From 425334a89d3bb25a9ec327c69d17095fd596e668 Mon Sep 17 00:00:00 2001 From: Eric Schaal Date: Mon, 26 Jan 2026 10:53:52 -0500 Subject: [PATCH 1/4] chore: update mbedtls to v3.6.5-idf --- .../gen/sysroot/include/inttypes.h | 80 ++++++++++++++++++ .../riscv32imac-unknown-none-elf/libeverest.a | Bin 0 -> 2782 bytes .../riscv32imac-unknown-none-elf/libp256m.a | Bin 0 -> 1918 bytes .../riscv32imc-unknown-none-elf/libeverest.a | Bin 0 -> 2710 bytes .../riscv32imc-unknown-none-elf/libp256m.a | Bin 0 -> 1870 bytes .../libs/xtensa-esp32-none-elf/libeverest.a | Bin 0 -> 2474 bytes .../libs/xtensa-esp32-none-elf/libmbedx509.a | Bin 92072 -> 180050 bytes .../libs/xtensa-esp32-none-elf/libp256m.a | Bin 0 -> 1714 bytes .../libs/xtensa-esp32s2-none-elf/libeverest.a | Bin 0 -> 2474 bytes .../xtensa-esp32s2-none-elf/libmbedx509.a | Bin 92072 -> 179962 bytes .../libs/xtensa-esp32s2-none-elf/libp256m.a | Bin 0 -> 1714 bytes .../libs/xtensa-esp32s3-none-elf/libeverest.a | Bin 0 -> 2474 bytes .../xtensa-esp32s3-none-elf/libmbedx509.a | Bin 92072 -> 179958 bytes .../libs/xtensa-esp32s3-none-elf/libp256m.a | Bin 0 -> 1714 bytes esp-mbedtls-sys/mbedtls | 2 +- esp-mbedtls-sys/src/accel/esp/exp_mod.rs | 13 ++- 16 files changed, 87 insertions(+), 8 deletions(-) create mode 100644 esp-mbedtls-sys/gen/sysroot/include/inttypes.h create mode 100644 esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libeverest.a create mode 100644 esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libp256m.a create mode 100644 esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libeverest.a create mode 100644 esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libp256m.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libeverest.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libp256m.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libeverest.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libp256m.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libeverest.a create mode 100644 esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libp256m.a diff --git a/esp-mbedtls-sys/gen/sysroot/include/inttypes.h b/esp-mbedtls-sys/gen/sysroot/include/inttypes.h new file mode 100644 index 00000000..a640f8e0 --- /dev/null +++ b/esp-mbedtls-sys/gen/sysroot/include/inttypes.h @@ -0,0 +1,80 @@ +#ifndef __INTTYPES_H__ +#define __INTTYPES_H__ + +#include + +/* Printf format macros for fixed-width integer types */ +/* Using clang's built-in format string macros for portability */ + +/* 8-bit integers */ +#define PRId8 __INT8_FMTd__ +#define PRIi8 __INT8_FMTi__ +#define PRIu8 __UINT8_FMTu__ +#define PRIo8 __UINT8_FMTo__ +#define PRIx8 __UINT8_FMTx__ +#define PRIX8 __UINT8_FMTX__ + +/* 16-bit integers */ +#define PRId16 __INT16_FMTd__ +#define PRIi16 __INT16_FMTi__ +#define PRIu16 __UINT16_FMTu__ +#define PRIo16 __UINT16_FMTo__ +#define PRIx16 __UINT16_FMTx__ +#define PRIX16 __UINT16_FMTX__ + +/* 32-bit integers */ +#define PRId32 __INT32_FMTd__ +#define PRIi32 __INT32_FMTi__ +#define PRIu32 __UINT32_FMTu__ +#define PRIo32 __UINT32_FMTo__ +#define PRIx32 __UINT32_FMTx__ +#define PRIX32 __UINT32_FMTX__ + +/* 64-bit integers */ +#define PRId64 __INT64_FMTd__ +#define PRIi64 __INT64_FMTi__ +#define PRIu64 __UINT64_FMTu__ +#define PRIo64 __UINT64_FMTo__ +#define PRIx64 __UINT64_FMTx__ +#define PRIX64 __UINT64_FMTX__ + +/* Pointer-sized integers */ +#define PRIdPTR __INTPTR_FMTd__ +#define PRIiPTR __INTPTR_FMTi__ +#define PRIuPTR __UINTPTR_FMTu__ +#define PRIoPTR __UINTPTR_FMTo__ +#define PRIxPTR __UINTPTR_FMTx__ +#define PRIXPTR __UINTPTR_FMTX__ + +/* Scan format macros */ +#define SCNd8 PRId8 +#define SCNi8 PRIi8 +#define SCNu8 PRIu8 +#define SCNo8 PRIo8 +#define SCNx8 PRIx8 + +#define SCNd16 PRId16 +#define SCNi16 PRIi16 +#define SCNu16 PRIu16 +#define SCNo16 PRIo16 +#define SCNx16 PRIx16 + +#define SCNd32 PRId32 +#define SCNi32 PRIi32 +#define SCNu32 PRIu32 +#define SCNo32 PRIo32 +#define SCNx32 PRIx32 + +#define SCNd64 PRId64 +#define SCNi64 PRIi64 +#define SCNu64 PRIu64 +#define SCNo64 PRIo64 +#define SCNx64 PRIx64 + +#define SCNdPTR PRIdPTR +#define SCNiPTR PRIiPTR +#define SCNuPTR PRIuPTR +#define SCNoPTR PRIoPTR +#define SCNxPTR PRIxPTR + +#endif \ No newline at end of file diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libeverest.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libeverest.a new file mode 100644 index 0000000000000000000000000000000000000000..48d2594292a26ea5d6267a2f6537de28d91f1248 GIT binary patch literal 2782 zcmeHJ!H&}~5S`F2f^b=`aLJxnBbjP;OVd=bTPg3L zUk#4@0^{(dkn?n~D%Of8N$(`R$Y%>RWs>ESi*Bgas!-ZgG>ZI`S7-wmxqn%U+uCWt<8^lF)}NTg`g}gvfFW=7p9e zk^)Vc$L6J;ZyUb-sC!!*y8&pyjk+6otHJjgyxrh80sMgjF#SF=VuIEb)}A|L)TIG7 z6-EG?Xbnu}S*8{^w#bcQ!_k|LHbTAwR-O$L#uT&3$|$|D;_u0QbkqJZtFqbWR1q|8 zw+DzR&h54t=g#l}#@xC_+@oqf_dIAmhY^-*(VR(zX^h&`8h>@`p5X}Qwsa1P8##j3 z#gTP;BKKG9pRiNT)ahyMW5>7D?-e2R@y0s@s^;dqi`< ztae6!MPu&3|GmUur?Km6tSoiayWzCc)Y$13jdkmV%hxVjs;;bK+|}4W*Re0SCgo$l gd%HT;qKdKYw_>L`U(5c7x^}PjE#9WN(H7191PSym4*&oF literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libp256m.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libp256m.a new file mode 100644 index 0000000000000000000000000000000000000000..3deb6f561edd2eb2626c85fa7abbf768ab0eb811 GIT binary patch literal 1918 zcmeHI!A{#i5FIz6qCUa7s$@=3iENxDLA0unst9tSkvJfZ&Sql?w{dLkE>Yn^Kck<} z59p6o{eUv#^}3FQAU7_Iv^($ZjAv(ecI2H;LdmORzZL$;Uh0#p1Z2Gn9``vmv7_d(3c^&p`*dy-3PyD-+ zvs2IWD9J)R_zV9Tz%L}k`-OE6e0T#e8V)}Ods1aun=G4m#-kwCd8apEoP`k&`5^qj z!}oz*fX`p>W0h#R1aFA2y|tm12Rz|MLxo$jK~<{EzcWjt3OisvxGVlRq0C^4;(%&e+rx9QDFF sPuzs|u{C+=xfZ=}+9;NV``BFM&ZHG-Q0QrF5Ckc^!qQo1DT~-n>3xa&IX>+^HwJmf$*ci z4?_Pq@Sk|a1iT7yaW>I%3C>egn>$o z)C}ilsZnBZ_O7K(EI)wA??A-HWRuatD7~`dufZcU)A=#0ycO?J0u+4OUDU~sPh0on zJKRT~?OXUgE93EdP(0RA&G(|1^u!#S=EpQt8rx2B4s)BciTrvDP_iFMJ`|nUxP*7}N4Ufn`}e5? z8!p|ROL^%kdBPm2b7^l4m)g}rWNT4T?QW_|M?Nq3eO>yDds06CWnEhLJFwxFtxf+z QoqAaEio`l@_119f2Z_QGNdN!< literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libp256m.a b/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libp256m.a new file mode 100644 index 0000000000000000000000000000000000000000..49a61a78b8736ddaa5c9163da575c6c0435ecf83 GIT binary patch literal 1870 zcmeHI!A{#i5FIz60-xYak(>)q(QF)(qy(W#6{5KyZdH$tv$2F*99z3fRJfE+=m+#C zD?Xr|u{~j9A;_%Hs69}Y|oz8TkvBS&^q-33;yxo za8Y3F=0ShZPQ$56=CKOnnNc@+mduP6Qe=~_9oOyH?O;J0+IX~c~hUaR3|4Zj9>;^+Z{zDZ3qL2p#)FF7*tcLQP?nFz#0YY;L^Q@lA4v&_U| zbn&^ZO(eg8C{9I0#;9a+ZDPID!&6`zNjeYgvas@gDu9l6-@=&kc=z=@KGQwSSzjUV zT~&|ohw5>RVX+p~q$}sz^n6N_Wz3!7GwdyAit+{w&~qMn-V@QkaNOabo@vnSZQ{VM zbFo(p;SIjHLqTO+ZwoP>2~k5NzEnBnIIsK!DyglYt@lSP-RHG+hl|iUFIZbb{%axO Z`Ty6_>RKv(XCx3b)<|7TyGT5yrN2+(#5e!| literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libeverest.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libeverest.a new file mode 100644 index 0000000000000000000000000000000000000000..7db4ad659b426eb242680a7e504ec6f05a170556 GIT binary patch literal 2474 zcmeGd%SyvQaB6)<4|-A1%X;wvx{a~%g$iw{S||!u!GoBl=}IfMkt9kz`6K?MU!XHh zHm;>Xy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedx509.a index f500f3150d9f3b2d5096a8e48cddecc9ebb479a1..25e1a5f2544d518a57fedd93c93749e6813a369f 100644 GIT binary patch literal 180050 zcmdp<4R}=5x$pPP>EGfg}*jmq`$$*oKsb z2~Asw3IVAd;uoN_h+l}%0>y|3J;?DWMYPmwduWg6l;iQX9;@d5|7*W%vN9RKdv5P@ z?sMNKE9U~A`m)4e-JrLetsjqHnc!RRq($bJJ zHNM)q(xQ^m+Ms^rjTsY)mXy{P)u9ewMNhr2Vo6ce@`~^|JjiPc~QpLW7w88FaxD4BGn4Eh{A1JCT zUsYPPw6vloboAKrqQ#Xp-P@zI`Uh&lwHT>vg|Eew|vpE(#7={o%*7l!^{a$ba@js6GEI6^%&N0R^5AFUR73og{qXvB|56| zF45Dv`r7iUB}Mhss)s$cZ9SV?T2)tGUDdrwD{9N@OT(41GkVN4TOD*3Qqkht3hcFI z)!pl`wZ^`zW+AoRcE+Ig68j?ysH{-$^>De;7FN>?t3M?lz^`Ya>nrdpR%gQUb0+soeSA^^rGzeMgWT3RZ zXhnJbQthN?3+%#ZVO_niw%)g>B4i(71>IKKp!;xJ2d&ksWl>f2;_8~N1vpr)%R;pb zLs+zUQO|}2%`TDEQ_VeWv9G8clYM!ZUg&YGs;;_BZryUs_;AgUtx$#bhE!cw8*UOQ zZI4+EZJ2R`_EO!|Sv~6vmaw;QxN(%dlt(IGRng+=%F2)lW*dav#$8!G8r+pt2iKTE zJr<7c7L_GE4n5rs^!kdus9Qg~Tb0+AAwdFY?uuFUEGS!Y<(}uL?P+hjc}b zU|h+{OG>Ni%gf3`j@sP|_?Fi%t;X@;0k!yjts>!9$?k4BkH3!HC6D-B?n2Mmx^ikt zE5i+KxP4X%h1+qvvbY~ydX}Rs4K6WpCHG1bSIjQE*+X1?o!QjYwlHT%-8*=t5r?Zw zj5u;Q;x~kT7&AVLg~M@Uw6@qShmTTUeQEmQ^y)>+ZcwV=CJm#ktJO-k`oth9`n=Sq zz;T(Gs>;!0vodX)V)u7%ot5WsIPhW67KeooNIHS|d^-NQEGtv#Qmu4rl#%=2iw!$E zI~$(q?6h_w-h~*#kF{|K*CC`Lj6wK+LB{1+JKFP{*2-mTFsL!s?&yLMojcnHT}0!? zt+5&dC)R(jEyf?e#nGC)ySZ;;py9!&#xuM6-`%@Cup{tzgI%g+6*3ynJl%AI)gIWe z>v3CKu>PwbJlB4tkDdCVyTI*kPjcF+O82v$+vG{GV|bYCZalN2|E}m~-z|R1Yim!s z?;6-=x64kfE}ZS}+tlB(4n}BIM+8UlefP;o=%Q@1g0o*Vw(nb?ygO=TlCAk9x&MdB z*TTwmFnYJc*8R}kG9x)TzM%HY-LB>wTj$Ri6*K7KIG^Q-Ip~_yd*+AV!9 z7~%0dm-cP`XxUPg5f#kX>fQ&pM~?Pc|7uXTs+Zr{_R-9v8~lfw-#*x7`+2nAxuk8? zk)xBkJh#kfKl@CYNSJ}BN5jOw2ko^9qBX%VB zUmszs+mFbAw{JhNt6g;M`vUC^waFcJvLll7VR!VRVez(NceEWp7*(+1s|S(?T^!Mr z-}Kksj%cT)$q}TeAi07R5hS`Ew;gk%dCr5b(U#S}@s@)To`JUioxYvP{r68g8F5f5 zTXSL1ow5{7xwbHlUvOL>rUX~&0KQKxuboDKtBY7my zD`;?H)tEp7>pEeD{?@4>n9e> zP0PcI9PFF3X%7?O7=j+&@`}+qH3p9y$a{n>yz_{6_LH)0QD}l=raf{KWOr6`VV^`Mr1ZUoZoyYoac%{qzruEi@9M9F< zcoy5A%l2=2ypJblLT%%ss^+et*1c)j-x_FW{mss;6Z3|{w$0Ihfcwq%#`b5|uWw%C z&pEbctN;C|gE44L^G02!V1IPsnhspnwXD5?lJ~ozeI)k#+OoV& zkGuRiV;1f9xW@eB?sX53%8Rgw&osqY70(xs?b{S(otWww9M#LR-f=mj^jJ8o#K&Q! zSLHm1WlfIm__%YF3oF>PsZ%FeVVtlu4dHe8`H<6XB3Ue7=ufe zV={(&ZH47Q3%v;NVHNVqkFRJtFU-uJduvh7l(~1znm_N>qFK}D-Fj!vthtjj+&NRG z<3Efc>M)1cKHssdG^Op*>wF!@Oa8Nl9qXmghi3ZG%(7Qv`qeh{tr=)V@WciZgW!}{ zr>X0Ukc=>ZN(gmYbXm5CWf@~rDEk``Q)o|~hd@8g2-J}`8oUL}b}?@<?1xJdMEZ zO8qVboJc7BA;hV|7Z7`dKSj(jVcE|RC@iZ*w|N{CP6Wnl5oo_((qx`X@$8g52o2M1 zyAHr|)O*2k!kILHgsZC`^en@e63!+OdfMoi{(0U>`Fq%phadW9tjBXAcpw7n;`U)a zxd4F@uHM%+b&A@E5sDq zkOw2sCJAHCVW&PB@J-P_2u=~+P6G&S$O(v58w~vcu=0VtqhQ_U*M*(X9|!At{}oJO z8S?dr>C;0)2=(MXh^bEmvk3Kr!1RyE^5UQF<51DlW;hsYr7F9Ch7jt>dY+dV_T}I? z$WKPt52nzbtjFO4FteyX5771g0j&G`N8x1Hd<-6jn0z%1kW^)_0qgx@3RsuD6~NC& zv|m9bgmsbi8sazfWWDcf18e_}f%P_e1&lxC^8i4P=Lsqy^iO8YdfztmWUW7E=*iJy z|3AQbyL<%JWAZ1kZqLVt{u3~Te#ty~vEILeV}+eqe6&v&m^R86n8LC#U?y4CW9X6W zCiJ5v!uoffVFbmcMm3nkIO)~J*14>!yD~v8j5hZ<3fFR{8hw>i|6EvEy^`d<=Ts}L zC=j`3euV%K+6|7CCIT~H!QhS@3Hb;Z)k&PiHE;Z7o zJ-2d~xPra6buP8V%zPeky2NFDqbmV&Swlk7LqpQsTe`$$4Yvxrl4|ajhNQVZYT?{| zR3{KKy*DI%A|!o2B>m@*^j|{K#-$nM|7v4MSzl^MdU8m5Zbn+7jUuRvAG>=F9EU)!9Nz;by?aLiYgy~_D=04RA^XHb3{P`hi zOD=ZVvAW%W`>?n%9&($)zKgEzl~>mmnYYC49CgDoOt~Jn1B&#`*{^-uwz|AT-9Hbx zWQwG^iCI=#UD^FkE^_SVtm?XTv)ETrQN7rzEUjE@+-9omy31B`Z|JQtUtQH`<*44* zbtgQi#0Bzh7loB&k2?f*L%QGi54z~O@sCy+cem{kweO>qR^noCup&E0ZJ)p27Z-x} z+InuQ9`{x41_W;=1sfLh5&rI9R{>5{#~_)oWLXk<2ypNu0>a~i!;60q9_t-R3e|jf zB-_m6reme`8&a71e@%9<=~R_){o2t>7$ zCz24=PVuSQDXhj&$|}7q_ew9U+AplyFYJY1hp=kDuxh_-7d5ubgs8EVK4v2A5Y8gY zm`pM_+u&S-^9`P5@NBa9oM&($nT>)hM9?dAK_Tp$Crve4ly}a z#`%8grN0jd??U_?GW^5~Yd=k5vla0V#3oT#kLP2e_aY|8a$q2P5$Kaia_kWNgX}|K z8=4UxCBr6FSl4?-^c*X4tgKh(sYlrhh<`792=T{c_{k8~Z5xPlhd9i)48$CxI5|Bg z#}30k2tNzc#tR$n9<<@MBge8~5Kb@Jj6-~jFzu%qd?y)YV-S)@DMWWxoOC;*q148gg6cegd8i!5sqUV2ApkXcHA}i#~2|NbBUsC@KGRW)8E#c zHknYx;iBjrh+V?-5OaG|PmU#Di+>QZo`>{9J?9lUb`1VOxHM2tALQ7v_y=LrsYkOF z>ptEhdbXFW^=cl%p1#StUbdBO;RCS$ zlW>F+US#;;^_Bs`Uc?OAX0YhlcV2U$o_)O2u(?ZYc->&JFzekbHry^Ri=Nj{ z-V^5alk;Twq|N^jJ?rX&z_#)F#x26%L0m8V1H|7K<~0O$tpt83TSWgn;x~jpK>U_4 z{r|?`^TNF5@Xv;x*EQHS%AXB=r(qw7GHfTWy|52t`oS)z%BCVF>thNJtF)o-6tPJ| zOxDK&&Og?hftalK@u}3KEU&}dCd_Mzi^;Ih6xR0licKTp8sYm9*9p^)I%dJ=XV5)F zJ^W+|>-B1j*nfriaj}^stZjCR4Y&IXVv{YbZMbf-{oD_JO-5b0!rJC-v7w*eicP+- zw)wqb^JlS{g_x{u{-&mhCT z9`+6b?P?X~n)VbKei~p;*7keE zhS!-733nj=l`!Y|ugNI8RycMX0P?ojoJY($STEPEuf*OD8?vs8H}`16>(AE;b6pxk zhW{4WlVf>sgG>|~uCX)4W&`wOyX%%twwIK$Pqo2(vW;wW!Lr~0e#3{7AWI0DlCCj-`1{voVlq>`X3yEm|9;CH@ z4m0 z=NZg(N&Bxbc%{K>4d(iz?Y9}c!{8STK4dVDf4b}$gSpOV{Y8VnFqmtQwuv*?YjB#u zSqA4CJlo)f1}`3=OHr;)yYxI{h2y=ts zYnYoig)V2VZZllYpzCfydOg0uZl!Y&tn@{7b(UR>+RG27vgqFHOOK@CF8nZt@n(!+ znA}Sa;H7PQj$RmB8MrSOS9n_!-*t z*Cu(0lxTksBW3!Vh4Ve#UtWG=9@G3RZTe#$v=3mAUlh)!5>jaR<7t!j_eZelFCck{ zlxW`{Aw|wsT6{J%{PEOC`-_J&)87-wilml@)3AN=wBjQ+lXp#3cf@yGK;Q*^Re>^L_lm$EB^T@3QCWLG2p^gN}%0m`%e zPxpi08z5&(UJC{<1I&KJA?SXzhWJ~H^k-6rk@ok)5Pt{Y?>uz$han33`(=nfo-=Yx zwP=6)L;P(UXrJ%WAGfn^AM0Ro-QPVJAo)n8Txx&sh4}L)+J5K{u7m!*3h{Ro{;pG= z?0?$de}?!Az+VbX=nok5Hv;`L+sAXaaQ=qCj=r-IC`S!{v}Ydo%YqPp5y&WjUJLCg zb3*)GfWJe~vwdC!?T^?8htOk8_Ul1SYp;rggnXV8?Yy%iFNa(h0=0qwrdWW~Mz@e6k55I`1D~$2Me( zJ}|_xiotB(Fa+Jc--Y;_1%ID%!4=W|_?g7?$1h&ej{b%tXn(YaX;8AUSkz!Hq(Q@L zwzTVmfNFyKIMCXI$;{7KT6Ddyrq5aJJlZO)%wP%brWM6{DBRr z8#eEEto}rv+wwafbT&M6C=CyHC7*u(sR0vOW30pvH*6?Ds%-ekgtjfwjWO2Dqs7qS1X)O) zJiX7SF8lN<;%Z=aZj&Wz7;HchiIw4TalJ`se*rP_sB z2IhUk@^5eJ+njVTdaHl8qj|ezjNmgZ{_X3ozQJ?Pk;5rQnG^f{8aHC zW<`AOCZ4<5Ll$+l?WSoP+&tcW)IQ#&yg1gcz+-EMo2V$1K}%P(CHozS%i;&(BEIq$ z#a3f4P)%!E*NI#;Z`N27<~-=k&h*|Bv2V_#L3or?p3B4JT9$*G9y2;_<}B=68M)Oz z2VWe?$-~~_-iN2uPCB%0%ZMh7UB2TFanWfJQ{FxoHOATz?WvqGqup)I?ARHFXHLay z%d+S2VPi(#02u7+zjNsRT|1)#FC2O*p<}PxI`Za+EhmOP<4!#B@}$X!ag%r9_=Nqh zM8nCEjy^lb8D1tXn1Kh9_C+7dd!^v`tFJ`A{BY#XvL-APiBF*VJbbhDBgTEKFFx84 zjpx}0CVB?8=Ow1a1|LH#D_H*@QvwZB-hQ_OgO<}aXLEdVT5RxftDR+diuL%vHT|V? z$Kp{DYt-(B2O1a4nE9QxfdF>wO6=IR@4okk0nUzMi~IJfrw3eJ8+a^nJ+x0_&VJMK z+}ea~>KT&YZ;rxo@A-}A zZ-Ga@w>jRKcZ1aywSG(M8=dXFtk%E+JnPsr!b*)=-`E`G)z8-MjF{{$b35}=tg>6L z8=0&h#M&7#)cxIzu>t&@|6bq8ZuP*{qyddjS3Eu3+4%ISiCGgOMz-5++8K9`d#2`; zO832*Gk4DUf#%$uInQXG=Q(!JeOK1?p7_?lF6)|X>=UiOx#n2TnK_&NISYHW{>Hu8 zf6LGz(W_S!ujtzpZ)I$VOFZ`RA5q(O%W4?gn0UsTlAZC;n#~gvHewiZvopr7Njx@w zLhr;gQJAWUpK;_8FC?z=40v~gEO7K6w=U}F zT=&w$qqt7`tZwV>dru7*&bc}!#CPCotafdwrFpF(b(5{h)-AV8w$dh# zoOJU|$qTK))Z)0k#_5SUf(LbD`)v1)@#RkO-P-7zVz<{5GbZWQDM`5<+wj=p;1k31 zw&MO|(yg1X9(foy{^Icu{dC&4n~q!4_V)_p9@>@66~@ANB%gjK>LK)XY-^zZqJU%F zgjgRkVzP^ipDQkoXxtvN{yF_*`niFplcsd@*L0PI2hbyeQ~Rlb@o)~4UCCXQKIr!J z?})Hg7p@!lqi&@ibZ>h7uhYgmo8IsAM0#L!ZCci%w;YW**1b)QzNyEiHg5N<-+oZ` zLnHzVynXx)@2s+tf8L4%77j2j51u2BS)+FPO{>1z_2k~;pYPdId=gX8^H?5E>-IOV zZ^FT);Z$bB+MG|0jbC@O^OIv4pUiSJo*e(~&CbS?8I7}?30p><*u3>01A$L>?MhhS ziQTpR!@yUbpLF2kP{Jddf8oq~v9oRN{w=M&tPO`UH$0s4$s6N0Pj-ItM#d*I93$tq zo*4i7WM}J%jMf>>gjYxIYMZ+Grq?@0VU~2Rd&HUdRA=kp$m3h~_Okl_OYiMiLVS5g zeADbE?@h`(k~Hny{&R`QFtr}fiDj{6uW#yK_U6?IkI>T=XU9XG3)U<=-kxvW)2sE( z^BXqQFTAjM-z_&G`>W0SoKY>E3$`yj);Po36Ug+m?Rg<5;gQpCj=%FY=gV2n({E;M z-FSMs0L^SWymZ!N$GQt%MT^^OsIta=_W~R%cD_p;gHX)_8gy z#ze}u-p4b^UGwMMw2989`#Kw4iE0*QEiQQIOk+}RcIu%fhs>vQgDy_AtRWd=3Ndxl zA(+2Dt1vDt=0Rs=#9jLwiLb?e-!lO36}ZjiaYpsCb__kSsQ+{ehm`}5j@WhDZT-%& z*6nrTKU#pwqnrC~ajdbo@#mPpo;HWSFRNdH(=M6AIL0I--_`oOzyGlKYowSIIsWCe z{l9^E_TWQEtWTRNL`xuwrP2zM-ehsvaS3`$aZ>Sc1Ij^=+_2pbJJJweFsrI z!9C;Xro%op9{bePLuIA&y4urmjkT!bOOJn7yQlY(EY8q|vcTz~SiwBajmN%RH{k}X zqZ|Bz3o$1Ky@j>qy5HeU{aQH2gW@p8DdVOYf19@dIlJBT3xiW1d@t%Ror5k8sq^9` zFkZeD4{grjFzt3`zwN~tr!I>}?8Z;T0>k}VosasRJNni5`|jD*H{kc~NZxlfBiEi+ z`_}A&(z|c)Pn?JXsfRwkGj)Q0dUi7G`Zgqc{dc!bWi&RhrEj*s?*_lOZ7%*bBx5jH zx4kCnSdAawkAM+u%!z1DvfG38m1|!|wB>i4$ZyZJ@*;7@Jdu3y3T7Nqi= zFU4*=&iPWU!tF!9?`$fyQa5hLDMHIZr=3?YBi>UsJn09?<&L}i4&SIw!$Zmru>2d_ zwr}t^th*KmqOI*`&o<4o_!5N>JDlsn4#$PfXH*N+`J!&Zh$wvQV}A3Tt^V@STXLE= zdTtAGfj4Hn7ZqvYJr~=Xeg2JG?rX+F>+7zK>iAu!Rq%Q5v=&dSUdhvD9dyim-0p(M z-IQU?d^~NIe$mAb-JbHOYeQATajJ$dh!}RBmCY`HzxUm($G!;sXEsiSTK?F0>>_sT ztq-ln*y2)IF?kZ+8bESj z6ZV%Tywf3i{EN=0Q=J}sJlxux3FY`l9BQ}ZdbZoi)BoVgpw3dx?dORUthf4Mz3!pj zc*h6&Xg8DNSaSQ^+xe!@+Oox2W5y_SW6^<3T3%JRyr!nQw!XCFW=kt8eHCTZwUvgd zx_)VCEem=lYAY6B>Z>hT;j1n6R#ulRuPF6a^|0t>#n*6BVar6X>596bJNpG{-m2xe zp;haJA(wP*y}YWNt-G_du6lXx;?n8Cx02CNx`5sxQ9e7Tqy+CUth0tJPuG9ekisE_ z6R-SFyDBNK#d|=jYag(?@5Qznm*YtGB{n7{rn*+fG`)=TxU`n`!`b$L?>(HI{e(>D zXYJQe{Pr;BZ6rQDAU^2STV~UUe#0g@qo!GbWFGsTtldeV~Psopn5V*!~AtQ<*B{-Rlj$`)HFpYS{jJcHNI$PZVZxYtjJNEZcIr zm)Xtzu3`JLR8temT9e{8k9#+2DF#tDLFQ@Tr;!B%9K-fsbwu?mu%cnuq>-)D@UaW; z@pva{5lZlwSvK5>{~=|gE_UKXEa_@JvKX4JD>ft_in^UeLX25a^XJ3%KdGA3o}@Oy z?>iflt}dG~=#v=dhcS-RIE=-(P_Eh0HSkg6t+M?KTVuWvwApgFHRdW zC5=97joM^+*JJxnvsS+{drRM@p=|W*fAV6mgBvhV9eM7ZVfzzytqANrbmVaE?&!U~ zL3Y`_NrT>*=)^~W;3RB%uCv{j7)-V%B`%s~b@Z`Nc;q3q-soWo`rkD1kDLRKcVb*H z`oXgKnFVjZH3ipnk`jlz9*FVu8r6&Ith#RJz_mMs*Kj_w7=iJvNI!!xq;BrqS>CA? z<-F}|C+3#c;;oQK+*;`?uRwfYvduXA+K24hvDKIrh8+#RYx2H}W11cjP zbmhBn+Lh&8Q8wbRI_b)ITz0`tXK{+@MkdcN$2K|T1hWI@wAPZcfw0CYscVhe2Ac+c zHEsU~+V-xp#86)YznHfF7dn4hnEcPD?SD+?k1xBvNBPgDVLN@$sZEBJ4eH(i_g`Sp z^iI&=+MYhn{s(=W44OojC3N?3{NL&0wN7+6Ft%ZO^aLl59z*JK%a@eb`zq9M`_%iA zht%C(UFE&Av}SopIo>Xbw}1|*n~5{gTdNkA*I>a{Ul~9_d>|Ji;ab3kuDJxTuBbDnMeGv~ko zZsJ{I^%lM@_eSf^>9cRWEqC;|3~O$F&S?G{GbU3-H;!Y37Z@_SakRb-Y4IbFd<_v~ z-;3b2{v?D{D*hYZA;dOObeyeH_I+O>@8wZ+KJP0~cpgQWXGg*BDR?EV^L05L=S#j$ z^S(Dl+v8G<5^XnI(zJJ6fwK*p6oc7^aAnySt!Mq3*(c3xpJuPYrv0Vb#y;q>rj6;- z^uxYud$TOZKlyH7%_hdtmgpNOg*+Q(ip;e$=Qh6w*LvHj{GG!PMGf(;{HZ`F1U~I zJg~N32&OPi)?-)-o&sGm!qZ?@O`9EHU3L$c!n77Ww^v*>%9$3 zp*@*vKK(30Fz1+V!*>k*BVav$IN!8?o{MS!Pl74*Po{5%rx7UO`oi^@HjK6ZWYIBB zL7;>yJ0E(M)iLe4hET%UbKj&rW6FQkhV{@7V+#F{^}3WsC4_pio*NUvEJyt$iCK=@ zh!UEqEXur7Bym=ex^67;lVOrZ^#`#AMCBT%R(v)yb9 zkM9)f$-3`r!FoRY5KN&Bne&Zh+Yu<#lX00z=?^1zAW(kpngRrqG6*fS5L1 z11Z##ry!>OEST-2{(a$O@Of|qV)92|3T?FLb%|-s<{CxcEX(sLO1QGzMzmv0p$$15 zfn~XNv1;mh&T=CH^;HNI>d9UN>VJfw*NxD9UyskvU_)V9GGmr~3Bf7peTcRFVK9Yu zWcsJw8Hri;ECPi#TJ)IkT$c7arak*b31@GPp|+up`z_0IzH^(Bxwh!>DFo|zSYhZZ z!OtMD4V-%v)=M6Vn0`X%)iCI2UjZ9E4$HxMo~#r-ZPtMGIrBqc>gfLwus&Y%S|^2i z@^Hkod)v^Hxwa-Fd}ip$MWW}sH<(2~dn(_L7q!jp!c%yodO z(08TMAMKAIQ}_KfuwEZN0_$U(lLio$(W2)7)0(+HqL}(@OFiwW)8jl5%zWy(t+oFJ zU@t;40@pXqTfu`7s6U91B>Vwlt#@G1bep|k-LF(IC0v{TyV|MS&(B0&w2l3m0@iJw z0j7j&vz=rA7c-UU`L5JarYW{`t=DR}dd4|y?uHYG_t@}TJ_if)U=b)bN7UqiDB`$T;G}8mR5+Ij4qIIcUAx}5B z)aqsCCv_!Md9HL_((~QCJfd|8-^FW+OC1TjG%l;QD*1PY zp&!-*a}Vb6n|jJXgnqbEW6lWXuVp60&L5|qX|Of+XFh%2!s~7Qa5nUo&P2@ee+WtQ z{8J0_BaA7-^Z-fo8dE>Cmhb=3!u*><(!8!i2`Kx?)^{YG4P8I1M?CgxVfp7JT?g)m z_31=NzCNd98QTB5`fUlfuu${j5AILDJOGJ~<>kG9*1SB)u#oy(T2x7Lxv{ zq}QXae%5r0?}VT{jnEHQF;0ir|5?&p5BuRwaD3kbh39Dfu-+w0I$EXYT716)#ZJ$& z3MHKjT|az+ykF9^VShJD`gWCnm-VcqIgb6T1=gt$`*$VHbF+T<-L20heO9H5EpG%s zg#K@mG|x@@;S=~hlID3$KU@`PkTlO3`eF8NlQfUV{kVSF4|l1^{z=9$cqMVYHFfS? z^QPvfjL8_+{r$M=;qpto3%H^*qo4fy5qWwbVEB=yk zusMs$>+w81f6g}iPb}j}{cb-use2i!S5MyS=jek&$hQ-8QwDzy*?wq_riURt%dG|Vr$hI7!pFX~0-p>>2Y`FcP0%q7raobEb|Q(ebx z%(XvjICx6k&S{n^_w+va#g+9r`a%hr3zb8Jo_i=R}olua}A83ywc zh2u{AgK&-3W%(IV>-iZ)>wC0Q>f$v5-Cxztc~C%9JB7VSJLHsG`H}Ha{gqQoVN_)~3i;o@-sF%|chwhZk7@%Cd=S-!Z`#cNy1zUeX;ykUMOAuX zR(%mxeG&H3zp(0ye1uSa;ROmv8iJ#kWZ!pkh&~f(hfk^PZ6|uQ?S!*w zv&go|B`>x)pIl<|EQ4p0r7Uyx``T20dBG5(#!y)GU0C&9%BsGbe&p0$`H}uAKk|`T z`4JoCXNg^x=|_#B_*7$P`e!CY`8V}Ah0x*1X4S`eHuJx(OZhQAwm62^HcBt7{0l4p!pi?J+g|w>y&6Lqb2Wyd_p)B$ z6oXR@R%0kOY7B+d7z(Q~6joy>oNf5YCCk|6lVyBnk!AkOHkd=B*VsZsztG@fvh0r~ zhJLBR6$aNBTu-I~vJyeJVYR^x2Cp^PPre8LAT0-2!TdZH7inMD<#l|r7jX_59|n1t zt-)A0{Nj+J#|Jec+zS6&m3VEC854IY`$&ikCI2*$De4}(Iy|U*Wk%y*hIjV_aA7(?@`SZ z=69#&3e*3$4CePuXwNo0YVhNR&Cd+|hX(&M8TC^BEX+3WoXQ%;7p5!DbJ}qKBgfu>e~>8%v|o;xr*5?2{3XZEz&{92cXVBg$gttOCdbakKgd!9 z+VHSgE&LtCD-CWC=3M>}8Gg7=kac?=rXGHL=fF?{~)IjblG=>-$%@A4%D+f|04YFi2qHPo?y=%pO2jYjshHED|mXiXqMQk2J91!Mr_;}xpb&;PJeg*MM z!mRfw8TDof>w1ri4ezD#elKk}PszI8^J2sA1^!8xWAcf?e-q|Df}dVi?cx667G@jN zx-kX-8H~W+S4c)VwT6g(tmxTJu9LK>MO+|Ed#2;Weue1IBi<@{?z8*JD0?393E>YB z|C2ENaQ^8wxY&Ma&-KE*PRjj_bzyl_tjCS}2JLy@Kbs62Bo%8L-bta&EX219-;G$U zld$LhPS*A{VzUbII^j8pHwXt1w;H@z_zdEo7`%rJ|7<&19}8X*n}dj77e0mfyfDXv z*NWNZDDWp__~E`uj-7{pkk1il!+WXR_sIM%LO(L>IW}Z%pC~pkv-d&Rc!gu<10Wd) zalLJyGlluxKDEw3e*(I3^aG||?VFq|5Os_IbGy%@4Vc?Y?T@gpfsXqp%aZ#ckIa6l zbz6K65^Tl(ZU2Gj zxgE(`|0mIV5tFt4FQVuAOxAiQ>Z5;-C0XmQqF&lFSa>Pok;42wXu2@hWW9%4~4ls??xW|_z>SuhK(2cCq&OS_eYv~jsZEA9fGLsj`uzhBE#FcFq*?X>#0_MW<#>~0i}4TAgg~1|5x0_I!#0q$ z|8~)HHzCLR@DH*Bfn|>(ewmE2S;D%kT8m)Aww)52Ny6IZ4E193p78Gwe_-f;FI?)h zfAg7jWkdHBLhK^^gY@RMfFGV4s^dFsa-k>3a%Y7M5t}}UX9&+mTp+vR}ajCRgOS+d^NezBp?9|&(m{3Aopb%B0TVUvKs-|kw1_y%&8 zy*_ZMB~uuYV-OdTVPA@Pk+2_eH5oQsA7Vw{2eDU}`(LubtXumTBg}fHk^wAB*8So~ zaoR6L%x$BY?IvG`xI*~*i0>!E53&?%KdZ%te!gq4I*xELfOrw&uy|x59!7>f0&zAO z`r8nzV*&U{@ZHqIhU25!AgtN|rhFTLHk1YgGRLZoEPl3$9+6rHsQ(UFjVJ6mCgfOl z8qybmHbW2(B*TXNCF}mCi#{GPS?k$1mgWA7X%yti!jB*>5axC+7iJslg&#o7pxdd| zIb1e9?1Wtsr}C{d!@pTR%1QzcBds!e1i(PvNzQ2ciu9 zuz1Ox;YYuEUN66a$a+y8`m zuf5Oh5aw9DM20=*Gg;dopx$eLXZ;hb=I@ejgn@9^Rugxl5O#XktQnZt{JkVu3$?2IhuCUfFJ$ojK$ zG&pXseGYr0@EOGS8r*K!JY(peH(2e1@WZldeYgc6tjCSpH4b|Am8?Jia{I9j+&{QK zka>K$oeX=92RW9L9a4Zmn<~WLGI%i=_8c>EY#shVY7nUBIFMuc!344rfqs63c(w4) z5I2%x&oL(J&q`|jf&D({enlJb8;CoEIj;XG%yD2l;w7=6Gmt&8KT2H|AJx^@@6*fLH^z1K}doug7NjM(y6T+M? zM})nI|0;~;S=Tu1dM6@IAj1#0Tej#wLS1}bg!(k-YemoBQ(Gx|ZtL#|1J(EXX`cb+ z=W6zg*Ijl9)2F&737bsV{ET`q?cWlca>RcSeHQdQf2E&)LRk+2?YYnLJW}h6h1s^n zVv`LUzRR69Pa+g>BXKj);{j^JEjJ58{+q%+#A;uF4cmA>_3$|xF zmp0(#}bdHg5~_`17uz{{tCiixHFcXUUJLM_*X)pAB{*P5Tn)$hxi=>cu|R;9=w( z`}zi1+pBX4vClB@|$6{cNQT z^!4ZqSsyoF7X3=-$=Y5Wr=;Fr(MFiZDKd{y>YNAs8Cc!V%CXl-vi8F~+Vhzi_1O(J z4XBH(ZTQ;@Y};Ds$y&dXdX(k$nNiA@XiWWAn0BYMtR zvey5D=pTljtlPl#LihcQ@CS(BGxYyVMtj;&maKjLS#0`1PjR3xln4aPTq87l3}zXv zk25&l;6#Iaf#as&A4Glj0n<0Dq@H!EV+R%(t|#NE2M=|~Z->K%_1{Uo*mGFPYzq%F zTK}Lh+tq65eSt3v;~p8hVzepAQhfPKFc##)gt^+FpJQw?WL?4{zqJL2I z!FewFpNKv<&qaSo^uc*9`rnD(i&)Kb(W`k5<~(OV*%!87T_*%{o~!vUeHn-}ZPI9u zpvTQiJ#08`gAG>mANmE*sriqxoWo>Yc9vnU=D+x18Twp>xQvXloWo>Ywt{-GSMy(( zWvJhZxQUFioWo>YwuO4JSMy((WvJ);eTs~-><3wweU^H$SMwhnod2R{dD;Z$Km24v z*JJ*Ry_)~v;QSZ8n*ZS7{D&XT+aB{@?A81S2j{=&)%*u1V>_$)4?p?v(_{XNy_)~v z;QSXo%d=lo5U0zW;Wi}e@yQe$&WG{BJlB|L=#gbP()eGFN5b5fw4U=`Gv~Ty&Tq|L zgMpTV2N{U+bA!#?uN<6s5aovrgLn}fV@UQ~cZ{`}rVdUv2$Y zzGOiGS&N{@LA77TVH@=_4yw&E4lhtI<8X*9<8Xp3<8X$Yjen4j5cD`)B+EE_L6&jg zd9s5S7$BU_nt2S+oMv#A!MS8!c!2O8iDup-(Y(~)dV?DbZXw6me%cJ?wHmG8WAFho z4>FKr2ET3ad4oSD$J+Kh*VP>1>|%bGMe7p{PBl2w;B14{Zx4%qo)5 zhlSN|4+|F?_7w)J-yRm5wT6C!!Roh%#YX-1u(0~=Vc|oD{RxBBZx4&jM~40)nL9c} z{r0dh--E98>bHkQ?=|%5w}(ZqetTFr*RWB)JuG_l+rz?34IA~_!=i66^y;^VMX!E) zSojIUM*a4%=+$oz3m-FV)Nc=q{=A`AzdbB^_1nY35!ml_-_>sqi(dWqu(0~=Vc|@} zKHFgR+rzxL1yR2}EL=hxVfEX?!s@q&h1G8l3qNew2MkufJuEirw}*v~8aC>;hefY` zdstZg_OS4$hP@Tl)i#g8@dl?DoMG@JgYylZXK*o@Cx(y;gI5~7*5C~WZ!>rY`5U&M z7YsgR@Ck#@82pjJ7Y+Wx;25mm+CRS|?C4|HF z#o#uBpD=ij!3PXJX7JkvpEvkpgZcZ8x@{3S=4kF?aH7Gf24@)&Wbg@t&lvoX!50nw z!r&Mj8+9M~eM!w;gVPMoGC0@Z*#<8(c&Wkl1~(YoVsM+mPZ+$%-~$F9Gx%+ClBMK4 zIoalq4gSpF2ppfaO&{`L+dk3YRD&}O&Ng_K!G#8w7+hoUYJ>d-KWuQo;AaiqXYf&j zPZ@m9;0p$SN=~u+$d_Dd_81&*a0+>-ZJ%NAB!lw}o@a2e!4(FtGWi^-$xHe2a+ z4^-Cs79p;$wd19lYD+78=@sSmrM13_^lopBP;WZ0-++>Sd8^>7Pp)idUBRU1drq!U zfbSu>lGA#=g5(N*@b-+aVWM6?as^L(&&Xv=^jk+RV`9Gl<8o&9>rm{sfn3He^z|Q? zG37R|sw-NIUjZrNFFjqZBed;$XUAon*7$1cN_)I@<8rRUzsTbno!O5^jso(?6F*AMyHQ98{MPY9)&JzZS3RW8))p{;SIX>?n~wyyLNaRd%q4d z3bIFEsoz~Yei$FdE`KFIhH3b%qF)4rouclF&bqH5VOkcldR)n2i1{VAD>qru;>sE; zz2|7Fyz)A{rmGH1>810_maCsYy4)@hW-;sOFLWgfGYa9?uqzEl_);<^;dZFY7Uz@k*l;w$Nn;=Ti1zHkUFDF1=r?AwlcQ^f0(Ye=Uze>!8PO zE2C_G;{|l-i>oWuZ*irstS_yq^QE&JG9Xy`ahBGVsHv^4k+Zw66?tKWTTd1)y(-}? zLtLT{ie_GdA!kcYA?^v{R*8Fz=J%Qf<)R5wPj60qGP3 zE!rQyQ(*c_!F^QTm!&^k_6z#^1K9NU1kz~;TC~64L1Fq^34g`V(H|}+1^v0<%=C9k z@(?M}{vu&y`a1)Edi&ziM9?3}?^F0Y0VDSJdIa4*KC=fG!S#>#>a`E3gS;uk-ywX* zLH9Sw@OL7_-x>JhIBU_qUk~wj0{--T;pINvJ`0PX*}jWNgxkJ<3-QP23-tCKV)#?{ z%aPXWJ->IbO*c;Lm>h|E*@kQ;AZhT&vElgfGL3GZFQk3^u0Xi$u`tA+m1954L4Ul| zqy7CL#2>#iFdO+=Xh&%Z@plIP^#03BGTPss5PxY%n}RMWc}eVa_ND9&z<}d_CA$vs zr^lK8lBF(2x*vz3CudU$IX0zhyJaA)`|-OFf3uMeH!kNw{GEqCJ+H-n}G&~#SwEf{w7xZ^L#9t~-9s*(fy%yr{=yZG^Ui@L{3i|t(5P!!o8MBeE zg>9nzA;e$yEc?5V>@UBPMLYJF@4Ybl8-tUPI_R}%fB3ojZv9;ie|mq*fwA^?Lx{iC z@HbaG6FVkHg!rqt&9aK2XZx^eg8pWRKRplr0sg$m*TS|l)P>Z``>J~|ep+-tszT~L zfqMBp8rGYKp!@Noka`0cES|S$(e=I>Qtuwvt=C3~b-gcz)ce^StRry3dZ&vWx5wF# zdMD!Ki^o$fy51P3Y>w*C}Tjyb8)JwhCgu(u%ia$Nho$$x@XwmiF z9a66c_ij?O5n^30zjI>NTaS}4p1ZTZcZePRuL<#&0e^QvuSNS?9pY~f{INX!VJL(B z_(_OA-p9f&7ZmO9V2Is@OW3LJs-QH?m9)VwSD2CZ_uG*69YFhvkB9OCaB z{H4H#;?>T?j>+92{&I`Ew%Zc1Af4^Fask-RCD5TymV8{2TXwmg9 z2&uPaF}9n``$`z=de?;1n>WyYzlZim*9?z{ogU|vuuIWKh;_aEei1oa^4`YaVd+r) ztwF5oRo^#4n&*U+ZSbd=XDFPFTh^~=Cl^=@68Z@8B1+DZr}S6v_IPGv7--fx@9$>V-JAy5op&3 z0q(dw1toAJo}Xr>h^`mAe>b~rt1Rm`EG(k!ZpiR<6EkVE{eN6$rm`D7CUcyvDRzJN z)>(NDhxWuV{8n%rSp+W8ZX7|ELzcJEJLjugjWr z_UQy?$2xxK^#1Bll-fad#67*O??LD8=p(-Aw)Z1R(_6MqIofAsL_zddQL)yJlm{d1 zoP+LmUru{KntLQEXJ1OYZ;B_%&gEx4>!7p!Ey*u%4@wxk$Tz*+Wwi#{Z(gs zFYv<6TiuOG`JSkCS3C1ctYHsDOH z@00N4`ooReJ;{;QvKQNZQ`c{|ZNE5vBq_IjyY>3S%*4<4CQYq$4x8A2J3iN+?Vabc zW<1mGw)$^%OgZY9w(Z|{OP_W}+GU%D;@BV@^_xyKtvzW<-i=mc()5D(=t@T(*7dzk zYvHkkcTPIjJvw#dk%T+PAMoyuJmQ;q+BZu#_8a|YL>x()c{*uUU{5`_$M_dB_c|SD z#9rN_XGiQ!nwjv3|8X~z4~@_XDt8&5CHmjf@B-#E%O*@+F2kR02(?v=<^r#1AAfA#eDL?(=d zc6^qz>Ap@B+9tCu3iY6)c@FN1fKicZF7I}(-h0q>GGcae-=Wc|AHME59k7xE4R&*q zPrtiuqJP23=sWYR9SaUdCG4{G9w*BBEKhXQV9OtOA@|I@W0?nCyPbt8&C=dV_oij; zGmevyRNI9%P3*O+z*PLuy=hnUPRAtAL6^7PYa5~5pQ8MZgRTXI3l^M=)Ma7%c?3)o zGoJTq9ZV-i_#F%U>(^JtZ1TJEOV+O_`1CI)qr2ODjtZa&*0AZgwd(#=%Q_rZWlR%> zqS8GoYS2ZzYruz}13nq;t@Rea01Ci&+NckmjUm9hTN>sc2M?K-s6dBkVg&Gb7n z+73N6;OsF+tiRdm>6K8i+u53Los2r@vJFPLH;st!OgiYQd0Kk5X_xb}!=Ct0{^5(A zj*Fi?^vD|~M*b_k=2Ifz0&n(ky(?qv_-m*oFG1jtW+X_7##-Mp%gm;s>SD>unOx&>) zvq3YWkHzimiwziU_vwe&rcpZ`o{BCNs$US<))x)mvUTaQW$b^@FU(iD?9Hn^z40!e#NkQFYbr{3^^;D59WP zUR7WFfYRInjoYfOUE-@MU*)SW7sFXlM_U!ui+#AS^Z=f99nqBE^w-{wUJmPy`N)gy zR>W5^zpA`m`I|crxiR?R8ee_s9ksJ-tM4zzPo=1=(n?=>MNUacZ7IIAVBe>{eK~Ia z*P=wERa1>J!R+}FeMB?0x}+2aeXWwJIm^+SvT{`*-KsCIuV9YHs#{*GDwvPUS#xi< zmXzOLYIk>j#0YEJ?N&J&SMIB*gYihKrml2(Np;l&l}P1SOG>No-6nS1be?9FRHLy~ zQ>!a$s;f%zLr}e1hc-X-Nm>cM@SHo9liEHn!H}!ZUp$oXx|B}yl*fS(hk#Rcbq$vH zV{|$N%zP}Ps{9DVJde?7UOQqwulex&ItKx#*unG+F!N_2aK$S?;CT{0wkZ315L2(y zJV#^x3IzK5HUitF(?1ry_Qz|%wA+b5yWI%56kxq7>0csde~(N0*NEA_vy%P*F+O&v zXZ+~r0s_Yf%Y^d#DPp!qr~eA(X&6tNXdj7~`8v&WP4>U9Ec;M_ct?CN(}t)89{JFOl#&(_WRb=K+y(gu;B*Ltz=srrvAlIghlBo@Y=giAc5M5r{Y* zI!*?s*;&E%Fsbc_fN8H|+7A;QnWwZA-50Vh%j=9R%b4w=O*X={2rPRS0{0v07a(Z; zePGTh+N?&P(1y%w`_w;;;6$Ka&sC-mAY6k$o3{|OpL5_S(SL|om;DIr6@3I6scm@Q zltTYx&N2EN1m-0XGVdW$XhYU@JqTvMXwv}JW%-U@{3-i~0owkjREnO=`OUIB3_V%f zKM!UW>wN(*R_y=T&|d&2ik{Dt;^Ua|c|BN{^@6$2u&y*P{*=#jfSw2_#^^$cIK6Yk&}=qEdvADi-n`kdK%I zL5pqJ(6EE4jc75@v}Y$pMT)IbPmQQ;l49Uc>`|%}5v`@x($=;XQK?0F|NmL{y))V1 zN1y9F&vmZrohy_1t$W>b&&QfIYu4IpW(ltYt4+=u)jGTztjCvYWon)9HzKvu3Z`RO z)M@*f3;}m*7y##r(&_XmqrUEANWT-FaeLtDC?oUyr+hcO=6?@3M&x@DYChS|(J`(% z%_q-0#$l*sXJ4abXFV;4XIgi|)6ouD^KdU%^Kc(n^RUt4RxsV^@{kBQ<1nP74tW7Q z(_I9=O86~=bkreh9{vK>JiKkm{{g0>K3VnOrx1>EvgY}?#UFy{sH0BnO}7~`U3I5^ z_n23pJ{Rkp*|!0T?e}D!+er}#`?eT!Wcs4SqD2ptP4-_g{hl;3KCjk&E*3qC_H)l8 zqaMfKw-fX~|DD)q`*!UxJ+`bq7i*4)z0E6bpZo0Z=CXzKxmagJ-v%f)az%2*u^6pP z6b+ugLr_0owqo!+D301*5VgH5YWudRZMJ)LwD&{ZK*;URsBMl*)N%i7vcdjh2(Bz_ zlXN_fhoI-;ctRcZ?ceygeO1){1yS34&xEcOeh7NkyQB8+lx?>EA^0vZ-vdxb`|n3> zyB{DetF6H3d0d%OU9ob0{W9|w_4EamHz`l>C4^%&bbOZtB%k>84}tX;MQAK3ilZ&va>LHmo9=5v~`Z-1xK{Y+y0 zvf2uh4fji+k;L7M!VKP-#fxkhd-vbveihTrzh=1qcQLE*aZ$IVk(ibOig7xzooP$k z{xGV^nVUS{2|i8Ycq4jQ?ZW!%CG!`S(rCVFFVt(oJ%1YeL zoF<)83__)$=sFj?1}Srwe$S8X$iu+`9D6LC-QDOG^i6)mzR8c+H~A5{A8|Bqyc#CsBFtSJTPU-Nm6=bj zMNUW7?^|#zN;%6!R=Kf*26bq2v@pl6YlS&R<+kS2toaUo$~l(RbWJ@Y4?KpZp5{Rvd?UgJGW3TFdnFHd zi``yx+ANcQ^i5AH|sw38|9O`{a|81PJs_0c2z0>WPjA42#Wi(e6DxwwyU z-$eK);lCq%TbTDX9|-f9^1h$?yyrTTjQnI_KUwpiB04<&0ny=UMfOUclPNm9&*HNI z+T^|4b!6CNyC!=B0JzzrLw)}KOMP;sFx%l`Vcy^I`mZ|NCi5OJNQV6!*d%-Xv@UCF zLY^z^l|FN$=;uLBR{0MphfSU@&j_;(?-J(y-G7r|GaqruTK1PL9gaKH4&x{vBO@-` zBiYNw0QaG#lZf_N!(L7fC)?-&4FK0NL8AY}bg2SqdNmFoq|uW40@4*NQ?+A)2I*x|E4+F`Yj)y^8q zrHt%1l)od)y!{6maamTf+JA_0iMvB|h9e}a{Z7$gd2!gx_l-E-zsuqli($^_@ES#1 z{2mg^l|fFyKRB`;FLNA4rx0@Lu+GVvPg94`VY=)?sl#%SHJ=M8htAyy?;t~mbx!t< z#Xq3m->##NxkM{I12U$7DVLgClz{GU&D+*rc5-c{bbl-`N*0#)0QNypNI~RGg<9CMY-7N6&*i9vfB9-vhb(Tf zxYgpY#ak_Y)Z$KyyDZ*g@$(iRu=ov&k68SU#m6mnaQ)DFORzY};#7ocJv3RA$4HkziZn3!4;;_YAEq>JEPK!}hj;?u>Kt7uixnJPP z1(yo%LElT~hu3w2GRZi<)Ttew+iJ(e6+7vai=AvT`ZqdWgVatTnHNB~+3?B>EM9E! zN-{e_IQ9d|Ef%*~yw&2z$#Rl*S-j8U0~Wt&v1xA-_k<-+VBLy5*sIrki9j z?|oFBY4Jph^DH*&NJ`!~Ceyg(7W1A^RWl#bzBzvEOOQcUkqv@@Sx1tC3pg_`MmU%H!e$*wVY7~;@B&L`vBhQ`NzpOuND8-D zI&EZ(8R*P9lEP*kN#QO_XP?Dp9ZAtK>qrW}W9gi**sLQdI%XY7VSgO*fNLe4Sw~Ws zb0SopZ?RcNQgqBZlEP*kNnx{&q;P{3*Q_Hc@>WZ}#bUFLr0AG+B!$g7lEP*k$-!=( zKlj=tQIAhQWnBjMxnkcF)K63G_YCt>6zwOPpQ+Zj8o_B7UU6+%&lb%TcxT*c*MqPg zAiL?BY22q&#%bnAM^(dTO=*r&mzl_?P8zQ}O_iOhb!vTml1^V`eUgSR4{HB{*&{}7Vfcet>!h`T-yeEt@(|L^mU}?j<1j(dz!2OzNRoq)Z?kkOu3_R*esc7-q=p6-|%ME)}^IzHDTv+n6WNiPXX3E2Nx zdPBvYoo<$~?Eceo@Vyzk9Mu@>r9*|~U_Ejl%aI*r&yQ_+Oo6?w9>WWx>@~w)A>_0- z1YYe;7kj)Xr{nKxtT%PoH1%^S zy(3Zfj$;SUIdy99_fhsH;@R##DAAtw70e%>)j>6qzZRT~A7Wdb+8Y2pa-QzMvt^D$ zX^)SMxsUevT%7jwxUI*5`3eQ%i1brM4}o!S;-r1v($jP=hk~8%mM=IC$AC=N53lLY z5qmsm>A1G4GPgC|uR>35GbnbrrfQBM_n&6Lj7u%~aEvpf?Q!=lQTfXc^tFR@?AQF= zDfv^AGhpux?i8o#u8gwR413gLc}KykJ?cX>;<7N-NkUuYIX4`hdOSZ-yhvXFbhy^r znN~zim%}6NGpM&X19PQMqi3#qWwndPm5p0gy67UmJBPt+56e^ z92T>Jk%@`S07^W<{G#NZpDY)jvGG~o7WgON{|Nst`2R`AxfGiZVm`&|m{0M))HVFw z&6{=0eo9V9)=ir=!+%>vEq^UX{ZICfEO!z|)-9~7TV7G?=WpdkN?CpN!aD!*8jJ^B z*~sjPQknPXP3AUGtS#KrztI%kqTo?gM%68z82TyIhv7jIO7~l5g8z9uKzG& z=L5kEzr^{18|MOvbG{pA_~DFUR-CIp$e0|{`07c-*)|87C`g~dJKn?2f)`JghSx5t zG8(-@(FCH^65pkby{?U(UY}i#tN+1$zc?BCDRY$;dJvf!9NNe{d5$+8x$Quuo!;M= zUgyc`_f2BW1;J6CqT|P-(p!SJ;Qs=}_#d4-nvr`rWAgrtFK(M2-qF>wd-x-9Pfl5F zj=-IX8`uA-bIKFY+j25|Qx}XpGa$UB!QH!Y?;qzPU*9|FAJsKEa7SQUK;}&Jgpd2Y zu8x^IFa;BW8qan*0=cfRBXG7tc5jSR{oxGJek8sq@#NM(${kMU5LaVI`1m6+rGd-c ztrbHC>imYW@kRSTM0(whFQMgVUQ_p-F)iPjlCmS;mzv#lZ&6NuQ%TdUO{<$OZkp2c zx@!-pQckk#Fu0%_Wyn3FX?OpOk4;QT^hBmK zKzn_l_oq&0cjyJ2iR+(=z(-bPUdun9-9?j zd*j^o6ACcO2__&$(}14t%x7Y)ycO;JLUnhjec{OUl}+dT^4VwN?R|+C^gNr|UvzMI zsQcl2syd4|(B7tJoBq)A>_khYd9yh_Ul{#|_%o2@>X#N(_YO39O}DkK4jgrw{9Pj-s-r-ZsM?HoG88)|b>|FVS^N-OnVR&-z~LRP;lTda<1u)u&Iq0R%NN#HKIgGA#AeicwzFql zXz;qWKxf+4``tK)ZrpQgXv(^_v)bO?kv5DT4^i!p1!k1MwkIOhM< z=~rHLUDOWDomwq@)UDD-4U#@;P-)od=uUETn{q7n>NVaF+9=XKQ5@_Z-t9P#v5WVe zbvW$2h88QDV-pW8+VkbkDUS@SzSWI8HnHt$^aY5RQt654_2RkYg8Z&U6MW|s;OOI^ ziveHCPt#+HCLQ<19GcGVOe+A>j680c(QW@foHQ|;9WxvU!gQ%_UvyJ#~9fUe%i7f}dDIe831>fdL{$y$exSaLG%n~nZ2 z!Q4eVJl3>9|2GQZC@1qKj`EK!IoU7r3t|9p)F<;fJ@q*;gHb3S3$7P=JD84gvL1_V zmYmGC6@Y<o7Do>5zHTNS$9>ax!luDf$imX?yz{m@=mO4nS?bPaz!TWIp5xzxCeJ<9VZ1y%Aa-WMur^jc5bnNPe;GnYl)v=4aP&W{AJ1=VcD^c5ZvdzGx10lEHkJ>&<8UUL%=dFyf8U*z(i`veM+MW}& zt(Ord!}#Bb+TR+r{iCSuT~XVIqPG7LwLOsSTpZK0p8;~4?_<*OG#G-;aB`IXHBsAT zQQJBX1rG)zvlH}LA*Q2Xrfc2O8q74Quk62DS25Qa4JMAgBzgZG_VVKW_TZ5ulEI3` zn4yB74Era-oo3dFM(MXM1-in{-&vk878L+ z@l@>eJ6Oh3)y<0cT017wwCo;-Q?>Ez!VvC z1WPN*>lb6Wb_g)9sXThp3+1Nv*2h1YZ)TX+Q#ex(9Am%y z$Q)u+XyANKu zl`Q&gKDU;qZy? zzSHsWlbPn1$nki`9oHV#59LgMi!h`7N|@=tLx%o*=)Wg&=7qOgjGGGPEisvS*(U4< z^SV!Yy0BNyO~#?k9E7|DQ0A>E^)nHYRezG`OhHJm`m@N;&q7G{$~j(a>D**-BN_VH z2+3-{+0yy8#XHH+pNNpG`dySu{(m9-UkH0G`O9R)Wf{pDmtz=>`-bpa2!C(MKPDq? zE<&=#jbq(Px@K+__zcJrEjiyAVB9>!BYRodaDGdN>uS)>XoRCI`IThE&4)f&)4kTx znJHX^@CHkMvoPC2sW98iQZj573ad@N6QE_eU6|vmRhFE$=!`o9amilkW7{m9cHxH* zZn5M$$cQ@=amku)r=|0ha5uuAS#qA1oaaDC_Og+}nR5y!%Um$K@?>xpLf%<$o&X(L z=V3+NrX*nJj7DW64c_B60b?tlIgD#s3oKBZy%!uFkuVnYn+6%SRU9 z7danyJS4mq;m?KnNQCd9(mo#x{6&~?`6z^WqkC86EX&8jOe+&{7?+P1rV8JO@T(So z!{Yme`IzEiVcxd?NSOAS52g!res0NM6lNX%!;6BT# zM3{MCv1yZ!8qT%Y^vRHyKsH(AY_n6zh{U!^_6G0|?izU7Vc&c`89HpYWG^oqaHije zoNbltmGKPIVB9c5K6+(bc57s{zl?I)M?P;89hxQUoUs;>`w^0LUff2?5%)oao5`@B zF06TbM09vh`g76A6jnRCMduZSzZ4yw(`2>tH<4!}B;aoTA95ax zWNb5U6S*Jk9R+|JPC0ba5SqRn%v<2_3S|qw5tN zKAU)v44v7~A*;??qQghBf3o-;;g1o%C(J(MxG*30CB(Qk+3v_%t|ZElH$JvKN0@y~ zsxXgBE*bfmhqz>on{Vk9i_QY*kah0U0!xSQDbY?jbjVt+I!oscVfJHplc8S?eX^#@ zck!9$c7&UR`H1*&GV~WipRD>jMTd`z*(WmYHiXX!GcERyl(W1CgxNR#mJFLUuu0bQ z@sFazzVo;+`%8Yyf_C`0J68IxK?u3d9p!w)dM+6@>tU0ubHKhJI?Tgl(OC%{vX&)J zboh9=NOV>~hpamDM2C->YelC4I%F?TSUA4x&-?@t-f3|&8F^a^9kSZoAUb>;-672W z`ypXo7ueU+CfnOjgr7vn?^95og^=5-vrCwD@=G$(4Iy2!o>PAmc{Ai>?Gye^Ic)OL z^l@Q6n&vkjXovkDS?4+qz&`3z$7}JK!r2H@$cTF%;*vG)a7$-|=(IwItofWQ@;1oH z-f;l9sgxt#nF#U2tFa%3oUCzYi4L!8>^J$%Tsrn^WQd(F3MU|}Bx4}94BF9hL)~U{!fof!a3-h7#N&IB)6sK`nUmDlwpXn;3Q_jkU%ZAsu zx#W0C-FpUQ_VvmOEN1RV| zPQdj=^?AKk_FJ4~F|XOW=1acCyhf{hp2gJ`*IV3RF~`*!x7A|aE2;cZi=Vcb<89U9 zbyoQei{G}G*HhJrL;tSKYpC*Yi!&{rXmOs!W_}v_2RdFi)lRv^H5RY3IAk%ei5fR- zv6-JH_B$>4E{mVH_>jd%EIwv2e;d=Zd={r#oNlq1pC)<8wd7`gn#gBc@&y(zwwTu} zO?R!uW`3I3X|v>JewxT1x8z+G@3WZKA+`Ue#b$n**g0Xz&HOZxoB3(N{_cY4I+LpSSps z#YZeYW-))O*1Y*F{@nBW`u)h^{%REYDCTLW&qaP&`jmNiksp{oL#OXopwFY|eyg_s zM7`5YywgH_){HyV`^2esQ6)Wfeq2;BPp@E?@e^`uR6b93jiU2^aeAHOM;phb#k>N6 zz})|GJfIGzopF3jN6s@_7*nR;g*vbwp7FVl1_p$T z?}tY>7qM3jw)5AFZH{%+sqHcdY2gwqToHo!VOmfo(4gd%R}* zA?L7$`=+Jv9E1Ad z&xTifby4=VVu!xo12v<^kk8_6d&gjJJ1X9fedoZdz5B$T*7Hyte2&r8VYjId&W9sw zz080f+nPGsquU83JKgXoJhOnzkA18kP4^IF_=}{)-^5Or?jN8e!**!nSvmA_47vYk zgYE;d=WgL14SJcnfl&310_^-HKq(jd{qV!#HGgJIi*0rHz+S2r9zwNuGRj^)>`~7T zoeSXA9`(^QBW`;V%8T}w28kXIh|IaC=LVGz;o#R>5ow2xZOqo2hkNWZPNOG3?$>|b z`C$_;nKUuSPxsmL!&Yr^Gcl1FLTxW|mKypz|JVm|NW(rW3%&sUX87gs--7Rf{{Wuv z`J};r3I2NcO8BqCZ-nPNIQ+fm33#@#uo@Yo6Y-;n_aftY`l^vvJM#kQ+B(#XWTOhM3{O*x~Co`7%p$%KU5mMaA#4 zPCghr(0pGe`v-nE74P~bvDwG-?u^NvG{rZhxjMM_!-nx|+HTNUQ>~Z!QtzMa@g+3) z7sL-i-F^Ji$#JWW7M$g@#)ncK@oXr;H>*6ZE$n=M^7)~`p@fvqk6JUlAtyD@3AVR{ zk{U+bi+YMjf8B+Oh<#^@BX#zzxWXZK#;m(9sWb3g+#|8B9n8SGdcdlqKb?5}%8ab7 z8wNV-Hcj6!(35p!-KNV`$Cr@xr$*RY|C1iCbN}!`!$RveA6<2{Hy+2mt=gO4u(#{V zwzGykFvL7vfsJl ziYrjpCSk^WX6+^VQ%oqQ4hBVOPr%4M;;!T9x2+vGa2`?zPJ}j+;MK)v2NU~hubl) zc;tnLM~;a^9pgpR_zOQd+d~J@b^r=TN0uKRS-O8@nW?`lJO3fnfBd?gm0?Vve5^LS zFVud=@@=6<1~y6chxht-goi|?c@+)Kz!b6eK$_Rh2XgyS;xjRayOUmv(>@D_bdl$Y zooAcF#ri1X(Og%36K1`2gc~{z{-$?5e*GFb_jmZ6D;57>#A*)PK6+y3%O>vrk;Tkv zM@iy?=U)J&{m-3TZF+8`aP_~Q*!h^GK=Vjt?vX+GKX7GkJVvXQO%!p_@pU`bm?DPS zF_U;(=(V`6XB&2OXLWRE21^oMt0^D;tFavUD$1yyR=}Ge*ywz0YrE!cW8$&UW9v}o zzd9+VU|?IQsXh3Trzc@0Oo^Rs|7x6t=&mdt3p1upUi9zS9Wa+)V5c@fOn%xyrbJ|mZMndj|_aJ+s({@ z?&is$rhAUugDgA~uXCL@PW~fI6nyvO%1aT|SSh;l#KOk{C5g!QrPWKKGd%gt!pE*e zd%By6<|ENyd*Q8En1wMK<}lI7BzZf<*9JZl7fJKO-@-z{*H0EtLQG?%XwC^^K~h6b zabezg$7`l?dh1R$Oz7J71Adf^-4HweIZJO@x@^T#EEG^uhfX`wEM8Doy=?j7a{tn0 z_5SLTnwpBGqtPYt`*N?vA)#vr+#HKpvrcH>y0|P>0zPv0ibs+f>Y2Oq%+SCCp70!$ zsUbfbSIK}`1fU?nxogFdbBmUqXv>#a66fGYb9Wwu{>%|wavkjm6!{9j7Zc7*+CDxw z`YWscwBeP8RXbYlO~PEy`}YiPn2^*kAv@Ua2_E>yx-~I@Fs{FI&L4@_sLuDBF%sh6 z8590t+{|r*pB@uzuU=nUeeRVT&)AyLH#59#TV=tSof+-8hneB#qj~+xON-`yv}z|} zneWz3af0Es>nAjFz`JL|x;Ag;4O=@zcU#W8&A$juD=PlDz~lIaG(ttbDVY01Jw7)l zuKK_i-@Mb;w*SY!&H7vJwgOmsBu0C4T*XJ;`$k}J?=+6-2KlbP?b{hxi#ho0^Bns< zJ^1-=CQaS*^Sr$J_sh=??)fhWyEYAO*yJA;81_^z(o4B!z=B7QwS?*$j5z73mJK&K z_=w`L#*~NS|G4R*w^o+tZu4DrThpMMW4wW$80VqkvGK`$-;MlM{MZ3SiE(LoO1rTGU4IWyF$UVtd!I%_g(5s=$+u`eA!^2=;p+!JvDQW#KdPiyP5Lg-wVr&%0KFT>m;r|chp8^{)cz^JJPa5X{WOxjiqd8 z^20FX&kS_;G;gza`0!!V>|n{ozCoK(Hl$^bjvsbaQR{`lKxy;V4QW}yJtsGecGkTT z?@RTE1~;Yb2$V%qz#RWko_p}_LdYMi^!QSPCF5qLjUSa9)B7c7M^8;h&rCPH+O+X) z>v6r_69{GSe&N!s<0XqjN7iOk6wUqEmx_pp-k6OuqoyNm!ZXO!L{}+%hd*V#Gizi; z?-(|gVA{Cm!r;h(59XYWt6@s<$G&SKeQ41g9|cDiKbV@ZA?@Op`?~JW+0zjyb*)@3 z*Q-6VI!ilBF4>P`E90%^$*bONJQEYr_w9WarR&=6?a^4USKXJ)WuLeZpmnb%fd!mL0A$`=2x zlc?TccTz*sqphjF_2EtaO{u*%;H#<=P+6|6eT#x=7Y_^JXdvpoYG3He&Y1YCoaQy5 z6kn5D&B5@#_21;dll-^66*0Pj8`F5mD?D&OLA=YfT$njmMYpXO5 zjUVX*M@(*Rg&l8e#~A1Sg9Cl%y|c;FvckV(#1|n&{$1O_vUy z6ZTBQJzN?q)D>Z6fHRyOY1w_P`k8iBPQ<{k=rri zi;W8&jOnm(jZOYS3r;o4$P4>V_4M;^;b|bG`Y&lJkOTd4~#vY3OXu3nkR< zJ`N@HJ57Un2RNMrJJP0LKT7gk94@H5qx&d+kW-X?0+})^5I}X+aVW>56<(BvMZ^-Y z=1Jz7-WUgEU$;4?;PsOQ?_+5K_Gu+p!r%q>O7L9VUk7{?-!%Akxqiy`QbR9%G!VX0K9kmJ)47^;$h!p#a( z6y_*gCm z+_3|&F3i5v_<|U->OymBrDKxn#;Up4>d<43qs^ZJ| z$zW*j^cXii^cq-1QMX>&fV(3f30dSFu(m-EOsE6?P)sok8|JQ*t@F^$3F(~|aw!|Nx6s-E*Stm$f+ z%T-TAuWhKihRj!16r9OcwEo6MuTz?q6!KsJpoYo@EVUHToptc_Lqn10S>esIUV3d^ zN=)x-9*z-;2CV4W?YE5HoLF>ldFk$~{oU#O)@{T9GBvdKc~5A?Pjj%+$1MGR@~oE* zHooG)N;K^)``ep)+Cxn%bS0W}y^bU5nD`zKt1S17U{w-|8)dk06i)jj6t`#hOfEUo zR}n*df8yDYfnA8&f?K8!u$V|+rkd}Vb?{Ki$hgLB9=F`#mi3kH+8_}VMSrgD32%)S zZm!bGcomh=xY;9_I~$q9r-SV*M3(ho70)SXgX-Y6YUH9`T{R@8F~+l_d!l|9efzdx z+PMdQ*S7U=T2e>a@Q>orjs_xI_(uC3xvjq|+Emc{cPCJiRP@|6jqf-e8AYKN8a5{t z-F{8OHh)J|QRSYP-fuctiR;FUs4R@>o#eb#oK%?_(|DaznHf`Xg;Vfbl&vxpQ?Sly zJcN=A#Vx`^tuYvr_=Y+Ld+%^Y9git^$=OgfcSBV%D=3?5*ho9YIz6}*#(~=y)A+m- zXrDJGSuqRkG*EP}mbEl_$LBBTNJh@+5DM^(X&s_C$b+eo*D8i%kRt2!6p4C)^f zb>(G0g9WVG{aw2o8lGZ5@3t;#OQc|#{Vu3*VIa>fj89FCDhu!J3d zuw+;;ZD?iTkR55m+R;Mgo_60*+_xaH)?pAXWOO?IF?V2bdO;|q$b_+@Erpw&!z?_BEtQtF}+yl@5z|neJ6d1 z50Aee$M@NjDboj}Vda|dU@UfSQKzT%cfMgQPp&E2bOtkdUig8o@ORfdJ%}rRIfv8E zJMcT4ywL1Be`AWaorsTfLcc3oIk>bWslbD8k9`x@6BKzvTI&6sF^#W$yzV?xpGe1? zVrOG5wc!t}Hr>*!mtJoi4LMd``(-y*A&ayJjC9X&_Uz`GR2iLL-ukkue`s6lJ)x3y zo09jmhi+Zhc1GL2&edBVbN6wrD(k}d3ZH59w68)t=w~;wR#gE8{K)3Ihtq_c05Z$RTY6r>b7zCjzRD=<1*kvd&RCFng7htFJQg}={B z@>{eQ{|EkW{Jr7BC#h1f1^45#!W*g6Zsg&U&e#F6<{!tBzO#I1`p$3*q+`h`&PQ0Y zPe+>3``kSy-uZp|thKbJO`kRUs)DPgO_@F2T4#&PZ=JHoxuo5}N`QC9+#JW10Ee9E zuCmp7M%#!P_@Xh1xXHEGz`78}w4+-t9UF8Vu1#2n%Xen> zuW_2lu4@zDzN7V4uEd2K;g&gFEfX5tGF+P&(Rq89FSThkemC0?ZrJe3U+y0|&cNUA zA38pw(|Ri+Z=TS|p`qFP^8LvJhXodtuW9r+W8>m+Xq}&qj43#HGPHW%ar40Iz=Bct zV)$zA4%{*O6lX)A=v#bT71;mkx`i=;%(>^kGrPLNUdPjaTgl>uP?OR&@`mLzp-Io4x!e?Q^+rc|oCWg#9{mOIy@Ftw3qnq?(RQCs+# z1_eWIO|0AfTri@vr0kYct1EH{>gr2s@pI9_rKW_H%j=idR@kNEw_5F8bIcDxQI*Sj z#V`mGX-6YyOQmOY2xIv-#^(UkcHU28TlqnK|C5l;ulH%E~Hg>Pt!& zSFpWRk2~E_|FlRmukmBO41Z=tm4DU^Q~bBp`KM3IzhTPgf7=j$E2EXt5-e-Gy!N(= zEMu^K*)l(#M%UJhMQK)_mZiROd=BML&;REz@Hz7BLEk{fz5~yw%{xVWClZ$cGv9;n z4gDJ44?h6Pc?eSxHXzJqWcWD@VPFkIyp;49Lm1e{5C-@@zvIWdI7}oDYdbS+aGY;5 zgaOV2qk%EJ7l47eCQNWzO-NaPcM^^-DDk;J-|;aHogBnxonXf4b(=f6{r_+|Ld{cj z$an7O@R-{;-H$3W4v#&IYnG7Nrqlh=VV1kwNnriLMeo<`ba%I@D^dMKW*$|C`BY|J zm1$R*c~)k=m6>;CTmO@oWl?>WNBNWVZF#yC7Z_Ql(GOvCln!Weyq zbkre#0iN-gN47cgCGd3AAu~Uea}G1z>Fl!(W8fL8KF=?D#`VMV=NvN6MLOCc^CwEm z`F`<<~GO6*TB;z&wU)EN%hgm1v{$AVNCY zA;-fr?sj-O%GGH-Gylv3!@=;>p9HUQzX+ydT(ZiifVF-Kz;x6hGd}Hn4PMK|JZqga zg6U3|AH2S5^22ZxJnc+_S3CLOAtEnANJl&5;qcV2g^v-gM@VMfpnr-XC&%2>M)=Cxh9J1Mq&Z+D`-X9H8D!mj2D)i$vZG*7n0Wt}H+8aE_23 zM^9W|o9CRLEYZmW^EgreW-$H?mk{7iSLb{OoB3g=`Q$mrV?aBs4?4yrYduV*5RP)P z_5&qgZHJX$y3?gQ5pt%hA=A19p6+z|d`3lmhI+ndg0=0jUbQ{vgSG61V7k-U)OMmF zb=arrdB^vN^*Hi4&{2o1W#nC#PuoMmCCaan$rjp3#6bc{>RfT#Xf z;kAs_U^EF+{#y{LoyB0LO*>(D)%gKfb+&*pjlt+VWyzlg>p9W`W}3{yE_m&SUj*Zk zpox1JAsuzdS|@)5Yg$LZn&+cnwRsGzZR~s~>v6mYtU4Eilc5)YpH72tOpC1be3d0P z3izjeDbEYqV#s(*gLR|%jBeX$*vGVPgdZ!s4k43Z{1Cjx{gx%a8_aYVm;L`x;cW?nT$UgQ1-JW%AXA*7>yvYx*mf>j4kP$PAI7FhF>1W1P-?N0>L2051saNH)do@3xE zz~>>P&ey@3w+FzQ)^@PwzZXnh`XgXE+9d07IRR!HqYmH6*S4YW#8aQF?JXUwZEOsf zajC<#3V0p{;B&xgpL0{$H&K2Qc%*OxSnKnfU^?0%PeT}h-vidPeg(##(cxTEt%pBR zC~~r%gIq^J^<9dhYB8(@~GC_4byfa~4h(9zNb*hsF0d*MC{h#Wvuc94>bf>eU*DZ!x z&n#atd;q>2UfcPdU_Hmzg6U3Ylh-q*%aBcrI^$)VHcQ~Az>_=RRp$Y4zR3TCkdAT5 zypB?TATk+)kn%y`ERjzF(@{=lNd3z#IeDDOZvk@`^%euNMczgs9OYzfW1Oo(M>$#h zke9*SMfm}M_Py^>2uC@27((VJiJ6C^oUC>xS#ok7_6OjXgD(^ggXtKTtZ6-C$;qRz zKLG!Gu;%Seu+}Ztz*6~Wu%1(sz+aNMbznp>X|X?1oz>t=MCS>x+UW!{P5Ogije7{J zW&gm^KMu|meSaJPj^!fj`OEoxYX35D9`@7z?Up`ykjR6UoIFwFKLu-kIxYQfu-fkd zbDTu`{{+)9KV;q$QhqTn7I2i4^;(k)*7kWLSksyZ)-mnZz?#-7u#P{!ZOL1}dX0O? zl5YiT86N}FF%M)tH}_g{vgU_#zv-w?R{NaDqxoUSsAbGyCkaP=vZg!5l9Tm1ap8U*to9$XbjVsiyDT|b+r}YFPS)$o`(UmA<6v#Kap<@hh51PY ztBwz>$MIZtZg4C+S@Sv8l9T<|PdnFIa&o%JZ?)uPZ38V}J$HJ+nuk4L&F70?t&`Wl z8utWP%b0=;YTQ(?9*c?0I2;2q4?XjF8Cc7H1z3-Jp6JllbTAzQvR)HsgEj7rU`=-( zSnH?OlGlT^jok&NV?frnu@kKKN52GXe)fTNT=522kIP>yowvbSKktF*7?3re{{pK` zKCe_e0})Z>31GD|*pd$cvyAk~V6DURs0_!n$Z9hktYw*G>5w%)Uj%EqxnQaV;HMMd zXp^k^*I070%D-&M$ts@j;IFw--D;4oIDbq@*a5FpnMm++Ia~~ zM>$!K`$4ek9|CJ#9R}+d`zV->amgC@12E$T;Qt9vM;&!qKWy{V(~$Z+x9Co%Pr1hZ zyi7eh9$$5*etRK9cbPD@-z;p7(?&<_A7lD03Ylm8!VtAT%Zx=RoNV@IMeQFKd0ta# z_H%UB=VCD`ZQCs(>X*;y^>TM>Gk1+wJ^v1T@UpD5OhrtIx2`ZhqZW)$2fiZyqg_V)C?4WnOR zelwzw_ZTte$!woWtXZYP-qzZ4WwGWAvG-rsw*iVZt2y?GVx3veuVj;bKn%8R7i*qo z_eo;S6I*+`xNid#Yo3bqiDI3b`Zmn|o1?bpM{O^N+AfXSE{obOkJ_$?+P2RI<`08X z%l-S`^59jW&&8U%e0!T$)jk(%dLMh6qnNiZ#8az0I?<&&8URUG44az70^Uv&i&^DrA4D{UBxB=DOJGxQ$m0 zBaYi+WSh^Qhv59oi`uWx?ih*srBVA=L~Y*_waw>N>KGrdvPK-Y{}8q9VMi^F`_22p z)^=Xh{tDS<%?&{>7?f@HJVVf5{6Mw~&Gr>$El--8Xtt*~`fQ2i9D@Gg46BJUeLhQ4 z$L--!+asd3-QR%S7}U>?+Fu;CT^6;i&zWd}@$ZuTSmT)4Pmepz)z*)8*H zZZThWF-rX2N=aP>zqw+z7cRwTTWac;EuFux=C+Bhj9+}2AJOP<3vYu&QWNuKOZz15 zn@9684;^nZ)tw^89C*HP#J6$gmzB&fD@`|(){#U_dUpE4y4sTT?8x_Bv{0D7URzf& zAD_a(=U(b7YL}KQ=0|(%&&HsH<`X!0Jtz`gWSAq5sqYSQ#2{)hxB5@}($FVkrc^S|Ibm~(*N^R{dRu-&s`bKx{6zuS1c{7=x_1g{}LA8UR>7qZLr8^qdxz4 zu0H8&RR81Oze1yM8zN5Hn&qWv_5F_m8(i7AiBB=LomqtoMr=C+0 zbCIfF7WL6I)1uu4O(GpizZ^xZe|on=J4@^4e?rG&Qdt=FZ82PxtPXtXva)5?X&7mZ zeO;Y5z*>XXq1l@#M!}WbeQKiLg^TG8PJ#Dtz6I3(=giTTkz$%a(r1-n!)r z>nl!I9=T30W$SRAhl6A|4#|`g$a2l+KF?MBFFJDjYji};eX4KlTtkWboJHl__VB?F zoY4_Bc7*x7R&_Y`Q06lnWj?D`<}+Glzs2bmXIjiBC90ooG4Bgh&S&<@xfbVHoNsZV z#WO6PY4L1}dH1gN=aH|)Kez?(%HRp*a_=*d%oi-+a^O{-OO{78d1R@Fd`nJ|=PURJ zHv`^NV$eJp^OU+goANT3i^=6KvlyNVmlu#FE$-I*R9o`JWJ#-rEcve|OS&t`lI|+9 zq}xE2GOi^{x*@XlSj|%j0bCrshZQXD6WMy?=3xfmOxz_dCm`@Fb=haJIljwWxjDYV z=J*OTd5^H4%tFJZ!+UNuXr4HGBrT&akG%ZUsdaUX{vu1i&gCrX+~Trn52A0{!va@s z+JorlQeQZa%!-H0hxaTuXr8EgZgY7CX`N*_M0hZB)ArM)wz#+C#9Gx z2(R)svgn7&Qa@WP-b(&D{=sdB_k6>k`SzIFd7N^|L#M@0Tiiu%z(2TM@T$LuyqZ$H zzY6aO8g%nXXP80*`P4IpoTHU0iV*^Bz8yBl8hH(DGPMs>M$i-WZmJdJYUl@`a7$KxLy*?W~i^WFjV z)3IreHTa9*QSj7fdC6WGcV$x!9Uj{+2^SzV^#Fb5pRD$IxuQPH&PyGc$3KsZgLxgo z8-!~SvOJWtZ4M!`@xqa{PKJW1Lw$3sg-2U*9%j{H`=%Y1h3vfs|KL~!)M2}0KFIk9 zi-l>QmrS)&PKF(pk*xW_;dGKGy6x7~8#2rH>v@h*&i2nbA}1qk6lUA*6=wTA)8p#+ z!B-2XgYOj11am$Z?a=nf7%`uUJevE(cRVn z5AG>=P4{QQyAXC;@)ya7TaS>e=^nClek=S3goiEpyJW;&iIA-6{>#$&SlC>jJ$?D% zd;!K?h5ckr_fkt|vTzNBCuGD8Auid=1`PL?%jY}B2@B5%Pa**nXXoA>jPF3;Jc zqH`a1k+q-4vK%H4t&o#7|7TK;xI8ZgTO1HxjnKTG4;}V5Qz=JT*uKbW=W5Eu&b1cL z7p9$RGUA32m#lGXM2C4W-(?g#YemjJY`rk&W^E+H&KB4qtDWzQ4(+sC{4+B2w?d!n zy#WBXOLRCt>^WinM*BJ$`rDyHR{MM}SIfxXddYuB__igFmwxO~#3g%YGbLP0D2G1t z&+jji*}o1I=6o;y-ph0!hdx=;<@XCTUB35A{vyI0OMX2WaXS&0?483@F&|lUST4>% zpw82flhyuW(P6#aD!c+=y(PbwjJREhOZM_23-?{o=|K2H(b)w#S?%*Xjhg?*g?A$4 zJIN~NZ_ngrg#RtfKK@lQ(%l1_WVQJ_(P5t75`G&Yf3sGb0}-Eb_aQFXE6;HFJ2rJV zm+lLq^E`COYJa5Y(0-=yID{8ka=!CSJ065rl9ASnutQcm*NP79m~SpZzZf#}{a`TV z0}v;f128xrd~&jTeKF%<$f53zX(68qzCv`$5pw9mxCsbh&cvn81tOhY_>GD>D_F1=NFK=|< z&W5Kx>%`PEbXZShF9%t0=6(t~)nL<3z+VN=foI&s2;uXzbbqf;h%+R^8;bp`B0d1 z6F;)#K5R3s^AVm)Mm~9tkiD!BxKScc7WU3JV#myLlzf`83gV_>7umbO)j?BslF_(0 zZ)UCVM1<>wTM!-;rjE%E^mD-`KbN`3_cCnL&H?DoBSX$(YQ{NW*6lNv{12kf`-4Py z#wBM6^Si}C;Vy)~6#f|DTf)>a-y}v{&JUZ;K3USbmJB)PnelxkayqzHI1z06f5^#i zSaE&Wrar%?n9Q zFCcu};vO>MLd_v--}o!hVY~gc@HT|BMVqf7JS_Yn!arJklnk4Ggk-gOoN~nF9N81X zv@- z@BT{oMT9R1^ZY$XM%-M)C42dh1Mc^t!@0a~3!gyvE*biH&>?Fb{!?_APsU-MdH<1$ zG^n2seX`n5qZ~S%@0%^m`w8<*19Hyy{i4Xz5l$n+P9f}&y}v4MfR4vI_4Yj&}o3I zQ*`EG7um~`5{~^N?d(DLtT4;SZOS<&XJ1J^10lbIOXj^rob-DOV27;rnMk?BHTMx< zKARaPa`FYj1vp0Brv6xjlgX$b7J=-Qc92qtergbxtnK+fM2GX9%{>Kl>Y-!qDdd=%`v}NaLQd9W zx|?w!Uj;c?kLh!iqaOIo>44}oK!>dL@Ve;mej*0tr=7LXA?qb^ZgsJl%qQg0AZwdbuA)k3MZc7a6M0gp(No3ezTr+Nj&SJ=_EgkdR z3Gz2^0DdfT+UNCvHYqw6;Se7l{N&Knk+XT_pFGS;;-31Kx^ zih=bkA!KbTbOxxMVQBq?`%{5uefpJJXzK)isuX@L(aLU{H>47{bPi?5MFI@2^n#D zzAP1aJwncbrJU{;B4=9fSn_z}Lv_w3BQ56bVqw-{uEkS@sl&2qp66QfWx{N$Axpl; zk{_}7sBkGl&L^c!_94eD9S>|#&ORiLjC_tkc&0G-rwDTn<#>xZCsgC+Sn{dDEDPs> zQipv}p(SVgpd2dBb(Wm-Kq;r2ZOJ(gRPEd(a@KdH#hm*|9Ukk&mfZBiC>M|8dGIVF z^PVO=3L!)h`6a?72+@TZIs4r!$*}Ji_SOR6Zh)svj(<#F3T9n#oBHVp$=*fy2e%xa z`gb5S{Un(4dYdVSekMY)w+{c{Ho#N=0fZaL(8&_^-U5Kz0Z*MjA^a&BI@!XS&u-D_ zMfeM0wu`-F=ubpQ_AbCbINonio+GUJiSf8;@t)e;FF+?3I%L(!6dnGyFjkm-^L1qC z=Ru$B<)8&_uIR9@E)`~<&3glui*1Sflvj{pCm(UiUREj`maC8Gd|Px1At!rpGb--A z18lZI_I=Uky~2ZJ*qi}1vexZhk@Ffw_VS>??WY`exK73q(U}c7S?l2)(RmMHEUyKy z&$dAJuA~)&a*aqr$gwYV=0Q$YJ7Yv=62gmwmm@47Lw^DE$==%maMy_r>y7sS)G3FY ztU6_u&N5-zthMBgWW=pTT(aipZqW%N+#ouOp+nYs`+?{@gYZ$&seukz%Wm!qP>0kp z<9wvWCPDV{1c7^6qVUW;!e!~QDRC#(GhqO%-fg)sG(2-E%=;UwT!0^v68ypHfy;fW~k-^i%9R@4<)>-?DL{1f2`;TYIIDaCBHpC_C@#Q;H zOe+`RdBR^nI9!-xuu){h4I?gD`|2#w;hHfMg=yys;pqscDkBfqlVN8I?2y&Y9MPGF zaK3N_!ct+jnI*z?2y28nc4#ES=2qAwd%q5VYZLi)VedDL*y)hCoPYR3Vb;&jMgLK# zk+p806&*v4qrMN2+w*x17V^t%auw-+)l(LYupP& zCkNpdg*i6P7v>r>v&e}1G~$vqZn5Za-I}GM(*+%}w*dfmo9OU7S}QucASbJx^`gVI zZI~YO&vEw;g<1Be$jHMU#3g%I(>k85iF}{1H)zCW>`pt3`Ogi}T50CdQzQz$xI+vX-=j^!)Kuz3jjWPOge z*wVR8m}}nLAXKNFoj2wxUvc@GM6 zY|Cxd!|xHkAXPv(*%zK}I3UjTUSa|BNJq#A6{y1UkUn0!0 zd7dz@U)QJ{;dR2Du~@T2m^$-?>k(FxQT8LOXRwYFzAo~&At&oNt&wu%jce_ETbOI@ zY$U_ZJJ2WV@oKYlIxK$J;_bp*n`Z|Zc8Di^A=S#)^r{9O1sg!?V| z%fcTZ{JX_x2p>gwj>W0Mc(mx=qahFEOv;frRGDFK2mp5pJoCvsplXbcPuSZCfV&=^ zag&6-O_bt!EIj4O!rt|i%Cjuk{2q7>Jaw2avf8{`IES)5}re~VOo{{E;u&tg7nP!7TFmG68n?^heHI_E_)Ux7vG|0= z{7p@5@^>_4-jgfyw@Kw3i}Nj>Y4JRZt1Yg#xWVFPi(4(`y|bqKsKrlPyvO1fEq=q| zx5>$FogcS24t;~llPu=Fs>(Ah<~^y(^Zvi;z6ZXlt4jCY+yEi>wx(%HV+!>q4Q)yR z14X15oeKq;Qd&bB5G$1=1R7$145U-!;TTe+Hw=!5m{P=fX^fU4Xp5+b#erBcBFwa% zS{bG&tvrY6s}9zxOl@D^_wBRRx$B}2J`+x_?;dnuO$`p8d7o0U|ut- zzSQ7ygDVWKG`QN}8sZ|a-X??B7|d%!wb^3uPJ?-!s5bizK5X!DgHIZK*5LC7zhQ6= z)_djWvm3>6gU1>?#o!qRR~fv};0A;Fj7Rxf4c=_dT zKV|UK2ESl1pIfQ@YX8It~a>Z;B^Kk z4c=yOr@?y+K49=u20v}^3kIJv_%(xhA*X$h8C*zwwYP4U8eDF01@XH)n@WSL4Xz=M zdp1o5uQ7N7aj|E!#o(O=?;28ob%y?FM%n{J6nS8r*B}a|WL=_!WaM7@UoZeC=QsZ3cH5yvN`J20vx+(+0m_@HvBDGngM3Xy0Q77aCk@ zaJj)123HzfZE%gjO$M(qc!R-P4Blz*E`#?QeAwXQ2A?$etik6Ee#79Lywo@p7#ufv ztie+Zo?&p6!3zy;Fu29wR)aSiyxrh#gC95eNrQV0e$L=C2EStP1%tCMOZ7d^;E@KG z89d40gu!zRUSM#&!OaG*GdOARHiJ72-ed3qgP$_^X@g%d_?*G78O#rs{P}Nip~0mF zmm6GRaHYZ32G%@Ir$d3~n*F)!@wrZ#THx;KvPq(%@c$pELN3!LJy6!QgCM6YCtvGkB!I zWd=_&IAQP{gBKWFZ*a50>kLjByv^WFgZCJGz~HA0e%jy{3_eFZ+B??2W-uQNs6Iw~ zt!GncaH+xN#MgN?6$V!tTupqvXH#Qvlfi2Y-eB++gLfLd%i#S6A2#^7!6ywqYw&r4 z-!M1__b0T?{B}@r+~BdqW4wM%F?fc-RR%949_!gR5Rdb43-Ndlw-UeG!<&iAJscXp z`s2&t-4$^Qy}TlBP_$}EQ|(L2!H6CKJ%hz7 z0{MOX^f@o3=^TA*tV7cQOucI1wQtD^{3C1QlW~A@#+T^;mKi*orkC)2CrY!8577R7 z>!wrmGXevRWhT$0gCd3>SKt5dK$SSJr30`!H>CsEq&!Rd&VvVCLcCQD+TQxE9BiS1 z#=*5eG`@u%BFER)w$z5k*R5VHrKt6Grt}>K4oT_c)N4b^$T)uvX8HbeJwMRF?7+U7 zqD-$hwWFpi0(v{HW+5|_$S{~*fr zyF$3}>D#-Mt7EeT`j};08@wU;Q&xoxL-nW7Ty!|Rp&o?EqBMuc7aIlHdVSZFe#Umi zGVDR_P?OoftR|Ta`dvx}GEZAa1~Truhzw8yo$6iw;h@8(gh1ZHJXs z1g8#coG*AS)3T2_q`swMdFHX4dw!2t z`4XZ>Trs za`XEM+rDz}Rl|sUxJBgi)d%>Rk>0FiV#nm70N)1iwL(We+m9YIC3BDNe$%jiKpD%>+F!jeTryssQ2KdSh z-<5`s-}YI)SU-IHPTRI`lHubcT;{R8^84%T+g|MCk0;SXNU4yi?kKcJ%zAB_kT?y|;+xngW z-yZOB>=<~9LizX|h~;ZR+6wb1HDagP{n;&r0r#(g?3#s7w;TCNTut7O_TyvF6DK6E zaDHmL@iu|>vLSa4j%8otK^e9s}h)G>KK%ExcjEngG( z*1&{(y#2tu7y`dQY^@i$F{pI{(n^^CW0N(*9Cqu77I||r|RfTqx z(Xg|8EsH%a@=ZffzPSNDK9}VGO;b@mzSm^=&VY~a0Fv)!1m)BJ*{s|55T3Is2RTX2 z;NDk4tmDGxcltlzq4vx0dl_4A0VV<8Phq{Y#E#>V4I=U?AMc&Vkyg<*ycOUpU6I

jHcSz*nqfV#j0&>}>lg!B+@9+cz6Q`92ijd!Zjbersd-Y7E~T!?!WO$CKE6 zy#c=M;A`QDvxxG2 zKfw3gN~}3JK_uUu2-?0s1o&cjFF{^qbBxOOYJe}kKD9ln4PPnWeL@=MPRjb>dl&4; zo$$;;Qw$%Le!qS51AH_3;hP)at1^68s(rrug-`dRd%$PcE4H1XD^Tw?*!>6eDmpG- z4Ak3zdifqP$N3`&I?hi8__pBWYlM=C9g}|_;46HKfVIKmmB?U$8!csGwc*It>f~2*rCh5bi!_mpYrUO{E6^s)=AiH z*92nnQTT3LHsS;mkb(`~w;mk71_b7DyYX8hErVpJc{KRUM9{p`0lo|1qaFDg5tNVi zx-9@hIXswRJy?#Y5`lJkp2|NrMKY8#6TW!N0BF6uhBVVCwB-w-5dY`7irRU%k5;c5 zzj*x0y2f|M%i}5Wu=hK8(j=EL;XUP(r#MuT`^lMeW`)Db#PRrO+L*j?qt}Q@uF^7` zpWfim75L?&KYqecg>WyzClMY(_;bpRQ*XW1`m?v*`g7Ltr*M~`&@2SbiHphT)i>XD zXB_uoS1((+0^49}d~|&%cl2ucCt`6vHK5k%mfgEzNqzjj)wmg`y3yk%Oj^xCar~FY z)w#AP{_UX_r+P8|BjNZs|JR}0)UGb-@xTF;wfFjJR~y?r`H|4MB}d>xAhI{>baqK? z_QcvD>qGpc@xa`UQ{itPEJ{v8cIS5wpU&RB>pOEFo2I$X9}IPMwsxI*ej^T*aJGB! zd~zDhdVWxrZr8E)&2Jxku0NKJ9e@1x!EYs}y*m1umqr&qJG#VCGrKRhS zz_n)XufnIZ_hyM|ZpWC{zCAT-=s&*Y+Pr&L+vpa>4Y;OEZhsWiPI*;~Fo)+4h)zi5p#*dNFT`Hk_a%)#lrKjmCxkf>rf_HjgSIOqa z1Nk1_*SST9dDQta8!I>d;gaz1OGA@i48?L{@7$ZyUfcec?d!`Qdmz#NKwWKK>!$ep z1MiP-|J?i!zdzn3V|^$)R&?ucJifZl*2i9~d;X^*j=ldx_MwQUO#Wugi|zRzFWGee zvz_HVM=F}X9q&5AQy8>-^D(Wz7MG^~7D~Rj{WqOWL=l*SS1*^O&PJQ$Fxw@;5y_Wt+b1 zb0cT!#@*N;+qWiBf8`d;_%_p8mfYBdZ$vvg`%u2D9Y+&3Ej_wBRQckR-%OpfF&{(E zUY8$=bRC)0KB0YD`&_S;n~RPXg({y(9*HgAG^6K8-l1$5Xx7kzP^{s=Gwl!6#7kUIfAv%Y9w(~druZmI1uf^fLB2}p_k7tgK3@v+R{^@*--qw<$ zd<@lXC3|2Ten<3v=);d-=uKXFDTiOY=1GCzpAHc)4XSo6rLD%Xo#I?MYHlk zFLiEywlmq&x#8uPPCa|9XWx;+y~Dh5*f|C}Mcvnb<)xaJUbc~^Nj*Jl(n)scq&s>k zD*aI5xUda7U zpLxrzcMM=dmOEyCXaFmZ>7sU%*N0-cvBEFrmT!L`vFm}(hvT2fn*XDmc>Cw(H{{HI zAewB;3GK|`s-4f*$Rx%cjP zr)MTMr?C%9@o~AwU+SH^uQ}2 z$F>A@Xn}hMxad~AlMtGB*UUxJrr-6!IrFM#E}C;|^~^h`&AIFS<+;J9yt>T)Dcfdpkyk$ z7JAw-rqG5Mx8q#d2NAP7)F%pHWf&Eu$yK$$``V2w1l%eJ|^Ldj_~vY<>q!Aty2S3v$x;CWU%pZQBT= zCoV>Q3Br4UNk#i9z(u0J6PQ9h@wJFc5Y`wyvDUlA=!tnrT!L^MSo`vfu^}cmZT{Kl ziFtp8`Y1ZCZR0a5o}W`szn~PBC+0DV`Wub?Bw#K<)PDdt3o-2zz-$lGGl4186YD(Z zb1ud7QB0u?v6ihddSZ?^39RksGpI7r^LY`4oW$c1)BY$hIjHXi=Ke|j zDPV2S{{W`YhFItP>qbw^e3s3^f}ot)z&al;;X(nS9kJ@^$4u=DjlS5}6EjJE{!bGM zc~o?r;oKk>V@f6)&MVq5*6qt@EIMvefM+AHt~LZ6lWo9!mQVec5Y)aKnCBhTe-(j} zsosmV%`4?`D$Wl5ChcBC#MQ33+(+|L380AUO-dEUd_%~dTW5w|MZba5&H6mcV(QbnM#5^;M%N)vITZquAm zDT%llY|}g%q$J`zirRE(DghL6t8Ypb30>#kW8|?eALBVImF>0$UUTtE=LsM!t~by zY5KlUVg9cJ>4=$<%pVy@PmnbC^?d9Pd>?|sbs-<~e{sOxzGpzb&4K(crtuZyV2JbN zMT>buHkAJA-s)A0GQ1Jl$Hu)$w|Yf0-U4h{nod!_ViDdeT%E35z3g7Tyqunc7n=D7 zB5x?BTjK`cqSedRE?LyDq^WtyDnC;S;J#whk`=zz^@R;uB)2G0Qzlkt!h4R3c*`+E zaaQZ@JErGhm=?Jg*YT$H>Lo3GGu=C;Iz(t=S~@LJyL!b0m+d-Tzlg6*FKSx0x@FPo zhT5j4mG}GP&T{pVzr1hBip5LP8P_gZwUUEVyP`flqq(WJW$DUQ%NL1-Pqvuc*wRau zFK+(0uXR;$1GLoM+gFJV>nq&|_t{kFsW(+H?9KPp@ilSQu)NtX=hsk&Yc*fHa#_9G z?v54jQfJs4tgD}`!K{mKXV=ixi~8Bp%;jtJy1o3q$rR0)k*?%~@OP4avV3*(lI1dc z>Xy{EG_77l#i}K>^^5B6Te{RvZs^k{i)&e0UEXWd9J0lATn<9&KM99XAM>0+^*qih z=DMI5x2k;1HAeNg-1l*umsVc4Nzdfw-}~&cks;`hArfThX(L z;R&7%s}GBw6l(9rcA{tF#+J{&AZ~1>t_0Fr){U*`E2$SehnQrLDg@P68|=nb?A_Q3 zuAvPtup#vbTDF0BGPT}wCiS(}jC7cdg|r~3AF?&XQ>pd*Er;Ld;Z{W2{td+J93+XL z`ppJ2FD&WAL(I0^Ogt2JI3H*fJ==9wFxz!y*t6k17v85~SyJ&FOUr&#Fz>U_jy7yN zeU+&V-_<4NJr~;1hJAX$*f5WJ_K)R>^ zW>EXPiD6%cm^dnH2v;(-Sz<8f2JOcpCRYAd>ZJ`27~Dw=`*Os@QCW+2Q7`s9e^UJS z#IT=)m^jMLL4J%t{S?8`H~{1s1eWEtdx01>6^MzW#rT2zI|B6y!P@3OP%mwGU2q6v z|EAGj%54D~x6K9fe%v+0;G6+lV&!!Ivr9O~i~S_Tybq*x%_c_KN|YszmHLfrWf#DPILb)~`Dd|VUw$bz3!x`ge)`_izWhe;9}vH0 z^jt~`cu@}_j$Z4ayOJ!x4x2y{k^6tA%ps1J5qb9l_~P*?k7ekc<*C_;Flxb zdp&Bi*VsHS_(jA&6U_TKzcn`b94l}xLCp7ViD@&(;N`^9hE<|x8#r%h&wGV#y#gMF zed-&cC;qYE8gTO7A$d4%uNoWo{}@r0_qHxa8FKPo7~h8^-h}vr2J;$D^`91;fc-xR zW?B9(0_Dj;ns_YYB7@5Xv%l{X%(Byset}@#Q@h9LnPy)oO-9f6vRM~7zb}|$#dox* zC;o%MZyB76JS}^#ORL-f6Q;)JQB6jOJFz?HA4Ojgy1oQs;%f#U4?nbQq{1$_Hc8yrumPb7} zM<6Z{n@O-Cj!p!Cj1e2I)6>O<#~R}3jn2fa)#Twi?bc`1Re>yGt&8_qXv6jRUSilJ zU_-3!+#>oJ&=YIf4(d_%3y8leHr$59YV(BHd<*eW!Q2=5emd)#1AF2qI|w-~Hr%gY z7Mm*QiIwxb*!&LhTVhiU8)CKLJu$Y8&j7{}qb{!V#A?IucWA@={~C00&;%f@>7oS;MSPQ>p2A41RlyPJBHZ9rM# zsGJY)7JEJ?;Qb=<@L9qS1oL^rj|6ia_$R@<_wD{K3hd89_oC=|@B3xJG1&iBFrO>@ zUND~}WFfFUO=u5slsBm%1)^^j9OWd0Tr2t(!O@$XIy9bow1I2gWWl`8&NY;JK6|)D z@a>3a3+6K$rfI|RasN{hm}}%b(R0pl9j6VSH*no2UW%Cax`_E)ifOg^8)Ecp4Vp(B z`9`FvuJ*sOz|I4ai{`>2NvpH&%Q}}=r=%59OVuOIY~Xr{tv`2 zhz-{(VlDfxV#9U&*J867HpFUkDbjqun?f7~CxyFH0ThoRo<=OU*JlU@rJGyS=Kz09 z^fAPp#8Q^j#NCLC3@#PS%{`VFJb8knJn4dPn5ZWQar7_n1GyW4`a;3c1OUXHx1+8$ zV6N}987Ww8n8)^PL(H+DOUq%YVc-*dETft-3C8SEc+3!7Zmpz{G7pO41UGn3kGLn z{ZgJhgGU-%W-!k`)jnbH9E171L2c>{ZZ>$G!94D${WgO;4c=q$0fV11n9n7Y$9=;o zV|C8xUo$v_^-Aq|j8R-@u=B|+Jmp4TVQ{6v)dq8&SI#Db*BI=4atr?!qu*)pE`#?Q zeAwXQ26GM9dYw;h;XiNmZy21Dow9d6xy3$i^v)-@=%*O{41=9dZn0Tt^zM5+(L0~q zf?JJ^^T{px?MB~iu=B|+HvEQ8``Bx+^T{nXXN=zY4~DO|bLH zE!g?w=D`Hwd~yqRKDh<+g@~}=n8D5`x9Cfa-udJfz4OT}*!koZTuu9Tc=gs8++^^e zeQu>a#qb_f;q^ApA&UCt%3$MrzUbG+J&72A$A1Qb2OMw#wxYIapql*>gEAbH(W3e# ztJ0o}Wbmq#$&-qEs5c1rL}Djx$>6m`pAPoxg$4#Pn*FrH9~FNb2XyZO&c3BC+D6|T zRu^l>psOBSZRwll&*hLMj@=1|Z1?^W_pC_>H3TA9&YbW*2yw!ta6X7vQ{pJdTXZbX zJT4D2B#m9t$u|5d2NjBWT1=ckpiIGuHp`O_hYz2x0ob;0JJLLdR8hXgP*}bh;N!U? z`LMkCe4BwS-{VO0+)zdN9)!a3Z3Z9Doya##^4Q+*Ay~cy63T%rAAd)1f=Wm!PV%+C z!;xkgrvDYe^6?z73_2C%ehCWOzH;#K+?VZ(N*?)QC~x_ikWda}`*@h>6I4QWnfCE< zkG8KOz}HN2Bbwwr8DefrN`H2hFybleKz6qapWF&^d=EQj?}v3U+%I-I|6({N<9!ho z?K|(Q+VR_u{vJjnIDWj$(f+#gWu%pl=P+{l;wY8xa{<1VxHnJ9$IBz-<9&Jj`Fv%_ zn2xlH^6d}sZH{~Qoym74g7W=D_;g$vks*h8N6ESvcu$D2_Jik2`W_z*wcZ@q5htjG zOe)58FeW_f#V+92TM^*n|CP(MU-Dg3%Xbo!nRevEko$c12%q+2Klr$IsAxaj`8<@` z5B|@Buc{GZ?Z*Rwde5WYI7nD8A6LnW*>QOde3|<3UP|P&*7|y_s>xfDP?51b}F>NTX3ZIw4GvI#geidk68QNEkLhSEo1nuuz0lq!p zg7VQGroNQo-a$DsVeb3o$pgl)`ujMItFco&r8_;+S}$)s z7_gULX2It?+JZm%Fs(gx3#ZZ_}(Y8W_>uct8m>Pzk1{2 z2g~34-K>rCLQ{87sa*HR$G=hj=y$V@&J86ScHcO^^38R--iuF%?g)M4#_f;I|F;Y4 zc1^?k-UqT~&4%VsBv!N@Q!ghpE_eFZJ4W1n+0;$#;n>ilrFcJJ*tM0n{Bl8dG`Ue5 zHfus?!F9dwJw4=5mVR`3dv3?>*a;}|9*KKQ_vCiW&g~u6_Vw1*L&{ zT9LKGPvqW{i|?!aQs5br)6?0VGV9nq^zQ1rcdxt9x~cr$DGSy-x_jyThkk!zXvzX* zUe2zFnYud~BaQWqub=O|# z#9?AAyI=ReX~KW)M#j*vXFM+ZzxI0>Z=QMcjZIL|cdB{$!+lIHgWU0wn8)Q31fH9* z9F|PCrgDF$9$j)mJu&xL>SrR<34Ro@mfZ!coZkeduq^Qh5LouN2w4c!{|@2P2-LTM zMD-hhIquYNA~}Ti#6u8M&*$9CqJ9g2+VlAeg?eJO=kpc{^~78f$n$r=Jl`RH%-9es z=huO=kk7JD0Bc!2#lZl5<=y+V9B zHuWy8v9~X6x>m70&ND5)+xHvnt~}kG(RciKSkQN(*iXH`Q9vyBC3x+8#mek`$^T$U5d{dR6)zIU+>G5Lvk4#Vw8ycY3#Vw_NLAMY0Z`>_4@2|j@M zyx^;$Uy49`?h~IR1`qco?z_}e9yEI1LslE^uUZ$+dsWYKWyN0+%zcdeqH^vrdhUzL z!|`Oajb}WzR3AaOg=s`B(6Zr$8V~iDfl+Tl}68VB--4K z_(Mj&Snx8$OO1ZHVDhaJyaw@og4qUcCvtL)-XM4r;s*tDOtuhXoH?h6qq5U}!Px8; z%yo9JV6Mg7mgMJt_g%r1mmHA&LHeBB)3Fe&Qd?o)b*v}vaKlc@4<)0%q zY{Pu9DT58M^7Hu!dC2eHp8*f&3vpETuXSR>V@W45Y|3Fn9F_eJN&lIP#oT84yoO_> zm~B-|F2$USiYpD~+*5sx!A%BpZmA9DlHx4}?=+ZWr#AZyK5X!DgHIZK*5LC7zhQ6= z#z*-J42~N-*5D}yb31C;DucPbRNr85i@~i1|7rJlGah>ecgr(V(Sh#vWhxW;ul1`u z3ENF2TfkL_i4&3@i~WT2ipv0o*yVA4bDd-w*-jcH)`)qOxd_C17Sx{|*Vddt*ew)3 zuIm)?Y1^4*T?|_#*7k9q;rWh=miaUkw!e>~0H2Yuzu4vd{vHHoaqhR2(ySC_TI>Bj zFw3b_!)}Tu5Ni{DVlcBe!;bw|QM;$1u$vWmjf zP*}c6;G-S+c!*Ix+JnNEI5HAY=0U^yXh$5pZm+@V?2n;W(R#VG>l|R-VKn}Ksu5zf zd-sH!QWxq# zvh7f~x%YE>S?=r$`nX% z7T%_QUL40wEQB&Q?UQ(w#BE+&(o?GTXl|BACiR!}l&Pjqp1(~#ku|b%-M$mK@Luxh zl>Eo;-S@+6KQETkI_74t9yptU8U32T@RljDTN}HMY0tD@ez~okm!ct^YvT{?xG~W! z8y}kcca+B7zz}xzlzR=0y#hx_Jqa(da97*(5426cBbGBR$Mqdvlyn<=&a*HMZw~W( ztNdzcTHd@-JY}3*8~Vcf*v?pVZ}<~g?GrrO&7WJhudVZwYD+rA!pwX?PD zWb3Ox|M`Oty#FKXV_*F7kwf9Xd8EB~;#}@t*c;!>?U*OZI8r0-2;zW;kMe)#A$htUFMAp2IbA%-FQq7_S5X5-CG+jpZ&RqbGPU2YTMe7uiNN_ z#$9c(+dTf*kUM{JI#zl7?xQbru_)Zy-CXo=J2;z*k_Yzf%6YbXPEU8$sh=MEp=XbE za?F&j?sc)@MZ1$(59cl|TRy$JvZthA_AS^sWmm$&dFnkUa+h;SN~v~F!dUr=jvY5* zEo?k76g!f?bD`kui9MZPGG=2YG|t=Fy{>9gYu>}HZOcN_f12G>n!jsR`SHW*-3_H) z9^Y1)-@6r__S)+6+qx?^-R~+NCWF|$p(y!S4(uAo_VgscE*Y%vhMpccI#W%@m@!+s zTX%nogU~xXrHAG2GS_~evxS@;$42*d*`>2_bX)f}94|@>9>XTtQk48r&R*F^-Jm9O zPUpVb`$nwr{DsfC{N9|{rKx&4jukuY$-2jKZtF4n-SM{Wbw$Z!&Zebp>`pSL@jzR5 ztJ8e9ts9L=<{bRyLFiEXc2<4xJ4MN@rTOP_+J=V?e(zx8{S8y^>})N6?C_mGdH$D0 zS#ZPHb|kOsWOnr7t&RDy+^$(sPl~>`|vU`_q?T*>+ylUwzoUFBVFX*j16lr~= z)z8{-B?wk^SFT+X8=Gor;}ULeNBg-5*CSBB7J)b0h&Ln9hWKv{-U3X?R2N_RW*K?; zJEP4QvC)|PV-YBsICa%i8Bs8?KP%7 z10|FF9O!A!Sm#L#|_Q!?2UK~EdTluR~k6KxoC92o1)YYJ1`|vz1){shB4(&wc-9i9>x^%5c3GZw(+i*j^{^!DVgdjhMqi(na{G^ z&vd^I&VSm{W;{Z>;BO;V`vbr@H*hwGjGj*vwCrJndw?mK+BOAxmSL=YsQ{*AvbS@I zmt^^ z|2wd9@(p&?|IX-t4@}MygbTphN517w$<)Wm(6bCSDbmKWzjN+Ry<8=Jnt_e}Nz)LG)^T`eM5H?(zJk+a-7qPgVPwZzj!LK9M%KoR$) zYf2T7J8-IrxG%9aMSG4*N+Rw*?ASD)+@&PqzNE5g`PfQS5%(WvZ2q)V0w@x?Igp+i zNaHfwNW?uMOerGH8=Xya4yPm%x;>QuinwE9N)>Tm_S^KGsf4q?E0CTSNOPS?NyL5C zY14N0uzs1EV)CEww~aTbQqtG&oq2!;vxs{G(%N5{O1S)Y2GaKKA)Pw7BWZ6$u>42e5k(8-0oj+_e;g_4u`WF!^j1Z;lI9smerQ?<7h=9Jzd_PPF8^lV?;Fnw^5IqRK){~=UrmMO`JF0-X9)RN zFZew##Y@i)-6m7{}6Cj;rP2GZXRq`x0XpOQ3>8~Ip|`0bAh+mm_+Xc7M7b--Dk_iU8^ z37fCp&|TTGdi=N9WlNXAtCx9EsAbvmC8dj3u2|i|e==KIPA_TJj~x7{c~t5|OUuWFAA9w8D3QKUsUBdr28{V&r0)P<~XSd zy1Vn6->=KMbXE?q{6`YMXkQBqSkSXu`ZiL(an4npjB;O^W%ySo_@?OMMoQJ!d7<~O zkr%bBbe&GUyVY++eJBErUb1Q#zO2%(xRy6BbG{MN6kdtCWh-h|rTqK#t#GxYT7>Nz z^aa@0_OEK2ment7`FIHZ;mks`!g>$vTSA8f-WT~XSj)1%^0vF*QWlY^&JCL3<+;A3 zecx#7Yg1Rddf8&Uhlf3ERV_Y6OO3gi)YhM&QKxw(>`SeE3hdpwG5Qv$y|1NVCEn=% zcyK}JzX-Y0-AsR_3_20<2j*dE=YfnF$HOf}@H(qLs1Qt7fy_czEzpp)F2j}oMz^S6Y*z&bUp9B@4 zMR);n30}+mtALwNuZzg{&C|yRz8U=-`e~H?%5&5x2L^qQl7}+IG2-`m20U(r<Bu)_K4oK zC*j%iSKI0EOi%B41UnwVj>lY9gsuG?uWTP4tN)>EP+sKYHZ*hp|yIo9%ukw_xu0%<&>-U6%=-iCd z11@c}LDFI6StK@WTa(zZjl{~sIjMDhQf#<=iFF)4B{rK8^R8mSwfKP$>)dej4ez~; zfsXAcklS{|(V6&xxG{mAeIZtT5isp(ORRd1BlT=EadZ}bAdbH*h1H(dy9LmbpEx=v zWm9l{3a8maAGF6b3Kg&;5aOsDk9eq{-^6ipHJ)#4C@ zXahalNE{Wt8&7r$LL8N2rR&Rhr*>s@&c6?;0(2;Wn0N1p7a(pUW`z*fM_~4aSm%lB z3+y>&??PbN4#Z3ob3Jf<0p=3H>dDD=5l8RF4`ecemYqcm8}^qt`Vss@!t}I2hDR>$AtSrK{bM*Kkb zBT)Z6#0Lc*MvUp}Y*;U`ZacTVV2>%}zCB@CZj<*S5OZytP7Hpwfmqj~+0?`4Fygz2 zVZ-f3tlNT{jW!1mFC~Tzw->Q)izez}^F73Fy8w>?{%h)C&uvGnoExc!&0)l!A%+dN z9kFtLo_g4P5AoNCVS^!cShw%B)K9_>#BC#Bjt{YJ7q_;@y>k<{jbOuZAXc7RfeT>B zrzuOaJp9*){{?B)J3nw@^NP{GYB0yW;63<(5Jwj~=p8#y_6{VcBG88IBvzYSsE17z z;znZFu${!wdi+3EA!vJA1^))I8$;N0+qp4Z0swgkLG8PUVZ&`ltlMI@vH6DBaC;H! zws6N>w2e=mdc}s@i&%M{re4P9l-O{45i8Fb>V@Zj5u-hE#KcifD9F%oisxO#uqlO} zIC`%$2{|9h#oqSf_Z+k-Ll$wAg9b@ZFE+EqhWiMy+VGnXZBL!pa9$8=zZ%7cb7QsG zaLN&DzgorS3~V-u%@o)WYn%B!5$od9zORT)1#F1*cyUbh3FwKV4FHg*sV~O&awz+f z*vx>QSoh^~V#958gUsP&i0SWuW%++nrV3_X=(mjHRtX+r?Qe~-aeg#mGY2-rYV+TW z4ZkBG59ckhj*0WBiF#Sr7sZ}WM!zKX)vzblW5-v;hW7M%M$QGWA=Y{i8=GTdvk*4K zS}*;g={BV=H1gEIhFE#diw*1gqu6j4BUYX;@|1`7^2x)^L9FM`?-D)NKVm(9zK(k7 zJAI_FY%^?#qsssw3ysaaV$%XWag;kfq(k&;1V`oC^1J+bzk zJ`S{P{~$ISU_-2Ze@<*Tm)!A%2Q)|tLIH3#;!6c{cO#D0;RoW@;cL8e0j`0x=ek53 zU5+1-aH$7aK0MmPdBj}QAzWX=IM1ZS5yE9e-hLjw-oxBi!(%+m{Vgo#bqQkb?2t-? zu$)J6j)vI~2tsj~oK+Bdgawa$V3qy7o&SxzA`HYlx+fO~lei*G}o<2I{4cu5GLYvJ*l3 zxQkf&xSv@1c$irFc$^q>m~s+9`*@akD7D_Vyo%pIT5(P|g$oRh8$8xvuHky0VTQr( z`@9@iRmgpxC%D1bv>41aS$X)qk>c$JcN6D&oR1s)q`|$!xQ3!UXYd(=UorRsF*i6Q z8|#VUJcCCPU*g%689d401o5Sw%^ZWdR;#|A_#K{2v%%{OP7>#NHvC3Qai_t1h%fVO zxZWy$%3!Xm`Yrei26J6i{c8q?uy*M8;?CdXX`1+Ovs4a8iKAX^OHY49#$?v#-I1|K%q`I{7*lSY5mU>=*5=M95%vQv8cYEqjx zvAkyB{7njW{w4)Gf0IRC+nm2i!Oq{L;0E%H^la!uNpY*e&flciIDeCZoxe%J&fg@? zw<*rwq~Koi2!77sGX^_Y`1$UBPu=6)5*!i0j?EFm%cK#*>JAadcoxe%J z&flcq5Y|QIcm5_t@BB>)cK#*>JAadcoxe%J&flcqYQtGWe2v#f=WkLleIluTgTa5& zH_EB!NEx1sr@NFi&x-myB~Q1^{P@iMTeiU%iUYqzK2;rz9iMj&%6UNg4w63J1NacQSW)Xkbl|n1kMq?O zwOI%*V&$y@7csE!nYeKopLyM(oxE)_keQjI-cVnJ(!6=%ZM^}Ss@!JL8K6YpRce3& zX-m|gY~AZ6gKBu%nnn>KTeHNs*HN*Rqwv)X7 z>7?5-ecu{f*^4Y>1NGHk!roRN{ZeS(KsBT-d2g$hw336U$u5&`t0G%);1Ty0*Nb%< z%j%%(cT4bprC(&ZoOdUII30I#6@G~mE`@V>+`!oYT!RosU>+||`CNl(oFY1@$FE#| zxisx4cOnoc5GaYb_nfK*7?(Ld-+Exn$NLb<0qEm(f)i9i*2TT{)Bxj@+~?a3Z24GD zE@OdGd|wuvpc0add-wKhfQKQl4eakfAy~f6NXsn*pcLOf2u@H5IS}{mMb!WgM^HX@ zUju0!ziq&o_#&v(j^ESq6d!LZC|?EaZ2NZh!^iikE#EoA$6E@@_ptz9x8xymLOaUR z03RP1alC2}cxyrV=-&!|et&lXXPPe$2l!&(<2G~L)AXtQ@|q~llP;1ysvKg zs=-$clNy985tPr}lR;YBcSiCMIZ?j*1AMzo`*>SG`Mw)y-&x7?*gQMpZw2`F8$Mkt zIG%3=_|8E`y^6N)4*|Zz;46hu4FX@2()Nvyq>tZg$crPWDBtz4BTh)hS@6{WGw|NC z^3@0UcrP(i`xXWGW|XAb2Wp@1;Q(J8d`aZ1X#2JW_!_{+dx$kKyaqwrcO<~K3pSb7 zE8dH@{pH~4{xRC{xqC}U>wGx?J}a8!^CV(KPWrRs{VA?b1KH`9W^zl|`LJR+71qTt z5uISH?K_Ob3u=UzeWZ*7AWkp=DKEu6cG%Vc^L9P+xE+@QSiYTEo*zPFIiVe;7JxXx z1Y|n~?L6Wd1l|H?9{D~EVEM+P<8mtyxt<;4WPmSuZEAhyt#jr3Mu2Yy_{Nezgm#p# z1^7C_*93hH0v{_VpSzcaw2ogh_;|chQNA|-Y(IE^Gn3slICxsS)_&|h7_dwBW5@3? zEFbTmW?KK&!j5fCNW)`zW~1|&?;vP@p9t{n>4%T^;w)c<;k(K3y%gZ<1)n_Xa4jJR z<#d3r349gM*C6nH4{hJ2*buhA7rO~b3-mPze}SNU?j9e~Fn7{~jC{e2l<(dE-@>xge4ZwD+&^{)+SdvKxur}x zpYO{7z81rGv)GaEIpNcFV+Z)OP2}U)GSIK39p_FMZKr{VmU##4h!djUjC#4|*C0I$ zfqAU=wgBH0Z0}6xC9?v2op^@GTlzH!l?clBV1SSJo-^^a1^5mazS)NFu<+@))X02< zi4z@{3xRrhZ=3JlsOY%-Hc;==s8`pQ+hMHzD9Q20S?m4#e(L?G*kSWI;XUsj!Hl%t z55tZ)K_#RD&m{SLt_GO%TI<~$sCOfX*;Y|zmF5jCr$B64D9!D zK^&E#5tCe)tt8$hzLDU)D9bA)e&JI7?3B)Pb;r66MXZj_;UMWg&)UOqdDc}M z_Bew+&nmilVqT8t^DN~#?d|cvcUl_Hn2nVi|8PloI3L$ft_|<&4s~^g@2q`SU9EHz z?y|aSN8b69pN@F_+TMw=oY^)(+DZM9cUuN~nv3GSPAlrGO5aV)3vSlr9@Gjgw? zUndmsG##6Y8$Y!PF3*e(#dpUmMjFj0pt<@;DD-S6+>fQo9vcOpQ1>>jg#)^j7Nw7k zbpEhXhEuOvd*9mhO1f%C!E#IyJZ;$)cGX@D^})iP;t{*D(*3D5UfEVWqBp-YdH54_ z7U}w&>hPv3Vrl)#Eodtqbtuxfy{-7_9oyGFyyNp*8e8Fg%Wo8_nVlbK=fOO5Xzi{N zZ*2Azk9hV--icv4cJpVyqpdjpQt?PQ>neVi=cwyQ72I@{bd_LeLOnCbEJeO;P!VwfAGYTwTJ1;lm|&2o%> zR!{L2Yv*B@;jvJBlHNVPk6*8@;*lOne-6Ilcg~zUZ{}Uq7j^U%F!J`d(?eo8^!jxo z8;xzB=2dh0|2e;3Ji<_TmPo;Y--+rq)_jfEh#ikQ6xxLy^0*X}PqDSJn4D^3G3!u0 z>ro8o`^&a~WQ?&iW>i;SZ%%i8qCBO`nO!houpuL_s{HZp)5+n~}N+urOt)dNM zN+uf~t!cxUlF0@KaA(7qV_SltXNvzB_D>5x`n7BXG@pyO@%QKUX|m#C^qP^W&)mP{fT* zN)>T;+iZGtD&g#}4W!Eg>FWdO8v^OEfwUbxw#S}TGRApToLlI{mab|GygV8v)%cjc<8SK`JIyH z-k*>8@KhlGU(@oh4P7dG6Zfio_@v^ymMW}|@5ZYzJui@M3Zx$hq;~|;yw|QmzJCm) ze;G()Bl$x6pwF1A0{PH=9OWGF78`HNK;SomF4X@o)DU}r{~I)K8n`ML*O4|(XfAa z5vDs`K{@5|eNc#x8Kej4Lt}7GE7F|oq>nUTC(vyGoWX-d zxWw(w?k8O8VV)T%=2=15941xoY|P zCVJTM$N|Wm8GAQN+;Kv`HQ;^Mu;_WVp?V%)^c#e@u_-k+Jo;-{9{03tIWZqhKu8_t zX(fbF_$CM4*`=0EQ2!oJKZ96q?o|@=1{GuuLRd~otBCm^08)*hcmc7Tt}P_y&3#A> zLO6jRNIin;8;GUvO~lfMW@6dyEyUCCBcku&yKNzt4Q`w#cm{5qZ}u?n$@1G|3UO38 zc}U9I4X0`@yO|;@>^Nr^n{C1c^9OVN)2+#Zq!H!8u6*PH29Kn9uf!dG^ou0Tj0x%>J@0>m`oL{&F?-D9ft_ z?l!bxy~I)3k2oEbGa>kC#GIeB=k_O#%Dk$kUfT0fvElY4j>>$i7n@epyGm?0ZHSd; zt=O<%8^ng2iCB3yiw&=uc8Cr4W8&y!{6IPp*dEsPI5FBBM@+1B9iU#?{C#5Blp-e9 zx_%@!v9`HJY}jVL-^2DKU_-2J{!6i8-`9%G4A>Ay zrvgBdqOTOJ-;!^UvgH4U*l@lOt6!1t8XKN}vkg_SA=d9A-FK`Qle5r0D>j^K#A-u- zjyfji#byC)i1jp0&*y_DtmR;;%PHpDv4HDa?7@k+62h7GZ-Xl@AWdHZ6u0I8X9IH$ zq@MdVadZNHAVmoDU%|~ckr*~H!O@!mMD*Jzme+5i@`$;ZK?)JVvaZI7seqIr=(k9m z-(gk=;T%=}NC{$TGob$+7Tck9Iew{&`=r+8IHj%%>aq4xDiO3U&JV4thFI$2xT|lj zH3n}mcndL(S(Kd!igy{j-{8Zzc@QD1XCB61AY$@sHV@Q=3og@ zmz9Gpk#+?+m_md4z6JepFIV%sg3$Q-+LqeT_`21r2YA67rOf8*@0$czUHoGb8O(t` z5)m`rfAIQ!kqX^)y?g{==D+|Yf)ii>bDd-vwtl~Fyr(+h`LP__yYInL7kj~9Z0$UG zTb0;?1Jr}5HE8Mqz63z4F#!k7<|gZ(>q~%8D2_D_OR@hh*d$<{Kd30isfW`iBx6IK zciupImZu$$-?vIy4x#S2PrZur&47Y9AsJi1R|-tN2mfdaEw$wo+>Ec`T$=O z@^~(#LOaU30N+^f@f?Kh|Qi#&A27vwG13n!;-q%pRQvp7n^U7&o8sAR>d}|C} z-0;!oKHE3Zl@5hIg#_zTVIIS6VyE+9Gn5r-gjmbaXFqX5^0uJfN?>lcYY?;__XXmf*JZIM@&uk<4C_@2= z6HGwj1qe{Ezt%~99P1|o8VK;>aBDAAy6Fx76;|c77{b1f_V23}y zecRAJuBmJv>t`O@_eg;6W$@A0ii*~|Gr-54h<4=Tm?|IbP4UonEOH5C@>X53*ySPS fu?bVbmy>7==a7ol%YDnJLwj(-u$z^MsNMetmE^;f literal 92072 zcmc${4SZD9oi~2xC6ka0nm`yr2s#4^Nf3|#Lcm}X!4MEF;bj0TivxK@5+Dik@<TA4pr6Q0*qEt1&HGVOxz@wn?fGt#p-bS7fC{*H-kYR$Tvzt~k&4d+s@tJ2wIC zexCnl&u8x3-#O=ZzUOy-=jEPz&zr9xP`9D#mc$#qv1XddYS89?uXo0@Ig;g`L`~Da zrfKe%246Q$*0ldWu7(CpvtG?`vtExSYuf*V%Vz&j8+2X2TC@GXyzbbc*}mLWv%b8n zVN?COE%$DypS`ZSwz@%!b*iWuPZCBv$)q+SJsx7tt$&O1lHYGURPbQ zb7+RDKz)^!VaH9==B%qMZ&+84fPqcXfKm6rrpk4-+cpjDGnl=uK2TpDShuAfNek2k zYU&5G)COt>QWlM;p?WA+ByBJN9M?gt!5-y12DB)E%W9c6iws6ehw?CRhw!<#eCN9Q z>RsjQs>(NQG3j4KLdn-vGrjee=#@{!wuWtWmNXlgS-)-l#_|mfNKV7Lq4n~`9JTf9 zHk8*jtZUf0#S#bem7;H}4^&#bs%tAYue&<7V7UUa@Vf$ZeM4P!ZRNU#%_2pEl;5xp z*;HOzU%k0DHV3!YRX3Cm6~^!wR1^&7D3~Rp4RxE=#nd5@S9Bd*jiO#L^)Tux0>sKn z9O}U8+Ax5=u6FZ=&07YlqJ(Q0QYv$}?bQuc)X};P>#qWT1+T%*LyKv&6IV#XhN|)n z_g<;wY(P;n7=-G}(DGcNAdnOFqOSbD&G(j<4VG+6-R6qwO>EIB0^2rO>J9^28ndVd zrSL*g5@ayCWU4E#ZwS;i1lDh|)Bqu!x!sMzE4gZsz`?l6w|*On>rgo)Q&qdU)*54d z-B6hi*DDoCcnwh`RRD`@g4t3ejXE-9QU|;SRg(d)dbA)=J95QY_3HE8mO+dJhm)y$>#=ZUUgY{Z9{cMwdJ`K8z8W)p=vW4*qx%XeyJcs z*XmeUHd9}Q?~2c;0XTENhE;LEXG?j_P-+{ha>zjNx>BKr7Yp^3i>ze0LMfEKUsMVu z+f}pO0);L>d0lOwq53}KA$Wx(Q~0ZDT*7{l#=&+4jl+i;ztQ?SVS1YwikvlFx!#i~ zo6_xZIQS^zWjhI(@kC`=drie0s_KaCZ-1j7YP^b=(Olb|>!4+c`cr#k1E@ zZQB!x9F9NkI7N>|BNkV7^t$_c6AFgsMIy&t=N+2okge|Q;rlOb&#}AaX~nl_TQ%)O zfwnagDW0S0d5ujyVc)?td+|-05z<{Fg6&T9#5;mN`_bNmzt&UqoJGD+UZ{P|{xy3R zS9SE}^!0iRh8ysUhXLOI$|vsZ;%v<8)tTn%y;ChB16R%}zLn8w?!jw%9?pdt%%Y?Q~mWxIF|+ z&pVpyT20>*Zf_1%rp-Y@p`y+dsAo$2xc9?(&7n}9kyN-N4b-Rqm3K>gdfwu2WvjjT zxd_6zK8WZkzbQdlq4(o1pG(h ztUuX*mrXB%2s?>@c;ZjRAtsR-Kk>iym!rKI%unH#Xk&c;7SY?cr~R4v@~@FafkmYf zHS=_DvPsa{Z$oELb1Br^)E?;$v_qK>0SoB=+)^+X@`oxoaPU9EDYsVt-OioCjvdX+Q&@BIv3uc3Z~ zq$254634wSWYZeEWLws8r0_qwTf_C(LM>FtfEZR20m9*pp)mwskiD z*bv``Id zA5Za2vU`f{hfz=9{MZl5;NF>X+<8Z$D1J=|nvZ%Ge@v(2xbsw8Ny<4k9-h1CSv*{0 z{#TYpB0KUV&bh=lCXW7KB1%;<%CYl&oHixVb6Q(JG0lJAvdhL`B`JF#4PlHNlx?Kc z>2+7qDRsnhGAp31vF*0I?YSwdGK%ec&#wI^I1(=A(*V>OrJa zmJ^hR;|@sTn6tI7H=|%2b;Bx%-Onv?(RtRtgtiWDd(Ah&X6cWLEEhr zX=7*T@iop>;eU0#8F7z1@kS)yR%~bNA_wQ$R~LC!+B*Ni^8z0eRU6O8dxpFq5L>#vJmqn^sx#En<nC zD4(fO4URkQNF?%bLY42SblbzO+?2|6+k>u7XGQwY_UT^tn0_QNK#mDqG)ZOSNZ&jAL(y)ri2q4Lp`D2-To|m zz@MPOXXA%>h$8-MJOO_jS@vuJl7)KdK&_0|x^2ElBs<*+zIQI_N#VFEK0}+Hjr3(E z>tkWbuow46x^L*nOhH*O0Pp&1-?Jq|KzJkQ-1qvPT>*dLC?ZXNmyx<%v+;C45^;6Q zj43~H*5;jR(j_&GF(@)CE4 z7OxdaryJp7*M@6fcN#3E!tT>hGlZ!T_AKqcY=-@!u*Ztv(2@*K`R@Rp**LUo%~nV= zQd3pHz>^)(X!y|popx=C#owCV8?>9GzQ}3U z@+|z;@YM2vaSY<0q4h}pk_#XCwZqar0`v$iPP@aDzw|e;3;ti5vY7t8GCd%L{~e|P z^uOD}|09e2UJL(?GXC`lJ3>p*9+&vPzxe?kZZH6Vj zzgXlsWC?%9;(x0}KM7H3jPxIob|b!V+FFZ#es00P&w|h3ws8gsu~TJu2D8cH=O*pN zAB@N&pFyYLX3H>W-fZIy+DjS^9B|5!bSmx`WD@Sz;XX~$^yhmT`KRNaPkI>sUA zCJ0hnKswW)OGwM2zLa!|;l7&mM1#JY^hkrghqT9_t4L=XG}Dy|eK4(zhBV!7mNe7K zM;zU0?!rYn0ry`@nmXu}G?JkGo20$CpO-YneqYi|uM=g0IMhd)q^Xa|lBPc9OPYEs zmNaGmJ4sVd+a(QBdqC3E*>@#f2>OJislV4GT>|Xl`Ia#9Bq zB<%&ABWb30p^0aOq?r%vBz-sN-IBfs^Z`kifo5G(_&<|0WuUS7jJpfBR4N>16fV+E z+?ma!rI%)tO&R@clkf*aKidt06fJow3nUD6N}9YZ;-twd!d?RchW1o6|8z^2G;Riu zYzA3YY*Xnf>xC?n#J9<&kvg(5b78!=RGrEp?ZqDq%YjWcwPdxiBEZbVrP3v27;ePx zg?lP!%19j2Gz>Fs z_+b-$!bF3NrjfX+4HWX+L|<9nW*IcGY?%fv%G-E@_R?K;Dd?@_zXo)w?253+lBPf5 zNax_bP|}QF=nd{n*UzLoWqDrGOxK?zOy$xEy!?ve;K- zzcRFWNdIbLOXwJOqQ-nfUZ;kmV+N`N^|g6o0suxFH1^DEFq#k>E;@X4MKy~-s;dcT zjAE77;On(!LNR7Pi0KEM!%$Z*1|<1`UUI2i`a(vb!vQW1TVqIM13p04UlA&XNtK&{ zQNZYI3zNW#%ZO=U*zRg+AK+s7t=V!l1sDUev1kLS64}flL5%X5gc@Mrh$TmmFuvZf zZc};f6_Y-QQ6(%|9Iia?Lk^lvt=){T`wQ<}IRyi(8}5x3na$N@qCCkFmZ^NbTNfxR z!yw|ol#OUK4S@kigfNQ2F3Z5FD!6hU#gIv-ZUSPO#nrTD=CBqSsWvgSLCmGN5|C2x z0H@L(QXm{F>NeM0VLry75y^F|UNNIpF&0@KT67QB48;qf0e3U7}E zZ?y@J$x(Q1=%a!)nvNx)H$~9~;kNsjZUN`*s-l+`vXm(ie zO7H*=BOvkks-*Dpk$5xS7TBo=Wfa~FxRWlF9_P{jA|LVi#Y5qZu;ASf`;9UTZwha? z1@AAw%Y;Aikn||tL@3iN-%k;4DEWNgGs~BZ4u--5bQCYag4Yea_3&3l$>*@(%{1Y$ z-$*{n;ec>v`7+?aK94dA?{heiE|eatfv5DxS5AfZ3TQK4COl+!QiN1^r)8Kz;i_q6 zz+>Nu`r|u~!dn8`jJE(DEYr#;Joep47fO%&fwu!R@kZlPc$CGAcRxHX!c7^4$F7+f z??d4Az>Rq9Dl5EB&}O_X(ECvO`>_mDh&#>CkqJtF?5--j`$3!Wb^vcE{cV?F3UR0D z0iMzyKW!+yZ6M5e;Va0u1$+!sh>PZoNj}D}@b0wWwE?eGgfRZdN3#e7=|Wmy-ZaVQ zgPnd%|2%uFd>;Z2s*W0kmk&NO-e)Gf3E)GRa)?WkgsApxAeD8wEEZ70vT-TA7cF?-0p3LgCi!SRX~Am*-aT+99$)(v z-g}nxHlnee41Z;md~aLQd)|b{&jkwalm+jnz~gsRWfWe&1+Nf|zyn~Sd{b~KyvZOK z9LW?W0gbo9po5~bL69z_Bh0hFQ}u)GFa2mA4#JG*1|H*6hI}*$AV?R|0`rmyFAsM5 z5w8K|jd;^>(aZrJ%YicVDbv&v?-$K2$(ucEwlTTni|3Xskni6{ zA0`LiP;8p_TqJTGE(+F&JH|;d6#l)QN5@QQ!GLyKV_U1Yqb>MY>x8l4R(mi(3pvGj zk{AlZP+=mceQ?|pBS-R2w}&#rsfY9sMp2{VpTGsq zd&T&d7)$e{Cy2pU`-vO0>XfSX>;v`_nVg!?*9*3GgXhpN$unL9ho?b#cSwk9=zVDO zy!fj22kkj2yA$?$?o>QKJ|2G_b0E$R7d*FDwQu*>nH9HRqgsSY zgUZCb5Ty*yGK^~Hq>OvNqgVJjpeWA^aYB)?Ay13Z`k27}@t+}+Fk@ru-q!B!J?&z; zhM2eDZ~heXP#77<%{eyviQb-Ls|>qcComa=l->1A#K(C7^Wvid?h*4*m|6Z~A7eg7 z_}q!!NYoc|f0X$C7ydtb|FiC^Ku+{VAOBiW$<29b;Whpy3G;XQ{|@5ao5O!&v0*$RJms(+VD-~VTf z#!k_~uI4$xVOl8u_LJ@!LV&@K*+;HWc6c<>=t8~xGv+i+&`>oIbH+OdkJ(*btsQa= zD{R}hzpypgGbSDt)kTfX?mH>Qgb9RVve>Q%nkV^3#O1qkN>`1XbnC*5$w?4gjI=*q ziK$16KRS`9A+}ZFg^X=>cpfCLJn^5AeBbO*v)$=}9Z+{9E~?y-;$LwQG8E&Jn{7v4 zXC;u}h5V?*+yq4A`jq9R=~5)8hmZ8~pI0tVi6-j0fr*JkqP(LKIE%6vS5b9?JKgrfS$ld*fLQasD0Xc1+vR_l~xpj)8t36*`b7T@t*Qc3WttYT-h}ppHMA$#7I}JWsC}Vl zc;mN{-FPl0_KIP)wTUNOT5lw>HWA{+>H7hB;I3;|&9$GnS?e0#wz4PKKDl|%(SFRn zIUlci(rw@!;5_DbIknTi+v(E3)d;;S389N8YmXPLDa{S+^exJplcE>9s#@coOp{F+ZlI zt^HuPt>9zfS4W?*3-sc>GyhQ!go_T9=%xF1^qfYx2d9@XMTeco@xTIN&YlD5_U*^6 z>&k39*rQi0b7j;d`tLPa!KKlnR=&3ojy+4RQ5vR=?ws+JBCI+lz z?9wWa#e+>xxhIDb+XhRlQF*g&OX_|d-G*v}Id{!dbDWLOw4F)nPw93iJww~K+b$$b z>bjI+V2F}=pjlgWEDj}T>4qNmaFj|ZAL=eSjrhgPKVKv=d#>|AJ95LFaQ`QdJ#L$l zFz$WuiMprm#9$p%SU-|EetkWP+@XJK}=A(an2j zqYJ>k&FtCs;u|>UYtLlec&G;uCR7@1>j{ah6m#41=;njiA=@3Uj^1hAdr;^DKn=#D zo{ilbitFoL&4|QIH~->K^tjNGpwAO(N8hLjMY!U^>W<#bqrKDgJcOE(sQdPgu>0+C zdZuT!O`qvM<8Y^E@X-w4$7f>lT%toi63W!uL#g`ykP{QW+7Ip688>_O9_Z-~v`e`& zXOHG|F8tUzWO)$j>6~SN=zBu5pn9Pnr8L#1O1o^+P_pA&+WyFT*53#Wcg4Xc?M)N3 zcJ$O*+rq=zhH2sK)|841U)M*olZwtvf}2w`kGs(R#c7@{7n(W$={N{ABX>gX$XrM3 z_d?%vmxSt{-mqx-&iUiszx~H<`{X6ip_r29&N<=Gq!Um$OU<1Yatt_1zG{aa9~!BT z4o%RrLo;Ohd=bpJtI*%?PJw*x?*J3Q{fVFJzHkcWjing!p_7kl6Q}v-eq?wcU3(8a zV|a?mbt7vgl%G4y#InWegVp*?!zNCND3)7>JaMm z7lhAsdR8Nbun)D{e$IYs_zSO|9*&M|p?0qQiR0dQG=0>QHHZ-gtC~?a^9<7TYdr z4xRyE*qhGP0=?*I7HInZr0_?%c2|*BQDrZ_RrBkkdc`vXo#ps*j!+S@9~wGvXw-H* zx>jgi6>Zyl^w%r&Yr8MDixML0l;=^ByX-EE}nG0l)X3o-Zf4$r%k5p)A;Sj?ia~&jndq?2h&Esj$U#c@%E@BfwkDF z!F{Okj_t<^L>l{#Z2#r_?p~C;!)y`tBaPd8nm6R1IRWKp z8VII`&$|THjRSK>RH8qzP!o?w_%2Ckd?4AAU>5qaNrEf`T^6ys#YXgt>>A{f($ zgYm@lC}W0+aUg0iHYb7+%S8-Cw23;SKEpncDQd|0X?!IzhtF>a=q?%Hf*uFrJrq}Y z%pb+d8Q>a-l<7rZU|JL_ja;1~#u%)#=m;bVu4>0lyE}nT%h-(gGWlS9xe|TpU|S=i zVy^gCYcHd3D2gg`BR1Yt>aH}ZyJ&92s06xO%xr5?*@jP=Ln;~RJ;rP+9>}(6Zdmho z60^-UBO0}l8z=}?84oerPN-~)&5!|AL&n5}%455us#Y0djkgQgwkpacGQ?U0m|kRC zp5lVe{d-1jS$lQg2lcku~^%))|{|l2+*we|q8}smRN1f@kquA}orW12kgr{fx zuY)(=(S2*d(@)JQ?q2rPoTBa#?&qJHGZ+3^QsKUy{g_n#VzOt6mhmY%=};0}dwTZM z?IBynJKf`f^;DPha00tri3e}6J($QsRB^*4cYfnBen0Rh*^fjbPaI2r;%E`V_dFAP z;>e%++R8{A>uG!@*?)sz=n57dW4qeZmE877(Gy+X#^&UXwnrYzcV@g${HI99SxoVl zQ@3pin)e2;HrcCX)z8zu@|AhoT%bGTQHEx(XH5CT_U(vidS@n~> zcPuQl(_-Zizb91U6M{uB$OQZEmP4 zue%dlJ$UD8H@IwZaq;-nEHQ{v6{suQ9;hq#)@&}@wyE69adEJkIAXXsAWsLw%=KQ8 z(U_g!t=)#P?m90RnG(glt+twCE-SC!ysd6S`J(8`Su&R0xt#K9brl=(r%xB8lm;m$ zQ2p}dOT6*XNucR zvv`}4FKjpEP1lw!T6)_Z3-V@7i)|#Ww*P_U0w0+M8^6q20kg=1=lWkO##hMmbzF8a z5<3urbN$W6G01~T|;AJGLD#$P0nMOVDhCMjhe|gG>%ja7)Q*= zJo#q~c!F|7M^g-Ehc?gRUu3b*x7cs9*cV#tw_EIAwb++i?5iyHuUYI?{rsK9f1UO< z(_m0Cd~+NIODS$#TX4?e|7&UIm^J72pOX9x#qgXzKrC3UpDOsrXc3He(VQ3daoQG3e7~3SaExw* z=F_gX$X8{GfbmsJe-5;bz{qX|?lg;Wjlf9i)52!_kw0R=8|4~cp#P^beRQS$JrXb# zLf$FbP0~LMw-J~f`+`NDJ<|U>!v7|1woG4+u+L$iRT!#egm$xbjns!>FVNOWeJvF6 z&DXYB@V7{LlZ5|Qw568(4oEyhe~YxwBpyrd2<;9ru4qVLr0-r!_}@zWivqt?`?vJH36)m33LNMC2Tdr9XQG@;Se5Qa{+T!Ws1TPo7ac#cS#J}*d` zLH;ah#u*PCke_j;OPX^BCQ6#|-ymr(=-HBH{HrC+GFByN$`Ufs?UJ4hcgC&KZcZ<; zQjy2>XP%R${}M^#CgyL@o$1;p-5D>9!W4S*3MVnI*(RG};@cViTZ3l2 z+0vc(dn8R6z9VVI^_Zj?&q+yBKOdRsIHnhvUbv-5n(=2!nz|KwAOj3>)jFT+L37Om z%`{x3$va=tlKp4TFXV7#~x)M5^WVlmS zo1ApO@M=8+zO)FM7-Usz8#ph3G%-pfO^g+iCPta0DKm}AyCl%5%n+C&T%?IlW0Pb1 zLS`fgNj7u{nn8s8<~jEi1V+dY9=viG3sabfmMv}ngbGai~49s)?CbSUI0G#rHt(Ba*%3K?X16Y;|RHq>vXhh=ge zXs@J~g3csej6WEvo;+jVK3UQa;66>#%%hp4$q18=i~Mc47f8Af_d?PO@dvX27kT~< z?j@2=1^yCAvkrN2rH;WLjA$!BGkp|`?$oy^lc1T_D(Oxc@0B#uy;IWE{eDSP_5+fp z?0+w5%6?qZl>HS+7vg?V(vk_nLUVCuw4KN;(sCucWDmXHEPsnfT!)bZ&0L*TSEAw8^qTxtTBGnIq|q z;8A6U>q%9a`37jO;LLpjCPJ4768bCff(f zgBLXAW?a)iQzp_kgPtkr+d(s(sVoRE9$chZHc%y^?u?7>l#%T(X{JTAlc0%lt8{1C zxJ}aJ7j1>)zel>0U$hl)XPRoIJNb7=n)o3}lmGjYrYvmxlsxT{CjU`MlV7wa!1sdg z!KL_LkTm)KUDD+Lv!q!z-j+1w`A8Dp zx02^8CjL82{CpmeXBzm|NSgU}x1<>t-{)0aaj>USIWY7i&3vSMr0I5xq?r~`XC?n; z>CU{^CTXVe>yl=kiny#+>nyE(0xe2l`&n#HD*3XyTII z30jryM$p!^reeVw7g>o7YUO6jo2u)vadH(`P;J-5@>BD&Jhj+Ltl;9pHZI5hBcUPFc?)l zc>C$Apbi}XE8R9!)m>7nNYeb%oWT(L_hn7frfaIEtYg>_xs|oss-2W`s=9 z7s-R9MPrCYPDfKxqt#C=ua~5>@`#vty*-Ed`x3Bcr~sPIhy2{O-Kz{ubA#3cn24EvAT9( zPx7lk4#_zfkfn&N>lbNC@Tl~uED1C;U^iLpt1CBeziMt+cY42y>=a7vFdN+&{z~8? zp;zD@QrTAvFjzsx>h-?`|EeM6a$==PQBtlNV6a5g4o8c>D9cPdLxZq=Hnzt9g1oRY z4u%stwX$7V`vaUx5ix7NMLShrzI9u9?S^t=ZMZ4-h0d@jTO2wd_MXXLeFyuP7os@PLKwrNn<$fEkGH{~IR{(Gy( zHSIDwZ~Q){%wKN6UL*LXtqi)I!c50MX_sNW;`;IH0cPc6KTsL=8)?$PN4k&}n7h%( zWZ$t27v-TJ?Vq8KXvSLrH}+?hAs-F*SR-9X3rrR8*q<)L#r`t=hOmRCOLGzg=|Wmyyw@9iWuQSu z@qP*>Gu}hMW4y``gXS?1qzh?*nGBFj+{--`|xX zAI)l9X1w14kKu`zE&XVphs%t&33wdSP)6b9!@-Pq9(by}mD(-MtwaySV?nP~2`;Pn7c<;P9%SLvN9SBQS#kn!TTlf9sm>Z zzJg2PWg&59`Mik43x8!4o)>(i3#CUP8Y$I27r{;8ePofZ5O^H3QAXiiw8(cq@E!nD z8Ls)b6y7Q+pIrjz=!^_io|jqVW9F*%?=}bThSJ_5X<+P~%CqYQ;I-W9;3{>yMJ z#6>^axp%Eue?J8t^`Z>V{9 zcn2+b-vJ)yaw((mS}b@~S%?>W#N+#b!uyFOKN^#V?w>wt$&c=d1LbeI3GV?5-V?y% z+%jd9eBZF(6=b8Gl=7`K;mt>3V{jx#m;?;iK&|2zcWK1;k_ zJe<{Y;ckh?bQI$`MX~vwNz;K&XS1sGu+xv%2+60sCZjVvRC_QSd`wdzE}AgnRqeq# z*j0L;08QL!xM)g%S7wmnU&UMKF!+?$Pr+w4F>n_QjDM6IL#Yl%vOUo{?!>hH{CRQx)I=u_fb)EbY>zhJ~gisu?tJ=AJ(Hbn)Z#D zwTCM=a8gFfc`if;or}eJpm)t*)|={1b0_w-MehC$))yx}o%ehZs;=jPqbHPH@G3Vj zxj~yYv1e-}(vC%sqqD~Lya^jDOn&iX+Vu-P8U00LE8Gc{BZs%#hUL^Py{Y?t&@=Iq z(#n~)75@PzwaiOI9H$ab_olw|r=C3+-uF#$7^`R}IrQ0~xnrB=B_wTF_+_WK9DEZGG0eeZbd7b{;KC|huFZAFduDR;5qTEH&b-yBJ2LxcURZEu1(!ODGbw5k z4^$-3b}If{oG#Y$Eso!KmvD&_>+--+>?&~6Wry#4ymnx5++9swt7ADPItw!BBK#fj zuR8FNeMjD|`%23ED=rCMV;v#mvl(dONR$H`wO!yY#z=Xv^q@QSg| zC!N7cH{;BgwTTD5m8dUB>K86tN(q4;9Y$NfO{{!Aus9(%g(}lm1W}3;Z0-z71_nyC z%e8UinbiJFGvKzk{?sVkl*9ugobFA+&V|%iKfm!?lXT<|PoXmM5Im=;bqXbT(rtGI zyYvH9ww#nnImn~3568XF9YdzX;llcKwSrEyF>GUL(ESuf*=^E}=3AH~i(UCEemwq! zQFg08n)@OBIp2WBDvxqkcvgQUm-1J4YdFP+?u{_YuF|XQ*7V`AEsVlNHz>w#l?ToC zRsF5$xAH4FRD9P;Je3|5pR!AD@eOnSo!UyLL*w4Tn`_0osrhhl!C_l%L)}i{@>RGb zYMbjS1GUw=#2O~yyadki8a5!s5sElKahW<)WSC9+>Pq+}#RLg#T8RTYMZo1N;G3Xf z>)D3#uhuQC+k9U&zLg8Fa<0WH!iKXrkwi0wBkvTe!4M)&+p-y9qTVZ=$XYlWhtAbBq0gCBBC({#>g- z(~FC1g%()&nCL1Gk9iwM@u)cGh3Gw)ztJa?|uhsgKJ0(rLZ%CT&iqA@#*q=!n-DG2~5-`c* zLYj!<1x=%55HicghHX+R1%UD4B2E7(l9pc4Gd*ax;k|-J;K-sR(oO+jL>keU(w`UC znb4oXNYk*(tk$d0ZjS8EOtg0i;a3#1%GaTPzNXsnHYzzc* zReXN@hG8~y%?XXjBhU;d;ss6o4Y<^L6_C+<7cxVs)PX1ipb5pWEE{z9N}Bq}ku;Mz zP15AeH@O!|IurL2Nl(OmsiY_2zS`t|kECzLy-L#jZnQe6OwMgy<5`Taqp2dzo+#}n(i-2`hVkoM$(M;yrdt({eq+) z$NhatAIANXq@Tf^jSF@AE0E$FD(DwLCrkI=g67;!@|*?jmGmD#=SccZ(9oz=;IL0Jt1a7Q@_}eW5n@ zA3P#&oHdIncg9ikict-etC$7S6?g}O${AVFqwTLUZ(wNF!H`DWwV2QFB}6pXlT^WV<2^>flN{>w@Ja+FC z-fol^GakUID z;vlWegDmVOqx?$1Xa4@nc7ulU(I~#x!G~Ye>;s;7mcs=q7wKUBh)2YRx=m^??JxTN zJA3-9nP2w%Z;$L-8*Nq&>K&xB?5D?lf*b$9oqG(EZlZ;YdH+J}S;+ly6)*3NuNwA7 z?iJUoJ!mhDL_8(KJR^r;)3_tK?YaAN1G!ss_vGf~7Uh=iPS7hoCH7$UJbzBaoqn|K z(jIgTv43~vJRDe!gX7^Kwmz%No=2dcJKgDU5ZgW1Bv$u&?sM?V8+Hml#f>4WvloqC zT!F0(`+8@_oZl`!&w&ANh>8Rpzn$s5jR$%a2*~`j?|FV4_e`>hU9w$zN^U~2Op=2T5Jp+C={kKB~6yc-bd&hMQz^osD4E;L2dzh31pNw!bvL5^Q_F`K_b9 zndA|hU!K(v-{E+~hPqb#+lby9I;q62@(IDQ_2P#yg0CokRtnyCawa7fN`(-&y{DfH z_wu;ir}|E=fKL&Y*YI3<_01C z{NFq)w*BOXX8+t_eb1%|D|6M4Pu*MfxY^x)Yylg3v-R2a&!T40`;^#G_bfKltFrAq zl!yHh-^8xhVHe`hud;bsu{mUh!O7SXZP@*DD|Y9Oo1Oos+2I+e8y(nhb0d;hiJiaF zm#A$+KlI?Me%u|2mECsNX^gt?+jcuXRp3*1JN8n%9Gip2eyZF@6}qai>o}>|NVnw5@BMZddio z2eUIlR+g;yG(lJ8e9^>iPz*jS@*r%;^HTksGl-z*Z13iUG z$y!?FZUnmZto0;RKjI;92oUI zi1eP@dfaIXyT3|1h1mGbyS|sy+A>UYyVg4AC3x0+in2Q|VXZSK5Kh_Gl@?N#UpW~cUs0jIcplj@GY{^%n zbyc?2_kaUA6@Shtgg@}k818LZVeD<$_uNeAhu#qIz}z%=6|d7i$nw0AH7b~u-jX%u zXjWQZ*68PtJl)>9KePv2CA?p$DTHa2Ec$EbU;{ajWVH?ga( zuiu7k?f4x4y{Wlgx;0c)*L$~Z;fes^mNji=*%a)0XZ(3d&5iys01yBBn*uB=zi;!s zK0${6Biu*eEsgJwHaYOcw5u@+ehaY?5Qg77Y_ceEEJlruWRjNS z7&)X<@dq;*7xyZm;k%YP2c5dH@ud}J0WLMBR6?3BfiO#Osd0=Iq{q6y0e182>j~}THwp_!@N=DmO4^nS@R^#aJNdD;og-r z!*Oha{0t}dHvmnY(Ad2AgAwsc8AQB3!<~F;kF}d69gPbg@W@Mjk%zp$GSR=0G-VL@ z<3YfXPmNoObPbn#RM33_Iby6fY3@SQ>E~1U{V9x@c#vS9SHi(FEG`fPut`M;vSJ=BDnmo*VsjD6|`ZdT~ zfiis#jW z_Q8$)ZDmxvKeFJx20X4IARf91QM@Ms4(Dh(GGS*t$|$@ea5u|Wg#o5aFcFW>1o|=D z4=i}oV6TC@G74{>1@Aj1JU(|7-Z{`_`PyVSE8ZCyrcio30X)hx0T&*tQM_M*Hsd`4 zJlPe2kHN?LQ<5&E1?HC~Jg72?$9Z68JnlKoXPPo9y_H}hT_`>JfyZYSf|gqsz2_fSo*(ArH+zfX_TO$##;4>7`M8A45K{Mh)?}j-LK}HD)@X zdNnrL@MXs)r_Y!v2PeOHZA$VYL;z#7(K+}IWJt&H5;11P6%WpLhhH9ko}cuMVH5R@ z+;py@dF+yShveCdq&X(Z`%s4CoNDY+`OkV?d)V&7_w}7Ap7|-&MLSFNomfVYX4^fi zCcbXsO3z!GzTMMrKk;9Y8vE{HO$l0S0E3wAtMR23Qg&3V^mHX+v`0B0NH~!Da_;N7 z7cmfeB)3-#gzm=)f~|q+f#h2QDU1K9qqnfHcR|7MB27E*)I7Tw{~mOq;{g~BG+_cK z0(FznaiOKxrs29gg=!qBJ>uTAf}hqcDfnH{QBg5YQ~js|*G+EiS)H)n+d z{`DVoOa(YC0GXp#Hh!~*1E`R{gh!V-5U%fJMsA)O6rF|v7k9CnDQJ2zGRKEAr5JJz zf>5xyd2R^nNyn+ce>mmH_ql8w$H2+2Z~XQ7l)jT*$>snPPWo+mukYk!IGygDS;|yB z@55*y+(*3I>02YlRo%IJpB}}yeingZh`1{47qtI`Bdptl?IjptZC`>B*7l_wVV#NC z4D8bv5Fl8YEYgC!5J|z9TkDqJzJI%upmv$zuir+9K~)DEKB0)8W&TmL8krnh8|+^6>hD@O#| zUgT&e^(O{l5sCd=FnhWoORzFe-+up}mWGona?^utzZ0zPab{*aM{JkkXuq6Wf^Fvw zhAAj-63x@WJP;-9L=a1=FuI#RO2v07{!Gz@QbT1Ozeg@WI1ceTr^Gcai-<&KoW>|p zo*2_*`v0~6B+8h+XK#kxwK&rGO85RE=p2J+$6nUk!!Pe0V=rD1>3>~60)`Vs5zj+f zcW>uKGIae*u)QFf)I1~7Wxqv?Q{uvTSZ3y$6>0jKtlelcD79!Y&c(g!y3ER>+6+`~ zwkhLGtBEdOWAeAmhfr-nb`P^CZBFak$;0ji^la%t-cpUt4U9x#2`a6$e-K zIHPeKG3qmmvFF(3id3gh93GqJc0uOQ9_U`3;0SA}sKp^)bxL*n6jyc8n*DXXGY`j$ zL9<}*v=By@4##(I#W0Qo$#jVk8=Mrokn8pKj=oR)ukTPr+no?@-#Z4a*Vyq@y(iq- zyRNF<{@1%-?#x@g|6JVVYvh<-l;5+Rb$;*YsiuHC+gI-|#%GL_dlvL;oKaP@@E7)C zjAW+xt2DiRN`mLo2N;yWs9jWVS2+__@%(Lf+hBG)Pp@RqhVQlq&}M#XtS=I|u&tME zDGs^jB#Z-#3uj}{E25oqKIk$J0=`-r3Lt+DEWU+(>!o?F8$tC!ImOV8SIV(VkXWZ<{R*=zBn*$r-DwJ4PV#4Yw)QHBzINxJ-0=~ z=)}<1P4FuI9fl0E-pI-fX63eIT=2 zV(<)e78Ly4Jf2qeYpttc=f$>)p7nv`53+7}BWqGH>&BL>sU2BUj%H1My8ZDX&lfOkx_kw658#~_&rOCNT8j=3JI?Be zHFXs^+h^HbZ5kV~+o&T>Z#k8SvEPgvplMhNNt{VBIDJ`*qNyXqt~V4!@nhD6ed;2_vFaH8 zwC9-gLxj8jpb%WGR)n*5fsh@GkYGWWdsZm7_}lVi(!ni=nrnc$CAq#GI1#kU;c0N< zLAM7@b6%b}KN;mVWINiMeAp@GNO*Q>$f~!C&_rG+LPO&^&!ix4aG2osV|h#c)4F)R=!KczUf{pwvgaRcy~Z32#RdQz2)!K#LgTDc z+ZG-OjU<2m4fN6RT(vcd=X7vtGk}VL9kS`8 z7KVp+W_72W;uJ5>E;v+_Bz0#Uj>mi_IBe8b-{k++<$?S{Ut+hN()-vwc+KJr(5j^`rg8&WhHlqnR_HCw9#J4-`FXt_(#atF|IZw=XA zHuNd_FVLsabGbslL~9gq__HY@`T-*@>NnsesFxxUhw$TDAK&g^FmDrQv@Z*I7PZgm z4fi+@+KvGWS{OujNtF^d5*`2_Cqj~GqL>lTR<={8exNhv_0(8J^k|0z}V`*qS9r7jOl@K52Mf+p^gSdHQw;Vq7kk3 zmVocB$5G05J3Vu?>Jhuq5RPu~`I;XO`qB{h_`pcdF)i4kJsjWI>fJr8bwtoNYHZG} zcvta_^@odsK3_0rnWw~-q%%FkjP&3fO{6HS>02AOdxO4_JJST;avaNQ@X2%wKF?~c zE-=F75Xb708#WQ3u79aW3*1Ke6KsGu+P~#+e9-5GV4kk&I^Jp&^eM&QSy9nV#%XvaV@^_2lJ0VXrB@v3{2>lunclRhC8?|1@5~O zyEpVN=cL&^r~5^-#9qb24!6V89EY0f%bccr5g~S{Sh^gF%V>Ty=o<$X6fDTroNj)D83N$4I$2K=1i(gx2=U!X5%-L{RtEGm+#U;FR%BZ2wjiDfx~DknBCPV z9O=!=Sl;7wmUql<)r*whj`sC|5#fuT%8|Hv|?YRJQ5&Kno^28kbiA7pR_FQPmv(c7x$URmYQ>gv0{ix5=owVN%Lx|AK+ zHy_O|IGsH=n4RB}J?Dyf!tn06RU@222gq=Lm#gFCCZoWtN_XN^;0kZY$rVOvS(P3a zd_;o_>U)RJC%U=*V@@a}e9=Gq-4iL83E7ma>AjvyFIM#;clvYmiF+TqwtE)n&U~Zg z!}kwXj*l)kO^ReBG&!*04-mr_5qXnMbLR*PzMR~ndpmq1L+RgcZM|3(C@Ed$%b4yP z*ZsQd?a$q){v#Sg-WK?eL2<}=J?NW=&qJcIn&?^YtjgQ5r}N@;-zYsX7$|7*jqwb# zuT2cT@L6|)(jK07$kH*?-(pmng2QoPCm=)4ju$Q^&8ToZiw=(NbSFNRW^c#TRdmvk z7nt(e)cQH>uJGsWSQeS*I>2Q&#aUNzr zqQ>rD_US-p0J0pyIts|s*Q*r_7jlb_MxMJcP5QOsBu%%6ZHIOQgr?%rH*snHW*f8? ze=3gj3t-ru76;WMU)+f%9rAmq=%eWIZu{)C+#sfLJA-X)jlcKa{wy_*mtkm~s}|DT zcCAYChaAn5Vx%6O-OI%d&${O^t%eAgr;Q0&?*}sr79DBHoQE|Q@lWO3T|1B$-tdv;P$&>=&%muT z*q(`7Q4sG0p->)QokAgB5N|3WG^_0ixY>feg?Je6cRMk^yB#_D^qw_aZw-vV7gqF6 z7F}HQdSCC7!|`X@k%|6eX?i@W%AtIB1tsaOvP-yu?fFo~&EcqEQ&_Rk(=Z(5AEroyAW`3M9Bd(!Rt%brf>h4?cU`+5sId%KTZ zrs9$6x&-~AzvTTB*K6HJT5c%TUq|QG-*xT2u(##j;+D3^-rVaZmfSK?udV3kmt`TO zuQ*v-6OV8^hT|m@PsoF5Is6ZEVtd7r>tLHvJRdaztD^2pJwVSc;6!~#3BN*R=24=tuFY%|!6YpFf z!Ey!j4b&Iz>yzuujf>VBqbzwAGb(%;h@YMIH7NsX4P-cLEYL}k`Vfx(^vk-_gEx${ zkdq;DRS5C?So~jfGbGgG@EkiBHZ1sxJkX(6>ozE3BkO@&7j*!#iaF?gz21W1NRB8g zb}cI59%P#*!QE=Bif?Yhx&YT?^Z`OeD7ahQ6xuvsb*_*P^On8ZN zW-DGT{dYmY@Sa0ehNDZoZ~7BIof5Y?K7UWe{NbH>$K(2aq76f=L@LrV@qJRC>F7L8kh3Yd($d@J7V9t^auMZPEUCx-Ig-Fzt;5?c?i4o{vnc_?L%z-b;Stx4(Mnz2uC) zf9osX9jlLRO?t-v!^@^NTclyyUN7EJFAcl@BeY+hgTp)GM9glPa=<8$Cg5v8ei_^Y<-*#FZK$mt}ie1CE~DkPOYEn9hmTM zO!=oz%p7}6@K@9RW0wL9xXYs&)Ea?U{xYu@C&^3mC1&TB@7Pj}eU$#TK(SN$2PDgy zl9yl4l?+}U{=$_A>jU-G8@wAf*J9TI?1R)$k0lNBi{@q3YYlbV%C!n?rc|y?_SOV; zU@BKb6?PDqXRL!ziNxs`GNEEUf}zERoma_IyYLd5#b6-z2i z3mv>$HgBrlfca@62=XJVp1HEJ_TJjf+iS7lAy5yE=7>cYI0|IjrZO*%zVTKCwrnY{ z%|%iA%2&Q3LLnX6imGz+A_}iKy#X6vfxX^q=(=nW6aChgmoqM78Ac9D5aJAQ6-n+O zc5EhvZMeL5a*0UJ{5x~KWt$;9WvU6_*aj~SZ>aJ%KoG=NzM%nYFR*`?RWQWB5F0kv z)q!WzPOr?<^*cpSSD-WtZH>-D}e&6yR$6vS9*{fgMUdn;lO zY>3@;=hS;EMt*1_9&%)4^-A_y+R zZaTsXII? z!>@YvpYD}^RE|&Pq5ct1Kf?T|tk|0~{jI^wnO zcu#+#m;P0+zy8=OZ@I^RtDN7>V*KYw$i!a6_ZrO)*2 zYx3;>rkDRxZ+xHf@^cLt6_%Iq_^$ENv%LPUl=5u<+#jiy{=B!;Pk>K;qbx z{QV+@!!(f7Jt=}a7;F1ID7To;*}+FF9zraagBUR{;E+;mL7Yf_PgY?u=iUZWEavlj zaHqwj4oWPJ6Hm36yWj?kD~U&0%rks&m&J>Sr&-K1cQD;zQ!iEs!f{TYqzuj!%=&E= z%yxN1Z~^uS!K~ls1!HH|5(f#(`Adl>=WBx5HfII1c`rx5uw3%+_jJVMzfUlA%x~Hd z9|LZ7boK}?Mf_8OM+5(r;BmlzC%6Ro-vzUcW9Uzo#WucEa5?ZQ!L-M$p)B?sk@z^` z-w-?%_`HJ$;GCj$;aYpdmCzX@csB5S!E=C@31(mM_aM|~Ur}`IAv*l6ryI}VULa!} z*&@NMOtqf@0(Kz8jL%sXv;U~Wda->28Uu-8)3Qp4dBX`YV?&N<-o5d6oH6Wqz943q zY)4}D(G$H^B3)8;1y)5h;Q_+JEb3{Y4{ z{_fhe$;VBUZ3o1!L(sGXje?kVK>SW%mKV%rto$An@qY{)!$wa2&c(D3@Xvu+9^;Dw zIevLzfQ-Wy+-sm|pJ2Yl9B07-i#g7i_cr8>3vK|OD!37tVTDnEXBrnuGv>jd>{Tn>aa2X8N@db%K%#^@h>BOBk>^ogKWk|{U0EHE3y1uVVlJN zU&L=0JP~^{PSDX=!068Kx2>e(?@%ecJJ;X2a(EFlyW z)F}b36U=_#@3j~|8n{F7IAC657(W5{dBH5l{AL~Txxl}Wc=pe)1hap}@wkQ#o2x?b zYT$W-w*hYv90%SecnHTn$_;xDJ?WN>Yb? z_$9&XfL{~LKK!9z_Td#-R-b)HVV{4pSZNQ;zz@crxp=})G5YujGhmWEi)HXa=*>?N5)gc$_g3o*A3A{iat64TNIY4c2 zXanNOXU?&})V))5$j8ez^D>^N7-Ht-VOek`{y|1!BPP!T!7R(zd=~)3*gVN%UN#EY zX^?BN5mT2>?ZnhA7R+)fdM{z>a+QrU@zoZavaYw-^t&{msTXi)Pp#E4_KdffoNTvP zwv0Wo*|g`fBxf+r;u7lDSzJoY6A6UL0UH1^8C$U2K=UjZtgtxF_y&uo60fwll6aNH zJPv~@i{sc8ppn?-3k9<-q-H$p(IlAlI3gIk$d3fG9%lu!SqgccL0-1gaKSO)8G>2A zd4gF#-~^m)_W-`#P~VD z_Y0m6{8_<^fR73$|8s)L|El0P@W26OhMD1gFLi>oHr|ZAbrug|{CbP|`lz7TVsoqklY@sG z z%hYS5jW>1KWN``gc>;!T3sHd{=(;313S#LNUS^}W&JKg6y8nB~79 znC1UQFw37FSesD}+#h@^ly0n||)Lrag zK20*7Hjs{(m1k3E+w8;XCGqEeU*(=6|ir<&3|@ z#v4wY|9NdS^#xwWKA}GFUSQfm%xA9>!GmGIXu)>^PY}Ein0-NgzDJ)b_;bLs1$P3^ z7ffFUO9kh_m^#4|fmaJ&1-w!4e&DTwdH&ljxNrc*t>6aW#{_>K_zA(^1+MPH?Zn2U zUyrIaYnQEE_fX#+DAMTD%SV_kor{!>Rrbqaf6Ss4I?uRYY{LiYb(?DO!N{$LadNS) zY3=frtLv+lHPkP=zbdJr?kajw(h`g>5qhwwqNj|yD!AFJsam~q!$!~fjC!rme1>*e z6WT(`rx(D`(Z;&_rM`|I8sA5a>%S(&Sh}Jivr8EI^XL&tw;xq2H=vz1B+Cyyq@=jC z>9-Db^~-BEt?tX!4V~nKzHrp)9&KWDG&XdgBff7OcOzk~%*2H%XX1i4PWn*PVvNdf z?Mla85QBYS$D^#0pestG_9PuMYKpcc@;;^QG^`{=J}Ww64^&QYkLc zLPu+wiea0gU`{>ZX(uJAvCbXBreoQ0o3LI|>Oe}9l)f&wRg{U39)nsJ9v_aTrY*y~ zzqQL8k3is9%Uk9&*9^HY-mq!q#`;>f7D^Ttl)Su{W06C9nda!VBm2sfJXV~0IOib5 zHMVC7p*cMdLDk3A7Y8vs+C9{0_EPt;v&SN3?D$*5*3g(+!Wbx&jddPM@od(YOdZHM zGD&I0yQZCpQ^BhTBew$(<5iXsK99PBM@1ui?Dh3DjS7nS%7!?OjWSx^A@KDL?O|FJ z8_RR~`09Y~j#QM7IxgR2hYydXA>RTJx_o?2uEwUKd~=}Z@=XQbD^Q|+IoOy+`)=^~ zo<$tzy{RZ)k;gY^v|W#ne4L)3eBT7AYhMErl!Kg#k3o+(&PYfH-jUEA@?DCJX$(K& z@vTNey7t@V@jdJCaX2X7Qvj}g351!ZqPSh+e0St0GIDkgwxr#)#H1` z;p6)m<=chMarrusz;|>i)T2BCJ>ob6kkjDfSYZ3%GepSO;PIVCCe9O5QNCp!-)IbQ zjs@~viH&-!?=}oZ*S@m|ClIfqe1C{|;w;Ld?!7=KL_7(q^qcX zf9CPU$0z%P-)@xe%Q&`N`${m_)7f_rdaiwsfluw@D|h8<@%ZB4OK0E19^XGX_7ypN z6TJTD03Y8)s%U+0_WENSPMqaXV*3rpruIcWzLVgqS2EFKFvsIt4Zdo`lWznzS%smv0dGxt{}aAt)6`+9X?LQQ@$#XZvyzz*|)^w zd&S|4JAC(Mq}I2g7yIsko?GA34&M}qkKd@={#^~ee59+8gTn7xF5lY@-&CYCjr}v- zJKnZ|4}YO3-xTk7I}1KN?@oiZ^4;L^JqEJokj?5bSmg1Io|NRPbolDM>&(@-DWKgd zYG1W?ooN7{9=|i8toF_F_)5Tcw~~n-gVQ{|ZQv_G`~%o#V^h92y!vhgABJuyYTxT# zeGh|AkB@sCzQ6SNwt`PSF&a+g`KzBo=QZ$pWE^RX%4*S+yvj!t90sVE=)-V(

VVfnB#at3^Z1aqf+aTLmORqt#s zdW%5n>hU2U9p7vWB3ExvFM6ACe?dLoBT-_|D{<~On8xh}8TV@6)MD$Cn|UZ&k0Ni} z??=0wMLNg9TG3;>ESGYX@8{q{mxsbKDf2zObG_)jhYZZaW0vx3=+#+h{xgl+0o09q zl_kR!*}bNnhMw!=J8_52$9hmyZ#L}HIxv1I_`WUA&N$>vyRd)k%dZVh7whAD()e+c zV@CS-@m+cqOSW?*`1BE@b&g*<`qZ@=_CI~s==#IG`tBAVGw`Pe?-NC>@D{Ni{t}K2 zEBy4Z!ui9ZIb8>LH`5Q$iJUXJkr@^6`UZy+*(c}>6NorCNO!UN90?ceQz;ef(=EN!!bi)mtQ$VAz;&!6n5z}mst)sfbDn(G9!z+?8W zjQcS6oPBCEoY=4}=+K+hLf%vFCMu4X?Rr_wVbuGkX7I+7 z$lqVQYvsHytQ(B=d}%UVV3HWVMV=39@Nm|SLb!e1zN@R{U}D$nEe9Xn_5EYeM!D3L zMSWQd*7edzSJ!5-F&lAc+82^G4#2Oe5@jo{rV}t@HL|EP5DcS<#ut=~0c7^v8HK|Q zdWElNws%$9Hfk>(4xTePSOIvD##{sYz|c`#gK3mz)!%Hc`kNCuc5pXJ&hEjjK4JEo zF&czr5ljq%k#lc5H~p53Y4uoXc5nBb$BXuMFM51%OZR;GFPaMfMKvv*qi1c74k)KP z=hj2fmC^mJ>mRBZSvCU>dKbU8xO4GQcvbD{oO~kdt&E04uwdbqD-++_e{R=ph{uS| zsce4B_=?Iam~r&@x#wO>bng1X>2w{R7_os+73Xv3Zp*_DUR z(CN0u4TRelhA&Tiuk_rm+QQ1{yc+m`%b!;>cwUWFngciKM(L+{^jlZ}BSwNTy8J{2 zyi=Q$nU~bo3{ISDsks9F$>34xoGEcm^lsx~e&G_hPGYuJc=60G!nm7iz2TzC8*>&O z$T~iE?@iajXC}QPZOJj-k*?iC$4A3%=)Qb;B}+qHP+ZXtIOx*A;At7j06iHk+>$x+ z+=^ovJO1XvioMsLvg;7vp3!h_b46*{q_*g7=PLJ1eSTh zE?UrLb`fIdyrmuM`UlrIoR=_=3diRbX66=tCr7-4FI<$})S26i@y@eSOJ@PkTStwL z-{@s?F_3fK%7n-80dQwnbK$~@ebzzF-}@kK^29^%!Q`#4TZF=ju)gk+A(P+-d#%5|E|c31Tnnef zryA5pb}8FJmwx5?y4kfh33X*WmZ>$_MqS0UPehKi!E5XkC2M0P#-^!jbzJo#KR7X7sjqp!)_WBo(V$hHon7hh7iIp|p5dEtUJ_}VDk z-NQfh*vP@-C%-oQB-}e8O{;Tzo=H7*1HC1;HYe7@8T9(D7Z$a54ms8tL!EH=V#tpA z6$(7wJniiZhFNnj$wuyPRl8XSU=4SZ)eL}z2hQ1yr&BY&l);Sjj~tdcq981jCFcE` z$+&Rxf7n&H>4>L?cb?e1yXG#q>)!djd+AA|VOj3E>%N%d%_of>*Y5383rqRlJJ0d# zqf7a!3mZ-bP@g{H>cUwJ7yf3(lubx_&B=?vosDMwt-RkvM(wEF@y@{DlFNQi?jIsY z^d=WaY&!oB;{tmq{{{A3bJrF6e{kiuUt?Ep`h=AJ8eVh?;63LT9D5lS^Nbe5dz>3r zhG&TWG+?eld#};7|CoLf_x36byU(c%$34CUUYKirs!*SEz$t?f&)@SOG$H#wjBEU^ z^Xwn!h22|s@@@0dzv`98--xMD|8lQB{7t6{(^q)m?|R{Hs516O-{Y_H?BVZ9DSNQ- z_x4Zv_L)@sk9out`f2*g@cV{Y0Kj(${tV*FD1pdCB<_CCBMPXkD zd~ky>FW1DR;Pqg*UMk;5=(?*V#8iZg#umuoFpgMWcupXe!(uWq-X&AYu>~ZCOvR>a z{?Ziv%{CrW4W^Bw1k*-5rkQvay+AOjss+==2EpW5BbZhDykP2lQ80Cm3uc}EPB3+T z;9$O=p>3tuUxM}{rp{o&(NFev@FfO`G7!z+ZNBo)=t>_`h}H-w+%} zJb&v+8`yql9i0rsscm_JW6+_vea-h_Dgi43VU(_$Y{tX2CfdB`2=Kmw!gdc>SqNUS zhimn+%XO_@s_I(3Y*S*kKih?v9FzcOdWtC*-?PS`9;RG=7=@U!ERZ(X3z@}HD=*5$Zh zjy;wU6yqPn*pIqUsK@oG$!Y2`oUwM?Fn$`asTVNEX$)IXh<^~~3HT4f!?=LN5b6`N z%$o!=X{=zDd5d6{Ss|Eq&K1o1&KFF+m4ai~^Zf_;S@fp_$FQf+=EtyS*})BrN!Iac zU{l8%O|(64K%ejaSYA+S<4t`>S{!5iD2rKMzzRXA%CcU=o@0jiZS2PpGXgRh8{^-@ zzMOar{z2l{7=H!&XDTrp22zQQ@i!r!r=)^Q7;Aki60=UUlNi;vzt03_donNMS-)z* zY|n&X=4%(s`W+Pbng5w)Qm}v9@pRre1zDM{W0WKA# zhz{$q8(hkP=n(G}9A_k?4);F}K(+UL&w%<%X|gOBeFRFv-nM7VsFAlZyK@(q?W z+V}6MpKIUGk%{*ZD$4g$=(&6+!B-6>^6}A&Y2l9CU$@5>!wt}OD3K4- z6hc1zHmAo?2l!?yndmY2Yp?wdgYOl@laFsZ)V?>p_WMup@tIXc?fZL=Zyg%#Z77lN z8f?n<0sym*$3}S*gME_2N64)~_PpPs48|a?v(WrkJ^Gn(vPU*?usfn@YoOZj(ap!D1lCm-dX;@1IC#LG*4`IyM16m0F1x;2JBo8Kd%KfLe2sITzT z(0vDr+q=d^->JbP4n7zmroAhEBFmtq9W7JtX_@lTXioCOfvLwFDac=3HO)5>ZDM|( z&0blwvaGgZP)ld-7ZxoZT=)#W0e)(F#{isvcMOXZemZE&%4qM*I%d9Km})$n_uY3Q zJFbq542nB*r*vjz=R~48RwX(FMxeFYMrDl*wyZ)TR1k$#A2VL%XTpc`+V*9Xv%eWd z&0WE&okz}}{UMf{Ywwb!8F zsWbZ0eT$3CnyzNi1bmFS0?P&A>^`J>S4(%U{YG;l$J+VECDBnR4S{uEKiSe5tv$_e zL$BuGyBSSe_(smkBIG#M867ga271}7+|Fzpg^aIewQ?6o+_;55}rfPj-Q)}UjD=%nWY`NIxI%Z??9Bbz^yHR-WqHsRGAvmPWe7ozc*wLD7I zEy0!@N6!CvZep+wK`h8@>fV^QBZxEHxewKUD^JzT64$K$PdJX- z4iw*=ce-{~mnLgH+wzK5?c9IpKw?Q^|M~-o{WaK*9!Shggw28_P_{iD?A~9t^*8&D z6nEDu!->qwW;DRVd5h+@-8gjBitNidKjzf>$hiF{7d8I~OO>pPV39%FaQiFvVv)bv z>$;PC?jF##;+icxu4`C?nqUZ_=cA)dJD~$!ylT~o?u^1G!ZzWt%o8>m_U$WG zpLH~AVk5^>;rQv|BJ^fS?6#lguiCx^^;tBxvf0VRX$i>k;9!j_kD7u(UNC6YgB`r| zqO6(IP5SZN*E^@8e7Q0$%(?9Nv5uCO&iLNL+c`24ovr5*ueE*;3wfTyN>qop?`lru zwgz3DQ=c~p@*}0-CvJI#Xh*;o*Hm{#7c@;k@AuIj+fr_eDp2YV3sv9C(FWYv=M{mDm*5y z?fY3nwq{?3Ws@#%$qLFZ*|$HZB`c$R#?I&dD*A!sG)>x=*S0Xj%Uc`_c{Iu1b|A8< zOA8U|zbnsSCBXc?oPp;?3f1!QB&Gh?Z8&QD(~tQ=$iG(V%g4BUJfZ)6O8Cmiot{0_&{JXlMtMLU1>&;LzUk#3?bYWa z(jH$nd?Ul}%Y3(x9~l!#V6Q^HfAaFH?_=sP{Sq0!d>51-xi#{CJbMmFe=arYw?$^+ zIa!7I%O(93a6Ve&>r!5Y30FjZ>gjiS{42fwZT9pJd+Ehq`a!R~8ol~n>4m>7`S}}z z{K#Dq{svlw^$Em2OsPit-6l!D$Fi#YuB)QoV@aXkW0}1`+LV1xtVIOHHmA|iNal6p zo%#eLtUiZ$aD&C9=C@M{j{*I@YQFa(p1Q`KQfk<6fwTc$%|wW`X#MVI_~pBw;b#Pd z?>+eJNd1^#NeaL9nYzdrFy+cA&v1@ICJ5hm1!V@BF&B)tm}5@Ad-MC9em@)ntmAa7 zU~=CpnB2<+lbgpR_1S-W1(TcaWEoFxihk>6bI^x2#n{XjRS;wItri=bCt7UAg`Ap= z%~BU*v($w)vo7~wA0r-ve~=PvjGu?SY1@H}weKqR_li6h5wrZ;1hf1~!7RT^~PA4QKTQ|=u$j(PeTC)8z~wQb2;z(EaRJTdLz;Y3XR8wHcwj3vY~ z-_sILd%h-^9F#!Xfn4l6<~4RoJ8-xZ6l>Z&T`_HI`L}-lY^q`N*I1LR3YLFKkzNUX3Wqq z2uzCG{DrsmyNg&tv6> z$?57!7aIpv8?ZFvhOiOLM{^7fEaX_Vajlu`;w4%OIRRSzQTEe|HJdgzti@=4$T;0v zSy#V?jvxD+*^$}`{Sfq1Jiq?`7Ya?At)HTtW8uG2WG~sZ)>4EBd`A!11F|TfO>$#;TgS zI`sI8kkj;sHPnrEtl3zT)aE6wZ|9jf_cpG5K;0wub2O*;wd{QsT53C{WYP{q9nEAT z*STdl5zwil@m-l(Qu@?>EY}l>aaozlrzVj%)$%l%`YA>(=O3z+o_YEy1V>^IXN~Em zU8PngU9Nr#O3o6y*cS71^ie=RbHG{njpeB*A3o%y=xv8WI=zF4cljReMeh|)@3CI=mZPy; zz9*okHUWmX26~K-GZON?(;t9geJ6N)2azU^>_ADrn?1fG5m_h_pHMK z7~1!u$H#Xh%7@3xknal~-*Kd+v#-tLi#dE8uWDbN*KcfhmaC#|Sp_|}{YHaN#~&Xn zm2a}gcN%H(y1`H?-z^^BRPdERgU1`+lPKS4bgtXKSqPwNp(r2c0TRb0rNOB$-*GD6 z`@k+=6an|^jq<%CdE(epHahhkim>wWyyNoG-gNDEv*d|mPkGegWBJO5W=Y|j48AGM zAfooMOyao2b3R@PFx#&PoANEf$%eY*rKs;98?t)D_d?I*>vr02IMS7Gq{p`ni(1E5oMt@#5*$cdO*{`QDRujZ4CI@M-(q;_!7r&*j?&z5*o^JqAyBe7hY! zzHe3g_IuaM$H2$)nu^xS_K@Xu|(5+t0WK_b+nyoZx4ahw6j9PsJ!!Ecw!_b0f> zyL_DA%zjf*zNet)@*M_W36$7=e8tT)=G)@&okv0i;#H_e+2rwcJABkvz83*p`^s@% znr#^DKjrHJAdXAg&%yT!Fzve&8`EfCJAliV03W{zs!)&eMF8SB1CZkwq`dZ!?=Eai zBVQrf+2!N>VaBT{-(aslp2bDH1WM$aj!pUA^V)Aa_;x9o=rQf>j#Fp^{GQ{l&Cd|Ew`OApF zq&rS50%?}JZidG6F%vVCYSPQx{}C%Jq-XTA5n zlhVt)-HA0p^r~Z+RmeGasC(hJN){h_XwTC}qd84Av6**HsTtNizP)oR(#^2^WM113 zi$|_!|2G%jihkURnR0Zxg^uXLB=fE1QH*$~=0w_##Fn%ifiD`PVx|p3scG2a8mbL3 zI-vX2Py{>COPs@P%4oZGXrg9U3uZ+7ncJ^3C0P1zT?_iniDp{>jR$?pH3(wn=3K*t zNwG_=e!6Dy+?JwYn47z3ea8SjzS>?YMC8*IaAMPfI$nuvT0V^WGUjVAf^_couRK#hYlcNLebk84iqVbr#g}p=XP$})hyGa?F`0+8M!c_2B#nUBaJCF*Kc{ItElMp zqS*P@+B-MHGAX64b^wf6*KxAF=6ZB(4qirVX@Ul^_ThL;N#7h+w=u8nflTB<14l3A zIO6=;EiJ1`Pi5HI`eO$0@XG5rYFh&bT~7A<7m6-i*zubSW3s2cd%+o|3UQp!A0Kjj zB?Co&=((7K&0Ng>=3%Dz4N5;B(^L6&KazuJ78x+jE-ZE`qeSKj4Y8z3|mk{WS_%=Vv9?$3x-=fnz+Q`al|7mW*vhYEG{R$ z(c(BU2_RFk1tSeK?*(+uFpC8%CgJJ);FTekjMG@8qNstro&wH zTp9hS=X|{W@1353I$hNC4AE2jFwsF42escp`)D$DPuMQ~Piv44P3F)dO*5yGX_8L6 z(6G~b{m-{RffqI3LiPUtO@5H3_#IAu=&?}f#m#jPLsF(K^!xogT_)|IKIb~9lJiwt zxYEo%=;JGY@0t1;ty&D6aB_v&jVm9pCy|RDy!{aLQ@lT8p#Lf+b768YSgHyP-acs6F* zqQ{qT_*ggPdkfcO*S-d%@mi~*eAIFE)*+lu&tDT{GxU^$oQnN5K@Q4woAt%5Kxp5; zqSM@Rw<1k$#etH1--jN#FDz9mNe{)sC_R%$>lrl@LdK?Oj~u6QU&QmN?D;WE?u78hi5bev@hB^XHS~V*D^(Mfu+G_;!P@1WM%N6TkAk z3gFtu=dU=@Rj5bl1|W_z0D0Eo<8i_?+OgjoFY|k`?{nUGIqmTAd${r~_xP%Nv9HGC zd*9*X@fq@=vTl73f^QDeRj5a)ff8|?0Z0tr9ZqA<_T%G^@>O_zXTitkU=`&n_xR3( z?|mqdFNRI|8ju&N;rVYf&LbS3D$2JEdc<)__)j$cIAHP>V^h96JwASK<8!!*@_p3f zD;b#ND}l1|eOJzZ`n`zf^*SZPp0;yi9QU+|G72ZXbb5az_F1h+gx`-`AqRzisod{H dTswur`chPn-@QN?%5LzTkuuQarXFn1{|C;h14{q^ diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libp256m.a new file mode 100644 index 0000000000000000000000000000000000000000..fdd57f31859ac785b818128ef912828c212b77a9 GIT binary patch literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=sXy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedx509.a index f500f3150d9f3b2d5096a8e48cddecc9ebb479a1..c066e067b6f3a7666e2d670967fdf991f7c96062 100644 GIT binary patch literal 179962 zcmeFaeSB5bmH&V4y?G+JC}6|@L2p99009F=Km<(yV|Y+OAVmgEE+mm)NMaHMEw&-0 z;fB%p2rZ-(DME)bj#9*yI<}<_ol?hdYps>v=d;gRH#;{0{LZWM zn(rUK^~%nE?{(H*`{C@f&-1xyzxBl_r$)7pi&leWY zFD2q!HUlMV8sJPl}jqRUeejTrZ!kx8!W1>Mbm;c z!Ns+mO)7(n+v^o6zplJ1EqbA|11O77tZ#wnf#!ZE05vT)$l`d9d`6 zqT2FDON$nkR#Zp#9&28-U~zTF`WS6Fd!aU}Qo5vUN!^l~E_$M}wrD|VO0S5sd3Kv7+lX(wg$R(ysEj3p$N7R~>N{RnUT( z3T(AyRUON4wbr(5Mj^EwHpYndBHJS~m_^av>$)tnPPYGxEL^a#biso~7wOFf7-+76 zX=w?joJ&|@JlB*yT=igSN#~lmZCOx>T3|Y4#CKI4Sqqh@Z&cB> zHC+uNqwO@Rq3xpIpuJdgby4RsBRSkP+*LoyR?0n9u(D`D)#Alb1I#t(avirX>Qv$O zMYV8^5!7ko=xDLHq|>gaqk+z^*or!|v!hjcZS9iM8g6QrFj7~YX7Vn5UB;@5{d-3@ zvRkYPF1G=7<+VTZh@0Hjjg5{M_ zJN2lh$R3O{S$RomWnFn$dDLFJV}{_8x`kEPKRjY4zt5GW>shj+TaM$;V|UR#e!IKq zW487s)uoHO>e{ZhS;^GZhTFb~+rh<0Ir7rrA_G^JUT)xu*(Fzdl&jA(n%e8u#Sv1+ z241em;p!qijwS5z8=_CftaGuhaMVcE7AMN?qcm7oI()(Ks`-m@uOhC}ajoE)<_(;4mz z6U+bosD8_Z3-vEtxZrF>ybUpgr?trl*CJ#hj70c1mS6AKd)ThqL5YH{NBPh9f%b7OcIpV)A6OYd#* z+utsJF5qg9C4QlAj~zZYv3$<-P|wERjde|}WZ@h9x_jq5)3 zzz%OiQ0yOzy)UtFNRKhzP|ssA^*7e<^95R^l56_5p4uLY@%Kpz)wg`5@ML#?O1SAO zg>$;o#XjE-X>;Kaf5^MAXVd$O7McZdkp&wQcf)Pl!5*t$i|8Kh7V@^dKlR|+(Eg@3 z_qE%85+CwD(DG>8!Ex=L*Gy?W^+Ms?xR#GX@vAo6-*COBEu+V(O|y4h?`_TKDZR2N zrtM%s_V)vkYWJSvAltbQ{0aU$k9p{=N!ogPo4=sN(@=7C$lF}fyP@QojiDy*s>fp+ z(cAYW?ubbb%Zg7wv31CIh9#oU@|+#swr5iPNp5KzKt|{H?(-dsc{di8YgYQNaF;Si zm&>n>THgCa%$D@tt7BYsYnya<>*l@NT1D5oJKS1dlYYoe9*X67*bzVf`V?2OBi@Z4 ziz{6E*(2%w&kt!VX#7iePrTPr@uLcR#aM2N0OZN}JWn(>%#gyZyXxNTpIzpv|m zYjA6N?>*y=#q5&;7X~Nyno>5dd)tBJeQ~V^q&g!{?I=8Tb12v{qrP$fQz;1}!y8Bb z>-PNLIsU~R4aX;L8r%H6r=RNU&40%UrB9yG6pZ7X=d{f5x2)Pwxh%NZar~RAUy&~9 z-8arCwD>ijAlVk~7BM*b=*VzA%R1^rE$KbwvnXF<|K7n@@3Ehvxp6;qzPa>7IIQ)o z3Ci}iX4?wKSv|IJW>!9CV-zH6Utk4b;6;2oR141Py5=7 zk@;fEbz42-x{Eu>)3?#}}I9M^r%tH(TO^M-Y=N~yb7w5(g>*0wPT{I^p?BloiZ{p7=Q{4&kz{?TeJr;7nzH=$&-g-lBj@k%`$qojj#W<#%a3u0FEl1N72hwuv1enPb9ADA zKwLM+dCTXG)4uRHsn5VlXXSj4>lqpPL|QO>vg%tDYAUKWyf+U^r1{Y%FKH? zreC$8Z)Knp!vh;g0)kg!O;gtsAswL)l@RJwG%xGJyo|9bjQvfBDYPfgLZF`}1nS7^ zEZzWSy|`>6LU#n(JdeQjO8qtj97q`be#Du=XA%2_KSIntVcw4sD9o#(bshzU7lH9g z1lsSBG?~XzJUS)!N5!;m*8-T2`T#gtIEMz1uFC2KJ@YW8bY+tYJ#93me;#*I{t@=0 z;fMYiYk!Uf_eEe?Tt8e+E<~VoRqk}?X~$UC^}S#U?a6}>=;zA_T2=#?^ix{DLW?HwbuArC;HO&a=~-A;Wv;GabQ7&t?CGYufLA@@UU>R{>jf{hO> zI|$Y~zb@>B{s>sh{R5c7Jml*T)2E+?5bDW25L2HDW)|xEgXtfU6Tm-h;~>$~W-u6Y zrO7*&h7jt>I?l^1`*QFMEKf(+1E$cPto`syFc(pO2B78s7Od_4y>L2g&VjE-Ouh;R zNSeG?gLS)@0M@*>19*N!`=wMuSQc65kdUP(>$bBAtp1+{>pFTBj6dUZFF^bAD3uWU zCo^WbZ(4e?>Q7sGa=h68J6PAt`(W*p55QWVbC&)?Fok}}+dU z;|ok--UKj{%#3PJ|_)M=xlISO$U0j{dxvG63$cNtMHb>!H?lrw{ zlIEWeGiyMS-1fX?rWFMupOfNDkR<0iFVeR7%uLd*@tK*-PU~#u>U@#XG|k><7oXYM z?6ln*tdFb=G4Yw6w(Yr=+r<}Yy{q$?HD)j89;aP=&Xw&6kk1(yl^zt8=GM|KK4-8q zr#)%LZfR7S^P>vK_BS7!BUGg0Y3My3B8m9{R;82?vUUCQz@qtfG}(levd z4@RZG8kJrnX^zZZ7$4t`TK=4*IWl@-yl}pyxan)1vy$fisFxFP{w8VKu)aOHVTmw( zy`;HK^}_hMEo%AfsI(&&yWH5^Zoqw5+!&9#P2t`}H}}e`YKrVz;_ec2!?KHfoo)vd z>CM^CecQIGyu{o;kGf=vq`8S%R#UaOmS=!HSBi1-VPo0p4uM;djyL`zF4}MWqgK}4ZMR3=`)H+$ zaWObjkh{dJpMTtg3z2(mo!3>T`>JjQA~%yF6^r=j`tDzQ1`btEe;Kf3nG(4R@bDl4 z!u^9MfPWC~>pf`(&3N~uyUhKjXMoF`g;mdENA({dXW$=%kw>PlOtSdNBFi+EO}6VM z)0wFoGeJz5^rmj&$JC8GOc9T{cH$;H z@v22$o2AaCo;(17n0oR+5@PBpK21G^O&>~LqnGL4=!H%Fg-!j11Muq+HuV=a^_TTx z`j!hJrf;QHiXP0RJEh z5!9x_;%c(gv(C~lBg={2a!X%t@k%mJvLGP@^}mKJ2PA9B(r-^#`WCXRqfKO4cVUa4 zwQRPKdEgA8X)^wC-(#-h^B`0>Nqlk{Z4wZ3=p}8YlwMVsx}#9I)IRq zWLxIYrwzM>=R35C5l)hAJePXduuBWbuwfm@Ndf$WaGh#d-2c(WkC>b!bHe>%vkq}F z88$tHlVlrTDEef?UO3MqnM95FaGNCR13;Jt=zj6*)=ft25Li?^(pZ5#EpZ92tJHg|%*d zaqN(c@s^F4eUvPR$K<5z@ejgtVcG;>!_9*>TzBLoRt&=7MVnEGZxg2d9Twk1M&1O( zWc5EsY&>4$YBCk@6w$X5}xo==fs!}Uu};sAtv3qfsKE#6Ls zeF|c75*r8Eg+Ti~h+h$AyMAc#>lPm;!w<&*IVlVOAa5aPx$lu-6F^MXvbfG@a~|=3 z3bU+F$*|`*A#0y_u}pnlWAQ*T?73>lN!XSti3rK;5C}O*_9N`aWOO*|%*Dx9;~!&$ zB#b4BvB9Z8#HP2aw{3EuO2$ReyAk_@XCdbLrkvJVNc&=Ethp=-8d(q>z!l_0G3rqh7+E{E*Bny zzWkcl(Elc3`g}o{ zei`wr!aPSfAiNj$9|*^Iksm?*bR)wLuebCO4j^Vwn*pL{+j-4}dbaT%%jOGW!|MhM zgjwz`vEh1oMfALW@{TaCpPV7XCvE;+^en3f0_(=>8@CC632~k9*ARbInAZ@@wG#ND zY!LnT5&u;9mxzBZO#i>I_>3^GIsDGj^STD>M){+qzhK$NA`k1yYcFgAnSQXznY@{Z z$+}PBZk0Clogp?^h{?Jy;P_*?*@(%yjZdT=d3hb?PGMe4TtJ3>joOLrhki|6|!)!SRo>rb9>8{z;bYg4ad+3A0ZI3v>I* z66Uq6n}k1xpDAScoF%M2dH&Bfa$A@uJRfn9FzZl7M&3EXy5C$XHoP|bWno?~Xb|T0 zI;M3DtS7_IJoq7N9X5##ujPJMY>Ht+*8R&%V#DjYKNRNmTh1No|7T?QFF{^%QUCyX zQ*4f+KJSUmLg>j_2VR$;A71LslEFZ121d+*_D)4Cf=QLpB+8s77A0uHP|Y z!?|j_a5>^BWZ2iio~&g}7aLw5E*56qDl+Vs!JeEX$Le1Z{c`BZ>Sqo0Xcy_f02YgxRx zM;l&$zDAhy(nvD=uYo-|i90vQSh3+8J5_AfLQmHDYNpt5ek~T8CtyQXKa0d>DdI}8 zX@Lz{_pJ?L!)xGc#by(1$hu#CM)YCm$*O-r^v^<1R-c^T*fevF`Zqqse+Kp9-}n*#;EaoQIWpjH}GKSDD9K%9AXfPL}aJ&*Fs^*I8U| zF|WO9-WH3WwRoq+oGU#%P=y?}nDe3P&ycxdA?Gaq*kT@osZ9^ETvj*tz=Sg`eU8Ps zWE`VXrdd44;u4FiEnaSMh}^^V^Mu7=i?>_6+v0;3AGi3l#b+)4$YKZEnwIOgIK|=& zi?b~rXK{hWvn=Mkr2Z=`US{!1i#h+O{U(dISp1U3`z_}FPxGF%nDdP4&s+Sd#hioG zCfVYE#aR}Qv3Qcj(=DE7@j{F1EUveBjm0e%KWp($i}zZ5*y1-WK4bAYi$AtF2J@4) zy@$oA7H3+VV{xv<(=482af!v%7B9CrWbqRghb`W2@otL`T72B%(-xn#*co2?$YQ(= zgSd`w#UNg&R8v|J9A1I9L~4Q+!`-Xryv*L=9?S3!Mjc;L?COq7M|;<4^!=BPHXVJM zYxI{g=;8*$=P+U%V$R zcU^a57v8Ks>|*IfJMiMRoqMkfTj{zgwq$HC5H_?&Nd*55Nk$MDsiWGvpv(iin6ZuP2jpWk~?XLfpL$ zMPPm|WBPVU$04SSL7-0+^_L5U?Jo=dc-%vOn4Tm4mVoX0RUn;(prZcRX4~Ik_*)4b z{b34-_~SXW?XN|aAu^)=oHx0*o+Fo9M<1(gsE^Yf`8`K9d!aoqsr4lm7^2fs_ z_4j+Q?Jq3L5E)V5?;}OdHCmh-TK;%wr2bOi%=Y&zmZeA@Mzo{w{<`h28vb}}%l_k` zkovnh%HLir+m4{3{&J%H?S?-dpV8ly2x~vE$gFT+FTvb_rO1IlF4{ zr{k3V`WVmdKWzt}8zAS(vNh>5nB3BlY+7D1Uq5?+kSGhc1fv z`%#oX9y78}Rn*^}D1V#!y2rcp$MvlBV;Rh@?cIqEl2a<$3#0tS zU_l}DDzu}_i1K$9{`N!9`UMcwAFoNUesT%inTrMEkXGR`hHpld%i}pd5(E9y4%HK5j`-l^+i2CC>iS3UMUeb>K1|z6H+QT#=xtJ`f zF&46*;Wb;@^*}%|k!>94?8IQ^IhKl+%S#Bz9+8hw;0ImU@xch|RkFb4-X*(n%;-^{ z_g%8=m2M^6{a~i^Md#5-eFz&*;~lPd-S@aUEcl#>dgM=V=CE5XDud_!b6e)TfA%K6 z{meyeIxM(MeYhSj{PC3w9CJws+()plIY)3k{da_`h3ksxSzk9pOfV zTM_O+xCh~KV*BC#4x6oWGs2w+_aQ7sScVWn_&hQy&uQ>F{tXR>kJoRVpR{e4*AosG zhr@Nd-Z;K#$j%M(lQyhfTU;LsuU%WWGjnZWA7}Z8@-A1%`@%>qN;Vb>byU+Ex zxjDf}eQ)jB5~Ruo5AD~oA-*BOnR>7(M&HRAhL=3di-Yg39+HpubK+Z)n=NI@s=~aEbhl-&1LdupC;mvIaY>$N-{dD=p z&sUehZAYi4u5Ni~UV1~gTl$G#t?J{=pXuygvDv)9<<_R~$W<*P#wB1;ohdG7wliaor(Y9u=tu5aC?_M|& zZbfsa{{V0CXb&bXLvxSCtX{e=KB8RH_s})Svoxi9Bai3YE{nU$baTcFd!;YlbwU?+QG> zO^(lsnegW6xRK75c>m%lQ(6<9sfV`4;XPFGx@OUfI02cG-vvw2ZqSN-qduxskdLc3O=quyKAHa>@d87O7c{LtR+79*DI?D1gcJ36sq_jK!aQ>@> zM_zk1{*@znHD+nS%6l@xh3v8-_Qe@zJ2 zPk8g~L+G@;mKjf_q-P~XUcuU0hBsS}{Ac5zFKk&bEM|q--0+g)0_n4mcYZjG4f`={ z*z@0d=eK>lhwgW{Z9n>apR4AFpH5v3?eiG3_d5RD8?jFP1N&hcZtttD;A=Wjcm`1;pw9W*$8`NPF!JrDJEs&^)*{`A~C z>+pmDZr&_yNd1K~A-DRK6|aozi$UQ`%B^0yBK4GfpBR4^iZI1_a{kTSsTKJS6^RTUtd?a`>(^|%sa{*=G%9k>ob@=J~F{^ z+ZUNz-@)AKX%|3a>w*4KM8` z_1GL38JsjBczZ)|f?HpI!pOASC!|d}v>C534mdhE|J%4%nRfeASKV*`Hvv=d5AF22 zw(E~LxvL{9Va+o1NBW7k;#!>Wr2X5{LpL^ud(RJhR^6Nw#EMMFEiQhsxHzU^bHeHu z^-cBDLr$bk=-{&v_b2d1dZdi!`li4eOtz)BD<4br_dXQkET6Ng@9GY@A4^=n>Myyg zB6TX<@@IdnAI8^YjhX**PeY#bU}HmY;^B!6oBgXd?~7YuwreE9a|1m>^>01uq<^pZ z&;zJ$o6nE;%M)CK^^bnG?K``Ue6n+A@iC9ToB!#29PaIDTHS~pO#Shk`jvSf9v;2w zR_}+0vp<~XX*f3e?OVMK$FduydHZb`di1G{{~8W|v~63zx&EYWo8Jq6=Kt0qoF?^q z@~Izs^LJfnnYm{}b2n%0{+zW>1riQBv9K>wA~IaaF%3>1l)a(Ao=gSIj%oTHxH*t@({JIEs-GarR zJ+<2#*K}d-=6Q!3rZ_vpIsTTNFXi=n^28gX@A--Ml`-BEZ)9&=cVe>RZ)rX<`uQ>5 z<|Em2H#bjl;yljWb-N}z{f_pVy>Q|Kd%cH#exZ8O{zud2uJCs|fI(H@yo-00BV#G? zv^ACrGv8_OrJ7+hWW7XwjPfJf7+l_uRwwLxx|3dS&Q19zg0+M}&8A$6N{kxU1u;o*< zAa}t2{^xJI?KUTnIj}Y>aOWNQBZd*Om$Cjljbz>Z2|Hr;dGu2QYd)ac$Tt$=Vw{s6 zXzcG4VB5>?yzL$8{nv&5=LgmX@FAH1 zzpRHgK_qZ`8;dgg|Dt_=lR zX5wFcIy##5aOYKxP2ci+3+Ua3yqKmmw{DoDIe+HIJ0Z`}g4Rh6=999N#84VG>4r&8 zz6UkkWTsPHKNt0ZL!aHAtucqwFf$|^?RO~FS-l;HEY6r*XWQoRhQNlHexX4H*j9em z|NPK6Pi$;_LJYr|(Bf?f|7vZhN5kRz#om`g-o}Uc#x7P%C?TBSEK3jddSu<|rThj$ zCXW>}+=}B^G1Hl|dC*tAjipZJy3IJWShLUTE-Rdp;x8MV_O-{r*M{m>U4tFj#@17(8fQ8DAVZWLj*(%9{mN4(O%2R(rdDA{98Mv*ylKY9Q2B@r zc}?s5cSgCu*EimYi*@kLjLl8K(7Fu|HQ@#LRoBEF`t=2;@RROYYy3&N7s#5n&olKI zw+a5l#%yQmGg;I0qZwaM^q0q76RjGILp(feV%hnZHTgol-c4*i{Au{Fxj2Mc^ZSOw z=ly-^H$J|6&-86Qd%qgzKZ+^6d)#j>*!keU&jz1al#u_+3z_LtYgzc<$g%D2-u{9n zeE0;X1Uq-t>z7haAKC2*tveQ9|5`nEqHf)LCw_!+1KEssIPo=)G$5bH%0_q>fzJsr z?vHRg0>)~{TUHRirDlcMUd*xO0f%!K&MUIk>u762 z8JjXgIp@x%wjUqoY~OZgBF>XuY>EjT*no3T94)=b<0Kp|n-j)U*a`Z*=_lUF=k|M`-;X5PiGj@Fbd7&CID!9+|xka0^YYnN14SJl*&mfY&7a&fSttg2?Q zrK+l1SX#r3fw5}E>aIpHekD=F5=Gp7+aun z32u(n1YpRiUagl@ma}&El-5=)saa4uIr4=w8cGw;IwZ=c=arP;dx*8pz$L@=&lxyp z;GD6S|EI1>%4_gV(W;t9+~xbpYcw7H1uZ_jz^AtY6eSu+hErfdhuZrmMs0`?oF4-^1g@9xpd}552(c zAiOoaB{7WI(D<-&ukK~%-rBP{t(S2ysL31myt6CqDrEMrSz$Je!abRiJ#zfJe)Sa{ z@^@$E2ec45uv}E`&{p^Xi3;RXfwufQnk2{oz zw)TPXq75gy*vFf=0EgS5`f32cyCvpFI0SAC-SLxb8cWzv|Hhq8GEM|!^UccuPyTD)k z)l{%Gt=IKqy>b73p&{+6vMK#POz^&!;K89%LxK_6+FYaciY|p&rgexO98xAxl zTmh>MFE%H1-{;-1xjDhVBYwlW=7gjTE1DA$H$2pw&}~DoIU!-gjOK*+4SCH8aT`W7 zC&X?@Yfgy4!50c?(BrTCG>oA;oaL`h-_Wyh2wNRp|JB~WqWMW>#gw|!&uv>8-nGB& zz@#1VyMp~!m?5((t^ZqNy|~~J8Q6_GF0=+yBgy8p)cJQfhk7~4Jaj(~=p)6n53;dm z?S8uVcjzaqm57gmoWkUz6L6g=Ep@Q(kpzFYVcj@~FM%sQ@5Rsu=i7Xio$(5!|A;WK zcIM1!fr%C6yglwFW|r3A>y=2{zBpK3f%tCoDd50Ny!MLkz+(H1Tit5oG2k>hq3hpO1dr!Dr|%5uc-@eIEHgw$HO4 zsn6@9eUAOF4n7M$jQG4J+UM%?w$CkpRG;x>13EV7lRwyoDSto@q1}_?Z}xKUHn4V5 z`2*#3!3wj=g67-M18eW9stnvyTD_#C9ADDJ7f%P)PQ?-P?Uf74tFc2ek4GRQ9=M3s z(Jb!)Jj^3DOi#pTrHyyEnRw4MMfDcAyRzaDESgm6dUw+}#`tfHfyToBe+*#!$48GV zGX~nnf5IOke}Y%fb)L2Bo9r&Pg{p_e`FC`<;_UjLLRq7UYfKzmX$z zOmx#IM)>d}qnk$P?OStiL>}MdY-R4@@E%DTLM9de3*TPS`!yQpvL28OH;O#>qRV+d zhQeb;$}BgEJl_$Jv@X|t8W+fNP4jsHirQ~-laAU=mo)7?m*HH?Cc|Rh$L%UF+oF1w zugo?nvwq3}i*5Uh)s1b?yta+))Aqx*tG%6x^fkhvdaUfxUOa?(|;PBL+GE(d%@Im zJ@YXD@(2V9ZOD9Xf_mONq)<<0Og;Dc6sE~q)|aS+P)}ZiK>I{lA=Hz3--r4EU@oFQ z13(=^KG-Yz0x&Ks8~t50hR~kOn0AGhp3KYs)ZZ&M^cl2l$Xe$`mY&QpLHnmIJ(*=u z{~VaUncf0cKQCJLWcBkKOHby#X!_xE?iBhV<07fin`hodAB%!?eewBsmdm`o2oUB~ z(XmQDT+Enbi}r&MD6}W{K%m|p^W>{VKNT^nNBe0AI!wX5k+pR+~1k zuHR$e1!BYc&HPjP5og63jL60AyA)+O2!FuYK z>-@72++Xxx1>?`yHv+B|{j*>l1G~W5w+CnpVY%d7#H^bKm7$K@4V)~@_ZPV>Q9m8r zL%0~M_6xxjrpel$4}qsZmyYlnm_^fOFIe;P{Tm9?Dmu1V78f(twy=E^+LOB@q$3PP zP#bQ?923+RBWQif!4&2t>-wz(Ge7M&So){Il&CzwJT zvd(p^gO00uu-50RVDi-8+LZ~ORUJS1wP^eeYzRiS!HjLH(aM7{; z++HYM<(&;Z^J+|c&Ks1j?72PCo-yUWYr}HrhcShI$T}BgQ3;`*tm9!Ul@RL5nr{M? z5T;eMf9ThXz?hv;G&m_i%!)d;LxD*}aj@^uK*A3*RRP~V0y2!Z;u2o&ncIwyPzR{Ot$ zeF$CzDzzU{z&f6Je}O_jpg1amp{oDVsVGhGMPHa-TX(1zR(F>UO9 zC3%AAPk~ua+P^ED4n70c{p|Z-3T;$$JTR?n&r2+met3LD=_)VR5$zaLXhY`q#=K(? zDAbdAoJT$9B?|TA00Q;jK+t*PJ75ZJ$l5>Or4m9tnKARejNp~@Zp3PT08F7Bnf_^a zQex&kg+QT=iuMWXOnZ%KZ?`Mj-tI##qfhF%-7+u7JLgk!5dv2YZHf_e9M*wVzXbd? z0_!l1N(k-AHzB5<6_%c?<7y{Z`{7lvjuT!lrJg>20@h>Tx53oW|1ZG35z{}frBbLT zb6%ibfd3%WlQR(0ev+jpvz^pG1Ewq5KMU65&+mb?ZoGzj3zj2t{=k0_+LQf=(-Hn^ z>B*c2sJenqAhahlrhRX)`sejw-G}Caxv!U|Ec{Z@FKlFfUol z%>(QHw*ovEfn_~u>Gy+G|9eZHjE++Mc(B&F1g!pfj7{mP&i`BW)b{dNPUqWiSan{1 zi8{NjasP{%Np${Z>@eFD>vnilnp;4-_^`ILkKFB;z0)qf$eSCk&S%c7?B&eWF22YN z;Ocy4t=r2vg4@N1=fiCAnJ*o+YkW>#djjNhCPt-ik4oo9r3<3clcUnQ$9B~|oLQ%c z1-Ds`c^bVvi_ctDveS3BCqO=PCeyC+IeIqZ>U@!_jhdd_ZVd88j;eI|y-~~OMy2OP zrSFeQ7e}S%N2N=m(xp-92cpvDQRzidX>QH!;)`6Za&h=Py=J@kI=l_X`tvBIU3^h*dHBo`nY}!%Jpt_-i=xsiqS7r<>2FK=X_VCqXD|FV2IUomUYP$*MA`pQ z(%EMD-S~YDTD#|ey)fUUOFAC9UYPIroePSap5@Gu^aSX7;SBO&Nz;byT_8 zZI?9rv6nN~IUZ&IwxoG%)(gKs_KBonhZ9lsN7Ub4T)H<2q! zqkdGD#_bSLc8CuuC1&_*>zc&<{Cq$1q-8oh+BSx6C)(*=Z2-B?AP`sS`A%TQd)~|h}%OA zPuKo0|88~XRot&JtixT8b*SsPlS|$6Bad99;5np64re)UdZy6A zJ@@uZcbUh=YLiNy=IR6F87^m##ZM+#@@853Y>RWq_uwCdbF}8=^#IlL97Xk=>M3RM z8iBUg)N>XT5K~X#0MZ^gO?)kk(^f^d-f=2DGJJFkUC!9;0`L4|*@&cC&$R#dMvv@jL@^Yzu zx6ZUz4#!O&3Y)eIo3=|{({|erFNQ#jA8D`gBd5&9kJuPLa_VFIF?}dLO&{9+xlsMv zdK^Nic!W(I(p;^n!*wp3I@sIb3|DXJAbL{=VN(a;08Dk9WRUIkSnc}Bvh>*&oAoI6 zV=TQ{kD|||Udoz8<^ipUZc|KZxu%V>eVH~^xyGiAwJw`}e#m9h##t`&zm{eESf?$X zfv%0w3mgB!#=o%fFQ-VxzvxXLN}roP6n%i@3TIfHX|d@;u`zupZ2C~x^r5inL*ZP@ z&m^++Z2?*OXBt_?&vc8~H9E)6vGnsSE+)(NSYqiHT3lgqwZ(O0Dj>@cv<}NHuD5ul z#Ub*2_y<{o;E{E@*5W6~(ykUu5A3*&+uJ5P9^yyv2=}l!+2Rz7%{mqPfTcICr zK3NuLTbyI@7>mt1mA2$sdb3VN5B0^{HH1s0UBaea!lqrqrd`6OUBUt6_XwMI37d8a z|4+25faOXXr&-LpCC9qYa@`=z{>vldWRSZ#u3F{mEH?IXsgj%|^TuegVZSDkxe!85 zlH(ap{mBXLeJEqY6$mjla-3sqy16#jVp%d4^4T30sk}(|Gmm4gl2G3rHea;#2gxJc z+nsBpRsJdYw6#!_;+NK zOX0l;t;7Ej8$P$>LD2THY_;cZkNPykgN5meVvp;~!)K0_~R|=Aj#HIDW}V zQ}7SM!yPSaJ{dL~*W{$>_y<{tKpXBBtAxLVc$vlZ!W_%rAj1#039{Db3F_e|h_*g2 zHXM)SBo0!@_Ykx`dxhH&|H#rGA;W(FF*#`l{y~l-XkOlPBEO56*Br>K&wmL23Gsgl zbBtXe!zZ^aZ1*5&xp-$5Pu-dKKan%zX@|2 z!B0?|wsZSP6lNXFyfG308GyjwnMg-IGlz)&M$xmLoF{2hgSb$b_Dm;>{Zi4NLA+7) zoHzE6k@pPZqr&eY{x@Oz;rP=!_*j3b&vnAQPRi|#Wnp?Wto_DqgZ8`+l}m;Vl7`iW zcT#9G4e?#Vyc=QWN!W9HC#!w6*gT4OmGBJ2YlXvzn=O7y_$1(MworVYsIW{9QZ>r{BYYOC(Xh?$R`N2;higPdt^R~(2ERv_6=F>`3x6r z@aJxWun7n!%?3cS5t6&RKBo%vc|J4GKz|Ino9G8j{cU6p7RUr)uJ@V3Twe>wu;(*^ zyhg3u3(LrCmzlT4XMfRiyW>1U8;;GP!YubzGRkFJ$lAANUBjO1i>GJI+lY9va4q6$ zVfIzMFm1kK>HnDw|2+_s^&99L#OB+GHwn`Z(=4kE@pEM4<$5P;-tSTm8`_)o4n79m zzfuo-_5)e%e+Z6QdOS0;(1Z#ab=E!A;hX`}- z940&lu{j=q4cFsz(Ub4Dn9nAt&vh0LW8JQB*Hur8c~>c!D;h#hnq$zNmtfEF$l;!R zrQ02VzYj40zk~REX*;X_E(Xi=a?iX(E)^gsy1oD_ah!chCRnES+|`r)Jq*E zhz-jjC*6gAkSPeXVH2pLAC4b#l3WidrXDs65tj+GU5hQgjf{*O!)6QWlRVn>bBiz{+?jCg+hD`G(uV!> z&%*2nvn{~qDex}Qv+X}2Lw_3aG0}6oFmpTf^l9b|F!#?595Z0e+ z{HHM2VJVi;elg+(GHe3S^Ij13^xqq4>e+5`5*q|D>l!xMU~C@7p6i6qcQ7yKl?i0z z%@j^50zgcE!iMX*5P|kV#FfI2Azn#FUiL9LsTltts}X1)M!cR38`goW{>>Z$JvR+A zhtN4>I|B0_M*JEXHXNH|&3lA;soR@kGY&CXZMZ(v<^zlWB+Tbu%{~SGbD<+A%?CjG zfSH%aazn|mnFKvKi5n$kgxGMOV~*2c&*y;Wi=O)db36upJ~$-$Zy^4fF#DFrSS;&V z#M^~;A%0D`5wSU@g3S@|>!N4g6T*CE_m^bUlk1I~R04o}AU1q%_?$4$Ej|+aX|N%y z{RPY32Rqh{&l&SxsPYxU$%y&8uhg?X1BLmV@i5^V5oZh2W{U81#QcpE<}F5CE6i=- zVc`R)%Qwhq*L371>-yzy323>k7IT}YJ`?u+5cu0;)rdL%lE=8){wQHY?zRAZ0@%z~ zu-^n;hCq96`$=Tzdms)7b6=fqG0US3w-2+efw`UKQx8APOV;|c-)Ucr*vvoRaxm*k z{k4df2y>tOWitF=kzw`oRk0~X{J6#37bLR+kN`q*Z+BZ8NQOQJ@f6Yj0C6!HdiF!D z#oW%-PlLtgxDod3pRLrxKmBaCY<7vBbu@hld-el4=>hzM^h99Z0f_sOVZ%0(wT;6? zpMsdI`W)(!m)qt9;X4se7v{WjpKzpaVb3~#QS|kQ8R&=gTth}3IQNpZtY+$^tgyvC zGIvCfD-g)+Te9Y5dy@OOW770LnC-}-9u1w1_&PFndbx@dF+Ko`|4%&Da(_y2eQ! zZ|z$H?(Ym1h@RtWDOvPp9|1mtZT#Do{)ZO-M)>cD|0=u^abM)2ALcd3Z(x3RI#=}M zM}>KQ@TA3jK2-DaS!33j!f{DG+hMjHFqhv*J#74l$$IR8A!6)rMVu?l{xJO$aP!_x zJ@V2wS+7ydras`>RFPrBF+x`VOQ;XH&ylYX{yO5P$gt4JLr?Y3$y=u{>HoGV82tJ2|YQf z8UPs}dX6cw+K&=_HuPlGPZd44b+YQsem3Afcm5DvCOl&5>hMY7L0C`hvcpZr13E&?j2Eh}+KM2RYCxCwtjv-F~{~#O_ zo&f$qxb8gx{DW}4dIIFF_9iXe3S4=#1C5B zDomRfEdBQ_HrpWlFt3>(ZUYEwzj3`LL(jI7_576Uk9A=G-!A+e#CMTl&;B4Maj-)Q z5olkD_yey`e-N^clWV}q82qCU543nVIoItUa#9WcLAoO(4|0F| zjPq%7p4%s8J^|DBJh7SVbB_sV!}cx_d$#2{;S|I#33I%dZ5j3faJt9!kLo#-$tZUj z;=4u9_4Xyv=b|igZky-M_b-cnF7$lXo^{~5ZW9KY=kBS`2AgdG{?}r;InD&r=O4vB z2R0uH)872{9&C0%H`43+9|L_J8T!Gz@8u&s;L>rwQvZ zKtA=bVSQ#ffAmiH*4~Cv2{b!+s&`$!gDg4C>#Ui;4XgML!MkYH}Xl^+jH?=3Ps@*qd`S z;ccS-1>zqG^ZgUEkH~Z9B(skwfIWbXeLev_S?j>h1!{3smeGlj< z9xx>aL7CgRGUr)k=21?zIK|>ri@Sl7C*U8XCjyzi%{+jKVUb79E1_rklf;H)E)b^P z9Q(nB<@4B%eyC^L$gImNmj1`WtkpKF8z(3@-8;y+jP8PH#Wkc>L# zAvWg`u*nqGbrBGoY{X{227B(Wn1^{Q5Kko|Z6_6 zD*7Kw-pE)L{W;M`#;WMeSOo{L+>BMxo3RScfWC>Z1k(cAJ(-@Y#W(*6PF$~@h zdozZSm*bGE<(e@p_GSzVGY`xCJz_J4k(c9;ta*=%4eM;iu;gVP=8cSD-(79S;W)#Q3?v~M(jGs5Kn zBF{*dIbJdvpziBnLyY_p3w%)v7m>BkU0n*4q!+zf@dtrJqGf~ zHKJ;yJscR2We6Ue|5EA^JhzhEeYxj0m)9clu&#q}1iAt$(gS}f+Z4%PEGUYX}~9_}0O4rX?i#J)k#p0JN-f!_yi%(kozQyOsJ>0TBwKxIux9a)K zta8BOEQ`mGd%1olSv=k1c@{6UxX$8wi`Q7(V)3&U@3eTY#fL3^)8aE0pR<_1w@E#7YNZi^3EeB9#G7N52FBa8X* z3~f7qXHq$Zob0aO42!cZ9%pfZ#j`9fwz$ILWfrfrc&){oEZ$=AOXS{e-S%62)Z&vC zzi;t*i$AqEA+gjr&^pz?(f>hk0Tw-yx#mg-YS^Na~ zTDPpQ#oI03ZSg^ik6V1&;V_+6BdUp-fr=3iw}}B+%_J!__W1mE&hl+$hGH(8IH=TibZo6|^?+t_|9^ z?u#zBHtnu$-0ixHUXU&Na_w&4@VoF~ZSt4%W0`inR`kO)*eGf*>#XA((nZapW{=A` zj55FIdgUrBTClj<8Q!_K&9d@Zd{(L!Q|ZN*mn|_r=X0q|po__@vp>!r*4Ee6Nbhy9czoTPKlAkX_*F&z$x$$zn(`BYhbk4=>yBM^_G&1#m zu8KsgFVVutAo*M#Bi0d*9cD&Z|JDc7hA*gEY<^d2__Dgv%G%&?HbXiDQ$LQ<+7s0^ zRn>BI_qn0~tZ*yI!KG9qyakBM>=9AsB^Yw9EGfo)J)C~K_cRf68PoX)wm;q?R3E?y z=LzRh38}FB;TA{4UnSV~$6JV9`70NFE@H|u%O5V6NBpe=+x~KqW>8VzYoH+K%7T^f zw*}1mp1AZH@z(~n{naC#fuN%P_CaC$%R)nVpOyY_8871Rw_w}fvq)zlsHneRLt*=? zhreRz=nt2NBK{KL%=UL&mLW2t{`h{q?e7fy>H5W`hKRpmQU2bzlxv!eW+#WGypjfmEd&&%5NOU3=;6j;$8PKP4?mPYwIk7ev<74^sG7Hoex z@JCzvy9$BJ*#3=C{&=sL<*KMZzTaT`%fLPD0vOTX)d=d3?^EF~vc2&ha{y@-^~Za| zw!aGaD~1vM@i|%b_j}mkFXC@G5?%G*`%(Um!XMi~f4r2d{*t{N{jHRIFfpR_<8zUA z{oaQ^9WVW0ss3`K{Dm&!kIzlo{?1$ec-dC{l}GvGJ$LrA3hgMoXKnlY6#kAv&-Px2 zp#HuY<&XE?)d$QXygtg`VLYdx?M<`%9gXsL68_lFD(d_7D1UFlpNTa>@l-1hZ5(DG;Qe_Q_e9Kj}}RkVIXQ7$=G7UTffH|#%NrqTKZqw2?d z|6Q$*c~SlnCb;i5&>t`LsK2j8`QtMH)3IDd>(?0N?+pCu_RC8$>ThS1zbvF}Vc$|- z7CT*hF}uAmVEG5bZN~xV$+LObUvJsaX*+%$<*x+kuKMM4 zl)tm^r{ij*FKCeiG&H z=oI(e3;M&ZDdO)xqWryy!I-Pg#E!||M)}LQ(|taX{`iO$%Vm4{od&zT$v7CPg_opgaF2^NVw_o0S;&bXMTCNWU^JEWn;P1 z5VXCS;!pc|BJQ!UJ}O%7y;0>(haKlB6)l&~kl5v>&Tb!ncf(lAT@mH49{#?d&cu$% z+m;!oGxQuxErkBF|fvZ!+F zVaH=a6)iUyRc=NhEHJ0C9di-1+$Y7KZeqMg62Nj5^|vEH| zbtZO99*FX{68Ioak@Num~;p%TeV{ zL%DozjqNBEJC2uK;!oGxJe*7fpjT0UJEHvUEN)+K55QR4@vivOb}Wa#GIfSn+tD3^ zlC1srKI|%}5YciIU`NgseUBi%6@bdJ9g7gO+#AH7mOH(V`_7JJiwuq?iX9-u81o4OPHK*&_WT@HN%r)r~SMWb{UqPwwKQf+3nqn&g1zi+gpvG z?KRI2A+2-moA9R$b)?)E;SWPPA~C5Q$Eh~`$5KBv90$9dnn0{}Ka8qh53KwIEM)!a z5VU^Bqx_wNzi}ATD(dfzD1RvnT|4@F7(xBfUi*$dGSSKPXxJm*0tDLiK!7{0rig68 zLF8^O6wz|A`FF6J^(cOuikU^!?uP6@2eFebyZ=Y!1IeP=ETu1*gZH>FwJ8w`o+K^L1}}+ws8K zI{(I}_Vj5!{Oz@C>(UQzeYw1Q^Wh(Xmw))@a&P+KpY}fw+g7jhn0JNaoJnwoCAP+U zTpZ+0*q`1roE|7k^eq3d|M@`H_@U!&9dJwfJZIDa?+#yjaEfc#kT%7CZ*wqrS%SaY z@*gw@^O}PbnuC*u`KHhAS@^)9ZC_~!7Wflp;5GB$WPk6tHTaf9WBe|kGw#&${k(@( z@$IC*kN3x!4P;C5^P76^^X`am3r=>ux1~*9vvI<~9?N11<3Ec_a<*hV7UM42m)IK2 zYYj_v+tTuOXS4<<_~YEAJlAvfd0T%j%L^0x_Zu)jIJwp5G>5aE+L+Y*;|s0b!1JEk znAnh3;E!8%l{de{x&HB({JW7AosxC)Q+>U0!=1qQ_b0u!GdJew6FY->Nzb)y_C3Eh z7VSAS(AgK~@9UO#Ut;gM3H=)U-W>@I!KtopP~yTN|JIN;we?P?U;5C{_3Phj*xaMv zcUB*0*z8Y_br$`gH8^qgX4m%9BW-DuS~okdkIhN_WLMh6#op`3_TG&1`cvKWea@5@ zS`(e#8$A;adhXctrybI!9kFiS#zA;rTsZC*7f`je6q;M5brX+J>K0v=*iR%|7 zp7b1xrP|H3er&gGg|_1BiR-t;Z}p7x@ACy(1FjMBeGnJ&?DNf?Gk5N>Sj`L5Phw!2 zn*IHN>R>uHCghnLTD^L4!upV}pk(#Z!jJxZEWV@7Cnx}#ND1qYIFCO3=%Pa&XK_L! zx?*wSu(Pg1DK>+jaDVu!c6z&RGT&*vHpOI$xB#y@VKuljju+4^nXj}Q1$KKz$Y zw|dTh{J8&$cVmym*vk_=A8^~WB{aZXM;JS*wlen-)o zh*y*|rTgJY`+P}9BRX`<2Z{b^w%PiziJ@7G<~JlbixzE~<7YQU%)>(h>l3?$%j!=i zAI`8VG$sCU^46YMf$?sezK(Sox7FjXXjh^5xv?!hQSl8M7cN@F_DB4}{868~desBW z7kObET0La_2~R=EklBSRKO7dDAA^>1e4^ECdOj$j|M`h`IkRJY4(}UPRo=x%VJ1Qm z2gQ=gx|&Cf=5A;bovNA#f|ccu2J6bja2nL{PDRy%Anq$Yf^QTLX)I{`OLtEh6BE?Sc2M=m75I1ox1Y63NGkfK@H}ZE2eo@#f-X1bU)+`Ox|F7Q$m2msM!=!E zx%SKZF`CW*b2+9_lYa-|<7BH9dnh%fH^AK=|9ZBP|kXb$rF=xC&1Rf{hw8hxp zhnRXz^B9fGmm<*L7ZF%5P5-m#)!!ybZxy>8h;eDbeEX02euTjG9zkIGX9#Q`&#jpL zB?3-6%sYE5?<@lQ2-Acq|0Be#kEZ_u=3y8Qn`j@4n9DWIV@*x zceJE$L3}0BQxTi~K}>&|21bPSbnciqacm%SK}}U{ZCzDW#jv~X2$a@V4;yjQ@R7r_ zi$-RTyea$Uk=cU-uENwYfNXH<%rSRkizf4K?ChDh7v)WudH1y0vu-b%HhI?V_vB5R zIX*ivZ^C5!hcSfhpv-flNID>CjsptE2!-}6hr&F{wmx9#nO|*moIzzoe|K~UQtS_n z)4^HBqP>1hs{KGP?KP(T^`ay5kd~rtBWqq>XJlT+tQT!^5w1aC-Y+0I7wjBq6w zr_x5h3amc)9;o&qzZI$Lcb#xL^6(y!`e^}E*cKHXKVzZbVvU)1oEUXwPaW-b8DoY$ z2+Z4tK%tJz?VtMB5w!k?!CuiHL9F%UJV#+(6|E_KGu-rum%Y}c7m_i$}*5N1Cn&AiH4b3-W_H!LWI=26T_>L`q2cVAj-ig`vKA2fnQ-RU* zg=M~~iWPHfm$)xy0;@~r*XXAEp)Ws`*z;vVC&F*Y_(exVT8!~NhS{|>{2U^J#r!#? z{?r!3dW`LTi+X?7kKZ<&SF>ahJ_z~I-&o|&A?+6y-RB=+-+ouo`>bE>l9~#a4e!g9 z(Zs!s!VG>hiyyLK?A?2p_Z3Gk|C-_6-*K$O$1uH;Mq?TU6ytPan`xtMKji6h<|WVH z1fM2x{33cu&HUP`MRVtuDH7ipIf?Y-aOpRoF<)83__)$ z==v1A1}Srwet(Yb$j`w79D6LC-hS*m}j&qT}p~P7wQ| zb7{yIQTr40S*dU?KcesQBlcZ>#J-QKq z7NwkJBCFil!SUkZ;9=$*`YePz?kP~D4IXRGE#?{^*N7Z}J9d=Uf^VZ7{2;JL|InGv_{m9U7LpWdLtXH>IAmnwBHHi+#rJIFmgJWgdVOj1I`PZPsHCAYo>!QCQ z%rWp^MW1!g-)c~YHb)3^?7CW*V^nTyKJPMej%77nSI@`;kD;q)IoC#FoAzlZUwAjd zDZ;G3tA#n1o+Eqf|^oIxsBoE&dc?cmnAm{$~ zMV^U}90=hb+z;VtCtEm>PN}SIinLfCUD#&2Pb2(|@F9f1GyJ?T%f)@ve*@v4g#U){ zh%oPK-WBFC<$XW(dCzqw8TrY)fr8O zP9KEiKnVZf(AB!{&3p$T$C;d8z7OFZ!#r10_}~GK9NFhYZPtq z8$T>p7C9CF;K+Ks+;J40DUef#bxziNx;lgo(`6q@9hQr%`7EX!I^RTiI~h8xb8=u5 z{=wD3Q)fNGe&o-1&p=-nK92CP;lCRGhhf%Z3Lk*MkpmYw^x6+>(oPOMbyya%mSrsE z(BZxO7s$|IS;$(J$&^Fq2twYgkryERG8y_T7deoNe{kjS)M2_y$6e%-*$|1wqhFMLjlV>>J@D#(-4bL`QY`DsBwc!

kLN>HyLg= z++ujE;T?wC4R;vcYxpU{2Mxbs_^{!lhL0Qe;rgNVmS{NHaGK$eVP4ZUZm!`x!}*4% z7@lr;w&7yKRfek#uP|I^IAXZTaI@hS!&?pSFx+k!Rprw)j1tLbQ6l#XJh|Y~;Qi=( z=|b?jmQXes=a)LQ!*g5hxVT~`lX9_>OGf`j$7_(AF;#nq1tq9 zM&z|d?%IjSIY&kHUE2`(79)48v^J%cjGYRWB!`TIVVw;SGL*sTjG_755PVZ(2e+1Tmg zdpKy=tqUnSnUr&I0q5q$2#+^%w=Sf}-MWy%#YShLVYe=%=&UyKCc~S_7&Fkhbs>e_ zx{$&hMrXfaw=SgUykX==4WBUV)`b*(w=Se`s1NdhYbBjq7gCsWB2->r*sTjGI&NJ^ zVYe=%uv-^WxX#3N>q3gW*~qsTcI!flj$0Q}*sTjG?AC=G;N=->mVCOkOJW|Me$2WI z-gCvCC#WB%+UptS$0*t-nxClFvl_u^7hdsfnP-b`3cT;a)2;_$9w2+^x@p{}RK{uM zNXJyeCrxRNQJ0y>r%oDQdYURbRqNFH`Y4^A%K9h`TT?Qr8ky}`fkyhPx@Px&kS%yDJg@KSa4I-A82`!nZVUI=xK{I;?XK+zxsTn~74X&`ui10p)v3Ka z2&}zw*yFX5_Rvj4?Nx!Ty=H8mE`MbbCm$i*Ot}Z7Jq{Bze|Lkey%ubT;MHmV8X>Ux zTL^o_kkKB85o)g;Z0&VmI~iV`+T%TgwYMMkav`I={<4qt_Y%Cd_Y}4>;nk_VgAiDI zCtzr+eEAqW_r|9iMBFS@(1wrI!q)MC|`0J$|!=_H4R2G%QZb z!Qai;a#UfgmkAw~gZ0RLEJtpPy%4tLF$MN|dJHd!vDXNDQy{0kf$(Z?ve@H2IUV1t zvEI~S)8+qG(bICw#5Uh8s-r!+TOcRra|7-fq|56C)5W2Qru+REdq+@_JV(^2y^S&U zns5SYIXIN29_xkA-S8K!=WOiw4Yt*(y`RU}I|zFmFEW38exddb$JjfL9X#jMslC@@ z?2W~<-ThFaJ?$%)KR&C2YBYaMI2qr=wmP-PZ?=>3bqAg;a~w*0d~D2pw8!V-w5P{y zEe_0=C=f@apD20=oO=T&?Ndfi)4c);Hr*|s^||j!G2IZnrh9|f<2g&mwNjP2t?7OR zdUBgVv5#w{<~j2IX%^hL)X0Zm3>j;WyKj!kUqMDsJIKU-&EFl8KQ%cG_FmymahmRm z7<-MdM?IEzIK0}UK2)QQ^TCqQR(Z}1fu|nNPZTfO7XaPdiZe|_O_#$X?K7yiFbm%% zKaHNd>Xp?jys+%TC8Y~43VCxFLe6>Y{g2Lb7?YPf*6sb|c@DL#U}Rz}Gk_8gb#Iis z^ONP`Gd4c!+XDXx{2$@phyR~+oJ+Ck1-8S^RrA9Zzq^YUhH*-y#ou%(k`Obgvw zQNy?8sQ+=HVdcK0VN2&PUAnBICd7B;PD)vA)%>NQWz`rDda_};W6MVk%N_0g3z5b} z|1rX143Yk=2s0{fU2=0pd5DYR;0<^gQd&BWmb@SJhVb(N{Hk|c$QP=CCU!H^%n!2t zNtwZbZZS+RTZ*4Cu$(@3w|D8CzQYxrxL)H2-}oW=^ktztaUv!9@LTlUwWWbbU0rcq zU2WqE{O~^G!0!_3d@W@i+h%wX5_F=%J@0)`+@oBS_Cd?=j%_z|Ju&w2xas$)!N=YY z8J&agg|h~=WOOuK9L_p-+YJrr;jA=RZ5R;FI_IT64gOYyF+L? zvFdC8YSp*?#c6hR2W_^e9%5+}$}9G7(jWYHpY(a@)nr|< z`{Bp?sM3R-sW*O}(;vLO?VVShGxh36vktW6c6E-;e>l|End|Lo+^43}F?Z#dFVflk zblsK?%rolV<7=2T{tW0p-Y2TQD5>!+6Jg}=`Zs-%r>AswJ(0GyATsOmK6R@*8m^40 zH@+AC(f8ME>NCHx(C^E5;pL*PF{MuoInbGgi3~kPMftDj(Er%N_-}>VV&+U6+S7+Ko310p;Ct*HB#*hBuZB=IsDC|TT#-Gvf zMDL7`N=i-gN2g9edu>MdPkrs3k*9Hjul-px$1X4T`I?`IpiDEHA{`Bn^v>zX1iTFI zdSaoGhFeO*2Q$~MUHSZ|qz#FE8V41A2YFbtJ}FW;JR7rweD(Q0R%DKegLJmBZZMx~ ztuNu9C-XWZJ7=`4zH!#tF@+dSg%c5@p>J1b_T%v;Z$h99_=USvWE)W6mdJkB|#izTmu>xg!h#;reO|D@QX3AST4x5 zTx;%0jkGpa)nDk_oKc?%@hoKh(8)Dt_hnf^5L}s-{7}CkZJyzb11~3FkXDryIp^0; zubua#-(-l*sQWD6-ZhZ{Yc^-Jr*GZh#W{52-diFQ)@=UF<|Dh(`?jSgdg9GVz1scr z2^h?EwH(^_L~oPZ^wdj8#P2LRE7Jzmzj%^)>*HIw3lq!=F@(!#`F_TM7rNg*dEU`c zbd#?s2+hXqgb+puPT+I@Cr-Zds%v6)V2;+E(nsCm^-%}~FA&1UUSDE_CTMRRv%7M}85xf=P$ebaE_ZjdP!_%P^ zIOZ)J<-FadF6CT;Eh6%tfWI!x$MQKgVWx$8v=_m`q z^Y(;t-d6M0mV5(zKjAqD=}wo{MUXQs4XMMjXTj6XYarv*Mi_mjdaCpj}ho_^QoDEO8AN5H`Ia%%VXKI5WqfWZfA@i*n<@}iucQI}r zfVa++FQ5>Pa`H%ol&?2(vew~4Moz{Zy3_wPn7e3aKY%vq|4Jbo#^8oKei2yX=7Lk8OPhSnqj|X2=+(sHSP{Dj~(Ow1U^ofk1ptF=M=}t>Q0@{!s_mE@$QM6-If=KBKqX{ zEq=c7DwEmtwY;$~I5VfjA`^V)i%5HZNKOQGfTx?AHqk#Z2#| znEmg>Y=1@?02?;v$BZ-$g7Ghp+0KvIz9D8?FCt8a@xLCkzd2_6hcVlGVzv*(Z2vuG zyB}M*IHqTxHFBH3`=sMZFc4kgxETGbW46m;wspP>9zaHCLFh9{OnbqM+NF!DF{7n+ zUhmzyTDs1haB=L?=e>8>Wz2i+!J|(kgO!sp69%s)dndx3Zgz`C>9ygea=0b7`Si`3 z;xc#P{H3*XmsW9h&GM+R+be38%)h;2ZpmU!uc@er?xJGq8(SNm+Q`uinb zZ0BXK4;*2_xq85R89G-F!mb`dPV6q08rSJ$cygyB-MFhO z>GEA&iH@tQp`Jd?`B_PDuC64mt1FSax)Qmot6`qLtE=H2ySfsc@euiW2LYE4?-zLi zS!}wx61l4@CJ5*1YJ|r#5%`5?lO^sP!^LEdvf#?$RlkZX`U?$LlcgSN$#MZ(VRTj+ zt|PMo;8w${%?MfY-$<5vXd;ioKe+Yq%FSfa-%P#`|KM8SRo;ip(GgrCymFAtiib;v z_wx=7E(PA7?$8Z_{k+qGV=~GivgmN|#NXJ{G5M4P+#JQ>nFJYfrq8mFnf`uZZ2CSF zX8PH5b`FN`piq6a2l95#FR5Hd?!i{fqC60^U#n3a&9sXZDu26Rgzgu-egjr zaDpB!LC!WA2x#fHBn`UTJ- ztNrg7oqG-Q#+Uiz@!TcMWBy-c0@1+PxRKf;EhWPIEVYmyyJ!=>s&3iW6F6hkaf-% z+biXW?%J--fub$i3?XEDCA(ushCYhy&M(zxy;IKfh#UyvAKX-U#=QaIwPffpeX{0l z7Uj^vpDP2`2p$7w95QbRTgbTcqK<3Zkn;v_hv+;J@68!go!^O^I_?~YKHKT}JT73~ zl#UgqPNm^SvZQslk#7@bT>frW?flvB`@(!cFqp>?Y5fB-HwO^R2MXU8IUhzmAiNLZ z&xQHGg1<*)T;8<*S(tJ8pn`d$`-jMxpAUtZRyN`=E^q!P3a>}Vbv-F3f8Fo~VLn87 zP?$H>KNO~Y=7Z@1eLpwyXM|aYe>Zae=96hrKF#nA!aQC)u3DBa8=W%4i-eg67MnKt zAb{PU@+HD02*(Mt%}yjE65A>{kb!@2SHm;zY=qa6p~H4d4zOc~<37sSR>=VwZ!itU zZ9!N`h7P+Xvf5ulIqf5#w~7wUl6CG_lgL8|$vQvo9?B8-euSIIu%9Wcd3#87c+dEA z(a9E8J5Pwt^9X+}Iy|SzYUi&a&qYYqIcslIjy&*u`Ij&sR`!9XoW~-CjJ%EIesEwo z0B(rr@WCb5PNF^^R`LNe_4A-Z);vrXIr|oJK*m=^lp`+hOTQvI`OqP2+!Z1(fSjyl zch_sgT@P8k=uCkQS>v{dd>Z6rolm!wa>V8Jf&D-8JRLe@olobk1<>I`(q}|xCUnTE z^9RbI!w05+GJI6{LxlenW}k6fm=EI;c`hSewmY(xE17cG>GbihRtf&B2>6K4PYfH1EM z?CWWh?d`|Hk0RuEDk#rE$ZgfxBg{JaH5utfkSQAxG*0a zpCrQ$`#-YIdF+dQ)Td6s@R`E72vf<3yB=}L8h41%87ex>&>?F+$BBG1i zBi-o;@nY23Z-Jbwac77QuWRf#`7K;J_G@H_-S-*DiQsvZV<5H!;e4{_v#n766NIaT zS)bdD9K~}wI}p0-9rVc|%3&uctaB>a1=A+e;rNNX5TP4`K_7pP19G1=!|1TTpv@G7 ztPESaYMqI z2W-5j`6f!AiWy9sdYuxeV1WLX80p*$4 zRxUQo`cXNLukvccO@>)^)!9n!hktMn!z*_f-cM!)z#W8Fe#7ul!zTB~1r4Ve&NS@isYxEj8@ZdOCi0m^UTk=wVP3N|-PMNOJT8cH{G#oL!-f)ZI?S|V8?=k$8;X{TG8-Cj`-z00^f`&i!{Jvf< zA-uOb(T`)Eb{bvu&Ckco$BVuI`UIVxw=|zd(fej??+JUSnSiH-_@tS4s`rso?qW)M z>O8raVxC^XmhmHU>r_5XcAcW{|KKz`UkGg+mlpQ}1qAN?m*W9-IPIL{V>)ua+roN+ zsowXPLfB?}?&El*K(=L=;l|Wz1G}6aLp~$6_8!K7knuzC=;osKs=zjXjo9W`N1fU( zgTUJBfW0Y@h2U}eMC~!YwYLS^^y<{!8VIbtL?p^J7=8KS#Syyx)rS~fKaftOvdVhcp?a8p$+4}(7 z>bQ?S8UGmS@m+{(GshR|w7dZ*+4AP%c@wYiAt-Was^z^n#$F3{3{+#H$IYA=dqE7g z*$zVR1K`!(j2L?lW5*oqS4Ta%FUHu*gguTyL-1$8tG%T$_ISO~AKyUD=`rN9d&bG< z2HXkQ+m4D4fzO6ld+WuX)^ivKpJQ}&*zKd|yf}th&ksZI5miE{<#-HAHr=hmz3-KU zpu_snbPtI=P3vYnd{>5=ON;5fiGMO|r`Y#h=;b-`{!xeSU9snF;TZ<>vULNY>Ky~v z{3Sz)_aPzpA@G_%H>Sn5y7yr(O$!g9+B+FzZyM}TF9aRFmQ{PyH_g(Qf=0rzU^?V_ zJd(jY_w?KV`U+C;Y{W#Q9Xhr#t5=SD>@!ZICokV?KkYoRv6qg`%MHgue-X8T>ckyWro2=kIXR;Xe<5E&M$Aufg8~&)>-K z-O?lQY%I{XbF|m$85UU)}G$`FopX4j z==Vc5W46Jj@TPn5d;hj1-vem_TDIoS+jsVkNOE}Z&oQlT&G`Osn86v(rR^v@da~}( zZ|`6(nNDgqdZ@Z%`E~y>A$4^B-1=2T2NRp)BJpd^jqApojkER+T(fy)`_Q(GxI2BE z4{}FR(Y}N!qi2tqwf?Ngq`ec@Y!0?x-zx>Pe`c>N_Ufc{5_t4aJaYMrKL)L5zW|!ubg;s@%X1~Kad3RJl_nn#CdqZ9- zfwha`bC2iW5tn<(gy6u&s_?$|>PD|>d|hWXMJ}rwS(pZ?3ovb7e~^qhhHzPU-EvZ(PXtg)e*ob?p*nTr+()RJ~;3 z{IdC|1gK$*a%rb;MC;`{ABsD2LnkI&N=wS#dC%10I)gJbv;%#^wzkx&Y4zX6>W0gl z;!AzJCept1o=rpTh$K?WI_?_OqPYwyoh|BT#NkARd;D z8Ncb_VOfvv#Qfo5!yjx7m-vni8}{0;%xG2Im~3sV_)OHsMPlPZ&&DXvM$Ut+n1ej* zg4c$PjG7o3v?itmKC)Pw`dh{J#7OJ0Vdbw4D?Ko*%#|<4maiGdGoi^$#%=E#X{~A5 zfBUkQjUC$}5B1x)vq6sNlSxA^h)(<}T00VR!&8=q-aofLo=^vMrc9jI69UfLR>oEWKTXAI}Z=6h8sEW7#X{#df zpOIF~Gjm%@azR@D9eh@CaAZZE51 zZ_z99$6lGT^U85?-E}9kTU!b`wq?|`PAS1cF*`F#lB$<6@#y4UoAOJTXRPzE@45X@ zzG`G=UruWmz}H|)3NPdek_jNBQHodEWUa1lI4rB zfI-PpTuidvq6$l^mMmLX9$LJlHdIwoU0tzw1iDIo_wJ=Wx8UBp?@jR>^F;cs>4W~$ z_c%Vj_q<<{O7c(d$=ZQ*UurWZa&oN#&Ww!oYqt}DpBYx&`GihlF{_7udQ{uA@f zy`&FJ{G#j=h%kL<2QT{^i?wAG1*d#3t|dEp`{?k9FRlF3y65Xw?rQpWGGftsV7zd{dBgD2t@A<}|BkqpAM}~NZNTo4;nu3PHC5+adCwVJ zvwCKjZ{9Yq@XYqCR@`e%^UBn?cEx2yvp!h)7-G5a>`m~6TUM_fQ_q3<-gRp>2imXS z+9tZ&^8V5Ii^!y+*&i1AeZhhCP?2vSj{kukznhX)z8g$vd@Q*6z>j{P^Vjj)Xz8Ii zz4~C(G3?u~WDMw@gt&oV|6_5!@P9wW@#*dXPkk$S#@?S#pI-Y;#W~@nx4$Ndk<6?q7UP}-T?(0_Ev=!qql%qYqEMnbTEFwpj+laD4om^OIhU6FYk z-wvneq-I}PbR{MQcaQPuIULR?x+!U5SM{vJaS6G;(JjZvjs8Y_uut%e=ESC^g5mRr z4ZkgW-iWM+67f;a>PJEcN-hkSjPkM^P9Jq3{lfj*68?PB7ff+S`MgM8(UcRrU)t4K zt_ig43+1i~ZQthX&AaXV=Clo)&)u30jjrCdy3#L99r+Fn2rQLXA-k74_ez5YrU|P%CRj)(_AXkOBQI4d{%R9e4vlSIJ-qYOw z7QUj{uWe7z+f04$Z&S*P%0KA-!$}`5Y1K7#(XOWDu~1ujj@aL}E}g}!YY4$I#3=je z_5|@c*4%K(#lij?Q`e>Ejz}1MRndwI!WpHFk#*@gfk<=zHP0sm(?XE}4XL{_%8Y$1 zn{hXOXAud7=lO$a;gSnyq>mn+64(8C->$Cewyx=3YBlMjH?Qr!+_yI)lEr(Q%eId8 zcBBp(R+CjxH0#4)8X_WkeXcM3%j&lDF^?llV?Cvo+e4{qeKUqtbdO|%38!D!I3+x+ z-~D-K;mVpi`@`VX(X~*DZvP-WZ1(+WiR;oYZd%{5A#ZP6MyY4ziX<=GJEOg{t>n@J zIJVLv8^^8uNBx33d!B%d@qAK{);5!4Vt_MBQH%j9l3smvEJ@aaANW*x*%jxMly^ z|G*(&4dqHU*Pa^xMBjQYV(=R!2e&siXR$rtX?oIQ`_x1Nj*P z>QjA@>(J`+tI=k7l5@l9`G=;2)6wCa8%eBr;y9Gh_cZkH z?(1vs*Oop3`%#i7`{1seccC97^!F8IoPF^sc?DJCJ zza;3Vbg3XVK2c`^E;wDS&8MsxQ`)k>8xLI;w8@dmkmJ*qF-RpD3O6ZCP`E+iY7e%K zZhR~fm%75&E|GS%Ha`@HhVAXPYs>U4T6dh!LHrpdsp0h0nvx++$MZ`|&KcDgYs~CV zODK$UD>yW!)lZ76Nly)zq$K!JSS~KJeEW)U7QSwpQj~ZS2}D0!-Bwv~9ex%$sC#mp zmmYczEXZ+pLu@#QNuF3DPbV7R)7~7m>d)gd<8XTN z#Pk7Er{q4|@o3iWiMnJ+TS@YRm+c=^ABfwV6}^_HHD@*S3#Sj5n2r;;W9{m2N%E!w z=KS)@M)Yf_(P8^IZhiyU3+7Fz*m}{9Pwjup}Kjzyhe3ryzug&LCEurmQ6FBeQ8ZObtqS+8$yiGDE-lJmc9H>Yw*xRh!nP z1Fel+t&xW1x~dHZ(9!aYEbQ{L%Eq4&u1scWdmFAFj*~taHPrRQbS_`hQxSs_9`>)x z!Y)K@!VSZ_SeT?IZsYAUUO1FGtWWngzgO;-rnU3Dbw;8lir%a0YS|hq+*YZT@ggdt zdy`)>cNQ{-&mG$=M3)F+72i;}8L9&|S0TS$PgKWbwmafqhjL_{g)0J%bhvWhy2{Z= zx+ll1#=@^NwRKsegM*ryJJwZR+`N3T;4G`{Anan8~!o~5>4mb`W|D9y9f zcUB=sQ@w2s$M?X;Iz!)%E6nqEwHygv5mSz$+pk}jbwxO9{Mv?aNm}7hjC2!srKfpI zKCwxUM}KIDT0w4;9LsqtO;+s8M*TJ&IH_up{ymt6GZ)%EN@+p>xxPuFcqF8b2db=yL1 zl|}RR#ufgDFDGfu$k4ngarpZCA7-C9FD)+N8s9ur`saP!FZJRyXgK(Gd zKyzGoF3{&N;j6yk$K&ds^{uO%wXSkD>nGQqpSZ4;^BAnTC$9b}UqwD`l7vpf^sKlgRD7WZoNxVBF74l~+&{m*0?_gP~aOLd6U3iDoT8?NvMf~}nxh5i-IZ8ieYiGD}A~MxhIVoIOu#GKs&APbm4L&^X*oc*_7^$a}ushUiik+Jx z%;(*{11)vEbq+0n&Gh8p)#1u3w?*123wKpchSda|4sHdi`hl#+%JyQMK)qw4t^(|5 zuozZrsN;#cx}UM1_gWXaz1xQ$XbH!}n97!w?DJB*AY6G(OQf!?@{7AFry6T9TvJ&Id=Q4mxjCQaF8ZaDGDuqHm0A z7>Hc5I?mpcrl3eJ=?|1*BdpO&`y7aUSSo7-n57(T_`m9Gf?i4!<>#_~G z?@sqvWX7{E*N=c4tGNBTv-dT4WFb1Ny-#p~tL*mcwm#=YIP_Ta-I0+rgx>{GFA@sVqN7uVc2)O*Dq$j+1k_WsW^Ov%JHZz;( zxTdP28%KWsCBeS+XLD!j6ko9aIy@OnPhFliSw|)4JrM`1p8009d>@x&+}zRLng(P;d1J}oXM$%2&+y8lW624=53v59jx=NU znRw^*>@(|fO`1Go=2eAPO`0%svRSi>OL?8L$9HL~5335^5qDD`t|~b2OmD@m<})@w zBa3t$nz9okW4ZrA$8%>eE|^d>G6^@iW;v~d3vf)^I_1)_PS^C>h&8=}XXgGEr-|(P zV$zY@n{VN&Ubqczx}l?KOr2MTFD6BGj_e7hHQb4(UF%xv);<5{4TCOp@V50Fv%_;ZADsf+F zMFk(}d8?OZ;~fs@No`qGXgNLt z8mdJ`kRIMdRg{M&U2}>Nq`(+uOKNJMv+%Z%yfrGl%|*rAv!yQP1Q(M_y#6o6&>~MV zFW{D=xQnnnES6FASvl5_^_Fbqnyge>dh>id$}IO?i^9}IpLdp(EJkhN)e;JZ+`3q| zg}C@cX-V15r&d?=5G<`Nslh9*`HNi%=Pj#UR#Rb1$M4J9T{pOwS22~#dd1r-Z(no) zf8R&yI+gN@@~i)iIE$CET4wT%T2BhGjRuE94w*aNsFY=kOUlYBs%uM17gn&nRb6nDV6T^gD^so?qvBmQkee7{F4r6pL3cUjG?6*C&T|1J_O$v z%J~S>5Y{2gWn}mp7{b6RhWG*1PKGeBpCJrz?tw3a-wiR5e9T{GSciG(3}JwC)@WcP z?*(9BmJ1Vo%`T*@w>t^PA5-z20Dq6<96C9OKXZZ^r`K)nX4Zq%E!Ueoz6a=FVa3k)#q2edJ7l(b%4^``gqbeg>C(Cwa_TWu`@E;P2144YL&#%5ZUEEK z4q4N>5Bz1wsKdTb>n8!MaX$lQbjBS3o`{h8*Ml`(&Q((Vo4|C`C-Xj#@i|Xc?Ql*~ z5Hi|vbCM8JpX(y<*ii3vqyHxOB9W)`>1ih;!7MZFaGua5!gqtUZEped*i+{qn8$|v zPcZ%*|BC>}JgC$27q5g}ei&+b*}k&jX@|c<*0N6ktIkBQwwY;Qp6AqG0k3WE4lv#6 z(q*3G;5B4i_6c;S)914&>NC``GmqNdSg)F&0p}-%nyIt ztjBRAn2tJREhCSc)=4f{(`C8nPM2;vE zus$`PJa_46lbjAun_qz+C43h`CPAG>c#V6vk*@Wjz5vEh z%gJ9wNJsl*J%2w0s}9GITIXkh@#pkY04y8r=YeU1oNsg{fJZ0tIvl+Oigo>zmlK4bg;Nus|WI-1r2F#cRx&j2tL$l3f0g>cLRSOW!RWafeL-x@iY zGWutY9GlK*e-gqLbr{ky&+1es9Rlhwr2AjhVSh+F4Czj1N3UB9wVqkN+3*?g|LtriYyGH*wI9v2X=6oUR z`RnGsLx*{|9P)h8zs=~Ab!-_1Yr3n!V@1E+=#y2y)5yuZt~393tV>q;#k^R+F+b$! zwFVp=Q-L)PbHI8J`&F>k73ZVt`14yv-UQZb+yh3w6|8yQ38rHn$a-$>Gjg)#hx5_t zs83e=oLr>&VaKRt%ws1BM}4xUJHg1wdL6mR$jLnCS%-~a?jo-#tVie{l39LFnupY;Az*;A1V7&&70@JZh$RUKZ z^F<>kXNvq5BPVMcXaeiG(+$=<>;-E+p8;!~yad*`C%{_9RAfZsrh)ZXjAaJl7?64B zna|6?TJ|r1wT$_qLtB%OnV5()nPbR?8CRz2b2CM!wBcB1*`k!g!H-hPChpcvr zjhxI)raRxr$*R8utm#&R**#Lf*63r?IUTF8|6!gO(lHO}{-<>=hhe70Q0siE$e8Xl z`0L=A=kLMOQBEEPPk9$SZBV`kUhVMSijH!!9`_f(s(%Qqb@dup$Jocfbc{>ZxbK1) zHv|4(@O0Esr}e`&PdyE(&vT3Jbo!KQ+)vBYqvP>ack1^VvUHaVk0)<;%H~#teqV9VPEfpi zy3!+xccUr0%_pfnF5ZoT?e?Ue4N$yqa?Ez2dpATO?=j-sh^|K^-mRQrx3%^>S-d+# z?EY(dHbC)ig~=XKyl;l@H?qk-AP(Es#k;50J(Bq76I)LfA3Zv{ePfR@DBe9;?GeSh zneBFaZqJ6(FOJzRjoB`X*)EUSu87&TX9M$tL8)>7{`Wt4Rp@c?(Ki~NEZ$vJ?SA$? zJ?`KCp2@jAkwK?^Z-jRUJucpjChT^4&ju*oJ$>jA#k*e9ZqMu4aQc-o+dPYVT)c0A z>kn1J{!;rv%D8=oIRxCsPYR=s+aqP0$5vXqJC-2{^c>-cgJks7qi_J zv;Ahwwx1ofIHu=*7i_lkWA<0b_8rg}i2fri+w6G;qQAITwx_u5FSzwZX>P3Bp5XhF z>}NR#;!VjJrin8Bl$h-yG2269w!L?~Ou?(Kf|&iYW46m;ws|k8j_Kbe+vEYh3b&po z_lMvIqCeUr`_tX_RNtR^ZBO%^f#XUy(D`fJ`k35a?Y5`8`#x^dF^#K4U$={5w(DZH zzZ9!I6 zm~E~-rjGmHjoIdU@9MaJT+H^InC;tRw!bCY>}dv~zt{UTZ@b8Mu-E?CzJJIz&+~!k z-+8a4j_D7G+0KaB9v8EHwQO@dG!WN^1+wjI`ARXf(6jDsm-)8#+Ahb-Bz!q?ZW*TK zmw8xSvt-`;x}4KmR9gPEpB`MVtneQx^~Ipx$~=U9qY;X zm6*9vjo!BKtB+`EV!mu~kHq_h(Ok@t$1j$ao+8KmeEzVAzq*-QRx-D&G}BF}M-tVU zxta5q)|6!CM!yN8g~HVOnxz$U@%bElBBr*YW^u_ve(1-3Y6c~ApUuI~fTGbwhWY!L zmhVH37{n|vSNm~aC;G?_5uN_CMW_2Zk>ugj&+eca=Pu>fgsLhQR#(*Y&KJL!G*?y- zz>%w+dun{AQifkX&E;YOr-{x4+=>FxeM{z-yGqhuSNR z3Js?Ewy1$cgJX&u@b2X6ecQ-=3Y;q@``yS z%NCwS!HaxqL@~-=tj!f8AE{){t5bD)eOD=(uil@qy1Dl!t$OYJ^qq(pE1kMXT?96xg6_-v<92dzsWw)N*iy_l`TbAAqz;W#8yP9)1UpZok*@xSQE z?XS}jIrpi)vvV~i-g6d}bK5VsW===g*%9XRTGip$Lz&NTl=-Y$na^mILxwXAXB*~| z64lQ&%=-eB^O?Q!c*FUI3k**&Jk9WQ!!r%@*^1hqL;fQE!4<!3kEo+&&CBe1YYwKGMs5Rn=ElzHG011lI7lKESW#BfXjnd z`FOHCqRA&qJro!@MgA}0AKWx}e~ClyyLqJ^&!oJ}z=H-i2VUjHQ?)#8o$_Kw*0r_9~?z$bEV-r@>lT>ZZ*8> zxb`6S8!2ZbxF&ejSx@EzD!68Nm2W1CehXRZXN%#jWIlX{+YaylxGh7TG(M4p0waIe5?`+0*b`8iCMV|s)v z$NDH);=XP8xY0jBUWI>je*B4@K4fXbZr4z!;r{tQinBePJ_!86iR6eU50dLWP9`^a zoI+mfaT-~4hLG>_DMxt@LOwwzUy5*qVaB1HT~H<& z*9CSpyljv&5VGqhk4MPgBalZR3>m&$n9u*dAk4Uv4PP%@jF4{-Xy;6XD2Dr%3(I}4 z@K%JM5xyVc*@jss{Pqj&f7Zx{8+PTo7y>wQV2VRme#WKEE8xj95f&JpMn+s7L$b!@ z(1iLt=Un}OtH7);waM;}yb>W#b(Pl{W>cX3M1YwhL@Tz~0;TB<3mybo__Z!(P zc|6EWtJ-h^c{KjPkpovbbiX^GK94i&jyx9Oa5D5+UUERjU6)Y~oqU88QHOaZt4()I zp;HT)JEq`q;Cy&~Pw5(jP6u2AW*I1FdmKn+gM}k&Jq!XyR}Ug*o2DJ+ zpB%Uv|KM0`+9^WFe2@ze&K9QqxrWQhu){KvH9t6#O&I9oyawv$ zf}a(}rY{)p#pS#N&Sjtu`-JHtr_CFMA4Et!>ab01Fgo`Mzlo4~)X9g=D@KR=C@+A# zKkSlOhr@)YfcY&H%6UFb6P^w(6`l#M7iQf56lUD}g&CLMEukI8)~@`=ocd-tNtX)5xSR}qhV-hx(CD~xU*g^+`c(+Y z0X9asZ^NtoR>KdIVW0NMYJa!U*=P7gGW4qvk^|S`AKdHkYX9$sd0nG^Eo5Z1AEaFJ zJjn0`qQ3(AWVJuW=imac{tlD*se?XQ^|{8m>hCrDqUf)N zK3Vl&H#&be9FX%O0)29TjR)>5%B8&NhA$QUM(B_OJos>vMBXGEnBl~}t0XSl(hSjA zk6mQ#ORGfQ3^`fzTur&;;cLSD4f_URAI_~7VV>*!b|LF(GwhJn&Mwhmztmxvzjdd5 z+IfMDxGmTuYuwk2{!zp6h{L$-Kl%&1->{QmXAA74g4NFXqQgAo7`{^Uw?dyBxE=ua zMbY6LEY4YFTAVL6j|}_Up+i>t3q^2YA7O8%jCqZ6v}mqO%8bvf96#a_G?hm4;^ubDr5;VfLvv zlabb5*deQ(TSSL;ZWUgM@HQjgKt|mCh)WL40>FJwbT~)tN22o-6A`kzVccYdZ2DyOrF`r{`;?Q_PC4b!p`9AT z7+U#KQoV798y5+?F^TXf>RgI{aA(4&q^7VMVKQ@8yJc?9o8kX?n~id6OOF*hk$8kB*Ks| z?YMe|ob}<31qO`F%UJ4wuSDNpDZB(>tMD;|yU0|Adjy{Pl>c0KGUEQ;$lnnD3&Ot% zGkOm67mQGh!Op86RGT|GmG^+XPE@B-)Vm7sGY*o`;93&G{^ zjLSOaHhB-idST|jL706@qmh4CcniYs3$I6bKN)!l3TqyAhz@Pi7SlS6km-?GKTjBT z;}FQ7f$YDH+>J>fe+{y?L{6LkG&;wHIk)e9BTth0CKLjojIgjaAg;}?qM*b(!=bW=M;Te~FfiSPhZp;t)9`JvQJPy}^w~Wq7Va~6* ziq{C_hiP3$MqJL*subpR;a1^f@NW(Ofh=(cVjtsXBFqxL6yYdgUQgV$13HZ;$F(AV z2w}N!8^Se)-54JFPe68`$T=U2zujS4oNM(M8F`@FW8{pZa@YSupK0Yl&*c;0XkpI% za{VoIcu)TY%3+gjhOGC4U!)v5?1QHZbKYc`a3jKb!s`&u7iN37oeZ07Z{z?wFgSM( z!X|a@fv0^o(T&0{AZ#HcF54kFFbDtOw!>4OIzJYE7Gb;LZZhIR%}3V0@qp;C-99J$ zLxi+No3A4LgYbt4|7`djGHiwrlGWx3$`Q9O>cj`Hc2b2ouQWtP+)SvDHLg1!5tllg zw@aOD=#aIpIG>9)nP+!yf?5AlMW4r(tj`wQH``$+7jkld7jU>a)JNO}2&>7^84Ec% zz>5Oht)jCU;Ra!zFW(b>5aIp8oag#eGVCyKWKC+l27VLlm$Wjq4e5Hjo+K%cDkhlvj7%Z?T1eA&x| zrz8A=Fz4D{Nrs&%utN@f2>|y+qjSA5=hx0L@=`M5PJ=!9BvK9nS0hl`zZ5 zZOYTox4HWrFy|bjJS{b7bE;U8Tn)p z$l4D1yG-h^Pc9N>pFCIetDsNTJXDAd=L9bnorTaL>+y2;JFv<5!7Hf)Za`Qsd^bX_ zLBae~BQ9Cn^Sz?OdBZ;vom%LS^_aT*9mHJ$Ia!aX`%XLLDXfcK8&?X@eYCjDK(=;3*FZ ztK3~5Ay0;!9N=IWj>VvUim=KHM4pC_ta5kVgg&c+tnwScEK51UFB$#{8TuiF$U?&kHl%8x8X}&(!%H!XFCLPNy*Q@VqdO z5r6Yc{lDPGjq^--j8HsZKQiQ;yUBNDWbPj++<|ba;Sw_9@_bn=@>+zPLrOW_FGS9? zjv9Fa@}W9sk&zbjcCj$)aJ=D(!qj2eG|#h)e2FmIYQ)I*8Tp?K9}_M`$oZJG$@A;D z(ec9;)!W?49ok~-{*rWiTf2jx)lU2Ehs zMGmoVmXUKFrP{ekM|8x$rC_^PVm|93eze`K7`o2+@T( zIs4r!$*><14%7hP+_NAU;P}V&rC`<-x2d0rkQ`Wme{jp-nTOjEx_%POd9jU@Lq8iK zIj|J};MT!Y|2~B7-UK>1!hxFsaJ%5C!+Z3flA)6;toiH|oo~KAa?~6X)SGfBK*qjD6 zveqr{8JHHYQRDy*8l1b2fF0gP92T9Kkdw6@-2DP{{t2187l0kM1#(~otss=^MKZ!n zGIZuZPF6c3MduQP7YQ#zSV)F`G4#oS+W>G}Q%&pY%c4^bIazhejLs5a+N?2h_Z$QE zs}Ps0`T3^kv>;qZhR#ChkhR|K6&{>Ms&G+v+Oe=-3`QwBIQ5bqK#DTnqX4$w;dXX^{h81;E`eI<)!U zqO%%uvgYSm(K&>WV|3byK!>b4$3*8iLOx5P4*MH&fCYr(*q!wgLg?OE2y?tn{U+#; z)h6$YsLyv4lY}`ptWcQOv}?$SyB=}L0S*-5-1`f}T@BfnMW62?77KF>vs9R6=er7~ z#ku>9!o1FWNBFx4n}s<)%DuCIekWutBImp4dxg3F2e)aH>ybPt%y$~wg}GLTd*1;a zj-hsmoNInC4&!n>^)q3vfzd6zAK|Zrxu(d|!p|XmMwn}9aGQ2sLimF4Sd{m#WYk+T z>WZv&{%kPEXMEII8Tvs`Ip#BE1hvc^4Mbn*~>PMBlk0%5MvGJ}k`yAhYH zac7GT*L_(mIvvm<2kHQDw~7wWqt&9b2XeC7St~kR8;0pI{~UM!K$vC!85w!li@4;# zowV-r{YK>bg#%$Hc4K$iVcb86&QsV$)^z_$IdqOA z*0|ZCGYa8E(K!emvg%9`9j*=YWnqrx=aFIa5cJ9V9B-k~xmB2J#@sH*D-TnD-!W z3G=>&+tg>B|3jGfKK~NtS~cI=UsnrXhwvI# z>dY0cML3U)vL9wWgLRznHIW~IoUG%tddiU&*Q#j}-i>er8Fr3BpRC90dq(G8!`lo$ zB+RvKeoTg)w_%5@b{;i4ouYFbI%LiBb0R+hIXSQj0QY;!k!P-p^SbExF!m#B+`owq ze>ZtjnCsv0*#YD7{%(jc*R#nI<~>CY8F}XO53)X2;cJYPeCEJ=CmVnr<&+6M+)F<3 zR5_!iO!DMcl1Jd#Hp1B=$EC%s5}`VqM2F|j&xM~vc)-Y?6Q-TN89qb!7{ap+rwQZH zqIZvmJdm>~N8V6nj`4wV=PsojI?MyA#_0rw1N8v7YvCC;Svb%@DV}x1Q=TFmSWBrq z%Yx1Cfmgv(hxsC_&2Nf)2tsmzKMI3e56}FtU%glOS%kbMQT`f2cfSUkAz_W{?!}-( zeU?Y{e=j@@A^Q%>S)XT;N5UiIvGHGke{d|nGWRJnugaN*a}19)Jl=4DVdg{a%rrd5 zaJk`yhHDM4G`!kyqv7?2HyZ}}{1@}T*Czab z`6O?A@0W9vP1!H!V-p!|L!Fi}NV$~Jl}pO#j-!;(l|{b>JKJ!%Vcuh^&Pp;nTDXYe^@dvvZ#Ud-c#q+y$me=C4;kk31(ow&QknOV z%0a`tXHxNPd7ZraFt=c<5Bx{h8qnx8{T4g2YHBB&$|utzE0)5 z4^-xTobnOF#|`&M?9oX!Jj8IeVLmfbo4j9Bo@RKq;c~;(hF2Qq`zE!s-f)ZI?S|V8 z?=k$8;X{TG8-Cj`CxmFaLBnZ=d5@$zxrX_CQ0090q|EzRW!|4FFEqTu@M^R8J-(xT-)2Q*>`_??X|!C=j^l3|CL^YpEvll!LJ#7-r#JU2kAD-GkBE2r3OznIBsyI z!HW#8Gq}m%^#&&l-fnQG!H*bxz~HA1e#YRJ3_fe{8wT@2E_9{8obYg`+S=+ zgUb!BAddMqRR&iZ+(=yH+pINsqrqE=i+!8j2JbQW34;$CeB9uZ2A?6m%I7?1@LLAw z;AVl^@LNX3F@wh$Jk{Wt2G2EkvBC8Qw;0@N@D_u27~E~}qXs`^aIeA78+_W}*9<;y za5gUTwZC}=k21K_;K>HZ4X!kJk->EaHyOO%;Do{34em7f5rYpH{ItQ(82pmKXAOSC zV18hreUBPE(%=$<%M30zxWeEngR2d0GmXBs@$;Kc^l8{A@WtHE0g-eGXJ!H*jJl)=3QKX349gI_cF zyusPHR@OO?XYeS4OAVfEaNOWZgBKZGXK<6j>kUpAyxrhVgC8;YfWc22{0#9J|5*Q$ z!DkJAgZOISh7Sf5M-3iHe2s5YVsM$k<;2(eHWda}8C-2}qrqzp-e~YvgLfOe$KWRn zK5X!DgHIZK#^7@Xzh!U^?ptVI`0Ze5tlzJg!Q%{`YVb_ralZXr;_*ISOgzEI^~CS@ zaSL&okG%=apIQkosEAwW4Ha>{qBYAJYbG?pUEG?Q#tF_pUeX=wguZ#|e$Mx%Nymd3 zjOaPfH(0tVkl)9jo%80I&e6xlI{qBM)UOua?Ut>=KXx|03kN7?e0~mKnZW~SdWocu zL20(}mD#@!+H{J3Mqr?^%;dpyP{i>Z4(zKb%Jh0uJ8H@zu$Qi8A13sfdE7s_YD}Ck(Kb7y9Sr(mF?;Y}$c*^~D^0FK z;(A!>A4HjcR|q#geS4R332e4NAG3^WgFhsH%BqlIsQwh13l4`r)PpctlI9rrLZcvC zukV`D&)BY7fj!6_YBC#`)g-e)ze~wL=4tE5K*oI+kpW7eQ~m4?uE80$ZsrMf!NEy) z7ppa$?`c|&aV(DsjKr3-MJD{C&Jv*S4das_aboI)W%T{56@Q~hI zGr^oMV2Q*4W)lgaqSt*WHp(Up@c@Jk$bDSTgbd+M7h zmS-Nz@zJ{Fi;EtS6XoOMd&`$Fe0WrtZ;oC~W(l0Uw_mH$soc8A-mc1KakMA%Ro=q$pn}G?s7CTz{;{hg;)GzGr|fAD{PU z>hF&NeA~fS0v-8q%Qea8-Zem4w=drr&^AGx#9`6Lse~K=AL}LGMF=dzG`~;7Uy`p1 z33)^WZHkZIN!b2A4ZbSmlMlCol6-Xmz9yu%AYVn>x+K6ia-QejXCNPLF(mmO3h=#! zG#69GQHzn~l>Rm^uHh~rd39tB?%G5K)mljQSI9;V6h z%jt*jj{&}?4BzF3kKgcFzGy#u<3%4wSxT?r<0D+Qo$Xy1;Nv?Q}^VJrBN( zFk*jotsvjJ0AD%MoRccb$8R-=o!k9_XE48%I0XJWBX4ycp(p#a~g zg{keq#|z5m-rF#Ie77PK-%kR3rG~G_@LhuPc6(Iz!^ihOSWg^*GTHE5g|xPh-*Z^L zxk#6|68?|2^@adn9DE!*2Hv7jK7Q|E`C5>+!aPc~*lBiucFSSF{c9k*CgIcVM!sTK zlmDar_$2hiamjncj0nDj(l*v3v)>R{;x-%Q(aLXn^l|r0X4% z|D$~04Dfj$_1}XdA8$Ws`}iG;9p`dnJd%O$Sb%RW`1tM@`N|C6*#O^J@X2Qaj#b#Q@}E9TdI~ z@)IgV2pKBHPUpcBIGFOA4;6*C01(F|W8_^}vtY}5_1uB=x_5mLYrXrRoG4`&X}vo^ zMy&OohTW%)oz}ZOQ19s)&pQk|*30=tJJ!qZZ!BLm4w6%#S5ZE`H$)tljLzEBahm5! z%p)JSC;74vC>`L#W8ZCI~Lo? z_Tw!0xLs9fM;QY<%U7|~=OW*91m&9-;Nx>W{(mtQ<>UKHmhTDh@m)Xi-Hf1o`oE2J z`!2)DgL06Q)C}&uB*Z!{eE#)gW2lhd#Sq64C})@9J?b34-q}bqkK>XJBJwKV%mUAg zA+4f(?*#bHuS{)UZWradCcwx0)I~}rc1#w-&bDvVs?>SO9I<2jJ{sWTJ?%_<{HDh8 zO*VX$hHq1VkN3axk*}it-4NibG<fbTH)HY%CeG1(R1s{~sfA14M-H(RjB*?B; zY&%0&px!v_{u6o?9ha{L>McjTd|#O3{BZ=W_vrv%dCd1=66E{)0N-nE{(eZlyA9vJ z37__3KKNe2F;7MN@wV7uNpUi{#6J$Io%Vz8rV+;_<2>p;2h4h_5wstpu||+v`CbBF z9?~kxcXPn*wSMeA8L)e+AG^N^*hR-=uJ@qWl}Up}!A>z%IxgRb9lD&9O4vt>oc)~tO$W!X9)WpLgjWK5qptS6))B}MQNB|FzT+Ex zJMuLkD4*RHq}a`aDb@olzwUTQJ8mB?5oUULyJz8BRx8z|g$Le9OkeYZiq4&f_a>SiifyYI(xz=aksJN@eIdU=3y)oT zVBWrArPIH=L0Y)si08eX`>W8Y?0s3uM!)zUwk_v>?fSNNPurM6_U)r*BS6E}R&3&Z z8xI8W=VN|Zw5#wn+pekqj<0f8Xg6^97n~vs@ z>%hD{(@)7Tcg*=^V&47JvW9-;ozBGJ_IZivJwvMYCVZMC$(w(ijS~rQjMy<`_QicT za)0h~Y)*2FDagc;qb2>WbZq{aUv9l$u5@1PYlp|@jy}h^G~L^m)zi5($`6+@gQ$e= zscl_76~3mc_$mc?3f}93J;hrZ4&?iIf9F;m_R;6YZmQVyhl@hPFZQOq>_u~;@7;?HkG-{#?BMbG0>jt(#*D58M>n@uh_yyD8QsV}2+*T6pVke7@Sw)`wrNec>k~ zj@@)3`%u_dCVsQ_<@Wqf6>q-pxz4hlBjrv1E!K5ps-L&znATr|PvQT~OT4_}H?0pH zexNYC=_LHg%`d+Q1r7~M+TWf#qA--K8f6;lhQ5T|1Xc9(jNE)*V*a6Ft@j^ppOGxF zyRhxse|!I~>|1M(hP>Jrf4XJF(C>MP+AZhzWudixD{5bOanms`I`_d$11~3j)6-MB`N077<%@)>`=Jt$mI5k?bF-m`K{bic(l-~cs6k)x^nZ(o+EjO zvSFZELkqlU{efrOCnlzUci!f&?0h!5^MR4WZhdxk9h&Do=y^Sz!+qO@oBv1oXyw=9 zv$MTarJ|fu`{KXOzSCQa8aLm!={9NCIQDOHd#L@A_M-L&+y6$4$8N&;e*LqF$I!Ut zw;ee&)U@sBMQGcOOWH$;XM2v6wig{5x+_7BXQgaI+p*d$BhiHD?L9}v*`jR1(d)eP z;NASrA4X&iz24h@q-0;{^_olkvX2}*`QYx~yzS8@^6In+;|IRI!4z0nYFGN|)`bEXN674T1^4Ih< zZeH-*k&!2c9U5XMTH)+G@0HFi&vhnxIyb)h%8Sn(>)C%~~t!wdo|gbkZHY7?pl>vzTvO|3(R!Y8t$7eCkO`8-^r##3h9F*A1atoc>9&c5~L z=~c60^JmRlFze1Lm*=_P8MAJ=^^O5-$a2T5j}BnvGhNVb$_6i*8y)%8+_D{?i|_ed z=g!!tvljkCPOSY)3+r>{d@hn`%kg&SaMjW=9iKZJ4?1wb@H=+I^B%(`<&jYz3q{}a zN~c%$&zLBAW)1m|@wxZxdarLLHm9%;OY!l!$6x84x4$SGhesW$Wad5jpPwCqZJV^Uc#@rAybWZf9|6Xn)6WIK zrL5E6OC^N%#JcT1WAwz_Mr_YljGma!xv2k+(G&ALl=^=F)@}Naz&hWa1uhYr-vLwD z24e0PEK5I~6zYk!Z6l1HxCr^h2p<3@744@27m9v9Fok+zTy{JAwMI{@^=>tKVqR7k zBOC|TzC3Geh{;Wxe=&Mu-lL&Df{tt3_}q)v+SHHcfIwKDn8zsUuQ&FSfw=@x{~_Qk z#I%nCvpr1D0;W(;tn-}D$`pUx*br;kYNIFSIFoY)FmC<1dRGH$`}rKJRP=o2L}9(e z6A-hVM}f7Sy};Z*sechz+w%Bj@wk=IS8z)4ME3bJ22k| zp#EzJYTpga^A762i9pFz?}ggtm-0CkXM4X%yPpwuwQDZ-(Y#awDC~NZQiYSNt*;Ba zz1`+>OQt03yd~Q-SF4nSv8P5Q$!(D3_FS8flMW+cx2mNSVYe#UbWth+6m}z;QiY+h z5_Wq+N)vXYZquAmDG9q7Y|}g%q$KRTkJ@xeDghLBt8Ypb_O40Zr{u9NALBVYmF>31 zM*``(K>9O*^tM3y+kx~C0_n4XbT%iU2xmh~(wwvT*i)wj^63|pG6NwW+xyNy{?b6Y zDUjwlhYIWayFi-94i)DAGLZg#AWfhBDzwkXxT-LHO(1C*lb0;zP2IqMnr~jSB*R;k>8}XF#=VW#ys8Or61FT)r>I-C1n(v`rz@LR+`|{3 z({u1rG~Z(6P04g?+(cZ`ykgz5CH2c1o0hFfW=a9vn`~URDyemSVS|>)ZBEpbiPf3# zzU30$w#-nR)w+9^>3J9?^cOE2;%)8bWr%8*)wMJ>FVQhv;@(qLE!votPD|7@ubSwx zU8n1o@YU-jjVqd4mNeJbG&ZijFG=n!o0t8?y~|cDU6#(cZrPgE9Gsd}b?F&RjWsRH zSFc&QL@bhIOUaEby=>*urcWict_p5|mYRF|DzRacO4rjqn+iSkrwWF>>E2qtYR(!~ zHYLj?YpBJwT2i}uMV;I3jur1?XV@I9tDmjGtP5{v*U;uA{cLIG@>P7@Udg`66wR2C zuH=MB?j-$WCDl#KR?6&=X+y=DWi@q6YVTdX+)i%j()?;ux_Uig`p+TuRIf1PHG|RbNKT3lIpO=jb=> zJP!)R@B`twbqLE3C61tFXBu2VT#O$`C4$<_CBBMU|Gi4pFG4!R20|7isGjK%PtHU_ zY&gV?)wMo$V>Q;tZmh2Ju^TIP4&ugYypNr|oE|v)F}~i}^JEy}?BDNWH?|xYh#T8$ zd>lg*61^K+(X)x6iM|c14~d?pYVXE&l5gY2_Ie+?u@%lZ?WL?6ThUigFSwGJWRSTC zs;@HGjjhJYSSJ@FK3{byC`m#qou5E~0=K~SG%Yl){(>-%O_zih2Y zYx_46vvZIHg6g*z%)F4?w{cib(Xy!*oMW)tcB0Rto(~!!1qh)JJLrzRp}3FTwi6tK zO6^OCr{hON+rVore&^TO+YR_|5+R*-PgYlY+voA$V9FaBTFOAJcgZZqN{Ny24{{L!h_8I&`V%V1< zCXUEj^iRg-l)=9xhW%v3#1Yfk$Vf%kBIF9-CIx+04 zU{9=d(MO)PpXcwyVc2_|lQKS+6Qk@RsEH$-Y>?4n!@fA*`mk9HJ+bnai4FU5gWwM$ z=Di~2=aNyti+2cd*8|C!v<~89fu=qJcLUm_1s5^BjfP{X+hxk^lZa@#OMU?acmU) zD$e`&7#p|0h|LRP^D^R}3g-P9w_k`&KDP_-GQ@mGmzXw{2CpQRHmngn+u;8HBJ6oj zaEIuJVeB6__(y`P!O44s<=IU= zY#u}0MGTt~!4cs(D*95y#1T1nI!-;xzKr-;!My+elF|QM@b3}7N(_GPZp6yZ?>4As z*NC-kZv6-U2vRhHL-F#ikrt#9G%< z>S4q6-mU*=PaHPH+Rm-Cfqo|R#9Fq4dX(k8`)`U3w;{3GJSH~ZL5w#9oIUqNzROO| zO4t)e*g?oCvEhFGs@Tkho>)20i4E`XzautPupw5PA+ithUjH~^)Wvn4SZ(;N58KZ* z`xdcT3>#v#xm|2{ufJYws$oMMk#p2lV#E9X%?7s-qh8KmV&zPT4W9>e2;Pl&r(o{i z-NYzckFvxOo)kg$iVdF!@V*e+&u0cd5X|Qa?tdjh&voFRMbCTO?ti5~e+IgjMbCTO zuL_RB{kgp=JEKkD_x&O0{ zC~e%B4zVK;j!TFqUl6K7I7gze-66~wN(>>y4nj&1La3Kgh7cOzp!-oyj<0e$9^qtL zmD80KPEHr)tRNQ7D&nE|fm9QS+<=f)gSQyW^G3DlHuzCu*^hW_qPW-K z=M6q>@M{M18br%xWBpQ`XYeS4OAY4vr`pF2t~8j>71XBA;3k9D8_eU5+HW_w)8I!8 zK49?E20vr)O9r1c_ziiz8eC#nzCCA-eGXJ!Ol;&ly!c(1@{^o=cilrr;YwKgU=i6{B(=G^V2QZ`RNwy{B#R; ze!2z6al=c;ncul7c7D3W#`)ccC8P0~w7zc%iP!vH*~=MRJO*p&8kWH8hN^&?e(nkyE1 zVM+JEl*#LgJggkh>5AA%TQYcfaR$i&&1@i}*-txC{m^k7Oso2qx?mfV=CHa@I|g0# z;A%^IH1%h5-V(#^ghRG_PlKi= zUDC;R{3-_(ig{X097mw6$B8z}lMjcFBwszSZQl;0c@C+fd`qFQdv}(-jaM< zfGyvnNb}rKMfvWB!ty->KAt;~Z& zC4%MSIbbPtD$4x|6t;aW;N!V3+ZT~M@$*myAx0A#o%wxDu>~#J`aZaZ1ztU9u&ikr% z{LZ7lJQw2l@iIsI>&};vR=!2ZkjocnQ+!_v@O8%gc}hNB9w{H60pKsm*NBW6NUP9} z!siCWaV8)KV*Y(+@?DOgd_NXG9hYw*Lk{t<^6O%KyeDMqJpem>UypX=qvXJjIL-v5 zx(L_7nDDF@yFjwu@&MmyY{X3aCEqEveAytP9r-ZiNxr*7eW=kthl zdu$n=dbf|Z+KK%m&V<2F??-M)jAH26jUghKe3CPrsuLt_Iw|BFRKB8j75ZtH#XJEd7itG&dv z>)-6$Q}%&_S(}!4(-Q0V-hVJ_=-uAOrw+Z?yRCiw;txEPHTz@Uo{{VS_|5AdJy`aE zC$ly!@TTpZTCx6*k3L@Z(34q5=Xr_xz1J_SczgYx58xA_JG_ryzvJPB|8{=;p6Ph6 z`#{$0InW#mM+-M#>g9Ojb7y?JW5ivTOxxTZiVi(mg8gdP)fKn=Vo`P^u}K>?d!o1K zn%)nb8geL0KeoI*w_|Vg1QdA>#(bu`b35kb_6}?Nc5CbL*x|!1n=qfe+kTiFiFKb?hB_SJhp6*Pn0QTz1dYMQb10yL{mTzdtcFWq~rUW|v1z z-5m|#hPs9~&;9)HV^|!gzxqn_qMpvM->yXH_S|cxUU8ID8$)n3+q*q?6SgUFh#1T6 zx0By4;XipJV`#`X9-sYx_PZE=p84~QO;FMIqIvnleM~Nc-0_l_$K_%Ko|~~8kE2{u zxxZ77E;*r|nENdCvk+!J+a#Jc?*SlVlD~f`CDL~?+`z1Y>1Wf+rU}K zXW7SqwX7avS@wV_i)5Nemecip_nT}f2`7(0zOL`P(QH*p`o1e|Yhzova;7Alc64Vx zd!Ldpwjj45g?-A$QAQpwIvv+yZc7!W7i$7B)6IeOmO%Pzfi%y7RaoA=3oDCr@~u7h z?wwOE!7HCjnrl`qp+m~mskcs-$~%?vR-b#-(J!#3=Dy&&eI~cho2z~yz66_kXV%!; zmor_f*dFJ_mf!d%8|Z}@aYDg;yj%1i#P;7W_yFQ_g0F;r zIRfpuPkfdbJlvPK?@~{>-{^S{S#7w#YF#|*jwj1b zN6c;$bNtv(VqMdS$;YuG=J_J$H!=D6$dI@k@r_2$HIMq+5LXyI&ylFV3-L#deyQLU zh?g7vO2On?BX}+1dj+!%+)m`=8og2QX2kak=9p|H#yE3M5l3XF{fe>KE12u-KEYgz zxh=`h{q9M@+-|+Z;N(~mN92Inl< z@`zCvw-K@Oj5IdIViSW6aYW{Msn~FRpDdVjiu0BHdtg7482sE|g7}hR2dlV%U_yhBzYo9g@jsE*5i}>GK+nkz%%0F}W0T zE-J1tm~&6{)dn{j%((Venytj~jf_;4=oFGx#lob1**2Utn;| z;Bf{|HJIB`%g!~J+e`KJ2Dcd8YVehqU#2qNpY1lD7vnZU zz_fQV8NUoF*#fRWOdOZ=I27Q#;xfSU%;Ws#I%)apk+#A-$~**OJqzm3j%#bqAnX+<(mvX+L4ck80DiqD3TIGMjXmKXjmWZh=bSd)i@#l5%elrFPCqo6u0IQW zm-h+&EN%F|Ov-geWx?o+y#=GMg1@S~4e*#6E==5-Giv6H=X2&vtbG>#F`|(h7wR2` z-ZhD~L!qYLFYS{H`Odpy9mj@ubq+z%(>dPUCk~$&QvE{g;A4LJ?%aj14qLHsRAt^{ zF)f075_^Xt`%tJb(NpS`eJ$qOc8nb|{|5zkHM}&e`V4Owygl^Qm!lU&%V%T4<4!}! zme0bShNPlnSEykbZZx=3EQ8w&T|INP1>=W|J~w5$*9M0-@BMVviR}BoTTp)O13SvM zWrxah?%z4NEjz3H*86W97d>^|aqA1DqhZL2+}m@lYSj7{Ud-CWoi+Nl)ps1sqG{RV zG2`o_qaoDOIr30Asp^>K%_$zcm;O@Fp2g8}Z)LQ!J&O)jpnqgiS5Jwr?dmC2 zAiY_9oBDHc95=EM%G|hL;x!Vt`EhYiiQ1#NSw5N6U))ownm&2SZSv`?Q5Ea=pU8!m zl82_|KYY*rA7&@>qB*T&Z}#hfQyG}ie+dk4nHs&dq3f9TO#78Ax2^MHG^BG~?15d^ z$Gc_YLv!D*lIU9)!mge&zoF6B;P9v??k5)SX`At(wi$OsbH?YmzQbFRZe!m`7RKT2 zVZINQUky#mTQHiZj8kg7uWX3!jz;!{KAqJ*(Wl+=rS<#UIzP*1mo`5Y?x+jFAxx<2 zNYu|BpWAV4$nCkavB9&WqYj0B^k7myCwtBur)L49Kj!A9Dmo5^=JXtU^Ob-4!|Bu2 znAESnd@39*@A{!^PuUjxvZ9syJ3Zxg{iDCH*60-}-Gb5YVIQJ7?V+~m*=^tUUhiye zJK6gB&wh6Q=WhD=hUiy+bmUOzuO4hKnlz8Q7xu=tb33MGwHW%-R|m{@cUwr8Dd}Mhio=36}eY zd^P*-;X7`8Xy^GILzb`j#mUQh$6%L~nlWx;hxJ~TQrwi=v1>@Q5z9dJH)NCJe&M>} zvDZ&qcgvR_gYP3-wju2HZz1crE32(&=DIbn6vferb#Fe`i5)B4)hlDTDdgdf=_YJp zj%M|yiqNL>GeRNW+l}Vj_F(i2J@A|rYOC=kP0xGy5`SbcC~xQfzVy}iYM=JQ8~%>VJJXvOinj=svpV&t~&rox@=;A|>P9N51n=eh36p6WhT!-8$y>*sE6&D+`9w!)k7lkA?7{5@;RjvrPp zZYcHYgtn6W-feJ&*H)L`)?KmrK3DlL8N}|5g^7oAVAn9NrzZ|}$zXlg_4L4@nQA)5 zj@{PXy7%)Ogx=vPJuLT@y7nhITgcgQY)o<{;`av~_RC@uH;QVQiAEg^7R2*(dv` z8`MP3sod9l--?brcm7K*zc(j(ajKq+6*ePJSzvw3+NyOYRi zIMCMJ>NHQbb)zwfoP&RN5IWSpgH<2=Zee0uN&eZKw&C8v?;UKouYTJ6&epPr56}Pc z3%@AL+O*1RJCfIRGCQ(!TSI;{x9e7~x3;Uh;tCvF_U_TG-7)9AS1g~6leM<)MZL9$ z!mSUsCbM>34uUn^734s?g@);K2;l1AklhS~u{Ix7DE- z_K-x*{<{43&?`ssUN6aeuH;f|^{(!jd%u+&qJ|+|C6}BSTD=#OwW}`Q*EcL&>Yl`?7vD6n)iw=oF40q0XldW7x6KJcy4VLvLr7{XBN;`+l2G<&M7yhtU6nUcSoE zdrE;Hxhn}mUQJN+L_8Stih~j?r}|NTc9Ku^yjr2e+%MKbi4ziQy=+%VbgV-$c@)!D zG21r~wq^U{v^MO6a$3E`Y`@yX47PgqO>JzOq4xBt(N}wEqYKb+n&{a4iD$>kxRejd%+JZHWKc;H|)vOm*?4 zZCbGy@?F(s2tA@sCiOvz-!HqnML$APgvy`nwwNYO7u zOrf5bd9>e-pd1|r?*OJ`s+apR%P^+=sW#jn$itXI9%3FL*f!o3)A9T`FeOu6MbMLn zG4olL`H+Dt%b7yRE4tNj6BoEtcsLq^Xh3R?EC!9Bo~Ol_MAJ_`Ih|N!N_XkPGc^WuZZ1~kK zg>?~Y-~R(xIr#>=>VIeSzXv8~F~WIZ?IYiEr)28m6zExovD$OprC57k!(X;SrSCK5 zYc$Kn;j}jbdCQA)Athn=_Ki(n=f0<=<|TwI@d>XMVXPb4I%!i| zR3=c^ed(G~h12dlGyjHErnBd`q$KSA8;?!%$z4jq?n^40mXEDO6?XrP#^z5?C4j=- z&4Ki+KpL0XM#An1VM-BpUgvC@b2ueo@AgyzDC~}jDOK2g*>BVHQwe8(XCS>Gkmfp( zlCb-#)28k0Vf`{S#iZ{$2zvbU4f?)gfSb2Q_)dY9zW(kmvDv8IJU~NE*u4RnG8x#P zoxOX=@}pCQ9Uq?xrzGswMVr1Vl>qANFYc~DzOKE#I-K@K1j~QI9Z|GU9>Cq2K+N>L zf%F#x>0N>JV}W#UApP?|8n+vqjKFU`_Qz3@9_P{%y$_fv!1mDpg$mPr_DSKE&&U3{ zJuN*s=`YUDzrp+0w0!KZT+Sdo3g=^gy++d1k$+}d{*7LPq`7kBWB>iDfc@@3`tKxN z?CfvyUJT^FEa|x}|HEFknc}RU{y|lkzEsjY1IhQMd$!IP0~Fsf39~>(mZnJ zdv|&-OPWWSd~bpG$3Xduc&HK~-?%_}P9VKJkp65S{mnr7$w2!1f%J=#=5Zq*>k+^G zQDJ*h?*J{qf5#3u#q*zy^1o*D)f>7cTTzGqOuJ(F3V81_FABA+Sh=iZ>FQO@E&PYH zC1pW>aqySsQ>n8wd39)IopYxL=U=N=ru#x$S(kjj$Gj0_-ykyTLB1$tN@RFZDfyx* z$06NsS$bBQr!vP$P0+1fvibeGrb}n#0LyL1Rzq%+?7(ydnD z-=ZvA!wq_Yx|FJ~lS2RBC@*PQ?K+)$cdKuErJ_C*>CI_gwq`|5%1hqLrWMWyVzO;i z_$6vrtg2aa!A3i(CD^_}pMQND_m?$|E9zFXe9A+AII|F~vR(rFme3)Am&IjkR@Jnu z_)CAgCtJ!Q($s!lp6g56_l>r`Hnla)E0*FtJnUg>YVZkFYRt`~wtfqZI?V%NUux}B zVDGk{)TM8&ntNO7SL2QDPX!l*{)>=1-Myq~A14P~0^+~!xc|Zg%$EgfA-M~Oe^8}PUhl1oP(N7X0XNMgC{=lO^FlZz3@@dGJAP<<(J96u1AABCnn=zc;o zeC*orVIT8~O!clkqId0y`!@X5b~-%E*E=4;jz_TLF_#q~YhUS??ZadBA2IxMjlEnt zxO%I6y{lKSt5+@`T>H(XM95r5q>ahtrY_kQj#EyP9jBZkJ5CuNw~gX{S+|YsIP(^V zh`!s!WatWC>Ds@<$F440R!;Ywjct!?JJ+5J+sL&?^sYT|pWn?H%m2PXv|*{S5$xJo z=j&Y?mihRCV&IF26(DMGT{7ZHp7V&XV{Ak_$}=WwW=Rq8(5NG$to6Y&cC zKw1z&4Gy~R6+@r&@p_|gC6;cS>OY1#ocMECIroYU+x)oL zlnPeP?}`mMpAnmJf+Mm|RZ@?Q@YjerUc{`6cLj*&A%3sHMFx|rU<`gB#E}^ex;se9 z$*Dk_Y{bOc{#&UBKgWPe8*PwuSb3I+4cpczHf$rY@^DUSU7r;jZeL;@htG@67R0=( zSa3CdAjCR1+UT&o&cBX5$Cq z_)Ak*?RmXh06qDMBb6zef@@Pa%^v!oJ*JUYz>YwOBXT_Ap@M!B$0IH#h7HRSN9N)O z!m*=&sTg9;^#VRBf)GdK`1Ky(f^pP}Up>LDUSM*%dbuD$E<>QtCw7O25SHZ_5J$wO zgnF@Y`zdUq(7F9oj)Ud2fu3z7j)>lkCp!fpj>xgn^<{!nyD~cGc~~kyhvJBN_l|fG z;x=Md2yuM`W?zVPp18iio@4et1eWbU%rr6A1J@T|E)lGroNO0y#}DKV1hx4DF>Kf;Vx9lXjm>JY!7zHnI{)t#o9&4InixE2p2IpO+!qSU@B<-^ za05b|eqsu%-i_fTU+>z9MUTTi0--=~DKTs~hQtx>&=6LmHf|hX&vnL)1ME3gZX9Hd zx|;S^;=NSFoy6DU2l500_1{B$Q1D^In7+=2^%Cp0bK48{m_qK`6PD#R`2Yej*R~nN z;Ab0%buF4hJ!}pmzLOX>++M`GEx6fea{%#jV%Ttd5$m>Sq#ickL+rK-@L1r_P!D@< zJ7VSBL_KT{BmN>WY`E=+mGjHg!{&R4zeNli45`DqeXpi|GJYU#8v%2Ch;_TTwLRva zo49QR8;%39^4tns07E`aS(fGF&mjI+q*d?yz=_RkM*q6O9QT47@B<-^EOpR7cA)GX zNKQkb4ckeqHn&g@o4JS^h+)Ha5=ZLr16hNh?P(SK8^mr5Vb5*n#&8(`wG%LqjQ^_YuRU1bX7gJwv)D|94Y9VF-xIMeKJEL4*p$PDSdSOSL?4HqI8qM) zd4~ETd@qNxuZYb|=!tb-J}WldM%T$4UV)hY4p^4|4`rHQ_Jw}SIBpf-A=ds@8yn|G z6E>BwAy%9JVr=*w0eLuYiFHhzPfgUzy1pv*d@}kqv9E$Xu^v0VDK@mH&ogo^f(^0O zd)U|<6Pv}bA=Y~77frV*eW8)38aBkrb53kn*B`}(yBM+Zgpj8^yq8ZNZVqBSe}13n zx&9IB`SUf@OW)}ujb)o)LmXKF09kBo?h%_7=!qlT=^-7WUn@8w*Cu~!%6?01*29Ka z%RVLgR_KYf@APq?ZTm;D*$5kA?fdg$!@1;+FFc?@iV+Hcvk_k`n7bQsq!vFAw+>(B zp9^peq&?Rq;>b$;h=fXf!1AFnKF%ZNq7LEu62f^VC58|xCGz+4(6v71z8V_qWA1Mu zIj@Tob7zNCAcW*RigPr?hCn#CLhpCbt0pEHq#hw8=LSv0az4Oq5W+Et(uxq`A^=Gs z=>JLBN-Sf=JnbXw2!P_`^a@c`{>#)edIo)eXJ&yJ~k3dA6+}8j~l6% zKDxHC63A`@?c*L|>Ejc`(#ONZ(#PY(n8TEl2-?Rp#6zj|zvWf@7Sf7yLMdEeaLnLw z26GM9`wTM;cHigaxT-w&eV*WYW7A?V*JS14_eP3$7~D;q>vKM8@KXl&65|?*^1Q*P z4Svnw^TgcXkZi0cit`K}MSPKOQ)=*JgX6>(`!A0fWPx8ZuL_-TW=uIjhoFB!~rRrPNe>|yQD@5Pn-snCH;MCYit{%q*!i0j?EFm%K209M&flcq^G5IdO^V+6n-uK)O$v7YCIvfx zlY-+zQvA-}WXv_qbN(g;JAadcoxe%J&fjE_Z}0p~3U>Y`1$UBPu=6)5*!i0j?EFm% zcK#*>JAadcoxe%J&flb959^}xJAad+cm5^?JAadcoxe%J&flb9=WkMQmEo)=zRK^T z^EWA&K9N+v(cnMn8|BnY?0(s+`$&mzV~^EJ6M9`Ge7YUIq-1zeSACE zy0o!@r?Z1C-tV*8!4jk%w+^;M`a{~mmP&hMJD5UzsyY}uKJOfq^MLdnBz?RG@F8%a zqSlA#z-vJt->NBUvk+Xs%3lR8U|`=fapN)}^SVPjdD~l-6Ak+^01EJ*KahW9CL zCwc$VNxPT6Zw;>O1s1Y_`kGwA-c=uyrO>{CYDio1-c>DWB?nQHT_)dEMYiC;BknJ* z7wR^a)j`+qmSFl2!>fbdgtaZpRyEg5aQ{ZvUjo*)@Qg)Tg#_Or^iSXh@f(9p2mz;b zPIzf9m-8--({3kM;Fmb=QaG2#4V;a@)d(!lJYJsixrXJdLs~AsfP6c~^99G5fW%|| zbE;}!T;?SCHUL|`wUUR(3G1b-M<9+PP}ax%_EZDolsw6|7ufQ#oLt5NrP}v(!Eq`f ziI_hw)xg6Lw7>rhZ27hzEw>PWQhfg?I8G(xK+L}vRSi5GLHXQ$4WxB@YzNN77e=MF zzt6-{e7vooeC4pS?c3cCAK$CCd}j?GZz(9>Cj)%ll849%?I_Cwe0*TU`B9C)TMNoZ z|5o@*_ID3(runinz!wD{=V>(pZ!sv}KLz-nk~~CCw0*n}P8|2uUOD)*eY~ZheD3}V z(z-nkOCBO8$``>s3d>hv_;?FJ`DVZlRVVqL1|H>@{2%4xeRa!M1->enR3luDpnUG0 z4AR=Z(~^hCiSpeS;M-%`$6Ex-_hg`bXC%*O^X-Vg6X1Ko@abB?@q8=5cNRM8RkVG7 z2=E;SUkQw=5%`*vwr@f>ef-`)UJOA+`L2Z>aa=OafUg>uf%l%3uP(sHdx@Faw`F9%Qek1>YN z-CIIh=gR@`S}$3D_n2vE%m`mXG&OGp&E? zU}yUq#WNe7&wK|#`}@ z8sWnT%IEI!Aq{gU^wXa&n33|`6X081nwrnk#g6lDZ=ijxAdp+iq)YOBJ;2vu_-+9ThW6MClmUf&wVYGt=B3kA>up^F(ehcd5nqQ6dYy{@9-rE9vQ?b1> zotMlG@O9!DB5%c4BUB(L-~9nT-h0l(*B0PAVEE=3zQe+&<5Dg25hhM_T+RpT<-Kjb zd!wS`^4mbY&!FB$7*!+Oj-dT0&hf`t>;3zF>ivY+Ve>iRJ?|dDjI`d5!HzgiC4~QP zfY0ZufjO_W-YtQ8H-T6lvB4@e4}KV^cPs3;U#e)mJ%M^#anPuMQ8mJy2wLxd2KbJH zkI!LLl<$oIUoZIhJfa$g3lNm=y~ESTuNR$|s$__DyWJvoI(~GLIL+8;y)$4(9GAQ^ zSS0m4aS?P{?>)kYY$wyerMHNs*9ZQmCIeABQKa@(mW-{t_{C`?4!Rm1QT2+BwMECiL~`JQ(gb~RAw`kV(0 zI?rrQ?-85~UzDLI^3%P%E<;ZpwWl+Jf`$GQ%Mt&Yy&An88O+Cy-8)>RYoIfFjW%DZ}^ zeva?+Eaf@v-SNP8S{l#TO%g+^gu<2?cyj$L6Aj z&u@myGowTCy|MC9M)PTCt~}y-&vnB6SgP!?(eMd%Ps2Jmpi5~{`q(Jv4=ZIj?TU5x zu1l|^t7bGT#}>lVmTh5I&6Q9e9NAMeVoz4OKedL-+lof?=65Czf11uBU7u4O-h5d! ztzWqXZAGIGg&TIX6Fn+f(e1&Hkbh&mGA- zF-*s9;hguh6~$gD8U<%vMep++bsd=tH(kYD#TXi|=SW`CbXOF*{hcy<;N31OdRuge zpAGMJBX;FRXK%tbj*d7`{M?bnJx8k5`yU*G9m_%0Cx)rd&ew|yQ0a3;m-iHnToGFL zc-N7t88w$_RUNMm=_%`OR*uy|8vCLCgeW@(1Doxb!;qzdSaY7I{jyX)xOo} zKX3G#fbr+-`BoNBN{SKw23Y&`Wg0*-^^0ef%x0|i9|ERWdtbv}wn(L~4y)7HB|k%tACk|Ad{G%vt_b=Dy{Zk-vyT-0AG!D_9}n1* zpV*s^?_u$0a2*0x^QuOMhwoy5=h^){lSP3ZITLmHc3#x=R`Kc-3_Y#ODW;w#I$b37q!OM7~*OzE{*FAsr#kY!%`Ne)EH zU4&`SAl%y+YdEJ!Zqff$pA*(~$e^6^Bz;hbj~S!~=|f|1PAk&(l=PA2>jb(DfHQco z2o<~C+5Ln{e9SWg#XKtrnZu;&osBsh>Nf>s(C-Kw<|!-0*~{U^ahgM?zKecA8!kr5 zGs(w}M-D*l%-FwK;*JygtpV@5hD6V^4b}7bqTe9Ij7^EL;n82q^0=pE%ZT}40z&E# zPb(peLN_|-&MviVocbGl{Y+xHxmQ8V8&r@=gpiz)&L!r907w;r;zh)Ay0(~@H}@gc z2%$KBAaw|;uP2tiHxf%5nuuk)w-8UqkBGj9@3w_pHn?$~=o`3kzS+mTC(Cb>DZ~-s z-G%r~BQ@Y`VuafA>2AUyLckjo5KLrhNMh|Jp}>hXdEw{saWY}giJ<##-6IK=S) zXXHVnl02{p@_Z5H3*_|oG|ov1a6m`oJe#GghoN>X=Am;p}J-0t`MCMf$_0pbChz++VaYW`@o!GRZ-Zf&wX+x|$ z>%@lr+9)>MOvK8wMQnK0v`cKb9}`EW;0Mx)!1l1NM~Ttq7-C|r>j3rA=I;~3rUWsu z*7Xl!L!O_AO(|kx<#|PH*ydl0%{auw%JZMbW+=BK>MDbdI3jDv#nelCO2mf4OB~@O zf$;k#wV5I|%p#85=uAAm|D%0hBsN@9h_%htV#7A`{T{X_4jW=^^IwP!`@T+WX2OOz zG7SKd5PgMU{g!;IlqLV;V#E1DtbRqFG&Vf{W*g?hhFHIgblSeo36`MNfiM8x((bq#y ztmAwK^-`AKTe03o*bwVDSBuRi#H+=o2{y#KmeR*0%eFvItlyhog*1HyP~4gWoDIx1 zkb3Ud#F2^kffORpe+4(+Bx2Y^1xIcM5Yca=SYE%4$|L4t1{sMEl65skOa-JALBB=f z{0^}~2kLPZ)fdSZ;wGH~6H%XNWnFkaGx%-!eD{^D{J@7T6{R#|-Aa zuiqF>HF&1MbBXa>jiZTn$Gu$5F9W;@bu}$D-h|rb<^f*tMk%xT`unN?Ru}%5M8;yE zk3__b_aFRzU!cN1w;~2rA~*pCSwWv04HtOPKh+7}kLBRreGitx0QCD#z1Z4$@~$ee z1qY}HQ)|%F1AGa9R$~GVn$1ntKi8K4o)^O!how0AF4$yXoNP6A}6$?bRiJO5h%w^e|fl9zJCF>d~+oakrU;69x2Or((v)H zuY83dvwT&^%QSwM!N~HR0bdDh*1l?Z?wF(s|0$UF}CsRyrTg4~vyd z?3fJ0&hotkzAES^Bam15t_|>w1D~9>!pgT}JU3uBxgWbv1?+guDW}<_arH883AC>a z=T*AhXs_*~&mK@D$8Ql5a%xYSB;PjzeAVF7@#B3B<$E!}$8%me?MvhPae!~F;fonQ z`rK#xCb`m{_jx2(mkRS3ZWBA52V0;lS0lt)hCcg=|ay*MUI6)@`^ zhrm46`zZi&b8b?m;h>?IX{{Ik2sdrNX@K2S8i>%2vR(N66pkmb3-*I~UxXe0lI`1$ z_Hj*R`&d8o*uDn?e6NC!zE)JU-rWH{?nJaBAIDVrXm5&pJFv*bk;z+iMPiqSn8zke cg`}KBV>pLYv|jF8M(sU<6NbI4OhoPeCqNAr;{X5v literal 92072 zcmc${4SZD9oi~2xC6ka0nm`yr2s#4^Nf3|#Lcm}X!4MEF;bj0TivxK@5+Dik@<TA4pr6Q0*qEt1&HGVOxz@wn?fGt#p-bS7fC{*H-kYR$Tvzt~k&4d+s@tJ2wIC zexCnl&u8x3-#O=ZzUOy-=jEPz&zr9xP`9D#mc$#qv1XddYS89?uXo0@Ig;g`L`~Da zrfKe%246Q$*0ldWu7(CpvtG?`vtExSYuf*V%Vz&j8+2X2TC@GXyzbbc*}mLWv%b8n zVN?COE%$DypS`ZSwz@%!b*iWuPZCBv$)q+SJsx7tt$&O1lHYGURPbQ zb7+RDKz)^!VaH9==B%qMZ&+84fPqcXfKm6rrpk4-+cpjDGnl=uK2TpDShuAfNek2k zYU&5G)COt>QWlM;p?WA+ByBJN9M?gt!5-y12DB)E%W9c6iws6ehw?CRhw!<#eCN9Q z>RsjQs>(NQG3j4KLdn-vGrjee=#@{!wuWtWmNXlgS-)-l#_|mfNKV7Lq4n~`9JTf9 zHk8*jtZUf0#S#bem7;H}4^&#bs%tAYue&<7V7UUa@Vf$ZeM4P!ZRNU#%_2pEl;5xp z*;HOzU%k0DHV3!YRX3Cm6~^!wR1^&7D3~Rp4RxE=#nd5@S9Bd*jiO#L^)Tux0>sKn z9O}U8+Ax5=u6FZ=&07YlqJ(Q0QYv$}?bQuc)X};P>#qWT1+T%*LyKv&6IV#XhN|)n z_g<;wY(P;n7=-G}(DGcNAdnOFqOSbD&G(j<4VG+6-R6qwO>EIB0^2rO>J9^28ndVd zrSL*g5@ayCWU4E#ZwS;i1lDh|)Bqu!x!sMzE4gZsz`?l6w|*On>rgo)Q&qdU)*54d z-B6hi*DDoCcnwh`RRD`@g4t3ejXE-9QU|;SRg(d)dbA)=J95QY_3HE8mO+dJhm)y$>#=ZUUgY{Z9{cMwdJ`K8z8W)p=vW4*qx%XeyJcs z*XmeUHd9}Q?~2c;0XTENhE;LEXG?j_P-+{ha>zjNx>BKr7Yp^3i>ze0LMfEKUsMVu z+f}pO0);L>d0lOwq53}KA$Wx(Q~0ZDT*7{l#=&+4jl+i;ztQ?SVS1YwikvlFx!#i~ zo6_xZIQS^zWjhI(@kC`=drie0s_KaCZ-1j7YP^b=(Olb|>!4+c`cr#k1E@ zZQB!x9F9NkI7N>|BNkV7^t$_c6AFgsMIy&t=N+2okge|Q;rlOb&#}AaX~nl_TQ%)O zfwnagDW0S0d5ujyVc)?td+|-05z<{Fg6&T9#5;mN`_bNmzt&UqoJGD+UZ{P|{xy3R zS9SE}^!0iRh8ysUhXLOI$|vsZ;%v<8)tTn%y;ChB16R%}zLn8w?!jw%9?pdt%%Y?Q~mWxIF|+ z&pVpyT20>*Zf_1%rp-Y@p`y+dsAo$2xc9?(&7n}9kyN-N4b-Rqm3K>gdfwu2WvjjT zxd_6zK8WZkzbQdlq4(o1pG(h ztUuX*mrXB%2s?>@c;ZjRAtsR-Kk>iym!rKI%unH#Xk&c;7SY?cr~R4v@~@FafkmYf zHS=_DvPsa{Z$oELb1Br^)E?;$v_qK>0SoB=+)^+X@`oxoaPU9EDYsVt-OioCjvdX+Q&@BIv3uc3Z~ zq$254634wSWYZeEWLws8r0_qwTf_C(LM>FtfEZR20m9*pp)mwskiD z*bv``Id zA5Za2vU`f{hfz=9{MZl5;NF>X+<8Z$D1J=|nvZ%Ge@v(2xbsw8Ny<4k9-h1CSv*{0 z{#TYpB0KUV&bh=lCXW7KB1%;<%CYl&oHixVb6Q(JG0lJAvdhL`B`JF#4PlHNlx?Kc z>2+7qDRsnhGAp31vF*0I?YSwdGK%ec&#wI^I1(=A(*V>OrJa zmJ^hR;|@sTn6tI7H=|%2b;Bx%-Onv?(RtRtgtiWDd(Ah&X6cWLEEhr zX=7*T@iop>;eU0#8F7z1@kS)yR%~bNA_wQ$R~LC!+B*Ni^8z0eRU6O8dxpFq5L>#vJmqn^sx#En<nC zD4(fO4URkQNF?%bLY42SblbzO+?2|6+k>u7XGQwY_UT^tn0_QNK#mDqG)ZOSNZ&jAL(y)ri2q4Lp`D2-To|m zz@MPOXXA%>h$8-MJOO_jS@vuJl7)KdK&_0|x^2ElBs<*+zIQI_N#VFEK0}+Hjr3(E z>tkWbuow46x^L*nOhH*O0Pp&1-?Jq|KzJkQ-1qvPT>*dLC?ZXNmyx<%v+;C45^;6Q zj43~H*5;jR(j_&GF(@)CE4 z7OxdaryJp7*M@6fcN#3E!tT>hGlZ!T_AKqcY=-@!u*Ztv(2@*K`R@Rp**LUo%~nV= zQd3pHz>^)(X!y|popx=C#owCV8?>9GzQ}3U z@+|z;@YM2vaSY<0q4h}pk_#XCwZqar0`v$iPP@aDzw|e;3;ti5vY7t8GCd%L{~e|P z^uOD}|09e2UJL(?GXC`lJ3>p*9+&vPzxe?kZZH6Vj zzgXlsWC?%9;(x0}KM7H3jPxIob|b!V+FFZ#es00P&w|h3ws8gsu~TJu2D8cH=O*pN zAB@N&pFyYLX3H>W-fZIy+DjS^9B|5!bSmx`WD@Sz;XX~$^yhmT`KRNaPkI>sUA zCJ0hnKswW)OGwM2zLa!|;l7&mM1#JY^hkrghqT9_t4L=XG}Dy|eK4(zhBV!7mNe7K zM;zU0?!rYn0ry`@nmXu}G?JkGo20$CpO-YneqYi|uM=g0IMhd)q^Xa|lBPc9OPYEs zmNaGmJ4sVd+a(QBdqC3E*>@#f2>OJislV4GT>|Xl`Ia#9Bq zB<%&ABWb30p^0aOq?r%vBz-sN-IBfs^Z`kifo5G(_&<|0WuUS7jJpfBR4N>16fV+E z+?ma!rI%)tO&R@clkf*aKidt06fJow3nUD6N}9YZ;-twd!d?RchW1o6|8z^2G;Riu zYzA3YY*Xnf>xC?n#J9<&kvg(5b78!=RGrEp?ZqDq%YjWcwPdxiBEZbVrP3v27;ePx zg?lP!%19j2Gz>Fs z_+b-$!bF3NrjfX+4HWX+L|<9nW*IcGY?%fv%G-E@_R?K;Dd?@_zXo)w?253+lBPf5 zNax_bP|}QF=nd{n*UzLoWqDrGOxK?zOy$xEy!?ve;K- zzcRFWNdIbLOXwJOqQ-nfUZ;kmV+N`N^|g6o0suxFH1^DEFq#k>E;@X4MKy~-s;dcT zjAE77;On(!LNR7Pi0KEM!%$Z*1|<1`UUI2i`a(vb!vQW1TVqIM13p04UlA&XNtK&{ zQNZYI3zNW#%ZO=U*zRg+AK+s7t=V!l1sDUev1kLS64}flL5%X5gc@Mrh$TmmFuvZf zZc};f6_Y-QQ6(%|9Iia?Lk^lvt=){T`wQ<}IRyi(8}5x3na$N@qCCkFmZ^NbTNfxR z!yw|ol#OUK4S@kigfNQ2F3Z5FD!6hU#gIv-ZUSPO#nrTD=CBqSsWvgSLCmGN5|C2x z0H@L(QXm{F>NeM0VLry75y^F|UNNIpF&0@KT67QB48;qf0e3U7}E zZ?y@J$x(Q1=%a!)nvNx)H$~9~;kNsjZUN`*s-l+`vXm(ie zO7H*=BOvkks-*Dpk$5xS7TBo=Wfa~FxRWlF9_P{jA|LVi#Y5qZu;ASf`;9UTZwha? z1@AAw%Y;Aikn||tL@3iN-%k;4DEWNgGs~BZ4u--5bQCYag4Yea_3&3l$>*@(%{1Y$ z-$*{n;ec>v`7+?aK94dA?{heiE|eatfv5DxS5AfZ3TQK4COl+!QiN1^r)8Kz;i_q6 zz+>Nu`r|u~!dn8`jJE(DEYr#;Joep47fO%&fwu!R@kZlPc$CGAcRxHX!c7^4$F7+f z??d4Az>Rq9Dl5EB&}O_X(ECvO`>_mDh&#>CkqJtF?5--j`$3!Wb^vcE{cV?F3UR0D z0iMzyKW!+yZ6M5e;Va0u1$+!sh>PZoNj}D}@b0wWwE?eGgfRZdN3#e7=|Wmy-ZaVQ zgPnd%|2%uFd>;Z2s*W0kmk&NO-e)Gf3E)GRa)?WkgsApxAeD8wEEZ70vT-TA7cF?-0p3LgCi!SRX~Am*-aT+99$)(v z-g}nxHlnee41Z;md~aLQd)|b{&jkwalm+jnz~gsRWfWe&1+Nf|zyn~Sd{b~KyvZOK z9LW?W0gbo9po5~bL69z_Bh0hFQ}u)GFa2mA4#JG*1|H*6hI}*$AV?R|0`rmyFAsM5 z5w8K|jd;^>(aZrJ%YicVDbv&v?-$K2$(ucEwlTTni|3Xskni6{ zA0`LiP;8p_TqJTGE(+F&JH|;d6#l)QN5@QQ!GLyKV_U1Yqb>MY>x8l4R(mi(3pvGj zk{AlZP+=mceQ?|pBS-R2w}&#rsfY9sMp2{VpTGsq zd&T&d7)$e{Cy2pU`-vO0>XfSX>;v`_nVg!?*9*3GgXhpN$unL9ho?b#cSwk9=zVDO zy!fj22kkj2yA$?$?o>QKJ|2G_b0E$R7d*FDwQu*>nH9HRqgsSY zgUZCb5Ty*yGK^~Hq>OvNqgVJjpeWA^aYB)?Ay13Z`k27}@t+}+Fk@ru-q!B!J?&z; zhM2eDZ~heXP#77<%{eyviQb-Ls|>qcComa=l->1A#K(C7^Wvid?h*4*m|6Z~A7eg7 z_}q!!NYoc|f0X$C7ydtb|FiC^Ku+{VAOBiW$<29b;Whpy3G;XQ{|@5ao5O!&v0*$RJms(+VD-~VTf z#!k_~uI4$xVOl8u_LJ@!LV&@K*+;HWc6c<>=t8~xGv+i+&`>oIbH+OdkJ(*btsQa= zD{R}hzpypgGbSDt)kTfX?mH>Qgb9RVve>Q%nkV^3#O1qkN>`1XbnC*5$w?4gjI=*q ziK$16KRS`9A+}ZFg^X=>cpfCLJn^5AeBbO*v)$=}9Z+{9E~?y-;$LwQG8E&Jn{7v4 zXC;u}h5V?*+yq4A`jq9R=~5)8hmZ8~pI0tVi6-j0fr*JkqP(LKIE%6vS5b9?JKgrfS$ld*fLQasD0Xc1+vR_l~xpj)8t36*`b7T@t*Qc3WttYT-h}ppHMA$#7I}JWsC}Vl zc;mN{-FPl0_KIP)wTUNOT5lw>HWA{+>H7hB;I3;|&9$GnS?e0#wz4PKKDl|%(SFRn zIUlci(rw@!;5_DbIknTi+v(E3)d;;S389N8YmXPLDa{S+^exJplcE>9s#@coOp{F+ZlI zt^HuPt>9zfS4W?*3-sc>GyhQ!go_T9=%xF1^qfYx2d9@XMTeco@xTIN&YlD5_U*^6 z>&k39*rQi0b7j;d`tLPa!KKlnR=&3ojy+4RQ5vR=?ws+JBCI+lz z?9wWa#e+>xxhIDb+XhRlQF*g&OX_|d-G*v}Id{!dbDWLOw4F)nPw93iJww~K+b$$b z>bjI+V2F}=pjlgWEDj}T>4qNmaFj|ZAL=eSjrhgPKVKv=d#>|AJ95LFaQ`QdJ#L$l zFz$WuiMprm#9$p%SU-|EetkWP+@XJK}=A(an2j zqYJ>k&FtCs;u|>UYtLlec&G;uCR7@1>j{ah6m#41=;njiA=@3Uj^1hAdr;^DKn=#D zo{ilbitFoL&4|QIH~->K^tjNGpwAO(N8hLjMY!U^>W<#bqrKDgJcOE(sQdPgu>0+C zdZuT!O`qvM<8Y^E@X-w4$7f>lT%toi63W!uL#g`ykP{QW+7Ip688>_O9_Z-~v`e`& zXOHG|F8tUzWO)$j>6~SN=zBu5pn9Pnr8L#1O1o^+P_pA&+WyFT*53#Wcg4Xc?M)N3 zcJ$O*+rq=zhH2sK)|841U)M*olZwtvf}2w`kGs(R#c7@{7n(W$={N{ABX>gX$XrM3 z_d?%vmxSt{-mqx-&iUiszx~H<`{X6ip_r29&N<=Gq!Um$OU<1Yatt_1zG{aa9~!BT z4o%RrLo;Ohd=bpJtI*%?PJw*x?*J3Q{fVFJzHkcWjing!p_7kl6Q}v-eq?wcU3(8a zV|a?mbt7vgl%G4y#InWegVp*?!zNCND3)7>JaMm z7lhAsdR8Nbun)D{e$IYs_zSO|9*&M|p?0qQiR0dQG=0>QHHZ-gtC~?a^9<7TYdr z4xRyE*qhGP0=?*I7HInZr0_?%c2|*BQDrZ_RrBkkdc`vXo#ps*j!+S@9~wGvXw-H* zx>jgi6>Zyl^w%r&Yr8MDixML0l;=^ByX-EE}nG0l)X3o-Zf4$r%k5p)A;Sj?ia~&jndq?2h&Esj$U#c@%E@BfwkDF z!F{Okj_t<^L>l{#Z2#r_?p~C;!)y`tBaPd8nm6R1IRWKp z8VII`&$|THjRSK>RH8qzP!o?w_%2Ckd?4AAU>5qaNrEf`T^6ys#YXgt>>A{f($ zgYm@lC}W0+aUg0iHYb7+%S8-Cw23;SKEpncDQd|0X?!IzhtF>a=q?%Hf*uFrJrq}Y z%pb+d8Q>a-l<7rZU|JL_ja;1~#u%)#=m;bVu4>0lyE}nT%h-(gGWlS9xe|TpU|S=i zVy^gCYcHd3D2gg`BR1Yt>aH}ZyJ&92s06xO%xr5?*@jP=Ln;~RJ;rP+9>}(6Zdmho z60^-UBO0}l8z=}?84oerPN-~)&5!|AL&n5}%455us#Y0djkgQgwkpacGQ?U0m|kRC zp5lVe{d-1jS$lQg2lcku~^%))|{|l2+*we|q8}smRN1f@kquA}orW12kgr{fx zuY)(=(S2*d(@)JQ?q2rPoTBa#?&qJHGZ+3^QsKUy{g_n#VzOt6mhmY%=};0}dwTZM z?IBynJKf`f^;DPha00tri3e}6J($QsRB^*4cYfnBen0Rh*^fjbPaI2r;%E`V_dFAP z;>e%++R8{A>uG!@*?)sz=n57dW4qeZmE877(Gy+X#^&UXwnrYzcV@g${HI99SxoVl zQ@3pin)e2;HrcCX)z8zu@|AhoT%bGTQHEx(XH5CT_U(vidS@n~> zcPuQl(_-Zizb91U6M{uB$OQZEmP4 zue%dlJ$UD8H@IwZaq;-nEHQ{v6{suQ9;hq#)@&}@wyE69adEJkIAXXsAWsLw%=KQ8 z(U_g!t=)#P?m90RnG(glt+twCE-SC!ysd6S`J(8`Su&R0xt#K9brl=(r%xB8lm;m$ zQ2p}dOT6*XNucR zvv`}4FKjpEP1lw!T6)_Z3-V@7i)|#Ww*P_U0w0+M8^6q20kg=1=lWkO##hMmbzF8a z5<3urbN$W6G01~T|;AJGLD#$P0nMOVDhCMjhe|gG>%ja7)Q*= zJo#q~c!F|7M^g-Ehc?gRUu3b*x7cs9*cV#tw_EIAwb++i?5iyHuUYI?{rsK9f1UO< z(_m0Cd~+NIODS$#TX4?e|7&UIm^J72pOX9x#qgXzKrC3UpDOsrXc3He(VQ3daoQG3e7~3SaExw* z=F_gX$X8{GfbmsJe-5;bz{qX|?lg;Wjlf9i)52!_kw0R=8|4~cp#P^beRQS$JrXb# zLf$FbP0~LMw-J~f`+`NDJ<|U>!v7|1woG4+u+L$iRT!#egm$xbjns!>FVNOWeJvF6 z&DXYB@V7{LlZ5|Qw568(4oEyhe~YxwBpyrd2<;9ru4qVLr0-r!_}@zWivqt?`?vJH36)m33LNMC2Tdr9XQG@;Se5Qa{+T!Ws1TPo7ac#cS#J}*d` zLH;ah#u*PCke_j;OPX^BCQ6#|-ymr(=-HBH{HrC+GFByN$`Ufs?UJ4hcgC&KZcZ<; zQjy2>XP%R${}M^#CgyL@o$1;p-5D>9!W4S*3MVnI*(RG};@cViTZ3l2 z+0vc(dn8R6z9VVI^_Zj?&q+yBKOdRsIHnhvUbv-5n(=2!nz|KwAOj3>)jFT+L37Om z%`{x3$va=tlKp4TFXV7#~x)M5^WVlmS zo1ApO@M=8+zO)FM7-Usz8#ph3G%-pfO^g+iCPta0DKm}AyCl%5%n+C&T%?IlW0Pb1 zLS`fgNj7u{nn8s8<~jEi1V+dY9=viG3sabfmMv}ngbGai~49s)?CbSUI0G#rHt(Ba*%3K?X16Y;|RHq>vXhh=ge zXs@J~g3csej6WEvo;+jVK3UQa;66>#%%hp4$q18=i~Mc47f8Af_d?PO@dvX27kT~< z?j@2=1^yCAvkrN2rH;WLjA$!BGkp|`?$oy^lc1T_D(Oxc@0B#uy;IWE{eDSP_5+fp z?0+w5%6?qZl>HS+7vg?V(vk_nLUVCuw4KN;(sCucWDmXHEPsnfT!)bZ&0L*TSEAw8^qTxtTBGnIq|q z;8A6U>q%9a`37jO;LLpjCPJ4768bCff(f zgBLXAW?a)iQzp_kgPtkr+d(s(sVoRE9$chZHc%y^?u?7>l#%T(X{JTAlc0%lt8{1C zxJ}aJ7j1>)zel>0U$hl)XPRoIJNb7=n)o3}lmGjYrYvmxlsxT{CjU`MlV7wa!1sdg z!KL_LkTm)KUDD+Lv!q!z-j+1w`A8Dp zx02^8CjL82{CpmeXBzm|NSgU}x1<>t-{)0aaj>USIWY7i&3vSMr0I5xq?r~`XC?n; z>CU{^CTXVe>yl=kiny#+>nyE(0xe2l`&n#HD*3XyTII z30jryM$p!^reeVw7g>o7YUO6jo2u)vadH(`P;J-5@>BD&Jhj+Ltl;9pHZI5hBcUPFc?)l zc>C$Apbi}XE8R9!)m>7nNYeb%oWT(L_hn7frfaIEtYg>_xs|oss-2W`s=9 z7s-R9MPrCYPDfKxqt#C=ua~5>@`#vty*-Ed`x3Bcr~sPIhy2{O-Kz{ubA#3cn24EvAT9( zPx7lk4#_zfkfn&N>lbNC@Tl~uED1C;U^iLpt1CBeziMt+cY42y>=a7vFdN+&{z~8? zp;zD@QrTAvFjzsx>h-?`|EeM6a$==PQBtlNV6a5g4o8c>D9cPdLxZq=Hnzt9g1oRY z4u%stwX$7V`vaUx5ix7NMLShrzI9u9?S^t=ZMZ4-h0d@jTO2wd_MXXLeFyuP7os@PLKwrNn<$fEkGH{~IR{(Gy( zHSIDwZ~Q){%wKN6UL*LXtqi)I!c50MX_sNW;`;IH0cPc6KTsL=8)?$PN4k&}n7h%( zWZ$t27v-TJ?Vq8KXvSLrH}+?hAs-F*SR-9X3rrR8*q<)L#r`t=hOmRCOLGzg=|Wmyyw@9iWuQSu z@qP*>Gu}hMW4y``gXS?1qzh?*nGBFj+{--`|xX zAI)l9X1w14kKu`zE&XVphs%t&33wdSP)6b9!@-Pq9(by}mD(-MtwaySV?nP~2`;Pn7c<;P9%SLvN9SBQS#kn!TTlf9sm>Z zzJg2PWg&59`Mik43x8!4o)>(i3#CUP8Y$I27r{;8ePofZ5O^H3QAXiiw8(cq@E!nD z8Ls)b6y7Q+pIrjz=!^_io|jqVW9F*%?=}bThSJ_5X<+P~%CqYQ;I-W9;3{>yMJ z#6>^axp%Eue?J8t^`Z>V{9 zcn2+b-vJ)yaw((mS}b@~S%?>W#N+#b!uyFOKN^#V?w>wt$&c=d1LbeI3GV?5-V?y% z+%jd9eBZF(6=b8Gl=7`K;mt>3V{jx#m;?;iK&|2zcWK1;k_ zJe<{Y;ckh?bQI$`MX~vwNz;K&XS1sGu+xv%2+60sCZjVvRC_QSd`wdzE}AgnRqeq# z*j0L;08QL!xM)g%S7wmnU&UMKF!+?$Pr+w4F>n_QjDM6IL#Yl%vOUo{?!>hH{CRQx)I=u_fb)EbY>zhJ~gisu?tJ=AJ(Hbn)Z#D zwTCM=a8gFfc`if;or}eJpm)t*)|={1b0_w-MehC$))yx}o%ehZs;=jPqbHPH@G3Vj zxj~yYv1e-}(vC%sqqD~Lya^jDOn&iX+Vu-P8U00LE8Gc{BZs%#hUL^Py{Y?t&@=Iq z(#n~)75@PzwaiOI9H$ab_olw|r=C3+-uF#$7^`R}IrQ0~xnrB=B_wTF_+_WK9DEZGG0eeZbd7b{;KC|huFZAFduDR;5qTEH&b-yBJ2LxcURZEu1(!ODGbw5k z4^$-3b}If{oG#Y$Eso!KmvD&_>+--+>?&~6Wry#4ymnx5++9swt7ADPItw!BBK#fj zuR8FNeMjD|`%23ED=rCMV;v#mvl(dONR$H`wO!yY#z=Xv^q@QSg| zC!N7cH{;BgwTTD5m8dUB>K86tN(q4;9Y$NfO{{!Aus9(%g(}lm1W}3;Z0-z71_nyC z%e8UinbiJFGvKzk{?sVkl*9ugobFA+&V|%iKfm!?lXT<|PoXmM5Im=;bqXbT(rtGI zyYvH9ww#nnImn~3568XF9YdzX;llcKwSrEyF>GUL(ESuf*=^E}=3AH~i(UCEemwq! zQFg08n)@OBIp2WBDvxqkcvgQUm-1J4YdFP+?u{_YuF|XQ*7V`AEsVlNHz>w#l?ToC zRsF5$xAH4FRD9P;Je3|5pR!AD@eOnSo!UyLL*w4Tn`_0osrhhl!C_l%L)}i{@>RGb zYMbjS1GUw=#2O~yyadki8a5!s5sElKahW<)WSC9+>Pq+}#RLg#T8RTYMZo1N;G3Xf z>)D3#uhuQC+k9U&zLg8Fa<0WH!iKXrkwi0wBkvTe!4M)&+p-y9qTVZ=$XYlWhtAbBq0gCBBC({#>g- z(~FC1g%()&nCL1Gk9iwM@u)cGh3Gw)ztJa?|uhsgKJ0(rLZ%CT&iqA@#*q=!n-DG2~5-`c* zLYj!<1x=%55HicghHX+R1%UD4B2E7(l9pc4Gd*ax;k|-J;K-sR(oO+jL>keU(w`UC znb4oXNYk*(tk$d0ZjS8EOtg0i;a3#1%GaTPzNXsnHYzzc* zReXN@hG8~y%?XXjBhU;d;ss6o4Y<^L6_C+<7cxVs)PX1ipb5pWEE{z9N}Bq}ku;Mz zP15AeH@O!|IurL2Nl(OmsiY_2zS`t|kECzLy-L#jZnQe6OwMgy<5`Taqp2dzo+#}n(i-2`hVkoM$(M;yrdt({eq+) z$NhatAIANXq@Tf^jSF@AE0E$FD(DwLCrkI=g67;!@|*?jmGmD#=SccZ(9oz=;IL0Jt1a7Q@_}eW5n@ zA3P#&oHdIncg9ikict-etC$7S6?g}O${AVFqwTLUZ(wNF!H`DWwV2QFB}6pXlT^WV<2^>flN{>w@Ja+FC z-fol^GakUID z;vlWegDmVOqx?$1Xa4@nc7ulU(I~#x!G~Ye>;s;7mcs=q7wKUBh)2YRx=m^??JxTN zJA3-9nP2w%Z;$L-8*Nq&>K&xB?5D?lf*b$9oqG(EZlZ;YdH+J}S;+ly6)*3NuNwA7 z?iJUoJ!mhDL_8(KJR^r;)3_tK?YaAN1G!ss_vGf~7Uh=iPS7hoCH7$UJbzBaoqn|K z(jIgTv43~vJRDe!gX7^Kwmz%No=2dcJKgDU5ZgW1Bv$u&?sM?V8+Hml#f>4WvloqC zT!F0(`+8@_oZl`!&w&ANh>8Rpzn$s5jR$%a2*~`j?|FV4_e`>hU9w$zN^U~2Op=2T5Jp+C={kKB~6yc-bd&hMQz^osD4E;L2dzh31pNw!bvL5^Q_F`K_b9 zndA|hU!K(v-{E+~hPqb#+lby9I;q62@(IDQ_2P#yg0CokRtnyCawa7fN`(-&y{DfH z_wu;ir}|E=fKL&Y*YI3<_01C z{NFq)w*BOXX8+t_eb1%|D|6M4Pu*MfxY^x)Yylg3v-R2a&!T40`;^#G_bfKltFrAq zl!yHh-^8xhVHe`hud;bsu{mUh!O7SXZP@*DD|Y9Oo1Oos+2I+e8y(nhb0d;hiJiaF zm#A$+KlI?Me%u|2mECsNX^gt?+jcuXRp3*1JN8n%9Gip2eyZF@6}qai>o}>|NVnw5@BMZddio z2eUIlR+g;yG(lJ8e9^>iPz*jS@*r%;^HTksGl-z*Z13iUG z$y!?FZUnmZto0;RKjI;92oUI zi1eP@dfaIXyT3|1h1mGbyS|sy+A>UYyVg4AC3x0+in2Q|VXZSK5Kh_Gl@?N#UpW~cUs0jIcplj@GY{^%n zbyc?2_kaUA6@Shtgg@}k818LZVeD<$_uNeAhu#qIz}z%=6|d7i$nw0AH7b~u-jX%u zXjWQZ*68PtJl)>9KePv2CA?p$DTHa2Ec$EbU;{ajWVH?ga( zuiu7k?f4x4y{Wlgx;0c)*L$~Z;fes^mNji=*%a)0XZ(3d&5iys01yBBn*uB=zi;!s zK0${6Biu*eEsgJwHaYOcw5u@+ehaY?5Qg77Y_ceEEJlruWRjNS z7&)X<@dq;*7xyZm;k%YP2c5dH@ud}J0WLMBR6?3BfiO#Osd0=Iq{q6y0e182>j~}THwp_!@N=DmO4^nS@R^#aJNdD;og-r z!*Oha{0t}dHvmnY(Ad2AgAwsc8AQB3!<~F;kF}d69gPbg@W@Mjk%zp$GSR=0G-VL@ z<3YfXPmNoObPbn#RM33_Iby6fY3@SQ>E~1U{V9x@c#vS9SHi(FEG`fPut`M;vSJ=BDnmo*VsjD6|`ZdT~ zfiis#jW z_Q8$)ZDmxvKeFJx20X4IARf91QM@Ms4(Dh(GGS*t$|$@ea5u|Wg#o5aFcFW>1o|=D z4=i}oV6TC@G74{>1@Aj1JU(|7-Z{`_`PyVSE8ZCyrcio30X)hx0T&*tQM_M*Hsd`4 zJlPe2kHN?LQ<5&E1?HC~Jg72?$9Z68JnlKoXPPo9y_H}hT_`>JfyZYSf|gqsz2_fSo*(ArH+zfX_TO$##;4>7`M8A45K{Mh)?}j-LK}HD)@X zdNnrL@MXs)r_Y!v2PeOHZA$VYL;z#7(K+}IWJt&H5;11P6%WpLhhH9ko}cuMVH5R@ z+;py@dF+yShveCdq&X(Z`%s4CoNDY+`OkV?d)V&7_w}7Ap7|-&MLSFNomfVYX4^fi zCcbXsO3z!GzTMMrKk;9Y8vE{HO$l0S0E3wAtMR23Qg&3V^mHX+v`0B0NH~!Da_;N7 z7cmfeB)3-#gzm=)f~|q+f#h2QDU1K9qqnfHcR|7MB27E*)I7Tw{~mOq;{g~BG+_cK z0(FznaiOKxrs29gg=!qBJ>uTAf}hqcDfnH{QBg5YQ~js|*G+EiS)H)n+d z{`DVoOa(YC0GXp#Hh!~*1E`R{gh!V-5U%fJMsA)O6rF|v7k9CnDQJ2zGRKEAr5JJz zf>5xyd2R^nNyn+ce>mmH_ql8w$H2+2Z~XQ7l)jT*$>snPPWo+mukYk!IGygDS;|yB z@55*y+(*3I>02YlRo%IJpB}}yeingZh`1{47qtI`Bdptl?IjptZC`>B*7l_wVV#NC z4D8bv5Fl8YEYgC!5J|z9TkDqJzJI%upmv$zuir+9K~)DEKB0)8W&TmL8krnh8|+^6>hD@O#| zUgT&e^(O{l5sCd=FnhWoORzFe-+up}mWGona?^utzZ0zPab{*aM{JkkXuq6Wf^Fvw zhAAj-63x@WJP;-9L=a1=FuI#RO2v07{!Gz@QbT1Ozeg@WI1ceTr^Gcai-<&KoW>|p zo*2_*`v0~6B+8h+XK#kxwK&rGO85RE=p2J+$6nUk!!Pe0V=rD1>3>~60)`Vs5zj+f zcW>uKGIae*u)QFf)I1~7Wxqv?Q{uvTSZ3y$6>0jKtlelcD79!Y&c(g!y3ER>+6+`~ zwkhLGtBEdOWAeAmhfr-nb`P^CZBFak$;0ji^la%t-cpUt4U9x#2`a6$e-K zIHPeKG3qmmvFF(3id3gh93GqJc0uOQ9_U`3;0SA}sKp^)bxL*n6jyc8n*DXXGY`j$ zL9<}*v=By@4##(I#W0Qo$#jVk8=Mrokn8pKj=oR)ukTPr+no?@-#Z4a*Vyq@y(iq- zyRNF<{@1%-?#x@g|6JVVYvh<-l;5+Rb$;*YsiuHC+gI-|#%GL_dlvL;oKaP@@E7)C zjAW+xt2DiRN`mLo2N;yWs9jWVS2+__@%(Lf+hBG)Pp@RqhVQlq&}M#XtS=I|u&tME zDGs^jB#Z-#3uj}{E25oqKIk$J0=`-r3Lt+DEWU+(>!o?F8$tC!ImOV8SIV(VkXWZ<{R*=zBn*$r-DwJ4PV#4Yw)QHBzINxJ-0=~ z=)}<1P4FuI9fl0E-pI-fX63eIT=2 zV(<)e78Ly4Jf2qeYpttc=f$>)p7nv`53+7}BWqGH>&BL>sU2BUj%H1My8ZDX&lfOkx_kw658#~_&rOCNT8j=3JI?Be zHFXs^+h^HbZ5kV~+o&T>Z#k8SvEPgvplMhNNt{VBIDJ`*qNyXqt~V4!@nhD6ed;2_vFaH8 zwC9-gLxj8jpb%WGR)n*5fsh@GkYGWWdsZm7_}lVi(!ni=nrnc$CAq#GI1#kU;c0N< zLAM7@b6%b}KN;mVWINiMeAp@GNO*Q>$f~!C&_rG+LPO&^&!ix4aG2osV|h#c)4F)R=!KczUf{pwvgaRcy~Z32#RdQz2)!K#LgTDc z+ZG-OjU<2m4fN6RT(vcd=X7vtGk}VL9kS`8 z7KVp+W_72W;uJ5>E;v+_Bz0#Uj>mi_IBe8b-{k++<$?S{Ut+hN()-vwc+KJr(5j^`rg8&WhHlqnR_HCw9#J4-`FXt_(#atF|IZw=XA zHuNd_FVLsabGbslL~9gq__HY@`T-*@>NnsesFxxUhw$TDAK&g^FmDrQv@Z*I7PZgm z4fi+@+KvGWS{OujNtF^d5*`2_Cqj~GqL>lTR<={8exNhv_0(8J^k|0z}V`*qS9r7jOl@K52Mf+p^gSdHQw;Vq7kk3 zmVocB$5G05J3Vu?>Jhuq5RPu~`I;XO`qB{h_`pcdF)i4kJsjWI>fJr8bwtoNYHZG} zcvta_^@odsK3_0rnWw~-q%%FkjP&3fO{6HS>02AOdxO4_JJST;avaNQ@X2%wKF?~c zE-=F75Xb708#WQ3u79aW3*1Ke6KsGu+P~#+e9-5GV4kk&I^Jp&^eM&QSy9nV#%XvaV@^_2lJ0VXrB@v3{2>lunclRhC8?|1@5~O zyEpVN=cL&^r~5^-#9qb24!6V89EY0f%bccr5g~S{Sh^gF%V>Ty=o<$X6fDTroNj)D83N$4I$2K=1i(gx2=U!X5%-L{RtEGm+#U;FR%BZ2wjiDfx~DknBCPV z9O=!=Sl;7wmUql<)r*whj`sC|5#fuT%8|Hv|?YRJQ5&Kno^28kbiA7pR_FQPmv(c7x$URmYQ>gv0{ix5=owVN%Lx|AK+ zHy_O|IGsH=n4RB}J?Dyf!tn06RU@222gq=Lm#gFCCZoWtN_XN^;0kZY$rVOvS(P3a zd_;o_>U)RJC%U=*V@@a}e9=Gq-4iL83E7ma>AjvyFIM#;clvYmiF+TqwtE)n&U~Zg z!}kwXj*l)kO^ReBG&!*04-mr_5qXnMbLR*PzMR~ndpmq1L+RgcZM|3(C@Ed$%b4yP z*ZsQd?a$q){v#Sg-WK?eL2<}=J?NW=&qJcIn&?^YtjgQ5r}N@;-zYsX7$|7*jqwb# zuT2cT@L6|)(jK07$kH*?-(pmng2QoPCm=)4ju$Q^&8ToZiw=(NbSFNRW^c#TRdmvk z7nt(e)cQH>uJGsWSQeS*I>2Q&#aUNzr zqQ>rD_US-p0J0pyIts|s*Q*r_7jlb_MxMJcP5QOsBu%%6ZHIOQgr?%rH*snHW*f8? ze=3gj3t-ru76;WMU)+f%9rAmq=%eWIZu{)C+#sfLJA-X)jlcKa{wy_*mtkm~s}|DT zcCAYChaAn5Vx%6O-OI%d&${O^t%eAgr;Q0&?*}sr79DBHoQE|Q@lWO3T|1B$-tdv;P$&>=&%muT z*q(`7Q4sG0p->)QokAgB5N|3WG^_0ixY>feg?Je6cRMk^yB#_D^qw_aZw-vV7gqF6 z7F}HQdSCC7!|`X@k%|6eX?i@W%AtIB1tsaOvP-yu?fFo~&EcqEQ&_Rk(=Z(5AEroyAW`3M9Bd(!Rt%brf>h4?cU`+5sId%KTZ zrs9$6x&-~AzvTTB*K6HJT5c%TUq|QG-*xT2u(##j;+D3^-rVaZmfSK?udV3kmt`TO zuQ*v-6OV8^hT|m@PsoF5Is6ZEVtd7r>tLHvJRdaztD^2pJwVSc;6!~#3BN*R=24=tuFY%|!6YpFf z!Ey!j4b&Iz>yzuujf>VBqbzwAGb(%;h@YMIH7NsX4P-cLEYL}k`Vfx(^vk-_gEx${ zkdq;DRS5C?So~jfGbGgG@EkiBHZ1sxJkX(6>ozE3BkO@&7j*!#iaF?gz21W1NRB8g zb}cI59%P#*!QE=Bif?Yhx&YT?^Z`OeD7ahQ6xuvsb*_*P^On8ZN zW-DGT{dYmY@Sa0ehNDZoZ~7BIof5Y?K7UWe{NbH>$K(2aq76f=L@LrV@qJRC>F7L8kh3Yd($d@J7V9t^auMZPEUCx-Ig-Fzt;5?c?i4o{vnc_?L%z-b;Stx4(Mnz2uC) zf9osX9jlLRO?t-v!^@^NTclyyUN7EJFAcl@BeY+hgTp)GM9glPa=<8$Cg5v8ei_^Y<-*#FZK$mt}ie1CE~DkPOYEn9hmTM zO!=oz%p7}6@K@9RW0wL9xXYs&)Ea?U{xYu@C&^3mC1&TB@7Pj}eU$#TK(SN$2PDgy zl9yl4l?+}U{=$_A>jU-G8@wAf*J9TI?1R)$k0lNBi{@q3YYlbV%C!n?rc|y?_SOV; zU@BKb6?PDqXRL!ziNxs`GNEEUf}zERoma_IyYLd5#b6-z2i z3mv>$HgBrlfca@62=XJVp1HEJ_TJjf+iS7lAy5yE=7>cYI0|IjrZO*%zVTKCwrnY{ z%|%iA%2&Q3LLnX6imGz+A_}iKy#X6vfxX^q=(=nW6aChgmoqM78Ac9D5aJAQ6-n+O zc5EhvZMeL5a*0UJ{5x~KWt$;9WvU6_*aj~SZ>aJ%KoG=NzM%nYFR*`?RWQWB5F0kv z)q!WzPOr?<^*cpSSD-WtZH>-D}e&6yR$6vS9*{fgMUdn;lO zY>3@;=hS;EMt*1_9&%)4^-A_y+R zZaTsXII? z!>@YvpYD}^RE|&Pq5ct1Kf?T|tk|0~{jI^wnO zcu#+#m;P0+zy8=OZ@I^RtDN7>V*KYw$i!a6_ZrO)*2 zYx3;>rkDRxZ+xHf@^cLt6_%Iq_^$ENv%LPUl=5u<+#jiy{=B!;Pk>K;qbx z{QV+@!!(f7Jt=}a7;F1ID7To;*}+FF9zraagBUR{;E+;mL7Yf_PgY?u=iUZWEavlj zaHqwj4oWPJ6Hm36yWj?kD~U&0%rks&m&J>Sr&-K1cQD;zQ!iEs!f{TYqzuj!%=&E= z%yxN1Z~^uS!K~ls1!HH|5(f#(`Adl>=WBx5HfII1c`rx5uw3%+_jJVMzfUlA%x~Hd z9|LZ7boK}?Mf_8OM+5(r;BmlzC%6Ro-vzUcW9Uzo#WucEa5?ZQ!L-M$p)B?sk@z^` z-w-?%_`HJ$;GCj$;aYpdmCzX@csB5S!E=C@31(mM_aM|~Ur}`IAv*l6ryI}VULa!} z*&@NMOtqf@0(Kz8jL%sXv;U~Wda->28Uu-8)3Qp4dBX`YV?&N<-o5d6oH6Wqz943q zY)4}D(G$H^B3)8;1y)5h;Q_+JEb3{Y4{ z{_fhe$;VBUZ3o1!L(sGXje?kVK>SW%mKV%rto$An@qY{)!$wa2&c(D3@Xvu+9^;Dw zIevLzfQ-Wy+-sm|pJ2Yl9B07-i#g7i_cr8>3vK|OD!37tVTDnEXBrnuGv>jd>{Tn>aa2X8N@db%K%#^@h>BOBk>^ogKWk|{U0EHE3y1uVVlJN zU&L=0JP~^{PSDX=!068Kx2>e(?@%ecJJ;X2a(EFlyW z)F}b36U=_#@3j~|8n{F7IAC657(W5{dBH5l{AL~Txxl}Wc=pe)1hap}@wkQ#o2x?b zYT$W-w*hYv90%SecnHTn$_;xDJ?WN>Yb? z_$9&XfL{~LKK!9z_Td#-R-b)HVV{4pSZNQ;zz@crxp=})G5YujGhmWEi)HXa=*>?N5)gc$_g3o*A3A{iat64TNIY4c2 zXanNOXU?&})V))5$j8ez^D>^N7-Ht-VOek`{y|1!BPP!T!7R(zd=~)3*gVN%UN#EY zX^?BN5mT2>?ZnhA7R+)fdM{z>a+QrU@zoZavaYw-^t&{msTXi)Pp#E4_KdffoNTvP zwv0Wo*|g`fBxf+r;u7lDSzJoY6A6UL0UH1^8C$U2K=UjZtgtxF_y&uo60fwll6aNH zJPv~@i{sc8ppn?-3k9<-q-H$p(IlAlI3gIk$d3fG9%lu!SqgccL0-1gaKSO)8G>2A zd4gF#-~^m)_W-`#P~VD z_Y0m6{8_<^fR73$|8s)L|El0P@W26OhMD1gFLi>oHr|ZAbrug|{CbP|`lz7TVsoqklY@sG z z%hYS5jW>1KWN``gc>;!T3sHd{=(;313S#LNUS^}W&JKg6y8nB~79 znC1UQFw37FSesD}+#h@^ly0n||)Lrag zK20*7Hjs{(m1k3E+w8;XCGqEeU*(=6|ir<&3|@ z#v4wY|9NdS^#xwWKA}GFUSQfm%xA9>!GmGIXu)>^PY}Ein0-NgzDJ)b_;bLs1$P3^ z7ffFUO9kh_m^#4|fmaJ&1-w!4e&DTwdH&ljxNrc*t>6aW#{_>K_zA(^1+MPH?Zn2U zUyrIaYnQEE_fX#+DAMTD%SV_kor{!>Rrbqaf6Ss4I?uRYY{LiYb(?DO!N{$LadNS) zY3=frtLv+lHPkP=zbdJr?kajw(h`g>5qhwwqNj|yD!AFJsam~q!$!~fjC!rme1>*e z6WT(`rx(D`(Z;&_rM`|I8sA5a>%S(&Sh}Jivr8EI^XL&tw;xq2H=vz1B+Cyyq@=jC z>9-Db^~-BEt?tX!4V~nKzHrp)9&KWDG&XdgBff7OcOzk~%*2H%XX1i4PWn*PVvNdf z?Mla85QBYS$D^#0pestG_9PuMYKpcc@;;^QG^`{=J}Ww64^&QYkLc zLPu+wiea0gU`{>ZX(uJAvCbXBreoQ0o3LI|>Oe}9l)f&wRg{U39)nsJ9v_aTrY*y~ zzqQL8k3is9%Uk9&*9^HY-mq!q#`;>f7D^Ttl)Su{W06C9nda!VBm2sfJXV~0IOib5 zHMVC7p*cMdLDk3A7Y8vs+C9{0_EPt;v&SN3?D$*5*3g(+!Wbx&jddPM@od(YOdZHM zGD&I0yQZCpQ^BhTBew$(<5iXsK99PBM@1ui?Dh3DjS7nS%7!?OjWSx^A@KDL?O|FJ z8_RR~`09Y~j#QM7IxgR2hYydXA>RTJx_o?2uEwUKd~=}Z@=XQbD^Q|+IoOy+`)=^~ zo<$tzy{RZ)k;gY^v|W#ne4L)3eBT7AYhMErl!Kg#k3o+(&PYfH-jUEA@?DCJX$(K& z@vTNey7t@V@jdJCaX2X7Qvj}g351!ZqPSh+e0St0GIDkgwxr#)#H1` z;p6)m<=chMarrusz;|>i)T2BCJ>ob6kkjDfSYZ3%GepSO;PIVCCe9O5QNCp!-)IbQ zjs@~viH&-!?=}oZ*S@m|ClIfqe1C{|;w;Ld?!7=KL_7(q^qcX zf9CPU$0z%P-)@xe%Q&`N`${m_)7f_rdaiwsfluw@D|h8<@%ZB4OK0E19^XGX_7ypN z6TJTD03Y8)s%U+0_WENSPMqaXV*3rpruIcWzLVgqS2EFKFvsIt4Zdo`lWznzS%smv0dGxt{}aAt)6`+9X?LQQ@$#XZvyzz*|)^w zd&S|4JAC(Mq}I2g7yIsko?GA34&M}qkKd@={#^~ee59+8gTn7xF5lY@-&CYCjr}v- zJKnZ|4}YO3-xTk7I}1KN?@oiZ^4;L^JqEJokj?5bSmg1Io|NRPbolDM>&(@-DWKgd zYG1W?ooN7{9=|i8toF_F_)5Tcw~~n-gVQ{|ZQv_G`~%o#V^h92y!vhgABJuyYTxT# zeGh|AkB@sCzQ6SNwt`PSF&a+g`KzBo=QZ$pWE^RX%4*S+yvj!t90sVE=)-V(

VVfnB#at3^Z1aqf+aTLmORqt#s zdW%5n>hU2U9p7vWB3ExvFM6ACe?dLoBT-_|D{<~On8xh}8TV@6)MD$Cn|UZ&k0Ni} z??=0wMLNg9TG3;>ESGYX@8{q{mxsbKDf2zObG_)jhYZZaW0vx3=+#+h{xgl+0o09q zl_kR!*}bNnhMw!=J8_52$9hmyZ#L}HIxv1I_`WUA&N$>vyRd)k%dZVh7whAD()e+c zV@CS-@m+cqOSW?*`1BE@b&g*<`qZ@=_CI~s==#IG`tBAVGw`Pe?-NC>@D{Ni{t}K2 zEBy4Z!ui9ZIb8>LH`5Q$iJUXJkr@^6`UZy+*(c}>6NorCNO!UN90?ceQz;ef(=EN!!bi)mtQ$VAz;&!6n5z}mst)sfbDn(G9!z+?8W zjQcS6oPBCEoY=4}=+K+hLf%vFCMu4X?Rr_wVbuGkX7I+7 z$lqVQYvsHytQ(B=d}%UVV3HWVMV=39@Nm|SLb!e1zN@R{U}D$nEe9Xn_5EYeM!D3L zMSWQd*7edzSJ!5-F&lAc+82^G4#2Oe5@jo{rV}t@HL|EP5DcS<#ut=~0c7^v8HK|Q zdWElNws%$9Hfk>(4xTePSOIvD##{sYz|c`#gK3mz)!%Hc`kNCuc5pXJ&hEjjK4JEo zF&czr5ljq%k#lc5H~p53Y4uoXc5nBb$BXuMFM51%OZR;GFPaMfMKvv*qi1c74k)KP z=hj2fmC^mJ>mRBZSvCU>dKbU8xO4GQcvbD{oO~kdt&E04uwdbqD-++_e{R=ph{uS| zsce4B_=?Iam~r&@x#wO>bng1X>2w{R7_os+73Xv3Zp*_DUR z(CN0u4TRelhA&Tiuk_rm+QQ1{yc+m`%b!;>cwUWFngciKM(L+{^jlZ}BSwNTy8J{2 zyi=Q$nU~bo3{ISDsks9F$>34xoGEcm^lsx~e&G_hPGYuJc=60G!nm7iz2TzC8*>&O z$T~iE?@iajXC}QPZOJj-k*?iC$4A3%=)Qb;B}+qHP+ZXtIOx*A;At7j06iHk+>$x+ z+=^ovJO1XvioMsLvg;7vp3!h_b46*{q_*g7=PLJ1eSTh zE?UrLb`fIdyrmuM`UlrIoR=_=3diRbX66=tCr7-4FI<$})S26i@y@eSOJ@PkTStwL z-{@s?F_3fK%7n-80dQwnbK$~@ebzzF-}@kK^29^%!Q`#4TZF=ju)gk+A(P+-d#%5|E|c31Tnnef zryA5pb}8FJmwx5?y4kfh33X*WmZ>$_MqS0UPehKi!E5XkC2M0P#-^!jbzJo#KR7X7sjqp!)_WBo(V$hHon7hh7iIp|p5dEtUJ_}VDk z-NQfh*vP@-C%-oQB-}e8O{;Tzo=H7*1HC1;HYe7@8T9(D7Z$a54ms8tL!EH=V#tpA z6$(7wJniiZhFNnj$wuyPRl8XSU=4SZ)eL}z2hQ1yr&BY&l);Sjj~tdcq981jCFcE` z$+&Rxf7n&H>4>L?cb?e1yXG#q>)!djd+AA|VOj3E>%N%d%_of>*Y5383rqRlJJ0d# zqf7a!3mZ-bP@g{H>cUwJ7yf3(lubx_&B=?vosDMwt-RkvM(wEF@y@{DlFNQi?jIsY z^d=WaY&!oB;{tmq{{{A3bJrF6e{kiuUt?Ep`h=AJ8eVh?;63LT9D5lS^Nbe5dz>3r zhG&TWG+?eld#};7|CoLf_x36byU(c%$34CUUYKirs!*SEz$t?f&)@SOG$H#wjBEU^ z^Xwn!h22|s@@@0dzv`98--xMD|8lQB{7t6{(^q)m?|R{Hs516O-{Y_H?BVZ9DSNQ- z_x4Zv_L)@sk9out`f2*g@cV{Y0Kj(${tV*FD1pdCB<_CCBMPXkD zd~ky>FW1DR;Pqg*UMk;5=(?*V#8iZg#umuoFpgMWcupXe!(uWq-X&AYu>~ZCOvR>a z{?Ziv%{CrW4W^Bw1k*-5rkQvay+AOjss+==2EpW5BbZhDykP2lQ80Cm3uc}EPB3+T z;9$O=p>3tuUxM}{rp{o&(NFev@FfO`G7!z+ZNBo)=t>_`h}H-w+%} zJb&v+8`yql9i0rsscm_JW6+_vea-h_Dgi43VU(_$Y{tX2CfdB`2=Kmw!gdc>SqNUS zhimn+%XO_@s_I(3Y*S*kKih?v9FzcOdWtC*-?PS`9;RG=7=@U!ERZ(X3z@}HD=*5$Zh zjy;wU6yqPn*pIqUsK@oG$!Y2`oUwM?Fn$`asTVNEX$)IXh<^~~3HT4f!?=LN5b6`N z%$o!=X{=zDd5d6{Ss|Eq&K1o1&KFF+m4ai~^Zf_;S@fp_$FQf+=EtyS*})BrN!Iac zU{l8%O|(64K%ejaSYA+S<4t`>S{!5iD2rKMzzRXA%CcU=o@0jiZS2PpGXgRh8{^-@ zzMOar{z2l{7=H!&XDTrp22zQQ@i!r!r=)^Q7;Aki60=UUlNi;vzt03_donNMS-)z* zY|n&X=4%(s`W+Pbng5w)Qm}v9@pRre1zDM{W0WKA# zhz{$q8(hkP=n(G}9A_k?4);F}K(+UL&w%<%X|gOBeFRFv-nM7VsFAlZyK@(q?W z+V}6MpKIUGk%{*ZD$4g$=(&6+!B-6>^6}A&Y2l9CU$@5>!wt}OD3K4- z6hc1zHmAo?2l!?yndmY2Yp?wdgYOl@laFsZ)V?>p_WMup@tIXc?fZL=Zyg%#Z77lN z8f?n<0sym*$3}S*gME_2N64)~_PpPs48|a?v(WrkJ^Gn(vPU*?usfn@YoOZj(ap!D1lCm-dX;@1IC#LG*4`IyM16m0F1x;2JBo8Kd%KfLe2sITzT z(0vDr+q=d^->JbP4n7zmroAhEBFmtq9W7JtX_@lTXioCOfvLwFDac=3HO)5>ZDM|( z&0blwvaGgZP)ld-7ZxoZT=)#W0e)(F#{isvcMOXZemZE&%4qM*I%d9Km})$n_uY3Q zJFbq542nB*r*vjz=R~48RwX(FMxeFYMrDl*wyZ)TR1k$#A2VL%XTpc`+V*9Xv%eWd z&0WE&okz}}{UMf{Ywwb!8F zsWbZ0eT$3CnyzNi1bmFS0?P&A>^`J>S4(%U{YG;l$J+VECDBnR4S{uEKiSe5tv$_e zL$BuGyBSSe_(smkBIG#M867ga271}7+|Fzpg^aIewQ?6o+_;55}rfPj-Q)}UjD=%nWY`NIxI%Z??9Bbz^yHR-WqHsRGAvmPWe7ozc*wLD7I zEy0!@N6!CvZep+wK`h8@>fV^QBZxEHxewKUD^JzT64$K$PdJX- z4iw*=ce-{~mnLgH+wzK5?c9IpKw?Q^|M~-o{WaK*9!Shggw28_P_{iD?A~9t^*8&D z6nEDu!->qwW;DRVd5h+@-8gjBitNidKjzf>$hiF{7d8I~OO>pPV39%FaQiFvVv)bv z>$;PC?jF##;+icxu4`C?nqUZ_=cA)dJD~$!ylT~o?u^1G!ZzWt%o8>m_U$WG zpLH~AVk5^>;rQv|BJ^fS?6#lguiCx^^;tBxvf0VRX$i>k;9!j_kD7u(UNC6YgB`r| zqO6(IP5SZN*E^@8e7Q0$%(?9Nv5uCO&iLNL+c`24ovr5*ueE*;3wfTyN>qop?`lru zwgz3DQ=c~p@*}0-CvJI#Xh*;o*Hm{#7c@;k@AuIj+fr_eDp2YV3sv9C(FWYv=M{mDm*5y z?fY3nwq{?3Ws@#%$qLFZ*|$HZB`c$R#?I&dD*A!sG)>x=*S0Xj%Uc`_c{Iu1b|A8< zOA8U|zbnsSCBXc?oPp;?3f1!QB&Gh?Z8&QD(~tQ=$iG(V%g4BUJfZ)6O8Cmiot{0_&{JXlMtMLU1>&;LzUk#3?bYWa z(jH$nd?Ul}%Y3(x9~l!#V6Q^HfAaFH?_=sP{Sq0!d>51-xi#{CJbMmFe=arYw?$^+ zIa!7I%O(93a6Ve&>r!5Y30FjZ>gjiS{42fwZT9pJd+Ehq`a!R~8ol~n>4m>7`S}}z z{K#Dq{svlw^$Em2OsPit-6l!D$Fi#YuB)QoV@aXkW0}1`+LV1xtVIOHHmA|iNal6p zo%#eLtUiZ$aD&C9=C@M{j{*I@YQFa(p1Q`KQfk<6fwTc$%|wW`X#MVI_~pBw;b#Pd z?>+eJNd1^#NeaL9nYzdrFy+cA&v1@ICJ5hm1!V@BF&B)tm}5@Ad-MC9em@)ntmAa7 zU~=CpnB2<+lbgpR_1S-W1(TcaWEoFxihk>6bI^x2#n{XjRS;wItri=bCt7UAg`Ap= z%~BU*v($w)vo7~wA0r-ve~=PvjGu?SY1@H}weKqR_li6h5wrZ;1hf1~!7RT^~PA4QKTQ|=u$j(PeTC)8z~wQb2;z(EaRJTdLz;Y3XR8wHcwj3vY~ z-_sILd%h-^9F#!Xfn4l6<~4RoJ8-xZ6l>Z&T`_HI`L}-lY^q`N*I1LR3YLFKkzNUX3Wqq z2uzCG{DrsmyNg&tv6> z$?57!7aIpv8?ZFvhOiOLM{^7fEaX_Vajlu`;w4%OIRRSzQTEe|HJdgzti@=4$T;0v zSy#V?jvxD+*^$}`{Sfq1Jiq?`7Ya?At)HTtW8uG2WG~sZ)>4EBd`A!11F|TfO>$#;TgS zI`sI8kkj;sHPnrEtl3zT)aE6wZ|9jf_cpG5K;0wub2O*;wd{QsT53C{WYP{q9nEAT z*STdl5zwil@m-l(Qu@?>EY}l>aaozlrzVj%)$%l%`YA>(=O3z+o_YEy1V>^IXN~Em zU8PngU9Nr#O3o6y*cS71^ie=RbHG{njpeB*A3o%y=xv8WI=zF4cljReMeh|)@3CI=mZPy; zz9*okHUWmX26~K-GZON?(;t9geJ6N)2azU^>_ADrn?1fG5m_h_pHMK z7~1!u$H#Xh%7@3xknal~-*Kd+v#-tLi#dE8uWDbN*KcfhmaC#|Sp_|}{YHaN#~&Xn zm2a}gcN%H(y1`H?-z^^BRPdERgU1`+lPKS4bgtXKSqPwNp(r2c0TRb0rNOB$-*GD6 z`@k+=6an|^jq<%CdE(epHahhkim>wWyyNoG-gNDEv*d|mPkGegWBJO5W=Y|j48AGM zAfooMOyao2b3R@PFx#&PoANEf$%eY*rKs;98?t)D_d?I*>vr02IMS7Gq{p`ni(1E5oMt@#5*$cdO*{`QDRujZ4CI@M-(q;_!7r&*j?&z5*o^JqAyBe7hY! zzHe3g_IuaM$H2$)nu^xS_K@Xu|(5+t0WK_b+nyoZx4ahw6j9PsJ!!Ecw!_b0f> zyL_DA%zjf*zNet)@*M_W36$7=e8tT)=G)@&okv0i;#H_e+2rwcJABkvz83*p`^s@% znr#^DKjrHJAdXAg&%yT!Fzve&8`EfCJAliV03W{zs!)&eMF8SB1CZkwq`dZ!?=Eai zBVQrf+2!N>VaBT{-(aslp2bDH1WM$aj!pUA^V)Aa_;x9o=rQf>j#Fp^{GQ{l&Cd|Ew`OApF zq&rS50%?}JZidG6F%vVCYSPQx{}C%Jq-XTA5n zlhVt)-HA0p^r~Z+RmeGasC(hJN){h_XwTC}qd84Av6**HsTtNizP)oR(#^2^WM113 zi$|_!|2G%jihkURnR0Zxg^uXLB=fE1QH*$~=0w_##Fn%ifiD`PVx|p3scG2a8mbL3 zI-vX2Py{>COPs@P%4oZGXrg9U3uZ+7ncJ^3C0P1zT?_iniDp{>jR$?pH3(wn=3K*t zNwG_=e!6Dy+?JwYn47z3ea8SjzS>?YMC8*IaAMPfI$nuvT0V^WGUjVAf^_couRK#hYlcNLebk84iqVbr#g}p=XP$})hyGa?F`0+8M!c_2B#nUBaJCF*Kc{ItElMp zqS*P@+B-MHGAX64b^wf6*KxAF=6ZB(4qirVX@Ul^_ThL;N#7h+w=u8nflTB<14l3A zIO6=;EiJ1`Pi5HI`eO$0@XG5rYFh&bT~7A<7m6-i*zubSW3s2cd%+o|3UQp!A0Kjj zB?Co&=((7K&0Ng>=3%Dz4N5;B(^L6&KazuJ78x+jE-ZE`qeSKj4Y8z3|mk{WS_%=Vv9?$3x-=fnz+Q`al|7mW*vhYEG{R$ z(c(BU2_RFk1tSeK?*(+uFpC8%CgJJ);FTekjMG@8qNstro&wH zTp9hS=X|{W@1353I$hNC4AE2jFwsF42escp`)D$DPuMQ~Piv44P3F)dO*5yGX_8L6 z(6G~b{m-{RffqI3LiPUtO@5H3_#IAu=&?}f#m#jPLsF(K^!xogT_)|IKIb~9lJiwt zxYEo%=;JGY@0t1;ty&D6aB_v&jVm9pCy|RDy!{aLQ@lT8p#Lf+b768YSgHyP-acs6F* zqQ{qT_*ggPdkfcO*S-d%@mi~*eAIFE)*+lu&tDT{GxU^$oQnN5K@Q4woAt%5Kxp5; zqSM@Rw<1k$#etH1--jN#FDz9mNe{)sC_R%$>lrl@LdK?Oj~u6QU&QmN?D;WE?u78hi5bev@hB^XHS~V*D^(Mfu+G_;!P@1WM%N6TkAk z3gFtu=dU=@Rj5bl1|W_z0D0Eo<8i_?+OgjoFY|k`?{nUGIqmTAd${r~_xP%Nv9HGC zd*9*X@fq@=vTl73f^QDeRj5a)ff8|?0Z0tr9ZqA<_T%G^@>O_zXTitkU=`&n_xR3( z?|mqdFNRI|8ju&N;rVYf&LbS3D$2JEdc<)__)j$cIAHP>V^h96JwASK<8!!*@_p3f zD;b#ND}l1|eOJzZ`n`zf^*SZPp0;yi9QU+|G72ZXbb5az_F1h+gx`-`AqRzisod{H dTswur`chPn-@QN?%5LzTkuuQarXFn1{|C;h14{q^ diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libp256m.a new file mode 100644 index 0000000000000000000000000000000000000000..fdd57f31859ac785b818128ef912828c212b77a9 GIT binary patch literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=sXy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k literal 0 HcmV?d00001 diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedx509.a index f500f3150d9f3b2d5096a8e48cddecc9ebb479a1..8afa0724098ce3a9955a0dfbeeebedc44e42181f 100644 GIT binary patch literal 179958 zcmeFaeSB5bmH&V4y?G+JC}6|@L2p99009F=Km<(yV|Y+OAVmgEE+mm)NMaHMEw&-0 z;fB%p2rZ-(DME)bj#9*yI<}<_ol?hdYps>v=d;gRH#;{0{LZWM zn(rUK^~%nE?{(H*`{C@f&-1xyEceI4(_6aV<|ND-IRTE(F3J*MYSj+SkYM@tazZPa!EzkOFEm^)COy7gGJS~Xj-r) zxVW~nNo8$i&~50*Ys zR9pUNY0<*cit6azW6g^eEUxZYAEPa2FVsd=N|%%^sasOhMNd@L7A+{PsVk~`q`Hfx ztjdzw-~&;M+%;RfWd5Sk1$F41x}whA%mGn!X%jONqMQ_U>ejBTI<~&NvaISdMH!Qe zG}J7+NK0$$YRW4gD5|S6E$p;z>sZ~=%G&a(%8pf9T2o$E+EpHRL8p=Csw2*#3R+N8 zfvvWzs$&_h*4mcMD5SQ-#u(9FWP4-=vnbkoU6*Cn$@YJdg$ovzE_kr$BE7i)1I;xs zEiJ*6a|ug~=bF-os~#*Z>0C3nEek493rr`~bDq% zq@z?{w6wf#p*rbY12;2jSX&pYsSD1ph}uS2K!=$&;=Zf3gWBqBSyWlIpsKok0*>Ts zw=gwB7Zxp;-??HDvx_Y1tmYQBAXrq6!M>!6R%ky~R#jeNY3&k>_^zrWYoQYLjVijf zrmI0@w4FvZv|aQYv=?ixF6vxnB!|0(yXr^TO1Y;BRu(O&TD&-FfVl=;uH*JaohsbE zs1~j4KTTzF0cC;$5tzA-D!%giHM(V25Ox~rh%UE@>fA8o< zc8fK^rI)DE!@-L3lJdIGQ)}#lN^2^Eb>$Dcv+gClnyKe99X~%@K>;Z+91c z%+|i7x^!_@UE9?*E1A05aN8GgJGl5LM_w9SWZ=ru%MDyHyX0z*a`kyeQ+wUII6~^! zz{~YGTwSEcv4lN-L-fg*buQKwjvA@j;zZeflm_cchc6gjHGk0!Mip75T_|g7RGDbb z7$ilX7ds0am6KzN9C72A9M`5e@yoYQ%lCLZI2m-sVh| zV)?%x)o;0Qq5g#n7o4q#w;_h`v^E*xT7*o5kqG}U$f!JLOKZN@S+-~eIyJ%B5nnju z!q(RQ=TW&)E1ZV#(bZpRNeHEE@HD6IXzJMzu7519;pDd7_jYd$ZwWtB@8(+bC>AuF ze7^Apr!~BG+cU1VaP?Afv} z``g9O1zhd1#4q&ivBT#kmd}|U>e<-aarVWi>QD@O@!iB@vCzf2W`(CdZD`%SI(Uk`t{>J)!zCf!~a!udXQ`V2{(PE za87r+*yr0JZ7v+*4|x~%YhzS{(c}*?cP%yWIOkPKf!}O} zdi%b_9Wm))S@G#7whsBuutfA(p0mT-_Drfj$t{fo$msmueZFHc@5aJ%%}W0j?o#IH za{0AU%X^=Q*^=ISb&RWSZIcdf-Mn{OtLR#Hhg<7w(hs@GL$MqWJL2bGpW-TZ#Jllh zafM4idnCR8`5}!3jeqIxiT656o(RQ7$QPlQ2+{SZ%@`X^GamDeaGc%^x9yAZ_jUbm z4Q@^Ey=UC9n0->mQ@=nmjyRFj(=12E7B#s z`^FiC7Qf~bB-_H>A_hkv9T~1?Sx23yCB3J77UgT~-#hr~J@!*HH|~edHwz8(LD{6) zA9FK9c`YM0hE^qe^IyC0M#Hg$+?N8zC;^T!DUDC;J;WJ#YWuR0gRb#5KJFBLf8foY zas4r7>1)2uFl+k8#X58HLY`xBt7q?v#UeNRnkgesz0l}&LV2sMPB^rW^Ks$hX_jtTlu3 zvAVe3-_vQkkHvOhQ{teo$0obmC8&RrPh!wh!E#ED}AnG0&FYHRDNsw#%vbw{AI zwtCozn}&}Zo?SFDdn7Jdj?5k$a21XpH4GrYhcky)eu71ld0}Su%-f6dCd|Bh+U!}k z7fqWy>-Kx{rp+9motQUaGXBFDVs>+g-Qyj{$uin@y)M@{MV4>3>{u>^K9uQ4nRzeA z^s6@XtqgQxcwhrbK=4YeY3h0+q$Bj95<;Dd=4E}DmoZj_vA+p1h4$oG2=vp0KplCV z#T&q^7nf~B=#D^}=MlJGso#cx0|}$wk2q8KEMmX#M~K-c%=<9{g?Ux9&ZD64A~0Tw zK>IzCCi7T|N2lcesF>F6S^)D=9{?u{=gxaw9g$R_c%AF29?HKF2z86fPJ$VoU{d^fg%W43#JnHu%Xx^WI zDa=d05rH;bcX7hFy<>zn?4}z!ch(wI6;7<|69P0JPlSg0;QB7fy%GIq>y}$ydPu zNt5?#ux=L60-DU-F7yC)&J9AT}Q8i@n?MQ1!#XBr4mB_ zWX3G_O-oN!{b@^2ju-oX2kUxyAFO@y0a)vE&eDGfrqC~$doPyz7jTlW7n6_r^nqz( ze1R#|68)sJi>vcFSG6w$`Ow?k<|v%Yy{7j~ z(){ybW(`P^+n(3Vw4y-db5fiMlH^?HMcNjhnMv9;J~NZqX`Rhnoi9?Frr8_q;xk*D zowj>}^^uh!CO*^CwmsK!yZ9olcXd9q#_Z+X=%b$}pM@BD<7tXg7H+`*hR?^%b^>PBv-y}^N*0(1&ED@%! zmo&GjUKl^OMJ=Blm3HJ}mm8bg4Y&`B8{<*8Dcrm0=3aSKO_6;|++AXBSay-G)9rvF zy*c~2Z`)RtmzewKQI|}SG&eEJYN{4@ypxM1Zgn1Qzjd=9SW!{6z*$_nc!71BX>t2q zw(19?Z;b_OD@Pbdb;0&K;SnV+kaxH!Y%Dw7A#f|w@y36|Mf;6^)XKWM?e?g9AFXsT zE(S*ma+jF(^N)LQA#$&+^SbJEU)8NZ(x$Sud8xylv@eFa<)NQECrfw_{5Uo~=|jnD^fKKWy|Agju&KXr0De8frvAdF{<2<7 z-*O?u^sTfp2WgM+7_#)qIE!;Fo@8->#nUXFP8OfDES^JVr6BVV)TWp${a->3;2&fm zg4$GATuqjG)>-;xWI54WZt3eSUPjM})T_{t_8}QiRn{qu6Xj{57#j71sWITJ!V`A}7gwb%uK6J&X7^!ut`QBg0R&u-2_F zjvbOQ-m($1kCNr^n4EMy{y}&yOq&2~xOvcq>yDhnia|KMXfq1&ZNjv_!{U3$$eVze ztp4YS4X+_QC^lTDWVLz7vf=R|{jiSYq`~+H`6`0e^C>cHxPHk=9DtB-A*fBO#oNiS zPeDvhV&fpY5NN*#@hie?*AFdz-Qwe9_~95JCuQLu z>4ThfBmO~Hb?Q-V!`jB%M9=z?Rd2>2?CG1V<+84<8|Nf+y_1Xqz_JR-aKdxg<-%jo zmtPYb`rjl>pDze={IroJ?@vU}etTOufcUI1*XhT?Ecb6@$=jRj5f0fW+%~Ac0rAtq zFC%_cnCA!wg!jV!1K}7i@*}99Ze;l3^_D)u0mKYyGeGogJFmG=&o%u zFw5N~He4^Sh@RI^-Vx^YlQU%aq|LvJo@MnwVBL6q<2KHilNpAqIYhu>LxUe{pVD1Wr{7cBc&n$3&^m~5mx&L#ijvqweZ7; zYlZ2@?6ctWW9S~I9)89M>wL9A>_0>NjM$75R-3J2!}b1>*yIYU4d+ePpWDID$S7-) zu-d#SHuUo=u_+K%o8MSAe-xW(h{W*w@?$U8?^_nS+_hSz4lEX?Z#4Z^%$ z$Fz=t^)yPZM^*csv zI9H7qE=N3t4Es9RleMhrV#Djh#lp;6MTY${*prjwSp6%aUk*K4{j8xL?c&_kEX+CW zIWqjz!=9}6JH>|AnfD7HLi}T4j`N?9k$0tV(kKArO|dzHm}RhB&Rw60eF!#WEsHnz zXv6Ez*9dc78cBx#HLxcqapwjZD>j^Cr;5#5=*c=?%@iBXuf<~X1Z>FaXOY+}MO-O1 zEwCZ$zO_MYcny55*ldCgS@+A&h&~KGS@kc7{#oeB>XY+3+so_WY=idCA&a>kQqS$0 zfz0{&uVnPe7WgD5@t{@2)6<0nM4nzQBb(#lL=HhV$CGT(36SL&DU&S6LfK>-V^GE* zc$i5<{rizt|Hh~I&!ArX8$aTI9QESAfGqxJk;Q*8S&s3zy(urVnBz?KYc1yb(CY^5 z7v+~M-f!_yi%(kozQyM){?y_G%meD5^RP0Hag{muD)V?td6LD`$ugejS-jBVI*aQq z=CxPN+hXyv7Vor}bESs|s*uALb3Ro488TNahk0Tw-yx#mg-Yk$bp)p0GG<@pg-MTYS*s;})N`_^ibrS?pk2({lY5r&yd} zakjL?i(j&Mzs21DY2K3-bDmNCd5b@_m~)WY zBwHM?ILqQO7EiKxy2bM>UTATh#q}1ivAD(JXD!}o@m`A$Tl}WQXDmKv@y8a&V1ClJ z_pmtC;!KNkEY7ufn#FT0F0r`U;^h{HEPle`u*KUg-fi(gi;r7;+TyboJHu-qS&X+~ z5ZCdo7{m*eYDz1D!z=KXNKLR}xO?@Sm)SeqV;SDTsN+kDUEOi%Xzx0WzW>tErlU`D zjs8*wUEE;!9Om{-p-Y*Y+YFa7Xun%9ybe#WJHy!t&hYuQwT_#O+Dmt)vFO<9i}$4E zuIp~>!kg8HT`aw52VUH^bMJLwD_vK`whZssyhx{U5RMo=!tSbzSUSV`k`G?qaE6-~ z`hvsF`*v<0qlYnU#S6Q;rmEWAoqVqU0a#&|Xr3ovh8zS;5fM@5^<;9cED7LPh`ZOJ z2+YrAOy4f)IK-4O2=u9<{&JzP{bj))k9+73({se%60lvr3Z%0TRMa2aZ2LP5e=DJ* zKTH7;e>{h_{k6z4L`Kx#6G++qrr~%`+sn&uT*frdrEPy~gZcnQ_y@wdR6^!h{&?7= z{(cX({e@*2A|vYieWb{_MvHSp%O4Mo)L#mm+5VozvJ}a~h;|g-U$^~L!yk`r*?&9~ zQhzr``P++S+YwaMUrv<2-SEfbGy1y{LH*5*^2g&vTQpfLb{rd&i`kXIE&r2f7h+ioq>-2&_xk{ zKZ^3lV@CF=iu&6VzW{>z<24D^PcDHwbFp9?(kfiW@Xe@lc|6BwJX93dN0qw; z7bHK%#KLk1AkdEOcvbvy%u$}j;8tc@%WZ=l=OvXlVK+t-h-pXRwG3sZ{g`}m2_m}e zUtq^NyJRx%Md~cpGQXJISpRNzoFsq@%pXvleX>hdcxu2 zaJX*Q8^<>d*|}kU(uTEbi|a$-wQK8kX09#l<1GJB-sK8;AM@5fzCQ~ue5Idw_qjed zHzzo$@2y>1f>hbyq5WDm#5W{3Qx7)9=sQ`%@REmlaq!*ML-O%{PJBypQwCl&i)h!RrOK%8wOF!|eReikqGo9TlHk%i?+}ac#xvFKvxCAU}{Mm)jj4^rX z;c(ODv18Df(PO-gcR1);|KcXTC4|alx|!DW&A-wKZEoq=l(sK^V`zt`X|pUC!uMQ4 zn^#?Rga5v^0~uDHqkBT@(y%W+>_6nefI*idre$p7FsE>SlH1lH+SUxVwZ)tN-3uqe zt!VD_AK)z>?ZL!lXzsC?)l2uqN0e*&9=Zm3mZo%XGYPz%~J>)@LmeLm&_Km+d)*4%esaoTz3s`E#%?jt{8IO5$a{~9p z?4B{MKVI*Ycl9v17Ukha$dp63auoJl9J?_z0}qqrJNaj(OB}&5%a)U4iGf z$?;h+6W%->H`3V>?_WG+N^7Ds_0ZNhyoV}Y*DQJwCm>Vu`@mp#@2!LOY}*UdMlXBi5;ZU_Wfb?LD?Qam}OiPo2(3 zkK$(cPd@Yi)PFAI3I8p3=cdQQ-^p9m=Q{r{{C^97^D9rKc;jwxTH;r4X#VMi)^1L7 zcrM?69O7iguWo3H59s^0TVuv2mL+=QGMuv8uN#`KFK2Cy8I<^?>>I=QJ5$?pd}6*i zuo#z8^L)kgnckY`kB?pYNX*byw}D%ex6YWVoH0J}LFJsSd0$hWbYJ2N!Ywnl&ho$U z)Ght}{o2CYoIbhEYn$6nUmePO{cE}N{B5TbU;o;zg9gVhf4I1;=b_$C_0HtfpPqYX z9iA}2&6}kSslRY0qz zw|n}W`P2U?5Dv|s9tsrh{v_!uYeU%Z>g$W^>+1@4|8-cLc}Ka!eEZIGeFn3~MP zF@iUK?@LTS@%G-iQ%@aBY=8e6#cbOV>t@Z5!#g{1c(D#o84Q{elZH1cmW8fjl;HPb zFpUc0ee!Vq?7$9;q<3T64oZ=adDBn5^J!uz`QDg0@#DJRo8i83S^a$b)IS9ljczOO zp6J!F>EVs(Cr+&7@2nagtSSAHsck>0Y?Yte;fBI({6w2sv8dACSVHwp`BjW zcKs12cXebXtXYQsNI&sbT#FN)w0~QA=*H%7@A+ZRs+*I7Sdj_2#lsvw!vGeQ_(yc8x@MZlFh~{;fxy^zStv zdH~gJ^ZD_9d4g-O{?X62eP`E^Pj>DsKIZXv^FN)B!@WICs~fR{sXv}mzcTN`!=qQ- z>izI=_J`9v4aY{meXFZcf z7V*tN&xb*oCe|lV17mK(ene18M!Ef44FgwtR{f zLf|GLos{J`1(J|q+1 zm-WzwJoe-cZ|<7`RC9&f9f_XoZ8%05qp0lnLh7t@sH)(vws=g<6jC*(O=&^pP%d{UN@7)rw?-7v|? z_n@Ym%yg>j=b}Dv=(F3iHRf;{W`=~L{SL)CtGDBj#Tk?9Y}*{(5ZDmYFEpqC+sg0y zpC20MiH(g{4W$B?_kE~n0l;1$e z{FrDsLYr zw610I+ED$fYp^5R*m~+z<1B|CWQelEF*5A1UwP`Jsew7p)G7>#!zm<}H_g}>Dj%^S zuW6nC&L|i7`o=qPu@1hOvAHQ2TDRe$CcFT@>YBJizrNrUe$qW_jXz2E0$J1cd8R(& zHo>3RnC(n`CTp60G~?@u{_?nMqE&-&h=+$wEIa?QCSR!6yNS(*KMnsi7l%-5e&2BT zyuVNV#>bcMnZB)O?^omeM=_;$kNeF9J0JY_+2Ava67qj}Av1kyEejtUIkw&1+h5Rx z51-(aVCSxS{Zh*5BfCAJb;siCU#rJX)UA8(#E&p;Ae-?HC%)#92ITWt*$D3<@Hqj- z{Sj_Qz*r4=%L?MR)T}Vui#fJD;BXGZc}3QmU12BUyCK%;H~ZfBwgWks7vlAt5 zAG#i!cGH2-&zoKhZLV)jF3X(P<3*eoWV(KbC2pG1z;Ds~YE@tVmQk+q-ck8|9c@i0 zV^d}*=iJ%U_T%H6?c455#Cg(-O);SZ8*mPaqoo&loP@(=bHaEEJ3+rU{lq)@yq=IA zUXQJ%5#NW1AN>Pw-0=&3oK|jZ%7Jq9lOD54a-Q4aAtr}ywc4AvV%uwM0e zcYH4dZPdE=KVNd!%)9v2(VDUaV@8fNn25;-GHyv_?UL&1s+zjel3N{BE)G_dRn;uE zR8@5gOKX@hFjlRYePOVsWNEObG_bg;WJyJ7pt6%i2P=NklL}YH25eW!Z}Ga!gYq}sE3*)CfX*M-Hb`JpFQz*VZVsm_At!+afcGo z);=&^wBbZIyKDBuSoWX(ft(c`I%qRvq`hWrMx=uT_-oBi-~ce~DqTD1&W%ggrtgoN#Vk?A>-T(O7x;_6 znhLh2^}2qnH}2mrG^AZsHl_cE3EuY-JUCQpNbn(llc#;<#og?b?U~n{aAm}1!-3|6 zD`2(Z#pZC2+;(y%_r7e4Ed*GhTu89}x!D z&YU?dFtMVXx5wSY%+eZsy%LGr7YEBL5Z`S+1ss@(*Ix0xTqrPK(56H(Ow3c`fWeOT z)S3Ou;+V&L1wI_(jqxrm<0%}zB9#4%Y~B|+f1BpOp2yxdK2UZ&vf%L8x59Ml`aL|p zZ8&_P-aYL;{HbdhzOnubWdl2!CjQMng3SCxeclo6^U;qx_ze9e;&XJg&m;fG_IdUr z^?7}?&$0j2!DqpT5uevY`&@nA_POPc>NCDdZ$HFikm@d#wZ0~gUc zn&mx!hk3+?>52HPwDAr%6YrU(sNMp1S5`cNMUzTh?`|5$82^ni&{+8Yj{%JT_~>zE z#z6b{PxwP*T>Ygiz2k71@*nnaS@?n3pmem{Iq4?np2^d1zjM-vQQ6MSg1iy@H*#c- ziEbLj2p@iAbkhjEeQWNG$m5%wt;{_f-Xlpv$fV+b;oD1kzeeL+)&r8^Mv>=UbUE+G zPC2>p|JFPM6+ zXFdi%9)Uoi4VlkPP|tgZ6za*0spmeQ!ZcaS`Vy58>d9*mXrCx6gnBaX`%pgs%th2^ z0H|Zg2YW?d0LEoyqrZ#B5ZaR&)2`6clX=;n`g_HOK7*DGS?j#W(vvwRX#cdOC$lW- zp99l3(_6sm=S9n&tbTrD>B+noO+S3jokBlkTqHGm^US;GV^NT`>$H@%QG4H(y6xxu}5U76?fkHi* zB7`hP*ta*u<#ocfap6sF0lKLe&PeFlMLc@g611VTMI6*2v! zTY570FVypz1@n=y;Mk*{eRUH8eKsQ8Ec_$HYSRYR z^?MAwKx|ka`e5EMR(;6BMPFv=$-0jCJRBD>e+7W`rJqW$u8SwYoMWkPp)rK^D%##` zD43ryg*IgEH$JDJ{&T^UuKaufdfG8&akQC(pmn~_(%%o(d37OJx37o5S{82W80o64 z31Y{XLK`xlX-r4pdhrU+L`><*&-KvLj)g|MxPJpE&6$2 zoqraB`-}doVEh^TM!>bAe-^A`U>8{X_5h6`ESH>%n051@GSrc~fs=*#{vx*}>ZgNy z2p5CZej%8`G+F!eA@CIF(h*(*vuN7v1#4cue?wtfMaMSF;$p_y7PgNzLUNrqB;r{r`YU2=!#vi{TXn3iT@5x0z7ThOzn|E;`nq z+Y6gzQ)olJ8i93dMW9emz7B!<0|*`j>e~c=E+K~Gprj5O? zBu^0iDKP6v`*(%Y!Dqm_pM4)pp^b`;2d0(nd5LAx508&1UFGFEq8(!jZOGi-n0E{U zg?ciN^Qh;%M4_G>K%o8`2s&?k2TY+2S^MX^R6?jHGiKhG5xkP#jacmufGM;i(?9J_ zO3b{c5Gb@!(LQ0FX|FNu?RG`m+kMDo^hq7JTju3>=X^>oLg1>QO)-Lw!#c3)mw?|! zU>&AW386jtCdBl!!qSs`8}}Kjn{B*!E!{-ANUVKd$J#KI>KKq zJ(=?WRaejng!W{{wC@d8|GYk|`_No4_qDXSp9T=-QPDBLv@-V}EQ_)BE%(b5<|S*n zd0^fDR)7a1u&gI7{eH0Oe{boN(NU@&57s)DfYm>bu_;~E`G2dP+Fl;Z>3sVQtIq2$ zQD?U`?td{eiO%1Q9cG(i-42gRa|>t}AJ&%kk-HtUciP1ld2_?n`OKM>y_~t)#TS_Y zT%FIXb$dBSaJ%^Me3&gh^QEJ9jnBzzPk?;R#HjS`QR)1sbU{>la#ULP*sj`#GwT$w z;5O?qPouYI@tLbicKYu21juL3WZG3eN6%(loiB2=QPZ>AjX}Q1QI#&gH){FZsPw$3 z^!-uk;;8iesB}qGx-=^NKvcRsD!nKw&8@jze37eFuFmIFwJ!wuI`ywTy185?AIbGU z{|(@tQT5{yO1t>XjB2O3*K8MGhqvKae;%c@i!bUe51%dn8IVnUYL)*B-?1kUPpuB?63-jNJDEmK3 zI@>J28^6y%Yxn%G7v{TkNykIi3-cYnb3t*_vz$4So&a4hoIyS;Y1**8>m<#YxEJQX z?UH6c_HyPr$D{1umNbvedg1rSK9Mw!ReL$bP9O##LjSi&n#ZQSocYdulIC$uFQ?S0 zmo$$VdSUc#k~H_ny*PilFS(h>{b|aP_%w5!GjZk@W=$-}7@0k)<9CA1OZFG}CUQk- z)Q`&2xcx)P@|(_Gd_q~4m=6(4o=B;-c|;kpy!a0)NAlTUfR6qgb;oZvN3vZ0`_K#I zlhk&b%(o%?Wq;8*Ql0tbb@(m-f7Z9_pPI%O3p)Jl zrnWL#Z@xgF-xG**A-~elK^gg3X!rZowUyNDvG0->vSviaXYj8v|?kfAN#n9Y2z8*0LFx`m2*&|M)cvini$R%hsl*wWSX&DXm;k z+Ql#1cIBXBTg(UFqs!>RZE+6y9{huFj@G=q9-w-jqo}@9J*6yO zBhdDmdd`9ZV(KXzK-wdR+{Taek7;i#t);!f#*eV^BOHL8euK=kSM;X6!t~{t!~gE} zCXXDto3==OOdalWZA=~h$z}f6_HuWmZ1i%7YV^X!kFfD0Z2Cmlv_;soML0nJ!lo^9 z3Srv93lxwn1Wz%^J-_#eJ_l(}(5T&YCwjB)gmY;#-?f=UUf^;8xy0pZ7EdQjUM|(| z)|vLo;kfBTVbgYD({{;g+HU*d#Sn<`BkeVQ$Jr) z(6upoVdG!e_!l<*2uSEq7SfK;S7s2EjE29Hl`1SO&cicUh3Wr(iyshX9lmMtGnUPFE&Y2I|Bj4u zDZCe_K|TBg(bnh1 zhU1Z(#6b%A9)i|quW%dUA6fb%WcUvtCMV6nKge+e&C7dEX2?+der-j_o&y&C`g( z!h9z01&hBg{3_y?g<0-FGRhqztmPgNn~xFmelKk}PRUyC8L{~d;tzz`Cm&k;H(_og z_z7y$c5WYu!mNXtH%0;=0}%K-6Y0oj<`B`}D0=kk(y-d_ zP6}MBymQ5EkIZKgdXZtzz9FkUpW&hn z{@iU4HUZ(J*#Jm3LUMQ4=Tu=n&u8Wt=#N2n6a9dxzm3en0+}Gp^*&RW>uUiS_IyT= z*Qk|yVHuh2GV`|h>@Rw5cbrFP!?8J3nC0F|M!9SYS^L(kYuIyr@$`&&8xb!Su0>oe z%)Y7@rp;F@{Xdi8zXxKnegl1j*nAuDCSm$vnq{>ievXX1T<>Jf`(5f`LwmE{!N;Kc zSL$KUejuy;uSC!FNLIa>pJ5+>j;#8>fa!$Wq7da1(% zv0*vnq`UABG6jJ)YywsE!|_8-lItPG)Wc>W;xb{jYq7<*k&%&O*lZ(mYnrTcl-Wka z2Ai>y3>&tQtTtn*hYjmkAWWYeAN<`ZK9i9pyaUW)l1ICKZV^U=I}@&b8*Ert+OU8A zS(yD`wgvb+1>Plkw*4n$=uaa)CVFlcW^RX`KFz!V=Ki^XV+PFq<`0D*fz7{>Q7*TU z{}kprEX6X~FGk!zhD`u^-V36h{(B=$J=;xAVuK)NUBf0DjLpN?bDi+{4(8>&GJ%Y| znZij$0Ep>N*l=AJBG5jFxKj8r#4E|j%RVM272_XdH3IF!h}V;0!#a@FznMdz=cZxi z5ITo!M_}H=h+iYahGUbgd5=&pb$e56#vvxF4cCX-d|>gPg!%ld*{8sNE_CFi`2a{C zF!Sn+S2Zu!e4a8p)X5aD{i)B5F zc)Rc}#IFfAA~wfVusH&LUG&U*LYU9&{*sJ(a=nq0N&t`##D>oepA+V}#YbX44K`%8 zzhK$>V8^=gIb+@nRlY(v88LtNm3r1^pfH~^9wvMv;%s5sOc9=rn7@(2yv2xXg}E&} zEPMcU`34#7nvT3=UBCP-0WG)HVs7))XTrW80)Km~8ZpOT@)&p9A0>>)-4>uv0Gs&= z_M5=V5NOYBKZy)|55xgs?yJ)+W_h&X_F=X)Ft@XO>fwiZ$y$H*JMD`RoB0P^4rX1c zzZUTlVeXT^OoksUGOT{SDmKN4AGetMf@D?z5{-VzioPB(1O2d`Ysjbr=U%dw)l9vV6}H$% z=8gz*1p=9UOV+$>PjVl3Oq%`&vmIH~qoK1AUq{AHFBh>nuNTJ9kLWS1o#b2a4?<4j zP8GtwVqT8N3}N~<{-I~}jDHNO$zYb9ENpyo@`QBq2^;z}e!wHZ6A?788QY>q*Eq@J zt$l02{hh%A(Q{laC5ztdBfw{{jepzH|Ip&!2>%`NUxim9?u$J1!@TDB4b1OO=Zc>E zs4&kDp0t?HhiYCvYs@-RI4-GYJIuBN=JFeotnm)CXLfDl%+1M#$=a3H1T@Ir0_4Uq}2D8TQ;3$ZG#B>I3ex<6DH;S1*%c z&+$xF`@Pf$+~fIEWY{2Sj&IcF4E0c+Mf_)B2YvE)VfH`I-{SG2{v0AB1DV z6Tm+R*S#lze-N%$PXPZQTxXsD{y}09lCd!|Um}?U4?@;++jwv?Cej0lZxTL<_(6+X zg=zDGrT@OgW*dYb<~8%fZ2)2IH?G%Y=-F1Xo}Y64u@3D2+l9Y__%1T+*&pO24t7W( z0_`gi-*52(GVIxB&wd~$@qit&41s>Wfq1#_cM&&`Vb4A$>-mnEe_+2G zx*yX9{8Pk-gxRnED$IUhJ(6?r4?@;)at$~cgMSp_fff%Z=eqqvPO8B_NOy$fLGEv# zaXwAXbNj^1Ct&)XCpMFP?lA#v*xn^#&$c`#oPzizVU8EGEyF$lPWQO}Q9Wle8RafR ze7ESi-o7OIT$E+bZS&mu{$ZNfnF+&%T#V6!d2|5_|J$C+UI{G-_C zz~)0?+MD0rgUt@;MtWWUW1!C?Lq8aK=ZJnB^kGZS-;1IR>&9p8S%+NMd?0#0Pyc7( zo$#LoJGH+`n04cG^vugKY1SinlCX~R0Z7xP05Ms|t=UJT4#m)M-P1qonM;QKG+{jk z$fq7Qtj{cq7YLUlE)!4?edXQkNCPqW3}5`G48SeR`z+c^BNOtS8SUbJk? z_70ml(2=#QgJQ$7PFVc!WY}|@lGXnAmd#%*Hv0(J7eigw3^a*e`@VS?zg`LH(O^F|q%m=%*oGP0qu+zQ{|~ylbf!dvlH^ zyiN4KK>QwfTW%nSW8=*e2H#~Qa+THIGSfOvrL zB*eFn;b%Ggkkt>DvHs5@-Y7Qpupz4r-}_`CCG;$RlGw1!1;W&u zV?Wrid>-4;5A|#tnRR)^(*IbP_4>7?KPSvOCZTNgbB%BSdUH)%{O5{31Ntivl2PY8 z#O6E#Hkrb@E&^hcjo9qhV9)&(^Du7(;;Cfh%@WqUGsK2@i!Ejz=6w?J!(`;84O#PY zOw)#Xv%eN*9_sfa{x%tTbA&Z7k2y5&OBU}J{ypL&WaJ$qta*=%4a@zd#mqyW$>_iT zA|vlO#AMBD&QoB+yb0`QVdf$88uPVeT8yTyjKPURgSQWh)tKa~Zo3Sc-GgiSF&=;{?qJL1BW7Ujdv?UL0#xQI+4$0a- z0dO*G*tcd3gCk=Y%<(vtHpojGvgS2o7&g=wBd8zdAxFkA@^Tz@8pD#;jA3CjhQa$` zZ^kh4avYMiTr-Bn-i%>k=3%+NM{LG0@^T!KHSck;VV%twmb}cvypb`Cyt&YI8pC35 z#;~v%!{EpmMqZAWPGeZ?%@`IoV;IcqqGk*uZvpal8pC4GYpL4L%tQVL;uDs)cmT$fwOc`k>^m~$vw5IpFA73~K<_0kV1 zWa$TPw;t&S(_ZNZR!jTAv{CwD7WL8(#boIRZfn{PrY&QjfUHE&elYcye%M64^n=i(paeFW`?^JM9VPs!2`+(z^nV{RkL0gJON=DkL>nMCG^ zJ7l`W9RI54_*bs8xZdJ5DO9p zeq&f{%x??}o8K4~-f!6-wb=Z|u-LqB>Ccn7p+n4X3=88E`Uz3t{VhDC3FV_4Yy#;|aXWuI%Y`Hf*-9DH1k~@g|G6Sp1U3`z=0d@kxu{xA;7{hg;UC7AIi-Rz07Y zRSsC3W$_qtFW1i`i>F&W&*Fs^*I8U|@fwR;EPmGFofhx4_^`!qT71Uha~AV=9JT&2 z*ykwsusGG?Op9|Y&b4@&#d9n!vAEje5~yOe&|4lil^3VR5#_<18+)c$US*7FSrj%;J?6ueErS#ak?XiQL<*+kT6WT71&t z_bone@uwCiB)0oZwm4vMmc?T%o@DWKi|1Lq(Be9BAGiMX7O%0m#o}iz-bv<3A!M(` zhb?~7;xpuauKhWSKejjq`$y{O^c)P{BEk0=Raf?q|eAeQR$N|^CgMFH^-{KUDGc3-wc$~!r7SFP{*y0L{msz~h z;?EhVyw~Ex7Qbon8S((v{+z`hTO5OZxZ3ovIMw1zi*qc_wRoDv zb1W{gxZ2|77Kbc;!s4*S+b!O0@j-Hi+s5M-pSJj{#UGIex%T{Uqq5)P6pJ$~&bD}* z#RV46vbfmd3X7Lnywc*e7H_h6i^VTlyx-!Z7N4~EeT&aq{HetWI4075;PaTu0gJON z9%Jz&i>F&W&*Fs^*I8U|@fwR;EPmGFofhx4_%Qi;cb&dT9_;cNi_cm7vBfdCsH*lo zEKapJ)8ZV9b1j}`@f?dwEUvbAIeDmC&ydAWSRA%^yT!XLK4|fAi%(m8*5Z#W=EDJ6 z2fxKB7H3$TO&%uO&hXkt7S{#mJHzpH1UFu&R8v|J99~ggS6UOS7~bJ42jiRnrmngtw_*`9SEUmt*Gh?U(zdzy(pO2rJaton$xcM-L=~4H4 zJJzC0Z@ngWCzGg6_o7CqLKW-Nd5Y+?#d4AvF?@tw=}yIV%5+I~T4V zQRWw2uUutC3l>*9!#nr3Syo<)&q~!|D!usfvL)u{d@i*KbTOHA_Q%=7+WNX0>0QrZ zm+OqKb4j0k{$eiLiIc>%9d!o9g zs#=cjK35cg6>cRtxRh#yw*YaOJtE4y1Vhf1CB?X}htqHOo+e^0V>%zf_QzX<>H`?z zJmFj_Ar+QC+~SD%s|4Hrcnh&Bf90ajMNC;{`NQS%h`)7U+g~oy3@Yk-4HV>DS+ElR zwt#ux6PI2i{@TE{zj~xI5LDFPJ}7K|S!f9Fv(g_f<3;@a7Hs=_7U?Vm74`RPC~SZA z@K+2S{o(RZ#9tzu+5V2pGDJqyAK$OH{hfh7UB9^05b-xG%HNweJcD#wm05m4j`?f{&;WL z_E!Oa#W12jJ}0aGeh)kRMf@#CqO1OUKg!=x_+vZhkC$@QU$VEOzm<{?CPuV=d@jFx>~<~i}IJ6+rEAWTK>%aZ_6K_BiMwriq>x^$|dK@f*b(*hW*FOG+Mu4RQ-7G zzpM2zFUnuS1ozzr`s1Y@_4l|4sq zVyBBQX15mx?ElNz9TI=KU!^~JjK-9w?Kl8EIoD|M?Uae_>n$5PZO5;p{FNZxRll5$ z@^=>gbX<+J{KddA+phKFGYN8A#?(aXcOlAO_9S=z#`TtC`5PSN@AyUhWx$TUa}g-B zEPw1DF5`A(o=HH=I#WJ?Kiu+(2_jK?c^mq}p+dypktl!TaPYuqgH+VtPon%C zo#MWGL4VjaMg09ol)pDI7<1K`*fIIrD1RAuy3Z%lA0M$|xoj`L(_ptZ83!Y^(5ujn zf}e)((B5MB)9oz}%hlfvQT{^kH`91<|Ea$rQU0di)xLk5X!)BW{&XC?1AhU_AM4Ig z8&xjvjq%v}u;V!`~OwnboO8D!g z&cu$%15y4~!e0jTtl#|z>hGf{e=YEL3d>cret(Sew*~%qOiq8r2=^j)OW> zZVb{Y>MsC0a;_|h`KR{%?|kUg-<{%5*V}gZyUSW1M23}7<$j8j6a9@D7NO;SIjY=g zD3{Nzu^pvi$MLdD{ONj|hm(l_^eXCaN0h&v#qI0u0T^pL-W7k^j^*%Irp^#+JGx^~ zlC}Tdhg}5~B3f<&?8v#I?-9he0#I4DV-bRudxQAXa;Nuk-`SCDk#dWo$~_Ca^<9)Z zH>%vd3*bq{{bH-!6;b7W36t{;S}0<=W_VKUw4ZmvF2l0Z_VRflyS;nSc|2cbd#e$& zz2^BLq;;-+6aJK;j+FZ%{9#B(Bqp`vIMt^ASn8*S<6yT_6NuIBhf($Gft8s4{F|&x;-H;vVAa>Ga_y4Gz9Ah_PWX>p8Q=Ita+o$DwJnD&k zcz>iHSQ7&|;PjX?yHcmL$V_8gL{AY1V&X$bFV%#PB5?h0L ztzoHdTUy@kjMm@;f1JCN=X%aQZ|l!xd0}GzegozQC%5{X=5W?i8bwCQ?hP;s;@V0xD)vP{-oD-=EfX-VrMWf>AAMezUTMG zqCJNOI{V`MeckfzOYA*2pt^Tmu{o)q>`I%s*n9oh-kWh=f2w=F&zbT< zYogP8qi4cF&mEiov_smoBi7B^I0)~H3&;K90;<-UHX;8ery*@}VM_dBPd?^#ybnI_ zaKE>Xc~^aN;?TB!_l({f*b&PevVK{kM}E7<`u$kx3rF)B07`d#9_o#rd@pSh zR?e=p39V^U-j$l)ml(0}cf)wu`-AeEhWW;Ou_F4VCpE8nHMZI74EpIG{Js6L{cePI z^cZjBLl=-~lZ?7Jl!J!md$=hAhQ*q(yu-VE*FN8|nCa;~2gPT;_qyjq*hvr9yVXfQ z@%E;%p}EK6?@hILG4l`CNlxiR*{N_{Z(@RX;B+Tffcw@d1CzhyU{F zR?qp5ANODJZtSrbdwHTKF3A1{@6n~&dEuKXC=Mc?S zpjc8_SM!L`+zm~lQ&saou(JHoU|qQwPJ=q$si;~I#C@el@QvajjRlQ=>F(*~aqgat zWl0^f1S@7&me(17GiPCG0)A*ESXX*?&Gee8hs*KP9%fPL;$V42UP(z!DIQvI?^EBk z1ULU{kR#Tqu0o#3;@L4hL^H9fq!b1{os!BKOHiA#a+6`WQ&(PB!6kmDc1evXU^Xsi z&AiKbp#0%dx4E-phB$ZJ<&>jx<-v+t7!P%-YfG1uR8>B*7^ytxfznDm+r(zu&a<47 zDpa;|V%6g6s>)LQa8bABK~0Z;m{o!Yo+nM@pmvW-(B3d1sI1okd_DVVW@Ie}tIz(ez)yJPhMu6YXOWbGfE@tjYHGl;u|=ru}u29)OtT zj+XQ-h_6I?Dq_<=i0Mz$z=*J(&K(mcjtyiksHv*0t*ff47EGJ9~qRhT*kkPU8~Ip%I`(PZ9@ojvpRqPz(+@18b$*6l^pCeOP4p1f%@ z$7d(zO_+@TFov)llzDCxNe3j&aX{f1q0pY?P?$&A)(0#-^Q(=HGpLN{?~V>Ziv6K+ zIylQ%wAYVGwI2wky~eb^UUXz0(o(c-WX;R#jLgfJ^`cEK!ZirY`vnAUH`Mdmg6bav zb4<}@IRb??=EKab!=pkBu+(|ZxFMxf2l5!BCVaGdDhL#%n<2M0tSgG#Cm@0(KS zpUg2vpZ&qSoIlh^9i=`*4{rACK z#ByH(+$i?Hv-D@dsiKeZy4Mit^E$BR4S>1LQJ)3IpYb^ypyPw@fpShuM_2@o5v~N| zRNClQfz>D91Jyp{w<2}@t`km29^NBTKP_Mi+oGc5XDk$4tTFSB6Qi!|siVCvW6ZDz zfqB~yDAbX;{Zs!sg4X{q*em)Yh_#-a=P1mpqV?o<$2^R+?VNkG?d+!|2rTOx2o(Au zYaJd3YaN~dYaP~G+ybU_Rfk0AnTIijHsoRimb(aHx$tihQ)olhI{XJ%>u}D}{|QW? zJz4GlOeKVRvex-yi$4KV{y*~G2EMA|+WS8zfe>)#PD%FaLtwn9AwJoJq zsiORUzu9Y@tQ_#A&vT#W^L#%4`D8NRz4n?lFMIav+57C7O&xVwZ@SHp>8d;VJH5OD z^}0mg>Af4E#6C~vxt$u5uy0FnN2WJQB3kqi*<}Bf(C0}b-Zg0?dP6BM*Y4} z?@myn>$!SG|NGxHjkj-Whv~6p^}7H4@4T{w^tzM3qdKB@Cnyo4l?fu@`8yc(^F^b< z^I&e=c1hg!lDO?#Xw*ugC`bi@`WPY?E|6j|ZdY;&?(G z_3dwb+~!(s>bPAJx6SuV=vv_i;}@E5#qH-hhIDNIgYg|(z6YR=_TGux_CAzBAMX98hIp%dX9GJeq!krrdTk70Iw9Y2SNU@>2( z)K_gWtjE~ix2W%D{rGLes=6hM@IlCr{>CC-hqPZ>l_Z3Gk|C-^x-*K$Q$1uH;#$p-;6ysE4n`xtMKji6h<|WT} zf=`h+-iTgOx1hde(fkD!xG!*bBYnPTXiUV4*L#dix^<0pODbgv!AXFNP zu1~>hkTQ4a_vhG-{2VO6vB%Q+jTz+gD3$dq&-FNj!2cPKc}Dv~_y?B*@6UAT#)7Jo zM>z-Ya6I4r(oN)(L-+^B^UFWnp|8MjAz9*1CrcMH!|2Q;kHkN?+3;#-u3_#|9aj$_ zN<8Oh#^Ib?I%r;J{9~Nhjcxqrd+h2;HwLd|hl?vzbBl<2sV&COQ?7RGkJcKx!H(m|-?I`Zz*g~0Atjv6J4Q@KJevg4; zQOa2+vdWzu94{UY9%jy=&qm1Oo(4tQ;IZc1Vy*#ljmQzWV@G*C_%_PH4k0qNVX5czD#$*Mn#a@gegR4UAS z%xYoYd%ABDKqvN10&oHBtP~xdUp(iT?p(;pYX5X>^IJp{5pulGHT~(xnl~N>)fq>I zPCta?KnVZf(AB!{&3p$T$C;d8z8B$c!#r2h_}~GK9N`U z9)xTk)JYZ&i~+zE!qZMSLe?*JP&CH@xn8jRnpU;wu&*Pl9oL759X<=B9aalj?X03) z%E*30`8&eQ+rN_$mt`fZ{f8)*xI0B>7(%kz?+_i97l+M#vxnpTy9~D&hB>FhYZPtq z8$T>pHaQ*t;K+Ks+;J40>5x;0bxziNx;lgo(`6q@9hQr%`7EIvI^RNgI~h8xb8=uT z{=qfCQ|DfU1ITB1&p=-jK8EnH;lCLEyJ6O28XthckpmYx^x6+>(oQZsbyya%mSqCv z(BZxO=gH7vS;$(JX_Q0fErh&RBj1GZ%Vg-YT;xC={=rqiQ-|p;B}0dGPS(7+Ydv)S z2H9%SVOt_=-kK?g&N~R#lVOMDBWvDVTavVXC^|gOWVQ2C%EeBP=!6iG)y^*|7dtN) z{*7=7LOMSS0>?U1rbwCjQw|xxv+hPN2rZn(oRs>-Kp7$uX>q(tr)cyhsI!28kn z(uLr4EukDT&M$Rphv&B1adE}Y2+GAy9vS@`9j`%ZXF8b|K)BiP$|Z&u8eTzWM+nD$ zK)J>6Cc|3{KT4L9wA1iD!v_q%ZrHUqiF@40lUcVSPcs}coNGAWaG_z>e#8#PhicQc z8Iji;xoamP=NuK)cWp!Dn~mJH2a)eG@;!#1GyJOIw+tUM%<-b8>(+%7`@Hv2d5+-; zh6@bOFw8NT#;q{y)`b-N9Gj^Q?-`UiR#T1|=KFmr?=ZaEuv-^W>>o7p!-n4`v$4}9 z_Hxj$TNhGvMo`Yd1)Q4~BRt8--MWw>ck4n5ml&OehTXc5qO;n_TMTa^W6VJ3)`b*y z>p}{58l8QH-MWyX^SY5AF?`&xTNhIF-MWy%p?=5%u9b9dT}WZhiBNf=VYe=%=(u$u zh26T4!fsti;RX}etqUpgRwLhR*sTjGI&NJ^VYe=%uv-^$ke6qyS@P-DE{S`5`Z4P= zc+VAkpP+u6YM*DAAERiWXnvwv?`j06TzJK^Wu7g%De%4vPPrb0d4TMt>!xv^R2iq3 zBOO-_pERX8PF-dqpFC-N=_#u0WUZ6y>!WmfE9;{)Y)#3eYGk%|2?~+9=eFJh_5Xtt ztwU(G=$hT{gKWVQ;CX#lhf~41q4-ZOa9g;?#)>cYlgt) zZz1fJKt_8UMyS0Gu(j8T?NoSmYLE8}*4{qY%Y%&e2FgCx-z)Ie-ZR)90k2N&9e}{v zI}UpbA)~#3?4v#R>G7K_v}e=JrD1Ve z4!$>I%Ta@|-U#Th9IQv~V>$BT?1iu`k14R%(_?skoV{k)n+`ec4Te{H)5IR{$?5pJ z8tY9RHeLR26+JD-Y;5zlMRl}CcMIg?0&c)Phje+pV7fRov2?!|XYVakB+n6bYHvfF zy%wB+S`H4SsmFTZb2t3O>Ny8Heu-^$YVT)p_71=v$BWD#pI@lG!*TYGVF%ASb!zXm zIC~TDY0x3r@!Ou&qw*@tf`B0^NaU%N&Q&9v>TXAMNqEIPK|i zTZ;qpB?`n5>8FSu0_R@GN&Ae^({wL~f=zexXMFB^QcO1lujyVd_IS?HajjHkZfm+< zfu7uEQ0(Ixsrin)f0_k1E;aID7(>R}iJE+YUxxzvk}_$)B2>0ei1C6>kEKxZpG;)qNdB?k@gwXTbPY+ zlb=G*UG>WA7G6+(!IH9@E)02d7(&i@?ER0;a~PkWH^J@wc<`|vJ$-rBN2q@kgt zp`pHc1zx<*+W+gM24A$ibL%WGLXu8YxbM9WN_v%xGd_rp>fCyL_fr#|NSOJ68hrfy zkkL8tUO0P5G^?}eqHy*(Td!}*3}PCt}=R-gFq_KE*aI6EZq zKjXzePvW2J#UFMkdnl%#^uJTe^LHEl@KMCwdOc#G;Jr$>|II439x02izNy-2_Jq)M z;?>vw#j0=lv(xPE3EFI5^_JDC`BUV_%ynkuL1cPRS71ryb3nbSQh`{_M|2cXoC^HSCdok4?VQ)x?b{ z_ocknF?qW=7|DmCU+sj^Ck8|}H+Wk2?R~ZO@iNSn*I#VI9C&5?q-VD)xB&j&%#Fnh|+kG8_J&m2w zV~-@1WnJ!VEgw8U=TVGJD&GGd((CdClUt4!GbO7oj0!kAHwZ}=k5PVee|Dr0S7WX==)8di5UT@h1n zelPrk@2%O`Z$WjD-&Q1rdqYO@9vb)gKCPHTFq zZ^p-_q^I~}QzxLkHmm2yzK*WQvpB)m{xp_jmzM{8txrWzrr9l#&ZeLA&FPpV{21Q- z)IuW-N6W$oMyy@C^2My!I64=MT%^04OKlt}fc9Ly5(H5T|-k+~)g(%H(o!F;Z@ zzNCMg$nT2mm=#@p!<@C_i!hoBCnH8v|L(4wClXEGiuZn|rYq96VC34Wrn7$WCMS=#I~4M!%7C8nRsT{7p4I16*E5 zSgotFUV1sHAKS*=8zW6!)%ge4r1wvn=quiz9_hNYW5|p^tlj;i`Gy-)di-dt0bXuyss>}`=;vPX>m=Uc*x+nqax{RuP;KxU~*F%Yiz_5{bMC; z9)lCphvMHIT(q`|`+7@{_7im3LxpXOxEUf|o5)i?s;Imr6K6Kl@u&$5IdxFRF|Z>) zw(4oW$q<`S&zZhGYa)ZzY|84$+_K(_bMS^ew?rnd*>uLHw{~XsZ_iBj#G6w3wEGv6 zFqrF(9^Cs>Uz1z))Jsandlp^Q8ABRhKEb^8^R3*831&qY!evFjm$m<;p0`h&dt@x# zv}+1Ob1^$1gb{)h_}u>~)2_Jknz$X9qjjhBQMY(~)c%29A2oO2tf;TOE7i+w`rCIYSQbv*0g+r$Z}n z%v(6hdAm(r%DDtvMC3mLe_fc5@9C(cPG7a=Ejf2Hq&t-kWtxWSP{wj)!H3}KC=0>! z_JnfYR`b@Dd_DXC;duz@PL%;EJmoLK(@{>&fv4P$`lO?rtoHeu+7QU7lWBCw{MC$dzGlQ-jGGVO ztuy5}Q3yvlc??3z?=^C=*5M;YPR1R&)BgpSyJ%-0fHvs=LLnUGWZo`P{-KeRLn1#f z0RTsRGJg@EKBs^%3gu(L^&)Qr(@{>=W3ko9$!uF$@VmfTZ{0?R%-d7y{L0A5yk({6 z*Z8OH?Jr=;nC=mP+I)vXILgU9|eSe165q$*Nxk*0id@ zY%?r-tM@)FPyGe(bWD%T;#0m5p1&56zY4E;SPAC+B;}3p zbc{>Zde{iodj0`e<8BA@*fH*p;1h)T=z@-RPI8Q_?&SF_tnOZy=$^RQZTSIFM4vq0 zg@?G;CAzn&>^6(l>rS4p!lvBo5?#^lwzMu0{p<5h*md^0#6Bxp@!+u;_qs%Md3*** z$BWuv98y-kI(Bg9>jpw@7sPFUDQN#J5n(cn|Mj^2t#RA`5x2cNZu?-|_TS>R z2e6fkV|w;kBe(h9Cmm0M!RQJn#_3-jw_P5$t@B;*05UcULZ3-u+6!jXE?r!U87=iy zeRu0>={j@5#j#7D_uXNaG4Hbnk3NwMR!+uD82mKZHxcf1vs*MupA9#a!!5DRr*GaA zm-!19EUllvw1%^5mdA|UURk$f!R?jvOBZu`O=V?lNA1GW`l=;$i{^_)Y)7mLyd}ab z%p8$Z&)jjD;mjO6nY%p{z?brLgFTZySS?g*AuR@5)VvhWaK{!~T$XAbA?H)vY(7AdLcJ&Z)Vt29BxK1a_lRF*h#$8=W zm+$IIbX;8x_w;Gb&q{)GbtQ3KU5VV)mB?LPjr8g2>N12)F`xzsL*8 zV$;=?$X#7AK{!`eqdlIDz%M+PEOF-7w;En;M#z%?X0p^n3wbR5!QBh5+)5VxP2>yk4=xI?@_uBFj^L8vm4jqfJX|Wg zpLb|*Y4H9`hi(w;=ba85lTi+lMTdhYzGF|vHAQa z>F3}Y#kfB}$eUp5GcOIo8DQQJQ_j5bH&Jp3%zpsP zSIQCHwOyS9MO(BPLdfxU1k9_j-ialA*)&$(px0 zltTx9t_)lwcs!VK$h;wpl5yun9oM!Y=MCO=(RnJ-n=__5zZN-l+&Kt!|?UOJYGDmT9z*xopQsAgqa5xn>P6% zfZd<+#locsCknI8P9Y-_+bTJbg@15Y!!zz&gx8Xx!*)v!uw#egKFZlv$pIN}Fb&3y zBCIAuhg}m{?JuF6_L0w9MTcg|I(Mu^?Hw6(TQ$oUCPc z*K5SR7qUjtnGPMY#*K=62IOR&Pq&3~#O3vY{Xg?O6FOv_Pv@=$(BVVU=R{{VbjYgn zd&;512c~~Cd_?#|g#Qp`pK(l>595+~E+bvGJF=E5m2%kRL)Ei{*~hqR2jo01lPE{r zd5BBaxP_umow=e@0v)o>fhsXNd|!!nDxgEwaxFDFw+pi$`xY7cHP9z(x_l>}d2U0v zL6{G4A0L6 zJ#DhR{ZRNZg#1ng<+%vCtvb7fStq|BBi#tnCF?o$2az{JPS!r*uav_k9~>VO=7ZxC zWY}T1=>;#2%P9?iw+GIK$Kam$AbYn2+f|^fQD5;{b5qf~S0#u*!Ly7?;^?Qty61c{a9{ zOANDqRL4f7hUa=v%0Tw}Q2aD!ovt5v_%@Mgo?4ev6{@wUe0byoRR!*3bp^;C6u z|E0`psPZtwIfnV0fa(+&cJtKGKhW{IsX7&gYYne795KvmqQ;FHcJtK4eut6oHvEj? zgN6?qe%mmAxze?mrzYHB^qUR08s2PpyJ0s^P3*XNYQk=wn((Ve|1HDE3}X%4Se{c24>O!&c!J>q z!!r!eHO%io_|do1)f!%DIAZu-!%@TA40jmbZTK0(2Mr%K{I+5KlB{_P8vfMt`}+I{ z;r*%;`#9z)r_sfJ`T3anc(EUVK0&AVSDH_w=zX)c?}WWmOu*AZeA3K2)%(aPcX1^> zd7fNcF;A^v%lHwwbt<1GyH3&fe{h!<#<3HPCMuLn2ucFwy>UH zy7xV%5Vjeg`#2sclx-PixG}Zbz%Hl9kk5#%y+<)1Wc(03y1AIW8nDe@GqyR_QKz=c zA+Yv3VQ)HQA$XiVF?)<}?QO<3y*jnG1_Em@8Hw_m9fF+08t!9$InJ~8rek9SWa`x3 zb_lG!XYgFL1hNo3yFRt|JlNV>$PMFk^JU1$tSh>Y()%6uaftOvdcTJb?a8p$+4}(7 z>bQ?S75^CO@m+{(GshR|w7dZ*+4AP$c@wYiAt-Was^z^X&R!Hd2CFgA<7RH0y&wkL zYzHCuLGWsCR-C;@v117vk)VfIW^uL-1$9tG%Uh_ISO~mv5lv^ceElJ>wK` z1MWENZ9~O}z-Pg$y?e!;)^ivKpJQ}&*zKd|yf}th&yPayC#r-{%kemrY`R-UdEYAw zL5KCD=^hk&n%2#D_^u2!mlo4|1OH^$POI>fVRF3@to_YVSmxy&14ay%2Qxv#i>qzG;@eG&B;91v4Sn z_l9etXA>;pNZVV{)?Uj%<6{4)4&!gs^J3(xm(GT}c5e=U3!{MX>`gXcRk z{B7wc@N9R_!~ehFOfxwtJ2H$rN$vzM%3QYwZv8(}7?-hs{a?dxz4?2aWDXza^Z5?I zzkK2ZkNy8&9s8J%bC*o^eK%p{(M{L2o)gRnjQ5>c;LC4o8J`*)nAf_hB~&7Fp@IW< z{@}O6Het5G#_-1b@xFh1itnL}LD4OFReR6c9!U-F`5C6wt(i1%=!Ppcyc|rx>BSE- z;Wx#}zF;u;z2G@VqbG9z983`d_O{KYevg!Plpox5*E^9?JHHu8el5Qz@mx;@eo zjn+3bygf9lYU1+^KPxMK|AXjbtBU{agQ5GvQ+=JC^h!$ccu> z?%B>))P~{rpkqx!Ki!E6NIWvxC&%QQ z{iYATBVoXOj|d=pL=-ChRanan4J5^ zM%Y{X!|s4@{jh;UBWpGuU3s)83CDX=O`x!0Z|4=8&KUZTXE8W9I%XAeaPE=%x@DEV zDtua{62E&-?VS!9;uO@y^4*mMODiifQ+y+ra=z#VW)`bAkCl7+OdRE9!_EARpWoUm zU%IU9rpoeqo%q^UzakWJlVqt5JD)h^6f0{lz&C0BwMc#Esd_1K3hcpZ?3!zb7f1bV`8Z|PU-EtZ(_*z`OkkIb?p*nTr+()RJ&y1 zg7O8Z1gK$*a!HqOblYV+9!YrX`Yuekl$MmUVf76 zaqdUk8)g-AhKjwJ@%GNKY8@FLZSQQWn1eZFE`PQ0_R_3c$C*xT>z44y(I_`25Rc5k zjNi=g$n3{ZW{wz}xP z+m}T*bZ(72GGN1wCOM){rwltkHu0-??HJ4rYs=Z;`xyG9_zt^e$!e@s%^SsH+Lcx3UM!~8#B#T7-oaWZM4D&G8ut%~G- zMA|UV*j2@)(_NH z_sB18jd(fI1C;*w`$dIbnfl~o?ctmq*~mxq#EP~k=AADuYpZz{6CO$fx3!g2Htg&g z@kr8(U0!AmbTv-|HQjyqZe)SqPxR#XO?+KD2=orcb6=~u1SXud;-2?M@2GQidua`O zi#~}z{_6A{S4>RkX*iM77A@@DnpM{}y%Y<@?8qujsa?jzW0QMr%CBIavChN3@AiWQ zriHe?yy8+=aK?&Xc;8u)RPS_+;J({mbd}XpexhM~=hplAu{d^*ydYh__~yk+mM_Kv z2Bk}JG0Aa@DlDy8vTR{RXz`NzP)%uVZRO(8=qmZ$yI1<%f_v}&Hzsn-6B)3kANo(< z6ZrVvi+)Ke#Xqw*Yx^^O>8+T^$+ZeNGcqzDdOb?qP?&eu^228r|MLB9X^21bN9LP* zDIb{l#W}|jVdn5oUiLW_YtJeUPXBH~G$(c2xbWyNt^DJ<7aLaYY`G^DvnSW@8PqU7 zwPAc-xXm9v@bxvT60)KgFI<1_NW8jrZb;+bkr4fUznNPH?HUtqt65uDbM_VYowg;r zcZT_@&f2j+X$t=SalxNb|k z=x)vbd-KmDQ;X+*SmgHw2RA}RzJWOD`+EFtOj-GEFsb?R;HLdQ_-*cACT%T(rAHF< z>Vr|o$a`MR8q_n@7Yqak2Cu#K+u5@ceBmdb;TUz-pl803I%Ut#3JU7qsW>yd=f5EA z+%TwNLuhE$(4Y1oz4WX5mu!E#B~stu#Hl}RS@&h%x&+_Q#`LD7KWw=0_bbXKZ4F*| zYtz6R69QRyv*Dp(iH$h-b!~=kCXMZX{LM_f7}MCpSN$G3C#Nxluxh{^4}ItMeO2KE z|3j^HL$eUxku)@GU;a0fFmnB75(4Y>ICD~huA9IM^a ziGfsVbxZT{F%Na_Yrv-yQ@6Hwl@{uJd+)wrK*x+pu;Z(Wqz(%{;eSM~$ip}!XGQWm ze{h%h6Y5GYT$g!aF!_$8vaZyof#XWYO)0&2R%z}xlY)Vj?*$*ewW7nzu~On8&jrq*UmYdkd)^e7d0GFYgfG*8H8LF;U+nfR+WEV$A~sm(j-rF-<$Y?=79Fy zL2onty}wScD6aUR=l3UkxSZA2HN?7^=;NXG%v`a*bzLTl+0Yb%Wr$JsQ|$@jQ>=O6 z(u;xvH>9u2%p09F^vdED=ZCY(nj`Bna|4mqfoon&3TA{NgPPKJW|bTJSTf^oykijw zg{%C*jBx1%vognxN=xYZoNs4$ZF~1jFSWYNahulmT;|)870Kp(&81t$c{|dFjI7J9 zES~dWFar@0y)h4GMs0iM_$QF137%5)_E7p-->i|9J!9Bd!kHH|PY;hA@L>L#xT>bl z{V;fSY#o&1+dl}8ocmx#^1956TJG&!pTDO)tIV@Y^{dA9c56wbV8XavUsQTNpZBUf}JBwguiUKL3XHhI+?j_zCg4IBd2P@ZIS z?dg$p?>IE2_gvy@El(eK+Rn@g?LU_)#H{}deZlj!Pr$kaBYolF6PsIMC(znH#<%{Z z0l{;QZ1A@%5A7WOSxAw8&vrO-eDh7gb6$1(9!d6us6d7Bd#2)EGm{nSiJB+!;^5nv znb+G+u43kvht>_xKbkpy!=QD;FYC_C+u+|neB#dGliG)WHddF-R}D*UM4!<6`B)^L z)37|$li(XS{BoS0<1#NU{?*?i=~GJcY9pbh^s)U>Q+HJr%{;Mke?iuu#&logi)i%) zwdgZLO<%n0&W7dNaddr=vjc_U(sRO@1qY{xGtt?c6G^Un>KK&J?=%hU>F?_p(4ILN z`%#jo`{9n9cc3364fGX{IF2m2IsH&wc?`-)XoVMM;^sFQYp3L_LgrBRH5(I(esiMe z9V~Hx^5gm%>3Y_?5bwxt3B8q>{U94ja*J$r0_tS_@KBdI9Ct=`a_ z(Kt1sE;Bt`nwI28VY#r(@@*@^+4!<)T5<9TBoO;(b$fN?7x7Buke+D?UV7*?uo%bP zO>Ip(>@qd`&MpcixYc9|3x3$p-c>NJG<8a;Jeg>IPkVFNYCMZ1vIb1zO^fnFg)}r~+a-24Z zy7q>~fUhhwHR8v@LJd{Cw8nI2z4V)dLy+fL(T%g7e`QU2Leg*i93vE;wY>YOkTH5= zO7WY^%AU&I-!+2Y=8YLZriLUv>yIq|aXwZInWf)*p7s1ojW7DKqD@=N{kNVeTV;7>f;AY`n zEK1TFxB2#2FC9!D*{^4--z#^tWo?zW#z@RW@q0Dh(Jk@9t<_o?FQYPgHu@!VXCia> z)UnM%Yldm{dIC`b00xFX<4hpPv#s~(4>dvnZcEc!ZA zTbDg9IHaYub6xdCt;^T_*N5vTes;~7`FJE*7Jcrf>ZYXq(YC95OiXX(p&{w+Ko>vo zW%L}d(wg2hY9l)R)X4Jio)3SVlh9K{<7>{G=q$bJS!(ZN$!j-5GCWKD=M-@y)z{W2 zd<%SnGjvZvQNF)B`d0ArxN;QVe%-q4%fs1|);5JpGm3^|l$*RWGs9c%iA{PEDzWKz zP0xCbpm|~sf3L|x^ZXl@yUDt`3tx`c1C5n%(9Z^IS_d^T(eAGNrpzZ2Hb$U;qKSb% ztKLkqv2U35(#t)5*T8E2hMxMSn(Dy`jS2ppT@&;>?%Vc;GtWNoyG>gTWu~@g4*MVp z?PvgcYJ5}v_DQY3D}K1B=dZZ&OD%r->PGgT?b*eVXB#%A7JupLhOMFY>f)+B2}R%V z<)*9|6RMh?fG@xQe(vd283{?(_^MFppY!$n21C_^qBXw8gTCMp+#x*Fn$VL6^f^rW zs&CY>gvRH6>#FChtDejH$+PDtuB#P125at1Xne+()i!TT_R|SmD@WS#wyR`qr7z=^ zV!!`X9N?w-89H6iI8 zEJ+ovo?EmNzaO<#AX@K{NkWI$-BuG^)JNJpCh0OXne2JRHKQAU&&7?pxD-*IiHK&7 z(of&g6|SCwOtn`}4ObU#WlLSNE}>_=505%FU{xzd>MbSg4)>a3*Tx9*dADzWw4txg z!JA++Gc|a1xcZ8%k@o7Moz>G|H3_GKTYai=Fzd0pqXZ{V-s2G_+TLVQ2LWBw5{>&{*kftiky2SfA?Y zNkpBk=p#Zq`%yaj!}t=TKe!2LG+vHlgRY}JGZ=lW;V0<>Q0+yNAUo7H{mty+wLy#k zPl}83jPSLi59kUm+PD@uZ|Gph6)rtX&X^&M!!VKvm$KszmkteQ4yl?xcxUF&Hk@m6 zPrGjj21ZD%HEYv?)^WxEb?(k+YV6wi@VN9L=Z;MYXATW6Xv#wL4GB$ykxN#`Sz9-( z!?Ap9q*tQkSWSB6;qS3ho(&C9M1=Jj2|Z=L>cZ)TI_55!d zM?;Pk+JR_;~BxkLwwxO2-6 zZyy$9>vL&*5zoH5+g73>^trgl*1AgyxcsDLCcS)u2YdkYm$q*%Gn?$VuBNgFM}FVM z!TybBacBB;UvS_$JQd7LU!E~dM$n(_NgymNc^nKikl zPMbCR%AzZ$PM$r@tk=b5yiVHVyQIyB6$S4|xUnBs6dZiIw^~>0X`7yt1-cGS-+_^_ z+<&3txigp$Oe!9ef}32klvdLDIHv7ga_Ly7>v?U!dS1cP^L~ZXM0R~4<*nOWZ{dnw zxD9T(zO!X~gI9(xq{MXI+8xYjx)V>j)udS=e}d^N!WpsQTJdFs4ITC=ThskioeOn zRayIAUb7$}D`(ERM`qVl+I2@mx0WtkP_dx?HawAA8uEV0sqn=sabH|%0x*Z-v$TI8wb$G7Du?jkG= zizQTjR*v;!z2#cD9xIiW-n;;hF)Mu6qA+!_XPxDxi&0znSqTM0Ze6U~LR@&FthD^* zldCIs2$t5D*5T)^1&dt?tCrO-tE;r7u!W{Dyu`YuA3aXb!lkY)WYi~kN%ep@wYu%DJ#V?yvyott;}@>>z6DE;VE@py;ziH z^>JD1Eyt%&{`mZV3Im@a-+uHBbnH9ujM}~X#CJDw3Gi)zPlf*#dNvUoz_#E`GmmkMMT8x)RloWad$Im``QqRhf2`nP+9@TbX%Rw)!8% zEQ{*1Jjx%XZ{;IQTwrXm#}JrJOT#QMJ)PDqSr@4$4lLuQ+&ybeA=nCa4;Dy@qkryfJK&wGk%Af%lJgggf1CNLfCkTtCbz+Z-p zI_&$jev-f%_Y5$jGwvYp6ok~j4y@^No|5X{2&SVxnfHN=&pEPchx3twkkO8tkA#r= zToZxEhI+3V{WriDiaf1fZ#x+SW|?V+bA&Dyz8kDJT~Nifbr+}p9DDO zL7kqz_&M0+hoP32?JEbKcK8mmmVGi+n<4!?J;$MHgN0%X+T9ECK|nMQ+fl#{iduQYO}fPdPy*(Pa=A>%O(){W*9kHnng zK5`~J^K%3ISm8AYnFMtr@EZ4ii6_<|h>}0(!JR0Zbd@Nk->#@My>q;H$uzw+8S?(SHD}X>Bt)Jz(0S zKMba08e}~#$H8o4)ZrWfZ5#TIKK03Gi_QqJwy`l_#-$F|PT+Z%1)mRA`$&y~Fl{icZ-Vu@#_I@=DdqdY%op{Z z18cnSPs^7E5KS; zwP3B2Mlc<1kuwm|=J$-8%)GIjyx!4KpR9HGLn9}%4ypfhBPTNtl>fJplPRNr*2uBx zoc1RnY*B|H9rK`0buuBK4nw;CRUP(Kw8N0@RCe^b#Zc>+<(mti1z!QL?VQ(QJ;zsr z=}u*n*E6Qe5KYMGjFWBJEQOy8Pi}`-od>{$BL5>o&Ci=)?b8N8NZU+zAUGEx?OaS{ zILgTkDQDkB$8GWj2r0iA%w3c(1muZ)6NPY;leLZQG;*@`AuoWri~0uun$Lew2uC@2 zC_<*oIsbH&lhw|}Mouok{w(-qV7-p>E zy+en2xD4_F(Z9{;lXYwv25Y*j!4pKk!|0P$zstzU`J!*fx@47K#ES(S^F!8a%_K0# zc`W-4V9moku-?Od6|8l&60GCTZyR|FSg&yp8Tl5l=6MI0j(H&Kxw+TK$(kR|MW>@a zS?zOTk>-aTqn0tBog^If$(rtDBPZ*1>zZ5%XmvR+@_0c-sq18ckOhmMO;n4c7|>IA`h9M1-8on(OZ8Z;J6$2uX05Yo;U zjGR0|fNM}V~~7aJY2=I66uO?MKQYFY5p2ynDXR{g8Nsz1ZXXMwf;XB+tqU^?0%tDO=f zCv%hOE--Sk>MsFny0u_-kJPU>`q*?%$13c9m?wsG%!9iBX`Rbpm}xQ8I=@O}Om_zS z7vY)b@50kjP96zQc{e<5P`(>p?K}^rqnxbA{UxyK9|UV%9RlkZ`zV->amgC@T`=Qj z!T%GUjymeJe%R)zry=!uZqc1epK^`+X_fqPwcv{p@{u z-M{`V6YX_98z+Bjgm(zNF42u9>~?1F1}M=zedrY>x?a<6SM_c<{pz@Fp2fW`(RY*U z4^_hcQu{&5xP6*A1l-0eg)ztNF|y5Z_+Xr$1#$cJ*&QQMzbtP5^0@80U_7}G%QkzS!RRmUm+k3p`}1yXQJS0JwkNyi zN!(^R2ji*KX{L!XeLhQ4$L(Qp+r#6wz2ADh7}PI}+dnsMyF6}NpEJ<{VV{&`7+n(v}`?yWVG_DkV-7b#X zZiw6dx43PtDWi_|o{rl-7`Oemxa}lf+{H2ed2!q0g@nL6s1#ci*M+rB4moA-X| z82>-xwhzW_zZ>d#`)b+dcxW)L4>!rSv*jzptU}Maw_Wbr(r3E@KPKU;k@L$j zCBNLm+PWoG3l>(+FR!UAzj=P`&F)JuPKn=VDP3C0Z?w4W1&i^Sm)iOzi{~$>y>)^o z;}>G)$29ud!doA))Wm%G;$DgOhS7Y?kH;HJOHYzxZa!Zu;#)WK%S-2%myK|f>5)Y3 zh`bRCme!Sy$cudsMhk^$^>s@t=i}2k_&iK~W!>V^h5X2m{mcwX=suZ)*MMTtMTWWi zn3C^9ju^x(E?56?UncsulSQZcGLhurd*uEtTDqJP$TUPTwT7`z?YvA*BIf0m+*kO@l z?Y`}FQoVXD@8l$6u|0*4$xKXh!BTt$$i3`$avr>{zl-%zU$6Qf|6Udvh1U>q($+33L#yw56xg6_W#mvR3eo5R%)?ADB7FvmQD1CAiv;Ohj4(%*nI{za& z9+%33xNni+s$@Fw#Y@VUnA0%U8hg8V*WOwB^0K~_*vHUE?BdCfzu4Y?{gYxRb!03Q zE>-v%92dwrX}6x!c!uGbhG!e*vlX>JkNgGvgDZhot}t9fmPZN;jl7n8 zE&jprSZdrAWRb5l@&?1J4M)h#EL=0Z|BDXY`x1V6G;uHGa@hUr(v`-iyjRvF$IW)O*IL@;%sA-bbE84SZh*Ugggj=01Ne z|4V!3k0Nl%@P6SSS<0Ad7#REZUO)15N+hl@w^i=gw)q<=5q)|7>(UZ-X??}hNkib5 zM>QGb5>M{Z<&S@GPG8P7r_Uc4;G8}i7u+y-%}>bi2*WvKiOZ_d^F5C&_dXNIe8B=P zA715?$nuD$fGqV;Xyg?6zl48qGvNKD4!v*Ym3cgy@^X*ok}EuBG5nPtmyjhb?$-R& z82Li7q*Y6n{MVBu-4$d>cO_ZUZ6He-SCb{(2$?S|it|@_&<}y16)f%}**tRdGlOt0 z?jnzq5%?E-95n2X?-Eb$j<2vgzQRo2FB~GX&~PK*{kJ%DPn`Xdmec2tNpK-}e;rBm zZ}K|Q$F&C@G`M;2DlZ}5hJSDs@XD?|NL*I8+Go}H#SXLOza9VJC{mj%4L6X#ihppc z;Z?`A2eIEwIU~Wfz^l%^WImvRYlT<&CbH;9$x=U?4R0ay;XB+mc>mWOx^IK1okuB` zJaib|Ww?{vfPZki;Z=VR`A$l`ZzcM}9zTOXb)GYP!0txB#VX_?4 zx5#p=kB}wq+lG%B{o~|S_($i*pV;X~mNx8m4R;#upZ}vc$J6PDz%QIkj(GAQxzXcP za+AktCt&c{IY1;md^i{O|L^j62Qnb;2bG`3nN=oQ@F1aNluZ zx$hU=g76IC2N9lSn03PMzR><>jC_<~SFVd7fFlQ{J9On|T-v-Go;(|2q2U>1#N{z0 zYg`UZsLylG)epD^%=%KB?Ec6r5%N@5d4pj#1=>$WNDiR>>AnT8`u7=*3ZuGwEE2!n z$Y#moL1tRDhLgzS@DGk0xYD6}?|}L|&a6A~1cal=&}Vtc0U38)N;z~25K=@P=9#QE z-7$quJ!I~ff+vCt;Q1}3YY;jea2=Rspq%Y-FqsV&j;!@C1WX<3yW=Z7+Q?l!h@5Sj zc9?&1;A;GXW3g$c7$NgPE<`w2nD*xzt{}q>%ShJz;BflVP*FU0*_P6f*@gtK?kMMZ z%rwYp2p<$?dwxflZT1@UC)5dn*9ngRKP{XC<~Lxd!*iAsQkfRt-~X=2fxdQOpzi_U zJn-|vi0gD~GAr5<(Irq&ys2ZY~1NImKlK<8DX!+n$& zLOu`~B(n}j3Qq^~-BHSUKFtuG2`&?!4dy$a8u#CY8TUb9#^pClsKdCN<3Q%|bnOb| z9S7#|pnRTi;0pja9uGZs=L@rLKTC#w2|}{!Po*3-d91%^xPlCQhV-hx(CD~xU*g^+ z`ZWm20X9asd*Ic6o8d>vuupqrwZF^g>^1x{8Tz#d$$@L}5AHR1wf{H6yslBd9x}4p z4^l399%A@>(O&_5vf3YSbS4{KBKj+#PgeW<4NvWV!!X~&WPTc;PgZ@dZ?5`#48JV; ztD#R;{nw1n-wX%jyof-b9AM*tJCkxLZ>Hf(M86q2=Yfg)lS3v zg=yy{GU7%Nm#lFQ8T})M6A_1bWB)NwnDd{~$*{8-cF1byJkenuat&W0`dgq+4qOL- z`-13j4i@LEGA+)R;`{KlzYRKMwZBkwX#W=B;0ng4$m zefDkb!kkmJlZ?2JLZ7VZ@|{>cMo$R;9AT%Czd%OZ4#Xt~clxbKP%-_!qr=sW{CS?&KwbZGzQ zhMy6>8{u!su>Tz5k~QudqQkgv3LioEXCrsx%!`>D?^>Rg=8X&7*b;K6x;K3&|0w`(aA@M-A;cBLUuQdn~IQ4pUl3Lk6mb=af=H|}ubB4IZs5gtpOOYjfwbojIk@4D>n1;9Cwg(!y(%S+brts4i5KJ^%v zW4Uo;=(8Tks-I7}=uZ+p3nBH=&hf^W*}{1UbA@RGLouhrx~MKHRaufRWKBPzQVk`u-Z>B?zO!M-lEMGvjbSfu}y@KNFsYxW6^>*M}Qw8gXzBV>AH z*3VOh-8cmD=OFuUBX?sG$PYpGrpRgYA4cbxFz5EYZ{#UbpPUPLHW~TkIYJJwLf}S; z9H)un00;7LZl0jzbE4>EKu!*nP{X@NNJHb|ypz?~CbR9V6>dTJk}!4LxClC&cjEGc zo85lce;KwJ_W<}tGUPm_Zkz*V-9BODZ;1Xg=%Z5L8JC-@5FQeK58)pS^E{-@5JIxrJVrU}Q2J*Vf&?z|M5oAqTz$fOGdR(5KF|qR;uY?pcJ$zd||U^1LAjN?lZ6 zmB?pelN>1Xo9@uzSgu2K=3y5(z>^Y= z{UgiBdA&~xGymMCJPmyt`${tB9P_((WX|jDC;eUt?2xrSQz)0XXA5T{9BSCz<3Ohf z$B6r=KNjIcGU|s#AZt4;5FPf(vxM0ve_8ZvpikC3l!^}Tdu|e)h0r1E@v0RazQegf z_!|hr!rw%A9~t?nMO?DBXLs*|Jo8!3_eG~3I%GYjkBWQ+a2ziS&wN7<*>tf$?0V1M4&?sd>H^YOmtX>ye3hf z&$Jc`HzI5m=GAUMNaGsAxMLqHpqd+ z_y;!{p7Nlu%H1^)@>IylfhG6{=dO>CrwOaP5Zknqfsm~7FNmB~K~}jNm!d2ckbQ|d z!e1f7P6#16z(xqi;!!?AIB*N4a*u-WNcLFk@+A#O_o>csEa;WH}EHKrZLb>l|p@On~XblkNA^55YA{6OTi z&+7s6L-|o*+GoF`@^OY+$&!|Pu8X*wulBgndDXD%b3}hsqG$7Bgf(Q5yFLMS?u5*p zzu;-ek9#fw=2-4+>|=h&=fW#rEL;G6cV7=3&NckH$Z5yjn?ug|i2o^a@;kzuCwc)+ zB-$j;G0bU+35U-Fz3lVW#n%NbN=FSBfl8&X>&5d&j~Z#8w~TEXX^YK z;eQCzPM0wA@S-q}9p8DT{-1H<#(Ac!TNKYXfDAe3Zt}M>GWU-W?nHQ%;Zic<@_bn= z@_K}vLrOW_&qdC(ju?3o@}W9sl93kkc9AgaaFXFE!qj2eG|zL4e2FmIYQ)I*8u=d$ z9~CY`$oZJG$v)(m(ec9;qUp_ zNqkS3_X-b^p+5s^WUbr1BIh-V9N z`XAh;%?^ZoK1Jql8ry`qRtL8!=NM|IFxUKG9LhPK`l&G2z~~W<-KRi@Yl?8LF!f(R z_?$4;(%?4buONI$cmm4%7c%Ot6?H|{I)7Vq{)zCoa02X~5at-;bZj&3Cd4J{@#Q;5 zOluOtbA&&GaF{U1V57*08%12Q_SLzf!!=hX2-D8zg{L8$qKrITONO1zutQcm*Ne_P zg!6?f5ta$F%`6gLim+CgV~0jEY;J)~a^PzKxJ@G8CLH*>6Z_gFF6ZxkUzqjtGtu7; zHL}+2lcK}5TYfA22Es$ajQchjd3Y3Y$r|@P(ea@U2f(wQPeYg@%yMOr5w`ePNdUr)1<|58{#ochWkZt%-b}a3Ji&ZtPAwjQe}hc?P@4n(kjHht4sC zeD|Ns^sae9(cwBD-xq!kVFwxduS1`#dHYY%*@N%}VV3tL zVUBIN&3bqZ;j6-27v~Scya#zxnD;f@ratTZ@4~$I`KK_~s!4>W4%@>ZVd`HXO#MrQ zIX36LCG~mzx?1>)2(J<5Z|vMwo%zD`2&>2_`(f5ISjP!p6Zu<^lXaZdNIBBtS~V@g zyAZA?!_E=tll6Fg*XZ1Dc&p(@gt@lO56Q6eHtdkq&SOTWOLUGwhpc&iLFC6FCkIvm z;C@Rv^2~K{UK1T3#(rdt`&ZH7dy^-Gx&95G9WXBM?}iC;J)3M{-c#g~k!L>tAnS7# zKAKM}U=F#JiVn}6p9w#W zaKDkiAWS=dHGG=zQG{n1&Jf09L+>69c_8Odj=Z7D9OL8U&Rs$|beIQJjnfGV2O0rz z*TOSys&Jr*Qaq1^r#wwKu$EGJmIa&N1+Rjq4)aA;o8J=oFofg)UkZb}7oPcHzk0v$ z^9XrOqWlm-cfSUkAz_W{?!}-(eU?Y{e=9r#A^Q%>S)Zqq$G{`xvGJdee{d|nGWRJn zugW6~=Ng`1c#`2l!_0@;nQeHU;R?eG4c8l9X?V5aX2bUy-eef)^IydOUYqcb^O(oj zKi*>=Gd~Li7lQX+O!C@~pA82t58i*NLwB$1&-b{1ayC4;>G1xE4!yZ2@(g({<*X#Q z5_rEnE3P5);Q?GNyq^sdZUwx*faHzu{c>)yDf{JoY$2m!M_&OP5Cb}c=%Et{S`+MbSWL%f%LWXk<=Nm3GJk#(z!+h4DHtWd)J^KxY zn+>-b-fVcg;a!IJ80K?kwg0N&w+tU6%kPi<5_*}>2vk1IaE{>#h6@bycSMal*Kmd5 zTEi>J?4;o$hVM1Z`+wEhW|;T&D&KAR8N>W7PjwC(e%r7w5jwoM!37Ox7#?9b&+sI} z(+$ryTw-`3d9arje~(jMZMelS-vv~iEr$8rUge#J_ZdE5_;tfa4D-D~wUgYhm-(Kb z%6WgToNGAWaG~LuhUXcsFD{nTu-S95MeBWF3dC%)l^XmCk!*3Zr zX1E{v2GvhB%zIUp=NRTasmcosbL|&@x|i-;!xe^kkEuE<$?Rz1B8KlZ95uYnaEIaD zhMysyRGmi+cN*Sj_<-Tp4IeRl+;B4bd$rHsZj?iYa}DPkE;KyT@I1pchWQ(h+HWx2 zY`E3%X2aXb!@PRlWtjJMD(8KmGVkM*-!gp6aKGeUom9ia4Cff;Gb6Rh`!(emhUXft zFkEYRrD6Wwq;~E#95uYnaEIaDhMzHf(C}fyZyV->5KT8|IKwdSkyIzoFrN>qoWDIO z^FCIY_vgwB4X-e~+Hi~EO@_A^e$;TM;eCb=7=GRG5yQs~C#Ur0GtF?waIWEe!-a-t z8lGpk#&Esi2E)yU|G( zBq3l(17t`XDUY@xrFg^8DMM)rl+KH3S|gQKk?Er-9Y`&u6lTz|mT{y-%WE0O&QNPx z#_IEZ-#%;IyY9&iiG8o{&-!KG{q42a{`Q}<&p!WGwj11S@Z$zQZSYZppEvl7!LJ#7 z!QgD12kAD-GkB!IWd=_&IBxJ9gBKcHXK<6j>kLj9yv^WFgC8?^zroKKeA3{T3_fS@ z8wT@2E_AiOoD-EtPxZ2=GgVz|m!Qd?h z?=rZ@;C%)kGWfW`rwl%8@OgvZGB_tMH4X&^#|$28@Dzh*7(CbDMF!U!++uL6!J7@< zZg983j~o27!AA{#-rzF^zh>|SgR?J7^*ztvkp`C;Jjvj=!E+2=XmFjuO$M(sIAQQM zgF6j=%;5b7KV$GogI_ZEoWXAx%nz25^WWe?gG&uAH@L#!N`tEmt~R*Q;57zsFnEi> zyA19zc%Q+C3_fn~DTB`%eBR)<49>YcH4X&^#|$28@Dzh*7(CbDMF!U!++uL6!J7@< zZg983j~o27!AA{#-rzF^zh>|SgR^n1taBjG;E@KG89d40xWRJ_UTAQg!A%CQGdN-J zHiJ72e$3$g20vr)N#fD|vHm54&l&s%@wL7U9}Fmt8eB+xoo`cWaJj)1#Mk>al?GQC zTy1cp!D|fOVDJ`$cNyGc@IHeN8GPK}QwEPlp95HC@Bo@#BI#pLnr(b#_V0r>ouZ!+7-%drdGH(*G5nn-{p1c*iSzC` z0IPH7Ie<;d17p(3?x0JESI0ryTOW^uEi}+Lxb}PFTj)t~d|gdTjW@owxmik4>+ekI zI}99m(iy1VhLn+Uk{rxR`kD3pB?q$u`)Z0Zz24N0nz9J&rK{M7@qK0<_fM`G6UI-l z&CX~CgML`d9y}N_V}8*}ldF)p9+vtCQKsJ&!i`Vg-lbdun=R1CEaTeX56K_1Dr6X{ zKZfR_!{HD0AWRmgIR?JiD9G09yQcIrwkwxo4|0c^%m!vP$!yT?QZkTv+B!0jao_-th6FHbztLsrfZqLm8-K@x|$u(N?gtkXy;td z4rry`tH&={wPMB6m6#wrq&L@$H|GmjVsYLgqk{yNye2u{8AKF=4Ia;Wcs$``5`J;3 zDk*q$<>V^-631Q2^Q!MmeKW=K%wst|TDN?0(IaxAe0+Rw`8F6nJSt4`)c{+*IY?(} z-=Y9tkKw~3s3hO|0N+BS`TSl*+qVu1+rH!A<8$Li=R|C$BKNoHJ;=<32gcJygyTae-z-`0=`n{$cJ05Nj~?k0n)mC`Obj03F;&ci#|>z zWFPogFZnJ(U>TaO{ z0AIm8&ufK_e7MDs67_t>_5&lo;F!et)Y zyCA^FcQnRAucG~(7vMVyz6~&9e|4=O-`W6Q1=5_8D$2)iHHhPqQFRaAIfIUTqY#)! zKKEV*Vx7-3uvjPu)JgnEfUj^tYJ2eUg7UfdHVhx%t;odplK@|-;VU+L^h;&8$DDrn z`2Gj$i6c;hvl1#bg3)h|7crp3h-5ck7LKcTNKL2?>#JE3({7YN2wM& z&F;@`84S384P@6Oe7fDpSK?~&f3zPThn_etc|B%ac$+}`@x=h&cBJKXFIQ6e_>PO^ z+Xuc%Sa4j%8otK^e9t3Y@0k1_<>NQ$mhUa_t$_*oc>95QQ3QU+V#m1x8IM7)qI|~! zd@UbFyHJpPSC4~ai(~SCly3+C zaa{5$KjQn*A|KBcm={GT0U#gipzwW=pHLw}$S_CjbRO)(!Ia;8s3@dQFygpm6x@sV z^I^++_1uB=x_5mLYrT7*oFHWwX}vo@My&Oof!!yKoz}Z8Q144Mo_7d#te5kPcC44* z-&nqC93&@0ucCZ>Z-_W98M|sz$7!A`F^_!Qp5)6ypmcx_kByVUJj!pyPW#abJI-en z@=?wM5XYH-974St5VIeAwUK$OcMP_Z?Z-Lral5L}jxri{mT$%qpNo9c5R`9TfRE4h z`2WRJl#lN(S-!`?$9Mh6cPoPO>Hjv??Yk5w56VGKQZu;sk`U{-@c9?NO;SzxH1^EfWqAR@2w@!oR`X%*#rC&2f{iq!Vyc2U0T0({lrD^@bGW3mKx zwta;wQ|BeK#g6U!aDZ<^KYaYA#`2XLzBz_(V}P#*eEG;%(f+Ov@KqYVyI`#SeI&s5 zH25|snbZI3F$SBkaC&X<$@@VyUq=39{=I+s@DxsJ8-k{|UW{j>}g9^-e*(d|#O3{80q0_n83S zl$h_sB*^#o0lsr>{(eZl`wZW|3ZM4lF7VN3n2Pq}ZL!0W;-tLPKMty$_Ji-H5yvIt z4b*!cnDtg8Xg@|_jUc!3odRDT(kjY#YryVYKXxAv*j?zy?r#EiIioYzdqC`X&Oj-I zonoeST)qc8bU7)Nu$z)h`F2eHSok!n6?WS-ftY+0z5~a;$C-ef{fz%j2gk1-fq7Ac zR|0&6*Lq&-2xN#T-{}C~(G9*G`5F+E&u$A+Z0Erg>j9QucRZvWw-1*HGd;ZRGx05} z833)9*O1n(^2?t0Z)l5(+WEJSnpclsGJaKU!~0|9v6T4O|D8N(lFOKI(}W2V9jea# z^vpT4LLp`17=A1{j;yC_5`NGKM*ON{tapP$ynehMfuAbOMYtc~(+FQe_*2Tx7vFiO z^{4N=^QWxikKrysp;-u=6Bm=w&9~ljcMSJoo0qRziES`7HoDHs9o;PdY%9j62Gly; z^7~gVt&2U-jGKX~8$E8qq-GY1;lCL+=h~w9_kdcQYW`=g@iG2SK)0z~UDV@&11M|m zPpVyQZ1d!Yy>m+s!&g9fPuA(|lA7#^HAB{W-kBV4|GbW4-s78UBZ=15>ekkl&55qg z)~**{ID$PZF%3mJpE`6pdw0)w=5^I%CyVTS+Z0)_|EF?z~_P_y0aI?e)>uyfV7@xzQz#xX}`CpVzVTw_8$8UaiU+Y|B|wBXp~`{(T$RyOTB>!pS34}0F*xxWgX&fb%iZ1ju&VcT-y z-(BB!_q2^JV&6V|E&?=cP31=3xA8y_f1XD{3?x~(A2DVp{Kz zs@(~nCQ0(|apY)8zbhS^e&&~3=a(y+7yIg= zak-<;b1qHu_GI;TZi({4WptZL=$_u%)m!Onx=OB5kf-3iKIkdg+^|32$9p@s=&+AE zKW1a)#@}BO8h)ua`DHJf6MgTVoc5abzi3}y{^)1o?VqWw$!pydTd@C@*!C|h_{c4> zE*bNK+0mlgf9>`fKnh{J(mMm$(1A^^rqgDhh8r1%I-4S6qSu2Ztr?@5~)h6iQZ&G7WV@ zU&3yJDtdbhH$9lR`{1zFhYqz*PnOtK)b_2veQ0O)?X^cjUhRuN-8^FGcfCaI<_mkW z&|1G0wJ*H5@t7AaY_CncTyaVJ*7Q18d|lFiF}>Yguw*7rrO$?CeANs&*Vr*tG1(Zm;s?DZidNX=6Typ1m$V816beseMBG zwDx&^D>oM%De@|xO&pG{*fgW}aNfae7--he0xw#>|Jn8liD}=Nx9Q6}o{jGKQsJ=M zpPf~Q=6MgpZ)fLl-*&;K|4}hY`L+10Y%f)*C}-Ec_%E~W@z$WmO%HCoL)tZ#{hQPt zYQL<#xc%YwzY*gx8w+s!e>U+18n^6@!v}|&wjH?yZQFiXdnoa2@8Poc;)6qXCdl!u zlx=7`R=c?nO^Dvvdw8rZ$|fAS!Mgz7P4E1EMApz7y}gG^_k>=rxy*nv|I@A~cQ z#h0CXwyQYrL@2g5c4ml&G&fD+;RUDi{`1)*BfaI%E;yZ!(c4;5l=z#6hGz|(?X~WR zZLKZ3_UP4HJ44=%%f3{2?Xt?Ly}fg*zm3@`!#Wh_1HHWqO^e_GrMI`r+N{XkHFYBn z)~M{%#dDQds2sZ)&%-5Z9A)NRGh(;Syu0f5S-0Oht!ifM?wRxE&%CF~<$3OR`pnyIziR*+vfMTE z!vk3POc%AAyxxoEMhm}^TfY4>@t)6g?udOdYrzk5V(nj8P@gmVGm%7Fj<+j^tCo)G zxZGKI(18Pn-?78+$AU}B!y`WuioWNSPOto*Fj4Z%8uB0Ga_`^yUf)b?PGcXI;^T6U zzjAcm-r{T=9(AOWnfK>^c2)?!VfM}~xeOzVwR}$&$My7(>R%+Sk#XCtw@!_fEm^&) zxw&Q4s>X45-41w1| zABE@SidkMUITTwPa%Iv(?PW_vV}W^1#+c{&JU6@vf#tBfx@+7kk)Zxg#A>qunCJVn z`3Ued#I)H7Og`#&0jvGjfGN}y^IjnBeg@1e>dyeE{l8KPp`KXnuVEnw^~8L(K~)?- zLlBoB%mn5*5YrDXh4w1icix|2He*UA8;%8S81uOxIpYY_5l=^;WGcHBdfG9j(1sYd z2wmBS5NqEPz-6L;+~~27B=!FcOd$_3W47UC1Par{yxyVycL)^fiE%5!>90VgTJHz| zoNhV&`+?bB+D`z+Efc5z5HS9nel7qmWu5*3Dj~Ed)@}DGqbKGzVtc-9^u&D5Mg6yp zo|xyM)c+7zw<-NJ>wJ3_xKwO@3rt}fh`C>|Ed6v+s3+F8jWBxRV&s<~d;pkKw4VZ8 zB>KC7Dby3=vfJ6OF?wRHcZ<;z^Rl`G;W)7NwQ*7ox`R+;Ge%!xuy;_-;t&LhCu&ZEHGKdFBaSljd8fhjCYtaJWN zqbFuQ%VuFgP|j>%oe!6Ap@7hiSoQRIruKzKUu^7&nI!*cqes$-t}~n)x_$YaM#pUm@N5Lu)rO#BvJDuw>Ye_ph}FIunCBg|{{{jjQ@s~!n_tT3RGjVo zI_-W&*wwDN+(+|L381j+O-dC`uC~4|?Dlq>&n=mfu=AE|(_F1m62_hyl_a-8mfLe} zK2AD}gx#u^QiR>AXw${11W?$GXi61^#!A@j2`Nq3jk-;9Mx`X|X0T23XpoYy^FC_R zrKto^*sZ=PRoJ^Od7qNUx_pf1tW>t!8XpRz>jLRd1=3ps>2C$n-w&kE1=87^gd&^` zF-ddI=3`Ht9LT3%P|9?Kd~EM~0{Ke<>83!M=Nu}m@9zR>9y?T+|I0x7cY*ZVfpk8` zRfXmGzdcl#z9o=e7)UP;r1`Ff3d_?^z6#Ud45Uv6(*GVvhs~5^`H_M21W9vW&&S(F ze5ZoKbs-<~e@VdJzNFQM+oSKz&=^0IpH7(0ltzNNMERtkP$c-(%bj6aUPb9Uj3T}Xwn)~}I zv0;-+*V8_m3O)6w3WmMufm*(5&Kg!UCCepisKvEfQoCw-o!jn?74Ktb*c_~@pRK{H zi*IMw(B{ScY-#55RearE$-c=H&6ts{B>iM1)lExR$n246L&fT)HFb+?A6T}` zPHyPaCQEXDCF}BE#paMLspWFug?Lg2!C^FsdCs7E9%mJET~Lf$RY}Y>M)f@MDvlA$ zp_oTB#bw02K!ETXRQ2V=ya0jld5(V5&hwy93_lQ_TZgdxP~r$$c80-~#3lHF%t26_ zxy08{>%Uj2`h`e`*g(i41l2Pg;>npvhz*ChvAW*JZmh=m*p1ZIKgsCK+Tdg6gXbc4I5{Zfpft(}ow=kU9h{TTeWhTK`#< z`ekcEI>g38S`gG{*&5=h)cU@eLx1MuRz%wV4aDpmB!Qs%%?2|sB=>C`mQ%EB>ILT* z?6#fg^Qh;8Mo0mI`avrsj^hX7wq4voFNR3%ONpoXdj4t~xLfi&Zwfb6!BGDm2Zw-q zwyRw*+f^9y^=ucS=fcBxd1=G@EVQEy+y0X1c|YYBf_cw{cC=xi zVn}Oym`6SP$MVE6!TP^dTpsEg3q5xgmgOeCjTrVE17fx3xhrjGf1km4&BfW5AtsK< z8uFLMW`n_e)=Pf!5G((GH8y(;{sA%U%MlYtWG(tfV{_Wz-w?xo5@O;AZ?-^qu|z$$ z6>%hnAIK0hws|t1oR-9qVrSxABlLfrW#__%SbdWIv)HixKNlRw{Cb@j_EoSa*1G5;PutJ)cj7SYJ~SI_Rz#3$SCxk>vi# z|JzC-j+8m*u9B(GMv@c}Ii~PF6!o+vj&P@e@X$qlRB%L&HH=snms1`#XoK!J9AV=j zTq3FGK1v)JhaX4_0>7tc8y+M^CwPxzgWy+j-rr+v-2NgqFNn>{h<_@W_iNmKAvXEk zF2G9>^BrAc+RQO{1+lbYwdmP~|00<81nF;)WrtzxpEUSKf~&#FdxYfSxVbqa_PN|% zz`Td${#P_G?|JdvN$NKtcKZ3ko|e7b;HwSh{aM<) ziE_mTUq_7gaPARDK3DjmV6FrIB$)TO-Tz8~{aNT<7CrBAzbZHi``-xW^Ml_B<}-sV1h%IUZ6J>D zW;CQg^i6^zoP>~TMc*PgaUWSYRuT(m74cB~K&lZG zHyXUg;0*?EF?g53JqGVH_>jTJ4L)V?S%c3T{FcEy#%VhX42~Jh^FXzkV(<)uc|22p z+=~pZH@JnE8xYcJ@MeQ~-l#U+20uksrGS$=NQcA3TjhlaFfC74CZl1?Y9}+Y4BqP?>G1vgHIalzW0=|I%o8680=vk z(|UP~QCw(nslnw2R~TGraFxMa=asY3;57zsFnEi>yA19zc%Q+C3_fl!*Kn=(tik6E ze#_vT?3BIp(=Fo`Gy1UxPce9g!Ol;&ly!c(1-oze1Uo<7f?G}5%?58bxZ7aor(4Q8 zKiz_l8XM=QTl8m){xyRy80`FXi@o#HE!g?#7VP|V3wD0G1;=s2OUIetxhZyjy2Zx% z=@#t#bPINVx&=Ew-GZH;Zo!>~^D%>+pKdPL5cfTtVCSb>u=CT+g9*g>=@#t#bPMK- z4a20vpxw+A9MI{C*hyP5 zczAIJ$pOu5Afwq&J5v47aU4vm`j)zA8!2~UG?Bs-zIF*okoaAeNha=50O#c$W^6?z73_2C%egz8Kz83KD z+?VZ(NFMp3C~x^1kx&j~C-E@R$Ek$8X4=QcI@-R90ACZyjcAhhWQe&fDgD`1!icA= z1KII@JNe{RkmK7yViD#sJScWL|Drf2)AwI#s(t5uRXctc&|jVlar}6hqy2T~%SbEV zLS)G03$!V|F9i5HWBxoPA1{xTkIw+`m*i_i#&o1rXh-351L8Onko__LzBBo*L{PpT z3!je5H<2NScv$&$u|D1tvi0tVoxZO}JMvL-U`HHh0#aR!>tIZH){9*rS#L#v?+i9# zru~xdlv=)Q5Ydi&81f|FeZr^x;Q!?2+M&X>Gr044#JW8;4^O?@M_cX3X9D$(M1?UB zu-^BH9rq93TOzOW@&5#5>c`gtd=+C-{U|nkKM}ri=qUXE0*aYtT?}Vn$8|)d6?RiJ zftWUw*M-kdVIK5j_p3nrs?feF6k>lzBXC^U-**Ch=fTJSZK9&}z8T=_0UzzicO8QA z(H^ErsmHy8a%93h>BA=vcsPRY<22rmo#Gjz(0Y06!Kl611k6dJP&>ZL@!)FsT9uDz z%VR0=vHz>z(B63SH59JJ$K5F7qa@_dXf^ zO8EL|(eSLRyu|QpE64p};gCq;2$K#opA!y4?>Q z$QpW|_t7asFZJ$dU$^K3PiM{gh}ToN?hoI%@$m!YA9yNj<9u)G?kSb){_yyd<&Qj- zb!48GsNa3#g37no^?U%I2;Jp<^v3OvF8J3A>w2c)z3%;4vt~ncFdQvfkExgAjmw?> zt&S1*UN&`8dnh{eNGbNKVb@mP_KSttk;F!A*sKZO!t0KH;PjA#S^BZ%ow*&mqbH!q zdpPDZ-Iv=jJNM|Ywr{nz9*-S5)Upxt$-CnRX+_o!KaqQ1F218mmIBY1oZimvlv&5_ zq4!qZyL;V*)=lO2Pg%I;k=@G{eCc;5hNdh~=GE+qsHwZ7A>2^c@aFlSA9@0d_ ziC)s%8TQ+i2;G@`-IS}2aB5=+j%0gx=5E9`B@Pi|+5J}X+a>%bZ)6M&`Nre2|IdCG zd_@9)Dv@`rG6$tt>8xx zYuO%P<@`Hf3d<6I5P@ZXgOG(l{cjOIhd_NBNL0T8nBz|UCXz#FPdo%M^`8f37WG>I z)Sk~*DAW_HJ)gHws3+!;smXdJt2;}Sfz8lR}rKIn>(zZ6Xl`CgT!f8i$=Ck)H31bU#8&cS(d>m!u@uJgl zE#|gVVS14!5HsBzNN*0LzZyvM99V_r-Mg@|I49rQbMM|csdr|Ly?r^;wTkU=UTpb|f3m^u%G1pm zeSeRK1%3C4{nYy#1;lb+g69r;-<$iQ>SM$_xIwVoCiP{+q902vCzs{Ka=)EhnD1At zLri{Rp2KiE60b$Po){+-+{e2`|7Y0#dj;=Dd|vR?&@V%vJ@<)E6N88Q68Bx|DGwPv z?;)!V_gAfp=e?@uxw7J~3+6t?eNj0dGkWfe%ER$w*=dN`ZDNie`$?>88Zr4eR>VAC zNhhI5uUBJ=hYvEds12eIK?BaV;|5=I{DB~KnP>f$ycR-Qs*QzAAo*bql# zo|lOY*Y`<+Ij1;Z$=?I}8N}e{zCx`0bHs*iSRgiKupw4{J|7_u`Q7_7;Ng5Bj>!JC zPHcEA=_H0tIc$g{vfm+@eCA>?x0yb#;TS1qTNRT_G3TP6=LGJq{pHF z=M|R$mS-O4H`htaSC6z6=27M$5bIe`e|B73a|U6zNcgy}Q^==nXPR{}Y?WC1%YBCD zJ1Sb{b5Ib+CF5}v;4?Dz7rT72zXyO>ock@MG%JOf)_T7O%yKGKu$!U@#M*=(8_ev@ zuw(yK)b1n{wtZ!|e&YDEeLU_nkLgzsv<#rfXPG=Et0?6AxR!4c_-IEy9%7V__Mk{g z3>k4K^PpjUv?C5)w^!qY{72BMXuVw8bq+A^5E}n)YJ^zr-ap~y)P*`wxk>rh|JCdE ziSRz)U$_r^-9BSFDncXtd0*x&aaTEhUt)IfO}qXi@Lk>~_>;8Z|1v4p8I}2?F7@V* zx(5EL^47y+YPcwId(Oxi)1S|oJ)!nl_{WGwZeE~w7>=$^v>gmJ9sR-{xsdO?H`Z}% zcvt5T6g`vU&E0qC#E|M2Vh5h^)A!{rcy-wF1taI=JrUC)xF@lDD6$WRiW0qLUinvJ zzHP^tA$Nbj;NFIphE<>CErYj*zWQ?Xl4!*&OnBUB2-)&kxYLkSbnFZ@EX9omSBhnD zo1v?BuC`#@kWuF+PxIQ~@aDar%sP?%(02+duK&{Zimln9ikydbOlr%{s<{23o5w~^ z-*DXe0_kWNaw7N6T&o(n?u8e#Hgac;zHRj#2eN2d{$$Mf`sio~^>!8>3@23`Q@zi|$Z=E{@}77DAbu_e#84 z;x<1n=`B@zG&jp9lln_~%T&`RFS$)VnKiO<-QE+q@KW-~l>A5U-}{5?WL`9NYh)1GO+lI6B`UW$fvu8nW%w}MLliPKiD??u4vA<9M^YvOVVxZJITU0ygkhKq4KMtX?gQU@sx3LjrZmC z(OuEVp3o<=+9&w5o4>GbZ(HZ5+3d3Br^6j}AvlBybsdiS+2e9Mjt#jpcNR8yc68*y z(2pKY>St%qp6&E3VD!h_+*C!!fza&UV{g9lkH0^2rW%v_)t66)qZM60knJhkVoz3d z&fZQ>xn2M0@2fR>RZ2I1)O*;6Xij^mZCZBQx4hRoTiZ^xzW%eHJ@lDdKDs{ol^-2G z82YP++lwd8sab8u-u~T`E6)|9^5`hLXS|&|D@2ahfA-UH?-_M|{wQ3; zO`)sK9VUMF!QZu8rMuz{+Fns9@JC4!9P;G?eo*`e!zHj*Un;+S6Vf&C}%YSj| zild{kOG?ccw=u(xUXfDVlH0L!NVE~lK=s#UljDBj+LAFhPF;K37oULdBU`p1?DlUV z>$o?ot$4=T)vpxC(TTNhKG%sIE8KNd#&BcE!yVI&*uosm>W!75jTfeeLcF&d&AH>@ z=;wOjIV;pw<4v5F_vmH*$Y4<3&i!54<>xNruv`+|m7Fhc=W;M6uOHslohV9tB&V%= zb5UaT;k@YZ<7L**2ytby1LgzhZpTmWbMdZ zR<>e#cV%x$!R*_xbIPuSh4aOmPUNoOl9W>Io`kVVDmr%Fh_$fc#8B)=$(;)YXHV?y z{Hiehj}<)QcNRy*j?FH2>&UxWa3z%Wvzh z-1MNUe3%Sk_lBaxqdBl^7~9($2fJjjz8iXb;m}Mq9b?99?QY%uSq{R{;VC^VcbB>L zCplZl*>P<2(Js4mHjHlT-iG5vX~Cn|BwLCSKg`)9`=}e#M9%5l*N?sxEj)kW3oid? zPV~}LJsro2o%U4iqd9l<8vX8ATlc!6L?UO?vNm=nk<+lht-IA}o@(nxV-h(B{_X&D zsC_%DKJcBQ#MaXMb2)9py#wDp(C}dW)Vn)d%O5>-_m5xrMN!tqm0sK7yslH(ksVtb z@}s$3w|hrxySgi{!m(v{k8bUb+3&q-*({u_wRJB%T6-|u`fzJ9Yv+|9SlwN@c1?6_ zs-+D}xjn8pn$^(o^yZWr%AEzlV-Lsw^4`wQlv&4^{Dv8`XU=X=Y8+5g2PWF*RYdLK ztE1>WoJUdn?fcyNabGUa6`ZHCfG;zr%k9UBnPg(UIXz@g)~|-5ueuMN#_=Q6 z`OF~NS2=o5DexnAB|*rm35uSG2V-7w zP=e)DKhn=m@~NIzE0mb~#abwFLSn6#?FxyGbtoo}V%jQZ`v$_cY=4~AhJ8>@tGAf# zSDTo@R?ohvjcqg3o<24DGBB_37}J*h*@Z9_p#BWqcQo%B2Y4M z^2(i@dIkS~+lKRj?O{yG)SkiEj6+%SXv}eVKLRBaXAFAUYfO6vN+$a`(9@o=&Xc*o zluY*A?zCr2$z)RmJ#83MGTE?Av|-F~V60ECXir=y`UQw7)Dtt0_S+DYqr>3sz?4k& za$jZ{#*{zShWi6~7*ohY%p(Nb#=BxVo*xCKWU8wedh#%4KFe}H)BQR)|7lB`@d)jL z{~Kbp-w%v)17~y4==nrJ%N{bg7nqW%ZBw9U8OGX|3Sdemdpnm{jy888XuX_Q4I0OyJgzuKj+E@JKbe*h~d-(Xk$Z;k$U zz~n4JxB#quX*+vZzf4Ur>H7|X z9{+rUzV8^|=B*LFQ(&d9zq`w9HflEy(2x^$Z$PF@2KHxX?;f)Js8nIc$EU(63A=UC zrmsmQfcpB2yEl-pYp<^kr@axu@*i_Y6fKkoaGxd+GyOmy{rNz8XCVDVAbm8D{&^sc z+YL@e;5Q%p<48%5b?FJ-2h0>;d+7f{g=s$fq;SjUV}IS2mY$UK7w6~SqQ}#d5E8$?cE`1&a8Z_533|i80XyV*E=9-9y#;9d%Tw=&7(}dH{bh1p!_8~ zREdypY#=>5kX{x@e>#xG)wjJ;Q6Gx*<}@!|y}TynC2vL3a_0jv*)}Tt61B@$)~vp0qaD>^Y~P^I zzrKz8%bLdJb<0~m;h{gAS%_9zFM)ka=#aq6;?mVCYg(57rN7;iEoBjDYCkW}^(F25 zMq6K-+M4F&OYj~Z_OR78_=GAo=4Mh`zlBDf=7F#;we~5nciT_u(zjO411=8F1(6cM_3=f=MB3xp5cln4 zh(gPJTuOYukIRTz31lpS;&Ni)nM54N4`d30mgQ~}k~t73uE!5#27=D*N@C%eWAI$! zIDR0c2+4L|NG$e?h~xNyR3oUK!=ZXssrzgrvFx)=#LMvmX+a1zIOx7t41L_k>x{mY zSnAzC9LJAHsKf`^h!k_kLbbl$ZI=~34kIck_3yY)rTBA#X|xw+*)ic}^i_w`o%#SbencE*JHMh>0UIJ`1Rqvg`(JIA4g>e+-9A zZPtoS3^8#ejvq)X0&QMEoDjSVaThT-@#nB|?iL%i`AM-U6Re!y5gT%z6q~VvBeGA; zp&lFIuMu;+h*=l!3J}jj{9c2L4JKE?X#7BkBhwvpcaW5mQ-L5lRw^I*(jscf8 z+92t$@+=k`wyjZY*hXUI;hfaEJ}oxfzQj5XpB0*2 zu211Kd+3Aqm_}X!I|3n&$nl7W3i?ePhq#0oHY`gVnTsC?$BzD`Vu(4{3;3uALL8Cf z*L#2q#!@SO^#r?mfywFW<$?sc0)alC*c~21Se9cz91)vR>cz(Gr?81a=k`-M4pz_x zdbW``B6>HT>=cAJBF9SCm+?;R%IKWuVW|KeiX-OTJK}|i+lW~q#Pt!FeIeF);`#!6 zj@kPVShfQ()5Kg4Twj2>M6h~tvR%ZHd+`IAjG$#_5yOW4C60U)Kajf+)aGNvuwkEw zb^b3iHmk%2!{`y~{C_}fwjus&V(_4O4(ph3UnnTY4}>_v4G3}i2`Q|4H--~^y=x~H zJr4T_gaW~3#IWHQ5=Xd0Ls*U4xN(3z*BLhsu;*C0aga6YTH0TY_fipe65og)$UX$> zzl->Q;6sQpeVq;KCDv`{wioO%h1|C%EX!^30R&>MZPSUt&o&V2S~Qz_*c?K94>4@G zy@+*NaI?{7KjLM?u;KP1)@{*9J#4;<*lic!F~Faq9`@XJ#LBsmde|I7{CQ&7aN7|p z=NGAm&36%hlNdG_QipZ>UQ7KX{6O3`0_OM->vnN#d(1yKaoY$s90y|MxgEFwhJ2c` zG|R`ILi{gCtKRv66PwqJ{&j;n?gcmD2SOZK;-G)*K-s&HoQgmjwv$+GZlfMHa}hTX z!-nl7j@01?vKm3#(<=Dah}{^%p4-li;Zgv|mk`vxix@WCcEq|Zb{m@~#fIC9Shs~c z=AvzU@^n;exV?y#=OpzqJ}-(5w->SUoS|NL{s%GI6GKcK;e>(=4W)SAM+}=%=!qlu zI}>lbvEla|v?)UtafE{gi5r{QV#9reSZ(;thqk9yY&b87wO=95MYJuq^){%2dJZ3;mXH+$zCCto^MvHqMVGZ05j*SZ)4`vEg?F>+bz6$oldhGay*wCIn&&atDHpE)*A!Bn)Y!<K_~#uMtrGY?ry}9TKquVI(&_PF2FUA_FR{UBP;MD5-Rlp z%ZEn$IFFc%I)v*>2}6ogGq%5R&sK&e0GX z0^!^Wz28BvnwVsedW4Xi8#EEi`2e>;2*)5wD?*5i03?B+|0iJ!v5Xb-w2$n+_R;lA z`p6;BKC*i4Bi9A(qietPk^7AHv6@)=*hnmWbnTQrZlGTJ=-S3gAiEH>k3GcF$9=@o z$3w)@$K%A9!<179+Q+lRL#g$@d4taw{F=cRh`GTb*;r2$=NUYb z_!8fy%-~4|$B8fXZRQxvwOaLc#P9KKnhaiNaDq6`x8XNhiaQN{jQBF&hU=~3XAI`L zs^5aYWH8rN)xTk|hqXh$7kB<9FZcNijlR_2a^eEtro!M#gSmdHO*QcqzPY`1v`I}f}Ouf!SNv}e&=s8=9=a?f0Kfp zze&N)-=tvYZ?f38cm5^?JAadcJIOED`I{8%{7njW{w4)Gf0Kfpze&N)-=tvYZ&I*_ zby4}9ze&+Mf0Kfpze&N)-=tvYZ&I-HHz~Nva8?sv5B=PO*}<^0pY~zyV9Us( z-FIj19^VeONb)J}U<+v9`#i)QEJ5;_pZJFyc)0sMz8!2`+StI;*})d?_gU>=2~v++ z2U{ZjA?;vGr9HA8Od&p19gH2HcMi&VK>7}nKHdZP5V%-T>qB(lwV;o0)fBZ^2rgpf zuL2h_u-AmuM23PhX3)w(@ zO)g>Ys*lN1Xx~6Jq%C>xs+P2pgQ&?alkch`TX5hJ_ZQcTbsNj-pzC)_Fnx&O)j@Ck znwF(2n`_3qf1~R!0c%=##v-jkg6|OeCvb!Kjlm{_fKxgryfl}~d6&j%x09>zOB{D8 zoXg_|&IaIW1eRwWFHiYg!}8T3Etg+Fz8&Mc1;?3y#AE(*s%l_d<|O&n16#f|l849% z>!qwiAdVwY*2VnxR0HFbJju5k*z&QQT*d;W+V?fVaVjB+m_IJnz{3!Lo> z-a=5m>99l9Nxo-*M>;0|NBMYP-SSm|uL>sB2v;H~pSvf6w6^bz1AH?|QtbnEl5aR5b z+X8&`;Nv~SY8YOFpzS*x;Ol`+ruB;V;%$F9c)EX#Hhk{h64E+f_JhxgCiy&x7?G3y z?0A2Q>(fAX`lXrN5_UeUSWbm?F-$}!7;F0uA@PzLA!Z*b;{b@`OhC#@agQCg)xf-6 z&pd9&WdN3MSC;RG5Lr%WN2viIjxzz-jzK$*xEg`Cz?nzB&jDDzvFNzm3Pi4N$2bw- zOI({;pLy$C`JN2$%>dt65{S@_LVxGPaV8+0;A=!&jljnW%wzl9y)?u+eof%x@k&Mc z-U6`w;Qh@^cGuwGY3*A3vHMWKF42!2zsInAynmW${aXt=+utaj+30-cI|$m}Cjxwr z^~1+|ah9*b@ZD_qUJ39W1)n_Xa6?EA%IN@KBls$yuSVee9@@T3u_0`KFMzKE`6|jc z9Co&SJ>V;aQ8mIX2+H@t0N+St%tgKm?IO~b3-r|pe~zGh?j9e~Fn2;f{rQ3! zDc}78zC~rJ`8-YRIRADB+SdvKxus0HB;VHpd@Y9WR@teBfvKW+dI>F$*cfhC!QhlR(v%=C4%xj z6yW2%=S+NU0lxi)Z?@q(Bz!t9)iNJp;zY;gLZDvW+vdABDmpH|3DkQM^)|w&8sSa^ z?MF$DKh9e3-}h7R$HWes&k65&_X=jD^?n3)#BnMi{C@*{K35IQd9C$s4%E95#PWy@ zR;hXLgFwAoV8{JZMeFSi)Z2=KMkS1@5$-|IdjB)PcN~0t4x^%cZv^;`f{)K5s$n=E zLHXW0JbnC*q7ze;46$yv+r&=Ck4_S&8au6bI_!w!l6Mx1q@E`(gihI6yO_)iAcL@7=8>v`DmYopmIFl^UlDo1`1uD^MFC;na$}vhLhn-GStg!j5Iq8 z%61kO(e}N6lJ)dBu;0fC<&&oPB?k8UxG;vw(1=N{&N94 z%AcLm`L6C**TJyW(K#F>-RD_*2rkdMYC=9|(C1l2S8vqM@qM19Jg2=o9{5g6;~BHD za^vqW2@U7t`pGq+z1?0{XXx&l_tn-&H{mX;t7hcgKmN&xH?KW9F`6^`R(kzAys)k2 z%IP&D{3gMD)6UWrxg(C{bRLWO*~yIDYv|Vr1$<4%rs9UrZi34*qeJoCv5JvK^GRr~ zKJ0nVb;A8vs_d~*@CkK)!&*3?OKDO1*huFOD`hzKs@6PAla=mIt>MbH;t@ylI}?XKNoSF+Y?x+0p^uiS#R;!y{~4cps_uim+R z?T(#a+|tkr?_0@6p_7+8HH|dr_3IBx66v&5gp=Z!@J#xow?Cj8?lX}Bled( zcX(0n;cE5%2ghK?a!~b&Vd}H<_2L3l`dsmqy~TygLu;SxI$Slq<_fK<M9=Tll14{ zD|YwHdGlx9Q*}{CUjZY3e>*)SnnSN&C$iDl_Gx}Kr~jYx`^6&+g=dKr9Qd86USrMI zc#YWcs6(M$$RVFgG5Hi*8;i-QHWsrE)w3SOfJuK@I1sucBV&rTpIH50#ejMA)VKtg zfs)CdXAHF0GlxIchF5~*VNA)y!@E_qVNA(n!=p8A7*jIY-~jGy7;|h(5cEv(e~0}^ z;b(j~HU#;9j+ono{AU3=5L3UFjfGH8j1xzv|1_}Lw;KItjea9A{+vDE%Hl~$3Bun1 zYrnoo14yQR@vM^BjMe^wz!YomYxv6+sr2>XBQIo$K{)Lyho>*{LRB)~-aTP{p;Egz zoObodeBND5NjN!Id|lXm#b)zksRU5ijZI1wc6ZxsdUPt`?5_=^%L3`^1L+$A>9K*d z9X+el*KreDooE0q#Fb2&jivt18LrCS0Ud&2GYL>q_L5bLi?c4n5zQ$;{xe9fi&Nb zR3YET18Lqnq;S>9$86Xd$hSUHnpbD`k)r=27a!&00ekWjd-L%2;`oHRP z!nzI_lvAFh4+`-ygY+PMXbjG2McST{KGJ-hK(_&K1`igY61O|MpHQifd1j!PX9Xd1 zm{h&9F^5C_rhp9k9f89d7F~lreAg6)E5e_hf zo0EFhL#+BD(bJYVB6H92$myfyVG|3WCl7H%<|NOA3a-Qtgg7GejprTwc9=pO;R8Pi z&-@DHGK19+lan|i^R}3Jydc5tTuuxdwuM;v9S<80aXi2odC;gN4{U-wpGWxuIsH9@ zbCLp_(EI{1pY0R#?4R!gC~h;D{bgC!OB|8?JZ ziVgQ;;>cwDKspiF9@h0ZG1?qMOssY7r(W9pJ!06DA|}?lekeBN`H9$+AtqLySHy;G z{&%q%i{?phD<#t3}<7>Bb+1uwz*nt*k-=p!}i2sL#%E73$bC}*NV*y*bqmi0zeX?uN17`l5df+ugFuzhUedG!(7-9>vxgvJ64RzS?Hb<8_qRiwV^*p9h387vk*4K`W@v3W0Qq8 zu`aHi#QHts)uOM4o;VT*fLu$xY?mowQwKeG66r3A_V%c;O3i1 z44bIn$gKb(`fU`;>$g#P#9YiEg$N;8S7XFfK*|vGTO`i!5G#amj;ep8II*-DF!>!8 z+o5$ieyNN5q}Js)rLGFrd&83xZK#&bE!B7^G< zZXw3;i_&WFW`nmI+)c~_2;^~tpEmfY!Os(8&Qs19{F=esAJxWv+bH(#-8;b}G0)Ye z%wYFzqu9ia-hJCBdhTCZ)_vP3diQOkU>-O1yF#v0iru%3*heUxM*qL^-4m{g%-0AP z`TPZjgZnHga1ChQ_P;ngukn)CRPqM#z$N;<)Ew}G5@~1ZvU0E`(ykx}Q)p1%x1c%h zQ$6) z1{B0`$=CwEQeg6h5tzqvyf(1yV>vmL0{M1~R|t+X0oeyWo+glwch{Bg5n#(VNAeIk zp&g|QfjEvpId1yP!@ctTGqB~GD|v{VDBtr)S-w+-kB5EbD*~D2t3qC;@w);>mhUY1 zN@2_X^6;;Ga{_$T$jiicTYxVI$4KSlseqI^6DA&yJVHk{O!1Cx)3bLBf8;Cn;tHA1!%UOy0Xu2K54I|U=ow}I^F zKZkre@5#sWZWZmvX&BjlJOd-0r##)&e&l4O^YQ$!M9IXC$uR6J-%H@Df_@SLd6n<_ z0N+^f$!ROBd^^T-19p@8vHL{8j@O)WnoSy4FXNU#`^s@%rQ416+CKX10Y!5B79t_1 z_M}PjeLcWe4L%(|-q%pR7Xy4e=atjGG`=4P_|_P{nBk+(eYS6+EA4roMS^vyFpuF5 zvD1058OjPZLab%zv!6IFd0S9#B`~+!H3-^|2Lko-Je&8}RJ7j51NHJ8JX5{j2-JJZ z)O#&RwcgW#dU;-+son?*unpQ@p0n$dXSR`il%W8`aV8+K0t6`7-|G>W$93rj0P^WL zKY=vIMMeAj5wX*H`EL6M)d(??PO1Qi<9^bMW3p5Mv)-`?%wxTu03bK#CS@uP8j6|L zdhw5N)ApMN*iE5<2<<4_gwIdmcmlg%KbZG<*x@hPzHMk9*HpHT^)rv{dpN-ND){JY zMMdk~72xAeL_6|vOqGxJrnt8qi(DL;yj52$c6o?-Y{FDX$|*F4b4W$&<-TRq-eWjn L*v-mB)b4)*<=hmH literal 92072 zcmc${4SZD9oi~2xC6ka0nm`yr2s#4^Nf3|#Lcm}X!4MEF;bj0TivxK@5+Dik@<TA4pr6Q0*qEt1&HGVOxz@wn?fGt#p-bS7fC{*H-kYR$Tvzt~k&4d+s@tJ2wIC zexCnl&u8x3-#O=ZzUOy-=jEPz&zr9xP`9D#mc$#qv1XddYS89?uXo0@Ig;g`L`~Da zrfKe%246Q$*0ldWu7(CpvtG?`vtExSYuf*V%Vz&j8+2X2TC@GXyzbbc*}mLWv%b8n zVN?COE%$DypS`ZSwz@%!b*iWuPZCBv$)q+SJsx7tt$&O1lHYGURPbQ zb7+RDKz)^!VaH9==B%qMZ&+84fPqcXfKm6rrpk4-+cpjDGnl=uK2TpDShuAfNek2k zYU&5G)COt>QWlM;p?WA+ByBJN9M?gt!5-y12DB)E%W9c6iws6ehw?CRhw!<#eCN9Q z>RsjQs>(NQG3j4KLdn-vGrjee=#@{!wuWtWmNXlgS-)-l#_|mfNKV7Lq4n~`9JTf9 zHk8*jtZUf0#S#bem7;H}4^&#bs%tAYue&<7V7UUa@Vf$ZeM4P!ZRNU#%_2pEl;5xp z*;HOzU%k0DHV3!YRX3Cm6~^!wR1^&7D3~Rp4RxE=#nd5@S9Bd*jiO#L^)Tux0>sKn z9O}U8+Ax5=u6FZ=&07YlqJ(Q0QYv$}?bQuc)X};P>#qWT1+T%*LyKv&6IV#XhN|)n z_g<;wY(P;n7=-G}(DGcNAdnOFqOSbD&G(j<4VG+6-R6qwO>EIB0^2rO>J9^28ndVd zrSL*g5@ayCWU4E#ZwS;i1lDh|)Bqu!x!sMzE4gZsz`?l6w|*On>rgo)Q&qdU)*54d z-B6hi*DDoCcnwh`RRD`@g4t3ejXE-9QU|;SRg(d)dbA)=J95QY_3HE8mO+dJhm)y$>#=ZUUgY{Z9{cMwdJ`K8z8W)p=vW4*qx%XeyJcs z*XmeUHd9}Q?~2c;0XTENhE;LEXG?j_P-+{ha>zjNx>BKr7Yp^3i>ze0LMfEKUsMVu z+f}pO0);L>d0lOwq53}KA$Wx(Q~0ZDT*7{l#=&+4jl+i;ztQ?SVS1YwikvlFx!#i~ zo6_xZIQS^zWjhI(@kC`=drie0s_KaCZ-1j7YP^b=(Olb|>!4+c`cr#k1E@ zZQB!x9F9NkI7N>|BNkV7^t$_c6AFgsMIy&t=N+2okge|Q;rlOb&#}AaX~nl_TQ%)O zfwnagDW0S0d5ujyVc)?td+|-05z<{Fg6&T9#5;mN`_bNmzt&UqoJGD+UZ{P|{xy3R zS9SE}^!0iRh8ysUhXLOI$|vsZ;%v<8)tTn%y;ChB16R%}zLn8w?!jw%9?pdt%%Y?Q~mWxIF|+ z&pVpyT20>*Zf_1%rp-Y@p`y+dsAo$2xc9?(&7n}9kyN-N4b-Rqm3K>gdfwu2WvjjT zxd_6zK8WZkzbQdlq4(o1pG(h ztUuX*mrXB%2s?>@c;ZjRAtsR-Kk>iym!rKI%unH#Xk&c;7SY?cr~R4v@~@FafkmYf zHS=_DvPsa{Z$oELb1Br^)E?;$v_qK>0SoB=+)^+X@`oxoaPU9EDYsVt-OioCjvdX+Q&@BIv3uc3Z~ zq$254634wSWYZeEWLws8r0_qwTf_C(LM>FtfEZR20m9*pp)mwskiD z*bv``Id zA5Za2vU`f{hfz=9{MZl5;NF>X+<8Z$D1J=|nvZ%Ge@v(2xbsw8Ny<4k9-h1CSv*{0 z{#TYpB0KUV&bh=lCXW7KB1%;<%CYl&oHixVb6Q(JG0lJAvdhL`B`JF#4PlHNlx?Kc z>2+7qDRsnhGAp31vF*0I?YSwdGK%ec&#wI^I1(=A(*V>OrJa zmJ^hR;|@sTn6tI7H=|%2b;Bx%-Onv?(RtRtgtiWDd(Ah&X6cWLEEhr zX=7*T@iop>;eU0#8F7z1@kS)yR%~bNA_wQ$R~LC!+B*Ni^8z0eRU6O8dxpFq5L>#vJmqn^sx#En<nC zD4(fO4URkQNF?%bLY42SblbzO+?2|6+k>u7XGQwY_UT^tn0_QNK#mDqG)ZOSNZ&jAL(y)ri2q4Lp`D2-To|m zz@MPOXXA%>h$8-MJOO_jS@vuJl7)KdK&_0|x^2ElBs<*+zIQI_N#VFEK0}+Hjr3(E z>tkWbuow46x^L*nOhH*O0Pp&1-?Jq|KzJkQ-1qvPT>*dLC?ZXNmyx<%v+;C45^;6Q zj43~H*5;jR(j_&GF(@)CE4 z7OxdaryJp7*M@6fcN#3E!tT>hGlZ!T_AKqcY=-@!u*Ztv(2@*K`R@Rp**LUo%~nV= zQd3pHz>^)(X!y|popx=C#owCV8?>9GzQ}3U z@+|z;@YM2vaSY<0q4h}pk_#XCwZqar0`v$iPP@aDzw|e;3;ti5vY7t8GCd%L{~e|P z^uOD}|09e2UJL(?GXC`lJ3>p*9+&vPzxe?kZZH6Vj zzgXlsWC?%9;(x0}KM7H3jPxIob|b!V+FFZ#es00P&w|h3ws8gsu~TJu2D8cH=O*pN zAB@N&pFyYLX3H>W-fZIy+DjS^9B|5!bSmx`WD@Sz;XX~$^yhmT`KRNaPkI>sUA zCJ0hnKswW)OGwM2zLa!|;l7&mM1#JY^hkrghqT9_t4L=XG}Dy|eK4(zhBV!7mNe7K zM;zU0?!rYn0ry`@nmXu}G?JkGo20$CpO-YneqYi|uM=g0IMhd)q^Xa|lBPc9OPYEs zmNaGmJ4sVd+a(QBdqC3E*>@#f2>OJislV4GT>|Xl`Ia#9Bq zB<%&ABWb30p^0aOq?r%vBz-sN-IBfs^Z`kifo5G(_&<|0WuUS7jJpfBR4N>16fV+E z+?ma!rI%)tO&R@clkf*aKidt06fJow3nUD6N}9YZ;-twd!d?RchW1o6|8z^2G;Riu zYzA3YY*Xnf>xC?n#J9<&kvg(5b78!=RGrEp?ZqDq%YjWcwPdxiBEZbVrP3v27;ePx zg?lP!%19j2Gz>Fs z_+b-$!bF3NrjfX+4HWX+L|<9nW*IcGY?%fv%G-E@_R?K;Dd?@_zXo)w?253+lBPf5 zNax_bP|}QF=nd{n*UzLoWqDrGOxK?zOy$xEy!?ve;K- zzcRFWNdIbLOXwJOqQ-nfUZ;kmV+N`N^|g6o0suxFH1^DEFq#k>E;@X4MKy~-s;dcT zjAE77;On(!LNR7Pi0KEM!%$Z*1|<1`UUI2i`a(vb!vQW1TVqIM13p04UlA&XNtK&{ zQNZYI3zNW#%ZO=U*zRg+AK+s7t=V!l1sDUev1kLS64}flL5%X5gc@Mrh$TmmFuvZf zZc};f6_Y-QQ6(%|9Iia?Lk^lvt=){T`wQ<}IRyi(8}5x3na$N@qCCkFmZ^NbTNfxR z!yw|ol#OUK4S@kigfNQ2F3Z5FD!6hU#gIv-ZUSPO#nrTD=CBqSsWvgSLCmGN5|C2x z0H@L(QXm{F>NeM0VLry75y^F|UNNIpF&0@KT67QB48;qf0e3U7}E zZ?y@J$x(Q1=%a!)nvNx)H$~9~;kNsjZUN`*s-l+`vXm(ie zO7H*=BOvkks-*Dpk$5xS7TBo=Wfa~FxRWlF9_P{jA|LVi#Y5qZu;ASf`;9UTZwha? z1@AAw%Y;Aikn||tL@3iN-%k;4DEWNgGs~BZ4u--5bQCYag4Yea_3&3l$>*@(%{1Y$ z-$*{n;ec>v`7+?aK94dA?{heiE|eatfv5DxS5AfZ3TQK4COl+!QiN1^r)8Kz;i_q6 zz+>Nu`r|u~!dn8`jJE(DEYr#;Joep47fO%&fwu!R@kZlPc$CGAcRxHX!c7^4$F7+f z??d4Az>Rq9Dl5EB&}O_X(ECvO`>_mDh&#>CkqJtF?5--j`$3!Wb^vcE{cV?F3UR0D z0iMzyKW!+yZ6M5e;Va0u1$+!sh>PZoNj}D}@b0wWwE?eGgfRZdN3#e7=|Wmy-ZaVQ zgPnd%|2%uFd>;Z2s*W0kmk&NO-e)Gf3E)GRa)?WkgsApxAeD8wEEZ70vT-TA7cF?-0p3LgCi!SRX~Am*-aT+99$)(v z-g}nxHlnee41Z;md~aLQd)|b{&jkwalm+jnz~gsRWfWe&1+Nf|zyn~Sd{b~KyvZOK z9LW?W0gbo9po5~bL69z_Bh0hFQ}u)GFa2mA4#JG*1|H*6hI}*$AV?R|0`rmyFAsM5 z5w8K|jd;^>(aZrJ%YicVDbv&v?-$K2$(ucEwlTTni|3Xskni6{ zA0`LiP;8p_TqJTGE(+F&JH|;d6#l)QN5@QQ!GLyKV_U1Yqb>MY>x8l4R(mi(3pvGj zk{AlZP+=mceQ?|pBS-R2w}&#rsfY9sMp2{VpTGsq zd&T&d7)$e{Cy2pU`-vO0>XfSX>;v`_nVg!?*9*3GgXhpN$unL9ho?b#cSwk9=zVDO zy!fj22kkj2yA$?$?o>QKJ|2G_b0E$R7d*FDwQu*>nH9HRqgsSY zgUZCb5Ty*yGK^~Hq>OvNqgVJjpeWA^aYB)?Ay13Z`k27}@t+}+Fk@ru-q!B!J?&z; zhM2eDZ~heXP#77<%{eyviQb-Ls|>qcComa=l->1A#K(C7^Wvid?h*4*m|6Z~A7eg7 z_}q!!NYoc|f0X$C7ydtb|FiC^Ku+{VAOBiW$<29b;Whpy3G;XQ{|@5ao5O!&v0*$RJms(+VD-~VTf z#!k_~uI4$xVOl8u_LJ@!LV&@K*+;HWc6c<>=t8~xGv+i+&`>oIbH+OdkJ(*btsQa= zD{R}hzpypgGbSDt)kTfX?mH>Qgb9RVve>Q%nkV^3#O1qkN>`1XbnC*5$w?4gjI=*q ziK$16KRS`9A+}ZFg^X=>cpfCLJn^5AeBbO*v)$=}9Z+{9E~?y-;$LwQG8E&Jn{7v4 zXC;u}h5V?*+yq4A`jq9R=~5)8hmZ8~pI0tVi6-j0fr*JkqP(LKIE%6vS5b9?JKgrfS$ld*fLQasD0Xc1+vR_l~xpj)8t36*`b7T@t*Qc3WttYT-h}ppHMA$#7I}JWsC}Vl zc;mN{-FPl0_KIP)wTUNOT5lw>HWA{+>H7hB;I3;|&9$GnS?e0#wz4PKKDl|%(SFRn zIUlci(rw@!;5_DbIknTi+v(E3)d;;S389N8YmXPLDa{S+^exJplcE>9s#@coOp{F+ZlI zt^HuPt>9zfS4W?*3-sc>GyhQ!go_T9=%xF1^qfYx2d9@XMTeco@xTIN&YlD5_U*^6 z>&k39*rQi0b7j;d`tLPa!KKlnR=&3ojy+4RQ5vR=?ws+JBCI+lz z?9wWa#e+>xxhIDb+XhRlQF*g&OX_|d-G*v}Id{!dbDWLOw4F)nPw93iJww~K+b$$b z>bjI+V2F}=pjlgWEDj}T>4qNmaFj|ZAL=eSjrhgPKVKv=d#>|AJ95LFaQ`QdJ#L$l zFz$WuiMprm#9$p%SU-|EetkWP+@XJK}=A(an2j zqYJ>k&FtCs;u|>UYtLlec&G;uCR7@1>j{ah6m#41=;njiA=@3Uj^1hAdr;^DKn=#D zo{ilbitFoL&4|QIH~->K^tjNGpwAO(N8hLjMY!U^>W<#bqrKDgJcOE(sQdPgu>0+C zdZuT!O`qvM<8Y^E@X-w4$7f>lT%toi63W!uL#g`ykP{QW+7Ip688>_O9_Z-~v`e`& zXOHG|F8tUzWO)$j>6~SN=zBu5pn9Pnr8L#1O1o^+P_pA&+WyFT*53#Wcg4Xc?M)N3 zcJ$O*+rq=zhH2sK)|841U)M*olZwtvf}2w`kGs(R#c7@{7n(W$={N{ABX>gX$XrM3 z_d?%vmxSt{-mqx-&iUiszx~H<`{X6ip_r29&N<=Gq!Um$OU<1Yatt_1zG{aa9~!BT z4o%RrLo;Ohd=bpJtI*%?PJw*x?*J3Q{fVFJzHkcWjing!p_7kl6Q}v-eq?wcU3(8a zV|a?mbt7vgl%G4y#InWegVp*?!zNCND3)7>JaMm z7lhAsdR8Nbun)D{e$IYs_zSO|9*&M|p?0qQiR0dQG=0>QHHZ-gtC~?a^9<7TYdr z4xRyE*qhGP0=?*I7HInZr0_?%c2|*BQDrZ_RrBkkdc`vXo#ps*j!+S@9~wGvXw-H* zx>jgi6>Zyl^w%r&Yr8MDixML0l;=^ByX-EE}nG0l)X3o-Zf4$r%k5p)A;Sj?ia~&jndq?2h&Esj$U#c@%E@BfwkDF z!F{Okj_t<^L>l{#Z2#r_?p~C;!)y`tBaPd8nm6R1IRWKp z8VII`&$|THjRSK>RH8qzP!o?w_%2Ckd?4AAU>5qaNrEf`T^6ys#YXgt>>A{f($ zgYm@lC}W0+aUg0iHYb7+%S8-Cw23;SKEpncDQd|0X?!IzhtF>a=q?%Hf*uFrJrq}Y z%pb+d8Q>a-l<7rZU|JL_ja;1~#u%)#=m;bVu4>0lyE}nT%h-(gGWlS9xe|TpU|S=i zVy^gCYcHd3D2gg`BR1Yt>aH}ZyJ&92s06xO%xr5?*@jP=Ln;~RJ;rP+9>}(6Zdmho z60^-UBO0}l8z=}?84oerPN-~)&5!|AL&n5}%455us#Y0djkgQgwkpacGQ?U0m|kRC zp5lVe{d-1jS$lQg2lcku~^%))|{|l2+*we|q8}smRN1f@kquA}orW12kgr{fx zuY)(=(S2*d(@)JQ?q2rPoTBa#?&qJHGZ+3^QsKUy{g_n#VzOt6mhmY%=};0}dwTZM z?IBynJKf`f^;DPha00tri3e}6J($QsRB^*4cYfnBen0Rh*^fjbPaI2r;%E`V_dFAP z;>e%++R8{A>uG!@*?)sz=n57dW4qeZmE877(Gy+X#^&UXwnrYzcV@g${HI99SxoVl zQ@3pin)e2;HrcCX)z8zu@|AhoT%bGTQHEx(XH5CT_U(vidS@n~> zcPuQl(_-Zizb91U6M{uB$OQZEmP4 zue%dlJ$UD8H@IwZaq;-nEHQ{v6{suQ9;hq#)@&}@wyE69adEJkIAXXsAWsLw%=KQ8 z(U_g!t=)#P?m90RnG(glt+twCE-SC!ysd6S`J(8`Su&R0xt#K9brl=(r%xB8lm;m$ zQ2p}dOT6*XNucR zvv`}4FKjpEP1lw!T6)_Z3-V@7i)|#Ww*P_U0w0+M8^6q20kg=1=lWkO##hMmbzF8a z5<3urbN$W6G01~T|;AJGLD#$P0nMOVDhCMjhe|gG>%ja7)Q*= zJo#q~c!F|7M^g-Ehc?gRUu3b*x7cs9*cV#tw_EIAwb++i?5iyHuUYI?{rsK9f1UO< z(_m0Cd~+NIODS$#TX4?e|7&UIm^J72pOX9x#qgXzKrC3UpDOsrXc3He(VQ3daoQG3e7~3SaExw* z=F_gX$X8{GfbmsJe-5;bz{qX|?lg;Wjlf9i)52!_kw0R=8|4~cp#P^beRQS$JrXb# zLf$FbP0~LMw-J~f`+`NDJ<|U>!v7|1woG4+u+L$iRT!#egm$xbjns!>FVNOWeJvF6 z&DXYB@V7{LlZ5|Qw568(4oEyhe~YxwBpyrd2<;9ru4qVLr0-r!_}@zWivqt?`?vJH36)m33LNMC2Tdr9XQG@;Se5Qa{+T!Ws1TPo7ac#cS#J}*d` zLH;ah#u*PCke_j;OPX^BCQ6#|-ymr(=-HBH{HrC+GFByN$`Ufs?UJ4hcgC&KZcZ<; zQjy2>XP%R${}M^#CgyL@o$1;p-5D>9!W4S*3MVnI*(RG};@cViTZ3l2 z+0vc(dn8R6z9VVI^_Zj?&q+yBKOdRsIHnhvUbv-5n(=2!nz|KwAOj3>)jFT+L37Om z%`{x3$va=tlKp4TFXV7#~x)M5^WVlmS zo1ApO@M=8+zO)FM7-Usz8#ph3G%-pfO^g+iCPta0DKm}AyCl%5%n+C&T%?IlW0Pb1 zLS`fgNj7u{nn8s8<~jEi1V+dY9=viG3sabfmMv}ngbGai~49s)?CbSUI0G#rHt(Ba*%3K?X16Y;|RHq>vXhh=ge zXs@J~g3csej6WEvo;+jVK3UQa;66>#%%hp4$q18=i~Mc47f8Af_d?PO@dvX27kT~< z?j@2=1^yCAvkrN2rH;WLjA$!BGkp|`?$oy^lc1T_D(Oxc@0B#uy;IWE{eDSP_5+fp z?0+w5%6?qZl>HS+7vg?V(vk_nLUVCuw4KN;(sCucWDmXHEPsnfT!)bZ&0L*TSEAw8^qTxtTBGnIq|q z;8A6U>q%9a`37jO;LLpjCPJ4768bCff(f zgBLXAW?a)iQzp_kgPtkr+d(s(sVoRE9$chZHc%y^?u?7>l#%T(X{JTAlc0%lt8{1C zxJ}aJ7j1>)zel>0U$hl)XPRoIJNb7=n)o3}lmGjYrYvmxlsxT{CjU`MlV7wa!1sdg z!KL_LkTm)KUDD+Lv!q!z-j+1w`A8Dp zx02^8CjL82{CpmeXBzm|NSgU}x1<>t-{)0aaj>USIWY7i&3vSMr0I5xq?r~`XC?n; z>CU{^CTXVe>yl=kiny#+>nyE(0xe2l`&n#HD*3XyTII z30jryM$p!^reeVw7g>o7YUO6jo2u)vadH(`P;J-5@>BD&Jhj+Ltl;9pHZI5hBcUPFc?)l zc>C$Apbi}XE8R9!)m>7nNYeb%oWT(L_hn7frfaIEtYg>_xs|oss-2W`s=9 z7s-R9MPrCYPDfKxqt#C=ua~5>@`#vty*-Ed`x3Bcr~sPIhy2{O-Kz{ubA#3cn24EvAT9( zPx7lk4#_zfkfn&N>lbNC@Tl~uED1C;U^iLpt1CBeziMt+cY42y>=a7vFdN+&{z~8? zp;zD@QrTAvFjzsx>h-?`|EeM6a$==PQBtlNV6a5g4o8c>D9cPdLxZq=Hnzt9g1oRY z4u%stwX$7V`vaUx5ix7NMLShrzI9u9?S^t=ZMZ4-h0d@jTO2wd_MXXLeFyuP7os@PLKwrNn<$fEkGH{~IR{(Gy( zHSIDwZ~Q){%wKN6UL*LXtqi)I!c50MX_sNW;`;IH0cPc6KTsL=8)?$PN4k&}n7h%( zWZ$t27v-TJ?Vq8KXvSLrH}+?hAs-F*SR-9X3rrR8*q<)L#r`t=hOmRCOLGzg=|Wmyyw@9iWuQSu z@qP*>Gu}hMW4y``gXS?1qzh?*nGBFj+{--`|xX zAI)l9X1w14kKu`zE&XVphs%t&33wdSP)6b9!@-Pq9(by}mD(-MtwaySV?nP~2`;Pn7c<;P9%SLvN9SBQS#kn!TTlf9sm>Z zzJg2PWg&59`Mik43x8!4o)>(i3#CUP8Y$I27r{;8ePofZ5O^H3QAXiiw8(cq@E!nD z8Ls)b6y7Q+pIrjz=!^_io|jqVW9F*%?=}bThSJ_5X<+P~%CqYQ;I-W9;3{>yMJ z#6>^axp%Eue?J8t^`Z>V{9 zcn2+b-vJ)yaw((mS}b@~S%?>W#N+#b!uyFOKN^#V?w>wt$&c=d1LbeI3GV?5-V?y% z+%jd9eBZF(6=b8Gl=7`K;mt>3V{jx#m;?;iK&|2zcWK1;k_ zJe<{Y;ckh?bQI$`MX~vwNz;K&XS1sGu+xv%2+60sCZjVvRC_QSd`wdzE}AgnRqeq# z*j0L;08QL!xM)g%S7wmnU&UMKF!+?$Pr+w4F>n_QjDM6IL#Yl%vOUo{?!>hH{CRQx)I=u_fb)EbY>zhJ~gisu?tJ=AJ(Hbn)Z#D zwTCM=a8gFfc`if;or}eJpm)t*)|={1b0_w-MehC$))yx}o%ehZs;=jPqbHPH@G3Vj zxj~yYv1e-}(vC%sqqD~Lya^jDOn&iX+Vu-P8U00LE8Gc{BZs%#hUL^Py{Y?t&@=Iq z(#n~)75@PzwaiOI9H$ab_olw|r=C3+-uF#$7^`R}IrQ0~xnrB=B_wTF_+_WK9DEZGG0eeZbd7b{;KC|huFZAFduDR;5qTEH&b-yBJ2LxcURZEu1(!ODGbw5k z4^$-3b}If{oG#Y$Eso!KmvD&_>+--+>?&~6Wry#4ymnx5++9swt7ADPItw!BBK#fj zuR8FNeMjD|`%23ED=rCMV;v#mvl(dONR$H`wO!yY#z=Xv^q@QSg| zC!N7cH{;BgwTTD5m8dUB>K86tN(q4;9Y$NfO{{!Aus9(%g(}lm1W}3;Z0-z71_nyC z%e8UinbiJFGvKzk{?sVkl*9ugobFA+&V|%iKfm!?lXT<|PoXmM5Im=;bqXbT(rtGI zyYvH9ww#nnImn~3568XF9YdzX;llcKwSrEyF>GUL(ESuf*=^E}=3AH~i(UCEemwq! zQFg08n)@OBIp2WBDvxqkcvgQUm-1J4YdFP+?u{_YuF|XQ*7V`AEsVlNHz>w#l?ToC zRsF5$xAH4FRD9P;Je3|5pR!AD@eOnSo!UyLL*w4Tn`_0osrhhl!C_l%L)}i{@>RGb zYMbjS1GUw=#2O~yyadki8a5!s5sElKahW<)WSC9+>Pq+}#RLg#T8RTYMZo1N;G3Xf z>)D3#uhuQC+k9U&zLg8Fa<0WH!iKXrkwi0wBkvTe!4M)&+p-y9qTVZ=$XYlWhtAbBq0gCBBC({#>g- z(~FC1g%()&nCL1Gk9iwM@u)cGh3Gw)ztJa?|uhsgKJ0(rLZ%CT&iqA@#*q=!n-DG2~5-`c* zLYj!<1x=%55HicghHX+R1%UD4B2E7(l9pc4Gd*ax;k|-J;K-sR(oO+jL>keU(w`UC znb4oXNYk*(tk$d0ZjS8EOtg0i;a3#1%GaTPzNXsnHYzzc* zReXN@hG8~y%?XXjBhU;d;ss6o4Y<^L6_C+<7cxVs)PX1ipb5pWEE{z9N}Bq}ku;Mz zP15AeH@O!|IurL2Nl(OmsiY_2zS`t|kECzLy-L#jZnQe6OwMgy<5`Taqp2dzo+#}n(i-2`hVkoM$(M;yrdt({eq+) z$NhatAIANXq@Tf^jSF@AE0E$FD(DwLCrkI=g67;!@|*?jmGmD#=SccZ(9oz=;IL0Jt1a7Q@_}eW5n@ zA3P#&oHdIncg9ikict-etC$7S6?g}O${AVFqwTLUZ(wNF!H`DWwV2QFB}6pXlT^WV<2^>flN{>w@Ja+FC z-fol^GakUID z;vlWegDmVOqx?$1Xa4@nc7ulU(I~#x!G~Ye>;s;7mcs=q7wKUBh)2YRx=m^??JxTN zJA3-9nP2w%Z;$L-8*Nq&>K&xB?5D?lf*b$9oqG(EZlZ;YdH+J}S;+ly6)*3NuNwA7 z?iJUoJ!mhDL_8(KJR^r;)3_tK?YaAN1G!ss_vGf~7Uh=iPS7hoCH7$UJbzBaoqn|K z(jIgTv43~vJRDe!gX7^Kwmz%No=2dcJKgDU5ZgW1Bv$u&?sM?V8+Hml#f>4WvloqC zT!F0(`+8@_oZl`!&w&ANh>8Rpzn$s5jR$%a2*~`j?|FV4_e`>hU9w$zN^U~2Op=2T5Jp+C={kKB~6yc-bd&hMQz^osD4E;L2dzh31pNw!bvL5^Q_F`K_b9 zndA|hU!K(v-{E+~hPqb#+lby9I;q62@(IDQ_2P#yg0CokRtnyCawa7fN`(-&y{DfH z_wu;ir}|E=fKL&Y*YI3<_01C z{NFq)w*BOXX8+t_eb1%|D|6M4Pu*MfxY^x)Yylg3v-R2a&!T40`;^#G_bfKltFrAq zl!yHh-^8xhVHe`hud;bsu{mUh!O7SXZP@*DD|Y9Oo1Oos+2I+e8y(nhb0d;hiJiaF zm#A$+KlI?Me%u|2mECsNX^gt?+jcuXRp3*1JN8n%9Gip2eyZF@6}qai>o}>|NVnw5@BMZddio z2eUIlR+g;yG(lJ8e9^>iPz*jS@*r%;^HTksGl-z*Z13iUG z$y!?FZUnmZto0;RKjI;92oUI zi1eP@dfaIXyT3|1h1mGbyS|sy+A>UYyVg4AC3x0+in2Q|VXZSK5Kh_Gl@?N#UpW~cUs0jIcplj@GY{^%n zbyc?2_kaUA6@Shtgg@}k818LZVeD<$_uNeAhu#qIz}z%=6|d7i$nw0AH7b~u-jX%u zXjWQZ*68PtJl)>9KePv2CA?p$DTHa2Ec$EbU;{ajWVH?ga( zuiu7k?f4x4y{Wlgx;0c)*L$~Z;fes^mNji=*%a)0XZ(3d&5iys01yBBn*uB=zi;!s zK0${6Biu*eEsgJwHaYOcw5u@+ehaY?5Qg77Y_ceEEJlruWRjNS z7&)X<@dq;*7xyZm;k%YP2c5dH@ud}J0WLMBR6?3BfiO#Osd0=Iq{q6y0e182>j~}THwp_!@N=DmO4^nS@R^#aJNdD;og-r z!*Oha{0t}dHvmnY(Ad2AgAwsc8AQB3!<~F;kF}d69gPbg@W@Mjk%zp$GSR=0G-VL@ z<3YfXPmNoObPbn#RM33_Iby6fY3@SQ>E~1U{V9x@c#vS9SHi(FEG`fPut`M;vSJ=BDnmo*VsjD6|`ZdT~ zfiis#jW z_Q8$)ZDmxvKeFJx20X4IARf91QM@Ms4(Dh(GGS*t$|$@ea5u|Wg#o5aFcFW>1o|=D z4=i}oV6TC@G74{>1@Aj1JU(|7-Z{`_`PyVSE8ZCyrcio30X)hx0T&*tQM_M*Hsd`4 zJlPe2kHN?LQ<5&E1?HC~Jg72?$9Z68JnlKoXPPo9y_H}hT_`>JfyZYSf|gqsz2_fSo*(ArH+zfX_TO$##;4>7`M8A45K{Mh)?}j-LK}HD)@X zdNnrL@MXs)r_Y!v2PeOHZA$VYL;z#7(K+}IWJt&H5;11P6%WpLhhH9ko}cuMVH5R@ z+;py@dF+yShveCdq&X(Z`%s4CoNDY+`OkV?d)V&7_w}7Ap7|-&MLSFNomfVYX4^fi zCcbXsO3z!GzTMMrKk;9Y8vE{HO$l0S0E3wAtMR23Qg&3V^mHX+v`0B0NH~!Da_;N7 z7cmfeB)3-#gzm=)f~|q+f#h2QDU1K9qqnfHcR|7MB27E*)I7Tw{~mOq;{g~BG+_cK z0(FznaiOKxrs29gg=!qBJ>uTAf}hqcDfnH{QBg5YQ~js|*G+EiS)H)n+d z{`DVoOa(YC0GXp#Hh!~*1E`R{gh!V-5U%fJMsA)O6rF|v7k9CnDQJ2zGRKEAr5JJz zf>5xyd2R^nNyn+ce>mmH_ql8w$H2+2Z~XQ7l)jT*$>snPPWo+mukYk!IGygDS;|yB z@55*y+(*3I>02YlRo%IJpB}}yeingZh`1{47qtI`Bdptl?IjptZC`>B*7l_wVV#NC z4D8bv5Fl8YEYgC!5J|z9TkDqJzJI%upmv$zuir+9K~)DEKB0)8W&TmL8krnh8|+^6>hD@O#| zUgT&e^(O{l5sCd=FnhWoORzFe-+up}mWGona?^utzZ0zPab{*aM{JkkXuq6Wf^Fvw zhAAj-63x@WJP;-9L=a1=FuI#RO2v07{!Gz@QbT1Ozeg@WI1ceTr^Gcai-<&KoW>|p zo*2_*`v0~6B+8h+XK#kxwK&rGO85RE=p2J+$6nUk!!Pe0V=rD1>3>~60)`Vs5zj+f zcW>uKGIae*u)QFf)I1~7Wxqv?Q{uvTSZ3y$6>0jKtlelcD79!Y&c(g!y3ER>+6+`~ zwkhLGtBEdOWAeAmhfr-nb`P^CZBFak$;0ji^la%t-cpUt4U9x#2`a6$e-K zIHPeKG3qmmvFF(3id3gh93GqJc0uOQ9_U`3;0SA}sKp^)bxL*n6jyc8n*DXXGY`j$ zL9<}*v=By@4##(I#W0Qo$#jVk8=Mrokn8pKj=oR)ukTPr+no?@-#Z4a*Vyq@y(iq- zyRNF<{@1%-?#x@g|6JVVYvh<-l;5+Rb$;*YsiuHC+gI-|#%GL_dlvL;oKaP@@E7)C zjAW+xt2DiRN`mLo2N;yWs9jWVS2+__@%(Lf+hBG)Pp@RqhVQlq&}M#XtS=I|u&tME zDGs^jB#Z-#3uj}{E25oqKIk$J0=`-r3Lt+DEWU+(>!o?F8$tC!ImOV8SIV(VkXWZ<{R*=zBn*$r-DwJ4PV#4Yw)QHBzINxJ-0=~ z=)}<1P4FuI9fl0E-pI-fX63eIT=2 zV(<)e78Ly4Jf2qeYpttc=f$>)p7nv`53+7}BWqGH>&BL>sU2BUj%H1My8ZDX&lfOkx_kw658#~_&rOCNT8j=3JI?Be zHFXs^+h^HbZ5kV~+o&T>Z#k8SvEPgvplMhNNt{VBIDJ`*qNyXqt~V4!@nhD6ed;2_vFaH8 zwC9-gLxj8jpb%WGR)n*5fsh@GkYGWWdsZm7_}lVi(!ni=nrnc$CAq#GI1#kU;c0N< zLAM7@b6%b}KN;mVWINiMeAp@GNO*Q>$f~!C&_rG+LPO&^&!ix4aG2osV|h#c)4F)R=!KczUf{pwvgaRcy~Z32#RdQz2)!K#LgTDc z+ZG-OjU<2m4fN6RT(vcd=X7vtGk}VL9kS`8 z7KVp+W_72W;uJ5>E;v+_Bz0#Uj>mi_IBe8b-{k++<$?S{Ut+hN()-vwc+KJr(5j^`rg8&WhHlqnR_HCw9#J4-`FXt_(#atF|IZw=XA zHuNd_FVLsabGbslL~9gq__HY@`T-*@>NnsesFxxUhw$TDAK&g^FmDrQv@Z*I7PZgm z4fi+@+KvGWS{OujNtF^d5*`2_Cqj~GqL>lTR<={8exNhv_0(8J^k|0z}V`*qS9r7jOl@K52Mf+p^gSdHQw;Vq7kk3 zmVocB$5G05J3Vu?>Jhuq5RPu~`I;XO`qB{h_`pcdF)i4kJsjWI>fJr8bwtoNYHZG} zcvta_^@odsK3_0rnWw~-q%%FkjP&3fO{6HS>02AOdxO4_JJST;avaNQ@X2%wKF?~c zE-=F75Xb708#WQ3u79aW3*1Ke6KsGu+P~#+e9-5GV4kk&I^Jp&^eM&QSy9nV#%XvaV@^_2lJ0VXrB@v3{2>lunclRhC8?|1@5~O zyEpVN=cL&^r~5^-#9qb24!6V89EY0f%bccr5g~S{Sh^gF%V>Ty=o<$X6fDTroNj)D83N$4I$2K=1i(gx2=U!X5%-L{RtEGm+#U;FR%BZ2wjiDfx~DknBCPV z9O=!=Sl;7wmUql<)r*whj`sC|5#fuT%8|Hv|?YRJQ5&Kno^28kbiA7pR_FQPmv(c7x$URmYQ>gv0{ix5=owVN%Lx|AK+ zHy_O|IGsH=n4RB}J?Dyf!tn06RU@222gq=Lm#gFCCZoWtN_XN^;0kZY$rVOvS(P3a zd_;o_>U)RJC%U=*V@@a}e9=Gq-4iL83E7ma>AjvyFIM#;clvYmiF+TqwtE)n&U~Zg z!}kwXj*l)kO^ReBG&!*04-mr_5qXnMbLR*PzMR~ndpmq1L+RgcZM|3(C@Ed$%b4yP z*ZsQd?a$q){v#Sg-WK?eL2<}=J?NW=&qJcIn&?^YtjgQ5r}N@;-zYsX7$|7*jqwb# zuT2cT@L6|)(jK07$kH*?-(pmng2QoPCm=)4ju$Q^&8ToZiw=(NbSFNRW^c#TRdmvk z7nt(e)cQH>uJGsWSQeS*I>2Q&#aUNzr zqQ>rD_US-p0J0pyIts|s*Q*r_7jlb_MxMJcP5QOsBu%%6ZHIOQgr?%rH*snHW*f8? ze=3gj3t-ru76;WMU)+f%9rAmq=%eWIZu{)C+#sfLJA-X)jlcKa{wy_*mtkm~s}|DT zcCAYChaAn5Vx%6O-OI%d&${O^t%eAgr;Q0&?*}sr79DBHoQE|Q@lWO3T|1B$-tdv;P$&>=&%muT z*q(`7Q4sG0p->)QokAgB5N|3WG^_0ixY>feg?Je6cRMk^yB#_D^qw_aZw-vV7gqF6 z7F}HQdSCC7!|`X@k%|6eX?i@W%AtIB1tsaOvP-yu?fFo~&EcqEQ&_Rk(=Z(5AEroyAW`3M9Bd(!Rt%brf>h4?cU`+5sId%KTZ zrs9$6x&-~AzvTTB*K6HJT5c%TUq|QG-*xT2u(##j;+D3^-rVaZmfSK?udV3kmt`TO zuQ*v-6OV8^hT|m@PsoF5Is6ZEVtd7r>tLHvJRdaztD^2pJwVSc;6!~#3BN*R=24=tuFY%|!6YpFf z!Ey!j4b&Iz>yzuujf>VBqbzwAGb(%;h@YMIH7NsX4P-cLEYL}k`Vfx(^vk-_gEx${ zkdq;DRS5C?So~jfGbGgG@EkiBHZ1sxJkX(6>ozE3BkO@&7j*!#iaF?gz21W1NRB8g zb}cI59%P#*!QE=Bif?Yhx&YT?^Z`OeD7ahQ6xuvsb*_*P^On8ZN zW-DGT{dYmY@Sa0ehNDZoZ~7BIof5Y?K7UWe{NbH>$K(2aq76f=L@LrV@qJRC>F7L8kh3Yd($d@J7V9t^auMZPEUCx-Ig-Fzt;5?c?i4o{vnc_?L%z-b;Stx4(Mnz2uC) zf9osX9jlLRO?t-v!^@^NTclyyUN7EJFAcl@BeY+hgTp)GM9glPa=<8$Cg5v8ei_^Y<-*#FZK$mt}ie1CE~DkPOYEn9hmTM zO!=oz%p7}6@K@9RW0wL9xXYs&)Ea?U{xYu@C&^3mC1&TB@7Pj}eU$#TK(SN$2PDgy zl9yl4l?+}U{=$_A>jU-G8@wAf*J9TI?1R)$k0lNBi{@q3YYlbV%C!n?rc|y?_SOV; zU@BKb6?PDqXRL!ziNxs`GNEEUf}zERoma_IyYLd5#b6-z2i z3mv>$HgBrlfca@62=XJVp1HEJ_TJjf+iS7lAy5yE=7>cYI0|IjrZO*%zVTKCwrnY{ z%|%iA%2&Q3LLnX6imGz+A_}iKy#X6vfxX^q=(=nW6aChgmoqM78Ac9D5aJAQ6-n+O zc5EhvZMeL5a*0UJ{5x~KWt$;9WvU6_*aj~SZ>aJ%KoG=NzM%nYFR*`?RWQWB5F0kv z)q!WzPOr?<^*cpSSD-WtZH>-D}e&6yR$6vS9*{fgMUdn;lO zY>3@;=hS;EMt*1_9&%)4^-A_y+R zZaTsXII? z!>@YvpYD}^RE|&Pq5ct1Kf?T|tk|0~{jI^wnO zcu#+#m;P0+zy8=OZ@I^RtDN7>V*KYw$i!a6_ZrO)*2 zYx3;>rkDRxZ+xHf@^cLt6_%Iq_^$ENv%LPUl=5u<+#jiy{=B!;Pk>K;qbx z{QV+@!!(f7Jt=}a7;F1ID7To;*}+FF9zraagBUR{;E+;mL7Yf_PgY?u=iUZWEavlj zaHqwj4oWPJ6Hm36yWj?kD~U&0%rks&m&J>Sr&-K1cQD;zQ!iEs!f{TYqzuj!%=&E= z%yxN1Z~^uS!K~ls1!HH|5(f#(`Adl>=WBx5HfII1c`rx5uw3%+_jJVMzfUlA%x~Hd z9|LZ7boK}?Mf_8OM+5(r;BmlzC%6Ro-vzUcW9Uzo#WucEa5?ZQ!L-M$p)B?sk@z^` z-w-?%_`HJ$;GCj$;aYpdmCzX@csB5S!E=C@31(mM_aM|~Ur}`IAv*l6ryI}VULa!} z*&@NMOtqf@0(Kz8jL%sXv;U~Wda->28Uu-8)3Qp4dBX`YV?&N<-o5d6oH6Wqz943q zY)4}D(G$H^B3)8;1y)5h;Q_+JEb3{Y4{ z{_fhe$;VBUZ3o1!L(sGXje?kVK>SW%mKV%rto$An@qY{)!$wa2&c(D3@Xvu+9^;Dw zIevLzfQ-Wy+-sm|pJ2Yl9B07-i#g7i_cr8>3vK|OD!37tVTDnEXBrnuGv>jd>{Tn>aa2X8N@db%K%#^@h>BOBk>^ogKWk|{U0EHE3y1uVVlJN zU&L=0JP~^{PSDX=!068Kx2>e(?@%ecJJ;X2a(EFlyW z)F}b36U=_#@3j~|8n{F7IAC657(W5{dBH5l{AL~Txxl}Wc=pe)1hap}@wkQ#o2x?b zYT$W-w*hYv90%SecnHTn$_;xDJ?WN>Yb? z_$9&XfL{~LKK!9z_Td#-R-b)HVV{4pSZNQ;zz@crxp=})G5YujGhmWEi)HXa=*>?N5)gc$_g3o*A3A{iat64TNIY4c2 zXanNOXU?&})V))5$j8ez^D>^N7-Ht-VOek`{y|1!BPP!T!7R(zd=~)3*gVN%UN#EY zX^?BN5mT2>?ZnhA7R+)fdM{z>a+QrU@zoZavaYw-^t&{msTXi)Pp#E4_KdffoNTvP zwv0Wo*|g`fBxf+r;u7lDSzJoY6A6UL0UH1^8C$U2K=UjZtgtxF_y&uo60fwll6aNH zJPv~@i{sc8ppn?-3k9<-q-H$p(IlAlI3gIk$d3fG9%lu!SqgccL0-1gaKSO)8G>2A zd4gF#-~^m)_W-`#P~VD z_Y0m6{8_<^fR73$|8s)L|El0P@W26OhMD1gFLi>oHr|ZAbrug|{CbP|`lz7TVsoqklY@sG z z%hYS5jW>1KWN``gc>;!T3sHd{=(;313S#LNUS^}W&JKg6y8nB~79 znC1UQFw37FSesD}+#h@^ly0n||)Lrag zK20*7Hjs{(m1k3E+w8;XCGqEeU*(=6|ir<&3|@ z#v4wY|9NdS^#xwWKA}GFUSQfm%xA9>!GmGIXu)>^PY}Ein0-NgzDJ)b_;bLs1$P3^ z7ffFUO9kh_m^#4|fmaJ&1-w!4e&DTwdH&ljxNrc*t>6aW#{_>K_zA(^1+MPH?Zn2U zUyrIaYnQEE_fX#+DAMTD%SV_kor{!>Rrbqaf6Ss4I?uRYY{LiYb(?DO!N{$LadNS) zY3=frtLv+lHPkP=zbdJr?kajw(h`g>5qhwwqNj|yD!AFJsam~q!$!~fjC!rme1>*e z6WT(`rx(D`(Z;&_rM`|I8sA5a>%S(&Sh}Jivr8EI^XL&tw;xq2H=vz1B+Cyyq@=jC z>9-Db^~-BEt?tX!4V~nKzHrp)9&KWDG&XdgBff7OcOzk~%*2H%XX1i4PWn*PVvNdf z?Mla85QBYS$D^#0pestG_9PuMYKpcc@;;^QG^`{=J}Ww64^&QYkLc zLPu+wiea0gU`{>ZX(uJAvCbXBreoQ0o3LI|>Oe}9l)f&wRg{U39)nsJ9v_aTrY*y~ zzqQL8k3is9%Uk9&*9^HY-mq!q#`;>f7D^Ttl)Su{W06C9nda!VBm2sfJXV~0IOib5 zHMVC7p*cMdLDk3A7Y8vs+C9{0_EPt;v&SN3?D$*5*3g(+!Wbx&jddPM@od(YOdZHM zGD&I0yQZCpQ^BhTBew$(<5iXsK99PBM@1ui?Dh3DjS7nS%7!?OjWSx^A@KDL?O|FJ z8_RR~`09Y~j#QM7IxgR2hYydXA>RTJx_o?2uEwUKd~=}Z@=XQbD^Q|+IoOy+`)=^~ zo<$tzy{RZ)k;gY^v|W#ne4L)3eBT7AYhMErl!Kg#k3o+(&PYfH-jUEA@?DCJX$(K& z@vTNey7t@V@jdJCaX2X7Qvj}g351!ZqPSh+e0St0GIDkgwxr#)#H1` z;p6)m<=chMarrusz;|>i)T2BCJ>ob6kkjDfSYZ3%GepSO;PIVCCe9O5QNCp!-)IbQ zjs@~viH&-!?=}oZ*S@m|ClIfqe1C{|;w;Ld?!7=KL_7(q^qcX zf9CPU$0z%P-)@xe%Q&`N`${m_)7f_rdaiwsfluw@D|h8<@%ZB4OK0E19^XGX_7ypN z6TJTD03Y8)s%U+0_WENSPMqaXV*3rpruIcWzLVgqS2EFKFvsIt4Zdo`lWznzS%smv0dGxt{}aAt)6`+9X?LQQ@$#XZvyzz*|)^w zd&S|4JAC(Mq}I2g7yIsko?GA34&M}qkKd@={#^~ee59+8gTn7xF5lY@-&CYCjr}v- zJKnZ|4}YO3-xTk7I}1KN?@oiZ^4;L^JqEJokj?5bSmg1Io|NRPbolDM>&(@-DWKgd zYG1W?ooN7{9=|i8toF_F_)5Tcw~~n-gVQ{|ZQv_G`~%o#V^h92y!vhgABJuyYTxT# zeGh|AkB@sCzQ6SNwt`PSF&a+g`KzBo=QZ$pWE^RX%4*S+yvj!t90sVE=)-V(

VVfnB#at3^Z1aqf+aTLmORqt#s zdW%5n>hU2U9p7vWB3ExvFM6ACe?dLoBT-_|D{<~On8xh}8TV@6)MD$Cn|UZ&k0Ni} z??=0wMLNg9TG3;>ESGYX@8{q{mxsbKDf2zObG_)jhYZZaW0vx3=+#+h{xgl+0o09q zl_kR!*}bNnhMw!=J8_52$9hmyZ#L}HIxv1I_`WUA&N$>vyRd)k%dZVh7whAD()e+c zV@CS-@m+cqOSW?*`1BE@b&g*<`qZ@=_CI~s==#IG`tBAVGw`Pe?-NC>@D{Ni{t}K2 zEBy4Z!ui9ZIb8>LH`5Q$iJUXJkr@^6`UZy+*(c}>6NorCNO!UN90?ceQz;ef(=EN!!bi)mtQ$VAz;&!6n5z}mst)sfbDn(G9!z+?8W zjQcS6oPBCEoY=4}=+K+hLf%vFCMu4X?Rr_wVbuGkX7I+7 z$lqVQYvsHytQ(B=d}%UVV3HWVMV=39@Nm|SLb!e1zN@R{U}D$nEe9Xn_5EYeM!D3L zMSWQd*7edzSJ!5-F&lAc+82^G4#2Oe5@jo{rV}t@HL|EP5DcS<#ut=~0c7^v8HK|Q zdWElNws%$9Hfk>(4xTePSOIvD##{sYz|c`#gK3mz)!%Hc`kNCuc5pXJ&hEjjK4JEo zF&czr5ljq%k#lc5H~p53Y4uoXc5nBb$BXuMFM51%OZR;GFPaMfMKvv*qi1c74k)KP z=hj2fmC^mJ>mRBZSvCU>dKbU8xO4GQcvbD{oO~kdt&E04uwdbqD-++_e{R=ph{uS| zsce4B_=?Iam~r&@x#wO>bng1X>2w{R7_os+73Xv3Zp*_DUR z(CN0u4TRelhA&Tiuk_rm+QQ1{yc+m`%b!;>cwUWFngciKM(L+{^jlZ}BSwNTy8J{2 zyi=Q$nU~bo3{ISDsks9F$>34xoGEcm^lsx~e&G_hPGYuJc=60G!nm7iz2TzC8*>&O z$T~iE?@iajXC}QPZOJj-k*?iC$4A3%=)Qb;B}+qHP+ZXtIOx*A;At7j06iHk+>$x+ z+=^ovJO1XvioMsLvg;7vp3!h_b46*{q_*g7=PLJ1eSTh zE?UrLb`fIdyrmuM`UlrIoR=_=3diRbX66=tCr7-4FI<$})S26i@y@eSOJ@PkTStwL z-{@s?F_3fK%7n-80dQwnbK$~@ebzzF-}@kK^29^%!Q`#4TZF=ju)gk+A(P+-d#%5|E|c31Tnnef zryA5pb}8FJmwx5?y4kfh33X*WmZ>$_MqS0UPehKi!E5XkC2M0P#-^!jbzJo#KR7X7sjqp!)_WBo(V$hHon7hh7iIp|p5dEtUJ_}VDk z-NQfh*vP@-C%-oQB-}e8O{;Tzo=H7*1HC1;HYe7@8T9(D7Z$a54ms8tL!EH=V#tpA z6$(7wJniiZhFNnj$wuyPRl8XSU=4SZ)eL}z2hQ1yr&BY&l);Sjj~tdcq981jCFcE` z$+&Rxf7n&H>4>L?cb?e1yXG#q>)!djd+AA|VOj3E>%N%d%_of>*Y5383rqRlJJ0d# zqf7a!3mZ-bP@g{H>cUwJ7yf3(lubx_&B=?vosDMwt-RkvM(wEF@y@{DlFNQi?jIsY z^d=WaY&!oB;{tmq{{{A3bJrF6e{kiuUt?Ep`h=AJ8eVh?;63LT9D5lS^Nbe5dz>3r zhG&TWG+?eld#};7|CoLf_x36byU(c%$34CUUYKirs!*SEz$t?f&)@SOG$H#wjBEU^ z^Xwn!h22|s@@@0dzv`98--xMD|8lQB{7t6{(^q)m?|R{Hs516O-{Y_H?BVZ9DSNQ- z_x4Zv_L)@sk9out`f2*g@cV{Y0Kj(${tV*FD1pdCB<_CCBMPXkD zd~ky>FW1DR;Pqg*UMk;5=(?*V#8iZg#umuoFpgMWcupXe!(uWq-X&AYu>~ZCOvR>a z{?Ziv%{CrW4W^Bw1k*-5rkQvay+AOjss+==2EpW5BbZhDykP2lQ80Cm3uc}EPB3+T z;9$O=p>3tuUxM}{rp{o&(NFev@FfO`G7!z+ZNBo)=t>_`h}H-w+%} zJb&v+8`yql9i0rsscm_JW6+_vea-h_Dgi43VU(_$Y{tX2CfdB`2=Kmw!gdc>SqNUS zhimn+%XO_@s_I(3Y*S*kKih?v9FzcOdWtC*-?PS`9;RG=7=@U!ERZ(X3z@}HD=*5$Zh zjy;wU6yqPn*pIqUsK@oG$!Y2`oUwM?Fn$`asTVNEX$)IXh<^~~3HT4f!?=LN5b6`N z%$o!=X{=zDd5d6{Ss|Eq&K1o1&KFF+m4ai~^Zf_;S@fp_$FQf+=EtyS*})BrN!Iac zU{l8%O|(64K%ejaSYA+S<4t`>S{!5iD2rKMzzRXA%CcU=o@0jiZS2PpGXgRh8{^-@ zzMOar{z2l{7=H!&XDTrp22zQQ@i!r!r=)^Q7;Aki60=UUlNi;vzt03_donNMS-)z* zY|n&X=4%(s`W+Pbng5w)Qm}v9@pRre1zDM{W0WKA# zhz{$q8(hkP=n(G}9A_k?4);F}K(+UL&w%<%X|gOBeFRFv-nM7VsFAlZyK@(q?W z+V}6MpKIUGk%{*ZD$4g$=(&6+!B-6>^6}A&Y2l9CU$@5>!wt}OD3K4- z6hc1zHmAo?2l!?yndmY2Yp?wdgYOl@laFsZ)V?>p_WMup@tIXc?fZL=Zyg%#Z77lN z8f?n<0sym*$3}S*gME_2N64)~_PpPs48|a?v(WrkJ^Gn(vPU*?usfn@YoOZj(ap!D1lCm-dX;@1IC#LG*4`IyM16m0F1x;2JBo8Kd%KfLe2sITzT z(0vDr+q=d^->JbP4n7zmroAhEBFmtq9W7JtX_@lTXioCOfvLwFDac=3HO)5>ZDM|( z&0blwvaGgZP)ld-7ZxoZT=)#W0e)(F#{isvcMOXZemZE&%4qM*I%d9Km})$n_uY3Q zJFbq542nB*r*vjz=R~48RwX(FMxeFYMrDl*wyZ)TR1k$#A2VL%XTpc`+V*9Xv%eWd z&0WE&okz}}{UMf{Ywwb!8F zsWbZ0eT$3CnyzNi1bmFS0?P&A>^`J>S4(%U{YG;l$J+VECDBnR4S{uEKiSe5tv$_e zL$BuGyBSSe_(smkBIG#M867ga271}7+|Fzpg^aIewQ?6o+_;55}rfPj-Q)}UjD=%nWY`NIxI%Z??9Bbz^yHR-WqHsRGAvmPWe7ozc*wLD7I zEy0!@N6!CvZep+wK`h8@>fV^QBZxEHxewKUD^JzT64$K$PdJX- z4iw*=ce-{~mnLgH+wzK5?c9IpKw?Q^|M~-o{WaK*9!Shggw28_P_{iD?A~9t^*8&D z6nEDu!->qwW;DRVd5h+@-8gjBitNidKjzf>$hiF{7d8I~OO>pPV39%FaQiFvVv)bv z>$;PC?jF##;+icxu4`C?nqUZ_=cA)dJD~$!ylT~o?u^1G!ZzWt%o8>m_U$WG zpLH~AVk5^>;rQv|BJ^fS?6#lguiCx^^;tBxvf0VRX$i>k;9!j_kD7u(UNC6YgB`r| zqO6(IP5SZN*E^@8e7Q0$%(?9Nv5uCO&iLNL+c`24ovr5*ueE*;3wfTyN>qop?`lru zwgz3DQ=c~p@*}0-CvJI#Xh*;o*Hm{#7c@;k@AuIj+fr_eDp2YV3sv9C(FWYv=M{mDm*5y z?fY3nwq{?3Ws@#%$qLFZ*|$HZB`c$R#?I&dD*A!sG)>x=*S0Xj%Uc`_c{Iu1b|A8< zOA8U|zbnsSCBXc?oPp;?3f1!QB&Gh?Z8&QD(~tQ=$iG(V%g4BUJfZ)6O8Cmiot{0_&{JXlMtMLU1>&;LzUk#3?bYWa z(jH$nd?Ul}%Y3(x9~l!#V6Q^HfAaFH?_=sP{Sq0!d>51-xi#{CJbMmFe=arYw?$^+ zIa!7I%O(93a6Ve&>r!5Y30FjZ>gjiS{42fwZT9pJd+Ehq`a!R~8ol~n>4m>7`S}}z z{K#Dq{svlw^$Em2OsPit-6l!D$Fi#YuB)QoV@aXkW0}1`+LV1xtVIOHHmA|iNal6p zo%#eLtUiZ$aD&C9=C@M{j{*I@YQFa(p1Q`KQfk<6fwTc$%|wW`X#MVI_~pBw;b#Pd z?>+eJNd1^#NeaL9nYzdrFy+cA&v1@ICJ5hm1!V@BF&B)tm}5@Ad-MC9em@)ntmAa7 zU~=CpnB2<+lbgpR_1S-W1(TcaWEoFxihk>6bI^x2#n{XjRS;wItri=bCt7UAg`Ap= z%~BU*v($w)vo7~wA0r-ve~=PvjGu?SY1@H}weKqR_li6h5wrZ;1hf1~!7RT^~PA4QKTQ|=u$j(PeTC)8z~wQb2;z(EaRJTdLz;Y3XR8wHcwj3vY~ z-_sILd%h-^9F#!Xfn4l6<~4RoJ8-xZ6l>Z&T`_HI`L}-lY^q`N*I1LR3YLFKkzNUX3Wqq z2uzCG{DrsmyNg&tv6> z$?57!7aIpv8?ZFvhOiOLM{^7fEaX_Vajlu`;w4%OIRRSzQTEe|HJdgzti@=4$T;0v zSy#V?jvxD+*^$}`{Sfq1Jiq?`7Ya?At)HTtW8uG2WG~sZ)>4EBd`A!11F|TfO>$#;TgS zI`sI8kkj;sHPnrEtl3zT)aE6wZ|9jf_cpG5K;0wub2O*;wd{QsT53C{WYP{q9nEAT z*STdl5zwil@m-l(Qu@?>EY}l>aaozlrzVj%)$%l%`YA>(=O3z+o_YEy1V>^IXN~Em zU8PngU9Nr#O3o6y*cS71^ie=RbHG{njpeB*A3o%y=xv8WI=zF4cljReMeh|)@3CI=mZPy; zz9*okHUWmX26~K-GZON?(;t9geJ6N)2azU^>_ADrn?1fG5m_h_pHMK z7~1!u$H#Xh%7@3xknal~-*Kd+v#-tLi#dE8uWDbN*KcfhmaC#|Sp_|}{YHaN#~&Xn zm2a}gcN%H(y1`H?-z^^BRPdERgU1`+lPKS4bgtXKSqPwNp(r2c0TRb0rNOB$-*GD6 z`@k+=6an|^jq<%CdE(epHahhkim>wWyyNoG-gNDEv*d|mPkGegWBJO5W=Y|j48AGM zAfooMOyao2b3R@PFx#&PoANEf$%eY*rKs;98?t)D_d?I*>vr02IMS7Gq{p`ni(1E5oMt@#5*$cdO*{`QDRujZ4CI@M-(q;_!7r&*j?&z5*o^JqAyBe7hY! zzHe3g_IuaM$H2$)nu^xS_K@Xu|(5+t0WK_b+nyoZx4ahw6j9PsJ!!Ecw!_b0f> zyL_DA%zjf*zNet)@*M_W36$7=e8tT)=G)@&okv0i;#H_e+2rwcJABkvz83*p`^s@% znr#^DKjrHJAdXAg&%yT!Fzve&8`EfCJAliV03W{zs!)&eMF8SB1CZkwq`dZ!?=Eai zBVQrf+2!N>VaBT{-(aslp2bDH1WM$aj!pUA^V)Aa_;x9o=rQf>j#Fp^{GQ{l&Cd|Ew`OApF zq&rS50%?}JZidG6F%vVCYSPQx{}C%Jq-XTA5n zlhVt)-HA0p^r~Z+RmeGasC(hJN){h_XwTC}qd84Av6**HsTtNizP)oR(#^2^WM113 zi$|_!|2G%jihkURnR0Zxg^uXLB=fE1QH*$~=0w_##Fn%ifiD`PVx|p3scG2a8mbL3 zI-vX2Py{>COPs@P%4oZGXrg9U3uZ+7ncJ^3C0P1zT?_iniDp{>jR$?pH3(wn=3K*t zNwG_=e!6Dy+?JwYn47z3ea8SjzS>?YMC8*IaAMPfI$nuvT0V^WGUjVAf^_couRK#hYlcNLebk84iqVbr#g}p=XP$})hyGa?F`0+8M!c_2B#nUBaJCF*Kc{ItElMp zqS*P@+B-MHGAX64b^wf6*KxAF=6ZB(4qirVX@Ul^_ThL;N#7h+w=u8nflTB<14l3A zIO6=;EiJ1`Pi5HI`eO$0@XG5rYFh&bT~7A<7m6-i*zubSW3s2cd%+o|3UQp!A0Kjj zB?Co&=((7K&0Ng>=3%Dz4N5;B(^L6&KazuJ78x+jE-ZE`qeSKj4Y8z3|mk{WS_%=Vv9?$3x-=fnz+Q`al|7mW*vhYEG{R$ z(c(BU2_RFk1tSeK?*(+uFpC8%CgJJ);FTekjMG@8qNstro&wH zTp9hS=X|{W@1353I$hNC4AE2jFwsF42escp`)D$DPuMQ~Piv44P3F)dO*5yGX_8L6 z(6G~b{m-{RffqI3LiPUtO@5H3_#IAu=&?}f#m#jPLsF(K^!xogT_)|IKIb~9lJiwt zxYEo%=;JGY@0t1;ty&D6aB_v&jVm9pCy|RDy!{aLQ@lT8p#Lf+b768YSgHyP-acs6F* zqQ{qT_*ggPdkfcO*S-d%@mi~*eAIFE)*+lu&tDT{GxU^$oQnN5K@Q4woAt%5Kxp5; zqSM@Rw<1k$#etH1--jN#FDz9mNe{)sC_R%$>lrl@LdK?Oj~u6QU&QmN?D;WE?u78hi5bev@hB^XHS~V*D^(Mfu+G_;!P@1WM%N6TkAk z3gFtu=dU=@Rj5bl1|W_z0D0Eo<8i_?+OgjoFY|k`?{nUGIqmTAd${r~_xP%Nv9HGC zd*9*X@fq@=vTl73f^QDeRj5a)ff8|?0Z0tr9ZqA<_T%G^@>O_zXTitkU=`&n_xR3( z?|mqdFNRI|8ju&N;rVYf&LbS3D$2JEdc<)__)j$cIAHP>V^h96JwASK<8!!*@_p3f zD;b#ND}l1|eOJzZ`n`zf^*SZPp0;yi9QU+|G72ZXbb5az_F1h+gx`-`AqRzisod{H dTswur`chPn-@QN?%5LzTkuuQarXFn1{|C;h14{q^ diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libp256m.a new file mode 100644 index 0000000000000000000000000000000000000000..fdd57f31859ac785b818128ef912828c212b77a9 GIT binary patch literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=s u32 { /// Return the number of words actually used to represent an mpi number. #[inline(always)] fn mpi_words(x: &mbedtls_mpi) -> usize { - for index in (0..x.private_n).rev() { + for index in (0..usize::from(x.private_n)).rev() { if unsafe { x.private_p.add(index).read() } != 0 { return index + 1; } From 2afc2fa72acf7517a9f220e22895efc0ff5d2334 Mon Sep 17 00:00:00 2001 From: Eric Schaal Date: Thu, 29 Jan 2026 16:31:25 -0500 Subject: [PATCH 2/4] chore: update mbedtls to v3.6.5-idf continued --- .../gen/sysroot/include/inttypes.h | 74 ------------------ .../libs/xtensa-esp32-none-elf/libeverest.a | Bin 2474 -> 1970 bytes .../libs/xtensa-esp32-none-elf/libmbedx509.a | Bin 180050 -> 102274 bytes .../libs/xtensa-esp32-none-elf/libp256m.a | Bin 1714 -> 1382 bytes .../libs/xtensa-esp32s2-none-elf/libeverest.a | Bin 2474 -> 1970 bytes .../xtensa-esp32s2-none-elf/libmbedx509.a | Bin 179962 -> 102274 bytes .../libs/xtensa-esp32s2-none-elf/libp256m.a | Bin 1714 -> 1382 bytes .../libs/xtensa-esp32s3-none-elf/libeverest.a | Bin 2474 -> 1970 bytes .../xtensa-esp32s3-none-elf/libmbedx509.a | Bin 179958 -> 102274 bytes .../libs/xtensa-esp32s3-none-elf/libp256m.a | Bin 1714 -> 1382 bytes esp-mbedtls-sys/src/accel/esp/exp_mod.rs | 11 ++- 11 files changed, 5 insertions(+), 80 deletions(-) diff --git a/esp-mbedtls-sys/gen/sysroot/include/inttypes.h b/esp-mbedtls-sys/gen/sysroot/include/inttypes.h index a640f8e0..10ca5bcf 100644 --- a/esp-mbedtls-sys/gen/sysroot/include/inttypes.h +++ b/esp-mbedtls-sys/gen/sysroot/include/inttypes.h @@ -1,80 +1,6 @@ #ifndef __INTTYPES_H__ #define __INTTYPES_H__ -#include - -/* Printf format macros for fixed-width integer types */ -/* Using clang's built-in format string macros for portability */ - -/* 8-bit integers */ -#define PRId8 __INT8_FMTd__ -#define PRIi8 __INT8_FMTi__ -#define PRIu8 __UINT8_FMTu__ -#define PRIo8 __UINT8_FMTo__ -#define PRIx8 __UINT8_FMTx__ -#define PRIX8 __UINT8_FMTX__ - -/* 16-bit integers */ -#define PRId16 __INT16_FMTd__ -#define PRIi16 __INT16_FMTi__ -#define PRIu16 __UINT16_FMTu__ -#define PRIo16 __UINT16_FMTo__ -#define PRIx16 __UINT16_FMTx__ -#define PRIX16 __UINT16_FMTX__ - -/* 32-bit integers */ -#define PRId32 __INT32_FMTd__ -#define PRIi32 __INT32_FMTi__ -#define PRIu32 __UINT32_FMTu__ -#define PRIo32 __UINT32_FMTo__ -#define PRIx32 __UINT32_FMTx__ -#define PRIX32 __UINT32_FMTX__ - -/* 64-bit integers */ #define PRId64 __INT64_FMTd__ -#define PRIi64 __INT64_FMTi__ -#define PRIu64 __UINT64_FMTu__ -#define PRIo64 __UINT64_FMTo__ -#define PRIx64 __UINT64_FMTx__ -#define PRIX64 __UINT64_FMTX__ - -/* Pointer-sized integers */ -#define PRIdPTR __INTPTR_FMTd__ -#define PRIiPTR __INTPTR_FMTi__ -#define PRIuPTR __UINTPTR_FMTu__ -#define PRIoPTR __UINTPTR_FMTo__ -#define PRIxPTR __UINTPTR_FMTx__ -#define PRIXPTR __UINTPTR_FMTX__ - -/* Scan format macros */ -#define SCNd8 PRId8 -#define SCNi8 PRIi8 -#define SCNu8 PRIu8 -#define SCNo8 PRIo8 -#define SCNx8 PRIx8 - -#define SCNd16 PRId16 -#define SCNi16 PRIi16 -#define SCNu16 PRIu16 -#define SCNo16 PRIo16 -#define SCNx16 PRIx16 - -#define SCNd32 PRId32 -#define SCNi32 PRIi32 -#define SCNu32 PRIu32 -#define SCNo32 PRIo32 -#define SCNx32 PRIx32 - -#define SCNd64 PRId64 -#define SCNi64 PRIi64 -#define SCNu64 PRIu64 -#define SCNo64 PRIo64 -#define SCNx64 PRIx64 - -#define SCNdPTR PRIdPTR -#define SCNiPTR PRIiPTR -#define SCNuPTR PRIuPTR -#define SCNoPTR PRIoPTR -#define SCNxPTR PRIxPTR #endif \ No newline at end of file diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libeverest.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libeverest.a index 7db4ad659b426eb242680a7e504ec6f05a170556..709f693f2dfd5ed24d87fbdaef805889d85cdaf8 100644 GIT binary patch literal 1970 zcmeHH%}&BV5MG2x(i4xc-tfS-6pCPsnizxw(Ub8el(O<8w4_}Kp7b$%6kp3Hz!|z* zSHy&HlEg`-^Sd*X>6bY=b3<=%ZkY5tS(+K^`j^sb67Lv9lDS?a$=R%wk|rIa>3ZY# z)hwKI+i{Au_9z(oyvIBibVsJa=RD+*kS3+cLny4zRVkNOt(;Otw(J-$_11MNl~O~J z6nOyFNE+ppD^Ic*tw&R67!4n(H+KC#h5pen@TqOFA}iATK!|B{YMT9_7|goN3nnI4 zPt5UnJ}FGYV8lJaAcI1v5Wj5OmhD(oyLPM%5UWh{WXQ*oFu@msVC@O_LGc5@S>xue z5DC|NA`IKK-ChqS>yuV_QQ&lI8Gv{NCO99GnnUGXg6{wWlCT~H#yI+MKJ2+z z0WE>lKc;?QN^NLoNRboR^E##);8Udj8A@dJFaH{*E?~B8FlFk8DY;GYDcX3a9DD0K gm6OZb?>qI|o!=c}h^KXo-GfijzF_PY2Hpl^pI4*{)Bpeg literal 2474 zcmeGd%SyvQaB6)<4|-A1%X;wvx{a~%g$iw{S||!u!GoBl=}IfMkt9kz`6K?MU!XHh zHm;>Xy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedx509.a index 25e1a5f2544d518a57fedd93c93749e6813a369f..2023313aa4c4342d64a7fefec83affe5fc00c0d8 100644 GIT binary patch literal 102274 zcmc${4SZC^y*_@1q-uKcum9g4Tdvad zPj^(WDJ!jCU$<)GgKO*NuBxi3s@D>|%4^HYEM6OfwRL5yO3P|3{&iIqHD#r%N`v*m zRS%WbR+VoXT%a;oS7{a4dc%x)t18OsSJfe6aD6;t+&{R!VpYxN^@E2D6tArd*3|`9 zZLCAqg0;cwx`84!!Rr2;#nY*;8q6128%O}pRZweSK-t!QD+=P$8s^QSgOSt00u0_k zLLMyJwyLgbd)cbWvh^EH_7{mz^HpoBHzw*Me5+`MI*U>&qsQrp+h|di@oAaOb-@ZtP*qL& zhAX5lM227%VM9>Y)z?A6&EE(n>@Q%w2z+o=t0Q5ZSA*-8@JnrFIQ$G%#5eTDKWBey~E8nXcJTW96=^ z?XO`LVgwCR;mr|N4PCXA*g(!f>JNkmwiMY)d8Z22tXjLFy4q5nhQOdE?GGA|gZ`j8 zP@}*GbR3Bi)ujV&J&6LU%SEM4$ZVoiRbAcYvRc;c%Lpl|0k?obxvn5J$o)N$M&1@{ zgIg}6(nG=ZRi#z+pGIrkyvk~8g7sAo8NKdhSmT}SWn|U_>#EkG+-uMzf>kw^o4O?{ z@}|a)qpGy5roO7Y%5v9Ej1b&hU%3JIhi#&-`BYH`@01d0*~@+!xgl?{{dDH1KK2s* zAsfr82Q%AXjYvj9&`|9FL2L&@*K#Q^M8%b%SE{&D?6Spfq53qnsb9B29!dK1&J143 z;-DJB;s~L|ueZL8ncl?)gL7so-_@zImoE#}mrY+geZ!h{*9)(Bkq+WnSF1cz#T$dX zBIi(Vfpcch7D?vMoi)cudv)p;Ze3ig>pETr4X10L)B3M8ZS`owf3`T~YWXsBPLbvw z*8APDyEN^P?VL*+cM$@Q#bOj|=rGR2EkEkVBFu74zqm7p{ZMkrb6n<-;XkKMb0@9v zdz&3@FLiJpbwG=qsoV0lji2Q4?zUIyyJE3J$w%!c8F2fEMHTHm?%p0(!SK9T?5Ojc zUGui+wXYr8@!^(Sn{$Cye3Q0G(~cKtn_{uzd0IHHp|Lya-=ASCzCkl$x~oOBovGer zd+71+?B4(LuqT{*yFZc_XpBj1X^= z1K!bkgGc%;veR#Mf?ukQev1viN5ScRTXSBmg?B~Unj#e$^N>-PsKW#EOiLbjF`CyD ziR2ksg+KB@dj?*8r^Fx5TNJH0U@Lw;hB(gmVqwoqCCDr6e$*+<3;CT%_l?n;wnrTu z`oYoqPFG;=MYrSjB4LuWf^otmVb8L@w7^O|Tm%)ikpbx>pG-nZqA-3Kce?G_dnUtc6w&F{R#t#@Nr>OH-MJ4rs_pZ!9wkFsD&|D_&;!!H?$1bK4n9x2HSQ3N0~NUeb$SdAv>_-0 z6%N^CHTAC3sL|wc7sIxOFLp;A`!gK=SZv%yw@oy#cq`Bl*V~-bG2XiKmKP6k5qMTk9ccWlK$ zWZtRmbOh4>zGA$&Ju|J@y89~HM`$XtJ}q_JMWLJ4&?(#M!Nj(%nfd{9pP+IvXP36q z7Md`tdBW@iOCv?0oI~DRJ=EIK^j$-JKia@L^ei}!yBKQSqx=J%e{VmLcDToFh)qik zG+*k-GcFdSdT+4<99qLp^q!OVXyLdQWR> zCT0ZoU2^J-R^r(OZAfF3pzI^1O|KowrnC|3$(*3JLf>g~+a`IIC-?R^3Wf)bZVg2h zXwvibaB|es()FwZVeZmH$xzs-d7HEq$w-zJ>2`bA6S*dud|(2aH=4OLKFh2@_P0pG zNMVu=7F5apB-qc5Sr|B?=O>3fO?UV9Xa&R3sU|UzBdV^Bf9((|Y;sg@sl3l?)Ym>E z*GKKh_r8@{RkC}8EJu~Tw1dc}tS6`sNA1wWK5tWR&)9--v<;gevct^GpJpF-aYgX< zqVOhfZY-MIv;w|VrmyHsFtQYa3sM7LzZ6csFXI;XHKEqhh#vwGY7)`sb?q%RPsZWO{+Wei%-Q=0)CU!3__(AiyRR36y`pfR?V_W9*v` zv5&0u2U7nUext(^O>KyDM}Bq3F@!)~gsgiXH&LXYgFE0aV#|&dAX{jccC^Z5txNaE zVmV_RV0io8@UUo7CGVk)$6~!%Y2i#o(#ifV!%3-`e%TnhKwM%k<5hF+Fd3o-enu zzJ6of{Ohl;z%MhK*G$K|?e%3U%Ju8lKU6&pZ}j{@a5^M>2%2WZTs3pX%o}Fp&zv_Y zvGy2O_akNH9NN1H)z7ZkRggH_wPdYGdR-46n>Jkgyu%P#Dz5z+T841d;yPRVn{Hgc zE3Ok&uxrDNK>6PeKC`oHSDP=P%{7{80tTOa5RJzlWs$drXIjFqvt0Wv*Apz)*_P`Z z?E{(LmB^<}n`Q~O=68yAgR~bVZCaj1-Ws1)?sxV9^0TyVX?Bj}SW90uyd2OUOPJ6&&pQkMR z4_WvbT_0zVkUL$*XEa?_KR2-t|KLO!`3;N>?4K;hwE}BPRDtw#Mk0H zLt=*WJ&p1+an2`B!9TbH9Qp(SwS~l41}-6%RecGu$M9cHJkh}S6JKNC)x=%{R}$wK znE6VFJ(yP}LrlLLC1zfEi=#i?N*u&4oPR1YZO|hzvY=szP{{ajJ|{8Nz9=#C>p-0# z5ABg5G3_x`V%p;tiD|cDiK+YNB&MCVNDQbwEHQ2NRf!9Mk4sGZ{Z8T%;I|}R4E&zN z)D!mxp&RYWxN!ufEhHkC{4!#_CI16_8t6xG=f z;AZ1c`4Tz|H`4dPKOLAll82a%(TJ&6k;G{@-z72iS|Ks@DwEiU^G=D$hv93%!@B)- ziL-EyN=$u!C^2Q8mYBMqH~GIMG4nCNwzzf1ZEL!Xs&eQ3A)U&@&BsAZc{(K{>`!ty zb^+;(1UC-{G37x0wl@pJ3+#5o3H#=wT!RpyBShVXif9MuNbe`@(b z$mOhrPs=@|_|Vkm2@jW3TT&;8lQrRI^HpkCK4HK>yVHtd(;s5^#4*5U`~ zx*@3&gjBtW4^Z}xa+?%ZQbtNv5vA==Qmnt2MPcIW*H{!GhXpYvo@mL-$yl<@(Nc~e zVR}IQs`X_xLoy8zR4T`-!_c#0@p%XGfp ztqPWwV%)KRLQ6cE`e45&Vi;9nyJgT;Ra`lrWJvo3#dMR)Sl5=N^ME@XX_b1_U=S7{p6L&Ql`cn|^QRoy?CU~O>y z`VDI}!7_cVHXVbH7{|wXTeUdXZeXuMZ@kGH-SDURUz(&Pyn+7?&)Z*wpK|E#g_{OI z%x5{e*~TgUpZ6HL?+qfS!WgdbKS7STke+ah?pogJflK1o{z=A>*H+w`h5#>X8lUR_XgysUosBG$LC@*Ul+po-l-hr=(bw; zN^k>@A|mo*nweCAP3@%JqxcpBoB0+ZfOT3q#m8qi;zAj)1AJS7$u|mz;-fBRz8wg77ki0hQVCuM2eEE7kUUmmU* zM!tH~H}cKIK{pS4tOv?5jK>=Mb6D#){$eEoA`w8Uii(?xQ z*1&K+N6^uJbV_bL^nx!aw}uWLn2;GgU<qI6{d392gf}zawPwSZIP^KdP_KhQPlYOCwL*)KMrQg8Dks&+Sx(F&vF#Y-7oQ- z-zAQ7x5(>de@OHfxnmwMS7mv`9&wB1u2|WGEobUkF-TcxSig4DJ{8TUP2be zUNQb9#?riFTw?Imc6^Ff<*97T*=IYR#iE-9{JaLa}T z$(3!7*m6BPUAw(^DVgscO+JS?5U&jvGIvzAZSmR~CnKNIY#cJI@=Vghdofv~O2o>5 z$;7-6Weo2!jB4k4#$9ah5n*;1%KKuHFl1uP(_*wfA#z~+CnzM$*x0oDKv&nUHZfg8 z%v%UFeT;c1OpN2^9Gm?p+?K0XMBUEgm<&Q>b3PaIb6&uL+pKb|i>Fz=)Z2hzNwlhII}wAkF<6Jku5M5rc``>vUM^KE0N4uj%ir2Vl9 zOg&ok*W;-gQoApD8&jJbT>#B1j{j#Y-#>TcT=y6u4yrp-Z?D+u3EcB8bSTD8Zu-`| zjtVd#2<1_Mxd}+f`7!HDE3hfDC=^`!g1)|-3(*KEUH z{jPR3Zm?o*L^xUWK-VCfV{3Cpr;Tkocp%qZ>>lZ~8Pi7G6WvLf;Rq*aFb9}*#vHbw z*ncNm()7{O z&*9e6Ck}+BbT+1F&+SA1(s;9mWLkzDXim}Y|KT&Ezk>N~1yi1xm(+Z4eWRu|A3W7` z;DFV$u7YVxTqX|*R#ZQM|IVvggI5Qv4g$3B`}o9cr9n$(n2{Mr3`-`Vqe_eOtsH6MoQ0H^c-s67pzWIf1 zD5s>t*6zLTF|9ABc^7MAKXf{@9^u>Fy|?v8Y2MfLu@{E@^X?<*u>b!2tHSyR`6&fm zTk;*xFx%CkRq&uJEV!x=mk$@UhJ8rz zVArq5o@soW6~rg&NdwNP5AuFAy4Izk{USYe?}<-{@v}ckoH8J8J!fQnQ};L7c3A~^ zpL0Sv(MK4Zn1CeO32M=6sKZI+l~def++Ri@yfF*$E!!QhQj$}ZlHrA^M>ZSsb%+;; zU< zpYkq(I==(^p_C8>L1XFjS69e0{%5u!fY3$ba#$pG0 z_-|=@YiwT8?RndFJ@({n-W=2eH*Ug7J(!h;AxDw#q;L-s*f)9Fee-S3A8VcCTkq`- z&l$UI>)!qO`qo{0H4T$tz@@ng_Z038wJmJgb+}KIJ|{|sTK^t-7lw?y!tU4oVdQmp zM<|%)T_@(E*)Y?HQf}A5j`@N)A73A*r0rO~ zyTx|=%ZVDNjz{dqMy+snT4(bCf9vrB$Ta~~v)b)C6THy&;VZeDmcQQd?!l<-_zhaiKewl9OOB-V`qNI_nAH2yT+|NV zOTMO~y?5xX$BI6fpVa=c@cWUk{SGbjfIIcz0o^@jO4xhkZ<))Bbn%E6@yx#g)+F^g%GxL)UzbI&q_)xu9b{<}&?|G`|1N6;Cir?}zFVZr@ zQ|^rx@6Yc#4%#Fmd#54&h&!dZgf*bUzua?F*4h_!+(M6x4EsBC!=BdV-O=)pb8K}= z;G}ZDvl&WEbLjGOSSd*<9J+g zrLWLAsBQC9={sTTi2pDi@6h*&`I;ZoK2TA1%#C*KjGsOT=Zra*7L3LAwK(P;DQ>;H zyS!pSSU=o%>2*ARMiA-jRnN?GG(6XOW>}x6%YFEzOT7GY>jl^3&JV|u1r?MX^S&nS zz9UKKC6=u1=Cg8KMPXC)=Y}j(6thVEvDn=Cjz?^GLUFrxe01tH^uXKKS!~z_2;GzSB`@n>&XOfw1kasbS-hGFTLg zg<88KOLw98#k|TQ*ff&IOaC^#y=O+(uD(s-AgmK|YLUH}jS*XK&vIdO2PR=BUhI`6OlH2{)h{?L)9Pe^HJU5W* zaE}?wCq#%oHWxR*?e_4Kk(_W_WK?)>1l-ZKmdYyI+^22Fe}{R_E9TDiPF{-H*D2bv z*M8fWtS$ExJNcW^aR(GIdyl0}NBsaJI z0a2gPrP6&o~?yPHLYmxabc#UyP^nvZW3;> zn2o<~IPRnYTgrj2N51GTiPXKY_Sw6)-BLBn9ga-cb`9)qFV52L_^x}{)Wt@o-MNip z6FjQy;ZYO2Y~>|2;he~<@TkayaB}3D<6b2s^5)LKr2pkPEBtq?l~jksy{IID*iAn% z6e}2RB!Op$HF#Q*sT%PsAqZMQk7QV#{CvO(<4vdOS;U78#qA9*YU4jC{(#Tf;k@$j zGnIar!~GR7i}$|3%8x~qNW^a>inm>~Bv@jy*7(zy5r(*^0*$|qDZPY5;I&IeFvDJz zVfY?{u>)g1VOYd-K*!unN$tMVU|y$ndHQtc_YL;P?i*t}ej-M%<81>TIaFyUoY_8M z;N*^4!$7K?$JdDM9RI>g!C{z-V%=HsM#XH?Hw z`oxUnzy)pmLO#;@@g5Z-5(Pj-@jQBk_>&yoDjYwVfRP;%`n5#|vbkcDC(_ zqrPVynZMh8)bZucrwjf~We&UzrgmWNa}$hXzA&{Bv-g$o9No4oIBvOZW^mM2`}kmn z_nx_-)*p!nyXL;M=3x3A;ZV@)c231z`Nsem6V!LNOzOdVUy2s;PjPSC{jBZyT0R%=G%(9wa$B6w{#ajMVZ%QG5pqtNzX#eF2qu&L#**>ZDw#}=M9i- z_D|a~j~*fa^m3$Htxde$=6p(f&t*IB(s6$bx$L3f(bF9&g{GZ0hoL?Gd|B1-wiFSqcS5LVn+( z2@LE?90Z+phT56s5ZyiJ)yCD@>#-O}nWWU#r4?riv-jK6Fnj7~>bM3B&SeA2 zWnZe7p#e?gZ4)J z9e90>EA>5B%6XTo*Oh$ON1Lc!}!2e182Pso2AZ<#(HM|Oq$6C#^J{w%!t__HHR zL;i{QWX7Kp$qV^&BmR(o5`L2M_t&S>{t@T>*IY`HB{#;g<;YF4*rt@1xZ3?QQ3}ZD z8vp2$*@3K=+_v$zBG;p~xkCPo6?ig%nb2g+qWB0W(PPam=!)h?4KT8iM%VPYF&{g2wY9pG3h3!7;-jczkADaI8tNKWPXyr9u#&?-`7E76>!x zGi=zVq@m--$rVR-sC3;W{ZgpE{pq$ORU8S#xpMoZ`V(b-@k~7<&Xqx_4v}I4*K2s7 zP8CvB_H8z|i%*7$#q(*(!5B#pzfpu*8;}%BC9qt31$`z;BNk(6B&M5A+bxaTE?yc5 zCV}l1vDg|_v0;d5P$MJ1M_6pd{lyk94Qu&MX0bVE#gjHl0~NulV+)JzxGFaErltbv zH#KxjbyXbM88@{m5No=fD7O3JQldbtReBjN*YZK_JWzU$o94AcmoDK(x&uG5f?7FGGJ8vt_n?^8WD`h4@ z*oW`7eO$;!OT`6T!RDH}%^NpvsI4z6y(#Wl9b8|&p|;xOwV}SUtoAM}+~b?CO>yc; zNy!)*lN{u!4Az!z3D%bRsyCEwUSHi!{*wxWw*z_^rv9yU3XJot+sq^{>+&IN^OvHgjX#o!mKNNmZN2F zp0571?B&_Z=U@4s(x9}e7N6y8sNH6mhUIbh-HUyO5rrovE@sy)#B?RAAH|9)uwIaq;q@(;A}H8FbIY>D3Mw|= zXKU7PL(sx9gWb5kbKwoz-6chN{5NyvY;n3_4o|c4#nlaYGqq*6FS+&3g?V#kBz8?h zU;Qt9KJ~F_y!F$3J7rdW;I~g#Yu|Sm5}(J(CT6De$Kbb5W@jG|KFS=d*~QH1elL5% z%npnPi!UN}_{2r6~P%G+dx1{&3#UA@D@%hb+a*ThsOfP_Zjlj%~7I_^- z*a&=W@C%FnZ_03fzcE6)L3>p4<%;Wh+HrZ!nm0nbQF{|-x?~(9Fw^6x)W^79pxq?x z&G|PY@CDY7E$JN*u{G^u5x-FTj+DoA8ptowt|Jj#K8_Li661oUeA1-7jPhBg&6oV2 z74iXdbrJSFB>7$x_E@Q{mGJ{YztvikjQ@FYT`KC2?xzNtn8(ELnW!S?w-9sA%RGs3 z59Q~QE&C;Lg(kV`1H^1R0?8Zdl z$gk5daG=oAW%-NmTY#Bvj`S!0E{UnbS0rXy2PI}YCnRP%e>LGG<`d5L#e>x#ACwx&4eX8&l^+uPsSf;1T+bQFxQxFcn$O%l2$r3Y& z^R_5M{YxY!$2}60qf}yRSyL_bJzJ5)lq4Tx>@ybEd7!Nn@g(M-N-{#Qu<0>ghHG5pER{1UU? ziF(L?aJS+}2d0jTBxc^rBxar-l$d$iBQb5bPh#3o)K%~>e=kUXAI^V}n0ewnW~RkF zjgy$V1tq51r4kncel^S4xDXazf6rmem?WErb(4n^BRAo)Z;3{1WmQilGlE|kZg(XIig%iYqSY1T>1 zG#`?fap|bTJva;frOv$Nq_aZ8@m5F7aA7y#cwBS4@KajaoRtnvmClQza!Y1&bjfG8scLLL?dnNnLbg%Fd|CDV-TDKYg#QbiPZUPQs z>Xj=o!|8N(W^lshOdO8YHyxPrbO|zixsXnkugI^gt0IqR3#%a`@+jMa$QLsNC-Mau zeh1{kwaQl(F&i=*^%QLiGE*gH|2IQoemg%~Vy+2MAo1NO9O^~O}LehUV@V6yqUis|+ z)1uA(B5@%wzfqt+_5Ux4sY8;@@TYxT64QUA#MEt~#AAUcnPe79oCW{25|;p%n`G)F zCeI#;7XmM{8|lsf{zr*@z%3F}{s$)iXH58ciSr>tr{ktX8#^R!z}aQO%o}BxSLTga z20QT7qO}la z;Mo#?ADC&Sv+&_~>mp{|;O#{DGc983$onWU^CIp?z~s1D`m=8EmZRi9D>3C)OH6t3 zOpdtBQ;qZ||5k}9ACZ{y-;kKP?3bAGZ4y&n^s!Q(qtf4pbGO8le^Fw}|5jr1zbP^8 z_eY5-|DO_5UT2v~e$gib=fYp~$-tB!EoCU5W0IdK@l^QVATi}XW0JqqB)>%B8IV~a zG0ROn+sL%aO>q$<%9r1{viw-quK_a+V*X|*@&L>>%{hLYp71bHRndKfxYE zM0|ZdfI_V+toB9tG@OIS8OX1`qW?6@KMYu@Awg5M>BMC+nl|NNd z!TNeEZjWXD<(@j1EhOu%IG53#N?C6*=4!0;5Ox+B9YT6gV_zU-;Kk}T>O%Alb!D42m({E-OI$fewFKGaVTXgdwefy_t+CP#Yw7gC7P{dQVzPXv zFRsH*FKa8Oi!E&u`y0g#L)T5eVJ__aKU*OO&#w5f4X^QW_cC6nR`3Tn>F{VQ+)Vr@ zb{d!B-A6)k;$ zDG*kCw*i>->ylwszMCP(IE6C6XW|}gubkpL4>>bm7<{TekAkq`!(`C}zV+ba{1fFAUyp^a z3w#eli2AX^MIh=Z;mtG|7)eks0(Equoi!1*xBQI75l7QPbj zZG}Je!%seOKCbCy)~^roXjkPF-zvxv7s`Nc@KKI@cwLY4Ewu3c3VbX#@`zch3fW8tqH<>>wsfVhwsa2K=s%NIox=ld0e%zRV9w?V`({*i<3 zmjJ|tynyp%8^854zkqSR2Y}6dkAe?XBkmO6a`>3}>OrFHmm|Y?y#R-q?|a~rLoNt0 zIC##NxR4ic4dBbbnfh@!f@zU&5y;GZ7s0m}{>mx+ZiSFpzbN>gf)M$p;81)V+cNVN zAhVpWq@3c*w(u>UXsn4wK8|lFzP%Q{Z=kbfK9o~@U$OAbfYDTca6N<-U$uqrN8pPp zGAYMP&U0a$LSDeF2VV)#IP!2PzOxp-h3>)YALnYA`JOWIsozu)725?Q+HW;HIZmS- zIp}_D;rj%9Tj5XrZor}R`?@WW?;`k^j&h3ctB^D6SC39e)ffI=s`wtX@O=U@h{m1b z<5-B9?<)|>f)w@RZ+D8X+rpQHo8R&{n<2-`b2yOY`18;X$R*=iIhF1+Nr`d~4O^3 zwey9LReW=#el{7u6%U<0iFs0dd5|M6q$k|g$^FkI#kf{{-?Zen8+?j`@f6-;;X4C9 zH^OPZ5-G>)3Jc#c@NqmzImNfe!uN)WkNv9B&ug_G_?V7ziqB)Q-$n4LcC;A6itmrO z@0rWv4e;eFGAYN)Hz3D2g}i`sp|j1xnfbj7hvG}N@QuYo8nPC5l%um*_@;u7`5@mC z9E$JvmUff{zQOL(zkwX%6yl)E2cOFCGF&UZJUn!p^Sc^+N+-rscq-(~d`nFF-DBb# zX5lLZAIEHzQ+)VxI)U$g6JG$rlwdONugJppjj7;3qaxo*9E$Jzk`F<`UBpAKPhy@FU#o>LI=#QW-7n>s-<6j7 zl7>OF86=WU@!e~wFCT*MVaQOw&*4z|&9d+nf{*iXl~a7vEqpt0bLPF9e5-LNzFn5` zjp8AEu=cUTQogP{W3C+e)|mKKTKG3SeXTqpxp zul8}AlRtB|5#h>f?RD_Q4sN#ipR4)e+Q9?gZV$Ewj}W!|Q|pasavd@T&*`yk!WVPg zaS0zhMsu5ki=!FM!8^jPP;e0zV%QtDab+X1C=%8r>#TEU?8Txyo2J>1CT%NfwrMxF z#=Moug^{#^-|UaxG-FNo(pao577LHWif>@VZczLv)7xb0xOLg{*g){_p|)JH5KMny zV6xAh=}u}))v(?{tyYA)sxw#S*K1NSQy4awr(VIEzcF#6{;g&kL z1G~rVg7?1p*DPvmFVUvV%3OHc{y*OA)G`}G!8^nLrl&(~vqc86Hk+Y(V0&60Rvpq# zblIGr(VjlWRo8aG_Kw1ahP_b_7NR)pzth{5?EOlz+tu_fEH~p_F+4N8du-M5zr_Oo zINY5)Bh>wajHNGZYPV}AT4qjJn>j1zX^+&TZ_~uoq`=#H;}k7tmd!a?!%tqwvXOM( zChztX#HzN3dUCgiq3~_{ZBDV&aB6`?Jc>XI0@fQ-`OrUbVSCOb6R-oUYPr^ zfAMJqVE?V9?-<5t_p1dhP(c=Z=Ojfo-99HXw6$n~YuJP>hm$kE*lgD(zHrf<(G|ps zF>`Ij55*8CcN4abbUNegxtkir-0(P^To%EP#XYdtoBSqOu1lcmExsu}WSf|rllc~w zv*B6`Cmm&FY(dVd0s3xc-UQcdj~hU%87{CzH=6g>@vmZ&C8PmBJ@UEP(=vVrPMy zK3n~0Px}@nt!(TRE2x}|OH6bWjHQGKw)FkinBI#IOwk zKN!7sg=ZMo)l7orGPl4EM&b}aMgop)y1M`|gs#S3nVP!<`=B03xs=qXYt_lcSQG0y zDS^HCJnx8wbvm`M-qg4~d^t^Fd+u52eTp4~T$BilsOT(~N;E7UxsFe-O$)tzs<}0`=S-UWTke&wKIad;{7-1{yXPl`UVg06f#9Fv z(p~*(zGKISXcVEBUpQ^kdrzL)^QW}8p7S3*`A>VE2@@IQm(%kC~&U5Ve z1k$}HU)b@{{zsFiVM(-MjW(^j!_zv|w?C>+OBr_&x2XiD?qj^4(&5%7oVwQKHGh|+ z8)ls1Uo@(4CC~dFow~M$tLJcQIOi?VS@lu=O5Pf-^itvKY>lVn@G2^tx>osB*Vg9XP0{9EOf9*X~J$*1z8(o@$mSd25=a+h|m!>(};lMOZEd+1x> z;e^NLntJ04X1o{N>qyl$)K&y*se8?UMt#|5YnRk+c&G}aQX;5~Uqh=;u#M>ncZsjO5hF>%x{~<3 zSq0zgNRvLdY$z>*fJZB>S-Kh8h<)AfbxhaltLoP?#I4nB79XkuJG8s+(kih3ypi2| z9h0@&?$Wr~N>y-u9R#Lm8|%t8mu{%pR*kD7t)dLOtcYxz$){?i8=!2>EgPygZm8jh z-6_ozBVT`SYN7+6CdPH;1~J-8(TecJV?30zEv)hfv3>ebo`=TD6boEwu!HK zqz6vi2h!{Y`<6K|T-8X!*FJ!cZ@B%=o-hK%^fI+Ss7?T4>>t9G>wi#{T87_b$}ilqtXdm$qp{NWjj0Bg3L&tkQT`mr_&)`&I@NoX(3}X4i5#K*`Sv3lYnIPOk9J+ir zq1pM(C>_;O-;Yj|n0?_aiK!}oBcTjcx>sV-a@>Ia%*S?#nUC*E?8EtSiJ6aolbHGV zL}K!fLLSKD1OA-E%*R%V3xIzuG4uT!iJ9+Vh{w3(_efj_oFy^y&GAXf(0_vo?~s@} zgiQXN(@S~!e@$Y(&vAY){fQkolsze@%7|Ef^Gco6x2@EbnC=D~#Oj`-(|~Y-Qw|g} zOdlh>g&v&qPAAIFX~d;WIxy2@@e|YGX9I!BN2hcX{E}1fOHQHxI761>VEnd~j&@hy zxh|EM@#-XIJUY&GrMoP@Pl$-;m~@iBvAPp89!)^ZptTam`6XZ&>pX41x=2h_8CUuH zB&I!bC1zcv{V7A)e3O5n#926(NX&MyMB>RfFE{zGmiR`TD<$T5*G7qpaNcV2Z;*Hq z&S8lc*8g zqc~rX_%WO>N_+_C4<&vMXLjjsC-Lurb0vNQc!tDG zGhbq+St#-Qz$GSs&e1042k>7mG3SV{mN*ILN|XOaiK!#|4aW80+#oT3lL||G9nO0s zo`7>yVt!BFD)EgtcSw8(&QD0p-wV4;{%XFqF$+6kDv&Xm6|*Nd)M9(->Qz`8HIcSN3pdEBJ@&Hdm;UT=&Y}l|~8){#=#3`i}WuEd^u?>V*I!-#o|i@m7_+xkWtz?? zDmBv-IBYvthIf|f182f1VPl>h)_yX76A@1xCHCLh5RU7|@P49P8g3j>lLwl*a4!5O zmbcg;=eoT&h+K(aF#hpgNB0g6;zAsBW6@uA;LKYolV=#b#5XnOba%jy&&SFszUSd# z<~xSS3lWigeC$ws&%w{kmx0966q%Ic<m(oVNK0SB`RY z>~GC{KJd+eKl%8st@w&8e5FI^$9-ANd`nDxe5O@={O%Qh@p7vNUk|R8qa0m^g|ETH z$47d_$GKx>zI+4>X1^aoj&TZc&^=+|<8zPV$M&F{lH+rdS*{dvr|2P_l3R{z;zH@a5&E@)ob`{7 z+zcasM5a3vm~J*2eyNF%kjH1`nKq+~q7s)HQ2bYNlaYogy7r0sVM)rWuz!S{d5nww z5FPcSQ*vveA4KDhd_I|ms;4Y((dDkKU9a|(GDftFQ7i)+|J4}R+*vcF$d$*qK9oOl z@jZx7*;&-ivMw>l0UCa9taDDOF(%AwO|F4X$o*lsPYkhg4Zo4=r*rM*9_Kdf_2PrfPE*kmxBaaSji$?NN1VRgd=}JAZ}7jyWf}aCBA9?V}czW102dp4kP% z^Taq7ws30E#ZT1`z^}Iof{wol^*tlT~Ft7ZSh0Nhz^~cuf?!=M@6XhLeq&*>z|rl4Ygiu zdh2ixhq(?hkKWffu4Ra8TJbMp;hx9|rFNxXD1K+E_x%LL?I1HyywSHi zT(tX9U&sEgrLfDnBrPys?`sQh+Wn~8yF>5V)$t_!XpMg39dE+&`@b`i7WoiVN$0{n z57;WA4?Dk@P*p{h#dwbQa8i*N%fl+ctslzqsZE%w=zPG|o?U>Az5akb@bkYJE6QSA&8W^C140(9 z>&&Y4(%JqncJqKOoaDxiPF#t%wYg5mWnDC@$7E4Ip=7BnZu*OX-@A8 z?r>5|WkJe;qP-Y7&f`CS6*l(4SWU#y+mnvC&ND@b9XOI2PQrd~OAn;CpZ)SOJShdq`0?v^|(!~cfUjjgbd zetxCyJ%B~p#~PAMEmaREMK@u0s-(I3|2{W53vHqui~6ra_A0tYxW_D3`xU(J{a6bp z-I-c}@!Qi_Et%sxZJ4f!;hr{(S6;G~9PP!u8epqxTi7`_!|P6FyAWN$SvDpt)z976 zxEy~tJ(|_DBHwu*#%{-R$A+cYg{BCF?yi)ZGYFG%e9Vv6&83k|u({ats|ckS_&5n$ zfdyOg4Nv=-JbHFwpD%b~-z{XA$r^hxcy^Dm1>VN44vcR5qS!LXFGgh5c7mRO~~>t z4E62u-k`7i;;=AE-aXper$MedrP!}M;B5432RxI4ZZGU)Y*A4p#(0$pdS*xVMs(11 zE$u5hYk$Xf$tJ4C&eTATqw%UMyemFN-Cf{%z>yooIDBK8H_S9dROl-PL^-OtGxa#?h76!hcG?Pu+%eEwDJ#U z*c@$AkqBicoy}SiL_Q)*!y~+1PUf~RsPdaS3=y!cp%8zmmx1A>%xz!b=nXZ@p`w#oJht7pn^MM;1Iy&G%)Oa!KNe zHgCi><%VDOjM=5ru!^$r&qp*r{*MuA@B_tvE5fp}hc-M|R_f!Io*0l@i+S82?`_;cr^_-jvdO-Qk$rXD#9RaW*4=^DN;%u!J{S^#6h-{p;oR zUqpJNwX+sJyCpt<7f_D*$+KKfknuT|%JqEt9;wFkXbUx_$9GGe1aSNvMUBafC6@1c zS;Vr6w1-64N%zO){$`o&kT(ouxeEvR)7~Ev`vS%zQs3F>Uz^i3@;#C2=9} zze_A^Ob#5h@koiu&vl0A?*qPF;>E!H#)STqsgZaIuo`>32bfNc@39PY8WWCXppO$! z#MiGiFn;2Qk0tWw1db *&9(_+~qj4|T(4mxtGaYA0Jx+l{0(MP5$>lMpP)o0pH zjSVi4nDK6wnB4D3%y=A&p*-V>b$o!S8=dYq&LUk||3!Ys8~&72YvbN1aXc+#nzFPb zWhnbI6Mjiz>LBxzthAJz(Z#lJut?N+hPfVTq~l%Mvr*1&OJzSR)J(eZXl*kNnh^^D>BYfknFp zo(gu< zfI+^55kD2Wu?$0nm?0TW$;M@{EDuJs;sY%rP_2QK5W{$6G!{Ne z3>ad0qImW&FRQj{!06zBU`5LOVTh+xjob}2aK$VbOIVa*eD5-YSBZjZ9imz;n=q8| z$~RnzkV`|vtrjmZF_5P+63^ikmiURwnU~&)d&*@SwCM?>c>~kH0G{%UtCO$a5M3r znD=Ws(H9v|{8v$4fRI)0{z2r9L5Oh*Wmp0F;SONl-uPI{Fm#35cP)H-;K%26Gw?w-)vl$Dl#d@ z%RLspRudoZ$BOSPuvtHj-!e=&h0nl)xKIY10w3))0S9mGitneuX1+(kCm&G|($D>j z#D(;P`<;mori}Bg2br1g3Gne=r<~HS0zzi}E|~HQ80TAJ;p+n*-+z@;e4Mvp=F32# zl|YF3_26I_^IwC5(N#S?hXCG}l~a6G@G$eO245EZ$Y&liT!w2i-}{Jk3VzBdzB}Pz z=6l$rpLxu1BJyYEJBG^XQ)H5Zmww2Z`Cc~h@o|=6%rE9*C-A)izQ4d6bwmi>}{uy|vE0vfhC08NytAcj$;m_n0 zHP=8jk7=@>q@(@llw2D0gJ|55uUn>pVQ!HR6r~!|tpBuQnltCjmV=sC9@E^h)JWdw zqjRx#uAv>rTf|rszb10LGyKx=DO}B6lNOpRPyS~@liGA zsr=@=u6^6)$M5soJlB^sRc%B0sPy^8_VCnxoY0o1+TgSG>~nZdN1gPuh{ zZtp4V?O9kbyhzi|VaMR@On(<1t&>3*4K|{YL7!sH?FyBb?H~08q$GmIU2Mj#n*Oww z+!=?vpUv@Zw!23%jK9dY2h$##>)r0^%Yl#h&Syn(GzYtIVz{u~pVrhA3Z}J8#*nI? z-+;MO4kXW;8>vu=h)wDrNcG+uAAAK%Q+6~MSn~nLWWa+>@0;d@D;mDo&4E|wU&0-a z?a;sX#MnuBYA|&M25j8LZswrz<=8xIGvP zq-k>C{9j)1^q#;L@GXZBL&>IFYW5#c}LoeuvBF&^ulwENkS zOzUy%@0mu%`!asQ>mPDtc1x%&jFH*4uV7@hZ4XCgXCpO(`}75FR9cZH@`ADuS;1K5 z^M8?W*WML zD)PcxcKrL2Xj=KCF`?F92~qbrv#^aLy-Tn`dG1Z2)^moyG}JfA=51#gh#Gc06ceMu z`6E?&CzH<cNlme9F(6D1#QsXl0U5$z`7GFem<%zLW=Ko*%PN0s3ckLc) zb1sT?yxO(52sXzc+>uwpZP8bDkG2&rjP<=9ei8!5i(=kKwXU9ycPY^M%TU{ncvka_ zM3?;nDNaj@=J9jYIkConki7u<3~DWUjI&AaI4`mBs6GRYn|;bS_f>J3OIMk~E%PW; zU(oO$=pRgDd18JAWHFAnQ}huPY2I0B-fw7&j4?ZG<*w4;mvN4G8c!PSnbp{P~=z*$S&Ak?m^GXrJ@x_{8gT+wrS3)q7{27K3h~o*5C0P8~|_+Js>s zJF@8%BR<$L{x%yT?;iD#_`jxIRc*H`+O~T%daum!l|9GZ+B?q5p1#++Ug^kNzV~d> zrK{waU|in2g>8QKsOhGN+uD}zEym9qp4AJx*UhRdy6q>nVvK}(0+m|0ZJNvb;d>a= z!Kh!{ZolsDf0f_=x3fMlI_{@KIrQN>Z9(*zU&{2yViz{|urED|QN(jjd~{kk7lURo z?X2Swr+EO69uM_|>v{o{Tr>g2fyb^caENNq5!v%L5DjUq({hR$w4Q1P!Y-ou$I+ux%(i(A=isbJ9Sc19)l*K5`Fy5fo1cQnXZBt}tB#%}ERKGjxSqct>j&(AGhuZ6PjbK?us#jj(! z!w8MKLt5Ep@@Of)Mr%b69!v|r+Zm3$i}@-|&$ss!92Q;q8Fs3H`4^#9tv{{uUCbo{ znM_wPHKij*jZ0KL5;z_1JWr+FTkpV)ZWp@dyu28{ zy+^%`=!bjK4mrde3-5OA^;qnWMd%_g6rrPWp0uA$I%mVa&U(d>46z|{$!t6~1itr4 z*i+>S`?tCH5S6R<_n3)2+5ff<@$`e*?Vg?X1-7DC>~&4srX%l_jwP4|(x;;??Lwol zqndkAHrV`m%aOb#ff=2%&;eYS{pE#$n=X03ulESU#l=9duM^V&k|7k7X{x^N6iEH_(R3jt3y@eazn6R@t%~<+uqmh>F1-(ZeHeiw^I|?($%E zA7&hGhevtIu&(Sw$tO9J(7R4sena3(m-@>K&k{RroSw1PZ7ag--pIaUZ-E}(ekebp3}5DR<##;)Z8u&ZyuY;_?r}Zw^q!trth+C*yRWDr?CB2s zLjQneIeJsHGoDu;omcJ1oOGx22jQm1Y;B^$);LdF@<>{r=R}6>I3}yTsT~P5yYw#4 zGo!h4d}j1;ivEbxdq?u|cVpg{lcv6X5YKN@HTPBSu{%CK>pqySpS|j>4E^L)?$1?B zzxmY5Y3_0O7uaF%e4*E^4SV}T&j(|j|M2mlt3Fuprw-4-u{*0BSTR9ZLOeUWUAtR! zcgDF~&$x@#4yRq4mQwBLwP{NpO$)r>nCQI0UA24CLU*KLTX#i9dUKC!&(nLJIJjqZ zxcg$C2Q)BdsK?dtgFP2dc-(TP8Z1$c#YB2sV{N2;vD~Q$&BoXqVzS7@0AifQNX#6_gE%ST}y8>o%^F;{GaJo=?SMb`i#35BO^b z9Oezr*=4Ivy8V@TuZR41hk|%5U4|Q7yMM_{|5CgH+IM_%f67_c;ns#DPab|rd+oUw zG9$yje0Kl0|Kx3SBK%zxSSUDhUe60fRZn`yjC7ZTf}B~@9=sNrXb)b8J^^>@a9S`H z3-sA*dpDv#b*ZwUxz0L@4B?D6@lHCLjJLl zcZ+Y*+VFE*sqP-dJMT=lYwUm31~YLV4vxFi9(F7Vr%lYwm{@sr`Bq=a>@d7D1NDDz z9Ie#`$6><8AxA&$YpEr(15bVOf1CRj_^7IT-MuGI!k`f15Fo%z2#_FPKng))o$!nT zN)RJZEKFV|$TI|a95_uz8YZbd7orUT>1{}98#uLB&{Lx=rzE8@^>L0;Z{^r}s`ka{ zX|33vO06{a`_^M-&CY~iPw(yh|1#O%TI;{Q^-d>Fz-rliPe_4vn%m4r=m^ zMz2)u8|z7q_pDE@JQa!qWkuzP(C{YTxI-=1w~s%Q1iPf6o+DP?&Bb4qrsZ|kkFeah z1de&2#ddqZ!I7|ar+dWdz*|o|Fz$2hjSD4_a_7j%CvIjS|c&udqf!c#u?FZd$3zKWPRD0NanDxP1 zn1*9e#e0WJfdq}AZ=3JlK-jGNoF zY`Je(rf=x!Kw8D+_BKxL0%78-8~`qG+wseCRDjCIFlzrEZy#*=#ej6eoj z2yX@P2<>UKGBeAIyZ($3w{Fk6hldtpA)M;3=4Avk@AKsSSzl~C9TqMz@}g2v_);)) zF!Br~V{ zw&dcr-(s1dCSO{`$fT7A=lX^xUT>X75hb`oPb417v!6(S>CvTm9~yB&5RLfZp&|yF zdvSI)-q)-Tq1N5$I3H?1H?;CpamWhA^S;>IfO_yWo_-?n*`g5J2`+j(jo|Md^u(ah ztDg2$cS_!?O@R?OjYFlL3s&2AXP!yYm1oTue_L_spX+Z&!OIK2=VGJ|CT6?3@3z{; z--2>SyB>VR8tKO=W*t7(k$B+oq3*%Y98N~{ps_Xu#x{+=73Jx<11%|{=INsr^s)Yy zrUZSgy!%r+?&+DQ>yC|z6<7SB`-#NDqBHR#ODCqcjlcEu`26$ZZwZdiYZ^bNzdCt2 z{t92a;h}l@{*fsw4+ec>Q4(mCDEs2wNytQ-Z=ATU6~B;#j5qm4w4s3Ky}Qu1Bo4*5 ziXv6#(`jE??dP66oSuVRX0-W6azY8S>1G7C%cCh=Sj^uC|CcK=4``+SF zxEG(@5?9;cZHO!BzC3tGMbf|EvKNYTr+h6v^%y2f#PM9&f5ZjcQ}F#bUZvclVTh4* zJ&X&?O#CqyOG5|wU-~@{uYG*`ShaOm;BcSI9|~H(144C}?|=T%cw+27-sa-mjy3jQ zUI68PJ~I?}Tquv1)VOTiXQJ0Ez&4`deXyFJP+1U~-uPAV=A~_78E!G#CXPZ+)iyCx z{J$SJkZlt=dcAGpz2g63{BNIy=?kGmPo>o{QM_EsoLDZNNqO6d*%qGoC&auLSF!6u z-YsBm5AIcPYN;n)wMboN=6zB35=W>Pz&r&je~8GVXr!Li80!Dyg@dscR*QXPXF!x{ z67G)^t>Q)-C7kqf0`Ut_*pZ%qDnk9bQ;hQFJ9%-R97=M#W~b)_Ihi5Y+FJX+y^GJW zmheIbhI7WvD0eY(mV}87X&91^_eij#adMQEc&D%4<8$5s^Cn7M-0#~0*5dZetP72g z8t?zbd!bMgW@apW)LQjwRVOFuoO9pCd`ojM?*Ib|-wS5tH)Y+1nLVGK6Kj03UMe3cKR2G z8jj&U=hU+YL#NQ4@(w95wBb_2+g+VY@`s>};G&FKGABoelA3(OkL0;4Xi?9xHxuc7 z%P73H2_+#S-uSbOx;pb6Wr&FjBf#ZeDsqB2A7a(Ppl^6%@$4I13ybkI??2s{he#-N zykbG`yfWcp(uGT1o&NUDGx1kg8OZ%yD|D&2=eMhp5^uGdvWi1*6p)wY;}9daR}9s$$dugMz?-qSjDbS591r&yhIfZ-1(*`yYB?Lgh~rQ^E{e6BEL?F3}anJbCyk`>jw?$H8YhZmK`j>)xo^ zLywQ7DK;i}6gT~Q_a8_aaxLuW4Q8z=zVMNc?{J?Nfo-s|Uw9Uex)O@_;7K~Y zA)YaEbPQguitqdr{bUwG39N$_>A=?#{opFkJ#7!B2wCE}naQGcB3W&ZT@~MuCeCA< zZ4~omj3UtIFL>NZyU3D1B)~ou-2m>?+28!A+a>#((CqZYWB6Q(s{-`Sx7KQ{H$;DN z0-&xq{N@79!1;EN~~o+qxzp_)Rma4($(qBAA-z^bI%ni zkvcSQPqO>4U76HakMh9!n&<=yFo9{SyBrnKFdfsDd<4Vh1agXI&vN0>8)W3Uu$7n6 z)u^DBx+9g+Gf})(Do*)uYQoB-yt;~cL)xdGN$By31sG8eWGV<{;X6cVW^sFhdsGJ7 z0&;y~CY~UE6~8L$e%Gq_IjAIXqKfhY*+ma@c!c>#Gm$CY@_QZnKno{4@wEpR%Y)%F zvkPW>WThgrYW+x~WutBbCBP_^x2vi3CwLIg zc>HD83m4uQV!iN#^Fyp(jv4mKySWwrl6v6Hq32)zPV1XPU%xeR^h?h__9O8sN!Zgd zV$b{Ey!GACButQ-^7ZEr{|qlSru^ph!$0;MxiUKBcE9lGJAZ=QYbtUINv^(W_Bd*8=fnPlsOvBTf$&8_&?qi5e8`p&<6=aqMd zW_;bQ&nBQ?c+s?p86wG;{2ou zQ>W)`Zu^EZFScs*RtC0gDc_WX zktny{e!GZ;d{`?g%gxDF-iNRdVi^`@g!(qGEbFp9N(?J0FK1eEx>hz?5Yh~AwpmUe zbu4y>Wg@+IaVlB%yt{I|Wt(9~6$-ILsTfOn;mka*i4&p;2ku zgH4~%3O4dc3Nb2BRhg)76w3BZ zfzs0QEn??4wztY@v1{#8ZweB>~Jm z++O`q`4mA|vw5>uZ1boXRl#4)q)0xlLHX+TUjxB4*v*AnZFS+$W76W4TRh?c4^?ij zI{MYIRvrKE6Uc<_9Ww!wNXB^K`Wwv5#Jr6mI>UVXektmiHx3u#_Y!3|7CEntsWH}3YV@2iXU?ZUm%Nc*XwNml7L&dfpjzk8EvnDy*lO679 z4)+Xe2nPj2cH!p|JH`vA_!no*ia3Dc`h?H1j&X1$qy+WkvRLX7iNh{lpHuaB2Hq}= zeEp*eUL)K!)?|#Er96e7%i1Hb{ukGWuRsThW1N_281ae|v!qNnTSY|TqIP&>epW;R zf#Spr#fVp2)DBGyUmXb)`fIEu>cqCu&Rkf*Xpm~p-$1wvyGyK4ZmwD6!fKBfRfq6d z;V#4fh{W}2pX(xlKyhNHkBC=X)W}+fv(-f;POL6zy4Ob>Kyl&SFQj*z7{wh?i4!X_ zneOU{11Qd_akw9HxH-}}B5`7cSJUmR?_eYlD6UWYW~oIa&Z-aZ)x)vWoJ)L0l{dB6 z$3CGuVCDWi?)9}WoO`=yq1&takIw<8Vuhxmj`(`+BI8g$-@#YpaGx@|80xcKXrcQf zePIBmd#5A*EaM@B;kT>vP3Cuq^|p#H-B@qf!FSYQ{}&wL^Bnx2Q5PuAS>}4gZ4P_V zRsRE1guQVN_jHH*i;n#7bf&NR2hF$Jp?_XqFjacLRsF5je@^uu6TzE`5%mF1!cfBU zde33cCZ%7FuvF||=vVr4gge`MUb&YG_Y~`xYEQYsooj7%*#BRS@)@V{^L0^vGp$*w z{AtTD?C{x)BjqOiQmtF9RgV0>>&UOmQ64>x^jaMC_ln9N(_oqvutN*o399_21E*T^ ztOugpi?}M45Dv3XwH8||9Q>R^sfB!Hj_}Vo+&^~Mo2&9C+v{>`t|Nc{+rj@uNBJ~6 z%I9f^d!>W#A06qx=4d~^a->(N+_JttWBo+czjW7HS&Cn}>qJrLIrA)f&eNu_nb->j z6!RzSMG`ZfT_`c<@7Q-poI!l2#9rdX5@!=Hk$4L6Qi(aoz`jdj&J(fkmN=g{M`Azm zGKuFC-zYJYx7h$7yaL)q0?IXt+3+E2@U!m`5WOn$rP@8u6Jk1PE-|Z|JvlM+_gRJ0 za11HT{E7Mej0pKMe$;0=-%*%BuPV&4c~9YF9L3ykD3FKqi5Zvt_bE&rF{c;)Uf?=I z=b*yb@c){^EX(gIoD2K|g|mQvt1!#hi~3|*EaQ0!=L4@-nD$gFOnXi$><4~b;rYOq z4V-{JiJXi(O5sA_sS2~YS18Qt<9dD6UjfW{Z^SEsDZ1^!J3QCj^k?%=Q*9p6EW3cA z@->&u1sNc$Kl?rbMg38SwlP1pO2|vhLWX4FXRi`awhh&1j)NEHv3qf3^V0L%S&qbv zK38Fu|6+xiKJ%&d^_=#h@Z%j9{b@@;VK0t{6lOd5qQbQKs|wS`9~$^43bPGRm`7$` zl*y-rmn;YPZ-J9(+iRr1CQ7kG+mawlg~*aXt==I|p(73ReQpS9l|Ep~9S}w?yG>z{?cg2fTu~1pgq+ z5;-4-|2pDQ{DYL?NB^hbUr9_42+M;0FT%fum<0pbi68xc3jaOCykJ0T@uUBr;lEGe zSvZP51Qi_*jOr9~?~`#P9p~Xwrr}3SC%ZXfhLyMcAE7|}s%baCIe{xfzYZNOpM=1NXcZYYOOq8zks7O*HcRaWGp&G>FB-e{z$*9z1jCI_em4%+~K z@{Lpe)Sag=`FN|rxb){GoS1QWTBdO#EQGfO#N?T&Fw+t?7Xd(o%_N5KvXRD0gK#+$ zV(N}jn7Ww?GhK?lmk@d3gjpr_1_=bedJRGyU8l6w-Y9iM`KbFP(XP}zlITNJfp3Ot z8Zhk<_Xfb^=Gyx7Cm-iR6O(VJ!f?udKJl8ZI%BZqAq|L zE_AjEZ&`+)lvw0(lf)vAs+>h03vk^?lx@hamO5S>?0kuHiTx7i5pR>2!FG+re&X#C z&nJFJ;zHsb60aeCP~zKhNW&UHwB;U!X**9R`m+qTC`=oVD~y9ITj(%PqW=VDd47*& z2#lhz{#9Ww@J|)a0{)$$!+l?=pAG*(3QqyPPGRO7-_C{3OyIW_W*PiiVU_`2vkDzQ zaIV5EgGz;226rNJOlukNDuq`7*DAacn9tzUq5fDjGGdn5WYi7uI^bLb&r)~^{JFm@ zb%-f;raX$aF<#<6{#k~YpNpI?M+b<$JVpDnQuhcsY@ z7bwhdijFJ#|H;yi^_m7ueTp5FN5NkxG2`10ODyucPhz$?dxpeF(z5xY4U&tW{aFF! z{Z+lhOv~m!2-}c7OF+v{ykBA_X@?|cz1nPq5K&fBBtDEo8Zd2qSz+4fVmpUFZM<7y z+PGR_CLL6m+>a{k1r~h~;${JVMfo!yrxa%Xo>v%Z);k6k=NCMgr(WgHe2Be`;Lj{% z^V|XU1K*|aeBfe*-N0oEGp|(&vptA)#}F5PLiqg1JTd>oOrQBD_9Gs-h-r(cFXc}z zt-~}l7WD`n=9Qw`iQrfDF8KM-03m1E%>s(I-o(^p{)wr}M-+{DX(6UvH44*~-3pVB zqSF=kFrScqJfz_t`6*gQ*wY~W$eT7>;%tSfzf)oAe%0^?jOLk7A60He5{vR#D6zN} z&yiT1r@-WAb58>%|2&0h%jXqlzFHL~-}?$P?gt9996nN*^+3_rBkI`!;bq0)kanxY z!xUyX#oj891vsSLCNcl(`vK91@ZtjzoKWOFl4vKurEF^mg{X1>mC!{}5O&6cuYFshY_8RBJbFF5SFk*VR{2ilNWds>0D?ry;+9 z55%mr!izvXsBFVPi!Iwr@Zr;321+c}w557;Mb(D#wWXEir4O!+Xy|2^`ccv;h()Nl z;F8!IsQ*ROrm01ibUZ;@T8*+$>2uZF@PbiW9$YJPVyveoiY2_h6r(am^nzgh1e^OO zalthmIm#HlvRfZdHArPG2C0ZligdMBcoD9sMcf9=ZCQCmVEYDbe(V|_cyTu_9fuX- zv@PK!iHBVNZ85oJi_1o5R7|>ch{wG#`V`%Bja@Qr%WFjNKoK%t222ku{GYwMZ`e{E*$eC1*U~fk9!Ejw42y)si5aNgR=$>t?)6Xu?eiQPRZeGJ9rD8)btcFZ2&wCguU`X zz>I$5#jeJIS0}BBUW7DiMbhvBs5;ANwowYA;|h0LQ9=DKbGnfmFNW8;4LADjRoY*d zK#ZVBQ(_|sY_F;0R;9Z{$@d?>AH8TYeX6qc^iLI2D|XRWZNsX;V*IqDk?X<~`Qzzq zXzH+13?JTHYAhfKj?K7n3{2A+;n@1IWZU+tnsTfa8!6kqs`^H0t>_1MCYI_Ly3{{b zq(~7O-ICE~;Ettl3SrCp_83|pm#A3l-cDP>6>+D{_=K5DK^MN;SzEQ`p_!43Tg*UJ zlA7)2aM^Vl9YzI> z`Q3`xj~^v1SH9b51g1RBs2j6AzwZIVa4Z=_J%|d;c_EjQ4bC6Tx z>Chwg(-U$4?{sMo`S`t2t@I7tt@!gu{dk8P~Oulvmps2$_J<3+-5&P+YoCP1- z0?ThWewuHEgOB;=SU)YA?`{Vl-<`58kdNOFG~X#SM$^9c;0|drrAO!2;mQ_W2CHaz}l%gOBf#wdnk=bJRyVI<|Z$vHZs4r|rAV z!FLvX<(f?C(V6GqTLHdx@F(8{{50Qe#5c2{AUF3k5!N4v@bAIIQo(RqKz(XML2w+>1yznS=H z`{L25oA$k;u1`=AqWOO1xE{R*_b#o3qt^SmitkrpZyDu+Q!kwE=Yh?1m%)x?6^94S z7gE?yPsp#qr`r`^m~TC>$+r@GH!*?|%~uXLv0wY+!;mMxoO~ZZ zk8%7ez>CgGxBCM4X}*^nd@H~=UB%%++xNVKZ;HV;&*1xXO0<2Ue(YNXJ=4BCgKvSs zcawwfk$&u(?BJVk@No!&&hK7Vw0&p$v2Q2zO#7A@e0LapYaD#%z?X_}ExP>fbMUP( z_!dK1+cyH0WY+Hm@Ufk0(R``UGwrJcpYAu7LRs_u!O`!&2foi~GNni7B}c#eq``N$ z(qsFXgp<{@Z_fys7C9)|K9@tU7J4J4N|fFe+?<>FxNMXQuMavO9QS9YdlY=MM~hCk z5qc(HJWfV^p7Z`h^KEzVwS$l4rbY8@aqwk;FAGYI_!Z-)`OZ4(?K1dK1Yyy9-*VKO zAAHOQ`Bvhm`Pv1YZ`k$X9}&=6lw`mk++rhS{VZoliUX z9s!@eFD^6q7UTMD+IJ3ovD(W*=$ZDt1wP$gc;Bn-%XaX+1U_6s!a_aDcn9CF!N+o8 zek<|QeAs3(%D&``*yr1y9PKaOAK_bX@cqcqp3}hh4TNja_WjVom*J1x|80P>wr?Il zRQZ9=tI3oeou7mrj=MmhL?20qSt)IvSV4FJS`Iv{)ea!duwZwr15 zLl(r`4%5DiV`A6uf2ufs94Qz5k@BmCTl4)3u*vrx_}0Kr3-u`9$IrCSDv0pas4&_W z#65_~w`8o0hae%EZ!h#rzI5<0KJ)t!ehj0#+`+dDd}rXVMf0t5@MRf%JE5%ke7KJ_ z?Hf8SwtX4UGwsVY_;wq7$qv3W@I9rCQ+jm9Ir#DozCB8h`JJZv1000(fN!Y6Jm~!T zkqPEQ>s{za?{#&)X}yd6=w+z;HLZ8KAHAD#pUHIj3_(fuqF+PVYhf6F%hYvH^G%s3 z?_;%|&c|ZMb+E8NwsE$Dhw%&7n@U&ny#_uMX;_#hp0ST~q^Ux;YxAJ_Ne z{yB8k8f)yCI+pUsx`w!A44p&V_BAXN`~OGMe2;`xJE1&)h?A%(_=x{Iw)prxqsj?nVjePgA^ zS)}o7S64R4#d3TbQ;NT7hniZ7xRp$>tE*6ks3P!mTRLxh6T7EkAwTAwo9!^?h+F@= zP@toz@kNpR1^XhGw4?V&BBciI9N&`JShc)s1EQYqq}f=ap3A>sO|WxetM|s&d$29T zzQ(R#YpC&ju=SC~cd$}6)26QHjj$&3H`wax+Ntbh;b60%??voPz^bF6q6gAbj3UvC zc%gxyy@>$UDfenYe7QoF(cW}BGWTE6erQjy!E-v<^Ki0fMY7s`rMM-rTH4E&6zoiE z!0KYB#2yOn>xxiUNpHqsN0tO@Z%UxI_klyBluBD?GPQ8oxh||wJi_jo-r-Yc#c#O( z)Lv{-!LkE<;LtGV`LZ{~$RF+0Yv^m6uYR;+2G2T%H2^P`cgi*Nx!zuU1J@+<4WV2;%Ve)3YSW~q5$S7?7&|RtbBFSbQVlijLZ2na`_k}2tLC7=xb+pMN81^aa zWOFO`@EHHj1mF1ynO)!8fcS@pMfULcY8vYLAZVj5I%=(%f_XjyzZWZC2w~Pi(Dy=Ipa|!3m?}#vCK#4$6Hv z?nsmybF3QV*=e_LMR~}4j&fsLA?(93&1&s9`{ekuSY8idIy<+dh|und+?ArCF0>V! zZfx!P-paPljMJT7&&PLD^yg`2#Swfk`XUN zM|{D>h}?%FoaThIaGFdp+bx$G=fD?zK@ygegy(Z3t4?)XdiK>&XXE3CFS!q6 zUAu*AtYhFgD)Ui%i$~Jrk3k=Z7)P{wh;rZ1@^kfwas3))G(63=GS} zlJqoSMg9=RdtvBOEV_OJEZ7Bacg2~co;qnm%Jn6IRIUM!<;90%rNm1j+I*xhPNR+S zSXEpsUF+(ejvkqm?xhF<>2BNwbR<0vff&!tyaV~ZMZ(}SaMCLBtiGO;J4qVQIvCk*NF zbthX@mk_TbP@J9AokB}c@5simg)ZTsy*)hlps_w4o>I9ZzUorw(#H5_I$R5%>3ybU zEJ8NMV+GFQQLc_lI|~Y@&we}wmHd>e{$TH-;auOBD@Ui)W6|vL?9jM&T7&rb5 zf63wgox}ZEWuLTvi1keeALnUmA>R)j>2Fr{A4XWJHOw00$Pb_WwJ`oqwF5`G$2<7$ zbfh=RVXt_2Q5=ll058|fX%#MF{zh8Abm;GMxW_Af9?18BBRthn zzY`tyaGtsr#^;=LEp*pA^p88-|L$-vb)-)&J5e&yl&CdMm;i+D=4=jJfY3{?2arb0 z0SFMjN3-bx$->X(Kmy1V{A|2;r{v;iv!OuvTxa9CpOS~4O#(E7zG__o zWxE${u9HFMG=*v7?F!SzRSMIjGKHDM28Hp8%i=pG^6;Go+aED?jwwu?Z!4UI2!L*(T=T0{h|r zBc(GR_@WW_Lj$|eUdZEx4n@~Bn}uHQ3c;4m%tAz6qpPQ|Tx{Sh97Vm4p|7fI_%8%z zH0o@^(Mzn_664r-4@MDbkr+b#G+?HAqrwcDrZCgQ@DZWIGz%1FJ>vdM__GXGC``Tw z753uD_g>^@`kz(Uiz9`0K87RHw!QcV(Rn-pEb{0R-g3Sg^v}S_^z2OOFY-HHVlVxf z5QGPNf`DQy0n>UFPPPN$pW(=MU{Az92J`Ws(9to~ybCp>N&AN9-&}n*l9>&*gMnuw^%Dc@ zR+mp(bl1I8F}b4j!RUD-Vqp7*2l{&A8H<&TvCSJE+PF4QR#pw4m}+6qaK35+4_Mna zZNY@an#jbWK9h+09XhVFF;G#9x(lbS=SPV4%dzHBlXHYGGyAcp`h;WZ!T5T*YdB@0 zA?AYgt1|Ee9Njp=$wlUsLhZddR z0Q5}z9s%DvC^5f)VZQkeKCZdUXE!aH?{)_t#~$v368VPVM?L2MPcY83Zy(|KBh8E2PN8vVFqD7mxFH|`1o#7i{`tc;`miSHX6xMVDkC!)Aq6aY2OU| zD0`DFYc@TU5b{^4j^e%>_-S+kWjJcldS8PrMszEk4~T~7u%AQE91FmHoI?93TJLGt zXJk+Caa|nZz>~0nBI_+1 z^=ezS_{PJ1xMfKH|7RVua;EQj-}7iv0GnuEUx$CY+@nsncJKN6n{hjb?0D9-a3gv+ zzxAtQPkwsno=I0uKFBn@pqvMd(I?D zrl*rkYNR!h9$l@+!+Z&M)+hdFZ^{2^?jC^;I!Nc`1YrhrE8^ji@7Ag(U90O)UJea= z@8a20I8F1#7wY!uNN8h9=-`fy^pgK|q(0u-@yQY0Pxfw1>9+C3r{1yxa=&OA#J!$2 zCf8r-t+eqy=iV{sJ^uzDC(!IB@kCG(>-&TbnDeoC-teb|_&eHxBi+AuxN{ut z;|}*=!yd*Ds_>t~pWheIy;!#Dq}V^&>fEBPes{-r2X+$vLD-kuj0EAk02}8%#fzWK z8xcqrezxjo#QP|87)*lwgMOdfs4%I%q%hN@{nTNa-%uC_`Q8=&O#hRxojSC)Rbkrl zHHE#vFDcA)#XC~y(=KZoZ>_CqrPwv8d{bme9PyYTIxO)SZG0m6D?KWRcY&(8uqLcEsGQ}fCoLNC$e+H)k^Q{Zl5L5uUHCcmvLkAu z&CywdAKQT+KgtFeu?|Px=h7aAu`MmZ&*WPJH_sC-)T1oI&*XavBnRL}KAt|BZyw?@ zy1tfk&0x&|ZxP0Do?1NS;zwBky)p^Ke}?h*Lv<9M_;&(&rcj6S3;fJ$Im?+s`zTuP zRsfUY>u{V^;f%r`&&ivn&oQpvUhja{@)kuRrY6h7Y}_a*&)$>P)6-<@1L zd7el<5+|c@5j436>m4PF+n}k&4RQxZne&KlK=3DWESdY~_Z^x11h+T7??`4_SFZbm z06tS-ND6$~y8IXcNVKLsIQOpL+)uibB7?nPXIs}Ykq}IcKTh zV{xoxVwJCIdP%|1U}y5=xgn44!R{rD$#^33{7!T&GOKQAXK!zH zr~8HbR{7kCMjf}O7qa<7Iaw6^@y*ZRn5+col?c6=OtF;#Tk;3^*Z*MK{ zu^}8ktIKJY*y}erSm4HHun2m1s7LMAJ)%%?& zc1WEV7wxv^m5pPdb0u6MOr)RoHmeTJC_VUw-B5&axW_ES6D1wM(&IO$RQYnafh%sA z@o)O)lYG6sUyNHisAcBmg zBuKY=!&@#k!QJ(%Lnn8BK7RINr)9v)Ng;WU+U!B$Gitt@s=MvoxShRN6dID1d+r4LPHV}jhCRF@-s(@C^@(1YwrkTK@DVJkDXKKn#bPn!+` z6SLKvGRd8MqM#wL|4>RpC*BC62D)1;_sGMYqQG~GzL9HZK|7(>LPJM&7x9v`hyL z!aW6)ECx`{Pv2eBIyZx=?ZhwhUk59>QVib?@|8?;q#+ASqVJit0#4zx9N? zW`}T&3A)`+iBz9W7M0tB1J1$=$?yA8mj{NevIRM^qG>f}b6SE*cT4+O!Ehp3-45)o z(K(IEzf1du^WVJQ+P&{&Av&w2Dd?=0CQgkX^Im}%H|gj^aIM(u3dURcIfpv3Z#?II z6K3FQ$m=Z%(UXYwN2j=2PfcllCq83O;&s@n{rX_Moj>SMOHwf2m4CmwLIpSv88IMHRn~zxQgD11)HqViJ7t=iSr_{$b?eaDTHo=7V?O-Rm*arK~hrK;# zkKvQI7^D8C>o;-YQb?|Q#|+0tnb+et!CF^eXxCq!YunaU_JU54fgIIojQbQ3Qou4E zKfJL28@!S@XT0ybmiG~6`NfGR_J~iMc(ZM~%`X9bmKtchEqpuT%p-slLw$vVjg zG|0c<=d#p*2;sx{H!CC$aecyPJHl^uxNmp3=Q-SqtOe?xknby8QM00%{$hvzQiuC) zhx?wWcf)+P;&?0y-|_Q(%pt=_xPgYN&S>T?osD!%+=tM@fjOT`nOTj@); zTdYHlAWOQ3Sm)`0NcVNtQ^o@z`M;p@%l9c9fBB~<_YGE+;wK07*AXb8`_V+{n2ZC* zL*g6`3&TI5@;45c<59V0wibr-nO+Osw<*V598)b{)C4+)Z&dG`@OmEM6Rdx9@alwh56KX|E>Fd%ppbCMf3(k~%8x#D zKWm(ibbms%Z@%wJwdPpo9QG_!`g|9Wiqg1Cr3a_rdt2qdTZ9)_KT`G<2=@Z(U57r` z5Yxi+zu>6<&pPy9afGjPlwY@_ydHIw*R2lsYl@$9hf}eKE7$bWLVG4D`#7d5Rqf%b z$9yuY`u!o}=rM|po@oB6pJwAu_^CT8F&yiTz z%!UOKHqVq;*sLxsw3&Ii3r8=p%1f5=Uyh?Fb5=e?ywe6|`t0-4fSEp%Bxd@B3N!tH z!c4zfVWyAgaiP!jI~4Zfcurxa|DwWP94WdSm|hymAtLYj5{vvIFSJeMSLKB^rLl2A zc-dhAr#%WYPvX3TKBN3p`7=-arbHg* zX@bID;CmHj+${<-?lFZ~wx<Vh&1M_`8 zb(rsOD9n6cj|Azjsykesv_sby^RN3co)UTwG_S(cU2OQTG5j|xOb&|P(^c@JadDc1 z;0I5+gK#V0?(MXjV8ty_gj zZW!YxRAVov8?7%_lV6L^bJv`2Gm7{isPk`pBg1GT1FclFgf9Pps>mnXm2`=g(+wvl?f`rz|uJtHBt>4x?(+6&vH z`IUWulEiY?;uHFShLShjjIX(JBQc^(jV9AU82-#TyLwL#?QK+tW2+CX!R$wh3Keus z_EAqW7-?K>xP2rMQOxDlRaf2lBeuF@R6-0Bc+Qt`hZ9_8FnKv_r5?P_V+p4}sKNIG z)G@Z47+{RPG}IirZxo0*DuNfn|JJ4-(M1w9%>G(?+^9&p^kQwR5uOHPoE~D=jOdhN zhYnDtx(gATWkmC7lcHOtXfWGL)|Z#cZLm}m9UvKX(f?Sf^o=t>B04XavcTCRHB}GE zYxgysMP|PGAs8Te^bvh_sfacCAiC+qiZwt&ywb$l;G_QvbH=zz0t3vPh!`I=un7B3 zL^YFXf4zZ4ui?D~@29mC;@RqV@Y8}v3n8lki21IA!siQ9c>hh|yf>$w4r92+zlRdB zpPmpu9(;JOejk3chhcR8z`-Y;W#F$x^Kovs$+yJd<0~i4_XXt5v~L;0^fL%KH6Pb6 zH~ChA504YVz9gkb`!+lHR>F_ZAzC!wdIulJylXzbQquNi!dTP3T7)q@Et(G_J)-nN zP>7}13V)ODKtFmfIrLik(R&1iW%9K`FIM^Oho@P7AtS$h@1yg(+QHY3Fg_b=(fPgC z!Pjc=@!3=Jz3<>VhcI}BMf3f}!PjB%;q^tBuhYTDa*Ac&w;g=17<_zBr0r|O31pVv zMTD^(Y0>t57J9^f6>!nu;?-4dx#o*J<4pU! za3E`8(R>`MOYB!6S?YZk`OG;8AHi+%Wy8UDDOxn&2k1w1559|L7|V(Mj>%UD zN38O@NyYKwNGUYQypABYd0-W%9Kfd^t*weCu4%<;QvKvCg+oLC@rS8hnL_&-TYx zg4(_u2j8#3_Z5U|p&lj6!S@mPR=}TpQ}NS${N4eIaQ!}};=xOZ=HvS_V!!mZmZ|rz z45A6Ulxumzj^pEjPY6>d{e;3^t5Qc z#~pk}4Za0X)_gAlnC)c?_?BogrAKEs^ccra2jndHUc!;~Ey7RpebvFoIcWSot3|_O z0K|S3@Ca@Scx@!#9r!Vf`OU}0*0k?6lso;kXujFdGx@kbLKc+B$JgYV&*$KK3w({5 zOzF{?;o$o^`10XTK90=Ld}DE8Gws`ec8gn+uuzXO5_-gbIv^Lpmy09$?#55^{SoD5 z^6dei`pgI|smJ5*p=a`?kBIOUDLt0c&k&z{Gw`E)6YgRO#eatJ_dWdMkv37>gJaJd zcv|IGYT?@q^h_ZKWh&aAId6c^Q55EvqV;|ZdtA~>{3qWl$QZ+U-DDnFo;S@jX9^5F zZ(!DpToqy9c>}e$wozt^|Jk@++G5;ta>I;<%!bsc*#a1&<|(lkw{5kox00+E+wd=A zuoxNkmRPJ3;d3%EdX~rVSbOloy_h3JpGbmUWaL?Ruo=Q%)Z_HI7VH)3g+oPr6&~#` zOeX&|j`vNyXusGN8N&^-D=Fr1U-EryE)E?=d6-)?q~?xgB~_s)591LJyTv~})5xEL&m@zxW@=WInOH`IAPfwA*@FlvuO zhB0E#l?i9Qd#f0$nuLX5y{m&Ku@yHilg#sZbZA zGK-K)jNbiV*y`n>t?itI0*~F>Py5E5@63biWoc*e-0MSIJF?r8gPk*j0bl4?Ffg{N zvkJpe$6`3D&&Q#tdF~-{2~d#sZFd#*_EsLmGzKnXYPGxE3kCK}9^8@1 zrIp2S?$+AIIyIbIu6$fPHyI`%su;YQV9gDT?eh7~`@EN5MY8tpr`kGq!a9{wb4daW z!LZb}z*tl-*Bsql4Gm&lk25foerGt#7zg@L9O9sm-GkYdIIwhgaD8^S%kuSN1=^_z z3(;|oE>wJ@C0i4!9~A`#-O ziPkpdT{g}Ep)%49XQgx)ZylwMlB3)aPWed~l&x(W442~hB48bpIJRzP(C_+b*z-^NlBK(bf=rKRS9^6AwXpgOU*p~EI!Kn&U zm-jgIr!K|GL!CZ6s(}k0;4lwxm`A{(_5=atxTc8``{_SP;`zkc5*HHZ zNW6r2vc$}b9uG-XV*1TinEAU$VdihY!pz?z3NwEf6sFE4g_&13+95f;z+)9=7S<}v zG&d^Dyo#|;&}Ux7*e77-^-ZP2=ab(k><1R>>_LZlU4gdAvTwP}duC7wd^3*BzfHp+XbR!6pxFvD9{W~~5oJ6v)()8Q`X9K1Wv2Lb3?Gry z{CfSNNqk)W%ZAAG_XP@RiP14?(2GvV__i7T6#tiwLD8Il#Q_ko`kDqnD7~-+4`NU5 zO>4_Ghrf&)`4k@{oy!bdrP!z+E}MZrd8$f{#Lz|w6Qapo(F9t__;9PZ^oR6o z`&{3Dqybv1PNtvF?N|AB?nts9f&r3ueiR=#y+{mQcE;E8tE6UVT|E)!H+7wiaiU?& zOt`mjF6Xfp%Xa=1zr0)43%I{AZsn}U@Gj^-%zGYQHz2&U<1!ci=D=&9DZK7bHsa^h z<2}C?t>@gUdOj3*z0#uf*1;BHzY6d}iPv}DF3_JpUfXVmo|*0v_^I0(AgRYA_a89% zRvLV`MGN!2jq9?>w*g_i-fAHSg*v8Q4cxKx#vp>Jw+DK$@|zAl)4nZ+eZ1vl81ws| zs5FyrAN7aM>x1_yn(sJ_GwnN$ zFy0?)(R^Qm60u(eeBI#Vy_@Dc0ATW+RbeWc&?EjF^h~}EgAbpB!hFjeeCH6R9vMgz z=HvSMCf_-OkN2DmWB&QDVA{v~PvOrn2=yp`a`15iu`CbJu`F@5lKYm)M zM|lZ=*iQ%K_XZ!&6Nb?aerq%Nvfzki-yuhPNyoio7UI)B{cf1?);sue!RLp+7N$!n zcktyKe7qmm_VF9KX&>hwEE5d!pXTG5Jj8w#whnwOYud-R5SnkigYPWdeD>6$`S=WA z^6{J6M^GZ47eCFn0db)k?*En`fbCO@=6e8oCf`i-r+juGUnYK2D54K(J0Q$$zw+zcO{CO_UFzM?WoE?|&%!wEw5UZwmD&+^@v^ e=D_O*h54muz4M3<%CN9se@msoC@@2m=l=n<+}Ftf literal 180050 zcmdp<4R}=5x$pPP>EGfg}*jmq`$$*oKsb z2~Asw3IVAd;uoN_h+l}%0>y|3J;?DWMYPmwduWg6l;iQX9;@d5|7*W%vN9RKdv5P@ z?sMNKE9U~A`m)4e-JrLetsjqHnc!RRq($bJJ zHNM)q(xQ^m+Ms^rjTsY)mXy{P)u9ewMNhr2Vo6ce@`~^|JjiPc~QpLW7w88FaxD4BGn4Eh{A1JCT zUsYPPw6vloboAKrqQ#Xp-P@zI`Uh&lwHT>vg|Eew|vpE(#7={o%*7l!^{a$ba@js6GEI6^%&N0R^5AFUR73og{qXvB|56| zF45Dv`r7iUB}Mhss)s$cZ9SV?T2)tGUDdrwD{9N@OT(41GkVN4TOD*3Qqkht3hcFI z)!pl`wZ^`zW+AoRcE+Ig68j?ysH{-$^>De;7FN>?t3M?lz^`Ya>nrdpR%gQUb0+soeSA^^rGzeMgWT3RZ zXhnJbQthN?3+%#ZVO_niw%)g>B4i(71>IKKp!;xJ2d&ksWl>f2;_8~N1vpr)%R;pb zLs+zUQO|}2%`TDEQ_VeWv9G8clYM!ZUg&YGs;;_BZryUs_;AgUtx$#bhE!cw8*UOQ zZI4+EZJ2R`_EO!|Sv~6vmaw;QxN(%dlt(IGRng+=%F2)lW*dav#$8!G8r+pt2iKTE zJr<7c7L_GE4n5rs^!kdus9Qg~Tb0+AAwdFY?uuFUEGS!Y<(}uL?P+hjc}b zU|h+{OG>Ni%gf3`j@sP|_?Fi%t;X@;0k!yjts>!9$?k4BkH3!HC6D-B?n2Mmx^ikt zE5i+KxP4X%h1+qvvbY~ydX}Rs4K6WpCHG1bSIjQE*+X1?o!QjYwlHT%-8*=t5r?Zw zj5u;Q;x~kT7&AVLg~M@Uw6@qShmTTUeQEmQ^y)>+ZcwV=CJm#ktJO-k`oth9`n=Sq zz;T(Gs>;!0vodX)V)u7%ot5WsIPhW67KeooNIHS|d^-NQEGtv#Qmu4rl#%=2iw!$E zI~$(q?6h_w-h~*#kF{|K*CC`Lj6wK+LB{1+JKFP{*2-mTFsL!s?&yLMojcnHT}0!? zt+5&dC)R(jEyf?e#nGC)ySZ;;py9!&#xuM6-`%@Cup{tzgI%g+6*3ynJl%AI)gIWe z>v3CKu>PwbJlB4tkDdCVyTI*kPjcF+O82v$+vG{GV|bYCZalN2|E}m~-z|R1Yim!s z?;6-=x64kfE}ZS}+tlB(4n}BIM+8UlefP;o=%Q@1g0o*Vw(nb?ygO=TlCAk9x&MdB z*TTwmFnYJc*8R}kG9x)TzM%HY-LB>wTj$Ri6*K7KIG^Q-Ip~_yd*+AV!9 z7~%0dm-cP`XxUPg5f#kX>fQ&pM~?Pc|7uXTs+Zr{_R-9v8~lfw-#*x7`+2nAxuk8? zk)xBkJh#kfKl@CYNSJ}BN5jOw2ko^9qBX%VB zUmszs+mFbAw{JhNt6g;M`vUC^waFcJvLll7VR!VRVez(NceEWp7*(+1s|S(?T^!Mr z-}Kksj%cT)$q}TeAi07R5hS`Ew;gk%dCr5b(U#S}@s@)To`JUioxYvP{r68g8F5f5 zTXSL1ow5{7xwbHlUvOL>rUX~&0KQKxuboDKtBY7my zD`;?H)tEp7>pEeD{?@4>n9e> zP0PcI9PFF3X%7?O7=j+&@`}+qH3p9y$a{n>yz_{6_LH)0QD}l=raf{KWOr6`VV^`Mr1ZUoZoyYoac%{qzruEi@9M9F< zcoy5A%l2=2ypJblLT%%ss^+et*1c)j-x_FW{mss;6Z3|{w$0Ihfcwq%#`b5|uWw%C z&pEbctN;C|gE44L^G02!V1IPsnhspnwXD5?lJ~ozeI)k#+OoV& zkGuRiV;1f9xW@eB?sX53%8Rgw&osqY70(xs?b{S(otWww9M#LR-f=mj^jJ8o#K&Q! zSLHm1WlfIm__%YF3oF>PsZ%FeVVtlu4dHe8`H<6XB3Ue7=ufe zV={(&ZH47Q3%v;NVHNVqkFRJtFU-uJduvh7l(~1znm_N>qFK}D-Fj!vthtjj+&NRG z<3Efc>M)1cKHssdG^Op*>wF!@Oa8Nl9qXmghi3ZG%(7Qv`qeh{tr=)V@WciZgW!}{ zr>X0Ukc=>ZN(gmYbXm5CWf@~rDEk``Q)o|~hd@8g2-J}`8oUL}b}?@<?1xJdMEZ zO8qVboJc7BA;hV|7Z7`dKSj(jVcE|RC@iZ*w|N{CP6Wnl5oo_((qx`X@$8g52o2M1 zyAHr|)O*2k!kILHgsZC`^en@e63!+OdfMoi{(0U>`Fq%phadW9tjBXAcpw7n;`U)a zxd4F@uHM%+b&A@E5sDq zkOw2sCJAHCVW&PB@J-P_2u=~+P6G&S$O(v58w~vcu=0VtqhQ_U*M*(X9|!At{}oJO z8S?dr>C;0)2=(MXh^bEmvk3Kr!1RyE^5UQF<51DlW;hsYr7F9Ch7jt>dY+dV_T}I? z$WKPt52nzbtjFO4FteyX5771g0j&G`N8x1Hd<-6jn0z%1kW^)_0qgx@3RsuD6~NC& zv|m9bgmsbi8sazfWWDcf18e_}f%P_e1&lxC^8i4P=Lsqy^iO8YdfztmWUW7E=*iJy z|3AQbyL<%JWAZ1kZqLVt{u3~Te#ty~vEILeV}+eqe6&v&m^R86n8LC#U?y4CW9X6W zCiJ5v!uoffVFbmcMm3nkIO)~J*14>!yD~v8j5hZ<3fFR{8hw>i|6EvEy^`d<=Ts}L zC=j`3euV%K+6|7CCIT~H!QhS@3Hb;Z)k&PiHE;Z7o zJ-2d~xPra6buP8V%zPeky2NFDqbmV&Swlk7LqpQsTe`$$4Yvxrl4|ajhNQVZYT?{| zR3{KKy*DI%A|!o2B>m@*^j|{K#-$nM|7v4MSzl^MdU8m5Zbn+7jUuRvAG>=F9EU)!9Nz;by?aLiYgy~_D=04RA^XHb3{P`hi zOD=ZVvAW%W`>?n%9&($)zKgEzl~>mmnYYC49CgDoOt~Jn1B&#`*{^-uwz|AT-9Hbx zWQwG^iCI=#UD^FkE^_SVtm?XTv)ETrQN7rzEUjE@+-9omy31B`Z|JQtUtQH`<*44* zbtgQi#0Bzh7loB&k2?f*L%QGi54z~O@sCy+cem{kweO>qR^noCup&E0ZJ)p27Z-x} z+InuQ9`{x41_W;=1sfLh5&rI9R{>5{#~_)oWLXk<2ypNu0>a~i!;60q9_t-R3e|jf zB-_m6reme`8&a71e@%9<=~R_){o2t>7$ zCz24=PVuSQDXhj&$|}7q_ew9U+AplyFYJY1hp=kDuxh_-7d5ubgs8EVK4v2A5Y8gY zm`pM_+u&S-^9`P5@NBa9oM&($nT>)hM9?dAK_Tp$Crve4ly}a z#`%8grN0jd??U_?GW^5~Yd=k5vla0V#3oT#kLP2e_aY|8a$q2P5$Kaia_kWNgX}|K z8=4UxCBr6FSl4?-^c*X4tgKh(sYlrhh<`792=T{c_{k8~Z5xPlhd9i)48$CxI5|Bg z#}30k2tNzc#tR$n9<<@MBge8~5Kb@Jj6-~jFzu%qd?y)YV-S)@DMWWxoOC;*q148gg6cegd8i!5sqUV2ApkXcHA}i#~2|NbBUsC@KGRW)8E#c zHknYx;iBjrh+V?-5OaG|PmU#Di+>QZo`>{9J?9lUb`1VOxHM2tALQ7v_y=LrsYkOF z>ptEhdbXFW^=cl%p1#StUbdBO;RCS$ zlW>F+US#;;^_Bs`Uc?OAX0YhlcV2U$o_)O2u(?ZYc->&JFzekbHry^Ri=Nj{ z-V^5alk;Twq|N^jJ?rX&z_#)F#x26%L0m8V1H|7K<~0O$tpt83TSWgn;x~jpK>U_4 z{r|?`^TNF5@Xv;x*EQHS%AXB=r(qw7GHfTWy|52t`oS)z%BCVF>thNJtF)o-6tPJ| zOxDK&&Og?hftalK@u}3KEU&}dCd_Mzi^;Ih6xR0licKTp8sYm9*9p^)I%dJ=XV5)F zJ^W+|>-B1j*nfriaj}^stZjCR4Y&IXVv{YbZMbf-{oD_JO-5b0!rJC-v7w*eicP+- zw)wqb^JlS{g_x{u{-&mhCT z9`+6b?P?X~n)VbKei~p;*7keE zhS!-733nj=l`!Y|ugNI8RycMX0P?ojoJY($STEPEuf*OD8?vs8H}`16>(AE;b6pxk zhW{4WlVf>sgG>|~uCX)4W&`wOyX%%twwIK$Pqo2(vW;wW!Lr~0e#3{7AWI0DlCCj-`1{voVlq>`X3yEm|9;CH@ z4m0 z=NZg(N&Bxbc%{K>4d(iz?Y9}c!{8STK4dVDf4b}$gSpOV{Y8VnFqmtQwuv*?YjB#u zSqA4CJlo)f1}`3=OHr;)yYxI{h2y=ts zYnYoig)V2VZZllYpzCfydOg0uZl!Y&tn@{7b(UR>+RG27vgqFHOOK@CF8nZt@n(!+ znA}Sa;H7PQj$RmB8MrSOS9n_!-*t z*Cu(0lxTksBW3!Vh4Ve#UtWG=9@G3RZTe#$v=3mAUlh)!5>jaR<7t!j_eZelFCck{ zlxW`{Aw|wsT6{J%{PEOC`-_J&)87-wilml@)3AN=wBjQ+lXp#3cf@yGK;Q*^Re>^L_lm$EB^T@3QCWLG2p^gN}%0m`%e zPxpi08z5&(UJC{<1I&KJA?SXzhWJ~H^k-6rk@ok)5Pt{Y?>uz$han33`(=nfo-=Yx zwP=6)L;P(UXrJ%WAGfn^AM0Ro-QPVJAo)n8Txx&sh4}L)+J5K{u7m!*3h{Ro{;pG= z?0?$de}?!Az+VbX=nok5Hv;`L+sAXaaQ=qCj=r-IC`S!{v}Ydo%YqPp5y&WjUJLCg zb3*)GfWJe~vwdC!?T^?8htOk8_Ul1SYp;rggnXV8?Yy%iFNa(h0=0qwrdWW~Mz@e6k55I`1D~$2Me( zJ}|_xiotB(Fa+Jc--Y;_1%ID%!4=W|_?g7?$1h&ej{b%tXn(YaX;8AUSkz!Hq(Q@L zwzTVmfNFyKIMCXI$;{7KT6Ddyrq5aJJlZO)%wP%brWM6{DBRr z8#eEEto}rv+wwafbT&M6C=CyHC7*u(sR0vOW30pvH*6?Ds%-ekgtjfwjWO2Dqs7qS1X)O) zJiX7SF8lN<;%Z=aZj&Wz7;HchiIw4TalJ`se*rP_sB z2IhUk@^5eJ+njVTdaHl8qj|ezjNmgZ{_X3ozQJ?Pk;5rQnG^f{8aHC zW<`AOCZ4<5Ll$+l?WSoP+&tcW)IQ#&yg1gcz+-EMo2V$1K}%P(CHozS%i;&(BEIq$ z#a3f4P)%!E*NI#;Z`N27<~-=k&h*|Bv2V_#L3or?p3B4JT9$*G9y2;_<}B=68M)Oz z2VWe?$-~~_-iN2uPCB%0%ZMh7UB2TFanWfJQ{FxoHOATz?WvqGqup)I?ARHFXHLay z%d+S2VPi(#02u7+zjNsRT|1)#FC2O*p<}PxI`Za+EhmOP<4!#B@}$X!ag%r9_=Nqh zM8nCEjy^lb8D1tXn1Kh9_C+7dd!^v`tFJ`A{BY#XvL-APiBF*VJbbhDBgTEKFFx84 zjpx}0CVB?8=Ow1a1|LH#D_H*@QvwZB-hQ_OgO<}aXLEdVT5RxftDR+diuL%vHT|V? z$Kp{DYt-(B2O1a4nE9QxfdF>wO6=IR@4okk0nUzMi~IJfrw3eJ8+a^nJ+x0_&VJMK z+}ea~>KT&YZ;rxo@A-}A zZ-Ga@w>jRKcZ1aywSG(M8=dXFtk%E+JnPsr!b*)=-`E`G)z8-MjF{{$b35}=tg>6L z8=0&h#M&7#)cxIzu>t&@|6bq8ZuP*{qyddjS3Eu3+4%ISiCGgOMz-5++8K9`d#2`; zO832*Gk4DUf#%$uInQXG=Q(!JeOK1?p7_?lF6)|X>=UiOx#n2TnK_&NISYHW{>Hu8 zf6LGz(W_S!ujtzpZ)I$VOFZ`RA5q(O%W4?gn0UsTlAZC;n#~gvHewiZvopr7Njx@w zLhr;gQJAWUpK;_8FC?z=40v~gEO7K6w=U}F zT=&w$qqt7`tZwV>dru7*&bc}!#CPCotafdwrFpF(b(5{h)-AV8w$dh# zoOJU|$qTK))Z)0k#_5SUf(LbD`)v1)@#RkO-P-7zVz<{5GbZWQDM`5<+wj=p;1k31 zw&MO|(yg1X9(foy{^Icu{dC&4n~q!4_V)_p9@>@66~@ANB%gjK>LK)XY-^zZqJU%F zgjgRkVzP^ipDQkoXxtvN{yF_*`niFplcsd@*L0PI2hbyeQ~Rlb@o)~4UCCXQKIr!J z?})Hg7p@!lqi&@ibZ>h7uhYgmo8IsAM0#L!ZCci%w;YW**1b)QzNyEiHg5N<-+oZ` zLnHzVynXx)@2s+tf8L4%77j2j51u2BS)+FPO{>1z_2k~;pYPdId=gX8^H?5E>-IOV zZ^FT);Z$bB+MG|0jbC@O^OIv4pUiSJo*e(~&CbS?8I7}?30p><*u3>01A$L>?MhhS ziQTpR!@yUbpLF2kP{Jddf8oq~v9oRN{w=M&tPO`UH$0s4$s6N0Pj-ItM#d*I93$tq zo*4i7WM}J%jMf>>gjYxIYMZ+Grq?@0VU~2Rd&HUdRA=kp$m3h~_Okl_OYiMiLVS5g zeADbE?@h`(k~Hny{&R`QFtr}fiDj{6uW#yK_U6?IkI>T=XU9XG3)U<=-kxvW)2sE( z^BXqQFTAjM-z_&G`>W0SoKY>E3$`yj);Po36Ug+m?Rg<5;gQpCj=%FY=gV2n({E;M z-FSMs0L^SWymZ!N$GQt%MT^^OsIta=_W~R%cD_p;gHX)_8gy z#ze}u-p4b^UGwMMw2989`#Kw4iE0*QEiQQIOk+}RcIu%fhs>vQgDy_AtRWd=3Ndxl zA(+2Dt1vDt=0Rs=#9jLwiLb?e-!lO36}ZjiaYpsCb__kSsQ+{ehm`}5j@WhDZT-%& z*6nrTKU#pwqnrC~ajdbo@#mPpo;HWSFRNdH(=M6AIL0I--_`oOzyGlKYowSIIsWCe z{l9^E_TWQEtWTRNL`xuwrP2zM-ehsvaS3`$aZ>Sc1Ij^=+_2pbJJJweFsrI z!9C;Xro%op9{bePLuIA&y4urmjkT!bOOJn7yQlY(EY8q|vcTz~SiwBajmN%RH{k}X zqZ|Bz3o$1Ky@j>qy5HeU{aQH2gW@p8DdVOYf19@dIlJBT3xiW1d@t%Ror5k8sq^9` zFkZeD4{grjFzt3`zwN~tr!I>}?8Z;T0>k}VosasRJNni5`|jD*H{kc~NZxlfBiEi+ z`_}A&(z|c)Pn?JXsfRwkGj)Q0dUi7G`Zgqc{dc!bWi&RhrEj*s?*_lOZ7%*bBx5jH zx4kCnSdAawkAM+u%!z1DvfG38m1|!|wB>i4$ZyZJ@*;7@Jdu3y3T7Nqi= zFU4*=&iPWU!tF!9?`$fyQa5hLDMHIZr=3?YBi>UsJn09?<&L}i4&SIw!$Zmru>2d_ zwr}t^th*KmqOI*`&o<4o_!5N>JDlsn4#$PfXH*N+`J!&Zh$wvQV}A3Tt^V@STXLE= zdTtAGfj4Hn7ZqvYJr~=Xeg2JG?rX+F>+7zK>iAu!Rq%Q5v=&dSUdhvD9dyim-0p(M z-IQU?d^~NIe$mAb-JbHOYeQATajJ$dh!}RBmCY`HzxUm($G!;sXEsiSTK?F0>>_sT ztq-ln*y2)IF?kZ+8bESj z6ZV%Tywf3i{EN=0Q=J}sJlxux3FY`l9BQ}ZdbZoi)BoVgpw3dx?dORUthf4Mz3!pj zc*h6&Xg8DNSaSQ^+xe!@+Oox2W5y_SW6^<3T3%JRyr!nQw!XCFW=kt8eHCTZwUvgd zx_)VCEem=lYAY6B>Z>hT;j1n6R#ulRuPF6a^|0t>#n*6BVar6X>596bJNpG{-m2xe zp;haJA(wP*y}YWNt-G_du6lXx;?n8Cx02CNx`5sxQ9e7Tqy+CUth0tJPuG9ekisE_ z6R-SFyDBNK#d|=jYag(?@5Qznm*YtGB{n7{rn*+fG`)=TxU`n`!`b$L?>(HI{e(>D zXYJQe{Pr;BZ6rQDAU^2STV~UUe#0g@qo!GbWFGsTtldeV~Psopn5V*!~AtQ<*B{-Rlj$`)HFpYS{jJcHNI$PZVZxYtjJNEZcIr zm)Xtzu3`JLR8temT9e{8k9#+2DF#tDLFQ@Tr;!B%9K-fsbwu?mu%cnuq>-)D@UaW; z@pva{5lZlwSvK5>{~=|gE_UKXEa_@JvKX4JD>ft_in^UeLX25a^XJ3%KdGA3o}@Oy z?>iflt}dG~=#v=dhcS-RIE=-(P_Eh0HSkg6t+M?KTVuWvwApgFHRdW zC5=97joM^+*JJxnvsS+{drRM@p=|W*fAV6mgBvhV9eM7ZVfzzytqANrbmVaE?&!U~ zL3Y`_NrT>*=)^~W;3RB%uCv{j7)-V%B`%s~b@Z`Nc;q3q-soWo`rkD1kDLRKcVb*H z`oXgKnFVjZH3ipnk`jlz9*FVu8r6&Ith#RJz_mMs*Kj_w7=iJvNI!!xq;BrqS>CA? z<-F}|C+3#c;;oQK+*;`?uRwfYvduXA+K24hvDKIrh8+#RYx2H}W11cjP zbmhBn+Lh&8Q8wbRI_b)ITz0`tXK{+@MkdcN$2K|T1hWI@wAPZcfw0CYscVhe2Ac+c zHEsU~+V-xp#86)YznHfF7dn4hnEcPD?SD+?k1xBvNBPgDVLN@$sZEBJ4eH(i_g`Sp z^iI&=+MYhn{s(=W44OojC3N?3{NL&0wN7+6Ft%ZO^aLl59z*JK%a@eb`zq9M`_%iA zht%C(UFE&Av}SopIo>Xbw}1|*n~5{gTdNkA*I>a{Ul~9_d>|Ji;ab3kuDJxTuBbDnMeGv~ko zZsJ{I^%lM@_eSf^>9cRWEqC;|3~O$F&S?G{GbU3-H;!Y37Z@_SakRb-Y4IbFd<_v~ z-;3b2{v?D{D*hYZA;dOObeyeH_I+O>@8wZ+KJP0~cpgQWXGg*BDR?EV^L05L=S#j$ z^S(Dl+v8G<5^XnI(zJJ6fwK*p6oc7^aAnySt!Mq3*(c3xpJuPYrv0Vb#y;q>rj6;- z^uxYud$TOZKlyH7%_hdtmgpNOg*+Q(ip;e$=Qh6w*LvHj{GG!PMGf(;{HZ`F1U~I zJg~N32&OPi)?-)-o&sGm!qZ?@O`9EHU3L$c!n77Ww^v*>%9$3 zp*@*vKK(30Fz1+V!*>k*BVav$IN!8?o{MS!Pl74*Po{5%rx7UO`oi^@HjK6ZWYIBB zL7;>yJ0E(M)iLe4hET%UbKj&rW6FQkhV{@7V+#F{^}3WsC4_pio*NUvEJyt$iCK=@ zh!UEqEXur7Bym=ex^67;lVOrZ^#`#AMCBT%R(v)yb9 zkM9)f$-3`r!FoRY5KN&Bne&Zh+Yu<#lX00z=?^1zAW(kpngRrqG6*fS5L1 z11Z##ry!>OEST-2{(a$O@Of|qV)92|3T?FLb%|-s<{CxcEX(sLO1QGzMzmv0p$$15 zfn~XNv1;mh&T=CH^;HNI>d9UN>VJfw*NxD9UyskvU_)V9GGmr~3Bf7peTcRFVK9Yu zWcsJw8Hri;ECPi#TJ)IkT$c7arak*b31@GPp|+up`z_0IzH^(Bxwh!>DFo|zSYhZZ z!OtMD4V-%v)=M6Vn0`X%)iCI2UjZ9E4$HxMo~#r-ZPtMGIrBqc>gfLwus&Y%S|^2i z@^Hkod)v^Hxwa-Fd}ip$MWW}sH<(2~dn(_L7q!jp!c%yodO z(08TMAMKAIQ}_KfuwEZN0_$U(lLio$(W2)7)0(+HqL}(@OFiwW)8jl5%zWy(t+oFJ zU@t;40@pXqTfu`7s6U91B>Vwlt#@G1bep|k-LF(IC0v{TyV|MS&(B0&w2l3m0@iJw z0j7j&vz=rA7c-UU`L5JarYW{`t=DR}dd4|y?uHYG_t@}TJ_if)U=b)bN7UqiDB`$T;G}8mR5+Ij4qIIcUAx}5B z)aqsCCv_!Md9HL_((~QCJfd|8-^FW+OC1TjG%l;QD*1PY zp&!-*a}Vb6n|jJXgnqbEW6lWXuVp60&L5|qX|Of+XFh%2!s~7Qa5nUo&P2@ee+WtQ z{8J0_BaA7-^Z-fo8dE>Cmhb=3!u*><(!8!i2`Kx?)^{YG4P8I1M?CgxVfp7JT?g)m z_31=NzCNd98QTB5`fUlfuu${j5AILDJOGJ~<>kG9*1SB)u#oy(T2x7Lxv{ zq}QXae%5r0?}VT{jnEHQF;0ir|5?&p5BuRwaD3kbh39Dfu-+w0I$EXYT716)#ZJ$& z3MHKjT|az+ykF9^VShJD`gWCnm-VcqIgb6T1=gt$`*$VHbF+T<-L20heO9H5EpG%s zg#K@mG|x@@;S=~hlID3$KU@`PkTlO3`eF8NlQfUV{kVSF4|l1^{z=9$cqMVYHFfS? z^QPvfjL8_+{r$M=;qpto3%H^*qo4fy5qWwbVEB=yk zusMs$>+w81f6g}iPb}j}{cb-use2i!S5MyS=jek&$hQ-8QwDzy*?wq_riURt%dG|Vr$hI7!pFX~0-p>>2Y`FcP0%q7raobEb|Q(ebx z%(XvjICx6k&S{n^_w+va#g+9r`a%hr3zb8Jo_i=R}olua}A83ywc zh2u{AgK&-3W%(IV>-iZ)>wC0Q>f$v5-Cxztc~C%9JB7VSJLHsG`H}Ha{gqQoVN_)~3i;o@-sF%|chwhZk7@%Cd=S-!Z`#cNy1zUeX;ykUMOAuX zR(%mxeG&H3zp(0ye1uSa;ROmv8iJ#kWZ!pkh&~f(hfk^PZ6|uQ?S!*w zv&go|B`>x)pIl<|EQ4p0r7Uyx``T20dBG5(#!y)GU0C&9%BsGbe&p0$`H}uAKk|`T z`4JoCXNg^x=|_#B_*7$P`e!CY`8V}Ah0x*1X4S`eHuJx(OZhQAwm62^HcBt7{0l4p!pi?J+g|w>y&6Lqb2Wyd_p)B$ z6oXR@R%0kOY7B+d7z(Q~6joy>oNf5YCCk|6lVyBnk!AkOHkd=B*VsZsztG@fvh0r~ zhJLBR6$aNBTu-I~vJyeJVYR^x2Cp^PPre8LAT0-2!TdZH7inMD<#l|r7jX_59|n1t zt-)A0{Nj+J#|Jec+zS6&m3VEC854IY`$&ikCI2*$De4}(Iy|U*Wk%y*hIjV_aA7(?@`SZ z=69#&3e*3$4CePuXwNo0YVhNR&Cd+|hX(&M8TC^BEX+3WoXQ%;7p5!DbJ}qKBgfu>e~>8%v|o;xr*5?2{3XZEz&{92cXVBg$gttOCdbakKgd!9 z+VHSgE&LtCD-CWC=3M>}8Gg7=kac?=rXGHL=fF?{~)IjblG=>-$%@A4%D+f|04YFi2qHPo?y=%pO2jYjshHED|mXiXqMQk2J91!Mr_;}xpb&;PJeg*MM z!mRfw8TDof>w1ri4ezD#elKk}PszI8^J2sA1^!8xWAcf?e-q|Df}dVi?cx667G@jN zx-kX-8H~W+S4c)VwT6g(tmxTJu9LK>MO+|Ed#2;Weue1IBi<@{?z8*JD0?393E>YB z|C2ENaQ^8wxY&Ma&-KE*PRjj_bzyl_tjCS}2JLy@Kbs62Bo%8L-bta&EX219-;G$U zld$LhPS*A{VzUbII^j8pHwXt1w;H@z_zdEo7`%rJ|7<&19}8X*n}dj77e0mfyfDXv z*NWNZDDWp__~E`uj-7{pkk1il!+WXR_sIM%LO(L>IW}Z%pC~pkv-d&Rc!gu<10Wd) zalLJyGlluxKDEw3e*(I3^aG||?VFq|5Os_IbGy%@4Vc?Y?T@gpfsXqp%aZ#ckIa6l zbz6K65^Tl(ZU2Gj zxgE(`|0mIV5tFt4FQVuAOxAiQ>Z5;-C0XmQqF&lFSa>Pok;42wXu2@hWW9%4~4ls??xW|_z>SuhK(2cCq&OS_eYv~jsZEA9fGLsj`uzhBE#FcFq*?X>#0_MW<#>~0i}4TAgg~1|5x0_I!#0q$ z|8~)HHzCLR@DH*Bfn|>(ewmE2S;D%kT8m)Aww)52Ny6IZ4E193p78Gwe_-f;FI?)h zfAg7jWkdHBLhK^^gY@RMfFGV4s^dFsa-k>3a%Y7M5t}}UX9&+mTp+vR}ajCRgOS+d^NezBp?9|&(m{3Aopb%B0TVUvKs-|kw1_y%&8 zy*_ZMB~uuYV-OdTVPA@Pk+2_eH5oQsA7Vw{2eDU}`(LubtXumTBg}fHk^wAB*8So~ zaoR6L%x$BY?IvG`xI*~*i0>!E53&?%KdZ%te!gq4I*xELfOrw&uy|x59!7>f0&zAO z`r8nzV*&U{@ZHqIhU25!AgtN|rhFTLHk1YgGRLZoEPl3$9+6rHsQ(UFjVJ6mCgfOl z8qybmHbW2(B*TXNCF}mCi#{GPS?k$1mgWA7X%yti!jB*>5axC+7iJslg&#o7pxdd| zIb1e9?1Wtsr}C{d!@pTR%1QzcBds!e1i(PvNzQ2ciu9 zuz1Ox;YYuEUN66a$a+y8`m zuf5Oh5aw9DM20=*Gg;dopx$eLXZ;hb=I@ejgn@9^Rugxl5O#XktQnZt{JkVu3$?2IhuCUfFJ$ojK$ zG&pXseGYr0@EOGS8r*K!JY(peH(2e1@WZldeYgc6tjCSpH4b|Am8?Jia{I9j+&{QK zka>K$oeX=92RW9L9a4Zmn<~WLGI%i=_8c>EY#shVY7nUBIFMuc!344rfqs63c(w4) z5I2%x&oL(J&q`|jf&D({enlJb8;CoEIj;XG%yD2l;w7=6Gmt&8KT2H|AJx^@@6*fLH^z1K}doug7NjM(y6T+M? zM})nI|0;~;S=Tu1dM6@IAj1#0Tej#wLS1}bg!(k-YemoBQ(Gx|ZtL#|1J(EXX`cb+ z=W6zg*Ijl9)2F&737bsV{ET`q?cWlca>RcSeHQdQf2E&)LRk+2?YYnLJW}h6h1s^n zVv`LUzRR69Pa+g>BXKj);{j^JEjJ58{+q%+#A;uF4cmA>_3$|xF zmp0(#}bdHg5~_`17uz{{tCiixHFcXUUJLM_*X)pAB{*P5Tn)$hxi=>cu|R;9=w( z`}zi1+pBX4vClB@|$6{cNQT z^!4ZqSsyoF7X3=-$=Y5Wr=;Fr(MFiZDKd{y>YNAs8Cc!V%CXl-vi8F~+Vhzi_1O(J z4XBH(ZTQ;@Y};Ds$y&dXdX(k$nNiA@XiWWAn0BYMtR zvey5D=pTljtlPl#LihcQ@CS(BGxYyVMtj;&maKjLS#0`1PjR3xln4aPTq87l3}zXv zk25&l;6#Iaf#as&A4Glj0n<0Dq@H!EV+R%(t|#NE2M=|~Z->K%_1{Uo*mGFPYzq%F zTK}Lh+tq65eSt3v;~p8hVzepAQhfPKFc##)gt^+FpJQw?WL?4{zqJL2I z!FewFpNKv<&qaSo^uc*9`rnD(i&)Kb(W`k5<~(OV*%!87T_*%{o~!vUeHn-}ZPI9u zpvTQiJ#08`gAG>mANmE*sriqxoWo>Yc9vnU=D+x18Twp>xQvXloWo>Ywt{-GSMy(( zWvJhZxQUFioWo>YwuO4JSMy((WvJ);eTs~-><3wweU^H$SMwhnod2R{dD;Z$Km24v z*JJ*Ry_)~v;QSZ8n*ZS7{D&XT+aB{@?A81S2j{=&)%*u1V>_$)4?p?v(_{XNy_)~v z;QSXo%d=lo5U0zW;Wi}e@yQe$&WG{BJlB|L=#gbP()eGFN5b5fw4U=`Gv~Ty&Tq|L zgMpTV2N{U+bA!#?uN<6s5aovrgLn}fV@UQ~cZ{`}rVdUv2$Y zzGOiGS&N{@LA77TVH@=_4yw&E4lhtI<8X*9<8Xp3<8X$Yjen4j5cD`)B+EE_L6&jg zd9s5S7$BU_nt2S+oMv#A!MS8!c!2O8iDup-(Y(~)dV?DbZXw6me%cJ?wHmG8WAFho z4>FKr2ET3ad4oSD$J+Kh*VP>1>|%bGMe7p{PBl2w;B14{Zx4%qo)5 zhlSN|4+|F?_7w)J-yRm5wT6C!!Roh%#YX-1u(0~=Vc|oD{RxBBZx4&jM~40)nL9c} z{r0dh--E98>bHkQ?=|%5w}(ZqetTFr*RWB)JuG_l+rz?34IA~_!=i66^y;^VMX!E) zSojIUM*a4%=+$oz3m-FV)Nc=q{=A`AzdbB^_1nY35!ml_-_>sqi(dWqu(0~=Vc|@} zKHFgR+rzxL1yR2}EL=hxVfEX?!s@q&h1G8l3qNew2MkufJuEirw}*v~8aC>;hefY` zdstZg_OS4$hP@Tl)i#g8@dl?DoMG@JgYylZXK*o@Cx(y;gI5~7*5C~WZ!>rY`5U&M z7YsgR@Ck#@82pjJ7Y+Wx;25mm+CRS|?C4|HF z#o#uBpD=ij!3PXJX7JkvpEvkpgZcZ8x@{3S=4kF?aH7Gf24@)&Wbg@t&lvoX!50nw z!r&Mj8+9M~eM!w;gVPMoGC0@Z*#<8(c&Wkl1~(YoVsM+mPZ+$%-~$F9Gx%+ClBMK4 zIoalq4gSpF2ppfaO&{`L+dk3YRD&}O&Ng_K!G#8w7+hoUYJ>d-KWuQo;AaiqXYf&j zPZ@m9;0p$SN=~u+$d_Dd_81&*a0+>-ZJ%NAB!lw}o@a2e!4(FtGWi^-$xHe2a+ z4^-Cs79p;$wd19lYD+78=@sSmrM13_^lopBP;WZ0-++>Sd8^>7Pp)idUBRU1drq!U zfbSu>lGA#=g5(N*@b-+aVWM6?as^L(&&Xv=^jk+RV`9Gl<8o&9>rm{sfn3He^z|Q? zG37R|sw-NIUjZrNFFjqZBed;$XUAon*7$1cN_)I@<8rRUzsTbno!O5^jso(?6F*AMyHQ98{MPY9)&JzZS3RW8))p{;SIX>?n~wyyLNaRd%q4d z3bIFEsoz~Yei$FdE`KFIhH3b%qF)4rouclF&bqH5VOkcldR)n2i1{VAD>qru;>sE; zz2|7Fyz)A{rmGH1>810_maCsYy4)@hW-;sOFLWgfGYa9?uqzEl_);<^;dZFY7Uz@k*l;w$Nn;=Ti1zHkUFDF1=r?AwlcQ^f0(Ye=Uze>!8PO zE2C_G;{|l-i>oWuZ*irstS_yq^QE&JG9Xy`ahBGVsHv^4k+Zw66?tKWTTd1)y(-}? zLtLT{ie_GdA!kcYA?^v{R*8Fz=J%Qf<)R5wPj60qGP3 zE!rQyQ(*c_!F^QTm!&^k_6z#^1K9NU1kz~;TC~64L1Fq^34g`V(H|}+1^v0<%=C9k z@(?M}{vu&y`a1)Edi&ziM9?3}?^F0Y0VDSJdIa4*KC=fG!S#>#>a`E3gS;uk-ywX* zLH9Sw@OL7_-x>JhIBU_qUk~wj0{--T;pINvJ`0PX*}jWNgxkJ<3-QP23-tCKV)#?{ z%aPXWJ->IbO*c;Lm>h|E*@kQ;AZhT&vElgfGL3GZFQk3^u0Xi$u`tA+m1954L4Ul| zqy7CL#2>#iFdO+=Xh&%Z@plIP^#03BGTPss5PxY%n}RMWc}eVa_ND9&z<}d_CA$vs zr^lK8lBF(2x*vz3CudU$IX0zhyJaA)`|-OFf3uMeH!kNw{GEqCJ+H-n}G&~#SwEf{w7xZ^L#9t~-9s*(fy%yr{=yZG^Ui@L{3i|t(5P!!o8MBeE zg>9nzA;e$yEc?5V>@UBPMLYJF@4Ybl8-tUPI_R}%fB3ojZv9;ie|mq*fwA^?Lx{iC z@HbaG6FVkHg!rqt&9aK2XZx^eg8pWRKRplr0sg$m*TS|l)P>Z``>J~|ep+-tszT~L zfqMBp8rGYKp!@Noka`0cES|S$(e=I>Qtuwvt=C3~b-gcz)ce^StRry3dZ&vWx5wF# zdMD!Ki^o$fy51P3Y>w*C}Tjyb8)JwhCgu(u%ia$Nho$$x@XwmiF z9a66c_ij?O5n^30zjI>NTaS}4p1ZTZcZePRuL<#&0e^QvuSNS?9pY~f{INX!VJL(B z_(_OA-p9f&7ZmO9V2Is@OW3LJs-QH?m9)VwSD2CZ_uG*69YFhvkB9OCaB z{H4H#;?>T?j>+92{&I`Ew%Zc1Af4^Fask-RCD5TymV8{2TXwmg9 z2&uPaF}9n``$`z=de?;1n>WyYzlZim*9?z{ogU|vuuIWKh;_aEei1oa^4`YaVd+r) ztwF5oRo^#4n&*U+ZSbd=XDFPFTh^~=Cl^=@68Z@8B1+DZr}S6v_IPGv7--fx@9$>V-JAy5op&3 z0q(dw1toAJo}Xr>h^`mAe>b~rt1Rm`EG(k!ZpiR<6EkVE{eN6$rm`D7CUcyvDRzJN z)>(NDhxWuV{8n%rSp+W8ZX7|ELzcJEJLjugjWr z_UQy?$2xxK^#1Bll-fad#67*O??LD8=p(-Aw)Z1R(_6MqIofAsL_zddQL)yJlm{d1 zoP+LmUru{KntLQEXJ1OYZ;B_%&gEx4>!7p!Ey*u%4@wxk$Tz*+Wwi#{Z(gs zFYv<6TiuOG`JSkCS3C1ctYHsDOH z@00N4`ooReJ;{;QvKQNZQ`c{|ZNE5vBq_IjyY>3S%*4<4CQYq$4x8A2J3iN+?Vabc zW<1mGw)$^%OgZY9w(Z|{OP_W}+GU%D;@BV@^_xyKtvzW<-i=mc()5D(=t@T(*7dzk zYvHkkcTPIjJvw#dk%T+PAMoyuJmQ;q+BZu#_8a|YL>x()c{*uUU{5`_$M_dB_c|SD z#9rN_XGiQ!nwjv3|8X~z4~@_XDt8&5CHmjf@B-#E%O*@+F2kR02(?v=<^r#1AAfA#eDL?(=d zc6^qz>Ap@B+9tCu3iY6)c@FN1fKicZF7I}(-h0q>GGcae-=Wc|AHME59k7xE4R&*q zPrtiuqJP23=sWYR9SaUdCG4{G9w*BBEKhXQV9OtOA@|I@W0?nCyPbt8&C=dV_oij; zGmevyRNI9%P3*O+z*PLuy=hnUPRAtAL6^7PYa5~5pQ8MZgRTXI3l^M=)Ma7%c?3)o zGoJTq9ZV-i_#F%U>(^JtZ1TJEOV+O_`1CI)qr2ODjtZa&*0AZgwd(#=%Q_rZWlR%> zqS8GoYS2ZzYruz}13nq;t@Rea01Ci&+NckmjUm9hTN>sc2M?K-s6dBkVg&Gb7n z+73N6;OsF+tiRdm>6K8i+u53Los2r@vJFPLH;st!OgiYQd0Kk5X_xb}!=Ct0{^5(A zj*Fi?^vD|~M*b_k=2Ifz0&n(ky(?qv_-m*oFG1jtW+X_7##-Mp%gm;s>SD>unOx&>) zvq3YWkHzimiwziU_vwe&rcpZ`o{BCNs$US<))x)mvUTaQW$b^@FU(iD?9Hn^z40!e#NkQFYbr{3^^;D59WP zUR7WFfYRInjoYfOUE-@MU*)SW7sFXlM_U!ui+#AS^Z=f99nqBE^w-{wUJmPy`N)gy zR>W5^zpA`m`I|crxiR?R8ee_s9ksJ-tM4zzPo=1=(n?=>MNUacZ7IIAVBe>{eK~Ia z*P=wERa1>J!R+}FeMB?0x}+2aeXWwJIm^+SvT{`*-KsCIuV9YHs#{*GDwvPUS#xi< zmXzOLYIk>j#0YEJ?N&J&SMIB*gYihKrml2(Np;l&l}P1SOG>No-6nS1be?9FRHLy~ zQ>!a$s;f%zLr}e1hc-X-Nm>cM@SHo9liEHn!H}!ZUp$oXx|B}yl*fS(hk#Rcbq$vH zV{|$N%zP}Ps{9DVJde?7UOQqwulex&ItKx#*unG+F!N_2aK$S?;CT{0wkZ315L2(y zJV#^x3IzK5HUitF(?1ry_Qz|%wA+b5yWI%56kxq7>0csde~(N0*NEA_vy%P*F+O&v zXZ+~r0s_Yf%Y^d#DPp!qr~eA(X&6tNXdj7~`8v&WP4>U9Ec;M_ct?CN(}t)89{JFOl#&(_WRb=K+y(gu;B*Ltz=srrvAlIghlBo@Y=giAc5M5r{Y* zI!*?s*;&E%Fsbc_fN8H|+7A;QnWwZA-50Vh%j=9R%b4w=O*X={2rPRS0{0v07a(Z; zePGTh+N?&P(1y%w`_w;;;6$Ka&sC-mAY6k$o3{|OpL5_S(SL|om;DIr6@3I6scm@Q zltTYx&N2EN1m-0XGVdW$XhYU@JqTvMXwv}JW%-U@{3-i~0owkjREnO=`OUIB3_V%f zKM!UW>wN(*R_y=T&|d&2ik{Dt;^Ua|c|BN{^@6$2u&y*P{*=#jfSw2_#^^$cIK6Yk&}=qEdvADi-n`kdK%I zL5pqJ(6EE4jc75@v}Y$pMT)IbPmQQ;l49Uc>`|%}5v`@x($=;XQK?0F|NmL{y))V1 zN1y9F&vmZrohy_1t$W>b&&QfIYu4IpW(ltYt4+=u)jGTztjCvYWon)9HzKvu3Z`RO z)M@*f3;}m*7y##r(&_XmqrUEANWT-FaeLtDC?oUyr+hcO=6?@3M&x@DYChS|(J`(% z%_q-0#$l*sXJ4abXFV;4XIgi|)6ouD^KdU%^Kc(n^RUt4RxsV^@{kBQ<1nP74tW7Q z(_I9=O86~=bkreh9{vK>JiKkm{{g0>K3VnOrx1>EvgY}?#UFy{sH0BnO}7~`U3I5^ z_n23pJ{Rkp*|!0T?e}D!+er}#`?eT!Wcs4SqD2ptP4-_g{hl;3KCjk&E*3qC_H)l8 zqaMfKw-fX~|DD)q`*!UxJ+`bq7i*4)z0E6bpZo0Z=CXzKxmagJ-v%f)az%2*u^6pP z6b+ugLr_0owqo!+D301*5VgH5YWudRZMJ)LwD&{ZK*;URsBMl*)N%i7vcdjh2(Bz_ zlXN_fhoI-;ctRcZ?ceygeO1){1yS34&xEcOeh7NkyQB8+lx?>EA^0vZ-vdxb`|n3> zyB{DetF6H3d0d%OU9ob0{W9|w_4EamHz`l>C4^%&bbOZtB%k>84}tX;MQAK3ilZ&va>LHmo9=5v~`Z-1xK{Y+y0 zvf2uh4fji+k;L7M!VKP-#fxkhd-vbveihTrzh=1qcQLE*aZ$IVk(ibOig7xzooP$k z{xGV^nVUS{2|i8Ycq4jQ?ZW!%CG!`S(rCVFFVt(oJ%1YeL zoF<)83__)$=sFj?1}Srwe$S8X$iu+`9D6LC-QDOG^i6)mzR8c+H~A5{A8|Bqyc#CsBFtSJTPU-Nm6=bj zMNUW7?^|#zN;%6!R=Kf*26bq2v@pl6YlS&R<+kS2toaUo$~l(RbWJ@Y4?KpZp5{Rvd?UgJGW3TFdnFHd zi``yx+ANcQ^i5AH|sw38|9O`{a|81PJs_0c2z0>WPjA42#Wi(e6DxwwyU z-$eK);lCq%TbTDX9|-f9^1h$?yyrTTjQnI_KUwpiB04<&0ny=UMfOUclPNm9&*HNI z+T^|4b!6CNyC!=B0JzzrLw)}KOMP;sFx%l`Vcy^I`mZ|NCi5OJNQV6!*d%-Xv@UCF zLY^z^l|FN$=;uLBR{0MphfSU@&j_;(?-J(y-G7r|GaqruTK1PL9gaKH4&x{vBO@-` zBiYNw0QaG#lZf_N!(L7fC)?-&4FK0NL8AY}bg2SqdNmFoq|uW40@4*NQ?+A)2I*x|E4+F`Yj)y^8q zrHt%1l)od)y!{6maamTf+JA_0iMvB|h9e}a{Z7$gd2!gx_l-E-zsuqli($^_@ES#1 z{2mg^l|fFyKRB`;FLNA4rx0@Lu+GVvPg94`VY=)?sl#%SHJ=M8htAyy?;t~mbx!t< z#Xq3m->##NxkM{I12U$7DVLgClz{GU&D+*rc5-c{bbl-`N*0#)0QNypNI~RGg<9CMY-7N6&*i9vfB9-vhb(Tf zxYgpY#ak_Y)Z$KyyDZ*g@$(iRu=ov&k68SU#m6mnaQ)DFORzY};#7ocJv3RA$4HkziZn3!4;;_YAEq>JEPK!}hj;?u>Kt7uixnJPP z1(yo%LElT~hu3w2GRZi<)Ttew+iJ(e6+7vai=AvT`ZqdWgVatTnHNB~+3?B>EM9E! zN-{e_IQ9d|Ef%*~yw&2z$#Rl*S-j8U0~Wt&v1xA-_k<-+VBLy5*sIrki9j z?|oFBY4Jph^DH*&NJ`!~Ceyg(7W1A^RWl#bzBzvEOOQcUkqv@@Sx1tC3pg_`MmU%H!e$*wVY7~;@B&L`vBhQ`NzpOuND8-D zI&EZ(8R*P9lEP*kN#QO_XP?Dp9ZAtK>qrW}W9gi**sLQdI%XY7VSgO*fNLe4Sw~Ws zb0SopZ?RcNQgqBZlEP*kNnx{&q;P{3*Q_Hc@>WZ}#bUFLr0AG+B!$g7lEP*k$-!=( zKlj=tQIAhQWnBjMxnkcF)K63G_YCt>6zwOPpQ+Zj8o_B7UU6+%&lb%TcxT*c*MqPg zAiL?BY22q&#%bnAM^(dTO=*r&mzl_?P8zQ}O_iOhb!vTml1^V`eUgSR4{HB{*&{}7Vfcet>!h`T-yeEt@(|L^mU}?j<1j(dz!2OzNRoq)Z?kkOu3_R*esc7-q=p6-|%ME)}^IzHDTv+n6WNiPXX3E2Nx zdPBvYoo<$~?Eceo@Vyzk9Mu@>r9*|~U_Ejl%aI*r&yQ_+Oo6?w9>WWx>@~w)A>_0- z1YYe;7kj)Xr{nKxtT%PoH1%^S zy(3Zfj$;SUIdy99_fhsH;@R##DAAtw70e%>)j>6qzZRT~A7Wdb+8Y2pa-QzMvt^D$ zX^)SMxsUevT%7jwxUI*5`3eQ%i1brM4}o!S;-r1v($jP=hk~8%mM=IC$AC=N53lLY z5qmsm>A1G4GPgC|uR>35GbnbrrfQBM_n&6Lj7u%~aEvpf?Q!=lQTfXc^tFR@?AQF= zDfv^AGhpux?i8o#u8gwR413gLc}KykJ?cX>;<7N-NkUuYIX4`hdOSZ-yhvXFbhy^r znN~zim%}6NGpM&X19PQMqi3#qWwndPm5p0gy67UmJBPt+56e^ z92T>Jk%@`S07^W<{G#NZpDY)jvGG~o7WgON{|Nst`2R`AxfGiZVm`&|m{0M))HVFw z&6{=0eo9V9)=ir=!+%>vEq^UX{ZICfEO!z|)-9~7TV7G?=WpdkN?CpN!aD!*8jJ^B z*~sjPQknPXP3AUGtS#KrztI%kqTo?gM%68z82TyIhv7jIO7~l5g8z9uKzG& z=L5kEzr^{18|MOvbG{pA_~DFUR-CIp$e0|{`07c-*)|87C`g~dJKn?2f)`JghSx5t zG8(-@(FCH^65pkby{?U(UY}i#tN+1$zc?BCDRY$;dJvf!9NNe{d5$+8x$Quuo!;M= zUgyc`_f2BW1;J6CqT|P-(p!SJ;Qs=}_#d4-nvr`rWAgrtFK(M2-qF>wd-x-9Pfl5F zj=-IX8`uA-bIKFY+j25|Qx}XpGa$UB!QH!Y?;qzPU*9|FAJsKEa7SQUK;}&Jgpd2Y zu8x^IFa;BW8qan*0=cfRBXG7tc5jSR{oxGJek8sq@#NM(${kMU5LaVI`1m6+rGd-c ztrbHC>imYW@kRSTM0(whFQMgVUQ_p-F)iPjlCmS;mzv#lZ&6NuQ%TdUO{<$OZkp2c zx@!-pQckk#Fu0%_Wyn3FX?OpOk4;QT^hBmK zKzn_l_oq&0cjyJ2iR+(=z(-bPUdun9-9?j zd*j^o6ACcO2__&$(}14t%x7Y)ycO;JLUnhjec{OUl}+dT^4VwN?R|+C^gNr|UvzMI zsQcl2syd4|(B7tJoBq)A>_khYd9yh_Ul{#|_%o2@>X#N(_YO39O}DkK4jgrw{9Pj-s-r-ZsM?HoG88)|b>|FVS^N-OnVR&-z~LRP;lTda<1u)u&Iq0R%NN#HKIgGA#AeicwzFql zXz;qWKxf+4``tK)ZrpQgXv(^_v)bO?kv5DT4^i!p1!k1MwkIOhM< z=~rHLUDOWDomwq@)UDD-4U#@;P-)od=uUETn{q7n>NVaF+9=XKQ5@_Z-t9P#v5WVe zbvW$2h88QDV-pW8+VkbkDUS@SzSWI8HnHt$^aY5RQt654_2RkYg8Z&U6MW|s;OOI^ ziveHCPt#+HCLQ<19GcGVOe+A>j680c(QW@foHQ|;9WxvU!gQ%_UvyJ#~9fUe%i7f}dDIe831>fdL{$y$exSaLG%n~nZ2 z!Q4eVJl3>9|2GQZC@1qKj`EK!IoU7r3t|9p)F<;fJ@q*;gHb3S3$7P=JD84gvL1_V zmYmGC6@Y<o7Do>5zHTNS$9>ax!luDf$imX?yz{m@=mO4nS?bPaz!TWIp5xzxCeJ<9VZ1y%Aa-WMur^jc5bnNPe;GnYl)v=4aP&W{AJ1=VcD^c5ZvdzGx10lEHkJ>&<8UUL%=dFyf8U*z(i`veM+MW}& zt(Ord!}#Bb+TR+r{iCSuT~XVIqPG7LwLOsSTpZK0p8;~4?_<*OG#G-;aB`IXHBsAT zQQJBX1rG)zvlH}LA*Q2Xrfc2O8q74Quk62DS25Qa4JMAgBzgZG_VVKW_TZ5ulEI3` zn4yB74Era-oo3dFM(MXM1-in{-&vk878L+ z@l@>eJ6Oh3)y<0cT017wwCo;-Q?>Ez!VvC z1WPN*>lb6Wb_g)9sXThp3+1Nv*2h1YZ)TX+Q#ex(9Am%y z$Q)u+XyANKu zl`Q&gKDU;qZy? zzSHsWlbPn1$nki`9oHV#59LgMi!h`7N|@=tLx%o*=)Wg&=7qOgjGGGPEisvS*(U4< z^SV!Yy0BNyO~#?k9E7|DQ0A>E^)nHYRezG`OhHJm`m@N;&q7G{$~j(a>D**-BN_VH z2+3-{+0yy8#XHH+pNNpG`dySu{(m9-UkH0G`O9R)Wf{pDmtz=>`-bpa2!C(MKPDq? zE<&=#jbq(Px@K+__zcJrEjiyAVB9>!BYRodaDGdN>uS)>XoRCI`IThE&4)f&)4kTx znJHX^@CHkMvoPC2sW98iQZj573ad@N6QE_eU6|vmRhFE$=!`o9amilkW7{m9cHxH* zZn5M$$cQ@=amku)r=|0ha5uuAS#qA1oaaDC_Og+}nR5y!%Um$K@?>xpLf%<$o&X(L z=V3+NrX*nJj7DW64c_B60b?tlIgD#s3oKBZy%!uFkuVnYn+6%SRU9 z7danyJS4mq;m?KnNQCd9(mo#x{6&~?`6z^WqkC86EX&8jOe+&{7?+P1rV8JO@T(So z!{Yme`IzEiVcxd?NSOAS52g!res0NM6lNX%!;6BT# zM3{MCv1yZ!8qT%Y^vRHyKsH(AY_n6zh{U!^_6G0|?izU7Vc&c`89HpYWG^oqaHije zoNbltmGKPIVB9c5K6+(bc57s{zl?I)M?P;89hxQUoUs;>`w^0LUff2?5%)oao5`@B zF06TbM09vh`g76A6jnRCMduZSzZ4yw(`2>tH<4!}B;aoTA95ax zWNb5U6S*Jk9R+|JPC0ba5SqRn%v<2_3S|qw5tN zKAU)v44v7~A*;??qQghBf3o-;;g1o%C(J(MxG*30CB(Qk+3v_%t|ZElH$JvKN0@y~ zsxXgBE*bfmhqz>on{Vk9i_QY*kah0U0!xSQDbY?jbjVt+I!oscVfJHplc8S?eX^#@ zck!9$c7&UR`H1*&GV~WipRD>jMTd`z*(WmYHiXX!GcERyl(W1CgxNR#mJFLUuu0bQ z@sFazzVo;+`%8Yyf_C`0J68IxK?u3d9p!w)dM+6@>tU0ubHKhJI?Tgl(OC%{vX&)J zboh9=NOV>~hpamDM2C->YelC4I%F?TSUA4x&-?@t-f3|&8F^a^9kSZoAUb>;-672W z`ypXo7ueU+CfnOjgr7vn?^95og^=5-vrCwD@=G$(4Iy2!o>PAmc{Ai>?Gye^Ic)OL z^l@Q6n&vkjXovkDS?4+qz&`3z$7}JK!r2H@$cTF%;*vG)a7$-|=(IwItofWQ@;1oH z-f;l9sgxt#nF#U2tFa%3oUCzYi4L!8>^J$%Tsrn^WQd(F3MU|}Bx4}94BF9hL)~U{!fof!a3-h7#N&IB)6sK`nUmDlwpXn;3Q_jkU%ZAsu zx#W0C-FpUQ_VvmOEN1RV| zPQdj=^?AKk_FJ4~F|XOW=1acCyhf{hp2gJ`*IV3RF~`*!x7A|aE2;cZi=Vcb<89U9 zbyoQei{G}G*HhJrL;tSKYpC*Yi!&{rXmOs!W_}v_2RdFi)lRv^H5RY3IAk%ei5fR- zv6-JH_B$>4E{mVH_>jd%EIwv2e;d=Zd={r#oNlq1pC)<8wd7`gn#gBc@&y(zwwTu} zO?R!uW`3I3X|v>JewxT1x8z+G@3WZKA+`Ue#b$n**g0Xz&HOZxoB3(N{_cY4I+LpSSps z#YZeYW-))O*1Y*F{@nBW`u)h^{%REYDCTLW&qaP&`jmNiksp{oL#OXopwFY|eyg_s zM7`5YywgH_){HyV`^2esQ6)Wfeq2;BPp@E?@e^`uR6b93jiU2^aeAHOM;phb#k>N6 zz})|GJfIGzopF3jN6s@_7*nR;g*vbwp7FVl1_p$T z?}tY>7qM3jw)5AFZH{%+sqHcdY2gwqToHo!VOmfo(4gd%R}* zA?L7$`=+Jv9E1Ad z&xTifby4=VVu!xo12v<^kk8_6d&gjJJ1X9fedoZdz5B$T*7Hyte2&r8VYjId&W9sw zz080f+nPGsquU83JKgXoJhOnzkA18kP4^IF_=}{)-^5Or?jN8e!**!nSvmA_47vYk zgYE;d=WgL14SJcnfl&310_^-HKq(jd{qV!#HGgJIi*0rHz+S2r9zwNuGRj^)>`~7T zoeSXA9`(^QBW`;V%8T}w28kXIh|IaC=LVGz;o#R>5ow2xZOqo2hkNWZPNOG3?$>|b z`C$_;nKUuSPxsmL!&Yr^Gcl1FLTxW|mKypz|JVm|NW(rW3%&sUX87gs--7Rf{{Wuv z`J};r3I2NcO8BqCZ-nPNIQ+fm33#@#uo@Yo6Y-;n_aftY`l^vvJM#kQ+B(#XWTOhM3{O*x~Co`7%p$%KU5mMaA#4 zPCghr(0pGe`v-nE74P~bvDwG-?u^NvG{rZhxjMM_!-nx|+HTNUQ>~Z!QtzMa@g+3) z7sL-i-F^Ji$#JWW7M$g@#)ncK@oXr;H>*6ZE$n=M^7)~`p@fvqk6JUlAtyD@3AVR{ zk{U+bi+YMjf8B+Oh<#^@BX#zzxWXZK#;m(9sWb3g+#|8B9n8SGdcdlqKb?5}%8ab7 z8wNV-Hcj6!(35p!-KNV`$Cr@xr$*RY|C1iCbN}!`!$RveA6<2{Hy+2mt=gO4u(#{V zwzGykFvL7vfsJl ziYrjpCSk^WX6+^VQ%oqQ4hBVOPr%4M;;!T9x2+vGa2`?zPJ}j+;MK)v2NU~hubl) zc;tnLM~;a^9pgpR_zOQd+d~J@b^r=TN0uKRS-O8@nW?`lJO3fnfBd?gm0?Vve5^LS zFVud=@@=6<1~y6chxht-goi|?c@+)Kz!b6eK$_Rh2XgyS;xjRayOUmv(>@D_bdl$Y zooAcF#ri1X(Og%36K1`2gc~{z{-$?5e*GFb_jmZ6D;57>#A*)PK6+y3%O>vrk;Tkv zM@iy?=U)J&{m-3TZF+8`aP_~Q*!h^GK=Vjt?vX+GKX7GkJVvXQO%!p_@pU`bm?DPS zF_U;(=(V`6XB&2OXLWRE21^oMt0^D;tFavUD$1yyR=}Ge*ywz0YrE!cW8$&UW9v}o zzd9+VU|?IQsXh3Trzc@0Oo^Rs|7x6t=&mdt3p1upUi9zS9Wa+)V5c@fOn%xyrbJ|mZMndj|_aJ+s({@ z?&is$rhAUugDgA~uXCL@PW~fI6nyvO%1aT|SSh;l#KOk{C5g!QrPWKKGd%gt!pE*e zd%By6<|ENyd*Q8En1wMK<}lI7BzZf<*9JZl7fJKO-@-z{*H0EtLQG?%XwC^^K~h6b zabezg$7`l?dh1R$Oz7J71Adf^-4HweIZJO@x@^T#EEG^uhfX`wEM8Doy=?j7a{tn0 z_5SLTnwpBGqtPYt`*N?vA)#vr+#HKpvrcH>y0|P>0zPv0ibs+f>Y2Oq%+SCCp70!$ zsUbfbSIK}`1fU?nxogFdbBmUqXv>#a66fGYb9Wwu{>%|wavkjm6!{9j7Zc7*+CDxw z`YWscwBeP8RXbYlO~PEy`}YiPn2^*kAv@Ua2_E>yx-~I@Fs{FI&L4@_sLuDBF%sh6 z8590t+{|r*pB@uzuU=nUeeRVT&)AyLH#59#TV=tSof+-8hneB#qj~+xON-`yv}z|} zneWz3af0Es>nAjFz`JL|x;Ag;4O=@zcU#W8&A$juD=PlDz~lIaG(ttbDVY01Jw7)l zuKK_i-@Mb;w*SY!&H7vJwgOmsBu0C4T*XJ;`$k}J?=+6-2KlbP?b{hxi#ho0^Bns< zJ^1-=CQaS*^Sr$J_sh=??)fhWyEYAO*yJA;81_^z(o4B!z=B7QwS?*$j5z73mJK&K z_=w`L#*~NS|G4R*w^o+tZu4DrThpMMW4wW$80VqkvGK`$-;MlM{MZ3SiE(LoO1rTGU4IWyF$UVtd!I%_g(5s=$+u`eA!^2=;p+!JvDQW#KdPiyP5Lg-wVr&%0KFT>m;r|chp8^{)cz^JJPa5X{WOxjiqd8 z^20FX&kS_;G;gza`0!!V>|n{ozCoK(Hl$^bjvsbaQR{`lKxy;V4QW}yJtsGecGkTT z?@RTE1~;Yb2$V%qz#RWko_p}_LdYMi^!QSPCF5qLjUSa9)B7c7M^8;h&rCPH+O+X) z>v6r_69{GSe&N!s<0XqjN7iOk6wUqEmx_pp-k6OuqoyNm!ZXO!L{}+%hd*V#Gizi; z?-(|gVA{Cm!r;h(59XYWt6@s<$G&SKeQ41g9|cDiKbV@ZA?@Op`?~JW+0zjyb*)@3 z*Q-6VI!ilBF4>P`E90%^$*bONJQEYr_w9WarR&=6?a^4USKXJ)WuLeZpmnb%fd!mL0A$`=2x zlc?TccTz*sqphjF_2EtaO{u*%;H#<=P+6|6eT#x=7Y_^JXdvpoYG3He&Y1YCoaQy5 z6kn5D&B5@#_21;dll-^66*0Pj8`F5mD?D&OLA=YfT$njmMYpXO5 zjUVX*M@(*Rg&l8e#~A1Sg9Cl%y|c;FvckV(#1|n&{$1O_vUy z6ZTBQJzN?q)D>Z6fHRyOY1w_P`k8iBPQ<{k=rri zi;W8&jOnm(jZOYS3r;o4$P4>V_4M;^;b|bG`Y&lJkOTd4~#vY3OXu3nkR< zJ`N@HJ57Un2RNMrJJP0LKT7gk94@H5qx&d+kW-X?0+})^5I}X+aVW>56<(BvMZ^-Y z=1Jz7-WUgEU$;4?;PsOQ?_+5K_Gu+p!r%q>O7L9VUk7{?-!%Akxqiy`QbR9%G!VX0K9kmJ)47^;$h!p#a( z6y_*gCm z+_3|&F3i5v_<|U->OymBrDKxn#;Up4>d<43qs^ZJ| z$zW*j^cXii^cq-1QMX>&fV(3f30dSFu(m-EOsE6?P)sok8|JQ*t@F^$3F(~|aw!|Nx6s-E*Stm$f+ z%T-TAuWhKihRj!16r9OcwEo6MuTz?q6!KsJpoYo@EVUHToptc_Lqn10S>esIUV3d^ zN=)x-9*z-;2CV4W?YE5HoLF>ldFk$~{oU#O)@{T9GBvdKc~5A?Pjj%+$1MGR@~oE* zHooG)N;K^)``ep)+Cxn%bS0W}y^bU5nD`zKt1S17U{w-|8)dk06i)jj6t`#hOfEUo zR}n*df8yDYfnA8&f?K8!u$V|+rkd}Vb?{Ki$hgLB9=F`#mi3kH+8_}VMSrgD32%)S zZm!bGcomh=xY;9_I~$q9r-SV*M3(ho70)SXgX-Y6YUH9`T{R@8F~+l_d!l|9efzdx z+PMdQ*S7U=T2e>a@Q>orjs_xI_(uC3xvjq|+Emc{cPCJiRP@|6jqf-e8AYKN8a5{t z-F{8OHh)J|QRSYP-fuctiR;FUs4R@>o#eb#oK%?_(|DaznHf`Xg;Vfbl&vxpQ?Sly zJcN=A#Vx`^tuYvr_=Y+Ld+%^Y9git^$=OgfcSBV%D=3?5*ho9YIz6}*#(~=y)A+m- zXrDJGSuqRkG*EP}mbEl_$LBBTNJh@+5DM^(X&s_C$b+eo*D8i%kRt2!6p4C)^f zb>(G0g9WVG{aw2o8lGZ5@3t;#OQc|#{Vu3*VIa>fj89FCDhu!J3d zuw+;;ZD?iTkR55m+R;Mgo_60*+_xaH)?pAXWOO?IF?V2bdO;|q$b_+@Erpw&!z?_BEtQtF}+yl@5z|neJ6d1 z50Aee$M@NjDboj}Vda|dU@UfSQKzT%cfMgQPp&E2bOtkdUig8o@ORfdJ%}rRIfv8E zJMcT4ywL1Be`AWaorsTfLcc3oIk>bWslbD8k9`x@6BKzvTI&6sF^#W$yzV?xpGe1? zVrOG5wc!t}Hr>*!mtJoi4LMd``(-y*A&ayJjC9X&_Uz`GR2iLL-ukkue`s6lJ)x3y zo09jmhi+Zhc1GL2&edBVbN6wrD(k}d3ZH59w68)t=w~;wR#gE8{K)3Ihtq_c05Z$RTY6r>b7zCjzRD=<1*kvd&RCFng7htFJQg}={B z@>{eQ{|EkW{Jr7BC#h1f1^45#!W*g6Zsg&U&e#F6<{!tBzO#I1`p$3*q+`h`&PQ0Y zPe+>3``kSy-uZp|thKbJO`kRUs)DPgO_@F2T4#&PZ=JHoxuo5}N`QC9+#JW10Ee9E zuCmp7M%#!P_@Xh1xXHEGz`78}w4+-t9UF8Vu1#2n%Xen> zuW_2lu4@zDzN7V4uEd2K;g&gFEfX5tGF+P&(Rq89FSThkemC0?ZrJe3U+y0|&cNUA zA38pw(|Ri+Z=TS|p`qFP^8LvJhXodtuW9r+W8>m+Xq}&qj43#HGPHW%ar40Iz=Bct zV)$zA4%{*O6lX)A=v#bT71;mkx`i=;%(>^kGrPLNUdPjaTgl>uP?OR&@`mLzp-Io4x!e?Q^+rc|oCWg#9{mOIy@Ftw3qnq?(RQCs+# z1_eWIO|0AfTri@vr0kYct1EH{>gr2s@pI9_rKW_H%j=idR@kNEw_5F8bIcDxQI*Sj z#V`mGX-6YyOQmOY2xIv-#^(UkcHU28TlqnK|C5l;ulH%E~Hg>Pt!& zSFpWRk2~E_|FlRmukmBO41Z=tm4DU^Q~bBp`KM3IzhTPgf7=j$E2EXt5-e-Gy!N(= zEMu^K*)l(#M%UJhMQK)_mZiROd=BML&;REz@Hz7BLEk{fz5~yw%{xVWClZ$cGv9;n z4gDJ44?h6Pc?eSxHXzJqWcWD@VPFkIyp;49Lm1e{5C-@@zvIWdI7}oDYdbS+aGY;5 zgaOV2qk%EJ7l47eCQNWzO-NaPcM^^-DDk;J-|;aHogBnxonXf4b(=f6{r_+|Ld{cj z$an7O@R-{;-H$3W4v#&IYnG7Nrqlh=VV1kwNnriLMeo<`ba%I@D^dMKW*$|C`BY|J zm1$R*c~)k=m6>;CTmO@oWl?>WNBNWVZF#yC7Z_Ql(GOvCln!Weyq zbkre#0iN-gN47cgCGd3AAu~Uea}G1z>Fl!(W8fL8KF=?D#`VMV=NvN6MLOCc^CwEm z`F`<<~GO6*TB;z&wU)EN%hgm1v{$AVNCY zA;-fr?sj-O%GGH-Gylv3!@=;>p9HUQzX+ydT(ZiifVF-Kz;x6hGd}Hn4PMK|JZqga zg6U3|AH2S5^22ZxJnc+_S3CLOAtEnANJl&5;qcV2g^v-gM@VMfpnr-XC&%2>M)=Cxh9J1Mq&Z+D`-X9H8D!mj2D)i$vZG*7n0Wt}H+8aE_23 zM^9W|o9CRLEYZmW^EgreW-$H?mk{7iSLb{OoB3g=`Q$mrV?aBs4?4yrYduV*5RP)P z_5&qgZHJX$y3?gQ5pt%hA=A19p6+z|d`3lmhI+ndg0=0jUbQ{vgSG61V7k-U)OMmF zb=arrdB^vN^*Hi4&{2o1W#nC#PuoMmCCaan$rjp3#6bc{>RfT#Xf z;kAs_U^EF+{#y{LoyB0LO*>(D)%gKfb+&*pjlt+VWyzlg>p9W`W}3{yE_m&SUj*Zk zpox1JAsuzdS|@)5Yg$LZn&+cnwRsGzZR~s~>v6mYtU4Eilc5)YpH72tOpC1be3d0P z3izjeDbEYqV#s(*gLR|%jBeX$*vGVPgdZ!s4k43Z{1Cjx{gx%a8_aYVm;L`x;cW?nT$UgQ1-JW%AXA*7>yvYx*mf>j4kP$PAI7FhF>1W1P-?N0>L2051saNH)do@3xE zz~>>P&ey@3w+FzQ)^@PwzZXnh`XgXE+9d07IRR!HqYmH6*S4YW#8aQF?JXUwZEOsf zajC<#3V0p{;B&xgpL0{$H&K2Qc%*OxSnKnfU^?0%PeT}h-vidPeg(##(cxTEt%pBR zC~~r%gIq^J^<9dhYB8(@~GC_4byfa~4h(9zNb*hsF0d*MC{h#Wvuc94>bf>eU*DZ!x z&n#atd;q>2UfcPdU_Hmzg6U3Ylh-q*%aBcrI^$)VHcQ~Az>_=RRp$Y4zR3TCkdAT5 zypB?TATk+)kn%y`ERjzF(@{=lNd3z#IeDDOZvk@`^%euNMczgs9OYzfW1Oo(M>$#h zke9*SMfm}M_Py^>2uC@27((VJiJ6C^oUC>xS#ok7_6OjXgD(^ggXtKTtZ6-C$;qRz zKLG!Gu;%Seu+}Ztz*6~Wu%1(sz+aNMbznp>X|X?1oz>t=MCS>x+UW!{P5Ogije7{J zW&gm^KMu|meSaJPj^!fj`OEoxYX35D9`@7z?Up`ykjR6UoIFwFKLu-kIxYQfu-fkd zbDTu`{{+)9KV;q$QhqTn7I2i4^;(k)*7kWLSksyZ)-mnZz?#-7u#P{!ZOL1}dX0O? zl5YiT86N}FF%M)tH}_g{vgU_#zv-w?R{NaDqxoUSsAbGyCkaP=vZg!5l9Tm1ap8U*to9$XbjVsiyDT|b+r}YFPS)$o`(UmA<6v#Kap<@hh51PY ztBwz>$MIZtZg4C+S@Sv8l9T<|PdnFIa&o%JZ?)uPZ38V}J$HJ+nuk4L&F70?t&`Wl z8utWP%b0=;YTQ(?9*c?0I2;2q4?XjF8Cc7H1z3-Jp6JllbTAzQvR)HsgEj7rU`=-( zSnH?OlGlT^jok&NV?frnu@kKKN52GXe)fTNT=522kIP>yowvbSKktF*7?3re{{pK` zKCe_e0})Z>31GD|*pd$cvyAk~V6DURs0_!n$Z9hktYw*G>5w%)Uj%EqxnQaV;HMMd zXp^k^*I070%D-&M$ts@j;IFw--D;4oIDbq@*a5FpnMm++Ia~~ zM>$!K`$4ek9|CJ#9R}+d`zV->amgC@12E$T;Qt9vM;&!qKWy{V(~$Z+x9Co%Pr1hZ zyi7eh9$$5*etRK9cbPD@-z;p7(?&<_A7lD03Ylm8!VtAT%Zx=RoNV@IMeQFKd0ta# z_H%UB=VCD`ZQCs(>X*;y^>TM>Gk1+wJ^v1T@UpD5OhrtIx2`ZhqZW)$2fiZyqg_V)C?4WnOR zelwzw_ZTte$!woWtXZYP-qzZ4WwGWAvG-rsw*iVZt2y?GVx3veuVj;bKn%8R7i*qo z_eo;S6I*+`xNid#Yo3bqiDI3b`Zmn|o1?bpM{O^N+AfXSE{obOkJ_$?+P2RI<`08X z%l-S`^59jW&&8U%e0!T$)jk(%dLMh6qnNiZ#8az0I?<&&8URUG44az70^Uv&i&^DrA4D{UBxB=DOJGxQ$m0 zBaYi+WSh^Qhv59oi`uWx?ih*srBVA=L~Y*_waw>N>KGrdvPK-Y{}8q9VMi^F`_22p z)^=Xh{tDS<%?&{>7?f@HJVVf5{6Mw~&Gr>$El--8Xtt*~`fQ2i9D@Gg46BJUeLhQ4 z$L--!+asd3-QR%S7}U>?+Fu;CT^6;i&zWd}@$ZuTSmT)4Pmepz)z*)8*H zZZThWF-rX2N=aP>zqw+z7cRwTTWac;EuFux=C+Bhj9+}2AJOP<3vYu&QWNuKOZz15 zn@9684;^nZ)tw^89C*HP#J6$gmzB&fD@`|(){#U_dUpE4y4sTT?8x_Bv{0D7URzf& zAD_a(=U(b7YL}KQ=0|(%&&HsH<`X!0Jtz`gWSAq5sqYSQ#2{)hxB5@}($FVkrc^S|Ibm~(*N^R{dRu-&s`bKx{6zuS1c{7=x_1g{}LA8UR>7qZLr8^qdxz4 zu0H8&RR81Oze1yM8zN5Hn&qWv_5F_m8(i7AiBB=LomqtoMr=C+0 zbCIfF7WL6I)1uu4O(GpizZ^xZe|on=J4@^4e?rG&Qdt=FZ82PxtPXtXva)5?X&7mZ zeO;Y5z*>XXq1l@#M!}WbeQKiLg^TG8PJ#Dtz6I3(=giTTkz$%a(r1-n!)r z>nl!I9=T30W$SRAhl6A|4#|`g$a2l+KF?MBFFJDjYji};eX4KlTtkWboJHl__VB?F zoY4_Bc7*x7R&_Y`Q06lnWj?D`<}+Glzs2bmXIjiBC90ooG4Bgh&S&<@xfbVHoNsZV z#WO6PY4L1}dH1gN=aH|)Kez?(%HRp*a_=*d%oi-+a^O{-OO{78d1R@Fd`nJ|=PURJ zHv`^NV$eJp^OU+goANT3i^=6KvlyNVmlu#FE$-I*R9o`JWJ#-rEcve|OS&t`lI|+9 zq}xE2GOi^{x*@XlSj|%j0bCrshZQXD6WMy?=3xfmOxz_dCm`@Fb=haJIljwWxjDYV z=J*OTd5^H4%tFJZ!+UNuXr4HGBrT&akG%ZUsdaUX{vu1i&gCrX+~Trn52A0{!va@s z+JorlQeQZa%!-H0hxaTuXr8EgZgY7CX`N*_M0hZB)ArM)wz#+C#9Gx z2(R)svgn7&Qa@WP-b(&D{=sdB_k6>k`SzIFd7N^|L#M@0Tiiu%z(2TM@T$LuyqZ$H zzY6aO8g%nXXP80*`P4IpoTHU0iV*^Bz8yBl8hH(DGPMs>M$i-WZmJdJYUl@`a7$KxLy*?W~i^WFjV z)3IreHTa9*QSj7fdC6WGcV$x!9Uj{+2^SzV^#Fb5pRD$IxuQPH&PyGc$3KsZgLxgo z8-!~SvOJWtZ4M!`@xqa{PKJW1Lw$3sg-2U*9%j{H`=%Y1h3vfs|KL~!)M2}0KFIk9 zi-l>QmrS)&PKF(pk*xW_;dGKGy6x7~8#2rH>v@h*&i2nbA}1qk6lUA*6=wTA)8p#+ z!B-2XgYOj11am$Z?a=nf7%`uUJevE(cRVn z5AG>=P4{QQyAXC;@)ya7TaS>e=^nClek=S3goiEpyJW;&iIA-6{>#$&SlC>jJ$?D% zd;!K?h5ckr_fkt|vTzNBCuGD8Auid=1`PL?%jY}B2@B5%Pa**nXXoA>jPF3;Jc zqH`a1k+q-4vK%H4t&o#7|7TK;xI8ZgTO1HxjnKTG4;}V5Qz=JT*uKbW=W5Eu&b1cL z7p9$RGUA32m#lGXM2C4W-(?g#YemjJY`rk&W^E+H&KB4qtDWzQ4(+sC{4+B2w?d!n zy#WBXOLRCt>^WinM*BJ$`rDyHR{MM}SIfxXddYuB__igFmwxO~#3g%YGbLP0D2G1t z&+jji*}o1I=6o;y-ph0!hdx=;<@XCTUB35A{vyI0OMX2WaXS&0?483@F&|lUST4>% zpw82flhyuW(P6#aD!c+=y(PbwjJREhOZM_23-?{o=|K2H(b)w#S?%*Xjhg?*g?A$4 zJIN~NZ_ngrg#RtfKK@lQ(%l1_WVQJ_(P5t75`G&Yf3sGb0}-Eb_aQFXE6;HFJ2rJV zm+lLq^E`COYJa5Y(0-=yID{8ka=!CSJ065rl9ASnutQcm*NP79m~SpZzZf#}{a`TV z0}v;f128xrd~&jTeKF%<$f53zX(68qzCv`$5pw9mxCsbh&cvn81tOhY_>GD>D_F1=NFK=|< z&W5Kx>%`PEbXZShF9%t0=6(t~)nL<3z+VN=foI&s2;uXzbbqf;h%+R^8;bp`B0d1 z6F;)#K5R3s^AVm)Mm~9tkiD!BxKScc7WU3JV#myLlzf`83gV_>7umbO)j?BslF_(0 zZ)UCVM1<>wTM!-;rjE%E^mD-`KbN`3_cCnL&H?DoBSX$(YQ{NW*6lNv{12kf`-4Py z#wBM6^Si}C;Vy)~6#f|DTf)>a-y}v{&JUZ;K3USbmJB)PnelxkayqzHI1z06f5^#i zSaE&Wrar%?n9Q zFCcu};vO>MLd_v--}o!hVY~gc@HT|BMVqf7JS_Yn!arJklnk4Ggk-gOoN~nF9N81X zv@- z@BT{oMT9R1^ZY$XM%-M)C42dh1Mc^t!@0a~3!gyvE*biH&>?Fb{!?_APsU-MdH<1$ zG^n2seX`n5qZ~S%@0%^m`w8<*19Hyy{i4Xz5l$n+P9f}&y}v4MfR4vI_4Yj&}o3I zQ*`EG7um~`5{~^N?d(DLtT4;SZOS<&XJ1J^10lbIOXj^rob-DOV27;rnMk?BHTMx< zKARaPa`FYj1vp0Brv6xjlgX$b7J=-Qc92qtergbxtnK+fM2GX9%{>Kl>Y-!qDdd=%`v}NaLQd9W zx|?w!Uj;c?kLh!iqaOIo>44}oK!>dL@Ve;mej*0tr=7LXA?qb^ZgsJl%qQg0AZwdbuA)k3MZc7a6M0gp(No3ezTr+Nj&SJ=_EgkdR z3Gz2^0DdfT+UNCvHYqw6;Se7l{N&Knk+XT_pFGS;;-31Kx^ zih=bkA!KbTbOxxMVQBq?`%{5uefpJJXzK)isuX@L(aLU{H>47{bPi?5MFI@2^n#D zzAP1aJwncbrJU{;B4=9fSn_z}Lv_w3BQ56bVqw-{uEkS@sl&2qp66QfWx{N$Axpl; zk{_}7sBkGl&L^c!_94eD9S>|#&ORiLjC_tkc&0G-rwDTn<#>xZCsgC+Sn{dDEDPs> zQipv}p(SVgpd2dBb(Wm-Kq;r2ZOJ(gRPEd(a@KdH#hm*|9Ukk&mfZBiC>M|8dGIVF z^PVO=3L!)h`6a?72+@TZIs4r!$*}Ji_SOR6Zh)svj(<#F3T9n#oBHVp$=*fy2e%xa z`gb5S{Un(4dYdVSekMY)w+{c{Ho#N=0fZaL(8&_^-U5Kz0Z*MjA^a&BI@!XS&u-D_ zMfeM0wu`-F=ubpQ_AbCbINonio+GUJiSf8;@t)e;FF+?3I%L(!6dnGyFjkm-^L1qC z=Ru$B<)8&_uIR9@E)`~<&3glui*1Sflvj{pCm(UiUREj`maC8Gd|Px1At!rpGb--A z18lZI_I=Uky~2ZJ*qi}1vexZhk@Ffw_VS>??WY`exK73q(U}c7S?l2)(RmMHEUyKy z&$dAJuA~)&a*aqr$gwYV=0Q$YJ7Yv=62gmwmm@47Lw^DE$==%maMy_r>y7sS)G3FY ztU6_u&N5-zthMBgWW=pTT(aipZqW%N+#ouOp+nYs`+?{@gYZ$&seukz%Wm!qP>0kp z<9wvWCPDV{1c7^6qVUW;!e!~QDRC#(GhqO%-fg)sG(2-E%=;UwT!0^v68ypHfy;fW~k-^i%9R@4<)>-?DL{1f2`;TYIIDaCBHpC_C@#Q;H zOe+`RdBR^nI9!-xuu){h4I?gD`|2#w;hHfMg=yys;pqscDkBfqlVN8I?2y&Y9MPGF zaK3N_!ct+jnI*z?2y28nc4#ES=2qAwd%q5VYZLi)VedDL*y)hCoPYR3Vb;&jMgLK# zk+p806&*v4qrMN2+w*x17V^t%auw-+)l(LYupP& zCkNpdg*i6P7v>r>v&e}1G~$vqZn5Za-I}GM(*+%}w*dfmo9OU7S}QucASbJx^`gVI zZI~YO&vEw;g<1Be$jHMU#3g%I(>k85iF}{1H)zCW>`pt3`Ogi}T50CdQzQz$xI+vX-=j^!)Kuz3jjWPOge z*wVR8m}}nLAXKNFoj2wxUvc@GM6 zY|Cxd!|xHkAXPv(*%zK}I3UjTUSa|BNJq#A6{y1UkUn0!0 zd7dz@U)QJ{;dR2Du~@T2m^$-?>k(FxQT8LOXRwYFzAo~&At&oNt&wu%jce_ETbOI@ zY$U_ZJJ2WV@oKYlIxK$J;_bp*n`Z|Zc8Di^A=S#)^r{9O1sg!?V| z%fcTZ{JX_x2p>gwj>W0Mc(mx=qahFEOv;frRGDFK2mp5pJoCvsplXbcPuSZCfV&=^ zag&6-O_bt!EIj4O!rt|i%Cjuk{2q7>Jaw2avf8{`IES)5}re~VOo{{E;u&tg7nP!7TFmG68n?^heHI_E_)Ux7vG|0= z{7p@5@^>_4-jgfyw@Kw3i}Nj>Y4JRZt1Yg#xWVFPi(4(`y|bqKsKrlPyvO1fEq=q| zx5>$FogcS24t;~llPu=Fs>(Ah<~^y(^Zvi;z6ZXlt4jCY+yEi>wx(%HV+!>q4Q)yR z14X15oeKq;Qd&bB5G$1=1R7$145U-!;TTe+Hw=!5m{P=fX^fU4Xp5+b#erBcBFwa% zS{bG&tvrY6s}9zxOl@D^_wBRRx$B}2J`+x_?;dnuO$`p8d7o0U|ut- zzSQ7ygDVWKG`QN}8sZ|a-X??B7|d%!wb^3uPJ?-!s5bizK5X!DgHIZK*5LC7zhQ6= z)_djWvm3>6gU1>?#o!qRR~fv};0A;Fj7Rxf4c=_dT zKV|UK2ESl1pIfQ@YX8It~a>Z;B^Kk z4c=yOr@?y+K49=u20v}^3kIJv_%(xhA*X$h8C*zwwYP4U8eDF01@XH)n@WSL4Xz=M zdp1o5uQ7N7aj|E!#o(O=?;28ob%y?FM%n{J6nS8r*B}a|WL=_!WaM7@UoZeC=QsZ3cH5yvN`J20vx+(+0m_@HvBDGngM3Xy0Q77aCk@ zaJj)123HzfZE%gjO$M(qc!R-P4Blz*E`#?QeAwXQ2A?$etik6Ee#79Lywo@p7#ufv ztie+Zo?&p6!3zy;Fu29wR)aSiyxrh#gC95eNrQV0e$L=C2EStP1%tCMOZ7d^;E@KG z89d40gu!zRUSM#&!OaG*GdOARHiJ72-ed3qgP$_^X@g%d_?*G78O#rs{P}Nip~0mF zmm6GRaHYZ32G%@Ir$d3~n*F)!@wrZ#THx;KvPq(%@c$pELN3!LJy6!QgCM6YCtvGkB!I zWd=_&IAQP{gBKWFZ*a50>kLjByv^WFgZCJGz~HA0e%jy{3_eFZ+B??2W-uQNs6Iw~ zt!GncaH+xN#MgN?6$V!tTupqvXH#Qvlfi2Y-eB++gLfLd%i#S6A2#^7!6ywqYw&r4 z-!M1__b0T?{B}@r+~BdqW4wM%F?fc-RR%949_!gR5Rdb43-Ndlw-UeG!<&iAJscXp z`s2&t-4$^Qy}TlBP_$}EQ|(L2!H6CKJ%hz7 z0{MOX^f@o3=^TA*tV7cQOucI1wQtD^{3C1QlW~A@#+T^;mKi*orkC)2CrY!8577R7 z>!wrmGXevRWhT$0gCd3>SKt5dK$SSJr30`!H>CsEq&!Rd&VvVCLcCQD+TQxE9BiS1 z#=*5eG`@u%BFER)w$z5k*R5VHrKt6Grt}>K4oT_c)N4b^$T)uvX8HbeJwMRF?7+U7 zqD-$hwWFpi0(v{HW+5|_$S{~*fr zyF$3}>D#-Mt7EeT`j};08@wU;Q&xoxL-nW7Ty!|Rp&o?EqBMuc7aIlHdVSZFe#Umi zGVDR_P?OoftR|Ta`dvx}GEZAa1~Truhzw8yo$6iw;h@8(gh1ZHJXs z1g8#coG*AS)3T2_q`swMdFHX4dw!2t z`4XZ>Trs za`XEM+rDz}Rl|sUxJBgi)d%>Rk>0FiV#nm70N)1iwL(We+m9YIC3BDNe$%jiKpD%>+F!jeTryssQ2KdSh z-<5`s-}YI)SU-IHPTRI`lHubcT;{R8^84%T+g|MCk0;SXNU4yi?kKcJ%zAB_kT?y|;+xngW z-yZOB>=<~9LizX|h~;ZR+6wb1HDagP{n;&r0r#(g?3#s7w;TCNTut7O_TyvF6DK6E zaDHmL@iu|>vLSa4j%8otK^e9s}h)G>KK%ExcjEngG( z*1&{(y#2tu7y`dQY^@i$F{pI{(n^^CW0N(*9Cqu77I||r|RfTqx z(Xg|8EsH%a@=ZffzPSNDK9}VGO;b@mzSm^=&VY~a0Fv)!1m)BJ*{s|55T3Is2RTX2 z;NDk4tmDGxcltlzq4vx0dl_4A0VV<8Phq{Y#E#>V4I=U?AMc&Vkyg<*ycOUpU6I

jHcSz*nqfV#j0&>}>lg!B+@9+cz6Q`92ijd!Zjbersd-Y7E~T!?!WO$CKE6 zy#c=M;A`QDvxxG2 zKfw3gN~}3JK_uUu2-?0s1o&cjFF{^qbBxOOYJe}kKD9ln4PPnWeL@=MPRjb>dl&4; zo$$;;Qw$%Le!qS51AH_3;hP)at1^68s(rrug-`dRd%$PcE4H1XD^Tw?*!>6eDmpG- z4Ak3zdifqP$N3`&I?hi8__pBWYlM=C9g}|_;46HKfVIKmmB?U$8!csGwc*It>f~2*rCh5bi!_mpYrUO{E6^s)=AiH z*92nnQTT3LHsS;mkb(`~w;mk71_b7DyYX8hErVpJc{KRUM9{p`0lo|1qaFDg5tNVi zx-9@hIXswRJy?#Y5`lJkp2|NrMKY8#6TW!N0BF6uhBVVCwB-w-5dY`7irRU%k5;c5 zzj*x0y2f|M%i}5Wu=hK8(j=EL;XUP(r#MuT`^lMeW`)Db#PRrO+L*j?qt}Q@uF^7` zpWfim75L?&KYqecg>WyzClMY(_;bpRQ*XW1`m?v*`g7Ltr*M~`&@2SbiHphT)i>XD zXB_uoS1((+0^49}d~|&%cl2ucCt`6vHK5k%mfgEzNqzjj)wmg`y3yk%Oj^xCar~FY z)w#AP{_UX_r+P8|BjNZs|JR}0)UGb-@xTF;wfFjJR~y?r`H|4MB}d>xAhI{>baqK? z_QcvD>qGpc@xa`UQ{itPEJ{v8cIS5wpU&RB>pOEFo2I$X9}IPMwsxI*ej^T*aJGB! zd~zDhdVWxrZr8E)&2Jxku0NKJ9e@1x!EYs}y*m1umqr&qJG#VCGrKRhS zz_n)XufnIZ_hyM|ZpWC{zCAT-=s&*Y+Pr&L+vpa>4Y;OEZhsWiPI*;~Fo)+4h)zi5p#*dNFT`Hk_a%)#lrKjmCxkf>rf_HjgSIOqa z1Nk1_*SST9dDQta8!I>d;gaz1OGA@i48?L{@7$ZyUfcec?d!`Qdmz#NKwWKK>!$ep z1MiP-|J?i!zdzn3V|^$)R&?ucJifZl*2i9~d;X^*j=ldx_MwQUO#Wugi|zRzFWGee zvz_HVM=F}X9q&5AQy8>-^D(Wz7MG^~7D~Rj{WqOWL=l*SS1*^O&PJQ$Fxw@;5y_Wt+b1 zb0cT!#@*N;+qWiBf8`d;_%_p8mfYBdZ$vvg`%u2D9Y+&3Ej_wBRQckR-%OpfF&{(E zUY8$=bRC)0KB0YD`&_S;n~RPXg({y(9*HgAG^6K8-l1$5Xx7kzP^{s=Gwl!6#7kUIfAv%Y9w(~druZmI1uf^fLB2}p_k7tgK3@v+R{^@*--qw<$ zd<@lXC3|2Ten<3v=);d-=uKXFDTiOY=1GCzpAHc)4XSo6rLD%Xo#I?MYHlk zFLiEywlmq&x#8uPPCa|9XWx;+y~Dh5*f|C}Mcvnb<)xaJUbc~^Nj*Jl(n)scq&s>k zD*aI5xUda7U zpLxrzcMM=dmOEyCXaFmZ>7sU%*N0-cvBEFrmT!L`vFm}(hvT2fn*XDmc>Cw(H{{HI zAewB;3GK|`s-4f*$Rx%cjP zr)MTMr?C%9@o~AwU+SH^uQ}2 z$F>A@Xn}hMxad~AlMtGB*UUxJrr-6!IrFM#E}C;|^~^h`&AIFS<+;J9yt>T)Dcfdpkyk$ z7JAw-rqG5Mx8q#d2NAP7)F%pHWf&Eu$yK$$``V2w1l%eJ|^Ldj_~vY<>q!Aty2S3v$x;CWU%pZQBT= zCoV>Q3Br4UNk#i9z(u0J6PQ9h@wJFc5Y`wyvDUlA=!tnrT!L^MSo`vfu^}cmZT{Kl ziFtp8`Y1ZCZR0a5o}W`szn~PBC+0DV`Wub?Bw#K<)PDdt3o-2zz-$lGGl4186YD(Z zb1ud7QB0u?v6ihddSZ?^39RksGpI7r^LY`4oW$c1)BY$hIjHXi=Ke|j zDPV2S{{W`YhFItP>qbw^e3s3^f}ot)z&al;;X(nS9kJ@^$4u=DjlS5}6EjJE{!bGM zc~o?r;oKk>V@f6)&MVq5*6qt@EIMvefM+AHt~LZ6lWo9!mQVec5Y)aKnCBhTe-(j} zsosmV%`4?`D$Wl5ChcBC#MQ33+(+|L380AUO-dEUd_%~dTW5w|MZba5&H6mcV(QbnM#5^;M%N)vITZquAm zDT%llY|}g%q$J`zirRE(DghL6t8Ypb30>#kW8|?eALBVImF>0$UUTtE=LsM!t~by zY5KlUVg9cJ>4=$<%pVy@PmnbC^?d9Pd>?|sbs-<~e{sOxzGpzb&4K(crtuZyV2JbN zMT>buHkAJA-s)A0GQ1Jl$Hu)$w|Yf0-U4h{nod!_ViDdeT%E35z3g7Tyqunc7n=D7 zB5x?BTjK`cqSedRE?LyDq^WtyDnC;S;J#whk`=zz^@R;uB)2G0Qzlkt!h4R3c*`+E zaaQZ@JErGhm=?Jg*YT$H>Lo3GGu=C;Iz(t=S~@LJyL!b0m+d-Tzlg6*FKSx0x@FPo zhT5j4mG}GP&T{pVzr1hBip5LP8P_gZwUUEVyP`flqq(WJW$DUQ%NL1-Pqvuc*wRau zFK+(0uXR;$1GLoM+gFJV>nq&|_t{kFsW(+H?9KPp@ilSQu)NtX=hsk&Yc*fHa#_9G z?v54jQfJs4tgD}`!K{mKXV=ixi~8Bp%;jtJy1o3q$rR0)k*?%~@OP4avV3*(lI1dc z>Xy{EG_77l#i}K>^^5B6Te{RvZs^k{i)&e0UEXWd9J0lATn<9&KM99XAM>0+^*qih z=DMI5x2k;1HAeNg-1l*umsVc4Nzdfw-}~&cks;`hArfThX(L z;R&7%s}GBw6l(9rcA{tF#+J{&AZ~1>t_0Fr){U*`E2$SehnQrLDg@P68|=nb?A_Q3 zuAvPtup#vbTDF0BGPT}wCiS(}jC7cdg|r~3AF?&XQ>pd*Er;Ld;Z{W2{td+J93+XL z`ppJ2FD&WAL(I0^Ogt2JI3H*fJ==9wFxz!y*t6k17v85~SyJ&FOUr&#Fz>U_jy7yN zeU+&V-_<4NJr~;1hJAX$*f5WJ_K)R>^ zW>EXPiD6%cm^dnH2v;(-Sz<8f2JOcpCRYAd>ZJ`27~Dw=`*Os@QCW+2Q7`s9e^UJS z#IT=)m^jMLL4J%t{S?8`H~{1s1eWEtdx01>6^MzW#rT2zI|B6y!P@3OP%mwGU2q6v z|EAGj%54D~x6K9fe%v+0;G6+lV&!!Ivr9O~i~S_Tybq*x%_c_KN|YszmHLfrWf#DPILb)~`Dd|VUw$bz3!x`ge)`_izWhe;9}vH0 z^jt~`cu@}_j$Z4ayOJ!x4x2y{k^6tA%ps1J5qb9l_~P*?k7ekc<*C_;Flxb zdp&Bi*VsHS_(jA&6U_TKzcn`b94l}xLCp7ViD@&(;N`^9hE<|x8#r%h&wGV#y#gMF zed-&cC;qYE8gTO7A$d4%uNoWo{}@r0_qHxa8FKPo7~h8^-h}vr2J;$D^`91;fc-xR zW?B9(0_Dj;ns_YYB7@5Xv%l{X%(Byset}@#Q@h9LnPy)oO-9f6vRM~7zb}|$#dox* zC;o%MZyB76JS}^#ORL-f6Q;)JQB6jOJFz?HA4Ojgy1oQs;%f#U4?nbQq{1$_Hc8yrumPb7} zM<6Z{n@O-Cj!p!Cj1e2I)6>O<#~R}3jn2fa)#Twi?bc`1Re>yGt&8_qXv6jRUSilJ zU_-3!+#>oJ&=YIf4(d_%3y8leHr$59YV(BHd<*eW!Q2=5emd)#1AF2qI|w-~Hr%gY z7Mm*QiIwxb*!&LhTVhiU8)CKLJu$Y8&j7{}qb{!V#A?IucWA@={~C00&;%f@>7oS;MSPQ>p2A41RlyPJBHZ9rM# zsGJY)7JEJ?;Qb=<@L9qS1oL^rj|6ia_$R@<_wD{K3hd89_oC=|@B3xJG1&iBFrO>@ zUND~}WFfFUO=u5slsBm%1)^^j9OWd0Tr2t(!O@$XIy9bow1I2gWWl`8&NY;JK6|)D z@a>3a3+6K$rfI|RasN{hm}}%b(R0pl9j6VSH*no2UW%Cax`_E)ifOg^8)Ecp4Vp(B z`9`FvuJ*sOz|I4ai{`>2NvpH&%Q}}=r=%59OVuOIY~Xr{tv`2 zhz-{(VlDfxV#9U&*J867HpFUkDbjqun?f7~CxyFH0ThoRo<=OU*JlU@rJGyS=Kz09 z^fAPp#8Q^j#NCLC3@#PS%{`VFJb8knJn4dPn5ZWQar7_n1GyW4`a;3c1OUXHx1+8$ zV6N}987Ww8n8)^PL(H+DOUq%YVc-*dETft-3C8SEc+3!7Zmpz{G7pO41UGn3kGLn z{ZgJhgGU-%W-!k`)jnbH9E171L2c>{ZZ>$G!94D${WgO;4c=q$0fV11n9n7Y$9=;o zV|C8xUo$v_^-Aq|j8R-@u=B|+Jmp4TVQ{6v)dq8&SI#Db*BI=4atr?!qu*)pE`#?Q zeAwXQ26GM9dYw;h;XiNmZy21Dow9d6xy3$i^v)-@=%*O{41=9dZn0Tt^zM5+(L0~q zf?JJ^^T{px?MB~iu=B|+HvEQ8``Bx+^T{nXXN=zY4~DO|bLH zE!g?w=D`Hwd~yqRKDh<+g@~}=n8D5`x9Cfa-udJfz4OT}*!koZTuu9Tc=gs8++^^e zeQu>a#qb_f;q^ApA&UCt%3$MrzUbG+J&72A$A1Qb2OMw#wxYIapql*>gEAbH(W3e# ztJ0o}Wbmq#$&-qEs5c1rL}Djx$>6m`pAPoxg$4#Pn*FrH9~FNb2XyZO&c3BC+D6|T zRu^l>psOBSZRwll&*hLMj@=1|Z1?^W_pC_>H3TA9&YbW*2yw!ta6X7vQ{pJdTXZbX zJT4D2B#m9t$u|5d2NjBWT1=ckpiIGuHp`O_hYz2x0ob;0JJLLdR8hXgP*}bh;N!U? z`LMkCe4BwS-{VO0+)zdN9)!a3Z3Z9Doya##^4Q+*Ay~cy63T%rAAd)1f=Wm!PV%+C z!;xkgrvDYe^6?z73_2C%ehCWOzH;#K+?VZ(N*?)QC~x_ikWda}`*@h>6I4QWnfCE< zkG8KOz}HN2Bbwwr8DefrN`H2hFybleKz6qapWF&^d=EQj?}v3U+%I-I|6({N<9!ho z?K|(Q+VR_u{vJjnIDWj$(f+#gWu%pl=P+{l;wY8xa{<1VxHnJ9$IBz-<9&Jj`Fv%_ zn2xlH^6d}sZH{~Qoym74g7W=D_;g$vks*h8N6ESvcu$D2_Jik2`W_z*wcZ@q5htjG zOe)58FeW_f#V+92TM^*n|CP(MU-Dg3%Xbo!nRevEko$c12%q+2Klr$IsAxaj`8<@` z5B|@Buc{GZ?Z*Rwde5WYI7nD8A6LnW*>QOde3|<3UP|P&*7|y_s>xfDP?51b}F>NTX3ZIw4GvI#geidk68QNEkLhSEo1nuuz0lq!p zg7VQGroNQo-a$DsVeb3o$pgl)`ujMItFco&r8_;+S}$)s z7_gULX2It?+JZm%Fs(gx3#ZZ_}(Y8W_>uct8m>Pzk1{2 z2g~34-K>rCLQ{87sa*HR$G=hj=y$V@&J86ScHcO^^38R--iuF%?g)M4#_f;I|F;Y4 zc1^?k-UqT~&4%VsBv!N@Q!ghpE_eFZJ4W1n+0;$#;n>ilrFcJJ*tM0n{Bl8dG`Ue5 zHfus?!F9dwJw4=5mVR`3dv3?>*a;}|9*KKQ_vCiW&g~u6_Vw1*L&{ zT9LKGPvqW{i|?!aQs5br)6?0VGV9nq^zQ1rcdxt9x~cr$DGSy-x_jyThkk!zXvzX* zUe2zFnYud~BaQWqub=O|# z#9?AAyI=ReX~KW)M#j*vXFM+ZzxI0>Z=QMcjZIL|cdB{$!+lIHgWU0wn8)Q31fH9* z9F|PCrgDF$9$j)mJu&xL>SrR<34Ro@mfZ!coZkeduq^Qh5LouN2w4c!{|@2P2-LTM zMD-hhIquYNA~}Ti#6u8M&*$9CqJ9g2+VlAeg?eJO=kpc{^~78f$n$r=Jl`RH%-9es z=huO=kk7JD0Bc!2#lZl5<=y+V9B zHuWy8v9~X6x>m70&ND5)+xHvnt~}kG(RciKSkQN(*iXH`Q9vyBC3x+8#mek`$^T$U5d{dR6)zIU+>G5Lvk4#Vw8ycY3#Vw_NLAMY0Z`>_4@2|j@M zyx^;$Uy49`?h~IR1`qco?z_}e9yEI1LslE^uUZ$+dsWYKWyN0+%zcdeqH^vrdhUzL z!|`Oajb}WzR3AaOg=s`B(6Zr$8V~iDfl+Tl}68VB--4K z_(Mj&Snx8$OO1ZHVDhaJyaw@og4qUcCvtL)-XM4r;s*tDOtuhXoH?h6qq5U}!Px8; z%yo9JV6Mg7mgMJt_g%r1mmHA&LHeBB)3Fe&Qd?o)b*v}vaKlc@4<)0%q zY{Pu9DT58M^7Hu!dC2eHp8*f&3vpETuXSR>V@W45Y|3Fn9F_eJN&lIP#oT84yoO_> zm~B-|F2$USiYpD~+*5sx!A%BpZmA9DlHx4}?=+ZWr#AZyK5X!DgHIZK*5LC7zhQ6= z#z*-J42~N-*5D}yb31C;DucPbRNr85i@~i1|7rJlGah>ecgr(V(Sh#vWhxW;ul1`u z3ENF2TfkL_i4&3@i~WT2ipv0o*yVA4bDd-w*-jcH)`)qOxd_C17Sx{|*Vddt*ew)3 zuIm)?Y1^4*T?|_#*7k9q;rWh=miaUkw!e>~0H2Yuzu4vd{vHHoaqhR2(ySC_TI>Bj zFw3b_!)}Tu5Ni{DVlcBe!;bw|QM;$1u$vWmjf zP*}c6;G-S+c!*Ix+JnNEI5HAY=0U^yXh$5pZm+@V?2n;W(R#VG>l|R-VKn}Ksu5zf zd-sH!QWxq# zvh7f~x%YE>S?=r$`nX% z7T%_QUL40wEQB&Q?UQ(w#BE+&(o?GTXl|BACiR!}l&Pjqp1(~#ku|b%-M$mK@Luxh zl>Eo;-S@+6KQETkI_74t9yptU8U32T@RljDTN}HMY0tD@ez~okm!ct^YvT{?xG~W! z8y}kcca+B7zz}xzlzR=0y#hx_Jqa(da97*(5426cBbGBR$Mqdvlyn<=&a*HMZw~W( ztNdzcTHd@-JY}3*8~Vcf*v?pVZ}<~g?GrrO&7WJhudVZwYD+rA!pwX?PD zWb3Ox|M`Oty#FKXV_*F7kwf9Xd8EB~;#}@t*c;!>?U*OZI8r0-2;zW;kMe)#A$htUFMAp2IbA%-FQq7_S5X5-CG+jpZ&RqbGPU2YTMe7uiNN_ z#$9c(+dTf*kUM{JI#zl7?xQbru_)Zy-CXo=J2;z*k_Yzf%6YbXPEU8$sh=MEp=XbE za?F&j?sc)@MZ1$(59cl|TRy$JvZthA_AS^sWmm$&dFnkUa+h;SN~v~F!dUr=jvY5* zEo?k76g!f?bD`kui9MZPGG=2YG|t=Fy{>9gYu>}HZOcN_f12G>n!jsR`SHW*-3_H) z9^Y1)-@6r__S)+6+qx?^-R~+NCWF|$p(y!S4(uAo_VgscE*Y%vhMpccI#W%@m@!+s zTX%nogU~xXrHAG2GS_~evxS@;$42*d*`>2_bX)f}94|@>9>XTtQk48r&R*F^-Jm9O zPUpVb`$nwr{DsfC{N9|{rKx&4jukuY$-2jKZtF4n-SM{Wbw$Z!&Zebp>`pSL@jzR5 ztJ8e9ts9L=<{bRyLFiEXc2<4xJ4MN@rTOP_+J=V?e(zx8{S8y^>})N6?C_mGdH$D0 zS#ZPHb|kOsWOnr7t&RDy+^$(sPl~>`|vU`_q?T*>+ylUwzoUFBVFX*j16lr~= z)z8{-B?wk^SFT+X8=Gor;}ULeNBg-5*CSBB7J)b0h&Ln9hWKv{-U3X?R2N_RW*K?; zJEP4QvC)|PV-YBsICa%i8Bs8?KP%7 z10|FF9O!A!Sm#L#|_Q!?2UK~EdTluR~k6KxoC92o1)YYJ1`|vz1){shB4(&wc-9i9>x^%5c3GZw(+i*j^{^!DVgdjhMqi(na{G^ z&vd^I&VSm{W;{Z>;BO;V`vbr@H*hwGjGj*vwCrJndw?mK+BOAxmSL=YsQ{*AvbS@I zmt^^ z|2wd9@(p&?|IX-t4@}MygbTphN517w$<)Wm(6bCSDbmKWzjN+Ry<8=Jnt_e}Nz)LG)^T`eM5H?(zJk+a-7qPgVPwZzj!LK9M%KoR$) zYf2T7J8-IrxG%9aMSG4*N+Rw*?ASD)+@&PqzNE5g`PfQS5%(WvZ2q)V0w@x?Igp+i zNaHfwNW?uMOerGH8=Xya4yPm%x;>QuinwE9N)>Tm_S^KGsf4q?E0CTSNOPS?NyL5C zY14N0uzs1EV)CEww~aTbQqtG&oq2!;vxs{G(%N5{O1S)Y2GaKKA)Pw7BWZ6$u>42e5k(8-0oj+_e;g_4u`WF!^j1Z;lI9smerQ?<7h=9Jzd_PPF8^lV?;Fnw^5IqRK){~=UrmMO`JF0-X9)RN zFZew##Y@i)-6m7{}6Cj;rP2GZXRq`x0XpOQ3>8~Ip|`0bAh+mm_+Xc7M7b--Dk_iU8^ z37fCp&|TTGdi=N9WlNXAtCx9EsAbvmC8dj3u2|i|e==KIPA_TJj~x7{c~t5|OUuWFAA9w8D3QKUsUBdr28{V&r0)P<~XSd zy1Vn6->=KMbXE?q{6`YMXkQBqSkSXu`ZiL(an4npjB;O^W%ySo_@?OMMoQJ!d7<~O zkr%bBbe&GUyVY++eJBErUb1Q#zO2%(xRy6BbG{MN6kdtCWh-h|rTqK#t#GxYT7>Nz z^aa@0_OEK2ment7`FIHZ;mks`!g>$vTSA8f-WT~XSj)1%^0vF*QWlY^&JCL3<+;A3 zecx#7Yg1Rddf8&Uhlf3ERV_Y6OO3gi)YhM&QKxw(>`SeE3hdpwG5Qv$y|1NVCEn=% zcyK}JzX-Y0-AsR_3_20<2j*dE=YfnF$HOf}@H(qLs1Qt7fy_czEzpp)F2j}oMz^S6Y*z&bUp9B@4 zMR);n30}+mtALwNuZzg{&C|yRz8U=-`e~H?%5&5x2L^qQl7}+IG2-`m20U(r<Bu)_K4oK zC*j%iSKI0EOi%B41UnwVj>lY9gsuG?uWTP4tN)>EP+sKYHZ*hp|yIo9%ukw_xu0%<&>-U6%=-iCd z11@c}LDFI6StK@WTa(zZjl{~sIjMDhQf#<=iFF)4B{rK8^R8mSwfKP$>)dej4ez~; zfsXAcklS{|(V6&xxG{mAeIZtT5isp(ORRd1BlT=EadZ}bAdbH*h1H(dy9LmbpEx=v zWm9l{3a8maAGF6b3Kg&;5aOsDk9eq{-^6ipHJ)#4C@ zXahalNE{Wt8&7r$LL8N2rR&Rhr*>s@&c6?;0(2;Wn0N1p7a(pUW`z*fM_~4aSm%lB z3+y>&??PbN4#Z3ob3Jf<0p=3H>dDD=5l8RF4`ecemYqcm8}^qt`Vss@!t}I2hDR>$AtSrK{bM*Kkb zBT)Z6#0Lc*MvUp}Y*;U`ZacTVV2>%}zCB@CZj<*S5OZytP7Hpwfmqj~+0?`4Fygz2 zVZ-f3tlNT{jW!1mFC~Tzw->Q)izez}^F73Fy8w>?{%h)C&uvGnoExc!&0)l!A%+dN z9kFtLo_g4P5AoNCVS^!cShw%B)K9_>#BC#Bjt{YJ7q_;@y>k<{jbOuZAXc7RfeT>B zrzuOaJp9*){{?B)J3nw@^NP{GYB0yW;63<(5Jwj~=p8#y_6{VcBG88IBvzYSsE17z z;znZFu${!wdi+3EA!vJA1^))I8$;N0+qp4Z0swgkLG8PUVZ&`ltlMI@vH6DBaC;H! zws6N>w2e=mdc}s@i&%M{re4P9l-O{45i8Fb>V@Zj5u-hE#KcifD9F%oisxO#uqlO} zIC`%$2{|9h#oqSf_Z+k-Ll$wAg9b@ZFE+EqhWiMy+VGnXZBL!pa9$8=zZ%7cb7QsG zaLN&DzgorS3~V-u%@o)WYn%B!5$od9zORT)1#F1*cyUbh3FwKV4FHg*sV~O&awz+f z*vx>QSoh^~V#958gUsP&i0SWuW%++nrV3_X=(mjHRtX+r?Qe~-aeg#mGY2-rYV+TW z4ZkBG59ckhj*0WBiF#Sr7sZ}WM!zKX)vzblW5-v;hW7M%M$QGWA=Y{i8=GTdvk*4K zS}*;g={BV=H1gEIhFE#diw*1gqu6j4BUYX;@|1`7^2x)^L9FM`?-D)NKVm(9zK(k7 zJAI_FY%^?#qsssw3ysaaV$%XWag;kfq(k&;1V`oC^1J+bzk zJ`S{P{~$ISU_-2Ze@<*Tm)!A%2Q)|tLIH3#;!6c{cO#D0;RoW@;cL8e0j`0x=ek53 zU5+1-aH$7aK0MmPdBj}QAzWX=IM1ZS5yE9e-hLjw-oxBi!(%+m{Vgo#bqQkb?2t-? zu$)J6j)vI~2tsj~oK+Bdgawa$V3qy7o&SxzA`HYlx+fO~lei*G}o<2I{4cu5GLYvJ*l3 zxQkf&xSv@1c$irFc$^q>m~s+9`*@akD7D_Vyo%pIT5(P|g$oRh8$8xvuHky0VTQr( z`@9@iRmgpxC%D1bv>41aS$X)qk>c$JcN6D&oR1s)q`|$!xQ3!UXYd(=UorRsF*i6Q z8|#VUJcCCPU*g%689d401o5Sw%^ZWdR;#|A_#K{2v%%{OP7>#NHvC3Qai_t1h%fVO zxZWy$%3!Xm`Yrei26J6i{c8q?uy*M8;?CdXX`1+Ovs4a8iKAX^OHY49#$?v#-I1|K%q`I{7*lSY5mU>=*5=M95%vQv8cYEqjx zvAkyB{7njW{w4)Gf0IRC+nm2i!Oq{L;0E%H^la!uNpY*e&flciIDeCZoxe%J&fg@? zw<*rwq~Koi2!77sGX^_Y`1$UBPu=6)5*!i0j?EFm%cK#*>JAadcoxe%J z&flcq5Y|QIcm5_t@BB>)cK#*>JAadcoxe%J&flcqYQtGWe2v#f=WkLleIluTgTa5& zH_EB!NEx1sr@NFi&x-myB~Q1^{P@iMTeiU%iUYqzK2;rz9iMj&%6UNg4w63J1NacQSW)Xkbl|n1kMq?O zwOI%*V&$y@7csE!nYeKopLyM(oxE)_keQjI-cVnJ(!6=%ZM^}Ss@!JL8K6YpRce3& zX-m|gY~AZ6gKBu%nnn>KTeHNs*HN*Rqwv)X7 z>7?5-ecu{f*^4Y>1NGHk!roRN{ZeS(KsBT-d2g$hw336U$u5&`t0G%);1Ty0*Nb%< z%j%%(cT4bprC(&ZoOdUII30I#6@G~mE`@V>+`!oYT!RosU>+||`CNl(oFY1@$FE#| zxisx4cOnoc5GaYb_nfK*7?(Ld-+Exn$NLb<0qEm(f)i9i*2TT{)Bxj@+~?a3Z24GD zE@OdGd|wuvpc0add-wKhfQKQl4eakfAy~f6NXsn*pcLOf2u@H5IS}{mMb!WgM^HX@ zUju0!ziq&o_#&v(j^ESq6d!LZC|?EaZ2NZh!^iikE#EoA$6E@@_ptz9x8xymLOaUR z03RP1alC2}cxyrV=-&!|et&lXXPPe$2l!&(<2G~L)AXtQ@|q~llP;1ysvKg zs=-$clNy985tPr}lR;YBcSiCMIZ?j*1AMzo`*>SG`Mw)y-&x7?*gQMpZw2`F8$Mkt zIG%3=_|8E`y^6N)4*|Zz;46hu4FX@2()Nvyq>tZg$crPWDBtz4BTh)hS@6{WGw|NC z^3@0UcrP(i`xXWGW|XAb2Wp@1;Q(J8d`aZ1X#2JW_!_{+dx$kKyaqwrcO<~K3pSb7 zE8dH@{pH~4{xRC{xqC}U>wGx?J}a8!^CV(KPWrRs{VA?b1KH`9W^zl|`LJR+71qTt z5uISH?K_Ob3u=UzeWZ*7AWkp=DKEu6cG%Vc^L9P+xE+@QSiYTEo*zPFIiVe;7JxXx z1Y|n~?L6Wd1l|H?9{D~EVEM+P<8mtyxt<;4WPmSuZEAhyt#jr3Mu2Yy_{Nezgm#p# z1^7C_*93hH0v{_VpSzcaw2ogh_;|chQNA|-Y(IE^Gn3slICxsS)_&|h7_dwBW5@3? zEFbTmW?KK&!j5fCNW)`zW~1|&?;vP@p9t{n>4%T^;w)c<;k(K3y%gZ<1)n_Xa4jJR z<#d3r349gM*C6nH4{hJ2*buhA7rO~b3-mPze}SNU?j9e~Fn7{~jC{e2l<(dE-@>xge4ZwD+&^{)+SdvKxur}x zpYO{7z81rGv)GaEIpNcFV+Z)OP2}U)GSIK39p_FMZKr{VmU##4h!djUjC#4|*C0I$ zfqAU=wgBH0Z0}6xC9?v2op^@GTlzH!l?clBV1SSJo-^^a1^5mazS)NFu<+@))X02< zi4z@{3xRrhZ=3JlsOY%-Hc;==s8`pQ+hMHzD9Q20S?m4#e(L?G*kSWI;XUsj!Hl%t z55tZ)K_#RD&m{SLt_GO%TI<~$sCOfX*;Y|zmF5jCr$B64D9!D zK^&E#5tCe)tt8$hzLDU)D9bA)e&JI7?3B)Pb;r66MXZj_;UMWg&)UOqdDc}M z_Bew+&nmilVqT8t^DN~#?d|cvcUl_Hn2nVi|8PloI3L$ft_|<&4s~^g@2q`SU9EHz z?y|aSN8b69pN@F_+TMw=oY^)(+DZM9cUuN~nv3GSPAlrGO5aV)3vSlr9@Gjgw? zUndmsG##6Y8$Y!PF3*e(#dpUmMjFj0pt<@;DD-S6+>fQo9vcOpQ1>>jg#)^j7Nw7k zbpEhXhEuOvd*9mhO1f%C!E#IyJZ;$)cGX@D^})iP;t{*D(*3D5UfEVWqBp-YdH54_ z7U}w&>hPv3Vrl)#Eodtqbtuxfy{-7_9oyGFyyNp*8e8Fg%Wo8_nVlbK=fOO5Xzi{N zZ*2Azk9hV--icv4cJpVyqpdjpQt?PQ>neVi=cwyQ72I@{bd_LeLOnCbEJeO;P!VwfAGYTwTJ1;lm|&2o%> zR!{L2Yv*B@;jvJBlHNVPk6*8@;*lOne-6Ilcg~zUZ{}Uq7j^U%F!J`d(?eo8^!jxo z8;xzB=2dh0|2e;3Ji<_TmPo;Y--+rq)_jfEh#ikQ6xxLy^0*X}PqDSJn4D^3G3!u0 z>ro8o`^&a~WQ?&iW>i;SZ%%i8qCBO`nO!houpuL_s{HZp)5+n~}N+urOt)dNM zN+uf~t!cxUlF0@KaA(7qV_SltXNvzB_D>5x`n7BXG@pyO@%QKUX|m#C^qP^W&)mP{fT* zN)>T;+iZGtD&g#}4W!Eg>FWdO8v^OEfwUbxw#S}TGRApToLlI{mab|GygV8v)%cjc<8SK`JIyH z-k*>8@KhlGU(@oh4P7dG6Zfio_@v^ymMW}|@5ZYzJui@M3Zx$hq;~|;yw|QmzJCm) ze;G()Bl$x6pwF1A0{PH=9OWGF78`HNK;SomF4X@o)DU}r{~I)K8n`ML*O4|(XfAa z5vDs`K{@5|eNc#x8Kej4Lt}7GE7F|oq>nUTC(vyGoWX-d zxWw(w?k8O8VV)T%=2=15941xoY|P zCVJTM$N|Wm8GAQN+;Kv`HQ;^Mu;_WVp?V%)^c#e@u_-k+Jo;-{9{03tIWZqhKu8_t zX(fbF_$CM4*`=0EQ2!oJKZ96q?o|@=1{GuuLRd~otBCm^08)*hcmc7Tt}P_y&3#A> zLO6jRNIin;8;GUvO~lfMW@6dyEyUCCBcku&yKNzt4Q`w#cm{5qZ}u?n$@1G|3UO38 zc}U9I4X0`@yO|;@>^Nr^n{C1c^9OVN)2+#Zq!H!8u6*PH29Kn9uf!dG^ou0Tj0x%>J@0>m`oL{&F?-D9ft_ z?l!bxy~I)3k2oEbGa>kC#GIeB=k_O#%Dk$kUfT0fvElY4j>>$i7n@epyGm?0ZHSd; zt=O<%8^ng2iCB3yiw&=uc8Cr4W8&y!{6IPp*dEsPI5FBBM@+1B9iU#?{C#5Blp-e9 zx_%@!v9`HJY}jVL-^2DKU_-2J{!6i8-`9%G4A>Ay zrvgBdqOTOJ-;!^UvgH4U*l@lOt6!1t8XKN}vkg_SA=d9A-FK`Qle5r0D>j^K#A-u- zjyfji#byC)i1jp0&*y_DtmR;;%PHpDv4HDa?7@k+62h7GZ-Xl@AWdHZ6u0I8X9IH$ zq@MdVadZNHAVmoDU%|~ckr*~H!O@!mMD*Jzme+5i@`$;ZK?)JVvaZI7seqIr=(k9m z-(gk=;T%=}NC{$TGob$+7Tck9Iew{&`=r+8IHj%%>aq4xDiO3U&JV4thFI$2xT|lj zH3n}mcndL(S(Kd!igy{j-{8Zzc@QD1XCB61AY$@sHV@Q=3og@ zmz9Gpk#+?+m_md4z6JepFIV%sg3$Q-+LqeT_`21r2YA67rOf8*@0$czUHoGb8O(t` z5)m`rfAIQ!kqX^)y?g{==D+|Yf)ii>bDd-vwtl~Fyr(+h`LP__yYInL7kj~9Z0$UG zTb0;?1Jr}5HE8Mqz63z4F#!k7<|gZ(>q~%8D2_D_OR@hh*d$<{Kd30isfW`iBx6IK zciupImZu$$-?vIy4x#S2PrZur&47Y9AsJi1R|-tN2mfdaEw$wo+>Ec`T$=O z@^~(#LOaU30N+^f@f?Kh|Qi#&A27vwG13n!;-q%pRQvp7n^U7&o8sAR>d}|C} z-0;!oKHE3Zl@5hIg#_zTVIIS6VyE+9Gn5r-gjmbaXFqX5^0uJfN?>lcYY?;__XXmf*JZIM@&uk<4C_@2= z6HGwj1qe{Ezt%~99P1|o8VK;>aBDAAy6Fx76;|c77{b1f_V23}y zecRAJuBmJv>t`O@_eg;6W$@A0ii*~|Gr-54h<4=Tm?|IbP4UonEOH5C@>X53*ySPS fu?bVbmy>7==a7ol%YDnJLwj(-u$z^MsNMetmE^;f diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libp256m.a index fdd57f31859ac785b818128ef912828c212b77a9..addefaad9504e68198c221d72713888de4b9e051 100644 GIT binary patch literal 1382 zcmdr~%}&BV5Z(&Wq$dwPz%+$^f?0rg_2R;bZyIatgd}>v>_lorex~mV@VhfpE<$aG0cRpB;_INU*8%9 z_xwk~@EO+&0$?^KKg^J@g6G^DfnCICtIHKYYYO}w{5vI uyDEFus=jBd$KZ|suxHHw{Zbvn47PWw4>>9F&(NaEzx-=EbphO}?9?azB)|Ru literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=s6bY=b3<=%ZkY5tS(+K^`j^sb67Lv9lDS?a$=R%wk|rIa>3ZY# z)hwKI+i{Au_9z(oyvIBibVsJa=RD+*kS3+cLny4zRVkNOt(;Otw(J-$_11MNl~O~J z6nOyFNE+ppD^Ic*tw&R67!4n(H+KC#h5pen@TqOFA}iATK!|B{YMT9_7|goN3nnI4 zPt5UnJ}FGYV8lJaAcI1v5Wj5OmhD(oyLPM%5UWh{WXQ*oFu@msVC@O_LGc5@S>xue z5DC|NA`IKK-ChqS>yuV_QQ&lI8Gv{NCO99GnnUGXg6{wWlCT~H#yI+MKJ2+z z0WE>lKc;?QN^NLoNRboR^E##);8Udj8A@dJFaH{*E?~B8FlFk8DY;GYDcX3a9DD0K gm6OZb?>qI|o!=c}h^KXo-GfijzF_PY2Hpl^pI4*{)Bpeg literal 2474 zcmeGd%SyvQaB6)<4|-A1%X;wvx{a~%g$iw{S||!u!GoBl=}IfMkt9kz`6K?MU!XHh zHm;>Xy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedx509.a index c066e067b6f3a7666e2d670967fdf991f7c96062..2023313aa4c4342d64a7fefec83affe5fc00c0d8 100644 GIT binary patch literal 102274 zcmc${4SZC^y*_@1q-uKcum9g4Tdvad zPj^(WDJ!jCU$<)GgKO*NuBxi3s@D>|%4^HYEM6OfwRL5yO3P|3{&iIqHD#r%N`v*m zRS%WbR+VoXT%a;oS7{a4dc%x)t18OsSJfe6aD6;t+&{R!VpYxN^@E2D6tArd*3|`9 zZLCAqg0;cwx`84!!Rr2;#nY*;8q6128%O}pRZweSK-t!QD+=P$8s^QSgOSt00u0_k zLLMyJwyLgbd)cbWvh^EH_7{mz^HpoBHzw*Me5+`MI*U>&qsQrp+h|di@oAaOb-@ZtP*qL& zhAX5lM227%VM9>Y)z?A6&EE(n>@Q%w2z+o=t0Q5ZSA*-8@JnrFIQ$G%#5eTDKWBey~E8nXcJTW96=^ z?XO`LVgwCR;mr|N4PCXA*g(!f>JNkmwiMY)d8Z22tXjLFy4q5nhQOdE?GGA|gZ`j8 zP@}*GbR3Bi)ujV&J&6LU%SEM4$ZVoiRbAcYvRc;c%Lpl|0k?obxvn5J$o)N$M&1@{ zgIg}6(nG=ZRi#z+pGIrkyvk~8g7sAo8NKdhSmT}SWn|U_>#EkG+-uMzf>kw^o4O?{ z@}|a)qpGy5roO7Y%5v9Ej1b&hU%3JIhi#&-`BYH`@01d0*~@+!xgl?{{dDH1KK2s* zAsfr82Q%AXjYvj9&`|9FL2L&@*K#Q^M8%b%SE{&D?6Spfq53qnsb9B29!dK1&J143 z;-DJB;s~L|ueZL8ncl?)gL7so-_@zImoE#}mrY+geZ!h{*9)(Bkq+WnSF1cz#T$dX zBIi(Vfpcch7D?vMoi)cudv)p;Ze3ig>pETr4X10L)B3M8ZS`owf3`T~YWXsBPLbvw z*8APDyEN^P?VL*+cM$@Q#bOj|=rGR2EkEkVBFu74zqm7p{ZMkrb6n<-;XkKMb0@9v zdz&3@FLiJpbwG=qsoV0lji2Q4?zUIyyJE3J$w%!c8F2fEMHTHm?%p0(!SK9T?5Ojc zUGui+wXYr8@!^(Sn{$Cye3Q0G(~cKtn_{uzd0IHHp|Lya-=ASCzCkl$x~oOBovGer zd+71+?B4(LuqT{*yFZc_XpBj1X^= z1K!bkgGc%;veR#Mf?ukQev1viN5ScRTXSBmg?B~Unj#e$^N>-PsKW#EOiLbjF`CyD ziR2ksg+KB@dj?*8r^Fx5TNJH0U@Lw;hB(gmVqwoqCCDr6e$*+<3;CT%_l?n;wnrTu z`oYoqPFG;=MYrSjB4LuWf^otmVb8L@w7^O|Tm%)ikpbx>pG-nZqA-3Kce?G_dnUtc6w&F{R#t#@Nr>OH-MJ4rs_pZ!9wkFsD&|D_&;!!H?$1bK4n9x2HSQ3N0~NUeb$SdAv>_-0 z6%N^CHTAC3sL|wc7sIxOFLp;A`!gK=SZv%yw@oy#cq`Bl*V~-bG2XiKmKP6k5qMTk9ccWlK$ zWZtRmbOh4>zGA$&Ju|J@y89~HM`$XtJ}q_JMWLJ4&?(#M!Nj(%nfd{9pP+IvXP36q z7Md`tdBW@iOCv?0oI~DRJ=EIK^j$-JKia@L^ei}!yBKQSqx=J%e{VmLcDToFh)qik zG+*k-GcFdSdT+4<99qLp^q!OVXyLdQWR> zCT0ZoU2^J-R^r(OZAfF3pzI^1O|KowrnC|3$(*3JLf>g~+a`IIC-?R^3Wf)bZVg2h zXwvibaB|es()FwZVeZmH$xzs-d7HEq$w-zJ>2`bA6S*dud|(2aH=4OLKFh2@_P0pG zNMVu=7F5apB-qc5Sr|B?=O>3fO?UV9Xa&R3sU|UzBdV^Bf9((|Y;sg@sl3l?)Ym>E z*GKKh_r8@{RkC}8EJu~Tw1dc}tS6`sNA1wWK5tWR&)9--v<;gevct^GpJpF-aYgX< zqVOhfZY-MIv;w|VrmyHsFtQYa3sM7LzZ6csFXI;XHKEqhh#vwGY7)`sb?q%RPsZWO{+Wei%-Q=0)CU!3__(AiyRR36y`pfR?V_W9*v` zv5&0u2U7nUext(^O>KyDM}Bq3F@!)~gsgiXH&LXYgFE0aV#|&dAX{jccC^Z5txNaE zVmV_RV0io8@UUo7CGVk)$6~!%Y2i#o(#ifV!%3-`e%TnhKwM%k<5hF+Fd3o-enu zzJ6of{Ohl;z%MhK*G$K|?e%3U%Ju8lKU6&pZ}j{@a5^M>2%2WZTs3pX%o}Fp&zv_Y zvGy2O_akNH9NN1H)z7ZkRggH_wPdYGdR-46n>Jkgyu%P#Dz5z+T841d;yPRVn{Hgc zE3Ok&uxrDNK>6PeKC`oHSDP=P%{7{80tTOa5RJzlWs$drXIjFqvt0Wv*Apz)*_P`Z z?E{(LmB^<}n`Q~O=68yAgR~bVZCaj1-Ws1)?sxV9^0TyVX?Bj}SW90uyd2OUOPJ6&&pQkMR z4_WvbT_0zVkUL$*XEa?_KR2-t|KLO!`3;N>?4K;hwE}BPRDtw#Mk0H zLt=*WJ&p1+an2`B!9TbH9Qp(SwS~l41}-6%RecGu$M9cHJkh}S6JKNC)x=%{R}$wK znE6VFJ(yP}LrlLLC1zfEi=#i?N*u&4oPR1YZO|hzvY=szP{{ajJ|{8Nz9=#C>p-0# z5ABg5G3_x`V%p;tiD|cDiK+YNB&MCVNDQbwEHQ2NRf!9Mk4sGZ{Z8T%;I|}R4E&zN z)D!mxp&RYWxN!ufEhHkC{4!#_CI16_8t6xG=f z;AZ1c`4Tz|H`4dPKOLAll82a%(TJ&6k;G{@-z72iS|Ks@DwEiU^G=D$hv93%!@B)- ziL-EyN=$u!C^2Q8mYBMqH~GIMG4nCNwzzf1ZEL!Xs&eQ3A)U&@&BsAZc{(K{>`!ty zb^+;(1UC-{G37x0wl@pJ3+#5o3H#=wT!RpyBShVXif9MuNbe`@(b z$mOhrPs=@|_|Vkm2@jW3TT&;8lQrRI^HpkCK4HK>yVHtd(;s5^#4*5U`~ zx*@3&gjBtW4^Z}xa+?%ZQbtNv5vA==Qmnt2MPcIW*H{!GhXpYvo@mL-$yl<@(Nc~e zVR}IQs`X_xLoy8zR4T`-!_c#0@p%XGfp ztqPWwV%)KRLQ6cE`e45&Vi;9nyJgT;Ra`lrWJvo3#dMR)Sl5=N^ME@XX_b1_U=S7{p6L&Ql`cn|^QRoy?CU~O>y z`VDI}!7_cVHXVbH7{|wXTeUdXZeXuMZ@kGH-SDURUz(&Pyn+7?&)Z*wpK|E#g_{OI z%x5{e*~TgUpZ6HL?+qfS!WgdbKS7STke+ah?pogJflK1o{z=A>*H+w`h5#>X8lUR_XgysUosBG$LC@*Ul+po-l-hr=(bw; zN^k>@A|mo*nweCAP3@%JqxcpBoB0+ZfOT3q#m8qi;zAj)1AJS7$u|mz;-fBRz8wg77ki0hQVCuM2eEE7kUUmmU* zM!tH~H}cKIK{pS4tOv?5jK>=Mb6D#){$eEoA`w8Uii(?xQ z*1&K+N6^uJbV_bL^nx!aw}uWLn2;GgU<qI6{d392gf}zawPwSZIP^KdP_KhQPlYOCwL*)KMrQg8Dks&+Sx(F&vF#Y-7oQ- z-zAQ7x5(>de@OHfxnmwMS7mv`9&wB1u2|WGEobUkF-TcxSig4DJ{8TUP2be zUNQb9#?riFTw?Imc6^Ff<*97T*=IYR#iE-9{JaLa}T z$(3!7*m6BPUAw(^DVgscO+JS?5U&jvGIvzAZSmR~CnKNIY#cJI@=Vghdofv~O2o>5 z$;7-6Weo2!jB4k4#$9ah5n*;1%KKuHFl1uP(_*wfA#z~+CnzM$*x0oDKv&nUHZfg8 z%v%UFeT;c1OpN2^9Gm?p+?K0XMBUEgm<&Q>b3PaIb6&uL+pKb|i>Fz=)Z2hzNwlhII}wAkF<6Jku5M5rc``>vUM^KE0N4uj%ir2Vl9 zOg&ok*W;-gQoApD8&jJbT>#B1j{j#Y-#>TcT=y6u4yrp-Z?D+u3EcB8bSTD8Zu-`| zjtVd#2<1_Mxd}+f`7!HDE3hfDC=^`!g1)|-3(*KEUH z{jPR3Zm?o*L^xUWK-VCfV{3Cpr;Tkocp%qZ>>lZ~8Pi7G6WvLf;Rq*aFb9}*#vHbw z*ncNm()7{O z&*9e6Ck}+BbT+1F&+SA1(s;9mWLkzDXim}Y|KT&Ezk>N~1yi1xm(+Z4eWRu|A3W7` z;DFV$u7YVxTqX|*R#ZQM|IVvggI5Qv4g$3B`}o9cr9n$(n2{Mr3`-`Vqe_eOtsH6MoQ0H^c-s67pzWIf1 zD5s>t*6zLTF|9ABc^7MAKXf{@9^u>Fy|?v8Y2MfLu@{E@^X?<*u>b!2tHSyR`6&fm zTk;*xFx%CkRq&uJEV!x=mk$@UhJ8rz zVArq5o@soW6~rg&NdwNP5AuFAy4Izk{USYe?}<-{@v}ckoH8J8J!fQnQ};L7c3A~^ zpL0Sv(MK4Zn1CeO32M=6sKZI+l~def++Ri@yfF*$E!!QhQj$}ZlHrA^M>ZSsb%+;; zU< zpYkq(I==(^p_C8>L1XFjS69e0{%5u!fY3$ba#$pG0 z_-|=@YiwT8?RndFJ@({n-W=2eH*Ug7J(!h;AxDw#q;L-s*f)9Fee-S3A8VcCTkq`- z&l$UI>)!qO`qo{0H4T$tz@@ng_Z038wJmJgb+}KIJ|{|sTK^t-7lw?y!tU4oVdQmp zM<|%)T_@(E*)Y?HQf}A5j`@N)A73A*r0rO~ zyTx|=%ZVDNjz{dqMy+snT4(bCf9vrB$Ta~~v)b)C6THy&;VZeDmcQQd?!l<-_zhaiKewl9OOB-V`qNI_nAH2yT+|NV zOTMO~y?5xX$BI6fpVa=c@cWUk{SGbjfIIcz0o^@jO4xhkZ<))Bbn%E6@yx#g)+F^g%GxL)UzbI&q_)xu9b{<}&?|G`|1N6;Cir?}zFVZr@ zQ|^rx@6Yc#4%#Fmd#54&h&!dZgf*bUzua?F*4h_!+(M6x4EsBC!=BdV-O=)pb8K}= z;G}ZDvl&WEbLjGOSSd*<9J+g zrLWLAsBQC9={sTTi2pDi@6h*&`I;ZoK2TA1%#C*KjGsOT=Zra*7L3LAwK(P;DQ>;H zyS!pSSU=o%>2*ARMiA-jRnN?GG(6XOW>}x6%YFEzOT7GY>jl^3&JV|u1r?MX^S&nS zz9UKKC6=u1=Cg8KMPXC)=Y}j(6thVEvDn=Cjz?^GLUFrxe01tH^uXKKS!~z_2;GzSB`@n>&XOfw1kasbS-hGFTLg zg<88KOLw98#k|TQ*ff&IOaC^#y=O+(uD(s-AgmK|YLUH}jS*XK&vIdO2PR=BUhI`6OlH2{)h{?L)9Pe^HJU5W* zaE}?wCq#%oHWxR*?e_4Kk(_W_WK?)>1l-ZKmdYyI+^22Fe}{R_E9TDiPF{-H*D2bv z*M8fWtS$ExJNcW^aR(GIdyl0}NBsaJI z0a2gPrP6&o~?yPHLYmxabc#UyP^nvZW3;> zn2o<~IPRnYTgrj2N51GTiPXKY_Sw6)-BLBn9ga-cb`9)qFV52L_^x}{)Wt@o-MNip z6FjQy;ZYO2Y~>|2;he~<@TkayaB}3D<6b2s^5)LKr2pkPEBtq?l~jksy{IID*iAn% z6e}2RB!Op$HF#Q*sT%PsAqZMQk7QV#{CvO(<4vdOS;U78#qA9*YU4jC{(#Tf;k@$j zGnIar!~GR7i}$|3%8x~qNW^a>inm>~Bv@jy*7(zy5r(*^0*$|qDZPY5;I&IeFvDJz zVfY?{u>)g1VOYd-K*!unN$tMVU|y$ndHQtc_YL;P?i*t}ej-M%<81>TIaFyUoY_8M z;N*^4!$7K?$JdDM9RI>g!C{z-V%=HsM#XH?Hw z`oxUnzy)pmLO#;@@g5Z-5(Pj-@jQBk_>&yoDjYwVfRP;%`n5#|vbkcDC(_ zqrPVynZMh8)bZucrwjf~We&UzrgmWNa}$hXzA&{Bv-g$o9No4oIBvOZW^mM2`}kmn z_nx_-)*p!nyXL;M=3x3A;ZV@)c231z`Nsem6V!LNOzOdVUy2s;PjPSC{jBZyT0R%=G%(9wa$B6w{#ajMVZ%QG5pqtNzX#eF2qu&L#**>ZDw#}=M9i- z_D|a~j~*fa^m3$Htxde$=6p(f&t*IB(s6$bx$L3f(bF9&g{GZ0hoL?Gd|B1-wiFSqcS5LVn+( z2@LE?90Z+phT56s5ZyiJ)yCD@>#-O}nWWU#r4?riv-jK6Fnj7~>bM3B&SeA2 zWnZe7p#e?gZ4)J z9e90>EA>5B%6XTo*Oh$ON1Lc!}!2e182Pso2AZ<#(HM|Oq$6C#^J{w%!t__HHR zL;i{QWX7Kp$qV^&BmR(o5`L2M_t&S>{t@T>*IY`HB{#;g<;YF4*rt@1xZ3?QQ3}ZD z8vp2$*@3K=+_v$zBG;p~xkCPo6?ig%nb2g+qWB0W(PPam=!)h?4KT8iM%VPYF&{g2wY9pG3h3!7;-jczkADaI8tNKWPXyr9u#&?-`7E76>!x zGi=zVq@m--$rVR-sC3;W{ZgpE{pq$ORU8S#xpMoZ`V(b-@k~7<&Xqx_4v}I4*K2s7 zP8CvB_H8z|i%*7$#q(*(!5B#pzfpu*8;}%BC9qt31$`z;BNk(6B&M5A+bxaTE?yc5 zCV}l1vDg|_v0;d5P$MJ1M_6pd{lyk94Qu&MX0bVE#gjHl0~NulV+)JzxGFaErltbv zH#KxjbyXbM88@{m5No=fD7O3JQldbtReBjN*YZK_JWzU$o94AcmoDK(x&uG5f?7FGGJ8vt_n?^8WD`h4@ z*oW`7eO$;!OT`6T!RDH}%^NpvsI4z6y(#Wl9b8|&p|;xOwV}SUtoAM}+~b?CO>yc; zNy!)*lN{u!4Az!z3D%bRsyCEwUSHi!{*wxWw*z_^rv9yU3XJot+sq^{>+&IN^OvHgjX#o!mKNNmZN2F zp0571?B&_Z=U@4s(x9}e7N6y8sNH6mhUIbh-HUyO5rrovE@sy)#B?RAAH|9)uwIaq;q@(;A}H8FbIY>D3Mw|= zXKU7PL(sx9gWb5kbKwoz-6chN{5NyvY;n3_4o|c4#nlaYGqq*6FS+&3g?V#kBz8?h zU;Qt9KJ~F_y!F$3J7rdW;I~g#Yu|Sm5}(J(CT6De$Kbb5W@jG|KFS=d*~QH1elL5% z%npnPi!UN}_{2r6~P%G+dx1{&3#UA@D@%hb+a*ThsOfP_Zjlj%~7I_^- z*a&=W@C%FnZ_03fzcE6)L3>p4<%;Wh+HrZ!nm0nbQF{|-x?~(9Fw^6x)W^79pxq?x z&G|PY@CDY7E$JN*u{G^u5x-FTj+DoA8ptowt|Jj#K8_Li661oUeA1-7jPhBg&6oV2 z74iXdbrJSFB>7$x_E@Q{mGJ{YztvikjQ@FYT`KC2?xzNtn8(ELnW!S?w-9sA%RGs3 z59Q~QE&C;Lg(kV`1H^1R0?8Zdl z$gk5daG=oAW%-NmTY#Bvj`S!0E{UnbS0rXy2PI}YCnRP%e>LGG<`d5L#e>x#ACwx&4eX8&l^+uPsSf;1T+bQFxQxFcn$O%l2$r3Y& z^R_5M{YxY!$2}60qf}yRSyL_bJzJ5)lq4Tx>@ybEd7!Nn@g(M-N-{#Qu<0>ghHG5pER{1UU? ziF(L?aJS+}2d0jTBxc^rBxar-l$d$iBQb5bPh#3o)K%~>e=kUXAI^V}n0ewnW~RkF zjgy$V1tq51r4kncel^S4xDXazf6rmem?WErb(4n^BRAo)Z;3{1WmQilGlE|kZg(XIig%iYqSY1T>1 zG#`?fap|bTJva;frOv$Nq_aZ8@m5F7aA7y#cwBS4@KajaoRtnvmClQza!Y1&bjfG8scLLL?dnNnLbg%Fd|CDV-TDKYg#QbiPZUPQs z>Xj=o!|8N(W^lshOdO8YHyxPrbO|zixsXnkugI^gt0IqR3#%a`@+jMa$QLsNC-Mau zeh1{kwaQl(F&i=*^%QLiGE*gH|2IQoemg%~Vy+2MAo1NO9O^~O}LehUV@V6yqUis|+ z)1uA(B5@%wzfqt+_5Ux4sY8;@@TYxT64QUA#MEt~#AAUcnPe79oCW{25|;p%n`G)F zCeI#;7XmM{8|lsf{zr*@z%3F}{s$)iXH58ciSr>tr{ktX8#^R!z}aQO%o}BxSLTga z20QT7qO}la z;Mo#?ADC&Sv+&_~>mp{|;O#{DGc983$onWU^CIp?z~s1D`m=8EmZRi9D>3C)OH6t3 zOpdtBQ;qZ||5k}9ACZ{y-;kKP?3bAGZ4y&n^s!Q(qtf4pbGO8le^Fw}|5jr1zbP^8 z_eY5-|DO_5UT2v~e$gib=fYp~$-tB!EoCU5W0IdK@l^QVATi}XW0JqqB)>%B8IV~a zG0ROn+sL%aO>q$<%9r1{viw-quK_a+V*X|*@&L>>%{hLYp71bHRndKfxYE zM0|ZdfI_V+toB9tG@OIS8OX1`qW?6@KMYu@Awg5M>BMC+nl|NNd z!TNeEZjWXD<(@j1EhOu%IG53#N?C6*=4!0;5Ox+B9YT6gV_zU-;Kk}T>O%Alb!D42m({E-OI$fewFKGaVTXgdwefy_t+CP#Yw7gC7P{dQVzPXv zFRsH*FKa8Oi!E&u`y0g#L)T5eVJ__aKU*OO&#w5f4X^QW_cC6nR`3Tn>F{VQ+)Vr@ zb{d!B-A6)k;$ zDG*kCw*i>->ylwszMCP(IE6C6XW|}gubkpL4>>bm7<{TekAkq`!(`C}zV+ba{1fFAUyp^a z3w#eli2AX^MIh=Z;mtG|7)eks0(Equoi!1*xBQI75l7QPbj zZG}Je!%seOKCbCy)~^roXjkPF-zvxv7s`Nc@KKI@cwLY4Ewu3c3VbX#@`zch3fW8tqH<>>wsfVhwsa2K=s%NIox=ld0e%zRV9w?V`({*i<3 zmjJ|tynyp%8^854zkqSR2Y}6dkAe?XBkmO6a`>3}>OrFHmm|Y?y#R-q?|a~rLoNt0 zIC##NxR4ic4dBbbnfh@!f@zU&5y;GZ7s0m}{>mx+ZiSFpzbN>gf)M$p;81)V+cNVN zAhVpWq@3c*w(u>UXsn4wK8|lFzP%Q{Z=kbfK9o~@U$OAbfYDTca6N<-U$uqrN8pPp zGAYMP&U0a$LSDeF2VV)#IP!2PzOxp-h3>)YALnYA`JOWIsozu)725?Q+HW;HIZmS- zIp}_D;rj%9Tj5XrZor}R`?@WW?;`k^j&h3ctB^D6SC39e)ffI=s`wtX@O=U@h{m1b z<5-B9?<)|>f)w@RZ+D8X+rpQHo8R&{n<2-`b2yOY`18;X$R*=iIhF1+Nr`d~4O^3 zwey9LReW=#el{7u6%U<0iFs0dd5|M6q$k|g$^FkI#kf{{-?Zen8+?j`@f6-;;X4C9 zH^OPZ5-G>)3Jc#c@NqmzImNfe!uN)WkNv9B&ug_G_?V7ziqB)Q-$n4LcC;A6itmrO z@0rWv4e;eFGAYN)Hz3D2g}i`sp|j1xnfbj7hvG}N@QuYo8nPC5l%um*_@;u7`5@mC z9E$JvmUff{zQOL(zkwX%6yl)E2cOFCGF&UZJUn!p^Sc^+N+-rscq-(~d`nFF-DBb# zX5lLZAIEHzQ+)VxI)U$g6JG$rlwdONugJppjj7;3qaxo*9E$Jzk`F<`UBpAKPhy@FU#o>LI=#QW-7n>s-<6j7 zl7>OF86=WU@!e~wFCT*MVaQOw&*4z|&9d+nf{*iXl~a7vEqpt0bLPF9e5-LNzFn5` zjp8AEu=cUTQogP{W3C+e)|mKKTKG3SeXTqpxp zul8}AlRtB|5#h>f?RD_Q4sN#ipR4)e+Q9?gZV$Ewj}W!|Q|pasavd@T&*`yk!WVPg zaS0zhMsu5ki=!FM!8^jPP;e0zV%QtDab+X1C=%8r>#TEU?8Txyo2J>1CT%NfwrMxF z#=Moug^{#^-|UaxG-FNo(pao577LHWif>@VZczLv)7xb0xOLg{*g){_p|)JH5KMny zV6xAh=}u}))v(?{tyYA)sxw#S*K1NSQy4awr(VIEzcF#6{;g&kL z1G~rVg7?1p*DPvmFVUvV%3OHc{y*OA)G`}G!8^nLrl&(~vqc86Hk+Y(V0&60Rvpq# zblIGr(VjlWRo8aG_Kw1ahP_b_7NR)pzth{5?EOlz+tu_fEH~p_F+4N8du-M5zr_Oo zINY5)Bh>wajHNGZYPV}AT4qjJn>j1zX^+&TZ_~uoq`=#H;}k7tmd!a?!%tqwvXOM( zChztX#HzN3dUCgiq3~_{ZBDV&aB6`?Jc>XI0@fQ-`OrUbVSCOb6R-oUYPr^ zfAMJqVE?V9?-<5t_p1dhP(c=Z=Ojfo-99HXw6$n~YuJP>hm$kE*lgD(zHrf<(G|ps zF>`Ij55*8CcN4abbUNegxtkir-0(P^To%EP#XYdtoBSqOu1lcmExsu}WSf|rllc~w zv*B6`Cmm&FY(dVd0s3xc-UQcdj~hU%87{CzH=6g>@vmZ&C8PmBJ@UEP(=vVrPMy zK3n~0Px}@nt!(TRE2x}|OH6bWjHQGKw)FkinBI#IOwk zKN!7sg=ZMo)l7orGPl4EM&b}aMgop)y1M`|gs#S3nVP!<`=B03xs=qXYt_lcSQG0y zDS^HCJnx8wbvm`M-qg4~d^t^Fd+u52eTp4~T$BilsOT(~N;E7UxsFe-O$)tzs<}0`=S-UWTke&wKIad;{7-1{yXPl`UVg06f#9Fv z(p~*(zGKISXcVEBUpQ^kdrzL)^QW}8p7S3*`A>VE2@@IQm(%kC~&U5Ve z1k$}HU)b@{{zsFiVM(-MjW(^j!_zv|w?C>+OBr_&x2XiD?qj^4(&5%7oVwQKHGh|+ z8)ls1Uo@(4CC~dFow~M$tLJcQIOi?VS@lu=O5Pf-^itvKY>lVn@G2^tx>osB*Vg9XP0{9EOf9*X~J$*1z8(o@$mSd25=a+h|m!>(};lMOZEd+1x> z;e^NLntJ04X1o{N>qyl$)K&y*se8?UMt#|5YnRk+c&G}aQX;5~Uqh=;u#M>ncZsjO5hF>%x{~<3 zSq0zgNRvLdY$z>*fJZB>S-Kh8h<)AfbxhaltLoP?#I4nB79XkuJG8s+(kih3ypi2| z9h0@&?$Wr~N>y-u9R#Lm8|%t8mu{%pR*kD7t)dLOtcYxz$){?i8=!2>EgPygZm8jh z-6_ozBVT`SYN7+6CdPH;1~J-8(TecJV?30zEv)hfv3>ebo`=TD6boEwu!HK zqz6vi2h!{Y`<6K|T-8X!*FJ!cZ@B%=o-hK%^fI+Ss7?T4>>t9G>wi#{T87_b$}ilqtXdm$qp{NWjj0Bg3L&tkQT`mr_&)`&I@NoX(3}X4i5#K*`Sv3lYnIPOk9J+ir zq1pM(C>_;O-;Yj|n0?_aiK!}oBcTjcx>sV-a@>Ia%*S?#nUC*E?8EtSiJ6aolbHGV zL}K!fLLSKD1OA-E%*R%V3xIzuG4uT!iJ9+Vh{w3(_efj_oFy^y&GAXf(0_vo?~s@} zgiQXN(@S~!e@$Y(&vAY){fQkolsze@%7|Ef^Gco6x2@EbnC=D~#Oj`-(|~Y-Qw|g} zOdlh>g&v&qPAAIFX~d;WIxy2@@e|YGX9I!BN2hcX{E}1fOHQHxI761>VEnd~j&@hy zxh|EM@#-XIJUY&GrMoP@Pl$-;m~@iBvAPp89!)^ZptTam`6XZ&>pX41x=2h_8CUuH zB&I!bC1zcv{V7A)e3O5n#926(NX&MyMB>RfFE{zGmiR`TD<$T5*G7qpaNcV2Z;*Hq z&S8lc*8g zqc~rX_%WO>N_+_C4<&vMXLjjsC-Lurb0vNQc!tDG zGhbq+St#-Qz$GSs&e1042k>7mG3SV{mN*ILN|XOaiK!#|4aW80+#oT3lL||G9nO0s zo`7>yVt!BFD)EgtcSw8(&QD0p-wV4;{%XFqF$+6kDv&Xm6|*Nd)M9(->Qz`8HIcSN3pdEBJ@&Hdm;UT=&Y}l|~8){#=#3`i}WuEd^u?>V*I!-#o|i@m7_+xkWtz?? zDmBv-IBYvthIf|f182f1VPl>h)_yX76A@1xCHCLh5RU7|@P49P8g3j>lLwl*a4!5O zmbcg;=eoT&h+K(aF#hpgNB0g6;zAsBW6@uA;LKYolV=#b#5XnOba%jy&&SFszUSd# z<~xSS3lWigeC$ws&%w{kmx0966q%Ic<m(oVNK0SB`RY z>~GC{KJd+eKl%8st@w&8e5FI^$9-ANd`nDxe5O@={O%Qh@p7vNUk|R8qa0m^g|ETH z$47d_$GKx>zI+4>X1^aoj&TZc&^=+|<8zPV$M&F{lH+rdS*{dvr|2P_l3R{z;zH@a5&E@)ob`{7 z+zcasM5a3vm~J*2eyNF%kjH1`nKq+~q7s)HQ2bYNlaYogy7r0sVM)rWuz!S{d5nww z5FPcSQ*vveA4KDhd_I|ms;4Y((dDkKU9a|(GDftFQ7i)+|J4}R+*vcF$d$*qK9oOl z@jZx7*;&-ivMw>l0UCa9taDDOF(%AwO|F4X$o*lsPYkhg4Zo4=r*rM*9_Kdf_2PrfPE*kmxBaaSji$?NN1VRgd=}JAZ}7jyWf}aCBA9?V}czW102dp4kP% z^Taq7ws30E#ZT1`z^}Iof{wol^*tlT~Ft7ZSh0Nhz^~cuf?!=M@6XhLeq&*>z|rl4Ygiu zdh2ixhq(?hkKWffu4Ra8TJbMp;hx9|rFNxXD1K+E_x%LL?I1HyywSHi zT(tX9U&sEgrLfDnBrPys?`sQh+Wn~8yF>5V)$t_!XpMg39dE+&`@b`i7WoiVN$0{n z57;WA4?Dk@P*p{h#dwbQa8i*N%fl+ctslzqsZE%w=zPG|o?U>Az5akb@bkYJE6QSA&8W^C140(9 z>&&Y4(%JqncJqKOoaDxiPF#t%wYg5mWnDC@$7E4Ip=7BnZu*OX-@A8 z?r>5|WkJe;qP-Y7&f`CS6*l(4SWU#y+mnvC&ND@b9XOI2PQrd~OAn;CpZ)SOJShdq`0?v^|(!~cfUjjgbd zetxCyJ%B~p#~PAMEmaREMK@u0s-(I3|2{W53vHqui~6ra_A0tYxW_D3`xU(J{a6bp z-I-c}@!Qi_Et%sxZJ4f!;hr{(S6;G~9PP!u8epqxTi7`_!|P6FyAWN$SvDpt)z976 zxEy~tJ(|_DBHwu*#%{-R$A+cYg{BCF?yi)ZGYFG%e9Vv6&83k|u({ats|ckS_&5n$ zfdyOg4Nv=-JbHFwpD%b~-z{XA$r^hxcy^Dm1>VN44vcR5qS!LXFGgh5c7mRO~~>t z4E62u-k`7i;;=AE-aXper$MedrP!}M;B5432RxI4ZZGU)Y*A4p#(0$pdS*xVMs(11 zE$u5hYk$Xf$tJ4C&eTATqw%UMyemFN-Cf{%z>yooIDBK8H_S9dROl-PL^-OtGxa#?h76!hcG?Pu+%eEwDJ#U z*c@$AkqBicoy}SiL_Q)*!y~+1PUf~RsPdaS3=y!cp%8zmmx1A>%xz!b=nXZ@p`w#oJht7pn^MM;1Iy&G%)Oa!KNe zHgCi><%VDOjM=5ru!^$r&qp*r{*MuA@B_tvE5fp}hc-M|R_f!Io*0l@i+S82?`_;cr^_-jvdO-Qk$rXD#9RaW*4=^DN;%u!J{S^#6h-{p;oR zUqpJNwX+sJyCpt<7f_D*$+KKfknuT|%JqEt9;wFkXbUx_$9GGe1aSNvMUBafC6@1c zS;Vr6w1-64N%zO){$`o&kT(ouxeEvR)7~Ev`vS%zQs3F>Uz^i3@;#C2=9} zze_A^Ob#5h@koiu&vl0A?*qPF;>E!H#)STqsgZaIuo`>32bfNc@39PY8WWCXppO$! z#MiGiFn;2Qk0tWw1db *&9(_+~qj4|T(4mxtGaYA0Jx+l{0(MP5$>lMpP)o0pH zjSVi4nDK6wnB4D3%y=A&p*-V>b$o!S8=dYq&LUk||3!Ys8~&72YvbN1aXc+#nzFPb zWhnbI6Mjiz>LBxzthAJz(Z#lJut?N+hPfVTq~l%Mvr*1&OJzSR)J(eZXl*kNnh^^D>BYfknFp zo(gu< zfI+^55kD2Wu?$0nm?0TW$;M@{EDuJs;sY%rP_2QK5W{$6G!{Ne z3>ad0qImW&FRQj{!06zBU`5LOVTh+xjob}2aK$VbOIVa*eD5-YSBZjZ9imz;n=q8| z$~RnzkV`|vtrjmZF_5P+63^ikmiURwnU~&)d&*@SwCM?>c>~kH0G{%UtCO$a5M3r znD=Ws(H9v|{8v$4fRI)0{z2r9L5Oh*Wmp0F;SONl-uPI{Fm#35cP)H-;K%26Gw?w-)vl$Dl#d@ z%RLspRudoZ$BOSPuvtHj-!e=&h0nl)xKIY10w3))0S9mGitneuX1+(kCm&G|($D>j z#D(;P`<;mori}Bg2br1g3Gne=r<~HS0zzi}E|~HQ80TAJ;p+n*-+z@;e4Mvp=F32# zl|YF3_26I_^IwC5(N#S?hXCG}l~a6G@G$eO245EZ$Y&liT!w2i-}{Jk3VzBdzB}Pz z=6l$rpLxu1BJyYEJBG^XQ)H5Zmww2Z`Cc~h@o|=6%rE9*C-A)izQ4d6bwmi>}{uy|vE0vfhC08NytAcj$;m_n0 zHP=8jk7=@>q@(@llw2D0gJ|55uUn>pVQ!HR6r~!|tpBuQnltCjmV=sC9@E^h)JWdw zqjRx#uAv>rTf|rszb10LGyKx=DO}B6lNOpRPyS~@liGA zsr=@=u6^6)$M5soJlB^sRc%B0sPy^8_VCnxoY0o1+TgSG>~nZdN1gPuh{ zZtp4V?O9kbyhzi|VaMR@On(<1t&>3*4K|{YL7!sH?FyBb?H~08q$GmIU2Mj#n*Oww z+!=?vpUv@Zw!23%jK9dY2h$##>)r0^%Yl#h&Syn(GzYtIVz{u~pVrhA3Z}J8#*nI? z-+;MO4kXW;8>vu=h)wDrNcG+uAAAK%Q+6~MSn~nLWWa+>@0;d@D;mDo&4E|wU&0-a z?a;sX#MnuBYA|&M25j8LZswrz<=8xIGvP zq-k>C{9j)1^q#;L@GXZBL&>IFYW5#c}LoeuvBF&^ulwENkS zOzUy%@0mu%`!asQ>mPDtc1x%&jFH*4uV7@hZ4XCgXCpO(`}75FR9cZH@`ADuS;1K5 z^M8?W*WML zD)PcxcKrL2Xj=KCF`?F92~qbrv#^aLy-Tn`dG1Z2)^moyG}JfA=51#gh#Gc06ceMu z`6E?&CzH<cNlme9F(6D1#QsXl0U5$z`7GFem<%zLW=Ko*%PN0s3ckLc) zb1sT?yxO(52sXzc+>uwpZP8bDkG2&rjP<=9ei8!5i(=kKwXU9ycPY^M%TU{ncvka_ zM3?;nDNaj@=J9jYIkConki7u<3~DWUjI&AaI4`mBs6GRYn|;bS_f>J3OIMk~E%PW; zU(oO$=pRgDd18JAWHFAnQ}huPY2I0B-fw7&j4?ZG<*w4;mvN4G8c!PSnbp{P~=z*$S&Ak?m^GXrJ@x_{8gT+wrS3)q7{27K3h~o*5C0P8~|_+Js>s zJF@8%BR<$L{x%yT?;iD#_`jxIRc*H`+O~T%daum!l|9GZ+B?q5p1#++Ug^kNzV~d> zrK{waU|in2g>8QKsOhGN+uD}zEym9qp4AJx*UhRdy6q>nVvK}(0+m|0ZJNvb;d>a= z!Kh!{ZolsDf0f_=x3fMlI_{@KIrQN>Z9(*zU&{2yViz{|urED|QN(jjd~{kk7lURo z?X2Swr+EO69uM_|>v{o{Tr>g2fyb^caENNq5!v%L5DjUq({hR$w4Q1P!Y-ou$I+ux%(i(A=isbJ9Sc19)l*K5`Fy5fo1cQnXZBt}tB#%}ERKGjxSqct>j&(AGhuZ6PjbK?us#jj(! z!w8MKLt5Ep@@Of)Mr%b69!v|r+Zm3$i}@-|&$ss!92Q;q8Fs3H`4^#9tv{{uUCbo{ znM_wPHKij*jZ0KL5;z_1JWr+FTkpV)ZWp@dyu28{ zy+^%`=!bjK4mrde3-5OA^;qnWMd%_g6rrPWp0uA$I%mVa&U(d>46z|{$!t6~1itr4 z*i+>S`?tCH5S6R<_n3)2+5ff<@$`e*?Vg?X1-7DC>~&4srX%l_jwP4|(x;;??Lwol zqndkAHrV`m%aOb#ff=2%&;eYS{pE#$n=X03ulESU#l=9duM^V&k|7k7X{x^N6iEH_(R3jt3y@eazn6R@t%~<+uqmh>F1-(ZeHeiw^I|?($%E zA7&hGhevtIu&(Sw$tO9J(7R4sena3(m-@>K&k{RroSw1PZ7ag--pIaUZ-E}(ekebp3}5DR<##;)Z8u&ZyuY;_?r}Zw^q!trth+C*yRWDr?CB2s zLjQneIeJsHGoDu;omcJ1oOGx22jQm1Y;B^$);LdF@<>{r=R}6>I3}yTsT~P5yYw#4 zGo!h4d}j1;ivEbxdq?u|cVpg{lcv6X5YKN@HTPBSu{%CK>pqySpS|j>4E^L)?$1?B zzxmY5Y3_0O7uaF%e4*E^4SV}T&j(|j|M2mlt3Fuprw-4-u{*0BSTR9ZLOeUWUAtR! zcgDF~&$x@#4yRq4mQwBLwP{NpO$)r>nCQI0UA24CLU*KLTX#i9dUKC!&(nLJIJjqZ zxcg$C2Q)BdsK?dtgFP2dc-(TP8Z1$c#YB2sV{N2;vD~Q$&BoXqVzS7@0AifQNX#6_gE%ST}y8>o%^F;{GaJo=?SMb`i#35BO^b z9Oezr*=4Ivy8V@TuZR41hk|%5U4|Q7yMM_{|5CgH+IM_%f67_c;ns#DPab|rd+oUw zG9$yje0Kl0|Kx3SBK%zxSSUDhUe60fRZn`yjC7ZTf}B~@9=sNrXb)b8J^^>@a9S`H z3-sA*dpDv#b*ZwUxz0L@4B?D6@lHCLjJLl zcZ+Y*+VFE*sqP-dJMT=lYwUm31~YLV4vxFi9(F7Vr%lYwm{@sr`Bq=a>@d7D1NDDz z9Ie#`$6><8AxA&$YpEr(15bVOf1CRj_^7IT-MuGI!k`f15Fo%z2#_FPKng))o$!nT zN)RJZEKFV|$TI|a95_uz8YZbd7orUT>1{}98#uLB&{Lx=rzE8@^>L0;Z{^r}s`ka{ zX|33vO06{a`_^M-&CY~iPw(yh|1#O%TI;{Q^-d>Fz-rliPe_4vn%m4r=m^ zMz2)u8|z7q_pDE@JQa!qWkuzP(C{YTxI-=1w~s%Q1iPf6o+DP?&Bb4qrsZ|kkFeah z1de&2#ddqZ!I7|ar+dWdz*|o|Fz$2hjSD4_a_7j%CvIjS|c&udqf!c#u?FZd$3zKWPRD0NanDxP1 zn1*9e#e0WJfdq}AZ=3JlK-jGNoF zY`Je(rf=x!Kw8D+_BKxL0%78-8~`qG+wseCRDjCIFlzrEZy#*=#ej6eoj z2yX@P2<>UKGBeAIyZ($3w{Fk6hldtpA)M;3=4Avk@AKsSSzl~C9TqMz@}g2v_);)) zF!Br~V{ zw&dcr-(s1dCSO{`$fT7A=lX^xUT>X75hb`oPb417v!6(S>CvTm9~yB&5RLfZp&|yF zdvSI)-q)-Tq1N5$I3H?1H?;CpamWhA^S;>IfO_yWo_-?n*`g5J2`+j(jo|Md^u(ah ztDg2$cS_!?O@R?OjYFlL3s&2AXP!yYm1oTue_L_spX+Z&!OIK2=VGJ|CT6?3@3z{; z--2>SyB>VR8tKO=W*t7(k$B+oq3*%Y98N~{ps_Xu#x{+=73Jx<11%|{=INsr^s)Yy zrUZSgy!%r+?&+DQ>yC|z6<7SB`-#NDqBHR#ODCqcjlcEu`26$ZZwZdiYZ^bNzdCt2 z{t92a;h}l@{*fsw4+ec>Q4(mCDEs2wNytQ-Z=ATU6~B;#j5qm4w4s3Ky}Qu1Bo4*5 ziXv6#(`jE??dP66oSuVRX0-W6azY8S>1G7C%cCh=Sj^uC|CcK=4``+SF zxEG(@5?9;cZHO!BzC3tGMbf|EvKNYTr+h6v^%y2f#PM9&f5ZjcQ}F#bUZvclVTh4* zJ&X&?O#CqyOG5|wU-~@{uYG*`ShaOm;BcSI9|~H(144C}?|=T%cw+27-sa-mjy3jQ zUI68PJ~I?}Tquv1)VOTiXQJ0Ez&4`deXyFJP+1U~-uPAV=A~_78E!G#CXPZ+)iyCx z{J$SJkZlt=dcAGpz2g63{BNIy=?kGmPo>o{QM_EsoLDZNNqO6d*%qGoC&auLSF!6u z-YsBm5AIcPYN;n)wMboN=6zB35=W>Pz&r&je~8GVXr!Li80!Dyg@dscR*QXPXF!x{ z67G)^t>Q)-C7kqf0`Ut_*pZ%qDnk9bQ;hQFJ9%-R97=M#W~b)_Ihi5Y+FJX+y^GJW zmheIbhI7WvD0eY(mV}87X&91^_eij#adMQEc&D%4<8$5s^Cn7M-0#~0*5dZetP72g z8t?zbd!bMgW@apW)LQjwRVOFuoO9pCd`ojM?*Ib|-wS5tH)Y+1nLVGK6Kj03UMe3cKR2G z8jj&U=hU+YL#NQ4@(w95wBb_2+g+VY@`s>};G&FKGABoelA3(OkL0;4Xi?9xHxuc7 z%P73H2_+#S-uSbOx;pb6Wr&FjBf#ZeDsqB2A7a(Ppl^6%@$4I13ybkI??2s{he#-N zykbG`yfWcp(uGT1o&NUDGx1kg8OZ%yD|D&2=eMhp5^uGdvWi1*6p)wY;}9daR}9s$$dugMz?-qSjDbS591r&yhIfZ-1(*`yYB?Lgh~rQ^E{e6BEL?F3}anJbCyk`>jw?$H8YhZmK`j>)xo^ zLywQ7DK;i}6gT~Q_a8_aaxLuW4Q8z=zVMNc?{J?Nfo-s|Uw9Uex)O@_;7K~Y zA)YaEbPQguitqdr{bUwG39N$_>A=?#{opFkJ#7!B2wCE}naQGcB3W&ZT@~MuCeCA< zZ4~omj3UtIFL>NZyU3D1B)~ou-2m>?+28!A+a>#((CqZYWB6Q(s{-`Sx7KQ{H$;DN z0-&xq{N@79!1;EN~~o+qxzp_)Rma4($(qBAA-z^bI%ni zkvcSQPqO>4U76HakMh9!n&<=yFo9{SyBrnKFdfsDd<4Vh1agXI&vN0>8)W3Uu$7n6 z)u^DBx+9g+Gf})(Do*)uYQoB-yt;~cL)xdGN$By31sG8eWGV<{;X6cVW^sFhdsGJ7 z0&;y~CY~UE6~8L$e%Gq_IjAIXqKfhY*+ma@c!c>#Gm$CY@_QZnKno{4@wEpR%Y)%F zvkPW>WThgrYW+x~WutBbCBP_^x2vi3CwLIg zc>HD83m4uQV!iN#^Fyp(jv4mKySWwrl6v6Hq32)zPV1XPU%xeR^h?h__9O8sN!Zgd zV$b{Ey!GACButQ-^7ZEr{|qlSru^ph!$0;MxiUKBcE9lGJAZ=QYbtUINv^(W_Bd*8=fnPlsOvBTf$&8_&?qi5e8`p&<6=aqMd zW_;bQ&nBQ?c+s?p86wG;{2ou zQ>W)`Zu^EZFScs*RtC0gDc_WX zktny{e!GZ;d{`?g%gxDF-iNRdVi^`@g!(qGEbFp9N(?J0FK1eEx>hz?5Yh~AwpmUe zbu4y>Wg@+IaVlB%yt{I|Wt(9~6$-ILsTfOn;mka*i4&p;2ku zgH4~%3O4dc3Nb2BRhg)76w3BZ zfzs0QEn??4wztY@v1{#8ZweB>~Jm z++O`q`4mA|vw5>uZ1boXRl#4)q)0xlLHX+TUjxB4*v*AnZFS+$W76W4TRh?c4^?ij zI{MYIRvrKE6Uc<_9Ww!wNXB^K`Wwv5#Jr6mI>UVXektmiHx3u#_Y!3|7CEntsWH}3YV@2iXU?ZUm%Nc*XwNml7L&dfpjzk8EvnDy*lO679 z4)+Xe2nPj2cH!p|JH`vA_!no*ia3Dc`h?H1j&X1$qy+WkvRLX7iNh{lpHuaB2Hq}= zeEp*eUL)K!)?|#Er96e7%i1Hb{ukGWuRsThW1N_281ae|v!qNnTSY|TqIP&>epW;R zf#Spr#fVp2)DBGyUmXb)`fIEu>cqCu&Rkf*Xpm~p-$1wvyGyK4ZmwD6!fKBfRfq6d z;V#4fh{W}2pX(xlKyhNHkBC=X)W}+fv(-f;POL6zy4Ob>Kyl&SFQj*z7{wh?i4!X_ zneOU{11Qd_akw9HxH-}}B5`7cSJUmR?_eYlD6UWYW~oIa&Z-aZ)x)vWoJ)L0l{dB6 z$3CGuVCDWi?)9}WoO`=yq1&takIw<8Vuhxmj`(`+BI8g$-@#YpaGx@|80xcKXrcQf zePIBmd#5A*EaM@B;kT>vP3Cuq^|p#H-B@qf!FSYQ{}&wL^Bnx2Q5PuAS>}4gZ4P_V zRsRE1guQVN_jHH*i;n#7bf&NR2hF$Jp?_XqFjacLRsF5je@^uu6TzE`5%mF1!cfBU zde33cCZ%7FuvF||=vVr4gge`MUb&YG_Y~`xYEQYsooj7%*#BRS@)@V{^L0^vGp$*w z{AtTD?C{x)BjqOiQmtF9RgV0>>&UOmQ64>x^jaMC_ln9N(_oqvutN*o399_21E*T^ ztOugpi?}M45Dv3XwH8||9Q>R^sfB!Hj_}Vo+&^~Mo2&9C+v{>`t|Nc{+rj@uNBJ~6 z%I9f^d!>W#A06qx=4d~^a->(N+_JttWBo+czjW7HS&Cn}>qJrLIrA)f&eNu_nb->j z6!RzSMG`ZfT_`c<@7Q-poI!l2#9rdX5@!=Hk$4L6Qi(aoz`jdj&J(fkmN=g{M`Azm zGKuFC-zYJYx7h$7yaL)q0?IXt+3+E2@U!m`5WOn$rP@8u6Jk1PE-|Z|JvlM+_gRJ0 za11HT{E7Mej0pKMe$;0=-%*%BuPV&4c~9YF9L3ykD3FKqi5Zvt_bE&rF{c;)Uf?=I z=b*yb@c){^EX(gIoD2K|g|mQvt1!#hi~3|*EaQ0!=L4@-nD$gFOnXi$><4~b;rYOq z4V-{JiJXi(O5sA_sS2~YS18Qt<9dD6UjfW{Z^SEsDZ1^!J3QCj^k?%=Q*9p6EW3cA z@->&u1sNc$Kl?rbMg38SwlP1pO2|vhLWX4FXRi`awhh&1j)NEHv3qf3^V0L%S&qbv zK38Fu|6+xiKJ%&d^_=#h@Z%j9{b@@;VK0t{6lOd5qQbQKs|wS`9~$^43bPGRm`7$` zl*y-rmn;YPZ-J9(+iRr1CQ7kG+mawlg~*aXt==I|p(73ReQpS9l|Ep~9S}w?yG>z{?cg2fTu~1pgq+ z5;-4-|2pDQ{DYL?NB^hbUr9_42+M;0FT%fum<0pbi68xc3jaOCykJ0T@uUBr;lEGe zSvZP51Qi_*jOr9~?~`#P9p~Xwrr}3SC%ZXfhLyMcAE7|}s%baCIe{xfzYZNOpM=1NXcZYYOOq8zks7O*HcRaWGp&G>FB-e{z$*9z1jCI_em4%+~K z@{Lpe)Sag=`FN|rxb){GoS1QWTBdO#EQGfO#N?T&Fw+t?7Xd(o%_N5KvXRD0gK#+$ zV(N}jn7Ww?GhK?lmk@d3gjpr_1_=bedJRGyU8l6w-Y9iM`KbFP(XP}zlITNJfp3Ot z8Zhk<_Xfb^=Gyx7Cm-iR6O(VJ!f?udKJl8ZI%BZqAq|L zE_AjEZ&`+)lvw0(lf)vAs+>h03vk^?lx@hamO5S>?0kuHiTx7i5pR>2!FG+re&X#C z&nJFJ;zHsb60aeCP~zKhNW&UHwB;U!X**9R`m+qTC`=oVD~y9ITj(%PqW=VDd47*& z2#lhz{#9Ww@J|)a0{)$$!+l?=pAG*(3QqyPPGRO7-_C{3OyIW_W*PiiVU_`2vkDzQ zaIV5EgGz;226rNJOlukNDuq`7*DAacn9tzUq5fDjGGdn5WYi7uI^bLb&r)~^{JFm@ zb%-f;raX$aF<#<6{#k~YpNpI?M+b<$JVpDnQuhcsY@ z7bwhdijFJ#|H;yi^_m7ueTp5FN5NkxG2`10ODyucPhz$?dxpeF(z5xY4U&tW{aFF! z{Z+lhOv~m!2-}c7OF+v{ykBA_X@?|cz1nPq5K&fBBtDEo8Zd2qSz+4fVmpUFZM<7y z+PGR_CLL6m+>a{k1r~h~;${JVMfo!yrxa%Xo>v%Z);k6k=NCMgr(WgHe2Be`;Lj{% z^V|XU1K*|aeBfe*-N0oEGp|(&vptA)#}F5PLiqg1JTd>oOrQBD_9Gs-h-r(cFXc}z zt-~}l7WD`n=9Qw`iQrfDF8KM-03m1E%>s(I-o(^p{)wr}M-+{DX(6UvH44*~-3pVB zqSF=kFrScqJfz_t`6*gQ*wY~W$eT7>;%tSfzf)oAe%0^?jOLk7A60He5{vR#D6zN} z&yiT1r@-WAb58>%|2&0h%jXqlzFHL~-}?$P?gt9996nN*^+3_rBkI`!;bq0)kanxY z!xUyX#oj891vsSLCNcl(`vK91@ZtjzoKWOFl4vKurEF^mg{X1>mC!{}5O&6cuYFshY_8RBJbFF5SFk*VR{2ilNWds>0D?ry;+9 z55%mr!izvXsBFVPi!Iwr@Zr;321+c}w557;Mb(D#wWXEir4O!+Xy|2^`ccv;h()Nl z;F8!IsQ*ROrm01ibUZ;@T8*+$>2uZF@PbiW9$YJPVyveoiY2_h6r(am^nzgh1e^OO zalthmIm#HlvRfZdHArPG2C0ZligdMBcoD9sMcf9=ZCQCmVEYDbe(V|_cyTu_9fuX- zv@PK!iHBVNZ85oJi_1o5R7|>ch{wG#`V`%Bja@Qr%WFjNKoK%t222ku{GYwMZ`e{E*$eC1*U~fk9!Ejw42y)si5aNgR=$>t?)6Xu?eiQPRZeGJ9rD8)btcFZ2&wCguU`X zz>I$5#jeJIS0}BBUW7DiMbhvBs5;ANwowYA;|h0LQ9=DKbGnfmFNW8;4LADjRoY*d zK#ZVBQ(_|sY_F;0R;9Z{$@d?>AH8TYeX6qc^iLI2D|XRWZNsX;V*IqDk?X<~`Qzzq zXzH+13?JTHYAhfKj?K7n3{2A+;n@1IWZU+tnsTfa8!6kqs`^H0t>_1MCYI_Ly3{{b zq(~7O-ICE~;Ettl3SrCp_83|pm#A3l-cDP>6>+D{_=K5DK^MN;SzEQ`p_!43Tg*UJ zlA7)2aM^Vl9YzI> z`Q3`xj~^v1SH9b51g1RBs2j6AzwZIVa4Z=_J%|d;c_EjQ4bC6Tx z>Chwg(-U$4?{sMo`S`t2t@I7tt@!gu{dk8P~Oulvmps2$_J<3+-5&P+YoCP1- z0?ThWewuHEgOB;=SU)YA?`{Vl-<`58kdNOFG~X#SM$^9c;0|drrAO!2;mQ_W2CHaz}l%gOBf#wdnk=bJRyVI<|Z$vHZs4r|rAV z!FLvX<(f?C(V6GqTLHdx@F(8{{50Qe#5c2{AUF3k5!N4v@bAIIQo(RqKz(XML2w+>1yznS=H z`{L25oA$k;u1`=AqWOO1xE{R*_b#o3qt^SmitkrpZyDu+Q!kwE=Yh?1m%)x?6^94S z7gE?yPsp#qr`r`^m~TC>$+r@GH!*?|%~uXLv0wY+!;mMxoO~ZZ zk8%7ez>CgGxBCM4X}*^nd@H~=UB%%++xNVKZ;HV;&*1xXO0<2Ue(YNXJ=4BCgKvSs zcawwfk$&u(?BJVk@No!&&hK7Vw0&p$v2Q2zO#7A@e0LapYaD#%z?X_}ExP>fbMUP( z_!dK1+cyH0WY+Hm@Ufk0(R``UGwrJcpYAu7LRs_u!O`!&2foi~GNni7B}c#eq``N$ z(qsFXgp<{@Z_fys7C9)|K9@tU7J4J4N|fFe+?<>FxNMXQuMavO9QS9YdlY=MM~hCk z5qc(HJWfV^p7Z`h^KEzVwS$l4rbY8@aqwk;FAGYI_!Z-)`OZ4(?K1dK1Yyy9-*VKO zAAHOQ`Bvhm`Pv1YZ`k$X9}&=6lw`mk++rhS{VZoliUX z9s!@eFD^6q7UTMD+IJ3ovD(W*=$ZDt1wP$gc;Bn-%XaX+1U_6s!a_aDcn9CF!N+o8 zek<|QeAs3(%D&``*yr1y9PKaOAK_bX@cqcqp3}hh4TNja_WjVom*J1x|80P>wr?Il zRQZ9=tI3oeou7mrj=MmhL?20qSt)IvSV4FJS`Iv{)ea!duwZwr15 zLl(r`4%5DiV`A6uf2ufs94Qz5k@BmCTl4)3u*vrx_}0Kr3-u`9$IrCSDv0pas4&_W z#65_~w`8o0hae%EZ!h#rzI5<0KJ)t!ehj0#+`+dDd}rXVMf0t5@MRf%JE5%ke7KJ_ z?Hf8SwtX4UGwsVY_;wq7$qv3W@I9rCQ+jm9Ir#DozCB8h`JJZv1000(fN!Y6Jm~!T zkqPEQ>s{za?{#&)X}yd6=w+z;HLZ8KAHAD#pUHIj3_(fuqF+PVYhf6F%hYvH^G%s3 z?_;%|&c|ZMb+E8NwsE$Dhw%&7n@U&ny#_uMX;_#hp0ST~q^Ux;YxAJ_Ne z{yB8k8f)yCI+pUsx`w!A44p&V_BAXN`~OGMe2;`xJE1&)h?A%(_=x{Iw)prxqsj?nVjePgA^ zS)}o7S64R4#d3TbQ;NT7hniZ7xRp$>tE*6ks3P!mTRLxh6T7EkAwTAwo9!^?h+F@= zP@toz@kNpR1^XhGw4?V&BBciI9N&`JShc)s1EQYqq}f=ap3A>sO|WxetM|s&d$29T zzQ(R#YpC&ju=SC~cd$}6)26QHjj$&3H`wax+Ntbh;b60%??voPz^bF6q6gAbj3UvC zc%gxyy@>$UDfenYe7QoF(cW}BGWTE6erQjy!E-v<^Ki0fMY7s`rMM-rTH4E&6zoiE z!0KYB#2yOn>xxiUNpHqsN0tO@Z%UxI_klyBluBD?GPQ8oxh||wJi_jo-r-Yc#c#O( z)Lv{-!LkE<;LtGV`LZ{~$RF+0Yv^m6uYR;+2G2T%H2^P`cgi*Nx!zuU1J@+<4WV2;%Ve)3YSW~q5$S7?7&|RtbBFSbQVlijLZ2na`_k}2tLC7=xb+pMN81^aa zWOFO`@EHHj1mF1ynO)!8fcS@pMfULcY8vYLAZVj5I%=(%f_XjyzZWZC2w~Pi(Dy=Ipa|!3m?}#vCK#4$6Hv z?nsmybF3QV*=e_LMR~}4j&fsLA?(93&1&s9`{ekuSY8idIy<+dh|und+?ArCF0>V! zZfx!P-paPljMJT7&&PLD^yg`2#Swfk`XUN zM|{D>h}?%FoaThIaGFdp+bx$G=fD?zK@ygegy(Z3t4?)XdiK>&XXE3CFS!q6 zUAu*AtYhFgD)Ui%i$~Jrk3k=Z7)P{wh;rZ1@^kfwas3))G(63=GS} zlJqoSMg9=RdtvBOEV_OJEZ7Bacg2~co;qnm%Jn6IRIUM!<;90%rNm1j+I*xhPNR+S zSXEpsUF+(ejvkqm?xhF<>2BNwbR<0vff&!tyaV~ZMZ(}SaMCLBtiGO;J4qVQIvCk*NF zbthX@mk_TbP@J9AokB}c@5simg)ZTsy*)hlps_w4o>I9ZzUorw(#H5_I$R5%>3ybU zEJ8NMV+GFQQLc_lI|~Y@&we}wmHd>e{$TH-;auOBD@Ui)W6|vL?9jM&T7&rb5 zf63wgox}ZEWuLTvi1keeALnUmA>R)j>2Fr{A4XWJHOw00$Pb_WwJ`oqwF5`G$2<7$ zbfh=RVXt_2Q5=ll058|fX%#MF{zh8Abm;GMxW_Af9?18BBRthn zzY`tyaGtsr#^;=LEp*pA^p88-|L$-vb)-)&J5e&yl&CdMm;i+D=4=jJfY3{?2arb0 z0SFMjN3-bx$->X(Kmy1V{A|2;r{v;iv!OuvTxa9CpOS~4O#(E7zG__o zWxE${u9HFMG=*v7?F!SzRSMIjGKHDM28Hp8%i=pG^6;Go+aED?jwwu?Z!4UI2!L*(T=T0{h|r zBc(GR_@WW_Lj$|eUdZEx4n@~Bn}uHQ3c;4m%tAz6qpPQ|Tx{Sh97Vm4p|7fI_%8%z zH0o@^(Mzn_664r-4@MDbkr+b#G+?HAqrwcDrZCgQ@DZWIGz%1FJ>vdM__GXGC``Tw z753uD_g>^@`kz(Uiz9`0K87RHw!QcV(Rn-pEb{0R-g3Sg^v}S_^z2OOFY-HHVlVxf z5QGPNf`DQy0n>UFPPPN$pW(=MU{Az92J`Ws(9to~ybCp>N&AN9-&}n*l9>&*gMnuw^%Dc@ zR+mp(bl1I8F}b4j!RUD-Vqp7*2l{&A8H<&TvCSJE+PF4QR#pw4m}+6qaK35+4_Mna zZNY@an#jbWK9h+09XhVFF;G#9x(lbS=SPV4%dzHBlXHYGGyAcp`h;WZ!T5T*YdB@0 zA?AYgt1|Ee9Njp=$wlUsLhZddR z0Q5}z9s%DvC^5f)VZQkeKCZdUXE!aH?{)_t#~$v368VPVM?L2MPcY83Zy(|KBh8E2PN8vVFqD7mxFH|`1o#7i{`tc;`miSHX6xMVDkC!)Aq6aY2OU| zD0`DFYc@TU5b{^4j^e%>_-S+kWjJcldS8PrMszEk4~T~7u%AQE91FmHoI?93TJLGt zXJk+Caa|nZz>~0nBI_+1 z^=ezS_{PJ1xMfKH|7RVua;EQj-}7iv0GnuEUx$CY+@nsncJKN6n{hjb?0D9-a3gv+ zzxAtQPkwsno=I0uKFBn@pqvMd(I?D zrl*rkYNR!h9$l@+!+Z&M)+hdFZ^{2^?jC^;I!Nc`1YrhrE8^ji@7Ag(U90O)UJea= z@8a20I8F1#7wY!uNN8h9=-`fy^pgK|q(0u-@yQY0Pxfw1>9+C3r{1yxa=&OA#J!$2 zCf8r-t+eqy=iV{sJ^uzDC(!IB@kCG(>-&TbnDeoC-teb|_&eHxBi+AuxN{ut z;|}*=!yd*Ds_>t~pWheIy;!#Dq}V^&>fEBPes{-r2X+$vLD-kuj0EAk02}8%#fzWK z8xcqrezxjo#QP|87)*lwgMOdfs4%I%q%hN@{nTNa-%uC_`Q8=&O#hRxojSC)Rbkrl zHHE#vFDcA)#XC~y(=KZoZ>_CqrPwv8d{bme9PyYTIxO)SZG0m6D?KWRcY&(8uqLcEsGQ}fCoLNC$e+H)k^Q{Zl5L5uUHCcmvLkAu z&CywdAKQT+KgtFeu?|Px=h7aAu`MmZ&*WPJH_sC-)T1oI&*XavBnRL}KAt|BZyw?@ zy1tfk&0x&|ZxP0Do?1NS;zwBky)p^Ke}?h*Lv<9M_;&(&rcj6S3;fJ$Im?+s`zTuP zRsfUY>u{V^;f%r`&&ivn&oQpvUhja{@)kuRrY6h7Y}_a*&)$>P)6-<@1L zd7el<5+|c@5j436>m4PF+n}k&4RQxZne&KlK=3DWESdY~_Z^x11h+T7??`4_SFZbm z06tS-ND6$~y8IXcNVKLsIQOpL+)uibB7?nPXIs}Ykq}IcKTh zV{xoxVwJCIdP%|1U}y5=xgn44!R{rD$#^33{7!T&GOKQAXK!zH zr~8HbR{7kCMjf}O7qa<7Iaw6^@y*ZRn5+col?c6=OtF;#Tk;3^*Z*MK{ zu^}8ktIKJY*y}erSm4HHun2m1s7LMAJ)%%?& zc1WEV7wxv^m5pPdb0u6MOr)RoHmeTJC_VUw-B5&axW_ES6D1wM(&IO$RQYnafh%sA z@o)O)lYG6sUyNHisAcBmg zBuKY=!&@#k!QJ(%Lnn8BK7RINr)9v)Ng;WU+U!B$Gitt@s=MvoxShRN6dID1d+r4LPHV}jhCRF@-s(@C^@(1YwrkTK@DVJkDXKKn#bPn!+` z6SLKvGRd8MqM#wL|4>RpC*BC62D)1;_sGMYqQG~GzL9HZK|7(>LPJM&7x9v`hyL z!aW6)ECx`{Pv2eBIyZx=?ZhwhUk59>QVib?@|8?;q#+ASqVJit0#4zx9N? zW`}T&3A)`+iBz9W7M0tB1J1$=$?yA8mj{NevIRM^qG>f}b6SE*cT4+O!Ehp3-45)o z(K(IEzf1du^WVJQ+P&{&Av&w2Dd?=0CQgkX^Im}%H|gj^aIM(u3dURcIfpv3Z#?II z6K3FQ$m=Z%(UXYwN2j=2PfcllCq83O;&s@n{rX_Moj>SMOHwf2m4CmwLIpSv88IMHRn~zxQgD11)HqViJ7t=iSr_{$b?eaDTHo=7V?O-Rm*arK~hrK;# zkKvQI7^D8C>o;-YQb?|Q#|+0tnb+et!CF^eXxCq!YunaU_JU54fgIIojQbQ3Qou4E zKfJL28@!S@XT0ybmiG~6`NfGR_J~iMc(ZM~%`X9bmKtchEqpuT%p-slLw$vVjg zG|0c<=d#p*2;sx{H!CC$aecyPJHl^uxNmp3=Q-SqtOe?xknby8QM00%{$hvzQiuC) zhx?wWcf)+P;&?0y-|_Q(%pt=_xPgYN&S>T?osD!%+=tM@fjOT`nOTj@); zTdYHlAWOQ3Sm)`0NcVNtQ^o@z`M;p@%l9c9fBB~<_YGE+;wK07*AXb8`_V+{n2ZC* zL*g6`3&TI5@;45c<59V0wibr-nO+Osw<*V598)b{)C4+)Z&dG`@OmEM6Rdx9@alwh56KX|E>Fd%ppbCMf3(k~%8x#D zKWm(ibbms%Z@%wJwdPpo9QG_!`g|9Wiqg1Cr3a_rdt2qdTZ9)_KT`G<2=@Z(U57r` z5Yxi+zu>6<&pPy9afGjPlwY@_ydHIw*R2lsYl@$9hf}eKE7$bWLVG4D`#7d5Rqf%b z$9yuY`u!o}=rM|po@oB6pJwAu_^CT8F&yiTz z%!UOKHqVq;*sLxsw3&Ii3r8=p%1f5=Uyh?Fb5=e?ywe6|`t0-4fSEp%Bxd@B3N!tH z!c4zfVWyAgaiP!jI~4Zfcurxa|DwWP94WdSm|hymAtLYj5{vvIFSJeMSLKB^rLl2A zc-dhAr#%WYPvX3TKBN3p`7=-arbHg* zX@bID;CmHj+${<-?lFZ~wx<Vh&1M_`8 zb(rsOD9n6cj|Azjsykesv_sby^RN3co)UTwG_S(cU2OQTG5j|xOb&|P(^c@JadDc1 z;0I5+gK#V0?(MXjV8ty_gj zZW!YxRAVov8?7%_lV6L^bJv`2Gm7{isPk`pBg1GT1FclFgf9Pps>mnXm2`=g(+wvl?f`rz|uJtHBt>4x?(+6&vH z`IUWulEiY?;uHFShLShjjIX(JBQc^(jV9AU82-#TyLwL#?QK+tW2+CX!R$wh3Keus z_EAqW7-?K>xP2rMQOxDlRaf2lBeuF@R6-0Bc+Qt`hZ9_8FnKv_r5?P_V+p4}sKNIG z)G@Z47+{RPG}IirZxo0*DuNfn|JJ4-(M1w9%>G(?+^9&p^kQwR5uOHPoE~D=jOdhN zhYnDtx(gATWkmC7lcHOtXfWGL)|Z#cZLm}m9UvKX(f?Sf^o=t>B04XavcTCRHB}GE zYxgysMP|PGAs8Te^bvh_sfacCAiC+qiZwt&ywb$l;G_QvbH=zz0t3vPh!`I=un7B3 zL^YFXf4zZ4ui?D~@29mC;@RqV@Y8}v3n8lki21IA!siQ9c>hh|yf>$w4r92+zlRdB zpPmpu9(;JOejk3chhcR8z`-Y;W#F$x^Kovs$+yJd<0~i4_XXt5v~L;0^fL%KH6Pb6 zH~ChA504YVz9gkb`!+lHR>F_ZAzC!wdIulJylXzbQquNi!dTP3T7)q@Et(G_J)-nN zP>7}13V)ODKtFmfIrLik(R&1iW%9K`FIM^Oho@P7AtS$h@1yg(+QHY3Fg_b=(fPgC z!Pjc=@!3=Jz3<>VhcI}BMf3f}!PjB%;q^tBuhYTDa*Ac&w;g=17<_zBr0r|O31pVv zMTD^(Y0>t57J9^f6>!nu;?-4dx#o*J<4pU! za3E`8(R>`MOYB!6S?YZk`OG;8AHi+%Wy8UDDOxn&2k1w1559|L7|V(Mj>%UD zN38O@NyYKwNGUYQypABYd0-W%9Kfd^t*weCu4%<;QvKvCg+oLC@rS8hnL_&-TYx zg4(_u2j8#3_Z5U|p&lj6!S@mPR=}TpQ}NS${N4eIaQ!}};=xOZ=HvS_V!!mZmZ|rz z45A6Ulxumzj^pEjPY6>d{e;3^t5Qc z#~pk}4Za0X)_gAlnC)c?_?BogrAKEs^ccra2jndHUc!;~Ey7RpebvFoIcWSot3|_O z0K|S3@Ca@Scx@!#9r!Vf`OU}0*0k?6lso;kXujFdGx@kbLKc+B$JgYV&*$KK3w({5 zOzF{?;o$o^`10XTK90=Ld}DE8Gws`ec8gn+uuzXO5_-gbIv^Lpmy09$?#55^{SoD5 z^6dei`pgI|smJ5*p=a`?kBIOUDLt0c&k&z{Gw`E)6YgRO#eatJ_dWdMkv37>gJaJd zcv|IGYT?@q^h_ZKWh&aAId6c^Q55EvqV;|ZdtA~>{3qWl$QZ+U-DDnFo;S@jX9^5F zZ(!DpToqy9c>}e$wozt^|Jk@++G5;ta>I;<%!bsc*#a1&<|(lkw{5kox00+E+wd=A zuoxNkmRPJ3;d3%EdX~rVSbOloy_h3JpGbmUWaL?Ruo=Q%)Z_HI7VH)3g+oPr6&~#` zOeX&|j`vNyXusGN8N&^-D=Fr1U-EryE)E?=d6-)?q~?xgB~_s)591LJyTv~})5xEL&m@zxW@=WInOH`IAPfwA*@FlvuO zhB0E#l?i9Qd#f0$nuLX5y{m&Ku@yHilg#sZbZA zGK-K)jNbiV*y`n>t?itI0*~F>Py5E5@63biWoc*e-0MSIJF?r8gPk*j0bl4?Ffg{N zvkJpe$6`3D&&Q#tdF~-{2~d#sZFd#*_EsLmGzKnXYPGxE3kCK}9^8@1 zrIp2S?$+AIIyIbIu6$fPHyI`%su;YQV9gDT?eh7~`@EN5MY8tpr`kGq!a9{wb4daW z!LZb}z*tl-*Bsql4Gm&lk25foerGt#7zg@L9O9sm-GkYdIIwhgaD8^S%kuSN1=^_z z3(;|oE>wJ@C0i4!9~A`#-O ziPkpdT{g}Ep)%49XQgx)ZylwMlB3)aPWed~l&x(W442~hB48bpIJRzP(C_+b*z-^NlBK(bf=rKRS9^6AwXpgOU*p~EI!Kn&U zm-jgIr!K|GL!CZ6s(}k0;4lwxm`A{(_5=atxTc8``{_SP;`zkc5*HHZ zNW6r2vc$}b9uG-XV*1TinEAU$VdihY!pz?z3NwEf6sFE4g_&13+95f;z+)9=7S<}v zG&d^Dyo#|;&}Ux7*e77-^-ZP2=ab(k><1R>>_LZlU4gdAvTwP}duC7wd^3*BzfHp+XbR!6pxFvD9{W~~5oJ6v)()8Q`X9K1Wv2Lb3?Gry z{CfSNNqk)W%ZAAG_XP@RiP14?(2GvV__i7T6#tiwLD8Il#Q_ko`kDqnD7~-+4`NU5 zO>4_Ghrf&)`4k@{oy!bdrP!z+E}MZrd8$f{#Lz|w6Qapo(F9t__;9PZ^oR6o z`&{3Dqybv1PNtvF?N|AB?nts9f&r3ueiR=#y+{mQcE;E8tE6UVT|E)!H+7wiaiU?& zOt`mjF6Xfp%Xa=1zr0)43%I{AZsn}U@Gj^-%zGYQHz2&U<1!ci=D=&9DZK7bHsa^h z<2}C?t>@gUdOj3*z0#uf*1;BHzY6d}iPv}DF3_JpUfXVmo|*0v_^I0(AgRYA_a89% zRvLV`MGN!2jq9?>w*g_i-fAHSg*v8Q4cxKx#vp>Jw+DK$@|zAl)4nZ+eZ1vl81ws| zs5FyrAN7aM>x1_yn(sJ_GwnN$ zFy0?)(R^Qm60u(eeBI#Vy_@Dc0ATW+RbeWc&?EjF^h~}EgAbpB!hFjeeCH6R9vMgz z=HvSMCf_-OkN2DmWB&QDVA{v~PvOrn2=yp`a`15iu`CbJu`F@5lKYm)M zM|lZ=*iQ%K_XZ!&6Nb?aerq%Nvfzki-yuhPNyoio7UI)B{cf1?);sue!RLp+7N$!n zcktyKe7qmm_VF9KX&>hwEE5d!pXTG5Jj8w#whnwOYud-R5SnkigYPWdeD>6$`S=WA z^6{J6M^GZ47eCFn0db)k?*En`fbCO@=6e8oCf`i-r+juGUnYK2D54K(J0Q$$zw+zcO{CO_UFzM?WoE?|&%!wEw5UZwmD&+^@v^ e=D_O*h54muz4M3<%CN9se@msoC@@2m=l=n<+}Ftf literal 179962 zcmeFaeSB5bmH&V4y?G+JC}6|@L2p99009F=Km<(yV|Y+OAVmgEE+mm)NMaHMEw&-0 z;fB%p2rZ-(DME)bj#9*yI<}<_ol?hdYps>v=d;gRH#;{0{LZWM zn(rUK^~%nE?{(H*`{C@f&-1xyzxBl_r$)7pi&leWY zFD2q!HUlMV8sJPl}jqRUeejTrZ!kx8!W1>Mbm;c z!Ns+mO)7(n+v^o6zplJ1EqbA|11O77tZ#wnf#!ZE05vT)$l`d9d`6 zqT2FDON$nkR#Zp#9&28-U~zTF`WS6Fd!aU}Qo5vUN!^l~E_$M}wrD|VO0S5sd3Kv7+lX(wg$R(ysEj3p$N7R~>N{RnUT( z3T(AyRUON4wbr(5Mj^EwHpYndBHJS~m_^av>$)tnPPYGxEL^a#biso~7wOFf7-+76 zX=w?joJ&|@JlB*yT=igSN#~lmZCOx>T3|Y4#CKI4Sqqh@Z&cB> zHC+uNqwO@Rq3xpIpuJdgby4RsBRSkP+*LoyR?0n9u(D`D)#Alb1I#t(avirX>Qv$O zMYV8^5!7ko=xDLHq|>gaqk+z^*or!|v!hjcZS9iM8g6QrFj7~YX7Vn5UB;@5{d-3@ zvRkYPF1G=7<+VTZh@0Hjjg5{M_ zJN2lh$R3O{S$RomWnFn$dDLFJV}{_8x`kEPKRjY4zt5GW>shj+TaM$;V|UR#e!IKq zW487s)uoHO>e{ZhS;^GZhTFb~+rh<0Ir7rrA_G^JUT)xu*(Fzdl&jA(n%e8u#Sv1+ z241em;p!qijwS5z8=_CftaGuhaMVcE7AMN?qcm7oI()(Ks`-m@uOhC}ajoE)<_(;4mz z6U+bosD8_Z3-vEtxZrF>ybUpgr?trl*CJ#hj70c1mS6AKd)ThqL5YH{NBPh9f%b7OcIpV)A6OYd#* z+utsJF5qg9C4QlAj~zZYv3$<-P|wERjde|}WZ@h9x_jq5)3 zzz%OiQ0yOzy)UtFNRKhzP|ssA^*7e<^95R^l56_5p4uLY@%Kpz)wg`5@ML#?O1SAO zg>$;o#XjE-X>;Kaf5^MAXVd$O7McZdkp&wQcf)Pl!5*t$i|8Kh7V@^dKlR|+(Eg@3 z_qE%85+CwD(DG>8!Ex=L*Gy?W^+Ms?xR#GX@vAo6-*COBEu+V(O|y4h?`_TKDZR2N zrtM%s_V)vkYWJSvAltbQ{0aU$k9p{=N!ogPo4=sN(@=7C$lF}fyP@QojiDy*s>fp+ z(cAYW?ubbb%Zg7wv31CIh9#oU@|+#swr5iPNp5KzKt|{H?(-dsc{di8YgYQNaF;Si zm&>n>THgCa%$D@tt7BYsYnya<>*l@NT1D5oJKS1dlYYoe9*X67*bzVf`V?2OBi@Z4 ziz{6E*(2%w&kt!VX#7iePrTPr@uLcR#aM2N0OZN}JWn(>%#gyZyXxNTpIzpv|m zYjA6N?>*y=#q5&;7X~Nyno>5dd)tBJeQ~V^q&g!{?I=8Tb12v{qrP$fQz;1}!y8Bb z>-PNLIsU~R4aX;L8r%H6r=RNU&40%UrB9yG6pZ7X=d{f5x2)Pwxh%NZar~RAUy&~9 z-8arCwD>ijAlVk~7BM*b=*VzA%R1^rE$KbwvnXF<|K7n@@3Ehvxp6;qzPa>7IIQ)o z3Ci}iX4?wKSv|IJW>!9CV-zH6Utk4b;6;2oR141Py5=7 zk@;fEbz42-x{Eu>)3?#}}I9M^r%tH(TO^M-Y=N~yb7w5(g>*0wPT{I^p?BloiZ{p7=Q{4&kz{?TeJr;7nzH=$&-g-lBj@k%`$qojj#W<#%a3u0FEl1N72hwuv1enPb9ADA zKwLM+dCTXG)4uRHsn5VlXXSj4>lqpPL|QO>vg%tDYAUKWyf+U^r1{Y%FKH? zreC$8Z)Knp!vh;g0)kg!O;gtsAswL)l@RJwG%xGJyo|9bjQvfBDYPfgLZF`}1nS7^ zEZzWSy|`>6LU#n(JdeQjO8qtj97q`be#Du=XA%2_KSIntVcw4sD9o#(bshzU7lH9g z1lsSBG?~XzJUS)!N5!;m*8-T2`T#gtIEMz1uFC2KJ@YW8bY+tYJ#93me;#*I{t@=0 z;fMYiYk!Uf_eEe?Tt8e+E<~VoRqk}?X~$UC^}S#U?a6}>=;zA_T2=#?^ix{DLW?HwbuArC;HO&a=~-A;Wv;GabQ7&t?CGYufLA@@UU>R{>jf{hO> zI|$Y~zb@>B{s>sh{R5c7Jml*T)2E+?5bDW25L2HDW)|xEgXtfU6Tm-h;~>$~W-u6Y zrO7*&h7jt>I?l^1`*QFMEKf(+1E$cPto`syFc(pO2B78s7Od_4y>L2g&VjE-Ouh;R zNSeG?gLS)@0M@*>19*N!`=wMuSQc65kdUP(>$bBAtp1+{>pFTBj6dUZFF^bAD3uWU zCo^WbZ(4e?>Q7sGa=h68J6PAt`(W*p55QWVbC&)?Fok}}+dU z;|ok--UKj{%#3PJ|_)M=xlISO$U0j{dxvG63$cNtMHb>!H?lrw{ zlIEWeGiyMS-1fX?rWFMupOfNDkR<0iFVeR7%uLd*@tK*-PU~#u>U@#XG|k><7oXYM z?6ln*tdFb=G4Yw6w(Yr=+r<}Yy{q$?HD)j89;aP=&Xw&6kk1(yl^zt8=GM|KK4-8q zr#)%LZfR7S^P>vK_BS7!BUGg0Y3My3B8m9{R;82?vUUCQz@qtfG}(levd z4@RZG8kJrnX^zZZ7$4t`TK=4*IWl@-yl}pyxan)1vy$fisFxFP{w8VKu)aOHVTmw( zy`;HK^}_hMEo%AfsI(&&yWH5^Zoqw5+!&9#P2t`}H}}e`YKrVz;_ec2!?KHfoo)vd z>CM^CecQIGyu{o;kGf=vq`8S%R#UaOmS=!HSBi1-VPo0p4uM;djyL`zF4}MWqgK}4ZMR3=`)H+$ zaWObjkh{dJpMTtg3z2(mo!3>T`>JjQA~%yF6^r=j`tDzQ1`btEe;Kf3nG(4R@bDl4 z!u^9MfPWC~>pf`(&3N~uyUhKjXMoF`g;mdENA({dXW$=%kw>PlOtSdNBFi+EO}6VM z)0wFoGeJz5^rmj&$JC8GOc9T{cH$;H z@v22$o2AaCo;(17n0oR+5@PBpK21G^O&>~LqnGL4=!H%Fg-!j11Muq+HuV=a^_TTx z`j!hJrf;QHiXP0RJEh z5!9x_;%c(gv(C~lBg={2a!X%t@k%mJvLGP@^}mKJ2PA9B(r-^#`WCXRqfKO4cVUa4 zwQRPKdEgA8X)^wC-(#-h^B`0>Nqlk{Z4wZ3=p}8YlwMVsx}#9I)IRq zWLxIYrwzM>=R35C5l)hAJePXduuBWbuwfm@Ndf$WaGh#d-2c(WkC>b!bHe>%vkq}F z88$tHlVlrTDEef?UO3MqnM95FaGNCR13;Jt=zj6*)=ft25Li?^(pZ5#EpZ92tJHg|%*d zaqN(c@s^F4eUvPR$K<5z@ejgtVcG;>!_9*>TzBLoRt&=7MVnEGZxg2d9Twk1M&1O( zWc5EsY&>4$YBCk@6w$X5}xo==fs!}Uu};sAtv3qfsKE#6Ls zeF|c75*r8Eg+Ti~h+h$AyMAc#>lPm;!w<&*IVlVOAa5aPx$lu-6F^MXvbfG@a~|=3 z3bU+F$*|`*A#0y_u}pnlWAQ*T?73>lN!XSti3rK;5C}O*_9N`aWOO*|%*Dx9;~!&$ zB#b4BvB9Z8#HP2aw{3EuO2$ReyAk_@XCdbLrkvJVNc&=Ethp=-8d(q>z!l_0G3rqh7+E{E*Bny zzWkcl(Elc3`g}o{ zei`wr!aPSfAiNj$9|*^Iksm?*bR)wLuebCO4j^Vwn*pL{+j-4}dbaT%%jOGW!|MhM zgjwz`vEh1oMfALW@{TaCpPV7XCvE;+^en3f0_(=>8@CC632~k9*ARbInAZ@@wG#ND zY!LnT5&u;9mxzBZO#i>I_>3^GIsDGj^STD>M){+qzhK$NA`k1yYcFgAnSQXznY@{Z z$+}PBZk0Clogp?^h{?Jy;P_*?*@(%yjZdT=d3hb?PGMe4TtJ3>joOLrhki|6|!)!SRo>rb9>8{z;bYg4ad+3A0ZI3v>I* z66Uq6n}k1xpDAScoF%M2dH&Bfa$A@uJRfn9FzZl7M&3EXy5C$XHoP|bWno?~Xb|T0 zI;M3DtS7_IJoq7N9X5##ujPJMY>Ht+*8R&%V#DjYKNRNmTh1No|7T?QFF{^%QUCyX zQ*4f+KJSUmLg>j_2VR$;A71LslEFZ121d+*_D)4Cf=QLpB+8s77A0uHP|Y z!?|j_a5>^BWZ2iio~&g}7aLw5E*56qDl+Vs!JeEX$Le1Z{c`BZ>Sqo0Xcy_f02YgxRx zM;l&$zDAhy(nvD=uYo-|i90vQSh3+8J5_AfLQmHDYNpt5ek~T8CtyQXKa0d>DdI}8 zX@Lz{_pJ?L!)xGc#by(1$hu#CM)YCm$*O-r^v^<1R-c^T*fevF`Zqqse+Kp9-}n*#;EaoQIWpjH}GKSDD9K%9AXfPL}aJ&*Fs^*I8U| zF|WO9-WH3WwRoq+oGU#%P=y?}nDe3P&ycxdA?Gaq*kT@osZ9^ETvj*tz=Sg`eU8Ps zWE`VXrdd44;u4FiEnaSMh}^^V^Mu7=i?>_6+v0;3AGi3l#b+)4$YKZEnwIOgIK|=& zi?b~rXK{hWvn=Mkr2Z=`US{!1i#h+O{U(dISp1U3`z_}FPxGF%nDdP4&s+Sd#hioG zCfVYE#aR}Qv3Qcj(=DE7@j{F1EUveBjm0e%KWp($i}zZ5*y1-WK4bAYi$AtF2J@4) zy@$oA7H3+VV{xv<(=482af!v%7B9CrWbqRghb`W2@otL`T72B%(-xn#*co2?$YQ(= zgSd`w#UNg&R8v|J9A1I9L~4Q+!`-Xryv*L=9?S3!Mjc;L?COq7M|;<4^!=BPHXVJM zYxI{g=;8*$=P+U%V$R zcU^a57v8Ks>|*IfJMiMRoqMkfTj{zgwq$HC5H_?&Nd*55Nk$MDsiWGvpv(iin6ZuP2jpWk~?XLfpL$ zMPPm|WBPVU$04SSL7-0+^_L5U?Jo=dc-%vOn4Tm4mVoX0RUn;(prZcRX4~Ik_*)4b z{b34-_~SXW?XN|aAu^)=oHx0*o+Fo9M<1(gsE^Yf`8`K9d!aoqsr4lm7^2fs_ z_4j+Q?Jq3L5E)V5?;}OdHCmh-TK;%wr2bOi%=Y&zmZeA@Mzo{w{<`h28vb}}%l_k` zkovnh%HLir+m4{3{&J%H?S?-dpV8ly2x~vE$gFT+FTvb_rO1IlF4{ zr{k3V`WVmdKWzt}8zAS(vNh>5nB3BlY+7D1Uq5?+kSGhc1fv z`%#oX9y78}Rn*^}D1V#!y2rcp$MvlBV;Rh@?cIqEl2a<$3#0tS zU_l}DDzu}_i1K$9{`N!9`UMcwAFoNUesT%inTrMEkXGR`hHpld%i}pd5(E9y4%HK5j`-l^+i2CC>iS3UMUeb>K1|z6H+QT#=xtJ`f zF&46*;Wb;@^*}%|k!>94?8IQ^IhKl+%S#Bz9+8hw;0ImU@xch|RkFb4-X*(n%;-^{ z_g%8=m2M^6{a~i^Md#5-eFz&*;~lPd-S@aUEcl#>dgM=V=CE5XDud_!b6e)TfA%K6 z{meyeIxM(MeYhSj{PC3w9CJws+()plIY)3k{da_`h3ksxSzk9pOfV zTM_O+xCh~KV*BC#4x6oWGs2w+_aQ7sScVWn_&hQy&uQ>F{tXR>kJoRVpR{e4*AosG zhr@Nd-Z;K#$j%M(lQyhfTU;LsuU%WWGjnZWA7}Z8@-A1%`@%>qN;Vb>byU+Ex zxjDf}eQ)jB5~Ruo5AD~oA-*BOnR>7(M&HRAhL=3di-Yg39+HpubK+Z)n=NI@s=~aEbhl-&1LdupC;mvIaY>$N-{dD=p z&sUehZAYi4u5Ni~UV1~gTl$G#t?J{=pXuygvDv)9<<_R~$W<*P#wB1;ohdG7wliaor(Y9u=tu5aC?_M|& zZbfsa{{V0CXb&bXLvxSCtX{e=KB8RH_s})Svoxi9Bai3YE{nU$baTcFd!;YlbwU?+QG> zO^(lsnegW6xRK75c>m%lQ(6<9sfV`4;XPFGx@OUfI02cG-vvw2ZqSN-qduxskdLc3O=quyKAHa>@d87O7c{LtR+79*DI?D1gcJ36sq_jK!aQ>@> zM_zk1{*@znHD+nS%6l@xh3v8-_Qe@zJ2 zPk8g~L+G@;mKjf_q-P~XUcuU0hBsS}{Ac5zFKk&bEM|q--0+g)0_n4mcYZjG4f`={ z*z@0d=eK>lhwgW{Z9n>apR4AFpH5v3?eiG3_d5RD8?jFP1N&hcZtttD;A=Wjcm`1;pw9W*$8`NPF!JrDJEs&^)*{`A~C z>+pmDZr&_yNd1K~A-DRK6|aozi$UQ`%B^0yBK4GfpBR4^iZI1_a{kTSsTKJS6^RTUtd?a`>(^|%sa{*=G%9k>ob@=J~F{^ z+ZUNz-@)AKX%|3a>w*4KM8` z_1GL38JsjBczZ)|f?HpI!pOASC!|d}v>C534mdhE|J%4%nRfeASKV*`Hvv=d5AF22 zw(E~LxvL{9Va+o1NBW7k;#!>Wr2X5{LpL^ud(RJhR^6Nw#EMMFEiQhsxHzU^bHeHu z^-cBDLr$bk=-{&v_b2d1dZdi!`li4eOtz)BD<4br_dXQkET6Ng@9GY@A4^=n>Myyg zB6TX<@@IdnAI8^YjhX**PeY#bU}HmY;^B!6oBgXd?~7YuwreE9a|1m>^>01uq<^pZ z&;zJ$o6nE;%M)CK^^bnG?K``Ue6n+A@iC9ToB!#29PaIDTHS~pO#Shk`jvSf9v;2w zR_}+0vp<~XX*f3e?OVMK$FduydHZb`di1G{{~8W|v~63zx&EYWo8Jq6=Kt0qoF?^q z@~Izs^LJfnnYm{}b2n%0{+zW>1riQBv9K>wA~IaaF%3>1l)a(Ao=gSIj%oTHxH*t@({JIEs-GarR zJ+<2#*K}d-=6Q!3rZ_vpIsTTNFXi=n^28gX@A--Ml`-BEZ)9&=cVe>RZ)rX<`uQ>5 z<|Em2H#bjl;yljWb-N}z{f_pVy>Q|Kd%cH#exZ8O{zud2uJCs|fI(H@yo-00BV#G? zv^ACrGv8_OrJ7+hWW7XwjPfJf7+l_uRwwLxx|3dS&Q19zg0+M}&8A$6N{kxU1u;o*< zAa}t2{^xJI?KUTnIj}Y>aOWNQBZd*Om$Cjljbz>Z2|Hr;dGu2QYd)ac$Tt$=Vw{s6 zXzcG4VB5>?yzL$8{nv&5=LgmX@FAH1 zzpRHgK_qZ`8;dgg|Dt_=lR zX5wFcIy##5aOYKxP2ci+3+Ua3yqKmmw{DoDIe+HIJ0Z`}g4Rh6=999N#84VG>4r&8 zz6UkkWTsPHKNt0ZL!aHAtucqwFf$|^?RO~FS-l;HEY6r*XWQoRhQNlHexX4H*j9em z|NPK6Pi$;_LJYr|(Bf?f|7vZhN5kRz#om`g-o}Uc#x7P%C?TBSEK3jddSu<|rThj$ zCXW>}+=}B^G1Hl|dC*tAjipZJy3IJWShLUTE-Rdp;x8MV_O-{r*M{m>U4tFj#@17(8fQ8DAVZWLj*(%9{mN4(O%2R(rdDA{98Mv*ylKY9Q2B@r zc}?s5cSgCu*EimYi*@kLjLl8K(7Fu|HQ@#LRoBEF`t=2;@RROYYy3&N7s#5n&olKI zw+a5l#%yQmGg;I0qZwaM^q0q76RjGILp(feV%hnZHTgol-c4*i{Au{Fxj2Mc^ZSOw z=ly-^H$J|6&-86Qd%qgzKZ+^6d)#j>*!keU&jz1al#u_+3z_LtYgzc<$g%D2-u{9n zeE0;X1Uq-t>z7haAKC2*tveQ9|5`nEqHf)LCw_!+1KEssIPo=)G$5bH%0_q>fzJsr z?vHRg0>)~{TUHRirDlcMUd*xO0f%!K&MUIk>u762 z8JjXgIp@x%wjUqoY~OZgBF>XuY>EjT*no3T94)=b<0Kp|n-j)U*a`Z*=_lUF=k|M`-;X5PiGj@Fbd7&CID!9+|xka0^YYnN14SJl*&mfY&7a&fSttg2?Q zrK+l1SX#r3fw5}E>aIpHekD=F5=Gp7+aun z32u(n1YpRiUagl@ma}&El-5=)saa4uIr4=w8cGw;IwZ=c=arP;dx*8pz$L@=&lxyp z;GD6S|EI1>%4_gV(W;t9+~xbpYcw7H1uZ_jz^AtY6eSu+hErfdhuZrmMs0`?oF4-^1g@9xpd}552(c zAiOoaB{7WI(D<-&ukK~%-rBP{t(S2ysL31myt6CqDrEMrSz$Je!abRiJ#zfJe)Sa{ z@^@$E2ec45uv}E`&{p^Xi3;RXfwufQnk2{oz zw)TPXq75gy*vFf=0EgS5`f32cyCvpFI0SAC-SLxb8cWzv|Hhq8GEM|!^UccuPyTD)k z)l{%Gt=IKqy>b73p&{+6vMK#POz^&!;K89%LxK_6+FYaciY|p&rgexO98xAxl zTmh>MFE%H1-{;-1xjDhVBYwlW=7gjTE1DA$H$2pw&}~DoIU!-gjOK*+4SCH8aT`W7 zC&X?@Yfgy4!50c?(BrTCG>oA;oaL`h-_Wyh2wNRp|JB~WqWMW>#gw|!&uv>8-nGB& zz@#1VyMp~!m?5((t^ZqNy|~~J8Q6_GF0=+yBgy8p)cJQfhk7~4Jaj(~=p)6n53;dm z?S8uVcjzaqm57gmoWkUz6L6g=Ep@Q(kpzFYVcj@~FM%sQ@5Rsu=i7Xio$(5!|A;WK zcIM1!fr%C6yglwFW|r3A>y=2{zBpK3f%tCoDd50Ny!MLkz+(H1Tit5oG2k>hq3hpO1dr!Dr|%5uc-@eIEHgw$HO4 zsn6@9eUAOF4n7M$jQG4J+UM%?w$CkpRG;x>13EV7lRwyoDSto@q1}_?Z}xKUHn4V5 z`2*#3!3wj=g67-M18eW9stnvyTD_#C9ADDJ7f%P)PQ?-P?Uf74tFc2ek4GRQ9=M3s z(Jb!)Jj^3DOi#pTrHyyEnRw4MMfDcAyRzaDESgm6dUw+}#`tfHfyToBe+*#!$48GV zGX~nnf5IOke}Y%fb)L2Bo9r&Pg{p_e`FC`<;_UjLLRq7UYfKzmX$z zOmx#IM)>d}qnk$P?OStiL>}MdY-R4@@E%DTLM9de3*TPS`!yQpvL28OH;O#>qRV+d zhQeb;$}BgEJl_$Jv@X|t8W+fNP4jsHirQ~-laAU=mo)7?m*HH?Cc|Rh$L%UF+oF1w zugo?nvwq3}i*5Uh)s1b?yta+))Aqx*tG%6x^fkhvdaUfxUOa?(|;PBL+GE(d%@Im zJ@YXD@(2V9ZOD9Xf_mONq)<<0Og;Dc6sE~q)|aS+P)}ZiK>I{lA=Hz3--r4EU@oFQ z13(=^KG-Yz0x&Ks8~t50hR~kOn0AGhp3KYs)ZZ&M^cl2l$Xe$`mY&QpLHnmIJ(*=u z{~VaUncf0cKQCJLWcBkKOHby#X!_xE?iBhV<07fin`hodAB%!?eewBsmdm`o2oUB~ z(XmQDT+Enbi}r&MD6}W{K%m|p^W>{VKNT^nNBe0AI!wX5k+pR+~1k zuHR$e1!BYc&HPjP5og63jL60AyA)+O2!FuYK z>-@72++Xxx1>?`yHv+B|{j*>l1G~W5w+CnpVY%d7#H^bKm7$K@4V)~@_ZPV>Q9m8r zL%0~M_6xxjrpel$4}qsZmyYlnm_^fOFIe;P{Tm9?Dmu1V78f(twy=E^+LOB@q$3PP zP#bQ?923+RBWQif!4&2t>-wz(Ge7M&So){Il&CzwJT zvd(p^gO00uu-50RVDi-8+LZ~ORUJS1wP^eeYzRiS!HjLH(aM7{; z++HYM<(&;Z^J+|c&Ks1j?72PCo-yUWYr}HrhcShI$T}BgQ3;`*tm9!Ul@RL5nr{M? z5T;eMf9ThXz?hv;G&m_i%!)d;LxD*}aj@^uK*A3*RRP~V0y2!Z;u2o&ncIwyPzR{Ot$ zeF$CzDzzU{z&f6Je}O_jpg1amp{oDVsVGhGMPHa-TX(1zR(F>UO9 zC3%AAPk~ua+P^ED4n70c{p|Z-3T;$$JTR?n&r2+met3LD=_)VR5$zaLXhY`q#=K(? zDAbdAoJT$9B?|TA00Q;jK+t*PJ75ZJ$l5>Or4m9tnKARejNp~@Zp3PT08F7Bnf_^a zQex&kg+QT=iuMWXOnZ%KZ?`Mj-tI##qfhF%-7+u7JLgk!5dv2YZHf_e9M*wVzXbd? z0_!l1N(k-AHzB5<6_%c?<7y{Z`{7lvjuT!lrJg>20@h>Tx53oW|1ZG35z{}frBbLT zb6%ibfd3%WlQR(0ev+jpvz^pG1Ewq5KMU65&+mb?ZoGzj3zj2t{=k0_+LQf=(-Hn^ z>B*c2sJenqAhahlrhRX)`sejw-G}Caxv!U|Ec{Z@FKlFfUol z%>(QHw*ovEfn_~u>Gy+G|9eZHjE++Mc(B&F1g!pfj7{mP&i`BW)b{dNPUqWiSan{1 zi8{NjasP{%Np${Z>@eFD>vnilnp;4-_^`ILkKFB;z0)qf$eSCk&S%c7?B&eWF22YN z;Ocy4t=r2vg4@N1=fiCAnJ*o+YkW>#djjNhCPt-ik4oo9r3<3clcUnQ$9B~|oLQ%c z1-Ds`c^bVvi_ctDveS3BCqO=PCeyC+IeIqZ>U@!_jhdd_ZVd88j;eI|y-~~OMy2OP zrSFeQ7e}S%N2N=m(xp-92cpvDQRzidX>QH!;)`6Za&h=Py=J@kI=l_X`tvBIU3^h*dHBo`nY}!%Jpt_-i=xsiqS7r<>2FK=X_VCqXD|FV2IUomUYP$*MA`pQ z(%EMD-S~YDTD#|ey)fUUOFAC9UYPIroePSap5@Gu^aSX7;SBO&Nz;byT_8 zZI?9rv6nN~IUZ&IwxoG%)(gKs_KBonhZ9lsN7Ub4T)H<2q! zqkdGD#_bSLc8CuuC1&_*>zc&<{Cq$1q-8oh+BSx6C)(*=Z2-B?AP`sS`A%TQd)~|h}%OA zPuKo0|88~XRot&JtixT8b*SsPlS|$6Bad99;5np64re)UdZy6A zJ@@uZcbUh=YLiNy=IR6F87^m##ZM+#@@853Y>RWq_uwCdbF}8=^#IlL97Xk=>M3RM z8iBUg)N>XT5K~X#0MZ^gO?)kk(^f^d-f=2DGJJFkUC!9;0`L4|*@&cC&$R#dMvv@jL@^Yzu zx6ZUz4#!O&3Y)eIo3=|{({|erFNQ#jA8D`gBd5&9kJuPLa_VFIF?}dLO&{9+xlsMv zdK^Nic!W(I(p;^n!*wp3I@sIb3|DXJAbL{=VN(a;08Dk9WRUIkSnc}Bvh>*&oAoI6 zV=TQ{kD|||Udoz8<^ipUZc|KZxu%V>eVH~^xyGiAwJw`}e#m9h##t`&zm{eESf?$X zfv%0w3mgB!#=o%fFQ-VxzvxXLN}roP6n%i@3TIfHX|d@;u`zupZ2C~x^r5inL*ZP@ z&m^++Z2?*OXBt_?&vc8~H9E)6vGnsSE+)(NSYqiHT3lgqwZ(O0Dj>@cv<}NHuD5ul z#Ub*2_y<{o;E{E@*5W6~(ykUu5A3*&+uJ5P9^yyv2=}l!+2Rz7%{mqPfTcICr zK3NuLTbyI@7>mt1mA2$sdb3VN5B0^{HH1s0UBaea!lqrqrd`6OUBUt6_XwMI37d8a z|4+25faOXXr&-LpCC9qYa@`=z{>vldWRSZ#u3F{mEH?IXsgj%|^TuegVZSDkxe!85 zlH(ap{mBXLeJEqY6$mjla-3sqy16#jVp%d4^4T30sk}(|Gmm4gl2G3rHea;#2gxJc z+nsBpRsJdYw6#!_;+NK zOX0l;t;7Ej8$P$>LD2THY_;cZkNPykgN5meVvp;~!)K0_~R|=Aj#HIDW}V zQ}7SM!yPSaJ{dL~*W{$>_y<{tKpXBBtAxLVc$vlZ!W_%rAj1#039{Db3F_e|h_*g2 zHXM)SBo0!@_Ykx`dxhH&|H#rGA;W(FF*#`l{y~l-XkOlPBEO56*Br>K&wmL23Gsgl zbBtXe!zZ^aZ1*5&xp-$5Pu-dKKan%zX@|2 z!B0?|wsZSP6lNXFyfG308GyjwnMg-IGlz)&M$xmLoF{2hgSb$b_Dm;>{Zi4NLA+7) zoHzE6k@pPZqr&eY{x@Oz;rP=!_*j3b&vnAQPRi|#Wnp?Wto_DqgZ8`+l}m;Vl7`iW zcT#9G4e?#Vyc=QWN!W9HC#!w6*gT4OmGBJ2YlXvzn=O7y_$1(MworVYsIW{9QZ>r{BYYOC(Xh?$R`N2;higPdt^R~(2ERv_6=F>`3x6r z@aJxWun7n!%?3cS5t6&RKBo%vc|J4GKz|Ino9G8j{cU6p7RUr)uJ@V3Twe>wu;(*^ zyhg3u3(LrCmzlT4XMfRiyW>1U8;;GP!YubzGRkFJ$lAANUBjO1i>GJI+lY9va4q6$ zVfIzMFm1kK>HnDw|2+_s^&99L#OB+GHwn`Z(=4kE@pEM4<$5P;-tSTm8`_)o4n79m zzfuo-_5)e%e+Z6QdOS0;(1Z#ab=E!A;hX`}- z940&lu{j=q4cFsz(Ub4Dn9nAt&vh0LW8JQB*Hur8c~>c!D;h#hnq$zNmtfEF$l;!R zrQ02VzYj40zk~REX*;X_E(Xi=a?iX(E)^gsy1oD_ah!chCRnES+|`r)Jq*E zhz-jjC*6gAkSPeXVH2pLAC4b#l3WidrXDs65tj+GU5hQgjf{*O!)6QWlRVn>bBiz{+?jCg+hD`G(uV!> z&%*2nvn{~qDex}Qv+X}2Lw_3aG0}6oFmpTf^l9b|F!#?595Z0e+ z{HHM2VJVi;elg+(GHe3S^Ij13^xqq4>e+5`5*q|D>l!xMU~C@7p6i6qcQ7yKl?i0z z%@j^50zgcE!iMX*5P|kV#FfI2Azn#FUiL9LsTltts}X1)M!cR38`goW{>>Z$JvR+A zhtN4>I|B0_M*JEXHXNH|&3lA;soR@kGY&CXZMZ(v<^zlWB+Tbu%{~SGbD<+A%?CjG zfSH%aazn|mnFKvKi5n$kgxGMOV~*2c&*y;Wi=O)db36upJ~$-$Zy^4fF#DFrSS;&V z#M^~;A%0D`5wSU@g3S@|>!N4g6T*CE_m^bUlk1I~R04o}AU1q%_?$4$Ej|+aX|N%y z{RPY32Rqh{&l&SxsPYxU$%y&8uhg?X1BLmV@i5^V5oZh2W{U81#QcpE<}F5CE6i=- zVc`R)%Qwhq*L371>-yzy323>k7IT}YJ`?u+5cu0;)rdL%lE=8){wQHY?zRAZ0@%z~ zu-^n;hCq96`$=Tzdms)7b6=fqG0US3w-2+efw`UKQx8APOV;|c-)Ucr*vvoRaxm*k z{k4df2y>tOWitF=kzw`oRk0~X{J6#37bLR+kN`q*Z+BZ8NQOQJ@f6Yj0C6!HdiF!D z#oW%-PlLtgxDod3pRLrxKmBaCY<7vBbu@hld-el4=>hzM^h99Z0f_sOVZ%0(wT;6? zpMsdI`W)(!m)qt9;X4se7v{WjpKzpaVb3~#QS|kQ8R&=gTth}3IQNpZtY+$^tgyvC zGIvCfD-g)+Te9Y5dy@OOW770LnC-}-9u1w1_&PFndbx@dF+Ko`|4%&Da(_y2eQ! zZ|z$H?(Ym1h@RtWDOvPp9|1mtZT#Do{)ZO-M)>cD|0=u^abM)2ALcd3Z(x3RI#=}M zM}>KQ@TA3jK2-DaS!33j!f{DG+hMjHFqhv*J#74l$$IR8A!6)rMVu?l{xJO$aP!_x zJ@V2wS+7ydras`>RFPrBF+x`VOQ;XH&ylYX{yO5P$gt4JLr?Y3$y=u{>HoGV82tJ2|YQf z8UPs}dX6cw+K&=_HuPlGPZd44b+YQsem3Afcm5DvCOl&5>hMY7L0C`hvcpZr13E&?j2Eh}+KM2RYCxCwtjv-F~{~#O_ zo&f$qxb8gx{DW}4dIIFF_9iXe3S4=#1C5B zDomRfEdBQ_HrpWlFt3>(ZUYEwzj3`LL(jI7_576Uk9A=G-!A+e#CMTl&;B4Maj-)Q z5olkD_yey`e-N^clWV}q82qCU543nVIoItUa#9WcLAoO(4|0F| zjPq%7p4%s8J^|DBJh7SVbB_sV!}cx_d$#2{;S|I#33I%dZ5j3faJt9!kLo#-$tZUj z;=4u9_4Xyv=b|igZky-M_b-cnF7$lXo^{~5ZW9KY=kBS`2AgdG{?}r;InD&r=O4vB z2R0uH)872{9&C0%H`43+9|L_J8T!Gz@8u&s;L>rwQvZ zKtA=bVSQ#ffAmiH*4~Cv2{b!+s&`$!gDg4C>#Ui;4XgML!MkYH}Xl^+jH?=3Ps@*qd`S z;ccS-1>zqG^ZgUEkH~Z9B(skwfIWbXeLev_S?j>h1!{3smeGlj< z9xx>aL7CgRGUr)k=21?zIK|>ri@Sl7C*U8XCjyzi%{+jKVUb79E1_rklf;H)E)b^P z9Q(nB<@4B%eyC^L$gImNmj1`WtkpKF8z(3@-8;y+jP8PH#Wkc>L# zAvWg`u*nqGbrBGoY{X{227B(Wn1^{Q5Kko|Z6_6 zD*7Kw-pE)L{W;M`#;WMeSOo{L+>BMxo3RScfWC>Z1k(cAJ(-@Y#W(*6PF$~@h zdozZSm*bGE<(e@p_GSzVGY`xCJz_J4k(c9;ta*=%4eM;iu;gVP=8cSD-(79S;W)#Q3?v~M(jGs5Kn zBF{*dIbJdvpziBnLyY_p3w%)v7m>BkU0n*4q!+zf@dtrJqGf~ zHKJ;yJscR2We6Ue|5EA^JhzhEeYxj0m)9clu&#q}1iAt$(gS}f+Z4%PEGUYX}~9_}0O4rX?i#J)k#p0JN-f!_yi%(kozQyOsJ>0TBwKxIux9a)K zta8BOEQ`mGd%1olSv=k1c@{6UxX$8wi`Q7(V)3&U@3eTY#fL3^)8aE0pR<_1w@E#7YNZi^3EeB9#G7N52FBa8X* z3~f7qXHq$Zob0aO42!cZ9%pfZ#j`9fwz$ILWfrfrc&){oEZ$=AOXS{e-S%62)Z&vC zzi;t*i$AqEA+gjr&^pz?(f>hk0Tw-yx#mg-YS^Na~ zTDPpQ#oI03ZSg^ik6V1&;V_+6BdUp-fr=3iw}}B+%_J!__W1mE&hl+$hGH(8IH=TibZo6|^?+t_|9^ z?u#zBHtnu$-0ixHUXU&Na_w&4@VoF~ZSt4%W0`inR`kO)*eGf*>#XA((nZapW{=A` zj55FIdgUrBTClj<8Q!_K&9d@Zd{(L!Q|ZN*mn|_r=X0q|po__@vp>!r*4Ee6Nbhy9czoTPKlAkX_*F&z$x$$zn(`BYhbk4=>yBM^_G&1#m zu8KsgFVVutAo*M#Bi0d*9cD&Z|JDc7hA*gEY<^d2__Dgv%G%&?HbXiDQ$LQ<+7s0^ zRn>BI_qn0~tZ*yI!KG9qyakBM>=9AsB^Yw9EGfo)J)C~K_cRf68PoX)wm;q?R3E?y z=LzRh38}FB;TA{4UnSV~$6JV9`70NFE@H|u%O5V6NBpe=+x~KqW>8VzYoH+K%7T^f zw*}1mp1AZH@z(~n{naC#fuN%P_CaC$%R)nVpOyY_8871Rw_w}fvq)zlsHneRLt*=? zhreRz=nt2NBK{KL%=UL&mLW2t{`h{q?e7fy>H5W`hKRpmQU2bzlxv!eW+#WGypjfmEd&&%5NOU3=;6j;$8PKP4?mPYwIk7ev<74^sG7Hoex z@JCzvy9$BJ*#3=C{&=sL<*KMZzTaT`%fLPD0vOTX)d=d3?^EF~vc2&ha{y@-^~Za| zw!aGaD~1vM@i|%b_j}mkFXC@G5?%G*`%(Um!XMi~f4r2d{*t{N{jHRIFfpR_<8zUA z{oaQ^9WVW0ss3`K{Dm&!kIzlo{?1$ec-dC{l}GvGJ$LrA3hgMoXKnlY6#kAv&-Px2 zp#HuY<&XE?)d$QXygtg`VLYdx?M<`%9gXsL68_lFD(d_7D1UFlpNTa>@l-1hZ5(DG;Qe_Q_e9Kj}}RkVIXQ7$=G7UTffH|#%NrqTKZqw2?d z|6Q$*c~SlnCb;i5&>t`LsK2j8`QtMH)3IDd>(?0N?+pCu_RC8$>ThS1zbvF}Vc$|- z7CT*hF}uAmVEG5bZN~xV$+LObUvJsaX*+%$<*x+kuKMM4 zl)tm^r{ij*FKCeiG&H z=oI(e3;M&ZDdO)xqWryy!I-Pg#E!||M)}LQ(|taX{`iO$%Vm4{od&zT$v7CPg_opgaF2^NVw_o0S;&bXMTCNWU^JEWn;P1 z5VXCS;!pc|BJQ!UJ}O%7y;0>(haKlB6)l&~kl5v>&Tb!ncf(lAT@mH49{#?d&cu$% z+m;!oGxQuxErkBF|fvZ!+F zVaH=a6)iUyRc=NhEHJ0C9di-1+$Y7KZeqMg62Nj5^|vEH| zbtZO99*FX{68Ioak@Num~;p%TeV{ zL%DozjqNBEJC2uK;!oGxJe*7fpjT0UJEHvUEN)+K55QR4@vivOb}Wa#GIfSn+tD3^ zlC1srKI|%}5YciIU`NgseUBi%6@bdJ9g7gO+#AH7mOH(V`_7JJiwuq?iX9-u81o4OPHK*&_WT@HN%r)r~SMWb{UqPwwKQf+3nqn&g1zi+gpvG z?KRI2A+2-moA9R$b)?)E;SWPPA~C5Q$Eh~`$5KBv90$9dnn0{}Ka8qh53KwIEM)!a z5VU^Bqx_wNzi}ATD(dfzD1RvnT|4@F7(xBfUi*$dGSSKPXxJm*0tDLiK!7{0rig68 zLF8^O6wz|A`FF6J^(cOuikU^!?uP6@2eFebyZ=Y!1IeP=ETu1*gZH>FwJ8w`o+K^L1}}+ws8K zI{(I}_Vj5!{Oz@C>(UQzeYw1Q^Wh(Xmw))@a&P+KpY}fw+g7jhn0JNaoJnwoCAP+U zTpZ+0*q`1roE|7k^eq3d|M@`H_@U!&9dJwfJZIDa?+#yjaEfc#kT%7CZ*wqrS%SaY z@*gw@^O}PbnuC*u`KHhAS@^)9ZC_~!7Wflp;5GB$WPk6tHTaf9WBe|kGw#&${k(@( z@$IC*kN3x!4P;C5^P76^^X`am3r=>ux1~*9vvI<~9?N11<3Ec_a<*hV7UM42m)IK2 zYYj_v+tTuOXS4<<_~YEAJlAvfd0T%j%L^0x_Zu)jIJwp5G>5aE+L+Y*;|s0b!1JEk znAnh3;E!8%l{de{x&HB({JW7AosxC)Q+>U0!=1qQ_b0u!GdJew6FY->Nzb)y_C3Eh z7VSAS(AgK~@9UO#Ut;gM3H=)U-W>@I!KtopP~yTN|JIN;we?P?U;5C{_3Phj*xaMv zcUB*0*z8Y_br$`gH8^qgX4m%9BW-DuS~okdkIhN_WLMh6#op`3_TG&1`cvKWea@5@ zS`(e#8$A;adhXctrybI!9kFiS#zA;rTsZC*7f`je6q;M5brX+J>K0v=*iR%|7 zp7b1xrP|H3er&gGg|_1BiR-t;Z}p7x@ACy(1FjMBeGnJ&?DNf?Gk5N>Sj`L5Phw!2 zn*IHN>R>uHCghnLTD^L4!upV}pk(#Z!jJxZEWV@7Cnx}#ND1qYIFCO3=%Pa&XK_L! zx?*wSu(Pg1DK>+jaDVu!c6z&RGT&*vHpOI$xB#y@VKuljju+4^nXj}Q1$KKz$Y zw|dTh{J8&$cVmym*vk_=A8^~WB{aZXM;JS*wlen-)o zh*y*|rTgJY`+P}9BRX`<2Z{b^w%PiziJ@7G<~JlbixzE~<7YQU%)>(h>l3?$%j!=i zAI`8VG$sCU^46YMf$?sezK(Sox7FjXXjh^5xv?!hQSl8M7cN@F_DB4}{868~desBW z7kObET0La_2~R=EklBSRKO7dDAA^>1e4^ECdOj$j|M`h`IkRJY4(}UPRo=x%VJ1Qm z2gQ=gx|&Cf=5A;bovNA#f|ccu2J6bja2nL{PDRy%Anq$Yf^QTLX)I{`OLtEh6BE?Sc2M=m75I1ox1Y63NGkfK@H}ZE2eo@#f-X1bU)+`Ox|F7Q$m2msM!=!E zx%SKZF`CW*b2+9_lYa-|<7BH9dnh%fH^AK=|9ZBP|kXb$rF=xC&1Rf{hw8hxp zhnRXz^B9fGmm<*L7ZF%5P5-m#)!!ybZxy>8h;eDbeEX02euTjG9zkIGX9#Q`&#jpL zB?3-6%sYE5?<@lQ2-Acq|0Be#kEZ_u=3y8Qn`j@4n9DWIV@*x zceJE$L3}0BQxTi~K}>&|21bPSbnciqacm%SK}}U{ZCzDW#jv~X2$a@V4;yjQ@R7r_ zi$-RTyea$Uk=cU-uENwYfNXH<%rSRkizf4K?ChDh7v)WudH1y0vu-b%HhI?V_vB5R zIX*ivZ^C5!hcSfhpv-flNID>CjsptE2!-}6hr&F{wmx9#nO|*moIzzoe|K~UQtS_n z)4^HBqP>1hs{KGP?KP(T^`ay5kd~rtBWqq>XJlT+tQT!^5w1aC-Y+0I7wjBq6w zr_x5h3amc)9;o&qzZI$Lcb#xL^6(y!`e^}E*cKHXKVzZbVvU)1oEUXwPaW-b8DoY$ z2+Z4tK%tJz?VtMB5w!k?!CuiHL9F%UJV#+(6|E_KGu-rum%Y}c7m_i$}*5N1Cn&AiH4b3-W_H!LWI=26T_>L`q2cVAj-ig`vKA2fnQ-RU* zg=M~~iWPHfm$)xy0;@~r*XXAEp)Ws`*z;vVC&F*Y_(exVT8!~NhS{|>{2U^J#r!#? z{?r!3dW`LTi+X?7kKZ<&SF>ahJ_z~I-&o|&A?+6y-RB=+-+ouo`>bE>l9~#a4e!g9 z(Zs!s!VG>hiyyLK?A?2p_Z3Gk|C-_6-*K$O$1uH;Mq?TU6ytPan`xtMKji6h<|WVH z1fM2x{33cu&HUP`MRVtuDH7ipIf?Y-aOpRoF<)83__)$ z==v1A1}Srwet(Yb$j`w79D6LC-hS*m}j&qT}p~P7wQ| zb7{yIQTr40S*dU?KcesQBlcZ>#J-QKq z7NwkJBCFil!SUkZ;9=$*`YePz?kP~D4IXRGE#?{^*N7Z}J9d=Uf^VZ7{2;JL|InGv_{m9U7LpWdLtXH>IAmnwBHHi+#rJIFmgJWgdVOj1I`PZPsHCAYo>!QCQ z%rWp^MW1!g-)c~YHb)3^?7CW*V^nTyKJPMej%77nSI@`;kD;q)IoC#FoAzlZUwAjd zDZ;G3tA#n1o+Eqf|^oIxsBoE&dc?cmnAm{$~ zMV^U}90=hb+z;VtCtEm>PN}SIinLfCUD#&2Pb2(|@F9f1GyJ?T%f)@ve*@v4g#U){ zh%oPK-WBFC<$XW(dCzqw8TrY)fr8O zP9KEiKnVZf(AB!{&3p$T$C;d8z7OFZ!#r10_}~GK9NFhYZPtq z8$T>p7C9CF;K+Ks+;J40DUef#bxziNx;lgo(`6q@9hQr%`7EX!I^RTiI~h8xb8=u5 z{=wD3Q)fNGe&o-1&p=-nK92CP;lCRGhhf%Z3Lk*MkpmYw^x6+>(oPOMbyya%mSrsE z(BZxO7s$|IS;$(J$&^Fq2twYgkryERG8y_T7deoNe{kjS)M2_y$6e%-*$|1wqhFMLjlV>>J@D#(-4bL`QY`DsBwc!

kLN>HyLg= z++ujE;T?wC4R;vcYxpU{2Mxbs_^{!lhL0Qe;rgNVmS{NHaGK$eVP4ZUZm!`x!}*4% z7@lr;w&7yKRfek#uP|I^IAXZTaI@hS!&?pSFx+k!Rprw)j1tLbQ6l#XJh|Y~;Qi=( z=|b?jmQXes=a)LQ!*g5hxVT~`lX9_>OGf`j$7_(AF;#nq1tq9 zM&z|d?%IjSIY&kHUE2`(79)48v^J%cjGYRWB!`TIVVw;SGL*sTjG_755PVZ(2e+1Tmg zdpKy=tqUnSnUr&I0q5q$2#+^%w=Sf}-MWy%#YShLVYe=%=&UyKCc~S_7&Fkhbs>e_ zx{$&hMrXfaw=SgUykX==4WBUV)`b*(w=Se`s1NdhYbBjq7gCsWB2->r*sTjGI&NJ^ zVYe=%uv-^WxX#3N>q3gW*~qsTcI!flj$0Q}*sTjG?AC=G;N=->mVCOkOJW|Me$2WI z-gCvCC#WB%+UptS$0*t-nxClFvl_u^7hdsfnP-b`3cT;a)2;_$9w2+^x@p{}RK{uM zNXJyeCrxRNQJ0y>r%oDQdYURbRqNFH`Y4^A%K9h`TT?Qr8ky}`fkyhPx@Px&kS%yDJg@KSa4I-A82`!nZVUI=xK{I;?XK+zxsTn~74X&`ui10p)v3Ka z2&}zw*yFX5_Rvj4?Nx!Ty=H8mE`MbbCm$i*Ot}Z7Jq{Bze|Lkey%ubT;MHmV8X>Ux zTL^o_kkKB85o)g;Z0&VmI~iV`+T%TgwYMMkav`I={<4qt_Y%Cd_Y}4>;nk_VgAiDI zCtzr+eEAqW_r|9iMBFS@(1wrI!q)MC|`0J$|!=_H4R2G%QZb z!Qai;a#UfgmkAw~gZ0RLEJtpPy%4tLF$MN|dJHd!vDXNDQy{0kf$(Z?ve@H2IUV1t zvEI~S)8+qG(bICw#5Uh8s-r!+TOcRra|7-fq|56C)5W2Qru+REdq+@_JV(^2y^S&U zns5SYIXIN29_xkA-S8K!=WOiw4Yt*(y`RU}I|zFmFEW38exddb$JjfL9X#jMslC@@ z?2W~<-ThFaJ?$%)KR&C2YBYaMI2qr=wmP-PZ?=>3bqAg;a~w*0d~D2pw8!V-w5P{y zEe_0=C=f@apD20=oO=T&?Ndfi)4c);Hr*|s^||j!G2IZnrh9|f<2g&mwNjP2t?7OR zdUBgVv5#w{<~j2IX%^hL)X0Zm3>j;WyKj!kUqMDsJIKU-&EFl8KQ%cG_FmymahmRm z7<-MdM?IEzIK0}UK2)QQ^TCqQR(Z}1fu|nNPZTfO7XaPdiZe|_O_#$X?K7yiFbm%% zKaHNd>Xp?jys+%TC8Y~43VCxFLe6>Y{g2Lb7?YPf*6sb|c@DL#U}Rz}Gk_8gb#Iis z^ONP`Gd4c!+XDXx{2$@phyR~+oJ+Ck1-8S^RrA9Zzq^YUhH*-y#ou%(k`Obgvw zQNy?8sQ+=HVdcK0VN2&PUAnBICd7B;PD)vA)%>NQWz`rDda_};W6MVk%N_0g3z5b} z|1rX143Yk=2s0{fU2=0pd5DYR;0<^gQd&BWmb@SJhVb(N{Hk|c$QP=CCU!H^%n!2t zNtwZbZZS+RTZ*4Cu$(@3w|D8CzQYxrxL)H2-}oW=^ktztaUv!9@LTlUwWWbbU0rcq zU2WqE{O~^G!0!_3d@W@i+h%wX5_F=%J@0)`+@oBS_Cd?=j%_z|Ju&w2xas$)!N=YY z8J&agg|h~=WOOuK9L_p-+YJrr;jA=RZ5R;FI_IT64gOYyF+L? zvFdC8YSp*?#c6hR2W_^e9%5+}$}9G7(jWYHpY(a@)nr|< z`{Bp?sM3R-sW*O}(;vLO?VVShGxh36vktW6c6E-;e>l|End|Lo+^43}F?Z#dFVflk zblsK?%rolV<7=2T{tW0p-Y2TQD5>!+6Jg}=`Zs-%r>AswJ(0GyATsOmK6R@*8m^40 zH@+AC(f8ME>NCHx(C^E5;pL*PF{MuoInbGgi3~kPMftDj(Er%N_-}>VV&+U6+S7+Ko310p;Ct*HB#*hBuZB=IsDC|TT#-Gvf zMDL7`N=i-gN2g9edu>MdPkrs3k*9Hjul-px$1X4T`I?`IpiDEHA{`Bn^v>zX1iTFI zdSaoGhFeO*2Q$~MUHSZ|qz#FE8V41A2YFbtJ}FW;JR7rweD(Q0R%DKegLJmBZZMx~ ztuNu9C-XWZJ7=`4zH!#tF@+dSg%c5@p>J1b_T%v;Z$h99_=USvWE)W6mdJkB|#izTmu>xg!h#;reO|D@QX3AST4x5 zTx;%0jkGpa)nDk_oKc?%@hoKh(8)Dt_hnf^5L}s-{7}CkZJyzb11~3FkXDryIp^0; zubua#-(-l*sQWD6-ZhZ{Yc^-Jr*GZh#W{52-diFQ)@=UF<|Dh(`?jSgdg9GVz1scr z2^h?EwH(^_L~oPZ^wdj8#P2LRE7Jzmzj%^)>*HIw3lq!=F@(!#`F_TM7rNg*dEU`c zbd#?s2+hXqgb+puPT+I@Cr-Zds%v6)V2;+E(nsCm^-%}~FA&1UUSDE_CTMRRv%7M}85xf=P$ebaE_ZjdP!_%P^ zIOZ)J<-FadF6CT;Eh6%tfWI!x$MQKgVWx$8v=_m`q z^Y(;t-d6M0mV5(zKjAqD=}wo{MUXQs4XMMjXTj6XYarv*Mi_mjdaCpj}ho_^QoDEO8AN5H`Ia%%VXKI5WqfWZfA@i*n<@}iucQI}r zfVa++FQ5>Pa`H%ol&?2(vew~4Moz{Zy3_wPn7e3aKY%vq|4Jbo#^8oKei2yX=7Lk8OPhSnqj|X2=+(sHSP{Dj~(Ow1U^ofk1ptF=M=}t>Q0@{!s_mE@$QM6-If=KBKqX{ zEq=c7DwEmtwY;$~I5VfjA`^V)i%5HZNKOQGfTx?AHqk#Z2#| znEmg>Y=1@?02?;v$BZ-$g7Ghp+0KvIz9D8?FCt8a@xLCkzd2_6hcVlGVzv*(Z2vuG zyB}M*IHqTxHFBH3`=sMZFc4kgxETGbW46m;wspP>9zaHCLFh9{OnbqM+NF!DF{7n+ zUhmzyTDs1haB=L?=e>8>Wz2i+!J|(kgO!sp69%s)dndx3Zgz`C>9ygea=0b7`Si`3 z;xc#P{H3*XmsW9h&GM+R+be38%)h;2ZpmU!uc@er?xJGq8(SNm+Q`uinb zZ0BXK4;*2_xq85R89G-F!mb`dPV6q08rSJ$cygyB-MFhO z>GEA&iH@tQp`Jd?`B_PDuC64mt1FSax)Qmot6`qLtE=H2ySfsc@euiW2LYE4?-zLi zS!}wx61l4@CJ5*1YJ|r#5%`5?lO^sP!^LEdvf#?$RlkZX`U?$LlcgSN$#MZ(VRTj+ zt|PMo;8w${%?MfY-$<5vXd;ioKe+Yq%FSfa-%P#`|KM8SRo;ip(GgrCymFAtiib;v z_wx=7E(PA7?$8Z_{k+qGV=~GivgmN|#NXJ{G5M4P+#JQ>nFJYfrq8mFnf`uZZ2CSF zX8PH5b`FN`piq6a2l95#FR5Hd?!i{fqC60^U#n3a&9sXZDu26Rgzgu-egjr zaDpB!LC!WA2x#fHBn`UTJ- ztNrg7oqG-Q#+Uiz@!TcMWBy-c0@1+PxRKf;EhWPIEVYmyyJ!=>s&3iW6F6hkaf-% z+biXW?%J--fub$i3?XEDCA(ushCYhy&M(zxy;IKfh#UyvAKX-U#=QaIwPffpeX{0l z7Uj^vpDP2`2p$7w95QbRTgbTcqK<3Zkn;v_hv+;J@68!go!^O^I_?~YKHKT}JT73~ zl#UgqPNm^SvZQslk#7@bT>frW?flvB`@(!cFqp>?Y5fB-HwO^R2MXU8IUhzmAiNLZ z&xQHGg1<*)T;8<*S(tJ8pn`d$`-jMxpAUtZRyN`=E^q!P3a>}Vbv-F3f8Fo~VLn87 zP?$H>KNO~Y=7Z@1eLpwyXM|aYe>Zae=96hrKF#nA!aQC)u3DBa8=W%4i-eg67MnKt zAb{PU@+HD02*(Mt%}yjE65A>{kb!@2SHm;zY=qa6p~H4d4zOc~<37sSR>=VwZ!itU zZ9!N`h7P+Xvf5ulIqf5#w~7wUl6CG_lgL8|$vQvo9?B8-euSIIu%9Wcd3#87c+dEA z(a9E8J5Pwt^9X+}Iy|SzYUi&a&qYYqIcslIjy&*u`Ij&sR`!9XoW~-CjJ%EIesEwo z0B(rr@WCb5PNF^^R`LNe_4A-Z);vrXIr|oJK*m=^lp`+hOTQvI`OqP2+!Z1(fSjyl zch_sgT@P8k=uCkQS>v{dd>Z6rolm!wa>V8Jf&D-8JRLe@olobk1<>I`(q}|xCUnTE z^9RbI!w05+GJI6{LxlenW}k6fm=EI;c`hSewmY(xE17cG>GbihRtf&B2>6K4PYfH1EM z?CWWh?d`|Hk0RuEDk#rE$ZgfxBg{JaH5utfkSQAxG*0a zpCrQ$`#-YIdF+dQ)Td6s@R`E72vf<3yB=}L8h41%87ex>&>?F+$BBG1i zBi-o;@nY23Z-Jbwac77QuWRf#`7K;J_G@H_-S-*DiQsvZV<5H!;e4{_v#n766NIaT zS)bdD9K~}wI}p0-9rVc|%3&uctaB>a1=A+e;rNNX5TP4`K_7pP19G1=!|1TTpv@G7 ztPESaYMqI z2W-5j`6f!AiWy9sdYuxeV1WLX80p*$4 zRxUQo`cXNLukvccO@>)^)!9n!hktMn!z*_f-cM!)z#W8Fe#7ul!zTB~1r4Ve&NS@isYxEj8@ZdOCi0m^UTk=wVP3N|-PMNOJT8cH{G#oL!-f)ZI?S|V8?=k$8;X{TG8-Cj`-z00^f`&i!{Jvf< zA-uOb(T`)Eb{bvu&Ckco$BVuI`UIVxw=|zd(fej??+JUSnSiH-_@tS4s`rso?qW)M z>O8raVxC^XmhmHU>r_5XcAcW{|KKz`UkGg+mlpQ}1qAN?m*W9-IPIL{V>)ua+roN+ zsowXPLfB?}?&El*K(=L=;l|Wz1G}6aLp~$6_8!K7knuzC=;osKs=zjXjo9W`N1fU( zgTUJBfW0Y@h2U}eMC~!YwYLS^^y<{!8VIbtL?p^J7=8KS#Syyx)rS~fKaftOvdVhcp?a8p$+4}(7 z>bQ?S8UGmS@m+{(GshR|w7dZ*+4AP%c@wYiAt-Was^z^n#$F3{3{+#H$IYA=dqE7g z*$zVR1K`!(j2L?lW5*oqS4Ta%FUHu*gguTyL-1$8tG%T$_ISO~AKyUD=`rN9d&bG< z2HXkQ+m4D4fzO6ld+WuX)^ivKpJQ}&*zKd|yf}th&ksZI5miE{<#-HAHr=hmz3-KU zpu_snbPtI=P3vYnd{>5=ON;5fiGMO|r`Y#h=;b-`{!xeSU9snF;TZ<>vULNY>Ky~v z{3Sz)_aPzpA@G_%H>Sn5y7yr(O$!g9+B+FzZyM}TF9aRFmQ{PyH_g(Qf=0rzU^?V_ zJd(jY_w?KV`U+C;Y{W#Q9Xhr#t5=SD>@!ZICokV?KkYoRv6qg`%MHgue-X8T>ckyWro2=kIXR;Xe<5E&M$Aufg8~&)>-K z-O?lQY%I{XbF|m$85UU)}G$`FopX4j z==Vc5W46Jj@TPn5d;hj1-vem_TDIoS+jsVkNOE}Z&oQlT&G`Osn86v(rR^v@da~}( zZ|`6(nNDgqdZ@Z%`E~y>A$4^B-1=2T2NRp)BJpd^jqApojkER+T(fy)`_Q(GxI2BE z4{}FR(Y}N!qi2tqwf?Ngq`ec@Y!0?x-zx>Pe`c>N_Ufc{5_t4aJaYMrKL)L5zW|!ubg;s@%X1~Kad3RJl_nn#CdqZ9- zfwha`bC2iW5tn<(gy6u&s_?$|>PD|>d|hWXMJ}rwS(pZ?3ovb7e~^qhhHzPU-EvZ(PXtg)e*ob?p*nTr+()RJ~;3 z{IdC|1gK$*a%rb;MC;`{ABsD2LnkI&N=wS#dC%10I)gJbv;%#^wzkx&Y4zX6>W0gl z;!AzJCept1o=rpTh$K?WI_?_OqPYwyoh|BT#NkARd;D z8Ncb_VOfvv#Qfo5!yjx7m-vni8}{0;%xG2Im~3sV_)OHsMPlPZ&&DXvM$Ut+n1ej* zg4c$PjG7o3v?itmKC)Pw`dh{J#7OJ0Vdbw4D?Ko*%#|<4maiGdGoi^$#%=E#X{~A5 zfBUkQjUC$}5B1x)vq6sNlSxA^h)(<}T00VR!&8=q-aofLo=^vMrc9jI69UfLR>oEWKTXAI}Z=6h8sEW7#X{#df zpOIF~Gjm%@azR@D9eh@CaAZZE51 zZ_z99$6lGT^U85?-E}9kTU!b`wq?|`PAS1cF*`F#lB$<6@#y4UoAOJTXRPzE@45X@ zzG`G=UruWmz}H|)3NPdek_jNBQHodEWUa1lI4rB zfI-PpTuidvq6$l^mMmLX9$LJlHdIwoU0tzw1iDIo_wJ=Wx8UBp?@jR>^F;cs>4W~$ z_c%Vj_q<<{O7c(d$=ZQ*UurWZa&oN#&Ww!oYqt}DpBYx&`GihlF{_7udQ{uA@f zy`&FJ{G#j=h%kL<2QT{^i?wAG1*d#3t|dEp`{?k9FRlF3y65Xw?rQpWGGftsV7zd{dBgD2t@A<}|BkqpAM}~NZNTo4;nu3PHC5+adCwVJ zvwCKjZ{9Yq@XYqCR@`e%^UBn?cEx2yvp!h)7-G5a>`m~6TUM_fQ_q3<-gRp>2imXS z+9tZ&^8V5Ii^!y+*&i1AeZhhCP?2vSj{kukznhX)z8g$vd@Q*6z>j{P^Vjj)Xz8Ii zz4~C(G3?u~WDMw@gt&oV|6_5!@P9wW@#*dXPkk$S#@?S#pI-Y;#W~@nx4$Ndk<6?q7UP}-T?(0_Ev=!qql%qYqEMnbTEFwpj+laD4om^OIhU6FYk z-wvneq-I}PbR{MQcaQPuIULR?x+!U5SM{vJaS6G;(JjZvjs8Y_uut%e=ESC^g5mRr z4ZkgW-iWM+67f;a>PJEcN-hkSjPkM^P9Jq3{lfj*68?PB7ff+S`MgM8(UcRrU)t4K zt_ig43+1i~ZQthX&AaXV=Clo)&)u30jjrCdy3#L99r+Fn2rQLXA-k74_ez5YrU|P%CRj)(_AXkOBQI4d{%R9e4vlSIJ-qYOw z7QUj{uWe7z+f04$Z&S*P%0KA-!$}`5Y1K7#(XOWDu~1ujj@aL}E}g}!YY4$I#3=je z_5|@c*4%K(#lij?Q`e>Ejz}1MRndwI!WpHFk#*@gfk<=zHP0sm(?XE}4XL{_%8Y$1 zn{hXOXAud7=lO$a;gSnyq>mn+64(8C->$Cewyx=3YBlMjH?Qr!+_yI)lEr(Q%eId8 zcBBp(R+CjxH0#4)8X_WkeXcM3%j&lDF^?llV?Cvo+e4{qeKUqtbdO|%38!D!I3+x+ z-~D-K;mVpi`@`VX(X~*DZvP-WZ1(+WiR;oYZd%{5A#ZP6MyY4ziX<=GJEOg{t>n@J zIJVLv8^^8uNBx33d!B%d@qAK{);5!4Vt_MBQH%j9l3smvEJ@aaANW*x*%jxMly^ z|G*(&4dqHU*Pa^xMBjQYV(=R!2e&siXR$rtX?oIQ`_x1Nj*P z>QjA@>(J`+tI=k7l5@l9`G=;2)6wCa8%eBr;y9Gh_cZkH z?(1vs*Oop3`%#i7`{1seccC97^!F8IoPF^sc?DJCJ zza;3Vbg3XVK2c`^E;wDS&8MsxQ`)k>8xLI;w8@dmkmJ*qF-RpD3O6ZCP`E+iY7e%K zZhR~fm%75&E|GS%Ha`@HhVAXPYs>U4T6dh!LHrpdsp0h0nvx++$MZ`|&KcDgYs~CV zODK$UD>yW!)lZ76Nly)zq$K!JSS~KJeEW)U7QSwpQj~ZS2}D0!-Bwv~9ex%$sC#mp zmmYczEXZ+pLu@#QNuF3DPbV7R)7~7m>d)gd<8XTN z#Pk7Er{q4|@o3iWiMnJ+TS@YRm+c=^ABfwV6}^_HHD@*S3#Sj5n2r;;W9{m2N%E!w z=KS)@M)Yf_(P8^IZhiyU3+7Fz*m}{9Pwjup}Kjzyhe3ryzug&LCEurmQ6FBeQ8ZObtqS+8$yiGDE-lJmc9H>Yw*xRh!nP z1Fel+t&xW1x~dHZ(9!aYEbQ{L%Eq4&u1scWdmFAFj*~taHPrRQbS_`hQxSs_9`>)x z!Y)K@!VSZ_SeT?IZsYAUUO1FGtWWngzgO;-rnU3Dbw;8lir%a0YS|hq+*YZT@ggdt zdy`)>cNQ{-&mG$=M3)F+72i;}8L9&|S0TS$PgKWbwmafqhjL_{g)0J%bhvWhy2{Z= zx+ll1#=@^NwRKsegM*ryJJwZR+`N3T;4G`{Anan8~!o~5>4mb`W|D9y9f zcUB=sQ@w2s$M?X;Iz!)%E6nqEwHygv5mSz$+pk}jbwxO9{Mv?aNm}7hjC2!srKfpI zKCwxUM}KIDT0w4;9LsqtO;+s8M*TJ&IH_up{ymt6GZ)%EN@+p>xxPuFcqF8b2db=yL1 zl|}RR#ufgDFDGfu$k4ngarpZCA7-C9FD)+N8s9ur`saP!FZJRyXgK(Gd zKyzGoF3{&N;j6yk$K&ds^{uO%wXSkD>nGQqpSZ4;^BAnTC$9b}UqwD`l7vpf^sKlgRD7WZoNxVBF74l~+&{m*0?_gP~aOLd6U3iDoT8?NvMf~}nxh5i-IZ8ieYiGD}A~MxhIVoIOu#GKs&APbm4L&^X*oc*_7^$a}ushUiik+Jx z%;(*{11)vEbq+0n&Gh8p)#1u3w?*123wKpchSda|4sHdi`hl#+%JyQMK)qw4t^(|5 zuozZrsN;#cx}UM1_gWXaz1xQ$XbH!}n97!w?DJB*AY6G(OQf!?@{7AFry6T9TvJ&Id=Q4mxjCQaF8ZaDGDuqHm0A z7>Hc5I?mpcrl3eJ=?|1*BdpO&`y7aUSSo7-n57(T_`m9Gf?i4!<>#_~G z?@sqvWX7{E*N=c4tGNBTv-dT4WFb1Ny-#p~tL*mcwm#=YIP_Ta-I0+rgx>{GFA@sVqN7uVc2)O*Dq$j+1k_WsW^Ov%JHZz;( zxTdP28%KWsCBeS+XLD!j6ko9aIy@OnPhFliSw|)4JrM`1p8009d>@x&+}zRLng(P;d1J}oXM$%2&+y8lW624=53v59jx=NU znRw^*>@(|fO`1Go=2eAPO`0%svRSi>OL?8L$9HL~5335^5qDD`t|~b2OmD@m<})@w zBa3t$nz9okW4ZrA$8%>eE|^d>G6^@iW;v~d3vf)^I_1)_PS^C>h&8=}XXgGEr-|(P zV$zY@n{VN&Ubqczx}l?KOr2MTFD6BGj_e7hHQb4(UF%xv);<5{4TCOp@V50Fv%_;ZADsf+F zMFk(}d8?OZ;~fs@No`qGXgNLt z8mdJ`kRIMdRg{M&U2}>Nq`(+uOKNJMv+%Z%yfrGl%|*rAv!yQP1Q(M_y#6o6&>~MV zFW{D=xQnnnES6FASvl5_^_Fbqnyge>dh>id$}IO?i^9}IpLdp(EJkhN)e;JZ+`3q| zg}C@cX-V15r&d?=5G<`Nslh9*`HNi%=Pj#UR#Rb1$M4J9T{pOwS22~#dd1r-Z(no) zf8R&yI+gN@@~i)iIE$CET4wT%T2BhGjRuE94w*aNsFY=kOUlYBs%uM17gn&nRb6nDV6T^gD^so?qvBmQkee7{F4r6pL3cUjG?6*C&T|1J_O$v z%J~S>5Y{2gWn}mp7{b6RhWG*1PKGeBpCJrz?tw3a-wiR5e9T{GSciG(3}JwC)@WcP z?*(9BmJ1Vo%`T*@w>t^PA5-z20Dq6<96C9OKXZZ^r`K)nX4Zq%E!Ueoz6a=FVa3k)#q2edJ7l(b%4^``gqbeg>C(Cwa_TWu`@E;P2144YL&#%5ZUEEK z4q4N>5Bz1wsKdTb>n8!MaX$lQbjBS3o`{h8*Ml`(&Q((Vo4|C`C-Xj#@i|Xc?Ql*~ z5Hi|vbCM8JpX(y<*ii3vqyHxOB9W)`>1ih;!7MZFaGua5!gqtUZEped*i+{qn8$|v zPcZ%*|BC>}JgC$27q5g}ei&+b*}k&jX@|c<*0N6ktIkBQwwY;Qp6AqG0k3WE4lv#6 z(q*3G;5B4i_6c;S)914&>NC``GmqNdSg)F&0p}-%nyIt ztjBRAn2tJREhCSc)=4f{(`C8nPM2;vE zus$`PJa_46lbjAun_qz+C43h`CPAG>c#V6vk*@Wjz5vEh z%gJ9wNJsl*J%2w0s}9GITIXkh@#pkY04y8r=YeU1oNsg{fJZ0tIvl+Oigo>zmlK4bg;Nus|WI-1r2F#cRx&j2tL$l3f0g>cLRSOW!RWafeL-x@iY zGWutY9GlK*e-gqLbr{ky&+1es9Rlhwr2AjhVSh+F4Czj1N3UB9wVqkN+3*?g|LtriYyGH*wI9v2X=6oUR z`RnGsLx*{|9P)h8zs=~Ab!-_1Yr3n!V@1E+=#y2y)5yuZt~393tV>q;#k^R+F+b$! zwFVp=Q-L)PbHI8J`&F>k73ZVt`14yv-UQZb+yh3w6|8yQ38rHn$a-$>Gjg)#hx5_t zs83e=oLr>&VaKRt%ws1BM}4xUJHg1wdL6mR$jLnCS%-~a?jo-#tVie{l39LFnupY;Az*;A1V7&&70@JZh$RUKZ z^F<>kXNvq5BPVMcXaeiG(+$=<>;-E+p8;!~yad*`C%{_9RAfZsrh)ZXjAaJl7?64B zna|6?TJ|r1wT$_qLtB%OnV5()nPbR?8CRz2b2CM!wBcB1*`k!g!H-hPChpcvr zjhxI)raRxr$*R8utm#&R**#Lf*63r?IUTF8|6!gO(lHO}{-<>=hhe70Q0siE$e8Xl z`0L=A=kLMOQBEEPPk9$SZBV`kUhVMSijH!!9`_f(s(%Qqb@dup$Jocfbc{>ZxbK1) zHv|4(@O0Esr}e`&PdyE(&vT3Jbo!KQ+)vBYqvP>ack1^VvUHaVk0)<;%H~#teqV9VPEfpi zy3!+xccUr0%_pfnF5ZoT?e?Ue4N$yqa?Ez2dpATO?=j-sh^|K^-mRQrx3%^>S-d+# z?EY(dHbC)ig~=XKyl;l@H?qk-AP(Es#k;50J(Bq76I)LfA3Zv{ePfR@DBe9;?GeSh zneBFaZqJ6(FOJzRjoB`X*)EUSu87&TX9M$tL8)>7{`Wt4Rp@c?(Ki~NEZ$vJ?SA$? zJ?`KCp2@jAkwK?^Z-jRUJucpjChT^4&ju*oJ$>jA#k*e9ZqMu4aQc-o+dPYVT)c0A z>kn1J{!;rv%D8=oIRxCsPYR=s+aqP0$5vXqJC-2{^c>-cgJks7qi_J zv;Ahwwx1ofIHu=*7i_lkWA<0b_8rg}i2fri+w6G;qQAITwx_u5FSzwZX>P3Bp5XhF z>}NR#;!VjJrin8Bl$h-yG2269w!L?~Ou?(Kf|&iYW46m;ws|k8j_Kbe+vEYh3b&po z_lMvIqCeUr`_tX_RNtR^ZBO%^f#XUy(D`fJ`k35a?Y5`8`#x^dF^#K4U$={5w(DZH zzZ9!I6 zm~E~-rjGmHjoIdU@9MaJT+H^InC;tRw!bCY>}dv~zt{UTZ@b8Mu-E?CzJJIz&+~!k z-+8a4j_D7G+0KaB9v8EHwQO@dG!WN^1+wjI`ARXf(6jDsm-)8#+Ahb-Bz!q?ZW*TK zmw8xSvt-`;x}4KmR9gPEpB`MVtneQx^~Ipx$~=U9qY;X zm6*9vjo!BKtB+`EV!mu~kHq_h(Ok@t$1j$ao+8KmeEzVAzq*-QRx-D&G}BF}M-tVU zxta5q)|6!CM!yN8g~HVOnxz$U@%bElBBr*YW^u_ve(1-3Y6c~ApUuI~fTGbwhWY!L zmhVH37{n|vSNm~aC;G?_5uN_CMW_2Zk>ugj&+eca=Pu>fgsLhQR#(*Y&KJL!G*?y- zz>%w+dun{AQifkX&E;YOr-{x4+=>FxeM{z-yGqhuSNR z3Js?Ewy1$cgJX&u@b2X6ecQ-=3Y;q@``yS z%NCwS!HaxqL@~-=tj!f8AE{){t5bD)eOD=(uil@qy1Dl!t$OYJ^qq(pE1kMXT?96xg6_-v<92dzsWw)N*iy_l`TbAAqz;W#8yP9)1UpZok*@xSQE z?XS}jIrpi)vvV~i-g6d}bK5VsW===g*%9XRTGip$Lz&NTl=-Y$na^mILxwXAXB*~| z64lQ&%=-eB^O?Q!c*FUI3k**&Jk9WQ!!r%@*^1hqL;fQE!4<!3kEo+&&CBe1YYwKGMs5Rn=ElzHG011lI7lKESW#BfXjnd z`FOHCqRA&qJro!@MgA}0AKWx}e~ClyyLqJ^&!oJ}z=H-i2VUjHQ?)#8o$_Kw*0r_9~?z$bEV-r@>lT>ZZ*8> zxb`6S8!2ZbxF&ejSx@EzD!68Nm2W1CehXRZXN%#jWIlX{+YaylxGh7TG(M4p0waIe5?`+0*b`8iCMV|s)v z$NDH);=XP8xY0jBUWI>je*B4@K4fXbZr4z!;r{tQinBePJ_!86iR6eU50dLWP9`^a zoI+mfaT-~4hLG>_DMxt@LOwwzUy5*qVaB1HT~H<& z*9CSpyljv&5VGqhk4MPgBalZR3>m&$n9u*dAk4Uv4PP%@jF4{-Xy;6XD2Dr%3(I}4 z@K%JM5xyVc*@jss{Pqj&f7Zx{8+PTo7y>wQV2VRme#WKEE8xj95f&JpMn+s7L$b!@ z(1iLt=Un}OtH7);waM;}yb>W#b(Pl{W>cX3M1YwhL@Tz~0;TB<3mybo__Z!(P zc|6EWtJ-h^c{KjPkpovbbiX^GK94i&jyx9Oa5D5+UUERjU6)Y~oqU88QHOaZt4()I zp;HT)JEq`q;Cy&~Pw5(jP6u2AW*I1FdmKn+gM}k&Jq!XyR}Ug*o2DJ+ zpB%Uv|KM0`+9^WFe2@ze&K9QqxrWQhu){KvH9t6#O&I9oyawv$ zf}a(}rY{)p#pS#N&Sjtu`-JHtr_CFMA4Et!>ab01Fgo`Mzlo4~)X9g=D@KR=C@+A# zKkSlOhr@)YfcY&H%6UFb6P^w(6`l#M7iQf56lUD}g&CLMEukI8)~@`=ocd-tNtX)5xSR}qhV-hx(CD~xU*g^+`c(+Y z0X9asZ^NtoR>KdIVW0NMYJa!U*=P7gGW4qvk^|S`AKdHkYX9$sd0nG^Eo5Z1AEaFJ zJjn0`qQ3(AWVJuW=imac{tlD*se?XQ^|{8m>hCrDqUf)N zK3Vl&H#&be9FX%O0)29TjR)>5%B8&NhA$QUM(B_OJos>vMBXGEnBl~}t0XSl(hSjA zk6mQ#ORGfQ3^`fzTur&;;cLSD4f_URAI_~7VV>*!b|LF(GwhJn&Mwhmztmxvzjdd5 z+IfMDxGmTuYuwk2{!zp6h{L$-Kl%&1->{QmXAA74g4NFXqQgAo7`{^Uw?dyBxE=ua zMbY6LEY4YFTAVL6j|}_Up+i>t3q^2YA7O8%jCqZ6v}mqO%8bvf96#a_G?hm4;^ubDr5;VfLvv zlabb5*deQ(TSSL;ZWUgM@HQjgKt|mCh)WL40>FJwbT~)tN22o-6A`kzVccYdZ2DyOrF`r{`;?Q_PC4b!p`9AT z7+U#KQoV798y5+?F^TXf>RgI{aA(4&q^7VMVKQ@8yJc?9o8kX?n~id6OOF*hk$8kB*Ks| z?YMe|ob}<31qO`F%UJ4wuSDNpDZB(>tMD;|yU0|Adjy{Pl>c0KGUEQ;$lnnD3&Ot% zGkOm67mQGh!Op86RGT|GmG^+XPE@B-)Vm7sGY*o`;93&G{^ zjLSOaHhB-idST|jL706@qmh4CcniYs3$I6bKN)!l3TqyAhz@Pi7SlS6km-?GKTjBT z;}FQ7f$YDH+>J>fe+{y?L{6LkG&;wHIk)e9BTth0CKLjojIgjaAg;}?qM*b(!=bW=M;Te~FfiSPhZp;t)9`JvQJPy}^w~Wq7Va~6* ziq{C_hiP3$MqJL*subpR;a1^f@NW(Ofh=(cVjtsXBFqxL6yYdgUQgV$13HZ;$F(AV z2w}N!8^Se)-54JFPe68`$T=U2zujS4oNM(M8F`@FW8{pZa@YSupK0Yl&*c;0XkpI% za{VoIcu)TY%3+gjhOGC4U!)v5?1QHZbKYc`a3jKb!s`&u7iN37oeZ07Z{z?wFgSM( z!X|a@fv0^o(T&0{AZ#HcF54kFFbDtOw!>4OIzJYE7Gb;LZZhIR%}3V0@qp;C-99J$ zLxi+No3A4LgYbt4|7`djGHiwrlGWx3$`Q9O>cj`Hc2b2ouQWtP+)SvDHLg1!5tllg zw@aOD=#aIpIG>9)nP+!yf?5AlMW4r(tj`wQH``$+7jkld7jU>a)JNO}2&>7^84Ec% zz>5Oht)jCU;Ra!zFW(b>5aIp8oag#eGVCyKWKC+l27VLlm$Wjq4e5Hjo+K%cDkhlvj7%Z?T1eA&x| zrz8A=Fz4D{Nrs&%utN@f2>|y+qjSA5=hx0L@=`M5PJ=!9BvK9nS0hl`zZ5 zZOYTox4HWrFy|bjJS{b7bE;U8Tn)p z$l4D1yG-h^Pc9N>pFCIetDsNTJXDAd=L9bnorTaL>+y2;JFv<5!7Hf)Za`Qsd^bX_ zLBae~BQ9Cn^Sz?OdBZ;vom%LS^_aT*9mHJ$Ia!aX`%XLLDXfcK8&?X@eYCjDK(=;3*FZ ztK3~5Ay0;!9N=IWj>VvUim=KHM4pC_ta5kVgg&c+tnwScEK51UFB$#{8TuiF$U?&kHl%8x8X}&(!%H!XFCLPNy*Q@VqdO z5r6Yc{lDPGjq^--j8HsZKQiQ;yUBNDWbPj++<|ba;Sw_9@_bn=@>+zPLrOW_FGS9? zjv9Fa@}W9sk&zbjcCj$)aJ=D(!qj2eG|#h)e2FmIYQ)I*8Tp?K9}_M`$oZJG$@A;D z(ec9;)!W?49ok~-{*rWiTf2jx)lU2Ehs zMGmoVmXUKFrP{ekM|8x$rC_^PVm|93eze`K7`o2+@T( zIs4r!$*><14%7hP+_NAU;P}V&rC`<-x2d0rkQ`Wme{jp-nTOjEx_%POd9jU@Lq8iK zIj|J};MT!Y|2~B7-UK>1!hxFsaJ%5C!+Z3flA)6;toiH|oo~KAa?~6X)SGfBK*qjD6 zveqr{8JHHYQRDy*8l1b2fF0gP92T9Kkdw6@-2DP{{t2187l0kM1#(~otss=^MKZ!n zGIZuZPF6c3MduQP7YQ#zSV)F`G4#oS+W>G}Q%&pY%c4^bIazhejLs5a+N?2h_Z$QE zs}Ps0`T3^kv>;qZhR#ChkhR|K6&{>Ms&G+v+Oe=-3`QwBIQ5bqK#DTnqX4$w;dXX^{h81;E`eI<)!U zqO%%uvgYSm(K&>WV|3byK!>b4$3*8iLOx5P4*MH&fCYr(*q!wgLg?OE2y?tn{U+#; z)h6$YsLyv4lY}`ptWcQOv}?$SyB=}L0S*-5-1`f}T@BfnMW62?77KF>vs9R6=er7~ z#ku>9!o1FWNBFx4n}s<)%DuCIekWutBImp4dxg3F2e)aH>ybPt%y$~wg}GLTd*1;a zj-hsmoNInC4&!n>^)q3vfzd6zAK|Zrxu(d|!p|XmMwn}9aGQ2sLimF4Sd{m#WYk+T z>WZv&{%kPEXMEII8Tvs`Ip#BE1hvc^4Mbn*~>PMBlk0%5MvGJ}k`yAhYH zac7GT*L_(mIvvm<2kHQDw~7wWqt&9b2XeC7St~kR8;0pI{~UM!K$vC!85w!li@4;# zowV-r{YK>bg#%$Hc4K$iVcb86&QsV$)^z_$IdqOA z*0|ZCGYa8E(K!emvg%9`9j*=YWnqrx=aFIa5cJ9V9B-k~xmB2J#@sH*D-TnD-!W z3G=>&+tg>B|3jGfKK~NtS~cI=UsnrXhwvI# z>dY0cML3U)vL9wWgLRznHIW~IoUG%tddiU&*Q#j}-i>er8Fr3BpRC90dq(G8!`lo$ zB+RvKeoTg)w_%5@b{;i4ouYFbI%LiBb0R+hIXSQj0QY;!k!P-p^SbExF!m#B+`owq ze>ZtjnCsv0*#YD7{%(jc*R#nI<~>CY8F}XO53)X2;cJYPeCEJ=CmVnr<&+6M+)F<3 zR5_!iO!DMcl1Jd#Hp1B=$EC%s5}`VqM2F|j&xM~vc)-Y?6Q-TN89qb!7{ap+rwQZH zqIZvmJdm>~N8V6nj`4wV=PsojI?MyA#_0rw1N8v7YvCC;Svb%@DV}x1Q=TFmSWBrq z%Yx1Cfmgv(hxsC_&2Nf)2tsmzKMI3e56}FtU%glOS%kbMQT`f2cfSUkAz_W{?!}-( zeU?Y{e=j@@A^Q%>S)XT;N5UiIvGHGke{d|nGWRJnugaN*a}19)Jl=4DVdg{a%rrd5 zaJk`yhHDM4G`!kyqv7?2HyZ}}{1@}T*Czab z`6O?A@0W9vP1!H!V-p!|L!Fi}NV$~Jl}pO#j-!;(l|{b>JKJ!%Vcuh^&Pp;nTDXYe^@dvvZ#Ud-c#q+y$me=C4;kk31(ow&QknOV z%0a`tXHxNPd7ZraFt=c<5Bx{h8qnx8{T4g2YHBB&$|utzE0)5 z4^-xTobnOF#|`&M?9oX!Jj8IeVLmfbo4j9Bo@RKq;c~;(hF2Qq`zE!s-f)ZI?S|V8 z?=k$8;X{TG8-Cj`CxmFaLBnZ=d5@$zxrX_CQ0090q|EzRW!|4FFEqTu@M^R8J-(xT-)2Q*>`_??X|!C=j^l3|CL^YpEvll!LJ#7-r#JU2kAD-GkBE2r3OznIBsyI z!HW#8Gq}m%^#&&l-fnQG!H*bxz~HA1e#YRJ3_fe{8wT@2E_9{8obYg`+S=+ zgUb!BAddMqRR&iZ+(=yH+pINsqrqE=i+!8j2JbQW34;$CeB9uZ2A?6m%I7?1@LLAw z;AVl^@LNX3F@wh$Jk{Wt2G2EkvBC8Qw;0@N@D_u27~E~}qXs`^aIeA78+_W}*9<;y za5gUTwZC}=k21K_;K>HZ4X!kJk->EaHyOO%;Do{34em7f5rYpH{ItQ(82pmKXAOSC zV18hreUBPE(%=$<%M30zxWeEngR2d0GmXBs@$;Kc^l8{A@WtHE0g-eGXJ!H*jJl)=3QKX349gI_cF zyusPHR@OO?XYeS4OAVfEaNOWZgBKZGXK<6j>kUpAyxrhVgC8;YfWc22{0#9J|5*Q$ z!DkJAgZOISh7Sf5M-3iHe2s5YVsM$k<;2(eHWda}8C-2}qrqzp-e~YvgLfOe$KWRn zK5X!DgHIZK#^7@Xzh!U^?ptVI`0Ze5tlzJg!Q%{`YVb_ralZXr;_*ISOgzEI^~CS@ zaSL&okG%=apIQkosEAwW4Ha>{qBYAJYbG?pUEG?Q#tF_pUeX=wguZ#|e$Mx%Nymd3 zjOaPfH(0tVkl)9jo%80I&e6xlI{qBM)UOua?Ut>=KXx|03kN7?e0~mKnZW~SdWocu zL20(}mD#@!+H{J3Mqr?^%;dpyP{i>Z4(zKb%Jh0uJ8H@zu$Qi8A13sfdE7s_YD}Ck(Kb7y9Sr(mF?;Y}$c*^~D^0FK z;(A!>A4HjcR|q#geS4R332e4NAG3^WgFhsH%BqlIsQwh13l4`r)PpctlI9rrLZcvC zukV`D&)BY7fj!6_YBC#`)g-e)ze~wL=4tE5K*oI+kpW7eQ~m4?uE80$ZsrMf!NEy) z7ppa$?`c|&aV(DsjKr3-MJD{C&Jv*S4das_aboI)W%T{56@Q~hI zGr^oMV2Q*4W)lgaqSt*WHp(Up@c@Jk$bDSTgbd+M7h zmS-Nz@zJ{Fi;EtS6XoOMd&`$Fe0WrtZ;oC~W(l0Uw_mH$soc8A-mc1KakMA%Ro=q$pn}G?s7CTz{;{hg;)GzGr|fAD{PU z>hF&NeA~fS0v-8q%Qea8-Zem4w=drr&^AGx#9`6Lse~K=AL}LGMF=dzG`~;7Uy`p1 z33)^WZHkZIN!b2A4ZbSmlMlCol6-Xmz9yu%AYVn>x+K6ia-QejXCNPLF(mmO3h=#! zG#69GQHzn~l>Rm^uHh~rd39tB?%G5K)mljQSI9;V6h z%jt*jj{&}?4BzF3kKgcFzGy#u<3%4wSxT?r<0D+Qo$Xy1;Nv?Q}^VJrBN( zFk*jotsvjJ0AD%MoRccb$8R-=o!k9_XE48%I0XJWBX4ycp(p#a~g zg{keq#|z5m-rF#Ie77PK-%kR3rG~G_@LhuPc6(Iz!^ihOSWg^*GTHE5g|xPh-*Z^L zxk#6|68?|2^@adn9DE!*2Hv7jK7Q|E`C5>+!aPc~*lBiucFSSF{c9k*CgIcVM!sTK zlmDar_$2hiamjncj0nDj(l*v3v)>R{;x-%Q(aLXn^l|r0X4% z|D$~04Dfj$_1}XdA8$Ws`}iG;9p`dnJd%O$Sb%RW`1tM@`N|C6*#O^J@X2Qaj#b#Q@}E9TdI~ z@)IgV2pKBHPUpcBIGFOA4;6*C01(F|W8_^}vtY}5_1uB=x_5mLYrXrRoG4`&X}vo^ zMy&OohTW%)oz}ZOQ19s)&pQk|*30=tJJ!qZZ!BLm4w6%#S5ZE`H$)tljLzEBahm5! z%p)JSC;74vC>`L#W8ZCI~Lo? z_Tw!0xLs9fM;QY<%U7|~=OW*91m&9-;Nx>W{(mtQ<>UKHmhTDh@m)Xi-Hf1o`oE2J z`!2)DgL06Q)C}&uB*Z!{eE#)gW2lhd#Sq64C})@9J?b34-q}bqkK>XJBJwKV%mUAg zA+4f(?*#bHuS{)UZWradCcwx0)I~}rc1#w-&bDvVs?>SO9I<2jJ{sWTJ?%_<{HDh8 zO*VX$hHq1VkN3axk*}it-4NibG<fbTH)HY%CeG1(R1s{~sfA14M-H(RjB*?B; zY&%0&px!v_{u6o?9ha{L>McjTd|#O3{BZ=W_vrv%dCd1=66E{)0N-nE{(eZlyA9vJ z37__3KKNe2F;7MN@wV7uNpUi{#6J$Io%Vz8rV+;_<2>p;2h4h_5wstpu||+v`CbBF z9?~kxcXPn*wSMeA8L)e+AG^N^*hR-=uJ@qWl}Up}!A>z%IxgRb9lD&9O4vt>oc)~tO$W!X9)WpLgjWK5qptS6))B}MQNB|FzT+Ex zJMuLkD4*RHq}a`aDb@olzwUTQJ8mB?5oUULyJz8BRx8z|g$Le9OkeYZiq4&f_a>SiifyYI(xz=aksJN@eIdU=3y)oT zVBWrArPIH=L0Y)si08eX`>W8Y?0s3uM!)zUwk_v>?fSNNPurM6_U)r*BS6E}R&3&Z z8xI8W=VN|Zw5#wn+pekqj<0f8Xg6^97n~vs@ z>%hD{(@)7Tcg*=^V&47JvW9-;ozBGJ_IZivJwvMYCVZMC$(w(ijS~rQjMy<`_QicT za)0h~Y)*2FDagc;qb2>WbZq{aUv9l$u5@1PYlp|@jy}h^G~L^m)zi5($`6+@gQ$e= zscl_76~3mc_$mc?3f}93J;hrZ4&?iIf9F;m_R;6YZmQVyhl@hPFZQOq>_u~;@7;?HkG-{#?BMbG0>jt(#*D58M>n@uh_yyD8QsV}2+*T6pVke7@Sw)`wrNec>k~ zj@@)3`%u_dCVsQ_<@Wqf6>q-pxz4hlBjrv1E!K5ps-L&znATr|PvQT~OT4_}H?0pH zexNYC=_LHg%`d+Q1r7~M+TWf#qA--K8f6;lhQ5T|1Xc9(jNE)*V*a6Ft@j^ppOGxF zyRhxse|!I~>|1M(hP>Jrf4XJF(C>MP+AZhzWudixD{5bOanms`I`_d$11~3j)6-MB`N077<%@)>`=Jt$mI5k?bF-m`K{bic(l-~cs6k)x^nZ(o+EjO zvSFZELkqlU{efrOCnlzUci!f&?0h!5^MR4WZhdxk9h&Do=y^Sz!+qO@oBv1oXyw=9 zv$MTarJ|fu`{KXOzSCQa8aLm!={9NCIQDOHd#L@A_M-L&+y6$4$8N&;e*LqF$I!Ut zw;ee&)U@sBMQGcOOWH$;XM2v6wig{5x+_7BXQgaI+p*d$BhiHD?L9}v*`jR1(d)eP z;NASrA4X&iz24h@q-0;{^_olkvX2}*`QYx~yzS8@^6In+;|IRI!4z0nYFGN|)`bEXN674T1^4Ih< zZeH-*k&!2c9U5XMTH)+G@0HFi&vhnxIyb)h%8Sn(>)C%~~t!wdo|gbkZHY7?pl>vzTvO|3(R!Y8t$7eCkO`8-^r##3h9F*A1atoc>9&c5~L z=~c60^JmRlFze1Lm*=_P8MAJ=^^O5-$a2T5j}BnvGhNVb$_6i*8y)%8+_D{?i|_ed z=g!!tvljkCPOSY)3+r>{d@hn`%kg&SaMjW=9iKZJ4?1wb@H=+I^B%(`<&jYz3q{}a zN~c%$&zLBAW)1m|@wxZxdarLLHm9%;OY!l!$6x84x4$SGhesW$Wad5jpPwCqZJV^Uc#@rAybWZf9|6Xn)6WIK zrL5E6OC^N%#JcT1WAwz_Mr_YljGma!xv2k+(G&ALl=^=F)@}Naz&hWa1uhYr-vLwD z24e0PEK5I~6zYk!Z6l1HxCr^h2p<3@744@27m9v9Fok+zTy{JAwMI{@^=>tKVqR7k zBOC|TzC3Geh{;Wxe=&Mu-lL&Df{tt3_}q)v+SHHcfIwKDn8zsUuQ&FSfw=@x{~_Qk z#I%nCvpr1D0;W(;tn-}D$`pUx*br;kYNIFSIFoY)FmC<1dRGH$`}rKJRP=o2L}9(e z6A-hVM}f7Sy};Z*sechz+w%Bj@wk=IS8z)4ME3bJ22k| zp#EzJYTpga^A762i9pFz?}ggtm-0CkXM4X%yPpwuwQDZ-(Y#awDC~NZQiYSNt*;Ba zz1`+>OQt03yd~Q-SF4nSv8P5Q$!(D3_FS8flMW+cx2mNSVYe#UbWth+6m}z;QiY+h z5_Wq+N)vXYZquAmDG9q7Y|}g%q$KRTkJ@xeDghLBt8Ypb_O40Zr{u9NALBVYmF>31 zM*``(K>9O*^tM3y+kx~C0_n4XbT%iU2xmh~(wwvT*i)wj^63|pG6NwW+xyNy{?b6Y zDUjwlhYIWayFi-94i)DAGLZg#AWfhBDzwkXxT-LHO(1C*lb0;zP2IqMnr~jSB*R;k>8}XF#=VW#ys8Or61FT)r>I-C1n(v`rz@LR+`|{3 z({u1rG~Z(6P04g?+(cZ`ykgz5CH2c1o0hFfW=a9vn`~URDyemSVS|>)ZBEpbiPf3# zzU30$w#-nR)w+9^>3J9?^cOE2;%)8bWr%8*)wMJ>FVQhv;@(qLE!votPD|7@ubSwx zU8n1o@YU-jjVqd4mNeJbG&ZijFG=n!o0t8?y~|cDU6#(cZrPgE9Gsd}b?F&RjWsRH zSFc&QL@bhIOUaEby=>*urcWict_p5|mYRF|DzRacO4rjqn+iSkrwWF>>E2qtYR(!~ zHYLj?YpBJwT2i}uMV;I3jur1?XV@I9tDmjGtP5{v*U;uA{cLIG@>P7@Udg`66wR2C zuH=MB?j-$WCDl#KR?6&=X+y=DWi@q6YVTdX+)i%j()?;ux_Uig`p+TuRIf1PHG|RbNKT3lIpO=jb=> zJP!)R@B`twbqLE3C61tFXBu2VT#O$`C4$<_CBBMU|Gi4pFG4!R20|7isGjK%PtHU_ zY&gV?)wMo$V>Q;tZmh2Ju^TIP4&ugYypNr|oE|v)F}~i}^JEy}?BDNWH?|xYh#T8$ zd>lg*61^K+(X)x6iM|c14~d?pYVXE&l5gY2_Ie+?u@%lZ?WL?6ThUigFSwGJWRSTC zs;@HGjjhJYSSJ@FK3{byC`m#qou5E~0=K~SG%Yl){(>-%O_zih2Y zYx_46vvZIHg6g*z%)F4?w{cib(Xy!*oMW)tcB0Rto(~!!1qh)JJLrzRp}3FTwi6tK zO6^OCr{hON+rVore&^TO+YR_|5+R*-PgYlY+voA$V9FaBTFOAJcgZZqN{Ny24{{L!h_8I&`V%V1< zCXUEj^iRg-l)=9xhW%v3#1Yfk$Vf%kBIF9-CIx+04 zU{9=d(MO)PpXcwyVc2_|lQKS+6Qk@RsEH$-Y>?4n!@fA*`mk9HJ+bnai4FU5gWwM$ z=Di~2=aNyti+2cd*8|C!v<~89fu=qJcLUm_1s5^BjfP{X+hxk^lZa@#OMU?acmU) zD$e`&7#p|0h|LRP^D^R}3g-P9w_k`&KDP_-GQ@mGmzXw{2CpQRHmngn+u;8HBJ6oj zaEIuJVeB6__(y`P!O44s<=IU= zY#u}0MGTt~!4cs(D*95y#1T1nI!-;xzKr-;!My+elF|QM@b3}7N(_GPZp6yZ?>4As z*NC-kZv6-U2vRhHL-F#ikrt#9G%< z>S4q6-mU*=PaHPH+Rm-Cfqo|R#9Fq4dX(k8`)`U3w;{3GJSH~ZL5w#9oIUqNzROO| zO4t)e*g?oCvEhFGs@Tkho>)20i4E`XzautPupw5PA+ithUjH~^)Wvn4SZ(;N58KZ* z`xdcT3>#v#xm|2{ufJYws$oMMk#p2lV#E9X%?7s-qh8KmV&zPT4W9>e2;Pl&r(o{i z-NYzckFvxOo)kg$iVdF!@V*e+&u0cd5X|Qa?tdjh&voFRMbCTO?ti5~e+IgjMbCTO zuL_RB{kgp=JEKkD_x&O0{ zC~e%B4zVK;j!TFqUl6K7I7gze-66~wN(>>y4nj&1La3Kgh7cOzp!-oyj<0e$9^qtL zmD80KPEHr)tRNQ7D&nE|fm9QS+<=f)gSQyW^G3DlHuzCu*^hW_qPW-K z=M6q>@M{M18br%xWBpQ`XYeS4OAY4vr`pF2t~8j>71XBA;3k9D8_eU5+HW_w)8I!8 zK49?E20vr)O9r1c_ziiz8eC#nzCCA-eGXJ!Ol;&ly!c(1@{^o=cilrr;YwKgU=i6{B(=G^V2QZ`RNwy{B#R; ze!2z6al=c;ncul7c7D3W#`)ccC8P0~w7zc%iP!vH*~=MRJO*p&8kWH8hN^&?e(nkyE1 zVM+JEl*#LgJggkh>5AA%TQYcfaR$i&&1@i}*-txC{m^k7Oso2qx?mfV=CHa@I|g0# z;A%^IH1%h5-V(#^ghRG_PlKi= zUDC;R{3-_(ig{X097mw6$B8z}lMjcFBwszSZQl;0c@C+fd`qFQdv}(-jaM< zfGyvnNb}rKMfvWB!ty->KAt;~Z& zC4%MSIbbPtD$4x|6t;aW;N!V3+ZT~M@$*myAx0A#o%wxDu>~#J`aZaZ1ztU9u&ikr% z{LZ7lJQw2l@iIsI>&};vR=!2ZkjocnQ+!_v@O8%gc}hNB9w{H60pKsm*NBW6NUP9} z!siCWaV8)KV*Y(+@?DOgd_NXG9hYw*Lk{t<^6O%KyeDMqJpem>UypX=qvXJjIL-v5 zx(L_7nDDF@yFjwu@&MmyY{X3aCEqEveAytP9r-ZiNxr*7eW=kthl zdu$n=dbf|Z+KK%m&V<2F??-M)jAH26jUghKe3CPrsuLt_Iw|BFRKB8j75ZtH#XJEd7itG&dv z>)-6$Q}%&_S(}!4(-Q0V-hVJ_=-uAOrw+Z?yRCiw;txEPHTz@Uo{{VS_|5AdJy`aE zC$ly!@TTpZTCx6*k3L@Z(34q5=Xr_xz1J_SczgYx58xA_JG_ryzvJPB|8{=;p6Ph6 z`#{$0InW#mM+-M#>g9Ojb7y?JW5ivTOxxTZiVi(mg8gdP)fKn=Vo`P^u}K>?d!o1K zn%)nb8geL0KeoI*w_|Vg1QdA>#(bu`b35kb_6}?Nc5CbL*x|!1n=qfe+kTiFiFKb?hB_SJhp6*Pn0QTz1dYMQb10yL{mTzdtcFWq~rUW|v1z z-5m|#hPs9~&;9)HV^|!gzxqn_qMpvM->yXH_S|cxUU8ID8$)n3+q*q?6SgUFh#1T6 zx0By4;XipJV`#`X9-sYx_PZE=p84~QO;FMIqIvnleM~Nc-0_l_$K_%Ko|~~8kE2{u zxxZ77E;*r|nENdCvk+!J+a#Jc?*SlVlD~f`CDL~?+`z1Y>1Wf+rU}K zXW7SqwX7avS@wV_i)5Nemecip_nT}f2`7(0zOL`P(QH*p`o1e|Yhzova;7Alc64Vx zd!Ldpwjj45g?-A$QAQpwIvv+yZc7!W7i$7B)6IeOmO%Pzfi%y7RaoA=3oDCr@~u7h z?wwOE!7HCjnrl`qp+m~mskcs-$~%?vR-b#-(J!#3=Dy&&eI~cho2z~yz66_kXV%!; zmor_f*dFJ_mf!d%8|Z}@aYDg;yj%1i#P;7W_yFQ_g0F;r zIRfpuPkfdbJlvPK?@~{>-{^S{S#7w#YF#|*jwj1b zN6c;$bNtv(VqMdS$;YuG=J_J$H!=D6$dI@k@r_2$HIMq+5LXyI&ylFV3-L#deyQLU zh?g7vO2On?BX}+1dj+!%+)m`=8og2QX2kak=9p|H#yE3M5l3XF{fe>KE12u-KEYgz zxh=`h{q9M@+-|+Z;N(~mN92Inl< z@`zCvw-K@Oj5IdIViSW6aYW{Msn~FRpDdVjiu0BHdtg7482sE|g7}hR2dlV%U_yhBzYo9g@jsE*5i}>GK+nkz%%0F}W0T zE-J1tm~&6{)dn{j%((Venytj~jf_;4=oFGx#lob1**2Utn;| z;Bf{|HJIB`%g!~J+e`KJ2Dcd8YVehqU#2qNpY1lD7vnZU zz_fQV8NUoF*#fRWOdOZ=I27Q#;xfSU%;Ws#I%)apk+#A-$~**OJqzm3j%#bqAnX+<(mvX+L4ck80DiqD3TIGMjXmKXjmWZh=bSd)i@#l5%elrFPCqo6u0IQW zm-h+&EN%F|Ov-geWx?o+y#=GMg1@S~4e*#6E==5-Giv6H=X2&vtbG>#F`|(h7wR2` z-ZhD~L!qYLFYS{H`Odpy9mj@ubq+z%(>dPUCk~$&QvE{g;A4LJ?%aj14qLHsRAt^{ zF)f075_^Xt`%tJb(NpS`eJ$qOc8nb|{|5zkHM}&e`V4Owygl^Qm!lU&%V%T4<4!}! zme0bShNPlnSEykbZZx=3EQ8w&T|INP1>=W|J~w5$*9M0-@BMVviR}BoTTp)O13SvM zWrxah?%z4NEjz3H*86W97d>^|aqA1DqhZL2+}m@lYSj7{Ud-CWoi+Nl)ps1sqG{RV zG2`o_qaoDOIr30Asp^>K%_$zcm;O@Fp2g8}Z)LQ!J&O)jpnqgiS5Jwr?dmC2 zAiY_9oBDHc95=EM%G|hL;x!Vt`EhYiiQ1#NSw5N6U))ownm&2SZSv`?Q5Ea=pU8!m zl82_|KYY*rA7&@>qB*T&Z}#hfQyG}ie+dk4nHs&dq3f9TO#78Ax2^MHG^BG~?15d^ z$Gc_YLv!D*lIU9)!mge&zoF6B;P9v??k5)SX`At(wi$OsbH?YmzQbFRZe!m`7RKT2 zVZINQUky#mTQHiZj8kg7uWX3!jz;!{KAqJ*(Wl+=rS<#UIzP*1mo`5Y?x+jFAxx<2 zNYu|BpWAV4$nCkavB9&WqYj0B^k7myCwtBur)L49Kj!A9Dmo5^=JXtU^Ob-4!|Bu2 znAESnd@39*@A{!^PuUjxvZ9syJ3Zxg{iDCH*60-}-Gb5YVIQJ7?V+~m*=^tUUhiye zJK6gB&wh6Q=WhD=hUiy+bmUOzuO4hKnlz8Q7xu=tb33MGwHW%-R|m{@cUwr8Dd}Mhio=36}eY zd^P*-;X7`8Xy^GILzb`j#mUQh$6%L~nlWx;hxJ~TQrwi=v1>@Q5z9dJH)NCJe&M>} zvDZ&qcgvR_gYP3-wju2HZz1crE32(&=DIbn6vferb#Fe`i5)B4)hlDTDdgdf=_YJp zj%M|yiqNL>GeRNW+l}Vj_F(i2J@A|rYOC=kP0xGy5`SbcC~xQfzVy}iYM=JQ8~%>VJJXvOinj=svpV&t~&rox@=;A|>P9N51n=eh36p6WhT!-8$y>*sE6&D+`9w!)k7lkA?7{5@;RjvrPp zZYcHYgtn6W-feJ&*H)L`)?KmrK3DlL8N}|5g^7oAVAn9NrzZ|}$zXlg_4L4@nQA)5 zj@{PXy7%)Ogx=vPJuLT@y7nhITgcgQY)o<{;`av~_RC@uH;QVQiAEg^7R2*(dv` z8`MP3sod9l--?brcm7K*zc(j(ajKq+6*ePJSzvw3+NyOYRi zIMCMJ>NHQbb)zwfoP&RN5IWSpgH<2=Zee0uN&eZKw&C8v?;UKouYTJ6&epPr56}Pc z3%@AL+O*1RJCfIRGCQ(!TSI;{x9e7~x3;Uh;tCvF_U_TG-7)9AS1g~6leM<)MZL9$ z!mSUsCbM>34uUn^734s?g@);K2;l1AklhS~u{Ix7DE- z_K-x*{<{43&?`ssUN6aeuH;f|^{(!jd%u+&qJ|+|C6}BSTD=#OwW}`Q*EcL&>Yl`?7vD6n)iw=oF40q0XldW7x6KJcy4VLvLr7{XBN;`+l2G<&M7yhtU6nUcSoE zdrE;Hxhn}mUQJN+L_8Stih~j?r}|NTc9Ku^yjr2e+%MKbi4ziQy=+%VbgV-$c@)!D zG21r~wq^U{v^MO6a$3E`Y`@yX47PgqO>JzOq4xBt(N}wEqYKb+n&{a4iD$>kxRejd%+JZHWKc;H|)vOm*?4 zZCbGy@?F(s2tA@sCiOvz-!HqnML$APgvy`nwwNYO7u zOrf5bd9>e-pd1|r?*OJ`s+apR%P^+=sW#jn$itXI9%3FL*f!o3)A9T`FeOu6MbMLn zG4olL`H+Dt%b7yRE4tNj6BoEtcsLq^Xh3R?EC!9Bo~Ol_MAJ_`Ih|N!N_XkPGc^WuZZ1~kK zg>?~Y-~R(xIr#>=>VIeSzXv8~F~WIZ?IYiEr)28m6zExovD$OprC57k!(X;SrSCK5 zYc$Kn;j}jbdCQA)Athn=_Ki(n=f0<=<|TwI@d>XMVXPb4I%!i| zR3=c^ed(G~h12dlGyjHErnBd`q$KSA8;?!%$z4jq?n^40mXEDO6?XrP#^z5?C4j=- z&4Ki+KpL0XM#An1VM-BpUgvC@b2ueo@AgyzDC~}jDOK2g*>BVHQwe8(XCS>Gkmfp( zlCb-#)28k0Vf`{S#iZ{$2zvbU4f?)gfSb2Q_)dY9zW(kmvDv8IJU~NE*u4RnG8x#P zoxOX=@}pCQ9Uq?xrzGswMVr1Vl>qANFYc~DzOKE#I-K@K1j~QI9Z|GU9>Cq2K+N>L zf%F#x>0N>JV}W#UApP?|8n+vqjKFU`_Qz3@9_P{%y$_fv!1mDpg$mPr_DSKE&&U3{ zJuN*s=`YUDzrp+0w0!KZT+Sdo3g=^gy++d1k$+}d{*7LPq`7kBWB>iDfc@@3`tKxN z?CfvyUJT^FEa|x}|HEFknc}RU{y|lkzEsjY1IhQMd$!IP0~Fsf39~>(mZnJ zdv|&-OPWWSd~bpG$3Xduc&HK~-?%_}P9VKJkp65S{mnr7$w2!1f%J=#=5Zq*>k+^G zQDJ*h?*J{qf5#3u#q*zy^1o*D)f>7cTTzGqOuJ(F3V81_FABA+Sh=iZ>FQO@E&PYH zC1pW>aqySsQ>n8wd39)IopYxL=U=N=ru#x$S(kjj$Gj0_-ykyTLB1$tN@RFZDfyx* z$06NsS$bBQr!vP$P0+1fvibeGrb}n#0LyL1Rzq%+?7(ydnD z-=ZvA!wq_Yx|FJ~lS2RBC@*PQ?K+)$cdKuErJ_C*>CI_gwq`|5%1hqLrWMWyVzO;i z_$6vrtg2aa!A3i(CD^_}pMQND_m?$|E9zFXe9A+AII|F~vR(rFme3)Am&IjkR@Jnu z_)CAgCtJ!Q($s!lp6g56_l>r`Hnla)E0*FtJnUg>YVZkFYRt`~wtfqZI?V%NUux}B zVDGk{)TM8&ntNO7SL2QDPX!l*{)>=1-Myq~A14P~0^+~!xc|Zg%$EgfA-M~Oe^8}PUhl1oP(N7X0XNMgC{=lO^FlZz3@@dGJAP<<(J96u1AABCnn=zc;o zeC*orVIT8~O!clkqId0y`!@X5b~-%E*E=4;jz_TLF_#q~YhUS??ZadBA2IxMjlEnt zxO%I6y{lKSt5+@`T>H(XM95r5q>ahtrY_kQj#EyP9jBZkJ5CuNw~gX{S+|YsIP(^V zh`!s!WatWC>Ds@<$F440R!;Ywjct!?JJ+5J+sL&?^sYT|pWn?H%m2PXv|*{S5$xJo z=j&Y?mihRCV&IF26(DMGT{7ZHp7V&XV{Ak_$}=WwW=Rq8(5NG$to6Y&cC zKw1z&4Gy~R6+@r&@p_|gC6;cS>OY1#ocMECIroYU+x)oL zlnPeP?}`mMpAnmJf+Mm|RZ@?Q@YjerUc{`6cLj*&A%3sHMFx|rU<`gB#E}^ex;se9 z$*Dk_Y{bOc{#&UBKgWPe8*PwuSb3I+4cpczHf$rY@^DUSU7r;jZeL;@htG@67R0=( zSa3CdAjCR1+UT&o&cBX5$Cq z_)Ak*?RmXh06qDMBb6zef@@Pa%^v!oJ*JUYz>YwOBXT_Ap@M!B$0IH#h7HRSN9N)O z!m*=&sTg9;^#VRBf)GdK`1Ky(f^pP}Up>LDUSM*%dbuD$E<>QtCw7O25SHZ_5J$wO zgnF@Y`zdUq(7F9oj)Ud2fu3z7j)>lkCp!fpj>xgn^<{!nyD~cGc~~kyhvJBN_l|fG z;x=Md2yuM`W?zVPp18iio@4et1eWbU%rr6A1J@T|E)lGroNO0y#}DKV1hx4DF>Kf;Vx9lXjm>JY!7zHnI{)t#o9&4InixE2p2IpO+!qSU@B<-^ za05b|eqsu%-i_fTU+>z9MUTTi0--=~DKTs~hQtx>&=6LmHf|hX&vnL)1ME3gZX9Hd zx|;S^;=NSFoy6DU2l500_1{B$Q1D^In7+=2^%Cp0bK48{m_qK`6PD#R`2Yej*R~nN z;Ab0%buF4hJ!}pmzLOX>++M`GEx6fea{%#jV%Ttd5$m>Sq#ickL+rK-@L1r_P!D@< zJ7VSBL_KT{BmN>WY`E=+mGjHg!{&R4zeNli45`DqeXpi|GJYU#8v%2Ch;_TTwLRva zo49QR8;%39^4tns07E`aS(fGF&mjI+q*d?yz=_RkM*q6O9QT47@B<-^EOpR7cA)GX zNKQkb4ckeqHn&g@o4JS^h+)Ha5=ZLr16hNh?P(SK8^mr5Vb5*n#&8(`wG%LqjQ^_YuRU1bX7gJwv)D|94Y9VF-xIMeKJEL4*p$PDSdSOSL?4HqI8qM) zd4~ETd@qNxuZYb|=!tb-J}WldM%T$4UV)hY4p^4|4`rHQ_Jw}SIBpf-A=ds@8yn|G z6E>BwAy%9JVr=*w0eLuYiFHhzPfgUzy1pv*d@}kqv9E$Xu^v0VDK@mH&ogo^f(^0O zd)U|<6Pv}bA=Y~77frV*eW8)38aBkrb53kn*B`}(yBM+Zgpj8^yq8ZNZVqBSe}13n zx&9IB`SUf@OW)}ujb)o)LmXKF09kBo?h%_7=!qlT=^-7WUn@8w*Cu~!%6?01*29Ka z%RVLgR_KYf@APq?ZTm;D*$5kA?fdg$!@1;+FFc?@iV+Hcvk_k`n7bQsq!vFAw+>(B zp9^peq&?Rq;>b$;h=fXf!1AFnKF%ZNq7LEu62f^VC58|xCGz+4(6v71z8V_qWA1Mu zIj@Tob7zNCAcW*RigPr?hCn#CLhpCbt0pEHq#hw8=LSv0az4Oq5W+Et(uxq`A^=Gs z=>JLBN-Sf=JnbXw2!P_`^a@c`{>#)edIo)eXJ&yJ~k3dA6+}8j~l6% zKDxHC63A`@?c*L|>Ejc`(#ONZ(#PY(n8TEl2-?Rp#6zj|zvWf@7Sf7yLMdEeaLnLw z26GM9`wTM;cHigaxT-w&eV*WYW7A?V*JS14_eP3$7~D;q>vKM8@KXl&65|?*^1Q*P z4Svnw^TgcXkZi0cit`K}MSPKOQ)=*JgX6>(`!A0fWPx8ZuL_-TW=uIjhoFB!~rRrPNe>|yQD@5Pn-snCH;MCYit{%q*!i0j?EFm%K209M&flcq^G5IdO^V+6n-uK)O$v7YCIvfx zlY-+zQvA-}WXv_qbN(g;JAadcoxe%J&fjE_Z}0p~3U>Y`1$UBPu=6)5*!i0j?EFm% zcK#*>JAadcoxe%J&flb959^}xJAad+cm5^?JAadcoxe%J&flb9=WkMQmEo)=zRK^T z^EWA&K9N+v(cnMn8|BnY?0(s+`$&mzV~^EJ6M9`Ge7YUIq-1zeSACE zy0o!@r?Z1C-tV*8!4jk%w+^;M`a{~mmP&hMJD5UzsyY}uKJOfq^MLdnBz?RG@F8%a zqSlA#z-vJt->NBUvk+Xs%3lR8U|`=fapN)}^SVPjdD~l-6Ak+^01EJ*KahW9CL zCwc$VNxPT6Zw;>O1s1Y_`kGwA-c=uyrO>{CYDio1-c>DWB?nQHT_)dEMYiC;BknJ* z7wR^a)j`+qmSFl2!>fbdgtaZpRyEg5aQ{ZvUjo*)@Qg)Tg#_Or^iSXh@f(9p2mz;b zPIzf9m-8--({3kM;Fmb=QaG2#4V;a@)d(!lJYJsixrXJdLs~AsfP6c~^99G5fW%|| zbE;}!T;?SCHUL|`wUUR(3G1b-M<9+PP}ax%_EZDolsw6|7ufQ#oLt5NrP}v(!Eq`f ziI_hw)xg6Lw7>rhZ27hzEw>PWQhfg?I8G(xK+L}vRSi5GLHXQ$4WxB@YzNN77e=MF zzt6-{e7vooeC4pS?c3cCAK$CCd}j?GZz(9>Cj)%ll849%?I_Cwe0*TU`B9C)TMNoZ z|5o@*_ID3(runinz!wD{=V>(pZ!sv}KLz-nk~~CCw0*n}P8|2uUOD)*eY~ZheD3}V z(z-nkOCBO8$``>s3d>hv_;?FJ`DVZlRVVqL1|H>@{2%4xeRa!M1->enR3luDpnUG0 z4AR=Z(~^hCiSpeS;M-%`$6Ex-_hg`bXC%*O^X-Vg6X1Ko@abB?@q8=5cNRM8RkVG7 z2=E;SUkQw=5%`*vwr@f>ef-`)UJOA+`L2Z>aa=OafUg>uf%l%3uP(sHdx@Faw`F9%Qek1>YN z-CIIh=gR@`S}$3D_n2vE%m`mXG&OGp&E? zU}yUq#WNe7&wK|#`}@ z8sWnT%IEI!Aq{gU^wXa&n33|`6X081nwrnk#g6lDZ=ijxAdp+iq)YOBJ;2vu_-+9ThW6MClmUf&wVYGt=B3kA>up^F(ehcd5nqQ6dYy{@9-rE9vQ?b1> zotMlG@O9!DB5%c4BUB(L-~9nT-h0l(*B0PAVEE=3zQe+&<5Dg25hhM_T+RpT<-Kjb zd!wS`^4mbY&!FB$7*!+Oj-dT0&hf`t>;3zF>ivY+Ve>iRJ?|dDjI`d5!HzgiC4~QP zfY0ZufjO_W-YtQ8H-T6lvB4@e4}KV^cPs3;U#e)mJ%M^#anPuMQ8mJy2wLxd2KbJH zkI!LLl<$oIUoZIhJfa$g3lNm=y~ESTuNR$|s$__DyWJvoI(~GLIL+8;y)$4(9GAQ^ zSS0m4aS?P{?>)kYY$wyerMHNs*9ZQmCIeABQKa@(mW-{t_{C`?4!Rm1QT2+BwMECiL~`JQ(gb~RAw`kV(0 zI?rrQ?-85~UzDLI^3%P%E<;ZpwWl+Jf`$GQ%Mt&Yy&An88O+Cy-8)>RYoIfFjW%DZ}^ zeva?+Eaf@v-SNP8S{l#TO%g+^gu<2?cyj$L6Aj z&u@myGowTCy|MC9M)PTCt~}y-&vnB6SgP!?(eMd%Ps2Jmpi5~{`q(Jv4=ZIj?TU5x zu1l|^t7bGT#}>lVmTh5I&6Q9e9NAMeVoz4OKedL-+lof?=65Czf11uBU7u4O-h5d! ztzWqXZAGIGg&TIX6Fn+f(e1&Hkbh&mGA- zF-*s9;hguh6~$gD8U<%vMep++bsd=tH(kYD#TXi|=SW`CbXOF*{hcy<;N31OdRuge zpAGMJBX;FRXK%tbj*d7`{M?bnJx8k5`yU*G9m_%0Cx)rd&ew|yQ0a3;m-iHnToGFL zc-N7t88w$_RUNMm=_%`OR*uy|8vCLCgeW@(1Doxb!;qzdSaY7I{jyX)xOo} zKX3G#fbr+-`BoNBN{SKw23Y&`Wg0*-^^0ef%x0|i9|ERWdtbv}wn(L~4y)7HB|k%tACk|Ad{G%vt_b=Dy{Zk-vyT-0AG!D_9}n1* zpV*s^?_u$0a2*0x^QuOMhwoy5=h^){lSP3ZITLmHc3#x=R`Kc-3_Y#ODW;w#I$b37q!OM7~*OzE{*FAsr#kY!%`Ne)EH zU4&`SAl%y+YdEJ!Zqff$pA*(~$e^6^Bz;hbj~S!~=|f|1PAk&(l=PA2>jb(DfHQco z2o<~C+5Ln{e9SWg#XKtrnZu;&osBsh>Nf>s(C-Kw<|!-0*~{U^ahgM?zKecA8!kr5 zGs(w}M-D*l%-FwK;*JygtpV@5hD6V^4b}7bqTe9Ij7^EL;n82q^0=pE%ZT}40z&E# zPb(peLN_|-&MviVocbGl{Y+xHxmQ8V8&r@=gpiz)&L!r907w;r;zh)Ay0(~@H}@gc z2%$KBAaw|;uP2tiHxf%5nuuk)w-8UqkBGj9@3w_pHn?$~=o`3kzS+mTC(Cb>DZ~-s z-G%r~BQ@Y`VuafA>2AUyLckjo5KLrhNMh|Jp}>hXdEw{saWY}giJ<##-6IK=S) zXXHVnl02{p@_Z5H3*_|oG|ov1a6m`oJe#GghoN>X=Am;p}J-0t`MCMf$_0pbChz++VaYW`@o!GRZ-Zf&wX+x|$ z>%@lr+9)>MOvK8wMQnK0v`cKb9}`EW;0Mx)!1l1NM~Ttq7-C|r>j3rA=I;~3rUWsu z*7Xl!L!O_AO(|kx<#|PH*ydl0%{auw%JZMbW+=BK>MDbdI3jDv#nelCO2mf4OB~@O zf$;k#wV5I|%p#85=uAAm|D%0hBsN@9h_%htV#7A`{T{X_4jW=^^IwP!`@T+WX2OOz zG7SKd5PgMU{g!;IlqLV;V#E1DtbRqFG&Vf{W*g?hhFHIgblSeo36`MNfiM8x((bq#y ztmAwK^-`AKTe03o*bwVDSBuRi#H+=o2{y#KmeR*0%eFvItlyhog*1HyP~4gWoDIx1 zkb3Ud#F2^kffORpe+4(+Bx2Y^1xIcM5Yca=SYE%4$|L4t1{sMEl65skOa-JALBB=f z{0^}~2kLPZ)fdSZ;wGH~6H%XNWnFkaGx%-!eD{^D{J@7T6{R#|-Aa zuiqF>HF&1MbBXa>jiZTn$Gu$5F9W;@bu}$D-h|rb<^f*tMk%xT`unN?Ru}%5M8;yE zk3__b_aFRzU!cN1w;~2rA~*pCSwWv04HtOPKh+7}kLBRreGitx0QCD#z1Z4$@~$ee z1qY}HQ)|%F1AGa9R$~GVn$1ntKi8K4o)^O!how0AF4$yXoNP6A}6$?bRiJO5h%w^e|fl9zJCF>d~+oakrU;69x2Or((v)H zuY83dvwT&^%QSwM!N~HR0bdDh*1l?Z?wF(s|0$UF}CsRyrTg4~vyd z?3fJ0&hotkzAES^Bam15t_|>w1D~9>!pgT}JU3uBxgWbv1?+guDW}<_arH883AC>a z=T*AhXs_*~&mK@D$8Ql5a%xYSB;PjzeAVF7@#B3B<$E!}$8%me?MvhPae!~F;fonQ z`rK#xCb`m{_jx2(mkRS3ZWBA52V0;lS0lt)hCcg=|ay*MUI6)@`^ zhrm46`zZi&b8b?m;h>?IX{{Ik2sdrNX@K2S8i>%2vR(N66pkmb3-*I~UxXe0lI`1$ z_Hj*R`&d8o*uDn?e6NC!zE)JU-rWH{?nJaBAIDVrXm5&pJFv*bk;z+iMPiqSn8zke cg`}KBV>pLYv|jF8M(sU<6NbI4OhoPeCqNAr;{X5v diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libp256m.a index fdd57f31859ac785b818128ef912828c212b77a9..addefaad9504e68198c221d72713888de4b9e051 100644 GIT binary patch literal 1382 zcmdr~%}&BV5Z(&Wq$dwPz%+$^f?0rg_2R;bZyIatgd}>v>_lorex~mV@VhfpE<$aG0cRpB;_INU*8%9 z_xwk~@EO+&0$?^KKg^J@g6G^DfnCICtIHKYYYO}w{5vI uyDEFus=jBd$KZ|suxHHw{Zbvn47PWw4>>9F&(NaEzx-=EbphO}?9?azB)|Ru literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=s6bY=b3<=%ZkY5tS(+K^`j^sb67Lv9lDS?a$=R%wk|rIa>3ZY# z)hwKI+i{Au_9z(oyvIBibVsJa=RD+*kS3+cLny4zRVkNOt(;Otw(J-$_11MNl~O~J z6nOyFNE+ppD^Ic*tw&R67!4n(H+KC#h5pen@TqOFA}iATK!|B{YMT9_7|goN3nnI4 zPt5UnJ}FGYV8lJaAcI1v5Wj5OmhD(oyLPM%5UWh{WXQ*oFu@msVC@O_LGc5@S>xue z5DC|NA`IKK-ChqS>yuV_QQ&lI8Gv{NCO99GnnUGXg6{wWlCT~H#yI+MKJ2+z z0WE>lKc;?QN^NLoNRboR^E##);8Udj8A@dJFaH{*E?~B8FlFk8DY;GYDcX3a9DD0K gm6OZb?>qI|o!=c}h^KXo-GfijzF_PY2Hpl^pI4*{)Bpeg literal 2474 zcmeGd%SyvQaB6)<4|-A1%X;wvx{a~%g$iw{S||!u!GoBl=}IfMkt9kz`6K?MU!XHh zHm;>Xy?9UuCNqRJ9}9 zxwQ)S-h(hqb8XwYahq*X=MHykHyKSl2v7JyBr+B|Vqi6=jcl0HroI&&S=FA3<%3iz zMG1Bx1y}Gc0bG)h2FP}`OE3nb0EdOb4qI|O*Y^Y0y0XL>{J${&@@{@U{}*%!CK2}Vm(Ra!@CK1%@I3$k diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedx509.a index 8afa0724098ce3a9955a0dfbeeebedc44e42181f..2023313aa4c4342d64a7fefec83affe5fc00c0d8 100644 GIT binary patch literal 102274 zcmc${4SZC^y*_@1q-uKcum9g4Tdvad zPj^(WDJ!jCU$<)GgKO*NuBxi3s@D>|%4^HYEM6OfwRL5yO3P|3{&iIqHD#r%N`v*m zRS%WbR+VoXT%a;oS7{a4dc%x)t18OsSJfe6aD6;t+&{R!VpYxN^@E2D6tArd*3|`9 zZLCAqg0;cwx`84!!Rr2;#nY*;8q6128%O}pRZweSK-t!QD+=P$8s^QSgOSt00u0_k zLLMyJwyLgbd)cbWvh^EH_7{mz^HpoBHzw*Me5+`MI*U>&qsQrp+h|di@oAaOb-@ZtP*qL& zhAX5lM227%VM9>Y)z?A6&EE(n>@Q%w2z+o=t0Q5ZSA*-8@JnrFIQ$G%#5eTDKWBey~E8nXcJTW96=^ z?XO`LVgwCR;mr|N4PCXA*g(!f>JNkmwiMY)d8Z22tXjLFy4q5nhQOdE?GGA|gZ`j8 zP@}*GbR3Bi)ujV&J&6LU%SEM4$ZVoiRbAcYvRc;c%Lpl|0k?obxvn5J$o)N$M&1@{ zgIg}6(nG=ZRi#z+pGIrkyvk~8g7sAo8NKdhSmT}SWn|U_>#EkG+-uMzf>kw^o4O?{ z@}|a)qpGy5roO7Y%5v9Ej1b&hU%3JIhi#&-`BYH`@01d0*~@+!xgl?{{dDH1KK2s* zAsfr82Q%AXjYvj9&`|9FL2L&@*K#Q^M8%b%SE{&D?6Spfq53qnsb9B29!dK1&J143 z;-DJB;s~L|ueZL8ncl?)gL7so-_@zImoE#}mrY+geZ!h{*9)(Bkq+WnSF1cz#T$dX zBIi(Vfpcch7D?vMoi)cudv)p;Ze3ig>pETr4X10L)B3M8ZS`owf3`T~YWXsBPLbvw z*8APDyEN^P?VL*+cM$@Q#bOj|=rGR2EkEkVBFu74zqm7p{ZMkrb6n<-;XkKMb0@9v zdz&3@FLiJpbwG=qsoV0lji2Q4?zUIyyJE3J$w%!c8F2fEMHTHm?%p0(!SK9T?5Ojc zUGui+wXYr8@!^(Sn{$Cye3Q0G(~cKtn_{uzd0IHHp|Lya-=ASCzCkl$x~oOBovGer zd+71+?B4(LuqT{*yFZc_XpBj1X^= z1K!bkgGc%;veR#Mf?ukQev1viN5ScRTXSBmg?B~Unj#e$^N>-PsKW#EOiLbjF`CyD ziR2ksg+KB@dj?*8r^Fx5TNJH0U@Lw;hB(gmVqwoqCCDr6e$*+<3;CT%_l?n;wnrTu z`oYoqPFG;=MYrSjB4LuWf^otmVb8L@w7^O|Tm%)ikpbx>pG-nZqA-3Kce?G_dnUtc6w&F{R#t#@Nr>OH-MJ4rs_pZ!9wkFsD&|D_&;!!H?$1bK4n9x2HSQ3N0~NUeb$SdAv>_-0 z6%N^CHTAC3sL|wc7sIxOFLp;A`!gK=SZv%yw@oy#cq`Bl*V~-bG2XiKmKP6k5qMTk9ccWlK$ zWZtRmbOh4>zGA$&Ju|J@y89~HM`$XtJ}q_JMWLJ4&?(#M!Nj(%nfd{9pP+IvXP36q z7Md`tdBW@iOCv?0oI~DRJ=EIK^j$-JKia@L^ei}!yBKQSqx=J%e{VmLcDToFh)qik zG+*k-GcFdSdT+4<99qLp^q!OVXyLdQWR> zCT0ZoU2^J-R^r(OZAfF3pzI^1O|KowrnC|3$(*3JLf>g~+a`IIC-?R^3Wf)bZVg2h zXwvibaB|es()FwZVeZmH$xzs-d7HEq$w-zJ>2`bA6S*dud|(2aH=4OLKFh2@_P0pG zNMVu=7F5apB-qc5Sr|B?=O>3fO?UV9Xa&R3sU|UzBdV^Bf9((|Y;sg@sl3l?)Ym>E z*GKKh_r8@{RkC}8EJu~Tw1dc}tS6`sNA1wWK5tWR&)9--v<;gevct^GpJpF-aYgX< zqVOhfZY-MIv;w|VrmyHsFtQYa3sM7LzZ6csFXI;XHKEqhh#vwGY7)`sb?q%RPsZWO{+Wei%-Q=0)CU!3__(AiyRR36y`pfR?V_W9*v` zv5&0u2U7nUext(^O>KyDM}Bq3F@!)~gsgiXH&LXYgFE0aV#|&dAX{jccC^Z5txNaE zVmV_RV0io8@UUo7CGVk)$6~!%Y2i#o(#ifV!%3-`e%TnhKwM%k<5hF+Fd3o-enu zzJ6of{Ohl;z%MhK*G$K|?e%3U%Ju8lKU6&pZ}j{@a5^M>2%2WZTs3pX%o}Fp&zv_Y zvGy2O_akNH9NN1H)z7ZkRggH_wPdYGdR-46n>Jkgyu%P#Dz5z+T841d;yPRVn{Hgc zE3Ok&uxrDNK>6PeKC`oHSDP=P%{7{80tTOa5RJzlWs$drXIjFqvt0Wv*Apz)*_P`Z z?E{(LmB^<}n`Q~O=68yAgR~bVZCaj1-Ws1)?sxV9^0TyVX?Bj}SW90uyd2OUOPJ6&&pQkMR z4_WvbT_0zVkUL$*XEa?_KR2-t|KLO!`3;N>?4K;hwE}BPRDtw#Mk0H zLt=*WJ&p1+an2`B!9TbH9Qp(SwS~l41}-6%RecGu$M9cHJkh}S6JKNC)x=%{R}$wK znE6VFJ(yP}LrlLLC1zfEi=#i?N*u&4oPR1YZO|hzvY=szP{{ajJ|{8Nz9=#C>p-0# z5ABg5G3_x`V%p;tiD|cDiK+YNB&MCVNDQbwEHQ2NRf!9Mk4sGZ{Z8T%;I|}R4E&zN z)D!mxp&RYWxN!ufEhHkC{4!#_CI16_8t6xG=f z;AZ1c`4Tz|H`4dPKOLAll82a%(TJ&6k;G{@-z72iS|Ks@DwEiU^G=D$hv93%!@B)- ziL-EyN=$u!C^2Q8mYBMqH~GIMG4nCNwzzf1ZEL!Xs&eQ3A)U&@&BsAZc{(K{>`!ty zb^+;(1UC-{G37x0wl@pJ3+#5o3H#=wT!RpyBShVXif9MuNbe`@(b z$mOhrPs=@|_|Vkm2@jW3TT&;8lQrRI^HpkCK4HK>yVHtd(;s5^#4*5U`~ zx*@3&gjBtW4^Z}xa+?%ZQbtNv5vA==Qmnt2MPcIW*H{!GhXpYvo@mL-$yl<@(Nc~e zVR}IQs`X_xLoy8zR4T`-!_c#0@p%XGfp ztqPWwV%)KRLQ6cE`e45&Vi;9nyJgT;Ra`lrWJvo3#dMR)Sl5=N^ME@XX_b1_U=S7{p6L&Ql`cn|^QRoy?CU~O>y z`VDI}!7_cVHXVbH7{|wXTeUdXZeXuMZ@kGH-SDURUz(&Pyn+7?&)Z*wpK|E#g_{OI z%x5{e*~TgUpZ6HL?+qfS!WgdbKS7STke+ah?pogJflK1o{z=A>*H+w`h5#>X8lUR_XgysUosBG$LC@*Ul+po-l-hr=(bw; zN^k>@A|mo*nweCAP3@%JqxcpBoB0+ZfOT3q#m8qi;zAj)1AJS7$u|mz;-fBRz8wg77ki0hQVCuM2eEE7kUUmmU* zM!tH~H}cKIK{pS4tOv?5jK>=Mb6D#){$eEoA`w8Uii(?xQ z*1&K+N6^uJbV_bL^nx!aw}uWLn2;GgU<qI6{d392gf}zawPwSZIP^KdP_KhQPlYOCwL*)KMrQg8Dks&+Sx(F&vF#Y-7oQ- z-zAQ7x5(>de@OHfxnmwMS7mv`9&wB1u2|WGEobUkF-TcxSig4DJ{8TUP2be zUNQb9#?riFTw?Imc6^Ff<*97T*=IYR#iE-9{JaLa}T z$(3!7*m6BPUAw(^DVgscO+JS?5U&jvGIvzAZSmR~CnKNIY#cJI@=Vghdofv~O2o>5 z$;7-6Weo2!jB4k4#$9ah5n*;1%KKuHFl1uP(_*wfA#z~+CnzM$*x0oDKv&nUHZfg8 z%v%UFeT;c1OpN2^9Gm?p+?K0XMBUEgm<&Q>b3PaIb6&uL+pKb|i>Fz=)Z2hzNwlhII}wAkF<6Jku5M5rc``>vUM^KE0N4uj%ir2Vl9 zOg&ok*W;-gQoApD8&jJbT>#B1j{j#Y-#>TcT=y6u4yrp-Z?D+u3EcB8bSTD8Zu-`| zjtVd#2<1_Mxd}+f`7!HDE3hfDC=^`!g1)|-3(*KEUH z{jPR3Zm?o*L^xUWK-VCfV{3Cpr;Tkocp%qZ>>lZ~8Pi7G6WvLf;Rq*aFb9}*#vHbw z*ncNm()7{O z&*9e6Ck}+BbT+1F&+SA1(s;9mWLkzDXim}Y|KT&Ezk>N~1yi1xm(+Z4eWRu|A3W7` z;DFV$u7YVxTqX|*R#ZQM|IVvggI5Qv4g$3B`}o9cr9n$(n2{Mr3`-`Vqe_eOtsH6MoQ0H^c-s67pzWIf1 zD5s>t*6zLTF|9ABc^7MAKXf{@9^u>Fy|?v8Y2MfLu@{E@^X?<*u>b!2tHSyR`6&fm zTk;*xFx%CkRq&uJEV!x=mk$@UhJ8rz zVArq5o@soW6~rg&NdwNP5AuFAy4Izk{USYe?}<-{@v}ckoH8J8J!fQnQ};L7c3A~^ zpL0Sv(MK4Zn1CeO32M=6sKZI+l~def++Ri@yfF*$E!!QhQj$}ZlHrA^M>ZSsb%+;; zU< zpYkq(I==(^p_C8>L1XFjS69e0{%5u!fY3$ba#$pG0 z_-|=@YiwT8?RndFJ@({n-W=2eH*Ug7J(!h;AxDw#q;L-s*f)9Fee-S3A8VcCTkq`- z&l$UI>)!qO`qo{0H4T$tz@@ng_Z038wJmJgb+}KIJ|{|sTK^t-7lw?y!tU4oVdQmp zM<|%)T_@(E*)Y?HQf}A5j`@N)A73A*r0rO~ zyTx|=%ZVDNjz{dqMy+snT4(bCf9vrB$Ta~~v)b)C6THy&;VZeDmcQQd?!l<-_zhaiKewl9OOB-V`qNI_nAH2yT+|NV zOTMO~y?5xX$BI6fpVa=c@cWUk{SGbjfIIcz0o^@jO4xhkZ<))Bbn%E6@yx#g)+F^g%GxL)UzbI&q_)xu9b{<}&?|G`|1N6;Cir?}zFVZr@ zQ|^rx@6Yc#4%#Fmd#54&h&!dZgf*bUzua?F*4h_!+(M6x4EsBC!=BdV-O=)pb8K}= z;G}ZDvl&WEbLjGOSSd*<9J+g zrLWLAsBQC9={sTTi2pDi@6h*&`I;ZoK2TA1%#C*KjGsOT=Zra*7L3LAwK(P;DQ>;H zyS!pSSU=o%>2*ARMiA-jRnN?GG(6XOW>}x6%YFEzOT7GY>jl^3&JV|u1r?MX^S&nS zz9UKKC6=u1=Cg8KMPXC)=Y}j(6thVEvDn=Cjz?^GLUFrxe01tH^uXKKS!~z_2;GzSB`@n>&XOfw1kasbS-hGFTLg zg<88KOLw98#k|TQ*ff&IOaC^#y=O+(uD(s-AgmK|YLUH}jS*XK&vIdO2PR=BUhI`6OlH2{)h{?L)9Pe^HJU5W* zaE}?wCq#%oHWxR*?e_4Kk(_W_WK?)>1l-ZKmdYyI+^22Fe}{R_E9TDiPF{-H*D2bv z*M8fWtS$ExJNcW^aR(GIdyl0}NBsaJI z0a2gPrP6&o~?yPHLYmxabc#UyP^nvZW3;> zn2o<~IPRnYTgrj2N51GTiPXKY_Sw6)-BLBn9ga-cb`9)qFV52L_^x}{)Wt@o-MNip z6FjQy;ZYO2Y~>|2;he~<@TkayaB}3D<6b2s^5)LKr2pkPEBtq?l~jksy{IID*iAn% z6e}2RB!Op$HF#Q*sT%PsAqZMQk7QV#{CvO(<4vdOS;U78#qA9*YU4jC{(#Tf;k@$j zGnIar!~GR7i}$|3%8x~qNW^a>inm>~Bv@jy*7(zy5r(*^0*$|qDZPY5;I&IeFvDJz zVfY?{u>)g1VOYd-K*!unN$tMVU|y$ndHQtc_YL;P?i*t}ej-M%<81>TIaFyUoY_8M z;N*^4!$7K?$JdDM9RI>g!C{z-V%=HsM#XH?Hw z`oxUnzy)pmLO#;@@g5Z-5(Pj-@jQBk_>&yoDjYwVfRP;%`n5#|vbkcDC(_ zqrPVynZMh8)bZucrwjf~We&UzrgmWNa}$hXzA&{Bv-g$o9No4oIBvOZW^mM2`}kmn z_nx_-)*p!nyXL;M=3x3A;ZV@)c231z`Nsem6V!LNOzOdVUy2s;PjPSC{jBZyT0R%=G%(9wa$B6w{#ajMVZ%QG5pqtNzX#eF2qu&L#**>ZDw#}=M9i- z_D|a~j~*fa^m3$Htxde$=6p(f&t*IB(s6$bx$L3f(bF9&g{GZ0hoL?Gd|B1-wiFSqcS5LVn+( z2@LE?90Z+phT56s5ZyiJ)yCD@>#-O}nWWU#r4?riv-jK6Fnj7~>bM3B&SeA2 zWnZe7p#e?gZ4)J z9e90>EA>5B%6XTo*Oh$ON1Lc!}!2e182Pso2AZ<#(HM|Oq$6C#^J{w%!t__HHR zL;i{QWX7Kp$qV^&BmR(o5`L2M_t&S>{t@T>*IY`HB{#;g<;YF4*rt@1xZ3?QQ3}ZD z8vp2$*@3K=+_v$zBG;p~xkCPo6?ig%nb2g+qWB0W(PPam=!)h?4KT8iM%VPYF&{g2wY9pG3h3!7;-jczkADaI8tNKWPXyr9u#&?-`7E76>!x zGi=zVq@m--$rVR-sC3;W{ZgpE{pq$ORU8S#xpMoZ`V(b-@k~7<&Xqx_4v}I4*K2s7 zP8CvB_H8z|i%*7$#q(*(!5B#pzfpu*8;}%BC9qt31$`z;BNk(6B&M5A+bxaTE?yc5 zCV}l1vDg|_v0;d5P$MJ1M_6pd{lyk94Qu&MX0bVE#gjHl0~NulV+)JzxGFaErltbv zH#KxjbyXbM88@{m5No=fD7O3JQldbtReBjN*YZK_JWzU$o94AcmoDK(x&uG5f?7FGGJ8vt_n?^8WD`h4@ z*oW`7eO$;!OT`6T!RDH}%^NpvsI4z6y(#Wl9b8|&p|;xOwV}SUtoAM}+~b?CO>yc; zNy!)*lN{u!4Az!z3D%bRsyCEwUSHi!{*wxWw*z_^rv9yU3XJot+sq^{>+&IN^OvHgjX#o!mKNNmZN2F zp0571?B&_Z=U@4s(x9}e7N6y8sNH6mhUIbh-HUyO5rrovE@sy)#B?RAAH|9)uwIaq;q@(;A}H8FbIY>D3Mw|= zXKU7PL(sx9gWb5kbKwoz-6chN{5NyvY;n3_4o|c4#nlaYGqq*6FS+&3g?V#kBz8?h zU;Qt9KJ~F_y!F$3J7rdW;I~g#Yu|Sm5}(J(CT6De$Kbb5W@jG|KFS=d*~QH1elL5% z%npnPi!UN}_{2r6~P%G+dx1{&3#UA@D@%hb+a*ThsOfP_Zjlj%~7I_^- z*a&=W@C%FnZ_03fzcE6)L3>p4<%;Wh+HrZ!nm0nbQF{|-x?~(9Fw^6x)W^79pxq?x z&G|PY@CDY7E$JN*u{G^u5x-FTj+DoA8ptowt|Jj#K8_Li661oUeA1-7jPhBg&6oV2 z74iXdbrJSFB>7$x_E@Q{mGJ{YztvikjQ@FYT`KC2?xzNtn8(ELnW!S?w-9sA%RGs3 z59Q~QE&C;Lg(kV`1H^1R0?8Zdl z$gk5daG=oAW%-NmTY#Bvj`S!0E{UnbS0rXy2PI}YCnRP%e>LGG<`d5L#e>x#ACwx&4eX8&l^+uPsSf;1T+bQFxQxFcn$O%l2$r3Y& z^R_5M{YxY!$2}60qf}yRSyL_bJzJ5)lq4Tx>@ybEd7!Nn@g(M-N-{#Qu<0>ghHG5pER{1UU? ziF(L?aJS+}2d0jTBxc^rBxar-l$d$iBQb5bPh#3o)K%~>e=kUXAI^V}n0ewnW~RkF zjgy$V1tq51r4kncel^S4xDXazf6rmem?WErb(4n^BRAo)Z;3{1WmQilGlE|kZg(XIig%iYqSY1T>1 zG#`?fap|bTJva;frOv$Nq_aZ8@m5F7aA7y#cwBS4@KajaoRtnvmClQza!Y1&bjfG8scLLL?dnNnLbg%Fd|CDV-TDKYg#QbiPZUPQs z>Xj=o!|8N(W^lshOdO8YHyxPrbO|zixsXnkugI^gt0IqR3#%a`@+jMa$QLsNC-Mau zeh1{kwaQl(F&i=*^%QLiGE*gH|2IQoemg%~Vy+2MAo1NO9O^~O}LehUV@V6yqUis|+ z)1uA(B5@%wzfqt+_5Ux4sY8;@@TYxT64QUA#MEt~#AAUcnPe79oCW{25|;p%n`G)F zCeI#;7XmM{8|lsf{zr*@z%3F}{s$)iXH58ciSr>tr{ktX8#^R!z}aQO%o}BxSLTga z20QT7qO}la z;Mo#?ADC&Sv+&_~>mp{|;O#{DGc983$onWU^CIp?z~s1D`m=8EmZRi9D>3C)OH6t3 zOpdtBQ;qZ||5k}9ACZ{y-;kKP?3bAGZ4y&n^s!Q(qtf4pbGO8le^Fw}|5jr1zbP^8 z_eY5-|DO_5UT2v~e$gib=fYp~$-tB!EoCU5W0IdK@l^QVATi}XW0JqqB)>%B8IV~a zG0ROn+sL%aO>q$<%9r1{viw-quK_a+V*X|*@&L>>%{hLYp71bHRndKfxYE zM0|ZdfI_V+toB9tG@OIS8OX1`qW?6@KMYu@Awg5M>BMC+nl|NNd z!TNeEZjWXD<(@j1EhOu%IG53#N?C6*=4!0;5Ox+B9YT6gV_zU-;Kk}T>O%Alb!D42m({E-OI$fewFKGaVTXgdwefy_t+CP#Yw7gC7P{dQVzPXv zFRsH*FKa8Oi!E&u`y0g#L)T5eVJ__aKU*OO&#w5f4X^QW_cC6nR`3Tn>F{VQ+)Vr@ zb{d!B-A6)k;$ zDG*kCw*i>->ylwszMCP(IE6C6XW|}gubkpL4>>bm7<{TekAkq`!(`C}zV+ba{1fFAUyp^a z3w#eli2AX^MIh=Z;mtG|7)eks0(Equoi!1*xBQI75l7QPbj zZG}Je!%seOKCbCy)~^roXjkPF-zvxv7s`Nc@KKI@cwLY4Ewu3c3VbX#@`zch3fW8tqH<>>wsfVhwsa2K=s%NIox=ld0e%zRV9w?V`({*i<3 zmjJ|tynyp%8^854zkqSR2Y}6dkAe?XBkmO6a`>3}>OrFHmm|Y?y#R-q?|a~rLoNt0 zIC##NxR4ic4dBbbnfh@!f@zU&5y;GZ7s0m}{>mx+ZiSFpzbN>gf)M$p;81)V+cNVN zAhVpWq@3c*w(u>UXsn4wK8|lFzP%Q{Z=kbfK9o~@U$OAbfYDTca6N<-U$uqrN8pPp zGAYMP&U0a$LSDeF2VV)#IP!2PzOxp-h3>)YALnYA`JOWIsozu)725?Q+HW;HIZmS- zIp}_D;rj%9Tj5XrZor}R`?@WW?;`k^j&h3ctB^D6SC39e)ffI=s`wtX@O=U@h{m1b z<5-B9?<)|>f)w@RZ+D8X+rpQHo8R&{n<2-`b2yOY`18;X$R*=iIhF1+Nr`d~4O^3 zwey9LReW=#el{7u6%U<0iFs0dd5|M6q$k|g$^FkI#kf{{-?Zen8+?j`@f6-;;X4C9 zH^OPZ5-G>)3Jc#c@NqmzImNfe!uN)WkNv9B&ug_G_?V7ziqB)Q-$n4LcC;A6itmrO z@0rWv4e;eFGAYN)Hz3D2g}i`sp|j1xnfbj7hvG}N@QuYo8nPC5l%um*_@;u7`5@mC z9E$JvmUff{zQOL(zkwX%6yl)E2cOFCGF&UZJUn!p^Sc^+N+-rscq-(~d`nFF-DBb# zX5lLZAIEHzQ+)VxI)U$g6JG$rlwdONugJppjj7;3qaxo*9E$Jzk`F<`UBpAKPhy@FU#o>LI=#QW-7n>s-<6j7 zl7>OF86=WU@!e~wFCT*MVaQOw&*4z|&9d+nf{*iXl~a7vEqpt0bLPF9e5-LNzFn5` zjp8AEu=cUTQogP{W3C+e)|mKKTKG3SeXTqpxp zul8}AlRtB|5#h>f?RD_Q4sN#ipR4)e+Q9?gZV$Ewj}W!|Q|pasavd@T&*`yk!WVPg zaS0zhMsu5ki=!FM!8^jPP;e0zV%QtDab+X1C=%8r>#TEU?8Txyo2J>1CT%NfwrMxF z#=Moug^{#^-|UaxG-FNo(pao577LHWif>@VZczLv)7xb0xOLg{*g){_p|)JH5KMny zV6xAh=}u}))v(?{tyYA)sxw#S*K1NSQy4awr(VIEzcF#6{;g&kL z1G~rVg7?1p*DPvmFVUvV%3OHc{y*OA)G`}G!8^nLrl&(~vqc86Hk+Y(V0&60Rvpq# zblIGr(VjlWRo8aG_Kw1ahP_b_7NR)pzth{5?EOlz+tu_fEH~p_F+4N8du-M5zr_Oo zINY5)Bh>wajHNGZYPV}AT4qjJn>j1zX^+&TZ_~uoq`=#H;}k7tmd!a?!%tqwvXOM( zChztX#HzN3dUCgiq3~_{ZBDV&aB6`?Jc>XI0@fQ-`OrUbVSCOb6R-oUYPr^ zfAMJqVE?V9?-<5t_p1dhP(c=Z=Ojfo-99HXw6$n~YuJP>hm$kE*lgD(zHrf<(G|ps zF>`Ij55*8CcN4abbUNegxtkir-0(P^To%EP#XYdtoBSqOu1lcmExsu}WSf|rllc~w zv*B6`Cmm&FY(dVd0s3xc-UQcdj~hU%87{CzH=6g>@vmZ&C8PmBJ@UEP(=vVrPMy zK3n~0Px}@nt!(TRE2x}|OH6bWjHQGKw)FkinBI#IOwk zKN!7sg=ZMo)l7orGPl4EM&b}aMgop)y1M`|gs#S3nVP!<`=B03xs=qXYt_lcSQG0y zDS^HCJnx8wbvm`M-qg4~d^t^Fd+u52eTp4~T$BilsOT(~N;E7UxsFe-O$)tzs<}0`=S-UWTke&wKIad;{7-1{yXPl`UVg06f#9Fv z(p~*(zGKISXcVEBUpQ^kdrzL)^QW}8p7S3*`A>VE2@@IQm(%kC~&U5Ve z1k$}HU)b@{{zsFiVM(-MjW(^j!_zv|w?C>+OBr_&x2XiD?qj^4(&5%7oVwQKHGh|+ z8)ls1Uo@(4CC~dFow~M$tLJcQIOi?VS@lu=O5Pf-^itvKY>lVn@G2^tx>osB*Vg9XP0{9EOf9*X~J$*1z8(o@$mSd25=a+h|m!>(};lMOZEd+1x> z;e^NLntJ04X1o{N>qyl$)K&y*se8?UMt#|5YnRk+c&G}aQX;5~Uqh=;u#M>ncZsjO5hF>%x{~<3 zSq0zgNRvLdY$z>*fJZB>S-Kh8h<)AfbxhaltLoP?#I4nB79XkuJG8s+(kih3ypi2| z9h0@&?$Wr~N>y-u9R#Lm8|%t8mu{%pR*kD7t)dLOtcYxz$){?i8=!2>EgPygZm8jh z-6_ozBVT`SYN7+6CdPH;1~J-8(TecJV?30zEv)hfv3>ebo`=TD6boEwu!HK zqz6vi2h!{Y`<6K|T-8X!*FJ!cZ@B%=o-hK%^fI+Ss7?T4>>t9G>wi#{T87_b$}ilqtXdm$qp{NWjj0Bg3L&tkQT`mr_&)`&I@NoX(3}X4i5#K*`Sv3lYnIPOk9J+ir zq1pM(C>_;O-;Yj|n0?_aiK!}oBcTjcx>sV-a@>Ia%*S?#nUC*E?8EtSiJ6aolbHGV zL}K!fLLSKD1OA-E%*R%V3xIzuG4uT!iJ9+Vh{w3(_efj_oFy^y&GAXf(0_vo?~s@} zgiQXN(@S~!e@$Y(&vAY){fQkolsze@%7|Ef^Gco6x2@EbnC=D~#Oj`-(|~Y-Qw|g} zOdlh>g&v&qPAAIFX~d;WIxy2@@e|YGX9I!BN2hcX{E}1fOHQHxI761>VEnd~j&@hy zxh|EM@#-XIJUY&GrMoP@Pl$-;m~@iBvAPp89!)^ZptTam`6XZ&>pX41x=2h_8CUuH zB&I!bC1zcv{V7A)e3O5n#926(NX&MyMB>RfFE{zGmiR`TD<$T5*G7qpaNcV2Z;*Hq z&S8lc*8g zqc~rX_%WO>N_+_C4<&vMXLjjsC-Lurb0vNQc!tDG zGhbq+St#-Qz$GSs&e1042k>7mG3SV{mN*ILN|XOaiK!#|4aW80+#oT3lL||G9nO0s zo`7>yVt!BFD)EgtcSw8(&QD0p-wV4;{%XFqF$+6kDv&Xm6|*Nd)M9(->Qz`8HIcSN3pdEBJ@&Hdm;UT=&Y}l|~8){#=#3`i}WuEd^u?>V*I!-#o|i@m7_+xkWtz?? zDmBv-IBYvthIf|f182f1VPl>h)_yX76A@1xCHCLh5RU7|@P49P8g3j>lLwl*a4!5O zmbcg;=eoT&h+K(aF#hpgNB0g6;zAsBW6@uA;LKYolV=#b#5XnOba%jy&&SFszUSd# z<~xSS3lWigeC$ws&%w{kmx0966q%Ic<m(oVNK0SB`RY z>~GC{KJd+eKl%8st@w&8e5FI^$9-ANd`nDxe5O@={O%Qh@p7vNUk|R8qa0m^g|ETH z$47d_$GKx>zI+4>X1^aoj&TZc&^=+|<8zPV$M&F{lH+rdS*{dvr|2P_l3R{z;zH@a5&E@)ob`{7 z+zcasM5a3vm~J*2eyNF%kjH1`nKq+~q7s)HQ2bYNlaYogy7r0sVM)rWuz!S{d5nww z5FPcSQ*vveA4KDhd_I|ms;4Y((dDkKU9a|(GDftFQ7i)+|J4}R+*vcF$d$*qK9oOl z@jZx7*;&-ivMw>l0UCa9taDDOF(%AwO|F4X$o*lsPYkhg4Zo4=r*rM*9_Kdf_2PrfPE*kmxBaaSji$?NN1VRgd=}JAZ}7jyWf}aCBA9?V}czW102dp4kP% z^Taq7ws30E#ZT1`z^}Iof{wol^*tlT~Ft7ZSh0Nhz^~cuf?!=M@6XhLeq&*>z|rl4Ygiu zdh2ixhq(?hkKWffu4Ra8TJbMp;hx9|rFNxXD1K+E_x%LL?I1HyywSHi zT(tX9U&sEgrLfDnBrPys?`sQh+Wn~8yF>5V)$t_!XpMg39dE+&`@b`i7WoiVN$0{n z57;WA4?Dk@P*p{h#dwbQa8i*N%fl+ctslzqsZE%w=zPG|o?U>Az5akb@bkYJE6QSA&8W^C140(9 z>&&Y4(%JqncJqKOoaDxiPF#t%wYg5mWnDC@$7E4Ip=7BnZu*OX-@A8 z?r>5|WkJe;qP-Y7&f`CS6*l(4SWU#y+mnvC&ND@b9XOI2PQrd~OAn;CpZ)SOJShdq`0?v^|(!~cfUjjgbd zetxCyJ%B~p#~PAMEmaREMK@u0s-(I3|2{W53vHqui~6ra_A0tYxW_D3`xU(J{a6bp z-I-c}@!Qi_Et%sxZJ4f!;hr{(S6;G~9PP!u8epqxTi7`_!|P6FyAWN$SvDpt)z976 zxEy~tJ(|_DBHwu*#%{-R$A+cYg{BCF?yi)ZGYFG%e9Vv6&83k|u({ats|ckS_&5n$ zfdyOg4Nv=-JbHFwpD%b~-z{XA$r^hxcy^Dm1>VN44vcR5qS!LXFGgh5c7mRO~~>t z4E62u-k`7i;;=AE-aXper$MedrP!}M;B5432RxI4ZZGU)Y*A4p#(0$pdS*xVMs(11 zE$u5hYk$Xf$tJ4C&eTATqw%UMyemFN-Cf{%z>yooIDBK8H_S9dROl-PL^-OtGxa#?h76!hcG?Pu+%eEwDJ#U z*c@$AkqBicoy}SiL_Q)*!y~+1PUf~RsPdaS3=y!cp%8zmmx1A>%xz!b=nXZ@p`w#oJht7pn^MM;1Iy&G%)Oa!KNe zHgCi><%VDOjM=5ru!^$r&qp*r{*MuA@B_tvE5fp}hc-M|R_f!Io*0l@i+S82?`_;cr^_-jvdO-Qk$rXD#9RaW*4=^DN;%u!J{S^#6h-{p;oR zUqpJNwX+sJyCpt<7f_D*$+KKfknuT|%JqEt9;wFkXbUx_$9GGe1aSNvMUBafC6@1c zS;Vr6w1-64N%zO){$`o&kT(ouxeEvR)7~Ev`vS%zQs3F>Uz^i3@;#C2=9} zze_A^Ob#5h@koiu&vl0A?*qPF;>E!H#)STqsgZaIuo`>32bfNc@39PY8WWCXppO$! z#MiGiFn;2Qk0tWw1db *&9(_+~qj4|T(4mxtGaYA0Jx+l{0(MP5$>lMpP)o0pH zjSVi4nDK6wnB4D3%y=A&p*-V>b$o!S8=dYq&LUk||3!Ys8~&72YvbN1aXc+#nzFPb zWhnbI6Mjiz>LBxzthAJz(Z#lJut?N+hPfVTq~l%Mvr*1&OJzSR)J(eZXl*kNnh^^D>BYfknFp zo(gu< zfI+^55kD2Wu?$0nm?0TW$;M@{EDuJs;sY%rP_2QK5W{$6G!{Ne z3>ad0qImW&FRQj{!06zBU`5LOVTh+xjob}2aK$VbOIVa*eD5-YSBZjZ9imz;n=q8| z$~RnzkV`|vtrjmZF_5P+63^ikmiURwnU~&)d&*@SwCM?>c>~kH0G{%UtCO$a5M3r znD=Ws(H9v|{8v$4fRI)0{z2r9L5Oh*Wmp0F;SONl-uPI{Fm#35cP)H-;K%26Gw?w-)vl$Dl#d@ z%RLspRudoZ$BOSPuvtHj-!e=&h0nl)xKIY10w3))0S9mGitneuX1+(kCm&G|($D>j z#D(;P`<;mori}Bg2br1g3Gne=r<~HS0zzi}E|~HQ80TAJ;p+n*-+z@;e4Mvp=F32# zl|YF3_26I_^IwC5(N#S?hXCG}l~a6G@G$eO245EZ$Y&liT!w2i-}{Jk3VzBdzB}Pz z=6l$rpLxu1BJyYEJBG^XQ)H5Zmww2Z`Cc~h@o|=6%rE9*C-A)izQ4d6bwmi>}{uy|vE0vfhC08NytAcj$;m_n0 zHP=8jk7=@>q@(@llw2D0gJ|55uUn>pVQ!HR6r~!|tpBuQnltCjmV=sC9@E^h)JWdw zqjRx#uAv>rTf|rszb10LGyKx=DO}B6lNOpRPyS~@liGA zsr=@=u6^6)$M5soJlB^sRc%B0sPy^8_VCnxoY0o1+TgSG>~nZdN1gPuh{ zZtp4V?O9kbyhzi|VaMR@On(<1t&>3*4K|{YL7!sH?FyBb?H~08q$GmIU2Mj#n*Oww z+!=?vpUv@Zw!23%jK9dY2h$##>)r0^%Yl#h&Syn(GzYtIVz{u~pVrhA3Z}J8#*nI? z-+;MO4kXW;8>vu=h)wDrNcG+uAAAK%Q+6~MSn~nLWWa+>@0;d@D;mDo&4E|wU&0-a z?a;sX#MnuBYA|&M25j8LZswrz<=8xIGvP zq-k>C{9j)1^q#;L@GXZBL&>IFYW5#c}LoeuvBF&^ulwENkS zOzUy%@0mu%`!asQ>mPDtc1x%&jFH*4uV7@hZ4XCgXCpO(`}75FR9cZH@`ADuS;1K5 z^M8?W*WML zD)PcxcKrL2Xj=KCF`?F92~qbrv#^aLy-Tn`dG1Z2)^moyG}JfA=51#gh#Gc06ceMu z`6E?&CzH<cNlme9F(6D1#QsXl0U5$z`7GFem<%zLW=Ko*%PN0s3ckLc) zb1sT?yxO(52sXzc+>uwpZP8bDkG2&rjP<=9ei8!5i(=kKwXU9ycPY^M%TU{ncvka_ zM3?;nDNaj@=J9jYIkConki7u<3~DWUjI&AaI4`mBs6GRYn|;bS_f>J3OIMk~E%PW; zU(oO$=pRgDd18JAWHFAnQ}huPY2I0B-fw7&j4?ZG<*w4;mvN4G8c!PSnbp{P~=z*$S&Ak?m^GXrJ@x_{8gT+wrS3)q7{27K3h~o*5C0P8~|_+Js>s zJF@8%BR<$L{x%yT?;iD#_`jxIRc*H`+O~T%daum!l|9GZ+B?q5p1#++Ug^kNzV~d> zrK{waU|in2g>8QKsOhGN+uD}zEym9qp4AJx*UhRdy6q>nVvK}(0+m|0ZJNvb;d>a= z!Kh!{ZolsDf0f_=x3fMlI_{@KIrQN>Z9(*zU&{2yViz{|urED|QN(jjd~{kk7lURo z?X2Swr+EO69uM_|>v{o{Tr>g2fyb^caENNq5!v%L5DjUq({hR$w4Q1P!Y-ou$I+ux%(i(A=isbJ9Sc19)l*K5`Fy5fo1cQnXZBt}tB#%}ERKGjxSqct>j&(AGhuZ6PjbK?us#jj(! z!w8MKLt5Ep@@Of)Mr%b69!v|r+Zm3$i}@-|&$ss!92Q;q8Fs3H`4^#9tv{{uUCbo{ znM_wPHKij*jZ0KL5;z_1JWr+FTkpV)ZWp@dyu28{ zy+^%`=!bjK4mrde3-5OA^;qnWMd%_g6rrPWp0uA$I%mVa&U(d>46z|{$!t6~1itr4 z*i+>S`?tCH5S6R<_n3)2+5ff<@$`e*?Vg?X1-7DC>~&4srX%l_jwP4|(x;;??Lwol zqndkAHrV`m%aOb#ff=2%&;eYS{pE#$n=X03ulESU#l=9duM^V&k|7k7X{x^N6iEH_(R3jt3y@eazn6R@t%~<+uqmh>F1-(ZeHeiw^I|?($%E zA7&hGhevtIu&(Sw$tO9J(7R4sena3(m-@>K&k{RroSw1PZ7ag--pIaUZ-E}(ekebp3}5DR<##;)Z8u&ZyuY;_?r}Zw^q!trth+C*yRWDr?CB2s zLjQneIeJsHGoDu;omcJ1oOGx22jQm1Y;B^$);LdF@<>{r=R}6>I3}yTsT~P5yYw#4 zGo!h4d}j1;ivEbxdq?u|cVpg{lcv6X5YKN@HTPBSu{%CK>pqySpS|j>4E^L)?$1?B zzxmY5Y3_0O7uaF%e4*E^4SV}T&j(|j|M2mlt3Fuprw-4-u{*0BSTR9ZLOeUWUAtR! zcgDF~&$x@#4yRq4mQwBLwP{NpO$)r>nCQI0UA24CLU*KLTX#i9dUKC!&(nLJIJjqZ zxcg$C2Q)BdsK?dtgFP2dc-(TP8Z1$c#YB2sV{N2;vD~Q$&BoXqVzS7@0AifQNX#6_gE%ST}y8>o%^F;{GaJo=?SMb`i#35BO^b z9Oezr*=4Ivy8V@TuZR41hk|%5U4|Q7yMM_{|5CgH+IM_%f67_c;ns#DPab|rd+oUw zG9$yje0Kl0|Kx3SBK%zxSSUDhUe60fRZn`yjC7ZTf}B~@9=sNrXb)b8J^^>@a9S`H z3-sA*dpDv#b*ZwUxz0L@4B?D6@lHCLjJLl zcZ+Y*+VFE*sqP-dJMT=lYwUm31~YLV4vxFi9(F7Vr%lYwm{@sr`Bq=a>@d7D1NDDz z9Ie#`$6><8AxA&$YpEr(15bVOf1CRj_^7IT-MuGI!k`f15Fo%z2#_FPKng))o$!nT zN)RJZEKFV|$TI|a95_uz8YZbd7orUT>1{}98#uLB&{Lx=rzE8@^>L0;Z{^r}s`ka{ zX|33vO06{a`_^M-&CY~iPw(yh|1#O%TI;{Q^-d>Fz-rliPe_4vn%m4r=m^ zMz2)u8|z7q_pDE@JQa!qWkuzP(C{YTxI-=1w~s%Q1iPf6o+DP?&Bb4qrsZ|kkFeah z1de&2#ddqZ!I7|ar+dWdz*|o|Fz$2hjSD4_a_7j%CvIjS|c&udqf!c#u?FZd$3zKWPRD0NanDxP1 zn1*9e#e0WJfdq}AZ=3JlK-jGNoF zY`Je(rf=x!Kw8D+_BKxL0%78-8~`qG+wseCRDjCIFlzrEZy#*=#ej6eoj z2yX@P2<>UKGBeAIyZ($3w{Fk6hldtpA)M;3=4Avk@AKsSSzl~C9TqMz@}g2v_);)) zF!Br~V{ zw&dcr-(s1dCSO{`$fT7A=lX^xUT>X75hb`oPb417v!6(S>CvTm9~yB&5RLfZp&|yF zdvSI)-q)-Tq1N5$I3H?1H?;CpamWhA^S;>IfO_yWo_-?n*`g5J2`+j(jo|Md^u(ah ztDg2$cS_!?O@R?OjYFlL3s&2AXP!yYm1oTue_L_spX+Z&!OIK2=VGJ|CT6?3@3z{; z--2>SyB>VR8tKO=W*t7(k$B+oq3*%Y98N~{ps_Xu#x{+=73Jx<11%|{=INsr^s)Yy zrUZSgy!%r+?&+DQ>yC|z6<7SB`-#NDqBHR#ODCqcjlcEu`26$ZZwZdiYZ^bNzdCt2 z{t92a;h}l@{*fsw4+ec>Q4(mCDEs2wNytQ-Z=ATU6~B;#j5qm4w4s3Ky}Qu1Bo4*5 ziXv6#(`jE??dP66oSuVRX0-W6azY8S>1G7C%cCh=Sj^uC|CcK=4``+SF zxEG(@5?9;cZHO!BzC3tGMbf|EvKNYTr+h6v^%y2f#PM9&f5ZjcQ}F#bUZvclVTh4* zJ&X&?O#CqyOG5|wU-~@{uYG*`ShaOm;BcSI9|~H(144C}?|=T%cw+27-sa-mjy3jQ zUI68PJ~I?}Tquv1)VOTiXQJ0Ez&4`deXyFJP+1U~-uPAV=A~_78E!G#CXPZ+)iyCx z{J$SJkZlt=dcAGpz2g63{BNIy=?kGmPo>o{QM_EsoLDZNNqO6d*%qGoC&auLSF!6u z-YsBm5AIcPYN;n)wMboN=6zB35=W>Pz&r&je~8GVXr!Li80!Dyg@dscR*QXPXF!x{ z67G)^t>Q)-C7kqf0`Ut_*pZ%qDnk9bQ;hQFJ9%-R97=M#W~b)_Ihi5Y+FJX+y^GJW zmheIbhI7WvD0eY(mV}87X&91^_eij#adMQEc&D%4<8$5s^Cn7M-0#~0*5dZetP72g z8t?zbd!bMgW@apW)LQjwRVOFuoO9pCd`ojM?*Ib|-wS5tH)Y+1nLVGK6Kj03UMe3cKR2G z8jj&U=hU+YL#NQ4@(w95wBb_2+g+VY@`s>};G&FKGABoelA3(OkL0;4Xi?9xHxuc7 z%P73H2_+#S-uSbOx;pb6Wr&FjBf#ZeDsqB2A7a(Ppl^6%@$4I13ybkI??2s{he#-N zykbG`yfWcp(uGT1o&NUDGx1kg8OZ%yD|D&2=eMhp5^uGdvWi1*6p)wY;}9daR}9s$$dugMz?-qSjDbS591r&yhIfZ-1(*`yYB?Lgh~rQ^E{e6BEL?F3}anJbCyk`>jw?$H8YhZmK`j>)xo^ zLywQ7DK;i}6gT~Q_a8_aaxLuW4Q8z=zVMNc?{J?Nfo-s|Uw9Uex)O@_;7K~Y zA)YaEbPQguitqdr{bUwG39N$_>A=?#{opFkJ#7!B2wCE}naQGcB3W&ZT@~MuCeCA< zZ4~omj3UtIFL>NZyU3D1B)~ou-2m>?+28!A+a>#((CqZYWB6Q(s{-`Sx7KQ{H$;DN z0-&xq{N@79!1;EN~~o+qxzp_)Rma4($(qBAA-z^bI%ni zkvcSQPqO>4U76HakMh9!n&<=yFo9{SyBrnKFdfsDd<4Vh1agXI&vN0>8)W3Uu$7n6 z)u^DBx+9g+Gf})(Do*)uYQoB-yt;~cL)xdGN$By31sG8eWGV<{;X6cVW^sFhdsGJ7 z0&;y~CY~UE6~8L$e%Gq_IjAIXqKfhY*+ma@c!c>#Gm$CY@_QZnKno{4@wEpR%Y)%F zvkPW>WThgrYW+x~WutBbCBP_^x2vi3CwLIg zc>HD83m4uQV!iN#^Fyp(jv4mKySWwrl6v6Hq32)zPV1XPU%xeR^h?h__9O8sN!Zgd zV$b{Ey!GACButQ-^7ZEr{|qlSru^ph!$0;MxiUKBcE9lGJAZ=QYbtUINv^(W_Bd*8=fnPlsOvBTf$&8_&?qi5e8`p&<6=aqMd zW_;bQ&nBQ?c+s?p86wG;{2ou zQ>W)`Zu^EZFScs*RtC0gDc_WX zktny{e!GZ;d{`?g%gxDF-iNRdVi^`@g!(qGEbFp9N(?J0FK1eEx>hz?5Yh~AwpmUe zbu4y>Wg@+IaVlB%yt{I|Wt(9~6$-ILsTfOn;mka*i4&p;2ku zgH4~%3O4dc3Nb2BRhg)76w3BZ zfzs0QEn??4wztY@v1{#8ZweB>~Jm z++O`q`4mA|vw5>uZ1boXRl#4)q)0xlLHX+TUjxB4*v*AnZFS+$W76W4TRh?c4^?ij zI{MYIRvrKE6Uc<_9Ww!wNXB^K`Wwv5#Jr6mI>UVXektmiHx3u#_Y!3|7CEntsWH}3YV@2iXU?ZUm%Nc*XwNml7L&dfpjzk8EvnDy*lO679 z4)+Xe2nPj2cH!p|JH`vA_!no*ia3Dc`h?H1j&X1$qy+WkvRLX7iNh{lpHuaB2Hq}= zeEp*eUL)K!)?|#Er96e7%i1Hb{ukGWuRsThW1N_281ae|v!qNnTSY|TqIP&>epW;R zf#Spr#fVp2)DBGyUmXb)`fIEu>cqCu&Rkf*Xpm~p-$1wvyGyK4ZmwD6!fKBfRfq6d z;V#4fh{W}2pX(xlKyhNHkBC=X)W}+fv(-f;POL6zy4Ob>Kyl&SFQj*z7{wh?i4!X_ zneOU{11Qd_akw9HxH-}}B5`7cSJUmR?_eYlD6UWYW~oIa&Z-aZ)x)vWoJ)L0l{dB6 z$3CGuVCDWi?)9}WoO`=yq1&takIw<8Vuhxmj`(`+BI8g$-@#YpaGx@|80xcKXrcQf zePIBmd#5A*EaM@B;kT>vP3Cuq^|p#H-B@qf!FSYQ{}&wL^Bnx2Q5PuAS>}4gZ4P_V zRsRE1guQVN_jHH*i;n#7bf&NR2hF$Jp?_XqFjacLRsF5je@^uu6TzE`5%mF1!cfBU zde33cCZ%7FuvF||=vVr4gge`MUb&YG_Y~`xYEQYsooj7%*#BRS@)@V{^L0^vGp$*w z{AtTD?C{x)BjqOiQmtF9RgV0>>&UOmQ64>x^jaMC_ln9N(_oqvutN*o399_21E*T^ ztOugpi?}M45Dv3XwH8||9Q>R^sfB!Hj_}Vo+&^~Mo2&9C+v{>`t|Nc{+rj@uNBJ~6 z%I9f^d!>W#A06qx=4d~^a->(N+_JttWBo+czjW7HS&Cn}>qJrLIrA)f&eNu_nb->j z6!RzSMG`ZfT_`c<@7Q-poI!l2#9rdX5@!=Hk$4L6Qi(aoz`jdj&J(fkmN=g{M`Azm zGKuFC-zYJYx7h$7yaL)q0?IXt+3+E2@U!m`5WOn$rP@8u6Jk1PE-|Z|JvlM+_gRJ0 za11HT{E7Mej0pKMe$;0=-%*%BuPV&4c~9YF9L3ykD3FKqi5Zvt_bE&rF{c;)Uf?=I z=b*yb@c){^EX(gIoD2K|g|mQvt1!#hi~3|*EaQ0!=L4@-nD$gFOnXi$><4~b;rYOq z4V-{JiJXi(O5sA_sS2~YS18Qt<9dD6UjfW{Z^SEsDZ1^!J3QCj^k?%=Q*9p6EW3cA z@->&u1sNc$Kl?rbMg38SwlP1pO2|vhLWX4FXRi`awhh&1j)NEHv3qf3^V0L%S&qbv zK38Fu|6+xiKJ%&d^_=#h@Z%j9{b@@;VK0t{6lOd5qQbQKs|wS`9~$^43bPGRm`7$` zl*y-rmn;YPZ-J9(+iRr1CQ7kG+mawlg~*aXt==I|p(73ReQpS9l|Ep~9S}w?yG>z{?cg2fTu~1pgq+ z5;-4-|2pDQ{DYL?NB^hbUr9_42+M;0FT%fum<0pbi68xc3jaOCykJ0T@uUBr;lEGe zSvZP51Qi_*jOr9~?~`#P9p~Xwrr}3SC%ZXfhLyMcAE7|}s%baCIe{xfzYZNOpM=1NXcZYYOOq8zks7O*HcRaWGp&G>FB-e{z$*9z1jCI_em4%+~K z@{Lpe)Sag=`FN|rxb){GoS1QWTBdO#EQGfO#N?T&Fw+t?7Xd(o%_N5KvXRD0gK#+$ zV(N}jn7Ww?GhK?lmk@d3gjpr_1_=bedJRGyU8l6w-Y9iM`KbFP(XP}zlITNJfp3Ot z8Zhk<_Xfb^=Gyx7Cm-iR6O(VJ!f?udKJl8ZI%BZqAq|L zE_AjEZ&`+)lvw0(lf)vAs+>h03vk^?lx@hamO5S>?0kuHiTx7i5pR>2!FG+re&X#C z&nJFJ;zHsb60aeCP~zKhNW&UHwB;U!X**9R`m+qTC`=oVD~y9ITj(%PqW=VDd47*& z2#lhz{#9Ww@J|)a0{)$$!+l?=pAG*(3QqyPPGRO7-_C{3OyIW_W*PiiVU_`2vkDzQ zaIV5EgGz;226rNJOlukNDuq`7*DAacn9tzUq5fDjGGdn5WYi7uI^bLb&r)~^{JFm@ zb%-f;raX$aF<#<6{#k~YpNpI?M+b<$JVpDnQuhcsY@ z7bwhdijFJ#|H;yi^_m7ueTp5FN5NkxG2`10ODyucPhz$?dxpeF(z5xY4U&tW{aFF! z{Z+lhOv~m!2-}c7OF+v{ykBA_X@?|cz1nPq5K&fBBtDEo8Zd2qSz+4fVmpUFZM<7y z+PGR_CLL6m+>a{k1r~h~;${JVMfo!yrxa%Xo>v%Z);k6k=NCMgr(WgHe2Be`;Lj{% z^V|XU1K*|aeBfe*-N0oEGp|(&vptA)#}F5PLiqg1JTd>oOrQBD_9Gs-h-r(cFXc}z zt-~}l7WD`n=9Qw`iQrfDF8KM-03m1E%>s(I-o(^p{)wr}M-+{DX(6UvH44*~-3pVB zqSF=kFrScqJfz_t`6*gQ*wY~W$eT7>;%tSfzf)oAe%0^?jOLk7A60He5{vR#D6zN} z&yiT1r@-WAb58>%|2&0h%jXqlzFHL~-}?$P?gt9996nN*^+3_rBkI`!;bq0)kanxY z!xUyX#oj891vsSLCNcl(`vK91@ZtjzoKWOFl4vKurEF^mg{X1>mC!{}5O&6cuYFshY_8RBJbFF5SFk*VR{2ilNWds>0D?ry;+9 z55%mr!izvXsBFVPi!Iwr@Zr;321+c}w557;Mb(D#wWXEir4O!+Xy|2^`ccv;h()Nl z;F8!IsQ*ROrm01ibUZ;@T8*+$>2uZF@PbiW9$YJPVyveoiY2_h6r(am^nzgh1e^OO zalthmIm#HlvRfZdHArPG2C0ZligdMBcoD9sMcf9=ZCQCmVEYDbe(V|_cyTu_9fuX- zv@PK!iHBVNZ85oJi_1o5R7|>ch{wG#`V`%Bja@Qr%WFjNKoK%t222ku{GYwMZ`e{E*$eC1*U~fk9!Ejw42y)si5aNgR=$>t?)6Xu?eiQPRZeGJ9rD8)btcFZ2&wCguU`X zz>I$5#jeJIS0}BBUW7DiMbhvBs5;ANwowYA;|h0LQ9=DKbGnfmFNW8;4LADjRoY*d zK#ZVBQ(_|sY_F;0R;9Z{$@d?>AH8TYeX6qc^iLI2D|XRWZNsX;V*IqDk?X<~`Qzzq zXzH+13?JTHYAhfKj?K7n3{2A+;n@1IWZU+tnsTfa8!6kqs`^H0t>_1MCYI_Ly3{{b zq(~7O-ICE~;Ettl3SrCp_83|pm#A3l-cDP>6>+D{_=K5DK^MN;SzEQ`p_!43Tg*UJ zlA7)2aM^Vl9YzI> z`Q3`xj~^v1SH9b51g1RBs2j6AzwZIVa4Z=_J%|d;c_EjQ4bC6Tx z>Chwg(-U$4?{sMo`S`t2t@I7tt@!gu{dk8P~Oulvmps2$_J<3+-5&P+YoCP1- z0?ThWewuHEgOB;=SU)YA?`{Vl-<`58kdNOFG~X#SM$^9c;0|drrAO!2;mQ_W2CHaz}l%gOBf#wdnk=bJRyVI<|Z$vHZs4r|rAV z!FLvX<(f?C(V6GqTLHdx@F(8{{50Qe#5c2{AUF3k5!N4v@bAIIQo(RqKz(XML2w+>1yznS=H z`{L25oA$k;u1`=AqWOO1xE{R*_b#o3qt^SmitkrpZyDu+Q!kwE=Yh?1m%)x?6^94S z7gE?yPsp#qr`r`^m~TC>$+r@GH!*?|%~uXLv0wY+!;mMxoO~ZZ zk8%7ez>CgGxBCM4X}*^nd@H~=UB%%++xNVKZ;HV;&*1xXO0<2Ue(YNXJ=4BCgKvSs zcawwfk$&u(?BJVk@No!&&hK7Vw0&p$v2Q2zO#7A@e0LapYaD#%z?X_}ExP>fbMUP( z_!dK1+cyH0WY+Hm@Ufk0(R``UGwrJcpYAu7LRs_u!O`!&2foi~GNni7B}c#eq``N$ z(qsFXgp<{@Z_fys7C9)|K9@tU7J4J4N|fFe+?<>FxNMXQuMavO9QS9YdlY=MM~hCk z5qc(HJWfV^p7Z`h^KEzVwS$l4rbY8@aqwk;FAGYI_!Z-)`OZ4(?K1dK1Yyy9-*VKO zAAHOQ`Bvhm`Pv1YZ`k$X9}&=6lw`mk++rhS{VZoliUX z9s!@eFD^6q7UTMD+IJ3ovD(W*=$ZDt1wP$gc;Bn-%XaX+1U_6s!a_aDcn9CF!N+o8 zek<|QeAs3(%D&``*yr1y9PKaOAK_bX@cqcqp3}hh4TNja_WjVom*J1x|80P>wr?Il zRQZ9=tI3oeou7mrj=MmhL?20qSt)IvSV4FJS`Iv{)ea!duwZwr15 zLl(r`4%5DiV`A6uf2ufs94Qz5k@BmCTl4)3u*vrx_}0Kr3-u`9$IrCSDv0pas4&_W z#65_~w`8o0hae%EZ!h#rzI5<0KJ)t!ehj0#+`+dDd}rXVMf0t5@MRf%JE5%ke7KJ_ z?Hf8SwtX4UGwsVY_;wq7$qv3W@I9rCQ+jm9Ir#DozCB8h`JJZv1000(fN!Y6Jm~!T zkqPEQ>s{za?{#&)X}yd6=w+z;HLZ8KAHAD#pUHIj3_(fuqF+PVYhf6F%hYvH^G%s3 z?_;%|&c|ZMb+E8NwsE$Dhw%&7n@U&ny#_uMX;_#hp0ST~q^Ux;YxAJ_Ne z{yB8k8f)yCI+pUsx`w!A44p&V_BAXN`~OGMe2;`xJE1&)h?A%(_=x{Iw)prxqsj?nVjePgA^ zS)}o7S64R4#d3TbQ;NT7hniZ7xRp$>tE*6ks3P!mTRLxh6T7EkAwTAwo9!^?h+F@= zP@toz@kNpR1^XhGw4?V&BBciI9N&`JShc)s1EQYqq}f=ap3A>sO|WxetM|s&d$29T zzQ(R#YpC&ju=SC~cd$}6)26QHjj$&3H`wax+Ntbh;b60%??voPz^bF6q6gAbj3UvC zc%gxyy@>$UDfenYe7QoF(cW}BGWTE6erQjy!E-v<^Ki0fMY7s`rMM-rTH4E&6zoiE z!0KYB#2yOn>xxiUNpHqsN0tO@Z%UxI_klyBluBD?GPQ8oxh||wJi_jo-r-Yc#c#O( z)Lv{-!LkE<;LtGV`LZ{~$RF+0Yv^m6uYR;+2G2T%H2^P`cgi*Nx!zuU1J@+<4WV2;%Ve)3YSW~q5$S7?7&|RtbBFSbQVlijLZ2na`_k}2tLC7=xb+pMN81^aa zWOFO`@EHHj1mF1ynO)!8fcS@pMfULcY8vYLAZVj5I%=(%f_XjyzZWZC2w~Pi(Dy=Ipa|!3m?}#vCK#4$6Hv z?nsmybF3QV*=e_LMR~}4j&fsLA?(93&1&s9`{ekuSY8idIy<+dh|und+?ArCF0>V! zZfx!P-paPljMJT7&&PLD^yg`2#Swfk`XUN zM|{D>h}?%FoaThIaGFdp+bx$G=fD?zK@ygegy(Z3t4?)XdiK>&XXE3CFS!q6 zUAu*AtYhFgD)Ui%i$~Jrk3k=Z7)P{wh;rZ1@^kfwas3))G(63=GS} zlJqoSMg9=RdtvBOEV_OJEZ7Bacg2~co;qnm%Jn6IRIUM!<;90%rNm1j+I*xhPNR+S zSXEpsUF+(ejvkqm?xhF<>2BNwbR<0vff&!tyaV~ZMZ(}SaMCLBtiGO;J4qVQIvCk*NF zbthX@mk_TbP@J9AokB}c@5simg)ZTsy*)hlps_w4o>I9ZzUorw(#H5_I$R5%>3ybU zEJ8NMV+GFQQLc_lI|~Y@&we}wmHd>e{$TH-;auOBD@Ui)W6|vL?9jM&T7&rb5 zf63wgox}ZEWuLTvi1keeALnUmA>R)j>2Fr{A4XWJHOw00$Pb_WwJ`oqwF5`G$2<7$ zbfh=RVXt_2Q5=ll058|fX%#MF{zh8Abm;GMxW_Af9?18BBRthn zzY`tyaGtsr#^;=LEp*pA^p88-|L$-vb)-)&J5e&yl&CdMm;i+D=4=jJfY3{?2arb0 z0SFMjN3-bx$->X(Kmy1V{A|2;r{v;iv!OuvTxa9CpOS~4O#(E7zG__o zWxE${u9HFMG=*v7?F!SzRSMIjGKHDM28Hp8%i=pG^6;Go+aED?jwwu?Z!4UI2!L*(T=T0{h|r zBc(GR_@WW_Lj$|eUdZEx4n@~Bn}uHQ3c;4m%tAz6qpPQ|Tx{Sh97Vm4p|7fI_%8%z zH0o@^(Mzn_664r-4@MDbkr+b#G+?HAqrwcDrZCgQ@DZWIGz%1FJ>vdM__GXGC``Tw z753uD_g>^@`kz(Uiz9`0K87RHw!QcV(Rn-pEb{0R-g3Sg^v}S_^z2OOFY-HHVlVxf z5QGPNf`DQy0n>UFPPPN$pW(=MU{Az92J`Ws(9to~ybCp>N&AN9-&}n*l9>&*gMnuw^%Dc@ zR+mp(bl1I8F}b4j!RUD-Vqp7*2l{&A8H<&TvCSJE+PF4QR#pw4m}+6qaK35+4_Mna zZNY@an#jbWK9h+09XhVFF;G#9x(lbS=SPV4%dzHBlXHYGGyAcp`h;WZ!T5T*YdB@0 zA?AYgt1|Ee9Njp=$wlUsLhZddR z0Q5}z9s%DvC^5f)VZQkeKCZdUXE!aH?{)_t#~$v368VPVM?L2MPcY83Zy(|KBh8E2PN8vVFqD7mxFH|`1o#7i{`tc;`miSHX6xMVDkC!)Aq6aY2OU| zD0`DFYc@TU5b{^4j^e%>_-S+kWjJcldS8PrMszEk4~T~7u%AQE91FmHoI?93TJLGt zXJk+Caa|nZz>~0nBI_+1 z^=ezS_{PJ1xMfKH|7RVua;EQj-}7iv0GnuEUx$CY+@nsncJKN6n{hjb?0D9-a3gv+ zzxAtQPkwsno=I0uKFBn@pqvMd(I?D zrl*rkYNR!h9$l@+!+Z&M)+hdFZ^{2^?jC^;I!Nc`1YrhrE8^ji@7Ag(U90O)UJea= z@8a20I8F1#7wY!uNN8h9=-`fy^pgK|q(0u-@yQY0Pxfw1>9+C3r{1yxa=&OA#J!$2 zCf8r-t+eqy=iV{sJ^uzDC(!IB@kCG(>-&TbnDeoC-teb|_&eHxBi+AuxN{ut z;|}*=!yd*Ds_>t~pWheIy;!#Dq}V^&>fEBPes{-r2X+$vLD-kuj0EAk02}8%#fzWK z8xcqrezxjo#QP|87)*lwgMOdfs4%I%q%hN@{nTNa-%uC_`Q8=&O#hRxojSC)Rbkrl zHHE#vFDcA)#XC~y(=KZoZ>_CqrPwv8d{bme9PyYTIxO)SZG0m6D?KWRcY&(8uqLcEsGQ}fCoLNC$e+H)k^Q{Zl5L5uUHCcmvLkAu z&CywdAKQT+KgtFeu?|Px=h7aAu`MmZ&*WPJH_sC-)T1oI&*XavBnRL}KAt|BZyw?@ zy1tfk&0x&|ZxP0Do?1NS;zwBky)p^Ke}?h*Lv<9M_;&(&rcj6S3;fJ$Im?+s`zTuP zRsfUY>u{V^;f%r`&&ivn&oQpvUhja{@)kuRrY6h7Y}_a*&)$>P)6-<@1L zd7el<5+|c@5j436>m4PF+n}k&4RQxZne&KlK=3DWESdY~_Z^x11h+T7??`4_SFZbm z06tS-ND6$~y8IXcNVKLsIQOpL+)uibB7?nPXIs}Ykq}IcKTh zV{xoxVwJCIdP%|1U}y5=xgn44!R{rD$#^33{7!T&GOKQAXK!zH zr~8HbR{7kCMjf}O7qa<7Iaw6^@y*ZRn5+col?c6=OtF;#Tk;3^*Z*MK{ zu^}8ktIKJY*y}erSm4HHun2m1s7LMAJ)%%?& zc1WEV7wxv^m5pPdb0u6MOr)RoHmeTJC_VUw-B5&axW_ES6D1wM(&IO$RQYnafh%sA z@o)O)lYG6sUyNHisAcBmg zBuKY=!&@#k!QJ(%Lnn8BK7RINr)9v)Ng;WU+U!B$Gitt@s=MvoxShRN6dID1d+r4LPHV}jhCRF@-s(@C^@(1YwrkTK@DVJkDXKKn#bPn!+` z6SLKvGRd8MqM#wL|4>RpC*BC62D)1;_sGMYqQG~GzL9HZK|7(>LPJM&7x9v`hyL z!aW6)ECx`{Pv2eBIyZx=?ZhwhUk59>QVib?@|8?;q#+ASqVJit0#4zx9N? zW`}T&3A)`+iBz9W7M0tB1J1$=$?yA8mj{NevIRM^qG>f}b6SE*cT4+O!Ehp3-45)o z(K(IEzf1du^WVJQ+P&{&Av&w2Dd?=0CQgkX^Im}%H|gj^aIM(u3dURcIfpv3Z#?II z6K3FQ$m=Z%(UXYwN2j=2PfcllCq83O;&s@n{rX_Moj>SMOHwf2m4CmwLIpSv88IMHRn~zxQgD11)HqViJ7t=iSr_{$b?eaDTHo=7V?O-Rm*arK~hrK;# zkKvQI7^D8C>o;-YQb?|Q#|+0tnb+et!CF^eXxCq!YunaU_JU54fgIIojQbQ3Qou4E zKfJL28@!S@XT0ybmiG~6`NfGR_J~iMc(ZM~%`X9bmKtchEqpuT%p-slLw$vVjg zG|0c<=d#p*2;sx{H!CC$aecyPJHl^uxNmp3=Q-SqtOe?xknby8QM00%{$hvzQiuC) zhx?wWcf)+P;&?0y-|_Q(%pt=_xPgYN&S>T?osD!%+=tM@fjOT`nOTj@); zTdYHlAWOQ3Sm)`0NcVNtQ^o@z`M;p@%l9c9fBB~<_YGE+;wK07*AXb8`_V+{n2ZC* zL*g6`3&TI5@;45c<59V0wibr-nO+Osw<*V598)b{)C4+)Z&dG`@OmEM6Rdx9@alwh56KX|E>Fd%ppbCMf3(k~%8x#D zKWm(ibbms%Z@%wJwdPpo9QG_!`g|9Wiqg1Cr3a_rdt2qdTZ9)_KT`G<2=@Z(U57r` z5Yxi+zu>6<&pPy9afGjPlwY@_ydHIw*R2lsYl@$9hf}eKE7$bWLVG4D`#7d5Rqf%b z$9yuY`u!o}=rM|po@oB6pJwAu_^CT8F&yiTz z%!UOKHqVq;*sLxsw3&Ii3r8=p%1f5=Uyh?Fb5=e?ywe6|`t0-4fSEp%Bxd@B3N!tH z!c4zfVWyAgaiP!jI~4Zfcurxa|DwWP94WdSm|hymAtLYj5{vvIFSJeMSLKB^rLl2A zc-dhAr#%WYPvX3TKBN3p`7=-arbHg* zX@bID;CmHj+${<-?lFZ~wx<Vh&1M_`8 zb(rsOD9n6cj|Azjsykesv_sby^RN3co)UTwG_S(cU2OQTG5j|xOb&|P(^c@JadDc1 z;0I5+gK#V0?(MXjV8ty_gj zZW!YxRAVov8?7%_lV6L^bJv`2Gm7{isPk`pBg1GT1FclFgf9Pps>mnXm2`=g(+wvl?f`rz|uJtHBt>4x?(+6&vH z`IUWulEiY?;uHFShLShjjIX(JBQc^(jV9AU82-#TyLwL#?QK+tW2+CX!R$wh3Keus z_EAqW7-?K>xP2rMQOxDlRaf2lBeuF@R6-0Bc+Qt`hZ9_8FnKv_r5?P_V+p4}sKNIG z)G@Z47+{RPG}IirZxo0*DuNfn|JJ4-(M1w9%>G(?+^9&p^kQwR5uOHPoE~D=jOdhN zhYnDtx(gATWkmC7lcHOtXfWGL)|Z#cZLm}m9UvKX(f?Sf^o=t>B04XavcTCRHB}GE zYxgysMP|PGAs8Te^bvh_sfacCAiC+qiZwt&ywb$l;G_QvbH=zz0t3vPh!`I=un7B3 zL^YFXf4zZ4ui?D~@29mC;@RqV@Y8}v3n8lki21IA!siQ9c>hh|yf>$w4r92+zlRdB zpPmpu9(;JOejk3chhcR8z`-Y;W#F$x^Kovs$+yJd<0~i4_XXt5v~L;0^fL%KH6Pb6 zH~ChA504YVz9gkb`!+lHR>F_ZAzC!wdIulJylXzbQquNi!dTP3T7)q@Et(G_J)-nN zP>7}13V)ODKtFmfIrLik(R&1iW%9K`FIM^Oho@P7AtS$h@1yg(+QHY3Fg_b=(fPgC z!Pjc=@!3=Jz3<>VhcI}BMf3f}!PjB%;q^tBuhYTDa*Ac&w;g=17<_zBr0r|O31pVv zMTD^(Y0>t57J9^f6>!nu;?-4dx#o*J<4pU! za3E`8(R>`MOYB!6S?YZk`OG;8AHi+%Wy8UDDOxn&2k1w1559|L7|V(Mj>%UD zN38O@NyYKwNGUYQypABYd0-W%9Kfd^t*weCu4%<;QvKvCg+oLC@rS8hnL_&-TYx zg4(_u2j8#3_Z5U|p&lj6!S@mPR=}TpQ}NS${N4eIaQ!}};=xOZ=HvS_V!!mZmZ|rz z45A6Ulxumzj^pEjPY6>d{e;3^t5Qc z#~pk}4Za0X)_gAlnC)c?_?BogrAKEs^ccra2jndHUc!;~Ey7RpebvFoIcWSot3|_O z0K|S3@Ca@Scx@!#9r!Vf`OU}0*0k?6lso;kXujFdGx@kbLKc+B$JgYV&*$KK3w({5 zOzF{?;o$o^`10XTK90=Ld}DE8Gws`ec8gn+uuzXO5_-gbIv^Lpmy09$?#55^{SoD5 z^6dei`pgI|smJ5*p=a`?kBIOUDLt0c&k&z{Gw`E)6YgRO#eatJ_dWdMkv37>gJaJd zcv|IGYT?@q^h_ZKWh&aAId6c^Q55EvqV;|ZdtA~>{3qWl$QZ+U-DDnFo;S@jX9^5F zZ(!DpToqy9c>}e$wozt^|Jk@++G5;ta>I;<%!bsc*#a1&<|(lkw{5kox00+E+wd=A zuoxNkmRPJ3;d3%EdX~rVSbOloy_h3JpGbmUWaL?Ruo=Q%)Z_HI7VH)3g+oPr6&~#` zOeX&|j`vNyXusGN8N&^-D=Fr1U-EryE)E?=d6-)?q~?xgB~_s)591LJyTv~})5xEL&m@zxW@=WInOH`IAPfwA*@FlvuO zhB0E#l?i9Qd#f0$nuLX5y{m&Ku@yHilg#sZbZA zGK-K)jNbiV*y`n>t?itI0*~F>Py5E5@63biWoc*e-0MSIJF?r8gPk*j0bl4?Ffg{N zvkJpe$6`3D&&Q#tdF~-{2~d#sZFd#*_EsLmGzKnXYPGxE3kCK}9^8@1 zrIp2S?$+AIIyIbIu6$fPHyI`%su;YQV9gDT?eh7~`@EN5MY8tpr`kGq!a9{wb4daW z!LZb}z*tl-*Bsql4Gm&lk25foerGt#7zg@L9O9sm-GkYdIIwhgaD8^S%kuSN1=^_z z3(;|oE>wJ@C0i4!9~A`#-O ziPkpdT{g}Ep)%49XQgx)ZylwMlB3)aPWed~l&x(W442~hB48bpIJRzP(C_+b*z-^NlBK(bf=rKRS9^6AwXpgOU*p~EI!Kn&U zm-jgIr!K|GL!CZ6s(}k0;4lwxm`A{(_5=atxTc8``{_SP;`zkc5*HHZ zNW6r2vc$}b9uG-XV*1TinEAU$VdihY!pz?z3NwEf6sFE4g_&13+95f;z+)9=7S<}v zG&d^Dyo#|;&}Ux7*e77-^-ZP2=ab(k><1R>>_LZlU4gdAvTwP}duC7wd^3*BzfHp+XbR!6pxFvD9{W~~5oJ6v)()8Q`X9K1Wv2Lb3?Gry z{CfSNNqk)W%ZAAG_XP@RiP14?(2GvV__i7T6#tiwLD8Il#Q_ko`kDqnD7~-+4`NU5 zO>4_Ghrf&)`4k@{oy!bdrP!z+E}MZrd8$f{#Lz|w6Qapo(F9t__;9PZ^oR6o z`&{3Dqybv1PNtvF?N|AB?nts9f&r3ueiR=#y+{mQcE;E8tE6UVT|E)!H+7wiaiU?& zOt`mjF6Xfp%Xa=1zr0)43%I{AZsn}U@Gj^-%zGYQHz2&U<1!ci=D=&9DZK7bHsa^h z<2}C?t>@gUdOj3*z0#uf*1;BHzY6d}iPv}DF3_JpUfXVmo|*0v_^I0(AgRYA_a89% zRvLV`MGN!2jq9?>w*g_i-fAHSg*v8Q4cxKx#vp>Jw+DK$@|zAl)4nZ+eZ1vl81ws| zs5FyrAN7aM>x1_yn(sJ_GwnN$ zFy0?)(R^Qm60u(eeBI#Vy_@Dc0ATW+RbeWc&?EjF^h~}EgAbpB!hFjeeCH6R9vMgz z=HvSMCf_-OkN2DmWB&QDVA{v~PvOrn2=yp`a`15iu`CbJu`F@5lKYm)M zM|lZ=*iQ%K_XZ!&6Nb?aerq%Nvfzki-yuhPNyoio7UI)B{cf1?);sue!RLp+7N$!n zcktyKe7qmm_VF9KX&>hwEE5d!pXTG5Jj8w#whnwOYud-R5SnkigYPWdeD>6$`S=WA z^6{J6M^GZ47eCFn0db)k?*En`fbCO@=6e8oCf`i-r+juGUnYK2D54K(J0Q$$zw+zcO{CO_UFzM?WoE?|&%!wEw5UZwmD&+^@v^ e=D_O*h54muz4M3<%CN9se@msoC@@2m=l=n<+}Ftf literal 179958 zcmeFaeSB5bmH&V4y?G+JC}6|@L2p99009F=Km<(yV|Y+OAVmgEE+mm)NMaHMEw&-0 z;fB%p2rZ-(DME)bj#9*yI<}<_ol?hdYps>v=d;gRH#;{0{LZWM zn(rUK^~%nE?{(H*`{C@f&-1xyEceI4(_6aV<|ND-IRTE(F3J*MYSj+SkYM@tazZPa!EzkOFEm^)COy7gGJS~Xj-r) zxVW~nNo8$i&~50*Ys zR9pUNY0<*cit6azW6g^eEUxZYAEPa2FVsd=N|%%^sasOhMNd@L7A+{PsVk~`q`Hfx ztjdzw-~&;M+%;RfWd5Sk1$F41x}whA%mGn!X%jONqMQ_U>ejBTI<~&NvaISdMH!Qe zG}J7+NK0$$YRW4gD5|S6E$p;z>sZ~=%G&a(%8pf9T2o$E+EpHRL8p=Csw2*#3R+N8 zfvvWzs$&_h*4mcMD5SQ-#u(9FWP4-=vnbkoU6*Cn$@YJdg$ovzE_kr$BE7i)1I;xs zEiJ*6a|ug~=bF-os~#*Z>0C3nEek493rr`~bDq% zq@z?{w6wf#p*rbY12;2jSX&pYsSD1ph}uS2K!=$&;=Zf3gWBqBSyWlIpsKok0*>Ts zw=gwB7Zxp;-??HDvx_Y1tmYQBAXrq6!M>!6R%ky~R#jeNY3&k>_^zrWYoQYLjVijf zrmI0@w4FvZv|aQYv=?ixF6vxnB!|0(yXr^TO1Y;BRu(O&TD&-FfVl=;uH*JaohsbE zs1~j4KTTzF0cC;$5tzA-D!%giHM(V25Ox~rh%UE@>fA8o< zc8fK^rI)DE!@-L3lJdIGQ)}#lN^2^Eb>$Dcv+gClnyKe99X~%@K>;Z+91c z%+|i7x^!_@UE9?*E1A05aN8GgJGl5LM_w9SWZ=ru%MDyHyX0z*a`kyeQ+wUII6~^! zz{~YGTwSEcv4lN-L-fg*buQKwjvA@j;zZeflm_cchc6gjHGk0!Mip75T_|g7RGDbb z7$ilX7ds0am6KzN9C72A9M`5e@yoYQ%lCLZI2m-sVh| zV)?%x)o;0Qq5g#n7o4q#w;_h`v^E*xT7*o5kqG}U$f!JLOKZN@S+-~eIyJ%B5nnju z!q(RQ=TW&)E1ZV#(bZpRNeHEE@HD6IXzJMzu7519;pDd7_jYd$ZwWtB@8(+bC>AuF ze7^Apr!~BG+cU1VaP?Afv} z``g9O1zhd1#4q&ivBT#kmd}|U>e<-aarVWi>QD@O@!iB@vCzf2W`(CdZD`%SI(Uk`t{>J)!zCf!~a!udXQ`V2{(PE za87r+*yr0JZ7v+*4|x~%YhzS{(c}*?cP%yWIOkPKf!}O} zdi%b_9Wm))S@G#7whsBuutfA(p0mT-_Drfj$t{fo$msmueZFHc@5aJ%%}W0j?o#IH za{0AU%X^=Q*^=ISb&RWSZIcdf-Mn{OtLR#Hhg<7w(hs@GL$MqWJL2bGpW-TZ#Jllh zafM4idnCR8`5}!3jeqIxiT656o(RQ7$QPlQ2+{SZ%@`X^GamDeaGc%^x9yAZ_jUbm z4Q@^Ey=UC9n0->mQ@=nmjyRFj(=12E7B#s z`^FiC7Qf~bB-_H>A_hkv9T~1?Sx23yCB3J77UgT~-#hr~J@!*HH|~edHwz8(LD{6) zA9FK9c`YM0hE^qe^IyC0M#Hg$+?N8zC;^T!DUDC;J;WJ#YWuR0gRb#5KJFBLf8foY zas4r7>1)2uFl+k8#X58HLY`xBt7q?v#UeNRnkgesz0l}&LV2sMPB^rW^Ks$hX_jtTlu3 zvAVe3-_vQkkHvOhQ{teo$0obmC8&RrPh!wh!E#ED}AnG0&FYHRDNsw#%vbw{AI zwtCozn}&}Zo?SFDdn7Jdj?5k$a21XpH4GrYhcky)eu71ld0}Su%-f6dCd|Bh+U!}k z7fqWy>-Kx{rp+9motQUaGXBFDVs>+g-Qyj{$uin@y)M@{MV4>3>{u>^K9uQ4nRzeA z^s6@XtqgQxcwhrbK=4YeY3h0+q$Bj95<;Dd=4E}DmoZj_vA+p1h4$oG2=vp0KplCV z#T&q^7nf~B=#D^}=MlJGso#cx0|}$wk2q8KEMmX#M~K-c%=<9{g?Ux9&ZD64A~0Tw zK>IzCCi7T|N2lcesF>F6S^)D=9{?u{=gxaw9g$R_c%AF29?HKF2z86fPJ$VoU{d^fg%W43#JnHu%Xx^WI zDa=d05rH;bcX7hFy<>zn?4}z!ch(wI6;7<|69P0JPlSg0;QB7fy%GIq>y}$ydPu zNt5?#ux=L60-DU-F7yC)&J9AT}Q8i@n?MQ1!#XBr4mB_ zWX3G_O-oN!{b@^2ju-oX2kUxyAFO@y0a)vE&eDGfrqC~$doPyz7jTlW7n6_r^nqz( ze1R#|68)sJi>vcFSG6w$`Ow?k<|v%Yy{7j~ z(){ybW(`P^+n(3Vw4y-db5fiMlH^?HMcNjhnMv9;J~NZqX`Rhnoi9?Frr8_q;xk*D zowj>}^^uh!CO*^CwmsK!yZ9olcXd9q#_Z+X=%b$}pM@BD<7tXg7H+`*hR?^%b^>PBv-y}^N*0(1&ED@%! zmo&GjUKl^OMJ=Blm3HJ}mm8bg4Y&`B8{<*8Dcrm0=3aSKO_6;|++AXBSay-G)9rvF zy*c~2Z`)RtmzewKQI|}SG&eEJYN{4@ypxM1Zgn1Qzjd=9SW!{6z*$_nc!71BX>t2q zw(19?Z;b_OD@Pbdb;0&K;SnV+kaxH!Y%Dw7A#f|w@y36|Mf;6^)XKWM?e?g9AFXsT zE(S*ma+jF(^N)LQA#$&+^SbJEU)8NZ(x$Sud8xylv@eFa<)NQECrfw_{5Uo~=|jnD^fKKWy|Agju&KXr0De8frvAdF{<2<7 z-*O?u^sTfp2WgM+7_#)qIE!;Fo@8->#nUXFP8OfDES^JVr6BVV)TWp${a->3;2&fm zg4$GATuqjG)>-;xWI54WZt3eSUPjM})T_{t_8}QiRn{qu6Xj{57#j71sWITJ!V`A}7gwb%uK6J&X7^!ut`QBg0R&u-2_F zjvbOQ-m($1kCNr^n4EMy{y}&yOq&2~xOvcq>yDhnia|KMXfq1&ZNjv_!{U3$$eVze ztp4YS4X+_QC^lTDWVLz7vf=R|{jiSYq`~+H`6`0e^C>cHxPHk=9DtB-A*fBO#oNiS zPeDvhV&fpY5NN*#@hie?*AFdz-Qwe9_~95JCuQLu z>4ThfBmO~Hb?Q-V!`jB%M9=z?Rd2>2?CG1V<+84<8|Nf+y_1Xqz_JR-aKdxg<-%jo zmtPYb`rjl>pDze={IroJ?@vU}etTOufcUI1*XhT?Ecb6@$=jRj5f0fW+%~Ac0rAtq zFC%_cnCA!wg!jV!1K}7i@*}99Ze;l3^_D)u0mKYyGeGogJFmG=&o%u zFw5N~He4^Sh@RI^-Vx^YlQU%aq|LvJo@MnwVBL6q<2KHilNpAqIYhu>LxUe{pVD1Wr{7cBc&n$3&^m~5mx&L#ijvqweZ7; zYlZ2@?6ctWW9S~I9)89M>wL9A>_0>NjM$75R-3J2!}b1>*yIYU4d+ePpWDID$S7-) zu-d#SHuUo=u_+K%o8MSAe-xW(h{W*w@?$U8?^_nS+_hSz4lEX?Z#4Z^%$ z$Fz=t^)yPZM^*csv zI9H7qE=N3t4Es9RleMhrV#Djh#lp;6MTY${*prjwSp6%aUk*K4{j8xL?c&_kEX+CW zIWqjz!=9}6JH>|AnfD7HLi}T4j`N?9k$0tV(kKArO|dzHm}RhB&Rw60eF!#WEsHnz zXv6Ez*9dc78cBx#HLxcqapwjZD>j^Cr;5#5=*c=?%@iBXuf<~X1Z>FaXOY+}MO-O1 zEwCZ$zO_MYcny55*ldCgS@+A&h&~KGS@kc7{#oeB>XY+3+so_WY=idCA&a>kQqS$0 zfz0{&uVnPe7WgD5@t{@2)6<0nM4nzQBb(#lL=HhV$CGT(36SL&DU&S6LfK>-V^GE* zc$i5<{rizt|Hh~I&!ArX8$aTI9QESAfGqxJk;Q*8S&s3zy(urVnBz?KYc1yb(CY^5 z7v+~M-f!_yi%(kozQyM){?y_G%meD5^RP0Hag{muD)V?td6LD`$ugejS-jBVI*aQq z=CxPN+hXyv7Vor}bESs|s*uALb3Ro488TNahk0Tw-yx#mg-Yk$bp)p0GG<@pg-MTYS*s;})N`_^ibrS?pk2({lY5r&yd} zakjL?i(j&Mzs21DY2K3-bDmNCd5b@_m~)WY zBwHM?ILqQO7EiKxy2bM>UTATh#q}1ivAD(JXD!}o@m`A$Tl}WQXDmKv@y8a&V1ClJ z_pmtC;!KNkEY7ufn#FT0F0r`U;^h{HEPle`u*KUg-fi(gi;r7;+TyboJHu-qS&X+~ z5ZCdo7{m*eYDz1D!z=KXNKLR}xO?@Sm)SeqV;SDTsN+kDUEOi%Xzx0WzW>tErlU`D zjs8*wUEE;!9Om{-p-Y*Y+YFa7Xun%9ybe#WJHy!t&hYuQwT_#O+Dmt)vFO<9i}$4E zuIp~>!kg8HT`aw52VUH^bMJLwD_vK`whZssyhx{U5RMo=!tSbzSUSV`k`G?qaE6-~ z`hvsF`*v<0qlYnU#S6Q;rmEWAoqVqU0a#&|Xr3ovh8zS;5fM@5^<;9cED7LPh`ZOJ z2+YrAOy4f)IK-4O2=u9<{&JzP{bj))k9+73({se%60lvr3Z%0TRMa2aZ2LP5e=DJ* zKTH7;e>{h_{k6z4L`Kx#6G++qrr~%`+sn&uT*frdrEPy~gZcnQ_y@wdR6^!h{&?7= z{(cX({e@*2A|vYieWb{_MvHSp%O4Mo)L#mm+5VozvJ}a~h;|g-U$^~L!yk`r*?&9~ zQhzr``P++S+YwaMUrv<2-SEfbGy1y{LH*5*^2g&vTQpfLb{rd&i`kXIE&r2f7h+ioq>-2&_xk{ zKZ^3lV@CF=iu&6VzW{>z<24D^PcDHwbFp9?(kfiW@Xe@lc|6BwJX93dN0qw; z7bHK%#KLk1AkdEOcvbvy%u$}j;8tc@%WZ=l=OvXlVK+t-h-pXRwG3sZ{g`}m2_m}e zUtq^NyJRx%Md~cpGQXJISpRNzoFsq@%pXvleX>hdcxu2 zaJX*Q8^<>d*|}kU(uTEbi|a$-wQK8kX09#l<1GJB-sK8;AM@5fzCQ~ue5Idw_qjed zHzzo$@2y>1f>hbyq5WDm#5W{3Qx7)9=sQ`%@REmlaq!*ML-O%{PJBypQwCl&i)h!RrOK%8wOF!|eReikqGo9TlHk%i?+}ac#xvFKvxCAU}{Mm)jj4^rX z;c(ODv18Df(PO-gcR1);|KcXTC4|alx|!DW&A-wKZEoq=l(sK^V`zt`X|pUC!uMQ4 zn^#?Rga5v^0~uDHqkBT@(y%W+>_6nefI*idre$p7FsE>SlH1lH+SUxVwZ)tN-3uqe zt!VD_AK)z>?ZL!lXzsC?)l2uqN0e*&9=Zm3mZo%XGYPz%~J>)@LmeLm&_Km+d)*4%esaoTz3s`E#%?jt{8IO5$a{~9p z?4B{MKVI*Ycl9v17Ukha$dp63auoJl9J?_z0}qqrJNaj(OB}&5%a)U4iGf z$?;h+6W%->H`3V>?_WG+N^7Ds_0ZNhyoV}Y*DQJwCm>Vu`@mp#@2!LOY}*UdMlXBi5;ZU_Wfb?LD?Qam}OiPo2(3 zkK$(cPd@Yi)PFAI3I8p3=cdQQ-^p9m=Q{r{{C^97^D9rKc;jwxTH;r4X#VMi)^1L7 zcrM?69O7iguWo3H59s^0TVuv2mL+=QGMuv8uN#`KFK2Cy8I<^?>>I=QJ5$?pd}6*i zuo#z8^L)kgnckY`kB?pYNX*byw}D%ex6YWVoH0J}LFJsSd0$hWbYJ2N!Ywnl&ho$U z)Ght}{o2CYoIbhEYn$6nUmePO{cE}N{B5TbU;o;zg9gVhf4I1;=b_$C_0HtfpPqYX z9iA}2&6}kSslRY0qz zw|n}W`P2U?5Dv|s9tsrh{v_!uYeU%Z>g$W^>+1@4|8-cLc}Ka!eEZIGeFn3~MP zF@iUK?@LTS@%G-iQ%@aBY=8e6#cbOV>t@Z5!#g{1c(D#o84Q{elZH1cmW8fjl;HPb zFpUc0ee!Vq?7$9;q<3T64oZ=adDBn5^J!uz`QDg0@#DJRo8i83S^a$b)IS9ljczOO zp6J!F>EVs(Cr+&7@2nagtSSAHsck>0Y?Yte;fBI({6w2sv8dACSVHwp`BjW zcKs12cXebXtXYQsNI&sbT#FN)w0~QA=*H%7@A+ZRs+*I7Sdj_2#lsvw!vGeQ_(yc8x@MZlFh~{;fxy^zStv zdH~gJ^ZD_9d4g-O{?X62eP`E^Pj>DsKIZXv^FN)B!@WICs~fR{sXv}mzcTN`!=qQ- z>izI=_J`9v4aY{meXFZcf z7V*tN&xb*oCe|lV17mK(ene18M!Ef44FgwtR{f zLf|GLos{J`1(J|q+1 zm-WzwJoe-cZ|<7`RC9&f9f_XoZ8%05qp0lnLh7t@sH)(vws=g<6jC*(O=&^pP%d{UN@7)rw?-7v|? z_n@Ym%yg>j=b}Dv=(F3iHRf;{W`=~L{SL)CtGDBj#Tk?9Y}*{(5ZDmYFEpqC+sg0y zpC20MiH(g{4W$B?_kE~n0l;1$e z{FrDsLYr zw610I+ED$fYp^5R*m~+z<1B|CWQelEF*5A1UwP`Jsew7p)G7>#!zm<}H_g}>Dj%^S zuW6nC&L|i7`o=qPu@1hOvAHQ2TDRe$CcFT@>YBJizrNrUe$qW_jXz2E0$J1cd8R(& zHo>3RnC(n`CTp60G~?@u{_?nMqE&-&h=+$wEIa?QCSR!6yNS(*KMnsi7l%-5e&2BT zyuVNV#>bcMnZB)O?^omeM=_;$kNeF9J0JY_+2Ava67qj}Av1kyEejtUIkw&1+h5Rx z51-(aVCSxS{Zh*5BfCAJb;siCU#rJX)UA8(#E&p;Ae-?HC%)#92ITWt*$D3<@Hqj- z{Sj_Qz*r4=%L?MR)T}Vui#fJD;BXGZc}3QmU12BUyCK%;H~ZfBwgWks7vlAt5 zAG#i!cGH2-&zoKhZLV)jF3X(P<3*eoWV(KbC2pG1z;Ds~YE@tVmQk+q-ck8|9c@i0 zV^d}*=iJ%U_T%H6?c455#Cg(-O);SZ8*mPaqoo&loP@(=bHaEEJ3+rU{lq)@yq=IA zUXQJ%5#NW1AN>Pw-0=&3oK|jZ%7Jq9lOD54a-Q4aAtr}ywc4AvV%uwM0e zcYH4dZPdE=KVNd!%)9v2(VDUaV@8fNn25;-GHyv_?UL&1s+zjel3N{BE)G_dRn;uE zR8@5gOKX@hFjlRYePOVsWNEObG_bg;WJyJ7pt6%i2P=NklL}YH25eW!Z}Ga!gYq}sE3*)CfX*M-Hb`JpFQz*VZVsm_At!+afcGo z);=&^wBbZIyKDBuSoWX(ft(c`I%qRvq`hWrMx=uT_-oBi-~ce~DqTD1&W%ggrtgoN#Vk?A>-T(O7x;_6 znhLh2^}2qnH}2mrG^AZsHl_cE3EuY-JUCQpNbn(llc#;<#og?b?U~n{aAm}1!-3|6 zD`2(Z#pZC2+;(y%_r7e4Ed*GhTu89}x!D z&YU?dFtMVXx5wSY%+eZsy%LGr7YEBL5Z`S+1ss@(*Ix0xTqrPK(56H(Ow3c`fWeOT z)S3Ou;+V&L1wI_(jqxrm<0%}zB9#4%Y~B|+f1BpOp2yxdK2UZ&vf%L8x59Ml`aL|p zZ8&_P-aYL;{HbdhzOnubWdl2!CjQMng3SCxeclo6^U;qx_ze9e;&XJg&m;fG_IdUr z^?7}?&$0j2!DqpT5uevY`&@nA_POPc>NCDdZ$HFikm@d#wZ0~gUc zn&mx!hk3+?>52HPwDAr%6YrU(sNMp1S5`cNMUzTh?`|5$82^ni&{+8Yj{%JT_~>zE z#z6b{PxwP*T>Ygiz2k71@*nnaS@?n3pmem{Iq4?np2^d1zjM-vQQ6MSg1iy@H*#c- ziEbLj2p@iAbkhjEeQWNG$m5%wt;{_f-Xlpv$fV+b;oD1kzeeL+)&r8^Mv>=UbUE+G zPC2>p|JFPM6+ zXFdi%9)Uoi4VlkPP|tgZ6za*0spmeQ!ZcaS`Vy58>d9*mXrCx6gnBaX`%pgs%th2^ z0H|Zg2YW?d0LEoyqrZ#B5ZaR&)2`6clX=;n`g_HOK7*DGS?j#W(vvwRX#cdOC$lW- zp99l3(_6sm=S9n&tbTrD>B+noO+S3jokBlkTqHGm^US;GV^NT`>$H@%QG4H(y6xxu}5U76?fkHi* zB7`hP*ta*u<#ocfap6sF0lKLe&PeFlMLc@g611VTMI6*2v! zTY570FVypz1@n=y;Mk*{eRUH8eKsQ8Ec_$HYSRYR z^?MAwKx|ka`e5EMR(;6BMPFv=$-0jCJRBD>e+7W`rJqW$u8SwYoMWkPp)rK^D%##` zD43ryg*IgEH$JDJ{&T^UuKaufdfG8&akQC(pmn~_(%%o(d37OJx37o5S{82W80o64 z31Y{XLK`xlX-r4pdhrU+L`><*&-KvLj)g|MxPJpE&6$2 zoqraB`-}doVEh^TM!>bAe-^A`U>8{X_5h6`ESH>%n051@GSrc~fs=*#{vx*}>ZgNy z2p5CZej%8`G+F!eA@CIF(h*(*vuN7v1#4cue?wtfMaMSF;$p_y7PgNzLUNrqB;r{r`YU2=!#vi{TXn3iT@5x0z7ThOzn|E;`nq z+Y6gzQ)olJ8i93dMW9emz7B!<0|*`j>e~c=E+K~Gprj5O? zBu^0iDKP6v`*(%Y!Dqm_pM4)pp^b`;2d0(nd5LAx508&1UFGFEq8(!jZOGi-n0E{U zg?ciN^Qh;%M4_G>K%o8`2s&?k2TY+2S^MX^R6?jHGiKhG5xkP#jacmufGM;i(?9J_ zO3b{c5Gb@!(LQ0FX|FNu?RG`m+kMDo^hq7JTju3>=X^>oLg1>QO)-Lw!#c3)mw?|! zU>&AW386jtCdBl!!qSs`8}}Kjn{B*!E!{-ANUVKd$J#KI>KKq zJ(=?WRaejng!W{{wC@d8|GYk|`_No4_qDXSp9T=-QPDBLv@-V}EQ_)BE%(b5<|S*n zd0^fDR)7a1u&gI7{eH0Oe{boN(NU@&57s)DfYm>bu_;~E`G2dP+Fl;Z>3sVQtIq2$ zQD?U`?td{eiO%1Q9cG(i-42gRa|>t}AJ&%kk-HtUciP1ld2_?n`OKM>y_~t)#TS_Y zT%FIXb$dBSaJ%^Me3&gh^QEJ9jnBzzPk?;R#HjS`QR)1sbU{>la#ULP*sj`#GwT$w z;5O?qPouYI@tLbicKYu21juL3WZG3eN6%(loiB2=QPZ>AjX}Q1QI#&gH){FZsPw$3 z^!-uk;;8iesB}qGx-=^NKvcRsD!nKw&8@jze37eFuFmIFwJ!wuI`ywTy185?AIbGU z{|(@tQT5{yO1t>XjB2O3*K8MGhqvKae;%c@i!bUe51%dn8IVnUYL)*B-?1kUPpuB?63-jNJDEmK3 zI@>J28^6y%Yxn%G7v{TkNykIi3-cYnb3t*_vz$4So&a4hoIyS;Y1**8>m<#YxEJQX z?UH6c_HyPr$D{1umNbvedg1rSK9Mw!ReL$bP9O##LjSi&n#ZQSocYdulIC$uFQ?S0 zmo$$VdSUc#k~H_ny*PilFS(h>{b|aP_%w5!GjZk@W=$-}7@0k)<9CA1OZFG}CUQk- z)Q`&2xcx)P@|(_Gd_q~4m=6(4o=B;-c|;kpy!a0)NAlTUfR6qgb;oZvN3vZ0`_K#I zlhk&b%(o%?Wq;8*Ql0tbb@(m-f7Z9_pPI%O3p)Jl zrnWL#Z@xgF-xG**A-~elK^gg3X!rZowUyNDvG0->vSviaXYj8v|?kfAN#n9Y2z8*0LFx`m2*&|M)cvini$R%hsl*wWSX&DXm;k z+Ql#1cIBXBTg(UFqs!>RZE+6y9{huFj@G=q9-w-jqo}@9J*6yO zBhdDmdd`9ZV(KXzK-wdR+{Taek7;i#t);!f#*eV^BOHL8euK=kSM;X6!t~{t!~gE} zCXXDto3==OOdalWZA=~h$z}f6_HuWmZ1i%7YV^X!kFfD0Z2Cmlv_;soML0nJ!lo^9 z3Srv93lxwn1Wz%^J-_#eJ_l(}(5T&YCwjB)gmY;#-?f=UUf^;8xy0pZ7EdQjUM|(| z)|vLo;kfBTVbgYD({{;g+HU*d#Sn<`BkeVQ$Jr) z(6upoVdG!e_!l<*2uSEq7SfK;S7s2EjE29Hl`1SO&cicUh3Wr(iyshX9lmMtGnUPFE&Y2I|Bj4u zDZCe_K|TBg(bnh1 zhU1Z(#6b%A9)i|quW%dUA6fb%WcUvtCMV6nKge+e&C7dEX2?+der-j_o&y&C`g( z!h9z01&hBg{3_y?g<0-FGRhqztmPgNn~xFmelKk}PRUyC8L{~d;tzz`Cm&k;H(_og z_z7y$c5WYu!mNXtH%0;=0}%K-6Y0oj<`B`}D0=kk(y-d_ zP6}MBymQ5EkIZKgdXZtzz9FkUpW&hn z{@iU4HUZ(J*#Jm3LUMQ4=Tu=n&u8Wt=#N2n6a9dxzm3en0+}Gp^*&RW>uUiS_IyT= z*Qk|yVHuh2GV`|h>@Rw5cbrFP!?8J3nC0F|M!9SYS^L(kYuIyr@$`&&8xb!Su0>oe z%)Y7@rp;F@{Xdi8zXxKnegl1j*nAuDCSm$vnq{>ievXX1T<>Jf`(5f`LwmE{!N;Kc zSL$KUejuy;uSC!FNLIa>pJ5+>j;#8>fa!$Wq7da1(% zv0*vnq`UABG6jJ)YywsE!|_8-lItPG)Wc>W;xb{jYq7<*k&%&O*lZ(mYnrTcl-Wka z2Ai>y3>&tQtTtn*hYjmkAWWYeAN<`ZK9i9pyaUW)l1ICKZV^U=I}@&b8*Ert+OU8A zS(yD`wgvb+1>Plkw*4n$=uaa)CVFlcW^RX`KFz!V=Ki^XV+PFq<`0D*fz7{>Q7*TU z{}kprEX6X~FGk!zhD`u^-V36h{(B=$J=;xAVuK)NUBf0DjLpN?bDi+{4(8>&GJ%Y| znZij$0Ep>N*l=AJBG5jFxKj8r#4E|j%RVM272_XdH3IF!h}V;0!#a@FznMdz=cZxi z5ITo!M_}H=h+iYahGUbgd5=&pb$e56#vvxF4cCX-d|>gPg!%ld*{8sNE_CFi`2a{C zF!Sn+S2Zu!e4a8p)X5aD{i)B5F zc)Rc}#IFfAA~wfVusH&LUG&U*LYU9&{*sJ(a=nq0N&t`##D>oepA+V}#YbX44K`%8 zzhK$>V8^=gIb+@nRlY(v88LtNm3r1^pfH~^9wvMv;%s5sOc9=rn7@(2yv2xXg}E&} zEPMcU`34#7nvT3=UBCP-0WG)HVs7))XTrW80)Km~8ZpOT@)&p9A0>>)-4>uv0Gs&= z_M5=V5NOYBKZy)|55xgs?yJ)+W_h&X_F=X)Ft@XO>fwiZ$y$H*JMD`RoB0P^4rX1c zzZUTlVeXT^OoksUGOT{SDmKN4AGetMf@D?z5{-VzioPB(1O2d`Ysjbr=U%dw)l9vV6}H$% z=8gz*1p=9UOV+$>PjVl3Oq%`&vmIH~qoK1AUq{AHFBh>nuNTJ9kLWS1o#b2a4?<4j zP8GtwVqT8N3}N~<{-I~}jDHNO$zYb9ENpyo@`QBq2^;z}e!wHZ6A?788QY>q*Eq@J zt$l02{hh%A(Q{laC5ztdBfw{{jepzH|Ip&!2>%`NUxim9?u$J1!@TDB4b1OO=Zc>E zs4&kDp0t?HhiYCvYs@-RI4-GYJIuBN=JFeotnm)CXLfDl%+1M#$=a3H1T@Ir0_4Uq}2D8TQ;3$ZG#B>I3ex<6DH;S1*%c z&+$xF`@Pf$+~fIEWY{2Sj&IcF4E0c+Mf_)B2YvE)VfH`I-{SG2{v0AB1DV z6Tm+R*S#lze-N%$PXPZQTxXsD{y}09lCd!|Um}?U4?@;++jwv?Cej0lZxTL<_(6+X zg=zDGrT@OgW*dYb<~8%fZ2)2IH?G%Y=-F1Xo}Y64u@3D2+l9Y__%1T+*&pO24t7W( z0_`gi-*52(GVIxB&wd~$@qit&41s>Wfq1#_cM&&`Vb4A$>-mnEe_+2G zx*yX9{8Pk-gxRnED$IUhJ(6?r4?@;)at$~cgMSp_fff%Z=eqqvPO8B_NOy$fLGEv# zaXwAXbNj^1Ct&)XCpMFP?lA#v*xn^#&$c`#oPzizVU8EGEyF$lPWQO}Q9Wle8RafR ze7ESi-o7OIT$E+bZS&mu{$ZNfnF+&%T#V6!d2|5_|J$C+UI{G-_C zz~)0?+MD0rgUt@;MtWWUW1!C?Lq8aK=ZJnB^kGZS-;1IR>&9p8S%+NMd?0#0Pyc7( zo$#LoJGH+`n04cG^vugKY1SinlCX~R0Z7xP05Ms|t=UJT4#m)M-P1qonM;QKG+{jk z$fq7Qtj{cq7YLUlE)!4?edXQkNCPqW3}5`G48SeR`z+c^BNOtS8SUbJk? z_70ml(2=#QgJQ$7PFVc!WY}|@lGXnAmd#%*Hv0(J7eigw3^a*e`@VS?zg`LH(O^F|q%m=%*oGP0qu+zQ{|~ylbf!dvlH^ zyiN4KK>QwfTW%nSW8=*e2H#~Qa+THIGSfOvrL zB*eFn;b%Ggkkt>DvHs5@-Y7Qpupz4r-}_`CCG;$RlGw1!1;W&u zV?Wrid>-4;5A|#tnRR)^(*IbP_4>7?KPSvOCZTNgbB%BSdUH)%{O5{31Ntivl2PY8 z#O6E#Hkrb@E&^hcjo9qhV9)&(^Du7(;;Cfh%@WqUGsK2@i!Ejz=6w?J!(`;84O#PY zOw)#Xv%eN*9_sfa{x%tTbA&Z7k2y5&OBU}J{ypL&WaJ$qta*=%4a@zd#mqyW$>_iT zA|vlO#AMBD&QoB+yb0`QVdf$88uPVeT8yTyjKPURgSQWh)tKa~Zo3Sc-GgiSF&=;{?qJL1BW7Ujdv?UL0#xQI+4$0a- z0dO*G*tcd3gCk=Y%<(vtHpojGvgS2o7&g=wBd8zdAxFkA@^Tz@8pD#;jA3CjhQa$` zZ^kh4avYMiTr-Bn-i%>k=3%+NM{LG0@^T!KHSck;VV%twmb}cvypb`Cyt&YI8pC35 z#;~v%!{EpmMqZAWPGeZ?%@`IoV;IcqqGk*uZvpal8pC4GYpL4L%tQVL;uDs)cmT$fwOc`k>^m~$vw5IpFA73~K<_0kV1 zWa$TPw;t&S(_ZNZR!jTAv{CwD7WL8(#boIRZfn{PrY&QjfUHE&elYcye%M64^n=i(paeFW`?^JM9VPs!2`+(z^nV{RkL0gJON=DkL>nMCG^ zJ7l`W9RI54_*bs8xZdJ5DO9p zeq&f{%x??}o8K4~-f!6-wb=Z|u-LqB>Ccn7p+n4X3=88E`Uz3t{VhDC3FV_4Yy#;|aXWuI%Y`Hf*-9DH1k~@g|G6Sp1U3`z=0d@kxu{xA;7{hg;UC7AIi-Rz07Y zRSsC3W$_qtFW1i`i>F&W&*Fs^*I8U|@fwR;EPmGFofhx4_^`!qT71Uha~AV=9JT&2 z*ykwsusGG?Op9|Y&b4@&#d9n!vAEje5~yOe&|4lil^3VR5#_<18+)c$US*7FSrj%;J?6ueErS#ak?XiQL<*+kT6WT71&t z_bone@uwCiB)0oZwm4vMmc?T%o@DWKi|1Lq(Be9BAGiMX7O%0m#o}iz-bv<3A!M(` zhb?~7;xpuauKhWSKejjq`$y{O^c)P{BEk0=Raf?q|eAeQR$N|^CgMFH^-{KUDGc3-wc$~!r7SFP{*y0L{msz~h z;?EhVyw~Ex7Qbon8S((v{+z`hTO5OZxZ3ovIMw1zi*qc_wRoDv zb1W{gxZ2|77Kbc;!s4*S+b!O0@j-Hi+s5M-pSJj{#UGIex%T{Uqq5)P6pJ$~&bD}* z#RV46vbfmd3X7Lnywc*e7H_h6i^VTlyx-!Z7N4~EeT&aq{HetWI4075;PaTu0gJON z9%Jz&i>F&W&*Fs^*I8U|@fwR;EPmGFofhx4_%Qi;cb&dT9_;cNi_cm7vBfdCsH*lo zEKapJ)8ZV9b1j}`@f?dwEUvbAIeDmC&ydAWSRA%^yT!XLK4|fAi%(m8*5Z#W=EDJ6 z2fxKB7H3$TO&%uO&hXkt7S{#mJHzpH1UFu&R8v|J99~ggS6UOS7~bJ42jiRnrmngtw_*`9SEUmt*Gh?U(zdzy(pO2rJaton$xcM-L=~4H4 zJJzC0Z@ngWCzGg6_o7CqLKW-Nd5Y+?#d4AvF?@tw=}yIV%5+I~T4V zQRWw2uUutC3l>*9!#nr3Syo<)&q~!|D!usfvL)u{d@i*KbTOHA_Q%=7+WNX0>0QrZ zm+OqKb4j0k{$eiLiIc>%9d!o9g zs#=cjK35cg6>cRtxRh#yw*YaOJtE4y1Vhf1CB?X}htqHOo+e^0V>%zf_QzX<>H`?z zJmFj_Ar+QC+~SD%s|4Hrcnh&Bf90ajMNC;{`NQS%h`)7U+g~oy3@Yk-4HV>DS+ElR zwt#ux6PI2i{@TE{zj~xI5LDFPJ}7K|S!f9Fv(g_f<3;@a7Hs=_7U?Vm74`RPC~SZA z@K+2S{o(RZ#9tzu+5V2pGDJqyAK$OH{hfh7UB9^05b-xG%HNweJcD#wm05m4j`?f{&;WL z_E!Oa#W12jJ}0aGeh)kRMf@#CqO1OUKg!=x_+vZhkC$@QU$VEOzm<{?CPuV=d@jFx>~<~i}IJ6+rEAWTK>%aZ_6K_BiMwriq>x^$|dK@f*b(*hW*FOG+Mu4RQ-7G zzpM2zFUnuS1ozzr`s1Y@_4l|4sq zVyBBQX15mx?ElNz9TI=KU!^~JjK-9w?Kl8EIoD|M?Uae_>n$5PZO5;p{FNZxRll5$ z@^=>gbX<+J{KddA+phKFGYN8A#?(aXcOlAO_9S=z#`TtC`5PSN@AyUhWx$TUa}g-B zEPw1DF5`A(o=HH=I#WJ?Kiu+(2_jK?c^mq}p+dypktl!TaPYuqgH+VtPon%C zo#MWGL4VjaMg09ol)pDI7<1K`*fIIrD1RAuy3Z%lA0M$|xoj`L(_ptZ83!Y^(5ujn zf}e)((B5MB)9oz}%hlfvQT{^kH`91<|Ea$rQU0di)xLk5X!)BW{&XC?1AhU_AM4Ig z8&xjvjq%v}u;V!`~OwnboO8D!g z&cu$%15y4~!e0jTtl#|z>hGf{e=YEL3d>cret(Sew*~%qOiq8r2=^j)OW> zZVb{Y>MsC0a;_|h`KR{%?|kUg-<{%5*V}gZyUSW1M23}7<$j8j6a9@D7NO;SIjY=g zD3{Nzu^pvi$MLdD{ONj|hm(l_^eXCaN0h&v#qI0u0T^pL-W7k^j^*%Irp^#+JGx^~ zlC}Tdhg}5~B3f<&?8v#I?-9he0#I4DV-bRudxQAXa;Nuk-`SCDk#dWo$~_Ca^<9)Z zH>%vd3*bq{{bH-!6;b7W36t{;S}0<=W_VKUw4ZmvF2l0Z_VRflyS;nSc|2cbd#e$& zz2^BLq;;-+6aJK;j+FZ%{9#B(Bqp`vIMt^ASn8*S<6yT_6NuIBhf($Gft8s4{F|&x;-H;vVAa>Ga_y4Gz9Ah_PWX>p8Q=Ita+o$DwJnD&k zcz>iHSQ7&|;PjX?yHcmL$V_8gL{AY1V&X$bFV%#PB5?h0L ztzoHdTUy@kjMm@;f1JCN=X%aQZ|l!xd0}GzegozQC%5{X=5W?i8bwCQ?hP;s;@V0xD)vP{-oD-=EfX-VrMWf>AAMezUTMG zqCJNOI{V`MeckfzOYA*2pt^Tmu{o)q>`I%s*n9oh-kWh=f2w=F&zbT< zYogP8qi4cF&mEiov_smoBi7B^I0)~H3&;K90;<-UHX;8ery*@}VM_dBPd?^#ybnI_ zaKE>Xc~^aN;?TB!_l({f*b&PevVK{kM}E7<`u$kx3rF)B07`d#9_o#rd@pSh zR?e=p39V^U-j$l)ml(0}cf)wu`-AeEhWW;Ou_F4VCpE8nHMZI74EpIG{Js6L{cePI z^cZjBLl=-~lZ?7Jl!J!md$=hAhQ*q(yu-VE*FN8|nCa;~2gPT;_qyjq*hvr9yVXfQ z@%E;%p}EK6?@hILG4l`CNlxiR*{N_{Z(@RX;B+Tffcw@d1CzhyU{F zR?qp5ANODJZtSrbdwHTKF3A1{@6n~&dEuKXC=Mc?S zpjc8_SM!L`+zm~lQ&saou(JHoU|qQwPJ=q$si;~I#C@el@QvajjRlQ=>F(*~aqgat zWl0^f1S@7&me(17GiPCG0)A*ESXX*?&Gee8hs*KP9%fPL;$V42UP(z!DIQvI?^EBk z1ULU{kR#Tqu0o#3;@L4hL^H9fq!b1{os!BKOHiA#a+6`WQ&(PB!6kmDc1evXU^Xsi z&AiKbp#0%dx4E-phB$ZJ<&>jx<-v+t7!P%-YfG1uR8>B*7^ytxfznDm+r(zu&a<47 zDpa;|V%6g6s>)LQa8bABK~0Z;m{o!Yo+nM@pmvW-(B3d1sI1okd_DVVW@Ie}tIz(ez)yJPhMu6YXOWbGfE@tjYHGl;u|=ru}u29)OtT zj+XQ-h_6I?Dq_<=i0Mz$z=*J(&K(mcjtyiksHv*0t*ff47EGJ9~qRhT*kkPU8~Ip%I`(PZ9@ojvpRqPz(+@18b$*6l^pCeOP4p1f%@ z$7d(zO_+@TFov)llzDCxNe3j&aX{f1q0pY?P?$&A)(0#-^Q(=HGpLN{?~V>Ziv6K+ zIylQ%wAYVGwI2wky~eb^UUXz0(o(c-WX;R#jLgfJ^`cEK!ZirY`vnAUH`Mdmg6bav zb4<}@IRb??=EKab!=pkBu+(|ZxFMxf2l5!BCVaGdDhL#%n<2M0tSgG#Cm@0(KS zpUg2vpZ&qSoIlh^9i=`*4{rACK z#ByH(+$i?Hv-D@dsiKeZy4Mit^E$BR4S>1LQJ)3IpYb^ypyPw@fpShuM_2@o5v~N| zRNClQfz>D91Jyp{w<2}@t`km29^NBTKP_Mi+oGc5XDk$4tTFSB6Qi!|siVCvW6ZDz zfqB~yDAbX;{Zs!sg4X{q*em)Yh_#-a=P1mpqV?o<$2^R+?VNkG?d+!|2rTOx2o(Au zYaJd3YaN~dYaP~G+ybU_Rfk0AnTIijHsoRimb(aHx$tihQ)olhI{XJ%>u}D}{|QW? zJz4GlOeKVRvex-yi$4KV{y*~G2EMA|+WS8zfe>)#PD%FaLtwn9AwJoJq zsiORUzu9Y@tQ_#A&vT#W^L#%4`D8NRz4n?lFMIav+57C7O&xVwZ@SHp>8d;VJH5OD z^}0mg>Af4E#6C~vxt$u5uy0FnN2WJQB3kqi*<}Bf(C0}b-Zg0?dP6BM*Y4} z?@myn>$!SG|NGxHjkj-Whv~6p^}7H4@4T{w^tzM3qdKB@Cnyo4l?fu@`8yc(^F^b< z^I&e=c1hg!lDO?#Xw*ugC`bi@`WPY?E|6j|ZdY;&?(G z_3dwb+~!(s>bPAJx6SuV=vv_i;}@E5#qH-hhIDNIgYg|(z6YR=_TGux_CAzBAMX98hIp%dX9GJeq!krrdTk70Iw9Y2SNU@>2( z)K_gWtjE~ix2W%D{rGLes=6hM@IlCr{>CC-hqPZ>l_Z3Gk|C-^x-*K$Q$1uH;#$p-;6ysE4n`xtMKji6h<|WT} zf=`h+-iTgOx1hde(fkD!xG!*bBYnPTXiUV4*L#dix^<0pODbgv!AXFNP zu1~>hkTQ4a_vhG-{2VO6vB%Q+jTz+gD3$dq&-FNj!2cPKc}Dv~_y?B*@6UAT#)7Jo zM>z-Ya6I4r(oN)(L-+^B^UFWnp|8MjAz9*1CrcMH!|2Q;kHkN?+3;#-u3_#|9aj$_ zN<8Oh#^Ib?I%r;J{9~Nhjcxqrd+h2;HwLd|hl?vzbBl<2sV&COQ?7RGkJcKx!H(m|-?I`Zz*g~0Atjv6J4Q@KJevg4; zQOa2+vdWzu94{UY9%jy=&qm1Oo(4tQ;IZc1Vy*#ljmQzWV@G*C_%_PH4k0qNVX5czD#$*Mn#a@gegR4UAS z%xYoYd%ABDKqvN10&oHBtP~xdUp(iT?p(;pYX5X>^IJp{5pulGHT~(xnl~N>)fq>I zPCta?KnVZf(AB!{&3p$T$C;d8z8B$c!#r2h_}~GK9N`U z9)xTk)JYZ&i~+zE!qZMSLe?*JP&CH@xn8jRnpU;wu&*Pl9oL759X<=B9aalj?X03) z%E*30`8&eQ+rN_$mt`fZ{f8)*xI0B>7(%kz?+_i97l+M#vxnpTy9~D&hB>FhYZPtq z8$T>pHaQ*t;K+Ks+;J40>5x;0bxziNx;lgo(`6q@9hQr%`7EIvI^RNgI~h8xb8=uT z{=qfCQ|DfU1ITB1&p=-jK8EnH;lCLEyJ6O28XthckpmYx^x6+>(oQZsbyya%mSqCv z(BZxO=gH7vS;$(JX_Q0fErh&RBj1GZ%Vg-YT;xC={=rqiQ-|p;B}0dGPS(7+Ydv)S z2H9%SVOt_=-kK?g&N~R#lVOMDBWvDVTavVXC^|gOWVQ2C%EeBP=!6iG)y^*|7dtN) z{*7=7LOMSS0>?U1rbwCjQw|xxv+hPN2rZn(oRs>-Kp7$uX>q(tr)cyhsI!28kn z(uLr4EukDT&M$Rphv&B1adE}Y2+GAy9vS@`9j`%ZXF8b|K)BiP$|Z&u8eTzWM+nD$ zK)J>6Cc|3{KT4L9wA1iD!v_q%ZrHUqiF@40lUcVSPcs}coNGAWaG_z>e#8#PhicQc z8Iji;xoamP=NuK)cWp!Dn~mJH2a)eG@;!#1GyJOIw+tUM%<-b8>(+%7`@Hv2d5+-; zh6@bOFw8NT#;q{y)`b-N9Gj^Q?-`UiR#T1|=KFmr?=ZaEuv-^W>>o7p!-n4`v$4}9 z_Hxj$TNhGvMo`Yd1)Q4~BRt8--MWw>ck4n5ml&OehTXc5qO;n_TMTa^W6VJ3)`b*y z>p}{58l8QH-MWyX^SY5AF?`&xTNhIF-MWy%p?=5%u9b9dT}WZhiBNf=VYe=%=(u$u zh26T4!fsti;RX}etqUpgRwLhR*sTjGI&NJ^VYe=%uv-^$ke6qyS@P-DE{S`5`Z4P= zc+VAkpP+u6YM*DAAERiWXnvwv?`j06TzJK^Wu7g%De%4vPPrb0d4TMt>!xv^R2iq3 zBOO-_pERX8PF-dqpFC-N=_#u0WUZ6y>!WmfE9;{)Y)#3eYGk%|2?~+9=eFJh_5Xtt ztwU(G=$hT{gKWVQ;CX#lhf~41q4-ZOa9g;?#)>cYlgt) zZz1fJKt_8UMyS0Gu(j8T?NoSmYLE8}*4{qY%Y%&e2FgCx-z)Ie-ZR)90k2N&9e}{v zI}UpbA)~#3?4v#R>G7K_v}e=JrD1Ve z4!$>I%Ta@|-U#Th9IQv~V>$BT?1iu`k14R%(_?skoV{k)n+`ec4Te{H)5IR{$?5pJ z8tY9RHeLR26+JD-Y;5zlMRl}CcMIg?0&c)Phje+pV7fRov2?!|XYVakB+n6bYHvfF zy%wB+S`H4SsmFTZb2t3O>Ny8Heu-^$YVT)p_71=v$BWD#pI@lG!*TYGVF%ASb!zXm zIC~TDY0x3r@!Ou&qw*@tf`B0^NaU%N&Q&9v>TXAMNqEIPK|i zTZ;qpB?`n5>8FSu0_R@GN&Ae^({wL~f=zexXMFB^QcO1lujyVd_IS?HajjHkZfm+< zfu7uEQ0(Ixsrin)f0_k1E;aID7(>R}iJE+YUxxzvk}_$)B2>0ei1C6>kEKxZpG;)qNdB?k@gwXTbPY+ zlb=G*UG>WA7G6+(!IH9@E)02d7(&i@?ER0;a~PkWH^J@wc<`|vJ$-rBN2q@kgt zp`pHc1zx<*+W+gM24A$ibL%WGLXu8YxbM9WN_v%xGd_rp>fCyL_fr#|NSOJ68hrfy zkkL8tUO0P5G^?}eqHy*(Td!}*3}PCt}=R-gFq_KE*aI6EZq zKjXzePvW2J#UFMkdnl%#^uJTe^LHEl@KMCwdOc#G;Jr$>|II439x02izNy-2_Jq)M z;?>vw#j0=lv(xPE3EFI5^_JDC`BUV_%ynkuL1cPRS71ryb3nbSQh`{_M|2cXoC^HSCdok4?VQ)x?b{ z_ocknF?qW=7|DmCU+sj^Ck8|}H+Wk2?R~ZO@iNSn*I#VI9C&5?q-VD)xB&j&%#Fnh|+kG8_J&m2w zV~-@1WnJ!VEgw8U=TVGJD&GGd((CdClUt4!GbO7oj0!kAHwZ}=k5PVee|Dr0S7WX==)8di5UT@h1n zelPrk@2%O`Z$WjD-&Q1rdqYO@9vb)gKCPHTFq zZ^p-_q^I~}QzxLkHmm2yzK*WQvpB)m{xp_jmzM{8txrWzrr9l#&ZeLA&FPpV{21Q- z)IuW-N6W$oMyy@C^2My!I64=MT%^04OKlt}fc9Ly5(H5T|-k+~)g(%H(o!F;Z@ zzNCMg$nT2mm=#@p!<@C_i!hoBCnH8v|L(4wClXEGiuZn|rYq96VC34Wrn7$WCMS=#I~4M!%7C8nRsT{7p4I16*E5 zSgotFUV1sHAKS*=8zW6!)%ge4r1wvn=quiz9_hNYW5|p^tlj;i`Gy-)di-dt0bXuyss>}`=;vPX>m=Uc*x+nqax{RuP;KxU~*F%Yiz_5{bMC; z9)lCphvMHIT(q`|`+7@{_7im3LxpXOxEUf|o5)i?s;Imr6K6Kl@u&$5IdxFRF|Z>) zw(4oW$q<`S&zZhGYa)ZzY|84$+_K(_bMS^ew?rnd*>uLHw{~XsZ_iBj#G6w3wEGv6 zFqrF(9^Cs>Uz1z))Jsandlp^Q8ABRhKEb^8^R3*831&qY!evFjm$m<;p0`h&dt@x# zv}+1Ob1^$1gb{)h_}u>~)2_Jknz$X9qjjhBQMY(~)c%29A2oO2tf;TOE7i+w`rCIYSQbv*0g+r$Z}n z%v(6hdAm(r%DDtvMC3mLe_fc5@9C(cPG7a=Ejf2Hq&t-kWtxWSP{wj)!H3}KC=0>! z_JnfYR`b@Dd_DXC;duz@PL%;EJmoLK(@{>&fv4P$`lO?rtoHeu+7QU7lWBCw{MC$dzGlQ-jGGVO ztuy5}Q3yvlc??3z?=^C=*5M;YPR1R&)BgpSyJ%-0fHvs=LLnUGWZo`P{-KeRLn1#f z0RTsRGJg@EKBs^%3gu(L^&)Qr(@{>=W3ko9$!uF$@VmfTZ{0?R%-d7y{L0A5yk({6 z*Z8OH?Jr=;nC=mP+I)vXILgU9|eSe165q$*Nxk*0id@ zY%?r-tM@)FPyGe(bWD%T;#0m5p1&56zY4E;SPAC+B;}3p zbc{>Zde{iodj0`e<8BA@*fH*p;1h)T=z@-RPI8Q_?&SF_tnOZy=$^RQZTSIFM4vq0 zg@?G;CAzn&>^6(l>rS4p!lvBo5?#^lwzMu0{p<5h*md^0#6Bxp@!+u;_qs%Md3*** z$BWuv98y-kI(Bg9>jpw@7sPFUDQN#J5n(cn|Mj^2t#RA`5x2cNZu?-|_TS>R z2e6fkV|w;kBe(h9Cmm0M!RQJn#_3-jw_P5$t@B;*05UcULZ3-u+6!jXE?r!U87=iy zeRu0>={j@5#j#7D_uXNaG4Hbnk3NwMR!+uD82mKZHxcf1vs*MupA9#a!!5DRr*GaA zm-!19EUllvw1%^5mdA|UURk$f!R?jvOBZu`O=V?lNA1GW`l=;$i{^_)Y)7mLyd}ab z%p8$Z&)jjD;mjO6nY%p{z?brLgFTZySS?g*AuR@5)VvhWaK{!~T$XAbA?H)vY(7AdLcJ&Z)Vt29BxK1a_lRF*h#$8=W zm+$IIbX;8x_w;Gb&q{)GbtQ3KU5VV)mB?LPjr8g2>N12)F`xzsL*8 zV$;=?$X#7AK{!`eqdlIDz%M+PEOF-7w;En;M#z%?X0p^n3wbR5!QBh5+)5VxP2>yk4=xI?@_uBFj^L8vm4jqfJX|Wg zpLb|*Y4H9`hi(w;=ba85lTi+lMTdhYzGF|vHAQa z>F3}Y#kfB}$eUp5GcOIo8DQQJQ_j5bH&Jp3%zpsP zSIQCHwOyS9MO(BPLdfxU1k9_j-ialA*)&$(px0 zltTx9t_)lwcs!VK$h;wpl5yun9oM!Y=MCO=(RnJ-n=__5zZN-l+&Kt!|?UOJYGDmT9z*xopQsAgqa5xn>P6% zfZd<+#locsCknI8P9Y-_+bTJbg@15Y!!zz&gx8Xx!*)v!uw#egKFZlv$pIN}Fb&3y zBCIAuhg}m{?JuF6_L0w9MTcg|I(Mu^?Hw6(TQ$oUCPc z*K5SR7qUjtnGPMY#*K=62IOR&Pq&3~#O3vY{Xg?O6FOv_Pv@=$(BVVU=R{{VbjYgn zd&;512c~~Cd_?#|g#Qp`pK(l>595+~E+bvGJF=E5m2%kRL)Ei{*~hqR2jo01lPE{r zd5BBaxP_umow=e@0v)o>fhsXNd|!!nDxgEwaxFDFw+pi$`xY7cHP9z(x_l>}d2U0v zL6{G4A0L6 zJ#DhR{ZRNZg#1ng<+%vCtvb7fStq|BBi#tnCF?o$2az{JPS!r*uav_k9~>VO=7ZxC zWY}T1=>;#2%P9?iw+GIK$Kam$AbYn2+f|^fQD5;{b5qf~S0#u*!Ly7?;^?Qty61c{a9{ zOANDqRL4f7hUa=v%0Tw}Q2aD!ovt5v_%@Mgo?4ev6{@wUe0byoRR!*3bp^;C6u z|E0`psPZtwIfnV0fa(+&cJtKGKhW{IsX7&gYYne795KvmqQ;FHcJtK4eut6oHvEj? zgN6?qe%mmAxze?mrzYHB^qUR08s2PpyJ0s^P3*XNYQk=wn((Ve|1HDE3}X%4Se{c24>O!&c!J>q z!!r!eHO%io_|do1)f!%DIAZu-!%@TA40jmbZTK0(2Mr%K{I+5KlB{_P8vfMt`}+I{ z;r*%;`#9z)r_sfJ`T3anc(EUVK0&AVSDH_w=zX)c?}WWmOu*AZeA3K2)%(aPcX1^> zd7fNcF;A^v%lHwwbt<1GyH3&fe{h!<#<3HPCMuLn2ucFwy>UH zy7xV%5Vjeg`#2sclx-PixG}Zbz%Hl9kk5#%y+<)1Wc(03y1AIW8nDe@GqyR_QKz=c zA+Yv3VQ)HQA$XiVF?)<}?QO<3y*jnG1_Em@8Hw_m9fF+08t!9$InJ~8rek9SWa`x3 zb_lG!XYgFL1hNo3yFRt|JlNV>$PMFk^JU1$tSh>Y()%6uaftOvdcTJb?a8p$+4}(7 z>bQ?S75^CO@m+{(GshR|w7dZ*+4AP$c@wYiAt-Was^z^X&R!Hd2CFgA<7RH0y&wkL zYzHCuLGWsCR-C;@v117vk)VfIW^uL-1$9tG%Uh_ISO~mv5lv^ceElJ>wK` z1MWENZ9~O}z-Pg$y?e!;)^ivKpJQ}&*zKd|yf}th&yPayC#r-{%kemrY`R-UdEYAw zL5KCD=^hk&n%2#D_^u2!mlo4|1OH^$POI>fVRF3@to_YVSmxy&14ay%2Qxv#i>qzG;@eG&B;91v4Sn z_l9etXA>;pNZVV{)?Uj%<6{4)4&!gs^J3(xm(GT}c5e=U3!{MX>`gXcRk z{B7wc@N9R_!~ehFOfxwtJ2H$rN$vzM%3QYwZv8(}7?-hs{a?dxz4?2aWDXza^Z5?I zzkK2ZkNy8&9s8J%bC*o^eK%p{(M{L2o)gRnjQ5>c;LC4o8J`*)nAf_hB~&7Fp@IW< z{@}O6Het5G#_-1b@xFh1itnL}LD4OFReR6c9!U-F`5C6wt(i1%=!Ppcyc|rx>BSE- z;Wx#}zF;u;z2G@VqbG9z983`d_O{KYevg!Plpox5*E^9?JHHu8el5Qz@mx;@eo zjn+3bygf9lYU1+^KPxMK|AXjbtBU{agQ5GvQ+=JC^h!$ccu> z?%B>))P~{rpkqx!Ki!E6NIWvxC&%QQ z{iYATBVoXOj|d=pL=-ChRanan4J5^ zM%Y{X!|s4@{jh;UBWpGuU3s)83CDX=O`x!0Z|4=8&KUZTXE8W9I%XAeaPE=%x@DEV zDtua{62E&-?VS!9;uO@y^4*mMODiifQ+y+ra=z#VW)`bAkCl7+OdRE9!_EARpWoUm zU%IU9rpoeqo%q^UzakWJlVqt5JD)h^6f0{lz&C0BwMc#Esd_1K3hcpZ?3!zb7f1bV`8Z|PU-EtZ(_*z`OkkIb?p*nTr+()RJ&y1 zg7O8Z1gK$*a!HqOblYV+9!YrX`Yuekl$MmUVf76 zaqdUk8)g-AhKjwJ@%GNKY8@FLZSQQWn1eZFE`PQ0_R_3c$C*xT>z44y(I_`25Rc5k zjNi=g$n3{ZW{wz}xP z+m}T*bZ(72GGN1wCOM){rwltkHu0-??HJ4rYs=Z;`xyG9_zt^e$!e@s%^SsH+Lcx3UM!~8#B#T7-oaWZM4D&G8ut%~G- zMA|UV*j2@)(_NH z_sB18jd(fI1C;*w`$dIbnfl~o?ctmq*~mxq#EP~k=AADuYpZz{6CO$fx3!g2Htg&g z@kr8(U0!AmbTv-|HQjyqZe)SqPxR#XO?+KD2=orcb6=~u1SXud;-2?M@2GQidua`O zi#~}z{_6A{S4>RkX*iM77A@@DnpM{}y%Y<@?8qujsa?jzW0QMr%CBIavChN3@AiWQ zriHe?yy8+=aK?&Xc;8u)RPS_+;J({mbd}XpexhM~=hplAu{d^*ydYh__~yk+mM_Kv z2Bk}JG0Aa@DlDy8vTR{RXz`NzP)%uVZRO(8=qmZ$yI1<%f_v}&Hzsn-6B)3kANo(< z6ZrVvi+)Ke#Xqw*Yx^^O>8+T^$+ZeNGcqzDdOb?qP?&eu^228r|MLB9X^21bN9LP* zDIb{l#W}|jVdn5oUiLW_YtJeUPXBH~G$(c2xbWyNt^DJ<7aLaYY`G^DvnSW@8PqU7 zwPAc-xXm9v@bxvT60)KgFI<1_NW8jrZb;+bkr4fUznNPH?HUtqt65uDbM_VYowg;r zcZT_@&f2j+X$t=SalxNb|k z=x)vbd-KmDQ;X+*SmgHw2RA}RzJWOD`+EFtOj-GEFsb?R;HLdQ_-*cACT%T(rAHF< z>Vr|o$a`MR8q_n@7Yqak2Cu#K+u5@ceBmdb;TUz-pl803I%Ut#3JU7qsW>yd=f5EA z+%TwNLuhE$(4Y1oz4WX5mu!E#B~stu#Hl}RS@&h%x&+_Q#`LD7KWw=0_bbXKZ4F*| zYtz6R69QRyv*Dp(iH$h-b!~=kCXMZX{LM_f7}MCpSN$G3C#Nxluxh{^4}ItMeO2KE z|3j^HL$eUxku)@GU;a0fFmnB75(4Y>ICD~huA9IM^a ziGfsVbxZT{F%Na_Yrv-yQ@6Hwl@{uJd+)wrK*x+pu;Z(Wqz(%{;eSM~$ip}!XGQWm ze{h%h6Y5GYT$g!aF!_$8vaZyof#XWYO)0&2R%z}xlY)Vj?*$*ewW7nzu~On8&jrq*UmYdkd)^e7d0GFYgfG*8H8LF;U+nfR+WEV$A~sm(j-rF-<$Y?=79Fy zL2onty}wScD6aUR=l3UkxSZA2HN?7^=;NXG%v`a*bzLTl+0Yb%Wr$JsQ|$@jQ>=O6 z(u;xvH>9u2%p09F^vdED=ZCY(nj`Bna|4mqfoon&3TA{NgPPKJW|bTJSTf^oykijw zg{%C*jBx1%vognxN=xYZoNs4$ZF~1jFSWYNahulmT;|)870Kp(&81t$c{|dFjI7J9 zES~dWFar@0y)h4GMs0iM_$QF137%5)_E7p-->i|9J!9Bd!kHH|PY;hA@L>L#xT>bl z{V;fSY#o&1+dl}8ocmx#^1956TJG&!pTDO)tIV@Y^{dA9c56wbV8XavUsQTNpZBUf}JBwguiUKL3XHhI+?j_zCg4IBd2P@ZIS z?dg$p?>IE2_gvy@El(eK+Rn@g?LU_)#H{}deZlj!Pr$kaBYolF6PsIMC(znH#<%{Z z0l{;QZ1A@%5A7WOSxAw8&vrO-eDh7gb6$1(9!d6us6d7Bd#2)EGm{nSiJB+!;^5nv znb+G+u43kvht>_xKbkpy!=QD;FYC_C+u+|neB#dGliG)WHddF-R}D*UM4!<6`B)^L z)37|$li(XS{BoS0<1#NU{?*?i=~GJcY9pbh^s)U>Q+HJr%{;Mke?iuu#&logi)i%) zwdgZLO<%n0&W7dNaddr=vjc_U(sRO@1qY{xGtt?c6G^Un>KK&J?=%hU>F?_p(4ILN z`%#jo`{9n9cc3364fGX{IF2m2IsH&wc?`-)XoVMM;^sFQYp3L_LgrBRH5(I(esiMe z9V~Hx^5gm%>3Y_?5bwxt3B8q>{U94ja*J$r0_tS_@KBdI9Ct=`a_ z(Kt1sE;Bt`nwI28VY#r(@@*@^+4!<)T5<9TBoO;(b$fN?7x7Buke+D?UV7*?uo%bP zO>Ip(>@qd`&MpcixYc9|3x3$p-c>NJG<8a;Jeg>IPkVFNYCMZ1vIb1zO^fnFg)}r~+a-24Z zy7q>~fUhhwHR8v@LJd{Cw8nI2z4V)dLy+fL(T%g7e`QU2Leg*i93vE;wY>YOkTH5= zO7WY^%AU&I-!+2Y=8YLZriLUv>yIq|aXwZInWf)*p7s1ojW7DKqD@=N{kNVeTV;7>f;AY`n zEK1TFxB2#2FC9!D*{^4--z#^tWo?zW#z@RW@q0Dh(Jk@9t<_o?FQYPgHu@!VXCia> z)UnM%Yldm{dIC`b00xFX<4hpPv#s~(4>dvnZcEc!ZA zTbDg9IHaYub6xdCt;^T_*N5vTes;~7`FJE*7Jcrf>ZYXq(YC95OiXX(p&{w+Ko>vo zW%L}d(wg2hY9l)R)X4Jio)3SVlh9K{<7>{G=q$bJS!(ZN$!j-5GCWKD=M-@y)z{W2 zd<%SnGjvZvQNF)B`d0ArxN;QVe%-q4%fs1|);5JpGm3^|l$*RWGs9c%iA{PEDzWKz zP0xCbpm|~sf3L|x^ZXl@yUDt`3tx`c1C5n%(9Z^IS_d^T(eAGNrpzZ2Hb$U;qKSb% ztKLkqv2U35(#t)5*T8E2hMxMSn(Dy`jS2ppT@&;>?%Vc;GtWNoyG>gTWu~@g4*MVp z?PvgcYJ5}v_DQY3D}K1B=dZZ&OD%r->PGgT?b*eVXB#%A7JupLhOMFY>f)+B2}R%V z<)*9|6RMh?fG@xQe(vd283{?(_^MFppY!$n21C_^qBXw8gTCMp+#x*Fn$VL6^f^rW zs&CY>gvRH6>#FChtDejH$+PDtuB#P125at1Xne+()i!TT_R|SmD@WS#wyR`qr7z=^ zV!!`X9N?w-89H6iI8 zEJ+ovo?EmNzaO<#AX@K{NkWI$-BuG^)JNJpCh0OXne2JRHKQAU&&7?pxD-*IiHK&7 z(of&g6|SCwOtn`}4ObU#WlLSNE}>_=505%FU{xzd>MbSg4)>a3*Tx9*dADzWw4txg z!JA++Gc|a1xcZ8%k@o7Moz>G|H3_GKTYai=Fzd0pqXZ{V-s2G_+TLVQ2LWBw5{>&{*kftiky2SfA?Y zNkpBk=p#Zq`%yaj!}t=TKe!2LG+vHlgRY}JGZ=lW;V0<>Q0+yNAUo7H{mty+wLy#k zPl}83jPSLi59kUm+PD@uZ|Gph6)rtX&X^&M!!VKvm$KszmkteQ4yl?xcxUF&Hk@m6 zPrGjj21ZD%HEYv?)^WxEb?(k+YV6wi@VN9L=Z;MYXATW6Xv#wL4GB$ykxN#`Sz9-( z!?Ap9q*tQkSWSB6;qS3ho(&C9M1=Jj2|Z=L>cZ)TI_55!d zM?;Pk+JR_;~BxkLwwxO2-6 zZyy$9>vL&*5zoH5+g73>^trgl*1AgyxcsDLCcS)u2YdkYm$q*%Gn?$VuBNgFM}FVM z!TybBacBB;UvS_$JQd7LU!E~dM$n(_NgymNc^nKikl zPMbCR%AzZ$PM$r@tk=b5yiVHVyQIyB6$S4|xUnBs6dZiIw^~>0X`7yt1-cGS-+_^_ z+<&3txigp$Oe!9ef}32klvdLDIHv7ga_Ly7>v?U!dS1cP^L~ZXM0R~4<*nOWZ{dnw zxD9T(zO!X~gI9(xq{MXI+8xYjx)V>j)udS=e}d^N!WpsQTJdFs4ITC=ThskioeOn zRayIAUb7$}D`(ERM`qVl+I2@mx0WtkP_dx?HawAA8uEV0sqn=sabH|%0x*Z-v$TI8wb$G7Du?jkG= zizQTjR*v;!z2#cD9xIiW-n;;hF)Mu6qA+!_XPxDxi&0znSqTM0Ze6U~LR@&FthD^* zldCIs2$t5D*5T)^1&dt?tCrO-tE;r7u!W{Dyu`YuA3aXb!lkY)WYi~kN%ep@wYu%DJ#V?yvyott;}@>>z6DE;VE@py;ziH z^>JD1Eyt%&{`mZV3Im@a-+uHBbnH9ujM}~X#CJDw3Gi)zPlf*#dNvUoz_#E`GmmkMMT8x)RloWad$Im``QqRhf2`nP+9@TbX%Rw)!8% zEQ{*1Jjx%XZ{;IQTwrXm#}JrJOT#QMJ)PDqSr@4$4lLuQ+&ybeA=nCa4;Dy@qkryfJK&wGk%Af%lJgggf1CNLfCkTtCbz+Z-p zI_&$jev-f%_Y5$jGwvYp6ok~j4y@^No|5X{2&SVxnfHN=&pEPchx3twkkO8tkA#r= zToZxEhI+3V{WriDiaf1fZ#x+SW|?V+bA&Dyz8kDJT~Nifbr+}p9DDO zL7kqz_&M0+hoP32?JEbKcK8mmmVGi+n<4!?J;$MHgN0%X+T9ECK|nMQ+fl#{iduQYO}fPdPy*(Pa=A>%O(){W*9kHnng zK5`~J^K%3ISm8AYnFMtr@EZ4ii6_<|h>}0(!JR0Zbd@Nk->#@My>q;H$uzw+8S?(SHD}X>Bt)Jz(0S zKMba08e}~#$H8o4)ZrWfZ5#TIKK03Gi_QqJwy`l_#-$F|PT+Z%1)mRA`$&y~Fl{icZ-Vu@#_I@=DdqdY%op{Z z18cnSPs^7E5KS; zwP3B2Mlc<1kuwm|=J$-8%)GIjyx!4KpR9HGLn9}%4ypfhBPTNtl>fJplPRNr*2uBx zoc1RnY*B|H9rK`0buuBK4nw;CRUP(Kw8N0@RCe^b#Zc>+<(mti1z!QL?VQ(QJ;zsr z=}u*n*E6Qe5KYMGjFWBJEQOy8Pi}`-od>{$BL5>o&Ci=)?b8N8NZU+zAUGEx?OaS{ zILgTkDQDkB$8GWj2r0iA%w3c(1muZ)6NPY;leLZQG;*@`AuoWri~0uun$Lew2uC@2 zC_<*oIsbH&lhw|}Mouok{w(-qV7-p>E zy+en2xD4_F(Z9{;lXYwv25Y*j!4pKk!|0P$zstzU`J!*fx@47K#ES(S^F!8a%_K0# zc`W-4V9moku-?Od6|8l&60GCTZyR|FSg&yp8Tl5l=6MI0j(H&Kxw+TK$(kR|MW>@a zS?zOTk>-aTqn0tBog^If$(rtDBPZ*1>zZ5%XmvR+@_0c-sq18ckOhmMO;n4c7|>IA`h9M1-8on(OZ8Z;J6$2uX05Yo;U zjGR0|fNM}V~~7aJY2=I66uO?MKQYFY5p2ynDXR{g8Nsz1ZXXMwf;XB+tqU^?0%tDO=f zCv%hOE--Sk>MsFny0u_-kJPU>`q*?%$13c9m?wsG%!9iBX`Rbpm}xQ8I=@O}Om_zS z7vY)b@50kjP96zQc{e<5P`(>p?K}^rqnxbA{UxyK9|UV%9RlkZ`zV->amgC@T`=Qj z!T%GUjymeJe%R)zry=!uZqc1epK^`+X_fqPwcv{p@{u z-M{`V6YX_98z+Bjgm(zNF42u9>~?1F1}M=zedrY>x?a<6SM_c<{pz@Fp2fW`(RY*U z4^_hcQu{&5xP6*A1l-0eg)ztNF|y5Z_+Xr$1#$cJ*&QQMzbtP5^0@80U_7}G%QkzS!RRmUm+k3p`}1yXQJS0JwkNyi zN!(^R2ji*KX{L!XeLhQ4$L(Qp+r#6wz2ADh7}PI}+dnsMyF6}NpEJ<{VV{&`7+n(v}`?yWVG_DkV-7b#X zZiw6dx43PtDWi_|o{rl-7`Oemxa}lf+{H2ed2!q0g@nL6s1#ci*M+rB4moA-X| z82>-xwhzW_zZ>d#`)b+dcxW)L4>!rSv*jzptU}Maw_Wbr(r3E@KPKU;k@L$j zCBNLm+PWoG3l>(+FR!UAzj=P`&F)JuPKn=VDP3C0Z?w4W1&i^Sm)iOzi{~$>y>)^o z;}>G)$29ud!doA))Wm%G;$DgOhS7Y?kH;HJOHYzxZa!Zu;#)WK%S-2%myK|f>5)Y3 zh`bRCme!Sy$cudsMhk^$^>s@t=i}2k_&iK~W!>V^h5X2m{mcwX=suZ)*MMTtMTWWi zn3C^9ju^x(E?56?UncsulSQZcGLhurd*uEtTDqJP$TUPTwT7`z?YvA*BIf0m+*kO@l z?Y`}FQoVXD@8l$6u|0*4$xKXh!BTt$$i3`$avr>{zl-%zU$6Qf|6Udvh1U>q($+33L#yw56xg6_W#mvR3eo5R%)?ADB7FvmQD1CAiv;Ohj4(%*nI{za& z9+%33xNni+s$@Fw#Y@VUnA0%U8hg8V*WOwB^0K~_*vHUE?BdCfzu4Y?{gYxRb!03Q zE>-v%92dwrX}6x!c!uGbhG!e*vlX>JkNgGvgDZhot}t9fmPZN;jl7n8 zE&jprSZdrAWRb5l@&?1J4M)h#EL=0Z|BDXY`x1V6G;uHGa@hUr(v`-iyjRvF$IW)O*IL@;%sA-bbE84SZh*Ugggj=01Ne z|4V!3k0Nl%@P6SSS<0Ad7#REZUO)15N+hl@w^i=gw)q<=5q)|7>(UZ-X??}hNkib5 zM>QGb5>M{Z<&S@GPG8P7r_Uc4;G8}i7u+y-%}>bi2*WvKiOZ_d^F5C&_dXNIe8B=P zA715?$nuD$fGqV;Xyg?6zl48qGvNKD4!v*Ym3cgy@^X*ok}EuBG5nPtmyjhb?$-R& z82Li7q*Y6n{MVBu-4$d>cO_ZUZ6He-SCb{(2$?S|it|@_&<}y16)f%}**tRdGlOt0 z?jnzq5%?E-95n2X?-Eb$j<2vgzQRo2FB~GX&~PK*{kJ%DPn`Xdmec2tNpK-}e;rBm zZ}K|Q$F&C@G`M;2DlZ}5hJSDs@XD?|NL*I8+Go}H#SXLOza9VJC{mj%4L6X#ihppc z;Z?`A2eIEwIU~Wfz^l%^WImvRYlT<&CbH;9$x=U?4R0ay;XB+mc>mWOx^IK1okuB` zJaib|Ww?{vfPZki;Z=VR`A$l`ZzcM}9zTOXb)GYP!0txB#VX_?4 zx5#p=kB}wq+lG%B{o~|S_($i*pV;X~mNx8m4R;#upZ}vc$J6PDz%QIkj(GAQxzXcP za+AktCt&c{IY1;md^i{O|L^j62Qnb;2bG`3nN=oQ@F1aNluZ zx$hU=g76IC2N9lSn03PMzR><>jC_<~SFVd7fFlQ{J9On|T-v-Go;(|2q2U>1#N{z0 zYg`UZsLylG)epD^%=%KB?Ec6r5%N@5d4pj#1=>$WNDiR>>AnT8`u7=*3ZuGwEE2!n z$Y#moL1tRDhLgzS@DGk0xYD6}?|}L|&a6A~1cal=&}Vtc0U38)N;z~25K=@P=9#QE z-7$quJ!I~ff+vCt;Q1}3YY;jea2=Rspq%Y-FqsV&j;!@C1WX<3yW=Z7+Q?l!h@5Sj zc9?&1;A;GXW3g$c7$NgPE<`w2nD*xzt{}q>%ShJz;BflVP*FU0*_P6f*@gtK?kMMZ z%rwYp2p<$?dwxflZT1@UC)5dn*9ngRKP{XC<~Lxd!*iAsQkfRt-~X=2fxdQOpzi_U zJn-|vi0gD~GAr5<(Irq&ys2ZY~1NImKlK<8DX!+n$& zLOu`~B(n}j3Qq^~-BHSUKFtuG2`&?!4dy$a8u#CY8TUb9#^pClsKdCN<3Q%|bnOb| z9S7#|pnRTi;0pja9uGZs=L@rLKTC#w2|}{!Po*3-d91%^xPlCQhV-hx(CD~xU*g^+ z`ZWm20X9asd*Ic6o8d>vuupqrwZF^g>^1x{8Tz#d$$@L}5AHR1wf{H6yslBd9x}4p z4^l399%A@>(O&_5vf3YSbS4{KBKj+#PgeW<4NvWV!!X~&WPTc;PgZ@dZ?5`#48JV; ztD#R;{nw1n-wX%jyof-b9AM*tJCkxLZ>Hf(M86q2=Yfg)lS3v zg=yy{GU7%Nm#lFQ8T})M6A_1bWB)NwnDd{~$*{8-cF1byJkenuat&W0`dgq+4qOL- z`-13j4i@LEGA+)R;`{KlzYRKMwZBkwX#W=B;0ng4$m zefDkb!kkmJlZ?2JLZ7VZ@|{>cMo$R;9AT%Czd%OZ4#Xt~clxbKP%-_!qr=sW{CS?&KwbZGzQ zhMy6>8{u!su>Tz5k~QudqQkgv3LioEXCrsx%!`>D?^>Rg=8X&7*b;K6x;K3&|0w`(aA@M-A;cBLUuQdn~IQ4pUl3Lk6mb=af=H|}ubB4IZs5gtpOOYjfwbojIk@4D>n1;9Cwg(!y(%S+brts4i5KJ^%v zW4Uo;=(8Tks-I7}=uZ+p3nBH=&hf^W*}{1UbA@RGLouhrx~MKHRaufRWKBPzQVk`u-Z>B?zO!M-lEMGvjbSfu}y@KNFsYxW6^>*M}Qw8gXzBV>AH z*3VOh-8cmD=OFuUBX?sG$PYpGrpRgYA4cbxFz5EYZ{#UbpPUPLHW~TkIYJJwLf}S; z9H)un00;7LZl0jzbE4>EKu!*nP{X@NNJHb|ypz?~CbR9V6>dTJk}!4LxClC&cjEGc zo85lce;KwJ_W<}tGUPm_Zkz*V-9BODZ;1Xg=%Z5L8JC-@5FQeK58)pS^E{-@5JIxrJVrU}Q2J*Vf&?z|M5oAqTz$fOGdR(5KF|qR;uY?pcJ$zd||U^1LAjN?lZ6 zmB?pelN>1Xo9@uzSgu2K=3y5(z>^Y= z{UgiBdA&~xGymMCJPmyt`${tB9P_((WX|jDC;eUt?2xrSQz)0XXA5T{9BSCz<3Ohf z$B6r=KNjIcGU|s#AZt4;5FPf(vxM0ve_8ZvpikC3l!^}Tdu|e)h0r1E@v0RazQegf z_!|hr!rw%A9~t?nMO?DBXLs*|Jo8!3_eG~3I%GYjkBWQ+a2ziS&wN7<*>tf$?0V1M4&?sd>H^YOmtX>ye3hf z&$Jc`HzI5m=GAUMNaGsAxMLqHpqd+ z_y;!{p7Nlu%H1^)@>IylfhG6{=dO>CrwOaP5Zknqfsm~7FNmB~K~}jNm!d2ckbQ|d z!e1f7P6#16z(xqi;!!?AIB*N4a*u-WNcLFk@+A#O_o>csEa;WH}EHKrZLb>l|p@On~XblkNA^55YA{6OTi z&+7s6L-|o*+GoF`@^OY+$&!|Pu8X*wulBgndDXD%b3}hsqG$7Bgf(Q5yFLMS?u5*p zzu;-ek9#fw=2-4+>|=h&=fW#rEL;G6cV7=3&NckH$Z5yjn?ug|i2o^a@;kzuCwc)+ zB-$j;G0bU+35U-Fz3lVW#n%NbN=FSBfl8&X>&5d&j~Z#8w~TEXX^YK z;eQCzPM0wA@S-q}9p8DT{-1H<#(Ac!TNKYXfDAe3Zt}M>GWU-W?nHQ%;Zic<@_bn= z@_K}vLrOW_&qdC(ju?3o@}W9sl93kkc9AgaaFXFE!qj2eG|zL4e2FmIYQ)I*8u=d$ z9~CY`$oZJG$v)(m(ec9;qUp_ zNqkS3_X-b^p+5s^WUbr1BIh-V9N z`XAh;%?^ZoK1Jql8ry`qRtL8!=NM|IFxUKG9LhPK`l&G2z~~W<-KRi@Yl?8LF!f(R z_?$4;(%?4buONI$cmm4%7c%Ot6?H|{I)7Vq{)zCoa02X~5at-;bZj&3Cd4J{@#Q;5 zOluOtbA&&GaF{U1V57*08%12Q_SLzf!!=hX2-D8zg{L8$qKrITONO1zutQcm*Ne_P zg!6?f5ta$F%`6gLim+CgV~0jEY;J)~a^PzKxJ@G8CLH*>6Z_gFF6ZxkUzqjtGtu7; zHL}+2lcK}5TYfA22Es$ajQchjd3Y3Y$r|@P(ea@U2f(wQPeYg@%yMOr5w`ePNdUr)1<|58{#ochWkZt%-b}a3Ji&ZtPAwjQe}hc?P@4n(kjHht4sC zeD|Ns^sae9(cwBD-xq!kVFwxduS1`#dHYY%*@N%}VV3tL zVUBIN&3bqZ;j6-27v~Scya#zxnD;f@ratTZ@4~$I`KK_~s!4>W4%@>ZVd`HXO#MrQ zIX36LCG~mzx?1>)2(J<5Z|vMwo%zD`2&>2_`(f5ISjP!p6Zu<^lXaZdNIBBtS~V@g zyAZA?!_E=tll6Fg*XZ1Dc&p(@gt@lO56Q6eHtdkq&SOTWOLUGwhpc&iLFC6FCkIvm z;C@Rv^2~K{UK1T3#(rdt`&ZH7dy^-Gx&95G9WXBM?}iC;J)3M{-c#g~k!L>tAnS7# zKAKM}U=F#JiVn}6p9w#W zaKDkiAWS=dHGG=zQG{n1&Jf09L+>69c_8Odj=Z7D9OL8U&Rs$|beIQJjnfGV2O0rz z*TOSys&Jr*Qaq1^r#wwKu$EGJmIa&N1+Rjq4)aA;o8J=oFofg)UkZb}7oPcHzk0v$ z^9XrOqWlm-cfSUkAz_W{?!}-(eU?Y{e=9r#A^Q%>S)Zqq$G{`xvGJdee{d|nGWRJn zugW6~=Ng`1c#`2l!_0@;nQeHU;R?eG4c8l9X?V5aX2bUy-eef)^IydOUYqcb^O(oj zKi*>=Gd~Li7lQX+O!C@~pA82t58i*NLwB$1&-b{1ayC4;>G1xE4!yZ2@(g({<*X#Q z5_rEnE3P5);Q?GNyq^sdZUwx*faHzu{c>)yDf{JoY$2m!M_&OP5Cb}c=%Et{S`+MbSWL%f%LWXk<=Nm3GJk#(z!+h4DHtWd)J^KxY zn+>-b-fVcg;a!IJ80K?kwg0N&w+tU6%kPi<5_*}>2vk1IaE{>#h6@bycSMal*Kmd5 zTEi>J?4;o$hVM1Z`+wEhW|;T&D&KAR8N>W7PjwC(e%r7w5jwoM!37Ox7#?9b&+sI} z(+$ryTw-`3d9arje~(jMZMelS-vv~iEr$8rUge#J_ZdE5_;tfa4D-D~wUgYhm-(Kb z%6WgToNGAWaG~LuhUXcsFD{nTu-S95MeBWF3dC%)l^XmCk!*3Zr zX1E{v2GvhB%zIUp=NRTasmcosbL|&@x|i-;!xe^kkEuE<$?Rz1B8KlZ95uYnaEIaD zhMysyRGmi+cN*Sj_<-Tp4IeRl+;B4bd$rHsZj?iYa}DPkE;KyT@I1pchWQ(h+HWx2 zY`E3%X2aXb!@PRlWtjJMD(8KmGVkM*-!gp6aKGeUom9ia4Cff;Gb6Rh`!(emhUXft zFkEYRrD6Wwq;~E#95uYnaEIaDhMzHf(C}fyZyV->5KT8|IKwdSkyIzoFrN>qoWDIO z^FCIY_vgwB4X-e~+Hi~EO@_A^e$;TM;eCb=7=GRG5yQs~C#Ur0GtF?waIWEe!-a-t z8lGpk#&Esi2E)yU|G( zBq3l(17t`XDUY@xrFg^8DMM)rl+KH3S|gQKk?Er-9Y`&u6lTz|mT{y-%WE0O&QNPx z#_IEZ-#%;IyY9&iiG8o{&-!KG{q42a{`Q}<&p!WGwj11S@Z$zQZSYZppEvl7!LJ#7 z!QgD12kAD-GkB!IWd=_&IBxJ9gBKcHXK<6j>kLj9yv^WFgC8?^zroKKeA3{T3_fS@ z8wT@2E_AiOoD-EtPxZ2=GgVz|m!Qd?h z?=rZ@;C%)kGWfW`rwl%8@OgvZGB_tMH4X&^#|$28@Dzh*7(CbDMF!U!++uL6!J7@< zZg983j~o27!AA{#-rzF^zh>|SgR?J7^*ztvkp`C;Jjvj=!E+2=XmFjuO$M(sIAQQM zgF6j=%;5b7KV$GogI_ZEoWXAx%nz25^WWe?gG&uAH@L#!N`tEmt~R*Q;57zsFnEi> zyA19zc%Q+C3_fn~DTB`%eBR)<49>YcH4X&^#|$28@Dzh*7(CbDMF!U!++uL6!J7@< zZg983j~o27!AA{#-rzF^zh>|SgR^n1taBjG;E@KG89d40xWRJ_UTAQg!A%CQGdN-J zHiJ72e$3$g20vr)N#fD|vHm54&l&s%@wL7U9}Fmt8eB+xoo`cWaJj)1#Mk>al?GQC zTy1cp!D|fOVDJ`$cNyGc@IHeN8GPK}QwEPlp95HC@Bo@#BI#pLnr(b#_V0r>ouZ!+7-%drdGH(*G5nn-{p1c*iSzC` z0IPH7Ie<;d17p(3?x0JESI0ryTOW^uEi}+Lxb}PFTj)t~d|gdTjW@owxmik4>+ekI zI}99m(iy1VhLn+Uk{rxR`kD3pB?q$u`)Z0Zz24N0nz9J&rK{M7@qK0<_fM`G6UI-l z&CX~CgML`d9y}N_V}8*}ldF)p9+vtCQKsJ&!i`Vg-lbdun=R1CEaTeX56K_1Dr6X{ zKZfR_!{HD0AWRmgIR?JiD9G09yQcIrwkwxo4|0c^%m!vP$!yT?QZkTv+B!0jao_-th6FHbztLsrfZqLm8-K@x|$u(N?gtkXy;td z4rry`tH&={wPMB6m6#wrq&L@$H|GmjVsYLgqk{yNye2u{8AKF=4Ia;Wcs$``5`J;3 zDk*q$<>V^-631Q2^Q!MmeKW=K%wst|TDN?0(IaxAe0+Rw`8F6nJSt4`)c{+*IY?(} z-=Y9tkKw~3s3hO|0N+BS`TSl*+qVu1+rH!A<8$Li=R|C$BKNoHJ;=<32gcJygyTae-z-`0=`n{$cJ05Nj~?k0n)mC`Obj03F;&ci#|>z zWFPogFZnJ(U>TaO{ z0AIm8&ufK_e7MDs67_t>_5&lo;F!et)Y zyCA^FcQnRAucG~(7vMVyz6~&9e|4=O-`W6Q1=5_8D$2)iHHhPqQFRaAIfIUTqY#)! zKKEV*Vx7-3uvjPu)JgnEfUj^tYJ2eUg7UfdHVhx%t;odplK@|-;VU+L^h;&8$DDrn z`2Gj$i6c;hvl1#bg3)h|7crp3h-5ck7LKcTNKL2?>#JE3({7YN2wM& z&F;@`84S384P@6Oe7fDpSK?~&f3zPThn_etc|B%ac$+}`@x=h&cBJKXFIQ6e_>PO^ z+Xuc%Sa4j%8otK^e9t3Y@0k1_<>NQ$mhUa_t$_*oc>95QQ3QU+V#m1x8IM7)qI|~! zd@UbFyHJpPSC4~ai(~SCly3+C zaa{5$KjQn*A|KBcm={GT0U#gipzwW=pHLw}$S_CjbRO)(!Ia;8s3@dQFygpm6x@sV z^I^++_1uB=x_5mLYrT7*oFHWwX}vo@My&Oof!!yKoz}Z8Q144Mo_7d#te5kPcC44* z-&nqC93&@0ucCZ>Z-_W98M|sz$7!A`F^_!Qp5)6ypmcx_kByVUJj!pyPW#abJI-en z@=?wM5XYH-974St5VIeAwUK$OcMP_Z?Z-Lral5L}jxri{mT$%qpNo9c5R`9TfRE4h z`2WRJl#lN(S-!`?$9Mh6cPoPO>Hjv??Yk5w56VGKQZu;sk`U{-@c9?NO;SzxH1^EfWqAR@2w@!oR`X%*#rC&2f{iq!Vyc2U0T0({lrD^@bGW3mKx zwta;wQ|BeK#g6U!aDZ<^KYaYA#`2XLzBz_(V}P#*eEG;%(f+Ov@KqYVyI`#SeI&s5 zH25|snbZI3F$SBkaC&X<$@@VyUq=39{=I+s@DxsJ8-k{|UW{j>}g9^-e*(d|#O3{80q0_n83S zl$h_sB*^#o0lsr>{(eZl`wZW|3ZM4lF7VN3n2Pq}ZL!0W;-tLPKMty$_Ji-H5yvIt z4b*!cnDtg8Xg@|_jUc!3odRDT(kjY#YryVYKXxAv*j?zy?r#EiIioYzdqC`X&Oj-I zonoeST)qc8bU7)Nu$z)h`F2eHSok!n6?WS-ftY+0z5~a;$C-ef{fz%j2gk1-fq7Ac zR|0&6*Lq&-2xN#T-{}C~(G9*G`5F+E&u$A+Z0Erg>j9QucRZvWw-1*HGd;ZRGx05} z833)9*O1n(^2?t0Z)l5(+WEJSnpclsGJaKU!~0|9v6T4O|D8N(lFOKI(}W2V9jea# z^vpT4LLp`17=A1{j;yC_5`NGKM*ON{tapP$ynehMfuAbOMYtc~(+FQe_*2Tx7vFiO z^{4N=^QWxikKrysp;-u=6Bm=w&9~ljcMSJoo0qRziES`7HoDHs9o;PdY%9j62Gly; z^7~gVt&2U-jGKX~8$E8qq-GY1;lCL+=h~w9_kdcQYW`=g@iG2SK)0z~UDV@&11M|m zPpVyQZ1d!Yy>m+s!&g9fPuA(|lA7#^HAB{W-kBV4|GbW4-s78UBZ=15>ekkl&55qg z)~**{ID$PZF%3mJpE`6pdw0)w=5^I%CyVTS+Z0)_|EF?z~_P_y0aI?e)>uyfV7@xzQz#xX}`CpVzVTw_8$8UaiU+Y|B|wBXp~`{(T$RyOTB>!pS34}0F*xxWgX&fb%iZ1ju&VcT-y z-(BB!_q2^JV&6V|E&?=cP31=3xA8y_f1XD{3?x~(A2DVp{Kz zs@(~nCQ0(|apY)8zbhS^e&&~3=a(y+7yIg= zak-<;b1qHu_GI;TZi({4WptZL=$_u%)m!Onx=OB5kf-3iKIkdg+^|32$9p@s=&+AE zKW1a)#@}BO8h)ua`DHJf6MgTVoc5abzi3}y{^)1o?VqWw$!pydTd@C@*!C|h_{c4> zE*bNK+0mlgf9>`fKnh{J(mMm$(1A^^rqgDhh8r1%I-4S6qSu2Ztr?@5~)h6iQZ&G7WV@ zU&3yJDtdbhH$9lR`{1zFhYqz*PnOtK)b_2veQ0O)?X^cjUhRuN-8^FGcfCaI<_mkW z&|1G0wJ*H5@t7AaY_CncTyaVJ*7Q18d|lFiF}>Yguw*7rrO$?CeANs&*Vr*tG1(Zm;s?DZidNX=6Typ1m$V816beseMBG zwDx&^D>oM%De@|xO&pG{*fgW}aNfae7--he0xw#>|Jn8liD}=Nx9Q6}o{jGKQsJ=M zpPf~Q=6MgpZ)fLl-*&;K|4}hY`L+10Y%f)*C}-Ec_%E~W@z$WmO%HCoL)tZ#{hQPt zYQL<#xc%YwzY*gx8w+s!e>U+18n^6@!v}|&wjH?yZQFiXdnoa2@8Poc;)6qXCdl!u zlx=7`R=c?nO^Dvvdw8rZ$|fAS!Mgz7P4E1EMApz7y}gG^_k>=rxy*nv|I@A~cQ z#h0CXwyQYrL@2g5c4ml&G&fD+;RUDi{`1)*BfaI%E;yZ!(c4;5l=z#6hGz|(?X~WR zZLKZ3_UP4HJ44=%%f3{2?Xt?Ly}fg*zm3@`!#Wh_1HHWqO^e_GrMI`r+N{XkHFYBn z)~M{%#dDQds2sZ)&%-5Z9A)NRGh(;Syu0f5S-0Oht!ifM?wRxE&%CF~<$3OR`pnyIziR*+vfMTE z!vk3POc%AAyxxoEMhm}^TfY4>@t)6g?udOdYrzk5V(nj8P@gmVGm%7Fj<+j^tCo)G zxZGKI(18Pn-?78+$AU}B!y`WuioWNSPOto*Fj4Z%8uB0Ga_`^yUf)b?PGcXI;^T6U zzjAcm-r{T=9(AOWnfK>^c2)?!VfM}~xeOzVwR}$&$My7(>R%+Sk#XCtw@!_fEm^&) zxw&Q4s>X45-41w1| zABE@SidkMUITTwPa%Iv(?PW_vV}W^1#+c{&JU6@vf#tBfx@+7kk)Zxg#A>qunCJVn z`3Ued#I)H7Og`#&0jvGjfGN}y^IjnBeg@1e>dyeE{l8KPp`KXnuVEnw^~8L(K~)?- zLlBoB%mn5*5YrDXh4w1icix|2He*UA8;%8S81uOxIpYY_5l=^;WGcHBdfG9j(1sYd z2wmBS5NqEPz-6L;+~~27B=!FcOd$_3W47UC1Par{yxyVycL)^fiE%5!>90VgTJHz| zoNhV&`+?bB+D`z+Efc5z5HS9nel7qmWu5*3Dj~Ed)@}DGqbKGzVtc-9^u&D5Mg6yp zo|xyM)c+7zw<-NJ>wJ3_xKwO@3rt}fh`C>|Ed6v+s3+F8jWBxRV&s<~d;pkKw4VZ8 zB>KC7Dby3=vfJ6OF?wRHcZ<;z^Rl`G;W)7NwQ*7ox`R+;Ge%!xuy;_-;t&LhCu&ZEHGKdFBaSljd8fhjCYtaJWN zqbFuQ%VuFgP|j>%oe!6Ap@7hiSoQRIruKzKUu^7&nI!*cqes$-t}~n)x_$YaM#pUm@N5Lu)rO#BvJDuw>Ye_ph}FIunCBg|{{{jjQ@s~!n_tT3RGjVo zI_-W&*wwDN+(+|L381j+O-dC`uC~4|?Dlq>&n=mfu=AE|(_F1m62_hyl_a-8mfLe} zK2AD}gx#u^QiR>AXw${11W?$GXi61^#!A@j2`Nq3jk-;9Mx`X|X0T23XpoYy^FC_R zrKto^*sZ=PRoJ^Od7qNUx_pf1tW>t!8XpRz>jLRd1=3ps>2C$n-w&kE1=87^gd&^` zF-ddI=3`Ht9LT3%P|9?Kd~EM~0{Ke<>83!M=Nu}m@9zR>9y?T+|I0x7cY*ZVfpk8` zRfXmGzdcl#z9o=e7)UP;r1`Ff3d_?^z6#Ud45Uv6(*GVvhs~5^`H_M21W9vW&&S(F ze5ZoKbs-<~e@VdJzNFQM+oSKz&=^0IpH7(0ltzNNMERtkP$c-(%bj6aUPb9Uj3T}Xwn)~}I zv0;-+*V8_m3O)6w3WmMufm*(5&Kg!UCCepisKvEfQoCw-o!jn?74Ktb*c_~@pRK{H zi*IMw(B{ScY-#55RearE$-c=H&6ts{B>iM1)lExR$n246L&fT)HFb+?A6T}` zPHyPaCQEXDCF}BE#paMLspWFug?Lg2!C^FsdCs7E9%mJET~Lf$RY}Y>M)f@MDvlA$ zp_oTB#bw02K!ETXRQ2V=ya0jld5(V5&hwy93_lQ_TZgdxP~r$$c80-~#3lHF%t26_ zxy08{>%Uj2`h`e`*g(i41l2Pg;>npvhz*ChvAW*JZmh=m*p1ZIKgsCK+Tdg6gXbc4I5{Zfpft(}ow=kU9h{TTeWhTK`#< z`ekcEI>g38S`gG{*&5=h)cU@eLx1MuRz%wV4aDpmB!Qs%%?2|sB=>C`mQ%EB>ILT* z?6#fg^Qh;8Mo0mI`avrsj^hX7wq4voFNR3%ONpoXdj4t~xLfi&Zwfb6!BGDm2Zw-q zwyRw*+f^9y^=ucS=fcBxd1=G@EVQEy+y0X1c|YYBf_cw{cC=xi zVn}Oym`6SP$MVE6!TP^dTpsEg3q5xgmgOeCjTrVE17fx3xhrjGf1km4&BfW5AtsK< z8uFLMW`n_e)=Pf!5G((GH8y(;{sA%U%MlYtWG(tfV{_Wz-w?xo5@O;AZ?-^qu|z$$ z6>%hnAIK0hws|t1oR-9qVrSxABlLfrW#__%SbdWIv)HixKNlRw{Cb@j_EoSa*1G5;PutJ)cj7SYJ~SI_Rz#3$SCxk>vi# z|JzC-j+8m*u9B(GMv@c}Ii~PF6!o+vj&P@e@X$qlRB%L&HH=snms1`#XoK!J9AV=j zTq3FGK1v)JhaX4_0>7tc8y+M^CwPxzgWy+j-rr+v-2NgqFNn>{h<_@W_iNmKAvXEk zF2G9>^BrAc+RQO{1+lbYwdmP~|00<81nF;)WrtzxpEUSKf~&#FdxYfSxVbqa_PN|% zz`Td${#P_G?|JdvN$NKtcKZ3ko|e7b;HwSh{aM<) ziE_mTUq_7gaPARDK3DjmV6FrIB$)TO-Tz8~{aNT<7CrBAzbZHi``-xW^Ml_B<}-sV1h%IUZ6J>D zW;CQg^i6^zoP>~TMc*PgaUWSYRuT(m74cB~K&lZG zHyXUg;0*?EF?g53JqGVH_>jTJ4L)V?S%c3T{FcEy#%VhX42~Jh^FXzkV(<)uc|22p z+=~pZH@JnE8xYcJ@MeQ~-l#U+20uksrGS$=NQcA3TjhlaFfC74CZl1?Y9}+Y4BqP?>G1vgHIalzW0=|I%o8680=vk z(|UP~QCw(nslnw2R~TGraFxMa=asY3;57zsFnEi>yA19zc%Q+C3_fl!*Kn=(tik6E ze#_vT?3BIp(=Fo`Gy1UxPce9g!Ol;&ly!c(1-oze1Uo<7f?G}5%?58bxZ7aor(4Q8 zKiz_l8XM=QTl8m){xyRy80`FXi@o#HE!g?#7VP|V3wD0G1;=s2OUIetxhZyjy2Zx% z=@#t#bPINVx&=Ew-GZH;Zo!>~^D%>+pKdPL5cfTtVCSb>u=CT+g9*g>=@#t#bPMK- z4a20vpxw+A9MI{C*hyP5 zczAIJ$pOu5Afwq&J5v47aU4vm`j)zA8!2~UG?Bs-zIF*okoaAeNha=50O#c$W^6?z73_2C%egz8Kz83KD z+?VZ(NFMp3C~x^1kx&j~C-E@R$Ek$8X4=QcI@-R90ACZyjcAhhWQe&fDgD`1!icA= z1KII@JNe{RkmK7yViD#sJScWL|Drf2)AwI#s(t5uRXctc&|jVlar}6hqy2T~%SbEV zLS)G03$!V|F9i5HWBxoPA1{xTkIw+`m*i_i#&o1rXh-351L8Onko__LzBBo*L{PpT z3!je5H<2NScv$&$u|D1tvi0tVoxZO}JMvL-U`HHh0#aR!>tIZH){9*rS#L#v?+i9# zru~xdlv=)Q5Ydi&81f|FeZr^x;Q!?2+M&X>Gr044#JW8;4^O?@M_cX3X9D$(M1?UB zu-^BH9rq93TOzOW@&5#5>c`gtd=+C-{U|nkKM}ri=qUXE0*aYtT?}Vn$8|)d6?RiJ zftWUw*M-kdVIK5j_p3nrs?feF6k>lzBXC^U-**Ch=fTJSZK9&}z8T=_0UzzicO8QA z(H^ErsmHy8a%93h>BA=vcsPRY<22rmo#Gjz(0Y06!Kl611k6dJP&>ZL@!)FsT9uDz z%VR0=vHz>z(B63SH59JJ$K5F7qa@_dXf^ zO8EL|(eSLRyu|QpE64p};gCq;2$K#opA!y4?>Q z$QpW|_t7asFZJ$dU$^K3PiM{gh}ToN?hoI%@$m!YA9yNj<9u)G?kSb){_yyd<&Qj- zb!48GsNa3#g37no^?U%I2;Jp<^v3OvF8J3A>w2c)z3%;4vt~ncFdQvfkExgAjmw?> zt&S1*UN&`8dnh{eNGbNKVb@mP_KSttk;F!A*sKZO!t0KH;PjA#S^BZ%ow*&mqbH!q zdpPDZ-Iv=jJNM|Ywr{nz9*-S5)Upxt$-CnRX+_o!KaqQ1F218mmIBY1oZimvlv&5_ zq4!qZyL;V*)=lO2Pg%I;k=@G{eCc;5hNdh~=GE+qsHwZ7A>2^c@aFlSA9@0d_ ziC)s%8TQ+i2;G@`-IS}2aB5=+j%0gx=5E9`B@Pi|+5J}X+a>%bZ)6M&`Nre2|IdCG zd_@9)Dv@`rG6$tt>8xx zYuO%P<@`Hf3d<6I5P@ZXgOG(l{cjOIhd_NBNL0T8nBz|UCXz#FPdo%M^`8f37WG>I z)Sk~*DAW_HJ)gHws3+!;smXdJt2;}Sfz8lR}rKIn>(zZ6Xl`CgT!f8i$=Ck)H31bU#8&cS(d>m!u@uJgl zE#|gVVS14!5HsBzNN*0LzZyvM99V_r-Mg@|I49rQbMM|csdr|Ly?r^;wTkU=UTpb|f3m^u%G1pm zeSeRK1%3C4{nYy#1;lb+g69r;-<$iQ>SM$_xIwVoCiP{+q902vCzs{Ka=)EhnD1At zLri{Rp2KiE60b$Po){+-+{e2`|7Y0#dj;=Dd|vR?&@V%vJ@<)E6N88Q68Bx|DGwPv z?;)!V_gAfp=e?@uxw7J~3+6t?eNj0dGkWfe%ER$w*=dN`ZDNie`$?>88Zr4eR>VAC zNhhI5uUBJ=hYvEds12eIK?BaV;|5=I{DB~KnP>f$ycR-Qs*QzAAo*bql# zo|lOY*Y`<+Ij1;Z$=?I}8N}e{zCx`0bHs*iSRgiKupw4{J|7_u`Q7_7;Ng5Bj>!JC zPHcEA=_H0tIc$g{vfm+@eCA>?x0yb#;TS1qTNRT_G3TP6=LGJq{pHF z=M|R$mS-O4H`htaSC6z6=27M$5bIe`e|B73a|U6zNcgy}Q^==nXPR{}Y?WC1%YBCD zJ1Sb{b5Ib+CF5}v;4?Dz7rT72zXyO>ock@MG%JOf)_T7O%yKGKu$!U@#M*=(8_ev@ zuw(yK)b1n{wtZ!|e&YDEeLU_nkLgzsv<#rfXPG=Et0?6AxR!4c_-IEy9%7V__Mk{g z3>k4K^PpjUv?C5)w^!qY{72BMXuVw8bq+A^5E}n)YJ^zr-ap~y)P*`wxk>rh|JCdE ziSRz)U$_r^-9BSFDncXtd0*x&aaTEhUt)IfO}qXi@Lk>~_>;8Z|1v4p8I}2?F7@V* zx(5EL^47y+YPcwId(Oxi)1S|oJ)!nl_{WGwZeE~w7>=$^v>gmJ9sR-{xsdO?H`Z}% zcvt5T6g`vU&E0qC#E|M2Vh5h^)A!{rcy-wF1taI=JrUC)xF@lDD6$WRiW0qLUinvJ zzHP^tA$Nbj;NFIphE<>CErYj*zWQ?Xl4!*&OnBUB2-)&kxYLkSbnFZ@EX9omSBhnD zo1v?BuC`#@kWuF+PxIQ~@aDar%sP?%(02+duK&{Zimln9ikydbOlr%{s<{23o5w~^ z-*DXe0_kWNaw7N6T&o(n?u8e#Hgac;zHRj#2eN2d{$$Mf`sio~^>!8>3@23`Q@zi|$Z=E{@}77DAbu_e#84 z;x<1n=`B@zG&jp9lln_~%T&`RFS$)VnKiO<-QE+q@KW-~l>A5U-}{5?WL`9NYh)1GO+lI6B`UW$fvu8nW%w}MLliPKiD??u4vA<9M^YvOVVxZJITU0ygkhKq4KMtX?gQU@sx3LjrZmC z(OuEVp3o<=+9&w5o4>GbZ(HZ5+3d3Br^6j}AvlBybsdiS+2e9Mjt#jpcNR8yc68*y z(2pKY>St%qp6&E3VD!h_+*C!!fza&UV{g9lkH0^2rW%v_)t66)qZM60knJhkVoz3d z&fZQ>xn2M0@2fR>RZ2I1)O*;6Xij^mZCZBQx4hRoTiZ^xzW%eHJ@lDdKDs{ol^-2G z82YP++lwd8sab8u-u~T`E6)|9^5`hLXS|&|D@2ahfA-UH?-_M|{wQ3; zO`)sK9VUMF!QZu8rMuz{+Fns9@JC4!9P;G?eo*`e!zHj*Un;+S6Vf&C}%YSj| zild{kOG?ccw=u(xUXfDVlH0L!NVE~lK=s#UljDBj+LAFhPF;K37oULdBU`p1?DlUV z>$o?ot$4=T)vpxC(TTNhKG%sIE8KNd#&BcE!yVI&*uosm>W!75jTfeeLcF&d&AH>@ z=;wOjIV;pw<4v5F_vmH*$Y4<3&i!54<>xNruv`+|m7Fhc=W;M6uOHslohV9tB&V%= zb5UaT;k@YZ<7L**2ytby1LgzhZpTmWbMdZ zR<>e#cV%x$!R*_xbIPuSh4aOmPUNoOl9W>Io`kVVDmr%Fh_$fc#8B)=$(;)YXHV?y z{Hiehj}<)QcNRy*j?FH2>&UxWa3z%Wvzh z-1MNUe3%Sk_lBaxqdBl^7~9($2fJjjz8iXb;m}Mq9b?99?QY%uSq{R{;VC^VcbB>L zCplZl*>P<2(Js4mHjHlT-iG5vX~Cn|BwLCSKg`)9`=}e#M9%5l*N?sxEj)kW3oid? zPV~}LJsro2o%U4iqd9l<8vX8ATlc!6L?UO?vNm=nk<+lht-IA}o@(nxV-h(B{_X&D zsC_%DKJcBQ#MaXMb2)9py#wDp(C}dW)Vn)d%O5>-_m5xrMN!tqm0sK7yslH(ksVtb z@}s$3w|hrxySgi{!m(v{k8bUb+3&q-*({u_wRJB%T6-|u`fzJ9Yv+|9SlwN@c1?6_ zs-+D}xjn8pn$^(o^yZWr%AEzlV-Lsw^4`wQlv&4^{Dv8`XU=X=Y8+5g2PWF*RYdLK ztE1>WoJUdn?fcyNabGUa6`ZHCfG;zr%k9UBnPg(UIXz@g)~|-5ueuMN#_=Q6 z`OF~NS2=o5DexnAB|*rm35uSG2V-7w zP=e)DKhn=m@~NIzE0mb~#abwFLSn6#?FxyGbtoo}V%jQZ`v$_cY=4~AhJ8>@tGAf# zSDTo@R?ohvjcqg3o<24DGBB_37}J*h*@Z9_p#BWqcQo%B2Y4M z^2(i@dIkS~+lKRj?O{yG)SkiEj6+%SXv}eVKLRBaXAFAUYfO6vN+$a`(9@o=&Xc*o zluY*A?zCr2$z)RmJ#83MGTE?Av|-F~V60ECXir=y`UQw7)Dtt0_S+DYqr>3sz?4k& za$jZ{#*{zShWi6~7*ohY%p(Nb#=BxVo*xCKWU8wedh#%4KFe}H)BQR)|7lB`@d)jL z{~Kbp-w%v)17~y4==nrJ%N{bg7nqW%ZBw9U8OGX|3Sdemdpnm{jy888XuX_Q4I0OyJgzuKj+E@JKbe*h~d-(Xk$Z;k$U zz~n4JxB#quX*+vZzf4Ur>H7|X z9{+rUzV8^|=B*LFQ(&d9zq`w9HflEy(2x^$Z$PF@2KHxX?;f)Js8nIc$EU(63A=UC zrmsmQfcpB2yEl-pYp<^kr@axu@*i_Y6fKkoaGxd+GyOmy{rNz8XCVDVAbm8D{&^sc z+YL@e;5Q%p<48%5b?FJ-2h0>;d+7f{g=s$fq;SjUV}IS2mY$UK7w6~SqQ}#d5E8$?cE`1&a8Z_533|i80XyV*E=9-9y#;9d%Tw=&7(}dH{bh1p!_8~ zREdypY#=>5kX{x@e>#xG)wjJ;Q6Gx*<}@!|y}TynC2vL3a_0jv*)}Tt61B@$)~vp0qaD>^Y~P^I zzrKz8%bLdJb<0~m;h{gAS%_9zFM)ka=#aq6;?mVCYg(57rN7;iEoBjDYCkW}^(F25 zMq6K-+M4F&OYj~Z_OR78_=GAo=4Mh`zlBDf=7F#;we~5nciT_u(zjO411=8F1(6cM_3=f=MB3xp5cln4 zh(gPJTuOYukIRTz31lpS;&Ni)nM54N4`d30mgQ~}k~t73uE!5#27=D*N@C%eWAI$! zIDR0c2+4L|NG$e?h~xNyR3oUK!=ZXssrzgrvFx)=#LMvmX+a1zIOx7t41L_k>x{mY zSnAzC9LJAHsKf`^h!k_kLbbl$ZI=~34kIck_3yY)rTBA#X|xw+*)ic}^i_w`o%#SbencE*JHMh>0UIJ`1Rqvg`(JIA4g>e+-9A zZPtoS3^8#ejvq)X0&QMEoDjSVaThT-@#nB|?iL%i`AM-U6Re!y5gT%z6q~VvBeGA; zp&lFIuMu;+h*=l!3J}jj{9c2L4JKE?X#7BkBhwvpcaW5mQ-L5lRw^I*(jscf8 z+92t$@+=k`wyjZY*hXUI;hfaEJ}oxfzQj5XpB0*2 zu211Kd+3Aqm_}X!I|3n&$nl7W3i?ePhq#0oHY`gVnTsC?$BzD`Vu(4{3;3uALL8Cf z*L#2q#!@SO^#r?mfywFW<$?sc0)alC*c~21Se9cz91)vR>cz(Gr?81a=k`-M4pz_x zdbW``B6>HT>=cAJBF9SCm+?;R%IKWuVW|KeiX-OTJK}|i+lW~q#Pt!FeIeF);`#!6 zj@kPVShfQ()5Kg4Twj2>M6h~tvR%ZHd+`IAjG$#_5yOW4C60U)Kajf+)aGNvuwkEw zb^b3iHmk%2!{`y~{C_}fwjus&V(_4O4(ph3UnnTY4}>_v4G3}i2`Q|4H--~^y=x~H zJr4T_gaW~3#IWHQ5=Xd0Ls*U4xN(3z*BLhsu;*C0aga6YTH0TY_fipe65og)$UX$> zzl->Q;6sQpeVq;KCDv`{wioO%h1|C%EX!^30R&>MZPSUt&o&V2S~Qz_*c?K94>4@G zy@+*NaI?{7KjLM?u;KP1)@{*9J#4;<*lic!F~Faq9`@XJ#LBsmde|I7{CQ&7aN7|p z=NGAm&36%hlNdG_QipZ>UQ7KX{6O3`0_OM->vnN#d(1yKaoY$s90y|MxgEFwhJ2c` zG|R`ILi{gCtKRv66PwqJ{&j;n?gcmD2SOZK;-G)*K-s&HoQgmjwv$+GZlfMHa}hTX z!-nl7j@01?vKm3#(<=Dah}{^%p4-li;Zgv|mk`vxix@WCcEq|Zb{m@~#fIC9Shs~c z=AvzU@^n;exV?y#=OpzqJ}-(5w->SUoS|NL{s%GI6GKcK;e>(=4W)SAM+}=%=!qlu zI}>lbvEla|v?)UtafE{gi5r{QV#9reSZ(;thqk9yY&b87wO=95MYJuq^){%2dJZ3;mXH+$zCCto^MvHqMVGZ05j*SZ)4`vEg?F>+bz6$oldhGay*wCIn&&atDHpE)*A!Bn)Y!<K_~#uMtrGY?ry}9TKquVI(&_PF2FUA_FR{UBP;MD5-Rlp z%ZEn$IFFc%I)v*>2}6ogGq%5R&sK&e0GX z0^!^Wz28BvnwVsedW4Xi8#EEi`2e>;2*)5wD?*5i03?B+|0iJ!v5Xb-w2$n+_R;lA z`p6;BKC*i4Bi9A(qietPk^7AHv6@)=*hnmWbnTQrZlGTJ=-S3gAiEH>k3GcF$9=@o z$3w)@$K%A9!<179+Q+lRL#g$@d4taw{F=cRh`GTb*;r2$=NUYb z_!8fy%-~4|$B8fXZRQxvwOaLc#P9KKnhaiNaDq6`x8XNhiaQN{jQBF&hU=~3XAI`L zs^5aYWH8rN)xTk|hqXh$7kB<9FZcNijlR_2a^eEtro!M#gSmdHO*QcqzPY`1v`I}f}Ouf!SNv}e&=s8=9=a?f0Kfp zze&N)-=tvYZ?f38cm5^?JAadcJIOED`I{8%{7njW{w4)Gf0Kfpze&N)-=tvYZ&I*_ zby4}9ze&+Mf0Kfpze&N)-=tvYZ&I-HHz~Nva8?sv5B=PO*}<^0pY~zyV9Us( z-FIj19^VeONb)J}U<+v9`#i)QEJ5;_pZJFyc)0sMz8!2`+StI;*})d?_gU>=2~v++ z2U{ZjA?;vGr9HA8Od&p19gH2HcMi&VK>7}nKHdZP5V%-T>qB(lwV;o0)fBZ^2rgpf zuL2h_u-AmuM23PhX3)w(@ zO)g>Ys*lN1Xx~6Jq%C>xs+P2pgQ&?alkch`TX5hJ_ZQcTbsNj-pzC)_Fnx&O)j@Ck znwF(2n`_3qf1~R!0c%=##v-jkg6|OeCvb!Kjlm{_fKxgryfl}~d6&j%x09>zOB{D8 zoXg_|&IaIW1eRwWFHiYg!}8T3Etg+Fz8&Mc1;?3y#AE(*s%l_d<|O&n16#f|l849% z>!qwiAdVwY*2VnxR0HFbJju5k*z&QQT*d;W+V?fVaVjB+m_IJnz{3!Lo> z-a=5m>99l9Nxo-*M>;0|NBMYP-SSm|uL>sB2v;H~pSvf6w6^bz1AH?|QtbnEl5aR5b z+X8&`;Nv~SY8YOFpzS*x;Ol`+ruB;V;%$F9c)EX#Hhk{h64E+f_JhxgCiy&x7?G3y z?0A2Q>(fAX`lXrN5_UeUSWbm?F-$}!7;F0uA@PzLA!Z*b;{b@`OhC#@agQCg)xf-6 z&pd9&WdN3MSC;RG5Lr%WN2viIjxzz-jzK$*xEg`Cz?nzB&jDDzvFNzm3Pi4N$2bw- zOI({;pLy$C`JN2$%>dt65{S@_LVxGPaV8+0;A=!&jljnW%wzl9y)?u+eof%x@k&Mc z-U6`w;Qh@^cGuwGY3*A3vHMWKF42!2zsInAynmW${aXt=+utaj+30-cI|$m}Cjxwr z^~1+|ah9*b@ZD_qUJ39W1)n_Xa6?EA%IN@KBls$yuSVee9@@T3u_0`KFMzKE`6|jc z9Co&SJ>V;aQ8mIX2+H@t0N+St%tgKm?IO~b3-r|pe~zGh?j9e~Fn2;f{rQ3! zDc}78zC~rJ`8-YRIRADB+SdvKxus0HB;VHpd@Y9WR@teBfvKW+dI>F$*cfhC!QhlR(v%=C4%xj z6yW2%=S+NU0lxi)Z?@q(Bz!t9)iNJp;zY;gLZDvW+vdABDmpH|3DkQM^)|w&8sSa^ z?MF$DKh9e3-}h7R$HWes&k65&_X=jD^?n3)#BnMi{C@*{K35IQd9C$s4%E95#PWy@ zR;hXLgFwAoV8{JZMeFSi)Z2=KMkS1@5$-|IdjB)PcN~0t4x^%cZv^;`f{)K5s$n=E zLHXW0JbnC*q7ze;46$yv+r&=Ck4_S&8au6bI_!w!l6Mx1q@E`(gihI6yO_)iAcL@7=8>v`DmYopmIFl^UlDo1`1uD^MFC;na$}vhLhn-GStg!j5Iq8 z%61kO(e}N6lJ)dBu;0fC<&&oPB?k8UxG;vw(1=N{&N94 z%AcLm`L6C**TJyW(K#F>-RD_*2rkdMYC=9|(C1l2S8vqM@qM19Jg2=o9{5g6;~BHD za^vqW2@U7t`pGq+z1?0{XXx&l_tn-&H{mX;t7hcgKmN&xH?KW9F`6^`R(kzAys)k2 z%IP&D{3gMD)6UWrxg(C{bRLWO*~yIDYv|Vr1$<4%rs9UrZi34*qeJoCv5JvK^GRr~ zKJ0nVb;A8vs_d~*@CkK)!&*3?OKDO1*huFOD`hzKs@6PAla=mIt>MbH;t@ylI}?XKNoSF+Y?x+0p^uiS#R;!y{~4cps_uim+R z?T(#a+|tkr?_0@6p_7+8HH|dr_3IBx66v&5gp=Z!@J#xow?Cj8?lX}Bled( zcX(0n;cE5%2ghK?a!~b&Vd}H<_2L3l`dsmqy~TygLu;SxI$Slq<_fK<M9=Tll14{ zD|YwHdGlx9Q*}{CUjZY3e>*)SnnSN&C$iDl_Gx}Kr~jYx`^6&+g=dKr9Qd86USrMI zc#YWcs6(M$$RVFgG5Hi*8;i-QHWsrE)w3SOfJuK@I1sucBV&rTpIH50#ejMA)VKtg zfs)CdXAHF0GlxIchF5~*VNA)y!@E_qVNA(n!=p8A7*jIY-~jGy7;|h(5cEv(e~0}^ z;b(j~HU#;9j+ono{AU3=5L3UFjfGH8j1xzv|1_}Lw;KItjea9A{+vDE%Hl~$3Bun1 zYrnoo14yQR@vM^BjMe^wz!YomYxv6+sr2>XBQIo$K{)Lyho>*{LRB)~-aTP{p;Egz zoObodeBND5NjN!Id|lXm#b)zksRU5ijZI1wc6ZxsdUPt`?5_=^%L3`^1L+$A>9K*d z9X+el*KreDooE0q#Fb2&jivt18LrCS0Ud&2GYL>q_L5bLi?c4n5zQ$;{xe9fi&Nb zR3YET18Lqnq;S>9$86Xd$hSUHnpbD`k)r=27a!&00ekWjd-L%2;`oHRP z!nzI_lvAFh4+`-ygY+PMXbjG2McST{KGJ-hK(_&K1`igY61O|MpHQifd1j!PX9Xd1 zm{h&9F^5C_rhp9k9f89d7F~lreAg6)E5e_hf zo0EFhL#+BD(bJYVB6H92$myfyVG|3WCl7H%<|NOA3a-Qtgg7GejprTwc9=pO;R8Pi z&-@DHGK19+lan|i^R}3Jydc5tTuuxdwuM;v9S<80aXi2odC;gN4{U-wpGWxuIsH9@ zbCLp_(EI{1pY0R#?4R!gC~h;D{bgC!OB|8?JZ ziVgQ;;>cwDKspiF9@h0ZG1?qMOssY7r(W9pJ!06DA|}?lekeBN`H9$+AtqLySHy;G z{&%q%i{?phD<#t3}<7>Bb+1uwz*nt*k-=p!}i2sL#%E73$bC}*NV*y*bqmi0zeX?uN17`l5df+ugFuzhUedG!(7-9>vxgvJ64RzS?Hb<8_qRiwV^*p9h387vk*4K`W@v3W0Qq8 zu`aHi#QHts)uOM4o;VT*fLu$xY?mowQwKeG66r3A_V%c;O3i1 z44bIn$gKb(`fU`;>$g#P#9YiEg$N;8S7XFfK*|vGTO`i!5G#amj;ep8II*-DF!>!8 z+o5$ieyNN5q}Js)rLGFrd&83xZK#&bE!B7^G< zZXw3;i_&WFW`nmI+)c~_2;^~tpEmfY!Os(8&Qs19{F=esAJxWv+bH(#-8;b}G0)Ye z%wYFzqu9ia-hJCBdhTCZ)_vP3diQOkU>-O1yF#v0iru%3*heUxM*qL^-4m{g%-0AP z`TPZjgZnHga1ChQ_P;ngukn)CRPqM#z$N;<)Ew}G5@~1ZvU0E`(ykx}Q)p1%x1c%h zQ$6) z1{B0`$=CwEQeg6h5tzqvyf(1yV>vmL0{M1~R|t+X0oeyWo+glwch{Bg5n#(VNAeIk zp&g|QfjEvpId1yP!@ctTGqB~GD|v{VDBtr)S-w+-kB5EbD*~D2t3qC;@w);>mhUY1 zN@2_X^6;;Ga{_$T$jiicTYxVI$4KSlseqI^6DA&yJVHk{O!1Cx)3bLBf8;Cn;tHA1!%UOy0Xu2K54I|U=ow}I^F zKZkre@5#sWZWZmvX&BjlJOd-0r##)&e&l4O^YQ$!M9IXC$uR6J-%H@Df_@SLd6n<_ z0N+^f$!ROBd^^T-19p@8vHL{8j@O)WnoSy4FXNU#`^s@%rQ416+CKX10Y!5B79t_1 z_M}PjeLcWe4L%(|-q%pR7Xy4e=atjGG`=4P_|_P{nBk+(eYS6+EA4roMS^vyFpuF5 zvD1058OjPZLab%zv!6IFd0S9#B`~+!H3-^|2Lko-Je&8}RJ7j51NHJ8JX5{j2-JJZ z)O#&RwcgW#dU;-+son?*unpQ@p0n$dXSR`il%W8`aV8+K0t6`7-|G>W$93rj0P^WL zKY=vIMMeAj5wX*H`EL6M)d(??PO1Qi<9^bMW3p5Mv)-`?%wxTu03bK#CS@uP8j6|L zdhw5N)ApMN*iE5<2<<4_gwIdmcmlg%KbZG<*x@hPzHMk9*HpHT^)rv{dpN-ND){JY zMMdk~72xAeL_6|vOqGxJrnt8qi(DL;yj52$c6o?-Y{FDX$|*F4b4W$&<-TRq-eWjn L*v-mB)b4)*<=hmH diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libp256m.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libp256m.a index fdd57f31859ac785b818128ef912828c212b77a9..addefaad9504e68198c221d72713888de4b9e051 100644 GIT binary patch literal 1382 zcmdr~%}&BV5Z(&Wq$dwPz%+$^f?0rg_2R;bZyIatgd}>v>_lorex~mV@VhfpE<$aG0cRpB;_INU*8%9 z_xwk~@EO+&0$?^KKg^J@g6G^DfnCICtIHKYYYO}w{5vI uyDEFus=jBd$KZ|suxHHw{Zbvn47PWw4>>9F&(NaEzx-=EbphO}?9?azB)|Ru literal 1714 zcmeHHPfx;73@?IzSUl*(i!m7|A(6+N4F5z;fFL0ung}GE9AnIY0YZ}X2(zleiQuQtpiBOSK ziog@hEr325QGo2!n}j&*0F;ZxD>Z3*uJ3c#?Wga{s^gE+rv}rRX6l-5XqUQ{QiB(; zi?J#)rD}3#=v!uG`0PTXRx{!Am696@!mY*&SV| zno8b~-DqPI5=9{u+xLOl?qGnE0ydtu z%X-xA+H{CW>UArO2+n>UF3uql;zVbwaL0(lsm)Gc749U=r=cVwoY2Xp?-Cox+sJ}C zs9XpGrKpdjJcW0(N5~XQOcU5cjw6d6P=#F#JR&6|k#8Su8J9vwL4Z&STrkG)daQFF lwDs>plRkn)1ZVgs?gO)barysuA3*-~iJe~F{eu;|{{=s Date: Wed, 4 Feb 2026 15:36:21 -0500 Subject: [PATCH 3/4] chore: update config.h to include new config options in v3.6.5 release did my best to keep the same feature set as when using mbedtls 3.4.0 --- esp-mbedtls-sys/gen/include/config.h | 965 ++++++++++++++++++++------- 1 file changed, 718 insertions(+), 247 deletions(-) diff --git a/esp-mbedtls-sys/gen/include/config.h b/esp-mbedtls-sys/gen/include/config.h index 8b7a1473..c5e8d596 100644 --- a/esp-mbedtls-sys/gen/include/config.h +++ b/esp-mbedtls-sys/gen/include/config.h @@ -9,19 +9,7 @@ */ /* * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ /** @@ -168,19 +156,51 @@ * * Enable the memory allocation layer. * - * By default mbed TLS uses the system-provided calloc() and free(). + * By default Mbed TLS uses the system-provided calloc() and free(). * This allows different allocators (self-implemented or provided) to be * provided to the platform abstraction layer. * - * Enabling MBEDTLS_PLATFORM_MEMORY without the + * Enabling #MBEDTLS_PLATFORM_MEMORY without the * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and * free() function pointer at runtime. * - * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * Enabling #MBEDTLS_PLATFORM_MEMORY and specifying * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the * alternate function at compile time. * + * An overview of how the value of mbedtls_calloc is determined: + * + * - if !MBEDTLS_PLATFORM_MEMORY + * - mbedtls_calloc = calloc + * - if MBEDTLS_PLATFORM_MEMORY + * - if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO + * - if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. + * - How is MBEDTLS_PLATFORM_STD_CALLOC handled? + * - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; + * - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; + * - if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - if MBEDTLS_PLATFORM_STD_CALLOC is present: + * - User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; + * - if !MBEDTLS_PLATFORM_STD_CALLOC: + * - MBEDTLS_PLATFORM_STD_CALLOC = calloc + * + * - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. + * - if !MBEDTLS_PLATFORM_STD_CALLOC + * - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc + * + * - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. + * + * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and #MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. + * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. + * #MBEDTLS_PLATFORM_STD_CALLOC and #MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, + * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * * Requires: MBEDTLS_PLATFORM_C * * Enable this layer to allow use of alternative memory allocators. @@ -209,10 +229,10 @@ /** * \def MBEDTLS_PLATFORM_EXIT_ALT * - * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let Mbed TLS support the * function in the platform abstraction layer. * - * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, Mbed TLS will * provide a function "mbedtls_platform_set_printf()" that allows you to set an * alternative printf function pointer. * @@ -238,6 +258,49 @@ //#define MBEDTLS_PLATFORM_VSNPRINTF_ALT //#define MBEDTLS_PLATFORM_NV_SEED_ALT //#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +//#define MBEDTLS_PLATFORM_MS_TIME_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(), to wipe sensitive data in memory. This replaces + * the default implementation in platform_util.c. + * + * By default, the library uses a system function such as memset_s() + * (optional feature of C11), explicit_bzero() (BSD and compatible), or + * SecureZeroMemory (Windows). If no such function is detected, the library + * falls back to a plain C implementation. Compilers are technically + * permitted to optimize this implementation out, meaning that the memory is + * not actually wiped. The library tries to prevent that, but the C language + * makes it impossible to guarantee that the memory will always be wiped. + * + * If your platform provides a guaranteed method to wipe memory which + * `platform_util.c` does not detect, define this macro to the name of + * a function that takes two arguments, a `void *` pointer and a length, + * and wipes that many bytes starting at the specified address. For example, + * if your platform has explicit_bzero() but `platform_util.c` does not + * detect its presence, define `MBEDTLS_PLATFORM_ZEROIZE_ALT` to be + * `explicit_bzero` to use that function as mbedtls_platform_zeroize(). + */ +#define MBEDTLS_PLATFORM_ZEROIZE_ALT /** * \def MBEDTLS_DEPRECATED_WARNING @@ -269,7 +332,7 @@ /** \} name SECTION: System support */ /** - * \name SECTION: mbed TLS feature support + * \name SECTION: Mbed TLS feature support * * This section sets support for features that are or are not needed * within the modules that are enabled. @@ -292,7 +355,7 @@ /** * \def MBEDTLS_AES_ALT * - * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let Mbed TLS use your * alternate core implementation of a symmetric crypto, an arithmetic or hash * module (e.g. platform specific assembly optimized implementations). Keep * in mind that the function prototypes should remain the same. @@ -300,7 +363,7 @@ * This replaces the whole module. If you only want to replace one of the * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. * - * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * Example: In case you uncomment MBEDTLS_AES_ALT, Mbed TLS will no longer * provide the "struct mbedtls_aes_context" definition and omit the base * function declarations and implementations. "aes_alt.h" will be included from * "aes.h" to include the new function definitions. @@ -326,7 +389,6 @@ //#define MBEDTLS_ECJPAKE_ALT //#define MBEDTLS_GCM_ALT //#define MBEDTLS_NIST_KW_ALT -//#define MBEDTLS_MPI_EXP_MOD_ALT_FALLBACK //#define MBEDTLS_MD5_ALT //#define MBEDTLS_POLY1305_ALT //#define MBEDTLS_RIPEMD160_ALT @@ -349,14 +411,14 @@ /** * \def MBEDTLS_SHA256_PROCESS_ALT * - * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use you * alternate core implementation of symmetric crypto or hash function. Keep in * mind that function prototypes should remain the same. * - * This replaces only one function. The header file from mbed TLS is still + * This replaces only one function. The header file from Mbed TLS is still * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. * - * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, Mbed TLS will * no longer provide the mbedtls_sha1_process() function, but it will still provide * the other function (using your mbedtls_sha1_process() function) and the definition * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible @@ -406,11 +468,11 @@ * * Expose a part of the internal interface of the Elliptic Curve Point module. * - * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind * that function prototypes should remain the same. * - * This partially replaces one function. The header file from mbed TLS is still + * This partially replaces one function. The header file from Mbed TLS is still * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation * is still present and it is used for group structures not supported by the * alternative. @@ -434,11 +496,11 @@ * implement optimized set up and tear down instructions. * * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and - * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac() + * MBEDTLS_ECP_DOUBLE_JAC_ALT, Mbed TLS will still provide the ecp_double_jac() * function, but will use your mbedtls_internal_ecp_double_jac() if the group * for the operation is supported by your implementation (i.e. your * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the - * group is not supported by your implementation, then the original mbed TLS + * group is not supported by your implementation, then the original Mbed TLS * implementation of ecp_double_jac() is used instead, unless this fallback * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE). @@ -469,7 +531,7 @@ /** * \def MBEDTLS_ENTROPY_HARDWARE_ALT * - * Uncomment this macro to let mbed TLS use your own implementation of a + * Uncomment this macro to let Mbed TLS use your own implementation of a * hardware entropy collector. * * Your function must be called \c mbedtls_hardware_poll(), have the same @@ -496,7 +558,6 @@ * performance if ROM access is slower than RAM access. * * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. - * */ #define MBEDTLS_AES_ROM_TABLES @@ -518,10 +579,40 @@ * depends on the system and memory details. * * This option is independent of \c MBEDTLS_AES_ROM_TABLES. - * */ //#define MBEDTLS_AES_FEWER_TABLES +/** + * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + * + * Use only 128-bit keys in AES operations to save ROM. + * + * Uncomment this macro to remove support for AES operations that use 192- + * or 256-bit keys. + * + * Uncommenting this macro reduces the size of AES code by ~300 bytes + * on v8-M/Thumb2. + * + * Module: library/aes.c + * + * Requires: MBEDTLS_AES_C + */ +//#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + +/* + * Disable plain C implementation for AES. + * + * When the plain C implementation is enabled, and an implementation using a + * special CPU feature (such as MBEDTLS_AESCE_C) is also enabled, runtime + * detection will be used to select between them. + * + * If only one implementation is present, runtime detection will not be used. + * This configuration will crash at runtime if running on a CPU without the + * necessary features. It will not build unless at least one of MBEDTLS_AESCE_C + * and/or MBEDTLS_AESNI_C is enabled & present in the build. + */ +//#define MBEDTLS_AES_USE_HARDWARE_ONLY + /** * \def MBEDTLS_CAMELLIA_SMALL_MEMORY * @@ -640,10 +731,23 @@ /** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY * * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. - * By default, CTR_DRBG uses a 256-bit key. + * Without this, CTR_DRBG uses a 256-bit key + * unless \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. */ //#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + * + * The Everest code is provided under the Apache 2.0 license only; therefore enabling this + * option is not compatible with taking the library under the GPL v2.0-or-later license. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + /** * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED * @@ -734,6 +838,14 @@ */ //#define MBEDTLS_ECP_RESTARTABLE +/** + * Uncomment to enable using new bignum code in the ECC modules. + * + * \warning This is currently experimental, incomplete and therefore should not + * be used in production. + */ +//#define MBEDTLS_ECP_WITH_MPI_UINT + /** * \def MBEDTLS_ECDSA_DETERMINISTIC * @@ -802,7 +914,7 @@ * * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. * - * Requires: MBEDTLS_ECDH_C + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) * * This enables the following ciphersuites (if other requisites are * enabled as well): @@ -900,7 +1012,9 @@ * * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_RSA_C + * MBEDTLS_PKCS1_V15 * MBEDTLS_X509_CRT_PARSE_C * * This enables the following ciphersuites (if other requisites are @@ -923,7 +1037,9 @@ * * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_X509_CRT_PARSE_C * * This enables the following ciphersuites (if other requisites are * enabled as well): @@ -945,7 +1061,9 @@ * * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_X509_CRT_PARSE_C * * This enables the following ciphersuites (if other requisites are * enabled as well): @@ -967,7 +1085,9 @@ * * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_X509_CRT_PARSE_C + * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH) + * MBEDTLS_RSA_C + * MBEDTLS_X509_CRT_PARSE_C * * This enables the following ciphersuites (if other requisites are * enabled as well): @@ -993,10 +1113,14 @@ * Thread v1.0.0 specification; incompatible changes to the specification * might still happen. For this reason, this is disabled by default. * - * Requires: MBEDTLS_ECJPAKE_C - * SHA-256 (via MD if present, or via PSA, see MBEDTLS_ECJPAKE_C) + * Requires: MBEDTLS_ECJPAKE_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_JPAKE) + * SHA-256 (via MBEDTLS_SHA256_C or a PSA driver) * MBEDTLS_ECP_DP_SECP256R1_ENABLED * + * \warning If SHA-256 is provided only by a PSA driver, you must call + * psa_crypto_init() before the first handshake (even if + * MBEDTLS_USE_PSA_CRYPTO is disabled). + * * This enables the following ciphersuites (if other requisites are * enabled as well): * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 @@ -1017,6 +1141,19 @@ */ #define MBEDTLS_PK_PARSE_EC_EXTENDED +/** + * \def MBEDTLS_PK_PARSE_EC_COMPRESSED + * + * Enable the support for parsing public keys of type Short Weierstrass + * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the + * compressed point format. This parsing is done through ECP module's functions. + * + * \note As explained in the description of MBEDTLS_ECP_PF_COMPRESSED (in ecp.h) + * the only unsupported curves are MBEDTLS_ECP_DP_SECP224R1 and + * MBEDTLS_ECP_DP_SECP224K1. + */ +//#define MBEDTLS_PK_PARSE_EC_COMPRESSED + /** * \def MBEDTLS_ERROR_STRERROR_DUMMY * @@ -1177,15 +1314,10 @@ * * Enable support for PKCS#1 v2.1 encoding. * - * Requires: MBEDTLS_RSA_C and (MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C). - * - * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init() - * before doing any PKCS#1 v2.1 operation. + * Requires: MBEDTLS_RSA_C * - * \warning When building with MBEDTLS_MD_C, all hashes used with this - * need to be available as built-ins (that is, for SHA-256, MBEDTLS_SHA256_C, - * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by - * this module in builds where MBEDTLS_MD_C is disabled. + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS#1 v2.1 operation. * * This enables support for RSAES-OAEP and RSASSA-PSS operations. */ @@ -1223,18 +1355,6 @@ */ //#define MBEDTLS_PSA_CRYPTO_CLIENT -/** \def MBEDTLS_PSA_CRYPTO_DRIVERS - * - * Enable support for the experimental PSA crypto driver interface. - * - * Requires: MBEDTLS_PSA_CRYPTO_C - * - * \warning This interface is experimental. We intend to maintain backward - * compatibility with application code that relies on drivers, - * but the driver interfaces may change without notice. - */ -//#define MBEDTLS_PSA_CRYPTO_DRIVERS - /** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG * * Make the PSA Crypto module use an external random generator provided @@ -1259,8 +1379,8 @@ * ); * ``` * The \c context value is initialized to 0 before the first call. - * The function must fill the \c output buffer with \p output_size bytes - * of random data and set \c *output_length to \p output_size. + * The function must fill the \c output buffer with \c output_size bytes + * of random data and set \c *output_length to \c output_size. * * Requires: MBEDTLS_PSA_CRYPTO_C * @@ -1281,12 +1401,77 @@ * NSPE (Non-Secure Process Environment) and an SPE (Secure Process * Environment). * + * If you enable this option, your build environment must include a header + * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS + * header files, or in another directory on the compiler's include search + * path). Alternatively, your platform may customize the header + * `psa/crypto_platform.h`, in which case it can skip or replace the + * inclusion of `"crypto_spe.h"`. + * * Module: library/psa_crypto.c * Requires: MBEDTLS_PSA_CRYPTO_C * */ //#define MBEDTLS_PSA_CRYPTO_SPM +/** + * \def MBEDTLS_PSA_KEY_STORE_DYNAMIC + * + * Dynamically resize the PSA key store to accommodate any number of + * volatile keys (until the heap memory is exhausted). + * + * If this option is disabled, the key store has a fixed size + * #MBEDTLS_PSA_KEY_SLOT_COUNT for volatile keys and loaded persistent keys + * together. + * + * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + */ +//#define MBEDTLS_PSA_KEY_STORE_DYNAMIC + +/** + * Uncomment to enable p256-m. This is an alternative implementation of + * key generation, ECDH and (randomized) ECDSA on the curve SECP256R1. + * Compared to the default implementation: + * + * - p256-m has a much smaller code size and RAM footprint. + * - p256-m is only available via the PSA API. This includes the pk module + * when #MBEDTLS_USE_PSA_CRYPTO is enabled. + * - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols + * over the core arithmetic, or deterministic derivation of keys. + * + * We recommend enabling this option if your application uses the PSA API + * and the only elliptic curve support it needs is ECDH and ECDSA over + * SECP256R1. + * + * If you enable this option, you do not need to enable any ECC-related + * MBEDTLS_xxx option. You do need to separately request support for the + * cryptographic mechanisms through the PSA API: + * - #MBEDTLS_PSA_CRYPTO_C and #MBEDTLS_PSA_CRYPTO_CONFIG for PSA-based + * configuration; + * - #MBEDTLS_USE_PSA_CRYPTO if you want to use p256-m from PK, X.509 or TLS; + * - #PSA_WANT_ECC_SECP_R1_256; + * - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed; + * - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC, + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT, + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed. + * + * \note To benefit from the smaller code size of p256-m, make sure that you + * do not enable any ECC-related option not supported by p256-m: this + * would cause the built-in ECC implementation to be built as well, in + * order to provide the required option. + * Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and + * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than + * SECP256R1 are disabled as they are not supported by this driver. + * Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or + * #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of + * the built-in ECC implementation, see docs/driver-only-builds.md. + */ +//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED + /** * \def MBEDTLS_PSA_INJECT_ENTROPY * @@ -1300,6 +1485,26 @@ */ //#define MBEDTLS_PSA_INJECT_ENTROPY +/** + * \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + * + * Assume all buffers passed to PSA functions are owned exclusively by the + * PSA function and are not stored in shared memory. + * + * This option may be enabled if all buffers passed to any PSA function reside + * in memory that is accessible only to the PSA function during its execution. + * + * This option MUST be disabled whenever buffer arguments are in memory shared + * with an untrusted party, for example where arguments to PSA calls are passed + * across a trust boundary. + * + * \note Enabling this option reduces memory usage and code size. + * + * \note Enabling this option causes overlap of input and output buffers + * not to be supported by PSA functions. + */ +//#define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + /** * \def MBEDTLS_RSA_NO_CRT * @@ -1348,7 +1553,7 @@ * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES * * Enable sending of alert messages in case of encountered errors as per RFC. - * If you choose not to send the alert messages, mbed TLS can still communicate + * If you choose not to send the alert messages, Mbed TLS can still communicate * with other servers, only debugging of failures is harder. * * The advantage of not sending alert messages, is that no information is given @@ -1417,6 +1622,46 @@ */ //#define MBEDTLS_SSL_ASYNC_PRIVATE +/** \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * + * In TLS clients, when a client authenticates a server through its + * certificate, the client normally checks three things: + * - the certificate chain must be valid; + * - the chain must start from a trusted CA; + * - the certificate must cover the server name that is expected by the client. + * + * Omitting any of these checks is generally insecure, and can allow a + * malicious server to impersonate a legitimate server. + * + * The third check may be safely skipped in some unusual scenarios, + * such as networks where eavesdropping is a risk but not active attacks, + * or a private PKI where the client equally trusts all servers that are + * accredited by the root CA. + * + * You should call mbedtls_ssl_set_hostname() with the expected server name + * before starting a TLS handshake on a client (unless the client is + * set up to only use PSK-based authentication, which does not rely on the + * host name). This configuration option controls what happens if a TLS client + * is configured with the authentication mode #MBEDTLS_SSL_VERIFY_REQUIRED + * (default), certificate authentication is enabled and the client does not + * call mbedtls_ssl_set_hostname(): + * + * - If this option is unset (default), the connection attempt is aborted + * with the error #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + * - If this option is set, the TLS library does not check the server name + * that the certificate is valid for. This is the historical behavior + * of Mbed TLS, but may be insecure as explained above. + * + * Enable this option for strict backward compatibility if you have + * determined that it is secure in the scenario where you are using + * Mbed TLS. + * + * \deprecated This option exists only for backward compatibility and will + * be removed in the next major version of Mbed TLS. + * + */ +//#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /** * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION * @@ -1518,6 +1763,20 @@ */ #define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE +/** + * \def MBEDTLS_SSL_KEYING_MATERIAL_EXPORT + * + * When this option is enabled, the client and server can extract additional + * shared symmetric keys after an SSL handshake using the function + * mbedtls_ssl_export_keying_material(). + * + * The process for deriving the keys is specified in RFC 5705 for TLS 1.2 and + * in RFC 8446, Section 7.5, for TLS 1.3. + * + * Comment this macro to disable mbedtls_ssl_export_keying_material(). + */ +//#define MBEDTLS_SSL_KEYING_MATERIAL_EXPORT + /** * \def MBEDTLS_SSL_RENEGOTIATION * @@ -1529,6 +1788,8 @@ * it has been associated with security issues in the past and is easy to * misuse/misunderstand. * + * Requires: MBEDTLS_SSL_PROTO_TLS1_2 + * * Comment this to disable support for renegotiation. * * \note Even if this option is disabled, both client and server are aware @@ -1554,9 +1815,6 @@ * * Enable support for RFC 8449 record_size_limit extension in SSL (TLS 1.3 only). * - * \warning This extension is currently in development and must NOT be used except - * for testing purposes. - * * Requires: MBEDTLS_SSL_PROTO_TLS1_3 * * Uncomment this macro to enable support for the record_size_limit extension @@ -1569,13 +1827,14 @@ * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). * * Requires: Without MBEDTLS_USE_PSA_CRYPTO: MBEDTLS_MD_C and - * (MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C) + * (MBEDTLS_SHA256_C or MBEDTLS_SHA384_C or + * SHA-256 or SHA-512 provided by a PSA driver) * With MBEDTLS_USE_PSA_CRYPTO: - * PSA_WANT_ALG_SHA_1 or PSA_WANT_ALG_SHA_256 or - * PSA_WANT_ALG_SHA_512 + * PSA_WANT_ALG_SHA_256 or PSA_WANT_ALG_SHA_384 * - * \warning If building with MBEDTLS_USE_PSA_CRYPTO, you must call - * psa_crypto_init() before doing any TLS operations. + * \warning If building with MBEDTLS_USE_PSA_CRYPTO, or if the hash(es) used + * are only provided by PSA drivers, you must call psa_crypto_init() before + * doing any TLS operations. * * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 */ @@ -1586,23 +1845,27 @@ * * Enable support for TLS 1.3. * - * \note The support for TLS 1.3 is not comprehensive yet, in particular - * pre-shared keys are not supported. - * See docs/architecture/tls13-support.md for a description of the TLS + * \note See docs/architecture/tls13-support.md for a description of the TLS * 1.3 support that this option enables. * * Requires: MBEDTLS_SSL_KEEP_PEER_CERTIFICATE * Requires: MBEDTLS_PSA_CRYPTO_C * * \note TLS 1.3 uses PSA crypto for cryptographic operations that are - * directly performed by TLS 1.3 code. As a consequence, you must - * call psa_crypto_init() before the first TLS 1.3 handshake. + * directly performed by TLS 1.3 code. As a consequence, when TLS 1.3 + * is enabled, a TLS handshake may call psa_crypto_init(), even + * if it ends up negotiating a different TLS version. * * \note Cryptographic operations performed indirectly via another module * (X.509, PK) or by code shared with TLS 1.2 (record protection, * running handshake hash) only use PSA crypto if * #MBEDTLS_USE_PSA_CRYPTO is enabled. * + * \note In multithreaded applications, you must also enable + * #MBEDTLS_THREADING_C, even if individual TLS contexts are not + * shared between threads, unless only one thread ever calls + * TLS functions. + * * Uncomment this macro to enable the support for TLS 1.3. */ #define MBEDTLS_SSL_PROTO_TLS1_3 @@ -1646,8 +1909,11 @@ * * Enable TLS 1.3 ephemeral key exchange mode. * - * Requires: MBEDTLS_ECDH_C, MBEDTLS_X509_CRT_PARSE_C, MBEDTLS_ECDSA_C or - * MBEDTLS_PKCS1_V21 + * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH + * MBEDTLS_X509_CRT_PARSE_C + * and at least one of: + * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA) + * MBEDTLS_PKCS1_V21 * * Comment to disable support for the ephemeral key exchange mode in TLS 1.3. * If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any @@ -1661,7 +1927,7 @@ * * Enable TLS 1.3 PSK ephemeral key exchange mode. * - * Requires: MBEDTLS_ECDH_C + * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH * * Comment to disable support for the PSK ephemeral key exchange mode in * TLS 1.3. If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not @@ -1682,29 +1948,12 @@ * Comment this to disable support for early data. If MBEDTLS_SSL_PROTO_TLS1_3 * is not enabled, this option does not have any effect on the build. * - * This feature is experimental, not completed and thus not ready for - * production. + * \note The maximum amount of early data can be set with + * MBEDTLS_SSL_MAX_EARLY_DATA_SIZE. * */ //#define MBEDTLS_SSL_EARLY_DATA -/** - * \def MBEDTLS_SSL_MAX_EARLY_DATA_SIZE - * - * The default maximum amount of 0-RTT data. See the documentation of - * \c mbedtls_ssl_tls13_conf_max_early_data_size() for more information. - * - * It must be positive and smaller than UINT32_MAX. - * - * If MBEDTLS_SSL_EARLY_DATA is not defined, this default value does not - * have any impact on the build. - * - * This feature is experimental, not completed and thus not ready for - * production. - * - */ -#define MBEDTLS_SSL_MAX_EARLY_DATA_SIZE 1024 - /** * \def MBEDTLS_SSL_PROTO_DTLS * @@ -1901,7 +2150,19 @@ /** * \def MBEDTLS_THREADING_ALT * - * Provide your own alternate threading implementation. + * Provide your own alternate implementation of threading primitives + * for mutexes. If you enable this option: + * + * - Provide a header file `"threading_alt.h"`, defining the + * type `mbedtls_threading_mutex_t` of mutex objects. + * + * - Call the function mbedtls_threading_set_alt() in your application + * before calling any other library function (in particular before + * calling psa_crypto_init(), performing an asymmetric cryptography + * operation, or starting a TLS connection). + * + * See mbedtls/threading.h for more details, especially the documentation + * of mbedtls_threading_set_alt(). * * Requires: MBEDTLS_THREADING_C * @@ -1923,19 +2184,30 @@ /** * \def MBEDTLS_USE_PSA_CRYPTO * - * Make the X.509 and TLS library use PSA for cryptographic operations, and - * enable new APIs for using keys handled by PSA Crypto. + * Make the X.509 and TLS libraries use PSA for cryptographic operations as + * much as possible, and enable new APIs for using keys handled by PSA Crypto. * * \note Development of this option is currently in progress, and parts of Mbed * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts * will still continue to work as usual, so enabling this option should not * break backwards compatibility. * - * \note See docs/use-psa-crypto.md for a complete description of what this - * option currently does, and of parts that are not affected by it so far. - * * \warning If you enable this option, you need to call `psa_crypto_init()` - * before calling any function from the SSL/TLS, X.509 or PK modules. + * before calling any function from the SSL/TLS, X.509 or PK modules, except + * for the various mbedtls_xxx_init() functions which can be called at any time. + * + * \warning In multithreaded applications, you must also enable + * #MBEDTLS_THREADING_C, unless only one thread ever calls PSA functions + * (`psa_xxx()`), including indirect calls through SSL/TLS, X.509 or PK. + * + * \note An important and desirable effect of this option is that it allows + * PK, X.509 and TLS to take advantage of PSA drivers. For example, enabling + * this option is what allows use of drivers for ECDSA, ECDH and EC J-PAKE in + * those modules. However, note that even with this option disabled, some code + * in PK, X.509, TLS or the crypto library might still use PSA drivers, if it + * can determine it's safe to do so; currently that's the case for hashes. + * + * \note See docs/use-psa-crypto.md for a complete description this option. * * Requires: MBEDTLS_PSA_CRYPTO_C. * @@ -1963,8 +2235,15 @@ * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies * an alternative header to include instead of include/psa/crypto_config.h. * - * This feature is still experimental and is not ready for production since - * it is not completed. + * \warning This option is experimental, in that the set of `PSA_WANT_XXX` + * symbols is not completely finalized yet, and the configuration + * tooling is not ideally adapted to having two separate configuration + * files. + * Future minor releases of Mbed TLS may make minor changes to those + * symbols, but we will endeavor to provide a transition path. + * Nonetheless, this option is considered mature enough to use in + * production, as long as you accept that you may need to make + * minor changes to psa/crypto_config.h when upgrading Mbed TLS. */ //#define MBEDTLS_PSA_CRYPTO_CONFIG @@ -2019,15 +2298,17 @@ * Enable parsing and verification of X.509 certificates, CRLs and CSRS * signed with RSASSA-PSS (aka PKCS#1 v2.1). * + * Requires: MBEDTLS_PKCS1_V21 + * * Comment this macro to disallow using RSASSA-PSS in certificates. */ #define MBEDTLS_X509_RSASSA_PSS_SUPPORT -/** \} name SECTION: mbed TLS feature support */ +/** \} name SECTION: Mbed TLS feature support */ /** - * \name SECTION: mbed TLS modules + * \name SECTION: Mbed TLS modules * - * This section enables or disables entire modules in mbed TLS + * This section enables or disables entire modules in Mbed TLS * \{ */ @@ -2037,7 +2318,7 @@ * Enable AES-NI support on x86-64 or x86-32. * * \note AESNI is only supported with certain compilers and target options: - * - Visual Studio 2013: supported. + * - Visual Studio: supported * - GCC, x86-64, target not explicitly supporting AESNI: * requires MBEDTLS_HAVE_ASM. * - GCC, x86-32, target not explicitly supporting AESNI: @@ -2066,18 +2347,26 @@ /** * \def MBEDTLS_AESCE_C * - * Enable AES cryptographic extension support on 64-bit Arm. + * Enable AES cryptographic extension support on Armv8. * * Module: library/aesce.c * Caller: library/aes.c * - * Requires: MBEDTLS_HAVE_ASM, MBEDTLS_AES_C + * Requires: MBEDTLS_AES_C * * \warning Runtime detection only works on Linux. For non-Linux operating * system, Armv8-A Cryptographic Extensions must be supported by * the CPU when this option is enabled. * - * This module adds support for the AES Armv8-A Cryptographic Extensions on Aarch64 systems. + * \note Minimum compiler versions for this feature when targeting aarch64 + * are Clang 4.0; armclang 6.6; GCC 6.0; or MSVC 2019 version 16.11.2. + * Minimum compiler versions for this feature when targeting 32-bit + * Arm or Thumb are Clang 11.0; armclang 6.20; or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * This module adds support for the AES Armv8-A Cryptographic Extensions on Armv8 systems. */ //#define MBEDTLS_AESCE_C @@ -2196,6 +2485,28 @@ */ #define MBEDTLS_BASE64_C +/** + * \def MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + * + * Remove decryption operation for AES, ARIA and Camellia block cipher. + * + * \note This feature is incompatible with insecure block cipher, + * MBEDTLS_DES_C, and cipher modes which always require decryption + * operation, MBEDTLS_CIPHER_MODE_CBC, MBEDTLS_CIPHER_MODE_XTS and + * MBEDTLS_NIST_KW_C. When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, + * this feature is incompatible with following supported PSA equivalence, + * PSA_WANT_ALG_ECB_NO_PADDING, PSA_WANT_ALG_CBC_NO_PADDING, + * PSA_WANT_ALG_CBC_PKCS7 and PSA_WANT_KEY_TYPE_DES. + * + * Module: library/aes.c + * library/aesce.c + * library/aesni.c + * library/aria.c + * library/camellia.c + * library/cipher.c + */ +//#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + /** * \def MBEDTLS_BIGNUM_C * @@ -2375,6 +2686,8 @@ * library/ssl_ciphersuites.c * library/ssl_msg.c * library/ssl_ticket.c (unless MBEDTLS_USE_PSA_CRYPTO is enabled) + * Auto-enabled by: MBEDTLS_PSA_CRYPTO_C depending on which ciphers are enabled + * (see the documentation of that option for details). * * Uncomment to enable generic cipher wrappers. */ @@ -2405,6 +2718,15 @@ * The CTR_DRBG generator uses AES-256 by default. * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. * + * AES support can either be achieved through builtin (MBEDTLS_AES_C) or PSA. + * Builtin is the default option when MBEDTLS_AES_C is defined otherwise PSA + * is used. + * + * \warning When using PSA, the user should call `psa_crypto_init()` before + * using any CTR_DRBG operation (except `mbedtls_ctr_drbg_init()`). + * + * \note AES-128 will be used if \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. + * * \note To achieve a 256-bit security strength with CTR_DRBG, * you must use AES-256 *and* use sufficient entropy. * See ctr_drbg.h for more details. @@ -2412,7 +2734,9 @@ * Module: library/ctr_drbg.c * Caller: * - * Requires: MBEDTLS_AES_C + * Requires: MBEDTLS_AES_C or + * (PSA_WANT_KEY_TYPE_AES and PSA_WANT_ALG_ECB_NO_PADDING and + * MBEDTLS_PSA_CRYPTO_C) * * This module provides the CTR_DRBG AES random number generator. */ @@ -2523,13 +2847,8 @@ * * Requires: MBEDTLS_ECP_C and either MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C * - * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init() - * before doing any EC J-PAKE operations. - * - * \warning When building with MBEDTLS_MD_C, all hashes used with this - * need to be available as built-ins (that is, for SHA-256, MBEDTLS_SHA256_C, - * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by - * this module in builds where MBEDTLS_MD_C is disabled. + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any EC J-PAKE operations. */ #define MBEDTLS_ECJPAKE_C @@ -2588,6 +2907,22 @@ */ #define MBEDTLS_GCM_C +/** + * \def MBEDTLS_GCM_LARGE_TABLE + * + * Enable large pre-computed tables for Galois/Counter Mode (GCM). + * Can significantly increase throughput on systems without GCM hardware + * acceleration (e.g., AESNI, AESCE). + * + * The mbedtls_gcm_context size will increase by 3840 bytes. + * The code size will increase by roughly 344 bytes. + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_GCM_C + */ +//#define MBEDTLS_GCM_LARGE_TABLE + /** * \def MBEDTLS_HKDF_C * @@ -2663,7 +2998,8 @@ * * Requires: one of: MBEDTLS_MD5_C, MBEDTLS_RIPEMD160_C, MBEDTLS_SHA1_C, * MBEDTLS_SHA224_C, MBEDTLS_SHA256_C, MBEDTLS_SHA384_C, - * MBEDTLS_SHA512_C. + * MBEDTLS_SHA512_C, or MBEDTLS_PSA_CRYPTO_C with at least + * one hash. * Module: library/md.c * Caller: library/constant_time.c * library/ecdsa.c @@ -2719,7 +3055,7 @@ * Module: library/memory_buffer_alloc.c * * Requires: MBEDTLS_PLATFORM_C - * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * MBEDTLS_PLATFORM_MEMORY (to use it within Mbed TLS) * * Enable this module to enable the buffer memory allocator. */ @@ -2794,6 +3130,10 @@ * library/x509_csr.c * * Requires: MBEDTLS_BASE64_C + * optionally MBEDTLS_MD5_C, or PSA Crypto with MD5 (see below) + * + * \warning When parsing password-protected files, if MD5 is provided only by + * a PSA driver, you must call psa_crypto_init() before the first file. * * This modules adds support for decoding / parsing PEM files. */ @@ -2842,7 +3182,7 @@ * Caller: library/x509_crt.c * library/x509_csr.c * - * Requires: MBEDTLS_PK_C + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_OID_C, MBEDTLS_PK_C * * Uncomment to enable generic public key parse functions. */ @@ -2856,7 +3196,7 @@ * Module: library/pkwrite.c * Caller: library/x509write.c * - * Requires: MBEDTLS_PK_C + * Requires: MBEDTLS_ASN1_WRITE_C, MBEDTLS_OID_C, MBEDTLS_PK_C * * Uncomment to enable generic public key write functions. */ @@ -2869,15 +3209,10 @@ * * Module: library/pkcs5.c * - * Requires: MBEDTLS_CIPHER_C and either MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C. - * - * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init() - * before doing any PKCS5 operation. + * Auto-enables: MBEDTLS_MD_C * - * \warning When building with MBEDTLS_MD_C, all hashes used with this - * need to be available as built-ins (that is, for SHA-256, MBEDTLS_SHA256_C, - * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by - * this module in builds where MBEDTLS_MD_C is disabled. + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS5 operations. * * This module adds support for the PKCS#5 functions. */ @@ -2908,16 +3243,11 @@ * Module: library/pkcs12.c * Caller: library/pkparse.c * - * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C and either - * MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C. + * Requires: MBEDTLS_ASN1_PARSE_C and either MBEDTLS_MD_C or + * MBEDTLS_PSA_CRYPTO_C. * - * \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init() - * before doing any PKCS12 operation. - * - * \warning When building with MBEDTLS_MD_C, all hashes used with this - * need to be available as built-ins (that is, for SHA-256, MBEDTLS_SHA256_C, - * etc.) as opposed to just PSA drivers. So far, PSA drivers are only used by - * this module in builds where MBEDTLS_MD_C is disabled. + * \warning If using a hash that is only provided by PSA drivers, you must + * call psa_crypto_init() before doing any PKCS12 operations. * * This module enables PKCS#12 functions. */ @@ -2956,15 +3286,27 @@ /** * \def MBEDTLS_PSA_CRYPTO_C * - * Enable the Platform Security Architecture cryptography API. + * Enable the Platform Security Architecture (PSA) cryptography API. + * + * \note In multithreaded applications, you must enable #MBEDTLS_THREADING_C, + * unless only one thread ever calls `psa_xxx()` functions. + * That includes indirect calls, such as: + * - performing a TLS handshake if support for TLS 1.3 is enabled; + * - using a TLS 1.3 connection; + * - indirect calls from PK, X.509 or SSL functions when + * #MBEDTLS_USE_PSA_CRYPTO is enabled; + * - indirect calls to calculate a hash when #MBEDTLS_MD_C is disabled; + * - any other call to a function that requires calling psa_crypto_init() + * beforehand. * * Module: library/psa_crypto.c * - * Requires: MBEDTLS_CIPHER_C, - * either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, + * Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. - * + * Auto-enables: MBEDTLS_CIPHER_C if any unauthenticated (ie, non-AEAD) cipher + * is enabled in PSA (unless it's fully accelerated, see + * docs/driver-only-builds.md about that). */ #define MBEDTLS_PSA_CRYPTO_C @@ -2974,8 +3316,11 @@ * Enable dynamic secure element support in the Platform Security Architecture * cryptography API. * - * \deprecated This feature is deprecated. Please switch to the driver - * interface enabled by #MBEDTLS_PSA_CRYPTO_DRIVERS. + * \deprecated This feature is deprecated. Please switch to the PSA driver + * interface. + * + * \warning This feature is not thread-safe, and should not be used in a + * multi-threaded environment. * * Module: library/psa_crypto_se.c * @@ -3009,6 +3354,26 @@ */ //#define MBEDTLS_PSA_ITS_FILE_C +/** + * \def MBEDTLS_PSA_STATIC_KEY_SLOTS + * + * Statically preallocate memory to store keys' material in PSA instead + * of allocating it dynamically when required. This allows builds without a + * heap, if none of the enabled cryptographic implementations or other features + * require it. + * This feature affects both volatile and persistent keys which means that + * it's not possible to persistently store a key which is larger than + * #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE. + * + * \note This feature comes with a (potentially) higher RAM usage since: + * - All the key slots are allocated no matter if they are used or not. + * - Each key buffer's length is #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE bytes. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_STATIC_KEY_SLOTS + /** * \def MBEDTLS_RIPEMD160_C * @@ -3090,47 +3455,85 @@ #define MBEDTLS_SHA256_C /** - * \def MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT * * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms * with the ARMv8 cryptographic extensions if they are available at runtime. * If not, the library will fall back to the C implementation. * - * \note If MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT is defined when building - * for a non-Aarch64 build it will be silently ignored. + * \note If MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT is defined when building + * for a non-Armv8-A build it will be silently ignored. + * + * \note Minimum compiler versions for this feature are Clang 4.0, + * armclang 6.6 or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT. + * That name is deprecated, but may still be used as an alternative form for this + * option. * - * \warning MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the - * same time as MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY. + * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT cannot be defined at the + * same time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. * * Requires: MBEDTLS_SHA256_C. * * Module: library/sha256.c * - * Uncomment to have the library check for the A64 SHA-256 crypto extensions + * Uncomment to have the library check for the Armv8-A SHA-256 crypto extensions * and use them if available. */ +//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + +/** + * \def MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + * + * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. + * This name is now deprecated, but may still be used as an alternative form for + * this option. + */ //#define MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT /** - * \def MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY * * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms * with the ARMv8 cryptographic extensions, which must be available at runtime * or else an illegal instruction fault will occur. * * \note This allows builds with a smaller code size than with - * MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + * MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + * + * \note Minimum compiler versions for this feature are Clang 4.0, + * armclang 6.6 or GCC 6.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for + * armclang <= 6.9 + * + * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY. + * That name is deprecated, but may still be used as an alternative form for this + * option. * - * \warning MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY cannot be defined at the same - * time as MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT. + * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY cannot be defined at the same + * time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. * * Requires: MBEDTLS_SHA256_C. * * Module: library/sha256.c * - * Uncomment to have the library use the A64 SHA-256 crypto extensions + * Uncomment to have the library use the Armv8-A SHA-256 crypto extensions * unconditionally. */ +//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY + +/** + * \def MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + * + * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. + * This name is now deprecated, but may still be used as an alternative form for + * this option. + */ //#define MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY /** @@ -3164,6 +3567,17 @@ */ #define MBEDTLS_SHA512_C +/** + * \def MBEDTLS_SHA3_C + * + * Enable the SHA3 cryptographic hash algorithm. + * + * Module: library/sha3.c + * + * This module adds support for SHA3. + */ +//#define MBEDTLS_SHA3_C + /** * \def MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT * @@ -3174,8 +3588,11 @@ * \note If MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT is defined when building * for a non-Aarch64 build it will be silently ignored. * - * \note The code uses the SHA-512 Neon intrinsics, so requires GCC >= 8 or - * Clang >= 7. + * \note Minimum compiler versions for this feature are Clang 7.0, + * armclang 6.9 or GCC 8.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for + * armclang 6.9 * * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the * same time as MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY. @@ -3199,8 +3616,11 @@ * \note This allows builds with a smaller code size than with * MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT * - * \note The code uses the SHA-512 Neon intrinsics, so requires GCC >= 8 or - * Clang >= 7. + * \note Minimum compiler versions for this feature are Clang 7.0, + * armclang 6.9 or GCC 8.0. + * + * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for + * armclang 6.9 * * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY cannot be defined at the same * time as MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT. @@ -3297,10 +3717,38 @@ * \def MBEDTLS_THREADING_C * * Enable the threading abstraction layer. - * By default mbed TLS assumes it is used in a non-threaded environment or that - * contexts are not shared between threads. If you do intend to use contexts + * + * Traditionally, Mbed TLS assumes it is used in a non-threaded environment or + * that contexts are not shared between threads. If you do intend to use contexts * between threads, you will need to enable this layer to prevent race - * conditions. See also our Knowledge Base article about threading: + * conditions. + * + * The PSA subsystem has an implicit shared context. Therefore, you must + * enable this option if more than one thread may use any part of + * Mbed TLS that is implemented on top of the PSA subsystem. + * + * You must enable this option in multithreaded applications where more than + * one thread performs any of the following operations: + * + * - Any call to a PSA function (`psa_xxx()`). + * - Any call to a TLS, X.509 or PK function (`mbedtls_ssl_xxx()`, + * `mbedtls_x509_xxx()`, `mbedtls_pkcs7_xxx()`, `mbedtls_pk_xxx()`) + * if `MBEDTLS_USE_PSA_CRYPTO` is enabled (regardless of whether individual + * TLS, X.509 or PK contexts are shared between threads). + * - A TLS 1.3 connection, regardless of the compile-time configuration. + * - Any library feature that calculates a hash, if `MBEDTLS_MD_C` is disabled. + * As an exception, algorithm-specific low-level modules do not require + * threading protection unless the contexts are shared between threads. + * - Any library feature that performs symmetric encryption or decryption, + * if `MBEDTLS_CIPHER_C` is disabled. + * As an exception, algorithm-specific low-level modules do not require + * threading protection unless the contexts are shared between threads. + * - Any use of a cryptographic context if the same context is used in + * multiple threads. + * - Any call to a function where the documentation specifies that + * psa_crypto_init() must be called prior to that function. + * + * See also our Knowledge Base article about threading: * https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading * * Module: library/threading.c @@ -3311,7 +3759,7 @@ * You will have to enable either MBEDTLS_THREADING_ALT or * MBEDTLS_THREADING_PTHREAD. * - * Enable this layer to allow use of mutexes within mbed TLS + * Enable this layer to allow use of mutexes within Mbed TLS */ //#define MBEDTLS_THREADING_C @@ -3457,7 +3905,7 @@ */ #define MBEDTLS_X509_CSR_WRITE_C -/** \} name SECTION: mbed TLS modules */ +/** \} name SECTION: Mbed TLS modules */ /** * \name SECTION: General configuration options @@ -3638,8 +4086,29 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ + +/** \def MBEDTLS_PLATFORM_STD_CALLOC + * + * Default allocator to use, can be undefined. + * It must initialize the allocated buffer memory to zeroes. + * The size of the buffer is the product of the two parameters. + * The calloc function returns either a null pointer or a pointer to the allocated space. + * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details. + * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. + */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc + +/** \def MBEDTLS_PLATFORM_STD_FREE + * + * Default free to use, can be undefined. + * NULL is a valid parameter, and the function must do nothing. + * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). + */ +//#define MBEDTLS_PLATFORM_STD_FREE free //#define MBEDTLS_PLATFORM_STD_SETBUF setbuf /**< Default setbuf to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ @@ -3653,10 +4122,10 @@ //#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ -/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */ /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ -//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */ //#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ //#define MBEDTLS_PLATFORM_SETBUF_MACRO setbuf /**< Default setbuf macro to use, can be undefined */ //#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ @@ -3668,6 +4137,8 @@ //#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ //#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ //#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t //#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t /**< Default milliseconds time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled. It must be signed, and at least 64 bits. If it is changed from the default, MBEDTLS_PRINTF_MS_TIME must be updated to match.*/ +//#define MBEDTLS_PRINTF_MS_TIME PRId64 /**< Default fmt for printf. That's avoid compiler warning if mbedtls_ms_time_t is redefined */ /** \def MBEDTLS_CHECK_RETURN * @@ -3697,25 +4168,57 @@ * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the * PSA crypto subsystem. * - * If this option is unset: - * - If CTR_DRBG is available, the PSA subsystem uses it rather than HMAC_DRBG. - * - Otherwise, the PSA subsystem uses HMAC_DRBG with either - * #MBEDTLS_MD_SHA512 or #MBEDTLS_MD_SHA256 based on availability and - * on unspecified heuristics. + * If this option is unset, the library chooses a hash (currently between + * #MBEDTLS_MD_SHA512 and #MBEDTLS_MD_SHA256) based on availability and + * unspecified heuristics. + * + * \note The PSA crypto subsystem uses the first available mechanism amongst + * the following: + * - #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG if enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus CTR_DRBG with AES + * if #MBEDTLS_CTR_DRBG_C is enabled; + * - Entropy from #MBEDTLS_ENTROPY_C plus HMAC_DRBG. + * + * A future version may reevaluate the prioritization of DRBG mechanisms. */ //#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 /** \def MBEDTLS_PSA_KEY_SLOT_COUNT - * Restrict the PSA library to supporting a maximum amount of simultaneously - * loaded keys. A loaded key is a key stored by the PSA Crypto core as a - * volatile key, or a persistent key which is loaded temporarily by the - * library as part of a crypto operation in flight. * - * If this option is unset, the library will fall back to a default value of - * 32 keys. + * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled, + * the maximum amount of PSA keys simultaneously in memory. This counts all + * volatile keys, plus loaded persistent keys. + * + * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is enabled, + * the maximum number of loaded persistent keys. + * + * Currently, persistent keys do not need to be loaded all the time while + * a multipart operation is in progress, only while the operation is being + * set up. This may change in future versions of the library. + * + * Currently, the library traverses of the whole table on each access to a + * persistent key. Therefore large values may cause poor performance. + * + * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. */ //#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 +/** + * \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE + * + * Define the size (in bytes) of each static key buffer when + * #MBEDTLS_PSA_STATIC_KEY_SLOTS is set. If not + * explicitly defined then it's automatically guessed from available PSA keys + * enabled in the build through PSA_WANT_xxx symbols. + * If required by the application this parameter can be set to higher values + * in order to store larger objects (ex: raw keys), but please note that this + * will increase RAM usage. + */ +//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256 + +/* RSA OPTIONS */ +//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */ + /* SSL Cache options */ //#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ //#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ @@ -3827,23 +4330,39 @@ */ //#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +/** + * \def MBEDTLS_SSL_MAX_EARLY_DATA_SIZE + * + * The default maximum amount of 0-RTT data. See the documentation of + * \c mbedtls_ssl_conf_max_early_data_size() for more information. + * + * It must be positive and smaller than UINT32_MAX. + * + * If MBEDTLS_SSL_EARLY_DATA is not defined, this default value does not + * have any impact on the build. + */ +#define MBEDTLS_SSL_MAX_EARLY_DATA_SIZE 1024 + /** * \def MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE * - * Maximum time difference in milliseconds tolerated between the age of a - * ticket from the server and client point of view. - * From the client point of view, the age of a ticket is the time difference - * between the time when the client proposes to the server to use the ticket - * (time of writing of the Pre-Shared Key Extension including the ticket) and - * the time the client received the ticket from the server. - * From the server point of view, the age of a ticket is the time difference - * between the time when the server receives a proposition from the client - * to use the ticket and the time when the ticket was created by the server. - * The server age is expected to be always greater than the client one and - * MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE defines the - * maximum difference tolerated for the server to accept the ticket. - * This is not used in TLS 1.2. + * Maximum allowed ticket age difference in milliseconds tolerated between + * server and client. Default value is 6000. This is not used in TLS 1.2. + * + * - The client ticket age is the time difference between the time when the + * client proposes to the server to use the ticket and the time the client + * received the ticket from the server. + * - The server ticket age is the time difference between the time when the + * server receives a proposition from the client to use the ticket and the + * time when the ticket was created by the server. * + * The ages might be different due to the client and server clocks not running + * at the same pace. The typical accuracy of an RTC crystal is ±100 to ±20 parts + * per million (360 to 72 milliseconds per hour). Default tolerance window is + * 6s, thus in the worst case clients and servers must sync up their system time + * every 6000/360/2~=8 hours. + * + * See section 8.3 of the TLS 1.3 specification(RFC 8446) for more information. */ #define MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE 6000 @@ -3870,52 +4389,4 @@ //#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ //#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ -/** - * Uncomment the macro to let mbed TLS use your alternate implementation of - * mbedtls_platform_zeroize(). This replaces the default implementation in - * platform_util.c. - * - * mbedtls_platform_zeroize() is a widely used function across the library to - * zero a block of memory. The implementation is expected to be secure in the - * sense that it has been written to prevent the compiler from removing calls - * to mbedtls_platform_zeroize() as part of redundant code elimination - * optimizations. However, it is difficult to guarantee that calls to - * mbedtls_platform_zeroize() will not be optimized by the compiler as older - * versions of the C language standards do not provide a secure implementation - * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to - * configure their own implementation of mbedtls_platform_zeroize(), for - * example by using directives specific to their compiler, features from newer - * C standards (e.g using memset_s() in C11) or calling a secure memset() from - * their system (e.g explicit_bzero() in BSD). - */ -#define MBEDTLS_PLATFORM_ZEROIZE_ALT - -/** - * Uncomment the macro to let Mbed TLS use your alternate implementation of - * mbedtls_platform_gmtime_r(). This replaces the default implementation in - * platform_util.c. - * - * gmtime() is not a thread-safe function as defined in the C standard. The - * library will try to use safer implementations of this function, such as - * gmtime_r() when available. However, if Mbed TLS cannot identify the target - * system, the implementation of mbedtls_platform_gmtime_r() will default to - * using the standard gmtime(). In this case, calls from the library to - * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex - * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the - * library are also guarded with this mutex to avoid race conditions. However, - * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will - * unconditionally use the implementation for mbedtls_platform_gmtime_r() - * supplied at compile time. - */ -//#define MBEDTLS_PLATFORM_GMTIME_R_ALT - -/** - * Enable the verified implementations of ECDH primitives from Project Everest - * (currently only Curve25519). This feature changes the layout of ECDH - * contexts and therefore is a compatibility break for applications that access - * fields of a mbedtls_ecdh_context structure directly. See also - * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. - */ -//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED - -/** \} name SECTION: Module configuration options */ +/** \} name SECTION: Module configuration options */ \ No newline at end of file From d8d96b1efa3932f9815632a5afebdfa527745e59 Mon Sep 17 00:00:00 2001 From: Eric Schaal Date: Thu, 5 Feb 2026 09:29:30 -0500 Subject: [PATCH 4/4] chore: rebuild libs --- .../riscv32imac-unknown-none-elf/libeverest.a | Bin 2782 -> 2466 bytes .../libmbedcrypto.a | Bin 1032206 -> 1054828 bytes .../riscv32imac-unknown-none-elf/libmbedtls.a | Bin 636310 -> 659840 bytes .../libmbedx509.a | Bin 119856 -> 134154 bytes .../riscv32imac-unknown-none-elf/libp256m.a | Bin 1918 -> 1710 bytes .../riscv32imc-unknown-none-elf/libeverest.a | Bin 2710 -> 2394 bytes .../libmbedcrypto.a | Bin 1030358 -> 1052884 bytes .../riscv32imc-unknown-none-elf/libmbedtls.a | Bin 635878 -> 659408 bytes .../riscv32imc-unknown-none-elf/libmbedx509.a | Bin 119664 -> 133938 bytes .../riscv32imc-unknown-none-elf/libp256m.a | Bin 1870 -> 1662 bytes .../xtensa-esp32-none-elf/libmbedcrypto.a | Bin 907990 -> 909936 bytes .../libs/xtensa-esp32-none-elf/libmbedtls.a | Bin 430242 -> 446692 bytes .../xtensa-esp32s2-none-elf/libmbedcrypto.a | Bin 907990 -> 909936 bytes .../libs/xtensa-esp32s2-none-elf/libmbedtls.a | Bin 430242 -> 446692 bytes .../xtensa-esp32s3-none-elf/libmbedcrypto.a | Bin 907990 -> 909936 bytes .../libs/xtensa-esp32s3-none-elf/libmbedtls.a | Bin 430242 -> 446692 bytes .../include/riscv32imac-unknown-none-elf.rs | 24981 ++++++++-------- .../include/riscv32imc-unknown-none-elf.rs | 24981 ++++++++-------- .../src/include/xtensa-esp32-none-elf.rs | 24981 ++++++++-------- .../src/include/xtensa-esp32s2-none-elf.rs | 24981 ++++++++-------- .../src/include/xtensa-esp32s3-none-elf.rs | 24981 ++++++++-------- 21 files changed, 65465 insertions(+), 59440 deletions(-) diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libeverest.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libeverest.a index 48d2594292a26ea5d6267a2f6537de28d91f1248..34762f3ad5f50ddfea65b3fd652555f33d9b8e11 100644 GIT binary patch literal 2466 zcmeHI-EPw`6n1C_C|7#~gSZ$Mb$-^44NcR~w2h0x6}tnasbkudq={lT8VHF!01v?9 z@d}6s80RE*NUNch-c8z(j?Z`OW1kcIbNu8mEco=ucIdLWEw{$)meT!Zd}I?X&gvpf z%*|l8Niwouhdc>R7DXxi!N5BRW?4KJ5#uZy&m3Enq7YJPm(pe;EZnYZuivjyy>M$w z>B#|VpO)ONZh{p>hBw_PR33mSWq9;|zKM{r>7=%#-dom%N4(}a9WBquv-5dY; w-ky%Uo%i2iBXKY9dA~95|Mg&Rd=HTGtM?#*J|lQuC}>gd`aQt6Xq|iT2dbjP;OVd=bTPg3L zUk#4@0^{(dkn?n~D%Of8N$(`R$Y%>RWs>ESi*Bgas!-ZgG>ZI`S7-wmxqn%U+uCWt<8^lF)}NTg`g}gvfFW=7p9e zk^)Vc$L6J;ZyUb-sC!!*y8&pyjk+6otHJjgyxrh80sMgjF#SF=VuIEb)}A|L)TIG7 z6-EG?Xbnu}S*8{^w#bcQ!_k|LHbTAwR-O$L#uT&3$|$|D;_u0QbkqJZtFqbWR1q|8 zw+DzR&h54t=g#l}#@xC_+@oqf_dIAmhY^-*(VR(zX^h&`8h>@`p5X}Qwsa1P8##j3 z#gTP;BKKG9pRiNT)ahyMW5>7D?-e2R@y0s@s^;dqi`< ztae6!MPu&3|GmUur?Km6tSoiayWzCc)Y$13jdkmV%hxVjs;;bK+|}4W*Re0SCgo$l gd%HT;qKdKYw_>L`U(5c7x^}PjE#9WN(H7191PSym4*&oF diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libmbedcrypto.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libmbedcrypto.a index 688954f4e819f5e1edb4eab4c418d5b3a06d6009..a5ee76f6c347cc4973ec4b3fbec2b367111ff373 100644 GIT binary patch literal 1054828 zcmeFa2Urxz`u|(aFhm7(#2gS56%~~+N3uDrIpZ)4K}izK>w*KQC>RFNRoATRy5=$L zx~nS)n9((0Sl66$)-~R5bx+T9_Y9tM?(h7cdwq<-^41dl3NSOb{msOo*V)dV1e|IBRWnG_=h}FMw$!bND|LPU? zJCPYKYjT`eyd2vS>$0vMZp8XOxsnTs^?&OsJVmVk)9XcZV*MXpa)(po|MumxmdO8; zYu4{X{=e+98Mv6(*)}Zu^4Ll2_$%!ivHN$f6L!Rozb+#Ge{k88%cRV!#xKNPdbQX@ z?El+Wd~;&|uddvx#NN_XIE~o<7cYm7r-)lSNAaDD80r;6G!Pa{u*(d(6a1nUOD3U|6l)~@Dak@AYBWoks7V^9nH-{tRf`HRn8P$;GcBTw9D*oeuBg}~O+u_H znyonQk}x^mRCiG%a)}~oOIb^ZMja}u9A{OBitEN%Q4LFJ!$Vv6w6z>z$s8AM@s3Fe zq9PJC(cvLUnnY8BR0&Zkiw+Xlh2CM)TWBOrF79P&5qBQ7Sn!0vENQeLM%WN)w$PHq z*cKrXnxv3uO{}TWyfH}?VQvhKi;Fh5qL0mun%LwRb8Ad|l({i9Dk(83Au3jK!=wb& z1WiJs22~%QjB%w2i3|Tq=8)LrXi4Ra8O3hpn`n%-RIVyoQXT3k7%kj}mL3wTiqV9H zgsGBL;yOwqL!zUEgNatfQi_noNL6%n+(b!PQL$lV-e_V%RFcNLFFCVWZ*t}Y)x?m{ zb0qvfPLxR<7e85K zFe^41i<>9~o!9WO$c8j#w&+CDfs(gmI!wiIGv^ zSX?aFOthhGp>(@cV| zVNZ+;7xye5ksM1WhsYlhYLpWf78N@oBreQ^PZS-3C{fbzsOadB1XXNUoM~O9=`5IN zakM7VB6+)Jf+iMCqFE!v^)aLn-PrQ%S5v&Gqo;_HvPKIN!(fll#D+zwVndSRLL%b? z%OGtAn2#+Wp7EgK2mNLa&~%VLcw(u@IY6g$=>MmTx=4@A_)N5n#6Fi=GiDR zX=F%(Pl$y<&1NoZxU!KJ#w=^+XUfF5gmKV=5KA#qFi_tal9^YG&tF!hCSz;f-?h}S5tr3rB{Ux_YbimRa)qobvp0Ham3*cq)BHfGW|;oid- zXTJZCL)yABQ*))?VXylMa724 zVPu06Nt5GEYlK;>MCX~sPf$fCYXoDSFI~WHLmsjJxpeS-vWZ@XgwhT%CJl+2U~(#F zP0%2<)X4XaVA64^rNfM~a-9+qkM&GrmPOiQrpnOtbUlEmG4mg{_KM~!myu(-r3ld> zl))2hkMko#xa}0i8|JrYTWW|8)6nWCMa9LM^$^`#g+#~2jZ2OPSFl}_Ix#UhK0YoX zN$3$Qu$mYsV^dPz0_P^IMpNNeLlg384`Z zF!5ILwBW7q0?OBfMX71;Vb7L`BN`RXn~c>^3zOmuBLTZix&&EH5F1C&s>+O}t;V4P zWQZmKGupfisWbVTa~aLk)8fpnoWu&5h?5sAiDf1*&uH$|FzJCbHHdr(gHr5s)*?+4 zLeHUDcjHtv$+S_Y<5t1Ah4!UWD%#U~3`j`tgfmtZlXc-oIjGnd$;6%F>_ z$$?<;q2-7N7YwKYIEyGzrOlnAQHMo_sId(Vi!-KVZP=cM#EUDyrHzY;PlmF@nJh3N z%|qK5kF!m&UF3bX6nI163DzWP0&B74N;blh@7W02s}kP}O0v)zOa5nbSaLKX67dYe z%vmtf!#xU1D%?bi8ka|O_GdCdB4gY5)m&^6;R?*<#R5d~HxDJzaJ*_H;D;*K>)CF{anMWA+A-c1FVndzcH&sjw6i%K-NarF{PU{j;H*(iSIVv6Mk4tK&Wx(!z(o7qAv z?HD$WO(x1nqqtHn$FbSOOC7C_u|z|k2-gTMmMhdeCq0z2j4F&4_N)reo+gNgwJ|0+ zR2m^X{G$~^n4Tz>bq6k5<$K(;&hO@Ra7s&aqQ}7rVdOKf=*G3-HbCy?CnHlT1F3-J33Bq z(82FD#FN~x0TE9@gOPS?Vq9{9VE4ioV%Vz3sA7`^+YUZ9LY0K`3sW`unwCdtI`w} zsw69L}O4CBf1qA6BR>eH=k8FRJnL= z_Lm(`u>u%lcVU7b)!SiF^f24lT&^&Q!lezeTxX+QQe!BOuhbXrVOhl&DsD|;h~)M$ z^bo`1$tD{kIF&?LR1t*L(L%)t14f--dqfT5X%35I@WUdR&M~H$gh)!{M9~v@&L$F4 zNLR*~K#WKRB5Z1|hPp=iOa zT8WVw6V^)F6|Kzrg1)dKdg{VXT>6F|%^sf+r`9BzP5`LQtj@R#rjg(w3sQ+{Wj;NT zJSk+{L~(t2qhuN2&7x7o8z&|R-X!6T$*~sA=GDMkOzg-}CE?sHF_KPhQMdB(lUg-z zN0~0x<$Nq6@T?ohe3(Na$%!h#V|G4?T7zTU@F+Dq_v3IH5+yj>=M!Pa$-Z=kV;<9K zi6qkKSKdzl4aGqlm)9&hejF{*%xuV2Myy6n_dsQ3DkGLN)4K^aJd#>|H4T6EZlSsu z>R)MvfCT*gq;rF}$B$Ddw(tpw55=QH3-`fmjM!(=({IrmiZnO7aW5l2ULz4R)WGdL z#P8ctyJ#3w11DA`Z|0$AL`xIG;*2!jB9D<$j91#riz``Ce(S(>1 zQK2{qGfjR&tO%(Fo8&bRSPg3rXc8A9TzwHmw~3rTEkzg>Io98j_^+G_p;*a^WweNP z2e8tE9gDjmL!5Ek^J#_0Q?MDH3kj1M9wiA)hFym6n1{_9nrxblFi>}kkOP}WP0v83 z$Ekt{;aV*)!*i5CoaYiuI~%hk#(L5bL5GpifEOcBg1HHYs1hSRDioOvqf2Zw%{SvM zOeRUkurrfA=TXsTGolPwi9$7rK9+1|rO>p{;6B`%DegRVq9|5Up7{a+*KsG!c$tKA zuON#dO41u#dc!D|#2NRcU$J9+nYKx|zj5ztIl|EC0Ew_>rcA;J=+Edl)6yaa3Unzw z4`fFkmrz0+K>~qzi|5Tr8dXAA+(c8q(SslQgps~sA-)yfCTO8-E>SD=IX-K(oK~Vz zjHxAR#AugD5~E%C#L;Lpbv%e;fMQ6b3X(<;=GG^pmpQI+f|5;!XDFKu1oT($d&IpgMpfK7BtfF*+`ZyAvfNoq;%(#X6gEnBO2O_A7ViB8@j^mm)Nd zEroVCUNEHxIJ9DHkXuTPLBnV>h7F_47&fdy#;}@unq(@E8t`CAU|{z~Gy^>jFx{Po z*po|CnhEkrtitM^mW8Wo)s6>ExMePd=dBxjQu zDr%_&LzGz=;w<8u3CpAz*{~{ca!iZ{Iz`RDvL!Y1Yc=&RJFF6tV^otu z;^Gt8OyXEN8-%f}H`ofZ3wCmhF`uw8(l}EtmR{_AOg8HLXbtxLv~ni1X$T05HWeVW zii!|MaE0){Df@csg{e%{5Vl2_LU@<5(wIu&sx8cKiZfQ;a(hu!gcy2F zm`q_oyV)#U7qRi|Qbr&8v0_jFMo9!6gKAa0N=;uOp*NDm)2e+f-mqAOPNq8@*4xSW zHBAg#4Ev}ZGc*Ce)5POsy!E9@#{S8|T@0nrd#l;}{~{4prC%+^QY@MR;bkEkx2Tz# zAaMZ~O#v4HX<24|**gTr3@Y=Hi1%!GeQ*)(WO%x0$<%&o?;Wq2E$*1~9` z$wiC4C`RB=k)8LU&}dX=w0!okpT3NV=jwtmyRR06!!XG3GAH|NosOn>{FVvtq~k;o zFMa(R>AsdGIg!35`t@>Xny-}+uld(y&@^8w!$6h9Wc+N9O~*(1St3*Xz$j(2Lxw!JNj2ca7N$(R5dC z9?1@5?k&!;n{OzgYzOe;i1wA>fPqdnu582F#@ASIS4mq0G3MQ8D9loai>t^EANE+> z(&oi5v*}@QJmwG`VH7onjTig4fL242%>22Cg+#P00~TqS#y+4)=@V%BWEY1_c-1r! z6qOuk7}5wfF+zXQ?1Jr88Bu}_ku*h_K;&L3GAc03l{OTNwNG$T$kv!1`3OXmC_DA5 zaUFmM!c0H8pe_jy#|e_TV}&(mlayI?Hnt3hv2mgbh^ofQcJndDnmGartHGMZ53Fbd zShIz}&Dt#tZLS!@?oU`g-Da6r#<*=WuaIe9X3%TW(k#@sq+^3r$g!E#Ou#Km)O5wT@pqTw}O+FdkXd~yN~8>F2_YmM!mq0uZM*he&Y z$1{MnpJ#FXS#^Fx%jKkg(Vg4)vm8I2^{IrqdD;2;fN_dRR zMNs!40`Y8JY1Iu6q`Cft!T8#O(UO=L&7CnCEocopXzAMxriU{LIN^&4YtdTrdoq)m zmBDBt}gZ9}Jk% zn%z(IY>=j-qSWxiDNz;ZD7E;5Dw>H#N*=B9X2}CR-b}YL!ggDJJ&~q1dRzRK9gX5R zD=LS+iHD;Tkqt@ldxtoc269O9hlXe=Tr~SMDP%&6Ru3<%m`-Opi8E z9)gzBDcf2q0PatuKW3xT8E+_rVq?yaWnq-$r3Uk;kZ|E2RpR5hi5#wBe^No3N&nEY z;O{J3`r5j6OM`igLny{4PR{A?=)Kk6aiL?I@g~d;a|?x@(aK5|Ztut2@at*(k3PdQ zTDUzZ-R~Jq_=zTd--kDMFpzj7-C?mW^Cy~HLSi+>yYeqP;vUg_O75W=zlUTW=J8R+ zN1@3{QO5LC*Kh|>#$-kddroS>EN-W%1iZWzg*sWtA>P6!QsPj>6Q#D07Ol5nrJE=V zX1b5DV8$lGf|bg93uer63)VzSNvXKSgO^x5bfTw^ma^eb9U)d2gTE+-H_)PuHcAz| z=MoaBiKgO{Ps$Hy!%#Nb9k9$8(r`nytiK)Jx+OQ3m92c*_^?UGID8k>E0|#z!haa@ zl9)n-xJ)N(xFwsQA?b;b!X~9cYETs!ArVAIn0%c)r2-$Ck)p669>Q3^3O2>=g*KX1#%)Qu1~bZt;lLy{oNtN-{ywRpzKlEE(a^vE|9BTsxX^_ z)Cc6usvtG_h13lCM!rW*h%Q}D_SoUyS$0G*E8Qx`ud1KcJ^hQ!qv(tN;2WZ=V#_Eh z&m_9RGa1G7x6aqKsu{(3!OM#m1?OoG*%Dc>4en_}WPO~7{?JR}Zqq5dz$Vm5f2f#Q zAm2VuSv-X3gAWpY!5yNol`|vrU5W-4c{ChE+NZ1M%Nb_n_8_$jts#Pg#71D7%)Bk@=O1`W00@q71%?I+rr=HPi1% zr4xKjnL#sBWX;midqGxhoY0F-PNWS+fkGxD3cC_U>*++a9&(~>nEplU4*wP3VRVaR zjAD_NC{R<~>zCAj+Uj{ra+fTszKHc-SA!3WKSNr-{DnM52?+t!PV!o~Ze!ce>ieiD80f zq(qJP@T^eLqh4x75BCKXJ>2RlJiJ>}@R{wMwlS?6I}3F7ek3)BAJrbKtw}esI=x2* zZ}FPVTz3zu80;X|xdxLyx!$?uf(8av?LM;m`~!0f&lWB|tV>U0E+4kFJHyK8-97NKPAen4*LTcfTooB|rs_AkiSR%rc%afuqSEeObUj6t(t6SE zoYpzC)!IU9A`8R?FJ#*0Ey}cZuy(Lr7O*6zc22^gG+*LdHDKMmy7M~CTb#c@UO}#& zUqloc@4l#gt1>Qr^Yi=poyvC!nqSl{=x|Xtc*!(_d!%dK@+->V8*M$min2ybMQx+} z3WHQLQn>l>9xjZl&n6!{^-%eCB>%;OA9U?7=0!5a`>gO7h+3yq{tf5u^q&* zhBD_+eIhGt1uw%^Jc!5+YKZn=GI6)XoU>kSqYuU0k9|dyPx6o^9cgok?9e)--9`Lm zH)QVC7>zc{n`)w0=O9H9N<2p{X3GxUCfcIc;8@W-`@Xsr4GGf8FJ>uiUo*;EqlrH3 zAfvxG0p-3XHM{oeTB)bjyDOtVKGQf}lqYhHV@Q9nGGip%z^c9~Tm7*TrVW^4LL1pXdx$e0tSFb|F>yOTgVKGE^@g~t-nZqcid~#NtRTJIWheUC8F5@7to@?h< zDM0JhmB<>;B(f%lh`#SRqQKnNO*qm;_xeZ|2M0w`VHe%2!Y+Av#ktj&RL&{R$?>1- zr)_}$RE2Mvuky%lqB}Q^=#LBm!5$H1j~t>Ko&~CXz`df0Zs230`%8;^>0TFg(Y-0| zl4;AASUoo{w>WRfB3h=MpLUI$%=KRuKzwt2^}RHV@`Rq~56oorfoD-WTSnHTE2H(8 z$!MD%Vltf^oHHFV9SfHGuP9hjuvE4dwDNW)vaJq8`=cY#7dK;+Mco;F(I!S;IG^ZG zW)QvaIYwD>o7p#4_x6jk;^G*r15b$V^D}2fNGxX5l10k`6lZS{-DL3iQW()6jbIdi zJtew{@C2>5lOp+K7h3ncMX2@i%DKTg%K~!zwdAIx#$?J1a_9Of&dp<5W$Q{)FiQ4d{$<0rnKqen|J;H+JHLWlT9&f+ zTC7mER{Dcyh`#4;;*NFcM`Cj-;k4)3g}#c<7#ATiL_x>J#W{>F`IEEms+uS+JtVqI za~Z`O^nd9%qC5YHC|-SVc5up+JJ>i_>#Z?Xo%BTMbdb2~bc3?c&S;`Q4^z+RzQ8+Q z&_1+LpRt|3daJPVt@VUo*hk-+!sB;UPxf3o{Pmzl}9UxV1IWHia_SguY(yOtkeKh-@SJ zyBWgu5N=?P{>SAlBeL~YM7GWjW5N;M+&5R*eLYr;ND#;n$#MjQM)P7yB&$ynVbVj+(NLTJG z(L3f~1uVhki8_@sK4*1)r<5_Yl&UYz@9R1jQwJ?t*ax} zfpSE43|b=K9FY~l2gQy=dlaiLRSHMef?B#7){Hg~TBZn|2u6xS&R8?GL6{?j@K*tR zQ({l_-S!iG(M=NSs1LqKlzkTyce%ffVmW4AVKP(T5DKmpSlw_^25lv}s~FE0GKlhM z7^5#9%qRC(naSj*Dh8)B{fpZl_B`r!++&6tvt|ZiJhZ3C8tpT3J;furiS7|iGfV=Xv36FdQ5uomdB z?od+bM$mP~v=-2ng))_23-WS;1#3Z?ZzW%4Zw;eo*Mdc0x@0YAV!jq=u@=ZE54M00 zTe-DBPuGI3`;dPnT9rriCop15&NF)7+l=D1a5caRc{Pr3Dhw;G^LJv8iUph)Id z1D#>46DIRMmI2)tjbcHeT=n0fwe$E*8&^9 zWeQi`k+6sc4sk})&=l;r>wf! zx*^$&@^~JhtAXz9JSNi?D}i;vqJq2vc5O=YrK^DQ#A}um`kr})l^_-?fel>=rejoG z9mlN%!?0>&B~T2;s9;wDsC>E-48ck<=#gs@&f^`Ms2p*UU4=nM*no)$6fUXw0B@IY$j@}k4!BYPv`q>+Z5^KSZ z#c95?{L5in6)a)bg5%(9?{u;UYk@8eYr$sl4r_sI9bF5+zh>xfZ?LTa7`NUY?8jQ* z0bZ`P!g>MTZE&DGKZ$Ye4+2wVP_&C(4ZKTqZ@~6Naz>GpPOhi+3s7dB#U4bJqSx*u z`q{6Da&{W%cAQ-gUeonpP&&IFD8P7kdCji+IjGy5LZV7hrRp=0b{;q%^cmM}Mj3RD zt_W4IB7k^`q}R^=a;ykiefC+RoR@|bWc?y#Hqv8fsSF;Bt1?{==sMt1z z>GJfm3d#E1jX5qoeS2z~%w%LiX!B95iN~=&C~zdofc2m~)`udr{|J0k0)KRcf9M(! zXb-{{Vy&j7cb%sllUt_Sk2>i9j_$2|MQ?Lt!X zcciyA?(~?IqEOHdUq5C>O1tqkSKKdqUg~k7Pig`2&$1o`aQtDSG#3^zv`$cY2bdzqgL)ZxkbCPox@w(J~G> zrecp$U>$0^+QwfVYNNbo%LL6km&GcJ!W!h8ELm}5l+}T(wl2y>DYm1s^>-^W$_QJg zch;b6pF%IJ<(-fANly(Lolz>Nx571$^w0H^A59;ep$IV2~)W_#ddNN$rZr~Akz zY+Lx25|eFZzWJJU!5V*p6ZD!xs*>8u6lMXs^0h(W{NmxU%~4`b$SI zl$4%6TYCD^sVgNnj^8=@;P8{;y=n5UUWdJp@_o##Y$GRMbn@3;a~gh<%hPFk)>mp5%(p@RFgn-j#KvAx z{LdHN;P;I30a}w=lPJ!AWHRji%H@~WM`Ptdz4Z6*6GeIrGJZzgOr1@1fm9q>J`jWXpJy}oW zOSOxf_zlt);lw1^nrzQf+H6AUa=8aiFyz+Eb!H_KgsXy0iTiQSqdgAyDehl5xM28! z*0VRxP7kK@S$%Ccl!QIm7p%UPK?*YWr?t;a&1VWI>6vSN(od)NH;!|qJQMSY-b;>C zpGvr&N6KE3?%+Xo;clH~?M_qA5620i<=isl)T0DhF_*g$#>i2cJ7t|PcaVqMZ1Tc4 zH1KqwfA<~T-FqzTVbxQP(OL$ZW>Yq`GO&p$=sbIGTI)2gOr665qI5h&(tFB+upR_K zQw855+Td42)-8=_yXC;gYeA)*JTGpnBg&iLMNlA84J5LlFyu%gtL^9s9M20oX4E|W zz1>J*jl7j8F@ozMPfKv+Z%PdLpIOTA0fZ7msc~h_WqGsA@HyHar$z2YPf{=9+%CnQ zgr?J;QywoO9%MG7PMOSj%|#E|cM5g~9eG}?u}x#t^TTk;R~9SG``BkT@$VF@j?ZA% z0A^)s{{Bq(CUfI#rQ;s6zU6yIi*ro{`nDA@WZ2vLkq(T#vbs_vi9GH{>e4e!DqIblqUtV_s?mcxjWNq4il)DTTJqM zr5;eGFY{$q4o90!yv_Y(i~EWnIi3l%=zAC5m&<4(FjE z&f72^WIb6!-VhJw4q3yL62G9-eBJKK;L!NWsWWkAGmO! z)vy=cLwlU=;ooydPxoF6ds+1k!e~`6%Hn1q{?Mb!XI!F2VHaOB!I5?2lV%_i>pz2tn zvzFT_l4=lIZfFK`pp6Yu*w|ooUT++K9-d5lkA}Fsa5Z7t&now*if0CMjlciKv~WBf zuqMn(lchgvS?I8F$(5{G<>IR(RatE;k8fqSM#>RG!jg@Rqd3Z6aym4&l z$`zf`%}JlHC?DKUG26x^w})aNR_E$r7)uUzim5eO|MH$y6Gx+$`C14@mUrED9&W2T zc({-6;8AZu2c7FcZUH=pvEsfR zo*NI(4gU{4$6V9PJ4yUD*yuOYtW;Weg5Pi!W!>DC8+E*w|1+O8W_{L}kvj@~mfC|K zUu`g36^@QX_n|sFg7z4mcdAny3ICn<178Eh#p>{0cVm1>E}x=LuB^BSDhj8E^!dc0 z*VrK#o@pFjN3@4`VK*5>WCsV~8Hk3+N|LdYgd#oZO0*~IL+9YREcS&rY~8Ju4~mKY z+Fha#hiagzwYMvg^+K9nt%$$f4Lf&Pfh^R?-C23hj?qVA^;b_P`p~P4tZNX~tU)-* z)L>_tObVQD$lc3hk68{+d~d#Hl(8p>{>fZM`SdQ*rK9XzXo+=L>+rnA`i8Z;O@Tbr zR{02f?YK8cQG`;?5qJ=ln;CvefR}DYf&)DJE+605=O6i z#3=86WJYCqG|6x6;k}@>hufcRJ>31;d3dIF22VPBcwO%dzI5hi7UqT>?^)Wnm!MG` z$&+-2Ya`(M6Nye3faoqGVazHVn z5>Zqe0j4x&*t@x?=Q|k5emXroi|T6r{&&**Bdn{`libLmtwZgMC$?;ED@y6o^z}yV z$6VLTn{u1P0*e)`M2QvJ1Fe*Ut?jK8*VzMl+QMBBvAPu7(2(>Bfbg@y^7k&=#k zaPL&$Auqwf6v3l7;)2T!moKgqTs3gD#-*M%aq5e4aYfCUh{m7K|2*O7j3eK^AJ+BR z=CiA}E?b*$V9zI=XX`F+kGEWR`}z0_EnKY+c^s^oCtqS)G3Ca?20N1NwN0wmh#kJN ze}__iqnpjr2K-4LyM5d~V(hW~?RxYYdh*oMjUNJfE7ODivHGrG#}ymCS>roz;SX(J z|GxWDU6(H}PoF5KcoecIuu9>N(>sNYs+Kq=weMwjulcirpZrqk%4o;GuKBcg=x$SQ zWWkwDp$l?vO}=}$O-$CgK0iede)T{zWsBY3N%g&JuHRXF@9(5KJ@?JYjPJZFyqoNe zld9E_Uo-M+Ex-P5afPUh**QyV&%9qUsNvPQt7ez~^I#{ zGoX5vwFlcb7@gPQ=W)mC{1Ehf)BB-6_q-|7xix=3X!C@aH?xjUSn%4aSN*=X&wniP zI(FW(Rba}l&^7a}Y#-je{@xl9K@Xf3kNSMz`oU(&R;j(7Rm=)rv}W9ye~M-ELhiaQ zT$cMs%#??@{fAvTyI+0ZGZuZL91}X=yP)l16R-U?ZcEzd)Ri^=v1^_7G0o}UxXcqH_+x^c74ydmL(e)ih&u%T_UT?Mj?qNz*Hw6R;)yy46j z9)GOcVI>>8_i^PJBQsCdZ2aTooeN*uzIfIr>c%R~rB^3x+ExiZ) zu=?eomGaE%K5O4ROm@^hYUexV>BiCHSJ>=}b@`@q-OPXT{0bZSe|mAsITg>+v?#Hdq&l)SiSNM-Cl^>U0;yB6r`k;tFo*J?edX z`nOK+w*2E$;ZUPhF}0RA>v?%c^Oxl_`ahbOfAdshedXw%;(z_VLQc2$UGImvZ}>R3 zaOJZu)dzpup``=d_jrp29W`qRn!74?TV zec!>Q>bF1MTc(cvtHWea=gMe(|v=B-wTA4ux+dz+6lj;_Bp|I{|+j~85@ zTQBb6_vq5w?@sh{swSDsP{9I5Hha!1}kGqyDFBPSIup+s@#-e?7E+dsIhSU9Wlj@szIHJ1#qYb=aU6iCwBzDw&*ksLdY(-kx|6@@eCUtDWL1O$z)g zs&hWO*R_9RP>`02TuP*8u=40H7iOum%7q1_15?0J#9bLjd3s0MHZwI0FDQ z0ssO5fUy9;BmiI>0Pr^eup0oV0sw>q06PJIssO+Y0ALIN5Ci~R0|3$hfSLe64gfF| z0H_84%me`T0015UzzqOk2ms&(0N4TmG5}x+0I&`KcmV+H008y^03!i_#sI)V0N@z_ zunGV;0RWr>0O|k$nE=2K0KiHBzy|0Qdp`)B^w(0RYDVfQbOWJ^)}A0MHfy_zM8&3IN;(0FD3vbpC4rfNlW5CIFxh z0Pq0-7z_Z^1^^lW0AT#)u0H8epupI!v@6D0Q?RB6afG&0e}erz-0g+5&%#G z07n4;7XZK)0B{2Uz6Ai@0RR;MfEWOvCjjsg0C)rdoB{x%0f6rTfcF4^I{;7!08|G6 zE&u>e0f0jQKt2HQ831Sv0GtE>8Ug^G0Ki%R;1&Q-9spPh0E7Yn1pvT30AMr#@EQQv z4**O90Db}h^Z-By0N_UeAQk|a3INyx0IvW51_0Oq0B8V!=>UKo0B{EYxCj80003tJ zfKmWpD*(^}0B8;X8~^~?008R&fNcPPD*(^~0C)=kH~|370Dvq2pf><85CFIe0Nexs zY5)Mg007?s0M-D&C;%W40PqF?h64co0RSZcpa1~o0svD0fNTI@HURJh0B8jOJO%(d z0szARfGz;QWB}j~0N?=tFaiLm1OQ|J0I2{#X8@oH01yHIBme;A0Dw6FfFA%b9ssxk z04xIl<^upK03aR!NCE)-0e~L?01W`J762Fx0E`0wf&hS_0Duetcn<)?000vJfL;K= zc>v%T01yZOtN{Rq0{}Gu04D(80058-06YT#76AbN001EXz%l?}3IH$+0MG&ebpe1V z0N^kHFdG1v3;=Wn0LB9VeF1>Y0Kg^ypgjQ40|00N04M=~?*M>_0KgUiU?l+17yyU_ z06qZ#(Ez|Z0N@M&U^073zP&j7#x0ALURa2)`62mm|+0GD*yl&03Z_pumJ$%0Kh%~APWE( z1pu4{09*lp4*g0e}twz;pnh5dcsO0DJ@ho&x}v z0f2M>z#Ran007hj06GBxJ^;Wf0H7HF&>R5h4*=W*04f6jzXAZ=0Dv$6U@idA1psIQ z0L%vf`Tzib0syN407n2I6#%#b0AvFIe*geK000XCfa3r_FaV$c0Db`g-U0wy0e}<$ zKnDOc1pq1n0N(=u-vR(?0N^(OU=jdO6#&=+04xCjVgZ0V0KiEA;2r?56aZ)q0N4Wn z(*S@S0DuPokOKgO0|37R07n6UQvkpP0AMiya0vkD2LQYQ07?OXZ2&-T0Kggm*aZO0 z0s!g&0N(%r4*-Bx06-D|;0FNI0su|}0D}R5t^j}v04N6lR004x0ssvFfFl6FZ2(|9 z0B{umNCW^%0Dv|CzzG0gBLENw0Q?02yaWIW0f3eOfG+@W5CEtT0CWccasdDa0MG*f zw*Y{A03Zzj*bM-T1OSEr0FeLRK>kmM{I3rA-yZV61LS`l$p1}{|2-l9-5~!rL;lZ# z{C^Gk-xu<~2=d<(@_!fP{}ssp`jG!YkpH6~{|`d`r$YW`LH>_}{Fg!gyF&i|0r{T` z`F|Gje<|5uRz-$VX4fc)PN`Tq>^{|My&w~+s8$p71r|BE31Lm~gS zL;n8;`TrU6{~yTzc*y^GkpDT5|NSBVe}?=|fc(D+`5zAXzXS5W8RUNk)O+kpGU5|Gtp_ zqapwILH>7!{Lh2@{~PkZH{|~U$p7(>|JIQIV<7*lLH?IQ{?CT|kAVE&2KjFb`F|Jk ze=_9%D#-t7kpJ)K{D=Ivhy3?}{I3o99}W5c3G&|=^1l=0e{0Bp2gv_O$p58~|MejM z%R&C@Apdtl{?~x~Pl5bbLH-Yi{I3c5e*^OW0OWs1$p4Cv|4xwqFChP$LjG5R{2v1O zzZLTT3FQA8$p5#H|05y)10nxMK>p8x{67ZyzZ>%Z7s&tfkpKRW{|d`ClILej~~{BH#L z-vaXA3-Z4h^1l`2e-h;XN67zckpD`^|L2hZevtp)LH<{P{GR~%9{~A(9Pq6?{})33--rBe-84$8|43~VzqkRyJ^$Xo=lwh{hO&%v%b7|QNDEC zxP4dR;y8>Q6yiw?6P#w(O4q zYuCQLm5`9P^uU1;$$Rz`T>tc`W+$C)OD|8)vC*wt51-zpi{I_Y)kN1si*>dDJ z>(;&c^Y-nQ|2%(gcVql`-Om>;B!;$VF~G~!wTqp#b-CO_hx!M5cxZk&cyM&{s#P1d z$;(^iAeTEgTe4)AldY|Ny^0lE*GNfOdiBPQPA48d^z751LDY9UcAR*SoV=oZ zTJ7?oO`0UNtX|!_b&VQLFUQ92*g1UolMyRdepuVT|C>XFinO#v>jw;Y{p+89M$);P|M+neUpKcgH$Q%?GkN>=!@Ea}czky3*!@|@ zjs-{T-+wWoUAvw+J$hVO+^g5wZ9|9NOFwzC$8V=jjVpTk)T{5tjkh0v_)s|`AfRYT z@80LbmC8XC($jM?gMv=p|K}eUYbz_8&)_~@Z0Pa2K;<(D%JD^=?F!cJKaIIU5^?ZuRO#|1xsqtrZ0YqxPLS6C1E;)6>Gx(Dm&W zEZEQ@H+SusTesT0m^^vTxx06L<{Um85Zk8BuuCy9dzh@Ox!cd33tQHw&*|bczd+yn!Nwa#?uOBzk+dH9c z&6@RwtY7~;ap%rMi;9cCId<=!$Ev^oo^~%OX<6qwb?WBz?D@B9-@eP`=gi4)&df}| z79T%UJRTmtaelXM7i?rQ`P(;dn3_&b6$@0VHDg<~3fVGb$UjlP{(7oP zM#h5g^Ye$cuT`r-gXPPAy?Fh4+lTMoDH<bIXRUW~WR&YrEz$@#JA z(xtmQ)~@aDI&>ATd@3^Xml=M32OE9={kGvvn@+6l>|9~$wr$5Y3>^3|=C|KUn^dmc zejNai1^|2y0Av9G06zf$-vR*D0Dw>c;0^$=1ONyE0Db@f zd;x%&0Dvn1@DKnv0suGy0FMBG2ms&{0Pp|+_yYiV3jpK+03!f^0sx>U0I&rB7z+Rl z2LSv404o5XF90wS0C)uev;+X`0012TkO%+_006oG0ObIH{s4dm02mDbGz0)v0RYYb zz%Bs59sp0f7AgKrjGs5di23 z09*k8&H@1U0Dv9`eN05$+XDgf{d00;yC z_5uJm0f3hPz-Iv90058)0Bi;Teg^=$0RYwjz*PVs9{@-O0Mr0La{!<^0N?}w!~g)j z0DwvWKq~;C831q{09XwG90vf}0RTe)fENJ33;>`j0I&%FxC;O@1^{vafRzBiVgTSz z0N^_SARGXg4gmZN0B8Y#qX0l70N@M&&=CNb3;^5!0BQjM699k?0Ki}Xpbr308vytV z0B`^Rq5*(g0Kg~!AQk|43IMDJ05$*sYXN{Z0Kgmozy|;b004#o0DAy{xd1>I0B{-r zxCQ|11OVOx0JZ=?eE?u90FVs;+y?-v0s!X#fLQ=Q8~~620Mr8jo&x}f0Dx}*01p6Q z8UU~i0H_N9{0#tH1^_YufOG(0J^;de08kMCNC5zD000jGfCd1-4geq-0I&xDv;aU80H8VmPy+yn1ptNv04o82{s2G+ z0H72A&;tOC0DzkSKr;X!4FDJb0Q?C6(E0xu0B{2UJ^}#S0e}$zz*qp_7yz&z0B8pQ z^Z)>Q0RTe*fRg~gDFEOp0I(4N_y7O|006xK03`sB4gdrJ0RI30Rsg_v06;$gpd$dV z0sz^%&00sj9uK<7t0DuMnm;wN70RZd(fV}{~Bmkg30N@P()C2(50{}Y#fMNjP9suw+ z0FVR#)Byl`0s#8}fH?p_CIAo*0CWZbb^!q406;eYKn4K30RWr;02Khx3IG@a0Q?F7 zWB>s906;AOU^xJA9RPR-04xRoDgXdc0Ki26AR7S40RWZ)0JQ;tnE=3j0H6c_7z6+` z1OToA0CNF=RRF+j0H8bo@CN{J2LSK~03rbZKLFr+0H7%V;0yq40{{jB0KWkMl>q?A z|6<7hcaZ;2AphS${(ph|FNOTS0{OoH@_!8EzZK+v3FQA^$p5>L|GOandqe&|g8ZKc z`CkX}e>UX*d&vK%kpDX%|Fa?gKS2KbLH_F@|3e`EgCPGsApZwI{@;T9Ukdr34EcW@ z^1l=0e=o@YXvqKRkpHhC|Fw|+k&yr2K>q&;`Tq~({|(6hpCSK4A^*J~|Lq|Eb0PnO zA^(4X{BI8V-v;vE0rI~Y%ZEaZO{IUu^4}5i ze=g+zA;|x6kpB%K|9^!1{~hwbGUWee$p60}|HB~vlOX>qLH;j<{4WRj-wpEr7s&q= zkpKH2{{tZZ3nBm8LH@UZ{67Qv{{r&=9OVBT$p2W#|4Wen4CMcI$p2-K|J@<~FF^ip zg8Y98`F|4f|0v}DE6D$@kpC`_|8bE2&mjMMK>m+}{BH~SKLqkW5%PZ#N z{NDii9|QT{q`&>xbIn_?Yx{@qn&qi4&wrS9v)zoP&A!ZRnH>;Vc;)`Ffm3sQ))#nm zdeSS`(f|FyK6c)#!W&+!w`0PH)!k#}{8>NY-J7tC$iK~D*eVkZSK`fz8c&0dG+zN8Wqis+Y{=vvFiRB9|w2tS$ul3 z+mgQye4cb-_^Ud9Z&1#%J=9`*MVDa>QXYkj`R2Qys_p7gzUl2LD|APeJzaUNL+>qK zueTk3_*+NqfbUgR8e31_JF(RBdQ>I#pt|M0b#wCz8qhQ-z`tpIWwKkt`iYI&yAk}& zCW1c-MYzZS{{Ug6!5Hk1{{+3cy>GCnBtznX{hJ~+Up!|VI&grQ(JeMENz>kq{llS6 zqhj6Y-@9f1&wj5o_ghPk#FCSlgy`;sy^LmD%IU!Cvwv2QFnL237wYBHQ2SyO(d0z3!dY zR%rXoZ?H{^?Um+CesWy5^2w+#&38VitBzUw{%D(P+YS#%yc!>y`1Z)wj8ShU{as~m zpXA+DB8xXaoi??b_4U+wcN!&ETXS#jkQUa8O!>#r_QPMLW!jx-cqTHt)6|RM=h|P$ z|1JIW=J)reZnys2ae$_Cv!GpZCuZ$9K6~D?4qYyK?`gW(P1&;hyL%l!^fUT- zKKJLA1;gx*Eb&Ww62?1y>Wb%TAikN*UqeUZt1M;hwnH)uKm97$bpa*%YM@K zUFpAN-rk`-?Y~@}p7zJ3$(4IfKarNPcvRal?Y=y&)S=<_!#)){s$1OloqE+pQP1^u z&xNZxpW5I#<;FkBYtoad|620Stwm_3LECSQAD6%XhPUsEy!)M|S4h-V@!HZfb4YF3 zre(|b#BB=Nn*B}l!!?7~jJ#Fh_J{mx)gAgjeY2uo(AB<6t88xUH}y_*8yCV@$*koz zws!Uoj^)ZbIZOR9ady9~$_wVnUU%$&si@C|`ip$!wU>oFdJ_=%c7ywv$H$xZ(lmTC z?9im}buJh4OSg=c`r~84oUC4I?KJy)RY<;zHIubu$%6xLhQ$q97Sns{uyrqDR=C*> zIU3!0*{1$IFK#;GCG|(&hnFLKPdm0hJa6m;ufE%|#{b-PWyZbO$1i`VIb!dkLOaH@ zQmu%WQ|}F!H+;@r-&<+_V}B6RoUWsW4@07N|8-zshhdkxUBtU`_`^8Yn5hjWe%GZ( zm5gUJyd|>#yNWIm$9ukAH(}7km&>Quvzb)o{k8J}r6qNI1}sodSg>Cg9{)&m__A3#PqUzAtjeqophE zuX*tI`h_O~PQT7w{5XBCRe`429}B$;2UZF)0o~3^~F||&sCbk_^cITTec3ERz>FTRn_M`gl`B6W)sVaGmr=r3ye7>^&{lE|n95|l{)mULoNxSKj!6&vAZ_-j^fKFz&b zc(-tC7@3q5pV+=xvxumq$mCFO`~}Qr8a_+2=;#SCP4V|S$7<9`-bmqwsHR-b5TE8g zt(v#>Y1at92t)-Eq7u~;2tx;iwTnDqg3>3-C%#2Uj8A;?5EcEVrr)N-;6EGPf__n{ zV&b?j(Fuuad=oUn@YRRDq-pqAljmOs@B#K;84-u&ExTYk$oZ$^zygMJnuLWp*=)0uchYP>rgNFD_`Z6l}aU|so-|3)b zNCUE*Z$IwAkcMn|GYqMTA^&R0{VPhs`vqZf`^vNBIT_=*@MmNB<;mZuKl?#F7}AJr z7KOb?A5pk5X(|dgVas14D3AJMwID36k29N|ec6dk!-e}9({theg0MJ$1xbD`Y|77t zP5CQG`ddNni|XH${3;52li{LpGty2JZqDAnI{so5_ffE6E2DoElKZ)`@l}oKxv(j{ zD_JP&{}z(`RoMJ^Io$B!!ft$!aADKCFxg6!rdg{ z!IJP=NjOkYzPLYYu=Vpcrsu-`lJFQwI7brRAPM&}-j6G9izNPvB)m+LKF}~n>6_wo zJg=3+7f8aVBw-gx{x_2NhJtvpKWee}+hMF97mk;NH%Y>#{^HV``iBcokfhHLgvIx- zBN;DT*v43YE^I9co9@rWUoe)>g&zpQ;``NQ@8@oe=faVaaHu3~T1L3^zJhph`5tWf zUdDJX{7w>nA_@CT!aXG6^^)*NNqCzid_xjGDhP|~Tc53OtTDbm@wOs_3cmWd7~(^g zVLZCxJH-YK?=$d;+Gv=Kz<25+hA7E%B&6ft))1dzU=bJJlD*$*#Bm?){v~`6cctUM zKoIVPa5aSa`_p)nKe_bLc6THpJBs_GQCu+4?^bq^I?7Xk2f&`cxK#A0r;4gj8ko`w)NpOFv_9F$mH8X@c}L zyjT*xB?&*0gzrhhZvtUfUSQ=L3(=sNJ)68AY23A zLr@l9|51j%8VCwNM|;_GM((~hihM;B-}?5?jZ>e z6@)9Gen}{cub+#dWSfIb(88%n~BBw;T}xUnSML=tW)342Sz z%_QOGl5h)2SXzIjB)+92+)5H|EeW@ggxeBc>(Oz*kam)IX}G;4zJny(Q4;PX33rx+ zyGX*mlCYm7>@NuiNWy`VaF8S%ED3ibQw`(Y3GJ^)WMr-(Oh*g#iM@e!^m|1jC-`%J z#t*fP5aqWe_YLvhYQ-pKaRY~AG$Z=>#z~u`TNrEeEKc;&fk}Q z=j}UadPDj2J8$1j(;MvcJ8#dx*m9u@9X<_l@#Bhq=hL*OcIp^>=y%>8i0@6RP%GCj zE>vLQL;K?YV((qRt18a6;aN#`5<(yw7AF&>A%UovL}YVNs&*$P0YX4ZAu2_Ign&>4 z-AYmu#ZsD~tSl9y6SIaq5c;IY=Xr6{1No99Z%0MjoYzrxayIqobfemrC%L53fXr5T?%m+?R z#y<$L@KwMmnkN>15pXg;fQAqYzZ5t{^TfhG1e~lNh!G3FlKPq_7XBo#w=@1h&SLZO zVjRN$Fa3yE^xGoNn@SDjgU#E;f+`z3sb^x*?*p8fX6p=a=n#vJWs{u}V%h9wlGC@FE<2S>bW#c`-;-AE#zYkdalUVqVaJ?q&NGyCE z%!%I;3vbnr_S^I7NBie_^`rUo>PP$MdG(|D^Xf-!msLNSch=8mj`|@MeVkg9R|mYnnfw8UbiihwwxESYpIs=cx6OB@&Y1`n9m}`- z+B~~N*0naKD|@fAF%KiNpN-jfMCV3e?@w)h67dZ-o{gRPbp%UZJm+L;`%8em*V{TP zu`|y`u;@PyDod9kn|)u~Bo-ZB(}>MtVDHatJ7cJ?Z4!(AH0rS65Y~w|$AXxz5P9X= zn1|}U$;LCWle#4qJC9N)-`3fPU1oue8_4&!@m}nt%*2xR5OAi>%j#1+VL%F4wmcgb z0%r}h@fu>C7k|sVg*N{Z@gN)X`F&=QjXxqk*v6lcA7bOyQNTCbn9moaY{XKwG+@kG zZiyc_bEu7Tfu(*59GKm}JIvOxd`4r-XMSPxJ+aFiZeuooX0eU^*h$?IOBpO*8UX?_ z1zVO*I}KRu(8n@w#XkuBO6(Aeoo9f(x8NTn8Jl;c1yve$S--R~eIRp`jkjSZc8JB! zeqiq%w$4YyyxE3)g-v{nSoC=T?7f{D_A?UiSR1EemsMh8mLap$##UXG*_ibsWgr%t z%-%cB)=4FvU}OGlWZh|F`mlGRjdQWf{FROAURjfE%;psP#A1I9aHiJTKztYeK{jFY zvJoJgv3aLjP#qzjX5&wY*=P{vE7v^4VxMjyJhAX>67O{UgYX!WXIRj}qEiAYMf1eM zj|aw_Emi_z;aRNYnHH^xg(sDwdG3Ut3!FR){~*M|-v^wcd1B$`0VmS|A@i^aUkRL| zd1B!g0VmJFKM1k#OMz1~Pb~au;A9pALM;5Fz$uz17Jdt`_g?&iyoxRJ*A`T-W0%Z= zLx@HHE#MT*6AQls*winUh=ux*>T8}@_$ulzwDpOFUqpS)6AQlO;cu3=*4Cdy{cj>z^rus& z+~#@DpUF-J;qw4f`wy|`FQoo_TZhk1GMCwS8L;$UV$oj?Ed7^Q_|?GTZ^Xi{1NK(i zHnEt6%6ibon;iTLdeww0r zV&PMP#ovg9zaBXGVcQO|@P6PF%@Ye>1T4Sf#KPY}o+ma4vGC)8#jhq2ud#LJQvYlO zi~fA@S&!KK5{C}4=xieYovlMG{1#xz>n-YNzaH`r+h0E^!ei%t=+ z_${&Ue3z8`l%1AX_~F#oJhAX2fyHl$g`W*9eoHL;y};tP#KKnri@y;IznZ-ETVmnY z0*fzg0M6WKmw7Ywwciqp{_DV5Pun`%96H3JbAEkP6HOd zB^EoGz{$_sI>f^F08Y_7vGBd9|65z1SomwHuX$qObAdB|XY1zyi{BE9&H!NXTVmmh zfW4dTv_pZ#Z;3@`II#FFvG9C{nEaxhmRR^v)Ym+*@MD0*Z;6GU2AsUbwnHrZOyCsF z6AOPY^+UEkvG5O2U-QJmzaEQxwLcRJ-vBH=wu|^B+va}Y|2fop^Lo9p(u;l9{-fHVyN`39;#G>DoI@-^>182Ts>t_OspA(CI4`A_gV&QuM zi=PtC}J2)+ZKzHuW`6Ed0IHf78|{7XAV1Yo1v6`P6^Q)+ZLeiu#%-7Jd=+-?sIM zgYR#T(fI&;roPra0-UwY);UW3uOe9Vzi{Y(M;(3sCl;Ny@!-F;(-I4x z3@mwNP)GYbvFP-m&UQO(PY3P=EIv;x`qu)B&l3xOJ+SyZvG94oSvzd|e0QIz`&S{b zx6bB=lHY0L;lSea#A4?T^8c}Qh=sosIBS>9PXW%yEacO`ZIx3G*2x2Twp0b zvG7&o|83hL7Jd(K)&n*_d+q{bp%FBeV`AJVjkk@rjNcm18*ds4Yebh$yGLbDpE_>r z%(2;Hv5fu9vKcc+&&5K;zbb1cqIBl;<|C$#FR>!J&Q)P66&$MO@HPOR2Q(Dh;P%OKZ-o>++&GDt< zOYp6f6@@|ST;;j>ielA`o;77+vqfXcS(_6t5^u$!DQ1*4lLJd#+6>Q9H^=KzTT#u{ zxK%qWlbSXQ|D^4wPn|Vo9F{z{S0N|Q@%7nbXU?2Hv1As!LS+|WVfG8Pqiq$14I2!* z0gqtH)G4K9us(||%8aofIu?J2``tCI`4p4Orl@Rwg_hla$cQYg5nlQ$mCersMvomg z4$H_-P}8QP-N%PlkPk0ves9_IsT1!lyHH8l8sn#zT`=B?>pJdY$WHXhW zS?P?K*YpwEfqI2Ch7I?HaRISyB0>%u-qWEF!Qqa;2Anq2cY&BvE5hM;I3nYki^~srC=UkND5~MBI9ZrQKYmzQZ-Oh@ruF?1^#N zYe_G?mtB+wv!LYGYb{FHiyq&vA#3H=apQhzzXK^mnB`$yA~6C^d%57e*hIwMIRK}< z`(UptlxUBKBlbqP$~O#g&6SVOd7bvwI?9JjpRm0Tk*~9SV-S~(O+?Cf#8tjmVefh< zv3xDCN%;o2j&~{I_>56R;7!nTmhUUr+l7MAUQ29Zufb*SQiS`kz*@xKn=X5A+>WuN z+FmQ@ioGpB|G%Ms7=C1DeLkGkyfxk7XHR=MoWb=Yg;u=fzK zvprg)@i{(CM9NnKf@SdQh&`~Es*l&yar8gl7CG%DqjEXEO+@VRcF}3?i!l*aW~rJg}N z?OleAaV#JG!)fm8t%m2wJv*g zuqXc9#bNI{Byg5*IqbD-rhL7i=PX~l@fd#wJ1k$i!`|J%PJ7RE!t+{O`-@2VCWCO= z+YEa}@CDlIrsG(Dd{07ql5TDnd;A$FOK5|#62Pgq7J3$8#YW&k^sgp*X;2U&4)~N? zFT)Y(fCX;7?v6+Y?B>?vNw=ANkGb`FHm~=hTdz;^dc)j${hHUi#;tc_^LmTi^_&Ym zR;U(%JG4C(pR)EQd^=)8>p%6leU0-Z_tL(j^4uT0Tk7fom)?>K=>6TL_r?YE%3OM1 zTtM#~6wX<`OY`k9Zg#06hu+Gi_W|_$qJ%wdP@;9c;522)r3Fo|52(lMh38!MI1Z=I zN@4#Kd#4a2miqewdVX8Q`Y(DTpy1TY?B9GncR?zr-lz-cEpXXe0zLLukr)lw^_})s zLvM^I={N@G>Uxpm`1%5RcewO!9niczy16soS1+I!gpyOQ(?F&4>rocVisSxo8cX?} zxq#j^E_>JFgw}%wv@kEq6Gy`sjch?vL7@8(3VV;L5``Dj2nR`OUFNe%Vd@n0a!_C=6)U{fY$mu62bnRIn3 zqzC_Lv9bNXPp@7U+qZ{kj7j)Seo=v8NRG7qWjKGBR`(%_vG(=G6)K*g|H0q$-^7E` z!teS060r8ss%aRGt{+uJ9`~I04CJCuB=FQgH_v%DxJ`1tSOCp#-QS2#Dw+V7?qOm3 zP`Kw7%K*fAjmWV0QXDY##P6xsoZqKuJ?t#eugN87*qU*ceZrcldp2+5hkNKWZL}|9AYJ&GY~J{r}^BKYij@hui<)`Tm-| zeXr|jo%w(Gd_Nc0oa|?EzRyDFw!5nitvj%B|L%Qz_wL_wX!rZOj_f$T?URPj>w;M0 za8q?D)*ClH%3F#xgRxKK8tu{BJy$QV`ce#tP?o`>qeHT=xwv~dXS;x z8?jO}R&3l6fYu76dI~9C#!AsxSw3c6TrSsa#7dC)OG2L=hQ@ZJKd5f2iQf4!(#V>P z$7BDp)HmT5Sg$e0S}EFWVHkf~8jMqk{pvCrx^L^VBWhRF?x;OcdrQZhMjq{riXGjI z=$*Zdik%)KO|ODnu`}PO*fzrW%hKqbWd_P<=oKMja%xA^++K@g^>*LYZ+EHp5Nxb~ zji+GaW!MNfY;1>(gO-htjf(B3w2kAQztoJV`CCo*J=uHBnAoqwE0_)+hc()Vt7|;z z^PW{^aaUEma#0{*QDI8 zs~B5;tUP1Y##O$W4a!&X64nJxL@UN(O;4_a-V&>ahdw)~(qclBx2Z&L^tLFh%^8Ok ztD%KgawRdjalT(IP&s#^U6#HQ)d)XIfpw{z0_eR4Lg1aJ}-)S!MWU#TsUDjKQ4Yn^Sh86@IOJ1s`Lr?FGtr)0bH5+&6255jqoR zyjvUJscn*PFV-5}Il&0!ZByoOq(+HzYRv;!xAcMKsO>7OQ|kLV#t06tGG;9aOoa8@SYVu5^8M0K!%4+e*L|O~HhdGlMPK^c($LPi zs(z`j;2o6b7WL-Rp8KZn?{lEvAz#(!M#S@sJWo-urHV0UU9Uow)hd{rugpN6+P}uv za*+zg?u>P#p2oKweBR*6Zftp%?AaOZ>jT$>hX%aL$-%n1O-bMS(vQ6ozdk1h`V} zDx8l#orm*MzOmNy_|I+~nlXIk@Yvf<4;){3sIXwr)V0j)Dv0RbTAQ_;~f(+R*Od z$~R~nYG#fKHlklV6la)!M!z_BHpzSXOSHmb!<>00>Esh9A3qsP zd)yqpz{m~eKI}_at91nHG1fB6twCVRLN7x>cbB^pN}ncyg>-x7?TTk!nEyz!?yq>_+cMLa&LoJRZH~ zAKT&U4RN94=pCgM+tDL-phx6kZS0*1>{Xv{$9baB>OrBY3sm10Mq@Mv_EqFVt3Ue? z`d?lG{5CD_cueR+cwUDXV{ol+>P{8?LM+xek3Lb+KOX0qb4g}&ixX)vw=X#!ciiLq z>^9~5^sLd45c+Jc3LOuqh8CgHM))nxG_!6td^ZA1zYm69E0tDt_((eQTmf)Q0Jbm|~#4?R8BH+#G?(dT_LZ#F_xmMh?=ASDJ-wA5KugRluhY8S7$k7C?Mx$86QEzK!QWPpNl=V*iQVo3kC&5Xn~dOaR*osj2fuS)dN(hD$3ZgAlSY@?OyRGPoD)HD&ud8 z@yFN2ywfJ8O&nI+Ri4=IJJv_lcPRCrR)PG|d9PxXV56~bEWE_iBC2q8{rKQ~&j~a7 zbW%=yusZfcMYlj>MS6Z?MaK5Vn4I8Y_{B=pz~6D+i#3l_s^F1I!`Il$Fb_myedyE5 zTp4ZnCgB(#2LIJm6*^rEe>i~lg}=?Y5oO zlN##W&=0!#o^g_zHF_b9oHv3-xqrgvzN64LNO{gAdjOi>nOl z4ABw$*?lalIPb%=>X+WWG<4G|>bFa*((^a+aKN^WUx2S*F<^vFp&SLD7{SApJfF|$ zYoM2&nE+28uKu#L9=|9%jP11tYeGBFire2(>D>>WOV6BjE5Y-`>b|8LoM7HoH)Cn34Ih$ui&;WI6q2-J}y;# zaRp=IRh@6rPD8F{d>>^Pa%SFM3*T7U`h=O(m}Ggz#y_5membeKV#Cdi(NEPjzFgz$ z-{0uA(Kxd+&**Kj>Ucs);=06K)N4araAg2BatnUxWgEzgq^UNVliDrx2WXb}4R2&2K{n>5kzP5fRp zvW?D$8S$R~6cz$}k_P zGG49;o$kY{m*D|i8->2=g|klRqv1yI{RLS6{jbXWE6!a-Unui2?00^rLf`c@e1-iD z^USFv=HZ)l&b#tsdbf%xNF0u0}Tushjvm*5A1j9G(F9u_sY=e$@KqE?=`MdQdBM66N64tL0n&g%&=4D%FdV;}kH8CaJ-$!N(6R;e1^kLu;#x8E@#VPJ zIjl-g#N*n#75t@@@nm^$`2uB*3@G!q0NO4AK64ngmSBYbS%vG--Z<}kjI$(ubH9L2 zyMR$0ADY<@zc!(dx?1hD7{4)#RcP`m70P=acM1W!t?{c8EcO`nwPri~UrMilN9>$~ zbJHVXZ-6iCC^mfWqQBt^6u(WzlQq_F>zTgr7PNhwZ}(Pwhm&6$JY?CznUS^v>h{{; zVdjMMa;=;l*Lmt|Y`+mt@bzD1n-pcNt=RZS^ok^-;^~`> ziVd}fRgV5o<5#*{jrm>`er4gC^vhdOwqKyVaSdYr88vhSUXF8f@Q#3yj(gbks!F9B z#cI6)KgRKX#=6l@#qS${oCAa2K4T%~*e%^8AiC_f5bvGowD} z@wbuCh0fqx7JCXxr)|YArvI$5w)-OU)VD}!dQuU3tGeHkKGo&*rSn=UBky>n**;H| ztjO`~4HQ;wtcuGy3>Mc~b_eZU6rH~Z*NY$EYV-@-k$s1A*%DZO6nAFN!^hviuV!v6em6dQN`*e# z0nH+4jlx-OGE&@!D_rY-J~r1=5_@}X{*r?=)?HoyOV!V7q6;!%<$CD+Z7FQTk6=tQ!=((-?j()pt+&wIC+;PuQ7&sJ&-htj!;8DGorqA1sOcYOz4Yi-72UOkdb6PPXq9SM z^j2lRMdkHIgKzORWgHz6*dG`cu1}w55zg(rr}d~{RXbcgrq6p_1rpLRlanXrhJ{-z zOP7r|Fz~Y3)X_*8f(0HIQ(uYW+RfDSo^qznPfx8@&MSb23Zty6&wK8UJ(PAJV}Iek zA$y1IDc(JD*Bv`bw!KhUaaF8(Gr#o2EW`Grp4H`bxr=UG{Caht%1w(rMXa0Rz&eLt z+>jsgY_Q7Vi4D#^oy7VrKOXe7SNFFs9rFfSx1|aN?lJf~_I*1~%dDDoeADYm2(%1- z`>iTJYM_kw7+Z#>4S#5O)NLmRmK5$U%pJ64P+CzwYP;Lr>Dg^MrDv9RO7H$)r}Qhj zT#}w~%_Zqwb1q3w`}rm5sbeom&%V1O;yWU~WBL_Oc1+KBv19i|&nUYON!uDl)kS8E zikBx2eK9n~Y|%o!f_<8M zbs{0sCq7HaDcBg+t z!3W}~6TILsJsuS)A!{KcTnm#LrfeIz>m|%Jb7)IsW)M#WSfG)N8c6R?CZ8o1A!T7F3d&YjU$ z8kbaDS>GwTdwHjd?m3;JuQEDSTvgvO8t2i9%$$zVSw_c-toja@;SB6Jr{o!HmHPR8 z^{-r>mazPs`P^q`*GxHj*NcUF9`CX%wegA<5B~f1@!JFIe)s5x>2J&;1@ga%`pwYmpLpiy>;1J4J$CJ>H@3dt#oPGh{y!v|UyNRr z*Kym^58N>B_Dg1rDZlxHwC>9m7X0hgc1P}LiN(A6B@B%1I;!E%&zC&7;-h;$-PQN5 znu9~0om~9Y=VkZ45dZqzZrPV^d}+sLf1CM}L2oWzH0{Qh#}9};-Fj^ATVAWGzwGg2 zU$1U6@h?l4Khk-@KlYBe;_pkItZw!8C%Jd#Je-xZdHC-;93L|LyX6gqdrDeOD!6{| z;y>MScHDoxwCb&^-k6ge{pU+=tG_HZ=T{?6JUsF9M?1Yx`u9(NuV#$@c4blEqkb*& zHzobc`_HW3e0AmXfBfx(HFI~Z_~z=pe~7<#;kBbGx?j=%udnV5ZfN_9#s#gf>C@%b z0mjn4Gkfm-$BVB#mw0$vac)N3>M?)W`dSEZi%)s>j+&uIr<_GW9J$}oF z@BF&#r%|;xe%9@wkK6z4`;O1PePGQ4+pn8&ZuVn0J$-E7sXI@m^qS^bzv$pSRnPR; z@$*5QH(q|a_x>qeJIo*b{wK56{X28ZrBB>GbzZ{syhkQ4Yxzsx{Ue8cIrhmjn-Bf$ zzPtXr-O;CRNDF;kedO-s-@X2F`Ty6~=jn0h!zl}1>oRxfb$>lJy+z6OH$HI3(*La8 zv%dRf-)=pWx~-{RuCJvL{@EjJZ+Jm60rTvs~z!&i2VoAirK*RD?d>XHBcP1@|= z{jFciTPG}xeW!OTWAT!PPew;|ofRD4`Qzim-}COh_p|uSwySzR_tNDF>3{$C?!UZx z_JeDF^{3xnGVslxul(0X&*Z${_=gcyecl>7?CamRoH4mryl%?XT{8C>wj4o zxXX;Yc}V`2q<1gf_{JAAmi_vVx79xRP1ea5)$+bi?8|<1$`wDGcjAUWcU$!Gr@5h> zpPwmebBv|y&3%;zvr8)4)1*8mF%mps-0KADy!>v%9Y+7PU@U>{h*N(=PtnY z+B^G?o#3J_n;_i(9>V<|2={-3a1|HEbIql~L>i*uAf4?>*{l%XpOu=a(a4=zC)b`WHTOSYnS)0XuQ$POc(}&t$+beeS6A7Mm zs_wonpY%=2>36%?O>LYXFzy@sQm>t_>|Pmo%6oTJ=fQ(=?mlzLRbLGpzI^|Tu~&{u z8Z~&qv+K<9Mau{Dzi-N(RP(l)RpVD=z4uO4ZO0F%oSypLpp1(Cp3Nugj^A2S_?s4L zW$%-VU%O$+HD6ErqI1i?#$Pr5tUv274N-6PNX+l}rces$XYduRP*_3-~J4F0`G)a0Hk z$G7X)rQ_m<>z@42mJ<{G-G27#9@WR!w|-{Q`dziR`A>{I{I8tDX8+$$AN%2e|ET}L zqo$O4&@mu~aQSby^z;ilzjX~iE2$J^nr!{u-3Do-m{ zILS(np#oZxT=8wJ_^uMI>@epWvc(R|IAW#aAChPt9_P}}b;U>O&$hS572nH|zUlFs zR{6Gs_3iL9SNM5X_*z#O!%wx?>1Rt2^ANNCs~q8``M0;?uL#H6;bpGyB3C$)zpX#X z6<_2CH_fl3%FuPu13HH468?TE)e8Sa{aUB>TH#bxi1Kd+w#W8$R=+^F1H#-4)mh!F z?Max&8!3NB>-Z|6Yl|K3il+n4@Ou)(yv$60X}G=YaJDO)>Iz@$2%prpSOx=M8(gKs zsa7~mtprhg-m4K$e{{xAbHrQrT;Z9naO9h+ zjw(^-ZI?g8D&H3_{r4SVuCa5gEC2904dqKh{1jI_=hd;ruHWOXFz5Aj#(&`mOIz9H zyIlPaaqMq${JT*$wzq_N{Jp~G6Fa{vT;UC_FdkoNvGwP>!tGq)C9ZHkNBCOg{|c;$ z|9%s0TV`>IY8p;g zbA>Zp;mcj&D_r63ir)fJo=2N-o_BsDA;L1vebo>YVeov#u%pP2jxk z?^+@IAJc!T?Gd-d*LU~o^bc6}+TfTYLY-4Oeut%Rs-o1PS%5@iDiC-V&D|b6AM2Z z*wllRiG^PR%=s!P#KJEFPSHHE@XM)>=Zh3#;W?jpisp%hf0X)odQBk~el7JiPb@rr zg5Mfah=sovI7Rcs!k<9>$#D@2-x>91@&ir?vG6?|JhAYc-%9j}g}>Fo6AM2M*o)_= zl<5u~V$qpLUjN7u3(s$#vh;-v+g*;ASakS1AjeBAJbgpzlUR6Omq~pR3(wzgX)j{o zucy9lFJj@Jr@n4?V&OMaU-QJmZw2<^dpn93n|ZGVEi5{n7-!miDsej-7ZLO14Y?JY z%nQ%&U`1yme8bz38uprZQdjE`7W*54rLKsDe*swPidcAFgGpTx3;#Ox^)V6){}%N% zPb~Zn>gzfr7M^`p>Xumeui&5FWDt#L{>Fk97JV|A{0J0c>1baf79E=N z^21I@8n&!dBBi=x%j{x7>;6P|`hd*s-VfNDZtILA?q=gD*qQf7u;g_g`S~_aEc_B+ zZ&#aNhFzAn`4D-H`JIy3B$l)VY~Rc6wEXs5>=TR580uu$I+xPsl{O|NxCd}14;s=F zTc*AkvyL~*qLm*zDFdQ zd9SgcVmY%|D2UZAIswb(?QPN4b)DGE1tm7`0M67pT8}@_<6uG*E#FctinGCvFNM> zmU9}h@EgeMK0+)!&nM;r{DTk+|2nYOkAIN2uz7PVsJ3BeGD8Tl=Guggg%d zLM;3jz)~J!;m?xSxmvGBad zPtiQF@OM&Q{L{ftroQ;6gP#ZN9cbIH1Wq0l!D4eE(`uer_@%(ozQn@w8cF=kdA+oi zy#9?K7X3Zs%k6xLh5vxOZg*ngKLVC^|BSfEPWvzFYd<6w{nNn7gKZsR;m-o6Xr5Sj zJeUd}7qRfI$!otQ7XAwI`nZUNzma^ooiDNQL&)pnA{M?FSdMEH@en(03H9}H5sNr4U88fs(SPkVoE;|GWfZ9Jbkx~;i}jrcRM*jx#mJj~W77JdzIisp%hf1LW- zZ;6FpM}5r`3%`~6+HZ-4f1Uc8Cl>xK>TACx7QTV{nkN?i5U}?bcKP22P971#qH~04 zHBT)3N5JCG#KNB>f3IzaSop+f@VecJh3C48W`(U!EIjY6rQL~z_XA72<6{ElEwY^)*i{d{mn0a{DfF^`jOXu zLM;4n^4d>`g`Y;g(k=tB@bk!PKOq)=A#kSO*5`ettfjGx`r1#3MgLLq`Z|YL_)X+> zIf;eeMqZbbSoovlEA4!Vg+D=Fmy=lduYskU-vN6|?6gsMwjt#t7JbfBjE^xb;ao;p z<7~|5AKo$>cP1WV<234wws8je@iy)boID|d#eO#U6wMP0-xFBMLoB?X{I6|0#KKpS z*Vi`0!Y>8R(q*`=-?jY*6bu`6-n^9f2G*LG@|w|{sjkV)loHi5JpE*Zx#;ARRCCTg zspra*)OJ?Rc_AgHr)x^c^JiJ4X0wwzMohS;b#%mFl0N6ej*b}Dl#dc)7ZqvrgpTJ; zT42rmhRNWXFR48%pFMSBSYs@WkDoev?$q&~?GFo|YN=8heAQSRs7mc=O zql`=!O0~$uirLefpNO!j)&-CH2WC>F6yI$=+Hd^9cgj=`AI z-cs1}B3?ww$NM;E{e1>QU7g>-ZO}&JrkSQWPTGVkkL}cLScSO@$Ty)Dd5ON8>xxP7Nz+d@p~je4e%b;9L*BC<~rGorEvgTLw?InD^FY}3_-WQc{4rgEWU&D9Q|hgyqq?%JJPmcj+V;!oKV$MNV89EspNN4 zfdbC6;_<}SB~+z_zdbOHMdb(bOT8~+E{H@wzmW3vsZ-190-nS=V=XQ7|Iu%@_|x(p z%F8jB56ix#szrh1FL~mtCr7UQg3QiwA#%)cN6@`m6>)Ygs;>i!OG`j?J*1$TGb8-0C`;v4Vs27VnC1FbD9Dhf_Frg@gt zji~X&#@Cf%$q&wSVaK!VSBA?T`9kgd8mkW1*fiy=u|$8*ff@K3a20&w(|NdR@b6yH zw6^3cG7r89klHD%>sj5s(wp-_<%2b>*V3Vz@x529s&*{eW)Mu@4#~v$4k9rs1sqR25+al6FQ3KgRY`gTXuc2JoE8^?$#b$4QUuMpF z3c45mqMdD*U0Geja`jwNfv;%!{YtRq(QitZZC3@=xr^~-r?8ESUkH<*;he}9K%b@YGZxRHNh?>Fl0JpB36`e^~HMo^gE|dTwK%PEW(u z687H5FIICpVA6f^cjQZPOTJ-@ua*x2G{YNN?a5nHS2FL^l&^RgEi^`89taE`mS zZK^ct;mvFFjP!NAjPwm%jXbNjj`>DBPi8P^YO}au)1r8IV08_?@3TB`OSQB#Te(lQ z$CJKxlS-&6hA&F#jQZ}C@Uobr-=qbc_8+q5NQizaK~*m)9l8wPsCraXVfxzFROwK^ z!O$fIOhwDx*O*lUarUA0Vtm^fwtbB0E1nvt(lBz+seJkQhW7NC^z;|=BVVf;dA4sv)$xm?Md6;yv)@Db>h9%6U+=ZnneXnJQ18uZ za1GDi=BxnDdsfTnR)=4OTVcQeIfft(J1t=QfSeN}{XQnAysmrYlA?uqiFJ}g-hi?t1x8qA3;imRlsNd49DBy$nn|X`&{vn^4Rf9UGeX`!jby0_4hjB zo7NA0nc~N%i+2Kfg+2Mk)Jv)5X5pHV#Czky_;rO4p%HPF`?-`Eo z;)+kV;_d5sD%s)IVf}QMem6@$QonXMQor3?`j=b!k@~a4ZNv8M@D;9b4@dZesBi$_ zO4T%cmGw-78Z)tRoN9*F$Kx=BJ?a{L19hhrj#IVRQxdUp+^Sc{+u>Gfiw?6*I4)HO znZ&xk+OLVFR(u=9_tTUk*xKSr3deg=?DXwby^iNOvMruuJgdXh@nS2`;Tx^^OVr<8 z@n36u3D~#Assqbh@qAuLxgJ|vtRleouN1avTh+xX2gA1gbagoc5W76x)EKRA$6sz8 zhpl0kF989s)?vGOd7}wo8)a$U4=n3X3~=!Db4fdim=6*mQ?O;}XF##QUOo_n(C;uA zfh8UA-{eCf2(iyXh{s;WcG3^Md{_se4~agp=(C)eGz?)s@#1+Kh38xu=Q+%Qc`g;6 zhic;a7ll}CTJ>OBv`WTK#zSTROBskoKN~oc55*uXgJ9OVjH}Eg&jW=NV9V-gLA#tf zZ3(DMeF9*8X7ZU9WG*(bQw1#c*OF%eAsew}X*(}C@I{Xi&t53>6)*omx?_`LB$i|B z37n~)h0qtxTksD;EINh2Sz2eP1M@JvUGNW*hRw@=5VoD>~X^@*~Ut-}|hf)S&;pq>V`S=H6 zUXqqrbUHhDV&N@c)ny`e)-evGhOLu1$j0QogKcb;VSEHj zT6W{iAvVwB%48?t9$S{?dxsYQyldLT(bLPujvHMvamv`~_b4ny+1x8{Jd?H7{~JAJ z>|JH!Mq8^lPM(NGFK662cJkz@b7T>KX5P$RDCq_BnNT(p0|A;W49RE0qsh-4J7EIy zx1uk+;6QkZ#PFN>@amaj$XY4!0;Od}Wm9I|b{) z%+1juoTjA!Ruj* zzW?)P^k(Wb+(l{pG4?Uo{5ssOwNhh%@!HiY594^wO+^A{zR!T;c}GO-r2shX&4fMv zHqxF4o7lSw#+>%{BkoRYB4Ur<|2pk$fW663qCH-wi@j=Kr@ej%u-qbIuM&jQ9+m9S3VDTr@gNn+dSx8z|IdZI8DVQoi52%E#~c z_**N2XiGRo+F8CU+D81Dw?1Oe@3J=(5jScZ+=;!Py6oKwd%R5G@$!~Q>@~XVEk(p| z#EXc%vo3pUVUO2`w8vNaV(+A@{*EJpJ}Dyh{@Yc5AHd!TDA68ov&7yUm%T60xtXts z*qiRMw+D^d6-uUnGfZjdq#k_vR zxPVvD!I)n!Y`o*_fe^m?jo(z|$uAxAiR!taONGZ{e7HKdRc-0er}2){k9YG+a?J&& z8do>0uibvG%Y5T_HFRHAU}I0kMPla9YnKxWY{i@V%_b5xM-Nbt%y!n4W8cGOZo=AA_vUln!hFf#m9{PeD)^pD0 zts@PbYK*VrQ9X688gDeq@m|j{dnHP?X*rpurA7LxZaGq)87qQ#tM7&7gXiF(Ygvo* z4S6?6uL{MzqHFhrGW&E;!MHPx_jh=-VSUohbE|WGvG6svPVAY+WeuJJo3%U;?Q43@ zG%mC>TcO^on;B=pRS^1AXD`}R?ZNz@{%@jDn;}m=N~pa9?~m6fp@&pq#$L&QiR%e~VXXw{WTfyzu87pkBMtLl+-UN@?SUu#tGWA)orRth+ zxfmMUBy?LiRNi1Nn2p)!`>IgrAa+Si6|`AnH-Ix6GC?>n)l81DpU&ruj} zQ-N8&cYfXYeW&1Qyff;Eku|X$mH20Q*s8PV4BLkB0~jSDy(hae7?`ch_j@Z}9D3}u z&yiE0@yY(7gv0(|i)2-L^c2>#IolZW9K!6)XuVr}9d9wdsWIbl7OY#J^zyldeji$% zBTBXe`h?%gFZA;)u>=|;8ad7+a>ilHE`dKs&JV*@)D$eUyxDBgjc11@y)LcL9;4tq zivJV+|G^*C|DB~^U1FZ->Mc0`VnoKGRrnqGbRK?HFxH}UUJDgJpj7oXJo%1UPU|;S zM#dbZU(w6R+f|Ae3C3DaK1U!pE#zUmNM!s*{5GThki#FDmU%d>57=eY^L!n@Cp~o$ zMqqGVk``*ffZdMTH`Y4ykHH!mF~~hWPjYsQk;0kj{E;I6v&S7&6)!cFaYta#o}+TyXUNhQQPR;KS0ChV|%Jwh_hrQgER z9~#!T!zHfp5LY;I-`2uqucc+LXIQ_bE54N#KRX<6ha=bZc6g>MK75gg5$R3qBgqwR zW7#hVr?S9qBt+|>RhuKZH0{N{%B?Xce!j?}*$Kiv`E)c$2I`#*7oyST#XR{nWm zdv-X(6^_)W9Ut)*JAAD}ziD~8S@yStOIaaDyv6%oXOdGh1x^7bJ-H`s}}7xWY$W;kB;tAxC%)(nsVf)ij(H zp6`x6$8iFwTA%lt94GL-PRx7Rwm4rzeAm8zsyA!}9wWyM^mXLt1*fAeC5Aa~0EOou z&WANd>sMLfR%$mRAqm(x&OpBgv*u81i~jm6ou20)jw_fH(a|hno=Aql__#C8h!Hxv>%; zR$7hI5YFU-LdX@^%$qG}VR_fX{+FfoJ5Yx=%n)MH$pDry238qbQ9~*AbyGVyvFNjp z%Xou3fxRpsgndi!eZ<<%a$r-R7>LErqtxMpM94GPM86I=OQ%gF&&q?OViVksnExQD z*aUY6maze>Td5Ob$(QFKnfED|I=XDcqEkqnj`#-%R*zM%d_d#tsjsnhTwOpwoX3@hu*|vChd7-Y_WY1CkJA8z<=y=dV9_53EM+E^ zGEb(?<@g7gi%s;G0%vt4YnQ=nrabg#8Ixd@jgA1x#wK$p^#T@uAeMZs(Mfe9H7JezPw;x%h zR$~*JF92t0`|Zdx6G$pH!7M|j9;ffn`hryQ|or0-UAuwfeQj zmx4D-@DD;PcIb|oIb`i~ugqVRjj+s9#AYx{sbOEYOIoX4*a#4-UB*SQ=nMlT^BS?7 zSp~Mv9oUIYV$mNDoT+WnCq;)?bnc~&eh@p4I{Np5Sag;Ed)aXz%dv?aV$pdVI8%>3 z*aYm=Wn()Eeic~k6HD4UU^$j;)X~RIEIJ1qI`27jh(+hPgC`cg$*=|MVX%x_;4A-W z_V9(7WpkSh9%%9|)=q@C-c#`?`OdpWPaIb^W#+{36U(NL{^4ZJjY_Z${*X}@AG`H|XFOJ`!7hdo5&2Mk-&GmI^nj4=z=h>jmn*Us>xbZ5;Rf9;R6I&p08 zu;S#&v+o)`cHFq>GbUpA#svn6*p-LEH0d=nCf-{XCN4Uv!cISR;yBJQA)UxEqQZ*j z1P?!QxWtT^Q>Ql>FCjMn?+=n#f$MO6DUP#+QoHc3>4bwYEY^O%NF1xfz4TsoQ5vK| z$*srV77@`)fl>@ezm6E*+J4u0HNwoEaf#TH5pddj09)Px_Qt@#8Zm~w*z2y-_;uW^u*bGzdgmC4 zG8l8(2<@*Zux+0$TOl*wf@$&k?X^;1^%^mMpoyLznr4tI(347W@ zmkQhCeTLH>=Q`T}PDILA0m50n9 zfYTlmEkb@GQoe-%PJ4B*C;s9bBk`Kc-XbJ|>xV_`z2vetv~8sRoMR;JaM@dZ0eiQ( z?A__G$6Gj-o$dRf%ihKd*yEgfOykE!ndh+A1!1x0aoKwb5xhv;M_J&dkbMt+LyPYQoc>_ zH)r{Z`2#^hi=23jEjVO7O`@pRUjo>RUL2I1V=nkRNMZRXqW2i|%(l=;i{>Yj&3uJC!D_Vat+kt@vNj}4>Y{t?#P0BiX!Ex}{G z`_p0=e1PLtu^~lQPg0rH=ENYZAZqo z!iFJr!Kn5z-4~SI6pWq~)4jU>PBXqobg=dI#!UgU^}gs$3xX{+N0~`Sqs=*Il0r!z z`pxJQ(dL_KUwi{P3X)w>b9kStNBySteU|!%&BMIy1cdn=Ua0pTzGzj zDLb|zrCEk=T$4bv}Du7jJSHY*YRF>iwJyf+uMOVcl_ECT7n5Qw%!B!(0 zvs{$oDSqj^6-IB&jzMg;^ncHAsUP!Zc>5R_XLA&57;_v4WAGT+oOL=$+Ldq1F_%G0 z!Gl*R^H7S)UK#Ri^j}kxR*=}h zeq#1XR(IE!E#dda+U9c<#Qr72u+}kZApb7|&4hi?Z3gv?@naR&qypf@gKzj;bkmz%LyYOU8W4#PfvW9@_Grsopyuc_|UY5AA| z#q)4Zmdtu%qSyx{y4_FCdbo3yN! z^ShMawls7qq(ZZgsDtqM`{D8Tw=eOG4NT8Fo;Pe@!@!<}>k8Xit6a~zJ9cN<_KbHh z*F(LmDJ-7!3eNRG_-8@@BMsuch8d?~B+fV{+KU2a>^x6|H|iutxby8e^+lU@9QNx2 zdFNZo2)yp^p0_4%AkIVZ>2OZQ+SJrs>sKfh9~MjB z%Vv+rpFQm7C3hDOE}mL6dCm=Z>iIu+*}I>~1%-9Z@SjFU5KOe<9DjvCw%Fle64deG ziy9p+2^+EXr?~X_oYNLN{-gwT`r)qh^BwVHH9mkn*U)46I9I(bwmr_viFBN_*PbYk6~3GjZ=g$-^e^yaxcw z_wYlB@%utyd&oEQw>oeMF)IObCpP(heloDU&*puf*jWv1@JKtPSHHE==T6N`{5siSomv! zGc(C5Yi-nI{l1*4qQhsS$v!3ZNh~_-Us9jM!Y>1sV<#4V zHL%Q6@F?*$_y>6$TXIheT3GbgflARlvGDAV=Fe<>V&UHa7MpJYC-<^-h()IXI7Rcs z!tVgi(t)e8tdGJk^j6h=MC6+Yh-Wa~O5??&*s zIOkQjXTx{$NELpFcK(YpYo77&#N&}k#8E-lWMjtg|E2GQ2jD!Sf11&HxGux9Y?)h! zVMJRJqj9Vb>*m*?$aBFzHlz1|7(rZ=PO%$%+Vt!20sM~g{Mi;^mWOdXm;DkOlS{r^ z5IBIah}b&;!l_qbmdr2Uidh_s1 zd6y_*FM2#jJM-;@gv)il&UauFVT|^4msJB$r~wXpjN^8>))V{7pyzk#F_`4i+Xp>f zw~Ejfg{M&B9t=RP#Kq`18(RMv$E`x|EfW7~c+u(*v3ET>N(~C z-Ua{TF|j=;qBj&kj+OiY=8FntJbz1Aw_a=|6DME}h9Cdz*>`PE{S^9#=K)TvwDYrl z{|Yq~xmOgIsp!LHczX4TihSA8vpTv%zDia1#@;_adR4v(#nt&e^L?>({y){;8)qIm zY}{YbW>NGr_#!TLn=%UuR4C@C-&4_Zd18()_Nf0)OQK;ndt2^~g}I6THRU5~GiUQ_a&1-~%6dqmT3-FjBOP+f7bOl_(Z3*D=YW6>)H zs)`kP{}**{10Gd%t_`o9WQGu<9Wo?Ppf*h)#dMM;Gsz^O9y&9b86hBt(j*F^kPL}H z!+*e^S8PHu35g^iLn2!0iBzafEwzlI^=*Ag3dqSzc`3!H9FK=ks~$g34|)WxugH5p zd+lfTo(-Y>uJ60P>-yGQd-nZ2>t4@Z|7-2PwS~*t0A!v4)9 z;j$dU+g!uy+hOCqA9ar(7-yk(0gdkoQcU$6n|G|gV{Dz>Vp%s(N!J$hTN7bBge&lm z1`KbM;9Wy{@2+`(Vv}Ok*Y;Fn0-w&ZcBDhlJ95VNyy(aw@q+Mbt0ZGh zUaX$k-%5GJIi!rVAYHnBWyEEnd}_gajfokvQEpA1s;)@&MX$w*{0h6A(r5uINz6KYt@k=}TV;NF7gByEA{>>H9VN6bqrY`?x-u}{bFg=p zZ(T<7VCY35HeH~J)=G&3#X&$imPQ|;AoGWznWRx?@%Ixe+tUPPqbydk4-~6%E z@Ec|ExqhHEw<8gGt_)DD`oo*kow(|_!;{t9l5^~e-FoCo^I&2x^1Et<$WFsr$EXd4 z5*eWTHF(psdWBF16Oqfvv$S8MRx}4<@#~}2lj+?~m!(bEd#4HAk3wwo=@|v19bNqAgWZz8H^eullPO?_36dCdPK#tNz_< zuS*v@2C~zh#=En|vZi*PVGUh4D)2_#aIskTgtI5v>#BM|SUOPlNT0Ed9KdmjyAJoN zoRoW22yKbHS&6cJ8dv$Lu3g^RIre1F4sSRZ?d`=X*>o2qnz2h%b?=}YI~)mr^{QOt z-s9kGY8yhClJK>gCMMpTG5#xG9ha2+^~pC*NVnU@OiE3&-e5_=4YKR|Q<{{)W?XsC zu#WdOpKnf&S`UeFmS(J}yrs!yIpx{dRdVQ|F?MUl_g$8w39Fh*Fe=%tR^jYP#EQQ+ zc5P|0d0UV+XP9daq*-!-?<$5PP%Y)J*cdV)$@Tse@Dpn zGVU_`yQ1KZNEzlcrZ)YVQNy5A1NtZ)Q$Kbj;)`qrz^1nkDE=Jj=D0bSNNhCujAg&qn3egSNmQu9(P%kKPi2NSm9oeDV}({&>5h<ZLekKdX3rj%98n)vF{1 zZWNIu%jM9yN+ptn)L1SeH5-9@z5qsQRQ!49f?ruKhQbSCZ+$8w_SZh~MqYcz`?GD4 zKc{0&>71eZ6WKTaN@Rb%S!oaj$>E?OZ6lYzYPm7AgH}jCl@PN1T+RI!^cP%5utK(f zb5(ZQ&oBzm`p+vWu{W%+-Es!wBJN^2JMvq%dLunkvHJA7^i*&2$mQ|t(wooG-Kw#8 z1An}s7gR>*ZSdF;uy!@xO~zBynbg?^O$ z&qNKvTLLXrbA-2kb4J2o?vYT_QE{>r>%g~uRV|b3rk{z+le}07pkE~3`2!KcRZQhJ z`}k5ZFzZE3=ptJZz!M3P3DZSl&JAK_ZzB5ssO4!ReI?YCu2gMDtscR> zy)C`HEk~{5A38I7vzwmBYU5V%6YM*ZEVn5mn025>1)!wWLN;73G%O_v6m~N<|r1j^`VU zb#%e;`k~qrvyk(Z$@++*j5q_KrTY}SWn&`lMb=po?X8!u{ABwtzO>wspoN&5%q11R zVQ-f*LT@%Niq)96k#mS$UrlA2+CHB$jP;|p&yR1X7D_cmt_Ch=Gm)ws+y{1Ry_Rug zH;zABJ?cECZEu^dHTJpkD-z8E2U^t`#EyL!=V(r#ry6;OQBCPH%+j>k46T{2Yw5cN z@)%yld<33>{XdWM!8V&W@s2uipxqgMIXttCk2IQ|bB*3;r%mw(p`6L;vG-PC z=7E}6RV6le$T7f>o9aAq>ow*PlzKT5(lHLSC3}r;w^KW%(Xa($W%HoTYkw?9%;;U0 zG0}&2^fNFgJ5Og7%I|h~BNM)fRETi+8?e2M#$MQG_I_=PUKDmLGVK5v#UeBGlB)0n**N6Qg2A6qwJN;!^} zv2KEL-gWOV;t^UqED|RMP|ozliNv0Oa3%M7ls?kY8BS=vP(q$De`kzb$->KVq8=eM z|C}02%PhG(4|j$m?`DX6^muF?wre=1M^`?Ymsfy~y7; z8egvF8Y64xwVo!ze1q0L2_y{Vo>1qaP553$(=AG(S~r!$v{HyYW2!jV^HKT^uX29# z_>a<+a~Q{x^{-~wQ_zPDD19`8;v?F}4&Z!>a=WE+1?o4IH}%(S=Q8XxpR)w)nDc@) zCmL>zo7rHdIL9zw8R+l4dZxGlC7Ez6A8SRlR6S*wK~`Vmxf=D0FV~p!sBXF3SMJd(=VSVh(&O{EtM)u9$OYE>D8$w$#tE!1TU9-94vbvU1b4B9aBT0#i zYm%Zjc6lQ|x*IWiI~HS{sib~!rSrzqKYm7Ri?wNL0g3x=L<+O}et{G{i)UH&8cK7j zKVTL|>wNq@b5$xgSzaCJQ^ukV>hmgGGic3G=Pe^i`gw&FGvF;p_8z0!Qe)89R&6=F zcaXFri8|X?W$`DxmG!pDHs}-H$U3_``BwqXPk!bQKC>pNdB7UDCpHJOTP|M-U3eDPY`(Y>`LRO`)H#Pz zaE&Mb*n(c?@%{d`K!00`#nt{a=9e!hspU3r1UH2?SGiBnjM^1$R1&9!uQUf|9O1ZT z-F7}0c_Cd~PQSftFz|NI)&V@pc40rx*OflW4_wJT`Sz~FeXUn=PbHV1p7X(v>_7gN z$UVK_$BEO_lFR&sAcU(*K*=|f*n97CM}r}u{BiF)0lP*itp6ZN`7x-G}ICif3H1N|qS z5hr4E+t7SEM!daiThq^6$eNzU+S}D~IQOi2&g__|_em-*eGYmCKXQ9tLiWy|sWlPx z2ql>lsE(CnB3RTepEZn#GS1$*ZRj5k4E3Klk!%<(2k5!TWPjhV?7Gq_^yTUTIvm@c~yuk{v^?4@cXgHXIk(b#0tjTpblMWLvcEv(WeP9r{L0xj?=Ek+6FmaP>*io{U_3^WH>>h7b8HUo@!BVTQ$)7DdL`PP ztn4ng@3tzD>M@FMOtk(D;cbatI+ieKeY5+c34}sBCMYc!yCeH7!c}rg{I#ojAZi`< zD19%tyW91ZrLHwL)}E*zn%Oa<_0S{EZ8SFU9SC26B z!{|yqRos+%eryL_pZ^(J0Hsi0SxnZ>7u|?U+y1>g>%02>0z3mw-`nb>FNt~U z=2G1}l6%ZyXx*rr$gixhKKf8y#kJr0S(Q606Bd3vySCzVg>Oy(dEN5nO0}1xZ=h*0 zAE0u>*WT)K2WN?}CHF`^tXId%IV37E^9zZEIJa4ZSrN&om577=hGz7JDPqARi%?da zW~yz?v$N#bY`CUiC_C7od|GMfD{++sa-60Gw$R0L)3yt4CNPJpVYd9V>aWffWBY^*DdI3f|BlP-!H~lfo5aAVLj)0 zp!-E!eUG%^>brF~VbzuwarK>^>vs1h2Cc$1cE1O6Ra^~F0(*n@3Dsf`t~@B|(J?<2 zk6N4m)C?<8>jlr{?vfXA4S&pp??>C-P56&3CAcGNA2UY0+}m=@Dxw|xarej<(7%sK zHcQS%uw4H3LXgB(CA3&pMe7&h2LK{D95x9QZaj=tC zP|c4Urwk)KT0YfIV;Q4u?MG{$hWUT>O4PG??L)ENj8>(L?`miRyWqq@ z++U~k#(HbC)YRno@=tti8DTO z`sm6%#VIG&N^)C`Ia6Cfd9&b{x2}OkC-iQ!L~5)AX>3vk=As1k@Jb)$mg!Cr?rg45 z=MQoBEBrL0NW$IB$I+j~-+Rk#MY-dgIss?X38!*TC!EMV$$cx;g%a&fU-HC(Kx{l2 zVeNF=wY14`+Ud!u6K%1x7rb|(S)48mVQCI_xCGDQ;E4jEUk$RL?^0&_s?<7VIJ?ZE zvre30s{Lz1XKbWPs7g4KHLS7?+FG2^CY;JTt+EZhv@eiwBI~5eHfXbmeLU-`zB>W6 zJL{_2jod>n(U^8iEPrz1?#$7(em!lRhtrcCdOvX0n>%=SrZ1kM%qAV@kZvV4**0-} zEO+T_>00?~)Te~?d?)?ih}%eVa%XI;!;K)OnNxT5(UsXR;!&_j$5?S=Ma#a9E7SG%inz7x`{yhA ze1qbKv-o72iGwv`V`uuxh-K`r#)fRTCVExg(mW_6k_5*}zk;ar6%;yMMaAxt(lW2F z+#d*vKrm3?EG&1ri;9E(LVtO2sXO2xnm#d_tw4mHq;P;gl1l)yQZ=j^S)bB5Mmlv12 zyU9Q-3jDt=>?;cvxPrm5(z5cB^5TMG#H+wnhl+ul^2!x-F~mv=PfEP1sOVD zak;a&#O-oAoxwn`ygXR$D)p7ZqT5~WEDMN&0=L^+SXNqC>Mk!VEiWwaIfKOkf0?h? z=`1OBddo^(1wMCKS)n^n>?$rV4HguY6c?6yOOb~~E^l#JkZ9v%-R4VS%@xEa)vL z_4-On;tuS}oL+bT+9j*jETdd0C~zTF-hkhas$5zWEH5bWmj=rMf4mz^;ZxP{xiP+!sXV1iHSup! z`46%;Rz#uW>**UL-#*Bbn< zq{IY(uZmX<^_k@O{GFs8e^M-nl7=a3f08Nu6q9_jNzPR5`_)c?EJ``eB+E`i z_b)K{C!oKPPKF<3QL}g2B)@HvKQPI;CVRD}<2g<84wKwxlAkrnFB#-5=p)I|yFUrS zr{)KL@0s!=zC5y2{{}S#{Yg2?Bx|os#r*a9n`N>$)ga(FcW>gDS352zaYlYDx2P&z4}Wl{70%p?yQ>{EK&CYj#% zlTO+@Y?A5yJEMQAN#1IZQGdy&cCt@`Wzg_LbE`%;$gSddc6dVeM5 zl_tL4-${QxzEal5L$@hDrKb2uS&xsD_4r6xkB^kQWATx)UOrOR>${W}nE1O)a-T`2 zx+0wnucyD%l%5$T`Bqce3eJ1&gL5`1)$CQ7vztzWQDeL{2lsz$fQr71SQr>Cs zk3XK@biANRo~7o`+*o)iPdCX+O|srUOa3O4zsDpunqCV#y=rT_aTe|`L)Wy+rlHGk-xZ0V#-YbqFJdXL&DI}+k$J$^ELj)_0t#7{QK z+f4lFCjUN@|3Q;HWRlOB+MO(Q%(L(ldSh&lCSr-QuZ16@yA~vW+zL}9VmkYJYf>=U#Z6Lp; z@*6RGQr6p#ls`22>uZQee|^3x7Q@%pJ|fy{#5esG5I%`WLm32I>~?1B%d(I7gL1DWcpR- zi;L9!*3UPj{BVpfWqmx6vOc~``JjnEWRmsyzT|&k^8dml>-Amo_56~uem*H>y*)^I zc`W@>e$XWANCV7EL*3%>TPZ<2;kB8^oZ@{|BT7M!6dIX$-^f3tU->CU%mL(6nQS&3=W^q>c_7aL-42hBK!A2 zwxd4PX#5t))E@uM5MFPe^=kT`gP(L#*7K`g%trWIFy7J_#mCp%ljQ6Dm6Y}NC*_aX zJXVRO{7yl9q?2-{NiH?X^GtHBNq)v4uSI;npMbSUZ~%_4e*P_wx68o)KKRv0A1x8U z{HG266kol+lHqA>9qH=DiwOUZhVUN9t8o0On!OUpk3wFe$z)F-pX$X}$QMlUoe5bw zdAwOB*<+G@CV7!T{v(c`g87#5_`fmuABO)5_#5-|?BhW`yBtc9mOJ`Jm$Jc0YvXn0$e|~ zG#p{7DLtQQd6}mArwO;_U#-e^@u7CSELBbyzt`mTsysm?P(8`7MGpe39U{noM)DG?6Ken)shfI-VXU|16QE9goy>4DK7;s{d5+xMuGY z#4`=O)K|6mKBW537ss{yX~1#PaK7`NCO@tEmx`}b!`B?yU#Q6ofYWe&t=r^ZpmC+Y zL;SO;Je?YUq8dJ5G@8PvYT>1Sf%v5J zzqmsy4_RJ8ffx5xH&-pMS;A*ZpVgFK+f3#E8yQ^tX5d^gO|!Qj`ZS!c@i+RYe@GJx z#H(6sotR3SAmj^88Oz`^-UaFBJ#1 z`29tdYsG(P@kv#Ww@my9dUB_c&NPhQf70@sbd;a;T?Td}KWWNu#gra0Z_~mw0Nb_6 zFJTupav9j{+DR*6)@K6qw+^X&*tNx{2s4N3Jsx*a-A=+42boD&i`R5u`@^yl z5N10Czz!`hXnyO^>Yyk4MySz+^DW1H(qZ-e4ndioMt|k6A zB)=6qyT&2R_IHt9t3QNUPesM?AN;rlM`an!f{OW-#3_}W#n?Ht zu+(pG+6gm%6LDxkUATv_F^4d7+JKp(makUs#`1jz9R7CU5aC<#2RDq(rmd-Yp72c4 z3h@Cp{?6b{NQUD(s#@59^JYjq9@yS0(@2=(b2D+YbkVgQjx%BA&@~^2N7^YOtnqIp zzSaf_Gk-PdwR90?J#{^tF1l`KE0;Fu9LnaG_&LG>iC-f8U5N*Q?K|-YN0@EW^$yO@ z3&aUZK4Ip3X5f4Y%->J6CIH_i`Dwshmk4v%Nx=LaLz*Awc_p8&!!xF9{*2S$&EG4e zrs$X>`MHFtlcPPhyxA&L*T=JIn5r7*KVgo82iQRk5ss2)Z$lz9%$#|UnX?qw9+4cv z%vlMXr`cIg9Ic-u%p5vbVLMxiqm?6J=1eEOmd}J)PwBP&BmUqhy?OIhDAaUy%lH`6 zwG`gA?@5jtH;qqmuq}}KChYRQFY!+7Y}6>>p1@|SQlWajHK|(19G`xuCTn`atUn2C z(-tc{1MJZ7FyTA#2locHyhSQh*R5v#7f{*mkb1R!-6e4blE>vjn2(hS?9ez4U>kKL zaPvq{oh4i~u)P<58s@O~5Qk32;nX(unB*AS)FuOmrbo7=DqT=p%d3%i53rpY92{Y` zPuD^mcS{bnJNx63Lzp=)1LtY^{0d<$Ek}SIT6vuS=6--Mhs}g({-!5k)>EBvEW;mM z1vdMS5Jj*PPZ97^YNSO6h%-j|T zvp$pbA^gE*Vq?7;|COZG;{W5T<8OnX{hy?sFo#w3PhG7aPyBAFC(QgDU>glGaB4f! z+N`l1dEn<*LkulGKe;+SN$_*5Qz>eG+V@EgJFu#HkrdG6RKG37a9 zC*e&}@5at{pTsi=-!Jhj>>LkDO!>^5rG&MMB~;{jT39tc4?zJ(@pNcdjn8IPt$w%A z@vy{dd^D`a=Z8{HdF5!5SdCA!#6Iluwn*&9&ekIFe1l$%XRFlTL!7Y04cM_wI;2gr zLsVP4&TW=3ml4$sTPObDCSkKZqC)wNZw*g{iu)qM z99GRAiWHohCtVWH#m=!^;!48Z65okkp2nxNa~mPdHmSTEJMag$6`TEMvR)Bp4tYB? zJ5K}KcH$52S!`^RF!P@WX8sVc?NR)}QNNw1#d#vIgEAFvIyT1ngnLLUzvY$JE3sPc zk4fyoj*m;2k2?$4L4^ai0GsV`70Pe2Yj`bGJSQj2VVi($Pv8%ZOmH7Xm^o^Ce=hUq zs`UPdLJDyVoBdhIA z!!`jss1d+Xu`z$NG)@PH(@vP}P@T8!#~&Q&ZO^DsUHjP4FR>3h2NeR`ENqUSt56+} z@-)tTsJI;wX8SaRJANwp)E4r7A@MTom`|Ably=9@BxgN#%zu#d2c*7}@N*LHApA>- zshIPAB{5|U*IUADpQ7u~;&9NwA*?IVb_fRGDuDB%607x7o1d8Lr|l)lsl|@#Bw@C>64>@@ z$)UXE{3pyD%4aOPsk$xrXAWWJQ2sNgk2u;mOPD!SjU1XCDk|m>W)4M{Imd{j&7TP~ z=WWt!_6f88U0@FT7vgC10m97r9N6~X@du}#)9pn@YM41wpkh0@z&wr+W)3}Zg?p6=!GypAx3tp~PIa#QC3+a}qf3gv7~-;CDzqVdm2{ zT5dZTglVvXn+lxwza*ynfPDT=n8W&rucd|V{c&9-%pAIIZ2P^ma}RN}>i~qAQ%@Yt z&RXJV`AnEO_Zv8^#L?ICRaN<3pG^XAPXc5dLR*+>Z(WLE_JWISzz5Y(kPA2YPPKc3Sdp26p^W;;Fz~ zX9#oHQqpVbBFuUZFsG}MI9mP?X3k<@#~EpVDRADP#48Or2P(UEK1-OxW|3aANtpGy zz_!=%2d9n~T3GXV;h=#FZay})LzwN{32ZxyKe%PsIL`?)rvcdUCjQ`7W6RTQ-Ve-t z!pv_1=Hs>zM~gpU=5zzw{sn(0<{^k75Mgsy|GB(@4sZhOl;?VGT(w~$1 zo3YCqk(lx-@4Up6SBz_cZGV#bM(i9K|3Ttt*a~d_v*ZxwI2Vy#OABGv&jhx;hd;Oq zY>e*#Wo`;vwvKEF;WesR=ngl$>Gg^8Q2Ox3J^BkudY$ zC5{$nIt=3r#D7V~nK1J|19toce{c!#=5dWMb5elw{!?<)Ie=z|Fmu%FPGlHvy1@=% z<`j^fk0d8Z9Id?*X3jid$H$U$Cvmjvy@Z*w6xgQ4XF2h;^fnl9BQS?0%wefp-lvj7?@rk%QgDQsL(k~ge=GHbSx@7*jS3uYF|gyW5-$bL z`$XcEz;?Ru21l5~wvj$4IfPl?4V?F1QlE+)w`;=8agctuv`Lut)R)@6z#km7apn+a z4js~V8GmrpXELAKvO^0?{fzBP{K0i%V>^V|&Q4$stF~n=>~4d8j{)}q=Uu@c++J)P zmfEsS$h1&f<~l%_k2MJFP$Y-ivLi`iYRg(?A@p zeGz8PCSV&C2;4*1^3o-41!g{B=Br~l2~U>%ON1v${5fzQRU$Ylo=M|$%yuYwlQlhI*5?2_z9#u}p6K|x z#J3W@Sz-@%d6^PdW5@OhvznYohfV|d znGnLPe}?o#gd@!Qmq>qD>It)+R5q>dQN6WgOAggrp0^Wb{xEQ!#?Qhr_#Oda=Hvo9 zrb#<92!B&zs-O0wI%fVo(C1Oc!=+)f-6C-TF!!H?nO|z)_=pq29~@!kP`hwwc9sI$ zUzIiqGiMU%wXu~j>nSacZ%Mv`I9k3DW{%n(9g?G_F<)XeK217i{sOZ3ZK+>GHZ=}m z=4>JTZpk6c`c7a+fz(r5%gd8^7xCM4%=|sX(c({O;WQFvj#@@k!Qm(^oJPXTxfR&q zk{lo5Vu>q=uf?A*^C>M3x8&3sIE0zAjr3X?3A3Kk;wX_}X&lTelDH4p{+y1PPjgy_ z7XQP<(dGk$nR6VNIqG<)oi`cByR!xkjd5&;Fx&YMI8Qqk_0=4I!pzABww1|vx`7=u zK*4#iIld$DEW*^0z*QQsnpavqH0ISx;{1c;uQl-R2j=`I%yDP}&eQBu|IAp;^W)Nv zG0$HDhtoos?HmTSc_jY`u){0y31Is_>zMgxpwFX0814 zd|*{+a%2T)xd0X6LGZqPnbCm8#qnClWvp8 zCCnVE1Cup9Vb-hlLCYUweNfxrENN#q_>S2UKLI>xj*i*RlVo4h6K4I>!1fc8Pnh)w zfb-@`{qw+%+a>-D@wNVhF!QOtIp#?Y)iLG}X3lxy{G;T2VBipD&gaCLFF6U=u^qz9 zu>m{2Cpi-h9Ky_*PMigjQ()i_W)4+r$M+?Niky!{m^qceHu{63xqc1ObjP>-PiaRY?7_*zs`*Gv|3=$6b>1GIm@yegiz|ZmB2C{KLSLH9cY0t8;HH z4#v6n8F2VI8)4?Z1#Hv$fpfr0{u5xf`5Ew}CHR9Q z%$zTPCu@4btWQeNZ4zdEDlprm^Kr*gX_KDOnpC4>=4U`ZS<@3{Jw3<8^?@+!)pK?# zOgQ5?dpaUAthUjfWzN|@t7*8#Xp3A26y zFxM->tY1d@|0Qh_W_<%N=ha%^N%u+)VdgXfPuBE=S^p3)mnmV^w*s?GdjG|-T-xje zp0q;8%%|%QlQlhI*6#%7{3pzMdIp@^1!30j2exVX*$>S5MwmGVfH~g?v;H73=Nn@T65bX8sq@PuBE=Sx+Cw<$Na0`c%?u=_Sni@xYwV^u7n@GhyaT z0p@%r%=%1V&S%1`r+4@#t(I{n%z6j#WKB<)^##BjXTq#61@_2IgzFgjv4~n9E|dfkT)%n+%*L;`~m=lQ46(8aO+N z^Ha$o%$z5H9qXmOkNE2(ewy?fB&PdKTrPw;Y(FrU3t`sNeJCy$!mNJ@IIm9Hd>Pob zOk%nxHK|d@%pZh)vZg1@`s2V{UW8eH3OJ7jb8`9X>l$j}zk!aG8JFC*enn&5lG+uk zYt}z78fSf7&9c8i39VWCfciCd?55s7nxT8wuenct)O|F@hPsCOCG^eo(Fn9?%C!Ptr~h&ZQZiQh7Gi~u^>s_wBR{le)v7u~ z{wl_*HLDwC+*TlIaUZHDD=Su$`q~A!p{@~SGphH!*Z0rS^t9-tM6UXuwqp$1-xcur`l07x;K^Yb-bwrIoJXp6R)KE7%XT$Op^^Hr`U!AH^JsQ_w`Oeh{Q@8f&Q1$EA ztkS)&u0|W~tGPy~(3;iDmZ)B%LdpvlrmcKXz@}9Bc?PoY+AJhhS#I=iM0sUSU*}gYK^h-Sldw3SiffdDz%4F zJ?d7iTC=Hcw7|wua!JFeG{ZniEMwBtfk2wMmX8{8bi>-Ry-Vsg)vd;8K(+kdQDebf z;>Oj~?5>W*-}0v+Lv}LGC7O*fk2-QLJ!b zUeg3B^JtY2*2Pr)s3GL{nvkePx4Uswe(37hps|f+s$m1X(1;pqX#c<}+H+aNvV2uT zjmTHWy8JQ*r3?y7fM6lt>5i#%RLr^G55*+ zLQK3NCJJqqt=?ZJY}LGqbc%{_YN)y`0A?Ot-(<(U%>YSIdNhyH+vNHrbUl{hLw>2) zXpID;J-SZ09~(QicQ1HGdy8SO5+t%`!N&GB02}SmDba(_v15A_&S>vB*lUH3^kXzX ziXW{*W3)%tsrsO2$M)!%H>15GT<~rHiR_KVMt)@P=Lm1Kw+#kRL@~$qewZB3>xG9S z#*)u?k@z5Z#^d5c;`nxrJT4uNkGl(*WIXO5?DfH)9Upf)ct(4tVDEX5C>=LpV|%v) z8|~GiQ2U`{$Mz6B&R*+mtZf4w*|TYW6i<2%(P%Ff2TFsU9os7aF!Jab#A+sC&%AE| z7}GJoLSUs(d0ad8oQ`*4%xJF>9$DA0Hv*E;-Zt2ycvCvk4fb9&+3Q81_1CaBXtK8( z_8K&M6Abo#mLlWFd6A6r@fhq;+%vI#fl5Z0+wUy!{E*pkzI+OvF&#;B^ma4}Wb&hQ z?E)~`+Xj17UhLT3cJPe$?u5OGAW^FXUF!sP3e6f_H6K^_~l?@ zd*4U;jPZK~^=ttf!=CNU1J4-0&v3(z+tGA`y(OmhYr8>++H2Tb1fJ1e(f9OzH`ic~ zurYq?VeeY;o2G^FU{CHP*yH#)Aai;hrt}_xJ*ubdIKAIArS}uqaQ`qpTOQd@Mp*Iy8}Ft`A5EkGs8 zfhmVO_79sJ2&DK@tE8n7{bZ8ysJL#;ZtcM6g*enpr>aCywo{16q9X3D>p zVUNPHV|zE6@^3EeB_kpfKdOfuze1C}&YSRzC>z6`?a}pYWBe+sbbB)m_GX&;gH2z# z_B^7@)E_LyV9DwA80|LuroePpN|L!!{3mWXvKxwphC+tyJcAVb-ZK{83VedKcD7`$l zq53jts?Sf4lXF|Mz2BPbWiCWN4jtL6z{dG^2-p}uTgJ8P^RKip9_-1DU!v#VT*z$i z>!$SjVQ;@0LjG}jCxK_oKUz270w@%}dDz$DXoHkq zH07ARH%;S55++OI;m?lkoiU9c_b=1qR}C^9i|UKZG+&ztd#5PEnqzzUruo_q*rWTZ z6u&#MvAtiJ?7cr(uHR+0_pHfY>b*FwW^a+f-XCDtn16@ACdV1Gy%XS396XxGTPyVW zI5A3}I9_8Os zY;5mYQ~BQdbs_!&e|8+dpPI_I=?8d62pL88YO%4s_e}LKHxuQ4jq*Kjs(+^%>(#xSIlM zj{Io*2@KPo?JvJY&JQ%2dMv`NAQ7)X^VkL+#h)Gd(e?|i9gPIsw_mZtnLFgK_ud_=PSU$NuEv}i1n$HNY8I?|(vNL9KhsjjNJ zy(?m=uCiB86W{ByR|nMpu=;ONpuso6?bYexqb_^{&}Fx}T{m_`Hy#yZo7Z)fWPIf- z`8|=UfXMH8(V{4J>!l0px+39po6GV-LQV6QCVN{tzBpZl=Xa)wNZ6V%qbFiLdS!D) zX#Qcb)%Q_GbGkA>)?Y+CaICiKstDpy)fGWJ=s&FfTa+p_9uY7%cE5;tMB3c0ab2!W zuOS{AyIw>*oIMnGXHSV$Q6g=ZE^O?wTQd-kqlkwqyw8I#g9f%VH4k)J`g=Y~51rd5 z?ACzr*4dLS7Y?>1<{Z1S+Z(x~P1vj2l<56drPdn#bc_-`|5FjUqh0JxcGYJn_NsP; zw0Cz!?;E4kj@dir?(MGnYO$~@`@sG$cMN=#Zf^_XyWFn{94WZl8@=t%;&O{C`GP0h z5*>5F6Mb)tGIrM3?U&m(cSTh1rUe&dwslQE`r39L9QwAdwa>PdyqFXPD z=$1>O<)_K`rg(zboDmItDjwf{xjAZm&J%7X8?SX;4zJoCIePKR<*qloE;qN}K^5YE zG|@GNInalrf3_&DS6>&dt(QETTcXx;9!raB%sJ1S-S$@zw(a8f$gxXTqMP0j|Jr?d zOLWXBPk2kzdddT-ZR2*=`-hM(AEhbhw={*s3;1Ssiq(~TRP6Rn@w(gW!An;*Zr|L! zu-i5;&hn@Q-|SQjyscOB-0il39o~!E?YDh;<$>_PcMuepo1hgPtt^PJhB|FOFsWlJ=oiXUDaU){HL`M;@Ps zZzbzrS8hJ+3P0}2>KQV8SJ-7KQr4x1mWIW+q=7p7R?CH~ww9bDS0;KRueXWF8Pvp! zR^_}}6OV3>RH7bQUPG%uE&L=&IocgS!|M=owvqOYNzUA*{}<`K)7r;dw2QlV3L1y_+7+v z7_A|+qsLU9R6F$gliwPtsusB&p{37@NaH0XWP4sTAGT*qRcnr35BS^Xc8f>|E!~ea zJnsqNY9-aNp|;%iX!|j-r+o8-J%f+p>++$sVUc2~=pkP{Uz!gqhf)91rwW&KnnIQ= zUF$N&`!!N3S@G;_!v+Bp`-;%#IbnZ3bM*Yn?7O5^3k^ApQxrdspqSxw592ULpiQl%0mc8it zesY^gJkTy$4!kO&-~G>osP#V+`g>jfW4}1GGrR8&G0XSxKSd9n7N7SxG|)jGpMhcN3y*?;>n8x?i}T%zpY+WmfRXol*DOqSp{M z>PFZnVSE4Uil}J$$rvT^z->z6FWZ%tU%sliUN}IuobM#KlHN(k-Q_BNTI`KvKXad` ztjOqbJ>Md-3`cUkpdP6oSAORq6prLJh0Xe>>}TIoD&gxY+K#ZU=Q)-XHmk>OwI&=w z`uNM|{1nHE zSc78bE|>cgjJuI`pUCdpB3{|zZVT}UOGt33a8)Pr!F{BJ@|4b`tgqZj{epey~eMrhniA^z4NQ0GiC1+6FoWM)8UG? zld=9{T+*XSAv}<+*UzkqofVdvEltVZ2>Xyx(M$Aa5@ov(Dh z-0FVh;3N61xgGZ264(r)=Xwk?tM{64z4Y;1K{1VN%N5ZZZ&fCG68GI8TBfDK`kxc> zdt5gL5^KZnhVN-R8;d*1Ic>vjE8E%1xK#Axw%;ht0hi@gC2_h1y+oOEzOABtkFUw& zdf`RUwLSVmyJ+6t-!tWR{(%s zsWOrk-fI}ulmXdWQOOcFE6g%meqfz-IO|N#>55bHPA)i6J+$cfJ;%`V-jyRF8{HyW z{G2%OqtMz$WgYtFmpj}Y2V46)?N5A5xNaEoGzS*Na;^Fam$lKGVqIX!{b+clG7qsy zcw89?HQgZAO$setq&%A9t&1dCE)0hg_YYlZ$w58310(DmZHjASuc)=wZNGavjk#GC z%tD9Tls|93yF2=6uQ+erJLX@z7j{*3XCD~)GCQ*$_8v_Mt$mqBk@;DbJ1Y|wemuLj z;&g>?&cQhW)U|7+t@cR$;LMJfI}U9-*qPs%yG;pPuCn)5qnFMRc8fJ(xF^zf^oqT0 z3XM>h8E?bPSV?alun)_b@gL;OczBw?=sz4#|HJCPMS%u0xd@p0%=pnR*QM7)NApE> zW_+;6jxYyfGvkZu%s3i8nlRFQV;82IwK4;$p@MvS|`P!r8dl)l+jSLa>U z+?{hN|9UNU>xCqWNf^woKs5aYLG9Mrliy>pY-tL14{lXvaZUQ#y0(*hPwXEWI)3ul z=_A8~XAj@=cI{jBXIH+ldU*ZuV_ohJ=Og(iUo6hejfD5@%{}cqGUHeX3o_Yz?m+H; z6S;3mc)7=p+>bmmL0q03n!i>_^{xB=F!!4))DkF8$2nBwjw%s(@S+m=(H)4{g`}Bh zLQ6L)7QfPWqd%J7ArhzEKzCyj#s)hrgLCr-5A2Dgr;A4|Pj&S7s6ATSK8#<(o@n?` ztVav`?Ne?MSwpTTT7|1?o8n4(&NDcB9$HLothBQG9vAb%C&R1ThT0aj54C5V%G&zD zRxaK1kIxH#Y+z%iVhNr5xv-Bf6TU$1u1L}cS59_ih5r(sr-e_r(-8W{m&e!cYCgB} z#G;dFRfBWhMi0c6mD`m$Y5v+>B`BZ0KeAg;LW55KmddoM{%|gAt-o!kJ!k9rS{BgLh9u ztDst6Qkt7sK~?8+6+ zg%#n0hH=7Wc^qTfUFg5{v9lL_gj;c=F6y9b=k(BzTpRZ(xo2HR&xmQ=(e_ql=5beXpK!Ski&b5@CqC-RKV}aPUCDhTaoSj6 z>DcCTS$S-Atvo8i9WKna=LqA*(z)y=r9QmhkUr9Q9E> zx3vO&$)dKsv3|lD`1tM+p0&w3)f}X}v<5y1=O8clcwI%Wi}dYLH7ED>P8_7O0OX{t zSIO~XR#K%~t;ZZikHLb#&ZEz^!&dDwD$S9bpX zFBep1#pU#ZxO~pSjCoPpmTImI_V%xd-r)K`$o5llX?}g>aAk1ep@lh%dKX#mx-_SL z?(p2;?T2n3i~dIhHmt?t*&9~WXNDT^BxUBNIy^wSW_6~sARmv7Wlmq-*tmAXjBkJY z-W83@H`dZ)``@nPAm65EPV?5TU$e3<)R+%OCcN@w$R*AKXK_KPv+Ne(4PpYVKE5s# z_5P*JvVN1xxx%@&aLFp?+JYrDghGTKT!lw*3klTJtXd;M!}<*&AlNXuf53HLc1hx+ zE7>fl`$SwBFuEl1Bk(g~Dk*O>$nkuu%3mJym$Dw-YO5_T|LK^& zlZ8f(nHtXrAsyOZ&LmB<4alR-(=$3RDKql!*XWmEirpiUS^X0Ciy{w9G{*H z^>}=5gK84xj~+iMx5mOtneKl{CuKdqq`Z^8HGB0Yxy>NQ$7iB?{LGlYlxLXaO(uD% zNv8Xo(#i09S;QSsN}t|7CYthplIpLAm$EMwUdnoYNx8}7ztSMbr*DdCe|pSc$|(jp zo`18-FOB(2d6Gen=VzMiOIf#{X-aRF%Gdp+?2Fx+k+R-?q)hK|ODE+8CV7WR?l;L# z807f)PgUci_cv0O_krk$Q%&*DQTh7)Ke+eEf3N z@OpievfkcuO~-erd`HZll#iL@2Mu!k@$%L1Gh_ZzK4_AkH_5tv$=A~(<J~zd}OPTHmN>^Y?zf&wsl0NSz(0#=slYfzFZ;*q-KfZjVtfxoHdU~Wh zYzqIrN&dhj>-U#sc)fl~S+C!k{aAiT`I1Tg+$8JIS4#d7q+L2G&o{~R?zPds+9cC^ z+D89YgB)KzZd3l2s`;t+7gDyeIXoE_AAW|)PmB3WIoTk`^KUhUpJ|dks=fSJcq!}s zx0IhY`JYW>h4i<^@>j~eCfQ?>pEk+&o8)&)@^O>=rAfXymf!ODr6xJSBu_QTCr#<0 zcj~2+_UPGmqkO?6pE1c^I5xn`C+)+IT!#``0MbvyLp!K!2$_pNNN^1B zzYH6Fqw||uTz9B)k|-fhxRuz_@Gx1CX1iXMlf@s&6K+4YG@LVE(ei$}DyND!HJQdh z`iADeXyF@F*(RRDo*nf=2etm@CEzstrm!dWy_Y*YQmi!P1dtI8QdTV6sOQ00l@ zKeY68tMVj)o7t+PKAo&bwD`~*h`ym&9p|4Z+BBJ-g`;m~{#vuQROL@qzYh$kJ`Y0Q z$n4Slsm{|kE;q!=LdHK=i|-;ed@k;1>WzG+#9J-M5)rJ;Yhs7msg+B7jkv}^XL zk4eLmpTE@PELENYr>HUPf5!uyP4&lbZ^{ zcvhGkdGmMt_7bMVXwF8N21keCZ}ib|ZFo+Roy{(h%F(bBDw{SDq5hVhLnN1pEpGxL z`8*JRXD=VJT^qOwyNCei#>N~fW7}6rE8h{Y;aN3u6rVh;VowD&eov2W7C_H7sqHwZ zK;Zn??1xmSV&*J>%7*8B$UTkChUdD-(O6;oh6>g5GRBm*j%=x?W7#NDa5J#kC{l1s zvDu~(lKq1%N8u6IfR)*dF9Zag`(r;QAFU>{Qs83^RaW}NnDMc zO`Cu%CcVaQB0U*{+l4Lf+bTqzgT7E=wH(PX9AzJWLyuG(H^Lk@ny1+`AxO9ge{lC; za}=vk=848x4HerV%yu>rpDF^}{n!}y5!O1?iG<7W2S-(bzw@TX;XA5Yea@IURR8%{ zg!xztfE~9=ekFGN?YoBv|AW*gVCVR*#8ehGkHo6pCov_}R&LM-Bv$#98E{G1Y_n7- z+x2XTXQB_VQKaC4gy%@yM0l>m^xT{c?~st&3Y<4j;%%hY@P5MoDD|1xae4`JdZz>P zH_#}r?62Stjxcj5D*Qb(sD#r?`SIgy>I%W<%%WbEKz!7Hs6sn*1N_`e^o^~uNRJI>TeJXZ&4HA>y zP8k44nC+--ZLO+S*WI_Rmzc&2{^rBwlL3 zPY`aAdOV;bY|RoM0_HdqW}C-|^PuEVS#$XkW)Ar}+UQ?i+vV?@A*gV4sA~0@fBr66 z3RHY7!fa=}K~I?V(}8W>_=EFfi=`cyIn)ht9U#p5T439D{J~K*<*A( z2HPRboLvSzVb&i2=I@WWseB_)z)^j(5fQE)n2$@C!_qs<{4FxN24(A&{9V9#^k6vL z9$*ejn8Utg&=Y1oy?^R>OolxNY}+j{)kFSX*$0H5kb0_zoL<6g=L_JxA4v|ahiBU( zu^ZU&V~J-1bKD4XSgMDtC(L@Plibe`X8mf?ACxu;v;IL~{zlmr!v7>Wbp65BC-FgG z`)_p2VGomDYny~we}ck3CHWr`-YfAXVCEBMK28yZ<0q1HGqCMxiE{|=lbFsCISzz5 z>`db9mmD8(-cKc_cdGfDV{3sqEMX421DL-F_6%{fv=C+vog1>AFzb(zUdvCytRDvE zZ|hxSRVQ`DiBQ9X0_!e?v~{y+>8H^aZBY4G?xAk=vK2L}mtZNN-|7q?*#!F}j{9tqNSX2GX)e z#%l35mNZfi&7Amf|993pQq62cUB<#X>dHb!Q?zcIy4q0OdO*wwVL2PMg)Lbz>gqtM zd0L_9Z%|?@_*^d+|HfiI>an;sUw?remHPLu#}jASyeQB0VjNpt=X#{SvCxk3;Mc7{ zf8Q!OsySK>XX-L-jT?0#AS`rqy*R3C-eC0?%$aP7Z8VppOBhCb(;?9LC_A?2fWm0c4|`LgBYTuKwwI5w&S-BZgnIb1V|%xN zXSBE65Wi%Q+1~GgjrKl+u%C@#&-RXMVLX~&lffR%b=lru5#DHz?wQa$mmS-qIhiqj zyJ2rCNR(d6H@5djlRcWZm$EVJ+1^Q$z26w@-DI%$nkoOjgaMi}vtxUwO!;>X_9{W5 z_}Q>={GJ6crgtU6y~M__XL~;dkHUB~zoKk;O^NKKVPkvGnc|lPk2Wm~?bzPWP4Rmc z_9z`>Z#*`(*A8He-!qW4={Q)ry)DpF7!N7oCQg;_J(Il*Y~)AfLQ8NP?af4+q;my! z9KSn3GTPe%d(VJG_9kLud+#BD(cXu!*UiSTXM5)XjQ0G~^z_p8LALjGgg4rI(2BNs z4SSQoGunF&_9$KyzbOWLU8eHb4|}&>!`@a?c^o&`yV+oGzA1j^M~UAYQ~b^u>}4A4 zHJR+)gzN8gkAofO-+wdN`waHDzGNBfMG?T5f3KjkSjxt*XL|<#jQO`LN3JhG`8O3C zm&Z0>qrIEQ>hIjbD`u}<3*#Xr+_SJp^^NQS#_Vl3#cv+$S+9}aPE-6|f)VP+$sYAb z96wqI%NV~(bY^t@h8?H(>)=rskLEG!n|k}mg^umfbqk}t1F-j&7KV0g@4Em-dnaJ; ze)v=TsJ^nj29v!`+&l4HBfa;U?D>(%6Pi5?oiTggLRe$`hLFjb@Mp*I%K^z4Kie&O z`zQdJ<97HP%usC~2hKkU5=TvXNe2fh!(@Dddr zK^;s-MoAG!#aEUE$RH}3DVmxu7$7i26Y$aPc0m{v6x2r4%uMl-nb%v6X}4QmAVDKD zGhdmRTAG!WJ?vo*|KD}aSu=;DR=>yR|M}ei|F=Gz!*{K{_S$Rjv(IDB*?VpFkNOb# z5UVCwH1-ClX{eg`3Y*qmYusGI)I9W$?R^HUwKqUxZ=jk+_KILkYp)ON(fx&q?L7u1 zt-Vnidvtx{_IpleFYy-s(YJoBy)2Erdo=dGgOb+2EZC!Oj7;p`SJ2biD}=oi=+W_w z#YSmVUwVy5_IhF?nueQSx&q}rrP0=2?FXE+k8YA0A|0YO08pK!a6*vY5N7b7^)jHO zoySklr$po*5$omQy32JUd0?;*7R2VE^zGQF9%uq_N3T2OS^2zEX6-ASf|Whb$#phq9xwxv?6aj$Tt92S5(dEZkwiZwz;RLm=QL zKX5(2jPL`Pei-R~_%td0cbHK~L$`601&3jpoAdM;I##s#sATV??~~rm z`hJ+I#}-yIQ2$d|MAQ%A-z=HIj`VKU_vw1A?fX;@BJzib?TrU!UrBxzTP!w8r+)A5 z`!W5w+sps|xbG_wEG(8k?)&t;lFIwPzORJD{~z^z#6zC@Kj{A{I1c*$ukWu=k&hQ0 zv;Xw|KM8gCQ~kg1fA!k`fBm2O$^To|euRI1c&a^nR#wLB|3U9pzTNBle;QRpCF=7; z^#A`0{hywJ|4je4r_RX8$;nQQwnxuQn|_DokFNi{2J{}FJpKIf_5bp{O|Snw(Xu9= z*j7b0p1&y7I*qZdm|IYo{fITZRcmXPqSn^1<*luj&L(SguU6K`xK`GP`&(JNrM9w$ zKhkPv8D_YbIh)zUB}6b1-k#Zr;95<=960(|`AH$ZSQ#-uqVPHTAE^HKvoCv2G`CqT zkRHDi7Ph$O#na5*RyR$d{ElIi^FXW1tqh5d>l6>iD(Zz1bJt!Hey#T4QOD^p3X`AI zytv`Qbps;q6z{LUUcB$v^=cp2rHjI_-zW_Gf`y@>t0->hE9$(@`_?ZF^BG$i@15ow zx72m9tuz5KVUGP4RNL9OL5{F<$&c!H*3VO;%hIKGiUnAL#p3;aMVL>WPnz%K%J(qK zFsKGm6_9t6NSBJc8hTk081KSZ*NI~BT7~O@O7U8y>qMm(wA8fkc_$Q9b&PQp??A5~m!Wk~!4{{{|&?3tDdM*f9IRoW@5FnhfxApX?(aw zIu002rGCa+`***M&)*owHm@}SF{Kk@qpOCkM62TrlzWD+(le-Ev>Uv-)@Y=&Oo@(Q zGS>WBY^iN+z;&y*OI&M1cd2!8_u5v5h@w`-5pk^yJ)~B}J!*r-VqRvOxTLt%aR=kL zw{t(-gNwBj0}}pO8CBstRw_B2rNZPy)Tg;uTgJ3_S=_VQ^ngQho+y@F#h1k1)y`lC zqG1$E=ZaRYiYeYHIKT7z?_0(jSFTJg3aK&-X(0@U5H+XHAPh-vi0%E-_kg9#_d|aRGm)@&v7hh~mMEo?@1wYC4(6d4E{+o~Ej1nU zm7FVm5#0@5j)eyy4(ZN{V->F<%7p`V9FnWPK)hGkx5BS3x$aii^WJ6ACEH56$@c=M ze~~7_Qa4eJ2r+#1jwq4Ng(21jVm-VRj0h$>o-}M38d$ugEYR@m8-c~o`Zr%xbGT;3 zzLWb*r3uoODwD%MaP0wSsV&fOd;RqeaXTID>L%57_DK!42OSrNa2w)?IIdHgU)-|# zqxGxbIPgX{^yS!ATw<8xX2+3^Thk~Z{mLAP_A7|Jfg>-iFSenL6GMbyNVq5-(hqH& zC=3bXL~%kU+Ifx$L))G=y3!D>=A&bxcyKASRziD=D7Nhu)!w-N`-S>Wpb+%*!v7j?ep4X#hVg{JGHeS)s_F`0<+mOe(f(%VTfm-dL_?naRu*Ty#9 z=6Yz32pZ}-;J_IZGsIUKRGGN1U&Fuyy&EZ}f++y8_Pp!8er@k`l>F9Bc1sEn~0CFcX*OFll6D~B%GP;qCav&7pwdS66CKX@yxuTI*T7(Zlm;yG``kMOoh zl5K5lO~Rn18!87LFpXa*IY%!PrZK+K=~&YloGXzAv@@80Q4Yq^mXQ$DVE~8idf_}FIw%4L}ZAUMC z6%p#Vp z1e0hKeJibnh{s^W)6_Bt-oaD7xK?q2wE?JAGr3l_o5exujH4j6@;MZCFuZZtfsqXq zk!oU1zp`yOOR4?sXLk!j7k}|uqWx^Cs4L%FGO)a;R;r6xyiZ7H9k!8pB01vrE5=xk zE2TGTZxqhbHsZw!YvC)x5nx43M5FhhMY~Jv%Q7WI9=Sz+1M<3HgX%{4yQ6N6lpoOx zH2LwIStgoBzVaGwyx~ft#9B(*x1*%EhmUv-eX2n1Q@zWIYU0Z&f=53@TQVk7`#5al z9ATRNG05gJZjwDQ`Z(u&-;!Fn=)BVyjA)ehX|LiaH^cMKe5ttJD1L2YY!+2v#mXGU z07oBoB;l?~zXSLfXNBT9*UQ68!}s6?6|M(j4_-7omjsIG z2TUoU!Zbe=aY53Bv%Hy~T{IW{@tOh=(eTXX@5cS{B#tOS;<&p96%927_YuYs;pJPN zGIdB1&gMpmwIbF!t0ssuRav3A?jG=jf0AEL=(tjQkiTFL+MP=w7AMpr z^_Uo2S)6zQ$Kt98^R_L)_1!qO!gbM4`k-P$Wn6_d{GAYMw--aK5w#)K$PFPEpOn_S zy>cMZ*iF1DhF69rURArjs+YYg)_4^UuW%QFSG5(k|E5>xpET6Jf%E1)^tMm&`{pP7 zIw`}`#*?CW-*fog^H23UQ|-%Fn#oIx>xV*f0<^M)p?*GEhpserzG+7JI@92fyzRy0 zisJpM-N*it`Eo#9BDWW! zmI_nBZNf2B8bLUI1oa|gGwuzncci4f%^vhTuA;_f9^BpCUyDZUX@-8exS8l5+@j^4 z;DBcReSCcP_;?xi;G3wk%wOOxd)QRsSmq2&9A#SK6BLekr>6IB6HfEP!t~Q^=&?8N zy-r7fpWYj5cu`wxx8-fE5k=?$%R{WuMZs1J_%QHYmWMclA4J5hyKudY^T`V3I+#iW z{HPymd$FhINFz*bhKq`!F^kJ%UF8o;Q=Z})k-nj8ZAfufsjVSAu5B?&FRlx~Q8ME= zM&OtX6ov!CMDc-%!tnZZ9Op-cHGD%G^wBoxqiw8_@3g7*MW6C^oqs^MJ}N=4psV2; z9P4ec@(P|U;|*!Pbhe!Lb$#q7#XR(oc&Eb9(1>1e3b9g(_kV_xt_h0mhU4vByENwF z7-3s_tYR|GhFY8r=WsUQjKJA2#UZVSx54l>1m1?g+mPZqMDN=l3Qv2$&Ry_!IJ|uj z-aZU(|8f&=sprYw+E>8a#qjnic>6r8{Ogw9z6o#Nm%aTQrTlzTZ=E3{P+C)uV~p?P z2@z+0BAx~5ydQEER}u%VBDhW@;5uP@Nl@D$T5*$e)&>on)rlF%RUq`|tPy#G zI^ma9C;YPNXoxK8SR5JG(GVqdERL$Z4R@x_3ko&o>(Krf3t$QeaNkc%Ked<7!9D7G z8@huq)_dgqpuKRe8G*a{ME8ATT$Q1r9)08(dejB5QevnqWJA#QCx!~^k!dC?Gx{No{lk|x?(PVf?rrTQ}CX{FakQmp_7bv zM1JSJstxfi&bO#;>AKV!(XH(`qYg`s8!Tm60RGWNenKk$7hp zP4Dd9X=4q;RUrDD*=qT^1NvGAYnKh!q&9Rl!hPP)eTAxua<_SOm56h$m?2yxDRFcK z;$yL;>XJFkeP>Scd%>%Zc>sE>$*;C;wfidXa;!yfqy3-JzPauA5r{uYS7r72fxQey z6x!!tUHR|ur+#Y>Y7U8~e@Te=w|-sb-|jlNZ1L_#FO5&$mbbIvtNwRse)32 zI@ud^&%Jk3T4=lWIC`DK2vZqyUSJdzPBOAL@U8)OvMnkjE`D$<+-OVbJ-T&|0Bl3J zwJE4oGZ<-!Ozq8~?QZMXsRPLnNEex@**W<4&_lfjq^!)&^LxN&T+(NI2M@SA zC*t|9{&uG8TSJ=tkiW6lt|$9Qu1{C~IP$`wPfk4L|Ic^k+*{NB#A9#t{P#DTXFldk zUvtp<*XtoCax7mxwtU^d0)M07=b-1ibbRc)$xF_BIb?8OYCCEJYAb4+5Z||l4)6D` zE6sPj@RH#`uji}3dHbP|?qAJ|t>66NOTI}9Tl$2I@_T#n;)(Y0_Oz6HQX-OiK0k5a zhU(Y}V}I>j^|o{J#L}nUNxl%D{^Ju{K8Sw(SpRn?yxwPZzmp{&1^xZQtbIc-zP)j3 zO%Kzs5s}Rv>c9P-Q~lojJnywp!((T?xaUld&YzF^$UJRq_rI=ejOqE-*Dsa^6hBXiCs<}K&$Y&P~Dl%=god9Y*E+3V>?g7%4| zjXxB;Uv9W~%KzRERxF%U?Df{LWifdVegEy#fBX0O(NCQWKhVG7uA-GQhnx1=qd%Sh z?2>14U#;wZ^{3r;{JLwxywyI_KS_M#m7`ssk6%<>ac#EmKga&~<@SJnLnE^89`N<1 z*lzFs(&lz z?E07Hk4)|K~>lZd4z2lvcTY6qd_;t}U84Dl&&YBeT z&iyq%9a%qiL)^8&rhRv8-F?8AzyvAC)nq$ms&smukI~h_Vs>hMd!?m zhramauHXJvzp4L=$;)#q<`|;RtPKBa!=!h=xv%}br{~```txsRO!+x`=apW8N8es@ zzTmlG50tdBg1p=Sn9IPw5gJ`aez z?S+{Yi(0f_II`Juf%9AaE$ovC=S~ee(AqmcrRU?jx{b{mwfFG8UT;SHy=CL9>%Fu6 z(nObcetzW(TT$MOl4rgg_Ih-!bg^sFlmB%6<)=gc{_v6RZ{?WMpRzw)GknkHvZ*h& z{qEIw6W{JXWyp$azdX3=w~5>DPB!%Y*81|~=}#Q%oN#}`U+*kFz3s8NC{etLEbeKHFh^*tYqL`)+%p^dFCPy65ziW?Sw& zHu=4Y_vb8L^YaV&J+72|_-3CuGoE|LyUoBet$ME=^UZH>zy4^KOVhHqt>2KA((!D1 zkl0vIe$oGfg~e|z%lrQ6e~&(SprL4{$^PlH&%E0Gr#p7d^ZDeFqt7p@nElTmxA%*< z`|H?u|1~)H?{ffRNTyoSX* z^zGlyKNa5pu9d_0M$cc8TX}W&uM<{JPkg0oeDyWov0nxZ%^I+&+h5+O{ph>>>uz?Z z!)4)5(+&Asg~cR{&7AvZ4csdKq9?cg>);1pUjHLIJsuAZ>9*s@mgj#6UgZDweKdrx z303C3@WZJV>7x$>ecPjO+58J>KYn&(bmYV8tX+&l8uWQkaN{F;d*to7;`r;_qE3Ay zeeX*3I}x=yXrq6d55GJ7blsW-ZBo}*7CtuT{Z7sBRrUAj{crbI)D*8gdg`%db2I++ zW8ri!oTbJSW4FM&ITwGx8qN+q;3+-5u#^f}RxckP(W9kxu_reLR?0 zo8G)Y1eu&y07=n)WFw5<+Mw3qMu}#On zqT$on75TrvC}Uq>S3+bnT0>bTneT#iaI}0^;oXD}*Y(e4vOm>o7JK4@d_#F3p9Mw@>}z7|-3Y2)idF0ewu zvVU8d6~SU4`hyuf{y{%fPWRl*f<-SR@EjpIU2S{HL;PWtpCxErqDE*$2VEjrzfAY zs6X*pI-bVzD-Fr0JcZ^i?C^VPrN+EpD~(>-cRtew>a^)bNe)Wikrq_T*S=ioX{3d^x54B4qzx)#NAtFX{M`8vZow(*qv2 zSCCp$#eQeOaS`#^3db`{w!h3zRl@Q3MTJWF-R1N;O*)nTqmKVl$K$rDlG2{v>Cyu< z>2J9E4rOU8n)2;*e0v>l*72b_zJth6J)w4xut;K4`+B~kF1?eEx9IrJIzCLtTXlRF z9p6>QhwJ#;b$mA+-(AN?==dHwJ_=*U6l#Hg6bteTm8XByMl{Edh;VCR6f~!fiDV~K z{yh3YYxH9Gr3Gn}PIG378nLy;{d1gp?om9I*0}$5Re5^mYK{BJc9mE3TVYh7oE=|z zDcvL%E39aNKGPcgbCJ%UuQd)(`K@&Pr#hZa71J|{QNkQ2gd`ldP}bRSqYm9CI4@z& zo1~EwW;xwQgVb|#k_M*}rV9XQ4mQ(98OoUR7D5!Io;S-hI)qtg9WcjH+(lSDuU-MB zH9~QS1Yy?S3mmG-39~#9ZNzaG&A?no!mN`-I&{$hO(KkWN<{SRVWQ5YV%C35BPYyq znv))cd2vK*H9CY@hhqJ*O~NdvcvBqvv5~ME@9~sIpD^oR(#Q$3{1;%eI`NG#%jw<` zs>%tooaXaKwo!ae1LoM0(}B&HvqeOh^(mfDs4CaS_9>yfZ590$ghLd(mT)@-*8xY; z#T(>@bAw|`b|b7lXbvD8s_0As=D3lYNPe3l-$&S@;G=}qU$Jz52H5qM1(mn zb+u4cPMGC%j+-N~0}*C99iC8CPMGD?tmY`}K!jONO&O}n3A21WuvvX*AkKvHEcJnK_;VoJVZc#$DRMf59P6^TMm`XjV_n`un0BBnY(cSvuqH7!(`FgUnEhEm z@{Nj|Fw36+4pQG%tptuzZLTJ{ihIImwn>=t(mREqcqoD>o&nn@%sN@56Q}4<9}7xQ zFr6xlsVhX<6gky5GEu?QOp!?nrefF!!fZbWIB1BXGYkKs)V#BS+0Hz|!xSB=JKG`5 zcD4ft4OMhH5>8ey`584r!4dcuIa0yoThJ&4QYggGzOi{pY;0-M#ipoCfH3E)swPMGD?_skQq0}*EV8sJb>PMGEE zflb@61Fgr#@>hY)4`K%*%<>xGP*qNt<%fZ}-x6l|S>Pc0kplV{n`x5_Wz0JB(6^(e zDDp>v`C3Pqb?CmveSYL(vFqPW52UdkFGS zRZf`YM}SS#!9j#seg-&btRg=T9F?Zv&ouHcNp4r<-vFEb?!j#57s$=jxj=+jjz?>O zfq)7Dv%C$kIYSW>W_df(SLK9Rem8K?LyCSZF!xEqtdjuDeUdQClYoP$gM*TRxla;i zol(HtCkeBBJn3gEc?q+866vdQ!YrQ#%zctD%U6%to{5Wt>uA*P+4f`_{e9#E{TRfQcPmx^h ztAts89++d{Qe2v#8A{%72+vaR_rTm&33J|Sz}!~}v-~$;?yH1Zjsc|ZK1P`30l?hH z2(!Ee>1QZD5N3I6(pTk#S>6FS=n+NV0vt74!So)4`!-?L4+rLQ39~$c^i}(WSsqRL zs+=&(2LK1=Cd~5hfX#nZ z>=0)8kHDd-oG{A=_`y!KqEDFR3BYE$@q!4m9MgeBs46GS^6|hN6L=D^xlqn32(!*K z;80agnB~)f`C3Gn1_01)_H;CTNOEBmcIP?r0S+ow@Nr zg0GOgRKeeqT#f&HjpPN2{5O)T=c$)J?5pPyVYVL#%sPeAJdU#(J$q()YCdN5s?&R? z=4a&PPqpXIp89acd_)(#X=w|pc|vCt*|O(woR1rWhPt)$GIBCyKW)om*~H#?u|nwLSLWN%sEW|y{&veI7MPd1wGiT43`e?@Nnc0tKXf5B+oSCyTGAJUZrt}+h zaNN<6r_$)aKcPkg34c#bJ%DL;cRNw60Z-*`C|=2cX1pOD4L4}w7^JC3dCbruBjTnG zPKp~n=1*9)XQp8sBl;b>U34!u=&$y~XaMd#dHKEiu^2!Vqv$?bCPvHjb~E<8{1|X@ z_l|ahUhZ@hkA*^^(9@z^j{emC5j_9l&rMFecX$BLflQJL9>sscxP{5oNBz(L@Tf1- zJJ{>>TBvFCkM#}$Q!%mFh}uLb@1yPjCVwa`5Zm98L2EA_vLI|sY;P-o)*h{y(gjLn z&xnofy`!^7zo+TlJrmob7~xubqhK!uj*&fjRn7Ls=6^yMI-s++4SLf&=479Uy`a{Y>k-hl>G@0L()s+X&Yl^1 z%gBIA?B9<%y=~CDS^ND>r+4ZWdU#}O(tZK$Zf>t98kl_GcD@^WbbVr?<4aVeJHAQK zb2o+thN$h#_LACb5;f3YuV>aIYTz&WazizV8knGBcex#u>kz~;aXW{D)7IAy-%+M1 zDoymh)9GbF?`Fqsi%##yTj;&6>hUpM)bZy1Z@PLsWM{Cu3_UGzJ)!{6G_yF3^wd|x zvWWF)oe6E6wq>{vBAG`;eQl4@T?uK}66sJcZ>I_Hb(ax^!SJE3ZtBr}#j@|D0H`_`^j4i4;82f8k zT%vthJ!U|b8AiHOM`|JmNVT3h&otZFkvP)Ph&jtzsk_wLxK=)xHyKf4GCB;a&0pdV2ei7g!cy7 z{%JE-I4Z1uyMz^=sQpel{o6?7Rk(ZJQPB7p$CH{k6-L{}mWXd-Y$LQ?SwG>5F(_H=1mTIC;6Q=$E@K-FK5Q>BIg6H+laAEj{wcU?_CmIwyiv8 zvgv!H1P{(5e$V#~A)PmUZ^PcOWtf+JS}EpGVrFTBnIbTVJ1dqODH6aou@N)otvg=v zL2Ql9jb5Z%U1guP8~v)>5I4*KnZI#Rnag`yto>|>s4j6iwu$hnn9^;c5wR06&kpeu zIBtRiF@G?(4SBXyS+~66WfwNduo>0BtJSJjXa}*b~F3FDqI`N%4I0Bc%=1`?l0I){Hze`t-O{6HiV#o^~|z z$n?XxhayT0wtC;VvbR!b7IMF`o#i{q{8FS^`?Lq7q?Eu>nRi=wwMbc4w&=$#MOqXID4@)sV zo5Z18w1{0)Nq(b}Q(>R&h)qyn_$*`$#bimO0;)r|jaX-}S^E^c3PP zG}ZGPFVz;=B*Zs(HP+B@RVeWdHZG+220`PEMrXlQ^x}HqDt|QY%#%}|v@Z(~MVO_x zt%No{W4ei2_nhu<$L`qhgp~B_y>1B7&hsNNnVq`8Ig*kdt;oBfhD_3 z5R0rlqTK6%SEJWKuR~r9bft0{1EjdbHh%LEZ%dN6o)KkIt)Xk9FP*E_=xylRr`Bx2 zta)$DI1UgFZ$|({U)Urlen%h4&(Gu8Fo!gg4fVEX+dFPW!<8C7QM2t-@=`x z3r4oSFS@kCeJ5!eM@NZnajkq#**9g0e$wgranW)krmL=c4<*pA?jeyB7PAM9&nO7$1gB0U{|Vylji6 zO^TxegyHXq`>?4Q&Yd_B_Ec6oht261=VfXEu5=H6Z8}SRMDD^p_|fcK=qsi#I#n6I zl*^FL#gvwaByryDgLJN`7g_CK4WljM;K`q{*I1GiM9(Ll61);Tb!Dj|5Uu64yxDU9 zRsqWcTG{N&wu=MpI2C2$nT0v2#xrl2u1Jmquba$*4|nVx6`is!rNxBbhUN}CGi>DW zy~CrE*Cn?Yac%Mp^p99fw@t7m4oMn1Yh=q4yN@`$qnqa+5hd zlt$00ZLraED-M>d|45qj;E3&ACxg8y9ocZ@?ERljP4hF)eZqIpgh8De?)&%lw>+vJ z?UbIoy2t$JQyo6L{MM>Znx)R!_THxW^36$upZK}*IWJV*>uVbbt46nN3Lb!keF_`psnhbhizK z&(iVZb$q;ze_Y4YyFi5$duy4!q5S4@`2*bP&2|2@l+&-c(-q$H{!HP=>C!#*QPMqi zR(SQZ9darBB3=GnI{tu;_u?OW$nUXDO08snUvQ@@e1bc_!YAo?8sn*ul0Jo5)n2ZS zKd$4;b^LZ6U!&vKXv*_b@iORm;msEH$Ca9N;z#LtZyn!H$B)zT^v+EorGB3GfeN3g zOQ-b@SifoeD*n+sS%nnd(>@CC=?^B|@d=je=V>p6@51KrCXVV`spF${{74-?P{+^K z@J;=1>z?0M4IMAcZ)=*~UM}AwQ}{x+J-vRYF8^)vy1t}NK6;5xy7W%6{a8|vNuSh+B71Cr<}=bxrz#@;IPAG?p2Rh&^V-7_StHnT#_PkAKFZuvmv>7FBrDDguR zK2p$l79u4*LcHFD@8+JLro1-0T`qrxk_CIkpRF4HZX8eYMe#pe{H=+-?&5Z&6Dj`o zknJ7P)Q9?m=lryalSu0VeY$s2{V1KrRx4x`eZcns!|61p$V2!&*Mtw(@we;vZaTiZ zj*rmsJ#>7ej*rsu(K`MP9p6hNsda0CO3?fVdN0mIZQ5OB=HNfgf7qf+|G|s3m1FRQ zF5SGzqyW|rl}y+|ALOEXEM`FvZy?t@i+oHKTMCv;wIy`sqgZ<4Qk^c^jD&O z*i7n$i!j@XCwU%rAi^vk1{_Hr&Oo`?O!+dDG3$^dl1>B=^&hrRn03NPPMrrtnB^hB zJU?R`uxTE4Ai}JZ3CwjT%yPQFvp!*#(=jy#Ue)EgVmx1hR5(f0?? zG;A!NLzuoJfT%rrz6D)>d0xc}gsE`QUTj=n!t7fEa3tQ76CK3H^Er+K^Zbv?z)`CI zEpQGnCjWVU2Kh{DM-uhH#`1dzTS=<);i%3EPQX9bNhVAu2Pg|$5E%y1vEz9dYYBHF zsqzht*6|{e>l>lq-T23KB+PZB`bN@?0n~`iM2!t1%sNMaBk|pr=oGe~Xc>x2_{aK$ zS^o+!>xZCCg6Lx+$O6p$pD^o3kPdYUP;bKc21yi4`f5KU%=&cgXP<{@^hW|mQDcKf zlU&6U39Ff>0Y|EMo(9ug?I1chAi6g5yqOiiQGFHpY7O2B%-09P?ArjSvd@HB9uFLe z-@HVlu<`tf>A*pEl2nM<*w`jv&P(T1B);nqb;QQ=DyU0E4kD>~zEFn((IMwK7Sybf z_mWhIVc3FV31O}SHa>QQxvXixY?H1bk#X38$WK0YgjxS_lB?Hw!Yp3|9Hsh3{+kA4 z2O`Wm-GEJVNveF)Wx4FLO_2}8KhvWg%sO&=syb9J(_a)F!mKkInCE0n12)k`4m1rL z>tq2(CSnJoYlZ2rGHh}kzLo#7e5j(Ytyep;qt=%&mt_Ht9F84Gu6vOOvyNPMRi_`4 zxjztQom-Vlmj*r-gjt_XSMx~hK!jP|8#q*z6J|MeBhxJGK!jON&BSv)sGWK42$?Y7 zj~$3G>r?xOs&c|C9|vqI!45>2VoF6*ntSMocesIDkseH1;A#i9EdQ>OMydGIboKU z1M}En!Yr>O{RglE5oY-c;K&IiRpy%fm*<_R?Y|!R+2#&l?mvWCzE>kB%<>~7pNAcY zFw3t2^ZXUUEdLFd=dTcEIsI-oPl5nMnB{)Jp{krP%Uc8U`9+xJX5dKm?OzwtaVRzk zvreQ&rw{3<*Dk`WL-!Q+pD@em{=)tfW_b$ft9}w@`FPS-<%C(D25eHV8-!Ut9hm*k zCmq#)!mLAc?^vgh@D!zvbpJ9>^Q93bsI zZa3wnlLJJU^X>(XoFbL<5G`lFMbn>ll8=Iog>rp`&t zDY*HtX&S4l4ke`#*UHG`w2bupoIG{FG9AW(SsvT@Q>ib|$mQIb`5DneMvjfj%TKjG zd@BbtQO~?A5#3~Q$Xiv0jva;u%fqr$bJM5hr#^HmyLz=h8o2B}bn=p9QwwHcnElO% zGvnB(sk%J!_~u)<{(EVPwW+D;G&ouw4|L1X$22xt9(qob08n*hw0ZWNn+RuTVN*{rGj`U>GfK$68^K^ASh8Wv1(c%9v1l-6fVhWf%tF5 zrnMIjUcICPdF*ur*4pa=d-Ui)*IT2SM)rbWTx;)T$kd;bKpuO|pr^IB7545%I@zOF zGL%O4=w7I`_c3JE*qFG!8Bo&N`xy3ephWikv9Y~4V68p67jA-#iS3auT6?1~E_E$r zWUrZ;M*b~AeyzO-7@)jNY_AwfT6>paF9}Lyk6!1nf04TO%Y*@X7s$l+Zr8P6pAcod zGudm2jqTCASgn6^kdNLaGO@k)0JQ!E;{D5y&?9^F`iSj$L8i5b0XI#?OR~LR)jYBI zPvnjFGb#8__DsZMqxS2r^Y1w9t%010?RC-lHy-wCphWi2lx}-tb@pcAgzA8FCbl<9 zXRn>vbAF)eZhM_{^<4sc)ocv^*&aP}YTK_T>}^Fl`3G0s_KJ`}+kVmL>^Jl8F`a)W zHU7~nEpERjfwlIA-NN1qHBT)56J62RyA3?sy9lhcmkE0#DT7K}-*e!#_4R{O(;%bz z(yKDIR|l-Mx9b-Ey{6`g#ebqK*yHO}XYg!~er9Ox9fm!6SIxvQ4+5=!g|O$1zD537 z)immVsW>0V9_KrXi$xH4CQ2i+!5HD*GKYEe&|^#@N~29b-Z>;dsR!v0vAuuk%Iyg~ z@`s6hCz`9%yIZHn_NsMyNjg2Y*Ga7h*Ea=vxKz4{?R}-Qmvsw!$8>u6x6oUn)58Em zG0k17r(OEM0rH`znnq)j({*~3-Ubz5Unx0(F3K9>v<3haJ&Th_ZwNE^&wBB&ryW0C zVo~mE)L)2LZvu>Q+mU<;>=pVc>AB#kovHuekraQud-5Rap7JPaWv5_e&uhF7=+(cU zlKRK%oYJ{L{`A2{Z;);S$D{KiN-*}v+vzR5S0U|_LR@W)-rgi*-fCIlr;MJXv2*f@ zsD3;aZ9!rG(pjl{GA%Lv`=`y{^N{6Xlh3$PXX(X6lke^CIu{OkAgDH_wq5^bJD;)`@7yKxzR}ZB0@~A+-vro00kwQXNfFgWfVU97E~_ zq+Ug8eUsEtNDY=yu7q+Wlq)GKm#F2wgL09Yfz$$|+M1+}LTVLK9Z21b)R&NowNSAp z#^j|FDua%pT%=w=>Q$+@zFy7yPQ`nb$10MKNjA?2$cU1l_YC#HShb}qJnailQGa<= zvk6#RL?hfX<^b}+MX`hnaAjPS)+XerqcZuE0DGkTkhR}8yLMwZy8VPrDK ze@|Iyz(jl+`@ByWwgmVY1C8EBAM5%?KLvOhJ4bX*r6bt>kafn;_gFX6SBgh3 zbDl6tb;b`WoDXR%PE{l5z5@e+wvcsYud z1s6(TzP6>#qYkOsSYP2hx)5t_*1OAeC77j{edQvi9&4W_zKxtKq;=jdIp+$gqg-Z{ z)KM;TrPL8+hOOJSZs*#Dr(OH^!&@r%GRl1oIen!%tg>}NI8S&>b>8($ohejbDx2zC zUr~oT4qUTijcZ@Ah_U?xx{0iE(qsXs%6Z> zFA39Fs%K2j7GXNJQd;NZ`g{vUo;MeU%@`lLc__}4GEuzc4H214bV3jHkBEQH@#s< zT(xplm@|C!?1ni9G8=ObPC4}W;fY7mjz%1hKH2+JztaQH?5$Z-SGO-m?vtMN3A1QM ziu-E*{iw{8<0**~c25YOxN@S;gWnI&Og^5RIAZq*e~jAf^@z`hVIPFQKkU7cCq^F| z_wK}Zro5f@R_2@2-^ks6Pu;+p-5CF@tc|L*xwT0Nd&*~}_MdKv*>h*w{Qfg64;v0) zt-=FsaBc2_^RSOFype!)hf+lG!E{kvlP`+jD#4YF*0tJ%*%rI777?y72ajTXqK~mo z(RWy{$XhZrw2=&Ncae(U?jt$NCzhH5K1+0#b${2?e8dCe_Kj{Bd0={Dm><^S@{O5s zKyqdOAPkKOQgLGnuFmPWcIQjghPuG>SknkA3mIcBS*4gymr1UVc1tn2bWJV6Rbquy zd~lOg{MIfhEHK`1-Yd+A1zoV3Q6GVlo6Fa1Z|GirT8gn}2-g?;gzGYN z6BDqWQHn6w(vdG;$QHfhjpvP%m%7d#Mg9_`uMi_Difw40gk7}C+)`Q}skS2K{ZEAz~g{g|&}@#RnBwdGb*2!~Kq!aGwvWk3X7t zJmjSL)I{`|Z8baU=vZ!bj{^^@?#z*63DdthZ#gMl3g5yLAq=hW84!c8LqMhTR`(wWNkx zqaSIH^!7+^Z|%0By*2#B_7UYp3C5v&@bpIGw)^8L3D$H?kKj@hGMm_P^=afiq*nGv09iJtA&}1BjU_hEzFG7!rB|qHdrmJJyr{AkJZB3 z-HBGkSm~@({Ppf>p?6P~t_2pM45PMmn^};Lmzv#q{4_n}{SSzrT=gcDr&vmj#Wwd= zYWi&d$Nz7)KwR#8OI|_RjO@I;?3uZi{F#>gtPIOgTS}q@K`k;6JS5$cHeVJFo|&6J zJ3Fl)f97lp;#*i|6{O{4+f(x?UuvEuH7CbHQoMP$%*?c;<|uYR}J}lbt``lATA% zdD-b1v*8{}3X>gnI|z@$qAg{*@y@=zapP5}y;IXg9{sa)|C0Z^z7@*=4=b2CsK z`ae56AI%^;oRO1(pfWRav+XE;#*6|0x%PRA^QrlAmGZM^P#G440kLO9TIObD!;RG0 z85X=5#`|Y1)P+`_^YYohum5_`ve?PfFN`UDt=nry+P}QM;tTWEeqSA2Jh%D&Q*jd> zyZ?ctin(3R-uv>&Vg08Me)+rLb{jgpzHoQ;&Mz}c|F^rr|4-~~{Q1gXzrA+HnfvsXZsqYIdtQHL z+}U1@Q+9W49vgr5cE{z**M<*&>C$J16IxhyUwYsFWYMz?raR(WjGjL#{n3TPGfFSu*sCrLzwoPkY`NzPvFre)xeIQ9riW z)M@bZKlOjN>(l#o9{zAwdCu}XKREG2cIKzuF7_RJ*Rwg37C!x#zDL*Xyx7CMCzGYh}!nsTDu+PF^R zvl~a(zkKh;ncsx`v-Vw)w)fRvqv~HhyS#m$U!Pr5`u)Y#hfYj*{rXesb7Phc+Vs;~ zjy9h?x!~YGTyZ-GjCjxM+jpLSwBfcRYiD+T<-yWB`uF_kv0wN7T9^~|P3QmQIV-GF*T_J_!x~@n*4;iUke8Mq||1Y5XA{dCW9n8l%pAm+C|@`9Fi4s2p2s92FWV(6v zv79i!JEb%p)9s_tAW@ zgxTiHq(dLcK!>n#?E9mHRXeAFIWJ+(OZ|{z)^{TvHGweeP^^_8Y8cR~z^p@jwzc&;?gjwD}Q!ZhalTD6&ueBcwImf;y%=!ty zW_)ubBFyq6;80agnB~d96cdMtFv~{)hpKYIEKdP8x5ExZnC0VvLsdCpmQMpV(}yiY{oY*BEl@s0S;B=gjqfd*o^n?M1)zM4;-q>3A212Fpn`W1UB`< z4pfMZb#?)p`d|kl%<=|clX{UQ%yR0hyf(m5U|s{@B(T|n9f&aNp9T)KU_>JkesbS*(2mFC?+xK%tv@k{idE&2R6JHjb^^m_@{|aYHyf_Q`S62{Mpnr=)Bukv z$0MqKC(tC-Uycn)ktT08ib@?NBbC&JEdOh`2kabz_S#aLiVr8ii>)R;bMd=hJe<&>w+lMfwwMW;jAZ$!*?-Z1@ z_71}yotk71FT>pS{D8Ig9wQwRsKoX@2Cvmy4Thdkm{{*a2(;yXhjQCNM&(jjlt%S< z75TOH!eD@&ahTZN9>}!z0@blOWRD&X*j~EM9<7^5&)iH5r|Rr&g}oFgkv;N@?G*t- z)qQ*^PBlGaF)^g}()#xc?9GFW?6pwS$nJyKwDu@IF+HO(vAuB+Xzk_W{<W#Y~7&Ggo(dOcMGDJV3Zjj3s5b3S%#o04DFI;ZN9 zoMI88i_9WSM0!IMDDT-u8R;cop9x_hC0KAhpgPj=AY#2%sGFvG@<6KfD1g$Vuu&dz z<&OS$YDNcGEPp&!Kn=BK`Qxzy-@!L3uMajFE6^33GFBj>WECWz6yiQ?OmKeBA~RqG~E3a81L&H z34Y}szBZyHz@hzG73SbLN)$CoO0aJA4zzB=wjJ9J??9u?x_(m&Yju~F()!|XV+-RD z`?8AysJY>GTXWaK2I1O$LiAhZ^s)I_yIl>mMqCK&=V0GW#+qvj3bnCzMjxcF>xih; z)!4%6bM?A0k>VNcD6t3C3qx1$=4Ce1qgRF1va1DsKQI}Wi$R*GG}P9$wwO{|oD(VB zn$kH#*OKPNUH3INgeSCc`BaIRm$r!LDr@A?Kx_1-K&g)M9nwUIlg@?V+sMe$M$MNE zii}iq%@fxrZ5T!Nxlxa7Y2(OA=P0U@)XL`&zAH5jJFrczn^YTJhPZCxCE<{xyBRil zH<#8MHkC9Vv`DH6a5SkEj!|5qRH->m=bFpyZrJSIym)g$bHf(YZ_B>s5jD|uz4!HN zaF)8YYM-kb) zh8t70y@q|?Ih0eiG3ydb?kQ6uR_!Qp*a9j&vHzrV)GnUyy;3b5K`z;3Tz`!%Q>)k> zv4*$mVC_=W!5X%_gVoacwulm`mcMOz&aAEeY~kYoPn(`4)}W3 z0bkEL;Okk3`KS?l;O9rySXZ&3@j>-70Bv=19k+D7r!JnFH?8%J5tf?9O!9oKiyAdE zXMV4ko_#%^?Ud;x-MU*cX3xe)2m8$QjDeP}*#V--gn*l*)Azmte3j@n7hg0UvhZg= zop?mtVE3oM!lDJmC63aCi^|FuFR7?px@`Fq&J|TFSFL_>%~NZiUiSh9x^c`dxEH zpY+OU@BgLrAFq!2>hZcwfB)kC?zw)yJ$L@4XZwAbc6`v@O;eUU_fYEv*M81E^~CJO z=10y1tn+Es-FSTS?#JJ{tKSnJy!N-Kxr>*qHthJQn}6u|YpyOIUpro~VyvTZaZ;}n zuipFJnJbmUAAS15oFf^fhZ=^bhM3Pan{c21`RR`@i+=O)G@s@F$#1+dmk-YgO!UtC zK4#?q2GNu^ijSeM+~Y~Xs7v?N@&2;@NViRer{4_L;xE_0_Ve7KJH_^+f#=+akc_@?$-iSg=#8~I3a zhnl9FO&-r&8BtcIj=?L&9Z*JMxWZl z(|&EmLGY9pkAHH0O5df?9|WF=euvOH&=hB#NZ~uk>+KOg8yl^&OZktGK&G~G+#7nO zWx+=NO~Zd8MZcr0|Dz(pzO8r~^`YM}ZLyI)+4H=^Z!0LSI1xP$OBg{;=`>$cp|*m? zOV0q)1{>#3)13EBd4-*#^N95mT z^bMem+jphT^!|*A+8{!g{Rb$Aj*WC;@~`@EB`f}elH!rO~+HaneLTM%5BK+C#nCLVih@I zmeaMx6sO1uvz#RS?IQq~=PMIt9sHaZrUdLjgjpU5%r*(L98j3}f}oMpaWW-Qs&b53 zpW2Y)+=KzMO~S0xhvY-C0}*EV-N2leTr>^C4n&xBl7S>iZ1#fxqs3PNyV%~KAY4REreMv`>%dmA)h&Z&qUH!+l?^mrvXQ* z`Z=VdKHv~$oqUbX64Fs`?1WjT1IblC3A3Dh2gaBFyp>;80agnB^0J`C3GnNZ^1euYr-r)0?cb>6K45wU|utuFw4&Z zo5o=WI*X0vmw-7w(`CZyG5Qji*UTo&`riQan%RU|{ylKi9oT_>#Afa(Lm9KqFA#;Q za>6Y4mOQ=@W_ciRWG}@IeRF5u=sTdfw<6bm6AXboRFxBEJM@fcdO*=9%!Yoe&=9p4Rz~(-R4q?_w1`bu_gjqfcnEfQo@`)rL zuh=2X@^oPKKMXOIu?G1qzpc%}D+~T2>W&S-pVZvJFf<=XY0bX>wNIyN>3{g~RMu-6 z!Q%HqQON$wd6bA0X-f15lF;iJHBN;pwEC%)8_jK8CwH4yy=6&_RiuoRlUq*P9B=_W6<#DDu+uWU;ftHRy1I=Q=P|LE(m zY*hX}d}Dji0)H%Z8&pGIXu7@pUA*bAfK)`k(6mKUBbs_lB}IhEX!1FKMk*HgbGPx$ zzE#VyCipY8JLbgy*5Y^@@taKjStegV0z!oNR3pG8M5fW$6ZTP9&3hz8;HApX;=f)` zz2wRotoJ@RZ)~x$6ywX9E3ppfa!bWiS|GO1kwI&Zo)h|EV`6(30krnk!(IxM$R1t; zyX}$xT6=U)_QS@+_DDx-?>pFQ2N~J(Rny47yP&AGw+XUxY)ovgAC$EA0$V8eeX>VC zc_@wSO+n?g_M*WIfSif#(Hvu~y4yLGHC75Z{LsE82+=p7_+XWf4_C5no?aajX zIss_yZ4dGs4{hv;(K>rxXs7LL4FB2Q2%Wusu(u59z^z(}Cl>lq)Q34$kCbsuC2q;giny?G@MnTX8JpELnG-^MdThHfMCOSJk ze=?D2+U`;Rv;8ljXMv1~UFeJY5oWy>IAN$9Cf1`E&{{q7E%b7bQL7gYz1eI`O(T{b zU$lCwZ=vVVl^cMQ5r@uA?B5a9UQac}483%>mQoh!?!%7rQ1at+a%+gw76YK@S)4?A zLzuyT)}!zF+VB3}xSpaa@^K?|)_WetxQ$7E0QQ#Qm{2+$D>}YZFC`oqM+o@i@BY08 z^t!X3JW}9~zx!{$ODRuz)a)jPqICLtX0REBbWTQHfol0{TYpr<K4U0eG

N@@|1oc zAG|U7#A4(Df3fw9aOf5%$3*a2g(LJyA?{q0q}ssP;`##Nyjt(e_1#&uB<|qY1yxRC ztoMzp!xgFHCBo}ycCAtp+cRKRsHvddms>u%$}i4utW@h&b>KACOtKZC-q{71nRsPE zq5S`nXWqYY2(6CRE>3#g&~1otw#^du8ehyW=bG*pqiWmKk00z9VlTwJ^AKO@>jhUs zDu&q4g7b;>@>s^oJYK2AysC|9?tb5UR<#@a%F4CzNs|{WZ2C<-x-6nRFfO~GsJ3?r z*4vv^DxBWNAEosN;+(++qPompW5hh_zQXxay=0%(N7`e&Ec?yaZJIrY@3rK{`q?XH$@6Qnn0bu1@+#-b<7 z^DF;7wNSv+8{uduYdLOP>p%P3Y}?*?FUXZ5rFP2+iV=928)qv`Gx{ce;41F{Bg8rXKw z?SpV%N)?T8x??4<+t+6P?$P^j-^HHFVO58!{H(au{uA5os%2@k1>Y9CM^ilx$h&FI zREq4IcWK02Xic6qx7q!q=yPh!-`p?~0|^T6d(B=UkeF zsEtMc-J?U5*)i3X-6dScSc`RFG+>3&Iuet5Ch$vcfcumo&ywm$~j&?eAO-ySZrlL$6ek~O4ICcWPvkYf7+SQ4dXSoLj`8M>iF`Q zP(rqak#MJVBoRH57{MzhGk;xVts9g*7^NmgTBD9if|(n4k-Z@Jj;Bri=`2v1GXTfx zL)wfFX%)@3G26Rn_tdq`SyPC*Bu!fy4y=o8iqL*X9V?q)uA{l9bnC&aJ`;alR%asJ z4~TcDje7=dvN*u~%WI7%SHHMwW!93+;XCW?vFG-a3+5Nh-yuqK|F|?`6|ILV;!*F0 zfdIWT6gG20i3!Is*0zQdu^UC+$x}}**jW|cb+wpRRulViBv2Mk_&8EiFh^KJY8HGK z3BB`uX3b3WTE7#g!Y4ivus!-I*~XA*r6v-6JW32TUz~KK!p3962CUBL8;1DSXTYKH2i6ysKAkg z_de#etO(`&cq;tkdaM|e*Aa7P4hp&fTjbX*VahRHN@ zk4v!9Rz1)#a7y;FU5C)ZA5YaZ2v}uX8;J1oDBc+c&Qh`UlQ?T7Jg*PMC|qb@I$h_MiO zUjDkst?Ie7tS$Pk>XAsGG+gmWWaQF$6=Rk@x;%X1IibehcNlxWHf^zWV^!%9Dk)x2 z`**BTN2aw6vsO+$jH`GYO`EFH76voFoP{I#xV5!O4%WapUI%6MDVnxyO;JG*?-Iq4 zpEsrp-j{6UW;t)<+*m0QNTVy=A@ zD~_qoJcau;@up7wj!&9}znnF%DRS?hyaeZ~(OvNT0M%}vQ#+N5=0Rr#L1+KC!2U_X z-M>oC%vecV>lQ}xGA*oR^>fXz?OBUnS=4KBH~dC%S=_mn*3k>*FU0&zXVdl->*YPL z`ulmy&aWe4Ht$%Zk!`ExoNA^4E*iV4Kyio!p=BmOLVx90Ot#g?U|N1iFn8}sYZ^rAm6t?BxdXjZwkG8gCm_6ylx zcg_FgvYJ4gRdD=i{Pw7ptIXL%Ik}tLZf&_e ztMaGH@2bvSxO$<}7VDHnOX#;&%*I<{XH;Q+b@Ur6Vp0FLtEg^i&TkcJGwSp3PtOT` z)Y14V2yPck%f7v>Ab7$qop`^iJhy6fRqn#O9A-HhF(zqbzf$(%f^N$;Ee~eq_Z^yb zpx@RZJty9{vys73me$w9nxf{B~LQ1RR66($TvmH&oRCt?`zqzu<<&1uNc=zTAYC zXjZiqeZW0Xjk}%k8=!4s`FQ{nxWCiWL*>3r!SR z;!^Ph><4fLT*;!e{TCyoD&5Y|_tw&0{(#Ki!O^QU-GiV)zH3mykYlgXuKz0SUU#o=qpzSLwEny-K_Nr_wH8Bg4OtruY%&E|MNNRZJ(yHeEcP0ho(k-n@hdhUn(78 zb6hbe|I3Z^typJyO`Lm6*+kQ$<|Mjb&(hnJF`p=*B z51>A7XeIr*pKxhYfwcq5r#~&oJ~2jPzn7 zeTk9&!AN(B_4?PuNGBTU9$LD;(SF|kKS#FbIHt$F&D5U!Ujp4VP3cL7p6(Y>LFsSe zq;2o^x6*Gl^zQMf^a~BWdweOqJKj|KpkbeA_(RXltDx-ZUKc&>KEJE{Z%5UtJ(> zw)3x+`7bo`Unuk6?&MeLB}UpkUtTE2+wGGk`7Sc}E|Pri{IAl~wkljC=pC~Zj^Pu7 zCr`cYn=12vCN1borQP{Yr59-W9d`ZbKdczh$>8fG|K}$2QBt37=+k9+SCN4XDm|2w zLZw@1>9)52)W$Km1Ip`vSn|2`HT7Mkp8l&;L8T*{6e^u>q}}7ct5IHe$#_VmY8R+FSpg(w_`RuhMOewA+6@jrv?H^HX1`pwbgK zDOB2RKb3a0WBONi)Sw=eBNas4w-3&*W^z6rvPFd=I;HT{QkzAr<>Hz+yrI3OTJ?jy+ zkGCwDP7oC_q*a0J!*-g+9KCb+xSgLYNI%3buYuH`C1xAtx3Rw8u)@p62AnXx$}-{(QTBi>1D& zxE3*mcG91V#WRLI{-kgMmG^_qPeMw+X`~mC0)f`_*xgN@N0da_-)rz&wm)P;eD1NQ z(j;%G)j3Q81S+iwxO}z%9aymd1GLH4>X-4C@=95W*a)! zP+pP~W;vaMTW-b|0%4XX0k_(WFN7p~Sl$^p#qMjGk5lb&*aet*2(x_;VCEsr@(3`u z4`G()0=Kr?hcL?r05d;fmecXf{DfH!DBFQz3M`lHZ?~b|{?yJXb)>1hUx?eko|c#T zncJT*b5c9=K5f*7%+rqKM2sN$i41|F|Ae3B0Dd2K5^!i6z7Ue|VIMjGvrU?YslQTb zu-Jjir6lJ)ZJSU<5s0GY4hbdZyfpS&*>b`xCx3Wpgjp`fUNQs-hd@#4`4Ydqrfl|~>=e$Vtc;LtvNA&kR^%bEn7VsjP)r`n6a5@3GM_bnQ}moQZtVFNxv zdn2H&z@axtDg3LvKs5{4LLU<(TQB z zemn|8@Co*oQ2svR@kZ-!=D!x0#~Wdm-ww?0(k9nK@8Ju9Fx$``d!hHGSnlh}a=PC) zNDds7%^l?^?2!tW6u2i!7K$q92_dLE^fEho(K65wE8Wq%`K zY8Zra!Z`}ldXD8QfqBdjW}Xee?Aw!M-$&(rR>LonO+?9G0p_+P%sg9xxoruv`~%=r zIw%o722P<)LpVlqyR5H(nUgT*Jr2yAgjrq>lT_*;#Y1ac&P$kW=si}PmoUqF0COFC z1E z&@s%)S)^GY>IaS&EI~!nP0lfrAA~PV*c0i$2%UG{^lynET}Ntvi{3zAP#nEEdCfs45;+5S_Mye^`YsR~m+25sDu@H8cFi>T%GE@qzg z5Vf-9gjwE^?58Vx!Yrr$ZDq>|vz#o0)M*IK@CnY8P_7$OW-Cl}VN89RGDpb|BMOoL zp#eU@n#*HBg&R6nEbUin_BN*DF=e%q%evV3T!?~q zD0yc@p^sh6KG113)wUl59K2K63?sZoVH%F1BQEB=MG$e`7QiWYE1TAY*DBl_QScsx zvk2d-@Bl=qwmtC&*D3ip!uKmY2@#h|n9HRh!e!k=HlN}PfiT-p^QErC7XlT@btlX= zj{q~zQ)FZF5N4a_$!0yi5VqsPzat2<&0b)x%Rvo)K=?jtZg8`Y7c=B_B;TR0slLwwVCTHuHf~ZTp29ZU-Es20)-=Fy&DR!=;~)xdRPrf^QXf2zar+R|GiS}yse36ld|uCD5XZ>&WKW}(HfyPMJ06K~_PusDXm%b-Rj-J*ALyp%w@+s? zcJgc?H_twenS2_X9}UKvfX-w(p-?>`e0tNVlV_F~kK@WGX+6(=bEPKYwf0dJcp<%4 z;a^+nlt??>)8wk@)Q;TwGiRpFoK;*reMU*)1kV%W{zc%eLWNN)WjrZP)iFd=5mO`| z8qVlkORn6UP)JXB(@URby6s3Tg(dXf`-vr!u(`Ky-%q~2X!_Wq8PlhYojrc)tU@xK zJhNbS+V~RnYAGoxoI2jvS=||2vx)__(Jq))?3V33zs|jOJ-T@8b#unfx_-`#@vb3@ zr7-RK=_Q3}{f1nbirN=k=dw9ZOpoOU*?sF`JONLwd&WF&{ZWm{*H6@&Y9dSPu?gZ>?4syzgluDfmyvHV+=k>!@pT1JU7=F^bd>M<>3$VZ#Znb8Qlc3V zwU3c!r+5DWRxqis;JUFT<2^0QwNlSKj-_{c6-paN;dVREIOHYKI40;`KOJ?wntaS$ zcnMeu_N<&HYc=^Mb0+}pA%1-%IAyAF@7aC8-eEqv2}{W#b1wr|<{~%i#9N*zt0+ z27dlF$~y$8ZT?3UPD{so6$T9NpPoJzJF*PwoTN_Uzw7(T1o<4YV|x;dk4=zqz!F4; z!T2T|uaermo=Om7%V~*d+R-|U1KZKEmDVK@Tk%qo5c82S4{2Q1kUCnQ>fqvjzU`Im|eI^R!_ z4Z??m!v~=A4NbW_4MbiQjrK=%Z2U_Kf{I$t^XCc%#U3)wp2TL78Pw+!Q= z8RQ(8ZytwHK2l;m%KJ4ER z!@nNjBO4CP*Wd7OCHTr=M7C}4VLk%7e|X4S{%2(J{TqEmc_Ox=MVfp3CPT)2AHYuM zTMIt=jmUxhd&l7G48G1VBLB|EhxzU@_*T|cdtjP;s|>zzntvEN4&N+;?-lUTZ)Xnd zA6=`~>wBZ---R${|E>Yh>pL8i8BCqPd{@Cv=X*r+4@1%6>t^sR0N*i(%{|`I4Zh8q zf9Pt5?^UC|Q!q);Z)Xnd--||lk8A#Qf-(6{^UDZ>?b?_zwIuMAk{`=X(`rwL*ixW04^PWP`Q1J|gLk@))9 zIvOwekR>949}uzz%Iv z%sR5`#|gx2cQc&R_tQBB|IjqjKQd>#F{lUEmE?QDcN}AZ^snGUb)}DH#%}qM|GNC&TPEB6ZP<~*4ogjWDnW%zh(Kl^W>h)LI?~mXmgC7>WCD{Rre0jCF_)+#<}}uFZRGKQ6!(KM0ckx zwlwFo1(*+czUOl*&G8iQQ%44zDrLZ_K?XVxQ^1m31}uGL;PVch^C2 zu=J5(fE^FCW1MDWz*0d5I?qsOuOe}Q9e1!}T0c|hs3Jk@UkZGxY^;*bJ@b6trr)I$ zczxJhCFMGhApI_+&{9S6cO60cPmTipE~9X+isbJqf+=>I*3A^sRD`E?ROoES>2{2z zjtn>z%b?D8YTZbJZc6OjP<^ZaopJJ$cF_W!@N|9|Swe`?R| z^goR=bFN5D&*+hw(>F^<+%v<$8C|u6*lMQ2OlbeOeHFJ~F(oK@_Ww~yl zjLD3#Bpg1>WwWuQVmWw548KC!keo5)?bmm(lb12sFqZt9O_;!(lZ@^D_J9WoC31 z_?94b=w*XO(n|o;!Grc2c(rpJ*^t~|sWcd>StzVb?1e$Fv6?A^A$5ibHc@Ay6>ZfS zdj)nYqp+f#I-{+~P%F|EVYMP%(M7FDS7h~5c74@~bVasWk**kqi=mYN3bi6#FbOU31V zReXE4imP)}yfRnDiH(vvkbPp~w(VpbYL`TDUYj;jp4T>6%JY)Xm-6u?gXj{k82|KO zxr7gH9U_;~!EKkRc>7QlAGln_Zw*uN!7FWhZujTLI1M-gD^?jhYb6Wc+9R3%@Q&A zH`B}4)Oq$>`P1CcH+P;%Rr<3H{n?`2(;lr1eJjz=(;nv-`g25@r#;Ry^yi85?H{(P zJ=z%hHb#525dk?12%*{|*|1L*dp!MnzM(%~H1y~%F!UFQ%RJ);FWN=By5T}W@6e#2 z+Up`if03BzX^&JxpDKoU+M|=9?<6kuv`4z3PdC~lU7YJ_kFa4M7Nz!ro~~QO;NKo^ zeY%Qzp7OdI`tC+~-No0Q@z~R_?3K zYaRku4d`AF3Ur+!Mr0cHnbN+!w4g7Q=4&yOp5v*1Un75CqyBxxa8G;Z81^}$tzCcR zPd`K7&+td3U4QzCsh;_vzmdPc;ZJ{Yg{MCT8ukOl*Pi)du%RC;GCaq_WrqGTahqp6 zUvB6x7c)HL`3ggSg&5;$-zyFMl}3H86c>Bi_iDrbYVo+opOJ=sB=$mAovn_~YYhE0 zV!Ee2#u)lBg7 z1@FV9j;G0nezN%9Q{Huk{yL+)>%`lh@}?Q~)5JQ@@jczpPZuA1^fws#8$`CP52Bl5 z#7sj!Q^a`mvkd(#vBXoKIfj0YQJ*NpJH%CwhhS^b6umkNz*> zTTlL%MXIO#S4BfldW(3C3Pw=nZxf5u&nG**LtN-d?-Kvg&fk`JO{iZdod2(4nEKge z=YL%^RzI`s^c!N6NB^dn;nBY(GSts8+x~5Fz@vXh-0so8C+?EJuDJZaiDsVkhhnp* zz8{JEJpFS-{`cVY5#wSd7l3HS~T&b|0&`g-8}tVN#oY-(NOX}{*ycOL!O)=|&+ zZDl>|X}@!{$)iuTwtL#I zlNIr#)2)G?_6%Evo^)4B{R-ys-QBv$)1E!8m7es))(lU3_OV{^wBM!H9MAEaX|436 z`&#dM(mB?%o^(I!OHX_Dw>o*+YoJxnlOAl<*!|NP2bm?RjQO)loV3S_(l0Xfi^O2N zzm@(rLw}oC>0BQ@ z|DVP8`0+!16x_9hhgpdJSRFpf3>gv1yKh7ihT8d5r^U5 zEa;<`|FT#B|4M!JuZnFbf2ps2iwHr###g^hTo3;q^wsYWufe}R`|5XzY4Go5U;S(1 zNtFMZul}#%Hza`edzW~N;^!9&Se2MZK z`Rd;h+0dT@JuN$HkB|4n5crqwtN)wm3;%L_^&g6I_%{-II_zune86+PkK5?}r2A`Sl0{(sTSKPslfKiW?wy8cV?D$0Kq`snTR5783(w|wF7?&_EE>YUp}zWm zi=psuys!RO@fgaV;j2F-;-N3|)mv5&{;hO&w>qnIT z5%jbSs?A@=`UT~G<*Pr-iie(_gNUBLzI8wRi^p%y==z4%C-9H{Qi`r`WMx2~| zqifF5>)*zj1ONW$t53F`NBQ^q>d&_lp{Mt8M(4l4Du92_`|2;WUV(qK-*NQ(7g_o6 z?*R048LRgANwpq8`A2>AoviOs{x81zbZZFojc|>DmNm8c!`2A+cQ*9V=l`zOVEA`F z^wItAZY_g<^bcEf{+`xhlu!SlMd!cR>Ir?WFMl7aFZ{a#dRnH}_Wx3=2mBiiJuUlc z>ocvn@b7x)>1R!CeP8P}lt0&3pJTOyzT8*e&q{-T%b|~6zy4M-{JYy%KhT;0{~q?$ z54OD5XD&0+ms@ve|A)~r{2MJ6?Lg^i@Q(wfuQTlbgmVW6(!XS1eFv`EnD4(89;XwA^8|CM)5;5sd80r0n{on21TVzJ|BMkd2qr6r||7dENe}R#| zvwgjg#KixR(H^-*I>D&#vqoBfK9l(B82%&~_HP*JQlq?MhW=dd~0p_Y3rV>3YB%=rt;RR`*tP&J#{CxkT!{W>bSGEZ_<93 zk9@a}{52oBw(&Zbd)m5p(dzzJ#aXNFdzJk6)Sdpi3%#!F3I8r1F4lb5=i|d0|Gf`> zzR9t=U-9c>mF5!Ogo-o(39Wd`ldfGN0sCeXfJK$4a`hkk@d)i$3 zHdJv+-wyitcDb@St#8AXjr8qpAKwoBe&1xd`mnYSQhvC$T-N;~C9hTYk89gYo+Cc;Pio6gTlX2n zX4m~wmA6*iKU4DGQ+Ijne6H+&_i;T}^Wh60ALv30!hhp~pKrt&I#!$CPk!3=tdwrb zb7JUApSt|Lc3FPsM=UKw@HWLM{r`u`tG6v_LtiO5Vb3x0b#3`+{lA?U?D6o8%BznD z(xt4TZ?(67=%31l{)*vp<(y!j>-D@ewyirTr~RAkPK9aNWUWycKe>c;m%{A`->q;8 z;k63WsmQuV;ogMrRXCfly`SVD!t0crrYh@xg+~)!ukZxI4=6m9@CJoT2-AgUgj?{j z9+FT#XKy{M@Dh?gqVP(>YI!I3nz1%2Inh~rRCqgKd(pX< z@KZ{Dkno=s{($f%g+C))qwrURi5TGre5_|AlzT#2&ng^;uCks}xE|r>6{h_mtrrw- zP54EH+Y$bY!YPEwS%fZxUskv`VR}#-A)D~43J)T@S>fS?witr|@>d zZz#N%@P3645`I(R4+tMn_%p(9Df|^->L`RC2*0iHFN6;%9EXG1dPiZp?rXiPFzpR) zy{B+%!tX2Gj_}_UP9aR4kI;qihYI&5d{|++AIJJg;X#ByR(Lq!BMOfu{E5O72!E>Z zRKhf%5K0JtuJA2{zficG@KJ@A5I&}G93l&83N&Y0BtWQ#j}5q-2 zeNQEq_PrHOLS)$wR!VytpVmI2@=ALf``Nc9{w!smMA*IvBJX`ymQT zdmBspVVeDw3dbR`u2wja@JNM|2w$VHYb^HwWN-`1B3#}WRA!ij{xR=6JF ze=1CewDqmR@;LflVd=w<3d=EhLg6Gt*3Sw{fBvno^ygQFr9Y<>ro+#|{v8y$5RO&2 z2jPIiy$L5M3@EI#G~7VLK@HR9@piD9XtGIA6mPG+dxcJ1n^%?|2O`D(H>YVf1v}@m?V@g`*jIP~#_P!*N zmD7LFkYQI|J@T3{WAi5zO`0h?iWgWEMwhmeESnpcz zS?^navp%psv<_PzSsz^4TLGk3E9%GbWGsN(#nLE1Wvjl%lM#VaGM~^1&yyLowX-?y1Wav^UAs_xFyn zIrpG6Y+UX17S&(T7U)uPzP8w@fveJX(8Y$`#HPBE_wLs8TEEyfY9nuVdu}g-siij8 z3NY2w1E*2T+*B=}vSs$u=qbNb|I=`s(T021hr{g<8kS}yT`jt+w${^awbYJlPWRO| zal9*;Q8<2DEj=9>w&U1JyOx?<*7_it$(htz7eveM)ZsK<$U_SHFy;x`@w=9rY>;sp z1Fj}sN>D4mQO#&3S~a7pwQ5Gwo7IeF!?lprJe`58rjG$1<@vR1sg1R0T5YUFQ9Bi| z$66E<>A%0)Eq;1YeyuJ*X500`g4$X)Z&a=8dNj4+dNdQw^=N9h_=2K*>}^oXdwFuO zs~+9LaH2Mky}h_LsnXW(-V+1)LB+dgzGxQMsNf71*qP%@7AS>|is(L23DLFGjkWXG z=YiS^KJaR5_~cMq!{>$C8fu>CQff4sV54Yh?D(slZu2*xQmH{s!|$(l`29^}r=!D8 z!%zJgUG4Dun;3(tI9emwRkX*QpNTfCd`-|1)U~JSi0Ep!BK{1vm(dC2AxfiEEIdwO%d zozGyYxB2N!9Ur*;&tUHUCX??VseL@F6B%AwZ9cjjjr}|Xmk^1)bK)8DCMFgn#!dmGN%1 zG|#KMoXbs|=Xbo_s`iVgye#rHTIP$TwBI%bB{$-wbA|jeDZ22NhF=NM#8k^@a{lcQ zO-Ef2O)f`ql%nZ)h-NQ`L^Opn5~3;LF(&b7#c&HdN^Uj&Mdx`*7uAAl=@EJo)HWUg zW$_58#vTDx)gzE~^hlh_d8D#d9*J{`m(nzPQ6kr;*89EMxi8)-7(aFD^aA~jU&g?w zrME{$EjbU3S_*w^)Kc=`sHNc1QA@$Yqn5%MAGI`28&X%-(mErgmd0sQHy^ht4+r;3 znRC^b8X}6Aazqo;sU?cs@i~f4dJH*VgVT!+6B%E7a} z2wjvOc7#Cs5Vu=No*G?+TQPN7bu>oZY_07r76k0Li_+5_p@up;LI?Eh#+iFKsJnx@ zIVioW16`Ef#SywFJ?scwl%C-TU6h{g2sPB%5jvn}7sp8lb$3uV2c>s)po`MGI6@bt zhaI7d(lZ>Pi_+5_p@up;LI?EBaGZ2dcL$|+bD)dTyE;M_rFU_JE=mtOLKmfHI6@bt zr#nIob#{aR_GMTM^>q2}Mmgwv(z_eg@OMym2c>s&po`MGIzktvcX5O+!p^kJ?xJ+; zUuzfXqV#k}s3Q_~PI7LaI3xH8_q@ewRx!9w>(BQ6ZY1V^#_3ii!uIWWzVDT+f`MsA z_wsPCZ}SriU`O}+L~O-E-0Md7@LYk+bqa#tE2IaL*@1M8}7q*4eWIPj%j>nX?$&Ar1OpT z;X4O*Iv?GP&HX{o2a}HaqYfHV=bPZe7Y93?uZ70fP~$s@hr)EesnDh1!-2=k8?e*) zI)jhK0*#kOh}pmAa8sDhcPDg7_;6spO|aAXrh<>|{UW{)V&;3$=-=m|qjuoHeCv$< zU8~i%DU6x#??(G=hc4Q9{@iH4r!~Ij8s7!Rc;4&7*VY)%do?~x0givS8sqPv58qs4 z{C%eJ(XF#w-%J3#KR)o`qn(#2PXr$dzi50k9Wh@Aqy0XEE?WB~8|~Mmi#wj_7GCB% z4~?n&_Z4)}#$QX=>HejFkH=pdjqeo3mCn}!i6rPb@Ob$b>~y|K;N$U^3}g0hyD|QH zfG=8oUp2l4;fpi)p3?X((D?cr<1f#LFWVS@yEVQGHNJa{@kh7t zMXT?f#`ybK&8-;loG!4CwuFQsYb2`0|YLH_nHzuQC3DUETiZr1AAM z#@{6HMH_!zjPch2d_4ZrHNF;@Z1nolt#(P!bKvn8f}LL93E<=LheOX9e>Wq8&i6DD z4VVlu^UVg(`Bs9D#~+}>7jM*eEBK<-*D~t+I7qm@-8H_WO}zen1HL5aIk119z)tt? zm{#AOFeY6+d|ou_+W_fk^?k;uZ;NhjeJ|Gdelz&!`HX0Mv`>ug9~Spc`}NWIHXFxB zN90R_o&%CH{KYsv^1#;)8alsSikR!$*5Dfe0xTt*z4<0Vt$yTRyRdj2C? z|4udfcP;q1fBR~DLz;T~_Yv?VIo`SBuRrYc_Ip?JFGu5}_D2&q^TBSUqt&-L z1|8S8pT<|z%**#LNu{ut%MHy?K7 zLj)fR2Q|LSk!Js<8uN3$58p&%e*Q}1yF%l;y1Cas+RrFj{|uK#4YA{mbC{SZlv| z8s8Tn*8S_|!*>LB3MVzbKOoKiJ!kaCCE$zJADfK+2x5`T{ZXp%-EH*86!5hp z2kgM@x7z5BK^k8fY}vn=s4Uf&^Q{0M?U%%X>?qJ``!&8b8ebav6Gb@3TOyvbk9K@qXpEN@ zS+0L~YkYGIz8*e&GYr0Q;N$kYN8@|Z7=M#|_?|Jw-wKWIK8-KI7=L&A@WmM8Z?ndC zzs8qs)OWWJ-=#)!nGHGNh^=Uyt^6VX9)pZ@Lz9yE^Mh{pG4jc-vyZ~OK3;VXw7wNV5g3WGGh8l*`_?N`^}%l6?5 z7J}fqmyG%9agA@A##f5-nO@&=AHG{)M|FzeL*aRiZwJz(qx!Zn z_?GzawKn*+Yka#jzV8ye{;l-k`xgV(K70Y#>3lzEd~axc8x8-S_ThWb@K5BZ{-pW-O^t7g z;onO>e1(R8^)$Y>G`@})G_};8{Ohdoy{GZrUf)~a4}AER!cMPmZ;kJ78eap0?=v61ItE{!#`mGd_dN3J{qdC# zUk&8Cf5SDtk2JnJjP=0}K76+u>w|F`-w}e3z&QW5 z_TjtNIRCEI`2L~s%`(;p?R@x(jrGAJ8sFC%Up<2_#fLA!;Cou*`=`eDn=#*a@!|W~ znC~}heBWw(uNddI-adRU80WXW8sGOC-?auGz2Q3A_#0{Py{qy4sPR=9^Zg(nz6Hj7 z|Cz>jLgVXa%%{VB__B=o^ti_Nv&MJS@Ncva-zSEDzi52_*7zPa{F~szx8CqCG1oo6 z{i^XzH0JxMK79GceBVUlJEid@7M158wL+Uy8;@TW&Gm zQRDnk?!)(qasKF`@zJ(j%vWIWE%D*I*5J$5_-N}d=39gL9Z6?BzS4(})`gTOf)9nE z8ebia??&X;`PTaI&4gU%8?Eutc4X||&xU^+eE8_Rr}ItH`08tXyN&bF<34=bjPp^6 z#@A5ed)PRCJnh4`-Z+2E*ZAliR$Si>2H#6Qe8~pi5{)mU@s%3qqwPL?w;1Q6J2k$h z8s8Ph`D3pS-w@;cu|eZ&uJQfd@b91x-{*#ZPicH-YkVIW=c5mN_}(|pM=xo7tu(&- zjPu85K74l>=a1bQAH9Q&`}b0V?<*g^UIyPmjqf~-kFFmg=^Vd5`0y1N^ZmyfUmJ~& zuBYjIzxePa8}t2F8eg);N7oN^zBu$_wDa#a!@rXn-}xHfLc_m$K73_{e{ucX^U(zw zU!F1FH}T=?Ys~kw$2~;ydg6r|-!a3#);@fn8veD`_%71;o;Lhz=fn3W!@mw1U#iCU zl5zf^_gO^ikLQf@M;DE+lg8J>;OpYU7dH4J8XvubkB^VO#(dw~hwl<&z8|FVg*Co0 z24A)h-w1TkW3pKtz8sD?V`D3aN-=B^1$4ZUwQjKqVg10|P zeE6ooPVbL(8egWyx5VJ1^J28)qsriWT;uDj@$EPG%6<6$YVbX;@#ScIPa1qneE1$U z__k|&{WQKK#`$Qa58nsI`Dnk!*I(niz?kpX`tY?i=KBvczJVHFoWZxjhwqf(-!YAE zu*NqR$1al2e}a#LZvxUBNJpQ&_BdsE5NSP-4F%f%6aO6*s}$~4fgOr=0^5B6dF-H5 z)1jD8${%3V07|<4M}h5rJKLRGNInAjI-jTXn_xs^7*mz#glFoKw9vU0R+4UAx=2k% zx6VD3$+)_I$QhK&djwM%miXQ&pVGkuRbCfLhz{7V+`^vqrMYRVWBUa}86H)t2=rMV znscJzd&>fWf)zVNXjQzGS-N1pm4naLjti}v(yVao7m=EUJ49LEL{YXcAet?Ec6qbq zHM`!hel4rncB=@-ACFX&)g&B`)O@o`+*MT(QxOO^_$@Q^&TpCF*(a<}zZ0jzbG{KH zm(5!cZm>BLSPOPR3!ZAm7+T5`%}MGly0lu`s1lka;%sa+FI6edF;Me zQ8uKZ2;aKRs`>F+QSW#^ux8ZxBNPi z&pltMv|DYJ#*}A=I)*=I$^7G3jW<(L{b`-6f=Z9zq^-xTpLRIQ;Hxk5(|wXEsI==} zeL=s?-O$iTHxhGfWkjOON{D=!KFfKh zVN03Dq7)&;{_~$?L7HIgK=+DMcpM*^6FH>dTti_fK0&PGDa^(vXgAbC!Z>eHAi5N+ zwJ1=%Q?O2=kb+Op?Pw9SJEa5ZaPI;I>gQln3B_o_A%*EXrMbdn8srA9z3s5J!!19S zUQjZ2TH&;5(`OfsomyB_qHkT{H7O{bi#?EvupI(y=*UYOUs5t-a{jE6Lf+$7Zgpbh znpS)o%4x-8i^tC>nLK`~NIUI5F20VFSCfl;inyt8#`MWIVIQs{fjv43reBYZzpgJC zTQYfCA+{!1M@9{K<8_x@c}w~REEyi1PLmG z1M`s|I$v*)(40eZI&9d#H-U9N+VY%^Qx43x7XqD+o{4A&8S&Af$9xw9>wE{1$cKyr z^L2wj=c9Wt**`jbneSU*ov#}RXinh3d|yGJ^KAwn_Xo`=%tuoI@ljb6=w0Iz6qMhj zqtBCeEQR=bnhUZ8WJ6&TKKfdd?68b<0^7YpcG_B##wi7AKMHKu0YES67bJrCkiHc@ zR1cb>3Z{)ONGnL2o{aKP*P2bxIaHoHMmmV@NM$yP-`RG1$MVUu zLV>_>Yjf$ACXv#u6}fFI?ttad`N*+lQ>1NnCf08CBFd_COWBS>5vu(B)Y9C7afd`G zJ`zK#lR!>&AQI!|>#%uCj+4r<*2&z*taWp5h(FZ!VEY3D_7B-NZ0}WjM(w_KXa4r0 zts569{(|{+MB1W)`B?uxSVvGCyRlAOfv77s-L^L~_WZgr)&Kg@vbKaPH%1DIXIsNo zWd`;*{ua!yE5dZ9e4pdxKd7#qq>wQ?lECyhhAzau3B4>y=O_dVsT9VssXDGR1{UJ zm0~~y;$PrZTJWK$Wz^huP3EDs6>)*Mf{!Oy1@q4mR4RG?Ma8wQFF9q99$uB4^kR(N zUdOF>n6ab5Ok-8gFHNannSc|o_A@)BJ< zC^$6nDyLOrAFLA-T3p8}D6SBtIYUKF{6iv?AQBH$6&!z1lx zxBY6Hysl2nmYiWueYfNcad7*JXCv*iS7*of|88Xdr~{+Mqs8?xoU!Q1MIFm03AgPM zBi5Ge%wHE;>q@hyiW1R7w5@3Gcx4@#Du#H{ALE>iAuk zX>CqUii-&a;w;yTEjijz%*WqxKAK0~PN zw>-PJbn7dNO1Je|l(Be{ypNb>gGpk&(=OJLN#gyAVOqT=i9;0wJn4Oo^+vQ1_X1jU zX#3%-hsTfnsejRcLj!UL7NTZ7Z-_tK_Jj8C4|sRTp(Qpg*4AE&t!>>F zrQKF1hk2|m8y98f6a*g=v3c7?SAFXG0QSGr)}-Hz5Px)R?%`Nt#vWGWA?=CjoDW(F%&Nn z7h|?rUpcCZ{iX4^xPml8Dh^c+s5+o&>Q=Zt*S_Mrq4~oP49^<5X=K|`w~vasrVZMM z=j!Khj;XE)i0)YQgyQ2xcbxb`2?_WOED{&>%gp1_3W5RQXZsxTR9C4yb@I04xg+It zxllsAr6}R|S!-p~tN)*r5&Yx-q>NxAPZ`z`zq(T`suLnHZM1s$TkEw5B}QWI|6RHM zH_LEa8!ubge4#t~bNE>9dPDphZC`Ky*8#5$*)?p(Rog~wIehq&559Q+@9%zdC~NU0 zi(Xvx?BY$grQNo1=_T&*xMcFIg8B7CO+|kzZEHn#)4`#7fs+OE>x=FfUsw&`*mmcn z4nZDO9fDst9M+Kz!HV3&IG?iC+S0MSK90yo!O$+DCa2sAb!{rDpJ^%vFSWKXGnK+Q zT;__nf)yJqYh8z6N@8b6k1`VXd1jdo;`SVU)^S)@)W?}5B#*<6<$6u5b>4LCvT+8= zZd>uM$dv5&vj_Blv46(_cMYgJ@TY5vMjslTJLcIj^>O@}XW3EjUVAA2V9|jo`>)@( zb5Yi!SC;fDe|B-kZBO3TadDQ@Mjff0@tdI{J5(R-i&YH!dsu7V7Li*-e#QG}$>(rX zS69Y6_20O(Ks<;QLw&U9$0rL`Jb@VNExhAhwKKC3GuLY$RvL}sn&zNA(IS(?7ZpR? z9y;RWzz=6@T{XPId1|n=j!JU9W3KCsvtQOVo33d)`u5Q=W4;?qXTsXE_O<)+_ZIEx zxTrL{JANvK>eUn7vAhk%#fj(elcIW29nl@j^-$fq;yJ|Ci|dM|gSz9#LFlZra9(`K zX}NllH*-gbVcO{0c$;-357(zYacrz3w4NE|q$}bw>ovkST4|LI#A*aOt}WN++FEn# zcLVbW9T-G2?3UaDtS0WyEeIYG)ABHu5{nZ{vqA|wPu-JOQ~9~5N%&mEZo}GSTQd>6 zuf3>l&`;dZyliJT(YC?X*!*5Szm4?T9G>B2g1T-N*F-yCYu^@ecKEfpUxpV94+!zVs`yz`V#iuV3| z)|PWWn|Ard*KK*_leEZvtH11XYonRf%{xAsy7=mIV;^68?{m{1&-v4`%RBFGo%_J( z&l-LH?=5GytUK(VKi$_Z=cCK+ZvMnYnKyqiwLAS}lE0hi+DrtWznnAq!Y@a5@9>8Q z<~6>1*2LU|y3L-xZg6JyiMv0%Xa9f>x6G@^zW1TOpS?Tz;a6`goAB6dXk4Fv1e@-; z;gySKK6$)i-kj3&x~3#tJU;QA)H{O@)M@h34}0GHI`+bQzkWRJt~K*3+YIfr>Vfy; zujuo)5o5ZBt$JDO-iuk3|5K}*Pu}~>byuF3JMq1;4iCp%nv=GC!OH``Te_tCw$V)| zUhqNUjVlMl^gi$7i=UWQePm6W6~phl{_V+AQUX)chX<|XoQaDbd;OnwWO2Iwfxq6= zXW_#4T0OY>hnpKU+Jq){+B*q&?!I9UpQwCv+};-Jp1bS2%!@Zq>wfF&!Lui?eXHyI zpPwE4Z^^UKeX-1@aw+ZU0c)Rt&*8y`3Xd=@cV9$VgAs(q6uRPvEF*r+*e_N%5 zzLdS|uSzdA^miKRl}37_kv?XmU4Iq-enWrUNOyGVmms|LQ~uNSY!y_xBPZ?p(RFPV z>NwZ-AAul7oNe&oJdF0pWpn)ZKBR*|u~7u|#Xp$<`;y^f~gq+GJ7$pJH$|kLusp zwxL}F*V|a-KTou?eUHfeN#ca9Zzl6M72S}Z%I5NE+)+^1ecOn!p7PrYel2JOHWsd} zv_yU?i}M!&Q%J(c!jaw2lmC4Aest1Dq`tlQ4f6w)Mb}`d{=E@XP~~4B-m(2x_30p9 zvH4W`LJ?!@laR*}9mQARO9p1X_P`Vr-$mkO4_}J-SZdkdR6%>$P}qx4jA$;~m#&AZ z(8w4cs{QNPoLDJJ`vGijr}MS+r|>Tg>E`%QeX0N28u|BW_N3=NB!1cxupD}BZ_>Nt zQI-F+kw4quZ>*&gkbep6@w40UCs)%GzdN6X#EkdbN>u=R=i$ zy`lfWNPldkf6~(4`ZgDL*#35gjV01W4|{yolj%+ZmqNsqz_{f@w*Q}Pds;(S7%3a< zG_4~o{EI;K9RjR^8lP)9X^+=sM*1l&?e*_$$wzIgf=b`ZNq9x&QQ0b}bZbu9`VCqd zm#4JQN_f+)jr2K2`dlM@o{>&6(rt`%TO*xpq%j|P{5#)Bw>Q!k80ij1`a&b!(MVrp zq*IJ^s*z4J(w&TSXCs|%q%(|k7x9M})g2{>=)ZHCH#ktg5763!(vR8WlWZvcxt$({ zIiWGuH_p^x>$e;Bw5KnH8PYyM+-+ybgRC)TWp}p2wt=|p4u;JepJDnu? z?HdlMKm_uakNuXYcVnCn>lu9IMtZv4KAitTL*D=jzBhpQ8PhSrxFvAtE_@*n4oif2 z9dU~7Zx_NgcLbP@dkWMpL0eAe{?Oed6>=TGJfo22`w+$fhwKBMFxyN4PPKVvXgCR& zp2wv?=R(G58tz8ezMml%IHfMW5C-AH_b^-q9I__{!d&jPWJ4!ggd6eU`yXhY3Ef9h zA?a!0IL3R6upgA^Z-xu+BV9raJ^L_`+d1*}*q|QO0H2~j7LFYF1lQ8FP z51eY3o2KCm;9w)gLu&-SzamM)DH^7JWSa;u_XS}ti`tFlgjr7g7@~oLK$zv!cYKe> zEre-tfUppsRB{SoF+M>$Ng&X%!*c49U^9}cbwH2?Ai`#RQt1y|gsu3b*pv2Wz`=7! zYPZ|D3J1{++~$PYx0b*uxc86(ty8#d39}8gC)bxS%X?{Z!Ym)4$qBRkDosw98iGhDMF%r^NXUyCmU z!YrrZl|qgn)We4{`J8eAN!6UddC6VQOUEP23A4NhaB2s9AyC(*bd*ru^Te2V7*p|# zCFcXmUgzuuQD}pb6XvqAfKx6~@&SlKYh27WG)J+`D6+Xn*$`$MY7@4ZL^kX2g+Q2X zN`ONTl2qV-NLStxI3<;&Le#q1j$BPq7c51I{OwxKzP`-?EkX$-Wq6NFh#<-vz(eE*qx;6cwwKZNVcIiWS z7Xo3H)3Mwtf-eNZEI$m~GLxi25N7!&z^!aKVU`~U=6)f}@{_>q^Dn^cGhw!&#WDL# znB{T6>@#7OCz5>x1PFv#PS+E-UkJ0D&db~{`Z=2J$!nRVcnGt73$nN6gjr5&A?_E# zET?mKiajTE25#9`aS~>mF2Jp9IboL5HG-COa3c_Ad2h0}<%C%tA^RL@#7u$p>bi3A4P2>}}r&vwRBK+j7Dzzn<)KmCuA(PQP_p z*>b`xpH24tls#dV-$eGdoG{B519QI+X8G;FT*sBbEorhuAj~#*0=Kf|gjv3p?E5Qw z!Yp4$_O_fb%Quky0A){@<&TiPEho(K=YhFj2(x@MF#Eg}n0+S9HamgYXTmJsL-w|B zgjv3i>}@$=mLDK{yZs5X{1DmOa>6WspX>*!Iud62VY0X7gjxO#F!u{#mj49Ib^I6E z3{sqg*(N5&wTUA!|{c%0-qpV z=t6i1pA;L*bI?^%ENY#DY`J+33SO=3>0A?f%*9;pDFIVYdGO`2Vr@?(tPr=l<}T+}MNwn+#wGh?@i=#v}rpn@DXElK?SNq=1T6AQvtg zAV9!N)f31?69`x~7i*~}Afkt(9!mR)>}Q+TM=!K#ozb4);xP= z4?%l=pZERaeBSp-X6E}m>silw)|xeIX3wlk4hsqNCN`UnfQUusePGc!4Ji!;B@XlJc#@j;Qo%BSmcX< z<@W-y$ayUU=V1rB3tMo$hWb5yaDl;VD5o*ddTb)!1f1^Fb7HaiAaH+2PAu|=fP=SU z2ik^B%A8nqb^!+~umkPEmb*|x^(+ojKZ!;E5O5AN1mZO!^^;h1jsi>lBo_G#z`<(l zKrdp;b$ol3crm5sxl8aH;De6*ZD6UZ#A5S3V5zIbBL4tb@=Gl80l?`?umcf`JOtd| zkrRu2FmU=(>_EgK9}3*xkrRtN2RMBhb|7Mr4+HM+$caTh5;(mUI}owR#{&0vdXr8qH_dzIT}!K~=j7=TR~(Qr3xgbM7t~bWF{}KJS<96U@ajZIWl?uoRrTCi z>@uY|_;O*@A`a>DdtP;W4TfM=RnEd#PS}psFe~DoM?-RSJ_`(I?!GEqFa7SbAI*a) z^973*(5q-M_=0t*z;``f&7V2b%Z%gJJRv$$Zb;Oyw#4F^b-uuPRg0>Y&Z({PC>Xm^ z6mCRU&LZec&a8{PW_fMrgX>HYXwNXHZK>9BO)tdo+d1<%qHoc>+WEe0o*Q`1Xg<9l zsJCq0BDk$~{w%Y^uYz+}(s^ko*TV7|eVypBf5t0x)w>$roIA|#tIywDoaANmRqUef zHA@#Ps*M@*r%w*bn%9wbwPxwus9QDFb86=}vm|`%5JpcaJ6gU< z#wF;n8P*v~<}f($o!2w2>a;ZkVJHZQye@Osd|MCYa{d`Zm^V<_LhSAe9*sM zP8jX+{ejos-*K||?ny}O{TVW^y_`!hUkCze&&DSHeGHk`-fWz#zMa^6A9`MUp&a<< z*z4o5cR$Xj*WQX`(-+F`-)iW2?aj`^^OR%n0*}45z+QWt!;;sC5Ta;m#@=g>^E8Zy zjQQ>7gt7d-iSnnt5!guY!5*I{g&4+-&%Zp1{RTu1f)`>K>0&5&^)^5+q(jV3^ajE? zuO8>*%I`$)L7%eVZPURo!5T${?PcN6qNo#@>J zC9mFH=SlZwU%H$#tTTJx^ridSdGyBn(*5E*>GJoI*T3;SI?wN~efFk7ue0;J$LC+A zPfyOr-+k%ULa(#@q8W?vZ^L=~+wJr3abLR3Bk6b8h~cKDXU>!EzxnFlYtTz|;_x8$ zhB?=-*!u{2sDe?F{BH5t`vQ8sqgt-Lbv`}z(ZHn{B}wnuocrT&fbALE4U*{Hi+o6#Q2svby@0lj;orxG zU|oMIYM0KcTv|R)#=3v)IQQYhhmX)B;=g{J`|QCcJ=Sr4jm<^sGIr8VQoUCeZ-)Gx zI<)YK3DNQDcTaDw!l=q6fx~4-Wn7)r5sjCa7}bm%dvXDMwb-l|f5JP+9wTHcX6;;mXEX z(K3}49odwPFr*wWzMBziW}GO;F4>m#tIVukBQpoD9GRK%y^)!rL8CJBhKDnA3c{J$ z*M>8P&IxB`EeRt$jPUT24X~D0@eyW}N~!z8Y8%mz-8?ZK<&*9ypXm)&WO{?LXCzpW zt{wd_sxdw@d28Ck$sK8#-F}qzaJQ9d4|o4f8b@tqxFgJpw|yVB1DSO{Rb}b07}wtP z2u6kPz`cTKnc$7>1;DV9ymslg~FX;%!XRi#`XBULyFSWw;mv)SZ&sjO5KBr&=%5l`H zx|Ngce!|}uW z*^S+-ij%im^VQL0lwY)bI5u}*dZa7-!D#Bn;*6$k(NbqvIPv=!9k(r-bGtDCc1BuO znbmgg=tYiNPv&Uk_~aJ%oLj|q*Mzu8vWm-IJ-j%av>hX)voNL_Bi=A>zkb4KjHTY6 zRNmzet*@+oskJdNa-z|)Uv5;9mlG|H#eZ0xQJL1;>S1dS=8oXV&n10Uo@y*EMGf)J zx=@g8CnA@#Z?uvdQ_@Tcc6CdzD@XL}vC={JOk%t@JoeTD|JeM(8#yL1C0O8@!D3|* z#y6H+fEH{X+PWc2GV^++W#+6*%gp{>TISF}{W7zL_sbky&@VIN+J2d#IsLL*)HOD) zjYvY>7ZtM`)#%k$YsKuB)UM`mVpT!K?1Pv~L6=*aTWa-LEq45nBX$dNxoT4+Vc!?l zsru{|s{&8qZrF*9GZAW?di6n$Oymp<$&E8M9`TIMJoaF6V~c0RBgc!ovl2w}pCsn>UKZW?S81+{ZO~lP`A@ix6@F!(=J4LtSm|_&K$Z^S#8qR$Qb)^&3iDu|H&4% zF1%9R93_-x=1j9Q^NQ@1CnE_eKH+G5c7nwgvy7V2I*AdOQ<9avJ0ZR?p|LKU*p?r@ zb0g+EIEI-3-18kfo}KO0g-e=_Z9BT-$dSXx4jn&mVt-yU&TBr~qewy<+M}l%vKw#~ zf)zDyLBbYlPxG!8?Pa{{Wnf}iS;f9b)WnHa2h+@IS{c2TINF{wU_?-#?c{>^|0iqn zWPfcgKG9Hda;NGjD#iRF?zrjpmIw2*zF%>FGJ4p!_YCXQ%A&x;#Kgd1)XaSom3Q_B zw)!4T)Og+QC%9+)O#a-W6GbJH_Dsqu-Bdb+=eNX~@YVHuXG7O2jEr9LF3+9!4%oFL z$-Tbrp1$+gwij3K^N*R0A5xIE7rzKH+Y;Hf#yxr5I#p1-^B85`nFwU;GE(W{w$6={ z*ft$|;ayeD)D!5fB?!}{r$j$?+xDf_munlbPcU995K4M`0mh(TYtT+&*97d^_ly= zS@)Zqy?uXE_t2?dw%^x(Q1ORb|K-@>^`oX|zjEQ))Ul6SlgFm5*z(Dq7wtVcx9xl9 z?UV^c8=sw7v+>U>^QVTt_w9R@pXm3)flqWl^yur=7oB`BE&SL$NufUM{DZk8k^9S9(c;WshKKj;8S8QK)@gJXGykp$$ zH(3kHAN|M0_inrT%(D|d98>@C-uFwoWLDId_P4^H>>vBR-+!yuj;3orxpLgl6Pm^vvFkfByKdC;qr~*WE9ad^ctJr+<$O+}wNluDhO$-?nMm8>hR@eJ@-&EdMw8 zJ>S0V-f^FIz3ZYse-!tC`d>V6WIOKMLLA$gCyYME>v3MLC{cCCj|}-;!nc00`dxf{ zz{hvh@$oawA;aUfUzCrv*Uc9{MaSoNM?)#7v+FvmW>wHY$ulYQZbB-qhE?Bm(5%aDm*>*M$M_`7^O-@i%x zSpQA_Gq4aS}?!`~y(op9G*6aJ7d{Cywq<|pVoKdI`HnDXxJ3-7J{ITp2N_$D9U z=Hs9B@uz+KJ`W#T9({Fsdf>vD{4+kDeOnBf^!Yx<%V&GSWAm5p%kKc4-)RyZJrSOBa5|2b3aRZ5 zkIM-BAgy2R$k=m1-qY|Ji$m{s_Lm{?C5WXml=u?Te5Q`i{&a>0DE9p!Uy@~dU?;iMlfc|_6p1z5H)MuYdLj%+o4w{0arG}{Y96qG^EZzT>qI}I?tkZL^ zFH;^bdhETA^sa!eq|fwvJ9VDieGdRl(m_evpsP@bQ^Gez1=p;^VV?{KYm5e*JMaPRbA)sEt>DEZg==H zq??Mj(tDlsS&vgus|s->rNNI>oZtD5Ka?@OX^y_|PZ2o8aM~3j-vgUnZY0EE19kni zD-6TBEOJU@{GE+#*vBq0QelfPz4>qW;G`7Wrw9oLJ;&WTJM6 zMb3MGjJZqo=n#tzp95s<+gf6LUnT9N{vsEP{w~OK`WpF=6OeaJLA$8eDIPAoc~ zQ0|l=vBIjzk~BV^2xwb4#X07K5&kszli$yW=dLx zP2?g0vAKhC=Ncy#`IEph#_h+{ajtP<(P6peK8(8jQ(HRL*&Sgekii4aNV$qpOonc028V*er4 z0mS+yb(mP}90ksC##J2$4$>*m>)7Nx5{v%(z`=3YflgzS^F=H=JQre<{jPJr2?2=h zPY!R|pdhf+2V#lKXD^96kUG-ldvvm>RTn{NQymDquZMdv->oU19tH%@HnWg2QMIv+vQ-;ooG{4}t=!sru={0rdpYmA&& zEAMOiA6qz`i`7f#pn}@{Ces;a$=E}1514)7Wpl} za!zZhlVxlYiw@smh)xT2oc4iObk=)x+B`bMqVt$XhtEan*P675MdwN2{*IhjipV5xh=BL9eTr=Amw{BvL#L-coG zsprI^a~4?YIkCt&CQH&H7P)>NyUqCQeIDxzo!oC5c@G?*HrE(vZA?pf%(y>u}-}?wTK+bgXqcG`O+d{@>ni zq37*bE%CJi64ZUG%a<)fZ*z2xb`}S5x-6f!PqFDCYdV$BTC})kX|z*l4b};Yl{lH3 zwQTY7r4?1NVU7iVd=Kx7jgV-MWfT@WC&%{omFyu~QmpJj?L7ffOr8@_3%3@*xv$e) zI%iSk;)P$8COfO6zdbrPS1nyJ2TP*3r!bnH>4t1{7RBnE*8R#QR?h8JU0%Jo z;#Q}#_pHjV=uqu(^c*LA{ifONSoeVbsyIgB{3i#?OI0qY;7qR^oUnkax>T_9b+pI+ zIbN8e_(~O){Z}fO6FBQOtXef|PGu#Rl#z6pE7Tec%|OLLXYFXup%{&drFYbzW>u7* z+l^aynI7eIs~*lC*Ib<@4;`(Y4&MJa9j4KiyomQQ_>a=nA-sP{h_bv@YZ{I{agt%r z+h>~3Q+_??kzdC|^QehUCzHw7oKmxG(;qAcJpEx<3bxk}!E5gp$i`w55_>NLcpE0BUNnb@N=c7&-4w}T?V*ppUE&dKGq$91oyoO!PmdzpyfwRa@~I`fb3RJ`_zV2{tW^bc8&+Pl{0 zAJ;T$LAa3kSLX9CAI?=niT057sJ*2=d+3-I^Nv&OE%e!Y9QGbS#%PcEmi+z*GH-rU z@nSs%;X-2XaVW*)7cWVr`~ai&cx`#@4TL?uixLtz1_H0Wn_%QV$}(9 zXj~M|PjG~|=a)KOdvBs||7^%;kIzh!-?L8njev|)1AB!A>OJjn`&VoMY*5$qW9ZR_ zkl+zeroQBhdNrbiBg04;KE1)Hq#+$*cA^*b=@mgQzZ1RFkTH&=+Weu(tJ$aQ$ZzR&;+prR(j=n*GmBrGJ34I6Ahg3N9Z%tC@ZzsGCO%rZaT?DHOjlqS$ z^-$_duyW9)u-Tv)1)pzOgRy*{3Ss(sxm)i<&!^5ptRp9@rE z#%)OJGi6V^&5BIBSVeArR7GyM*jiH0xU?7f>^W^y+dq3OKJvF;#wT}a@BXwpzUlbp zsT;yc532U$SFPjUANOGV#XWT&rTRy(s_kPvRgW$$3E>alR85KP@Ak3k2gj@UN3o*n zBXKHzXh1!bklv+uU3=w4)~3W)S`W6S2DsKw{G;8~hQcjZCFCP^(kpA5x*S}WR#?9s z>tb!kI#@%J)xa(fCKRvx!`i+H1?#rXdr~DGd1bBLEB`>OrsEvo(RFRS+N{z2Inowg$X`i_choTnn|H>=3+E>QMwQA*#wM%lM_585|; z2PK9zJ|4WlvR}U#J+Hs1+E4%73NPNIB7dBx+TU+c?Vt8RT@R`DGyB!^Ys2sV-m+J8 zjf`Tr()xzU)07 zg+YOj4$g%>>pkH;&Pd}QMn>Ue4UnHg5N;*UCBTn0EVzKS#_IYgWX2!VskPzxzeA0?5bweg^23$&Dl$FS`d)MU8@p8aPnni|rb{R< zDLnVr>U;HnUf2GoFL5ompx*zN`gBeEo8MP0JtCh@hUZVK@H+u3awaL%vDTjUgw^%F z@SCetc`H*^L?ZEE#b^ovm)_rGfllI6ohpL=sjRj?7j>PmtpvSUW7ZV&ud2cpXfs;I zcj{2h(7Lc6o{U8hxt(~ROC+%fZQg zXRGdWZ+i66O4SmK5=hHys*d)foX=7!>(xChhD&e zNMdu;g56jI{y-M1^kv$MuU{S^eO|&*|9%1$X@+Gqf>~ z){&NfQ~sdD%+Q;`%#72)K?$e&R0Pq>+SBt;eBIgTjtV%Rx1#$$%2z{Pb8No4A|DN& zd?f@USW_)p;yRy`g2?9uk)&VtwC^nn)+4W(Pk#ErfWpkSPd}=E6kOh?XSWod>N}tV zVILywZ2iSa9}P;}(y=vhPTz{)TmRR2^!MJL`GQ$%=a$2Z4()B8dw6H0{>pHq$KQMYtaX2vt?TR;hp2C?3D?%D zt?QB#wzk?YHfsJwYwNlU&3|e&C0?`UXRYm@zGbx^ZB#!)N|c5F@@e$$Xun*BR_v&i zP*7G-e`%wN&pC)IwEe&aYjv?3uvCT6#9N*ZGzXfsD6r9+! zq41G)TU)~u{-S=i_NQyZ&+k#~#do81LYscU^A@e*9*g@e?Y*+LrHg$Vt`*p&wf2(N z)TYhhls~EV)^)1A+fP;Gqcic5m*y(_<+s%@?m^q$+Vg9;Sc#IQ?$2gJV*zo~zH<~q>3a{C94aW-Hah?@JcQs##bpf$17DfkLxdvky)?~LN zV%4ih^w^4(rKPLwjpJ15#zBd1V71OyopmL#E@e_;64sThdrPkhx&v!Wz0p`6?E@WO zjPfoXfK>r=@GLnV<6g=z?&T(|2Uv}j0Pj+Rx(!M>)h~0^`|9CUU#QIbE$ZR=H5lLY zI97IgMrE!%ij|#SQ;o?L_hZfPHjeVJu70B>zW4@MT>z_h!0IHGk;t_Mr?=LZbVUmN z^h$%5Af3xqMweICVzt69-&t#4aD^)097(uWwg1;6c&cTa%fWyR3&-J&wE} zPxY_ij-`Dsc2}PCuQ>WuEm8J;V|Jr08iBUR?%8v%X^V~}nzrb`5VS{l=4D&-oO$MD zTNLRQ2<$~06seC_d+{u6HmOT_a(Et|Y4E#@ ztBct^9@!aLH6m;${`Dif{_j26KE2XvqkYO4+TGxIJTH!+rVFx~Ke%`WAqlI~Ku8O=wd*4Be8~Mz%Mzj`w?tL|I!ayjAt@h$))WFSWHvN5bc=dlM`wQrzg|}Z~3tu1VqJMM55ALRt zQ+Q4pgPxRbIksWy#uFRkFHTVn@L)|r`=J+5HoR*LK})bN#GBHsG!{d4tOT>DotHztOsN?Wk7z6h4U3!P$yz zLJj)r(mD8_p3;f@x3_fSbKKHt>EdYlVaJ^FI4w* z4_7^bd)aQ>%MR*$+3s`hWpi=w^4`m4eC53?W5VBXZ~Oo6W&dBgmtn;3FYudaJVr*3 z$H?gM7&-k7jGVp#Bd4#x$muIEa{3C4oW26#S0Ma~%+S^=GV^|P`Oelc%R{w$m){n$ zlQ)izw7hkCemCVY&?GbVI?3OtDZMzp)qZ88RZ2kq|NRbq4{(MY$%pGKO86hvO@txFRtxu4wbDNXy+-qBLDI;1@9 zjpLQQsakbiYbQ0u`@OMIvZW~5$p>yeB&GYFuXJzmmMBWw<$YzCz%tx|G8|MgQl$k3 z;N535*C-E`X6GSy_qI+(;ODC`WysOw^Ks5@S?#9Cb9&3_7!Q3KKA*bgCrxg>xxx6= zSS;y_UnY&t zRcz(hSkzfPvDzAo=66FKjn>Bb_$BYwSUpa9JjO|n$2jTn7$-d*^IO!`ePWlRr zlfD9T0E~;zSvd}K0E~;zwZ_%wc3h5@;Tx;!y!Fm%!%La}Az5(=T>{;@_Xyg3`u0m7 za1oYO&AKEz=d$4=MvfVK1?E7!s<>oQY1y}~ojUEh>u>zd&2!2t=gq%$;i8&l%U9fS z=Ux9&SKrvw+_Glf_ttON{J;->_|VpE+aG=G-=BE$srKD_e){w?KkwLo;JL%Udj8l8 zzkTV%E3dxx$CH10>+L_k_x^_;e{%Y>&;R=$XDx@$I&=}J2k0c|V~}+b{(4wFoP&jT z+9$1#t&g39Wt}yD&cV9q94^A4$3VR1--|8!kVn_yhwxMm&CUhW2n2FSpkRao>lA9Jl4}V%m zhjT}LN=YVeT?lrGDFN1@Jce9bl+ljz$e?ZrGKnX4EUgE-A=rV|O7b`|4He=M_HeAz za={8jT!%dg`w;fvLv=w4`A3YfAcL?48C(a9BXzI=8%`e#?c{KK>)BLz>#tYpi3EW zK*xn#N1zR3%Y^B0>eH+a(3rZkp>=7~q;1ln8UswYHcOVuP8{Qh*3)wOp#7p*;~RkX zT?a5s>lj~&wVXDYHfn?1LoJm6oPe7qj;w4ToD>4esRx_@1?n(R2k9LYA%q@v8H63< zXkA95F5@9g+hAIR)N|6+ENw8rY=~si0&9F?I{Y_&P-c8)6em5TLmk@Jep8u=Xq)C> z(k8Y-p`zk%52?s4zN#>HNVqaIbjUJJQBhe{q1d5Ng0CvP${QRzgN3YzF6*PqI_6_8 zec48`fL7raCc$k)iIR?PcJTC zeElmEKWyw>_28_-x4-!E`d6k6`P=fw#|BRP`S%7a{Pn~~e{s$1^cCy2{%!8ZTc`B= z{;uaMSNw0Dx8V)E&lTdl4O@lL$9NUXC#pZ=oU$LBp+sMJ7a!l%r{C2V-c7L|9jOkR zr7qL@>@Q`gn@_*H4#%rwhYX)3tm^L5?-}j0RR+uK5dP{Et?%V#3F$x)^?}dLV|sT>T=3AE*5d!Iq&+pMOJi_+SafIDekM z+oSr1f5sQS!WZtAuhF0A(?8(j2YBLdjfN3itkchkh8w=rx$j8${OC1&u`fTD`0`_T zH$R4V^J927KZbYnV|X_|hIjL0csD^H*s9 z?~6vbRP!(R`0YOaF%SP7(xWXVYhlI(o=-Qwm#W9Wb9l5j{B=)!>a%a8A(Q_5!Yae3 z`@%o*g@57WKlky2eenZ6o_&=Kne;~c_);H#y^pW<@U2c=G3EUYT^_Zb@DH83Wx}u2 z;ZH{Emq~w{NB>(WANGGo*TiV~a%`0$qtEf>!gEb;+BTG{mc{t|T8#MULhGzCZ_fXCPdM$b@bT{TWzw7P3uhlrvCsH2caU=G!vntX zL%#BR$`^j0FZ_rv{0kq?F$3Q8lYQ~u_l2kW!r9l{8^6fIzvRR<=RaScj~$+H<~M}R z8$a8}ANJ^9fiMnDmijR}>KiTOs#yLqA3w~;5BKpSe0ErW#e1VU@O0W0KlH@ZP=Uo{Vy%zW@9&MLX-o%_|#l5yn z_&`VB#P6ae$LM#Bjzt-)<9Cbpsn6DYcg1m$q${zd;`wQfFa4W!D8`_o9&iovMUMU6 zTHlVYNnWD)KI+F#xUqkMn(EXg_K!|QOMQP#_=QU9vI!rg{_5y+984;D7VmWU_3$ed z_w(LPT^)yS7^%3w{wgN?5OCal+vq&W_vFI=@iR<-~Z38|UX$oQQ zodYHv{Xs~qPhuw(xW6MO7Wn{RS#yb4`&C#oLJ=hfYW(lf%ah&`2pbmj+|KJX}A{B zFM|L?EOI{c_jlyPBImPKaG25OHJ&rVVAjc8M~TSUagGWZ$F9UO!|5|>!w<^ju`D@%!aA%b*U;naI|{S*8oeMAr|@l z)OYF(vBDnKB5wnhIzue-|7o2mWSw#5yqS&rb8tM2f$m8FcILSm06xc=lSbF2 zd}^3`M6keMU6%?Cz6pn5k-@qyJ>_EYQ`e=dj9k|xC+;(h>tJ1%oVe%Ir4kcY*QH{E zr{Z8gKN0|cNH zv=4G`A{L$Az+#{6p6%S5ylr4MGO@8SmgVF`#W-CksqMGbA1tu{4n($IkCu(QGbE4Pb~7| z)OX~>B7Xx|*0z0@n2iDGBVbv>md~Yf-4RRNv%qrQ5sRFknPhESzJr$Qj#zZ~eM+u7 zVv(m)f3fj_SmYc(-rtcEi#!8Zu2W)>=TrV~#tyN_Cj#d#G4d(Yajqj`(Yc;F%Zv`+ z8^|?FEIRysDc2gY$oY;&)?96&&VLv?#GNsUWEIQf1vbJpwaPCT@KaToNnGlP9p+|ozaPVJ@{>{MY zt6VJl<&gJx-$Q-p`XUzjD(X9OVv#oi%QMJ)R3fu+477WpP%X|ISy-UcjdUvCG_<;@oKm`DCN<&8%E6y;3@{}?#^ zUKfkapFrN^L6FgS(s>kSSPPcyhT@r?$j5!V>Z=RNB#gG0o%1`j6Y4<^u1Y}Qf@ z^?V7|JqGujG`oBOZbY5TkAva!Tu*pb#r!JF^g~oLXX%1kE?IoeTsor5*^$0l%glu1 zwV~HThL}qtcP8h`yLwS$&iUh2kO_8}xM$U3?VU3-&UsYag^fGS$@%8E(w@f5Z{;MT z1N1ys@O2qyl3E5w&za@Q(VjYyp=PS9GGeo$u7Cb1|Ab8EFLiTQgV`PRq+o$<(QTVKbo8UP<3npLRE|lehag55aa&Qz!7Y_!A z3NgP`6l033C=PpY%sRrQ(BB3r zHY*!$hwuogX*>4BNrpY|99ds`Q)(h)wAbAUqrJzV=(YDOWT-Mx68|2ClGol8*sF#X?e)aQFxul|fY%=D55E@) ziM?+_;I;P*>}`RJ_If#Cv^O6Sy!P@F&0JOp(j@jO0KE3Dzs#+FHZ;Y*BveMPy=kyl z;@ILr>{-zB+N*)R!3d{+eXxnWCw=}s2z#BKkAL&|w*mHsIrgMa1M|BUo7cYsu(t{_ zA@Q#n0pVv3BLT&Iq^^WRM0>E#`5~N6!tpHZzJ@) z{tffkyU^p`3Sh6jEwINj5EB2EK;X4E8}|5^$@9TJ0g~ULzWiq6;_fWJnZEq~*yGgNEcW=+NE} zY+|nmfY%=9mg4tNA+gsLdW@6r1f=0%f4k$~#gK`;gFgS#aWQu0-#(vz&x~~ayToJf zKY+ddJ)Ua5$2x9A>)%c%PQDXRISTWc2TXqXT3q~l0hsnAU$6Cb=lx<->XCkh&70rr z(Wu=I8Ou-FTGr>!V9aYT1s7u-? z5R)!%suVaR_A2~(Yy>*dYw+u(cdoa^ug6B96MNVB^#*jVce`JYjX)>%?)U2r>|F0Z z{d#N!IZ<>Rj&~Uwu)7 zI@i0^XD{tMde8gp4LgtC2k?=;qWRG@5qgyl=7C|{BG~aL^!Ok_<|tv`27rq-5=y-Z z!r&-+zocH-my02)WAMAU-q2L)>y5nVg>gQl>?l7Cd$ZAIG5m+v5UiiKD(5f!AI*g~ zeE6tQ|Lk0Nr_q2iJv3RMq3DaC=fX>LXSH7_#;r*h zDcqD4XSHAB z=T_UwBG*cmlON`;^Lc5oPVMUKhH*{Lx+8&4x#?uDvAZ>>nNdHoTO!E~)(n?#jx<~f zKX!O#q(RwFU!&gGkXiTdn85|Jxik!hg>8*fJt^4JThvr&Y==gX6-gMZX23?NtI-h| z(&zK#EB?_3b0og|ackbj&SrNhMy?{$o7IsGnd--wvuCi?-dJ0Z+4fUqwMnV6ZcII( z*9}Jbx}%nNHk#U1u`fZb#A>`!bFiMYRq@ewRSJKmHXU<4YAe-wa3#N-UZHlQrbQAO zEY8DacS(rPLLS^zuB}s9h~w6%jMBt8Qm1t4@5Y9?vzU#*3})gH%CoTnbveqLy7U;z zBtN5QeUY~gF}FLLotm&8Yo|85Bkj35wB6V>?ucgv)ySwm>cSaWNh3C5)$h}fUgaqfoaTWd^M)zK3#4%CB9ps4)UsOY_YuQ zw~uPW>IQv2w@dn}k6V|oXit19A7}h`AGfwAplsVB4T-<=`jk<+zBKM?dUn1!eRi&f zf62Hq(Skm^W?aMQ)o2--Z;qB8$JN^{-QuP;z8;nBY~h%G_o|6Bce5f5s}s0Vyj$v7 zSg~0+>f4R0;~R@(CEXHylBU)1^VRW~c=K`P-W;u0+ET;nIQ!mi@w}oZH@zMWLwPlI zOUOVSl2oiy^1bcJQ~O9D36&<$~r~fYu|1# z9=NOSp5sG@)mDzu%xHSs>p9|WL#q&z8|0Dxd-GUy*W&Ie~Sc0S7%XV|hj zOpDAlw;Q8tO=F%v4{nH;a)I1~8{#~24{mVh&GXKohwEDO-IB&w{ltt$UVR0YT+iP2 zbwmT&^5zl8hDPIB`@*<}%(`e|`Duyx#vUo+k{uZJo-&|&RpvL>vIu4-*{ zWH;Qc@3a-c?P_U})i$DNTT#X_tId-_+tlI;)rb|~#ovj6RUEBE0XCL|ut z+F&`c$UlNw;<1NR%$n-i4e%*R;rT)0Tl?fWK_rq3YChFdq*jMtFA-Kd*A0(sL+$tL zTScx%8I4@2dpg_37tg627jhP*PF8d0EU2!kG#1Wh zzkBjElO{|oSUjPypmgN$%Zmz&zcp{+wbSlgJZj1H)uZNKTQT|aX_H5e8g<*P-zpn3 zY}AN}ciw*c)EU>@G5>~zw_RH?uXM%y?#aWK%^5y+?j3WdUjD5GGm5XdVP5sOYHnRJ zWATKt$zzsOj+%4rb;St@FFJD+z zdiCKV%`XAHac_FG3SnO-_)%FN4dUtV+Pu*r8Uo>8-6!SV%#-_0-< zgDnnkE9w7}TEd;J`4c|=Sq~rUkBPq{8g6*kKf^QchWe;$9W)xpIJ~W5`fZMkZ%%1|l8yW_MBf7BQ5 zmX8VloiBW?hmTF~BAwobs6Q9^@-s+>4~>Q!-qkm}TmFWB-KQV@0go3EJReQI@Vh+x z&k;@owm`O>_7MHQ!(Lcl5u&F%{S6myioFy|cdb z*f&au;rvD_ME*@Dd=qdgz9!7^>HmjgZ0AFMmmhXHTaE^L-Gn_M>E97lqOOJ(SqIU>p*Cnhnwz2#+i( zofi~{SaevY`#W-Ck+Y8FcEt`9!X|jI2M_gN)>->T>_Eg~hrH$3;c2pXk$`xx@Sc#w z_x2WdAeNs+2SL5DS^T&OO2uX~5JW8Y>8FfGqHm%@EIRyNBs#2Fs&dz7J`^Z!Q+7K?@(&mIngf!FKaiK0p~h#SX#dRV$ly#PNzU2Y$E4* z&*A%i90fW@~5sAFRXA{Lz#V7WGlMb7Ih=VI(Y1F(q> zvFOl6S(94pXF~we`p)_F>&v>;x~!b*!dq7Qnq{GaSk6+O#F8%cgO1L4>M#)yvFMZn z2l??2#QL0*r=jk%Aob*Wh(!M$;9SRM2w28GX+NF3c>Nsf(J2C!vLzOqOjqpa>&UsT zz1I=Xqg;=~61N68XE=7C71*TwiA9G#2ie$w?!#u^s-ecBb3a6)^PoqESah~|be^P6 zHFh9k(b)qmcJ=|w`rX8$a~N23UZc)j>_Eh#^Cqy2CHnwa(jpd}Gaj9@)LDofh*)%z zEZ0slu+$S`(HTH_rH-nIMLv{rr%fXkIq&&0o^2#>E>Aeb2 ziADb*>N`4me8nQ8Lo7PGJUaV;<(v|W&S79#hy4ZWIAu#LI8XE~Q^vC{YVaR!gZ!CvNK(PtiIt@$$Q)EXUP(P5h-IyZZCh((8& ztE^v7w`8qkV$r#iI!q9B4>p@$fkDKgvjI3gA3G4S$R7aipN}1gSmaxP(+emy{lY}v z2EM-|Cl>irz_Ru+vB-Y{oKuJ$Xg{{#RT}E?X1Pvzz5tQn7l9>@#A1i-Rqi*j1D(Vs z;}72kmS;0!(LYUjEp{Mckt@%&KrHeAu&gPc3Y_~59aZ%Omb5}1`Cwr2lUVHJQO7wK zL70%=1;nD02Ang&*ylARV-&sD*FeZ+j3Tkb%>cG<#|}g+a^B`;3>C4+^MGXx6|u<2 z0?T^e#3IiJ&f$d!;%Q62T0@ORrv#$@j+|KJjAq|q^od124LFw-AH-`}{PbSeGa(m0 zi6t&?72+qc$ZLSbCa(oqN8Wo~tbknBktde8cLIx_#3FB^+_`p$MXt{y6+!2m$8Q-q z%T|61c*}WGbkW|0H4A3lhVc+pv&t7NnzIy(Y?oJ6)>bc@#ek(%b1FNNS8z3MF2n71 zvqsO1Sf92qSh;uvOBXr@MTdTfC zMVEEd$~l8BxO#H5V3BCg;^kNc+*P2n+8q|?;!aoorpi3T zEniT}6~85~EJR1-u_vJt$+t#0#ZEPvw`lpo7-Mr6R98EdCPpsHh`UaE6G0g*tC|J7 zD$h5zM6~8CTQpo}03OE}W(D)h7A~(oSGKrP%krwLS1ja0*h`l!m>0DaHD5bto^qBH zm!w%n%NE>O6;$$ z5o4@AF#>vhj-cvx6xL#Q0dOkKt3bglu3WHa#VicA;qu_;sR^dSFE6iN(D`T$sTDOw z1uk+}2kJOR=-_zALVeUrhDXO)U<`#>GCVqf!W}jdT{|2jB*L@)#{(obCd7`9=srlP zw;&V3?Nd`Z_QXksJ@5F4pLe3y!->N~oP(dnk;&vc{70$gT>^iO#$#hx3bvkz;7zv> zvH&(Av6l?swHL5md-z};wO8b`$NOSu_P*(}7xLKS>pt=CU*N3Qzo`f-#3lqYn(l<2 z*T1o_*MJb_m#_E4UYlc2;%z_}pHGCSNBV)!-ZQW_5pvq&YeBJB2j{&0J&v&X*n}jV z??Q=j@|}Q$-mZV$ArpHXSKzhB?-(~bad;4WHv@R>-3NQ(Ur&#{U--(8zvnvh?^$1d zUx2;GV2Anb<+1l2#P|C5Dwq!tE+qb454qRB+wpGkO(@YGiZYtt(>{9~+q_4N;VAY# z^x3$AskyL{dg5_`vd_VV%ZN6L@ifyCYt0H{W<%RR7ny%@t$>{UaL zaq^w8`#kpgK_>Pl`|Pnl{ew;%9>m@x$QdV}LeLAa*MK9-k6oh~#_P9_FTb3VlHVzW z#9q*s-)X4y(~uY1RYVUNKn)>Yc$t4p!RaVTDU z<8X2F9fy$E<2ZS*y=U+Pvmv0Vcf=I$D`PP0DAo1 zD8w+*kFXIBBLj*gcizAHAPh+y>U{=1FG(2Rx8T(A=Y%HeIX}%bFM3%}^7gMz8D#7; zza-K7A@VDEpgbRq<5M`t44;OLWyaqSRTY)ZPO}+QXz1Bpxcc-^6 zs=qHKdv@+=*wvEP?Cp`v-icXFCt&FqENzB&@6;*9p2_pwer_EL*$Ww~HdUhst*hf| zpf~4~@@dDX72dGxhK!l(XR<%v!~(9EzAxGBLvH$DW$iEB$2D&gi! z)UaY}fBhu%Fik#)HJ}bAMUsoVOvOr?Pd8n8ujIu#l@geW^SZ-5`=<(v!(Fzk_ItPI z*JAC>6X<8@YVR)|QL<}eW{7>G?Z(7_^b-7J5?9M)UqQEqnZES*6?9$eo;T~%u44C$ zTBqWNG%Hg&!F)UMm+(! z?3!dk&-H=*MpKFtOBUWyaX-#{(m|DV2DND=wd)PU2qW-m?>Y;Ym8YJQ~69uFWK$e!$0f_3_<&Jo@J${n=6b zhM(-=-Lxn~e>~{dMZ*o>;NfHS(fJ1#N& zS1zmdi#+AQ@LxOW^BQ3PtSvr&+I{>~Cp|v*b6)13`|{^}GS{in{t73&QtS6pr+oID zSL9Ls%N+gtwZ45$f3Y=={|!34kK#N=B-ZIv^wR6*#6PO}eu{H92+^OhK3@9QQitK5 z>}Y-fWcE;ontlUe1NAk-xrs=uqxK~lYAibZR$)6Q-22^Pq(`4v^sfZYabEHiQYQyH z5V7d++Q1^Zns}Y(I{It_Z07--SoB%$b{=*hVv#eN?R>u{7PVZ1(PQ=iU)h((`m ztK^YbSvB*m(ckB?0ob@5dmna~nmE&Nx6ZXZF#`g0l0x$DS>%21&kT>tFyP|Uo zuzdwJlp>aNmja84`AEO9EMW10SZwlKNdGYH17FyHSf0`+OqW|e zrLpB!4c^YD)Xe`OHfzC)&HI4mx*!&v5O9z$OF;A|$HDo)avq6AzZ5u!83o;iP0kUq z==25-vH(DAGNcTNMQ0dr4qt+RSU03ER|r`8Y-xW6K>*@uuzA6Oh{a9`u=JgxZ#IpA zh((9(gY@fK1#A~%2O<`o`+HDd(Sm{+xE7QSe#h?%QQVo-r!295oi#okYK5@x<)>7eKrJ8yg)EB0fZPM2S) zV#W0Dd^4EwHAT$#yiUGCXdUnOyYuPr%S-gT+d1E6w3)B@e5ZB3=KI~b-?DTpe4@kW zId2KMC2T(3dBYYgn{{W^(#7W6YMvW{(x{lTXjUace4oTR|ANJ`jrmGt&VB8y+B<68 zPgfN3>)6t&WwmqoVFoj*Nt*t8Hp>&nc;-CEd{c7IbBvglwBUT_Cq|n_SVFqAbpg#< zfR9iy-@A0d@~qBViaOQlCn~Li51{y_TQzIh{5eaj-0xhjpB%4to^M=E8n{}{`;AMh ze9d<-tz&AAu|q+pU&4lkaJm1}^a7s6oX0U8=PukE-|`6L+3Grk5+^y9+3tHO&SCgo z->;Y8Q53xjq~X=$ZTqH9^lpY8e>aYn(x)=KFZGpWl zP@+BNP3(P%2wwmAE}UUPV(%0LUcEFhyw3`W-fIvre!dehwww7*#dPtiIGXMb#P{0E z0>k^2kl5P_x!2wl*yDYH_5h>yeu)TPd)vU2i!mI<-T?rwy^|h$-97fo5Z`Mr0r56< zVs8SJy!L8vlEgpn_pBP9y$4~hvJ-o^`s{HMvfH7@{Px1ev{(-=@!8{84yG#vRulU? zdHuT`_Vyu!_H1lougO=hINxgn!iB`%N?*Mii%KvJO0?(wp2an2kaYAqN<~6^mJ||u zkNE7ZfxYoiqP+{SiGPW{{LV+fQ89+2*khuMlkbEbhP@vH)1LQx7OxxnHw+tTBt8aL z8mRXSDZL4FeU z>X0#pXJKO=gV@kKE}P@|K=F0oCx#Cj9{y+Nf2kW}(i@3%_|$kYQvXh$h2Q6!zg2ZN zENMEi?Zq9(kGyc~*zuz$j=XyK^+RtQczgeQ`xd>Pw`ONUpn$r6;RyBsNB$qap8JyK z{j2pihn5km8;eIr-yCYav7GB9vZg40M&sMjkcugZYR2^J!zI(R4^0fpo5uOkxBe5O zXl1e8dceYa%Y?*Xxg`~K2UTNY-hm%o^N$NF>bk4yKo({@IO2IvUKXr@?7gND6ZTJV zzj9co%7W#Mb3JBUFeNY(^JYj+ zEX02`CcT-S^tKh}mRKEDk=2&n@YT7`XxuX;Yucu1NjIFCG`I9bY01@luFfjkRF-tj zC*P@xc^^L-@8O3QT$tE>WnOc|$sH=Yp|o+AXQmKKkA9bLB#-4s`ixW+HM>=FtNVr+ zZ`vD*;yF)>Xn)~cx7s4#`jV) zLxb$hyy3kva|(K8W?$PYbLgC2nORGEA-osDdmU=Nvia$jJ*!8wWUm=qkhi)pnmT7T z_+diiwUL-XK~f0x5>y?yIi`fm0_8Yk-nvj7czff-fcLCNHVsgLUNzqN81N;;vd09_ za$+syNWe;-yf1ryInLfx%zeT4{*oSQe>82^9}8be_{A)%u|Cw18jn2J4=zZJzr;$d zzoesAeD=y-_1Oiz;xDy&)nD2XjL%satj{S3PIu1T{=&Zd#J(vzGpoXmBS#J&J9PZO ziT$tcyZQBJTQE~g^N7_?uEw{P=$EXCX%cgO^a|>%HrO9QcG`TDgt=mJR=Qfg*kdzV_rpotaG~Rsg ziF;?>x8pwX6klvRI*a4h#AoyKiXJNJG3oC&+%ogknWZ;AePi}b3vdqX#NSw$fg|9y zd_#L>9~~NqKt3#*_Ra>@1|tndeWNU#u+fpbUkSb1m}9}4xeHe_$8sA<7hCtM*x zs|}vFy-_^b(<-ej$_zCt(~g{bEl6p4zqgKPeiC1lM;{G0yzQCs$31UD15@<8EN&ZS zb^K*H<{=8~#C#^@#m9^DHgYDEztsLYVSY5vZv3q1{41YKDn^+N#n(HJty8cc!$+DL zl5WS-Kfltu^I!3+dU^4n*4@+1SH7Kz?X{c_$^CwcFO?114RTInTjxk(LXw@-kc4@; zno93Ix8-%M@C$#`2Ifpl(BDbDk_JeclcJIic!oM9JaX&#a=x+%^KNxWsjsRN^uPK0 z-OoJFcKm*KL_hb)E?&j*3F;;2-!Bhrcp@X;Ch88)ertwI_)cM+aQ-fk@T1NHUmXN- zcyf+SFG<@U;Ar#7n&~;Ofgv?~jxT(Qk9U7#`RxaM=_PCXA4KCD{)CS|?crnnP4U_5 zq3!L9>KlHokN=&I=h!VnM*kikzuv>grXTdBpQ_VeA?EN!hUMq}rZfC(U$|RdCY<9; z3>iM%!^fuI+n0V{AD^bvFBNm>%}Iaqef;%4-t{NVXD?mH=Whc;>Avs*I()nYW27n5 zbL|`6^=E)D{y?pt9F0HF7amei!=6hSK7O$3<lWWoHR_wPd#T{+?Rd+6#4jTeE#2R%;`PTuIddUV|^a-P)S@#-EC>xexow=Mi6i*$ zEu()kH8MN$lYIOoKKsiZp6_!~F>}lvj(wA#kjnL?&$d12xOafp5lu>2OyJ|%sDSUA(EzY!-mV$sh94wO;b z&hNkhrDxit9TH2}df=eutRY9+Ar{U?gR_;KaX7&d3x|DB?Cb(gVWGki3+EZ&-dayA z`s2V-R>Yz|P5oDKf+H6FTfow0h(&)9IIAm8aCZ6Y!O<*#yUpnF$80k}gpo2Q7Mr<- zo>=txhMrjTtXi={EPB>gum?_Xh(B4Ecy$;lKv0K8G#cVv2Z>C7ET=d zyB;Trg>xBjFohx2y_t+}yiXI(6$Xd*H8Q>t3y0rgi=A9@^!P?BoRJ2ngq(akT8mgX z;|F;3&@$M><|lQ5jlF!#r?pto=+|LUsHTy;d2a>`4?*p{zme38iU*8pdw;RM%=BQS+XVd3n7ENg8Mi~c!anPYO);1CPvBsu9g!JWks zm})~C3+EzKVux*5);1v)P7KOc>?9KRQ+Dj{fch%jljW~*DsW($(i4jvwp-!YW7=fJ zF~>A&WDP4~37bN_zNaDmk_ojp&17bFGB7J3xvx zDH0v`rHit%dj4J9e~~GS%IV!zcU0Eg?&xUol9QZ}E}7-j?rbXfvq&Qm*x%`^$!g{@ z22L5sIs>jbQyDvg(zRVRHvYNj09Pn5!`?k|{bhdvY)h*n&SKA7oMGw@`doSvQ0&N>c* zQe~w7^1p}h%x=8OvbN#g^t67CXK37p*zPwP$7wl7|CK+y-q3XfU>K8^X#1#>@c1pa z$>Y7oQxX}l@QT30e=8pc-BXy;(hScGVCs1!;ox52roHzd)Iu*#?6m-x_9i5&`Mg4!T=uy4Ij{HP#9oHW-p8=VdkWg)y_(qT4Pd5^?+Y{9$!~Y?7$zSF9p|Q3fk%5R zN3r)RuxXETqS{N}i#kj`{?aY#>ZFh5Cieb<@TR@}ke_QOeHWlN)3=89pkw-YZzT5a z1vc$Hh&ILY5GUnV4TWj%aXc$a`SCtY>~Z~j(_TI74QeNSjo_K~_QPHicuXIvCStG7 zmEULL+Alw@wPD&T>*b^mS&!KJvCG~u*lRDpTsPXZH_Ncc`lBD~i_ z{J2iIY43j6e_%c+L1anMFPp?8s~gPm6aya&FA;!HhUxQD<{zhX*q#ocR;n;VSWC_YPP5ew%YCLM0Vvp0P6P zJ;lLOOKUNo2;Xflt=$pw7bxsGaH7C-Aa+}E=XdYn{7ZW^1AGnMc7=gyM>6YT@l#Vc zq1dXrX<24nTp-aK6Dny~-54jk;^c1d76dvROc;20$jU?9C&>O@drJMu`t8e4uaH_p zjye=|ytHq2@sQ%#9?Z~EU#H_6daSOXcO+744HVwUc`@!aC#Id4e!Tox<@`SnB2ye2#5|NFZw%tTEYT->{0!U>n*~OPgK^Uj@2>kbX5Y17r@2$ub?RLG zoD~_XPp%&S9Vgx44n^_E-(_FS+Eu(ebWZ`-Nr+yjBIec)ZY(c5SyniXD^?8sX54Sn zev|R*(ig@*Kk<;7Q#9~b#_YMs%%DJHk%ceo|k28OWv(eg1Om4s3~jGJ6`AqqX%+3sdS@P_xu%G-Ta~j8#iiyD4_vvdf4o)k{$4d7 z41KVquCVF3hJ7nBx3O_Y&s`O`xCLWPmpf0$e5_gT)~Z|~N4TEcbSJWsPR<1sRR zIXQD?bH(;g!YtRV=<{C0w>xfY{#^ewbFV|rhiWEE%@M0u5W-3r-K_M~XRT#rKC7ZO z$?DWpF=M@_$};DXGDIcTNqEv)WWn5xb@NBe)_Ddf#4%G}&%omG~%o`mLDLZFAVYnmOd)&c%xV7x!REBI5EpLE&~O8ARoY(F>5OVxx> z@%SdT?I2pg_^5fIX=UR#kAJvg!Ai^xSF;NTP1@aIWkE1L2i$Te{?@7qgC<3Kr*FrG zEhX{!v5)(#vk&DS?%K0w{Ppo1QQizqTYYNvL}R>JQiQS4Hxy&Z6IRc+#Ey+5)EIa!t6u%oHH zHsQqSkI%t8_Y0x4<=c%C&O-?(HLJaFtWp~#2>$(yOrAGw%^lyK9a7B z7*nFZNQm8*=)K$*zGbL&9%Iy_QFD^v7YV8SoO$q>b&gfc&Yn;?>C~i>Tb{WkW7PJgYsIu9xG%ETj&gFD7`f&phRmx*IKdeY23Vg?9*?VsIU)ownuOyHCgIxMF|j@m z^?5X6iQh;ZMXx@JS@zC&VYYB5*7n=F`yK@IwX@Duz~lKPzHBJOmkWis3U-%p@qGlf-TQDDp3eduI#^ZR z`P5?lrG%;v3&5RIL2P5`EjThNlhOMMm-_;j6kQ^~CJ!)Edj#7m^mTOXB+^ zMaKK+7%vrqw#-yW9JJJa9G40KeLOCxUJ5*|*(GUMooKri-!myP zI(S;YyzJzfFbq#?*s~TjB)Rsqy8VnAj`+p*3B)ybZ5yVl`=#}@k+sa6IA~{rqi=E2 zVZ_>IPfcIZ)y~~pv#%&EgzrxZ@%>35TIr~zwO>+Z#n=NihF4a}X*}yTvY+agmN~-v zz3%XSuTvVd=l43TUDDHDoudxFBt2%!ZO?+;*1sf8|R#vHHmoUd3naLf6Ti+-0>en0||*%m*OpT6*IP4Ym0_-yft?E!|ADW zJlv~1BQhrWnznz>bH@FgwF^&Lo?`d2>@M8Hg}ud>vA)c;)&dxdspCpqPCWz?F#_X> zKb+u=kvib&XUFTEk;2n<-9cYbyu&WF+2+b$zQ{h7;Zp9Y=WWEVH(58SX~{~UZv z$i0cD;oF#r_%cr$%qm(=v&lGOCfwW;X?`u0uF7~D6#UqRpW zw43^-r_St~KJc4Y!v9M6Us=*n*fetGzNTDU!SVf7L%{b}?~a4v#DXgeBc+_#__%cn z-z{ygPc!l$y2^HR(+u5qtm!tSeqa7tuIuKn$jAN0ltxc@N+ae}Bx3jVV%&Ee!anPN zveK8lY(2K5*i&()(b^qq%&$08>`B9Siq6jL6W23+2~Ezf;bF)*mh-)ir`7S3a?Pv{ z;$4AAxXZ7<5nlm1S89wbeKE51U4}Bkmu-FVWm_t~Y)i$LZK?ROEfrt3U5PK-uEdvZ zSE78=WSu~~0T|%py$$nq#^-rv#qN4v!G_Tl`#-e0#P442E0|d^+!+aUBMK zxPEJa_wp0J{CaWa3(viF{DD7vo<2V?{``%1dn-MSKaYL>k)JQ^k(Rr^rMmI0|G9f+ zr<^y7`px^>Yx}3A<^HR3`_vn1#tvHfqvNU7pLMUidfnUUxAnKK?efzJ%lBTDcjo%_ zw|=zcdtX0&#m1be1>Og@|8eV>1;d^=^ZG06%6A>RYUI7&8}#p<`I`>q_PPDs9k0Z+ zj=nGPow7fFI{Tgx8AVQb6L^I_y7M$ zWWvX{-jMpvD=Th$Yu5f%zPn}(_-x#30~S9v`>%ulp4<6v^{osg>*8*>^#10EOe{$owotNMDUgx--PZ#}W+V6Kf_lE@^mk;SXBsl4Bli&Z> zXU{KtcjzNu@A%QM#hnjcSbTi+^_#m~Q*i91ltXi-Bo}yd6Z>2k^6zs6-DXWav-QG( zUT;?oKDYDP6}$g-&$Z#^0hjmw>%aUnZhHNp^^c!AU%u@xfqsv@c6QPFzrOd?`)}#> zz1ffdzBF}h-2+)^e;E0v+jnGsW%pN3{_f1==Ee8Vy!fwGwHK`eFT8{8EPE7qJMX&Y z@~?MEKl7I#yz~9Wfwv@HIqv>Zg?pCmrp1Xngi# zLz?R*-Sl?Gdn>%3E`EQ<54RV1CwIRva#HilukJd&=+3+smkqP7-uC)i#hbr>%Cjea zOX<0i+Ztc+{rsKSr(e9IPvDV{ztZQW)XsA^zjSeUTF-5doE-Jyk<`ztOE)dp+q8Fn z>Ykj#_0t~x&3$pdzyIOmL;L?D{;K&I%jOn%?|6Cq`RQwpe!Nq#9ez2(%%nvI+Gm45!a_X@ln z9&8$X_Od(Q{n?C`q2Y5s==NObzynpkNjSFmV9(t6wfEn4L;eq*9RAs7=dZ0^_u~9c z>1QUd{Yvq+YeK(oOr7|4>(##)m)hBLWv?+qhi*T=X=>8LR_wkHx|UyjJ7wvyyw~5@ zIpeiMWq*6=+qY~idVSrtJAU!!jaLkRZSbcx*L^T><3IQ0ebnp4gMYip>-o{!A3Q(e zdtHBhW$nMd|N4Vg^5dJY9e&k)|D2WI^_~kYg9nWIPHS?(sg^(8{;k>->tEP^)nhpY z|M>NzpUr*#Tyl?Jy?NChwRT%3N7?_EHvz{poH%|%xK{-GZ>$w9`>fO8KN#WoT>c$w z|I~=TlIObQDwoW;XUZvlt%z0!m;D6WK7SKdF2UvB(e_UhZ>+cyo&HYNB0Le%@h3Eo zHQ0Jt%Map5FYc+${H?YbJauw~?`-{*KYGDEg(Jqg+U9SuH9U28@w-^_b@|?J^8+q^ z7h7Hz39sZbm%P;_A9cyE8gg`gRea8Gr~y~{RDSI?Y}-(Bx%>dA%ftCiQu%L+#HZw4 zE_tU*9%0zKLziErUEbHY($m9L9zCpI>#&c*W(-zDVf`G7*jN1ZF8QKM{=|@9((x~~ ze{_9aZri^;;;-b*hAevy?}IJ| ztFW*<))@ZL_LRTVp09M}r>`A;VkCTDmw&qLuYP+aDc$0}8FYPccrY8ZRQDfDp@E!Z z^D84i8msV5`%bs_9{v`%>=q3FC;)9;rRBeCdkZ0Rk9p?rc%=QLTeXl!!H;d0;deo% zOU2=_hFWW*9*nUU?m`?_eod&xptCr>DKSyzZ3$aW%|iqZTM4m){RZK^0i;8&A-8#fxmPG zI6PRzko=1}4XmH&`d8&wZHM5gzqLbSb_0*~6+3*c*3qB#@(nrK-c`1LdBp!JYl-ep zdCBqsB|8|0vn%zgN5X*I0kmam};sXW901BJIIFeklLSNcyr|_Eh?u z_I$0CpzBwaN4{;J?NPaFt#i8lD0#4T4a(;(2>4^yUm8G-AxHCvxWebSMz0bGF>sx>@tj*m4(3_Lzrg+y99xzsp?d>F@Gi80p(8{O@%7 z#9mPQPenMc+5CiyA9nE*T=v(x_}nK)9LqD;C8xRM%U$JL>hj;~l2gSv{?h*2Iz3MT zCu4`4tuFoySNSZ{;TPEazUYIFqdmDdh=HACjECGeMI8NyxXR2|1WIM>hdSV66>pEF7jen5gvA$!T=3a9Br@o}~t6bM+@FK1~GK0O9yY zFw>vHN`oU7n}dLRYdx{(c|REFf)gCE=-GbcyW$1F!XXw8+l+9o2bOq=g_92~@e+%^ z3OLXeCpco!(|%B|WxX0$IK;wv$l&xONB2Qu;iOT&0w*|P(c5*`!&bLl7n%m(N^t}+ z50;K)BKb1QXA1O^FJiG@4J>6vEc(U3vbOdb;4I9;q}zxiz*p9A#KLa|mhU#V14|zy z7S2=DH{k?FEcz3`{>!Pg@Xi@=rP$DVlUT=V_g_6$5KCD0*#Hv)M=bh5z_R|fU54Ky zqn)+2^*5iB;1|#wVzD!Wdfk7CMSlgbd>hGld zgZ*)WdkRO^RW`Jq#UH=M#|(VZz^8#_oFNvQXMuwmIMLy{CVMdu3nv~}INiz7^+hb4 zD-4dkU-f2X(%i55dWO~QkXXW&7NVEHHX7W;1Qc{5sQ7+doZZ<9HXR6h=tQ^=!r$Y zgL+*i#G<$Bnwf)R{|)@WhBg+?IjH2D)%Sq?*DB7(_>+~TFzY(d>|hD&hhD<6-es&a z+W_Bb$XG`#Ve^3lgOp8T(T@QZn^S-#4eYK`FT}#nrv6c7hgkF@fP+-P72*hNv0>CW zPzsfBCX(}*;t-3SX$Gg99BqeKICBingXFM-!VwFn5m@SoSoEpD{v4d(GI3-LwV_Hg z8wgw>4&j#pOF0mWeu|+d7CqAz*oG4vvFNLTgSpgNRy_{sSd97e5Woxve}gjhHisMmdgSoD84 z^u(ecfHoHRArx@LqUTuT=Kug#WMGatqOSrDJgzvz5_SQwl3jJNScX-W48y*SwxP$ zk0llkqYV5ACpco!uLqX8AQpWe>f5PdyV0M=bgjV9^tcJ`FfH3MV*T`%;Q*Xk+0FfU39F6N{dg zqQFlSpIG!cz$wK_Pb_-otGCt@i@pRnuo@>gV$rjG`l*0pJ&H}UPT6k7Cb5K_1uQm+ zML!ow*C;w2W& z5nzdzSoE&~OT5IQKLac_FOZ|-B^J&H2IoUyiI-S7p8!j|#G>cgC4uil0Y@zQWMGN6 z4>>F(IAY=O-cmRm&m~@SY!5;&@e)f|j`@KnlucsM+v9(U(vN{&Y!VBn3|MRui~crX z$qTXQX8}t(=aHlHLM)txz(F1FB4CM^SUC3sOT5IQZvvLQ5Q~02u-M!LENR$6{!djN ziG{zz;6F)xqvGrYmOe!+{9VA(r-()W46yVmV$t(E-xS`+z!8i70B~=uCl>u-VChrD zqCXCtGEUhc7X3-!-dayA`cvd{5P~BX{b};Go>=r}fMs1UV$q)mmh!v+oH9Y#Bo@wl zz`eDeSo9x|uU`}ri~d9MwVqh?{|1&c5R2X$)tfqQE`vFN)3OaCPn zeIH=S*A>7iUsE=Tg_8!{TkDBM9|RVg#G=mu7Mr=iDU*~RYWYDiNL+Jo>=s^0gFvy(a!=7PEl#ABB#;8!l^d&#G+r!us19I{lFGcehu}zlpSKxZv@Voru0t&%lJSnoTq?gd>|J6eqb3Nh(&({ zSjzJRu#68c0jJ!m;vyFQtH8aro>=r}fn_`)7X1Zav40U*(o8Iz_kktN#G>a%%Yi3V z8i++74=gtQz>?;!z$v#WKC$q*WTAd)l_i=N*>i~SsOb}O62!nqz;@lT%U_Y4lPa6UHl#G>cN@X}{# zA*k0QO94)qK@I-m5PlkP?-@A35sN+>SoFlA9|7zy#|e(N4t-`2Mc;e#QWV%@tD}Bj zV3!EaRQf*TtaY&1??=uorDwdtai>8zyuD7Dt@y-ZhnM!=T2Cx`4vX?!MlAXnz`;tK z;1=Q#o5aFd3@kQ@MbFz)u}LiYRA7GqxvhJ{CLHZSjCbXa2HBvHQuf#8Tm z&v%B>#)w6q1}rv%MMx1OALNA${lm)@{cm4~^mo~)zA>X?hKD%#5#x8J;bc13lxuY{ER>xJgNoQPOt zXU_T6cg?J^u>a-Vh_{{kU2qpY?zp>R;lPyTv$6C*#i2g(xF)#X);1wmarxCslkHGykrrQb7%WQ889j&91n!?XIrv zt$(O8qT9lqkw_Rhn-Ts->;BvI2Aw#i-Br!JyUI*_q?6uWJ?|T?1q!jN@VuHzCk3;x z*DywrI~GUpDQhc?rS~MN#dj`HgNYfRc;4xF+QUm!I?!Ne);N*4)~vj}eCFMbXM3v@ zw$nG**yhjUB8csHvau=8|ERHj3Dsz9WSWgl^@ym|`s~cvTPa7W?edU@>*oy|5`7zcKY^MRRj#(J4 z{dlDb;7Z~wB-PFWgy@k2hwI^M;4lHX?N{NVoJ;73w3i#^6&Zz}Jva^|shwh6lr02+ zb_s(cdZc#nK!{~b_TWJPgHqK6|35eUV5t{b)Kv#=HoY+eP&$Rb= zf6ICcB--=g5PSC`fN78Od+Wp){)#=mk1_2vWvIPUX^+Jt_L5xo_QGEGcI6xjSNrROhe5voq`hu9#9oFg zzd?kX+K#=xuKecV#{Y=UFQ<@*y+hD3ILz3t4*7aqWB!r!?FWfr@~Na7==8T<5XIhc z0Mj1l94@6oJF)iyc&5EqVecY%%x`ZTVvqYgnf7*~u|Flo@K@};36g2=ARcJmhd=FI zjzjFZ*ZG{DXj%KFcZg*j^6fFzu~?Jo`^S3~vy{mADy>|f2^lgT{r^FckioJ8- zF-*Spn*<=^3%Xv!UWLnE89H|*BhXIlO?TNlmao>CW%{nc!MK>;cW{{L+m(#H&!7`0 z_Rc|JrZ1;Zts6>vS=x{GzU4|^Dh7)@=*5Y>g|751fIZ3YwIECS7U=qra8qFqT`uCt zqr1~pALn7OC-h7ons&tA0X_clodn$s*lSSGKC>)%6uRPl8$6E7;-tuTXnT^rkHJe7 z68;LW!Nu#@wS8Whi=l|&ioo8;mhz@Xe7@6RyA;9@Tc zgRME9ifOMN$Az~Cylw52OPWG^I9BIZ zc>6EG%SWV)caUuj>-K^-OJn|_ACJ>IztqtU;6=l56ic1p1o?I*j~ zaz)i)D2{;FYsD9Bch(_k8B;XaiZ2tzIrzN)k3piu#+ak&t8zi07`@F4Qu7X4#(c`W>4*S$c_8^uWhnge$!RIF12fxLAmsIgb<0_2tZCd-AnB7<6e^aS zVAUL0GvpRkcieT`>uIk&6!@IgvDlu~{_j#>Uy|BZNn<2_?pKcWg;iNH7hB4W?{&=xUF>!Y)=bYA-eIt)w{p@Vhlj4q&A#dp$*G9d4G$4!cBR zixVxB%gSC>#hE)j;lvcI#B>U)B1#!?)v|yu!Q-?nYL=BGauv_exz7{0YE*p1`-iNG zHFsin_XaD}n1;2R+DoBRUR(_qEeNGnvF1KcDc1d+9*L1Hxgk<_@%h`Zx*k@|-f*4u zX}8jlr$kalo|!JJY#S+QUvb5nA0a1Sl!~?BJcBuQy)crK%~*GbMtH`5VO{H1?pl$W zE2Xtp{@7*RUJa6~P)`XtZR_28d^cj{<(?J(*(lj5k!ucRXVpvY>F%tp}uzDU?_Iw9x$*(@`UUB9_Yj@m7R@VbuLrv;edj7t;+`1k0cirO~ZMTsb&m&A= zc~|Sx9=V|{Mtvvcr`PVWlJY}(O)ZXjOKaa<*lBdQJ}$mu#yM+ELAXPAYjex8(Q#;J ze@6T3ZpDtyz}nrp)-c?WbN$54E$`mDB`(~pgXiT{udO=ZYgrPm@6a>$<`P`@e`ZZB z864;NV{T|^ZBn76^Z!H)p5`SbNrg!*j7e6o<0@nuMyr-nQQN`OXVl;hOa8dDcGc+3 zEfw#7s8=ZC-9$Rp8Cy1a`R7=F3~P>^!kS~x;7-Z&D@n1kv9z}TH?f9XPplEw6Kllv z#2RwFu!dYOtRdG6YsmG&8gjj`hFlN$_ke$o^Z}3dNYD6b4|^rpRl8R1T$S0h%Vk*sf z>9H)UrTgV*EwTNNc`ESUFt&eLOgQnFC(yAhhNJE(>vSZBdB;61%lapIvBqJt#2QE_ z2$V(`Gg8tb_f5vo|T9`PkwTk1;d&c_(JXst>%rBLy_h((MW zp-!I66Haerig9-mNsSY`v%aC3j)0Mdv`~c~Y49glvD-M3#`eb;-|87_kJJf1jB|6) z<0PNVH)9L<-tWP^0G1R5>V{ff#;zI{nB33GJn?8L#>J;6LlY?G+P^=y62>km3U~VF z=RV(%x?fu1ZeCophP=EDTwn3-l&3wd#^`}n+gD~BO*`T#_7sJ?4Yj)aI<4C6{gLJ5 zA`o)!ICuq@boso2d;Z?JV#Z`o>9MNhZwnio-NX4GvI@9p5~Y-yI1`trlPi!UD`j$lU=KGQ5)Rm`olD|B(1#9g_($(tg6f>p5|4Waj zB>d?ookPV{$>E2F;=9esmM`v{uiJN8mrVO^&z3H}iZf4p<|darIcgn$FwkM;XQ9y} z4g@v~!`0_z%vKz2g&+Ec)v#*q>LK1=AdNq>cKcqjMjj5V>R~-_c?F)s!ruDN!VRI% zrZOdwbR5Tem!1|+b9Qm1FMM;zlRUcO%+HXffN!NI9QyS0n&cG+d~s{zX5u<@$THKR zTILqCrr2wme7t`^55pZU+sN7?yN#ULV>J{7>i_z-%q^+=bGVTIwd!fI7?km}yvK{MHXC4_cc|%O*38#NJeIej2 zi%m1GF}T0SwL0V2bVC=;>1I_WziE{1`Is$H*ZZpEi!shxq$GmYzoO_te22U$B(h?yzW9-Iw5Zj;ih`SB+i15&EDBnnHMo*n)?CmiV z>)Wo!iq&GH0>5_{qZsZc6RjhWk_p6>L24*ISwDWcgeWZXw1zR(y@ZxM(8+0QxM7t= z-Es3i&mIF+2{=~APOk7j!Ru3kZ%}zL`VyX>SO@I4zBr5x9SiWRDe;w$EiA5B(BH$+ zue|sG_{v_z`)G~O`HIW@T~_Vd5UBgd=Q|o|kb?I@^Ne)Gj`ms?W6GoJrSJ{D+^1YkF8$bl6>YFy@xkLq2-Rdb;Vc&WAorw>F^1?XLXD%BW`_ z@r*r*agcp|V*Qp9DM7Zv55}>-^GdPwmIo$R)NaFm0t1f;BmBTWI?qk6E;e$}IzF^L zsvH+2FG~J*40irNS$;6~c<8uM#&eU$M{$?l5*_+%@u%JRta2>*L^9im#OrCL6kT8L zHk8?b7S|l`cJu@`++aP_X?NX^^S7*bMrhTd?bZ?cV4PDkti8;JJ5vvXYB%!jjnW5ov(c&)=puTS0%N zy|%A}@w8Ur`D9wXvx2*)br3#7r1qpyvXmuE=BfdBpXA)B*mnt*lPV`gPHN^{Vpom0 zaomf-(~;p;x(l4Bi*{wf0RYHLd|W>cXM1))>otE*_G*1~V|7xUl1lksoKZXCHFk z-m`!C!R)4ijhPMhd&K@eYfWj$m!68AbpSiM)CD>wd8QdDz|JjRuO}l)6DoE_c#pil za6JRpL% zkvgu<=8bQ|I%{aciA|biwny`N%j;(t?>S15jyH{vft4MhJB?VQv~???-4ey+=t}0a zdM9S;rb8#KL~)#}x{^=gisFnmqMK;M=;)lhD;?u=`jew`+v6RclXvpMcss(}ZfWPq zowX-*6ZJIQGVx1m@}xZud~to7{c_^LfpwV;fkvNaVpKazjFeh9ZmiW9@)Vm-_2Gm% ztFfLf#H{(oP+~o`Qr@0cO3`<>Z9|2Moja8sbxyo^DlLlMC5*jF$|bsY;ay!rAmlUN z_`G`$?l|jwdC_kO*emc})x&3=u^4;JzJ*a4d|q+G4Rw}T?$iYm$Ksj987(z?f)7kb zTLIbG7sz=lk`!MW)yh1rTs_>mf5bJk&J2eu685;ll|E9I%lapHzwcYMG6V}i0 zOGh|l=1S$<)6&+*(?YAh60s7UEBkKJ>&s(I&fYb$n-j~PdwQAaE4s!neS<0^;7nNpUG)>jdGJ=f?4~6x zfwx_Zf8--jHJjivRifjt$1u zvej3@cbSnoXytX*cmrv_V^?pfm)0_V$1lv>`G1ag0S&g^dBZKeE_&pcasWG#)yd8` zyX-v)BJoD;kFc(keRs+JH1w4z*u5rW`SIn>)iSM={t^dj$jklj!hEbvo*rBa%N65&3RQ>{S-Z)&N;;@^8CoPn*{OIzwc@k^bk)m!*!H$sU0Dp6n zR5(2_`qz%SxGnlO80T%jyL7m(&d$cnx`7x2rChLgTI;fHN3jFfl9pxLN@JF^;Jt^} z*E1G6-Vv7a-BTzrj=TIw82;MlX(kJIoBPA?b>6=2sKf68&9>MFD6E{6BC zj;S{G%VP2sxh=il+gIXT8+g^^4w3fWWf(=I-eff3{Uyf(ydy&CrPa5s>3}cwpPuFw z`78N*4(S9Wl&Wp{DsKreswI1+g>aqe~*lOyphPq_Zqoy;^bJ0c8)k1b9?b-MD6CdsWkD%4{zn3j%*ny;pGFDhcRLV;(X}yp*VMG z#}`EZ#+QxXH^zJk zBMEyW<{GV2>Tn9KrPEw{5@pscxsh#E%F21xaqrFM?CrYC-raRsu*{0hYO- z)r@l(I2z>|IaXIP-cLSWgnI<0&d!UJ-m%;2@oT^~>&c?D(9#W_*0tVC=O8-wuJUMg zmlv*r^+m37^%V2YKX$thzel7uAHwxBx}44ea=ghg>aR7n+d;b}1Uh;>fmM8WbS^X}k~iG1wDVqQU0KXHJ_S!hT&AsQ zW(v{v!yW59(_QvF&E`8BPs?D~aJs!5qDQ(^pO+jqtn;DKF>^si;6l%`m-G%e^ zMvXIRE)7GOoPxwa{ZYht()jI4g)BFEChr}mxZY=p&i(eMCE-71lE;1Cq{fuRllGW! z>9Uu566qhM`|Y>5wYl+Y<7WwaE#0W%X&3XCPg_5P5t zIM(bkXiUP~g+{PXp|3gbZB?3_-}Ct^AM3<Q4LX*NhfBrRYk5o;ojF- z#~&Uaa{mHT)$Mxg_=a#?DMqP*MqLCNI)0wm@${y@rc~fNjIg%>U(0a6%%cWp z*>>c@wrpN8FrUV(saEFoQC|&0oA&2oiaB*o4U-qmVk>ViwB3)uUN(70q^wO{U!PbN zZGkUTEV>;{%+UjVX7)nfYLjrUBV+5XdXBE0N(SO;FKpgDU(#>V`Xpr=)9 ze|mriUwp@=a4c{S{Ye790mAp4HU|^-xXzA^X`q{R250sCWmk>q8L;+Kjd>2-Ct^P# zo_Fl;+U&6W?%@h+zm4f9ZqR?{23sZVyW;HJlI)UEgNF?&$sL}Pn_Dm}r>MB3C~uTC zw74L*WJuodf+2Z@d4;3$1{V*@9X4#}kix-33krq~%^hAmcvxO`@sL3Ug~h{)vWHqZ z|6P&>S;N{-(j~Rl(Erl?*GY2cz#2Mg$p6m2LDtY=gNGK68daQ~Gc<2V$*_W9gR+N= z%FY>_n=@qiprLuWc{$m|d4qF{hGpjsD##gLT#{Q1|{4md=Ehl_0>=oV!U9XfcpwJ0YClQCxAF&C*F z(EpyR6J=9d84mudzaC3{MaaKr-dTMAbp?BOcAxUcPyYIYgL6(Nta@j2_D?^pFZXr7 zee7QA_RSlfeQZKgzn`A?>EzAJ{&K6g=(dAX`>d{iHEsOwPyC?E&G?kr`hR)f$!j>k zYR7#iSK6b!XkxA3@qz%y@BBPgofYlxv%atW$JqYstQdSKS;7Fe!%qf~2Z(6-T;V&| z{=9A|r(}F)7m=gmOR)L8Rw$=rTxTM3G{2)OekJ2GNbQtt*P*TH=t^HFJN#ur$L!B& z`<-2K7ndAx$=z&w@;xE1iqZCZ*#3JX@hN$ZOKx__T#HS)9xi*mYL1cXg4LLe|Usw2an?EALS8~1~M~Cn4vajU42*1C} z{#CB@DVgh^DW~L3B3eprcF9F9`G8A)$tB0R>^o~LT;)pN)pq(GkAzq9PM5sLC97{O zsZ{*LNPJ4>+Q-T%d5%jSXvlZ#{?0ta;OlVK-}@3A_M^*R`8#V`Tx0!Q_x}&=@N?|& zyCUHg-%0;9E_+!v-|1gU=DnkGSuXyyHvf9@#y*G9=^JeOPm1^}*%^W ze_O;~$xe7BPci(X!wIrS&V!_9lFQ#&Gep^IcKLt6 zhYZ^(|2JIzTyNR*=UN-4yx--|wUkZ&1uprhOJ3uW*SX|}T=G8MCnUemy8LVSFl9TH zpO0PqL9YCA-CvX6-SF?DuiyU$CkCr1u>X!Q{D+;=-48&MV?fiRP;bm`Hsqg!Z@Mm=S)!5-{t0 zv%F5bMfgfy?~>0Na3++@hpuwDfnuh}tJy@&ZL zLER`6i5*zt+}HHLq5dR2dV+z!E$lAZfIB|GUG<*J`zmps~zZ$!kNk_Wit zGcNg@OFrR}pN(9fls)!c<&?a`<-gq}4|2)Q^;U)7fNobq?Z6D2PcZ%fISMcRwD=aQZKKjmL# z_(#{z&31mXBleY?=aPH6qL$xeAI`J#ARN_L*tl>C;5|KB zep-aDWT$+U?6hYkk1_bs@z1jDO^c*Y$X)mwLR;DTcth_NcI zY<<0C8}L}mttNf18HCLk>|V?3g;PGWtVGyrg*~Q`_UNB&#Q!et_qxFb#{l}zjk4ch z^J@(L3GfTR&oJzrF#MzQTWN=P%BRx$T<6DYhhJ;^_W@R}(pCN{KULzb^S8w%&vnU5 z4f!qP|8GbyZ)+w0&UmZr_lu-o$pc(+sv#%E!4MM9TQ1s*&aZkOFenngl2cvsJeOSN zl6SadCqK&G377u|h8&$9b$`sdQclTEc`JFNc;k0jwvT6BvNIkj|D!Jd@h-XEB|GD# z3h(4^u63Qh-(eZVU^Twz^v|=?Qy8(QWaoOKF8LvsyvQX#;*!t05N%=e1TP5Fb z@DC&^<7~4rSPho#{Zx!ZxX4wW>ixkO@z(DXoc^KTFSz{QbjfR6@;aC7v=3$PfXn~9 zOU{hsNAYiS$@;?kY+WvCum+hP(h)9u~GhO zT>fsp+kY)hM_ep+&x}sbI_p+W&VWOfaICW`P&c^z+Xv;lAjcc>y^z@?$)SG=1hzen z$&{n*hh6dp>jKJ#j_o%Yt7j&`9$hJpWVDKp^!1YWu*qmO_i34ZFc~vRR_OHd9z7Xf z-E7nC2cn&h678RC`**U&F`;k+aU^5a*Bx4>j_D3-nb+`Stgih>m;Zb%m)QOR>v|>} zj`s}7_`MI)x+0GDzN6)Rwto-nYcBsYEKKdlzf=2{0w-gpP9iG;PRYHk-dd)Pd>Jbl zEE%gsFEPdk`u|OrN51WUrFFrTpMZXsrpmXk^|mg5&~5ua)8SS8>DIp^@7|PuolgG* z+kSs*iz`2~Xb3J1=}yM)Z@+c<|JIeBWr}W}nf_07{ZT>rhXio7w!N#ZLrS#I^zY7s z(2nviT=u)TtR>@UgfHf`7YV{?Ln2_Z(R9ZrTMCV zTxY$m)5CkPWW2u|yLo2>qNd{FK0YnD&T^X&9Zw%*eG6*m87>yY-JV9U2yH)>hgzt#GlmQ(HU zU$>st`AM_+w_96ueX*G&TQe>0El4*7M>4K7*J}Bk9e$Q|#MM5oca`tIT-(fOEJO>p#qN4_SSl0(bF$QKNAy+-sWq)$!GF}Pb_>E zYj4db7CqCAYl1zg8fh8B^C~^I}$Ik=nH}S==2bap3Onh zKrDJDQPMyxdgjHi$B3@LLEWDJTRXgr`*H6;$2=ujzpoRcA8mk$Dt7vDl;?(G!cF`4T;`=-K~7 zPb~UN+2Qq6_{75Jy|(CyMbGg;^u(fPzZE^P=;u-YvdS;9=$ZGxOaFN}q>``8jacji z4Lz~wFO_~!tRO25j?F8eU&<3pShf?<6N`R;p(hqSpcQ0c!?Az)xj6-#T^HJZo4U|? zvrg^0(E2uYq4jO*LhIYqh1Q#OQI0f8zKA9Lte2pE*s3vbEpXr!RY%0aUjyvth8b`h zaRj&lwZ_7Eiu%`;o>=tc1-Ur}oL&B}Db9aV{%Hs!=_eMO0}VZ~=<^LdvFO>y1KbP* z&g}2@IMdfwW3IHrA(pVLuOK6bE5spoh=mhF{TXGSSoC&&&$i7k+f1-OPH=Xc(HyhQ zq`@!9$l>yE1T=?O?Av`xU#N*iZ|9d6Qn)txz1mi*{Ax~{{A$i1Py?DnEcTg(V5YL; zC+ED1i&!{4$q6bB^CBE#;m|}dOL4}Kqw`2C9F~dyTE$`5EG7ib?mHJ$yk_6I9)3YS z#KINg2+|X-6h}ap6|vZ#2pr7832qXOAYYinO~>KSwISXXBkVgWE@BD0j(R<5hFJ8E z082Wz0*jrU%2bSwRjT=-`Nj zvj$k~JOnIxAr?+Euzxg8a651W{-Nv;3+EZ?b$cKdeGIUFEKYDKID#Bt;I6>o*Ek3q zcu(0RmayH)DZ>fQ4y$nngtOz-_`ykAq8sw{1j8s;TQc}3D- zKR0Q;`P|eMJpav#%v+q`6ovayKUHC#gUk>d>n?Ds4Q(uWWYZ7)Ta`bt=vnl#&pVSC z_*8L-g+tRpHgLGjIQ%n+@Ovx{*~fejuv}Y-CG2zLRNw@65J%Q58(K&3NA8D-g@4M> z6N~<=p(hsoMMF<4`p*nKvFJJe_-8`_XOBNKY-sg_Uhaj6h0o`I*$>?wqkazsoH<7E zcPHWG0L$1&EOxFpI3)&$SUBT>{ohdOnL>{4o5aGIVd#lP&)+tLPb~TxLr*OFrG}nZ z^i9D2J5(Ch5Z|uwM&RHag&!dmgej*@KeCj9*D*Mv%vm4RoH{Xa~0+-c-CDC zpQE0GCER6b(1FjO&{*trhdwypR$GI}(PK5SaIQD>#G)T#=!r!?1=znp*(@hVKlc#} zhjY#(E@II?2<-o+3R_Q(ZYRXTSq&VlRvgZwmHHwU&Q@UmJ&N-<@j``n0tfF^_&MOL zMG7AwzE9y3&FSmGrXJLk!% zSDg2OvuYInkopx0e+C?EP&m;GeWSwtfU{OAJc#-xh0Cbd?QTW1F z+77XBV&V|59?!kN{)d&#L|~~?V&Pvwy?v*Fal_CL01onI0WOD}?>kt+@*TKvN(~ON za3%u#A5mdvkfZC7SU7XYX;z#?#2Xa8-@vuNS&u6HYG4`LiN($)^0z2XGx_>w(4Exl zuzRT2_KyL}m`N;lUIGqoRd&vj6Lzq0E*P8-$yug2#KPf^-;x*ZLG6D`aV`UvG;r@f z!F_}&8 zaMn&`a}N2szYq(*n*3dgbHBkM7EYbPS#5BLg|i7b>j%otPI7dgA{NeGVE=B#d5-+$ z3Lhq)H~4VG!aqUIkCpzEfvE{Tqx7ti_MS~L$l0qnK?CQJukY)KC9V=fPb~ULhMrjT zvkX14=y{8YWqWPM+or%i2McE@RKZ^;J#PhsLo6I#W`xsBj_%9E!g(B6IILzF^NEG? z9QC>`h(&({*#9g}aK~{7hgdkT8hT>UpEdNvqVG<npe)Cpf#l^s}m2U$?<8tHq|+b9UsJv>Yn2GY2@RIrD(! z-4U^Hc=;4NycHHZ#KNfq7CVjP==*kJ;qX>N>}(`QKO++hrx{r6Y$r$CAr{U~gTpQ% z=rj;NY)tf*XND(oZa$Lg3&*oZ!lE2!~iWtn1(*oZzP65Du|$Sl7YBIKkE9$YNo@ zZNVXBODud2i!x>si+&$)@OhlzXhJx|!m-O%b50u^V&R+x7CY}59Ae>oXmBiCZUZks zK?f`xzJCxq-3<=0aIP>o{m9Y%kytoEVE<8Np6^8^U&O*G1eUla7#w2ZOf@)_28UQU zoI~N)<+Iq}5DSOz5QNi6j($!d7S1|@vx%HvtMn5Khwl@_&Q5alb&yy%&lsEo-UQC#KnwR4jx1d!=Yi!nJ7VE~1}yoFV}I2Bg;+S3 z0Sl)mIXb_@!r@pdW0ZSb4Ze;@;Ouv~y3F10a{a$ooD$m6?^}q){&--q!|^uj4aJ{A zzD_f-@TUX&Sr~A$i2tB)6>!QK2Md2L^u4v7SoGDv(oTp)Uke;;Rd$vFr<`@LaO$D& zt@XsB=R0AsNi6#Hz+!VVIUFqEh=sG2oIk3#c95g*Pl$!H3s~xXA91VV?+2E6iG|NG zJnJ>ZdBflk3x`P&JC}hP{FCB$B|fL{rN+j7@b>>%aR%a#q=8uM7XoLoVZyOr3!VTh z&!oh{pAH<V{Tn>&bjjuN_^Bz#k2U^4umg8Pf z^DD{un<@ul;mk8Q3(3*HM-vN& zgCF7qSAs*r5(~$!(~rr}bGrViFvDhjqHrqyh<#!SI{-MS`Gw@@XBlGQ(2j&97JUYA z@ZUJW4a5=r)P{CD34W$Zu~jN;!0ewJ6^as#s;1$|1->!$qH zNi1n&`;oNWPmUgoh=sEW*dM3tG!uW06WrrC{2i2jFR;wDAeONEfrGJ%bA%k-Zi$6+ z!r;7WaEOI-#^9VcIK;wv-{7!1B`#v&u*f7mNx)fr_<&2sAAf?vY4{^~A(pV2z!El_ z9Gw?p;fydiMFxjhIAsRMzV>N5ZLWQ~+-8BF#Rn$1xx~6HT?RSWQR%xAGedCfcQP-C zSmMnE&f<*#-1Rv8ofR%3_A5LFIID}oskXQII&7S1$au~}(wh=pU9kNzNqeK1SgTulB+l^$Z@v)p8E zEwSj=QGZ79iABE&*xyI#cao#uDG>{2FL3a3#d(gLa}E~HVREie`eO!%SU4{koYMw} zSU6|Nxl-A=0Gy@c{eXP^n+vh<*~9~S9x1WtnG^{NwH55EY$lVh^GGawKRNvrrzbhO ztcZn^N=|>pNh8is*zQMfI#~GG20sVbf0g3!8YkBUV&U6uM%!mUm3kx=PAc{Ko}5_p zc01R4vz@d53ZGc`j7#*yqG$gVJ+bI{y%0UI=c)l{>!eL@$NB3+6Ih=}x16crPs3yMlrkPf1B z5J3^?U;#mz*ujQ~1%otEX<}EfBBFu?v7;h3#D7ncfg`WJ_ul{izV)xW);nvR_1&rUrB8>Ta0ONKK03NT#Y71e^DFH0awj+$~Re*8M zAdKyGfU#x+;PL7#O@uM08L%|ljxe^Pxges!;vwwT3a~KLxuq z+m0}{_W;K6K^WW7-iQ4}7~A^*V?PnbcC-&-KM}@ue!$pIv}EHsh%n|b-#@bFEcyMT zJUUk!9-yFob3ED@*%+UTrj|6@jxe^Pbiw^X7~A!cot?aNIcq%+VK^Sw; zo-56^llR|+V8?w&81r2KtD!fwP?o}z5F2{}9y$P@y z8U!d85J!?VPZ7o(RHrtL#X+^>rw?Py;RCxg+m0}{s{j@l z=v@3aO$cK;4now?>nvGR?)=Ad;(ogGiKo~WaR0Sa0}Fh=_0-0}4iIR~7;E;N_L@kAW<_XiNhI?Dm8S+O`MAJo~JXskt~ zS?!X?JqGdFoD{%VKLhcfvUCu}`gw@Y_F)&|u=|2A<{UsAYu35NfUyrJ5TAW-6JgA+ zL439k%zR^O{w3eooLfkzo28F1)Dn7X!vI zM;M=r##fEaLF0>KjxgqgA&vt}CjziKTOW-tjswD&pM>~q&IZI`#}i@9*#cO|nWc%w zUEPU=_W%}=WyJ?!%tvF5HA?}bHIoaT5yqV3fYF+X>lU?CqC#{qHJF+mt}mI7AuW^vpBtFtxHT7>W0 zBaHbdSJlu34wOhZFh2$`9&3a#KMAnfG8TUm;;`2WgfS-vaoFu{11yC8Q3#Y$I4~b! z%r6J5=Fj4^Ar8A=2xCqs;;=QDYYTh6j9goUma}vQkj|%JjCHucq_%=(=Yc2OU$lSW z{vwR|XrEFGga;@xh{NtL!kD9kIBeh0-Xs(N4^YtM6wW1tF&}MXn2(lJ%t07)&@zWP zi%A@WF$Z0*Vh(B&>mZCd5hPA5iGwiaq>wn7h{OJ@7GccUO5z+q9QHnfFyo+fQ6!19Ao zIBfqB#++|}v2Xl9#T zIpn`lG9hv1k#rEoI_U3}us`mI!|oTtn6r$;2}2xqTL@#$Y7!>}ao9QtV@?K%lY=@J9Na~NYz2+58xwyy>(l)~bp^$_`MI6xzT#_XOg!4`a-!0lWG}mc0*g*yDvT<_rKt2CTjr9-yFg3C9g#%tz}I){I0P zcE1qDoLCYExr;dnV@@WCvxCGz7<2Xk7Gn3eoWwyGb81PP3y3oT5)cZ)nA1YypmfI^ zgfRzgZ@8@wh=UdmY1Xu(uY)}x!d`ZA+xh%dsVB9Xkn4o zI6sFm<}lZRHkKV>Y-eh+`D9Jxry5EqC}wbAO@#5eXwAVKwB`tHXYoA|pZ#}X2xC6F zHdEWl;_N^icAg-NIedUAyICAjg!izpJi>)6jK-Q$#KO}M-pj%!2&2S@g5p5g&%&s` zlmjfh4B>+;9D#5#3&$aRh=n&HT*AUz5kAbq00~Md3v(fi-T*;i`h1Lq#~}N07Dl;5 zDPv(~U(f{tyHLK0$-+#X3KnMSRI)Hrr;3G{I@K(U&ZnSB%r2BOEL_UL*-3d! zspUMw*}zF?g!u$`Xhir#MQFee54weU1bGJs`mgqJ3yfMlvN9+*EYKt150&1*D?I~z z+&sL!N1ht!>Ej&{5blQbnLq95wkpg&!pF_iKgc62n!we8A^yKskX*x@VTmvw5AWY8 zknMjE@CyrGiGFZ0B%0hoaudutY(RdEBqKkDqp{q>%Pr6&=#O%KK0$6FVg8XTeEvxB zTIS=m;@>2#^!ytk)Yjirvm*aD1ZMpHras&!!Yu?w+TZJ6H}kJ~;j7%deIPPEZqbBN z)E|d~6`Ylx%m5M0Z2c2=sDo~h(tjd(tqg-E1N_7P$nXmbar5{7TS~Z3fUjGG&!08m zmqmlaB8b410jys)CA>W`LbHVVi>G7{hXh%(gj|Jl5#=44N~~ToC)3~2n1jh;VFhM3 z2SVq9z%%y5L^kB*NE`BUq%9mq0ogRXf&&A65Ex!Su-@=2^$+s@BLk8w#KS)f)c(w2 zO;siXiz8?MVnA8x2{L4oAGY}fLiI0I0mu-tG9vs>-lJ%QFN4wZ8YYDWdwWE9XlPiw z!O+1E*J|L#P{pW^E~mfCmJnNVtcu z4;m+LxA0XSe>@lE&1#>p;6G{mhqJ1Guj~;X?(Y}$OS6!K0Y1N)eEkCg*!$`)RMuAe zrN zR{U}rgwGAa_KOX*_ZM3*Z0{p@%q@R}4doQ#k@8?@inxUZ`H?GdaEF%-=Geoi`vVcz zf*SN5Hhs2TBOo9$5M6GB!5|Q@y#_`2{z49i3zZ>5NPtI#FI>JbhZ9w3FemdbK0)4l zL_p2&Q~37w;+$e zKXOOp#GfRAhDM2$JwuT}aV1}mxdjZnJ`{7-r5dXGLv&b^&^OFy_+;jbKhW{o|92eL z+W(6r^5;*dpgI%{$OE^)VDDf02MaRO_8V{TY3P(cRI{hl-zhMsz~3mK+3@>nlpP}n z9IcZ6;0|-4$N7(lIBaNZV{eVW^%`-J$nYA<)cbv6k8GWls|3;rAKFORMpA@OJ+s^X zQ9i#$+s_Nuh+uF3ph&l1??3v-O39&NLUODw1q6F|6H3F9ULFAf!Ct=`9CQv239!7_ z7p7z?vlnP90B?N4BHZ9oePs17*YP7O+3#x5X&|NXmy=-ufnSe@jV92OK>H@F%#U3{tp4Vje`6^b?BY|54<3^i|+kc z!GR0bqX3VrhyIsdFOZNPd@MJl_kQ%RdTCHM9u8cv-fQ5I^$2HzumBR$5T$1)=PjFyD7{b}(oY|urwe+K zV8;dPrH#~tmi#KPYAw$9|a_&Cjtl7(}(0G_qP{b zpnILTU_EW%p>t^LiZsx(1B~><;J|w8N9ZYlKn?pG^n~@2M(A~bo*J}`^d#WGdOjoc zIzYe*39$>-b049{=gRtiJJOSa1M6`?8|40?{}=Z=J@jW(9BtjfQF+ zK=*oa!TpT}9@)PhQhz4_8TS{=zvu-)g#v1TU9cWZ|6lYh+*qGEBmX9|>(F=g z6BgUJ-{_%x-emudyAuTZycX$AVb>wOKyZMphkp0r7T9sY{-Mu7$$G_}1YyF~n+jyy z-wP0bvffkBBkx^UuMv1;z1Lo>zcWMrsgv{yN9ajH+|96a@Qn3#jL=i@9@f(&=_QTG z7xX`*pesWK>#ZA+FK`(;v|eeG^e&9pkLp0reMoKCzs3>!Q3vSZ{6n8jpje>sa2?^F zJnRz|ztKa#MUKv)vFj{+hSxtmuwlKUBle?Z@cMWA(IK#t^>%=s66m1uFd*p_!FZC# zcQu^X27Sf_$8RU_$a;047X=+edeh;+{-uu4TL{km&cB2adeg#&{hLA3yFH@6-XO+@ z9A+2nU(1O8x`18;JD+C(7yHKz^NZZy0NAVsu^2pKJ#^7S?r%#tLA++`%_iyTLJY`y z%S8!d+mOhxo+j|fdbKMFVgPa+#g9(X`#M68OM?76o5Om2BlN1GhxfNRB)w%L^y)y5 zG`vIo^%|k~boKE1Y)aBYAK8)ndja(Nkbzxr*U`t9(#<$ zT7kvj8S90P(5sCl2zjuf_*s(l7LCvggU#s5Z}iaD(8>OFtQ(HsT#}yTi2O5x%{kyV zdLkq8k1u|B{@RfA(Eo&lrib1Klz`sv_DiV|>wydC;r((xN$)I(k@cED4}H#x3yxn6 zkjVXw0KJ(&Lh)Mw2Obafkv>^(99)e5ZvRDJog(WU2R(PT-XfA7`ly(!=K^{`$iObx zzi(h8>j@>m-^D;B^3NU)>>v6b0a@=7T->B#F?hy$_eSW&C9(1V={b`0&cX>~y@hhW zzdk_U!6Ex+ojlxMyw}4NB1}i<6@lLG#+NoiuN3s~_%0#&mpwwS7WCwi!|Vdp%!0m; zME0)<^w3AWsK0P2I26BQ;3T=f9dI$Hz>;7-V!aaJk@ezIhu3Gglo`_7F=D?Q1U+;f zE?CbB=03Sy4tdt^1&rjG0*~D8K4>=+NT?s4aG*LA=P4ufoaEuR8h#TOr4f3%kSv`b zg7m!Mzm3CiS+96AT>nA4NN+hw?<2g4Aoq8x5<%Sf zjow?}k@aG-Sl{iR1g|O>TzR=(x_g7yT)@LjNbr{Y7OxAPCf$Jd{BcunH6wErL2jTxk zZ-WZ!fA@izS+E{V*I)Fswhpfw5$rmoXE!2#PeIR)sl*RXHO6k_w0OC5EIoZbbYtK+g*5alx*R9TC3)l3py3aevz( zh~)mZfgTz!T(I74;F0?qQ8avCAP&e_Pk+RCSi_r`eOL^hv7Yvb@%RFIczhE`dKY1g zkbn5RUeGHh>7jN}X#yVEzqGx>^CJoBQ60*c+X5^-9l)q;)q?wUSOi|9w$PzEqTM~Z ztbGfrm<69QX+*n9`-bmd!ID1IuJ;JNsz2ztjnE4q>8&T}#j^W>~@h=*9 z$X6P>t{n7G98jKagag%~*9s%_+Ww#?J3_CHq?b<8+c`q76ZGVv9v9RuD)bRN0^S75 zGiz86nD-SrhsFh#C}xod998}Q%VTU$DSg%+-bNm9HF|P)k4$rTMF|v3>_2|!i@u73-er4xT1W?>cY_^)gJ!7k9i*RDSPm_!z%Eb%p5~Hu%TwB@DTq>PlSiy5H=UK_^lofjcZ8nU-%^g zToFDv1mF;)agp^@n6nJUM})hHIOLO^ynh3Z6QxUJlnIe+YBdx&N>?^FAwYi3ZDy5x z=|89+KG&iHTBPKfl3L?#;z<7GwFw8V1y4A$xjUs%d)P+l!Vyp*Ld}M)S_IiAFSvbB zk~G{;a_{jtb(vr#^jp#Y&e(XEp^^FHXv4@2DgMjRAvi?%;1GaAkl^^8f7v_)=YOEb z33{BM#|e6z!+MZ|!#VSB_7ifD3w~c4@&^t9I0T7b@&`xo{l7g+P*#Upgw6|{uV1Iy zppYDIMlt`z$KlBR`#y4jk0YX}D9;7o?#t%lmi$G1IFA3mIwz?AA*TOtGdz@;MJN`^ z%vj(YjyF+G{y_6IxnW{#$?cI4hoh|0gl6ein5C1-G57bgv{#TkPi#ia(&0Log)p;l zZqa|4UD@1qg1^o;G-LPwGDClvvGpZM!>cT1j|lhh{Ease;qDYvsYBLYX_Y$ie1rx1 zKQ44(o@Rw6_4G9Fdxqga_adw0RK~41|s8rBu5aywn$9Kk?C!6S}3e6$rW`7bTPUKT7 z&J#uXjPg`Mrje1_LY3gS>80;r{=dCZn_8G0w7 z|5SZu|G9BXM)`)hg{F$7MTA#p6(PP=B!z=RB)Ng&<<3LVNn>z3(bC1<7l@>o67fSL zVwHS?reLzggu{|fNr)TXndddDCXI7WSSZY$Y%(grx=v9vhfox2BH|lHCE7J9O2R9t zr$n~B3Xu)@DRM`F$ac^mL>x5<`Z7hC91ca?w!sEkzYBPDRx|PDLSL3*X{URJg?ntqkob79I13b`q63?>a>_C2mCxE-pOpPB3TQ zFCMQyJ=CufW~OmY8b!#^6BW-7GgzCLIR}o(B zl|%)M@hyU~hYEGniY9`}Q%9@FNmStGkTm7g;O1mh+7XN-JDO|;qq2!YWZ91Z0#gR72an3Jet%Hd?nsc6bc)fc5Octz=1o2V6j1U#nr(S*)< z)o~FuIn;92nVHNpsc>dZ4yQ^ohma+;l8Yj>iJHnqugRuXK0&RdG6-trDncRO<(wCd z7iJ8@;5@X;;O(R_4EhNMZ!ZnaBIqG^CC$k)YxB`9jFTq_MoI(aOfI#;fzZekz34^b zAq?{vdfn(u?m8OETn6`XnqeN*pqWDDX{L+X6r`WnO0Bp65nD!_fLxQHXyiFD&(w!A z@8B~}Rxr;5o4zkW<@Kd;I`|X0>HEzLw^DU`2#p-Zq&Oy{D_s%($)@#HFZVm>3XX%H zhax_lhhDa@8t|ZNm!hFjpEtC|{%)+#{bsC1>9%xE6>biQI7gz&IgUg{Zca`OQ%*_O zhCD_k4~3fKOEC0r5ohuk2BI*6qV$~^41)-Q$`wIF2#snJ)Ap2Lr1sOKHWBq+b-XZ| z5Lw6wh!#&TjiG;snLkWxGF6_#d!)N z^*kM+=S0C~rUjyuwfQl(OMUj;WV%-!H(H4*QkijuHuTD&jpH=1B|8!{Q%2<{NCoCrZriD@)xxf@U*g@IFrjrjfC^=BJWe61(vO{naIl6 znT{gJNa3L)XT7E#1Zxb2Jd+a%7^DLn|SGfbYWlO^`qI@Fe-VW z)#UWY+$akqucEQ5$fs7`#d!epiwaS!fINUzrQ#D&lSfTGN1z#7k(&r}4b9nZLT76Y z%u$%F22RkL6YY=*%-ISU=~M}NK{{G7P$p)j!;Z(y#DerJXj9}?GJSY{x?CO8>eZPC zv(uDg1CK~b^N+vGPoaN*em?un{2W7fq9?*i3Uibj)<$kl&2!xSxs1x&6h;!t>~hFJ zY7!TPVUUAz(cmfg`iVy6dP*ni8Qh-UsxB`D9(j4`PW9BJO3>tnsP!@94Kw9r zB{SZMipiWVrgAw9y@(My`2_c7q#^;UNivPWEkPdxD=`<0Y$~++nW+=U)IlpMvT`b( z%FD2Na3vb@q~Whtyy`p+SH&(ZodgxDE-k+pJBE6FPt%2?LQMc5>2m~!E~ zMdMP5S|h~(`pfbphf(pA=?SdNm3d6hyRql`;5jc^KcQ8~S=firdYQwhOk&16lQy*4 z}%-78@B@z&8aa=cAN7bru9pj@T$G(py;0Mf~( z>NgTF`*@y!#TP6Ln4de-r7~<;vm50*Qwy@A0@ex8s>r3La8nq16^PAqhl1=HdDaW` zcQN!IBLDPv!TNoNM&;Q>6KeIU;~|cMrxi?94f3dC{np>6>ED2d-Vh>tSeNejs#uk zHp)b}_Ju1B6rau^9gTd$-3+~V;Ax`0Ke2i%RlkSQkb}^Zqh;swCNXof^zpO!$f42t7hNfIAx}uuIY41avGxZ8NNl;8F zdy-A*V#eGe4%`$=Q^oORTwd-62um|Qni_HRf}(UiS2i~{7eCMNd!95t^1CQLTB5x- zp+y&o?4NMaObf0TZzKP>nErhq_Air9fpqoKPxCdI1n&*;dp9XF3AnlE2Y2|eMfNY2 zi9?p@p*#;2I+WY3+UDIUN#eBgAtsr6x$h%9L?=S8lHr{*Tto3u_N387MsagwODVx8 zV3(5TrQmm+R>|?E!>`h4`%Oa#5ngwWq9F#w^ncq=M&Bo!B4$Vp6d!%l`mUe zR9%nSn+5IcV@8kLG@DE5XSJzF9v6k4peSC*rznxd=hb^|$cqbv>NydfI?mx(pet{Y zJS9ptS28C(;R11B=&FvNON1wBKpFhQzG_j(_k$>1hNke>JN2rK%i!AxB0O=Nn8!y! zcen5>N|(@x^Ahd5_#irP*Dy^8jg9Hxa2qNVHHr{r_}p2hiV}rs+&B`C?f@IJDE zQ<;zW;h;F~HZe9sQT_sv5XZ{R1D7scxYm55=}tp?9g4G82wYb}j_PbIS#JQpn8R%b zbA#WT&dsgSrrIu&%TJ-l>vt&1)pN8bdAT2kdu0|7l{${$zHyd7tfi(BR@)%raHsml zP^{N;DNe}Z@Cw-oW1&hcB*k1sQcY4wayTAZlJkA-YfLgfclktF7vVc`I=TwN4GuT!IjyQQMReAkEnjhZj6kJsERkFgf7`^{ zoOkh_m2<9kKT@#%uK4+6nwP=pS*k8Brc)k>81+_l7K#7bDytvp(;<`>_!;K|evO}* zG!pM0`>%2P&*MWL4c6IMgOwk1-ET}bnt5$T|M5jvj`PU+)TV5Wv_Jid@jTnGq)o4R zabCmLHq+^aeS4^{)Z^E3uKGaR=k=_+_KUf(TGxkGi4~s~oHbZRtGIk^srCv->b0rj zy98sbUOms)zHa>BW8)|D7fkXRXt-4UF=>~?!6VFN=;IN;jYM0PS|LnYV`@xN#Gh~Azj>vzM zJ71Pzz`gN|!ll#_H-VR#F|u=3?~IR?y;kPVUsu(8QbfD`MU3b+mD93)U#4_y*>ZO4 zF4tf+-p1=Z*=I6F{iHBIeJ4NTd_$kg zlkLoxzv2I5XT|BCIQ+N8fjk%fuP~Y_vu#)0nqd0wy{_7GkVae1zy?`5N1S6^^( zRq|vcH-m<)Z|m;JoHJ>(hOnZPkePZOyhmnJs%_8Fl>3$zguTsI^EH|*ar&6VGL!9& zmL{LJ-jiOdR_?aJg{yAHwy5P(rb|L!MtM)mlB*0pb<}*v`l^d3XSD1e_1S`QW!;KA z&9jNADGR>+t01wK4p<|`p;RC}<27ZZok=6{aQ#1aR{Z{n!+%>G4Br0!x&ieAZs8DX z13F)pweFYI?W>IASbJRg=nKa>f%o(8@6=p+FRdhjrkip`ti_9-bWp`%N1&$W_VgbQ zBbJ-_3rY-pP$plGu;TL1d&}R)0a?-dGcrE^bN0YzzaM9`M50#Ut7e4DzRC&#pIE^| zD?^^X@Z0BKs4}4SsG!$|y2P|_zek|`{kfMOJD)yY_gU)6=R4moB^c}0tb4PYFZOfU z?#R$Xy_b?aUf<~HU@xjH*P&0W^3VH(KgHpH->y0E=ds7*4_^!;wn}^vUlRYp`JT!( z_4@Ud#2|V_$lz<7=$%ndqupLf<#HnD3CXOFm#xF7cz7Pgr2!`#x8nroGCm z+6^t}bp4i1OK+T=vB%?)`dIBjo&T=gbpm1_zQ&KGmNx@Bl<6~BLj;Mc60cRpDnsgqC4 z&nP<6u;&=}HGaOZnPbE@&1z0)TqA64`z|%huH3O(=8sRLzAG`iqp#bk+|wg;dd%RZb@!jle;@mNuX);v+4Yt2 zh6jp%nqFVl>n$TIwrHj@oio8$I6iCDL^Cr1l_^z`Mj|1kBSgz&nP7q)G@_+Ep* z&~Q@mV%In7wO(6aUZU$33yFW7mHyyz&N*wvQqxeK$LnXfZ`9ta6{YxDJkIO%D3u4# zYL-^o(zf~;@pb$snhIa4Yey;QZCti=InCTQFve|db@rNNt+wg6S{_GDnDH}XR7>Am z&l%wzlE>OP*Cn_6pvkRvF6lEtw+5kZ)lr) zX~|LxH!I7B9Vdk2C!{SoN9-BDX1@~gdDMp=3Q^Y&oqbvNTF1-5b=t$V{=}gj33;g} zAGEvj#osKGH5V#fC*_esmr_1tO?NS}5BV4IW95qwGhryqzji^_0eJlxX~%i>kNx*? z`zJoExcv9T0cHAs`dN7Xt|#u!txXMCrxot1^PaAVP`ys=J=6LoEp%@2o7juvGgSK@ z3G`SCp40ohq4D)YIl`|&R%f%&_fzT;AD<4kiP)P8g{T=VH1c@Q<@)xPLw8i=w8YR}Y$i7O9Ur(Iw2R6@cc{X=ic z8_Vm1D~|8yIV`!nV_V=FbB%EW3&wf+j&{CE%ieQxvD4jmmydOfE>!;BuD^5d-5E!w zm(SqdR$StLBJf_Tja5*doP@8=^k&Dk-COqPH<*4UJj>rXn{~L~+pKi_1$|#?8jKh3r9u|Imxb@y_GBloWCwb>)1`)=<{&o4_4IIRr~^4%~?;-}!} ztHlpm-M##_)J3W1Hbgq|x<8xHEbZGgYlF(Z zWRcAW^`xA}{`e`~dgoou>Xydxchh|h2lwyL)v}~LJU3k#zU(IPc&hI}uAAOxr|WiJ z1&-XNp}~Zk51;u~Pu0vozvf!g4K``~db_AQVkE|V=~`{cvCo8O^XL%G(B!$7zh*3N zm!2}GaP~Ec8#=CIZv-S5JR7i@*|(*9LvC_%-g|ys&4}1Fg(Wp9tL7IyTldc0Hty~% z?b3^buldLCUZHs=>u%*Vi?XB1TL-zXicZ<7hE_oy9boSgF-E3}E>!(iw zE;WlbOu9KI;4Z3fT)b88!hYkuTP+=;zPx+mBYn!d!rIQQRdWpW3abAWeOZI=XIr<% zgj;tVUraY`yEB7dCbe?;E3Gzk3yL@r9kH$ZR6|4gk^_GAS zsxQ!wns;;wN2F-~#xH$aRv6dVgz7yXqqcSX{s~7>{V|!jkCuE`P{|!pwzyePz@tZL zl;^R5`=)cc;_OlV%!I)sjnA&PDHVB2MD{NJW>od8w9Jn>~3m148-X_>s+6g5!&^R|4oaq)lV_PaWbkGxissu_x7OV%qJl$=y%_2<}fjd zyC!0=B_}*C8r4_YgsjyTlyM5wOEYg$ike;1do?Sb@vwsHTJvXA|6+%F&kbU;(Cwu$ z0%L-lIF80oyf&v#Y1XdV-ab@+N2npfYV(Hc>;3wsPMfMH@#*=PL*G`pobIH;m!_aR zH_B63)b-*_r$}v~_-o4eZN$aZjp6%EyZV;aqx$09JNI<7rnamy9>wjU8k-QFRK%U; z?empWJ(Gdz`JZbf+sDO33)YuLl^^>abhA+*IY>S*y5}dOZ_t)VFc>U0xy7yBO8$<#u(5r8KU2-7&e=;@lBpuQA?elr3pEUZ; z^Y$Q(7CGTjsK<|uXW}*}Gmr>T{p`nOlt%8wZ=Z5)-qyQsqS^O{QqA8*KWyyBW8xnvEhpZZ``mix;eH`m@g zc_&jsU_8;MQvYF5zn7&`hX<-JmZyAwf7;EoWgSnu@a38V2kFEg#6$U60f!57=-@AUpwKDe*xuBt(G zU5Rt^#@SBy-Z&Nbd`?@dyvgb-_wJqH+b%vg>mWX~*gqopKUpn5>kzLl|LUZ0y~@JF zPg-e8y3wYN`^Ry$_=vCPMdX5QNR{M-Ju z8y98i-5^?}cT3Oq=i3(6dq|iuC?MJ%BXBdZzvoNp=Yhb?GwWuro_bg0y3PmnoIv9r zN47n2Gd`8{W*~P;c%h#W#}h3(y$t>bew=p;^F3yK8S{ZU)5%^}ac_aExZ9fAQ`bD+ z&f8GG;EL^pu{P3+6lEFhs?&TICUxa5*`CNBKmSOn;7?lM0m!WHCk;+@ z-*x9q+VMz_mwsBRB1q`9!0S_YE?j>%J8^tk&*&*9t2;05J(^}Fx9VyvL#Se6%dNfQ zd~XXc6*JCGDadI3z+HdcHOpc*#qxf_BR9h?p3EaprtNFGc*C%V^IV|o8NHUHva5Gr zqRQR4T$(o7zPEZur}l$_6pydlb@J#=)4ncNt;!QPVO<}kcAl?5N~zLWTDRVEOa4KP z^yQ4{@gnO_ZmUW+-jQzFJ$Lqexe4YzOPv+2gt@)X9zR)5_uLY%5Br^5#59`w*3~#I zP6~EAazH<}<8zlEmrcoA$4JAQ^J0}H6%=>>l(qIgZ_hFNNgGGzsm9k@wB5nped7KW z`@Wg%$Q`rRZ>dSv#7|U2l7{==s8x zYxW*)R7-xgGm73HnN(`$(6f+nx%hP8hok!{)=Rfj1h2`&^xIlnzsl^kIe%+)tEKt| zN`ZThTio{T%a8NkYbbi_d?vS6v3sY(QRnXywq7sIic2jHa?;{E$d{ut;J16quB5(a zL9zA|t8JCO>^QH>MQQlH%IG06?d_BEJ6|8DNV`7g+m@vnFD}jbGQ%=}a{@Tln`CGKJcS`x(N=Cb?wncd&qtCXIuz4>4zBjiM4+4j9p0bqMZ0RaJ7}Hotp(^*M2q63sgw!XLf*xF+HvV@YmcDc38p3vNXJNn3f9R?4wn zmB9Jh@tQdnW}0mkUNJ9h?`^6Uy=UO{P>7?-?8vn>(-O?peGk5%DsK6jol|VVnE%46 zbOB$O=J@s_d%nhZMdcfA^J=S!9xtJ*y=L`d*R|@2dE@3vjq0ql-{AOmUQq07;hp{+ zjP^FZWtN}_eJLmh1S#4(|{_VR}dGz8b>B#iCNWBup3o(n(rxkS&MaWt{5+eU#${oA@pswFCB`O){q9Fi{A zIXK)G;Jf(g)~;^Pmhmwnw|UndS=6aBaZla3Y4H;k1#X;@S-{;QmvAWbVB_So%_Wu9 zmwikhRhvneeVR7=M49U)nY1YZUN7!iRMoz}Td=8tyCAT8X+q$$*xPG7zOAL)ukaFX zcADPToSeFqBqxx+d&L7!w&M}}ptH)2Gjuy2kDRy^X zNxMtziM;#9Mq%E2{3d^;OU!xFQ|$ZT%A8nnZchEV*DW^FGoNi8vtp+LSFKBmSG4AG zfejC*_|4|1%32pOAnLt`+PA`1#w0YgDs8r@^webTb0&+#jHV8@%7j1B@TC^s^q1Lr zqjPah#Zl=Tu456IE{?|yO&@4x%PZN*rhkjt8S3Y1xpmwH0paw{&Hm2oq66G2Ys=EQ z5@(J(^)^qnp-Gw^S}k$>?J3#ywrL**Wb7keJ=`*T$FwaxQZ0-Vss+k>-5%G+uN?T% zSfQ-6`Ph-?mX+Rf^8)7O9^oCV(3&syTwUrApU|1prTnv3{QTDWG(z-Vh-~PGMk4)C+Vq2 zENB^1HF|o@5v~IQDmGoSo=UsE=D$_dlz!Z3*|i3Hn=ygg<+F7%?;JIM5OsLYu2(5tl*?czI@8x=F-2LxF)=wQR$qPxfz%9YIT6=K+qiVzXqm3g=O{^^kU#jQMQQu8#H4d{Kdbzijd%?G!JSJP8h z?B;%~kUf8VaV6)jz?jP|{%OV2cNuJn9*CZv#n2le&eYC-_l9y!IOkebkQHm z&g{{uGN@JETH{Eul8f4%d|K-2xX}ydJ7~?FrL<4nnY;AWO=pdjF_cZ!<@@hxOtDT8 z=U&Od;CXvEW_NVf`}vAKTVs;Cerl}>eca$?Pdk0p-zRl;Q-hMDfEK^ISgVqSW5Kr~Zu|ph4%g-j7r%U}5V2YF#EYn%Cv>VoX^w`0-Gwk2jbYc0s!60IZE_;&r*mg{Q!H?Ogs_|TTVGrn`})LlDsi=VXZ zmrqU0cPsIBF87V?S?sHWhYnQ$d$zybVef!Dm_|nE4 zPVT@ZQ?%&gcU44QO4MF*@Urnlx~++gxAyw$Ne!;~`)5k_3hw`rvDjQK#)(6nRyMk( zow~{In&O;-q($aoCKHyZ9<9H(&o<3VGUmfd|8Sy7dv2!eqwz$WKX=)Bi{cQ^cd;An zZP&cpFmq5^(L&KHt70sd-AtwJ=eJFo)|mAD=Wa`1)y}|W8(c0oWiLuD9DB@5IxW|F zbPLadEyvO=i!PLRu8dqXDs4{crObV+W-pys4);J(ysu={ud0`DxZJpQNtt)V?vq&) z%Vgx{9cl!I7l8}sAiYLW<^Mj51FWl#w*mwB+r#$}1{kctoX|l78RTo}exxg}0 z{~6a*lje6WZ^cD;6HjVIIyVM>no60#!TIssTVItW;|Hc)?NJ)%Xq?;N)l{+^I-HXvWs5sBj?p3IGl790rp@LH&^~BsYq-9# zp!w5{2Cc=aPy07+%zts>!Nkh317dcgeG+B%U0t#B!<`;$i>D?2*^^gK9x%uozb5#( z*8b}vW-goBjzuWiI3(%JG7*)|Pwf3>e%I~C)@h&jhI{M(SW_?d(pBe%dCq$E1uwKp zc`o>HeG90T{_J77=i{&P5?sdg+36W0Y9A~aK zOPHT{?Q&I%+O{OF<40b7d!)Osk!~{2$EZU5kj!%*`Ff{CI$!DzoK~ys?RM0@q8vQ= ziJgq@O^Mo1N8fzE`dn`JVsRN=8Zn__xen2AYsUCdx}61^$5@G*B!){$-^!WdIc1-E z+0FjZ;fzP=&;_sr3w|zV~FL>%2{@A*^^LXv=tk(8F zP%Wlg+!?lScJ-GrQ&;LF7dS6ess`Xu_kzU>1iEEg`S$TJ%uMl7GEvc zaXk0Pz~k8GgLx}jbqf}Gjh5Q5%5~~tipsp?mfMzzHtzAwSz0rQW2+61dhm8tJieGa zhd#KyqIZ9J{?Q}r({|DSC%&7D?j!t9d_NcIXqKtJnylH=zICq2r28&zej>>#Q5q|C zb^IL#!=qL|S(M)Px}%-z$YI?Lqdq!Cw@vZlylgvuodeN-AZl8&-)LGQ>*Fh8!|fXi zO~j0v+t~tZk{2}c%sSv^XUP#CrSM{f;g;uNvcYaDyRs&yJ$a|1%}Ba5PG{EFQUxLS z%fc7U)CvAll4sdJX-e#|s5)=3n9%3FqSN`7v!SMGO2gA2CHZuo73XU{=b-W^ncn9_Mb}x0lCTqVwsrFq_gB0o%lpo{y{K}szyopqP6hG5VroGdq zh2Mgw&mvrM`sY^pRq0WiO++q72@6vnTfUqV%{QIW+7_-Bs_8%R+4DZL!}6DyH?u%z z)9C8Z@sleLsuroWw%6957TPN`A@jrjg(~0W`|3jKK5af&(7XTUs0YeDqSMb@c0acJ zj_9F_@{KQDitWkbKz?3a(ZLRRe39klmNEQ*25dk(@PF4Y0B@dRqxoD zL`gXwaiXu^uk>{3lg)En$_yGG2TiiPI@)_FAEUa|t(C8`wXZ|!#Rbc!-@5dT-UPwF zrPq%Yl)J*p>Db^g0Y4-x_u1e{6H?>&zqh84*o$Pb9x=>;HI6bK$dG$G&TC=e%)WYc}nn{10czyKEg9$sVWb zNVV=ac25V-*J>Ml`m+9Q$jResi3-Zw7FAEj zH@V(_Djpl}+!Vca@5i}Yd>XZntUNj2ChOMY6ARcnVWa5LvNmI>r?e$&_IwD6&0b*P+Nw#p-SOM2K%1LMPUCl~eXQ!bouy5rF0-8IRV*>UEJ zmGC?@{?Mh5>z{Qcz8N@tkH4CiFW4;RYSd3||HGk+a}LYPH)y;~b)0bIW|sA= z@3Dm&dHt{RrqnDlxIT^T521Xb`f=8ilhGILlK5tgzTsNDO4Hl4z&bTge8T-amHfo1 z=|79++uscBwm4ldYnd3`eu7gVC%%D1kXR~_ek@@R5>@|Wxqpa z_44&?b$1V5-ln6tha=0$c-?X_@8ug$ZE#F*I^=Nj`vco8?pNZKiuGq5X}`C?$PwrB z>%q;(M?chvjlOZ_U1?80$i=gVo!!>on;Wb2D_#^{zN> z%v=BAeb^E?1G^n*H#|$~+5R+0ZCLMABzT{4#X4WhS64Z4x!i>N7nh1i+gSeGzN2*e z-KTRu+!}u)>S}wB$LZSAaY*tH@Q@gEs zI9o^YA+4WYJ|nj|y|e33ubyl7t(rAgqz!di7HdS9i#FPAM&KHH^hx%cvLq3Ei`=zo}^vf%5x{qj~Wg_3YDM%bybeOZs_f6AOYdu5F`fUa`);Uc%7(dPXqQSH?GXi!mxwlcaLi8SA z+l^R78I}wo7TP_l_4xCvOX3w@s~ekkFIZx-Vm+syO48(`af_*Egr8J+kAHMCIm>U8 zLQTu*D|a8txDLur1|H3b~yS5c{b?lgZkNtD=#5lgK_b!Fs zK2)vNdC(~9Zt60w<94I^!YVJkRk_k*8znzBi!<{6GNo0kI~`8Aj=Onstg-XPM}8;I zv|f3py=b)=qn+)~m2~Hm(t>@*?rFBFb+&Q6EA6{mb9`^?#jAV^91cYKQ8!6=4LY>k z3oYqy6g5A0P&>>zuD{6fpsO%r%@@rsqc!OF22fG%`?_LH<|C~M3GX}$truPDE{LSm zqzl>|>vIZs7<>@Zf9-2ep>E@nQEnZ}XSJ;}Zs=Q3RaJji^XOWq)?3mxiZ@v@M0M^X zqHW^CoX_Sn8&6Ocxynh*Q9OMq^g~FE;QS7{-I+Vnl|vTkNDAwi@#Y&kc2e$anSbrk zq&Vdz!P_{w=eC-=vi+Gv3De4ySRfzqo$ljOuKw2d>eUkZl~cU8uJQ4Ey(s!Qt9atN z)l0U=3$0jh!oM!rZSBJtDHk7QkGrLwQ>@;%#N%~ChoGgtI^^VVY{BTC4tfh1YfAZY zLfc;#xY?XrqrEYGsTlWrqg|UNHuvtB>zQ-JazOB6^X4B^6J57FiFL+jK99Y{?$`Gz z(?$5wv&{RWziJ-hzkcU%>gv5xhwYE_jHaA(klMLR>S4l+mp4am@>y~IqhLa6K%0i* zhv_>lL$n_rTmANUdx#giUy<`vZGU9cy;>+36Y15q-t@J4^}N2f$=B<1UGiK@oJU`} ze`8t3;vDyT9A{VUuC~6Y-cffwUal!%>J@{Oj>q0%x7q%vX_Yz4@7$`gYRt|r@*SBq zWqbOb8|~OtbaGPBal5M;)R*^+kH;O~J8kzM{D-ZdlLHNR9!N9X7%W;b{q2O=W%IqX z**bxDcm2Gf=f`60At8ch=LL#WsoAz!i@Kqz5e)}^PJy#&NJuieea8F z;+kvT^O<4YT_~Lig}6T_KF>@3bj{<*j57B_28SATUj}gl6SF4U2(7ldv>!>ijk)3u zPto=GnAkqlWUU!FWZ3u6<%u1IhfBn$*kxz?4}{%@rzHfQxD9s5^=7){pE~{J>G5fW ztSe_X{in9>krB5xGpjx1dHoh0ALd}u%^&XJcd|L~SPpR-Ix%c0;iW%&^<+IK`F#eZ zXUmR)(Y%6SE2VI9<5}S&#e6bHZ*Uao+7fnMj_;2=$hpyluE&(DK-6p^eTX+%@>rC( zNRC2{%g+3ZMB*+(>+(`#nkd2aKSJk87bwjn1o8>=k}glhkvB~tIvAXl?7yHEkBcA>i*&W zd^IbU;m!$Xx7kmBZiU7kz8afs7J9*X^77zo{x+v-pI1+X&khZ+&=?;G4GeNfsV34C z{)zU7Ka$+4KNluG*!9vwJhH$kQ9dsF0T=6!h9-=-SDRG|k4d&JeyHA!_46J|cW=iz zl;yrE_(;Pg1-J=+dw3m|+d5yM z^Gs&U@7Zww?A_*-@jN2D$>5ebA>(kzKi=#Cl7Xa!_ESH~9A0(_+wdfOJ#_Fz{i}4e zKQ86whpBAHxTVjMvZ-I`4O0~ou^Ah8X zLoM$1zEqPAw9j#pt&{6i-?>`$z%a}}{`#_9)8oi^4JoCY4_0SL&n{-h7qmPXKb-ty z`GQc(pYcaGziM&r{!NeFsg6*+EcMDd)y0?axo@j_Gs@A90&Hpgc@yMGL;`LenOyBP zjd5&wK2{zEe8K5~LU<}Wg&%USd(VHoOD}ot)uafr8fYZ(6i*k+`wEhKeC)k#KNXU? z9$Tlej`^82m|f0(bbI;48>MOK6Yh-`t$*IqSjfu;XvizjCD8V7a<%dDe$^cLcfDZI z9cgM)ntFsbSd7a5PTGrOnY~AA zmtrW+l+AJTHU^v#M)yl3sCZz?@vEb-R>!f6VY;G=-o*8KA(dk)CS2oN!mmHn^`4(A zi<@rvYR~>6>&w!F`?0&X@2zsSm;H(=Egmj#{)p}uhg-$ns#r37?6wYQ&% zZC&T%&BwcJnMwALGZ&+JwV|x>2;qX-vt;e_yr&;Oe>2T|B`scv!CNqRxcY%=#>dit zJ5}1lE<&H*t9{%;_p5RzlZ2CVI>wELkDAGrinHgc6W+ttp9HP#$WivMZzY8VTiZ6nF_D3#w{AE%6oMsdJ-rp$i z0QDCW+CUEtweZ-o&h+}!eY`9#zb^dDBQ`Li4{`4=8 zO$bhZC0X{73BvozDPL+tEm?GIFt054$VRyJfav@=FZ+OQg18bUXp0Z%X0UCiJm|!$F;q}^o7MeVA7TuL zJYSYC#Pkgq4Yw0D4?8_M!y>no;^yA!c9m)|%c&dlA+WTIw}T_F(>wgtS5sO^!Y7Z1 z7_@R6eB6H6@w&P+c~AJSr)Yb5rH#!nc<<1fWkII3p+R+@8vj@Zq(@uhIbW9((i%Uh zex&%-NygP%az(2B{Wj9YUuv3n3V`72{SDsuFiNO}c>cAacsKYaoAzTyA$8P?rX_W$%b z*4_40H%?B4=!ziW_|K8&#VgaIDv8B;zu_+|>u>M9f359xR?JU30}<&_avKAlHz~h4 z)|ei%tX|n6_;7c3c?urirY}cr&r2rJ-)c`Q>!}*OG%-$%pMv?rxmPmE99B#vmjcUE zVac-lX6GC>{i#bd%KxT`Uh{O^U0&OAS)sjfl2z=!XFny6zul{Kt1}(Pt~6Z?}Ej|FvUMM7JaTx1)5fQWJ_Jxe~%- zjh1VJ(I$KE&+E=h&8WYW!Ezu$`OFLRjqOq>P|3cYTmGm)&57OR-yc+py-s@E%0Q^% zWvA6!uac&6#TikVu$%YvuJ5)pQU^6xBwBCBrzO>RI6q>eRc|@>*OAt5TJp=^-S*YA zMf)zM=1U)}#7ao(xbxN%;VDVy0sDyPjpSEF(DDSnSyX}Ym_+F|sFAL~d_`1qc z?4-Q@@dWcqsP8)ea#S<-Q~T6)aB$g2Si^AWDN0cc7Lj_cKsAc!$q@7Uvw zYu-~28+CN`Jk)shepMl~;#-AHtraVh{=P1!9eiJI7PK9@mSr#6#5A$HeB<;4&Cy?j zG+(L4znk4O`N|V7FHStyPxeXt=!YRhu!0ZX-n@}> zKV!GuoG4&(8X4#ozm%~ zwVlGA)W|OL>4$IpZu{iYmdGX*cPy|_wmjk8rz4mM@=N^G3GQRsPCgy@o|KOFEcnmR0JkN%v>{2Z zv1`{(XwS*_yX|+09V}lxPFN;%%{=z0}Wa zKppyJm88iimLtm}%E05?kKa}|w!-B#N{bKwHtZrA>0_*Ee{Y^W7<)*h(j;vi|Auzq zwqtO+^o>tXm!Hjf=V#IgHbn8Qv;@%nWF%{V9mOsc<^LjhU8)aBv!40t{IYet;m@ZN zH!mljO(@Veq^t3mv-*~HRL}dvqh+r8%XQgl&mi7M6TZ2hScJ4gJ_a2TEpxE$yvLf) z*-LG9$>f#9=hUXGOhJAA;z%p|EXKprmokH;-;Ul0AG+Ro$k^kQ9xaFSVN&NV)~&ZX z9O`n0J>0)HxK#{Ps>n;K*Lp+q@d*Z5qdH0%uBd31y?>O`>TOYyyFy!NjpRTh2lEJNVA|16jfgt<4AqoNNHe!~dT?|4e6@f%WzG`K zp^nRc2M@6%pD;h{rNYlRZG@lZ^|&Z>F5zB`MMFq-ml2P0=F<5Oj;l=f*`hDReJXJf zh)YRMBfM;BdSJ87>ab*DMt{o%MuIO-v%-5V#B0v2*}E+zkN&W+GkJv{)s@AR*f1&* zc!g`ms{T}cY+WLEBe`whxAInZ2BW!rWB!<=>gksq&!`RsP6}W=TkdJ+vlDe6_kK|r zH_uj+R;)2|>2qlb;ecGC$kOeZiSEtceCu63pGCLj!`3N#e`vBC?jr9osk+H|i{Qd} zagHUC?uC9L2r_&^ljuX62Bt3?e~kg{bDG=I7#8cVuzI9`xecDIsp$QcB*ddTi72! zKHjlGLUl)uIp!o#@SmfPqM)Q|dRUtvYdm})oFFfK?M{--0O^FpMm!a{WuzCA)Lh!U z%vOKLSbW2p$^c>QH9m*W&)tj|_{c87VVP3q-pfM;aRL*qBa5}%?@~Sr2Im;sNzXq% zQ~R!dihAK{p4)7NM1AjJ%*M6rLBXo$XLYPqX-&&gMV{K|zSyC-j30k)qU3S_kKcLP z`)hDpqXG~4G=H;3W~9;jn@exitH&iGwldjFtUEu{E6cT}GXlq#hkLSzkQsQ`6B=4^|iX zI?IiS@tfvy56oj&eh9KUJYQd9NhZ}U(<)M7cV#u>uvq%ID1G{{rm(wSm$CJ1dzbAi zDOtnrodObysL`ory-%`zgru4lRV+0W7wOc8 z<^YK*8ihyeEq2m;pX1&6dEY5>tF}J*=U0uXdz!`{MG9HXe_tIMEVUpGT4|2%WR=;V zWcn@Ze*3WQR~HtOKL=NY*H3*nOf^z0IvT4Sc3i8S;k2&B#aH9Y&&}@RP18$rME@~N zjC0NPQx*RqqeLt`@b;p*QsltZ*l*c-E3P6&&?BR~o7zmWfAUfjAIsU3h_?^xuc|X! z^Bz&u-U>3;@2;nHFu##FTqfDMex<^VLVtwPAm#Mb$`|cIO}-ySnX9koSxZF*T#eJT zi+nw5RV>b|E=VqUYZpIOx3N@N)mS2{4wtd>33t~wFM1*LAakDlZlo?>O@(=iM#}Ms z?sF|&liL<-v(JWN<2u5ZpFDRnt=8H4WHft$G`4U%;|^wB@$T_W)72AYb5pCIG-lq0 z>-6Sw(hO3CEO6A3>r>DZ5ON*UdBd7De5x($!Lno$o+VY^btZlW8;AZ`^MYKj`iP4% ziK{GaEFZcGk0#JkxZAj1?kxFvQ3KCAm$pyWr}lL*Yh1@!E$N?bgZ=}eZTQLym@}ezA55G4&Peq+2URC;x zx{IV#>)!Y!pw?F2%GXHw#EjFeJm;%<7t3jt!P#lg#f!H~|DIDg zdFJh(sP7$X`U+G!O zv2qa?@m5hGNci;a@T|{vwil=5ZVO+t%@$%(6c=ZdYqPx#iw} zp);r0L-y=SqQQmc5;#5d+d z@N$AQp#6q=b`v>;ykK_!V9;-ggum9+9;uVI<@ht|m6lTmK?{YM3?#>A2@+3_)!#^@ zsgr!B>reaP-3#(ZC2{hz4PoWnIXu3!+beHuLN4B=CLGn+p(#=$<@bH@tY^gtzjncw z*XvrXCFzqgnf_nj3RB-z-6bPFW=TJFSC}m4ClTZCkhG%*R{5G2>CcGK=2dRBM5)c> zHhz3wKIUK}N#3^URGurt92a0nbWldogPPB``N~2m&A3hb7(47ksbB~h8J!t5B$`-kzqJ#c5;TC_e`dtUar1w|k;cavh4 z_Y!6!SEA!}RGR3Y^g#=H>1obm!8~wZi$*%{k~?L$n`y$q`DC6-;V&X7;%! z+RaL*&&L`RB;)+Ujy*ntCr~LYoMFmNQ4;>aMkJb@dhStot%u$`9s^sUTPCx3WV}mf zPFGar3%Bb&uZDsQ#8PWLC(2dQG!?aVnJgY$6&IU3>e~_^cKWAAR~pYtD{ebI_z|H(bS zk~DwRlU*!KkoGI}75iJ|MNNkou1IEX&R%0*6AZef_v&cwXwbB0LG}w>^QP&u&8%5N zv(M$~L{#t$DMkx#aq7@l1az?|ck76&51t8+VgH#V{H>{mp?XlQBKo(3Ty(?_0rofk zx_0H$=Epu=o)DBLlJCo6s3o|+zC5(4#Nw{##)8*HCLpZLpjS|1_nENn!26DEI%@;v z%O58+H6FftsB=59ZSuy%+2wDK)4Y}_&Oej3_<8L8u|v#4J;DZ&p$~mJAM56YU#fdk zSyFS$V)Nyy-p%&&1(qlEcD@lPUAlghIMyekqrG06c727;>BW$LWZ7Ns@7KfPK2Hmh zQRdkCO%{tzPhEebd;V*0oq&_)*M%+z_sGw8bnk56*C*S|Q`gd%JQBVM*Zfrvdn5lV zM8)UR(xG~JPg#iEs?XZzSY6Ku9+8J>FRzTat`1wbmGQSI!)6bHt5xnR_X=I4xkwdL zcTVQ;d`}Wi3Z>FudiCw;xzY;35B&$3tMw$*2P0D3*klIe%^7{qtqHs=DWav)xtgNr z_z*9SrB$hSy98J<6Q;7XWx)q#TT;CER9g6`D?wO-6QDmq!a z;`wUj;PFQxkV&lK=$GGdugMtrO|ORtf0oQSv?6R5$kDp#$>!AmJw;5V@z+LL^lz8H zPAv9!8%Cv{j#PJ+-@Ki$^OJ8=dUbQ7{RU4^RJ8U`;0Wc%c^zieeAf?tV#Tb@1HWk& z|5hB<%JWusSWonE6W@&G9+_+u3s25b#?xLoc~ZFB=@n;%iEt<6czQVh5!SR1)ZKvxB^HdNPtN>Yx$#Z>U2C@9lW3V9 zPG(h%ThPNCCKp>nqxzd}3^xu%ZP)6~>0F&9iZ?TVqe*#xB$@lX-?{Yf>4sNpZ@!YD zaJ4=`1kb6POur})`td~6?({k#X~AjUtDGW!W#m0)scp8ap59Y0U}m{#?;K3tb7{R% zdP65XeKonM-+eMia6=%eBi86ROkml=+W0gjKV&L;D*I8d^!-!uV%9;?DUbDH*yUvK z@0yn7@zko5q?4QYIKGwQw+-ul{*v92FE6Z!{doS$x66?#caNo#c-qYi`(FIONZ9f* z_b7>wzqE*;l44q$DSi9x(;Baop&g5i2ZLlyX)32m^s%~-+l6vP^0QuqN@Imn zFQ^P}%UPT`9x|_bV^Q@AHNIk|>@8&>zu&7*qV5nKCC20VmKHrvJgfYep2%tYy{{+3 z(Rq%T6lK4Zs2-XT;>N9y6lnr96$fQT1g7Px2`M64WDIo&sBCJgwId}j$~82IV6%F^sdUYQK# z>rWEXL^2{*LYGU`IW@<3Iv+4c_i`y*7_hnS?R7cHWv!0h%8!tqjY2}c0 zxh!R*tEa^vt6!kz&e3kKGTPxztKRdbk-lC`(9OkrGn-FCZecc4`df_DXis`$Zz$tp zT~oHo)AyW|q8~!c-?wJD{BF8g7^oxOFw}GFzI;wSABCatQe%nF)o+i*>ZlrK+WFU6 z-YZ=?=9emwG}(eu+A=%k;j18Tppb8toF}0^mV6?m#(9h^t4p=F6yRd5}j#y7_gN6;rjjX zALKW3YuS7pggjIlv}FIf-WIr&EWzmiNc%@5e0c_zI&3;<}Pf1zj7wG$qy;FADu~RC;23{0)5;Kc}8V zNpEO@U_jjI2Yuc<2h$k1jKxhkL=%__`PPH(Ron`nA>KUGWk?cJCKR6kTd(82F+oPr zOYf)E@ip;n@!v0Ks0jvI8h>@Exxw>&&SQ`;#hE8kD)%kv8ohO&|9XKZ`?=AQipUk( zarO9=@G1yWO|F$;EJBdbNUB@ruBRLEl58zc(MQXX4?>S|pGiJqrEwdTMYY zl?<}@tEnpZ!$hqAR8>Xfxy%kv{rr^5EO%5%8h#Vq|X4R$~)$R_8+^KPk_~hHd`t-cS zUoy+c=MTta8#b&$xwQCKKGJd+#D~YY7T-MMH>Omz9=0a3-IjLHOvkNf;`vm`&^sp+ z3iERY3fYod9uEWT?i4IxZ_`&)9Vcxob|}6~&h4207UGQldM*0k(PG<*QHSA7^6p4} z&)~kXv@D0ga^8h@V)A~cxnJ?-!#j%UuXrT638>0_?P5Dqi6V?<600E1f~O26ORk$* z9V9=550>7R!T%QR7T0juO=c$VJ6AAW4i5+ZRD*)Pw`TCO=-%AAhT@EENQTW$(XG+6 zo6V1Zc+%}cky;n);qs!kD`!34tR0pm^gAZ={K(mZBo9M1bo|7KPhZI!-|C5>^7t%A zD#cLcjY)Wx-xaMe$u?u@tb3;-8Xi12U-7}%i|fZ1E6+}rcN(6KXX9C}XdLVQelmyf zYH{k90Udr8(+Nvs3H9^_Q5QBJ{%U65Njz!s(&Bkb3$>*Rk>8iDS|6_bp7E#q{oyZ6 z=V`5)hEJHVDVrR7(YM&0f7NcVS)q0HaI`Y}eEc^ehroz|ojPj&f#(OhcrrIXvmM;< ztGT^k&M`+a{!4p=p<`7-y0fdyeA6XA`@-!+=3s9LB!Oi6~BJEl~jFT86WyWFq-_6FpqKPn=i3wY3d1*S}~8MKQ^v4%&}^h;2TVx z@6y7HhoAF(4tiBhsXCl`>&R1o|D2>)O-Bnc>Jq$`qoEmAZ%===O}1z*ep#-7Z8E-iK$1Bp$nW6vx_AcY6vhY<~ z+tAlEk3K+lB+ahZ$p<~u2g$LHK&N8(clcV*lCx*ptajPsv_Z4@+TV%nL8|SpBvaG*2-Dnn(43|F5bD~nHUZ_Vl zzslD{=OBs3O|IxLs+~p;Z%IbS#f925x@LTKi>;?g+3R9?J1QUJ(-?eLM7fRU?b>Lj zG8M?FY=|<_p|$gex1L09&>nQOxWd-P_wdZ2-^ty)i<(CSqOUx5eo1f9UP_N4US!Ys zW?w|3J9ycuKYM6%z39al&FzcL2N)Sr#va<)Vd{p=OkbR<8rGzhwy`i5{haB=)OXH) zgyFhgntN`(;rYX2`QQGClo*Ci(MsHEBz(z2f2f>}{oQiUPdoj$yryHS&4-S_=^xOi>dtM`!LG;h=nQDa@9%l5+Ejg58XO zXH4jX)9=%dZq*V08Wt?>6cE9vcoVDNlj+u7eRlXZeM6eOZxV}ot+k2TtC4r5%MEVP z4^oTQmvV0D5FY-X>Xn4wKa^OFIVzqIQeB_P)S+U2<*9!d`PeMi#CPG#4L@!Txu#`* zIx9NGd+pC-|&zVhsPusa4SN2|9Z@X>os=4gK-R#Y{egE&ZnYOmYKc*g*_guweav9vN z)MpxriZ`^q{u{6*8bVy5D)uet>MZm55(de^Og_801GQ4JZSrUHJ#HL7qIamgqrFO# z`I^Xi4XNr2p2wUz4}auXh<+{HQdlvcQN)i=M$H;w)P9mpQ$$s-?Yo}G(COpJCwX`; zITt$xNY6Uo38)+YVO%R0CR@$ZaqMwA+(-LC2WNRub$9; z?fVK(6@|Mul~6g=3lCP;_Ry~b2R@Emz&B5hG^-euZGC>{_eR_O=*BAxExmnGk%{S{;7sCjvA9QLv3*VpQwi1w zhuMVb4`0ntSPuv?pyo`PT{>q8q>+h`ICUB+|@M%*2I^lMDc;fDSOeleURB7E8FP3zg#<{cx z2MfnLQNLH(qI2m)^ryE3uhkTN*?Dq2@WC?`lC?UL0IgVxif5rI5IUu$@d7oRZQ{uY*7-vYo zogo$F!&WhE-uN;Gx)ddw451xrx?dmT9gGe&9aswXc)`!%cR;d8U;C)U($~-L6gyMP zb@fxr6tlLpB35oSPIL2>&a=kj=eCy;-|R6JFq@3I_)V<(#9Iz++o?ONgtr8qbyU6G z{GHQ^=X#Xtcgd1rE%s}>(hNjf2$dgiuf2QE9^Ep?G|Q7j(N_}{I9@RWB;PU(!FD0<=q@t%}^tE-gsV=>JMip>ASuO%NO~g z%SAs;tjG2k8JBkXTMjF~?X%1#KJln;uJ z?@OP$WgVn{@Pj5^QH(ODQ6(fGy3FZ3_C7VWMLAWT&0F!;pC?9%M8u&KorH4=D_n?xJqAe!p4b_3`?6*Y~dX@~7jRgKM*HxUU&VTywrqnD=#1 zb@Yh*Sa?VMftD6blNbq!Tig7&Qdy&-LXF_~po!T8RaW zR>;s?77dqoc2y?7-6SoM|Gbg%Hc{^5E^=-1DHf;c71ep~VZ|d!GoL8NTU`D+-+p0L zJJlc{_x9`vV;;$GtNztEBL`Zg3+|79);>L-@qDM7I!#+@`iPyHZ1-Dd**7QWPF{OV zY@q%|RfU?!OV1;)!!k)?V%AhN?8AVpV4~S$@vH;>dG`+m@EAGb%2jK0Zobl&L18YN68p9&&#qX@5PXZ!{|u zkKto~zUYIF>rJ183N*8kxV`vI?aj9({@di4$2{B7j8_U7-g<@8&O zN+N{H@6^NMS6;_<#U;2Fa?ZUY8Ebc;OuGD?IWHs9(q1vQCDN3(*+Vwwb&PILf8AYD zDTm(UA}h|+6y}aj@ghb^N77(9_FHcbJ!qXi`_cA6b-r3PGdW#?$|bvIHagw&DHeoH zbG*#=gV+CZJeM~7yuDidI+^V8qj0$y&7YJ9yUdhjIwHLnHyMg9ErwYpf74u?DEW0Z zQs2Q$ z+VM*9MW_bLd_JXRZ*pJ*)1i3wNN)Skk`m3wjgPr&>F=?~|4=h|4AEP^2#Z`Om zXqV^51i2U=8L!f@NI7?dqQ*mAl)K-L3qc8t$p7D9|KQ2q+h|pMy?h*eeO(;c?c8iU zoY*fq`1rbbda#R%2ptzX&d%rT=jY`sBP{IX;^*vdD`e;CF6{7c5n(sCi|&G6KAx@) zc78(GIoPpHg2<9qq9UT=B2uE#MKSTRNh5Z=@ zqKD>i`eO=}q06#k+hNE6I)MB+0BCnJFk}c_K>LRn`#E#8f5`ks&^C6y-H9FhfFWb( z#NM|;{BHpo6#jW;YB(3B5-9xBJI*U`Po{L6<#^ZHFN_$O!EZ zVtME@+8@NHpjl+a5Mt~%8le3_thm=7PIQ^w@exJGhZXxX48*k8PW4{~@E}KgWQELo z+dq%l9p6lJo&Ux=1Tg!)8$c^E4!iGyW=20?zoWLjTr{ z%zp;rMfU}<8f1p{1+n_x{?wrR@UOpK`}(JW_9q+L4-9k&BFD*x7_^Db%f7e&!cYTx zz91HXWYO&-J`O2k=i8mwu@4v$g~HHnBR;X$pVocb4??#ej-3w!kwa&2j{ixB4;`P~ zQx}FLpc!=gh$W$apTkEi1^Hs<+no?gLzU?E5zFjtp8{Ry?s!z;Y|jU}g0?AO*8xLr z&@wvyh}|JM9D6`7(EUf+J)vIga=ViP_5nj)5CM8T5PR=!-*(^jkl8! z_H7|Dob8)KP3ZR7vD<(l3#b<-50=os&wnHBR@jPwOo*+aBy`(|ZT9-p0rZDzpRI9@ zk1HgL_6Iqh_Ru@DKZqTmEu4HfLSg9mAni_26xtue&QLqLEyON+{juM-{W0|TAoY_L z!k`Ytt`~;%pjNa$$oOhOtT^YdHgpy3-|i}5NCzTCvyaSw7NWvAe!9>ZG%v{boP(~R z`|}99JO(1!>)*3|{oAcaZ}-_2?Vr!y{D=4E5879s)X{k<_WEPESI?sMwa1~`!!~0l z0tokdNVK=UVzkc?_WHKFeIaCK?0*p(01gG54)_`1Z-D85?TG+3035&1xcx`QZ}(Uu z6A1*P`->bOKVW}J_xA69f1(TV|Mm~D?Z4Gw&)?nghy|PpxEt^YVB-J!kF4*1`;S-& zXx9ZC0{AB2m;3w)J@%)ueZW90!2TaX_UFI)fH?fW{v!VO8CC434ff{$cMbmMRbYOJ z|F)0JuL}6zXI1|#Uk|j?py$xPc22-o0N)0@4EQf#?6279bO;y^^1c1@L(d@yd%fB{ z-fsV9M;!pT74Y5{d++@WS^j^=8!^Lw`-?aLa0Fn?fBi@1rvMxPI0En_;Qx&evOb~z z#sl%c8vJkn{ebpsfS&+<2^a&6Ck0^Zea1bXDfh;o?!WOxd=v07z#;pLyFO}&8Qs=y z8HXVw%t3VC-TNF2#0KO6dp*FJANwV8|BdDDg7nZVy06IkOn`QzKHH+(fFQ(tfbI7g zcm2ryD&v3c=>6+|`9O?~C^{kD`(V%BPndxHVc8qc-D@2(A?Ex?Y<<|xyXZdS_J?h+ zo%O$V#C-qt2eBH^ejD&Jzz6m%k9&RMfN;$T_y}Mwz}$d&AWunT;kJ;A4OV zAtN+j?AUI>P!i;i<_mE$B!%V+@jd7~nlHpDP&Aq^#HmoxZpX0`JN5xX_n{AHz7VHD z>$KPg?8J_Jz)(6QfaVKv2BePW3vnhCg60cx7IYuY7vgN_8k#S}IZ!s5FT}Y}6q+x@ zc~BvmFU0xK9W-Bv3!pMIUx*8#L^NNBi=annz7Q8fhG@PJmq5O|Pp}g^_5nkskOZ19 z#19|?G+&6zAbK=kh|3{yG+&4-AZIjRh%2E8G+&4xLJerX5LZFNXuc3Xf)1ehLR<~; zq4`2w1LQ#%un6GefJFhH04xU0gBg@kbO)e6z!E3-KuQ49yqfG3Ym%FT~>zHCn$Ae}q)gd?B8I>?yDv#ZHJnL0V|O5PybT z(R?AEg!IsSA)bP~(0n2O0vV(ELi`oFh~^9NG-Qe93-JsTg60eHEX0D=FT``uN%p<& zq5b;?{YCSIw9iA#X#GO`9hyM%g?ItlM)QSu5fa&bf}IdAK{{x@5HCYvXuc4yKv`(M z5dVPQqWMDn6Iw>|h4>eg&9{I3zo8cL{a%F%dG>n^>NvFD>rffjes4hCr2D-IJwk6b zk?n0kuSxc||AG9`^Al;`h7#EJxBrFC{7&r<&Kau(I z;6n8N3^6|Z9=(1dCVtcEjw#IOj?_>sUmIOBH!mcSW5QrG}z{0_p{ zPdDsM$o3Dxra0qA1}ou=A31D|Gkz2>0nYeQ!bfn%j|!f~Ie)2Pe4O#4fpPD*<$(Gi z5BL;d1;C1cm7oH&zNlgM5{78ucC@}Arh_BU{voD^^U?Z(m;oL}>kHz;@NcxfAZCR5 z(Bq4k306gqFJfjm5Iw$#S>Su<@kPuEccb+MF&jKffgBIS?C@)}z98m+7t#8Hm=k`7 z))&M_;9qEcLCgh@q4fnZH@u0~7sNd9BwAk(V_*G8k1t|AxDc%`h>yY@?ECx24@aW+ z2S~dBT!7XW#K&M~^!@;`ARK|-A0QTj8+L<-oe&Gd!)Sd$ECL@u>o?-#FdtgK5sSiR zX#GZf0uDs)4-kvNYkd3HFAmekDFSxC*T=h;`spw7wud3)kV~PZu`F8NYLI5YG7N!E!j`rw^OqjGqBeUrqz{ zK?SfX;4^^L0ILJmfELhtvs)&x|K16cqWwjD9_~Zy4PqnsJI?R>#xNUtypeVjSPnhj zh)rQH^mrpSgYTfn8?iauhSnRz7VrdGZxCC;ROsC=#_yW9)^ZULVT#eQnq}?5UgVr0w9xy&y&k=jVoV!o36Jjse5Un?eykVQ*Aa7bgKC}Vr06q&?7w|d2de9J>H+Jkkz>q)u6X*A{i*PNPH>CX% zJc#rAe*jE`<_&4be*XoUH^f1(F`75T!SF>iZ-_(S5;Sj!FT z1_e8@V;?XS3(KN;LmUU2qIp9c567T+L!1CVK=Xz;5y+bXkPkz^=K&i5HU?}0*c58U z$y*XUij%iwI1?vt_uwX+yrsZP==q2AKNUWNlehb@0#4r2U`w35rNePJdCPz+aq^Z4 zPvYb)3&y?$WN$*YmkrP2ydIDP6XN787hXiK_sINt@Ijos<-@;lUJodMsc`aE2ydeG z3R%7gX28i?G5i!KZzb^f?u^)p9s9t(-UMgkUOveG*|B2|L#?n7PTtyJEwbIC@$Yy%gT-+2)(-2T_m}M0d0?mmmchx}bJ!TYzeL(! zzzR5d>x3|9SU`N1C zfSm!m0Ct6>(Y)>M7WVZh*a*!V;&(73THg>4!%}G85RbqY(7Yjj4@aYUL;L}5Li2`r z6#jtb4e=O!2(533$6*1qz9IeyTcUYGJOPJLAmfYp6Ks$BdK7#O%^T7_3A>_sLp%jX zp?O361@=PohWIOd2hAJeY4{?VH^eh=BAPeEv#Dbd_~%K;289LMGRqdamEkEc%bJi(vHF8px0N#c$lZ? z^%XHb<_Avx2rv{l<41^5#u+~%j179eBFhtF)N#g-1mlD=eg`mTamJ4n1DMRZGVm3@S1++IIX2(22>kVQK%xkpXAm+r> zqxA;y5zITZ-XP|}w4n6{F*jxmtv85yFdb;ULClMpMC%P=K1?K9ZxA2F6tF{k6Jmah zGg@yD3t%G9dV}~FMjgF>KrD!HLhB7;A;r~`G4*J@K`erqN9zsZ;}{aO zo+B2;$fEZTh)-Zl(Rzbe3^RhBFNno4tLXWHSOW7AJzo$@V*a4#3t}nE7xa8VERFg1 z1{1_Gm~ZI$g7_qc7-xKCG3Ds_g0#zFUZLj;VtLFRwB8^-g(*YN7sLt}Pqf}3R>Z`h z^#-vLrWGfD%9xKh`8$oF#2G&oj4)bnkmXe|wrIUUdwv=n-vAr| zI1+Fa;Ap@%0p9|A8*mKZJAm&3js+YCI392U;6%VlfRh2=1Dpal74Ut)X@JuKX8_Iw zoCP==a1P*Hz6Ss8Q^xn9e|$$egU`>@Jqm5fV%;|0^9?*7jPfo ze!#B*zXALf@BrXJz(auF0UicC0{A`P4}eDjj{zPB{1Na3;7@=*1D*st1^5f#uYjik z&j6kUJO}t2;CaB`0WSbv1iS=z8So0=AAo-X{ss6q;8nnDfY$+U0Nw<=1^5r(ZNPs4 z?*N8?*K1(F7{GXd@c|P6CIn0bm>4h#-~)h30Urc>2rwC7a=;XTDFIUfrUpy{m=-V{ zV0yp|fDZ#^1k41O888cAR={k4*#UC^<^+5MFc)BMz&wC?0rLSq3YZ_T0N`VQ1px~I z76vQ=_&8uuz$XBU0Tu@=0ay~S6kuth zX8@}KRtKyBSQD@oU~RxUfX@Qf1$+*$9$;%{uunS;Uz!w0!0d@!M0oW6;7hrF|K7f4z`vLX`d=c;^ zzyW{*0S5sN1{?zTGTe2K;5&ft z0*(b72RI&Z0^mfzNr009-vgWiI2G`Hz-fTf0cQZt1e^sp8*mQbT)=sN^8ptCE(BZz zxEOE=;8MU30G9zS2V4QT67WO7Re&D>t_EBK_%YyGz;%G@0XG1C0=N-y6X0gREr6c_ zZUx*1_!;1Kz#V{}1AYOx6YxvGU4Xj*zXIF?xEF9A;C{fb0lxwK7VrSzLBKB;0mcVR0GJRk z5ny7#B!CY9CIx&D@FBotfXM+<0Hy>?1(+Hz`0vlOKsy~^dcX{T4+CZd%mkPjFbm-S zhrKreud=$@hR=vNM}t$a_6QLpO=5tcXssoZARuC1h*qs_2+4s&GMNFv*J@Cp&ZQ2O zS_f+5P--nI4sESPix#bOQK|K9QE97nD79#*b@=c5S$mzcpM9PUzW@JS|8;%W)vYJz z-fP`^?X}k)p8X8x;UFjfc_*K7@&`Nl5l()jlP`7hhdB9BPX16QU*_ZwbMm8|{1=>j zxs$JO@|8~ha3^2oZfc@?UiF$2j>fIr(Fq z{Fj~lL?>V4Tro&0G|{&XjQMq>7m;C6XzbvhQ?8}F~$+2kqZqaG~@ z(QE#{o&0T1eje;-V)^48ePv3uVn5^5mw&g4=*{i&pb+id9&Y5sDxVBoV%kHj@@c@sjhtBJ_2ir9Ylv0eK)#U^tNc{*&GQh% zDnEmKBPUk*Y~T{}{0XtjTY!ffIkC!HflJKu7{n@XC*R14Ro+d$dA^8P<$dHEIkCzI zfGf=NAQu3am}f_bm9q?ZxRDd9{4(;3@CS)l<;#JG8#%GcR{)ooXIF?-em(g{POS2k zz$NBcA!3ye0uMKGVwK+xTvCibNW?0?19-TR6RUhRaLF+IK_XW98sOnZPOS0=fJ@A? zO~fjHkbEO2R{2`s67#GNvC7v04>xjRl|KtyVVTZ= zMXd5oz{8E4Smkd3mzd}1h*kbJ@Ngq1R{0k455ylNVwG6gHbsWv2sQM z4>xjRl~)26|1A~piB&$4a{QAJOvEam0$e^K5XWX(9Af31ZgJ+2V_rf^tei6~P7gWn zNnOOsImhB$K#s9PtQ@|pO#Qi%9Ak%AIoDa78_D^H)J3eEJ1IBqC06-;z-s>?i$koO z$1Kj1=UcJ zo_r%GR(S*Y=2=H#m7hw!krS)@4Dz`tKq6N8Z1RnqSmm9-73NvXZr~F0Trjb6`hbTU zIkC#mA%CpYMXYkZ_inh66RVu>dn+*+VwGP)zR3`){0j1`#XhmhuO#2diB#)TCsz5(e@MQO6RVu>gVoq_UtCfnWr>wD z40yPa6RZ3{@{bcfvC1>#8#%GcOUa)kd}5XJoxsD5oLJ@Mz$LZ9CsuhC@Ngq1R(Un~ zb;2iB`2_NfoLJ?2?_miy=19aUpGdxu6RW(I{NsgBtnw-38#%GcX9Me+z;^_fOqH_4 z%9#s1+{lSl-cJ5B;S;O8n|vcDR`~+*PY^z_%FiL+$ca_X_ac`}7e2Ad`L4&|Moz5q zW#peId}5VfLcWm`tNaS`X9%BI&Q29VwJBazd`uKDu0rEBPUk*v*e#Fd}5VvAm7M|Rlbq@ zQ-n{f@>j?=a$=QlBL6GGCsz4p@{OEWk&)1>U) zz$IVJW99D)`EVmAR{25XpCNo=m5(6b$ca@xiu|t$pIGIi$v1LhmGfFg$=8KXtn#ts z8#%Gck08HM_{1tdntUTCR{62y&lWzh%8w)8$ca@xnfxZ<6RUh0`9@Bx@;Sg7XTGDl zq*=-mE2kBBxRDd9yp#ME;S;O82Y9%V6RZ3j;F7HHiB*0c@Ngq1R`~_w&lNtg%9oLE zv;;X%HIVp?-D!PEDo`9@OthX zXDG0qPZ2Ap$l~lz&U-L`M68^Q#VIAnoKF!eXDo0@xA;S>@*{wU8#%Gcj|J9q8Df=B z2G(}flVi@Ih?R4y#hFcxIgcY&POHV~wm8JfSxC-V;`4drnCpJT%2@`i>(yoCnDZuL z!ZZnZeX%DI!AcBzYhl@|g2p&!R--2flpDUQx1j@f5_&i{(_cG%1M7|QZ_+R2DvHCdz>hb~M z%)nR4;yhLk58=a&oLJ>cfOTvWt9-d7CssN8MPo&*@)F>p3-Jf37M~&-Lt-~8X1x_l zDUHRbE?O4A*cJGy_@>~8D8ESXdde>r{1N4s2p)pAS6nKX?@cedOz=d?FBjZRISnK6 z8cW5u1m8_L8-%nLSmQ~oZCOu_Y0Cz3zAb!WmKzt_fi56?_$a zNARC1zgBP=>s=wZ8o1)Sf^Ve!I>EP7{yo7%6OdmocyHi}8wB@Iexu-XDZfeZX3AFz z=6O)X_XW2kA-`F0AF#%RSlfFpIi_6~kz-;)teow}WKitS!B^2Of_Vt3xK;3dl;0+p zW1!-8!5>ooL%~76uM*tOnEXia0>w((BG2QK=F;Zwd^Fwakm?h?F- z^1B6(V0-ToTn=2ZMsO?T_X_TzoQ@;iN%{SPxlgWmK=22Y|5Pv+zKWj-o&sF-bHS$q zYs`r?o_xo9(V%eJ$uTh}R?Z$!7yUvw!|+wX;30AOEBa*sW5?pF_(K#zBG$6gfQ$bv za$=Qpo|YRsEx<)<@dv37AN7-1`4>?Bk=P+tIbf{h5&o5=ax#Y-IkC!j0WSWPaEVn; zNy(!k=UlV&w$=`#cIEmElvgA%MZVK+1nBcwfrt6cYIrF9k4m z9KMP+3a-bO`cJI(&!pVMkXYplfs1~JKS)dP(XzzKxsvivQ}`Q;5v!biQEq&=8Cd5g zv2s>foCkr6UdA6JcCFS$tbE2+{UlcT2f#(Y#~&odQ_B)7r-*XnC$Y-;Z+fVo8FI`T zLaZFxjlagfG1)7=F1QF^@x_AoC#F+K8GPb@A~Nr5`Lo~&_=^8U@D$=V1hX&VZwj7G z{8z!P#BT{^U&J|}kOuIHze6PdrcL}^!7K0;|C`|3iMI$|P5gJkYl+_zyq@?Uf;SRx z6}*Y~eZe#lXMmBm;S>L70AoWDpEw0bjA#5`f*H3s2RIV<67hcvor zMDVG^p9*dz#(zxR#BssQ$5}bjP~x2h7ZER})Vza`69_4TPkdLwRm8gqop= z2(BmIQ}AqJHV&zkcrU>ViT4&fKwK<%Iq@*TD~R_Id^_>Jf>#soCwMI}2O!dV;sXS4 zBrXxWiFml+EyM>3-bVa6!9iafBsl1c&kN4rE6zViL0=p!IOvNJf+vzQQgF~0rGkUL zI7D#J7rdE?6!eAu<95i$D@8t(_;A5R#EbC+ zR8Kr!@N8mkw2@kgj}*L+m<>W2z$bo`;N`?e3tmC|MZvcd^B;{tT21^V!E1?+6}+DK z%Yru&Ge}6A@QK$5-a>qw;BCZ{1P6UlD>&$jI>A9-OcosU#qolJzL+97=!>a>gT9z1 zIOvNL1P6UFU2xDBCkloOv3P^vp~NQ(E+Sq`t?7$XM4mxD{uRMh#H<8q0`X~rrx2em zxSsf{f@c$-A-I+JYl0UNe_ikZaiien#IpsjAZ`+TJMkRBtBIQhuO)5~yq-8Kcq8## z!JCNZ3Eo1?z#wfSZWBBdU-2^q2YoSLaL^aryd#y7(;+zMi%!8oUvvo$`hvkm3i{$K z!9ic}q!}sbi(bJ4_=@)lzKFPA@CxDuf>#osEqFEYLctFZFA}_-m?w@%&l3N);7!Em z3Vwt58-lkHpC_2-9r5!87ZKAbr2UB(3oawRKyVfDg@Pv%FA>apweh8bd0#cYOz>>t zZwltU(Ks85w2=5>!50x!g;KzxPZwZz{N{4DWu!5fLcE%*)M zD+O;MzDh9th+ijoDDn3M7ZER}*35)EeuLmD;u{4|AihcP6k>K7Qa$na1 zA-+@aHsYTM9*VCx2O3fl@m+#5#CHoWBfdxQ1mZP7=K7G&BcEycs=o2!Os#uEO-;~BZA)`{*~Zu z#OnmdI5r*?Ttxhs;QfhzEx3%Bl^|6SKQ4G8@e_il5dTK-sl-nTo=yCe;BMll1urCi zM({<%bR20p@pFP#5v`;I+gr2!59MMZp`1UlRNV@kYU0h<_)T^~GNm zJe2q~!9~Q2sWo%qb&+R~k8c)SMf@kh6NvvTcna}f1lJQY@JO@qiN7hhmH4lM7ZSfE zc!2nA!OMx?5xj!FliO>ZX%yRyu08j#Cr&?C*D)=Y~mupt;Bl?UP#Ofbw~sF z#ES(lCmtqv1@S(DZztYY@M_}y1g|CDU+{Y30|aj*E)l$mc(~v##0LuAM*KO!L0=ps zIOvPd3l91sBRJ@bg9QhDF+ySYTqU@O z*zSulBF|7hR&W*ZIKdN$s|8OX9xu3__z1zXiH{WAN<2aELgJ$Y4-g+McscPG1+O4J zM)2*#UlP2U_*lVfiN7p(J@G`r8;NTKZz4WU@D}1pg0~UZ3J&_BPH@l{lLZHTVIDva z`eKU6gT9z5IOvOMf`h&|L2%F)e6R~C=!+8t2YoR^Fm>@$1P>+tir^w*yDv@^d4}@S z1XmHCE_ed*R|QWYK0|Ol@z(^;CjPqMR^mp%3yEh79w2TKyqtKB;1$Hpf^R2o5xkl> zD|jvOT*2#!=Lz0O+$wkzahu>R#AgcLMm%3|&=>83gTCkx9P~w};Gi$M1P6W5EjZ|l zvjhiy!He-oL0|L=4*G%*uOS6}(Jz?!_%{R(B|cAZ5wYDD=Zic;`GDZ6fFpPU@dbjX z5ML;`o_LAi*~Ci)w-PTCypZ^tf(M8%61<%FV!NAL0?=WIOvP-2oCz0i@Br~Mf|nDsK}aizpA&pL@$-UL6aQB5TH+0Y*Au@Wcq8$Pf;SPr zBzOxkgM_q=_;-Sba%{XTxQO`of-}Ug2reW3AHfrd{~&lG@gD`(6K@iHD)Fm=TZvy2 z+)ezt-~r;zf-fTeli(G^e-^xw_%DK26SHHH9w2^G@Ot9E3VxROEy0_J-xmA^@jHUI z5x*-qhOhYF1Q!u=upsSE{CB}+#P12NBL0WqiNsq4Pa%F^@TtTf2%b&+Pr=>9+XOEp z{+Hm3h(8p(ocP~@R}z0D_;%ut1wTOiiQu)wp9+4KIEEX8NE?acg5Mxc2;M@R6g*_= zn4=Cjw0Y0YgNN?C%dWfabi(u#XPh)`T=n=PjvV{NW4?6kmyaHP;O7qde92*>zffLL zS(cqUueI&Wmc8~a9=6ZEMY9@CKIJQ?&OGC5UvHe<^wr}g)z(cuzGg8_MPA3L#-DIn z@fVyzyou9=w{U9k4o(C9hAsc!vAzEXw({>|+x|~%(f@_*_`k9B{utZrPjSduoVX}) zapIE1rHRWDmnW`Bd@Hd$@$JNwiK`Mk{8fT%Wihabx19#LC3? z6E`P*kQhwdlDIW-TjI{dPZFyWcO~vl+>=<7xHoZM;{L<~iJvBZmiT$%!Ne~T4<&w? zSetk_@kruViFJub6OSc+omiiEJn=;0H;E?`PbD@aUP!!{cqy?l@w>#!iQgw)N&HXZ z4~ah}HYHw7yq0)9u{rUl#Gey?NxYGGGx68NTZy+5?&eZ@ zKPCU1{7dqU0HL35Uu1&2-eK&Po>U*i{ zQ#Yh;Ox=`PnfiX}=F|^TgQ;6mx2A4O{Uo(Ibyw={)IF&+se4oRrS4BXkosxrXQ`j3 z9!&ir^-$`UskNzxQ;(#6m0Fj2H1$~O*QxcX$5T(Fev^7K^;GKV)QhQ?QX5mhOTC=> zed?9e|D^tq`eSNS>ebY1sn=7RQ-4bRIrW#+8>u%_e@(rWdOP(_>fO}eQd?4gPraA= zM`~;8{nW>)Pg0+z2GWbu7o;ytFG(*=FH3(jeNp=2^d;#_)0d?$PhXM#R(g5*+vzLQ zSEa8`Uz7e$`r7o0^mo(OrN5WHK7B*_#`I0;mFe%NZ%+RpJ(#{FeQWx*^zG>%rdOqZ zl)fYVA$4kNWYo>Yx=G9+v#`G@23Bj-je=%`n~i&(p%H-r$0#lGrcYSuk?rM zf2Ti6f1Lg#{b_n&$l@Uv47qSf_sB7olWVOH*G{WiQH&9e+g6n8tZ| z;hdhPw$ARZuJ-x@75U>PRQvb^s=)qOhfm>{qsID-j348u$R9s;Oqd^79)HCAkmshl zLLsUv6q?p8%tfQ1;dvD;o7Uxpd47S)ctW4^deOn*1jZFw<=SAn26 z+lS!>QnmvyXM)^z3MzZrdYcziHud%Ow9V=7%l3vSO)V{rO>@Gs-qyCceT_Z2jtZh1 z4BPIUEFVYd*Sv;o>7cwU&vrF|?O@2}*_27g_?3py<}*;HngYQKh!FRz?2Rb9m_oIxPye2ZL6&42rE~DeZYzu03zd^VYOY zw$^TvE7zVckei-&<=XSET-!L-R^;8SFSy8%k$Q>O}5rh=*+JRcV z4wbguE>Nh!G25@tqt^ODYP-Gyh4%dT?e@H_r8)J|mKO%a*0PlLyerq9x8-?j+9q3T zH_4T2&lku|&%1K%c~`D&9BV7`ZtXy=UWZECZWk!DC&onA7pb=U!c$KD45{tjC{Sp3 zgcSLPYs*4vyJZCm?U6!->5>A4_DO+4qfouw;c9E`5ZUs4gET_6)((&>*ZA1-yfqDv zt+k`$$~8CzauXX@uAy<|+KREZBJb7?)arGpwC#3*LVIFNbbXO(yDvQD)X$LG?u`P4 zc1K8&Z@9KBq_$gDpwJ#EROoQEn@m&MCxs<~OCb%7 zKSOG}HwqNm9U(=&;o7p0+HP5aLVKi8p~Ka7ou;%;3QL&bI(ECm)z;b}vgP>(X@qR8 z9Uxb(@v-H3YZ@L~Ye&bGYj6tWCN{2IL*vSGt*{k&w|1b;d2N>tx$P=)x)#| zeK97wocbA3+r3es(C!E+@{VZBLTbBZ1q$tvLWK@j+jW}KJ}E3=hU=K^4p&?ZY#ezmG>%+bG0tv$-mM*|wNpc-ZMO>)YH;lK z>+`6!zL46kuRxI-|IzhDs%cRD91~qGQq6LD<`ODLMXvj!4Qk5@%E?`bhQ+w~PFv~R~m*B7a#LG{y9 zE>g{Mx#?loM}>C3$Dp<>q_$gDpwJOesL&NM!UdT(u0o@5RO6}Jy~B~$+98TAr4h2V zc7R;D#>bZD$DxMD*4oi=riRi?E-}w#I1we5C+LhHk=i0#$qQEPo6wOwCqtk6L>oq_*8IP-uO)6|ueg zJZh~kq_*oTP-x#C5m{Z7mgdyU=u%NymeQWLOHr;pZ_5jN-qzYpa^>3d1#;8#u3UTG zm1`?-D`I;+;ZbW(gw(d%1q!VXw<5MzpGU3rh17O^1q$uk@sZU zyA|LwcWA;h4x6H!gNW2Li?mZp;4&bZj5ZL9U@zvZ;(dF z*4hDba;Zbd|eW(R8ZI#k+ryFif} zkJ0r-s_nkO-GJ@+8B*K5QJ~Q72q_BtBc!%lR-n)xDOBiiwOywv?UTY1xjP(DZPgf! zwIX4M$d>0DlbbUCN{2IL*vSGt*{k& zw|1b;d2N@bdpWmVg~l3J^|#j*A+_BXAw{8|A$1TZ^Qd8gA~#&49nqE*l+%_KD6~fk z6*^q)n&_MMNnwfH9ggkB$ckVnM3y`vLY6iZAV;2yk0sAr%Z10%(poM$jyx9}SFW*f z zGo)rYU91Wex$ciPs4Xifmm2_fxuB-tsr2ARM&3i?g5Kc>D{^BX!c-4e(yGX|YK&~H z9U@zvAJ7^=TWbf%m1}%#dET0a$JWxCM#q)w^eB*<>EX&XG_G7*fm;#zSmxc@fm*!| zmA2h3P^dxNir8L#9<|mNQrquMl%p1pe0-!Ffr*r31Vzf>Q=~j-U9^VH zi_`?|i_~DfiB(RY)-biIu?nCn6TEKVGyVDgkeGQpfza!R#baMMCSMefZZ~{RHTJaJX4tap zCXZ>BV{aSY)q6eUw8!ez-ryI*{_T%)<~4gXlk@K;@IwCKeZOm=r@furS51WMec7?M9`7;6PzdbpZrST|?CrJ(-dRoOP15#uIrd(`yO8^gy*#X+nvFttQ*qiLJcfVurT+7~mmc26^d#A!)5A>R}y#u(XMcRovd4L5+bc(KkBRV)BHP{u*gFG4+WWj^Zw}@Hx#~yjzVfaih=N2LOb26L z+q?k}kFOK8c`H1;;GIFRtM#t-@ZN+2w!QTp-twcvyiMQ@u%JoWj!VI_<5Gq9iC+dD z<1z|d>bUOCaN;t1|5z*oxhA!@yBinq4pb7pm3KAjpgY>$>pi^hfn)O?@bF%MVVk$X z!#mrF%NFnkSkNT(ug8hYgCFMOQUNY`j0;~mWY^nW5{qRZ*QECD!a%io%RRhmkZj&+ z4-eBV#Cz7mTja!Li-)(<(P4WM<*_8J-iktE?Ydj`LJ!rFN4J*s@~h+fX%D-@V@NCWq^y1b-dJe9PPwq!^emN zc$`Pl zKM#`4+wG8O|7JPyEA{Y-F(_<%$AC9Lfl1n?J-{QLXyk7vo?#r7=3 ziyap2-xr+tWjwrBo%l@zZ-9=Nr0saciC=1`eEd!ampsOAh!elHqoe&>Y z<5%s(FNRG<)NzaFleT|V9^OBk_|5k47QvWpZ@Gsz0AFq1S`Y8%PW-lbc&9q?%T%HQ z#6T0{!Zgc?-+@?2^!RZm^cp|@o6WX=nKAj8(~jDE!-?N)4{yA~Tj}BPmHBqPn>@Tn z;e*Y~jE(k>{|uPTo9*HK(23tl@S@^3=)|vV_k8?%Ok6mB|K+S3E63+!26Zle^NtMr zHwYfK(7B{>UV2cN_n?P21)D~@y&F8dx!8}|yth5P?;`#-FLgw;fA_;_n|Gjx_g9Qd zn^*1O4aNDD&71DweX%^uYw_?-!+ExC?_3Y>GOXJ+?`jWkRZ*CChlh9Np<&)S4{tTD z^Vs#i;^D10B+T3D;oXNpXxrNj<1A`i-8eGLEA{Xm+$GFA#={#tILvGC@E&oF`|Tdy z+@r$wmUwteGGX5J9^UbYmmQZi9$psbB{uI#53g)on77%(n_Lp+edOUS!a>Teci4pJ ze!F(RFt6OhdjiJ`+g`1Q$LmHm?+g!bIF8FUug}9fYVR=bG7s-0#KE>V2p+mJmvsH> zaMr(d9$uBR{%!W~W;p9#3gaxQ-o?)PSL)&2w12oAwI1H{&idEl;ceL`Y;TE&H_}=E z20gqQXZ>5};q^J|-)0Z*N@x8`;kXzTzjK`Ruhhd^;jDkP9^Qbn{aNlFi52y-uz6M$NLfx<&w^$ zN@x9R@$jZQ>)#R&Z%=3a8}#rhO2YoF^YCUn>)&P%?>uMyOC1y4-n*RjuhheP###Sr zJ-mdo{Q z;jP{)%v<8&9pLW&z{4RRm-M)GsN@XDP1-x3dRva|lJ@$eQo z>)&P%?^3bC|c)!|QPO2UDWkd+F!H_8L6A z8P5Dz;^DPB`-3$e-r>&t*zDn*=**8{Q={84;Oq}-J-i$D4Y#+?!+XxXe&FH#%{hK- z@bE@B^CLAax*Zdp`BClRm6e6t(c!P);EI4io|+2g|Xws?5wIoF%+@bK=c3ftT2;XUK*|Bh*h_AgNx zwztH?%Q)v-PkMN>z7V!I?BwWr&)Pf8JHx~Kn{#{{^ze2s3fp_z!+YO3zEz(R?O(Ao z-_G^${_Py!)_HgbIP-0{uSC}ycjjAzhxd7BzFqI(@jj5fFW&6oz2+R>%1@2<@0Rgl zdwm|>ublnggC5?pv0;0u)1vDgboPJKJ-nBkwU$;E2{|eN>7jWZ}PA( zuie92G&;;%Bul|5WM|!yTAN%GD*k32R*#Us>Aj+czBzg{omUj-hS@>wc-7AQ-EDSsza8kz-%=0nXlMQ&Xncn?1ZD zXZ=exN5^lQbN*ZE;qAL;I4-pw-Y3raZ;OX_ptJrh@$gd4`Zws|jd0e#bspX>Bf{<2 z?BSI;>tCuRI)2YO>mU9}%*griE+$PJ()#R&?@DL=8}#t_ zyEEIrbspa9&ic36!;3rXUn(0NmuhGIEA{YZI_qDphqu&O|5`k}A2{pZ5)bcQcm4D5 ze(SD(9^QA{_0PjwmqvQ7%cm4D5((d}_;Z1PYKM(H|cm4D5E_T;H5AQa2{qyi% zcGo`-Z<}*HA~i2Mew*C&&%^t~xgJsL;r;oL@H}eq@KWyj=i$9QGHh?q!`sDO|2(|+ z4i4Mf?BNx;>tAbh{O)(xKM(H(cm4D5R=De*hj*X5{&{$d-1X1HyVhO*JiI5|_0Pk5 zW4~~mQ*F`l8}6=u9^O&z`sd-byX&8acZs|Hd3gVJ`eV?;JHTE4JiJ$&{@Co{edzQ@ z>dff)Rk-V)hj)T=JgW8Z&U5;s#lySa>5nBI-ZM^r40?F)IQ_BC!{hJ!?Bn!i5ARra z{hJ>hzfp&V?Uj0XweI@o;g!4VpNBWixgNX3!yD_ae;!`_F5z~p^YA9P>z{{r%FwXA zRC{#%K9~^Zm3nx?-1X1Hdue>wUWT-0(e0Sytbes0-oS2Qdwm{WtGoVrc*~si zZ-a-|>8yXLv!dH^nX~>?dw7-3{;$Quo1O``_i7JsPiMce&cmy4_J3PFye-c9SK1TZ z-aVZCMuUe}Qx$H<5)ZG@S^w5}cvn`0?QQn(Ry*t8u-@o)yzZ=jwH{u4?{K|+9^PGL zVcwvJ_spJQ-Ubiv{!w9GsxP`7FYF%XReN~9C=K&kJiOoU8s=T?;r+_FKD5rmdv)iq zy{#VJGIxK_AKl);&xh?bczE-i{lO9sZ>h6CSmWVM85^#5vxhg=*&hsB5Z#XN9v-$= z>*3wMZae|94{sl5e)M^G=N}oiHwfOu-0m-b|Mv!G|F_x0o9*~ldQP;x^PK%(i-&jD z7{@;k@0tC>yv-h7!kNFN{~hgL#+kn@9^Nc>{(5+46+8ZUc!SRVuk_q#{~jp{+iUUg zRyq5>K@V@ev;W)d;jMP|f2H4u_U~zD|JUN--RJKAJiHCg{%^B~_n@=?D?KmTzn7i; zUyFx#{!!sL4|;evIQzfN9^ULD!uCqfkM{4p&xLs{9$wA3FmKSqYb*)#HhXwiI{UxU zfoT6$?-#b$;^DpS?EeNmy!bw0dz(GH>Mw+OrHiBeo9XQTT0FdGo#We}hxe{?eB12d zz33d@N-v1^Z>w{BYw_@2agJ|;9^Qw}@olq*_u2?2eiugj7jx!Yi-&iMb9@{0@P76A zaJ`#7yk+CVywWAn{tX@&=Cycu^PK(Ppoh2gfUv#I9^M1)@ndPUe=oYn4-ao=cYb(y zhdTSe%^u$A&i=1-S+su(o&8^nhd0}uA0FO$?)>oZ=8g)-x%8XS{w;Cmhlkf*8n!p+ z;a%d+4-c=$ogWuP`?uWL|Fw8{l%YC`Pc@D-#tz-zJUrGNbV zcUrzxHT@Dr@~!Q70QOLIw`$2dUNiVs-mhUVIsMZvhz6*xE{ewvL=5?w<@~zoljCu%k+%PltDki) zfr?se(UHo~FUZyPcK2j^d)ww_n%kQ?=VcaTdwSctIx}OdD#uig$&|JB^>z0iefZ(? z+WK1i=TtU#bsV16B8RuPFX*V~?&&%++uTWu+s6F}9&2+X)c(RN2(m*V8tqzc1SxtL*IR%T^vgJ+jIUhE zpetH(x%{|cfANFi6C~+7lfjo6X2CoA$2h&dSm86@Rt z^@%6eKmFMA>yB7*_mVp=zA9am8huIgru$+QIe)Jj(iAJ+xhZz*(h9% zed9lhue>T13;tH&@2Vwb^m}OD?++)QS^IMBw5dOvI(pjf@O#yg_{!7HTK3}28*Y96 ziD#dF`uQhceB$Nxe|YS*b(M&JEY-Z_(O7Y6B5d7#@#ss6cdJXJ>zD3Dl*(Kgwzd9DL8@KG_*<7pF}=;l2|_P0u2Z$)N2k zV`uI1T-~_zy@{FEjLhs3`>$P^i&n+TW7C$-$dA_A_{!pV{FRZFdyN=bzIepQ(cd01 zvh3iIBS(!HIr`$;op!r%XvV)XawL}c;&eLa=aikpbGj_9Ey$zzt7q0dRoA@sme_N3 zRq^|=%wDx@NbDYXdiOOolhf%9kB__~9b5j~$eYuN(NC4dpQ~FPy9zy^mf{cRZ7r>h z^5U@E938dv!py@XlckGCURYW)GI>~h(>Db9vjEp@ROQ)Bnn~RplmZqAQS7SAarOE?F{E=_$vosxlHSf>jkU#O2 zx`J^Psa$$hdSycENv)07V%#-R*%ix&UcXTG!-PGHgZHdioYHP>W|IJ&5 zSci2G;-10YoAQVk&ZlEHg3mpRB+2KG!B|366@2d$@NwzEq@5i7&ao@Z@o_yE3H(bo z;qto%0idl;}p~+(J#}i;m>jMw>$ZZocwpJeAxfJg8E10^pYQK+7ydP{%A*E;^_1K z37>lvNs_->v&P z3G^QZ68;f;f3Wi31b=_zxgS$|Pg;8R9~34@`F)-I1S@|Nn7DM1vlnj9KCx-WKQXwU zli%OTm&B%-n%SPcG5>fXrHOmcM$O=x`3=UGV}bX^zkKy(&NtDY>Eug|Ke$W}{!X#? z@XdtF-N^48`-#KO5w4pvmEu#hUjSq5wsKB-BsQZQ*EX4^mTto1ekm$P$_&cvsP9gf7dR}2qe z>^$NF1uwDWY`eCFSZ%H%$ME@8bP)a^(a#E8>tdpx+D2k6%kY&Sj6X>9vuH#BW9Jf& z6g+^hawEThavDau1fQY|k;K2^5W&~uOXmf#)^$7OQ-wpU^3}lV!y0nvAQG{19s<@m zMXd7mlr!*1#43LgSjP{s%KreYb-hLo1As)VoWBAqXDhIdb7JLuWO2Brs}ID=!R4vk z{32HQ{=nsqehRSqK&<*{-&_J$j|Jr19Qy!b@n6Dyx%vUrBbiB-;jcd>Yi$ca_X@uP7l z11>U(N@8{<694Tw9&<(vvU+{lSl&N0d7<(c-z zNBf#sITf*vY)5nVq8J_&F_!~_e{(kY=Ttl9WLx^$dmGI~sK(xG``kvJ1KHOM`7hK) zvfDb_`eJILqoq;u*^b_9U#zbX-uxzj4aziuS*Ss%6!+c};z- z*&f<$Zf)ubna=k0cW*%11T^n;4*U{KDb;O=yt>R(=cY+I|DMV-HL1M|L9*?wguQaeXb&)F?=E25-u1`~Rb%*8dv};J z6OHakG*YW06W-A*=sN?4d^KA~jv3cON1PuA3ym0`;ntsE}u6>$av02ErW8;9JKHzxmnGafE9u zc{={N<%=5sBMc8;L0X}}d~3ZNi}v^@FKYaAUfScI?O>umOlt3RV0-*;LVhAX)N}0X z_|NwAboJ!!MDF-r0*tC1|?E7N-EWRJJADUR@HA8E7AMt_#mSd^=)1RJy)zbHO z>bM;DywVeQYTk59Y?pK)Kfc$Hr$;WOLVXFN7@UHp-;ODZp3g*yWIyGq3`Y_0j> zW#cXxoLG~^9hGhO^sS05UTfVQdU(~cBQXr%CGO$eyfnVj&fS{3r}H_MUf4V^hK3{v>)VrsSn3l%zT7Y{VO>^3_u^j!lrj|@wCpO-h?xvomjx09Gy?O2A;2ue)uPf8k-rm)Wjdlhn z99=z&@|3ATVea}e&0U>+O>LdMFu0(py{!c%TUy%i6h>1gD(TJiWcg$T?z!Y@ugy01 zEb8v#6B=D}GjmYIe6Y^yZ^J_znWoI#{`Pi}=8M$y<5Z!uuMN(ynB2w5lwnJrsi~`} z&2)6NWP1{$9kXFLQQNZ-zVUmRRkS z6A{nI0Eud5wkc>HT!&8?3iClUo*64AHqB=sJ_FM++TA~=y{$Qec=jVC=AM;QAGT=| z!@NmN?alo-YcWw)S9=lrY+snlVAaf;fhT2x4mHDur#pD81mmf>tEUHD*uKa#t42nJ zu`EL)Y>~~$Ak=5~v|;d|{c~~GElin}?dxN3=ooshzr7!Qj}bF3+nMcY>O*1E?7B(y zo(|y%or_ZxwlO9&Hf2u#+_~8vc6(n}SEjcEgP2V5rLW6ka?s(-cso<3Ji{TD8!>b? zUnqEpMrT=Xe|L9R565}l6FhL!8Jdd01TlmYgDIs`EI+D^`gnSkxr$+pf69-^AZ=dj8%&5U`|JS+>Dv+>MT(8;}6XY84R zE@7o@o&DL^iM5}34GXAI(=#+00@h^jIu@wmduK2`d(fx3Ic<;B`Z}%!GrBSat>9o- zabR}g2`hf}ceccY!@oHFr8zTw*gXroW#to&-yPAiC8uzsPb92%x}8IMh!nYu}}h&Sg#Q1-Lc z&vota$VDwM;`Wbu4pC~*3CRfeHQ}hxBhy*5CqSC(Lym!dtFOztI@=dzI6k;S)=kPZ zVHW0w!eL^eKB@=Z9%m5$zjrvTaHYk9;qg)+xlKFyhTDO$Oi2st+S}W(ZD`Kq z7T&@j&6ql?LG(DBL`3Q2PTw$Pcw5?fxlzIv3cW)?ZhTk=mjCrqDT5R3?CS61o-5)2 zg$7QVHD)a0`WXhIVNN#NywD!c%sD$S*1YR&<^dyLS^aT!_K`oZWUpK5)c=7YGilcN z&)PZ?Pwv#!({eCyoZ6YW1Gm*UbXiN=JRHwCo}8U8!^?vIM;dY@3~@Zj+H4I|6a1Do zZa}bI&F~_xbr^sXEbAYGO`VJSxK?Jm`fz0&hfOS0JP>0<1_xa>Lu)6_j65>;urqf5 zd?MI#hf53=0QM@@d~8zr092HTV5iKYxH|p6DZj&cyF(9}vps!nbGfb0h8D%o>O~z- zZ-b^WY6x0>-;!%-G$-40C|9bvT{)hd)0o98C*9s=S7UifwnrMljgTDXbLBZuw5!mE zJS*$%&$b+n;f?d1pkH~`!_zg{vBkLVe1>&EX#a0c#H8e`E}ZuTgH860nU?-w|6(@a zX5-luEP+yj$0)M zXYo?m4v!N;3k^-vH67TaH=)rd)=biK2Gam;<7N9#0Z#h3Yvj2xU>5tt7RysC8lBkQ z%HF>vn8GdCpJeJznw*P=*3{h9-`*00JGT&FxM9lU5<{kU5iTIWP;(}@SY--h*FAH_ z@j>M{uUOF5g1G`Zr#O8JP8qX#ZgYDZ7r*>^Lci2&oZ92$iA9BmQ-2(W8R}pP;=G2s zrtmceUQ#gjCyDW#IkXZN7P6i6sW*#XQuJW2jxDlY3*lM>PUs*^K7W*wce!SI{S1zY zzOLr3_TKz{4$d^;(2?^t)6{|*`r3N4I?x)R>pDBUY3DN7ldb5*om6%XOgycA^~eJUPu|n|g2x z5NraZg3+0}oQS7bVN<+1fCGLXJ;zAILM6@2d5txw75yH}I1Jksv>iNz09S|ld${2U z&N(oNOgHo*{2Bbhif15!3OMgn-h*tX?4WtEAlrn?g1YFK=Ms8*+Z(ZT%xw$`H?l=# zhh=K&r$&2(X%Kdcb}du629+IF9<6A^1)gqK%b22COd8u*aApUwr)kK9E5Q+>%#$t zM>n}fAtT0n@+|5pO+77Vb05;w+>E`XxvZnt*Ye{cxS(UN)H^8HJHM^F8{_HlOnY`N z_vT%l<`R<;^@hVz@Hr=*r4E~93~Dk zMo;dX-^m49mMm-an zR2$fUAWXbAb#`#TJsTSlX$P-_;$a!i$zZW!6r>$3TG%?{(iIAap;^J@S-2{|lP)Zi`BQwXUl=!8tewFkk6m3auhJS@lkx`wbKK+o2dS5rFb%B%Q!2lg z>uc-a>e#PFs5PzU(^43OP&cv1#d?18Ay+{2)z6gumASCk-qkg~*Iaz%_QV{%^@wZv z5J(TNNyu*iZ$tUCu^> zvbqJ);aU+K3v|E)7meHHz>L8&x4#Dq9@bbHbo`aA9#MN+gAs}YP7BrpyK&eKHn;Y4 zVMC5%NA5hqL<1KNaqET=UW6yoWC8h1uH@U>)Ppk&7zox*V*+~{b0Gl=j^~QGye*cy zSZGbeNmFa1cEqrdcUE=+xgBn3||QIdiy%jAajgGF#CJ);2fq3Zro)taiGae?F{xTGL~@> z|7;$5VOuu8*6x_+tGX@dLs#L<3HQ)?Z7<60{c9)hB(bvK1d$st+-bvKjFaA@ao)s( zVt(Te9PCPir3B+6h{qR|mRALjAIjuv!l4!m5BhFWO^#{p)dEw^T?kiDm)X%UAjo5! zawBA})$=At;7`zMMCGK8Hn~y7)l>E|xMgTsf`W23XonI<4ICP{okF8=*&IU;cT}3& zIG|0{*wwXlU~Knx;UYK=B{($Vm*;KR*77zkPbg3`7ZwDG*X@H7>yD;H+@SR~&CMc~ zdRWB}>BX5mmbsuyGri5&f%UX?p#$|cQD?Rfm;bT2pht0h&o<$w-!1rsayKU`nt;Ws zt#^KKPQ*O}&&3wNsXqRE9A+?5n{cF)`vdhSOf_cmQOaP~6ZCJ;3$TZqKhg@b={CCx z?1XSTFu0Gz!acZ+f(}DVPwVQ>m<1uYb7XIbaAwk|!xvk#-0h@XhuOV3CyS#FLc}Li z*|?@)MCZ2&I2_~#bXk9AJJuzux6O%AroWpF7*w1;pA5z>2PLu$1dKYa!t|I#07RBTqc8j>~Q%R=dVi z>Sj)zd|Knoy8k+P>dd;@Oj%2IZc~4IA0keX* z8OwTbjU(jZr0G)|Yo<>>=_`$2sjE4maZ=sPhN+XMPO53B6YmM9o;0KJD^nY$oOE(S z2!hpw*2uuGZ`+7Fv>I zTVrl=U>ue65)zlCoV#+MG8aNjxF!eBk(kA-xoci09-qfj+MB7xlS?R#`@dRq_zJu! zUxS0FdF%(vQ21#RL-F61HH2E+6*BjmqfR`ue!W&Dt6*1ia7NJ*+)3toDf<$10nesz z8XMfhrD8$PTx@QzP|m>-Q!lC3)Xl=wo@%bA^8B(r+c~eVH5OI`Co^rq<5ZD)QIQp^ znK?ClXTX+fMG^L9%@_kuPQsoL0SxrP){ZxXf`eoyZ?Tz&fAA1Pe>0yRiv==V)TWAq zoR{oSJ{Z8cgKw}+Rcc*u@Ca<<1dyh27|k8(!1)e=eTHg3*D zEJx73z<}w&ZVKB@9I%6qj2$->Z|31sB{kTd2l3Kj#@z%i`0)Y|T?pEYIH^krB_53f zBX44dw*YdLVb#V_8c{;;Y2ZW7aTMd`DV~Irr&#ipplH;TVb{uuGM=ci>ydV1S1_-i zw)!M2r~ zZCt$Fu`|IQw>jI5cOBW`^bVOxIC4*)9yRwYjrMur{F^k%_e3Fs$jIwOwwO?B@;4%| zQd+mH%)&ZpN)7%WTZK`iwaO}i8I2t$##H9Q z%DZgt$C*bb%=!TDIs4|c&2z0wJj%3^FW?@E>{l_|*h9gQG+4%Y`_C@TV+n_;3~sX@ z#uKNUd9}fk&RAN#Y>w(Wt<37AZy&*qm1_zP4#8Dfr^Q@n^GsaY3ZAc%kYM+W*@_cB zxQ<~RqA4Rdr3mgJ1SF0pK1uJ85ojzZpS_HAI1RVIZsyFB__Xoyd^Rz6zfPsW4Fz;b z6V?lySIR)r+rahHYZ@k>G?O!-@Om-AZHBf*3lCZ6ZfNe|Cp}-+ALzx7pA@XFI_!e0 zafMSzSUX%mjWJx?@jtmU1-DUi16wb%n&FxszX%5pwpie~Pl(xtrUnQ9++fU<)tRYb zkJ`gRMZ7&^+hqWC0)%JT^b@%?Ve5l&%n=+6BAGQj(sX9X$*oILU=|){l)Gunb4SCH z{e5li!MUP2QRI~%y;=ZHZ%hjFZ+@c~v9GjvG8j0TVN)JJ@9l2lDuI!bzZL=Orce;V z!~LB^Q#cppbLzn|7+i*6+haUg!rn+unYdud9TO4z4aT^xju}_QXNtD72G5#O!>t#- zD#n-tV-RufrEpOQ&B3+g7}R6OA7OYz(ht$h@xfDKv`FM-o;>4(87F;ZMn)#*q?2mv zGG&KURiAoT?2z7A2Jb`qPx?;;{u6=!MBqOW_&*nc|BK&4TdhAVL^Sx@Pb&*aGIr!H z`p#X3D;ax;Ur6UB`5VApa=%LyX*%GSO9p?_x!+Fm-B)q^l09sHr+|NbjxYH>C*NS@ zFTxKTtMTJZR1aHtZzBAgW9hr_3q!t7q{PzmxABt1e*SmkJH@^aLq~$o-%YB$*OZQ5 zU()^-E3a+i>r2QV6Kc@Tu^RlSp1OmK{&f84ov$kyY4W}JL1#BGUyH)>m*JO)KL+MI zKA67+{%-67 zhW{+^u8^reTT%CT`51{5bfx59%y6`RVZQ zDCCbb`7HeVZ{!(smOl@8JwDpLYhmjj$d5AmpToZcP)6(fBmA3yy!!td{AonK)bQVi zKNnj0H1fA0pE3G_;NP#2A7S$R{pXv=YyI`W{LQ+?qYb_si~RA1e*yekiag&_LH}=s zf9sG}f1ZGUZy~Sa>nZrRGwM9X@Lz&Ib;yr0`7OZn@zM5?dkH?DGx`y*bsO?(?~Cy7 zQRFqA4e)O#*gVYeJK$dx@{>*e+wgAz@>5LyUikMA^4i`9;NP3b*BbpJz!i{9F!|r3 zt}OC3CchQ_+={%$dw1lYKwjfD3jS?Hev;vT8UAsOmYMvi@UId1X(oRz{QDvDhnf6J z`1d^W+TI_)))wUPPo)I${xSSJY}Z(9s>weF|9X(u`2G?8+=;x#XB+(4g1q{(7xLrq z&WVYp{Al>si@fqD!M}Tv*Lci>fB!;W+j}Ye``qsN_FMt~>X4WBOY9t50sp>=yz=jY zf9E65_atzFSI|1|ttk9>v6 z{{{ZMkG$IF!hB#+UVi}mn~MBlhW{n_*Mq$J*98AoAg}9d3;cTl`EtYWgn#k9^6Sqx z;a?N-vy6Tv{9A*(mj5aI`#bX5zt6*;YP_358?>&(}4|y$L2LB#FUhUVwzqgUs_@55{4#Vc* z1Y^G!{`DcR?Yj*AJ&yblM!y>VeTw`fljlC?I2@dhGx?X`-xB1fnEb2o=Sk#8nEZ$E z=UwEVN4;!sG4g8<&c~}9{-r?97=9girN|#|^8B|g<|D7;@oe~a1M;Jd{(A`=kC4~- z^-K7-75Orwe}w%xGM|4E{?#I{<^KeKI+54%pTM8*AwS-f-w*j`k*_lOD)`66X@<#9 zg?}@UKgs0hB;gl9jGbTSgjrG9NSEmqvr!JlGOrt$d~{5cAF<$n(O*~pg~ z{=vIoJwaaQ-xuKDPm$O4wif=qjl9HAaW^13RJCCpo-dSE47MTuh;&* z-`TTf<_u76d;kB>=dNVVeAn7*ul<-kduH~N`w*5`?p&v;47`+Y1MwRNzK7-B8u7am zyri!u;k5-%T+Mu{Lq!9Ud51$E{A9+M#8q<+~Bw}6@64RDp$%#dd$C&aXy(B)b z(vcS=V$sP0&amXfB5wzrhrA{6UJO_XAr>7zqxgP7V*L{M*n}n)oid2>T5EX)PU&qN zEILCW%CO|bA|DAXYZKKMySNAr|?5%Fo~jL@e^dz@{r-3Ekh(-Ptu*8#C09@7ZG2laW(Nejq8XX)_5uLBN{Iw{*lHji67N?74eTXUQ4`QV|p_l)0iToS>uhw z8#LZbOaW*s4&!kXn&rXRr13M9KcVsS#PkGu0f+IV3Dqv*EgJ73{)xsc57_j=q>qSs zLx5OZjBlGzeM&q+<8#C}X#6GdPc=qGtBh_MClFtvG1sd#SQ&uY5c4G-#P%Q~69AM- z+(ToogKT7J+>JP>aVBw3jai==d^mtgh)RR?8dnjA zHRd|DM!CjZ$JV%3<4MG28c!uI)p!PRiN>>t`SAgoOMH#S3yAqp0xcpQq;WOzM2+i+ zCuzKtc(TUJh^J`0k~pIAD&nacuO*(QG1sOvrfa;O_-2id5*KLv7BQZyq!Yw>8ox`7 z_XW}i#JL)OM0~l%XNYq&{*?GKjn5HhYpmjc@!TVEeMzIY#>vEdScBRS7i!FQK4X-| zX~b0;cOxFHaVGH?je8Q`s4>4ujjdOq z;wFuc5;to6I`LAC-y&Y3@d@Gvjo&4%*Z2eCI*mUfuGRPq@nVh75!Yz^CGiZ6@tUKI znHsY_!nj4_Wa3*jZbLjvW4^x_vo%g7o}+O$;@dRNB%Z5rPvYA(&LN(saUSt}je8R> z(6|rrLXG+TV%(weAmZ<7Ttd7^<6*?#*SL!KPL0{NXZ%3p3B-44Jc;;jjpq{Iqwxab zA8NdaxLRZW8pkwFAbvsPWa76pZbST{#(v^IXv`vOyreOUrt!AM-H3msaVGIQ8uujL zr7^1jr!Qvl*+Fn(=9^)B%tjXxqjtnnG*-)j6R@oO5NBc?IXmpF_gCe+Wn z{TiFkwO2K+Vm*97WAj<|zQ*RW>E{|Rpw2dp?;_r=vH1*Q;y~te=UI(cQD=w7=JVw_ zjW<&MyvAFJf1&X+#K$#$f%tbC?;(C&8V(>kWN%~JpvjCbD3@3HH=&!2;_N?hr^=Tv15cDukTv;}7V6bu+(t!ZBn z>Tg2_h5Fe-2Zf4lp@TwwZJ~ogeQcqFLPfUFL7_rh=%7%@7CNY~w8A@#kSBvp}w}zL7_gj&_SUhTj-!rp)GWwkSz?kpe-!yZNrcQ9oc|l ziM)eC{cWLxLj7!^gF?l&&_SWTw$MSLKDN+7p(0!8pirSLbfJ(f47s2!EbMK=kOLjr zfWCGzZ4~NnLkETW*+K_}ify5Tut~AlbWo^|Ep$+*$QC*%RA>ubC}aymE@%r2d)qMN zKu0zJn<-e8jg3P6ZRns-KU?UaP_Zp^P^hmhbWo^|Ep$+*$QC*%RA>ubC}aymE@%r2 zd)qMNKu0#9$WEq>Lj7&%pinrj0`VZRns-KU?UaP_Zp^P^hmhbWo^|Ep$+*$QC*%RA>ubC}aym zE@%s}3AUso zTj)l%Fcfk@iF{#iN9cm*?`~oyH8h~Ncyv&xzb$l72*Zl3{BcmI*cLh{)Yld|D1=c? zmUjnXjm=bPlNEjiO(sUUKoY(5h*sS;A~O? zeu)z`Yxbd7&^+Oj)uj9J>(%RTx$z`=%YbRK1P3W^upXDu5t#9zTN@no>$W!wd~X~= zVy_4Sx4juIdp^sJ_CCVlw)Y5l_7@0=J$^R0?QMiTKO7mqB+HHVhPKl73V}(@uyvIy zf;7#8pAS5X{SzTQ?hYc87#4}2DDH5d8G^h)fDD(Hg>DRY0uHym34NVCDdA-5@qD9& zOUQsujKKGpl@8hwd$dh^5_P<%*yH^mHr?o+f*+oRRzc5A;>IQ&T*tZMMm=PqO|~9@ zd#?nRKN8bR61{Q&$vev5f<2B!q5H=;m<~UVn-S1{p+tw* z2jQ?+tpK587i{d--UUhJ?(73@PkcM;t?W04zCQf;$fIM9j6ZzSA?$M8nA?c`k&{E? zBh{O*GqmzY)JC4$MEo0-uc81u7d!}y?^nYp>JEt=ezkQLq*E~_|F5$xG2A()LL2S+ZBo=>(3X8)p1Fz3}a!Q406bhtLq z`C1k2JW2&d1yseFeQVlc|*Qnavn^f(d9V&j$J{7dExQ1QPR zqiPRLSMjghp_-G*d{Yv(fBc-+=;Kjp`;kK7qFc(1 zqIVlr^tTTgMeluKMBhnO(W)P-!0$R5(Ie@`_VwhnB4mkUR4{3i+K_Zw1&(!5wfoMh$7_pj_8F6Fze@a{ zhUnSO?Y8f`13k#c)duus1&!0j2III9j601Tuy$at`?G38{3aDav)p6h!0NE7uc=t= zFRdy~3r`3K#x@v%qYa2zgNhzaGypQ&KtUSmVzUZmg{Qt+OtIT?*> z^tBpZT3ItZ&}q0Ts@<%L?rT=j`1-{9iq3U`)x%Zy)k9aWThd(jMSc7$Nh*F{f*PnCJgBs3Zty0qO7H&tfiu?rSg6VRSd5`ZkKgmcth(aI~(gmqp>Ud=qlAR zEztQH^<3iL)xs6eC8{LsKyv286|FY>KZ$FbLYZ3W64hIak}JDDF>zC`Y1z6tlmA=f_ezGa)%87Bh1#x8A= zznPC{Vq>S$ibbX!xu0Y2N#2jO6|2)~c4Nns4q1n4cYmg$$@K|=&p%NelPVsJ4-QtT zgX0U5)P%wPlF>VuoUEdMJFD(r9C+{*$)aSe+G->ibw z?<-!@F)A8Y?;8-#t<4G-4&Oa^6Q_(epRZ;!xYR#Imq@uyE7+HG;?z=~a&JtDb zQ$Amh`>e42$5htvZNtmTN8S+lEWUlwlFh2~>gbpoRJ6+>WBVVG+V6d;I#kbVUv%4j zD*EF?Mnlr>2WuZh-+t9_6+MnvO#Rf@o%G_0tUbm1?%dz~Kp)g0xVGg<%9r#QLOF}H zM*OHDe1H2p@4~`xb9i^f$iacJ^+-{@5q-U0MStfrq9f~3pW!?T_ubpLC*N*Rfp-#d zCpX|uK8yRTv#}w52lmFny@xl34Qe{>$1%7cQKOGeGJ=WwaIc*40mK~^BPOEw4+(jmK$D1*`$L}g^EU4SkSli3jDLy;gX?sI2qv+Wkst9$?_I|IZ z5AO?&uK8p1#@`wE{TyYbsj*AV%cbF>l+Q{clX8urO-0FHs0hYNZEryBm(} z&#LW-y^L+Ei=Nx03LY#C2RFZw8rYGl%rDu5V7>l)LpzAmf&NPYZ1pQ^3!slHYn z;qygSu0{w)>POlkly)smh)lWy9e1tNn1|x`rl{I*g33qCwy63PUqWPMu3?1Td*eJX zH10a)*7t8uJf3wl`^eD4!w-!-I0jEJ{Va>jeMMc4`k=6G<;xMgkrp>Tg?)oUqa$aI zsqMZ2rI8c$s`l}^)cDPNQnxqMtL@J*N6)FE;w0nl6%h>6xVj>uUQto-#`@@v&R<2U z6IIcBKEpT}zc-=N)s03=w7#xOc71`J3b7ac;xp_Ul!Cl0N*P@mnbf4Rnue)tZ|X}diIEYb&QtWdt1V;otW0g?`=#wu+BIct#9m7RNu=uzB(JV zzE8yuPBd%%W2l9Es2QGBMZR2P%(~|Kc(~T$dFR8EPRet{A2w*I-h3Miz*g=`cYSVsYHiQGsqt6%I@Mkg?o{;N zIu%@>h<=~I!vDsbAmcvVRR#mT|N83Jqa$;lRp!(1*qg?Rgy`ts8%2NGs1VE4=&GyK zij-e3ySlMm>+^lXTBoe~p?01Xy?2YTecC#8{c@uvaIB6`*5h?Xbj-afaO1s3^u{Lc z?saDN@}e1hyJ#~0ykh$Yr|~A$r2c&0_EWffe%EBozVEyDMIWp){=BR?Vefs>)O(Gh zg}+o;zVPyBYLl`3j-9GGaqo)lpY2qqQks3+-`lCSzn^3jP48r&4(YP}^caOaO?zYc zHTw$p7au4%I7{&=q3$~G**qNYzu9)&S(juz6pwnOcCT5ND7;4})Z;qzWL_u$yN zx1zDE=_S6I*A+MHwCx%vvk;C`cNr%akC~vd>JQ+(V7Ps6L+i!|Zmfb_O0m24^447Y z>UK9?vvlW@;w9S}3K~aN?H)TzW$nt|U9hJn>|71wNLEetBDrF^PLU z_h7m&n&3+wv%la#_K|`^g`=HNH`SMo!TX(xHYD0H$T9TSmc%IQa8cVv72m6^>g+2@ z{0YYQHHHh1I=jB*HuC;8zq6`0;vKw|T6|+s{eP?N_5Y=c62HVV^M6!7d|L;SlGHU1 z)?U_D)#m%u($aVg)LvE=e?^j7mz3^X=iBm#r0S`MIX@+klA^9zmt)k2pH_vtN-GL? zXQpNCnbUB(Vak%XmyBO}WU0iEPl3&NRbsm^;nytyIn7s@$fy;qxgl{Lo6D;@q;Rj{iiT(CO}Wz$K|aZh@VxY8qO z`DQ8k|0^B!;pq*h>^#?Ld%J#ojHFd~_h{}+Xy#1ZGaRj-Fd^+o%oQ0q8rLC?Pl@4m z(Z;r4MSUr8&`(lv6Viq^JmZ%u#1KY~j`;iHeImzjY&qAR8pG?T^Q@6$RHgM#YZ>hJ z9a~DM-Q37B^1q+29jlrzaBrPoLONFIGSVEAYdJ>Eznr(uSDn-fI^QIZqjkvPdMAgo zFOb8ll{<&scb3>RPF^^djgy;|yW|=tWApbP)nez>UMF)da<97UFuA^EqkX>I*W;=> zBzzKX@uB8Sm>hnfN@`Dj^J3phPi-r%Q^G#qkuaXbiMxlwXIk5eh#&8Zs3|WGi+y8= zu|Bu)LLpx)mP6}nGh2GbFv$SXYp%ARh~QU?o+(^^LjwcY&IVjY+0WRn`Kj%34_lZDjwD zzWV!z4>U}h-);6S_pQ3QcWttlw>-0*umr~-*8yk}+Y{wrdn4OO-3LC(O@BDqB>FtN zDHV(yZu!50-v|}t^uo4@>z$&c)P>hE8*{-PrH(?OjdIy~anMcbNQng989 z>)XBdw~jaV?0e;B%d6uDT=tU{pB^2%F!juTKh*Py{bT1B|LW&yao0b8^U%~@U5Biw z{_EiT`t2P3;_S;NFPrw(-XH#E%D|qjZaBEHZQr7EZ+$lX@0WM$^~>kS-1qWt@7VOl zsP;|&{Ytp_7f(i>`Rktln1Ao#*Y-d0&_lPL$^OpTXOA}hqU+PE-rV~}pW9#jD1AiM z+&> zvqyh3{=>hnQ!2AtN&iVbtLLttwX5<(l{%UEKP7KW+FO19`sKTxJYkIxlHC30&j-HR z`O+7Me*e?A51d>2&-=#vQ6THPEEl6!J~ICABWG^8<<8apN8NDuWADBke`G`26FD#M zdiC35s#g#A^318Sb+?YJ>ipF2KU@FyEjMoJxBcONB|NX6um1eSp|^kf(#LZC$xq)r z;??>8l8;~d=AlVDHazgRoZY{;ecM-y{@Jj~YP;|5@x28-ubbE7xw^wgANk{!9#`hY zZ9LJp<(}Z>TOTXvaV&LP)%0k$yYIVY{MNcHzKjj62i%gf^}(yhp16PTx5m}~JN_Bh z$$hUHmXjDA`n?~1c4>3&;L$T5&b|GHU++8DZ~A-x^@CXpg7d3qs&{|fbK4cI7M34v zytQmdeRAV}ZydDp;9J{jjxM|Fw&OVqk8Iu8C4N|+r>qftwDPah+V^|jm2~E-(r(%J zTwC|_*?-#5fa(LS2dNKA|1Z8xJdF}Xi`#mG(-uORnUH;Cx!Iv)FH?8#O(Klav^}~T(A763r;BT!zGv#yo zKXT8~8QuQab5LdP&g1WU>%abf$%l`-`U(>vt9X|GRYPiIS_YpLFY-q~UviyYp{9O8aN+jm&R3^U#>P zlRo`nzYV!{Wp_^^1teEz6!>Q8}*dFRy;$>3jWS7BB6;_iXn_ zbmyHZFT8qoN@I1WpZ+`k8P}KZ$p7nsMRylIHMr%fzpgF+kDsNVyuS5=w|uep%FloI z@XjBd`0Clkza7wLei8FfH8Q-ZMKEZy;((Y*<{t=J7!`)9!r#)6`16iC$k)CJqC$H0j^TPpyv^2#YlTg|Jq5lkE7n@?5Xh zroD9AUGvY_{xv_+!{6iKXLxugKHC469`}PD{;-F4@>~0lbHy(pS_YdFP3w`OPl>6Rog096e68H{<)d%bnNrD-Yk`iEnog z|GJBJ(n2HJez|Q=^Ur(uIUatjhrh$ab6klgZEwA>2roAL4rcm>+U}Zn>}!6W9e>R` zFQuCA?Qx&$;m5o9*zf~p_!I2#1D^PGGToi>+{xqK#dOcM{de)WcQxII+3sD{rHD%j z_+B^+tg`fDxnChSFblhf#aH7x8yL^A%c`5wO#Ps`&*EvrzzoV8EPd^MiF!Onzq|U} z;&++)*{V23|5Ek)82wB$zRvxqU1ozknx3^i7`SwT+$s z+W!``D`?XEM=pLwO#FJN#TH);4+dtfb6ydt8i#>Z18DzGF8}0HtTZtu`=LJ#x@b~0 z$GktVF<#H#_c|e+UdQN-dv&Q3|$G}a}`qy~) z;~t)C>bUhAJob0Hc&=?V3(9;ZNPN>0E$_$=#uwd_7IjrWh5iC?l0S3ov{5BP#q!-e z{3RZ~yNAEj!)JQ<9v(i+!v{TlPY>VA!)JT=%RGFJhriszU!k^HInxej&gXyG;(1~l z&E*#V1@ejW`~Ph5Jkg!&DF~6zx68hE=XDXHJJ*{LBLAkv7tnhM7_bzILrC)_I z)Dh+BfW`B~@Lu)!zuv?5^6)H*ffe+vizUZQk}`4lt#Z$>1@|Vl%KJdzz)Jjph{bOi zaGs^Zx>xjBj|Vsy6htigHvtD8pj0VhkxvKa`Z%PyI08``IAfg`ZSgeDdprZ?ZOwJlm=o5>+ALT&uidf{lOhPU4`()xQrXsH-EMoCH3pme8*8=KT z<(XJ?76bbSXghqr&SM1wIz)Xd{=}kxoH~}xx2W@w)+ZL7T!^I16N{W#nKwx5GZ^tp zEIMVt`B!V5p*ZDTqp^97bgO}Cg2-Q@<*SHGHQq){10XZ3a*dfyc^0O#PCZClG=nfotgH5QaaT348;&&zGYw!ai7I`ypo@Iy68-FD=u{C zO3eB*xs+S2*2H4p%;(`+-@K+jaS)Saj$sj~4-yfU##VdW32~8|IB@ks;a$=FQSOnJN2ShA#MmL?A0U{PTgUPVu#3E;zNgs_L z5V6R|17}!rVv*kjoK8g$vB;+YXIOG#kxvIszY#wmVv*khoMFj{MLrKWeJp-J#3H`~ zIKz??i~LUD^l|tB5sUmD;0#MnEb_&`=}ZuaSmX`B8J3(_sW<#D~$%#c?N&V?spIGFqXEH3gyUrO&{hPHuvFLOCwhT*7Eb>LbQV$S|yc*a) zL)&ShPP2nWXAO0%bTzwlh((9%7K+Z()Un=UiACon%B^~USmgVG{WEpA2Z7UhLx6}y z=P+=FB_|g7QQ*LOQ(X~@oNZ)sO^HSR5wMgoVv(N#mNG^xa(=g@->U5si=6GB8J3(_ zR8utmP?0NbhuuP=-f#i>pBvP&Qi*)>qso}mB9YlI$W+%BiE5wbk+jPbtD$~BfxSU ziABDZax1ThMg9zM`Wzh=vB;kX&amXfB4<05)D^@c=Q=hSleHaUk?#kVx`J5bhk^5N z)B0~x$BG-V==_Ot>pBvP-27Iu?zOL|W4#*?i%ufiJLFnp=)L`JKrA|GE}cx`xjH_5 zsK3_1qR(|^#AXHY?OJD&OP^Tu*~TUMb6ooKfb;oK0e&$Jaw#cyT_$NEIJ2WI!CBum0M!bIYGHqZiz+y0kD6*4)-Hq zDYwL;a|T$-EwRWy1(tG4Eb@c|$gQ$LEb=zMQf`Sw&h`T-x5OgndWus25R1G!^{x7c zSmas2Qf`Sw&ULu+7w9x{%~y#VvFKD#Zk1bNkq-x!YdW4fR=Fh>ohdGzS=6!KX^BN= zflKEu;)OasE2(dlTVl~)3oP#{#3FwLSl(5LMZO+b;<<&`Dto(u#XhmiOV2Ka0$aexue27K<60pRFSmZ~6{omE$z6qRX-BWJ^2R3Lq zvFLvQoPVd5|AqQL(D)2+`dtnd{ZAp!u;j!dKL;%FCl+~JBIH)xPAqb+BP-XGSmZa} zTs40BXoWSPB6Gj5WT~de%(>VZbRw38;$CV6*uZ>pLCj)Gm=Z0nJr^m{?c!>)rcYde zjdm}l!0oyxT3hj{0$G*H6(|FnjlDrHW?<%=nG2W#u407^Sm$3%&)oifzBiFG=S;tC zB6n4tXl`0d-{&ucg;gwQntP*q{Ug+ca~>>fb>Wf;}|X=@WFPvw$YFn^&1wX6liQ0UAOGtu0NufUSdykp|bIa8-C zx_}dM;9^eL0P~`5u*iZL8w_lnFN|DB2=7=(>;l>_abX8W=Atgx4)nG;lV@GP9b0}ncoMxQfEi2)4$_Hi zti_Hqo6Z>@y0yU(#NoDA2L1~%0xYmQu-o1_*vo`R+Cvp<+dB&Ew#V-W_V)>iz289K zwwIQp)a#JZUXta;_^rj^wl^J~_{}UN_M#BD?VW)=elpWuE6a`cM#6*J-V|gw`x}MC z-t_=(dlS$vu?tGH*BS@iXfMHIZzUqnZ+#)L_jkzL_PB2U(~!|#TO49<9Axy4XqmJW zkw0W%p2Qy8jotPRUV*jk;ZA$)afrRUJ@&?=U=JAvV3F8cCma&L zVt8=d+X8zi3O0$o5P;hr78fzwj%lw84zV{B*lq6!?6H4XNbH3naN8RMdsA^^(q31~ z4PH$p+AAamWg|1J*Bq0l8;>PcI>i2C&?_-D^bd7NgK>Wmi{87?<9#l~IFWwjvG?Ug z^tgwS+g@twh3);;V=wO_dXqf%$}ggq;L)1^y=pV&`bW~sb{Tj4-nxiAEYJ|6_bK!; z#RyCaJYnf|w8Bd53_T0;#C*-f@v$e|KG53*xsceq(;F`IsznKB(c@lB#I#RZfI?R- z7Yn@THCebfl|Y|nxW{N}J?hTDkNBb9*lzrFNZi^2AZV-AN9zrC)NC7Uw{@=*v>wkb z7JHUwlGytp5+G@yd_BS~K^;T)^>2 z`gMZRtnm6E9Nz8i5&9*!Hymm{xaq)w{fG7)*;CPoIl)a^>IT_!TXXA-lZjQ?_Uyyl zhCHk)pw|@0vgcps*5xS7mP=rR#QW9Q$))~m$@KE$t?JZsx)OY(=V*6lPrCJMiA( zWrbL;!AWTZ&+9GAxVA(DPq0%>#(J4wT=d;_@kPEL;n-4A)OWqg{ZYVorhR1Y>F`eNA_k{LJ!D-? zlN%K!m}AzHads$PanHO;TM%!Kt+QE_6uMW~0?p&mW|8KH3v205aq+R?C7Jey+i}wT z2wPwCV_m$}9AMTb+@p%|5gFeU$rpR<_4e>PT=uBn$K#&r;@KbO5ccqk;Zr<(8+F7| zo`EyR)S;R*X@SZ6)H@c>6YIfiEPHcs<`}rYdE9e7{AgGB^q=l=ukrBT_V8^y{+m7S zE@v}-L6?Bx@m(Tdy-@H}Wckm+IS&sKQVxy)UvfaiqH_&!z=|-j$XQ+jc#e^XMcxxQ zU_G~pMV<%D_D9k{906;*6S3%&1LyO@0W=Ipo>lOs0!!S8MSm7`EPZxMsWr&U3eVabWb{v2R`JFUM6r+hr$ zNO$1~@IwqlEc#8rflDck?Pp&FUiSBS1X%KxSp04TmVJMAQzsKYAY#!u04(F*Sl$CY z@B<f30uZt2qyS4;?SN%0UmEp;TAx_- z^Qgm*7*HW_K0lB^{i)9jZeh`{pxi2-#3GlLK&Mqt8swxIXg1qZoCdcGG)wV4XyUX* z3+7FZpj~dtw5bbb&7TNwGiFbYV8Qsw^UNl?^BdW?fT~+xx2zR#T6e+V;iL26HFB$4 z!8G_y8_O6gx96LuEtojp-6nR?#xjYzr#%efi?w%IIWQN^a%}DL?JwF&eZ-m5N z5oB(Avykv^aHKs}jbiUE=+S$jW#As@xXhWDJZ~|cds}+^HkfK*p6JHo0qcyDNq>|G zSv++}%v0pkT$8~M^#%)rv*`T-*!``->r1k#P+M;SJh+46^NV92Xr~JfrkBq=^VXR< zZ_3Tq2g}!es|*-W{Efd=j%Moc`XC%WEiXgpvbInlu_V#?T4*&5s{!4fb5O4_w77cQ z?G4A9k8V10;P9bCM-Co8@aF!v_Z4Ctw&c>M8s&XBx2dRaZ)1DkOe5N~M-~0xS*(R; zBt%{sTjNu8xpnR@gFwn2R}6C-xMH3iev5a_C?~zS4fU?I%(BdM$7;(8Pc;>S zdfgr@=#Uo7t4Ryy-k%oC>CrWq9qJnFS=u$2_3f^~%*kDg?=5U9Xx!42IV7vTW_O@d zs>)jJt3gWrf3Aw02pc0;1E+CCoRoTeC#E@9zIM|AU;N`KiB0%cT)gHFRmREMCsTa9 zCXUOY)q&$()#5c+LGSStpRZ=iLtLXPf^n27^}|;ma9!Uc4>i?~ajmn7@6D6GaB$O> zgcPJy@+X@slyt=kC0(&XNmr~;(iJO|q+x}UG^|jPh80TEE;;WSa6LtS?_#C6d%f4f zmAg&Rggy9jj#=j`=4#0LgZ1HTSG;p7g9TH4!OW^8wX`+4PP1NJT%E_`*XOTqIDY?4`|!2ixUDX?33t)Gk{7rxC6P0$)k3U! zxTOi9`Xh7u8neO0_d4J+TH<>R^zEo?lPK4b?i^S?W;2nQAfy=VLvTK$#KU{Od zYr7V)s`mx6cP2Qim~pMYvg@{)E9BKw7=tB$F0`^)NusmTnzt4jeS5yt?cdgY#P=C>Z-{q^P9zuTOg$Cel$(=B$m64J%w&mneL0SL7-eTfgF<)61^ zoVnGvHeDdUE}D{-`tl3KJG=g+ zl7jL_%i9h4V%$vB98M}7bRmDvDoZuEdiu$jy?f}c!n%S6uF+K66Kk*fR;xnSU68#h znAxbXvL#mId!RgSNU5>7Iy1BK`qFDBmX9nOoS8FXWaibGRr3~3yF7DXraIrLV)Cr{ z+Ra)A$yxts{i{D2``1(NZG8Kh7jO9dnn%7f_2btM#4S75q4M#%uV(&a{9nqpTwm5@ z(nCjY3Ox8$$@L8ze(>42s)aMZ{q8!|e7N1QhrbGa^z#7^PpYYWZOxB*wH?%bmEXU% zW3<YSZmY|N2D9U;cJ- zLfpgUKZ`H_exHYbb=Myr|NiP58>aVoHBj53V*bEiE$h4gl^);u&YC?d9xht8;Ex~v z=&N`3J$B3UM>FT%*1peAe)!S&x1N0cz`(#YogUe=_1b;snqSJQ9Xc!}!;C)BW4~Pc#h-_KFfq`6|Hg68{a;?MVVmov zpKV`Pn(til6R%=dbyOW=qU+2<~ zO;4&PzMakZ7TEfoJ??3y`(oQYO`Wzdn;tm-eT~KQy97NN=C>k6Z1;*oOQ5WUz%pTA zmK?9|(^N1iO&tf%^2~2J+M~Nu9(4F$X=VIsKF2D9!l$|TkoCdEGHhVhIPG!1fhO(0 z+QlD&dp|fz`0s#c+PdLjd_L12%{D_rWt#Rlrd?B-x%UOJ4zGvl-rwcU@NaSPvDYJA z{S597b@T9-c=+xf{!$O0>EU~L_$&|K)7~#V8+jC#^+YceVggt*513F z<+CGt-6mW1H1AhGjo~|}<(B_s$UEY1h2_pRkd9cnPuc-`n|$Y(aVQM`S{x+K+wX|- z`jRJo1s?u+t#1C(KgUc6k-y5rv%Mf-Re;3O?#J>P7=|AZvB*n+1J~mRRDwg~mB7+o zJpwo|96ump(HRRYI#Yl}hgfuOap}wgmi_MUaOo3^{yi>z*294t@B<`{fQ9cSk zAYzec0?WK|mQT4Z#G+G7xs@(rk+Uw$W8nsk#36o(MQ0M_Rv91``CXJ>haV8J$XVn9 zEWjXQkrx2V9Cn5)bJZ(dxC&UpA{M{A*3xc2kNST6fR^GA`2)bxroG06n}GwP@dF|j zo7;dT{=_1G0a)77_fyBZ7Q~{HN%<)JfHHB2JO`NLK1g{uBtMBor-X9rS`dr85;%_o zcR*8dNInpY&KwWAOL6$EzNam~axI9(PA28U@B_-kA#%pk z-yJ`oLLB*49}1tZ{!ILUN^pq00ywV+en7mXWxo7)VoN?9SmHn|Va)-SIr#H{^Mm*S zEx;jj?H9Q)(=CgKM~Ecz_BQr?I~&NAS?0zaT)9O*0|AY#!O2%KTbiABzPJTM7A zAYzfT%%ta2s{7GJJ`_C1#F2=t%GxmYi7h#{j2WFFwQ~XI5rda$=F2 z<&%n_^U7y$EuV{1ddR`zmt{4>k`s%Zl2H-8aSVs3St?Sd~lcN2FN8Jh{bOc z^{w<0i+lyJ(P5_I}yTIwi_yG}%&IiC5mYi7Rp8yA@;0Hu3@-Kk%_;L;U5=Xuj z2lj_b9Ee4~Gq9{v!MVetLo7N4zwNh~@XJ0bBT7CFZ?NIZ!}&i+%eIg~mR z%qS~j(cycU$caTh0odPP>rVnsAK+lo;o27&mYi7R91kaDl33((fzx^8f`~=F064>v z6N`Kiu-wj%x8%ek-v%t@oLJ;Lfn{BeJ=AHVZ4!&lL6^>()L}&eA{L!fE}b(j9b(Zr=hFEC zIQ?pEhgfvJ0?x4H#3E0QL%3G?Clck zSmXmKx5_H9$je=FVv!F6_J2#;838P1l~{DDfTgSwi+n7w#DQ4koO2zBXq&_$=bUS) zm)gNu${VrhbOg?@o-f2A?+z@_Yhsb}IVk0mSmXs)7GHI>dlHP@If^+>*5sv$)8;Ig zcN?cj>6uc__=xkT@La(A1?M%%umDFtW?;pX`SUTc3e!_=n?9XWn?zlPBg~s-Pk8b= zecd1nnGa$mYT}&R=FYPxfxs>%TgA#m@q9H%yc44kL2FW!H4`dk>X?&SC`q<*R*d@! zNP-;Yc^FG^+iX46tl)fS+G2)GsVXiAv1vnJ8y-B3~1RzAFFt;xb?Vv4+0<6TdeTa|JPrilb`mWL#(_ znK==P^Pn)8roh>Y9Gh_e8-r|6XS{^=9sJvLtQ+1D;11V(oJpkMF7{a0y6qi>J-!pr9y;4> zdu_e;pi>8TA+g8jmfK!s2fdyi?YYOk(?dl9`Qo^T%lpUeO(l5n{;g*#tX1(ezdJ*ERm zveUu$KYCBJ{BMLO>vhVMh&`@X>9*G&?H_X8QeF1`01s|^Ps5Y-X%=Jeb?CY6jexyD z&|v&JyX^6`%5CoiJh|6CmH6>h+ihQi}blV$_LTtS{!^J75)N$LJ zi~3*^WVDxVxzQfi(4cN14$@NC3u|cp(v8RcIFfNd-K4|NqkSR4{MMnqq>Fk?n-JYd zmwWWE`K#GRt6jAX;y>eX+ZzkL98t2|$a0LTTd(>e_ShsrJ-Mcbp*NKVETS8a-{Oa7 zp+3C1T_kQtAw!<4HgDx(c}BJdz{>1To2Y~ydEUc+XrKkca+}+dnLH&bRU9) z`RvCrYxZpm=DQ~KeBC&?;{KuHOq0HTPR|JxV1}nZM{`jA42%-1{+uIiqP~@%bM#Hr zx86J(Cl^;oeTUC#*`&|8f7m6X7gt}6Bj7u6j=$=^7FXX*K5`MtS<zE_u*C7wzgy&~YN!yd|Q z_G7IE~1X9lVKghy7-!wm>o#5 z{^SOem*fE!TpEFLI>~Ta(E44QE-^HG#!IX_^LkhH8L%a1e>To4v##r6nIZ)hL zbxxF+am2>{%KOc+Pbb6J%hgvMADO!Yxoxb!8i!%YjBqgX7s@>z1AAFLf)R65Fk)^B zM$ApYh`9(x%tbI_E`kwr5sa9N1PgAT4EM=!pB&72Y;rLB=aVZMU&4H&F(e5KL~_sFWKueFh!+`%<|OUCXbC%1A*<9l6aM14cm?VSR}osc)NHk;jhN}i;y zqZjo}MmaHt2CyHQlcSi8)#TWaFl9tk+X`p?7so8c_q@)yA0uv7sSd-iLwB2!xPT89 zW6~P&ufk}Uk&gsYS{s3cm1m=^5pLTv?J>_Q?(vi@blfg^xA3|x=cXEh3=Qgx^%#y!0#651) zolDxEYXsOykuX-##F`NVF>4I8}Yx05vAHzbWkU(&N%^l&8~@SlU#t2mX5_p zbsOx0ihb&R{E6awp3lq0#G1j*_)g9pbjRi&r^mn@jy-o#djHxf`fMk) z#>e{^BSa$@AsWF5(FjI}MleEj3Py-d!3fbQ7$G_Zd)Q5m$Nh^v>?UImyUEzYZW8YM zsf()_H`E%amyIw=KXP_*IFLAbaP2;nH(zw$+4jY&BP;jfS{UJ)p{Sd%E&*#W?$pQG zd$Ke2mb$B}YEBxb;`i3Y8!c~DcEEnmPpJH=$fPG!{Ql0Wc7LL(-JOkkx>#i;7fnku zcE_Dc+W!8H>buLI!+w(y|7U7~3M8wz?E0EYDLdS?xXv(VYueX4(6=$+g>M;jx0;Bdqxlk1w|M7W zFkZ#l_j&jv(;nNcG$nc5Tbb@F#2IBW)?RDVeXZ@T`Sl*2?Od9)`$l2$b;I;*_V8Oh z{L>zOhl`JmPg~R8Fxy@8Tx(8~=BEgYuOTzP?Q7Cjas2`kPX=aG(ETfq|L!h*x{vYj z<2^jrMAW3iYx20?;cLYv;NkHUvC>lx-yFlk{vi^}EXVBZ zF**Iic<`N_M9eWZH@m{8>?S&bSY|oK#^r4Kk#^VJrh9Aku%*C#G&-WZc;{zUyA06& z5D&iuG9kMEhcGyk|AUABZx4@8UXzyMmt%YiJ@$EN{MPm4x15ae;P)(ES4`r!qwF=1 z3GB!B7%2ybjA_B=g$fi?s=qHKAIQs?4O7SZkRuiyrbG4@VBI9R#D#fJ2CRySSp2d) ziJVyEX8f&+iQlR+ej^Jw5A7|aN*v;sSo~JIDaTYn_ zoX5-nt;G?z#)RjO9kO&7PthS3JKKQ8&NIO2925v57M1A4rN~>BV9V|r<3bWEILzwWjxPf>R5S5EILip z>80~<4RH^R*8%5S^7Ssf8Cb$17CX;V-e3DA7Wpnb^9AKrnIRT=9G)S0**XqwfaN+8i%zObC)1@v zEIK(Zom}Ab%d|~m(cv0L8J3(_*X3Z-AqY{Hy)$FzAfr(bX_PwhT!(cIhS zEtoiW;gnf3BNH#O?59@6#_AqbyElC9{K*q%OrDQEx+zfkhrQm~mKC16@=Q((_mGwBr`rIqg|qz}C88@37?Q zd20pO-p=o_6+b$`k;$_n3uj@~O;=V=jG%LS=EaucjL9gohZdcmrtm@?pXU!purpGx za*CMRouK6tuMdwJRXR94@!A`PkE$viUNy07Tvd3KOJT(5vSCB6JCAYmC*y{-; z+T-Vg*c%J%w#RqrwK#;t-Y5v%_J+Y;6=bxB?hV@>hs?O`aZKE9$b`fmt8urz^{}@Y zGTL+ZnXZO^x4ko9oIMep{96gR+g>F)N*}?+ragC`DY4sL0d$r^CM5AohQMu)>jKt6 zMtkVaw$sZw6SOD(cEFxsh)p-1Z}8|ne-Sd zyts7$KzW=ia_S8h24~S5N4;TxzYU^lI?up;#Pl=0B++By-07PEdy}9@cit=X!}5rV z!PT>snfY~nTYdW$TPk1Qw^fO6Knagu!JWYc691R`r4rdM^^mJys&;Rcir-g`zO1P# z{*?vj$9iq~?!+lcZ>%`B9P_ZzkF{5I2q&{QDyIKR`hwhj1;*F*P(Acd_E1TWRK1Fh z@fpE5wEo7SM=BmYQt|A+Vw{}*E2oEQ<^_AG9{SgMsNM-?cgPI(tjP>!-JcoE?9n4w z5V|y&S9)nM_uH2Sb0%LJ%)b3nxL*qQOM{t@T^cO-`6XNG;=}dvS66Xez2e6Gl@C=! z{KwSN%KOc8z_)8W+Nb?!pAL^xwG~5D{NS0YcJTLAmT$Dxk2p^EBf?jF_@Rp0ipGlg z!B1Ay4*o@jM<*WBaL1s%3h#A@K}bzCTb?lA4pZ zzkf~@z1OV1d*6pEniIFr{GEy>p7~bfM6nS~9HQ2iyj2pvxlYw?-lGQYzve*M!HPp2 z2In3gcm%y?NhK98m@VZ_J30HGkUleSeHG|8NmM1n*KAdN{LX3*TBqyv5&z?c5sofz zRno7uifftHF9q*sDJe?U8tl~?Gwjb4>|0j3r4g<8)sL%C7#4lIDx#lVqK2-Hwyue* zX~|s%S(}=;E%!$MaEV%)7Td?NG|kf6hkeN$4lPur=kU!J=s8S4$WuZ3KP*nZcgl}=CUfeYq&a`FP@ z^mygg{i9x0r}qwdn1(z|Lms9f57Ur`U66-e#-YDw@#5Or|J(gNTz6WC{XKktb0}WL z@;>!#JRF_(JDJY5@*E!Dod9q18;s`+F?`4%lkd<9Xx!%{2riB zmJ#-cygI*R@lW^(_fH)j(D@)>aq8- z<<1lBAM@}T9{oo=e5r@8@%aCnhtKus78#q6p^{)XAF!Mmf;RWPRk>3Su&wT}!xvviZ=UH=K*HF%j4B7%LWs+Fz?4aDb!H7lv z5^$c?*Rqc~h1w3W=p1tCeCpC679G|tVu$VW>D{y)V$n$i&amXfB2NL9aEV3Ec6_m! z<hB9BAamNGyr^4>kJ?Dh}am*@Y( z)@3x~ezUga`4j)QT9)TaHXF~LHt*J1(=cIb@^rmpmDvDpHoAKz z5&i28&UXGe&CO^ky6A$nn;1P}Bs{th5>1=FOM?&Q%scoDsomLID+RfnKA zm4+;$Jsu(ah;2F*N6EW1omSeRm<; zxd?#na!pwtXHSi3^8MO2-%#HHee}Y=U*G0Cqfm#ZA6+?Equx*pJ3SUQ*MId%i$}rg zIg=ez++ENl9wwnpI_s8!F2VmP+Wx z`hSrNZ!6*aiLZ|*HJn)%xph{IcRf{C(^A;DtR!Jq5Z&Lwo(XF9LgqZvbD`Y#g)wTp zoy5Cxm(e0P;>T#e^`?8O$S&-@%g*%+yH|gWyJ~wu`>3PX2hb`kuE~3_rYTxoowhJD z)gQR$ZG4lQLuo;&ym*PMER`~&b9HfbWodm_WR7cPsWUUjEp_WU8s8*lxaV3@OKWzo zD!XVYyFlD76tnYX-!y!Gsj=H%wy^VK6_FGBR7#@E>?mI2FNnh#9Xe{7xcY+nZS?~iBs_^heMPMNLY%V_cC71#{W{v;B-U7AIUGi< zXSA?3l)6!3-oajjyC0r2TpO2~?tAw+JOrY33HGYPfyRV{=6WghM$6Lj#}bT_2kQ2h zT(}12EClyG!166&Ew2b9`Vu15J5*J;hp*;TVZB*nn=$q71+}FKIhufaqB=!km2Q;9 z_$QmNMt3X4waep&j#iPm2b43v$2iITp@zG928N;U-tA5+v{5@GtmwZeVF>0TO^P4t zS~uI&sThsHVzq9hn-g+3hWN z?)=+g)xb5o3Q+sjv{aWHyJ}w@jr|jxz9z0@Z-;ntX-Pa{wcXdp@Jhqy`Ep`z#uRnA zv#%F-^^(%$JO|n!4hiKoyPO=w3^FrBu57MLi}P&McaliYUwPbU(ffpLYbvPQQXjV` zZeQH~oS0p%a#XW>74ViV*on+eD{>e6g`LT^W~RiA`(y~$_vQ?htni-~M(gmbZ7B;I zEjj8)OnJ&t?v(Q#6R)u5yDQ&CaXXpsPk1%5Nig55NYo+8nf^#t)1p0JowkK&!(XCp zr{YY%JkxJCoar|cXU3&>wSM<4!TI{~zG~!<5#j60L&d$-sLIk1e|QuY_AyU=i+L*Q zZ*qM@c*pui6rPW@8s^WRIXyEnYx10%Gco>aK9+6BEbLu?EnYKoW-M4RcmBXDue=#6 zDlDABZI`c{CSIOG6Bg)6on+*VgZ-nqtzEYPx5-+!~d8WNg%NknC zO}?Xtcdk#K$A5vT@8m~;$Gx|U z8|dM$Qs?kIZ_wwZ)_ppZ_?BR!~UCek;Hyj+_z&Yc=-9& z^+-h>&=I+CuP44UBr-TNKFdA)b`S5|yITJ-k9)CI*YKX^8u8V3-J|uR9{xoS&;99z z7$5ed3z0u-<==SVj(9%jTGyL8bRXs6@AmK|9)6~WUt--K+J3tFrNxW=cRhSN&-HxG zJmuksczDCZ|JaHT#U1hFddx~6i$zED#vHT4 zPdE8&b=;G`?|XRmO$jkR)>5rzeb*6VpKr0k<2zkPm8EVH)A1=# zqpa}QAJUP}A39pZ@B&u+b$kmI=RA>`aCAfu*jpy2*L~`Um7X8B(znKR?{C(-e#;N* z=yWT-#L@@Mx*@}o6N{X2ls#tIFC>`plKpA5J> zNLgH{6{}XQt=0;)D)N56GxOYY?oH6XzqkLs|KIb;IrsZK^UO2PJTqrI72}CS9Ry1$QH6CXgS8V2Uz)IDuHCVBU8LW?p%p zyO#%N04K9R5V82*7dXYriAAp4>wXA8t=g-rk&niQ?*SJ}-iZ)pS{=5FZ-dbx7M&80 z&P?iTG&;nhQ|ZyUjyk_EI>e$wiDTy;>G(5{ARYf?gBdr+XRwaH#XA1>M>-vUi*@{Y za|80@a4gnww(l3RdKnfoZZhX42RQj$oIu3l=OEw|D<>BDC}7`1IDv>o&KPF+aRN=k z;oGEPtM?9*x*NHUCof9SH8{j3vDmBv7Ms^m=V6>c#G-R6u-IG-oM~+?2Ns*eqQ4qg zY&KKp5u8B8qH_p3`MdxkcBwODPfyEB7=zI>GaXwCsk})31PioQMD-7Jc$gPoC}g(8FNe zKY4+IbpNz{N%v2SJ0s0GPpjx>X@YhCOfzynbu6YNBb{ecmSEbKcW2p$lP{zO|L?ed zb_Gtca$@nH;qX0<6Np&kIl#VOQ5xCL^T7L_pj4?m9HKuOSoDcSK8f-WP9S2DmjL_N z5kSNup9?HGUNXN}$9XI>VdaJlud8@cRW9%@7QZF61-xxWu$aUPFHF9E+>$v^a$Xms2 zn~}GQ+fXCdamzPY$F0C%9XDGq9XE@0-13Z$j+@0gZbOXRj}OOUN-~D?Y`&i-SxlSB zbQVM`b)o$fD<>9t4`APRoIu1PzZlr}Jf&vcR*{ba@7tlp5&xT}P;T{!MSmvcJB>cE z$Zw#0myr{T{5FrASme}nM)GX?#de92|>vY{wcM9a~Pm0_oVYLLfg5 zXEc$a3^uH#jERB}+dVE8-{K%jv2tRO)3@Z8j6Si*>1T?S6N{XE+xId~Aa6e>pFEjo zL!z(CwQ_H{)XKQr=$?v?WHtzhSn|?-ij{lI;&qgK1x_IEHI)oL#mb4rP7h$;t2lv( zMV>R2D4u!U2QNg5BbhQEP00k%Xb!Hk+TUir{ZKOqu2n}UFztK17j|A z^v0j{O)52cS(l6wgL%#Z9yI6F_d2}wL&aaIQvFJ<#7CW~B`+koTh*)%11B;wki<3s!>mb~u)OSzv@$NEn!I(q)`eGq`W^N%|?XfGQ#re)0I+1`g(%ytoZ2Vk*J zEcSW*W?YLCNVk{8=Yr3euf_Pbj=VN*#FDo!b*z3r>ex0S79I9U(HTV@TSsEi8Sl|y z_Z1yt(V6biVTi>aV$rDr&b0n;e9oW%)ES3h_Pva1O3fH0K6e8zc6hCczV3V0XJXOO z_OFKkq~r6Ti$zDr=LRF!cJ{egbn+m|xY5XYJ<2_8t84QoMu$z3ag)K+aMT%(GK#Fvk;TslmFeWd^gooD~M2MO<$%+sJ7&*iZa3gI{v?IFoCgrOq;Eg;Vb| zIzMyT+BhL%ABfVb8&r6O7SDuoS(pUMv$2(fXSJ4y9U!!=3U~jJ1v87Y`{!Vv36E?} zS^r1@lrUGJl`Jb#GQXm-d`=l=K3H-29IVZ9lKSZF9=MqV73N{Fl;S=Msw=q?4ff==tY}R)5>}ZD%5agJ zvj6NNIHvh+{9t@;@tksmZFC>(lX0@>l~+|)+BC^nQeIXydjY*Oi|HVD=^QGVhKULk zw9dskj0f)y|1l3$+r$VZTWXB%HC)A(kA{fzG6?- z?P3f_J7ACH3Q0Mm0GKDwCR~|<^{^nLe{2`AHw!Xm$A_lZ0ow9!I^Z`PjV`{E@2eH3Mn7r(@h z--X0p3G#dWI|~VI`F9ocm?sYh>2AO4AG%K1-cPMP@vjP*dN6|}+92H&Wp8G8*FTO6 z)MG!KigC#6-yKL;1-X!vGX;9glV=n5!`^4Wj31gNY_HndlYG5#9rUny_(2<_$|!p~ zQeFT2NT(kCTMOXzZ#3+AhRJY0S`9ts$-_bFn`ZLUKbQ{NyUSj`(qATm7tDO(cQfQ( zdl!4`_3+qxH7b5nkdN&pB=+`1)prE!-2f%}*9!;BVtx5t-&@}**yH#kB=-71;Pr1C z?Dd6=_V_~W0~uf1Dgk7Klu*gGG3UVERx-g{7@y>uK*qkjt#EU&%8u$KzCkl6bP z^t|@=_b}@@(q0A*vB%hZ?R^V-lnIGF>Uiz-?&-F##De~ffuh%59E`Q~F75~@dF}Os zy>XDyKgLn~I|crD?WLm~+iKr-(DT}>>E-@k&Gy*4CpOYv0qiYDx{%a&E%dzhw!z-( zP@;dl2N3@b0(<>?1@^{4CM5P=gTQO=j`Nk81{v+;*fhrPUgY=MI~NyQGvq>I?@s7> z?R^P*;@<^Ced zUbps<u3qYJ_<$W)3uk%94n8toJ5(n+^ z+9Evydu0advy?l=##xeNog(3>M@m6`p;~D;Jom&PIb0Zgie4QY@Vom%dPw=iDb%j0f&F4xkta7ONy-+kKh!PYy1wO#u95}Kcqx70iB z9JjNjC_Bkl_ra^d+VbH^FOGhZZ?R`xoAAffKlFNQ)Ei?DjXyBy_fuZG`qh%(O@HZ{ z7w7IyKfL7mc(vrkE-Ln=o_Oc5KX!1!TaC{bsn}P`)sk1M)sk0g)smN+)RG+=RP2t; z*xhNTihTvEWbS!iEqUpvTCykJS@OFs&XR3Co!H&|oh91~o!A$PoYLGyQi)1v^}mQE;K#X$vGJM z;8Q1Of9Qk5PR_o{)Q9);yl z1ybYR#qNjWi}EK0W^Pp3MX8fQ*KAa06va#mfgkotN#Xcmp^}X%zc71Ppmd{3Ej(k` zkL%O-1j^?)=`RQ7Y;{6&&Qm2tu@}~=DF-hrj7^VsVlOImLhr0_S{}aUQ0SAOle>BM zhoL{+t8%aN_XvE_pmO*B=DEN}=Q}ND-h4Fhw_Q%luBF3+H7kbu;>)Xj30qF_#l82p z;L?A76>QvC68c+z=cYG9g_k=2st@ga-`Us{iksPrynh;0$+tbWCRF&bdLK3l9qc|=ROn>KkE!p~ zv@bufbiKNDO=#zS^-=xi`X`!v2al>)D&$v3IVIXC{tu(V%= z5^L2h4gDK(H!Q3OCe+pkYLBZ;&4ZeKMZ=uz1nBHqssf2e)r}3^8*+~ptnkGhy(wXN zp!OY=+T``=pDKVl6*v5_;f?EqOV9lE2aTcHmFlrIy_$nX^oV}Hr$RNgs=OhqG56q= z%X|qR{3KKxRDGJaHU|$hJNG0Us1NO`K`s8;(0^r1*HyEEb-m6ABtC;x9#WfplNp)I z>jS%+P_NCZxbf+gx!2!u+?SYpb|8M4N?)^ajqkue)vm;=>O;eyRH3+9^?u`{jV*;Y zZVcAGKOhi)j|#QhtOlcI^oKR8QN5Zf8nRaAc71ZBFQMz=V+%t|AA`pF=HMav^M{7e zaKyTHqxx&(hQ^j2=N|Lb^q3T?+p2O_4_*_TG~CI?n#h6O8`NXX)r|w|b6fJZ1rrnd z1rpy3sc-3W(LrC$f%xW?q1t_F zeN$Hb;HKc@YNuEHRrP_m11dCpzxsP)Zr6esUqVh{ptezcyF9&lb0cGPzO$7vLc0fc zF2!oMEg#(Xda$PJ%uwC8YGZTv`a$q}ry5Vc(e8o5f2xX=x$*n|9E_`dCJ_H8#O#MF z;nRNlWP9??_tf$FmP1Fn`)X#q9ZI}YtzYxB?y=R*M%JwcZ8mJRy0$SlA@_M-!t`50 z@eL|;+fLQ9k!|10*^0Jb-xS(atB#`O4}1}acAQbYXZA>t2vD=NB{Itu%>8LDE?n6w75xSH4a-7 zoOr#{E3vRK6o>x0`wM!s@zZa7adkhMKQxdKRH@BBgh#$Z^yrO-P;Ijc?P^j-8(R|Q z&G6MUXND4fqt-WXXk@e*BSbrKGosyszSc4^y*^m;zzc!+Pt>N>k2W?V*7S%if~$SF zj?wV1P6U^pzdC?xW0Q%|0mf)deQHyvuvUA0?Na>DoEfNl6sxp!r#A=bO;JP3^qzf1d_o}Z}pd}79tG98j zww!-k95nX!Y}nY`zu}3dK*C$Nmc!*A+W$sy>6+NhDE|P@7(9f?~9ge{-g5Nxi>+>N*w`KYj z<-XId8}#nMJ+FWMW}w|;D*s;J!6x-KuD6!ocWU(AwkDQi$`f}_zoX^LPfr93|9RrI z`iJT_qP;dacfzNZ88x-Or8#$VR0+f$R)c~qD<7QaD?ECls6Gq*F<4aYq@!oH{59j- zu5Y*GJNNq<(q8;_+bi4O-VwqWv+=I0?`iS18|$lmeR#0&*omF^FZC71vo6lFyylm3 z;lUp)2O zSH{=x+k0?d%fY(81ebpEp0D;6_Ln=G z;-5nte%IjJar8uJ`QvIs!=$EN&B6U$oo5qvHayl`)EL}x>_pC8PuEXr-i~qy)rR`%tNCBtL@uXkWMdHV3^hEA z6*P_obDD#bx;lf=U(%ajYYYxUo~19UAJ%tWgH_BYZ&s5qo@6(@SRWjYJnbLF${J(u zUC;jzXs_4mH_>C%=!uDst?plcF8UrzDXQ<&^kU<_Nt>De}Of5=pE-8w`op@UBE^6Y7Gta_`9P#{a@#lrO z?=Spn+%*&5oH*+8t(T`yxpPW~E55qqn$d5L9yMm`miwqmwW9Q^}^U) z<9B4&U=QqNord_19*ynOoaTQKYn5Ox?4BdBUu#*x47EOW*; zdDku(g*DEl>{nI?;`$B2n>cZ$(;iU4_Mc(B5_g4gUtHWbSgj?l^qpnO+2$0EYATN3 zSeqJN1?BU+l7f8&`6HhgnK~-InBOYAo<6oLy(VsmuYIip`|W~9zlaSbJgw3eZp1g6 z%2;15_J_tAS*J9(E0|+N`CUh`2e^2b>RHDG-*@1fn--ThA}@GgzvFA}r-BD3I=(~u zRnx+>c01zkZ?`%wt^Ip(_qX34=j+-ZyA~8VzR3qvmqoADr*(KT?*0xB#HDpaddK~7 z-V)jsV0T-`hY?8cyuI)tb^pRQRNA5!)%}Z}RwE))7bA5sQkNig$thd&-#=;Jl)YEKQu1>8GUt-of);#_ z4=!u3S~}u$MMss3FUsgK>YUNhI|?|@arGQ2VabM$coyKU*3ug*a=a2wb&kY$#C;RtYYG?!UP{%-BoE{doL@iA9qpUv~MFlNZ%DD?8Aye@^azfo&8TPII;XKOtKLpXJ2j z;O}#MW;_@NpUv(+XXP7>>WR3I7Pi0RlP~jc?etvr)7$>O<-x4y*S=eEeXrtG&bT`+ z-goKa2b+I%OYb8;o&T>{6}Q~n609FT<)W-je=pwq{5QWpRDAn;>XxrZ&fYWQ$PZqt zdiaig*S~ReLvgo^dx!k|-pPOcV*Q1Gda>w{k#F|tp19?v|IIrj?2!j_h#S|_@jgps zbR&5z?T3eWjJF~D%MqwQ6QlU{QGACezLU21VAzJ?ZTme*k6VS>K7khVaHY_z}Y5mtOMsMDcDsOghUjWcUVQZT@Xh{B{rjPxyNl zc=2zyr+;t;aU|a*itif5pBcrU6~!m3VYY1cDXup#IqZvh9?Z34NqjcU^#>+<{Gn{E z<@pSp`%Qb2b)E{yNqpwZ{ic^{4r|2Y|0&lC_=(N%h)(aM*UG2Lc*qew^%t9dt4>eS z?{hHyu;$OuziE*t(Vv$zGAHuh-vY@$AC;Z}-j{BK#NOWuBKA+nXsyF%=CZ~=vE*Hh zy7{a=vB+tGzpIc^amcg(zQD2{!XU~SOc48>*e4b{?4Len0uhURINXpXl@ew;ve;7Gz;A=2GAWDkmUz)9V40zH5uIaNcA z#r}g3rC2$!$R7a~e~3lSewb-(K1H1YIDv>o=gcm$8vl3C>c@2S^4Zg;^2XdVx4*49 zi86WL%)hU!=1lsiX^7#u?QKkIte9I>K7VfUY|IDmKNZUcmg4po(*`RRlwQ}TxC--% zORC`nruXSd=4P%r3MrjgJYUzuJ98Ws=glt~=Y}UA(z2E>sGg(x{5zAh!*i$m zM9oaLQ`E&E3R0Dr`dl?VJU6k`?yharnGSu|R9~55dy=erekt~G)xU-QdlNx9n-c-- z(=Qy9@Qlp9e)f@nm-b>z<2|)d0{XTuMmXN17{b35jT0>2&wk2>WXXeodAxdd_}8kU zCvyv^PkOSexewvxN`K;Tbi(mCjCt+lLzaX?NbEffCFaSq2`|H54`ABERFbg0V3a-n zZ(un>Vy_{}-e(^Fc&{Y>l>&SH(LHl@mY|u9vy5N z{jH9w$Hfpn0=babtBk6LANDw|&>rnbJvc`af8lof5Q)4e5)yl-McLaAdmPJXkL@h> z-jA|32#L3fF?@=>ccSdwjLJ?!I_R;onoRcNj7uvB&#rZ~P9!UT-AQ-WfKH z_2xct_zTb5SdIGWTdj^muPCL>DC!OOD2iStfOmdJ9L59I zN$MhcuLDS3X{Lt{^BhqC(=jDPw*lMlqO5_ro+%yQyT?FoR*qHw{`nm%Q5efJ*IRFV zR|EIIc&*!^sEZK4o979mKVwxSk5NtkU-texZ}nd``k!OOzd!!VDW5ZM{*C+xJH34V zRQ;wx8+*G%`0?G$)iFrC*t50*I>FI7&Rb$xiQ z)A!AD%F6DWYbH8<|8;O1E;yDa*Fg_(zJ$Cu&pfAy-#R93AGB=Ca<0jqzC0dl-){*& z6;7|IFgsUl8=ZH2*^pt}Be{KH>8b}jPmagede)Xd63X#A<7;2R+THFG_S8|gJ2EPA!A)a@~=i#>lt|IQPEWUW5ca`*gI}UDtbKBK#mmHq{<~6U+ zJ&0AsS8Q3{XZfaOY3mZzqUS2AgPqL!^S+}usrw3pIbGDU`r};#UvE)?+H0Kd@ukxq z#2RVSIt1fa#Rm^A$1fbq@$1RM_*LT9_*LT9_*LRzyer(nNn89Dev5b*zeW57zeQZ( zUN3MtPuiqO+)QO8DtNerKs&u0E;`uH;S`52_)BrSEJ~^n-f@v&=NuGdA(L z1h#d#_(Yky+}ah&TY_^*ARZ+b^~Xx-z7<_yXOH3@D3dUs>m}@M@fKzs{RQ)qzQ*eI zE7X$RcVXt(!9LUIMKvRP4@K$ng`kK9TdkFf$6Xv#x3^ zTzQ~=$*zvbpMrgAV|QH$D?fnF9~xjI4s&q++|C)&IHta+A$v#qF7BJ0f!`JeB#o_o zJ6w0}1-)sdvkpC`a;Gw_;OqJWb+zZWCG0X#P`tJ--nV>(@^$-xsx1h0*qnFu-Nje! ztB>7@@^_}dJCwfb2bdXm31+{+L+tPbRoq4PCg48OXA~_i z@?BPoU(Dk18yj{AKZLRm#-qGPQQlus-XG9^PH}t(YEj;AP~M~HL%%~GIf&Ksp`W{f1dm>)N>|}(IGCe4Cp}v`cIm;TZmi`u zr%p-Thlw=(74|LksJQsO&bp7PheX&~bmTdVPFvV+>IT@8T+Wfy!Y44dZu_wGy?yri ziqKv~35aDKVhOyTZHM0p7k`9UK8;vDglnE{_XcA55MsF&vHTZijJlEOUYNFS6WR{7 z`w~}rTmECug4m56)L2iSXJlr!`&l^F?UL>b<6gB}@_H3C7bJ}Q{PL11`=;byQH%(? zF>rT?PG5FL(R1bJU|;O`&-g1U`h@e>hL7q?;@8K&(J-byFzWzzvnU&~sW!B0Cw}`q zzBrJ$H?MYaC}D5j8x6Z7S{(sw*6lfsw`;F7Zr%#o^eh+rZcVY!%%3#fe+G%&A{nKBOLA^~EmN zaqIFHy%VUdz?e8bJT9cIy9U29E-G-=oqQDEwCohbHW9zKZ$vx$I$|$}br{!|=d8?L z5sW)_BKC!Nj0IhAJ@>?T&>z=yA;vh&n%!BBtG`;^7oQgMjk-T(rAmu^MBN|zvPx5( zocmQbC(Svm?sq=Hnvwmmdxz_lQ*dg>y0}Sq1v_>;5sJGr@5q%`*XwH>*J{cCt7{cA zYYV%nC54?-?63^%c7L%-jStMk%-zD#*suOd>{~w@d)(iwI2soI5B^4(qeCc-tRCnA+N%Sqy7Lr zj7rXLFxHo!osvjv=So#aOcs7n5=v52mr3dRzQMr7M z-m#-f-L>T54yvJ}vrTl}J?|e>%L?O%m(;oc``%rNU8UBwmUFxfcAKKa#-_WMJa7uW zD-URQWjkLxg&7%B>NbY26l%xfWr^{H+<&HbyX}SUj1Z>L{&bY;UXw=Jx1DQmeS|ey zYJ#OVJu?)TCmTD73Ku|kD~a0 zGKRHR=8EPe{?5Ae zdg}2rx@{f|?}PK8zC#Y@+2+p3xTf~IXFH|Ww^f3(ZlloUmv8j@FPWS5qmM}(7oj>XTGt;v?StQe@F+(4aS->$L7qon9DW?Q9Q898ewU$~ zI@GPMesfT8+RfX4`}!-pH~sOAjSxjpW^J!_=fr${MeVUWx7U4g;Fi2UUiFWW!wY^d zN~fpqPZ=?3ch6CGjQIU&f4CuVMeLm;9&FAS)2*f9;RA0Tx-H)~=i&jQ27mnGl!STv z8vptu$rt_E^jyl({)4`K>yG0GU)VG6tvMSmsd{qlX@?89{k%)#k6$VI`MbaD^{1Yv z&KjNK|LxhU9xp$1$B|HK*`wngtg5LDd)}-=ADmnE!(+9p7tJf%bN|tK z4}aWq#L=&#^@K0DcwU$GORoLd;42r6zHeRrCo?bliEmDiL1Sj;&)c=8OX-LAjVfwr zU)J^P-^PCP%T>SnCUfiZo_7vUx#5-r2l77Yx&Mbt{inToc+Pq8Z*;xv(ua<{bTsNo z5uP!XzkAxn-OKNMvZ7o|2G$nx+Cq=t{1AO;t#!j?gP_%HLt%+ z(wp8qU+tOq#)h5~|CV0=_W|>+Sbg8dQ(u4Jv11+TiyxkvI^{Prhwk_1*1ym!86rPt z|L#ETS$S*za^U%24j#TY;&F$E$I8pt3luWB8jre58J&)(^)Ozu`xwx7X>L!ubt9JN!_|@ZUtGKf*ynlSv;P zrT<`5`cqN7J1@rMpBR<@y(s-1;TReHeNp^7QM~Lk!BH-vV^nM=x z6l}bDt%WJ@A_l(KMDJ9 z_%l4^Mf!JIcs|ZF*mTs{YJ<(o-w`;6NBZI_&8Mi%5$Rpk;RwEq;ybsb8*n(7$;Nn1 z*Akvi)BGJC-e>dUHWm6lo&Jm`o%!AVX7aoJ&G3(h>t}ebV`0ef+oJeMwoLlNH7dqH z+4LWunrw4U!>5B^20B_@Q~z_-3la4_OMM!_pQ$dkWnHE7pQG!u$x|NdBQaz7|A0QP z5B|O+^+!jyWc<%Z9z%v76veNK(*NAUCquV8GV}gJ?0@V@CoV#oc@}Nr|E?!}0P?eK zI(zbWjViyu!yiH30np_%4wmPRB@p2HjO5RV;-mFDN2Pa(;=4xiXGZa7Me%1x@yStq zN)+EMia#fcKR1d$FN*K3?qjtmL~l+n|~$RjC065=5%@Uqx5fz;wRb++$-x0jOV!?1N8Un zD1HHCq_MiZ)71DVd-+lNzcK3iOnb>u=?ReeDvT0wz(D24r*D>Fh(+EPSmvIwUnX%N z2XWpGzA$Pkz}Yw3#gca%<#UXjSmc)hi_I$P%r!d1qC<)75z+xz>=TR5xs+Gp1R@qW z+f?SZ@wXb8+cwsNR{{Ix;{+m>yz77^KExt_5IEERCjTU`*xc&D+dcSmVBZ3qK*VB) zYt+h|x+D+28`#GHfQUu^0qSr70dXA6v~%PhqddvTw*iaK#FCd|Z6<&8234Woh<#$w zxfwWv7Z-^8O(k_UcrS1!2O-ekDEArM7yU4aKe&TN5T9Z2Wx&!F#A3h9BPSNQAK8-5 zGI@EeW!iaPeJD>h@@#x$;5TN{#W<3z4*Q$niNL;YIDv@8{*}P8H^$Y#vL6Pq=#&7< zei+0ezXsTM9Zn!(k+XS{&ZE@KSIG2hsBXiD_`|-GVf|c9d3U3;4j&SKVzJ47C4TBY zQwagc+h;h)$lekO#D1-!*RGPfbB>1C>;{~XYIJ%7OWz}4?T4Kw@(bFN0XF2ItP zYjb6$8Jz(hoC;AAI~OPeN9F|@sv3OAwMi^?9s^FIB8dNIGBY()`|*))z`>7z)z_QvDoQKxosC>k*9j(#3E;y#165@Sxho7 zAP}+0`vIp|IkCt&wkKPLSmeC!QY=F(@_g#k0Ek%R!+=w)oLJupz)3&E3G@UGX-8tw zVgHnNBo_HzVBfVkfrv%^I&jipN|kyShu}|ueK%366tU=k0W3N(=)>YCvFPakWj|t0 z^PSRH?PAgC#r~gXW2CYF1aR^w z7mLmo=CyKSkv{`0*9fu5U!nXOV~1GeoHLejiIKkvoXJ4~^npj8SoHq}EZ4{}U};BU z(fJBk+L2h~onzpGy+(*d-VIpxhUoz;{l5?OZC@o8eLg1<{e0@!dJ&7xDC&$cb-9u{ z_8K7;oigg!YjY;Bl*{iDQZBLR^E-v;-%32z*k1@N*9fub*8s~kLM-yzfaMw?7Wsp~ zNh6HS$AB|0HTX&342!n_Cv(6C5lh~!z$sQvEb?c8GkUBJoXjhtBY_W-9@ zIkCuJ0T!Q$MSc)i{5%XS_TQ#_g0cTDa5DdyfQTjU2f!&-PAu||fu#=T1eS>$)t^;4y1_I!-ZB&#k5GXgng?un8oGlx!2DxmX+}J>k+LbVo>tf9Oj(^M0Tq8r3N@YuevHq zRN01X>YN2LTB(UliY%2nOsy=QUsX{&yN&lGtRL6YU_`()A2Cz(``(E_yynci&Rt>K z#`WayL`X;?R@}C^BD4Rt^9+E$BnQ&n&zjVLQawkrO6Py=3y# zkwYhCiyA=dRCk%{aO(f?or>2mUf{9}Q{P^Ae&`Y4-;|~joQV?*8}Z%%MKGi3E}WzF zPPJ+L5Ix>^#^K1rLF#*!`5iS4n8h=#6AnIV@Y>4<&-+&)vDXd)ue}klw+b@a<6|MQ z*MtmSdk2wbzmfsD{_z>C*WT-}$J=DuF4mXK_N}-z`w`+Utz(TsU$3kL{_m^IKJJ5h5#0c~R&Wf_f^$6cX zI_#NJE@m?uvX&PANjNVInv4zZVpytF6zrl8T;mO@M;#YgFt zK#w+rL~n@I%eD#Ap~vrELe%5&bDa1oSjawX~PBthnr zI;3}TpvzQh1}Ey-uO3_@3lDR2xdr*jNP!~M4JC0%pUd5l;>JC|M!(r z(`H>>$a~J#<+i-GYm#2)i${#MPs~4kc-@qf(erklwwagM4>PjqpU9>L9Kdj@xmdeC+tey(I@=ofb-m@TBq>k!cN;T zHy34?cL+qU*Y;7{oafS)6%3KpbYzaz=)BTZO=y*6%3a0Bd9K~)V%7w!+|bVL1u-Ls zIIb7x-Ly zqI6-4itU}KiW5t*r9FLS9hdan{cV~*!CATezt!%w!%EcwwM?Juhm|HBP%Vgaur5J~ z_s+V1LsGau|BmN6!)sfUi1$tYPhA=C9sY`+;wAh=+_8qA+JDKS?XeFIkMS)X?rdFJ zn)IM@3NIVF`nj|I%YJUq(cS#-M)&`hSpIiL8Pmi5?{BflXiVDf>%g%cYlSV_)aK~E z<6AwtZ-^ep=O2UGX=+Ba(N*jL8C zJZaCA7p~q_vSa%8Czg-Pcedky%L=Dp(Xe1g)y~&R#mib@%ff4eJyydtXfc=lUyF_` zfj8@$mh8k^AMchftj0>PSlccU>k&7wq|#MAoYHsd9N*G}uY-yHSZCc7tS08p&c-;p zxh^JH*hSsaCAc&`)^~mF@tieNYWLKRt$Q{+&v;X9QBmo(Ca3hXCbei-?8Z^5er2D# z;^RuE?NE!hV}-h}o*0)p@%D)^mw!I8WYoS<`IkI#N$Tj^M;D^LzW8nbTD&k2zc$ZV z*LJ;q9Txtp6yJ`XSl(yFre)5^K+R6or*=spmidbh*7iIe+}uU=SzDTfHzMNOe;JHV z`m%J|X65U0fl6OnTR1BGHb~k74`HN^9oA8$Zx6;N9Pc??Tb|YepBELTul3b_b)w}L zYtP2Ynrkl@QTk4c;+PnUdkbqn#>YO<6uYal!dni<@$Sd*+Jw@|HGC%yB?a2Og|`-N z!wi3n;0f=|xv)7N~tQuVo|3NPPc9`W?Z#=Cu#y z^NpB5{G=GHKAI4Je9`l@ak0DObgtuP>Rju59j5)uS+~6=UYF;KuZ$_3w$s?(8K;7} z%mb=64lN!NsNI0}I(nk?ot-MZd4$>%u0Q_wEsx!>EIf}mZGC%{_5fFdYpZqGHXBCe zZdiNv1(yUnHm&t_Ld{qsmKYy@y!4%|s84NN={qlB_2=oaeYE#jNiM8`w9mGxuV$@S_$tXMRhX6|4dw2glGl4@)Y*7n1aIlAUxr$&Rp_ZY zO2;Q?_V6jU>lE*6(ET7bqxOio4#YN)GJYMQq+NWo= z;!zYAt18Mei>oqA=izDM+_Bs>aHxiUgU3QAA*@q9w`%^4R!L(u6zPdJ9b4`d&#tJt zQH>4*q_(rE*jKfxTum_NiAd;R6XwmIQ9QTersAp!>%gTR0luIY#dT~$vv_t9Ho(=s zK;KVBU0S5l>qgZ5^AxAOqsr%C`O6{L50i`G6lRk1b9+p(MR9n)QP+Dx`FuR79b1iu zxbxKn&G_dUE+VNYF3IMooQIl(4Uf}Y*l=WGQQYYfnTF0QD_1s0DX~%4;-a`XajAN~ zuGWNVtm%XHn7}qjw}~?4_aHBvxWQWTdVX3FQ5&({(E zaW&d(dIf4fJS_8H8y3z83th#cxK7qgRYle8ay3z(4K9l7W7Ep!x;YB)CO$Sdt*%%w zv%F0AEKd<$#iF<&HhblQ^6IjAb8noZ#)Xk9YkzyMWx>xg${dI4)fHu`2+idmS*D1? zsb@2_Y#!QvE_!t(_U)Wor3y6fM~@c)J8`Bhw|Z{HwbkV#%b;n(f}RBdOot_{RnGA- zcWHTMN%4Y;(xLO_;wd)D#4=9#6!^W8qH|8O%J?~=h|83!OUiHb8&q^oPn%eNLlwkE zT6jZM`P?!@&a0@q7K&U@U2;u%Y1NR~=3lGaK z1WtToH9X>?bJA?C;_9lI^X6j+iOe@d#5w?;oEIiI@$rdx=7#9cs?0Q`A@Wnk_CxJ3$|##J#^x)XU4g`id_%S9B>D89iSl?2PpFtNm;3heBK8Yo z?dvNVdU_}tH-BCg+KI*6(a0mQ8T43*3{@3#$}v*TsiftJVEkduYPPqoUpjQcI4PCb z>q4Bf_`RMIo9inURL{+vUOYFmto*u)(sDJqB6C8~SoD+G6~%K)%l*SD%4e7Phs-Z8 z_M=Z+KX3jlfA3*K#$KR?%)QaCTNr!Xn99){R%#=rl9yJG3W^7?KrMKb7j(WBR-GGocaA(otvWpYwfLus5qzpcAuTm+SAz z0*!E%QX%B)YMG9?nn4hn5PVZxBiaT6wlg^rrP zpg6Kym|(={&RAYLuDS%H2(EGSKL-P3;ZXl9uoo_hbM*g~^3sA4D3(J1^m+4<4qgW| z76aLW^3uwzf!Xu3G(uQ_Y+|Aj_0O@1sF_9mv$HHh)>+}Kg8JtGUDzWwHm059B&rgQ z-<9*`%^rs>eUUHB8&(uMx(VYtoZ#}s5{ z<@B|Ii%C@602*1c)QB-dhVq((t0t;3?Ie*dhLi1uha1b7_F)D1=_;6ujS5(N!kDMC zVFfa_h>oH_kHZSuef~FVhryK=jN|lM>$t2j<8*RjRb@#zMr)Tc&#)O1Vb3LuhTc+gk z%D(H_g*6fJ;f;yd^U4IvCo@ZVUYS(HE0gC6UYYch2q!EfHptQ!sdKbE&FZ)L@xS*q zZuPY%IBl)~T_i`VaSQT<6A4rT%+V;;kg;X~Wynfz{fhIh+ry*B~Nv(rmaLZbS)t=~dj-e7et zDz^uPvH!KMUt(1K4DXiLdhY|4Hwd;2wb%JMze)JN;9|N62m3M0i;Pc4^`3o*HyY`D zkDK5Hmg7hRqk55v3lHT<}+{Vu8p`tO}6pJS%M5t`WfD>-s=qoN{jUkmQ!Mdu+sEX0{WrYpe@aw&=jie<1y;a&gFi}JsF zRC(RiS24OcwN96Z7n<-R!H^CoYj2a^Ezj_7dEKMROVj1K?QM9sy$$a-F5qlm(0dAymHu!V=FJg%`?p)3$ZZ}_vK(o3Rv zwzVOn@0MrybEEYAQGA~$KF`Dd!&+vah*6o^zg3=e#%o#>zb=aZGKzmPisw5?hK#>_ zFUiY)7{w2^eU9;pjHmI>UIH*-_yRF!d3Ss=={=&--Tsn^-}S?Z02iq@(7y`M!McFs z`1t_Fx68rvwt;*(z;y7qyj8~Q5&$K-Ed|3(}*>w8pP;Bz(A47%i1&R@`W6&?$iv?Q{E!~+3VINX#5c0MfVvwMc@F8~-y&uNnf4l@Dp3AQp7cpbH~?Pi z{{#5*wkN%Sj)n8*tJ6@C4?XFeNA9K%Rh!}8=brTSbOdC|FHlQS&^Mm+GGI5oP)&q? z3D6P$hcF|^GsZ0PN9yOQ_ffx5@JaOl z2FHI4Ui!<^h<_1y6OV!FCfK_IJi|zP6H(t%Px=tlw*ox=bb2p<1s=X5e7Oa@ zW=!y>_1{53jUFCT+tgZ*{wwhBK2Q2u_=kl&!}+Jczs(-~e(>)%p7ieUZ?}g}0DjG* z{}(v+26(CO@8RDc!NaWfZyORgM!<~bBjXtz-$7~<%ICEx-;yv)`h_Q z+RAuVAU=J7CH{lq5AWY(yvl(;1>hxqDez}Bc>c>`{vK%mvA~l5QxrZPy!6M%QITTs zC`Riqha=YjOaANO-)!)b|4R5*310jiiHtXcm-w6uM;3z@|GTn1J^8;z`z-@6|DWRE z-#YLT&sX8!qu{0dRY>?Hcq#uH6dVGN*J`xCli}Z9VDbNA`1b~QDgOc_90m`u*8dj% zd;l!v9fRY%=a6{31^@62KV05>NJs$hv-y7s|IP-F4{fg!hRz2s_C~?KexCff@NWS4 z&Q`x092pH>%5&h~72w4l|94b)@*jkMbHGb~`8E9GJL(eu9Wb;UJc`l&G{R7mC;vD& z#{KieemXM#0=)E>Gm-I^;3Zz)z#qO7F7ZABMZW)yX43XwgnzrhOL<%1-)o-ycfmit z>m&IefPcK-lKRerBYby9+N&@8`^>|4fPeq;#34^a*(BzrTQgC%{X8S_wl*Xnbk^Diq`cBle2nA9r<- z>vb6X>jPfmaVh-E126U>$G?l!TkwzXK}!B@aBQ|G|D*8lR`62Z?eK3g_;7!Le?J2+ z@tO+%?(*o5hJW{h7k{$g-><++eY0U`hetmi@p}Qh^q*%LKk(xJ!|?BK;HA7(0AG6a zZ-IZOz**^!I zJAxN|zQ;wMMgKj-Z;(fS1N<8bUgG~#wl{c)wf))fuf(Izdx=@#yV~@@@NbbPKUT@c zjAPfIj_~hp@Y0^20sj&Q+|c&_g?RnOqrU?QyTFS-wQ%Hh@Z!%@_{V!3Y2VTC?^Ey+ z?<^!FAO;s$`;qa?i@IML62<37@k68df+)T)iXRrm4_Axe-!Bm(ghAJLI{e!L9%0h_ z1mI_J;7{{>H*_}`sjnXy_j~ww)a?j(ssE{H-@kxIF*^Snh~F^}efwh0cgKN0Z7%>@7kbk1N|eg+@R9KysUG8n51YuQ^WO-6+Jl$!2Em`sp7hS} z=NwPE1Kb;j)c*q*>hIC#caOmy{Se|a(xbl)@tNe&uSMUO>d|k2f7f{QFNc4;M-qRN zQSd^K{ujX5(mm|Y5!C$-kNz%XybnCg==wek|9%OcVc_){8J|nkLiqP0()~8Q9R7U- zUdDsD$e6%3vgre1_;m21{}pf+V`kGM?T?8n?^0EXv5zzz2iIvlqB(Qo|FrWX(&N=u z%a>{WMD=5PhS!zM*Xd`gnYKKWKSd3+ys>|dS`=abJjL}!NJhWAI%?}L^{u)Vk>|LUVRiUF zC>i;A??W8GLE>1QV&%jlPX$g!e<2Zzycckal@p7+4{#C(9uS{l`FP`KvFPN1&p@9g z4a1RbBK9^02+)VnUw$$OFQNRr&u|$$l0{A79p|7*%xJfLuSil06+|1hM&mv_vG#_ zmb`R5#mb3APS<4*U1E`UqdprSL@aWOl6p{zGI2=%Bo>{1OzVjgXb_H!G!1opq+X1b z=+mE!^NkMeXZALjXV%4rH>}Ugmvy0>SnM!XQWtOBSeDc!x?EX{kad*x3fWJR(s2Um zKFNy`#F!^vbdu}H%3JlxzB+5`K56Bx`ee4zAAk>uEwR)w4>-dzx=&_702+ZK)A|_$ zoYbFEbI+2*&IsZqnv|=dt{3aVP_vF=pWQvh%85m;>rO{N#3E;XQ>;9??wJFrZT5$i zxUuU6lwTb<8g{I_>b0G|pg-KgrflVktKXIK|3|Mb2v@+1}6*i=6RHvGVBHW{yW9h;d+9 zr0AHiEK+n#WL-jUOwyqz>k<-+5Bge|NGrBoicZolRvzs`@+6Zt+J_V?_xhmQIi*~(k_e3i-D%4aKY4SMn}i|8iRGr zt)INsGUggN{Yjo@;t}mzij_zEmRxD_dVS-ylVat>61QyNr1?hwVtmN|ePYq!keac; z=!_!1)?f}*nbuEAlB$i|kB^M&45t0$>s>51b0A8wa$=FQ+~gaKzSoC5h*GSaSoFsN zXWWDnXbO&upJ=Gpu1d0UhB)bFBd5Dbw;0T7C*5i=KQe!6a2-B;TOG|1OIZ!TnG3a8 zJ%SI>Ar_sdfTi4LJoshe8*u{d#gVZ{L-iFtGOeGnAU$kU0f&zvukM8`pcJaYbyB0BtD?W;FB#1e8kdx>v1_#klRYJ=aTyvg8qiLD(z!w}zy zrQ9!oGa8NlG2l!#2q+=OZBt^=KNUEm+31`_ooA5=L@YWzD7SSa7Wu`%5@)Vsn`wP( zhx{3LXfx)Xe67LVD8JL-e)veb%iw%`WZrEs&rYhrwBy`ka3|t>4L*x_oxy(M`wZ?u zyx!ox#P=IKfcOD}+2@@N2D8sQ8x0;u{0oC854R~0;t z^1ViW8S!fdU+KYR#QThVHu3KbuJqs=i1!=$LgE7k*Ld(s;)6!Mn)r~xcX;qR;@6G* zLE<+IeuVfW7Bte*2ngXyC4j=?-TqYTz<@vgz0D7UyX z@sEwX8}XkE_IofTj=h)DcHXDN{yzGF!P?HB4c2x(G}w<1=OcrA6Mt-QU*f+Q+>iJZ zgD)ojtHHWW|7P$A%0D%D9Pwuc>o)zn!Bx=s1d4YUx4 z^G_nBben!@FwaiB!Mg5W8?0majloIOIc~6y!?yDf_zbQg=0F9yjo8Xp5_d83)x=#5 zzJvHogYPCj%iwjyoSXrAkT}`kM~G7lew>&$9iS(P&oTHJVmonl8}WHYzJr(pC+Gzn zPIrU%67z-yw4XT5;Ma+J7<`x*FTj)DBkpDJhs5U_{0T7!W6)>B7a05{F>iuE-w
8=wnSpQ$>XR!Xi(BEK+ zoE(EWpT)5oTwP2|0Vt1npur=Ed9wx@P5c9c#}P9VXd>|s4Zf0iu)))ae`IhOF%5%e z5)U!Bk~rVsD&nCA-#}bo@Xf@92G*;RdfHrn8pt`nRTbI6I?^oFeBEgF6$m zLZEKMV+{5ak2SbA@udd$C1#~T{fK{T@WsUA4K5&_VDJcH1_m^axX9qkh$k6*CGli~ z%ZM*CcsB9n23HbKG57}JD-2#p%wU6Rh_5nuB{6T7L92-`bQ$H>8mwbD-{5JKFEDr}F*_7!HgUDVsV*7?i))D)^%j(1?hS%Gg#Ma zxxu<#D-5QdQ^B+Kx!%aN&kY7^pBoL-gVoa3%fuxxs+Sp#anlhjXuy>w2v-_$%>EGjW|#{7u=1!QS|vB%Gn8>g0+ zexIV%XuYQaEnsb&ituVeQ_JUa8JVeAEofdF8wQ-TYFMNSt5uaw#Y#h5B&LmhCs@?< z`Sa#X{r6OLyv&{y#k0krCp>ni05?tVz;KcXRnD6FJ&F+;o?;^8-&MqdiW%QmMx=_T zkjR8KOR1byilsBAVu=M$DIODTrnhNnPFdR)L>{s0!-BbX--nYlC|gM`im7@5r&j&= zhW^=or}Fynrnl*tR$71+m#U`fb;Mek!j;GEN2XTmWvafzB`E3@syy1#GxXLH-;vc` zQ*+8rdPOpPSk>$MZJ4X>`_&`#dVHs4+f$}u5tdSSx02%7SnKY)975Z25s%hYk_6QH za z#UmxT&_&q+H{FFU%FcGvUFbnsZn_7Ch1q?>Fw2FmY#=vf(R;DDC~H7i=%TFLu+T+W zIborTvipaHSuS)@c0V`Wg)Yhtxalr*QFeAX-Gj2i!YmIA3$y!%VU`PB*}(9gG(^!| zB%C;)bz*Kf(M4G~VWEq-I+1h*7rH3BpPTMN7i9OF+*Mr>scd|Ut z)$ALFSuS*C1My~(?J{AMH6RRKl$9G6x+p6rEOZgpt`eJBE_6|LKR4ZlF3JwL=`M6p zcD9@DLJ#5wM5azz9vBv8_YK1=7rL^6{Uke4R2yLVCTrV8S-D}Mi?VY5AL`x)zN+fX z7v4L`2}uZe;3SAaotQuf=}8(AzO>e!U``AHDUAsgRK5NwuEFLKpdN9+6l@3o%2*V!a$@67xAy+G?(e2iBnyshbB&OnI0;e>@p{M&_iXDJbw>*sI1)c_n?Q$$~=D$ z8fc>DZ$Ot>R_elu9`txux(8bk`D=^oIn6~Ar@GKXWm8<{L=SqXY_jL?K@XKp^87vM zp|Wz%--8}1EA#w4XdrA+CKbzoF0-uEg%dppp7Yzv`Q~(f@TgC9^=oADy4BvXUst-& zLldXDOb<<*>M}i4HpOL5^q_~zCVT!K^ibI(&)zzQWs8iU@7|-KC9#SK(Zlhqa$QS&||2c37NmI=GD-b zeJ!R-(!{M$#xSXxrra`(c@wz?$fbaekO}t`#_yiOox?e_hkoooxx%OKLGT9Bcd1X` z@-KM$I0Pd4p7QCVu}k4EPVD=UPv52JP!juwKv?w61UA#lu0}m<<){>WRXR+>;bM*j z^wj|~z3I3_-*x~~-{TKlqn^qm=&sIL$DX6Z1ziN4=J z&eT^2eUHGO`rzg2t3d$MzC6%n@E0fgq5!784-NY+g0R?^>(f^US`WcGDn;KIpFW;T z+X@NVH^R{O28=W9yC2~OsxSQzGVOZ;`lNi>r7ZUSvrpgq(5JgyA?4-YGd_Jwzl3$0 z;L*NpT%zv?Fxc+%!87&-vX8^!rhPpT&%TSbAD@rE!)5AY{hkh){?fsm>1y+Q1|1#+goNr+VPZ;YX@+^6qm&;ylkiBI2~(Dxej(7wwIecym_ zrhN}0+(7xa0YdPyBDm;ITkZIq|*I^78JeKbSLm!8xOnuxRq*9a^ z`Z)Y$>gz(s{!++M-{%Z{9F8~j9Y$k2Q2YF*4imwhE(HxcnrKH~F=4~N7?F1L<5i=dOQ?0+ zF*JI6>7kv(8}&Vxb5IyP;4xlKF_L&k0W-MhTZu-G&zm^WHv$aei1rB9SynCrQXlhC z^zHK5mwTyYHR~|EiM|~^`%3G*d||sP`bMFioAz}d;|$lX80%z|?mZ`d)@V>%j~y$7=foGT7Aj zBJ`nYbDik>A>>Sb&wSN;-q6&z_I(bR`bxEi(U&KF@6wOg2>jt)+})5fo%l@x6IHNL z{3yr#5GQg02$|=qaVYgfTjd7`eq`@u&Iv#Y=F%a~1D@fx|1v`Ryk`a#0Mo z2!T7xh>mw&(oU&zqmOb@pYZA6$VuI&+)^#Wo9M~YSiBw(pzjhd>!DfqDK}8v=ex+P z`?*>H?V%HWXu1>X{#nowT=ZwXck6z`D!1OVa(`OgpIADvOx6BRulslBtN5hu=OFg{ z+<=vzhih!W+SGi@nzrZn9NBmHc+c!JwXe)QJ^$qeeM??icIws_H{NCUPVcy8>!Gbv zw(svKX)W3|CE@(MTjOuIbW!`prp}>(_haWOZSR!5f?YgGu_fC%MbW{($PPV~Z58cI zj;2_TMq|MPR%b?*wanF1J3t68ba~+6it^O?6~ECMe-q8meawni#v%u;r%};yf}%CA zYObrz?zLyd&ehoEDf25D)9h$Vw687i-ftuC|Gk;}endXnxWTbuXw~oSuFjzu&p3bI zUl2bSDX83CnL6YAye0Eb&7XeL{+se{zW?T=TNdNw!t>FV-au5e@Z`hu(Z)1WGtTVY zc0O9`+VREuyg>Kg*+Mi{^2edc+1BK$yj`*8qt-1ccGu#RJJ54?cd(?WS~1zQMGSqtmi1^4qZ{@TGZcC*_qLr6v~{F#Pp;hRZi)= zX?OiBLF)`tEAlE{$(*_pGJD;auS}4MHK$mPu9tD5bkEvo%gp@TnRb5O4=tXGJn0jx ziUm;s*?5=sy z*doue#F8Gk{0HRrUpC9`GRx<{O?FqdV+AZi+~*N@e-u2*0b_?4SUiwL^zDt-w#~lx zxNB$kHoNycLbINf2M*!XX`GmO?x@PQV|Ld+-?V3_S2ygg^7zpR&mjG1L+7^CW8H1# zLrz=C*A1~^!51u?1&UK9?XF8^h2ppB+zq8#NmA++ZmBbWJKJwfPClApU7yVw*8L!{ zs#PtO@r>Bn8k=$3UFO-dWm`*HySJ9aTihDm5^bp(p8n|c?^NGXUl7QyF2DCTI6Zra z6}orGN3q7Q;=E~Wk<}Ht_mBS>YrNPF4cYObL;WeX=uP>Gvm;VqMBi_VAz`ck`YBegJFArX5 zS9fco7SUM1T*^i+Wh0lekxSXgr7Yx9*5;y$tjVy`?p0@|7qzBU*uAqN5;Cn)(2sEf zt2#HGdwhKjZ`)1H1E0&g?C{~O*R)@?bxOznR-DYcEu)RC_rA6zZh98DrCroI-^H7v zdAmYwuYdgH!K2nkqnf^T$)=KBWxE1_SYx-v6J0|oi%@qH+wbo7O?X;cYBJj9#?2Ve zvbP%Vk}f00wwm}EH%^bgsq)F8k6JA~kItIgfs=_-3R+`l_aaU!WkLMaxOdiUOGkNp zo0a!aK~LwY2P(3QpI&JiD*cdBmsy#4d?=HEa6 z3e>5vRe?5toIN{UME*cyZRF?L5Kt^{{qYUL#gQ>hvMmW7%eVNtBV!$V8E+# zCxxT4udSUor!HEFgQsQ|&se?e_N#Jv>W~~k754FQYLv;sSyb4H*$qijpH1bL!dYEB za>~!vCsBp}s(-h93D3N^fzAp+SAgMCtS2C!As^G0qJus<%SWGaHKbSm>`W{8?XoZ}{k|o{SjvQ za~x5*6l(!6b(sG941ew;`AwhyBZfcYJLjXX@zIqAEq$1qpfd?O7xDKn-6Ob?(0fXK z8w`2UYkf5Ls#H$p=luqq`248)Q6l2HzEt|?1wOjgN4FYuqW&~%yN;X7n3Awl3GH3# z%BMMV+2{X;K_{k1<<}jqzoPg0=(~LMvp)I>gZ>Bi*&;K` zN~E)W^u?B>WjLg{*PdRwWW9rY8j0t}OPlJWYjV@7XubT!v4DLi+l}~1@AJ`I6E2Sa zzZC*^(m(gn|K^h~gk9n&-{A9q%xB*w5yqYJ2Ym7$`shFV!gu<@pYX|#^x1Qf&;N6p zo&r51vD*D@pZ+T}eHZQ{Vd2+(;SF)e{(th>^J_zZ>C;QA94XST`Q(rKI%m(H@uXJ^|Lb}tBSY+-77MV6fhFD~d zP)2vM9RtqM4-~P;oB$r9`NYD12{@!1J7VF#0vyIz3f);;L5y3_oyQeg=s*XHJYI}e zkRADOd_IbGx`rEg5^xyfRCLpTLyH{fV9^ty3?DqWS(MRn5sOS6W%x3N<6MK#Vh@W9 zm#m2mcLN7mkZ@f7RXjprmb0Xb%btQG75{s{IUx^=PA**$Jn3EOYstx{)l-K#N2w3uvSoCxJS!6Z@OM6#oMIwVkH@jy)@tylD@!QtTua{mjGgwMyQxVU>qP z=0-z?Sr%HYWQav(E%~=AKC$pw){>vZ!lz_7%D-xEi|o%B1TD`6vB*35zlPES`WN8ddiXen?!q59Vv(Wg;Ty40+u{q z#KM0BILJYAxF>K)SrCg1>qc=M{=oI%5*cEVIZnRL2V&tnbw;Q0G-Y%?5R1&Kz>>zd z3>jjPId8~(V8{@QOcKgk^ze6qfs6UVq2sdo#yc%;3*apzX>3^Ktm$8| zLFR8H`eB7GR_Vsp-r0z$9f@9x2lqm#axa){G9YW0sdL5Z73({|%|HcNGS%Uw1v4)u@Gup4OU9rAl;gY6h%Nii+ zrQ4KQ+prk>7AO(nGvbEzO^r@wuWGaq)5?a`7wkY_h%bZv>z4cG!iaz4%EjxK-M)6! z!n+#Q-oE0l1~tpAKhhs?&7wD^;^u@#wE8cUFI!S zLN&V`CAyeXpC*=&Uz+PYx1aG3=bYld>yF?z-vNVxroeGm;4g8iA_rZAvv&Zw;W`X& zNg8uYBU2y0<=D3;PUNnFPzsn4?Q!!+^hv`A{yZk1S0=6?E>qtWc-#-3IMK&XbW>jn z6fFXe`j|G+w*=VKcMKj6f+tS&@$RGMV}^ zb3A<++K>9K!)5Aw4f+_bIMFv93{&4zhCb?{AMfK3z|_})%$NecIMJ62VCuUW{SJ#D z#PqV9Mc)`GGxZ&YKK3Pw6Mdt=Gxa?See7SMK9;HIyBBrC)OR&9_woVsaSX!L_Xzqn z*e61Ls5-8`?`wT!;L*)TKih5voxfDg>rQw4(nC0PUi9XXI^C1xAay=HtqWU0JAMNW^a$i&OU5q1Y~AZ z$*!~tXozlVR4tKY%X$l1bqg#4QT00^w{nc~q-lSc}dN7+V+T3GzIlgI}$8mpU zg^jQyQcvccC^%koZ1(fDN9G=$-@_RoZ)5ggD4sFe?z(F0!L4QOkGJw{!qCv6R`R%+ zNlCk^p|3k`NAq)++O56$d!ly!-pO|UzHv5Y6U8&qy!kP#;!wQEB0*FHx6G#;=Re)GdMR$4{U^LJu4)nuzY&=py=ee?W=)U*n34o$ov z)P~tzbK0yJ=8xZpH{es&R_CuXqpW$awWcXBGqz)?-5EIdP2_4Y))VJ^vLGdKhh@$k zmOW*`jun$=XE0FXSQ;$}@Sg5i3|}V&Pg(KkeAl`U_-6NKTQd5KbtG=?m zV%g$RJsqgMWipIP|@n7`F!&s2GwR>6GQm|Z@(i+|T2pkJjo2b43> z${V^-8jd{;+MXaRX$S;1BcG|arMDwGH@<0CZ$p3flLsEg43{S&*KdcWX#R*tEl*n< z^YacMuZLPwv#r!n;N34_CLub7rUtAbNMEkq<;jMc-n|HUGX%3jOQ{Po4DtE=f=4Yo z+WD&q*08Fg)VH?}TUP$w&#cgtQP##$Z*PC{b=1PKKe6%)(=GqpnW$R_ooA*uv!bQ< zp{S~hA=_@j9JYHfhwUEBVY>%&*uIH5Y#T9$ZDabHlCAl_gq? zObMW5lIzp0?>79$_7Te*&gg>pC5tiJ>K@Ftx(BnZ?!j!UdobH-BW7D|L_FWz)V#Sa z9cA0_t^1ZyPtx&@3eI}kUiJ2!vBo|txhQHS9ZMdUVP(3rbna_FJ_N7d9t-ZW=A?C| z{t`3ytVn12FYQ`m?q4htuufIZK4Eu>#x-|QJ0qSu8Hq)XYq)ZQ_=3$5d82gR>gK4#WNHS#CAMo zRaYQHMac<#Agqn?^W1Wg1AIK>n}k!jke)eS&OT@*<7k7#ISm}6TY4CUuAhU+wMoZ6&PWMQV(>l$J4>Nw61-I;tK@VG{w+cqiRwtc*xoexmYviou&jvOBy6bT6mx{1S^G85T7?_t;QTeU9<6& zBK`p4Pui8A_b8tA0H1EeHNz^a+FTGo`-r*gxsO_xHGDMc$tf>lo?mDP+L(6_BBw^! zu^q2@d4UpPnVk|YgwZ+`AP zdvXITKi9BbofIf*tfkQ-}$7_+hME>9a;A*a;+X={n{d6F8P_^#*LfU?%dTZ`J& z7lZxkldtc#TKYGm5(TU6%!hwZs}Rdo+-8Oj`uY=&!8vzbE$3lR@70p*8INNJkEQYuG*eFeyFv1{7mZ%=2z}(o4v)&N7Q4=XS(*4 zPabE#-NdgHw91XE@V>h+Z$4B%50mm-7B-9pIB!2Zu^I*Q)biai+bie=; zQ}@o^a(qitrcRaWC zs*Wk`W!oNaou$id_sq5$RdyYbEfv`)v7^?p2)_>F(fRH>VL?v;X42NSy^1n;ip1$~kw$qrU z%zTj$cK@tMelEY6RNf@ca!tDF{LCe@PR-(M*W~gXoxD!k9EvB6-qei0 z!9@R`4&Z-j#hR~&h71|q@>Bb8GM19Z@cTG9KMm_DlC8}+s`aw#V$E+_+1JH(ylFjf zZTz}e@Q;@Bqz&O$NUV8?4GV_^f>*^iHD^_<+0b(MrMWGKS#Fzl+fh|sp+G9_38ccF z?l@a!JU9G)!dfzIWzf7B1@oi8N7wl1=|1|DkDl$L=lJOF`RH>#+Wk?l z?crP<<&=E~eRP43F7eS3AI&}rQ{O#4dXd|apyK1aAyb}XMkalukM`yltMCu_{5ikJ z4F8;u?(xyD`e@FQ~u~u(k|%pAL;nx<4L=bKL0Go zpW|Q3DSEY#nD5B?HOoi8=%YDqr<{^M@1wW)=tdvi;iKR8(QoGi1b-FX;iEVBXpVO)r{sSpqz=EwM?d4E5Bq5E zc~bh`^!cCl(VN`-Q1YD9rJSOxeKhAZnf_jRDft~fdCoO6<+(qKNx$jy_sUP{%kar_ zj+7am^Px=oh(RZoSB|gzE_KS!YY!EzhcTg2(bb|}(`$Y7tp=SK-{rpea-I03FV?aY z-R6c@^m-qCw~s#JqmTROhkW!|AIJ?$ewH|%WMc;y#y`@PFSY)U@jb>JViM_cA3fPePqjX;_4A#>`R~tbeMJtP zV*Nck_O%P*K3e-<3Oo`cSs&@}(;Pa@3TpaRht9CB!nlDrhVRrg@kopaJ*ef^81ZNpM5{ov`SCV`nis8IAllS-zcr0ZQ4k@FaJ{_!=3u{u@4TH zbf<&VAJSFYUUEp+5@<*ICqm#(x?bV~M(oy?eBn7)RUGAC7Xo+E-m|9Yg+BSEzWn_c zU-;X6^lV>#jrWDW*O&jpeg1oV`uctT9FG%6`&loR+i?-Uv90@@o_H6NGsRbZ%d0f`S*onH+7n$KvmF1h^+j#(ScfjLzN+JAn>7+M+`jD7-{hkq=B_tjT4h}U z^G&EK=gZ~h4u^waXB0m>@;2yyxbJm|CW+LF8#U*prj~Ms_@mTzU zdl6UhI0ss<;3o6a@*5{_8P=rPLccpnE2veLml1uS#TpC#6D9jAPWk~vHM=N0C6ap+MGi++Bu2TK+I zePWDL)A4srF)JM$e?!W=@R0_86mY0p$qKe2@UfHKpS4C|rHdmafK`jO%ji+m2S#8pU{CzK4a$dr=*W5p*Hegs&~ zt9R;TRLRT&KX|Re3mA64hb8QC%19nkM#p;xu*fu%uj3^aemk(_|F?jHRZ2hWv&8!Z zaOg?JCzi0!P)6tNG0Nz8iACl`@^!q#!e@P!cL%ZX-vkzW&KdYU1Al1XB-T%z_A~y6;9!m7&%rHp(8D5gBUmzrdpU4$rjl8STj*&Ii~M@9!m|{A z17&nR5Q|JRaPgP%2W}It&@&Enu*kH7CG)&l|7E`QW5i!k@=p=hD$KT8<^lHr%beX) zz%s|zX`knU0q3;OUsd=W+(P=}kyvct9PUt;k|7rUB;cGwmc?hCSoqU`$7nvW@UI3A zGb7=gdOlC#YVfItj#%VtfvJa%SorLl6F#x<*8>OVD|y!c&_8)tWLW=;Z&Lg=VqNZA zD9_A;BNqAlfo1;sLEzxcO6IVEPZD!-99$pe7bxts)&J~a(Rm&+#j_Qk?RE|uFgRk7 zc^`O;<`WAa9Z*(ykt1%g&WCj#vaJsN55*@Id9HH{^(a2E@FT!MZNnVm#Y$!_<$FCW z@(T?4rNB9dl?<`SEC(K=`NYEK@2b#Gl{~TV?*^89XeHLq!nc5fOO!l+n+fhRWcC7w zjwl&o(fJrh|>SnDSz#21%#64tRnueV{m;nhlDih-{ozFqOB z;})c1xH-5)o{xP{hh=K(%&7%iIN4vBq~(W}TAZqat<^i=9li$e#ob zvmt~#hb#1R2Rc~f-v>)<`!jKqlHvPQ^c0Z)b;Wn`{|<%A$k%uh@tum#JeP7ImbfD1 z>vAC$el>8I35Bb}75s(+opT_IwSFc;a2jyvgpwf^Jx=|(NAVqdzNzrlxCNUP<|{VX zqVR0o!WuK)kZvo8MJKaf;vyFQ2H@gN_yfms5loigZvh84;}6^exP<>8aIlqJ%j&`< zc||PxA0hu3{=g9ne?M?IPOfDg#1(FHpmRoU@x2P4#x3+O9+t4Lf)&;_zXdGzqyh)G zD*55W?Fu{m4uij4Vdi=GZxzlka1c1C`J;(F*w_>P_50RxU{3~NkU&UI&8a%MZ@lJmneiTm&e z?y!Bxe$M`t-DmH$2V8b>+rkYvpK;lp?h1gl>lQDJEpLe3wh$-$ZNPkg*9S))HpFm} zBaZfKY+7RaFpOH@F@Q(o;Xi_l*I`~Oan*b=c+hFqmBT! zti;KarYz6SbPW|xtlt?RVwDms%D~B#jca8wj|eiwxYps;xNe=!Lv;e^0Bc($lN|w3 z;n@NUKOrcN_FMf4-Z+=jzm`a1KsLH7jbzEtKud3KQ%h`^ARJ1FWl0IAFhYyDB8Wu> z7FGkTZ(6r-{p|~NY))COZD8$SdW?fl8G`3Q`q%?oLO}*F!e6-JNSzBaNPX6ockzmW z*BR-=4pih{TYEbf8ZBv9x_;$4)O8xnB|t7qXHX*3kz2Yvkx9vfpbfF5!WuZ?vBj$w zF2&KR16Ci_fkC{OVM|u5=b|XFTrzwuRu$d8%4O3gTvBJ9dbJwm$75ZcOuJxJ)xgFq zZCKLuwFIqBldyQ{Ql9WCMld$ohJ{tm5vvJX6N?Z$DYMR8iFLset%0pzIOAZ^3#)9x z(k-RKJ&S1F*H^5MEib`F$SWJX)p4xo384%#eLjQRWSmgyw@J0M3-OR}DIMb;q)eTn z`E;>_;1ny@e{prg1-m~FY`$)ZdBiWDLANN`>O0Q{A9s2T96WY=bu*}$8QnQ$1y8Y-?Q+$m5Q_z zeF2}oXP|EpWSCy&qv+$_Wu`vP^Wk@#IMKHSa;ANwktzJfqdw-F=-cVDZwmDBH>Ws( ze+yvhD}}x{!J|HYpNYPI1~BdGh8+XdgJ&RT>Kpwxo_$P@=sW65?^B=|pE$9v$Cutx zL*GaUi$3n*VcK_?_K6b62^9x5lUM$Q53CM;ZFo z`Sfw@^q3fB*tgoJ?-l4vgTb_qw?WR#zYn3W6+*O+&!^ajXcP36rmMA)U^`CqF-}uobAe|ce@BYG+aPG#Hx2qO zB||&Ww+uW}-viM1A!KM@E-umc9bbC6CQtuNf|OTZcKXu0bG(wHzC2u_kI#c?-)qpv z@)sxeJ?yK`V++0Xj)k!3+XrQ)z7L>}Ph4xeii)MBf<*nflgG@a%(XS0DFoGxZe=qOZrNufxz+Wa#UI0j9nx=$kcweZPd9 zY2RMxTM0R)H*Dye3L#V9{m?gd0DWbUGxY^wl(eTMhQ6=(>dQgsV|yV^@^6-}z7#@V zHH2s%e`hl;1hsyFf}nluyP-P{rXJdLX!<#qj#u>a{37$cKz(!{`qI&eco`q#L^z&R>Z)4*`h9%^D_1-No-27=|j{D87`tP6*sZZX@)WYg@ZuAM=6s z(TQ9#@NeE}amj}8cEz&gs( zvRxl#uiCEkQs-4$xUwyt8cGeMhK3xq58ivI?V5WJ-z%#@INLt&NWtO#Z6$4yiq4eQ z)I6-U_%_Pm-Ay$&=i)xn8e;5yt)4-#jowWGIy`UG$M21hZbyivPq5VB6AS-p;4m5& zI<}z_mRMwHdytI+9McohACbf&(+FIQc9f3qWYI$`GHi!KG!l+j_huC7EsR;*sU_Rc|mgbva}$<8+2F{HXK z2mT2wq0#e`5W5pEnTdP-7(Y@ahPbeg;4j%O<#tqRT?L)OZbn^eH7dHmqwpohtHW`V^j&W9 zPW#_r_~rP#iW9jvz+knGXb14 zd^AMgL%^m!&gahsPn_su`)}&wzPx-^sBeh&qkUs>nfgjVu)Po``tUO>L0={G@%g7d zeCoUQap;WtXgl3X5K9$w{?d;Z$IW;b_o7LFDdbDQ$O<+Qj-%W_-!Dbro8K?Zu#b-R z(TTpV14x?49}Qv=c=Ts}Fc_N|)ZwqMUEJt?zG%a!Gm%bcw_KEwHP)6lpwK2-+` zt?8huE98yb8F=^O70!88+zH|O?E~$X@f=S&Y2Uv!Qc<$aTjd=)*R9qfV$ErHYo4=` zG2uL<{_+EL32Q#RuNQC6j0;zRE_i;)k>|G_ZoQ@hJ9D&`wNJk(Qt`ME@0OleqpX6w zaNTO&EUx9u!;1L%ZD-oJ0<>n!z*3R}16hFh+ppPr)i$i^Y^_A>-b!Jv$1RBWVJ-gY zwgrP|k1iJ7&Wg(SFN~iy4isWb=HHZ^xPz5el<>^~*cJ6cm+u|Gbg zjbEG+&w=`G>?LwQ)wD*n#*>nVr&m|_*Xj2BIW_%>#Wwj4zXeurP! z**GO=jlR>eSruC+K2kCLrnJbM%Ez}Q?cUOZ6SX35H^mzF zS)n-h3t;^Ry5qufR<%DZlAPaaefkrSwAuFUje|Phj@@uj=eI;&tbDvZX*cWpmdGoS zQ&{26r#tZ(#xI6@RUN;8-;CWQ{s}vdRAR@GO6)jNi5*9x*m2}q>^O2Qc9*y|zi{!j z&dE@%FIHqupHo$|tt6hbd-J%NRwxVGp}D^)u)_yzNK5MsbS3d@F{v3xBKRFuxoMZP z>&&@_vCh|7F&)S_i}t8}OQf|DJBTD*nifj4lTYH=XsOz?)9w#qZxJhL^yvB6Riw|Y zWh}+FvEu~Rrk}+wI=Q`-*xRHMdz(~ZZ<9*wZE`L4Hn|qNKwO*rIs00qEUKP}K-4=Q z29sUxhUvr;1i2ls}%<_NDzYni663gF*r8=`RkoqKiRq!{C=aQ{Qb>{Qu zL=wKb68!^Kx-R_Hj(@7pKh@fU_`L5*MbCF5NVVS6;Ws(q(|qC6obYp9`7~>zmgjF& zp8t|)Plh9Zvn!urRcQGQj(nz1KGTt(?aF6bhqOGudy>$*pQwMhd;Ue(@elg^gO0vD zS6|RtqAPo@BR|q7Khlcp{4aF;vwZ$I)f4%L;TPu{o$I%50eyu*zoyHF-|$KJrI={% zC~Kwm&vN`P_W57z%)y73Gw#Lpv5DbFJLwrq0mqHDhr(U z`i9OAm4BD}{4e+A-{n?OLjL9YyY-Re3CWJ=ReN+&xHIe@c9>5-_-uwFSQF|j;~9QjIDzR2QlIl8mBlF<8{C?9s@`K&0X=(~l4JmWuP(BIbO zqv~&oPhW{6pXbV#SWzvn^1sw4UuykE%d%KmUWJIybAGzqYKK2%ne7+KPqtd%j}JZf z`AO6_)w%=z?B3z?b7A-^t=r)rf}hl%#PDD6+4n^s{UvL-uAflh{D%6HkJiloQT|6l;7J9-7|kaZdD@esE1qdvkn);OEb_yF<*W%} z;nRLuGsgBOv=o2fh((6>$TwbP#L7Rebxwz~Qk?t4FR=5y1n}OiMxNI5==h!e? zVaEn`uERMtcJgYf!cP9^0avGtbVqD1yzL4l}<0phmCYDd0dgV10RWsZH1Gk(wykI`Ch%jOda5Q4tEM`F(M+q>jIsf;w%*JIH{CJlU7vEG| z`s%5W?AtX5a?~u@K|C2wr_AXTHUmnGI(-BB59X&P`g+rb2Mqiv-b}4CYtx@18aAMZ zO6nk9oO#UIodcS}xCZqc&_kurIRIc#ji2PZ^7fb+PEVutst(O{W;?6FET6xW&EOIV zQ>X{k@k!ym$<@xJTV14jO0~lhD`cLvCx^M)2~0{RFjP@#mZX|e>S<#c>N)c&UXHry zDcNc&y~J&Jm}(5RF&fA~hL1nMK&N0Bp_L_SsMg1K%6C^e2GPH>KYh>Sh(;U#_)J?B* z-lQnQUG#MWnD%uU_VIg3?7P{gZyD&^0rY*hLl?kI30aG8pu|(e)Up?jCZ1Su?%uVkypWIWBqaJY*@8vMgw2$+Li$n-_ zk-G#!rhO}6-&pw5K9-BvmyQ6YKF)oozc|sC0$}Rf0ew=w{8Sfxols`#%RssYsxRDQ z!PNJNp^v{8L|>E7zERK@7UOUi`x<@r^+2CIAD0{Y#`^S4hrZka^!<%b--pmw3b_hg zlo$J!10X4GnJ$68f$}c~IfjYgq6?4k^yPsTecwWOQ{P>n2WlrdSKgFs1%ZuG9T=i+c{~7*v!KO^zO!JM`Z}Pm6+G%={StlmA%Llm z{hI@|2OW?z^|9Yb>R*YWkNb_8`nsTRpz>wAXzH5$q1SM?K=GkB(=&n(;10ysh9@;Ns6!iT7tZ9ilH2joLu^j`-5?CiJb; z`uOuy^bPgdcl99pQhoN-p)Wz+)BK4m`eyp{tsF#Ol~3Oz&?olsXR_$~4_|s88bse~ zzVv3{VOs<}%)c)f`nChJTqMs)`#2s}p=CvmbJ(S9>2(M6or8_^zY!PnC5X%Ul~CqRVaolqIZTtUoHFUN z&SAO~eM5|I5-vVvJ7fwN7a- z>F91xI%5A@tU1%VlP7AV*l&<-SX#!RUGb5>{l7p&xetg({!wOgI7?N;a;fvY<|IBJ)D_r;|9stV$7c`54O z64^Yi0$RVHRkCYK&$*-o-`+npb+!gZckgWJX*s)mwB+;h(Ps<|%SW$Fn~&Y>#n-^X=>%BSOR89@hQc)yKMbl{{aztLRAQ&<{V}di|CxiFr%bp155l6ieCjQ&dN& zz_rt<1(-FzC97j(BA1qfJ0g+0B`Y&1y6yfmt+7SV+L^(uU>?qI@c18PwVZu*`+^QH z=02pq#y+(zGgyPO7ew;O_PZ*W_L!AnwFXsQR@$|YDll?M@^ZmJ_5ZD@3bTh*obrTD|dT^~R&s8^5`@w*b#l(Wd6V z=J`R>jh86r2l2Ov=aLil)8#Den;<{O6;O1SkABEUul3Ped~~0WW}kp^O24-zMA6Ur z{7?Ak8-4T+A6@OHS?S}xVP<^nLow;IK6--@J~6+BIQhfhfXXSlSx8IKUiuZyJ{si| zeOO2>|DlgQ{8sPyR)p|3RO>R~|~A%=zNX4Avhn zKNX$n)900s@|QV5628nQ&ppwUQ}XO%G3gyX+FN6;@Rh&aY~ z%129Gt3@5=dMZ7%<^-X<_iQSCH~GRFq?4W<5*h9cf7VC;z(;dGKXH^V@X?dpvQYZo z@cHBCf)$#oG!XMQA>DLbT>n8=iA&aF%?6frSGB;QY4`(2EMeyZhwzWTpRtAr|>1z_L%ZQztob2hORJ8s7n0_OE8UA@a?{?5u%v>Z+Fi9_SDs z4me_oYaehZO0H!Q3;!u#*(3T{VA&)3B(T^_Eb=b{hxub3?kq0ZNBVcbp(^}=BNll+ z3*k%2wX8qm3SaI(E0yJytMEu*2}>+tbAe?KXTA@ES19>HU`Zpf$WNk7o|0jm4_)VB zky%fEwc-;C|867fCd%kWlUQWhDKl1u-AS1m4~xu0hD;anI3?3<$P)$iGM#J$Hs!WL^diYdc?|{CK7FP0G*mu*maUN#x%lE>tofQvP}mi+n2U z`2@uu3G9{~u*h6anJbh`9&wSvVdAjD&U2^hjQQO0Sqpzo$?&^C_T^qmT&(!FQjhM0 z>>w^x{GF7Us4&Mjf@KOH0+u>MEOtImnS3R49Jn}7;giH#=oGNz1F?iw_(KovrxlAPF;Cu<4jNp+!W&cJ}332aEiRbVbHXg0WE? z12(J&!x(3m06Ha0vB%Xprjg(Ad=@8r z-SD5<4?k_vd#G1DMwdc3{{^#-E zoc#5vU-kX#>0h4tmsfxB#?RTWx#?${UdXISiDp-o9YtSb^1h=yU%RRUJ@8nCIAvRP zMfc7}?8Zy#Mwt7HyxSCN4FrpJ+Feaep_JFt^WuM=v%2m~-RybK%`2Jzz4^m$`t!`y zv(C&Kfu8c=(RZ81RY86<&tLssR89jO=k^lX{a4jJSkKt^ywudh_`B;nGXuerox$`+ zg7;PJaeGPa{(}1B(W0N1?CO5$k>HMW!>6}AWtVNAeZ&r4GAZ4()!}!gU2?+Rlf|)q zwB0`{D!pOs6|b&%E84W7b8fxW`Ci+QgD>1y6-r4B@;v7cqM^Bytu^hmEW~k!9q2P$ zbT!8rb{w)cZhi9IN0Vmn8n!*Q=rJq9we_y5_WDQMIE$h+*PX69dEGVDooOwpW-qMW zpJDFZ(tl0W@YIa>W5GVRpOO+@pR?Ut)au1zcNNsfthn_^@SM3*O>bx5EXG3)SmK+} z=H(Up5;Njq_ss2go9teekLU`uKAevJ_Ch;&R~0O=PC2I&OI~r6=ELVPCI{%jo{$T+m&`#QR{M! zUb#KRZzfQA@ek(QT6emxX5OKBMe`q=pK;R%GjE-BdREQ#hpwN1{J&&P+nGJD>^pt@ z<&%A(h}(MQzn>e;j59GOgU)In!rWR+Z%z-cVgJaYAnXxTRO+T8-E?w_&NZZ1IYfxRLt$ z?Q6}KpwsTlpZ_lZITbhD@YOHZR{Hgkwm!)KF=Ws?`{?B2&v4y6Dd0JDti677YXwT^4IKZE=KLhgo&S#{Jq*j?FYeKrF>LmDWOx#-wMyZ>hR zn*a0Yfw4bYG&1$`XQ%EngTA%WzW#;c+dF=7`EQC&URH7LN3(y#)HlWb;8ps)K6FL1@57Y$#xDZC z@w6e1{qDy&zWkXVOC>nykvf0xfX*b0r_z6e;jg>IG$-AsU&(vvQ}h(qK1DBb^(p!) zpZ|wG|HpkafAc7(!k-mV+w0}G^1sxlzsyHpZP1D78)jAN{OCa(HdgBXJ!p2xu^qLo z5!O7=r3T#snttNHR);_5$d9ykXj=S#qUj#TKWHT(zggEtIkc*8UU?1km6xK=LRL9N z_Xvq!PZN>0T+sZDC-wJz!=L4Q#78H&`JwcA`8muw0ekt|RP?>z)=et8$V#MxK6-?Y z9_gb)K03=skFx%t^NZcI9Phe`(ZaEBo8w*o=-RGcT@5~(^U%cw0e&b1?xYX<{Mnx% zj{ZLr0(a7exI^nMJnLKV<9ODW3<1jXJuHs&4}AJJ`)IFiQ1P+fPaMPV76NzDD}4UH z_4(KN?2+~L6l3_`>+rOb`xg%J=}Ys4_m7Y5_WA#winXJD_NRy=Ep72wgd53U`#yiJ zR}e?}sXiLr818rovGhll0Lz#gpH~?JAr_fA!0y--aIx;g*aFPGv*}ola!x6+guNeF z&M74p{sX|$cS|h%E?^ncdmLEC^bP~dSO>AlAE&(jPiT5o?>@ z0haU7Z$g__}bmmZonFmKKGI@p!+fm84Y6H(9M$yu-{)r67 z0A*ZjxxrrzEMpqP64%}2*C;*2!e^b6u?1q`e-Bv35BE}LmI_NOGLIQD&rs%iB||JS zJ%-Hll$ot$h(+ckWmrMsUZTvGJuEV>fG>G|7C4AsRCI4qUY9Si$e#z6vt-|=ysi&_ zCe~ro@Vtark>Q9XY!F!FM^ol2N`_cuIMxvkDSjca*yfCTX#IS?h0n2$P_2?D7Cl^Z zBIAd7@DAOeWQawk2so_QHkVSSPRS69%r)fKD?YLCS?$7nA;Qha6}s4g4i=eZzOG{f4TSUCAY+Le;3xY& z5Q|Q>gCf&P8U11-7MTu1W(Q?%#veFhkzt!7db)t+c_9{=M}Xz*+@~m`Z6+3(XMsh} zVajNGh(*R}qb>&n?j$a;hgf9#fJM*Cz%tHuo|qK`?tNUrTp~5@Dq~z3sOMrovFN-M zIIPDiONqy-u>7u*G2Usw#RZB#9a#3NAQnArmxNC&{9FXfDO6#Jh0kclXg;y<$;z34 zKXAmt4+D?Ud}86V&gbxffHUj=B+z3tpIGFl0q1-Uf8dCPe>LzJ%_kOq1UQEg!bNZi zzY=(i<`WCQ8aSsIf8dCPKMQz_<`WBl4sZ@16gXnx*8z{wd}86VdgbWxPh#OOpuFZ2 z3x5f4m>C1N9GC1HLM$>JDZxPce`yGJGDdK3Te_@l z;qq0BV}l=IhEW*~^{y-XWRZ0ZE0--?kF%59K|(#m_}?}jtPlReNTy@3bC{Xc*tC9~ z8>4s)I#66P3+s^?CboR>S~r+C7CO+dG4ptpckY-w(2HZU7OrkudEs`?G7Kx$=y79V zn+jYLZeO8>inS?&AIas0<~TEs09?I(nX3d5{zb#hPB#AkV9eQAQZD(R^KP&)`-G}% z3OR#_X1$hS#S6!%_2P0=qbBUwz&#RJdlzB^ezCOzn`2-?G5B)N6@l(^(HwQHP z5yS~3-_&;m`ndNvlH>H5i@q>uQybn|o zromsF=zA5w)b}#fd)li{IY>AnHcpQ|>w;a2L7XQf}7Aw}aJ8?{`pO2Xbj{1N`^vU#rC1sl3b?0}sIy(19L+>8=cw7}{YSc!TRDET; z-EYL*geh;;YE0>tcvENW#4ta|F=2(zQ5)bj<` z-2oeW+_&zBbgGq)W76{Xrs50VOM#R7HCr7cc2suG=8Dz9=F7bGvp>90gj0qtsVdpZ9C{4v z&crsZm>X7CkV4CZmr_|B+1J;-^UdIkLDSl|Sqn;wcE->__@-NO5~_PUPbUgxv{3&{*$^JW2QFr^KwiR`SEwTlWpK`&rui z>g=vj^=q=u^?vE?#_Xzt^_*YTz3cJ5*p4{t zXUtytFyxfE`{sr+?4)YTET7-AO~mZ31J;!K`*~qz1?|ZrCA+&WVf$CUut5u70F_t)|1W10_y`G$h z0&aeG$33pypF9q$vd7g}MaN2xd$sITbYr%9tE}2?rhj1F>4WJ0WZRrHplx8Q5sC-i zXZr24f0>;dvrkoRijJ&Owl;0|@}Q{IOQl!V`fY@j)+z_h_i*0)`{yU!bbjWNS$re2 zMzD7MMI|}MDM_7@!E%N6*2WW0ZDAgKT8#E}E!RoBB~DEEy88x0hXOxD3y<0r2o%~~KD|1hC{$kPAlH*Ud9<}(TTAeoM zf;Z}^nvwP04_2p@2K&5JBA?awM_&A3q@Z$lW$KLc^Onp%HGeVkIj`RNZc3r8)oH=B zN%*cc!=fI6KL>9HgWEr{e$9Hj_b>Qn?JIeCx%(d8n0@>y&Lp?RWx4H;ztx0+!UR z#oHZx>|S8jKuRXecy>$6?&3QDa|=vf+N<-I2g7NN?l%s~ z0^cgmtZV06MCZ5dYn!{}Irk0raJ}8Nw(8ZYB{!bG zkur08s&KL<*i>z8xq5&Klzz%4IA_LoJAPI{JO#&g1NH?i4o@%^xP`UUSS z=ScaB_a`Z?Lb+LF+r18-EaAIy3M!=C#FM8;|EW z5a81scpa@{T7U^OgBAx-Hh3}I43A~ zPVJ1j6?M_vnbCQUkLCQ0&aV6fUllrf?I#2t)Ki5WJl27Ibd0mFt(`ZgE?W6X5r2w| zk@EWKvu0d7Si%SL)V2@g#SEL{^T535lV7xLOXf$TZ|<*nrYO!)mI=*HpVr$S50wru z(Cis|9sbfcDD>TqpYmt_Aszd0c{UN{YaI^%sPMCW^hzJiu}S5W{5wMG@En6vPWczP zHY%F)Urc|_w=rpN?xd3EJQ~x#%14*@=%ohDJs#;!I{kw~ti=3M>G$$W(VJ8d{8co^ zag|f_Tp_i;m%qxt+2_B(pcCUC;^aTN4YgDBY}bB8bDoTHimvt1i^Ll}?JUoOK7X(L zlz)xSf1fY>PM<&L7bvH~b3T$uzvZL7{8#cf`~2_s(K~!J=kthuwExzv@aGtTZC&i7 zZ>{0a^l~k-$dgXeb(|v)r1u(hV*aN){@rf;if$8i7-?Ymt9|qdAD!#QpKjf+F~ezn$|;)joJ_jJpt)w7?g7W1VU9hE zjQFX)%b>X)n~u*M=StJR+R#UubF!4v_W0-wADv~;-$i)Vcb)^w^ztmCTY$0r(4ncH z>%)~xx4sVgE)X0Oqx@>nyMc2wO?i$1DW~j7HRuNTKLO7ITnv9R=sw`Fnog__D!n!E zQ%=##gw*-rwU^4jz|B8Jd-Y?em7>$K2|AK6*P8Zv&$p8I+Al?W&(Ba_d!@?Hvro~U zeTw$%Q}kNbenq$YXs^C2|0Fj(ica&GRryVHU>= z>6nHjE8CYJ>iN3Wk>DRiFY?i?K6G5l{pc)nld`T3uqxev7Y{CMw272a#F6}`{U zM|-^XeuVWC&{N<)25~U``#^sMG}lIvPJCWeeV*l}N71D|+N+Ps|3;tx27^x2pY7yV znd`6Ur9QgKpvS{r&s}UK(xZKJj=MM0T}UJ6-WPD7P`e=RH@R(z8b4g*^G6WZQGS-s z{~p&@g&*OQ_tNtJviCmlRaIC1=sx%6-25Sw3x|LO+ZS_5#5APHmBc!&lhE7Cn@yb))0vQq8oV`=+gFoASJvorF^B57=9W5wG{g0iMh!MKa@i6 zcuM?lrNrkNQ5@-eywsuhhm`VrywV9zJuC39F0muX#{}>f&Wo0t2;s0Bo`+xBuF%cI zGsDeS1z^jq1HyvOF)eoT3pIR>UF)m(2S-@&mjNzv4LQh6@Lk^^)>n`MOg4T$6F)-M_Bw{2Q23WehFA? z_t@aWR>0OohYn$(GZ(PjJx1Bz`nrQdSa6mRXM*Ej2UybL_?EIX0=E9r!67VhIe!bz zM-goGIyi&{rvR|ntK0o&vV&8CAL|<)Ecmw){~E`i{Yvh*V!yI>I{t(Oe-Yp!c38O2 z;+f&nuLCT0>5YW1#XmUqt0EWYLBgD{;2y>!ai;+evJh}Zc&uk^(1s=5o8TpOu=pZLgav0CaX#+Qc^vSJkOO~}_-?xs7W_TLcX7T;oNqh$gav0<^Cv9+$25P!;(uE6 zCoKMF=>MEUpRoA94Y(-R@&6TZT)szGaP0fW-1_0#bP5>;9AUxXd7P=PKVk9b*&OSy z9DKs!|4G0_F3oD<>~(Mm3(g|Ia{gioasJxDAuKoz#BpuZ8v)O7X?~IT?z~A@@Y?`O zJ8su-2n)_rfF<2M#ChIHm$2Z_Zc=cDiQ}e4Sa5g_QgB`+j!TEI;QUm>IZqsy4q?H0 z2XK-5LS2a5!Dioc=Hl!3obj$*Nw)y7^&KbwgoS1?;36_hxDw)%p~6)YcI$8vV5{Hp zCoFN7YB;Ni@59+u;9EzoIHpA zFmc>|LRfH)0iMAL1a112&j6r>vs?pE&-6B`)VU>${FWVe#JxxQL0vwc(lZDH~Mn_?dF62Mc~Dyr#PT zgvFn-*_1zZ@Cl3mjzt1+goXYu0SldX0L!@;!h+)?zjEt=^Nz?rgas!^f0sUC@wew4S6(G1| zaFN@-!+<59goVy=`n&lgEdHkf7tM3%yhR+hJ_!rXyYzSKld$*)e281+#LWgQ`6nzm zyx-1x$-yBk{=7R=%2lAjoNMG9(?Y;gZg=7mmbi-mPj&qXi~pU(U*O;q7XQx@-}NUf z{;L4Xm?A9xUj!U1cj$0#3jUb`Zw4&&ycMw2GhvDQRrgvI}Lz)~lK z#s8OpgEbBv-uEf>@GkMmbm0gKeg=4Zk$cXL-!7A~1OZD~CIX(a$cal>;$8!Is_Rc! z{I4axd(M}z_~#Pe^(QR;GXYCk2#f!%fF%z+%OL!%miT|-TJ9Mf63!OUwTQ58Qge5N5{y{gb1`VHmK*~s1@a_Jv+@VuO9CtlSSa9tA zPzMjV6?ls7u|fO5#*C-~e-S^TJ0dJ`DSH&vJ2;#1BlwR4mi!PFe6pk>H$T0E@5Mhj z_8H-0ga!XOz(vdyTt6P+X@mvmAmE|~{DT|B6I@Bi=^HYSoW#4}{{pbgBZS5OH-L-o z!#_Co4Vgy>3yxx)yLA%K;A{?cK^cW~HG ztVRzOoGJ~+?lW$l7r|fhwuEsfI&le0+&V4p8sfP8pRnLiu8=%z11vNtKg?L=(42&y zqIC{jgdb^Z!b0aJ;ymEsR1l}vg9WD=UV>xG#_pPhu;6f*6|HyTvMbDJa^S7_vHsSB z1%ErdiZ(d@z4!^b_$okv=#uKvdM!5zXtwOU4O#jUrYSW4nAS=Coh`n`s;k@KKM%=5*GXi0ZSep1uXgB zN_@8u5ElHe(w~h9M_BxO0ZZT5rNQ6Q@Cgh4B*YJP+GK2dg5VYh=6DIRW5V5xNBACL ziCYG^s0;t#s_@L%W`p)!69U(2{vQP_bO;Nb0>DMx_y;!=&y2@xP~C!`;NuQlq501R zEOHTHp~JCRTKs%hC^l<=I^1bUC@5Vg` zt5#~4L?rGr81?%APOP;}h__~?ce6xe{pu8t&nLgL(RdX?ofe6HtIz^^RicuKhGdqn zTfUl~7N}pf+%9J^f|}5lTF}+LI>6jGJ*TOmp?+No5vOrc%XhPCZoa!|P5m1CN{sq@ z?#6cqbZoC`-7ew9x@sI`(@Wuj`sj_RM3WHKHAHW|>BgBhj+UD9eFV)zdfvV3Q1^+x zA(u1MN7BFoccLeMz%ogBA+;QQAC4d{l;*|hyOx$ph0B*!x z7f!@cF1@hxapO#2%*-X@|A6k(rgQ#Y(9dI%`vv^OVY;;4jQ|J--1nQ@U-|L5z^Cz> ziubS(L73p(3OEf<86LV_m=wzpcr9Q*9)@M(IgS^d-d?=8Q!PS0danRar}sv#QpXTZ zdMu96`!Leb>3tIKOhX)AZ8s5sPVf2aU^j`vlU_O=p*H|nr*Fag&|{=S!zzuscV3-Dw9#^90sElr_!GRu*fQt925LhpG9BaJS- zu^K(z)`w<(2QE`$)uaLnI0Jd(ek1J>znLt;lpq4$OxrwqSz&!Gb@ zLOqk-csxRnI%Az)EfU+v2(FX-{Q*dfQzilE_p1Pto`px~okawl-j6}gT@u?dh2BpA z==4^BUYkoVN27NPosslr*|8xz29^3EJzPhSPaOaFOPP@FFba8(1KR%u?=MgXgvAw3 z5XkwJu#Y2uKy8#z;@u`M_!YcsPze2g4)Oy!)(f5B%||(;?DSs`dNa`%7*3I$b%COR zb$(&pN_<}^TD-RIzK`d=|2Iy;pZLJvIC%q^VtNiQa=vlm-4cQGW4NDVR^m*fbH77I zS#??Aq2j~S6X!eowNuMSW8SxfdCroGik~$r<=lKx5Ic%fuo1N5q`Z^Zs^?A1yvMH*xZ?E;6y)y0HK9Zu>rwB6P}>ExlxXMfm|lNn%Wz&LLkhH$@i_5^u$m{rX`e6(wlmZ#r4yEsVc~?amwVzD zY#&I&3G!a%qSng=zCx0GvduZ=>*jmEK(>{q4nVeQntp$t9Rm*^e)_?@Um0dIryl zjn+caI>k6Ght@ePeNOAINws%Q>#vR4T_!w}sMr40>OP}<^%G9b`;M$Y{M1^apEnAe z7G8lbmmE!$$L$FmNl7`Yi)55n<2=ZP)nIC?uVy|1-6J!XX(tCicyz|ib z#c}e`{ejbYuNIuFI1?Gc3&`a)mQbLp%=-pvbj-rW+(UnYv6#8<}j&Wv*& z<1F%Cb4c~)o;JH$_8$HvB!+k(H%;oe5a*5eSI)$}Q(liNY@3dAxE_voUOXQ;vCpcG zdMY!^JI9)GEYl6q&Vik>$UeaF1!K1JWHBP&$Q`LMs{3kc)A@<9kSz`ckW&3@5kg7 zt0?C0M9TY-l=oLt-rv^VKjaFa6j6OR3qX3*b34wV|4Vsw)8l@sgeRBJiH~KJ>oQZy zKgOm{eYWGA_hs^mRTtC$Y|1m28VuhZTSxcPq&2tKT07@zhaI(~D?J8eYtaBuD9 z(5Kyq9?tce{@$&_j->DegP*H)`>d>5sGN zdEw5x*Z$7CtBwbiarSpeJ_G3gaOpn*`Xzv`bKjZXGQf^=;-8UM#Ao=?l=t6g?@b8j zx;z&T%R~FcC$aSya^Z|EzYa`pYh*HdH=rP!=K;T_;dnI&T1$I{5`)Ioop)u-Io17JLqF!KbZ>)FENPxmLrO zPMin`z!4UlnZ$APe+yvAvu$_64MaG?f?ox=Xrkl4g7}sL(@Va0LRj$GH{={q0dcDE z500?luzv>m4{jPBX)nTpQw&(n6n#>|AuKqH=+DjzM_Bxq0+#P**nQX?7kVFF1spkd zbhWboUqT!=4}=A$j5r(|a8<-{`ypY$Swx&%8^yj4T)qiJeZSx|5XY^PhXK#H z&cT0_uv_OFHMm`aJ2iNl2J=1)iOVi7-w+}!=@tMk;y<`qc&ty`pbZNS$8`{UAaoqk z@+}j>g0m2?e9MHe_;c*bw@h?Ca3}F^z&|*`g5LmGzCT1*{MXU{4*Y{7EdCDzmUCk7 zS;iv9bjvv3gN2S=#u<+P9Q;UMA}ly8Z;;Fnj%Ac@kffGZzCn^&UO9`Um-n-vBWJM) zOIjNMOFa-4|7O5)ZfY}OHX7VkJd$U^g1-Z>e2-+8hC^6zY#w+MJm9{IXUc3FywWzy z^?wP$5_gdJB@RAe@jnE3s_Rc!{K-pa+=zd0KgJ{9b|Ne|zX3d@6#w7|i~mKyQ(b?; z;{OidDL3OE9AWW)7w}ZqpRoA*z#k+J*T7%ujj-U{N`E#W9AWY2G+cBGeVx0TH!1C=V!s4H_iS2By+Z!%0OmK{P-phE$!Avp3p*>AfK(dL56NG*At44F}Ym$v; zxX129rHM!VgPv)NZQ0-iVOxGJc8gZP*5#i1HS1S4tgK&mHQXfYnc{V+rYg=xd7^e` zO5mhXcZJD{Z1%%!!9j6KmTFdV1sV%Ndlm^08w382iQ zzbBe)E0c_qAi?&bfsZO)vlhE=w=Gya1D}YAem;>|Ejw$Y>tR9SSgRz$QwjsZ?_(+A zR2{$3k|@urPu3LS#Yn7oFCMl!qR&H3nKFNH9CM`)OB_GVnLobwO-;q+5BpVRz zODqXv54$ME(W@DIyoYH=!k{Bz#^D)np!jR~sTCS(+*nLgj+wa_$RE&s7VAxS$!W)! z_F<*|R`US+vE7sSPdMPbUiCXAoVrr++TA$(@wqUk=rlZK?tAlxyzhW8d4^@b{hA9m`?8`;!)2bPQbfU@^=LEevFDEJ>5>@ zZ&K(rpfa`#G5iX>@21e}g>k_f2q!(=PJ=Qn{u2G*9nedohwFsiKc&!Xn}q#z1d<-A zGEslufuBzAU39Pqg&2N?-g5x-`ui>jN&BMc33}f~9gvyf)9oNQ-so5_bb@yeh)LP$ z&%03?QP<9M8H4;%Ri5p%_BUw7*c|{BvOEf8skOH{W!#6Z-z&DOrI;n4TkUO^5Ew zP`pFF_447m+?(hZ%EfKtW7;#9#3FI~u-?oPsZUXC0sIB+Y?;=eAXA>z1#g48VCB8K=p!U-k!Cb8P{bzM&O0)RW8?}^WfXK* zYSF3Q-O#iqnh?W;1pPcNbcJx^RO1KwUyQ!3brp3zUT)O}kbrDY!eBeLbNG|{f*;|V zZv#%n(?^)#{Wsu|W*Hv3dk`=aznoW?ABItO_y!)G9{KQS^qzvhPLK1q&;!#<(0eh3 z-dwzM+=-L?y#NoL-XR1Km-$O~!l;#2}Sd4fpO`jx9jU2D$FMfN|i>jkD;HFlg6=$!ks z*zBux9RGyhk0-Ag1&{3{PR8F#c#vk98?YV3KM9y?CFX}=Y@bw~awq)m!6S}&;*;%BUm+id296u3*hxrkn!tV{n&E_=W9sGu!_vU?Rp|H(Ag3l@(&QYz0 z^OgSxv(st7rSkT;Fikqd@prulXT=A@r9 z7jOGX*FSVsAB(3|`0uFnzA`ryDM;8FhVs(VjEM7<2>Tlm!zp%;wzc?*@_0vu-xwN- zggbYaE$E3hRv5aq<=bU>J#P=fX0poYJ*s^LD6}&zEf$Hv>esU%4X0Irk)JiA|2CyvE`0J+n~lLUg9GL~V}WLen`{lqHQH!)!*$0Rj^1}<&Eb+m zkKEb%aZ|O1BC2(IOtt2XDE|$nul0tA&tDkxwHA)}3I|(@O~3V_c4hTMl=Y7xW&IOu z08izqkH#zia$xIXwXUad*k8Tvvj4WPUv9l^?`40*%a{H0k6&(`|N7#j3U9R<(1?@Yr)Ean7ZM|M~OAz(4OZ23BuU z180c4060rkYh(@LJgV{{eP7?1Hf+|V4{iNPSNPs8W8i0>H^Of`Z;W&eq+M?eG?y9! zV=Ihs*J305y*Jdr!Sib1#V!^8#NViJ=kNRj-}{|Eymh^AVBdOQ_`pQ}z=1`+z}Lbz zO;zCyV~pDE;n_R{d%b4d+s0)E>f-D&Fkcw%7Rvqtd~;Q;cRw%%9MQ}>ly zcZ9pz)IdqZ7`TvWgm2np43u6}12;Xb_J3_)f4y(#lLH;~zL%dKIPj*w;A;bIZ~BjZ zJ^VtCAEE6%{+FK|IB>x~5WC>-d*a~sHQW1ly!Mq}^n~|4tHKA~P~jKX_`;od_8(S# zUkiWlSN?-fhBy7nAKtgy2xlKs;TOK{zqMyz)7Sk2+urquFJ>AgU)lSWfs!Aox~~oF zJD~D<_I$1OiPv@%_YCa&np*l~_@;-AqdgmX1|G^XcJ>_X2_JY{FFiEJwXPSk*Ijo5uxW-~v_cEeTum%?tg{RQOtVw)tAWb;#%cR+>Ma zz8JOlO*LTNi(iy5@ENq?TWY{R*$5x_Z)(n0GFt}%XUZO#{7~10FNYrl)^GQ#fpx%o z_plmxaI!J*+YRb-U9Ef5jAL`Vs}EI&?_Hq=-Wo=)eo*y&{a{bYj_~HMsPMkMHvNH{ zPpkN=+l=^+K4ipCZ^QR&Lh4oH8TG0P8NXA{7~9pr?0qU;8#CgcF^%}5m^#=K^6gU3 z__nK%9~k~uQM=)NBg#4roYSUZ{V1j?dqQb1sAtmNP$BbG^^AE)%|Xk=467D2YGW!C z0EGb3NI#^WNq+&~3)8=u<5?RYKU~t$-@$VYbM4tjIF|l3)w%d0n#bwpYS!$@ag2!f zB`Vq$UyY9yZf&WERhL3Yu(Gn$0sO{0vs5V-CDxcR>HvP@TgIqTOxjjvraFM%ct<9_ z){~9zWqLO1R?i|8@0q4*dS2`4E|2%DSFx_s@RJh6dn(lHJ#$rgqAwU{t>0a1)2T{u z=9cPMg>eR7J92;jxQOY9eYVgtdT)pb+)^>x=>zs$_S)Rsg|5ty%g?Ci<~QZ4hUF_) z)!&mlef9F_4T_&eufIpdPQU!%XBMvxf2pG8-8rWM-!lBoo&VR^{y$dz?Zv+?pLb#E zwU3wW{^!O2*!kP==JvFU`_A9?iOEA{A8XEh`sin0%57{KR4Na1%a`zcEAWw_nRk>N z9{$*tzs@$Ue>PIy@Z_U?zgqsYjGun-rICNG`}Dep8rQGAcir;F6)U5;m21~Et;urC@_(DVe$f|}Kag9uZsn>~EAK7J#aZ3l^(*RgA6SK*zlUdhg2Bb*t)gSFW+~zOcNm{+6urRjYDWuU!4WL%Cn52O0^~tzEbF zUdArUDtBqFUc0(Jcir;!D;~&Q+q51fuB$Kp&%6Rt>K{d5Me}eC<}P*I#_}hv`?;es z4MHu~#E!%HEdlM{^py8Z8^14sX%WT<7wg z0hnoXuZQXXrPd$79aG*Xro88*yiZDbpPcf3P0ITeHQ&t(*K}O7&(YH7`l!QwCp-cD zuhYe+T|RA)m%H!$A&%JN?*&Y~wMNbk&v89IYsVj}Xy--8K0+JcYwb6DN8WxPul__M zK>BaG;r!wI!zu6oHRYY_Jgd<0B%IJ604|~jTmX;Y5Eh(kkhV307|^Q$7XNAVcWDw9 zf8xm<_$-Im=N15#JNAnKTU4OI5tg{01T40kWrV4~gR8_N_=E+YI!23)21i)@R{$0p z+Xn#)4q?IJc$NG7w-d+B4`IRKy^dl_%X%(ym3DUi-8#|pPo5%a5f(aA=&-D@A<8Eh!H=kbVtKj0azjpu&A!Cd@< zJBVk>bv9_jLi1&KO?CYVi~lfS$pc~WKMHt8F8;wC$77Y)pbZPo#K}4KRWXhBJwxu6 zly_x|s0&4vgiDfEHQY_vP^D~KCGSVMQlxwDPyK4=W*^6yl9t8EIU%Hd_C{s9R&zuv&3%A7K*F70Y4x1luxPhhwMBJ+`}T!=_Xn>U(6R z0e2idutFtol{Mnlob?Tf?W=^MbQCM1E6Uc?hQlx2Gx+NbK6#@o;5beLgahuoJM7#y zPsbS<1<#!xY+NB-hBr=o{H5Ck!Gr9C! z>FIlJZFtw|EyO!z2ysG>>m8lm8PJ;vKhmSj#xUk@8RF{nco)fD_=^*Ie-3}09?y^* z0}|;`XDsx-30S9h3kZ1Msq^Z2ryHjXzjQwZJ?4k>*j7T1_5wP+GE@d-9&wVtEcog9 zdmHpV2_(`((G&D&C#2JR3LTx)Drj_q7}6WrHjz{6j{ zF;9HwxdO%!dMn_Wi+6ECkLLh%yv@LSSCH^4c%?4PK1bJ%PI8X}+W(2i=NP z9NXu5H>K&MOCNKlo6^maQoYX#Eb~Q|?Z?+JX>(--0?^lOE#DaXIdlIrH}{vA{?D6` z;_sbYBbTuY|3qIqrGIr(I-f`hcy^gGoRsXkD0Q*y)b}m!GaYPD{jP&$)A}gvB+RH%OGM~SQ6wFip%*yB)l+Qf#Z%*8}dEU*7a((Rdf9z5_35Uk->HjaxUxtHgnZ0)DoqlCgzs9BR z_)ky7nCbWrf|6y_^zY@AeJU{z%0-Th7HAVu2{MD9*TK1sU_{4r^bIdL+kc z>VdCg$5AkhyPNL79)r2?lF_@j%}nTfGfo(=o~$^*FVoMwu?$3zBYYF(RSdC&&pWO){c`0p;y7^2U{Y_dd2FzA63uufH5`&j?1F ze}vl3$c=WRm3G`j4%Qs6-J_NS7H@k3qx3ND7-=-arw=Q$(-dOLbdyd~cCFt# zbYH_CCpB$*jIEE>dT(5@uVLL*FBI*2C^yZA-CduvpTWIdX$PnMJj{&hM{;nJ*O^pa zUtK+;%bLyhkFW2!h#E@kzGwxSeR(l&7YR4Ez>eo}Sn>#c*gMvSd$8ydO%zj?|F~|DdKJ+1@0__ail5=CI5Vzrwu1B?Cm^&}UiQdu~^Y)C5 zvl}axSLSIu9$uK2J7av{c;2ysqg6+EpHJ=Z{*GB~dpjjf+%^=1t-!Nc%D*I2eWX6z z)TbV+CwIE8{-KY?fFa5U`$1uGnI8A^ZbDv6~N5(Wpa7Ul7KO<21nSN zVrDmaATa>XBpiP;Gq)7N@a~qe0oF(S!XL)943$m-M&RO?ql0^BoeVet8mB-5vcQ+Z z7oH_$d-lSw-{zM+nFjAcLahY?NM%Hk24JLuy)QSFe5QiDSmyb09Ls3EOQGH@yv#K@!6;-3{UKwXw^D~VkpCNlkN4t~gar;&xy=HIixTVb=i#ev6-SAk0 zm45N^$}f|L{Rm_8=i5w-&9_vh{U0SgKfa-<%Pz4x#nBXGj-!p+k?UpX84I)?^!7aa&_81l&noTlO7y*sBXcmr zj^lXPT63bNBzCktZ_~+5(o-I!G+qO0{nua*ACdRFo+VzozoM|_7lHjLp}ZH1lI;?o8!sxmo_;+f3l{?5H^ z`Y0*vh-adA4^@HVdbi~9wmx-&EnVGFp&Il9X_EPQ+iEkKFI9 z?2kpe4}&lI5nsmeX3&ghE=-ihjCdo?kvWFZ`|~Q}IRRs+B{Y6S4K~WvX7{`NyNo9isG}?Gh?t!=mt)r~mUl=jSGca=|Mz(R*qmCBg-HjUerhH>H{carU zeD^#<avC9-|6DG;D{KGSOG}s=SNib z!WOiS-NWq`LENO685{u&KV$T^!UC@14l`m_dG;Zc+bd2S*XG*C7ay4y%6(RCzC9X* zHR9sT%I+UZ{#l_{=CVBN>BSdz3;#THOV?$Y;w%nP~>7g%R_CxPx zn~CJ=%#bY=CdXQmj0kMxVHPEM@W0qRkGmCiko)b_EFCwOMT4^qE0zYk$eKjoaJk?- zqbi<>lJt@*5T1Eyvy%_{O8F31avJJQgPe9Uk@E#tj9Z&hQf~L-eoAuiV#o%w5;58T zYivG!JdvxYf*jJ3%)Rw{S&iNr)Zp>9IK^^!BfCqy8dUyKIx4VDhJ zZ+Z=MoYd~?oluE3nAb9ocRi}aeURuE(hgcanIFn)(k=xt&u*)rDj%cPsBD>61RTLI z&L-34oxM!W85zm_t9E$FU@`64vl~qL&=i!^!2VI3{MHuSL)YvQRVL zc;z@et&PiBb{{b2GmhIbHuOB^YPM*0hF7by0^WBqBSY^otSPC91=?5ze_vRzXvdoL|p=qK#GZ70c#qdpkCl!`7}N^9sJTwG5*JtF}<@v&!Krk{0Tw&A%IM z>-JZ#r-yps3zhYRQGT$t^FQCnv8nw7-?uH8LuWSretWd$lQhE6BylVjSO zJADx;d$RoEtUmq7xz+UMxNv>Mcm~#>Ov}I9lmGmCvV5(3s(e+TzaTLJ;*jdG=EthM z<&0_1CW4ojgxA;Ba>h%abDurm_qJT6PMkTTzr&d`%qp)R$(-TYhjPw{xO0Z*TL`(y z(TH%yAk;E1G14$=NnPktmEPi`-4tAVbjgvWhxd2(t0H}Rx_aXfZ9F|Uw6Icwg6EiLmyy-%tT zdQuByqfE3&7VL-{%YWV#j=iYD?JtzY&7e=p;9l)S!}Grxa+BxM}d9Af`}timlV z!~I)Q=887l1D|M{RF2qZ&lN@m<$SdG{Mg(j==XW;d)k*m*RcRr+0J>4zK%SN<42n* z-Lf61M|xf3s7o~th>}&bfD3sug)TFU-Y!=u-e=PV3zJ zp|zN5Q1gQo#qRlu6=v)1F+TsE`Mw2%OJh6RYf*nyiTcCXsxVQ@I9cyww3)h0Xi_mNVvL*6c4EJxlp0tQx>oL8)Ti0{RndIfVF7AqH7ecI&Poh7woQq# z58$fS{FW}$UQJ+S%$0>zlA~_#dSuf5UF&(WGVR~gp4c3%=lS!!o=~}X|7{Pd!aB!{fU{*7`l>YU-lBcKY+P)r9#2v&)P> z=KQ=1BPwF^nD&E7JjRo5?RhF@^!|T)EN~?J&yIssIdjS2%N@6D+22;&+1J^EHEzmG zhqZz>(?M29nYG*WH4W!odu>z^i_~J29>r+bsm*wlVZaY7z(p%45$PHPa$MoHHAyqO zta+{+!E-v0cdT;kzP%->U!ToH-=##n3N_{R-7EV$`}(X%%V72$3-54dm}JgUU5*jp z=z>PYC~TYM&2Z348NE^p%KnZn&i`NV#hW=#M`PGydO%sf4V*vV$8J=sKR2o#PzNj< z#tsu;#~=I152#6lLdode7X|kDFbpLhBLv+%==|dj;N#4@O;yKsc50Y@e;L>MSJvEr ztc0@!I*tF8ysx#!R2Lo?Z`V=0^|#{&e!EUtAF@=m`};=xH<$*@qm7xqj}O%MDA6#S@Xgv3wo0H$A!_3L=7W9|lVPyhd!F;$CN{*NA0 zpSVBpdfrb9UaR`?g3~px)}CB)V(D?`l<(mVjION*x0Gz1wWYW%aQin}N(1R?Y#@|7 zR#9GvHfK{4i5|X+l4H;tV_3-zUF~$*9Q#z|tcZUxcC}>Iz)I2C59X=2Sfnn&2Ox7n zD^r({2$*Ip(x8PGZh1Y{poJ&%Csz`$ZmDXiwk5Iol;2vQzsXj{d`FAZGJjTtW8BgF zk_#*yTrhm!A@YKAo0e>TD=~A~+$)I|d6+l)``T(_=Ms5a5_>BFCuDo@Ps;Y*igc;Q z^*DEVdzAlSEtC82Xc^4s|GQ1RHi66vt6N974Y{2?1(Wf~ExaMfZi1|pvue;)u zvmj}|pDuP5b?#Vk_#<1e=Qjote2xmGeH;7Tq1-Xb>$TXS0)~X@tBl$!*7=+(Tjn{V zB~*a*D)ve^l4FsNG{iTU=V@gS%KaXA19tebxPxV{er(-`)nsN<-xts7fxmUpJZ}sg z2!I!RJI6Pk>iI@x^voVw z9(^=?Y7Z<&v5grij@j++Sa+yB(B4qvg*B*~+xT07T;y^YZKROPT&C&f(oUbHfWHH? z1_A+;?yxebIn{KT_%askazfDe2h07D7}7!dXN|$V&@tsDc+1u@@TDQx`|QiXN#&kP zp*?A+hoG-U+g;lVZHnE(ZM%Sj9@#7Zmt6u!tTHP6BW+F}00wda3C+SzitdYk)0>7~ z=j_E9gVf9BC3-2p(&b4j7IrYIl4Lj&Jtw=o1^J94pYa&-nG2Jf%9ye?yfrSAHljiW zu!2R+UOA4I9)cTo zfkn>BZRmT!P%lOZdbgF$USnl*4sDqST>)Cc%AQF-cdS_1J!k`r-`(!`MPAtsW7LF5 zB4yR{d#`3CLPZ4mVxP`TWta&{6i_P-QvvTeiCuoq{qYCB`JRg&5S zPloPJ-aH+4@~)le&@0q|NLiY%3i&S^h`flK7M_PzePrD2UA$qzzc>r^@$;_C2HS3} z$!u&H!aNg${qw&LG`*-wE6dVY-qJvM8p?h?s$PLj+F)9owruJrieU$EM~_{b!539W z{bRO{UF{q+|@C=7j^`*JB(g0wOX^OB^C+yQ0rqvsNs)ife!=*(Wj-lLJ4CczJ&xa;{7g_KEd}Znbqt#dG}z_i z1Bdet(GC}LlxnREsLb2AryuQp3w$%6p04B^=HpC-v0&osBpx@0O+(~5*S-`z?P9VG z0BcruxGb|RVb5Tf2mR97r@}lCk$B0o68B;3`C|w>;+?G{6{@Slv@LapBH;X&qUXU+ zu);4$v<9t$rDd+17mPuDKI7QZXO_)n@e3Q%8k52->k1? zQr0TyjcyKltufsfmt2)&%l>mqmEJ>7g7#_bM8BRGlSpw3c-xq6ZGJJTtub~@%|~q| z$r`lUwOiKSJ)PBA+@ZHDM+o+g5~azD4dB#_*%HQo|DH@}aV<#0kL29n#a-1zO)2hW z=)1$@8qyQMFA$!xm)yzrc6OQc-5u8&7P;_x0_h%4j7siqA)eg}m{-dl*`rxG)xA20 z_Q`F&li;&odXxL*X>rsN`7fji?21$exuVr&aO`Gt54^&dk2NKC>)p2r3ELy1I+WXC zB$aQ_*;^Zf{a1a*Jx|l>W3;2KmyTk$l=oR$E=^eMtdvKeACULd*`fK6H#;=Hnmjvn zzu?Ud)zM{JAQ{OF5$)ckW>-fW;g={|d<=JEI7d7dp-q||GRS(a#%^UK{M2r&1GX4* zGtMPimb1ZVZL3@LVBA)5_ei%*KpUQQ#`A>5p5859G7&dhwHaKS|8deEwhg3jDZewL zWboGEszZC)&uyyRd@`{{e|)iS$=3Po;Lnk=KJ$ARpC>5YsT%d zF`5KA2Nom6ZN5Y7F=vx|4D3nvciNUS+DaSi1nm7_JXaW1>@j(+#$)t$1jW>LR9ZW# zly(ei?HGxk=>w;ecD$}j=K1LPKIP>hFOnE_Lw#G8>Z7+HY4qkkYipJT+u31eTk_T; z&-#jXdV(W;_{yCGt`|KSgE=KH{&iUCmH#HuQ!gsu_(!XUM*nW+7r7k!H-7KRdt@$bybS|-?K2`IzM?e5g+StZd+Sb6~*-&kW%KS zjv2(;a=5}CHMc{{g;fN2Q$@>sV}5)rIX&UL*e~>aVjrb0r5@{!)DBh+FFmy6Fm~29 z{Q^5!p5Chu_{9 zx@J_K`1ogipZm@2KhIX3j@2 zQm~I{>uar8?D9Y4*xCrLnz7>eW6tU>S#|se^cIa1^!@MN^8bR~(%)X(9*c;MKUMOf zm3JvPKoczmP2V8b8MJD!C<~qSkIXYZ1e5}q61Lw3pOe;>|f0PNyA;6~+evTx< zbtNsbJUbrDa6{gDQMWa-VjT$^Rm7XRKuaOn(#4U5N@IgD=Jt`Cf#3DPj?G*cZQg~I zV42C2Qr4*~Bieijnij0FG4IEF-a%D%Qxx$Pq_Rj`BvA?NQx#yb5b)%6m1jT2JbP6h^(q)iLn>c*qC7 zNNWzX2-{ywtUuhm2N8~(qeM6hxC=H43r(zVaz(mx-%;D8C_O?J=A+eurZexMybD)% zwW7r)WJ169p@BE^jnK|#RjBhtl$E`pCD9A6oabo|gBi!R;_`GswBiC+1z&Y!O2S;_ zK~jb8rNW4G4B0DF|EV^tdsAV)bhb zV?N@@bpA`3%(kR5vrjT+B7U5_g@Pt_%)n%mt zj8M$F-{~rEumY3p^QYncuRy2Xf|JZ`uw&G8q$xEE?McB+MrispBV^aGo@eU6q1zr# zJ|Tsk3^_~Fb#T?6pQX^7B2|WUu}8%!P$pXkj@8_} zxUDy6%|EK5XP~v{3KblLRK}87IA)x5UI_9XV|HJ1QuDB69$>5M^8!wUAV<)ozZp@X ztUipUoiV{p))cZ%ujEG5dy6gsJ*hq4$H{|BTM$y)_=y71Uz1oXwt#Rx$=+vGVLA zUT)r7^I^<)#&8U6z%e{}JvR*BH#leOt!=dV?C&h>az>>$2XK!iSx;r}EyKFArMe}; z8e)wZRmK_24zSO~S*zTw*dZM2)G+G%cDuffVe4YPGR_TQ3`z;Q4DK}0I&|lzy2MJB zx*N0r^$d0@P8$A#A0oEDV61^Nd0Sa4tn=u!hvKYP7o#-yw(0lkmrl4P&0aI9&}zq;}ADv^C%uvd51z zGK}7Z6~?*XT=W98*#{d_-hAxXXD>~pxx6hK;Xg6D5$9ZACHd|%HuTE7phqUDojbXyiE zY^PS+hy*LUhq#h!ytJ{|@yn>BJnOFfY=0w?eHb`~@sm)&_=3>1mV!{;V+Eny>#h$K z-(2Pn9p|32ohFYZ&|yoED8ln^9sjv=t|2;9nOTj?`41PV|1R zA&7@Di?vG~=2mY!GHmPI6LY=Ul0If-ou+S~&w{5hgQZOjGIpXL4q>dKUYjPyANt+6 z@=DfJ^!zL86Oe6C$F=SD{Ud07v_n8G*wI=YAa8>WLHybVbz*K$C2Q?5Te8flJaL5F z6xcrNCGLB-`HPR?e|qte7whHD@$l*qH6`1MH9dO#$?)Qsvi>4REp4wk+HknP%RiE4 zFsJ9Xeku}OHrqJ2m0Fb6V>pL1G7%#LR!b;-clE2)sHx4{jb}FRQW-%{Bg56}M8n~0 zTNj;Jlo3pn^X%4zCl+R49hDJ07x8SUxKi-2`nFoLCt_CVHoy_i?%cYjoq8?CS)ZZD z`b~tZwjQiUa3=c<^OKy5lr+wco)<4~q(7|Zs`q51xQ!Z|!nXeEaO}CVIQr9^NMFw^ zO%`Nrh1aWkAmZ-m(i4dzzu2ujt!K4O>e!XEaE77`a%z z0=D;h(0cE68Y7;K^5Wk1D9&`8>}W3Yc1W5BNrRRcOEtaef==r37^@-HnmbhB2k&W} zR$k!0!6<0GVJP2U*plB`Sf20yn33Q5v7u@HqLyi`Mdj1{GmL4iGloLoS=T$K&i1zR zh92ef9f}6`V3mv>#$JX|ns0tGv8Fc8=0yx!)5UQ)LTLdSFvlu1qa3?7vvXj>bpQQ< zALX4Y_{XY$Sn&5XKdk+`C9f>~LET7Sn}2b>vQK~G>?GGU#!$wbyD&54#SShkT=e9k zth?TscVE?ORaNs3&M&OK9dk?Z*3IC;{s`^@!K&Fxd!8xU{Q2cAMQS0|q|(NY7NGUD zX)3Sk>H69u+y}SXA6C{~C93Lhcmr($nI;O)lEkQHRy7w=y9P^UzU`J9J=wyAQID z7Xzp3B8A_7`x?ppkp#pz$<_(q>2hx1flWO6s3$RTWX;VG3Uf1bp3_1}0X1b?grq5- zev<-LgmzxNH4pP@m)b5pY5}Eh9l=Sk!+*fZG3;htjE%z#ksfOPiF)SCFRDi>(MRV| z=5T&z+P~0en9YA+s(i1lu*~%;zGSv~P93=>vr_Vjos4-NT)0Ko0zkq+y?7;b>h&X= zA6XpEiK%$Sh0CmCk1s=yg0KB#s`{=_^Rw#hYm&o`T=UCo7AB-p24uvsK3ID>`8=&a{GLCdD}@Pl=q~M^-GRy_gZkOczPA?)G&-1 zyPp*#G-Sh7IAyxH5W5V0$$jh$b~kYI#rG07UlzUptXX~2F z(3V`^**v)S;HHvIqVMdtzr)J;%D7GZM3>=c1}HB%r~Zx0kKm*QW~@wd3diz9eW{+3 zPR5=X=e7eTBt?wE1Loz6dwND%TFz4LL5z$)=DZ0V*N$b3m6xa~<80a>$^aWVPYaTH zf2er;q)<`Iq)_2wlS0$4n;a^*adK!{`Q%XE9h3LA^>vg(r=SWwy%ady?~!tbl?FRQ zNQnj8sqaL6{~7HK;*QP{KBZaeUF(8#zUXsPG|02HA@nI9%I<(FoFwUDE z9XPeyK82~@#MoMBs;n4NpX8;UrSXD|5wo(djk0n^Vl=m$xvqIUX6Ts8N<&UDI!%1p zCZpUJvwAw!K-S`N%q&^T2g{LNcNqob{gc7_CxiD-2JfE?-aiSve-e2Aqz{9S);wWC z$AbIomgO6W2fkMGM5g1@_^kTl5~FwYtNfDnCnfyCR0mFVbf#EXwCNTW;0YD%T}I^| z+z%xE|AT0mu6`c2?htJt3b!gsvpj*%)djR{rRXV-;Lb1VpQ0*_Tr4+EF24{GI&Pwb z+|-EsxrWVp(~M$-vfl)u{o4)9T=#co&_1Vj4l6t0S?26qV&+E*Om`+sNYA(%tqe4V zOvq#-3U9#?&_R5gUNC57WkWBy8+@SJz%6ay`GEWjdg56Tq}-H)c+2)c9!opFU^xEp z@5Z4lzIY%Q48PTf9>>vfiu7{b{6SxhQ**YY0d2hcHssUijIkXKx6aP$$86)-E6|tv z#pev#f|({unhl+>6W^6oSa#4v9i&COp9Q^41zkPzN!+;kVeUIui{t3mswQuJkePA3l{4R_s~m7PVKL)}u!%6y6A78X7#-+Ss2i@B&4_oJC^Y>! zn^WsKYpKY@T{+LGP~j&zwvt+gt61ibbvCxrrV4%*Z;Ggvv%tr`$`$k>E1F8D&-g7B zRy{O-C==@I$q%c?vN#V>ir42%NCjJx``>jfA@&{g#AoeXyZQhqRT^LHV^fBh(E%f7I*HjFxm5Q^Fv}5XK%Cn{ln<@S)sAj==J-iSo@|R zZScozyS`B3kQ$?&!PhmYN%#8H@$K;~(^RM#tHS1+jHOBaE!@7ceCduFZI##8#&dE~ zLy{+?wjZelJo%34a$S>cuj^Oa>w0RCO9S9n*tv0L%a$R|?HH-3RiWwV_Ib+6(vtc1|YPv&H~3$lM>aqIA>F`H*b zn>oMxpb^4vz?b>a!6##r+9j^hdoXru`;+aHHVtp8-2C;;Tu+Ex;m{;StX2L7`jt7* zpUi>&WDfKzpN4*=JXBO(4*g0w^eg4CuV^dWGSQwTn!2E4z%22m+S^ftTSZF}>7le| zN73`)Y@#MxqQCLxAm1CixWB8V95ZVM#U}A=Ts|#8T zI8tY{VBuV5R!|#HUOwM#aoV3l`k%+sMBYhO+%*!BxP5K3qLVk{3{Rw7O^-dN^W{$5 zzqu8bqg#E0E#JQdcC)pKxU5OqhfpU93lUpy4Y;Bdvvl~vb7*t6z&_O(%hPOCumaga ze6AiC3%YoFb;~=vBv-XDgq|^QS7IObcEz_4ECX2?z1Eg(MwGid z4vB#y(f^F;J8{RH!QvQ3PJ))R^5z)9Ntz*#V=Op~_DVX}!F|A;iP~lE3p;3o<*fqs zy+7nVv9E2}ds?u>O*(_&aR}Z4c58=!5$*8L!tVSaG&dv4Y@kHTyMLtI#@S3rS6mD4 zO7=%h#hcR3@BucawJv>iznqBd2| zDK#C=O0zY;Dk0C!p_Kvd8P0M$pwv^u z8v=0)FDyF}dJs&h^a)&78~R1<7N&<{Xvxp*#df+#kZ(Fa+%a4FjHOcvKqR)6{tL8woB;%y?6dd#eU4hpoC$6djxBkvrO4OvjY7c^BF)s z!4fM&38~qr7;mp1?D#lc=E+P8%VEtC@pfz+8Kz*kq^-Z5VZ1BUvhSI2G!%Vp6U&QZ z`x9fqh#V`+9`r{1!pM8jL)a+vA}RDLlIYEQ4|)h2h2FdrdUJJp*pa%6yHpdGZXa2+ zF$(Z*REQ!9>8-s63Z{Bmn(dK%V8 zc#80h-Gy;Pjf5w|${t)Y?=Ea>Mcy;9OS)Tm=MxSk^m?t4Lkdy|bPlGCGZ*`X*@>Ig z=VHH5`qy0S77EO?ZM&N3y1jwqK;+lFL%7R)lT&-Kh;NWQY*ATfY<$Bli5^1<$Y-CX zH8FqHy7N~F*6t&!8uo0G;@o4f)T_*{Sy&@J8*ztj#tF-;@Gr0Q^nf1MXQ|j?UJZG2 zke*YPgqV~jbP1s55br5s%X@3tS+EbvSY({lwbye`*l~xFt%nOcb#3GVe8JF>>rPNzY_2W{vjxr=2>0iLyVVTYAAV$6j! zIOyM*C{3QNm%*M8xQ$*Tys^3tPuwgk@M_YxSR|`zt$tZ%n=9o~c400jM0O@ds&|&X zCgIm|CN(`<;}dY=_hOwWHwDv{+}bp9`NC(Sjh8Uj@IH^e_G{+FoYQt^ey03C*aI!$ zo65Y6|651e4cL^8>@Zq}j$tJSJ`FkG#8K)FpfALn2V1Ig=NxTcPwPkwJ@2sy&LEdF z>{&p>kKy;}h(EF$QqUtgxS_amw=uRdiW|0Da3f%kkv%USn1uQC&C3=(b6}NBQfB%i zlW;%#rHkX9$v%bt_m*m@#QB>5`dwx0J@G>>eynoQEB@PJ21f_a5cXha`3EXyX1@}; z7W4MlQ;-#|?EU;QH}QI!=;L;0#W5*(eN z*RmKRkcYi70{zEj`z{06LL~R+Jgjnz%EVZKZ3NEHATEEM|Msm4_B(GG&^eozUTxC( zbGbw4%5mq()m+o-{74^zymuv$qm=Qd&q#V+xTD8B$L;$M=G_ln$Ry}OCP5c63A&KU z#V)t^9qzEl2>C>EO=Qe<_=!G`W>agCvp%u+!?Dp1D}`V%nBkSBu*1GlHAnL7)eCkm zu$njuew8|#Lvu0-nv+S;oJ@k|WKt7GhQmS7W3USwe-Jn6*f%g-!WT6r8_?G9HU`X` zzsIP=jRxJ(=C@Vib_2lHy@A{V>A3f;wJSXu#OS(Yo-e(Iv3?HJoO# zGO*IT#POY;(M_KNOlwp6Ogr>vW^QQ)zVFdGHY3`dZp1HL7#HWAE%>fMI5OFYmr%|} zj=nT-@lACAmc;jenfEW)srHygOJ#JS3C#Vfbkkt-Ba9tlSu$jnY+; z0%GEpA1B^GrC|SITgxyMwJ* z4} z81p~J{GMy=b@ti2QT-YCb&h*(k^kx*c>7NumQ>W}f*YsaEx)8A^l+oAlUF5r;Yg!0 zq`rFhm5n7&z4T2Z(boT5b{9r{=$7O19!mU3U+(&@T-tk5`tt1A=XRTYB6+Csb4lN8 zC%p2Py>`A(v`)2Zmmfhwamv_Tw-Z*vHh=xd;eY;CL=Ub9?^Ie5i4;H)cgbZhxt?@}vt?KLW#f-7!)J_I zH$2_nzE1rYu~U1oZ*N(II%7_{?;QCOekbNHG9s9Da$kdU5#JReBj^;18p&Lg(LCPJ z&FTjh$gGyRQjm2aEtGF9!FPQek?$A5oIS$%3r>&7-TTIJmwQ4gGj~zr<@bDgWAdjd z4-Gt$+}Y%w9W9fGel9auru!dcCdi9K!U{W%e$%K@s*Chn>0d-RRh_PsmG;1bv!qV) z9VaK=IJ?jo>*IK`ZIR3%L~VqqjksZG=(%OP7w>J-?YT|KHz)sMnbfjLa)zub=_Rc3hZpU+zeppK6+Iq>at$O)A6t}kc2{l-K_CqEmoUjEYiu-w0BT!X(fKHLza z_^{mN={EOa+@VT$itp;=4g5F3k%nbo9dJ?7NItCruk>2|!$FQSC;#)V5sklhSHpp` z@4#npy0ttmzl1eIM)SQ|AN`(lK3!Hg@`T(Y>$bX~tkQ>N|LJ?J)cT}+2gliO-1Ww} zyYHP){jmJiQGAJqhr&aI(+gOo+eNUoR;_4SFp` zeXo=hiF>lp=*_d=IOo-6-4^Xgel%dh(Vrzv8;RfjWfi~I*mvN9J8zazlXE=wKoa&q z`5UVAcHH3t|98DlOP|P&Q~j3S-|DomZ$rEO zz;8kEK8X9vkh{tb|AOJ(VJ+;muw!!lK>wa}z<_)1y(;NDd0fkGJ$5AB8ttk2^!iz>dETvYg8(sjS|%!T0<*qsBebl=_7;oiOj@lEUaYqtHJlArak{_cD)|4u3T z^6MI2>^=+Ex*@*J1LxQQcjH=dND}_d9@kpW6 zCrZ?hmJRsofFXNirnpb?;4g(Jkym$RSznxOwQ_~1R;WDExN{eph-;r2cF z9YKGuqshLg)O}?G?kbl0-ndEft{gTC@%yiM;J05}=tExIf!~m=lt&kNRLR3^L3fyK z>E_4lZCZxC{(p_1wvgJjsq9kKrqaD817_9K%5RiUom@F#`nZ`lR?eAJJ8SAqGb_7x z>3n(T%PTuhsjI7*)$6j$Zk$>-W%hXdp!#K#EX!rnr_Y&@%debIn>3-WvnVPhDQC{H zUAuI>qD#-NS6!O)9ViW{ojPm6oTRL`V1u+_?VN61r*^HmeC&*_HC@Jz15E(kHe<%@ z>6Zh>jhk^3VS4SX2||)FI)0_UOAmL0bo@SYnf$H2G`(R`YBx^q zuS^p8`DZ<7k2Eu(y(F@qiR=uMz#Y`zR$gkq7^N?Z(qD_xpN-P@S~#uG+(>^YuoqSq z#R6x#_W9pjX8mpm^!JN?WmMkA$bKu(PZIr*ViAnLDo97Xp;7)}k-aU_kB`#3ME1VO z-W=JxBl}=vH;e4Hkv%A~dqj3!WUq+qrvtlXFh9}%rSnZb{~`U;tJr_EJ4W`#$nF{0 zGb4L+WUr0v)q!1FpR-(juy^sG-Pz29cBjBD&40GbkKZ-tLA%OK`So+O7wezL*-?Ld z(4~*JWchV-=>4*%Jt|7CiR^=s{d{1T*0&JVw-D9m9GBjzn4fl4VAtqxj&pzMU55Jh z57SHbqjOz6KYq0R`l0Rnhqf>8+^Bx%xp;kw<(-#w((*>hnkrAukM!p|{lMaSqwVw4 zZV;vSk8D5RsK2dPKJ68ey)CjIkL;t7{Z?fA@nrlKQGMJ=*X3b)WsrX80}Qsj9Q|=g zwEth=`eRtJJlabm+s`+q&kxc|=hKH=JU@SFPcG_d&yDQGk?qT;es_>wTHb}OJU^dk z`}sq=s+j-6Xg*xz^0zOh)AsuhZNL6$`}IiM$EWS*|3y)G7f1a~8k?P~;9@%Mp^;r3*?xba-j5gUM*@9md6&BK{C-K>_aE(r#r(9V z1@@yAH1^3$d6K($tAljxH-3IG|MV#R*~nfS*?v7Szh6JJ{d%N*GRoh%xZarFJF@+L z!}KXZdTD=s*tO5kU)oj0@@V_{_2FoKv446L^|bwX)As9ywqLKbeSgxfi{knD$8^75 z^QbfjBH;&>iu}r_WSeY$vHZI#-D-t^I>;>^7}FMFGleX zM)sb__Un!LyA;Qhc8|#R*OyFR9i?xL>>Yt!IzPI({`312?aE^PXtxjS()?Gr{C+>9 z?fZ|mzkZ?Z%cJerGwmtG@@V_{aYZ!#SGw{?6!o;LBYR?G`~8Rd2cz_9k?rRr^?tvg zJtxvH4(!tYy2{meR56{l&wo{Ni+0v9(Ud12ar$|YzCN%^<5TbFKkcljr(G4;rTIVV z%Jbtv+pibe>x=nm?~m+_kv%%H7e;n{V3*eCYF8gWezg7g(DvtZ+J1a#-%yNC+wVWL z_eSYQBHOP|>bC~zrSN}*EPTQAH+n+CJ50CUGBHP!O`a@Cr=E&X=*?zp3-=AOm zM(gPsSO4k7{Iq?4)Ar+WO_YCt%ipt@pLS(rw-4;n{<}6=_CY2#l|8FG`B)VHV=jK% zVt(4bzO?&A=>sF%x94MWPmqZ-U3t0N&sRqJ`pAAdvi(?i1Pdkv%`M zeSMkV@8`7r`I)v~kF=LY@eW6}?{DhgiPE2sZ2$h|6H$AwckLZk)YD!N*}gtZ-x8%S zi|pZ%T@%@x0=slQeA3ltL@}MVFORn0UupM`^wp8=uU9^q{AWuhz928<$){X-2O|Bx z$X*xNrS)b0&c$@vT_fA~2h-O_>At;8_w$K%b)@&>!StdXedVzS3SB>HYXJePxusIj~FX_Ze5eLB(|1(<9rDKhqzK(#wn2e@tH#rLTzW z){)+?Pv&nFrTg{vnP@$IHk!Y*{rsiv>rdOyU)t5h`qB3D_p?b?oxjc9{{6XV{!;Jf zFYR?fywd*uTvBl!6I;1>x4L+KKVW=+exqGmj7QtIhqm8uX&;aDe!Q6ec$EHpV3*c+ zY&1V;`}slJ*N3(*kM_x8eA<3~(Dw6#cFW@U)7};3_w$YEZw2Y4^&jWzKc<*YyFRif zMs`(XFN|!zKF1}4&tc*Yc`27qRoq{hB!0gb7tL3u4=l!`-6OL7^*ht&MCq#{+pqr# zQF)VGeSCSe{rQ%*KVQqKDW=o*<JJlu|IB!>d*7B->+!<^-9~H zk7z$$j8EIwhxWQCeNSXR650O#?yXV%{=@a}sG^?sl*pbL*^46E?+46(FiNkD>@|_S zF0y_9GTzQ0y>z~P!PUQ_nEr*ReP49xBZ}igdw5Y#+pkyJzQ1Xoi1hbGwjV$0{d%Om zJJP=r*?#|`K8@dy?%Lb77@u|)*g{B4T)mqzK!BKz*hUY>kCW#;>&56hDkQThrOzg;mt?GBOc z`;X}(qV)NZ?dKcy)1vfeBioNZ^?p9l?pPdu+J1g${3v~KV3&^X%BcOTT>JYK>qEO| zWKWFjVUg|I&-@F5^iQ;;fj%iuR=e_62I==#Cdu;1_WKFr`Tc>m-`{CBE4G*R$sk^7 z`&s^wV*2W+Kkjq&>s(By?bp|Rk$#QScP;8^kBRIakzEzp^^v_cvVDIt{-z+kw0&!% z`qQ3M)YJCkOWTh>ZNItY7*rnsO-qm+RF`f3F$Q~5g z)sgM@7v`THrEiSv^^xt@BlG+IrtPn%Y5VIR+Wz{I_O#;o(;gk!)sgM5FR5P>rMEA) z3Nw9el)gQ(cSd%{D1U>-{_nHQUmvCW@nHJ?AicD|HoE@u^PjdKAKHF@q3z#K z(%xHaFYURJ?e~ACABfU@e>45XDBX`I)8C2GUy1Cb*k0=W_-ss0w4`{Hyp$)KT>C2` zyK^`}s<{N2Ko**rnt7U^Jez{dm&$<4N0( zCv88TwEcL}_Tx$0k0)(Ep0xdV()Qy?+m9!0Kc2Mxc+&RcN!yPfZ9jgr{rJ)L<44<% zA8kK=4@Tp+IjPgXC%z?PUY=};(zm$&A6Xn9+VdlON@V-}pZdj7`o75C8rkb2yF+n4 zGM>NQqCF-`_xlsmcSPwEBYS>i?~3gGk$p6sQM-w>s*jO;m)Jvp+s1a|58?})~mcKf29cE`Xj z&A-#-?^;Z!JutGnN49VO&Zxg0aq)b9+BjG6pj~NZLVIvz`|_B+CP*)>|1MXa*VFd< z0d2qk)As#KdqXikZGZhr+m8?Jg^~X0$X*xOk45&bz%FgiZr7gC#dO-sBYS*g_m6Df zKIZq=_q6v%djEca>1~SZg|=TGwEcRey*-Lo9_2q7rThJd`EQ8yBLlm%fA+Zk@$-rH z=3;!>)sfvhvL{CN@yLEMva#3jVEjd9Cba#0p?xGu_x;86x1;oS#r87YpO0w|iqdN$ zyLV*!^9%D2iPHW152lX~(o6e$uj}s-#ro3r`#bG1QMy0>Fx~eL?dnMH*ALTQj?$lv z?0J#>LS*~#V!TJ9^vT8cGTp!brtRMk(yog1zQ397|6Z{-+7I`+{%cn(pSC}L(q0** z`}xiEZBe?v{$aY`pJ@C2iMAiFeNp}PyZSXR#@`>MA8_dv#dO-O0=sm+9CZ2{is`id zenxwK0~65p*K4%>c+&R$qxmg+LVH*g??jaTqI@=(2lf8_FYR|MS>koBq){a=Wy#g< z^Jo70f%+Sw@|s4rpAXdg^+kJdr1$IbVDdfvf2zl&{PLumE5Avkf2KGe8E;5A>zqja z*K7XN)xXN+A0DLNUn!rbkL;FF{N|CpKGJW9>@89M`u|U3{rX4oT19&KS`a;`Zywpb zBfE8EcaQ9mk-amr+XVGl)0RaKl$Y}4Q8#}pgLL%QZIRtRvU>z}>3U$i-rBlE<5vZC zss6EO{r$?-r%O>!dvIj?{g>$zqx5aX_A}k@2ekeD6Wadop|p<`=Ns)6k^OX3p1&VY z{mDq*GOEv8#rgEBq?yJVCa>kmtFHa8NBJ8BdW=tHWWN~ck3{L~qVivf(lzY1d}YZ;-F|l{NM9{_fBeqn_vaVJd#fm*U0ED&+Fb*?^#5Id7q#d2E`E<lve@&GCP*h&qD1Bd)?)MwU+Z^d1 zkM#ckp{aj6s^9)7|DniU9@&1sWW1N7^lezI?qK>Ok-a^tU#lSfbMjp!ICjXRJh{TH z7k@t1_6GXi^{I+Q|0zcm5QuH|F>2nYORbpCkQqQF*j|eA+{bzoosVn4fl5oNu((2I;@o&s*Y}p*;DUi~n+vj`8gt<*y3t(*FIc%kQs0 zX#4$*_UdAM+J3*GEgQ8SwC9_d&|VqYzP(KM`w{J++yI*UW_W^1v=_AFs!J{#T>={KM7f$zp!m{(Mf`&wttnBK?BM_WeWs#wh({WN(h_ z7XtfkeKU*q*yYI^uD*UgFutEZwD$!0v0nW7j_H2B(Dv(xc71Wa&>k4sV=BXe$McP(Ui-6+Xv&g4(SH7BG(Y|s+5d9= z-?A8=cF)N6_Y;`z=f}UIc>i|s+7|QE_VbyxKOfNc>y5U*|3Z636mMQ&m-gqouKcFO z^mn8BmAUh6>tZ_X%E;~!*roB$aQS`wGot=(7{#aU8%FsXNAVj+>1RgqY5VxJ zef%?{{2y@n{dj*MNd5XI*%Kq%?|01a z=i}K?{Xgi+TU5+Xdr4&b^8?c#jM9C3n7%ehFKu7Jl{debPTOD4)Asv+A*$~=QGVJ! zKW(4?oGAafE`Nt&`Lwgh?ibm9JgE2U{oE-2c`kmRV*c~WKBeDxvQK>S{Vy)PSCEeV z+0Q@be=)V{c>+-f5?@8BG9A!cOu(g?=Zf<-+x}& z1dWe-pykPhE}p;tOns-~{!RO65WjRjus?Pb(`i>lc5P(OiR^8GT^j!aSHHBFPP;0y z{dh9nk3Vfco)<*p&Hij#j7Pg;Wc&HW^sZ65pI;w};dC;C>rjEzt$X*cG zrTue}>mOe~+J3#$_U)&Qxy6IF-+yRVTXI5sO=Pc+?9GvVG_qGm_V&p3`wz=I7^M#@ z&c}e^pUWdqrgX`N{NkL3(L_UgF}lFE@eOX3F;+-Cr4ge-`aQQTnFHo*CJ` ze$4O3m$vU;+Al=;n-u$l>3+S^_Sb{7M@4#neaQ6bQF>L>et$ob`X*8Op(uanD7|ZB z`_Bt9UaKg5VPM}{S!}$(rLO;{1?l%o`pn4o-zUfTbEEY6fn9ok?b2v|@%vqx7OOzJ zL1Z_IY`=d{-#tnn64|&{$%FbDGxhsr{C>&w`=az+k$p6>4@LGXk^N$1`@aXXJpXwk z+8v_$u8QpA#r~zfU1Tqb^amsR`N;O)7sz=2ei?0lzmK+@*z}<7@5j-uh|>LhWcrCH zy=(D)7}I-2w*UJA(|bhegChHdDE^2by>vgy-F)}!lXe$tUP9Z?C)&%R^pTPMa%49z z_BZqU_lL9}iS&Ly%FFJmEG7zE=IVRA=wg1qU(tR&N`E`D{q+m={`!P=)2P1w{cv73 zvoid?K-Q;Mr0)~i{Udu&WDgDO(*5GHXur7JwZBubJ+#{ecIo)?@2!iA>9qa%jJEIp zZc%x>pX&3|zM&Y8_PWSk5ZQkIP`@=wpC8$`MfQfkE^XhHu0Q$}(`omLY+qld`|Fb{ z%S!wEs>tpY*&m7Q-jV&$$nF!_S4VbLWcQ8iYs$Xdij8R|FBQod$@1o*-7x8>_Vcpl zE9CoS|409RglnJ*`MuhPdUEOM?6Z>dg6}s?#rKqcA121ALcZ_Q@7?@fnA$i~eOQrsc8o%15pOfVJeh4b$pQiCgxb$n5AlZildH3*>iuL~GgTxPBu{F2`<(ruq?`5^ z`{%->QtMCqqU3v;zufiD#mP5{do9Zw71{G5`%$&`xbiMZu87k6X@Azb_?IT5wLZg~ z{=><~_4|dybnR&!^~dDM{%X{JgS0*EUA)VZ8?^mifxhmwrXkSZ&My@AE;4d{P?yeP!~L+VEj~j-Lxkf4f8j1?d_X74nVy zII84Pkqk&$s0|;|U&oUiSauc3waH^@!v~z9-_OMKk0;|bKKA5_VAprsJM-MKU(|y4v+FeQI)C+w+LC$0c9a{Y*^PACE@%Zncj({f)_` zQF?V`4^x}*Kc9TQ2_h%SeXc$;lD=xghyHJ^^M9pFzbSboO1}^rtsESmo0GvM_N=5_ z_Y-U*70K*mr>4`Mll)lcLuVKNmSm~U@28#qKav@`UOG7Y3&}02$7dibk}oFLsJ_aj z-=1_T(ch80qWdGZg^J|P@Ov&H9pH*oQ&7_2wRaXNd{_s+FwbAs=kv; zUz(g-qFPH^2a_L0>91=4;WS^7Y)<~H{cq*} zJnG-;qW--_ZRX#al-^{S#Un|Z==^$y zo}b=!`d!H%qVrD|-4CX?@^>d^Mf=@(x}Mj#^gYRmXgn?uKMq_MR3v+oXLbA!i?1Tt zmrRV>Q|HwDeTRx}9 zMAs+(*7hO~y7~ppZ}x3b`>%-7k3gsg@^_EoUl{3sY+`wZer43&Kj{3&Hc*lLI=NH( z3(crVev^D(=fiwwKat$6?MFXVB)?C-gNY(XZ+TS6=M%PQ{(5K2=LvLw$2E0D@?7$~ zj+dCOKHrGyJ6~&@(=k%FD9}--b~)r{Opf^CiAra7K*GQ`BySC>i=eHuW{-BPVS7- z@6_^8c17}T(oe^`%GqUQmz1QRQ8r2Ym+1}5MwFyCE;~_@erDNU^?Z$GBG>a}qxAY_ zx3kYGdtCQ}dS{kMSU+DTA==A57 z_0#^uXAI=}y6i*I{@XLU{<=rgagVSFr+GE*Jmevg@Pq9T4qrsHgw@V3Kr$ zLk>)PYb)6NNc-Q>WBbjt4>2^U?uY1xRQKi%V7-p$4Awc_6Rh*23asbi!C+lySU0Km zG2YYU+P=~7>)M{JQ=R3Afhw3ScYuapCjT4>tcX;Z*0|i(ox3p8#uF z?+E8@Yz2 z-us)TeW1y}+QwdBZCC%mKO9`iwu}aA{Ayu~iO>0)zXq%^v4>ba7YCZ9!j^Y+;9n2c zyj#IqEQ+bSf3+-AD%LupV(*0G!C|gvW`ei+-JVck0o8E?ZxslKbB3I?hlya z=C1_fNe)aG^CNVb_DL4_y9EC3fggL3>3awMs=(hr@DB?7L%`a`VS#3N;2#8;GY84zM39zO~7>l&kcB9!1Vzy40v(COTo?LNsi_6uyR*|wQj2e{~EBa$8~{! z1GrM2Y21I47d!=x1$CoVZKHM7ecCYijX%H0F*1HPP^LEx_BVF8Z>ccH%;tZ}A*b<>|N zoU6Ys@MC-}FUHjJE)95P!0W-Npd4sd*2AG(Ur78b$!KHYR$gp??Yz@YIO|DGM|m+l zhCk~?e+&3OLdI#v;(#p<@@BoML9+}0!Lq=nK{$(pm>D`!4)l3?wL|uK6&ZT@^-yPk zElxjS%ZqCXD+_EI^nb4L#|Wo=Z?D_r;j>j1X+ zN8z7OKiK@Q30oYTmkVE{25g$9qR9rxlN{*h!tK<6P2DFB9FoytOM9Ijf68eyyRr?UUBXt91Zd-gd})y*%Mn9yTAqra^rQUuI0O z`CG!TF~R1q6i$cBlN{aUk$%ddyN{lZAfs#2Pm@Q3G3n%(B9HVl4wLEfl8++S!msS+ zq4F~LKTFLjdC8R5!H>XlY?ep*IfuzsdCA9+cf&uHydPXmehfU0d{|!c@#G`$YhLV! z#;=1_^G?7`F^9F^z}7z%!nyWO8(}M}BlHs_fE-}c==43Wap5&;M zN8tt#+4P;n&OYzl?l<3TpX?$o)AWJ{lR^$x{~2U-Wnl^DC)o7W!ud>jlH)dc*jRu~ zgMBR5a+d`fuxT)_(wpQ-j`i}eegK}as~Jna!Yx!I)g1H;^%Xz=>Wc!jIwfck{n&- zVeJB2-b&$go;=CXQ6A|R9J=2#H0}q#Y6gPmQ!`Xv@-LD{!Cy~C^9px!9Klu=#wfj= znq}Yx{lxksMl*eZ`yW9}C&%%dJ`F&`7ozA8_0JSmUtUWduk@?v?93g@fn ze*yllkzbLQY&H3WyjcC;2^jY-tlz*^F0PR>t(!Z)tYn<_;!nR$&V(&ySLpAfAAh&A zx>dpdpY*%?7#b7zE>d)c9HWJ;KfzXq$-*|iHDJx#MDk>qXmYfbht(f!c{>Vc-;gIc zy2!)E9c-Fj!udLRlA}@{g;nf-uxVVJ_2Q7jt--HR6RyGTNW0%j+#JguAdirj!fNWl z7ITbnwvn1@dC9*;#@bAkYlX8-^v{)-d;@ubyrkbIV?CN5U0L`#%K}?jC??aq+n_nc zKK4kU*(+=@n?bMZ7i=-x!LM<^=0|_pxfpEze!|&id6HwGJn}6L*;n5s<2;*ULC8@p zkL-J(BpEM{6cv|anmjD;BH_YA@bbNbmF4J1`>pju_ki8C+#1e-_gu?q{6UDbi*bg6A0}fx=Grd&J;c@&*y=e2`X5n`^=NYd zY?=kaDLP4xrO;?UfK7wXOy)bOSqqK67Y3VVldzSAzw=mow+FmC;HDBT+rya6>jzNjO5w+Y=6oLk@S|*-xGoUS6!9!B*~a_;oJ=n}4&g#jFs{ek)IMw2_DP1K9NKg|j2_ zBu5u{6n^K>v1xjWD}9Ro{?O=N2R6+x__aP@^N$qHe=kpRpuH9!Y?|AIP2=kP2XV;J zN*?Jm4mpk+*#DK{vb>mYnd(vh^pEl+2kLD71~$Fx2W{hf`r%K=$?NU>S+a|%++AGh zpXu){FV>%6i;q6Zj!`oN8tp5vX)w?8=cvKlC~RcAz^0iloc)EG8hJ^dC(o4^YZut` zi{aP)2b=#v_`k*YVDoPi&W_8I9N1E=4q(&l6V9~`SSq>d+Y6^J$derCpX_fA-TNl% zlOE!-IDMdbk(z<>VtoQO%~0X=C2G(=76)vaYT@kf@+1fPDu2ZxuSH)aqucK|z~+AzejQ)1`7tfb4>o@b;jFAop5;De!03NFXMs)MT{u;JKWH{{ zj)6^sKF{z5LXI22svjYoo!on7+aQ{>z`R?*_`|Xsd*xBs$~a()b4WPVHa;$#okRUo z!g)*b3&MqSJzL(_q1U`vLU#QIHVuY3$D2Yqnt)Y*y8f>aUDld%|q-5uxZ>pY|A(!#GikNjJcOrlB)xD^H4Q4;skYw->oBDu*=a-9@Z|fX)@vLB5HaH=Xf(MM}K)_7n3osj9vZJk2#j=KOedJ ztG^olOPF`MaN+yx2e6e}C!BSp2JVi{sq#i)TNhx9gSlsY0yh66!uf|8 zXOD2!iH!59>A|LdOgPP`ISkIpPlEC0MvkNMuyF@l-WTE5{s)^M^ESPVdEXY!mEC;1 zoc>DjXUZL+$4v|Pz}?8*g>CG>7QZ)ic(Wx3#>?skHqB7s{0eF?->mIm(@cb4>kl^n zbm8nu=Eb<=J;=+2Q`}IIV~sot4|9CMmKS4W`pp6F2)I%>!<#}m&~|Gh*y3~%&OSm7 z=BKq0Y?>|1VHvb~z?MprS zC+$aG2EK;8TG;9gw!9nQ*O*}QyS~zx=quBJO@n(-ZI$q_3-OC0&M=p!r2h!#e7JwBX1GTKStgO zKi>4qaY!D8A8;;#EzS{PtMfC$>Bp&mRyfzXJrCBHZJ-}U4f@CC1K47sud?f@aqCO3 zi{kZ_-#`uKjLi+O#Xz zftsg~cOv;U;leJ?H?XzQ?bWKsJ+WLFr~iCB^Hz#J!_8nhI?BVw6l`(22xm7^(-RsU zQ?O~OgwrY141(r#d)G8-hKnZuJlXZGm#-xg*ekEw9_VRD-!xxS3^vP18d-tEGRKa9T$m0sn0BcwyV$z?K(lEt^9P z`Xs-FJO@0BjCqx+e=+oP>0c*Y_#x*5*kW!H&Tpk=o3Q15RM_SZ*!0Jszm59Wq0v1P zY?_ns>z)ZVKi*oTT2EZUTAkgxo5z@L-F<=V*4=!vTX*Vr>rUCtlP^*;MaoL+$!^`< zPOgW40okoP)w{W&yb2m+x9;ws{($)HJuKMTa!5G4lNz_~7Li|u{>SWRu<1_-=c<1v zVBCMs7cy@f@n?(4?S*Z)ZyLf4y*~^~C(i zm9f4|4>tYwK+{|}UCnaag1=7g6mSplee}Dw|AcLc+n)a?H6x&3L!KDqohDq^%e-K# zPpz=!of~kaaJH6lIttrd0$W};F5jT0Cp0>jz^17ZPS;U02%6KK3)WMEd6?f%c5D2b zU|zT0A0T5)(~acSh^ci3Tb(z+f4Xyl#@rETz?OHfaITtG!s#ZKg?>xF zP3|6W75G8=F^3ELI7VQLISQKpre;c@cXRt^@15IiM3a4o`u4)s=U|JOL9@lz$NB+v zGY#fg`rV*zr`u1yM-9f#;(#sAXyJStHPyoDR&t&2Y4?+dsKFj$V*$39YXU#m{BFH` zpLu(UKUKy#CEr2+5ahiqUaXz$VQLl%r#s1R{``RK=FcPKRid%J1zVi8i1R~g zuqRlbfK9VSINe3f4rsJ*!KT?Qob9G&KQua5!KQgkIQ=m-PeP+{z@|AWoc)BFXNB{< zWLzKSKP8_KPJcvx2fT-j^L474_QHh&oNr)@-&xq=^oK_GNw8_~mczyoY<^rWn;&d` zT!yCm9CEn% zqwMC-FX(^Y`E!sOH-G+zycjVbCA;~oV-(J3>_6ErsaYp%?E+i6;^`aS`ppUsahHXbFMzr>gm;n(=CZ=m**r)Zo9p?Q^l*FVZ`U909%38$(U9y{Rx;KXNZI|e6j)AQ{`-H6y<-%DRp82`B^b9iEXj~<1 zYZGj71_@^ksK-3XHScI)Tbp3hPlUc9^|)R#{T$&G|C}ese0f+ugDvkO;jA$=%b?Nr zf=#nZILALq%Yi;j&m^xGwwPekWA0`6M?g8Y$-`oTP4kFw{sC$Z3a8D;$H8ZjUxubR z8SB@$T!zQEQaC%C8k{d|e*jxqU7*1~Bg)Ya8r>hjrWqRe!RBuyc{2T?wr1c0p*{{aDEB7Bm5o7o#DTfTqT?; z4;Hq$0k)W!KUpX0v0e&)?e5_`kPCi8)FYiFQ>nK;O{AH`vBPLIY>CuFLxX)Y<)5s`lD2PrH*{Jq>X}{3I-s8EAaYCL z!g1yWTV8NBn40#`E4z94ar%2AukIUQ%iAA*-AlpdA0wO%W!{O<=z9mSX{JN-32Jc8 zvhf0&2Ir}K7&Qxp(;?*L(Cd5yn|`%$c0Dy~gmcwz40s3lI%?WN|4DKu;S~Q|E(g|{ zwHIvh2g0xI1)G1UaQbQH#eSQPB#!`phFmRdZ3J6h^n=9&n;-p)YpJiDqq0#d=*fi*q6#q0Y#|C*=9I$D&2xnucaeXzGd_?@|=g7yv)#MYxg}-uM zfi2ES;cOf=SZn#G$V~!n6>uBy2x?j*?*uZ|MLLn(UD(D2Y-NptW->Knz&Db|gQt*P zKWm?a{XADR*8gCOSudPx%mu>fRK{5%Z2bl{J@&?I8a0@Q`RBX6v#reGsex1)?i!)C+t7G2z z!s%@C0`MF%=9|qiu;oSDEhgCf>x6TS`KWMu3*$U4oGH6`HJAQZpizD&U~IbPZw9`V zdc2P_ZVkSTe)pd4KghTyOy`k1gVkRpY<-1miS!H9j0*f?!1^ULlcCZ0GllKE3AXmm zfu@FWZUcXjya0OL55cBiBAnGzgZl>7w_wxUC!F6-&0679zi@aX^coXv`mMs*9n^0V z&KHvR2&XzXo)<2>#5oDJym+f-a|UdFT+n29G7jFNq_t$cJxCXkak*^u2V35D!uc#} zaJgoE?)Kir^!Jvrwz&B8B))YL(vdnVX4^Mun?)GUNX z=N{NJ%Y?Jl)GQayzfN8$oPLeG0j%S=Q@HSV&O@-p!CcLkP=5%l`Y!1I|D+%Lp3NDs z`%wbV?9<`m}(?33v?sF??i#sOO#%(v{D)SPagbaM}1 zFeAqrc~~5<#n~X7ZJ=f|G+H09X|@aJ4^Z<6Slhc>I9*5oKJfkIN5LD(j|*G5V2k;* zaP}=~o)ykFk>3V?o7@27^`K|V>*n)+)1P9zRPXlW&Gh#`-d8!+V9V?F;qOp0Q2eRp zb?@nvha<1v3j$l-YWVeB1~xzDv-!d1pBwnW=C2n{x3CVF&)Ij$i{Rf%#(cK109)QQ z@M|5w=EpqGHRfh$^jr)!O)7nxZe#p5;D^ZV!Q08W7RtU)?h5}7vRex~$?v-sen8D| zJH3c@! z2I1@{)NF?4bZcQRHEu0vd)-?25&iolZ@P#4DEO!3_gxG7sCicO`OnC1E$k=1?^^gd zHEu1a-mQfL^t-k2kJGG$Ur^)Lg64H=LHYm6S~$o$xV7*=nL3k@zh ziITEhAkY?^h#=^q(?6Zj~3yKw#|@*`l4voG+U z0PDCkl72hYd}}5C>=@%zLZkZ<*y@05*X%iJdI;yo$^GE}3wele`aHQB{8#cE@C#(j zrSxy)dg1&<@*?%d=zk6TI{Acf`Ud$V^6K0MTV7n>+S~@4zol@h?Q(nL3C6*DxAaZ2 zyVlh`KfKoMj+lDR1zXJC!q!*S&}d$;X=Vyr-_{2DW@y(xS#AsP+vH3*{TI0>_#JW; z_}}FI!kO|w;rt~1m;?E{z+0<@Glm&a+eBQS#F=v zI=H!^ycTiZ=2`<={Efm{8SAhaaa6wxto3XP%^B3B!f69C)`-;^Y%$vj=MAap0*%%m zY#PML8V7N7eT8uHceOI{2Xd}L9ah7G*~!2mwud2GyMT= z^kH@${ngOuP4kJux$38Z^@ey|;J*#}Hq7hxI^`AOFC>lRnZNO1b-PdO>;mdBhb{gl z_%;4!;Z%R@e7mrX5!mAFgI~u8Z2m`ut)54r(Y*z1no8lUl67!%Qs-?vC$kHw!Cqng z47NB`!f88d20^27z@~A1t3MP!O8oi7)MI~0FCtGD&N`6MpV=kk`QVP^CD5yXnQ(q7 z{p+C7AD-U;&4=knA6mbGtv=Wjtlz-qM<3=I=P_us-@vAMQaH^R|0!@zeg@o`{JgOB z71;8=4!_0(oBti*Tw}JAJ>1&f0eic)*ImP0#`yikUnu9i0$ZFR$lHaQVZyoQ9TD(k zu(q*-l$+@fa&<=CbnL(u6JwoqW6WOQ?&K<|NqiVm??*u=#Oak!#F4;dB7w;68)-E72z( zqraoD%?Gf>=?cwYYPt)jA1C(?^kCEXhyFThhCrkJ05;8V;e04H*iX_SC&+G& z4I{h#tA%Y|fvv3dh&h~^jnIFJycPOW{IAwd==DeFF!$_lzF>=a zP&n5*U=J}q3jQ?X9}~{BZqI{np#K%HYF-ykN79cy#O5K`%4#O#W%Ceh{uUV1&oHlh z4>gM12L8{IF+Z*U!Il?$k*kpDj`U&#|m_!r2%y=1e-4 z+z0+@azEihW3GL$l{*xE{r`8c`9})p(*BdHCSKi&1AGapG8J{vpVu}Xllu5 zS2~-#9XyA;AAAcL=h;jdYozsD`oUI*XN1pJKiK@w3+J~|k2R9tMt&QtZLE-anEnU- zZco-9D|7p>`o}{vpBlFZevw=+ep?q{D|c0(UkBDWJD{&;Ua;wRLvuU*2fz!+hoRrb z>u0d(p9=KH0u9(SF9w(fd&*LrpmPVb<<7c|Pf zgm*x74Q@lEca!n<-o^-Qdc0LOeIt?P%c*ZJFQx~Z z9&bysuTq1z4YrSgP16OMd#J&sRl0H4WG_sG@05q-nsWxi8RcfJWyb*fg7kbM60a!s)&8B*#H{ zu{8)b{c&i%Ow9}OlI#3=9sX7H<3mY>uX(n-O~s$;-j#x9Qqw{>UrlZeR!y5gQwjb$ zHSNLwN$xCc^#og4z2MjLBiQ`?gl&%+1lF>K2-{j1AzWz0^B~yrRzst8o(_$^Hw2qz z4m9X^IhxBO{V#Gm;ld{F17Op463*6A(@Qv4?g;-kwT@cC zK45o#(eFwP&o6UClRm(_?)<2{8UBs*Ni27{R1}5R$=R(o#5|NzX!a7{H$>PF!=@WPV#F3zXR5~m6!Xv zwGb|RknI9nxow2AM;NCPnmL^3VAFJj=7-dDfkxLR*fcob!vh zm^eQc&Y=cunw^1WH#9A&0h{JP;0K%kkZ`JF_oT4R^9E9_^e3!aGkGcK_ltrpZwui} zHLZkg4zz`TuRO`oKJaJ4HWpxu(^EM8fjr4^1Nf)p$?{^~jSM#Z9B8!8^P$l>05;7c z;Y`;8POIrYd6HwTyx9JRZOHP1EiaZws(T=cvF~~Xn+8+C;v4|$xE}^6R`RB3a5`V{sCz8J7dA7!F#t% z>-;42TDPZ#TR*|PVACHJK41M{^S>sX|CaiWvNxt0vkUe~_2a#{`KtoIWKGJRWM0gr zvfq)LfRB(dH_9|l8t7XHXHQepM%dOM*y`3EnmFByR)1MBWX4nT&ar z{+*1ul)plL8h*|DHuzQg%P}8bBR2*AgWNLUO7QFScNVty3t;Q>9?-l&%|PM&1bGPf zP4Wn6-Xh~##oCT*72}$KaUEjw1Z-t35zha~I4hyoI5cuEp9}W1pu-$V2TODvsV)q=t=6Ba8CmH80@moFL7Ea%#zd^Y#w?f$76M-#G zYvD}$6YsU{JrUS6T?5Tf;j|1ZSN`@2E+@|nxK7yG0=77Fg{>`M^VbXKXD|+~F>H*M zgB#F~YYbcOV9UD!nugSDhDO&r*fe{Dt$*D0LnG?L>xaY8==eS>Y-9a`aHjrO;BU;l zZwXs{z*d&K-e^KiGZ_Y}57;#AgsrU3!q(m%(CalG*z|pbGi~D_=+9()TuY>Q6DdcH zu$2Y2ytoZy_wm5yUnZPu-qphC2N-9aaHey9gRs5t16y94HmrZJ9b36z(_mSq%@`Bi zohhSh?7j-v^hmb*Dq!=s6wc3*Cpqx`*Y?Sd!nQwvP2WY>_6PUg*8NA2T#q5Ij^kwH z)%U7k%ew%6oj+jnuY|w3Jjnqz|9bfKyZ|=;gThwU)_`|GukpdAKNx6m?n`kqK#sQZ z$UaDJFPvA9aeZRr0=76U;m6GbIl$(3anA8^EH7f32It2doh^qumz_%1Z7zW=Z$J2TZh*}{41QfNVDpa@w!R%L zoNGUKkn*xlEVr|;?Tui|i@BP8n3_Stc}B){TAGt53fq{1E$?*U3^&Q-sFO#28F{{N zhK)pydU>SEi-qkoU|@^0LfFb(DV$x-ylbJ?egK<(GyK{QVDoPm&bl)14&k&L`4Mn; z@;+gkOJK{3YkP|cHvbXf^a|#EMmSe?h9=)AWa5#}sV-A;NiI<{bu&#s{0m zUH_}5mH5+Zs7Kw>{$#8L%L}%=SPR(zYS8v{Ah{3pTjeAy2iWv(ji`RO_|t2tM;+2Z zUjpSpRmS$%e2j zr&mVX&0i&Kzf%LY_=APB>zH?_aQ+E0`XL)e9wVIMVnGhq4;Q_+AKd$_Pf}Aax_mep zeUg5Pyjr+0!n4(3o%pj))4xGDA4%Q{|7XZMgl#T?E$;#0RNMO)H2T{;VAH$|zuw~l zoBu80Y$)TuBb<*SH{y=jW{z=q4 z4c2x&8))!8%VOgFlyM{38j37^nBK@ZZvIapr{cHYnFU+_W8S7yslhc{I*r^r;C{lb zKTki{@(vU}U;SY7Ls__l^Al`-spkLweL0PTwpbj&;{Wo4&5yFq=hl*hkqd09fezKUa;HlK`rDg7e374-GwwgF?^*>z6123^brLCl3g%sYdai-MTS z?;CS*5OYZo^D9Bjr9n*P)5U}`Tjt|r%gHU##;=k)38%_E10E=B@5R8@w+o?J!My8) z^LxmfgbO_y$ur-_ncnsDz0{ze(^ce3;lh>FgH7LAIR6?oSPSWDaxdZR>txJ-yEX{d z!XRkwqh>HP`nff*#UBoh#>8G^ns{HzRWltL`>8XYgN zX;#6ndBNu2BAjbmwg=osIK7`S+X-hI$Q{7y$9c-y2)3BL0!>w*0h`8+sm2)wjlQ1( zn+AJPp%>>8*!(l$*Y_h}^UoE|A7DKf1RAhuPS-!Kz26GjyD4a|`ro&`s;NS`_P6Yy zT-RRJ{QuhCZ~vdQx0%!}{cq-N4c<&{E1Z3Y++H}}LdKjo?jme+3~YVdADZt{k9m@Q zkL>zwn`hHwAIKh}AL}UpKDi2ccaZyoA0}h%q&vx@g$qCMY%wQ_Kif|KG-w|2Y#O(Y zbd17vgn5$vkov{K=`QkW#OcF%2(~!uq5lyzSV!q@@($>K?Ai2tpxHzJKH>Z)j-Rm+yk-o0yckJ;Y`b|6wdduJ{^Rup6))0YFeQ_ zx=z6s$L$IGm=|N3{*2s9I8#6NbK`-+c6|u8IKze0{mkpe_iFYz*ff)cv!7E_Bb+O{ zG1WaG9MgrOv2y{~;w%gNVDn>dw0dq3P7koGt-`ss1+_{K(%%~VKjd}+cLYC5Kh{X5 z+ynee`q4j@x4&@y82xxo50RTd|7$Y(JUdLrewF`*Tq&GBPVNx+I|uCQ{3JC^#h?9_ zjJl;q$f#TXJ2L8)KSiz%G&8~KpA&F<@YB>|ugLyDMjg^;$Zl>Z_ZENtNBa8(JOuiq z^kcmjbl(8m7>yFn{zMJV3;DBT%#HNV%qt9Um|S#2H0Y*5YC>X=04&4FXVLr zKN#>%VOvvRi?bJgJ^zBue++)zi@@f89e&-5z~+BPID3J0z-QrX-GNQx?sIBA+d$J7 zqb%3Xfu_B1cARnCea`2}?mnmPQQ>{g{)l7u`hqw^h4a5M??|wg>*oB68ehszU()zs z^;dykrhk}l;TqNxY;AF4s(OrLp*1yN(_p^Yz5zCWJ^b3|VDn>q)4#La<-)o0YGKoZ zP5%fqT8DDs^i}4q0KZ1Y`7!+m8EwyBC%g5o?B=<0f9T(!W;pl+xf=W?c?$R~@^s-` z{ca8`&kyw2uPi3!s_{nT)jIEh|82%ZyNvgNRr7ej&kI}Lm*M{x^S%~vxr}@E4*mFh zis^B0&0=Ei8ROns{!i-hdCTwlLvtp1lyK{&o~p20SNVeD2XS3j$siunccf zrg6~2WoNMtIPVzaTCq&)nFibf`~m7)ft!(WZYpa|t^}V=ZVy&H){E(JeQ5E!1dMfL z`ksLv=MIZ6n4}eq-x7QdxgEGAxr1K;l)d6E|rmg9(0iRE< z6V5d+_9ct6S~yexdidK=zXf~&*{##IWVipQe@~!!G~lPfAEF*>));FxZ$bZC@Lx!7 zAagZsM{Wkbh@4^$s~^{drfC;&SFqN<54ga*!@%vy!vmfSzL zdai+A>%1=DtzeC_8{Cn3_k%Ab9}4tG0zMY-%feYF>T$0-%g9Y-{%4)Z&4km-$d$rY zw|3BUp}##em1L~tOzVcVZ1wLhoU0$7ZB8$zz8|^G#l-*bSXp56KPH^#jB`jhyOR7k zxF;E(Nw)Di2EC5y^8vpea0|JYoNN8NfHi*iz~3|Q4-EXn1AjGG%W~)FUaSxHne-!M zx88e`v7e->!5(7l*1r005P$Yj>TzwEUQNbzNLodn8RT6mocE=F1^oTU?!0^r8Rz9x zc_;LJ=zlEmKQ7$5KmB0q|0BZZs~>EBto?i-^;qx5Cj-X$+WhUYE{0H#&pEWd&a=hr zEdKM=4>mu}*Ve{<0pr|lew@3F-QUZ!PsWJf`dO-$lxdyax#nZ6LlgLwn}M~j+_^@% z1^ff3Zw0=V?9MfV$d&L9CcATu>N^H{%m<6_&NUhzbHn2I4D{|?qw%ZY|2X6K2WuNK zf69i@KP2E`VD0na0gnU^rG7N{6Xa^}_2h}*8^}|@s-F&4JNmfnn zDs1o3z!tMNG~=l02aVnv0h81;?WF1BI@e8_Ti3Z}*0`|~C(Rl=Yf|0V&riB_Y|XgZsdcv|GsaJvST}u^ zOM)B8niOS5>cmO4Q|FAUn|jksC!8>@X50isd4K7R67zJ@+DS8Rnls7OXyUlKabqXf z-ZW$E3~|=_y3MGWI`$T+?WD2er_LM~CDcwDH?ioSG-E=|dulUf+^i{M=Sa;bzb9!N zGM_qW#<&TmNttj{&8?_#+-m9Fy4ssgnH2TiO|$E2X1igCV?@HKGf$(NG`HraT1K!D z!~jp4P&0Pwj8i5}o;-2N>C$Q?YmhA(%^)Q#t7hEiCym9>O8WGvG7V1EC;v+#nSYme z9a~d7*(PUkR$7~GoHTP%?KqhL==QJ@u2m(eQRUw+%~g&Qe%7p8ZmON=!n=hc(|l5` zOuBJ3HS(&xT{C;UH1s`nK&QXI!qxKqB^ZMDDx${xzX~uM<7Q4AJN>2!pC4OSJ8tGI zS<91Va>dV@epB7pTc*}c8C!FcwBtSVwtp^5@v9_`6)95DPace@u$?EG9kRM`;(N)P3PE}n?E6L<5W65#W_bRZ#opKwD*W)cyYk1LuJyH^H!o^GH z&O>I&{yJew=elv@r%!U1T%|(9ubnh&QmtI_Os<_&5~Acv&7X6}PMukIliP~pI@oo{ z*cozWto?u3d-w3Fs%ve0?Ib${MA@(bk((ib6k`%XxJngwXc8e(M2aYQ31Jf;8X!R8 z?RZJZMTkJrfJLjGlp;lHJr)ow_45}HDN>7+Bh*^!0jt)wo)%j`yz;&8nscl*_skAj ze}9~(&v(X?wbvM9j`_|pFKe#b$Xw;6744grR^W`l^XIJUIdd>23!*d_udqsI&nAF3 zhf%krdX}rpi7rInBhhNY#ih6LbXZb47nO-;V9iajwo*D<#XUvFCi~Z|(ds2txGZEc z&S#|V5jt!+|0qCIeJN+JCVz;GR`HHye#Wcz)^aB?~JB(#=4?uW87`#6xsP ze_Jpwy^VL~^hl%y)$^5ao?BDSo<%;7%~SOsObaFt=)6nug_j6IfE}opRh0!IHAL8E(bN3zNJ$eO29oiyz)* zF5wAn&cem+bfj;uRB7#A5B;-1F;_+I6|!4c6!)I-D#rGmgNH=!sTNgp-DGWbxqe$1 zr_`^Ki3f0u@9qVa59iI3EX=zcD&Ymvtm^WLs`55{V4mRGG4an_?HFi``DII%a9Ffs z<-&Z4O*<1NXKv_!Ydh51!?YSxU3Ii)><*Xq z61^&@Hfq;5cQ(b5SdM3}?P2k_Q*#@yp;ha%jh6qj+PEJL|t@C*kycoE47VG$NPwgeQ%$@_gcF%NY$-|SHasK%dOYhX;oqwtq z;7tS0?A43Q+-KH!|54?hjNN-s>w;Ep7xb+^&)I(aSCm%a{5`+q&a%Y|-Gs9Fd>>=i zUtNdbdZJ?C-0F5x%PPxNs@YTSxYWnE4H}bXW-{glJI`5?+Bqf3Wo9+rAE}4PIc8bL zaCYY+-q72H#V?TZtGs(=t zmXDvK{S>c<@upU*CIpZIyrzz0h)0QwMguUKOeh~V}LrX6)Qvwiyt zsor_pJsrC9gg2dV{=xI6C48%cldO&2&Vf~_FWy|N@+Io(*u6L}pY7Gse;!w{uynSK zY)yRXZAw{G%{F{oF@K5slF2Q?dhz5H;WdvMotVPyVvHfp)PcTx=yP5bV=3Fk)G6!FK4|^%o%|y6i=OyS29#FLq`nt*x{FyFb1O#nduMHn6K%)SiFeVW9O3KHNeiqTW8=gl0)$L57VZ9 z6OqOkKOtd1JvSC_AMjEELjO9zSnyIcp5$Zv-}?fl?I`xK{Coeu9OpS?B3?&r$NIi> zL9Bm$Q4r%@gruBS*wKfGPH1`Cab5>cymPP@|IPs1tS|p1XSB}4o#1@}I}`8rKR6C! z!ia~a@bF%<@KVsYY(pWzd)2~g1>Q^;5w8pO;@>kC-c;aqr^A{A@5dHi>N}3}8ElBx z6??&Z7(BDfIGqP(Fk~UYTLXnz-@fmvHD!nw)@kgI$(Dbsfj1L+A;G)S@-G6sdKeL} z2lnFMY{;g6$AQNfBO$>nfsyIo9^l;$BjTNpz2Loq&N1O#R{R}+DOq+OjqTTlh81~}dFJWZj9Ryw~bi~7y=lPcn!NeQeDgJmK3_BC=_@C6; z6vP`~;Pr;HCSFrJcs*ce;${8W@85I-@5fgA9RVI=Vuhr>8?E-+0KDTcqJM+1XIUK2 zdlO^*dmWQSEA&Ew$K{qy|JMA)Z@+KASn#-9l3Cw%C}eRQ|3<;i#M|}({>KYC`gf6m zH_hsgPM9|*i*wkEe^*=maqzE>GZpE?yV$_n+b!0=8Nk~U2X7bbO#cS{P0d5Z%Qo=F zS^e7|li9#Hc$ZoII~tvVQ=aSJ5Ce}f$N2N+t8u_TCSC$2$6SrYo#3s5or(9(-~I8-I7q=uM}8A84{{BGGzngR=uN!Tf2i{o+iwJH z1@9wF4kq3fD*JJY|XfOjd< ziC2id`1jXPEZ#ogVM_H#@csll6YqWC$?y;I_vmwKE*XJeZw{Z zw&LGh9RJKN^?eiLHlBa8U}yR_?=#=OD-FCG(9R~_d%$~0`^KI4cdgYQHNblZ>Gbd0 z*o%KpBEN}u7aFA(6`BNZ1ME!yW`FKqA6x}n!5d-Wt--~}a{`9F;N@C)pW&ZGQcy1a zyV}6phjDNEHxcsDICw8YZ~B*nTyng9$G}^Q{xtEjFfZZM>XG=j8g?e$_&~s$udXrh z`2T1oUQe_;|KCMO@UmfK;@yCgz8t^T!dTkxbId0uUU!^#`ct7v@J_?d#Ct9=;I-d$ z*b3ek)_BS5AHV%Rw#G|qlHY#U8+ch(`*p*4`@A^*eZy+Mq~rj;->drfMg#9RR((@b z@xK^x@D5q^&F$dVx5U6ZYSnkl0LR&hbRlWK-&yq?jluUBj5z*Ev6uEM!2C&f_9PeTZm%{kZ`rf<*c^A3E``d&gM3w=-}~j)T_) zb|&7QE&+%CUrD@$23{Xjn%QN%+&Vb^eBTpxCf@0;0q=RqA_K3$!mDWq?{W)oa5o=s ziGlZ-h1Uc;`XMCkx5cts)sEfIaGo~n`ylN2e|kcKw+(h?eXoOmGXLEMW2T`?WW&HgcjK#mX z=vWhP8*WZ8WIPhQS+Fzl-tQ4`>qr0YHt-f%?e_-oDp`Og!K<*^?*#CkhaK_mg{}B^ znN{Cn-0VaI412*FZPoXg^ZoHsYv6HNTDpUsOHIIwS6?pkZPxcF@YtX9uMT_h@6YGN z;ynXA@reZp|C%-aw!n@ULSnbfvfJK{-Gf#;?`)?YE3J0^z^KPE6fX6+!D{EDz>_wj zkK$hhO0)gmYsYT9<=+Re!%+1|@V;gFciQl81+2xtu9km2bK?8=X)xBmzU|m;vaVy( zU>EN?_J`JWY!WUeF}1tnV71|2vvu8`1-y9k_$uqVy)W=yLxXZ$@xD;%n`7ba9TMNa zi!8k37x@0kGenNt{{XPrZwG;gDa#}2kIk^74-uV`f{T|8+P{aO6aOYy*G+Hds^=Rz zn>Stxtm~$y`UKqP#jNi-1FzNUw~<5RKL`Ff>`eb=_VthRM-03NVPw{K0q~v^=dhRh zu7sV5w;FgdPd;kk?Y72WMqd2u*#BeALo50PyyuRO8+eu0eMP}Abw496ihs9Q_Z0&# z^sn1n47`6>$J^lHcn2aNuoL#L*6}tvHQ>C7ME1ve18;pwZ2R3X(s2&4K{W~9W3V&Z zuY0J&}j)V7GtG=Cw2E6wMoR7r6vFFCN-@yF% z@6|4Wo$24Bz-t8#+i$0V_j&(Vyw`#E3DSk6zNcYl;@yxJ@SgiT4`cB!vu`Zkp>gW@ zkc~G8b|&7QVF8EVk)nU>Kfw!Q5JBaQmoWu+zD9*6@$Wp?nRxp~`1d`nuoXO9HpJi^ zDMWw7!Q(m4#7i0N$}ImTL7N!$nnu_ zyjlkWDwhOL?lmJ?zwVpcT;J+!5JtlcEoy_V<~EamaB5_QtZ#WzccX8SkJ>&0FSXGLW1{+^*n4H@TTf< z|9b=PN9V=%?{(Ly=lnL_df2g;h)(zblLk)dZh!n2_EO(XXnQt4igIZU@M<*Ao%r`d z7@2s3ulDPE40eLY&q11a-KVSXy9lJ<@w1dB-gCg43L}n}KNxs7hhy=k0B?$bVJ~=P zuru*GPx0~IHSlh?j`Iz`ACf-cot%Du?`=fz(t%a9xJ>Fx-!JA^?o&HV$ z>mDk+KN)z3t?_c_4R|If&S5Y99kj+v3Km<;MLPZai-9-D!rKG9#c}XbExggd+otjU z+rVqI@J8O~I4yDTYAw7E47|S?cpP_ZE*XDEfHye~9&OD2Xt_4v#czD5(>Pzfjmgf$ z%eV>eNu<$`F6{4NXX16fF5oQF{qYY2FVZa*FK1@_`+#r4&cs_Y!=L|78hA-K2blgX z10MYr692eVris_ZE>`c7KjsA7}=LX)rR{!n;9!@kR*b2Hs@Lzj^KWcctauQNusHO7i?WZuxh6JO2H} z^6vw~KfLwMX5cKr8cA?tj( zy3~K4*VVuqXZ6QE;BAcK-(^;RteX|^;-&Cv!1M1vEj+~6$HhBf;Vp~$czE>g;k}5? zgy^+j_c`&e+h2g4*?zar4mdM)`|)0kX*`~}EToAy19-Tl_DIIdDA<{JuLDn>i{g={ zhj*1VUp38*A1_sG%~wy&@%y8Xfp@tzo+r(VU*9p-c-}VGuP+|)dH!v+#`7BBUFy}= zAJ0!)`1Mf!5zk|SA76E~NEjK&P^P1;Q@Roov@mg_nF2~y-1Mi1c|1P)%ah3vN z;5}~j@48z8Zk#mz`-XwHPvdzI3u5PI`b2us!mC-}KUcZP!0TdNZ$yAM3&*~Yl+($& z-iR#3_(Ngz50B)$_IuyLTffM0P_##a_Xi7a{1X4UJRYHWczyKsxa12hiM>9M`u4Q0 z$3MWsx)s2oe|UuE<5|x!*8q>#u|iT#PwP46?YH{ZyLd$9;oWm#?0DG&yw?N_d%?Q{ zcIJ551iV(H(?2{?^6;*;#`C(W`13QD`84t7-R3_h#3LmS?=d(4(HqZ`svQTnTpo#k z>%f?Jcj2a@0#@{Ilz}%7lOXYAh-?C$^Z`MIe_ziVg8x)Ib|0W!QVhIjV8?k@Nbu%$ zROJd@dv>!fh_!njcm)E6z2M!h$En~sx5l3L#V#W?7OyYtB609~X*qNF0 z}IPh?l0}Q{jR6lOVUBunM51XpYU7&eNm|-#5%$bkM=wgyDYRz;>0rx zkx;|L_tC%XL-sF8?A}3tcx?iGuiJ2c1P7U3rNTnA9Z-V}i3KykkbnTlyu(oe{+5>&lQwQ`* z&l%b$JuAOYdgj%A(g&CJ*}HsP)7blWHjP}KQ@^=>a7sA2=7QS7?*ZYDH9$$(*pSw^ zzft7CuFdsCeJca$!zsT*9|Z&qPlTA<&KU?|w!5S%=$Zg3##JnQTT zP7XFV22-PWDg}Kg8hX}A3H5Hx+r7VGTH_myQ|>!(U(aPyTA(E*)KFN2)ZTlF8;>;3 zxbM(?la@VXq~{k#LmPp>+=m(`-S^OaMav%X(mkAGwFQZV9|r0M1^O4SUA8OG(wx-t zk^J7VDEUa*YZ-@%4^BET<(2LAThL;e%M%X|a_SBToy@(JPWP1SQZgDmv|U>!r%iou zYQprtPncC)i29CdXgz}uwgvC*vGwEze)D>AIN0)0wB{veRB|NPoSd8*tvO76D7yM3 zC-Isjw;lS;fu?fN%0WeJiOl5m)So%g&`VCZ({g8uSK6V%Ek#orCiy+p5%#svr3-QaKQ7ztNXD)VO@_TXLHh@YSO#?%=uyB!%m7!|{Oe&+&lq?~VubcS=gn*0kMIFuo_ph7FPQ)F&}_ zcxgNyoaHOhQ`vuE_h?YRsxNmoX4ZSQ$Li1<&F}Vb(i68i(iiR8on)`Y+HGkJ<&Wxs znV>_5$vO8$ol|NaxDUrac#PcCXlT1rS6Jo@2sSJq@`! z{EpVV=P*C&5Q^5E!WXeRq!P!^A83iso4E8zc@yZGd?4+WjQz#?#$vwdoWFzZb6oPhyqms}TNl9pnMrRaf z@($=hwnY#o++&am;xox9lp69^K(u`n~3*Vx-;aq_=c*=pA#n zd?Y?@nUGdYKb^uQl~`15N%@@AXhrFQxvBV1@g-QcCp9lOXK2pQ)WP$rsw$U^88T!p zmffqK#f1)slu4E$ToWQ2%O2c}RgrRFk&2{jm9r!-H*ZAl=)6lVa`KCCnq15k*qi|G z?ojQ;w+_oI&#N3-GC!{}x1^L@l-!;3=T}z@B~w~Df1zS37B7i{L&i2#Ef-QqNpe0s zlOJP|=uFcW8+<2|-~=6h!f%>qljzD*EE%^bnpFDZBH|ceem+N0q~sLuQbWn_OR~0) zSm_y-Tx7`kUS2ZF-*KK!$$6Iii6uW{$tNs%pjTedi7l^#TR(P|A|;O&5&tR6`upwG z!OGv!P50YZ$-cdk{q|EbZqYR3)5cJl4Zg@|~9Kk2jTGW2M&{a;!gH-SV=$^sbga zVK?0`U&;RXQSwwTzmmrra%_1$Ts*&jmF$mCCC~KoD;c+#nv^_4MEr9S`*)5d`}OT% z)#rTIew}BpWPki9+4oP$Yb^V_40$oi_vr#BR_^26rV}S(Om)NYjMuCl@jm4mEzyT= zI6gY^rbiRg2U+radOo5F)8Dr6zGwKu^wCy&4l`FY%wTqb$vIv`OkO0YmJBXmRxPgoQuQbmB-|VDb{^=6V_!hS@e^^XX!fdIM<(h zcaOPH2bH-JyYK{`m%Q7c3gNj3sTErY&lX7gu!ZpakMtI{aIwp}yySfks%-tB;E!dR`w$JChfE7WgcU&ubbfi%k>i>B6`%RiX10pFw>u#dF>Y>&cS5V2%Wzt!;Q^ z7}k?Fd9f)lY&g`y*Ww36UTj8#|EG_O-b7Jx*x7v*&v_w)cfq7N*hF6mKGdID$GH=m z953X>hZn$yQt<=Yk1aI7W!*TqP@3Z3!7e=A=Oyn4P-UkpJtyh#44)SpUT2C8{yhrc zyHhsq@q#!F5_z#d>+zyb6ysQyKK98=UW7L|TuXs;gTc=tuiL5<(qzsdFL^m0ve@~c zv)b_B1G(cTQ}Jx#(8Y>($4{2xhhrBm@p&nW<0Ly<>BrM%rq7GbWT?c3!#%_S2x9++ zOI_CG#eOmMdY&OK`g_1<4^j54S7@l>Ief!WpBH;}kKm9O{dwR+THp{2v2q{|kEpaHpU!b)gfY}_`{HW8$S=h8wwR~8#iui_hd(YyZeU;?@Ae~IGR zWT7#NcaODlpO?H5sItGQ^y9D#(Giea*3CXI_UsF>=V2eZOxfH-{aD4%Huwtg;ailR zyx>$(ultL<=<+SL$Qv6~0Dfg>XSQg7m znH!zYRi{l=)K}pvH14MZ%w@d<(_1X8&1XN_Sja~%B*Ac}v>G4Lk*`WfI-QD}K-Xdt zjCG_Xv*(wfdS6@+3!`}TxdQ#+E*2Z3U~x(j`#}Q(z+HfBNo;fSBPPDeZO%9BT(Gg7j?`RV?Kfx^!2xU1?m9yn?@cO>%ebPAA7&K30H?MzWTC zWjk9cHd5QQRRzlPNlaoE7!@m{K&d5H*2XH|UiYw=_R{E;yIh^SY+y_-|LD=nHcFAq zW2sm~+r=FvgI5zfmtRE8f`x8VaS25Ma2v{6Q&G}9aDR0}Niy0-m0VJa<@+SnuLc+O z6RlqpYau`}@X8ZNcR@gE^|F5)adFnyll*!ePAr~Sjj!qXOX^L`O?79luk>?YlK&2v z8IJaJoS#D{gv$_@IL(qzR-%5Vrv>a1G`k3U+m842LSo1B3X6&8gg0@r=6wV&33+?P zw9eQjBZG-o1A*61LV|ZC7!xlwguEILuRA?F-a43g{0{Cs0mEMKiglidPOI#y;uYv0 zZ|B6nKY};$GU5E}IR3q@^F**God6#H4~clZ^%K0$pfmASAwgfhF`MV#M=&z$J1?x( zQz9O383iu`6*BSo94H>%0N9y$D-67I4ZLHhpNaPtGBqJxNZRjB*qM0G0B;+N=wBCX zOk@B41Yjl}KQYN`FCoF(1S1n~c6SxOL_9R5hj%rMOuTi#`iPr+WM`1)f zxa#56TlGB!yww7Rz2Mzz)%VgKYF$C%f%WiqB7^B)BMzudaqymno#|h99G9=aj(EK7 zV;b9!_n*X*Hp{`_oDErsY23X*eKT#`5ZE5{*>$Nd${8;*^m|3XNk zQk;9Y-WCk(NO6ME)#nFx+}GOh`T2LR+|j`ay!_p*A9V=0+VfkJn(zClOLGd|iXZ$D zbK%|5>8qlx;CmshLkivmo^-Isn^C;|a_u|hMnfl^C$7MI>JF`m?prXV1zJXpk08hC z%ZY>>5jRJN8kB(dWjZ%=u0_rUY_OS3{iu`(N;OJ?&BI8KI`IDrU@|{+%b|M=+XL8s zfNdqVpIq_i?&Wiu?>lw5s>2RvP*G+w-|%;w)0{jqqTcV%iSYgY!$pBVAU9GEJIK@6 zGdH^Wu+w*3b7P0kwvIgLgj1Z9mC4c79RkfAoX&lB(|Wm^XKhj7#qKY5oYNJld{9*Z|~_`vnsH=c0AgmCt5H0)S2i(ynRbPH6$9@=upRZ z&F=eU>?wms%f7_cD?&|^Pjyi_5RpI&=wN}CWU2Y&k1OlPT)#9zu1ZHMT5qs#ye2c4 zvvypt`I=y$Us3eK&90NPwr+5cZD=U zY;=Ol1IId+g@ZkEqcu-BZ1185c|SR_K5u`*-pMK5Q*QU(Wp8c>6xJTgD-5)zv>qxP zSM)uM&Og>T?%PeiG2Gc0yh7dyU$Q9qt+Y2Y-Y9;3(vc~zO*=H>;FzZEOJxt( zbT%&!pVQ#X@ZPZ|P92E1k<$ay8usHYYORNiXqg7zDjEtp+TYNVc(duG@ZEgkzCBLe zORqVJd*5;D_MUJOe^Kw${bG%ixCd!3ZFANK$0fg=yuQP*_k)40@9%YP{BGUe0$5B% zuGz>{<%~<36tC4s{2I}@^*KAy)tp{K&Nica3?Kk*LQ)DRJdyEJ1K$b zD-W-{aaG=)oV}U*GWO@al5-#nE$Vch(V*U=23lq`Fy`lw|1S2}s6zBZ&1U$F_qeM! zJGF%vw}pPq0>?%LYwmrlY}l#I&JK*mVbzRKIpQ?HZh2X_=k!2B(UU8ymu?;Lj5F+^ zz0T)7K3v&x&JUOBIF=sM1J$*GT@8gYO1G|k!ily{3&fO*@<#O&vFV%k;Dv56(!qet8^XhY&HZNxkOwGN+ZbhsUT5Nqo)H&kRJ@Ilv;@;`b`nAJOy_E34%INW( zs1@JR??4aWD2Xr*D)EWsPGHyg{N_7P2G9ylk`r!N?i@m&ZA5&B)I|1mgE}H&g*dBE z1zKv06LzPkc60)*i6|?4KasXJY>uR@h|b*RezlBJujh>a17C6?ekR@(jle3nQBp!eK>)fvw4#BX=(y)}b{LTskbdH8OqG-HnS@hKo*} zsa|#U%DZcaCAUO^wZnof5l9W;Tc1b?7oI#be`UD3tmD-yw|xkZDXLO6k@i%cm7KJVqSjMnU^Bop&yQN{;2#Y(3;k8YVw?^N2V4{-#$HK z#zQlbukQ$NqcxqJ@hKbwUY=vUi<=6@r}RxZ&`^xAG{qacfn(zeo1g8Dd1CXLcUKNW zJC0AO@{UoodBM2CErppyIcrmP2U?~tYCN+3wT*}NA3Sj2&?`swzp;;X8{34KMmM@^ zJm$BUy6Nbyz!jb+i0|rV*Uc{vaZi;Wr8R7yoH6yGsmaq%O_)=Bq`2tHGSn)usMZPW z9`79S&IOF7f)1my`Ptsi=0`q9tlu>Ow+>FzeT=~JNYt=u~l9LU&1Nwv17h3?Uc(Z@F7Kx(7 znDq)68^rWHN!D_PA;*r74$iaMx6Z&!z}D`QGyp+-*c?`pX=5?P0X=Meyn{LH@(P9SMp>_ zUhI{p()s*fk&@Smh^Gzgzeg;&!pc9-lKI|Gk;?y^h#HU2s?79|A;;FIt6RSR%tgrs zk{wSk=-=~}?A?GPJr*zQ+WX@#Y^C>b)0cX9O7_cBvfsW+o@3cpSh9Zo0*^=FamFdp zeNNX6$HxFIbI1JO(s)hC$Jm`T3*Ufu?T=~28_3I8od+!Yj+U%n$GPwCy5VWqjaK>t zbOiJ!Hpb@s&6U&-{oA4C_ptAVr&X*M{|}XvhAoujvhJLUTTqwAQlG4NK6{mznJMIT zgWg1*4@*I_v1NC1S%+g&;$#+6&jLXlgA(gfPo57(L94Na@VuGCaU__JgBQ&82EU0m zd}s;UhE3ut+FK)!JA49&Evf{R zXG~}a|D!~@lX}hHLwntK%V^VE*{mk7Vse_kFLzn#iqFI@TH}Ih>W#5~8w&GL4XXhy1jn!d+Ao7Ca#LX9&Q<(8>W3B!ZMZXGsNXNiD1YXK*0iPAY4`?&C ztbCVs*YK10lig5-^+}GrV7>u9r0w6QjrNDU*c_*RE`C7dMSmK6miC8ZQsP@U4h4t2 z*r!piamb546TIL=z=sN0l6p5P^_s%G+JEwrcMf=Ihno#P4f#XtC=d^=EWUUFjlmYu z{5bI0wIbok@NIen9iEiJ#=fzLok){D4}qiM})V(3SWB zaXJn!c3GDfo59pqDLr}7vo11^krzGdmGy1>fTmyzO?Fu~?o{wOR>gi6_^hjy4X3bd zW&&}nW@&yY_|SK#b(|I0!sRaO@`AGlsw^H5ppDoho{GHKJPlrK_RwYlen8~K<`wW_ z!||DY6@EZps~xUUdEItkr9s@qYloT8XHUlus0Lfs404Xsh)wECUi@4IK5H6&K&*TA z^)BnisY~6TflBP3126W6z)Ri9i_JUWv#-SuiJzvg^aHQtW2!3l3V~KuR0Lx<%5QBi z@XF8a8Zp-AOH9uirKRB{POF`$Ds9z%Tvd7HJbbh~Zp4%%&EdB@7tZG=E)nzrpa1_v zG{w4o_L!zv=e2FyHm|NU+tH0>QLe`ib~<}Yoi$vkvdssBbr_oV^z1=Iu|`%sVnT?t zCC5`GzR6s^U~b9$g|m%_B2_=-t7}qb$MGnLIFUSYs;`S{6Vwy`>&}+rZFBMa&M}c} z8ozvjj3o3CzKofh>Kv zdl*a-lo6fK(iJh~xUcLF89O(P=a4ZFOuWaDkLLs-!5aZP6YoTK^$kGc@wSv{#2W`N z6OXYE)C&pTWiT@F7z5G^M#SrYP4NE1!h45!0s=c>H(Pj9fwvDj;_)^>@D^Bj$B_`v zzj6z&@A$lI4!1Ile_{Ymf=85Qp;lN{F`gbli!Mh9@OuT_;TwW&& z3EpThCLY%!=QT0$c>67Qzk|-idm00b=SCsHI|3sUFBSKqn_xsd3>^=TmtiK}GIUlJ zbV7nR3knl&AMgf3N4&63W4qsv&BWt3Io^a$Nbq?6H1R$FUJ5c2kGJkjBi>K3nRu&H z9Opgggaq#?C``N)z11};@z9hW-Wg;dp5(h7gQ+iMA!3ktE~Z^B1<)GU%~q`Y%QS9# z@x#5)X%0?Gq8Pafq$pR zX_=p?F0HCsTt2J1D(*Fr9b%mm6aPGLw);_U9djG4C`Wm5&eh7zuk_mhE1r*p_t3i3%ah}}GbFCak=_z?xK2tT;=7J_i5^WcR_$P%O*k0A@4xa< zuhs!Z)m`FoKSKm}pBVE!3yvy2zrdxFrX(vpIp(|Gyb^j}Ox=A)XP1^aE;&z(&@#t! zH{jo+W$xJTnBraHanlV)4^D^PI|YvKFo8hiy*Wi)2J?<&_Tq9Zy-{-8;?l}W?B`+% znN?k0QB}TxQ;9vtSk`5?S1w$PTY>6X73ERazU^ey_O6V@w#kV*y{fXs3rZ{6{0~U% z1a(%=Ir+`1o-+p(SyFyynG-vk#X7&FWWmA`{KrjIc{I)h_s`t~bVHw;a~z*Jn*SpY z(WM*lOa9B|xSz+d)7|Le$b7)ZvL+tq9*z?svCD*l^Ib$I@VV(g@N%8YG>#8qnRt92 zBEEw4=Ao#z%cT-@6Smndr+x(IF^J@ab_=8Tl2!rPoHJ<`Z_fM)?Tk5-?Mz}lNP@>_ zi&A&$`3$mEr}Ow=ebt;f+6=A!@;K`eUwzJ;Izag&b7pUN7rQ#owB0jW$1F$O>T<4f z)vs*Wzin_HC>z-j4gDOeW}WEL91OW}TqDXJKpbuG_^?|yFcvp74Hny-+ScZVDraRa zBfSvYbrSf;)Vf#U!@Zr_qs`q%IKjeZ#Ib%4wf$oayxEo6B)nh}uXJVhN)>Tgis-hJ zDED{*k)o|nI4>7+4Y1#1ohqy$*N}9g`Q*t@Yj>f%q+G;30zHxG;wf@=iPmg`?DW-p z#CbwaI^KoW$Ip+pVkM-Y(^;pU=UE|_i-%ZIH-9g^N6e^B(VEq+1{ebr^6J!$esmWi zdi^!mq^^NuUCW}OAH$2LIBu(~#V@&ZRy_QzupiYR~jBAgWG`}RDOKUJ! zI(o1;;Y!9X2MW?tCmT{F;0Xzk=jpddp74%&GOmqz0So)4baFT!!VH>zlWN z6<3U!wi~OiE#I=d-<(A&yUuyKp7GtyP4&ssJhZ^BaAQ((bK{=CD4cq*ewLHbaHOHu zi`EkluqN9vrUZ((qMyGanxtbi)=z4vEiCr>BG8i2z}EKHGmLG^V5!_k1PbhSwrk?H zYdza_vufAFXxBZX{iwlXb%&Fj5oKNH@W|SF>Iq!Wa9uyduLnRNlVHTKADibKfTw<&nFzk0jQ(u-=#$9J1#c7- zPuMx(T=?2HivFepMfKyBzu?9}v+e4za4Y>zcx80TSZ@R{QhwHziGzNb*e@8KF#_w? ziU0n}bj^KwW8KNB!2Igwq+p2iQ&K2!tU39dWc=3%{&yn9>70^_IOSk)vNYsGUA!51AcV9 z&-tzWcPmc)?^iNXJ%Io8U=(oLo{Zg_>%&P6$^MZU@2FaD993Me@4XkbX;^>~kLWiB5^@&&k^szbN+k(gOA2|5$px-z}O}m@w z4i9pc?phak!Sj$Ubl!x7y@`mCPx!A2??}X&m|k0LDeTI#aVUS~?H6QVhLBo)GChDX z6)Za79Ve1P{eH}YBFjE-Y}HhmLsPJlE7v}4JCAanoQ8Q(a`~Q2@^n5|?CE?it>KHv zf`YdSCQW!@LQe7H#o1`RyuuZce!+9q)dS8iXe<2x!N2mI+6BC*)5QBUEH!Qrp3fkC zqNh=^e=nzGUWY1DvVLU=m6B)bRFNw!d5$H&?fIbc@3+zqTJjf`e89@j^-&Zlyi`jb zW66AGZrby@-<0`0*_3x%@@YekZBIPkLVJ#p?06DE*>As~6KmhWO<&>JEBOXX-fqd; z3^^9BqlLe>+;`pX1s;;@K;CsU<&d$g$;}>*k-~wTF`Z`YPG)4<$e3;VIeg zUnO(h97Rg@>#O8eNyZxlw(skfTxsR^pQ|hTOO5o{`gC#eMtgW&toG{arhnk2E4kH@ zpSR>ah8$a7*u~5A{893sJ$ogOwbK3aRr+bmev)C|0qx^c4<}YW-&rR&gxK@BN+-jf z_kxUv6QcYbEB&}}gU|HYf(M@RCD?>0KPm$Dl=*!EAPwvnJaA%4&~o+I~FJ80Xtnrzg1Ob#<oVv^Z49F){x_~ z6^VJAO?@Z)fNsW?mF%)y=HCey_`E#lyN5RV;mA_j6e=6?V#Bx_iM8bXBQe4|$)ATG z&|Yk^M%_N}*;;>qy!Pic@DdBmc}ViUL!K`zK|G#?KS5sOd-f~ z;rV<=c+R2X&p<<;W$?odezalF`9^Sx44(6f_;wxma1k5?k(YLx2|lZv(lgd9tRGmB z7n=ptv%^8;MSm;!tgzDG30`8B`5su-MI$fv4^ppj$cz3F@PgAqn_`7YUTijj&*lqM z(9`5~oA0Fkl}b-u?0F3!Wsw*Ce()04e2_LAydd&o^9J=gzKp!+zW^`eBoleU-*U6M z@podwV-tp4XmPI$nDoZN7sa5P7kw1TT5X zi=Oq$Vue8Nam~p?^J3EkIa}ke0Wa$yk{6q&sHd|a@}eIIUiyf<=(E6QrQ!!P4x6ks zI1Rk?5qYt9`%d?f*>@GR*L_4@>_<|sk2Uh5XFF%5;|IiPPUbQ4V&k^6J_gNpz7957 ztOV!=Y|^LXCGSk|(x>D_@AeA;Kz6?f=AB5Bwk0ol8>!cIColTd)ay1UFZy-hvj^b^ zl#5N;pS;+N1|Rwcen33bWxYo7V#A>zdh(*52|hF!KcJhjWnbj7?z_aSOvT@dowN^m z$;*04`1?Q;Kfh!qCWvX%nk>U7yW18v$SuFqYv{14T!wh@VZBA7_%WZ2Akw1FL{?yuk(@@{c7-%cMWYA zPy-?_HjjcAo2S5sIpKlGi_JFhf=^!bFM!Y1HxPSiqsJ0?u{mhy$&3CC>L=m{L|*h9 z|1y5eV<7{2`CoxC22Tj-FY_NKEJX&euAHGF;|O>lP#XUEIJ$U0f0d^e=wORV5a+2T^Ph3$-6qc6$aCicM(@e-d|FV)zzA@5lu=n)F2VM?Aa-la0;VW= zUfg(mHz8VD5k(+;bTI#3ke>tM@_sp zyZinzPLXNEOSbTOBH<|k!(Q+L79L~x8RJd=_?SxYhQlAIy?)z`geodD3EmLcF;7J6 zZ|DggiNre>o8a-ehlw{5145s&-JF8=B#cbFM{&Vi4-4Y)F_hq)WBGRv@Dk$qmu&f$ z3ZQkcBVJbn?|KWb2A##{ltSX)Gz;&!-gthY>x-`T{5y=i%$}pxhR;A=AHwjqQv> z%Na5}SI4NTNL4dfOY!PgzQ=jV=wV+urZqA^m8a%}!Oj4b-uA8fSbQ@r?|v0SqGMv3 z7>O{ZK3X|9(2TDN23iJt?}q(%vwkE*C-04HB4SWf#6(j=D8+xjy}2H5|C3Tb4zx@{ zyo~>DeON;|R;HSr@2~q+i#Vck#1Rd~idMc|;Mm|4MpHC38f#`jcfgEqz*}VBlX!mm zwWvMHRl?+b^Jc`o#C!iPF-;QDkXO%0n((x0XHIa!s)vgh9~?cp*J)0!3~oKL*J)^~ z-Q6j96s9%UVO2fEW?;EjdHiSzVPdvh1dlDjXd7_?`n2?K>SKcSy`CtnC+Q@HV%64@cB+Zwtew+ zRxe(_FDG!cw$+ad$wX9^y-pnal(At^{mno1#X`o26t^N42kQ}z^xLAaruDp}^wj0< z_ZuH9NSMGiT?Zq6$;h*7^Vjeyip5O0f}J0wmU;h-hV7Azf`RXvuq|K$DoSu5!`kxm+@*i(bOZ~=Wmwx#A&t9rKkUetklgCEpcb`4% z(^r}wJ23G3V?Vxo$RDE7&egAT6WE4 z|K0l^&t4n8>E3H!95;?B+Li%>2!XdHt>$_rtd?`SyvYr~UUIqldvgXs$1S)|6W`7;uqiSGjZWh zmVEQs&z{fOof>>;)rWO=_pIBp_aDU>ySDu8lV!Jz8(lj1hVMze6NLGHssS#1_06|N zT>s6o3lgt?e)x&EK7KS|bm_K*FCTgDyCmGpBGGd`#0bI&)I)}yZ@q-SDv}y>7_q@^s!Tqzd!%tm(oU#Irqme z4fx*o&;9co{rep09B58m?0cYgo3OZ%k$_431y-8JZ)eizT#n=?w<{eL^) zf1(2(@BiU~g;QSa`Rx;*-jVyKcivrg?e?ecE*W>^-{<$bE&6J|YZ4<#_no}{iF<~= za_6EE`x^hYZD`Yf-`qct{rJ4RCp*mS^gwOyp83DH{o_SH!6nc|5C3r3FYmvzcfX%q zwkYCUnmOsflOM0_^h&3t5B%!D%Xh!J>g8u=+`DYUE#H22)72;Pmmb^O-`qAe@B6n7-1or0 z{eJdOTR)$;b=8Vt6D#|U`PEO7ul?-R4;Fp@!W+g;DoVO=bnO+NPW*h^ZBGnb^wE<~ zmWQ6ZCNJlA(a7s9=N*4=M6l~0I=!&#%*TINzu?|2|GuJEZu*PY-81?P=eFN&yLIfO zE7xrK`K~p4%lhB8|KkV$y16wyb8w$iTYq%PuC&sgOFO;)yX&slc-IRbzud7;QTBIM z{O01ss+<3K?@hBV${N~Z)~2G#H}1=RZtAe6cm93Kh?lQ_;QSS@W*^>v;6&mFkM#=e z{l>*f*MD=-$8X+JbL8^h7q5Eccm2y}ZCso2+R)Nn8~R;)?j57wcx}UZd5<1^=e)B2 zJplgq0Qi6Q0C@Gp&6`L5#F==?**CiXxEVu#d-c<^Ki_isftM#g_N{sM{-ylCfBni$ z=d5_~|D3uq^tZ?p^U{<1=YLuYCBvn~Tn?x_Z--LpxSp{@1<( z?x`4^@ov`Do6Gy3H}2BU9{$rGdQRRo;NNDA@A<2rJhJxV!_NiQEc6Or^2rN*Z(OwLo*`BJ zPw)Do@r#W=|NPzDx%Zy?y7+pa%r$l2J-y<{iu-rGw0GP@ zZvwy_{?{ZtD5&AX0(ppl=MFCM!NI@qm&Ly!^+7cl!@NV)O8+K0pP+vF)hTpJuJLS? z%=glY620%%u7ZN!A!q(glC1N;Wyx<^GM^tRO7zyURImVBor^F5#>D`>6a-3n0{{Xkr!%n$QSLJuN z(z`o9ko@p7fK@$W%kSa*HYR^hE8UjQx6&`Lq znBDiatm=1;lL1*`QnSeG@xo`I*?i#uVu(ce5|?%PVTyI*y+l6_I?+!w?8%FsaRXvc zUi5B!2A=+r%=nDkA!qR=1?V1Z693u=KFkV%$P3Oo@ZoP#tJbX*{YJ=Am#4vpFQo-y zAF+wecJLBYyBmD?GW>wZiw)neh|MAJ;j#Dukr$gcz-Q?RZ;Oc?^i2=bql@;Ri%s^z5EKT2Ef|Y_i@uewV!HIez+Ry*ZYygI@ZJyx7kKFW-Qk zW$-tH7klzzznC_hMv6W**>y9i`iDAp_e#d)-gMbA5a8a zZ&nTz!6rC7M*CFY!0zMbCD~>W&}KOl%V8ONm?mo}a~#UCOkV8S{;~!#^}^>G z{H5TfzsO78B12DJ^pg!edC|`>^yEc9+t8C2J=;zCoxJFmg3s!M9}wG0zE91zk}*kM z?AL*pc;6PohP>Ep0xve(Xrt#P@?!J6VY7!ey06KL%`3F&j~@`{E9q3=c~Q|&=lZ8KcFORfpnL3*ER`!L-8T%b&P2* z@;YXeseu9f)p>PHZ3^Uoj(K(SX1gZtnm~b}iXV63fb>D%xai{SAw#`bg?7W6m=F`d zq}JqYCmLtY97fN4X>gHi786}`HoUJ8NklJ~RL|n_Dt_?K*)U@wQDR!bT#K{qsxD{4 zbk~bqTt2^yL0k-+TDVxp%ba~BM@HJXEfNnvqD*2wS1ihQqI}#wQ-MEcUk6KYm?0)Q zh6*%0m%X%>m!YF^f?;xW6$SBZb;_ANZ+^+-lDypEqtQMKXO~u$=6vORSA5NUlS_u@ zUNZ9Ql=t=WO)eQZbolVEQ{LChH@Rf=&`a{ZPI+H1-{g{Exud>Tc`^BNCN8b;TMcG#y1}v4~YG41T${G64u77$-0-r?qbUEhmGn}+FVd{5jCw|E%E3w`6-B!i1 zeigRf>epyV!m9XX(Vu?<}E)_EUVHz(1M?%N!QtmtmEJH}}hC*-Rbv_@M(51rA zjKwO047G=M3IgjUBzQBSF!54xl49AZ(DOD&{Nw4{#Crw+W1tffJYK4rc*_t}GZ4B| zYz*5Gytl!dcz*^!y!QLO&J)3&^c3)T|C$QkjK!J&9r3VpsXq&%LX)tywjCNx(r7At zN8~3jco)L1MiLFXe9P|N(Se4U$N$VKmvKZMxPkYfZHEhjcz73K@Rc zsO~YW@d@V#h__Z!3VaWF|5yVgtN~<7?mAvEn%MLh zsW3e?$&ET<#1R0$lq4>!xD~6Xhj#S z3pXSMnqzymjRvd5@q3`|x={FSll~Png`FcSTK(9&uTl$DkM8-1`}?B${GAUCxFS09 zH%?Qs!~yPnXwA5#jrl>p#Z6v~A&x*(8=p77`ukNp3&gC0hBeTzCSOW^bMoOc;Zvu& z;Wwdib!@u)KDc+3ty%{602U^BU13Jf?@!yAvbLuu5MrlrYJN zaEl%<2!!3Q26v9ABVhB|0qXe0mu{Pa=v#M{FaP-UR}@l5@Yk2URz1d;LvwXCu3h$3 zS_$hyEK1Ml+B1D%ZO`)FomLJ2l|BNe};M zNN;)A>C~{^k7hj93GuG}idzB5`_WSVno4HODq~XXQg`)CM9Fmn^Lr*<6zExZ(XJke znYBIYGV^;>qXwLhyX#GA!*gRQwp?rxY$AhoNo1z~E5AEz6RMZ}qv@}-u1mnBcKOa8MZ^Zr7S z^2dL_)WK>Wd=p$u-TgUk{U&?5bDW(q^*`55&oa_k{|7BuKRSd~;az8?ue0QvEV zml|?x|DJ34-^KOsQqR7N^V1mrySnKEjdc1y&yw9^*3~JzA}f80CHww&vD&w* z-^U9(M|1~7fXVOV(jOmR+57$}d9hc%lK*bVn_}wQ!^Pt>bVbVk9TD-amE~=;aH3E`EiVU&(hFa%_KIVBz()6!awmdz%J_RMd8hxJNrPcx=hTQa|QBEXI}yB58G3Co(hXgzt+b1n^EjUNzs(N6|1 z>q?LpJ;{zfPO#^tQL84m$CW2D21Lx^1p` zx6RowAh*pm@3#3srBB5!pn2vEWhp(owzqyaN?!co5bUG%2}kh*A}{(J@Uo^4 z=L%UjguK{{F>J=urVKwI@?yij5S*#tWxWsbVsnFGGm|!R@dKKPO>8Q_%h)C_dazD_ zPJ!HZ9;$e^owbqM&bocvcGkSx&a5cNZD-B9?VPLhsn`WH&u$2fRC*RE>)=q;dz8|X z7vI=EeYBpu=nKGSkH!yZ8n&!UT-L3xtS2%PDzTpjK12XeB{umk>QeBs7R)m6y?LO3 z$V=W8;QMGjdC@-#UcQq{Ui2Hl%Nin2(dHKXfXIu@Ht=HeJb3vgEP1inW7xbx8-0OC zUTj`7Y~G{|4?Yliv3Uo)^gDUce*j+AwE^n{^7*UBK*VL$u{KWeov{miQ}ON?(7Zba zbex7e1~lK7_BtLc)!^M@pU#?e>?cBBK(m2&$q;1_JT`Tl$c-tjPsJ(wDG=Jr56=hGOsjm#K_onMdr^Q z5vzdFh@p9HbVFk`i_0s^=Fc8FGFPkBH?ibxxh@FbcUfGu#E)V?QI<*<)>b>zw)6|s z#%*IDr1Y4OgmwZW+-5>tgZGip_L@@LELd1omUG3VYqC*#^cMZ1H|A@Wj4W_b8uiICbBwBW*rPA%&Ry)+T^xIebkNGm$*_six!?7CeZyV)M%g*<< zjVX`g*vJ@mK31^tjyCCfONWj(HGUDUI`)%I9G~%GY9oiMy47qJRph6$4=%ur!+ zT_!ixo!q|K&$^_T*S*f_o>*56I-!7Os3M=N<>7iSy9CYfw#Bxq7bEP&j<;~cj9?>O zdak;b?+-o^8`F3W;^hhPB;Rx32VxVV9VrW&i8uN@wLUxXf;x?OGXQ4#$8#s2sR&6q z*Fb0DZ2(>p5{bv#My3((E{!MoxUTX*=!IxUy3NAdgp+Co^u#mc8SX&k>5jB>7Vy?X z7LszRU}yT*y{rHIP~Iwwf8W=5lJ6jxc>Xevt!mAJa{-Np~-ZQ#Cr2SR^FWy=;KeqbgIPlg% zNB_WjcnOw&tKoP&|30_ymLWbz`WLK+_XCY5{%r%^qevH$c6ijP?+Jj=j{fo15!u}F z$N!PQpV#h_G1w!Jg=j~bjE#1=6hNzCH(RmpFVnbvA3xj+o#4S^kfh~+LDTZm$|c%e zAp-Vdw+i(z;}1B$kXR3r*tNh>sXO(TvVm}*F`d_htOpJm#2*YFZG<0u={L+qU6MOo z*?)Qb!F9b=d1`JO?DRwF5`VyV`a2q0&x}fLP2@MJ@MWUZ=<1j7F5ZkW*b!{KcmB#9 z!J0((%RIrPUifmCw_Xlx6TXK!{ILe*xDf_;!TB)#R&j$8inP67YBD0SB)If>H-Ivw#nmmay% z)%*sOlhmBl@=+8|e!!=2KMFWlu_o2{<`TX#=A#6T5u@1nLW|UBGrpe1cfvrp_YSWO zw%0RmVdO5p`^7hox*&q%j$b&%YcDHm?&u^%XKq9!guDaJTN}z>RG82RUlLTyOfy=B zo-)FLzpzLQv|L>nX!%ueSmDncMn&{yM8y{;d+Y~xG|szal$VmeDKii~{xH@K3U_c) z`l5AWS8Qo2z-mA(wXL0E^qm^E2G=@?MM13AJSQ>TdC3X7Uta1|KP>@^>wr~#K5~yuKN`Y} zfEd-G_1=$Hjp~5oaP@l_+rb3E;_>CLIkcrdlpokVvffyc=U7rJ$CpI!@Hm{lsPV}9 z*ESy7fAGM8L$4g!|Hi(&owa|JcbcN zlz1_ZJvAqUPkw@^4E2q}@V_-Ag*zoBbWRB;J4sbo2TICDiN~fOB0*$)#|rb+l$e#a z@`^eeD|fLbHc9|r?Auc4ubq_9uzhmI)Q6@fPd_zbPVtfAqASZV_F`M0wjj{rui}*F z_Cd~ajOC>0@dl?E-(r-SV8k2aoku{iq2W<~caP?(XHU6DLXy-3KIpZOxCT-<5coY} zIMNWqk%kzKG{kVEBZgxDVmJmMhGRhb;L-u<8H)xKE#JNTg(iFt@cu3L^9z-3JV&Y@ z&%s!ZjK;SbXT*H1u#?w*8I0FRL%c>B;x*C`uaSm$jRA<)7=U<<0f`p}2Gm`=D;3_P zFRkI~O`Kz={eQOQqR>AV(Hq|&*Lp(*qKgiQHy5m7$tcgm9c8usIm?o&tC{m z)~)mZ8N|Nbif8m;u_ zEctCqF0$~8EtzXPD(c{z_IPS=nV?hD?i@=#*RB6V&qm37wyEe`%f5?ipDM}!m%Vp^ zuBtrK$G@HAgsU1k5G*Q3<-i+F4=_x;}ee)r4%ZX0huk6M16iT@~dwPAmw!#>h|(|%dl-lV6wX!{-3v~P6TKjWY` zTkdCo$8!r9{|6lQq=$y%)6_S?MJG7uNdJ0W;Wg=`uzr)C>!R)OcwO-~$k104mN#kp zd6S;+vVYP+N2c#!S9)LLqKByOSkFF)f3D?t%aK3$4r1pe^PPn6pJHfl`^B{Xz_MgK z@!M8>pAkd(>k!{!NdHC%{FBai(c4^fz~#Si(pb-P{!SoXl*LV4@uI+OBNWD|@0bni_8(qB$|AdBbi6%`aF>*7Wwxbd}85$PJWK5hgkUdaBMg%R|3nL4`PuS zO1@Q&h=rd7EZ_sSkPgL$RBQE-evtn4Dn!- z&*CSzKe3hfST_k~dDJ-Y26GKAS$jcew0LrrO2DPDu)^GkOXP1NrUIB0T%vQN1CJuM z^s~+p`P+ys{Tako7&9H1(Ik8(xvVK+(G@(?A#d2wQSb{w#Ln<$GiGjW3< z78!b7@;|ZgnHCZ*V&N|V9$^uMz;SdCrW{w?XagGON2FMI2UtVWO+K;c*$I5D#U~d2 zlfWa!;0Ci7m$-EtSibv2Eb^}cr&z=(%H-e%Lo6~~!16tx^T3i8#3J*tLq@Sa$pwSP zQJ?e%7Cl_=E&d@EJ$!eOH5|qotZY+_a}CxcK5L}~u{=8ic*Iy!{!0AG_ib3@;;gj@ zLxE+z1+%zd<_F0?#G;eQlVYu1V4jrk5fO_Fy&`#lSoj&_vk=2%;1a%(XL^%su8$P{ z9MCD_4YtwNOP#q8ERm@Jj$j)f(rtyoj1p{8+kClwVk| z2%lZ)d9A`1ihsS;5RRCUH3dDdYcT@GZ|YcLbl15yA{-_&S&g(4jS;I9L~xD!Gc93_ zU$It!J`s`dGp=<7&K&gRs|cvA=ZAZkY=>|UbL|qMaE@NG8WZ@dS1o|=%=!1U1w1qW z6Y=K!`^W^NNPV4Kf4p1Z7dE}opPBApplUM=Umb{JP10z)ENJ|({iR_y$u0MwVPoDz zE&*f=t_)l>PvTwUar|G0i_X)I?d*HFocf*tZB=1F9IG(RTljP8%S1)YE(Y~^EIaDs z7=lyZ3*d1~O^m>AK**_YF7(ZW$EXiefMNfQvGmDvBOy~F$}BmO?EgFUJ%bnY67Z4IHcLe$&!?Ku( z#{XGh>VxXAz73ZD4kfjc1^M)4fr+xHtbBpd!B?lUka*IjTMCm8j!U$D)o#9f@j* zIuzBmvbR0QrJb1)=cM{aP*aq{4zo&;-(k4{GdUmnJ^nhl{!WQf!x9@YQ#A6Dc5qvc z&Bbg~#fAtvxnkq+Y*m;wFv1@Laz}x7>?}SLl{*t0$80Nnpw(-W*H4}np5d`)!R=Wz z%4qci{4IXWV)w>}l>B?+D8o z+Z|gsXY1_U_V&c7?(s&0C>nrF2 zXKy2Sy63jcInZRz-dgF!G#XoxzB%;~k3UedM_rE;`YC2{OXD#gs_C&Y@v>VVbDx9O zPZU?QGm|oZV9l~#Q86rWcRc5f&D9BC`RqaGZuD*0QMY>*N!&ya&x9t1N$(q@g~}S$ z#zP*pad=F;$K#6)BIoap51i-9lah=4j?NAsewT@o&Ykz%k564m!99NC8SGg@?n2lY zfA(4dV)oM#+}opu^+6ec#1)=l3A^KoLS?&|!~dYioBdrq-p=RDKm2Bq z9d0`%oUy?Z1FjkWd@qE1Q!j+uTz%m6l!bGLoin%+K|3hv$upCK0B?4Y6fE-(`Q+MaN3RYssH-+1v9erh8ou`_e}az7roy_bKJ``ru;D>v5(nyi_9ww|D=cQP1+i+GVCMeuQKFQ!ty4a?V|1Q znfA8-O`2m_rZH(df19)&{;SlVto&)pU+tm?xM;779_XUujrRiT;yVcEO3NG_)j06~ z(M2zE(ayCUl>f-#Khi&P(euK2!R+(?z(wb|;bI9y)$PkOnF3MQ%Y0pq512-6Ak>R*RN^f$_eaznR zHWrzqV2R8LVDAJ|hFE0YpbQ5XU{2#2(U(XW=hDkr*R1PA{zG8l6AS+{@)@Zx#KMn3 z9*}u%<_FQA2png*#kx{(x&t#m3V)gd=Q{9Q2VMv~#G1n<7C&$d;aZDNEc}(gUccdG zMJ)UxU^$z79k86gPAoDH0L%I7#KPYIEINsWzZqEO6t@72PGXVS3M@K_g})tGbP@}{ z9$4n@cL7V-iAAOXSi(*${Jp@UlUVr8z@qaAWjGiELo70{P{zu8Cn)nhQ-)Y%PC59* z!haW7@`F+Kv&?6SMdn6euQm8UEc{XAPr?m`Soo|rQaH#1Lu>B<14iso?oa+?lTR$q zCIQC{H2FpyV(E9*A=$8&c@$!KHUT&;9yb`ahjD`qsM3fr_CUiTH-r@o46!`RU|(zT ziG@EMSk9#&7XF>UDc0Qo3Sc>JU=6V~U;7ZSxJ4|_ZU7dyh=soeSk`tB3%>?9iBoYtflV;nIVqvCf95WQm5?pb^4QQO(A!h~@fhBk=u=tZ$+}#Zv z_buFD8ga$lWI$s)Pu8h0enkF7;1S<8We(v_=3j|LhH)riBo_W@;1o;05pP!BcE(#@ z$jE#)v!mnzV$s9+kvu>w`~+Z`vm_RN3UCT(ysumySYEUMXQ_uLxdn~A{)VcAir?+@(1!4AXMgl;xCEcHCDWYXPM2CXpRCcSiacBH^+s@$7W>l zaA48Om8%2J6k=ZLVZJnV%E$y%Az#}JiZSOL+C-iV=Mwm%an&+pUBU^XYZ*fIdkZunjx@ z^V@7rxwBs&_m=gH=zAA(%uiydgQg7^@kkOde}LR#6B>8g@j3)W@(eA$@ARA{L;f%b z!JRe4G?cTt`35aIPC%b?j*N95- zzup|)S z9_JT3>aZoRuaJFddoJ1B$QgzWCHLPG+nIPGsXhCZX~$`t7;VjXC|)G|%|;!|EGVD)yw!zzM?H;XP@MrM9Gva0>VI#F^V>M$P_k za$a_O_JrI0n9p#=?TkZXE1E0PN_~Ah)%8p6shrWmd9mq+3*r;4K9a_c-wf=D4GvU+ z^H1R#rG-2@G7=p#G{*ke@<%h)W2Y{6IorEe?fF8?T=n5o#~sg2gREmuCT4gZRrU-` zVm4=EB7JYh9b;~0IOeut9#T7Vb-u^b;EJVW%q~l)Y?SDj1v1^ZJeAruPpBBTd0$0y zX=EyC2QlY)yH-C^C1GEm=mrP;IbqsHm=oR(Tc4O!=C@t4XOt&)lj=9BH?xyYE5>Op#{lV05?1{U9xZRlF zSpO;^n-VKP2vKJw4Y6BB#|~9(VKGP)8W? z_S}-Im;O)udsUuZOxvu@Et~gOj0%^#L?hQDeT=>OGaUIRux7WBt8HJ{=<*WLWYkhE zcOh{XF^TM$aj_Z1F&LfVPWiAvu`L|;>4<{68S?%T1 zHZ>rZI^*{5dP-W|%FdBxI4AwF5XOJB;#tpGVV+4(anX0W=p!!L?(>?@?|0Zox`(m> z_vVD{Ju1?^mtk)W7eUITGs5yFUErc0cF|9|=z15u*Fi_R-^Xx&T-d&k%YXe`{xfMi z{`x7dtEAb1D++H53~#t2jJFZenT7;!CSB^HJ6&{wbc8MWco!Yzpd-U$x}Ox*XVP~3 znl#6{O=Hpz32FJi$VFGV==)ssHU}N)pQ~K)XVUgNok>p$KX1}@e3|qvm;E6Z{ke-i z>Y~rN=(k)n*XWw&Dp&enZTNqJSYr(Z)6@2^N!$6yr02Ti?fhWc+xgd|kGbTZanW&M z|6Q%*?C}|piNXwPWPE#F`OR%V$gsaNtly;9x#$cRZHM2Kx5H=B`(5(SI_Pg9zHBpC zMbh6;3#}KuS0ThXd*}EI-|_6d`Q|&{bG9<$9gy#XVknlqIK8v_qymfi{`#n%Ha`mD=d&M%;|)IS85%(D?&(-Ov>N?9+!`cdY`h((6)`m(?KHp+Y- zHyC1($pn^pPS&GxUi@@m+3!p&@+@mIcSJ1wJYZQ-OGPbA;!I1me;b3roC zoJJWdT*M+{#FbSEIpbp1edSEkI1bXmOv5E-?$dcW-<(*UT?stmYTRIoaLIl>Vv%`>{5x=iAr^i) z@Q4BAn%{?!GtIYw7MXfr(Mc@)A>>=}Pb~Z-VEG>TD9TvzOe``P3=WA>%dKk|#*UdIm{6H)+%r4>wV&NB(PX-LJ@E-t8%jLXv zV&R_v9%0Razd@Ni++c`B<}F}xw+mR@B^H@;z~U~k@IM9i=HmuKEPVDAMJM}R5{JYh z!@5}VC$aE{0?S%}8;PyB9SHq#H_#=e5^%}<{EfgPhT#UoydiV-=?VZVmaryuoi~McC zDPv5T4E&9_)x<{HjWzKU{7Kpo%d<0q<-Gp+l(FhhVv#ZOr{#ZV{@liA={QU+E-BZ< z^6U;^Dc8ipe-c>E=qDEbGvr%s3bF8C0G2)Ptd}G##3FMPSi;^395)U(m{Yi9{Ufo+ zcad+oMJ)XHfyJ%!z!ENEk@*N%!bL26u4|X?3J?pQ>w`vEYdM(*#GkA(q)s3f`4r%k z@wmY-iY1>Di;R&szDEh`>;)#Qg++!@kdkSz&GR3u^d(DVrU6U-Bo=-y@Ca+d>psd@ zWrSE{N`d2;(O_zD#Z5AxQGO-foaOg%SWCPSi=L-}y{pYthIXq zS>YqI{)Jpzb9Z3v&DI9{@NxiJm}?u>6z4gY`4~?uDqNetz_RFJ{R@{WP%i(zHLDBF zRYG4Ph1EnN<@A>6de2Ui`z0DJci}-SQ;J-JCAS?|+z}$=_rY}i}m8%ymUQn37rZ9gkHY6=7TE4o#9h;H_ zJftDQ&WxZ4HhrA8yogJQ#3#&WT>j(aebthn%U5hkj?Q%ghE`tMnwTZ?>yZ*Qy!sT?gKZsKB z#E8E8!Eox!xZ0GXK1^GM_1y{V)W`Md`@s_<`u+(Fr@lkb_ZfK9#~}*wAKMbAKAyR? z7(6ke@7G{B^&J>su34f!=bE6K5qPJ*CMe+8mKf2;u^p$r6ffF3SW=&JO;D3d->ab6 z-x4GGe&*758#ePFfDrXL*97%-=_`aMI2I;G^m$zRK7&54tEWB=H_-1)-#Os%amiPE zkyv~u6C?U^z;lN86}+3B29NrXG+}+*qv+Ik2#T%liJ?;TeeUw#Gv6@#Q`Cp34D0)M zD0AwIN8+<@FGlon?V8hn{|$Y+!J|F|J*@9D@c8&hOTm!dk@d7|HV86Ij0f3 zRLCJHR&N941#(u`%n%p3YG!X^Pp5eQRuzF~Ut zl5%XOoh>MNighRDB>z)xu`OoU(LNCu|HW(-=wj)q0-Re49{h7zpNz$q8Qu>MB#N3P8p1MhlcVw7ict z^vSB3y1r%o>A==Db%F@zGU#PxQQ8@;eq)CN%#f8s+QH7k7E0Z**KdYZjhMfmVB ztRgxfI>&S#I~FQ?Hp3g+d91Q5RMr|b24QUq_CLTcLOeXB0%s>Yr;beVc(j8@jyYF( z@PrJnhbs&po}wM33tKO8#hSUsBWf~Fp)f;{%CBLljjcEfAt459n|6g)OX!{qoEGw& z!N;M3mR9EF%iEaCeCu_aNVSi^TbGe9-fZl6{$(HqO>FR53v195MwBh%o^ zGv3&(JRxFwJ>*mro>y2`rTR>Kd|F`ZJL-+>fV!Z55U-b)M`>sIJlu?>%Uafv<247< z%8-uu_Q$}f-iuw`eI_zgfw(U9%G4_+a@9{+7JZXiCaYSs7R~>I_*Y)Gzgxnb;KhnA zb3LTDc#m~1!LWJ{PB~zVXa`fmtA_AJ6DtlFex9MQp(N2iWvVBOry@AN?%>4K;?yC} zZS?yQzhCF+#6!uY2z``&(m!&=r1jrhKVkhOuJ)Atp_ltLZ zP!>Jx#v&D1^MdOCO6tRmedJqBR;>L!w=v&wR9b9f>QR5#CR)|o1W=5cXUWH)Olar@ zMB2xy<*>gl{7kINzPDk|F(K2K^o>HI#pd%ICo+vm+iikLvrcx}b4 z%bUj3*C3=NU+bbdeq@^7uJH6V{A>HCuhBQ9?0vYRKruY&=EJ!6bvzH75D6TZX6J#-InNc8jL&0eGX4yxZ5H2O4v|fX3Q5t}|Fl z0>*T2uv%h0zYV+rIB|^Q)MBWUW(Xbg7%)7>$^IYrv5-&fGp&vCWXOZ=@8DC{wUmb; z7WpJ#IR}AQ_{<}6#yrC$ejpYZ<~#8NvGD2cU*m^sATR3$=m(kSzloSH*)YktWKMo0 zaEdkePIu)z0@e$1ZaULn&f%U(%$H%9`MBgP`GvsZPh#=^Vql3YV&OC2ik?zn*+ae= zSk8uLI;IT34Q4woiCbdPQxD8>1e)ErL}#M|?**3g?3wo@{)t5o z4AV>Iewkh}XPyZxZV`*lNxtgJDw1{%|AD^9IB6 zD1IQ8XIYQPd<(JgW68JDomlv+CuN^DlSIxPPXvy$<~-@7xJ4|_rj!5w;RZu2eCm|* z7l?(=xRNw=#@kKcOPUgkyit~!8DSWfl$#A`jEBhi-Fag7*FWUh4* zTmV|mBY(hw%Za~>8%&II;G1vs99`!wRBR8uo0BOE)~;NQJ>UgA{djdDCSt-P)T`Iz z7Z}qmu7PHJTNm?1u1OoJUQ=ASv`35Lg2Mcz%hzJdHD(Vmg@8TCfUB_K`o12&;r)gF zG{z+E#iz8xK6eL?QxiBR%@`qf2!$t0WGW=Q%bRW)8nI(G{6NG$a7u69u6!<e7{~^A@dKfN=0| z<&g$ArF(!c}1PPpCk;3O}|m%Q=lzBuoN#dBlCzF6FFh*^m`Ejx$rY z=wn^WaxF&W#z2VmTZUzE2$dR(Zvrmzd9hs@;?g%CyeYWEh`vECeIG$zDTESm(J!L! zZD5Fo{nrTGhD(g-I}HY($-qT(A0_~%!V+t`u2jj4?HoVk1|euqtMrR3%mqej5pfx|4KaI)W>gKVz`uYGk^<9I9 zSzjjLV)}_b)`L!cbMYMGLyYJv2E(auCG@e4Ou)r9OY~JinN#0l%O4OijOaV&l3NA~ z>JcMy%tKCn_rZekD@Nodf#Hm$Hezg;3_yhfRQr{X;S0zq=sh)VB2wYw?khm48d_H|NgX`9IGHiFuQJ!+&0X@A-cY!tizSKl|Io zMax&F22xk&t@v(&ncKf4|KFT8%C!CJ`R`G9KW1D?8*n2i-E;b4;1!&X;W>YiJMB4R z!!z!==l=A^8%lJ}5P`3IUcpQex#|<1M4f>94{|V@)KcMzu6w&Xpx(y3(+@q`*$w5< zLCyu~o?xFlvaGMRqt(W4Z4J8QD|GN3Xpqt_M28<~T=PaEu%a&dnM!~oV(SClNTg%e?TMxo#vFD=# z84YT37SC{)hj}!f@vZvv^zLtS&Ma0%)5aSchi}Hy?)+7>8%{go=|!};Kr4D7C_9Zm!=zYKnJg+aY#Qlm-H52pN;)YS*_oWr{T*Eeuo zf$M5q9$cJvOD$^(&tJ+MpZ_y+2JW7FVoxS^B>gV?x6^(zc`;(65r-7gy{xPr{gq`P}vUEySIHFNblYaWz)*r z!{5$MHqIgO_1&DoCnN26LP^Nen338RiYY^@={#k`d~O-ySw-6?#`B3Le^N~-W_QGS z`dTLEbhY|qoUpQQdh*O2GyBf|bn=Sq*R!WC>UkGG&QqyK#T<3WgEQ>gkOR(^Aw6r9 zw;$r7-dFbR@xHz_8Qy*wpYSAy&?6NYq0Nt}+(WrI$)OIp^qms4mt}ob00;5-%Dyu` zDQL{)`akM!c=X5BeLweXnHEewr;+8o=JX$VYo^4$+Ev^LC%~VzJ84i!6S1n zJAK4FYr&mrb6!e4gj6f_#uOWA<@La?r_0n8CEg)O!G#kwrdiYGP}w24H=XDHM~lz3 zGl5+XqQ^f13M=Wbs#~x2SmUJ}x$h5W@hnOPCrO7Rg!AYubd4+vq zO2qdVxawd-CiSjAFd%!Q2PtsCgW2T3X{NuY@Ba*((UNpv{eg}CzThGyJ-2F}%63PN z^?7zEtx~IJRr5f1$hIkPIcMaeSg#5 z4xdS9y5y(0=$S5>eG=1{&*uq=-untidT=FaWO(}-;khX+-%mYj$~q zG@N+K__gEb^6#%lrtcMoyd6H1e%jDzYNh;xE_$Jh-t407cO6sT3oiQ?UG%dq`WY8} zz(GgG&sDDYy4ncO8)12qw$t-!wcN66!#~d>VEA5l$Vcio?XL^ln>63WOk>hU)nqVC z`XRBl^xN@y`S;oBz8(HShJWn%8l*BTUDO$cQ6S163+o@`3cqQ8OW59|?fhfXGhFsl zT=ZfG9hpDB;mWT=T=car`Z^bVy^9{|qQB{)Z&10YducLoab8~b-w!cpkMX@aK;zqK zJkQ`)R{3BV=XnC}So9%-zC!)c(wAV+SE(4w9;7ig)MVM8H|(!QnX*kB;IADF(zm;w z&vVgu6);RY?wqGjciC^X?DPxZ4^ynv=b-FbK<8m~_ zJ_ErX|JPc4V&T&*ndhdcX3eA1|AOhR#(_^5>eRSU9EN%X4|L#bh-nGK_z^t`#1^07 zm1kKl1k*o)M-p3e)vP;&&vGUBHexyslYvXV4V_7BHE@%Ntqd@Q*qS?^PVB`EhT)aH z-VEaqYp*x4#1*}Mt;Hu6K2;AHiW>~E@L4vlwfMxsXFDi+x(#=400V}}DRa`)FZ-Yw zpR)Iv@h1C`8CN31_=&R`*bL%t;ReI7%X~A#8)wZ!-$^_SH<-n^EHd?!xdk_vMqJ__BOS*YY(@XeUglH>&IFcy&BUT}3UJCl;0ALiF4+T1EHcZ; zzYRASV&Sg=7PpvQB10@PTOBexh^_sA_G|xVWy28 zo#DNni`Ew0Z0$+n2re4(v`gPYC^#?5@Gts);?nmxlnexq`q)hu z{{?`-4#(g0=$_Zq%(tG&z(371aprq5^?7lLKCmP7#lxZ3T(D#t_4F5#mXkhvw0~gICl*=daPknqvp&iS|uW?bIJhudyoqiT0{5mk4 za_b<+=f#NJFTilhZGhZ$B7}dDW7wQ>J0X|QgWS`2z$u5p*@(GrhJz*w>Ex9A2y)DK zVrWOR2^aB55-=JH%3>3mGCL-Yj!;Pe`&+(aSpFLF0QpL0H(^&}0` zgGS^^ActSrJPmixBP_I^f{Wp0`V?Ye)pXCS zqi@0}9rpts@T~WT_kUqF@PJ1sjK9NHsON|KmyT(E`Ge=X_H7?CD=khh8#K}zTl>PW z1nh)M#I#fE^w#I!ZvU0Hyz4i5?9z!i;rW|!FU@?Z|I3_zT6NE`q^skG-MAiKgZ^RM zu!I|~KK@_rzwi9d*Izqz@@z-f@6P@9{ogbm*!U}tias_-Z9Fy{vn``l^bx;`{#B0J z_?vtc{Zg^oc)UzSzZ}HZl=rCUL(i#=M_MuM)1fxL^tOur^#v7u)T3>Dd62g8z;G@4 z@Mvvgi(iZWO^&wlXuh`b*Tq_5|CauFvA+BVRpYC^{93KCbK|edwCH0&ZR4>$T6EiU zT4Hp|Re609uV{(Mi}B@0YmFy-%RkY4`M=j1+x=U1y%K$-Rg3;rhqm$f+uFw8T+kA) zZ0VENZ`TzqDzBF>f2h`Y+?W3kTH~?MdsDU0s=@G~Cu-y2K~d4I!=s`PjgCsZs-^GQ zex^S{OBSf+qoJ<5wB{qBB@e3Rw$RF2`Z;Q2TTax*L-|qBhl``&qbtu|wX4?z4}7#F zT5CGw>-sOPsm0edSW7!KzB2iZ=+-j05rqCdQ3ylSu2}fK*REcnu3VM=y1#nttMe+8 zJEL1Wp!aR)ybv`ZCNFk;Ra$#=TWeIJrzJM8*BzC~$9*eLs_521(U|9o-qSEW`~NMxbZu^wBENTpV;`_iQ1&wlV9<6+^ucA>9F$F{8UZeGHGJ+ zF>l8*&0G7V^4*Pdv~$vPeJh$(Lr!SvFV(n~+ML+jP(ic0=wFiMTh**q90>jKAGJ<@ zR+evhvugH-&b_D_{P9^KP#@;x<%U)^tM;4;xxUrSswrnc?r$qoU;ohWTlu1zf$zXi zt!(TJogS#3uh}(SFI~LfmwyB~L2v8s_PzU`DwO|EYVV!a@NQ+;o~szO-< zwXIXr+Q)7W9f{RKv6oa^t$yb+O&^RfzCT#ow=KCYsV;OlPmQb7C;p{7^zMgBKbfaB zM)}?(O49bl{=Q0|b+4AxE0lLhh5XC3(58!8sO^GUw|U*6P}zTJ%|Y+UrJ7#*6Xkoi zOMSlW_!Gz58=eTY4bVQX^-lbAcj$fkjXFbb5)IP!dtR&bo?NFj7`_c1KCJmRm8nqc zJ1W#`x3;%V&xO80KT)A~JJhai^J_56+S;z|3hHgp*43`OCk$C5T`T}!pl#4h#zabN7eY2#|WGofuTw4L3gUJv>_tF;Fn`Lrb|__L~XX#7j} z%T@Zxe67*r`{07obDFjI*xy!WzgGC@he2=dXe}MN)0Z_^8&Q>A>xGb@!jNRRntMys=TCyj!`U1uW%C*GUJ1V`M@!I~_oT>@I+|tfhbGL_DbJSCn zEkQjOS_bby{GU`qYtL>zt2gL3R}ZaY+W!`Dy+lin4FxVLZ)Z^3>G^G?H+Qf$uGj3U zw&3yYK7WTcqB09HZu-Rc<~wSB?fZ{4JobyKQ?=g1f9}2mJ~1@h4Gp=)S`z&4?QGU+ z;gk5_k}X}YbZrZ@wrWpR)`oo&dheuqpfvV3tYlz z)gEn#XEyRWef?VH#b8$OT*bNVzN~fX+f`Y$UgR0(1m>roRW(1RXZ^X`_f7{wY34_u zoLX%t@}sx&JKDZ}zOG-Z?Ap+#9MnmBxB2|7+CNst8*!&I?%pj^H&;JYr~8qQD(Sc6 zSl{w;jCn8@j0b0;mey;0^@KVf=IPt@8I_^KC$)dA-mmMk7Hi%?yH)7!3kXL;ka2Z? zr5TRUYJ}tDMr~KL@0~Z5eqxWd!_!(BiaD(5C-GDrow zf1z%eMIXcOdcVF0|Te+iI?fOwcT^4+V6pBY#{h(PbuhRV&x(Obox=~-UZphVAQQL*e^O0XsLW9UJXM-xMHdNfHO|8~jKkfcgrEZpwyK7Z(rMC^a zX5DdhM`gp@uI;;*R#YeO-un%;rZ##|G4PUTm5k!ySxcEQJbN0!zU+fiA-5(OXowKUZD zok-ncEwrQysf$wbX*hL1XjS`iQeQp3W7m$(TC|2+%2epe`?Xy=JE!`pexMR}#=a4% zIL$gP#-r&uaFg}I3aljSV9lLVc?Rji9Qz+gmpQ@g?c=t$1VihJRp_lOP0vE_<-QKo ztVW4k(SfJf+9P+==pDPY9WgI&3B~3Zbud%K_Xni)rXsC)i?F(e}Mo)x2W{c*vKi$9(_&4r^{vDRSpqgcDWR`q&q zV~{ni7yT2qJ=wv;pf~Gc_tYw1R+p9*^mZb5*1^SPhn4SQuBJ23U;3Sbzh*Hf&aRAy zuUL1?u0sDpTBi5jQSYNf&?hg!CuLe&Fx0CPwE)`dI#n%eFedG7F zWj5?=--&o_Ytt^mpNv7Y)SKScywa~j-SKJ7t{N}uQ=}()5=p^O**c>J(rfpiw6>w| zlB1;}C$}&7TyNLCZI_IY#A>MFa?`bRmhWC=nzv)A+4KCMLB-Eo@p$6nUjL=;dC)mp z%L^8o@jMV^^3AtUTFbOVgmeDR89VKmMc?Bj+qBmzeZ5d$ps(mf&(l{BRP)g$>4z_M zzgEq5az|aL)C2dV?#61wj-O~ddd;hBxoiIR8QXQVJZKlu$7?}cn>{!55Kt0~zTUfs zRaR~j>M3v5rS8c_noO(pZ5o6!h7hoK`W|b`25kuH?%J&8?d{vWZ69^dhU7ZbT>8u; zZEUQ+iZw9XUA7;ga~D)I>IcT6A0ckl)*)?jQF|i{=#7V#VdZ4baBVEgU)Q$wZ8~D+ z_wZr9s)Y}kdwyH_fZ;=<&b|Av3YDYe*V0}3Fjh;i4V9x_bJU^Iy2Q@fXQfIGB-5EH zvzRLLs!(Q-3ysq7-yf;5Xg}z`sqkNpRtWzsL4LRV7eEba^{@-{8A#)c-SeO=UK@fm zj@QN+eP`As^j`>Xj_I?r(Q-&$%-2x!#H4Fp_Csn>Gp>fd&gZmRgzIc>^P}yLGS~Q_ zF;`7PPGAhquIjXVtmt($qaGChm1(&_-=@{t=as%IH>u{V&?dZ3)%i9)rX}iK-w$p6 zFKyQjUrfB_Wp61S?k$6Rvlzd#E6*{#&;uG@?VEV7%Bo9#OxjF+=H19qKUJaSLFGj$ z^5y?j`TRk~MGV?AD=pC~<*(zPpX%yy=dcn@1TtP|J=O_?;mWD4_2<&xn$>ub-szSG`yLdcwVdJ zo9E2uwRrTZeWeq%a0~Nhoyw~V-TNjrAJ$okm|vM~xCX+Z^tpzkojOjJnW;a|(S0jISUajQ6|{+S;a_UFiE}muK%N zM6XZk1Zkm-b_KF*S3(6B&_4KzpJi%tG~*I_OXxk|{ph_8^$Ge`h>K#QZ?(N}`-I@S z$=Ui6eFs9wwu|X!zJKKgLm&N^ac!iZ)!zzqVEs2+6r>y9S>A0{OS0RMBRcC4D=2?_ zcX_SS$Pws=-m5kA`aQzUmSAf2uG-Lr*VN1K0eyv*10@6L_lIWnP)#96U}E0UbiBD3 zZ+sYQ!8Pn$WZTsKMy>HO7X{ zHK^L0z50jf4~Jq|2by((?*sOQLRziyripj4!xzzu`WT^XN4}`73&p&loh|W|)o8xW z9&O2vP}KEWsCt`*@wts}YhC)ZI^ViKs5`cJjgbAe+S`WS(u3%qpx1%&viPt%g%qDw z6RJ3gF`|4`SQqjv*FFrk&F|d#;Z9%qk5t-DZ|-hwNX+;u?}_E8pPn+tjE2;PE~1q| zO#421SRJftto2*3h@7;jia9cLv0dc={ki*(NLA*k*DyZw5L!OguNZ}x#Wr1kLw6Vz;yF!0G2ladW&(TM2P=!dnw={1i`t(H)qh~%8wLklZh+!jS zsC#2)KIM(=I+0g1Va|-l(;mN}IhyI4z(2?b7|#?DdAb2_($vc9SPYgH|J zGRQ-Gr^rKln8R^Jj*oEU^0lfV!SpG4dYb-J^*G&&u`C%?^Rd*_&d2E232k)c1oX-g zpEV7NEtOXr7adxxhg*@oHAgFs2AhJzt5Y!&@_BdY9kiC{wKc~0K6qAzVg_j|9yzx? z)RwFERADR>HpW}kvghC%*5tD*Ki~Qg+9&g^%Gc+0?P9QL>r>U`b;jFGIJSH!ZU4IE zXIqZecso$u*lR_cc{_}n8{=F>T0=~0_0VAL+%COI|2D_>GXLED(iSVO@pNrn?$mSJ ze61d16osE8hiQB2l8$5 zXyvn~A$A98w=#B7R~e(PXD=Y;_;%3&pRn%Dsa*2=i;p+%+!36kzh082!!Nqmh-3DK znd7Eb-cTL#pVYcgzZ9UZKzqOXBzj5T)6$}u&!zqvT9@=sI}k6wtlo)uxzPO@;>Bno zSwhMOX<2u@j`7m@>bc6j+gTIw&4nWf-ji%~=T$%SqlfDBlMidVdWYWm7-KcN>e7Dn z%PmPi(lapvhxW`U@qtY$)Yhf_d)51BQBnWaAa+;tJz%Pqc7<>0AH$(5tZTb{KH?S{ zjJU-Zo~dD39s0_sL$~?x1~8&}-!_&jjsW}cUZl?&r=?qQyi3~=6?$u%YOI?UJia9@ z`0vKp^2gn%Ur#WeL+@=;zS6g}Ay4c;f8>Jpua%#oe4`&f5as`U`pN7^7S8kax=mZgdQYGS7DNhsz#bvr!VXsL#ArBcf$>$o(!Xd;PmHcks`Fyh5_N&mDu&*yRiQ)2 zwa}rDw4@sSBx-{i)&?ITv>XGPSDl6Sew3Du_v^yU>>6L|2imwtnICVhLixq$laY%4 z;aUh|IC{=u;*PpsRE?{xt@U9%c*V}p#MiW6 zR)2`TRfDzzzV#Ztm4nr3Ib(w@wdujw%-+YMavlf{4epwGv8Jsi^U$`LEj6Fk?XT&5 zB=bnzq4HmyYfaB-Jly`$`@imddC0HVy*%eXm;BezUp>$|?(o=`T3&B{qv=%E!6Vn` zo|0J3O21Qr*-HP$goAO>m^IvZvvX@!ks;qEl;!CA@^Q8k^O|;geOFXISDdja`o_CRDK}Bd~Ck=I#5E zHY3PAXX0+Q zX(&q!YqHNlO~eAg%3;nkDm_BCDD3khjt~}CB1gE(&6XywzMOG(rMe-@rg~@MOSX7}_h@L>)UcA>>c=G~)Ufr3)Q{Ict0qO-Zh-9u*lvXF z#%ERUNfFPM!nPE)*bVmMGCUh;TMpZD*lvRDCOkVO;@O8``!H-PU|WHj9dpUHA2q)j z7u=aO`=0X7T_+makG_Jh!6P0fS@X~m|6?%M{QPq-e=r7f&Clni#d$r0M(Sn37to&l zMlWA7F}W@ENZQf#V`Dhq?D2dv`S>KY%dvNB686%Gu1SVJgwp)Y)01Y_&WxR%4}aWx zPwc70H;0zrMLIa#OA&M{L~F54-5>a8FWqWZ63twKJZ60j%tq5%yo8q*TKRueg`R z{I<^z`*~vq;tR)p6n3d)QgRGd32-lMI0W_I_J?sMzIQ%7Z)W?<3A3AKC(hY6C+e;b zZ_k@@1HzV&Fk|v`|J2M8Tp&=CzqTl0*zm<;6Vw`fA|rpXTCxaRx}7T|P~`qM%%cAd zB~BfS@&ZosZ^x_h@qvn^`3Z}cFGZ~U?fMjaxHx~w(q+q6+`V#D!Rj^l6s|2QUU%<( z_doD|shkR_lWM7%%Bi1D&=opFx9A*Qq@#5A3!NK3;d`0>tcjB*XWu?$>a_1qzhlNf z&CJQ2b?59kU+njhH>deVjZPnP3y&;uo3NcN^*13yKi9%U9`)h zx@=GDd!Nl*bW`uThu*y~scCrS&Hdi^(TL%9k9+U+y`%oQ>!UX|&dK_h&#RhxUphT+ z`vZ@~WLIr(duG$0=Jfk)UTnn&liNRiyYPkezZmx9f=_Rly&(P4b>E76e0j>Xx&QXY zAMX0mP5GfUl`jsc|EF8BAMgM0Tb}xr-+JSt9k1v8;XBWq?N@Mf{NkwcKaSnB=bn-G zH+}PtipPpm{j>h@_FF&t&)=op_R|gj5lFlHFD3Bf-(>!d&!xZKv9PJ9y_~%xBF3Zs z8S+eH(_Fr{GE&~X7qPEvuUUUXAJ@Q{#-wE(7+15=y*#nD=*=#=+(j3-=p7C^(tlSP z`fc~FRI{u_Um18t!|KLJ`8XGiQ(CR~t2g8a8|NDVssw|MSDhqaxVBTns=@bwxn`2< zO*Nci`2qfE$Ro}0+G|Y*81y7Vf;W@i>7woUFzuUN_Ej$WfQxQ%(6_?4pRYqMysgXCU5 zhqYl}OhFjdP5gH7qXvbuSFs?HXYB5>9(dZY@2}D=n&122nY%o*ndV_!JabppQNCf& z1Ju0^2kD>Bafu zh(*2>IBqDpX4#fKj;veb638{rOqR2J9|tYx_tpc)-GCd+Zd^lHm|%!S|C7MiT6|*R zKMgGYAr}6#z#}Z3FHpwn$q|dp;6VeN+p4(Hr>9*w;bqDA49v6L#agC?J~B7n*s}C2 zb~Y8_bW-!q{X7bO2`pPwXas)M8hhQf5jKh&`;pvd#9hAg$9884g1VL;nR9!f=P$^u zDMYxIgm)sXS-Gfa$?C#Y3m(WXT+Oe^^{^MpcB^;|ww!&149@5+_zDs08**+B8!@(O zG0%eyJK4k8cSd}sjt+-7u(rsT7N!t|H**8hmqgiLd0yld|#nme_U@unN!~c z@ZxZZ5q+m1ju_GRZ!UeA4*#(aCjMIu?DXG!(5zd< zh&~+*ryT1k_HD$79Q%aMaLjeM%Wig%73uav=(`UY5b4EOiJqrNm;G*>3zTYd&IZ?xle-1-;& zqY}(_2Cxl78Jh8yKDt5kVxm$B1~PB-lR;Z@qVEmJ)te&5UG#k)fLP=n9A?K61x1cc zCNcX3G%rGKu?dYk?RZ^_8~?>5+$hNW7rPfhqWrB9Tgpuo0{``g$U~;KeKf&Mb$EjNw z4Zf$?8{_#n(Q#s!A0vdldym8^Y~iuQGkJdP40y`HgC5(hY+JV88&iRPpFPT{9sEuvt9#HVoXTZGOt_Y~`WJRf^KeKhA+pL{W+HSK`y8uhrJ^m-~Tf9CY% zQhlN>)7*np#n+PR6K(4X#9_1|A~fW{S6@S>PfVm9J2sJ4XKacZC-?&jGq5o{{mc;~ znOZ&1>`Oe9R%)kOVwwHbE1m=Rr(%9N&GYf9O8Fj@%s80mr{%VctJqi3yxEu|*}VRs z*R$D~;%Br2UQgesU3OZZ36%6j7&k|CM)3NOr#VNqIa-ZpHGAxxxq^O44LavRwqYh@ zL&`-f+=(5QOImukt!ZQJB6 zq1)<}-Y-U*?}*Rj&Cna2e8eGl3{OTUw>daRArq5)$iXT1{qtkWH+nkujSbgy{~)YK z2x_5EU&M+f;N^E|q5P*yeUVT(kMN(N;+1T>2m3B%e zh2wwHfobI{Hl4$Scx!N^A-P8 zeVC~oT!Oi+`Q;7a87l3J@BUjg@967QyI+59kjl&QrpIFyJyr!4KZUss$|se#WTj2q zHPO~A>3T6^NoHqe*5u~NN!hj8vA2JCSKi$AxfA9!%^Qw1PAofG_GJ>Xx6sVhNiEq2 zk}K?Zgd3%v)7lx46nrD*gMSCtg2Qs&1&Vj6omWpwk_ib)2O@0J5Sm%xLa)Q+Gm-wYq^z*;n~UM_^e8DI z`5Ka&%=lTK^;J4Ihb6VJ>ugPX^r;mdr~8-7HkSH^*DIf=J|n*}`BAN&B`UeXj`5?V zc6n-=%o%=X+2m=Z=@m^Cshb~+NldSg;A-gCpf?!PH|p!i zdSf<*#Evc1BlWQl(W+#{GC?U)#5~nB;=&eT5&XP}iSDD8S zSBJcmkgez|Vq(Q8DL54)sq9?Yl5j1LGJ?J&U3wq=y|CLTIsL&cjXLXW2@m$PillwY zgsDwaxt4^bjedIFadtE780`#KuCUi1gExWf@-NdOy%)BK_(pLr`_u`$_qVsS%pW)% zRB3p}4QzcDE2``^9IdZ^*iDbd4oj|xW$K`gIPdJi-838h8C*AnPpp_U-d!6fhu@o! zBaFUfncv~U8H7>c`_@t3KBZCrhrM@!uc|uJ#`npMa8VB&Pzh>df)V3MOmcFimgXeq zgb*->5E(#9NJ22s5CR0NR&4?aa<3&ot+h_H)LKRv3rZ<%8L*0s!!VSwl(CiptJYfU zsGqft?kw9b|gk0v1P_-X7J>F?$rTYxnpV z@0$G*dVd^sYn;*Jk`A26fg>l6y>$G=7f+l#{_+d29m`yY zBNHRprp`ob{My3qoojcj?}@tS0iMMVC5x@s9jk{N)N-l#R{90CI3X$>-xkNW((!F^ zti)$bMm%nbsPT4S@H%K?`}KF~e0{Gw7UHj3m()8L+t8s&z5{bGZ!?chy4{hQ?{qar zZf+?xS&7#6Zr9eIp1VU%I{M3}n>#nhp@Ms@-tUb3p!eBP_)h#g%Q+gtc=za{4cj+o z^z1FojNBg?GU@%9^Jg8ORdMs~n=@u_ojnP4|9Z09%5o!io$a}6q;G#uv>G{lZPoO9 zr0jjCUr#=XTt08~Qm-fXxcw!*f<6?-;<^Nuj=}0<>A0n3mQ2&V38;s|$!^)Ic5yh_ z&Yv~KvF}3#RLI{rSA^>@~y6GS_B1oRzcYS=-kbE!8<9Ta5n6ce-~=3hwr;bbNiM zYkSNUtSZxmxpIFNu|`mnR=24xZsxm_8mo>~MbWO~uNq?cOLtBjQMtY6_^N8B6;mId zG1$7abd&9K{GRI7QpR0axjWmqVfz}@r*$2uSW~uk-}>?EcCXvHA-g;NJCg>94f#cX zyrCDD_Fua{(36Sv44lV4Xqvml7ysBKt7-0ISn=qJx;59EFdFZo8f>-oJkqmpRorHK zMXoz>59fKNb>D$d_cq_jo>{BRK01`R&9^IYb~t-WPc;3ar#@-w9A@1$>XQsC z5;d~c)epgXnL7jL*|UY?W@l~3W!j?{oXOI9ENZ0n!;R^oGCU_=WdU@ZfvU?8RBX&3^6l}M!w^wuqe7-&D*~2T+ zgIyKrnP00&A9v-%^o-nz>0`qa)6=F-Oiyi?n4Y~P3jZklG1`47nx66fXx@61WcRq4 z?<`NOu#a|pPbfYMBdf%Z{|Vo5+Rt@Ptc0!Gw`T9!!gVb(q_*WZbFDhc?3IGcQ>;Kw z7J7=utq(9`d#$H&m3t<^TI;Z%CEPY+*U%}x-YFk``o;r|D785_TZ=8<>Dy+^u|pj* zbS*PFtQU>4=CS=cTYag7i#-N1dhlGwL_F6q5zlo@#B&`JS6*|VB0jULVr6EyBK}%m z#mZ|BMB`BoD}&)^d={Pq$vO~0`BkF-jUGtYHKeaJu`4vRue8NFY0OEwD(2jO*Yw^& zzyCCpOvWzkn>v5s^F?>9`a!t&2Nzp!ZQZx^BWvH*-g_>#YP%6%B*DtO=c=#nN_@36 zab;-GtEK<3q4zt9*2kk3ZR}lsv6YyxV{4QDJmU)gJ%ci?I(CcUK!qySB5v_mEjF}<>}eE;q+iQoSr!~oIb80oSv~H4F51z zU+&qxCV%FVFZCu2!rUCkY%q$|-;e$&FbJ*T)N5AR+G4ABNSC$GsUxiU;e6W_iH~++ z#TVr}@oQFSkX?!x&*3S*K@V9!*|;n5Xld^+F2=KvPgyVD-&GMG9b`SyleJ-2&o-7f z_BU+cD*9ccCfRRK>0Lg`N*u%z`a54BY4)eP65lQjwd}Eut!-da%^M=qXTz%LT{kgSfV{Dj@dlun+J%9N054du17ivWEhG+BZ z{tynm+JV_puCp4Q(G#>@#(P-m>}TH_HiTNA#WP?xg+r^>hSQ9Z0goA8LvZ_%0G{rD zHo83#v0)V4ykXZLeuSrwcO~?druVJ!jf-jZb~`UaJ1;{!FGD*oLpu+norlrR!)WJW zwDVH5^HS7*Is25oD`NYUi;X^o=eDx_>{%{$Mi%-@UG{8vMd#D2@0uaK&e_Hr>=Eo< z8FQ$8>-KgRc4J<+ZdWs&?<;u13hchbdS^q^y@}SrHD&8pW>&?_!{vzH-lJ^b3KnMS zSRER~bDeuu6dwA5^>^LWggZWToTbC8U5O9))+9E)&Fg)EEtgqMZ*SMWzP`bU^VicI zT7Q4|_RFdgf`qC4)v@F_e2+N>Am0&pK^>+)$VL%0t0zQ)v`b*#-m&ZlD(=8l?ur!z2OF}?_fHgveuU9CM_ z>W+ha`_Vfk`s3W5(}x+Ll)SI+D7eqNZmw)3Bp#){3UN3*^tSzvSjJ;b8*9Alwy%qO zIu2KR<~U&_Y-YDQllu0r?WwU`|0e%Btc7i=TC#js;?2H?5>fAi>@|wHcwRUW?-c3T zi!<(1cnXoU?QN@AdHgqoQAn2D+=j+78wbu=awr5Ue8@{Y!kaHir@?`FP#Xd=^qh>-~+2I5$d6 zG;Q#__VnsqjlZy#+{QNB_3J=lGQKgXTXbh5*7oD9iq+DV`){`hgRzse-alsyg&EZv z)a|;R>vnW+Uz?na@+)=MCPJ@%(`ofw=Un+%6-G!OIU_57a^M1=Z#u?7Qa0@8&~L5( z=+nk;#YZndUF{#rZ)JAvcdw2LSB|Hqd;b9?DO&lp`(dtS;VcvAaqos$8TH|rq4eiyIEukTI72)X^oJo*t@&m-PW`;$jiYDCqWkMB1n?;18G z%s0br-~7k}y=y=E^yMuXXg9}izZTRoY(vu%TAHLbQD{)Hr zzemMCn}DO?<54{cU8i5`ri&w2T=ROniC@B8HPX84rd_L^$H?q^XaRV8!ysRH7FTwh zK89nJ-b7#6{E8yiH+gRh>>OIK{>=IGczneW*H+hNcE=r#J2Js3YmPz#1N&N|+)^Ro@S(%p3LP}Dtp7+>GY%*p6CjFk=avmQ6@C3zU5 z_~S8kIm^@UZtsp+AL%=QRm%f)wQJ0E67PBl=TAKD+3y->Xd&vsd0-fNOxxm=5g|_lJQK zqZu5>>x6Etf&)!=jAn2=IL;jxwjF4?V>E*kz;R~rME zZ@>46YuDd*+Qerve~^GD!n+f!meCCr?j0iX^!}m2rz>XreH9r_Kj%BpgJ--GEN_gs z4u3`}Tr2Oz&G642-cV`wWAPaWMph1Q9WC|eJK(k1gR}A3Y#=4bz1NOiB7I(4UiT=c zJ+&g|BaOA+f%503WJ|@=iI*h@lEZOseg>+CEzzm4KEqkh_MP^o#COW>0h$Dcj4|SDYbNrcM|RI`>OT8FjfxmmVmsHyrP2Q{DM$UVJK3Z6N*F%u`7rc z6%|E_ii?Y*k=#f@Sw*OzsJJk-pflH8*FoKQtYeo1~|Sx&e(6v1CKryv?F zC@L?kD5xkX%qgrWD~RNml^2#rLa?4woRb?ah?eA+l@%40Oy!m5j6_*v~7KO@6DvFCy?!|?nyuAFJqHslSMKpqRNAt>}WralukXuj@ilXi07UZEY zigF83+_}->0<@2ca84+<0_yT`v?Mni%8yvNsDWGy@06GpPW@u@?Wwmmv@XCSNDCIX zIj@u$lA2mGxqMoBZfbK|)6(19>6zM(FWzfl_&R}Lts!;Uf?L{B`wIk*>{NWcYr*{6 z9g~)RhsE|E9gdIlS)Wpdr-g{TQ}gr5I#?# zM7iDPoRqs#ys=I|{tS=1%y56m2ZbQC5r=su`I~JGcPjjy9{1fIxBJYD;_vkM@AtUh z^teCtxKo`xD|;0lcdN(!iQ$edFO{F5V?WV~^&e#CH{0=7Za2TmUFz|#^SE0)Zam7N zMTPGcr={FG40mjL2HWY`?&L?gGdym2&YWM0VtrM4{M$V4Lxy{Te$XW!x;T8lH8%dC zw!ID~eM3F|7uf!fIsO-T{4cWo`OJ(G<#wN0Qf@x)Yx=wGRr#|mn*MJ4QvUnJ8()r! zP5*E^e)rin<-X71D|fBO?be_2ck4^J-TGASRi5xqdfa`6J2rg*JAH+YzjDvW7GE;PyVm8)0;2BE#)5Pal8G&m7ehF9`{&}`znw7YL9!Ir@WNg zJ>JH7_?b3;u9H6Hju`IP{042l+rKGytHW1rH@tF}di-a3+;@1~^9*-v{MmN=+noAP zZuj_AZufkw++#g_w|y)B{T_d}ed_Se!;;FK;^DvGap!sX$8ZfpNw$@u$2%`V5r?Nz zV)K_{=kGS5!=K07!ydO=Uf%F|Hs3v-lzWpCUb!!J(yQDfJZ|@R%Cjcx@e-d!j>8)* zn4aqmes8ie&N`37s46x;`8Ge#iQnt5>@9TsmD@evD0j8TzsBQs`&Y#eI_XnxxBpb` zCp_WZ@=*RCdi>q?Q0U2Dv7Nt{9KLcN_P95C-0t~I@f$tAS-5S8jK_GTxJ)>uvrJr~H)rO((o^yW>;ke#_(kV^8?a9yc0_78PFJ3x$?t$IovU zD!Ja1z6rMfamSu=yW>6OcFzx*FXr$T0JdLuyg9*Rztr}3%S*Z4^JA%pUuJFA#|P68 zXGJ{z5!+t1lV0U+bJC;Sw|d-e`&9mJ`&I6P9{wJWdzcYl{1D~IJ~Ga#wbSFyC%oyc z@Z`V3lb=f4Kh24+(&Jxc`@82m<#x{pRn~v%^enW?Yl_XE<=9jFBOZ63$IZS|iQ+#j zPJE@C_4}^jjy)b!eD3k3+!LJgQf{~ZQSM@o{|t|NzTu9Iui8$}NGCnY9rU=%Jnl-v z9c!<~w%6$RE4SOcd5mzvD|d?FjxE3GHb2|(SMK{gZnwOYzgwQl?H;en zz0(ukJ%1~IH$T%o>7QYz$M1w!?hKFHP45g(_*r)Nj~u>oyY;Kw$xeOD@`RslU5n#| z;seKL&9&{h=hNA?+dY1jyFvxQUb)@lSGm`F{O>c|X^4+;bwMZb9Wwlr;J?D-?;g*y zt^b4ZQ+!-(dfoOv+j;~32^eoB8TQ@tl}ev`yw0{xfIkHMOAP+gh+m1~-)p%44g4#? z=Q)DuKL|I4uj=wy4OXspv(DnIId=KIXoSBA`TGXK^RyxP&q02a%(lwm|9Qhc`?Jdo zf4W;dZoV&3!k+f}04MQ6FPQwopoXG5V&m;|wblCsWHDWR+PwpK1fCts zqlXsyH+k&cr`>NO9en4ZjEz@-I|6r29MtD~nqc@gPy8R~vSpvZcPd_#Or{d@_wmI? zTIhb<6TZT!3uS)~8?qMi3q0X}=}FHlU4HL_I|A!PZeOVEy|4W_W*C7lhs!%5-?H-? zurAi|AG7^OS?QkiukfVzRZsfHc*^rdT^=9W_AYVW5qZjXkGAC85V7OG9LIz!%u1`n{I9lt z&%lta*hb)rGHw=hgz3xj)R&B1+iZTOwM8Ef9Dj|#n`AEXw9h>{z3;=$2rJtf?70$7BB+p8ER8Q(x7d_!>R#7d_!KJ@)q)6~_4EJ@&8mq_;(v7yIB5 zI2v#C)K{%1KlQLFLi>X~<#Ed6?(o>_@uc@|5C5=-f2$||>`N)?cq+CIXgB+j5!QI? zHSJ~}Jp%KWcRcp}y8M!C{|Q!!C%#D@{^vEn)V5!0)$8&@Hx2t`)<%6iW!UZt>snpj znYO#qs@3iUyL_vxFMGa{}pYo#!x!h62#^v<$=sO=Y{Tt{Gh(dVg;JWu)E?uq||#~t$I zhhyUYfYd>CY>3V8xs z)7Un6I-;t&gmV;0HRd&E4TAs+!}$#IYVMA{hFog^&#FF9UV9067ogjhIivcZd~ zwJiPwZcrRz;amnByc9bK`#i}nv2cRGLH#b@Y+^kqD>V4T!e`$i{8C_fk8TyP*e4c# zEwJ$G$Y-J;cE6;{|BQY~r>6xxdEYPlBC$^__U(R2zeI2=^g+J#9P$7*=_`nZ{}^!A z71%-SzC~lZd~_L_9pp`H@*d;&iPNaHtPimX{=~q;&~yTPfh2@jY>osDrrT=kQgU?PODvoma#&yx z_BnwX>@*fm1vyvQYKv8#rEPLPAbR#KfvMO*h$U<*IhxPDBAB7<+y@+}#STI&{62&8 zIyqM>KCy5vgi7?pqPLHiYZRYZ3QR*F2(fT-fc=_dw~ac*G22EZI6=*^+ljVgwv*|G z9k&0#P09|j#06*tujO97D^>amGtDXR6FsqnWig4KSoC>@o>=q~3_Y>vc`S<^V$n1G zq9+!8qoF4jeVd^t7X2NDo>=s&3_Y>v?c;?F3UbErqV?wS!a9|)6S3G~od)$g+s6TC zU56dSu3zpTHP|F9v4oug9L&ZJG8$!oM3hI37DlC$`{ciLmyEElcaWfrHmmYgrqyi5+6G zvlTe_IqV?2v1Ms|F|dsDiG^>Mn_eV2quf3ZA|xMMRw)s$NWsp{s+|yvoeE%o7&{2d zC!lQ-3uhK^unarMTx@bI6APyW*dM_TvJ_i@gF%gjb0^%wSq&Wcg5nShXOqEskeoS+ zLoA#}$cbVH*?|p@R@=gIlROd&e;=@)8HF6iCV3<|m57+CD^5EVPb!r^I8?67LZ z4zX|=fyGV-IXXSW!nu@h=p?qSlaDj zVqL$-$gjW-LM;3gxMkc$Ec$W4!Ak5P?52f7EF5+R!YMU4#KNft7S42oLoA#*24}v( zAr?*>Ig_x1v}5!0Bni0#n~Yb9h0i`DI2k)gH#Ywi8>&8}QkBCQeTe4sT;RV!@gK&I z*e4eI+ku0c^CWPVE~_6KI0IP9jab5F0|#%!4pN9sIK;x404$segF`GFyKJ?cvzD#q z%s1>1iygac+1W#G#pa)CL%VDR-)-nwwtjYUkhR#Pe2B#+`=X$>vl-Yw4Lit#*o03k z{6~O=|0uA(4m-$BY{DlN{$60=v&{WBVFx*gP58vZKLRZLqriR^801B4!Y3B~%fQ0F zm>j)cL@b<4>h6kC?Ic?Yoc55&T^kA>M#Kv*x5eq!OUUV<~RgRox24zY0TcCI=5$QfZRg9o_i7t z|5kD||88=$O=97!0v4P1lB4Yq3+F*#v16B;wqust4#UoF!w#|7dB(8Ab}Mla3+K4O zIc0E&h4U7$q~`;JLo6H%U7>$26p#eqEL{%vTvg}MJ6H8LD1M5;9}ktJlUVGtod=r~ zpLHi3V&Smvgu}WM4zY09=7qD+;1COk?O!-|7#w2ZtRQC|c96B${LMDB&kKS#8Tzfn z^A)ELKLMWbA${1yCi|Q1K`b2hdqFl{NEx;)ZPQM_UdJ%gKN1|tJF(cY({m>j5SB^ST{gs( zOz`!2jac}F)a&^*vFIlN2k*uXVyCCmhU)y)PkQR$?e9{Y+4zxj1hLp$Pkp;8A7asO z1`d7&JIDjrq#%zlVRwIMQ_g~b$c`ClH(0N zvGBRHB=(6#Uv21#ML)yP6N{dw5V1ondUj!=Cl>v!hMrjTora!R^v_Vg3_A$1=#K*j zc~C-LCZ|Jjh=ub8Il5lnBWJnd5DVucgA<1iUC!^s!r`@;;06^JznL0f!Xd=MNdwMe zLxyCMquT(na0;o{bwn(BJ_F|0?XZ#@-8P7YQ$x-wWq%eq+CH&x8V$}ua`ar1SU5`! zPA55EQh6a34)52JxV9P`V&Ob!aJG|ko3cYJoSg>e$K>dI5ew%TgL9Oe+m#(+;hZoy zuaKkTA{Ne@2IqZpbX>&3`NZJxo;rz(SU4kqCGTnE=(;8rPNu;bZ*Yi(Q)Y0ckaLI1 z7qM{a49;9~bef5U!~0PrJxj^a^-e6DI}A=YIob}faMl}~t>ox(CKk?v2ImQKbl!=D zv&Z1bU?0Da9swo;QP=u!Gp=&ASxGJa5i|pK#^^2Q-IR?6d$2 zr_JCH3x~tFU@vx%JF!XsKr9?)TlB=D-%0)5Ds9A~KSKRil%81hCxEjyV+R?FEx6T& z_Vdd!2Id$;_@%&st^vwNhn)?MU*mZOw(~nrg*Efb^asC=9fVCGONZr;q=8t{@E~xI z0|Cf(Y=ITZCb4js_ux0MgFJ)Hf4>dw@9+gyo>>m>!aMLy#UU0u9|DUV&QpX#EF8{F zf)A*$BY`FTT>c0w#tuU4@Zpwx`GG}$DRA)bv4hy{R_DuXw^zU~(5-9|OW1ML&sTb4 z(dPgMAHoh&h)u#03nxN-j|xjH`YFJ{hp~f9#}-(nIK;x4OZ`1cPb_-2^Q`Y+2U(3x z+6=L9SS2z?BNqKOVE-f7L0G5$M{TIq)>f;y%(lH3-obAx&eQk_tWg|dvH85gIc9K( zh4Z4pIYrJ|WrtWeuLDb5ZvgwhhaG=G^)s;$yAAwCS>xkJCdW9jaF}=D z95pz^!Z~4ZUMA;T*g=Se!!{G7VaR*fQ2i_zNEJ50tUD=Z zVhP(w&a>D-m|Xus8(J(w|8okrAZ>wrv4apxSgHbFQ+i_2-v{hJq{2Q-j_%uug>!^@ z-FFd--fp+gtFU&v{TGGVRs&xJ5n{I6OzJl%J+atHp#ER6gAj{;EU^FIs8wSL!FIpO zOhan0N!uotuyz^hwr!Rn+ka5oTnH>Sms0;T>>#&c6Pv_hvy*yllUVetfrC7tAseyz z|J{c6JqBX`Vd`H{dUnlOIt`Ce|8u3^ZRpv=g?|`W`gvlB_eJXUJut+gw@}2v<4{0` z083m~00(}d^u)r?AYZ2^LXJL<6ANbwIVV)uHga^l#KPH6z3v}~MW2LVekKqy0-IpF zo#=Wu+etDxFOiLN0XD%Yz|u~L#Xj3f@FaGS3~a&ww4pr)5L^sZ;FQu6OV~2t;Ay3w zgP*|Hk#GpHaO^gtZMH)%9Ae?HodjRT4zdcHlmoGF*fxT{#tyO-o17Pjh4UbA@D=PJ zk6;V%0M%GHI}JUt==TCkexD&{o(fAW9JZeDh{!5UIz}o zh8^T>Y+0|`5bs?FU-u!z!e>7$9J{_~05T4n9BahF&!Ju)Ys8{21rGieJ4hwA!2K$1 z#KNfo_G?ZZu<%<9eTRWrcm6l9gWQQNONYH1*#A3fEo(hC!P|kQY>6damOnm`V#~YO zOF0k=Ck4qBJ+bKRanA2m*c@_ne@iSJj)5gCvFO>)OPZ5m!v9~&&M^E0HRkc+XGKA- zz~+C)hHCwMD-1wbFJdzv*w2JR#$%J?j#xNV)ay1zEc)5N!S}F(@Hq1S!G>0wfmzPd z{)r`QH*oNM>>#VLW$Cc@0sGmYAP-;*{>Co zU{r{t|J=WFf>40APUShGs z>2&aqiqGcm|489SssBXb9mF3iypJ4h^DyzJN`KVQp9Ge30kOpO8aX#1>fXV&U)@7tRcF^qhrQ zICBk7i@_llPP@Um&EOCVr_dOeRL7XAIeS@A0UNx;EGg_8|@F>#X8 zUj`g_z{O%Gm7HXyPXqRA90bl9tn`Jza&97)uoHlTY;=$cY{DTHPBn0FsN&2f=M;7j zV&TjK4h~bCR$w`PiG{;{HF$yI+)0i;e-R6Z$9UF7inE$nr{69^%{R+%5AEo45V6=f z!mt-AJ9gO)SJ*CFjajz-5lWvz98mZQ;K1LzSZroc|De(ni=JU+?Uz{etc&0%#b;dz zhgdl5ONGO_5Du|$SQo-!+ZGP7aAp{sMuS5voP`F5bs=_$g~Pg#xKjvJg)28UQUuLDcI-ZePH!ugP#i&cGb zoGi~(5esK5aMmS?!}cTVpTxpp+mLe~vFNjbQ%0+>#G=mw9;5Zdq8|?&__pE`i@ppv z$N>VR5}T}55(}r6di`7&vFLB5zEXuH7X978!7G%0HSuK%uLaKfjKUj%<-Q$a3Cns< zNmU%P4Lkt-7_BE3{x)FA7qRFc0}hT+cJ`2?(@89x{p4J!I0uP!Iu8M-q$xeI@DBrz z(RyOhzW^+0AQt^gz>wq^r2zCe~?q7dV9t1VSwQ_kqV~J+bIN0hTln zi=N%Rq=8+kq=8sC92*3$!VbcwAZcJyQZkgDSoo}lFL)8bvFO`@gPBTikE6cmV&U9raPB6)R&hGVO7i~bSdlx*xE#G>C0JVxt@MZX6)upT=IvFP^$2d`85XYk|K zb$19jB}eIrg?|`$jMfv2{wQ$ZJJ>;pMSlV~OWS-AIGC$AFX1O8&&9$&1=Sd>Cl>uH zz*3&XqJI-u%7Iw)Zv#s?5R2Z5gPl!KP=H0x@oF%n^drd8V_IV2a9u8#uQ+_JTgr!6 zIH|x=KE$FQ3oPYBEc$F z;Aa)6e6;|l@Zg3Ji_KQxF=s+0ZSPYi~a-Z z`;;AG(ObB-D{VdwSn8cvI7z@#@5G|FujA|E-Mo%J5}W`#BnYwauK<>I&g=M+9%A7X z8XSfXUa#!uw7In*yQBHGj%+cubXh~a?YF3TQPaQ_(3XMOzHC{&dP(;{wuJb_ zre(SHx8@d{gWj%q_ItkvGTGG9-1Noz_N5DM#f!<$L0aB;7LF>k_Oo)@8u0K0R z**Qx@$_NQ#Z;Pp&Tb3^V(m*+AzO8-n(vJG24FfV3EIJoM7uE7cySU7l?0U8fvT1P} zTYzP^1CwGl38_Y>zU%EE{kI>3%=f#Wjk>J4b$)$E^D;!=zb#b?1No{F7|2(bVAIkL zr_h;g{VMzBdauX4=6TDTlzM>FAb9h#`o#^+?e+Sd_XEYPn7TQm*`I^1i02>~vFms0 zpKt8vpsU!0B=z2~tSz_xmgbK71#NBtva@Mg)E=X=iRvKmQkS9WnL3ugE@mFU4d}F3 zOKr`FBD-nvqD2If06VV5OPlK#p@}Y9-U>?#Vtr#3^Aur#x{Ku^8_ZgxVX&#A9-ZEz z#kV%sw>Hm5M9qtqHOI!+N=5tfj%98d=hZLkXjp1!m_?_F;mB`Tv<%g>U|G|x*$o{X zOBXaQM|*d|#}>#U_`rNqOT$u!u?R6VcPwvr6e^vl1V`f(RL5ewtm>CGx1XhHNYBlK z^ISBi-#!~zwV$&wbXm7Hx5XqH#ZT3lry%l8veCp$H8VbcL2D~|$+mfm7sc4_N7ZCB zrkIT1GQWON!?G{N==9l@6@<+!v-&m`^E~tv>_E*x=Rs~;+|ispvHGSgG#dn#w(cBk z$daS9>lFtZbw;apxNVEu?r2_$#CXE+STS`*>6vO^<|BqmUBkRHbv%$`!p=j%w=G!K zVkQg+Fj{YOeMV0S7`uE5f(7-nxis zT#5$g#Nw1mM}tSHIwq>o!6G97 z(uywCuGr;m%Npj#dfA77U7F}q>zC%$dpPr#Hpd2tQAl~=XhVujrgj^x)T~^a+y7Cn z>)bw|%wjSRC8ra@2@=PhTU>5ly+N0^HMTBjn`f#Q-Oet-3A}iLs%ic<-j3Gg_?Qqe z+|q=@VKEx!t@VrN&9lb3#HNPU*2PURaTvV@292!?nk-}_8yvL$j)q43-oD8GUAmYb zz{$>@LZ9psOM_wog#h%)Ef9?Z@Tu{u1o9Uq+lkwi5SbL=~V8$)>{tGTMhd~nT&_Tc5%8wMSNCusv0Bk?OV z=8xDL1d?fwHyu9;f7(NpI`-}#5^L{1*xLbr5wW)gJk#Ezuouzky8vYRu|DcN>8n6O zxgIPc_HOi~@6BoIel4c&B5Y!hWrcqyzt^L1xmGSB_I~HFS9gW=9PU=w?O=olQ?wB=<~)-jFwBld=Z$1tT-LblDswM7J^y;0c2 z-U|p|+Ite^&TBRzV(;GoOncVNmc_M9+Pegs*vo;=w8!K5lo-RW*yB>LY46Z%w|++( z_KH2}+lWfn%Z9d9u@~~BZ`d5ftJ62euy@3hzNgWc*sesx-amWN_h!9o?{dT56==T< zF7=Uw#&n?=!>`yI4W60b!wr^oDg0S}pTQ>O_mkvUdm~}50{$XmZx48;y;oqb4kX&U z5}VljzUO$G1$*=p5qrP%#5-pI-Zzm^Grx`CAqq#t-d6C;^c6R{`MnBkN#DPC?6nRM z?{5&sjJF-Utxl|NIlruJmukNn#CtC=%ViukiI;29roALAjJ4@7{DHSE7XX;~IAz$& z1Vik7746)#*8zLGwGIA=y|v((_S%~)D-{8mz92TSx6{*)XQET#`)ftS-s7Hr{N8!6 zgFc4#vayN1k)HIWq7!&gjNw=8UF1pMkH6?1mpO*LMo&NVA?)d;W!tLQ<9o5q{923L zemBpsx53l?=Au)H*p}2z?5*~+`xaE%^`J1nJP%8LqbLKjKDNOg`z8^wR|=k)zHP84 z{aT@6kIx>N_Fllj`@R^%uh_fCli${M_1rnrS8Uk(k;mTi==4|~B4Tg1$6oOgb$y!l zc>P-P%jb{G^nC<-yp|#&@RuHYov`-=0@5DKQS1!?FzsD>8TvRe0-nG`@EE2P8zpC% zW$ni=?M=WY_DVeVuE2tGDf~smUcSfP+pt#&677{@6MHi~^*aalI35rYdv%`rE$(pp zp)!!g-bRnTg|NqVAR_kGc?QP*--#Z3x51vYmny^Fe|XL_ ztFE-Hh5guj0X#E(<8E`uB~uK0w|mm}cAC2P928q5za5_Rb>D7TtzgW@R*g;adou!< z^--FR^OhI^PvCR_GktHvUIKKqS7X@w*wa5(;iR@3{vu-U15f|_-k05RB8Ie1`q0hB zq>ndNj}>G16?;sFnZDG!-2RW}f64D=U^BmCVecq(B4Y2WP?+{+!(J)^GM?$$kH^(d zv6=SXgS~v{M8w`cC`@~I-fdZPp`*PS+K=|w7EOEOu2%1-hT0afR}PnH?W)9*6!m-Zo|L#2&6~#n^kH6XPb-5z~husO?94*Lu#EtFBe&Q+U}T_AHFdd;HD;lYX?9j~&w|ef*QK*Jq@Ue%$uyc*TC*b?Unp@Un#*%Fke!ILCHb)*|rc zY0Mw7w_EpX;`KA|Oc8sJVSI|@w2L2k6UBjF;eC({-jq)lL)A&|8OSfw%JQQKZ#VKG zd7%DMB(yU{`Imvja`9ukt}wSS)sUPsu+kLf=i5HT`611pJLD_TDHT4S#7Nu!$BCbD zeuRNKeN{Uhhk2CG`ofY`2Ooask*A;EUwyLnrRguuIx**X;|ueTEj-$GWXa5~r^m1L z{dD)*?Q2$-`A)}QHN^5AsOs5Wni1I=Nt*QT%*I*AW|iH%^X9bKn`Xy-;oTb=8dh}f z?9T44?&)&ATHaLCXZ1wgFWA$a(Q~Bd>qyCOI`K7(nnd`g8SXwS&EwzVd_}y{`Tluj z@*_QItHg@$bY=3C=^y7GJCdeifdYcBiC8Q|;u2n#5tD<&XKA+P8u2riVT%KfQ@H@lEYdS-!qnltlHa z<4$N_-|b71j;FnlajfcS^^w}cOX|9w-rb$IX2+V$wS`7|@f}F(*;$iTx2Y~}=DU*` ztDBnXropWUTn%!%V+O^w_BgZ{5LIpLxT?M7S zU0;3*F*kJ%wJMX3_tZM^`VM5SbB{PT+>+&igv3)#);ep}W?!G#YrL~O&o%hy;^Lm ztV}-AQ|0E-+asNBiK$B-GwicskGM*-DJORame}RdUrD9)yj#;)cdV{#=FXXEvo_6& zyZPP8SE9aR(;#uUJq0yPhuemPGjKWr1*5EYmftmsHLzg)z^!*DT5qP&dWSeA@7v#m zRS~vRH(uZAAw3TpZISM^J?0TM#5}4`v!%1Hy{&yn&x_}81tr>x7Ut`-e?L&igu+ar zvj2RK+vl-g2qN81o!D-(C2#LW_(ZhL&L^!vV&Vr)o!czb8#LR|hPxu}5$2Xh|Hs-m z%dLAU^InwsZ&BuP@ri?mUNAgx$>pE9>Y8h>EBNf^$|p{`aoWs==3BnFXvtSru35L` z>)-nJcOT#N)IS|~_PKxm&tJd#+y8p!f2`=T_NC3smMxf{+SJ<6c1tR5AX>Iyaa(F$ zPBtz|q>gLp=xARy{<`aKSlfv<=hQb4H4)vh2v9Qsu*f>KtHWf**-ucuW*-#sAor1rNAH~f%gc9ZNuIVWEyW*|Gzht=Q>Ie#<^WnQ) zv|sH+s>1WSh!W-Idba82eX*u{ypspT|Ip*l`zD3&c-e|XJAMq?wJ0~&IFu-Nk`qX| z-x6D8?tgIVmW&ImSoehuGS6~b3IcS=JGYy{dXDzVUAr{UigL6MQ+77XB z9yU0SlA}F{g|pMp6N`R7^?G50SoDX0<$Fm-$tl1NLM)sUz`-PHE$bw<06SI)v2b1o z7Co`(-v*ZN+`UIm5q1z_;c$IUzHh}g6ezYSc6$;IAH9=w@)4bsWW^yCP6qH8ttS>e zud4-gBO?|)Zygq!e6A!gUfCoT4xbqj&OCB-J0TWMD>*|{Shh(&)+Q*c$=C4`3;$m7 zu{J~DV+QgqA^SOw&nmt5ISxs~4%*adAQqduX_FU_A^XVTDO_XW93%(pA(W%!==>53 z=Y+vINsf+-SU9f%`!7^>-Xcf0Rbt`1PtHY(W5t1^+ZC~Jl7TUdwZ(p(Lbp%v^Ay4v zOFN%ad}6T^H0%@-b72ZHfqb2QV&PYiqw9!$pWqq5^6e+SuP-n`*&&v&3(3)G_QTux zE*P-H#r{Y58RU$>4nlLnAr=k?UjE_OLAbUn9Ae>22Nup8gF`Hw`M{E%R&q+QgAfac z=TU!vTK!Hl?QtjE!dV3@eG9SZH&d_cky!K`8w5vU2ib;AIK;wv3|Kf%k`u-bLM$Af zvxV~vu=H2N!Z~bkj+4WJgb)koB(T_d4LDGS9fVjo?*dDIMJ)P{3_Y>v*+*sRI!ZQh zD*2j3Ec|i6^8K$Ia&);73y0lY@Dl7GrP!ox6APyjSU6R{{!6ig)L|2w#KNBqEc|)o z=;MW0IBmfG(bz$jVv}!*bpU5+z1>cDg8`%yTOdNDu-I7-x0E5V=vmidCzTxSK`fk1 zLr*MvR%a0Fo0L*)@_jMpUD^Y&@N0pCS6~O3flbmwESyF|Pb~U&V1Fuh5au^4l}H~K zxh@v|TB!V2D*Yz>NWVuc9GZtvc+23h%}e?}G4x4j^O8 zj(uF~ylf*!mp`#^9s?FTJIT@MBo@wIa&+3B2F}XF4)Q!U!H0qUxTZ$oInJ*+FB(f@w<0E`RX@Fa*jfa)wPHWz#?tM0gI^NH3K7?c6 z&aNNKIlJ}qdq(G+Pu4I(`_Y*JVsr94;Nvm_1au!I;*&FScXRfXdOX9}wk-Ck#u#q4 zebc=A7>->eEeq!3mUt_BfJZdQnYZB9*vBArk;BiueH=RP6BrEJ-=h}tSVjL2H82!! zJ7>t|TbtY9;FB)5#NGiPdm}!A=-dBe66Cpw-E1-v18;6O^$5b7-FYK^Lu*HUOLJ>G zR%&rCyGd$Y#(Ua5_qP8jHwgX~I4(M`En@Ds&<^bZkk$o;XQ4WA1IBN`e%F zIk9ngu0y=*8Ic1KEBGzv^N8RxV|JJ@Ixp}dxuBj{%^!h zdz`{c`Z(1!?X{r5xfUQI_J%-V+Uvl0o@GOOxIpdLn}M(lF5zB6;tSyx5z{|{f|&CP z%82Ct@0Z{!iX;qq=C|tU7QZV2kUb8KZ6R->IPfdH01{^2FTwUlVLm9rI{}{Lf%^Th z*NFn4Khw;z@MBxn(vX|ol)bod;dS=?5IOc)p3!!wq;&L8e&`--fo1+=-F43UH4$!g)={y zv2iO)i0v%i01=34h^b5~?d)z2mup}7Wz4YM{(`2mi#-VGO6MQC_|!Go6&oFG@hl9S&YO`W)Xr|-JF2`k*b zzQC5TR@D}NIFNX6{H~sDac^xgEhZ;FHrx%ftEVIWj6pK4rPV|t2k0OR_ZbFKZw z?k4{?eYhT+&~)!+{AS{c_L(dFLz;tLBYQwc7ERV)Hy}e#3%R{4_K+*^T5+-XY*T{5Ru&KK^gPe+&K>;C~_hzli@< z{4c_P8~zvLza9Te{^W>^060$Vdv9L{_}(`r6i!U)TDW(@RZDKGdAjw1qbI)Aecy!0 zWuHCPws%L>L;pSXnpa<~Xn!Yv``533;h7h=y?@2;uKnfXSLZh8`xgH-UtPRjIvSKk zf7cc{UyC?p7Vq>+N|or`+ju<`KD5S9H1{8Dce3>@?dCbdhaUec+Ktl++=DFIZ`C@U zvFPsfxW_taRQ~%t{*QRvCq3>?Pk7F)l_XlX128Q-w@G?d8~#iW*O-;4_&N4A-5k4% zdm3;G9AZzuW<>iBvSQuI9`|66dx*z9)Z@Ouxwn2UV&JthJw>tO<9T74jnt0rfRk2r z-gv>|f3?Sdl=j~WJ+Do1E+ayF=DCgTjpB)4x;Z};p?j4$@Jly_16JS)r6dk1XkUX0 z=yeEsi#`Kbu1#^Q5=g}kLM$Af=Y_*|8MqQV2(fS~fdgsOs(VgFZ}W9}Onw!3DSF+S zSoqA}7_BE3eI5B2!%&Dt&vmsiT5qng&4xaOjRrz2{JFqmw4PY>^MK_V4zcK4faMwv zvFO`@(V^RN8}@;*E*8!T>UEhDi+(L|kb^78dTeri;6dQPRn)5WIpObsTk3^a^t*w@ z4(IN24P+m1mcI7#04`{b~(K!}C&32;!ZtDr6W*$5$= zucu(_ELix-(2vo2V$t(Bknflgi{75!b6^Wefj&zQ=|~c-N9YPQ^*#2tHuHJAF^Fj+1TD{WZ%-2@fPZ{gyhTS(+;8j6*8-+~2Z3`Tg)Hg1l zZ@=C_o;qg2Y>#Ej7Y#Vgwu8&N1!A7{?>7SPQ~h>u&qMUeB%fEue3p*>9>}(zpT?ur zXTFDqA>7=_qtiL5s+P`gUyl0Y7)K-n$NxRhi3m)9f>?J;1I}^hg5>4R6=V2~)A(kP zXtPwi?}XudfqB?5J@n&vz&q#L3?0uiB4Ur-mT7Mo`ol|Mh~e4wioInzeR98~X$Piv7s|9IuGbkFo`u$>V#ym~IiqOJN^p@)D3Xo;yUuUJwf69PLpG-aH{` zKl(qTv3PA`p&26fZh;P7?AmQ1Z=yKxE4$&Afs_ceZ)1xn_QG?s?BOyOAiymyeBe%~5a-U$W{yAO6)NzkL2bj{IWB z8r;eJ_Rp=}g#EZ{k@rn!8nehD#{H{*%G~plnzp)=b=5QX%^c2qeWRBk=eMA2uUV3w zJ$yuZuxmtm=GR7~kGnFEo{<|!9~%y&r%er{r#1xAvzH8q|8V#ZPapTt@brxD58tsa zb4}NQAE2r9t{-Ok`UC|Mt66)N@8He}3mv~9J)Et+;kbRL zKOW6{JuzP$HP-q84yN9oL@Qh7t%=*>WDdH0i;+&;q57sVf9)MrXT7%N_2KUQ)JOx; zC}AbPjolaEF7(F`TVevyHXwCZwwLL~<)&TTqv~a5aE=?m95;YDZUA%K0Oq(OFvlH% zIqnF|aYtZ|I~;S|;h5tN#~gP!=D7Y`)N&7IxXigb!{t5RJx<-H556lcKk-D`sHPskc|$bl%`46@?2fw@rla8{)M zM#tzNYY^NN4l#KTG5t5$8tznlk9ypVMtJf$o>!vyN5!ebUuy7wr~P<-_TkKSi}q9N z5Et6=#Z$9J*Pe{-#$_U_kw{?N_&p9tL#i37iMf6Zg>1&_asvsCAjHBc1sv2(fUgfX8S( zvFN7*2Xe535Q}~euwT#N=L1U_5({T7aLR?)L5M}a5qON&6N`Q;u*}c+Q_CFwE#MSAuO^nT z?*fm}dScPXp{>e1pIG#~FG%M3#G=0tSkgu;dagA{+PJ1E?TT19TsswxeP4n0Fz+iU zCg&0)5W=-hxkqjSaEiX4jaY1!0gusoV$oLs%Y78YqOS#(ds(LgXXz8!Y(qbndVLLS z9`%>0^srA&xx&R_vlaR=T2Czcc3?>ZvFPuhK3mx#7JWDM1ximW`t`tBdM%9SHMw7C z6L3nZ;u8y>^VTt1Pb~WTfh9e}qCW{N_vXC}oTc;o8u^9FKC$rMHaG+I2}6cme6B?r z%-e9A0$w=UX0F!syZk_^v7*yICokXR^t0+iD`#8xv12*=%8&DM(leHP)WXi0D?T*p zuKBntL3v27s~_N&3pKlS-ZVMTYLF9mKZ`+(-?JPPbHjv0p;w3G-Uj_@Kbc;id5=T? zbx0yL58y@rMp@n|j_%1m9itHByS|NTvh8sz8ni6>vB@ljvHx*cf=K^surV2aY&cL0a`VoA9jqX?YGFXsnHm#@g8EzhrIf%Ul~v4Q!pvwXuZ%&9yQA zpj~HM8;g?_FW>3jQS-Pq7WcolHZ}&eI0m&i2DLZ_wU~mnv6PjW;S{WmrC@DrbUbPZ zYh$CaHZ~e-W0#hk$J*Gh{;}Yp-iAB&9u6;?v?Dc~JL0tutJi$*?uUmw_||KaZ~FK9 zuiW&F%&Tua@Mz)Q>(jse$?tv=y&;l5@A}s-%)I}fZ~V@bZGXRU%Qu(5`0K!n>)-q1 zxRD=?{QOtHbo;^I{ry)STKbJ0kMCZ6@1-@Dk9%;E^~YC2W4>|nnWxIfKlks~ytVsR z8Fh2EzIyXLlYcw-H3NUF|KsR{eKTzK+lO)2Z<&MN=(=HGX&8g%VLzd4*f zWAB>}xCo zF6E}Xvwk@Lr@#I1YaMe-yy3rf;iZF@%-+bnGJHGy_6JPnl|sx8m01AYm}U;De)Bg?e*8HO$ z_rPnA7dmT@(_mB96wiMRQl~ zEc#MlSzoLqhk+o(!l?lk4%h8ut%z7SjnwNk5@ONEQO`yMAr}4L)*$U7u^z*Z)C;kc z&y&Ei_V%|mNL5x`ca-Pkh^4Ilwg#!n=dXPYa@fT~&b0=KIrI6hL57NB)))I-|Dri# zowA=bNHWg025DRPzr6;@q`Pa4?iwT`bM*tSL6Uc_JJQa!2FdW}Sc9~q7;p^|z60K} zR)pK}_~{R58Rl9g#~UI%zfpb3}3) z;jX_mNbefo9&pcRjqfp#WR34^YmiUF-ubLSJ_CFGtwDO%NS{Oo`%9m9jdVZCS<-j5 zHAsGYb3f83!m_1!*B0-_-0pnV7JmpH$IBuDe+>mOqO)Zf3T>Fi{9#>DylbDAg16uH zQ9H5cU4uLUo{SI4B#)bS4f1+vI3z*Do_7tByz^OuJb`jXme08c*$sOGtU-p{70A@o zbKQ$qlp~CDKlgPfGROSM8e}qEf5mUoD`$mi;XO8`;;?_?tyni2gnnRJPAUD|n(XPn zV;`wiH~yk}&bX2j6Y*IcRq$o|5J^Q9%n}EFSw9s1a+Bt%>Wn^08cJcX?k8|gg8xiQX; z7JlCiA8yl)Us^SvX;fJ4<$1@V9QB^))YNmg`%Xm0`2N=J)wePKjCOBS&!6A;Z$uq< z+kQQCBDx9Lbw&Kw-uC|vc{s1OzhIHu@SXO~mOoJ2m!sp{ZU1k5zWOlnU(n}w=<4~i z8~zlu18=*ZEsY+(|F5 z$Me@UD>{FG!2s`!A6+3&28iZ!jwX~{m|bAqfR8bz)=im~s+@n#!zJsW(dIZ_N;ceV zp|S1+`#V*nupjopH`YJNK9|!^-Di<(e>;SHC0_Snk3XJ$)lAM`xITQpc8{>#3C?jr zHOB~Yu2BB!?2y6%gcezQqH2uR^GEcIC!i-8#G(gup6w(Sy=_NDV~au)ZOd^R5nd#7=6u{_VbYFMNB#Wet*vJ~40m2ZJ)gqG5Z5^> z&*<;uQ=i@y0G8SL$Wf5YesD8Rjvp8Sr5_v$-T9pVSsz{=>qbP*y_=yhc@yAf8xj%T zSD|2?mue5bccl`Tx4}}+jm?Mm_n7u-;O@^J`$5y*6vG~ymDu~OwwH%rN+UM8wnjJO z;>O2T`J01{@+EBZY@~L=`wE=IBEJ-%f5k5aZq!G+c$3%PSpO;VjBmlP-Y6^=ir6~= zti5dgSa_V${;U_~*N^SG!cd9o$JPE^{eFov$vyXY=cRO&9vSQNPWL}p+vn^8J-@k4^O+ns+kh5tGKcDhWZ<#H{4h|({;~^*4{X2 z7D!X-EWDy6R{-xs)jF>B5{9GG>T7Sjp}sC$HYGaEDxXwS8Lh3q;l@a`zPzkF)?HB+ z>#nPfao_0ipHb)7s|iOUld31y*Gw*-RwRK$d1EzFS{AFXC)B9`HSdwmD+C@AdT11t9Zdlcm5_V0nnCl3_)03HQ}XL^*? zpqkE%p{%Cg6qVJWCeLJ--&8w2npc2(485gc`{d^r$LOmkO{=TFv8Ha)4Jfq8v~YbS zS{JRoVG{L|%B{)Knf1{b<(1*;iP8F+X_K9>F&>f1vv|Vn*}Q8J=YWRkDRp{Aj01YA z7|-FYa@((QhOa-DziGZ^a(zv>c3KpHP+E1->ImAPsVu+ohML;wv}tUbwY4|a)=#Ue zRUmTH4L8iRs&A}!4(VuhUG0rEIHo7pGY%Z8_0w*uskyPX4yy8Lx%JcWS$2)`a;+M0 z%4=uV)ZJKLK4lUDo0|Wxx^s__vns>*97U@yVISW zS!QNwi-lP%E#)FsXr&4iv_%#LEEk2uH9?}-KN?fe2x%&kh^CS%plA@PK}A4ALrsuS zCC2AD@AtlQy4L!)Cwpdp&wI{yzV}?d`;E>t>&059SszTa@HwyTEfIEYmM&3;8wYSinMQoGuycdF(8V(zd`MJWsU+n5y=#AdZvt6o&(q<*?e-TT&Q z4^`@&kzz@VaTCGNf`43on-wW(xKbJIj8TOZB)tFtkoK& zVNzwps!!J1W0^*xt}Q%vlS(ZXW_oXT2LZ*yA}s3DfMl zDX+uw9c6ml$L}^cJi+n^&Q38+(>Z}a?n%4~KZXOn5}Nmw$$6e0{~hFY&{{sJm#tS`=Q?tE%!b4B)$hu z1)9g9d>4wQFM@xU1^PDlb5o$-fj@laPxD^^&2Rjuei8oc3-mDbAE4*P{_cf8y!TP{ zQs`3&H9}J-3L7{*0bOrzrCUDeJ%XE9C}Wi{wMfz1GM_nhUPK3w%1SK z&m+)$+>zzypq~xWzXLvqsMF5_zXy4A`rF~p>Cig;KTu9T^n$p&f5M-&(DP$`G4wX* z(_;M#`14I@?Vt0Z`F(S(|8DTlgY*U9KO$=V?twpVL(h)On+AO%%HTN!)`!oQ&kpn< z*gpi#G0*hB!Jl)XwLM$VgF*hMz!xB@KUpx}*{k|t%=>0&tq;!;e*;?ki{Jcy3|i}V z82;>s{$M=+E1_Qt^1n(ud{F;h1LNH>=3f=O1X0fK^d$CR+U0>>0zCq){!GH3tDqOh z^P35MAN0Ag-U|PI3@zu!dJ=EKpSPiPJdHz7#~9P){{W^t8CvV}JLEkb`h9VE=R+5u zwSK$dPa9hMYXLOh@2lzez@KfX`3rPUT;5#hL(us16b27Bf z?IQ{<_{E47-e(c+PpeNzadC>Ut`Da3xA#{4)TT_G9 z@%|?Kxe!{*8;4#Kq(29L)(6w~Lthi*e**K_1dTsGzcLEC0fOf;>F>kv@3tWSTXD~g_dp-)S^ZOzEdm_;1KtBzw<(~`xo`Kf( zy&DNH2KqSYKSOJKT?hXT2Kp8F^LJ?NzcJ{41=If&{+x)3wfsEv9BA$To$zM?wED|! z%Tj101^OBIGZyGR=u4n=eq48739bGtguXt| z_rjm;(Aq!T7Ty(TF53?T`f~X9P@rFcKf9o{{#EG5pmllO1Aq1fdI|Jz13d|U{tAs- zoqYXgLi2m!I{jAogV!;eK63x0XUe@NCrr^N`ESLcXn$V}uM1Tv;=p~5eiisn&34oG zgHr1?A+lbx;krt%36a&#b^7f4@q<8C`$Djmc?Q$ahG?b)S@WC)=DR{^C#(G&u)Zsl zto9UG-xW$$doOr)+(=}#_kqtwyD|(Qsy{>Er5t>5a2%Kj^uuvbAaF9r4o2|fia!W! z6UTvt;Md>mM1*;WjvEMsQxP3ABFsm0>{tZW-Ekv^!1}t`9{qJf$HEYjh>jZ)gbbqN zMg)QNa@@coEJt*lAwnOb$HWAAiSQldvxRq%mkQrU<^Vx>0MT&+jxdSn*pLVhBD#nq-x6~iI0!ot zT|7{Bk=fV?yAfU1qyLteiw_(gr#&zBz2siuC&>ljr^w5M_mMv;yq~;W_*wFK!q1aG zCj0{VeBlG+KH-C$YtR}SUHRN&Oaq^|Y zmytgqyn(z{_-gWH!W+r!gt?#X)(dYTUoPzLDcT@>3+-13Zzo?VJVCxn_zv>b!aK;H z6uysqjqn5HPYF+wHwr&U{mJheD2VlY_r`A%0e3{klsxZN^8t_07Myb%AgE#lLI(n}3ga>+Lb_ zWmvmm-P)@-o{!Ri&7%*;0HfKI? z*I{bDcsI0EF2$g zfwL@QdYney1Htm*UH=5nFMr@f7~;S*#*^az$=Lpz_a6QJFz(JWzlLR;Nf0!Rhj*w~ wyeEcp9LN{%g8ST>?^5Oq?hj*sFle!w?+362&5+oR3_DN{rhg5QZ7~b+-;g)kxBvhE literal 1032206 zcmeFa2V4``|L=W<5UK(iu@?kIL`5a`N)hb6R}3KtN|Rz=7Yv}HVu_%uuDz{YW7&0A zR}oNAv13`+-h1!me$GrLnVAIlzxV%p?sK2#-n@RZ=6t`Wm-qS1nF+t@tyJ;qh&B%O z-Nc^;f*|)@_+K|S-^L9aG-2ZmcOXPIn2@lm|C#GmCL#ZDG0jVp|MoS=i7@|(YvKmN z@YfvF>wojhs`^^;zvSw?x7`r>+V8hzystoA-b2YQ2M47k5p}C)WSwTGx$O|EI3EzQp=pUh=hnLpX>VY`YYeY9<|G(;5H-*^$({((6*ju_jWfJ@U=H(FTKt$K{F~s3Nb*=A29KLs5 zzDykG^#WxIE=Su!V!ZmTB#zQ+d?s;}UMW_@vAAnm3*uPZwW2g}{J+=#ulk^5)qdo^ zbhXJLCI9If`jC|5FHH+l^8dtZ!xU2TpRUuLNJ&fAivm)zn9HeDX<~MHjU-OryLvhi zr+;%rc@if}*VwAW>7T9*ONrC}%a?PbU}ARl*+QJ@rLJhY#<&w_{+hFhIP+I_W^||~ zEHNq}M5RdxiHwO%Btk=YyhbB3j7zi-iyF;hCTJ2zX~u_WV$`Ax4CXM6*i5r1CWXKy zOcfcEsELnJMX?n}De>duOm!DIkxJyGEoChs8g;0sa-3BiDy|!6MKvtN4G(ST+sv}V zk~tP4PuRhR5)qS0+BUsaT(I<%)? zv``GqJtRgItqBVWQzfdzb(A-yF=53PG&VjmQDZ)q zoY`zNIdi;fY)EKQc(_I|>uHrZui0R6X7hgL?6Hwy;_7l{^jR#b77-m18K#Lzj0}&o zT$=gZ;?kSVF3xN|zc@QuIsyY>X+m)kk`lw4ea9V#iI}Jgjl#6EFeeRFQZ@dLmzxR2 zOlmHJ?>b}EiI{4ZN>50Pjkh?{LRATxCXFcKW5Z0_gux0LS+JV(0K+XN5;cfc4mFI3 z7tBg(NQgj>jWUirHK}9c#)}LIV^wh?Llm|ck%6u*^oq!aIA*q}1QWJtQAi`i7h9po z38p@vhIoz2Y(h|bbW#)=EG|084ko-u$k68Z40fVD%7;I@-|ByB#oDl6l#{1cBHf) zXgo_cX&H22r15CKn#Du^OXF$Ap|4?2hz%Ey>FJ9vKxC60eF0i#6?2)Na8P z8G|v66(_g6e$;eEG~Dcy%rx3Zm>%YR z#4bM59&c<0=8bve=qS@pYm6Bk81F4ye3M6O-EE?>c^E7l_a?}p~E9|nr$jV zr{!`nsAgqJrv=RgOVuo%bgt2O7FIcH##UjLo}J!iR;r!Y^<`o4aU~f1X6ujl(j{my z+u{qf)MQ!_OWi~5lw43W(VCFrXCPl4V_b`MvfPPiqADgfCQ^;tKX%S>qaQDsc6<@V zO-tU7f7#iCc&2=d%j_SfFyv zc8hi8JeF$9diY@#jw@R^fmc#()*~HdQ<`GO(iFw=pqcy@dL=S0LK82((^hk~$e8e0 z%xvs`iR0r;yO)_)BKFPvV^mQ|8o`|Ba~G%%LmF}abMeskg00mM5yp@>P?pLBaL}xB z(g8DO6%uLM@(g)l4;S2D8I1hs2^J-nhjbcpR_UN|R!-`PmL%uk1c@bw=*Z7d7j{tj z!Pks4DHx&Ou!NzG%=}>*TD`=`*ch`xNJxr{i;Yjz2$~6Tr-{Z5j%jWthOnYKT9shB zb5-M}8@G-jQX^F_-;a$`G-1|kF7!AfL^E1wH)a$iXpf;LktW%TdKhC`5*YBC?)O7L zDU-Z5xzKkZ>?9Rc0KE_gRD??_#@S=T!$s33F(e{dWjcYSm7>zPSk+^4nn@m3cSa>j zwJIz$SAl{>3*r;#xp3Slbwb0CF%26-kQ z(~-s@reFg$<&qQ{6)EUyV=m@)-0*-sc%CKLXK6m-$pr&yfJYc`nMM#+^Ul$z!y@QS zPe@p-F(zxn@lZ&dxB^_<*yy+EzYe-xyJ>(3JjgMBD#F0kLMPLamXf{EXIGHjqGgJ7}LsL=vA`{GQT)l+% z45mhNt5N)P(B$QYo_n$*Du&CFO>DtS2Zr^r(L@QUi_6urk4+}t(r9&zIU2@9xJPha zE>rWA^aR~9sxVvFgJ+y6juB65qbDg;>JT1I(uyHWPx^~1fpd#`fZYQv6iMy;)S~x9 zW{C_=OLmcs?Luk2x$co#4IO}kdD;o0TyTt!J5Q0x@;c{6Bq~;LkirXi@rp92dhvWW z7-=6S#3scHZVC8I47d8xs+c5!mgl`AREanrF;$ZqJ?RSZ$3$)q7&$o zMJPe;E}K3riP1n<#E%LI9gjE6jG5DzA`gu!Oe%_5%nXQ%j>UU?+--w+rHMSE>T{mR zXv#1?sc=DZevWa)`>Box-*IDNC>>c)2_F_o9|;KRPAe!8&9v#3>uj`3Y78;+o%$xw z2dl-l#;kZOD1lHCo)5Dg!Pzdm90lSSVRe*Hgu)=!y3`C+vI_wI-gvO{ivB6N`hJNC8FpNFXlz)+SD*Ob0s>r?Fpo zJN-8lXM$W>Gk4r5nx&c9kg6Cj&f{@=R$QWDy!_J;3#DQ9ey0)waPWi~P#-)%@UqsyYvq?!a}@VEbF85xcRSUYX1c^cZ!79Cuz zLa-byClWd!>TvI3j3-{t5PS68jxIqgE*ep?ZUqqpXV7uHIZ>mE4~rdZ8lQ2(J4Ixg zgq@QU&h#;C!zRXh;QYIICtXkCluE&Ho23*u%~LjM^qn$=PP~cHP}zX$CBYs{-+^GQ z;(p_;60Km2EztxcujOHjz-zpjNe#bhS7HzVT>QoW;_;}l=T{m!j6wyL$)+F1|3zJ zoa&OuP&_$FV9ka*1Vf4J51Ax(VbHWXX~oTAo7`+7Q)}2D-*`5_-rK7}>3I?DG&aa> zV#c6h0vN-Ffj5Q?cTdK!ntLK-%8wfGa7bWaZ&GLidarLPorYLwn`%H!hK*5d6x7O? zOi(jHI*CBIA(>e$ zft}4ul`uX!T7$WxHtxYRxxmct*3`_-j`*aw#7Oq1B$#{As&OH)aonU6d+E#+dfDD! z>q9*dV8(QUIhwo zGF3y^PGJmTDaFMx<-%24nBL?wR^GDPya~dh%`+ByEoLo@VCrOpp66eDGA%5F!!Uyk zYL@n-!GVKrO*~~PPMoRP7&g2wA&6>L8cN}l8FCXWVS`1mR1FqhX9{u_&Tkd{O^q-P zYbY*;ph3cTQnRsD?8_?Ls$+kdT^UYn-B3N%4j(jXc%MrMnq3B*?6Dx)1Fn5M=-rYS_5sL*3n zBD87jO%Q!=6Gv`>Fe|bI;V>wDy!XjIlct5n;mv#;u;M@rKXCmo#QR>H_*lGS@SQx8 z66hPJ-!F&8`CcAznt#rN#`#_zhSi&pgdc;l@z~xlfrbs577y<=^%X`%ln#e4h7wJ2 z`8pUa#@=Bq+>ABl!p=2QkPZ!$5k0VB6`5$L*;UAMML3IC2Ul@3GmjlJhZwYGZZU4n z+;rt~*s2-mN*6Ovlt>I|14sGP>@?-xgDk#<{6wLH zVS0)wNNU(5EMzLFtRRi~_=qcNsSW(#(QMcQT1zUO4h7`}eypd8#QRY6wJxZccur2y z8CAU3fCYMd8HWXCq=v+9q>IGPY6yegWGAu2Z`kR-6T_%NzLVT2M!`4h^yrq0ZcbSqJNLHhT0t_*P zi}Jg92qc{4cwzz-Um{)M261aSBY|kO96_MvEJrAI%CPrZbmHMuz*3j8e$yT*$(>7W zytB6CExzt-;^J%0x{Iy1XtT7?wXFX;Ln%yO{6GqG`G;7h9kaOF&=~y2SzH{`{`vhF zmWGP0Z1Mfcx;cy#o4VNUriT{anI*>4kYZC~h6exz}VpDxBSif^Kzkncw-ww;0_ z4PJ>^8VJ*Q$akg~-Im2S3zGH0Ye>Ugj3uu?Pg-)D<)VgJRlo0v-t~#G1KjZ)O%h95-fSnB!*A4RhAa&M!QngHCnx zVKc4~^9l*phGnOPS{bvmP%}Y(#ds}MTQKE?ttn;}vSz~)FpJL3eKWJ!q!-4Z577Q; zTC)%AxHoI4%#bE8W?Iu!<}yZ_*z&xkX^Web7JwwoRNxkp2(R_BPb}D51HAK0rydpm zc^brX8t?j!WboS{R=#P&55$GW$XwpAlO?QjEFH_}qlX zgqx!Xt&Yfpo09~*!U5!RA|y7Bd%Km*7pn+ABcWqK)5Rslqhg~4>Df8J8Tq;i z-xm@*7BiVe&&5n;F*!_j_CCV&{tSPH6k>`YeZ|J)kt}eNL$ZF24r31+E!exIe-zHN zTujmFY~xlCj>kl1$^`Z--q=BiYgjkZxSUy(+z?YO;5u8r@R1`mfN;1`W`9sDN>8VW z#UC2eMARvHwS+g*(=B0*jW0qA=OK-3`4w@2NBZtGb#dF3r~vwYHO{<6Hblj5%VJfU zIOFNFuuh!Y^xIKhzX;=SUP~T9<~&G*38k4^io<1Y$%E8*zJ-UW_-Pz{RYdrH0ep1f z2>sGlvp(Z*VrdSd7+kq#W`0ug(I-qqUyd|p%)TjU zUR(OgV`J0%2wc!YtEdC7Mq11O?^_Csp|4+Bj7Q&@GAJ;{PpIG(5TQ%* z_LjLTBwYB{6L~+klEXFZuh$5vFa5uh5d6PMSo+$ySu=xqxI-vrES_Z2AA5-n%gg*s<-$&zhLj1KG-blqT`}3v*qs8#P zIC6{PZQN@F{Obzr>kGWg_>xLeVx%!X-GRAB62@po3;X2Bf|)y4vE+z~#0<9J5Z}xg z8(=D&-g{U`N42;GGo-2oD;1X(%vfs{tO=H)QcZ-X*D-i(k-l;U!0_1WpnGl6MwG<8S@N;kH&zREcY>1tj6cPOEV)(a&+NFpz?7%E4$~aFa70?s8Ic%IHOUyTe3#*p+B=Sn=56GDnL2B|VsT|Z(zDG`oE=^AM*x}!4c0@5P&1$}Xd4H{Y+Bca;-Z%ZB zw?tRYmQj?QN_73EGK$IXoNs7VQ}VNem*y`B&ek5bC9+@}lxag`-JFR2@GIhO(>gQ9 zCe%rPIG>p--#%NJ-=FA%4-tLNU81m+GeZu#WoZxH9^qrC{tDlC^3$kkJgi&;IB26(16fzl6*cCEbPbZ@FkQ1#}+BdB` z`Y-=3qgxxyrTW5t(d(iYte#=3)uc^Z|K83IoX%#Zi`Wq|CYIZmdrEl ztE^VuS8XlS*eB?l^5kx!3_eL3&i-w-hx;AIC2v4p<)ezX@0@kn7@-AI$qnRtV~R?< zXu+cFiVOI@kRg9sjxxUxebG2G!1ktX>)EB8nrG^R%QDKtXNbQ2SfZ25t!PUJoTz-- zCr$0*#4tfqk|RfZc$O;dQ6r_ahx^>p9&XhY9zG3A`A+vq-H_UWT?IOOf07c!&uWjA z)}#Yjnbs+tw|GxyZny`P4t9|1T!TrsET60rL4AVCcO24j&ViY^=W-Vw(WRv_SB}_s zP`Rr8Y?wVZn2G5&WRDg8onmF|-96}KomNKpUf(f|aaE+tnesh#W6=X;&;w1*v|-uYBN|+0|#a zp1ttkTzM(EdQKiuq`&{B_AAf0_|G}m!~fJlm!LU$9fFSJbwDqfR&b{@t=qxUGW3nM zhJR^UZKkxg_Q6tpRa26=_3oL|>3|Q`JaOBQswTTJXRxAO))K|QvP9Q6n5@iFq@|WJ z^%Qf%GmZ8fCBnRRRvk@LVEUSD|4-*$WpsMs%HwMb3XT-!pUExCxqM*Q)zB;9mq%WV zDcX@N^P+P*h+_?9&f%IwmfIM;3|oF*B0HoZ+Cxdi-4<)kdZmp%6l*``HBmmzMw~Rn z%_6eHYY=xA36R~Cxm#m4+9+?SiC#S)G4hb(d2%UJcK8m_=Dh*O@@Ct2*DdoRh$p`^ zOKJOtQQjU#^kIh>{rxe>_YJAszDxTuowYvg8U698#`&T=k!74i`a@+IBjNg#_fy&G zj}R#uz&Cbrx zs<^1^{QUXz17`YbYvKPy%P-YWd2~0?ogYQ?NBe_dkBPF=e4-mP3sn1rvZ9Et&l95i zON+8}Z}Qse-sZQ>u;p{Cn3bKCpS@@S&C||byGl-G1}q6Ae)IkGT{MjHgr4XROl9=# z&Y^a;jI3^ZM(Z(^(bhZ6WH>oEXEO3bTOEjYog>lb*JqS@ z9T|PzCPtq-hv-kH6TRPgMp<}=**8=7?whmX(s1kpPl@j9b7w_J3|7>l1xo@I=WY|- zc<}gg7||DuU=)8nBf7EZ30iL_MbgQ(wC>ppQ0t{-vx4U@37j9GUE@UT{E45w@B-1j zd+n?|nZ_uJVu`XN=z8ut$*|XrDQK%pI!0SQCZEk=(NDBD(emuz`LZ?kg!br?K$igG zrwmFWyJqS0_b}DL`OA#5U42F$xC?!p%4EoMvS#`#&d+8VXX=WQF-!Jf{bizWGi);C z0a-cOcK$h8G%sb>)!3nIt@MY^5`E|0#2x$6I%0Dw{*33jd47tom=__@L_z1pr5TJa z>5H@OnwlssKO(xzGa1EOjDOK6qPy^zC|-YZc5up&JJ>i_>#Z?Yo%BTMbcnd?bbV)` zol!)A5vDz(`-a~6hW4S2`t+3~ds*3KJLW0QYZ(RRQii=^LP6UM2gQfOZ8PM$vAJy( zm1<(AQ_7n$!HaSh1^=YC|CQ`tnCv$*pmLyfK)_;|*I`EA1uG8ozo|85xV1IW)`K$G zgt1=hOtdu}h-?GKyFS7-5Uyp9@yF#OBeJztM7G8bbHWk5xo@Vj<67(*n;2#AZl-F% zu;adkx-oB^6}{6LUAc6qiw=Q$**Ua{DgwRTYofQxCCZ>pq~0uLP!QvNO6Mv^E8aNk z`lm7O@-ppjr05-TiQfJ-QKcvycM_$;YNE`$MrtDd9me~Nu5237m60>Lv2UDJDLvZX zm~tao>5P1x5wFBKqIaB+9k39WC+bwh_@2}CqgaYnmz%`oID~?0IaW8F zltEjG?i%Lv#dM-92xIj5{TOBLG*UZLciEcJ4NN1-!{J09)Cawm&*=JRFbAhpPuBIa zK|bdhkK{PAD)~9%kcXr_O(q^`+sLZ4Im9FVIn!kiKP1pP|tX%8`y8c+b>|Q|m zTrtbq-_E!fXz5;X5)`3(K_b5w=-wUX2soea1=$ON=coE%FYt6Al-tUqJHex9>;?T8 zT|evv1yjKj@CAE;4*L!zg>Eq2cT9T$-B~D8`Mn@}ez0IKNcAh@r|ha>^z2@+08E$c z1$E8$0xk9e8Rfwi@L?;r7wG9;(0(7%FGs7giT(s;Y~ck)?{|k$yb;`4&9=0?ayMdiQc7t_JWG3AWx}7Jwx6iQ~Ol5R^V#tbF zigQn}7bvh7DCk~b!?%3VPuK;r7G=|xYuDKmmjId%)pPp8V@bnV%KU7m=1hJ5Wkw(L zC-&}HOonw1`n~n6>Y2L!nT+yyHle$L?%Zr9!xlS%b>PG)O7)|=fbzr}mK6HV z*@m4U20MWb-3caRR$Lp!?F0j{Yhx!+^uw%RcLJzhwkWyaqo|P1@j0!FcCel$Qye`9(Dq{Tj&e)Q>c3jwl9z~iuq~e zMoN!BWyU$&gQ$}A+MPr{{WVcePX*nMv-`mtx*zmSWA_6E81F8x++IHeb(@h(RLQCo zeFoyr2Iqsm;=02qgU-_(p&WJu5Koc##yLQa9YL$lJV%tXQ?Y}rU7*ZFeB4p?gF-dk{VsdxZ^IDOdbt&B$`?5F0&+y+NBR1N-$SKcmiD(K~;V zn>PBuX}AXtuvIKfW!xPCO5C){vA^l0&#lQQ^A8c-0PF{s(ulHMAllfN(H}jBJGz6( ziecCzf>W{H&SS>fGP+@@#6Lw>G@Vfluw|6(`w{;sigQyLkJRTNyc^>Iy01z*g*lwY zw8(FBq+5Z{ah29%3V1)o1v|oW>P&>?@etoU7hSe)Wngbbncd_$m)!H zM}PTR+#jt>mmQX4d~8VT*&fMvNt%t^CJpy(Ye}!PqBM8-jr-dT|KLuzr{cp0t^KY2 zE2TNAT^tFsoaU{twr6B{7+p%p{M#7i*F<(Cm1vL5$M~+s{=XBWPR~*FH`fs5t$f66 zhgf|uSHh4Yk*u_%_tPtF0_34K%KLWA(AoO?yAi`0Y0HqFvt;=-kfsstWd6>iclM`e zDZ_gcSf;`g;1$FP1R*)tOMoaVMBu(Bp(}Uy@Iog>< zq6lr5pjDL)+Ous6df6ki&zU{}19uE`A2e@})!>(%t79LpFgpF}$}4Lx7hEhXI&-e* z%;i&83vV93Tk!D6)BL@&;k8xl-( ziEl|jkV2kTszLeP#u|7|V}foDiXW8Tv1~`Zd_L};ad#?M`fczFSyk~8h z;XAWQ>X*uDVn=!fDer6|%nil)kBrW>B2ff?_@*oRz}VQQ+bjBiWRwrl*O8Zq{=owh z+V^GO^x(4X(;Y@nsh**;jk8l09VXuAe2SV}Y;jp%P(b=!>2DpkZ zH_VUU&|l}#Uukl=joKxPG_Y%A7Z7yDcv7KukrS`-b?pYF)BcsU=Ta0AxeZODc1b6E z?b00-9X@~3fAb(aiQHQ4vYNQL^a^4Qx|R2`)62n1 zvlv}5vMTbqEHNqc_?GFEN{tOvVshG04yAf$=p5z} zrQ>0e)>#&mOSC~?MeuE+4F)SZq!Mihu%i8H5Xp=cLG2I=tOx=tf{SGZMnT)2Wkqle zSOCnQ7K?`_{qkAS2I< zRko>&dQKS5_snS#+J*AMe2jgklYrL2>Nu1OPg)5XJ{?Il#x54mSh8wJES@4K7Ar7*J&NcGdp^?_nFtnYT(O`p`Ffj3h2C} zvwN2y^pS#L{_yZA72r`fCBVabZh(hZ^*|5LhJhY6`~yAQdj@*AsRBKGM*G9>55K>M z*9w0R&+YyjX5BBRupw5aGt+4$xTgvH_^6Xh5-=D&EhoH<>D;sgEG0^iJ@(LX)9uL~ zgmp7Z5PMBiSQPg5q(WDnqkMEz955*y97s&QZcrtn$Qns>)^a;VVkJWJ4NYebG_^qt z8ynIsZLM)mcz7}`JiKsuV)Nq{DTVvNWS$eUSc@7&EU7a

imQB+%B!64O?3Cy$KI;lRJ)U-nL2{e ztm$6^p2auCyNFiR^D3v+QI+?HH_~sN_T#JLYY!ecaq2b>g>luwsyw6FEZ!C$b z=$@m;9$8y}aW}O0t7Dsg`Qy4T>qCc1ovn#G5QkUlLc5M0Yh3lH+Eh2GeosU6P-o}4 zq}_FoG!(9m?)v&z?p;sSPHEVQc+uat5c4rLp}j|s^}gfYy770gXK!}yM8A8a;c!iK z@7Kq2D&JF^YG?nse)JYKTtWrY7ME8_@8`d)Ye%ypX=T zYhilBjKT!`67SZllbZPA?9;H0RN^}P(*M&E{O&LKZrn8!-<~+?il?tgpK|AvHdlUk z$u*YBe7abx2{iN{TNtJXk57|zj%5dC)8%8Grr!xUd$-$03c<*x;7`F&!7KeO zqOHHc8Zn#Q)KEgg_gHHuq4@ok%GvG|jH)k6++5}Db>Z!l(REZ}5&x_3d-}-At=Re^ z)Vd1$3#eAnim&1ulb%xDmTbma?WWid_l!t*A`sw(_Hd`&J%G2zBm@)Iy{lR-Kl< zR@-gW;|cezx<8@YZAicEP=ddN6+^MJwiCh#6rEHBKOa!{EqP0ITl%89Z|PHNUu^2F zNWB%Q%aFS4DYarmOx{YQRwA_usa41un_7+3YNVns-nSg>Rp7;uJC0m&UG2EH`?Fup zeUyJ4F+s5^r*f25aic*x`|GK32y1vu%?NM)zJu?2#q=Qoq zT>a{dm(y1|msAaH!hi13m914%TYTQuR^{PeWAqVq=IG#l8qSVMzJ9c9Q(OG^@2!v1 z3p=8`>h?0{gT%I6?Z{ifsCY@G<80u$Dq%tYMdr)=E}>l887P&Mk29 zQ0(9`ZpOre69-@M*cDx;+&(4l$}caOF}e%t77k-Yn=m$9D-U<;Q8FN`78EU7R9d2D z7M0Dx$A3E&{dZd|no<1UYjSSsqD4isO2cLn(tm?(cvw<8bJpy#Yp$I$ci#L3*DYLB zUUB^mi*LN?|IqlL!9#`?3>!XT*m{>Sz^5s`dIet-Dk?fp4eRK2r z@%Cnr+%!+?{}a;odG973$4NMN@BAVh<8T~0v*xYU>am2sENQ*|vu_9gwB3%1r?&rN z+m^@+cYIiOL(if$&bajh4_^A{k%o(J>Gi?S7XI_vvRiI$iq?*wa(-m%KZ*{#@crv= z6y5%jy5(OZ=j@;L!3D3CKe+zj4R0OYRCGqhF9+T8%gKNHYU6o-e6jGMk#G0zlDzGv z|IIs#?3WvIh#S{B!fkIK#m78z;tClj;ietqZ3tg60`+HdfNve(+XVP_+TIq|hT*dU z{EPsQwc%=FGiY?*Bf- z#@Fme*GX+d`YAYY`xE*d)iYL~GV+Ws@8=rAY6Rd%2#Y7m7b;8>G z+XMVgAO8*f<#Sx|Z?CU^aHeo9-zmU%4)CW2_|pP>s(w#|#j{Uw?TN``Eb;#DHd{V1 z*P@v0^M|rKEYD{;+(*QhtnVL}K~Ca5UhYS~Tyt2z8Q-QI@Whh)zL6fn(E(3}xW@r$ zC_WKA^;gUP6tWJmDEH*w(R>H}Y>)aR`ty=T=0yJL0RKXO=QFENx)BolpE+glCOAmz zWO!I~m>lYD#$c&?61NA$x4F--&%YGQhXbJ7aY$LjqR;Bdz8ZX9C$SZ@V%_X%x=tB@>tuc1Dj0uhURA#etR2f7|d z3g+aHZpI;dNDzyDC2-1FIDuB+kawy%uBL=>0jZLG!6@hvTgzzCThEK7#AW)AKjO`p( z7#G@+dT_2M{@nKcGZOjRM@a0Q9I&?w_SQg&_Snv1@8f{I3?%+kjNw!4y&teQ@ie8T zBc1lx&SDQ?i1BYL?7ah-kl5qzXMg-2hrM1%q`eL{jrEp&lCyzH)%g8^DTgkx>O3y6 z^$`1;pvT|vLewE0#6c`c@4yk3DMX)0pW^WAeG9z>I>nsC9{nQDvT3v7e2K;UU>c8O z_7fkPUWT5Z#NPc7;<|E+qTXA;m5J_Hu557r-yL(-|zKMgTh#zx!!u=e=>0Yi`N?-g1QLtfAD-^ z^k=+^p`MFB(YZn?7t4)2cM6F>AVKyI+%wSC8u3`gFA=G^!npp2a)WoK4ydOe}5e;zy-(h z4-a!ReJ{71$T#3uk+~(SwE+ui1^g zEQ;6M@4GuZzRI_2zz2=FVXQ#^Dpo}I?xJ@cbvvF%$XqFH@7rLitmK|vxek8+X$kIV zC*~&v_dD^gJAZK3k)3aEzxury@63Grnm6Yi!8+}?ZCllQ)z+2WHYBU1JIX4e?XZgf zk~S)I^d@z0K{U6MT3P!;=bV3SQ#n=FI9(Epr*FZYC)3+R6W1h0kF0V+Z>+*|h6nMS z;kS6s@LN1*cu<87w{g1N`g=TGco0t){)(pyS2~yzgSG7+^R4=xQ#H|9S}?`EyN@R) zRjbrrDxx*;0HqAVZZli8AKV?AWp;x-V-ugtU|W}qPn4<4t-4M5OK>j9NkqwoeX;g@ z=(bL(IAy=;GOT#|B+Sry3A+IN9`lI)ikU|LQt^9lQ_J?=g}Go4VlLQk)yBlZNgpQV z{2B8r{=5g8mq6=E6~FshVfn9#dObm%S@}&wzaw?a#oogMKMvtKM_#UW{K?Td_9-ddq^{%CthL z^9AZ^-_s(jXg{>*j_SnFs@qiPj0;rN(8e}TU-7A|vosU7aqnqI9uJhRH%X`$z+hEYkEe0k-Js}5c@cjF)dU7{)uPR=W$bOZOc);24 zmx@6#7MFgo1LM;+wBD-f%Tu27wO(Ao?U*aKaaj7xycE z;{Kw##XqI)i+=!DK3Y({rS4M?sBX?3>OSY6s!f#_pDqR6Havh9L><4y_1;n~uop!9 z=GMypoYWcBZNo@BfxXVDa--g+%EP@{-RsJG#ymOW6EiO=-j3=^hc7KyIxMvK=*bI* z4Juu>r8T0S_yuaHP&=oz_KMmrL;g`SBWeHojktnyFpID;Zs?%U*9%o+{0sS^$`!{N zAIIFv*%CtSZhaQ*kiHC%u(4f9@im*Q%#Q1>Qwi~Am}R)bc12(9)q zJZk6Mr_OM?Iq#swK2xDP`>07(V!#mMccML)|hZ-{s&iGU8}EYT$?lg zUtOD+8(VOOT2{~wd%9$(Wy1!lu8BFbG55A$G$MJGS~h%+iZ8fXar7;$>zce1^F80H z#cZgVNzNFIGwFNc3(kZ##;su&B7b}2--%JUuy)z7F|aUIy;d7P45QWXTU1xfvxA-F zsdXHC)AwcD@oBMdd`iE~`CwtehXrwyZl9z_49pzTBgUH;Jq`lDj?v?F^!fMD-`_*u zjzh%aK11XX!T5Gg2-ib5JaxDaD}!{y;uZHfXW$yC#&v-aChlFQTl_81dj%sAuM3PY z>Rsqz6mp)$*j}urqF2`*i$2j&wXgZ1W8=q_DjmHiQFRNC#M9$R82!CgINq2u<+x)G zN1PMRk*>sdx&DRY_PtSg__r?9uAOSazsb>6ZB*?@xqj03<>793s5PFQV`h1@w!O;3 zf8L?CZB^Gj%N}f_>e@QnMfW{-4B4Vq79A+3J?Dd#V&{DDpGWSNwmNQOu>af`f36@e z@pm?)*HVw4(&r>?i@TH17X5ozx(5%x{l<#Hp}7P5jk@U5 z7pEl6Ke+mDd>yGps^5`zwC{i)f4}~RBm4Hx|NY!emy|z#$I0&$Y`>?|>dRi8anFap z?)k?aCtW)_E&TlHYaT6qWBmt>T}vJwx23%N_NQBK81q`tX#CmNzVXRfB^Q2OwRY+J zlKuA`o&VscJw_b;S5Qy*p#$f4YQ5~bpI>y<($V*B82s7n^M4YW+kL>8IfLi#S=Xuf z&-achtZQA;`Sj=GzyI}`-+Z6>^r{|r4o_Qr%i+WMpY=F&;qvgwZ@)A5?8LV^Uw-KW zU%zxTa7PGh*Oh*F^1v>ocRpU$cE;U*7`RKymCvK!Hr)5@`J>i%`@Hjc>dC}6-aG65 znLQgeUM}hNZ=a*~&wp!EkBNUzul+~A`B$#Jck@Ya-v7wgZEA}ioYr;9v$KaB3g^}C zYmf}FpL1S0TyH$DfS3V_L(InLnRYQ4{LCx>@*Qa}WCLfk}t9 zCj9h?-;MpTw4vxvW43*}yW~Urv?x|pb7Sw?`OGtO&I-NW_nGbAEV^dJcgrWt?DX5Z z;@e(cI2scUBa?txYJoRrg3vL-!!(KOheA0Mlq9LV2V=iln;8(!9+=cqvY-v`nk;vk{Pq>qM< zpWhNle=@*(^IA;)iGlnd1@w2hF){jlKhj^``vIOlOL}bm+v@tHOEPvErtS>4Ji}K9 z(p&k`ueW#v%8bL#!pz^@mwt*ZyA^CWm`%d;p00n!eovo1(@zTU^@zTr0n(!Ks<(w_{Z?+NgpKSuvE z*I&bT@Rb+q-^uR$o9VFWsM8hqMJDli0_W^V-(92mH1$MGdS~@c4ByFp&bCPkhcK^~Z%_$<&AIJ{U6mfB?_;ll|#m`gqo7b4BvlQ!{Z zObnf@&O&~+O-CG(zjL7cp+0^u^7ex+r*lx>zn45`hsE+80(?-vV<5d#fbSgOPYv*= z1^Ckgd}@GC3-D(I_%j3iSpoj+0N(}odJM6BIR|W;<@v$ihj_%K>2{ns2W+S1`N8xC zw=E3c)$L1$_r_wwFSYvJk(YDEE)L{hVe{9Z%{XVwXHJ)Qc|d=9fS+hHa185!@juUJ zfc`GRK^m*=pRD=?@(&K^KWo(WnfYao8U^H&aD=WUXK;>zDvZz2T*DBHJPTOnmgNGc za9{@w#DRYwH4Vl&G|$75cP!=ejhtBIlYqtMLh39qI>e&G@k4A9i~J1AsR$w#IonP4 zgvkb$Jz-d`;5ERZa-2ZKl6M2J#DrMnTYxj$-~@UchuC@Ahj;q$m%yP4oIu24rw!UD z#XiSR@!`9HL)U9{MJ)RFQ-=c}h+|#mNd`YcIi4+(wgZdL#FCfeX=aMi;d%#RpICIb zM^FX_A<#bHl#sz3yD~X2f&NZ;2ZOWF_hdho5yW^NO}ZRd+Jac@m-ytwA`c@E=N6E9 z;gCI2dIP7}`Ce>0nd7DV*l7@ehT=%Ecp`Af&aWaC`&R+WTrSSBNVRjhh(%`xaGI49 zi~Jhk&|;iG#3JW!SDEis2`uxy>L|DVGyrE;J(SmcX=)2y6WoLvBiA6q``nfoPh($gOIL*q5MLrrhH4i5c zvB<{(r&&3%$R`4)(h(4`$S(&@vvOjQa~w$Rj}wSk*9(=dow|CuT5AfOB%&ZWLBmss>K^63l(&KP3y4g*dd>S56z1$mm46N_Ar zZ#Nr#|M% zEb=YDDWif*=vYc^78k&>@`Fz za^4e_n4j6bPygJ4k;CMzfEK2l+o@<=-2K|p8{LWS#bpa-V-BE|%Cz!pZ%F;WO6zkMUXaftL+tl$Mmw zSv1Y7Hx|No3oW09sgd5Q_c1R(h|3l8Zdh0(>*8yT<`OX|d29~z-T@*z&HrKp9G_oN z9uO^PK{jpfqFK$3^rxzBe#DqojF>^xy-P;d{%G~+adrNNH=pFy<2dQ|>65KYI zy!c>sT9|q2E{bhlcZj$PVH5BLh=}(F#MqG&CQiF#^0bjdCS}_et!Bc#(F+d%Bi1@_zf8iD7% zKOr$a8v^FZw+RVnp^c$Sd%Q&?_F5w^?Mc3&Xmqxv5YtG1g@RviH1udgNc7IJ_Ofll zIOts^O8BH6k9%<9rBb z3caZ<=*7dB-(Gukl9tM?wYGUJlJ0?CiGlh|8$AAH?Maf8BFKDFhx8#1beRR3!HIhI z-xnHc+f#_x)@4*%fn=)E$1RsNtRxP&!&+?ij?HYFS@ zUW3&+d#qC4tS)EAiu~6SoDVQRa%B9bUB|kGA5def{Bz>D^34DLN~vtIF8lI#*t)F9 zZ@DJv)uBYhXy?SirwlJ%^NC6swrp5u%yCS@?8cs$|Cp;bV!b)cki1AXytnW>}5RFJ4oRR#~aMHF=yJtwtBICRnqEc5WXUH_~s5D?P14ANbP}^ax$< znvrX^zdX`k_U*d#JoHhl6{qshsY9(=sb%NvMdW^k&*jI8mo%yPUdgH`xj3a2-USH% zz&bALvG>Pr;UuSK=l@i@R}Cvxht*1bt{qmKa#%GX&e7^5CEhz5{sT$Dp~35SbcENo zCNb}o{NK7V;5+;kKgCPc;Dmj&wcL^WdlhV_zNr@}&J!_FcVa#;%z=A6qqUu(K26_HEA4rNg3aRjW`t zl_;xft#nt>dZd!;vtpL`KbL;64Bl+4U$z_XPkdOsqynp?V%@i7tkqk`l8V=KcZ%Py zc0$XO{uNCQ$2%LQVBIZm-ZRFiC#vJ31)bC_oubPV<3l%8{gAtEO4a_VvDMGHGkCXF z6&4n6uXl>Ss8>se#cv*^YHNDmm6%XGeV1Cg6RWp<_t?0u6K|gwcg2?@XN)>HYVakG zUD9>*?V}4&-%#TAf8M$zC-IJaX9I>R5PuH~@q1IgTm5o=$F?NLcX^9)e($!V&;Jct zl4D?T<h72MeYIxX z4}aQ;>g%^B_4Ui7zJ8h1$uAS1C5?`V&#qGz^eFD#qeAg0Oo&%yC7DI#ncT{9{=Bi= zzifzxVS~p)C&|^Rm{-2=MysT;8iMp>n~q(62r0I98PD)wnCFI5xFc_I?p z*o65DXBEvWyQ!$W%sOzXPoOS^X4@7ti{=z!Lrv`q^uuJ-rG+ZJdPMa%?VZ++DxHf3 z_6A`;KQ6>kkV!7g?fu9WVtX1>??t5x%ZlcVt-$@Ng=&Ik!t)FllT?_HVsk8*kD9oK z$7#+r9Gh5}a7s+3A@fU0mCaF1Y}B>5Fd;!)s#vJ2HK79QiJ(0uunp2};;gdkOHDHk zCkktg;nXAcc~I^vgApv`8Mq4vXFS@=3vILj4!iiHX7 zteNt%@;RkyqCOj3n9$p%mCW;U48>c(*krMyY|-q}65X?WMfep969(Dr3l^1Dl+2%Z z<6Je)MV_qn?LAjUzsx9c9I988m8e2AS9oNJB6d?xXKKlOwEaBv>IK+A5WBSw)qEH| zUIgsKnYP@Dd1cpCl#VQcrU?sr76dTuN}8*j8Dj3@(##n}i^__J%%6u_bSM)`$PA_+ z?3Watd9qc;ZO}q4gs3hly)kT1;h8;bV(H>?h>f&hae3*y5=73gsJj-5TvRdRn$qI( zL37N-Fu|~4@a7VpUOmF8{&uj5)V$L2Ma4x6O5y9ma=l06SStw+fdn-!##I`gc;kXn zRd{CD`a)%!G;aQ!vf?t_W%jGP!t;`x#KdI$Uyf*8yC4%ya((H-K^5h*)x^;g!jns9 zgmH;M6sC;vL}|F{mCYAt^A*o2Lt;$6AzE~te0mT=dAz13l+BvQ{XBV5g@v*9^%Vv^ zJv5A4IKLcmWAS!$@JVb2J$4~OdD+}jj9haU(DFnuVVAR-t*z^q4w*1cN+tHYkl@_< zQ4fjD4P}ce=4H+-nwMEpdVN`OshV7tIiYYY+HFo*(Y)f)@UXJdIVIsi3rmZ_XrmkE zFT6I~YuKQ%=c+;TZVc;)V;>7M+BpeaLuYbX`Rwr%1{KUJUU=gIT`zE9?72CcE0DUn zi3&R>W=2k+Jz>P4h^u}Q)v*=riS;v~;bv*8v-HjVcUk)8x>?#W3wFf)H(8+JW@*nX z*aG+8WPye{@1*#+Gnw(#3ls3gP+YR8DDwuyB~#b5V8~F3lhhn~=)|##tYNIGtuvM5 zg372{K-tum%JBhZ)+$!n)|1K!0cF-FR+$p%2yGPFe8Pl5nd2r*aD|RqxTq+$TbN+P z>CRYMJg#B}u4)V}<~slbR>6?)wP4R%n&9ZMzO;Dg2oy_Uc;@_tNC&S28jpcxQEBml zNdN4G5seTQAe)$MM16B@B5Gz)-|UD*$a<}tRZ!ntp!2%N$H%pDoMbhFj@RWn^Z)Lbvi~Q_{hug9{%@0d@v|jaOTPH?2#(RS|A_fz^8b}zCjX54 zWnpVDHulD#U(f%4pZFl3!LVS#@>7y zjdZ@}NPB14+{{Hj?Biqe8-1_5_WHRg)yF~6QRk@F+u%J#l#dTxeylx{Ki9Qycsq3$ z()Iy=PuBi)cl8b5%g4w1cZ$~Mb4x>p4-2adpXK9Y^M`bPufK-e_X@`$kAv0r7Nafy zjGJ8k`lY+}On$FD4L{149$Q`~U7i;Y!+Z5LJj*uJNzKB*l#YXAlJuuxl8m?8=Aq$n z`%8bFG;jY?1NA#qEwg#Q(Du$#v(a`VkiX^rYVv#aGrU*7Qv>aHx-Jh>QY;x><~%4& zE{W|QhWGl{=>dCb0sqq!=b@08$59umbTmv4IPZ^-*FGk{=fB}S|I-5Hof#V(I2Lwyq4o-@_XeO-Ybv0U;63nK)ej^#mn$vH;duDc%2=v*CpV87lq&c znmDJzQ5UOZT<;;otY!aAe$Riyd;WI`l-Es{H{BG0b2l~B#%qKwZ;;xIzV$fDlkth| z-`l58-s{iC-dJCHY`l8t^4NC`8UCQK_%@zzvGj*r%o8DI7@A){CjSv%e)=;#!0!+6 zO9K3w0Dpgge>}i{?c;xi?>T;icBQnnL>2HI7 zH~I8`1OIOG=|2wt>V5jZ27cJ5{}}vx&Zqw{{M+Z#KM4Qc_vvqgfByiFKke^&`1cJM z6s!3t{5u9d#qtgC?_~HO{Li6yHhAgpYk@IkKy|SCtC4qrkG~!MaUX5buZ4ewzVyf7 z-z*=0FZ{dFr@svT-RevKDg0xZQr=P+-t5!A8UFp+m;N*09X_71ejU8D-!1U(UGQ=} z#rB_b)jjalK7G8RP zH4cim`qC#LK3@6&H5UHW_|mV9@$UjP1O7Gm(uXpzAXEN8bus+g;7cC>|F-)03xOZU zA@S)4|8{|w_+9`*ulw|K*?vC#{_yW_KK-%q?|YyA82FcjGR6Km@UJs?u^-zWnd(wB z{7j@XOuW9sus0XHw10cpyAHgm-}$N)?A-t!MQZ)FsPE5w=`6bnhqP~ND6aPLcrd5# z05AEIVfbEOI&M;_2Yvkc@b3wqJ_ojEed&LLKYM-rpHc8@KK;J}zvWB+1O@-m$NvTX z{LQET5&Ss{Uh4ZN`13FD>;{a_hX_n7l)+{v9~;jgpQX-%BCjnOFS{TwUok~kb^bG8 z`#fL{>$G<^{Ob)Y@lS<+{C=15;7m9+6uiXmH260fJikVnzW{}e1(y7s;rMv)(*E%% zxClIo)%riepKE|6zXN^_c*)PcwE(>Mdkp^E3|`{%9l)*N#s44RPn9qKw=lF4ynNsE zfPWjnOFX}Z;fKLX`F}*behpsAe-HjNg2yyo?e7P0`~a}{{|@|n3%r#72l)36cx2Q1 zZ^OS&fTg^5;opCOmw3F1f^ZMgE$;^?CV>yx{2#!-)4{`SZSMv6cMf>5_Z$l9$e>Kor=yOzi(E- zzYOpa-zxZ*4_?Y&0sn@Amv}8h!Z`3y)AqK&zezrR9TfRqnB>0^{!Irj*IPOK<9lGz z|2X!o1~2v(!oRzG`77Wb{|AuxEkMD)1`jj3{6+BZDIY%%1-}4Z;v0p3e8&oAwEnFq z=rDL`zY-|E3ts%42E!lt^3Q;OpMjVDI~5s^ftUU?9fniT_|pDY!oLt0v3E86<9g9@ zyV74UDDPycenZy$K+KiP~Qc=5k43i>;EDK88Dee2WD zfq(5$hV;kY@b4V(;(rAGo##u>fPV$xrM%eq^iflAVe&VSlz$%lEeDU+3Uqs)27hk{ z4>vR)g1>k9^gF}RhkW{{KyklMza#v89lXSczimGTk7BgF4)FI&pMHDz`!DdFZTbNC zcM4>Zzb!I$126u33x8NgiT8iOpNqlEc=I(B$N2RB0e>ce7kgj9AKpU{e?Esl72qZQ zUjqLOhxEU{!M6tR=UV?_=;U{Q`Xd06!qWUl8C22KWp0y@T^mM^r<{lkb9L zgU5&FyCH$U`S7Rto~YjtFjC(xsLMDXA6uV`)nC#6XCN4o{}sf$2Y7sFd;5U1eCaPi zvA-{U4;&c^UdnqB{#@qM-vxiB`1JR}pHiRxPQ-hmPybIa^b?={OYpDSr~fb<^dfQXhWA@7!D@i6jQBAY@C6IAlqER|k=})dh^n^|CrPJH0 zqxkM3W#j08QSBwm^B!ggT=hS#@#D@1i1BzZ}92xc~A!6G8m!fcqg&+H}hJ9meZ6!`kE+n2PxG zyO%fz2Z>`>nw1layen`j+K)sm@}9tHR!%JP-oPomut5EAg!nR-#iElBUe+HPMx2Bb zXatT->!9#PDT=iA;Y@?c!m{OV`t^ zoLJ<%rzLyC5sRF~r?K%t#3H9Cr8}i46NmIqV$tctv>rHt2H?o(rlD?2sTX4<`t&E` z9HT?~nY|3=nRTIGB+(4AOxUP9v2>`KUjG%CaEk0#C|R|*$2|Byjg$9MWX#u4uL+Q1<#Z)wfss>`a-G2oiFpG3 z6i4PF4OKNhLN_~_A(pc0fHTXrSUrRf(IFO{CxNBhXMFf&;<-414&cbB&`^Dck4)<) zB@P=C)Cz}lgNEjw+G2xGqx?pL!^Afk+@092&y+=cvyrnOI=2|icsi^oi2cp^nTCp& zle5HN4hPOsgQpYUYVd60Wd^euoJxb~mQ!W$5@H4n#AIi=hWb5!XNAG*DYrh~O>BMM zLcG%GJW9OE;Kzw?Gk803jluhfYYk>>9X1Z=O&rc@4b}U^YYhH~_~!^_BwlB5n3xp;^&-B*V6H7Em=Y(;$XgNLWpF!U1_0C%hciG! z{hQOd$KWvKzc9ELaX*7;&iSRmeTX+0%(HWm!Md!C2J5mc)@9vi(d82RPITMfR-hf9bbH1avb4;j3`hZhq+Y~)Lb zA2GPnhiiy`ZRBf-A2pcGBX|SxZ;YJoI*%F5BArHqA1CGs^b8K?2@TbD;%x@+BW^PI z0P&LsA0mFrV4fZO9oLHZw?^KMn1(?eabT+=O=l24XK%=#3?54Py9Vp{yl3!e%Ku=nj@A1H>sWnYu#VM-22aO_^GAbq+&(f` z$L(W-b=*ENxEvqOpA6P9{IkJJDF2JWmBgPKyuv51A^xk8uO;Pu3RGx%=ezZ<-P z_;Z7|5PxCtL&X0u_)+374St;XzYKnc_$!0A6CX8r7xC8y?<4-k-~+_p8hnWOp9a54 z{GGuJz4I@F87Aj@gBb$n2ZLE9=SPF-u5-*_n#SrTnqf8vudryshr2Cf;n&az4*= z+8aEO_#}h#iMa_iXaq4G0gWa;#o%$o9SojGY&TB0ikQxVrW1EExP-W~!Lx}^HFyCr zD+DSh=0jP~V&YVT`BTP8Gq{rY41-q?pJ{Ln@mU5lztfIq`#Xd|0#W32F}NdfSA)+W z?q+b9n1KZKBF0N}q%2~4leQ1>IYvH^n85}OB|g{S5ya^Rk0Uw4uFoPsomjSM=CxUa#wj=2VhDYpyd>pHR{fHElW zZ?LZK0E7Eceu2TdzU(ZZd>qb&2J8A>WbkOpFE&`$ogE6K>psX}UH8ETPe+ge?3~84t-GB7s_TBK(a~+njtSEBz0BY+cxSxN&QxkxJM6q5ZKu#+ZD*3f z+RkKy!_adsH(1B*3WIg5rWmaI#+3%^Sn+}Y>Ao@5U>&Qg4c76QX0VPAFB*`JPm#go z9d-~J+P1KUr&~9(XlKzJ(ehQrF0$yQ#Vlee7Hn-6 zT#Mbm#Yl^aF&e&NV&pC6v_&i`oAvL?h*j|w5}VLsDGRPGUKGimhPUE;rT9#=nBJnL zxg{-I5P8gknTzJxB{NUZO45O+={L=r^|{4;v$LiZm6tE{r?=>tR$4TB{=)KUdclKc zrf`*Teb#9e`hEHnxCBN0D*b<^ZCh||iNc=oC$MUpX&PP^Ek2PRBFPsln_qsCfC7)d z8fc_{e_7wtLy>;2&_j_tSLmTgt}FCVq^~RVP^6D5^iXz=D~x#1L)qD0x(9tI;-&kb zE6mPvVZ?);tbaeZ@-B+>b0LxK^>*>pNS>SMp-8SP^iZU)EA&vLk1O<0c8)8Ic+f-H z*n4~P=%Gj-SLmVa99J0epojQIybM7e^dYX@Y-$nlL06ca<-&*u zJz4)8$?l;@KUe6XNS-V7P$btCdMMJ@6?!Pr#}#@gJI579Jm{h9Y%kq|J{0lNeb5zV zXSp!qK~L7-UE-Q3(AfRlL=Q#sT%m^|xvtPdk-o0bLyZBDt>6 zLy^9&&_j_vuFyl-Ij%6`K@VkTyXk)93L_C8lsIK)c|sp_y8!-Wi1hYU`e#W-qF^_1 z6Z2RBCasvgRU?; z%Y_jQv-l6_e@Gn@%$#LWzhflcTR2HL{O@WZ)HF`AJpa%3Q=DZ^j&H6v)2AqU+(&{o z^KIJw5wl0#aPUadY5f11`)JSyDfdp`mhA0-p5NZ(*`7V#N@g1ET@mn)#!Da<692e| zuHRm}9M4`dl*QgqV84I79bj*hXp>^^Vw)#lOO@IVdlP|K-_|(9-me4xJpy~Y*C8bK zwg&v`hz8+(5ZY^tL+nLRX}^C*z>F4S_!N5?&|{u_n>G~owgA&!dmLi#bL98i>k0!1 zwM$~}Qz-fEedhD;WS_m=0ecf+z&?V~HpSldfW0&NnrDRc?-ZZC+XD7(hk=&*OLf5B z2H1NXc4&{c_@urw0`|Uzy-7$H690H>$zR`zxwwY}8SQn#A@=yV24c5Ab8Y;V{Cm>o z$;T(@(LB$;Q^AY9wZMLRkHg+zX0Rmw@sXzAzmk6FgOJg`(`_2Bk1&k+?R|Y5|9Cst zZ?AiQ&%ZREy$U$sw|5mXwN&2)(DU1S(`WBYpS|Vq$8T>ZGPP7+zWd;}SA*xH+hK?G zJ=}`QBe*a#^fH((Aw0ABJvG)^T)>r(y8TP&aFC_M^hrn;IUq0S1 zwe>yErm?>30`=v4wi_T95_=pc{PuPYGI6GVnK+n6dlzFcq<=EzwQGYobHKI4G#;M^ z${mM6;C?1pl5#%{l)HT}`YHMv%jI}3<#NnqcBpImsx#_qF+ao}+=;2jl3`{}1MSgg zvBy25{q~k%P+5X>A+gst(C;sYA@)Do>w`n=b--^1zdha%M^|-8s=ma=PwJ5fJ#;~r zMDJ3xliyz3@Bu=_#yU=2HNdz*pu-^ev7a_7os8j{=E-- zP<2V{@m)W^f8$1a{tbdQ(`c_d4%%biCH2CWONoK{%rqV!*iS9QsfJ%dKB5kZ*B+{} zKr=W|k1-Jvy{+)izyHR1_{TKS6}>ayC{$fK1bYY2_nCeTPOL`?js-;}SmO9vcMp!N zutx@)b8eqL{||L<171~irVa0%<{9P`{8sjOj@l!;h3IJqbB6M5HMLRM7I1 zLuk+d0TQczY7;n#5THc^Rvo8r$|$3$<5;MU<2b&AB1LMcr4C~m%MizQ7(d^>>Q}A$ z+V;KgwbrxuIy;F!-#6ELU44?h_r0EVuV?-4pR@MbYblQ_D)h17Q>?$yfp{1n&mTVB zWzqF#JQvkml@Gn+TvRd3&Du+K<3v>Nus-%pSMWVj%IgU9&wJJ5l;hW6+p0z!Z(YaZ zXOL^bMceYE0M+m{&!y{#PSzDSxlZYNqmLG8Pq-8*p0s`PhHLwUhNnY2&V2&Rk#SMj z4(+y2p0sEB3y;@zyX_Yk52lAAyv4whR_f1Ui(#Wb+r8KJo7Q>lo{jsH+CF}DPW!ZL z&lD8t_@wRUBle<#kW*BMZA!@5((#3jnP&=LEk0fU%7Rl1UtV%@*-Oh$G`_gz_#bX_ z2daDKY=36^Q#&hnKAtSyF|+GCNcDeoz~Vq@a!uE3p1Z&2j`rR$q4yK5i`-&QTex>? z9IG7U^*)*Blq>wxyvPspoYFn%__XxVcq06y(>o^DY4k!Y8771udRl02)wJ&0s(xuK z{xV)v(C>8BBw|lFe~)I~+ZA$_)-Ly~xdZO}#9P<9(~`GUg|pmvXZ%ce;a!r4-calh zf4EJhVMqP{aQk|9WIwI;?=SCqr=fAt$wk#m4=gQQcF(f3>)*MiasJ8qlUHr&I2;ef z#R5v9=WslnWn0CnE;|m#7kX*%(N&8JL;Zj0_HB)~xsk3Je~Qe=b7s^Q?oD(&?|d!8 z?OTARj zt(UgJ&YDPeGA%N;Ax-7#999ZCbU5C5O;N!$Zc*VsI&R+!Dc0xN)=_d@HPe#yRbK$- zAuk1ANZ}+pG8|R!ueg1Qj?vDA@kB$HdvQF0(YBFLI87fL(h}jvoa)-_u9ICSy6e62 z=W09CKPCr>Fxn3CFdcaaBM(dCiIsjzmZqe{uYIe828PuRUOeCJ8@`5~yx#50Q>jNz zkmkck^I#lo9D75UUZHQeT+nwQzOZ}2UB|t=_3v;8tdt(i7q5 zf%Ac5S&5a;J3iM(s$`ELMM&?3^CO`fO<5s)n$&ldSKlnHNcN5CjN#fmwyn|!h;@7F ztmz$-?{Ih@2ov<^rO}H*L`hqaVW2D+FifI zDodlB$X%oUkZAoX)+NH!27Qsce*eD`trxhFQM*4G*3^ag~)-8;gp^=NC=s%r7duJHM!4 z@}#2j%P%a7R$Vwd`BaiCyp;BoWJ&90y)5kBZ=KEVU`bYwch=F>8L#g?iCQ_~)kDHeoX*!5xT#+uVL_4A&YS6V*~DHyl0sC;~GQM5C+sPyjK zqLRsZMa7rr6-}wiD=Pd--gC*>$(h>^Y=69`w5K^NR+^ntST$x}cd?gyTruvQ?KFp5 zyjb1A=J3#T^(RxUh{a--QXWbv52cicQp!Uq<)V~wx0Y7r&Okb=#%CTaJW`s>s&WVB z$0S^qk7`8sgScKFtIFjZ4PVDyccc||4sU<1XZH4)I}aqwcl7Vb?&ei|e|MvoEB|U= znq20U_?CF#-pHvY+;uAVhC+$A`W>$F6UkVKcH23SdIjHtGu*Au?q1ks+vOe3KNsCT zE1vH9t}|XtzJ5#1!7-0IorfNszi?+H)PQIK3IIH zcT66>T;A(;p7m2++P%E%v}fJd_y1+2Ym!scF~&I*V2LvjmvF^_doJ&_QKt&m{HgAOu6oaYCvsO+yTG%bni7OaN#$oq*ytaLjOCGyg`e3eT~(T6B2MmtwnL6Q{9nhNnWS`L74Uv(H_N z_UHIq+uajze`vYCiMTHS89)E=M6T24|5(US^O(@qJ=oIlONjaB+MQZ-e6<1hZ!P=e zPq6$~!u@#!W?#F+cbnx;{%p(rRk*9c)%{>PeO%jJi;n*UIJSFEz@O`z+y3VT_=N$t z%+Da@z1s3`HkSB4Dh;iL>E$~kEg5Rf+poaEGL`)GS^jZg+OYi}viz?E{${{`zva*P z-U_&50e7wCmj22uu$hLh`}y0K@(8vx^xV*1(&DF{54yg~RS531yC&dX9&j%VxRaJU z)qa-KX5!`$@-%#%%k-@F_*sGTFdp(eFL3%zSakcMw$dFLCjL9rTMn*I{3$s=bH--v2cz9bIw%?vFJ|%N0w6SIK-kq4IIUL3CbC4;cNxf`>Dt> z9}A!7cbJ{xkW7?cnaS5!3-c3_$n}~-EMfWSM-=ZOD7EAm`^3WG^(M*_5W>$TA~*P0 zI4h|)otng==lLh;=>QJ%#tP}Co)rw)O})wEcZvC;9kLHNKgY*nb3gQxjGkEZj{{42 z5{v#R;AlkKISMRwdV>61ttS>f$1cdcM6Ust@x?mi9I+`|J_AMZZjAE2rT++6=F!0o z#>toW4ZvbQ19+0r6N`QvN-aCnl&Q-Jd?^0Dwspr2&)#G4a zp9L&)^YB?He2KPM11$OFGgr7k>v;_ePu6%LaiPY`h>J9CB%Y!%-?>Mo`dH$<1^TjL zt=~qzDcjxTn|dJ@{(Tl_Kd{tGKlOas4tX3n|56`I*aOf{GJ0asKLadfLM-~jz|j(I z=Lm5AWj+?pG3X~5J+bIt0v4OZqJITATB_}w2G0MSkA-sv`bkDlEc)L7i%nwD{}woE z^8OBR883>E_sKWsDY5X=a6gjslvwm*fy?+348r*(!{r)JAU5?_Kn@?KA*B|c2^^`= zdSbCTha6MC^U1kfbBKkr1UPE!FC)iXLx_db2rTWe88}?2?eJMna0f9Tav|Nol6PXU zvzvNjpIG$Y1s41Jh)o$j1uSjyIbdm%#1i(X#W_oCu48WykJ0IQ2UzU$k`Y<1^~7Rl zHn7ZlR1I7g=*0q!;vFO?CqE*;Ic&io;v2Z3* zZ`wbx=nE}9vFKUmVux7t71Xc84niz?RWHmOgjn>dT^T*G=vmz1x!6HiOfvTpvmK37 zi@D;l$#V;_guNM9=3BZQxa?}|AltA>+K7d}8#r2r9pqkYQVztz`7W@eVIMgr&BVfa zf_f$dLM-}cfQ3&i`eVS+dDuZ-#umOtLFY9b#166WKLU={YYu+Udp3!Ma~}034aB0K zXz__fKa2Y1+9t8+`B|=%1F`7m14}tvgkX^kIxMkpim7kadScP5HnUOd?KX2IR8i9z z5Ce{|QA1+bBrK~(I1Rv&&DcSRg~KWl&Prh65DTXnSU9Tvv_SzG(tZ|b{p~nJ+I=i` zwo!kB))R~V5#TTr1$hFS)CI9{*aphJj2+|;L)HFXBR~E-=zK(oOOq*Ph+EdVyQlx&y z%t%sr_(n3tt)kJIrgfW}e1jljiSA8UeYt$o+RcfZ%lY}}+Q#-aEL)6`A^0}~>g_y9 z@)+$mHmz-ITG80PW(}6bwm!PBIarq$pF?Yk=oxWSTYIZ2>~*b-tfgtaQyv((V$s(i z{hOPe@|3YG;@{e`stt>+u3K?i)20n;Z)@^O4DqzLuI6&;LRDq6X2S~gDTw;oR(#fM zYVv6;`xFJsUMWV%WeORQq_|ZDq-e1Gb<@o0E1K4;)y*XdMvI2THP10pM?4a%S}>r> zb24=(KYqsxuBT=ihf%B8p`RAy(~N4eE4VnT#6>GZwaSREM&*zE`K|X2p7%YP_f3}f zeNxIdI&4a=gjm_ShHE0uuAfdKP;ew{P3ynosOg6cKw9ptJ4W4tsAxM|-SOv9}&= z!?wpYir9xQBKFpTXWMJO7;}WcllF43iM?&cUZpXxWVC)R6niwy?N)QFFdlD$x7uJH zgm*gtu}A|e%M$T>4?0BMDqiH7M^~j19{a)Uv35K!Da;2&c++7_@=pDIu(xuQ_UAY} z=9lHz>JKqh<48Ygtlbr}%uu^eG0t=%es?oHeBR?Y(+ap`tlgFlcfcMWF?MlXY|Gy7 z4H*ZqrQ?pgU23dQc1XrAmG8}}Lio6huqZy4q9$nlvc3STTfUVm)C(S=8r9A0*aV>I5z_`XP2_C&XD_V%Z? zSN1%fyaE@6$e1xs`qXRE()QNDUVoPxFDh8=CI^c4#oeNZX1GQBr@9#J)0Lg&kKZY* zzo$O!8jj*|2RQcQhIo0`mb;kV)R;Mzuri5}ggrX-?rR5seXr9wxOHl_(>c)jnm=+7 zF?Um&{?{Qlfp(HUwcgo}F%%qQWyc#@m9|yc3Y%O{O!eK;aRJ)JNaIUtw{vvKGs&lR zVC2J&Qd6exzaRYdZLXy1Mbyxiz3u=B^@l}$>NJhQm_R+pVD9f?2JMyN@=yUGKTemA6%L8n^ z^cv?3MqBLfUa;*uXk-7;ffhF?Dat~NVtS^{nCiaWJ}uN2!-&Y%b-RX(b4$n25jQN4 zIX%zxs5;tVQt#E#m|^P({@nK2Jx}#;oa+3P z8uQ1Nx&u37S7bVwy_uO6odY|oF0M`Ne%^U8w!5mg{oV8bc~>RMmE*;Z-?hvuTR8*& z9#`$&?o4NL?eHT*tFN8x*J5ZK&Z$Uf9NOfXL&aUMS$5BOmfgM=V-du=c$XjRC)?I# zI5JPpKwdA>vE0eqo7CA;v{ltmT~*rFNLSj#Egjg0QyD)RmT^(l#&1MMjhfi`BlmFn zBO$c^EGNAv3nM$zovm0hB=73P?sLw4bGxoign#eURlSH9kj7D=W{wCQoO1?{(w4-Xoz*rZAL=6!v#rf%`eGbZC1!5&jtR zwRZi@t6J8sE@&`42)x!>@@G7*|3coRjBt$1CE`%WbhSQ(ugY+)0>9W(Xm_sVP7R-_ z_;}1SlId_v1cmoSuKAnF&rlRfKx6o( z8v!iMe<;B354hO}qeb%%i_?UE({iV#KUbx%-1FD&n*;8;fZI>6=KJ}{4V1@(fP12f z?`hATc0U(z9|^c~<$(<&pIDw}1OEAze`@~n6(5hgM)Cvcxk&j>5O2(gNBb99?o@l1 z1o+zR^Dhb5FHrni&z^ScXFV#l`^tcSEa3L*ryyXzP}%p}e__CXit@+L79-kSAWnP< zmYTm}=QdN8{H^EWd6eamyZ&@ibvE|_U@~(2>yD;U>R_pT_mAXci8hf;rgI{a+8GBol`#k4R zAU-Kewi%A$SY(WG++Ys=E;Vi*Xmh~W>jBQen4GJPJ+`SFjL0)xqs~kfexh1m4PHtZ zp6_l&=$>NoM;+Z}s!2MPdttzTyYkUH^10p}MVD{Bb3!|vLL76@vY$wCU*e4!saO65 z4&OafXe$SyzGvLLhUTEX+-ma6dqxiKB>yXrp63GY-vr!zH!s3CC^9C6WiMk-*e)Xr z=&RRQlKxaSKN&N^Jj$36V&R+zEMrE9MbG%6Btlp}f*Dto4IVNDTbbeTz9-{5$SI>S z2-|ADxhWBg{V4DxqbC;qEa0dayU_qFb^x6y`eZ1~mtd8ih*GQcL|NF7Qfz{0Kbl9a zevcI44_1Ry;x!ky8u-aO-W!3-j7^4#NFxW9uqrNd;i!NI<-gtie`hY_7L(E3k}@xXsc(2rTI&mUKQsP9b)X1K6Slp9Ge7 zO2ooHO^%88EO8Nb5VmhwyGWHS6_847QG=%wn+pKzRLY!K?8nGqqkzoE7QReDonK=| z<=5aWc+1!XVzEOLQ6>bU%Gr!BP~}{%^>sMNI~HOI%QhA@V+~m5QC1+N5nI^c+kxf% z6|sa(0_QKs4ni#YZNQU^o>=rdf%DBfb7Il&Cg13ZMgIhFWF>YGV$nYfTy{CNj&m5B z;8Va-KE%R5V{tfEOWvy!3kMW$%_Mbx8IMfpWxT+7#B9_MrDtVAl>Q4EXW=04@Ofzv z90m@5QFA5|U#T&hVE8JHc^-vXfsonQ$_$^>@Rz97BJZD7I;*r!;kg>CG}LIEhC_a> zk0rlM|0JU)7QIUI)tb+IMGdCLU90ts%e_%!#^v6m@mS&(jaRI_@urrA%ZGgfbJL2O zF;(mu{X&a#hI$?Sn>Mdnfo(Gmt(!L+nx012f4L=Z1u%)Lw(~IrOtZCKd0T;6btIgE zOZyG?{^TaU2noJBvy6Ce*5no0@J7@tC1we;v*I;e$^@xMzj_14^t5eQ0VjD)n>KCO zwArB&8oUc@Yu`+76SwjhsvY{WOiw#CLis0}n-VvzXkE2-_*Z0zSHB8tY+BvcvKi9` z^F7U4e3_C`Q^-=PQt?(drz)ALl%P$C)uI}{&=RZGuUNfdgru|9M)2aq$&G8r9+AmG01%kn#pl+wdk6 z+x(5SZHeY`d=KB!HS=!J+nht2n$&w&#xO$psPg+{TFOgBzuZ^@ z>J6u!keB`BL%#L@|MP+kmz_&+VKR@L>LT=u9DHNKiH8rZEDsT}M~dB=AjWVMd;Dg=wpV~m zN_~(o_BH_9_V|vGzi~yx9@~&@Zx-xv&MT&mcEujQwXp3y1P`_+5wXYb!)$xEXdia^Ho+d-r-;~NJF?Ta2=?kgVtyIFq^}%+ z_A0Sax?#`!gja6*al6XIEB5yU%7ykQvjXuxhF@gmQ9JojvH+`auy`$eR06aq1Q6tP!~gi2niZ-Bj*u+e`$ zHs*uv0uLJB*tDwEn?vT4-f83W<5_z4q?OsWx)}Io@K9&E|;rJjy@I z9Is>80)%DE|Fyz2e`QFT$5yHM-`_G)$|Z$Qn-sparQ@o_rO2bCTc=mKju|a-_g|ZK zvDUsZ^T&nH7yqb!;KZ4eubw)6`js=MUV9nuK6gB`eP+)AyumNsag1|{r1|p#Y&jHa z>J7cy=zq)4nGNK+s`$FG;2VYe1sFQf>`%a`7Wa2)&;gv^y{US4{^qkHkttU7@0!A7u0&JAM3M*S*d$XO9<~ zJ0M})zCb*9hng8bZQh-pxvSoPbL!3O;=h#@EB#5|N~SlrK<8OMp8jNU*E6xwng?pK z=e@Ud&9YO=YOjCl`r;er;XSmPTL5n(#oBox{YDby_ouaL&LPgLa_ug(?I9y7=Ip>M z6+LPej--T7w0_^wEyL|&$~YrO$_zMz)1F+N@}}M%y&z*MhQ6m?ezft((d~zmb9Q3n zMi0j>9KOEPi*?(fMC)TZ-dloi+Yek*IG=Ca3%gEqE$=?9-qY7_8=fVj5{8Q(v14Ya z**j)(tiXt1)b;~vyoQuB za*TG$^Ky7wg_wD$9^)^TVJ?{A7?M*t@{M%ikx;xhbSPWmC{4Npe%q4SOJqcjU;5%B zwnDYiN+YAXoWI9qzW1(C&R0Ua2VNey@A;RWfAEE4FKp>3xpqrOZ~L$Rv@!34ly=6H z9O#{9Z^n}+7x#xaYn3X!R^39$8#;nQ((qrIpV5APLS0$R#kS{BTle3p<{ZKm z&>R`(*s2DM1WLPC&Z9ew-*9!C+M-L7)z@cLHPk%5BkkU8hcM$&?CthM>wYKF6~c9a z?Hg#s)}0kgFG@Nmx|VgH`Pdeow$%-s$7s_%7z>r`$M~q1Y98-NyO%9`TkO@?NnD9| z?xvoh81r%-d6qd3)w!-k!Obw`VTq?U}3Q>`CrKJpDZ^ zrPAaQ?@Bv)*Lk6hZ5W>w$~f!x)!~lYm&SRYq&04fy;!qlFXp6*CEj`%<0CRqDy2Q! zV#ylJ&6IY76T!{+1loLO?Up_6V1v_(u-Ao`V2-DgUOVEo?CthD@-Rl|?7Cf;+h;E3 z_L+;hedc0rpShUZry6tnRAX+RYUHFwxAailpRonw*=jrEY=6?u{I4$Ya4!$I*I4e<{ErUge~ilCHjl5} zy94f8?}DKH&jkG63b@(-q($>r2HgI8_c6|M=49pX(=^PiA2T8KVVtwT_~R!S{Lc^g zpYQz4*ltn&;edZw<lM*QSHek&OV$Ee1(exep$|O?gyA`xwo78 z;UUc_2!t~BkR$^-mzXNB?C>HmDd|MN~?N_kcU{41O(Dd8^<_+ReanWj_UqvEd&_*bg@ z$20|d?XC;BS6c2OV~^LsG`tCjd42@bmAx8IH{H3<)Xz)MrJ)x+=J^rKRDA#Xr`?Zx z9PMtk+?*GRQi3fFUyR4-@MKn?K4&>^nDiEclZLm%F^@|y+ey7%Ua985rVopi^_S{D z$2p4nr5}?q)c;G)Kf#}UM>q`QU*-G|9_ZE|!GEsvefUSeRAz2u-*&n&;pAgb@`$JYHb4Bcr{-W9;(@wUWNC+Uj+Q`7#$ zy(*$|3bihb4vMt$$2`(UFD5=tAO3{&Rpl-6#uwt zXPh^KG8S9DDGy>9!@zQwWc0+MF9wdXF&mLJ=}8r=+Ufb4K%1_q0NN4Edx2o~hr6at zUPNs2TVUy@5F0xs7Un%r^vtiz6A3aMo9Jg*_)214cp))tE)xi;!RC%uQ1ySicuz!` zkIgk5-ArPb4^I?@LH!~(pm7B3s0G?~~s@yJMNXJp-W-!y^8m!8V1|ZY1iC&eP;iz&m^4ni#DHU~J8q*jl=5`8V)GRBPeg#0ct^t&73 zEP#8G(G!dQ2H;3Hb`WCGuK|wSMeWdeEM!igTi_SjrYLGH2?TaGr(y>=jxExo;E=hsWX#*kWtdODy^d>c6e|#G>as5Hj!1YztpWzKNGu_>I72e2E0fz$SG~EF7Lrq9+!8F|dr; z<9Q+D;^vUQ8#@TG@N0pi<_1;*EH;US!`~h<=Z$JtcS8Xo77m+~ge4X|&k>nZXCXQF zUek`1FJ`#(br?<=p!^=}-FLn@O;bZ|v z?xj}WdqvMnhSWQ;=+l7nYp{b5i#`*0lF<{3{ygCPICcK5*g;fzntO-c-grBYJg6vY41y@b{#1&JixmPrIKxm&*`b z4$H$t8f}|4+`0mTJk{{hwd-0pY-&@^DYtkdKARG)E6ljj_Qn;hn=tQ;Z8hL!mINAh zpe5sELc9UEwjG^18GJj`XUM=?p)h^O0SC2Wq^31TjUIqXg`R4L(f^+qZ>vYm4nNeE zY2xr%%UANDMq6+W8$CBl$_QNsGvhTmBEuf2sYlh0;K^{NNYzjdJD?=R6zs76ALr+1 zVc4L|rK;#)f*J3y9y%u@c(G78!gR#AM)VxkL)Vd-%4S51ALolHaO`kqz^+uKwyp+0 zrwr&7e<}Kr8Onl;s2@^-LKdZC|!hJeYZ<7&_^aHy~@65!6jBtA>1LpuQ>4qp!`i*IWPs?G<)M zq^jzY%nu=cN_(;x_7ws?<-AOK32jWp6r6#ne$l+kS8%y(fC>dF3iOTfQ|!-%Qs2#f z6TkW2<-@2E{1j7iEB3_VHC?N{J)dhS^FRpl8nu_&3lB>csb{E|@oT^X03VyK!IqAV z&pdoSSa0k}xci`Mz$QW-Wo^LTeX#cy^t6X8diLIh!%p8h_?brvApQG=$G5SGA{9dKBz+eK()SYVeFO^A$8IaJmjt%c_ZS@P*Av^Nf$*sBZJn*w|MttKM& zUO=RFyfeXT5fYBVI|7m&?;^y@@?*Sw{*-w4B7kjgAMAC&UqtNf2C(ft0()12M0-r9 z*t;rVuMi&QabB4ed$R)eUbpPA9L1g+uy-Fk+LR@|6MG*8@>_r(Hj+M6p=WPtz}{H2 z$E;!OEefRX2H2B&<5AMb@51f!%Y{Au#t@P8eHlE4i5ZVJD}8{TJvU%4273i23=d-O zqd@wefRPILvpz1uCh41m@OJuE!d(o15wSM`dOLk*VQ(c!w8wrRv9}e#w#V_#^b-+# zV*t96d zJqlpkTMc_szqBj%ZVsgHRoEM@y=)Amk8_}jJ(joF%MaA=>##Rmd&vv5mp!m2?V05x z_Ff3&H;n6H0sKWIzefW3eF^rYz3^wg*vmkA?DDICz2VC5PYA#;F^LF`PV6y1Vs9FN zZLb#g*e@X>>027$HGnr1Z5 zzf<7P_Qx&|M5o%{#o*cT{t@^1X>U3A1Ch0OLOBK9s1w7=J3?@EwpZx%MO_c{XD_7=ikp%}wa z?EM=6!^DhV0p90GdzlTL*gI*`C*j&)k313bC_fFPuL1Uw&@+8Zr`Y=$%Ae^o-Biv) zuqWRtK&|}fFLM)0yf2RsZ*XqHml1CZ!ZY44VUu{D2;?IJ49_8dINt~BY3TlP)^vm7Oldth%h+#>Yj zHi!b^QRIE_Y!N>`?;+||@gwhQao{Mt&*6Gye~+>f>BGOO57LEq4m_z_>SMSFah`wr zcVJ_^g|Vq0mzCb&C)0n(Jduz&P6p7-u^H z<7_X$INJ*_&h`R~v%R3GVATah9mB4>=;MqKeQM&0Iuf6rL8fRP0_cHn)d@1ej+TyO?_^}Lbi*21+h4A0Y zE#JHC&|7IKz5^e$_a;LV`}cGn>O9*#Q7ku4^jD$8+MYM>`cw17maLQBR~VQVaQ_$= zI{#~nK|eHnr??ZFC(gn+>3XaaDprx>WOEkM?2R>UwpMAh!uRzi-yE;j1ib*`hA+Ul z;R`Ts_yUX@o`7+~6EJRgLi*?230prmke7~<-x{sTOD}WtF2vaWZLtJay<}-WJRWNk zFTTo&fmKiQVIzX)~U1r+u-{JvhD9JvgJoo%Xwj9e)MPUaYiS+Jn&imIrMT z`;2Mtu69db+!pywSLF$**}~)Qp=8dcn!+84l|OXX@8HaY%e;D@ma)3(^d9$YW859+ z82?U9@eZtB>fX4c5OY`htb@tbRm=8to@F`vDOh;TrW%%Le=#d3F4lYk7RzB;F4d;f7@hy&|z#Y6J*FF2%uH`%Z zm`@@9_3p_XW5f0MQbw2udv2>@-V;u?lML&!tZ^5DRcw`#l;!gKtK*w$_H}g*q}PU= zKjeindvAX4{37Rh%;(v8c;Pj#?O;ya_~CeE?N&V0rDHJE%)O=Gi7dWLwf;LM{2?z9 zzSnJxuiweJT@S|#KZds->!eCL`;*(RWl3>mTer{8RV2IMgKarDyR(G3ZG4I=Y`e1P z$`IzluB`Ey#(ia3C{Hroa>k3T)!0O`lUG6FWp);P>ge^ zbW4ZxXFQ@E{YKVJZ@76GInP!DZ%0bf)x29W_ZsiO^uJBKjk_b@=5Hh|ntxWDhW|vs z-=CXH^WO~c7XK^Ts82{^V6WW{XxwO6RfcySHdO8B`4+8GDO!#`V z=^T`|-?p^mtdScPHP(Me9B^G@fu+-N9VE!(nJZtHXQh&bIpCM*rg8UIU@+BXO z%`CJtDf4V#S;vj%zwn8LUukh>0!w;$t&7C8ePZD+A?G};Uxb6SD`Md^0?WAA8!f!v z!fdPI2zHR$u?fF}I2Sue5}WA13mmDU)^Ug>uE&7Gc=tj1A-1v!3OYw|khBpC|0Uq) z1)B2;4q^1aQ(ngwsa8;7;lBe_bfVV3N1U(mA8`m@q;WRu!h|K3uoHo0u0vj*WPV1~ zR_E%lc3WkelzAJM14n8!hgfW?w!{tyNU$wQSU$%@YBh&g!fpW$7ij%Xa!khpv2gZS zoco9;YyLi9;S&qLpB!V8&pR?U_i2kyEc`L^b-;rPMW8w4MkukVDN4&ZN7S04m%8-m)v6J=pMP;S{wZ_AL~|geJtsm96B^({%07P;4DO&Mf3Dz zVh+|BfldUM1tok;Ay zHT}tb(=%sQeA>S0DG?ptbi~8H=?G#Uzp?w@_Wf%AzaIbPiGMly&!>KI`sZhU_S#R` zFSz9=TVB{64`XVB@*i(Gf}WQ2eLqfwpK|nCCNp=`Rh8~J=k9i=kKgC@>$n5&vM)H? zzsK!sNB`-sM;CYfv0?q9Gm921eQs&_vhOZC@A^Mpvwr?~^s-(Of46;VEqjg=;pd&l z<1$mz)LQA$aR-kt>R*ih!u0*8+S|Dr$}@{2V?*J`_cV+?7rwi8zaQ`5%*ChUr9Um- z+kfg@_@&X7&%nWqF1PdSIk(}$w$XMwmf6Ul#uJl3y(Q`SPDN z{&dYxZhT?=kCD2bIcmnK%ANf?v#R_Q_U}L&b4!n`K}s6E@-9uPK3nvfzV1ZE{=hl2 zXY{peFeA?bkKqnRo$xMcHCw601s2a?|l5ECoEq<@*xfEAn*M|)^E;_xae(5tyOP4*c zEc^Noueovl>G}27K6CA5IA<}Z3g*p`Ggac|yeeExtF*hW`}gDA&{(ISprQJjn%c^O zlE0{{y8N=)1)FbL+uGW+I@|ek?rA+~UBHLyXPt~2#xiwnfcxHn`%u8m-xw0!JZ>9zNTtua zLE>)A^!fMPkhk8&EwGV>k$UvMS~vk z?_4c9{8@3D^!oj@+W(?}{mOv*O3R&^zcDKR<|j2`8Ke4oSl86CzT2(##gT)l?(+if zu=B3r7vRW#&MjWt`dPv+3+?vnR=c-(dDZUk1j1ivrH9WZ`vZK7uAW`^97FjQHuh8I zS_FpAqNfqMzY?%t72w|z@ZT(fab)-_0{+hg{Da@pHwE}I_X*RLgMQ?H4#dxAPZ7qK z76^Y+fPY-bIFkRL0e|U7X1m~A17~p*A)h~grEjzrIPy8|ODw-L7XVA2*LA>UdxgOMZ!k|2{e9Vfv52l3$*e5%Zg$Sok@>VsipH6$k_&7S1IW zhv%=98_yTPG2qDMIxMk-<$J4$Y3RhFZ>HWjh(+HDEPcB-lcOKL9b)0!X>oeUF@4j- z!nubW{Pv;TN6t(i3#SiyDW8XcrH}P-^4Yi`#KM0HSk{VRKWy04-C<&0m>@3#OJ6pz zgk@iq)b(j{W@$dLa9$^e4IAH8)YJC^`UKWrgvN#8fIa7uxr z=C>ECT>8F=g)@ixE3tzRi@pvx8lhI-zazOm7S0-|q~C{F^y`7kOrI=6Nmydxu;`^f znppHT)W@)c5Q}~RaCjoM`gg7L+p08FX?-va()Y^ytMnZci_JTMg~Mxw^yLu?XQ##4 zP0n2GAjHDC4_NH<0n52SESyJxrN8)xBTK!)D@;U+iPy@bsHx^u(e+4_NxUiADd3{f{5>K_z+|^jhVW zE1K7>N{qZ53W=MWTGp&+!xx`kZ=C7*(yN_FN14}exArr4Wtv4p(0Qg(qdPHM+uJsK zF^ZR3abh#N*Vb-M++4n@t!>lV#&)C)-}B&$RF7^FI6|i;zUoY@YxT%p!dJC?eZ~6r zmKLXc{f4%t@~amtE<=2Yn>?nZBG9908}PUr)~;3^yCx~HJ;FjEUTC|&6ES`Ij!sF| z|ABr@bXQ7!O9oBsBXxPEG&Gx}`n~K{C_Q0A`$7GW?<8^w+_bq8RbP&}FCXSxug}tb z>YPr~{gpVylzfEulEwJ_B7)Od$z<$_c^*^D?Oi*thZ!aR6ClXrbGwK@zJthsGG;su z;aN$(6JqrAV}B*m+^79e= zMyLbNB)nD89v>~m-ZKbqr;qvK??4er-;)4#`tF0hFm$xX$3(HW7}&Pg2#-s|7>;7E z!Gwt!Kdw=+2$=Tx7%BF0P?)q=iH*_$k0~0eJ^i@-l{xY`g7Oe}t2I=6;av|vERtoO z#l)t&}pr4EM7?jR7@FG;*;mrb}gPY-4*~EmpR^E`dJ8&cXSy&OtY>XOYIN z(kb(wS8jhCHC!=V{Wh?Ex5ZvV9r+~|tfPvo?HF%v)%)PiSYvJ4p|rzkN9wyeYu&3m zuXgJ?>-=1({5N2R|M<=rN2Cw6z&O(ml^!mqg}7Tg)XLjze+}-S*sw}-(8q71_gwLi zi)nGRG4zjPp77+u^VaTk`!3_i{v3?2&cXQV9E`t?VElCij=hQkB9$w z_>af<>+u+WJs$5AsxGW8-_G|QEpDM#3ml_7Zc%ZD+t=*XSVm1T&iY!WgzaT1rNa{kyWNknU_uj6J$Hd%%s1akG2Jbf!hd4rKR^?F>c64UFp@-8se& zx%J_3mL0qUS^W57o*l)DpHs($T~_RaOS(>bsm7>fjMSEx*`NJ}<*J)#*XucFr8 zpB*oKfIj!vp7hh9t|TaTFZQhujdO~B?4F%AW4H4^Fv~dVc;ecfk9g;QmWP@>RN{@) zuJgWfaL@AWbqDy4Mzu<$tKKTBQmm_hamf*kOO9Y%as=a&BN&&QgK^0@TT82QFfKU< z5)D!tjUYx95b9)S0TPdfGS z^mqvK#7EkHeg0^cRRzoHnR-9(p-^IXzsf;Z=#B{sy*8oGAQeY^D{O3YKFE_+Ozk_K?uNI%Ke`Ud`g)c8Tx$LFoCmLT&;8|0>gWd7ej>?_*exoPbvv@Gs z(NB zsq?2U(UEi(VvUZ*)U`+ke4dZ|Rb%?Qd@b*&_|9f(y;FLu{J4K6pY-nO>vq{C;SOti zv{(C|&bEJl*Va>3Qn6x?s|2rWSS8|pmXLe)v*qNDypy$C;yJa`X7u51)V|AWQMk_e z<>0pqu8D&u27G;^%eb)XorcCmCl^&OJ+QQJ**(kBu7Bs6#`%-c=Gc1JqCZnzH>kQc zIr(hmcB{#WJR7y|N+~yW_5Y+a@%cbX;19eqASF+twY!5XqlI0zMg6wd?fd^~lVzi= z2G1Nk0dCAZRrqr8$@-TToH&pyPxf#3pYsZj9SrSpva%XdpOOX-*DQ?V?w(bV;w36ANSk1M`B=}37{Ka_a`nDSI4Om{Gq=MG-y zvHbEK%4$$7{d_gDtwqL`T~|YGMY`r?%=eyshVvgC`gs2rQvCh9fIDd6fl{kxs+#bW z`~I}{M{yTnsbkd19*f&ojYT~qUkQvUSLKhpd?(J|;1wFHv*3HWv}0+<(_Sn;dSEZU z?+euTftpRI?`Di`POWd=xk~p0&r6<>X^Zs}Ic?c@M|bc*d{b@j=ody=sm1y4KfB^w z59wc6>a0hb*%Uv(yY^8&t(dfB`{__)O3ax9+qf?yo!-+AYvZ_gr*Q`>@aOwILT?$}ozDzp*M%XO^XgLh8zYdD2}tBKdYN^{hZl?SWUnf2F@hOcex zKDzJ7{=>%)EjY9A)g`Bwy;AsO(M_AP79ilVc{PiflXw=wDrXPbJa zzGtzFWwA${6@K-=SF`Xf?6U6t-AlGf*oPOpeU-KQY74JBa9vi`l0)#nYrj_p&oAB| zlDkgj5wAFmv-_a)0}2}sd^pK{*EKlqsEm5)mu?&9%seD#}^W#`u~cYXcv z-Rc@TE7*6z@lb_FD*aJ#c&7J%$MX5itYKBLZr6cWVNI1QYqAv|u0K?{y%fI<9#7uA zYh!z&;R%fS%H(*g^rC`aI*E>_ocrU6-B00Jdmesa_}6Lme4zTk@B|qO;hc|ze$8KX zG4^8>O?lM8)wMnA(9~VJx1zV};mdUF_td1#V+zVB)$yz6EhxZBRRs+T=PjvP6fd|Y zzEt@*Y9C)v^D(|UbbRi|1Rl{-haEZA;eAYu3+66d+OQ~I^KlV>0>{ev;_CVH=8lx{ z;XF;+hx1~AH3U2`Cho*lu8Z|1_1HLcZ~s|;Yy1yZzc$CfeMvf^(a+4D?OXBNknbk6 zX!kARgnte@q#-TX(r`T^zg}s$)BM_iyE)+A7I42AaKB@@pEQ_rzo+311>-wy`P04H z%Y%-eV>YyCH@`^|cZ2C{pMZRDOk11rslzc1zqwP(L+7vDaQMcB@ihkAH39d^fcpl^ zooZj_$1iW~F7)`?ePzHsKj7{Txc%}Q70AzMmHz8IzIJoGix%zXcSE+jCE$OXc%%GS z9xny_{q$&mzkam)P#`?Vv}n=(Hw4^I1l$>c^l|)+9iC%zZ1-aUcYna`f9tH{=l4_+ z9;4UQ8ajNJ<~kRv{61~@GyhKn-2QhE+TNSqd&kj%`WU0^nV~?4A=v)LDgRSmdbNAE zNgc-+GJd~(7=FNizL&mn&W{Y90Gnw}o(lhJfPcn{@2jv+DZs}3bM8uFzPpq1c+KK7 zJ%`|@MW=`FHf=Y*r4TpYTT*U^jWm4G!0d0; z-)7mTz3BmWhF2dtef*YG?2#X{+!w<=2c8^?!u)2#{WV|?N0IzzS@wR9>nqQXi;Vwo z;l3A`!%l>MgT-fjoS#t3IOo^kKLJNEHu5=_9mmK_G49mshb|BQ`m5cI;A+wCh2q5e zbBu4j<^Gk4oA3V8oC}q|e|~7b-~P1wxL5w#&GBGb&JVP2T_3!*YSHf1;&imTA>e)_ z;AVMf(foVFX~ORbxIePoGfZ7>fi4Xz!7=~4z4U5({`F70>jM5;0`Bix?$r9w?YG*C zU%PJzxc&Ol{>=gZI|FY2daL>V{ZhOA>%De!yp$I0UgM=#yU&TYIp5kW|J3~G>w}*@ z?OyJM*KU@r7VT~kr@6kIwA|?Yb~YitZ0O{C_^sv7`Z>=_PhOxsU7+gEZx7o2v=?5x ziv#YbJ$u^!xq#bm?-w|~!1?we!pr%-0qMCAeEWP~5D4$L2W{WKpK14l7XMn7?WH>T>x-r1H5_9mp@e9i!{rdyyuM33l3B>n@fO}J* zJUHf9g!X3#?Efy{|BZnA3JHuO!?y&&%X*ij(VufgiqQRKao|Yz6@l~?<9rpN{~ZDQ zMJ7EbaLjQoaQ<5$eG?HT@;BN7v5fyL0G2scN`Yl=iz|U6CJtiZ*N|`0!ZH_r1No0& z2O$eyN3G+W#U}HKya6m@$loG1_3|D$VeBATC~Jv}SZo$h zKVEZ)MPCXmaq-&$2}>-TMbzi$u*9P0Z)^bV8r6m}3|;k*PK`Fm>hJjSAb1#X!iR5DTZ=;!L+V z#KO7K;_$g5@()NXgjhHYmY!Jj*8$7iD~-T1mkO^BWjwhdHxid=%{8_r2`cw#|_h4ZSVCl>v0 zEIqO4-?H??qW_Tkf7JGgMbB^aqD5NIZ-}DCBO5qua4xW%NBO|gR*A(^aMWBmGqnCG z=%ua?lW(34h=qR~IDEP0t9ft?$DRl0b#kU^&Tnbwzx!D1yk~K;@!TVE5etXos>RMl z<|m58aQem#@HVgo~hHr=T+eo3x7E|CjFe}J90?#iG_1BaCDZ| z-%0-GHQqyP>g7S;$bi-pOW6Gu=ZEB&d=U%hu*G?aoWt4~0#xBEwVwC! z$n!oH4oyU_(t1+EU(&b+hsaSM3x7U2F|A*ML*&Ok7ETNGRa#Fh`rD}IjT%BM`Xq4V z1#0#4farI^9j#Vsy>9JXjd$aa&jdn{# zd|1T784DaW|Pb^`lP;Z{|iA7&QeZRItEc#i%(QCB6j-2oNSU4-G zpRe`AqHktclg<`$Ogf2$b2IfOoy4N=px&gDSoAxoH|Zo6{T|@xwK@$Ckz>+HES$sC z^PvnvEc)ZXl1~11lXMabhxa?F)3X-l{Vx1vZSxJ_sHykg0!#Xd#g4l7ne-32_cdrc zIlP9O^bq4lnW171%*mV~eg* zP`w8)Td8py4v|J5OW50?k~NKYl5;|Hh=sGq;(V7JV~1Ec`z_8>`nzxZ-><|lQx5eT8OZqE_h4Y}r=_AMVR}c&55pvitA&-;ujE{wLl$<85f03M* zd@P)op)Xsh^`|X6#KL(EIJ`!4-X!1He2dtGErGY3Ys3<^0yx@?9b^tRIoF7VQwtnj ziyeg2@J$M;z9X^8b4~a>zr^M?V0pGD7S3*RTCjuMi!JhV1r-*~eyGZB)cVIQ{4{WQ zgVysrk~9!Y*pn9L72xQ4>>xakBCQH4EPS3v(T!UF4msm}ESwK5&L4rpn>1%E%30Dt zEc}VU!np)k(hw#85gnFT_|wT@0Yl~hhc|0n3oPZZ09g7zi6!g}m{|g_B{ck}ZZP$8rUYPm{o)?l%o(qBt5lqU5SZwl|AN_{5Ig6Yh z`dBzIsG_%M{c>XdK!L2mR(7j`s$Wj}6mcgR`x8|@-3cnjz(nBo#Zvjhs_7LBJ z9ppZ2@;pN<{6665o!CM4W0PkaV&SmeMj1JT*$aPDL47YU&pAh-68;%rd7dN|{cnJy z9oRwMz$STl%fjzj_#@!(7VIGBu})1~#A36UdehE{MPCjqaj_jrSYqL@y~*}=A>`#;DUSi>F0+#gOX5m}}izangwhgHxVhLMGPM79Xlk>Me7EZmzSwxO`#vm5X z4dirV2U&xy>@Ee>dzQ${J{JBxP(`;vw_3Av4g03?Dw&7=0g>}TkBWi zAnlM?IJ_Lldn;nmv+0LfX%H5fv_oRy@LU%Ath>m5>>zeMvX0738dyhyp9aqF#STI& zHlGEaWc0+MKLnh=2Rq0iY@$B`Jjv*ZMb9QE&*8+Pe+?K@S1LJ&ee_<9S?^NL#KM1{ zobPDPAIUN0Oe~yC)O(bL0l5fR%9&U=93vs+Of32su%w}eoX4~sV&TjOE;H#|2ps;l z<}3luzu(8gUk3doqbC;qa`GS0d}7fzl5h0HqUUu+%8*#}9l(+X-tQ#+>b_>$fPG)% zy-eCRvDo1=p0tO@Ec}GUCl-Ddk}iFZ#G(%aM<3Mr;`tSM#mB;-KFkXbq!?THzbUB3 z28a7Jo`r*4>xd<63^@8d>>%~n%JwO!-bV{wV(Gm}Xt)-7>jum?v_h?%-ne%Cs!g|g zzUx}oj;K#;Xax~70r6laAfmNIGuC}y(Td5J)D!IyLTV3l^`C&8>}wQ2F-g6<|gpB(2Wr3sO?tWB&S&6=E^QLJ6px?vL%w(1*> zo-<0~XTrX|sdWXWGHO|C&Hv;F@`}!z#fY;%NqCk&W?EV??2J&__=a|Rb3S`h2dz!( z0*aeb-87mKf(jOFqh*D<7EXn4O~h`>AMvi*v}zqEk@8l)hgbXNrWKY~aDFK}dAg~! zuUXTyDPTm`K8kn+Cn%b=qJ4eSdNoT{(`rtb{|W3*&%OL(t!-{fXo8pMo6L0nqL8_p zni8yEbsAU`VzKa0m@Q4~y;@;qt!r=b++KBqhsl@LuK$FYvpha*dqx-!n+J7PWq926 z8`j^}v}uF#my~;+YC^4)8e|(lMbbmqlFt#)Y^R zOqrhxN&j@K5U6u_!@Aa%rZ#`#f72A(Zf#A`tzAFtLIW&(eUVdZ3rOZt9OR(gwXRyb zNv}X4EP8x>6Hl`gK2Nh$#Z9ShR!$0m8A(yFiDMxMdqD#~vX%|2)Zzw`jKr#zmJJC^ z@nt3@8am0Bp2h16GM(2f0apl^DPV?x%cl$Sz~$3KHO*@U!%Y_EO&jKc%Q1o2h%<@l z8OAEWs3_34rcbs1QHWo-_|k_5$vZQBH*UR3mI4rq*L0(oLz)46To3Zv#0dO^mjuqh z7Q;r_Sp+vc3xSy)`tkXBEP!o~&kHTki-^5Z;Mw+ePu1_wXb)NR?EM|EZIAEW`Rpbl z_V|cr+bh5W!z}Pev@DEI>5rUggnYhqz}|q?Q$IQt`-N5!drrb+H>0R`bS|tD8l;* zE+R1L$w#nR&0K(^l14p|C{>5-mEiRwb|F-?i3H5gM;%_ z)%%=8ECcgq9Jkg2=FB=Fd=c!VQ_mmD|Iy(%)Gge@xz_v{d-QB{!==ZbSI)NLeeK=s z_O+^b#Xi<=Mhq=Tad3VSgc%HQlhda5sd?^J?J9l1p37_@<`(j2=WDFzj3zTSX8x@3 zr^P?PSMbTS7kWe8S-GPlqkiD@j%vuNwANjA2gk-Dq1XqBvwNNT+JoJDV~MjzooQXq z$FdIfhJN6E;a?yBFm_|j>6&q{ZO_ND@Wmy^mmTZPh<)H5#+*sX@_Q=}*E!ZKPRQRq z@oC+Qs}c=|9L!<#r^>^B{q4{nBct`QlWb}Ci+ zN6L?uc8A*$7|@X(4)^pZKcr_bB z(#8CXcDZ|{eyIGg|Ly)gQtF|;*fdyec3!h;lzBgZy6^Jq{-~<^j6B5*mR&RI{xz>e zOv#OYNOApDV|1HnMmdMGeRjV(lTzc?H9}pnHwOyZ4^qX@jvd-)?bMg5x^8wtfi#`G z|J0t-d(P}B-cz`DTJq5ma>6T#pE|o0sCjO1C1`fCyM0EfYW>-&E;?(aE>hS2NgT>h zvH7c}>l_x}KYYH2rs4P=t{~NqvmiBgrmyt=o-RGlkr(^muq@MF?D;9&VVRPfPre}BkLg}5>Ev8Y!*Wf2?D&Ur`@QRG)2`C{F(0BeYshh28SL3<>>0gyEjfkl zG`2I?_F=ntWA}-DFYZ5n{Md=3n4fNY$%2bRkwr5w_r&*{%9Lw`I~d9Qp1K$8^V(*A zG6LQ{?+hsJdM~!7=2T7Xyr4YGGCIRtfLYhR3m_Zs6WgREUO@|O8i!4D! zMyAH$Dj0g>ytgb{oh$3@40 z<2vyBK2@hqoi3uze0J|2bAROS1d{>KY!W(k-+3{9mYX-&t zQT*oPy^xRKy^xRKy^xRKy^xRKy^s{=N8{elp}kNdNxhq6V2b127TQ}q99{={>4!xY z{s(w1IC!eY5Q*@W&cnpy5KP&_X*V|0gv1dk$P~ z*=e7T-itx}v~MAdo5jaR&}T?8_~Ypb-2Wk)F7QDOcW8L0hIctIogpMc>-6;A3yNPC zIdCK7e;^@d?eXyu{FvriCQ+jg;_`k3nZgLXN2yp;)Ed`VsNu;~xy!B~JtFlIKa-<+)F?OCHMC6s*&c*@WM$pNp{JT4nOkyI%JpbV_}!yuNn_~3N19jOvX>z zOJJAZzahKyOZ7zFj~zoie}{iCWS2bSV3&7vbIE=Q{=rPcPnId!CI9WP%lo=iPh^>r zUGgjE_rwz@DqnPFD2c19T+a$U&BM*EB?8| z{)WT82X^_*9<+rIg&y8?^aq{pwLyR!g z)MY-CUCNn7?pFUmcIjS4?lw1kX`a@BOWWxJBg=2@Q_{d z^bn6FXFu%MTKtC{_IF^H{UO<<-_x+myK}UkBI_90CC`_z%e$;l`0PHD?2^X^yNoC4 z$1=TSmpqp{cxcZ7C)Q&xT#5m+aDS1?=)J z@lxWk+7#I(&nno*T_wV;A)Z2Impp6XF6BH!JU0m*vP+&#uuD1Z#8W7E$S!%d!!G5} zy&5Tp?2?Dyv9aQFn0N|>9I{Iux^E-p@H?wke8?_&=+3H)&w1FT9I{Iu+V7Hb=>Ck1 zkMk}~I`LTX$tIpc5g)QkITMJ7227YD;<4gGcF9BcXQUjuKO^OkUGmVq7ulyRC!X&M znPitdKPDcl&Ohg{w>j*a9rl+T_H>Bz-y&p^UCPXcUEa^ngl{q2XcFwcN_>k|!Tdms##)m+nQdkIKP67_v)u(lIWx+@1Qy zOt|}R#XlIbOa6(l%lk`Ym+n+N^4>4Wmt%)BtZBq^9sa@0z;Dz9Zsm3eB%C(74_lH8aA<8_<&qT(s}|yzmz`i7vJnARTy$E@=84Y~{b1Kc zY;?Gcj*>}&JmN&piU)CoO`PbmPSZJJO2@gry-@DK!JuzsYgdF*nf!lScwU;6xhvvMWzo5^xRY8J9gT9ve<45iWN%b|-8m=w43m9w$v(KGP9!0c_syHTVlGv_ z>*xcAf6eKm@1p<5pKVH@Ki4=Mpzd%}i~nTz3K)03ft)aGazkCZ&PQuA(nvlUGCla^ zTZHkLgPZ{0NMH({Xvz4|km8iL7T_+pNh9Tz!oewz=6N&WM)I6zj|$-5DepZ1n(s;@ z<=qH3r@VQPN4hA88xT4>WoEA@7hBhNqPGJ5Aolkari{NFIvDmPa}gob7eN z7kuKr5}ddp8vXWK&+*(9V>k+7o@J+pqs2*dn-e)lS##7x@UbcD-?R3@QHIA#-kXs-f-}*7VtgPDzt*)Wp z>Kb?z=5P4T=Fas`+W(Q|BNFDezcq?#hTIv%^UF##9yqt50Bi{w#uwt^=qO}|aYNn- z2d0)i#PUGpPvOzoLb6MI0(NBvYyOAucV`iuLZbEZpIXcUo9tgKJdD#5>^e;HhoPsM zXVIx{4uh1l7N!T)$N#Nif^;5J8mTLiyvr#WQXrtycqhMr55l(H>d2LTPl~&ubek!(R~$j z7tw_Q{Z;_?oFmm3*Q8{<{y!#%2GNyfHI$oa{Kvm?Wuv`6OE0I>ZW+v_Z|z1Dis7?36Fif^^RLZ4-U_q4+2S>#M@_^3 zmh^K9`+Y~)i-z)>3BQw=dkV=f^q%y--RzzcLQKk8`TDxzN=U6{n-YHTI7xkTeXz2F z#ZH|@$kE#y4F7FjBYIl{?g2)4I008Ld(qX;0`61nMR%&67`I&)1=jTkuSVDP37N8SgW(+jw zUNo?(n_Y68T6G`p&wb;NiQ!HTSNBw}Sh#3_F-seht5@KP-rPkC=P$tpy=trqU586X zD=Js5u*Yf>WkM=;Fd`rMLQ2Y`#zI9*2cN*?adF{YA;U|rZ->=}{$|2qbhqQfqWO zk^0tJcD=h7A6DCw%IfxDjQsT^)|tRkJ{^(ay|vljkjF5tCA_`9ym?u(ugl$A4$ew& zR)aIdGWdviM|1i5TbmzlE&;t2^ev$806n77eY@SgM?mid{S@f^px;WPF_#bjpr;z{ zJ()(`o=FDAd&4Q;w-=# zvNKA}xwH;3@a==DefRENvL|=aGsC+}ROVU3RZ4 zyQ?n8bo(!X9@84aJB0$w|Lps2o;TbQ9Y&sAup= zlXy;gg1`SqBli0pMr`pK7CS+_)4+2#s|ziGpGR0msQraao*uIzp?lri&B6K2M(q86 zG=lHFYV6*%`AAsFIlkZb9d|)pSy$WR=8q2 zR=9$l!`-pYnJ(|M!HJi#;L1V9tPR0Q8{K!e#&XZPJMe#{E7o+H1@qF}!9nL(Yz_G9 zXS$Ybh~>U!bUYpNZgl596U#l$VuOybnD?wZ_qkZ^I}AR(D_ucvn!Dqv?HhtCJVvbJ zEf(z9&5mvi=Dp{hy)kIM=id2jFmHo9medLPh}U3neG*?p@EsI{V$RNWZ)N>75&vY}mf>_){OX26w#7f}QWN;Ok3V z!6y7V_OSM6gTMI1z4Mvinor!p9b1fG@@^J*?bgb6R6No@IAG6P);vv9EPyYwW=!V^izS)?nu;7W~pQc5d9Y zF}4G-{?cpYv_{J_ng7Aw3xgZCw+1_US)`dO7l@!2C~Z*pIo3{hzgXm|+f?tWdug}J{gTHW zO(;k1{glPb`FJ9Q-rG=$r&-KB!U%T$juk$YSQqo2$bWdmgU$Vq2UmgXkC-DY2iN&M zEVgQd5&Ppx_JiiSZ60HPNlV%8vf%s$EOxpFwR#n6e_>~9?#3X#wHn;9jmwW+f0RWJ zuQ#G^U4l8qdVJ9`zz!QP;=Q;5<8#bhHn7;F9V|KvGmhI#BRVs}cD4pwn=$X$fO!Wv z+=r37!5zH}vk!arQ`{QxyoPVOyvG9OVfLcAn-!vDB8Gn!WX!_s$O{QxgpshDy_oPC zlf9w%YNqqnL~i5uMttGBzJ!lHvd1c6TkYPf1UDp9Pgla!ZM}FuMkxOF#Mkv>+3RYH zB4v3{68uR?tP{^@QxeO=#M?h;5bMM<`q&_rhxKTGVj}CrGuoKQ!qB9qMO3W(tutA) zbqt%)dc3uzAlkZuMVgPoO{O5)TEyOMEnx-fZcm^8^UJxMQaf$6WsxG|1n#I=&p*$k zaPqL|f$x#pvW&K?LsD*S(ZDxU4)L$fr>9T1bcXa5mG`em&#X>oRdW|Es+^ZTcJbWs z)okh9`|q!u$0A2}t-7szaq!Wi8RrX+cwaKyHBJ9Hc>AAA|K;reDwx`T+2v2>Z~1-s zzcu|axVFJ_cE_11H;m}czosVf`F(f2k-oILOPo!36ywWF-YdGt-|RVUXVV8 z-k<;>|L4qAGas0He|p98g^Ms98J9kH$-MLx3o6s^Uxdx&2h&&Fx3cp7q@soM(&s<8 zypmJrFI-%)s4{)w63+L)+=|M{Nd=1*r7vE%`2GjeAE*Qy38=Vl`F-=r_qe12OXlMH z7FVV(pSxng{pt5ruRw|`Ds%p}=jQ)L3Zi9bZth&mB8@m6n~e5;)O^9z=m{E5A>>!8QSSJ0LJL0bFM=+{ECM6YgmRM*eYZnol*j3=$F6gui7&5s%_OmYZzcf$2Hi=xt zTEn%pNDWhrpX4XIf)l96&pe zXRs+>$5{*0JpNXmIO9)!iVTbFQqCxHxAKbY(w*|eKMwz3$S&O{!tN)*Fl3kR`LO%P z;~z{ue$ss!>{342rTdkzj~b4DFl3kR8L(ewxszSGQyfO&-3?@%@u8?+X1SAH@>3K? zrQsh8*`@mg*e|o($u8Y zgk7Fvr}4yZodYDhwbpS)wmbF$wg(``~55CE{|uiNlTaC z7p}a2!0q2MIu$718bv{b7tF=MJe+^T%hY(-w2yobKX|7vTz^BttB{oY7qIy4V7!oU z$%-m_i`HJ}9^g3JMQN*Eig?7Gc)N&&Z!PofVn@zF4cc(nMd$iw@hiRuBzn{YHls6dy zNXL~%%G(47r@VI{kMfJ+M`cAc!gMCaDK8(HK{}5#QeG0=obo<^yc@wp@{n{}-p@68 z&w0hUYh7MUlQ#wn<23e@JX#}{@k@i9q60D9xRAM@TXuTL_|dTMjNfw*QU)T)lQc?i zD%?mOjd^6wLf%+m<^PFBzXjG)%D>X5>LM``4>y*)VHTVNKK$8+;zW28JdhtLZvhEtMqV zn<4?8lJ8nrockIdAakkuQ9hHAd~_d3rj^_$CP6qDiGDSHlrJgxeRsn6;9qkd;D)?O z6DM*H-@dPLW}3mn6Dq)1c9nrMc&OjBCi zjZTk<0Pd3NaEA?`@|R?`lBti?TEaPu7ccS|PE1#+QW;Q4Y!aPgG zf*LhX@DhodZC{d0)a?3Fgs>EO<~L8AMb4Q=+=<2E6G)4B;w#Hv#9T_YPbp5Tq^vWR z3}$greW5brxo}X(eH9W>A|y9r{+xXNlG4XhHHVjz`31T1)LMB0&J;Veks>rM`-~-< z`#^oO>L8ER2SVmS5z<&&=6K=W#p5wvgm^tsd+m6<%G2H^{&T)A*wIk`e`2EEGp=yg zR`zCbm>pq1C=RD!wcBLL;g&7zYV3$b@op!gM7=2gdpPyFM$S1>aI{Fy z(Zp%=q=J|B>n7nh8ox{NGw~aWUm||l4UJX)HMt1C4ZYc~*>7iU^={voIwd^kE#^;X zam8l6#Uf3$CnHr6Zy0M$y~UgO6X|U@`~C32J&gQU<%ij67H!DI^C;U=-0lsh9Hlh* zta$TWGTMl@mQ=ZG4E65G*qzmrUGKXU zJ1*w*b4J^?dedJ0_8l~EUb^U@(dIYDpHn-m(jV>CD4(>?YKFGktL=gUkp8(x0aBAuY`acX^rGb2aC#uGumFi3QO$31?!m$B!N}BP_oFZRDZkA1#@$=cXK)T0;-D;QEpD8e$B_O#=%1}C! zsEnd3TF?5uHLi?^+VR4h^wd6gx5~RkYWJdVLQzQ>-u5(S2g|VY$ZvL`Y~53f9BxHr zx^xq*Y%^+G%ULR?ORaX{uikM^<_qQEgUh@}GY)4RDm^&u0PQ8^*rCvy7G*l{?z9xV zpRQ?x-a3AroE2<)mrZ;f;YpBD$?1@S`Ex3d2&-bIP(Yl7`+v~?qHN}|!N?Cq%S z2ki73-Pw&k-#*9Q8NFT3Xxok*BpF8hn-J+8h{n|JnMPY6XN(a@pXgSyYm3zT48(UlLTE?no%e3Q*>j(T1_7fy+=a7`lf z_a~m|Ol4kZS&!3*4c!QKGoAWhKDxEgI7J*7>Bf^idMYtJ4^y8lwS&Fk7L2p~e;QKT zotFj<@7c$x4~H%UyB9Lh8@EC8doL< zZ-tUcq42Q)bpU-;)YEb<(3ZqhDe@3pc<0)XaLvoCE;G@X;mq&8y3DEZF5P_pF2ADa zP*LI3?Nc*KpTwyPv>;OZn7O!L-8&&@0kzR`xCqvF;27om4wkl5BYGt z=?&NHLCsy(Y*tac6ZwDMU$upoZa}-4gEltJ(GvwDPh-bR>?^rL|`FB_L)7OTB&qi@q4C2U!-s&RE&5?$`CQ(dluu0zlR^8^ck9PP0!R_a}IeFYhC*ZFZkP z`AX@yV*Z2c!zm3cy!06>FNRhj&sz4dtcC*(Gw@b9m2UDO``3$e?3s&l3~#dgMj6J} z=Ampalz;9ciLBV9nmEnQ8}xQ4HIX0xefjI`Bk3KkuDz~36MCprjh^lG?T!BOqXtG? z55~GSKkB*B*3p#HMDHwBF)N&E^wni0x@vp&MchX+*|A%*cSqNRT=bT{X^}&YdInCs zfj5jj7S&d$Z!dL>9P#h4J;dK)>)tXIS~p9{st+&S!OYMmJ6C!zhQ91Fx;NY!$Y^w7 zIP|$Q6XD12Aw41^6d3w4>#poe4WA)Dl+x0Os=bstcV;6C zw6!~8P3b6{O0AyqW&F9EMx$*Q^@Uo0nA4bDUsOdMEkf~vV`;iVnCUK?$^w**bqSE}DMcA3RAI*oOl zia;5SNkqHMa=csC-CM+rzKqb?-A1VHNWJl=rvuO7R7RVs72E3Tj^Lf3^|jsZau1{4 zZtZk~+jmqBt@?B7ht1S-dRg-H>C;^YR@kGS(Wl0U5_@!99=hCD8xrq0mi7I!Pk58+ifkezN=)JQ8g&AMlP(zN4K@Fk2q#j>r zdM)SVdy_-dKRDjrd1&|1p5tA2zdM1SMsdC4I_~rNz4e+QOJ zV1Y}2f;x3Ha<~2N&|$OP*AyA;jag`Svu#%zp~5wT&^IRW5jKo%D!!)(!t~ z>>r|Qrnpq8lcoU;0qxOfQ#nf7jjiz(7~QHApyx8uQ{y#UA9$jkrRU=LXvRT$!{TOW z3ofoLm>vW9k*eBkhC_p-GWX>heH0(+H)(`dIr1CK=S@7@0_=yTLN0@NJEao)E7G2=;X%S`c5x<^uzUe2`HDA(`>lUpTImn zvTGB{zi&b)>Y)^58q^;cp=4jq)9zwt3QVLRQ>37;7W%t04WbNH%cS-wOK@9#asib~ zZTGr-%5POVs>ai3@pWZ7aLud>;T&22sUcKq0hb5o?q0KNYNS}^g;O7!aTxQt0@oo? zcQH;k;=Q~Le1!1g7K^s4W=|U3@;VDP zyp|s|Q|!?rzHJOt=HV8aSE%vbo*7Jyl-8b*{Tg2xLF>2T*yj!vq0MY%s`c~Upw9@A zAHRw8@ScGFzj{`24HSdgE@yucDUo&0*>lKIvZv{$$0lP%WI|I;{fmPPSGdMUy-B{P zed9)|cU&8NC-3z6mKDFN>fTY;v1E*`%iJnHRQHUcK-;}&wS$;@3*}`^KJwB;UV48K zmzS!)H%_RQ+A-BRhSrrVbBC8+W<)(ya&=n>0;d5m-cXzMdXXkat^sJd1XL|2A zJGH9xXle1ymB;}xTP5wRXD!mbCU?#DhMa~-=$mR^#XD8UiyuQBY~0z1*1L{Ivp|~< zt7Zu4bWBZP)Cs(^kzoYNr={S;(JEI>A8HY^;b3Vm)`pCe;|EU-P=& zursc%-)*-VIu~3KG1~s`t1(nx{`%T7P+j@KvW7jIc5m(3*EQ|k8Sl(GKKoc<<1Si5 zXqxaC)seXR(U*uCKx5^il#Ix6y9S_r&m4=A-el)IpYa@W9UjY$H_TddXbsiq+Ai56 zsF5tYeu6zV(hQ&@KdWeCk$386cT~(iG`sN5xu|(GqPhRUWIct?ha*^tx}W*~=snZv z#+p@~J3Y+qXPtg-$2t`3!X2yW_p>xdh&#gIJ`=>@nJ37W!sYziM)12?GneY*7A=gl zsqOis|2o@Qt=-P*W|*x1{-IoQwC;~XVt-uD{FmVU*Db#?qMxA`LR|cA#IdG=O$f*Y{|C3(JV-sQj>bXchO5o;7~tvfDgHFrROB*NmQw-CI#7XgoP-xB5dDt#lb}svT48J24Dq^OPWbx`U3H|0rsT%PnDy3^Uy{hvwoK>ac0J4O|(xop85 zc#Lh#ooT{Wg8eJ{#p}Ht&~vj%3x{4)+qb>GE>zF_XH%JRa&n`;-@`{re*)Hl^MA_M zfw5+q9!@z$Bb>g&< zM^6#=YpnLf49B{u(7OF+%`-+f@(%0X&t$5yPhW5(7e+8T}X zQPKpu_HccI`@@bM;!Tn^&BbXmS{NQop zSMZ0B;g5JoE3ssN7xuFhqZWz<&Rqi5_^Tw_r2+uKO#KeoN&ue5r%KTILP>5HV~)zPr%o! z#B6#SY5T}!X#IV(TGCNZy8aBi&&Y1fut$TE-D~q>lhVbAO`5(pe#G|UtU{PUH^izI z@)I)(l1OubX%2}*nZs*>tOxNk1gZz|vjKCioQcv*MW1Q&IzqEZ)Dfzga;@Xy5iz&v z>)Mder~dkOv?wJ}Ye&u+YqU+clg88Ib`H9;24Plsv&)4smEt;%&BADzWsR(|--D*j z%Vgk|LiytuZR6Vr<}qK_0>5rdrafnxW%@C{N4UMBE@atp&aPMXC`x$m?l8mpDQ+;= zGhTxAo7u(le&-s2n9Ke(Wry7mv^@IBaZ-$y1ONZJwSwFxS{=x)cO9a7NFxmL#>>*F zzD4;elgx3NOZuyOt(6FxJ)<>08m#8KXE^t;13jj5Re|P0$pw$ zDwlFgGu&cN38mFmRFqbp|Lj4Ti`(-jh6E!cH+7` zQQE;{Z!@BG;#NAOL(6%cHC8^sXCv2PgcPf7d8u6~UZl&^56O*uZtiqgSR@X*C z!B(0j86jGgpgvu#`n$I#y6R}p3Vph@PJw)qd7{Q)s*k>WT6a`^bNo#_S^-fs@H-#E

^*Yy6*UFs`zH$IP91xDKz>_HMpOt+GejRT;%&>b(tmTA8+r4z}S=kQ_T>JGH4s;5E`Z_Cza4zQvqdY-P z;w!B@2l@Jj>Ys_1dWU6CQ~h(UXeb`FVq06Jr&q18@KV9bKr2E+N%3%;-^d$iy-aUG z1Fr>_c6DGjqSl*uNX2x*2j_yE%N~Ap<>@ z)f=s7;N=B-AJyMEY`(&3ptIXw} zbSduWKWIFh`r-Q6nuiK}zS~FUcHPu78(ROnYi6uHVC(!FL(VfC*hTBY4rYo6@g0OY zNU3Ar#wem$fBUmW+r?w^-A6^4xDKmQq5P(tqP32Wrg16McdK&QMC%pQ)7-3P7=iRb zs7Lxpx1G;FX+K$|mGv^Lp;Z^2u%jK1qa z;S=rXUu0QjHp_lHe5T#n%T>KL@ydBu37g%u6{{>q`5avK(VNN#&ik*c_osV4>Y|!o z^@GlcRrk$6`e4j-d)XeETT)IxwusLhRZb(9`+IQnpOS|gH&^)TJlU`x>6(qS0^}6pe|BlO$hpp$9+iMX6x6X}a-dm`J z4%|2V6?x>SjsLgiQT&Re-fn5Uw)MK5=cKXzK4F?D4k)~8qz~# z-Hj%;oQvOdVxq_d~cK?|Z4OQki$ z*VfpVn;ETLhHG|0!{YTd-G9V`eZPHFXH&v0J8`n{b4D=?cVYCe?sqRs-GR{;d+BY2 z(4XQ&)=&8V@1_2sJUj<)@v(M%7NG~qT0^mvDJ5<4`>Yaql!AT%C%GUOu}`F0D|y-* z3up5)WU1XOFnlvpd1l2h1>X!t{QT6WTH0BjIo*T?l1{R@4f&CWGJxCkU~fCpm12s% z1u2@oxVa9cF)R^t&`V;cGL4e1KoXsSpwd-qPVt(WoFN+BIi#lu<)a8o79cO)3q~DaP33)FPxFTaw=y>ALXe zRKC}2QY^1+M(!d_*IK=z{~@eo*&3ly>NkHDrwP(Gn{{3An`_j?dLYRtjn@R*rXt2d zYjbEs2F;KWXG&!PLn^D0%7p1r8l#}Sbb3*b*5I5PZbD-`K);7Gcszo@=5=O(y2=6OF*w zF-Bm3R8icbD_fa4gd(+w`Hjuxma_(ICg4xTgEKJ z;$u|WMXdvGbr2f55nYjrol>mKby;!pAWro-od*pXb(;Fawvr-0wfjC_Nq9~#8`|vK z>x>o7tHzxn&|?*^>l#xjH~f`2am91WS&}n$7dGvxpNyWFR(JyGUm%veN2a-i;eQ~N zVa@6R%yNEL&?ww#hk7e?I@K2$ZMPTkUg~!vON?JxJG_&|JN9b6X^&Tr`?R>dUA3B% z)g$szoa(46LhSm7^L)g)wf-?Uwbi|r=jsWSQ_1<+jkI2-=c#j5NDn_g@0@Lgbj=TG z29QV^P^W3ErT)mE6}m4_$IrC4{-kzjF`Y823C#@0 z-RUIj+&~h}G$dixorLpTm_wA6NiLtV;RMk@XVZN%;Xc#mSGL>Xe!J~%+pvC!TM5xf z>l|v8h>?Ml9rg}{|2)ilwxtLyn{tBlA6#Vj$H7c zJv*deN)#u0!b?xH8|M2H9(csM8`6{HMf|8QXSo~euJ-c2B?ax+-*Du7^oBI{Orm?w zKch#=LhKOZ8ZYz&^9=m>;3uC_<$r)~g(NVH7p_Uo{;FK&Z+hN{HvQ7@KQ=fi+VD#= zcmLbXIs0g3H_-eWx@GXA{vmhQS2TthPVMwI8#qsq4}D`uMl-$NE*o!IDvjK0_q1-} z@N6!)w>7ZtpAnJ=H~r}B+bekIZ(!YE_99$oM-GK5iVxU+xQ+oXthqoFp}j}-ekr2W zZ5eF1x87pRwsV?X&0@%jbGi3vv@*}|6p|q8BWh3^{ntof#7Q=m>izIclzar1aU~ku5CxU@EI~o4cLnuSNGZ_$Lj=>R}5* z-_y4VGidU;!sqmh6QqcDE9N)24{}1rFg{*dXo$%-#ZJYT!s>Cxv+YnQr=CXp?E39R z!N}%(D%HYJd#m%i?v$@VZ!Gu_#>nRVF(neJqGXykDs3Dm{S50?57vCK zyGVPBqK8vooj>r_p(98C?fAdG`~RN&4SMzROh%{1>3lQREgxG;<9_eWeAmS9d6jwv zF}vk4+s@C9t5tK99O|F@e~)2>rO#K+ewTLH{N5ij{~fuk^qt_!9k?q({==+;O{$`` z;DzgjhJ|&9YBQO}7~H~O|Ac-RckWW~^whX%rFU^NRwvMoBUqzAFJ1jZ##?J>pWPNjQtIc5p;~KEL+i@?a`jV_E+Nik&)zj5Af(8A)Wp>WC4j zd6~Ur#8Ves`igNd(GI!q?vT;;k5M#GX&5J#--%N?d(fBlKIlfueg2hu zh6HNfMBQ5Ip0*LY5Ns<8487MV!OD&5y(>ad+%j+-a~-EyYl&~%NIPV{o`%zW_Pv3M zna;8Zq_?|x`WvDNrMNrSZPMn{$&rMayh8pZ{zXL5ay+Pm0&VUJ=p52N%v9h_w3wE_44 z(ZjhzuNZ?HMW2_Pv>h!iUYDa8>MJx-`#ouWQL zNA4YxXug=7%mRa7;qj>+9>u9mv=;LXgU%I+))Ji6z|1C^T{zzy(Sq1e`H47Ct8m^W z4UBz-_j=A))fOd&0@<&yK=zFohiAl<3h8t*zXqe`E#>`8v^vCU`@qj{7ijXKyPLSh zq*6`(Ym5AqSa(2rkXO%K%AQD~K0Z8Wl3|7%+Guz7WASxwbZvm@4QkPj!_63ySd3c*O2Z2&Q!mMw-wSDqVo5^ zhUjBsSfB=H62-Z{%rGb0&0gxi5|y{dLn46sw-ICV2& zO?Lh8f}F-hY-rVFJ11#1Dnp?*-da z&UJ0VISsk4Mr$mcE*iULagDgAuoEMhIvFW-UOG<^zY9XAibY&e1F)`-Q4ixG-Zibo z93kS|-u94dZ=UzU*=3v$Z^2KPYeW;$adO-+W;lAP!YPzezd6^~X~&szuLa|BW^ooy zWX(04sp|;|Zduy37;&Us-3QN#+k35~`bWLpMfoRvQp>z}3@L29>9L)-Yl~R}Gz4e^ zw3m_S+CzQhgeEGlxRY{y+e7Z&RO}mOpjV<*$6lQD$YfWTgKNV}Ni&~Anj=qH7S@#y z;Ed#P=b3wGJ+mBjYXa_sEwpuQoSJc*Q=pbbtxBah8!6EDU}hhi@ECSsxNbAoE-!gP zd|N&3gvcD=H~IOgZMqFGTRV3|<44;$efLzJ-F2QImS@pIUx}I|^{vvb360ZlanCf_ zwtA!I`N}>z{Q_OdtfKX`EJyt{`VwhP8JYl{R8TF4&VMG~S__?x>PEEMbLI+~5n+Vx z#cBJ}2BBfmj=wx{tMo2$4nW3bTRrw?PP~RWtW13YFpY@ywhlVia`6~abCXgfj(@`f z-5#F3*P0K~t;jZvUR2g}mgR^CyCRF5aql0R&LX@WP4%^;>rR+TdqSmlJtoceo9+Z# zWj_@+>s__o?yRZM8>T`RmZ{kuBB`nmFxvL!Lt7j|+G5>t4|5+MLvJGZ&vurG82uA; zAL`3zIo5HEKBH|dbn=&Rdq7GRS~;EHD|5!bZ^BgPePYtFuOMBjr5$p)7Dswp^+Q;* zMJ+ngL~C;i)PkI0`#le_!8PIz@fDTf{BmPxWzPWv4-}h zcc7%Cjo*`+Ihhquc+T*lPhFAZFVANFc~~>&a|)SD=qJ!eo9t4o2a_Fo5({MDH^yWV z|12cAsg1~bC2OaYK)Xtk&*U9*lsv$+ZdcHj{RgI^;StP_x;twNys7AIx{0 zXYFvt0{;2V5PTSI(+i;MhSaLA3?FYcXdqhn%pSy^_gQ?F)J~&Rq(jw*(Ej}7F4Y>` z#Szk;LjkmE>ThX9IA!YBhe5Q9!>($+0@7Pi%|<1-3ATTG&z8|s196*+Il?l%11E{~cst<5j# zT358_;Qst^2iN6eQTYteohBaEqLh|WBh><*0eu#&yL{ito&0aoMM*X>f&Ay$bv zC9%aZv-w0X-9LQwNS1^LaxKqnrG&ZOL6Kiqy=o6S@$;8*fFR_eQcpU)|hD9<(SvJ4);lz z*SyU3PgidDyF_zoN0mlp4{TM~4_tcjQ{P+U};mCh#KKk^sG@%I0wI3Bww zj@f@{97Rt;{Xqn?;-hSO0aj74t3f)^QJk9+I*^~Qh*Cc;^F{PlwB|}Zud_7hM(WO{ zT>2^o&ZmoV38W`rKIeRU5^0h&!>VUuzD@Z_BP;DpBYbOT+HdZ=(9h3hVBghy>H>IA z(7hO}m16e0lljVM6lg>_V}1tLp&=?68f|sHfLhfZ2SPXRBT33bCew^kH_1wncT>&Y$I_bSC=AJ7~6BQ6y`5+-ZtF zSGjaoGbdH|{{r5=sYrV$6iE6BM#}DP!AR8lP#7uq@z8pQzjNNoPUDR^3cpFxD;#L&3I_@_=`cLR~|HL*Y(Joj=H{s>N?(@^4Hd5s{7OuXheCLm6gznlo)p|{g!%8vrR`Whi|=Zmo})| z_*P?FD)KG|%H!M;@0=Re4;7e0ApW)MeO}PQ$Kq8g`x20_mei$Ufe+N456& z{3|ON%tz7WG8$#+el|;8;TUacl$$UG8g0sOU#Vk{gWfTQwe(b3GgYsSJudV}`}hdu z9OL<}R~pt$)39!uhIP}lYUCaIPwf0eSK+21-2zHDhucXb4D1@io`8|_3#z>d2`%B8 z4;XR4KA!CU`QG%-1l&`uYlg0Uj``1-XYxjpuP-3seMUEgq6u^}=p4fnbFFib1X~Na zbc!2C<2m(x6ZeVmZn3(-zHm!|5k1#GBua08Yr%K6LL-c5E@{As(W9}mr|5o?x$JSe zoy0?JHI3Th@N^TL9V~B6R}Fo?iPmS@&1~<7wF_4VCn0skBmq8g3sU%t6-(|vt*`B= zEvA)6TAz=d<13(vkcpd3;gp|3qrT9%teH-S+Mk9iHEe)@P`0{qkJIBn&j9)b+iT zZS>&1l&BF~*)MB@llJnQ`@{O&$m*J4=p{%uN{qH!e8G@u_;FRuKXN{mhYN8y?_Yy= zBc?vMenRW_@TSY3V#O6Hz)kf8Ho0{qzLDozvka-lDx%A1yH(hrj{tj&w%;UtZ@qs~ z8dlGYw*Ts@PpKc=)<7|)8rey2s9QsCsCysfL3VGtRTCTN{c~^O+%#MpaEqVH^0dk8 z^p@4A)2Jzavbp>H8*oSOwymshL9F-~i}<1) zX)N|@)L*dw7WF{*qV{!~a?O&8P`RYHkh>&dpg85Boo!h?7;!qyqGxfFFM(ReX@>oY zwmfP{UXtn+t=4PB)hpr$sa}$bSlcN@N~*l+aZ*>F6;g2m0&#mZcn&uKz0CX+b^R@@ zyuZcraON6!7cT_+kDyjl3-CXMouLt1+2{q)+ka}r&YDK>+#dE}o$;&ii4n%GwLQMz zsh8MKs@`0WSo)Y7Z3?+WExfa#tM1QfvCp_9ymgaW2eqs}sFqcOcct={CC;#*y|lcK zwiR4;iY20TeZX7SACRk2YF)CW9q}4JsfwLD!h+|}x_%X&lWMfD{m3`EGJ51Ce5-8} z`wik!i#gl~BUtSOte z^s-$W>t6Cg7H`ojsYRbg??Ljma(UEBqF%^LIC3FaeU!C7)mW@p6C`|Y>(H7{v4-^e0D3JMC<7YYsX7CAr!-D0i&(G z0VzQZ!Tbb0D&NaYImg^@nYVS7E8ErjT!G(* zJ2`8XO)=UKA7~T&-XD578V4ErtXn~W%`CNN!4^F8q3_TsV>(A+hSW^P zx7X<27g1-aiuM}N5{=4Os)OCDWTCGVtwM zv6hUTS!l&7*4uG+tpu|Hv8!9#MekU4#BsM4D&9EQY=?TW+zT-GS1w;!xjejRVdat) z=)~{_3GwX*deXN8&?xv5pA%py^x@*m)5qsup3a{*_{6_a23OnAcL~z*8;@T;eiFmV zjl@L%TmC}dymX!%{*S)T_XJi>m2tCQqzgpfz%bb5Mm*hQ|1>)Odwqmw+X4iAorX_q zxR45n8^J%@{s4r)CoC$%{F~%oPKC;iz+YNspdg)s#!ie;3()dSdxI@GH zG<;ISym9dWgnasDyfeIs8h?p~uhj788h*!tzp}oKCFCct`1+T~%O~9monfv>`7=$! z^eru61bw}P7XNY$tMU;1^oNrPipeEYxuB+PiXiH4XgGpfon9Z+Upfsetw7hUt#kLT;;&=^=mZepJvkqR{1aR z9F5+f;a40uUOrAxjTZWoU=et=%`b4V1IPQ%YNu*Ai;M$4r|p@J0>K(y%ID!LRyPfgf@3XIb^D0y>Wim!~QJRrw44j~)C(SN*4; zPqfQR;At9Or{OLQFW2xM2aeB=Yk7W*vg32DR$kxb^bDIW@GuQmXjtWs;Gg55$A^C% zm!E6X1)iYc$qpRvKgj(neu0&|pq8FVoL`l{!1cC#fmL_{tMZ?u$;;#NRDI6V=r?e> z(kBF-V}~d3-5M^^unPYMP5$3;`Dr%4z^c3iR`UK%^Zz~WU+G`p)9Bx4>#f43I_qKu z8ofYEzrc&^_z0}}XMx9SbT$4IutQe+S%Nz2V#9d*QT?&-zd-Zfq~Q%3KBVE}4jf;f z{)d*n5Ko^Pe*`YH{R>>`!13~?aQ})f@bxyoz}qye%3IJ?e61X z`2|+>Ti|?+uIh`R&(r9tyryd5-OPStRmP9t$Hi{Z=(q6rHU0~F zgGPT+!%9C8{BLM)YAcoPIw~pURJNj#YjLtn?p& z=h*QPSdEtgQ(X~8;9U|jf%j-wwO>8Hw`ut=u*!ddRsIXC@?YTdc6b7-{1;f|zrbq# zA+XASfmQl$)AIKYw%7W$`X+?wVs~ovJ9&E6+wl=NSHmkctnycv_X94k*ya~lm7l;5 zX>=t|&{sI<@$KgxE&g+Pcx5)fz^Z={ScNCBl0R3I7uIkkm#_L`fmQphWH}xYIHl3W z=5zifc67E@(?&nvg7^Mq+hG?OW-*geVm3>eHHw-YxMUttm=#4uh-}*eS)sa zTVR!5yltBb+BVfZ{wjY3UZ>HwX;_Vig8w-OJzo9;T>dDV{(u(#gPgANU*PFBzrd<~ z2(0p3;4d|Pl|O?1jz<67f#c)*Lmrtflv1jsB>HYcyP|;nf3;dEs|FMQY*6=0`Z_}_UKOz4!2R%N1ZCd;UR`C;9#ZO=r zKY>;J1Xl4ASjA6Z6+eMh{Mxkou!*f0CL(_jdFEo9HTq^Af7M?KJkd_Cz^gT^`ddL) z?MdJz8vl9?tMU~5?Hc`hyL<&*jYk5j^>Tq#eG^#iFA1#nrvz5xpTHZm@LtgHP6v)J z|E*enzQprW^(O+)vC}7Tm4?;$Bj~Dr2;8RepVaVf4Zon_CJpy!_;Ux2PhUGvj~ZVD zo@Vn4tl}^5Dvdrv!zw<4f00I4@yFMoJvI@RS9pBJ*-o!$^lhA;Zqo%;Z2b`8I4pRW?>-L27AYw~h6{wxiT)9@S(U$5a(4VP*7 zE)D-k!yh>CeF1TORLXayng0`CXB$Uzts7AIKQF`oG-mIfmQ!0@FqJx0@rJJ zo918XZ-RfdT|Wd?^+n(YjlN5hr{=qY-)EPn!0LRRz=s_4WJ?z5ST1&)r~d;jyj2>$ z#NnUn=O-Hdgod|k{42HmQRf3i{Eln>AJX_wYV?ho{4X^6k2U%mnml#BP=v4ApTHiC zU!6}B^xY16eE+zc=jU*{yaZPIfWY%Kx*895v*)b+6w*0eY>!sI_i*`2KNk31Tb{tH zHLS)HLEo&=pVRO=8vaVdYCb9C-Du~(9^bvJE=_pejy}f4_G#(a$I~;>mM^fXX3gys*Hky$QTllUJo-)xQb;Ra$zs zYT>K%t%Cm=?><+8FQJ>;shdF`w!#QpBcUZv&9?;oM-F;?_+orj`onQ8e(&)3ss2siM{IclEB^wk z`HH|QeFC>@{u?x`#tXs!g+@Q1;gNR#Aoy?6u-Y#abhSPr@C1#&MZ-#;5&WeZeU^qd zX?U}Sm3}4Uy{FOlYWQOf_h|Sl2aYe_cX|1#`Qp1;`JUi(HD3}~m8ZaS?EDsZrUS=^ zcaqCXvgs$a@ZRI}Q8r!RbPeY^aJ>A}-2Wvu{j?_k11dytPvH8DXKd|O! zUbq?TNKdz{y@WOyb$sE(n0@tm;jUUaN)Y|lu-gt;Mk+-Pa^#j?fzEaox%(K=lQcr z!!K!gn}*eRDEzDW3)8}ParvtMa2da~;-5l+W4-2j)ACPXm0p2W{^|acxc?1ycmlU*SoH@nY4{Nbj=vvziB=!P{fs0# z3IeMshQKt|2_x`W39b7bsyz#OnMN;UpB8krelBo{#{ZEff0lzDKc0yD4XS+#tok2;Rech8y-dD!KjL-`f1+Wv zeaPS=`i8(?+9CwTKx-L+)qak^Ng92o z1Fu4SillcdK9e1E>Mzv%RmdyS=p`DS=D_j&#c-{^5c@%^?eGO|ap3s!73)`PZMwiS zG~A|PC13EX@)!73jsFo1KcwN!4jdo9QM^10ZMwjdHLT(*=*13te12VS#N#V8e5HoJ zqv3Q7kJfO8hQ}Dc8Yv=k2_D0+P`kjo|2P(HZW!L@a422Sk8*k<+ik7CzsB((_J-B@ zlTJR24Q3Y{?-NLY+Y=U@%3v59!p`6+4bc}{^!>08V?&u*TNXOx19o2^@c*wD2CY)@LRCb}haOHGE79f0&lue<4AZq43|g?nA7HeHgofeb>rA zs?)>RcbHep&+l5w;yz9v%}&^Ttw_%<4G*>k_ZH3{U{7oG=Pmiv=L}<+>?SR|+H`od z48`|LEx&%NrT=QJKH+7cwjuw=Y$W1)Rw=){JesZYJUO0coF!BkV3cq3OyX;Ta`C@V-c`Gj`8)MYQhq3EenT5%Xr}zJ(?(O5O zs>=TVeSiTZ)a@Kp1hjELLfU&oKtLiJ2oQ+~i4e({X9OLFaTpMZbcEqSLL)>nZnBA# zh}+u;5sA!@kdU~E2#L%H4b6;<%#^%Mzn{;#uIrpNn={n?{eA!WtrzE<_rBI=UF%v8 zd+mp_IddT?2!`R6AM^_j=r(Q4Z>90BcKKHYn{>P-o`J!l#Q3+qm?eW?0bcpR)xpPg zo9Ep5!N-D5x=juJujLQ*Aj$so@t|I}X=DDY+8%aue(;Il2Z{EbO_3(z5ZxC2Cxbs~ zdnY0e{FDIqWyz)yVm7j7j#JE|4G{~^?fRMCea@^X#dr@@}CJd zcLE@FbmM=0@Jn6qXk+LfX#a59gSFoOx5*D` zgG#NhhwH!Ff=-G0@nd+I#QNUpDw{j-ksr(szNOo=GJl);x9!7PUgq=d!TUO&rM^3Y zjfwgFeq#Mys{W_KVSez%peRw_&_sRXo7MNF;JeyCtz7xLf{K{a5>g(P1s$j6L z59Mxqb#P8%y_m22|6G^h4zgKlHf`L|~s=DYl@xWZzNBzDCsIv+Z@@z@q{9x%yzwLQ2_HUl;@KX@vb ztMTJcabo-FV2AqKt7tGmmUH^yI~`Md{}AG{cJP3Vht{)}|~js_pm^@|=@{^G>^dRF7B zb^2q$mlN?`lPKR`&{o$&PSbo`T};jgAj$lFGl+Hnm`)(>(gRdd$J~x-F`a8j0w6Dk({{nDVwUf=h5*()S zhO`E+Q0EoLG1NKqC|UQXtzMIylsG z)3?YvPv0Z6vys|j%tM_&yvJm*am}**Rn#Yu+a}{Zg`y`*N_AT}69$DZAFwKTOuK zc#N#${xrFV=y#JZ6Xrd1tBcQ5S--sqwz`hf&dG~(!qdF%@w=X$_d&yth@R`E#S@Y> zo}T2(MZ^2{Rxj__TfKv5*R~8J>-diJG-GJjF`7VDpOZXIDeXEZr;#;=`JSHl{>{FU ztn+6rS^YPGEw=TZeUryqJk3*{eHU4M?(sDHJ%$Ni*d=QE<_rz2VQ?8%h+ z=em?qJC~bOZ|34!4KK5EnMi4$aF;eacgvLaGe68;K-PFTjm*yDb4vRs^6XsS%--L# z5Ay6oJbSTcAMV*ldG;}6ZR0pkGr_Y@^6WQx_EOJY>Di}w_G*u7J+Ak7uE+B|Zt%F# zsV~?G>?+i&nAzzc)X3QbK@z`zQeQc zB5Ry`Jo`Sf`aj^=4|(<@p8Z8~0p5^~;brw6C-=e|QX9O&*rB_&3X6n8+OH7qOztDx zgM6iML{`lJa$m7uL)HVvNKeD#X{7q`wD-pw(qz2Cs~iU9WI98-1uyeIhdhwhAmDK` z9ON)qOje&wVk67*Xo_#)9%Qli#v)toV9~ruCs%vK`Y4!O^vNL*leBJ*R1;7cQM>=KvyIf|vOrn;({qK7}_VPM36F&Mslo za7fG#eMX#=bsU#KCM62LN-6_J}b+xtS+)?*#EKmp8^g!I7kh6h1Zkh zoGRU4;#`AmE4vXKYS~@j^i`rEo2COe`Yhg%*jMR+q9L2c_4y#N`+d%`=>cLVo1T4` z*8f;UHajqgCh}eD(*NA#*L4B%q8psVjZw%BK@ z583P!z~PN}L%Ins^TYX;{)E&;HocoO8gp{agrA2HsXtyej$|v#X%Vs#Bz8gg1&2YY z$J~$7#ZoWX%GQG;4nERcyy6mvZVgEf75$wsnSLcWJxuImvvY1lrFcW)zLx%^Xvn5{ zly)6!ve~!N9*Lf8_Fc3O7dzSP`)OA{WV0UzM-_NOdI2x%XR>LI)2?GpHv0*1to{5J zH6x^6vT5D}N0oSE!ue!+q-e;d;rYDn`((3U0FJ7pXaP0XN?EdLdQme~G!Zy16XrFd z#Y{Fm&*x2Z6E)iBWYf6w`Ev1d0Y1_?$H=BB0Eg4@hQxUl-r`W!?OTP%&|WRfsTR%< zo<^<_W_CPNxQ=#Z&L89Z$hD$bjgLsViT2yX{wSFakT&5J&vJ;nK(KSdBJIX2ob3>I zU%+#O58@-fUHAy?TK2fd9Me!W98+U{e{TIuw*GO~W!gX8V7IzBUTN+$NMzIZ0Y}{eT^ z$Yuuy5eEwC61>tkJ9KOs#u?ou_CD0)IDUnvvX>i&j=jejW?tL zcp1AkE_7yD-x`Id;3HljT#1ixkuaN)*8j{xwz`(lt}&C%zLs`f!^vjf2sZyasrj_D zi)rai@?@#V`>CZ?! zWGl zt`G579pZof!2Y1{5qyMS7e0oMc$M($_(+eJ_{rvz>xQ-WUGf^dF=1b}vb=vE{)d=5 zdG;>gG$$7l*?jW*1@p;u!^VzmnnBcjL&|d9i0>C3?eSRhYO#+eYu{c1Q~I;g7P9&5 z368!g`rgz`5DnQhoRg**L~gw^!Qr>@hQzrVYrVIC z!*#Rp%*Qhpt#NHy<+ZA~Vdf8JZRKH)iM_@wyZc_#jtnoB*Y`GK%I&s3j0 zw~Up!=A%u&v2tE6e-L(GNv)3pILNBb#O(?b^>| zvo8QgKa#S`z!v99>h+qPZ2Gm-Yh9bE`Mk7+Y?|%hP}{=$&+${@e-~N%VGr2iAzRsl z)I2Ww4)}9u?wD(H(x3mMkex1( zy2$2d95{Mb%1$Kj6z2Rl|5H46vHesuj5*pPoR5!mnfNE0|1O@UfczZZkb2-{Z6}+) z4>(p$e~&|O^fSC6xjw0ox{`eo?Gw!z{i}wtrOU++*~65AK-t zylB{#v}(xalXE8G0)sRFFZ`Kvmj;u6B|L$AM40QI>8FA%PO|x|0mr|_8P^hdGZLjIF5`_|e*HvMwibqyq&eHS?VGv1K);FX@yCc~!T^o`$eX7}A?x<)hy zVKNPeEqYxv$M9iwkxj$w_ypdNTI$=5$cz5!ByL=yH-+=@k-kmpC7Vy~kESUg{|#?Q zJ@B%AAe+7z9IIxy$CrSkzvB(5Ctk*p$3@`qZM-3I9AnjU9MiKTHnP>lag5%<8xr@C z=#;~t8Xvayl1)E{ns-Grj~bnmWYeq$hyNp*&G?A^A-n}2vHEv?_)oFBx%$2^`zriE zxBwsN*%C9^{JZw@;sdDLMKFh(8mUZLaM*NUX!!ZhZ zqJhL1;&#I9XFE?Lo1XPX?M1_W{$KAqXGvM^BjJaHm(q`388moN_*ff*K7m8*YxwCLR z`6A&4GA~k*8u5x%zYJ_;S9`pk+*R~@z;VAKs`ya`Wd( z;RbAneTCipQN5c#%5MHBv#-K_qCeyOxk@xIL!Z7=<`3E0%VjH8jhjpTMc8hG`d>!oLA9c;UU!PxdGYq!#(|2YV^8>Y?@oB`Iz{rrlvvSC!2-t7EJNwpR=Kd1uf9AS`{0Z^d+v5S`Vy|5bB%Wlu;-R9MNc}M3O0O*2 zm0l=i$reu?*viiJn6c&Bmpj8Aju8L7$RmaOdt6MuR_w#U>BUkn+3Mv!9*z=?o1dz8 zeZEBWexG-wpB!_;?H8XCKRkYgyud{ogID^~S+;s7z#j1?9MU|z!p{ibNggM>6l`;Y zY-Jy#eVN2YHaph`8*8%JcYz~~XAd}5-skDbra$6o+Eb%*m~5I59F3PayMV*b3KxK5 zwHJad9~O)30@H;CTNCA%l!`FCsVa_Jv`jeQ6ji-&CSxV2aP zZ-hNocKxjTj^EFa1YK^F7|7;_HFi@w+3eJ`r0<$T&;E?2i2t4*yM3@k?89IWONHIq zTPDmt43*v5TQ2rW*liri7F#tqst`>rIIa?&4-TgaF9zE@BwN`Hw6A1KgMe)IP2i|f z%5DY6Hw*6oTWtGj*EYTkj;4v`RdD)#@kutHZ&9y)-layzg=`wG=h1ZW!_y|~LwbvD z75h2huv+*6k2ycX8Dj5EeT}f2tF^)-sku#fG&okxINFtOBG-v#0XUi^yp(pWca_IY z9JNw7ZNyuiO1`fX{J~=1D`NFl} z_)EfbJUjc={E*GhGU~M~_wh)5uA^S(71{J1sJTo0b8eW1Y?@1`xmz@DZYW;^d$>UC zoDbnb;j!SjQJCv|s9Z{3BzCsZ_D8bSRS%99i-zrrwXWsV>sm)P{bt&~F8xe4`%~a( ziTK&)@d4`Bh@NbE&L7*S$Y$q07%de)Z;>^gQ(%jY`<=Bhq-L4ud5kvh22QV)ddcR$ z7wz8=JK5}Rt^2b0;XW8G7iK?4YG*%NTgX<{jp==&=Qx^%Y?@ZIe_b?Wvoq%KKg3=D zj@Jq^w&)weeZcAOO3Y*{JBs>mie@4>Y!WU7+gOuLe+xMJmS|Rk!*#+B(XPCS_HT=w zV`{v|V~(%ckB}c0{V|U@j`1U6KS9G+ZCd-VoQKgS(Q^)@zb6{9X{J!~ebG!K zZx*hmUgs6r^lNF?eV=T0?(gyAQno$V{(lGAG#$bA|2xQL?*xvXkg{Co+=!bT)*&}dz6Rq%vm)Y5ek@|G|<2Lc{_D5}_zdtgzh+nWEU4U2kLt(BJ;Zwq_ zH~x`uZ}QW^eZkgmWQ*a9{l7!XRze@C izI`WT2<6_$>>|*@8lFjbM^thB=3wx-%5gffDb~nDS3U8%d*^TcX#D0)vmED*szwFuHX4%(7 z|1Rz7|9x=$N3rMQBUJ7Jws!H@XZm7rdb^AZ+1kS6nzfy5c6W?>9R?(KjC)zQ6d&>L zg^Q3Eo)G5#V&@EG^D`D4{aG}VsL}o;o2DKdz9E_h@?V6Pl1~aRC;wG=1vq|Fm}3#E zf9_wQ+Sk+mH_>oh!ncI?fzwY(Kaeek!_=t$1#qOyv9R-Yvguz3oBxv@b6l)H$)*e8#>~jq5ArminqK`_P>c;r|kPeOSQuwrYjwjH~$fn_X9<>wAL~weCw4H34skG}oYO>iI!6E;%9TNLLK1+BF*!Byu z=^qA19YnK%`aI!H)ayP%HvN8Z_#x38C3h5lm3+3aTl3Wq`!-Z=h2f0P5lshhsLVCr zxHI`&(ex(sKMNvpZBIWV{Xn*O27u%9L^F(f^*Ne$t#_QqLGQxbG*xhBiO^9!mbZL zB3w*+FX7=Vt2`1MUoQ4B$;L$Jk3HlKyG>-s=8J2jF1XjNx&AMtYuIKEQ22buo? z7pV_kVL#z(Ja+x2dd|=EbJ8xd)y4HH>Mvz)BCF3*u*FO^eJ$-8GuiA9fh``_cKt!d zZm@>~#eX3<;(ruID#9zgT9|8ctQyXTc(B-qQ1db2;hts;IQ=te3)y1e9EgU9ell78 zOrc)aXR_&QXxFxo&AtL`G30|I{Q<86@+ZVU`#&lccKtt8xIgT%Y6g?}pP`Y4;bmnx zE}?41fz$sjZ6R9>lc@islx573`YESg+d?*d9qrl{ve{RIEe03!2=U4OkCYj6G*ayB zbF(wf^v@+WviW43v6gjlD!ch}t@v>^o_LZ^VMXt-v^Fvkg_YO(XwRItfgJclFhyz9PvN*Bk^3(%92g9 zg?24VHv7|H>z|#}XuV|9?4w=FlFfby9Bcm^1&23E46jqKe#oYO*Rzw&p3h^M_916Z z^m*~)_zS}AVGpMWk0zH2yM3fgcna<1!kiCbg|OQ%4$_cmvGX=oSSQTe zJ?UEMTe9hSOU3lOOf?PJG_QLaUJ9CqY#Lq;nV*iRGF>Nikxj$X&1i}2!9!%tVWlg-ZMHJ*((B<^P69AQq!@OEJic{o>i0Y1z>+59X9 zn}4#|9|MP9#2eC9@_gZ^Jl+Skxk|RON2vJ{-jLp;M#qk9ns>p`ouX-l`>)|$!u(rm z*5_o?cLtlj2RLpJedOuMrteSv-J;>|F-Hr9uc2O_Q6!t5zrh^y$3>7PQNKu-e|s>R zCp?9kO5tf>8+Wq#sRxJbNF@FpuZW$Ew2XS~2eRo`QltH_#%W|Okxj$Dw`H2gJPp}2 zTRqKAPeV2h|L&IgIYf=lTe4|h1jicB%iwT{#Q!e!dd^Qa{RId&yhAkIz_vd0q+Qnv z7E3P`4cW>Lp+@_&0c?HC$61W|IEZQPqg{OhgK(MnECk!Lc4YJ48ytOEG(E`o3OoCK z!hLD~itr$Cyh8XIkB58ADyr4i&fK+YvWMyNjA*|o}FxVUi+tG(UZ;2`vB25q^@z){7N)r)7(V+5wVla zUI~sKlCm|_{8}_*)6Ajfo1)>p;7B zd7bFDkiRW_7#u$=e3ZOin74Y3-vHbH9V46nx53c{(Z5HHp7W4R(-ztBM$zyXWbNt# zwsw(CUkDEW6K_a^snK?kO*0G}eOENY$^RwHV@>)7>1VR(dFm5s-}1PVenB*3({TAS z4G(G2qj*E&p(Xtr(UVQzNR9ejPL2Ln0NFI$g-o-C8vVa}WYe(g%}zEutB-UnHi2z! zzev5Vb!5}O0SiIP0b^s8BdMQ4YFw_gCm{imDK2cGqP#;_ZlO101}U1Hh*~hGM{AAFQ#7C zNq1ZuApPJU*LeK0a|5!K9 zr2VJDqrs6f`#;_z_VLs_Cp?*~c8-hbD?K~=Jlre#dDQ$&_)gmQ2{)4eTX;Enzwm?P zp9`-e9}wOIj(;J%m3A%5z6}qGoqZerQusLeknl;5-z7gU_V(yEJ69xIUxn=3!=m9e zSNtnset#Dq5$;3HuZ7)MXrC0*t~}b~$zWUS$W|ARt?>)uhsRTkna9)cH)3Bv<^qYt z`|YvD{~+zZ6+4fW)~=1@qhjCg@eZ)^y4zAesf#=rN0In$=+IAD$|uU&9*`*)$ud(K*Rw z&c>QcK%{o=mf;`qhO{3a77y9{a2UeZMZ<2gc*v$X1-81}ZzS#!J%1z7e3DJy2^?t~ zF9C;t5^%0xTJ{#Q#=v7=_-FCS<6WflssWrnC~GF! z{5(p%^&2(X|JyvxL2BL*pS+%ml#he$dYo)NUjy6qIN9uPg5$r4pHpOwxedaywSsK= zj$m6WE&<0cNm>3xn)N?_g29d>WGl-O z3b4h%M`?}MQLlYSHvJ|~(;4&6{@(%FGzH-3O^J=iZW}MMX^Oz{-$c_N9KI#Y*}W;5;D zKV-8X0Eh2O*_S;H*)%7>7F%!X@wa!F*bmk}WYZUeqm*dIfkU2LBeAcHE5UJVv2%=! z*(cVYWb@eoj<^UREyc^eS0$TfHSO9)ve|j8H#^zvJHWC25%5BA*iQU&zS-O+o8Ha6 z-^-lw=N`{zVqP>Lwa3e1BU@R{x9CHn=>`tZ7IyXWA_IwiYh}q+wl6q3S2TmcA#b)J z4a3W>{mG^u1CCYC{*SmwBTdB1?B(F_Jh9h<)2~Xq$mXXbHEGf0Q}YMWkWJ&-qM9C_ zhHM({JLZSyjpm1J8tS9-r7pHNR31Y8eRxA6n|?Sr;zbzJXuM3%_S$cxkWF7oyMEV0 zHhUvD>LPwtQ1iz&c$fbpX___Ij=G7a32gq!rr7|FdE*ml6JFuP!n?>k7$WT@e^~e+ z*nR_(Y<^wZeFPa{Xd^QhOd4P=d>k(yXE%RT)Du$`-rtsi*LCn^#>&tqeKKzTP=ee!%Y zyh1cDlC>=_Q=>7w?(w@Gw{4Zxa7Ly7B=d^z76bP$oqF!~UCkcCZqG}T&3*wmx>Dll z?3E>(rW@GGlFi=B)052}d3v(hxewa0hHQ4X|DKSx`1>!{I%^Br^lYQWLpFOpIO->D z;o6vfLwu4=!}z2AqPYZY{>i2(1e<@d*?BHucCy(Afpu4Q$1k%Ffj#{fiGghP;o#^h ziD48quZxCknsMNGfM~d`TD@e`+yb_G$!4zsTiI6NXps0hhdfxAb0GYfFvmI`BFug; z?gh4E7TNqW+K6ACAUXfV!p{FNVdwvo!p{G2Vdr1DCI8MRPvnuD&rzPw>pY*MJ)g=g z`E)Ul$@+=L3UmI)pAqg24wVOZ%<-~yo^1V4NzFJZI}aRRFT8;If3QaRyJV(!ee&6C zz3F#F!x&7{0~}BA;`y9#AJ`*a#31#@%l0F(mA!^`J>MpqeH1vlLCTKyG-T6EphoMO z=xNBNnM%7J@5pB7_=Y!%f5vamF_KMF1db+)rkEN%&nKH^EI9nUXjpG}lkgOXU4m`#d|@>`k=mv5#!_jo_GH^dW7=%f^vxnx|;jvShO#0ms_LqaJqw zho$245^z)|Tu4^Cn|sRat1jiDA)9}$nO)URHv3?3`kykF$Yvh~j`R=W3J@A`A5 zu)SglvAsfo(k@ zo1N>1ttVu&mx80EQdcF|);+RmxX#adh-F%YGJ_j7#BR=PX%_rG3^TFnmYZ+mkaLz+p(T(W%tqE zO6CUH>@U);_jAZ*f0cGUHz1q+q-Q6a{aw#aHhU|~rAX%h=cL8S`4+3aE%f1i5`RZ< zm#<{m{DiP~RXf@2ov2?Sda~I&Q?GWi*Lv;M>Th4Y~??nPcD_HN|W!aR1^8bvmr z+!vy+iKYk~e_fdCRk%iYBw6hf$p0aBw??Vmtx;>mUgwp)6C6DxcCJOyH-)+WMCzaO zByJLW6Ip$7&R7f^Jmwk|eoORQJo|QVyiV*p!L~+`t-VL7(YiP{tX*$Vuj>-o^lrUs zBXf^z_O_fG4@zCU-ZwwI-cLU)cCzVt?H_+z?0v}J5O!m_UYPSI{Eo02Q)M@%8^q4B z3pWb)A^)fFAkTh{$78_hwh}+t;+Y7J)DPDmyI<}-+Xd@8n0(rjd?5WPl`{@J>y+u)g1EpHL#WC91FKe**86QYt9eE z&N*g!9tX{*yQif7c}$GAioQQJ+l7aae<(Z>9I1W`?aC89E~Vxv(bv-cwD4T=kA?39 z$2)|V(*BI_3i3|jN69}CehM5Z^B$3XS4g%w(9-vw`=N<7hI24cqFv%MBtI+M32beN zz}63a$UhRz1Zs8*PX>4SX_hU9DX@1{JK5~jU~6xk$8$WM?=ioNH2r-ZV|as<_FEhB zUWuW-$K3Z*8Yhnt#+}G}M9*VE>N#Pq?Wvy$7m)V}_aLjD`-|x#vij$`Va)x=^jt$s zKZLCQfp{K3{9iymC|pSXrEpJhd`Oseh01PSQXWP7^P-tVJ}g}7G55{zS7NUv9}%tx z$69s{?aB{=Bjt6p|625qkzWvY`{{3l-7!M#J3P%kk9jT;z9@R`v&P(K<6nsV6zxZa zc~3a}oiOhShsT6@&Je5J9V3(rJ$+xY#(xd@fRr6aeo2`3c#Wr$Ul#iUaP)g&cmMXd z@G96X&b8EQ%uOC|BCDUL$*)M+-Q-t=4|w_`9v}Dk4RG`a(ewUo^he;8FKa0HwHNO?+z8q<6+?Or>{@_^cgK2+5^ux%15$66Io)oSDN6OrPZT%tJ zKF)pFo>d^5y#XA*CVrNI!@mlzB)=*A82N9)PlF@nonWhrY(Dv1fz?Ge`+jizy7)N& zj@}YJME<+*VX%!CAEB^5e9hyxJnn>I7JnbI`tR@A2YL39o_&I6FD2{zamVO)U_jzJ z6P^-w`};qHxt@fo;TmG>_I+2!E)eX*~k{R3flTn@OR z1_6)Dq4G9x{6C`E@7WK5yQD-twqoM-S~ZvdAv4z5AGLdiJs4l zb?K00^T}(6u4*TnoyTiy<1mkT>^3`(-NxfRo&vUhMrc7wV`lBCwh}{ok2{jJuiUXl zxfAWJMBkarhb)lXu_jNr0Nbf{!ac~U??qNU=Y#oo#~Ss|xncT2p57g6)PFJU?Zy9a zvW`3FPwH&3kMVdMS^Io~$CJn(68%kNJ|u!vidX6!;Y#wk!qdpAuO_RW#~|}x@9|tu zKi|_gkkvo?&F&$SZLCYdVZPK$|B-SX*q)Oio1VuzdrpRI_6BgA7C-C2_S@iO)9^TG ze-n*tc8+y;zLaHbA^&p&QV;Tl!tUCzvoOarx=6S$*zV(z&F2tmx`<{NHG1!bY#NSN z+*LFa!J+z}437ApDv(O?GXG>N%WF*Y&wexiWYaW&nmCUNDFS)hqj*{B4y6N?I1T)I3D(kCfxh$HQtyzh}%&n}dn?9$ke)`NBC#)!| zEvulHGfQuV&z7WhRWoMJsd5ojmerS)Os$(aqhtn*b=lZv)J`wC9nn^mluxfIOJvkl zl~rc!RWmATPm5++*{o?La}fE|I|A1WXhT&UJeJkg;e!>e7Epgc*Ki-;&z8sW$y{O@y1P zYO3nWFv~b_$>uf7Otj)mc`iKJsbc%LK6CAESaSBUmy;uEcR0vd&dbSBj>n3e#j+VWO8MP9tGe|n>y8;Ss_N^o zuD0aibVUw7+J?%iGqu5TbCh>+T7IrJSYEEO*$7RQ^l-X@ez+)C&8V$+Cl_u-b_>t! z8n?vTD(!4J*YD&qbo=yLIbGx8p3KZ1&r7D))X$Xa5^>r&P{|A&YwM<$RktiHt45GK zBA3seIu%C<^JvQzPYf$&;M}98K6AjPt*o;0G~2A%<<3@AF%y#k1rlM^mEF#xZb{kA zbyZbPkYf~@3lbg@i*R#o4rkMArf0+EDb&q%GiS3gFehBQ2{%)+{Kkumsu?(RHtT@u z`V!YSr#W&99D1O(x(eOu4o$P%*t=mxf4e^5(2AKAV2GyA%Z~Z1WN@yb)i=+?8Tzyt zB{-#?F&(9)1$8rdR_`u8T9BQ#reQFv>gs0K)=w|5u5u>@Gs@F$*QYr zZmyqpTJQg>{KVd%*Dd9D)K{J6Dj{{VvP6^&tgeb-xam`mMZA1=4j1f{Gb`p`7Gt!l zFj%~P#j;c8dz(J1Vop&rOXkYib~vm)3W?CI6@)2-f&&_7nSAjuwES`es@8CA1paX?#8IXC}8bA|@lY_`i{t=`9@AU~4{m8h0G3>Uc=uqK%s-l{07f5%|*F3OdQ$#5mo78%=iuQ%-tN zmG56dusd@tN-`C2%-!5>*-!R1REx^fXHH8#sr2p~%kjM>u^auCGCB2SVc^NDbb3%! zGqb*`=-RQLi?PF1+?p8~yE?#Uu6r%?r4tgn;PhG3l3jYbfE}$%klj7jr9HQY=9xK4 zvkKSX+~t$mIXt+y?xs=s>{Zny^D_2K2ySL+; zo^@)QoW$&0MVc9S1Zc^*8(1uHB{ef^Do*RNe(HAcyxB z2BcO`=v-e+pC#_x3H$U)41?Ue(#w(R>HHe(G&?TlF+j9ir)2Ns@e(09nu#S}zFw-T zkV<%mVa6<6RiIpsarSl%98r><6S+OI5mmVRs7ZYy61iBJhP^0xWyMHZ7H8*15lZ6l zgv&8}-Z6upIU14Us3c$dyDD(AFeoaYHLK|6>Y3#@q2~QLKk#fPSLp51nNxXJ1{xWy zidpqn4#;dJt`V&zXS~uYLh=7EmzG6Wq5S9x*In7~>XIuJGXPs3%O03P2Ym|g_{P7T zZYu}^c>+y}d^}DCn=Z{3$0J)Vy@f|Z$Zd7Izkb?BD}^87fs~}~924Qwblafg(N{{FSOdD_0F)uOZ(O zbxfa6`0KVc2>3fp^w$pg=5Jp?^Y|tp<1ig)vU+}6&^*3F+k)UdXz1@Oe44+fFKX_u zH-hK0KbFkj51?b2V$C@4gCIBproRv2)BJ7i(A?iq_#32U_+kFO51sFC10F!;vuyNt zHa^YYmlOUjz=Ys)ZkEj7;)K7G@K*{E{h@0!{%%hAD~G>*<_w?auRP&z+z*3b2lDCf zJbYSwUkAgKnWseF`p{iQXJ^KWz_zEb$(^JA9G--twfW8ja^ zSJB`3__X-=rx5-4*23RhbB0gzw+13VzWMOCLH%9m`8$T4%lFr*eGp8eL6iCW4RpT0 z9zT-b_+)&TN}2eoAoBgq$K;%x!(S5T(O*~3-%Dt`@9!}B={^e%pBCSX z(E0ubJre|t$fv)HJ%5*@fbXvolYL$ee|%2c_xF_N@58>o3!3{o3V(ZZ`Gd~)SG-g9 zOU8Gp=Z}w^`tfbRBwCTfUn}T*e{XsIx_kckQ^UT$LD(7joV_JvyTs?ceSaH%5(Fop zV|fcN1!%;t#m!bZtK!mZ1cHeOXlyN ziTSs7cMv?R{w{~u{4Igak8eyE1czwQWd8Vn3jFwr_hi@Sk3wty{(``Ke+BtLP-xEZ zY5rb^&i8i;lb{Fk*?+O;uN%ty{)S<@CWpTZVfX!Y`&kgIRex7_{%X55_qPe6cY^xkGoj4me0dKq-`^n2i`B4M zvi^Gq2H#&J{PDQO_^#4C`rFv0xxfAJmuoy8fzJ0g=)be$G0^k(&qV*7gueyIw`B31 zO7!1N@Ye_tQ+pN+@IJb$aPzWe^R!(U%>hEI#{ ztI+xWChgC*_v4sCP{!YLjmefo#f4_mw_ctH@Izz?wegdD?-ldoyzQ4EO??lF1 zHok?>`TkbH-*6P9zoDML0oY%Ce=lQQ&lTU5(E0w3{5%`qCp~|^PmJ#g_?ws`zN3lp zJqdp{9wR(|TNC@oFs$oabNKsyV*i+SK+a3p-fKO7{S*F9!C!3-e^(^@_5Ve7J-E*E z_ex^_n1*t>`tMj`|2P1DHol+o{QVU1_~TIrf3N3=ZzpvAc)SLGolubN{j}%rdTjgt zZbGGXIsEbefcXC2I~WAj(9z##Jb#a3zWM(4!yo@|nkAdh-+|8eH|>`}a1tW=yB?p+ zk>$EWpQRieF5!(SsEX)=GMiS{o2Rd)aQ0<`AuT=c&m z-!QZbU7tzjuLE>`d_52xrk0DZ1fS+_SR%ej@Yj&>mTm9H6Y&j!zq#tK%=6cXO8oea zz#occlErrybbfqW;14DjUj;rbz7OO4+xK?@{$9v<%f{CQI^W+u_`^Tvugde+3nJg& z?o06Z26Fi84xR7s;a_LZ4{rAS{XP+2fRk(N>X~HiJ(`H`6#VUgit}YUK3Ny{-$Quw z<2wj{xz@j*L+8i04V}_Q{oU&M`)9)6i!Jy&mGJkP=WmAR@2qp0$M-7yF%C=C-qmL} z*S+3?ZVIl~{Pw;99shrxCG&S9bbfm~|0W2=LC5~P4PxuRip2hre<^pzEHfH@^kloniBN z+8MfB>(Cw0v0sa|C*~i^uH#E#V;+VqxbwW`{tDr58FvIt)_-?E=lffAEC}}KJY5E@ z`O8oEd$ecn_|8uFyXoa@e9Jw5zk*|iV`H!t{cxA#@} zt2bx(G=EP($1=s5*YS8ZzE!X>kK@}P=QX~+$-VHm1GEf3%-K$H1f1D)@05B%}|3*%b@ zt@*1+9QXJ3MtgJko02&0ul)o1S^cf`{QWi&UliqD$B!i93;&p1#~Wx8gYnooaH^6?=I@5Yda&is+4$Cb{(g+}LWX1OK`H#@x-Q!e zogd#m__OPt4W7SmCHz%i83d1IqRZ|dYZLz3{3ZK6$wtp#NxSCpb-_V(Kn{PCq4VS8 zMdJ|Y*nf|D{>G!T{PvE6zos1iJ`J7kZwUPDfR6sy9_Dd9_&v_!e19k5Zzb%OY&?!a z=lgpP{`Nscf1B`W{x&Aomj(TBzulbS)BHV>SYP)1HS2G)=dY-9^Z2^-m-@`5`MVrC zKfYCOX8rN_VDSw=yncK4!ry#zhEMZ%B}Bfz(!XWz6K?hV{SNE6?{DN)azDacn!gvI z^Zj*tD+u^|PVB#Jp1&Hf?{6|DODA)NPxCij%M@$gfxpXm(%*K?5 zlKHy^7C*ih;SXKv;(JQ-=&vp@|CYla|0ahe^EV?g|K5VXTJ!%Kb6WHFL!zVRwu4|9)-V=3|N!(-&YgYJ=@^#Cg|9IyP>uI`$l3s-Ym|&o<5iu zk4~*qnepA@`TNoZ&HIlxO*gYLO%~r===}bR;I9uBVaB%?T8r=Z*v7xi`n-8W?)~j3 zM83b9&PuuOqv((8jQP6=JA?19Xe7R8*Vy=B@pXdE_jdyRdLWk-c{0ZLqUUcg7EjjAIGOJJRPOcaD(HNFmADyu9D4dYicjmmA1CI^F8HgZ zV@(#{_QZS{bzUm-y~Z(U&0kSseEW~VePDBjPxE(qVmy}P4{mThW_&Mu{ys>wcR2hN zBj1wwdpFVE2jS1=AKPv5)!@FM-+ztphg~(3%-?kASf*HWj(PFD3Y+;mfWp4N2U}?G z&!F@Do$&m<=K1^Pxy}7;XraApp!5Bm^4g12^GtjnB;tFmh4|i0#8;foj>iel-yah3 zooXSzmlN@gfj=7$u5Z?Vysz)~-=I&+?^8kIl8wjzbZOq+RbG52p)`LJ@|*jc0Dljv zFMgQ6&p_w*UlaVzMLy>rPTey8K9V?pJ^_F8=tz_KD@>d}cgB}OTvzDtEqq#hcO=$> zsbhoSnEK*}`KwQ?2PfgL0KVw&ZRpJ3g2Z@?{ES@hm`n5brNnrI_yI%vUhn-?uHsNo=g;{^^dj76Y>~HsBF~uP+lPtb5iT&-t&Z(djDz^7Md|G=i!8sC4nf31w z{0*i-lli*{I)8jm!QaEs(ck;fn!olPoBKOweD3q1*3kL>)^w-fU(xHxrMeh_Cp=+4%Uqp7kI9Y$3z3_V)N(?)z)}bDjQp z)WY9Blw*5wYLxMJQ(}CNz~2gMB=m+iB*u40K`P*HG14Ee=Pkaw)t{A{HYo^-;l~nn zO!E`|dUQ_(J7A~3b3A_q>E`X-0DtA!_bpjHU7_>admR4wvwHN$?^!LruO<9-xCzhQ zAm5VtTbb~8;v?Dd#i1nQZ?F2Za&y1X{Ci1j@3RSiD=tq3%i)LdVd={FOBXb6?|bmK z+k(TV)pHJXetWxpG?jTSh`+sR?Y%lNpLb5l{hUJo#C+Zce~gRqVQI+t`v3u8Gc*6@ zmIMKYB$F&Y{)t0BzI{=4|Haaf@wc@={sx{6=>hn|)W{_3ze~@SdVQVcQEdFV4~x#? zI0S#TuTaO>nLeJ-z0iX0PX$s2%aKdRpyRq>iS>qf{iC3HyFS@d8_h@L>?!B+?+Pzm< z*WLFFTXxNtw=WxTPf_E>#$N5yZ5uASd&Jk^;SUY)(tiD-!o_Hn(ZYgfy0u2V3wsRh*81{Pw}qEK)3tT) zySpyzJ+y1^hd12oDi}J?xTi7dA5j+t*nKv%){>6C( z6~XfX>|sUtM9@C$vZL?Ly^AI;eqr(WCHt3Lu+(ZxHMI{HjTnjCF1toAKD>DHl7mae zE?w>A4;@hvu7?MfKDc=7lGRH_E?tw!&-i)i?%}OR{57@kveYG`A6WWKs_FhVP4C!y z>b$o53-|ThJ9^L9-Q#yn+&N&`=6fD%T=;xm(E3o1p!Yq?7LP|?nXiqD(s@nq-2Kdx zi*|f4ux*g{&+{Ljy&b=?-*#L@!?VG_w#9k(w{2Tc(eONNVa1APgVxWtaqYf%DlE0P z-Fw+cw!C-S?gc*xD#B-j`#andOk8CC7mS#=Xzb#3nffp)Im`d=e5CVMpuIL4QZu4% zb5Bs1skv~`{tR0*sh3hC7Cz7>=-nYbabv1`{ttq0w|*{ov$%Zt!QsQM+k9Q&=#``M zFycecYrDH}SMSF5L#+-Q?X(+hv{FYqo!1y-yf?MH)p|rF{$j-|=XP)XaF80Yxwvrn z(A0v4OK{eGkn0Ld^SuvaTcV*?G^?%LXqS@a4xE zdpGvNC^Vb*!Ma5~G0!p)JkuNV-p%FVe+?>5Hlk11Q`iH#J-(>1n0r8)dq5`ULhb=w zu?KWTsjk=qx?&ILf<2%M_JA(f1G-#|{%GAR)va&@_JeK%+lG0Z9gnx#7E}bBA=m>r zL$C+98G;$mzWoI|3U`jj3?I8>?~+VxP3_wc+c7d@zhLRQ%*;+TappgalJ_ra^TGJV z`xlSK+_#eUnR*GcK0u5Y_gnOEarc7nV)e-6agPY@S>Cp`k1?e+(Gm$BTwxOZbl z`_e*;#{I9HA9QcMC9tt*QTKO_T65jz#o^F_?XVWKYd5ZFNd>M++)A(nD*zaCqo5+( z8Y~=96?XX|I8ZiEaBWI&VYo}i}H9}@J%U}c%cSXai0n4KeVMW8+0c-{IlP#ZW z%FVuC#w5|CGV9JYSfe`*eUkmNq}{l_yDJ+09z4mK8d=i=0j#L$@2F`$=C4JYYN{yx z>FKuGpQ7ERuH9_?rFomZ)hko>rOhL_3fP{^eK;Er*TLS)77m~7JXIX~S}^RMt@kYK z*&!I%27S?{4fWP0x&|IQFDd zW=AcPiRdd!+WwVzI}?W zEV{Cw*R=Zj+F66IxZ-B~;??YO{-W3wRaWE*{)g|lwr=Jv_~DQuC<>4jOUaVHefnP2 zXHeg(FAs)}#DTJozd978h5*s*x;g#&PVZZLWyy@bwS7v;NEM`cGiJ=LzLHQ@He;qh zb=|BA5DF&JY@RS^Y7_kRgQ2$JK3fM9^+b)=+O2R#vIY8y8BJ@qJwCBrlh}SJu{}4j zoqaA+{PBL0B-t*`oQlXc&w2g)k>2)D%W|I*Z}$37wt0U^l598Grnc{RVw>mLlJeX$ z(6+_@A;$jT&`6T)LAI&++5TylD1TO>KV>_sm+fqS$@a92f7#xU*j|v>=Jli`(P!_^ z%l4#1ezt!lpTFmB<%b%&&kwoy3o^D3CE9m(BLD0}{<$tc+g{neCgV@G=OwnY^Gos@ z68VkZcJp}8bM-};{PPm=q+Ncte%bDu(aSb&5onTa-WQaVPWU_D`OEGvvOUb?_#b1O zKc$K7`o#9+#P-z0cDB9eC+fe@`F}8@m+kEQk?m}Jvb`#ypYLtgA>M4dC}_UjHMm_f z$6(InC!&ym**DD3Mk{qxvwE+DqkQ}i(C2iUAJlJ3 zY_CXcx6=0af;}Jqm)L$>xBIyA=LIVg z`8R0);jgKtA6`tO@Jef4WV4S0N7@GN=W$!SA#tAz+c|U>^Jx}Bs>RF7 zZUKj9(HaCh@CrMS@clVnA?_QS z!Nl$eIe6<*-b^=EjYFxRRyI}eF$eg=SJ)$rUet&1qxG{Zd&r%rkz-jK+q z`M=s1a9@gvVa2*wP63DAXqElK?A#YZd=J9JW47%hWQ*ZxaEN<*OdPMUfF%EyAiPxg zI6l&ovTS8fz!VpX-Hp+WSvC#NB~8OI3cHKO?IU_1C7b??`$!ilI}Cbj3)#v}1jigq zBtBbWTu#=$>VQ03XUJBT^C7wnZ%Aj1jl;NWxK*Ycth%pSGwGx zW7GGbUDqhG+0OxoeMQe<2sMMlAF^>sz3@s`I&^GhS!H~c*j=AgW!W^YPgGNk>@*vS zRE(Et7?#CGHoJ>wAPh*Z|G8r!vDx9(4&84rq^D)s$`->E4;K3{e1snpc6Ck9vgtV% zrspmlGH@ggbNq3K?*6oKHB9MS#7;Ip^|Z4RB(mA(gCq6BF$zC{H>3!!u$Y8%D!js> z4qg9*3>=B>(yRoDY(8DgpLAvyXL?4KO~dYvRl{(tUKeML=#z0;{EXTBG=d|Ic_lbj z&iuSi#k4Z~!!NkFzg2@DjmhNPTrq<`(CV8ivL^iL3Hj3yE&RSw8UGB-X}{8Mzc<5Q zj&Tb60eQ>t!YP}Lzl>o&&Tjb(DrW{mYnE}QxXf$j$IH#VSH1iexc)gGR@=cr6e z*TOvq?iYY&HSbRT-GQvhb!QF}e$*+)uS8pnnZDzXKV@~vUtBhMj-Od}KSFBx8FxAq zr~fGLY07{7^S$n;_gefVNw1Ui2NSId_H)9-PCET(6|F!fdXqH!eLz!r6nO(`%;AlwY$#QT)zRp8_ml|8`o^rulC=?ZP?b4`8!|(-4=2xkDl6!85uV1qhK=I>Jg-yg3d%pWgP z%pWfce1E%8P7krprTH7JWs02@=dS0;cm9lzmvH9q4`AP4gy1W4#P_n6DaI$$5%{Zz zj{bPLXa3%U&G*OWx_ORb$>MtlB9R7=*o=0>ml;}t${y1oo(iC40OJ~M)+F`1^pq^jK9W2dr!gN3g=1QEWW!E z?JdA{+7U?T518?{9R>XOmSTt6Ag{ zC(&l+kHm}Z2=Th2uRcVe&lvoxXAK5kedPd={_AHAmg8ib_4UV#ds8=T;s2=K)$jJa z)RXOkyo&IhVBnG+i@tQ>9rq4w7o@KHO26CNrJVJ`9c|L>-Z{5o+;{LTS%7bb-uX<$ z4lwNQ8?)f=@{L*WinHO{vpyB!E5T*grkVz}+tJ#6n}$4WU0aM2?|h=-z;{@pxPm3x zHNZQ*4b##rc|JU%P{Y(($8iiSr5TCOVQ_i*XFs^W?jj|3Nuxcg<4)7*64`F&_j=e2$B{=A@lzpI+? zUH(>lqZ@QQJC90!e|VNFbN-0CcP`zzdC}m-_PylA&c1zd-nC}A`nI-53t#N{!ssJo z505`I@!;eGgO_bxwz;vWvGuR>f{pj2KeQ;AocZRj^@JWl_of?D6Bq5pcYAk_{2IpU z4-FW(XErX%sw%=fw8KRjeixAj?fH#y>pi=Ih0h)eTJJs{EZqH8(E6v1!NQ-e3R>?% z-m_bRb$P?uzT9?QyMC|br5=B6ckqR;EZjXDiU}xHiBk2!ur}p+>)P$iD{njW-rwH0 z@TYB1wo~wndt2}B5iH!*KPYVT%va!}&4~LRKi)odTDG;l<5n~H{wh#B85uGkpdJtEcg)e+g2rCu7C*KpT2 zs`|aXF?h0VLz{lH`6R{RU=eipRHZMtF|}yqcki9O;PIbDoj z^A_pzZ%oa;JN3+>5d$y4+-&>y2aiASNKmn3VyaoasDEJI&^CzSBxArlYS^^q z-hE@R?ty-9Kilf7_g2*Y5Ut{O$4_De@U49D{mbq_{Z9m~AL$UZ{^+7qtDW5o&I<6? z>`^lH%;S0gSzNfhqI648wEX@rKbM;Fz`;f3nQ^41Uz^6ExtA$`6Cuyc2=-)RnY@{Qlb0$vszV@R=N@g&sd^go64b+*I2oV+RBu~ zH}-+s@(z06ed9?MM6?dE{Ge5;Y2qU0t;cf{7J+>-3h9XzZ*xE1Jg#uU$_cG*eDk{U z(FaEl`_$%76^SroP5qbX_acK4n}A8^Sg&n3!WKa+MbKDk+6Q$)Hb;5ulM4;4eMz> zNBGPPpLs~<)na~Jblc*i>t0;{!rmkM4<9^q_}~i%nm;Eq3eSh_Xp?7@%oE6jBTWqNjsbk!qYu`!jC|vaRxTzBkPZ)XQ)*E|HUOl<(=g&g4 z6%8GNQSA@nIju~Ym%5BzHhfh3ZteFk8jX<{pBahNOT$Lo|3oM3w;NZza&N!38;eJ^ zug~l=cqVE1uo0U_^d4FCK>MAkrWydW{shy*O z!JSFz`&!t>Tf@Mqiv`(h(mlh09KXDOOhsPIvJ@_M9`}N{c z!7{IxQo~z~*!{Vl?zy%9KR^4h(L1@}vk#Z>6eE*b2X7;v_rxU0cDZfhOpE!MlP%qD zO60$o*glll=KrUaB>rBuP4&m~T1k?>!!|YlKw|q?Vw>l&lB7J(L;Y>uBlown{}(~@ z#fkjv^_%36OyrMGZ1?fDoA+;C!2d(a)DivI3Rh;$^V_-peOn}Wm+g}of3p2vBEMB4 z|5ReTFtMGDPyF>r&#u}J&+lD(YH_JFY)RRk=HAs=RFf9@qbq4_eyz> zgwHly>T>0cQ_6pG7hZB1JTEczTk&inOvl97V zMHwcp;e7VtFK$cT=7}guYSU|!ki2COu<;P zcIad>Z!95|;uUuw1%dmXM4uzzyogmZ7aX#3qz1g~S%d$>-n+n8Rh?<$`y@FbAi{w| z0s`8Q1d4bPL%2$*J;8*Vh!Fu1FAz=w1QQZM;%(F>kVHXns1e6HolZ*8v5bGmqDAZY zIe{Xj3{wA$Qpe9aV6AN(zYgOlwT`Xd^Q^Vrz1LYe2{`k={QCQSZ?gA(-gmw0UDv(# zK6~A^5%U8O=ph_p^HE^2$@(LBH+2T#1bP~W^oKuBY{Gg8SoFIoXGVYy;}D%=z@l^9 z!faba&UQoa+ZO&cu#6ozO*|AQ(5E;e{I~;R8!ut8zc+^OKO~NcDC7ql5Zfu~V;^DZ zvrbBXJKI9>I~iE~&a~uee1x$%i*kecT#)ev#FKQeYRzV`srrYFKC431^raJv{y567 z)t-q(emUh8T23r-)|r^;TV6n&#af40bSRSk`J0K&hn>|H{s>t5tC_cjU&0BL!E`MN zu-N2#LTt2_4+W0oYRtJp(r=#&EPd~)U)?n3#9~K{Ju!BepVB|iwx_T_+gwZeSdANj zrJsBg<;*0|R^l&f{Gf%uO>F$`0xmQFTX~DVP3v-dfS++Ap#A9Z9*dNi6abVCjcvxkrj{0xiT*c&UPVd`+>&>v4%q)VPV5 z20(Y=kp6SF3DFxV)$0sMSi8YXfBRnG=uOnX+7&oN=LKMiC$Y#60LM&xc#li}{JYdQ zc8Ep)1IkT$iAByjDRy`-N2Wjk;=L^C8qNGS@h29)e2oJ`h;O2;>0EmyB6Kvg*Ge*V}MO03rIj+AM<4VS1H%R?-79s-uW{l}?u15O}f z(Rm73bPfW`_!nZ)Icn*=30xS*3G`pe2Nobm<-6XQYQO#-t>i^E@gXC!UJ^mm$@8A}js0Vg4-9_(bL zlmiZWZ2u<)Of>o)29T`ecug7v5Tt5F12#phS-)mQU42!x)7h@IQgpYcs3FGUf2ZgD zrL^RJ_Z`DM?>`|E!XrcxA5+Acn(ejU{h#31)#GzWNK79C$bc|z9N6zZ8Zy2P@@EI# z2IAm*m2Gbu7|Mmj-d7>F?fp8Uzjx6df3AqVzjN$8LVIEadII-2_Sm_57&6-HXW3it z*xQZBr;1;VWAE_LAb$KgBJtz%6{>zdKMi|q+l3^4e03(^?|xw09{b7Pf=o#4@mXctYl6Kjc%(ff-M9CB zVB6knxB)(ZOi1iK34v|zF1(}+GxlKGw|5+v_RMRp*Nw_l1zw15JPzT+t589fAbl0L z8~_w)gSb-9JT8?;^oAg!c0W1qa}v`_61_vvlQdCY3wtY(X1Z74U>b32p`U!}Wu}W< zUC!1|K5_cQ60Lvse)4w_2*cw$C~N;9aO{8K9O$`M{RL#dYC$Pw#?$iJTg&x~S?TLd zo@Y6=t!T@hw$=kBTf^nn+|K=bwj}jkb+yhrydbn+ETb23M?on6smY<1SK04U{5yA+ z7iXzN)BwU(ic|n6ZzDebs-;Jqwt(#9}bSzJ=tfnC>O> zVfF1|s(3)_%ilkI$JC^G^RodW&6kO@;g?!`vi*L_9@`F0nh)BHe%@>1q^|uP{ygs< z<31i&emnfJrO&!O(&5GSYNa3ce&)E#y+bkmFEQ@LxN=_D09>PN^gzV&-kJ*>r3X+h z4w0j&^ylr229Ba_ClQNI0kF(_Vf>H3W>e>5ZLzk zUM2BkHJ14C*-v|7<3r#o971&C@jY`DIlpJxBrKl+2&zHcsF&(_`a|kjYuvEhNK7wD z?4X%rPuH38X#YYU zpGtZSh6A&5y5-5IpIGuN-JDmB`97xyCstmop1(acx%vZEq_OnGuXfqfo>dy!AD+#X zSfcIa-WPG*{6x9enTF7@+++K!&a85*TCl{M-JWb?L}~jRj*uG?PL>ZWMW`6J;mSAf za?=#PB0skpdTuW06!d1NH#vRfcV&7U8$uKYT2|WGkLmc8lm5-)gA^vmKAkRE^pj<+ zx52#b-6a~1!(GSPE)l+&yfbUj6$h@ksC(proP)__om#)Ql76c+%2=)Z#D5UaQ`5%#Xyh)QS(~5+7GC@p0vLN%7tFz@n0CcU?R5=1n)}9KN-? z@xVm~M;?+Gei-Kp9X(6zi}(vlBs{mXUwbG&Hypa$N*n9gx#&pxE3Nd??-!M)kC&2l zEp4XDti+CGp6e2f4Z|3`Hp%hI@QAGabD~-M{jo(H|5bvOe7=XZfiSMFd|+15H`8Zl zU}PpNho?Mn&Gs&ub?*01Z}qRY z`=@Vx$^BBNR3wjFd2jluYAZ|EP3ISFSH7rzs(kE1Ja$~unaS4iklzk%=;c1v`8c{X zJU6kUUuZ)w`Essu$ro4uPy6@X(|iFj#NT&!@a4p(bT66DaQLvp_jCCE-Uz&;<@xsd zJMQNxcmC$lbe`jWzH;Yp4NaOKAuQgwlH)hn(bs&SKiJV9qV#ipdqW)esB$+y!Jrj& z+_N3`Y{z}La-ZPaAMUtc;P}75aUbQlk8<2Eboh%L{!5PkFFEdGlzWi>V;uK<$35S1 zAM3b}b=<$~@Z%l+V&y-`pNk#$OO$(1e=c#{3myNO5A+Ki{YxEv%?J9II{Fipeo+1s z9rsDfJ;=XFj{6kH{}ji4n&Upralg#rzoPVm`ur8g{j177_=fRS$Ng(gcwckeOC9%8 z$NdV&{R+puT)CI{^}XD2pX0dCaop!A_ltc0^Bngp9rr68_p6k9P+nI#?pHhRS3B<4 zIPTXt?$;{!puDej+?P1+OC0y>l>0J2eVSkC@QWP&W{02Y@U<47+#X)fN59gEU!~)oaNHA)d$r?U?YOUT+}AknHOf6m zUyb8_i{pNa<6fuSgY?xo?)8p;%?JARj{XLvAJpFsj{8Q(eWT;v?6@~O?zcJaw|W1U z_5A0~lF9s^d56tMCw_C`_tLP@Pg8t`_b=w#Cb~S}9`?RJz^{zzd+1){&hNPV9{RB3 zet;jEK>B-Ze-D!xd}2_K7g`Ciyiw1%||2c z{{rs=`G{off0G#v((a=?_Sp(C{9o_{Vzvy$%*X#Q`K9@bJS_jMNc;bi_l}c)t=d_A z_a5qv@tRD2QB2dzlHBvXBaZ*Y#=b6}vEFBn`+pk$G&|J$vWL%6iZnmo!z4FFI)5(q ze&giNcliMkr0d5e-phukjPWaH#R6&ngt`iuah|#s89|@|)(l>v~;o%A3&~>RsmD?3DlOCce4K{VU#o zIPq^Z_m_76s<*@NP*>@HDyjZ{&3na(|1eWubo@)bNro5yze&zx z^~$|Vo$~qDB={4^H`g)udOuU+HllM2 zUz+<}yI<}7gLD5kB>BI_d(iQJI;s4x^#(inyELhNTH-Z3`6uk1h|5s#I&Y*?zTY?b zspEIO_fsc-HyQo$%Kr`CcO3uQO@0(B_nW-GbMoi+CcWByg?FKoza=I;I{Zqn!b#te zr23uk{+Cm~rzW{qdp9`l|DKe-HQpfS{=U}K4;?=|f1Ubssi`m8{T6SDQ-8i=c%46W z-h8M1$u_+9U++zF-2W-*{@>tz=-mI=N%eoDH_2&#_aNU%I{%uzf6}ZvM{wSdl>Xbi zKX=NP#S!h$o`|JCj*{qoTF$e`sUu_U`5qeGN>{yiQj(6T2dsb5ZAwM;>4*-CLHhNS zO;b@B=ja1kpEyb1+zU$I)Dxw@qo=;oVFwL}c@uq5L4|FbG8Uf25`9SP5GUzy5Cur- zJRD%rQDF_&a(*j_J`!NjVR|EG+`6*!sMhHbmKhYGbiUP7ht*BieN#GJJ#|!k#%Q_9 z|6Ku=_$ZzHKpx#4;3S=~fjs(nfRl7C)^e5hJpoSAxkSrVoq00AqNCDP7|5ef1z2=w zKUSpWO20VJi9Q|RBz^P1SNU%oRKD%i`oyBIY);W~m2b}mSag(~X@TG9z5plbnDNLe ztmk{`P!fGX%Xt>RO8-SIx8ufl^4Lr*S8=#pW6Gm11z7ATow$}Oo819U(wP;=qXz<< zq*E5iqXz>lI;t+s*75>eqK5*Uq%${=M-K;BbX5M&*K)qkM~?(JNoPSIj~)%M=%}Jf3?QS=E(pj>95gp70()t zRaw6iV9{4Pw*>O&y8%wpsSD)M_X3=xQy<8qzYehIs65%A9hp$=qCXd9e21*RbvfS{9kcfV`W1Fu4>&s2x?Z}p_dRW;t&`|DN)~W2M6<<#a8w0 z4fTy`)X!NIYwFHXv7z#o>J=Oy1Ru3Ei5hLZ&a4B-n5NcHiy@{;32m)vuBmOpkfgIG zXifF{>c+~Z>T^&vX>Vv=g?K7`4wMSUtf$IVJ#?LenlLHBPLwr}oYNKDnFuLtscfik zZfa=8cq})2jJ)sIC<`^~QyS3XzWtjx>nRa-6p|eJwxR3cinWy+*P7KTZ9_d>`?hA8 z>05DQ&6@SS1=^R}IR~Kfwr9>*;=UtjE#GNph$ZgZe_drFMScd-zJ1&Iu9neEs$o4{ z`?eNjXiryaR(FF)A@3>sBUZQe{u)zU`R= z$h4poX%nZu?WiP(s%<67;Vd?S$fvZ_)0qua(8go(5|%yPSX+-VqB3T*?+`g|v~mqr z&s5_}du`0sq^Q0v*|n2x|N7>-74;3lqOXi;Z#sQj4(e)ec2jHgZB-Qup9r#)Y>zUt z9gEZ+J4H#uVXJE^d(AN3@g}t}gK1f|^&XCW$29pCbLM_ATT?3ZZPUKtQdmsk+_$~t zyC{XllnQ;@v~Qdg7E?I)ZI9WmYD(%7v7Gw0qaH>*ZCK*I{i}yjPyd#fg_?9{u4t^h zP2Q%|a(W>l4Hs*?;U52+l2S4_4l)s5>bYgGvLn_99ljnHkg5weRdUH7|vwWS73J_?0Jx9oMaIORAovuwu*mwxDW$3JbQp zZwprSIm@fFU!lC@(fz%)d~BmxcULv9UX5Qp8*AHrSbKmw%O?H;hww?_=C*IQ0`SGc; zHH8gZ-gi7y4NPIdmiKLe<&wgHCGOk5t{S!V>yyjK68G&txv4yto5M7oz5k|H6JYud zRpk#J2`kpuuTLb$+;KVwJ39O9b<0`SRuS}EmOQy4Y)my3M=hS8qSB?}J}mq)X`l05QKCktXYle@-*#02Ew3eisrFz0c7HW9vXX7X!n57LxcCK+m?9f&RY&D6u?Hb$oj-p>S+_ zH}(?0A41QzH{P-b=-cZ=1Z;bpbDt``4?xehx4^Q;Zb-VZJbsS$#kR+F5cvIANYeYi zoO=IoFM9cq+xEJ^q>3N+m$Kv6V8xHiY)Sn74A{2!JeXAX+pWe=99Pmqmc23H#oi)d z+aA}gN@edV<0p3Pc@yH>^CLio4saeabR_PEERo!+-Bd+df4dmjVa_A*fbxK(|U z@?e*%t;e+{Qt9o7VOwt~^itL57olgzkBKNi7_86i0;U`5%U_|fw(ZS=y;SY#Bha($ z6E4A#Ma>|$UpHr3ZTTc0&wCr7B+3WAL z2QR|jbhryid1N^4K?XW63!udEEyp40{iS2?qh9QtbnK0{?9H+4bvo@q3;{7*A&K7u zPJ6JxvNsRP62ECq{j2E3UWrrx8Z3KPTK4js=Wi42r7DjLp~pDHagZLe?8&o=?ek9O zeR5kb_I5b$lh0fBu7(|kMSJU<`0eh+UbPdyw=8?tSoYp`?hih9Qni1-bnXvsyix!= ztS{GE_9~qF<3um^u5|8?0?XbK%O0PhcKdP~_U?pCNa_o9;N+LbT-e(Ip7FcRxH13! z7WLP*w+{6-Rrx*+J=@+JR{XBF?A_(Gr<-7JJlusOez!U8>1UR`8=%av7{7a+`n(7B zip3bNVsDdEpL6k}f_hBvO*q8fe>nB;&0g&N)~SCLmOTzl5qmMGeI9@UN|k?KcG~9_ z*efvctF-JLbe@-az1aH)=Xtr?vX`*z6+8B3^kVN4$KGMfUbSWKU!D50s26+hIrZfO z%ibEx-c`u|r1}SYsmgaQ^qA*y93+lIl>Dm!FXeGD{M+^(?ZsXJfgFv?5%d{--z6xzT9Tn+iuEN%3u@hRl!||apy70+(#mR4|+CHhs6E05Ojm)u!a=) zIl|y7djEpN*z2gw%+*S4uSlZzdL(G$C@;o)0OvW-eKQW`3sk&ICzVV$OQ@*J+163H zZ2DBAfA)1$VtG0|{moAA-xaJy5bO;!V+(ed+EUcEr|rV(XZ~}y_l@eQ?TH=O{paJ4 z26u)dYIm0@)!)GGQQ^~*&g}NE7f@trJ9oGWb$5oFyzQ-d_j3mrtUdPeNH26Ms`j{v zz7BjcI%g}{!xLxm#RJ}dg{PEy7?Hzlt zpVcCNwKCt@sUg*g9e<1ca<*nI!roB}J5Kn!r35;3@wu*OMlp6Zie_}-oIZAdcRaN( z>;n^o7oa?A=N;Jth-)o`%JOsPg|N#DR>jCWI_}8)!wU~BI=J+}fvuNsd11@ct$RC) zIwrKGF9~~_mlSwu-2;MMU-s{5ODjWMmSlK8s7@;zvic9%zuDfjAexyo?EBk0e~|6% z+nL|>0(Pod)M4)yv!^Z3PgQ`%wcD$|Jvg6haJX@r!T4;saP@}mLsmc4#?@{*x3*<1 z^{s{WM>`Jo>+EPt!|rX|FU=d*exkkA-y=uzaspPYpi5}>k&cD;9`{ou?%bUx)b;BH z7lxxtr(ho??30zj9i_&#AM?ZVb&=l-u|D1+zxEx41m?rED+osL(=Z>-*oSTMW|+dDflBU4Q6-k@rC zXttz%LYts%6`iP;t^3EdzZ5Sj`*zu&d7oatZg~yMusgJWt)Cj~^Mn-zGd=7h)o$bZm?*FBbg>&g7w%TR-F+R$-m*TKgR9O+*8_M*3zzPbF3n@`Mc zo3-VoEiY`{r*e4nb*#l>y|mY+M=tmChdou|MHH#^5=`pz}T*gS2iP2hj+fTAOtQ_g}z26P_2!$_gaNNk5fAdRtGxR8IRI}nx~#{Zf`{64%fvgzFVADQX9eZSySs6I`q-^3&l{$AL8|8Z^)Q+} z%1i9n4Yw26mrZg$R@B=FW z!X27oC%w82`QwH}@(Wrc`FY=nNTx!k?dM-u@gu zjq(YWh`jE-(3bvs*!!#1(c8kOdH*INKl2W4opt}_*T;IBe)h?bm;AUguP(nn9lOQd zo&EjtO|K_TKIV01kM-m}-Mdpz$aM z$;GFx51ks&9-f_|&4m02T3^wWE84n(&=6_62jJFD zg1zVhl-IsFcYh=uxw^TaG?IRCDDuba*Drs2`NA8nK@Gkye&K-5B{NV%9`pDlK)#*{ zb#>!S;3N*d47K3sk9ShR{9*Vx*lrvraZuikV<@S(xVUuq@ZqI@!pqmJL`U1`0?C}0eD&APBU*Wh{Iee4DuXA{=S*=Oi%W!zEhibdC@5<&Q4xi`n zMGhbAdzJ1br$4OHGegXy2bbxqwfJQHe#-qG-(B-JI{ZP0f861BIQ;V#pB!F)6(0M9 zG--Z;u;|fE);~|_ul3zEztrKMu=r&E=PUn>e*S4b$Pdj=cibQL?P+(exvWX^QyuThY!kkh+{9R z>~T#@O`3m5SgeiEf**Y({zeL6AE_fqKM9|?z~?Cck0=RG+JBIrnrC0BCe4p<_yUJ- zv-o8uJncW*OXhPNez?P5;O$`B30ei4TbPJYh!~G{*N90ZHKplSKtYWq&d0I1aAWagmcBzfrFGME@lwJ?zis+8zI9MS$+lI^o^#*z0ig zbG2!8rvLwR^6N>XKNoJ?SFOKsPgCI!@vd|H^Ba>8?aAEjtx6vw9Gv)-IQ#_;&wdvn z+8gMkXFO!Go(S)uh;g59VLs1f?dN5b<2NOV?X;}lyb3smZ^5LsIAnja^}w-AO7-{h z=$rtvzml{Ghs+D#3LIr-frv$CFK~1or9JmmiVf8AZd{^_IH((k_&p39y%Hx7vB+Nq zj=29mBVe)fDRr*G2}CS9Ebl^mKO%A6f61Rg#4H#P z_XCTXmj`0;%jdC#ODysUz%dS@0dWtf=+yxhof(u@XgRUSR{~2MCcrs5Tk8;uP6==< zs^x6+3x{dUvW{}V1c+GlS=JHssnF^FYL+KNDE)Q(}>`ddYrE#3E<0 z#d2{1F`r{&6jb{)3T9oBHi20D-U=-Bfmq~s0!w`$7I_=6><30H@@>HU)=GL1hty$W z(dn&R9*0h$iL)vf)1bTMB4xVIvU$J?i&(-s0xW5N65%x94ki+m-p?D@A2xNsa!pavYVFDvMM(R|(tZ?dl&v4q9^jE&beS?3Ec)_4~# zkqH_z-y)Z2ycd^3R#?#UI3flgwD4=hg*buU#}Qpgq_Kqi33#a|#3KI;Sn3I}$Oocr zj8;MbA{IHv5XMZLM^k5&)*%)hzAK6je>aH^vFNBaIida9ZE_j)jhtBY7XZuNetZ{} z`bjK0Y|rI>Bo_HP%1wJhEONe26c*_?L~xO|msoU00L$KidBBo~#G=FMB6&zG@?v0V zdx=FJr`*JcSmZ2PsoTUNp9&l^46DA>VPes#u;j!dzY$pWQ(R3Qop53$Hu z=VKfI1!}<|eu+irKFUp6h(*2wSp2e{N2_oG5sMDn6VZ7RIJyQW5V7by3oQ1DMg9_S zAu|Sa2#3@eV$pfkk`s&kP0CGsPAu|wDQD(^h(%ru9GOn3=au0QycAf_L# z^D|<8fG|Ht&cF#oEc$GpM;SS>$XkF%eg!8`3l5RD0gp0rVv)0LDV&KD=usTe8U+;= z9kwSDXJV1R2ps#W);~y{bpaNgqm-MnCKmZ?z~c8U>KMPoqVq20#xJqRKL8fL9|Ft$ zMJzgJfaU%o7I_Bm>sufI5sO^4T_&s^Z5LmTK&tJk4Y2rC`_9&BxxMe~7k#%>?U<=! zc00C^aW-{~SihEQYYEW_@L2 zu<2r5LrrRjz+Yo^WmPI~spQp(D$EPf6JC;{kXT!txMc+vSilqxdj^a>hm}DFQw00c z3Z^F~1%i2mYVig!N`pGpX9?AwfS6=arSUADd(2Vv{9Sf}h%j5!6s#)D$mwHmN=CW1 z9vN=dqQK5O*2L?;UIP=_P+23JOPW<9Se$ydNh3gktTmG4{U?<}qOunASF00^*a0Z8 z4Ii9=qc;8FhCk=DA!XpbVMWcx6?axQ*7sF{DvgcR4cr!JeN$yqP5pX11}3+B5hn>T zPK}l8vD1(*W^UCr*Lr=-1(kTwf?Ye+gumWn=$98~dG)4-A_!)>(>gWlIYFtYXu-zY zYMK&ji<&A|)m9hTu}J0Xi|u@wv~MNzKrEkl6bx2yA=!6ztsykF>|nS#)FkmOy6POGD(_AQuvQ6;QJ6-8d|WUwvs(2e;= z61~kxhoph>-LQ8OWkUDaIGA4Csu;&M#U8qrYcm?_^VG?D+py^+Q;o{m$FbESQVdVG zG2^{2fz#t6CbSJKofh`~*qlA7<1z0$v!mgL-*K0f0ht)*!EtKd-ksY@H?>E@86oN8 zMlW;{*UGUaNs>M|jOEDiWX~u>>8vEopO#D z7!a127wya{O>6JW$Or}FL;@7*g1@g%YW^O_!K4*#k50+PIHR2yTb1miy?k7|E3>U6 zYmdYDt013Tx87V*hY?u9=%fAC$d#`A+ybO2$OYNs>a3Xw1<6n5CPq~Ju{meL!{3?B zGJmRVKqm5pqpiFWm3Pthj8JEC$@Y+7v?5A`HGrc5&&5X%o$`V4ZE7Dejwt$le%oI>kz}TrKvG@$onGs8%i3z zh|z3q%<0a|*FTS*IWxF)&Qn{slk5+xJKLM@dFJ)kz4k4w`|W&BpTKb~9J@IsJ31rV z8#y39_nTfT#)(GK7GhM3)S<-bvQRY4v48{PC^g){dv=b|_wUMm-qx^;mI?0PVDyW= zU;pd8#36KwBR1{Pk{r)>Zsj+Rqlt1bnkWaOiE=QSXn20n#O(Z7X?FgEYqBv?u5Id; zlC4i|ozOO*J(}rd2X{k$*EhWZ?YsQ(H5}V>B57n9$Mo3ae`v#xbGI6ClY}I5Z?J*wz>X6io2FS(1=S&=j@PLYhr~9Aq@EWg!4kElT$=1XO+F7XGNE&o@K5o6nk1(fa(}q)GELg*EPXIs8J0ztQ2%Cmu-CJw9Ip z!o3qPK>bvFa($WRS+<%qzg$@8|0u~`f8{@JxifwI-lIwTZxq&qx7Xo29KOrpUv&5r z4*!|M^E`6%aXrGx#$!5-435^-C%V8SI7N9 zhYvaW*E{Y996s*oe;2<)NV{-w{LKr7r;OpBa`-b2-`~j(cP|R=6HRKu!SOR$j{k`c ze}ltcdg4(8FvcEU+M7f-YU}__ezKV8^eDKwzxMBex~~4 zZ*qZ0n*1P^@8bo)ql}zbQF_EOI`J3ZpoI8gR%Mpxc3^&y`s8+o+R`6KETb=wbyG7M+JF=j3D%vBo{sOT0Jpe3YQ;0?9DCJBLh*;#W0gKdowm#iM;{9GRBKobcO=+TPLZ2IyVGZbSMc8)pAweax`Z3 z3XRZsAaO)vUIeT9hHq3Ps)o#m7Dg*XM^G+~&~PHX)>R}|LAB1($T0zy_~bz}%E*aD zJ{dTAlh!8|`Ap!#d@Wb?(7XuP^>Cr3Qvn(IFqYm}hg3kJnh``Ij|Td2ZsV^4wsR=gb(8%5#HNp0gnY z<>Ck#OusTlghe~D5GN3^#D`UIl#vsQd>pX!qZ5m~2)OW4oIq?Jq%WUXbY=jH&RptL z;{+lW9hQaYEC!bG1jM4F%Eg4Wk~(W}0%3w~0j#=!F<5kgD4gHCFj-lvF;) zv|Q!0!787bP>{-JgH=8kYk4j%A%j^Ak*QkFAY%seGIE-h6HDBfKckGCSmb5Eh0}2Y zEyWSLOhJ`i>AznIk?5}lj?e(80Y~9i6jb9!BL?3G(a4!vPAq=60gp0rVv&CfSo-XV zMZO!j@N%3$PvVfic4E4VR;u(}s& zw7z{WFc|6MCzg1scZ_nazlb`k0xUYqA&MEDD(bMnLByiNa+mg>Smd_@$7bV1^1G|8 zg&?KVj@_oJ<4!MtuQf~`XKy;POt`pjTw7T(WomN2bY0byWC4_>Of2ako0u$VtZAsO ztC~2q*oc$+v`s*2Y5HK5a0cawOkh2w6J5<9K%;z)-Qj&@rCz7G@2oUB>+74Ui{>m` zQi#wKxAfKztqRC2-g^$+rpfADa=faS zGQ!Cc6W<=fiH=?n+a9XCkCR3asKUou|9(Hd2_#7gG8DY66$GKg7*)VxHNyy4KU0h& zC|WRo@w~|^iqXRlFiAj(fQbT%6)4VCjoZ1M9?4Msh`#cU9M5|bGNF(G6cJ|{ezLjB zCCvc#@w$3#qJ*pH@h2Q@#&M8lp0D5KF9POIZ@Tdr#Mcwr6MxSG7vK=09w~;ywl{r{ z9&b*2VdF-7%VErpAD^B4rXnQauz%mSw;T32PJ#CLvypDJ$1!R2F8;Cr3cw3dk93=3 z?+H9qYaypS{)82KcOdb!C;1$MymPFG73vIDo%2_Qc<-0IA~l zuw!rZ&>(&&8b5w7!@nKBkH9yXIPfCjbOYG&_uCm-6M$ zbcV(H@*QJO%J*3~d<$|R$%k(_>HP>ssK@y6r=!?AhH&xk=X(VzdmOwF^+**ss8>t| zv;%ro8mcqhc>EEnlq^QE!egxQZUvk+sJkuzevh9VF4~LPRC) zl+R=a;YOo7-wBxx+%gz{Fm2KoSx0BuWs}c&9i6t3Iy~LBjmMI4!T1CA=|9)r{rR-a z?sTr&f;BmE6FXi;FSI@4;JI-3*Xy=F7j8*c>rjL`O~~t#{J{`pDg_GqL-KcXwO#0rZa>6*(F^r!&PHukJ`<@Da%YaZYgMagq3@?3Yf!80a4`df}rhYW+WpEXegvYf}yewX) z!47)XbM3W8_Ou69LZ@hBe*1C1r&3b12kXnQPZ$=yeutk2``S2eVd{SN{bEIr!5G1D z$B(`FJHI-+v%i;-Sot_cLP#HQ$<9dWhVrxy#3fDV%u*|77*mdLQ2qBGc-b!Bgs&7b$eyb1FkoqvAirWU51xyKZC_HW4yb+Ke#2|t7UduGbh z-XF3%f8U;=bLe|0M^x1RpGoTfu+r88)9ytb?}s`*y!p>N@9l@xV1B2@hy=6*t z`gMQ(_YX|#hx>5Hd#KytG_l3|3*#xwYAbu&BBh}NQ`_u1kkQR?2Qqqx_u=&$I!^3* z?eXJBUOjf~_|X$b-aK5gMU6}8K%CGX+?`YN09Fmj#h8i6351pr8tC8iTrXr`)^!KJg)4ka31_AXl;&Aj!VXO`^K<1wr; zMCq6C-qUSD^y5!4DnqZY75%gJjOc)jw1HXCOfRDeE3X9gCv<9&wI&EwXF+?l$XeYc zbgE?bK&-YUK9~~MN(gIO?JW;hY#GT*Wn^jOr<9qK-3>$cU(H{{T%1m2ZG z7>w%}lRv(4O#ZkHV`gtTu;rz#Gqz5>fA9TIVT6ntrfO49A%COG0BdU$Q?JvB}@ml4u!#@gm3Dm-=@& zM~v9(%*)4e|br}M?Qd~5#Xkza8wM|V88)sa4>6)6Rwau%z3)-dC;^k6~+%9ZrtY251 zXexq6E}ROr&lM%bB~yy0mt1zSS2`Pkse$xfXeMArB;0uGq>`GFhKVccN*an+R1zhK z?ySRz_K5_Qm38$R)HZHR0Kua}zp-8xIQ}Cm$vxe>3@<0ad#UEl=Spa5ewpt_^D8Yr z*{uk=s*0u!F4PkZbe(WKq&@fmdIxL|STxZ$|4xGU*C+wni&;W?K_leXXB z@Hv)!+G}y#`L1jG?{N6%9sV7MpY7P^7+TxjB8z{|$JD^9gVEHN^Bn$smHq|3j^_Ej zQ`7m5{$Qn_E6(^ubgzjk*HlTv$Y!R$z;aIxU%RjM-8H|^;e+3`+I^4X{zaQ?-JwpE?hbO!D1@%OHdgO8TUXe`W2L4g%gNa|X4K7+x8a&Q9W;t26(1r^{B{qe*!0E*!do5dEMOl<74 z%@O^X#KwM{*rc({!gDRmY?W~*Y>Nahwse+R_(ozA=am+&vhZ39*Akn1p~1pU#7s2k zb{vB5A`TwjDcd>}kr$hQ6NuRqF%L-I64F0SEOmgY(zXzboOvZ{elUNe?h%U)%Qset z6NtqemiFLX2v%#yCZR&K)fF#r3!jXYAmkt&A7;#1iaUzZV*d6-tTMdxwg7;hlZQ#j;)Ar_r|z@l>i zxUd{2QeAajqT!BU=!D-ZZI6>s`&&vUEj761s8MhSNto?c_2m8JVGYJ9LErz6j6$Fx zvngrvp3x>Gdw@d9G^mvfw3eUn9-bt@wu2dHkjly543x3cg8?we!|W0*BNUuz^oT6JE$|-u~oumir2q1R4r@mwbC*`BdUiZ`&=c*g%+)kh30cw6`C=X?Luesb3 zpovq&pAf{EnpMv*1J#AkVG>`LT)n%Li#~~7F4znlaU7(h_|5SxTu0+z@O0zz_BS|e zdryNmO%@QpVQ6|67u(+2L3->U?eXWB*yFba+urkV zzje@kJ`ScMg5%OjmreO1{peFJn>bbLpM4%b$7V1*zB6%^&f(yK{b-8XCTvMN_TBSC zUfQ9w!)Zs-4%XWH9iSKL`=Ov;EOd%HU;G8^{Hg_3(Yt~fXi8+3~}kv10Tmm6Y!)M{n~0^xk7iJDC|9&Vx6aI7iV_tCo9J_yE*sBJmH{QPC{(PcwsZ=XHR>hGMd%VpDvAfCGjGSIbuYhP*!ylj)LdwsAI{I+okR3Y`);m{@vohkr{7PUe%+); z=VfRA*Sv*0^F54ffM!_vS-5krH5wv)Tt?2ghbLm3%E6q3_dS)y@4-e}PV$U=o8QyM zJP3A@U_EN>ws$HD%EQhR&c`27`dmMx{@#AL+jQT4G~DjjlAwmLpFgx;N|mYE)Uv0& z?$*xCGtyB+-JjXJ%$`yw0YUo0e)9NTw%RSl+q6*P~%} zoY~Z(d_;_oT)Kz4HZ0|}a*5VjiSTr&(Qr3#I@-5C-Hy~N@w^aXKk8Cp)HU6!gZo@x zrg`~E&nFk%`CQSY`4(Y~dxyi{nwNnTLz^2Edze2>NgDdVP2QX z`%fWczupsSoYi~dc4K{zvUgsOeGqKKp2qB9*>bS|fksd&VqGn+c*<(=(7bQ(?|V$oR(Ec2Qhful4G zA{L!Hfn(+!{vO~${x}4+;gEjCZv#h+{0R%Q{Sf&}7CvI(lfcmdIDt;$kZ^wu9LvH9 z^Z^bD>ojoG%!4Bq{ZA~N(bO?FAF=4D{512q?EH*Ve3jkfm(1#Sj6I&bwk1;7Wo6fQAQ9% zEb@neWe?3zqO%WJ;&1|3`Y_+7+{EW3<)+_~^+)6%0!OdF2}CS5*>@^?4@8Jf ze-!&mrCf+bpW{lz=1AC)zR*14i*N#|axs`i%l&{!%)>}7kshB_I7VaMUxJwr5>H|Y zm-!(5oKF+y;{$BNyWYV%3!XF=n^) zvoTr`8UxX9geTB+9I_66oY?5F&POiA3B)=tIyVB#+WIRk`D$Y0H!ht5y-eSSUF4=WC@>v;J%vz4S~} zCv?nI*F^9keg(cmuiw~|w6tvykpJnv2#dm2HdfYE<4b<3#e`EtSpvk0vi!td-Pl;) z=+7?`N4rbQ7_o^YEs%cbdY8xUJf4T&)VFupuBP8ZS{>+D{8BQ)s3ldEoIze>Ed(mFX$yy>BMQqa^F27ZzryPeNT5Qadhq@ zagFu0f%l}zeUgz%*oTFNN}WA@FDlHEDoS`o8=D%NDp%opN1eKUk!60poA5q}f1id# z@LppH(3C5>9%tfA&Gy=l@Fy$l%O zyR?wlTLFP>uLbtDL67m{E1}rC7udEp7n#9#X(6$<2?E>Rz(IQc9PQct2z)%)_Ljnv zd7LSeVvnzow!JL8d)*Eh?a_wBZw8Fn_8x@8U2qo?dsCof+iQWn9Z;e@zSfDocY$e7 z{0%~3S=CRu!CCE3LA_!!pdrw!(omi0#$yT$@ha5J!na7=@&OP|gE&!djxe~2UODX9 z-_^O^58ap!lIT^#n52R77h#Wc0qM@?GSdsM-ldZ#ezAStr%XHN@9N9O=1n{C{+7hl#qd|88^U6?`CIy*EcG*`ashPt#=c)4=E zMPNyP8P6-?a6xdd8%+%uWUS1=0?Nx`G~yg~t{h zU3z5sVcFq*!u{OcJ?&7FpU)*_%&nlGV)K&oyoKS?*8HwLUJ>SqoZEix(y#I1JiXsM zzTvkKwqv`ScgqjYz8|}rZ+&6Q zKDBeaU4j!(e#IX5xR*4P%%?1v{gh}x|ApGs9($Rq9m?@-y;$uuNICDpj-Pfy~-PfCY z+kG9W;-2lf_jM=G2OHWiu}(zLZ-*KdHN8ALl2*>9OV5(T?%Z20M@dfYQIhN-i&-Z&3YC14v^i}1ucim2*E>J!H)va(?qbxF2Uq&fa=p>q}eG ztUGWQ@=ez&_P{M#e6ydUiH6RH$JUdcOt)(yzrekxb_R5EwO&A20ub=tS(&Nitz4_RxqpOch-S+r`%}c}Hg=mfPy9Q#X z^T)kITV`#2scpuVw8O))B%E0)zk;#}5bw;c-}T(H{=+L*EjYel400#XWnB2&e)!6c z`F@T?p7e8UIdbehvj?Glb(E3-5go zweW-=MyTsgxU0(>$Cori?Cbi4FzTA_Rl~i^muY^H!w2u`+I^Sf{)EG4$O|OiMrnV% z#V3a!R_^@XqABbpyZ2M>3&k0I1+*9FYksTazT4psI{b?cf5hUG!|$)c3-Y7C6TkD6 zdyqfpd9S2vV~^vKhF=+sZ}3}D>+@TaCe7~=7Qb?+f5ze8clZ+)pB!Hup84zrEzQsH z^)(-)NAp2>YQDfIsAhT|FFd;$8WGopMIC8lIDYXSDK&i``7$zhu`h+haBGj z0b}eRb=*I2`1c%svR_{ZJLNq@#lOtg*L)CP&Bq=0n;pK<;kP>cF^Avl@Zjx%(OSUU*eIoy3hv%3uA-Z#~7a{WQ9_scFSh@%Ist*4j9eW`wJ=Fhq$NoAKSO>10 zqbPa#mg4()LmmI`I{t(C#5(-1IpL2n_IY9Wk30T{IQmw0D*eZd|CPA1?^DJ)a1H_2 zpyqFSA=-b|vG<6>&vDXozvI8a@Ruw5Sc6)O<4XI%y{7pqO@!H>G8CgF*BPGPs6WQx zpE7)|(vN!FQ%H#VZ4S?G7&1qISo#n0fFmZZ#%zCV%Dw%iKv~(P3LF^Bssq&U;k$jbBNft8oIY#34HCfMw1mzgvk8vFL20yaFc> zvB)0*mc8h^fTa)haSO9u5u3!~_Xy?J-~=KT`P;xUkCIsA?@?|Z(!?S^4J`e*A5rI8 zoIu2)^GD#A=|9dyS<1X2V$os$oXj^Q7Wo8ApIGFaw#c zA7$jkB4?eHd9r1|GS`e)bXa|5e&}NAn1=+h=rGRGKfRimHyCIg4(WTo69A9$3PC0a(H%7M+)XC0t^W9|M-Pq=`j-0$6OmMIDoe z#G>;)yl?~B4qa01Q1A$6Eo^vi%_^aSF4A^L1vq%4R2Y9jb0C23B8fO1$8Z%gQc7ZQ6I!^+N9b(aW7Fg`CzR4WegTRH% z0MHQ}lCERGk}hJga}qdWm`|uvgA<5YbXb36e(OL!kC+)CV$tC|eQ9TiMb6(JQiq8} z&SzO+p|-;+BI}G#2A1+A7Jb&k*fg9#vv3q%rl2l67A$BX4oM@i_+|Se>xQqSj)_09 z=&YmM+%Lo;e+W1-6DQCkION_Z7M*Va%e_x5@;$(^o;b0{_fpOXf`~=_0# z5R1-HU`hKMz!7E)=sg^AKN5@nN0hI^2}CUN&wwQk#3JYS4v7QHUD9i}A^eRi=_MAw zqk&~@bYhY7eZA0(A>+G^#Gki%B#skkIu0p!V)4tej+NpB;(aP*M=UyvC^uzCEb`^R zg}l*0_u!EHBo>{mz>zC(0zHZ&Qm&wydn;-GHbkP&dsEU*EOM5ktmjTFa+ay&GqK1I z02eZGAl{D>hqr;H9EnB$1Ikz71R@r>DqmBV-13bX`+tPKq=i`ga$QwP3$e)6y<87P zkbN(6j$h$yEx&TP3>uPAD2*JPa!X?4M0XeUhFi>D=6!FXPXA}$M4ehGHc>|y7_76g zS`9o(F*1jPIjjK89_845+8<})Td>^x5lnU(VP+$fx^bgSMdq&PwuVkck_euvH?F9! ztj0$1>l55`y0;-ul^7<1F-MIx318E;t#epx*e+HORn_MjglO7^bP(dgRpaWg)487< zWK_~d?ZM9Ndh+)Ax{qGt^HLM5-Ns#(9rOI~bV zwAA|eY9ceEys_p^jB~24tE;~?81IDard!h;4b^rGCvChK2lPxNUS$zxM~I~u?DAQM9KrHIc*;!Mr8?Nxy1yMU0`i$iYPdlL3OG4bQ)3rX*f9eYi1cwCI(D)tUI_IBrZUN_ts zKYOec_l&dSHxil4Z+}8!?*hkO6@DMTX5wd$l`4nKwzmuwjNb-@#9kaSJH68pF-fmI z=lTi9UKvBK7_I&$UnJgH=9`xA5`_^+ z5L6pPPQ5w8;3|4|L&+Ya^#Sfn<^|(N61}e>qLN3HS1??pneOv&FdewHFh*;#*^^w) zXto)R^;z~XpH?hGy3S$lGXi6HlW}m2Ru;KG-RXhe6)GM2#6Huw#k2I1dE5X+9Fy$% zPyL=x^S;OZCO7#TQw@Mkia}q@wQxk$@hKNYk?^^o-mtuQ;C54_%g!*kNS$I^M?Ip%5U)&COeE%=;o)GavtdzkSdiM<!&{!g9wh35WGnsm-%6nTR&JgNU*0vFBv80%zvaka{L&ZMa)yh)Ee?$vF-X8WcV zjBfBYmxsO1U!uRv`vJxQ$t?D92j+M4i5$(y@WS)3M}0+pQGvBGKs2K*EfIN$<8`!! zkAFFs7JANyr=_ATGX5j|P`Dzz6=Q+k;VR!;uO7LJksYA}7->{?_v~;u)D7IV`B1sn zdf>IIo|*cp_lKNGAMK+?7ml*@pS7oTcC@G6owKh!^b3sZ$>iGGq3&?`+@rx5z+D|j z7q*96vG4p2%qI_(A3Y{9n0Dgm(Pyw8bu{zD(e3Tew7;B&H3?cmIoJceJ3sfIVJjLg z{vFm9@bbGdlG2mk751Quwdgaw@K&7yonL=}JpWY-Mwo@;7(G=Q;#i?*xCQf*we3X3 z%U+@a>kedk42|=ly%Dn$-Y=21Xl6%R>pKWFvn6d(=F4f%!5y>Ey{Qjx9@kNkh^X1q z6^j?PXSO2GI7>Q;P%wV4eDSdz`^hmJuDnoj6?5_KoL66=RB28LNAAv!Ht&Q6*XQO+ z{p24bkMUkikxoHqf6O1Bf^nS)LDGP+RpqZ<6)sP#d>NxD?RDODSd?fRmW5Nh%F|yi z_g=j!v_GX!6Hn&#jx&LUyn`48ml;nB*7!!PnA>_q>#Wwf9FZz{6MZ1FBAV_+jxKE7 z-`;QZ(ao=Cdae79&WfJF8srCd%ntWk)}1(g*sD0Y_rApGYLsa>Joj*@t3540cd?f^ zS?z6`-JYIb(Bvf=p7#d6T6AA$M@L#>$Dxp{uz&*n6Mk-RKNKN8H=2b}*K{wL&+sla z4Oa&4M(#JA?4Id;1@0q!8<~!KmU1uf-8KKB!>@Mupq_my?>(bG8a6rBWRl^BDL%s+V)*%r&-C8)!`AP}TMYlIa?etI0TeOKL$Uhu z-;x2bjt=z(dF{p?f2R(`OTdo|&pN=d4O4L?4ZtxJf98{;8Z*N6o!2N={cV0I#?D-4 z{6C=dhkKtJcV47ksXegKUXbM5V+OF=0~>N;kuzSSDS(_<ic8EnD1D18FS#C1-oA*PEKY&4ur}Ux6fn|N^g~Udu!qQ<|DeFtK9g=Yc zRn*~+RuJ1~i4U>FXC1KU)B=m0CSWNGV$t73ouN2^?!zJZ@Bpyn1F`5o2rS_ei+mrj z^u@F4NSP9gP8P88i+V*Y@!I|0GZ_+RV)09J z5@%wOvkpi<_&DI0=__aX%D&enz+#hF{7wZHo5UiI1Irxm1;DZvG@!qJHRB%}Ly5lc zq~Df#B5AkthxJzGIWzt;kDB+C>_5%;M;LKXF%BtfVu>5W75l^@SNYEj293ZGGyS3fY6Ps9l{7l*7f z%zH=rRr#Ed{?i+Q3#Z@&;(a7|9k8q$e5-|dFG!zqhWo{qUveuk*|)YnaSMAsR&1=T zZ^B3O75M5~-*|`qEnmcMyY&s#>)pN)%CS#o&rTCMG&DD^(Y+~tCy3RpLJbC9UDwcb zhaa*Vz2@~v5p$hW#$HX_y$ze?T2}oY2_Y0fE%Sm{kA6t+2vXJN%I(od1hKUlcqQ`Og zY{%oq?Y=C1|FQj{oX0>M=Q;MOAe)avNbIqH+qU;A?0pMLw8uD$z0JT-_0#bb@T)k4 z#NIs+*!F7iEpr<@(jH9v_6`Eu_PBnQorhxY9~^t14Dh^_kkKBXZ;x@c?d=7#7BV5R zM;$wU%kZK7S;%OQ`6lUo4A{2EdcpQyNbGe%VA~rABW$;6k8Q2k`#Ox-_KIPE;R%Vo z|KaG(ghND>a235`VB6jTI50niL~kwxwjTE;C=(@IMehn=I~@gxTrFfwN7T46zLhv^ zdym4vEXah!9@~4{-VV!NwsE7qYhcW__ZAF1AjWVNdkdgs+xrZjyW!6G@l}Lww8ydK ztY_&sNVNd`Z7xJT(it2Km-$GdUX_OGOgA3xdZ@38VWUeOQXK%C8Z?J{15B!KqFg7| z{wDe&+85ejI!IzK59yG!Q$7L_Z@@wK%WyCqtQVI~{$lH)PMcU_KB1nyPvAZT#_;rg z`G5KZ{+oRQP4$gd9l#(yh zFYtf*#gKU_|NcMg7prO7h^6>z|2wr`kJESS|0vA=|s;2<(=VI&uFRld-j^-;(YfK^tc@OMmYU%UjCfDICtlKCmecbQ%Cwv z_NR1)clN((w%G+4Pi@S&_KJ26EZxuyRJ^G@ykuOMmS`_@N?TKIBQ~|DYnHjLHP_qC zb(w^Zr2M}^w|@Tl=fA?ozB_RJH|wL{M(|#%=iP~G%b$DRExh6dhk73P+jxBldj|0O za1gaWqaI#=Bo5w#QO^Qzc=>4uLJKv?@zh!Cx^*j=R1ODb(&k`ZQnW=r3^i#SVX?#Rqe|DeP~}`6hp!!w+=$^BsPW!$-Uy(hMk$ zgWvYwAp_#KMb5+AsW|<8h-=E4Pk`$8)DVPkJ|C(6k|B88zuM@>aUFsYPU?NYJRta6 zK=xMTdx^}`<8L_m-d#X!UOHHAA_w&6v+=h?goCko#UbC9`D~H-S`2F>f9!#X<$D?R zM;SS>$Qf45d^-m8LW6nM?=ylKZiqi5L9`h%`m`gMbx|-?Lv#d<#vyiciH)4;75(uR zW_(0mOl&GS>zc@?TbOk&X&*TLKm@Vw$$oNkiOo0S1;qT(M+!cx$>%Lup^%R;eB`OE z+o)F%{xEc<TNtmALtu)}Qv&$dBG z?EMS^+uks|DHK3Pd;F;{_G*A_dk=tLg+oZ}RY73en+_uqKQ<3yZ#yvUiNDjp6*z>b zN4gJ(ZLbCPsLS}_bC_?Bw~cKt4#wQ_aM60a7UHn=I0u&ZqmYC<2LfAf2bj1h;VOFk zPDDN4>!eq~RB5QrbmPG}F1!j&mV_IDxP1a1<=9~BF)l))Hxj`9-N*Vzl4q{yaV)AG z)LmdIaM1lrIGBzIjz)YgudA9kwb;D)p6$JN;-rZslhteS*}r`}RHVaW8_4mH7a{a$ zW_P%?Ty}8aTW@z*IJ{rNRk-KImamz%@0EXh?!6ZtnRZ=Cq_aJ{IGXwJ^ZB`9?AHrW^ePcb}#*vo!BkpF)#h#54_EXU-r_Ez3y%P$uGV1fBe|{-_(73U=`K1_uk1l zNeHM%29O5J#h@w8J;_ZndBL?bC&@WLcoZoKf;=Q4;UO=P;G@>dBPWnR5--C^5H->$ zsiu}|b2M6NDWN1FrBrhvDA#%cH6m?MDGy7n`F?9=)|tr>Z0~o!f4&Vf`R%oTv-a9+ zKWEN7A`d&|hTjgB8}{8HBM)ZC4g0+^@^^)D!{Ji7;Wy~0N>`+T1Wy>*j@n57``g_^Z<=xWsX5^s` z8Tsqua>LON<%Zu~lJPh0?^oQv>4yEHI9e?oE?bVOrT;2hjs!oREQ8B#frZY94F?BD zM0VT}5qTgZBL1fRv1j@lb_C1jiMGSRo_l25p9TD-){ZYlychw{wRhOO+ksX60 zaaUgChR!=8;lapwCsGa*yj0KQ5xiZTRPC88b2Q*oJ?>3lS$KzNs9)Pi`1> zP$=7eA|`AZKQ8fza(t0g>Yo?teR$tfVP=uKq)jvz1{eNZjNM;f7*!Np-X<=4%Y5px zHnC)1@K4{7-CmzhUEC(xyuov?i)QZ-Ul6eig~dg|rEQ|CFt-L6%q6=MEAABniY zG%Z1Up>_w#*xNgyPMc9G6P>{om+-!ZN*Nz@SB=s=MDC3$tj!G+Rdl~yv_05SC|;=9 zAJB@R<(6IW{|Pa?{!H~5tyxR08{R;5{}y~*CKIEAC6|TL9gvOAw`!E4Tjbd2nYEpP zquW*QahX)(gU1a^)b~FUbL-DP+5F_sYTv6@4*t3KE?A;#xDOhN%4GuVSGwC|JuDd# zDBIHWX3y4OM~8f&raojz@Z%HWk@~2bsAm$MNv(SXmi#qjiMoO;A@7nU4RSavxg0pz zsCr99Qq7u>CBd^FiO1@jo@svOXSG!Cy_O}*FAHr3d2&vTcA{Q3qD2LxJ7m}Fvc_OX zhWup>Jbi4TR061@V!vptPblbuPcq;WrQ^%q!W!jRnQVztKduy7_Z@PN^LUL`v{A-m zyijXPMUmFMw&*?e;4SDU2W4D?He)$j&u$TX|B`sG{tSGRQPc9I;{8i+@WW=I9M^T7 zZ5EpD*LP}_6Zgp7{nd~DAO=nhM*l%JH>efw%3%L(V*TV`U6O2mCUd&#bjX%%k2I*2 znX>5#)jLHq+n(xoO>PN>>N~1jj71qn)Xpc(wKg&J+ z)t=vog8JabLX1hfx2oO_`JI{}y6-gd-C4g#t$VCN^P(NqkZp-k>f%bgSA<%D2a<6z zE!tC;+n_qiMVB_MCV23K{88OrO`EYmDubUB!TT6OQ z`$9XmOYU%X)C3&|rFH^GHQ*?W3#D6>gBN?%D`$nLZbu+^dx`CU5e8EBIHGi))0pPRswY_tF;4Y#nW) z>FMPSK3Ier8iKz1Nt;+)t9dW=1~0XWw`!(rK6>Qn_PyIXF-91@Q#s+6O{n9?>eUB3 zD%}gD7I;pm?{|pO8m;3ZbnX?CYqaCf$i|yu zi&_r{Km3*0F|}phmxo%P-23F*&^Xi>P%k^>%v$B(UwYNQd?>C?Hd+deljpVbolV;C zdackW)6injE@+&A?ZNju#m8F|-=$u4&F_S_wrA_!t*u)xKv#xT7bZxh^K;Y_zKmtG zx^sA|>2aD)}vHoLna(nK65qD^F-4VQ|dK+yri+ANG4;n3s#n*y`qN( z&|c02gs(nW-YqBBX&qO4KdaG<{&8QuD6dgE(Q4Kl6?fG%&+ggYwB6V6m^K#ek;gk_ z#$Y)X?Qt6Fwn(CVVy09d=t2KBMq13uQRRX(Dua>Nihx+MBYsC$;Imr2J(fQ&3TxVC z9@X}0!vmI;0Xf`Rh%q5}xl{&w%7k_RT6+Vq+2}6;QF(V~V^ibh`kNqN6D-z_`($g>@tWn-qhPUDreVbIM(vi%U|A1p7ro?asCGZ;5PJ%f-#)sd zX-9WGX2UIh5xntX+0@uQS*`t{h;NK~H&}Iw#yE#lYK6#?#)T!gMtz({?!ubWs26In zze2st3KVP~yM2EkxTahLKk!M-ht7`wJhJFbf5;xpB0{(H4_e_eX12rLM{JD1{XM`LT#!1$Cy{CEzPV^H-0MB z0atM3Qqi+{Y{P}A>ZYl3?DpXLMRM=f=0=~mCKZh%ukl=IJYH!ht_ckBYCi6uADUeQYuB{9MkWy(zI-_d@l9A9Xx zJU?j`L*^`bD*h?Od!=^{bY{rnz$(MfgU~16{{X$!FXK_pxsB5rEze@@af0TwcWTsV zj2BodDp+}{%L8IA<|OUlmEL#iXrA2B5Ug+_KOVbxp%wpF?uedKv;UsC+ox^UF!Nwu z#2Rlud~K}UutGpj(ARor4+>vVE5<3sccpiNUMExP)s2JE$4~-VoqkNCWwVUK*j?{y z+upTZ>AcuG6U;RjxwPpCa!i!BmPTNjcWM3zp1UO4Fg}nMy(n>qT!XqP!sv}MU^O0G z)CP@r$T8@DJzKlBYVgeOVPUDLhlSL7-l};-w@@E*?>i`hmFW5PlrLErB{S=Tl^EA- zV<^uqQ8V_KwNeOXCe_Les+Bpl=rd@AdT;pSMKK2R2iZ3n_7%!iu&)g5-L$U+BdEE; zUan0;9bfL918qZO9O`(89ILOLX)Gc8f;e-`oLPXGgWF=M#K_~wlnSjw>M=5|fWGcm zWIf7trl{?St|zF~c%iXKOhHQ^56-OZwpOfIb+us}Wc&QGD4=d!A-}9qZ`>%_e8G)4 zpK4GyJSpR~p6>;#|64ZgP#r_0LaU`A$Zrwyn?e4aS#yr+3o9T`ojUG8;cG~IlIKiq z`h93oKM}#j0imE5sii*=sy9Hsa9}<&>k_k4A+3-n*R<(1by06iAIkbb;#10T8hfxl zC|oL)K`)|hzAQ8^&ecj^$2rq+xffn7$C(hkidCR`pC6cxXs_|jIfq)(4qWX0{g&VX zhiu%Y`U5gp`HAeRS1X0AteaMUId>0o3`Q=N=w-)fjP`EPrlST2?-J^{fQWxa^M0ZC z{S3JSE8Z1S8}uI-wa}CVG-B^V;U=@D$1lkpP z4qAcw;ck?@1AeA;mWI(Ncn+<8#w&6Nog3hs;W+x*LY%W{`babfeLO>kO18)^R7a0c zFMTPfX4N%^G5=+)S@wuFpniGf)XFD%o|u9)1ZoGPyjnsl#LKhxLY((~etIt6o_`VsoL_s_k{aQ;Cva(m5^#4eGcV z5@#mIUX}H9<~jXUIRvX}wPKtM%`opbh~kFegYT0j)H&AD7*}vku!3eD1v8KO;8~2~ zSqF#JDK{ScZILhSsZ~#%X_&it?vAn@T^KWG$lcL%>NNd~{&-zcL-6v4SVPeK`WLKY zNmp=j17^Tmkmo{U{J^X>WYU=(7j_f{9^RsjL!Df?AlmC%xA$!C#0rkq1>PF%7-{aP ziwgu-|A)Z5cHl3)SR10gv4URW7mrmwrmfO;)T{nzNm706dVix>T*vbxS!G-m==|Pe z+sn4+;(Y5{aty59T_3#ij_ANj`YKk^3Puf_vz@IJ=L5@ehPO8`#5k{~u?}rQ(`Sw2 zHSi5a#Ng%kP`=i!JzIwau3|m0hit8l~ML~T0tHE&I(FYTFCSlesI$c~O$ ztf^qBGH4e@fNf-HK4$XO8rJm96W`N%wBZd$>w~M`7Qf%3Vg5ud>y{O6seIzX6Gyjc zML(8tIFnRP43c{tw8rh$*IF7zl;D}R&8CsuLz@>R5xcn042etfVs!h6@aRsX-tR8TF^zm`=7p$$|i*kK! zwSCq0+`yU%1zMT510|%ni|Wrf|0)UuFFs4Y*6Yt)ZQ)Ek|%oNW_j1zl(n z-3{;x`X8OUyi=pM2&_XNl+DqtrMRPbE0s4v{DUBG%c7)4{CF&3zw&{`-c>-95DoQoa2j8)XOlS1%nFYUztY!N{sUP>C~a{akx#r5J;mmDc09>Vr9q>Z}l}WI79^ zvsSuB8NB?4P{v{H_24HM0n{rPsTRI3GIwacFM2<&HG5)-U+jSw_sAi!>cVpvX{pw6 zb<1&!#QbHBaKS|w?aN-7nG=;W5wHYXH9!5?Wx=9iW}&xza8hj3uK}rSaJ*_cA;pS)x9<7`zQIM z+Ip;H(1z%oq8RgGAzfFb>mzjK@}1haK<1=kElqo&Zmg!@S{7ebQ>oX~&&AcRV=|*A z7prpkb6c~ZnM#pkBZCXH&@8fh+u^Fif!4qsb;-CA@?~%EBg~dqwY50ZPhJ*5$6&c+ z^SSN8&LXj^7S}?NqMubQdIi?dNItXX%f}zX{A8R}sr^pM%YoL%U#P2W(9do{-cr%q zezfJMTMlnij-$WPsuey{j_V^gu5+!H&5n+`;eqp1wy zhgb!i!1cWM0@@5?9GtU7n^BA34T1~5#OjS!L>)C(8W5{#d?5NVJ*=r z)vYg1>PMjN0WCkR_Rw?&s>7%=4GG`h0l)mbt`UB@)cX$n zqR)`jLn;SL-#sUBy>za4rDpeb8j0x4g{~kdCur84Q}@`@k2Po~Hp!-#;76b1T1`_! z+S5PZlJK;ak1KGP&-5N&vQY#(d*m-`&tpc#_`40>T|wsolV#cs>cT&TO1G+^bK+e1 z78-Ql;u@ZzVNnCt${0hpsyG8ks@t=b`W0OPR&idW%@`{)O&>SO9TC9~wu+X9DS@L~ z(gMHKuPuMxi}Cds`8oLUMxj=GAmg6df%V8G`JV`O(rUfI$$kwg77+Z|hts3>N+}-#>?VftA1EbQySI}bg862%R=)GOi zsxY};IffNj05$LltqAEXti84oSHo!(@YJdmf0eDzWYi@zD7b2gu|S^{gYVai;DMtu zc;KQ;*ruJpXt0e&gNrCFT?3j^=fixTE;Dg{y(+(8o7(Y-9Qy>d$I-RuzqtCO*P{0h z8N@Xlt#Gl74`{c%fNNc}&ZBGVb8t?q&7gC;IW=d-?P&N}?b!PIdKK4$mox^)y(52K zcL8gwX1N2_D*9@ry)LbAOkjU~W*{m*=14^0BZ1+8rs&9^4I4&G7DP{cD-@_H{HLD`^}o)&ib#i{~rG9M>@tH9P`HhlWp&|zUON{G*ol0 zjcUN}lOL_cua({nBidb&_|SIDeR&0M#P~w1a5zd%RSCSS!dnoy z-$`Fc;u2iQDbDZ8&z;aZA-=#lpMD8tOOx?+umPT_(7ZNM>pm`T#Jr@{X9x{8XLhC? zDmjII>s%YHM!k~5Z>zAr^t4pm=Cfj(^0h)g&fuLA^BUgW@tk;891|nu0r9MSSsdz{ z8iCXZq(&k&@@27Ue4k?-NOd69iBu@P3{qo|+7GGy@KqtN zQF_I}{8w=!gI3i~yo!6Hw9WkmzwzX@Nm;nPK#7eNui~#(9gFr;WNQN( zcJ;?S6V}^C#*4drM?==g)6V`SxJSbJ`cui;3MqHe-tTy;-@o@)9E0%voPGlDrN}2H zy#Qfj=>kzU zA2%!8?}?zh0RA6@`Tq}e^ieUtxTH_~e;rv?iZ=%?EFH06@j`gzf2|Hr3>B9wC@ovK zXz`N!mM&YqV&(m-9#~zz=D~*^e&qjBIVmKaq?R<3a?(#(P%e}a4ilz?w&d8`nIQ}rm5)}nOWKNFiv;~rCF^16*BeH z{V%xBMt`o1?u(*(fareLso0*n*}tpf<1ePq9~IN^*x5_tTkohz?f>r6Nq5{g_T!Vg z(|^!&@!buxeE;@kZEMVxQ**XI@}#4nc6;Yb8$X-X|BE?MRi8}gy87X&*Vg@P@|;Lh)77d$m!(+AF-OTYE*#T_S$|M1T* zo$0?kb;yE<%0G?SxaGKy1qr|S~h4bb_j%7PHm3mgjr5~lIwyn%kQ@F z3A3EmWQrLf%<@$vH~mkT<md=pClUW z5NHf_jUZ%vQ-HsR@)Y7prp-HnUAJL}@Eo={>NE(1*`DWthnaH1EPoN0?IFzamw}T^ zov#tcT(c2o&Mkun@{8TAClsvLY4EEuLbn{_t<+1)=Fy3R{hgtq*Kd54Z@fF)c$3G< za(d5({D@w3n$KwoNdAz`Uw!z|(v3PW0 z72b(q?33vaY$;hZAFm%TT~@MerFBoWUN)lB8^FKvtisoMrVK@WfZp?MJiK8UaP60P zuUv(4m4#kWzH;gO)nzMIEt~g9>8cgtQP9uy2bYa!#n z(<42$M409>3TBr#BG~gGG-ibJ%;`esGS7pU16z(R72=C;8EdL?^bYq5PRfbI6p zMV!V~4y;duz|Ny_iq#wiZ0uOX})i=dCjFe(R? zoAsrH>1zhzGAqMh)<@4(+U>jb+jxEy>7?U)DNg^UC1qosyj-&yFR_sEmJfo2+&`+Ja)zBFul7-75%%Z%x1 zlztQ&{bl_LBaCwci1a{d6g;Lr%7em7@j{Hyk+CD2^tj1meQ$!d)1c^k)<@585@z1Y zkyc+JBJ*g)I7(wXm)=%hPh7;yfJDWV^Ol zvNjgi3acZ#`^fr178_x|21(Zy6=#98u9C|3&&u(P&gaPi`!(vVxJtc#?K});?d=e)|4ZRT@Xnn=>z^;@;+yq+1vjx;appS` z57{I~aHKP_($Y?4a#2Tuw$V=A6Sx)a(ig=2 z^iF}#*R_*Jn`RH3v3`09PNYiK($-J3Rwej*{9`J|guc%%Pg}nsjNdn>TDn&9Xh zsa_f*WqX4EJ^zLLgvy@EG1Y86d4Ei`l5s13-Oi9|`A@`!eA!-x-%I9JHiv%okf+s$ zM@uE+o1)9By)sx7`;^QfxHB7fnw7tRtLMZ|sNC;M8`m_>(#-Aga!y%(cfM~z+k}LI z`huv57w##Z-8DORPV1aIP?z!k!~U;h@bhYY+i7xDVs*YparkX*6Zus+Kc{cIN8V9@ z-wZ?!{pJ#Ht1FW+b!Q)`gn!YS9ET(R5w7B>j{Jvs=$%%5TREfGIxKk!Y(d|4S`s_+ zuuWc)vlBg*`n<)Zqt{K4JMS;o`Z+(J;L=I!b)@X@l0(ZoeVg}JkKM9ob6ZX8 zmgJg*3H1}A3KAY9{0xpgxAYEmNl;}}Q8N&mEvCh9F1ZSflojhgxLsK21{>$HU0+%?BX8q+hY(>CwM zo9>Mk*vB9KFn{^O{N)exm;ajnB0u3mOv&T@(AQ%{k-yI@fih~yXO?}Iz!;$+FY9+H zd78?rA-^eocqGf01vVM~vS<9RxwXI?W&6wwnN_V-$tdw{wl?`$xl-Z$9Btrh%WSc} zw&eOK2g@ASD1q~oB^S(3Po`hwzsO*h#h%*RjjVv>HO6G9fZg`ys_)oM&9Aa ze!RzcSH7V&vC3)}=+za@Q}VRpz}+Pw&tr^=DY^F*aaX?rTc0zz?N<4!yu>Q7wE^W0 zr}(V=hl5G$$6FHoc8mIsl!+DGpV$V!*RlW>IV*(bI1r)qtBBP4IUbApHRlA$R+(QsK-%Ih@z?c1S{3~^Z`FltM;pPsDtE?) zYU0hDSeticdtwE0tEdomX-SS#+&|qqM%VH-?iC8PG8%I?ypS)H%6zG8tcZ&BSNoen z{*k9+`}ixd!qO#A(V8aX{;1!@|2E+_1#e6_IIW}T*R$H+d+*G zRVQ!pdy7K0m$;nbtc!iJDTEHiubVGfjlMVy*~1@uBAg= zp?Wv$IqW12+$u;$tXX}IBZf6s8=L_{SB7b-?q~O=!Ls|)$gcpsr5e5EkFLXg@`&{> z4S7oMwGJn~^I^0@+u6|0Yp-)!tCKgkY_{4<DqoY){8Aw#wfI|-B*=cJ+@}g=FBavHM=V!cU8r5OTl+)wrKb% zxHmcIyvLIq@Owwz^vajCs{G;LF8`8HnU#(&dLw^a6`S~E(D8&+st4hoos<5iig=s> zg)BZz3_6dRR%!JYWBfPDd+qykto7y;jOqW_YSNkkv6iYx4$XnGom$=DN^1`1^(QRA zJY~u4_gx)5+I6J+@X14CDrjX!Yf)>Aw9W7BiPe@o7VS;?LS@G+w}{S@94xVzypD?Z z^W9dLCzKU*7x*TYqMcYPw8ZK~xbsWc&S=(m>g(0bC8rAHw9Ph+nEhzo&3Vym_(yTG zWewuC-j20Dt|DX%6G8t1nH*RtHsHHVkp~@EyABdRuN}Gem~ckzt|)nY7tV^B{gK|! z98PDjdWq-R=pQ*qj=Q?@<<5uikLr#;me5u3=9Ht;juai9b!cv9@qx1aySF5wJ-<~* z{w+CmT;LkbX1bqHscaJ^r#i&g>XB=svGN{(8CUfedaArP_?{JeaF&>e^Op{B|6u>b z#4Va5C(7xYh4#DtsSRF-Sa(|UU+gVeyISt9pfl@c|GIYEFXm93U-Z)1&q(3WSM!Q< zkT_~Pr=j~3r&YF2ji0`Cdc@2N6N(GE3UVj5PK=+lb&_{}-_{^^VjbsqzLp%g9)JDX zy_?2tYTLLW!5ixwSF*N8tUI%}GIwL=M%J{>C&w|?+t{aA8%z1x$mE-SBi-wKBNPAK zH*(Z%<3=W=jvINqXWYp6yT*+iF@N01(S3kTzHEMKJKhI|Mn}qe{mnJT`^{C-di=Mx~)3$j*8HD(X#peat*8XlC?OWd3u;o z{7D!mekwl47}w)3w)e=>%7C{Vk>9F_Rr^0GwIhG+J@-^Gu4l~Z+n13(OFz<@Da*<8Y_yxDDTK_eCbI^KD4<_#*#V z`ZoM?yEhWP*x>efBa?7vYf^hYd^jHG0;A;k4c>N#Qu$4M*ZX|EKPqyZLu?p_GCGEd z@6^3h<8&l!E_wWz_yUqY^{W1ZIL~`oN*~Tz#z|kW;$_eI2Ib{JB4L|9I#{t0@5YH1 zetPc7aVkey?TDGV<(q3Y-ynQNtmN?qkysz;jnc0hO|GF?5+3~&bCYw3I4hO}=zi0Z zm50PHr?)ud&XGIc5ORM(Xx3SWJ_4)vqULi@vpJ~Q9MrrAHSa;qd-hiC*_c^PE$RLT z6-V^v>(1nRw91RWQle3>r+P$gRkqk0>eE;co*soOoKrBGP20$xO{^Hz$J6oTTMvBe zfp0zVtp~o%fp2qQNiMbCJ?q0;?+{z-rExTOAGP5jn>Y{SD`VW2xov;leAZc&yJc*} zo(h~DV3iOoJrTOvCQn^!ezZn>y25}NJ=W| zwALb8&1TG-T>8WVL2y)mmB;Tb3n({S>ZKX60M}TGDpU&KfUj|E z*i|5$p^|u}qmHWj%CHuwrn`e@p-oQ-X{0lUqkYDc#0omjx=ukcYo4^^mQ3!Wm8|A; zMOgh&?zEW3N_QI87wll zU*1>kpNbKeb(OfD#MQE`1^1U@eISn<#hg-xMsyDDhCq z+6b}keZ?7r_Xux@#~hnivbGo_c!cn6;#O<5U-14fXV=_n%$QY~n_KnP9uos!da(fW=NF+F*A=7OAZ3xQ#AwMC7-hD6(Odje?&Ed)tX~bd zKb1UAt9ABZB42@^HJRV~C250K;%V?Z@kWl0oNq=2k9S}NM5B*V{zLjzV2kF&YH8)` zG@|L(f`_aXl^y;RV{t6h=~afnB<{1p0sRheoCwUqW4T70d1no*4uFwKlo03 zw^T~ixy!@j(XyJq+&VJmN226YI&YZd`ODzQ4hP!#-v;{~>rVGnP>fbEI0N~VRxnEC zAo0V(VCCVQ5{zLbkK?JtXz7`SHOJx5C_v+&=9Hcy+ekp8CS93>oe^yJbJ&uvb6P6^lNLp6+6icyKK#B-gKq+bMGueVFyfaE|Q zNmV3W=eKhvIOw{$UDD49Jx;si4M-03kxYojQPFlzzZe`9x|&4xR7D}LC_Cp3a1Qk4 z^aH0~h=Wna@_5))+5E^|`LP>zRm6^re*st2e~v5avfc0%z76Z_25xX?kOlP1 z4(9}U$P4t_ktMf$3Qox5IM$}$Dmnc&YaMHOjeggqb8nC2x?R7vl-_$ebmZ;phT^@K zL-F3rZ`iNmZt7?J!ob?Ha9b074LH`{?qwOZ-&jA#Hib&5pK%Pus(2_?#Y3?w9y${( z^SOT2ert5rS8^53&s(;wJ0*8o@|NFRGbj4(4ZjPX{YG^tKiM91+#%PUx;B4Q#6Qa1 z^bhMibn{nrTBW8DRPGCZLdr^)r|tNw%vW)v2cFjxqrNfUXI+`*=j%50JMFvGC4C8@ z5nHzV@l2LOgy)EM_!TQGEf?d4x^BIB{&@R{9GTF5OU%vgZ*Wb@_Hdo(+B?5a2P{G9 z!}aJM*%_`YJl-$Vp4=$;>QEcMe)%j*s(g2idsHYfGQuj)_3EL@dl$414P6VCr^79= zo@JwR$xZ#jkDxm#;NAT^A|_V^D>_2<(zA_D2YqYYxXR^`^i1XGw9#o<8QJL>YD%V> zpPi!S=VxM<;myj*%FoKq&i3Y~=4a&k)Qqg`%+%2-K2Mr2P4(vHrDUgPd%T|fe9!2# zJWpmG9h|GC<)!DRri{+@rufv%{7jEGD^*R&9i8XR&+_Eu`!dq=e0fm z*ONP1^<dEkqPS4HF%F0d2%1Fsd zQ&mq&ZeCWdCokKF!eosWd9X9Zo15j!%TLSBNJ~@mpvB|K^zLsC<`>8Y97Doj&Jrzh2$l9H#Yqdi%p zGg7iqw`uwLqcc6D;S5hk{^)#ES9ZQ9Q$W8G-V~%{rR8P$@W5PZdRi)) zMP@pltIPAC0@KiPva)ltQ?u0E(Z1|#_&qyQO-oBp$@2J8ecpW7?M=(|=4NK$fYc11 z>P6d0#kYW%9f$v9-FuzQQ zj~Rv@0gW9oV(P@a?~hC!fln0D=LeBE;u@)V4$+nxI*8s|KjMMK3zv_$)`UGZTZEK$OtL$J&)ero8#5k{sWHuo`U%Q`O_Zad;Rc(s2S)PIQzFg=q|*I zNKa;h8Gke^o)Z?I9u{8|7OxMBSA@lP+v0ugaq9M1_XHd9?IFGqr~8nNV8pHbjkuMc z5x49y;+1?j&eo~?bdRqQjQCEDBE7GD(K^3{Z`c$@JRvO3&sovk&!oQ~EPZ)c{E#jF ztcla{Hv((^zWMjl^~HzyMx4GSX#^uaG%S9rE#6mOe_fyDFC%XG%ZPWgdR!x<^0b7- z_l3nThQ(c>{Eg!Wg~fAh@xJ!mpywC5!4|)UQU2>g`i*!`SbSSp{Q0mr-M4E5?S?FyhwnMm&d;@$~>|FSEkpkA%e+*y4TjAE6&_^OFacg`q;#Pec@gZUSt6}=B@pe>L`4aW= zSgh0 z#4Z1(gq1ff%s)ol8eh}G`03(XW`B4MHbme_)4us<>iUY;IwSA};lB1|hsDR}_F40b5g%__E5sO4Y3jRI zFYlc?-x~i7zSTaA`17{osr+Ar#jW*)!MFO~m@xZ{{MLkyH{#a#W5ligV#Jd}{xITG z!s1r@yfZAnv3mIih4M4vR(~<#nYQ%4{>{;kx7wQ#9}vplh+E^a5x2%WBW|ttjJP!) z8S%@Z{Ec{in0{-0YNT%qOK%Q~AF##ymM2#)&r_lNjJP$P8Sy4tdf(&o_2c!jj5Ei%W z8y{wWfquNz-i^4`zKwWH$lnEF$4}Cae=(Hbq_FfUq6_|`AfZEwX*%B;@22Q+YrSN| zea0c!8}V6T@hxF-YyCP!yn*~EuXW&XewII{h@T>TeOS6RA50NDkRBP)*Iw&i@-#p!)2eEcS)Z?)^r>O|(WX5#h7QE}uNl>qlK$_S$6o~=i1SB!#|?!pYy-tj;=884 z8}<0jVnLYxk4<~24-ORg%CF7eq<^m2{)jdZ@7Rep%WuSoh-c092B{s0R>5=qdObc= zRGaCD>i+w4So}|vfKZQZAiTXk%)YH*{`sNlfaN;>R&l3kZ<`(;j(Z6K%s}=JGwml4 z#oNN-ubSn_M!gIaBg8P%AI$Fxt1r6Z&w=#)OBg>dEZ!8B-*3(G%+>4jcAg7!q(=VQ+yLXXd|K=T8#DO@A8gaf(*U zVxvIoNq!$vGGWsvnZV2^%>1!7eh#q9w7CG7`GlE24Vd*$C%##xxi&sw=9k&{i->QQ zX_bvnnE8(o-{jO2j>Qh)DQrrAqd^g7KCNex%y#pV4bzECU;Ecx~)C(LrPne`K9`8i{HwnvybDa0|~=S1H>Rc^)(fiQDuy~*!( zqU&}^rp{S5`2t|YoO}uMu}g_#@~a6C)76XZ#8E&e^~&^PN(QfLSMD=C2`+$$yME zrcT1lsRU-7G!L;J!pvy|WnFzcr|**((WQ{6F# zFmtHxm_v2P9Ky^gwsDr&IE0zA%Eo!b#v#lc8oS&y*dSD6bKRjsQES6nZMdE=4de(r zu_@+>FJadCJh0o;(*o@J7Ip}F{hEAx{q98?^Y;O}s1qO@!N&Rtv;JeiZj*Bn*!6Af zD8T>BC(L|07w2+O-Em%Y4KyjyIFyDSm-$}9Y+%+ynDyim-z*oofa`@YbCQAGNrui$ z8;3A+#@aYO8;3A+rr0<|HV$Ft%(ZdKY#hSOSxy`>3SkX4m-)^@Y6FZPvteovt`zJL zs6Fu7gD~r)_TV=4Yy)=0V9F`qE=_W(2hbzqm7&}rin zX8utd|4ri4z=?1Y8|x>`{4>C;KaMzNzb4EaYF=)tGz4-7a|kmh8<;scHV$Ft==Eso zp}J!|gqfq)qsgJVV-8{F==GQd0m4dbF3KF?5o}yW!pztEwfU~T3dmh!utTWD#(cue zuLpLU{O!Q5f5i@=2^;eXGoSjk+vL0qoMhTh^~E>}SfN1?fiNF?Bd}{MNd?|O3;bOj z>emU}CLRuvVqQcd%*Q4GyUk;%871Xlhd?@co+ZruTY=qP>=0;}Q*JZtAO}7s*E$a>6X9GP=iMhoIX@hMSl&wri?U>CCta_eZ=HYU2u5` zGv`iV_eAUvaZ4Vb-~Yg7Z$E6W6u*nItd=bgbYZ`=Ez7p6y1BM_xL>y`eCT7lB z8;8!7_?(U~bGF(zJBZ`P4uLRpnrxii#7QzZgqhO@>@w{+VB-*G&Ji2uZQ>+jhd`J) zr)->a#4*o92{Y${jq@dO{slV(!pw<^um^o{Jlgzv}5&vH75bCjUJ15Ni zMqtkOMH`1Ob7)>;jy?{X^%y=5Ge;kX%`)1@;bS&E?^0f=MjIx~d3^xvGB5no*vs}` zAikL|Vdh^Yj#=IasAHcHW=Pd~6Ql%$W}C zGWoM@nCgz#*o67m$AH}>*db7TC7H+80xRi8UWA!Xb?2rD9H9xDl3{QNGp7aEU5Xt7 z)sc%bMCin(WEy)i*O1X zbIt;DUer!p<=D|*P+e;bOqULm9yIVMl0RTzn$D9}8u)hnaXoC{bQ>N^_z^>{_oE*e zn5w}|9R-2h;rcfn>gUw%9~$^k{7Ew9Yk}RgLs*ZEaW$}uhzMJ;xz_2>xE^Bmi$;jJ zya#}}4HITL`7Oz`e*my+19tQmo4Z1X`a8Lm@1oEM)VBFpD!Y+Z5~t3KgX*Tnf{=~PW#U|5_A_BVb`r2#!w%tY zY)T%KnV30?NN$cNgjqfS*cHHz{$g`e1tJW^rsNuW2s58-Q#^*8Fv|gjvYqxuU^(?Q z_YOmrX~RXpcx8hg?zLgE&Ha=v*59Rmy>{p}kEJfkdZ;NgpD^1%RpovfJA`f6T+}cT z=no(JybZqyob(KK2(8#$I|&){T9TPBwOg0Tp}xuEDq+s|6v@qNN`zTXZO{E92oPu- zW1X~2SDFktVdhiUD?jyWe1X3pKfT$Z`SG4mzNoR>&$_EW+vcOXlyJHjldvBJH} zuqT0Vvw^AJ8Q%%4{Me8a=3{-tA*UiNz^05xh9+i?KE|3lAF^=>GiNQZ`vvR}s2u$jgf$EgUPr}ThY}`M=4&fzi+!qKlXRl38nB|8^KEbe`Fw6CNH|6$vKM4-| zr-zO;=Ul>k?0MiMv+Ng$W9lKyoU1mDgX*rpuz@ghX#L~>6NKD@ld^TRCIu66{05oG($`LF^FDV&n1>W{%6|2f{2TpSWJ8BXREm zam=xiFmtAp-1H$~mQ$Z%n`3ait4&vf_ddfO6UUMKRYN|U@M{JppDW{_0D&;;Oa|sY zNSNg`M|0T;vwSwNdk=O9bFsO8p+m9Uh93pyzCf6dtpIkvjvc}#Y)R&^+ksuw@DZNE z=Khrq#ZLU;wn3Qn>;`t5$5Iut4depm6J~y=jdPSZ<`_koIaGJ7llp>tA9e`T7hLT+ zG=6(E^IZT}@_0y?^(+N;|I*-B1H1Mccst1t7`Tz}uMNDLIHu0m33nLseKtAG^*lZk z=DfOzW9D^+I8(4gAj}+nemC`xKpLMr5N6IOVD~}n5R$R+xdUP5+)46mLqB1b=L5SB zVTUjt8?W05GiNF=bM7XNxo#)SoO^AYMK%s$=1~7-JrCJ9gqgF}#;GLESi@$*%-KqE z^IV27%Xa`Ly@4G<6gKy7bf|y7knvEGA2HjqHWJ4i-v~43d6JvQ5@tEM ziRT)^EdKzQZPV+e8v=wFY;F?|0d}1rDZVj=&Gohp_4}`tsb8(51SBipGvtIhFFKa5 zGZSVx)ua0)cJvn;a|kmhozhGW)gyBVGl%MtIaH6#A;=tcNgj zs2(}5N*jkTbExi^v)#ra%$%JzPK%90m^rOB&g(V~VdfmLarC;5HT-X{YpPDR=M*rP zi!kds3(TAgHV$FtTqVwbVMhVkDBm~ovR}{9*Cg*66xzGrGw_Z0!@o@sW}Va?SWcMb z)P7h_nB{3UIboLTZR6X9J@&RyVB-^JevwU1nB{ugF!k8m#&R2&ApxuKUMai`xB@3{KoB><|bupL{j!6m|%9zl}j$DKz{> znEAQD?$g*IjK{`xL6|wyNN%gWCht5IVf5bru)YRAp`fV}pPllW@^G5&=Gv$O? zPGbVwK$ztz!0ZQFnzIdrnL|qr_jx0)e8Og%p=n;Z5jzCJ%%^F|WtNN9`R-4QV~c>} z$dL$ynLi77m?v8g+n0B@|D2u&vda^O&s$+3c}2J)W&&?FjXMJ zTHv@pTbTJ3kPkEEgjv1`m~A7>^2dSWE*g3WvwR!yFjG#L<&D66PDGgH&A@S&3_XNd z-U2+#loMw8Yrsklb_j%7z7N<}_IrMw6`>zJ)R$%rIVdjhgX8#aoIsK;0{vpirWMK9WJ?F+{ zAEaI5wM}(PEY~z#xCw*a*i++!e`QdAdAy$kFX2IoECIB8+#pMiXsDJRVG9$@w%VU~YR^1BQ@gjtTq2SaT>0+{Qa zFms}Sx!wu0oSq3~{}5)m{=59$Mqc*c<%fgA?L3i=HSHnH$Lhbuzi-qR?cI@v9v84O z)56Rj4!O%=$S=vzmv@(~Ts-f=Rf|`b&MRKLeEzD3`y{L?oxk8(@{$!RAHL?dZ6BCF zPfw%o3SXasPe?uh=E?^im}k5W>w3DFcwfl_sq@yPX8axcN`t4rVe5J-OBR)u+&2%O zA6|o3fc+g(c`O@-Yff`q0W1t5(ljHUGiuF%~cTdkoW_@?za4yB-vNo{?Iz z0^fjs2;ZDG_SZIseHC&l%)=pnmrSoK`#P%alh@bQWq9FwIT;?fUaINAl2xli?T(6V zzL~9bUUC^MLpO3~5`Pk#IxoK8JrCc~4*8E{51={OW#m)Sb=30l@oc^AE-%G#$t5e6EhAu8 zYJ9i6xOBnlr4P(owgAc&U$-swS$K%wos=ON__@O5$hQ|Bz{Q{OA+ubRK? zS|2vIv#pXWD}BKFl(}W?1Es6WSBA<{vU;BRne*#686J+PGuUg4jKg-lWV=;N3yoFb zy6j}5I&}t%sovl<{ln{hKN1fc$fcBGCzmZ=ijTt2U%p_)GP}vk7M9IhHvfV9zVi8Y z`?1t$kYOKv%gUF2RkmWmS7h@Sd{ssbu8+P2^Fkkl4}H-d4GrI&FP*n&K0Xw0w??04 z@Wu4S%NN>9Le5{gsuXPklhe}0%NI~OABS2+dY=wlzC84;`D>34{3u?%HfW*tzrs?>^5gX}9nr4r#f z-N;D0rdv&?&s(-)L7&5^hQHEpFvJoq+A}vD4C6k{UuGkP1tUTtQ7uM%2hWH3cYT z1Qvn+U?}Wod?%dg)%OeW7sxmmD@h?<0U#V@CZsdL{EH>D9%cZ9^IFX``op|w01m`+ zNQkiZJ6PM|z`KF5{MFM2;4fVYv+JYFZFJ3x1M8a#l3m}6V=aA7kSUGy{d;s@eRTbR z&V@O!zAfO{^}YRFJTnX)*@vW%zNaCh!`UyjFy1^h(^ay*?I79p9q`~DGss9Extr~y z+br=vq;EeG_|%*fvc6=H?E0R|v-I`1=^Kp$?E3Ihb^Uit(nW#w(K)nTUxgRf3UMIW zcLO%IuRKg2IirgdnSu4K4AVDh9DbiN_1y$6>l+PVx33HOZe(Tn%lgv6qhoT+wCBeg z_Xm-EH)CUc@1uNneW#$$XC6a;Sl@f#+4b#%zUfFOeF`?#cXv!*eF=!;&`@A~68YHk zrFRoti}y4dqn(!q9_7V>^$h^Y&dUUEJ(KX4dC?%*%Q0wzz&9|Baty^^F2_f}c73lw zUp-_TSl<~4?D}4ZzQ-XWzr>ko)Q=tvvu_F-@p8yHu)bAc_D#Z%8LaPCklDUW9B;Sp zb;R3P8UC`qRLJf2y$gLKa3I-7=f14(XJPfRDi-&#(ZFH`*7qWKc70z=#I-uq5$PL& zjrBF6GVS)Ypi_(|ff-oe6JhP@$X&P>(6lceT-J9G2iWypK%<{~4SoB;v)gyz`$EuI zNA}%r)3-d#zNxrCkZ;;Xf7rgoVfGCw6yi>#lfDFOY~Qi4cDfDvQm$d&@4&O$Hx>GL z+!$rk_gPqZ51`YUmsr8F?E7O_d56w0p0g(V60xy;^!_Qk|Mm#`?Tr`p!e&)oYYDCrqCkifC*neaSX`E5h`h9b~k7Q1rm|EeX?iV5adK zJ?Trq#`ZOa>3e9f@qD16%_=XwC(K^nlv!4J(`@?w1e^Q#5Be}9gaX@l79_jAhoEmL zSY#iq0ocCV!rIGz=zEPaFaztmHLSfn4t>voNBT0cvA(MScKaT=#hAat^<4swj>$0- z(q~)tWkbgLa>DGZgucXU*!Qnt_DzDmQ>J}mZ2H#1S$6wgf>Z9jhQ1$wXSa`@$DsL~ z%1ix@?OPURpDWHt2SpF;zeQp8t(=E^!61ED@`Uv5LmqbfCPCk|+Vd|!vfKA2^c^$p z%dzSEB5XYM-Fofu`AXP$`rLeL9hPg;cOS6bzAvDU#vcw`-ZBXK*jH?gSNUcd%}3j? z+4aSL)3`SqVm+|FI>hYy29#Lq5}%ny`hJbgt}h0Y3$=F+tZy#_c72N$SoJ~U45g7i z!ghUkLf^I8U!HkP4*pU&1bsYzV5$r0^Mtj(vVRg{w|<1NWBcw5Yk<P;P&dZ2E@c z0K0vIMqGQoRKT;B*RcreCd|py{-)UU{VvSDNh6K%5fnYJeTT#ByBp^pH13hUso2*gUdkjQ_!~)V=ATh z!w%W$_saiEMtbT9TS)l|HYAzp>3T|bnwn`)?v4F7?s?J|KWX8-kbJr(aBkF&+RTgR@SxT&E-e$pSf=Tm}>d!w(6FuO+Na5 zY&E`SSKx2UNyx9ykD72{X7Q}9S-JPL-V;B2>+Fa*7befgmzwB{&h(AW2ITb7S|LiN z?i7Bn^^GQqC)mE&STfa#blX=Kkxt(&w2sHO;zQrbi3xqVDki46&v(mXVg}&5^L!M( z@mF=NqvTFYgErVH+t;C#_)?c8MLBm>i5Sl}tA03`zOq<`jRQMeRo)!37eeH7RcrgiY zPCIJ*hAh6KJZU`qWtEdSwsN2DYZZOZ$Zki8t6b6-JO596-vVAmb+vtlBoI=d2?rDs zYYzkvLK1RvC5kkM^9|m&!$}Al6#6NU60HsTFK3zipwV z>St|BTifz^p`d7~TB|;O)wb6D?>l?1nSCY~QvLp?kN@L(&YXGI+H0@9W@gWx*=zR9 zmi#Tg9af?R=Ab0v>~oR0bI(zdGN5SnKC7i|542r>n4-3BdrBm!rR^b~wJVC+P;bnd z>Ya^xWo+$_zl-^2_ixJCTx!%D&e3VkQ^y(VHiX@ILsiW(=DS19;mqo?ZPpQYwm^5L zvBlV1?(CPGeLH2UyFaW`%Y11Y-P+1o1SxTBf^YM!4c}`>+EAaLaP}zY5*KZ^RPQ!( z2JXq5F5FVO9&;dW+Pm4UtJdLac<9dOXPx4lq^8H5<&rw4*AX9Q2b6O6uIJo;YY$^q zQhN?SbB^u3>)o9_0B!|uJ(rTbVr-H z>oIGs%?3G+>$r9^dYHH$K?w(fYRN}GZ*+GrO zb1OB~tg|aQN9f6}_7rCBO_-mu&t-4U;2f2SK1dmEn?MQuaO;QYbnl1E{m3KG)$E;@ z9#ggVLDb%y&DBn;Jl3iE)?veO2ET5^iKJLfcKE=2wm)Xg;qF}pkG zZQrA2t3J6Gb$D%6SNp>|yJ(-wcaDL_mq1#gWCz*k!?Y`+%pOvWs*%Q{b^yf{+k~DS%cR@RqVd1g~%xFGp?yf*<(!E zHCay2ii72=Gh*_ zA9c!8ydItjsp22;q(AB58H-n>^m9G@Y=fWW982aH=u6}WdH8gvk9ZaG@!RI?6A7gQ zeA}_D`UCE^DE=p&ba!8?^nr#yw0DJvXPj4v>Aw{QYw}Y)`h_08)uaD=kG-#WcwTo& zZ(-rL+2vcwl(D>W0ucMU{5Ja=HitBnI~Z5^p_=D8$8V{>;<1lzxASe}kp|8&Z~-wp zSfER>_$dGp%Q&m~!0EdGxfED*h(%|Wp~G{;AH*MsSafax7CW1P#SXFPY%_H3q>i>j zEIPXlo%^U$h(8dq=sXB4a$=Dmrd%_`B7YoMz6*VfIywMCEIP-j(-(iB6IlEuHng$m zoH69YB7Yq?Pwzt>Z$AToAY#!;#_^NyVW$E6%WM@NvFHq@4*Kb&k-(X$E*70Jkjr=C ziA7!v?4PLgiAB!W&i%Tw5sQ2}u$0wI9bGqwMQ1T}(v;0M;B@r)N$aVv%OV#2ZItV> zh(&%Ua4zBiq@BQddK>Sf{)I|TEcy>nU+XaTD!vhm&SC2Cfgb2_>RjYv(K$vPZRa?3 zv~R?sa}pT0i8h^~j@}Q%qVqa+1}U9)sH5vGvFI?!A>YAH1C}~QEIJ%-EM;+AvD8&! z(HUjvaQv`;k}8*2bV?1K3StK4K-JXO{u7ISggW}zU2fp{zaE4~d_bcjWV?Um^4rjD*x#GjKmX9aNjF#Lg5 zVUcf=cL2-x#(A&DXAh(`SY*Eui=C~M>vo=4Hv^{!@CVw4 zMcOf9(Xs1x00PiXEV(0WsJ`!^G3$A{#(ROKEMl?qFm(d>10BX9I>e&$II!p(qfQWi zAY#!u0W3N%0gDc?=)7j=ybGKgz#r&6ERwgc<@!J@d4~Xt&UuCovFMC4ba;;}$B|fc z_|BAkUwtxliftDFZ;@eT`=xrnxohJ>Q-x)f@qI1H~v9Gz4l%Jihxq4sO z*IYI{AoH3#s1NFVz!v+s`ghJ#p3?F?c5a4zw|p|~$gu+!pQloP4E{j&HLKFaqQh&J z=v)pg$BtNZ78*LssH3-wSadq5gXbh9yB%X=47vu3__-cf{3MpVTY<%g+o+@cBo-a} zyw=;YhdO%y6N}D1V6pQcb+n(vqGMmbv~NF#JZ~KSKu=&1{3LLC4y8Wd@36=>J;M-L@YY?`L4Gmne|O?3$f@70L~q6XZ4)}EIyoXU_QeXp9_HH zd?6M)7aDS6kuz>0`-fQMtANF({a!{-FGM7~L|~2*)dR&j_|$lxz#MPd)tGt?dp5_^ zb9k(bv+vpZ`x$Z%kxeI2u&iyts`mVrgl%5d&hfpTalZe~z*^4Hrn|QG3A85@<9{F%LKU|u8UMt66`L@| zfFj8<3QAr*#)O0feiBNwS)mi&8i4N`K`+b zx2*fK$7DpaN3D%!kGwUS9T?G+ogZw>&J8tY=QK8EkDb?;J!WMi(i@T9m>syMF+2Y| z4LO_LCv9u1HckK4j53@~{s9AgH`RU*ah2^i4fK_v;`#gc_k9oR?VI}h{9A_L>0=t6 zD?aT!S9Gmdr&?}_S!afCPf73V@4IHQf8d(Q^7Jt^_0{2&32&YH{3luvHMVy7cZ~8) z-;o~jr`(csV8fn1ukA1`rl#)8aPu74(2?}~j{7ni-O&zsQkLc`!wHP1QO*;%r`NZn zf5pNx)#R32Zo@hUPlY>cx#f)9ur6>UnuI;LZd53mG|q~y8+W8JDQ9itx|~pB(s-+J z-S{Jsq};WUb-AHPQl1rAmv^KAd%o$0H7Qjs>1o)Gabd?#JVg!!nyN#2!9d4?_KraI z=++AZzBas;wV>6vaNd$-Sk0T?f{OA!2pL=PTY%p}{1)N27{4X>EyeE&{FdRj9KRL# zU5Q^Cekaw1;y5tALb`?lcb@+zUb=t9Q##O z#vU`&Ax&|{fb;g$LT!9c>we4TQ+;=7p4T)BE&lbI$7Kb4KYL!_Wm-miEN_j6=e1Rl zND*1y-opYZT&Jo(uNR+QrVEC7AswN3oF(MYF1jQJ{3Z=o)`871)flkN`NM1G?%Sd+)?fX{!v5)v0FsJ;cJ<33Cl z`50iCJCpY+{s8_!#G=FNyy&oA`bXdoL@YYh!2Xexsl=8ep@pZHW%_tRvHko=r;prX*sdTTY=>{3bDu+1Iu$1Vv)B2 zqd~XnYW(|0xma{=pj_{BVv%nK&gIP&i1(Wkm%kg>KblhYO;yp~4_=N7vB|c0_W*x9!~*FUSi4nEU@H#o;v!N5{u5uhR$E9!^#387M=Hib9u8#LS2?QJClJk zaqmnb7X4J%fc1^YNZCy2pIoQolgyzGse4TP$yL zy3V!*-j&4XuU=@sye+R^(lI-seKlUtUU6l|g8XUqGxPBJd&?D0m(tEIuSzGpbu4}J zgaW+pBHM|cw|P-^{ zYtcIcZ1y!rVTW?tjb_l!#m_d&KB3@M*keqDcK9fV+nbIBb+fRf)a`Aat*==;G1%+A z=6X2A@`|zeFgx2&a2YE%{$clX_dfH)fB)k5`!{U}x4iya-}dCg?^wGy$~ed9MWz{J zK>wY-=X;SAu@kZSIX|3}!SS-;bFt-%uy4n$%+AjkoSnONaCXkEgR{qu@Mn(+`m;xc z{MjQL{n>$e{_Omf8A#7SdPerxdor@ed?#c7mYhv%k9-eRW&73vK5LgCe~PbSLwG}# z^r%`;dvk6wddpS*9hdpGr})zSw~zO2@9XQcsjg`A*DDTeezZbHt@{VCuiD=p9X#I| zvz)f!gwu0He>MG}CB4<{{nt!h>ZGM@U~lzhhqq4sb2!IKqQ5$Hl<#{unYM38@#Rau zHDym9>4WawVfcw&{i{a*b^Fkm@1-4QGG;mczz6s!d1ZU&uOAq0N#BRkQj&@G0I8A9 zUQM?w*LO9})2lg#eOy2KxPJ6;{pjQR(Z?N(KJH-jaR;N1I~aZ34D@j`(8tX{A2$Pi z-1H!h@&@#9x#eyTm*b>2ILAJ_|K~>*ryL)-amt?0{9yOY13C9Ua{33m4!r%svb(;) zy19DdmU9{}xa!GIANuq?|J-Cn9(Xi7_u&6*86J&}w(p4opPf4MjsdqG|33$hy!@qk zn`gZKsVTFES3me#{U7h=iR(Lb^*KNKqV>y{L!pWjpWZ(*`+=l+U%UO>Yjz$?|JS@X zeM9dbb<@&$zwSHn;TI2&**;)$bNSaMou1SBuMvy>`s$yb8vab*BR_v^#oR9s`Ny`k z_dNFe`rl7p^v0SytM_~`IC=jraJli;ahErX~xPzWR>Nyf1{|MPk-jj_QAqck?A)(M*I2tfhY0Smg8`lzRi~K zPnCC{ho5icr#|oJ6)F8=!s`6P4Eqp$t! z{L0_cMmqIh^YB-D_{9d#_->ZR-fkoPZQzkeAFj)DlE5=E{$PUOV;+8hhac$S2YL99 zd-!w@KiHmIo+a~Uf^me6WHj-bf3GlDlmDFIANh+s{M{bD0y-q#%Q23?@0AEKzZvT% zf2Sm3O`iQfA@cVKgEjeEJ@%gRq|1GlD!;#-N5*yH5rQv|H#Z<26Mv2kZ7hAEe9Ffw zIkCt~fn_Y-Wa{uH4@4|FJg-Ej7TBMMKM=9#Fc#paVUQUYK(+JvSt&upqJJT9uI^9r zUNe&$1|k-n3g9d)Cl+}Xu#AtRZ<#!4K*XXm9XLzNiA6pOSe^+Ji~MrnblrzvNSz$~ zfrv$CGjQf0O4Z!pBEK1YmX;HX{B~gJpYH;eF*3xWvyXCpT!=+}5Lm|aeHS=g_ro8j zzV09pi~e!SbMXfv7WqkFv2z+&`s%!=mOlJzz?r&VO)Poe1kTcOVv+YjU6p=5vB)`o zNBa51A|C`Sz7dO@u?F#tF-@sg#G*6G(6OKY>jd-p|3vDX3kN}rZORz5$-tRxpg_c8 za|&>lmJ^G7DzJ=YAQpKPSjLdf0?yMHvbl!5nQ}ImpjOJyQWP7JrCE zegZgMkB@sEI8SfyOVlq__K8LRbwj7SHX&`mIcE#fpx?$Xnk~O_g&D2sGWdZpqi)Q{jRY0KU02?HEQtBf z77cRB?jjh({GM=7!YABR2U>l`t@Ag|qwy*8bPD>3~XlxVYpLePz=>OBeGpV1$t@zTU=plNRp z_%tj+Vvnb{X|Dj+&0&zyo*6&##-sKl{Y@62N$jx<(_S^~y$i=^kC$rkkJm)gzg;lU zm49n!MA2n(rIKlUW0o2a_Hl?ZZ2Yi zCZ=(TJ^Xy%|$}1g7!btxQxdi*FuNI zfEGyFBjDkZQT-gDwa zEeRI(J`PqAEbnz3%!g+VEUy@g#K8tK8Z`vbrXh$n4M8+&D56nA-H6x&|BDeZL{)|& zsxlN&m7$2L3`JCBNJ&C$Yy`c@gg2S+CKKLd!JDk?QK2lv#}8;;o6u<~BS#-96j$vxZWU32KkPyP|ltI z)$sM&Jzu?f$5&QA{eu7Lt#7?OcF4O!KJ~@VeD={-zIy#VtG>Md{_oy+%dp5N#@=1y zd;4@z)|XEleW>!n$9^;JweLPRCU*JlFJAVA8Gq{k$6?hM5BTGf*82P@k3BNRG5bV*AAcMf!_hE$wM21CmfAuLi(wi^$LQ5^#Vuc93o%TFX&f!1S1T2_a+NJy zxvHIMSas;t>i6N|2h74Yn2k5b;rz_E`cvVrUB2a^T^BF8^U+AZ3vvs;HR!~zS~9mZ zUt0OE%l^D(W54nD{PD@`*@s@er}**F-|!aQzi2?w+Zof&Ts(ZjV>kRfYg$uA*0~p5 zl=ABdyVh)c;eodYzx&u@nKQ4;`~Je8{ORwvb~KlJ^WQaSSpSu+9Y0H5v93OtHvPOm z54n4%@6GDyXIK5=r){-4m-T!2z_SxyJ^IT2FFkks`inPh@aF&jJq9_-*xfco+s5(_;*-UR&p#mc%Gkx{6VzrP*Nml!0EgTx>ihLZRhvBUr-Qm$iN#3HW% zmiS^db(jf6EIJWj(P7+9VnxKFGoNxDBOw-fAIe#YK*S>dC5zD^%C;7tI-Q$}VD% z)aWS&X+`ey$=$DWd5_nAnhXb2sL>FOV6_)p^eTlNPF&s zGBqeK9}&myj)@+y$EgowrD*uDC~6=gY?Eo4`Ktm^3NM1 zJ&gS<{`C}twfFsBlSPTQI)7u&p3IkEn&{n&p@;DM&DH z-tsFIShlLY1qc~ERB7-WV^d-9JPL_CDukZtO)e>23{Cd5--)lo;?a(Acsezu38nYM zG$4_6L@0p65Elk(9wQRhT%?MsQ#8QEU>O9Z6u*{An%iW5Pml@Aq_eJCEb^lrv z#_~R@`)XRc_fz-v;d$Q`zZU!7Tkq#WCZwy6eVm9t?Dal|ZRkzC*G;bT;7MvV-{)0W z{mVDSgT!O9!#Pq&)TgEi?tU1-5$AJ2ZynKI8 zI^O@&nzX?f*`1mnZ1c(XvC|^Ejg;$zN>^t{CL2&q(*LF?OUtkS=)lGz6GeT;XEjM4^v46@#| zfjk~wJ$<-rtJ415=Fww6f^|qp^u7oIk9mcWPz}tXfRuA#_2C!?vs||AUD;zBXxiiV z{=^>r6nlTt_6o5ku^%?nM(U4cap9|bTo+&=wPR_uk@^$8>%kHW{a%1xOIjv)^InH~ zUES+EL_K332_82R_X|nv9S4?uNqGPXC$VNa&lzqn?{y}WNE^;pUfOvRd)oX0$#C{I zf6@i2Jh|7w_X~WXjJ}VKJUZsb(+_`s4!@6G21oqK$<8|+?zh&hBdHY`$rffeuxh4n zc(7t*)wZfWH6iPUHE{bQ`e+ZFbq~}{30L8EAzmGt6^@6R>U<)I)P`bH8=`gbx^P`X zbdDp(M<{~vP;JZN~Fgvm=Zya>ppko%;>CeVF^Zob+?yojpE{oU8dL9G{xc#kywp; zeuOKlnnLlaa4a0Ht6_SLTYG1O=fuOaE2~5G)57sc(~M3w6BMedd!dBldZQMFPiHNV zO5VEG$)mF>DUW)oruJ5kh0m9;f6-c<^{jn;>1T~+rds&HB^-^RU2bX$O*7h3CfjX! zWkY>^xH4ALP#>>xTa&Jn_BO?1)#3Vh zUC6EZEJXG_5}L4GY~Z5d#1dwN!;yF-jKoT8O3l=o%1|tvP(n0ZAD-3_tLa>JU1)ZE zYBV&h4m&fB#&%k)Iw5By+JK#nYg#Z~*j++VLV~SZr1wP4l$zR_*c|(k)Rk7kiDF;3 zx;o#uAGF!d8N#^c)rF%t-rf_U$82^vJ!a*u35TM!bK+H@SSa39b7|sERlA0DBw@=! zwUNZbYuBPseXJ%P4dcXcPX?zBRflV98{)H2L8f+*s%m)!Nz`oaIiY5KbF|t*lJYuMXkD zP*`9p*rG@Sj+<*l-x(PKoM&cwEE=zhPMKzis=`xdCi3P+S5=#C*sZN=T(!F`a9yXvO_}#-qpf#0z`2|xh&pGfY%*Q3?<5nf;2KeA3go`pFpDD}EGkGa zV_Y_zdKImK(^bJzv+nTP-3ip0IDKC44yWG z{}uekN<2Rp41?#)>~!-vxe*=AVNG zV(^Tgl1~CZ)!;d|$!ze9RWhCLj;;b9&^+Il-Dc>YfqV~mIX=Gu{)xet06&jK{J$6e zq@oUt)b`E=p95aDhtH6vfzQ_Ie}g|u4gICyw}Kb{_@3*%-~(EpW3V3uuf`?!v*#-M zgTen7e0c}_7_C1ZJm>8VYJMmDX#iiQ`GMd!f@eFy{lT#)N5BU({}=dk3cS>(X7KNT zm-C-vw)>~L+cz8h81U!o{7+$B1zxuINAPD6c<1{wy){{|0}q1uy0CJ;7VSOL@=0pWWcaUM=|V82KNEKS#kcj!ploz&{0E z$~z4C^9KJd`13k=u{RL>zl{9X!M~3qI4<@7FYspsc(K%GZOq1gWnE+E&(scCmH+_gI@!GK4J@Z-UsHu#qGZ-Jgm z{XF+4sUAMfo*RhzRap28c#50ZKISOe`Ti;E0H62bXQvfuUG7Uh@1>kr!WMSWu=!b=KoP?&%XQBR+xGfgy z2Fb3^6oBlyz!L&w-zTy1f$TPy6%Q1^VlfkF6c&pW3N#jr#mWK7#bWtwXg?#gXc$zC z#bN~mO~hjHV1g!Lv3Q{XRba7LIH(GX#RCee#$xf}2CBtk@xl#?V6o^RD2B!21rszI zi^YoxXf76u7h+H|7At^1P%9Q|gbjU*iMg{u%dlA4Hnay|S=>-i2Nr9z4SiP=^I{3Q z7K?R(4Sj2fxidiPu~_45=(~}a2N1Lsi#6Vcc0IJX!$7xTvGQzaj|;Q%72Zkt1ci4I z^WcN_V6lQWw8zm}tO%feSS(#>9w6q92OY#>mDtetFtP3cJVMM1JLoVLYa)^UW@5R* zk7H%=h8^@I7E5;!juB6yRLwJHU99kNtgOijKTG^6g-;S!D14eYr0^NyDGI+zT&eKu z#8nEvMI2W69pb49ze_w#VO%VHn5^BVWa1iy`JGv7y28BAw`M4uPF$<-5aK$8hY{B+ z%zJgKLE!*#MB!1yjS7z?jw+l>+@vty$FO1w7ZcA^nD1s-vlO00e2Kyp#IqIVHQkz{ za5eFz3fB@}rf`IKuEH_mPbip{h3_CDN4!emeZ=hwKS11}@Im6$3O`JImBNn@e@5ZM#8)ePl=!m>KTdp&!cP)^ zPT^z3*DCxJ@#hsjPJErh&k|p+@JZq|3ZEuktMD1(8x($(c%8zp6R%hJE#eIdzeBuH z;dhC@ps=qG@Qn)d8f|S-IF)#_!UKr6C~S`@->UEs%5PGbeNpRXg*oS>^+kmP#J4DH zyp+{D9aQ3=Vh0sDC|Kw~7X^ck&_D%_&;=769~@NXpi&2wIH=e` zMGguUI?zSIpd&O;fg^N4Io~_6_sB#Cl{u)?K_w0?j``ROX;k2iafcvGs}_S+K}~E(#VpLKg*tj?h2_j?e++&c}WxI;hM+r4A}_P_cu8 zMGkaPu+R~@D2V5aGLp?j1rBsTIX-5s_l|?g98~I{5(gDKC|Kk`7X=F)p^Jh+M`)k| zN9cg^BF7yEl{u)?K_w06EOdk}3I-jafeIX<1IqDkmOfYxDsxb&gGwA!?4V$g16>rvLuYN#MZusWG*E#n z^bU>G7Rn36)7vJ58QQF{rHGrL4{{&y04(%}X~evp zr#;EX+XlwZg{Vgwjm5Ng2l_F~;4E#V=rrP;U}#U@#@lmng$F{QiD_KY^twRHU;KF2 z<1cyZOMRi5bU|t@Y3!VoKrHWnPpGiE1eBa-eGKR9NRm!+HSB3t_V%iTgRLc0q?^N3V z#Q&*-Kd=vE{PXjQG5imA_+nPpe)V6DJ4aOZSanjIa{FECzZkn(60HNB{Y|ZjmccDe z{fU95f%d*ce|t}7tMbcw`#QP@n!5V8q~!M{22%1{2HR5d6Y<`Z{I1@Pl>B&KO8ae1 ziFj+fo1&|?zo{?L+?wcX>gew9Qds=9zCXze^t5&cWlNDN>l|OLXm*Ms~#uYpu8U$cYB?KIw+Z)K~r~gm*4lG!YT6b zRGYRYwl}qO40I;CeZ}-NoZ>X~cWi0u-P+XLd1|Mq7Syq7rD?D~(T`r{%PL9U+rQPP z@aaBOXj8ni1MSh&p6KlC@rmO-JzG0cbqLLO4#SSFM9*NL4`^{xOB!=XHs~EyP9y0A zjyI_sK(CDZ9cL4@Hf`za8SHHu=xIWu`qG)oN+}v>MjuK_(c9NE&=c?JY`PiUtfQyf zr@)b?x38^fV0&+hq-^KJw%(pT3`$V&rDW-(n*1(0WojBg^`+wD=On$$;hk4#Z~9yXfI%7!awB%ehHZ-zgP zuNd}vI}-!eP)TP|b8QJ8{TL~%(N(umck8JW_YX9qf!mwATl?Fawv`2OMlze5-Mobs&JyR`J`KJ30sZ{NuE) zzBsZ&E_(25>hBEWb9TN&7atYRh(xGR-%`OJ7;^Vc&}a2hT#R zJfEsl8XqU#*#pk%w)+ImvDwzs*OjVg51S>hCyvz26#GrTu<4|HG<=X_!kjh5!tuI4x< z=E2zjyD3il&0G4KyPA5N<6DDcoa35TEu8&e^q4u2n7c}hu;^N z(>u)87XO@@{-Y`3kWGez|};~6wky z#o+=+W`DQ08rHKZhn>cV6u#cI?^&E*p6sXbMHF-s|bV>qeegMBxrO5v=^{Q6EmG3PItQu*9; zYCY8nPWu<=Ukn{U*aZqVeU;N+m_2_RbWKA=k^czGj>q0-Feqv@@}#IldiZb$4P5 z=7i|ufhCcn^@oVDFN0ZRJg{y`Hq+FLVYtUXMRK%c^wVd0f2%kOdZ0>lH@9FxfWFm@ zNqu+X(=srcsb7kOXQUL!K6tRQmzkA17VQ{>{Np!!sUAj9r~QMS{-&kWI(9L!(#Jd+ z%hv@0dP%ZW9gAt4wYal6ma@gEf^#L-*{9aQQHd5$KBqA~J3Ut|W*yzzyuGt0u;>sq z908}%(o@{vxq|6ao#dot`kMp$f+9%r#G5AI5b^I9xguZX>J|Fr-QANUo%jZDKsF`0 zh7Ripl3Yug&arD_3{9F78h&e{tr^`ZxmP1ik}VFn&Q4~pf6L3_Cv61k{X^3qJN%QL zE-tN&Ne=S9IwM0T(`r7UUaLC8d=nQMfi;mO_9bH%(CXSU_R!5vUBCbpajt99Idov? z(Fs!IMOE9*DHXLnE?!Ql=Jq1JE{^wg^!kr@y;ERLfJvJ<*uC$#Il(!Xzg;=V#G5TQxq%y!!fdUvn=uUfFdymrFhC399>S=`!g3u)x_y7a*mGy+H4_ z${ZJa8kqSuRr-vRRq5>NqlU5L*M}3W?&v)@)#C69?xSmOCTnQZ4HB5`^f}iClDdM{ zaAq7BNPNC%(^)<}rz+5{DS95>mHLZ%?l_mHMdF8S)_O$6(Mp z$XOZ|^ob^?wo>G2=2KoR1y@d{2-uMygm0eSsq*LkJ+=RkIxckQ@7 zK08`5r|KBMCCjFsHmo{OEA7~hZ#Bb_|CqNE>UQ`;Q`uMKl7|CrA0s3-4!CD#jU6c( z$Sde%gNJD$UR~-*p2L{joa;rNE&Bqyvt{cX`W;wn5B73%2~}ezy0|Kd$rY*$r!~%U zCo2z@a&c^sHd*H;)7?`PDur?iEqyw}JT`$dbt^O0o1!UH%`iO4dC}AmHz(x;;`r$_ ze^)aurJae%(-%k1dMPi1XeYFzXQ1e{l|Efh?jbZ!alM2MXRiJ^Q=}%W5S!ZjQjPr1 zmRav$3kJcaZQELLFM)HEq{w*-)~tOTt9X*oMPdTq**!%vnG_B5aoOukjWBp_>4+<} zAb2aAbthXYSh=*?us7#;H%yep%X(UFT#(a^BKP<3>O{Y=oJF~JH-Vq;9D+Vg=aRO~ z(YLOk1Xw%wV|Jn|pw(8cxw66>rY@eEpi0p-@Ok2&sQp9;MW@3vo9ggt(~>VV;@|>dCND z`Qs0%9YfJj=%4b-X2kMKhGY4~Ux?+;n>#nZsA6t@LG9f9ynoBfF9_x57tP2I9Xm9V zT^l-7(n!9uUu~>TXa15U2?-&Xl!|$u9Jl6h|jr?qIY&6^(A9_;JSI^T?$J46p zcWM@A(yL6>?)dxEuI0BKzfHW|U30-z4OeYDr8n>(Z^uv^o&)^^z7(ML3Q&6msJ%ke zULk6)FhB3A!u(isVSd?7`H<&Bo}WMO&rzG-%s;d@yO!y*uj2o*y`GofQpZP@?_0E| za>VsA!diW5*9zCi^oMek<7MRJXr5DN(eO7z^(%+#r4;d@43+on>gUEr-~BM0xb>X) zYY(YIqoKOty0T}+_MM}~rX5Qgo2p{bsoxAOo`%|(HcdsRyb~V#k9Sr4t|@AGqH6RG zb!7DRnz2l1nEDdycK$0?o?N-(i^2Rub&_7v9(4Od@&27F&r%|9arryz&r;D{;orwM z7lp>cuca05|H+p}GxCSNqrzv!?>ZWa{`LbEI(E2jPsZ4kV`))%zjz8fpE3ou_NXJ_ z+iO<4wu<*hfBUW)%?Q2T?$lo1J;VFN6P9T5lA!k$qW2Y|_Z6b|6{7bQp!XH*EUqm` zzc^H|^WtOq>1fTJCAInKrJ?+trN{En3yMzFGtnDxEL}BsvLk5u-lz8RC=w6#arBg1 znrl_js6IMQx_!W}`--bOmbF)T`ch7mD&;YSQt`O*dh<`woAc0H^Uz!K(3{a)EArug zKK#!|Z_Y<=o(uV0$mgOrW32e*+(Y|xZ(cqUAIeJEr*--AM#Y~)ZtotOddwV$(P=97 z%B~`}gy|2RrF*$LX-0iEd_6Dzh!XH!d*S@FX>+Vva@v719Vhnikq9db;TB%X- zF;)J<^&jLmUs!f~Xngqf(0DYg(r|31=V$)8dNA{wDnIL+YF~Xj#ugPTyXQ#w33sHK z+$LHkAN?(VC+ZmeEg$_Y5B)6pneik}LI~*%@>cv?Y zF|xAMjxWBAHr!Vi&8TgD`*s-tr(BU-;~eUMv`G5p%jM^>GmcNxcFwBz9K z*L63(+PL<*?_XE8@v9rBf9m&_cdvPM&Dtxzf5nXE9Ya$Z(5|7d^MCkX#66)a4_cFhXX+@R@k4TsI@GnVuj_E+rWy^*0uBb|GN1K*I@?}v7R<7amPUa z{8&f-vK)o9{jvPQRzQWDd`p+Bj&A3|ZEW4;F|$!jox*;FyOIYxTVuFQC)SSDXrenu z)n8iIuq<|!{Pr4fi&FLdTp9Iuw8d~cE*v+DrdVZpSw&ezY+n1oKyUxD1q-%x473ln zlwo1KAR$Q>bavj{Rf?t1jfwa`88l)LmFkpDmF1NS%a>Fxov&(FVv^I>(I3BAg)RZi zh=luYuBz;)?5$|(s_ZRqY9@*k-O|-H*jYi)+}zcpL1$lo90&;m;iNTz%TWLJVYW}6 zuKvo%Gr$k2sPfCh>Oh)Oce`mc-DlB${VYd+w=36luSIV+_yYWfRBj-@DNg$7$WsSR zzv7l*irN7g)1HsW^z`qr(N=1TS_OIqXiPL*`Ae3Z`pYbPq(5TOJ)jp_={JG?7-$^s zuD#8cKGPqx=tZC#psVXs`?uGU`|E3}UGM1gyi^>OROn4FVH3N4^d8kb^yauRmz}--lcWO(UU?eqTtX z# z7?IUXoI`31{kTJi)gH@!1iUK|8TKO1#8KxRJ4#W0lhNmKFcV&XoXRFpe!IbJ^O-n) zes1W)NH-Jx_dAB>5A`{gFt8qGqWvG#r1PJ0%RNWGz+zCIV`v_uGg03RvvIzZP-Ote zg9{9wSorgROW4^F$`A!tTA1xCHi;$eGT=GJCb96B14oR_jlj{%@ehGmbZ!KWu#=il zVmj7GK$oyHAkepn!H#bRmxC|<5Q|Oj3y43&!e0U`cItpOW<=3x1)gL0 z#KP|b7C(uFzn^^5sfmTpF<$a|l=y7?LwFW(cEo`W7X9bJnq&CH!v8UFWTw{tDSk?# z8o!O7*|{DT{a=AK$MA`T{~KWOpIG?0=-=W$vG9w4XP*N_1Y+SA1J5yhV&U_gA@+%d z-(c~Hg?}w@WR|wyNvsboH2_?4uIBFmo_(H&CG9To=NLY*@b?3Y55&Sh09?We1p?2V zQg6hfa}-$Wjac{`yTvB4@M)`L4*#Qm5KGKJQ*7ZfVCkR4lC~09`X{mQdF)4wofW{d zc@jq;79IBgIfhRx{Pn=%C$aF`$iE8z5Qv4}4LqBJ0Rpk``+(;dKC$pW2Q2o9h41u# zW8d!oP*IT>|C{4?uEz8^VlaT3SnSjQOCKN>ejTvb zYy_TNf`16aqQi5_9K$CTemn4N9+U{g!tVs0WBA0vXFriL5)1!6;MoiC4}n?(Yb(p9!vNKjfmn2w0M9XeV&QY%SGrj1uLhpI#KWSqmT3*2 zSok~_l$f+P0!uv;i_YhOBg?eS5n?Xd5WYlxGyV{Z{y1!jo)9@4dgvQy#H5yODPf4xDGx0Nfg@?uFEU@Mn zKC$p;1B?H}!sn1N`%?TvAQnE4wK;}QEPQrru|q6;R_kmYObEonUk*IS@QH;_7p2aL zg|E62U2!~BQ?N~y@t!?Z)|cpPc3@em=fnA&HaAnca7~(Naf$PENqB>9nX`>j);xfR zh+A-jLcc0oQ^to+Pm`Vf82Pq^=_5H{nIV&%{TxbN%I&G zJ7FsR6K87DTthVkek2LUsGwesr{?O7K`8_L8Y8R2`hmkbr?K>hGL9+B0`_>EK8`3s z@?99PHvoGhP@+99CB@zQKLG0Cm!8A2S@H^N$3QT+4OA~ur1O9CT&9%J* zfo%c*9*tmM1VY;5vQ+Gi0^9!WMrC|ojNw=84FTK!t%)iXLqghPTZz5bfo*#$A>jE! zg4p{h7`DC6T+qfpE=|QA$8Fo*?@+nidypV-1{k)zUL<_i*h5vi_A+41w)cBf?iw+M zU$OULz+Ni~`k&yjypk9D3(t8xFG-(X1A=}?5PUlfGhZ_eQPg{0l<-R#Bc~($W#42t z4~^BTq4Qt#n3h<=XW6J$5ZM;+;9IYVsCStV_!Yft0n*oe*aOxO#XK${^?l;cW-6>L&t{a@~@s9I=lu!x=hzKU<-0B3%B>NXF%av@ba zBlDTO6Gg{YPgL%CY@~R^e{HJn+5D1%P^kWJOWtGjVLK{XyK|^K|YHDo1gL1@btu>zvwX<^=qUWg!*ArSiNE%Ydf}e6qwC%Jt{PnxIuia&$h#vUzicFwA8Sk> zo(R|Po(PRMoXDS-0sD8serP4{jX4s2x+eZwVJN>0^^bPCYGvN2cU?17&osDV`s>5% z@*3}MOuOzkt6El{T)pD*!s=h%yny>=JOU_7U5WG;xI9hg z1?Zsw-58*20`$fJeM5kD2Q%dF_h*XZ59i!EXqxA6o30TOXF~cvFF=1TK+BlTGbi=i z1M8>0{nTrX|a^x|Wr|Go;dVPTQ&i`6} zQ$X&OU(4SP$iEk$9}mzc1N55~y};^^3fC9>^bA#KblE1nKH}A#KJUD1JpR%vG(c*WK|55xy*oIhQFnt#OF5qZ2 z{vi-cdwmI5+L2iJ>~|&X2ndfMmKyvNvGIq;X=FbBAv}X9_{YG~CyB-88^Dq_d2c~B z4pJ<;y<3U(o%E+xp&`DWZPE=0%N!nl!rGFzarpKhlJ_~RG`RKMdC6PSmV$3tkL;b- zwVm2m=Rw8OsPN@2a(e{{1N!w!J#oi$Ra}>@_ggn@nDg z$nZD}v})-5r;PEh&9B46zg)YMS+d)KA>#1r1nONT1b%6Y;YWz}nvngJf&MXw-emw% zCh|AI-a16eOAuMc2qKRlJiQc8nEUPZ3Q#W+HP-)SO}Mz+dz#^N_u3C3Gv=p<*m;-- zf%+r95A9NvMFQvLH9|PQxG%&<<7hKG#NH^LG^hr5V12`-8Q@IwB#m#r+)hPY2_c%^ z4KXxBlS_GhhHb@&L);1G)MzNLKk>Myp7ed{rRw{6Mh`zu;JMTew86lB2>;x^PrX!q zpW~<9_gM}G`okdhJ_&61{ntR(AX3hLFMWSO#S&{btA%lOCM|F1(C&ZPf451R2!yk|J}SC?0v z@pD#QMb8B53WNay9p!fMU22zIOV9^s;qMkTv*c&Y_Eg52|)S--eK>^skQZ9X)@d+!g|huvqMLdS~tR<5M>NjLqWk8nRyu}V5zS6QE*w<P3TxWGO8LHpM4oSc#XR!yr*D1BzwZ_ z1EFKuX7NY^o?n~RDCK4y2Ybejp{k!Alm zLa*h=rYL(K`j2^*qSTu*pyBxAJjEXxh`!w3nZzhg^G_9tqIdZXIa({(w9Zklz)M zKWfqGMwk03X{;^y%lk!i(DvUKlDmD7&$8t6Tp0m2f*@b%@-$7`I%wLfPfc^~BXYkz z?N5n_jelH2>M$+Pe$xXquEfEgVo}Hb9%;_WbU0g`bjw1{i~t=~HCoZRpPc)DI}J^r zXQF?7$4XDTT*F8p-C~H<(3^?+dpV%b>tGV7KOUgxiV(k)b1l!n{yY=)eN#YxPJsTV zqm6rs9R2C;{oL%cyq_8^prV{KA`n+Oh%&6DxTr>8{Y6bB@<()>{X{cCje#$Fg^vEk zU?AA~th16Fhwbc($)4j9uw+j#1}uApZ1)HqN8mnM)Yv2zAC?1`pjjE}5KFj_MOcj} zdx(v|vOh&EX*U6vaIuTPb}D6|5!w+WQ3t9%{7712NqY;hr2QPQ>_6@xHg-7IFEM+O z@J|3o&c#23=MlvRV$pdCSbTVmI>rvM=)4VFVh)&hfFtGt z>+gZ13-AwtSoC>6VyVe@x`lHs90Qg;L}E!h4R)k25eq*TSnjo*4J`M_=8^vq{6i=} zjF`RD65vw9uLhQSBNm&>$*;se1Y+TnE{XBK-Yb#&CVA{gd5J}z`9=*vEPQsm5;73z zzxY5bI&@KdAQnEyu#!UjW3V>++&O6z-aLUfY2fn>csp$Ho-21n&0DbC`>wpS&im0U zt8!UraPX`IR1d6kAwKz+%;d50Z$F3g8i@JgZ1p15*N z{#Q3@(Ourb@no;()?mC0r#U^z`3JERI200N2I2%B8+MQ+9Or|2?86d7?^ZBuy#~GvmEQA^?Zv;G~9r9xf~j0 ze$jAPh1;T;Mdfkzgo>e$?6vX{ent932c_qVIxAuYXA0dQNokw`V_8&$pQ5gr7tiv7@5O z?#Zr2t|%FGwmUj|PN_5K==}L9b-K=pF04mgqTfZ)rw~Jk8Hi!ThcUoBf_MnAWCF(n z;-8^keVxCE1&H$yw^m;-gC87*uLM z;@zOXgxHPPj`%gCeMBks5b!tfyASbCfbT(k1aT{30`XymXG-w<7=G_Syc2jo;=_nH zBDNxCB1RBDhPVuIDdM-3zIV42zaK+PLkuBKoxm^RcYwc*Scdpb#K#d!5E2&c?dk7G@a(qtQ$>Z z(+h!pQ`6ZF&3>xsOowJWXgbTGr%Y%%9M<-844q|Y9zP7>DO!H`7_*9|?-=zqhb(;R;dU1a2sd9)+%Gjy(z_ZxbavA@gE7aI9(hQ7$iqlONLb$xQ2 zVaPJ{M<*N-<vJ?rwu*J$oCrhLLlPcH9PZ)ZZq3cC%^4l$PLw|NcGcGjxw;K8)Q(lg143V6WlRw8HhUrr@ z&GCpKY-o;u3|WR=ph*=DYyE|W&N4K|Oon+zpW`C~Xs3J}^B9VZoZ}kO-Gj?D}gnetAba7g$+#VP;UhR!nde39erU2I>D z%M8;ET|D8CDl13Jd0t?M7@A`$TKD!68_~l`STpZ zkY#9|7Z}1*w4CP(hUtbbnji)J94#-Ka7g&4X`V9}a*h7rghRqVE#GbE3ypk_p)WG> zhqXHL)8pSGhK}TD`Y}U?jr<#i&NA{lM2@*2>vx~X4b5{7!#uG+;gF=A{&B$2MMnOx zM>}$!e;9I&{GJJiMEP`ncN+RaBmWaaUu5Kmv^vVC$M3HhI+CO5!-ftU`4K~B89C<` z4B@cW|AHpbewzM^3C)-%_C4D1|Dd6ZjQo&CJ95rh7;=sLixUos@@e~b8Tvva|AL_} zGV;ZS4o}hNt0jic%F*;fk%u+CNaTjT&(OIh{Z|Y<%cOr)=`ekYKHq)a(2*QXbI!pK zHge8S7_y9<^AUz{SnJ=TNz|XFzcis4xh6g5Gz_y$dd_7SE;RD735Ue-rPE(!=o&K~ za4yEM*wE`H98xVe;|J$b3=0k2GvSb`#@OpH^kPGI8+y6PzunLa4ZYRSHKxCD9>uWO z&^JyvB=Xn&wbjrI4b8bELyZ|PuAFd4q}SsS=YkB&&G@o*!Xe?mmNy%^#+(nYF!W+W zbN+|tVhF)yiyVsTL{&KycYs`FLm8-AkE1L|x+{_;u-1J(``7%R| z8E-D1a7dI-k58QMGAuXa)9ML_gnwFowV`Xw`L5p3iw(Wr(96yFvChy74c+CY*T>Tq zH@&7i-SnDnGxS1pys1DK?B3dqPa>(tHCI=ZR+ZM)UtLfJ4_LCzRKvPRiRraA*kZ06G{S(Z%O zr8bt_Gg9kWnVP;ext_ldPOgW3cbZb7V=kFo#VO;dY#4>fY+PDbL@b5&2Dx2rm7TexnzswsT+jX$YJ+tMVR6j`R!F^4mhHB(XyCaURTR9cM2`q3LFTji$QaN zUha0UNqUV>o+6_pd7!uWsCKba~vfQ0q$+F}xQz|o)XwXKW^^;wuH-VPtIo_KLO*VM@HLOB8-kj2g6g#z2 zz~y8mD=&NCPIl;&<#H?1s_N8^xtgcV*wsu?_5O0WnzWh9PpHcTbJ7+F=veM~Z4l6z ztgtE6Qnf=s&C1c&5-HS9Q%1Kw&cH!e_YAUkbth{P%T-r5MVq*@V`+>)?fB$pl0GmR zCZ#uWsaBudsw1bNeL|~JCJ~yEEjg7t8u~;|ZmH53ff)_mG;TFoZo(^5Zc(?YLm!xy1b^qa_T2Z!K$89D45nso!V{HB(Z70 z)P{}Fn*F#n=~lVrJ{(Q9<0@LkkXH72<0{f(prunQrf4M`%Bk8r&`v3|Qh1j_%POo> z(iAF|p;RiqQl8o^SJg5pHOG^<+ZL1b>Li^M^_8S!l@RJq36gZq)E`s4(;7)uaEpFA zcU;BO`Q$35=v}@7x{8z3ma{ulyB=%rGg1f~{mjaJdSN&%nz3MuL(Ss~zyUm=Ab$qE4iB<}~tbN7F zT1<~5XXIJX+9a-}QcLNZziKC`4*Mj^x@D#*t)U>kKAxgC=(46#G!|u)ORYF*d4m=w z@sZnlXX0W?y%ZiM=}qEbO1(fG^6Zt|2?CuswNk*dWTg~trB+JeQ*s|k;Zw3w3ZMK+ zllYXZWckF)2_Y+HSl1WGXGk+q^r$14atXqd-#_LjtD4fKRJiX4&sDKZUPyP}S;uz) zgz$BWeL41fiPF`btTcrGbmX&~d$3494!w{%*U?`@h7-~qdYO<)(<=k?>HxjbqW%7b z9eWX1uIURb+OMDG=+ATIn$8W-#TM;PKgGF^i{fm=5Z+qH`Z&+kpW@I37VS?z)sa`b za!q^rYud|S($_;whh0%83FwnD&4g2 zG)I3S#gBJaNhd*~)^rfJA-+7@)KLY<=x9FGP58o@P>;HUJ0J_Yg2jJfZi#`E= zK4;OnpbvtcYwXA2-`{}FH}sd`-`ke_RroU%Z6fkA&}E=YjeZaO`;Ot-=py7LgXoQ z2I%FWFEsY+S%07}GW0#bw^;I@!PXZo`9jc7fSzykN8#T;TlCBDFB>+CjJyE;m09#g z_}2(p(*GI!xz(b74SWzWX401fKV#8D$m=bOei8m;!iMO_Ko_yhCVembW1kj!0{(3V zeZG;O4ga=-o@3~G__yDZ?*;z4CI1QXein40(VqkQ|5)@^_%{5;Lr0Gy%O|$7JV=Li%s?V=g;6vokh<9-46Pr#{O3L_a_$pUHJ2aMgJ%K`6r8B z13CkPwTxHy!@qKi{w4g`WYL#^-fhu*uHq=@n92Vi;m=DJJp=T+7Tpa0a?kSgzX|`U zK}&!64g9&vqE~?K1}**PZuoZ_Xz4$1z@G;!c_rxYTJjz6?-kI}emhXN|JS0w4gX@( zJ^2Uluim1s0DU9q0#m*_;qRRm{VM!BY|&+)U$N-V!Qb~m%Xsht{F`&OM}GwLC7`AJ zUGVQZ&@w(e2>-TO@?XH8dn`HM^>h^UeB&sj8X7g7g6=NtL8@b7Od`cC-wHt36u{73NToEaXS54r|)fswbuzgCMr3V(K6 zbOz{0ExHl@y$D+B?*RPyH;aB3?K^X(SH4T(-^VO^JN#?4=?}dNsK^K|)e*%BDS#&YzuUhmi@b830KL`Kb2K`Z!{(Sg1;~bB^ z68gYfSq(DRM`r{T{B7JUxrqFJ6i0spSFXwD_Jfu3j5 z^Ley!i(Ur*p0()D!@qYd`tRV+dFOiV69N5ki{1?XS}gi;_;Z^@E6|Tx^g8(WLyI1V zfA3lJui+2BSyX8JEd*TyI%H`7eD?gne0Fw#o)e(Gl?u#ZHFRM>exdIjXk34N33_l@ zJ&HLVX@CA73D7Zh3k@T5Bl0~4T*ond1d;D8UBZGOEJEaW-JWnL{SU){>N5Jpj(m#x zM?-7>z@<127}g_};C#-o0g?Ti;RZyh2V$|=3M}8RBNjfZ znZ7X)3!g0d#=sxpvkdai1(sdjr@%Tap%8)fCN_h0C^o4oHfbmN2L2(~^%(?Z#88O?op)%3N;R${zf9vs;sqMB zKZnXS9w4sJc!ao8oh(}T(9v7 z;*}b|M0}aXZxT0X{4Vh-jro0x&}xlyi7(fZH{EB0?i^lg6#Yn>8LFZq|5&xJBdr#Bq%e5VvZ4lsKXB3F0=5Un1V3 z@tef$8ox{2p>akA@QoUCzb3R*;{xJNjjM^fG_E7&2^yi1xJTnw;$DrpXA-(e;}POM zjrSAxYkYusK;xstgBqV8zFFg!h(E3Io5b5RewTQ=#u+%*g>KO}m-sUp7Z86|<7(nt zHLfH6oW`8rhd!@yEAf!V1H{7`j}Y(Bct7z@jSmoyXnd4-RO1uGyEJ}@_%@B-B;Kv@ zyTp4m=9(k4SL0mb+coB1Tj&mrtBLn%Tt|GT#*M^(qH!znT^bJ%e?j9B;=488Pduja z0pk4{A0@s=;}gX9YWx!M7d3v9_)8kUOZ;VxGjPri-KTLb@mDl1AiiJYYT`fDxQ_U% z8gp+b^k*8k5|3*X(#j}Skg@qXe5H9kOmK;xst4{3aY_@Krw5&wn8ZxTPO@w>#2 zXv{sb&>@X;iNB_C0r8_6R}+6-<2vHUG;SpRhQ_VLk83t*7yYRGaA1{{5KlEN&KwF?-Kt&W3H(} z&uN@X{J%8jUSjBZjjM_OR^vM27c_1p{yU9ZiC@%sfcS?Rj}V{Kct7!vG(JH5lE#_; z5VF1}C+{}uAMEYz=^IG2+V6KapZtn<^tLDZ`Ug7(68OX#-jvia(9zS4kHqmCXJu=e zu1NH4Nwi+p+0)Y83GSJ^%$+aj>FnqqXtHegE6)iZ+kA`;UmkPba+LgPc;|ILmXmm! zk}=%0HL>0O0A2Fil&my^c%@KNZ$G|E7kpFf>GNyr>*;EOdmY^=KPE@_JePDm;=6NA z_+njiCsXJztCg+k|8&PdyuA$HgX>KA-ZOQ|)Jb0ioGicpLS{}<-|M2?H!eAK=zR6B z$*G5d?Y#;69b2N9%B$|?u7tAMx~aD>(U#~-bjK$(VQV}2b+n#oZqUT5q9%KnRj@B4 z@Q(k}w~XzM(}j>M&>j0zzJ!V&(kol)e(!IIix#`6Vv!3yRI$)ydZ?n>WqPQh%4K?} zqS9r0sG`DUTBzJ*dcge{;Sv`uc2UJ57ka2-q0978MYYTHP(_u?^bqbSkZ%oosKWa? zqJ_#`O&2V6zm&MdMT=cjvB-rUs#xeUJycQcGCfpLWqPQh%4K?}qS9r0sKWbtsD;X1O&2V6za+ZEMT=cjvB-rUs#xeUJycQc zGCfpLEOw!XDi*m+4^=F5nI5XBc9|Z+ zW7m?Ahbk&vriUsjT&9i4ERX4#>6!iS!+IWnZn*MN+~d&~P|qy+9Szar(w{bK94@Ydk=v35kv_PJK-S!+urj_ z^!xwvAjOi|wa4%C+4d$NTZAY4+mIUo#N#ojkIbbga@$oPT&&H_OExD-p9-X z|12Y8do&}xZSQ6f1>j2%dz-+w?d^xXOQ1x1XCqQZdp``=yKfSE&j;+iXxW=#*-Jy` zfvVe2zdwn+58$Zn-?Wc;{zWZ&Y){+X8zAVn1S#(W+!p||(g^sTQ{F2mfq5~06p?x& z;(ZFdhfo4_81fK_YY-V4;9myT?&P0~NE!Wjp6g-!O1}4_a%;~6!vxA0@5Dd;O1`hb zk$FakKa%hN4d`V<$u6(x%`^2Z_Hvw*0j1CpZ4M`<3DmdE@2cEL?%f%2Ipk$1?9)%5Axy58-~C zO~Vt}b$nZ9Nlj?{o=+W`8X7ODNynw`(6MK0vY!o&XV)~;MrwAhyjO)U+x>L>uD4YB zL*eW3y^N=?!51!`t((>`mRVk2yeod!%PO}nn)%xgKK{vg?_1c#A3h!$&)v|lVQh4? zJ({V~cHE1%b>1HIXB7U#D)DuXz%38;6g-i^$YtnKk9i zgE+1Zsuxd$j%U~8Uej>R*l0#*a@!M&@&ufh5^J>!TS>~M&oyZ9t zA3j!Tz3CHQ_!vFx(XWrzuZ!eHJUc8^XdGYS&A9uz^oRDUwCl#g<>hHF@C~2Y4Py%z zmXH1IISM5_ma^SA^Ci2GM>~!<*xq zzoW8icGlm6`Y117>v}hq@vk4?ySg95H$$>_KHe?5*QtB&J0U?I_M!fVJ`&AVX?de3 z-Fj-+)PV1xoTK9J99522n}g}tk2Zh8^Zka=_iEbeUa4ET>WNiFtM6T%dHHWX)w1d2 zrWMy8zP_+|$58(8BWY_ky;#5Y%VQ%;(~gC`FL-R)l>YGFsH(jgp<`LWTx7BOSSW*)z_o`>vT!@{phOjs@nKF2UK+GY}_Ao zpBkRn`B2XF8?CR-RONgHZMJc*KMmf=y7^nGdKp^Srvz9-my}&*9c< z^6~w>2Vr~4)D`tdvc6Umefc)zbqKuo)#%PtR^Lgo>bDuLk50Q7J@Wm}YoB3%JX|jI zy9edlW6C#{ak;9-5q5CY`{r~!5>|QF9NM3fzp>~(wg6=(18K5r9=ImG{^?NJedq6~ zS~#vU!~8n<8}&yPKCX_u_m}DicMcz4k|JH+HO2R>ugA!U9`|%8JY1FdRw%rOZ~To9 zos}{trl3r$y|Ge89qqeq@0>lMW7Uyu*~$LW%8`t{wf~VjJQ00)1a>imAS7-#t? z-pD0=gMB7;aUM#0(CsC*tj3YOaa+-D@nZcQa`YU@xTKax&=)fDWBaFjeW9+#>zT!S zrqu6QC23Q&_v4Lw8jA4+po6!qcJs*3s}7CUhw-&`${)&54bqB`{%+U}&m7v5U7KDQ zo|-?Ni87+(_>P#ghkbOZZ10?llI5^upTY?CsoF0)XNcPR{Gl9_;t*y_c#B>^cxrad z*zGsM=8TM=4Mz8dH;cFN&7TP!8VQGwgg;Zuevv=)6}7YQ#D}9(Z?Jk(cFn=B%)tA` zt42Rnn;&~bb(}MH4Qu5o)C%%AXNtN>bB4hgKBQ{h+6b-Q`OuV%vC-dtKKcnXnDTvxf`GDe&(r> zC-xrRbLftFwPkmNj^Q-=TKYrNP`anH^T#vX_rTlr)H}V+Z6#AruVJJg-DB!0t}@il zPiCn2P?jn>F_zJ(q8}8iu@7de^H)8I1;NMd<7c;xZrCMxxV0EL zONB3w--V}w#&=$mp~CgsSH?F#0iTBARU4jA;k}{bWv(aGh%P(_=b~@@`gr)*@R4r~ zhN}MWL-67(l@8fh_-DT-zrwL0c`!xQU?LPchI2q)$FOp&zd*Jh|gx6%KJ8L9l=`N;w`CF4j&Noe?A&acm_i$@+ws!z_8%V&D^dCtb- zoX~g&d*6AX@%i=9>>qqMmbC`nKk{L8!)`V93cSI}?LnMD@^LZr!O*l&e%epfgK6JO zvQ5w4v25qZ3PSUJeP~*s53L{l&AOJxlZ`8`JA7T<#=AGBed;%tx2!q2X2lhUub7K| zwBVZlL|^}cM1Q=!xw&&ee_wpTmX3k;!Im;yAqBg))Lh51acTed{sqGC>}ct0?%Te= zx%$)DfiJ7zy3fa#$3ESM>!z`|!-=&g@O={ZYb8{5#7*tZ-L3uY&07;qUHw~p^0v;7 zE$svRYHoMG^HFW{r4y!YZf$L9?{8{v?Q0t7X~L%!<6HX&yVPKBYcnp@y7VOKc>+9-*kXs##9%Pyc5@9Ejvfvbg9 zMV7<{dIp+1WB4pjqPw5YcP6^G474wc72Y!F)AUsOef*Lb>M&+q#6!~Z>TM;l!hQt_ z%U^%Ry2k68*4MACzwFA!Rke+)u3X!+YVFD^o36g}>J0&7TY3hVwJ{iTF7>9!P*-c; z&56F4Q;)9y$bAy^=FZ-3uMmN3ji=t_^DTWngT4KhJ{@z#F-JU)1)ZQguKj3?pY$RcCgU|P7H#nE?G0i~c8+_cx#~LS%X9Z%j6;jQ!^=eafk? zgU-Lq(ti&2W`Ldp1+mv+$(jD)0DUMx_Xg-40eV+}_P$N1{dv`v!=Dn+D=dG0Vawsq zFD?4(pu0ia{`2`!9n#hNu=i6Cc6;x#UhU z1bPYR0z;nz+YG-zOv4ooa|@aCOmG^mNYH*Iq7J%!ssr>!i@x1xHXx5Q)FRXOT5{3@ z0s4*reKJ5F3ed%woNE$&kOwsG`GH`zMiu5(;;7u`o6}<-$H$iftLE9 zf4omohji5qx(h@MQS4P?7gYycA9#hgOS5hs0hNy^`X?;;Rgmw4>;g-^!jhj0IgeNF zAxrw*mi(CMD=me~xvDL*|uKu6SwsheM+Pw@GtS*E|x2K&@iZr+-n zZ}dgJIzYc3NY7{KCD7i30e#E7li#fY{fn*gF#SCNd2c}8VHu>pSNGcgv4H$CaSp%K zzdT^iJ6CA=vjKhHyDx$17Y6L}8lwct*9QE*Dv~>g6(U0(qCD?KEc_zi*~TWZ@Ht-2F??d-^O{n$5C0H|g})qFzLUFx*o=`4!17Jo zwZ!HC-#{H+&_>vVC_0_M{00-l0HQqmbqnz{a`8MSB9`(_xSJT)*BHKpDBr-n54hCm z93r15Y=p-UrGALT|HHsiKg7a+g8Hmj1Y+So1w6;_iG_axxYTrlXMp9ouII=%{`{1D zgI}}o+raX@-QN)Nphx%}Vu`{0F0J4kU?~f+_`vVgN?C}7Ka={Lh#(LPpYQjWWBA0v zF944AYkgwjbG{|*SWX=_6aum6)Bww~WvhWpIKUySBR*H-^~B~H^akMQpym^cog1ig zzUFTRE;agX)W2EtiAA4tyOPAr>9Je?`hjEc{AfDI>A)d2M|5Ty2L~_{*qo_{73r z1020Y>k|u~^NdKI=C=Wh55%H#Be3{DEc|Zj=j*h@!tbNL;S&p=?~svtCKmp;$v1UE zEd1wz#UEnf^Zpv~hgkT0u4{Io_J>&bKc>Fn6AS-MV5t*g;qy7L2nS{a-X~J>QH^>3 ziugk;`kBDu53%s^85T8ro=!_F{OQy;d}86#w)jIV{377e`PvTOZ6tkZiG}NcONzA) z&wo;%#A0V7aH%O*E3nwX2CYC#hei?GOw973v#4vG9KiEPaev_-_JBd4FZ$={Vm;O0@l%z@?mY zBb*0ZQm*j@ty2SBvP9$6OpE*S z7>Fh9dSFSriTca54&Ucg@-dCM{w%#jW3HnkAJ_P^z|qfpSZt0^$CQ!l>If%p2=`Hc z$bk+P{Rb@lM}bR>{UVqh#KKR@gg<>+pIG=gz_V*LpIG?Qf#(=LvG8NSQFERm7XBjO$O>(T@9&B3 z@UZBtC4Z;p6AOQn#U~biEAZ?~wLY=%+kxj8KC$pSsb8n{iG|-weZwaf{s^$t39<0+ zC4WTQAr}5uflKN&{{diWFJjR-2rTVIEc`>%U#Zg)3;!|TIfhRx{BHx7nuXZ}aCB6s zB^I4$flC@R|9N2Xhgfu81QvgYh0kY9XRp#}iG}}T>Ki_>@ZSIyf8GL)?$T+AMdw$* zC95@`?{pG>h(+f;VDX1o`0rEya-Eh~_`j#V;S&p=?>`fNW&@Y3(P=*dEcp_Pejc#o zODy~%>R+ML5(~eW`i4&|{3XCL|0foH4RC3Jwo?aOvR31D)W6NcqJJ&;G7fZF`n|y7 zKe6Z!0E_>`!rw-H<0rB3`E7ggpIG?2fTiB}UaRPC?HjS^+zTwe-A|n>wGOf9JW3tY z)`u79%%#KPxPL&g?j;d81XV+*nHdCHWrg;@AJEM;sV7Cx71vNj|ZKD$oI)%b_t z_=Y)$iH3NAr?OOA|l4Ob_*W@mU%3(=zp91 zJMa&ISoksEk`4HW@c&fCPwKQuWi))dj5Sb|G7^gqJS-#E;vWKk1P=h0Tt_b6g@!2g zKrCr@0gL|K7Cu0Ivpymg{lmZ|8}Sd}RYa*1V$pdYxYYQ=Iw@gg^Ox~@2dZWGk>iC} z(k=&<y~WL%0!9a5wR0{6pY&L!{Y( ziifE9Ni25m1QtJug@2Ixar{Fd7C!sZ9K$CT{$s%6C$aFK0FJccAHw$#BMAqp3H+3{ zY5W|1B3m^6F@8!6{wZ*DpXL*b&Hn_Bn6%t463jg!(I*!DJm3-@90=SOD(%p?2smPJ zF|n!7Y74Igj7JrCE|7~FLhgkT( zqJEe5hgkT(p}yf03;*}PGIu2w{_mY8U-Jl zH^{W=TIWqp6r1-!*k$Gm65N{U?LiR}eG0mKVT7%xdjeiz(cIZ_3vQ8eZYI)2g?lOA zq@df*r)gW%V%*BZ`;V9BhgbBec6h`QZ~!CS>pgMFxm$!{gY zn>+g30}5p+-|Apz(=yoRE6~lTJAH$h_sWFHD$jGKA7yl!*k{Y!?bSr7w4YDGshW7N z=>Q$A<{cBA{Y@RMK1J&uF0B)g_b0lMSl>*Cqo%hrftQ`|eGpQ!&V74ciJE+GbCCP_ z_(&~Y&!Nitw|6?*i)qclQZ)7g$e| zyU&Nazk3idx9=k=EVO`7M(41ph&qW465!*!u9^9_ByBFx;+^th`mFgZF>hUR?ao=ZVhLYD0s3+lP(6fWcegXj1UXfAn zG9mCQdOc9GpP^*`V_-QLMDHOKNXkw=--r1Q+K%#@5LsTjvS9I2`w_~Rem-*YXDF+x z7cSD$(?3JG1Z~0mxX$7V4$s!9+8LS8(F%k4DwCPe=bg9LgU$H}v4p&+%-<7Ca~L zq?)!OdRx6Z@A$0Sj^8FFC>u?F3gEH5#Ut6wX#`I?ymnCSx$~xa{(gVYvb~jiJkRfG zJcOqdX5jgsSKPbpL$C8Gr?tDJG+Jkk^#lx_CM}$T@2}kCJ~1_1N6t-QKI>2vxYL|> zm+Lw%I=TAA;*kbbJdqe2%Rr4xJayZm+wi<7>MkBRsLJ-_Msjv}-hI#*dOaFm<;yAb zdUgYz`>da@(pOGVJ6E2s(l1-8Hq|{4KAzc<`49W9x$}qn_WeoK!r!VR8RIpfaoE6< zgbnK7+}6a?p=h1E8`G|13;hw_K#RT~u@25u_t4@{wLj%5k6?f5yQ}!|8^0T;n^apELG~96D3IVcF-n7raO7dnWxRM?c$r$28g0f0@7p z(z}JgFX=&Jza4m{%5lCIBPx`0jVysQ&mR&O~0^*XkQ(OJwV)q;MW%4TarXhq8BV({0FVw@UqNmy}mpB+U@!II=^bL+#gh8LqR;W=|vcF(k0!8=A>Gz8f@U%<-cA(az;61rGNK{vZL&C>C-|Nn`c zqW?Gi!wPeAeBvRlG;8AjA9HU5A60SgkI!LqHZLR?T!IMNu2~X73=tAQrRv>4HY6cn zgam;CA=zw5FmL7s(W||L%?1Jl(KV>O+MDuLrPW_0g7)`!d#t@8UmGiT13J-gKY@BRH>&W9!Q%slhVGtWHp%rkRl&b-e5mJ2x5>&Iyze8t8~ zUx~1!5Z3keAE(_|L?^3NSx3rGI~>+i-3A4>okD84ky0L&vdTzV6`5j{|Nm9!%Y}V8 zhE8o*Z}Ceq!Pg&zRQb1kthB!#ilwb8WqfZSN}JX6_JF^2+UVzyu9f~ z96~Z~#!MMEW2O;@yM~R>jJ#U5VDHN4eE-J2?U0GD*Tev8KHe^}2sJLLBuj<}~1?83H5s3?Y_f{?PEm}lp z<10$$%=1MybA(hy&875_Z9ycm)Ru~cbm~4@XM79hEL>V%;VVQ7SNIlCnUS3O78F+9 zT~y^OSXj2Ss<5D4atKs#ivqcx{tbDg8kt?X zVqrlMtSPkoZ^$is^M5V3QFcLjc^R2+ZZZA~rT>-uU+(_={|Cd@j;$;0?G1Hqe`7U1 zHe&1}aOX|U#n+tOS@j(qt?jdJv3-k1WVwaj+)rt3YgrTUcjV%0HE#M$jmTM*H#Kj@ z)Z6lIpUeu1P+h+Bg7GV|;!^dtwfT7sd9Bl`n(|twR#j8TPoamJnmQY&QJ}iIsYL`D z+uHpIMT=~@GP#O%KRtclAjiz+U=@I^M`yI>haQ^qYWOlJ;ivN$`p?1g0aKcq{!=CW z0w!=`UPX~Q&rekqkAuc0d4Oq-+=sIv8C@*(uweN8S zrn5(RN`6W|qomV$Yg)IF^eLUzRK(+8bl!dy0JXdij8u}}AHff`w@jY~*n05wR0}{T zp6d_sBOU=$`=~JKlL|j4K_ma`3j7nu=Uu?`PDQrwHYI%?__rQ>uK@4@Ga{b7j{0YU zNor%6|Hn!?;al>JXK5(!Rp5(tJkg)_EBMVwr?nlGpWi6yUqw3YQ;_N3g1lZtx>%oc zv8PeqKP&Jt@b@#|Q#FXcTI8qiThOw)8XLdY;Hzxn5%L;q!yj$K zAI;u22nzb+SfqSh>;aU295~~R^66VO^nQ_EsS!Wt!7qK=Tf&#J5f58!dO0F zw*k}r^NSStd9;5!V6t(9zYOqWO8$|6zpvo`80FKsSxLVM@c#vvWKQ|N0yqsnDX(85 zZ5m*iz8>(sO8Vb}pLW2qej4CD!1PLw==~GQ-v?NhN9Pw$0G?u`Yk)rm>^9*22#-bF zO$O`-d@EpCzcGOEF+h`_A@K9}fF-@PfS&_=i;@3+@bf0%YyAyz# z4j2;&N9yYsoBocq!FK%~Z%e;{N!xP?<9<4+NO2L8iCVHtl0;qj9wR`{tOX2Y%Tu9+jA{>W5sktIdq*G}i!$ZZVQXzPV&r}+)@DOjQc|6E@ zljr-1MJX%dQ=adqu#BIDaO!mYhsTTGc;oy%g(VL0Ho=Ieu#8`T@c3KtA07(J_=N~h zFybjJT&)<`sNxdEa;iJWo$y8Gi_2d7hraGX5CC z<7eYPJQSAkClQ`t#8X(tzmBl9ArzMJX9+(Y|KXvqjK6@eJhw_=8UGH#^4uzgW&Cdl z--rM3P*}$Q7U2m-JcVWaM+lFfi~sOYSjPVW;R!}Og=PGo5SHi8DJ44-bW9 zJk6uzxo`^0cqhX0TsVbgJoz^AJT!%6d@AA3=j0iMWjxKZ#@{XCDJ91$jaBJW%uN8xf2e*=X} zMR)}Mq*jP9(HviCg(VL}e}WNDVHrfID>67dr$OoITP zEd1nM^*I!7rC4JuzF&k%{_?K++bG;F;_skvhX{Kq+$q9^6kaRB#T0%(gv%(rPK3)T z{GbR|Q1~GcCiRtf)suS3yXsd__!0bvrxrhXSA9K&|AAt~9d_D!9^{*YbiXct< z7GoXIW&zU6++zls}0Ri1;DM?SAcF(zIVHM}J0Xz{l+RvGVC#4*y?=RL&%V!8~S zOH4ui@`i|+mmd*~+Qu5WUlrRyNj~D(B~IS925_+1_$Ys%Hs&T!e!Hi2S+sRSv~?}C zbr-aC0d$^uR58Y(Me8nS>jG!%)@JLfX6t@ttVb?32l(Xn;A@n1b&XNj%*=X=zo5% zc$X-_cqHC1V4~?Y;%bSjJXx8x%AaUk6^T@vL`uW=7+?e;Sd9Te>?p=GX>@Q{E z%84w!ht4KHPUn|5nxXYM_jH-(n6u_@=*Rt4w96aa)8%wV-Y@7%H&5|CQc3qF;taG; zo`_cOoz3fgu{XQ>6^JO@jhnz=p6ISwy0OYT#<~+v#?x(6|vp~OSkz`FSCNx4_^0!ZQ+AsS-8jP&hI(qbv&ozy{2oKQ}eeL$E-)jr^Mx% zjdX(~>8?xv8rt8nr`H+uRieBA%Im~AZXesJ&vw3tQ``<*780DB#wxc3i!#9747M|V z#iKaktylKF(dSB-$d>kPI&|ug2glc!J>l@-RyyApmafn5+jL6aLnpOYuMIno{_!zz zu(;=f*($-;x>@kKZcSo+Ui2+zAIDi}-j0deUbRhS*-v@))@q*T;&783za7xL(e`TX zmiAf57k!g!*jf80wY8{!LJC9ReTaB>?a;M*`hssJCeH7ht-C68&7b-SbL{SQdUikU zv|8DN7(YCeSo(0_Kh+X&*PO0zkLDy)8}4}-JT3^OTXh{yOw{#;2mPs`D9YiUxc}@0 zw$vJzp7<&>Q%?l#wEKI0x$_r$e}3}B>DSH-o%`8^!z=%-=Iy$FU30$q&Ha73z56yl zvfR!o-9_BGQc|N^{DRN_0=M}=_x7Y{!QJyUx(_+Hr%%)S{H@WNPrdBW%Ecx>X%*RV z>7g&Y&4uq2E-3kFNp9)4N=ME6?CWcmUsztc;)g4ypa+zi*x8#M$9|zXd?!*GI_Rqd zuF%`)6Cb8XezbQ}e0!hvr{bQ*j1uO^?8VK+eQ1jz_E9(0`m-z0;){E5k75Z=31*$Z z8R{|2fAKrmvo}W5b^oRBM9GkNX7?>tB(4qI=<~0-923)Bb5rr+P>hxX74O5;cjjxS zyT6_I?sYfmo_#Mc&-XrOj_gFue`#)152TW(`WJ^Ry~fRsar$qyf&9?ig0NmPV#GTe z4sAH%`Q8g`J*yul<=_gThxp={<5(OE#l6($!EG^moPYan7R*f4UHa(w|441_S!njC znM-IlhAYk*PaZ?b+iSz|qvKI;^LrAGtP*p?A&k_(!{gL+lC~o&Q9J#l?3;u&H4uRV zJ#jn-yiBygq(m*a_ZP4#y@@mLz3ZvL(2Rn??qTL0-8e4n937u|DE-J?M^A4&ZR&cg z+fYeL7wZ-)qcZP3ulrMX!&YTik~Wg<(n~d1LxaaIUvc$ZzM|{1gjZ zj$5ffO89X0mLPbs^iOE1pKXcRL$=?)IAmG#W$2l9xloH9S{)rv^3sE3p@pWMV9>M} zntQ25)i?)wxhjLy)<~^&p#2@0C)k4iMzaTLhhy=ys?}<#$QpyA2nlfhU}f?zZyXVu z)<7G0+ytvMvSh?E$XV%Sun-RPq@7Qv_iK*|8}WPIM_dVANf&^58s41QE-~&0Ci$&j ztM&-8JAK-|O6muLq34<7=;bTqjs6g4567UF#H#J3wW3x#`$M`cjrvOdBOx~U_xRQg zzKoN9a1VQAY<|aH7EZpAX=VP_ms$Rn{(|(-1yffBL$Jf>0c(0*>dSY2-y7;0L|=QO zk2Ea2M`xd>HTCJedR+E1{#8d=T`1od(gx9|^e*aI^ZOjT`!rXE&K^n2f4EZ{?081g zw(FuBTED6IR59I?y}c}@&%bI2cI_zanmspZ(<0v{txF*jvULk2ETWdIbMj< zg3lLf!56x<{O&uVMnD=rE`4n!q}ptb0ne0;4q&9lm>r9w@;gS?TRd?~bP2bbpCXHY z`dPC1`AI+Fce3-eRetspt>&a_=#N)|L*2Lq<1%}%C_nTmwCJ-d9{BG5RXv)k`#P2% z>S0~J8q@mLJh1}vg57NWsfA@VCmn_7Q(RlmYMyP~=usbDQ={}}JD2=!;=5Lc-rH!| z;2m$yLIO|PKNL_5U5P3m+Lyn?2jOIG_+|JnM zVMnwb+4K4*5xBwFW~63I;clWh&8=Q^U@C^t%q# z9GP`Aed9+PKQjBq)%>HWWz>fxZE9iMCJs-nxqmQTFR;s)>N|iO65r33X~&D7^^xyv z$0ePaIv*5|L(Z5DIgU+)yr(nAYlSTMS_MX$TG*8i%wd23#jb6if8lww?~7fJzVL-- zYs!^fTYvI}r|%bE?CN{_i{r&x%c|49tsg(W^_0B~vR_k|Tl|ohHZg=p?=Z4Bb4G{dzpXxvl?+z z!@2RVPh!W5spb8xLop>jP;S*k*s<6pmX~V-XZpg)CEBvk2cZq$%X2Ird#@xv zbi(_A*~Y=|;6`@x?_;b^UAza@%G5Egk-#QRbR`_tJ_!9S{s_aW7UqcT4}2Yg`tGS> zy=X9mLxBCKj&C}((C2U6ixxS-2KBxI|E1WPHn2E$Jy(JH)vS_zt&IAb``(oy#coCP zRPVi_r)DZWH5@1GTBc&x$wy9MHNL?_UqNPsr<|OcY06c5R|&&c`*Q1+3N0Z?37=Ha zZPHl8Lt_VCP%I=?BSt$iqnYtF68oT0EG=lQR*jHg*vLe0B`NAW=WcO&+HFZZe}!w z?_xeJ9G8JwxDd0e3p6(rYW;Efq3H$m-9vTVjn>@qkL_V8eUEGybRP2R8}jjg<+ew9 zKJIfBeR}2ozWIHRz=O5?Qx`_+M?xFcUw?nkJ3D{1_rl4yPM;J(dCrY0qO zlR{dN%tzmP{9UNd9PJ2xCuI32w3ch-#hPh(UB$VIqNN9yW-i;Y%=z_C=hc;+D=V6R zaDF0cjPHnypj9?WoxF^s&`z^#?cJnMqsf)_ZVmkVDSgpWXoa8KRkYX~Y5c8a7`e7+ zkze7|ll`rmu@NX;p|6GqLsPVLbzK^DJFRd>bya7kO5OqMdzA}LFFdvQL)YI#;C={3DJCzmWiPV=jR*bH5C7!!3rLVN#-`XE#>nXQyqc)J> zb(kxQ!AXUQ{`K+9k#RJ^-x|F}M0rA(_XQ^%O|WxAt9!d2C2s00Ys=~MYx7sUf;S}L z-b8jQUhlY)l2~~2Z?;QMCA{U6?eBNyrnq|bxAM1s&ui7^ciq~%<0`bDC3}l2S}Um3 z;9lRzLH$!!(}QoN4m4IcGLI%ylowa*@2~0Euw!30;SdiCdd^|SVsRqk-sxGk(eiQp z>#-_+2)|X&@ET|Kdop(?U=1*)tSTRmw%#O<%RM2b1u&i^;tQh#gZgE!C-db5KZ`BJ zv|hE{f*FO0^}H_o`lS|ovf~o2Cg-C(w^cjQUj49;_EzCKvRUOYZ7CM)2JCp@o{5`P zj@M9#8y&G#xJ;fZ$>di4_ z*x9GbaQ@O<$dLM2x%a~&%s&quV>w=YC2FNMkc_{+k=+H^PsidbZEGJdTedQ3cX35y zMQP7ouF)zV*)eN2#5qyl^N{`%g$+Am=h(BAByHuOIrRL>T;0!}XMS%Y^JGp$ZMf#X zW&CZ`2E_Zs?Cz|BWN&bizS6OGXr%wrYs|4XG}6ERHOyQNebqDiK#jeY>_Y95fiT7W8g}n&tL+=ZN-x(U|abI3(r^Htc6)M&{Mb&43U4(6M zCBnAI_lXVRo|0#KeWm7zU~z(Xga%f)rx!S?rN$S8y)}hr3TKz>FQJiCEoI@+#YdJM zinhUI^(KaUeX>0h%JH@)t8kPbduXMtllg(GE96;7rx-*Z!r|}jR$`-Wv z&g|~GXuS`={eI^=>A%XnQ2N$_a|_QdKC|rgm8WY?)ty{(y!lvcz3BLsr5ES{zG0@9 z_}6DdjV>5BfoYWs+zj8!?FG}Eo{0xmqJ}Hgv|Y{&%`rK&l6vv^vU}!BEei!+Ds^qC z90>Y)F(d2Of*FaJ&*E)B$pBG8P2pu=J|^>Lc^ySqFQxZaIYTQwxkr;d?w3d9KBEozFIH$&FYpBX;LSrT zU3$?K|Mm)uS$^!FvdXbSG~0t;*)zlj`+n}tPd-rK+EjSOzbaXqz16?{=U74g9wR-v zyi3$a*5*B>_n6KfVM;GB; zdI;;G-6_1x-F?1k#nfA6scH$+bk&=+q!L71y5dhUA(`Kdn)!?;GgRfsOl14}{i}Wq z$(>+bhqo6{yNC5-sJ&;R4h=Z4^7HG%2d-D7gm1rlxfbA4!j{CyZ`KCNyjk9+BLC|{ zpr@})EZXH9QgH_Qe7l^{Z#St{q3@`ANc|S}(l)0iyw1ImJ=gy2^$}nH!@QcZGi9^q z@1IZKVYkMToI*#2ugbqZdWKAN`~Q(fM=8lHFR(LxRi5kvE2ka}W{{+Ys)Cu_qa2ft zj`B==d6Xv;e{+VRY45MhDYSoMKNjbeyacf~7Qbre_jSwC9}8sn()#k~2CVUp z@?V;)Su-@3^YWF)0^y#a>-?+E;Z5%Fb^g{F8m%Gw%W0)MKW;{W-y6rQ9MpIGts$%r z++L8c@AeYq+z@8J;5u^D!3zDr())YP?L52p%*oeJpFVTy+{x^2N47pHH_9J)8@mTA z8xzcml|jw3pZ-6%6QC{4`SYW4D;3>z{Qx`}Mod zWS(^ljfKt1#QNJztiL%~I`(DM#1Gb722{j?M;EiD+Z;o6Sfg9ZcE$}oI?g*=f6rOj zmtVISdpVwDEBZon^Nweq^soPv6>V~498Ga8-o(b-yX0O^^0(QpL-t(k1p<6 zV0zDvjKWcl%cc6cVj>Zk8kdDcG}_3a|m@K`^*#!s)%t|`}(Y3yLg-})w2 zKy>Ws!P{!5>w!yn^8P=Q-Lqzf+5qK#Udeqm9jQDN+qdaI6lqB_LkG(kmwsAOS9-2A z0IL{_6W>3po;PfzxnG4w&!H8bbc_cyCS<`gNYIy9nxW31&>{)v`CO@fxx=S3?Bs&{ zQhcyCz8vqao;^(N&J&h7^GGRt+pGfZutl${aC8Y|Vp`)6_FzoZgg-Q*gzh?#d1*~3 zI4LwT%X>91e!aU7c1~JWs)?@nG%>h^uJ#sYd3QPcIj4MY;(EuVP|E1|aYshi-9MJX z+m9?Q^5nw1W3Mp2=P+U=aq*En>@{>`gi?apaifAI_=4|dyTnP~<6cx-irb933`WvB z2u}y^(AFnnZr61<*-JfBFY<36;&5;X{v3zwRQX8yKWLRCZq#FekWO=*XdHU?u;=@u z>n*uNYZ7|ni`sx_N%Y;6@Wzu@!o%^}F433a$-n|@hIgV}HvE0D+YMG`)W@CA>bd=~ z-+kzT(e+_x<^FrdMfD)8UqthZ-3$Li#f;^x)2t~7K3$<9_LzQ`IsXcR7vlfhxT)pk zQ9`1@;m`^iT|6U(*sc)=7->alMM(GL99Ry&X9TPia_lnxdK^0ZG@W_kM10Vf2FsBF zt3QL0ujbJ~MIVMwn8aHw%Ue-GoM7C6CEBp#YW+9u<;WERRQz`jneH-w#&`Fze=sfQg+ab(4fGHt1|+(YV*s$ zwD2r{CK~tMPK=l@Mj6dMb zPdMlu+;q@uuW7hv%+E;=WSe5_^I`9=VZT)_9CHJVI0??}#ExS}QHafsryZ)peb^;? z5&k~LOvl_k*u#2&9dV||pWpWOw#WMX7slZ_(|gQ%mgmx!TIGTv>(iU%HbV zS=|Z2$%W2*XIjCLkbl*2wm;xQ_#84cm~_47U!P#640fkQ&2{xP zw5oIR^~^)rN30rCThy03vW~{XtL`4YZZPy2%ZKgvw;qh*H|#7u6Y^yr%0&KirVkR1 zbN^WzSR6VMvaHVX;^4&Y1k@pE?~}`q`!B_7=bngF`^#tgd?^^~?DDTY>zNprKx2R_ zG@TvrO)1d^UMluqx-Pm_kfDB3l_B>;E?Rd!i8WMOIZeR&U@zv;{j3r6KS{t2?QHmK zC?y>F0ZO`EbM-FOv;i7(97R5~X(e0YO?Q4+IJg>nwh#S=Ii4F@;m0@SXa%z0m-+PG z{)V+#XFXXH<2~6E<8yx1_^WW7^Es@Jm%BhQ=WNzn^>2A{CdSjq;mMsC-*q^q6#hl! zAMbi;Y(a0>g%xa5BLSzuzapOv{Vw%fgohN1>YmeT57q`|6hp5P9FCCTP&`jp)ImixRt*oQ6@g7&t zOxEwr8J>E+_5Ad=JKnauJMs*R3mlW<;y(1zcmHYKDVSNJH7{kPu7w$Y3{d{B?WyNdT7 zsob!B@Ydh5uAh-7i&c-LaF70l|B#dAR~|%9cVy^E`IWE{Lzk~Oor7ry+5En5==A1R z@-@}s%a;khFoP~C0xyf%PW|n^;M_X!xR$-=oQ+Wdd~K`T=3k$t4ZiX!@pbEQ?5up% zJLo*_eY%g&&kj1{KBhA*A?Fu*kz^U}wosgfWeZ1}CK8!GZ9``V0 zbO16M1f8y*<=^Vm1~;Y^3_6_!Pe1B<_}Hgc^x)v)H`&|UTyOrVApe1Q&9(YEhBaHX#{sm*`zUJ|W!-xBrFnZo&0hd01Z1yRa-ZVD*RKtPx;sHroYe8Uy>BK=Ods$)dxT0 z1eKgf`?G@CiE*@lh-6#W^WI{6c@C^Bi#-P~aqq}6l(dxma)Ey&2L6foH+-J-AArY_ zL=SdScrw9nHh!CumWW(uqHAf z7%E+w*4r;6x@YrJ>2cEeC*k)Fez=F7FC0-RHPF9mhW1jTp!!~sT_VBnY+fof@r;>f z@l6^SL@A#1r_n06C*n8Ky7lusd@SsXOmc-vuVf#E=G_>{`$rqCQPtHykv$&QyET8y zKeAxqyrr(oI1PjTplD$lR+>INdd(Yso}?cwc`V?+Sg8e{`}vY@Bb25s?%7$W9d->* zXW`2oY;eZ+SziBO(gButt(;aXJ6?JGHR$7w%r)P4%RcvaZ(rrc}AZlu8HB z>5)8JxVq1}@6?m?-6f>ELCC|C`}L*jJBlq!J(%n6!cWY1x0r2WpYJ++^Ogqp{Cr8c zHjSO@_w4=A5>L`UE_u9E8xTC~kD=Y97b5lXsMPZ%vW*2sbnl?P8-(}j-%fouF%Bc^ zMBnnRL#PKl74&0_z`@C(<&KF%%frs5sgbgfy631?`nkk;E*!GKM0LRXxN5x1zG>>ni1KE$xI?`xtjO3k&fE$&3! zrrZI0ZrI1L^O0GRHMQ~)&fd8*i!q*l5qn%f+r@Pqey$`~QV<6(4mTMMv3sz4`}qjV zZofYRxRNZ@@Za4m|fBVbmK_zTPksqVh6#l;>V^CiZ(i}BYyQ!a`WdquW9ooBL=ba;Bw@5fH8S@F~e0+tgvI!mZj-VI)_TL z{&;wI*Rjez@;@E$KgpXz8vMHXxQE!!aGu5ag6HbBJmI9i<#Nsd{Vv@xw;*o+4o~`r z3E_>I%ro%^PEXbeyfr`X^yK{6>0$4)Oy4oz;-X+?NqjDLC1PDA_j$aTK9S&AkM}|A z=`H1BoBZ3MyPWd?IPV1I5P0i1#t%mk#`Y;&mO6X~uws$!T)J)W!(leK1>;>Uar^ni z$ewvxvGV9m@vhL%*-N^$PDWNQ+?m0;-gO0hC|}g|h&kFwU8T{)QH&n7J`q;@b4R4M zTIZ1V&MopSF5ZW+^3J$O97&1#Ww>+bntS+)?>QgZ74Nm6Rpg1GjbIPqUEEj%KghX1 zl-KVl(wPqF4RMWkt^E}HF`OKa-r&%Q@$gu@kHdQp|HXq?y~20B2hg|UB3n%xIQMKb zb_-fHZw~D=*8_u)0=*qc(trQ-{JwCfk9m^5yW|yPU8d`>48ihcM9Npz3f3|+cFO2^ zJNx8FaK40mjo`hBiJ^E{!0EAb2#c^{dTiY$dwz>^&FZb--z1&*W^z7WdTsyqi zH`AQW&h!QM99@E)!h3gPwq}hs!ORm*nzz1yIV*)pi~F38xzORFg1B>YXFeH@n`CG( zv^V=hXzLJv|c8spMlG0491U(OLJLM{tmwSB98)Nt) zl=3#;iwk+-9q?3G+ygW(0JT0nHs3odxUESF>uJ#AA0**K-Rm@7tZ>H0S6c!(X@ydM zB+Ym`x1Dl+9v?fWd@C1g9yOdrd87oy8_TYXx(_?;K@%-tyvMR|uD%YxCpE@u4CZPX zSBal-Lu~xCY0*6O`tB*Rc;GeqZLIq28AW-mR?iImusplsn-xh*KPy>NdZDy*-Vf(x zmwmG=Y5u1x=3_N57LDPr#OBM#M=mKVZD2pGcft3w(+JgJ4_?o)o4#G2eTaBjY_3Cb zzE|1tb;zin+X0KVTz{f>d(_snRwLgjTB}*)p-}uV*F7-@6^ts7zwI1?s z|9}P4;t~t$!uUE1cC4nyC1EZz?&SomQ)3+zKX+V`_MW7#QXalr<<=Z~4ard184Fa5 zUf<**t0!@M*wm~F58k}*!p~fZfc@Hqp9hzf?7~l7%Wti4=`-QQ9%M7%o3&QdmxlqT zIUSP=S=QN{w;JD?`m0vFmAYP8o7vZEX^FiamS&uUX6!XJqwtU&lj^glTy5(}-KMrq zE@-`ntaR9U4kzSkoyYa$421HY?Cag%KLu|+)+z5jk_#M}da}Sj7z2L>yvYN}o{8^c z@3GipEO!{w-UmIQ3pOK^fZl|4d@+h5b|l{4Y!5|^N})iwCu3Qksb?5Z3aDhl4Q32s zJ;j$8>m4ZN8(u~$4WT5Iml?ube<&vP5YFQXuI!Q{8v1gpY#k$`eESg#caMUr!SmR+ zF~^6RCOh`dP082ydb#o^(>qV?J$dr@ z>0@V(o;z~k(8_meepPp2&0EdqxE;q?96yVLuF~kce{=K>N-C+pP1PS&udRLo%iD`y zK_dcY1Y%5AQs1@0@6)#*>s%NK zutFY}kgw0cy8Z5iT;=>2rBU6m+b3Z`f3)SN`t9k!`?3;!{@e4;m&x7YdSjrozcQS1 z1J>5`?Rh6%&WG#r&bpk*tMkt6({qo9^{s1iPlfe6nsQIWJ1Wn9J*T|ua8}ud{?GY$ zI1;?U4BtqrR;oo2wZfZsSir7#{i&T1W0>?A{i*$$=o;S)hC=FSB$v z$4Dy6o`?GP(1U94<6L0`w|pi^pKve#J-#ZnB{rS@MxtYV-6&>RTwWH=1;{JXgQndA zVl{>LFW5fp{2hY69(G`4n_BVhBC%=^9)s_I=sVcne%EGSa(?d)?-}LP?7rTePv9FE zqtrORcdF+14q&gR>bueiAB)pattypB4_-I@ca``3y}8&iYNwS*Qrlo__c(Q2v3f)- z|D5u71|zi$b6q;)7%?tfE${n5^>m`x#Z0@q)p05o&uRFg5A`SOeHr)dF2!#9&VR6T zc)DB8eWbo>hoj%BQ|L zBtNQGPg)?nEwPu`sOuq`!$nC4-u;IW=TqgpoOn=9spDNuR9@8Ax798yI~I0WZdEmg zd{T9{ie`RU)usD%Ss$0)ooIy%9acClPKLue!`DQGpC;#^8`e*)Y&`54;e@~Lgujlz z_<8VU=3V%CH2lSH!}^>d>>S6L8GV$LmAgPgYZYSs6}w}WU_a0D$NF$;+1eSC9=BZj zgh9NIp#4#<9X+gMn=7pcbCt?I|MvIU;lQ8MUgEn(`0mTl9`9_upi7p4J=i`Uc3L=! zDn_a@d7u2Gb<_tuNpVU0LfX3+MMuI@@#UI+XsF1OG@P_6=|B?pe_+o?tn=}pf3qGJ z?b(IagnMR<>-AYWW%W}>2HpYRmmm7B*Wa3<^%crEXBfyq1pR;^26@|bMSwzW_o;p9%7-*T}M7odt_|ayEIRt-A}RFmcD&JE0B#P@ICQW z<6w57(~)yD0lU$X9oa{(2~Lhnjaq%VFYKJ~p4eAyodlF)VAy%Hk#eiaGvf{7$uSd>7(SDGLtG!W-WtoK>2orR$E@O11fY!J%cE*q6I>ZvMZM zr}_cY;31D>j-UU~5sv#;hrjh1?BBTKFLq8yUqZj8T3x`Y>2PI;(N||@>tTGaRh}=F zbqwMB^LfsgnJS>rP7|vO&3fr15`JjblA%cHHLdmaqML#W`1am7MwTa zc;^Y?HeYWna3#!$;yB!s^Bdy#9dkDlx5=;DOW+>N@2Iy~{mi~^R(^Yc`a?KwIEu?~ z&%?Z|y&G4WTqbz$m|s7CZ)j!D8Jv~g@T7J)fE9de|3!-L&y|lX-sQx1W0HS>b7A;y zmp81R&>k+SpPzeZbY1C=%^{gnyqAd5G>juZ;N@EH=VTj%ohNvmGJCA|J676<|4tfX zM&`GH;iTui`lIZJT&}&nEr^^CX;So{&{5x6Ll^oWx^;?iuZ(*9ukEi%5bp{A|6?ZI2j@2|7=0Irm2 zXbQBsJ6hZsweF^NCcwbD)`qq~ExYqBw|ZNSzdqo4fL1`}pXF}p>}c)maJN=J*w|8C%NFtq zy8SK99f9T!cg91VD6PfaSlzZdkmGKuUf0mn*+kK7PDvq~%>`hU1=5l-*fe-*Zs`#D zk<`+;x}KrYP$UqVs{N*rnrf@+0avYCw~m!8c6YWTJ*xp+v^7^ZPPU@BIGP$dkbg3( zuB~n8XlMb3ySBQcTI3=o3Va2Htj1PVe0aYx(CogG*w1k{H2WJnYa5zZ<0Jev4|W9F z-7R$x11L7HHo5XQwAKgOs;WCX>Z_#41M50ibsZR!Rh{MTs9wz$w7AO`E|_ZxLun;L z5^WH6Lv!G7W{jk7vIe14H`nqOG2^bnF4rH{UfmO3h}Y z26fJIH>?FkUK;7Q-y(mrdm1>)a^K8(bEB}ytSQjmUcEZt=28R80l%roMhZx{Yg?dA zr1nkK9sYWgD^tHC*vQBbEEqMu=}z}lGl#!}cM6ibDrm^PE&$5VVRR%m8~wkNvjq)S zjSktknueAv$gwSOe`lZ_+PB)>ME#$4myY^sG;KpiJ8On?WPfdFcDGkI36#}s)lE6* z7THB}E(HycUdQe{h+)B5Umk{>szbz~sdaN&D$m`7nc~lX`u^FZ% zqt@tIH86fH&5aN8j`ctQqA{|FA)v0Yv%TIhlGF?lu+#?V%<7JME*}W1v%`{*tQ%*t zu8RJA84sd!b54NXVIPN#3WJpxVz7-_b&UoLsH2m+JI8k%7(s~a2I1E>cjiNU3* zp}ifQoV7nt-Rcgsw)pGYX^7#>)*(-OJ=toZ->j~!dUX@{B2BWIMoJ5 z(rhtC!w1?LI^<|+9}ewIqfQ(>x->ahnFG`;cYDJ_0b$h+v;~@~(df;qs|=r@3SFMe1=#|&sH35=5gZx4r+O_0hU%Ke08EkF-`Uni1)IpK zhVqV6CF)2`E~I3LB3hBCO)-GA8Kxx)fy;+%wK1A2qN;B< zP+!{?9Yl9oi_W5EHB=c~2O8FbXk91wwW4T~E74Atr`aEHH+Mn~Z6vcSZf2=>m=t8k zscUO#f|u0ZVf0KiuV^aRjQb58z|E4l2eGBD%ILhL8LYOgrL~os7NVWfQa8mc*2oV* zMG-OwE>58ix`3(}{Tj83-CbBlyCOu1ZWz6c&fHv75Y@)8&DuL_1REW!y`?cA?G9VS zJ(A{09Uw&R$Se$!?zR@x9J<=nvNjN-0B)DLbTV2A4gY8HR%>;mneQYoft9xf;C}~Z zxgV&8frBi_1?0n=)iRRdb_nejVltW;=(*@qL=|Ri>bg2SXshb>_COPqT)MPuJ`JH3 zZ9~HC)Cu5InO&I3+{`6{z7H~Hewv0*Un6}mCJhlo7?ExaRLPbj<&H=<43o(L?!~O` z=xhh8@SEX*2G%yTbhcwqn7m7$VCKte%nzznU;5i_^IxvTO+>78@kw&*;zGDd*^)ou2q3oE8p=U*9 zoPv5bp~Wx~16rE653w2WFuLG^dEp{=COM%pY>H8?&&uyFP5rjcuHX~%3wI{VBbL-SA5 zC(pr5vxCpA>RYI1lN;~$H#U%`+(3PuYC)Dw^gIet52F@|bF#J6=?yorJQ`cpzv-{<3fi+ko zAf*g6wPJWN`X*Uv@~0z&5-CO+CEVb#j>CRbe%gOcva!#_9)AjKM9s18D*+5YmDpumZKFlGD&m zYaQ(Yc;kixBxeGKf|WE&A;{cr#UWrt!i$y~N(K?sqP%DLpE7$ctLtoRe2~FT(}WhG z1+;)+S`RrSAcia(7?U~OQ`~%=bGA{97Y`Ifxkar>8~+wE zV%di>D;c4O1}Cz;5F@AE#xNRK=MRvDfh$bT6_yUC(Atf=u>q?P+|XoIH`34{R$YYE z5lmxM*F9y5o15}L(*Nt_R%2Zm{gljD6D>Klw^m~Yhask}Ex-pz$)!yQ?MYaSFs2C) zQm5uKy;u_B3!YrXYZ^M5s#_=jACnoG?IhSQvBraS5J*@|Tpr9pg~$;#EH)s4`G&?EAtIa+z7C6p8(JQ=JUQVf zac{c08N(8*ZD{vbxAB)C%51_IQL>~3RIud4$d1B2Q@)(s(k$n{(zBIAJtHrnsk&JX zg2Hcw&s^)q>jsq>&%~QwPn;6R|yg0Dd@ifHDFlBybNZOKOC znhS}xWKxl8c!4do?m2w=P)v+5x@wyoN17XRiBdosK&-vdix6HUy$&`+Ma##v1}}W| zn*k<48HpBGr{|zo7Hh{7C8R^cGi2idLJ2 z{gf}8vW!=#SgpWnO|4Ouu`V2m8_W9!KIhT>P@t`4iZNWsfkLd7fT&f~md-Y^Ynb8S zJt@q-aG8w^&_h#`3tJYsF;qi4Q3S>tQY=X~#?m&K7?~`%VE>1=6u^$=)-!8(p!GPI zc8n`o8SU_B@J>VorLZNJ!X?5`1I4JN#RO~eY|4dZ#?dQva7-UqL~9H!%@qy)`!LMP z3}VrXWMW6j;qGoDCBdlEx_xb~!nGuTg=+K;-XV-Ws=m*O#8NsBUXRuUc-JS*6RXu$ zh3E}aTcA$7fsTmIffFl?gP5YLRA`kHGc$T|V5|bk*Ah(jO0l^B`#2ze?sH<9T`ZcB zGb!H#S=iRgI_j)g3FeQl9m}SWW*y8V7P`zCW8T!YJ;k*W!fDG#--|QYxDCO@>-`= zHRZKVt*WMwpF$5cHFY*lqd;|aQ;P^Rwzc~a66`Af598}n@`+;~U&)aG|Lb7?bRA<< zvUnV9I!-3iQ-Pnx+Hu>d2)hh8GQZCA&!P27Vz5ehgtX|8_HfJlkyWdz*u?5%|s=(SJ%wpLi`}{{(m(ezN=xN;=^m zv%yCdc=Tw7Zv{u@|42#y;u^+&30U$QSs%eqwuvub3rE1qmGlR}?-ta#7;%!{1xh;c zyU+$({Mzd;;CB@KrKr!pfWB;BqPJj#L=gC&N)YlaN@Z*k+5~7OKPQ!R%0Ek!5h8z` z0^bGs+=cwPO8zz_o${|$;F)OXM&RQgFE1D0H(L+jYfAowHhw#7@Hz#47W#Jv`R5t= z{~7xHBfx5Xex=~oLjJADgKG2gHv{)Zz%!Kc^Pp?uNn{T|mJ5;o6(ikhTf!L0ZbW%c z0Uu&8l+;5$rt3i_LE@Jbsz&IS{| z;u*oM@V}?vzX8F{L^{N3()+QJ{u{{uKaqZ; zlKzg8{z4KG@RTEN1f+Tz`f)wlPs;x&^m`omO#lw@`x44?1IC3vW_cf&?LCrx3k@?F z>24)m+7xO(lJ_MApWr{(;GM`X9)UkgksslYv%zgPxLkpEgMS>Ajno&wlKxM@Zz=FW zme=PX+NT<@)K@C6)W*+`75H}${67OmF+Be^$dBraKOFul@;|A-L~nso{^!uo-AJEc z;8S{!lKv*z|8=C_q@;hOr2hs5-voX^hL=bAlbrzgBjh*H2Ina70cuD*Gw~aNT2THS zN;<*I6?iC_qq82aFV}MXTAaKR&q#I@`t~vSRps}%k{;QgQ`o1F_rD{v+MgemV zzt#pHQs93;`d7h=+P@!H(mz5&dKSsm+3iMQaF^ibzkDzDS;}rG|8s-x4!3Hn?9NNnP`Vbq3t04bd0juLlu|n@o zAhsdhZQy4^o{s~T^r(G5Q1A)>PH;(>zCk1_AkQUr__(&BR2Sy4Zgu9 zzv&8m9R#xn{M~Hu8%O;Q@I3}h^na@06C7viw~*frHW*i~8IMT+tpdM@irkO-Nq;J` ze_X@$KT~Fh6sWx2Hn`RXXG1>X5%`uqU&A8lkG8?0KhKugnShII@OB&gV;elxEMMe* z-Ii|gcdf1bG3+tuCywQs?M?M9HS>?*^&c?l3%El`Ukm-5gZyfLK4`ijn_m+a+jq&R;(xrbv^dD046WndugE4F|+BY5j?bsEBy{u!0GMoA~Q*#vHKO_0Sf%BIq$zj$>^mA?S9X5EO0!PyOiY>o@ zscz!=icQ{bRs#K)4Ed_|YO6$NZdL$&FILjYm#61j_>Excyu5Fk{mIQ?%f1Qt63;>Z z3HTEm{HX%pj{dV6Zr&jP>1|8vlfmjOeqP5rd&q2PC|js8P6_){Bf**}s0q%EEN z1@XAq2I%)YO8fOg|AzoyZ}1bTKcYR?%Is+0d1!wRXpjz3eHKAqt_3XX6PaJMkK4>I zV9TEtaG@>T(r1yr%$EKQ8@$a1uUFtmell4Y@;?USuG)tp6F-ydlV!gI{0Fl=1zco< zpHg62%Q$DFZ;i(y{~1$X1$;=!Px@SBwwFjRx4}6!c$N*GZG+1cxCw3b0rpH=XQp9CAfUIm_ohA%+=i3UBw-=L%u{DBSLq`+T={%k@1DN258yv}6T zLEm0Qy425WU=Q8^EZc7q0s+98M*hh5&f@L49BJYa@Jb1yS4QGzbNs1hdN#XfqyX~p zX9Q+`R3DO+c(R#nyK+Q~fK(&t<#2qfJOQsVax-8@;^*4nTUZO)=X3N=)xSGp=D&s0 zxB7>Gt?~qHjZXsJZp&X|>Yqq|OG&>Q?K=+ol7%?Z7pi}=4gWS%Uqt>m8%%R^@!Z1h zKzn&X?>2>=wO%OlpHlFtytfp1I`m~7@`H@YkEKr{zqNiS;D>Ge{M6LHTi8VC(>Fm+ z+OIi)Z$Te{nc(!#!hX{lwJLvWy+_c$L!n3fTI*{feUvTz83o>tf~r6t+06PhD(N}U z|4rZzY9P{KU)C!89RPpdMY`lKQlF;T^eLaWAF>!vzAb$QPfwT0@LH)pq}$>VaH%Oz zBi#m1m*~j<4b*Q$Qe=C-sHESA`piPQv`18)HUALwlg;)Q@XJbhOCXB}kYCyd%1`rq z@d$iN{{?KVkIrCi5XK?&afr~AzqP(SgFOLyKSDZOY%|?j51qk2OJ?l*NGCHv{bK~$ zs|P@~g8y5E|0>AiIMSCW>F+7&#J{z^E%>$OTQgW0)kWh0P6QH z?Bh)ezU4m%{J+@bwanB%k#4PD3iu;i`g8@p9qmyG{w6EsZC28$ep_wu?-V%6;AJ85 zk6^cQ{j(NoZf%3ryZx1Ir_G5sjDfl-i_&(rohyKh~ z(({yb;&-_MUkk%?1IkzNE0pvMly?U7N)38B_-j3)K9;|6E89wp;vo_m>#+65+j;%R za}4@Vz!McXlK$5?eubGX-~k)_Ed`Fue<#mhY^K}Cv%j&yor;%QO{yz+bQ2YO95}g%t z`DB{*M8Nw&Lp%b`wWVA07m;qguMw~{eiyP_=xY)Nn;Sq-*2jAPB=DcG(O+)#X^f{Eq}O>-F+?Ae;`kl z{sl!ox1jugK|21K^?TLEeLk8AY1-xwiUUQ1~4K{=NYIJO%$xHu~0j zyQtr6CI3F;y&gZ97_+=|CH*Fp{cm7qx{^Likq^l`nKJXIkZl642lS=_ruOWFek}r= zZNSN(SAsmZ8!+X6iv~;n2>y=Q>bs1LnUemL4gM7UMW*+otj|F6yNICjw;H^C0(blo<5+q7_5)@c#%1 zNO{k;;eSJc-$LKp3H~w^{D+kEi{R}akS^QrMabtybZ#0GCH;d6KJoXEO+QcB(ibY} zFG4*zmg*I1%~xpgeRVUfvNrbY#*-HKXH)n4HC&g7}ao6w_LNHcl5V0C@oDf2= zdota?@FC&^VL}iQ5s@IvFrOL7FieJl5M(1EfCLdEK}5_VBC;&9Y!G*(kQeFXhmjDv}m_Wo{*Tl9yy^XjKN|Hj zF8=S`@^r&Kv{P_T@IMGV8sh{1;`UkpgjfG8^0^Z;2e|oN5N|m=i#`8XXjaAszrp_O z3G|<~zmw?57cf2A`Jcgp_bt8j{>~Aveg|TA#dLq?XFi*}@%$^y`!(`Ih?m-d#m%udy6-@z~9ZApGL<_LmyTnhQ{lTf_Tfl z`cttyUqqk!>*J6&KZk+)Pncik#Y^swSUweA`|rZ~e-!Qe>*Fym-uE!?9>gnk@&1JE zFQ!8fpMn@}H?eEZLN z^M}B{--~}~`;&rVEXYZ3KI7Nr>rV>)jQ&1{`8r;3KA+F9GAZt_bD9h$1wX_3;yu_b zG>y;F0{>WV`Ux!WbokYuuVQ?4$F$#{Gd(}sPwvM|3UU~SRo?W2 zSf77@|2EIR-<#hH{z~+j_Q&V3{d8bj+t;PbKP}FO`wA;IJzkT6O;;97FD{s7?pCH1 z^w0D-{_~wRe|qo>jF&GXAD+^vf7WO=?s9Q?+X|*zyy+%ZM0pCYPQi@WpY)g2*LUW; zYsPqo;u?Ij>HS_loS!_;Ve^j`_)ir~zg{q%+@G@g4}0;CVZ43~%d7nt+dJ;f=X6Vc z{966w`q-x5Ebu4S+cv+nixRTwiv{tfbxP*X#&~aX(r%r80qSp41v z^UoL5pH?tEq`;qi-(&Im=C7}8I(dG|rk^XQpIrY=4<5&OTJhfGe1!QX*T2()>DXR+ zW4_=2TfF>uEnb27J&Uy!dxx zd`!fAoKoiFb@%44!oKGM+SC5+>lojEhkQ$&|0|gH?|3QxrTZJ(UX$(HrkA6xl^H=Z z@;g?VTpwIoe`at23wjUo^UueV?O|rTy(jx8n{HP4z^0S)A)CHXFh44iVDtNW)1Sif z_b$UVJ1p9NCFgT9gH|m2@6aDNd-KP8_2czXFx}uypTKxn;w|5$%Reh#zDJc_Fe~^j z#{Yxx`|E#+H-9(Q&sQ*C$4l~l&wpwB*>U_y`TDa9_UCm4)Aa?@4RQTJ`T7k7^PA%N zNt;at^PA)OmHGNMog8193;c5nrtc1Z*AwT9xZe5zVrczr&&RtvxCmIY@V7jSb zIvLMaKUse^y}rPoY;W@l`fq-mU%$NHrZMDQvFTBo#Q((3{z}%5O(*MrenI?uVte``LDrv`$tS; zNaX7$&sX0QT)_7GL(G4#H~*{`|7O(x8kR@#nLkc^T)8LsCARNZQQzNRZ}aBU-#>qR zLVsi1zZRW`X5)N{0KY)x8{IVhZ+ZUL;O~U^-Q0Zqmm9$$_;o*FJhr!_EC?>0?kJdE zSTKEWQ0T5@2eae)_YhoRypsj-Uo2Rj zujSW`)&F)uyschBjQ6Pme_g@!*WL2K`od-{bn9AsKI0LHuV6mN&WgY5wF{Ae;Uj1EH)%KNMqBRu;6Ee7A4@P43=U6Y3OW zukk^bKcA^64oZU`#?f%j6OWH5|7_9J*xxt!vCFq2p6(a?wjlrib<4+XpcrRmGYZ!K ztu8)4xcnpB{1xD0Trcf&`SF-ijJ?1ITs-bGi*eWUS8je=Je>~S>DFIqJY62>*#1)7 z{;k1>z3q$b>E1XtOT^0t=iK<|A5RYs-s|G;jr((G@FTY^+wzXcKl`{R_P;-vUa&qN zaQ$iVKNx(&t&fYbe@w8@#piRu#rS@1wCg`ULr{#nP7k~39&!Iq2<|WFzt>$n>^9*a zA2hni~~H*NjDj@>g7)GaE9MP|=hp>4b^XP##rS`_-r=Tm@pM!08MMnX2Cw3vIryZTw&k7cJ^N(& zFizU_5j~MxKJs9^Sa>W*Ih`z>$K=ShPnO=7ey5YA4+59mZHPUT_57m zmd}SQKaZ8lhb$e3p&)YoN0wejzthRmIYyKZS^98r#;q6Tqdp%oodSyh^ZLvdqRyo@Q{GD;%W- zFD)-wo;I+Smn^-5ew?GRkfkpMr<_ifz6xA2-|{3&UkA>V;05hJz8M0pHv{Gf{XyJmgA7;k^Xq zNmd*_v#31D()nFcbc@v`OP@-=)5+3#FCxPo7)moZ9Aw-^{e8wq!ODTGy2ruFfh_$5 z{b{R9mVSzUr<0}g`bYaZvUJ|pj4~F7Ed5Pz%IRe3yv|dflcn>VH(hRV_}x|LPU?7{ zGUNt?G90XBB&+Tyu$GZ5y^8*<)g?B^yk3JndhI%fh^A%uyP93Mdos5>NAZHu?Q{LutTEd6E^U z8LT|X(p%^sg*Ozk^fqwH>163k!OD{?o%`*Q4s;lbzYl*J)8Xh?wsU}m<~a&Ubx(lP z&U2dn51RihxyqRP^UQ6=Jl2Qo7!+O`gRMILM12dsV|t1aGtRzHxXm(oAZ>XN1N z*pYHNS$YnvejrO93C>ho9R3zAyxn*VSox6UuLdh0vh)e`kGHyH>67SpI$8QmaOMv4 z^BH@!MV6-ythUI~o9O4@LLp0^OTW{}(mTMJ514-)IQ+2jda&9h%fAt7z^xa_fIa&IX;EWqTC+KnK0AzX2fy0kjTb;Q7nUt_RJgzB!{}>lSSN>%A zd(r<x?BE?N2^`khXeegdp(AF}i_ zVC_$MtkJgiD)p%r{{q=@qDoSvr5i9?i76Wa;9R8KX+yYiUWcjy&l@D3^ z4*F+VU9$9D^gEp_eLq1V-Fjm0NRe-)f^I$1h@fT3|nmd@Xnl-vs= z3RyaTLz12y%fSH8Lzbu9^9-S9vBe?FGs^Q+(Q}`9$nx;-m!xa0tts@lYgn>8v%wlm z4PdPcvOLXTtqZdB7W(TfK3RGj{Z1!KzaOmaf-HSCSYw0VQ7Z?sJnO*9fh>JJ{cb-` zmcEgGr<0{`1#AD$d)#V^EYA+G+9FHeMZb$lmcEC6r<0{W307N&!D@>v&rz`2B1=C` zf4%iBS^5e3olcg12CQ*Nmi{U@YOpwD>AYW@aynT$zFNu0AxrN?ojU*&vUEPPk#4m3 z{lHpAvOHyAEhAa_0Q#G(E?N2@`khXe&gUPrEt92>rS8TyS^7k<_OVkv4_O}m&7$;O zmcv}I@+ZsF3ReDP>FxCMgcOA=eG&amCre)e)_KmuU>)np@;pub)7H;q>4(ATIo8%u zu<|6!a~!NZ$163Ifwi5IrN0W+c6tFE-fb~Ebp!JR9EE?=DKpQw zCs=us6(K2HBqTNh;cU+{FYbbeW_V+vV%1@(I@CRzGOaJt>}QDF5IS)MAe`id-lEd2|t zE?GMN#zxBNWa-nvTBl^`b>K{g#p$5uuWfnB@~oilwtcenb>OtCyNMpR4U*;A;pt@Q zd%!yG>;-3dQHU}CFZBai{y|{%16g`G{fqF1LYAHbr<_ifJ_@XT2wD1AaCk4?PUU~{K<;X-GTBaOXp@2Ex{WKSvrSf%IRe3lro>j z8_H6=)D~HuWni^Mmc9ZU(TGBpz8aizI$8P#u=C zfnfCsS$ZWn^Vb$GSba;D{sK7tpv8F^tYzVKsJIxcWg)BX0C0u_4P_MlD~-pHR~hpf zF#N3XB(Ro|tTvOK$}yXytA^u6Hp=PXZNlgi^?pYqyMo}=`*>jkpn zobWuS=yBHzWO-fyhik2^SLkv3bFw_=!Rjlr^w+`aE3))A=>NRMBujsbey5YAcgNu; zv(EhSeNMM6`1d)-!V`YMJhQ;+PqN}Pft4p&`dqN`BunR4s?oz1lPsOhr=0FzFRy^E z?S(A=!{F$P7Kbc-132Y$vh?j>#UV@I1J?Z+vh=-R-Jc;#KMYnJvh-)c(R#~=Ed3-n z<#e+27s1-Uk)`u*=azg10t#7rDLDOz#qSSRpOfVo2v(nyrKjoVfdz#uy@GzHlckRa z>l}tGy&9~2FP}MA4rF;|fRzJT`YigtWI2$f*U|5Evh-H4`k5?!5jfmvaqcI7*?2iv z`H1*hB`w+79b@V%(EStWH?s6f`khXeJ_fAyLY6*@y4#PD zrMH5^%@%(h`K!k3!OD{?|309V`I$8Qou-4Zuu-YQavj?oU$kO-H z@2-Q$()ZEtbh7jVV4W+T28WN@GQLdy8{>22Eyld2Q$A$Hxd>K1Wa)3x@0O7)ozF69 z*~!v*4XE+sUk^smHGcRvZIuIAbxXm@fh?VW6FT~u+(511lf0bpDoJ`H-d0rGKmCLzdo3zthRmmx9$NWa<2EzU~8%rEdeLzi#n&fR!6r zo?T$&MwY&Z{<&6{EPXHiPA5x$3an%CA#k|O>ON0)`?|B_ZD^X#I>opX}q;dQ;@@NX^XoRcii)AW4P+B!my+gFq2 zc^0gGCQCmFRzH)apQe9@#Ux9Ao_?p3rN0c;IKKeaet;}b&+bWXWa+)Y8MiI;MU&x9 zYqvi>GJj`02p{QP#&w>4fcm#g=QXU_B`ZF!F*Cc(!}}X0%j_J?zt=GwdiW3KslrF* zG2@B&D0#sAWW}6LeYxpm=}puhG@UHH6`cM@yrJ-xN(oPR9m{h+rsY`$mWM14PwUfr z@rDxLTUcpv{Cf+BFi+Q#WYs+e4!?~zl#_Ustg^afd7cL=hZpJjta-@tyyAI!vd>qW zhb&JoaQII!qVW54Eely5t{1hHrvGvC524?+OO}6>=dYrNe+(XlED!G+C?@Y4s9mx= zGdvH!2bahHPMqI&D-NI6Qa)tGS?qb1(&MfN$?~iKXWV-4hg`J{lI1A_Ya1j>A3*;< z;|+x@o!dgn>162~!`j!8rH=up_u~zv8n5t)81ck5_(|iL_)u9ul-+o#EwVh^1*k2ubPm(#8N8v8rL&7uPA5x00@ivVOFsz?58@5w zIlPnuS)Lcb%7HBXMfzP^Wa%%{?{u>C*XaKq-cZQW&x2D=Crj^Mgq&M!`yxv(2B*Id zBMR^Jr4JjIgERkX9B+5-*>!)r|FUOboZiRt_XTU*k`<>EtZ_@0&Sy%M4_W#saQLjXTLn)4$e8y< z)jwqUtHJ6Yvh)e`yZr`PI`5rozv16Uoe5p}kmYX%YkkcHD+jVXyf3O83h$9>e71Z3 zMfAJzNmiWYVC6uT9zVC^w%N;`+xfBe&p!B-8(DRq1S>bP^rz|PjtYe={UH5LCrf`8 ztlY@bPlMGiS^D!}wM&+MhW=C5E?N3Z^gEp_o%d1Iu76LJ_eD#1lM=Ye~AH?s6o^#9W8lBGXKzthRmUjZvOvh)k!^otfJz&B*D%GrNbiuakLmn^=2&za9qrJPPy9Nt6LG1|YM%;%=mpJTwvfvmdKVC6uT zK7s!4Sq^0BljwIkSvv0_D+jXlCUE#`i_=Q}iE%sGZ5K%nT5EWH@4cFEFv z)BiiXp^&9V;FQzJ(%I)~*YE!vb?yvM$nuW@N9U+s;Wt)Jufja}CxI28ES=*)%SD#n z2dw2HOXrx0&f^V*EWH$*aynT$$Bf$b$4@2n^zZS8!et3B#28fJL-~*uhhs+h_~U0h z{eQq43R(V%;FQzJ(x-r<*YSozmOc%faynW1Qn2zTOW#J_{XUT_eHS>qh&PnIc!ht8 zF?gE%N8=apQSz{@Q?lyvnnla*U%znk(6W=|e~tb(@P%I{i*3OK%3NAIQ=} z)DPM5C}nu1{~TkyFU=EG?w6Et(A-QcjN)qRTmHsd4Y>y1x> zqqirlx~HM1oKBYhJXraYrE{O4{K?X}?PpwD7wHMDEwVh^mctuN=c0zi#;leuG46{G z-9sj;?kI4kmw86xBYcN3$A8F;8--&&?RW-t7jrgPIg=H0F7+?i7$!?^2Z!&(8_FVl zWcnDdrv5JDb>zr+y~o?YQOb0(V(tK^oKBX`dlBkqvh=5^w_9#x>AaSY*fA)D*Yzo< z_k~A(Ud!uy6SDLibr+v3eKt6Jx5ei*b-JH%2ROt3+!cj?Q?KL^%Z;qM>*y~v&qi=~ zo$;geyM89izn%W~nrA0C2eR~5>h4^EEPWAJeL|ML1gt(GOXvPD zy2bMG_l?WxcRE@AjbPQAy_ za^0yv$!CLmw)LlP}A%Dm`6Fd+1|LPO6+G+u-Psq~S=pSow z$kIFLcRE>md>nD-#{O|+J>!hCIAr;GOi4MNEPV%9$2hX|!_?h=i7fprIK18BbKje; zHZBH-L0T7m%(b6ES>i%)h=23YxIB2+9gXrPruX2 z(%%GU+%m?;#4kcX@sEk|K7W(x{yu*sd^+zUD<l3o{N#O8PmK&EhoSEdWJpK5*R#l#4#o;+dRAY7h^9}ZY%IW^P7zJH|y5soV!|`J1S{Aa}S_;;(kfkpJ>o`c3z5=Y{AX)l4 zaHi36*aQxFf`IZUUTT*t|5mWtB}?B9j_$I$Wa&G>DW{XA?+2?7$37F^vh?HhJDn{36j;mt95|d~?Z(%_yZ}Xs@Dbi^+z%hhhpaffG*Uif z=>zC*!5a!$`XF%1>163V{HssM(kFm3^YDhkLx^%9%fsEAav)3RE# zO_shB9NlYi$kKO%Q%)yK=lA0}-}ApKkI(lWwf(k#zIPn{^kR#DnsuFrte7v-bDw!$ zrKjEEkmczKDb0%ylw$IyjeCPLOO5-0)rVx&?F&{PlBJi@|JPQREWJPdPA5yxfz^j( z=_A3J`z=ltSUHg884FepWa;DScWsfS^W0K7_~)53peqNm{0-FC;|+x@y#=g%$kN-u z%7-kygZ|IhvXG_o+%n~Kvh;P}{I#B^^Sn{}F|KmuKvvzYVC6uTzMcMMmIGP(PWqir zmd^7)^@)E@_%w92OP2p2SnZOfAEy5SYnLqjDE&?+OFs=(yJYDvg0<{Dus%w@3IT;I z4~BLSuCTWHfYYmtOTn4X8V{mpwK30;!iS7`?x*DcOuy5~(szKB16le$aJbImyhQ$j z@mn5uhZH_+dQW^PPqN~KVC6}c-i!V(;tho?y$?9$bh30F>y;;2dO0}5gC|NgKEg+g zCzCfAPsK;{rG!4J?p{F-@sfR!g%p6kKN zlPsP0k)o|u*T1LKn|`O0|&UkQUoAE^IYm6s@l^a=gr-GFmS^9MP zzhQOB(r41|bh7lhVC6=Zz6~61w>W#jnQt2J1E+TwAEoDSjZcuBev1B`re7etb#Xm* zsp-EnJp^mH$ZD7O>a|>C>3!(mWp&BYxs-=5H(xkKN(7j3-gw zZ9I+o-y6>am+VPcad^B=|AXmGU@Z$-p1EKx3t4(A{f}8)vh;TPolcg%46J1#OJ5Dn z{G-L$09FoUc{YKS16ewc>Cs-ROO_rV-<|Fs-}k_yb4arMJVuAEAL3)NJ0HI6SnTwp zUftv1=-ZY9Susz5Q%)yKe*vt1AWJ_B));#Y96oL_&x6$`WcgnQt53+%-=P1WtS(vl zTl71fES=A}DIcKd%GwpQ7SHF=J zGY3|`k)>DC-)1q%(wUF0+5OxmKv%z!<(~r1e9z+Wd^O|&9HkDgwBvTL?qQNucNKMa zj3!He6s(wWpB%QBrO?xkhk#3XqZ);*y4}F(ADEx{hewUacslb;A2Yp){6pgo`v1*% zDL8Z7IF9+OaUAnU#&OIO#&JyN;dhbgADh05eA4(a#{7x#)8O!w@geFzH7*5fJ(9It z{lQv~Wa$IJ(a)?dSvv0zr<_ifJ{+uVlPrBKIL(tOlxn<`16dxfcje%Zfl2iLht(y^ z&#{qmI$8QGuyP+V#iPBKn<9mVX6U?UJRh1K;q1#n}i} z4rF;YgOvkW`bqkKVRgyUPt)&ovh?%xpD{mK`s?&Noh-c*tl^91??(QW@%8vfzhvAO zA6hQ5>h=d`er=us_((fWQ-9g?96rL|7+2#%+ap6Cc^N^)42B(}(mcA6Ma|W{X z72wQ&;tgdzKGH4+UM7|7ux*(v|8{WrTfCw06fOLvF%R=%9s+N8)$~Ku|I3)0qWHAO zFM%Uo5TKCN78fJsbh31YR^O7PzX1+^hc_0S>xSoyyOaOhxEDA&pRnrofu3?YS$bcv z+9FGz0FEwL9I|xYBTYG-EPV=CamdnVfHSXHoY~;;55~=8*SCwo(d(v@Rd*>k<#e)i z-seoaD|{e2R-~B zW8RaD-b`3^&p}T)ohp9hC2i}MCOZak3XiT^IpCvBVc|1MB3oMdNs&_m(h{E6P3uzb*dR-v2@c<5?bd-arN+(R z67F14$nv*=)9*FU{ov@vgymTdJ>_(=^wnTpmyxA!0PC2(37omfV)AbX>HiD!|Blc; z=xN@hM0t{R`x_r5-)wx8Jka=rr$6WMiyogR-(r6LJ)dY$!pgH7^pw-d(tCilF38f0 z!5NoNZ*cfNi&;ia8&`m%Ov0)=1bWKpWa-1fYKttLf1fAgVveQ9tvj+j6T#_nYila~ zWya0m=+=bgZ-Jh2I$1jZR*!NZOJ5AmxN|f9t)8gDVv^-~7@TrCS^5UBj;CblTfyn9 z#n}xGbH@A|K4Si@o^Y_~hrlKLau0>9I49^CVxBYLXlTOnyaYYvbh7lbU@b3M`kUZz zgvIHGi+_zn{{MmD`%UldaX)Z+l<9-0f55m39P!~z6td!v1*e=&mOdV=e8|!#gVp~t z!J+%lM_Z^@S^N&_ZhKiw-Q{^dSpT;jSut19f1B0a0FK5aEYBwBDW{XAZvkt2CrjT6 z4u@Nuec-fX{$H-qhfF8Se;Ax{I$8Qru=;^4{S-LkV)nTfZMkFm0B|(c;*;ec1Wq}f zEWI48_+;so;EX$;Uqg1+DeJ&G*E$J~##vir)jbVPIh`#13|MWErC*@#j!k6gU3#G3 zsx5vGaOQU7USK_|Lzce}SkLN^rS}D^U9$86;EcOIO@qVn7Jno-x+7uvM?+6Joh*GU zSn164B!6~PcrI&)! zpD=$JIGUEQJOfzQ>163c=>Meo$CQDChvvh+#dXu8EAOP>NxIh`zh8d!12 z((AxFKOswR0_*&QEWHJMgFB`y14nmS4rF;&fKyH-UMf68dvp1-M=!f28WI(dpyI$8QQaLVaq={vzX7LcVs z2G;TDad4*AVjci1K3V=lV8tg(KMGcSvh)|hQJuvkOMe-haynW1D`52lS^9af#$l(o zA!fbBB+JtcoN_u@dQb2T|7+I~#o(~P>h|-v0vt7(PFCF^;FQzJ(uaeUCt3O!u#SCG zz~M(M=4^1(l(75_&{Iw)OK%1%K3V!=u+D9kf-@s6=344*f4dnR-DNsib+>?1PA5y> z23A{S>5qXk!z|8Tu7DfC+VLMZ{h)2`qT6~oh>kmc!geX=ZM>D|E59P0mRmJgZIR`f09IRM>67SpG0D=W(C>7z^x0sI2eR}Qu&z%#==ob)*JOE? zgOwXu`YNz;BTHXH|2$hRvh;QIJDn_j3t0O)vh>4XwM&+M6s&g1(vQ>cmYpp91pQ7Y zOMf1${(k|iw#f3l2v%EU=`YjYYRgEL{tEq0CriHwR{xWw2X99XEf%K>dA@NEu<{|x ze?3_Fkfj&X-)42m(tFeIbh7j`Sox5pj|8h-vh>klwM&*hhJJUxM3!DnzthRmr-Ick zS^7+{_DdmlbLnO->hUEqxChrQtN0gHJ6tbEAw9|9{Mvh*Y1Xt~uTOFu@x)5+4G2P+@4 zbbiMgK4@|Hy{gvHTVUlwmY?6ZDj%}+Zs2Hz#UV@YLBG?<())mw4_W#Eu==M09ImvO zm1MVmM|(V$yvjTiJ)S~#{XB#0;>-q@@PTU-vf6D1XPjp)Sj$e9rxmPaCrfXq|Ff0@ zS^6USolcg%44heQ{^ek`MV4n3SZ$G|uc7}Tt4o%?j((?;rEdbOt<7MyMV4m^SZ$G| zZ=-*WwMCY`gMO!zrSp4dty8k}gJ7-GW8m;}7L(sWr` zkfrmqDdlvsbe=*fH?s6Mz{;%?!fBjz11lf0{5`0gI86tZ;Q{!2NXEPVo4Igq9Ekf0oRX{sE^^6+v_ zIgq9E@+SHM-cZQWdAgr+I$1go8_Iz!eGNGMFy2tOI+X)i9?n({Wa%5||03Q{$kI1~ zQ%)yK-vL$*Wa*EC)erl?%7HA;lVIgQmi{#T>+yy{mVOYNaynW1vtZ>wmi`<#vkY%2 z__`o}?njn~$KUjq%+uH7GV(^#d7Ra6rOB#02CU^GORolNxyaIaT#mkMG0D;=(eHG! z^x0r77g>5UIO0k`Axm!or<_if&SSUYkfm>@?*4`hS^92p`YRTn&y{Hz$?`l7)-sZ% z@2CGJ>=;nU(w_qBZ>o@`9|h~&m@NGSIOEn!{2Wvl2q>352j%qBn5VitMn{`1f3oy5 z;FQzJ(q9Fuf5_5#o~C6dOYa5NvXiBAEJcr6yJYEo>32F=`arPSB}<=3{abdNB}<>~ z>164%!O`DXyJYDN;FQzJ(&O>7#r&6zAE&o?{$*h0NmiWo)ZK5I$kHDLtKZ1dw}RDg zWa-<%>91KnJHXM_gyq=_(=^!;FsAF}iV;LO)8&OvarEn#^MLr*!KES+Od%S)Di zJy^>{mR=0ja*?I?rhmJ&OO_td?{u>C0bsRDmY$>jO&bqn=_A4EZ(97(VC6=ZXAD@m zk)>DD&mA@jS^5NU%IRe3@z`^J=df_>W&YOUG{LVN$f`S+G2M1bmfi*qcUs*JaP)Tx z%d?nuolcg%3aq{&OWy(xcUhc6;PkhQ4}+B(S^lG7SX(ow|AX-ou=Xuv z)#Z7zbpM>0=fm2!_~*v!p=;klR-BFWyL|{*`eyo_PL{q0tbQX)-w)RMB1?Y?to22f zet`bRY#GVY`P^p8>163VPgcABIWvc8nkO$PJ@E>8!op9yln+^Pxc^r^Wa)kA|7WX9 zmL4Aqoc@;_3o1}Iv)|$j2Zv7>kM(#wShTZ>OP>YK z{EPV;!0D%qxh;o|TfxeKth()BbmcD`h?^<25^iA|Toh*GjSmT5&eLq<3lBGWdR=Z^B2f)z*YnLqj5IE&@vh-)c zYL_hiIk3h<2u|}v7^N5ad&UF6;UVKR`TNE>vh#2}D1WlzPX;T0vUH9I-FqZUpHBY- zyrGb#H-VKuS^9Et=CI|{9~>Sr9^^6eRBmL|tpqDKvUDB?qaRotvUDB?Q%?7fiCkXg z<}dq9=;2X|Q%8^cdx>PlK?hsji9{Y3-MwY%296oPxwt>?>H{MR& z@ouo{l2w=YdBPXW&tqBm3**D&GsY*t(JvEL-BZw0PA5x$4y>_Fmd@WDgfCj0bL3wc zzYfm4Wc()eUmJJBhnV+X!k10&P5zB>fAU%5G(OaCWVJhzp8qt@7>~z;_5Vtc<)2K? zD|kbhijRz|JA?XfO>e+Q`c>m5>i=cj=J8T+^qT2p#a{+aIh`zh1vv9NyrHbchx&?_ z)8g&m=$v`Ts=E`MaynW1Zm`w`Svn7y;eX=|6_YHTn}_;} zLnr-vyrFQlg%^xp#Yg53#*{+mc@vy|-Ske_m8Ab@+@0+79^{Lr^S9NZ;|N^xZM>n7 zmCpcr+`1b?{*%=$2P@B!;OGt0$*MaVoN_u@`WUd5oh*GaSnFsiSn+3pqyMq^WclmB zDW{XAH-QzOEPWAmcfL)Qem^*5=b@}3KWEHGIWs>t=I^GpUm~k6e>biD5?MMQPl^85 z>XN0$zoB;eWxt`m8%C5po_`-$$EN*Y=4)fdI$8Qju&%+$ z(z|p)pKySqbO$R3vOGP(%7H9B{y#o;Sl!G1j}NE&|Hnr^)Xn_a{DZ)1m%oozyJW@B zfz>WqdL{iXK3V!m`khXe&i~6p%TAU)6|DZB238Jad1io>16ewM9~}nhNR;^Z(M1W% z)6BX~Cre)h))*#BUjbG=tI3@#CVw9tbxv4*{ysY8bpN-~n^?Dt`5*P->;&ujk*qlT zJe@54X|S#<$Ibs)b6_p|d9cmYpp9E&82Kmfn-UQ*hfRS$YK4y5MhElml6wGO%(WOCLbL`#+M%(g)G+bh7jz zU~Lz}$!@)m1gl-L{G-8Ymn@zC7k1RmmYpn}zmZ8foh*GCSlb0z`Yf>8B}=aZt6j46 zCi<_jcFEG`((iP#^d(@mOP0O@tUl+pQh2S!akZw7}v zNTRfOyd13MCCk4GtmP$3=e2Egoy8$bUq`>w$Ak_q zhb%p!|7{kBEWIE7PA5xGgOv|i`bcniy~U~WxEic$AF}+D!0ES}e+pPRljWHPR?cMU zGwA0D5eixQEU>O4$kKTor!hm8z6hLgIWGl=H&{MgkGkga*D2Rm+IhH+lrvc|*MpTa zS^7r$-LaJ{eKY+|CrjTB&hSJGWhY)GJm5Q)XD_D1V$=7LON163Ifi)h;($9l4y)DiKuyP>Fa}lf@$kN}W|D9HsEIq*WOUmhF z>GAzickkN2U&?1EltU>v-N$0~2kY9OtT<_UT+S6>*y$D%S)ENgMO!zr9TeV7$ZwBMt`N>ZE<>g z+y|_D$ny6ED<87-QgGDI;*h2H2dA7)mYxGEAF}k(;P5>bXFNUbnu073@42O&XDV2E zlI58WR-R<(GwCn2_+;s`!6~PcrMH2#zR1!SgEOw*mVlK5S)TjB%7HAM`@`tHmV>`< zTt&ar$?~rUtFOq?fkFC4i*r3aPb4f)zPCI`ZkaynW5O0fE$EWL`l`zBaLVaq zwZ(C$+{n^bQNI%#Itp3(MsPUT;%^}jG2RBw8OS^94Jhgw~-^vCFT zI$8RDaHi7yPlDAJS)QlCYKttL$K`04)g?w&^zEkiBi~_M<}veEKa0`kur<0{m1FN6O z(r1CA4_h3vboN!s>1630VErzMEPWX`oM>@YfVC`Sc~*n9EM)0x>Hmn;B};#pey5YA zKMK~ekfm=2XC_&k9bn}^mS-1OIgq9Aq5q>+mn?lR{Z1!KKLAz^Wa&r2nU7hV3*c~y z@kMaj@f)7r4ZDEw@tenY;SqxUrWa+)>pK5i<(j)qvPL@6hocVholchi99aE8mVOqjcFEFT1*=`M^mFvjw06nTFVOFFvh*&U(C&QmlclG@YL_g% z0<3n)(udGL%i@rw52xShWa;C<>T|O6+2C}I#c8IeJz;q^(=*%jt>Db3jQN<9awf~q zTcXODES-*nM!cbrrEdYJ zoKBX$8?62$OWzOH|1(9F{uEgM&lFkuF|fuqS^A4${eQk>=`Vxz|M`-oUjS>l$kN{g zXC~tfh2LN3cofWQoLAp=Ur^rO*iu{G(YUyyd|q8+Lr2Skngt75YU*3&FKDc3o!>F1 z>As-<;=rGGS7S#_{lfP4#@3FSc^wObxOU!AKc}s^vAw2tVMlXKV{3i;eQg~zhIkK`&IMd!l6;x=d|ACyy|e*opC?;3&cF?7B)3CwzE!Cdt+nG zf|mK0=DDD8!GbySTjP8?u)xTme*V09SZ{@qnitf}Sy0o~KEDmCuBpBDuGpj;<~5-5 zoJ%Tc7Sm{InR8b&ddhVfN7jPIB$IlKl6b7u%x`MqjLUl}9(L`GZ7sF;S+e==M$^sn zYU`cqt@L>L=XA`gU2u1e-&#Xs-NL)DBv@Khx+G^-QD4tT&)Ax-pWoWrSbvGpU$}*B z4YijHzy%$(9Saxu2|{V_Sa5~K;yCHxV617Ik9->2VY>3>=32Sbdf9-ocyn6+(r{OC zvL6=QTiaIC*fzhunK{i_P`{|WwxgqcPTj(e#$@4QCziJnJB5z+pnPI^{Bh-F;IeXS zf$z$O`sT*^yDzt}k+#})>~7i{>*u#~yQ*zK6s-je0fb)ImKWTBnwKap&vvfz*2cTA z*Q)Knz`t4|woh4v_3?k0+L1-g|BHuvLYH*o;x_Ct7*BaKDH?2NR5P!3alB>Kv@~Ao zN%n2`w%4{TY_p9STV%XJHO+6IcUj1J^BWprn?KL* z)}j`ry>VVG_5|4BwAJ3%G9Mj;A%^Xv_OABYc~|Rg_Cei!97DB>YUi|E&F1d|;*sJT znLwS}+TBbXn;Oe+pY(|gHoyA2^Ie3|(u5QjH2X@t3n`HO9R&_5SJ-^x?fTL~kDrsj zo-OuY=C#eh?d^l|mX<~HYHAxAFc^_U(&v779Y?XlznVpdQd(5iUqoL|_Q-P*GdhlI zYQdZ(jrjoBA$M>9)+}jkpC8X?oHuX&qQA9liAqOp9X{`y7k|d5F6G$~ zBiva`c|zIYc`>2vu)LU1wlXg!lpUHE6Uq(Ai`fJd$_-BDCzwz!m&{MlqiizY!@QWQ z$YVCaL>n=Ea0^L-S%b!Gv-{lKBZHlpCDPPcWfeE}5U8N7-b)hj}qqk;iO;i8f-edMBam z@VuB%c356aC|j8q6Uq(Ei`fJd$_+{8Czw!fa56u^gmSrLeu5rllldOz#au-mvk4~J zh+Mu)@{}E($Aq%O@?t{S%Dk9RZfIW2CYVreNHRacgmQzE`3WYJ%O&#@^eCIm_b@N! zD)N|3FwsV2^Iejs?C?A$lpU5A6UtWR#e{N0^I|r^gmOcY`3WYJ8=TBfFri#7nV+Cf z$^5K`TF_iYB6^tLvEXbiTb@`(RH$M?+2MIHq3p1{m{7JdFD8^5nisPPCX^eJ%ug_( z+~8z>f(hkv$@~O8$|mzY%!|2-JZ598D2?yg|0Qp~=o#>>^cfG2JLlv5xW}dOj$vLuEhJd+j>G528~7dk4G+v@JpAeG zd_4Y^z|Zd$ObqurRPjDjkl&f_1_A%JKI7p}Bj@As?}7XA%8>lyY|s_OdjguDUzfx9 z{UaU@V?6vx)_lCL7Q{P+PUYYAR#Ci-1@Rs`iT__Tw0QV4kNJ3iThM>6_QLO`uh4(n z3i_|**Fi8FahMK2>6_fit_s|^7ei0@bNo(75Sco&+nIGXqUfv zW4pz8aULwef8yoGyNEHrmNQ*Zyq7TT#~XhZ|9=EJnDMaa`FK4M%#XLCuZ=$!EReK8-BdfcLza}g5gv7eI7nPUiUu)!D-BAygqnw9+&s~c=_>G zAs(M)P*J=C5d3&&5Rc!DGG657F&@7c_2Y%_!EY3yt0>;R@cHqk|0xJ6U}8LUQ9i$a zD;Nh2h)17_;vIp{kGC4}xIbV#J`<(o9f1mdej5;P6mn5fJU&C<$9op>CSsdoyi&Xr z?+*pb`)nEh{<4DMQ}NCfEN|aGW1Jun#zU2SyqmG@`}wuri2tkW3h~O|^Yg1fEv?`F zUc5gRY?lFMzIBD=Jzub0b}uRlMxhPnH^7VcSi$&v>t_2chf>t?eyd>ojl}?Ofr;@3 zdhv!8HM=2OS6)#ti-(!fU^*hLm_w$1Mb|7Bc72=&P$nPTJ?Szl{rM-AJ6znH^ z-(u@uA(h`o2>yDjgzu#*^z#>8>?#*vYxkmHYjH7XG~#ibsAxHU4IlmmRc^*~#A7~;$M63+kJG7wex8hYdpXk; z#p_+r&kcz861G*w8;Y0W@!20gzfQRzn4)0#R6PFIUw(e$Q$@jI%xAn|cq!fw(f5A5 zsfc%_{l;PV{CEctkNZc)8{x&{Pa6DqD-e&*@u?`k8w%o`M!Yv+V!Zd`rTm^mFh3ry zj^e*FQW%f_{jHzh$-YJT{p1I{c%LrlzvYNmtYG+5exE7WzifbS(-nM63idBu-dz;$ z$GIF;cxgHQ24mM>j`WZqxOjzl{694O<(Q6mE$}hk7%$%Zf^pR!gJc#@3|!H2%qx-GpZvtM5SA&hykGBYoy{cgN zRJR@w(iO?Htp~`SFe*-t$+8R}bGM z{fBs4UH|cXNAU*ZoWYN`9i6-43h~O}^W$y!NKtSAKK9=j9r1uYY~AeKdLT?nCGK{dXAg z#$djR^6P-fk5_?s<6&Zc&3Gxlj}^r0{>dwEzpDz?TOar?s8M{X-3JQR+hVlKb9uIV zx7Y5I(ER1-iH&0C72^F9eExFmZY&BOhL7>)dGU5)|Ki7c9Pz3!Uj<>}@(uX>c%$$z zy82~49O@VTxfVa(1;p#dnXV|_S%4pJ1>!C3Zu#8JJ(kL_iO zjqwqeJ3nJF++>^+W4;bE{Ty>Fe+6HIVf@Z{d>wH8qFK+t=NEcdu0v4l^4n}G2Qz-{;#$=wLif3^*63L?{Ds9bXibbX(TrfpPCd z26th3i*D$4yzJP3qZ5uyIy~jj=!Ys-?^@A$+{$ZLRu5jYqpD=#8*hK4+kq~FyZofn zfDPTp?s=%_nen$>`@kdjb{$o;^?}>xEd1iQlCE9P)z97+Tz^gd>^}x2T~`Dvs}HUm zz3R(o@i)uR{x5G_JNDWe_w>K^!SBB-=zRFv;K9SU1fBnNM6j*vk3N5}TirE3TlbUC z_dIZ8S^uK*Rdr)ej2&~w-aE=Bbgf;!?9%L>d?@!&`I5Ma_xQA z`G`foEa^J7t3O?~@_}(`ujrY=3|EdTTY0Ibp1tp$Zl}sl4mdI4**z-;t?03`q+8G_ ziS$U<16?`~ICSlU1G@C+eACz-gCBalQ`uK;Ec-!lL-o;>%QqJNQghbCHK9DSYsG+- zdncDoT|c$co#W6u58m_;`um~afoG20_Rs?*uXCLgRj*mOvRe7>Lc3V@PMR*-I^v#g zFO)q$;JFE>C!Lyda@vU*&z3*5Yvqll*SNlU;F-NEI`8P(qv&9z_3iBXGaG}!-8NJ` z(yg>p{p?f0lMi+N{>p1hI4Z9Dey8%UcE0Ju!RqgIzUjK4WZKH2N2YZxD*5Ef;KpU! zgKsQ*DY)^0lfgG0I21gHn4P~lu1Cq5u|c-_1efrc^ONhQo|ro3&b@b*%~(I9)2H5x zWqM>y|DwTNrry@keZtC9E6co5)IR=^PjoMO;Fl$zSRLHB8qrsGDJtpux!{>`L%L_H z@3_6}K;^;mLnl`5Sas^Nr&i~e_?PYDUL1E@*ZPOQ85E8CLDw6%J`ogcea9yTbuHSO ztf5KAryMI^^Xr8rtGk{ndghU?Skg25f(LKv+5`Qu{K0YEiaJ;KF51@h+yD9f;E|QL zbZT5&|M0$`XzU{^$6z#f!e}lIN**dJdhk#gMtCkLyXM=?KMhviey~ejw{h!AIv?or z?dIM^CEdFZ9NeX$)1VCxR`&`z-`*wYT-`r-aO{v^TeqLB8`JH@F5}jHVqN{RBf%rD zzcc7M_JP|Uc(G_JYMmRCU+?GdsGGob&rw^l`r4vrs%OSaKk2~egO!Iit~&bJqsg*A zGidc3ZXeIqhda4`yLUZXv~|k3`fzB`l$A$UPRjT0pw;M;>4Ums{5*5p4c!ix9U8Ra zy@`e{Fug zO>Zrj?v_6!U00Cb+v57W@_w7%Q83+6F#S})^y>xF{4JrCw-vPa_P9Me{?YOF;AZq+ zQf?@iF3I2P#Gw=SFFIdxuFvE3r(IjT$6Ac_oo^b`oPQiI7Uo=x_49;h;QZfkrYoF| z3g)|?a|gU{UyN@|1{cgv#+tRa)y?O<+~VME@wJ8@|9WqE+1`uJUkNTof4or;AE!$} z$&D6)JlHTk&r0*81!W{&8Jw@PaI*|)M45<}nAc<_H&MOx@4Ij;rk%eJxa4L!>^lLq zH4xKjoI|qY@CtG7fn_*eV)g_7Pgs_?U7UBbOv5YV^ts>?216k$emhw4mw@FV%d_0` ztfmLoJ1k^*9tQI|m*sK1Bx9HJ~FQEX>duo>15@02ApOiD6in9wl08G_ab%N-(%^7JWFm(SaG<`%Fo|1 zi|I_i$NU^FCA=|?LRMX-D4i^wU8(g;mYzJJYQIgx4R)ZdL~ zVDD;dt>Ik!=q>)GL}BIs?>}t2!f&qp2X9@w@h`00Pp2;bMUI#273voJJ|@4E_|Z&x z!S5t4{k?%=UH+iI_gg^yjBG*e)t~%#3vt;G0Mvlj!R_<;iz2`GuV9Lw{w?hKIjv3e z?XmCw>v?>a%2l6s_gmAV@wY5N|AzPhVyl0}XNW6GF{=KuG7QHOTsY)NgkTv@Lk4 zC|(;(emwqP-cw;>JRa5*?+DnBcLvi>;iaN@--F=CJAimEL1R4JF388@F2;}dC?>ey zQc=8jLh$2l$MJ6kG{)nhkn^~_h4-#<2*7=iisDU#=Eob@!;V*s$HSW9ZHAB4wcbXf zb9r8&qIh2_h{ylu`4~)$$NQy<_k2OTDVR~IVE9zLpBBX1iKMhXcvw`t`@u}70xy=; zn9*PuzjGd6Z@SM|#2fGH`h^~rf5Z!m*cMOVjlSD8flv9^r~W-3j(Zj^FN=I1!~$uV zsPpeSmZAa9FT;yz{6ECK4|r6?xj#N9yJxcr2_#v9;GcHMCNV^aAp!hT^(L4NA^a&| zf`SMnn}tLJi6o(7wM|Giuz`57OQ=w7BmWAi(iQ|-ytV`h0!6D{LzQpq1zWu6&w8m> ztlCaX9MO(Mbbm@-=vIlh zkU!zD*3GG6eeCCJUqQ1c1Zhp_Vnj386q;hlIO(tK&B8xV2^9R5T_|kz_a(NRYxVah zQZ0@t{fWG$^TP(#WKpNKa;`IvlpfAOpIGhlxC*XG!|L6_j*K{$FWu?#A(Eu^>VB-y zM_FlEuWG&4_g3V~nzg}y%5UAFh*H)p3xR)^*6qj$yR_ccj1w;1&X@HD-3hxKnI~LU zZijyi(|TKqwC;+gh*M9}x={v^0V}+2NL6QCCF2IIJfu$M;&Mwx*wmZ#kSP_z8*c+TloO6cg?9W$uRL zwn~~z(uY=N#>G?n(4$Gw`V^WRVC5`4IgnJ&Zo>HX;2pfsP4in$Xm4mz`=Rzb)*M+= zyf&uQ(49}CN7n%}+^v8*|3Us+rF zn5aLk^n0Z-)AR}}`XWo_tEguD(^MmRt|M@E2aDGa!iGgcI?L&D7orV*uK8APh5Y$l zJJ{X=>S5AX>wa`Oo*o@}l|H+*O;E^gyE28A!W`gW#kfr<+S=IPJh8am?Uq4T%lQPb@RZO?7~+nPc1ol|MBI=Yz9_W>EZj=YQ0O=URzKZdK>z4x_yom4-7ez zoq-L{X=>c{qiL1XU!OjC#@-nefgP-uDv#dUL4CBRBYU0I{?~1bi#X`F&#;5wEYjv= z$?m(iV%I|E5=+Ca&rO(!Xnoz5y8QyggSW0nSL z-PX71CssFS6+(IeOUi`&l@=mRoKWbw+oeVBZf9?l`kX&!+nnc^PyY+sruX7}RdVs_ zO2X85ht9@r+W*h1R5=-eFZ0V|zSWd!RR7;`0B zz1#xR=;Y-rEK7=_z1W=?A$BL^h%X||aaP^9?-1Xe&S)!5Gn3d^!ah@~K-42?M@cfr z3q7vf+=Rmcocu(IT=Fs27Sdk_`rPsXLWolDx5s!0zQ%?*TK8I%MG2IIeL_j(P<)2R z$t$^Qpr1e#W|fIKqlRX!k=6`F^7-=G58oxq2C3|)sKfMxsLofxos5}Om%AXLyrtJ& z=su1)HX%6}arR%O!xCGPti~)YW1n|>f+o#xqGs_8^Xoa9ebx3;J9EoLzRt29r`8>D zb>B^Y3+@@1U-q5&TwZPa1da@6g2g5IH@-CZ8Qj-!`LgkSEIv8-pj}8yKw5$?3!iL! z#yS%)i%R>8J>jgW!XI($IN^{{oKx$aY0Jd1BTm=OkvGFe*c|NI?KDam_Y1DE@9)_i zgZxh94@PwTSJKShy&F^wTKG%#L4Tm5R>{`waZWwxap}Lxly><%p(1+i`Di|DQ^Gbsz7rrODK)FjgRw9}6Uv zfvY%Y&qm({C!^Y{PwIYO>`wSxjvak&N~=EUi*>O#V0B>^Htb{@3+b<8w{CFR;veVN zm%O*KaH+@D{!ygOH8SG*@#WGr*WMXee2L|keZus$+F{!Bdt6VBg%9z^IAhKZ>q3`M zuXESS0mKK!6(5AviL|?z z;!!dO|9hQ7L2;;>2h@jx#!&q46g*TH30qKIWJv<~oYf^365p~4zzasUN5Ax4M@H&+ zD+kSSgWcJdrRQ2RAADHJCS|u373PG++Mp+_+1jg)R$B4?tStL5SoUxhNoXTO8yF-R1CC>&&j7d=h&H`xAq}(d=Rjs&XOev0 zKp%7!klp4O<7a!?N<&uJ9;t;_Zq-S&YNze}79F-co4r%XVu-oi=iCpkbsPU1OW%E& z`xCHtzdx1vhVG9C9=jhp&_~~NO0VtB?OWZP&_Amme_xyR+Un+{*UDZS**_iFH*)__ z{LQ9vV_&X+dBSU=rlhyZ-b(m`wbmx@!CZ$Q-qY67JADC1Exkzvj^cKvy^~eo@atyW zg0H%??&Afp`P|E}^{NMFDhhHjALa@Tgr8cZ%7$k4`sE^zS$p^N1vw!xe{1K)7U;!3 zc&b9jtkL&qSqtpGqaRl6EbLMLdDx3SmSgvf*1NW#H6w&`2CW%=#$P&f;K=Y}MXD9? zb@2DF*ABV8yt?_R@O1ng`xfp0`(vYhIEoWsr1$29_q6H$pW9lj_4?9vmQdjA^`&KK zExkGI>-{a~+{d(TcY)UHwDVyGJlo=jhQZcg&cK=%ISykjE3M(j{-GYd0pHd|qipW& zj?7KBZ|F6B@p~+OvM?I<-{VW~yN9P-`tG)z{kPF~pGMk{@bWCQ;!3U7vBIQPraVe% zU3(~u6$osZ1Jc^lfmt2V1Nuu*4?01k^`dv;$uBehzZhta$NR-U{yRK~F9M7AW4$kW z3?3Hp`_eYXpO)fKW;x7i52F2-F2B-6>o(p0irrhjbfaA6gdy_j39ZzK62z0l5G}y} zoU2xFWsN|{H6AtsXMNgGvwhdJv~#4{nb!C6TB7u@eafj9ae^?~;|QGXW6u;oPj={c zBQ~?cf44<(SAj1}pXix&5U=F+Og%1v<&9^a6AxwbDC>#N$S zbgt-#{+E{PiUS1)Se&sI8)f{}xGpL zJ+da2ZTbF_cVeb?BUlbw~n= znb2G@!q3e_Y^+pZ%toT5C?&5CtOz6Ke5^2KKK39!5?!|kbqha(Rtb`IIT!NJykgy= zlw7yrX`ohL7I_pt?|wJ^)!~~O-_rNHeVIDlOUJ!Tx`(-Pm=zb=-AO*k7pcoSh0nle z#XXYUp?I+zEf(_7{1zo&_H#qE?(DEgi|A1?-@0y!%lYjn#o%qXjLtb zAiJ$K-9HSmM>GBxXx`2w|1%`M!($vOJc{Xm$i+-6_Xf?1IUVZ@DH`5VbICqo?1gY3C9OlASH*TBiE4rVg1o$h?F3b=c}=I-8q-`sn}Z z_}>?A_NgGqwAv{ibL>KUoG5>dG$1N`1{zSsgb5j!;*`WgMo{EtOK^1$A)>#{ndHN zLG6g6*u@?l;aT~~u+HMZ*<&o;W#!64Wd0P|)!GMFC)M-GCFFQK$nzWoC5qnf?OI<* z-b_!3W@Up5qh8NS%8hylP<(YB>U6nS#P!ML$S0o+OPmr|{5$6PekQY4zmvW{^3Fj0 zkHN{LO^%FXmkl0Jm#6*GWx;1;M5Z03+q-Gw{*8jAe?&2oxyLS)jg)h1UlbZ)TZc8utU^Fo-R=^w;UUw^b8#KTiL&G|EG^ zHOSDYENB|%QLJ3BS~1rx+L7S}t;gC~%R3JL2%MS^B=z(01Rs|6kgR$zW)~n5(9G8t zv=*4OW^a2=yI3b_y@N&VZw(&^=e6~;we%)W<7b{%H>dhDrUlOKwqxq4#iBi_&cN9k z?RbHYZAUCNoo%E4``cKg9MK@{IkrvP&XS$`LN$fQ3-S;A652>BsC^F~U;)-|M`S(l zT>@u&*r_6l1^I9;E)v3?FHXN(?ZN#R+;iZb9ZkM43$ zMcS@eiHI6ZM<33yXT&)hsjb?%3uW0`B11km$`-azsS9PJTSx{M%6w?~Gi8a+mfnj} zTo)xa?z%_jn_9b#y@9%pn$q%wuEEN$2l8}6LL`svET=6zggA8Ua1J3%T(|yaW2}cf z`}!u0+f=j@d~F^=oW1^oKa}qaH5nr~JY->4WJnNHAJ#5>Y3+`_wpd>b`taDs*hqX8 zcJhy+FSf_dwKdCVdGEp>1e<)`8g1WxeDt3ohN3TC);Vxz#$SQ)*S9ftZWov9ezeuE zd7K&O|9HgZj$;2;mg|?x#?gP&WoT9mWCkvu!AkjJnRdjZSJ}~1u?J52F2}KGe_3d* z9LFDQBv91uKwDm0c1K<~fcbe}{6>tlee1FdvBG!K{P;ZVa2!L+bA4&(t!bmshxco( z*yVN<^Cwk2&~;z>A@-MR8<{- z?kJw8w-(pvY5I)LNa*>`F+aM>AL}fh-RbkjyTB2m?(wd`*?w@j86|e3#4q*9`c~xM zSA%_&xD$Gy8T^OVeI8gmQKPuII0fMI_P9s_*7$Q|#JlA6E2SYufxB`J>pO9vb$1#2 z2&w+S#qE$BwO8!M$u>mmHKLbT3j~`sbJ-py+19XD|2)WYDr+rX#nSX6I$GHITIY;T zUv`hn;SV!k0{$=B47oAKwuBB>U~!1OcTM2zIu>#6#@(LSogv{{25@ePyi-qH8OBfM zM)YQ=qad!>=!wI9sLhGmhC?#x%(F4XX0Oi=WfuktLhvwN!>UnU9izA6Ne1%DIBhfK zKi`yG9BG4o6!f7DV?gy5P>n+yMxhOmJ@Wh|mG{={&bVS<79@?@9sa4vH;;{qi=>9& zt?X;hF7#y{LfQe;KO3uK5m)x5_u#~ZBl9Hs#F9D2{ywGZ$&?{b;H$>rni@#y)tJgO6cqS*M?3B1DlWIEu$GQ=5W_ zH-po}xRzc+Vn*b|;%hKo9T_KG*@mM1( z5Q!KN0i_oAMU@@gGwSon?dSYiR@prN6BTtIjK{9)WgZ1@;LPm%(A2<&iCRKYqS1d2 z_|aL0{10F!`S5+P2CnA&^12dwiweXl3cj4*>QS{;Iig=GMf53}?@OPc$VV-0c!Xo9 z-Qx7w;L`Drkz3YMq^@|azNOJ%*jA%wTcNjH+e-@m><<)Ryk-;)?er%crMb^q8Co7^ zLXk2W(4&KK+%#5$j)UH;{kA0+vL?@Xuu>Ug)pk-VEFM-j59G&c6Zz%?DAq(=zswN( zgvtKajJCvi#lD=Q*f-ifl-AIQ@=3m_;0pR}?z=}^V=`5)L|RRzEOU$3fx74|3@|6_ z3Ag(H1Y6S5D|VS^U$oVaojU9_we)69x3q}v^L?iNTuNL?_;~+oxcSy_5@ZU@C@U_%)KDwk6(j0eX*r2=bI24 zSWI)r>QYbWB-Rw$nWw))i}ZIe&*^xLJdJJaB&Zw$mHC=`L2^9Nn1hpL7L5RQr(^ut zTTmYB$L*}TD59TF#@fy~$M$D%8q8T+t{h9iZzd?oae|q{0U}KTOU?d8qzUgZ~mdCoEQyJ_gR&8MNRe zTF}FiDBKp;aUzgM237xU{8w&o0 z8uZPlsw2MxpQm-r7t@3OejmJ@0dH7m^kao?w6w=;>E~=T=zq>Bl{<$SD=jle9PL64 z6C;>nKzp}DI^tsjSb+Ju=kXQjVnkul|KMR*ORop~Sv^iU2GiZH(#J8rPOh12?;*pU z`qdF;%~zV_5AbuVdvMCR1U@%;+?eqfXy@|6Zj3h_-fhI`x=3fJjZ^9H-I5B=ucR|z zILmR7-ab%LNYSmqxY|F1xO!zxsm;}Bf1rN1J@;7=veCt(ONI3m>ljbdiOZa)09Lz> zzTK>~@0VCphY{1<%+mA|oh1wS3LxT|dO8381I+zq$(!!q;|xSh;B2uL={SM8Y;ODO z_K2Z5R_yl+izIsmA_nhXFt)_)uRT2WXzfv)Be2i@aL;eI;eFnhnm@7Ij_Ev_n*S|$ zr1p6<)2Dbbf87{u?v{LgS|Rojo#g)~Ex5Lzx+tNzHPbbu_4pciQ7(taotyjmnzYBP z-X`x0>sF^FgP&lv5bvxm^2A;3+^64A=o{LX5U7U-hS4ilFnsi$>~b8_+4+^8a4Ms` z+mP4jv9nmSVie2yjZwTgAG!EC!diQ`V!h>O3PpR zDOP81J?0zxhTE6(oV(Tk9$NPqD4amaw^$@*s)|eVSv+7_D{6E!q)x zr5n_+PTvWvD45jNsS`IsU@YDl~ zXOBykncf9ZiX9^HE&%8i^3mzsc<7LCY|${X7PLN|x%to1{8?K>F>yNcVrdHb;=Ym3 zx#h@Amc5$74mfDmXtZi4YL+iC*qHU-C;M*jVQ?Pu@n9s>f0b1is3lZmt)tw<`NY9b z5|M8qb86AavQP1dZzc9w9Pv$fh2q=b=XXRc^68zyTB%patwh8oRb3%sm%+t`ia2l0 zgTBn<6kmEviZAW)6rXpr$Cooc**CT@*_S;#*_Tz3?8|&G8R^N`DQwGW>sfabo>cM- z8N$RVcz6}&?gA_Xp6P*>FtHaWryj&PZp;cy#0#TR&F6t+n`u$Dr0dbWpS5~>Qyk#9 zHN7y!F-A*i9n+ia$Zkn)%`QxK+@K}5-q4%m7~7Imj_9JVZ5`Xz_5-G!b@W}Mh5eqU zzG1rV3q6mwef)&!(>;1pl4Y+giAG$_cig_z*Ymv7_snmcz5Z?O>oni@f5LoQ)@dF+ zcBk)|{}b=q^OJaA_wxz9?+r=tgdRws9l%kx7ewdKEvi|tfh@`5KhD3+@ib10)4ho6 zK|DFM(AIYC+*5uU0luxMYcuNH^E~1aZQ$D1{S%C{L-u^xx?>viJ@XTLb}~xs`i+a$ zYppwmAeOU(oy02D;=#A|8*#qvL)^Zd&%0r%adzW*?A6nL6Q_NqBan0myChbAOA@|k zp10=!AL#qG-fPoAj9Hm)v%`*Zo#B*`zopcAwu{cpXhohaSF_SBC)--fsL1$UN)Y6vHrK70;02Ah{s4L%f%^k zjCaKMu>!in>6z9Hv2wD`Dpn6zAwhCO2d+x3{TQl0Z^==2)aPT2p-E!2)QmbSd(E^N*0bK|KooQi$4Tssm*B=-P% z#l`TP);l~e?PaDKD-vr(rFBoV&!|2+LOb$gsb|eGcBnnD;UH@*k7X^rmKR24!68-v z2hB6BTK9gxrBPp`w)Bp)&gLfl7`s6(lfU!EZj~rAamqpSY|W!rX)ik7dB>xTTS zMSRqA8x$A7N;)9&YUkoZTkVpA#a3|6#pVCLOh3bKX<<)jF#7&Vi9S3@fn@(thc*3Y z>fW)L&S=Q-E1V>N3@8>z?e}?i!wdMbCzP_WYkGj~UALz#Uq1j3fOcvf83|6u2}IzJ z4#zX2>CB_|;p}U3j5sMAIQtFFlNx6E%R($a^o_#6;vHI=Ge4NFk#7)lH1ny@jJROo z1CfMrEE2z?`_XG~;_>P1Bl)4*3Ii9PWi#6xeR1%_DGu-1q-(P~^Y7o!BEzv3ddsPW zr86nnYajPlhAfRf-ENJMllHSn;8vrx1dW1o&F6>LlpE_{{qxIBn`s176eR%>9*PA8 zHtg53W*B$SNrSp=|H{}gp(NB`4;WXW<0V_q~@%+;=b<9mTzhbmk z&*}1w&|?PjMy1NPcB(vi;WZ)mya(G)Z+&Cu>nC4*<(1b@oj!Tyc=o!iLg!Sqg+#@F zH0&4N5cV@!Yx)o;Uq@L_DjYOz;Z3%ubfuJyr;eZUbq{xVVwv;MvDQB5e8z7aEd%0M z2LFdT<(g4z#MxF|P2Po5oK21BZTI6&jEG?4-D*yc9=gAla@xD-)hvQloYg~)tRb2s z^EZyx>xUTaK^dK|>z$)phqf5s^;1bXC_8rAO2~IdTX#THd7ZF41 zg&#?8ZX38WLhZYBh)P-XOparNz^Nu(pm}XKu9Ww@Mqm{v!4IE4H=4p3|L@ z&)hwOeEQ+=*@wfY9}b^B6+XQOKD`G%y$3$M2R^+A=^mteeBP(w^Zz_~MYwp~k?KTw14nX82Wn1UmE&w4R-MSzN}}Fzs>e^$#!SMGH;B!)3XlGs5{}?EXM4B8U~Zn z`Ls?@U3hZuI!k}jPC1IE4v#qhoah_c36FhhN~W~`D@%By&nS!DOS5A@s-MVndM)fMieS-pU~nHx@e5=N8EJEbx!D=_SIXiGTFKX_59eq|o@GRPns8NZ*)_ z_kZGiF{Qs_Yq&_?j&v?HnSSfIB1EXuP6akR!+u`kOS?|`%0W$DTtYk97EWolX=JYbdt|E!=V?yZOfiwUy07BJA>?y z(Kz3qrFBQ1x`x#ob?kj=U+5{e&$UvU4L_&UftV!&!r0q%xN~f)iUU{yFID)f*#mGxVAN zgm)Vp52?m?#?ARB^7bKbNkLqTXQh5ysCZ`RUC|F$kov?tt$X2Gtvg?T2;SEaN4|T1 zfw8`ZmXOsehFq+1Z0RNSmj4D()11(UA+aZNrIEcOFM4EG)7spQ6cDu+g3CI?L9%d< z!>6|7ekFPt`C9kmezA{nrF#@UHvz9xh( zLvK|Pa%k~q6(+r`b$?M#tJJ;ixrIm%T?k>7JumSPf41BV6L_u+Hj6a^DkfV$pY@8s%S_|LtSL??Av>GgJnMx%_mM^t^-D=w} zAt_m7`d%IU{&}OcRYz)BHfC8*e;D4G_fB6k_Gy}L)dCkM(w>TOYRZGz#MkDm-PX3f zHqx=ZPV1iRH+E;5u~UWot(Yru!Y)1oPpbIcgXwP58)UDo8c`c4(N2qq;qHr{0RKMk z3Uobd`r<9RaY6FQcJzm*2#R=W>bvK0TBiTTd{=p4xY%QyfI7`0)T*{@yxW&JMXMHL zH>Q)$n`K5vkc-d{&Q~^u*GEEa5!xxo^ItiL#hC9d=I_&>(}W3yj-7f!U>3~E&d`w7 z9eqRg_4mbuuyUfOhCHWJ*}=Kx<%s*Y&n=If&S3qWk<)(TZ^-zoYq-;Q>2d@)n;ttj zDL+5bJ}Lk4&iqgMS-9m==fM%fhVAY0pv>N`n_QX}Y5(M+$2B795>9UQ#hh#LxRPS_ zVbwYdG8n>v*B(_7SJm&s z(ujBTZD&|_oZSIkIa@=~Bzjv0&f#IVAp|{$cZQ1Teb(ALj$`Ko+B+&Y#t8TWMtrYh zXW!l0JM}oRoitfH($Wh_-raJpc3w;GlZDpVJ+*YiwK0mD*7Q=m!+1Co>yDnV&bR>FCJGCC{17mG%pf)@mzRg6q-_pe#nH`DKiz0CoS-w6=6K|Jtq!*3K z4`Do}BP^qp8!{ojxd z$tHwzEnjW*_n!?xQnDX8m^?3?mGy}%e`Z%CcH$sDWe6JX|F7g~QM2JyE|z0PX#?K5 zo*gbK^t46mgou)=99cR+KG@8)TWw$5mlkFsGE9-FFOMf>6}C>zfQLx)HzF_C%Nn?| z8;8;K+@-J-51<&08&7QPkjB(LjHwWw20&~9u_Ei-AD;3fpAd6WR21S09>%3lD3{z5 z22VJfg>i@d=+=z&@jAvS`K+{lJ>`I3;I4g5l}^OC;)XY~`no)Y6u0iIY-E zwlv<>VF#;P%-@=EDwg(NpGB=1g z3E;%U_q)hbYnc&AVD8YgaB$U1&$_PnJ@KFXI1-=vl*f5Hp428Qd@45QDMxW4))1gj zd>zjIjst~#Ri|0t>_#m=aU=5WfUlXzWdXe)YqlQwn>317S$v(bBafC$TW?tJaO@a@ zh(4arhPIO~or*2-Z|xG+i%!>wbpWM@rfuyim7;JxZGi%u2i{NytBbem89njEb%Djt z4l0rTe~nBwH~qIPZTMmiL*B2-<4w#B;@ek61T9&}eYF2WSi~Zs1r9!foVBk7 zn#25*#xDlvvg^IU@B1$de!u@hbgOn^}stel8TI$Lj` z*5I7LGfwFKVC~7MmQUWfai#~>^Bmdg@D(CL?=>Nwc)usCXHiL6U#TX`l3CAt?)!KL zYdJeu&HdH#9y?Br_xSIjT~2Tx3f*Iz=gSVoM)bbe4TaMeOqd6s+cp329K5eAb4}&i zx9vF$E34kY=QvuAX9+VpcXZP3DLscfqZ97|n2PsQ9WGf=Jv-8* zCuN3P&PAI1===9@nnQ1X4^Lw75eH8ky3EI!kVnaaM`pLYIGEha8)dz{g1$!ODIIjT zVl=#wNK+~}iZo^5?`U}781n`%ufh`GT)FZ0EdJ7pAnhpa9IG5r6zwS9{A9^pv_PDH zsV<@uFyhpmc*{-JfJk|y{bN_BzuGwOHE<7GUTx5u=30yNLHjHiE6d1T#G|iqe)my& zCk>rm!7rQ)nYF-|b->sM$nmEO7 z&43Zt?jeW+r?(}J_xsYfC*g#6QY1vbkz=*5(EpYnXVZ*x@w5H(yE>4jU&qM}k}!E2 z(XzSS|H4B9XKb4w-GJG+lUrA{2PbrdIUSV+nn2n`cj=k zeIxL>$~lzgqBb+lhqM;R7H8kgH&snvkXvHta`E&xbC1$fx}siM&FNDG9;}Z^(=H{^ z*bu7-dEG@TBI39QMXTqpL@Ss)xV_t-EYEec8XQb+=MfVZbr_Z$v0kC;1Fc&e zG(DUmG~Hb=*3i5+W_XHI@!K0|d{1zIRgAb!q(rxx-nJs@zEb;AJ!&b;`R3}QdO<66 zf3~r{NhmPhV23yAm@ALs!CM?O=vh(?`^OXu9{4(9kwQmr}Nhy9zgeji0fWFk0?$V zme{+8C2XsF!e&tWdCg?R-t7`s(y4Ofa_oqAM)Xj133>JQ&iR!}bQyG`PsR?k-!!)S zjhwRAHF&<%J8=$NvH^l?z7iG^z^SvSSm|Wr&BG!;jcq)UROq<7FGhRO<2oPHRqQEW z!y>VlE(gwj!aU#l>##ucdFHs=#o}DrAL&Hdm&IHTw9)&Qv)g>#u0cJC{u#2ZHO}%a z4xF8;<+o2Q-0Y|GKXks9&d2CH@^C{)4{R6$FT3>yzngY19Q`=wh;?q}QBUIiZ1W83 zY^ilVH5~NB<>ulk*7Xy=iQS0Bc}F7a`@T6@kCf?}h)8CyB|hf1ztcW{jj*K&B?k58 z49$aQv;#P;fC$Xuz^fEj)tmp4il+t7(!Hd`6!(FDZv2nkI=t85d}_^Ho_gu>rOlB` zmxkfg&e`4CzR>Q%I9?99eC!3bjXld+-x$Kei39n0*IwHTt{nY0u<(%l#6x)J3hL6? ztiWO7D5=2Y!uX$3l4hBAjQ_Q6<2Tzz((Xvwl)#3;*YO#%WIMxu&rb92pArc@d)d?e zGUA)<;5r^$;|UZEPl@397td+5B<3WZ965yNXMNs-8s60L-PVi|xsmgF%r@_VT&+9B z|K(?T#5^(cSY8|6Eg4qFGo7cn=gZ_UFg;;Wr!4Bi=Fsr};CH`iI9NYbK%eUvW+z`&lpE zu_>^4Ct_bJ2M5j5P?7d|cU?J^MsC+#@~$h7abVvD``sb}BjyAC9>govX84m|QQsw` z(;gM=@!WG?qAL=@-bhd1ZQGvdzfF5FtMDZE5(hkYY{&?LU;#HzH2Vd;hn~> z7v?|kV|Jh`vJSbhH$FE+bFQxExBsMo=-?fKU4g|-TI(3lMHE%+byDu^^>f==i<}IP zJtjQ~-{6%{rP#CV&D!YMAZC0{1pe!Ro@%hFTtktKAc-c&8? z-f3yZ8^;kz9ec~LFR!5s5d-7>1{k#$V`Q(1em!;Wk?an7dlFeudQy?bhc!oMhfS-A z(GZDW#dK(V*`R*y{(I#;l0tt(zXdyPPVBfL8bwe4gX#p*Wjgx={=X~d)77cedqis->d>eB?9!0F8-V{-L=+sO%J+W zO6$vfv9$M%fZ%10geRf5htIuEVK8zSH@3c&*R^s@K{0tFrtt~T3 zwdBNeinqjYEK>J5i?lg-+tU{4uZGjU>zJTJ&x?|^BTr`Unw&Lb3lT#K)MJmI**h2? z&7z17*+VObztYHIpPSq}%a0s`dqa1$(OX6lHN}%N)wWORc;+{b0Df;tJ8XF?u;S0G zb7*HRtXie;l3%*Qei649TGJD%#``iwd#jn;@73&e(R;nwZGs0xC%Em`%{kbCG+t_V(FS!aFR#FA~wc!`p1`0NpW6L zjwgzoZy+8{`RtYqn1zhri@+OqL>p8o(X6JQl6Nrwc{xd1uEVgek{9vAUSw&-@+8`(rYnFQh zb<3C3EM*xDw|X-gvND>+i285?|8lOBHh4k~3qDlS(AdE2iVe)_SJW(T^jbe;S6i{P z!JC!)P)2UvLu1%Ds;Q>Ii{JdqVGY%FO|@0tl?jw5Hc&V z_%Ltc#~tfygN=~yUBMM7RnrixLQ_{X1sa?1JI~$<&_>x6!HTL?tgJe?B1pY}eyXZj zzSLW@9OdatRYhaPz~s87#-(+3@;8^)t}^676dIc9>+4ofy~b_pSESKzYEq%Uut@G= zx$GQUc4#>76H<`Mpf_lY9{eIAe)O@56u%Kei#o#iT}AW(|9!<8{F1fNj{2rXqY-El zb+OzL#&0<;YN%PdsG@f1A|eA73Dyu@++1Ekg7PA%ZUuhwdfBaBX!=7$gDdHvS&(|y zz@iP(a5Ts5GMI>39@iGD}ps?dikgI@gpXM^#}bJV*{jlo6BDjFKm z`KIX^pSP&KuD+=j8n>u%1+*NBx{UNvE^bMns(RU?Kt*i;${kn{Y-B|xGj8=x^V$*$ z2CAx~GJwz8y5&oQG?EPJ%W4`MNyybfjBMO|uqoJJbcOM2o8CZhMPtp9ngHoPcxZT_ zrrtX+g$A;mQ~J(FZ^eqG!LeR48+XuOn?Gu^L2i*fpcXA_SV~n5tOX)8dONBri>ZMr zmW-$l8X@>Ywu5L7%naH#2dKKDzN!9J?~gs?*gz+6p3HB`^&e;YM?s|K?RQEjY)>Hd}==WVDD z1`M-@kzZNYgsKd~Kt|9TtgpkI^ew~SQ}d&GXbF_O8pe~f5&9x}$F9}x8v9OVMHR`< zV9~n_ze!)Q)X*RfG)=DEv&7q2s~hAg)7sv!sx-TDzFsua&=upqtO^B!y=h3duU?rE&R@^ zMPybODVA(svix_FN%aPrAd)cylbcBMMB^I97`+HPcxRy(I#jcqjrQIttXy=fmKg3) zM()iIv9HJzs0~)EfZIYwX6f>phcPgvPGZX{9>R|cS1eryC0WF$4@N#qQv=Krx4HJD zyJ+c(x~6(4l%-3OGBUWMiyBrm*0XBV*H{^>Xk_T}TC&jShDEg%tDqP4_!;E7Kwa%3 z%XvYPK`vNj2+_3YhC2iVYN#Ki&pGU6engeGN>{P=KsWN`o8a&mm zT4b0N(H!(AIn50$P*?XrO_0?$JV2SDjeHC*T2@yTM5^e7Mf5w^H2i9Czpkcg(UO{4 zOpy(&9(p286_jmIF>zI)N(|;0T&CqThgB`AURDucg135jK#hyY1XaLN1eXU^tg45l ztH$qiQ$}M9R-qW5qpfMy`ekSCM3cvXi3Lu`!@)(hHDn?0G`!Lhnp4Sjg9P|@y{?$`#Uz z;s$eVk$2_FX-cET2Yh_~HSbH9s9A0}gE{8nW(-X#lKdr1)3i5=8rOwhtA3+iVfJ2gVPR z!x@Jm~e@eB*)n&tI%b+xl5j?V+8 zl>D0~M5S;{DR~nonR)Q-0lBo4l1HVD+<6m_hrW%!#iEUGxc5-r#EIi?VGm81aI>}M zvz-WTXl-|c1VT=ceS>t7S-HLNe&BW+Zj;D?)l^fh;n_r$gxx0J+zXD#y~fyp!87k= znN|Q!GrB)mHO96USmDd132@T<{U6pT3*_nq|x5SYIMC(^v*eDRGe0t++f3TY(fxW zDe99a81gpFt{_`JcqXqkf{ckhfb}u=Xt26rMs3nGz@*p#?7)&bLt;>SvJy+kgEezV ziA_?XRn;;CC+yO4hCA!(S5Y7aF^}aK4`j!L_dV5GK2s>?o7Q5P0J$4d1VRKjytk7h z2sgQ^ZW#}d7ZrxBgIl6n)?%xgJfUtQ?VnNh^#Brj#ZNtb2JuBUV)TPn9!E{3})cYnA-J`R$p@X0`Nt^?3CG_6-@s1H)`6KEv># z->y%=$Aiysd{XflgHJX-H{dfCpKC!pDctwfLx) z!=leucuVyPa+g%L5H$%oN+f9-2yVrIHKmY!;i8S<;0-|+k(ZFZ@9)ngN!fB2uSQTtxL_0DT@Z-`&^(W2ou zee>MJWy@wC@&75be`V#u?;QJh`sDX^-t^}OhFo57;A7XpKYw`h1Am(z{?U#-KT1!2 zWZKu?otm{|_6L8u_x2;~kzYI=__hATnUYD@mjCCLni2oD>x=Z?E@}pnSh^dos278d7BdgU8`{NcC8jvU(V z_`&t9TR({1`tSSu?z>nwea?xuZ}`n8UH4oy@|LctkG$V?|M}F{Ge}&X+bgqycrmXfwe9~p<4Dm-7@kST%MHlfz z7x6XDk_%M@h`P28UpxcGA{jBM8?d#oa`@` z>!LK*!Cu7#^iviANR;xoOZW$*G`Py}(O9PTUt`e>d?(!{dS`eB}_1&uA=@O2n z7iZ+3Yo~KONx=&hJWImS^oAJp8trtBcPjX>f}d3I9tCfeaCCi%Mt!6|{7Pg$r7?jk z8=n~VqSC*^jQkLhd2uY%h~s7}88a=(Q^=2F>TiB={ICU)KbpT}qr4dJ9E)4(4@)rh{Xd}RG3;6`y8cup|5XNk%RZ8&zT`E?vsdw- z#%@*0k5bBC!=5vZAN8@uu2=G3XV725N#gHy>;u!drUAvUud@wsQcmGJ*;i|P2>syY z??)QHI6h`U(0e3{u?xUtx2gPRnfM=VCm9otZvWSn_I{oH!Q`jF$o~!PDaiM7f*7yS zCmKLqQ`39%Hn=Ww7CE60&QtIN1y3^Qi~iua-mZ`1Hza&C zov{TF_SbRGlJ^lQo#Z9#(Ij>o`llQDp$2yTkEHx-Atp|wN^?$g!=CXCL2QhMUNLw&m3aN!7+xcd2xKR1K{}aHD}A+8p8Dra1uu?4X5-@Rc~?m< zk{Rl{EBH1EA4{{D!xB=+@s)m3ZAdvd)Wg{PV9dC7sKvT((g0s z7xs^1p|2dzxB1~1L(IH5USL7cr}0;+U?DHH{zVEuixpg<;DCaw6dY9W5(O_c_`BBT zZ>f@AW2E0|r*r&)g7+x+KNNgG!KWo0JwH8Q)VJJD=eR(@)e?>_zf9qOxj`@2&d;&% z-#Hfg#xYdXyf~g!7~*s=<)m|O1jWLo-WpV^-6nJ81;+# zI2QW1g1sFze>5uc;rWIA7|;xXNxHr+2NAK32i?N`B#A@bZ(D z{EsO4OO*7rO1iLDoZe$f`d$V9P{F$tyj{V+Q1E<(pPwoCsFGid7tUX;lK&9}zoV2F z{t_?$p_2ZjQeOC*JpboP{$D8hk1N=v;CB>!O2X0pLZhP3D-Hd;$F85_HU$fNu~I4j zkWqfRouA_s3a*rJ^mu+)q4#YCKce7A75p6qf0xx`eZ3p)ClL&s|5^-wh5g~U$mWk@ z(f$^;)O6+xkSB(<8s)zu<&SO;PtUW{TNVC73T`*(346qGmR+7>Vb9u?@@o|wR&a-c z*C}|tf;$!bn8Dvro1e#&^bHDrT*2Q{a74iy72KuZO$z?Lf}c?EW`ke1%`e9YZ~Clf?QL52TIfHoZ>Zf~j?*O^&HpbA{`cDSITquS z;|?kPI1+D%d}x?j_0N>jNx!NTyhOsYVBbrn@>>wkOaP|y5d-bl^DHNevAdBj&tGEv zK5y_Z>;uQ5evXCwIlf@?^E^9*!LS7MN0{~h7v`@=r23-e^@35~0lPfMMGAgM!ABG< z);qlXb4vPl1vg9hvvkJRfj=+qk-T0ob@NH!81`#rJpY>g6#4%#l%EN(`b+5Bui1Cd zpFfAOwdhg*JqB9*`ZXI5oC@KSnIG6cy@oupZT&K_Rh)4=S;31Hyhp)8Uc9`J567QK z`J?;iMT4I-J6+v>>@(7Z|Ix?3jrRQn^0fAksr{Sm@;v`62|tMW_BisBTW-m-SxTq! zha?<=e(UHXYd@m{{=XTm3r<<83~$9Isy}(L0Ipu?guUW2^lerF7!&BL%0Rz5L?*tWfY4 z1yg(F{I@E&O~F4@@G}ZNrr_U8_)i!gzW^SJ3J2=t*(2 zyiwdZL#44Cqd%APTlo7jdk^I=p--&+!*Nmd-)Q7tFXcaq@%RGr-;8@y-{C0wxkmo8 zQvR+4#@dko7BfHTi?EL`8}0drlz*xDo%$n&y=KR%Iey*9|Cp_BFSGMQ%>uZmvGGRz zf0xn?`(uw+Uf&)ioz^4#;_1Ja@C8~(;<^?ejZM%#GUbD20q1F1X8U=60TW2BSp`E`bU!#or?5;rtJe*T>UEeBcAN0fQyc$=C4K{3PNLJpauKJ<&d%eyx%& z=5L-p$+qtwu>F|N@=@Q{Bzdh>%HJ&IcVe)f#{6uZ4|^JE{{t+S7wdCg-)&NPvfsi# zhhVhR5i{XHA}TkFf&puZY;wAr5M{`!zjfq$_L>EtF@@~yP0XCJZ( znrLv58H{0{ur(%5GqBef4-ZoY`gBstAAxb|1Hbb6rOIwU&+k;Q@Yg?Nw?UtNi24%1Bei!f`nv}hY#8_|v~LZt zwLYN!Ns{RO2^rr}e8{GPzxgOnbCM;`HmQ7lI^xer2MHrRi1pH50Jt~?{s{eX z8tGQNBf7u1zq=fH`NeUTO`qc@tz^?bKCIwF3jPlX{|xoNiOSP(&*J}Th5lK)KX`q@ zU*cHA2QRXZAdj12e60R@82V5SoM_Tt0(n+S_>btHI$&9Tl~VmDU_3tue-=IJA2A*- zvZIjaRVZ)iyBqW#1-9gwhW>s`s&5O*{{T2%YVTthzx?9u8L8kb32%VBcAz}S*z!6h zr4xT2DY%q6-?%vadlW3zGd%rjDLoDP`L|fn9-`l)N7I`r<^MJ0Me$9z_%?rTDV@sy zLMcC4!Nm%mqu^O8Jq2%3Fn%n+ympR!%rqe<$qYh+tJ?_ke}?0 zmA_I-r}iCJaJnm+-ruG4*P*Zf06nin4?j|6UYy_Q5{@399~t(_bQw{GW2m5caZGaq zzc?n_W8r9eAG7!E6tchRivRhE;$M7f)Gz39e49m{aXd@G8x<_(N1lJak`6(e7f-)n zL6g3Sr+>=+2m1OK^e_3;R{y-IjLe{RT6$b)0iUmUNs`R7>J+t1mdbUX_H`e?S%-e~%NXSad>*+`f5 zd%I2V??(OKQSf65-XP&T*qkN9&+<#(F?niF|6c8k&8PnG)5O8Ke$ z*X;h_{1hmd_CL(apeOdDm=**1O~T|Xx0m9Ra{gMS{8lA>y@IzY`Ne$8`KzSH@r(DT zg71*%T@U%q1b;Upzcs$nAy4x%%HJd9CwX)$^cE=T8>I9@$o~@PTmA`^zaXU(J}Q+D zL7%^-$ZM^V|7Qw*PQv%5BmR%_*P89w0Xz=+X4#`c=wCb1@t@J&=S?ia7pEuqCh6QaZIq_)jrfAMkqQA8*!2=@+H^^P!JlgL6F5On)Bs?giv0n{3e^ zYwKf-Rt)*vh5Rx-v0mi-mPq-jJ`oR$(cXZ)`ahr#5!m!&Y<-H+ehd5Y0n+9D332{D zM*9N(!;tvs{SMk+<5!FpLVI$MF5AQHQabVTdj*UAVb1?4C4I83A3R;`=W^_l(jSC; z?m+!eYomQ1;!72<)!$UV&}UwLp;VsIt0Ww)A5QIhq)&!Ec}@BTJ>Gcyb!yk4|0<>Q z=<+VD6!KqZFVMOUm$&`ls?n$FSo(JnEyBy^>f@|>!({=2}Xy+ zM#twdQJELdFVGuKjHWvO8(;t7X8ihk5uSgE#dLdmk9W=>>u&7 zTuLV_{1Hy?BPIQ91&jXR`Ne)T0RNd4(Q(@q!*%1mVIlt+m~R-C&#Xj z<7cFFye^+5xJ7>u|8Gm_70{=zDd}#7Uaf+KKcAqiKZY9opi9k*W3p}h;utCsg~5`I zquZaPeF1%%4F1pzyZs`*kz~}@XccE1e@DT>ALQwW?DiyS{|jcTL0^s^Jg1Zw{w*(G zFO?^Gen-LC3eL30OOobAeIeBMHK{#&mHbaA_#Fvf3;o=N@}tf2(eg^sevbL%DAMKq z>y37MQVeL@Ll*iO^Qko- zMz?Rc!T&KkKgTB(EXF%eU#X-oR`7J2f1Y3HJI9BV{6fEY`p=Z~4GQj2uvp*n@?TTx z7y2_?(;?4f$V2W=F+PVY<8Oo^pZ~Dy8=)m$kNtX-_u(Gdk7#+0H1ZeO`8l2};r}GV zjtkv_@&!izTH_A=;rZ(oTq)t{urK$Ze*Ck???Y009tQR|m2{!6BNcx6^OeHBT&<*E zYw#!Zi{lUM`ZzwN;0d<;dHO3#`rj2S*0(&rcwT^GF&;SHuF!u@!qNTlHSLcyaB$I@ zErz8j?ei))&1i3dQG)((T&&(@m$BX#%ILK!caDv&M9ccen;Nd3z0p_a% zz!v@IP=6n=)xMvi{?ovgJpYgl{}I?4A9#N#`xqGi40+AQ!21UPhOvQP0Y4c-#C-L? z;Ab+hwO&pHo-g4L_*(%ClWdg#Hu!rO*y3*^_zMH$pOOCWH!!vlz}kO!A)B!u1H%O| z(*59X53sc#;sbwuz*hY~1%H14w&e2$_<0Z5lFx_Gzb}BT_(MJTy9$}D_AUW`qk%2{ zz6<_xfi3zE-+*VWfh~FN0)O*>Eq*=&KlQ*?`Juqy1-AUr=>8p}^mn%QA@av2ivIZw zg1;8nTHl4xzHb0q^+(eitI!*#;2Z_tsNh@$k5_P>g7XzTLE8fU9!Goe&*-mTL;g=m z_$|nPw@v9rMVXV9yI{67G&^dq|c6BT|YX$|O~06N3! z-=mQ4GGGizgI*!z`>2$DFZf?0r8k5B?@Q@h!2i<{z83udM9QB6{-2l9{|)^2N%$M! z|F;re2>#xZ@K3=XosqKieJuEUA6Pf}jc)HvN_%fn@U05|hJtTb@Er>NHw70cxKP1& zY6nPBae47c!CRSTnfR=Mb=E?L$GoTyF4Mxyya?ZJ0sK!mVwNw%_Y_E_&crmw<2_;a zS)*4BJcLz|BaQ10d{VHhcfy>{=pNA<>7sA^BD@Y`$+`$nH_OvK!dH=@!1WkDDHzqW zX`q`IrLQN&H7}z)Io1*$W9FwhFa=uf9L*EStx18^C?G}0MfN2Hv&4F{KCgkVVZS1x zxIV!r1*?SVq{z59Kcm?^*fP4>@kxP~^)wk8T-59oL>1y`;xR8GCRt}<0O8<^G+jp~3zL%|6>i?yJ3zYVZQQG@# z0~ z3ATwYPH!grQ4~MlWVL2&j_04nj?+Q_7qvBo&1Scl{ym8`h23TNdX&!fuZ)czO^9Dq z=6)I|xaQ!Kg117Qpoze|DE*W<9!N|n>>hTDDPLayJT}feKgHAMvrDEtDO(D=mrXav zGta+>{mdMnG%QlsV)lxepX*}<%Qo}#@&Wc!Q$IMaV&699%i9-ZZJ8+Q$u`k-}Qo%clG|{Sa$3%k%l6orO*L@btB8 z7BvDF?~gFs6oot3hA4eq$I_zYy`KGd)cERTe>2<5`Fo62n&W}jw}JgK3O~+%H=5Va z)4%usb9O#(QeEZwpGA@&QoPwg#2Lg5V#M^$y0Z{MC`L>Xky46?6cJgL{lhLBO+o%nx-+0DW)`~F^w28#`t@l`@YZIv%?JW z=lL*qzVpm;-us?&&pr3g%nq4f`1qIsxi<5O%rc*^*sR*j_RLuyPu%TlGk>4C!r!<0 zJ2Id0{H#5n%=G(f>(8B;fAjf+&8*FQD)RyF4}1U9nOYw&w!Y6~F7*8a_GBMj>;1DJ zss9g|?|FMSC9gl5+2yZqOkRI3^I;z!S0%6U|ML0qcU$uMw#=g*4=7c=+yc(e9=Df4l!-6V)JDFR{j<+W`P*K?I+RS$|Cwx3lMLTNoefh&BS-+KMpviWDY?@u?tP@DN-W(5Z}$`m|mGe64AD%(E4_V%$_ZRTGy5Bc%U=KDu7 zv;6(KCh%{-Yo;peY&lh-FR zSJeSf?ER-Q!|IZk{`yqr&%OPVlKy=<^Xszt{7G*gYq9_C@bR%b>EF|tbvzJx;rraK zDtz7I{eNHLeN5YE%U*9QYv1y+@%RMBA>CviyJR z`y*qrJy*GZMKaz8)%;1>{P-n*U;Zb({vHUmxIcNA0|{j_9<}(q@r?IpN3uOHtl4@= z@^p$SH`5oU{d>(ai+5GX2GXFDwXz|w7&_AqZtdG|Q$hDc_HH#33 zWkwP&su|?{$L}cB;xC`{-O{zm>k&1F@XT@)kJ`-0nuTTkb6wf%(PjN{rfmCtw`_jp zZ$GNAy&N8q=ftiPa~jn5?&`p?&nx4=Igd%6fCtNXJo2uSrE?tShG2n0md^gkyH1vV z6*&7*+iA$sXMl4)*O8^q0_R;POJ5AmZm~FI=_|ky4|XVP@W_75JY;z`g7tSyo4{%> zS)LogYA;#(P4xRdN0z>ge%Hy;cY)Pjvh;mm<#0P#IgsVK6RaG_((k6<$30p40s37h zOFslw4rJ*ZN|BC_;FtpjWh@@zab!Oy;dU1{g4MTV#heB%)M9}$6Av+mb>w50F~#-Z z*yo^$ zt4o$=Iz4`_%<-B1gn7cTx{&&I)5)s46s-8|^!&Yf$nx}pbuG1)exC<6fRztfevV1y zvz;Dq7g?U&^!WM29m^I)5RBi51oc)x= zBuk$S=Dk6d`FN<$$?_}($J_}}lI`ey9&X1Tyr+D)9mPCMM3-TKG6avvk1L!qa%=<& zS?gjy8zW(0t=Kd4yT^H>tw}YTcRtmK;aOHow-S}+|g0U z@=pRQAF}jmV6B%deL7g{B}<eJeP=3Ja8Nc;w!mV8Zh3fRuNgEPWqX#}~5n2f?{%SfG%l z9|q^AVSz%H{tQ@g$kI6;qN}k$8Hz{lj}tt1T)93RZ>#Po`nf?+$kI8z=3OUC=Ps9< zfdvX#I(Lt}>tyL1%DH!8fkKu(8Ju^WES;M+HxmmKvh-=-yz6A?95eAOEKru>k=@1K zFqVhoA$oTrXX@~jo1L;e;~?c-CriH!tUf18XU@4l#R8=~|GevA{@gq{CW}H=9ClgW zb+Yui;Ft@PC3q+YvOFum(Vt;~G6au^I||A$JaX?%@Z34m^$2e(&IoW}zWGPuDfhmV zW2C7u$sNibh2XBQ{QJgSvvbU`+3vD zKA#RfUW^3_H*NNI^N>}S&6bB&Fo3D7cGCX^h*PsES>$VoXOJJC(_B%lkMf}CBK|r3s1BR3l!!PwIrDA zU*hq6ugW!%&f8;nv@YfuwOSk=Q*v!7%QFR1-gUBcwx!T+es14rxiPn|@>vL0K4jJ9 zwpKpjc3(<=2Nozx@sOV>=3OUC?*b+YtBVC6uT{xG<34HhWJ z@yM}bP{{H;0?xZmmi{DIeRvX_TZIJ*S)Nniyz6A?XTZvbES;Zi#M}rd{4SHuUCHwB zJ8AJ>m}gwzAD%ddoh*G9Sox5p^KapF-9(no@3cxMOMf1${3EPBzRq&se3ku*Z5OiqJif&1 z%u|OaT^Ez(;T#oz2n&=3JhJ`=C1iP~f@AKWDAV!K7$eIw9~^%e3zWrp$U~NgyJCDj z7AWj`dC2nI0FM6>3l#4A;+q2A0oHMZth#puI$1jRYaJKP*~k4@d?@fA0p~VgfkIZC zW8nM-EKtbO9|dQ>YW+`^{uK2Crjw1kBBV)OZ5D;dH6RR@!uK`2Ip=}S$_WAM&5O@^ikkwi}}ZrIq*^H$saT3Z(78z zPpAG-)0cn?e`nlJeXH@hfNuzxpKCF;}-+w{dVa?0v=1|#DH=c z`6I?LSmTGRb@4aZTYt`(sx*Q=jp3jhghmk$ED9}fccVdAu3J=vC9dI4_W-L&~ z;Zbu-g7*FFPaDV7KVv)`Pa3Oa<z=by042Yo!cmTpXE=MUKi+O>EppUHWY;{o!cnyI$3%HICmQsC}imq!Fkuo z(r1D-?~$c1q5gHtlPrA$b>CiO>6}*LeORDu!9&M=vOLK#)cYhnhO!ya=dnP!6A$$p zS#^(4@52IxEPW(c{YjRdj6?6|a2#F+kNT4=e?3_JNtWJ7zxNwi`Xu^YCrh6NR)3PE z52F4J>rb-uA=Ld?K$aeX<8NYt!f_%V6Y!-0b6ZFEV}UXSkAl~|8XWx-Rr`D->tBEh zxAkJYm;JuwMph23;P@aGC>?m{_)C_j3#{WWS$Yrs-@*cgEWIC`cbzPK16ch=mVOgh zZP`JO|FJV!o?T$|&rtHWu|TQCBXZ6KTnEk`v-Xk|XFNDQgar!wQ*pR`#Zv=j-%4k+ z?02w0AuHxEaQt1WcF$bLtdV#vPqIxps8M1*zL#L~{~gCijhRE?`^Mb9@iF78@TC2P zteD)s@ej;17f-6YFyITp%9*UX%s+k<3zVckog=)K&iutm{*TdZ$CTLlGQ1Wi{ptE- z=!GBCoyknYBXXV{@O-fPimcq0g5$@rKv{u@K8GU9vlblv2NozB@epqTD<)a~o#6Nh zEKqL6Lovzn+yPe3`vX1*j(>s$%7b|5vmUbQvio9hBfCJ`i!2YvYW$yApp3>Navlqo zo{Z0vblC3$X(4k`QO;N%Uma!bbB&&*$kr|4PZ zB>w*y$JC!Q=6Eao+;}4Sj4{WaJj@|-&y2t`JK#m&_!n59aQsKVOwhK`Sz~Ua+^&#%p&GQFw)M z4>-QScpdc%jn`8jV!VmEuXhWX7k?KCJQ6VFtTqujwSJk zfJc!%2kuky)RDd4#s&KLfa8EU{#BRbP0aBoo=Wy@J&pWI%adcT#=n@(u_yoRfaeB0 zKj4J{FAjJq`67$Yv6}q1@p$ea^FO3T=^}goaNLUf171t!Mn+jrex30K@(AONWRJ5s z;4J}f4S0LNI|IIj?Av#Dpzk63*xMKAcLaP_!21KfC*b=6K1lZc>k#=5tSt|bUu}GZ z{08G=Occ>@XMYCPm2%QFiczr{Rr z>G8fI%d;rZ$KrES>$Jm@~nONtR~;b-&j{mc9%eUtu|P(Bt1lASb37=9|2aLWa*>8k=JFPsISQKTt?l$S3{OQ5*$yp^(G$wK2PXjUq!t6hcXS1 z*f|;VZ!>)m^oR!v6mt9?;|t02jQL(X-bp}1Gw-(^K+ldElF7(_FLX{ zvh=C+H<_O-eHu9LI$8QmaJ1C?v%$IMl;z?6n0K8loqZU$n4e=Ta;_uu0~wS{@yNBM zthyWndDp}7Fd2H>Zhnq|$T`W){ba>Sa&tY*Z4u*m4l5XExy9@OD<87ra6VB!Wa-?G zq7JK@j0c{Wpm4uX9J2hQ!HPqc&VGomvAW5acji2=IAr;+1}hF(`Ydqdbr*u;E{oYg z-TC)wqt{KgX}86U7}J?!JN7^5uM2oQJw4{<7>@tKIN6T9#>1dzhuFSGR$JI_ald)$ zz>#wUILjY$L?O$c#9VED_Eq*(<_Y^P88d6lll0ZK#&hA1yzT;U!I|Skycn$eDrBv9 zDOmSa$kJQExwRIbES=jT?>brf8nEuGkfj4N*^8_#S!&iyO8-ux561@}w=>mCkS>*aV;Opb>vPry;g^6+)c4^dIZkUwI~^%gc7*MlSH zWFGr#)5(g%eIf5US$eX4{kRrx-MAv|Bdlx@@C_$o`bOU0#+HK4u=VRb_hv}#A6#c#N z8M4=H7?iG;to8D5km668e*-w$X}l%yljY~{-o?r%V18z#c9G?O1g!iy=CiyIL?O$Q z1IM2>onun>y~*;707suOPaT;ZhQj?K+HJgy{8{7V*x~xxz{4@7Jjsf`C(y~#9|bG^ zS@NwGpJOKaobgaR>3ol@x+Ce?W1bv6{{3^ZJeN`T@1K*UH-e*o!~%t=Mf`L74Zw_$<8 zU0w0H8>kN-3ixQikAt;c$cp(CJ)g${v&RQzNg@xHx@!Y|Yj+v*Tq}0wd6al8IC6bFI6K0|4_Wy%1pX=Xf7xPA518i$+1FTI zvg*zQYh4TI8EGD}JWJ@|nsjg`Y^E8H3A&niv>zDH|ESA z&W&RO|E1t;-aKT*tPecN*t-t`%1At7=P}^uo2HMWe!nrtp7=7bwime+AFSm^HXq~3=G3R(J8aQrV8e+D?>fevL( zz>CP=F+JIihmCunYYrhR=K4S*mfW2TQI|G>C`o`;P& zesoMED`qm5erTTA^mzZ1<(UtTkDF&9SZycEvly(llcg^OtN+Q;Tfypovh;3n;YYTv zesFZc_$*;s-UU{_k)`*83qQ6vYrr|4q@$4KSqIL$ zPL{q2toD+n4+lq2SezU<{)zDz`u)0wEI;Sl_(}6j3OrUFkV$kI8-W-l>4oNu>N_x#E7?*_*wEw{b&_`P?sJRG0#Pt9|H9*;wo z=O8^#ndia4Lzd@Z>SHZ8vh>HOztMEEbk39Ue_70D=<)whfh^Ap)cyPFWa$^8n(`z| zA4}c;UYIO>DC)-l4FQGwm#%HYeQhLlZ#!9axgSOUV|7P^wO^3ssRL`jAWP@ImOE{A z!~JeN{jQVcZv+?q*Zh;f@iWGg!CEg_{;6QCmn?l6IQKKFOO`$zoOhipeGXXbod=Ge zwYm!e=02Of)V5=||F+Zff9CH1D^IfGbH7%e;XckWpW}r!N;v+x@8?}7E6(*`<+%Z@ zb&=)S2-dpD(l>*1Keu&}rEj6%b+YuE!J0$J((ebyzpyw5!ODRw&mpjKAWMG;oO|Bt zlBFM^-*vL|6JWLX32^jFtNS$htnqW;_*cefz{-cLIA_7ihb;X?`hRV8$brfVz6>p z29AER+lJr28;r`FSrZ zdWCtW1RkFdE!WN|iu3!Y~(-}--gan5|}dN|+iV0^#FOIG|{;5cjX_XhFr z2CGj_2K*dY_x#CC?dR#TIiWI2vip z{aU}*5$@v)pzHTK$cnQRTzIY3<-V`q>mbY14%Y8=kfry4HBL5w)hD~bS^kj_3R(W! z1Aj7a`1U#y)IGtves7knx}2sJzuLT!+z;1S#p>mMJmBX8z8d?8Jd4QQpY7z=S^hoX zIA^?uy7Tp5%@1VdxrrVog2LaH)VLzcvlAS@-aNbM&l_`|DR}%lse3;6fOS8UtT>0M zzs1H3S^A^kc#Oq-oF4ysNwPegPjt>1&Mjx4YrQXk3$L*_Y)@2YJPfS;ovfGh32? z-%s7IS;*3P-Y7p=I?n^+ORX)3>G5@u*F~28IQ2=`DN)GMp9afMmd^Q5Vy0khC-G; z37mJGEPX0C>p#*-mOdRE#};P>I9Etno>|cIu9KxF*F^Q^=eW(iHD!6`v##r8>5IV1 zhb(;=IOd1pD6M$piYd#}0X^?JS$Y?^;Q4g3Zll#D%hL?7Vk;Xbkfo_K=A zxdEJ;n6m0_f}VGsEd55X^5K4zyWHxA`_xv}b)BrbJHYB6vh-cxc#_504bEMWvOIgB z=UpdD-v`ddHV>1fp905MTAaZcdpVxKqLAeo0?xZmmd-Jp`y=y*~O;%mzCY>yOJUD)j)vc$;?+udWxtgAN=9w9I$ntQ0i{ERWCG_}liY!kD zJ@d_z%td}I2>yH1wQ zy(wCf#>q9MEYC33b)77o&bZn9JeI}FjG05+Vw|+4)i?(|YB%P1h}(?0j5>@NN52U` z*1Cp*^_u`>>0DQ#)9SKasvEYEIjAmKb=jZsHCFdhaJ0g>KF}M$*~zwz$f`?cw9@>) zSI*s5_xH-V$Lc0IuQKK`>NWno^69g>zgIr1t?qc{&~F@r<2A<9$k!Tk8C_@md*!*# z>i%ANuD7~Lo*y#iGP>S4$>%Rq*0xT@p6lm~J$_jUCCSG?uPpG1ALG3QwQt_xZDaE{e)myxBABJ3Yyj(=oGi~qu+GWJ(l>*1AGNw<={)bs zyH1wA16Jzeb_P_ch+!jaZ|D?qv%YTf1*U8dPfOQ>5mi`nt+G%mPy`oPUzXXn*+2`@irt=}J4{vj(*o_ni*$kLO0?>=V2 z`*I8E-(@k$^7Ed2-gUC{rC{|BSvv2U{xJ(lNj>i=lW>k;KlR^3Oz%9$)Zxn}X)$kLN* z7T3dTmZ#uR&Sd$Y1}kT>^s``%8M1U<<7EHX_HnXwUJgZ{x3)~hliEU-hnGoe3t2iZ zjdHhRfkKwfOOd?mWa&J;R&HeJJQXhN#R6q1o?`D?o^loTnaXN0;r{8t5^o8`_Wqz{s#q_&QmcA5R z__FzzflHq$1fF(q=`)2uUqS!fR+p@pJh#caPL|$F|5waUmcE95*U8eig5&+>-v-vU zBg?Y`tZhe@&hwVsSFLV%4zr7X*U9qV0oJx7OFu;2KjR=vKN09;>8AsoEd2%QemzT; z&SRNAe<4es2#&vI`A-I`?PPhTg4K4i^l9|pV|B^Wr_=8`Svrq#g|C}`2{^jfxEmaQ z!?+i$9LTD>2CN*&($~>{pVcKxzn*^A$t3C8qoO;*gu!D6fmOc-h`)4dr$kKTX%DWyOk9fO8amey-1}lHE^etfJPnN!w z{s*x@Axq~ec;0og^gUpWC9-r*g&GfJ>D3hJr zqgIzJeIGdQI$8QX;KKLKe+aDK1tQCH1RNbRPcq;7wP!frK2FaM%<~NSVdLk(%Ac&5 z&x4geSvu$B+z+j8I6w26CGR>}{)qdye}+YtUQgYR7i8&^z`5fVpDcX}IPW@H`W&#v z5?OjTb&pS$z6PB8k;NxVUkA>+PL{q6toUTkYriH-e;lm+;v`r(kmWfARt{w8r|Eyh@+V7w zmVVdC(q8}<{>}UuJZW8Ic?N^EF0%9?^goIP3R(IvaNc#Y^c+}Yj4ZvCy8qS$S$a2E z`H-def|UtyLSf|U&ibIzEFgW*PEKtbOPk{5TlchfmRvfbQ7r@cuSfJGMyB7apJQ1vZ zCd)q=tbQg-pGyBvtS(vlH2Pg9OP>c;Ka-^|1xHU>oL2IG8s9)ZX}kqo_^I&@ubpJzYkORZ}UF| zj<^v}o~7<>c@C@`$g2B1SUHfT^ZPKl|FJk^=`YdmI$8R#!D*k9rH=v^{@3D+rsth@ z4NjJ4GB|q1JXe!{W;_#Ic-D9}`TvZUf;ESe6{k1Q$KLn0{VKI+@wT;N~@aH(S zjmXlE)Bn8HB};#Ve%Hy;`O|?KC#S*6hb+$-aQsV)c^0gE$nv}hRz76u88lD%kfjd> zD<87-;b7%62Aq8t7ARzS_*MA$tmShVSox6U;Ya4mhb+C3{$E*Lvh+#xyH1wQTja`T zI{68!y9gX{GDBG!=*z&$hpag5VC6%WzJh+=cgWJa>35wheJ!|f+Sa=nto|X(vlSfw z+C1CA%7-k^PO$PJOTUGF?+3E<-SoRomVOsl=MQA*_fz-lHL~;v!8)%v2992|JRhNd zCKf1U`JVvCzcJ5Au-ZbF=M-3NAxl3^|4UYvEd5#fT_;O_0jzD!|G-=MkmVTyjy>mL zVC6%WCju)Uvh)%3`+CXJN73&(S^8M8@)-w?ers)M0B7HgWKqcSPX@;sOu#5t2OhFK zv*__SbHJL1=LO8QM1w5O5b`UGhkl+D zEPWXLu9Kzbz&ht7OTQGX_VV6il(T%U4)potyy?AQDSZm zI$8P_aCVN34YKs@VCArzo;wDk_c8;%(|$+bISf{wWW_lOR-R<(yvEG_nXQ*B{RMF3 z<6$@^Bk_oU$AERdM^;@-W0`1-wS5#geuFXRghHM1R(dWm-VWB^1(OwLH&|^UOWy-l zTgcM)fpcRmCRzF&^t(=$&U-Z)8)WGtz*;X^I@_Z4lBKgSnDNA zp9+rNWN|p}#mTfn~C67052PC3q|8w$&JR`zG_$bwpP2!x3$_8 zZtJ@cN9`i3UH5^tEy&W3QonC7miGUUOMf)b$o+3E(mAi{HzLT=pQisdEKtbO zp8@MPBFNGQaX+oYG564ag?aXZ3s)MSrr);*2kuI@Hy6AuCQJb^mPvvh*q7c#5^DPnRKV<2f!OCGPSUHg8*$!3?Wa&HUpK3XfrQbro>tyM7fRzJTI?sVMmdMh_ z20B^#Wnk^&Wa;%_jU}@5M*4lskfl$e-*vL|SzzT!mVPNXnr7`yVqOFR<(!zVhcTzX zmwSiRB`fAt;JoW(>9fJgfh>I~IJ(;6bc18(b=3dZ^bLWB$AxIR={y!>=li)0STU1h z!8^^vV}Zs1Ssor2GzQ4hcY|{?tS(tPj}dv-!{fz%=-L;^@^j8FyvyP|2##kOKMaoE zZTtv5vy4xIl_yzoPJxvtS^8=E|HSH&rSm*F?>brfi(vIXS^Dr`ej`iI1v**!Sg^(_ zSvt>qHCD;eFQebbBw0G=d5zU@&c7PE@+8YY7p(qV2#&lzmj&DtFwdEDbF6>L&!6+I zuY*VNH-Po`jAZGX!O@>toUQa+g3d!B%d?BR|4ukrI*%{$T&sIKJ^s6qWO?oZNAEGu zgXDR}kC5MM%=72MeB&p;8Yg7M;b%7*CuHfT==c8klZI>}%b7L>6g*(I$8Q;uyP|yp9wB3usCzU(VrX7 z2P+@4{0qU#hb(PL{p`Tv%x9>IFydH{KNRUh)S_-%nm_{2=**#zzBw zn7qXF$HB4l$v{61R=dc`=UK4YMV8K6!?`AlNtVuAoO##D(q96rpUKjB>m*ugad=BY z%u68cJ7oEJS}zYz$F=W}<>6GW-%TY;=PnvGV}Zh5B3fq5&0J_PX4glp#(X=G&cKUsc zk)`jX-*vL|yZnzw2b_$!AXs zZN0Nt*Ux##^2}jf*U8f7(eE+I(ihP0I$8Qsu;z_rV6BTRPdixaB1>OEzsDp?@21~% zvh?*}^)p%eO<>KLJHQcl2o!#XRk+4@Z=l~9==Xp%#>k4v&$-kVvh+h>wS_F5pM~YR zY+YpO{46Z*I$8Q-V4Z7`rJn>x%Pr3H^enLB6j`1OBzcB`l_y!A2&_EG()km&xs?{5 zEPWLHu9Kzn=ei2B%|8yTb&=&657xTK(qsBL389dsH_-1oS^8CAZC|qVS>Qsa#o;wb z+~fI>|H3%A?(p$^&UJ_D=UjJiB1Ado8o~AO8euwo%8jht=7I}-7H2-W-*^F7eMOdk z5mCb?* zUCw~@f7X!YISbbRSwogS1m}(Mb(X_Wu<|F%!)p!YA6|FV(!b8?lI0&szw2b_7tIYj+R)5+40fMc(F6s$Iq<#`ya zHj<^EpnrqqMwb34{jQUx^IAjOCA{u<0lIP+!Sl@bTb^XqURiFV#R>15Eur6avix0O z^&wgMI&k5yEzWLmyvg|1fbS&#jp@AZh&LPGPySouL*N2WT2T%Md>pLfJ6Y>}0vvzT z{7-__cCtKAfz@`h^rz|Pi7*OT`ZM&qPL}>6SZyauAB+&1mo5Y=2eLdv!ODRweK`Fe z!vcjYy%wBzoh-c$tQ^SFXMp3Iut4EqKK?u7x#X?J$#shN?P5sk=Vbx&v{?F3#8O+x zTGw!}+Cr9IOaC@o7g;)w^?BFH(#L|;7P9o1`u@RKB6mEbPXg<@fGnNI@%R(A-Wl}x zZ}O1knM>WTDag`!>{c7gkK<}%`EfkQiy@R{cqmRgIPW@H`UbGtNR~bVto4$mj{n-(l+|ORodxT_;Pg2W!1#=~KYbCoRrQaJ5527WDXY6C z;I#qY5b#E@+Dlga&0w{cEPV_8H(PwN^sV%}PL{q4toD+n-wBRBZE@}a$IkcD&kF?< zviuK%l_y#HVX*QfOFv5gEf$|F{bBlDCrf_mEK? z`h`5M-DhnfOCJu_eNnRXTCnbmlBJKN|270hAxqEE?>bp}Jy>laOP>T*ACjd{0jm$m z(yyX_m$jWNo%dSvu7~$smqOQi$?^|J-dZnNI_Dy-mn@xgQEs=bmn=O;zw2b_mx8rk zvh+sk{=0Bw>6~Zc&su!$Q_3yezZODQZe-P6O#iJ`mn?lLIPW@HdIz}hIrCo+*5{05 zd3J&0J?7a<{zv0G==bqMmjB*BCrf_-tZ_w_&izH>iY%S`i^f&?zN2v!?mJJyuYM*g z&hy}CujTv_J)SdJo?#ptu9KznGh*dTmOcusoXOJp8L@IEORuBf_XV=_iD2bSmOc$! z@SJDS z^yL2hmn?_1^!WchM3!d*ICjrQu<|6!!_SwMCt3Oy`tP#%Wa<3eIqy1I`psa?A-90F zF0wqk!CDtt`X2hfZ0jOR-$%deWa$UM8UtkM2f>9qEzSdAf-VQDtupGMR@z1r%^7Mn_ubF2p zSb37=Sr1m8Wa%5g`dphVeIr<(Ym=pK2P;pq^jpA%dn|`N;OOhdcaiTkK1lwCF^^4! z`-~p~D`&D|9sw(7vh-v0f79xcr5~r?b+Ys)!P>rL>CaO4&qT=52Vs8G_t?qO$AF{z zZM~P#(`0iUS)N94{7>fLF-YwSk4KZCt6gN(<^3qNi!7bTFSUy-eGXXdB1`9SO6?*` z?*eNZb%T`~S)N|7awAJ$L%;VeS^7HqT_;Q53|4Mr={u==pOdBU1uHimgLLjhmgfO* ze9-##F!@_P2I#*X8xZAK;C})fJz$>XzLR^x`%cfoQ*h52#(A6h$y)DV%tg_+O&kki{fR=e?}F>tyN4G1R}07al_=!J~c~gZArprO2u~ zp1S|N6}mi{9B zu9KznT3h{-Tz5>feY5RjDlbJkQIm57s`h$y^j8m+V~+$A4k9IWa$&ZIzE!6 zUqziCoT8AWCv&*Zhv6K~Ia&U2eqIZ`@O^6wW5qu(9un{&VBAFQeySW6lHW z2eR^s!RiOH^alD*SY5L8iS)ZpmVPx@`#xFvTyXTS7H3hwOTqCYrguFdak z8s9+vcjKGDY71HG+6Goz$kKPv|CrS!OTU?Z*U8fF1M7Fs$kMrAsEy%1@&xqgaf^S7 z{2#{8lAkc<7><5oJQ&+l%yBD@xUIczj=J-BaO});kLXE@!|^7b4OY%%<;?Se+<%%s zJU8GqY~FRU{2gGmku06Z`uN8dXFa%Z()b2&^i$&-$=*g@lZtsAs&?HH=)4Ybrfaj@D>md^7EaN#-g-wjr7WO)vNl^a?5z4Uu-Wa;brf1N3_iWa&KSD!1_X zdmOs99a;XTsr&EIk);p97*qaa={(*kf3ozU^n0FU>BH%Foh-eUe$SsQeI)&^lcn?6 zr@kEvR&Hc@E(I$$vUJW-%8e|&o_^1bEWMF_&w(s`68)}|rB4GZw?*LC$LF$u+ri42 zthy_}%9$*^oBm(eSRzaBrQdb3^bKGg_sP|HinN`mc@GkzX?20M`HELROxe!4bcphq8k_$aptc-{B<7 z&;2fbg?a7(M>WRWr=s85x(femi`j` zu9Kznd_eOCSvvPS%^Tr9IE!P<`35wheGypwPnN!my8nI@Svt?X<6#zm3^;PGC;x%z+^=)PQ&!!{(DSa7rB4GF zJkAVocDY^SkmZ>Jj$dstmy#pnW#C+G%JR2E&$~{Rz5-mxn!g(yUu?|t@EpI8i$a#a zADnlcEPXvV+hKWGA7FvOMg!__gMl7I?_=G*I_@2xRF~sPD77Wa(Ff zRo##Js-eT^d$A8;_ zEDz^ZdG^!OY5hr-=f1%606qLc5frjKoMYqBwytAfU00Ijd5pUMb_ZGdNpN9|)#ZFx zc!M$LK*b@;KM4D^;*g~$^O%44Bb>*09FOWO<_y-o#>aM0cMe$nuz()#2eRVxT1K8$ zdb}UV@^l5B9(sITWO;aftvJas-PaW!(>Dj6n;6H}MOK_0foB&u8f$IjHBS6S<2%3_ zOJvpEPyZ$6;dM>n^~NLE=Wj|`{%ZO-`h6cE%g_BK8gFqXg5$RsPXg!uFlG6~IXPnE7XE077WyP7rIIfeWbMDd{PL@88{)@0cAxmEX&edCdvh+pZyz6A? zoZmEulco1i@3QemmVP~T-)G6vxnIX`we@bH$A5>PEYJ49b2B}DKZ-2Rt@QAZ7*O`% zq5X&~5BFL130eA4u=<27{bBkWEhbs|3Hn_pOMe<%`mMG==f0VnU~$OuN8r5cWa-Iy z$QJX5=OOj*XdWQT&;30&(fnlTQ^0xG$TxFV}=2UwnN zdVE}w5&3H45#&EM9z~vRJevGY<2v#T<8kD78FMVv%rxfssd=|?19_J5MDm{)PbSYc zo=W~x<7wnM#?#4vW;~NT*LXJhJ;rm%^Ni<{-)p>(Jl}XR`F+Mq$qS5I$$xIlu~)Ou zxQqOL;~w%NV_>G{gT_gJE-_B}v&optn%+R~Gfw)p-#F>d)yCuKUt^r~+qK3?U#&Gx z`sX_1>GZENPWs_P#!1`P8z=4kuyHH>*Bb*fHP;w(Su>pqeqR(1anhDf^CV+qg>jO< z`;)QJWqQ&U*Xx2f;{qN}UTOZMjqXpzhI7*1Zu2B#!}X-?t4yzt-}l~o2Y+Mm-4}f6 zf(+0)t7+t%FL zw5+qcx%awEeQ#S=bA5l?+WvZ3`ue(>`r7*XI#+c!wXEv7F0-<2Wec9n#dlj)t-7YO zt*ND>t>v1g*3~OlR(SK;-p>BE0dEeB-`}*Rt+%sXHN!VsR&}@QUFj{IJsoYm$gBUF zw(BxIea%g+ZGHW{tFCL}>!1}$e$8Di9-xVh?rK}!+){N-Nxw9A_p@Vqx|-2m^;K(A zXLtLmruN=dE1O#S*M_T+$GQXgwsti2H1{@}aa>jJ^0xk_meswzZQcD%EBjY_r-sqc z#PpqNtF+#2?&|4o!ltX{LPC9QO{r^kQ&aou?v|#e0o%IF73N~A>1gh5?dxd1rmbmZ z-}3XV&+L7j%dyV$8f}#WjOWX3fU)v`^@we~7*$Q(%`4k1&+|qtGlvat?^@m0(X?uH zf6r?4?m4?hGD6dC>F-?G25&WEvcJ8Ir=_j8ALH*Ynp&Ehx;py?Y*LOf-x6(IU8`tY zjlo}StM|6`wRN{Pbqw@YZbN@>b9Z0Qs^0$6py$eZSiilwzqtz=5{V6Xlg;jGOFW(3 z+|o3Z?SRcaNeJwkO>9{BcG%0@8G72V!OBg^Ue(ps+*|qWFa~#*j=rW<*J83d&#ICw zRx&9-YumEb%bR+7JFz#m49t@$tnO)T#w3=^bA78Tzb&1_6CB-pVny`4R1 zeC4i3ANQ=nimP>wreJQ)eoRC#wyavY5)((Y8qB~ZRSc27)m`a!TYGuKm24oIx~jbs zTd%dPy}6>Hv%52`=96xs1zR|5wX!^)CmCezt9n3!32B0m2d-N z;wiUq%cNT+c(->Iwrz8Lh4RjH@-;}gyCElyDZIeUFvgX#6%`MoQ zX~Z!Un{mL7l$h+0!|jE4t8|3=*i1os9gOc)s|>QW{TOF$txYSN`}&jPXG?F81~)+q z50-sx1N5Y~E4>l!Fbq^B<5nEn*R=7_+?T-&+E;2f`ZU>z1}I50Tt2r$eFtytZtB2J z&{u7hzWse*!&bRNa5_+&(A3u5ybOB*jw{`m_oSeCON@CSOh=^8PECG(+LmpUtN zu=M?N*XAv(Xc@4wbBz^Gn(a7Z+Z!`Q^YW^_jx)eDZERg&a}GNRr&`TeX*HLc;4W?A^q8ESr89uu zN-uU+_f*Rs(<0tf4bH2HP^DkeL*TW&%{@WI7F=xL@@{1sYTyyErK^*dDmZuybl5OR z!&dX94)hz(&0jWB=zH1LB+;~W>T$M@P0}~;Qnu{CP|suDz_!@AwYMNSZLTo*c^F#O zxvJFTJ=fsK+1=E-s)CoR^oveR_1$gDSM_%`_hWvnx-ofTS#GVo|5c60?Pgcx-PpZ+ zPitM>)79B>{&k~aK18df$33NFshrlz=CwTcxnL)xT@b`wCb?OWKg|iUKz$t8^2# zXA2rcX&6gLUWTA^>$Z!i{pS-t;>0zu?M|~8!)BF9Dg?d^WF>J zIrj`M*dT0ewZUS;p4%BGQSEKGTZx?=ebR)BcpX}*)ioanz4gxT(vRoX>FQduvI(;W z4k%T##1Xi(#S&ZPV@m6?w2#8xU$(kElbo@)S8EEo0Ugj@>R~j9ebR@isifhCaes1a zV_jSCD!x%=c-fXo&ikuc{A{wXc}>+YI+rZ>aN`enuQU>I>|xStn!8q4jY>l>nN&-V zwsg|`9V%d@opuK;y+WxLJe|usyKygq_qmd}sA|$_1@0Ef6-Tw$={Zxn;jl67GP|@X zp(OK!%T+ccPEYWuMRKpPvz@0_RTK2nO5Buu8Kd31=G{vfwe>K>+3Ee)^`wbgzvI@F zKA9NsE*eq&otCau-Br^q4Iiwq!!L`fb!c)xdKr%$i(kgX)}_Z1UWtXP|rZUA>1^&by^xOrRz5z5jbVySv(ICXoDR)ID_CEU}ZCo zA58<_N?XnCS9+5-7QAxmNUl&-J#YlK8tgNVN*+rgnR(7NozvdZURB}fVaHm1GT4kM z?cC0=d5*USR`)e8uWCrz#`}_~v&#PF6DPNTMO62k=eT@Mop8e^AC4rSTHwmJuX2(c zyQQ{qwD^7B0ebSHO4iz$22@A}CO;QQ4j2R8;w8fQ;teqKGu#0}a=Uhb!d2k_hhsNC zqd8w>Zq(#74K1$Hn9`USxK=;nHR1E1fp1_AvNfJFy8J}8d3ApW4mFIVMR(+cjjeW>< zeoyk@RCPp8!Z`S_%nsr-ZH4D|i-HhL@041e zQgK2_OsUvd5)(ov)HfDOS~0+q*w|3QVv4DD<>XQ;OH`a(!jy_vl*E*ZlS*Pr#mh@# zO2vsKF{R>!l9*Dlu_PvBtt@H9Vu~edY$#zd#ZqNRmPC^8 z{w;m|#Z*tR7-0H-LkWv1rrMR4E5VeClS^Vs#Vbl;O2tVfF{R?=B{8Mq#FAK?P{M?& z-qPa%uEOp2`o_jmfMSXP71Q?vEQyT`B`l^0E$!fm>XqV^B_zGqNpDv2o-FE5EH6(^R&;)D{WRBSAX0ToMPF~E}8*igb^ zim7(x1hpfj;^dN;Qt^tCn9`(@R=m7~DHSJ{#Nvb!rc`V!i2)T$Vllvy*w|3QVv5kx zaS|S^IiLrATHl)7Q)y~c!;4pzFs0(;l9*EQijtU8aZ*W4sd#xwEKW>uLJ3nUHkQPI ziY2iaU`cFjC}AUOToO|%UQrTLDo!eiDHSg-i76E)mc*2b6G~!A#m15t zQb{Zp161;j4XGGlY1Y62u~<*btoiSrbVXBxQKJ!0`fyrCF~O9IlS^Vs#Vbl;O2tVf zF{R?=B{8Mq#FCg&aY9KYCw{rogu9K~xD#d{ruu>WTMIFp$RFY|kq zzsLSt^7?`C?m+T^z)lc-g>s{HetS72>@WzA)a>C-DEs zd%SEA@B42a7>|EOUMb#T_`-NwgLtnA;vKFV7_S|b_;)cX>c4-k8yN546PXPEzJ>jV zu1MC!?K@?}z<4(x9`_>^#k(B7Fuxa{NcT65CC1xSwta6#r8)(}v*P_#+4ddrlT2nN z-e-P!Jab))cMtwB2vTW0--|b%$7>bE`wDzvev1+BK2&5p49!x!yUOyr3p@8%1;exA zeW5JBQU95aXY7ilcr%6$%!O?a)M z{N}(H#+!aJ-9O$4Gv8zXeY$pFyr&SaQhRs67sea?Q~P~C=J%!`-te;hW5`ALKOXSD zit>A9+5WK|@iaeUsF(8lJYIzD9a$yb9{9ri?g-+&C5ZR-vi6QcyjaQMS^2Fj^UZ~C zb_HKYS-%{@dfBh+7sgdTk130H3*y~fA>QlC;vGZ05s1Zj^+CLAu${twnS(!^tCU|m zd||(wd@9{;oR5^>yUOC-jChr{+tp?97XMee-5P^|Q{~!JjQ|QcZ3Z9kUZ5Tw1ht(%#JT^v-f)}mlR`|kr z&-P9W;(fvUPwiccc-SPRqWt!j^xt ze)m@Kog6tZ-oYxq28_3Gy$`}yslA_qDfAty60g0iUrto%9f*os5dyKjsJPZ7tj1 z_Tr>;UTLlAcy21&-;U#CXf1qNw>#P_}J&u{Jl|V zZv&XyV>zC+J${CZrEtBc5HAtDp8EM|_`-NI5pOywGG1p8?~d|#c)iYJ@k#M+D~q?~ zSLt#3njqd!%I244Xji3vc?o%k?dX7Sc7^r+3cj!%qhCn(-|k?&6Gjb;w;%D^E5xgZ zFO0Vx@igvxf_Njw4UCt={C|cCdr`l<8on@I!>@6Di8tBLz3}oqj>juKp6W%osC>j@ z@rgc`iSUu9@de84-()hIJzhUv^SxwzmyP>Vh_{&)yl6eYE}Kt}|2C7^4-fNOgJ;G2 z6TD{gw5@v3PkdiR@%S5AVSbxYOYzpita$BZ`8|brip`jccQG0huJ?2m-;+2vhQ8P0H?SS! z5pQcLTG}s@;S1w+A>Om_al8Fh5U;r`-aUvntwOxTW$_l{$I;e$ypII&{ssF@*w1GX zuhMqwF6+OS;9FK2^~XW_$8D;4cW&tYSRzF|0z z8d-9s`$w@X-dOl5jh9c9ZMX68RT?kdWxfXZD$NH!EW3`H0w0E2si+-C%dQ*8W4m$t za=U#B&zcY3S2pfvRax)cvg7ZxAl|2gc*C%gu>a;GUZsA%2)=M!EkwKq&+juqyxy|? zr~~nM-mIebu7od)w;AzbB*OOo1I%jgzm$#p`w@@xfQsThP&V%O4^HR5&%&&DJImrt z$MwjK3WjIJ`$Sp1Jr~quPU3y$_qib6wRnwxrLlAr@vg#a6~*IkFAr$%g*D0b3FG}E z%*t=@*n#ne;pXZ#1;exA{q~Z9@g76GI>chU+k$wL%Hr)pyh`J_2w#}rix;Ki@AE;t zjWA&qrS|Scyh`K#FX0R0jTn-~`$7;eE*md*A>MqvucG$8xoo_|h}Q)Z+xta4b6q^o zIe_z;Fu%c=Z&0;V6z|LMh579a^7|6piuY()yb*}^sDi*J{83rFyAW?Z-ei7X4&r@u z?7;k;o>UnzlX-*x`Kii#rqn3VSa;OT~j*m{2IK<@3q(;!gy!jl*t@aFgz<>Eqr0T zEf?2hPNO38`+5-XV`ayqdoIQKbA|ji!xzR|o2|)g$I2M*8$mptKeD=x1;^i9`M%zN zmCb*{M%H8=LPf^=W)P46tyvgv-*~%TfF&tvFaK+~Fu&ukt;uwFynljI{r87u$IIz& zvHKeyuGD{*!WYJy`nsCr{x0+TRuGRr6B_2X{<2I4|4K#q@t$uOZ(=?jf8P$`Z7bV9 z_9B@7bZin+@jh0zfAk>UQgk}=`{y9u^05Q+d#FB>@t=zy5N{cLVSdLh!SMqEO*NTgc$4wI125m>{BjIAhw+}7Q2Bnuci{`;9T}g_ zf8Pz`m7Tx5h-dB{3=VAC!)*~=6zaQe6eZlR~T6X<0 z?F#!G0Bxx>k?))E zh3g&h*7SV*5xBM9sBFErBVJu8S~?D11z#Ai4)N5EM}v3^%kn#nc$i{KMfttAEWgD; zyvKrgU3CN7`xN3el%l2iEr&16Zztl-gpd9FIG)wsRj(ZwZ{%eA{9GZG-wOD`cuyeS zevkJ=5N}7_zVPL#Xh&NZk@T_>>g)hu+ zT(Ktkjbz3<8N{1hH!$9bD)~)-FN}8t@s!_FLA(pg;tjpBa(ipa;w^4W3r}K%*yYhW%(UKJnma6inpmO zzcYw;3imA8UUrz`O)iTU&BNz7=qnY)n@|?-v38tCTx9WZtL^_$_x|x!RCoUW+$1*y zM0@cPw28IX1TbO}69V{Sts5vopp+s7suoSc%?$}AAx#2BYHc71ilRjWR$besij<=3 zQh(LD)&&aIMb~9rb#2#Lbgi{6by-*a*nV95dA;VG*UZUqsoib=_$a7xvKJW8B zKjxe>b0>EKfBP_*F^hcbVC~}U_ly4yc5ZolJ7ON+t-|UxDLqSH$0vOR>(D z6UW~@5r6$x#=J7yUq(6p-Z*o3d^aw|=Oj3;O|Jh9c5Zz4UXA+}w!Hj4dmdwdJ_RQ~ zldC-nF3&#yo&-DB-yQ42^}z{_KfY7k^>+^Z%~DXvNBB8_>+ePQQ+p&FfBzWqcXb2a z%ft-qCVvMa{>nFm>-G~Jf3Ja=T;(0R44>m<@%Iaxrq{!6tvF!_M`$^y^{!^7$4XV}Hpn9qw;d#yqblhw>MLo$K#b_RH{S90j}^w>Wb0s4tLI&c zYZ7hDi$C|`{w9CR{~KTRydD|hH}m55UD&z#KK+ew+&$gN_qvF`rB`S7_e{j@AnXz* zEB}Ax`}dK2%kaR-cv!IhcwJ39_P@WhuFuPv$?Cky{StGP3O6fSu~xKhFQK zZ5cJ(?k(6k)fc3n5b>Auwe0>LiTEpkT{eF|xA(&o-zl*31NNf|@y$rSr}Ub7ux3HK zr6T#3!7f{Q4~-mN-b&bEC(i*k^pWBnaX=r_A_Md{@C=wBK{T#$KQ2fVpjg9hQ2*rhLC* z=V{q(gB_YO*jQd}PoXi%vfBkagc5A>x8KeSRrbh>uxkpej1T%*kIpOKJbZqiV+7Q( zThLE)ohGH-g^sE0{s!g9o%j2dIMmC-J8s9ghTp6|Zn7IOJ}d+Ee)v1M#2nvFGmvd-1yeUR>JyL+`HM z?|G%`MtZq*{fT(|u65t@Xji%(zbE!5k^`4`gYkU{`RNmLkGT%UXPy|843-78TjQ0xV?*oea%b)L?%NXEn=SXmnBlqG5;i=9I#s@=blbdw z+T6PR$cq#kih9ee8mJr0i#H7Bcb@i#j#icUG1WcKn6lPLRr2VVZkn5JSRA_~5>uY{ zhjKbtik#+dzx}!mB?B)EEZm^liS60hAB`Td=N}yZhrBKLgGXzTS5Do|KR&MsB?H^9 zQA865-mYCX^Vyj*=G;H0WbVy#U${X^fCEQl884L!-II=&}Fvo?z4S2 z&nr#+5V^$a?yoJGdGpMiIn!h7dxxL1I9vNC^~dT)*DhGvx4$sfcg7R>0~`G)UUB1R z^wTy*YnU-DI4NvdMRmJ3I55Yn$wz;0co>ll#;bCYFKqNo?|TsO;fz{0B{pyAy^F`p zDoy=8%AD>U>D`oUH+g^2HMe=7%j`*EeCL_Y7*3Wu5b-(urfnm5yIG zuC(N)aiyu#PAaXeE-WpdURXNmqQcU$#=_ExUn<1$LL4tFO?{`ZwDSAON!Kr(J{`6A zu6NytvoRN-ZoLb(7EI3>h}EgaclO8Y;xo0EEzVtw24+v%ed)lu3nyMHJB))R*Lxh` zFAc`Jbu-O=Uuw^|TtwP8e)_oFGh*ZV&e&6!J84~E-=yhiz^Ote#?;WVS)H$nIbBsK9QaqM>#&M(j&ba<~lp%3c z8JY(3w>-5GX_ZGv*>fArpYk-lM?GysAKx`MOwD-YGrK2_J4fbb^TiTPJ>*8!H~ur; z#K7OA{!i6?YL2`|BjMS$YtfJVKDPaul579J(2M@mUKlN--{yzhI?k-Z40J^8o;T;H z6lm%3cer($yMLSay*kdcgYiR+HP2%$v5_t1dd=Q)%>AJ|lvi$DokzRspoj15pI$fp zBgTO5U%1C_p>Pb~2#_u6E&uFB{n614=I{IGti1{~@Xq%Csju&)EoPmRc}%kwZNau2?9XK}>3e$>FMbm9f?`*njGGG4m#`J-C| z5ifq8-Uj@%*-G^MdOx?iok2<5{>8fJtNUe|rRtlo{|oD0LAkucmvDdc^fazOpPo)0 z``LK~RYjK$tiR>h<;px0DHltEm1iHyXX4ATKrLVd+yC<-+v76>>+;c#h>0b&Ty#J@a!X1Z~D10Pk!itgL(Y zqxE7#;cWBh<=J>)WC|0sEj<2-%t z{u@xU>n>E!=B&tG!ujyl#V;)$jKBA_!GY(`O6G598_f4=WtY9D;Jkl;Ic-#L&r8Pl z$CYMhKWg;&!RPzE(wv99yK-2=$K_2tkQ})`9@gK^0l#(a+4u4MxdYpSev>^{f0W$G zd{r{_FCKX}>nzGS@z7Oa-ECd8GmmY2y*=B|I&2j$nP2FYP6Xc_AD!ME_tLdTUpxBi z`p;x6YIXPCAf2v_E^fe&l-gXQhT? z)j|B5M@Ki9zsR3iqIJg7bbd9g8Q*i&@c#eQh(4U{)phC3cl))}x8J`8#hEe&tKaKK zJ#Y=KSIhtN#0Rc>(5t!j?%HS``)7SC|Ax97j#|$>^!xOo2k{p3O9z$=Yx8J&w(Eeu z-iRJy^qc1~+Tnd2tFH%dsM~m9SgxDqEUf!!-TbW_=SwU9c64d#o)f0mm3rGTru{k2 zZ=Tx&xPA|FJa+G0{3KiM`}VBij1l*K=iq@ciHtjf8PkP>; zr8P2TOZ)scIijdnvmJ6d2ie{}d|VwfD>hWQrLS%#X2nH#6Z3#q)A|$dz%A*`+r8Ym zd0yY#vA7>K-s}6!6t5)zfwqUUo(TglFvkPI6&dp^&B3TTY%RNUV|88iXBAg8ax+SQ z->zln2cvXp$vv@j?`ZV$>vPxb*|9jb=kQ|rz-Wi``>S1;^rb z2ZH)AeV}CY-cid&)nu-UJ&?IH_Q0>XGHk+pGB@b;7=LodKVLd=!idtcsUxB@Do5^_ zKV_-iIT1Ndj0dykV1Ca}x!#$$AvP4Yhsw=3+)=V{ojaN|a*f*{Ti5RHKH7zM6*kr- z^Lukb|Lixc|G^Ra^Rq?$&dzAmw5=PVJO=ag?ul50Gg92lNE_Oc`IwdRU%;$X`)RdC z_OlDMaE~7oR(ocha#P)cf}7@G&YLwnC9QBjs_dR%epF06BkHyvJ%ak9(9^M@>RIVd z^w&vGji?!Y0DX3}x8#<={E1%r$aZhZ9euM-@p3OL_XfYQ!F%A}f8{+eVs-3>5$Pk} z^-4zk^u~32V>6E*z3`T^al1G=}_k$LHco*2(@on18>*2V^Ajm%H?KJTwxvbAL4(6P?(txq1KtOITz z*;sdmGq(A&#O7=sIU=X##htOfwCws(zWoBfWjI1ih+n4G@Xy||_|np%_)?aMt4y=b zGjmHaKa;~bku%Up|GwwWEz$D%_klh)a<3#TcKi%-Ymp)Vw%iWLhXa5v0_lcQa-xG_xW%0f7&)$&SI36R?;u{}Wj@cQX?j%Ry z?yhq$`Otz(ox6c7Q!+lVBAM^ygkwS9-;d96)6`y+EbwqHE!+@}WyyE~rTyMfh*5B=~Tlz3>_DvWVl{<0& zsN_I%u#WL-a{T^LeK_MjK5KAf6V^-*dxdrB-n(({nkxoV8~cNGVRBTzcT=V&zb-Zq z$9e~M=%Ve($S3SRR+;YpiCZSF}O)#cd){# z+vX)R6TENw>jX1${dr2pa%F3Qhi-FgktP3B9pW$GXBAO<_Rk?)HC5v$j;pk7SQ(mC z8AkhpsP$m}gZ`+mTDfgbwzl?15}a4EiVc0jzdAe3eEPw01by9%MsaMWs;#ZfCf|8wg;j!}K2SAsETPbRtQ z-Cqn2{PGv(UIJF(sQtc~XL!ettlTPZHSr14(+k3@XV%)T3y+S3y63EiIg>Z!g|+LC z4JWhB){S8=5VCDR;CwvN@n%wQID*xz}@3Tio=GWbe z?m5laym%O!zdlL${VAC9!Yg&vgvM6-`z2OE+4Q^7@;L`$LkkKvVm5mw=v(PT9OvHm z>nd-be0$%lBFx~E{29FF@UOi4x4yddhB(`RGkCfepODNue$?P`hku`C79aJ?yKC}p zj}7LH#}&~{Czg%k9I&oVeVF%#`s&7_eQTN?@@fYDYI?e10P}snS5~xO6j~@(mW-%x z!n$Pcgy~~;ZY?XS8s#3DT`(B;5}~&9nj7kp1=C|(E4<*W6>=xUl1kUSWpMO(%yFCi zQ7l{SOxT86b7nQq@0;PBM2>v!+#Sa!65E41#2J-Wy5sJpJns$+Td6`X+PZZ3`h3#H zcu*_RSj_6&e44TSnz_#E{CcO)Wk0{!&l7XZc=??=a~HOEjJe;p?v=rKZC=RUD0_Dn zbsdetA1A&Z8~Wp}PUF|J_dK&TxnWffSBEtlro{SYt&;b#P!HhxfIj5%}ZZ!r0K@KqiO1FE*#9A6_q9l#}iq zk=1(l=fiV`=g<*nrS6~K??=mX^rxjP_q!XTXQS(>b(KF0Vm@jwe0OmgpX;JuIP12X zj&W~fE6#n6A*Zdwr)3yDa>38mm2AB$*Y}V&n72P3uGYf)LeI|P2*2=_@Yu5(k2MDW za(DLge(~MW5~Xs(y7KGhpqa0R-7!O5WPZ#QczDN*>zpuU>=o8U_Ro%{?qibgZy3i|6jgmF|9A zuarMEq9mTYB_6xzhR@zGBc8k@9&7Uw1>xPR*dEMM!I>U=#ogn1h*={!dG5$~Y58|f zOpe?)dhWopfi;i!oxU!a9C-8h>CShL>bdN3@xh}@Kz+c!#t7>>S`)mZ-080#a_gq# z;Lbu0M%EP%c?*Nwb8$UcaKIlc20}kSz#4w=y5Vd1)MDO;3P0%`?4L4hy)JNsC}5j z4=^rgzdNiWtgphG+2>wYtK0%T{&CrB0tn=Jf|9XMf&&>Bi6Sc(^KDH}{fxKbkjq{DR!+ zndI?>N75djM;ecn1n!f?AHYf?dEHE0!Op>_3tC@YhJ3ISFm8zr2{VnqruL8u10gqrjJoy4}G!xGq)}+2y=>#{kRK|*ooEfMPrr( zJwiRBwDLO%Gl%w_K7CAX*}CM%>&i!6T)4}^f~Fz4L4;Qm2gLKEA?>X3?s|7 zYVhYt)KfT5o3SsOZ@*5zXuN+0ara?V>f8U2y)PB58{cyV?SB=p!vghtvG--DUuD|DByFKV_Gk1qip7FV}VL5D^IX&4w{IlTj`Lko?fX_6M z!<|76r6n7^;dxBAPvYIbVN!oV9cMW_TUs~{&#D%p$Gna^k+?&dcpjg#7vi&neTlGC zSaHC%W`Iv?_K#6JAKhxK^M=#?yEFW>Wj|Lf(RgW-DhtbFdRVycKVO$JPxJ9vzJa>Z zk_T~JZlWKUH3{Ry3-+1L*q%P*!TW!)y6ipR&>5j;=5!<{+;8Rcg+t6K`ph8eXS#on z7|&BYkKVUvY-~?#Z{NN+KEvj{(`{LMVP|>hJ9}Q)V{ABcc)CN*)4P6c>>A#V*=qFQ znX#d-j!P$Q@ycqG8w+uFyVQHA;Vy6MvShrl!M#$>wpQq^C~?*b8h6=uH~U8pToYcO zAG4+-rBCICrSeOGYai2wcyjs`K9l=AdPl5o-cme|ykq~U>~+&y8G2!z9$hzTzu~@r z>H99Ph3^gfan~hVoh7RNcfJc_aaU{6GgPq;`uIm4(_t;*ZF<4)tM?Zo12jcNr z{yEwCg7?+Jfq3kdY^A80Iy|3Vr-z$!DSLdKHN(>#-CnBMvf9%8=STJZ3!ql$F19ad|kS8zdt7QJyD1i<>DKzM1RF7abN;Umrm5hdTV35 z2RBZ|6SAR4>hlNgbUycp?dh$(DKB;?TU~5EKOB|KxDxKGE~uw+BRcwKR)6P)cBc1* z`_VJA#DDs^w0z?Urk`(_UNho_+JOtxyML8+v=~~2S^FpXUf)l~c^mUfMqKvw!W*~j zNiTRkt95F%MqQmtvARcZ*|O*UT8>?&?@!!2slN=XweVArY-dTU>_}M_6X+gp1iTLe`i1LrhiN+ z3U(*)T$1+qH2mn=b$d8+#DuR|^N=_)ETw_+Ae5~*q*O0KE^rgq$pgBN2uAmohQ`%KJ}%63q!y9+kxmRVBtQr z>2-W=s?b}==cf9zJvZgAXV!$?{44y1*ib=jRV_a|pLWaONIqRqRW(0|zMyvO;@OJ_ z2hKqK9m-jM%dz@v;!3x_4*zQlt{U-o0<~oq4Gz5fHMCpqUH9#;jP1c4&d~#PZVi{! z_D$$N{$!lv?|$uBJe&0VS%VuU;7aS7oW8Q3b z)^{UPwWN9OE!)V^ur{>v>!}KV=`s_4>vVkI;*s9Mt;rYgSrB^ZUF^jZMtZo{hqER& zbk^eTOjq|=neKE;V`JM{-CgOkmbdn_tXfuySIa`~tg!FqIx3wdE!#w$@BX4_;+T$-IDe_{)*;&Q|AG_o`05yA<#1?p)d0(NoVCSU2``^A);| z72Zx9QTTG%=B~!&?Z~XYEz_~QrzK($eamX}FyHIT_k_1cGaLS%R6kkpp6c^bO?=UP zYsc!ww$`Q;-pk&TNln1#=6*vq^x)0C?Dp;p!-sc* zuFRKKWl%*;<*8+>dQu%Ldr~bcJ63jOno`TIv<|(Fl^qpfAof-AsiswYBaMShjONMHQf4LGG*Q!io|~Q-ua)(Rs`2kIg@nbW#*n$?QROMuuP#LmaSaX z(bS!)NTu3aJI+gev1-kPHJ6p!Si*huJ?+SmJxB01aa2tY8oxb*YHnK)6EFkNS^a%?G#^8p29$qnou=mjbF#jj5gv$oeQTidQ~O7pi>R6 zg3!d9(4Ep=OJjFxStiqg+U#D{o@w$L(PEL5>6Vq~#3?5#_(wERGh2#OW7~2@5REab zn`m|Ptn6uQ3(p>Vj+pZJ1s~pLLQBsa{lnvfu^B$h80`-X64v0OMg?PL>lJUDPG2!> z(6EQI&k#oyqp_{C!x2|?T+x9S--il%1Udn#WmT%Ibve#CoK0s8J8hfrK5x9Q9`Cg5 z_S!Pb8`D<~uQ{BvIJ2+dS-7&fITf6u-mr7L-tT_FXpi#)y%b5xFet9-%AAqawcktm z;_)w|Km9>>?Dafv%1nf3gu_wRGrhF~X9}~Q&8cY#O4xkmLNf|ztVp$Xr+QYdOm(+l zB31|0+3yT6lF}bH!Q_YR7Z5Wu! zFtqw-_wYtw@p|ghEt&KcIJ?4;Dr@ODQu_I_gu|-M9|Uk-c2um*bgfjd$1n+8;8aLy zRiQLNOM1gjg4C)Gymmd4##kOXU>64-7FQf8ho|buEMM8vid93C_jxmJcJ}m2wfmDU#;3@nJFIpzdL4C^`RgtYmk0np+WaER>w_{Ei=6U+O1@oO4hwq-3f|sCZc$Vx6Ji|8czM{2r z_!KqFf|D#?KbuK6wbWxWZp0$4xoc&6eL90K?DSbTmHNB7c(!Ay_Ep_xT3(j%gXly< zWs4Cf%c{1fR7VD91xA9-&P<1=GrhH=6O&|9V^1S`VQK=#YlQ1B8L%+ol400ubG>ei zMvXlf8a%%w87!c>;j+6W7@RtOMVlb}HT2*|@AN6S(qg zj8$i9&8;ieU2Ah|noHU;lXw-PJ;Mtb-J;t~lC=uUI=io^Z*9UL)!K7qeG69g_EZW_ z^rn_}vq-X0%$)t%RA(1f0^va9&tIwYFN`le)vMkj-;YCfiTU=;>d(IA=$w2GM3+8Jde8`1G&mQuboU zt=gb1*s|@7S7hotS1oI6O`A5mSZ#LkFuQbPTiRYK7`xA;g5!Qabsg!=)BXWBC3;&* zz0L1FZ7VrJccni6`FU7mH#g%14X3wZ)-Ynv;}rGLDHVW!GNXsv)dJ>YGyVpl)4*K# z1}g+yWG-ie9lQSAK-)1-azIYmnE;bzXM4BTT;J8P+;dx-EzomiXNGGGe~b-cz=&ZJ zvwPcYolY7KCw}ifrU5%IrvWUCI4m$j2Id6e`E6nSsg966M>VI&N9P@M(T>cQG4J?G zd3!174>3o}K_|6yn7J7A2MW(h?g~R1#^6=mnetQhFw^;Hif6r(fN5^UAMW& zXhxsM)TC>o)a0s4yd67L*3#3{*?rzwk-H}TbxHGCZEdUDD=_1&z>Hdn`zk5kP%$a% z@s{zaRp(4T_Y80PEPRaGh0s=evGaj>iFnuQn#rw`JFDy4CwErWH z@s&RKS~P#3_6LKn_%Z3j?_10Dp8A;QeHq8kcI@AZ*oWT_Xwrw@x0vfyBmI4_FLl!I z)0Z#dJ1dy~XlMT`_};I7f_;r+f3b6%_9r;|hv1)O!`C_m)v^CKd?_326JLwv z$Jd4Y{u%s9yT2L!z76L0V6lCc;y1UK@ss0?@cmUe($;5hA>-zm=V;r+qH z(@cl{7WXbg{!HK=~Pr(yp@q#tkh{qnQ%{mu9f`@h-W zro(tfi}pJs`)@|}`F(n38|m%C`L-56ZhgnF+*t`21(8k)|4gPnO zf!|@K`sceJbe!q=9h};qjs0Juj@+dg=R)NaQA0o0G#%>HbAJA%8vB69pz=lE^t&m1$|`hPDz zJpF5qeHUzhhIsHbeL?&?BmS!*={ueMPL!t-KW=#vk@CD3oK&Vfo1Fb|sJ}s^$JY%9 z`Ok8Wv;HPI?alp?=sw~%+emK|%6}VdG+xpEb{5XxO#Tgy|Ko7{8;G|A$JM{Djr517 zgLB@b?}(f~w?^XOyDZIS>|b;I%|co0kSD?n^1CnMZyr07znSzU&i-ta^{+IEce`YiO4n_74NAfRcaQ8a!Qz;-|4uY{oZmOA+@M_zUKN!jD?flKkD{`xtj|3{R^J>MUR#1nphtZC1;9sdLH zb$X1egLum3;d;Uobmq){Ov{kx#u(AEo?TE{~eL~ zA99XAjr8+TrW6vWJ|2toAHIv*Y$LsiuuUQccl>(B>EGL6dm;KGi$Q-cVxQlI>e}B2 zAM(fYy%yPjJ+i;UX}_h2*@iuAs!>6!_EscE+fwccI(q7^0 z)Bg$h4pZ4r!SQY!*ZIZcd}o}F|Hk$YeusCCca|UDj!1ny=(H6HW$`A+)LD1Qfzr>y_aPv${tJ0<4XyfYcG{c%Mn~FbY-E32WPfKQ zp8F&FJ&|}iob(*a??;`feVG42=Q#KC9Dnb@_TMo7RXg#Y%*OCH(|?Mb{kvg*J<6-| z;jgei0qrpd_A38Q$DaA^h{Vfx4VumPf6$4C_IwABj{gAt?ILLS=lfrd{Kg`4o+8Tc zI>+8m&y&yJMtYw_!fCLt!9ML@#JOIIeKryIFS2X5ChX_HE7KP^@g0W!Q_xt2%5O=e zJRdmYJJa(WtY#bOjYVDkANZ(p(!c8Xr~OVR-bYcszd@OiEXXg-i<@4E{FKD}&=}VNVybf7FSW{-2HP-^q(xe>3g%rnA4mj<@S^JO`sR(?97P z=l-I|er06;{K)?0k^Qxi@~m~r^Bt6*?_MiG{w&WL8_)ZGJf(g-2O|D%j`-W+?3bbL z8xb=l)z8CDeX~68Is0EkeO4fb)2#i=*zZLBvdNVGd?#L}Z{lR*ZzH`fyB6-ievWs# zAMg84JonhO<~jcHGrY^}ey_iOrf+{S2RDB+?emi3pZUGS#l1a#8_IVV;&bP_?T-CL zi2pxOpBgXs!u~|82iPT4p7D-7{a-NNy0_PZ3nItgiR^#i>@Uao|2gz|`Cp3ITCh(O z<~IU$`xN3~7Tm8vJZB;vwa*6F^8GHS+v7afy0M?K`;6~$r~KUC7uiqH*xyY3-5EK4 z2RoNNegV?s@4$og$R@=12=*u8xay}lWvuxP<;?H8Nc%h!*?&1=e=0kZznS#6MD`at z@q7v8|2Fzi8SI(=y*A}D_??4UfcdvM_S|0*@%MzY&kHU5xqWaw*l+z^?)xkD{k`qj zpNjT42lkYh{{u0TV5x6^l5bz)b{*Aed}IIi~38J7RYJ-)9Tj}`k%62`}OIB?6u?;Mo!uMz)v9M|}+cdIn{ z#|ynP5YJ1F{})l;>~nA%w0D=&o^x<)Gk%aPIF7H^vYTno4Uzrxob)XJP~`Xg{X z<8PpTiZS?CIQc#29H+l$o&CwMpAGv;Yrh`MZ5e)YyyN})-{IIlih>TIJX|uVf4}7% zr~h#i=z$yNJJjbl9RGJ=e>L_`!%?R9E6%s&f5%1cM;;&9|5#+-^p6!mdb7VUvafT1 zcbP^Z|2-H}Qm|3{ndW?(#5Zp9$^g z^o4%<=D^5@-MGXzyPj{X}R-*S8rD+1Jfx_9toAj+epoYxjqo<6lC5_$1nZ zOA6Kht;dJ7{5vXp>zE6Xt>45pQohad&@cg zDvqCv<{;E)?>B7@lx+H_-37+ z3{CMKc8=5EdT0L`#J>^t>_fEwOYDCa`^<;?yHK{jarUo4`X4y^!{agQ)!M-S1n+tD z|G$I1d;WyugR$>%?EeDxyhoC~znb;jIf1>|58Kb|bFMVo>5=i}48Okwm#d!H50sNK4USPu`kiCJwCAo{bv>MEyk`14oa5ZT&)NSZ?0G*6Q+$yB zX6HEV`MxQ$+595=UCw?C{qb4&)Ac3S0=%E2{yKdAi_V9WBlF`Fe21^exi*(`aIW_` z25L8ihM2>R`z_XBcXp{KsXWe^9%5!jmHb^acbQECB{x|+&>W6|5e2PWxIZ0 z8rsJr{(B?w9B>+t_PZnL?~LpZMe_SJ&Tnl@KPj@`64{>`sV}~FPaD(Ejcd=ue_|y4 zHzLQm*4M`LuSEPWcN&DpIhShV{`Vv0&yD0a5IOF5OzVK@&yK{uEn=UH#P?!kzcylD z74i3Uq&%Y|_WuyENB0gk#&>xnzjq@2VREECu8i1!D$?H1M(T4yq<`FYLXf@R|K5%q z|81l^oX4~=-jYc9CP(uBbR@pPNO|~vL2dMRPvrQnNd6~B_VITAoOJ z{}HL5iSUuIF-!s%S$i_?fpO#fP;7Owbc{Y;ku48d`ZU^Goh*F@IQefT0J8MC;DjwF z$9nN~w6`CAlV#8GIbq8=1Xj#s*=z$VX0r4h;38XRWa;L&RGeh#oQo2e zGr3K6xQX_!;XiC-*{=py*qD34<@S784_5qS+2ggLLHuOtc>SkWgn5h`Svp?3=@na@ zEFG^k3*skBzZ0BbN5^)r!_R;##u%N?D=9Xz(mn@P-IArhNc$5_TC(()Xm540^uu7j zr<&VaVC6-Y&D&t*MV9^^?Z=w5Wa+=7z17LmM`65FUSq-K_Fnfmu<|9#z6h**$Z#*!$PD4le;$oNWB_c`U_7R@$Xt#YUFiKzlBjv5}=W z(cbE0={;c8$$D_oE@;WJxei=z@3ZoG6vac9&COuNLzaFE?N2fBkfq;Fd#jVBZv!hH zJ{zXI$g(LD-Y}a=@sMSo0xKS}bS5jBfd88G6kVLKl`ijyq=wP3|bmOc|)GztGc+7FcnT<>yYY;v`GoPWv22U* ztCOX7f{Spe#*Hk!2V87*vh-`gYA>>Mw#yiHG;DX^C;5hnnJgRDvus|a&999OSvDn* zl5ZNFEPV=C?Ms$^4p{9=mVQ3%&w*oXWa+iEw>nw+0c%VsxN0C=_ymHqShoFzS!1#F|tQg2j`vF)nkfnP$u&*^~$WD1^h?322eR~L>h>atEWHDq;2?pG>kY+5mdzTlVk1kxiuM

Nzq)BmMr~t+FPA0eFs?eK$iY6bvp)< zrE^^&oh;p7OW3jQsI`RE-L=GXNUJfBEI%)TH3pKU9|n*4j42nN$x0qEeU&Vm7V7_L zbh7jv)Vb)!MwY${thyyje-Ny?B};#V_MbB`kflFHd#jVB9{{Uv$w(4RkV{G9A?3atK5mVFs*xLCke30BNx z+3;S6VkS$UMtj@O$WD1^h02^-D_awMV8GQVC6-Y zewg-OG;xxpAECX~$AWP?SCyAxT|H)v*MwZPfV8uq3o}#@iFIoC{ z+FPA0o%iun4=v#2f7x-#u~`FF3}mIf3al8&(tBxNZ{jCQ@29=h$5tLA%cLbs-%Wd~lcgU3t9_pXC%R4A*U7x- z!FGha%J4g2#Y2{#_rZ#XEd2x8uQqAP()mDRvDL}aPXOy2Axj?zF8Z?ZLzZ3yF19*Z zdKp-L$kNXT7p*aV$kJ=U#a1UvpAVKFvh)UU;!5ME89ZjKVSc`qeAk?_WZCbc{a1|5 zUh-9jp9EKY)$l>;R~zQ%Zkk)k^7E#nlcn=>5zVb+>FxmFsWD1^nS4B z6#hM`@*>M-6IgkXrEjMFMw1s=`WA4p)ydL_z#7xY((eUV*!vz2f)m#npHGvoH+<0H z=fH}SEI%)T6(?ExOSIo){E(#|qP^A0(%%GE++gevgOwLqHb=n9i!A*e+TUo>lBK^- zd#jVB=Z^~Oge?68aK+b+A3i&fDH^qXnV8>`sJ(r=-?)ydMo1=e|VCs=urWwRZu zyvWjb(*7GJFS7LeXm540^hd#}Te9>g!8(r)f)lqIpD&YdGt9p`N!)HY|F|$tviyt! zD^9ZX6KMZeCM{X|iL|#mS$YbbYBmcA6M^?UHM35q9KzPS$Z4otxlG{8eH)m zW8Vu_US!$ygOwLq`psa?zhvo;Q@8i%$kGouI$8R&V6EB6(q8~;%|@2~Guqp=8Cm+v zw6{80`rBajPqOs9(a`_f^arx^(cr{grcO=-t4_$W83$IKkfrn4hoWsJEm``hw6{80 zdKp-AEB~H4akoi(zQc3Ds!y`gE^&0S^vl7jPqOr7VAUsCdNb{9y^*D_puN?}(ys=q zKFQLzfbrGt{&qWUJ~VYpmJR<#SM^Djz8$RkBun2(`|lc`Wa)hVvDoTl>5qWN>@fEH z`(Wiomd$Rk@*+#$M|(RblBGXMd#jVBKMU4*`U1GnVwmMn*%e2ok_GIa= z(%$N1>95m%r?DqXf0OoBCrf`HtTrM`FE}1;bdT{3S9BmhNn@#&+r1U;v~z@ zBCz5lOTU=*e`C^;r7xwu)ydM^z>1SBeLZzMhLELic674zTfyq{Wa)Q+)#u65hiGs6 zHd*>M+FPA0{SmO@Bun21PE0Z7<=?26?=pPQ;pf1~-~m0L+38ruTRwqmE2Uk33?5_nU9|~DEo1v>LWa(SLDhpZqt>DDN#?Kw#q924Tn<1vPI$8RC zV3mt3o!@Dr7|7E3{Wpq%EPWsCA2Ioor9Vk~tCOX_2o64bb@Vr=$4nm}%l-&h>(vjy zij6EAK4h-g$kOw`MUR@;$kGdFZ*{WtlflUx69ZX#8Mx?gjUTe~a&WQL$kz9D%$_Vq$NwALVK%|r7s2RJS9tS1}C00ey%3}z2Sav#R0?oJ_*G}R@&>pij6G& zM%vr!II?v9t%R=c$kOisYdtUoR$gS;Yy&GVvh*Faf6By3mVPhotxlHyFj)P8-!r1T z$g+71th~t5chlZpcaWv;qrKJ1(w_yZ&dJgbQMY3hS^8UGofmI|6&qPL?|~H?S^Dp2 z|Fo$Gvh)vWZ*{Wt(PP5c$kI;*D~3t5;ln1_$g-IYPW*$(YYF)u4L3O43|9PPrCkA5 z{AB4Jv_EM4kfnFg-s)uO>%qDvB}?BzJ#JzqOMeuc_$TB4afe?6D^9ZP-vBF4vh>5W zf7bXROFu$;tCOXF2v#2;OCNh8bh{2AOHYA|{@M5^OCJv|wmMn*IbhWTS^7+H;yL4I zHdtjO%Vr)}Wh6^qK>Hz+mMnb{?X6ChemQu|^TwXv-J-n6vS|h@FS7I%w6{LV(mQBx zb+Ys|VCBW{1yf#R+4O>y7g>5g?O!l)lBHiud#jVB-vU|~>m1nuRt#j>+zVC= zWa+zT-(q4QOMj5|Rwqk;9IUbNO|be5SvGk|wDpU|=P2?|4JXJyGkgkI_s_{SM)oGt z=3mXuG_cA-md$x!m4z(*0&vkwCM{X|3~;g4$Cb`{Ct3O-u*#k{7Hf}}O|_ju-bwwd%Pet(86^i73$pYrw68XKk)_{Cd#jVB-wRe-kflEY zR{fBrKL%F)kfraY{Vz?vWa;~8Z*{VCe&?C;B}@Mqc+3>z=QVKRSBBpJD;~1!4}%pC zS^5#$zhTmnrN2XatCOXF2(GYmL{1_28Iv|2ocOij(bV5GJPxdQ$nsMJRy<_sr_%o4 zO{0w+h9af2-T*J$&f#^w#MVk67uFj%pXr5~aF+a@hp`a86@ zI$8RMV8zBS!%$vi+2nzh7g>4%?YEk|$kIpC-s)uOn=P5~<~vTRadpe$b0#3YR{Hy>g2C~w2fE5E-`f70EU6Xb#xahr*Wpg$3Vyly- zUklcG&F@)LzGT_l2v)vi={M8<|CqeU(r=-?)ydND1nYbuOTVAGy`CaV-wm#qZ2TXg z&HEwC=0ocCvkbEI{F6{8zcu!w!73M7HvBs|m5VHWEbZ-Q7G&us)86W2=_O$GReran z@*>No46MA!(#vW8I};~adKK-hPL_TFSanF2KA*a+L$dUxVAWw8IPrnWtBd-78|L>7 zDrU0Mt^q4%vh=HH|Dj1smflNytCOW)2iE7mo50G8ESt?>34!Fes1iylYeh`7g+bT$g+O~oY-w_9&_w}M%^>_u3shZF*a|36+c;i-Ucgvvh??8 zA2WW)(tk&LtCOXld@|xJuxmE3^vU2vuJJR2HY1Gx2jX>**h zAh|xx$Z36vh*itZ*{WtgJ6v0?~{V?snZOTrTeuVZ`CrkewxZ-#dLtYW`J;87Zxcp;=Cs9urK8HNUFu#*i zv61Do7OdFF(r40s$izmLKAZMdCre)l*1F;4s4HkVVk&v}xiw}8ukZ{lwQD^9X( zI>CyQEWL;J*O;_q>1$|jb+YvJV6ETy-Mh+*ESqb=%8M+06YcHXM3%mp_EslL{}xzn zN|t^fb=#(7>5qZcC!YW-HnMCEfE62A`p>|6PKhl24eBSDd7Lc$2)Ml1wC~$sT}QtU zR=#A}e*jj#Wa<3!xuR2yAF}j3aIw|N(#L}JSuk1p60q_mOTQGXe96);r~M~PzGUgk zXm540^iHtaf-HRvxZ?ks{=@GkRt#j>Tn$zXWa;Z^KV;I9rEj3U)ydK~gEdax4lX~{ z#6JX1eA4hvhYy02DWj9+=S6V&X-0pUHvGeJY-HKI?${irO{uXV%jO+$V!Y8ue*!l4 z@4Lye84FHKFg7XjM8o63sw=YW%fPBDvh;G=+i{O9y^8i$CrdvMto0thb6I(jWm5}Q zUS#PrX>aFrvh>-sw>nw+LhzWM`&H;&4AwJUWZ5);6$4p%6Id~jrMJ-jbW>Mk>20*P zI$8Q^@R-+44A+5^A2a7HSvI$V6J^Hd5N#61hAf*MV8uz6elJ*YlBMsWJzolhjV%2^ z+FPA0eIHoo5n1{{aM2{=hb;X$aIw|N(q9K_O-`2n9=QBW*$Uz6@M( zmPyO+30J$2WzzyyyO5=~(Z0&0B}?z5z17LmduU&6?8(yC(BA4~=^MamN3!%gsGn%+ zkSu*0SaZ{Mu*yP~%}%h&LY96X?I)Yq$kOkpz17LmcY_rhS^7chcHSgQe-S)pfoYeQ zz>1A5n?qp5Mwb2>?d|wOmi`9qtxlHyHdyO$eiwRCugRAzoA<%RRwqmU0Ib-^(!EcH zv5}?cfs1NPy^*CC(BA4~>EpnvH?s6o!9`PyAF}ikaIw|N(kFxEhb;X9aM4ubhb(;t zxY+7s=?lQ}LzdnEE%isbn6#U~s#~&bHiOmf zWa(RIKV;gDEd5q+vDL}aw}Dj_vh)Y3+dfH_z89?XWgl3vk!ABFSh10%KTUfZ16le( zuwo-i{~5SqoT-O*z{-m(oA<%Wi!A*EaN<0Z)=MGnw@sapWs?Wixj>eF0$6kOiD2bR zmd!Y@@+C_zqWxc(e96*JrM=b3(#yfBf3oy*z(wa9KV<3WgNv4xtl&oI1${At4vgNtT{EdP%}FSa^a`r}~5Lzeywb^8VRWa%$} z6SIu}pMl5h_WbQ-aNV^6@e97iuz|_9=Gvi8_#5L(LAG*Ud(Crh6XRy+&A zisw@5^JBjKJDxZLKo7pxc#f{PZ#e0#F&p92?L zohpo&SvD`y#(q|K2&}S`W%C+X zWhYC2gZ7sh|77WhX>WD1^bf#_lPtZU6uP}$CQDC%6PFwRnw+V_@COB1=C29`i%v=NYhKAj{@iuwo!f ze}VQxCM{X|&uDLTvh>%$ddBiFxIAs@=Y4R(@&{nWKvr6Qv8G}mOV0xrH5or-=>@d6 zI$8RO;EHpNeGxd3F?=ey*>H)&6TymyEI*ULiia${lJ?7uAF}kxw6{80`uSkRGXtD# zF=@%NnM<1rqw}3Uiia$l1z^QPmcEGg_PiiVznJz`CrfVvYy2cj@1Y(u=Q3IPda$1T zyOlO48ym80?gW>&n)tWT{x#EQc7f%SEc-{mDkE9?V_=n$EPXfaR~Y|f>HBDJb+Ytl zz+*mbVt5u@euYW<99a31W&a{r`I4o-MEfrrKV<2LXm540^f$q}Z}uLzyv^kMJFxoU zhhW7(R@$5iVGLyH`QV~<JwwDKD~Y_+7RtFIoDjwC^x^k)@Z= z-s)uOMD;s-*5qWrs2`#d4?0@vkl`BKQDHXVSL2x#V$3BTf$!KvxZaT z%MGL2yx3nFE+b!NxSTxAa20v6;VI;)hR-3-F?>GR7N(Z`1*79}p5SwHvdUZH=w#`W z!1~;rEWHw}&&|owxm?ia=49y%U7wqirOyTHoFz;D|4W=FAm;LJ)34a3i5|mjM=|Rm z`EfJ0xOH+K(^`9eJTDuv>Vdc0%2yem3&HC1WZ5hMtIw0Av#S-YHfhPy+0}}zPL|#R zuK2RCZv!XR814a=Uuk$XSTT^5b}d*jkfmQu`?V%5S^9d~Tb(TZMzHz=S^BrA+cBIh z{V{Nbt)Efg#8oCQo_FPziyS=#uK234VLw+{$nrT6tg?`$v;P-eZPJpZv;P-cohErPEWHU_(Qo`WgB2TDHY>o2jV!%`_5&s@S$Y@ktxlHCzNFa5(r=`0 zVGy#Z4_W&Cw6}Fami{p9txlG{8(gu$#J>-mxW@1yus-h~%l-|p;vq{v z3|2g3=|^aPt?@~g{toS}PL`enQ`HYy`Y3SGM&pMp{RD8a)ydLRU|pAyrB4E@t@)9U z%0iY6KR!`e$kM0K-qs;mI&U$nZpqSlJ5OaHOJ79Ywl!HgFI^N{0qUgudI;DO4s)!o z*kp8`Yl@#NKO7Sje{_5(y1}HK=-5x9z17L`GYzcx$Y1$aa;{W8lckq|i?*7yWa(TB6b9Sdr5Aw9zY)fqusn|XtzpcG+rt>jZ!^rgQd!)3tAwtykd@bD+W(bFOP0?5 zP;7O#Z_I$MvXEuJkh(1kS$YGw;tu0~8CbEAWy5h;v5}>(p#2d3!$y|g0WKcGf7r;< z*Mb!rS^9OAhgp30eAP>b8x@(!T|+*lzsqaBRr3VV%q7 z5wPMX%ZBSQ#ZQ*L8(j2V@b7isB${I39#ZM z%YH0aagwE_`$b^Y4_W#$aK>Wlt8He(RQ<X=mC?KEWMfb zRwqmE0;@jB(tE**^IEWCAj@VGSTT^LZ>If&CI+(fEwr~fS^Aw|{rw$T`Yv$ML>T z`h(zNtCOYg1Yi#C$)uv>XWdT@iN|wHe_K%sgWa$^v z-s)uOO(H{qGH*Kt5oYaVDNJd_MVU z!+va*S?97}LjDJ1!*f~oJWs_dz!lbir=zcN_(X6rW$KNrdMg5#|D*BG{+T?@*tp}~ zMCj@dWTl-1R(~K%ucZA!JMb;bE%h@c*xQhg3JHO_-Fl8JZqSJ zOmVvXZ7FocNtT}m+S|{4$kN#-^?8unKUuemlPvqIz>1+CtQg3$;n=7c+;Q?2=z4aV zEPM8`#B-)x>|^ptmJQoNKBMhY^t?$MZI@!JyX|rw{HR=H`JWB0c)|E#-%FO7wjj%9 zHMsm=jLllG;v~!FYOvxYOJ7g>7fo8S^bNGPI$8P_u;xv&^xfd{pBX;~X!GwO%jQ|y z{HxJD{7Q~DWg*L^09^i(u^EkDDhpXQ39!mSmOhsDKgWOA$kI;+7h9byy#!qGQ~ZZ* zJbo!JvTVx0%8M+$oc6ZglBHMC-s)uO=Y!S0Wa+cPYTvnF#Xy$Le6V65OXuStMK9w& zY-H(6z{OT4OJ4?73}oq@V8yV-VXr;Yp6N^_S zGfnkPjXjO^ZLQrs_1!IvZEY*R>{a$;*7OASombSa&UCdlUs+GJvMbZp=o?gacemAl zxvRA&Q{SEG?rvS#QQy;=z9Q3;&91YttNVXox2m&qWmgY^>s;B|(No{Nva7wZr#qWt z696L1bTq-fJ*$z){f{zgZ0qdEmXC4K-na%;*SNergQ(gv9m{)Kd}GyZSS2lu9Zjgu zD>4Xa`LP|QTbqu3Fw>Fly0WvUzNaPAQQzK}J}RqD6uQ0{?blY{*p}%U)@C+ww87L6 zU1-z#&h9JfTTsDXWqM^h%f#-|oeBLkwY1l#8{5)o;dGayXVOhASr0U2maSS|-`T}h za}%&)n$U|@XX>xWT-ohL<<=egXZ2*;snTt&tmT#r`Xo!<9rVaGQ>)IcZ|bODo`IOP zL)yZ#1GR_g{HT$r9+l7tJ(4utl1X2IlKNHS+h(^LR)v489qP+^Q+ZjpU71FNXrhts zdvp&}cC~h=S64Rn^mMf@Th)^Z3&dLO?rDUCUtM11yh{F(BOYZ7+j{Tp%Ct9j_hg0} zg#Gl(U5%ZqI)l{do_dZQ?VWBlxvs;Mwx!@(#$78ps#JcoxocrgWw+Vgto_pXqexe# zBeQ&EPitcj$DG!V=9NLv7^~8a9raD2!equVIy?udz?Mh+YK|UY!?2euYwf`)?x9Ng zOOfiRs~J}~aq9g()V-=bFz2C_ojtAXt!p#ckEUBYTM*hR4y3CvlCsT)B~P#HXs&N* zWE-Q%>7$N!w=Tz^w6eXv^9rxBV`WdK^1}IxD`1=s{kZ34duQt~|Lsi}J**34(-ItX z5;fPeTV^}L@y%@~)e{TupKDjt_gvYTsmFL&@8-m)k*!zR*0#F6zOktZt+PDHfT_`# zL0s-Je*&ZHp2jeN6KnmlRn37TWJ%L*RDYn+xjEU>t8lUp(^ogPwW9B$t-@wGR`J3! zpcNx^#-9}Y)A6Gdu&)?Xx4!HdfRVhlxiyU_hJ|LvophF?s42fbP|raM6r87q=^1Q+ z;D|qb(w_5wpoY_YR|b)F^)xPP8+H^;(18;sJXSfczP@=?N4mb=UkVHx7BR?U%ub_* zmWNJQ@75SZoM)b$xSN z>+%-FxU#*oEra#VAK`6fb91H(mTqRIpES32w05^d4w+U64vh~JVjgc>nGXDL9Bb$L zq;u7>w$@Phr=M&GSi!b~`ps(3koxY*m*+Dn~ogL7$fTjjCC7|k>07I&t9Ec%RR|ld)Re>15 zxzmDh0y;aOX#q_QXi7lUH35cHJvk6Vs;&-1hpGZGfODq?;RJMcK+^)68qk!0s%rua zsd{oChE!c0hz?Z+VgTn(3Bn2J?0}{PG&P_p0ae!o7*h4*Kn$t6IuISI3d8`;tqH;j z=MS{?M@h6CvcpopR8EV4d|SJ&JJi= zKvM&n5>RzbfFV^+4#beEs{_%Ysz40j+-e1OPC#b|G%cX10aZ^4Fr@05Kn$sRav+9O zT^)!HRfQrZ60_vScv@XaeeR+;HT6}B^W1>W3Fz#ArUf)Lpz0|BhE!b>h#^%^4#beE zs{_#`id8B9cE=y}-_R(}%XKUl9rC%qYuXxikD_sv{?TX5rZ2Q>PN+hg>% z1V667H{kDOXxikDkA1rS&i|6Ew;DiyO83qgo;MTw+Gxk^O8{~$cd)(l6VH1Zzv=Hd{O}n4U4>xX_|CzN z)@9KDA9e2@A60elfA7g;LWqD92T%j*NJs=sV&tZ!>PawzfItxekx~Q_5GX?A;;q&u zBoi(IMFObQ+LYT-O8HR{YCRqclu$~ML#a~hvHXyqTI=yxjuj8}@#ypU?6p2KD?6c= z=jrpuvtMG~>$AV>yT0qP*Is+io;})B&i$}+{p~%JZoiH&mcLsA{x-m0m7L+P{0#~C zoB4~hzY86I2jJL^?{oNjxeb3mg&kukv-_fl@jIf($ol5uANR4o{{+qT_tMp#HwC&j z#Wx5>uD_>#iSY*``itS8{H+f7>t2NVvH-iuA0Jb4{Y^q=jK$cZzb^PEfBblt*>xP% z6nh@;^=p&AX9E6q{+s7L4?VKRp}GEE_;uRf6|hx(`C3oc-^^0a!_<-5Iy_8~WSi41eYCvOxQ7 zhQFPt82#apO8NUeGPw2affM0+3U-sf(*U==V}Az<F*|Is*4`JpTccA+w{J{`LY+ zv~f;ocH=(&yULb};pA_x4{15?%I*wKc4Tcg+#)i6weJ98!GEctPCM6Bb{jDc!Xv(z zhuk&v!1Vz))`Oeup2+W`l47QawgO?m4Bnp zmG!7tQ;{*OJhZrG&M!(|S@_E0n$W%ZCApX97u8;#-{-N*^Lt%+MSkJ6SLF9BzaqcK zZCB*Sr(Tg?a_?o>e;M{)mf!39m*p4!=(0X5CzW4^mX2j*dDpeW-*)Z1NL6E2X2)d- z#ZY(ENH39iXJO@(vtDf7Ro;)$(~Zf9SF$d}p5m_xP^It_~M;%nT{NS&3s!dgZ6bF_ ze#yUf$oHC=+p8;F*|DzRm2l77dX0-UZ1r;QesTRJ*)N3`ucgmzOM+fe*9(%4&rl-c zkRr((7PMvzAAivzhUU%Qvx&-6TfD}|sj2;5+u}u*v7|6!=ye+jbxpO8AH&L^*W`@1 zvRLNqWLSJa{3!o5RR)b-wXdALvQ<#m0^FArZGy1ee{eV2vNhjm5emxYT% zm(>;T>mCb*;uqtPx*NyU|9cPY0dH7-k5Knul#%I;Sp|n%)IE`|dwljT)IGVZvL@nf zNmN$vZry*#KmC{gn0f|dOI9^DjBRKU8^=Oo9geTc)m!Yin*KGm|8V(Epcu_})|25P?5ekgNn zU7{m^c^)2CS<}v&Ir6dT$lal?@RbY0S9OdwCSSX_WPL32L9fT54%v$zZ+ir>Zx+?C zZG$b-m^C)$j&B^XXMDRrE3h8XFS+%Iwf|wK$cP`~eAl?Fy>}hv*;r1F_uCOa1~o3v z@vg&iKX$-kF7 zV<_{~AeK35NxCiSexB*Em72cHJ!8^s)ST&6M%RVH1tZ(lCEzpB#oHL!_4_Tpb^Hce zk55_G{k*dmKGf6SH`?DfF|{uhO*9E_E8#Wb)fKGF3O7f54mWr4|1OJMI%IgN2h;No z`yj~(Z)BO1Q-1RcJ7(wi>6jgALJ665y(6J;pOqbhJ;J`4zP`m+?K#qG%nQKbz`e<@#>nN^?DDfoU#Y={HdwC z#_h4kDeF;(2qTHc2!0HFNdDr(-loOdy!^Ts(H)=gk?BI=FIr96p=@tvU1%ILNYj1y1 zSyK?IT)ik%IeI&0%t+0Db*VhHJJcA7PO0>ELn-zDhMF43CB1jBZvgh4{o?GCjc3nZ zSo>D{3#j+YstVUQHkIOxLQ9Jkv+(For6lyD?{L7Dy%{Ln0OF z^!bnV=41cg%%g0J=8N36V6D^Ra$Eh4i5rJ0-nQ%fum1UcEj@1$vL;@+ip3i z`(LejV?*b6{xS7Vw{fVc4l_Dt+)ykz%u~(kem)Gd$DJ7Cvs%xn4IeLA>CA6DE;^4J zIxcs}#^mDlp?!={T4VBA@3tYXI<`EPRaV-V{6na6$_cM?dF7dde(oz_#s2o^=HQA9 zy)xi&)0&}u;ezHn{CU=!c_(uWE$9E!>oulOer7DQIj5!d(DDxDL(5AJ^*NlKt(qQB zJlG|MJLdf&O=W*r*&`VmqCNDpt<_qEBjlZJJfnP=n)gCY|B!WuIYUH~&Jl6`7zX^x zZx26Dxc4jVaAxsxhlHA9;~vFz>}JdjRsQ@}mq>&ru8j<7yr9Axf3R|Ovp=)N8qR*J zuIR*#m8&~=bw$k`{lD826HGeUuCk_sS3CT%d#=OTFV?=jr?cSk??$G_a=LskyyZxU zu~nY>W~lDf6`B2#-z<-<=;>8XNrqyt)qD9hKkzoye8;QXawIcWe>IMv!ql36*9B{F zR+^n0-f$e}Jsu}&@w)9JE=nYx zYDb2e1}EwYYP)l$YdnFtf0OhYe-jDiXPodhWqji0hu`%!h4=8x*fBOf>E+iqdz9t5#vyi8;5>=-;*iRkX790zP*d&jP}8+Tu-eGp75Rnt+aV=~Dx85j0QfLk@SzkNOMlVhJ$6Qkw2naU4^iX z3O+bro2+}Mb&qoWaqP=>hP^rx%1y9G!p%Rx8NFi%t~hKgG@jjkA$WtH&p0&ezF20~CH^si{B>h-Y+#)bem&xq-~G*tcPy#&vb}zvyzT98D5?MR zs>+&!UfuYfUSqqS-c9wjr|ZTRc!1A{G ztud=7=42;UoJV8r-8J5}`r)aX1Y>ts4~0t)r=sVTa&d^UVGWFxc6f+c2lvQo>>3G; zTXoyY!I8#0BO&%-ey@%>ty|Hr-M7+lt^3-xj;*cO*6+OIUN`th;_9|7lTW*reG~nX zKPYRtf*N2}P?$*?Ut8`?T(>E6x0fFo7iu|s^r;WFgFknC&uvGXp_=M$!SzVs9LW|t zRi3U_9gb6T?T2>qk8E=t_)5F*kc3w^WSkeiYNbDxdt@amcHMmfbHd|Z_?hOfRYuQw z$#(fW&Q5B(wu@TNP^H0W{PsKC@+>*`|MAuR;+nyU(8~PqvtI0hvlq51YgS{{Z);X2 zR$`=YOr4WCx3BDY=a7yo^Gjaokk8q=W}Ux=bystVMDt%+%{8Z1b2{qsd)(;vo4a0X z>o{u6npJC#qPl`e`;0@i`|1jk?eYJ@j+t2bw~u8d+sBdzBl63+qwNvUyqiZ@dF^A< zlab0Pt?w*wOqc#s>)xV{_dvF};%|Q59kaNiIYGf;2a%c9}MpraOGDDrSGae7U zm0fY#Ki8zkSBGrWrCU0k?Wfas!&;4Gw9kNKU~Qe5#N4slYf(1t5#k)R4`=Xj9p=?= z?`F@rUar43aqV!8s$dyrX8n;rs<$pl--FEWF*1~%J=z-2?7itLTbvgV*E;m(KWcTN zt9Q&#s2PukSh5+{>}470HVX}7t%oM^>z>V^)v-jZ{=tlWk#s9_f4EPx*JDHKPK{l8 z@v3X#Dz@+VhQq0uLg&54hI+e?SFCD3jtkS;KZcjaCGEVnkEepgJVp!G(N=jw`}!M1Cj-R~Xy8D{J%df2!FD*&s&S-nd@< zwrOqcOYiA#_tf5^eW41R)uYLZSo?`M7p-g6LL9lP?@hPjH^*(tz`dIA29&=NEAPdeEbp(Zc^k9d{=l7sQ6{cL zFy62}#TmP2$IL$K>GiQ0%T~pb2XZ=OtEJlRLyn-c=*8WMqwCT!(zfl{b~Vlzv4)Gi z{OxBao6vj_VhKCejZ7{$K-!k2+yJeAASCRC>73**(d5br=-Ntrb`}W|>jgfsT z!-?JA;Orh*{bpo^`c*yd^?QGdx2x(zt3Klzw8=j&k8$qPRYq|qb9F@sb@k6RSYcu& zd2B?#N1rT@MMh^-PMIE3yKBVoT(;M_((>11{#~G5nNPN|W?z-w!n@4r`>HIhj=bvd!+uFb3F3pxt{~q7t z-u-*56aV%1Sikn4v<~(=YxK@%X2$49EDiMr+l{M4Q|vUqjcPb^ZJ(Xxdzy~h%! z9ZC+Bq*@}hPxVKQBg^nRdTAen6Mfd^PQSNHzlLW$?(6LA;|i1`Zg8SwPM@`{jvcIe zhBb0+k)Cxzdt>A3;b%GSe`3^l%e~n00^HXfRNnGhyuE)d-tx-3^?cKqb!i)`fX1x; z|G6@;%sEcdwQ2iI%cFe2|F9+;Z7o(5*pt}HI;7V?;hr5knJd>GxHo0)XO*nIr%PeKqhtY02jndt6}sNt#jFycG$JlELJ#d{9z{5#wm*y5$HpxWNg)m|l@9}E{9 zyn}6HK6ikv*Lpr~RR!_9IwIx)+1xv8L>qC;G9@}1y(4@R`Ju{BL8WS zU`d>H&)~E3a8I*J-jB~Hu|{6YySP8>)Y$G|mOiaWtr@Et8$RB{QIuX?gmDx$wrft^ zt8Q$_{Bc_ri7a`+RZQC!?a~%KgBG}-tYdzEBF1~*SwHzJ*8_gd{T0q&tcMHQTsv*~ zyH+Vlf0c56Zv`JR#{G$9SXZZ8=={h10RIkAtV92de#`4a;Y1G3l6hW_$gWwtz4o|Y z{%ot>WS`ZHOphL}D&jbbHA31N!EA?QM6K6i#+=2`{fj@l*I@i?KkcvW*fE#;Ye9|| z9h;T(f1Jz%^Uh&5FwR(&lFr1AfoA&flW1`7Qpp#Kc-|@!S7zwcc%7 z|Lmo>I*DLKbVI0pW@U9%sD0`hRpZfL3!&AIJNNx}Evd&Ry6sT+b6@;xg3oIWUd!Cc zR-YR%_vo*r+cXyGj3ae=2(w@Hqiy!^v9I8sG}`s!J8SnJ8XVde+Rr%>XYhtYgX;>- zCv4%XI(B;O?#3lQzWBuBbN%q1S-WQK!MdbBp8ME>xvyhp=aJ@IX4cKE*B<^6 z&`w7{W4lClTV*Z!J?AZrSz7(+EG_5$v!Ua%XVaTKm=Y*)~# zHFy+wx6Mw5hN^|R%IBT?Xgrox8qe?AoRNR=?u`6PA{n8?jHh-*ib5-KHFV~}U0K__ zx`SC>?de?&TYTcDeeH4Qen6-WcewDW3|1RxSDbzKc*}4_(E7d!Yu$7g?$1PC{33kS zEA3(fx_B2wqS<}c_jr7G@_4d#$kEjO%eLn{j-iOZLcmG~GsafWd>X`iFTs9cY0)Vy z+jwW7wel~Bpslv84L9Q+e{*O2E=bbbHG7XYer;v+QEy|U-`lt=|7g!vzSWLzEE%7= zr^@3gR8c-X7U^=P&%sEd&w-A3ViM15C9cL9<;y&yRN+~uN3lXU^$^qxpmu{ATOSGC zwsIst6e$>}0UM>e0r?tvGk2pG@Gq z$~G^}sI2*Ck1Hqs?TaTU{~1p#pp9<-`+P-kmC0us+49E2nel(0hftGWhp(PLm$4W< z;rtf32bP*8ObzLC%DD6A;5e_tITG{S?Wstj zLs>E>7f(dCzo30i<&-anSYCVovw=_o&$Lv;zSGAW{vF;Y2p^1KF6)A)S1y3pU#+ZM zz304MvDTW>Ka|XAT-V1tylzD~p19oCR%_tab<>+=!96@{#b=~@W_ix|Cm9v*2`z2r z@s|0E^j@|PpB82-y3a?ZuTax>RopA=)}Ib>JXYV0vskO1_Sc_njv~L8P>Wz4=&K37 z(swI@7Odr|yU%wPpK{yz_MGwe^hn^F1O5yV^y`nxDe3m%RYVOwz12MK-_?xM`~QEo zO*y;0#Wm(zGS4;isn1T}9%NyCG#2TK&qnaHZ8M%A!dW|(#5^3S&sAN|GwRy$j;Zps zZF8nw`d+?i!F1aHeodU;tKoNQurliLd=z&CbF+^2I8u0c_@Pk;#~c{Hf8ySf<=d9U z+Q-Aw7oo2+BgZPM_uw;=Q+T>9j4Q!9ToE>6UC{48pmurG8@V#pIT9+bX^h}Wr>rR* zc+^Ig;mN5j?KAP@)cDZ8So<>>$ln2<7-U9TjksiDRH~1cfz#Khg~^Y~rd1rT7(DE` zVLgVg8J=-#Wa{FY#)+N10ayua^L7tU<}6E$PvyoZvG~?e`^@~p0^GZ~z-yoLVCUqp z^cAdGS#Z_S^7GcvzWnHuUiz4J&WJFYT`ZO(UbV( zxuS7L2*z-^KWq6<2Zr|79f)|}>{=OJkGX7YXY_R>no)Ubv)5MHqc3f{UCwk($8f%w z+VZ#e;H97BH14sDN}P*ZkUIPsc2pZI;) zYmfg4g8K0 zDwHMcy&}|9G3i*v%-o|%}*(}yKNF``qI5wCwshE_{Q+pN1Yh+>iFXmk4-*0?Z}M7vk%QZ*mqe; z{k9b)skY&&F5D~8>ZoK5kM*75e7;im+ACgoO9wo+zZ>5=`A&b{~;90HGWn7=gN28~WJwA5uozLCbW8#{L8DIVA)@dV-j~G1ixsg|*ujZy~agN;5 z!9RC!Z5$qlnH7Hn`@K21!gkd<=Gh#Xux(lB6!Lph?yRh7`w7Z3Md`TwyFT_?U#TaF z?03F$M_z|75yv`o@Vb{}>}6Z6E}oGb<9z=ry9{@II~;W)&o1NB1vyJTbiQK{+Q+;* zuVLP4OYC(^2~!i1s$BhSD7(y$zOcDNxFFK8?g!1|`|j^^U});73BPs$&NCYm_2tVh z7#vAIDOBmL^SEyrzKzB*N=xZgqegA-RfJBp?jhQb?$3LA%{hGbE$RP1g8zpL5; z1^bja&L9VSr+Zm`NpgH!7T&e#)^+=A+cL$oEt$5!xe`xp{{&~-wtU6W-pbY1etdDN z&3rot&cHoC9ee&JXYV?D@=Lbwk&--wpGf`v3>Rq$9yzu>BiLEjr<A&?`ZYBFWd3hB1Ko6SQhxS_IX^-@$>6Vi!;4T6WMz?yRPxq zY-R@M_pNu-uPtv(7V`5otj>Z_`|JMW=&9x`+?(o(yDI&vUc-|kNpHp8%Id9c+86vf znHZjGlk|E--@(R}OeRKqB>nwS%qnf(KVQ_sQ>bZa8Lsa#d#qc!w{b~xt2@z*^|fEG zbjoI{g`8FCwq@Dn42+2gEwL;Id8Ys=$nr&n@yoEm{#1(dcM)w0K~=h=8g8LnOT zhME@LoAvV^&4oW3zVGPC<8PjLg^_!L!J-yHDA;cwb* zp>ZdYi7`&}jqM{Zp!b?Hy~`r8uCIAh7xPMjcOe_c4)9`UKfaK64EjaZ;%qRW&Ckse zueV*&+26D(=@@GkE<7COvtpwM$0Ad+bUbDx8gbI;cLaBD6I1b|)zqxsE5eC;@s!-X zSC1n%#f>#?Ry?wE?)59f@`GDnKfE5il{_9PR1r7eO;oO7w6qn3Qmzs_w-m73i?|AV|DAPyp z#+%~)Ya-+3O^|W_Ezd1p3O8f=!pfO=g=zJog`RoUCyb`zUB;f9r6_LSA{yr_PW?(x zn_AVvt1Qlw5AX3U@$+$2&srMq#Me$zK zAHXX&@%B(8dV8tYk>f?7c&qGo_=?! z8)}hSK|^fb+&K@*c0qjXh}+}Wmh^2=yQ27fyt;MXJ@IJ|@{QFkz1jE0$7fXqc2v%r z_w`xRJ@bc!n)l%1waxJvQ)kVY4tw9C<*w?f3l^Mb*MhIls;=ffzt(1$6~&$Ry7I;M z!M%7pE8cVKzbx9#7x!NvPkDhiW8R{MOR8J#<-2sJE?hJp z@3)e zt7xU!*Qv+(BKkO9MBm!LzJDJ(`G)bhd0l)fGxfXqoq$%m`R;v3Tr~IVbLZXfD5w`& z-5djGK(yQ3yLomsUmOgsn-O1{|csX5>IOfF# z%+d?ZfX67OXq#1wEBUkZI!*u;~X>SftE+KKb5sHrr8GUE)V|s zX7PAxv~!5YQ#l+Rb5(JC!OVG!=2ZDDGIJ`9-?`omH@0=YKy`}o!w{AD4TC`Mq2e>< zq1d^_e37)qdW&W?Chh@)VQVUjn5*nW2@Or%;-D~1NeMGQo3P5mS)I+=!Yr;4f&Dj| z=?D8gJNC_ljDj9oBx(Ni*?vpD_DmKTg1%87}UBsghnxo@{Fe~_uXp_slj2XS? zPiL62D=UFB7R|x@&3AdvLpDqan5T`sr>38d$rpX*H~zx;53+$!*NgC@Io?#vErFaiYGG>2h}6(e|2%?mQ89Gnp!kHi=l>mT|K6g%6IeuQ zCE~Br{S^+QOL+eO&D!0c5_I^ae|KWeys7CQYH)sm!IWK%pVbPkpLm&Pmr!V0>F zWd1@BA-N5wQt?9{>;ztdo0-@>F=!@f+2w6n_*Yi`p;EqJ5Ehr|qiQC8y34bUaJH@( zmG0`c9Hrv0J!|F-|9(YqSUJ0ptHlijcf_SSk;B^ktq|wdfNP(+LqL1q>s{tdb{BuO z$^1OVd9tR8;&^d?Da#)xx5iWZ{Z92`Y3uhk+?=g~;BPq1s^Xe&;e#oEzExX4?v&2n z@<*`Jx~XA{y*L2;-}gd;|Mga7Ro$BSRlViT^q6b0P#b5j;zr+oE3Wr#E$rcq-y^}9 z&KVT)G3NI27GpQv+s?AYzdi6^YId@Lw>I#*u9ckX^y=w29dIg{T7}E!*F=gYEM{Swje|>SY68_(?xA`K^82G7oN0y)eAoiKfq#wbju}Uw3zu}!duR8?A)1NPP_O~qWMfjhA{d~u|_78OSvpoK; zfZ4LVe}nyXv6lX7P=@x?{#dFHOgtwYe>br_#D57gsJyj-`W$e|qrWV?TiW$M)Jgvd zWj_R;dj4AhUmK{;cE_IaeCVXdWshBD39-jSNV&PcOcRT%eOxce-%jc9rVoq5*$73r2hc_-$A;U-TyfX z=1)7j;|m|U+ReoKbRfM0y5nhI?Pq@9zNq-M@i=hwsn+F;X2b}$^&t7M~I0)OVXp^{O|8c;6V77^dzY_5|{Le)ae^UNW zaxnUvsqcEn{?BNeVJO3G?~k4G8P5lfJ<}zD_AfQ%LDDv(@8%C z+sSBOcm8}NkiV1T|4)eZAkyyfIX-YaO$emN1k=v(lt6r(18Ac5p6l#q{L48Q{LQrY zOeftL{eL^!_e$(%{%^y+67z?9{`t)D_dM!ag8I4Rx6r8{%iHLrzd&H$3Y_n@Gqb;C zdC$RjFZj$uTJawb9Ip=t`u~wY`cR;KZgT49$HT_uR~t;cO3SLe{7(9o|DXG+W+!E{RRipPar1Oeso~}#6bGZcuV`) zf&Dxmo6VHJ!fAij{|HY${$}<+9k72nklr3hzaGecG>|^x*x!lvT8RGB`Hba%7?__v zckFM*zWX#W9-}?jc4Gg4r(7C^v z_y;@t=ONy~sK4f$>%ots%~YQ!v3~>V$3s@-4-J&xJ&-PS#t+XekK&)!FKnMjoc&DC z<_{YATbB0=w8ed}r=;@c1jb84Aid2gzc1SBae_^0*e0B|GzF^l4@xEKk4 z%kr+k*f@m!T+(X)2xosb+V6B=Jnjs%*J2jtZ&}{6ux&*94MJM}@c5kF%y_AH;+=^4 zoJAXTtvS|9&m;cs_~+Vx;G8db z?2kcblp>4TFDp>~1gE_j-+@4RpE~J>uzwr;u?ys{)baN!V)-5RyW{z|^}&kKMJJJIq9FHK6~KLJ$?o|>;HPh z_b&Dibjqu6_A~wlC;cM?)*a)q#Ib+D+5au*+^X;|17~68f8E*tA1JFU`mhi7tGzCX zBjIo6_?he+AIv}h%9i`zkGD*J7)U?jv?udF5lA0$(!W4o55O_cA{kF7q$ePa|5EYQ z@Zj?|6W^IY`UxjJ4RyN!J~W>0N4gPpmj74U8BeBtF7sZ-{_i11*)!f31LJpoU_M#l zq-UZpeuDCFNci#o5M}Li(*FbhtfTgiMEX}wn&rJ3D6c0k9{nxL%ZL3>(C6;_G{@P` z{3`94`r|2FcML*o$8csb$Je*wlf?=iamGr73%H{3r& z{10G`;~}B^hn)S-Apd&ocdvg2ad7&Z>F*g=w@j~h`kV2NaQr=i_Wy=6er`wnyx!vy zishG}?Q>C{yZ##M)QA2)b^I}X%1Qqj@xB6QJfu{gzRrHypK#(I2Kx_Sk7n@gOR=B# zTs0mpLcCn>E(fRQy~3u z34-xA)Bbr*`NL5D4=(XP{%x^vh0sOs@*W^GqN;yr^aQPdI6=g{rmNULSXM_FszeQ<#~aKX+Q&KK}W? zqd(t1@Ha-yX4*eHq_;$Nrlb>ldSZ_judp?B}(>ui#Jd;b$)W&6Iz!HyZxVVZV;I zJM8{BetTc){R#0uh5cHO9JKMz@b|~OH7Ng3VEpV4jE4rNJzquthTyLN<*2>lj(tD) z%Rym1?f##_{`Nroj&{apCiXvs{d6IJ6P*2QubqMPb|?J^+GkuA%5?G{apEaK{jb7) zRzd!|mm=YBX1u-b_+xn&1@@l~?9Xxb4}))RMQFne%sR}U>Fj5EMIb#tkRIg3OZ#4d z{iT8Qlt6l-lm0UD--Vd^BPP~&UDWe_gtU7-@U~;m^2RvjZ@UoJYp~}KRC~>F_D_Mo z67;X;-luEwl!g6Q+WiCAaj7jk@OfQMAZ?EC z5h;6G9Vk&>k22?UBxJ(&_vroz8!8ApfO){)bcLUFy}~_|3rLO6xuL$7*N)IvoF9uwUmB z?w{}MXZl1SU6yJeQ(pS>=S#geaQyd&KaL5uCqGNMA89VBn7#u0M<5Nie!2?B>tv)g zU$tycGry*f?{3~$H2iMZyYZ&StFb?pinp7Wi-KN-z2+;{r^eaO^zuOZxj_0%AYGav z!IYPkY7di6fBtRKJp%hTJNa|a9zScJo*x;{F=zkx(0-p|KbO>Ozdxe>SLLMZ|4&Hc zg+kr{yPx^F7BHJB|HVN1P$1pIDUbOd3Z$cf^f@R0XE+|df%4t;!5PQ?ChY$R?ax!H zj<0FX{;y+vUWxkkvip0(z6t)6W;}-+d#1C)wt6`Keg)%)&ktyRs=;_3hIEPb*NpbP zA8F1pEWhRWx-5`3_XpDRnMtRQw=2Aph<7-AmbU57+;8GOvzhc{CGGvF^zmu-&kpRb z4y5-uX?}M2652q=*JSknt85e4w634I|28O<-=w<+(&>22{{4adW1Mt1l=UY5(TDmo zJs+F=+Z}uM*Xcm|vp{-KYCPq8LpffMN9*I3{blY44o>Aa>E(fRy1mW*=L7q5QsotR zi_o9#Fga@eVZ7a){Y-xx$p2Ab|LcKtuhe)g@Rnmd#^GQ0$6Ky{aD9TYp5A%|(!B%e ztG%l*mbuNuzl(5}{ip1ByP+!H^^QNL`)DWrGQHOxJIr&xIuR&;TA;k10e>3<<$XKQ9wP(ow<3_fKVaV!DDOLg_?`;1 z*L#8XOdqSJzj>{qjrG4jkbW_cE})U!h!+OR8x%`<`R~P87djkD&Um!oP zt+cVeeFOe@UWwW^jDut2jRCnI{&6e9zt|l{CriJc`)qw~qRj+jLzc}5aIuYPtiwD< z=GnTCWzW3btnT_5OnckbWZ4g)z17Lm$ADvBHSv(8PXkA7o6QF2;e5`GEStIDZdNBt ze*_$xWPFmPuW)p-^tIqTte3cvr9T1gW_7akr@(nw>u@7WZvuC-I$8SjVAYWHHj7v5}>7T2X9d z=@V%mH)WBfvkAIcoh*G0SZzy|&TFXXmB!CfhgXq%7<~;`v5}Q`Jy@}krEj2pPm`A{ z{b|};ohWvh;zpw>nw+5U}DQOCJT+=Q?ERW5C_6 zHvY-dr-0>$EWH|>S7hwT(ieieS)D9>F<5@c(x0GiFO+q?@W8ElcmSOYFn~&t`T%TDg`SBvTXW;6$4rN^|ZGMvh*8h zZxdwc!@-JyES=XGdHqehk)=-pce6TK`V`vpCJ#2U^eWn0oh*Ge?FSlrvh=yMw>nw+ zeA-`U?8(yaqrKJ1(jTHd7hKrL(jTF{)ydKuz(s?M{R)TIfMZo=e3E6q0UZ6ZvENF* z!SHr)@r{P}gEh9v%KHX&yVfF0e-|9R$>hz(8c;T5+4OXDvh@Do=s%gfH;~H=4<(ly z9_{c%u-2bs`Kh8l-PD&XeGWJ}*!X#vHa32;Y(ja#zxjkK>Y zdCAhZ(%$N1>Cb}|16le(>UPaZmVVsP$Et ztQejK7mYAB&(MCP;q7Fr?<9{hI2(^4nmQ^*Q-gHhK=(mUWTCU1@K9c6aoi4)=0w_+1u_L$c~#0@gSrOYckjF(wAG^ntXu zI$3%JSp7?uK8Ly;hh*swI67H6e!e0#4$0E%!5W8T=}T#E#~WGt3ffzpEWHV=ILXrY zfTOpY`o2UPdqapUn2n;NEPWwZa}HVh17P(vS^C4Yw|z>MUPF7Ulclc(7vE{>^)y&*LYB=&u-b$yeJkz1 zYVwk$Z==1{$ ztCOX_2iBM=#66GLY!eSzHl@_RZgjHr>%ql$nX-n^#;$eAvY7~0{AB5q!HS+xBt6pU3uhRZ*Oz*yDX{87mi{*F=NtcI>Abhy&FW<7AAyVQ{SZEg5M5yMW`Tp;_Ij2qo!>c$K4APD1s7ZY{I0v|LYDojVAX{z{dL-Z!}uXff0OoBCrf`D zTwGx6-vz5IvTWW5t1Png4{86f$xD{b@56MnI$8SXV9i%#>3Ds+SA3!I!_S8m16ei~ zffWN;I-h;dnvRFR)@DOYaL-43E&pu4l-ySqfHcWa%rwij6FNHMpq8 z56xQx)_R64oAqF=XUNiOT9+)Fj~$&X{WGxEKV<2As9NhEvh+-_ z)<0zFeD+%FAF}lBV8u+9UILERo4ViN@Nja{=%c~K4Ti^(?QzQIfTBx`&hPj{ml}SE zyv%StIB$8HRqj&g-KDU073kFGJyaTIMd%;#jHYYmSfuQxm%?EerHl2zcM zCyYMB(W|LHY4iqgbc5mL4)eQ#(eD_&iTqu|JILQN{1Uk6X~PG|PZ>T4&TTS$46M29 zI9TmQR((%^)ox_zZ_s|D@k5q=lJ-_7OMefnKKcM0n{UP^SvKduMVpMz49x3_hb)^c zu;L+0&!PPmlb0-=-y`Z~b+Yt0Sm#r+^nu`_t;WwFuwo#~<|eRWAWP@>i}U{3WD1^oPN@KQLwS z88VecmQ6iaWs#*XrM+DnkfpDnz17Lmp8#wABun2$-Olr5>3bZVEd6D$=6SO8{b0@W zWa$TKkFmv#Ed4O;txlGH60A7M(mw#}cPmES>Kt zP&{PmM``~f6AxMXaoSs*Ed3N%@sOpz4=#Sr_&Ebs3}o4S3|0(e>E~#_%j6|X|BUul zCri)HO~*i%&Uby_=REzb2YI*Q!Q?%Lhm(J7cr3X11;cy?jAACs=R~k#CQF}8`=6M+ zWa-mrZ*{WtYOvakEd3F%$|Xx*3|6^h=?%1h(UeP;zMS?}CrjS|)^#yi`ukv&OP2m2 zSmlzX^Lzez|6o~IXBIh|~|OMe7h^pa_Z#bC7|SvCz|wINyha@yN_vt;S3 zXm540^!4D>H4eDwUro8sIQ$|ww!o}0$jZAP9DUi?9|9{*vTTlk6(?ExG1~vs9%2((}Mt5A*#fDvK-|J_oF_$kKa)^Y)uK$D|GKfh;{v`=6T_ z$kKb#-s)uO*Ml|3lBM%~lhH%Q&scDgC2w8q=X!8r>rvV(byn^-i zOCLi0e$%#O>7&3!M@(JDfYr`q*^CFPoypQC(*6~bmn?lU?X6ChJ`=2Ce<3(})Z~4L z`o9@&0INO8%DcwV$6SnWxcejFS;DS&juI2X6*TXFSP?%Hq~IY16le) z+Mh6a$z1OYo9?POYcPeArlW-dYt+uth(&QyeA4Gerlcf&^7w3ESnF&(f5tbM_|QCmdz(%#YvX_ zDeeEm{sk4*ez={dBwI$3%iSZfKg^djmtW(kxhCW6&IWa*P>|FOwS zmOhR4Rwqk;0Ib-^(pOQp>o>CW4dCcmURA}mi{4i8$Ve(Uy>F5Z&U6?k>`NtRws`~S=2B}-oj z?q+qe^m?%7Ub6Hx;OJ+@&w8+8Aj@V0STT^LKTZ4pF?q?-H`3nfWa&G>I%dhzUjXZv z-A|h@j8C#`4uhj!$lq}ctT@TCc@?ZU$n-oh-dGSn*sAjTrnrFz;i@=&^_#R@#K$cB^uwo!fzn=Cn69ZZL4Yap9S^7}0VjxSOK;6FB zfGm9)IQRReA0Gin?ft98;NodU=ew&FGg*0;f)z7a`U={2HZhZ>ucp1#$nw+L9k*VOFs(MHNyMgqOQj08L;9Z z%l>1q;vq{vNBfISUb6JhXm540^z6&i@sOpLf{QOPer^I6U21p)IGSg80=b)EzK2+G zlI3R#SaFi2SJB?Stc5InChe_Gmc9_Ib|Xt~pk8m*9%Sijz(tpv*f!86X>7={c?KN4 z!r1JjecbRKuj$F%kghWa-1H+vg?7(#L?Kr6G^o1hCqNESpJSwGUbP6xxsTvwCFd zRkXJ{S^8YC`hxFpk6s({GuMM-OU-dgmi;Q~%ZyHzzJa=Zu@71LR_gY%2D0=W;Ar2F zU)J*uzYJD=$+F)MR(;9R57NG0$oE5*ei+=%>SXC}fYldd=^s*m)YOYC{Tx`&+42Xp z6dPGKnPA06mYz-f{vkg$vh)tLw>nvR9$5D@$kKaKUy+FPA0eJxm@J@GyNDvK0Sp7?uegLd<$|0~~Aj{?mSTT^LAEUi3i!A+B+FPA0{WMrH zkfnbJ)_VA3u&!&)ffWx~_Md?j4_P{2#GCge)Ba@Xnc!|#Crjt|$rKM+`Vi{&o)}sB zcyRG$#{Wcc?iqjRc~fX_Urb1r{YGd%$Xcvh){eztZ?8OMjX6Rwqk81lIRxj)J57fgx>$r(cadVEWL>KRwqjz2v$1`2J3z=SvJGL(V-@u(O|_x zmd#kO;vq|)K>J}PFIoB|+FPA0eFj+VuoxV@)#T-GwWwUO?3aU8E?N32+S|E>EPV~_ ztxlHyG+5^svh*F)>&*N>mc9p^`v*JD!HSK)sUw@0!HSJ6eLwAgYx0t%AEdq2$+T7mT?*LX=WZ6W)DvK<=Gwny3 z{vu1ig!Wb^OOJ!q*A?K{Y7-AxHY32%QO4&Ou;L-hW;|H&kfl$g{Z~w0vh>Ncw>nw+ zOt9vnx!~w%lXpH?<&tH8A6Vs*r9VV_d#sVAKSFz}lcg^O>lj=ER=<#CvjMDrX#y)A zvTQbk6%SeZGqktuPnN!&_EslL-vd^^>;)?xvTP2470*$y;vviCI9TzJrJta^Etf3) z4cc3sEd6b;;`sm^9bx+A6Nf(oD+aRi;?>}(7|7By!FjhCKV<3Iw6{80`Xyjp*N~-` zfTLrKpZ*RH0xKS}>~8|AO~}#*)Bbkjhb(;v?X6ChJ_f9K$kHc+qhpPqD)KnPGr@|7 zEc-cN#Y2`}O?x{}lBF-Cz17Lm9|3F4)&MTD*J#TfUO~3kYir2kO>Bq2vB%7@PnOSP z;OHI3<^)*rlV$S;Sn-pkpQQZ+lb0<0H0`ZUmi_@acdwaa&wy1HSvDVoRTf$LIojW8 z$|6hujP_P1OV8pA~8STT@g(-W*1$kKb!o-Y%{MwVVgd#jVB-vHM5 zAxj?)F8ZqRGa4M7WSGAlrg+G*p8!@oWa*Q@(XW}jQ@|QaWZ6`KHI~TI=YsW}P5vgG z$|cL@KCsFqOMi&=lTEo~>5tIf>SXCl!8*5Y21oBQdH0Z~7=8(?7|6=I7pxe_(htyn zs>w^1eu(x~CrdvL*8Fx7tg^_mISp1>Wa;nHo-c*PMwb3Q?X6Cheh#eb095k>>SXCB!J4;Ef%B?Nxn$YA4en-j zvh*`x&0}Qg=fK6ojh~!8>G;XA=>%5%Wa$@yqti{^uHd{GX_gJ&3){`=Wa))q#Y2{U zJy`LSfz_U5*;IfP4_W$9+TU$rAWI)Xd#jVBPXwz^$&ixCpFx$nsMPRy<_s z{b|3@_#sQbp7vHJOCJnY`|vj^^A?%BWZ4V_ce6TK`dF~WBw2bDSYz@baP&Uob17JL zAE4$0Ej(%$N1>6^hCpJeIV!O@u}hP~tm44)uBX!sNILx%aX{^&Oh zXMyt`PP2UGK<{RCvh?n>&o=WjS$drIRwqmEN&82Pf3oymw6{80dJ$M{PL_TH^=}zJ zWa$;)=rj}0P;haLu^C0Z*6?`pV#AZjb%tkxRTr{+&H<|~Wa-tkuQz$g(ihU+>SXB; zfK?Z=^rh63#t&KgYOw0E9;~`NLA}A)KTWprZv!iSvi$4-D}J){=V-sg_#sQ*Lwl=} zrN0PP{AB5esV_Bt$kLC475@pa;y(peoMhR*4OX0F>F?2gnek7S{sHZ+PL_TKtT@Ti z&w&*~MsYd@vTU-zih(RWhxU(}7|7B)(cbE0=@)?&16lgz)K?fkWa))qwN)Rm;_MGr zTajgdJy>y)rQbmNRmMMAdKvAlPL^H)R-9z%Rn)(2{E(&30V~dGu;P3OtT@TCe*~;J z$cPbu46gz!X0r0G0V`&*^!2oV%H$o)ydL3fYpX%>3QI2lksyoSTT@g(*vv+ z$kGdG|9z8}EWHoytxlHSAFOpOe_LE-k!3Rotg^_`Z=$`uek4mDOna-7rH=sXyCIXn zMVm~V)5x0*&j2e1vhvObD+aRkxwPM6@{*;`r@ht5(jNxrK4aE(_28n7Chu}^bgSXj zWUH?QD;~1^JONfbWa&@Q{-2E>vh*g}Tb(R@8(8gs1RQ&AF}is+FPA0 zeK}a|yb7$c$g)`jR#{}}>uLXEQx;kJ2HIPlEPX3j$2D2{0qTQ{AF}il;OGlRf0H(k zn>mmyn|G-{VRW+e55Yx0F?r9>#y&Simd$6>?K5m-=~>sN+kq@S2ds7=OYcPc7fo4Y z=@-%7>SXDcgNy&g*#Fb3P9_tQ06H*WF+q(9M2s^rlM5FY?Sy6m3CJQ1 zQIV3%WCFniVlGsz)r4e%;o_nr)C=uK1Xkl^Srly9)*oSkBDIuKU@diB@Mqm_x9w7^ z_Oh-1KA-cP?>Q%v1l|3;UjN_!d1WT=^Lf7K``n*%nRDTLtzaonYB6JO`Gv$YS#%SkfYkzK8av zPqOH*(%#g`qQ4H7w2p%1{Kj#xwI2eOJiG~(bx(pN4`k6#)Bd2UTe9eH(caX_qQ3{0 zHYJPxA$9Y*04N$UTL5nhp-#zPb3vP8Qwh|7M*J>Hnra(_vo%mO3Ykp9<<`os&gx1519$ zqO*M^Kk;py_O>dEv#mR5Z|Y?6!?{KBLl%7-*l*TbD%kUm@;QP0uZkyuC2wR|cQRP= zMixB-Ed7%#`V_GAPqOH&XUUth&V$s=x+04`=Li3Jl{dD#=Uv5VVBh~%Y>dbE6tmrZ zKUYlup7#|Of~8z!@jnwRv9kykj17CENPKN-wBqq$f7?7mbA#CzY3OmAd7yOx>*lo(NBS; z9!`TLZ)CA~3oLmfi~ct4f2qnv7X3Up-PFmV{|YR5Ba8ka*#95O59da?2Z1a$SAZpN zWYN>Wk~gyGSJVDi_(C9yo(WDjb+YJrV96U<^qJtaU*ijbEc$G4x~Y>zUkH}p1j(Ya z$$kF`0fF<3l!Yudmw}}$WYIa#OCKPM&ap3jfGj%4zLbS5dOmft50FIqAC=E#V95_z?5n|&AF}9m;Iu!fb;+Wy1gD!i zS@brror+sR( z*dK?UZt7&wPlNscrR?7Y%e+Ar8)MEf^X!~+{_LaA$fBR3Zr-O)7X2L9H%8^{J+No2 zVvZN#55V5-N+-*@e**h1Q+fij=(${RGFa{xCW}4Cg3qIDxc&8vQ=AQ!Iw6Za$AZ*} zb6n)oe!NE<6z$;Wxs88$qqGy7ot;wSMz`ifw3n3T({MRVX!#`Z4!*;|%fTLVOx1!VZ)EXV50<=84H={a&!-jZ?X#MHU<0_AhCXMc+jGEPNr5Mdz(Y>84H=ozsW(PqOH{sXu`)1hVKa zgMCw!z8C-GHyX0oyiVQxjfO1xQLt|+z7S5}pUk}{!BR%D*q;VV8Ofr*Mf+@gA&^CX z8=P+HWYK>CmcB<8{UTV>C5!$cSkfhn{s-D$hc5)O=zj*Mn>tzaB$wTe$zVx~EH-1n zk``HX5ACO^w8)}QpuMS+Mb89F8OfsOfc>e;&lSkGJX?b-Hkl5cEP4)Dp1DC5Jr|rl z7GDTt(euIb%nh>W)4}PN;R}H*dO29~Ocs4S*mr}SXFn$igfxD5(8K@uh&|66OC6F$ zXIawxYF)DE*|axxvgmnW$q!ld31H8S%FiUQ5qXWZ)CCA29~^$MSqI+MQUBL=sd1TH+8b;FM?&imn{0LV1K^ya~LdnAdAg0 zu;hU(`kS<$uGS@sev{p(UvY*cU zn|u?wROvymf3D(r4t;@x*_S+~4f~1D`xct@Lz`!87MqW$H!7Vh z`X^lXua!O-|GYbF78~v|N?UN(O3F?a8}5Qg*~y}FQ=PU5UkGH;xoJ!{b+YK34y5d4 z(P=7q&~jTMjWxM#k$c;6TU#5enrm8GBURzXhREu+s^-?as~YM+4Q=;nO_8Q>Gyc^^ z>e?DxtD5hwS{rF;sJ~B}a<68rKfJ5fNNa1un$=Zp4dJ^ZZBEv=n^zkt zIiplER@AT+)l_qDReej%iY8W9V`TM;wv|Kts3ca_tgdTaS#x&;xmYp8#w=39imIB% z5o04QsPU@RHBFI`YbD%JH*#cTb-3le=C-P~m66p|O*P>m*{F}Sg;!QJtZr^^vl_ZC zQro_ws=0-Y5^k||bbz{u;ZMsAuW4cpSnIH6rQsV^Hw=!bZ){kx5}9bJS>4*ixJXlL z#5Sp0*;Ey-X$-?bxW%DI!gVW$jc{hrxdJm$hc3D{QgwIazScpRYj3WrL8r4DrM0c5 zt-UqAYsUAqL0xlrW3!IgkDKf?jm)n=|A)sKht9$_u~Wq9hP^W)x22&qyf(L{t*xb@ zw!JNatQuq1*#5#%4%+jG}W}W zMPN645-_Nbw4k7osx>WG$#P`m8g1F$Y)NbcyOzJ&Qq$~+Wa(jEWei|zm2g`X=bENw zX9YX+YWr(dLjsu<yr$(3IhUS%U*v{#)9m9+B zv$YZpjJ9uyG&k1VR~23v3E!>du3pm?$(_4!i6706WvLhEm}zQmuylH9sxu~``j$0K zXu8&wR-|L4`YN`yvw`9>h{-!V?5dpqESFphHG(-5iJ>+y`wfa?H8_h++hNSGK?>v> zb*B1e3x*%F&aH^y|MU2bw^0t5F;yd4Ze!!xrmC8{IyCCwY^p4&QaIxrHC9#IUT+o6 z?BdP$RW;Zmnyrmny{h{oEo&O?k66~MBvwSzn!1Qe!%-#9Hjvik3icprz^orJHc-YC zFvzX5$EZ1RP_)`~g(EF(4fPFS%pZed)$BN2tl6*I?rR>rMtpN}TQ<%biT z(GGFCvHch>fAbvAsGHzO<3EGL3l@PPnp~MbtJW7iGdWvaO~T z|Lfg($^DNtyMHU$bS(WXGYCE64SSfYdSEYXIU zR(>s-VNqbZg*F9>EYYSwp(WZBD6mAE0{NC`Qy^f84$8Ac3ueu*@@vryivrUvv?)+z zi8ciaEzzbxfhF1$$hSnB0s%{OP@W}PFl)M%UyEi~6qs(IO@Sgyv?)+%i8ciaEYYSw zz9rfe2w0+n@+{GUSw&WUEeg!A(5Aq2OSCCaWQjHf3N6v5K!GLN6v($kn*sq#bWolp zS}?27%DP2?85Y_Um~M$S1&S=ura+-3+7u|TM4JNnmS|HTV2KXOvqTGK6w!f$5fLQ=rHaZ3+}xqD_GUOSCDFZ;3Vq0+#5YJWB+a z#|@bB^K+>iB@b9dvS_A7ff*Ls6qs&_HU)|-(WXG5CE64yutb{z`Icx?AYh3O%Ckjh zkpj8YjUwe)MY3q7MS&R>+7y^>i8cj_EYYSwp(WZBD6mAE0{NC`Qy^f8PNJBXVVv~( zoL}jqH4Q&STH&Hs*Pb75E%NlB5lZn*PEw1;eK;l>|8Sbj2-l_zwOeV%@t@dDhFv0- zgA@^VcB=amaC^UzAI6Qr=KwP2Om{o9WPBuuza3b?X}1#wN%>-Br~6IV(Ra{{n!HZa zzT1p*d{}1L7{_#f1fW0h{~~-nhh+)0V>k{V2f2Xo7Eajm5=Q!CJ{d=UR{@;)tH23H zsY^s#>3kArw-k2YqJbGCKYxTBeFshbBu)tP`WB{(CbiP#Z!*qw{{Vmdy+MNb+Xcbt zZ|29gzp-W<%fa8ao&GY5H0=p-hX3O4a@aZj_5EJcmYMmx+~My=Xik3z;IDcZf6TMf z-=A@!o4*sWyyNg;9P@WD&R^PeO{-@DW{~{xmQkm_J$UZ-bI3FOdGQf{{}Sh~V}_>H ziZlEde{aS4yW=m&3*zZ-B0l2pG?>|uwtsg7e?KzU3F1G)B>Xsa5dZ1#3;2jX-d^YQ zS29!6cwSzD(czgt zypGSx-}gri_V@N|O{)`U_%Hqr!OrP#UaD@4H~QmkhKytW?!(8Kzu?Wo`)f1T3F1G) zMflr-|MbUO6~*6z)WQCC!rw0uFG2D*7k1A4b&S?E{tiKZ*Wx4o*sjj}J#vetl~6E) z_@m_X_uN=rJ8b&PGUHg@V${9U->ENZ8n15|wkikor#> z2981eVMbPgc5`I`|HaOS{^DBj=^98KjOKQWf#qcoyDUtG%%_Al_{+;t@kIc0*_A8}RsV9hhU5#N1mh&vA#(Z`ERMEirsPs=02^zw~G%7IptQ zd_JPjaBB}0wD)VTxwV9_XP*{ZvJqFf)@jGw&uahR%hGH7&*}p{#A;YWyRuX~$HqM4 ztB<}L&F&GUAi7=4(xRGv(CvOFnrZ3Tk9*tybU8dEdsBDP%c3_nCnw8V`i11=nA_v2 z>^Whrp|rdVZ_+s5sX^-T=u&Grr`z_@->o0q(d~7^J}RCi&#z(d#d?yot4g!2IK3~@ z?sdB_c4Z9AaiOlerWDU{U9ZpSx_+S8mD5?=l~Y`ddMfU^VIb)8bq2e9#X+>qm)3RY zyiw{>Gn$vwt?}6U^8}c{wcgIF0CrOG-?LjY@Q9 zM^8m7dls&D#${y`j>^iMGU|h1ZON&UIc0mxGRq$;ch?L}@_GT2i^>=pB=jb5OFgDA|dg^7YwP$@VYGuGm(Qbmzxq_2p;FBd9~P*YT{} zafMmF&cdvmM+>v2U0alu9Vp70Qe2dkd0SCdMop0_X>NCacXAR&PNF?>9(E62jvrYw zFm587kzZrfc>n9e%g2Voo)@%%a-(l0x-X)pqKA!|y4k3yt58$Zzc^e?b>+A<)Q$UR zpTusOs6CacA52cNYG7{8!OBC~(H-bLY|Bo&r3aiNK<_Ik3hJ*E<>^hE^$Xrq-FLPZ zc}zwx555w4L9@q-8eJI~o}{zZSdvl5TD5BYf+|sQsowY73Eq!By!?BiaPvOxo0vO_ zzWBUF9x|gCp+y*>MHrz)7@t|<>~7>;(PJAWA7ZjX~XpHy}kY2-lQ|1dfPv~e4sS9H{5(i`wsHo z{@^QTjtt4a*$yaa(L~h}ajoq3B!;VZ8slJae=D88f4 zD{x{xHzYowRUXWa9!FbdK77vVyKJx2v`HexJ^H+58R!6{fK?ws(X4)?09qc@#Du%96fb-KYDtMJ^dr}^ttTmA6Y&9 z%#fb0VWe_IV=gYlT%5>${>n!?HOx8*6PJXyoKbrV7mIYx_}d+*R_=EV$-OyFqo>XJat5~W-lQaL2KN5Eqef}Hp;%I1V7WE_xFh;OuRHV| z&at6=IZuU~@6xgTPjpx7ea%`7^Zrb2IkuKE>*$zS<9$Zq^JM<==#KT4RbS@38Hrj# zXj8oHqp;Nq9)M4=ZPqfe{XdTFzbHA~`UR}5c@q<@d~e2j9R%Cw5@bXJ_!dmcI;z~yrua# zl+&GS)tr8QWXqiHd2#jn@uK>QvlXRx?!Pm8>9(awccq|*-*ZpWKWCoF{z>_d7yfAR z4=aDL^o=>aulL@x@#Svs`ZJ%#+JBExnX@5$@gr?k#OrQAKWj+_+%Byf}Sw^5Ur7yWGZJ%frdiLSr!Fs6CGO{f(hx zg8n*Y=zah5wY8ac@6`{+k0Xw`AS~=L$72P1@8ID9OTUYY*2S!q&DozdLtRe{a6shX(q)U7@IE_2Gg34Y7@7?&a89wY8zOXv{3L(bwZz zi~7O8V(In1uJ3ni!^H<@+x2J6XxQuYZtP82`Z?0fyV+T@nbEzAGAkadNVxNZvfA=f z<#Xomou9eju>~R2VHoFF*iT;6Vq;Pgyop*OTEShu32CWiH(TZSCRcV@(($e3k9(tK zx|En2mJ@bZb>P}nuBCK(*Scp%OP5FAxAc+vbMTAOpY1i5;>feJRMHq}%{^Gtb>vko z1>@}6klt4u(o3?QdtU3BiaaF+^NQVBea~xIJHDf3?Zjtyik9`<8<=&R$9Os2(~8HG zbq=^nLkV4P;23Cwe#n*WzFj}ml^wc$_*PrADAOv{){1_3>@3CnlHeWn(L)74|BmKO zxjoPsDz|$Ydd_gId+;{YaP+624jB90vfny%d+3_R>R^PrW zz2CkPSIx%Tb2Mix&UB1`&XVk?eZ=TSPncHRg|fS@3*G+sz{Dl56rI%mGBL;9w0Y8@ zbsZD$>G{!)AMXCa@i$I<|J0GQ|8#C(`M=iwOHOas4cNZ#8m)I7nV;Y)->N;?yY6k& z=b0abWA3e=c(=Lr;&sp92z@zHCE2`QZyV(xwaSzLd}J7Mfl>8VMjo9 zRk>Byk@i@k`wy(`&N9rZ39;yZJya0s#~s#70y{7VWLmX=^92L(T*Y2g}0<= z;Vp@%+dqbwqp-G5do58z%lAa-jcYM)M!_^y%j~;jdXTzSFUsTjO(|v+vZf<~%rhOY_c58=-IXp>FIP zg*#GEFD$#1BCNT27D?lIqSvf*E)qL@E-x;3*7y5M7Fu=Ed2qP)*|Q31-jI^$nlf5n z_tv_z@iyG^+frfoh)t6&dhD^Nk1)=I^x6y9d_uMmy`;Tu;Lfu$- zA2FRJdf)q%S$(6g;LQ1753!G)t&F8CD=JupGh^;$fjyHJqur&>M)Ff#iP0Xn@5s@6 zu(BNcjwc-ZjOz@7`xY9d%23kbUgQBhTTtO7%bM-^lHH*Ws<4vl6^X z+%mt4qp?bCDfH6LQhQs0QMf6-XR*g#%;AyR`_^ccJTb1hnQ`2DfA)-`w%+?Dc)vXX zGw*O^Uv$HAl--_tT`&B=<$7^+;<~fzPD`q6$&+E)Nt?N*j?sVR+2fIAqa4HRV+QN6 z7iN_LGa=S<@mT!x%!b#iGnbeRXW^(X<)kqiJ~0W$$yVR#-=q&IUcA&-6a!*3h373`5`*DoA$UV-ym(1<^h3|!xL_c}<2KHF z*XlDr*Pfi-w4 zDpL2T)Kx6_az-Gxz?Y%!RLl61eTjOdaaWpUpf2YfYH;Hc#I)WRX~ku1HH|m6wuEn7 z(a^TCy_PpKL2mY&SJOM$-+Eu`jiNU;)V9>L+;^i~I$U7fW`qleZ@wkNc_lutjw>*( zEpNva{t@%GxhmeLGUUoSTvBJ=C1zY&9&Tx9ZqqC=!?+#8yg;4nXW)K;3~9CuxhQ`2 z&HtnHRX!tY*EHg?^|+g_>@wnB0v3Yz3#k^-N{oA~GD0;ijrV1I*|=#dy1V!>ZoE<6>@>uUT|sJ~IPSlQze`7zi`P)1??vj`8&TVBxS63U!Wta83e-T6 zny?dGft!|E*d|s#8G65)O0#)Qv+9CI=i(NA z&}NwZW%#c5S?=tz3{xvL&CR%Xz_=sJx=OzQm!X=4c0{XUH@DVQwbXpoxJb2T1?~$m z?o6aw7s2J7Ywlx=HkbE|8r{LVk2F`CC!&cE3-%2 zUR2$+YF{$$m%t!5=Kz^XB{yF-?sgkFerR7b?jSVhX;nMsoxOG%>b442iJB?xUX)=+ zjj&e3+L2a547!3{=8@{|R-;=<0a4wma66lCWnv-pFuYt&i>D|G0ps!B7;Do0)saj3b^ss^Lz8Msb{mpM5u zb){;XbQ+Y=&`LPKJ5AV@7^nE-pFFn6|R5 zt-1B48{;;tYLy##Go8P=WzDKcxGfi(-VAPY)tXiLdHF?oGxKL%uN9Xflg7QTnvTot zv_y})WoE)zy0)8 zSup;)wA*kkZ?kpzlUiQoSboN|ryCtlji>!-%ZIY}IqVtF=gz6%GOqKKB@O4E9yAwL z;eUcQ%J5fV8Mx!@Rs0=R{HVD26k~n49!}HL@^Z^wEgy?p=5sMrNYRes*GPsSK04l9 z!2I)h7b>XrUzA1Df4^gSaD9%BTVE}&v+ULKfw<+vR(+}XJ&yPmUWkmqKB42qsm$L+ zL*bXQ-ygR=pLwE!ir)~oydZA*!MNqMam!CRmIs%2tdXAulANZN?ex8l_@E>kpvT5gm@O)YoFEjK%s2m2ovmw&Zv=U*+``B%$!{?)Rb|8a5s z(`)z-TIs80yS~(NeOx@ph6*ZvyDZ}B=E3=&X!x(N;?=U<|0f#PWHS0Le01%4Z4~+s z`37^D{mCwmT7MJbR8Y%L$s(?Xru`jOe^AS39r16XzxH5xDn3lF2FovidEGddkKx=i zLnVA9;A-eR#B)4cix1=XVLbi}EcqK;-Y*#GFGIWvYT2$owY*!R;h*_^F>aa9%Tz(d z2jiB1CDB-aaQaso{_Os!mhJwimicTO71Z+MvZ!6Db)$TI_D}{imY4bCGcr|B_UjzW zUxs})mZv!E|19S4mx=gt#AiF=`5Yn@uGD^;q~>>L{1cA&xk!H-mNT$|!fSh@P~#+PqNc{$6s?>pkl z;Gd6`y3X`J3Cnzr=J4b3nz-?iVU%x!QyEB7e^QU_RQ;h-ZD< z+jEuPn+|^kh@XHn=e+Ml+AkaaRLIaSga7};vd4`7H`K?Ij`pDcAl4WAf5&*3ie;H^ zzhK7I!XN>&0`2*{P_cg*_T{j-8iJ&MwZk9nf90^}^2c$@xsLoYezjxyOYpxE{-nQ* z$8rqI8D@IlK>1#AEF0-L*5`7EBR}=9{|T0-nCst+_=Ct#rX&9g9rj$m-mzSS^?#3L z-q*tNCSrL!wn4J|6V$IC%V}o(^;mzdWBFf^{~9b$b)?sfWffHW-tSoc9qivl{=|Op z_|Me7jrdV0?{tU155*ly#r(e_d5^e=xuH{HyGL5$Df*tRQl%;&(dyas301A#2gOtbvUu#Afwt!4VN$Hx@y2E zE&Jn^Z`9s1$LbEW(RkcF#OEwZP;;OxsX6g?Xln_KuZ~*|#w~wOjPalLU1%!_T>h!m zmMZ=~;+9k5{Bd7^p&p;{IG(-EjQ=&3$Kn240D zH0;M}d=@mrFYp#%@?^t)oF>QGFB=O6ki~|5T5PzD@Lp7Y$YPU6{kKXdi+&T>hq;iUgf`5S$zrnrdfM-lP8NL;INj9A zqF2!VLuF4EoyWWBrcM^U8tnZ@*^@;#?&UVyIvdg6RAoaJn_RGu2UQ4j@DUrb*p!3C zhTDs@-{T8`EH;_obWNa?0dmb8|E{S%aZ9sWsQC5ufXZFoR{(2bAx zj|LhnHk%;%xKobs2tLy8WU+Y+EbUGfeH-n~_9ct{6zxr&EP5YU+MO)=b6}~TgJ7v! zve-}V1pu>i9j)wydf#+ZRS&BJtc%~?>qrJ(T6QrKW;`25PIwIf^;PWj=9^caCM5OUdH% zTVR<>$)fKE%UC9h&VKIWfiA*vd?YQh*cg4-oQH?>VRPMV*n9l=LYR(^&*YoHQYU2b zc?($Tge>|zus;`H2-Wy_ZX~I98+$l;BW%D&@=2C;SwB)I&brzLUFw7^_M8W#PROFO zetZFZA#l7)TF$Zm4t29m$g(c$$8WA{^b<3}=qD!skNQa=93vS0q)729{PVD~5gx%u z@=2Ebu)IykzPC0N$|m^Q!0 z7Xn#q#&fKh>ykz1KC|CU_iEUCW^qmRei5I^`B;`dMwWG_gQbs=MQ4BWvoj(r#mDnk z2CBMc;~=cW$A7bdS{wdJp2_0p0Wj;9|M?NU1I)UmMi%{Xu#}N3I=i(8&(&ZE;^Q;9 z1T5tui#^APl#49-Vz57mFNEdzq!k-zu-LHwq?tzf|#V{KK8q#sXRVa6J0v8nVWIC}kmw&3>?y zg)BPzY8opBfh_v#;B-?bi~c6qo1pSQ7X36>^7#%}@<0}wcfpbevgq&Az6@UoWYIYm z(oLN#I(H+yE|mwe=sYj(Er)+tz*l_Gf-pHa~P5b$3U9#wzv^RCK z=!Ia(8(H+(;IswG4_S2XW2BopS@eZq=`&=}ms9^h`5}wWeF@Q>`xR4QD*KsavFDKX zEL472Wj>SnPsR~h>^WX!9FaxmoZ$a!d?7UB{40rDUo!xzGKe7uP$sL5ip6U%;P3ZWk#|CbHajK1nt_VInySD|d)!#^(%UJ=OR^H*Tm zk0OhH5iI*rWYIsQJ--n6PjvQA*^hGe)lZqYwWMD;X$z$YS#VX^>AZ?!0n^IRk1Pl&EqfU*yos)V;txBt)ot72xLjC5$tPIKAXW(Ub5J< zfu+1;(eI^wyIPkl`UA8#b+YI^VCiq0$Yxu73oLmfi~Vk}j~h&cez4??EH*ELC2wTW z_tM_X16lO_v^RCK=m)`)w_{-6S5>-iQfEg-_>gSoc|4YV_ZzZt4&3)O#hep-4=B#T zKmXSi`|wZlPnLA^z>re3He6RUr8!i_W6Tz6x3N4zTR2kVW4B_IKh7f%_^R?#LkQz{h9uZm{f| zk!9U}uSWPRgJsN;MSmMC z_540q@<0}wUxFnMWYK>^`zXE;$fAD$PB(S3=saAP?G#yb_AB4R_(He^A5X7=#&0XW z4T_gj->A42|0JJe@ly|$e3C_9Mf*+oLLiIIDLCEK$)a<3NS`E&&Mf*j;|pOYKGG-2 zV)HWC_c!=L*n^MclPorDcgZJN^l#ICDZUWMqJI}GeUdEtaj>*0S@ct2&lY?koW;ju z=J_1h&(4eREH<3lpr#=o}2xQT@P4PXh{8Z3pys{yS%`)0-RW{uBll+s# zrWP#uCyQQBdo!P8(O1#l)XAcAdnEZMi+(>?`UY9_2f@-e$fB>K{Wg_nvgkduH+8b; zTfqKrDElYCo+lJP2lko#B3R}tvaGuYEb|pv^aEi3lgiH_ve~cR1WQ@SVt*1WWg&}x zn)XjAKV;G0qP?k;MSmYG^9EV;-+(=jDnB29{bry41ML&>g+La2T+F9=o>um}{z=-M zEH=qtX?L>dV`y)-FIjXC?Mz*1La(WlXVyRs*X&UZbg zn>tx^zS>vj1hVL*)XirElSSw2D}Cmiz-vS$Z)CBl088G;qTfOLZ>qeJMd!6<>84H= zy&mlUma=aHOIl>Hxfd*Hkwt%i_J6C^C5zrcds8Qiz6mUII9YUFx906re#oNl0Q;U% z`fjk~jVw0(V96UTca z@p&FBW0NfUFTws@%1?p|Wi-!elf@<#?AxtuE(1#$$zn4eEM+8%eg*C4sddSsr_tWj z$)ZmIOBwn6bpIo2-Ey$^&o+zwV(7lVQ#!B3l)RC}W+_xzXg_dB#Yh;PTQ;ekVStPoNnr5(Z358 zKV;F5fzw`5e#oM~2~Ib4vgqf);)g8y`{1-!l^?R`zXYe7I$88TfW;44bX?x4rR`IG z$f75L(@mW$IEB`^-a3>UjEH?9K^O~|*0G9S8i_Idi zv@coo3fgmL9DywQ9ke%fvgq|->4#*|SA+e3ul(HW;D>2%_D{0dKSmoKG$45Jkvx;d zW&&99Ocs3-?GNA!fh_uDaJs3JMb8FHos&fmQa86FWYIa@`~DGM2t3a6^56i0EHCu z*J;l$1pX8K5IEh`$)cYGOFt)z{uVgxf8h&(Ec)BvbW%W)-H^jfg=VY29}z-g=u1hVLC>vU5m zi~a!E|4;Zr=*Gu$*g)f4sL$jlAW2)3W!>#yX=}3RyTSe=_(Ir&kJJNMY&bnhJ&;BJ zHtmn%3xO>9cfskVP8R)5u(UN<^z-1f@8b*MJU*ho2TnJ2vgjP%($-|r6EIbI`ye2Y zMNb9$jw$^zu#}N3Hax7AGLl6%e#hLQ)*bRYrm3en?5BaHt;ymi59~j#{O~t)&kqzY z0{cwnF}1WES=PM+ENw>?y%y|eMI!K+SLPPy@ozVD-w&0|W3*v~A&|vSpF<~$&SP88 z31x2_+ZNj_HhW+r^+p!`RdCvmls#GWZ`0n?$)XAz z0(5h`MizZM*mp|hhsSraU2`7m71HJ>%4Q}wt=MMqGaI^;mn?da_8bHVWYJ4#Z|Y>x z`OY0FFIn`ZU_U291m0)i{fo_F^B{EJX{E0NOFqeB(*u@#l11M@`!i}?vgnV{-qgvW zKLPf?q3n4~Cwb#>nY4@Z8137%`LVJ;Nt=&t7N5p(*;%FYSWNOy7Mt^6$v;{2_h@hK zCzD101?^3pEcypv$^VC7NsBBte*jBbWYPaj`+rvXB#W-$xFFrs$)fZ4PUbhV=xN}z zx0D~U=vRZ&O`R-y9$5U4Mdv%2d_Prw{zu1I=hV7Gjj4Z%={K zO`R-yKUm5_7X4Ll+S|$xS@ds%(@mW$`Z2KhA&Y(roc1ru4_WlH;B-?bi~c@X{E$We z4LI!`<%cZ#2jFy5CyTBn!jGorAF}AFV43H~!=3NE@_7aR`7bEW#y{^D)VgF@Hy7-C zSJ~v@pPWx4i%lU|&Zm(@pGo@<@r6JZeKuImr;$aU1D5k?WYM{w-h6mZZcC)GCbta_C(E@TV-){9 zCF>=d>QO|EHMJ4E{JJGl-*B%s&3LAd@f@qFnp(Uwe9)7=_*zx#p-fed zhrjW0bk-BBhCbH{6@&MYJ99gyV)Tzl}--z zv4`O)hih6|joxBBEvq5S$HKL>x6;6@4kLD`DsQiqO0zqx(Ib`9xGuP+y$$VJReN7s zWZ3wI)q|tuy}vbWZ7mJ8=n<^khSu=fT&H5ZBK^{}KJ)>Cl5Kl@wl@zqYS7UU;izc4 zoXnlMI?HK1dCg%cDcCDWw{|wA{Zzb5t~$(9^e$;HN!hLcITKoWcU?W+v)qj5!BrUz zsV0=%p`{u2nS;4_N?{~-?!qO0^qBD7)^y_>QcbNZv|K)ktE#51uBEkM#jsYj?e&)4 zjAvN#$$?e(M_Sf2+#fL-iqEC2GRtWQO*LU_*-<%;`mbpWSILtrVcHV0QZU<*ZCF*` zvZkr3?Y?F^wjNLPvrNrARI!EzMKB@d$9QU^^3zbKO{ufi4c9a_t_eFHDTt2Kil=wx z;vs=;HMRJEUz73Q-Vh9}csL1P`l+5~X)uN{*5&2Pg|mbTEXubiV37rdGp!XY%C{(B zkp=cE@9p>8J6>*Yy}jN7`3~m$zOYZ$Y8;T6X*O?v8i5Td@H1<=VLmTJc=a z@XB0NYhz@XZY(2Z*g=_VzqH+cQ@j0ocE>x}t(UIbV87MeBFCH1Ee-H_^EznDmRn@K zOWb}xx&2ad$D7D4I}3`ecXr$F0k>cN?R?|6bOEejzph-p+nb#>*M1YX{rYYDo!gEV zZT~l4soj_~_iC z_|t;MTDUKFI?e?kGJs|51{-l>@c(jXPJcW`uQ%7>Kk>(7ai_m(?462xCC1gF2};I9!H{f#o?m_Po0?)1msAI-xZ#M=4$K8&3HCg5HqUe`c> ztZv59-!pOkI#3zEVghE6{B4i(*L)KUU`v0a@ezNwUO3&Z>vj0+gd?ZFF=(t!6wDyyeE@b&e+P?k z@3`3>6Jaa$cL??G^!G%ndM;eNzwg1$>F;6*uBSv|%-?>GOUH+C^vAyA^mhP_ z&-0lQB!6h8LH=I+Yg~hCmiH<%j{cJ4>hH8iJvS!a-!5dpneIi{@p%~%B;7vPF|R>0 zBDh%7GLUJOBLg2PM;OkW{Foa{8;TQsbBYGVu|AHvydfdeEr+9an<* zD}qKjXhtlk!F__LEc%;*593%b;{Z;7kD(E2p-T{dOoQtL&4^fQ;!GpQe>ysd!w{(agiyhwzTU;-9xSmBzZ= z7sJ{S%@+)JxUDx4xTck8{p*Lkk)kfv^Y~l6A^Y7p%YyBpaP>!;ck6Z5o0xL9CKo3} zZ5zI&Y3RF{+>uz)lAr2*4m*!q`(bF1GUA#?j5YTLGfN&TDb~M$hFgKwvwi6ooPP8R z^OjA!jrln9IsHe^as7Dz@%0hwDY+1J)P}qbZ0MSwPx%Jg>fbuhNAOM~y)QZ_ufx5W ziFNqVzcL5Tx2-v9VVE*Z3%Zu3-7Yp?wXzO5{eKhW ztr~nII^Jw_eMoz`+kOX7f3N-4_4v~9or`-a_&)FBc=O0^>-``l<{LHmMs&VaW4O1+ zzI*unL%%$@`kkEagi{G8<300jIE(I=7L0}#c_ujC1BUjz@YvFXyIlT6yp?8ALc-~U zvk7m7nk_+tC@%_wh;2j6QlY=FV^pU5CE5+!kkxcjipE z*tQ_))(^fCLEXkS-jq<#J70H&QnaoRp8D$M8~JYAeCy^|`$VntLgmvbDdFlH^f_+t zGPhpfzM(kW{G#>>Ua1({bfp%qej4xfOTl}4r)mXBPZx))cWdu&Eu3@*-h#8#dJ|E9 zcQ}X_Mux&2JGIX9!?jg2-)I(B5@(%hcyrpN;+uzwXZ>YV4jzr~E?EpkYG38c%QoJ! zb4Z&SZ&bRyx5T!``|N`YmhoLNUc5chb1bWKmv(Z%5s#UIB~1?YhQeE3)fNN-?X6D{n10u z=D24+>vPYxy>hl4eyzT*I^Xzs95Y?4J7-8;aHKA})0?a%IP25v-n`O_H%8lUPWHMz z3E}GgA?q7``A$1Os^1T7Q`&iM*Zbxz%gPSvuVJ(7d=D6NaUNc>d)`@ZzfEY~vSRl; zc=xZg>I{rUz6F}r)k|r8e0{Aow|G;>>L@YZ2H9Dv&pl=L-p>!WxlD&~eGW3Y{gw`WQAIP4qvhQ+>^`(lFL=MH5}+nLIKmwarv z^{OAR)8Sj(IuDiv?O8OZw=DEVnN`}jQKRP6H|B9xb-oF?vm`6CP}lp6n$L*2JCG0O zb_MOeu?*w+Yr5;m^;*}FSz2sDRQutkf~2ouRBzLExC{PcXzyie+E+58@2tcyypJHHQC2wn@Y5=Ps};?mx;M=V*3|blJIV+ zK5(eC1#e-BA1oS?vnXOl zBPQK3bIozbzT(!oC0=dy3i^Cy^hVu_l81x)^gxK;;f}G|^%$!!8NKCXb!IfaJ*1v9 zqvxW_2YKWBH4hrTyzVUt;f|LyuX|4dec?TtnCo8BiY?E<`v0!ylcvW!m*g&^_VfDa z@5Wq<8I67R{3X_MhjI?-eMTGpH%o4;6B#)_Y|Hk%l-{LBmmlWbqf+s#7X)fx z)cyC@Ilt09*Iw&4>u2C-$BW0UcFvR5)ce8*6SeU9r}dUl*L6$s#)n>+-G^Mpx4v^5 zbaEL+;@r*!=+B46jybGuU~0PMyI|v8#q4|b_HVeoMa~Zg8=SK#bENmFQP7ortIm<2 zUr_IUTeoc_AD+gcxn{1Kmk-sQr8&QR4R#l$95QD*E%K^pksm5ZT2jnhjGTvqtMtCv z*uUBv$}Dxh&)Y65>;4U)|EA_vJ6?40(dC(xZ9` z-n5(-^d^1$kSn_~@3o|$7VAlJwLcQ}oYhi7SqU!<>qA?u_kDe$w`ii)v{@g(Ogn;I z^J;sJb%kzCn22{o&sie#e^y5S2-|=?c-y4(q8&>(&UWF6xi4w-(S>cu*C!Sf^=YrP zZN*kb?1rmpw*N^-9%TD)GKtnhkI-nprC#qFKBjraNHL45M~c}}Gjd8DbtC0@%iTl! z74sGha}6FP*~bGpL*HtRW7Y}VdqYw)YW^R(^^En@JvHQ5&e&=>_kD-vB-ZocQ;#~1 zknA=XZv61*YU3_?)6}I2E&EuYF!D#5&gnbGB?kExW2OKp#WKWP~ihiRvWFLX?U9(+NQxYdE znYYB-9bLsewjGxk&D9SMe$QK7bdhIyZ`aZLQAvxI|d?SiB1tgZX*NjjT(I{Q@l$%Q8tzgc;lZ*=Ega@W*} z0lN+3_ch(CVo3*{-He*I->53HWGw02v%R5|GH2W~@jb;jYmiwQuFlr?mMz@o?Y&-` zkjy<#sS6&3&IuK`i;8oe^t%83)7X-zmeuhc?b(j!wbyXII<_IzdJ|@p=X!RqXX725 z>+QE;s{Q@0>n7&KdJgZ{9J&_0va-kC7Uh>dgLN*^D=%;ahK$*7AI7e+cUT?Y;<2Qs zb`9>OdlzL^JXVo#=LcoA<)_L+=&M`f`lz$kht30R!!s{9eNMxX_f&0cX?V*KZA`H1 z$S$pO0KH$|r|kTS*2mx=8O>X>gd|v6f=q0D;!TZi*Lz_Qi-+A+h`_6Mp zPnC@gCA`U_+=bh+I&j?EJ4-7Z(yFzgSoBJ*eCsRjeZfCY^q!5PP2bS6I=_SSda)>a z-rr5kD@Z9Smb|+o98*Ov6b;&sSX{aZ`L1Qb!;`x;!G=c`P_GeJ!8-ot`|e2!Z`aKOFWX` zI)l9??9W9bui+Pv*v8S?44j$vrle@E;eV_*MVo=1>rG9ydT{Tp-pxfF(FML>=YZ?z zM_SmkP2Y2?{x1CP4khb{x|SrNrBjl^9lJDgN>b+q*O@6=Zz9hchJ!C@I0qBtJ_P+M*DIa&YCH`ap8AK46a$&Mt#{{?yQ} z&*=HPM(p|0QzbXtTRVx|NU7rEjq&}ma}?Ugoz7BX=3Z1=ajIg@oqO-hT*`BDAIz^^ zaB9JvTle02EqZCZU!$c;om;?#M;9N?>6U!3)UNAG@Wyvb=`9KsmCMp_{`OStGs?|# zkYbmWS)$upmAz$|<=h_I+g+aN6kDcg*92#$NV_-5oxx*lhd$)kf^&M|e&=3}IhzmK zE^&S?!uf@(%CNU%jx}ioY!hB#9out)9kVko#$V>_4gI}#4Gmu>>iogNhmTuz!ZQd{ z2GvS@oy50wwu*1Ln?pB$M$3Kgf7EjEB{pWu0cUTu^ThgZPv}CQ zn%MhFVV}0p>RCCxzfQEz%EbF*PgUo(xxF6w-1b%X^qko7=I-OikDWMr>hRe^=MFA^ zr+;H|vF|p_mrJJNoD|=ku6`xx>fh*!pE=xhv82;SdP9TW{LZ(VAK5U9Ie+8HqTX9K zXKm_F@_zNB%VSB2-+wgTR^y&wth;>FxYFImeqnrBVo4u`|y_}NW4qi)+A>n;C6*3JW( zcSHXuS^xUE%aV;f?t>>V+D}=f9_gs!%yHJQ{X0~4^y6TC$=Q<9vi)V*<=e`W=6`V4 zRLp3uV^575u18Jz0c$L~$38!5%`8cEW}I_B^wE$fxlOZcL+zvS_Z#-v_&SUwm7H+4 zzj5B|{PP-HX3A~TmK=Z5oBExEnUj`HI*aqVCwkUBK2kZi{z&$K^uANK&j?|U%suhB z@cF;f;?rb{wx5hT`hl@Ux`^|hiBD?YGwb!(nf03Y>?l1;dtQ51!~U9%eR2Jd+6?UJ zct>MT$2_lWjJT7mANvfCYghRw?7!>Y%BU8rbn96OSU2IPT9)e#?OE6JTG!u|kCOFc zNmG72cx|s+OUO!mUQ<2N9tpK~c$Yk^J)8J^LY6zlWv~CvQBC!G`nV~-`{nNb4FxIthirqmH*m4g`FjkGAd14(kK;^cxcYhgemX_N5df5( zR=s$?5!DJBzptfi3RidQUAt2gGn0P2IqUHx{4(IyvbU$qmt!s2FC2*caei!!554-M zPk%iz_wZ|DJHq|F1<@CS;pzx}C&783Bla)61x+}nnlM%$=&)y;{`K6m*QQru-Ys{` z0iYrHr}1_n(K{1D!ahf_~(UUXSzl z7zvmuaAve9zTey9)BZId`{jvhY*t1yt=^RR8OI=(I#TZ6%wKoe*Q3bQZk)53ir>&G z^{%6s>%Nb%ytPNWb8|sbrSZ$SYxmg1%uzpmB-}cCztZm43)W_1%|sB71l#EPQ8}zHYZWy@Ag;whF6<_7@>sNL82PWe=3K{D`rFVp`=aUX3%=yO!i-mi~4#&&rPr;mQ@v_2^~D^%31XyJ>u>QU@LZp2>p-ubzk!dq_D!&^3DORGlL zg5vt%`B zluO5N`Hc9JpAnCp>LFWD=CRL_N9T_E!=^b8)qt38rLwpL%XfnOU<_@99u-%-ODo?n9X+g zBzyzsG1g-b!tI_G?s!d;R>$uczX)%^ISaGYtdA|1*+;{u`{8N~7WQ83QY#mFpUtkR zWm?RQ<4KGlNlj8=$$}H?R9vM`j>3rT>&GuW&yT{{Bg>;vuA#r>WBt4j-FX#1vuxLl!$9ftY5F>h>d#|@&2|VPkX+w97m{jOLoDh zYgaTir9{X4b|jToW;)vlzZk%xYpOfdl^sg8>jT$W4qxU;%cDD-+sN9z94kQG4V~z;j|=coC{J&;$XIp%hdQ3CYO`35F1pfM6ZVTTm!Clz>&V4n?38 z8OMuCt+kFY$XJGQ8Lp+4aU684<1mgxsdcJ=|kjFj^vSy^m*5IotR|WKjDHQ-@C9GQHQ#PbSWvbaK+o=(`c)caDDp zcQu#8c3XS)leezl2H`63bYa$`e-4hb)$tR;pObUuc$Z%fkGBNZcWN!}i(Sq=?k7F0 zSMO*#w%r?x&z1hGEfRBEWCU6yf3SBr+XDLsW7c_jIv(MBW9XIc??vriGk9$OtvrTx zx^suC%F=a3{#_J&ml#Ls-j(sZYj6+mN!-JG((_wjZh9`R=A!G$Q5L>+`GQAujQ5wPI3v3wdQFbXc@Z<{m$?%vHTz8x+JK7O>b}pJ$=65JIR$jK|sYfIG<%##F zvLismPYW-u-2Eu`E}d2O!0lt>(f90kKVCpBcXv5Dwc~Tbip}3gsr^=;2-cml2kso( zKhZOy(cQ6n)n?YV-|Fm>XPFFG#wqtme)nbDQsm^qiEfmFjV> z_SvzCSM0kV#X09i`A7R58FZL`7cydve{T%;1M|BahuBk<%R2WIj))lDn=sZkm0wno zKGlx-@pKOQ3&-9kmTkv(De!ywvltP$^S85SgnzXWZ?6d2d*zSOGWj@%$VYj0&1E^6 zc4fE@71lf`JQFA z&R7Y%X}#aAbw923W5p`mbzK{=X78G()(%~ZZ;?!YCGGcl=ra_K>0ztaS59-T^0F%w z>S6n=V|Cl=HNI8$lRmpzoSGRaYo9sxNB-)_R_d6s%3F$-!lxXVMg3P`Hmz9e3SWz1vFEPS@4RyfyqUbM0u<-7B}6idJ)Z|I}^tOwWa<!_M=`|Ax-M=&fwq$bP@QyPT`=c$c^~+p2bKoqEJ8 zTm48mu4-|N;WyVgy4+cH(8FimGum%u{raysh*sPVW#z5yxAsr`tjp}>Imj`m6na#R zIiI?YtV?DLjdmXSW9?r-?hd|FF?3b;Gib*{?UjR^V^sDp`Bp5uc1CNarS;lOYr4L= zy7Ai9mh`pr8rtd?)$sXGkegHX;Ug}mT9>w7E4{Iyrlq=N>9yHstia>qObZ@q;y;}# zVKx(dd{Aa|Vqojwfwe=N$DcH}EKFxwTdUHI4H-OasXl|pqd2?oZfR)C7?lrVYFUc+ zyB1|y+q&3fn$j&xo7*zAcy>)&rm3}IVNg>;3=RWDD>tqoR5*ct}ssPPK`_ z16zkAQe#l2kKPSqR1?3c5~iu9PyTkIq^LB3r|u+L7d7)iVwu_^uW4aZs-&na@lD@$ z0$VlFn5k<^;2}B*JWD6jlCUk`&@|7x{)X;cBequTP594bO4L@jRRht3PP_R{+qv&% zGzDR>o!OX)g>?zUSrj}3Cp%agTB`!{Dr?@#9^~`PS~(&bnz-4D8fEJjSSEtL?h;h@ zZoRH@0#Apj$8)LBjAfn~hNf+ki55KJXW@c`d0JIXb#21komhaOQavvd%3}vm0+0Q1 zt&@qyhSoN=gn2X%Dua=Yw#+nU(&#cP`zoeM@vtR{6x*7mHfH8krzU)_S)faeP(8e0AF(O8WLf)*?C>J~0)s!e>`pRZG@7i6;gI`x$4 zWHXPOV8;Hid4twW%xhV=sM&Fl?P8l{(Y4XtZ_WT2_sujG*`?fzp5>vl@)48Sy#!7Y^YRU1( zc9AzFGjCyA18QEY#b|WmcFwLlJY-u?jpssjo_k5Zj_yOe8ftGCxWvf*1IN$-Hwa16nT~3te9}^ z`0*7JvTkrF@cqnag6+b2O?VVqZGv;R_C|jK4qU{A(ytenZuXErwY>5ETxToZRC!zC z=0B;Z%t}?2Qzum3Tsdv*Zh4FzC0gl)zV^rlA6JE`N(UGV{8`NUi;xh~xfn73KKGq9!2ru%c zw%Apq){n}sfENVr&N4jek8_9Pbh>~1Px();L=(g1XwNttomf~?x2TmT61Da;p$dlq zbn+q|qfPvBZ)#x8tOG8`cywL^s_ZB{fLAYSt7m)S+{rJ#%3n5YEIfp25Nk!pA*+Z- z?=LEptznuoq36c&m|R!g(8x0dR93qO`-d1jWD#r1=tSo|!O-NMx+tvo#6 zt19y!I*RkjOzomZ9E94?G*$kyF4;K#>6|&bVzA?M4)5l44wX3f&gly|rkj=~CQO^w z>P^FmL0cmGu+jt%4%pKv7@j?}IZrgLf>Bj{OA8LTJU#992=5%aJ6ome7vfwbwEnav zumodm-~yaoP0b0b$!^bEgT*O0ZSj}abL8nf@rMTk{-T|M{gn$l*9rW%^;slG=KIKeq>12j;3;!T8Ix*NkZq#OKhxms994l}- z7#vHSDcp>;*B>-2ZnVF&CW2G7L~yFc0d7wvvQxQpUX7eD%N|?t}O%oh& z-F7h(^4tC+FFOw%%vzQPIVjL`?>(Igojx4K%j2ra=t0b6Rm>c014e z{pasyH$l1H@6jmbITCZd&+wTc(;aw4yc@jX*iXh|?fh-pUmwASpK`rh-A2WCLb$(P zyWzha_ko$7!u{hM+#lzDK5NsYT<=jlM3T=M{Tf~@kNb~1{<*!uS}We2q5b@SAtssn zY||#nugEnU{2whjc$!HBy5GPyV&>t6>lE?Il<3iJP}wtS zU)c68^8NSr<7ZhW<$4cUT8!U0-X;G22b}#!_#jH8op|NoiI=SJ7H2=VcZas0a<+ep z&(fI+P|qCi3a<=-euizgz2A21ar@g(TkxKPQAYnCIQ##%jfc-z&GEkK?+4gq+V=uy z`&TIM6!u<;7u)j@+kQ3J&hgIkE_3DspLpAOKAh+ELi?7XtQj_c^H=cfLToGk&h|aM zHxTb0?C)#s8GrVO?8pNDNX-t2s~@j3bFKOgocnf-%8+mk}uYn|;? zXwN6Hoqz+yf3LIuO2oGi+g$UspU)aLsi*(kV6vINSDE_SIm-Iqj{f2QmT}jQr=9$a zpZ}x9BoqJc(Ehy8{v)CN$LyG9c?tMCfcE(+94g+SPX2q)zWi1{euDk{-<>9z@-gg! z?Ng}#SQsav(BI#{|3$EO*IWL-6O(#+_^0xG|AmnKL1%k4 z;`=SykN;yu{`r3fO)~AnXPaufC;Yz*|Cd6L{aR-~%R3p$|88hIfxo(yKiXdx+MX5K ze%P)_nqPZE+jHz1tNlqQp1ttTXVxZAAmhCQb!9q>-#J+2S$?_g1LeQX$v5X7VT_(S;P|AicA^V9zYj{Sq^-@k|dtL^^5cJ3AX z?KQ-YXSQR1BjW!#{P9`7s_zD8KmBiX;^+4J&h}rRK7WJ!st@;{boO)m-q3h>-`S2M z|7qk$HU0AM0lbd(805sW-Lb#cw(oJ|$?>l7>$4;j?`~)NAK~u`^#4_kzgt56dB*Y2 zc#EC=Q;~lR^1H{2gUs-(A19JNqAizbCN2pDq7#*tcN2#BP^ho6qc3|G$O) z_#w76|HothW#~`E{}J}j!uCL$|3k!=1AF!NQuO~P*j9fGM*H&rzH0oui+tI1zBeBB z3lOhczsA7eeD4bQ|1tLSFt72EeU3K1C5ZT*!+x!wY`>SC{C|mzN3mb=a{r~a5BbFS zgVy$pKVM4x{+#6O--Gh;*q0!_&hhv59>o5y@VVg?;$9E~(=X{i@^QR-&K7swi?S97FY`x>#RDSu( zLfa37wjT>^ZwPJg3~g&p$p6vM{$ru-3xf7F@no-e%yz=r|1jGBM%3>c@Zle?Fn?BK z+wJcojy>y}y?!+Qra0}%{i~hrh4A+T{Ee{wxu5?Z(xkXI75lz}_SEt6MeN_~Y=@;p_nYe%JVx9mvpq(eSe1W`@_vg~1vIT+%bfj;?#*gTr}eyZdFJ|U zQ($klCp+6ehQDFRule3Nf1&rU7;p2iA3uIPo%dhikEgwXKeK%}wEecTy%PP|3$Fw; z)sO$5!lWy_e?dV*vEM!4n-lcM72dZH&)u*ocJhC$>=+e4#rXd*_G|oKf$cZ2UF6u; zIsRs0-#C;9w?RBxop@eG`_90AcfEeh+0Xvq{|Ytf3U3hX?}R;uNZ>Ee*?%+av*~Mo z`<)5-%XjSQ|HIJ!PeR*R=xs9Xf1k6x5&3zH)$#TOD!SFF@AcSz2HWoO@C_$F%jf?I zHR%d(8`|>-?6n?o|2UlgXg{|nIomy8e;W2!!h`nU^@Z%4u!-~Dp=)??Z~9h7J6H#zqH_y}$H3T zbG8p-yxxWQG@e<0_INZfRDW~5btuShw%-kHXOBl_{}P2`uh;5>`Dyk)5ZcbRkJvQMvWv(B~gZRz%L!s^aLfdmf+byB(mqXjx>w_WQ0nEq$L_9h_xexK4#x`Vs z{4@S+`}7K70SzY(E~dPvofq%>I6%?Y=?(oBex2`;UaS-w$nH5F8Ioe*XU@ zldkdp!(L1C9$*e;E&C^Xf6&-x&(E*%9>jW9hW6I^7VX~)#djoBUiSW?@yGvnrSh47 zZfN_R(Dro4-yOY7&WF&3Io`E?yz`y?^moA7{t)ZsB*fbf*>t`&z^Om&ZwqbT<7}5; zzV1Z+K~DapGW397)D#}}k{pjXk zKmWg$N!FjU{WH`bk7el;-;2)v=P^HXvELmpwa)&l5ziyo@17rJKmV}xapGhB@v&AA z&w8}?PN)1UxgKDfW~|>TRHO*o{p@z<_BP{Zu-w`4R1?~s?ri@fPi&FQ_2w9V{B1N6 z-i^Nvq3xZa?f0DR`3UqKC;q3{UKry#zW2fQ70x#6KRRd+Q(jwWyDqf7(b?`?e{=ul zp`bs^c1sYS*}f;VT@d&y@wOwr3vvIBxA55By|8^5Hm#Z%vWDc&f82{@|{$}*g z1lSL=_T2xfv!B}+hT{9o*{{zkE{2was~*~CuOCXh|84VfjnDB$`unq=kC^)Par|G8 z@xK%CXnt(N_B6%J+BL$$tX*?}dH$^SjK8!{6Ux|3J6CV3W$cr5Mj= zuwVV(xxY;PCdu5^cb2og1LLz7ZVo4)X?|y~cTN86_#5sGMSD$vy{;$T#r9BaUupAq zE`OxA0sUKx{X^{jkI;YXv0dbpm;F4=wD+{2zij)%)+DoiMw{rL+3@#s_!|k0@pmrY zwD+rl{V4AM+WTy%{3Fi(!PuWb=jr^qvp;ixaCBh*b?@&`{{^sDeL8<$dPC@XYD{SR z8=>v7UT>WHFipl7xfl!AUj)Yvb4<7&b6W{R!@Je4FVwhQMzD$7Kf~Bi;&yFttTOhe zLjFFqQQ3C-uBQo|Ielp z?VrKeRO0q)q3wSP)vtf3{N5q^xpIcz^f!bHlTF-yK2)Dkq4+-w`6~(aKR@eGqQ84X z@ufrCw}<@yC=}0v(0IWk3xh=eOG5S~q4+Kh#a9)wzdSTwriJ!@Hx%E`L-jin>aT}F z_ESRk$xwZ+36+0)DE^b7`S**E|9eCB?}hpg%aIqeG4hxo=K37(WdqHVsux-MGH`+IE3))e;6kgDr9TKx*}m8aj$dHvNS4hOaLo4i zR&WZ(YNqXY@pBR;vh4SO75`qa;wQ^yA6W5|rN2P?i}8j;mi`jB(CTFAuYwi-Yv4Es z4iZ^5Z-V2!O})s{-vuXaz1{<-`r-}geZ1oKAWwmaZ8rI9h@9w?011x?jEuo!@LI;A8c&M%KJPxY3JaJV6_!lHZOzKR%Gc1X+OmH zBujsl_EslL=XF7x|HvJQEd3N%F~38bYm85_Y~H7hjq_vLq>K$&HoPuK^1=j(OQ-72 zAui^37ga~H^70x%btFr_l=fUuk;u|7r@ht5(uaaI9>~)99k+Oi@k5qQC1U$7k8F<* z{1xF%0VFP45uU&!#qf&Qb(l*)Bu>>{&sg0**XIQ}QUWj8b4W$5!W$BYg7hT0KUMp= zll3zU+Y#XB(d)?r@rKlhm-04~ucqpGZFohBeDv?1>UhfKPwn3iES)T!)hl2FAd#ihU7^*< z(o4Yw{7?>wEPVvH(CTFAlfW7$Wa*4S^s$-v$ParJ=$G8X~J?QWja;4FCJN!I29yfI%%O}788XIrydHjmqX!r;?$;p9q6s-D^ zmG?MU^(9L`LHmg&FIoCY+FPA0oyWe^BxBFd%TyLwHmAWVi!A*E+S_qRmVTD@RwqmU zi1v0IlBIt_d#jVB^Ybaq9UgNP8(B6y{wg-IbRLTp8(BJslwu=G=Vv2|jV!%@_BJ-M zbbgkm*am?W8(B6yE-Nl4Zm1 zRK%tjy@qVZRUKF{lVv|2teDBtn`r+h#t&I~3+=5=mc9(Ec|?}Z&s0-9I3sPPjlF3~ zmJL70On%GQ@cXneTgPX~-!?k`jw8kcJJPG<8HRZuSM?&x=P|JAMV9^=?Qb!8$j| zOTUu#Rwqjz3{K57_M^e^OH7<(+3>q3v027u0$A~oWiuJ9c*xSH(*Aanmn?lc?X6Ch zUIW&6CQEMwYdp7r6$4o|i@}P4Ed3tZ&o(iTrQb(;tCOW~0LMAek;u}wQU9vZ$mq7{b;q%Nw8ud%jQk6VjxR@ zoAy;E2D0>bX>WD1^fTZTPpFYT2CFQxY(536EV6Vj5B78YtoV{aR?h<$TAeKWzF_qQ zS^6OAwlB!ii@*id#y?qlDY($;Wa$-P`6o-CO})nWAxp0ZC(}l61FP<2*(?F8?quor z(!SQ@B}-ohF0?vX`Z}=snk;<_IF>Pfwt0?~eGl#DnY?7_Pt)G& zWa%%06%SeZQLxSl-vBEHvTRO)6$4rNJG7r~VjxR@kM>q4OaBn87|7B;18Xhich!=2 z8lU{0ny#(LvhU;QWa*cKbVR{Jn)- zZsMO!dwb1JmVK>b&+jJ0cmayE%;B|Q^#xgZ9|Wr}$kI2`eu42rmi`d!txlG{6Rf#I zmi|0A)@1y=4Nmfc80if4yA1R15n?Td`9=I#tKkBNuLs9@!vl#d{}r^EX6&bud6A8D z3we>@S>(lr=aTO>+z3{ikma)(tTrJ_Z=?MZlb0-g3GJ;;mVPf-{Y#dnw+39#x*mi`X)%S_*qrN0l3Ei?YlfK}g*s4qAAXJlK)Ugu@wC(F-;V8u_C zelhJ=7(Zm`eQ9rXvUGlip!mts2UA~Z{E(#&1IJbwy&SBzCCjD)tk}rXC(yp#95n?>SXC}fE5o}`f2KgrrpTW&w^uXjsK6piqq?n zjgu_SXCLu;L_3zmoboI8|@#`S;N(i!7V#!77U^y`1)Typg3> z(BA4~=@V#g#~WGtWZGMuEd3VnMPp2C{9A3sMwZPSuwo-iuc5t-fh@g__EslLpHF)m z16g_#?X6Chz67k;9snmFHgT>4D^9ZPH-Hr+zVC=Wa-Ojzun{|OJ7BMtCOW~ z04oNv^vA$48^iOo`I=pm9h;ZI7ukEB2f>PyEI+S;6(?Ex5!&xCagwDUqrKJ1(%%3p zPO|h5z!#MpKOce>16ej7gB1f=`lqztY4Vb#^UJ!0RwqmE1=gJ6cY0M8SvD7gRTf!# zU)ulJltq@#@8A?#oh*F-SY-_ct1Pl?_+2ZNMV4Mn`(36ivh-oJw>nw+7_iD32Ub~R z*^CFPEVA@TwEu}Ii!6N#?X6ChejE5Ad;e_?SY?rAQv+66Wa)LZ-)+hwOP^1BtCOX- zfmIftsi3mRvf+1;RTf$LGTJ|B$|6f&1unEYS^9%uwIQE3p|Z%b*#uTuWa$snevc`O zEd4RsTb(R@Cs_5`15Q0|@?L;nDwiz#7+B?!rT3xzQ+PunOTQFcXmzsm0btERvh-4L z@-Oj*Gz>4rK$gvQV8uX|&O>a$(|AK7OD_i(TAeI?GFUN?rPolmpHq;f&j+Xe2i}kx z@ltGL*))R{8(DfA?f2phi7b5yxX|ik>8rqsjVzs)1o4DfKgrU0*iJr!HzXc<6&qPL z>{`V}mcEVl&*BYO*KvtZeL29EbPe#o-Pk7R8w1jqRyBobLReQEPkU-rM-rnV|@Z2a%J%h8yOP2l^bvstc(zk?vll^r2wIOqO0m`-6BxB1UZlcjS!7rcTuB(n4=;6kgDrOyG&4_SH> zbvsVT(iel1>~JKGx74dXdiUX1?3ac&;8&bqh(IDM?-p><+CK|c`;cYBh``0S$ZD(+Ky+k^b5erzkwlAAKKXQOqLD5k0cwe zlgYm|_Cvv`BZf=CsxMi2M}Spdvh>lk|CPy0mOh5|RwqlJ1Xe$irO&5sKVu?GZv(6E zE<`bkjVzms!HSJ6y)W(mC*F|A(hIDPf{$MA;4F`WE6AN@5}V{aNH z+0UZQabv@=nqtQy)#Ii3$+G8qtN6*%n`!@RydjaLw}A_-PL{p`toX^&AEe&PjB~Pd ze~qwU1*eCxN3PhU4ymo$( z<+BDHvo>|$)CptX1XgTh*|&fd8(I2d+P`k{lBM56d#jVBKLA#HlBExTi`Yryr-=Ob zhDVdxz)0nIDK@h5R)7^7S^5NU!9U;)i7b6GxX|ik=~KZ4Z{iJ!EPXn-(CTFAw}A`( z5pPIj>9fIwRwqlJ3obZ?H>A0ENv{PLp28avS$YdN`8HMaJmQ#T9v71TdM!BlzVXjzjmRfiHur%wKFQKofHgkJ(pS^|-;7VP z^tH6NI$8R|V8u+9z6)INf$>9@z6V@rb+Ysq!0IEi^n>8!zZ*Y?$?PbkW8~i(e$C<6 z!SR%7E3*8&O`EgE{yo~*b(<`kj~tyW{WGxEbF%at6r=T=EIl8r^_(o7MQS}KOXtTt zYD2Pgc6rLi?0=^;&&1#5JEc}Hb@K9WLkj+2?8)*u8eC{~vh?v_#Xy!m1+4KymOc%v z@k5q=3+?}C$|XymMSH80rPqU1E?N40)a`u?vhtA-zaFfyM3!C-)>tA- zuK;T-k)_`TR(q1AUr7C0Qx~%IOTo!c@P>3bUh!gMLzc||aPt4)4QUu&>KC$X7<0<{ z83R@yk!3RutUe-3A5Z&F@rFc}J_%fCb+Ytx)v*ya@e&h1S@!pUlmCe~Bp#6pv zAE3^K1c@yDC|EjKI!~uG_Q=vtf;INY(%+=LJ^v(2f1CDJCrjsaQk-Pz{yZu*adw$U z5iF=kSK<{fGd5)99RyDDz>72#FZCB$Hbr3d7g>5K?eU*wn8?ycfD5fomRZ7~?%nZ6@SpG@7h8(I1+M<+|K0ju4}((Ax#H?s8k zw72a;mfl2rtCOX#04sj7bk;F>o@s{!xkq-qC3_k!hOV|HEAKF{+LkQ+I@tvzT$}1 z7h0Vx{b_Kjx3S*~R#{}(>;tPTvh){df1$}smi`j$txlHyDme8OV}BT|vdFSI3RYQU z>BngwGkM9SXDkf;INY(m50~ zN66AIb#$_H{_UIQNcivIG)KbM@0ufn9Y0C1<_KB-%fX71EPV<%bur$McrCBCBFp9$ zu-b|&eHQKGctavfp93zmI$8RBuwo!f=XFYwH{_7~>y$hneU{By>{bk9=?{VnE-`t@ z(l>$&txlHyI5_oHydiDHFV&YUo9$qgMV7vc_Utqyvh+RRLaURdzYNwrOtSRX!LiHm zhV&+W6%=GyHoUGWv^rV(S#XLsERjBT_%nxj%_19KcNE}4p$F{UYmk1>3$0F;e@I?@ zB;Jt7(#L?42~+Mku-c6*8(v?i-N@1>(f%rvmn@yv9fejWOP>SQ@tQ1s1z6>hrLP97 zT(b1FwC`uiB};#h_EslL_y4Y~F9f9U-?bI=H-2_G_Iv2Z>SXzO39No6OFv4zAKsA2 z(ocYsoZLt!!J3cnfK^|z?B4^czGUg|(|(ZgLzaGq_EslL{}inGNS4mOcZ*$Z{0sso zxxgUt|GX$3vh0h%iia${l=eeRUb6HNw6{80dO0}N*Vyy#*VGRD8?@L^qu&Nr3}oe< z4OR?f>2qm+jmb-vUQ2tclcl$S)h1-=%fO0s7*g#Y6$7K7@Q2f7#DmMCs zQRKCs?~s-EQn1Dw$4$hp`EY~hewe&m)5RB%?J*_ha36A^vA>jjh2hJ|R~k-`ZGR0Q zTYFv$$UaH7{&}7(=DD%#uXF6LCtLsJWb2&DWZ6ssD>kz9X|%Vok)_{4 zd#jVB&!WAJfh>Iv?X6ChJ|C>{NtV8hy1lnXmc9*~yw23+d2npB;X`0Oqk}B_W3>6Y zv3ZSrz2VovsT&NRqHdYz&$9V|Jj&Rd1*_f2^8XQ7?M9aV3GK(2ykzO0(cbE0>Ahg8 zb|6dVR7s66emDdb16eja{3`~sbRH(vcVy{2{HX89(z$%7@5s_iX>a?EES*iMam6Yr zHnMESffXBB`gq!Z18+!V>65^PRwqlp4XpMdOP>o)jl>&LKfID-4RemiSRfLwRg;y5 zr-EY@hNn|!;YhdP6~7KA4wmJ=k@_g3lcl$TV>a&+u>9OZ{YK;SKJo;^E5Iphzsk`! zIQ$U#o5p?%SnWwxxsQX@o@D9UXg|^9B}?B)d#jVB9|5a9$-mOdFAn{50{b9j!!ew$kxzYT9T_UmAyn91_VwpGkz>6>Uj z#pESRf0*`GCrjT4j!iZ8C%|!jD1k(l4c7{_Cs{h@e)3x;?`Py`hI`;w^4o?lbof$m zY=+S}mu16K>eO_j55lh)FJ6&&=uKMY;V1re6B}7EaGuH!hoG4AOLcMQ+8pQwoMcF3 z`KbXHTAeJt9;~{Pr7r=eY#mpDW4GcBX&w1b3~$7*)J($<WD1^j);K-*YBQ-$Q$=lchfkR=vp54^y|tCbIM^QMcIb5RiDjAucA*Hu`vn zZz0=%DtIrs%Gmg0n+qEf=YGucZg8^N=ueT^2}sYA(}rJi_-$}3WAyhOo#QiAYxFa; zsWa@4Rm&W!8cSr=F(0NXi?^%9eZVnxK9WCfEf0dEF-Df3>%i)3vUHAB^)*>~Iqm1; z4T&th0$gZyvh+z{^&MF{@9o5|H*|9`XT&M zY-IU73|4Gp=|^dA=Mh=@aoSs*Ed2!S_xK@rWa%eqZ*{Wtcfct&HqyKJrP#=_ISp29 zWa%H!-o`+dewOxDCrkf`_BIBx^iODSb+Yt)3=y?6S^DMF?c66zuK+84vh)dH#ZQ(# znf41&AQD;nRN7meEZx74WbeJZ_mS#gqyDW2D+aRiHi8ucS$Z?=ZCjD0x6$6}Wa&$2 zZ`+D2{a)Hzoh+UAuhhQ}fE62AHtWEOjVyfw?QINX>6>V8b+Yt_X>Vg7OMi^^Rwql} z307>o$##zPMSsNZGX0Vuw;1Lcu6`%W&lqs3)!3ASRY$UHD!{5ESvs%FR7bM($+Wk1 zBuk%4dmaRk$kL~S^*1$S>2tvv!({1;soOD3mi`zxw%F8VD_C_Q%Vs-RbsFTmVTV} zRwqk8LHnh~o-F+&?X6Ch{x&%F9b^A4IC-z(kHM)wHQWoo)GuV^?F&xcV{H22m&R2Q zd6Ch1{-FAjm3I%p;Q#!r*O96zz;MqlSJ z&!1yFNFs5Zh@T>_G&=iB{3dyo(cb~9j%3B~9$0lGOMjpC58(}oEd2~ve{V~c&hr`F zlP62hNAaoECWapPr5MPvxd5yf$kKT(r14Ld&hsLTf3oyTY5yb&MJG?X6ChejDv=Y-H)PX>WD1^g6I&s|PDKvTPc`ij6G2nf5jYvh+6E zTb(R@3GHnRWa;;^ci`b;Y)G+ir;`YB(nSr z0>>USHc9fI8Rq9!;#}Pi`{$E^x})?**%!$+F)E zRy&iWzd-wkj32Uee%@4Qb@#KU1JKoOWZ54B$9`b^yheW5@VnsDBZfVEju6{o_(E{f za)HBx9h)L>>QQ6Q&wY}Q86M;CB!_2#W7dYx5{%dQ-QtlI=Mvid(D?D60mx29a-RYC zFm3+a==}UeeQ|)i)#yjT`s{-&|F2UYgGwWjrSqA4sm&(u`(X7ESvGv;p8AL^{X^RS z$mAtU|CshxCrkgL&ue15ph05!vGs;xM6+c<} z1lrqU1X=oI+FPA0{T6Vl-IR43SY?rA!_S6P7FqgS+V3!V$kxhj)4^$S^8_Vw=s~V zzfOCrlcm2wdm95;`YGC5oh+T7ohi2W!HSJ6n=@d=Mwb2|?QINX=^xYH>SXDk(%!~E zmhRy*IK@Vm-ix2j+4BniZ$-sMmQ4(-*vQiPJVV9iKHHF=_bE2A>@TOijg2flL3^u{ zr4I!wHvXSN#YUD*F<7yYr4OV1E;HuI(yybv)ydK;z#8*p>C?a(^L$>S)>X1>>S?pa zl-1^6SL(jNmCTAeI? z4_N2MWa%%1Q)`W%gS4^77qV=Q(Pp)=8DQ6Uu3co=3N|LaURd&jPF6$kKV(jy+}kG&e(s{o(_CHMC7r_O4vn-pJp%+@6Ed2;r^(9Mx z4V-$$_&EVqJY?DU*SuI$nA~e#Ub_`MYx0t1|2DYL>SXC>z>0w^{S)ftrftd6bKpAl zobjKJU$P;~hS$!qea5B$zZ5@NHdlhxo@D9$X#Z2ZA(5pI0vB4HEWH%0_{q{IQy**M zCrh6Wjy;bzq*?f-*vPV(16FKg={2u`Vrb&ohza0Hl+W)P|OO{U_6AP{G9v@$au68EN{#|g&*7r16F_2~R z0a!7RrJtq!5fcMh`bV_4I$3%?Of_c6(k}!T{L1(tOTQRgXmzsm0buzdOD_e-j^YjJ zI{ZrgPs0_|j~V8%ENS^Ru*L~lerAIU?KmMzuLaBJ60p`ovTS&ZIr(>ZL*k`xe7xy* zvTQbh)#jTVP9jh2e?dSR?J&ou^f?aKfs?Np`+9J}jixNJ%4!4`TAeJt8JzmH$-4}! z^F6X`9sp}RkfpB!YdnypZ=gK~H4<6+Ca|8XLzcb^tbQa*e*vue9&z|haPowS`5mxg zCM)m9V8u+9{wY{7lcjrbSMVF-lPo;mNe0VETnDKRicL zoMh=WV8uz6UPt@a@rFc}J|A3Yb+UASeA>@j-SN2^Hj49Mhj)VGzr`C8S$>`ZCr=uE zFMcUzvTS$`qnOFkc^X&n_jp4hOXsOTq1DOKIdygHCQE0Rr|i6V7o7YDydj;zuh^T0 zKg6&2KW15ZKZTS!W%SQz^H!E+(*xa;wEiyy$KEzJgTbmVS@ub=>PwbhO#63CUb6II zw6{80I+q5GC9-s$=M?J{ymeIEd5Q|Tb(TZJ#gv`WB&o!#&#)UQn_T=Uk+Be zWa$ZT!D-`%EPVjD(CTFArC=Qs$Tb70z@Lqei>MClBKT#D^9X> ze_egw`0ui=THRe&w;-?LB+Jik>O8qdB1=zzlOGuWgUJ7GcraLTl4YL+D^9ZXV%l?( zA(5pI0~cDIEPWhUagwFa0>{o8KegoF8*X%X6IkD~A}jCXV8u+9z74FH$uWl=^ug%txlGn z15?FDmL3Bu299UNK$Z>rS22Y9y5J)dL%6RCt?u@9Is7OFviwh?J~{{Qou7?19oq%} zVf>S2e;c^a>SXElVEHFYUkr|YZ2T;9cq{pT8=arUCoS`|BYu;Khb%vbX!C!JJ^N8@ z<@V`O=xQsn@*bx>4t2!vE~Erril3~!?03Z<9s>oRo4nyMP-t~`3|t34>I<^`j|ay*)3#F`UJX_}WZAC; zD;~1+2WcNMe#p`{(%$N1>74J1$DRATsduyP9fF>+arUCkWK$MdKKp=^xkm2`R{Uhy z6o3^!S^AZ}y~#_K-p{u;I$3%tSmS{#eP5opAhRIdywqDzlc{ZMY^`c-ZLGrYlCr8h zGfS&l)AgC!MU9!N*0$<-nW{{6OJjGY%`FSlnby{-bf%@Pp{^la-Il3ZoM~yO>(2P@ zmImzZ#-Kiqk%&1&z!@{O7 z$ZmrB@8|IQoR$Al-?YpuN!M35VO%U&SZi~*!^qU3y0N**ucy1q#MkXETl0o_Rn?92 z&XKXz+4}`OTHn%QMloyjWo;c){aj_5LDf{f;7eVZf!C60Ygt;=lDTV9ru7_SsO#XC zd8fw8G}TtsRku|)qDe5rg1K6osaZ4+L$IN#tt##4oIUe0ZB^);S`6hoGgWOZ)lIGG zmWE~ol3uuAL8d9|B|F#BElZo*7FIPhHFVzFin)#P)^&$jDB!Sp5vDXo&7uX(ZM0la z-P(p3*qTYB6}pX=`WJLvQ|4~uHpR9zr0)!@TNc)$CAusS-PpTLXaa4(@)pcMcM@?L zx1vo@L-u}a5HZ`vv@hgLlRxXeDC|s=--ejrj(yia8mntEjop=Es#;aoSUs;5U7lkd@5^c_asj6FurL?7U zDe4+yyr6YnRb%ziOlKQAI9f718Z@`wSyj`}RNJjhcAVbbQr*0$x%(FGVx@LXw^i{V zwxCl!?aYquY<|0}Vu&h>9aaCmOraxHa1d;4;85}x0k3FsRaM=hrgT-6Gi1%`m+oZO z-LbE(p{csD;T{~1oC8|-jnnmb(P>ne-FC=#+Jo+?<*}MWyVH))uRYSoYg;%RaXOK{6RSjbCLBfQGFgaaWdU2FTL+z&q3Y)5MxKIj z9rD*b4B*ZMcDB!si|(yC9TqNXt68`R%ka5P8k)Yy!W3D5XKfu;hGwkGm@rraI<*4} zLQ`R?bdpV03E zt#_IzY+zclE`v&itcn^N7cZ#7Sj9ZZ7U~95v#2fzrn#}Yjf1M{o=nR^jLPmCwl&k3 z!P1m&Xs*ZfT7;9{zyTMf#hBVSlwn9a22R_#Yf*NHa*X&Zek@ZwQC@3EtnCvb~eahY;11AlhZVyJhu%pN7wh-NUscmd8rT&G!66W=)v z>sm6|P?$>x%`Q9qsheX?)fIN57ixPVt-;Gi<};I^P|gZ<8s$%dv{*kg=h?B2N3 za0pBXWQ$H$<3cLkDH79N-JIxRKF@3D&eo133}sv}n2J=jHfPdaHfnR2D@uDjDQT;& z!SAID{NMg*O3|oMIG%D}(RBfh3}{3^!$J0lUNpJ&?gq^FBDiVHILF{_mOXbtDk>Qk zxXV&WSs-Sqq%;t-R8kU%4iyJt7Oo5G6wt_kMg%lGppsz$W~rns5VKTL8i-jcDG5Y} ziUTo#Q6q!M0vZ|6h=7I%R5C2UER~c6VwOru12Ib_fmTu+U;v{=1mOfUGN2Iw4G*Yf zSb$k7DGS6bm6QfzmP$$j(V^l%3}DpoAhLi)1~ej|;Q^Hl3ouJ1Wr3KblF~rTQb|c5 zI#e8p0gM_JL>ADhl&F+fKg>ZWC4u~XhcB6 z11cF7V3tbC0x?S^rGc2Gl9E7ls5lS<7*!fX7SPCmMg%lGppsz$W~rns5VKTL8i-jc zDG5Y}iUTo#Q6)iS0gVi3L_os>Dj61FmP*P3F-s+-ftaO|l0bB*I4cIrEY{?bBI=W- zPb?{|DmGN?gTG*pqGXotfJO#1BB0>`l?)3oOC@E2n5B}^K+IA}Ng%pJu{eP{p#QbB z`9hC><`Seg@oe≻nV4b4T0r_}F)HzSW1>-}+_l$a)_C4|mwk-Wv8zW%n!CdU_s za@()RSIl=g!~RCW&W&&D!}y=q(CClF%im8!@y(Cn|Mai`n-t&PP<#U(!!zlzlm2?+ zC4c-Lyc^%c7vcL_-S{hmog3eW_)vl0fulcEDe$)dF}waQjC=m`DPiI##a9nI*WdF$ z!sn#W=no+T{@w}o?^77dFUbk)g#Q@o-}km-ryYL?A@H{W?8evlRrCEc$bOQ)?_tZ0 z?>&5Qas(RVyTtC}c>V(#)Ajc@{Pm$=ll*-EJJ;W{PvY--u#^6fC5Z1($lpho;yWdB zhTrnHKjg3YsqFl?%<;DcZQ#cD7UzY+M5r+^dE zCdGFz>|B4xp2l}0@nI7EU4a+(vHkwi`cuBCU-P^Q=t{I>+6^F=a|7vN{0}wt2eJhI z4k0)J&VGQ zcQalFgyMT0ox2MT=-%;5R(;3d_(OmEOqyvK{M~-B zVZL)8U%$b57=O$E8#kH%n+nNK^vCr3Tw{k}=ch|2oBwBIHv@nCAKmn)bT91Oq;OI5`)|9R*T03-A|E>96|HOIT50LMlmm&ZD-S>~g zF)p5;?~O!X$Im;@`+j9de)Fh)?Xt-%ibtb!({m?Bo{3H#d)fH(saL#;*&V&+ds&;v z{s$^#AKAb1rp;btYuN94_)R!|BbAY@k(+vyXY=(aUpc6~SMJrX^qLLdC)#UP2m9W- zxN`TF`1yr7-FZE8eKrzBJ3G?z{AZ%G$EHtZBJt>koU#WdjeRCsABpGh`n+THE1$=2 zUG4SHIqf}>bJ&ZY0DHZ>C-9xO{*lAp6Oof%|E)hmOEpBgD=#soU;FX$kNZe;5WY~Ng&UiPFHHGA?RThW34AJf>2@(=Yp zIOxF8RY6VmcURj}#o5+vuZV12Ug7pxcR7knoE&+B+V__CtJqjEHnL(_vhCgz%T{^u_5t3$ z_I|;L7__N>Bo956hhD^Qyuy)i9D8L`+IQYR?SY_%mHiVFBWKHNDvno-o49vkze!Q_ zhdXO_ugN)*ji?k6Jrmtm-qRoT@ihbRUnZvZ=+k3LFgqgqb9eM~<`cJ8ULEa~JGinJ zW>n6=^E!I$_olQTM(oSS2XVYrS~>KQkys|;d5GN3JkF5V*eOme%X&Og9*@5FdB==) zw8XP$iS3=Nm-*H^gR#hwt}=GFM=Eo7_RNdtfArmzgZdW#di@iLeZ`TjH8&o=aomLV z@!7bPBjSu$j#I{nIqLM;h&6lHRNPVIj2L&`=T>g^FqU(ExjwS>PiJ7HR3d^yo6fu7 z<&O64=b0JxOE25{Z2Osatv<2swVlTgA3J*V_>mKbPrmx*p|=l?|K5Q$FRdNDYQ);2 zbwk(W9O%Ebhu4w+o6qBa{OBuVZ|qp~;aAelzw<`Ti=TJ*eb3zT8?Sxs@&iA`I@Yl| z-y5+xw=#Q2V~AgQh<;J%8p$6YD0Om^A*TeK!r7oI$&cx-0+9es2sqIqCH& zC#Jo2%kf#q<{Yg#Qg?X%tL%fP*6#iu*K(DKsP_+QKRdN%`tj-GX6~KYZ`Q_HIk%s^ zsb=!=$>VOm3jT6;oS)aDvLjkvoSyrf*Aw&jqKa@`IQ}-|&I#Hgv#28vEB~pPk$A7^ zURnE0v|DAQBl>hsyf0_uEU%+3KlY;){g+|wT=s(3e>v99V(YyA^jcNE{U zW%*y{-d1r(caani$VQ?%PmJWwsJP>@=ripTaSYkfWp!a&H9Ps@(U)^{49UHu;*OqC zf6hi;z#6sNqc49u2irNjy_Ey=?#R8R;*NN9e$a=x(@|a?{ir4@(Ptg)fAni&YSH~s z^;rLG{E-T@r8oKJ_#ZP~zb$Fp70TAA40U;=lKtOZD;&Eh>xKQ1d;2Ttc>bfGbzG7k z={OOMTyrNIOIjwMh^U9`A8hOaCU$rSMKeca~;v2|NGdw1JV7<8~Uc_ z?(^nOjGSUTxdUG5k;Yk3?u~gFZ!3vps z`#YaU-s*@x`dNH)G!nlh8c8>=jy&`07rpj1Y5X~V93?SNx_JkBDi6NsF|u_j>X(U( zj4n%;&B#QeYpAl7a}N3CVl@8*Bl#!g-}l=gp1&LS+2*vLY(E+tS#L)G#$KHjO{i7G( zd^L}I!8u$Gj=YLw=&ERCbfUJxHRLMt^z`-#LtmcXzWm014@9=k4_4naE_`zb-0YlX z?_PC9xUCuAL0B9Di?f7{(tL~zq=Sxm8mcB@fYxsb1dg*xVF4Y+ks2UHK=v@ zpJr>irZN_5>yh0aiL1JJ&z>IVE{<$nMqaeGBR_9Pdu299?!ewyIsf?Gl>;v+>8$2f z{w_^FS=Fx->~ZEc@ReI5Zy~Q&Ka(~+#`1jz#_`Hj?=GXUeSXL4S!>ofrT(b0I5s`z zc((D*Z~v&guHr<+_=)=_4x04Pr2L!C-d;2N`0R0a?7d@P^;dH}Z=RPMjwsaA!z+h> zNh?3srKiG?gxf!w>B#@xF1DL{w&LXKX2kthMsL?1YH#dV{ppKtTYW#&R=ZcRA65=n zpBt^@S?$K#uc}NpFN$oNnfuBRZ{;hOdAWyhCVgm>*Drb?T9ZFx{ok#B=AUbshP`I$8U(f2%udx*PQaD+hi_f9ybibQjyRKXlsx z^E_A^%=ixH>ByhHsl75<;r3GcP%#7%Oo7ta?*2mdn;zHd}T<^_oMOX z>HkbOKZi37JoUXxi+1F{v%{@NcO_+Zx)!O5m6%(Df^~K1n(WnSIJa4kxf<`hf6@cn zf+H_$x*o@ki)TeKN-HDVZqI$?e2mgUFW#r!yLnwa|McfLKk3pxTJhNa!&gMM<_^5M zM|%iUocSfWe(UGzomaMcVkF)^Bxm>LVX@nsqa9Z8@+ej%oYfEP9a%Z> zSGlj^h}zrBt;D^G<+zH&HP{pVqQ%G?oE^pUz2F=zdo9gTJks6+;km(?JF=s;;}?Cr z_=|nKmPzRiy}dOPacmyYJ8xU`nSVhEYp&@s-^V<*K-!B*q@pcnU zdRb3z=&N%!jhx}dI-<9)Dmskof?fjJB#nX>kwW7ExhypEm|z4WQkk=#lg zk1BZ_ia!*Md~5y9>&Hdow?`vo?W1u$oQbTQ+|$dgxD023>%6kYcJD_Rg*B_+4z6T) zH0hUDme~|(&v2G=zG)mEAFq1r4AF1Ffzk8XChe8!Gnq*4_=(=i@iV=SOICZoULQa2 zUq4UJ{i(Mtf5wApe7<#bbME8@?~0z!v=1D+CYnCg9`SG%ljn6@Q0bgGrep09-p_FE zsP50*eu4M>3uud3x%$_u*H>P3V>Yt4?;qI%XJI{hc*`d!w#e50$@LeOt!aq#o}8XL zGcvAn<<&EaaSa%|DEiDFf9$o-PjBdYrOesZe!siQm?LgS^h^%M9$PXC@r7q6)E zX5Z^c=kDXK>5;eIpT2y*O6k8nFTelJy!>e8@!;s>ujp$}woePzyxdn-oj2{#_@aSd z>A!vYdHr`*oY#Nd_I$>|(m6(UcpZ7yAi75p8IDSog=odH`OhJ`N6XW=W78!%)VX3G z>+IeeEn8g?fzmmWRpGp7|9xEJ+%w4KH_q82yI01quY5e8BPkM$o3uBvYYb?i$_L!l zGO~5!9qDDgy?)a%2l7@{a18(PyYZfV{53}Y6zTOmlu%KqZY;#<7%>LYt=c3{KqbrW5To?y9o+Udl@^s$0n&aY* zpyZWT*K=ZJvcHF``HtW@WBZX&S;_bb%#{}RDqWQdpH7xkg`=rIFYvFbXD%tGNgJBZtygX~D{{$y`_4;G(jyQ|!YqlCKU6mEbsaLk2xm^5l3~ea;&;?n^$rueVuJBY-Oj(uz(=CURDi#y!ao%1&w5Bjj*tNrUGu0wy=RGz$SDC++SZyoM6qw%oJ zPDRUqcvrkK2e!8SJ8Qc(%=rO(@DXP|9xo4j??byDE#X;@IJ2iQKiu)7%*iyyjkFy% zk~!lrZfrpd#WideuVJ0u)m!#$*ixD~xyvia{mqt#b_^=Xw8g!-_dFGU^xVmF;wzE^ zM|)kH?~cukdIxe)_(`BNOABOSkxAQF2h3m#N&0>*gr_-2fh zlVjOe=6LN_;+j764sT+0YwStnpcbv7QeBwV}AIsqD6`dEkD9(SGr-v$J>pt(UxGQr5w{oaEXu95AFYm+Y;Z?QLkepS{YxqCe5=n$xx6h5I`(vbSHnB^yt7`*HNie)x{y^9_F=SHc-{ zyW+244*QI^Ij*zpz30vud~&hA^M<*x?lJc*xnD=zHq^F!b>|yS3(8ckj_n(`dIs;w z7h}B9+-G0)lg{-vd(7Ff!VX*uI`{Ty!_hOaY`oPyXExb~mX#!1<5{scqt@*0H4nJ6 z+Apa$e3BaVp<1J_)-O2D$VylFqeKp`mYwAz&wX+^M^3e?*g>|6zFG!-fBdxDj#tv$*ybLz?%pO?^Qv<#TH1=l+{=}r#xa9tK-V^qbcKcUAeFSJUZJ=-tp6ZPhqygPmIT1vGBkW%zPJa;61>J zV1(-Hlc28L5x?NoJ)Hk$j^+3zk5;&KXRrLR{Qvnm_x_&O{D8dRw@BC?Q^2U$P?aF=s7vJ}-)dsRhZ^?cLCG3w=3u4`@=k{?| z;oSpS6mG)v|KL5HXgRUo_AL6H|2)UN7aEBtUo7vB^GrYM8u)Eo-|`e>OaIcd0+uU%GAR;^bM2 zyuvu=72lp=<`rFc&c%7}M@uTi9piM)E3W6f;(naB73x5!c~G6Z^hI&Z4_?Cj!kLL- zez9-!tucOLoGITzBFx_7gkN!ryVPb+E==13q^%HV4jV!yF!K2xluAw^a6h z`Sp8BK ztLtlAar#hjT+Le>~uP;7NeHW;(BYRxA_jt$LV0_uVDZI;#mJ(aVo<)TR3UJ3Vf8(xTj4eCR^L?PA8QF*9 z9^M3ae!+KQ&lfFOcd-AA_VNw=W?!{t%g{~xCU<+qo$K4oyK99V;b$oYK@_n!i%RdD zvtZesGX@>zn`eCQ%-D~4e(r(7j+bD`Pe>~rKYr^?#k#-T-`1N8oaJa9DXL|Fnu!HeT#G8Gcvofc4VcvlI z`O58H_91*Gd1xrEB3*dayLb!lT$A?9rc=?f_q(+Y2y)1TcSLfVdK8nwm@}_^M_t@f&vU|Sv#m7&5Ev$?1F0jD8 z|L+X@ntAgvniJM(8**|ac*fEax`xDK2ir!D*tH~DerySevbjz#3nR~*+Udm(u%y&3 zIJ1uKwU5TTqod0Q79ZxEw(x~yXJ7A9yY1rGH^Os#S?QD_Hl6)UrK2{&w=+ZQ*ui;t zeSVVXD*wHx?>Z!wz?wh=N|9$VK!cAjmJl+vI=)aAI64%>k6F2{`w67X$9L_U_Zw+To{t(ai z_*^*q5T0Hg8iMh`%rb-V0iOr;<>>%Coe28U&2tY{KQ*u|^SdEkXLbK4-&*76-uqtJ zjd$AC9mF+nmg*+swZ__Ue12zUE8ky#(tpyBWHf&xBhV99qX>Zyak_! zJXC<^vADMFy<^L~sdL-T)%^4+JQM5MG{B43#0Pc_eC1~oJAYA{IrXTQ+)|Dwygx(s0G#AE)(b-^b( z`{KXE=VNH27cDDMX~t_f`YqnW6ydx-hF&R)sr_)*j{h)GdHc^M9{b|s<&SqFDz(3` zH81VaDhoRb&iMB8UjO~)OBQ2QlIBZluo7lfRox}cO_@tp*0!u_UCwp%AUCG%LOm|0 zn{RHuM0#EA@}{b$n=c91IWeoUV4aiZ>uVcRJ(rM71#37pdkdOs(wT<(6}2l{u|iX7 z!8fl=)wjZJQ|jxf(bb-Dlkyi~DN14SqT2eEXY^K-YFJa-(n1sZF>9Tq>T0nxVI%;% z`co~|o9puok>thE^u~3wS6lBdag_3xD`LEh{B`_Nwauw8Qy#tbRQ!cvQd)zmk5y-| zreI`AIg`YkxbL8Yb^lUY_b)7Huh+rpsc%o5KIuDWI56=$UVQ`d&~SZiO{%3Kg_Q%V z|0LztWl(vMD2#DLv^8cO^__IO>J@7irTk?{ow(iVnVwovRa=KvVwX^2MRVz-6ccKp z&PV`U2Px{)G)b)1$Ad~|7Wh2FnZu^{WvOPECWC1)Q*MZH>YDHROsmJ1cm!W4ir^fQv zIBzx=pk2siKo{CoK)>lP}V|L7d<+(dW>XnGTS7%H$tVk`I_s!x+3an^a-LNLL{AMnUsjOJS|Wsx>uOj5Lxwv#J68HsvIk&T2!N6l$Htu)L}|RadjJDswaX`Wmhf$~6*E z{4J{*s(W|~J4TQ8;TM4E-CUW^Tfr3s&p1Gzspxu+&W@v?_cn*;@8u*g@)J6jAb+7h zw|0W%$*}%d4NAu=S2Oyi&H0=%Z=qf65pC9#1~dnI4Q2kqVH%lGysg!y!q7RwSiW$v z;?}S^Yn95Ng=pPMzW_`NuB)kE*|G`^In&UDF42N|;wpSt$4wU$bM2gCFHZjD$1Zn> z7PhLPwXQlv42u5?s;KuW z#X-#eD$#6~)hI9p0-yFufbNPe9vrYeDmacyerr?8_!!+wApL#om?96~rHd{gDwDZ7eUD3M!)*4Z#$3kK}#=-?>{vX8Ab3bg-7> zAF;x?)))>3YG)Qpn9oy6=7Q@YSDm8q&{l`OAGwKl^T#j+~3rs}5Dil(ZST=E&incq8tAiQ#| zS6r^RtW9$Ymj|p+xw5_nV;zg%A}82t4k(OHo% zZzbZdO7)e3M>y>Y7q<+~6phcZ3D)2KhLg@-jZ@!fsOK8K9@h568mMSMn9HrfkYz_| zECpI$)xwzwRw8e}s`abZxI?YuQ4XClL#SVz9<39X1Fx^fYujqrh_(D|(2D(8nwj-F znKkzly<}co`(BD)y$aX1K3DEeg%hLcsp^LM8cu>tyT^jtDZ8L$$}Z4dhPhM~+GZbz zg0|4dv1sk}v6Q!67Q3z%Yq!?=V^ymc(a;StH8s`Esj0XS+}vEON7Rd!}*sD-~2&cW35Yj$+AwuF4n6n^bVF?ycy2>E>Z6rym{fY3!||uxU_GK4$F&? znZ?_CCHII|_GjOkf5pNwFEIp*W{gOcl#WRGf6w=Zdl%RbhQ8wQ+aMxad9#_ktVm_* zu==LvTB!*o#aOg0HFi}?OJno&OCtBR{(NV}C0rOcjj8TxTt$m<=bPd!uSr=kp=843 zl4%nz9p}xMg>(ALm3y(vfH{eH)7ps>Y9};~uUIpov81Aklp)=+W=(6|ctTaxng#=P zP0bllByQ~f>)D}}La`p#V-j2UnSo!QHSiI|g@NE1r-V*HpZ!o_LMDg!(&d>bVuSkPMw)YEXEfucx z#^YSm$!sS6Ba!`Mk^NUA`}XU@eE;}J*xBM<&-yX-fhA|`*3bJVtbcMP{0)Vo_^0cz zt-n>y{td9NggvuC`=0&>`1#oo*bnf&iu^Uf{@gz8&+_dD2KhP5`!3cY;&vT=vb?kX z;~)46e;NDBBl|Zw`TeF=N$&Wcd zmi)1s*$>Od?6ZHF&FnAGF5>T5KIi)RSsENa*DJK~A}qvL;vcVejx)Z`Bl|Bq`<9D&Wu772Y zry}WFBKFrs_UA?HyPf@kIR67Uzsma)lsCVBuK)q4yzh4MpNr$eke+Q;$MKy)b~Ew4 zx?*&eL-$p?(zLAcpEZW%pS>VLZlvlarpuCpqWi{yCBT{So`qk^Sjtzh)ca zEyVc;qWp3pFrM$=e`^xh|Ek^p0OdI!`@C+b{Fg`0$Fk$wHTD!w3i*kiYkx^YQ#8sBg0k@hVYYUqSk>IQ9#i z^6NnUzJ=ph_A>CtHCfGO%J-CGzYzKP9ge&4J?)%t9M1m-l$ROL%=kMdQooNl{;ooN zY|qGcaQ=mn^ZN_D`T?1EmN>`XMf}@wK3zX=!Tw{|ciYQzjy=m~8`_iEhIpfJ{u78_ z*NZz4>ttN>N5eqn`+6k(OHTa5aJ~kVpF7{G=f%$7OuRcCd!GM@Q{OM3JU1ad*Zk!9 zK7_yNk@{NY*zZSO{|DkNvi9`X;l$@*{}LQ$2#Wt*=Q!;@boO7u`OimwRbCZHyBvu} zI_W1k=YJ3tH4Dex_Ixao-vr9kY(uY@~7hZH(+6iR`~?=X`AC&m#VY$oY;&?3b`J_?xNkdn5Z#NA_Qf z>_6w6kMX}A*-xN7$p1GGPX~^pi3jyN#5vCNW1aFif{wTq_VcZM4EsOFahL_^UvkpV zMBN?5aWuo=_+H1KU%pQLz6`??IPUiMB@E8rOnIz`?2m|)-|@))TBm%5Akfd@AKCWf z`5Uw)Zu}0)Ec61#Gl`AC--dX%z}LBmX)N~D{+BxOeiebff$|vR9Dmt4PJhRk8GkeJ zZ*}(hN&ili*C-s9{{t*ce;eYJ+OlL9i(#cw`Wxb;=l+Pu{_8Ake;eY>2G7G7#3HBv z)5y=Y*dJ#1nZ7!b{sAZb+bAfGVH!_p|B+L^KSN*sHO8Z~<8K9Q%r?Zk9mg+0dbhuR z>iDO>TO9k(5X+6I6L-AGan5%&j^Bsl8lRcI%&A}QPl@cWa?jj>z#(BJmYQ?2B1B{$|?C{K)Ky0!KaHGkn6tkEb@3h=2PLK76)CUv&i)MB_qM}63$q6Lf5bV?{o#@Pu66p; z3B>j(+KbLth5d8TxV6vpjgj=*Bm0}3{YISoGPDPVp!knE$M?cN*C1z+@c7;6n|}rS zad!Wx?O)6N{0#SsF!#!Vrt3H3@jDCtFvlo$6OaqQp4`3q293|slFkNAH*y6^bA9tE)r?Rk`w{w~LUDEv=D z{@n5IapySWc_*@eDzfi)PMbg4C!F{{g#RNre~EMcTb$#xAEbwiDDNv^|0(R<@@|RP zKM>j9;p}Ije5ay~yY+dEQ$L$f9t&{%A}5|A=Q!he*4aNF{w_v;amT|0&hZ5N-3Wh3 z7SzwXoXq)~X%7RL*zRvcdmN7bKo_ddCMW+qf01L){q>RK3nIsxBKx}{`?-;L3M2cE zI`(mUFY-F#%R;N+`5%wiU+3(9X6;M;>uG^+zt{2iD9Ywae&ljs<2L5jk$oKUaqlCF5V{>=&Xu zeutPjM5sJocaGD3No4;TXaAs`OJNv5`tiR1XPo1li(icSx!M!`z3m)7jQ%(m$1nEN zoBPN9C_A%V=)H#Y**NZwcj5OxnEXs}?5~2qR@fIi{>D1TUq+x0;kf2QJ)aku>t&lg zyXTqx+amj8BKzU>A?58yd43h+p(ziOpUsYa&-0o7w<|bq_76MzUx%YKt|!P=P(QS9_pUaV6{j=x!&3I86oX_lUi|oJV?C(JSy5LXc$NJpp9Ou`>UyI`x zK~sBr&Ncj3BKqTptHMbAnETbIgY;&9eq{edWdGC1 ze%M}3`pbj-oBiG4J!SgT+|Jz9V4DRQ((f;jR?HPYpuwd-QFx$|F`4}f9daEBKAWf<@0{zd|!#g`)nlrPtcaM(f_PSd8Sa#+Ial#h`;7Y{-;Fz zRYmsmBKwJmzxK#}edPSHNcvTg{RJ4$v@zc9NO{~5vH$mo|9O%6=^v^8`y=}YBKt); zIsWqezm1%)FyjAb5&LD4czzMt|7~P{Tf|@Z*@8L$wrC&ySTMlIDrQm$4lcmoCC*Lpw4_W$BaKg5yYKI$XZ~FyV_BVlx zZ28_wn}0Gs$+BU8EV5;^8JxE5;ZCsfNS6Ipu<}TjzK!;S@CzGR`n}+MtCOYg1S^kZ z>5qdsf8_QAev&6m%w*X-3ogQSfZH+rBojXRESuLL6vbkN3@8(B7Yf{T)VQg079F~snGaGrhcLzewB;C!o-rN0PH<66w^ zC5K;j_%(-L2Pg83{acRyuERVUvp#dk_PGU{zL-rdW@Bdd#FS#3Bw`zmpBN{s*hb(d zMgdz2KQSA_D6+NZI3W8Xvh`o$@Fd56nqz+%+4^TUQ$HoEtXPFbe4veuuGKckvY`vL z4YG8`pU0bdY-H&vaK6>a(iy+nDp~pzaQdtGg^e+*-;rfg1};kB7q(gWQJiGi%mph> zvh?}1{~CT_BTHWh&bK;Q`gLH%NtVv)NsPoVY^)dYOmLD72OC-T%fO10EWHw}ILXqh z!FjBFY-H)H!1-1uOTP)MzDAbLrjr|Mp)2oXrEQ}<8wIvD{7CNr=UbgD{cf=8h%Eha za9$d}u#u(j1?O9xEd6<~%8)GmCF*aRIwebgADp&%#3Vl`2eNE9_7)Yx5ZefFdYobQ zDfL0Oe~o}%#14%ug&$oj$@0nSDH@Mo*jSJ02|nWc$H3Nz%}1%; z@;M)zZ*{WtYrtvVv|(diC+Ha4TKtGNf|LJ@%wZ!dE$gDl+V2D>-!V31**r>{OYsZa z9{i}CkY)1(SnY%?{b|}y$1iMT>Cb}mtxlGH1f2XA69ZZLad6tk`7&5BkY)24STT^L zzfSu2CB;UT zK8*Hd#wS^N9__78mOcio*vQf+P`6_XS^7e7QMvJd4Op>}WwQ*d*vQf=X+O)PB}=cS zz17Lm`CLeCk}Ul;urQb{YD@;6O=?~D}>SXDUfK^sx>1Q@^+Nw(w0C*b72q0+FC<&)o?Tl7t1 ze;zntc?5Zp(fR(M&NYE-eNF+V7aE)C)E66`?eH~@{c?w!z{&SbJY>al3%JNWSXEL!KyE^^asIdo5xdN#Xy$LM_|Q3mi`ItuQf4{ zrGG|ytCOV<%0UeF-i<7MICb0C$kO?)LJ==e*vi1F3%*k;UI=0F z+r}qZ`gOFoI$8Q^u*!`reIvMNnenp~oc@kszJINF$g0w^{atWTmGSct zSTT@g^9finkfnb{`{gDrSvvkL#>=-lS^6NbVjxSOLfy6{vUEOMQ#FtNjaOv(xdp88iY&bioaQ7KTLFF&H9q>EZRf2BS@y+{@~uvmJ{_F=cQaOyrSp;_ zoh+S0VIC)9*vQg3oaI}cES*C`UM+rMBTHvf&bK;QI_GTZ)%b<21wYACCN{EcIDboU z(uZvWeiSEJHrpJXEd2qn;wMY*1}lED^qpYEPnP}&Sn-pkKLJj!!7pr2<0tuh6F*rt zhpF2#Crf|X(aF+Z2P^pjx4OqTvOSTU2OzYA8(Wa%G)74s+H_EslLp9WU^mxDD9kYzIytZ{%WeHQI+ zKt{2VrO&0k)ydN5)4s{rlcjU6n{RcpbUsVexIva)PyIje3maMbT5w*o@lTe13pn5E zWa+no6D`KR1DsxKcmr7FK$iVxu*!if{Vv+yWYUtQ-%Wd~lcjfql`pdN{nS6gFKlG# zhrx-PjsK&x`PkTyWy9y0YGbd1i*7OYd=ypmUBmCu=2pWT8pNl;=|49*=g-Q!JD0{w zJwe{dI&Tg*?|UXKS$cokTb(SOb8_XKEPV`hTc>2{#o$Dn@jnTiUT=62ILW}Vk!8>M zbMilp?#`uGKv(%R(#DP+E2g%a!qP^{FWa)R)-s)uO4}#SP zIS)^MV&W&uhVyO3zlS#eWo*c@d73sH$gw>KRy~qs!}+<|Fj@Lx+TU){lBFM^z17Lm zPk{9-g)IFoaC)Qh^A2t7HHa*m55UTcKmWIN;m-eaF&9-Gk(Krwu~+-dyRleZY&23DM8+20FRoMh<_(EcuymMoqBznE`zvh>Hnijyq;066g%#?K32 z#Xy$Li(th-mVT7>TTNQB^kcNQI$8SbV8uX|{vJ4O%j5&vd}{gySvIG^YHxgjL+y$z zn{ynUEPWVQ?Tsuw53Ke^mVP1aZMz~%FQC2E$SXC>x_8?To3xGR zX|Q4-EA6vj#Xy#RfcE#97|7E7dp)bW_j<=+qxvGt{v>rfW|F0U;OJ!Or@?B&Wa*!R z)rQH^Kc~HIt7Pd}yq~fvfuL36?G(K-4{}03d{bRRbzTc!c$?~%S ztT@TiH`D$vOZ#YS^E35w>num|DjuPlBJ&mRy_^@ zCmu3+FCy%!zL|R`en4YI$3%t?ROb_vh*@=zSYUn=Y!Kf zHulTF3EmuI<9qkwdaz<9D{T{4F_WdQrTtHgAF}jYXm540^o?MZCt3Qv)a{&vEWI0? z*lqmp0&8sCO?xgNfsHKty|jPS*uOxV&y5XPHb=p#yO+SqFIhIn!OAaL`m3~m%=jlu zKS6t|lcm24R({FSPgA$;oGd-3U#OF%4+5*5lcn=r8?|$?^dYpj?U^inIPI-Ymdb6~xrEdi*ezNp!V8u_CelP9! zns~_4AE3R}$0p|IdLHGg&szgB3Gb`eEAJvL#DD zLVK%|rN2b`T_%rY>Bnhrb+Yu6V8u+9eww;1bF%c$!HS0@bcb+Ys+V3ieF z`aJ5ktjN+AffYYl`ZZw1PnN!n_D`F5$kHomZ*{WtIIPj)4^$SvGGtI$8QVV8uq3{vKGdk)?k? zdpq8erGH3!tCOXF4pwYK1|YUSnCll=HWz{uYfU*6kbiD?HaL$D&#;kYkFT%B{}~yb zEPW9;88bRr`gLHn6SDN>V6_vn^cCR5GbV=B;JjaiESq|!wK`e)Enu}7vh+K_iRX-; zyTR$dHoOC@*vPWq1y*ci>APuvz@#Nhf1LJKCrf`Gtj{IM(vO1^2aTUk$bVy)|Dch0 z!Enmq%fQJjQ?_LJDWlCHW50lW*zh%A<%=x)WnkrtEPXlc|EEbymcD}aRwqke4OTgm zrQZThylDKik$+`)JNby=2g!eHcn|rg;r(Qr_5e7UZSqT&{}*ZVlCeKd8{6Kerf6SyMOXoj;=UbgDJr|th17>Vw>F0pc zzcGIDz=`J#mynMeo&;8GWTl-3R%~SHm(l+3O0?d^4tEd6=fTb(SOYZRoPGO-;8D>kxhUIi;Qvh)+Qf7PTVOMip*Rwqk8 z1=hGhmi`$y@ejsN?x2v*A-`tyQ4WsQ?q| zvFCbCijypx{b0pOmi`RwHSRh3bF{ZQS@zG8kX8gPlPQP#XBkI31{5e?VKvvqUbHZ{UOV0)8ePGg(r4Iz> zTb(R@1X%r-EPWI>@869dvh=awe5;eCPY25nS^7Nc{E!(NS^72L#3|!{8Tt2y>uGPt zJ+kcAf>jP=>0B#M?SU-)Hrjt^e3GTFr@ht5(zk&XKUw-taN<9VpGUxofh-%YFQOR8 z()ZBbwmq`+CunbVvh=5E|B*QtS^BfIw>nw+i(ridWa%fs>5q+{*TIUJESr;H#Y~p| zHtlU}Wa;nH-s)uO@6-OYITu;_DcW0|Ed4XEVkS#J=Ul}6iSfhr6!QKnWZ4XXo^N%s z^b}Y=$nw+Y_MV=OTPx3{ww3B zo;CwaUm(k7EjY2x*mRITGkh2A?Y%!)_FNxUI$8QoukxhJ^?E>vh>erZ(|@!=RYMYHnQ{_u&ya&>HTSMuPJ2d=Ye%i;d*+B z|2B0o#^F-1+6-A~XVd0$V?Up~*6=d2XP$d32d86(x!#`gPL`ilVC9`Gy^i)-CM{Wd zBkiqDmVPT(ZG$ZRF0lGF*C5QxHa^L+*#^$HI$8QIu*PJv^u5&W{FyBMIdCG!_&-b= zdmSOm<~VKQ#^!a0-zMi8{Zogz_H&}2(YY>tVu0akgKXBT9hw~01CHFb0w z`7D#R1FU)>%YGwR^+J|@7wrd`v}Eab)86W2>D$4o7qawS)CZceh%Ehau;SbcPM>Yg z^)y&SkDm1(z$kDqQ8mZEpYlA!*7EX4_Wr_ zf)x*0`unuEeVHu%6z#1}mi`g#?RY|#{t4}^PL|F!-!#sg15TW4;v5bh{H!Slt{JMB z$x537D`v9vQM6AOKV<1+X>WD1^eJG~HCcKYc<`Mj2CiMD7|61j2UZMZ=?iFY%ZDs| z5$&x`mVOQG?Pn8Y>0DDxpIMNlbFIttV3WrtaM5{&*MgJDkY#@x^u!-bUOK>o?YOrQ ztbCDWetCOYg2CFW}(hpF#pD&Q5zX(ph zX!6DNj0dkb%yngzFS6`k1uI`<=_hD!<0nghgZ5S@OXu28x@M83ze9U_%_2)b1s-gl z3uPry7eh@Q4Fc;Phb;Rcv>9e>xJIY)LYB=4u<}Bdo&x8cZ_<*bj{@ggoh*F{Sl0`( z^vl6{d~q8aS^7+HzSYUn7lGx6EPWMqTX$sXw>dglI@fef@E;AaasAM|5h2UwF6jAI zCriH@thUXyNcHYCSvL29_3kuT`h#GlAS&dKV<2TgVlb>()WTj zPLieX2Wy-pOMd~ZenFOgg1RkRvh=sWgSY!d=)Ft+rQ!F%$`^T}k-bx3<%=x+BXHh@ zru@m$KLO`koh&_PNEjzs`gvf*!!>Oc16ekCV8uX|ej)9@YGNQuFQC2E$1A5y_@zn2D0>>w6{80`XjWr?$vh-KMitRP9Vk67ub+BS1OFv0_8v|MT+qAbj zS^B%Qw=s~VzfXIslck>qE4EL;ij6Fr&%ug~EIlz4{mVY@B}*R;P866nJOV7AWZ9&^ z@=2CHiuU}%By42qV`*=7vh)eyH2;wZ+hyRyXv1Y-twBMS{XE)?F*Zxd7a6Vu=kXtp zu#sh74bHbZS$YdNU1;oY0V|JW+1v(J9?8Svkz8nX1)z=^c6e;us6kY#fcth|t=zfJo~Oj@$^cWG~Rvh>qn zjoW1DpM%pE7(e}oVXj+ZcpzBukY#@kSn-ghpGW)gCM{X|Fxp$4EPWJM@sOn#fzw|x zeu}}0fh?N|V8uX|K85zSZ<3`?r@ht5(l4jIy>B8*pGkYGlcmoC>waoJSh101vkCriJM_BIBx^yRd-I$3%hSh3ZE6&qPLO<=`FmcEwuHU_fvTWD`} zvh>?%f7hvKazS4l?5dS?3)ER({FS$AXn#vh*U_Pc`QvOE00l)ydK?2P?m1 z>9fEI{-YSYy;pWR3q| z#lyApWq%u3@sOpjr@d{@Wa%4dZ*{Wt&9pyl+7DU!U9`74S^B-;!T)LOyTOWcr^8Qx z6*F0Bp9U*tvh-(Zf4M0`vh)MAw>nw+aj>pgWa)2!^Ulul`XfBD^tZtIRwqk84Njh8 z+9X-}=is70HSuH(5A#BnO)gk@Axj@f`%;sZEd3nXTb(R@1UUGt+|fsY6ElpTv0(Mh zV(K%E&hMU3Ig{mc3Rtm`rBA2*H%wZx^vh{)b+Yt%V6|1U^d;bQnenp>tQg3$sRSzq zvh-@&mz%U?>8ogOb+YtZz^ZGq^qthtHFZap{tQ^L9j1-_9EU8MmmQrf{dKTD$018U z3D)O0Wa)3y-hN&~mi{j7txlHy8Cc~>mfrt@uznNZ#4J-j!^u||E_QetSY=L@pUc21 zbF%bO+RrwA$kNMbZ*{WtMPQXVS^8>lVvg~{@2yD8HN25L&+u0ARfcytd<3lL^JMuv zPMi70{tfb<8GeVn!0-p;s||kwPA&{te)uJ7@{9qfr@k5q=Iqj`ZmOc}#wn3J@fciDY4_W#(;Ka2? zUj|m3E5M4AEc?}9#YvW4Py40D4_SH>?X6Chz80)F$8+(4wi((+l{(Z1wAWJ_*dwcyQOaF-WRwqmUg!cCOOP2l_?X6Ch zo|_+Dm-(GDij6FrbHIv?Ed4y%+Zf2whtb~ZWa)Xdw=s~VUr2kalckRZYtF#$w^3|l z*_4148(I2Hujqu9u@SqoNdWa+oi-o`+dejDwrPL{r&_BIBx^bNGPI$8Qwuwr`vtoszQ zY<7Z+mYa6|2<>BrA9wf(u<}J#+NZ(F7g_qVw9gnnWa$TJZ*{WtBj9wkv407ybCG3p z9ISJZrN2u18k3eR{RHi;PL}>QSm!zg9{h=!-<}31Rv15@f|DylR@$r)IG6n#fh;{2 ztj`z7(g%WzRvABoz=K=Oxy}QpYmLtDC{ljON;@2^{F0@Qp#5r-mMlF*d#jVB7lSqD zBuk$HR$cRZjFQ(IpJdt01Q*pAy^QuY{&}>w&%?>GUql=G*&=fqTWRu}LvApe_Zxj0 z`Gm)Jo0V$g>3GW>~cGF(Zv{;M5c<#3(D zEV9^U{KD3PpP0R8yovmEQ%AQt+(x#~Bv~}#jpT90{!a3r7~V?0%1^kDx022VAtCOX(sVR?S z>D#HFXX=YA{XuZipBw)>z>1A58@`U9*vQg%)BZM-mMr~o+FPA0{b_Led&d4*u+Bx6 z%>l5^MV9^oIIqp5B};!1oNslq^q0XZ2eS0H!0C0y&pWh9nld5F<^yoidSmk;SaFhN za~iBT$qh2kVj=WVd! zBunRQZC)pSVIxcDt!cj1$DSQy4iht3`ZC&Eoh*GdSoKSm-ULqHY5d&kFfXx1R^I?lY%(?pG8de~hTEfn3&?+A z^fHI%(Jqc(*vL9B^Qe49^P9KT_=)B>-|B9DSHX{-rI6*ng}VJ8C9?Dm>h>K=vh=Os zqVJpYa$M3omSoxN1gGydHoL&e7g;vD!O9m|I>#T~cerEGUfMs5U)ad9-w)P&o-F+t zu;%k*=`VoOT_(1}V8uq3%@MF-BTIjY_BIBx^y9R*I$8Rww72&ZWa%epZ*{Wtcfjhi zWa*z#|J=k(mOc!U;wMYb11o;A^b2Xf4ZpCFrSoI#e5;eCmw*)yS^DK*)$btqN^FOK zEzjYxVEx|*S!pNH<_E@pI{9A1mxGlTvg~Jql^3$~S+xJ5NlTVKm-bdCOJ4$3UdYm~ z1E=pZek#F=fh?P9uwo!fXFpPVaQjpp?QMG?%f6BJ_nUK(rL*7VTixx0ZO|1nS@w5> z(+?Ow+rWyMESr15ikU3^0own_q$Nx52IpIyEd5ciVjxR@p1N(5Wa(_r=?9JfLEuEU z;UNyQ-W4-hX<6@zIobyD{?hn~wt;-ByKP_*{3vF!{Ijn0y7&3!JMjw}KN3z}oYN&nRFW%#2!l4V~C zRvyXH%V^Jzg^euTpTAk%oxkzXzw$_yeI-~iw15+j;TN{s@F#geR=~2~0KMpOW5cPK zVkXOm(+zuq|`=Rqp8lKiyM-v+0x%{$H0LEt|D5(#Crcj)Q(UobH>jY z{7L+^;X?dT{AAe|gB3qn`UKh^z%OiM=~KY@RwqlJ306F0>HL^Y;~rVMKUN%sfNd52 zq%Hf`*}pORa2!imW?N0L17Ry8A2PfUTx5AEIGJb08M4k*4OZUC(pQ0%ce3<4+W$}E zpDdl%&3vo7*HE^9<=yQIejCm=@wjdHLHdv57dEo|?*JFiUA z!R=ojT&Vq!WuFI595(*hp2cjd=_6K$&%{x~Q^1O!EI-r1ik~d~a@w;1u#u(D1nYmk z$kG>r6EB%_EhYb*VYU;Wf!ZET(fD=%c(JPTG{ z$kJZ|>+?Rc^w+@Y-x!~)Bl#rD#;-5iR^9q~i}rRLBg>xSr`jZ0I_p&HUAXnjF;nYZ zkY)b~IDOp2_9@fa7|62u9IX73rDq|TVk1k>1uHhP^ntWzCa{sEpF?}AlcjTvRa+%X zXWLU-b;r!<&{fVnN9+{{*mB6P8tzYi%`nHn*gqKlLC$-z?Ky2ZTXMYOrkc8{;+C45 zT8f*S>nd96n#WJ9xUs3WrKX~`x~9IRw&iATP0gB2BmOL}smAe&(C+%0n=6_#t7@uS z>uM^RTdG#pRMb>8)%9iC*wm1zX>P8_)HJo!uBgpa;RI`Inrc_{Wo*vhhiPMTRYi48 zb4ydh%@sJgH|i$OkG=0~G*&e=Bd(ezoT#F)3An1NsivAKE0AF~QSZE&7?#)8SJyN( zS2V2ne{^6Av9{)meKa*xSG80XpDBz#(o3WoZT?#u8ylKhkZ%-2b8SO?v&sCtii#Dj z^_hwar{e!#Q&iP8*85)F3|MEiD=Vt%Rz?dvY(&OvRa28+FMbt$S%7^Q_tlJzXTOoM z;=e3}Ohd!WUSp%sONnjlIXgl{GCDtE%d&k<06A zDq5PV>YFo7wT(TRVpuY?&NS4os9o90X4}|&J$75`Vcl1Fwdk3BRyA90GrF=@oM~9I zhTztc>G7GSn;TmiDr)O%`#jpPrm+*W#wVCT_-B%^9s=}ZV7Qz>qp2;yQzS;HOJO6gXsjEft zRIIA0t7|ZcdRu;JF{2PoS`JnyQ`ToqQ&U4zbB}U2g@njz>itgHccq#v)ztg-gErvU z)BVbtdW@kNj=e3d%{-e8*yGXOYVYjSRV}Zn>nk!-&=o7{s#db>YMV1_i>q2%nrfG$ zCGhX;_SuNIO}tmQWgIZmhR>I3p`>1lDS@&dDC~*6l&39GOHT;$d#&Uu64Vqhvr^aQ{N*+Rdsd6s^$tdP;^*7dJL;Q zOd2rAuJJ2}expb2Dea(K)!10a`IJA9@`{4K(bHQ``>>h#*PmY2>}d_HEz5DGsWx4% zPm|jEFS0PFTy=f*3Jh6|xZk+pPPG{u93K^$ zWU4Uh$n;2IdyzjK!E~zWW=yL587G=F8dV>*wyyjFvhAdzxv?hWh4o~{`{InpOEE5H z_F23|qdzmht7SPmyrUW!Oph*Eu3}`|?<3lP5FobEr*#epx(3F5C2Q(?5 zi2+RrXnaT|0S0jC)ZlCZO$}&DK$8QS6wt(gCImD-q>=ywxO7Tzwt%JvG$o+P0Zj^M zVn7o>cC^Vfw~Xf=Z`rMM#%al!uFA#Z>B3aCLnVP2z@?LAH!Yy40Zj>LazK*;ni$Xo zQje*VJ5HGvZd+}1_Ki>jHx88qVgQ#;3PKHNYCuy0njFxifF=esA)xW&Lky`TzyL0t z7@RnusR2z1XmUW40-6}mgn-764>6>Y00X#mLU7`MrUo=6pveJE3TR?L69O7PKE#kp z0wl~`G-q1Hc%ApsfTjgBHJ~X0O%7;MKobKRKi)yP9$ylQLF310HNKd-A4Z9Rk_rMx zvf@hvnikO1fTjdAIiN`aO$=y4K;y@U=n%0ag@OwRwBxou;%_)U+&BQ8{`eSG{OJo!6de6w8MnaSTaozMP#8?7P5J#^ z#I6H&*Nl)=c-~tg`FQ(A*v&QP9RhRuW;yS*{^bAli_G^d%cEj=EaLC7=kc9wNW^>$ z!;kzOMm%o0Y#Zx&%jFDzb)JJZf2HF}`|g)hVCVWP`xQR(M?(5bIsQ%~0N3CA zi;*V^c2j)62e|&ak9gj@(CDuKKZ=hZYq|dJD)KxGy}>4b{3z1(xAE5~H|uYd>ksVu zTb=ei`;nmUGw^5Al=`aY?fg6B7bjqRY!8aB83|l}lP>YRjTG!AfAs)2J`XP*4YKut zCKmYnb;RGZXe^WZ@b_ZG-=KfM`?Sy)AF43$_e-4AjqlWWjB9=P<9A28@m=#<&)a7G zp~wS&51nWHO@PL2K0e^ue2!uMrfdH2yDaz@F8uAa8RmLmcl~4JT^QtO2eyWSUirLPv6#+C-~SPu zpQnBKHgi5RhZ*Y?;pmLPxrYm081ww@jvv6{U)s>xI${T>BKOJMTyH8y?PR}xUT1k% z?y;;fojY!q)l;}ub#=zQr(oH&A=mrLtb)$Hr3Gbom(7TskAho?(u)nweW~E+m?Lvv zoPT)X3sW}j-Bi4}uwz}he8dj!?&#}GiJXGYUBQ`R-Pxnd`v0~(lX%iwwXD57?q%@B zL+i@gM|TVy93R>J6Yuv!N2Y%6#k%|Q)d*iYUrlRQPJHW6$_qNjY>+ml^TX2RWyi~A z&e=PsU~ar>eVa;T?tzirx!%ZBKQGgE$Sd5Gsod{PjPEb)ydrbz$6m5?w3n&e<+Z;M z_p)CY>UI5~!#nsF1MbRHp7siI%I}OFc>I>-N!JSO45S`#OJInrVF6>&hwj zGADoFwU>|fvdboWJK_hoOx*B;QhLvxHPp*S{t9xh-jeZ##wKdA) z+fB_h_WR=F2l~zJSq8_t;;HPpJxamUUDli#vGr}ya&*sC(*KLk)rjLA&+oct(BE_- z>Nz)z95Z;>$WiNtjV$>7u#u^+ojX+q>_@9mCL0)#VrJ~~`b8>=~$`q*!mUk8eHSD(G68}igwlyfH|D5*n zd(hsiVqLjj&hY->8Q4OHE-B3IihJ=;9n;yKIyfvFxoRIZV_5dM*s%6-2Zv@Ct{d83 zIAdt`#j&C77atswU9@gUd(n&`t!Ps-XGe3k1#uoYzpGzWEcBa=FNJx2PJ3Ag{yQ6Vgtus&=s$W%@6Xwrm;0P zVNQ1W0JOUcyyUP>uWNfemOXk<&f>fF)$R9^_YI0AzdbM(JJ??Su@|3}*?Pz;x@z5< z?dW;y4rad+_hJXTHjm5Q6rZu;&xh?hebl=FE%X(SM>fS{Z$@*+@gg;NdFP3s7yErL z)fF$v{^Iu2eQsDDej2~6E_d2$tULMfXXh%%yEi2lZ;oj%(>A~>+#Gu|**U1~hM_a# zGuCY?&zyW1y>(gJ%y@EXJodvm(O6j%iSyi8vqvAz9(#2%erV83L0gL*On&@te}FfP zLQxNH|JZY0@BFbe8gT|i8S5U5sD6sRJ`VM9saFu6c>R-z@o)c-sjP`jMZHg~+3leg zB$s7{5nfQ9+4>Vi zaN-Zik3T+l#;oK2m}xxZUAiKfyY{wyi}!n-o7Np17*}g7zNi0;SogYe)J*HA=T07) zoIDio@a+DlM=vlX*?v(hk<2|b=$fqgoyRwf*?3}OP!eaz&7L7)EV1rimM`y|yWx$X z4AAepzjMQe!#iHs_56_o^WRwb`jQh%U%T$rxW923N7e#t` ztb5^{v(ZmR$KINgeF**J&;{OATav9GpWFA6o(ZWw~=cymtB0<4b3Ld+)akmfgK9>pLG_RfW+d`_MQqd(6@7_QRKY*@c60 zlIM4NV;BDRt}fKw^YMvqzk=SYyqg-)URTE)FLoea-W6}VKw3Lm|0BN%QzYZR`a`C% zvsbHe^SI!vvF_NF^gS{a&z;ygE|zKA*((Lx>8a7Z+bQ*97k2e)!|1Fis(7tVaNLb` z&)=4efBL<`7g;W+`rX_*6%(xFz=7VDtCDAzVch=s#}f`GMuzGqy~mL6wv>BKW1jqRYjpaG<(&&R?6`f&#&xq*cKbT+k7Z6)$7Ytd zU$nR+b|w1e6|~-Jtz&_uDbdWyoiWa`j%HtWb+j!qUFDdtUQTqd6nN!mFB|Ql$86on zJ+HkCr40`ySI3@T-npxD-K^LZiigoYhCV!h!;zqDd$$6&J)Ii)#m7rW^*+v4eo%^N(=W+E+x~UyF6$%oLB96nik9e{l-005ug{p<~^Cd2H;8 zZ_P5T0d?8k74L?hr9r**b>>R=39s~s;)dK;3tk>`eD1ONFD*Q}@PM4VuS|A+{JnJt+aEskEzC$B9^k!yE%xw*^Jv#| zv&-%&$uzda3a)G){YuG+`;!Cmy^-D>7}e%FbHIWh*0d%E#w#-?FOE&@ym-cz@=WEE zn2TT9YmD;y$@ux5uLk9kX&Z=^Vp8AlW$)aK+1Vm*Unlx8XBLZdVqJ?nype4?y@%SK z@J6od@Y)|f;%&(pJ_uLD{Y#Zt2cn{&HD`%9K*@{uBbJUF1p{*%0L!Lipi2wFyRDb(F zx-f4jws(={PGrChBa3nWP=x!3Lfk)$#r?yW@#l{mHRJq|1y`RxGF6593EV#v;r^lU z`?#O@OWaTV)zHFTca_X(W2xHOFa7I(7&~YAvF^97${v@KvvBVEV;MY|&K~`%Z^hp1 zU%KjA%!!L|&(?;qWb}X-?-Uxdc%LvWEA)W$Z)T5Omxz`y>ubUETOG^(rS0R^CECk6 zQ5sdeuZYg^2d+Dyc~$Qbf+J7crQvz+S+qMRdQRqb>x|IGzgsyUcPr=PZsmO3t(=d$ zm0`GB8P;AnV;JsMhT(2yXg10acPm4))3|#{9~^Q4>Roa4xWmYf4SFP2mlfV$U@lvU z+3H!p%F2G_EPt#`ZW@={)p?ay{NfFH3lGnz>#Wgr`Oilr@0i@yIj5);cNK>}#;80c z_9*T%29>ryT;4y^7WcAW#aN9`DK^FTt?i6WT)QEb@m}@SO>ye6ZqDj6r9VaMDk(Ls zt7L)wTgks1v*K;PA36XnY`^zT&_ZJev+<>#oS~{66mG%2gQvX=p7*mJlktJ}-T|$- zk*#(q?j5=o#bXy-#kqO;7R=0Zha@;NzqS9|px?#bY?{sb?*96SL_z104eDj`-@ml! zib0EKFCLQU>L1H3K2Z4l>dtr2OP{}DLU289M+xrkaC+G7>khC!6PNepkw;QJj)bFm z_A3{Ao6h1`5N#i9LnVJ2whw>QPhkd#R@!sSz_p|@)~#0XRPdxnIimO2oZhXJaUDZk zvSYiz{o`Vcac#fEDEXL|du?*@CXAJjc@M2i#|95rKI@m|1)bsSfS!*-aZ0zl=hLLV z`}m$&I_Gc77kHaDgfZ;Kye01SFD)tMjG!w%thy_A)~e*xp_o5wt2HZCy?-C2P>MV(-0;%vV}d&#_h_Ym^oVnGZs$vG9rXDe z?f_CLm#VwI?y6bOd&(lV{@t`&&(YSwy4!O_n5y^lvETUh5?*gOc7}D+cfD-AQW5(# zaD`I?e^lvL&gohDzww_0g;DlZYs^XaywE1h37_&6l@^p|{{;1iJ3hY@(b6ZBcXbY} z4%^&>S~jzFU1z8MOrFQ0&(vha4)Qr< z_UMkY<8wxOqhnW>k1XCfXk=>Cxdol!GhL3L>&nKKj?5mN9gT-IQh9Zl+c7<^^)eczV-PdAPx_H9uk^TSDd#HcR z8#y56Jv1N|8{B{9;b@fXx0Opr^bfs;bSD3Mmd3irmM)qzVb&m|TfhBGcHXz$c08u@ zbm@w+SIb7DJ+f@W8tI%>*pWGP827KZcRf55cZbOz~G%r&&+@3%=x_M4BfX*JTHc4)KBz!HaWfsU$vKF zPYJJ?&2cGbn_qf&9Hb9uM58rbWOPD&Ix(BeU6U4G^f|v zyef^$2lL**|FM>B$Afvfrw`@DU&+h4zr5!4Bi@hK;Czkqcb>;5RNu+OyQcV~FJ0qJ zIC|xPocs1^;pr*cyz6fGzrk1b?bE;HljpssyCz@zU|y$p@0yy^d(Ax}jtzH? zy&!k=mU{+`-u>91`hH(4&yM)>9y>Ppxy&1bpZ?Kf-qU$|O22yV{h86j)_9|bKk5}8 zU-(kI>w+N#{kDh4?40M$d`5k;$CWEb?~)pOZ|3K0>sMOQulqUTPc6-_o#)*3^?bI( zCrWF|=G`#bf5LN*?7?q1UB&n8zI(#m#bIk4kMRq2ykEcIxy13zth?rX^QCWQpGjo! zi%3oxuAp;yUvu8Ln~NU2YrJ>EeLup}k>`tQUf<{S$J50j*Xrrwd1D6`W$w*+E(iNX zIL@6KVs+6P8am^-dARmFjl0+0avWS5&4Ih3+`K&x=Dpsx+r46sUxX&!jJM+3CuZN~6X_4bAv8$miEhG*WJyOEDdZdIk^+-XUY-9Z}B@?eCLY-AMbOw z`}hC=8#j30-^WJ-b@+bM`y=N1f*`bqGd-#dT{mxZ`{oU4KX_p|biS9gdHfv6zv-sg zzWvZ6@Nnk5dEMTK=BwFZmCnaQUPT+ed&Jx2?znco#dAlGd8s}8Mx(RUynuh^uQJZ` zj{BFJgV*gqE1P_fXvKKreJ zKR@`$ce;O5&)j~2&;0&)ua~0z+Llav^W`0WQx!hH2zEL4n#Y~r?G5&pAADcunF9re z84eHHh^@ES{hZ%}glhKi*rVBAbycmqgNJ)y@OnNxUfJna-;VFy{PBKWRYPN@Hpt;N zSzjIaa$?1lqN{M|#l{IfX~Gx9UV)GPXhCnG^{tsqn_Hz3&=4+J4E9l|R|A`24N?-#ogrWQ%z(hVLA5Q5XjBvG9GLQY?xC zgP=Imga6P3@4I#Xw_QdkqK~BVi@p|5V8J{`d2Xv#KF`Bz z1l}|mAU^9n6XE->xcBjnRmG&-}PawV}WF1nh?+j#uGA`z1~~?Q0|PA!w5c#-D?cbUU32OicQzNczc0e7;lO zT=?@ao_F9?!O$Q3Uvh`#&2;Raf!YT9(T@FOC!PMUh{XA>q6z)I!Km*j^7DN^_4kKP zI`a>;W1Q_diT&dbu)o5wZ+6mYf1eZo6ysqG?i4XaeOUf<F+xE zS>9(+Ql}uyvT_UK>L4>`Y(Y4+TJUibe8{6B;F_D55Hk?{omunk7K;{!x&Njv%HE(dzVDw z3nTG*C%y*${v2`l_*?Fzci&$w^7u``cQHQP{biQi#jif}r#uqpHzg*R^hJtV``So+ zStQ;ViD$>NDeoaC{eAf7qknWhrauLd`cF9a--11-3RHW#xA)@6{%_(7!~7{NXfT?)J#qUlQccmS^H)!uFZ?>aac&Ul)mEVA^2P z?})_LIq|LVrwIMY>qU)c-$@^g^j{4*b#al>IY5?2mY`{j=wrxOW@ue~R)7ocglcC+_7SJr~ci zhuiccIDU*o+;{BPJLS)S{qIno_6OEK%Srz((m6Gs{Oj)jV6PVGQ=D|>&tA_C_D-R{ zu66ujdKY{#VQ|pCrxb-3OkeB7$D{lkBjq1)(!2X}srMe*+W>ow-x$jK2I3QuhvWGG z{Mm(gk&Uyy4PkkgdTWsWs*}Ha`CstLk$xKK?)aY?=Kn(Af3*`I0DFGhBKz*;CB5Tl zUjfq9zw~EGm_O+~jP&b}J{Fqx$G4sIg-BnD^bt<_K_`6#($^u~y*~TQNq-Cd^(fNa zo1)m7g6?BfNd6pTTVZae=>^jfC}xAYK%XZxi1WNzd*dCViS?e;evA$nAc< zU*)88`)zgNGhlxe?0df+9qHvD{YIo?GxXA)k%7P2?P22C>&KDa5p3TD$d6*e{Mqp_ z()$+DYmlz{pU?V*jRlPMy2r;v;$tK6agq4tk@$GePSY36ft!!}XFFYNP$|dQCt=^1 zG509;B?YD*kHp`L#D8V4RoDmlxWE31(;nu(ExeX7{Ay<^7|40UXA3xK4L%ADUjvg3O^MXzr)&Z zLAm)D1$B}BSQUxqaG=@1{EtP-UlZ|Xu&pl_cKO~&@4ZO+(~<3C|0~6y29{qDY0nRA zoYQ#b<9hJhk^cBWBtFx|SE8(ZjN*?X?JteQza7+!V=nZ3T$OXKUIqFyG2;LEwtsjJ zl<&p8t&#pY7O}tD+JA(y@^QZUo=rax#4q*uE`tK=dngjWJF-1)wDoO-Z9bl=Y>%Wb zvgPxcO+Jp|^CRV5XODO92Kk43&)fLUz1E)g)ydK;!0}J9LLf^Y3Xa>8Dp|S@PTB1-2CP0I z%ccOVJ|Rm_(cW%5vUIjLX?3^l*FaaFkY!&EPTOrb2OQ%@Ls)=C%=5EsTEX&@ta3WQ z@{=rm1?_qAK_E+C1x{L>EPXvV{yA0%Wa(SLxO%1Rk)`K@V;501_rS4%hB+R@6UaQl zA+YUYwmoI@E~L(zbcAXwF&2!l9E*4zIZhSNxUj@x0eTPNPkNByP57h!A^O5?NEWMca);F^B zskFB`S$Zj0zRe=r@yTO?{3OeMGFX0+rB9J3?AIQ>!ahuDWp4VgC z`ho2A7`Ik;$1TTUoEK~e?wBm2o@aEj>YWQt^ffwJdIdOXb+YsY;MB;V_+b8o^eDsi z(BtQ0g+P`)?~kODrSm>3HrnLf15WY8h_Ii!3#a3UG`i?md@u>=_^b*{4Gg7kY&UFenCEv zrSsXjjvHj@qiAoBCuHg4XwM4-1hVuAw6{80I-ixvXR>t8m!YvrmR?mgf8k63_k=`|B#jU5wQA)EPV^@d0;~zOW#I& ztCOYg2CKbf>4&Iu=R+V%KL$?m$1;SMz_DV(uYlzzS@tKv@{=t6HQL+lMV9_1?X6Ch z{xT7SV?Q4(|H-mh2$uh3>5FMU)#N2hucp1# z$Yd|S^7%aTb(TZ4%*x8MV7vn_EslL-vHKj+ys_y zWZ7&6%Qv$0t+eM!8-Xl+JMFDbmd@XmbY37!e+C@8%9O+V-Pm-)C&4MpuYnVPW^}Uh zz6nlRohC;oVv!?i~*}3$g<&cH}wNqdW!a6GvWj`C7x(+LZxmeOnMBw#U?1lh?>!?(@;YR$C|74ZZ3YPz5 z=^eEH5>^Og=_|lVtCOX7f#pA0`UY_N%UB`YhebY+W%B@7K9HqvqP^Yk$kI2{-s)uO zTWLQFD+IFi?ck)<$2=WKMt1vWa%%{{;OCakfomhC#_DF z{uWsNkfrn9AvFgALJ>G_AJmg&a}D(vRtRM2v%skv1KFELn@fxhSvE^(GuPNu(}owG z2xQqbgJWMaHf><_16el9!RiOH^p&*N@zc@opuN?}vR_MkyS>QL*U{eUWa%5h>8}{y zwt-_e8QuYwpJdtZ1j|pd^j);CFnP(+_t4(zWa-a<(=(0z0kG;K%jO_hb&;j>`ZjU1 z$xD`gl=fC9OFseD*dR-P2b`X5%J~#5AIP%dZ>sWvEPV(#!2<>YS$cx@Rwqjz1&%E+ z_PoxF{kh>%hs((ejXuZWMPU6u^kkLEYslDN82e`OBExOq^j{k8puX7fN^+&);M&si z2I@WLwnw|A&_N1oA&lciMh0&XY3b%wH?W_=ksB0N3!%Kw68OH$SM zX(L&AdHo~b$kKT&B;Ux=->1Fxfh_$)+FPA0o$tWOH@;6K-^jA*3zlzW=@-zx(fCZ3 zK9KfSCrcj&)^Ua`o!45iCQ}ZtuVT%H`I}7a7Q?f^=@!GY!Sa)=a^`~NCs}$0?d^6X zOXoG1`j9Mr5$$bXk)IzLBMO(B2;Z$=z17LmAELc&FIoB{w6{80`gXATVFy^gk!7u&x!!vi}S$|H;z(;5RP$PnO;noVeALNtS*A z?X6ChJ_wv{Gxo#4@}~eSf5@^g0?Qw=^vPiPLzX^`_O@QK^cl3bI$8QGuE%Z&f6VEIf|-W6c^OqRY1ET75JSJU45MwZ@1d#jVBKLD1`Wa*p1>7~ZE zA^0O7$g)X*v&6+&fDpD!klNx(#yc9POK1k>6yMQ zz~DE^6mQ57c=?sOJ;2~Od}^g(p3c*MWthV^w#sl9{-nNP_#XVx^INj&-3*S|x^_6c z3#|Sj%YF}7{X>?%m-csHg+P|RADpy0S^5#Mu2sm=Uj)bg8Y_eoSmfI&hxy1)Z6Pb~ z7;tPg3=w!AB>%~>nGcr#Wa)KaUCWWB^L|IyJY?y-uZb-;b*-mO5-S9i|Nvo5k^ZrHS&Ape2p@=v?oXld;6^3NZLiB(}~l$E|E;gVWzM`h4o^4KJc@nU~SBnFdy$kmbV+u=<27 zy%e0_;6*6KBAq@YtxlHCTWj?RS^8q?b{`~5uLGyPg%!dwEa`g#G`}z3XP84d^=-rK zn$$+atUhLW8(6<9kyZYa;FK+M4_Iv{%ZB@o+8*7H5+U zU;P7$B1`A<4fYjv_gTk1&~@x0%bxqbboV&$IP};idCS>2-dTDvh>4X?So|Lr>OhJf3ozCsE;%{S$ZGbGp7FD z_%INh*pX$~zdoh*F_SmTx~J$PUFF;fm%I-hUo|BWU~F9z$HiY&bp9DBr+QwG+U zB+F(dSYwhbozF=UkDI(?>3n9Av^rTjpN*(3?sJkh>O9yWkY&&39y*4vb+`+xcg)DL zUk}zhW@PCbX#a`vlPrBB?X6Chz6q>%%*fKWf@2#@IXl4V?-_m^tbQZQ{zNIWavmLT*J_5_oYrLCWvz_Hy}A#B4U zf5@`m0hT{x>D>H@A7F(*md@rStxlHyELg`Vvh*Y11TRbw$kLC2lU657e-*59$kN}T z&J!{MS^E3n)DNlReQYdhBUv^dfz?K`^iOI36jlgi={y7^txlGHAy{LEES;CX>8FEY zJRXka16ek7T|PvwE967;x)OJ}*Qy@{KGT?(gy~y6-3U8Q%su_T1l-R(JRP zQPAZZS>=~fxBD+y`b==@AF)E1jYYnZWiuBn-^kJ{XulsT1hVu6;H1^b(s``V{!5n5 zV?z4JSRt&yqWcT7Y*vF)&tQeXeP4dM$AR_G*7YY@_ODU5keBdJL?3$2d(mxH*n}a{`D@?zURn7u%%Gz*S$Y*!Ea37b??*6`v_D8Wo zAgjz~aMJ2z>A|-990G#7?FJ&Qddafqm{+~g@t-(`L3_uvf#Y0tk!7LttmWw7ccOFu#Tm#{)0OMexdv^rV( zJ7As5$kKT^lKuq*1dhqrzXxcZ2fkvs2!G@oS$QXeLjpJeH? zsq;Y{0$KVJaEuo$2z6Kz{}o`svRMWxX?3#nwczyYSRt&(l6oV+U|YoAG`t&s(*JEZ z=tKKXzT1cIBRM|F_(oRwAA?hGnY^FkkDf)4Wy4{iXAxxSxnMnuAWP@tFg=SPOCJc< zvk0A`P3pP0Noe(SNidk?h;dDSOml~V^+pOB?51FKKS(wk|2 z%G67i-bQv&6+&S$*ppP?u&UIGDuESpha`9_w`eNDba_q)V9NJN-`MfTj+ zl2&*3yHeV)futMN|6ni(o;5U(!;DJ7g#=%RVMc-`An9+ zf%flVg+P|R5uCI-S^9Rcd?riZ3r_zID};Sm{kZmnBn4hn*COc`R zriLwSYvDwNg@5!vus_T6vS+Q^{>S&d)I7VgvJSJ9R#p}|o(8i=_TndJ_C1IBK*y}` zf=&o0XzYD*Om{j+x4SUAWNl>~`lGS3su3=S#nfi1JC|0rwly?&aF)wZr{`y!gq2eo zH)Wc$*5M?X4b2T5JtiwYYd3bA)i~3H$zekuT;JNDpS7HGpQyMnyM5d)`cvmS=7#HN zsboh5QyhX3=vu$_N;-;vBLx!EanD>032Wqn&)SYo(s zvlF16p(xXX*=c+2894OXpGjHs^-etmQbPlk*+(FV^)?*&C{?Co(^<++)KkHDqC;y3NcG>rtnL1ZcbyI)O5FNstvYxU>eMz zd)5tPx=e$FhonkO&WqYHS8rIoyYHbJLOmE?9aYGa-OkZ;GcRn!;H)myWl(oC1LsfW zmcW#&-Rs9D!!IrS9jJ0I~BX5(#}HLtr2#vTIYy-_JP*RY2xe|dYm7yBZemi zcO;pC+;cMHv-a4T=Bhqx9cRqc`=P-&7M`4{a0)SvTCt+GJ{U8Z6=sHS^u#%yZO^f^ zb2#T~_F)`U+S{v^X3k}6^vI*_5FX^}+A^7NoOFu>BcGE2w=`quIaW+C{er_#OIvN2 zoeA#b{HlyP_k5l~YC7ANXK<9LYcb;)eO}p6>y62lf_ae}TWZ1{b_+2Zs6GP&RMgRS zJJz>$X4-L}tyjzUlR^q%%G5Ax zNF^Z^hcqdq5T;BCvxZa>QgKL=LdwGAFl$I9Ar*%-DWnjll!RGBDha7Lq)8!#Fr_%m z8d6C}#UV`!DTFDL!mJ^cgj5{Tq%4I486ygFXee&YA?&$HtHMVzQviic5+=zErjKVf+*(7|qb?;^g14X{Dw zwL^Eyn_TXBAHf-xHvo(Ldm>WadUPtck%G$G5h*WKfw?-7$nw}mm3Liadn_1eewT=r zcXecY4Enm6+lS>{?38ym*lq7iDDOg6W`q3eLY#7`)%T#hm$4yO-X&P%Uk*CjE$_8_ z)Z0sYKSf@*ysk>mdkX`P<;9)yu8fqoauE6%=?e0%7h{$@U)~1p1s)ez5rwS zH$URvvna0*E3iT3eJ$eO-g>-qV%wX9t;#ze{p|X85YE4=!tht+^@(hcid!((qAhQ@ zQ{JtS@^;~2*Un!2YmAh)stLbK!Dsg02&cS@;i&6hMFPI}QXbz`Vw*~_FdT06yw_pJ z@#tR2HG$TN1x&!dcy?TeMu4gm0b>w rFXzqvyam!~Chx#`hQ71^7-Y8z{h~HdKY{Y*Vuxh<@3AmX49oumX?mQf literal 636310 zcmeFa3wTx4oj1Hrk`u0C;2(|PB;+LFT5A(b5D*bDQl*wda&kfkw6;#0A~H&?wMw-YQZwf=jrz0V2I zci!juzCO>aCoAXozpVfIughM0t+j8{FRJTIG+jJ)cGMqAEmC9qe>A#aZs~ljvTm$W zp~*^JSaR~XsK;#I~sa!`ND%Z0K(3iZ>+d zd)CLhlHKv{rp{znQ+rE;^2<6po7=kMtzGNW@;j5=Y5Da%jcNJGL`PbFYe#chexft2 z{l<7Q(a_|kXzl2VcP8r^lAZD9wq`Gd#c%9PCe!IRCX-%?E&cUY!7O&7y|p!c2A#=7 zOI>rTn@3kyOFU7RXiEBB^4N9`9v4lK#zbebwSA-KzfV2hTDK{lZ0qi9PIje9>MJ-C zwlsHj#}myRP07x#p62dgB2N%+>}+q1H+$9NWE+%sA>%f$b5I8*vonad)wTM44=S7_ z4^K6|A-OqT-`w4jZ1WY<({PFt?`mEj@7NHpYdN`7R14}@wG!{?N_L@_`LarpcXVy= zDcsnJ3XLaPn$aHdresS?yHA{GZ{N_Iu0v?Pa~L+aCfj=geL#y-TGE(9vL5fKavDh| zaJ)(90D5J@?>L*NA-=w|y{9AI-5y7y`qG)oN-OHFLmx^>(b3u7-JWP~iEl(VYi@7z zDRAWJ=xmI4Z|+Ewlh3#QOUOSsTz~ri6$KC9f7vPpqgy+XWZD*yuJx#>#S?*vIi4p z-q_O9)f7hu2-@lCXh1zv67Oioh>TkGwU9BI(noZUOjCRwHk!@KhAU_!pG62a!XL+1 z40|0d$!=??q_e2G#w3q^j1<=Bs@tfo;pBwBhkO?h-X z`ixT&*X`#tvQOCEoY;WOeG?rXFoutD7XwAQ6shM4lO(myjKFF6bf!{{_e6VJBRY`3 zEm%iE9-F!S#0(p+yT#TQs)Rt@n%DJ8-sZzKMq>PUl@c{<&ve zLqoi&E8f)5$+Py!R4}(6QAHoOX;Zt$MQT@+7D(x%DU8%U$%8|m5k_oS?G)X{IXZB< zm#k&L@ejv7sjnfN4vfRjIk~1voWgQSk}7hB_`0_4W(?$o88U)RuDm%!{hc*;3yrV9$Avnf4u6fnMDNgDP5rHkNW@koZ&B=WV zPFXCW|JZS)7zbkI&axu8$(-I;e`z!mJkw%I+t}Qarh1+63>sT>M4`MPHT*{fFy}@=8UYNE#8EAq2GBUOWQLj8>wS7)p15&hoL7PT;e!27i5}z zf^5+ZwmEBnHLX{e?m*(JKfjLEkUlLlXTb>9(N*V{@Ql>Zgd>W_Rehih9M4>7qI*-i zw5{=0%vjPaIi1v86QQ1(()Aa!Uh+4FlPb~ExiMV|XX)kFcPcgA`AcUX=spg!uB8JL zFthaXTVs9t#Hl6bMnbyzies8pF{02pK01>(u!nMgA=S35o4T8lZP>90tgG2p&Iz&s zt5BR@vAn@ipRjkAc!+36;ALZH9R~lvMt~!2Nv^L;Y{pRBmRyf1AG&a0S>tH^C1UKY zV3L>!tbJ0=#5*v`w){F#}II8F+@5yy=?4aRN z&pb@ezRSh2S<-gYZEk4~EDb~r9r+YmdLkMe(V0HosYqI;t1hrbCxR4DypuV4x_|4& z75OSxFP2B{wVov9^wf>xDxTsR`kf<4aV=%i#U6^0E@kFs_zlU%I&`Ph4vRD?wm2+0 zn~EL&-6xBmvL~mv@=Skh_D@Y(xd=8UITZWqj0~MjtNDa_Md=L2aV`e}D;G=bOU5ps z)wN}8XPZs4fB`Dvj1<>7G-CwO3DV?6Rol)<6}3GsF-BA~zH`RX!`*|F0=QjFFKrW@ z%^m*XKri^sIV@$<1-tCc8&M|e<;M<09PBFq}Y4WW4zBb&e*Z+ zb#_g0fZouP44g;IW(5k?+}NB5E^^H-#RyWb%r|z{bzqZ|eUnqF^plUEy3bMVhu(V% zoE5YaX+>;iy|XD(O>8Y-0va##87HgE*+EAwVRx+)Cq&(o+i^<7@e|y$*4~WNSf(kH zm~?bH`|v5vsWqIL0Y(a+FWPikk#^Ixh_&5K^Zst(Ri)V$PZ{!@j-ze3%dC_G(wWWi z=+T?rBjwShOPZ30bDq^TikS%ZQ9IEWeT8L-%HvHN8aNZderN+0m-R{i`A_S#a=Q|q zHli1%9tK*+N$Yn~3(O&qW^$wD$&KwTIJ!oZoAk-L&X&za>m=EDm9Gt+M76G?qlHJ6 zvsdp-y-uRcIYcYAAF!`K@@!2Ph(kh83-_+g{DW)VG&PUO9+fyuV6vXRbvoKRw5jw* zt3xaO{ccf^WCoJZ<}OwX-+s9NbtKC9s+Xl zMe&{i-#Iuzflw%?{qgW!=M-4wfybFzj_>y;}%M5+&{R*Uui? zh9Y;hb1T0~Sk4mHyT0z{I|qtS)49lNbM(y|C;?WYU6@1Y3TUuZ^cvL1aV8x4@Ji+D z@g>N2HqCtQ>7Fx^c6#gO+QsICm>=sDz)-BZk?xY4TcK-qe#Kl<#p}j?zGnI2P$;A% zgw%g1j{^66+((C>3P)jvnhNU4uu^$L52!7@kx=NTc_kC0c}0EEyjfp}=FONsJ+Ck} zJukm%dS32tbMx{;d3l8s^FoIY_K&U#9UgsU=x|B@JfzPo2&+Wpx7FMokL_48IWPBX z(IsjytfIA(BV()7!fp2;zhCt#@J?KiIPrj5wfCW#JoRmLzY44EmFHc#PY{^yXWpG>vz4(VNE`@ZISC^<^y9D>ugibv4LEt&LZJ&g=!Y})krB4y;&;v`DHH* z4t(%YIC;xitn-5dq3XWslII3@pQQ%JAI=yYr=pQ@-wMqekJ=bNUPZ>d7asiIAE?Bg zV^rU8`M~Y!@qt~HgW1q9^(EHr{1+`gws^}u!Tdwjl3vmtaQnclJzE!_p+sKq^0(HU zp(5MDe@?6`456Q7%-Zw%y#rZ!z28;gGZJ?m3PpbRp$Z*-ta?Y*;F!Z15qLju3_Kq* z2DWyn$HTiSm$|lP?TP&E12vEpdb7!?z1+QhyTuchXylTh_Z6V`6`=POp!XG^_vNGa z&drYBJJg&Un{04e+E_!P&dTTCv zGkR+*5B}%D|2*{OJoM)2kWYtvI(jq4hi^?kxLfz;i~AG3qtf~mRH7Y))%fGMY!^w5$m+T4+^}QJyiiA}Lj?K)x?60Z&v%jVCMtw`|u4%&9qM{{x z9}hp_jx;0NM9bu%zvXR39izYHp}*y#zvZH3a?#&%(ch+LqQ24JrlY@2M}K3B?5a&RjZp#^H5Ojzi7v8mHFo4v&h24_9*Jk$Smn@xr5SISR%(Z4()F zxbl|+tG6A)xXsb@y-%?{CB;i#t!MpM74~O7`@u&ERS*gtM$M1!u8M@;yCAXdVT?ZS zU4Y!y{cOM+4Kk5K+kJUzyyUY^@;R_;AS;{|8XDa7!|_ZN$*#=sM!rFC*1G*HbeMKH zR_fIAMq$JlHA-!{=N+`+?&?TZRoy$gWCR>@d1gWXM@Vzw(T^hG-+q2h_;AhIZEv}y zpmZR)bMO7T!x;S^2o2OEa=xw3tBj0-?x-~bIuEI%(9p<|k-YkFaxAOw#MXzFo|Stk z$6>T%&!1Pe)&8t@#kJ2|Te9XWYbJc=&zH3=|Jm{tmp^m)#JVlLW0s&@Lt*EC-_Hj} zT{=d}cy^{z>s6*29Ch2cRNfEH2=cbz{9MpAV`dZ=9C|w2k`2*4?KSQZ)ZW>K*v}nKnC`W(0E7x>~MQ=9vJp6{#EB~UTd6T>Dd+$ zUkCaVpmDgn_SRYYOn<p zt1Q}Y?+nM@qi%kh-el1q0$+pln7+H^sj%cM&oE><==8rAQfaz0pg+T+-vRD{KFqlG zmsxVZzh^rBzU|7-RG&h^FC#6M0&e>2fOR-ieF^d#L14n>$TxxRb+D)J^#^VL8OU|e zG!pvgKMJX|{G|ZB$kJbh{BDCBj}W>3y>7{qkoQ3*?Zx`6wdADt1?Z;(^l^(Wg8mTf zMNEGF`kUy~-(1La&~&blO4G|M`drw195n6l_{j$SJz%NN|3KbHE%`sVzJLiY{Pg4i zeO7=zTYbf($B3*Z;T%$F==}~IRy!>FIpAG^$gmS}5{^3W*ink|8;m}WgGuoElT=43&sEXAmj17*R0WMEoR{v@3zdPh#QM0!!L;z*8sS zAHq6B(P;plX86Ry?*tY7A@QH>0 z8gR}et^WpoiXs}ngP*CBJuLeF4%RfoCl>zuz~Vo#@F$~xi~q#JF9e=?78DVPg+B{; zn&A@*pXUs*Pb~Z;7N1!7*8t~C(e_)2^`WJ@fs4-8{4Ky!&+)LN-3I3WBQz9FppWm^jYf4_J1|_Qdh*1FULAb>y(j+ z5bQE`fS#J`uobbS?FOD^_{75B2`ptK7XE(VqCEUV;IS;nFR|!63M|JjvG7j-i%nwT zzYCmGfPV<@A?6f1Pv zzQ#OGi)LzEM!wNm4J`Q*i=8#Vk}t9F*8)qv#KLD4=X_k-=W!vp)WS}mH#!%AFMWVm z>{J3vA0QTfHL%#M1)f@je+a~)!*j|s!zUJg6Yx|XlnBJaZvmcW_{73zKanyL3;#>N zQ)lBJ0d+mA_UG2 zBP%^DI!{?TF91(9lTBjLc?o!$;S&r0HQ=HJ+U5!1oMMeL@RRc?jYkt#YCIl4MO7M4 z!q3!29u}KZz?x?G#KNBnEdCPU*X5 zC6}(ax)}FF;OWm(*yaP-CszqPgN^(2oXdBoNaZ}|SHdl(IG#|!qoM0hm4MG@ZtQAv z9)@WgS=qUS>^{R@Qs328qOXT~54PtwD078Tv3k4f>hZg|)%kTQykvo?`I6XtK`w~R z6P62NbA{!C*c@TGAXXtP7sSei<$_q5uv`#}2@9aJoj1HEFJ!8UjC(gkw}tZ>*>0>J36E3;aqWn~(JahjmV4=?`Tb zQx*p7@i^U&C_(a_6R_6=d;L(NJuW51-cn%Ozqdf|M3f-*s=;8IN+Wm|_6`Bl9{1A3 z-iCmG&Rk!NKu=&}z`vm!?2AB1dt8=^y#Zj`znf7R&wwXE?Dc|S`&SuJDvE@($F>rC zZvxx)7DB-Dg#@wp1{k)zb(29G|F|?2dmOiId+(xhx%VJJ;6yNNdkskVfw70GbnRuq zm~HQURPJ&yhF`JwQNZ3cDCnQSV|gVn_7|S>cwUk|T?vAIND#aWhMBLKhA8U2C`$OH zjFHn3{+cO=8jr?m04+iEn3h;V2OHH2B3ln0eCrSq^)3|xzoK^yK<4s~+QI6jn8zgp z%gZ2oZvjXhk^ddo>qVPTz7&z=MORa^OK~N_3O1>+{xA1Zl+Q6YRYXsHFU5CofHOZm zb(?`*xsa-wnEhPt(ZVCkhRb$5(m$);e{HJz`Mje1P^jjy%G~O^sxy{Wg|_rEg%bs8H+^VCikIZuJy13xIVO(oEud46+TW8dSGG{!i z61}6_i%tpk9l8BT-{R2XBYQ(bx2%T!OOY1Z zzpi|I`>!h#?|n!09l7|PbB;U*zxeCvFMoFO56cE{hXwL@eA`)7k?djk7s-Cq`A>Xs zfcKw-YF@6n^Vu!Ew_LrYck>O|ujU>vJhtrR6)&xNarFypo?rW1{ZY0--{HKWES353 zES10*F}ix|tgO)1nbo1pnbj!87?ra!(K}WpI-XU1mz9q_P>K5_hFHhsM#4kLt*<7u z?D28WR+f+1Tva}PX(+L-C{&((UFh+-+d_SBO}(&FmWv*K8jS4J|pEHzN!7?}Yu(;>0>$tA4gJaiSoUSAzOSJ6*Xrcfh-@ z8LD9#TrvI4V=HrO@2btX_Wh;x%Z@EublGE<-;re@8UXDLb~f+9NWBr`(``> zXq37F>Cba{n$8W-y#cy5KvxFnH352UfOZEnQ0|` zJ}`2gz9wNNcDAv1mqU+o&tp{Md8(TLVJ9N5k1TO0V#aamK|^!Dh}T2jG&Fyhp7WE4 zS*zM>%&``q*j>{B%k>ND7nunz{VnE14`BwPTwmb2GG{codM#;R7l@Qo?{&L_P zW{9u~v6z!H1n$)ok9VN6rzh6}+Q>KgW&jtN&O}w&V`p9Du&@a9Q}&kgi77;&pR$+E zEs5gE`pISyO#SeL!!4&WTKCwwz-F*8Tlf+#k(TR022 z$n51(wdex;LvZ|zI#A8UPtJ6W>03^&#+Af*8q-hN)1#lorqi)LWnXcP#cv`1Li|J6 zgji%SeHQ*U;7A4jArMP@eGypNky!ZbcSY<72#+8Z8~hZp@rTE0&P@D6cn(qUYrxVc ziN)qyz>+p~Z$UN=(k#2Z+lTdocqdn(A-<$+#0?0`93D%;+LE_%`1T)C_c^RIxZT}( z)mh4xf^S)m?46gEo!nRF8NpMi@D*)XyL%p#B+@M4|AJ-kr!baaPVR;V%%N++lOXVP z*TC%NOk;);XI@+;#_-GInt{gzkC945hKG^h9Q;NQ=?`T*?*ARpw$})nX(foge+9#~ zchs^MHZt0q2xGRrUhwWhlpyxTL&>)H2JGDjCHlu9O8jdBw(U&jPd*C*J0w{WV@4DvR%Lsad>qC^)3|xzqG~hkBIh~ zko}Z_{xOK&r2tYU@~?xvm57uVA+n4)h&+PuTu~xv?y=V^K)p!RSpSzb;k;7s35HYM zU*C(&n4cbEXJ8%#>aX}dv`bJH37nT#3gP_Xz7QXcqs{CPd!u;Dpc>qP^$nM1fHTdL zGQRn8I~j2WglKvHE}6*Y|Uc9)6s_bEzF@ zgMs}J{<(dhdg=N;$4|TOvm6Zche7Op8rbgpCqP#sQqF!aeSdb$yinQfiJZFci~gzi zLwNm$`Tcj_*OxxhOejv(_kE8;{h#-KrLIIf1p9v-coNu74E$yMYw!Qpq70|g|DA`+ z_&(ax9Q!Lu=gifI%BlN*6DAp~OX>epK)sTTWJfdcJkmLN(Xd*6I0w5`dXI2!f31?; zxzOQo4fh1O>o=)p`IR|W=MHFE?&0?D1ga`*FAd{~k^YjMqgN*G+^<&Q`H(_)_bGI^ zvNm)A`&LWyqC3=z0edHp`*`X0%3y8RtesnD;%TH^+!YH|uNc7dDpw}%{JL5*aA07q zW&QbD+<*UOX2DK8MX_InYxoSrz%s8i2X{PwJT#=`Luuuqp#wXh@xTu=@(zqatjNrZ z9#okREX}}f=KddMtZ?t(&pWUqqe3miPFQHMugJZ)v*dZO-oVjA)b*sF6%W`Y-_ASlK z+y79;>VeeVH}1XZHZ44Iuz#mlPj6;aZ?8z z#zV3*%zh9$tZmNfUxKID#@9;Om#h@TS`YSL&k3EjrWa&Id08wMG9X2h#t+(x;sFpy)8#DhoMdo%D;1ROpfb z?bW~5_tuhQ1NO8(Uj1sCb1@yp2lOWd=rbLEW{EoX`{+OCXgZv!zU!8SoQVNC;>@)u znT*K&z^x<@crKWP{xxK!r(LdTB#^E*#46}bLj6A-(C2kA3Dln!pl=A!(?uD-)aP2C zVHM&e)c>~}3ilE@^aS^Q?u8D0CN!|V;-nFQxZFWZi?tLN)%-<_m`Wq|>6i)XdEm=l zVIlQDj(-TmqR)0OVkQV|W7%_L-N~L{6j=5OnO6=SM_`+aO=7WmF>nztxFS>|7I7hq zunbZ55LW}s{uHsKT?<^q#V$evVlfMia6Mv9#DQufek3iiq`ehb(ry8k{l{&@#t!!q zip*Z*e&EOy{6ioXJKq70m;-`X_|E~04=+*2?D-Ol&a1$(r}-9jj2&Xpd6zop;2*;K zh&kp0>z{xlv&q%hnMI%XBg+1ueQ)9f@QY1dasNZ`R0|g}ZA{xF7MtV2l0HT(d>%t` z4=%@4xpy{~d^0HIlW+D|*&m7xpM6H^lUQtCOnxc;ArK3nbWxQ5^&X1cPsw9O>Va7F z>5teU7Cx(3^ofN(0l0|HBCuTI8?ornb+Jh-e2)J`W{(xSlkPoN?i@Cbw^QJ48~Eq} zUbh;&N6TG-^Oi05J}ob;^C~mTs@%!tX^e2+mZvbnuIUIF^428ZM;hR9Ylk}d_NnEd zm#qcDy{reR~DoI@|5M$65qd+SJ0O`IdydsLuDAxRG{dJ#SLq?`GcB?7UTu z8ye;-BX|c;OM61ODgUecw?DzLWUujV#u)l8coGD1$R*A;0v;E3$S?%Q{-7TFsRYrx z1q@qn3257<=xqW&3$YTB;axbuITMFI@)>#D(=XfJ&7fBxN)UV0vF**kIi?mo+M^Az zcO9^8?*-62uSyVmp9aIWcQfoAhaT;XHZuCR06g2?c`&dFdQI zYk&0dF+=6SJLlQ^ny{LOP8J!B9pX3pY6eFwai5wGC!d65aQkRAm_4U7l37qXn9)0H z@xavE66z=FoT{pD=;xuKFNF7ezjo2%qrRiQFskp!#O%cI)hcgjlw*CsdACX=yhLs3 zJvhMpBH^$KH%77xOB3n|m9rE!-U`)t>sG$eWgaRdl9i>FR332Gh7B_y(15axlA~RB}l4KA|Qrs><$rYfEot!Qzj+Rcs;dU3wDs2m70VS&=z4sKv|(`VwLYF$*z__~47UXB6=uV$m>;1H`YQ zKYfG0i1~;!5H~0s|M;DZxB&Q@_`M(THpE?sw;*;Q-iUZqDYYH(v%qzTS0OG%yd1Fx z@#BcI5x=5v-HgA8d59Mxu2;C8gx?5aIq)O+-G{ghaVO%c3o zOAwbMRwF))GJOM)W6R%xo{#uA@Lc?U0l#0s@0StpLHs&mE8-1^>k$tsJX?+5d5Dhz z&%y7V_`MUqcO!lY@gQOgVh3U);zx*os}S+~N&L=1ECZf}cqU>AVj*G}@oR{mL&Tpm zzU~ItjJN}_2QiMAK)e$1GQ=woKZ$ssLd5Sy_??Xy1D=UE0kIgd05J=32=OMwr<77v zh_?f8Lfnqnjkp%E9&sh&GQ<^#7a=}^`uc`a>Pf`Ch=btWi`b6XjQFrpIQEpw0uuj15Blx`?@ebfUhz}xOkJx~i zjhKV@3B-kn3lP7p^nJX=`27T824VvofX2$kH^A2ZlmJ^Vl$S2K9ODFkEirJZ?0dsWK6G3~3s7=^^lV(sYJHvu-qv4KD=t zO-+w>X!cW0XFD|8LDQogdd#qw4L!lo`Jx}z@*+d$82THA zo?-OA>CqXEzlJU}@<%+{k#`z;vXOTgdWx~X&Cur?`E7>2z{n$p4rl24NI}Lrlk?%6}1xC&>ks&9n+w&`$ zME}t=$1R4ip*Lt!jWTq(p~D$kpJOP)C_{gB*df&nqkq3gJN3&klA+MZ_YFHFX-EEy zCe>skKWgYHhOQC0$#1*J4Sn;lW}I*IZ!z=*ro0^27;?fPr+;xAVwixNz}Y`I9x-4~ z-Jv=DF^n?wY)z^#F5Xjrj-f{xnqwxz45QESkpZ+*K8|?|g+|WtjRCYH=QzhO*~o_- z3ip&5nqwftWRqXNCe;)}bF5@I-{^B}X1KtVcfznk!v8Uj|7RL{l%Z#eJWI;RI4Cfm;&le0A7VNG++!4Nib z&QBOd89C=84B-r|zgLr}KTUseSTiP@^qkW$Ofl&>mti>H$OnfV633TLf2E--&3M4M z7{fe6uN-zrb+H*gIG19WW9ar_hg6luUbCU+8M@8T7n}T>3_Zut8w_1(`Wxp_4D$?q z{jftKf8Adj3_Zut2}4(!@!|?Y&ogwrp)WS$%L+HW9Ta6Y1yzt!aps)%FvbOd{<-Wd4^tP=!?zyvD(mc4BhIc*T>U(H@&7?-1M4m zH1r&Eys1FwY1`0-?+2;cn;=S6;FF+E{t%97|rz*Ob*1uez$L_|r>kmlU6dE>fJ9_UYSQ zdDUg7o%`wOGVjyVWXVrYQ`eMLdbS|j>5@g4utwQPraA*kZ01ucS(Z%Or8kz^Gt%o> znVP;evYx*Wj;x1%cZyP?W6mF0#VO;-Y#4=+Y+O=xdCl_WORMZ^AF;Ar<Y~Db5&2B zx2rm0Texnzs%d=njX&u}+u{_RG+CzAF^4mYBA(XyCYURTR9cM>hy3LFUOi$QaNUha0U5qgbJ zo+hIdd7!uWsrWC_f zvfLe6$+F}xQ#vyvXwXKW^;2D@H-VPtIo_KLjWl@sHLOB8-kj8i6g$0Az~xjWD=&NC zPIc&{<#H?1s_OKPxtgcU*wsu^_5O0WnzWhDPpHcTbHo-1=veM~Z4l5Isjz9((zQcC z&C1c&5^2;)?fB%UlRhvSrldD=saBud zsw1bNeL|~JMi82jEj5)p8u~;|Zt2n(ff)_mG;TFoZo(^5Zc15QC0ZJ(!d;~_ zwa$~B>(>Y^m!fmJb^(ljcTp>!&~ zQl8u`SJg5pHOG^<+ZH4A>J*(c^_8Myl@RJq2~u=U*B?{7QyNKCaEpE_cU;9&`Q$35 z>0Q18x{4#zma{ulwF+zR(^3c={mjas*8tbN6iT1<~5r{!7D z+6bkKAxsG=(46$G!|u)ORqR$d4m>5@R8ekr{iK; zy)+)C=#AiDTD?FW^6Zt`2?Cusy;8ulRHZa-rB_PhQ)(Yc<5Q|q8lU`1Blwi6WckF) z2_Y+HS=SfHXUH&7^r$14atXqd-@oRks^XbaD%|&jXR25xFJ!v!uj6|GLikd}?y>ee ziZaz5tTco_Ir1saJy@h4g0y~d*b{)L_NIj&sO z=UKF0f0Uy?!)+Ij;T~ht9WXfBJEbyuy`h+RICbTbtE-MXd+A@)Wt^$*HU?M+A?Hhht`J~iK!2jjH0?Xy(VrHu z9|`D3RH^Attb-8V-sSiAEcHiYPv<%%K%cF?KStN>R44tpYBcCvV4<%;#q-`8q3<1~ z)N0UdbGFC7X5)TH;HaS&fW8Zubx8S+u)a^S#L)kQgZy1!);Z-fK~I6xg@)dQ`nw3U zq<;kdG=UcV|A0StS@b2K`J7jQN#76u-n8iB@Q3f1)b)R^$_HIy(cSQGwM8F=Ket-+ zWYD}9e7dopfPX&#ooDEK;om!!{AciI9NI+WC7??{7aRR{`1cu${(Jbd-J;I~{cVem z!@svc=b7~1gg>}M?b07XhF9RZ^|u24t+42R_}6XGKZHMDvgmU`4}<==vA+iX{hLJ} zgg;Z@gUJ5~TxHSAfLjprO?ukC)1u#je}^o30sMQ-qTAu$pFm6f9)dsTBTu1myN0?L z^!dhq4eJl|1%}=We3K>r1#I18$>)H60`yFyKLG#!#iCzp-7t ztsR-T?n5!A7o;e-HjtSoAp1t3gZp z&%nRWS@hT8-;kyMN8lqCT?+g*qNMLZ-eXV(p`V36B^I3x`YMZF4gWYM%rgERfIs^z z`uFhXMT=ex`u7%nH~fo^^ZMs6;7hedPXpZq`a)xW1N{3Ni~b(`dBURq1b=>N(aS++ zVX&6*>OS~aYSHh)pX)68BGB6{`gZtt2z1os|IhH}xJ6F{{eeZ-!N198c>3Rhe-)sm zzq}8BuC(YypxZ!8|G5kP-3D6v&s*?kpCvB?{XI**1^&GXTH0$1>h?b^n(vH_PVnR( z!oM1ez8v)Rpz}@n?ts5{SoF`}-(wbC0{T^pz7_ud5wwg4FTuZQXL|IC`QE2Ppl2HYHp9Q4TJ#U$Pc|kzB0m@OY>RG&f7gI6H0i$! ze{QwtF`)N@&NK3B;NK4{`VRQ_4(N{?`9H#+vnG0U9_UKY`9|IV{~9d%5d7J0(YT#Q zJ#5jn@b6{NQh)p5&u=aI1GMj?NnZIbfq$Q{=*{r2!J?mmKf5h@0_Z0|i~TF$-%l+1 ztMKO!7X2Ieb8f`b{}kwjpbJd-{s#WVE&5;JU%y3jta!+x8{pqdpe6r@;LmR?`hUZp z98B0mz7TZGqIbf-RiFz^{;$KIO%^>1^j9qUCir*MqF;c2?|{D0q(2w_O+3q^uYiB^ zEt+F>+@jxxKie$20Q5I3x(EIp2R+l+e-{3HXwheZE}Y`Ylko2fi{@Nn6X+QxJ#IHs zLl(Ud{ylHepND_%S@b`^pL5Rk+9wC}CoOs%{HwR-;XVN2>$)v zqJIN_`2C^+<8J}zO3)!g`{%Rg2IjL<1N5{2?X6T`4y&Q_1M>5I??dDI>xFpIG<{f#tmki-6^w2-U#FI1U(AAr|3$&afJh{hMJeqSOPi*lYlnZ`lzGpVds? z7>I>W7JXyjkMLOrdH({-F7H-g9TriDzX(OG_lQ!33>$G_u79A(8 z;ishKpoie(%R(6JOKbRcS{_az4j2fm{}3k=2>FPiA_qFpmWPTpt|q@k<67d`8nZu# zN;U2#j%nOaT&D3JV&l+$;tI__L_A01qr`JHK2AJObHLfP+pomaQ9M`ykc%8=G#C00?6W43Jhd80}e&Pm=4-qFdK1$rE@p0ny z8oy24r11yD%^KsDd=ajVAF#5_SG)DpLA+(6u+G51VDH)z~X z+^O*%;x3K%6L)KTh`2}Nqr@9EK2Ch2#%~jE()a`7%^Kqo2^G3YR~_W{oR| zZ_&7#_*RWMzYl$0;|Ahhjk}5aH0~$fqVXQ$ts3tq?$`Jb@qorhiMMHdocK14-zMI! z@dv~^H0GKkv{U2B#Je=+UR&sPjVp+EYg|oyhsL$Uf1_~&@tqoX6MsSDe&V|{-a|a7 z@qXex8XqFwtMO6dyEQ&ee2>O&6Ms?T4~Xy87>~H9(3doxO#Eey^NH`%xPtg^HLfQ9 zipJa<3Vl`M2I3)&yNSQ1aX;}sjrS1Wukn83{Td%4en8`+#0NA!PW*QozfJt0#vc$r zq%rr%LI*XTO#F3?^NAnUxPtf_8dnoPqH!(pH#Ke`epKUb;%{l(PyCq1dx#&`ct7zW zjSmrjTjQg|PiTCc_(_f5CjO4b9}s_6Mz_#ZXiPkdbC z?0*Vb-bhLMNCmZZ{y_?T}C7L^$lAT>W&D}|SZVhiiYVK}sZ^H-U_`S1| zY;TRjz2>&GAC{wgo=dtO z@eR5-zFt??!W8-|YbDFOZfx#OG?n1na4kvSJETsU+I>@%T^;FC{1-BFlKNg9Et%<- za=rigb4SvCf0ihwtA)0@)}*r9I^NNlY)p10+Y%$1u(h51nj20xH)!JhP$Rvk zD%cm2c;El2TgGS>Xj^Tzx_AgMe|$~o9jXk#pbw755+26riWtX zF4IG?GMDM0Sj=TwsMKY8!2K}cd>74gQEaXYJrtYcGCdTlaG4&8mAgz2;f@0N?x2Ta z-j@IW1J`Y65s)-mEBb`3u|+cg}awJQv00y3j+h zIWE&fu?m;zA-rZws>DOFGMDM0nD-@73zfQ>E?D4xRdl|K=D8>~*M%O6&2gC?idDEw z55>w|riWr>F4IFX?=z2UErsCl?vgM_)D=?`V&5f37PZEqiVA48M?u@fEuu)R@ENNVOuLSHxVLY9GF9+A07GXHK|DD%L$tkBTj+R#ui{Q%OJ&R*-j0dsflL1r+7xoD`T+rz_`%z zYUEN{vMrJGirRW$mx^rr-G`t2bfV*zxH`~x1YZU@5?YLRZdSckmG|J+mC1i`wu;Q1 zqHdYedPhZV-;r)a<~EpJSxP&^e0%81qal=ZoSJ;~5_psq8rho@bJh+VxJ~Lxdo~!R zwQu8FA1ra0_4UAIXKpRX8W%d;ci7cE92(jRzV&U4HwS7~j-EW)t2x#IY<^>0*0H6T z1-sRvrGw$p(v0W$UQpJ-;G8+7gD;$g()Arq+Y0kMTgjfmtnhoGA$&V%-4VbUITFhIc#d<$Y-* z=*MofS-N_btA6m%e{( z{hDKI7JcTi&*WZr*L4}6egE>hx-GqVeGg@9h258HR@@uuUyyM)?A7hozxz>U=7T>_ z<><7BM+I}Dk3$!DIkD`SDEmMS+i~lKXB72)Kl7T)i_)bVj#}wzFE7Hkj;nQf66=~n z<>6+0IeNbu%$kO~jBxA>Z!I{ZsBj?H{f0{Uu70#%;Vyp~yw`QzxAD$Wrxl6^LR%j` zLq*1ZT&+5i=pC;zj(*_`t>5S#Wn0nPwjLN4y0d0h|JniT{j+a+wU9ZZTFtthrG0tI zTK5gNa&-OD?Z^C zapBE$_4D%CUj0ZJZR@vOoriZv-w(TE#!jkveAL0p$Sb!YpRa@WpK4%hI-9-coZM!( zCNh4O`bCfScC5;qamKBK{p{B}P_7-OT#>A0sscybz5(wW)(N}wz@7$2=Q)tLEGtC0`D`i8`Azq{@GH5J!JHedOWTV!9=l4_B>VDMp!>H-omAt!H zdINjOiJ5Eh&82;Azp!O$7G-bUmb+cNSaUm$l+R0hG5yL};Y$aq*A9f1h>otOy{bIx zqN+sBUNtc*Z)n#9uQkWuJ49c{aTi|f@kTlm^e)7AjcV3f$I^(Jp9l?|+TP2s2mi9l z7S}F4R#TpRv~umh$Rq#DpRmWX&`=qA#;V1+cRwCJfOJw`whV0^tD)5|?B2KcWHx&* z3Jo3cl}OT$uNkvAg7Zq=z8@)$3|le!^DN-ygmXYO&L|hwoS8S2t@^(2|DG1UeYJyM zikH^0Te3G(yv;1AK2z|lZOIi#W~@@VfI zhH{PNSnwH)1)r(9*BNQ6YVvSo-QRlEAv43^H=W9d+>ogChQ2D^UrhXD=-K{^#LcfaK-lFck>`6?;2X~HD^RSGJj2ovSXH=FBo>5w=({i2` z&B+~Dy={#*{HYa1SfeJH|;1WxkfB4&KI5Dmsy#$`K**tv|_EJF?1ezd6+R^K)zXjksXF zv6RC|D=E%eGiz*UsF}U%oY2tBn#lGaeKdI6a=g3!>mNl{Z&!n_!WW#q@9%vWN6L$6 z_wk{;EpMPlJe^{je)UfBZ0AKchh|!Rq^Q#CA*%-7Us+#!taj10k6oL)=B_mvpLzeX z`sK%#FS`7(%co;rG`p$2H95Ppr>!m7Is3-;&JDAZT^+^d8qr9&xNCFQY|&|HuJ5et z+&tU4%F@z|uan^V$|o<5-q?xjlhK63i8dwi@elV?AXIh4@us@AhOVZ%4as4{UNMWdHg~nw;Ywk&yD91FbvGwAB)f~E4b5G=e(3T$lkl~JS(GTd zc8a1Xs_TjJvI}S>+S@lY<0_q1u|?7D_U^itC_Z(QZ0n-)Ey=d^-AxOl1vmBhG(D9r zAHOJyI*nQv&ycjVVpCDHpi4o*^4DCxvi92es+tuwmtIl3w5oRL6)WOPS1i6Fe$^#c ztqvGl-`>rvjlrmMi8W1zx>`FoCOe}}J-YrQ_Yu_VS~}XiLIkoko_d$9*LSw}baYwz zbj%e;9q|knbf#K?hHSW$`pi5!BU-R23U0eriq>sJcW|x)tE=SFycXH!&&J)G=VEQl za6We#|BAnToREzbl!ec`j&@2V|1#B7vzhT}utNCqc0D#piKiI)4$x~v9Xlzc*9PeR z0KF$b_geI$@aKKd+#_Lrw8!WBbkO$yD5S~n?g0H@fIc3eU$*GKMSgh2w|O2#=f^!s z9dv%t0R4f8P5zSu@~i+|6rkGz^z|0K6aGvGJq>wC`M+q%Ss!l&Xx{gzgZB5q0R2>e zekMSV57e);Id{1Fk>5qoUu5}{AJCs+(bqtq-`27H|D`4WG0OJ_Y}x(iIZOTtq`w#G zxi>B4=Y5De=<>B$^v9sTANprm`W=>>^|dcRuY(V^z1IWsT1)-|VD5Ed8_)Hp-jdV) zgBE=NI1lA1F#3a_mw?VU^d+#xz&gml6^EZY6z(YoKLb|`Xs;7d2VGu1V`bBKTl9C0 zq!4*z;0giLKVr#AKNg_h570SsvBvc0UkBt(mOKO*zZ1!87i^!mQNEvp=2o(_*Xx!( z^UuPrq7In~n_;RIL=;iL*_TIJR2MyNsJ>IELeoIk@F={gGkHPU~AOH7R^8bbUz5w#cNWlDG2VD+Y z#*<3WUKpqR^!NaMMu0w3ea6(qJLm&^{^x(Xb));p=UrbkJv|`b4PPX%jNt%%Q$XJ` z=k&qafc~EYbW4D~#40cIyT>v}n%|(5K>BcizEp(xrTpIlaz39af%4xAfnU<>yAntz z0_k~8O##9t`d^`bx7H^X{R7m$K=U7^j(L89Saf*Z zyeO)5o(2}5Uk1*ZuK6d(=Rt|UxvTiVd8^bdvDoA_aj9Ek;lE4$JZ*0 zCtx`)h=o5k!}Bu-I457*%q71-<5Kd?v9ky`!UGF|SnRB_bQ-90qt+o79nKx3jKsq4 z0G2Wm3%{HCh1w3W@HbK4@QH=L6F9O->k|wAKH!`SHU9vx_&_W=yk|yyAQt{3)Ssc# z5)1z^>Ki_>@HvJ{JrfI`&*Dm*5DPyCW4ic5Ed0s9;t#R#&!PS-?GLf=`JCr8!zUI# z?>UeaAdyDmssrZT@3PU?n3G;&^pATv&hm}4qUWQ>#U~!%^nv0wU&Md^*^C? zZYI7+<84g)Ne@d}uBF7EFH-+vt#gq0QyM=ETwJN~Bh;_b_$lDXEglw|N2p`Yi7yZ@ z(mH%+Qsh<-i~b2q{~h2WW1r9G3Fb{>k%4aV&Ruk-|&frUkNPzgjo1XfTz}IJH*0Y4m{29iG{xwSjIhK;kN*b|HQ)Y z02cp=g}((j(yQ|&7XID9Ig2%aA9eaXEINF*RAh_h6AS+t;3Bg)Isz>I5R1-pz~T?F z@L!-l7Xb*w!hebShEFW~*MN(cYW)+yk*yvUonM1rv`q8g1r~pZMdv+W@rPLWd{%Pm zWjZaf@c%%4!zUI#K6&Q)!}mEw`gK}j(U|~Tv|RHi0gFGxqB8|p{2>(II>OqMl3o{0gG=h5t}xB)xvK8M{d(;i6!mZz{O^)`!(@6tuq=wMXNN9;z!Cz zENSzBrHsVF=k#&vRrrTMEPPJIrWro5@OfI5v4~js9Cjny@ehGm_;f3$mR!B=7Q7F% z%$Mr8NS`VtP`m# zV$r87IdS|$XhalzJ@GpHL+C^-s&k<89w71aCa}cLt-#_ZvGBJ5Pp!v41Y+T{o~Ic; zvGARGHv33+J+qJHG~ge?6NouU2dWn={2FkP;lBYql?6f|7W*fFrx`x6@ZSM0UXOnW z?;=WG?^&4pB*N$3Y-A_3aql{?*qH!aWcm@lJh`1dq4lh5tpe`pPPaNn-ck?vt>NY?k@adSMM-W~5uj$EJm9*?+l^9*z8N~!rW(_San z)H%6#S9IYawdStG#*(^jJR@J;mfz6{>< zCAiBntj`tvk73>koQe}?Ytp$^WuWtuVTh{%f_l96DM9pB0w8NuX#{^d2k-SflW#!R z{!lg^@sluS+xysPJuflIa1VkGd`8o@*NaK?+Yr$nizD`a3T)f^BkWBg!vwL%IgxFz z0qe6U^k|R85qkr`w!QIV@xD1R0-3;Glco~C4E?i|x(^jkdt(sA-Uc{Jdu50WWvGM| zRs&JS$oI8)FX}EwL+3y9CA|hp)GKwkco#SH8Vu$SWsE;X0{%+)0D5*1*=Xp& zoeq&v?@}S~D|(BeWIw;ge#OA@GKk(Lltb!>{EOi9FxrH2X2N;_OU<6QzI%G~Oz z(3aluKitwA)cSEv?tqq`jq}vN+)%^cXLc;yS+>LTd@rBEdvhX6 z_o{oxGM-ZzI5x1ty=z_TELUEt(3_bBWANRJ8{B72`l`vfAVRS$~){%Q-6Ans~{}9q-;B4T} zZ@i;_yK65fpAe91nrm+zG~Fwt(lpoLI!sXS%OK@2asu=uwajSd;+OaK)Ek;V9J9_g zG{-Q$>z8Xa2CbiM-B+pgue9=G`llUjye}TVlTdnjmoM3rzd~RF>Fq+`mvoP@*91HX zPrPwILIUM?1oA5i&=%>~%QTEHA?+m8*Du8werb>G6Pc`;#Iing_@**!{#5GYyw5-^ z`cr_5%tXV{;XedhX9nnqxkrIm(v|{C+J)3P5C0H|MQ0JP=&%jN2V&9T+(X_EJOMa| zjw8?q!OT}M+bF^lIRdfRVfJ!OE8oKOGx9O~Lm(FYi-6_*!_~kMvmZ(G+30EILkGoZ+yYdmiPz#O%XzPY+M+Qg&iVJ0Do? z^8_D@EHjN6;+%PBt{B6wnEn)S7GfnLLlf2p=irw^ET)%^jN=sN z)V96VMus0Jh`pmwvh~(Lnl9hJhmxIdFY@IW#eC^AWz3iR$+kTnr`I7$kbJ)dhHa1E z1n38k_BgDHz4m~AuR+#?C_(ITZ`QU~0jHKgiT1`KioHJu>{Wsuf?R^w`(41^&9FBN zCE8;-#omX&P<7kw1c)zzmLT^20EX?~Md&XNf=7E3jEr{YBGMk~mVx*3HfZSlr;PDD z{Nt~LpGiiBA+oQ6M!)E=_0p})_)LJkHe-KgpnnWvuK@YjS@GVcN-!voAhL`cu4gZp z_ZO|r@CvO8y?#6O+U!rbcZT^@AaZRs9TcC%j4e*AdqV9D%QKrLd&gG^-ZJ2#UOZ3y z-WRYsc|eT~KZ$;awUR2?JGv^v(($za|B0NU|6llrRph$F@B>^;RwiC{ephNbr!t|w z4Ss1Q-#+2h!eBVu``fe5PpNBv{e=z>hI69ELNsV0XQh#>Op&ZJl68KGm;e7)=+u?{ zyPCv%4_Gzj?_FDZ4-Q1|h8OXleHCwu`3O(`mL}G{>g%_otG4u_ho00Lo)|x=yepaL zh%G4F5W@qW4(imXtgOQDfP^<^uJGo}H9UN~)u1_LF`)Vmd;!+^)sp&-Ik7U(o66?Q z!8Yrr3cSy=v9X~kSyn2jycF;Jb9fb{c)_KE=JE}S4w?_|)YU64yW-O;RA*NmUW%LO zitz#v^6@kH8CjnOa#qPi0}`=pj$e|{V>@n=&Ey{2DGk{);#lqKisRS0_T*-5@!Z@k zp5s7+E_t$nMHfpQ(6Y+_(y(khhUK~-MURQ2O?5HV*4~z61+8EWUB0NMx_0?h@vE*{ z9$!+keEAi4K=#V3Yp$yGNiJEwv}Q%ER`3a~s#&$VX4S}o|ChaYfsd-X_Q&^OawZQF z3=RPr^mfdU5Mqdt@UUFP31lV@9z{%05DCd-LV|gj2cp$BVKRXz!N3@NTFFUUTd$t z_S$Q&{W$xaGuN}YwAfobH^0;qE#ExP(sIv@bBpp97KYQMd{GsW%PlYX?m|m$uC62` ztZ=C{jA!B8#Y-2JdJ53OrJjXUX1J!Fg$3o`^_F|`7tdc>UXWj! zAEv6_NKzY?|AV%edwqGnx0Kp}J7iR&36Wr)1h^nzUFnh%LUP`)I8epz@gLV22_L<<#yrb(X~rdAj! zFN{QiX3=7A`9f=l6$Cggg)=!QNhFG*GO1`@0o>=tMez9YC^;=;Yi{2C7kzheX*tzm zYWafv>$wNbU2N$W7FHNtZ(#1b*L%K34$cZ~QK06hUn7rjBcn@~F3$HNn!?M!MsCrY z|7W@Nvhx=$nor?dix~fd(*HsJe?Ig1hT|Ixd}D!cEbxs5zOleJ7Wl>j-&o)q3w&dN zZ!GZt0So;9_`PUB=|&5kwGsDVxK(W|4)>(84HMhgf8bt*d8zDXJwM(5QgC;M_|psq z{$3}d$@HH}^y!et@3BxK&hj9?SE9dyn?0?-<@}2zI=#1x?$yz)BvC%yU*wmK(R*wj z1|sJ-?{(q5Uyz?^p*QHc>8=(%_uB}Zsx9Qx83BIT*ypJKjX>h?6ZCaDmGWN>`5S=C zH&F(eFThI(sDOv%xUq({4WZ!UY=>+SXK@G=fKbJ>GS@yN8+@TQPUoseA-|y0JFcDt zo!_f>FnS)F`k%nZf&T#bsT!o;Uf{cc(-9cL55xX10~hwE_I(#Le#Np6A-@)MBy0Ti z9-mjDB;r*rv% zL;qiZCsm_6SQhY4fYWP&s6M|$dyl|R;HOa63Bc*N7}2YN&jRk$@fhICB>YG4FFJ2P zF^l+@1Ajoup9K6liT|f4|1F8$2>cxI3_ZUS_$Bny@i#!b3b>%3MENTu`f}iR02lT9 z0_EKY{8Bytqrjg5F6y%w`0K!@=yV(KFM&IC{8`G2w99nd4}3OoQNOXksg6RQm!aP} z;6mO}=<^@Iuh8=^2L3+qEFC`snBGqz@cV&J1%9PYF9PlZPDc{So}Z&UdXJ(gkKU8A z1338@(Zkz&3`+$4eb9ydUV?sKNb=}C5Gi(3et7<|tO)d6(1kyI1bvDn{vO~}5>B@H z0dQg8{|n{+P{PCIk7xa$zXbZ_y8hPz{}?#Mc&ZP5-zXJ>)ifO+g#HVG&(`thq2ERc zpAGy7aJNqX74%6!a1(fV`PTk%iN${Z!nQ*WU1#v4v$*2Db6My!7bD)~YE1pOj*jZSxJ^wC;erFRF>g^*ypWV39r^a4PCc z7r`Q(+IoVXPOwN%15CE0i(rwS0eFI*POwO)HW24fuL7K^pF<^B@LUaef}T#WNcR#y z4RW{$7U?B`C+O(}i}Xc+Q}wf$1dH@i;@8s&7U?txOr=2#7r`QZ1>gyKI>92n3b1&u z8^I#IhWKeP!$q)2ZvdR?pj5^P7U|7^C+O(}i}baCQ&aFCE`mk+oq#9k=>&`Pb%0Z8 z5XVKZNbdqXK~E=Gq;CYAN}UiF!6LmE@B}@bV3AI9%vAjxGr=PLA>!B52^Q)7fKw?* z;_Amwr0)PcK~E=Gr0)itN}U`R!6N-Bz!UUzf<^kXfKw@m;v!h2KM#09 za#CCbi}VA4C+O(}i}b^QQ`7MuE`mk+QNR=Qbb>|talomQ@EMrvOjT(+L*o9|2CKpoWWJk^Vct6ZCX~MLIyHxafa={!OuSI1Yc5@f=Ph z_!15$6HNc%8iSuQQ3Lt=Ycn`ZtjfP|*hz2}hly38Ot>=fQ|Lcj+4w0`2(DcGl#4Zx z$KC`EUq$Io{D6Sbd z|KTFF#JjZ!7PcZi#k;i#7U{D9Cr`tFxZL=q;*1|%Zu|rf={7-6Cs?E}1T5Y`MX*R; zO#CzPA1;DL`i+3I$r!jO&Ln?F1Nl1}bp2N&DV3DMMX<=*0C<9)POwN{3pn{-@gJ^s z{Dd7k0jH9&aS<%|HvpcXrxPsFw*XGQ2LIuD2tOg`hk#ROQ!2(}`~?3tz!UUzf<^i+ zz^T{bKU@Th^d|sM(9;PP>3aaDy73<_f<^j1z!Ti~4;R5A{YAj3`IO3^NfGHoz$fVG z1dH@TfK%t-KU@Th^do>L=;;KD^w$BW&c%PY2o~vY0-m6!6D-o-1uWhRMX*SJpZGoa z4;R5A{kMQqy_CwI2^Hxd1D~L$6D-m{1uWjTM6gKzGw~PUKU@Th^uGd5EumEYeo&GA zci`Xt)o)s6F27YfJHjJ4`YI!POwO)byey@&QGvNPbPjnonVnp>#Wp8oS$Hk zo=W_BI>92{N&JgBKfxk>BJu0#1dDXyRAzAg7=jmYIF8^#4kr>^%;98$3ph;iMENd< z#}j-Vhc6*`9*0NZPjVTD?f8?r#Ds+o2}qitrxPsFFDCvQI6uK6eJo({E*yeI`hQpc zDCA9EivMt>;wNAy;mhzJE+>9M{zSkN^mKwnx>m>KNWk^q)j_M{%{*^J9rbj%j#^pe zod17R*2)W%rKihf5vNkg`8D70aai+>Dh_MD;pedC8`T`vd}9@dHQ%V=u;v@J9CqT5 zvYNwWPvsU4XA)e;;cSBIIh;#y1Ba&(+{odp2yWu=)db(lVK>3e94;WZg~LSzw{mzs z!EGE~MDQ98mlAv%hi@c!Er+R@mD@SIlHfZyOy*F&$6>0fawmtW8p>T9CKZ+MbC`-( ze!yY+U+Lg*Vj|#m98M-Uz+w7d3351w;4Tiw5xkzmU}wq(4kr`b&0+dqxrf7A-i;jA z^7e38%e#rgTHbp(JO+Q1UJh&RxS7M|3u2__t|DF;68*U-JV%8Wij?Ec5Ast#;z=g@ zgilj*b$RRUO&4aOM}+7#7ghRuEbx&ZQ=I-@1tIY3@aD`f$0J7#Ev-3nE>qE*+6MZN zP(&G#`6AT+`dLX)d~~R_(brg4uD|?*iu~_M;IH6mYQ$Sh$b?Y^L_AL?US$)lj$szj zUwIS87a=WLC89MoRXB>e;#D&_4UMh-oWg}=Q_v7TyuKyuttxnCjPmoBs^A4UO@6$M zNdG#MzbfjJV)U|+oSDWOMP?Y#bOV}ZKzRl<)qtYBmSm>!Hj)_zG~Ix3z+C^Td!7MJ zHJ~W3G?{6<(qx7KO*f!v29#$&Qw=EWbtwEjDl?7up3E>H9P-q4nr1+G1~k=x%-5(G zNi&T%rOYs(=>{~-fbtCJAHHs7rtxl-83r`nfbhJ5u$=+@!xyy7G~UKC!+@q6&@=QHOn}x2t}>vR1~kKfrW?>S1Ija?|ARNw zFt!~N7@IzX(4RkGZJINtng`KELp|k@`OXkQzXV?$aFXfP z(|4s|4;Tqf;G_@HXbk)}{79b2M|0&O;Nl`ay0+pc%X>P5vA2=t#81^}B=05UCwW4@ zIv})wks5y)c?SrPMg7EV>ThCzty=%B_I_C(>yy zMl`C&EToZKAukSzbbm`+Lf&*R$?~p3f13yi#gDG}kXOY) z?SG=tkG`Kkf5r7QDJ5Nk=0F;ns!5QDk9{;ryrXKKjm8GjhM~^R>MVidG(vm6_}|VEnB{ z83%TE)+|u==S2O2@1mHDp!t>NUGx7wKU6l6rFGHUkG9bJk=7efd-io5`^B4*G8e4t z!#BR^DN}?GhuzM^S5WEuqq)-e)9)(7cW6E9+VQ?4{f$eP-r99++tGm|M-Cr5G`0IF zd~5bOm?(s!BSHp!A9a!4{3fnQC)q3QY4}?1vGpa!*Q4Xy^u={$e=FWTbWHlXcC>Fg zlY~XFX~6;G>#|C}_MV}?D*bitj{QyY8;thvj%u@^SbAH~!r&3(ZAi6kgTwfCv0Z&W zv^RyNZ*t5S%iiee*dK~fd#(1Nx}AwL-(QpwJm;=1I9cE=-dCKCcMU0{?Z?uNW*jLw zyztQCgG&x98`{@7wOjjIu@~Q!_vYN=V<%Zsfzm&vAf!%YzNQ~Xw1MiUQq=cG7ePy@ zrh&qd_(Ha;^E2kc#{_)I`&d(%a=?#o)IP=>aVH@wUa{({`a|~Mua$ns*_SVR!$VK{ zM&l?u74(FCCs|cb$zNjLQZizmirP71_MvQi`#Jcg5>kI+e1X^InZUMp?qD|0<;)e_ zfv;54yPGb@yPGC3+i)LqjO$|WY;xS+#e#)PH~Es!viw!IkNfea(7v%O)Ma<(bscis zcByQR-LcHB_?n8M)}!n+X?c7-ef^t!*P;F^qc3-N+XJ35l;=lzZFpCdhi${VqCT*{ z(_<@CS)ee5m2C=m)1lpTwk`JNdk@$v)v}&9dK_^R+0vd3Lq~^PctzH-`)nS3>)0~} zr<@k_Y&dFs=@^5!BQ}<)RUv!KZ#F}NC0*|ttrB>-lLdBlD#FJ@_JZH^XgrGz54Y_q zP&UlZdcZYMrMPy*C_ct>=Rkc^?w{ixnLS4T_xeJ5l7v60r;^S4d_I6+L zjtI%2u4x~2gZqBO$p31GtclWROb>(~2 zzg+!J!&`fLa=Ld%e6zb7p8xbBA(D38F`e^{U#>wGl+^tj7Z*X}2o>xnO!Eh}E}ohgjyRaA0v*^;2?tN4z0jQX+C zpBF6552?i?M!dgnXx#zV6Hl^sRx@7M!4ZVldt#XFPz(#kJk#UCT}m~^*SmuSGU8Q- zIy&|b$qikLjb1Y2#+eu+95Ln?u^A;dEeXYrjzztV_t4ogi;Yo)IL<7&bG%F^Yuhs8 zm1Fmd{zhEMH-z!PPi(uumw`5z6t4sZUV~3|$IrN7_5*{#>G^}5Czx||-T07wbZo{@ z+JV^zkF7su^i^elR>Y`5R(krzCDKT%^_|zLHz@sCW#o+%kMMpxHKe+838pmvnmqMs z_pv@ljQte#$-tqr=jr_es=6oGaUf6acavRh9y@b&;_vWlin8B^d>^*$evqh+PF2fi zJM{VaQ1El)d#YP8^9`$7K5PG_9^_tQ_5cNAO+4b|ZsVKn!ge&84&A&YxXiSF`YW2| z-94@+Ueemq1`CSz6s(v3sKSiIu)3K{F;VLtnI7h1#%psnX9q=oJPJisF$&6|yJU z(0k>Yo~j7O04&aE`tBfMVFD6F2Eeuy4fz!}=HS^hGtYr&B!XQFfP+ zPY(tkXSRc9&(qBD1-z#O=l7!8d8mfhYFl4W6{S&s$opQ9g<4Y(Rn;?j`*yOs#^$vS zu+Yc}OquU%dX^1tY|Bpzeq?yWU=Z;YUY^yH6MWZ5)g-m;RMeQPhkYxbWtGAA4O-sc zcCcjzX4}!D47Ro@>c)7F>xmxb!`X|P@eVt)b$EncHS{)63Adp&;x`gEMY3q#pO~vEchs z>?9AXVWx-WP48!SrR06juV|iQ%)!F_$d`;6BG&gx|CP7ef1UPT#xG0WS@_oC6HESc z*&8c{RkPuZ|egC?+{`Rv=n87*YM<`J??9doc<})3iNj zbd9N#7HQ5X{b@%jo*#RJB6?oJOZn6TG}=lZ_J%5tIEMdnJ}}&g?^m5=A9(YE=io_S zoOfY{?OWNUI6B9%ykHmW@KhSnwer53F?-*^+K(=tUwOn<@J^Cr(BFEjGN={$Ulb1B$_MJJwlCZuQV1db) zK{Q(ol4-(sZ5NI<{- zR7y!qmgy!;<7!qX`F>oo@K&q!NXIiXmHx#WZCRKTWOc*d#mb1+M;ssVraL(kfBO>}cL>n)JSoBpdqvDc}@VYd3i^92X_#OqpqQSZYA8;fjMi_px6 zBG+JWZ~owVicZC9VsglSojQA{^1!TvY3n~-|EbY8E;Qq5pG|#8$fg!fWHk3`=o^ex z^Q|`4W&+3|_Ur&}?LF^(b+~Bb{EC!E)x(E39<`Q1 z@vD8IsSnM9Z0QM@v%iAA(a@J@cuQasQZdqhdcReMR;L-J4DvFPk<;gL?q+#OFS$*h zJMMJ^&xzSTcmh}-sA^u@-VxnBj_E0g*!4Y*#1!2zf?sPU zQiwL&nZ*9At@f$!9xYP6gF(D6r0?kA4M!Jyd`$yrkyqHD+LN!no6Dk!*7J*^*Yjye zzfe@N?r2e8Ybst5l;T!cPwg${JvBq>si7Di*D|EIPIKTSR_Pgx_vB}U&4d$^GmO5Y zoR(nB(*AjLTL~{AOYzyL>?wrpQ%%Jjz?Rj8wXQpNcek&1ADi{i zG0dWE9va>6Ds!!SoNdR?6~JHoTq^J_#h;H4hh{{YWoiSy$`F+9iZ<(iO*`K zDEl?(H-<}hoK%(V0dRHx7W+|eGFLE0A?e$Z%e4*?)*VEtpJA`)pz>r)NPSZ=Els*- z^o7dqW;BLxXC5UKla5+Akg~l4GS?L-eKC2#Y5DX9ba{7-cE-%NpD#SN_~?=&%MPzN zRC%!a!0Mr=Hb$-}DLSoOD`I8QBE0dult!|eMRld4s~zzt$0hZY^!b|lqQ;6-Yn6V! zYsz7t_2J$;p3>$dLhBp%XXVb@8_d`(Sw+WTG0)|+Fb zuN^bnA^cW8tkpQ9&y}$w4!c4TwxYeyvw?0;^#0$w*3=mBFdlF3?;ljpx?LI1#`##J z6}1`h9cG?DdO>`RR+HU*q9t8fF>%qXthM*|qS-k5+B$`=iNXcbOc~=tJK(>1jc8{Z!=sqZXaX zAA@Yc(x4|No@UB%1wC52nM<3gbz5aq8>O_76`&K2G&;^{)xG{S?`G2 zP|Q#MfyuF8X%6g1J!_Hs6E9XRLx)(l8*d=R`Xmv5hevkiXFX`uiz5Ehu!-q+Q7_VBCA5(D@5$pS|GKS_{M4Rq*x2N!HP?c&9M#7jXFhj4b7f3K zJv2{!TmRdn^c#0{@)O;GN$M2afG5#+=4ECZP!oOaFJq=V^ljI-_U2maN9E;?4#f_A z+pI^XCLz)78^V)`J3WbAvA$E!v8UE6{d5;7@R%pjm3cPXDv2z`E;gl@cZ%dO1~Cw^ z#1W5JqVJ~%YeQY1Z0h!u7_)Cv2JYPGT%oSX_fixvx$x}?cV)rxf;q)|iYfBSrSLm0 zk@1$I+`-OnkLWFNi?Gv{Suo0nCpkrI6Z)xs5%od|!$HT$lrCF(XCiugQeaZdsP3Mp z?k9Z~BT|(Zv*Q3bY#9Zk#-N2a_fSORJnwcblq1)oUd)$J>dFULUfct2S6a+PK0GqS zW4SFOCK2m;tnRZ5MyXT#ToZRBnijEIoqEPFTE?0l>iVpc`irQk{uPc0KFVJfBrOGJ zM?s`C;@aEA`=8*WZ-vNhkX9n@4khQ?3b$eo5=;yhhU_zNhvF}6irtlVBGHvG4Br_} z?ARYTbRucSR)XX0O1~=uw9FHUDRx&DII@Z3&HRm?o=xBZhSt^ZS!Nu-*G}981wso` z?~KllQ|4Vx>sL~iy}sgD<A5L6hnm%iM|k7cl1i+Q|6l`@9y-uFIC<&?KTA5pWJXaRU zrOG8-slFdHcV|qi1Ts+X*rSYF=C`9}JnYH|PO)Xgvps#jl`q0_udt5&z4_GcA@vYy z@5)x;0eiE*{8ni1w@Q@-{aYC zkG#J{wMu_b_CxBoh?ka?5Amfu5Z-gGU+o!j)1T*6&ObhX&VoG)=nFpPSdv{}OZVjX z+9TKQBzJmGPgp+ycZMg&m9{r0_h2ABm}AQr&Ix36j)Sgf%2VXborYn`oFVVz^4vh`SDeT4kDf8Q~H^~@6Vs~GelbG4IQ z;A>aeXg`fZTsDn(h#nJTMmf|ICAc>fo3#g{-ejUcqk3$5k!5^UWp>UV!Zl~&FDo-x)vHUXIpx~C|gEnVs^p8 zzJ*&|6Avc3(ssx?tDlW})QcJ(>chmkLH?cUzClZkUz zJUV9_C>hG?%*{8n{#|Y;d zZt9t;*Vj9&;elby=`<`_JElKMJ0mfpHv5Art#=}MXf5a2HoC^NL!>96H})(2yd}|h zlS1o{oDZFdRkriKj2R3fu%gdUl(YJrpYPuw%8dF`+aqdDU-bQQ)jzrhI~m)r8z0ew z&O~aWjW#$TWojF3#!f4z0Q7VOhuLOzwi!X73+ewTzVr9&C~ncfiC{L3F0K*7I0e3! zk$(rXgQ{!d-fYZ$Mj%Qd$9Da%%cf$krZN{^c0%a^PYNPOI->q`M)Nh73MuLd%nK8= z7Rz*(7Lz6zcMyrzZM{(c-Mce<*NfVp+uPSmvn%sFAMG?mpAmgHp!8e!cGcRD{gn;m zS?2C8;%JgBGiH<#OYNU*pjc{hsGj{E(Mw3<0PLn3DI13H{X)G?f-BoiH4J1NOtS6t zOnH6CMf;Nj7zy_84i>8C(#3@C3${kA6Yp z3U*+ed0oTqP+6D0<2uaDNJUXDE}u?@qAlXkPtcDx7x_+&Q)-sW9(6!X!&f0s^gQ)| zYvP!ZHoSl(s&+5RGggdPkjwjCxHMa#pOM5sVH-|>+PpzFCzehOp6J1;#Z#E6W2Cbc z?!=kGz3hNJE%u#F?`_)L<2!}1KfN>V89UuCjaL5N7v;85`kyKCof#Lg!qj^1Ph?JQ z^?nLpv&7lkEd@N5qff=5w1jA<-$+9GP=o}Wj-|M0^LkK&GIpao&HhQj;3}LL9r`V^ z?HbO;?y-X1evI#EqvVreqiNLo{7i0bI!}w-B&X@GQS0CLlFVOAUk1e)!N3kRClve) z>&xe`VpSR6F^pE;*`G$_-xb+gs3$MgI5UhHkJ%%l#g&k~`={1EAjV3>xH#-(B&Y?{ z@>MrGf>rD}JTpMwE=n?1s>*3c@IIuCk<#c6F<-s#(NIVvpDxO`O^%8A#6w^Fp}m1X zMzK=29CNaSe-!&t_FJ`-eK^yN-K_LivQ^cU@i=xN%-vbsZ_5m+@sk~Pw=t{jC~!@T z&vIqpml>Z$Z5QreT-ziseJv+9-_e)Owy51bc{urN^Au#N-4xjlW(G12O@b$8_H1(H zoXik0j#32dN{h*KO~fxFCR5B|FdvF@<>2R36I^L(0>0my9~eH1)$~1sk=8NRtR zeD=KEKA5tPE$I2adRNfYE7#P^lL5W3+VOg!%M!LteXl1_SPdQ5un+8W5DTE!rm{`G z_7r9Cx#vl*nTK&^>UsB|{jmGN9&IkY&mQw9I$0jHf2DeDlhlO3BBn)?f4UZi`hMtHv=` z_AuIGFWTcnlyw4S-FmD2t+W#v|5@_J!e1$nD?JuyGABN>*sA@Tpb0CI8&T)p}CoBa;;$-ieEb*QiXJ?n@=t^a%0VTXFxms!W3 z!$V1-o+MU5=be+Y4*A<^zxPH;&g;NVWxW~Lc~1g#j_cU3-Q^y*C(d_f823zHjZNC* z+VN_fd2c81*sHO&UH8O=>{CW>MqMh6oh;$;n6saD?HCz{IT8NH50dYRQ}&zn4yk{8 z4yzmVeTO>o0blzL`n!w%Qca-;`dA<4vK|E*#07TFi>LDwf!!lx=>9%gu(IoeC1O@0 z%C+sB#~#;4$Y-?GgKan=ljcC2|3DP}S7YDsxVHTSI?juC;ZCP(0Q&C6uRS4?=Q8&T$4IbC@sp3C~cYqdn+vAZ*Sw3a(=&`fQ~(*lr<_0hIh(H{RAkKai1 z%iQSKkKdDkIDS6sV95SbM7_bezSxbL`DZ-j{;a{JDb{ zz0u=Z_d@1oe@WNqVr^El>*%CM{k~Hv%AVl1LS?_>#7q`Cdm9^^{xqA~x4Z8$f1a9> z|5PWKW)U*RZY~yEPvUz&@^l7bZ)4!?2bM>x=F9X=@CrWvpuqYQezHqmx2aDeTie*HbTM zxYj+Csq}LV_C)b<@(oVi5<%tZkv)U@ZGif1FZJ7zF&H5ydM@u6g6?s)0rX*vq=Cu7 z%WV^fFGnOC8@>Lv6C-iwbO*fq$qR5G9@yb8_U;~>5wM>ehu!E?)0F|~JMOLl_z(KA z+2%MsWUs$~ypa8oaTm}4PY~00Qq;JN_d{zBRr;;9`|>ixa6Kj>PB_EsYL-Gg1BEk+ zLiRs?5`9cSo5ghO-&Gta&X2(?49^A(v+Ho8^6{`}ZnVO{5@IeaWq1yGmUsgL^I~&wLI~^Cr$EQ-z}1d@_IA1hw0VQCH-;@dz_s^7`!;AF zgnoVcSYh*GB!BYmOq*vfR+VY?rJDvnIe|0p7~85y-?=+tR7%235mK5#AXn2=}N7##c zVyJESqU*FBw3F}&#N7d!+vu|u%pWfGVy0u?6P(&-!x~bB&4xAqcC0yvJKT1(A$Evy zH-?_942{Lz4eTQOPVK{90N&}_kJ03h;cbQed(ZAi8gN3+tZzebo3XzVK;3D#IYIs7 zg9~~>Z62J?+MW3v&J2Xs$6~w}5F{stTUFEwv(^hxw)M~qBJkG8_+TvJTx#_Eyw^`j zjqb}7%lCOy)%C=)S+1vcWSKiduH8Gbl>Gyq8O927h9|J|;3S;Tdum69=y~LwJ?O(8 zrQ!yq|4DCBVE}#_Kueq~n0o(=t$Xedb&;pSLwCIjPlcC0@k_hwDg3lq-M__Yy~I0? zrP<4{4x+O;d{#M+)q8#JVYU=8XeZj})wmyf=q{Iy#ug8D8ClM=wd6#o6z&TO&NBzo*SBVJqB2%jHj7 zJvI-rUbA?SD2pQ6s|g`B1%CUJgl>=a)m{4|pGGfPv;mFg$Vodz>Rl=Ny$#q5wK@|$ zr?y*D6lGrmyE4-+qC7$)e!r*Vl30E4o`0~5c`kYx{tKk{jfl?w;n+x> zx;@uXLU$O6I*VFKhlo^Ai@FyLrI{ z?x0LpqwA$=Ba^U|(!YmxmoSU7>JhBQDW>?UxN=^jl1JOB8 zgz3T0x$zx7+JTEEd*|c`+1U4t#_5mb?4@;z!`?nZ?4K)^yJlIPnx~&phT>2@?#+#& zyMpF91v;6fR*2m6u7-$vAFD(5l3e&(iF|KE%#TC%Wx2F(9{#=t?C~X?@X)<-m$MXi zfu}2!vK`-bkn0+KxAomz;xVH}q%A`Bge&FNrrk+vjl%B|L|7BMzz;%(=;haW0?<#z z{l^{97$;HSXGLyREy6yz>NS1bykms66sHgElcz>#Y|v__%9=*oMdf#EqiOg#@(K zF$q{9jDI%Hl^uiqK>VCB3CagTzAQO?x~#1+;^{V_vfDIWMcukRlO-E#{P63{Qo3tM zcMOe{JmSuF{9FqD;>S-F)RYFjxGR8|cX~;R7c(KxbZ?J$_txE*u`hB@do%m(y0(#Nouc>q4nd*SDZ-u6#89w{ z^?CQKcf_8=Daf1$o_gRZSo*AS7SfgVAx=EvH&KnPJK@SqiFIYA#7=v!6=mT>7DJKbj4D#k9c-yeJuLw*?a20gQl8CObK zmb%AHXCaaozUi^sXKYpaZ@#tb(6)mE2aXIae1Gw;mb|;{?G-00->g2q`t^omT5QEL z0X`N3U!+lS&)v~acBPccJ|^FnF=Gp&Ax^hz_h~T4=3}iyJ#E4t(rSJY?VBRUX>BA1 z9G$N1iloPAp3)h2vfFoRH*(QVaf!4igy@X>g)wn?>hyfq#2s-t(sM^dqq^Y)Lfpc> z$Y@M|rW! zRg?obFP2Okm zd(0vN2Qi0m+rxDxf1q_dcDXWR5~$XqBstc5%4N@v?j3uVke=p#!ouJ_cSgb10(#Xj2F0sQ(QA`3FMQnO{)HS#^roCWc*;(eo4#D>--a~W`$bPm zP%(<&G!6Dkqt(oFlkE4J7Ld8Shw2-RzwKt66Y%)ggp%yN6c70Mu+3WSRF5ljN7OrL zWhHVAZuJxmY1&_)zB?C@PM;blv7_nX!81KF&!@0;_)L`UYX8yWbL&t2Kv$d~9ER8L zw_yy*Eq&C>*UzCbcm`eF$_DxzcMm7#b#HYam!9j`-M#HTJbyh(PV>2Q6`#8wXU60? zAe~)`rfGVyY~k>kuxiYMW!?95=iua7G+AX;7N3cc#{#oAMVseR)I3o|x|klS^hd_> z3+2UDX}?(lKMhHzMCGw1n$B$%RHnRdh_;8`(f#qnN~?y)I>j17#ExiBHc{>Tl^8v- z2A~=BeWN;t;QdKQq`f-19WE%tM_lIfPDi4)!(PAK4)R)nyg;nq>12go*CAR9MOX)G zf*)hIz_hAZ-~`J z_kW)9jCP_yJH-{;>7JwJcZf2uo8s}{6oAcJial-9<{#4BW-Y}sS3*p}?x1oyklr~G zvkOm-F=GsRT?r==wkPaOz}Wf~!Ma4}I0`F@4G`+m`<7q(^Vb z3;xLMYf4vo3dA#B;<=o&*yk0`pPIckboR50!es~vUyiw}j7F!(z7^_9Js+7Gtln&w zZGqi`MQNp5N=Ga;pVsuiqaA-~W6IAT^$u?M$nAK0I_}vVW{3K+9taf1v5@yR7Myd} z^?COnXJ3we=U!iLH5(i;HXkF?I>h7yoNMa+k9zagf8-9%+0&I5`T(4R|Fw##u^k_D z%yF^5Y7!minlTR<>?&hD>+<4odd(Zh9xcl2I_y>p2gkjP9sKw3mcFry3vb5l>2RFH z+mZW1>Y0m7|I>8C({p&U#zk4{53HyCW;!|cq1?Lzo2rL8Ju~+)knL9#hi%HGSu~=R@T7!6^52^?yDEnEEou`=sJ#PF4x_! z?Du<1f+vmjUy|qZvb&aSx8r>Ui9g1(C3s(qJEXp%+*w?+AZKWFb;;JdgCZy2osaM| zj3J+E<(l`TL>q+c@mifSy39KqCT;RtHJUDNt!+RHp7c1|-*MSG2cGWPuHtPBcDz#|7VlAreTBK=-eInh zfJXvOe1}DP4cezG{$waty^&hO^c_R*uHuuVsYwY;ijkf!sXa-4QqpDayVKLJSXm@y z&@=t(O*uc-Y-7q%`n40F*q6Sdrm^0CMRQw2gTMKT+Zvm1xx(MlG)4bx!G+){Ew{H^ zA$aO)E1N5tZ@9RNL&YV%N-e${$AX)%bn4 zlsEf*jm=ez|8Z8fRag6)wO9T&RW!Hwb#i%)zoH81a`q~}ule?-)^cQFS6_2s$tcy| zps|v4*3jr|ZLVl&scvkpcjBuHYig_fRiv@bq{*wSsB-EW;kEE>zSg#8|Am?TkmVQo zXE__&TASKholOio%mEntG}VunSMtbN^5l1RWz^iXFKaF*4Eay)l)K? zTU@~AXa+FLf@mQbYU(=SBM&@3NR4f)YM8IF9z}wozQSi1slKYb26*|}wQE`N5@%Zr z=$W<9qPd}>ZnBxAnWMh875OK#imIyG*4jpJIO(nUJQpdE@5wJZUJ1=IotJC6IZ@bTR_||V zsaWNAYF2~FexKpTIt3z}RgLf_a{KyG%G$WKC{LNqX_T6qC(8*cLZ52&Ue^aBcriF$WP1$PXX{n)D&HbBI zH&?8xhhF4KX442uWTv+{XFJo|CQHp0Wi-64xwch|me%3Wsx<1Pu}79B1}kHLn&oV% zy~EGLyF64Cl+M3CGP^mjT_|5$6S|4NTpRjZ+Um7|URO^Gr~Cs&*2-K+TcaX;G|;4p zF@>Tj9EV0?PMw90v5G$LM8g$EEB$Lxz-~%!o0Z;nGlG>goP}qmrbF8{BKEh^bcv{| z8nwQ!M=4)p8x5__+q5C#w&sc^O`TN;7|s6r3N(7ds&ai!P>wE7;euiTyS}xyt_~XM zy{BRg28N2tIzK{@)7RGAOa&XvvWIFNr<~W3nw(onH$|i)QJZ1_Yt}G-{t$H)!J6HH@S7UX#-v6j^SygjmQxmlgtTUytdWuo3 zo*#9M5M+!!nuKaJC#s@%P1Gv7$FuN$Ao%$ZPvccfTN8a(jEBBv%wlzKG@OHKug`MB zVlJ7l&R;I{q}B+d>pjV^GCo>X(c0DmBVwY5DU*LqZDU&tqOew|E{5DhRzfu9+_~2a zi)1^|)?#4dO&vzn=ds|(ox0XE^js*i%0E||++B}BoGjmhskP}R&`fs_y-_gjhX+Jt zoB|E&{p202cvS<9tPw2e8D#e>bMi2)u5W_1D{Jd&TW`leT;(@Bw4%=6j0pp8XsKGO z&@33GEo3tAED;J=ZHu!4Q?yo0gTwfonTQb>>LzmzUtJ@NjdrfBM&Z09PQfw*J=c%2 zYPmCLVoZCrq22YlPJR>3(=@IEnkpiyX#+)A!Awf3!~C=E8gw1KM1a(=5{FR52#`Ll zd7OOm?QB8GVa~(@uIWptq#047N;r+Qrl3ebxR6|OzV)^*eb_d*x`bj(NdK!Ix%slMae9*5v@L*nAu?Vf)D0t z#b8zFLtBDD>!p?~+GLOCYjHwp=o}fRqZFm(GfXV%9U+2Cj#e-RNZ}`ZvZ*T%U#;|$ z;dH$bYoZhnC)KR0SDn0!T1R5_wKk)zgwKXY8$)l6pD@IxnieBGH8r+iVlC#C%oIaQ z9b@{JjYUnXHjS@oq@GPPMyIc?mL_Gj)YqvN4UG*`c+Vqj2bu%C#~?m5kh$Os#EBtX)ZYYzt8B;I8TV)R*y~ET+{?gwHli zvcW*pat!mBC;BiuzooXxDNPOKX`NNP@|A8EHj{v(JT2RJ3pN8zVhFcmM zZzE^XdZae{Kr+R7F;l~=T3i0ja#9GVIh+wgF*hY4+UiY+(B~y`+CP{B=B`a&Yn=j8 zIHoyTSnb2@MZ+N`ccM%fwxSC9wxXr0OdIDgy;|Cgrh@t+Y^nvXS!N}uM&RSKD7Xxp zi_fcK3~d(DDF$L*iybnGP0jwMx{BLT43{lDhc=yP6AN7U)~o0oG=^*Q5kF>l&=(3A zQA_uv;)c~&d{Y+`xt-F;&%AtECtQ&tU$p65I--$Ycn+&>tE;=6At2Kt3D81X6dPee z#6YA_2!moGr*n!^+dG@1ONx>QJ6XQE97Jw%&&d~(4ELs5!*1G&)X+pLNwbhPa-ye1 zHydIJbtA5qVa&z)1SQNq`ea3){T3M$Ds7C2VkruSdQ*a>p{nsV>Wov!jd``HCBBXr zzL!9mrHpVyT@%q@H2c=qa{7SjU+eQzEFo9GGz$AsQ)olLSyzjttrk);E9z*F;7fVF zjOI#XtI#=Ric<^P{)GS6%dNm>Wqp&jAgiZ+jFzSftSK;aB{C}IxC_pD5Qt^!gEUsZ;U88Ko7MgPEu~}P) zF|WP`(On(m2#ffQ&lbKS79V1FNi5{Tq=~www@{PU`CI*rQ4hJ@-|7@yfg8{8 z_I%UWWL~qA>aw)0jhc!z*d~Zr#4?YzL9I8CxwhrIy`r^rPvw(2J(_vVqNpRZ)KSRS z20p39DIl8WGa57^!hAh745u-B9j&MI#k;YCZ$$gB8HBb^hlM?DADYuIKDp7Rz_``o zYh_jV;CDr{wn;860rb%!Q$#a~ODxf>EZTHZ+iq-ZARp33O?^5l#%D%DdwoR%Edq(o zC!3h)Ryna9E$d<}1$(ZOqYo%tlHTKu!AFa-+TbR(EVRbVVP0**Zdg{=Gm=w8d|Jmu zMB}hB$s5e*Ci@H}|34h!grT(x@Uo3~Z5V@LHr!H6TR6P=wM<&`qmN=og95I$A51#~ z=zZ|4##?H^jWLoIAuZVe8z!}4xr94pQf_TIj&*LB%@{%z%!_ngwB1n# zoD8M!K#`TjPF;8vc>b`gx-q^^Zp~WZvrMf;MOoy!;_e81-dxm3eVy*|2}{v#BoBq+ zW<;ibiw#>0*kY;D%hLA^!+E1knZd8==)A+<+&D##{37P_Ee;4ZtJ>JsOmPj%65K~a z1gBBe*vWt&8lGIxc)b&&E`3uT6R*a4ax5V?%GM`^7(wP*h&l^qKFL7vM*CFJLfl+< z8tT!ia!O<{U+BN>dRm`1Hk8)-Zo$AMGBA@@Bw>3IZl`&g?)>sbdN`NlmAEfe>DT%c zH7Va?G*zUn{bqkPzx5ZEoUQG`ka75eRhB|q!C0rzj;+2YBKCusaCd%J7dOyR5iLw$ zbCho((S%EEz?vxl^a-UN!YQlUcqOB{gF#Tf-Fk zmT^q7+Po%jYVFjfE6eMrHszLA5ac81j{5qxx+@8&sHkt`KwWc-4-i*Z{$CCI9`m2h zXUjxg8w-_Tf#?*_4 zSLp_k{{isBOh)}GiKJa4HGdosDENN_S&xAqpHw&a*GhD_d2h1+TK;b0mB{^ut4cVg4`+xG3*6=u-lI(Vt$2 z{VRYAf28teS@hc?;rGCQeg+(7)apA3``is2Vl;d={QrIlCwUX4@x*wY62FuR8T4vsbxxE%kB$Qas{#QqZnHG}R1PWF2hg0=t`@~C}3lK2UKNWzam zemC?H{_$UMtY1JM(VvKaw^TpE4_NS{7W@*6{iaFyF|_AS=y$oU?;EiH>%gzmagzU2 ziJ$No!@s%xF0tVF$c=t+`o|LfpNJ2)qJCoj6W%{A()>R|WQP@~yd4(2%7SOXKK$bR zraxcA!sU-5Q(2&RRCW+pQhM0@|a{qbO!f)!!^C!Tb{Nnf_ z3%@zvfqrQJjgT+L!%m6+PPEUjL5G@}f04dl3GurAvn76_XIt>AE%-W%e&+bW_4OM4 zV>D}le?Mli-x?`@5BkryL7yn;XP4+9w0|Y&a(r1S(MjKa3%<;P_e=V$LC4w$d2nOH z9!DkqX7r!4po{UD zN#36&`EBsGFD?4*ljy|%qJ-a$iW~;N7>|iQQ7WJC90^|wdtU^7sKwR ztLs}T;djDb-+_;b`3;q~TA~x)V8QQ`@E@SQHz0oo(kT9gm!HCJhWsy~FT`l{mEdUz&L=re zC1yud;? z{h8C3S?J%l;F~OXyM%}9<6_fb|3e7wa(pN;_+6SmHCXU-MtgF4i3NXH!e_#sCoS?f zN_6tqlZL-?c?T`@5~IC1-P|wWc&>#$+k$&7xH(^Nu~}&UkD%W*s3W!CHE1{&7N2tb ze%q2i(V}mGgy+GK`N%&}mq+#MlIVp0&Vp~0@bAEX?m_-3QvN*>{c8Bz^Pmg=ycUl4 z25`}SGcX?bfoJIX!`nMuYtQAN@r&at1d6B<&Ob@x&o$_i*v15oOvRrOtU{xct@t&G z4e4!1WsG1~S>#RD_|5V-zEaPPNNeH0+=6Gb#b}=|(Ld$+-2o$iwkF@~9~?K!s75FE`{}CCM}Q(|G=) z5V(tKiTU> ziJpe~%tC(AzllCdqR&A6PNRQc1{uQt#z=JH-zVV{;UC2#!`BO@|8afpl=vzCPc68) z-#3+swHS>_BiJ-{8T|J$$j_AY`K=}YA0#{-4R<~2H%H&l3;p{Re2avK>vxS--rWYB;~OownV-|m@;Sc8!f*Bu zPCsO!zboP4`drHiix+L0jo%Napt*J}1K=f@l`KpuW^+-vynwQL;9%R=Y81Pnr+Isf7O3nhN)PiFt( z^im7`62qT4eV3*DY5E+WLEq)@_cx(~yx(rlmw5g|7J24=*|n?;h8_cZ$msodV`tNM;ge{e0k5x$WJ`ZS4-+noBv<-LIT$}iXp zy4(i-TqKaZ*?=FzFH6VgLf#L-^Bo_bDu;f{3@w_i_t!Rf zZ$RcOiJmRdiGLJzF74v=xmd!-fS#Tj-d~PO`OiXrE$G6&B=2pDfBZq>{}Q_7gI|m{ ze}%t3XpuiwDxc(yx8UTkNk={y7qz@G%y99=6cGk9Z{8BLVYO8IP0b ze?x!T3;pi`gYegL7I{;p{NF;^2cTcN#GfP4$D;rIJLsZ4pGSSJL1#u0hWynMKh-DA z;;-!%dW=NxLwl`6FvcH4-oqCD9Tt4Rf{&HtQTZ=g=-S}`$ftNm^ivjklVtyIqkpKV zoDTFP54wSt{}}+QfQ$CeMn!*w{*R!jaJQam8}Sr+3E1x(oOS>{PbtzUS8PI(9kqO@c9~3c|j}r1COhuSC#kNF(}G*zNgg2 zsIAfe1pcX*oQwK?2Kftt3;R?3?vwfl;SX5w`I0^U0{JVDe~K>uH+p^Sh^Zs6(|RfN zS%Ll_)&nH3M#}F%!MB5+q38F)K5rqOuhntlKPmCQ1o$1;PxQZM!TS~P**gCtFznUn z9}}hg%Ov~9fqx(BBh#~Fe@1y*L3c{|M@jT7l)nyi(SDae_J2Wtd46<6;&-FGFCcTh zE-xE@%`0E)UsQK~aopTL;dq@O<5U6J<6{eM-aq1WbN`UzFBvOSw5dK_f^ z3UntjkiY*O{*w+|#9NY|D#<^EjxYy#MEq6JHUr?Fq38by{<#)(q5p4C{&L`=e~>(L z|1+PBK!0gP{;7KY^T3OMXX`lqHLtmr^@c}lzjFoy$H{m3nC|0ZAuOWXA zaCyG?reJ3t_5teihQuFUej)o1wEx0SuFsuD{zCRKbhkl#J+^@VN{RnpjP~dJrvDYQ z7h$iTgJ0O|=V-qc;Ih4zSn@BI@SnlH?|?sg{pM-E%fU&I{6yEu44zF>skErkRZl`rvw>yy~FK)9UDg5XQGazgW%t0 z;qQ|0!%&9qY2{1&&r9^5!5OI;qP>&Qp7hZ&%EEw`AvW4xOqQ` z@2Gz{@{9Pj8SqOeU-<7ske`P7 zJCT9<@57+a!cXWM-v4?3Y|^D;C871#brSvnjR%mQrOOM?zm)wu;u(#(^8DJIFD=#N ztu^FvyvBkLSn$s*c&gD~c>YTy{4T`Ldr{wFjE#_3mCaI^jE zEb<#P`KG=N>}~jGCMIYwnbsb^gm1cm)37eu$Fy$)djrZ8f-d}-+Uo+heoeu!N7^iN_jj@!=GsjMj-wHl)QTYqw1jgz2Tk3PKML+-l z=Injoq$LI@Hs-(M+~+yZ`8#Ka?6KDTU6F(suONFb%;tX~$DhiHe@jmM|BS33#tXmOws_NB zfAAh-KRosOr7-=VKmXl*UV(P|;al!QIsI3WlkeZV^)ny!`r%uQ8(cp8j=LX5>Cas} z9s~Q~TkB@G{-*{0Pk5hl%UcnAPI{lqS$^HS%M0=;^Lpp3pBr3!zHxbf?fUC3a6j+M z-fvufEy3sOy!%}I(ZT0WdDpuBY7IVL@11b{TM~T!w6_EAEN6q|NqOsX`uDfakKG#D zEBAD6H8}WO;mvaGuR*``!(9nI8?!ft(+~H1 zce(jpLA#=bLW*=yUI!`7gS7 ze5RwH_f@YZr@yg#3Q9Mo{k*SvcewRACHVYxZ&J?qc`WDiKG#1(0{?7pgZqr#F5=Dc ze(Lh83_dq{-$ouRoa;1E*^O}UM$=fC!J1~&SPT2 zFxC6oQQ=ieFZq_ zbh7ky;CPMYNtV7DoQ`9HvK=q+L*Nt#9ZDBo@v&Byth#%^@;nAs{$zO`2P=QF^e5=Y zIRgt>`cvSf)5+2gfzuoaD97=NyFU&f%kvgEH2@Qockxm_WO?2LD<87-_vy#?Ei7c| zAA*xkCrdBF_N_5Ymd|^46f1C?oLSZ?*^+~vh;3n;yO%F$kO+MlTIf~ ze+I0+B1`9(iGSY4e02N_#=7=Dg_$U|WUgcsUdt;_vf@kvD^IfYDfC}&b;;8COiR+~ zWa+#Ykme2yr5WrGGv;?H=}#LU2P+4%>OKcn4rJ-4=ucT)vh>sRJDn_@*B{!~k)?kC zPNXdkS^7udq|?dLd7Y&`Crjt^XucbtmE>}ZSxt5)aHGIlMzZSiyEZK&S^7Box$&Wp zrSnvD+jVXZ-SKrS^C@b-)MEo()qW@NvD&ge+X6%Wa&j%J?aOZON&bpTKSOW=W0_v zWa-?@5+g7{Axr1bOgfz`o%?O&6Wxc`K=&!2Ou$P#EyA~vc>@V$E?&x$toZZ6%9AX8 zA^oE;K_N?D3{E&L%q(%Hd#9Njs9p%P>$ghcVAAB z-o(ov6QK7F-qN2lK2N>IxET8ff2=XTm+{9L4*;tl$ZCuCV$~01>Ae0=eBSDkrI*t0 zbh30_r>Y;w(no^RwH9YI*sn9L0V^M}{5%#YAF}ib^w(Qmvh?7%;PmKmVJ1B3@#de! zx&CHgNhg=HCSNZ#LcnR=Z^Rw}I6zS^9(YPqeyZ z={x9mI$3%*Sba{G{uDUv#?MK5-0_zz55KeWZ?U#`zbif|WO?{Klkz7^?*mr;Wa<6r z|ANIKOCLbL)5+3#pH9a?vh*r&VzR{{OXuG)B%Mx{J^`#aWa%@(i7#3lvh>@)NvD&g zw}2IgEWMlhc-xlA(s?XMO|kgg|EsTZj|J+hrz3T_|4)3$>XH@n5IE^{vht+^{<#d53FS*D+k_V z(lU~z^Y0`QGpsIIdMo`-Cre)m)_5jM=ie)7JZ}X1U$vN7QwJ z$y#V{F_yhG`^~HI5#4ok*5v3RvT08d&Rs zEYA$E)&*JmEc$t%Mj=a|L%-9>(iej@{>jpL-&AAcF0gVS%X2qaIgq8Vq2KM#$CEnw~EcYxIvS)MMi+9FHeMgMGDUb6H(^gEp_eLq-ZgDm|JI5EfKkfk35C!J1~ zej2PeWa)2Hzs1%&S^9h6RD;Do57si0<@o@tWh6`gi2k`&mn@ynvnQQSmd<<2+P=ur zc~4H`jV!$sto_@th=(lC7;vi5a;O0-f3iHaVC7GiK7syuR+lV&68%mmOP>kWImUdj zjI#_v<73WQ`@+3=tn|`+)k)^*&zthRmKLBg{;&1xIzhM1F zmWR*A`#dp6sg8Ka@=T&W+3J#|&jI^)Sl#A`hb+%>>R+_FWa*p1ev8$8h@L6tA&o=Mc*K7=fN9(8xTAWLtH=w#`4fpr|=Z!`I|*6tc``pd>c z@TPtstL`wc`hhIHoc?cMfUTn_3#6$JHt3X_oJF zo<@kd%S*Lmg2LU0@+T`kH#6l=md>G;ScVA-S$Zot>2$JmUVEmOV}i00FSSLMXBAj& zk)?Nl6W_!Hg)DtNIO%k<^lf1E6h7ACEd5om@*zt<3syd4>2HA(cVdD2$L6kH9*{k)`+IH4Zxlr4Lv+kmcbuvT`6x53ZNLWpyvQUUqu)dU+`7s!zy@Qw>h9 zus9RIK353JRI<}~{V3+M5!$zq73VSP?mCVv{Ryy^i!7bjfLboH^k?Y*Bg=s-{Q&(= zCrb~mAKmvd(d)-o;7Q$Waoz+g|Gd1Ac@3y#iCzy5fu8=h)#bDA{wm{fb2#ETPLI15Aj@+q;yF!^ zyA~kJ6I^57V{N@nkK4DC<#`XRz9LJ1AFRG2OaG95?o?37(m$r(>164}`RJ<+<{u2! zwm_Dr7VK{{&u#Qf3R#}{(3K}y`a-bsBuigR|GgH6EWM3>r<0|3fVD3oOWy)cY_d3H z>D$0br<0}c0xJ$#`d+Z^v5=+j1M40OS^811;*h1E1Sh^@`H-c*08TocEd6z`_HShA z0}G%}gMdPoUII>Sw)njERG*XO846aPlcn?eH1Wq)mn@yvr%9(ruT{rD*EtMX{(7+X zz0<+Ufh^BVuyP70(mL6Q6y8UGI`gA!w{(TnbZu0%cYrx8ftT?>h zR6bE}rY3R!wJ{Z1!K9|zX>CriJLy4#PD zr7s5i4_N%oWPYKFaz9vklI7nHR-R<(57F<|3t9TZ^gEp_o!4<%U)^A}MV4nTSZ$G| z@1uW$xgHwVVH-@j3GMjL(CW4_R?|y{3G~(m$f#EhAYv zA9B>Plco0tYy6OYMswa z1#8@r<(~^yK4j_h!ODj$eIfmSV)>AzFQ(t=Wa%rx>Jzf`;M&vOPl#T7?t~|`!{YA- zD>t(0@|sk+MXyi!OsMWBkmcV;|9p!{mi`P_$Ku0a|4+^HGTH6x-XcG2`a59dLspz~ zVC6%Wex80ee#p{4px^0a>3O_P?69^9z-o&u53iloR_=AQww>JTXl*;u>*xgAa@ScY zu+A~aYO4yY9LUl~f|UbVIIAyrS}J?-L^0Y zP5O^myMytT-et`D6{$y!=SK7c)OVZCYgn~QR(xJ#rvJh`*Wyk6K$fQztbQO%A4324 zF+m|q5ALNnJ$f&t3LcF&vixJfscuYA#^L4vWq`qN|ND;_&%m2-w96d!vtjyUTTXh54%Qfk)<=;#1An+AxnP(oOC)_`eCrv3t9R}uumh( zX}pvJS)P}`%7HBX75aaO2?|;I>tN+Tmi{(4@gycFWa;mMlTIf~FW`9oY(5lxw-p)B zyeE_TQ6PJ~50iSzco;bSW8=wSEiYLy=TdjiWRj&X1p7~0-Nod;HV*E$JY&3y`hMdM zu=5?wCj`S!2SV?c?zt2$nu{CD<87-m*_ueb;;6sUnuExvh=sX%7-ld zW9rjwJdmaL$qVx#OYa9(K4j?w=>MVRLzbSP-|1xO!LtXWt=-&b5Bx(GhtC+KequZd zto|V@&KR)rAxr1IEbTYQ()o;>_8VmBQ^D#Vvh>@)T3>U(%7H8o?_Vhgvh-&9-8dvm z=d%qOpV8+WRzOz{WchbeciSvkdN(+A#QNtkuyP~I!{_Lf8(I1j^dGglWa&@Q?{uprcao^ zmhAQk^IArNl>32F=`aH1ulPtXjoaR9crInuNLY8L*^wi&( zeivAIlI6J@tUSrm*U--cBMMpiI{KYXmVQ52d6K0+3|3!tgZ<|%<`dLU86N;EH?ry; z1}itR^kek@z11a4KS96K$t(Av*6SV7Uvu|{i5-C`e$H*LYDs{aLSE0uOQ5s zEKdPgIg_Oq)6WwM6tZ+aqmpzwSvvbe$7r(jQn31y_w>|n(ffN<(3JyObw|?g&N0Z+ zN7L_gvh;~y~ ziZ?A6S?#94S}wBm3i|&M6BM%aDsa;2Wa+hFjR&&yX<+|lOi*sa%m1eUgYP2Kj+-H+ zd7_8XhL`drE6#GT@+3>Yi~fJc1cfa9ZgA4+Wa%5h%9AX;4_NJzrS}7?U9$86^uLA) z3R!vroOC)_I{RGhM*F{#`d4kcAj>}*oOm4*6teUhaMI~y>65{VPnOQ{pyeV<9|+cR zk)?CYB+g=jLY7_vPCA_|onuDrM#oPz^wb-epfG>`%>ca`yeS{D;&99;pXm6RK>x2W zK_SaO37m8~S^89P;w?;2$kL~SlTIf~UkO(JWa&GpyYqRn^lq^KHYO*KVftH;to#C|XWa;nH{|+W7Wa;mLlTIf~{|KD^H%w4I#!GFH<;lbO zt=b|>=ifc)+@37G7ya(so-BO;Sp7zpJ{X*K{WAot9LVwv11krz^m6*$a*?H1((iP# z^ct{oAWNSJRt}TE%7HA;6tHq2OP@wRI~#>8eFptbCrfVzD+jW4ANBonL73oo)>6MQ z=Dsw|m4?D`p8AgfgGuT?jafJTbsIlq#pM1(dUW417<%e`Oi-@HOUp}E-BPfYmn?k< z{U2b0LY6)ZoOC)_I=5>rFIjp$*#9p~P$uG~9LVxa1}g`$^r`fJhzSZ=I=9oL)5+53 zf|UbV`rXw3FD58t>07`)Hx85s@ltMNd3J!68(I2eVEjQeY;i8b`q2%YA&h6AMFz$o5RH5-8 zyy-q3S#?K))7}l=nKp*W(%Zm(PfSpj z<1Ni(QPxwx!gw>exAFZE-U&`zX*yXkcY~8oCrf_}tbQg-f0nv?j)g3JU>@SL!%)c5 z2Z57LCrd8@>)th4dL?xipDdl%%l=gspVz`E-?$x|?rXdb9KX%_jjXzx>F;Nr?O^}E zgEYMz^t*m0%fE~MxcT>h({5}$4)*(-egLfNN3!Z3qyK92@VZso3t1jsw`zOIy@pNj zfPfOchJBfSr;`;Yc$UN61BpJ%aULG!`~g@wkX831uyP165s z!8+EHrE}lwf5PJY|2mK2!&xYU@KVeYaMI~y>E&RJRkHNO)ZMuRS^9FY`h+a~F0lH9 zES>wqMAGt!?i<(8?{u>K+ri3*EWHo)+2|w`vh)Pl{{xH92z{mqR<5CnhNDleA+V7ZiUW zSp7*>Os+fiCs}$4IKh(|loGt8bJ>$lCrhsct3S!o$ASG%MRFc$e3JV0#Gg^=;~Xt{D;8l3QSPW(Bt;WWO;gH zzu{-h!+W+GtI_+nL+PnBPX&3n@knx&@o2D?o%dRO*AKkE>fdOd$q`QrSbaiPKCNK& z30XRi5s7MxLzcdRey5YAZv?AP$kKW2NQ|&JWa$rqlTIf~?*{7_N0xq^y4x?2rN0CA zZ?gE@$EHRa4*>h4j1yojJ6UzF1#8*K(s@rZ@foX2mOg}jr<0{ufwk;p>Epm!N3~#| zCq5{=mnfbB*7+4#b$N*OKWly-o>OCtxogw1kma8T*0PYLH`D()t4o&7dyh${lclc& zYgx$BJHY80i?bf=JKjvcJ0Bp+&%ZTGInP62}2Va!TuL4H!iO~Im};qM&t8ZRe6#XhvyiHFInB_`3Czx>GbHj7!6%{k`*V& zXR5{FHL3q)8rpx4w9vJ zfOQ-sOWzDmf5mcm5bX1!4P^&jYL_g37g+6*rSAeKzG`*J()WOqPA5x$3amaPOFsZk z&$Kv)z{-Iv&rz^)AWJ_^zdHvYOMi}jr<0|h25Z@00{dUHc6;H?pJkjNf8F?6yeS{D z;*^4w4_P`-=@PeLfJzebZhq<6n4nC;n{pt_^Ly`2xn<`Nl%K0v zeL|K#AFLe6(u4E2>9${rp1<*2%b$Y@%5l7<8;lF`!u~9d@E~x?^)s)3wJc<{H5jb^ zBunQxRbsBiCreM!?{u>CYH+&I{54>Ip7BI-lQGY)#M8mLjwUM(zsvU787T9>%9$)r zGgvv3rSm*3al6$eOApT3oE|-Ay9*xWypnYbf@VFk>aGH-Ewc0u`kSpSvh?-zJDn{3 zL9o^}S^6GuVu8gWOMeWUbUIo3(_o$Nk)b;;5P)9-Y$^h&V$kSu)^ zINfS-YQV~YEKe<1Igq7Kpx?DcmOhDor<0}61S1V)dmn{8tu$H|S`XxRe0t#6k3~kR} zZfy-DuQ2AhlYgi2II!|3t8P75`IDtjr2ku1mn@yuN=tIc`BJ+g9*w^yrnvgxr_AI8FSeAPG^^;?=hX#{Po6si*E>7@wY%q zxn;Z`tYsw2vmLBuBujsY{*9QRkflEiPCA_|o%e9GjAZFgfYbM4g7OsEE$_2nf0OBl z@TT0zs(Tcy+{n_8)BhbzP{`7s11FtMmi{tWxsj#64OTwq!Tx4UP(CLAv2k8rm>XGj zi@?f_EWH=~?06Ki^gi@Eoh+T_UCNCteHd7|rNHVRvOE=F~FJt27wa~ge-pv^rX|t(uaWcn`va}<=~WyIV$2I%hMn1f7jXyjth>5 zv94prQU8!tm-mg;KV<3E^v|`JWa(^I=hD#}crmn?lKII-92lBK8UcRE@6NU*j|vh-ST>aQ$LJy7cx4$-kOnf}MEE?It#nWWRn(r*JR2eR~qV6{t@z8I`_$?O^3Vmgga`av)1TML!QpC}ioU!AYl+rSn`Owcq?7g8d&E=i$xg z0S%=e-n6}tRW}7r{MbBX=@sCl)5+4Sz`9-|OXod@^wXH2jKN##uZ?S|KVv+Vy5s5K z_!8T1lNE=T***`vC@thCjoTy4Q`^3OYdTM5`~${YBFx>2^j+Y@LGzH+7B{D))5+4g z*=U`TrE~Fo9{f?*r2iA+W8}leFW@b4BxKb+11afrvUDEn)fQPgkIRXlLO>x)5024J zj~=7@!J{~2`4iyu-&mXyu+L;shLT<1@;ICLnd#AE?r7*qr;`=42CTNo(kFv`p6sAZ zBmdl($JWG&kmcvGHR<%+aN?zq<>`i=bUIo3KCp5oOMedR|D(lufgX3= zL6+wnJ#H+0Nan_el2?HB^-sow!2T=7d}iDKXJbB(op?25#pLtYNvB7j%^m|?d6MOy zMEy03LzX@h?7wdMLU7_=LY9ZmV<(+Xmfi+dTV(00sJr`VWa*p0{#lFv5It@kk>xoH zPQPIu{x(A5&5-5cZzCj~PL}>YSox5p^EVUHzp^;J@%QqHw?dZ3hn{pgS$co4Vv?l~ z25X;5mOd1mbo)%Q^b}Ze$kIoHeO`E>)PhrvCz5|{`ZRhRF9avvF`cY9{9T2l)5+4? zz-pH){cf=TZx&}0IPq@C@@#>gbUIo3Hn3unrSmrv{C~GN{5=G%-{@~69HV}-dC01J z5}ZC~`pe+NZ$g%bzm=DCI$8Qzu<{{Ge;=H9&*G4!e+W)Gohld>0da#b66T#{KvY0dI zzbZ(%jkS^X~^IJ`P#!J`FwT zbh7kk!RlMG^rPUk%jY=Q|DDA=P4;jgLOBag#6nhG{suzQ>165r4Ft6n{XK;9(9-0F9s)_PL|#VRzHxX-wjT?nEXGj ze0R(}1x^gK_+s)9JIPnQ$iqz)7c* zrEdnSEwc2T)ZMuRS^7S3iWem)Pl3}(<3nJ5|4x?wC|KV$lcgUAr~lRV11G`$AdB+~ zIPnJ|%l|s`q|?dL-vTRtvh=)Oh;yyQAxkd;C!J1~-V3b#09pDVu>Xe^r<7b`TuFBO zhpFT;(-)FUjoZNK!Nzxk6W4{T_-mjiolcg%j&*tAh;lzTJ|tv$9;W^&)5+4G0VjBY zh(eZr0GxC>S^8mc>U#4Z1t*4uEYES)bvjx48TvnMezNqJ>32F=`m12AFS7LazzN=X zMj=aoADnbLS^9@y#UV>CxB}OG?pQDooJdD7QFd>7&3& zr<0|R0c$LgrO%-5&f&?@=Ydo1c)gGwx80HD*#!38f1G$fIL({!C@+9h8RM7eaeOwy zZ%6oiguULOzYjQ3X>rJEw;wp^bh7jTVD%MQdI|O67KbdI|3_}3%5<{yk>I4$$Q)e6sWv;6$~>BuifjPCA_|eHB>!K$gB9 zta11tI5EOvlI7U}PCA_|y$js;r0pAbgZ+_KcVC1LgA+HIPFCGx;H1;Z(ocYuCt3On z;Pe$1=PcO&r15*;#Hf(ve;<0%>1632f)$@Ez1Nk9>5lb%!0A2~^IGa||Cs_OK4Usr zbt}M0r<0{ufz=jS`Z%zTzqMf9vn9(j0jztrWa*RWpAc+P9$ESn`khXeej8XhkfkpK zr`>(y7I4bl=WGM}Kd^PWGQw-X@jL9ik*qiyBc3f_EelzmZD1`6S^9(Yf7bewEPV(4 zPA5y>4Ni|S{~oZ~BFpm_SZ$G|KTiMWtS(vl6ZAWsEd5!q+ByJMTV#0-gVh#U`Z4<5 zx*$tGLBG?<(ociaqb;{HV6{b-=Vh?kB1?ajeixH0{Ve@XCrf`1tnomW{xMkBl|_Bv z;lnj3WO@37l^a?5K(KNnOCLo4SX(Z#^b-1=PL^H)*1nD`eFj+VlBLfAt6j46IrO__ zCrh74zthRm7lYORtzfl9mZu%8w#d>~&_B+Wkt}^B{Z1!K-w0O!lcnDePS;qR?c~oJ z?*JZ@<`CXwu(Rdu${YTT2 z$&*ZW5PL_TKtbEAQ-vp;! z4t!3@ztv*CPj-FyafAzSnDM8Zr+0+=kzJew*~KXV$G>4?fUI_hg451346J1*%To^4 zvXiA((*G69fh@h6ey5YA*MQSA%s&pSw#f3-gVh#U`b7G_YIVudC)4kAvh*2XwKWs0 zw#f3_23A{S>2v9yX>F0E&!^w%Wa<3gQ|pv0eGORabQ9SBn#JUIpeeVG?guM3vg&RJ zD>t(Ahv=VWamdmirr+sg>5qYx8(I3(VC8lQtZ{M_tbEAw9|tQRvh?TZ|GMQvmVSzU zr<0}gs~6=%mi{hS`S5nOav;mY+sDd*ESGSOXnrGav)3RZ5ri} z04oQwJiM)-9LUmnJ0LL|6BM#^UeYI>PL|HgA>}}p&RuP44kjqvy($N?Jlu^c2eNeT zZW0Zcppd0=lS?|CEPXy$Igq8dgVhhq!ODRw&s|{UK$dzujVz zrSmwLbUIo39I%#)EWH_=Xtp?H=`G--)5+5B1}hF(`Y!7HvKNIc{V{NAfyL)@M_NX* zJWqhNjAZFg(SHp#6cn=bXTbU!d9rjK*L2PqJ;w2Qn6z6jFMyQ;S#^2rQx0V5FVnx! z@+V7w6`XWBS^7I*^$%HkZ?M`WOXqo!+9gZxPk)QGOO`&6ey5YA4+g7Uvh+#R-Lv0h z>C?f=hb(<2Sox5p-v&-CvV7)%6N^KZXCCyV)5+3#ex>z7mVOsFy~N_I1SeWUmS+|8 zq|?dLH-WXhWa+)ZS}wBm-`me^*6v09?DYRlKUXlH#Ww!QYIh_!wbbH|1}itRJT+kT zIazuwIKiDC3R(IDaMI~y>0FQM=jb}+x=Sy!I9xBvA-ayZ?JI}qeqb?lpF3I z0#-g`>F?H3{smw6>;E|0Clz zu=;_ly34`p2eS0L=;y%=g)IGU`khXe&T~KIOqR~=#b0G{xGkht8wdJY;}Yr}#s%Qi zx`=1Ju@7DOlNFyam4EKGme^o*qubgb`khWzoS|UlPnKQ*PH(h0-0u8)jcX%30j%7} zsyhj++{n_W(7(yzkfl$f-|1xO!M64t^Us5x+HAZK>^tT*r5wnr%k4`!kfn2*O8l|K ziEdxqeb~$VWr+6ZRvI#G>OO}5NSnZOfZ=?S{t4o&tApK4!OWy_7dLc`H z3aoa?(w_mVU9$88;KcpbE?N3vaMI~y=_kQzmn{7yu*QQAPHnT8{mBm)UkmoP8xJOb z*LWD&d1}GRpRD*CKgvIMEa{$A?pV@2t0|E<95c$FtoSRy=?5dZJrv2!aV0#;jjX!W zVC6=ZK8pT7u{dPuW9WA}SvvDqZqa3#1>N6aapuy)KLkV}t1icU>QBwXah`TLb8M$v zU5;DDSq0YbOp+C6JvhY^a1@T)_@9L=&qL7tF4McfsXsT~O?{{FW8nB*mM2+tpN@DA zkRLJsF>q>^F~^m^+xRs3FN|LS>$@|uVtz=S4^g6!r59m;>+i9;J~;h-<9=YRN3#3_ zz*>)F=?VI~tu9&mwe&lkEIqid@|Whn4SMST7|#Ryj$6U{-2<}fuB7hHZOGC)!2Vu~ zvjv>`E93jAJAMePx@6VeNzdcv?Ivgx)Somy72%h_>O->H zdIhXLBunQbjEVgghb*0s4hYF#bti*U&ze3BZ~osJ&%|5$fH5z9edk#S zP8~Fzr`oAQ#ystl&eOHjPfX`2h3}Y${P?$QoRgIscePp;?!x@Tn4oa8SDxG~wZ6!z z%gs#di!A*y`j23OLYB^9lyo{-I){t)U1aH8JpU*rD11{sC&0>wEdNQc@*zt9}Z?JMEtF8}L&SdF) z_B-)2t4o$Xkbb9=r4IosXR`Eiu=eK_VC6uTrwXhb$kIpBf825)OXnl?NvD&gPXg<@ zhAe$0*ni04tO6?svOFDNi_4!T6VHLr@&fvvh*`xp937_ zWpLsbApGn*{avue16lezthRm2ZEIY zS^5xg>hCO0IXKOY6{Rx5!E^Y}o1Xg{=}D(YpTi%=x~I%vABi&+?Ek&#GpN5{JQJ*C zCo4DpM!J@rEPXEhFIru)^!fBVoh-c_tYs%lUjtVEuOqu<-w0MdWcfFPl@D3^{q+Al z=r)fmeLMY5Crj@FYrE(M`>x&n5k3G`4rJ9m3|0Bs2j4i$wg{RI6^Crf_`tUe)2 ze+R672>u2EpIONAya!eeWa<37gTy~r4rJ*c((iP#^j>`Cyat0Eg)F@vH~}9ES^5C5 z+9gX*(0|6-B}>1Sey5YAmxI+VS^7w@#sjZ+d>)8UcpWVs0!}%d=l1%0VY1@PiRfhM z&0zl@EoMuE*MPOWWck;DwY+5Mygp65Y;nlaH`DKQvh*Ebt!uLMC#ds)fI^nu53GF1 z(g%Q*4_SJGejc3pj+gXn!AYl+rKiBkhb(;**#BpXQxoBOu&!Uo@=pe*UN!$zuyQ8L zGaam)$164=7Sos^OJ5F7yPQ{o{nst#8v5OJ6Ip()uaxs}9VutB zJokf@Ggk z{l=uzqxT+t=vu#I`3HiPLkT$buNHGK{qFjmEPsj~mvaSJIg{n70xM^-^pW(B#RP>c zeKc6V$4Hi54^F>r`Ah|;er-Gptm|vC{LR$e_f2H!tzhNc4pz=&c~*dxGg~bJDn{339!Z(S$aS8b&3}d zC<7uq5UhO2@(%(lAF}ikaN^%B4q5tOaMI~y>6KvRLzX@U?4PqZ6X}lI58JR-R<(v*`bg#V1Rj15P@fEWH)1^+lGx0-SdJb{AMVkmb1>tQ^SF*UmYC5)qv&eF*h6<|j)J){E1l>!qIlapot> zUkpxt5auAhmVWme7i9T4#{3V>-P#aj5>!9h2(+ z5_qC96P_(gbW9F~C+T#u{MBIfKUsPWb@%s-Wa(4Ee$3)?>?yb0aj4vK$6+GR>duM8 zoCi)iovgN&gOwXudI$Aeu%V-nrEdfK1r~n?xzM-^oX$7i30BTz)!hwN&SdG`^cPuO zvh=<5JDn_jKRDgP{7-?^7FnKWz-o&u{Qx*oY<0=f4}+6VCrjr&SoIHCdI31q%i{Q8 z{|aNCkNLfggE4lc@kr?DKE|V1_bTI=WZo=6nTwb2^o8J5U(+{I?`QllI6fuhXg)q~ zuAubC%O7Ao2%NgwxP*L-aRu3VI3`oP0fWMAEtN1XjWF|9Ka165C!RlwS^xMFRK^BKBoqd&bI$3%nx!Xdb#Og-3g?)&VbUImW9RMo_ zvh?HNbg9KT5BAH9KLDp3e;Cn=unX`9n}^>iE9dC<%lz&@Ig`~EzdJ}=XLWPGM@Tw7 z5%CWLr+LE2$Jmp35mt^t_JeY+Bdrz*-iv>TU#US;*2i(|^6?K$d<#{Z1!K-wD>3Crjsfnm^3q z8~`f^vOI^u%7HBX82z8Nx@74m=yy6<`b%K-16lf8V6{t@&hItUE?N3H`qS1fS^9bU zolcfskcW0_%ukk{0;^rJ^a`-rB}=cO{|1XgmOhexr<0{m0ISc*(&vCvydjO!Opp5; zH?lmueVoderwg1;8T0!HolbWa&KhR6bV_!JUpj(Qy+zgSoIZI z9v({7S7hltG$wAu1cfY}hrOiJ$thUI~SJ3aqDp@*j6{$bT z((ebWKgrS`0w=05K_N?j7@TxES^8sO^(R^SQ(*ny7G&wqfc1Y{kfomhYiyIHzYf;_ zAxM_~CRqQ6AX)l(u$GG~{UdPtlbE0sU>~pJk+-O6QDf_!UU^$nOG9~k(~9=;MRS|x zwYMyty>w~I?8cTQOPgjdUedl`{+-_76<&1S?M>~o8<(}UH7#zRy{LVe7u3!=8W*%S zH?_@fSk~S=yJ>M_+nufLvl0E0^XD~%^DmRgH`^ApH_dKtSUhiObHg1?vllJBJqULh z`}~$=OPgmeS=QdVto?G!HovL8v3d4_#W@x(_Piy_=C(A=Zfk09YgoK=(Sr8b?F$w) zAzU_ny4sqSHZ7hvySb^QWeGlfV_DNuGrJA;0TE)esWyKMgarZ(1@-`3PLduhv(3-essv~=l$C5wZ6+p)mNpmE8fMObgS zk(!szUa)j_Yul1mth)Ja4Y%i-ln$Gn-?HHLX7r5fB95e`O<~K87!|?Tn!RNHe9pMI zXM$nY*3{b4aHl1g?cPP`)1wH$J@TbCe zh1o4l7ka|I(Kp)~T9>uj=7()4*d*pJXsi!btp`*JNxThpS31&g_hXl=N&WeGY6Lkc6j;r6zMMVISs_QBjcF^pz6EN@uQ zl3f_BUT%b!s~g?4gHaSUGOM|6BX%=!h-oSxKl#=)wzI}NvQ23}FdxY;ZO+QktsO^# zOYB+@27@YGLxC&om*}dt*#A4PZ4ho3?UlE*EMGLcVctB9McKe;J7v`M}6kX)#f(4BR z$6*|vf*{$fqvIMofXhX2$2}fvvsEwn;EvUSc9})bZq&g(<8m!scwo;qhThGM9c)p- zX#jRtI6Ye0+R%8x0?>fdueJs(BnE7-?c0vXc7vBo!A8pO_t;+f_j_7#m~Uu{p21!0 zXO3JjcS6%N&+Vcwms_x-zc@^EZQCi@*J%vSh+12k+MDKG&TOOA&Ur#}v@z~4 zd9dJt-O|$D_Hr?~1m56z*)`kPfK$oF%ek$e8!^N&^4%a?+S+tkza644;aAca3p~s6 z*zwpwmLn3*7TO!;;{DD=!FzE2P@cKzCU+`P9#UpxRtzaKA}fZJsm_WaWp2!hA!Vwv zVn~(4vtlO1kSZ&~`5{Iq6V8udR;;YZVkX2;yJ=*0;j@$(nZ=MYBeG&hnd+<d0!}%dbC=1;tjJ;}L}+bGcv@WE zxU{`Wi=VkEiy>u3X2p;)BeG&hnd+<d0 z!}%dbC=g9hLpK6D~42Al@&7~hEzE` zoF8IHm6hTA5Tg{%&qPp5S6LB?5zOuja88sd4=p!UsA5Q&ky$aM%!sTQQl>g9hLpK6 zD~42Al@&7~hEzE`oF8IHm6hTA5F?Zc=SMIrR#s#&6JSM2aQpawHMt58irC#|v(K3k z^KKXrR>jvzLAeD}a*=)Xs@%KY@D)W+evM$cz9}-{T|V9m=U13DZeGRX_AJG6d}cnJ zht#~@fM~o9XcO>KQM?}Tu}+Pf@dV=W`(?(%qqo_3eR^FO?*!&utAzwBUQhU<@uvI$ zzj=U}jEA4S&BnU{rf7a|Q0!=D@?{<-$Qdv1Bi?-IDvEb3XS|$$ z1OI3RHqTSf5>K#1md;!X4mHVnqQ#?51XbD>4!y*UWK?E+mz z@%Xq{G+yo7o>u`A<9z}zE$=6D*6*l4Fkf!GK{@NU9r3tbG9DHw8}E7~5Y2BP;*CZw zD#~v#Ae!GZh&Rb?AE=Uz_oJNU-Cg2&eC|g@@%H5`Z}B;Nw~0iU-yhlanB@hUM6qVY~+W*#fLqIhZeqVdin-e~MxnO_-R%J0`X z@y=X_|5Hc7@UD1o=ESSOLo4(#9;#&H-J7$1Ylom+%vVu7{yuaxza5CD_4_H9l^=go zH@dv55U*9i@UD1q_@eR7BHkX%XMWe?rFi_^`e?j!h*yI7DvGxqLe%FYsk4_DSNFje zZFkduVZU2!?WWv3Zb!e#Y4`jv{Cx;?6}8LXy^qFA<;A>#FmXA`@zQea07UaE`n2Z_ zRxrFP-gn_+of@GY*C!-WmnLeBqaJ#=#WC91b zFU5Nr?Ou={I(L?W;a&0gGtbd@GkV6d<8)*s-W@s1TYST%*DwD+h-kYB_#V7OyJK_4 zK^NNPewWMfnMk|WW2{Bv?L)i|E)j1qe9`4Nk9aLE-e)86x^u=sHwMYOIPR;cUmndF z2XlJGyeT*~Fu%{?rG9=mC%*?Vvr9qX6MiozzsHBfyc6gH#v2=n$KTG6F7L>3I3L1% z6~$}HiMKKxZbzSoS^52QPP}@=!=hx1;_)}~qy4uH@djZg^Q()*dnjjrH3g0B%ti~B z_ko=K)#EqByk@k^c;h4Sj_1UC5Ak+gBEKU!@djpM!EuoBZjQwJ4z`bI|7}O|82Z_w z<>ezl(dC_1753jPk$8N3CmQcC;&EK5C|*TQyp~A3FTkwz(JN>BsHn$tbP9%d#VgF& zJ~|Lj`?W7d;{8F73-hZ%yq7N#ZyZw6LYw}Rna z@vymF(0~0W#=K`xk@3Ff=CS{pa?UsMrr>%3x{Bh>$vNLRiRbG(U}C(lHPO0zT%WA|L;cg=oAE_;{RDk#BX*{&d=;SoZw60cPcQ5D<;G|1$BO zfsb`+Ttgj*$Nadwjd&^Eod_0<_ZH%fb9MNp{MuoP#@m8;6EL6gn($J*FXhA=hKM3ew*&FiFD-B=zkkZfuOD^-MV#r1;++9R*RaK2N%bZ@{uA5XJi>XD%{*P?? zZ1Ws;UYyJGQvC0j_?x?!7ccU9t*+xAcHEBTjrA>huJpu^;}effK05XAm<`qIyF2ph z3VU|e58t@ECcf;$tF{)cDi~hyV&0H#6KeKuh#eeM7wcL*e!;T)>f(ik=Njki_xki` zoby{RURdjO)*tE|v+lcS>sPDL@@r-5YkQV;5AM14$S1sf{6{xyk6!QP|MVtrXW{eT zIaD;a$1gX(_?_Md-m95gd#ZNa&HHXHomkkgX4Qo`J-wlFL;1#G9o3zR+uhN$jBT$z zaH1w%&kPFZ$BT-#{qWZPUgw6@2iMnbE%f}xbB}uFi*=O^tLj;nLN4Wldos`6*;ujH z;)RC`qMu7USJ$bf*umV~I_pY1FVxhNcYdSjbm^05V7}S7ru)AYO=e{YW)9#;^_tiS|$J*;|M(^J2 ztv&H2buWt8-7j3KAT2zwPIOnwY^oIN+g+23k*Yyn6{S`0fZTU(0 zpX6V61^%zy&e+!Jg|YZoI=!-0ySztMo%PCAzu-Nx`mnbaG4mfi(lfrX*2~nN;<6ol zZ_3

2ej>b|d*&b)tS-q${frP;c1aBO(Nw6X2Q6FX0LmPSTP+k~yR7ROe<7Qc19 zSGFF}*B8X%g|~PI>#B+~^*4_%Jy3n9{P3yH-Rn-@b9#MtiC=50d%bRKVdIuZy;$AP z3d_2F?8UmSzI9k(tSek6lb@SG-}sO^XUakDhG_HZdia-~<=lbiaIN9j$;rcBud@I&9wXV^>F*ddHc<1D7?+#m!KAADBIMy|`Z_&}x z!^1lI7ODri1&A@0dX;wWt0}D=8`H@4>Xzam7(9PEzofARk8qT@M-)pcE6VZpLdnqP z_V(7Lqi(q2_668@&mH>c73S3M5!Bz5oo}CUD0ZcXSL$dz z-t%y$o9*q;Y}`q|Fdv&gF+1Nr&&>HeDd%%@&S#z{Sm~J)|B9S^?Q@sxo_#LL9%8P@ zseffqzdP%<&%1Lzx95Bg&+pCue$IUUy_l6NbK1Mg`&49o@=o`KpX1qkmAuC8ha+5= zo1NEv%f;Rn%rCs)c**1ObJno8KbYUc`*AiGtN$xEpKtUha^`=QEH6L5?)*HD>W6O*KFo=a(;YAVNlZ}4!vnJOq*Q@@;Q2rr z*8?myc=b_$xyY!$f zoGY_T!7J@N^T6>TRPB6DF?nvPx*SjPkmXq!@vNbz7bYlVc{YMmxHe_ki2o@eVoIy z6kyDyT@JkWBxYZwt_dvmJ3fvFNA%HPp92SFJ6=A%KVsR5SBhV}pzOjc?dqNZ$5T}8 z`vv9pDn6(9#R|&Xc=^tM9;~`S&V%T{z7~1L(;+Jkw^RB1MYtEN@f*xfmY>Tgoh+T* zr*%q}9zG&ze^-P@fz z9-@r2i-*+l_b>KmFqimSj7vWs?sCQgEeroHLQi)FVtLNP@fSXJt~@S&Fg)@&xBdiZ zX~X586nBYS^uV|ph%9K^68tsH1!W2Ayn%ngY7SCT|&m9MkZeQ;4Xj_k$eX2Uz znih?J)xc+I!!$4XJZnV>M%DkWjL5t28HQch-%Wz1f?*z%k(iQ;?BivhVc_{puFviI zf|?3_4?gh_QxmB8ezDk&3*2qsf-{)c8}G{yEE;bdv~75)C|)Z}(RkedPlJi^c=+Nx z#yf^rG~Q`^-jA1x;{60dG~O!2{* zEwW{4d1LvKxeIS7Dfyr7&15QX9DY-9H|Kx8H&gT1v7o&ww8JC(Fx_dRmiy_xV{3h(^bwP|@r@3Cu- zV7bPZl@xf5Ti(ExbY1`0PuAAmiX~iq=)ps=Lt6{$`c-z0isaT=*ZV-M%c9~gNu6E8 zhB3Q4(Ocsm@EEgcS?BnmkNw|zXU6{9_{N&wdT)(gTX*Ej)vv9sd+|!Pl0W{%E3KtB zuDZA-Mdz|w)acAem$OzzCFWb|z7nc=l*S~OVb&hMq_f8weHTt)DBe1Q<^KtjHOH|&u zud{mH)9c3EbLgJ>^?7T9arD8ORfpD(S^xB!>U;LB>%Qmey7G0;c5c5%_eG-f`sU2r zT3C_a`0AthrOh8<-?Fu{&?|qScr5y-&PJqqv9oUY1CM(9YS{Dacj*__v-ua^&6<9E z=CRw3)^{B07;|s+hJCn4+P$&SEB0asMuok3@60SmBjyh+%x=9y4wN36-gyf9hvVyB zxd-=lU)|XeMi|y{`3S2IXiqZafFkU?=cVkPME5XxN9)wYakuQdh4-~oCtBlDPW5un z!oR7zR8NjTzhW(WYgS!+$Md%5=AM{;eBrUhN5^e=cEhNR`!`nJyZ7Eg|odVK9E>mEM1TVfc&R^9naCTpv3)fBm4Ext*_c&RlnT-PFk4w$6gS z1&v#th~?hZeD9XIlTJ+<_l135;Qh@@t);n#M{VRf+PiVsy;}ZL**zidGJfkN??=dN zYe#|CchU$PrQ^MNdBb147a7G4?x>lGJEdGdQ?qpn3+^ju^gCh~_gv{D_A>XML&siS z-?-|Crx6(I5>5KqnpH!`qW3D*%luTA(I<|?sA7#?56#s8w{(E9>#R_ehV`_?EqI z{gBSQ@5Wx+Q#0-6A=o#Tu3NKRTWPreA983IqaYt`4MS@#{Is>8F4H%=-{U?bRxfYt zwF}+$xv*06IXC(Vd&SDDFBj{e?HRdsT0MP^_7v}?;%@(d@NPejoP}yHUf9ty)Ha1>VQPKNAqjv;H;hG8_``3@aJ<^F|`lFZhmqc1y5LB-k8@L^Lp#}9UQ&0TjS)T-5ZA99G+L?Kl-!$=%=0qv4fMdM+Y2h z3uCVp;;h6Qkj-V!_X~nrfxar4)%Sis5B>u9o3<7fekXEN?)pBW2C*<@dp4$36G!`k z!lrmp;dh2azGaJd)@HZ#cxOR&OVu9!*fBV=XEgE7!&fRETl!92+3F`eDd7_Fd$fz! z1J+UfG z_FvO(syp7fWo%)=hJx6k`wAQ9?80%dzqcW~55xK1fz{)FglpTa>x;dsC&agxdK0$~ z9CvhGqt_$$`S)n_O^}XG=EoNaqPhAx=++C zSblK+)`Fse@pZd@w{zWtn-brI^}pTDd>YbeR4gB(Fb+=;JqMhwYfIj9-C{GGkgWj6Z9#h zp*6@5TUWgBKfj%S-PPF<&*Rdilt)SmabC&udYxOA9v*UtJy2F!n5~T?m5;1EwCZ6g z^Uy}#h2LBk&kD0Fo~697-^s(P&+1q4t@c$}wH(V>QsCQl0bAB_GCY!%6+DS^wnuE* zgIqT3$=>*0_{poivOZ7t!sn7Fv7b8vt*nsqTMkwnS+lD5i&I|2^!X{zuUX|kKkfN} zFHXYevVl+b!L*$9Qom^ZMb-0ROa3pX{j&Ez=?aj?PIq;9U~k9jgOg_2r_~4jn*928 zUhMUuHF)yDT}|8hf2`|RP4*a@T|?dYroN_PD_-Hc#93Nx?%sw+s&k7%k88ba(ya2% z@Hi8DEmc!kUxxFvi`Uj4OVx^$9l^CxtTtQ==(k_2S@owICSjWTCBIv)>!CHHZDZmAY#RqFH|*^wtouP^ zUs5)>(Cb}OaImcOy4dQ2+2|vDMc4`<|I+o@aJg?E8NH|Ig?D`TXaT-JCOX=FFKhGiT0Ro@Wm^ zEjrlq)2)8AJw_iaAXZtYL#8KsnUp7|82usJ zm)D;yQqFyEYc}-{#2eHbl7BV}wYX5NU07ey8p}}T!8v{N4j<@%|Bb%yfVOsaVvfox z8ARW0&=h(wzR@~Kp&Qe3{!o@5|nhbW+(JG4sJj z---I4`|4;nty*0EqgHGAa(KSn34_#=d1D%1uO^Ykux`bFAyo)c$#F$762@rdHVSqJ zHLzk~p)hun<|y;d=xGo0`!se7TQ_G86}07dpl*)9>3;T15&Fz_S2lJJw)?Xs$ES** zD+Pnq$aeX+Shabk$k($Sd3;;K+2qN~e6%AX*57K|*YuCWnxkfF>!H_+FDVTa?PH02 zZE`XHHhM|^=!_RWBxYeJ67{uZ`?05O^9p;%djD6D8dMMG_HR@gM zNni>4%Zi+Pu~XFZx4^OQFi&XoSCRNx(AhGUx5?r$&!I>*uvj|4ZUkDa_DQ{wMe>|vN6N~7^ z2$iPB28$wV;=R#)D1E!1%IKw1wA2fgc)@tTQ3js^v+f73D_ljcr(3a(O5OeY?Nl>J z^FNC{pYHq^k~?u0Ng~EDHr!;!7efj^> zpj*QQ2Pbz->fF_t|3Gh>$LUJ6=cq_WU!v{%jt-v+&$CDNnVHxpQg+-hH`zJuT&nL& zHYn~!@_=cDq{^`qdj-*Ddr z+P%zuda!Y5hq5Pc_;Jf`$kA?J3;D6=tGS7Tr5%+!B)g_kji$dl4s)g|Da~*BookCp z-qsS2a~k%yBZ;n$BT1TEsJI@OmqbwaUcK_CG zywQdB!J793xNH?1FDAZuZ`8jrfxN)Xy~BLj{lnlL+}e6(`mL>pem{G4%f02$)1ic0 z@ga}EgruKAUP5Yd@>GX^qv`YUbxaF(Caj%B5A7roLbe`%e|a_bSgC z55MDtYe;@OoeZ>|K|cXTJqg|@>QT(^E7IvoZ=3Wnay#sCX&lOJv#~&tiv{Y#EOBjM zaR(dSVf5tUqkHDqw{Y)08TQ-x(0>zMf1eiRuUb8Y_naK`C?Sizj=A<6qqBwlc6-%g9E!DrJh@|EM?qU} zXX_!?jpBCe>Xvl>#Ww~{KW**rrkC2*C*2u1U5%ZFY1ru-hUaIuvHZ5(;p$?FDctu0 zdKs->c7Jyto~<}x?FM>W^{&9_A7Q1@$s*<0lfdcoR^$zBAHW{N1m-jLpr<7nv_h0M zLVO(J9Eh{_Hc^Tj`3>9`W^`Y8YvLZKFX>I^)}%hCZ_qZU$Jyj^Y)`@omeWuB2}z14 z>q$z71?2Vwx`RCnZ{sqN)ry>G<8|2zxqQY3Mm$omCZ6set$5Dgq0S`j7LC?q%~HrB#F6 z83!#!1E*j7V_5KuS;#+zjdsoG@@4h{zY3I7v2W6gkr6#25RVglZAAE|xE=Os# zD^$A5wZwH8oJPCL*F{{9elfc%rPSw5azhI2{3fB-_M?Oj6ss=tE_u;29)F1JO zT}#~MU2k+jpLxA*)Rt{c!vB&@s2g+m26wsxi^J^J5rM@Iu!!?%#GZ=Z5w<--(gOLE zp2WErXW8h}yThGDiKSeUgZ(JYiPDBaW0}meAv6&;uQ% zW0=_&g4pu}zm&w*L%d#~`g)FzEZDW^IxQwSZO)<6tC-y{XLs@bP4#Ix!0Qun&4(4} zMX#Wkh^v~{ko>;g{pAMj-+h_x%NSY08&yZ#Z~x6cXBz4cWwoWuFZJd3;pAi6U|PFk zKTYvM?GrfkNb?*x;-30Vg{H_%(_p{nV!*Ws3x zGvq(Va2f;8&b~E8@z@vt9(Jh7)@Jp6Pv*c0h<*C#vQHloZ_Sc;LdrgK%<9XMd9eqJ z9ner#NwylJz?bQJ-QYnhuO2b0*ez^*^Z+SSvi)S~P;r4mEmmV1dr-D>S;& zj2=4Uq7$Tj9r+zrYo+hdn#pDO;$DD<{0DgTZ?mnAL_@5_o`(PZ0#+ceVFmIzZU}X-goR;$(*4*e zFO_}eY%_KO7SkNEdYUIZfVIRn<~h-cl~X74oJ=xk{@%(4z~unAEHDxl4oxB+b8y#5 z@(AE8HO`;A8TqlA*~Y3$BCfMTvA%Q8v8+4pCpl|M9R2+%n2%F>H=pc|be;wETwX#| ziKDbX#g&A7DR!Q!k`QiKI{YV6j$@x|JNPz% z43!glP*Nz%nRLPYZsd0(e?0QXBfk^*ou`=31xZ}JtQe9k5R&-&21Q&M+*``;^n_1I z`36J2!JNPO6m8^}kQ1%%i|a*;e*oD|K{l)>PSEO`YT9eo^b0l${J#*K%AG?*pAZy@ zNjM=IVvlXw@!7RG(wP(&_!uqHGvDC;)ncQE+8;6uX+7kDe6q!fB35q?j(i9+`oR73 ztUGgF!tSI-xMwO15X75Vd>lIJ)YhMYO z0$9&F`a7`WxCyJ~r{Ph&z&+sCy2=*P+N|&cx+yjFtAw}8-b#1}a|)gs_8XDT*D%k` zYd>y{81gUdvvJ$b#rA>|7Uq>D_-hX4_0{y@%-y;@BK$a<9>G7nGre$PkF~RNZ+hWf z@ENVURKmA1UM_rKj4^L>q3cFykU43kkh*YWQB_HDX(+pNQ0UeBaYM}Q@Fa{Icl`d* z>tt(_KZW(FQ|bVF7^O+hsuE9PhI6;;@?ziM{^UUYKCHOTrr0YIF?t8O9YrwT0dINJtcli z{QPzAcI{sJ7S>z7ygdoN{5KOq{jY(?+u-pB(0{J+NHiR;Tx^718DoU{uQG_o{B>L6 z1rN{tQ)%DXy9c*H-o)zgk0cLvzV`m>>j4koEK6u#uzUxF+N_yc^x6x7hHue+t;C4vg;K1S&*u!}n zbbl~t-5d#jZuljB$%c4pu0>i}oa_J1sfZ8V9}t zcvTy;@+L0QUyR``!UOP+Q@uI(KDa^mP%sic@eSD*DNe%Rom_>rOEiUjPYzzaJNBI! z@<8lSXG@!7-J`LgGV2bD4cWJBY$*1%Hzu)Kh&33Jk*yvd#Ep`VyG|s&Y?&j ziu9qAaOW8}@H?--O=nMXGWJkvn7!W(AH_U>pdFNF9Jc?drbGrM8}{yDR7&EXoT_b= z++OfdC40gjB-07r#g?ZONZnvau4S;3ELF;$=-+BQ z$)@wThpU@9XJhJ01vN=9b(-+ov(# zGrgAg%yU0AfG2FWGwh*a1aD^p9R|kY+Bn~q$%(#gNeR9k2NGb>i+s-{bB1qmvM&t3E5tB z-vnoMO%pL%9pNVCz2(N? z4tIdz?lLeu=kq?+Wq$C)c_wc3qm|?e%;=d|y5BshyLY&8_?>B<``yNY_Q3l6EL0xP zS`SIzjPk;>z`8)v8$Emdax{IJ-g@X}c^@?OhdBRn<8+nEJj+kA>^u{1*l*r@x%V5! z%Z|6=jYxaEvG0C*{|Ht;{q1-!%y#rs<8bK24wihF?wa-d4Sc?~YzIAQAa0|g^jD{t zW&dyTl!`oR@1KMdGgm3j>{I(NuWm=HlFqmL1E-^(%SkS#TRJQOdtbO?Ao~IB5+uUU z+ethA-ly4@b7^nP1@CN|HTvwG@lmDcjol|9;Os9GsL;c-z$qr!G9ah1E zo<=9A-6#<-eE1!V_T-Z++0^G1lA@k{aNzcA1kX3vw8ojF@D?lQg?7UB)~Ni|XDedy z_m5Zj!}ql@y{`Y0veWD6Zijt8o}c4c(tfP>8re_z{0V=^d#Ev!C%%5<;17_pWZ=Cch)MPjD&-i~q7VGXH+lF7SO- z?DKzJdNsLXpucPX34nu2FF23eD7IAqUOVqR8@Yg?$H5#|@R>fS~mfxjv$GnNV zGrYd8{BGaHuDJ7Mqnh>K)uqei#asjG`FFOT-16p*;{(Tz9zFj0$$?X^=01>9?3}9C zFcDn#ZtC#c&(%5lagv=o$SGES@;R{mrd^kw6>N?9gqWV<%flW-KKv2y<~UD0a~?Pn z@?%EN`l+M!P^{AXAM8>~&m828INPqMB7euZ!_s%e)piwP;%uK0Zvb<8T;Z!~h|)U$ zuVS#B)*9B4Gstjc|I`t>Y!C~9GxE5^YV?s=ay=TkzwL?z)@n4CMIs#q9}7cDqbKAa z!2KND&T!DoSA%yhMv@M(1^oSD=byOnoa-s4>^GCj&es7w6TN-?J>X(d-4M!5ij$N^ zk6G6%)Vj%3+2g6KvyZ7QNvonrQs)(tGL$uNUnH^fYTRga%nYBzySr9z;Pu5b+MY!F z8SRehNPG1oB=xj*+YZWdBJEFa*3+`X`(|a&-8k1h|Ffw}r=6TudSehXiz8>?K3TTR zO;YwhLM?vOvNkwpx?Y*DdS=kdVi;Bq!?1D~hLuG+Ru&$tEIe3Qc(AhYU}fP!x(DeV zpZ7_uJpRwnhK|w)rgUDn_CV*PHay$dmD|ad9O!xZ1(F03A=re!PV&#Hc1 zNjxXoZnU*0#mg&6ACLS)w(|Vx-?~u#pqc;pjVcEzBl@6&#`Qf3bTf8l`2F_Pn=dqK z&S5uqTGU(`dZjI9ZL{F-gkISYJ1vp8NG*unrtC1*bHlKn8;14VFs$c>VLj);dd`FO zoCoVU57u*OSkI+lJ(uPfi}l{vLqqRGue95{_kL-^EbUcB+$Dp${9QAqDOO#kM%;6e zMx%#P?fz@0R}R8^C~+&9(%-lGx1HXEbfGtu{}Mlgr}d)of6As8`$k`4__9;j*wXQs zEBe_`f9s8*tQ5nS`7G<`@~puQ;M@tYttsctBGeNndb<3#9aJ^$Y5vC$^fBz=1yTpG z$YUc|Q-b62F1GKn-QmYrVfzZ)pec%*4T?c*(m=thJG;;hW3dbDn&EJjzGrEj_UKZa zQ85@TvQNkwk__92!0J3cg4OeKc0Im3{5ad~USZ5G!MMYYky*~#*kh?VU2SVILhUtw z?*mKxp&XYXv~({#i)4mpw$?wx3fJ6=`J1HQxt8kTxO@h?y?f_|9e8e9_MAdj7uy}K zH0+pAX2-DBgO04%hRLJsZmD%3(?*0SJ^L#pUCq!_o3|=|fcJ&5N(hS#} z@RE|R_hz|$xCk0a?7~gve^0v?w5cWG(mCPZ+Pc4hrn4?KdTv`|^c05gg`f3fM`6O= zBEFtS?;!hD`bcaYPsGVqDxN9)C~Tk9TxbM$UmQJxt7s>{+MA#=U_9Lb3-*xTJ~6ov zuk;L~=b@-IP3#`j47xxI-tUP%c-()R)qbK69#&(Z8S=|g`pwkbj?7|5uQNN+*>*MUOoyH>$quYfgzt$@ZWz1f zh#S+NM0d3==Jz15!o@llFzpib;6K*8#x&fdM~;ii7nakLzLD^@t37V-^}`aR9Wijn zH&#D6+iUb(!g=8Y2%Ky#eJP&yZCBUeUWoVlf5+wAk7&egv1Sju7t0nWo6`Nm*ztRx zQSE2?++27#o)aAmE0ybgE!e|snQR0;o=7KfbYG{3_q(;u$y?WMn;hxfcAe2P#m~?3 zT5y&J`Vej^%0Hk4kGqp5z&00LfUoEN{uIeK zF-X2}^D`Yc*c|bM^?hfX3*F_#9i<+A_w6K$P>tGhvAaW3qDG5xBdd#UAZGJ-hgi~- zpbeZyH*~CxgxmUXYyUp%!kO1z~4p%asI!oStqCYN-)ha#R zkiv zk>2t_eb<4f2B`hRr2%#l&ks0`oGmck*QKG}cy>3eFm5jQXB+R=;}(DF6ytE~q0sjJ z?A9|i^IH!+RxEFF>bWEC$|z}C(PC4X%jFwQyDY6Y==8j_J!+4m7AAR7_8F48YQAxZ z6&nXH@jq03?qX-j?(ow^fzx=_J*y+dbJA(_;>GQ`_wQHRldOMscO-sd3|~5o9+tjuXq8rIB@~5j#8WEfoNM*b%1C?DTk4#WQ>*52fBD_gYfQ1v zaj?3xPx7MgLu20Pkd_IzI}+aJo)b9syWsEBJ5v&h9Hr=kkXwwop)+E&IJIKde@Ei! zluq*NfUL}AWYb{G7u>2=@?vbCp z2k?SkdR8jbpT+1Vb4tnw-Q*7%(<8|&!F6LtaMg-PXY-**;%7hfBxOGyNx2qJjqf#T z7Un@!q!>Z@h2D zdD~Ng_1oZ&KZjk(X2S6=(vd z4R^mrts`Z^tx2?LtP)N{(Iph&eNIm7EIM(!8*e5H_4+S!JVj;FU57|Gd>OyLmm7|c zxccMQ7f+a9w$O1|$&g6A-yMgw_erb7+)kWP#~3|XKcgDiZ`|^@UQ1SHbIfJ0C1c)A z$;Iyrlv(>m%hS)5)14aZAye-zwrge_DqC1HyLjmvUFTaj>J$E-t8EoXO=A4X{>2GJ z(-+d%@=U^=w|2jKTKK3Xdu++mkHzLhYw#ao)Fj0mCH^V~kXZ|Tx%;g5OxX9?5{l+7ym|gGe*evQ`B*7D&C?0DM#63b z?{bSd-qJr-+m+@M`Fui75l*be(rq3498T9Cji3`Bs}ifvNi4Tct)&(22x2UK(&aBZ zcwz0ty3bDSv{GS2q0F|F z@qSCGQD7kjeF?&_!G zO+CZ$`G#|F>luf?%}nzltrgPXu9*4GqUj6AmGSl~o&MIiK6)3;IaD3l9&6RY5PHdM-oD~V7__eR zSW9EqdvBBkv3$-PX20i0u1Dy8!uZmN`v~Ti6Re;+554#Q*f(Wjj`oTCDH^FGvf|@( zZ_687#_eCInxUNM`)Sk@H()Ha4JBD*DfYMtVLnCA$C|SB%+nY*(~A;{!WcO}@lQW! z+a0@?#q1+rsy-3*Bz>oA!K-+KQ0FeZHK(`pI&03h-}bxa{84&G#C>BRqpBgSrX#64&XY=Gs9T&UOhLFL$<WJVbd!PmPV$0nu z(QTZ;UNUYajcWb+x4!Pfc_jU2n6JmpVzqbqjjHt&cjE)6ry7OrQ;RqG=`IP~D5bj= z!ls5Ucew-W2Qk>$%l!%D3p-8>!o5Ei%kJ}}+|D-5*pGL%;=Vn*0&g7m3>w5bf}X^2 z0xBV?SYA*|RM4CL~QcU!LDuH&kq?949Vk9fJx}4&YWk%5t$;frBJbYLO`g z|4%8Yv&CCwFKhVyA1!{8zSLnzw)&I4EsLqkU9xc ze}U&APT|Rq0X)xwn#2v@xrqa8T#?Va-w0*7zZW^{iu2{{yU*xJ^MCznPTjFDXv3TF zI`qCm=khPivOT%L;tklP+F;%=^0a4SW!;CBxD)rw@uYEgn3Z=8#a*OrY>WFu7d>^J z-JR&_@E6AS7X>~(i#7Lf7P=uDsqe0f+&>Aq|Au#)yP5IwbsGbVcd+xVJBHleca=k!-x2Q#^11e~EZE&rxOVpSu(Gi^bClC6?vA?Z}e8+>V4|oG1*U6%36} zy61(bKyfoJ(wT*rd3cTk2Rg4{1v5O1=K~7e^KhT*Bz~u@@Qxp{ech1~gukBW#7-e}hySln!c#?VdNMBIOsR*|T4*UoDTl{lFT?^=Egv;EQV62)p}ZwM@I zLe6P;28m8RxXz!#Z6LEIU#GqD@~_u!ce$#e3$>n#t`jEha`oBxx0Mp~ufP^s=a(C(iFu zPAQB15!Y2XL2%*(0s9dyyeRVFrv~5iEOn>)p6b8v{JY3d_IYn3n7wo{j8~b@l zc@ofkr~8%B{n;;1J9PBDpHL&H(wseUyG-I ztg|ZHn$mnJb=KQydmy)W7bcY(F8^_>ujM{~ckv#vDSA70r`%%HhPNoQbYb{f76B24HT~ewg6_;Lp8(CCs&g^#1HRiPk>Nl~O?Z)9k*IH)t37pR4Ppn*W zXZz7DukRQbc=hO!<9#O&pTbklq1=8)KHd<58}Wzbo7Zt8Be%_glNa+%?6!vztCyGm zLG>Qh)9Nz3%g~lzoL1Ysu*brZ?fRiT?6mCgXGKd(PL`BT-8VIR+Qw<_8?&HE{j56i zj)(jsaYy2(AIQ^cSz1n!bG8R><$+yw3`_9DGspO{IsE>aTs24BBmUUsACEP!dd8hV zw+*cK_}H|!{E_Nt`;26%Z@shq$d^G+>z>;DaH_WxSdrg|=ZzBVDg z?IC}yHun`}muxI?PyKZMk_E>XOu41vYqWXwS$QsgL2bsJugwR}UO=1HO-WmuKRtWC zHosL>w>jJTh_1Eu#)P= ziX}BcZ*ybNTesAE{nQd~aAi}lwz0adHlO)xzb5gfyK0G^QJ$J$?XspSZ&tInvM$)@ z#gBSg$8GtfHo-E|8OTce8iNs-|G$81K@G>Y89B%c`VoRJ#iAii(=*O7Gn1-}a8rFZ7BZ zHEV3HZVKkJ62z_;pI^Y5YwxJ7gPL+EW(|Ng6*u>k-Y~4lFs;ClvDQAy^w+R@YPw?$&Rb5woZq7b1dC4NZ&eRCF9R6+aeN zT~T9~0=3m%*5s{&j#-(M!;Hl5&(+rio1orr2OE&9x-nRZsx~wSnws&Wvfc{tM&5>C zMdd0sw<_2Wq((q9RaVz7^H$d)KLM2$O%>-S*EKgStFw}Cs;ybY^+6mOo9pZA8mL?z zEq}5W?WQLc`-@A|7FP4lv2=%ui#DPDu_WjX^1*{2ZNu-Vpcg+{*vNk_i`u)nDY$5PMPn1XgK3M#7c8o;t8cDBA6(SbfPRmzyPSHenq6w3 zvTFIFKt)Xe-969{Y+@y4GbVd)^jaDU1}dwf2q0%oUG1_UjV;c7d3940DY+_$p^nHq zn}dzKarjRJdIQ0Rrs}2D0U8mIq4AFDdhhuuG_+Mp1s3DEqG4Gu&r5dXI{LQcqdIeT z_7GdNym1*7b$%&OA#d%dqNGsgr$`-988l|_Mb?CPpHB?l)*wgG74^;alf6r;YcY0Z zFa6r|82MSCB2X3dR>C;aKxk~LLr*k+$dGYG5@)V^%MbwYMm4%#DD@+u83?olaPc} zRB|I~*#ojB!el7po?&iKhIu2JcX`lzOV-L;$)Ys!naMI7TI$T02BHz88WIF6^O;bL zsNl>B@U`3ztB%x@IT@--dRSBoI&SkQrLndeV~OVNh8Q_2YU*nRDbI>(RANM$)uu$H zyyjXOD$8oC??(4hiek$vR^oR(E0!%sRTl{($Y?HZZp7dcmcyD%7AykAbnK-TB8P|jtt;Tka;KhLLo$Kfd*wCe zek;dK;#EP6d+8ZTe7?uXASTfdh z;~M3PK-yt3+miPU>lnDBv3a>YWkvfK)*K%lZ8E0mi~rg$+(&e@oUCyZR_4KV7(+F# zY!+mWGpy{YYwPRkYGzFwUjUp^3a^|Hl_GFTDVR9Pqycn? znp;UJpxm6gU;=0e8h@4K4G3{73noq+e-&FfVZxPim10eDW>Z->W=op1z4io&j^o7` zhgeKfnYb5|HM~SV%iHu=4m8*Bi8z`O={h=w`XsSJZK7BMm#l?V@S;}aLc&9YIW*&P zOdA2m5G@(39AnuMENjVYmASYRBE}lj!z}?Es>UkrZ%F&2<*9F2N|ra8k*t6@ZcWLF zJ$H#K<$%^SU>1FTZc=G|5Q0J)4E!kHk$e=zUR!R;_0)5{O;zYyJnQvy=2CWAdSa)iIyaHKWwtf3jZGw7okc4rj=O46082(OrNg}!f+`ZRa_mN!17a+>Z{&&# z4VY6UwRX*tiohL`)HX=}E(0%L=uJ#CatPPou_ze8ni;*JxdD@{cV_wY=}cEvj{kaE z%6J3Km>9;KpWI9ypY2pMj^W-DTHyL((qeTj8|77Igy>p{eTuAcSFTiNidZy(8qC&A z*>!;NTw2GwU6ydXmy)Y%QYeYdd>RmmvgXUNtzqR>39hfJUqxFu*e$7rVIt#iyXjNq z%9}QUZj$S4LP$T#<^}&%d%iW|y_P&i_|uhj%f;3Tr(J^GmOBW7Z-woR<~%P}^cGyb z!U8d?o3Q2T2^DBgupJ4eF-Xz(xZ}&67j*@S;RO>8=d=QLMlP=#`5;n^FPUa?Zpi4< z+=r#B$jB?XVH?r|2IEW@|9UE{Z2MsAB3|w@jK%5Tku2hq2J6-!^eZq zFns8Dx5wa^F;)93VapK0mv&t3d35ybX$h;=O>n;Z=kAMl z|7`O0BgS2xwEWXW!>+jL%*5r(XCLDXDbx*zLgYMhU zrXSC~=#ej6sp$>t7IZ$-TP5pl>VaJh1yNh1vBWsi73mB={YU!c_(gz8w`r_}nvIRX z2Zzc?7dYwKfe+e^r<4Bi$|!0Bj%NVIm0IG*acWayoW@S$TeLH^+c!*{+MWp0*g<@A zzPz7&!^AH^93Hu2#Z2_3O9A6Yc!3|}`~jX9D1leTOp!9{gj7$eF9p&G$xU@7eNdos zsn3$UR7cVs)lUzx`kka9{lyAY2X!0_HHq}`K>GcE97q{dS*jQYofrRFln+22yykx* zqt7?Eb{tNJ%b8#xzr$$&Hb_c=lyUQj=7Q3XK(g6>|vyt!sP0TmU?>jY5K&=>%OjOT?Pd+jJE`{b)} zQ9aVZ3Shvfzlz{s(djOp{<=&?4oU}`JE zDSt0u5d^>E5+(kZ3tl7>(O;9p_<7hw6OWcJp35`E$}jL~8a`RWrz?0gzeLV&o|P`} zNg95ehR;&)Xnun@za}eP;5#(@poTxD;X5^ai-Jd&m%_`V9wb5vtEVxAfM$Wc!L6dG z_8-FO^Em~53Eb{T0$;18->l*HX}H}#hG^vt<>lG-Lg04!L)rCNf*Fm_ILx-u{c|X* zy-ZE_X#71aw{mvH_|IR$-P!urj^Mgxmu-(-E+jJ*z+>MO^G-9JSB+mR-Mz>i22{Qdxa{T?`p zLHUz6Iwm~2{@>K<`%Sjbl&6T(dyRLX-;)^Aa=b?8AI0jU>O0)P57Dr1pgfwB zsJ!i{*rmY9carrf1uViSUj7`3vQe5oeJl<3VJz}Xee5yIOGO?7C8fbWOhr1)O_IMo z-hGcH%Vgvy{f~^35dt5ODAGT`d@=z39aJvO2gYUyugy@ zO7<6XekcP?92>;v=SS3Z=wk!)MLwczuQf{gGBos^NC%mfzFJ8qeZ8gOl~((T`utu? z|4hTDEA-{2JvhzF8_DGzrleDOlQcYA!`)~r5k&b7TKc~7We{79)a8b znZWJ-C~$lJ6}YW0z5H7=c@}E;ts1^a!xw9Kg@!ND@BpvxNUJ^pEj`H7CtK+Px5tyf zcWUV`YWO}4e_z3)$Kx_y-byQ7;I{q*-k_vM=dae}zn$}g$uon%?fFCCQ)Ds|IHuqz z`f(C9(`oJ#;dZUO8eX2=9|T??$?+~jvcGnH1a9*axZU3cK2ytY_rDsg{94X`l0`3Y zyS!R94gP=~>N&k#KSBShMIi7rYrYZqMh$;h!%u6tJ>QG`l^Xw%8hxII*K73l{4DrQ z(dh5d=*zV9HCnoDuLQq!TKX;xe?r4;dnod6)6$>U@CBMY&uMs{Mt@SnYc%?MG~6Cv zLLS@S5co$LzsI!v&uI7;8vXNH`l}l5*6{Z={B;Fi>a~~ysMq>)1MioUMqrmO?RN%HhByf8?Kc=8g9486YNvW&u>G& zqd;@Mf83+--@^IZ{c($yzKy5b_D|q;eYR=zJ6Pp#A)FIyv^e&Zmi`pyXX{(wxmJAy zUZ&syb8xtLeMa#1w*41D|EWSx{*gU@i1goU>4Tvk5kz{bh9A}NV;a6PE;@gSmj0B6 zw`=%I8oos1_Zuz!9Sx7u=+|lZ0R@lluf43?D`fBG?eh$858Geu)!Iv>PqWGw_$&<{ zE!Dw9`g&`9E^ynw5cr#xd;*`R@!O&0Kd#Z=rqSQ5;a_O@3JpicG=nJL-VYJ@&02bn zB2TnFcXItLmh70oZF?v1DlPq(hOf}@=QX@X!9T@dq59ETp|r<#e-`CsSoIaSE%Q#T zeV^m<@3Qy{+#Zht?^M#=*k8K_`oWfzRlYsn3;Ifhp2p)+1^*`&?o*Zg=_qUva5~pN z-(KxvVRX)UNLS~lBNo41Tz*@>0$;49+wzF?ElT=hnE!&{PiBkC&w+9Ju2P<@JIb_2 z)0e*IN@k9@1Y2|Pz;X96$M@Oc_; z*I&^0Y3chk{O<}LEzbci4@5SDejfKCPq+Px7g;@sX@60kr&9el%Ir+g&rdN&)4?Fkg>rxYUEpVsAI)Ore@daJ{BJ4v0Vva_ zelee~lTlw0guHngzE;EcX!vy~Pt8A9!=KRb=QaF@hM(5(&lLO$A7lH04@QC1zR~^b zCEkA$topvho3=fr)l^S4X5)B5nf_r(gZZY zP2>M}T)v%FeFT4dJ{9;%Eq$YgZ_)7ID|oa%4)XFATk;%aw~S`2AM~RA#eD>OJ{0s# zQhX+Gdwvo4fR=9eUy(jiDeqP2|7S{h(efSE>|q~!gBB_XOYkvRrtvm4Gy>VgICg~B z=Vl&5Uwy0q{r#V~phRmBIo`La>1eM81>b}5^&05q`5Cq6S|$BKjIW1~ex<_iw37bg zL5$su^sAI~+de`b@cT@mUuMFj?>P3VwKpj6*EqfHfA+Eeriq&ZbZD>)K0g0$=~M8x z{Y!z{<6GdTG$egi$vk*a#1+VT_TA5ITB^R(8|O6yui%nFK{%W83b`)<#_g8!ei{KqvsSK&wXx9fC9fhp6kdHvQ~^a6iQ!;fir zr&XSyKdGdT_TfH|lQA0OQvU0dbdu*v4Y%tj_}TNRz-@m-;P!d{uURSPcf8(+-)WTP ztq`+t`S$$*fn%bJN>9@8;TpbJ!FQv* zm!N#P-uwxSPXzcVa3uNcwxc4>veQ`a?m@b`{#;^~PU%0-6v%JzFOGf4&YAd3)G3Y) z<>Tvah5ifE7z_G8GA~Vp2!ehHr?>Yr&a#o9zZHec^#ir%^CAnr&+`6s)Y9KsRtkFj zFl*F$#=Z|C=o2h`2>cNx{~okg1mz`zJL%)C(Tx27xUd%9Y^4{*6&AbITjA!pgG zum^PK1teB~tX0Z;81=mgi8Kew{?n$U{}T=I3ev%Xr@sRFmw~_~;&?UM@25zY`ybKm zCH!A|J{NeV#b4mGRu)0v2PJCy&j&R8MFk&;^3z}}pcYGhyT1v3wm&3r+rJX{MoZtn zW7$w_1Nh1H=T5ZWgTTp6BmMjW`g}~mXG8x_16TETn^M33K!2W~@T2xgQ_{zwKhH)w z)Xe$cf%e`HT!;6&iNS+-UzDC10YxtWA{!Pf6g26z~R7iRGgA0njDwXn6(cYs$KU|@o zuB4MZ&uF;Q&6(j#=>Huh-HrZwCHQ$2e&aOyJOz&)pMT)?iewQ%;OO#E_@xqMBAslH z2!GJ#(?7C%VIMM5qw8n;AAjWK+5U#WZF~Gjwh{XI6!t{UPYY1kAn-#J*Kf4^AF@X1 z{~aW%`n1dYP%BU1c6lFa^8cCB+w~LpHL|));IlN`u8*1DvL^yxpwXiuW)SJWm#E2~ z`o9Q&W`Dr=i9>r|gb3Nc-jc~Cy?x#x_}S~jKeO?$AES|9>XZ7{1k3&i`r%4>ly2KY zk^WmHJq7Y)fM0?sPjq{HqUl@UcK;Fh8cTkG+xGtx_5|$P)!(`S)q~It^d1;6Fuwy9@j>5GVEfypm4(XxH#g4SzzzH){B14L`2oZ)*5t zt9|~$9zK1{=H|4ih!_pbzQpLhL*9mr(teMR59&@fK| zA7#oD-9G2I{>NGMImg~afBBn|pY(Z3Nhf@@hTHlP{OtBP$3~(*XTzSUWbQ0R5Gr@zwg)Yvql$`isavQ%k>6!|n4lLH}1RJ=vPyMEW~g`UgsRFGGKeA>Wl; zA7X#;H1sKg$WQz2Dn3u+pP;3eD(SajyuS_ps{inWk{-^)`cBi&1SOr?XQ_tYuHbWF zZ+?ROBO#z1|F_3S%lno>-wJ#20qBv8O&GzFtYE z@-j4ioYK;hwDdI^K3Ks&&0_33D39g@()aI1G4==wN3>Obi9&xI>92r3TS;H4q>qGr zA0l1m??A&`2l>?b;R%JF>a$J5dlfv|p8btQ(Eq*-eqN>gn*odPH?|M`p;1YX&i^^P z8~q`Ibk(1oBD1s4xxHMX;ae2^@yi(dA@ZyJ^S4U+W!YGdAzjv=>i4mdz8(GJ_ehuJ zN6YsQ_Fw22|3o^L1eX3Ato;9AzefL{_EXn42b6Rw@1TbFY4~9Uj|abz;8%b+Io>8) z_V6EEAColvBMqOT;r4l$$ZxNo1#a($2;5#D3f#8O|6uo_y(=M~)c2EU-xlCfKTYUg zGl5HgGg_ZtvLM>~VTGRbv&5?Zm%M(DX!zeX+}4+%|BaTOYSmw)+xtgfvNe~9{;l@^ zr5b&YhTHoUg5OCk-9BFs>2GQ2cKdwE(y|$QL8*VVe!gPs(I0<`^kURWwtu@-zpuD{ z@-6-Xe@00^ivDv+g54gZ-}jXCPeBEa~RcRPaq%EWYyo^4{`AFnq+qTY!TJ(J`L}+niY<`xlgd zkCxx=FCu@vlAo8S;kg=a`x_2pRu0w+C{NmR%D+pax5uL>?|mixEEKT^`A3=hh}M_O z_!5Tg1k%;>?+sRcTwFi9H2h(UzevAbOSk=Jkv>|ZpQ7N;$HAVWd~`djy^d-8eyic1 zD)@KN8PXE%`8B$J@m&5R7QMg+H2eb%U!mcPHGH}yzu;&0cY)jXTi|y868Li(zx5j4 ztKs(gQ{=x?E8p%v@x~FPjfOtd_O!=mytdv;qIjN~`g56<{=Sx;s-@>>xNTnrznismd;E&@0VO@Uequj5 z*D7D&<22l>;IBbZ&%r>YB2L=dE0y&BME~qj(mzB;KL}j4A5SRsq>qCd-lO0{k^f!f zm;2H8VZQt;a5*2Xf$)jguaWadb=Ux@bnCvaK+ z6=?s9L41*!z8Uh4SMYeqHx)Qc9OoYo`DO!`^5y2De!vHr=_AH4b_Z~||34J+-3J^~ zI?ule@`Zs*{k;VF9s@4RzXtN{0WS435Aq!ZF7EANXY8qJ1-se*vGV;L+u0Y4TiV%p*g9;Ke5m5`RpE zA)Ll14O+X77@L9Q3Q@;41L4<71pf&yH2KX1oQ75yV&Y3Up2*Ohc{s}PLF^Km=n<~N zCkA(107*AK4}=mCp39i6OkDReAY~#1UL<& zW*a%G2&9HIScOS6Fc64s8g|KpCVwx-N3cC)C=fowCk<9LWVY`*j*nvZQ$r%O)BoA_!0a{_}ya4A#gvt)@(mPU&@}0 z;&%gEXyzB`WvtfhuL7US@<{Org5NZ@81l4eUN`Jb=s!R8_e)UqLY5veayrM?{pqBualP z*tJpmzl&v??IZfjO7=_?zKY#o+AooQH!C*n-8Np{ciGFPzC``+Wj`|MMSbsM-!t_k z(py-mSwErwR<OdO5i{-X3I|P5Z#xhOOs! zHHbp!?_svlY#$oNX>0@gm8nmnp**#wKIZZCjqGK!e(fB8gl#bKPL6M8@~)VeFCSyQ zX8rEw=})j@CO@E@|2t;7kiUoBXpSEt-xii*(u?_e8!Iy974_M{#(RmA*pE%ao9cc^ zj<*>&4J~XG{CN|nGqyB5Uv(CCUk0LomlSOV!nvVP@UX@&py3^6f2J&yKi+I_iC?YJ zU##ILP5W~Y8PeEuti#NIoa4J#hB;o3aeNQ^lQICQyxH3Ld{Dzb)b#VDmi}|_kb(G( zH1&NA+9eIouRLPfd!nKA6fZ&8W5PH|!}AHtO@2$beh;#EbNmqv(SP66FI6jz9cFi# z{h8kRlZN~8BTZb=pQMgp2Fm}u*`Fzj@P02rA`t$l=1;w1%Ciw^X>5QkHtoY?j=#=| zwDx)4tRGD)Y3wMQZt^3uk%s%#@n$;xOJi@a;bywPkFzv$J{rfCdu5n*JZ7iOvkvJ}*cF{|Wz&Y40eS z@ItNqkC^FsNK3>0oj8+U887e8>^aR}dR4>MX!XmahB5<{_oP{$R{^K7PuNmZKhrt? zzp!JbJ)$f`|Dc&p<)*Q7>@H3I=QaIjn&VmKe^%4~L34gy1A;X6H}-*9KiY##!};1c z(>~H3dm8%(bC|f~H_ycB&SV<jRh1Tl6u=l>P^m8p*$#HBIA7y&*M zrf_}^<7E@y$mv}MJ-bg~CCB59u!#>K4)6apO0@cYpy|IxYagm^s@VoK#w1MBP^#H? zy@2H%uuQ=6JeS}?d?=9oBTU`|%XsQH84378AXvta13bcvCs@W`2iVgj8l7MnUkW(G zv}FX#_-TMgnDGS5_=SKy&4LfXGX8eJsY&=kSb>jcg`go=(zF2{YmU2iz_PvsOPWr= zvc3e%_;o~Y_9230{KG_V#uF^#p8zcDOR$W83b2%+7qFCpU`ewRu#|yd8NZ9@&3;I* zjNeD}W<0?%z7MdJfnXU=T{G33|7n=z(EvmkjgN#g2{y+NwY!81088BxEO{0I9-D?Q zgfe_2O#D;Lu|PZ}oDVq9v}qFv9*!@BN%-WMeVzJ=go&ptmta}$V!&ff{)36;ZYRFQ zxwNFYl;X|)K(LG_`SVOWGMQ+;EAkR7X-bI3v^~^6J@*J2wXfbx@%M^&f@R*tfF=K> zM01~@Az0Eh03K`3r7MY^6o$}(kCcaCNl$%J%CmuJ%z6Ec3nuIFFQMhCHtTlJL(n%7!I9HJhv#!7|>f#1kyzCs2HgD3@RvPhF7SIZ0s{ zKAu)VL$IWw{+XJIF9fnVW3xEOh)-U&fUm?qnU`Rhw}j%&atW64vnbwd7lLIxwPW68 z_(E8Wk8BHqB~1JIS2WAID;yOkc^My zL;4wE#uF^#Nk3!9;tPTFpFsl)L2V1_z9Ydz zd1(xeFyjf9@s!sSqHp2)|GRj~n{fpvXDXjGM2#@x36^|#-?&Q9Q&-3{VN$V&1~dY} zl713kDG$Liz6h`^mtYxR0$7$yu#BGxIOA%3ArLI%=KvmI#uF^#D*=za244td2lB4v zAl?{f%So`LCz~MUBv{6;1}xZ9~|Vcq}hn55oSEW zGX5#RavmXA#vcKkQG_o9f@S;w;1NamLLgYie*{?aAy~#!uSlJOFN7p~GOp*~`Tfd_ zAB<#~_adUF20Q%tV1yY@u#Bg!oN)ub5D1p>R{|bk z#uF^#scAFH@P$CIj4uK_!i*V}_ zQU-!0&Fz3wZ^9Qs0zRoUP!N*w$@n%0&$oeQd@7P9pJ9N<&K2~-@h_v?h9wQRfo8mF z1Kl9?bPAmlEa@*4UjUlC1%f}x;8`c~s`AkE=`lAf36?zbDSo}6Cs@Xlo;?qVcva^m zh|gPyF9d2@&%=U-V40VyEoq2U%0sZEAw5fZ2$u18Q@kk;!7_dg#hdaFEaTS$&bt*~ z2)+17c?gy?gDHN4kdt5;PdfK>i+F-%e6|u#u#6`?OPL9l@uU+OPq2*V?PZor@V|>s z15N4@d?AoLsR0i1@g?CLO1r??NBZY^ppj*foT-(956vkVK^vAdlMyw-j3-#eQ(eX` z74+1;smlaR?JMQE8L*UxV40WNTFRrg`(mQ6!WY6~d?Y=IIKqr4SjN`^9$SqsgnE2r zSp-X(Ccv^Rf@SQ$+GJ`6Fp!Uz5z(<(z1WWqo0ZaWK0Gv^WF9d=m%}ansnDGS5_*Vf- zy&VOdN(w_bj*pa?U`c-xu#}l#8GnlC@5C1Z!7~0mz$46ff@S;%fTa!zmhpcFEOqz= zU?~H^lICB4r3?hicsei3Xg~x4!7`qnjTm9Z6D;HDTtdn~u#6uKIImIgp?gmfrh7f9 zW<2ekNw`RX>E4)>nPAD2?psNj36}A6uPuW*BLcxPeiqT2@dV5G1%SuiA?R-hEPZ=| zB~26Hykvw`C85;O$M_$L78(Lh1i0$8@!Qv|OP z@jC%aJrFGO?gA|JK(LJ8NA!1#yadbm14M7e6D;HV0L!)`SjN9e@#dO{U>Sc}i6>ab zr=rL_8r%qJ_;}0*BMFu?mjcea7hecoeB?TvU`a!^H19rqA&kSv^Qh1#!II`0zvRw$4G;;yxwcrb3AwH6ZU`azJCa)D=2-Jj3yaY@7 z45ByV36}9WfIa3zJp{{mvLR#J1)l=IQU-!0%_P8527+b$WTL-c zKMk-PBLvI%c@%Gs5rSp>QYD^X8NWh_Cs@YQxK8a5^1MzoKM*=6SklmQ>ZzTA<|Dv) zYX$r%#Xlh6e*%_$m|&UL83%gmya;ZBy97+n`ejf@Mj%+y4+cEKj3-#eUkW&Ny`ZN% z9eEE6xPamx5->fVDC6lIA@xBKzXb5uh=5m8{00Hvr@-xi^UQcUBT1#fgs_cZv#p;2 zJhofJ?~&yEaPtmoVNvE z2)E%QX$Y1yT+ilwt?C)wfqAwFISH2Z2^4RRS%PIe)g^Baz7U4tBjHOGI9q|o0Z!eE zFNDeXj5YI40i3#zV#U6?XOECUtryK}p1mTTU@1c-;Jp3#La4$=+DU>XO$}gaCkdAE z^+f+Xz7PnO@lAk7nDGS5_!hv@PX1r+-UiO9vRwb)!@Te!*pdxMd&oxKLRx#yY#0!Y zJm8r@BsAh6sgc7lGYB-mGz^3uGGKs&z)+B5MjkRWB=eA>naBJg2aJq3W@_f~7@3-x z8JU`y+5fuM{akB3v)LOvo%8$rKcC;y+55}2u5~~6^Rk}xthMKbES+Ogb&0N(S6H6@ zwelu-)IPn)_u&OwUwj3QGagrg)9xFH$SP|DIQ%!fU}JkK&RCD5@#A8$ZRKHB>3w*? zMpn$;;BY@xd#0+nWdQyyPt>RX9$BJiO5p)xj@$5{F>}a1WPCRD?-`$iH;qHGVzPh3 zL*|)=HywMi#}#1ZOxCf?Kl~A1utn|ZIKaQ9Gk z$LLO_Cg3Y@Jk{eFV6_!lxy=TLkK+Z~0(|M2Ia!|N;NS_oU|WMP@kX#>lI6bv9R36^ z*lxy`Vv^;#9ju)9db|%DK8Y7>>>hnaK-RI3Qg`zSS^5j$(AE7#&qJ1nV>o;YFW3g* zD{wp*EPVv|KkZ8bUIl&bI87G{&9ETemhQGeU`O6q?$UP1jY#_OoNa(NzQOR!+Xww+vRd^5S+_#Uz= z_g-+=!}R^sdm2CHd7hxBx9LZz_c4B!`g@Go#93EgHgR~0>2Ff!O#?PoDePxlhPP~g zV?KWf`NtNq1=I%`^WH&uM)wF#pG4i&mp@}AUO;yFuk`pvva9bs9&^2|vRHPB>r;;2 zlHXCWbEkwiN!WVhtHkvk$C9|8$2^ZpTn-%P@>G#syAAbpj(K@Pk83=x^_b&L{_$kj z*AvM2j~mBc32*YSaqP)I)#GU%&+zzSk7s#2oBR%5uyL%G{3*g{9a6%ZMQpA3Qdu0g z;tr3Ole?RL1(_X=Z6&@+PBLCYcI|w%#~VG~?D1BQZ}50K*^QYUp1zap#@;SZzun_K z9`E(|UXSnhcpurFUkAt>;Mfk4Il!?UCJ!)vg#0E|TVt1`O&^SZr+-iu>1540HJ(nE z&N(N2*!*PalfYr6#pIkL4_Tg>^b9f&` a<(cd0Wa-hI^FBLvfaf90Gt|?`(nnE0 zVmXtgb3PB>Z!ypHJY;#M&{JieY4o_ZBFl5Br<0{~9A;0qV*_x=hY;BM;Y;6RK$f5F zADm&H5S$%pTni3AXgm(AW63(Uj{1N1`x8QoIh)72H2_<frg!h%B~td}$3pmM7{L zm*+Lml{5P#5H5 zbh2%X^PkK(j;qKYH+?ub!wV)hvSM-!R65-s4;;_oCFbWC2pmVbIX_u(qTHPB z=f-m|bU7?woJ%cc8(8^}6^G}k@*zuK0S-Q4$42Aflg0y~D-K!yL14upOK07~%k0=_ z%sb}%sW|>zdaf6TtT&I>Y#jAti*ax0>6h(XBdacKxAbpJ_uH@vdU&}V%XUlu);#|BsfHfRGY`*^V180= z;ErW`W*xH)#dTmk#~>@8$zVOlAWP?X%W$EGjVyf{xYFrl>6d}^9D^(!m`eZJ>O%JQ zaG}NLUNO(9aIxv^3vtvJP9N;)Jdc7l^YeO~ z!}Qb0OO07>cA0V17mlO(>NBR36(^dnobJz8>?2)M$nvxOgXI>djeLdia`KhNE6M+4 zybG*2WW~AP)5+3b28S!`*kj=AXN}*WewFc?U|qAwIySnG_?&roi<0HS9~*Bof>p-6 zjD?PQ=~8ZF#o^^4SdABK?6$DenAMh_EdTA`V2ye9k=Gg@##`3$lhoIl{w#Hu+e_f^ zYSZ7qTkv_~ZrzeNGr%gBta4|A!}aEmo~3Uv-sAbn@<-3WT|TezSjTU9ezN@C_}trh zIL^}>Ek0SEXv}Xio#Rl?Y{~LO^Ya%IPq5iIgeSPpIJ%~6F}~2#XL-B^taczP{tcc^ zmVN}R_#9WkR*U}{`Fi7bz*=9Cb!;!}4z`(xw>0|RV6r@?QFq@POqM zy3H+QdB#(B&z;E9Cxf%DO*jt4)4{Qy(|O6sxbv5+IJ_iOI-M+?(_;D!%ZDtz z9UR_>7i>I@RW66M+VC-tpYr%6u=<6pn6J{a9WU74#G7KiL%!B@eh#Jh{On0w0}gL8 z4}bT$`iQLf{CNxY(G+^z_e+!I;W?t18$I4dc4L6&Nca^iYcE)3krihjJ#IYk^Cp!= zmgf<0*2Q@WtoS^q!hf;&DV$T%qtBb%+TQ=XsV_V#D+5+pWR+FRIBuNG@^}&XOIFq{ zaQ4f_(KYL<#ylTG$6O1E2ZIBrj{v9Nv~faKxiy}j*R0@Xi&^I}*Fxz(+OcFEI~}aD zX43PPdC2lyM$gwQ<|6V=<-|1xOJHg63!+{wv|hkK7f9wlcf&@t6Z}5YU-cC3pTR!ap3S?i+?US_>S=uk7ttaGo5{! z{Ws$_aJr-%uU$VgU5hS^E88wK-XO01mnM#n#W`LEzv))7eMC ze&ZT?{@r*ySl1e|Vosv}fO&X-r}ihyGXoqRG|$Cg)txNQEU@ZMmOdM-_9shk2CMza z(p$mVhpeo2aPU3j71UkbSAx_01uu<|6!vl*;B$` z?4s_DB}?B64xg}N@AW)ndG^!u6Z3F9D-Kzn$EbI=oXOIkq29xEvhwF>WSe}EK|FUEK^Kk_IPAAJh3Y>k${A0o4&y2@`RW4cn@nDrpmOcTTIcmp} zrPqNgolcg{F|2Z@gTtTOu`@ls44gj6`iQJ!IiAC3%|8#UJjwF#d{>@i>237?!j2_N z@1Wo5Wa(FdmFG&Z$|B3N2CTBk(ys<*p0l#Z(l^rYbh7jt!J1ph(jNeaFIb#?VC6uT z=Kxqakfk32XMSnNlBFM}-|1xOPk>e5qu}60JC^58@GIk2!66?EV0#T;%7?5tZ-SK% zS^C@bzih{nrSn{?bh>}u^@6T^c;2Zj{~YA~j>_`yefrV=8@ym6t1R9VRXUw4eK1&M z4F#(#vOFWeDvK;Vr2iGXU?WSf0arSmEIqo1a_8MS(8FKj1zR2Yx5kt3rX0vRb_!TI zkfmQp|1rE^BTJtSu5>zCdi31MunqRO792SJ9FM1X9L@R8GXuKnMOOTa!KxQo`YifOtX#76+2Bg2lcl$V zRWGvi72tpm=CN@tmv#9>^R^rR$IaVL_vh_xI9AVK$%=myIOO2Pb}POV|4y*l=Q)pG z1?!nSS#jP1hvgQBbEBTg=g*VrK6b6_1&@v$N5A_%WU}-L;IPzUP6h|vji-b4I}OP4 z&jjmt8jz*W24{QNv7AHnI}OP4a6ZxRG$2cF18e-O1glMUfYUuKCRzU7p8p=tf7s(E zz&dxxI+mxL;`3)KK4{0bo&Mg&JHS~Ne>ZiP59gos$u>5~igN@U zzQ>Mzl%6l+rvdGf!@cd-y_fo&o z`kE|#zvm}Q=lW3b^Vf>X=Lye$6daz~4X^mSWB5{8WW{`$x@!lr^f$rbKs)wrdfe}p zAnQ^qJsnmHDId!o~N`i@ETGr<;f8MP_iqiqi_c(&=RBycbh^o-fLuEYC`CIK*PE z24{vQEYCXVl};y1-vCzp>%fXnmWSt5ILu;h2WN&SEYA+;l};y1-w95iVsk86`itOj zgvH?)&YY33JSmKUN~e>hmw_`Q%}bpZ5a62Q7|W-xHRH*YwKJ zbh7l>U|lQ8(pOM_xC}MI-!As_HQ?|A7Uu?VkTu>;-7&A@LAB|3fYW`g-N=gn063F& z*DO!p53Y1NS^gv7pvGeIx*z0>-vDP_K3wt!e`h)`nVEhTpR72%zo>LNSvrT5;tW8Y z!_g414Z>HZHevazpjSGbEPW_A;D_GWc+LjnjO)PZ{+16}ex8HDndX@T4#ybtdaCb_ zCCi`jbh7l};BdSh8`9(EAF@2-sJl6tEPX0C{IDI%d~_^Xo@h>R$NF;u&+CvkWY{|J zrTAnWdlfkRd-GgFkIRiLPgGy`i#+}MMtw2Sj%8n@orkPrxi_dY4`0K{#ueoAjTtlK zHyU7zVt&M!Z5Ui&%)Se!8uK;ys4?T{=X1#_m(Kw8^SNZ{EGs+Bj_nK9v1ECegN`Lj zXT8Gdb}aie_?U6Er`Lef@3XN)*0FR3GtB=t<$RGH`#0tMaXU83d8RR6gG-G6rhG27 zWB;anX4$bLn8PQGc`k&XH0JmZFEi$AFx&WV%Cpgq{hRV^vSXt>=NR)fXfghq@|kPL z{!RJJvty%tE;sJSd=?l-^V_G4M?%lECaiJDv0CYLvh=aw>_YR8_xN0JdZ>+OviwuP z;Ue?TqJOdR9B|NPJQtk#biz7z0rX0zlcg^LXWPxsxhu0IVR<-rRXW|D$5ud353@YU z@~;7h9Ttb@aU6?y<4mvQFpu8(d*})IL`l^V*@`O+i*!b=2MOi6Tp% zPTl>UD6;fR!QnqyOtw|}1C~Eo9=3@*tZ&-=@zeaehbt`3N_e!cCMyoxLF;O=^sB*{ z&)TtM=^N>HI$8QQaP}(m-w0MakmcD)-L(T*`kmBWJCLQ{2UZ;)qQ|uZS)L>Ge9p>! zj2`#<#K`g-qwd;=Ed5PzxXO-w8?5#r%M+~wyF=iHwTkp;9q8KOxOJe@{dM3#9IMYg z$%<12&aSi^c)ycfZOnTX>8GLSV2$aV55+v!w6-KGCdX2+*8FokZY8fX{TlMs#(Tl( zkv7K2inAZAHX%!A`)kbjeQ}un^%j#X|0DD}oh{iEWKrGAb1$5H>h@py3di^dbcY9F%lLzd3< zyxPZqUUxD5n=K|;{#o=poh*GeSnWfW&S!MNwH9YJ+2y32F=`ab$y4rJ*E=yy6<`Vp{ldjuS8vpgT8{?Ep|uTjoq9m|iIl`~oTGxWRM z$kLys-|1xOFVOFDBTIjYey5YAzX{fuAxr0@$@B;994AZXtxoV|s|#;MR2Q;56Tqqq zSvr^RneBMNMwZT{e5KRL(z(P`Ze;0P(q(VJ3pOt4Lf5ujE@W>sotJ;*M%J;sY%4di zbY7A(U%?ADvUFaeDxFT2&gnzBk)_`R&VC6m*aqTDIgsVynn5{`rB{J7|6<3Ir4I#H zI-M+i6j(WsrPqOj9TsOYSf2%u<(UfBX8~mC)9C-I9ZQxzgMO!zrC&_{&E_XdpGCjZ z$2$L6cKUBIKUw-R`khXez7-ta zYW{6t^&MFru20l={#xZG`oC_+lI6ddey5YA?*Xgt$kGo{ci%Hlmj0BdlcgW?bh30_ z`*aUZmR`g2y{F|#mOc&~-e&rEu1Rey5YA-vid?m}Kd^j%4;&9RHef2zsT{$@25_vh26a{}fn#O_t|bu5aF{-h|}|AXPe@EPVtxyxaUC z-jqLCo*J<7CrhuT{~o+xBTMHstJ3LY=~KWO17zvb!I^L41shrVOmL;s$Wa*spG?vKH*;N`3Wa;;Tv%BzujdQi;8Gqhx zh91y}trcI{e=}|a>oaJwVlD@V_nT)WJ>M(CYbv!8U-E1O2j4Xh=hE;2W6q!1|6{xz zthOTS*d1WC6Pn~k^LF5!Yh?L(Z=!zmKj*52o_WaP zljY|;U+HwR^r>KtC9?EZ>h5|(mfiu*e9z*Or7s6pI-M;28nEJ%rEddg4p|(sbk4n% zPWR{GJE4c)H$Uf3wYfi+-p6CzJvdo0AE4jO17zv@>32F=`lDc-*JSBWfpuOS1uF-# zJkNoZ16lfu^gnF*lcm2*zthRm-vDQSV1CZAD$Ad5Q`oJt$U3$RoH=aAlBM?mS2~?6 zeE?YVIa&H_>hAYHkfkpGD<87-MPTJamflYP5AlMHEPWZc(&=RBSA&%gS$Z^2?uCHu zxOvj){ye#haopc9A}h`waOQ}`Axme7N~e>h9|9{5S^6X3%zxko8(I2e;7X^HrN0PP z9J2J+zySkb>%s5M_>u8&u-cg{|46XfnJm4U{vX@1Wa*>mcRE>m9a!y5mOdREFmY@% z$&VXH-vjf6@m0{XKQWHJ*Tp@TJMMd3o;1%*@ax$fS!LY{4u5JMe&37gOP1#jue zekc7;*|B8l_t5Wjvh;o6?0=e{-wzW!ZTtdtR~LS7jB+6B*q6b|fh?VWH!$;G7KbeT zHTs=Smd@|xQ=9wW*LO1X?9VJtUwX234^GyxBf-H@^VE=kZafa0eb$(N=P>&V<7r^c z;bg^`xt2X=b?Pa(vQ*a$|XyGjee(-rN0AKKK#*$^xs+gkmcdunhRgDeE1Q# z@*&H^k5`osS^6OQe{IK-rB~7Kbh30l0#-iks_dh7Y#lgw*?5YlPX#L#C4t9{7wbb!O(m}fay`HM0}fuXJnyBy1~1si^6vwOzctSRu$w?OdOvXX4Lf!KSkJY{@?^kzu0@tU6rBBo9m_cS?2IhWAh6n>EWHY>_9shc z%*-DxCRzFjaHZ49(#L{z{US@BKz*}~ZL;(Wsk^lSS^7+H_?DGBn;!R>9a)}vV0rj_ zPoK?^b;Hm zoF`ptb17Nla5*^aV;;7-&MC4yE5SOa$kNw1J3rdvQpl&0Yk);m@tG;}`6!f=z&h_*eDhnZMeEtT@ZS%9AYpO8QT=W69F5qTlIc z=^Mf6u{Jiy(zk+@!w!13mZ9}hDY87bd!C2E%9AY55wP+kOMeEOKGVu2OXu^Pz>SAq zn99Y0#~HBh*T_1y0{I2+wYm=khZ$qe3E4{H&GZa1-U`<56Cf+j4zTJ%mcA3Lx{#&s z0%zW5G0DGy&)HptTZfmJS9I_six$165EV3kXjJ{}xY zSsc!Lq2o)bpKkhP)CU_klZP131uJK=VlDtHXR`D~^bfUT$164zfYWE&IY^ey z=k4L&Ssc!dVU028y)b9YxlYXaEf{S&=PsR_WW{Wzf0TLVg0r>8chX;GIgsVQkNz>{ zc>t_-Aj=aymv+yw{pZpT(eHj&23da2OZpue{v7obbX}Xs@;?h!U+@{Vav;mYXVmHo zvh165efHfY-(tBWjQx2R1l>=FxeqiN5mOhaFGc5k8L={M5<_jW8<`c3pZoh_2^Qx8a5&NUVQ_G+aWp6VgYi?)l_yzoo&hUQvh-)^=R<33Wa%$}E1gc3 z{wi4QPnO;dV^Vqc0tYV7ejZnO%ymxYJS&&1I3vN8PA5yR0qf^L$72*1AGP=um`{Rf#$4AaPqO?cgOw*)dSCio zK4j?w=yy6-WIBT$co8Z9kmZx zI+yR6%kYAYEd4ZarPImMtHD~&kfrl-n{B`gwsCk<4rF71H1_Q=vXb!zO9 zrE{pMkI2&JPW{G zlcnziD}S=|N5H`(ykL6@Z<=$S1}h)3{71pchb;X$`rSE8mi{9BPA5x$6|8fapAV`m zvOI5sRTf$L+w{AbWa%kf22>VVdM~ib>J3&|WO)Lx$|6heN53nJEPWvTPA5wr4puvp zrH`fV#tB(^9awYeRB*sSglz`(CgWM2-t6i8yizgAipg(VQ60(B`D62{BUw6!W2V{4 zB1>OQzthRm`RC!a<{?YxkMRfYx^NS@#bWLThjWehfR!6r$L<9yH?nko?wPsVjwMUy z=bn{LCrjs#^{V~J(w_il=UJR5!ODRw&(mP#K$d=#{`qz+Svo%ht#mqB`m12&K$gxQ z6%H0y9DdH2{gg46u<3Jb4M3KE5;$x%&t$N2Cd)GwtenZxr_sOAjwMTI3nDjV%32aJb0gZ=mPz%|n)F8#q{Op6wp*1gB5K3pTR+w}TavpZBT0WO?of ztG;CE{7f*@W@VA3AE4jqWa*EB)kkFM{Jbx4_2TDl=^=Q*MwTa4fjmELW%2Vk^poj#I$8Q4u<|5J9|{g!4mIQ@7PHplabV>}*0JNk%8e|20{tBp zhb+C0ey5YAPX{YEvh>;D>{5%<3=WnVUjq&u-$?$9={v~Fjdzo;Fx~^sUTJ(MSal(* ztb4$!3t9So^#79`OP2ls{Z1!KKMYn~$kLw#Ykq!)?D9DZRz76;p93o&vh)|}Ut#%> zrN2zS)5+4`0xKV~^d5LFl5Mm&eZiXl$?}{A4nJ$2DzNe-%QFCv%$)fEd5+?_H!1e4y+u=@=OLR2eS03^slsI$C%fQNkEPXCm*P}MD zav;mo0agxV>C5R~WjTEB@GlBEx#-|1xOBf%<{ES>EZe8J*G?Y7Z4Y9B7pu;sUp+RbmDMev22?AUgX z`3z0^RUWSdtG;CAvj(jClBM%GeC8U9PnOPS@|8{}OTQ7U`jVyZ1_xiXID5gNWa$I=?4`rT09kr(#=*S6jVztxR^{f8;mlSmH-8LQ zI^7?`LlH;ik`=#(y8AtBWa$@z!|N^nbg*(G%QF+K+{n@|rGJ|pOP0=aywd4p=?lPG zqmresqs|*0Y-H)Tg2R8d_~? zWa*F4?{u>CXTWM_vh-KL!FG!?6#X84#kiJylkqrk_Fs&rfrA~!Gr{S9u(3*3Og;>tmOTUVKr<0}g*{S-@e~!8hdiHCU!%g5| zr}0ku-QR5?E6(lU(0TTNl`~nMy0 zv5$B$`P{YA>135v>>2FK@Th%W0js`b9s4R+^(9MxgZ{5u4rJ+X(eHG!bbcnKF-ex* z3u98{lBJ&vR=H&9ed)i=$|Xx5K)=(;(g%Z8E?N3H;BdFaITx%P$ns1AD+jXlDfGKJ zge;x&mF5<*bk08-pZ;7lmpX6Cv61Cp1P;GpxwV6p8(E%ZVC6=ZekJ|xvm~k}KWsPQEBL1IZt@+*_mThAcpo^s$9O+jIg=IhA+T~LOMjUDZ`rYA z=||{yI$3(LYwJt!=$?fv|J&48+8j=nJ^77g?Sf zu4r@$)9t{WRpH@7*OUw-MCc&!Lc|j{>V7 z$6|8*7^4tJc zK4j_J>Hj}=ELr*vaHZ49(szTE59h%22Fr&m59hsbpT*={r+o6~J>`=>?`0meWBqyW zQN*cqI$32s4OTwSft3$go|nPlev5ewtbEAwyarZ2Wa)3x@5&`hf17@%lciViJazrm zo9E^TJ2%Pl^aF?gZutxZD<85vgTTs%ES=vopx=u{mOhmJ&)T>mOXu9HYn(q1pF`b! zPdi!u3#q#~jVzt>r2J&*%fZwG6mp9T&NTbxTho(&FvX!<$ zem56cdN+(Qmfn|smnT{J0Q#Lymd@*)+IBElxsl}= z4pwet>71jK8(Dfa{Vq4M^ilM?9LUng((iP#^a)_)b}2Y?<8zM3bHU1)tYa5|l`~oT zBKlvlu|$^MPQTO1(pQ3YttU(8y-D^(i?fydD`TG5!OO;j$-gn?HCJ3qe#P`D9$!lS zt?3KMzcc2!9KLGYPW_nimE_+WuLSFN_>-0A)!^WD^K2vk!FUH)-I<@B9s#Q_$kHFB-;EQp^e5Wa(TFXx<=8 z=Xs}j!#@Y7aE!Tj=5=3n@z(&;psOxq#hgLE%b6_wV)~s((iP# z^h?2Nf3ozOsJrL$Wa$H_yZbV-^wYp$Nf};KsR{U!hb&Jub$2gJmOhU9W;>QFeF8Wv zHJx?TeLYzouD8{mWa)FLyYE9LOK$~-WfrrY9{2Y?$nvbCUf{EdZJth+ehvi8#Be%6~T&;6c>65`hFN?|ZDE(2(-#@3Cp{uQ0 z>2d8qR-6vc!}Yn^fh^Bz&$EsmR~A{GYdp_3dR$p#d2aGNT(_$%vOKqYp1t6J-<*hz zYxS^?@qVzz5?RMSO#eydc?6v8Zp^tNc#m;(PVpNXu~p$K(>Gzo84A79>1636z}d9< zd9H=07}tO^{Sua+*Wya2lck>x);UX-elA$^5?T5ru;wMQ^eOcBw{pqSFQnh;Wa+cO znwQAZ=Tdib1zCCrb$1SurLO>o1FYP2^thkdC(Cn<=h;e+d#*y3XFENoTAZ8danCo% z^6UevO~}#@fYl~s={(0X@3olz`F@ywr<3J>7ObDyCrdBG_{n4}4q18+aHZ49(lcPi zAxj@Y-OUeV={4X?rNt*puLV~+ohK#LQN^Y zNv&}$d5kgFT_t0U$CJ-Aod7|+=^0~&Xme$7Vj+W&e)v_#E(%P`3WyzBHix)LCEpEFawXkJj6W+|ly-kZ3e`z|POK&+lmIva@Uaj)r9|?epjANPlP3;ze_{S9;U@ws|e>$gAU1 zEmx%4mNYgrw=C&sUwlOa|9yM~q8L$)8y9u3%5ANU@D;ADndddMHMTb{Y-s9Oo*KHm znD_FQj)tbC?d>g#IvN&sEGd#Flmp zi-tvw3tKGD6GqK5`xT$tx^&6BhQ&)e+Loeqj~m}nk0;I2F@IqTyv2;s3G*(Vrk3^& z46{!+G&MG~&R^1{OTC_GX>DCh+ft0)V!htpvZQ5EbHlu@-okb0Xm4D!q-}9~M|_5} zur?k)x3QzK6&;Dhy6j}NTU#Q}{6*|(8oV=u0UFz)5IDCQSTTRM-^x50+FHHJ3pYL5xNR{CF4j1jL)o1j4Uw^F@xq0eIEo#? z3~W}!5LvRcHR-qIV`|P~1yR+-bLXS?np@^J7BtLXG(S1a&6<(s^{`)SWqBe`G|1*I zZeNI6c+s2ZIiX1CF6Ne|=6QB_5jQ&+6Hk5~?3tujx`bTV+%+Fs=eEwjd|pRGl<`93 zTBPryE5n?|=7o(-I9qANMGoE6mt2*jPDLDGKiLUU>vnH zH!N&i(h*(Yn%ccI*u+hZtxdS_bHLL;-zgxQ*e8|e@am{&J)8 zD;GP8wXm%Oxz_6D@o_^TFs^X*Mwl*=QS>w$D|4mO*Y7Ao?ckRG-3L>980go zSh03V8D|t~f%C1stL&Cv9gCw~)l+Gxo?0Ef6&_DI6Kv>mk%!f83yvymZ(D+8yUhR? z?KbmtO#v4ou6Gb28f|Q*B{-n5b^eu@t8gl_+E}49B1~bAQgR-3RdOMVmbN@xyOJgT z(zarmW3ItY9l^;e5{lF_xo&)>y|K+Zun8-4+|(>gLa~O4y{UCR*Y}u_yE?2}-`$ru z&}v-JzH21k_pY^xqE)vq)=a<-S<>|eE^oH2=7pqdU2LuIY8tII3k+t??Q`ZYj$6F# zQ@9*0YG__uz{?^VT3aq}Y`Ox|@1mB=7kA8W?7;L^v@^LH%eNLjpNhs~zuA50BAhPn z%xPZQ);hoG#ATymZip63kE^lRQaG)Jjmx=U;~ajXD6yqT6kMiaOOZ3S>jfk34_2Rf zwzo7bZg0k9(}q>+39^a$2n#XXZQ)KA&j1Saqr0BtJ_a*aK}Qtj-S%_DEkw=c%%xcpV_DBZs%tWBS~TPV;pjm=ooEoqq7 z+}?oMIWZRQH0S1Y{8zXaw_(P`^!l!0lgY(qHMCYs3)701=_hJsUWRbQ;)R9n98m6R zzPN2^EAO8Es<7T=vtd5&Jy`%^6=*|tb@W6-OPXTYx^ak$RhQxJm$Ve;X9EpIhE>$_ z@3tRTa?H<|Et*agifP9SHm=r-7Rp&Ds(%|SixzjZRG)X@MOl>4lvKoDrsI)Zk!C`l zE?HD)XH+ll@~(t)ac{I_p07m9b|)XdPQk^K4|$?YxtNKM^m3cqz#EN1d-x=&K-N)W z?TZTSVt4X_bvb9AHZ%qvKE#oeX`Ig;xaatUy>?~h#roVvFS`qCo4GA`QipRE^=rTl ztga9RqML=o)*2>N-P*crVFS)#Oz%Yt!}Tz3#K=~7hHsveRMl(VhB-^;rlNK5+!NFW z^_Uws6p~}rmSCcYH9Xqvi0;m>Y-wN29mURu=y`3lnl5T_E4w9)%Zi54$}Zo-KJ2nj zgOgVRCcUh&b!pM4G@&Lrm(-_02DeO!w%DGvhFVyJXvKVjf)1iJH@!Up+skv zlZ!OATVCOb*8I6#ixjQ6J^19KFB#Qt7+kDw#}#c!I#vtZ*v?(-W^sQnQY*fvsde$9 zqFKZphXUs$cTJyMJNH@-!|nhYOM@KFL6s!YMPh)WMM4XR7sXBWv-pS8e+`)+>df2VQJ%@K|Y!AeJ&vEsMR|N&;HoIKtBb`R9TaK@+EuwkH zx^zk7IE$PB7BFgIi>R98hSu*@zweGa#@`t|6px-(tg1IZ(W4wFlUBQpC~dr zHCkz)#ziU$$Z?j7v#+d3L?in#1Dp16)Xw`^(bKNo3e!BxDysd!Ab0`FV-jN0Adw>4hTy121u7CHj= z-GAKy$cmXZoG7T~#C#9W>Mr|+CasK9vvqNk-&hYb`@@+mPJkNSF~Z2 z&1+eN$~Q$1wsCBAQ{2b#1zI15*`wP65jjcVnFu}}jXvsVXqr>N6m^X1;XX@EoCX}m<#e{OBV=2QOej|yi@DJ;CX^c$iyq}-G3Q|{j;e_8Smx!PDvC^tG56UvQ>MUQf^nDa0eN7clbi?F5&-(37xZp%(j zrR=91?SLL%EJ>ZoZ)SEIe$*t|_%mbV3ioe*U$eh;bN`t3zT9J!z{l@?p5XTF zd@PmX_g|lZLYNQt@q4yk!Z%|3<<5Y16kpmD?|JzAc=sb-8Fn%re@agAvibR8KVxcB zyb*c%?ZXcVw!*}C{1udn*E28P)!08r!SJqlWqI+!pCs{mdhz%(JO~lD^Go>05&T=5 z;=LDwU*8)LZyLPJ?KO zK)hb?`SE7_G?h9AAM<;U7w_x+yT;?MDji!O-p%m&@#>zkzn8{%r+D$^eV}W+hY*k7 z%dbuKZGz8_cL?z`{?agWAKUN4!@9=fueT@^ZybDnyrW(`q#nmxfDZQCk3XJVC|(PE ze!MpkZ#?3#zNdQeYLKiSk3XiydT3L9KM0>6ul7Ha`f4n(z72W(%O8EIQZT$L-lci{ zI~DQxvnZp>2QnT`ojBh5y!`n000tL`w0@STk%XP^(0J;Hw5pBcP$3DpWjuOfD6@kBYb|m89%e%UB-AAnsK~y^UjYQhnf^5XS4no9LUEXJ$$;)Te^Z67RCSc(;4; zYQ1>(pi%w$UWj=7J5}0*--6Gt?*YW)-|k@hao$&cd-L*JhVx|r=1Ogf_pf>R1;514 zce!}uym&vvMbXc1BQ9#)D7a1W4#DT=SM@T+34F}&Y$>9c*Tebo1|lAsD&7>2 zzjDv_omRw$)254WXc6BZ^ZIRM5#Oi#b&Xd8U!nT)?{WG0on6FtCN84BudYbBU(Tz? zlp?;FdHGE%;+vPZewkUsHyq=`&u$lb-zOzp68m}Eb{`{jh zje}bF{BhO$m1JC90JFx`%UCS<`K?Agoa*tWcz?;O?*{k^&8Kg{=a)Ma<&HxEJU^y+ z<-RzeYq{f5iRp2v$@%sR`22XYew)mv^s64Pq4E8CT!VPrr%m;^ByZlh4!%O?Q7W%p zZYUCO4+`+xZf_D<0d`&#y18cZKS^BX8X~5Wc=F&}}MreO`Ve;X{|ln|y2X^1J$2Qr}O) zt^6{1`He%oLhUyNgVL`@T@hdZym@09e1*pIRmj1QcQJg0+NC_NUAX?JiffznM=EbU zz615Gfsg&sgm=~Vc{HkD?p3S@1-GgFj>5-dCOG{O#N+RUVZ0V-ig$BfybbvG8g~re z6z?l}@xoV=>(=F7yo*oon%~K&SD|)!4S6$d?du2MWESW)mHS)x{CYfwa+kxydT?B; z9^cNJ4`w0W90kL>;@z1yA58syGVWWwcwfk?#{-D>8WVP#;;nVe;cm_+t{U!;3d7=o)VW;;FA0R`Jfvn@=|v z@m1x`&)eXG6mN=mYo2dM5#PkT`@G#nd>_Ij>$l5Z_;$vnCiNH#pWiO8pGyYy*Sm=Ci+R_hzVJ8~> zA0NpZ&+CemI|)9&f2VozuJht;#{B8G-)6+al0V**-xuKXR=g{}d3oo@ zPQ;rTM@#yxDQ|wh0r7Nyxy_6BT{M=T-&=^s@u^Mu-3yR;elo#){za-;thZnCNg`$Xf4tN;x3XS^- z@cH@m#!(v2H+%60=Z%-g5N`(dYg2!`FK@gIMLe!sSl^v^XIWeyoSiqGM_?X7SH_#- zjmaC&o4x#QgS^5X46yf*A)e!IMQAFS%ye&f;ZqZAD9iZ>iS zzx@W5mc-A!cf+UrJ_?`TABzyr{ka^tl6X_#^W)7xyfvr?^Sd2B#k&*FgZy{{hv4}P z1-B``Z^Gxtd$OV=Ua#E&ui`y|^VN?xV`wV1Pr>l6ct3#8k2kw#N$O=B$o%$r@jCOa zGyR68QjZphcNKhoys0N8@$U5EalPl~_X6TQQXt-Y;Pc~+>r;|C_xm?6_(%q zUcByAUGsZ2#5|6+(x!Ob;PdmF_1=;cf88YO`vA{a(CJV>0&RO-H=p3Id<76+S=S0mS2H zgv{@N7w^Y;=g0Ee!uK;r^3IPLLopv94&y!K#cKrn`MrX8NG0BsUtON>jUv7W^ZMf* z__oE-lKS4C*B?(Jzhm$*zlZV8w%~ZaH1ED*>lk}Jja|{E{4Roz$4oFeb!b>Jo)1G) zygU1Kt?v=UJIx)#H^rNj_q_9E`1%&`O@z-cw`_PxlsD_~AMmT(lDu-?K|DzDrgDS4 za{G=g?CXuB{eBw`ABKLsDPDK@{QLssHyJMG_hY;(zu)JTI}`E7$I+5@c_pvD7bD(Y z7w>T|-q^hSu0y=q0`YQr`Stz)#=VR86E9xd`?}WmA;e=nw5h(Ig3qt-cEsBS6YKj^ zysN%X=EXbt%)kn@5(Uc3>yl@8|F;-Z{|x{HC3i zihTL;&VtX+uO^Fi1j=B%UwHA}$-DnO_91*OuB6}-{t-Su-o2wrQrj^XGv4!FydgMQ z{rqk}2mK45HpM#)K0n@!vr1Cqu=ZiRUwZNOVO{9QJ6c!x^V)yo`Vq%Xa0P9gl#G{O zdGTHw-ZftDdb|H{hsE{%Eqs2wLFbjE-b5nI@7G?u?+@)7?^uy|2jKJL^*cX__Zu(X z+j-Bg9-D;oO^pVh@DK3$@p^xxB*i}+!2Eve#rrZezx@WCpGqCVer<}k4L(0!kB^q5 z_QAw>zr#EC@wzbk)UNTKL%gX9g8jlzz~{$1gm^bVV7%XZ@z&?XtC@;*DaM*M#aojX zZ}yCm)a`hd%XqJQ@$Soe4t(?<3qQxaJMTGg@3|%M^Xxx(@t#Aa{q~zT1J^AIZc~0g zgU_$;yvvavb~3*|!mIWhiTemY-nxrYsi6u2pKus_e!PAQN>UxJ{r=>|o0b=E_s4PF zQV=iRNAlubjXx%G)W!R=7jMQHUGsb365J;jsP9MN^Yfdx1nUSl{{G^{`zbEAetpM% z0-xJszc!`%7<_)bi$7BmKL;s60Pf@X>yHEcc(W1jTm`{?A=l`BysHs!hRYAPXmPyF zdGT)kB-TwVz-@~6g}iuAqfz+lf7!p~Uc6htJiNjkKdu3vFHmrs;_Yz9OmKRS&td)I z^6T#QvA&SI#M?95)@kmrxW4QozrOuem!uBE#Qb`C@qPmn{u$?YWn+#;!J| z%C8OYwRhEjHXb&0$b@&6#ceHoe!0QMWFF%8{cs=0!Mwb9j}?h`d!BFdKXrXhqjJBV zS8nSj^asje`xaF^_U0WQJL_rdQ8r%$7a-HJNC04gS>kDaJa?Ry~O0tCNUV6`7!1uw|-VVro#6K z4Q^Apci^ELkCAWCRjJejneZ;(ZSaw`FT@|U*oS{JzbY@kTZeVcZx-SO@M&WV{(FsE zpQ_we`26`)<^G_j#Z$j+g>R06;a$FU<>sq#``&=B+4HfE{92y2ckR0Lb0T}EhueW( z(O7A-f8jn7zVq}CyvsKl_cNta|FRg;O74Cc?J@}OY!`0wU3GfW#?*JRTwF7`za5oe zJ=iXPhwqH9@;3h;#`Ze4wl;E&tr=B2E~44JK36|=Qb~zQWbEI^n-! zX=Sg1r5>yBOT95Qy8Olo*Vi{4yCs#aUteE7X~@bll(`dS;(gWL)O+iPtUi$X+Ul~@ z$bDZb>oK9T{`yq;q^8XWQ=RoQ`mK7fP|c2=+_j9-`nrCs*^Luevvm3FQkB9z<>gy0 zT8r}bqP(4{(n)pw(rag=Sn8JYy1sGE;OsHs`ts_1B|BEtmrgpEx?^j}{z9csJEd#s zu7NOWJi9qmZfX!x0IF7MqizNqP^1wM>*9$&YTLiNL%{& zoUWbHH2b2GOY(9mOP#2sV?$8Vlv{7yux{|$C)Q41r`9QXaQB-0?2&uLv7sl5)^@_Z zvr$&J`rUthS;Gdez4i0TX!zP!C(NmPwC>#V?>v9-lNeDK;wcpm4L&e@|CD`qtm!?m^WgKTAv-Eks~#M?e$;Wb;ThA`U(s8ZrpwD`H_hIf zD&Kf*ebel{sgn9ny0Lq}joq@;kgD&Xl#=>8Ck(E;uCCkp6H8XF?0U}Lv1a6&9uud| zDy{Ed(s|p#3YK5O@;BtSCd*%WYSN3!;KtOJwdbcsS72<s_Do${R;Yv>0|&1?61U;xS>Z*)*It6_nz)<@7p+`dzrZ^m*mhCwBg;!l&*;;;^NdY>P>0~S zIy7&osQtlu9IG-CDqPx@ipPGy==qV>W5n*6k{r!^6ti%oXvUaQDArdd-CE)2w5smI zZgl+5dh>re8vdup=eHSq?)syCOSLS;72ue9uk8HejzE9y{j%RSr3ZJWZmZ{&ZcF*m z#?g=CTE3p`?ME%#{w%$IyUHr9ug7=km8T}w4;lQ;<9fH8|T1XEQPBI{>9j(ldi}6re13& zH3d(kzEz)I*OF>#J9vDLAlmDXG1}Vb*g`dGSsj&DzdNppKSJ0Ro%PR;Vy!xd9UQ*u z=crfenWtX;jW_&6#*(zRYuO|W)j{VYG$a#NJ)x3PfU zvZgFvopR=waKVDL!{aND)~(z#t;?P$?ioMq-g*A@U5>B9Y?Bqhs3eH5#F{+5dMcWy$vtU6EQGRhoT zMdKD%mM!HEU6rm__n|EnsR{BF?&B>Lx8223)@z)WrOWFpbj6Ts?75@m9FTY8ZsPw%i7*e`^r;I6OO-cVys6#Qn-JHeckV!k{wAs zSr^t+t)qXJ4y!-ucT3ZF{5o>mAN!Adxanx&v-+0r`jMk6!t6pdjoM)Q@!4&uc<#%E z{H)E&&n7JsMXvEjF3;9ZoTs_^rp>oRt<-riy8l{}Q<-hoalWPE{Jop%*PoZv>)P|D z*Z;Ks!s|Ih52^lc?;%y+JQ-KD)UD{13sQDQuEo7)azydb_xkskOU~{w?tUa@@fV{%)!%IOwfh3)QJ**YW+t{#*NX#@9?x@W`+59M)K3?MpdlyD`T5V~lOi zL+m5WLw9WLJXn|Nd}v1M=JLCK^?2&SZA}4c{)4hq=MVa&Iv*aIDt)-NV7rfbf+Z#Q z11xJuw{naI&SAWZzz8T^_290HN*;Xqq9mhDr6aohYsk>@iXp?xD=-I^?z+f#{;-Sl zhoy3s*B^;%$eN8@Kj);P#-Vdibr}R$E+_t4+c&h2xt*M#YJ0}fFm7W)-Zmt;p>ladY zRm?5fRKYz>_=*2jb$xnI-*zURDyDn(Onn>gTh{kXmA9nJCZ)EV)cnJ)7Ob7J?wNHL#&@*q%bJchm!P%r^vKSW(d!nJtew=eqG{#hSaTK5`j&rT zZ41?N%%Q?Z^k3_bjrH|scymiM%Wf_dk@IoY)N*gG95P~4ugE_w>J^^r!^%VTVRSxL zm4`$6mWQlUDe7b^9Gjcd6)oL(P2mjQGn%7zZ_Td-pDRrJXwS+12vz$GkIzA#xg)Pe zZ>J7D$i1^BcH-~eHqCxB)pWE+N$J6%D5Ex2`jE{tbISLZU$7~?erRfN#YNZLbvdqT zcp{tbg(rgE^T&PD7I;sPSeJD9+OyIXscsJ^<$ix?H~*NbkEMI0aPCZB_i)^&>GA-z zyzRLDVQWtNSkZRAu+Sc!udg5W`z~tz9mTwlKVGr}b6}tJ%(Zxmhn5C^ZS^fYpHrQ< z+H?*pKdE$h{YmMybK|Rjv~OtrNu4;y-aBc_`ev*&?n(8pZ(4Z^o_6v&Yi*INrqUbM zq^@llT~S}Mwj8SjJm<;pMdtnZ|0$Mb{rCJD+4@JV$|LXY^zU<4)g@O&ySnx`pCgNP zTiAa~ZGSvF8nW6}bR`%K2ZxvZoOPOaNy&qgCu(eZEm6j2C3bx}IGpdDa2Gyr9^Ziy z(JtwhVX3b~D@&VWl8g$~y#7mm{%nO0*Q5L%e5#!9=cw3$^E`*IaVtRz+z2&bl*FeR@`3uV|yohfQpnmfWSW)%Kisd?rzAdaE~HFK3q}ts9+@ z1KDS*PT?ryxrcRAYDnk7)Ym$1NnOIe$2#wuSm*uM$sfk^ZJts8?RDOdj?e5jlWwZ; z&m?A+Do-+t)&M~?n&Rt=t;334S(aj@q4x35$cz3R&%Pfn*)grhdR#fYwGe*nzhuX^ z>Z@*mQ3B$Ys*Q${!4+YWv}aRxogdalJuIP zSh=t2JE9lo+*S1&y}U2)JlGFCdlyz&qt||6V$=Ue+uOibQJ(4lbCR6!BH)P!)Fz5Y z0*IKzgmzSVZE3lykj zm3667>slAs)>`Yj)Sp=ETK!+wJkK@re|P}_;?fOzjo5w6KcoHaRjSR}4= zCpO0K7>aeJK9X&m`F;06)R?o1cz&-Oew#dS?sV74XfirwdoVIFmhy_bwv}+i9qM)_ z2>q;0CB;M5JLm1$$0hq`>?$))eLI;t#`|n-1?GOx%Hy5U%Dj-hzV`kbYARbhZ@V+n z)%_Z%=jS&p^`>=f^~0OuYnJ8k>}m9xF_HGEwK=&{m*?P2>30Wl_4=oe)=y0>IO-kR z)Y;LI!}}bWIr@>$iF9>#;Jg6+By!d0+u`TRFXg1#dS$iV{l&0%v$vmg&RhL)_}(Xr zzhiCYxN$wzEi<**FzD306h0?I8@lH*r@7u9d&I207p}x768;!p-~UK*_@)PQeGhq^ zdCC0n3?{tSaAYdy;W?YbV@KAWZl>I{C;Rw}Zp$oBA~&olzh*GUvM+YK1A~?v^b@Wp z;T;&B1%xTH_c*`b|AaY)R}sVim!D&-YRlFu7IZuR>se-hu13$P_&l$f+Aogcd>L1N zm#mDZjy#1n;@p#9tKT0*7>d|xk5p#FX zQcxe{pLvHho>?2b!`S4n^0~=R=d>q3pED#nddcJ7oFI2zS@k}I9@7ze`2o&vJJ)qT zzm3gX(sA{g@annq_A%YhW&Pu?-a0FoyV^%$?s~Q_=I?&~)paiJQQ;0uZshoFQ&O>H z+zoD{Q>4l-cMw?w{38Htm&bhQTE#Kdbp^VdG zwKPBM4Xh*g3g55oME2Tk`diEs2YO-DoWm8j?s0EzuhAW2Ch?w{`ev%_JHeF`+cMc1 z>3XG7*S~Jr64xwodPe+=+k=v`U$6&N{_K6(_YlXY*7C8tDw_|sf&3{wJ~>A2sSUSA*dr3xf6{dE=z?6E z(mV|D(=$J`N<3e>~ptD^?xU-QDo>w1SdWzPJ#Mvm>ond=t{t`4FpF8g-OtO}C~ za!0I;e=1qhcYg2bYmTlt9L%mg$Dh9*+?8zx>&)M{k-9%GC2`J;)ha0YX`Xf2UE{9L zW}eLEn>88xlJPz>7V$r0Yd`R~y+hNZMqs@=jX7et`Mlx@+*`)@+kmwu5iY0I56oy-_mqo=+>%bv3& zXP`ZcOu2b}hx5<9m_Ih`%vzF@SxVy1v(VxGuio_R&m(K_1WuB(Kb~eAbT*!j8-&_@ z4cAs!jbbn2bICzCzuzAV&lYjF1Gb|(_P4pd8M`9!$#j|64iY&6X9eMEnQ3Q81vgPEB z3_UZalR4pj9iM3GVosS)De(y<|IQ*le|{0|Hg{lTZ)9Kl{wSVe;hndwS=(4G@{&l`*UnDGHhUu~<7)@uo@jCJ$IBkgQZX8hWmagaCKnX5YK8JXZyW~ z_KPHET!+t(b{^=Py>7b7LND~%vu@OW-F^SY_gzv6-)qoMvi6Pg^8cOhK@rC7`^Npx z?7sI@{H4Al`#4^3wvPUM5Yczwb2WcNHXZf8HmD;SIi9WEE5~-vr_Jf#W+Y{guW5Am zbUj;3^*W-mc)*MO+JD;fYW^=}`6&*zR@+j~;`(2g@!?&+W8^BXK-`@umt zqnfw=CiGS)hlZhaJkxKhjO^)LI~I3ZLyy#Fb!>6&nMd}vRo;~sIhL(1He5cvTMul@ z3HMbOre|j8=$TplT^8Dzz8CIij>{qb)0V|0YX_KKzH!p%UPmiCu1xLut(VPr7q9<+ zn(wv$^lWc!{*Yc@{`#OhH||Z%el4qYV!1|^Mp7jCqs<%lK2ph<%k=!=`$n!FfwP(L z9(uMbe6C0f>fEPBBVCv=oK*cPb9Z#~Pc=m&J8#Vv`7xvpqroSDILjYV+1V?ZpY56@ zv1EvI7EHTnFL!<^?{PfY$30%z?fA+m!#l#2p?kRx^jB2b%I&W@E#1oARccb#!{xB%MDH@ry5}#5n z*v_X|f0Oj~Mfa}clcx73`|XKz`EC84DX)2wwtNy+p{ehB(JQ%Lm(Piuz&bTN*&B1m zJU&H>&-8E)jNB(ba(q==B)O_Bil5$B;d9V(KBa?mnR1T1_=_Fhp9g(yQ0J)^&y0^v zdweRVVg0H$+!tMdGnCm+c=0vSwy&IR?ytr3V+;7%I#Ms-bLhU^Y<`A=BbD}u|2xtJ zWwurP-;BX+srI4K0nVAlUe!>~-p0OqtSM{*v|i92k-cA=cbZY_q!=_0kAAX$JI@4h zRh#{ljw?gIdRjU2EMU%lwCXxOtun})!>3hNXM0+OJu7iz=*{mb3nE>;E6XeSiR-w{ zoqg7Pn)N;_h`x8_z7tm(8#oG_u z64~3Ccc5QK(yiSQmF>e;_a9i9JN&>cM>gf|Sd-Jf<6utbnqgi+`ldmT_DW6~j(hFX zgX@&jMRIaQ_S)Wq2-Sl2Q?@MU=nGbaR(}1I4P}>pb!qbrm!?~qO6?myPRFG!H?>?UoBFzi&DG5} zUCI{};Vm!~qpDK%b?L@dyuFN)d6iuE*Bs*QYtFHjWlelt8D6m2w6w0Vl`k#E`$b#$ z0zJnH?-|Tc^m_9KWX3nAFKS(!VUhV_wamjewx%2TV$X)m%(}lC%}*A*SaM>bhA)+^ zYxG~Uo8W7-(}`jDywxvtVsRR8fh$RvS3)Mbl{*o<5-_{*X)5C5l6~%~DIaH&rK&zI zNoL)BtbI_K)h(@QymmUBYEHL)Tq;}93G)s*$C|Gz#5*+;83s#h6Q-pT!&WTwK66FF ze+MC~@V>}qQ}@9;^Vs{`H*j`ui{|uKmf6((n!ey-qytF*AcxmHOygECv@Fwff zYh2n`8Z>;uzJfJTvy5*l?cTQD!s?oCVaVFUO9|6;%i-4V842_5P9*lT_b&fTwj#LY zDPfWpydBiDs@+ZC?LP_B$HJw{8f#h-rHMpCUE{>Wm&$J(cH@^zY%JkEx`1}%$aYn{ zo)cBmiZ*CSPfQG}UzTwkZ-K2@+JIVVO}AtmVxjpmNxUzZ5h69lLHN??1mDb@z<5p! zD<5;CU&pnKHp7eBxUPncTLv#^+wN5mns~!n657KH%o7XK=|4UNf90%` zZ9^S;DUyu9+_bDYeQ{RTelO*lJim(m^gp^|ujjZKVIsUZoQ|@N^twij6lOn-E5y|( zVeL(G%q*a}B2m|pXkEHA(Xtrpp*pBWzcax|N-bS_LtWZ-Gb~H#7C(Cb?c5l9Ha|^U zEp;o>o=M{QuPRN{R@c>IVj3}wa~?)__eNmx@WSE6>C_DvUExfXwRD^*{d`%%Zq?>b z0vMN#r7P0SOBL*COad1e3W?h0>P1}Kl_p$1yA6WGvPQh{G@arbZ@V9`YqU47CC!<# z`@zQaqNS~MSiEbzFPh~8$Ne~iAndp*<%?NMXHNQD*q1Ww?C?r7_-h~Lr;N3)TkUA} z>M_dv(;rTk2mn6n{UZ5uQRC7?w}W+<(3UndU`^=edD4v8vz!>a?@mm>OHeetN49lo zYH5AgY3+oIF$WhZ45>wFwt349bxqxusBRWqWc@c6r)n1CMcB>NIG6HYP|UZWyNjZm zO8s43JlnBE!?G5$EH6y^K{TPEvc-tOvaG%)(U``lz)aB8ly3Ai((4+Vut?Taw^pMU zCWc|YM!4p+#l}^)ch`9>n2oAiF*SI8N$?Kk<`%eYSsYAGO*d2_8;sm=IAo28XO<&OV!o*QVlQNLixxLY)+!vq zm-5!tU0bN5e@Y!p+b%}g{k<4ho&i2U^{aXF@I4@V~^W+%+= zEA{)DpnCi=x$c}vD|>`2Q8MAbA>5fj-3oBdl$^ep&B8w$ajMRy40;>JJ8CVFE$J7v zv?ac%K9HDHzX(ecUJDlTtYaNW9C#| zSOn2#Ju@^3;nTmYO4w@-w`zm7V9PdC-;l0qTDGtrFQ4|?Zob-VemA>Rb$!a7u^YS3 zCxYXCo4Stl`bYnOn-aY(q2A_qpZcX-pqmq4{NfCpWY^YWfQHLkH)|NN=W&Vp_>>C3 zAI#|C_G|&`v6+8^&}m?0?AryTTEyOfzrGk?DDtmK|( zNW)aTtR-ENsHtm7RX2CL%&V&jM^n%IJTKW|t~F}W^|3z6l_V&PkYg|!S83Et{3DXZ|F&#~nbMqPHXH)$$9 z25d%X%e~0uz`R(rdHLv3b)%Xpsv1T$l~+}hQlu3P4a@2)2-VdMOAXXFx1>NlKT7O{ zr+KvHd4Kpw-!EgdT>m`<_sIZ%Q+^bGTh0w%+k|iBDD{q?>3P%fRUV~wpYJtzKKN=6 zlm2Zc@V8u#@B6`5LwVz|&-Ao^E5kng{w9+?{64H)@4NWE&t0%DcGBesg;XKRI46-(R^?p2PTFyMCyj^Ko49p649z-XBanwRGrjQSTSXe+=To z*Hi}S7u%!!rlIcXP5#dW$9s9xkbVi$m)Z0`L_GIkf0*6xp1zMC|F|H&KHehKPq>}o zADrtQG+9RXB&%)C^^3U{# zo%Gy)#3?WLk2%LH&=zN)Fm8Qc;nX+n`Mq`WKL+KmMw%iBivR5l|2I1JO#h^_e<}7K zM|!tBXJwSImUEo>HD|=ncW9c;w9kF;q5UnW+lx?s%|A?k zlAXcdjD4-+|2eeZVEhchapnJX#`ru7@tMt}Z^{@i$1>u1f}P3VjQvZFzbNAQIes{# zl;7?Qe|O@z*-ZKxXa5-LdLi0-uucC3?6+ZGFFmvK!-kCgw=(j7 z3-#gVe==jgHKToJIraZN6zqBQ4|YkF?`r2blmbG{kr3w z@4Pdc=|9sm+WQ^H{}kBnf)BTT-eqU zcNH4n9nWXM#%v~@2Vn2+pK#*69sDAG5-?DEagH*ZNq?TRe-ys&Lmj#E*DX$YFUPUN z=#MN0{WW2q=P0iIJJ4MJBb|6y-ja;{6HfcZ;cF`PSHL5)87^FSBW3Df0jGtdjrfL z4td&t3H-LR&-kBq@@LFde|Npf817F{V_%89|dkgkvGwsFn+W!e+oq~OL zy?7?0en&a^Gr!%eTz@nEo^F;--_~|!tn$WFy2AfAB6tt_Q!rs zd`$ngvwl5{{oVK}w&{8NWhZ~`^Bs9+Gv%F=;csHb{&L6vUZh`v`k3hWf52&P`u{Lv zKi?@IkN3{l=eq>lcot^t56OtMsz@jsK1 z-yvuJGqC6SuJJG$`wydiu5!{}>x^IKcXdX*12fJqYaIWyZ+6lzM_&I9jZMb({|IIK zCgOz@^xuh&J=51a^X+le$B$t@+S)fE{Z8yNOZ9)g+s$l!ywx~<4Kkxk9nZ^%f8jZy zJ@cz^_W9n6TaahDlYT-*dFMLu%|ZQ*!_Q04kLQ+uL}fDz^@oj4e9V6}E7#xpcwe&D0!`S@!K}mMvmJXpB;#)r{NuyC zU)XcWHh=#j-+pTXJN{>@|v5tffcl|o(*z??RIqFaI-%8lui+vVZ z(q^G~3PJM8n@8B?-DNjzu{@c9R@i#OE{1@VS zMCTV@L0LYF{gF7X_zz~JKbkP9@lD}=dlj;?_?y`u!^&{>TQm0G%-G-I#M1}mAC5jW z0_mCm!`9Pb{LVqGvwZs;d+tA+;qN@>_&xB~3;rn4-)igcI^W+pzQ1XX{S#=9e?s}y z{~wK*1jat@+u!KeZ$bWbuxAML|0vpu+tc{T@%sDruRHPmH~QbLupf%!v`Zd<^LiYW!KA%ot$KU#R$8qc&{Am5*@pTu5$GN{hWB=8ReZI@vY^HxKaQ5#( z`Ynj36b390{hh_h&fkoE%-R0~%J(m@FT-)!zvlRxgIF)Z50`iyFLBb-|6FJPVbu3v zjA8j(2>*YEf4XG)6~VO+13Dw)exPaJB|PMBW`B-$ZTqVaqo%zr$Zs0vs|0Km-yIqD z%QN<$aQ5R!zZmH?p8=iiOuznu;^8cT<((f`oawDbd*6;kmq26w-P0HN_O*e%+25J5 zzt7pPMP2_3oN!53dG2?PpThAca9r~x5v9B&rV*CPFJ`0QEVW`N8pvy@?pFyvK}U1?_)}bDZVv za`wCXGxsy52gfh*rlP;{ewOBIrVr;wW53I>{{h-=ENrj@1^I7qjx#;qQ(-ofKAca@ zK3@G39KRQ3xdv%8Ka7C?Ph(&Gwfp*(x!#p!tbgVBeo*7O64xPT;jZlj25L8Rj-Wkr z&al|pQ|0kRdFFUMI>A{ufBX=BwDEWq<^pZppOUf9d&Sy#{C2F}+PELh@Yj}+{}iXe zXy1^L{%EFvJFVAhX@%Z?R<6q0j|J;n@zstyfd`5Xb$f&Qq8TLQVsNeF8^p9u6_YWEN z&t=%7dj}iKb7e+;zsl$j4`-BTVTS$ijQHJm6VZQJMm%xM7utCIL`M8vr?m0-;~D9T zGV&|Qh^I3n{y`bXzngLV-i-Vs8T;)S<-aat|LlzTPGrRQUm5*tILf5w3ph^~T6;3@ zIdS9suX2*5j{@`BlN(w3IB=2G$=r zjkyi1&q7v#6+c<_cnwz&KUw-Z+GCyKMwZUc4T`KzmVO^t@sp)*0mnG-us!VXVQ{Iv zFU{wD6dPG-UjVCa$cMF}wvF?5hph-)X z{yy!kPL|#m^P}<_2rjYrQqKk}U$X2A!OE8`eK75LQHPBzeF*KXPL^HI?v z-|$Yb;vviCZm{AZOW#a;Ucg`@OTUlyRwql}3RXOPwn}-CWwR5kyvWjb(ca#VBTIjT z_EslL-v?G+`@zbKESqP*%8M-hS=#eN5gS?h^R%}*S^6=s@_Gv#xA)1&vUwL=lJH%6 z?}HT&SvDVn6%Sc@4%Rx|Ya~n02Nzvve3GRP1jqjkg995``W4{PA;z9vxn!teHkINb z%RT{CJY?xiRyYj*VIxZ)0WPvSSvuD^jS+XftArloLW*q~e#AB4QmZrE5<0`iUy9T9 zUjkiml9g{c?JvfE*vQg(-Bo0Dvh+%@;v`F-1&-Mmu61}7Sh1~kbgsFI(_Me>gswQr z@_#q&N8&$hWa*p1MOG(E-wIZoWa*Dlf7!G8mDlb_!ZD5s`EPXZY?a4G*`faqgI$8QXV2ypU^e%7#I|8;R!HR(_ zo2S5vfh>Iw?XNIt$nvRAz1Z5 zmOh+13yqB|y$l?iV*K;jT-5_vHWR>#jV%3g+9yp~vUHw%6j_}teLA>+10CBeu<|0y zW)4_+k)`t-rf`}`OO}2u?X6ChUJF(|kfk?+HMi`d&2LPdkY)20_1BC}mR^RnEdE=g zlcn<+W0i$0eIi(8Axr0)SUAI!g)DtC?X6Ch&d3e8zb+YtBV2!(@;Mf;UzQ@4Imn{2VgOx8?`s=ixXVQ|Tze#(mlcm28R$Y;$ z=jVlWLY6)N9J|{19|%@#WZ9exR%~SH=h5Dloh&^;d#jVBj{vJq_^h$=BFl!)KqxP= z^f9!bZ{j3NpFn%7lci4us~*VG`I)`?23h*G;Mg_B{{paLBg>`+tk}rX7t`LBmn^-W z_EslLZw0F!c7x-un{iE+%^t8~AWPp5Rt#k6&(Qul6F*t{v$VH5S^CRh)el+v>)_az zjh}bP*Bd@N3j5!gILWdf431S9o1tLEOqLB^OA*9Omd<-%g$qntvh;G=Tb(R@B3Sh{ z1stn3Y3Gm^8m=Ly3^$T%4D(rW#YUFT>mNgmKfgS@U!F_jQ#?+q~7o= zj()=7*U1gW=3R25;Sazn3t2JnLkyLLEIkigxYVR2OYcp4tCOXl1y=i>2aYwFv}NS4 z80O~?v1Y@UgB1^1ek#F=hb(;x?ORM*vh-=Rw>nw+)nJVgvh?f0g{{U9S^7e7k=4o4 zo51ozmcANXxXkz=OTP_VWOcIi&0zTDSWU>SXCP;L^W0_I%b;^E_EL&EQy@vAGefc*wH38LW87(%WdCG-=7w zSJU3=Wa)Q;)t~PJD=)Ha9snyZvh-cx`0q{Ik)WD1^fh43)%@E!(l^uI>SXC#z?v(_(szMN?RD`J;MlFk z=V9_~hL1RW6s$PO^7ArSagwFKO8d3O4_W#N+FPA0{Y`KwZyI5H3#`1zvUwY+z3_- zWa&54o;T;Pk)^lM-s)uO>%f|O`PsJeBFkn2Sb349Z=`*v$%`!g9@<--EWHb?am3H% zl^0nyJHX0|Ed62HZ!~$4rSGP_)ydMI0;_Jx(hq?(j*ft1n~cw6uqgk4a0GeirSmPL@6d9RGvqlVs_mz_ELcpUY`;U&ykVLYr?IozLN^ zKFP9~0aksIrO&4Q{U$A0`dr#uoh+Sy6Q=WI{=J>@BFm;0th~t5m(c!OCNHw|M%r7Q zEd54s=>x`o6%Z+1P_d9|(^BUlTJ~e)#utijyoo0al!3 z=|gG1)%YY!A3=MolckRWmu@rm{98TcMV8G3u<{~Hznu2Bo3v!7Wa-nv>R0@` z)57g0Em<~vX1K`eWa<1nNySE%el6|uj32V}>uLWTqm!jCq`lS2()qVInnTFa+rY6M z#?Rg4hYa5XF5PMPVd~#Cya%i}$?~%wtT@TipP~K3CM{X|v$VH5S^6tr#YvX_HaNyV zoWk}#xa50=KXf>!AJV>K`WRVh`OIYel+nr3OB{Q$^ofo=SvvoID9#((*vQha1;=)o zcvjHHejY@Y%?7aQjVyg5SoKDh&c7un{6EGgS^E97w>nw+!(i1LS^87p!rjIXS^6Gu zk=4o44}(j;Z|skNjo>^b_FNqsGr`;KIj3mdzVXYjv{p_rNL_ zSvtShK{1e}_XR5kvh)G8f869tmVOrPtxlFc1gy_=$kInq|D)*xWa$&ZI?v&An2L=o zo9ST1MwUK{_CGMOk)_X}z17Lm7lPyOnHb2@o56)o8b4&|%fUrfCrjt^&GJK*zJvOo zjDNE9-Qd^{jeq{_ipofq&5yt;BU$>>wEvMwOP0Qm_EslLKLpnL@&Y*ak0$L2aQvx| zW&Z|k{=w)cnRb-n_rZ#jEc*|^ijyooX8`Q~$)qJq&j%M-oh&^D*80M~)l^<&*_;hl zUS#R~ZV6qxk);o&y}foLOCJF)tuwLlS*O?@!;{H-4PQszXLtemCx(}R6&qPT8^MZ= zEWMfb`%PN1bpDNKk=4o49{_8dlBMqe#|{`j{63)ALBj{Zr9U;yzp++qWTkx;tk}rX zpQpV&|0hd-f%aA>OMextb@>EXd68xF8d!OerN2S@XH1-A>2J~A>SXEffz==02P-eK zY(4}lFS7KUGhuJfSIN@z!8(s6OCJbUos*>xp>F3Wvh;GW#s$AuLa~u$GXbpF$kH#T z{m)E2kfm4B-s)uOv%rdtEPVl3G1Sw>uFGWEtOLgmnY`{HKWli4!#lu=pRBa}8+64_ zmcE5tLg>SXEr!Mc_qOFv4T55Zw0OMeF(J8b;F=kVZI7$;fwL%@oYEPXib z|Hb$rOCL#ltCOWq0IQzK(q~b(=OJY2*MbY5H~z`euLl=doh-c>ta>0zzXcroSL0_D zSZzU;%^I-ENS3~i_V!wdEd5T}Tb(TZ9&o`ClNZ0wKzWg6(*;&uWa(RJZ+()b@1VWa z$yarYb zWa)3vK5b$kOMi>@Rwqk;4_sPn?1vPDeTFQX%fYc1jm>28QNz>7zc4%(toyEHrCmas zmyAs#SY;v0rWvfVkfkrD{Vz>gvh)?Sw>nw+YH-0_#-85;qP)nmxdW`c$kI2^evL^> zmcEhpRwql}0#@6RrSAfl+H((n7m7YdBg^J7us%m4OWy~UPqOr*VEKF(T=H)w&JW11 z7|uHj{42x!j*Iwzn>mUsKM8Q`Rbw;4;c{^4zZ;$3Z=!l5EA2S2>WwUYBJJ-sY01*B z0BbEKOP>Z-f13-A9W!YcgOx8?_Vr-pOP1b5`x7QDS$Zq&txlHC@2yeYlBKT$7gQKO z8^N((8@>muc*wH9AFO!D(z|H?8USm!5X>G=cE?td_T_%{uTfh?QB zV8uX|J{%l-+oT-{F8seC%chKJtxlFc0jzP&@5)iWWZ7H+R=#BElWG5s$%`y~D!9n% zWa)Fjn$yVA7gD$9|77V+;L=gX|1R3td&p$jJOPfKGB!_v6+c-vd%%jHEPX%izirZz zr9VS^tCOW40jp2)d&ra*SvD_$l^0q1E3|*tcI9M^0rH`cj`z9?}dKvAlPL@6atk1Lfy;#bNESoF9 z%8M+0GVSeo3t9S9+FPA0eKxrCWfR+6@_!q?9<2KTx4~!^fs{OTe9>G)a|uA zS^5Li?LBj{^j+Xs#N_(~ZS1uwSvJp7=R@My$kJZ`$8t>Cm%*wlvTR-jtFFk>PtZQs zq$Nv#jrLY2OFs!Nood?XJ#Z|~q|HAEYj@P}S>$}fgTb+0hWXuJij6Fv!@-J;EPW*H z?bswsFQdKH$avg2rhWUMfik~b$3&Dz?EWMWY15H}8^d+>nI$3%vSodS^ z0qY(GSvHSRx6go)r9TZWvFqSIu;L`k<{(&clBFM_{c2Novh>5Ww>nw+OJJP~@jD2W z7g;v1f|VCp`U%?Gd7do&HQHO9Ed3p@+LSCk?^9u$lBJ&oR-Zf%tk}r1Nq`j_S$a8G z&oGdsUqL4mY;HPNs-aV(dN96WpjmNGle$i z8ym80W`JXZjb1~WV&1^;1UI0265nQ=;%%}H>{5aaV*+C+^FSvDVn6(?DGPEi;q zS$aOWu-Nz{OYcj2tCOV{f;EoF(uac!hZ;X*=_A2KRwqlp9ISI%vh*3?*f8T~w!_zf zONJYL0d>o@4mX42`KC_D^0@-6w5!0S7a2eNUQ^W-S@ySq)uv?WchG)>NlTW#f%aA> zOW#O)zDxoeS^7P+w>nw+cChM}Ed43!y-c~t()WY4MjQmIEM(an0;?=!>4#}Q(!@rV zeuVZ`CrdvDR%~SHC#lBYw>nw+a^@KWQ4EPV^O$m(S2yTS59mc9pEQepfY0>{b?AEv#X>&UV{LA|$~10DShaLFi> z_D!(rmaMcV!Kz!b^mk})*JZNw_h@f*vh=+3!?KX252SAUJX!h>u*M_5vsbZ^WitY- z*vQgLX#XwKAIQ?n!HSJ6eImHDz|_NBu<|0yWY;j*T&C7k~@zxBbwusR3)O zk(IU)taZ5=tbEC`Sq@gdWa%qtKi1?+mVOKEtxlGH2UvZHEd3sE;W*=mEd73Pk=4o4 zcY)=HES=wb9GhVLyh6Ur@LS}GhTkTC+VFei%ME`>{*2*%gAvaaAYp`!$kI!|u}Y(tgA0Ca+G`B;Nk*SYo@{tB*~T^-T=+SoljUGQ#g zjV!%}`V`}bEWIAA*qXqKZ8`O%v0p*9@!SS3oN9Ek{M-R9vN~D%2C(8GOTVA`mBtTQ z`c|;w*#TBOyQxnz_K%TmJo~_fR~elwKL^1@Rwqk81Xes`=`T~CZv2p?p8%J9-sryu zE1oyNrM6Aq1sBdRHe{uJA6#U0vh)wZih(SBzy;7}8b4&|XM;;@Ugv@p!*FonEMrfW z{YY?;)ydM!z{-~_eIoV0F@DI>Cxeym6tME011_9x?8&mf8eC*`vh-`g%9kvC3H2`+ zKV<36VCCBiR=%sig>#HOS@vtdMOG(EUk6scWa;-&|Dy3jmc9k7e7Ay??<3&CxyGI> z`zOFfRwqmU5m@<>r9TUfjW>Rt2W##n%jN~J=3cV&muUYjGjEWkze0Pflcm27Rt#k6 zC&8tIObl;>3+II_n|GlXS)D9BKLMZiZ&k?BW8m1;#?MgN^fBu`SvF;~8RhxgIIzl2 zmd!-4%1)Mk1?~UV_$N!BOna-7rOyE?PO|jtsUI_b$kJ=UvH3=?CtqWDIqmrcD%i-f zUj^3Ri`@r~pJ8msve^PIz1H~I3RZc^ve^MvdCAfrroCO$$;o$=vh;(rx7XBU>4#` z#YUF?F6}EleM0=VS5h@bHkaLn>Fuwo!9?F_JDAWNT3`!7d)KV<21!9`XlOTQjm zIy&Op*Mei$8(u=LGTi8JGg$GE=3hHhc3wJ48~busvTTllOR6J& z+7sY{<34(Cf#s7d`**=ABU$?UV3m<9{X^O>jQCE;(sPEu-s)uO{lEp2ObmSYLP^S` z<$D>FFIo0ygOx8?dLivwjUTe~!L+wJS^5aD?s1I)m(-YiCxF$*E(a?HveH(96$4rN z6xyeaAF}jmw6{80`W&$O65kV{yvVYd4_01e>DSS|*5pN&zJT^tCre)fR$i>7NSUcC zUiL>mZ@4#kvSIwGjTgDfFdh;0B4Z8X5eY9c%P>AV@FIU}_&oA-!wK@23=buL#_$O8 zwT4T`V+@y*=NP6Gu|ZEDUupEq$uz`PiJ!<^l6jX?Nu8+&#t>U#nE8r1B;x&Z@PGI3 z{+)>Z5^FyVEE}@wZ8mLgFg_Wg+K4QhtHEj`vUC=;u->F4OTV7>Rwqke3@&Xj_VwUc zqv2L?$x_41!HR*bv@5`hfh_$N+BccBWa+DDZ*{WtJHeWB$kHF6{zv17Ed42PsjZ*B z;8?S<83-=1TqimdL&ITgC%C(Hh7 z>b5P&(rdt_D~$hIuwo<2W(ioak)=1%{_jj$vh-%!Tb(SOeMzyArQb>2#zvOD6Rdd1 z(szLs4_W#nw6}Fami`3otxlG{2V8oyiGM#h_BF%Dz`6%Zmi_Bs#Y2|PM@1D6S^7!Z z-(q}{rN2XatCOYYz*O}^mfja!`1i&SS^5BQk=4o46JVYHlckRYtF24GDhpXQR2nB}vTchd3|)POEc-dsZJ#GgUjQz>+xTAyR%~S1a2{4{Wa&$2Z?C_| z(i>@Sb+YsoV8uq3zK*($jVyg9Sn-gh?*c0xvh+u2-)YK1mi`3otxlG{53G2|(w_yZ zPR<6GY%)Fz!LiMTOB`nXOTV1<-!L}*I317!1@9-qkNnR9$L=*Y^TGPOl`NYD;F9}{ z4ePw*9>a^lsuQy8>%poMvh*g}f77HTOXs;+k=4o4+rX+5vh)qqZ5xrLKL9Sh-}v9* z*pOwzI+x9pV8u_C%~N2-PnNz1T=*^HpDdkgWs%j%(w_$_ezNpq)NTA^>0IL!TR-Tr ze=vE)z>1SB`+;D^NtS*t?Ym4`vUJX4MOG(E9}X`4wz22AQ*4XjE5OQ^Ec?k|kDqD!ty^}Mt7Mz8VObQXTdo9j#YvX`q2R*p zCM{X|2yl_r$z{^;v`FFJrq7< z(vqdu(%$N1>CIr(Cs}$MSaIG4Rt#j>+yPb$Wa%4dzthA(mcEhpRwql}0@mL^k)`hj z7k=0HAxnP@Tx4~!^nGCYAxnQAT==l@LzeymxX9{c=_kPQLzW(+UXX+T(LVT*?)R%* z#{d7SU;Q7Gwnx9R`X}yJyN#d8h)v%gLROp{M2qoSh)GM9 zKA-khCrhsZt6!0&vyYY9I0w?^EK{Fk*$kl`H#%8*Ik@C86T>KnIlf9CH#)~r>sPrh{${XZSPfPTWZ7_TR1EGsxf!~i z#U;z0eJpm!l#6{#KFP9STgYc-yA=MjNt@X&MOJs)g=@6RMV9|*;L>M}ANIZYIi@Yh zvRMu;dCu6Z04q+iY;FN7PO|h>v_EXplBKgrimXnSz7ec-lPvuyaLMz=&q3N83t2XY zY4fi}e~&ijnzE2(2y_N zbwj$Qs;0WNx~jgerM0SMadmzD(yw}Dt?3(E1N){Ms+Oml>uPVRqFUCRuCMkD%350L ztG?P?*P57rEp4o7txMgIZp~)bRNdV27uYRpYFgUdir|`-)-|?P)h=yrsBUe^ z=GX*)$kL59uy4p}WODyRM%DFAjoI=sE*h$DMAcO*2TWD>Nc#B#np{9 zsLvbH2x-yj9j5APPJb}nm}sut~6UsYY7Ztm7*HgRTy zsUe!trd3TXH&iV~1$$+wr41|-yGu(t^i#9Ap(<5fpF#_#njJlzs#%=%Kuvn#vPD%* z&1^L{0V}2ky=Zy5>W1`9EpAk9-JyS0jIy07RbR(iUYtgsWXW5C9(m)~^2@4f8mkti zA!hB6w(#sg4PiPzY9y*cB~(MtNSa!lPThc#`c>oGX1D8Bg`d<8^<}-OysX>ibTvXW z(Mb0_x(CXd>snIF%c@&jo9h-XYfU5Y8D%Z4%|U&za@mx&f}5Jt4b?5J>Fx$$hx}@D zbijzb`lUpAOhOWbuwn^Yy#?4DPeUyE?xocs@tlPeB)_!UH>7qH^m|nEB zwXV9AlS^G=?b0A2QkSf2kv@B}~%z0>OQ)^vA-HLSfqp7;4#RzQ~XUt`oGTCO`lBbq7)}ppss#;o6 z}9`z&p!YP!KIYh2ozF1vEpyiypaLO<>RY-pg$&`R8`m1pmi1n889^(Gle)s;_S45>mAy-MrL2z|764Pc6f!4-!yc zUR_^@zKymFo2{FH?ZudO>uT##uh^`$TE1OYORlBS)RaND$&fR7z%)6LIQy9&QLMJR~3s(_;{lG-f(o*dl z=4nC@4sHE$)SON&ZLaC2Gj_iY{Sug7%9D+{o@PciCh1gD)uQI5%bGF`ok};BaO6za zZr`*0tEvv;M&}LPVnevgt7_}(7A;1MOBSyE1m2d`)~1_b>1Jjcy|%8gu4Qq? zAye7Gp`l?ytf2KvQ-L2&EDby}Xj-GAJDjf#s)Md zpo-A}hEy>s5JRe{2t5327*a(=AUaeYhyh$SItVAA@d1qsXly`Z0;(7tU`Q3C0x_hDia>OzJP=0*(-7wb zPTTIfz=fOhMAaz8dRagd0vaFCxPZn6G$x>m(E)~3F)9#4s;CG=hspynfXgZr*o1(_ z2Q)6Au>p+c~0@0!JP{itCPJA(mR+LenKKH88RpkoqvVbN8G(Mnl z0gVl4Oh6T*0}QERR3L^_Q4xqPQ7ljRw-i3ne}#QLFW0fG`MKx)_nD!9+X?>0$K=TQ zX4e~If9sdI6Xbc{0%Y1%IvL3B9zY%vS6T=C(w?^m&UsIh<~-I9Kfl0_>yPg)Y=x#x z{*FL!{XKhw=k0(-e^Gmk{&=s`^~d-Ay#!60{Cxp}>#wyQ?;Sxx`s-zn(cdT-x&HQG zzkUb~*iHUQp}YQ`Z1BAMXBmHeV9R6lR|TLyr7O7z`C?xi?YLbFAXjn++g#khdltVL z-x>JfG5Y%+z>Tj7{+@=eP5JD|@R#_p=kZ<={q@I>{CyUh>#uBtx$m3lZz7DCrqUjG z7@6(?(;vH+{B6kacPISSFax_OzS}eW)&CR9jJBh{0{qC|_cHvweX-~9ezi9F+mYdK z&pyw43`X=9$B+Dd0A@Jq_p@*_IGeve+BB8;&8_t(p+9^LQ{a#HZe4#nPvh?+c2l%cEd7 z`QtrS*WWV-Lw`lEReb!DYS-UOC7#Fo{@Ub^Ux(!Sd+Zs{>y3nr?|l5oUo+a=^*625 z^LYPRoBTDv&h_`y&pdBF4$|KR_>sTq8U8A9Q-775;kW!HGyDz2V4H2@yU_7B4;{sg zZy)?+EAMRBx$)IJhj{~j7+>$2zvb`zjQV>F{&w5?!w?Pp z{T2z_@@_2mygMn_P5w>*-1usqhXL|neCV=)zxkMKn4CJdA%I;m!~CDe_;ZoX7uosS z^OG?TS>`X<{Su1_S=*S;iOg>u+mBfAuSrK~ccpglTXwgjALP#XXep#N9_ISXP4UWZ z2-azpoyTv6zYP}}KQF8lJuI@c4H`(Dur>5}L_+@Kzx9vak z8%X!tHmt$PEgjkylZgrhzl<$9$s-l@z6;Z6c72r1;vT#3yRCW zaz2iqkK^YTkNEca#lydU{?7H+O&X7yj_2ol<9p$EuU=lXrZay^@3l$A(Egp7UNZTc z*3^PiUVPI<-Ve~yogGoHY*X(^@%4H0b2=h3qe(VY?zaAUxyhuL!kI-jukYloO*RIl z&E2-X|1XmTQ;T=~xL>h%fT_Lq?d$uuZ+k9x=od!Ji?7-46)gJE<{Q1Ia#wAn&z-ks zdPSu99gfdPGUuQo$-64knkB3G?`|<1*y=r$OdZ?ibw-a>kA88R7hTJoauLIbFOV8L zRt7b}{gLZ?cujZapZb8gHg>cp_Fj-Xbmax@sQ289BNwz^ymxT!$d!ZJM@|}?dr4$) z`z3qN&qW)wmrOc8w={Bod+FZu;*m(=91Mv?7#DxN2eyHCRq>F>dD-IJcCcINlVRx- zOCCk(JJzP!qTaS-s_F5bEr@dd=BNK}%9$;;vA1@MjlChciDPC1`o?zjtf{pnDV%SN z$B>Ta%CRqIDH?Qw~}?6Su>sa8wa>O93$?eZxc}R7U>#0 zt$pir`FA0=JrkMRtXsocX#Z)Rw;o5@KFuR@!rD2I=cQtsBDvdU_G(YUXL69YCHm-Z zxB1rI<+Q#!ux|h9Kri>1q5iRQ|Jb#`u^^gQ2fVF^*QnRNZGC?3fvC^92L}1S*G4}z zb$ZZt;he+T?_h+VVV>6qev7yF?_IpJfA2^aa=`e>-MPMhW=llV=>MC#_tBZiy?3IUUkTO zaMez)xcx`IzmT}++ZhaOcf0@k13gE8@UEdpUS+W>8q1UihJk|0h zv>OBtrxjw(x1#BI-%StXZhJPu*is9=7HNOsj=a&)uT6^IF%E>-)#A?(m9NAMhSrz0I%Hi=)Muk&0Jw{fJHtM^Jb^7}=|H1m-=q z7h=*GHTzYsY^yshAK&h-?>N)%AMIlMbJm;LI~u)aDpwc(ENI(v{`&bD|C|VI?X@59 z&yd;Sbgi5o>8hBDl)WE~{>=O3)Utyqyv8Lr*~i<9D-Y0thrF*1+BP+H4DB_Y1M9&ssYwrHEof9vK zMhb9k^SuGN2fmB7uzx?UxZh54#kkj>-3R$ci*x#NybthOB!3XDIf}cU8&J$y0O>lT zzxk;1)Z=GzEsRV->XX|%M${Q?D==rXE01#@HI?`JOf#=whUwkD?ZB{{gLTW}dHLu1 zJss)W=c32A<$1X;MZHOjzIM*8TT@!Jg>#Shp zuubM(1+8P&8qBPF!yc#BW6d^I`hCVdzxv%auOJ~f6C~?m1oKS`f74j+o)t@eR1wXUi`*WXZFae zt~39KE7vF2qn~XF);Y|KnDwri+JAlVuIKs{V`L_i#ci8B&OM*({Hinms#TG$?7egL zL{nSs!#eup9OQUyAC~Ov|HhRa&PV&i^AGficTCM!J#k!)%-RmgM2J~r8{llCh=g*l;D4@-Z%!BVmM zWy8GLaalay%L(u2WJVZGGsef)#d~`>Zay60ye`7EE@txFtWT>uEDmg z?;Br(^P!VH`%p*ikI!~vL~h%;jz5R2h za%lg2vUBxKIeVkw9S9!J9eKbTexJ_Vg86?*=bFBEn)9x3MC)khnnHVQ`>jK|ttz?b zbCJD2z*$P?t-ZXSHO5&l+Rhb@*T<1AS%#h`TF)8@evG(MEROWWRpL(X!j;ANpK9-< zY;Z1N&x<th`d`SVJ>o9aG|cuEn+SrXHh`W2>t<>|I}*_h1gLsdMi` z{_AmG*VnK4+ym=l`BAK3d5FvB2T9x4$Kv?i*|EML95Yl$ZS3rLF6L<4*2hL}jC2j( z#M%pD+dFa{O4)1pCXVAU2DWvNepvfE^pQx{u3Ot*=!J6$o^`}G*mFy z2m5zM58e{bU-RkCeD7n<3On+Qg30`_eRi@g*q;5{xAz~w5{%p2ifa_r%;|G@ z@exKIjvxP=Xm={Mwa3*v$Hk_fxvdfDsz<9&53Ym!T(ZuBo8IC1;Pf>sKf$%=pm#a; zKB?!i|M8btr~mUWu^#jWtuuQv>tWt|f03UzX&uk=a`qfxJMoUe-Y8d1bBEw`xtw}D zqgUlc6OpcHl4F)5`N6!t-srrcll=L|pVc1C>v=B9p6)FR`*{>+IC;31-Rc#u#P5|` z{h5m6x_H%AZxgSmFz58ogL3JXjkw={Go;aZ_j-4w%QoR^7*}622S(O!ie|f8&ef)E zNtl49D&$@T+D_*r?{$jZMG`iV!& zbGp}Xo_AN$tOjKV%YvGS>{aJ-k$bo^fp|b|ImKA$5o(xYSPQSavo;7^&V?(Oa7z3eGNAIz1$rKN>UqoMLK#F zZ$DMibH!z^@jlnsaro9P!AjlJiv4(x)3@T$1-Zo@da#Ecj6NBS@@{Q$pxsbykG1Jx)KfZS!XWj+eOO zi*v+*r`QhRN}jv5{{VBnF$CB1<{m)V#)d)hWv9;Uj6Q!R#}mieFO$3z{C)o%G`#NY z-Y%z)r{ka5JNz>?-rf9e{{h8ABj;TotOPq(t0s1Kgymxl(z!B^^gj=L`QAs@uC46R z$8PA%zhn=~b||=xs`qy1qR-*(SE!9#?SGOoVr7rd|zjuA|W~WbwpIV^j4B$G} zxn_{}2h~e4Ppl)XYJ3Hci_V){GgJnUV=o?=> z#Y;7H^jM2JYX6k)d)sQxG#g8_?P7V6Pr$&A12O`lvZ;R*UDN_jdM5 z=7;B@tFu}}dxaJovs!fY4lTB3THxN5DS7|AN0R>iw)`J{%$XJ2>eM?-H41kdhGjh` z>G+Gz0JiyO0H^ns_SgJJl526d^OKy}q|Mrnmwy#+JylY?{Xj|Xv_ZJ$9_F=A9gF!e z?X_RI%xj<0;pI-*gzNEb-sE0edVTrplk>Jj_pZ-PKJHEKJtTj0ZGL2Q%{RQ!Z*21( ztvTAGoq3P!d4E=)bKCY{j!eb!FuzWTp#5|$i0jt7W{kf5-bwN3?3~nsbdMV2Tzm3L z*65>o_x3o-Id;J`e$E?yzDe)xxY7)-$+%t@@Aw|B<;u&S*~_Op;;V=Dh?%}-U&X8b z&OSY_{Bhr4JkNl(1T$0a{-HUkV{7sKgi{dtcO#u^$K+&=A3wh7Tq)dZI$V(-nB<>N zg;$nbZ)YbbMGuGm!&<`UXrnt;qeaH%JbK1@tPhu9bp2zG60okCKHqZ&!S${gb(yn% z9pk&|lzUatj=Rs{Jez&q?#y3%%8m@2!|MuUYJO*wS0B6zsr;PADm`SmQcB}K#;^b9 zadOJ<`JW^nj=C59aqx+){ZY`48h+=RmHVEV9N8P$$GI41dTXAU+& z)OqU<&N=#x_8lEL&(52;dE$NXUcAbQ%hk_RKYpcf<9itn2fMw0> z9e&@&C{bPc*J1wpoXv6%dbupuCgb@F^1}V}vTXkSocFu)y?-~RE1PXc?XUbkg0a$T z`=;E3m=6y8f6Tpqd{xz*^?#C(h!OQdkZMBdl^-d_8%#n#q|^yW5D_UNQlyj+@&lqF ziTQy*9m$V^OJftb-J(Ln&n#)^QyBtaUzn zox5`gPM?3iukU$@dGEE?-utun*=L_~&%O8DQNiGxryF($Pj{`yar+on_Vau7zroI( zdap1ZX}AJr_SgdET7~!SDLp@&+QV#x4__$9S&6HBc5Y8C-24{L2pSF6^ylvRy8q}Y zHbz|+M!ja(_<_8t3GbcZwdupFHsc3J%k0dK)e2FC?{j1ojvt6Q9KP3qb3Q&9wdMzQ zPRklTe&Eh;_Z0PG2mGkB&=O|g1$ORZRGZH$&m6g-9iM5z`ze+A{PYFh9axWdOn%(s z+}SoQJqDZ+NnF$TW0Ji-<5wd)zmRcmubP(HjC0QzNgn-)FEw=?@!rRH`WskhUO5N9 z9QEO!eo|R;0_*=4mhL*^eGryznVxPjFS|chrMe7U*|gl%W4tG)er*s|ZS~clVbamF#9Y^k=j;wH$&aLcmojq}Ve4RZ%7}pRVDZ z*_X6GGWO_<&!cbp4XiQUho09vw*6|@wrcU~zz1og_YnE{o=rET>&w`-=!P}!Ge(E- zS(eq&ykJYJB`h^HU5Yaw_jI$K#cPkk`!=65?2OUm*q6*`>dKg`{hhflJYKRBNu1@9 zLoRtab4dQPnL`S)GczjR{_fLVmuK9KGtS8ipU&ACtl6Ivta|h5wU33w_sq`Cu9-h7 zV-4=yWmneV`W34>t_gMr>+vf0%(FX3?y31_9=RN+i+XWHaYY<{G6uC_-589!-aXu5 zLoLbb?qjznHVQ+svM~lbw`9GHJGw9T4+dvHee1KqtSvQ(yMnyChMsj?j(=lT`l@4P zZjiYzW8(O_yzGlk7VSMBpPRcmBdhXqTqS&gHP${GWK|d&x2Y(b>XwYC`A8* z@Domno141g`(7izIs5uxvyZD{CtL5DcrVnf{01 zGK}#Lg5vQ1aCdh>Gd{wpA4|bvnz}C zWo+YnD%^iI0>SJ*zZS)IOW4D&Ms+0SoV^ZQ!9{DA%5#>V{2xZ%kKQl0a@N_~;*qij zuVgm=`Xam<=jW=f$KFeSKEg(Ut?&7ih|egsjU}G?e;B89JKJtLd$ebpUu|Qma6nR#g)~L@c6M2t`Jpc)^^HMam-)Vm646l9&=5~sLZ&2^Lf`Hf^%_pST$u{XV#=#yavk0HP6lW@N*pg z{Vf~6T@zQG$gb>D(Usd5pQ$_dymNDF=6@jr?V%1_L000E9TW4uTNF(BF7IAt?a#)V zby2XU@I2J{4|msW+I`kKafY5>p3#-N`M#pyzBlt|xYiaXeslZ&{|<2kHz(~Ps_ByT!fPD^#VkGx7+iFb9i zc86EoNtXQoetRVM*co*hr+)7>VrcB)_x3?Eyad6gwIj_vyzhK{p4MpqodL^^!Iauh+>;lsUhl12vp6Pr548_mtLy)1MhH z?AkSb@XUK>X5Mn@x&>2?Oqp=~uImR+t*lYEVKw+(;kmgZJ8#Qa)<65YEL>@?!Ik#l?7Xen88_Y?UJG=4moMX`A)CGvtUvd^ z^H)vG*mG{~vi>#mZ^1F2*DJ`bX6zUx@I~o18NgN(gv_GJfuIiM!76|ZJy_QyWYPGr`cc(msu`;wl=rQ|c|7|s?`Pkjk` z_@ozCkZl)tuP>REPKU?9;WOjls#S4G+Ly6yctzg&i*Ozq()-yFkMzE;1Xq?<9Pq9n z^l444-K?P`e=t59rlZ);sR(lpc%Q?}s617%VB(R96Rz8JT{h;nW>@-kjLNf53GWjm zJTcgi*O$n?GE30(tiB(7FG^S_x{sb_;u7mNyU(y-MEIxs8kD;w+|`o zJ8;O*RRf0%{?@=D$xA=Gt8>KqqR!#b9p&B?jW@1(Y50v9FAcB2*k+#j?UwNTF=()N zw{O*+-V@JU?ZWZ?Tsmfa<7Xhg@iP$L_!)?A{0v-%G3{Nk6yIM;1yk1USc^~RytLDc zq^?7AYIAn>@S2s+;JP~dotjOUyY5pFY#~TyY@0au@WkQ0%MNVr>Xo5=n?93Ho|_6k z(W9KeS(1%nRs^z_q$PYhW8Db z-W7PypwFSGml-ehuE?IWVeR{#5|+Dy?vphv z`}{S3{qnG~y+!*bM@LN7tLNbyv%Ru&{QC1IWT!uyQWM-4FmL^N8NXs1(@R*ZW{k!i zj|4bz=H8(n7o*$o*}wDfxwc{1;s3jGSG|NYcWzIw{kntwZnopi_7neOayhJ67E7!-~eSZe8g!p-cM^^U=E~)IjhpXPb;kA^lto)AY zlbu_}Z|*AOyOp?NipR&hC&PY;QG7WE_hkm)nq*|{tGMsq6>Qv7)3T#S|6{-OuaxZk zWi8wHPI=XnmyJ)}MCTo>b7y=%lP&+DTTL0;)>W)Q*}?a%+q3x_mFM;p>&=Jn_O8;> z*Bb08uLPD>KG~V^(=8QGXCJHRy0&J|k9zFEMQ`*p)7D_7t@>3@t={)9c=Z<@L1B-# zp$3lG&j#R*>BxWoL$E$)%buFx+~A^nYAOmdGJZPzy6s(~*B;<1|En|S1$%$r8)wuS zUT^99yF3=0JMwkB>V1x5-YfWQcHV$jgX-1cw_0$2Zu87hLEaxuU&vS3BfB2J z+B~YqmR>$fOC3kgXz4I}mbK&OS$t1#`h>jfhjVlkW>r3ntM?z`PUXWnYbO0Lr{A@u zcRzb~-lTJ~D(|`B?i=rxZw+d=|K_7N@9fO$^>Eha?1!`Ra)K?zFYH~AnOO` z^~(DE&sN}*`}2Q|y9v)%6is|!V(xVx+)_X1*qljU+5MI4aNg>woDt1cp1IJI;a!<) zhQEy0J`V@8@jZngYev^G@5*s!=UMi_u`@;n^ZtrO&5P@k7X?{sQ zmN9I5L3M4nTID!PxyHJt5n;LR)wZ-Yw>Q@`HzwWlG{+{tGOTv&u-dO87(8lmSzT?? zqDm!e@#NC#*4l=qg$fkUxWuD+@!Zyq7JIrPAG*rtX!>m=myAp$qk&4t|0y09Ye#Ul zKB6NX$xFYOEcqWD@Ldk`S$%k5;_YE=!|Rsf34C~%Al#P)(Q|?E+(0}b^oyt_k`Nsp z6-+6j;F|FHwv+jI+sGI`=`@K)dnVJ5GW0v0(wJ*rH8(XbleaB7bLvgW(h+6d#xj*` z#S=N37bh1iUb_5)`+KDh7WV~%O%4nIa6*6>YF>7YLhpG5AB_X zhi9hqTvoS-$exkQCuml;ceLWMrHu=l@i6N}i`&jL>9LYY?5qYnwiu9c|%*U0J57`7Fh7z&F}j;~g{D z1Kp44aN+D>PIC;ny8_hD2jwQC+0H4Nj7oSq)~e!U+oI-<#@cX17FFZ;Z3@PHv8S^W zx>JlNwAbKa;<3Glj@LJ%*`{JXd{=Y5+pwC&KVUFzt+R-^)-9CKFx1@+3L8pFIL~kh zYlEBH!eQ-ZOKL_S{~B9pL2;e)9>w%_xQ?0qeB+0}Xv07GLbMaPZq(mvMl* z&wwE%$irBhT*RgRZ$# zlKw-G&l*JJ{gGU3;NM?67V*cy@Sg_;hDqP2$V9hR4tFnt9suB-LqUwwjA_?mA2%;)!0#y_jC8FSnMKVw3N@qB*L~ex-L5zM zhbQ|#0MNaN4vU6bt`NNF#L;**OE9bry|v?r`*uMcV#2=fz^_>Z)mUp{C0*3s)I58Q1){3~s{( z50^A|A;pJ8FTj)BaY=)xRP*Y~p82c`EiQlEUIo|_p`)wh@bT>aXuBs~w_|s-EpBK} z@9?uk_&+X8HPv`ly1Eipl1kc%)L$oYg&19)#mqhYdWPr4!`$(_?PPm%a}rBeV`Ho^ z9vsiLuiMJrv*lARlDbbRSEY{DvtBdxSV}X{ofOX2=jb}V`%js8{f=giYlcfk^qh7* zq}ThI340zo7ZL7KURQTNkh_(SALV{#ayWlK1cQ26uoy2QbS0dgC_M$_E>c_;e&}Nf zR+I2V;JNt%rt+GJlan>oE#013A9jNe9mXqM{sIS<8@R#*9?IUz<2pUb`J8nA)I#`x z_-N{}n|{;vc>V8s;SO*7TmjB>-lR|+Gj1B+ZSJP`ws)Bl-Y!@ctxhiR zGY#RcJ423kdP^Nn2V6?3Yw^1&oYC#gI-_Fx;#lE}_V8%47Ne5Ns%@@oYx;b-JXl#MDGQ+Cy5!T3pNC;YXcAY&Y`S0cN0$;h&X zvX;`S#bqreRn?>#((=WNI~q#~)zyoe4H{e9YCt`G3TO|W#HX!S@cTbqqeS>OD`@B! z1k)nT(tJ+0ZI(_yb2%&MUOqdP&I#VgvXWoLpA0f4Ibt-%pTclWhMFsQc$&KBt=L4Tv`j z`$OrO7>~h74|n;i&@g{L(4TJ;@Z3z>Y=6v-rPq1=;rK3!<=+}h-;0?1`tb4gZs~m( zL))yq2V?n@@iblKSD-(e(7r!^ws`rB=W%a;GJQOj|8^{WXRN)qyyKDOb92(|Gu;wP zPmZOR$I|m+=}ocpb}#)i?8u9;Pxu^k&8LsOe766f7vC|=hrh=7COv-&pOUf7#qbc!W*wz^!w%L4|A4@Nfjo*GRUdB_)ofmF7!9Sy8la<8N>zF?&R(?1a z*Ko@T79+L~5Tid{8@&8~Mqk$;KMB9$e?8Xz8?p4^SbL{q>Fpf+aI^kq#>S&hEWMYL z&GQe8<)>ol8Q%D_|GW4j6JGi0F@H-eJujAiF;@PWSbBx${~^X}8TOyfM{K`WY ze??yWx54`u^8EGduvb6(^MN;?N5j7f?dkf0`4heQ(ieGaG2TPH_WF74%|iK|vHZ8Z z`oD|#4rJ;7{a#$eSsez z4{n$LHH^&;#Nf}TTCczP7(cf0dH5CIO7D0=cDRkhF_DS0G{^55ul_%x{^8JcyodA2 zD}SwfZ7>=WBoniW`SZN~?Z$QJ5%0GfR>mQH3 zz5PRfZqn-D>tUux$MVN``MkE+it8;-VU5R%n18nCpNh8M!1!wZvi@1zS>cuwT!8`n z3dSgfwCbDf<7}Thvzq zzv8R+@*lz6`z`WEd-;pJe8#`iOTUD%xD@kggy(9m;L@sCeAu6|B;t}4aTbg z|BAfwW4->`YZr1+1 zSpRl-`Q?ZwfqkO$J71eT3QcLoThEi7S06qE+AY1^OYgyWy@>kwl7!=xjWn-kl)f4D zAM(4!BG%p^FZ~D1#~1O>U$6Rk{bBjCSbDyfUWIrT!lUv$mtBjsr^Lm} z@}GEqrW0Iz!p$8ovH3L4OE)66@1s60@j70Hd*kyX^z{hx{q?B7SO3S@zrRC14_TET z#21_4X6;YpV(g`-d->xqA0{DYhNSW-ul~V^?^ta7=6Lz+@1wE)Z};*~V!T#*^X)I- zzXS2=`1lU;o<&;ohp+7yL*pd{dj0zlWq%JpstNtW02ibF zD_r_Z$bTPoYX01c__8p@7>20+!QS|={-#)Zte2jT^8EcY9&(Crj~7o7%HM^2E=kHS zW9P%o_RnZu%z5dpUio2&_rK8}R1=mTkNus4`gjSU`j&fs#(OH3el3Tq;-6-{W)I!OwWy_+hgg~vGo11^pmM@ zaPU7HuXnusxrk?5cK7SGCEVHJmJ_VQc#TB={QmSQPUkbeF<$y%^#2#AZv-qH58m4t z?e&-bld*U@z42jw%4?tLNwM@tp8q$9?*r7&DXsnao|n(^GkEd}H|zfsvGj<`yXV)( z(kr}pn=zmIpnv}SdC1FWd+*2UeDidf%{SbhDy z_ICHd@q;p&f1_~j4zkMM&?5pHrISbsT@WEx^A_TotD*X)^CwK_4rKS7;3KCXxVG59YES>L;DYaJ^ zOP`4O`*``?zw*@pgcj5J?n zd49f^bI_Ylm6-qUA&p@P{oTjoqOd;`qWUd8Czei+$3?O6_)M(4rPJjtoi6{GSourB z@^?n<;kO-d{QnX0>iU!Wf0LL0IF8@k-s$rL^IN@qrjNza718)ud;Be2+b#)yhvWY; z)Wr1UDhA^{M-K+IpHkz6-)@_nq+Te8%|F^VR%^ zT{JvvWnusQJ^Wg)=wIpOGrb{}-W5xqjHOeV60E(PsQ;Fp7|ZATwYFLQHZT9P7?0<$ zCSD4I=HEdt{|6Yq|ATy9LNWi3xj3KUpZfn2`u7E-M|tIWZnw?a+Z{{qi=_v7?QuMo z#L|6Y>C;|$-g|FB`@_8U-}C$>$o~z-pQjM@Z=RPw4fAsV`ZwI=7r=iX>QkEW?DPCg z_sX)~asMvB{P`!8*ZQ;>^Z9C|N4WZ4!}vBL%{7MYcb{K&e}!|^HcO|Eug?ZKi0@0N zvjm1S%iH}n=GkWHc}ik0G2Zm?Xz5#H`7N>ZZZCZT`}ZZ(q2uX%r2h$N3~3MX*!{;b zQF%-A+RiphFIN(?j`6(^OHcRGyw~z8cm_bz{yXI5v;2-&`gkmTI+iYr=Fg=8f1~-2 zs6*H9-S>~(53PvGTY6nAJvWx#6-)EC#BCcAd=LAw4;DkMH;g}hzP0*K$&RZ4<{$IQ zGrcF4zBiUmA1_0KH!=T)p*`NR<@j~K{)wjxWBH$tr7sKql{+5WBK+%zcM0xrX=>P2 z!AZ<@ZA=#_fxk@eamNme^$W6tJ-C+V_5cphet13lRb0zyqyKNCW6#QeFV@}xoLjWf ze(7SRczh}5pB>vDr3war8P9KH<-Zo2zZb^R--)H$V&nPm zvHtgQ`;&4%yh?75?cc^&|JTRj&yU6Tg;;-v#r9WKto+Vcx-3>7&npQxrb%$#m(4&P ziGSR9ZJsyVbh31w=TfdeSJQKgdC2ncykG2MnCbCYu#Oe7{487G`smj)fqpmEWcer2 z?{u>C8Q{FR77tna0&v2O*{$GwzL3C1mZu3^;B>O|mEgWOpK#lVe|+D9+a~-|U&!)r z0jn=$>G#vm$%lNDCODC?@w1rXnPm4~?Obr4yYMBeY%M((TiIK|ik~b`6Ik(+rMJ@03mI%=>HIuR zfz!#-SAzTIoBu^{UX_g}SsvWP3i9TgPL|#etk}rX2Y?kDSvuE^{6W?hSvp^96gZtM zJq6a-lBJIYC-`Cq+hmV2v5GY-P#PxqAwnPL{q1+;@oi zcYyP%@jq;2dH5M+#Xy$63#=H((s$EeXmygMKTp5Y$H%J!I*#sV_j_*vQi7gYz%9`pMF3!39nyOJ4%ctFd~>(mTNko|LdX zPA)cn60Gqj%fAb(@h3~)P5%fhOP2mT{Z1!K-v`#Q%v{V@Hw-seV^ zew2Qvlck>kYi!BV-vjq8v3gE|6$4qG(_qCwmi{6AWmc9f{bTx_PL`gF^SojpOTQSL z?-FF`1HlC@L6)ARzuej-OCL(V)5+3{=;zH9Y-H)YPA+gdS$Y}$qs>p2KAL`~lckTP z|4Q?drC&|I)5+2&fm2tRe=0by*5)Kxo|)hTFKV#OCx5}X9$Y-m_)f6qGg)P~P3rQK?hn?r99i`YqF!hHB}*>^ zCn~HSUau>DvOJT(#k^p|HUq4=N|t99SaX#ueGdH-tSnjjJo=qZmfi?f3}or+z=>fGY#4|=@K^YHr^+P`G=o$rHb|B|Keq<^}_K$iX_{Z1!Ke*vuhOP2mVIB}!Z zbDAD^Gk`2lFTCE$;{^pavh+US#0)Fj53Kmf@(chgezNp@`fswbWa)$GcRE@6aInrD z_29e)i-#-^zjLA($kJQEih(SB3H`Gy2D0?!^gEp_eH~b1NS3|@T32F=`g35#K$gCrIxhgRk)GyzBRaVb7aALmk4sfx%uHbjU6dPG( zp8zX1vh=6uueN%~(x0K<>163If{PcJe;+tiV|;*IYkUNps55@e<2S&0jW+&d)%i9( z_2xeXPAxS4ki5va5AGS{Ew-{`l`W*+WI9>;2yo(3D_aiMn2_Ze1J;<3rH`Y(!OD`Q zSAYwgPL@6$tk>FP>9fJbw^}`0=xMe%$?`l3PTXdmo%FPrhb+%7&+{BueId*90$6<^ zOW#9(qt#EAzK?#VlcgU5>o|HHoLFpS-=yAToS6%~*|;CM#W>&N!5$ZR{xY!QC#&7j zV8u_CK9>I5t$woftLb+-S^6|^qRsp>$nC}pJYE6T^%7ZS@2Bowvyi3l04G|lo}J)g zS3kc;tiF)te+sO=kflFEe}~mWmi`?5PA5y>3oagFetu_EZIR`91+2En(ht(V#LAMT zAEw{wWa-Dj#dnyW-(OT)WO+`2)fQR$Tl6orvSjJ+(C>7z^wVIiZ)EA8fQy$|J^a9c zVj#=Y3#=H((tFdt+{%)r^YixwPA5y}eMH4TmOd1$wX}sEckMxzXE|80k)^KyD>kz9 z)!@{f7F#D+*B)ef)`4~HL6&|mSjQv3XPEz&Ru5SoexIhm>165K!F^YlpWg{p%w&0X zf)z7a`jhm3-O7@s@1o!7Wa)dr8c(wHLtw3eC%}o7R_FU3e@tFwdS)N^R~zS$+l&W* z6Kjl<Qyth0LNgEeksd1}ELH?s6a z^sl$FWa<1~YJtjqi+L-aeHEd6nC@!i(eesJO* zJ_A-fWO<$gD;~1+7wCW3%95q;q2K9b=|{jiCz7SV15RzXdfo#o2C_US!HR(_{WSfL zSXr|459xP0Svo&6S^TK^^TCP7j0b_$E?NG;V6{t@UP!;2t7Pd#^gEp_o!<@BnnspB z5v=*ZXNxEXvOH73ih(SB8vX8EPnJG|ey5YA&jTw4vh-H4VpsvjPd9}dzw4X$fiXY( zuGqrQ!J8axgs#}gs&f1658fi(_f>HEMMhy7s1K$hnKSTT^LAEMu_lVs^f=yy6<`U$XNAWMHAtQhz# z0>wa<=QLO`kfnb}{}VP2Wa<1~Pl40P(sM6N$3T`ok-EE9Axr1y#S{-&`V6q*Axob{ z|KC_VWa)G0cRE@6BCy7UEWH(6{G`>h0-X3?#+}rkGF}T-Y-E+)09I^d>G#n8Ln}*` zelPt_CrjT3R%~SHPlDAhS^6%p+9gZhP5&-ymn{8x`khXeegLf3gJkJ^4_WP!r4ItD zU9$AS^gnIwlBE~Y?{u>CF<`CLWa+ik-P|BcZv-cvvHDxVij6GK60l+;OJ7d^O;(mH zeFgnaCre)o)^+R#u-YQa!|(p9Ewc1`>3`PRB1_*&zthRmw}ExOcmj+cZw$9*Jbne7 z*JkHdvdSK&=SSv023DM8d5(h>Ct3O%^gm~1$9fI!pIAL}!HR(_&wQ|AAWN^M|3xcHmcEF7r<0|(gB1f=`kmn7zq5Ka z(&IiGLzZU?Sh10%-w#%7Wa$smzsKq%OW#Jn)5+4G0qgiBOWzMpykzwp2B#dq=J6XI zzX{H3x4BJLJs;Dv*XqgahdLei2IqB{pDh2y)ZI9crStpwc}vVsmRiUZJHr|u zvh*?Z|J33kOCLwS)5+4OfVJ<)()r91#ZQ*r1WxR;`d8A!FP>r}%d?K2m(6nzSn-qP zxfiVX$0?~eGmO^ zJtRxtN59j_(hq^PPVyNkYKtt-QLx$~OMi|2S1eAl^w;TkI$8R=VC_4y^bf(sTdkg6 zdDs_!Z=3)ZZ!_leRumg~q{+bmuwo-i&j;%|mMnb`Sl6*+>BGT#ty%_79Iyt)fOS8X zJkqsW;dv&36&qQeDPYA$mOc%v`>|x{Gr+nZOO`$ttT|H;PW-h6(MtZg@e;6NAdhr$ zE(a?Hvh)>Ty(T3~Uk%o4QnK`Wz}k0Y>07~CGk1a$zp#d%18aRCk96@Ir|#Ahvh?@B zik~d~Bv|p2rJn}pAF@ix(mw~OqMS);N%*Po@7Ktt?skbo!l6mOcmE zcY*mAfOUNF`8)YXO()C02wdQFvUEO=C;wIRlcl$S3!F}tz5=ZILzcds`chky$5m}xO zz}iP-=^xSmPga&J{S*3~PL`f~Q91^)^r7IyajR!4J?=On%QN58$4IwSTU33830zyWa;_z|C^O1OCLnP)5+2c!FqjB0#;jOdCI|R zi!6O2IPWhlezNpM)K{2JmfiwRyk)U10jn*tJj=mqi!6Nw{lB)dWa+EvcRE@6Jz%}Q zCQE-1totx8((`qTlPu4EaN=!i>mXQhlI1xJR-9z%N9q5Kl_g7mjee(-rN0T*_`eTM zykligQ~!5ke$gp!rNv2B*(CKPPIFqH%1}EOLdgg)^16iK=V8uX|UQ7S)tSnjjBKn<9mc9h6$F|qy#Hfm$?`l8PMkJ< z4_NV#<=F>TJY?yw(EkT3OO}3+ey5YA9|P+%ODDj2f3&h>dENmhJ~aJ(u;L-ha|*0@ z$kIQc|39rPS^7uxJDn`O*Tw00E&ywPk>wcxPW+eEIS{OP$nqq?iia$HDE)4~kfjf& z-|1xOWnhiZII!X&%QF$2_-~763Rv-w<(URnJY?xJ=y&asrO%?@>165i!HTCAthUJV zECQ=7vh+s!Ke0H;(p%_vI$8R1aNnKg?*yywWO+7%6Zi%uw|l{ghb+%lu;L+0e}I11 zN3!&X=yy6<`r}~reJ@zA$M;jOvN-vSM8!Z>*+XE(K$d=l{tSzsEd3b$PA5x$3#@g9 zEd3N%uTL+y1n2HdtFu2?@sQ=e7_4~6(g)Jd2a{tXOHb18bh7jmSn-gh&jc6uvU(PP zQ`yEX;Dq~P{hj1FYwjl_g8x82U{oOTQniILXp?QeSQ7FS7LA z;8d>F^CCU&3z}qk4uTWsndd0|?tvZ0!RiZH{x`tt3t9S`^q+6_kfpy(zthRmPl44J zvh)k`G3G9Y{vH>CQx{nMDX?NAt858av5}>h)9=2lNR~c^ey5YAPXsGAvh-STal&F~ z0;l>Kw}TZAS^lM9#Y2{UC;k1bELr+W`khXez7ec=$kLyo?)E!b`U~Jxp4I;%J)Q2_ z%=7H`JcsGwm(sA2RnL3WyR0l(`e|_LBJ+O$*1Ew5F=-sg^7jI39LUmp(?7uKAxrN= zzthRm2ZA*YWa&e}sn1wFv*~f~zmVlw09I^d>Gfd6MwWgn{g;J95|E`g(eHG!^d;cp z73N<7PVmco*gDCV7;h)LFZAyu7nuGGxOkv3pO2|H$*TW(u;L_3f06#rT3NF6z4SYs zEd2;rV@Q^M9IX3Gd}gU)Aj@+CtQg4B-=cqz#Xy$+4*gCiOFs=(3}op=1EIUu+GOct z!NuoV{S(28jV#Y(uwo-ip9R)yE3)+Y)ZIO5vh+pZ#OJK7Ca~Hf%hL*0TV&}==y&&` z$CPO#3!o4{&|EYB9O+9FGT6s&%cr5^+*_{C6cC+Ts=0$H99=^0|4Prz!I zEKlZV)9sR_=YaEX3abyu(sSu|I$3&uu=>bnuO^0CyG7u-fky@h_Klclc&Yi^UJZ=t^4 z;wMXg2%OkzYO^e5^6y!DYReHZ;sCrjT0);(3S^aIp4SZrkJ?^1XB zf-JqyAjCY}+U@T#zf+sI%=E$F;v!={Ls$JGtDfOt^@}V$MgQeimMp!5ey5YAj|J;q zE1%D+w#f2K0IMys^hxx8V&hMiJ_W4nd9w7`VC`SB^jpFDz9F9ptQg4hw1O1_S^5(C zKd~6d(wBo316leyuwo!f-vZY4^ER+zAj|V8STT^LKTdzj#+)qu3HqH*mcARTG2aKy zyUXSeS)PO7M6uQR8a?j&2xNIq(8DjRV|$N$h4D$S;wQ_08m#!q(m$mCAsa)o^pC-M zpM@;F*XI!bLGup=t1YrTg}EiN#5lK7xLylciq`&f93?LzX@boL_47kfqN6 z7dV|PeLh(AkfpbP^UJIrvh;Rvfz!#-SA$g#S^B-;{E=107C|Ki9mi`+3>#csW^w;TkI$8SLV14fQJ#fN3 z`1B-L?ULm`4OY8k=^xTR+F~Y4|CoNKlcnb*({n5V)_ozeJQsr#S6ZEez>0?~&tS0P zAxkf$|38CpBTFv=>%I_KdO29<;<4bw7;E=xu-YZdKLMsXr)*8MuNJd41It1O--u;L-h(+XBRWa&%jA8TdF(wEckbh7kLu*Tsvu-YQa^Ey~< zk)@xY{|nX@S^8V_JDn{31F+U=vh+{DiE&m>=A~)o_oxzIG<^{HFN_C+6(?Es6oM5e zS$YxuOM-ACOCLeM)5+4ufcrjf{tB?#BFi%othUI~C(~b%5f&y(p9(H;I$8Q$u&zVM z(wnH?ZR;didM7wBJ|nDuBUrJK<=F&QY-H(M=%0`gmL*HSA6(#cvh*jxij6FNA9eTI zge?6qIB`uzSpRDtp8zXPvixs>6(?ExJM>S?2Z<6+c=28DPavmOhJqH?PRj=g{wTvh-ST@wL`gJy>m# z<+&BCw#d?(=zk*&IUq}KrQhjf>C3@=|JD3!!D@>v&jzsCB1?Y&tk+p&>5o&tCo`;+ zEd434-gnpyR$F9wo(HQfvh)|}pKN17mcEyMr<0{00Baq47o7La%rG9ZJg2~k>#WWX z!HS10&&OcJLzd154d+j>vSjJKzy(exOTPfD^K5@`;(9B4F<9-AC@j z4_Tfju;OV4D;}~uOTmhVEd5UUUAtuIE9rMSS^5UB;@JXDU1s~`evcm@yVq;m$WzU8 z44k(qGn`js)%gZEaf5l@0xN#9Jnw)NKUw;F^iQ+0Wa%gAcRE@6N8r9cw&Rz-|Dm?X z@?;K8w?&qo1J3`FwMCYmOTW{}(g%Qbz9vf_3fAj8{$_|`Aj^{itG{IFCG@)o5tF5t z)9-Y$^a`+IAWNT4{ady#$kOM4`+m>HhrcJI*vRrM04p}K^m_VlwDBQJzmkz9wcx&6ErtzX#Xy$l91J*J19$0OW7Qk7k)?k~zthRm zdkssEIazuiaNobPG4BU1zS`>KZ`LRtviui=6%SeZK>FP|nk+p@zthRmi@-W}mxI+7 zS)MUqwMCXbj(+zbRI>C6`khXeJ`Jqbm}Kd*z=VG!vi@;iAo4|^bEKe&~ zagwDkq2H~gWa-Q4cRE>mCs^}=znP=9$ntCit1YthP4qux`;jbt3;j+fOMeKg^W9Ex z!acb=yy6jUkz3~Wa$&=ck_)beG>gnCrh6J)>=fCzJR)0C&|)p1?zZe0jIuVaV`ZX9IpT? zX0pnz1}kQ=^tJT!p^4bY(l^lWbh7jZz#2oc^rygyuUb93J$?bKc*yea0V^J|^nLWt zvwFzVU!mXWWa&r2iia%y1UOM;^}J1&alXMV4nO zSZ$G|Pp7}e+9FGzNx##{(rdxm7i8(J;8d;Evy@zC%-^C?JY@M-fE5o}`f6~h-pY1@ zwO`2ctOIMmkfq-X*8PF|!Fii)zmVnG22L!r`ged88(E&6V8uq3{v`d2tSnjjF8ZBL zmi_`*`(+PUZIR{K2Uc5T>95f5<{nx4LHeCemVOMZImzGm%5ShZ$@07oE^s&J((o4XKXAD^5 zNtS0ESn-ghSJ2;RF_5KCq~Gae=`+BZ=Va*{z^U787^G@*DxHEwc1u^e?fpWa-E0cRE@6 zTVTDn@*X&Ghm}1=UTXZI#~*_g4_Wo_hdC4vS$Z#U{xYkFEWJ1VPA5z62Ug$t`*ius ztt?rdi@^m>Crcj+)_fyNF9&PBO$H~vW_3;nt1o2vXM)uivh>;XyE#UdK9_!{lchI; zHTTHU+rf#&7QCgJ6vt zS^68)x7gZCmi{(4waV&$2dvNJoCYWEH2p(xakKHq)K?p47J=6o_a=85UqJ3M?oVE8 zoCK@yWW_KPtiF?_52ybdR+cP1MZeR@(o4YVJ6ZY!>i1dS$r)S_)Rb$g2NNu=+)ozLNfpRu5TvC;d(*OJ4_8zsS<>r+&B9Lzcb` zoVv&K?O^q5C%D-4m%mS#_@;SwkzHS21gkG()wvg}zL2Hwr+<^xLzaGkey5YA9|Ef{ zWa)2E|CZH5mi{(a`{-S;`f`%`z2^Ub?BdV7JRLt-_2hsRKUsP%{hO^Gvh)k+cRE>m zKd|B_OCLmii`7GxUI{Z1!Kp9EH%Wa+c0 zZ?$^J(&vE{=K`?eYyvAzviz-J#YvXFg#K?^{bcFO>32F=`Ufg6|$kLaB73XrW;#><>oMibofE6cM`aSe-v--)>@1@`A zWa(SMijyq;QLxV4kCU6M&L_Y+kMs9>6&qP)cYzffS^94JAGUhP(x0c_>165q!HSJ6 z{U|uG-RgM_tQg4hybe|jWa%g9f5gg?rN2eL)5+4`2kZLtBv@^cE+|CQB4mOh7mr<0}Ef;IkY!HJz# zb}Kmbgz@9lpEQ07ocF)dta_fK|0&a-2kZFSL;Z)QA0YpY@nLY{uZ@p_i+33xr{`(o zkLlTM+-pR-U9#Hk15W+OJQsk~Zhz{oUH-m7;#uLE)XL%-9>(kFm5&Xd4ui!9F+u-YO^pGNbOi zR?ilCzHRF{S)PZe-)}lu`VMgFZ>{X(^nAlSWO<&U?mov$mi{7G{UuA^3s!&0()ZK< zg0)4Ket>?blcgU67yrck{7qxEMV9Avu-YO^KSBSCR+cRNE&82Kmi|6i`;ot2thUJV zoCd2cvh)w>|2u1oEd68polcg{-#^xVBunoHR=Z^B1HfvRESLg2_LBG?<(&vKJ7JsW-ZIR`v1*JKIRBuPB}?bH6*!$Ny#=g!OP0Qpx|_FT=?{X7 z-T2_Go*;3^+QKpx6#vqgeNQ=_N{?g4pE_(F?mP91topeh)i1Ji#-?N6kF%YAckGkp zzZ0x}k)>~-?)pWRz6+fAM~m%6dfe{-lI7VCP8~H5A3c+J)tJ*%&$1xPpNZ_$|2EGB zk)c2MTeowt^%=#0*F)jzIUu4xk2CROO zrH`ZE?Q6313b6V`mOces{EoFX6|A<%@=OP-Ewc2P^t-mm(r44}bh7kXu*Q%qy`8!n zL$dVM;NpL`*gCla!232=ea z$kz9)8OLwtRAk7`aCmPo&jLRMwXrrR%~SHgXsSq{)de$eK5Gd>1638V8uq3 zJ_elsKK_S|EPWif!0BY^)4+NkiY%SGJarNRHm)=33t65E!0HQGI@fv40kZS~^t<^+ zmd;~eeIZLPqweMaS$YMy`1ckYkJ-d2<5`{_#((<%$MOHci~j>Jey4M7)bl*a>N~Gn zQXiVX$m4Rb_7PeBF<|W@vh;EE|EJYMmRvWj_L^E;Kz8b0d*3?#=n*o&!LZpT|O~uX%X> zP4qJ^1Zzyl^7B~GnE1!V2>SD^ELr|C`khXe&f`d9LY6)Woak@$OaUtfvOGMF6a!iM z4Eis!vSjJA=yy6<`W*TPn4c_t9{o-yORuH>Gv+5tUqrvt$Ac;aKNSDNMwY%2T;O!F^!ve@pJeIVsZ+p4 zmcA358fN;F_@nn7$nrc-osDB7OWzAl6`Fnkf3)@<1gno^`45BDN3!&z^nV`z!$y|= z8o0peWa)2#HTTHU-vg^%vh4WJn zwz6dDh4ed}EWHG**vQiRgA-R+Jr{!&16iJdV8uX|o&@VRZphMk%~Nm}{)f%K{uzOE zaf!7x5u7MBo(xvIWYsejtai!Lr_=B1Crh76zthRm7l74wvh=mozi%;+rSsY&Rc`vd zV8uq3hu0g5Eq?8hKg!BJ;Q1e--|1x4^8{GelVs`7fQ!qlo_%1&K$hnfuwo!fKS=** zD@&Gsn0}{|rN05zcaF%?-vJkow0gpMJI0uEATicB307=mmF0d{Y-H)f!P<9Z=_&f% zz9UN?4KDtIwZ-e+)Hve_9#8go8u=>og!7~~1Z-!_6Q}$0WHx;HU$nAh#V{9K;B>Nd zUMFi_`Pa-#p%-6m^=t$u{=%5^N6a~ssxW;!dA#wX;Nl6!JHQ%SvfAAV*4UDzKS{qE zL$dT;^gEp_eGgdilcjSGBwRf2(({1DLzd?hIOXE}0IWF4^6(m1agwEfLjN^ZCs{hL zlM9?qmfnxoMK$IpOXqd6?%R;1^FEcvf2_xxSBXliryQJeJcc~U^sB+e*BVdq^eG;5 zE+w3Y^CabXJ~(fil_e{lMsQ-X=`CQ56lPo<5wDbFE)w z)t{oiz;v>7-do6f*mVCs!*b{;UI=4*9-R1+@p1Ya)2w>lq<^~U0siD|PqRF^khEX= zfHe+ec@kia16g{1`ftSlu#u%-3@&gwSvoHZ)oQ8|s?ct6JJ_t7@nPHMB1a7S}DVX~CZbb+zq{ZB;F|RV}G&ZKz)s3|$(8 z<$JEGt*))Dp}DE5y`ko|y7nrx6ZhTG+R$EC)z;C{(%jl!S6kK6+<><0n_CxGx3~3F zz+y}nSlHU!(ef!yv{~0wi<%dkNnK!nt?}x{mZq>JKg*hlvU(h-#nnrz>RYQ9F6MAG z)-^3`Uvx%2*2JRfrrNee)wk6liiKx*T$dUaR#i8iHMg!6BVN^1y}0h|qf*mQd-lw_ zrkd7eE$vn9i|U%H7FXAt5k`God(EP%hNhN|_Gm}f)-C8*Sk=%#hi z5jD+=IRa4`j;wZkLsLWdjQYlgg^LhGYjsoGV&>H?ZmUaMY8Nf8s;O?QK?OCfo?cf| zyQs$uKR~|#gQ&$6T~b$dTivp@Zozf5)K+8CrFTkOdv$w9TYPH9XIi(Z*|XV=G3W8( zbem!D3o-vuW3{KVvx_+?VtVNJGe)#FwACybQQh9&+OVLby$+#<$E-hLYnq$ttHOh` zrn&jH270EBXlrln)^i@yZd6)Y>lRnHwb!+ttu7eq>sryHx~k?@6pAVe!^2MNXo)0_ zc6vDPXsvGXGTBYotHL8SDpJ#4#YJUti$9Wnhtl=6+1y94GPgEk4_1%(bM3JO4xOr7 z*xcSw-OjbCp{c$(iVE|(rn;%BHm#)B2^@c1%pxyyTI;H7xfFKGKqYMr3)4oVx%U?| zv}2KoigQ>f`x>jPX=qu53Ol$icHlVTLL3#ssCDpI#I8$=EEVqg*1DF)>Sa|mi|T4_ z3q~|Gx7UrhcG}IwnBGWhu>2!taZ5v_vzEoR;SyBe+PoP1vu#n7=@qK4;so&bT0Ckj z-8DTHoEkg)zgr{1{7 zDqvtXBEg8p#wClZs%vYpr@Mz~Az3f{Ja5FR7If4{UBez~=jp9#d0lIB!}7W)gX6(I zFK(`_v+BIwcXRps+Same*>=jQscUU-sBfsjO4lvdR<)jT-85}q*3!L1d`Ivc)UC>J zzE!bGOxWs$-80*8_Qk$s=3-n8_}TTXb#bprdw@cM>}wywbN`kF?qGqgRQQn#nv-q+Rp01=K0Krc%SO9on4RfY}=w(VcXMD*3fj-7_!FZ8h@xbL~dr-AmMb| z(y^eip(cul>s7cPVtRNw=qZDBy19t8d?79@!c(b=ZeYG99|RQ^Uj*P@Km6k z)fR5NKTOWCWcWQ0hv6UG>I%1i!g~#I-y)aCKk^-guNTr46tOK`fq(dWIsP#o=Jmn9 z=aKO1dk`9mMw{xp3k7^1-&=S9->K0i-&*)scZJJ1iFSwLrZwAT-HHq*W6XYin@$G7Gw`v$eeqBI-4m;C z3F@n718!4%{3@eg-^AYs!Q+UT_2uE8>f_f4SX}$+_3|KC;OgQZ)%RMgzV}WC!5-wZ zzKifr^&JKK^<6!x=lXu>%2ePlw&*7iy<9_w) zTm6L~7)QZvs*e)OR5*Q0uZ&=ytM5{m7mgps%CGOmaY5kTh7L=rzH#vR_02v9{dN0e zh*#hDF}YbE4zqAOeRU9Q>+cfy!#w^wnCR}?a#MQF(#>}Hk8cCgk7Xs?9)PdbG5@H( zf5|ph)+g}!8-3h(%;3KkO9cUa*D8U(@)ex}-_$=fLt4pfo@cmme{hrUpRs>6M${+I zM65-YKMNTgGjuh$qV%dUNpCATgH0J-ULNL*EGrv1I;8ozU$2}xDI-HIvhM#Awa+#W zc36AmOyFCQ<;cy;$oTn?!oKB0hOR0fGWc8NLz0({8Zx4ET|&-Tu| zZ1|&^74wg9*lk{$6MS}3VU(A#t*#?4JNx9C~jL^t6m%mh&m0DG{CN;hcdu7z>l^K0=4h=q7cwova)ArBUH*4>N&a2lyzkc_I zvJE>sH=onH*XXr-*G^fN?%n2`UYVQE>6KmBb);+7+G*eL^M)kL&lxg!=sBk<7EC-c zal&=Gt{eP+iF^C_sH$sye9ufKB)n*3Kr!)UOh^oI5+LD4soI2Q0z~8@0+oo6WD+C@ zA>_rXwVIGjFaazzVk@=15j9n`UJ8OOwY`J_Rca}vN-fuG!Q1-n_4;kOUbVJW`+J_V z&pKz%NrLwN@%!#i&g9u^uf6u#Yp?xw=FC3j50nS129|Q53#Dw>dtYJqvmJRI&%e2zvOn? z%&AxJ;nKy64&QW9N*-!<0yR6@S-v61soCE7ISU_Jn7rhJIV;Lfl-I(BXs;t#1?WW) z^rAfUqFnT%oXJzO#+OXZ%DiD}R=8@au4zHXj*gUM^qC~L&)gSGjHjd|_NnRUGqszc zuhnBhe|zuTQPEi1)2hGR@~x!c8CWWQ(6ZDumZdI+rKWv;FiW-P1r=-){I^efW{g$a zhWqxXBs&(EmA8NKft>hucn{mM&28!aypEI<*FHs4i+#JNPV%kU>^mJA?u(r0f{rQh z^5WgKPb-7-bV^E3FdR-xKH>BwpG8Ycqg5S=r*(}=%6z^5Jtp-2d*}Wr8f)02zE#^3 zpZfXTuWlXC;&``4@6?RYv<#J=oRV_H>1_#mqVY`PILNT0S_pzpS7u*6^zO z0rYRVXZNdz2Iz0M18O>TtZoTUD+kk(VwI0u{UFib%C6gco#k^Qh9|95M~%_%`4Q-= z8%N;Tm!8fmlI~WE_vgfqpe-}+JL&i?+iQ4AV!ocv5yK|WGWn0Y{JjI~`~PokS=W>l zv!2sY&(MewYVxd}fG_lPelwWZrk~~mx1~%N(g!YH*LigN%Y8?Vym<8R@q>He={@xH_u=WY=;`k} zp8o0pPgm%v?9mvDr(i5jqMz@6|8a#;$3J#aY|E>9op5HVk0X9)_^^?=YFB)oGd9TR zG-1}&D%0}l%+7iDxh?%c@ru$DrDb#W&dDjyhOZ3t*EbHod2nCH-mYC6^EL+Zf=Pkw z;l4oWR#niI>5dzldV;Lcr_VKZ&u#h0?YWrsL&?c%I@W@rVZ&5cv?qD~Xtu<8HJgZ(Hol%|5INl7f}K-btzlbHPoj0;8^sL_UnR(>*fdkl9)Yt_==X@95cH zuCIY>XW`Y5CR~$LHC6*huo@6bUWf1WbSyVRNlA{zn~^VERDrSN$cDvE-#6I(Kn92e&XcG*WCGk{fQ@G#bUoZ zFS@gT=*#b&d-fGT61|MG8hmV<MJMdZCScQxueJ#Eo;tP=WQQ zZ2hzuXV1 z;?J@6zTWnqcBsM9_aj|oTjLqlp`ndksTH50%$--8md%XsnxDDwfrb7h@6M?%KVClb zx?R_0&V68R6gG_Eejokh8Pzi~)gMYyNoa*&`6iU5<3YB{kxhY|Imt)1mOmJZ&+&;? zq#^Ei$JRh!w~Ci7i@)V)K9nc#zg9e%c`C5~Y%3GFL*<$Dd0%hf&~qvkee1HQueT)X zE6sZHDb=10J(7zjl?1bTpHf-df1t7+$JLjrvYvbiBaOM!%j+0la^GxUe;~TmY0XG+ z;BeGGwtGjH??9k0nBzOp-WSaoyw$e+lRK+zUAP0%+sZ;+@7+5#bsqX}x$9x@n88|A z-N4<%Z$8sp7|7*r!YgI#!gzE?Qcv=v`Pdh_p` zUVQ>%V@w5cu2bTC6nNri7tM9r#CMh*WMEO1x;PkGI8|+bJs5Sp4}R0#4k_(@8?!^5 z85d6v`cp$GZNnC9a7UT5$sN4K!nd%EedVE!zuh}FX&zP*3pz6$yW@UEzt`IA-KUn7 z8?6&d8?M^+`+BQddXj=^|ELGhGSW9_xuNH?!E3PP7E>4W>`(EO;^pPWxE#Z&6K^eY z$08TCoeErmmL5OC=d}RWXghB#cSeCtKT>ucZY)^pebqU^+PCXf=T%tar0yKYmE&vUU^z$Lka{ol^}e+@t8c_bzTOjy zLrH(TH#B@9#?ggp=eX+l0>@W|%HO)k*DH5|WL3x>dumZR_Ls*u%yZU^JxL2wOpdh0 zcfmj`Ci>;teM^_-6YbWI9v77R@oJWnbL;#ZXF# zwVEYeEI5?L$G&KK)L^Y~tj^@{mCnW*wl!Jgy1tMT|D?FS^o`PabACLhp#0nA=Un&K zn^!H($9Q!9P2P1hZ8GVmrK;T6m7jmp(lpZ|4L6yoIXAuTtiqXlr#Cghnr9MHMJjzc zZHXy07{#1;zSM=Y6-GQ2=o{f{#~LAR=0cSj|MZ#Q)T#sv_4-O>bO^=&cJE{1I7Ud* zW^Gurm^($3Iw6?kwY{}FS}nRkFJC+MVhz?l=t}5ic=PFx$MpQ=y>l;&#ww@!LR%*| z<4VES6s-4s(YZ^vm-Qt5<=(AHp$+j74a&^RRe{^nW-om>+A}PELG092Uw5jkdgpD` zGnjAo^VkvfbR;FT#hEpk#vMh|+TnUL#TRw=pxlApu&(ph+h6Vb)sbHw{l)R0pZM9y zm)`j4n}^=|$=m&To5Ce2vlHf`j!+Wj=A`X$Us+q3J8HwPH+j8_W5~|DYWUV$PLCC> zn0BU~X&k#h+g(##cYAMc&B}vWL0wS|E4cGh`xP$-0{J78q-3^dYc+Y?HXY@AX56uH z61VCy$oldOa=A6Z$|-x4wJ&%3Uf#yfyeqfI$G>q`ZjFy=K8}wcVtjMw-yNGU+h>nV z3I*fS=^vtDiqDM2T1O7L-mP4lpl|8Q1n+mXUJ?KC{DOtwUU<%uPv+E@zfnH#x*uOx zF!$SY&$)gLykoGwIWnm|d!$O4(|!oOv!oflpxSBSp{&>1kf2TP2a9{UH;(8Dethp% zOyCvq#h)snw+4NPeR?Ek{H(l9xSyENpXd5|S5z!s(z9{nxuKMPtbtF&mtpK(u))}; z&`$?x+xfMaDLr=?tnsauK6=8K55$j{dd5n9!$=K`-(<}eFOLb0*gU-_Y4cTEqx}A+ z0y}LzTWrE?@$#65qtr~OgO%KH>)n_=GCLPIbJg7m>- z$2_T0C-#jqR+@NP8*D18{lbnw*&daO?^%2Y9>s28Jjxx$!``)bSU;3%!~ggYGkTL`bQ)+3+LV#o?K8A z3F}9z!(VV8I$v!4KFndz59khLn7DH7n%aqtE%o)ajT67Lw(+)!wM`BA_LJK~;rymM znbmO2s>VAf%EQ1#)(?L0DDXAchRr9y`G{MQ^|W{k9>K4*f55h!KO`COcpRRK zvwyE;JuDt;tZQgi4l!)~G{S!5ocY6epg%0l7M91{ufFDgRle4<_V%@_@gTbAXHae( z@#`p7fRIwVUztgyprg;Ls+}9YrkRO1c%lDr!vpT^WSCzXEeP z8`d^x7qpyHr%jL2?+LfYh*QCB+{Q?4=+#UmD zC>3pPw0@2@boxMFw0_HHkJDON`==;w8TyA3G>QFdx51Kz$W?dyP??YdS8(e*lAGla^Nz#fa`&v!-SBWP+-yHET6k-PjZZ zLPk&6fiBBtfsaAe@woWM>U*_=Z_=}!+y%GN% zzRP4N#^qB5mb|-2u!7G2j6`kuJB)auz9T&Ob$q?UujBhXah|=VgHGQmQ9KEJ4%&x- zKHgCzyVCJSBc3S#TuXkrldj{7J@M6^c!ww6V8j#UpXbqE$6ft(+|^&lUHx_3)&D$? ze}*ji#ZLJ;?%GSoS9sFdH+0bHk4O|xHYe&o){^h$*Kt>$vFcq6nhbokgAXqneGL9X z%;z>4r$4#!b^czY>7e7!N)%5*liz(FTgTrv(pMtA6Y*?Zl>adX>!*SF%sAttIglXS z1fTM&3)IU-dj7>6J$OCA24xy)Gyf?gKjY1YK6{|=uMi(^=l>1T_d}md zL;sluKl4`@@ebtwGvXOG|BZ-`#wJ1HnTY2jo^GcfLjGAs{L6?}A)alNSA)0?+CS@! z_*cRICiD}2cWh&hOtlc{!%*L8h)H{WpoLlK)ZZO1Gu7j^FX{dqvD&}h!@t*vFNb{@ zG=ILu|9wruXQuj3q+f&b`I{h?|9!+48~P;bJKoCQ>f|4h(g^BiLxboyPMc&8_RyW_u_pXUWj z{(nXL??HXUzo_pYJo(-6LFa$Q$WQ*gp7_f~{BhKePXXXnhfaI*TvjPR2kE~~BfbvtZz3-CPHb;IzKj#~ z?D2+uLkFGiu1|IRCP@bWHz3;$xt{n0Pdv{Pzrqubc;fk9Xh_lvAvFWd*VNGvs?LpZkH$WvON4#J@Feo@#VJftbl;g z*zc~h)A4gn%n`ZDK7w1Fw9-@6Tb}alSA3{)v@h-TRZsaRD9jE_w~sirD2(s%@GrD^`H$%}p7@_V z{7H8EoUru0P#v=4Z(H#Ub%#g4iJo|_r+u&Wlozt&TvLxmue!-DpZ#exep&dwo&P@2 zN2{=U$m}oC7R8#KOaMugJNCJnv~a#KOb5 zC4}GJG7t-$d%y_BW`=9Y^MQ+nrwsJ;KWjR%(93}{Y&x;f=aHWkLLe48-z$(|(}{)7 zeP0N_yJa92dNpvq-PSos3k|netUaFa6o3@rrVL>wF5w{-9_~|xhx1AL-|&GzEIgUO z88)3*=!L+cKj8y`Sm-l=Bm6-*!hBr9Lo7UD;52Ud5pr>*v7;bN!j;d3Fv8Wi(ned* zdY5Fx#*~vD(sWZM$B_)1PAp|D1mXz+#{Mz+zis;h9GI8GIlR z3%v|j=)^)_Y|x2?z7jZX96k^laiwv=h;Rq4{B#SdR$?xs5on*Zi!5l34-p&pf|Sn1 z2|_O}k^eYwhD|3HI>!)^zYjPZAEFO9}VxF473 zNi6!XzG4%z?(`Y4iRnMPD95fBvB=p69GQ*}gu}R`EMnn#lXN>TvC!WJmb@R3$6n(R z3lGn!m%PM6PY2Go%e@5rX;mv0f7J3bEelb1}8gZqUSkS`4b2~^GHl0}LcafipAP@`v9^ed{ zPAqh*Zw7T;%)ZI`M!tX#gl)L;OD(9j<6l}-<7Y@O(|8~Lg_5-#Vv&CUI5JD~(D$S+ zrXL;wUFt$Cd5@Bx0}KMO(2oOW*mPo{p8^iyOcjPxxP<-(VA1m(V9|kCc(^4UqfmrC{NG}H?0h=nH?Sac&6dW8Jf zX_>@ApG1C}PAv49z@i(m(7BdKpR46~_a+%O-Q1fjr5xL5h(*q7(m&90h=qQaK_?b^ z4p?RVNi6iMfz#$`IV?V6|>pU&aAqk^c?g$PM^F_%^OkDk^7V;psy>e}P3-&k*0JG5r~*Ls${hw@-i)VI>gW z!W9~!d5A^kAAx0kMJ)7pfn|L~EOa)BtgncL{#WwTc@c<(&V973uZV?y4(WCsiG^5DT4tmA2R->vfKe zXMiNWL@fNAYs8m`h0ft7|BLuQsKk|a6A_++!4>+%f)*D3Mvx*)H2rq`lYUJsJa++0 zza|#?J>;*z2LiFs*8^wRbYh`z0?xk~9|#ZN%BSNaJcvumB^G}At&~eF^hd~l3qBBt zh29ICVbh6)z7tr+6Jnw715R6p4}|@=*w?n%Sa=R1&b~%EvCvNf%N~tb=)VJ&x)2MU zW4qLaSm^JNe>px7h=qOzIK!qB3;nOa`IY!UU~^LEEjAV&Km3Y1lTIvj`nl*#Ec8rZ z(V1B2Il!VbvC!$y=~WPpVET3e`E5F}@LN7_kHeA|XvCx+R%bZIr^nY|N*iJe2{75Wvo&k>3Xnl49OI?VC=Q&`h3$f6@ zPySk+mssd8kl&^g3;hVN_%pH4Ujfdybr=tEAr5{B#KIE+j@(Kr-VKQ>bgt$h7M`nt zBP;QN!0{xMrg?~kXFhPG4j%{$aY=oNg@;3r)R$Q3?Dpv#kPwK4UJ0CG(}{&nQvPlD zKv<1S$|4q?24E?RSm@2&R>fUgcop${fUL=AaH~gMR*aH=t(R*F9VC7#6mwt ze%sE(LVtz)Hl0}LZvso-Ar?BgrjSY+mr=gXRB67k&{Ps6|buV{QF{z<)vCGXY1QZHhm7Xznr zQGig4OX#J*88)3*=<|W4FAxiTDRBP1_&`{VOV%*N!b7)+wBiHd4qT!qvGA};q9?J? zTY+T_LoDCl;Oqz@k5~&<~TJ3L+2-{RnV|O(z!m>%h{NiG}_kMSo(U{{dM1gjneB0E?dx3;hiFH{%0=Sm^HoXV`RNp??CL&klz$8YYmwPb@s# zqeZr8o=bp5A7bIj1QvaWg`PwH3Z0i&=y~L~>BK_65?J~UvCxZw)4rzVaP1oD(YOpa z|3QuC8MuP{TQz+Z`EATOOU4cF{3YW?BY33TyMgl`(sI@V%bu55c)EepzOH%h2Npje z79P%J;wQvHe~A3HKM)I@^PTt!vCw;g#ZQQZz5`g=g;?m%0!zCP3w;;)zoB&|7W!WD z+jL@~9|V?mAr|_}!1;E&oCFpfh=u13V9|kC=x>t$VXXtP(BC4zO(z!md%!ZL5exkz z;Is#{oFqSZIB+5m3(q;Ej{_qDvCz*4j@bSa1{VE^g=ajl=ua$ko+q8Y%@S#yEiLp2 z`E5F}(60oR`IlJeWu$*o%OMu}JmAP9n!W&7bR!lXo{22F5evP7{NK`fiG|Mh$7k4d z^Ih^QLC@y^iNNP=r7U8}ThF{Dnul2EjpYAlO(z!m?c}%V#6n*WEOsCkI-i@Ba*2ih zAh486Ec9=XzgL$_Ec8dnZ_|l|-UpojsOEnbSmr@u;W+@Dwq5fa2aeeI1h9-7#KM0P zSjG)vq5lpz|1mA+6JWU?PAojh0my$`^9%=;x)Te}IlxkPVxf;F|7@L?Sm@`I-=-4_ zJq#@E%k$jxzpC?I3mj6qUl0p_8F1tY%~K96x)BS{JYdm{Sm+DL&j}WRSm=C?G{dG7 z3%wFpbmOzaQWmlBtN@m>h=sn2{NK@K5evPZ{5G9f=&isqh7b##&#b0DspSw0ooBLV z*mPo{ZwD4R#6o`-IP#R1bA~*Bb+Pb#NS+;<{t>X$msogIl3QP5q4W8+^rv-RVxgyy z-=-4_{d`~| zz!^53Sm--}MGmphUjR=3o|Z!_^!>mYHl0}LM}b8SvCvNfr|;5oh=u+JaE47M7WzBD zB8OP$?*XUp)^do2{vmLNO(zz5au9Ot`-;RuA4B^2y1j^nei3lwIW2z*c}8g-V&S=( zJbN@xF|f2RvG9}vOZyTFeKz^`>b%54pG$t5PAv2aVDUp@p;rUve^<*{ZQ#4fZ~G^) z@bj7Ud~P%mM&lBliG}BUV9}Xa=;`GDK0f##m(VW(&ammkLeB*jn-dGYl=Nh6Phz3Z z1&;gx9|((arR}qz^}C?-AG%oht3k@J>BK_k-Yx$H&EJZDA-^t*Sa|LOma@1d5L*!o zPcLxVkMM!O;XeJx7PPSNaQMrx>BK^(>*W8d=BH`I&cwn)6~)fPLf;RZ&JTqBxP*QX zID-TPVxb=gmOer(^pn8p{rEs27Wx~&88)3*=-huvdl3tLJn2c=hQva@n)FZbfj}(u zQsBr>NY(d*rS7v47aq2?)SX!9^MPfbMJ)7%4`HO+2 zzQjVe_J(_P-T`|NzZ91{gdx1pl&fkh6n(EUk}b4tr07J4#p zhD|3H`WRrDn}~&e39yX+qaiNxrj~g={^kFN#yR*G%FtsMvE(fPj{HvZOu|38=SeI) zQ-I~3C$Z44BtIuf1Y)6cEhP6miG@BBSnhce3%wjT|M&Pn_|W$^-=BSIP3@Xk!=2{q zwg(;&g@cODehyjUS!mvKv>2~jW4+XzM;;Y4)~>E9XvUFl1@7Tb-czWY_lxQi-d0yt z*WxAMjkPQ4?oi|JP*!$D!PLz<3CTMBYk5^Q-kqLsJ{sRB>zr4$+&D6irv^FaehoYg z42HoQ+)Zr<8pb|XYREItjH(XI%(tqa^#nC}Yiz;XCY+TQTUmg2hOe$I_+LqKOg=Do z;%Rrg&`Ybw{hjGc_X`dyZ z>nf6qUe>&JIeitUOs;Kgvi#0Et*kD_WBHm}n#f?A!%7`UmBtjKxvp>dwifDf=Cv)& z@Q~%zcQ)4!nqF6*m@F?(u4-;>tgD7^(YSR@vD*twiuKa@vs-=O0gj@!+tXVb2J3(5 zGDt8C?begp+1Xi7>*PCwQA%(#NCz>S(mj>%tXT&+#qg~BQk2{JpRu5ox7Dn`%c>i2 z9^Z1SA@$HSNGBci%*O(p5?Na?Yu=)KcuedzXW%ls)S9MSRRPa5TV7RD)7VsZ>!4iK zEh`*)1I`fT$&JhJs%>0bcUP^|P&^lOxm{0-u%;^J#0}#Z_ODtUTP`Pug0->MDZy?> zw&C&>jceB|Z@#m^OWL}sPQgKtZMb@wK3yd zM|e*Yj!-SYNsSm0@&C>>)_-?i8N`=Rm$M(OYF7yz8G6cVtfyQhsK`Nu4w~#B2TZxr z$>5+u2TgX61Ex%OGB~KvL6aTifGN|Q3=S%E&}0Vz*l!*G%=5>f9j##MR4H(ZgNhtf z=%C3C0{BOZ9%>3LnCiUReu{&N98~C_$qsUX`;K`B8SkZcXaJv8-GsTaz}mVTf=X`ROeOd?(5mzce0x=Vi)5hgZmbF{mOOrfP$&cYt7xaqPwp`H{O5# z55DRAhspZA;(E1+`+B$G+?rI0@$3y9p2t68uv>xaRx@C`W(B;^WdI-VUq}$XEbw8O zt%~i0*Qen=1roW2#gg7i8;So*Kr_qb{e~5G9{v+~3js`d?_dEf_XkmwBkvAiQ{FV> zTSY;35P40AoANM3IQRXA*=f}8d}J`?^&)O>2Q7&r?>qogUN7V=MMl<_=4Kk@{TFDa zyt`nGcSx{<$m93_ro4}4fWh7ijQ|vRyysxbTLEL75n=c*^4dN6eRPe!|3>{r8S>us z$Xg7D_`@Lb{;x+KfAb~x@Xj^l?eoaH7RKehI|)d(!XA&j@x}Um^3?A;KT}>Z8f!3r{u%g8d2?sN|Lpb{Yseevk+*%g zKC@3$6#a&IWMBZP(XX^LiEZ7eO%DWI3)98Qy z3Si1RhQ@z;5PAE+$2`Tj7-r8^O1@vsKwRX}cT9Qv(D-a438EjGDM8-+`Di!0z8BkR z)NcX&*OYfEO`qB0mG>u4Jw5^-&mNH=<-YBy$43j4DuvRtOBk2bBZflFayxJ{z`iYP zi4=Luz{EVo78U<1aaMy}k4(@+UI&0F?>;nYn2B}}dG~@walZKd3Cm5NxtD1DfNGmE`en+JcIr~Txi8` zW*GQ>4BwT&G+qze|3%)OEO#y;ugGKnA{M?Ez{h(Y5~v>o`=H79A^1?V6NK-Ju$9R- zX8hoMuVdUX`6hv{*pa5~!sy>{k#7XFr0#&@z)MF$mvJKor}Neo;2s7Xu{I|AZ?E7rKI)SXiiE1RvJH zjA*Ps&|>}c_rz~{SC^;P2)U{hrI(zSd^q!9&Vjs+*(JYkSyR^25j+!9 zhg76E)*5u)RT0Q7RXa8ecppejPv`jWcSYSdq%19NiN-45SD~$!C%n_gA9s299(>VzFvbbEvVW`ua73shRnO@2jtsToLTxnX^HOwG~KOeKUbRXv?<4TdiK)X z8>mTJ>7s-Z27B)mbsM{HF!^4K^mH!VA2;lw-x)SoPE)hC(y5jXXVD(-EyKIuN`s$G z*MFrB<{SFl()cc?fp*F*4lD`=eEn^u>rg^l=^A``>qaZ=`H|V$ZKe6q*?4oW=)Jxb z4*dTp+_J9o@b-g!2afEY_r`+P7oV(nZP|(HS5_Qfb*%nq-e&*H{v+P{SnoG--d7cm zPD)vrvMS+?YrftErJ>+_f2<*{@D3wYUEZEIDybdsZ*<>8*AtvHDVDa!N^j5pc_4(h zLGo=cS-C$~$NGDc@>Ev$6UpAP`Cd@9Ae5r~tBiIE#k;46@b+Z)ZCCB3dHzr^%^y4U z_@HktI<~;o*z&bw1KaI+jG#RmhAF;D>exSd`Fn!lz`#7@ZJ6)j9oG}AOj>2U56W9B zT2$4$xpLxri*rgJDovjA?vmJy5O$6JhE`8amwi2=4S>)3iD-#GR2KuPe3q3e+c1Bb?__Crbd1~aa9 z*X>n3Tf5Ztn|oTus@RsGDjM0XLS5rktTN)884TSN^o4@6)$U-Vgzt|m+L$!pO@q|& z*dprqb@=@MX~j8(t#}vPq46kXipmTY)$CELjCWM|PIo26&eZq@THDlKEyBA5p?x4X zs#*_aJ-K5*U1{aYFG8|YZs3XGK3{)N>J=zG742;KWAt-s@b^Pj-sHAW9p7o#+Y>zF z_w`!-6UKX@fI~^Q!4jKPAbOo@kKU|$#>CanHx(ssDvnh?q_zil|JT4au-!A-@RqiomEh*Ffh z+82nzicwl|_icNSzPcn<*#c@3sAE74Jrwlau=)DUGlM<11by-7s(5|pTh4pRESX7P zMhmw3W5s)XlcW5MwT@B~qOmRCRhD<%vMTQNI%&sM@soI;l*A|v776aRWQBrT{IS;W z;`^zcevuWf{KsTXjZ#91qf1)sAIl#K9z-7Sw>Z!<4mK6I{N zH1D9Vm$s^0IyBc{wz7Ig)zEnYhgRL2+LifY#bM6Cx{Oo*pbc2YnSapk%(K5XILp=S zj~k|A9U4kWQEjuOy?wp0{Ymh`4qy9s%J1EN-ORbW@NO@!ub6$dbqVIoS-!b#bA^i~ z6|Z1PK1XiRh|&^zYK7xjgRM0<^7gK<-kFCt+5X-?7H=Hp+!Kf%@>$sEH|>4pzEyY& zd`0K_hX!9&QQE1M<{XpL!P-$`dv@@gw*FP|^;?J1qjiJUJ?2B&xzt~b{(`uQRmze+GG7gL+RFgtFJdT znw9xocpb;)YP`XFo->Xz7v6Ur3|`6p5qP5f-oLbbJa*0ItQ|YBa%8Vr!;Jc-!WHKGxIu%Eqr5t7&%? zJ6QX2eHz>}aOLa1+rBH>fZw+pQcmxRW|kE^v`__Snbg9v(Q~-Yb>HspJG~w8^0W3_ ztNgE;>tpvl*L-(hTWN0b$VKts$XDyIYEH0hm)CbFYtemO(Q;=!%J;mES=4r*9dEdv zy(rWXzltlx?Pu}z;ELqB0Y=u@kIg%} z;N`_f@;Y)$IC8aTk2Tud`zF-js-EN-J)6+nPry6 zDsz0h=FEF2)HOkkNrCS;Er)UH^vq~caB4~3!=d1R{=H`rb_cCLP>;1frM&N6j-yA7 zd4N8TcVTXD-%6QV+`tS>nf|SC$>Xov?qR{D&M+0xTp9pV?!t6XoZ(lR@)D7zoY#-!F!8R zrm!CLzM6WgZ3-mbMrm+kRbdp+XD$bkC{gWK1#%ePGJT~FRMha<#Q>yqEdd_Cu6 z`D^n|EO=${@rq;1j#j_C;>fBO>tW~Il0YPQc`R)tY#4YZIxL3!i#5u2eN0_p(F7hdbWZb$w{_)YkaiNO4<#;PCq@miCZu z=MBC$A-6A@;ycj3C>br3njC9=LJ_AXx1A2WI$m`p@h(cN_`3?b-r|_r!~gT`|CQWz zaGe}%T{kv%>bt6XWBcVJthII+7F^cpzLz?XJpwsZiaSn_a#`6?r_cEMY5P-FKKFgM zfh#sb*AXa%b(Y+L*OG8=iu{$cS&sYG^L9ujXHWdlNa6PNM~X?y>Z`q6Xj+1IWUxlQ zguah{lzk}Yq7oS&$g$tU!PVNK9N+1b;+0E${dk*ozw6x`3EE1tEsqs16ItBVO)7VJ zz3KFxsoyre$K9`);}d*pe)YoR3ui9bwIs9RfeQc4?_O6u_xRkI*YCRiGWeKRu4QM8 z334B>e1Bet*oFGK8riF(vkhUOd9j~_g7;N<>gZ{&5PltgYouUwRk9X)bdcjemg!ga5A z2J3o~|MDG{=+0XhXAe~jV`(ovJhkik&5w2ONDh7J{d0SgUwV>rip!Z&JZ91CMLiwe z!_F(~v(^w^zvxMx@Kih+pA|2~=r^E+X{oV&gVSq=pdacp?ZbPFTm?N+Jh0@tr#K&r z7iwMSrf|J8_{yHz?18p}>9aYyG^Ho`{inEsab;p9HYadstNO~=3o&!|so_D)&8UK@#D^2t|3>p&(M1AJ>8tR`)>N2@`uWk zuY33AZ1nHIi${hH@Ri$ol5c)SuW^n$yB()LC4bXSGglm6i>9SC8|xIPrWs~c44#4ul$dP+T}FoXNBp7Q-gIWwT_ z!7vg%{yo-wnX>{7JkdQ2YcOAEaa{E*4*IhE$m{=&$_l)s9t%9B+P~91%&AxBd!F1O zv~X6^Q%d_|h2y2wH-#46ryfgs%AXZX4Y>KA+r^%@tkbo7^`b~|-nOhKgZJolLhRHW zUr~Gx?hWt`Se6=&8V$!gh4M;ACGM-%^J7I--7trZ|=KeZc0hY z^=T!(1Lp-}X?vCLK!IbYwAnj4;K%V@j)oi;zcRLVGy9SIO~TpMLWLdAcI@abO5HnP z?BHy+b8?@ta>fijIac|gO2zk5Pbupja`G8a9>-l;+y^;4MuonP`@yS!s!}(B&)42J zJSj8zmz%R5O7^$)_dSw&ovfZ@hAOG~%XQO7w#Gu6BkC(-c61a4zl*z~wY~u4wc{SM z+@0KAw+G*YrTTb>vfioxjt!jY_ZKckPbl9|@AP}z!%gz_ue{!O8VL7i4yE||+ZW;c zss7Yp(Fa}X^yXOWA*{xNDmB>Fk5$;IANqH~5Diw^mHr(LQpv!RG( zil-!&oOS-x0BsXH^`OsJ>g(-Eo?qzg2Z6Yd;)RfuD|rMLX4!%|*$JaYwjM1#(6uWe)qz z{aNQH7sgtXRl(L#*Gc>QDB3eB8!glqEI3#czojJB@HAG#<*4H|XsbN5)eN-N?$x-z z9KQzAw))z$M5LaEpyON9Qev0oAx>V6B zXgFrLufMgZrQ2#FteC;sm8{$7o2qEhBZ_U5hK~rDvTVE!y4vurGFMpAX;nMPnEzzXreS9YmTt zrwp7w-8Sz@PMdc2^x|o&96hX&&GHNL`=WnzZEBX@JN@jXpFz4~SF9-qa`R5tq#5y2 zS4-X}Gw;L9JG|iF;sbeIu``EM;9yYobc|KO`(q8AYUsXz@upy4S*GR<1?7X-rQ8^K z&3#~I`2*$L3-0dfP{Hz^;l-0;XQudK4c%zhRDAofRk@zjm2~HrSlS|=S3A};JgH|` z@g%q8p)Arn(dDsP&H9$_>@_-t8hh`yRJ^$C@Q!X;t{s*e73DXUbuFRfU@yO2GDi%2 z;}kx-{K_N`zdgdZ>sPGF6YfpSyl&TZygv~_i}}!E51qBeR1mFxUEBWnfU#ZXTYl3N zQ!PH<>CkN%)*iMp$kB7&2CVaLyUwEYS`>Fz`|+4yQroGvQjWk`!)gP*Uh~^E{MPWd zSvlv0v&OfDvogOH&I(_4SysX1OS2*+muBVNaA{U<)umZE>n=t5rAWUtEBxrCSq0y_ zc;BXJU4`A4?=}`C4L;wch5I&SI`c@Za+|s=%5SVgn=zhO?(hYEhI#HF=DD#O@x5mp zW9tr#c2j+Q4~I5P0LR;)yj_ej+|Tt#Pkat&`&8iN399|)S0UFXwR_bbUr}&hajbHY zui$Xti4jQ)=M*J>y?9x?FFvFDY~MZfUIrd##rY|%{wZG3`zh&Zmz`aHF?5kVg*!ei zOX!E~;r?&{Ez~}~BpjIF3%5_`zci57c4>QF$)$lSe3!Og(SJ!G(soIEq~wx7zVDLu z{Qis4vX`xIUGQRN($Q^2wKcv_N4fe+1@FjgA64}G&AwgN6Mww$D-~Z^ly@Z8x$AMD ztSH`B^02k)i=BE3-)`btp0bOv;?2jrRJ8gKzGIxLiaPhg?tN&Z=So7u6rM%+j;il$ zKQc;%HeL*B4cc;%Z$UH|%sUcG+lIL;?hBMj#P*&f$>XFc>)oRzap3Uhh*6{C`B{wTyFXxQ;pO9-IeH7ady=az{>F%9 zxO2L~(N522zKeamSs85?W#vA4QDJESW8hcDhFab~7q-K9^TUJB;~A`;co4JyxDxd2 zSr~M|j>~ zGoQ8RDKbCeveJz^h-{T+5#`EFBp%1dLYqIhr7xR8WK(c zl|l8vA9wBRp4MHsv7jq&Q&xDG^0o*^nw@Ex*wt1zb6FsJWKtH!PH7vfuMVp=S}lh6 zbc0K+w4UV)Mo&5;Jnt|ZF}`aj*B!VQaTMeI$xi>*k-o9EMeN@b4CcmKe~A7Y{6lQZ z(@u%>lliFweUe_XKLvEdpBhrD-O_vARa)SuONL1~tmUcUE+1>yerSnx&u-0Td_Qwq zI8DjLBitPGoHD$ev`)jhE~l#<`F8vUEw$azcCb4>)T{Np>Vy?S;Ki2)+`qD{2ELq5_n9ZL z57X3Wrnz@m2J_>s;5!9A)4$r`6M-j!BjTmlYd;Yk5lj1_GJS@-wt?%+%(+}?(h}|2 z@!^4-Lq>ZJRm;lIz@fZm|eU4D#;!C<%`{%&z~>G4wD$Ky`Je;xN4ZPBbP4?_=ri@I)I z@~<;r&G}XNFX#PY!O!<~pwD(a+m+Wb!)eJK@twG%s*+yAx12K1`A%<2Ib+@}JY80{ zx9kPn;p_*sFYbOPGx#%Ulg@W#Sx;bKt+#mg^BA>zIub|i*7NU%M0Y13e!!l(1yXVn zzBgT|cz4y&vVSF3S1L*3!RWsEc?-8K9KPhQb5@mK4@(R_cJ1iOEy?OdOXWKE>~N2w za8toX-lyoo9)1sYJfWm3;Q3GE?%mVMnu99&1RbAkLz#Z^%;=uh<@<@OR?usnNKNVq z>TmMh`g{Ae{XJwW?-tK9zJu=xUg4K=UVtCJ6qp?iC6C23i!T(%P94HM(Wm|GpdO3% zjQAX8qW+*eN49_Gr9j}xpQ;1j?03c{u_W)NZ*AKgbw>s%>uKL)Tb>SQlg=bE1d7(+tKxKQTUjyN=T=WcCfe*gVI^un%Zzv=52Nip1I6;JT>3gUNOqoX^%$<#Y5 zitf9)BozFE{hj?j)N;pwnaldlzVmA+HM8@CGr|_#cUwtTIMpXs#gpNktZioJNr#8+ zufNxS+)i7t!TqMWt@JFT4|1|jW4ltz-5N<91{;NFo0hn*mvu`Vi?F}s{nRdcxYzgC ztHSFGr6Fp6cYi z&R7w~4c-$CZS2O`{0rjSu}(W`jM4*pHdhM8%?lFxbz!t8Uas=K$?tJ?2Y*<+I~jfT z*KxGT+h`N4LfVh0$J$YT_&4yUNdd8NTWNbX?veKe@4aDj){{@%Gq9I&emA|!diEka zm_rNt`Yo#tcovQ=J1OE?&-R>C4`T=aa4~kOm@)Y5Fn!1DD+lqN3&znL)*@^DL0IZ> zehc%(curRM2Lt+}wGuK)p+u<{`$?kbj9ru$O!R5_hGvKJ9e-ZOz@A}^6&vEw9Ama| ze>1Yab>hmkYicJpw$#_xHctG~+Q!=^);2Zd+rRoB3g; zskZU<+D4o!V4XM<*3mEz@~E8=&Th)hu9;w*LD0~+Hdfozv^=)Dt`^6htgOWu1xE6h z8ta;CHI+xAG~S8NbuG0`%>#I9>tl^~HZ<4P;1r4G+WMxtwe?M^>9)Fta6?sNQ*Ag_ z+t^&UqAmtC!qBg7#hn90)YpCqN24?`>+x<4G`1k62wt1J|yujZp_9 z0S!25${pc+)`8`%uD!J?c4wHUVc_5aOVc&A%`4X?$_^VX0>0%9#Oc zs=XtI6IO1m4X;^SQ+qaP)JK??Tg;}k#I|r+$u?ot>V|qlQS&SittuG|aX3+>9%uMK zXw~Xl*P`RDT;o;ETgAb$pbK&Uq2O>XdR%yd$_+y_j!hvp)xbF}%U3onUs==0bAw_l zYh$-HwX9Js4d`mMZrp3)L?5(j;53o#0!F>PxxK7b{#)V1^uU_1^WDZf zLur9C!fUHnv@~&ss1)DQXQ;kQCJ!%)VQp=dPSE@7NNWE~#F z8Er*X-Rjz!0-T_9ntz$RDc79jDg>Yt^)@ z#)Q|5c3f_qy~dW*PH8P1FaTgtgHOGvfrW=oT!_|%CU=H00X3-wwQ#DidkkL~2URg8 zK^b@%JkMoX4yNTR8yhjXbBrBy9bqgG61ie4*EZGGdpc7S#^}15YqB{syCbDuw%G%@ zRng_nAhbMTUK=7$V%O9|w4t)m4hdCBh(v5#Itv-QVCASH%c~hO(%s1QBIiucoX=$& zZEFs<#&8eYW4)rdFp$FZJi>VZqd3O!L{nl?NEor*`gj<%Hw-G&ni|YOMxXF#ou|j? zk0+_=cBqZjth5|bRsx2t%nZ3$7uMBJz(`wPQ^!@1 zx+2*Z3=RwU64)@VS##u!aIQ6?p*bd41AYs446c2QF5Q5c!*U`PH^Z6-!p`z7?5z0c z@bb28gv|NFG z;t+esgyB{9IPq6&N^fZ9?r{zFGg!jf=X*MSIwM@Ow!RkYt}orFcT0LP0CHUuTe&8} zDROl+PB4_I8{_xc`PbI3sJj)5ZtT6A3rtr<0mZB_RubQAr%AkaG5~=d> z%$}sQVB_sYg>{7ulb5e4Y?!pXiYP{O*P1mgt0xmwRjpa8!Rp4Q7!Wdg!lUQ7ge3Lf zfB(K41q!HLWAJW9zYqiJ6pX-d3of6!Mtu;{7)K&maq?d)2j(FEIf%O>|QhQ49j zzI?xdAE(0=L7yKYe>N`BCt~ow1}9{=8#4Vkt*tXnsZ6Bv+&1A~VetR6ZSVP({1KM^ zcNpo^uiJ?K7Y`XjSd7cB##;RD8Ex9$&lvp7&v*Oj5K#D;mKC0}I?9D=EEM|$6w|(M z8T{+<%>u(*Tz++dRUY5Fr$a!Ev;Fm$l^(LvlRfqvW5gdvd8fd82`<{>O2glk3aUhZ zAEy3{Gt`Pu9?v5e`?2miX#ZRwQQKde9sP9ra8KOr55v?f`1ALWZuXbw4F2z;z4<-} zo*T#VzXf|PH{vB|KeiXoZ4>=+jr_EKp(no5h@VFJTM_4ZUd+D|^__#b)b|pU|9ixx ze9Ak=v8S#d&yLe!nEEQ)6Z~Rd^7H)ylFm5KNtAfC?XS9hFSgq6Wh0%AdlBMcWRUvJ zwELX0?ag=0>7ezQXT;aR|JnaceIiCW^_k|0SK2;D`ESA=d_ToFqx@DQo%wfq@^7>I zl<2q16F=^Wzw3!t+I>XwKjVqtWRD4wKHku$5bgPjVXueL77VZBzaOI}^?eVMmJZrp z^NsvWf5%haCZoKiuxBOen*{-Ej}(-}FwK&mWy#;>k^h2`|6=HO0p#h+ni=U3! zLD!$>VCsPJ0r__$e-;R0uZukX@}9v@`JZ^wD-C_V5B*O-9>hBGay|S7p7>2hJdXU= zK!2=vocx=Nbe8{t5&r<=>n!j`Z2lXOzY#XeG4kgb`Z0gR6E8I4pR@h>4fu#3tw8=_ z!=CHx`Dvup9uw5dXy4r^?=ri*pQHSCqy1{p-m77c&)MlskoQX?{W16--=}i9oqj*! z5%7yY{TB>b0)FwI36TGm(O!x3NvgU6@|&QqIbN@ZY#mb7tC0U)q;p!5_D;9!%+qVj zkp4rYo8$3*J2%sxM}1yFy6L~;jQkJTynjHQ{A#jgzj7meE$p?$&@WN{5$Xn{m%y22 zexUsuobvVhLCR2glJ8;Y^A+&ZMWsIHJLQc~xv0+?q>Df1g8wflU+hcyJj+&x5vtkt ztuhe&Xf>vn8R^eM-WLu167?UYzKnvthx8)kr#|nXy?%$dIX~QOm&Vh0DgO>noPAvf zot|gJ9{_(CK4^|_HAXt+x$Cb{>K2sm2fvh`sPDPz1nfN(>88KTl;V|MZ&rHZ4|w8B zJ@FhzpL5mKkiP)(Gr=S6)9v988~h>Ix7pAqQQz|{dlfqQbzH_su0mP=cN}@=sTF9C zLq`374SW0t;&1^=pRa)bGIR#+aj4&Hq`!mosdk+5T>sPZTal)Nj^8IyyZlEy@hzTs zpC^9M6F=&SAM?aH_UNF?cl|@hU3;FV`eFZDP(K{mY}M~_#2-Q2Y;UgrOnJvW@sa4u zW_qa+{|4IY2aq=n4AQ=SBfSIt?Q5{7%&+gGJ)Sn=iS4V`*9W9HytSA1XWQryQlCKH zpHN;t2vT0For-6KEdKpQd@cAdLYrOy8u=5;)BB5ZhhN9p_jMSnPC?%yY(-Id*vklGw6B;E}5^d2L5MUVvp~_mb(x)=g;Si{M2`+5x)fdlqusg)5l@H zm+}}78}S(n$Y06!`$@V6)OcMtcp1jXAB+f9nxHkA1?(|2WnYI_UcD zFye{(*9=ep(fcX3oenxq-!$XJ62+*)`ph)qiT&|XwG8R0SbLfC^LnQ}^#0;5BfcH= zodbRuUnu`cN51C2$KYrBUp?vW+25MK(ZiqSiHD7N3d)b6d~-Z{!AQR!cs$axQRcw$ zL+>xPIs7`l&l6wa_=`?&boAHpah~)mJ@FkL{^vY#cfFwHz2-^(gD2kL(eEN7ekc5E z3+ik3|89>yHyQEY!Wa9%Z?^YqhCH^{hemup`1=j{iTe!C~W z-V^Wj#NYPB-SuXcDn#G=1p4KIhwa^u_^%O{@gh-Qy`L*~de+=;)#AW=Vz2ETUcl(Q$Ki+8%9UpGQ6YF=mnge-!uY@@s zy7QUdU%Bf=9WQg_>A35kI)2KN{-L9wvc6%uJ6~x1 zUh|Z9zem4!40+7&&ObVTu`|D1uG+b9M(D%k$Eau3-y^@=;Ai?OBObABt>>R>t^BKv z^tE>VKe6Obw9*?5`DN(;|Bm`zhIIBX%0FtPGd{ypzoka}dG=4_&oT0s8~Gnbf8cvd z%>C83jr{+E@s0OWr2phX-gxlK{8NMU$B+)PrQfU2cQ@jBc093vOtAEyk2D=7sDAK2 zpORR=7bIC}{!Sxa2>#c=FZx*RVWd9>Mczlc=^s$c4mfuZ=_ApmlR+6cKV6}Q!yY%H zezISxK>eOVT<%A(y!RY=+FxH0@wWfE{avTO<4Nx}@?VYm{08#J+4@kvJN{gueunfH zk&b^(`@8e|73#aF&wnEwYC7rec%aK)W|a3;)GrP8xy0tjmRA)ZZr0CT4_=`zf&2i{ z&GlEO(|@#l_x`euyX)sG)aOy3rO?l8k4Z-UcJ${aq=U`U|36WY4TxtN^;vK5(>`w* z@kIa9{nMQ~(VM<-p!yN&prs9%j?-`}Es z?TAbNnUDCljCi8_$yR^iy;&V}yk4UA{U&!l*Xi#3JXt-A_8WsShF=TN--jc9DdH3D z_)E5Lyo|UXyFS|Y6~|vDt1rVp=7E2T&Cm3MMmpoeJ^KCCNauTw8B##=V;4q#cfUN@ zy0^^qc~<&#EB#52Jic2?hso+PPdN7>8J^zk|j5 zdhq8VePI7DQa?j`{1WNeb~^R_F|ZCr>T0BafOKiU#P-tln=R~ieQz@2-$h5p@r)`A z8q25rawDDbQ%3x&Xs>zTm;K8n$Ug~j>A#8PPqzl*RY;#;%U_4~>p{H0j#K`XPWxzk zpK;2YuHJ-w`oRxLgV;yg^Pt0jmHH0kedv+@qLKbzXrG*s?s_*-UwyxEhQt3kYwy+$ ze$h8^Kj!^@@mkOKji2|#OVpn*7ctC(4~$j;^;Ku?({t9tXiEt&wYnYkm%w2~7W<9~-^FQrXV~jQvM~J}PkI03vF}2UeU^Fj ziF)GvZb$;<@Av4_>Cu;aO9|xvx`+Q#kABlU`d#ng|D2~k6noOEJoJ@NB$}g{}GSBVK`H1woh@47tHZCWKV3wGA=}b z)9pGD3w;uBhD|3H`V{ipZA2{eE6H!uiG^MU9QvCc6^Mnt065LIRRwUmU2kIHSq7Y8 z(}{(?3K-{gT7g*TjlgMkf4Bo!>P0L(cLPhkh=tw?oNl)jvCun!Gi*As(C-J%x7*?Y z;Lu09j>N*V4LHqi@9pHrT*lCcE5rpc0 z6T%Or)K8!ZVgyPlP(^EiNswR&F+WtSMUVsq!J-kX*19PIwbWV{6kTgAu)!-TbTK&9U_ngJ_;W0DM`?~M*zVGw%o_lAwQ5}+H!*#jp zkSzU0+K(_k$92s}SUoe5rN0hV%x}@A*!U#N=3U3;W7=?1L?X+E->;=g zjXnshvh%*Kn7`pu8Oh3f9#~~0OD~}Pg~lgYdJ*ldPL@6ztbRh4P7e{=Mx4GQ_WZz) z2rrV6IBiAF_0d1)N9;VzDIgLzI)|uqnnrj5jFiMn`Y`hOctc_{NN1Hr3aHxewXFZq z*p7VBm%WR~R-Zr~Y4l1*uX1<_nI~MNsdz5Uh*@G%o{;SSKuZ6YKP~M?HZuY z(HD_fAf!gTl((5&L>1q2;}t3K(Z9Y|`?9F2f10X&$jB zmn@z25Rah2k;u|n4=KCBdMM!+hDa=XY^;y|_u_GT@yc>3?=7_91ryT4c&S`u*=z!< zTx986Y0m(W$kMlg6ILfne-0eaHu00CAEcgRbh7kU!Lf_+hI9fi#YUFRn_$I8mi{*F z$Kwr&Ed3pD!s=w{AA(iqWa<4e_En#GV8uX|%^6_DK$bp;_FsZCB(n6Ow6{80dOqzZ z7<;nx^Js5%vh-rGVkS$U050K=2#_uTD`v86KJ}bc>1XYI&a!%qCc08T(a~%U>%n%eIM;7nd6eB z@29=h$@VuiK$kN}Zz3nGt=^xVG>SXC3)86(IvUCo6 z^&hfyp36$UY+~d2OJk5M8~$E4c8Rf>LgvJb#NWY+7l2hRvhpqjt6XI1i)mkN{E($L z(cbE0>9>GYw`A!Z;Mip2=Rw+VQbZ!lW)nDdnbEg8_S?WEmm2*su;M2xFTeX&{AB6; zjey#PEd3eU+jb#Ke~$LHUC7dR(cbE0>HEQImt$bXMwZR1V8uq3euDNjrd(v{Z_?iC zWa)ndYrK%9<93smy4?5~2#)c@i!_+}G{gL@wPGVHZ$4PDk)@wU`{^bxS$YBOtxlF+ z3RY}n>HLmM^V?L1XM$s2GyWGj+yYjdWcj%PtT@TiZ>IfB4)c4>crF?Qi7cN3!Lcih{n_Lz4WCDzYq)@XmEjTO zs|}9^s~*Vmc@bFkK$bp%_TMyl$RYm6VV^ts?zt4(6IpDg`V z>itZ=B1`A*lw({7Bk?|X>c9Kvh)+w2bgg|mi{(4)?)m>16G_LfE6cM_8);2Cs{gw^q${p z{E(&RfD=|HOYaX>oMh=ksq1SBKXqWmNtV8d_I9mB zmflEvtCOWS)84MN$kN+rZ*{Wt?R~bKK=~HQMb+Yt1;F1nwzZe`p-LxZFHZ9;(r?I&Kta!+>xf!f@ z$kLb7eznOI!?Qb_Rkfm=0C#+7E z{sg$>tHypiSjQsEW+zz3B1?ak_I8|-r9V%5tCOYgp}ifaWa;~8Z*{WtLtu^H!(hcm zmd#PHVk1jGMtd6rS^BHAw>nw+3EJBj$kN}Wz17LmPl6TOAIU3B9ew~#-C_76>T3+2 z(I5I+!-K#o3t2vgf>jo>^nBXeu|}4D9__78mOcWk`Js$#$K3>Q{7w@CS@u=nl${@@ zgJbKA%>vr5&#>$l(`K~M+h}u!8AoKWD1^zC5HAv?i37FjmWf^{si^yg{6 z!5oV$eGl!ePL_TMtn~v~I)8tt{`Lx3F_2|*9IP0~(qE_j-6jUI^tWhlb+Yt#!7A_j zU>%Drn-9S{7Fqhow7NtRv)j@^$p zq|taO2C{4}0xJfxbWXMT58w@nEWHw(usT`#RIp+oOJ6|U-n%AC=VfZigLp$~#7nV} zWz!5+Y-H(ewErI7kjT<+0w=6amd>SyVk1lE6c#_z%$a2A_kmLn;SGr)DmJog9tJBm zvh+=~|32Q3$kMlh6ILfn-wD>*gDm}dun0VaSxZlh0JC{^9bE4c})fHKO&I7Bi$kGdF z{{xekEWHSvusT`#Xt3ImEd2_w>S`e4$T2?2vf=nr3}oqp!TFEi4T&uMY;eNrWa&j< z#Xy!m8l2jUH>4?erMCF!f5)nLrb3ea46x!MOP>YKX9qzdOTPk~usT`#La_P|S$Y$= zbRt#k6H_`r4ydjaL-vUlpoh?{a&zQ;FwYjWZ7^`DTeU) z%Ks5|BC#vWo?|Lub+Ys)!MblumhO)oJ4W2Ga{xA}ZFoaEhL^?&S$R)@W%CYg>=+@- z=6%P;A4hhK^cqL@Sb6NjKSm}bvi$Hn&D3K?=a^Dmk!8a%rMe1_ul%2wyy5Ycu(~_G z%HT)sMV9~RV71qIa2FqJ#yeRyMPS87mR<~2Y-H)BwErpIkjTT*Y-H&* z;QS}>hD4S=9h|T_S^70#`5{YhqHg;GS^5p&)ZgL_>1Mo2cKGNm$487E3TXpg@gb&8 z$jZxpo3i#aRsFdA@EPc;AF}d3NBgJnhD4UW3!JbzS^5#M`Z-zpN$U1K30be>%>JYDx_ycBv&!qv)fds86@Wz6vG_fE z!s=w{Q^0CRvh+n@wb2>yr5MPv83a}gWa&d`|192+$kOw{39FN(j{qwMvh<6<_%ld; zVqZkKQ7DD1Nf+8^Ma7EWMfbyYPlYmfi+V?7|xo zS^8~Y#ZQ*L0jwAv1jqK^4e4>b;zP3nmOYy%Wn+F7teDBNIRRG8Wa)ndtACQE=dgWk z|0GKv2u?i@L!`m9vHg=Qn{yo-&U+=hjXl>4ip^a=6hl{RWcewj{ok9sWa*=5Z*{Wt zO0epaEPWVU#P(W01sos`!6}c%}Z)M{k|O?4PmU7@hqyb;$50@&Ut}@lj&yb}Kk`*y!xTv41kmX-mv5 z6|=|M11_;PEUNV5;P~gV@a}oX@lsh%g5&%_2NGHO2jJ98RPld}*f-8GHe}iGT%S5> zY&fr~|Bz+FIW~60*!Xj-jgx&co^O1*{qt0FNHU66&pJdrA2djUQ zrQZft|0GLaP5YOPPqOs2w6{80`u$*)ohHy?!T4 zuLCO{vh+n@#Y2|fNc-1JJY?z3w6{80`pw{ye>L_4@e%(#1SGO-c71(*R(I#^InY(l zWZ5sK{sj|1Svu#;)SGxi;+$FXdmp_O_)wf=*>`{yCt3O(;QY7nhD4Um`8Hv7vUJY3 zijypT6Ij2mCQIkstKV0Xr9TOlAF}j3>Pb^xvh=~=)Z2JNIvcO}`NoDUnP|5GRNhLprB_1`4(d-Bw~hD-6Gn90h^v7ngUaWR(m z{}*paWZ84PB&<%BUISLlWa(|x3r);q>FdC$KjIDPF1!>QSvL286&qRleYAfMZ%Ab6 z?5hc@lcjG1m%NWRq{r~mvBPL@6sToS<>(ky)FSY+8;0oJj|(zzbX&%zs$yEdCg zd#jUW-v-w8K3V!5;28eq0MlLg$Ymd!no5>_Wm=lZH7*VsSl@beD8=@k2(B4 zIDc4{*B{3v%m0Vqgw@H?`SoOcxS0pY(s`+wVy8gjGFSCUmJLtss!y_XPKEiWo4jP{ zT*D-+?yhIXLf3pwmi=6?j!Tw)4Oqt|OJ6|yGt6SXCRfz^&==_|nbXBt0b z=^fyN)ydND1IrIt`c~@pz7|>fN|t^c9E%%2AAwVY4f8kBiia%w9I)acOXu?>@`sqbWa<2Ub;9ao>HJM~ ziD&H3Bis3kzlDzRCM(h`uwo!9?-gLhK$dfkRkAo9dCrdvGRv#lv@1KLZvh_B|;bCCa z8(H=vz^XU0^c3ywammulXm540^eV98AxobM&OgVLi!6NxIAL|N^lQMXH?s7bsoQ&} zWa)QMxA&dM(l>x(XPM(ZM9w$730#seyq)}KzbX8;NYv<%@qY;obKZ;$Fg%dl&v1;K zXLvB#);ZU}k<&6ZsV`(~V&@sAO^PQ*q;v6#7n%M*R{UK1#V;_ryAI^~w&Z-1w+O5@ zB`a?+SZzv{PCxmDCa>$$Ut3z;U0YVdUTsR2pQ+&3Fym*Y!`C?6=5Pl%HQd;*1uJH< zeBK3C%w*|YPv#eyykzNIPbRERmi{<6Hp19*4Hh3^>d;+}alNEI=B}Oo2t75@vs;KcrN&B(ey*dlnM+beXEVoaUb<7>QgD2vZC|kB_t!|)zS6O;qP;B( zS@u_e^XUwUES>9?gw@?O%mU~tJ6ZNOfMXZn4e1tqlw4@|HhieP$g*DzR(p}9uciH$ zd^i5z&X9f=?X6Ch&NWYd8Qze{((eN&tWK8xFj(=ErE`s>`vzp`=fQ7m6a=IZ4wsSn z$1RX1J3NOx+UPfs*&s;E$>R*)>+oi9>LQ~*O1{|ecJg?`&p6C$f!GA2zwYR7f=lcJ z-q|N(Ht)NR&HG^W8M4awv18-+Pn(y^wb+-I!?d`ZAOW#U+ ztCOW~qdhwy5?T7=w6{80`ZM5?uiy>oS$rrqvTU9QD>kz9J+!wmkfraVz17Lm_tW0S zK$d=x_EslLKL%EPlBJ)dZtrK3rSo2>;&<Oh zr)Y2ECrjtGiR$(uuwo<2W&&8Tk)>DC-o`+dUPXJWlci6gy^Vn^eJbs(PL@6gtk~v( zQ+7_Pqs|iu60dy}Gg)~TgB3GbdK2xdO0CQ0HnQ{?w6`&nrO%?hjg2h*3ffzpEWHk_IwwoNnYtZQWa-`D*fdj? z&E)BZdH&M#6UefEo;FjB%^tAIPL|C+u*y!BzMuAAHF?R>57OT1Wa+PhRTi@Jx4BpSvt?B`7=yjvUHwL6IOT6tywTt3}o342A9+rKSS}M7|6282P+1$ z^z&$M+nOxBfc91=OE03mZELdhV%l4sES*DL{c|YF72`=2DT!C?>xS9?)gRoka0&F1 zS;nRkta6d%pZ#3rB1>mKSGmG{UgZk+dHudR+~@WCYPZkNgMYOJS;xJBy6xL!=?{Tp z-!NtA2CFP&*|5*6EM)1Af>jo>^v7s#+lVav3EJD=gp;K|Nqei4rE?sW%r>!c?4+(R z%<-Z)!(&HrhR06+l_sw{b`HZ&!s=ul_bC0(HTGobT$d)SPL_TG9J|`szX?u#)9?r2 zl4}g-;Y000R$h*U)K$iY{aO90lsw1ili^3@B`a?YSmh;4pHBOECNEj~OxjzWEPWnW z*RW*ii@>q@#!r*O>_4#uM!(D9`^jmev!96B2V!+bf5G8b$n{2N9jc6E#lZSh8OhQ) zkLmxgkfpyv`&;pbM3(*$SocfG(sOY5l50&2x%f~FWZAI26ocD#XVBjEbF%CQ(cbE0 z>HZwJ5eG-=H3wSVodbsHnQ}ww6`&k zrH`k*)ydMiJW_0v!Kyd1Y-+%YjVygS?QINX=`(3>b+Yt1w6`&krE@4MHnMbfHO00N ztk}r1SqxTeWa&+`w=s~Vx6t0|Wa&51-o{3jelzW@PL{qJta*Se{UPdhekM!j+CFw2 z-jF^bHyY-DuZ@2ZZ%Aa>^Sg!^14rWb3$dk!xvmy-Z5(ShI=>@`U2mA{-WUsqv;iD% z&9MC64?Wdp^v7s#<9UL-#OP0gORWApSoKeqpFLpJKUw-d+Or~&$kO-I-s)uO2f?aO zvh-u%)Q!f^ad7M=!>^N<8Rq@=*tZOy!F$C#AtRCHhxgl4w-_5fwm3J)dmmB>OaLKKP=TKi^_-b(e$_y*-Jm?9llcn<+CMCBS`!;ZVRfc7A3-nlr z(YwK_f3j>ggH``z>5tOB)8r*fe~k84Crf_ls_B$@H0|M8jQ~S|FN}(7lRcK zS$>+piia${h4y!vykzM&(BA4~>9>K^)@14Hz&eNWI|a2PSvK3K+xd+weLGk&lcnzj zD`v9vXKBCQ#7vg{JngMcmi{7G?X@4QW07TZ5UgX7r5~ofo%6}kkJ8@iWa-CfZ|8in z^jB$bb+Yugz&cO84OVPq*}MZ*Y-H*0(%!~Emi|8NtxlHyA?$g<(HUlbcz z`Y77l7|7Dc(%$N1>3mjSXDBK8#{> zpB2OBz~pZ*e!|a$Nm$)|Cd`xc zv)lw$3}oeP0V@WwbY7R`-)H=grSo1^!s_mQtq$ml;SO->yC&}jhaUpRtiBbjc*yd< z4Xk*`(jTWiZ~P;XrEdo(tWK8B>wWbZvh)|hB@Y-s`@xEVESrO1#Xy#RnD!5vykzOT zu1{ESXDYz`8akOP>kO z|Gx1|;MLd3TXF8GeC&9?7td#lDfSI$8Q*aLHz4e}s8+@PfPsY$k!_lPrBQ?YH3# zi7dSaoUl4s`W&#zOP0>tQku8P(iedh4_P`dFBK12IxlPUe~dRIvUFauCag}D&dV^x zLzaFAxa2XsA+5zn{!cP28=jIARwqm6FxEMXES+6M?MRmX1a*6kCQE+?tg@4(KL=LX z$6^eR3t2kv=cH`AKMRgo-b4E`ydjZgzaO01X^#6x+Sqd0a$H8mcEeo9IQxW>5IV$tCOYkT&(^;mcAKW@^j-SpEl*F zNF=gsxUPtgGCEoMSa9kWChsM*sW3KV*{~jDa|LZUu#m{InFmgBf0Gat*s`nxD+aP`xQOJX%?NO8uZe-} zE1vG~T!-04seQ)24xG;)Xdsd0a}hXUb+YtEaLGTIytjb0_9M%t1FW_nOTPoGwjfLQ z+s-}*qgUHm-EF(g$g4Ue%g;`*%KoCm$H1u1SBeF5$F;|+-{eIYnu zb+UA>i!|2UHPUU+73aMUZ=(IL@P*xR1aj?90aQ#$kGqf z{+P*2mVT7>Rwqm6cRD2pjs2Ts8{654NyjD2{#>w*OO~Dl=f7h7kfjd;C#+7E&hx3p z2wD0BaO_`(ZOJ4z2oMh=8;QUvOf3kFcUbVVAuigtA#YvX^ zX6hH4c*xR|;M8&Bzli*r;SpfPNtS&ItT@Ti%V^I5heVb>8l12?S$ZW{agwE90gk5%QQBLbEPI}76f;@6e}1=h z>z?0Vg-wZ#|2SB&k(Kv#uwo-ie+!)driqO#{SUOaI$1i;Q;Ll&Jr^z%!!YQIfh?O5 zV8uX|&i2iJ%ft|F>x9+aw)WSS_IoRLZ8-&g)Lvxy=l!eve>eWg(&vB^Rwqke2v!-% z(%ZnXw~e3W4sUY!32@5V>;lKfo3TKapBKTY|1f?IfK^vy*&G6^uE^4l(4Hq5B(n6E z!3nFArN0T*`HL+59dL<_GYNMZvt-$v4V%6>%BCG|_v&C9$c3+n6I8e3~yTN`WfSzb|lUH!7!*7TzKy7tEU+Sa!D*Vfn8&u?k$ z%e1*=X}Z3(wKiSf($=uBAw9pXzV?RtmWG9W8Q<8_fZctVmbTP4&M$4Nzp1S>6NRyE zt#5(9+C}w^jZ146EUjDS4ZF$nO})>~)!c&k7tL>}uk*_U|9xj_p5M}1U)!hk(z^L= z^Gi#ow%*v#mR?laHh)25y%Xf8<0 z+FsuKw*M=uERz}4*xInP$sVq+?BVeK+8lm=VKslIZ(7#hlwLHy34LnG(mI>N?SiJ+ z=QlPt`Ss%NGV%4f%XXHAYis8>UVDm+tw{RaxeULD5fjOw)av z<}dk7SEh@%)VH-Pt8J;jzP-Nn6us3P*&RkQ?@?LxO?9;k(RmwDB^aH-IIpW;(0(mC zdqY!OZQ9W}@~*9Kt3~6~VbEMxU)$C)zo|9d($I`R(o2^tsc*`7p>-=pK6+GbLsLV~ z9cCIqmgaU0c=U_*CCzQLTr$744WqfWK8kQX`H6|8-v5PHKeZ#tXs@L4No6^ z*!QR;zZNk5>YMzr@o9&yZ%Vf;Yv!|JN3)Q$5O)Hk*UWn)05u1&bL3mfNO+lu2f zw5D$;o!{2h(y#!P)H4I-Tu7LDTYC6mFS3(HZQIgbyVbw#uF|QcVFzdlG;pR_YZorX z)Y{VXC~8$>yrlKo+Q#|I>U-MQ25zb6eBa!9UG0K~rn)|DGQH`>mif)?&3)H!FDun+ zx~-O{sU!*qUKUG1XQ+C_CO?2cG4q_4wB@5_X}=u{?4F*Ph>fd@iW zVW{-o#;x^@_2}#AhUP_RuXe7JI5uhTwzWAFj)L`rGf{`lIE@Fb%SjhUZCct^UwY~E z*(I1<(x-@G>B5EeTr9yKmUMm>XsAPnZ)jTvFIfNd5sWd@+{3eyfA%!yea_^49K}o@ zp<}owDs-S8$3`J~)IfMYhF3%DBBzSN2Bsz#)}v4%tJ22C8Hg>|=o9kPaq8Inwyf>=+ii?s{8TdWF4&Au7W#){bN;Dk>#!Il6ah+yNO?;;` zT-Z{d35B_I0`+(FIRfhHu?kw!&{W@}!2W_bC=@;U<2c=Ht`lk-u%2sKx`Y>L;2wr< zmHRf>-{+B4YBSd|E(&N| zKw|?M6VT{@$}0lQQ2D4p%usoGAUaeQh#9yj2q&O%0gVl4OhBUpDz6AIL*=6aF+=6$ zf#^_KAO>*pxFDQ>#sxGspfLfB4ye2$zzmg-3d9VRmj|LlWq}yL#bbkT0vZ?4*nq|a zG&-R2iU2cIJ}MA1R9+s44wVIB02hx5!Ur>Ss(^*aYYbLK;r@$8_<}5%0~y7 zq4J7A%uxBLK+I5ipp};e7{JA&f^Y&F7tq*%#spM8I=~E-R|H~)%0~rahRVwW(V?u%xx{@rPOO?T~=0G zW}w`VnLercbWuR#0va38n1ISh2biJqia^Xz`KUn5Pu&=3GQSg2lE2eo=lXl>d-#qB8R;*Mm*RT^g?If89O8NW{!2;zj>FFNx8nPrw+lw} zhb)1=TWo*Eho2T;=Tyu5kiQ#4{kalftZcx3`uiMSitld#ZhVi!AODWElKedgjdG>k zaR~k%LdT=ObMWFmj<;U}=ui3T@Wslx*jAz)6aOz4xsn@5jgR74hxnww1YX=ne^-av zcLn_QRo-ue+IJWH%|m|r`#fIqmqu`Ic@My!{b>NKGI8^_H*S1M{C;Uzw(<7`#~*)E z=lXjTh2`%vm4y7+r0cKhF^mt}|IT;(Wrh5W#lgn%05-|rUqbPn{9E&^NS3z{FO`?S zV|C+eOyaxzKKxx7j_)bY>xM>u!ySKr2D|^Cly78^}2hZc* zJ7s)d#7p(}ZP>Z~9>&hCa)wX&yD8+a>>tgulIgF+@z)TFuPSB!zL{LgUmfh+_&$Qa z99!NC9e*6tZhVt)u(#v{`-FGeJeBzL(_wtqYx`e01eKRRb#(m|mzi?dT!FvmVdTaa z`>lB<8q3S?KjkkAb?^FnAO8ANuu1X#1>pLd^0N7T7yXUFOa3kl`TH2bPw&HDG3;D_ zqmNqr%?LPMBCiEfKUjY_6ljRJb^49=6 z*WYNYoA~<{#`h(>RNhZ;GNC_yugtUv{z`blvWffn;{O5Rr~Kbv-S@m(0>`vNGx+IA z*wtC)2lw&yj_voKLR&e(rl$Wux zyiBrt4(C;sf%-fgcUPg=|0fu+USfD%IBN9hq?5{eu~EiavoRNs88_CqnU{BK_0-9c zh>l3#|2H^3kC{Afj)$s78iD>2@s?emd$iz4(czjy(+|!(FlYbV7q8hje$CD`+wUx0 zTij9Do$D1Q`+47m{qI*G_wH@CkIThMAUD?=hn9}_>*w8F-IY7z;(|`u)VIf@(Ru0P zmq&JVUOw@h$?4;Jy{^2)UdAG_yXxvYs$~DdSBIY`;9xElu&PM?9VrPo#SLjDlJB%*wj*-OCo# z9Ilyk`S#1J=ijy>a(VyC;Ap%1SFS3Go|b(<^=W-XQoZfL_-To(zK-<7mow#3$*+nG zIBiGgRTI<4>m%{#hOCM^Y9{W8E{eo+AN{0j_1;h7-&pMxX1(n_lC|H99|e1P-Xq>N zuQ0OTdn9tqEA0L|)Otgtuj3uRq@eTg?Lpk#@zY{i5x!?fx@V&{eqEjRp7Np~XgQH? zG~EBEH1Vw5eFZNR?J4dEj=8(9xOSCg>Y=kL(!H|Et=+zI#LAro{xV7qn&b;gqd-Kr8vxfJ}b?^%Oulo^n&;P!?-;wbbY1b9 ztUX=P-+mH*@4Yj3PcH24@1>hx^8RjN*XkRV?|5ma*STip?x!*Lc6CO*(v8{GQ4c-2 z{f}pk84@2e#LJJq(caa8*=649NY`~kydBZi7-j8|Lj0YHOmEuOS>|C5$hpF+3EE*> zN9475|8w#8b!$2|bq_MMZkIdS_nLEl+f zRhax%q^NV}jG|fh&C0#<{mT~C9Icsr`OeFWrq-hu^)=rvcwy|C?Q6EJ9WjyfZU5?c zZe`iycc$m<_10h{-CY%qjjeh-drnX`^u!#_xXU8(wX?j6&SewR^Qt3V(I>Lv_i;>I z<#jF0js4)Z!WE}sl>E#qT=^^Sk(Iym3UB)!X7b9imDMU^Uq_k|%^WFvOI}X@>aJ*6 zS^D@Ec>WghmwiV5C!G9o#H3@b+MJiOYD>MM$q zg_$T+-peA{FIA<^iSFpU4834Wud&T~DjSx`7mx1B(p;Opu_`qn>W_j5MnPnoM_>MS z7Phmtd5A5QeY7eSk1h^IWA+goFNc1DQlLh%w?=RM8cMKbdG9{L7&bVuN2*YV-qdOF z_v*cZ2h+F*lPOIF%JD#TdfrogmgLY`nUb&_vai}ZDxUkjkGqECM!JqhBj;b5KKUm4 zee=MIqx-z*+Q^=tuN;SwgtIY6(p4NuUD2QY*TjW;qPtf%3{7J$t(&&;IOAD0Y;XVc ziX7BIj`v1;yd(MnBU_Vm{^jw3%>ySzC$3ys9dYKGRU2RbWXq8F#%LryCmKmNFO2M% z{T#+_dPCIru_h<-TBLi(tYy{3Iq7-zk#W%#>5AF)k?0!wWsPR-@sERE`y=$&A64G% zmph)j4gZU4PUo@CgTWkL+>yqDeo$3>_MIMjUUqy=2TECmwMU&-n1eHB&RQ=%=XS5_ zw>+zUh_=HSG<%!(NcLjP3p}$vYtO82d#tySIfX;(EBfkVWkcuS+*%NfMOeAMVb67F)wuGEcT*Rk7TXw)mu0(RgTD5vxTQji>`_6?piY#=gJ%}niD<(^E~0? zIoJ^&g1I9ajhQim`ouUX#L;$iRN)MA=u{)1s-m-P;>?YOxUo>s*?Z+xFqLbs2F_S# zN4mefGBejlx+B%Mt@!5ktM_esVe6j#yQaT7^OZTr=DvK*(FI2q9$tK?>0t5tt0!KM z`hCxfZ@j?Ey`>Jv;d-uu(a}Up*bk+8&3a-BA>a1_RJ8k~_&t-ew zwOG$D4(3eusg+eF)sgOuwz6sow!<|Ot?SAi{otDFjNRhS%#6wY-23d&m3w4EXLYn{ zv2*@N@5=GgD>{0$RUZ>)X3>q9<9iS^L9v z`!rTeUAOo1)?geo-gRj;U0D@9MX6_Rb?b0t)t7tab-eri7jsx{G}#qhk(JrgM~}F!EB8Nky1wrY)y_75 zu0C9Kes#Keqj%!6?7btsReJ|`+567%Ru!+$UbXLHuOK=p_e6B|`roYI@%t@a;iDhs zhF7i8#a+3_ezG1ll3B@T?`?pmE8*!fZ`HnK@UkbmAUE*x7`)guZ&z;dCPTLt$%0rm6Hoc{5&rm+lxN^>wa97K2@EL^*&Ft zEvxV5(RJQ# zZC!lzf1U2-io~>OZW*IWTv_*TZ|{ z`G4^NZETI2U@h?JCFuOg|NdxQxqp7zZE@E1#i;9*Rag2oiED^YIiuaSV%4zI zb2ddQ{(XzrwRU9hdT;E?eXe7D_34){?mX(OX$rUHEKlQ`wW1fM-#c!$7wd{Xwz_m5 z)?#_XaJH}im*N+3eRZ-TI(K5a`Nv*-O^uhHR~*USTa3On9-}UPUo`Ty_0!f*igsNU zjZ{R7ajnrF$v%+hWxtS*zu3OctGKSy`vK~1?&>|kijnhRK~6<|M*Kfo$0zA|PkWnkXWy0fa=rZ< zvkxrxzMr?FbN0kF(e&}oh=+4b4*rj5wR2U-BX3#c^vl!7Ya#{Jt1hU%HPT(N`T;My z80W{%ky+a|rdQyeS8myCuCXh4XW-KGyf-ih4Trh{>Q-;nKj8fM!VoY1-P^s1-x+{= z8E>M7c7JE(-&d@D!#iur`h{K5A}@Y>?h`v!Z>dZl&yB2_Jj7ddX%waYm%Gv{u+r~W zO>cA3$KUg^tA=~o)nnjc;`)l!?^W^$mu%#fM7;Ay5v`OypJ@-&Yy^F+qT>N?%K){6 z+Mz4=L4O84czdS*S9Feyq~~qM75C=K=;U(~`YqZEobXRa^GwuH3CUF5H}#TevkZH(Gr-m__|r^UkfEGlRBU zwRdj63fySwdT;odg`02gSGcvN-y>_E&HZa)jIK-1tLhyg)_E^H5st88byWm0_l%_1 z-GZ*%VSgJwgRiXmyg!b4YdBoP?o9I%&O3*vrB|HpEvQ;mmE)~Sp%)DpjJ0A;kT2f( z7tH1xgZnye{w-aYGcJAS0Ue_&cb)CYk)YqESB&pnUd(cP*SPc6r_XWGpWXabN2AHxE`x4Zfkm=5y^A zqzug7@b>J{Yv zW_{tdfy>h?qF&9$r=yRZIp(tH!gwC$khL2N3I@cZJMSxgF&@3)yT$t|qH8PH8=nKK zFe=wZva5%|?`X`}I~tzCs9cMAdQ2qya`dmu2V(HgyU+*ZQQdD7sdkbFZ7z z^g&wUzTs?svNx_8{_E`QYTS)oyCoOfkr#It7UwO;c_g^Pjpus7)pq7ull@Dz#;X>u zHq)Qu&kgpvem>ZnS(AHgD|@#u`KbaQp&L=|V4@S5AdXRwgH!JVJwpLell zEF3V!?AK`Zqp#lR6$O2ui+2XGF6L3=9avFxuDh7gZwf5J^-RyPMe+U~t~@pc_gYu& zAC?u59>Y3xcCUF$EyFvsWeYN8_OD_5b~$xxGEWkvR0%R|iMv&wIa@P#_kg}y+KuV> zXIjMa`tm{VC&RIw-4&ge^XcW8;d^^z1y*3g)@Sz*zE@-a$VTgYdkF3+9^c~SMYRqn z-PnI3?=fU`PON!4&&yh$$1{jprn3%hvigtTat-bV&dJPBDAm*W zmZPg9C+Pj`L*3{JMXO(RR=PSG_wMrd9=m-`Fk9meRBp7pD|!XgXZuSlUIeYKaTjTA~tjKHOGV%=c#{E1;$b0Wr^li4gGXz_uufC!F#T;8U_V(oN ze-HatabDTGH}U}PPe!AK!?tDlXTBVsZ#%0C`#m*^GruC^tk0tsJvirk;c~F{R-_kq zzUtIndfwv5j=aSadF449XPVP+rb+NjQ}>iJ7i1Tm9x3j?sP5d}qxHf^U~llQ>v{L1 zFPr9hnTRtj#kk|>!|caf(2u|7_vnqF>wWqG`*uyFCejV7Y+C&&u(~_1E2rag;bTQ{ z<#b?2cpcbv+L3-w;~deoI@cR{>C9boI=LF<3i;KbPjQ_S_J-?r zwc1lW5_@ju`$x{JT%)Y2p4D&6nrZ7F$=jS8zwx~@yK-N7>Tcg!Ew{v6a|d@mKJu?9 zGkw=Tvv>9j0s zjC8-3Z+c-@-c?xl%tdef5_;q1_AW?8F0Nzet;V&RYjYHKa8k69XBAMd!1tF6m%R9v<0#rFk!^D#0q zSIzNRQLLH{;yl~)>Uc-q%@KY(mago?b@+y?w6__b*p6*REgyDgK#W%OW_&kcYiu0M4S^~-bob-Br(#;+OWG14tE_W{$#7yGL`wK5}` z*NSU{+uifZK<5rAN6=@q`I1lHzrxv{Io`@kGe_*oN&e~6eKa?H)`;2VTW~h*aR43j-#fFf6%M~o+Fr@ulbGMI6nA94wJ8YBeUaBvmFq5>arL^11NZS4C>i^r zJvF1WGdjG!u+e6cpJMmqedbP$CTcG(y$8&dj!xrx>v=#5u z52zkkd0<*$){nB_VMt!o{guPH6T`mPb7$O~@s**z&M|)5e=E|RS>N^c$hFzYWf?zy zZ%anHGs>wvCvPcmzM05;Q;^B2-|l2x#@dTV|Kxu|l-VCHonKS%s+L??l|6hwWa`!Z zC*HAl;LDM2(_Z||(TItwX73%fan`cQ+j4j>Z5-AjJ7$|-iQs#sbLAnjTV;RRo})AO zy80fAl>^;UVU18VqO!0kdalaS`*%qA9@^f`>ztfExfLr=-v7D}YrrUG`5~C)yKrxG z_Ih4#$2Sg$#IKA-qPVYD6v-~m>GgdpTX@&`j3IN6Eqi!gN+l{Bl$VND?+@yzFu5%i z*}b*1CRj`1mnMV8mwd)dcK)aDe*zKch?#4l0{5;(XZSZheYIv~K>_ZC$dm51s2wqm z*0Aojca(PUZm7BYfi}mPdZTlP*1wyCtH%L3Y46@%>j?Im75!?0ct5>lhjKHPnUeL+ zL$99WHM6p;=}`;j*J-AQ^IlQ7Y^UGFb;w@y2Hd4ZkH{_>kYm1y>B9Hu)7Ezljz)H` zC>*@CC|rN+35Tj`oH3S(JbiMr7um&{Qr-Gjb$x8F8jfFx72y|RQ7>zFw0Ajmh2YN> zIGX%@X5C=!%2@M``7fPo%pT@6Ca0k6I91&Zz@@)Ff{FWqr`~lo0O*eOrwRcbS>kO1Lhx0G*)`tD~qcJ~|-_PS;JJ&eh+7|ShJt9?wL&sF~ ztYbSntZ`?DRn>!W4V2@Lqptfpz1i!#hIV?ZzOirAOY8SUyN=*jM;pHDy@xv+8*!g( zMd6N@HuCpJE26jp#VTU5%GDL^{-3_Ssb&1l=Vjs_GOIY}(`&2p^BHTmw)(1>L$J-< z8TPG{{C53Rb;IA64#00<6?N}lS@Zn8%ZayQ^_oilk})$oM}uFv{JeT=l)nOwbYFaZ z?yCi_6dkL1dHT_rN9G)!d+3^j3l1#Yzxc(beZ_aKyfix%%_%I#J?4{pz3q3dpE|B) z#hF@dK8^bvU26t-(fVj!SKgLw6`en;OrLzri?6T7UF#p?>Sj2;jmLLR(H%?n;x}AB z#x>7VP<1xs-GIBR=VBH;9GtTvudS~>>(aS6iyg&%#_4yg48Eb*5&e0DzvNtX!PHw- zqtSYfq~Skij?DT!g4tIVT6?Ki^Zv-jM?Zc48;^D(D%EtRCFeT*Hqu?(fxbIq!K}lx zCSAGx%7VG~%+0#$-OCqDJv?>NwC&T*M|)kkXz7yr3tQTo@HmPKZ(Q1P-G%k7%_a7! z0;l4V)@7|1%BHblLCgG>Wfx{1R$v~jfQJ>dUf0l^?DoOJX_1ZZ;c~!;u(ce79j*4%3O-oURrPnpo zC)<`LTk#yVFD3o93>q&~b;dX(+7`2p`p!CD?TROrB>e{!I&t?bY4D&q$HH_lJbjBh zdp=grvFhnZ9qF@jO*9=24OmkBm8vP#NrtFnB>Ct*&zdx&`})1Ex5bw)Ne*vyp5vjX zkMwxv)dY0+*5nAjjr6AQIgc~>47{245qMwspL^x&o}NdQbi||{+!E~U4!*-dz&5+1*VQHUMMhNfhnWh(WSG~j`E7-J1hc(7fPPllv%k0LhU zv2DTg9n~B8FeW};5`75+vUPqf9(>r=vUC|6&aIyLd<esxQiBo{2>^X4>wokz!v7+yB|rjbcJW^w)!KA|R*J-uit3XpU% zjAyeUPjY0kgw?QMeqFM${@VHJWf(w9SYSSS4AtMZXlY#!Z<+qtqks4nV1^9q%v;C@ zbDeV5J5|;7obnt;94G!TYt0|DaOo70s zonA3qF~ox%c0>jHaUN}NNg5x++f&K5MfDAt?I0V*Rx;g=2h&>9hB}Xvq|wH6B+PEQ zu4(CwO+9AKQt$Hc96Dln>qwp;@o=_e&_<=`AEpI*WcMds-?>|J=6OqgrQu0zf5j7f z^;FKj9*y^P{~@jirmLaX0;_91vlJSJ};p7e`(>^iR=kE>gPCwVn;t2VRMZj0}q zCvX<<`)e|If@Y>^TRlwwpRzaHjxPvfVaX*KzkrA>UsrH5zP;hBGEa;$Wg zVD7O~E*^c?G{22!c05maDW2QBXo)*#Iv(ZFsWXK7>G{#0Ft2;4LbJB3ZmRq0!fHNZ zx(er1c8NaqzPhLFjhSw$$2kW5)L$hTe@^9?)p;+OXVAVMUafJ1lUkoovrT%zm>Hj} zTiR65;+dX}htMYNL*bJ4p|wE=>0@8GN&9$)t$mhkV*?&w*s!D?vqHOPH9oByi#%6q zTH2JZAD>x0*%-_R8W_)TvnL$u#2GQ49SlceE1dUTE#6nSp68+obEz$TiEoTS$Ww_q z)7i@hcaK-~)o)C{bY@j-@L>FR@nl)$xk>-?bKcqhQ$6_Q$LBph13jFw@!z!ZpQf_# z)6Xni0B7NG1zGqn-dXs`L6%qDYStwSlj%l0axPdhjVdd}bC8lF7PYlCw~oK?!fVmz z+ZXV;$Gi^omof`4!b6J#kYlDu3rIcrCijT%#S(Wr|@dJ`ujBL4xuUSt9= zCl+nFp<-0SsOIw8C8L_lYUh*Eq??y4X>Tki%%8txse#6p)-)(wD)_;2{=b7~4}1^%r{Kl%yo&#f|8HPCMkOfUF2|nv_l33( zgtqOUgn@@_?|Y}?BS=xNXZ@S{=HDzZsh@ZDnVxq!{0)Ji`W>&`wtW^k+uP8-^I*?v zqJ2;Qrao5(_5-|eh`$B)I7}b*r}_0cI4FoJXzQ-gze|-cF*`s{y9PZ)4ktW|Hy{?rM~|K&VC**^Slj{|5a!I4^a^-alB!E z{**Ty+gq^BX6Ri%XZrp}1^Lakc}@bwGrgP9KlnGGXruP{gYDzo|4RhQKLx{Q25JAt z%<88zy{lLsq5a3Pt^L=dA^0bF)ZW?Ho`!AJAIr;U=*a#*v41GG3n1ut2kjVUJR8v; zTCsnmvwyjh|1FeBvheO-Bm?%v$^~JxxT0= zLGc$k^~q;}ypH{xAGE*5+0XcHcD7%IJ^#*=TVKbW{l7p#^HD#Aj=ycr{;y&Gm$6^* z^z5H!g~rn$zrWZ&%L0#sydx-2CJpxYXU4O!za}s++v|eko9*0wGBDdM+Jt|W_cmwy zzY*`3aB})QG}X@r$KMd_Z^wQ-nl0GBE2w|t?-^(NcjzyZaD1FE1N*$7e-83~4}Z%s zXS@CuIQtpjejLvvuj&atX-=2>BX|R7B_HO&X<&=;1_Ro9akS4$V z(@nv4f2Vx3PldMapStnw$6!3wGA^QUKFO$si&JM+2*yeds@im9y<8$duGVwKr;(H>r|Ao-@ zM~?jt9Pb<)jB}ul$G>Ch`ad_cT^!mjbGEDDZyNleSp$DpIQ!W?S)uw_=j@+|{oh3X zbDjLhoOqf4L1+6yjK^nSum0SDhB$z2m<7jgLVKGu$a@NbU5Ngr`TI8TM%WiR_Rl!} zdA#MJ{Q|#1V z3-O4-s#|`dfwix&qto{PRJ`f0mQ~AJG1* zobmNPXxk|$Z_4^({PP_9YjL~|*yw!yw`k90Xb-jjmGHL@{&c=%{;{YZlT7@po%-PZ z!N}w89~;`f$tnLy9Pf7_{~heSelq^IhPGb}Z4c$(ckE|4{uxhGXd4eh3GCsPZgtGoCf};z~ z4@X1&ndb|W26^?c|4-Pnie&#`D89T<{;@2)pGYw??hU{~px%rDi+q)e5H&NC&>cgGi zPB{DNpKEs4-*lAO-QMKH_f;@2^qEEd;YlZd0sQ?GZS2l>lSBTl2yM>|ZBKUU|5w=e z1N2db%;S9%+mB;=sB`?c9eb81*V$f)c)7mSe9Zk=2H7;on}@lg0P|^y$f#t#<5}V69Mq_SgCGzi|8)kl*bOuQ>M1Kg;RQU%|dMg@<0p{Y_5&`rD2@ zw;y-?fjQr~=f6YF{yV@2&_0Duc_+h%Nm!rbSpS9nI-k=2Feg8^Z*lBzMESmo`qTJ0 z1N+j>wr?NGzbUkRpR@fZ_`4g&r=qlF&~{B|dv0iZp|kxrC~plqxB3hH z9dq`lu${*K3+(Y9LiyHW8*)&-+d}187utR(w9RMynl#8;4u4<3dZf(p7vtdalc}#V zXL~>DSK#dD_BGD-8|eQz7_aJ2 z|6$jnEByG+_4Chl?0eoH92~meVD6t5n8MhE=DKka9Qw&#SlpK-RUFus`3Z18uX zmqvYl7yi}%=er~KE!z6iTz*n?alq@m@PB+{|5P&V*dzd|GCb7`n$y0o(F%g z!Jc)f@?@SbeXjQy;yV-TH=SR5-Y+`Oub*3x*CeyurcLyUOHr^k%)h35;rq2_{A~^F z?Ra#ycj5TAp?|TO6yMMweq)~#+Rn5`(mN9w@yq96eD;jr%op>5>uVmjs7f?yBzh{3j`5Qy~Zw~6q?B{duO)}eOgtq57+n3?^DIDMJ|5Kg)Jbrg*dsApT^E~un z-V*fJIq+A6092mFkbUO<*Dx;!{%>*0-?P5Ve44bSp;yL}3T@*+HWhh`(f_;PZ!i=c z|A2NQ|4#IuUxv!7bAtSDb?kY(J)!N){re*C74(lE!XM{29WOH;O}sTueDud_JClmM zDB}57(`w@ezQF_w4E7`X8#AF{k$J(lG#5Yw4Iqh zibLO5r9#^!-k%Zw1k8V!!u)vGW4jXDxJ2-`zkux;Y@-|d+mE1N{Cgr;;`!S>&v&IE z{}+a~%R}3vLffN*?+TBjOoQ-!+cpMb6GHK>3T^+83u&9Uf4DaA$?eN*-3;^no#uTj zl>Y)2%qH6N?|LY4dn4vDC2lWfMcKsdbFkK6Iv1aV(CYW2?UlHHBrD1$Zu8!k61VyH zP?+d;5Y7VE+3kfG0E6&vx80@w};y2_o4dE+$%H39~P>g zUxn;*LdSnNv_0FlFJs{GIaZXoeK+PiC2s#Dlz)5Zc;5=`|3#?&j)snx47JaHh4$Bm z;+Y!iuh)mRQwkQJe!QXl{JRrM-2YQ;;FH^52_1h^Xgl-Wl(DZ0#Xl=l{;!7Gy9mdK z+cqXw;KjuCTgvvGQDFYvA11PF#)1=8Crjt|?fJGI$kH#Nz17LmYrt{)qXn|`E5I?^ zpB6aWNPFAPWZ83_n6mYGGi_{LkY%%hy6ppG>Gy-V4q49Y ztWK7`3tYmJ5z-#KRBvS2>;tRb$kO-Io{f$~mVOYNusT`#F|g{5Ed68ZzcCXrS$Zy{ z)F22*`C!!pSvCc1$NeI{7#&b5X3 zA+X{h%f1_|c*xQ>)1C`4B(n5JX>WD1^qt`NVZ0%crSor_=x=PiK(_6>-{FG}(?#rT z-;MuWtL$HOY`8aK{cxB?>@_>PwU}KnV*4SRU+k|f&wzl$!$j=;8~+-0s4sg->NbX9 zWNSZyZ0%EI>%Yw5(T@E^j{O9(_0OTDF-TTjv3sSsxI>E7?#?LES>S^^9_j~ z(v#qX)ydKszxoeZI_IJi-k?RAfS1MsSvFPR)OmPAnv9p?B+I4-tT@Tir_=rmctavf zp9xM_ohJ=a_8q)v7N9wS@!RMRsUq^A5wqG^arwZj?>r|@rG1|SIV;ApE)3qdi7_k zyZw0<>`F>}b8itoVx@-L99|BNA2l(M6~jH$e`|EI^oPJH>*sOW*o$tmY3%!f^NZV##juH4BZgiw8gEGaP&{P$xd^Oy$kHd!ehl7_$kHpp z39FN(PX(*rlBLfD$Hw9fY2p7P?S0^*s_yjvJ0!t?hyw$NGf2k(5#me?;jgY`10@I) zDNsU1 zzsh+StT@TicY~w6fJY)r-wTdeoh+UGL~)X(9|4Ei07x(66S1+8<@x`#O|NE&{cKaK zyW8{}e2R^%_3|Eu_F1y@vEaltEFEJhSnWoZXChebMwafMkNt_s+vj}D>hAd%?^9?z zA*&qT57IWh$>Eh?#Y2|A60CU0(rf5vM?)e@ucP1UWa({SwG~;qf8J$}ckX%D5&G@8 zN0#3|kNT`x?`i0YnJmv+V8u+9{xn}S^9@y#Y~nybO74$Pfa1hiZdC;wc9_qq%ERaCBL8S&AS;Hcj%PDi+lVX=pP|z>B1_*+ z|3VWRS^5t8txlHC`&-%v$qu;L+0FQ)$sCNEifDg9O_ zOP>W+JY?y74lcRGl(P)17|8P61Xc`W=_~2K!Q>@NucY7VWa$lH#Xy#R2ROl#eWcA` z#Xy#a&nqhivUEOo9Q~rnOP0QaeyfwE_ka}xS^81xwl9&T55c_|?K^n+U9j(yGy(TRwql}30C`)rSGBs zTN4{u`aW>D0u!VI_$W5AJkNp^8(I4E^jBhnM3(*{I97=X5?T65u+DGE(q9FKt1v-& z9iMQukKUX3qj<>jp8+c#vh;W8Pho;Ymi`_%W_7akkHKmyvh;j3Q_{vW1gsdy@`S;P zfh>Il{b>}2M3z39eyfwE7lIW7S^9M9JSjjTOP>W!)cUeFkDh-v9k!RYEur+i&RIlJau5zku1G|{(6&_EWMe2tCOX#11E1betr+Db&=({6RdTSrQbz= zgUL&lzKMRTlcnzft3Aom_fr2COpwUZp9P24nDP(O!xJtfvOGuVvHSZ8aH7%pUnVyh zew`i;21wj&;&;HwTaErMSam0>{Ig)yohg{#HiyBFoS7J=M!S_nSliIF(%a~_I$1h@KNY>h_{q|F z{u#46S^8$MVkS#}fV$llWa&NN=vPhoWa+!WF{_iM?*WJJH2x>R$qvK&!I6J6+m0;% zv-I0-_agoFn01(bc19$!{Kp;tDSH0hc*yd+M$bmG-Z#N&f3iGhz-oW8be=OuJ564) z^!MnuI$8QBU>!Ti(g)^b`oLgtmY?V9 zsv}wYO!~K&I+CSdOTX30(iei&XUNi*gB9}%dj7-Ikt|O&SaqzUhXV-`S)OKkzHZ{V zi=N*Z4_ThAVC_@9rciyeuP;>J?M_}^Q$+7E<&#zB1K^m|$4s82$jPILY#V2v(eA=^xX--Q*=p_i$bsvpQLN7_2zS(yswWzhTNDOXvB2 z%hb%wO?Zdn=iBt(zUC8p(fK?Z=^g8;xOJp zWa+$iNPg4!JHXn%$nx+yBK$4mxtD%BChw&FfYJ9l%xB?MN3zP<4^|z?(ht!8ZBq_e z`m^*~oh zhBuKPF?=sQyA1Cj+hZSp!>78CRpx_W)rBnmA^IOR<&dTGd54(Q$2J|*b+Yug z>F+Uqvh;W9w>nw+M_{!HS$cRNbbCA^OXu%!6+c<}7_j0eOXs^RqCYV4kfo2O-|A%P z39#CV&w*=QWO=58wJx&sYv}Jb>mo~^MZeX_(&x~>*Z9fO=h1IAZwG~-<4RzaA zWa<1(u;M36Zw4!Vvh+6kA2acgrLUvk>SXD6(64h{NAIBD>SX!1gB3qn`U7AcBlx>s z#Y~pxA+Ta5OMjUDZWA+E`fmEIPL{rxetTRaOXu^-I^L0`KL=LKWa%fV+cqale-*6w z$*kRvi#SA6%Sc@8U0U~ zc*xS{(r9;yr`p00kGgkIFtnt^-!wY>RvOEpo#9tXt8~LY(*MfD;eivBnLss5R zV6_if`ZoHXGv$z_Z>QhtWa;;VBfmGXk)=NbPX5f4^B6eH8;VH$y+-nR!-uK=wc+Dr zdn|s%;kO+A&|$nT$V=F~qrl-8OgV+*7Y&z^ZJF~NUPL}$B(gkZ^!%;yEOdA&`MA+*9ljZ?HX*B= zMzGq1EWL&Pzcb~KrLU#m>SXDg!DVBJ?COFsfm+H38T;9+&9Ouh#|@sQWaS+WR?KASQE>QWlXomw z@ss5#04sj7^g{aokI74xUPQmu$O*Mzcmj3 z#+11NtTM^+tOBb{vh-^DUp0Bj(rf9rI$3%fSjSDW^gF=GJ*J#H!HR(_&s|`}K$gCV z{%(_(EPX5eRwqlpmwwwf$kOkl-|A%PJHhHRyTRdqFzedy@G)@Yzf9YbmG=}l@tX0! zLVt(hGvwC|zY9+Oli_nztzdoUj^$toGkqeIQ))@;XQEjtl_g@ z#Y2|=1F+&DOaGAmZj+ZR{bTyAPL|Fe0cs2(OXoXDHHMI-4+U!s8BYG4Sr^~mq&Ug) zj|MAFvh*?ZcbmLq>2dn4PL@8N{vP8eOP@%;)ydLJ!Nb01{Ct;`Vk66Q4Op>}rO%?j z+vFunpF_XZ$1A5&mCaJMwZ?|f47N^EWML{tCOW~rr#c?$kMmbZ*{Wt z2f^CM$JcXmn{7V{Z=PSKLu87Wa)2$ z6~jAZd!0MvVwC^iW?Ul69|p&)PL|Gh&gy!WEWH4%dXc3Uf>kfF^dfNh15>YJaP;>X zmZy|?txlFc3#>Ylr7r=8|F0=$IXL;D;Z@ZC%Wxf7agvp{0jxO5(wpi3$mAtUZ=>Jp zWa)gTqmH3u>Gy)8|82@4OTP~svpQM&F0jfWOFuyUW3#=;(q9CJKQ`qbCjXD&SLnCL zWwQLI!DHox(NtXUD{Z=PS{{*b~$nw+4*KnjWXRGVpx^3b=?{a4eczP78?4yK^6UjGHnQ|5=3UWO1V)-?H#aUBg^w1Sh10%zfb=_(>KV{&(Uvnvh)GNGJT9JeFRv2jPJ2j z3}kttV8uX|K9>G&(>`SB1@v2;EWMC^+YV&uMf6*pEPX0i?K1});fuAA$nq=%hcB@E z8adzaN^o>ghUKq>9Lq3lA}6?gXn$ zvOGOtl}VPqi~fsDUb6H(^jn=QeLpxk)cE;6!|25smggDfwK`e)A+W|Dvh)++aM+Z? z_v$HrvOKSV6+c<}YxEB@dCAgG({FXM^moCEfh_%F@US16J~nhX;u&tr91RZ6VZido z>4_K*-}|SS$?{ADD`v8E{?$nu;9D+aRkx9CrqykzNb({FXM^mAavK$borf;PF=l*9L(Dh9GVgTab{ES>M5 z)VNBPJ{+uZl`MS}Sl2#e>3p|=u6@YT$Afj<&3CUVHnKcLV8uq3UJO=jWa*_~#YUDs z9jw^M(ysw4HnQ}&V8ylsoET&J!%fuBnf7b|>pm)ZijloGua1=w)WTWa-<$F{_iM?*wcAB}?B04v#hEJmK(*U>(cIQ*1mhQ~$*H$9;yr`dF}HAWJU+>sT-gtmE~3hnG5hlfyL*w}2HtS>>+Cb@^lT17Z z!Kw>cohtxlHyGI-eE`yqI*gS9TQJa2-vF0%A9^j~S#MV9^! z{Z=PS{}`-xBTFwF2|Z-mfh>J0SkKRprOyP%9yc+QrOyMaUy-FR0}oqo{CwB0>PVJn zC0KPNORuEA+vFunuc6=SWa)ME+iO6w^alE^PL{qFoXjz8*a=P~4Q~dA6NYzCFE)HX z^|;{&!O5!(_fWUI*YWHJM+TU-C2PGeg4GUW>4(8;2eR~|^p}`*k)0w^eKh^urf-m?kD=e{Wa)AGZ66>@A5Xv4$KjwR;i;y+*OI3hUh42l zu;M4HoJz3bCrhuPf4V7$EWM6?tCOX#18e^!OWz6(&oJfi-O1sZhWC=MF}$DrCx(wW z{4QAE4Utvm2lQNP{CpW`__K!d$+HZH$$x4%3XYUzSmhMZW6LQ7CubW^g8Cf8Q^~fR zS>VX$j80ZL^S}w4cRn~d*LaqK)#haRmxI;jWa%sDFE@F~(pS-Mb+Ytou=XRe^k(Yw zOgUuf>%fZhc5w1K`CkF6j%4X?gLPd`mVOo- z{(>p<96dQ^{3Ofs2{>Ur14bj}(ZdI|kjCrh77zm0(`eJ1@@Crh6L zR%~;@ij6GKe6V68OJ4!jwj)cg1?zc?InPlnB^mm*3lBKuNZ*{Wtb@bbM zk)_{3ztzdoH-U%QV?Eyyuh_`)+zVE0Wa;I;U1WLAfVD2N^mpk0qRC5^{vQ2SCrkejtaasH3byy^^TFX|rko+*$c-6R-VxAs ze}*i5G+6g%$kNAv6U$9GW5L6|X0~-9IQeHr=X>&1U$XKhz^X49kp$E;44o&YCpIe6sLi{zSPFXYX4KJpC zv*D!<*MJkZ7`+x8ZOE|7ycv4T>SXEcj;bSB`da$)FhL?q=dKuCW6CE>zY`p@I$8Qw zu3hJ@CX<&e{W1EjPL_TEoNPA!XTWMV zvOLd$)ox_zhv>KMLzaGoeyfwEAEWMMxV8uz6=M%8vBunSvKiX#UlBM%&#hBH}(no-GTp&y5tucLnL6*+TgUAIY zX0mjiIw(%E^krbhNtVt-RCFySNMz|N!7;0orPqPgo@D8Ff|Ko-AdSK&yw31=aKdsC zIFfH-CMz%Z<-~g9p9+o+G9I!#Gr=*dlcirv|6t=MOD_Y*tWK8BF(GoH@sp)50SE2o z=*z%CyE*zz^xtk`Caav4^jn=Q{bsPXFIhUrill8Hj``s`Oqo%K3&>wJ`do(>ffX}Z zWwI`cnJk@kiE=|Bk)<>KnAP37)Irz12(tWb)X$l6$kIEh+vj7+(zk;XUo-yu>G}H% z%d-o5vcu@R!KxQop1okzi!A*K`nxefB1_*7)_FTwI>#%W50j-oOTRrICQCmAPHr%< z9R@2lvOGt@ij6G&IQ`w2Ad#h?1S>YO^q0YkjV%3D`fY4v>1V*&AIZ``rv5tr(pQ0#n@u^DV8uX|rv|JT z$kMqVsXw^;R0I9pm>`kmZw5!Vn01k*bH9sO-Q5Q}petsw{P%&ATTMATz>1kH&jVn^ zOqRZr{;!+7Wa&NNnAOSB9|J1}vh)|J+dfH_&i3$e z$3s?`o5A57#`6$3`Ax$;VAY*0KgUefoh*G1SbdBvo!dfv%-t^g=(pGAWci<>-|A%P z2f=D9vUHAP$@@*rr@)GtEYB-o#Y~p|8vWlgdCAgGgJV`FOMeHPe8BkM1M8jSWO>ek z6ZaXCWFIhUr z!{|;-kjT>KfMZrCOXsavwK-XO4RyOuk)_`bRy<_scY+lUSvrSuJ+ncU&Y@P%Y>=h1 zSrrdi`a|I4cQHZg!Jou;4DZ69$dCcPPL}^MdYB1mAO0w2vOG_L6*F1-GxYx@CP-xI z&w*oBCrdvH);Sni`bn^2e%awy9Ug^sB)$g$X$(H$hYe38KVrB9toX?)e=1n>K7H8gZXe!^ysA4{ zAS(YCrp;U7p!~2Wa-=&6f;>m z_l4w7P0ZXE6f;?#<6y;1md;~w^jVXaEd6ErtxlHy7FaQmrGG@-9$(1PN1^D*MP@uF zOJ_e+oNk{S4_$GR<)29ZUtxkomd<_~v%1@dXF^w;Wcim-A8O(uORofnpTY#G27i)2 zF+36T;h!0v3RcWy<(&yu%w*};(*GPLNMz|{VEx9BEPV+${MTk(H<1q-Zgkl1x9=O> z?YGDJbYRJx_D zzP3J9g%zw#x7646XEy8a$J*RlRZ){}ZEI;-UxAf-Aoo=hBt7@!4EpJIz zw6#<p}W6o)>UC#$yD>xtmiA3o3_<0y>AWepwv*02B@e@H#9VvOdONin*32Q z-O|$3(%P$aOhr+8y3yZt`fqv@R=P3Ovc8!+n&W5jtJ94bDpMR{+uB>XHXEMDrG3@D z!8cS@ryKf<%rsU-Z9~;+*1x_rwYIpbt*xcL8e0>}qGF7;Zo@eHT~lkDhIQ;vy{gR) z)8_QgirS`@ifog%tue1@U0u;owLaauAltiI(mY_W1DgT0|A^cn7oneLRPW{L+f$aAv=Jsa)@VBPfUE`-^N|_FVuCFZT9hx(1>XpeKg!`_dw!X2dq5k%Cg*E$Kuveq^ z?V)ba{ckvXbTozaJ1l4u|1X^G@%B?n#2G{C79E$(o}{i&kG`L(YwD+3_Sn;F33^3v zQ0lcHYp?6I%=RchhL&_HUBA}d;XHKrhIC`E991d8+eZ7k9-{DvHSF1VQ+t?C;5kjK5p)eP3>*f82oF@UfHju zzVXu>W|eif)YM{pYQ{kbyDLVOUhTjYp{cN=_L4a|Yc+7TxW~ur<=BPlTkD(yXtu#ru{Mp9!7P`~6*GGg z4wp4ew>7SAsj5j=G^STKwblC@tawe;YE&_^3_Ys8adrQ@qJM<0Z?40MRXfkQ(MEMV z+wqDU8rH6Zc%o7j15@Mt8=ZT~lXI!uxUh2RX*io@Lh04EAh2g)Y82-A^{v$81~d%4=}O zfGd%HtftWO8f#n9y>t1oV~A*Ksp(Z3HyRJTsdijhRMa=tHdWNNG_B#q6E2$iSdFc* zYEAmQHfNI=4~iL|DJfNjvyD`*g6+=epN8Nxs%1S+ru=hB>^(*LPI)}&<6;PZ*RSDU9gY0%=~s9S&QV!sw1YiKD8Bk?(aeBm1T;OMX#q_Q zXi7k(0Zq*tv|!x<%?N0E zK+^)68qk!0N&}jlp^^XtxO!@^wt!{?G(Dhc0Zk2PN}k{SC<9>2Q(v~=>bg(Xlg)H0xBi- zIvLjfoZ0p5=#YJNgHVHF94ZM!!op<>W>id8q*n(tGoTp(O%G^VKvM&n5>RPClP5c< zl}s+lh(RyMpf$Oex*t%9fszUW2ejg=1DYAojDV&GG%cX10Zj>L^5hIUL@bHpCfolq zT{6_;zoiV)aoj|`Arj2;7NehD#FRYH%=-W5*P{Q&+`0C=PMETNr&S1?^6_yh-XkpY zb9>&$t2}QV0-26^#=~X2SIAq1%&vSR0A-k0qK}EUQ{D2~sy*)@be6}*Fjd}h6wdNg zk7X#2-`6N%)=$5L&n<6i3jePf8Cl*1_^3RV>1>EnKU?wV$9=E)8HJ-Nz8q33L zj)U?(2cuiwD#S6Kf=w!K7BsiKc-r$GfX4FhD$$_4=MkV=-d)I4&`)_kh0iVTnOf8K zEDx{u3(AY2G2QZZVSWr7*e1m{6q;LJM;*RT$Bkf?hu262<#nSm-SYU(Vdhg(c_mrC zL-5t&cLPfDT?wDN-uSKfZhf{{?{Jv8jQuKQ%Tqr7-*tXhp`;jAWtI2Je)By)>oEc! zmG?Bjt;cgHuTX{Iuhz2yznXL7+dk3r_??lG;^QN}ZhUv(UHD^cc?B@5zJCjL%WIf~ z^7@JIh|N=mzf2GOH9jbW@r}nvZryl{Br_9WHC5JNgWq(z9 zL$liNu>|(Fe&QRH)qbOYktq*N6qI)w1-tPLFZR5Z{gn3)@G*umeEftji+3Pq*0%^B z#rG0+W@az-O`g|ymFInz1C>o&#?K_XAE5|8UHDlue%o2!L;fcWO7wG#U>Xiz+$S?( z{xCk*;$1}asl2K1QCDJoOf%qf>#^gQ+22?Xgc{W2f52{eb5S1m3ni7u|2a&b_Ss7K zYGlG+F5~AxjEnrMbO=5-Y1vTh=h$@3T1MY>n!#WBzK!m!JE$C87>Gtm2yzM_IFX$@VB(1RP{j%!0 zC+E&tuzx|p!n~@xIu_hIu5j3>apO0P8dva*QRCv5Uox(E^2l+C*(1jl-7s?8#Hx|w z3U3{W`C4rd!`{x&3p21mBDuLiotYy(vbL)rh{|n^ z5`Rgr_IPwiZvKLe<=;fhRfW0-dby+XGizY0j$B?eushGo%czB28{;pG%0aC*j-Nd$ zXHsa?#z`-X%qiM1a%0i#kvUg}MsB?Fg%LT44I?%tW{+q`JItA%U9)=-=fOz#1y!L; zxjDOrcrPy4IJXnOB&y28ItN4$k7^HX&`)qS(%qHkZ8+H7_4MFSPj}Z#Lm~si1LS$+ z!qDJ}mv-k>g%$_(FIbdUo@(w2l`hCBALMN;ztoG2>hikp&kN(!v=`TZr{omZ06w{QIf{k8jU+g~rtw1=PPM0Z|1r`G9Z zp`OU^|NCOqc<+|Tjax&SOW|LO6m1Q?5$U?HjC;u_k z{E~NdZDiouJDJs zi(g;*+VWRdyt3-$>Ql8RZ$8m@yr|z1WnZz@`gr-0{1N%pnJt0+J=8O2!A00(CWKBd z$ax8S%uAPg*WVLq|NX@nZTcBun=f_p_Zc_cmOn8%T?fhv z=iWbe;DYzRRK4QliaB52|K);}_pKc8mG`f&!Z?%j(j+gZ@L0~q!&iG76GL(%mvng( zm;UD7Zfv_3^QOG@YwX9Wd(H&*YRz?bF7QGJ^UAyPIz~#{2*;jZWpYIFe)$KCBz<~~ zTgS3ks3-J!mOU<>H*iYVq)@73SDzg0r>8IP+fS(w#d#;aMG#6v{@4sJqIFdKvyG4hlPj0I6yPof@Y!8{X*xj`%=vhTyFD*}%r9%bS!+(h5VJdu~ zxBEM(%CCl|YI@ZCtzLQL0pe}-Cv)JTz?+Qd1*XyPQ~8-7UO|Ro)0S*N+%uK+V(M;~XjC z)y~n3HR4|CU7ozIx@+mChwq+|kCw>K_cqMec6+k(%c0cin$X7YFZx>O^VlD+V~!4+ zBNX^dTc%F$3SmUR7Q6O_?Ec4mWd)gS@oFdAA!ou6j8k1WP7FB4BgMuELvlABoq)Jf z+n@C|E_}3~^9Q$&oc>JTE$=QbiHCZ&EM)I{?1l|5_@(bEzkKXr)?!1>S*gl(U%9&W6yK!Py?$j^s zxgqC@MHgS2zdINea75{M&p$D-y6a?cg!9+RlIC`Kdv3t`^0hreZ-fqNgzOu?Tk{_5 zJ=xoU^(!0GSMQbYk1Rhp_S5s9#d1Z+)|z<3<@18*`>lJpDAV4l@L;d1Ju*12a>MCC z=mUHE-QSm7naPo+`vLUKxhb55|4(#%`y1_%15q6F^0wprrgBR8Uhm2BXFVQ2x}P42 z@%PqyLT^-;cem$-Pj+s2qr1J_+wjKk((rct>pk4g-Ff>4;Cv`AjPr}`yq*E>sQTu0 z8-AYMs_fZIl9`D5whtZ6j-$Gq{p9UmrMBl{zpUe?^~|xyD)>B>f9=)pLVO(raA^=&u1@9o&JuOvui7Q+cNLTE{w{jAH{o3azouWc6#G*w0flDDR10{ zPH*F*N4Ht=x4p~4pz9xU!G+EN^B zo4uU{0pqBKnsXF?3cYxHJmsNn^SsgaZ8n8nFBHtOGz zVfQHCqS!@tKl*7OjL({BtZ+xTdCKF8u5{G;X+zM0sP_vG5H(3G{CLMiWM zU)_>N9cS2ivp1y5eu&;xQf7Kr$rAgwl7Bgd=XLyUq`7uG6ZFu~3puY|=tbH;3a`V6guX|Zu=+f&8gYs}~HE=|j*H(ArFAVm+&>JoD zxz(4HjR_avic9;N){Y9rclZ>O`L z-M!%;x9Y*N{z~MM6TOyX?os6Y`buxhg&YyGdkK5e>DifH;vW;@IDpjaYhULEmE_6Hr<+po%(cw0ARYPlEZpg6fID=EvtIcRs@ zs43k8=go-B7>TO@&$&az5uv{pJBw&CtsCl@Sa#RkjT6deaMT;VpnK5BDY~}McK-%i z;p}wOrI;A$GT>EW$2BEv-+ftk42q7 z!5zi!&fMURB1eLQU&!oF+V1||ho~}38l3Ivy24A&=gME1xw_6@sg|9;GJ9JxhSN*( zUmI7Pi+$T1U1x_b!Hw_LxcjZx7aqhm!*ikGcA!bq4T1y@^KhrZzvyE zylcp~_)|j*x-$2XvClYX7Tdq*?zx4%j_a4*y6O1C$95kr>YO+`cR_yDVeYuZmhru}SN46fYqlKNQo8kt&b?dXvmeO|c>`X|Zdq=LvtL%P?9Tf!-ty)i zJA3{w&j`)Pg*eK8?0q*qeBQ?0gLAt(^TNN}Hg5QiG2?a}9+RIR8CW(T)5l70{6>1l zzyX7bkC&bZy^xP9?a;gp!LcaRGj8-ZaGusV=7sbdBcFWwQSZsTeP!3*Gw#yw;f(tb zO4}W@N$3Tg-~6P{F|Gg6f5}%uJ)6s>Y+5k8%{%%3qa1J5a_1(NmD#1&w?}gGaNczm zSAG5E*jJUE16L%udHcHaP7myLjn?N|pufBP@wR_{uxi-zmu(v`HvP;uUVM1isN4T) z+o}s58uaFoJyUjGRoAp8eN{_)BYu`~)oo2Jw_KHOZBE*Us?NvB*7dDd$K4k$FI{V{7xhuJog>9PrVj@%n~_^y;bxVtZro%Q)w8Y4fWsXFt>aVE5FTIG){a#80+b(s4Y~--KV))~%U1 zp=9d1NpTd4A2`IDYHQQ@XDnU z7GG0^A29g47(1WGo!xB>HdNgIt(s>B26QV72ij=Ox7d2{CmDg78L9eI+pDgsad+ro zkMkc}N5r?c$E(-l=Vb9o@!G2ThIEae!>zI&+K(%Ub<;|&u1Im?_&+MbZ)m-VakNJh zS_`#rPN!SkRT=@+K&$rB{c=n#{ofvYR}Kv2LHQ>k69)3d7E8y0;ruK%Kcw-tl zuw9z*b5OUS<$m9AI+khBI7Xg2cdx-lWDoH-p%ZJL?8=AQ@fRrk0kl(i&};kY2KZ4z zs=a|f*zoJNzJmL%-J})=av_c0oUPe4_S0bs;S8cRlJy=GhiL z56F)apW}(+!)JEN@X)P6y zTd%q5s?})W_GGOKF&uH82$-A|r6r})N@kW`J;|Fr53BWm zTj_>(xH$8O4&)r~IG!PzF9YVkXCD;8Bfoe;C+^*j&Be#XOhDVUV! z{Sf|VFoQ?P0)M5moc@}u`BAnF_;fOtAIw^AU!#B$&GNUimcN=czuYNrKH`bvYJ7?l zkA0PBP~LpU|1DhmF2Xf2AE#w~`F@T6!TdNU|5V4%c-Ljk-|x)lVEtdj`X@X22ckTa zOnoLg^GC3L+&J*Abo_i4-1R@;%-;k5kKm6v{<)Z!e<_w9#XKGr_3OiU&pG)y|B*AV zzFFq`FZZ{{K&L$V2WQPMaprep`OBCeW!KlcKVIOSK|Fka68_ap5YJMuNf-F*TdY|; zUC#C4F*}>g{JomB%lXa@lP>U&`_GoaHbA2yo&A*a0e>Q9Wbk_VeS?yKk%s-FywDYD&-q1;pYuzz=5KQ5dyi*>yk@lTHQ0aM z@ob^39k&Y0o0m1eJ=ovP@|&`jS7y!EX3f`S&2P;rZ@aU6D(b%o^>w#j<~KBE{ihuN zA;kLyr#`*wdtui2Z01)4`OSPy);!N=Oft(e@tgSuEyk~Pdav&y|F<7JUvRfy#($9? zPo_LGpQ)dj?+D5_^P95fF>u&qmfx8*zsZ^Z4{Yz1XiuKoYJZD6%dbTHbzt6&_pV?( zG377Jnt#Q~@AuEFdHX6ctkL8z%gUd5*xW215sa^9etOpYoUHk_toi%0=C@|8?=ffo zDYQp3+T%*w9_umx9jATnLwo!^=HpI#z31eg1^&tAPi@m2%9)CY|nO)w5`Rg$scl?{3^8X9VV_4p6|8|yt z56k)LLdDlR{$buqEI;8a=l0E z{Oee*{(m{yL0Q9HNK-2zs z&{=*FmS2wL?)mX2&hnF}@3mO&j*ss<%X`Orso(zdg5_p@lQZ8m(DTwLuLzpr$&81_ z-{bgumml+1BA&lMe(evv+au<$eHJ}pU9dY?D+R#`I9K$JzrYlENA{^ zXMQE-55eF6`TS+xC0PC{mLu$-z8%5(FZ1JhFKa&2pD*)HV*C6S`B6-e|4qk#50-Ph z(Dmfn{9qyAGhXlcc-H*oS@Q*1^W(izdoIIkg5kIxAL*3OK4D**=&zLX$8&uQ=H~=$ zW%|&c*~K;R4afEBZCT5CuBycH>}xT7iSu7ZUsvM1lily5wORRZ%ZewN75@~pof6A? zFf0FPX9Zk-B+Gxm`uW?>;kbS}h`&noznnF{K5PAtW|jX+R{er=b@+y3R4&h2f96`< zv~NXLdAqQ`DKVZ4v*Jl)&Hsz7&k=upgS<0Y?Kd#1eg4ueza3={M=$+Cmj7E>@&1Jk zW;lGqal9_hig#01{WJG2O#QCNT3((tUuEmVW8!e^6{EQ0*~I#DtW)Crx2*p|@Nn$) zpV;!A^XDVp(5(9WTUP$xX0_ih?Dk#j=O5{PoVEN(TmAq)zDvBvv&y^OZZD2e!*Q48 zl%2ob_s6`?XZ4@VwX$iSw~`jPUx+D= zPr}AJ9vrphkmZ>Oj#-^7Jwdnw+W^m*Wm>`j*?*vEe$V8UTIw~HwzEhzq9BsoaM3#OnIA(RSbheM;AxmFQ{bNj!$kHpp2_9IGs_{{5WO-`Aij6G&X8P@KXvxyq z{xPeQrQZQoY-H)3;OJ0HkjT>6o-wPtZTkRp^$oK8J>Vn{f=JKc6X6bKS)PNKPlTzO z|4*ZBbR6^Y@LWLcK$boftaczvA5K3{7Ldr&`JU*Q)!lbS7ebHVs~je>{Bx=28l5bi z=N?f!Il@Gi&i6jYtnR)8`X=a!;lABl1x`i`*MTDgF+n1$oI4zyES=~0;Snb9K5&93 z_(;!Cx6IctCq^0l5cv|rM;(5Re*5l)Gt@^L&)ZSXByFwUyKk)`w6FFD4P!~5!rfhTZ2ge-j-I61_Wzk;3%&;UqedFrU=8=Wk@861xLc5f{>ak*h0f5W^O zKzaZi!Bb&k1SB{XP2aHYH1cpMI;8rJtkUZd0=KkLb5LS$Zyx zrAc0tA@TbT#YUEAFj%pXrSp9Y(FrCmS^9ALtxlFc7OXZTOD_Z`?RG2zhYL-ayniBI z298{4`T$vZSAr8)7=I;L@ss7L0V{s8^g8+{n!IG`JlBm`oh*GVI62Aq`CX6JMV99d zu+~ME-a)_JUS#Q=^jn=QeKY-bdy%DYqu=Ue>AW|u?briWY-D+MffXBB`X2g=Oufj` zAEV#uWa-a>b?hKZKLie6Y05c8=1CUPTi}G{x4}_SXEjz&ZyYOJ59D zf4+&Hi%gtkd8+BLVD)b{c7`mSn<{2!$kKT(r~S@7ubWHVo{y2` zUj$Cjh_nQsaLnpt>78K3 zPnNz7oct3^knY7tF_7iC53Cr-((k9=?ssJA57KXSvh;`OzZMfDvh;_+F{_iMKLJ+E zWa)>f+hZtM`Z2KLCrdv8R{Uh?r|ADvOpwUZUjfIgPL}=_Sn-gh^SU=t1_7xA9I-dL z$nx;LU6C**NMz{?!HL@5XHhGBw4mZuV&m}5NE^zh^qi7ZbeIQ%)|X#uMp$nvZO zs~yPFc|EG_NS1yl{dPN&rQb!r-Cktro9MSXS^9Qx^0Owk9&ota@Gh|8B+I`CtT@Ti zAESSs$xD{LkAAC@r9TT!USs^vfweBOJO{yA7g;*bfuq-%ykzM|=(jpqI=|OY-ylnW z2b`Q`$~gyC3}kse0xJfxbe`Xa7nr{3oU}JE`7W@?DB~xq zoHF|78~{fAuY2Bg6a7{v%U=VITw>xOOK${+r<-!_ zB(E^Mjr?W9JHScHJfBgVWR>$ESaFi2KSaOX-^tP+rr+vh>AUH-`#V|sUiz(0mi`o2 z=2HR{Uh?JnxEDn!IG`AJcDjvUEOor169-o$Cx&nR3RGzhao@ zX5nhXGr`G};T7P>Xw#R-Du?&%6E((D3szmo^4ttoUC7cK=}()yWa%yRTb(Su1FUmA zvh)Y3Uut3_OMe)gs5Ry9BCj^Q8yv06u>5>SXB$>9_rgEd3DuRwqk84px8TGfRq%EYB&hVk1j`g?@XyBTIjceyfwE zp8@MQ$mgN7F0wp)E==npOFv7$tuI;n2lQK=Ed4|JZGFkoKc?U6Wa<14LhZn3s}vhq zo*`hxMwZTJ-xM2J`Uv`MY-H)9>9;YErSmDSV4b+Yt%V8u2c9OcCX5?P)_;F#6P(r*GsqGrD%ORoecZZYNX zIV{zeEKe<1^(9Ncnf?Zomn^-JeyfwE-wxLJMwZU+48t~tZQ#TjQ|5N+mUn;^8(DcD z04p}K^qurKnsUg}d+4`1S^8sO#YUF?EI8R@%6T3f<^>tj+u(%d_sO>!{X=q#;Q<5T zZ#6s^oa99tQrO`rSl2aVt#>>)(Qf>OVAY*0PZ3ykCrdA;f33+&mR?G~)ydLlfmL_1 z^m*XqZKfPPv!)ox^6=R!#Xy$6g#L9VFIoCB`mIiuUI|tVWa)hNM(00w&|~ijkmczF zC+&ITHu~3_^*%tqXZk!@{vNRELYB_&T2&Xa^gZ<7ZptJ}e~f;slcgU3C;!~|`A%lV za}=z2$nu{AD;~1+m%)mMEd5pb?Rv@5U#H*dWa;mMbu1=J{{XCe6!_{pxMmp)R-9z{ zhl3R-S^6lj;v`Ft(r@D-OCL+W)ydNNUAE#ROP>l(e#x}wHQ>Y@hReubH9VJmr{RV4 z+kI_`!^<6B>F_9IQ@zMqZxpP0k)@BNzXKB_vh)IQtOFAyvh)O4eVZ(uLwsb6>7Qij zbHRxXm>}^|B)QQ?|DIB!)9`ZqNpu-rMc!n%27i)w8|Dxk-fXx7e-c{^)2i>1$Xf6H z;ILg+kHdSwY9F%vkAc-bWa<0p---zmS^87pnAOSBUj*yghb;XlIQ(@?kWS&F*xquO zUx}$MWaW*6!`qnC^LW2S@ss6Q3|9PP>8rrHHY7{u{T7WsWa+%G628l-$}pK$0`hVHW(6F zdLcOc7gW)A@Ck4C(f@w{;cpmbzYX&SArkwoJd41|ZmQ-x>+lZ4EAc03xteS}Gr?*T zvSMKQY7?^bGH{d~7O4y$>5L&}b+UBc=1`lErE}lWK1h~c3r>6s6C|EaCBN;X|68Q+ zgNE%6C|?q=fL{T znk=3Bk-m2zOMjbsuG#Kn=^ua--^B#!96tR1`j};TKEgb|zot%>{s}nw5GG70TJ<8! z!&RzYWa;_z|E0-Fmd>v$Vpbu+~eKJ`t?-lBFl;|DIVdS$YXLW_7ak zYr$GCSvv2RvaNoIqR7&Dzm#o7-Mx3Z6}rYQvi#harMvs}Zs_5MO`QA5j~G4zR(;7T z=NMS^B};!5oOsmaJq-?9K0|%C(ch!~eZ#zODdw}a;U5@%DA{_3gOfZsAn|$IFgrL> zoXm8@>x1?lH`JoBH0Ith{@v+wW4z()WWCPnf(fg7uvsS)RjSeJ4nk&ikUlzUk<^ z7aA!rbtlXJ3H5PCCri)IK@2}KF^m95IglWc3|Re{EWH>U{jn*BES>jD zV^(+Xoz8@=^Ea~m^T6RSXEFVAX{zeI0cU zLP%uk9bk>^n;qT?j&kroBFld-IA(RS^!wFH2fG??M9Y=A6V^1mi`p|JZK=1r9VTz)ydKifz@tg=_kO6M@%{A=&{#dWO+UT zE9U%McK|i* zM3!C#4*vubB%T9AcyO>RkAFV!j4%7=1B(ANug5oDj=k0*#PccCvOJ56)S)DAs z6RiD+EPWd|Y2&;fjDJhuryfid4_W?QV8uh0&S5(GSC}A?rE^$}S)DBXd9cPPvh>5? zC{Hwy$kKU^5wp5`zVRA#l|z>Q9qN-zo0Fx#4^I3H6QmFDQ60(hd^~S)D9>2v~iFES-m+C^oV@OTdbaEPWaM zhcH1ROTP&mvpQKi#|rJgWa%6ek}qL`v<@F#caY`j04KOJA$8)TILY#C1}jdo^lkJX z!32pceLFa2b+YuGV6`DxI)|0;FEK%4^%V1Qu+B@#^1n{q9v8^c&wvxZzy#?%d~{qO z%X1E#w4T9W)t4;KP_XJtmOh;Rzrh5FEPWI>W_7ak^Yxh`c%sKJK_bgv431fyEd5%r z+KnuIK6UQUNMz~kOVPijYMu*{&b}10y4$a+p{snd{EgI;rhKw=_MgOYOptEJCsJ%Y zWO>+s^el?om+pnGHYdw}A6RWpmd@i&^zSf1B1?Y|9J4xE`cq)lg)DstSnDNA4}-N{ zvh)%3{|XZ%vh>m5nAOSB$Ah(Avh=ysc`=7XmcAGqJxLYMPT(VbDL7_zvh+%@$|p-7 z3Rb4-IQj}ENFDe{?*zxJ zPL_TjSmzRC={u>Hnsy*d-vv(m1{0(`_$W5AJdc4D8(I23`d`Hai7fpoaLnpt={&tq zI~)Ti{s9xD6ZmMoWcg2lwO+DxRy+C{CP-xIlwwxrAL;Lab=)CK=Xp-@A0Z&IPlo@= zNB z&VHNxEmgcb1s@$l$@1{nq&kwN7lKtsvUF~X=s#nEl)YVIR(H3{O!yQtS> z^#2qSsvaVQag~P^R|N8 zfh@g6eyfwEF9U15B1>NfPTKx9 z8pTDfhJZwtrvR+j$kIP`e>n>yQlI_B>hAth2A`fMB&+;|;Kc7RL8`_l%npLof=|No z?d1QYiu=I$B(2^7R?K9T$?-w$NtV7D9Q^SXCWt|Ybt8- zV#J1uss;oR6jPI~ZeLx|+*04z#@Ad1IwL>tTUYt=!8Pf|j5~NsW_@El)btv>)HNu| zT}2CY*0`;yf@|Ft-2|=kLoszd82DXRdu?d6@8|@HMO?5s;#Z1zPcSR3hlLSyvGuax7v@r zt;PN`_w)5n^S0T{t7t3mX4s0lmX@Hzpvf{X7ALUz1y*w_x(^o#{rtjWQ?^>tOe&u5W9=i$N6&*OT?0U3XDc zO-)5zYsH#YzY&91@wygv1HEwAyy%y&)a|tbTI?%~&*NZZLC6(rs#v&@ZA;Ud zisoCqV!Zt}U3}f*8T&{~fr&>fL<-%@F8p zI0S$^neCjt+`P^-%kZfo)u!?O-Rul}RcHma1l}&%d;Qp??B0HL-DPgf)$O(ZPQ~V^ zurE*j^q$nu@cQW)`i!gC(}Drj?JD+l;MoJ~rLzU-ir1gkM!jiaUiis17Z{9T|XUE`N#oS)iV zw5jyoT#PHNdKy@@Xr z?&svAF5S@3gb3PN)?<3>|I^snyG9X&VSI>sMAWFk57Z{8#72(WuS>M?u(1hZ5m2x= zLK34G@gt|8m7qlw3xza73jY9=lol4+NNoHIQpC<8$bl9q1bv>Jd7m4XD>AUz-_E@A z+js6Zr?YP7M5!nd37VNCqFj`TQc)rjG*d}LxhNB*qC_NUCX$G9 zQ6@@7Nsn~t<4QsWYBMz(MujLBWujD+kQyWS5B?TgZD;wn=@q?k7xnaZ=`h?)@wGYl zF0dAc@?J%&tkopNFSD@^?t^M75gq7 z^7YV7Y59FbT-MKgDqwg>_j`8|CSNlJ| zRSdpIzcurnMO^H=aufAQ!g`M&*nHnAz6ZGJ^QcdLUn{=uJnj$S8+R10W0CI~`r^m0 z%air-O(8DMZ}5(D>mfhhGPe8{!}DS5>K=7&1mo6B{RH0x zTR!gl&|Nm3mu(rrjBk`j&aEMCCNOvAo5KXMwbltEzqhdtPKYIAmA*0Vf*oLQar|AO qZ4-ZQqw6t;f8h0*Iq`93v$!F=h}as~zX;z7E@Y1X!NxiJu>Av6U;6j} diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libmbedx509.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libmbedx509.a index a1ffa580e3323d0f7f9aed8a8559e5c99a5a58d8..e85936342c6d23d7173f0af0f37ccab09b48a62d 100644 GIT binary patch literal 134154 zcmeFa4|o;Txi7pX**hd5$c7DyiM25y5#vq_34hdM?FO?034u~1R4E$5PLS9n#QZ_< zXb+I=l<-HXAym9zRc#A{V(_KFXyWkJn>^SE=>3y_6$X+giWhZ`Qms zlSxq9@80iu?(=-_liBlo-}SC{y=%>yHESmC%(~{5%Esu5Ta#}{A58f!R%7>XdV1lM z{2R5((qyGnRH@4@8@k&eR$bLx+f>o;t!UHqikkYGW;IyUP}$g2T~Srt=#ejPtgiNmnriN;udb@7 zs%);TSXJFvvwY3)3M(p`R(KUwPtCun;-2c}iY8>NthF=R^2*wKD(YKmhff)*-q=*x z)Kpo~(1fa0HdfX(4OOYHtaEB$m(yG`oD@|XY5>9txHUAPdbQJvrs1l3*3ILCuIX?I z+U_tZ->P0y(Nyz5b;XM6+6LDlF$GG&a!1%nkw({ zB-PX}U->zun<|&EY^GhpbW?L|><>&Dbe7uEL8rMbHO&n6l_uB*UTL#aW<~wV=*kA?Ot;K6 z4_mZ5-~BbsE7(RA(Pf`u{t`(;#lyR)hoMW|taLp{@nCt43L(2X0Ky&Zxjd4@~75gQs;F0ZNO_`AHarPgx-I~gm?#J6Nlxsi~#9kv;n}l*H7K3+Ax4K1XYq z>-%6c)@8A=^8U|oX;o!yO;t_v7x5aGujvE~b98GcY2Y?i0O7ty=q zCDt+Lo(OW3a#9+q>xOIE;Z7ne6Ot}<9w3S5!KHh-rErOkYo&f($FFe{(EI7UBR9x?G*BE^T9eHgz8~u?3 zvF{=0uhuG+)1Nu9M;U!RZ98M7?IO+0$T14rCK|I1^|#?AaFW z^(mvfvn^?>`MbgB9vfL7DfI6OM+46*=6t-^ov)`Y=pXnvx^f_}fsDt22OPHNWWsL?lE+VIl9K8JDE=#DFYJJQot*Am^DWdwc4RA;jP zWMbf0EW>W`l(4@zy7pD|t59f>=d7-&eGqMR1i9u`D?+mcm`9`a%|@T%&MI4vuE zi}i>rZ!Drk>&PcN^|X9>&*%>NlH)RLUk0}p$_o2cX5J2!8A?tKCTzT(=_l+O>GZhr z%$yxLg^?`dw=F@m(nI6fbAP?r=w23CUv3@`v?FT%B3jYsN6lu8NjQ>mI2(QQKwDl% zP8)h=#0V_sX&ruf~jrnK(%kBZ+j=lYzZdB=?Yn>S7C2>RRX*7!9?fz`&@px>7yo`Q>w zG-{RbJ#EI>f{1WNU(QCsF_*NbV?ivcM%uZefqiOT?2KzP(&xW_ulKBv`{so?JoA6C z@L8NQW?#i9#GFn~F#2?Aux-=z2a22#&Sad^h-iZar7ac1=iE&5cjs!Sr+DD|5qpNye z8E0Fs^Qr!#6Wbb0k1}F=?A~GZ;l1p`M#Shgy#R;)FzLYjjD?RbjJxwf$+FT@r4h7i zYmQG9M0$4AJrG^H10!lO&XAeKrLhyXJ@YI~UugJY3+a1@`nve&-A9%kKGadr(X%nG zf4(^$*=>YtNpO?@v79Fs#|D=^bIyS|8D;cgY-v;_tN7i?Drd){*r`FsHfNJ@mMKvc zG5m9I{73pXly3G%I{o1Ur;MC7=F4#R2{Tt_`sM`x$c)X=K*T_6%rUzC*zVqBboaD5 z$0~bMd{#%C_neELn3RBXEY9dnT!_}jIq9>{*X-E3fy{|M*Vr{rpOfiH2`I-kCM-C- zs2?q}v8OGrS6^q{UgIi>a=mtwT>`uZ^Mz7h>+TMFgupnHu+iuC*=+-*``u}{{uXTx^UCXP{R3?{hmJI; z?-q|Kar`{M^RIiNalCiyVV--^#%$f3_Sx-!7-fuzQ-TZ|CD}#xCPJ`@Heh1ET}1Hm|Rg;(2!qI zNfae|psuc^b}~U_W!*{*Y8#uPK*;E!?_owMBqp2bMbxPuXgb-f}iB#{|S77i)Z^SjDx@=?eF`p@|gZd7k|#eWzdgPBTWDDJo)E& z_!~X^5*Pok7H%-@jWO-@yV6>*JpPX|_3`gBi!{GqSfzQVe`?<8@0!QI=?3LLC#;qKHy(b1bxf3%e%_TnxIUvj z^%?E)U-yTZc7Dw}?W1|8{l|Fn2Tl8n?EIQ{@@syzCw;kx-|XS{xcI^K(fx0}ov!(5 z9{xoa|Ekqi-!_lm6{f#0yVBYJ*L(P04}aLhpYrg|@zVah?nzIzkC#q&j+f>WJn0{~ z@(-@R_J4_;u6gHt(|nF6-8o-$dcG&U)WiST!Ct+C}6=*Oum zJ^kfMv;Cd&uT(L6EMWm@9{ws1f3=dwDEODU8jB|*3C zrEco4u*X83{~k;KVbgw+I_S#4{QcO3OnaXEw|V#hQO2J7H+lTY^zg+V{@Yf5UW3Ns zzG|<M_PQJ(y19{UNf7p&Jti3=_Jv={Pe zCLOzAgM&pU526sJS0tX(!TU^TV$qpTd83vSi~J7Y5DNq?!xpeAwj4M&iBhF%u?eP$ zTubLc-~cc9pbgl>KC#%}3LF}VAJAji0wYYQ4q+$y#G?NSaA=g)IZABl9|sm6&Hx9S zv<|W4{SY`1&~l!Osbd^0I_$`4mYi7RiNL{TtxqiS0B~rmmX8Ha4LVqKE{8nLk`s%Z z=eyV>7I_FbWVK-)a4HWnh*)$AfYU5FvB+-*7MsK(p9w5Bi-1$dYn#NPGaER~k`s%3 zKCsv%7Wv)4Vsj~Q>gC!dvFKC*r&)4hk=Fu?O=6KZ1B=a7z^PYgo5Z5?0C1WmCl>j7 zV6jOo@{PbD>$qq*esh{Rx(LY6ft53c~ zoT7E!V_xf+{*iJHw4lpyo=ZO`7CV;%hpy5(6RESx!J-qQ&X=@&3b5F`h5GkvIkD&$ zQUA+YUIr}w%m)r!t>ued@_T`U=~_-KcABYg`M=(UHvmijCl>w9z|#MTMgAzT94}&# z?*JD2JBhE+KJ2HyHAWGOKCg|T46V}(oNM`Z6gaqA%ZWw*4CR?xPAu{PU@7-Q>frwe zBx2FQrP0>83Rud@rres;=DFlkT$rb;_)jc0d6+}j;s=zCEq9U$&7Y7p>EI9(x?amo zJ8K*)cG4jVKA`2qA`emi_gYRY@>_sI6oA6mf|gBU(cv5>l#3q_uL~hwOhD#!Az$Mq z*hyYu$;)d*XtLI+cj*v|4i8V@2Cc*2kd?qoT5yV%6N^5ZBQ#CRnH+q`!J;#hI@7g$ zHg&9vJ+bJRb+L3<7dc;uMQ0hX*kN6Q|9~G5vFNZap&Kd1V+Cx%wL}_=&V%6Px=bwc zHsH`r_yKLi7P#4j>S64}4zcKOr_SGLoo?*pI!-J)dx3Lr!4K#-wp^=@r(O6>;NUv^ zfQTjUJHR0;@B6^HU%?OP18m|CvFIma91E_ehEl{L=XEe-<>mD*bgR}$rM}h2h($jG zSp1}BD6I7_)d#LZvYbc6VrL?7hzB3ULn1oFq7w!V-G(0!k6mt&3C(8@qR*jF^x5A6 z#abs1yU;9+S&Zlti+(9}*wH`>vE`PS&^%uRv&jNf1Z~77@<)M#ZImiSEH-xl2j) zen4+v6CGmFc?UT34g7$9hb_bt9rPi#&|(v+KVm0&i6yU(efXPNC&kr=iA9I~JaDJh z;apDY#l9rR#oe#6ArIZ9_4A0AYFvPw_&_Z7ZvhTfYMpzjW6f2FMdtzFK!w(M7`u># zcL0kI#G=2GI(Op-^ddIVAr_rpV9_~2ofv*V#G+%if7BGK-(VMPcd+Pi+z44Z9{~s0 z=|F$MmTUQ$jCPZG4zc9rbD2Q3sjjX97CRFuw`}IS@GZbHuOJpXMZl7G9(7h}o5Z5C z1USF}9>jU9=-*5Id$gQb^c!6|tAVBc9|X=_ru8q!PTH1O^0GgKYP623tFDW>0w5c{ zCDD9&jn%c4dCdqf$r~I~ZAM71Y^-nxLSItZimLu=blnly6IUzKg+Z}76%zY9C@Q$J zseZB<@rSS`#b@+&2w57O&kk$5q`Nv|uDTAHHkmP*4Dx{%AL{2- zHY1>RSxa+u)A0EiqKo*cD56z{#K5}ZO5K?Ux4J7#7Do(m(x2g;>D}-OjCExE7lM16 zD{8Bq=w7?|E*+|F1;6FhuSCerta;_R2*`|n%WmS8HC1N&TVYRm{KrT|WmOe|0i7sw zyO`!mM~ED{Z6EMNQp$n0g1j$Tj13I!Ahn2esVk|!0j;{REY=cij|{}s4S$93Wa&8jKZ zUUqR7_!IVCy~{)id(rz4*oQ5Qjr5zbN=?8%9UF^hS_-x<7<1d32^pUk3W>d~P;%Sz z1(kXR&!^I%h@EY3z+-PUY?X;I?8V-H^Vr)D=kk%Bj*YkC;$J25L)C7V!{B+H6cT$& zAb0yW0DI@5l#Y#$yu{vWV7I*mNEip1kl1U2z-{m3l}b&7EFBvkeTls<1H0`lM*^>L zLSio!0=K;nU~d3=>5%i$nAl@mx$SL4;|}K^r?hT+r_&t&_;^I@{TvRs?L7s1)|3!h z&ha=7J-5A&U~eJP)3Nc=CkbDDv@_`1dc6;m__bZ=f@Mn*xi(-b;|V{o92LyAO%!(7OVg z*gF83+uj}MOq|yViM<~Kxb5vtca8@RwQcWRt3Pv|NZRJH$FjKntF`AjK{^S&DhR{Jw8i{FZ*;Qx=?g|zC+*r}V{QN2UmBG)C6}|CWx;#BrPEs?_auVmpD2T)v2itdt z*Q|=pKdD-a{i^d^LSk@4dSZ0zImDEXSApL62>vV58*DF9PF#%9_c0@wUS}jx(4TOM zzvq5#bf<(*hBuqB6FL@-k#H>Sd#L5F)+#dsWzDK!Lc+;{u204@V(yD+cw^NH+MaFe zihR9zb8kxT*8Y?kLBw7$!X^H?h)Rs)oQz^TJJgZ$IHMF9CFP25=`$mx5MvUzII40C ztq~YjWBtPD+KHA%`mh>t3!@mxw2ge1Mik?{UCzS7$VB5~i9w9*eywf`BBc<8_wH*t z4l8bPV+8HF(SI^$M`9q5c*>5Q(b1i3DdQ}o)ubI6CuwxAU)UJwK{RI|aiMb3g44z; zSZnv6oYwWw<@X`yf=E^|<1ybJCLYu1qbFGxb(CksAh#QS#liN_NKx~spUmqT8h;y% ziH(>tx@W7Mj<07KKiUPU*mOs>8fVv+uR&yNOs$XT7+6H3opfS#o^1=vz!8l9xFs4m zqrx+AbdMUnt>}|E+w%JJRbt|xIODT3BReBGNAkLIj?Q+qiPc}>IeKc0?H-KzkLmax zM)%B&nDMBI$?aXPsO9yM*S4&K#cQ^Bj~=7v?z*r2$j-xi`j7R_duzd)i{4oL`rT)i zonC(G-jnqw4s6Nm=xJNivS!W;SKTo`Hs@kXFvWiqalie+gm?Q2jy#=$R_@C=8rXXAT(YC$AthmMWTMhu&iwyY>Rf2~5ymDvi6F$}hsAj&X1=5BSQ zBZ4Y(*FKfkbnyrDNbf4^d$=+b{y2Y>Ohigm2R*)U#hHqY_QJ^NrM32|L6D}9B& zm|+a84M$axk@@f%#QJq2fLDCUd}g2O>0pdAOG`2`dsrGu3dB_AGmPabGI*8^pX=T> zquaFK-Cv3$j`*+xrHk6)cW*Hq`=c=G913R_Z7)hFxp3#Q#itg}{N{mgW-NJhN!(o* z=2qg^xnt@Mpw+!2+Fi4vYtO05Ssc;E6!}Zc5$h$CSCUlZ_iyOUN3@!hXY~Dhd5>R@ zYUh3`@n1TIc4s8$--Y<<-D+$2Ko{FA0j+tt+EG9E}&#Pc!?<&+aQ9U&6vCQrygC)n$Ldg-+&-?!{Iyhp4Rr2n*&M7}sFLk~9$R}6) z`fNBYqeceC~(p*6&qserVjm74M*jU1_w=TCQ4) zRw+~KgAYb`w)sAx*1_*U`-NR<&-W@HdFYCR%l@D;_uL8F?alVdZ%i(tH^EgOj>Z+_lR`giPyeAR=n78Tqt-n9(B&l$XZF0N zf?YpE4}VVitAZnTEiU}V3(CLA_}M3nQ61siE&RukPbQdcdHzM!Sw5Swve!ljP)Z~^ zP>wd=A0Hj)Qo*T5;{Uz;q47O_j@e1*L+`3B8`t&!9@eH;Khhuccl8(g_r`UOf7j?- zl%;;L<%Q*s#C5i}_eakkQWv4sIsR2+%(}T-UiifiRA=n@hJ#a|SHH(ma(b;?gLwr$ z&=z0f#{^`^mDY?q=h*B&fV1Q?;uIab^NuVyoY#?Z+q%Brni0}Bw;gIL*mxi|&5jK< z`kpV}<3H$o9%q2l*E7s$(hcFq&G#w%k*6ch+0oO{nGjK>7>(TT5A?LTW2OP1eYMtFC_qIjXjs)M*vSw9hQs8_rNhM!b`T}Npog0%CM*S6-A05r(MQc}yOpBz zyG=bxr3^Vr`3w&%t=oN5|caqm1CrBgTC~S*}gqn;*T6wgVQLl?=o<0z4&P` z;rxhT;>pp`0mNVX&yQ$GF7)pSxBFWbje7W#^3H^_XrZY_{4C5DzcCBGUTbuI=YIP7 zoe}Y0+4O@)KKx5`=`15Sf-;PL@tL@meLUXp??~W$x6rpgjL7vOmat(q-Z{b5`R8h9 zS9IwHb#ivj_W0ri)w!q`cC(GncC!uI6XL(J@duCm0(OgyU;<_6m$3V)+B!SQ2h0BG zQk=E89In#Bi5SU zH!dD$U+csfmK|Sy?B1jGM-Fsg*0pK&%uatGE@u<3f%nZ}&sjpSWTGv54OKk#pYhdalpWCt|*6;0dMU)qjK*D{YIaA1SFn^GUD4JaD6bg`Ag3n+uaW!V5fa zv+=!_Wo4(zX3jk@m+!YYqa;W4Mg6yS+`RD+-_vP}>)jYDux;awHEWE?c9n>`gyP}k z7kU3?d-8bXU=rTk+xn7fNu7?T0qAM!n&KDm90XeGrFQm}cvm%w%{Euf5Hm=rWNlT12Y!Rh@TWw*$LYdo}BUejPi%KMfQxie8gRk z6fRFN{_WxM4;ydKkBlpsT~d&+BjNSPlO^R3A1^5wu>%@k-|}x;3KO0W7sSxU5xw1c zU;CMzr}vyXcJjoDQ^(I7d*kR^N8UbsuK)es`nL)?d^4Wyh@O8=5P#UGV!n+2%=9Nz{)EM@w`YvA%gS4`M&iFU zzLcE9c}JpwV!Uygk|=e@J(IzAsBmu*XfX=PMUMF~-q?)a{abD^cd2A7eDa zTb_~3T|ZVCk<6Vx#v6l~-9J`4i{epE&o=rH9hidA?%0;hJ)>0Nt5cl&(zf0Ee!V$6 zc4&U~!tDza?)`g<4ybaU|HGODc^yePN7g^>}z^7i)zXr}Ms8Uk=)FsI@E29J(~C zWYY_yD8uv4R0Kz-ZegB}v%{HqLuZ9@-sgqwKD@hyXAIXAqvbwg+ZNdG$zJ1rPxfrk z-=T7jSpFqD?M@2?k$%jpqHA|4^nc&(eMYy`!=;CJ{!Fc{yYL>!;A3Z;Jy1Hcv@lj` z=n}r`KCXB#lsR!mVhqNIpStnL=yND##+YJW1!vEdcN^WKWkJWYc)q1)jdJcdGe*9} z$yp+wOmJS!+VEXDr`6nZN<9V_;GH47d3UVA?(L2}YIF8k5Q&+6#yHFCC9a~8Q<2tJ z@wTdZ4jfB*6(xPXJsij4%ygex*FOe#Bzy3tk`Y-KSy23NLj0@*5XpPql}1@-*R8Vf690@`)8$nC*C^s=9xF%c>S$2Z=XJQ>iv_yJMnBs&c;^!Ln1zx z_o4~v(8dF8FW^Ca=cbXWrRBSGab6{1zPic((exBt15#4d>thso2BAsPgVEg ziYeCIHoWDy)9BHKa_!SK5k41ak6dHVbZt%a>r2;_HnfLs54<(!oj}g_sd3WodCnX{ zr-=7M^PY(u#QYy^u-31PqUDhcb2j7l$@bNp({vfgftL3BkO%kCx()8W#PRsN7Sip* z(()%rIXUM0+Zo?KxOsE<^YS+?vW{RwJKFbNyZ1Gg=X{^_!d;E$ShmiNsMg!cRs6ha z)jG39#orcFtzYX>t!2Aa>pZ+$__bH@6y_Irrtq$ck6cuFCksyHoc{LF<;PYXf8fN` zy^Z~sA5J~uJ|5z?w7G821?6~C(I~dBzc{N)GVy<^%<8x zE?<0Raq%|~eKUK>_9Y2-eK@xSBL#Ia^TZj)v*%*VnBrguW@H$f-8L7L>#L6=W4??I z+(lzwcV}MG=Z}W z7vl%cs8O5qc8Ff^qR;2dK>vzdc*|AF{3~)9e@m`5%$xrDvWotuToeC>T(J%7dcUZD z24)5wDl@&rkn7Ze68+@nGmdskLZWe2j@bWytcUjD|L=}<@Zz|?p@;PQq9=X!_4V`4 zmrM5%>m6nzQKes>u0rW5tLZE1E9$FX{R#qHufOHizspzxk;=+1xC6VJ@rnir$zN6J zld_sZ>2qflPtGOCUrn9spq!464W;wziz*om=$4lHrj~|=m5t5SRkzy0y2{$+D;w)v zqLs}nsvGCw3ySGCtLqaCzkfucPt<8=MP*~v{gsW?>2)isT57A)88ZV_s}yRGY%PZ1 zXc2#JPQRq0jy6iKZ$a!#BNbT_(Qc`)p_>b;n^v|oMypHg&r?ycYToViS2Zq=-dIpz zLdzS}9O*UlXCNvGFMO-4mOS}WS$AaJar5W@hzC_QjdhSc>3)KBE#1gAwUJFQ)OkiZH6ePn{cqcmKD|DCG*N! z(}<3H%4(XovOax5bwf*44ZakHFS=zl&B4)*)JJO?aPZ7PxU8lkgaCPERGV=RK5}X4 zkiQL~YNmCVxott2K(UtowffpMNGht<)-^x3XsWt>_KeB=DJYm??xs%TuJA^an>x8b zEhw2EnOih@ngj%V&i%vx$?xSa!xdYI@8u(`z(w)uKOmTAOEk||6-}C7EG(iPs9)vc z2ixGYrRvu=BQ|I5wqb@55@I%Owzad<{K zxP3>O_MPLS`K3Awel78oRlVQf0Bp4Ajz2NvVCWI(#t&jd=J0E#SgCUXw#m=7b&Ir8}0Hm@AOB_J26d~ zcaD$dS9tRO#=|#zc*cTj()j}(KEuN^{@$&hV+R-M{LXhBG|zY2-1@6M{8KJ|aQlog z+egO?(Sqik`fI+-vd;9u`GaQuR6AYs(>(la55L~SKk4CjdH8J}ey@uk?9X`Jf9!P4 zJI7b^PX8b8sm~Q=e&=22E7W2Xz_GxGjpMisXb%-cu1vuerrUN*3Yw#_Z8|L=u6C^=<}Td(XU7P z6=0-(ET8ZHNjiCFywvtzcBL00e;Sk#l4tvK+GU^lANKHjJbZ%7U+TZ_N&lUPzsjTk zx+nddhj)VWwEv84)TDVQ##i&-cGZvmyzbF&^YGg}{4*Y&?|Qn+>-F%5J^Wi9{uYlv z?|agHp7cZyKf%NEy-)GyY0NJsf}x201J!lWm1ci*rdgVI&d)2=d}Lrco1FPKfzJb` zi{yU|{#syk6O(6qE&`8a#A3D9qlYYX*kB7a<;PEdmvwW~F zN;As~+mbZJ7+H>A?(@MJKeWDMU-QRY`G0B6*Vv{8?x^e>zCi;$-2%bw$RjfcUemvs9zNYZpLBYThj)&b zPM_vUclwJ?KkTue=g}|l@b7!{(GV78dg_y9`oGLh&r&}|eH^;hOlNy*()z1h`ey(0 z@OO(kzWT%T6&`-6NB=QTdZ{Pq&v^8m z@mc48&yzmj;tQ?*tjoLB)85ya?J?H!MycyO>DQa-Id;0{OFg_Z-?-kBKi89A^BH!2 z%{#|a^Rr#)Xbuy}{$}WYhkG_V_wkU5E3RuSxQn z&GY*x+OrXuasTAmpXLE;()peHAI&@Gi{_p2M)S^h#3rj3235GwwEw7>$4Iys{@jY= zOEoEfuPgn_Nay_k-|JxdEAaR0;1Nn;>u+?`kN)$02~FCcw}nM{On=YCZ-KqLVJ{gn zDZj^K?}EqP`>ym~z#ixOG9J?YQdc^8=l)=_`X0)Qp)7ZM-|Ny}2mPm!&OSwdioyR3 z_&SRp3H~=Op7zsS{+&d7jfX#SePQ|vmwob$F8y1;KMDN_mVKrl^5~!R@O914G;}f#1E2a4=7mr7W>N(hVAOE+&Yts5V zghl=%@UPFKf6|q{3F#-04zu?0PjK0rk93Y#oU=;*aOSI1)p(@;3hB~6&GvQWe-6j{ z0(kfMx7U^4iu6Bu@;l?g^wFS8Y*jjtY@go(^t<>2;9qm`_k%y_;%@=ZZym~bGr0Vl)nNV>4}YuKcC1T1 zHhx#^=XTw7n@)mlQU*4DS8S%mQ^qzwJt%#I`n4xLV%cM#9gAN3qSOB+gMx$-!wU;`0nCZ%zB+`nXd0qkG(3(KW3x9J)ZV^z~i5D@2B;D z;<5K*v^ zJniwCm4C6BeuMgrm7m`;9E<)x=i0?ZA?kSn@s$9O6X` zv<;i&-9c>S-3u&vi6!rT>ICrvdJ&uCJqeu4i6rQCY=U`C2|f=j?MW;)nHL)Vxps+c;~@g)|WdDO|!I(J}~o2fDHZv{612Y8Z! z9>gYP5sRG-z*5$ez>>Gyg%<)#USi3+1X#Wm#(6Q-wK;VT%hFzz+#hFY;rgYWow-x;M`n|`8+}JJYuVT z77$yRmjDNg@dF|jn>_sjQ%$isX9=+5farQ)x(UtadAT=g%;emgG%mtU+KpIja-0wG zA^_sC7X5l)`QFza;;-Nb)PpT>s|n5dfXLbAxnI@t3)Hd7^}&C^9Ixd2V3!eFIvlS8 zVV#$4E_OKgmb|>Cg=T0S&f9WlYCMJV+cdrvSoBL>c)knY;le9`#fMs#ocDYoHWFwR zb!KYJXT^bt#!tHB&$;keBnM_`opkJiC8!W69hi`_`Rsl~$}n07*Q@B`v; z&*gyvO~e+Qqiqt4O?G|x))rL*956uUxoq|MA?Nbfw9dWQ1;46o5{u17;Lv=n!}B`G zfgeOHI%|Q&w}*k{n_Z6rhb*5TbKxD-Uw|LbPHd8w{YvoVz%o`4OIcR~%eTC4bmxI^o(?x}Y=SafJ7&5{#~{6Xq3*80REUkjXO z$%#e25jeC2KOnZ1eAjC$aIWRUHsAmsI)NU;Cf~p61`f{G{u7JMy}M{q5&N~pLS#n~LzXvRS5{vvia3G2w z&6N@|_Sjr+6`HjF*)-5i)5IAJji*upC3SHI;mrgS=J00i&;M8w9SnP8ylxE4@ z^P)D$gZwxNh*BjH9kZ6T8#&QL+dntpE{QPKN7cUd0ag7+cdrmI1tnLa?0B^o<#Y2jYE`M zHqCFkT6i|(so&8$#8US%;5184Eb{rl(uavfeh0Alxx|I*fn|In7X3zG8Q+LSz6v<- zP3_N1z`0iYzv9CEE}R3^K!?`PC*}YNx&>S6CKH-i?1v#rv*g4gF9J^8j2{rO$Y%qm zS#n~LmjS14!4HU7AM}P+w#N(Lyk0vy+=<}GSS#n~L?+2DT5{vv5V5wKX3nv4o zK8+s`vFKk0oMy?1MLrf->=TPT132^p{D6o9KQy5##ZKl?#G=phLhdh!MP3UW+J_&| zgV+K+CRA*n;N6DF5R1NfUi?Vw@Kgysqw#j^0zcN6%`Nvw#FBR}aOhdB!(Hf~G=2^{ zxkn=weYRVOjS6}jTYv^Y=dk7e#Dt1-gWLleb3P!La{$3pT=-_-U z zvB=rxp?(+unQd;>i}%`MhgkGEr^>Z-_#7$78*vb^=xhZJSw3^VB>GPQ%Q4yooO;;I zs)!};Uf?uKPAu~M!17FtSmZAP%dz0ROX^50I-G-rUe#rB4wm~$uKIdtopX1UY7M%j%faQ;Qul zAuab2_iCI-{IbR=#Fqa7;yx`O=aNq#{+X6vMa%&YM4N&CY(jHv?9k_6RLhA)PM;i9S%=!l2)Holz z)PHxd_&)`rG)qn_a{8J2mewa0c`0z3B_|g7B49ZmiABDQa%;>d7Wuuvp#l7WYOw{* znozC6F86JXAEf-hYutui>N^e=I~yQMv*g4gf0X*?v_7%Ow*#kHa$=D`2^{zpen8#W zQr{!eSaf!QPqXC2BIo#-`fL1vh(*31IL(q1i~JCR}-`GKx={JnnEmj zc`q;56k?HY0G4YCvB-J-5}S_!r~X0PCl;M2fzvEGvB-Ao z@H}FkK%fP{xmG_}0xWij#ZDFVt>a=o>#%SG^Zr@eSp}TRlMh5Jc^?2yv*g4gUkfZ{ z5sQ2SaNtvIXR`}GNqwF`AY#$qLmj2%`+=n{hk#S#w47MVDjX8S5=$$N+GVCnAVg@}374fB0-9HD2p@pOd6na`$tRh0qs&h{dM)%*1Mc#>0fYR z`e%H=Un`d9U5yj5Gc24!{NJ@aK>Ufu<6QCy#D@0aD&pU2ovX16jL`B7V0pGfEWTv} z%d;I~k>>#CChEK);M61si%vfCT5@8Ma}FbA5sUmr>Tkjih*;!dU^%|TBA*W&;Kd5G z(1n)(%kwc}(O(KI&&P;Gz5+NjQro!~I5ow=qEiofnk6R|`6^)XjacOEz~b9R7dGcS ziy;6Fne$lk?MM?lPXUKUX@9zbQ!jI{=$LaJOYWWXh;PrhY`zREzV*8BQDA8|VzGZ5 zSlW$PC%OHM3u4(s9@vB){k5#N@%Fy}eq8?oru1B-9OB3}g@V(=|!HFl|-09sgd z9)u{(k`s%Z^CI!hJxAIGx%l>&3wHyHZ^U9}7qIw7Eb<=U&=vRrJ%e591P6=Geu&a6 zIkCuJ1Qy?jMSc`md^_&K92-Na5P;IL$#_L9c_#wPcttGoNx-@Mpgf4pGJL4PAu|Ufu&x=BA*8w_>wMnfeUkpkv1n5{kwss&51?695{5f zw!?8U^~(+xom%F#cHUHkJCaOyP< z7M-2UYsra4-UBSY5sUmKVDar07d`?kz7dQ5F<|kHSmdXGLmAqi)4-{j4i=r)nb(pN zi+liBd?Ob5d0_GF0~h`?u=qwS`U*vgZ^RcKLsql z5sUs#VDXJuRE%*_2*zdN2lf?$(WGmrwIu-n!PQ{Aq+6H{&h3bP>(vq9)4}EWi`!M z!wH{`si<$Mt-Yjgtm2SmyzBz)l+WrQy1CV**7~xI*&f*ylV!m0;hyTonrMY~`15?V zv)h*8raP0}HO-~um?$kN1!9>o*4mv(RP4;6BMFjs*fq;Ovwc2qO*69|`cQJIv!?n6 z9Jl7>`rNcv)EjgX4PE6-+_e3#Z>r!*a(cP4OZjK6YWDeR>?Q1$LmHB6*uV~tXSIC@??W*`&s%!$05Bs-d|zTzZ_YpTAlrMf;^tyiXVttKbk+v@feRn<*V`*2%J&9QIg zMK86|+?1PS8M#6m71(I9jchRGMmvLz3T!kP$Xr*_I^=m}P50L{M_1%wal6{;!KZ~d zjmB!qn>t<0PO(v;jS6fu*+w?NXQ-^z@}}6R&_)F|nrtH*Om)`Rvr(aq3T!mlMh>u7 z@YcDi;Pc zR~MXOqe2@M*l4nYa4bCw3zjY{nS5hKJ}dzh6q?AiIh8VP-A08rDzMRHqI}MPz8KXc z=x<<%c6gamA8{gPku{6L8&a54VS~C!Q>?x0FugOW62Pm+XK_NJ$LH~!`-QE9)wp3^ zYVmlyYNl}xnBlRvlQL{VNH*z90B(D)!ye~{VQhYEOryOM&~y8D7_tm(LP$1=?^e3) zop;$A0S&SDRTy*IJBPFj6j&to_&+zdy~OEw2L_2@=p|tjd-15e+a90G@3d@j2iBy& z0J!a)ze%ZHq=d1J#3uH3qVjHgd}h9382`QxJ-5C6H|w?aXm6Cu-fSqj?ZqJ<{~sYF z@HXhV?ajUgYhWW|7>c8@F^$J#ou|GpqH*tlTuAKk+X8NTzxfK@w}Mg_+Zb$O??#Wk z0Q&MXNEZ@&g&uoTZq@I&grOM3Cicj?>-#e7H9#gL_Wlk6w}1Ix)z7=bkdL?0Sl=_) z-1b5^_-S+kuBUT==Fm%$eF^%@xJ@yV?roa1wB$LG6I*+|t99%iR zUxKFCd){O3FR({FA+g7MXSaXPL5co^v3(hv*xL*YReM}3M(1Rjkl6dVr(cy`LT@QD zy6w$_-fRji5_{hS@Aj`3{>_J881hUjjsA|qF?ZYBj+_Lm-e-Du>ckcY7qVq;nCf7e*{^nIt4xAFd5M4N*z}f2F4}PF1HVu_VTfjZh^fj4b5Ms zar*}p$h}ZE2Ok$n8lP?Au-lgw>dhKPkM9z=*JkB>jTAP2owDvjJy5hw@4?>I%XRuq zD2sK(P@-u$eVI5SWj|HCAenf;SM=A@qoGIRO@afgkc)h*6THoA?nb#o7n{E_lw zZII67-nihXUVmpweq75ctYa33wTg~ny`9y0y$kx^Xlsp(L^Ng4e-bOL?#7BvPlRPv zFIi8ibvIV#+8V>Un;G_s4qT~bl+icJIJ+XwEstVdgmrWMWmr9C*B0fhch?i+T3dem ztNQWT#+b~UrvuI!N=6wy>GY+cta2kh@~2Ouf!$bv?C%Y(${Af-WyHVg!^)FgM)1`S zK3&|^*)krQSYONE@=L5{@k?_huEpa~=QDPTaaEa~%`so_xm2}iTh2yjl?#3yKND|4 zJT%Uq+~G3@S`VkFVC*WD8G1T!Ft)^)l$`IZ$$&a#U^Pg*@Urw(d?A0L(VDex%=Gbh z%r7kOQvMF3FE4hW-RS3PUr~IyM& zJQ1r0MbFn7jz>9d50yvNE=0ecYeU}is4uj0?Ug57E!CH~b|cnM3!IOl1~K15sj=kf zK$THAB0Pgfn@1XbU{>p{|DtX_jFlAN?Fzd#%k9?5m?hdg8m(C~#xyHu#Xs^nZBFmY z%rOE+Z_(kPKTY+t1xH@|G}`d@SR2fTb{mJ)&aw=n)F1JWjGq6N5s$oF8PF*UE2Jd* zkD79P#a)+9kM{2tE4U#&&-QmplFTtjRuRv6W`u?{V;x#kzvBAj8aJ(b;G+Iw?H z@H?m^!!747w@)}D<<_T$m5$qK!qg!!G-a4ucev29!r zs;6!68j_Ee#?9e+INp_@79YL)2v@x9Ob&m{720my^laNf|MTJKz(qB4X4X3jYry>qxL%aeW%`DGkz@A@qdTX==+4HL(NXGI%}pQkc&x~R>&7R$ zi@6GFr~ku`yNbEiSEqmbAF;Bb|HD6ZK3|P>xVHcKlkq>_5??$XW0cn31EjTys15#4 z!KqsNq48he5f3)|*Q$+y+4c z1TFQ=dT|8xHAs@x%Eo&t>uVk`7bq|l%OD=1YFFYpbWQUbwLn>`ULcz9Yvo8AIVekI zZFzl7vzhVsg-A_QP0f|f)n99z-?(yB4IX}*N!46vK~{Ir|HGPRE+By%Sh#m3^4Q7c zzJMjUZDmz86vn8k`meXZo8>k5hhDiaPc_#x*D@tVHMN*)U;z8n?eo+u+0G*RZmlYepnJ zn%&WPAyj2tsfun>>E=QonOy1P|KxQLc1!0$Um0#41ja9u*!K)PSv!b{eZ48+PrS)r zje7=7n%^O;m2UmpA5xuu&Mq@veQM{V{jsXf;!k3bFmMOK@?Q4XJLTaoczDMAYSQId zVJ;A9{ze&qEI#bv`P|f6*tayG5G+P*~hU(B20g z{)meoY(L4=f5uMN{2mYA4^sh1C@d(d+cEJ8N z0A)Oqvi1K7JdeK~Z^o)`gP-Wqp9?kI%~KCi#6R50CO~`!(Qa zfaf)q={JHe1s44g;8|bJ0hoRU_7?$TXY#uN?gWOK$v1<)3-}6)zYTmdu;^a}a6fp_ zzlehV9z5$z`~Qf9M}Rp8AzuOhNf)07ejj+r{|W5<82n|H{&DdC>`H$E{J(&g_U1Qv zkGaxs0)GO$wC`B(Z@AL`2mE^rJRa|u{&b<>cU$V zzNz4+yV8FRdw&O>b5i>MB6xnXN!p9w>0AUJJ2QQ7e;@1V??DegUNK&j)Bpqgt|`Y> zA(m-{-kBouzwo4QXGgS1`zW0Dd8tP~!NcF;$^SDCf2*ax5N7#Z)pM44j!9#2ratGf zSK`Uv;z`f)q+e$7hfVuQ=6NYKV0~IGCf_V?q_SRXFr`f2?6H3fWI>)lAmTz3>2Hao z@*shVu!(#&uzWj}SmZpXMNTa8<-j5I5mGHSEbVI2Q}_*86Z>7j{68P*8EmQ61f5vy z><3P>j{5AZAYzff2%KigiACNEjK^6f9mQ{OwSz_HBt-Jf!`F$~c|il%f@_F0 z7XA0Y%Xb~m1Ls;d5FY_c+Y*aD&%fXU5P*n9&g)8$gBOTch^5?B)Uj@QHc)4R&PyyhTdBi;K!TnE z4soCcv7ZMYbg=02e~hAk#D$L$r)vE-fkSB;GnQ5GdoKO+E;;{SpL>0(U)+ZKu8L*VK2w3bdCAKCK4Zyh>I`0F-nHsMLmi|L5Hu>IS@Y`C4 zSmZsF|AUqji~J>*KC#G;0EZ@O{nNk!P82``#911@Pt1!O=mPbx)%XKoIrl#T7JrDv zelo_JTuYyGTG1gEoyF9dq-`!Ew#Jj?E;;|lBJu!KLpfTXT{-u9joFk^cVe;6D#^Dr zr%}f`ABjaL3@mnNGh|KprT_=m;|D}6`nLiH@+sAGpinJ7xq~{E&%~m$6ga@f05xI@aZ(QAWhS`MgoD1_ zv>qbS-$otFH)65*6m=}$dZ=UhMl3qdQOEL)eM5XB7M&y1v3z5H5Ie-8Ge8~7&Tpt= z)sa|qKA?_e=g%(8IhuU?G#NPeRwRNhbK$Wre7OrJLoX1fww}`lW@vmBcDZ4Vc?bhD zHRdjGo5rQs$@ftyF|7GXB5^S#(8XrVGNF0jCGvF2XKOk8wo#%nPfLS_K`d9~Vd6RX z0Wq6VW`SG(kEiNCJp8;BQZyp{NNjUOXk zsBt%OxyE~mE%|=pMOywM@i#Q?C8mR*qu4}#l9)Gqpx3cUxdX(D@dJ7foAFH(n)gD+ z5{*BioHvIg98=?N4HJngH0Hg$u~cK;_ZyWOrxP#JcoK0`W6qn6Dvde6GO9J^oXS|P z@oblTKJh(Teh2Xijh7PFXuQHDZy>%`%U2VBOXIb~wHj|AwjR`NC9c=<$B0*I+)dn| z@m}KlG~Q3l0RZ%(OYVA)CXWHzb`-QLP9HB1ti-z)E9xq0?Dd4bZ_2EwUfobx(^%2G zvI61!DvuAo`S5m7RI?eb&nWsPOFlG2T)!CrN2=?auwpM2y)U3#D!ku%0|Xw_BgXvm zim-Id*juv^@J@?FlDq2OSb2ZNvXp$yNmL>$R+m2Iv$QvvSZyzGO#A_{D zylmx4yv|a;vbj2M*1YmuJf@F+YdAOYD#bl`<;i-dMC!pX_vMW%>+n|0;CD`HYgg4( zRARAb#FBr`p`eD?bF~ZK-4OB6z37uC~Q4z)QZ1%*m>$i5~nB_5xD^A}P zieC|Jtj7N}hKa}*H+0B9mY#OM04CAZUoc9)(2mF-9GkC0wC%(%7-9cc$JI}oPyinnem=@QUx9Sn zduM`DOChH{KQ^&90PMEMI7#QZw`1?WS$V?PlZtS!z62R*Zv-~6mxv0v?cu+L=Gp_y zLz4Q&1GxR`PF1QG>9oh`kJ#g_t=ryF*vqHDBC)p`yxZQ=G#zJ7dpuTRZzizY-bZLi z>+**b$3ISc-S&K6((@(S<1=8fw-gT0p7^l>jltt2L_HEO|8Biz=$&-cL-dwH&s}aA z%I$`6mK(6rX#YVdF?#_vQV|-h%4Ls`+c&IzKK7)&n5b51X#R>GWAcfGQrKuNlC-BG zLl?1|jC!+%(YuHY?)XHWMkV{KkEZ{@Ok zZ%Eg%hdN|YWBu#ICl(YIn8}|XpSX0QE>EAsli;JF?z*r2$j-xi`j7R_duzd)W)xvx zUdOt=108Xv;!ek%i8~&5BJO0|k+`FA#}MZ;7x8~tMWc?ub@q#uUSM_{6rv3G*j(BJ#peuM*p_s>*MiugaCXu5qJ)wQcP?98iP)Z*<)_LE+joVdTVGYPj}B)w zXQN{UcK!bMau6}pf9Hbove`Y47sh@XPCOb+YBLfixZ|aazE1zZ$I-y^Dlq2zfM^P+P)ag5n918;{V%c`x5F_TQ10o}{l2k{8QBs3ENcQhFy8ZrOLfd7X z35PFBJRTh38(kL2w(IJ)GIeowve7-WJn?m@o71|++5YkcQ$AqF&Oi|#5hCN4mlIudPX1WCiOv^AU$PJ zI?9Zysff~&vUmh{BQmfkoLJO@qurpUB)X3E*}(jnk!WC#nmzwiMDiGCGZrvN(4b2@t3;&=P(p8H;rScNpj=nLP~ z=~q6HWyFku4Mj%Z@vunZcNL9h&v%YabnQgL;dZte1Mb*CeNJ3~q2wNnCzpzzi>l|< zfsXl#XModYW{*RPadvD;6jzIs@ESz*4t$Jg-jV+Od5?FFOjsR{7_-doeJZ(K=RIb( zxN&xUQDQiA=i@4K*FM#=E!h4V`klLlg6$nRLT*W7IPP$?p-Z(!VD*`OahZF6im2g| zcx`)6Y=PakjlO80+{k<;2@$7>;nu8V{3rQ&#JS~Lb#PnFh@^z`x)OV%OS>4yi?e5O zmvJ^F96g_9a2#>kJM-CnaYkQCxThmJfVk4gf%zE=A6*!C=Y^7GrKd_Ie(&y>8T;wq zy$}2Q63%3t&OTLoa^8sr#}{#onqjtPTSm-@_w4B~&c^R6QX7hVVMM+mk~fHUL~ADP z-q)G@?!LIA4VK^T_Va}cB0bw0)Z>Gq5RJ11R(%4A?$(Q{h+&*t=SG`=&od*8t|ILh7YO6GYY78$LGk*34HzvpqI`wU|AZn`hwt&BIb z-za^3-kAlb7oA#s^6nGMjxRqJcl5V+KAU9pJ-c~bU%{rFj@fqHZxr)_!dNXLt1o`~ z32l93^!dwzEmtA>+tDhGopVQDq9iA6UhKmBWeZO&oO$PgJ2MtPx;XBe7v?N0J5_cK zyo=45jw@|2Ia$4cedoqxQo9O5(A*%6u;pNbxhWE7XW`Y7Yhosy#G zH>q>m9Ns8f{sbe!_iWDCgi&zQp3R8sgl{=*j?PZ->q;)&GSfC6=*a7MY+g^>bj*Q* z2?^?i-HR`_bZ+*qU`%ARAsNt;KsW*r~Vnw^qZnB4PMSUKo(Yt!f9Yu2TLzOuxFn|6f@H}xnvwk<84DgG65 zglC71zQwV(Fd8^EbQ`u92itxW&Upf(v0ChE7oFOr#+BVscGdj&Nkwt3liK3S7ItjT zc_Ocunv3jXBD&!v^djd8V?bJpWjZCg+xq|E?rp%Us?N0GeUh9IAi#kw2#I!%38WZL zA|!y8T6=;yA%sAY5-MncI)0ABIEwa1eeZj(_3XXQ=0`g--*tWSttDEY-g|nRA7VUm)$rb8<9^I7K)M+!r zcVJ?C__o>QjtU!h!Nq14`_yCV!3eLZ#v6uJHR!iZ4v$%E4H#3utiFDAbzPWmUmPuU z4NI5Rhga8Py%wb#Gj77-yfNbn)K8dbvirjTHF(YPM+KN&y=K)t)r-Si`~jmFUu0c!hCXwM6ABHuDZT{*^+R4 zMJ3cy4h7@#$LEg^k6qf(P+LFw#vAX(Tea0yd|7s5wFJ45FK6;<>sBqVjyL3k5r$Wu z3c0XgT*1U~Hy3>AdaI}eeNyM$m=)l=@03umZcSmqvVz+23s)A@j$2qs6eoIM<;vA7 z#uHRlu3V+Sin{tZ5CSH;YjFn`cd2oSPr;w>@RdupC`UxZou9IP-3qOepZ59h@yUFq zR!;Gci758m2MXn%CJ!6h|2-eS)aTDYK5v<_ z{tN<@^7qc4lFNmz{Z|-rVtoC4;{a8D^WE}NviE$iWc>*NR+a3%pHMQt|0t(q?|dsc z$!GtZ(6zlXpTAz33oI4B#PCndk1GEou016m^~ulsWL}BNDZZB;C2tmQeSY6DOGV9weVC9rOuY8rv?`Wn! zzmtianEoLazp;;lCx??TKH8t}*4H6cHRKrl@H))#=a^xB=HX{v^1lwb-H^*5{{*t6 zzXMadlFB97s|@3Y6f z&c)IHTR#3MpZ|WJY`!*Pc#ho=N15YN#8H;EeK0V`wLRyH@5@5QfAas_=Pzv^$2ko{ zeP>+|NB#j{e4O(tj{a?0UIQNY|Gv$~|Cx~SpZt?P`QLr=Fvt;oPDdDc95LQq(oMo4 zW7*iY+WPw^v3#R0BPSI2epao9Pfb4bt&i`$6@orgCmx(PXXuY{5}IL9Ae?H%w*5%x5&|P5ew%$a70(0 z3*_jyh=s#;MdAtr+xojMv2b`ll`(g`ugG}1Nx*r0aSK;W{Sbxc0NeVeN-TC307pWK zQ$>zW53z9AZb*9SfMpEbeFmRc_^k&2F>>_xXJX;-J#2)P2yQPqI$mPoa7>)U+eeNr zPh#O50hWEg*`C?oR5po)bB-Ka={erbW`%+y77oY02`3fThH!|5 z7O^g8wp%tEc{pMTI|*3!+@1_9V;-jf%YNE3fn{tRv4rKgHc1=r88RMl5&62@h=pGR zEamnca`bs87EUX$*yI>D8B4g8d_5L`Son{Tk8c-rI}QFG>NA!8DPRdpEMcEDI4_W+ z(@ZR!gTRvJW8^GSHi?CE5?IpA`+;0*=YSHI zq_mC1!WjuHV+nJ}(bovEaF~AKOahj@rY9SECk;BRnFiixh2IQpFToESvDn`PES&AY za_tZc=W&Cx3pg|uKXAP`B+bOaKMX8;eIEgqy}{YXk@1XY$hiSOaPQy{JH%q=eP9{S z_z7?*f*&~c7XTLd8M6G2V z#3AV?7S2)N$Q1m*oxmaKCl=0WU>TS9CONuniG}k!;7AldbgaW{{NPdy%=TQA39#5?(FlH!d_AU&SorM*=OF|0TF5BH4;-=Zc}_F6-aNm(&`WxV zg?|iK((syrF92su!w(#>@OkbswVqh?X*^%LJc&imXIHV$XAHq?-!fRJaKyqN3!JI- z#G)?%7W>4aj{=L$Vgt_s&X}(36AS+i;7qM27Crl=8Rd#^_EDFRul2;j=R2$jPdMBf zU`ZRXaJ~a9Xo9Lu*AY=KUVl%20lQ(E?Z*ZA2K-XuS(dHz>yisKKrW~U-Php zJq>-P))R~VEnta@So9Zw#s2RMJTeJE_&LDB=e!NU6M!>jsq_#F|7PG!ttS>e z=W0lLh(*umV6i#Nz{dE>gmG%0W1Vv0J3}QnbdbX{jlqwu9>XXcKMCLrgkyk&k(lCJ zTa9s?n3Zpu5e%n>* z^?I%Rgi)6l$KfAn$%qq{$d(|rD=Hh7tg2hN@PX>ORak2Mif7U(6E~l3q7oLkcD4L0 z<8l**b@DVgiYt|WLI|C>g_SiNgj!vF`Ei{X1a!G&mfhu(-JzH6^2Od_#4^Tnf&h2f zUw0AT@mE@$*BN&B$1bpoCSxq#ljv6^P6P5(*s^|TD9|i9j$KybR3$onT@9UoXf7N# z7bHKA?-j)fyd9(zD5KhA#W1Y-3B?G=jGlh!I8GpdX>TMvc`p|y_I?3i+DpO9;gcZI z9$#^Zy)IzW-d5Nf44pW!_b3#mz1LxHBy_abPx~=_SukeWnuqhU%Q$1-iOC|ZHxcJ9-DR3-mX!W71s6!YCooLIRcpWxOO4?4C2IIHGpZa zF9TyewY@f3;so+OZQ9#)4d#PF!Tb)vA@({^UbM$&1G)wjhTg`* zk?F^yQU4$3Xf5lB0hb;#_;ZlS7Z+q<7*6~K0wC&I@gh%mIUSYDLx#*TgSp!ihIcnD9Br43_?>if;nq;jFT+A@;@+ zj_QyxP1oMrdUWTJJ%~@<0zpXBD4r#`rgmCmi)%#POT8&UnI+&UnI6-gv^M(Z!>j zv53bx77^nTdz1Q-4mKW`|Jv*m`-9U1V?(tej#CmFfgX$vOAo%~jm-*lIcYkOotrW; zzP2IY`Bb%Bh%PBUQCu?Z`Dr<2+sjg?zjtTVUB~YlgAp!S6$SHickB-?FWS@>UyJcA zv0$0Rk^9=AzCh3B;#2PUf$Xm0K-T<%icQ6Z!ETIt%6%;#qYE)wF+F%+pews8#me5Z zII!V}r1rQQ5@YH%c_~8LIWqAvt|b`g+DVJ$-8%|fUW^_(WN++4ZbKX|Ilx=<&>W$N zl^xwUv+kNwk^9)#&^cp#PoT#gznG5kKp4$vZ<5&T)|8~NA;a$3&P{#LG^CwqS>le; zU}`ZQ6QlfE0xajrZ}nZ;+P;d$o-Adr zU!uKtin&%@_O4y&PxaZYed&o7cUC0tX-+>>{&0uA=GULLm1pmKHa#BN9L%P7L99gKHVH& z8?-ncEzn!of|V^X1})Ijf)QX`>yNF7Iez!}{3&>u2~@n4PQNqsU}NyaIyUi~qzqWf}tJ3E3ebZ!iOl$IuCl$K_v z^;jIEwkL6nS`Sv>!`HdE)e!L5@wMsJlIDULE&X?*))&m^jm<7$F3izw7l-99y^CzQTcjS@ibS_@WhoEQ|ttvyFbZvfF01T&WD!t-ZLMu{tcuHPu3!+IDiL zjA6=YIn{F5y*|5J(B=d&w(S7MwwX=%acX%v7`MNf?R1%N5My6Sx3g*Vo zzk)HUuV6%8pi9`S&vI@%$H4Y0AADLksXFlQ9gSyI?eSkX9RHuZ`|$8U&rRqh+5P(A z`VwoGKgTNetcpPo6`bJx+HP$hGB&g#ld+eLk9eu>I;uPCl3ivCp$$KDI4+M zXVEC-5&s=2H0)jFx2MjSe}p(!tgY%>(p%8X63IFYZ11;3A z{=ua;;bF&4Pq%)A|DBuCt@al0>Iw8LIk03s)*hb9v9$ABPrEIzJASpeZBzG-a~lI^ z0@Jd)FbY3BKTzfy-^~&2S>;>GInMikb~-0*DrnDd>u&!M9!ff!Q!Mv7aZ40;>ZMO_ zTpKN1-5dz?%*9yV`K`x&rH1jt8~+lcnhVRD11F20ND2IN98c_W#W0K)0wZk zJuzk5ZT8@+8=y4B$)DQ2i7_dy%s?Kvg!R#0|)GF8J4}h#j?K}4D4^& zYgIPQdng<8w31`VSmPoCb3%(gHSf=`Z^ zadsw&WidP!k5*uP_}_k7tgZE-B|apsHCUZm@U!OSe)Z)L0GdJr|h0-r=1_t|7)FTXOga;`SI7;FSU~= zTFE6rw)7wK%)E#kAGI2L?eF#r1b()E{of?-`>wrygcS_N&%7DvD8a0XCVN}IKv83S z(O&Sf*W#YOXd!GQTP;Z~K|6@^VvWGr{P^o%Xu&mvv({NS-1^wY?70oMZg_G1r1d|- zou#ui)smk3?f16+YUeNa{N3SS9Q{AXe}3X`PrZ8jZ_d5)=Fi^lsrjdpjZ+T&wC%-B z=*1q%Kib`#-PO-p8hU5sx94W(2R{k*To>e%3!k`W9(4NA?$y%tO7rl}4}wX#n;OsB z%_;plrrm^V&hFpeD#i6SF_2z7C}EC?9qhB-Y^ieFnm~_Lj#jygE5m9`gONQPbO|mo=wFzm5J&MIc%nEF(W|Rii$x4rF1jjA89;psQtCv^a1k zjv?-yKOSW*-}uhRC2ndlRqNWT76`1H3PM%&Xk&2H{9`hD|z13g%Q9J7lGf4Q4G6`Z}UdjG#X zX@83vWdwIzh%Z8)eat3z{$p;lt-b8?2Jr?f76)sQ6G)0X?@#$Qn%4c@D0|( zGYWs*?(7Jm(%Lk-d{hf&9=zK46waBKeuFFL(t-fPz3{Y3t;@2i;17g&3Wpa6jbbt&FIKI!I{l=^KU2`7oQ-`S*6j$KT~pDt8`tzzGdeh1^Xyge&}hU{5KAlK+5hco z&I1f?UfJ=}S^0AwpEG#gC(~-mPM6J`{?qCC<&T#Sp7FbHu0%`kytUiRGq`#+uljd! zUs}C-A6kIr8&%su?edM@I~!?_j-5JE6<{BiftR-($;tu?-hf=XV`yx zW%#;;eH^gUM00Mlntdv<1bY6lqC1$6XUeAQQ>?65_xG~!q;K43&r&Y)?h9wrqJ^=E z=FH3=uk3g)T2*|!c*?YW(}FkyUT;k1nX+e*);ly6_q_pLtK!YwO^+UnZtB~&E&Tvm zikLTZ-0Q22y0`W8&e!*xI(+iziQ})GIDYEb>7(b4ym|QTL+>8!*7I2>w>{ssuft9~ zIJl$4E4ADX=gF>n&=Bm^Gh_qaN5pGmfzAPe6uYJ4s@#+Ky*l>wq?f9+~dHZ z+++A1k$V)H5xGa~mY)yLJ#4oO8j*YGd(-W7XI^Y@_mlYtS=PCINvGExSl65MdeW(9 zoH?>NMhnf@*G6+EPh}&-?iem1uemId`FEdi18-PmAXP3fvzg_1{OOh z+YpT}!rM>mZgKuk84|OUlNc8NLn`#Cmf0n}C5ho5cI-c)?VoCy;@W3QnSQ4RW5s~K zLQYgZmaJDf@qDT(xQ9+l?CBt5?5URc3OsA@=lhXi7iqFC(p0%=q*b1$Q!RC#4qpQ7 z4xH!jtNVqD8+$xm%@RSH2EFnm>Mh#B!dT3_GM+5_Hs>r$XucK2_W&HZ9nS3RLBD=- zdCP@aOXi%IQ!?-Qc{%g9&riMc!t^EOC(27^JU^p9t|eOM*9UVy7Va4HG_K_Aa4ODe zD(0^we$#PUz-RKeC0>H{IMnTjr%C6d`+=b) zbB#Bc`0m+}JfE_uvhJS7HWJuxYf%Is0R(HTzGof~y zz6Q*-2JkIRuR*|izXkXI?3@93RvOJOB7=56`EFaFYaO&+&B<@hHFlKyp3_dDHAFk; z-Lsm;ylNFrd=Br|yQ1FiPpmoj4{wWoJSTo;H?EiRXl`Hr!Le@Nk9`>QCGmVBPaB;n z_{wAK#Dx_%u8&#y&GFEyR-ku7G27DW(yaAOQ~Oy>ctVY@{gw6dL-EbnQRu>lgF0I; z{64oXFlH!}+gq;z*1p2U9*C(TMi1vG?1f;-Me&j3!l2ZJL^DH5HTdUF+pd@y)MUogX3v z>pw&aK6F9_QyI!!(c{wZ>2jNAbYS&`=ATcq2UtnJE*n4n+w%ek8V{sJH$_>>v!aLa ze~*<`?Dc~1UOCcdHT`8D>dS+HQ0azJX9bi}^Sw^ox&`;66@mELFXKJPJ%O~+O<aD1OfoYe18yUm-#%FlE=l=B5Plx;g(3#9Ca+;Qtu|_l?UX5Pl5bjfF`n#GJe_L$! zoM|P~ZY!D-bF|*n_=|i7+~!S04|DQ+jov3`S$*~5>jqe3>N!(A-<>zkK@6NhPoIP- z>(1zg$(VEQpINU$I8)qLS8*n}Ou2U~x%|c9urobh+xg7N?pWn<8D_Tsae)$N$a^Up zlQ;h6dS)wJwXC6@X{xHMUltEL>jc(e51@v6ZdVN@x_2P?2^sB0_W?X7jgR!VV zh_jN5GF*QV9UCcO3##x;4DAb#y=~_8;l-c!#P zW?p0jF)&1YRb3r8EA9{Lb6R!36BK8s-U(Ucgyhl>|EUm?<=c$Q<6Fq?N-P_Jf93%udG37;cO#gNUam<{xBDotioEF7Z;a%3b58@ z9V+0m8YhQKRyVA!t2T4Tg*8pD3a38#3YX=I3Z?wK#X&F2btsFg7f=5q!qn8WSmv;j zdolQH7EXsgWzP9Vp{%Z{jK`~M8!D?-RI|P<&A-%Hzfz!C)593>8XjAHcX;;Ki^6N_ z!?D|nzg~3xA8m-29IaGUVu_B`b!)04j=_ditHQX1>Ke2~U9GN^BrhMIgM8)me+~nm zBi-BtPR6;(7&ne*qvI`xj$_;C!p^TZu5+!H|KB&DBC5D{jAd0^8;0~hcL5V5zJ`NB zwc{El+eC2wCtGXv2{?y)dlKH5CHe=g8*#JmbHgY(>XT*6rG@b1m-zfw_~g-22{ivH zpZ^)3+~t#>@yXBoqX}!h zf3e|D+1uMr*AK%#vHtY))u;YGd7xvzRN};%AhgeUUdkzXxrp%RUQu)y28^a4=I}Q; z8vZDLvmyT)-=fLIFl3kitl`i2I9EzJ6~4ru9-sW4&~<$8`{Z#xzE>Xy`tm=>N&k8G zd=9djklwklXQo&77~+~IW$>?s|J68{f9!y1tq10qa>{>;Ue%u)@(##9f;>_CFN6G! zA>R!7I;2;^k3o5G9SIDhcgri^J-;fwJB;+Q{BHI6@ACOu(#RwIuAO8Og|4hiVzgy>3`49EguOZF~edEDF5QkrZ@LZQb@;4gtmmxEYwATu`05XeI z@?Qq5+z{vdEf5juVfiic$(sy0u{{{-@I8A<_UtLyv!`Uwo4`Gk1ms$>1&JW}P9T-3w+@x`S>^c%ck1`ka{4SKhkWu{pWJ20iSggy*z>~Q;EONM@y~U`D|v|_C)!ib zqu%{r$x~dulD+%KjlTHCJMnQXD&>@X(kJin$=>}z@xA8F3>pzVP1r0LAy( zHzj-be2s3?$efGGPM1sFhX8+vu-(<+w>igpY5R&jz=iE;Wf6B*w@(7>owO`|{ zH+9^-j=e(19@iUFZoKuc8ncg*WPQo;Xa86H8K2j_jki8ZQ$FwDUy^l`!{6fLe`Lss z^+Ux!MO){J60{%j$zK0M`FHvJd2dlp`PYc3?d|f(FBo!SdQ|!5yZ%a^Wypzqm0vHt zO3rfmO1{M>d;KfrzryF=>XT0ya$@}I{LFX#m0aMHCmZtl0ZL#K6tJc_<-OVPXZd^g ze`U{$U&*ig_`L1`>KN#)WQ?gfHO7`;eWnXyJUn_URE7=RL zWbgbaIqKsd@yX3TdAm>c>X)+DYxpOgFV!D8qh z+nn>e$;a^|2v*!;mxFae%=n5?L$n<--P@t z$ULWfzMcemDDLm9!<0{>zTO7e*79FL=KIW%T7D364dgLeo(`F71MnJVcQT-|E$TJ|kiU~f7>@7YhK*Sq&BIe@w?j`7{-lh63_ANIvR##df1`}o6s@(=X;L&nMY{>>-9?2CVo zj*s`mVYteUYJSv_hg;X`{NLxuS6fkC-n?Fi;r&lQr|&JNd^4?4zVx^F&KK>{@%kNR z{fX76%b#f-imT$wzWk2&^om?_|o$(BiD{`4%hir^(WhkCCFo}ztZVb z_34XNtIz%;VhsOjZ@bU`hdz0QFTIawc?7}^!&}A{U;e_r`nk|oK7a4C_n}XI)Msy# zuReU)$Dinn@0iY?IzLmaMt%O3e4BN*wy)%3=e?_~%bZ??I{Y>GFKb4J4b1jL)`q^B zSeF<3OtM}xpC9scx{HZ*8hD?#*Qo>(OI&vVN6@a)Ey7`Q@fo;9IE2G{B-?Vj%{c64 z#UU0B&#kOGypx<3#UU0>H*g*+2i!9_B3z^f?s*&-T<|kl3pj6>;^Y$Rc%#6QFJj@B0?Qh^?B`3qh=sENIHdDc z1uQn#lCR5(Soj-&Bg0i19s&-rLc?tb&f~`uxW|dL&8L8E27)6NJI?|~MmlP%7dQ{= z6VV+3#$*@AodmY^V&}vX_6)GBU;HjP`oWD@I2Xv_%^!|y=gB(S{AMI;G^e4B6nzLd z#L5eoVd%#J+Zz!Gj#%t-y*x<+pSz^2h=nr?Sk{$ZM9wBMTaYYjg`zK)kz_%D!?;bhA?Mox!H8?kWs{4Jb!fkS_y_|xK)uayqcAiOlbu!Y3Af7WvuA4%Zoz`bjJtzT=YmIRRMe=PlG{sj%EX!5-~l z2|Jq{oyR+f$0!cpbIEyM!LYji5KGtw@^x6g_mVo9I^1X7@RHx?=|pKz>zPi zH0%QwJH%p#@5F@D3oPk8LjIqrc!`Do8nC4E6mgESe+F2}iW+IFi6t!CZPA-;co_Q7 z4fuhhIl)dF9&yyp{_GKUcHydUh#g|FzZ^J&f#8TmUjv+}^~9oY0Jb|-9*IT&AaF#- zyB0XahYYxO9C0CZ8teLj~L$IBYhY8cSH`elf{WTOZ+H-pvZ9fhy%pEc~me*LH|S ze+{s#xf}+TG>j&`N!fJnBN|VlzCh`3VOU+ZQR>GjeKD|<`3R^&Usn1s{$=TQg^-%2B82CHn ze@~@{SojYa9M&rd%R2MNtO30jd`SyM;|SonPBBm4;lo(r5&1jBH|!k-VEsrAI7 zUkWVgAr}38z+(SF1GA5j!3qLLEc~6onOaXQ`e%T}KC$Qz0E_)T10My>xJ}t77Cyfr zXKFpM=wAmG`^2Ju2UzT%H*k6q_#7|-M=X4P;}U+@z+AW2eoXPrHGGSy|Gv@_i=A>{ zcg=KiSV(ZQ3=ZE1XB0bXXa6Dzy8!x3ttS>e-v>(`iADb)u%vmNfgb^m#FTx$+mB3D zcrQ8A6lR|!G+kl#NkTIe{weX-6y~^}jN3gd@$!9srq&aS{wT1dlUVepfhC=97?^#V zJl*D;2hNzS;v$x?{C1eB^~9og`a-%LBNqKI+<&F~3y8n2Y_boNF~`HgzZv>WttS>e z`#E_PiqG$P8FM`>oGA>e^~9nt2bOXm7Cp!LNjX#*_yO|uW<|upUk5CC*#w+ds?xym zRT_Knh7MT5rT}MZJ+bHq14~@QqW=Q0 z#5LN$w~*hZu3uu|7aN>ezC^+~r~6?}a{7>xo6b4_MMeEc#wxNzWkzpCZp}IP&gxptThLq&$g*Uke%@afew~(&Vnja>xo65Lq1Oe z9I@zgfitz9SoHb88TaA`j#%`3gviu-V$l}^N9yqd=hPW}-}Kj+5HkeFrc*GBBT`2# zz60S1t#+VARmK_*OI%cCYCZpnel4)nJz~*61T1lFF>oqy5pPrao>&M%*>B&_+I zwHW%y<0|YDV7b2#i~Z%ma(^KfeFJbrr|mxA5GNkMeTP`NE&`7H5I=BBab)aspo4|80;)`{ zCl-AjaOhdZe-QuV+9wtcug8eyJVefO_<V`I+MLx{mZHTtK}p zhg*pcDm|}d!LxzICb8J$yAdhdMdZJt!t(mf`x}L8f$gX914k@j9{`RVQk)IMuPVF) z*k-}Q5euK!SA-`4?i}&Y6+TbQ69V@M@&8dcEeZIT!XaS$7akUyBcTuR1j0qge@)>@ z2A^2?w~}*0arho1@=JwFfb(=%ep?BhRQj33f3NUd@_(f;-&aJmp5Iom6sY5BiBBoq zVCebo!v5dL92~Kvhu>W6XOx~;^p8>hL!~Dc{Vw3hKPdZrzmdmE3imAe`xKv8_%D(F zkBW1W98MO3BNh(dQRMNa1jly~lE?R`|0kvAyNJ*kg+HPG?-b^@n9x~;2LsDFA{P5u zi!Zi%5>jSZbT|>@Wit`|Fh!-o| zTHw5YQFsG6Z!5f&oc~AR$EfE84aaByynj{r0QJ1M;Z9KhZwm9vKvh zdOowuIVBc-8gS&ivgtgt>oPH)*_~%|eeV3v=8=C_VasU$2kQJ1i~TvYugh&du$04E z;LzWyu+7xJr|<^q^>w$E_ur6(4BF7@olz!8gn z60qorML&i5A1gkw=w}*wV$shx^u(fHV(5uQUke;bQuZ4Rd>{EQDm}6A+o}JF(i4k* z3veh|=^r6S=bczMJAoqs#bJ3yf(nl$zuCjW50leR>Bj=+r73(f`7e7|_)+pTr_|sO z3ul(WNe2!MPaSD!y~J4x z^EM#y@)^X=R(fKIw~rhh?;&7`_Xzc)@dJ09Sf~GWV0(fZ^UV za7vQLNe7m)9Y(#bV^;x78aPHJ^hIUI`A($MkPE%tqx8g*h63P-&dUT~v2zRgV-=rR z_)Z^8^PN7JPCxrycCX?S3*YI3Y5pD1i+yL@%g+@5qH!;pzue$A&^`+uj#%tJ2pqXy z>DeEX@@WT_xE>-WS8+B|uj}e|@^$*VsMqDmKAYed4cuqoLk2!#;9~}M`d!*)7Sb)( zAhD!B7dR48X)6W}-KenB{{OXyg+G`4aY}y|`QsIK+W!q67Jd!+c}nlJ|2phJ|@xB?kMR67ZhrXmR%P{m6g_i^8-Ky|9>NRGW zh)rU#$@^eL+u1|TD=I9pa9BPOolds-Vux5bz2s;+Y}+MYV+}sB@SS@W8(p|69FZvs zF9i;1TnC(So6-|Y*fqeJT2Cx`<_nAP<5$g%mvr*H3y1lN6e$kRwQz`q^HYO!5I9t# z_{Ye9$iu=vN&Zx&KSNxq@SDUsFYf@$I7wm&`#W-`DL$L{P?^Hcy{y^8!guavI{myP zLdA;1YL} zwb&#U4$o;sa~=TB(|8zgh#OT$!T*mht~*}xyLW&$Qzhxi)j4@>c62lTd1F_@K#`nYrDbULB0VWrZu3`M`rz^%Yyhh-RwE51{1+Rh$>{|xz6 ziu0nOKS=#uN}mE8sKpOlI*!0{rN4^!9)+(VW(N&!H1SG>S)PF!g(ncNQkZotP^)k; z@x2O{6W1xsG7Qu!%rXq{1v4DWEwEZ)mRn$r!VSdVQusmQ`xI^_zF*-@#1AOEmH2-t z{21|r3O|*6gQY+KjcU ztFTs@8Kbk8XKmf8CCgS+FN`m(j^DG8jM4YG;him+xpDA9?n=CP;o{1M%7rVI)nhm2 zrC7ah)witt2CR1nqpRqZFS{elE};v>dJS3Pi&Uv}UST(FwbQnQa5qOb&A3Xv@Z>@) zJn5wKb8N)@nF(H8y`*yWiYsl<&8@w$gSRBn-O^j{*lnC8H=)kbnhTAkHQmq-<-fGA zclC-&$&_OZd$dX^*JC&Dn!D?9mOjts-#C%j`rDs;?$o_7jx`P!%G#T5+E*=G%x%XV zU$q)!wMX*XxhxTh#Gl?h+5(I(t#hMra)i3MupV1&FI-x^qPE)e{QSF<8`qR`F|Dk< zD4(q73*(6%a*F-s>g--_Wbh(h!uIB<_3_G@g^O32ab6TeUG(u9R4x>0ZNsV>w-8`} zrH6G|vF0jEi2sb}-Q=lDIqro_+*#cSa+&Da=3wR5>bjcB6>jv7c_!fhTN|;vd8@C! zcXf45yn5lPC2pEms+!4KtbK;x=ZlWbs<5A%sOl?imKv~2I1nEJY_bVQYIY^SI=$Sfu)9!9`Q$hVps%SRAM8!RcvU6#F#u7AJ;Tx%i^8W?8OYc4>X(>IN(>i`AB$BDf4msuc@8k#bSRURJ+QugGkT zUhHO@D-ExT8+(@{ji1qBsb9UUp}NY<%SCZ{{WGU#vNpvNLO3uVGhhj+k*%WBt55Ni`$ROq7d zF7iO31SkaZMeq8JcaaMw6u1FhRN$iVE^@(y@ooSY6}V`;humb~6pzn$^%KWQ_z5m5 zbWwqe#uJSTpG=pe1^WAWgAJna$VtHw z)qX4R;Klc6e3r*&O~;SPcmO2R-W2H0k)WN}TMeFRuNn5X;(HtI;h$@7Pya-FqY)@g zjN!l7djdSu-bg%9OZxg5_U0okX8IxsbgBGSfM?npXV^njZu(wAVoiIK5ojqD+DZDj z2f1ml6!yl#lldKpgMKW(L%#IwL^!SoAWrQ4%$L5}a=b@E!f0<04zX8*%$w;uhx)Tu zjN!l7TLzw)z85O+43B`cH^i{_=LlfhYe(WQWp4*~roA`jdiI7I_PTueEkGf>0Dp0k zzDIre4c%c`e67ax**GM>hkW^c8}_1N4FAR6&wTlvGta9p!wq{^qq3R#%|+qfcL{sL zz%%o^0`{H-kLkPGus7LPpLfC@-w%nC^iA~D=kR>X8GA{4qi{%mfA1^5*J1B1CRjVM zcfnVF4Y0@YDYTb~L+lO1`84y}hm*ffjN!l78w8%2-#74*r5XOTcP$RF$Gn;LO7J3+ z*QGeIHxUZc-qLTPK0`-)f1>?(eVp`_-vZd<`i|nn-rxDk?-|&;8Rwk#uEQbe8{(@k zCvoy|DqSb`2KegBTZ_H=l5N=gs?Xk;%h;Rjvu9O%_Qn|YIE2G2zqep-u$wyXeC!0t zEWeS4y)PQ}%6;|u0_^cUo;b0m2*RVvj zcRU|A81`C_05iWY!5-huiIeoL1u*Tcg*{%Ew3mlN(s#<2-*LDY=ZG=<7kj_-<@Y1l zBailO#3A2Ex?|hWsjrs>8v^O4y*gNC5mtk4GVhsPq-aq*4HQ$4J z3LWk7J+Roj+IM}F;No6z346nQ*T<$6>ODT~O*HJi=PSQmu=ma-?ER~+{9b}RN#9L| zz26{1NVeNA*?bN1K!tXa-*W)WQ&j8wR$^@=o!>7(C;8<$H|?E9moPqRoM(6(B{=BE^LDq6SMo6$ zjUJjD*D)@-x6uDF=g>R*RFUQ6_E#1G6k^+G+b*4O37 z^H)_ZzcD;6>^X(i@1zM69FOtiCQK}F(4ql<8Y?de1SCe<{tq{P#`(@@72gC3n5}^o zo2YmTEe;QplD?RKiwztP>-F6U@4 zw#VJME%ylaz-&Hl?7y15bBC3^tKG`kIyS8~jr%&kpqKoai?4SzYn`~ z#@>q+rtXSzC&ujVZtGH^b2lc04+h`LeH0SEXzJCM7hF!*9Ldv7fge%+v?EwABFygH}uOx6f@k+FEAplw21( z7fXJ!%u3$Vj(r;ozK7jin-8asO>3|Y8#xS|wOh;5I$PV*?DdD!R#@KddS?D6-kCEH zJ0Q2V_Zypb*h?Ey9=FB>5=wXA?z8h--kVi5=lGl{^Y+cln!ja!(w*FMF)-cRiP+pX zZ{?i)6z-PS*t4%K(3{&<*fJrI9K)`GXP3JB3i62ydm?k!P3~cjSqgSqV_;7!_qLak z`gk=MALU|a!RM^c!_RFFoY@zfg5BX+&&5h^vlr{Pxx+Bd_AaZ;*-bQ&m({XwR@R&? zbCTx0H;wz`U3`TsIEo!iH|B4AWM*!&r2Mp7x4K(Uhl9bT@dMcP@O*V(f67my`CEm@ z9Ud>o-DY)c%HL|Iwk4VSK<2hzc?+eDW@&1 z>5H$X?Qi=r_728Ao~aBY<%jiD zc|~(~c;UL&OZx17l~!UJb6X`p*we6fQUK{o-QV(RH2+9p@UUfHNKMK;95`ohyI{qm z*yHL~e&YposfZC)>eT zFc&*acLa0$?BJkaZttk_-Q{TMu?K7J0p4Yjj--YBcLkQ$x;bc1x2A=@SF)#NwtHnc zJ{7ZLRfkYlT6bFo$Ks)FfiWdFp%uXu=e8>3DZ3%#ZsTdqdl0or74OCN55j)ZxYH$_ zNIIExD(SVP<7uIBBYD4i*S%H(XOr%%s>pqm={jZXgAIK}Z$;IK+*7Dc#}F=b$_wM} zP)vIdBb=0a;OshB>wc6wel87_yF09_J+ODqP5MS{sI2AfmebB2*gGq@M`_cTj?`h! z-q(S1*!g<&%c|Bk#snJTNA^u?{UOd=awPL|B>;~FJpR5EQY6=oGS=gC+ z!Lg)@_@d{yn<#c9{XXg$_SJ0(a%bbS>%K`%&awEJW^2qQ>_t2AD(s@lbIQGah4=id zoH^U)q|UoAZAsaQvXbe~PtPgeUYC{dy-;-^(3ONMjJO3mF!TSf^?&Xded*mr z!?R*G* zvL0dtmGaj^kz9F$!T*g8S?A5Gtl~L@VCMfudkf=$RF(H zf1t%VMo+@;D((MQkY6@r@<$u|UGV<}{P`}K>8Jm*hCgLJR1A!Pj{he<|L^$Za<_aH z|7o9pt0BLE_-}yBAdLS}$Zr5&t>rC{e-AuT%c)2Y%UtBd^Eb#>UPGMp-hr^nDY;lg zyx~s_uj7_jrMw=ln^Ay%7A|qybZ&=fDc;8L#(T=g2;L*ZSmQpM0lIAMJ20?MJo$YmS__mm}@pWMqKyXr`+q4zvi=-;fwG4J~`s!zw3*Sb4SH7zCYChZkkBnAZJ~8)BhPCpY5JF zhX2&(pW!>d-}1$;hqO8-7=FJm{ri0U`+fEY_+-vC5l4HBUeN~IBfj_i&(<4{kOk{A2?#s&jOZpo7raBRKO7nrvcc$om%yMK=cnnj`VZX z)>{0tb)!WroQHsAozm?F?g9?!ioOq6>=R4a7lCE%=mX?v`^3UI1}yg9CFkq-fg={q z?||`2$Z? z93yA0;t&gm?X_^&HrwA&9Ae?TN6t{C=lw_0Oe~xv)OATS=fT;mXmG^B;XF8r%UNe& znBshad|d~Kh0pd+Y?3M04zX~UZCTfv{S?6?4Lq6{-@xd2P1$!k(7|G798?+XD8Lbm zegbf&))R~VX5b7)0!J+RTYxjQo>=td!1i7Efg=_@RiRPTTGk>Q8TfWZw+M%D76WH$ zJ+bJQ0%v662aZ_uD}Xb#o>=q`0!tc*Mc)b>xduOQTX0A@6AR~Y>hb-Tj#%_h0f*Ru zgyVHBVTpx<&p%cMf8h8}^jW}}T2Cx`=Nv7B0*+YpEN5BE`W6GT-OC8$2hMB*%OGcl zsa5MQi5*_Lvd$Z^=vlU6pXDj|KJpjg2aZ_y8-Rtg$-rz6Gp@rA9I^0s0B34FvFLXJ zOL~Y!|17ZBf5E^f$gji?9I^1<1Q!0=27VvduEGx-vG7xH{n~LyZ4rx}?Pr811diX& zY!-~h!kGkpMz+!ui+(b2rq&aSz7$yUNG$q0fF;d$8JJT|BBPc42dK|ccpdeu6mZSN z*DJgMIO7Hni~UW|XKFpM=r;pPdWc2e1uW^=W8i(jdHC)~$7h<1h=(QY3(#k3J+bK7 zr=O(Bec*^r!ykb2#wZT^{2BaUPX{b~KC5PGJ+bHq084s^ zMeoc_*7n2DOWJNGe~B_rEc~d!DFe>K_cJ;^W5}A`#KNBqENglbi=Ok2B|XHVUkWT~ zVBb`5EBSY;xQK=SkimI`I9G8V1J2X+Bo!*@M-fX{G9%;ptHy@d%RDTc45;koN>40$ zR#W>Pr6(4BKJ_b=s3$07wv&vwklcX>Ku;miWIYpBKAzc@sn1uW}uKV4GiB;fO{56tLKQ5m?ed zESz3)bUKe29Ae>|G&pY%e+fTuf50I&iG|O0Eb?VC)K~)HTxDEG*BG2}z;>ZQF<@t6A>`Tw2TXr|52;R-PJoRQgu6>oc$_7lA zt6Hrl!Cf?A&Kbb&PAqVOa$3TFX67$j$aux@fGf>hdYVmv!`kNC#GMlOGy~+X}yL%=WxEe)(*|O><7+svcR#Rck0)@j7{he44!FkFYN6Fi8hDeko27eHtj8iy*e=hKY_37 zFj4%cn{^GIIraJF>oBqRApq^^F1^L^(&oE&`tjf+0{@T0K{s^3rN={l1QL1TR)c3c z@#C;UBuDpNEsH$eZFA_tn}iIR;~{yy(Xm|Ugx8LINZzS`3HD~8;?aKw4(2z6gKhb@ zFgdYW4~YD%@sI^KkJFUT9uIjlDkkGo*ZNr0tAKT>5nfeCmKT6?m>Z0_2z2jeI4=wF%3x4!;+AqIxs-?LozG$1Zf9`gxrM;o%eKqjPyzQh82vNqbGCQ_YZ8b7W6fi#gUKuS6^G+ znZ77}06h8okj<&iPxs^E%$L#~oFJk#*6a zqswu1-Ht9fHW1I{!8G!}i!%GoT6}W?H)m_swoZ)Xi=U|oB;T+xse1=UP9l#OEn=rm zcWepYv+j+)RMy90#9wqkpsTb0qTgctBjT9r#owmVgwajOiE-~=KQGYz-NN<1kIGoU zLC#1&iEn4DyDfe`7U=BX1*_dC!<{(x;CQ=jwwsHY7mZ|mZ+cbv@$xA%_RZjUwu)|zj*^+R4MJ2{?U^;aDvQ;(Vf^qqnMi?Huw4tH4e)5es-i`UutEF!G~ih3=x`Ss|bocZYU)) z1Rt@7uysB%i?GpH$_6jAf}ENA+c`eZ%> zn*Qf}a+Xg%<&*i`DB<;^v(qL8aJNly{mAgksXqTSXPg9?d_Ls2;C@DUwsHE=nG~nZ z`%4F@ANrs1$zy!-W}p0_PtJlY-$R)f`Oe43U-@n~i+bMp;pXBHya{qw-`y{#8G zq&s4-6A#7@+?zP$8`uS48~15CVzI-Ufb6|G0NB39p;*Mi;X9oWZ^Uq;$+_0U!ikV$ zD?Q)o$X=UMh}p@2D*?{a>13Uibh2M*>+ci9VsimGtORgN$GI&JJX$^NhF zh;?7L9azE=OW3Wzl7=pFbiRm%vzHuOrQvzt4E+s;SU7yYld1K@qVEH?bsvCO^v8fD z-jl$x7wqc>K4aiF4E#2*9aiZf7Mol(Nw0Lp9C-p%En=oGOY&*k-4Uxu--@|J#aqN1O(Yy|Hc?xU&^i?fo9@2UUN z&+$eeKD0}YoF~dlKm6$)6xKNKt#zO$<-4=t$LV5Kh5H%5Y(w?s>M+lv{b2nTCy>nt zajN#X+_TlvOYqociW3-zf;OYtgKJE`1y6QenI8J_5-UKYj92=~e6FIOIQsEmIQ}1p zgO1-97Axrd3a=LuvACzfGoAR^P$C_*;z!<85%6Dl$H_D14zc{`m>xReS+5t6Y95X_CgoP2{Nzya3gUtp`35vcm7!6)L-aNf$-P-bB;`sTxwducDw^muq z>CJEMOo=7sxIMX?mYpq(cZ)Gv-Q>1>Zf?8Tjxo!4<+XJ)vIQJ`i0A`5w*unGt;GgBQ3iSJ} zWXX}kT|a?+`hLHQ+QI%ouV25@2%BTf%Bd=gA#X!V8e@{Tq4&1_)6Rd~^ACsr{^+lc z|MJA&*@3{Og0}qj?zUjHof>PzY=pqR9di$+rFk_rj%&`wfd4?(y|J0wLPblhba$47 zdTJRSlT_|+X^)1|I#VwEX-i60tM}~0*=|`ah^^t1Sv7M`&zU*zr}OgXKR$mb(wB3P z7H@Y;McJgT%*_{bpS8{I9}6%wiGCjcqVnoD+Ia>-d9|43g?UU}h3j*R{My6b?6IyE zJjGgRQf{hN<~CPi?0xY3$_{n*13ehk-!J<xkPX_2~9MZeRA*Kg2mrPqS0cTD#qR zb+2bG?3N#V`T?F+pTlz~!eS<0)>J!~Vw}wuBSfHU*}d60Lx*LLZXA}K_3*Il@O5@} z{`jHUk)om5xwj9^9$PsyJLle^`R%!FOOtZ@FfS|>+grKkgHOaPu|TY`Y}EAQEl)Qe ziN!bXwl+lLq3XbE(albcl(W~pktsYDHS4b`U1~-AX>`%Bv?;e}Xz~q# zp-ngRgep*bg)5mBW8qfq5EMK|)!NDQPq~##sym zp3lx7TACecEX~e+xHNn0b-K5c;mT>*`S(tR|5W%-%^v&2)a;xe zPJOX$Qrpw*-OXvYXJ-XU3Og_(GyKHVmRPV%N;r38;OvH3566bO8qOU(GRIDBEa^-w zD)FAY)fIzMn1)iAhEkY@QkaHPC`Bohq7+I|3Z*E8smVx1Q>18Wa$aC+Q(jLAuClUq zYd1vOoH;Jfl-j{S$qBb*ROeIaj5iI=nWvW5kjLhkUa)olz+GqoXk|gGn-iy%QX$3- zxG2P+U2OAaG>r+A94aqtttj#sDh0{#IW{ZMff6cFw#Bllg?4L7N}@h@lXLyFreMC5 znImd*A5*$2H+|iT4d%r;%00As&LwOdOdiu%vVY>DK>p#}jc#f%vyZXO$6U+f-YiL{ zytbCxt;M=zgwNE}Y-PUBJ^JRO3$`Y=2Cd$bf~hZVKec`5_QH*O@Mb90+FYI(zbca~ z%*w^=o|ND*%%p7&bS=R#A4g$JMNxcK7ut>wK4p3R#h(Q~*<2n>y_AjlTkU~YIce&D z(OKUdMGU={3Z->&ydE6Hi``XS0PHAY#tvCe!G_oVpdUs}nr5f)|^CUbsTax4cp zn#?}d%b(LuWde_uXF4gKi4^l5?Dc$jzbbNisX4uznJDGa-O5mft3e271s{IF~(ZdS{i8mXi6YpU3zw!qaC0;Iho9uZl=8|uFZxe zyr}pe{B|)%KeOQR1J5D<{^>yi*Cktta?sie{uI|g==1OAlhb^1f1f`83D!+2^L`|8{r% zK~`1w{qi##2F>ex6v-~)0?WGME+X9`wL})&U2#JQaV)WlB1%x0Mb}7ntR=0YL?oKg zX5(08Qp2EQ7$-v~)^SWG0|tq;9mYC43}q;7nbdI@OB~8*;@GC2&-s2o_nvor%Pz+L z)9=o`@ALhh&;6e7Ip^+u_uX^OJ*M|0`tn3yk?89ZeNUuchTn}8{$|9Po5a(QJ>=>3 zoAdl6{rnK0o`>?yQH-~P4uhD!S*oWGBs!lFniwBHGIIUP@W=8gKKgHr(z~Hw6Qx(T z*9A$u(?fhMa-W&*kJ(@~eN~jc8UC5K@~`$kGx+1PLle`NNyV%z##^+H>F*`!rxX3% zNWUA$^U-MS{AUIK#rZHR+W5H;!ysMJpJNq4cc!qbUt=v`&|c}&olX$n)*!W zg{1nNBzE~qkx&O|<$2_+ro=e<6KN#Pj z>rMD9NKDjO*XuCiy?@>AdEaaXouCX)oNj1-UjHKP&6;`j`VhWn4ejCiOL#`2VNm ze4Lr^IVVTL_AX4m)Eph+ye|P*{a&m)%|{^? zhh0*#6U*Kl*@30F&XMJYXold zKB`vW%I(-eh?Os!ro_Q5kV)7yKAl(`UduENomh6puRf~T5r~z;UGnm610@Yhw-sg}k|9gN{Z^ZKRGC57yL0-jH zniXJJcUnIG5hn2uk>fER2bND_aZZrqK0gAk=ZOX(76)JQS%ce&Wv>I)9G5b1eM>kr zBNm6_IvU(gEIY5=YDZ$(TY%dwKcIg1Hc;l{|xb^*g*eVYM z7_c}G!qoZ&vxhqDFg%El3KJp3;vWOnoEZMks=bKCIZe)D>>#80|K;sPEDnFimiT1_ znM#gd!->UdCTEdx+R1T0#NsR@$NhxyB0Rw%E6LwlVDWDz-+lIz^DW~Li*p}2i_QKW za;_|}I8Tz(Y4+zL4zV~tBFAIa*Y`fL zIK8y{_dc=gn}BufcgWdhF%ygPM8w%i&cntb7KiUuscbhpvFvXFEB?31@nea_`8Dlc zc4FB_k1dWZ0juo9;!GjO%iajAbE7H3{QV*O6ogn>W^p#*L+3NGe9j?fxp8}255wX|kgBewcKAu=ou>#D)+alN&`UcZv; z>URLNLT_+8vHZ*jt~`Prgjn{WMu*wpFfKyFL16uBde^VTYCHM3t&M%_R~zM)^>?iK z`k!%Gu{&-p)*96KF3d7BnpP1E%d{vpA1J?C8EJkL=Em8uxT>WAtAkpP*VbXdF;Y2* zuJ#1L>O*V^veg(I=Y#GPNi;kSlhnAf(Cr(sW)Nl;Vr4pHf>CgJ*#nmY*V4res~MK_ zNG2&3G1|(2U)zW}A6bEhSsBng=R^27eesNA3(<;r+u!OMcW1_PtYQ$R26AhD8SvjxG>dnVb<_Xp3GFR9fz6c~m4sNxT{A7vhH5rF# z>lwwo;w%aOkv5or_y9=GPk=m>GYs#Ef!5vjiQN%xAHRi zJ1rtuT_rW=oz_~uuX;f&a}rkP8__?k{(Zu-dm}o+FU2E2Kv`fOELV%%w7%c2rXxO| zhhO@xy6SitvGw|fEl|}g*NtnrAY9d{%^9gU(`u~0Hj>$-`GR4^98wh8R+WQSTi|PM zBfqCdD)aID9Jg}0bk5AOzlKeMpCmzkgFW$hQ-_={`gM>}9`8LQxb+UgC6vbkb(os{ zdXmkVn+KioFpc*+A0Wfn-*vEcVw1?>Hqrcz7CVwbKmA_v2>-S^$A%Dy>_O}%N?tzW|DxSvjel@AT<2aCZ ziTquY)ZbqCn*tL3q3C&huO;W-$szph1uu^8aO97V=vCgo!SO5$%T3`sJoXz5d&Tz@ z?6JT1;E(fn7~kiy$=~1MfY{&9pw}wz9@t}lQ&Cuzmyh-3@BYLef6vcm1};#8u#Z0W z*A8cV#=`i{$0mPQCjL&Np3XHFVK0AIB>vt*Ar;>Rk-yiI_T_I`|M^|z@8?PT)}eoc z*AB)vJ@WUx#NTH4YphXTyuiMyyu09Um6vyB)2OsCl-&TB=(I4}nG~?p9(qPy# zjoVu6`00;|v(4bG4Gi0f_X9X4mi!wpwvj09R{*HOJ|&TNl@xr6SC4v$=fv>)m!f#Z zy8`7<*_qygf66!O%+K}ES>6)1OWNaEFpa~mr!#+k`+~+G!_SF%5*ISY(~gZ#4yHnz z*@$kIM&!I-6f8(z4znJk_^Ur(s9X$5d(L+a$96omF_~6@bop|%)!B@7w z^zgg~=R7)l`?xNQKIqUGPK+LZcueyf*_Jnce9oiU$=A2loybRkV`OT_xa|JDv=uYi zZDi^;%vs3B6kIZ!!^mB-ixINsgX~howvpSH;oqBU)NHGJw!7NX5sn=G_AaE<_Lb&* zWPogrwEgZ_u5~o(i$fkcp~%UiIM6j_)&z`VeRgq?Vk5}AyT&y4WPdPj>*C$j^%6#m zGlx;#sz;Xp$iT6Iw+D`gScc3$ss$eNz^v^!j?ot*o)2_w%8D8s_3w<2yuQrGJ7+5~ z-nr+YgZa2+<81BPdbQ#)%i~>-7nXhWv8QgZZh79qqxS8_Xy2XKj$u2F?d=D9^3>+7 zuXN1re5!N8)$jl5y6X>J-+jYNH#Dz$V%7K?-~ZCp7!!P;YeUr1>$(qh@4V{dfgg|C zIO?6O=b`0!baoER4`Zr#ABbDD`RRAESU2W7VLnsQ8my<6x{eI&9$+hN*jmh5;V5{t zI7Y$8 zzP@+(jZ)1YpXi@S^twc!kmwT={oIfrpTnD+oBfX?hCK?S1grBeCHzu&KMuLLMX13q z2R{2NO-$#U*jQ&DW~?tr(%F9&r?U@D`d!GJ_Y%sV^*1r`w<6**y(7^(6TLCfPbYd` zq*vF^q)^@^3J)We9zcG)Hztqu$=_~#cF$W3>WiQklIrIr>7UPkN0o69$6E4UnZo;l zGR~JdL9-q2MULgM+Pw*X3s87i8F!4hr3qsCXR?*JVWPBRD`Qmf>p`;}{e9o-mi1jm zt-qSrwfW!X$6NZu?5-sJfT#2Rxs00mqa;3!m9z9x*5${41YQ|`OQQN>JWpbiQ2);) zzh5N&Tax3aCH()8GkntDibTKE| zKj-Pofy+4G#wGcYt}%tUUCk;jwAk-S^&#;$ne4=}&!(L}3?Rg^GhgwEWpAS0$K?>q z&JZh?UscTOu{aBW8{AGTdk3&$AeQ}%dHIjp zkQX1AKt7h2+eeZY|EDVRgPW=`j`XSb&-3|A*ORk9viVZ?~~(Y#058Nn*swQjCI5F z2uc}t`6t$~Q-S559Avo#o_ZWaX4BIf&J9G;FZ~@*lmsCeBy5FGmgUWX2~lfZ<7&pN2{DsPwVjg(8!Se z&_lhLIP&#r^&xu^KgB-ekG;+qXW7O(`@e=>!@QeUl@s+-dLU=tWjwSmb=r=go7Z#K z5og)W>qi%Twu&iq%??}cv;$X1N6n2P0qoaR%B^d9d+)q8?&h@@57+MI&EE|Cf6$k^ zW^8p|?z^}_{vm7K#$9TD^R718cK_#xg0 z;4z#I8X+qtSYL+vipX z?=X(~9?smdhDF<&XD(vA-1vY6sHkZxS~7`yK%O z&BI1{5&F#m*^X)4Zu3u`Ba}(wYWEpk&%R!O9^@v+#r+qK{J?3TOJr!X19sj>`x~A^{ literal 119856 zcmeFa4R}@6nJ>O}k`t2<^uPhd#M+oZ#CQ@RLHww-0dpb=ky0d75edmjfY6Y{d>}Zj zlaQR0gy2vER?&7+2B@UgaX_hcI^KjvZptuRhD)h+94|Q5+K%mY9CftQkNf-Wwcowh z*#xwG=Kp`5`~3g!lfBRHeb>9*^{$V-_D9~m_Eoo3w?x<8ns!}QJk2s#jm>>lR?)1R z9Ffl-2ER?JeWfxwXA!U0t*dm1(Oww^j5A zxUdd;uCcW$TG!H6)wZd5oHFQodu#O?Us8SJ>ZYm-+qPBCW7$qSkLlL7miopuRc%dn zoz7|ewkmW}U1Mu~Q)7G&-rrK+RySTAop8=j&|=q^ub^m414p3m7_vKzNpXjfD~&r2 zU8!v*-dCDn8~CMdUYS*mP0^-i?@)BiwT)Y}neYDkwzX`ds%Xsx%%3OeT=DpB>UrWk zb%?I5i+-uQsF$K&`JHc zQRt{$u-kp6a1l_~(pcSAzd@e_&r@Z`w{gzt@fG~I7DwslX>p{m#jo?>_8+x}j*UjaH@o zd8DG$vMk)rXtLD5E00rZY`U`fId<|)brrZ!@^F4<}105uQpjDg}nvcd3}M%f!NoP^XDB(3 z9SWTJD7t-*N}SP$a?6MFPUJn7a6I8yN^n*ROF24DDV=9}ORT~5?E^`Bf3(C+&yBsi zxMu0erStDTaCi3dhnHVfy}2VHvNyt#Czst2P%0D%s2QcE#qp$eUB;}D@zTbZ{_#1i zv({ij2E!{I*AaEbx56PHQlwxWBk4u)lcyhWu@g z<-oqbS-GM64096$+##c=$(`2~M1m zn%6bGH{TjjcZe)IW}V5&O3mvW-m^c8duZB5+!QhL|kz{JFT3$M-_D>!N$ zzIp51-cX?1ZH-@W7T9Q=4F!@?#Zz#x308v=eyH0zTNn|}8p-Pu95bXty-Q+IHNnjl z4enQqVyBJSNFV=!C;dl#!aeUU_!Yq534I06Q(!+~?!&Ft5?y$3K(lIA6h@>o-eQbX%(dT}<6`JBP; zt6A!?(#OiYv22Yb4Pzd$$5MPR?T!SCbFyx-aID6^COB3#Xx2&f8WO)Sb+Lf223L`_i);|#K*o7H24M)iQ((>4G*PeY8 zW-YY>u!Zy|&-Hcr*vca{qlbD6dx!cG4llOnBe#ukE(vW7Jev3T@>qQ7^A{dim|a01 zCYMK5no8W8rt)?zi=B+?+q|vTS*Ao)#0o4#|4#^PDen(N1_H&&UKx4a%$IGB2|HI# zR)2C}LUw;N7_rbA3$4Kbwv}70!J%%iuX490&gf0>A9IP*Q$jVhU?07YX7BVy zPImdjn>=u4cqEhld%A(ULMa&ZKk7Ne@t zvT!EH*)Nf$d1tyevM+_g7V@hqO0o0gQgw+wh6t{2Lay7u*^%Sbqx(0*5~7foln^cppk{7e4VqZa8}{QitsIFe$q(MVVYZM3>ee`u) zQ3@rgfBVB<3S<8!s(3!2-h=*HS4Z=WKEBPz*ZBBTKK?Zyf858v>*M$M_=nt!XYJ3J zFCG6da7d@WZs@=2)Sv%cuvDg9zZZ@4|A};_N%~RnQw)9t{FMg(JouRg|JUFP4W8|{ zGywvev_HQz%47O(4E{|AS3o~OU1a-L;LE?r$KUAVR~YZ@g>% zv`_y{AOE(GpXT(5Qab-TMtXdGF7egp5}*HiJj{3VYu;-g&3o-X$(KK5+h6A9*Swcs z^BaBXt9^XGkKbqT@%7Q;Z?T)M`MEy+d4qq+X{!hA{=3Zf7yr<6Nax=ytTVocef+48 zKk4JW{?hhd_N8aI{iV~r{?dH1Fa1L!e|-J5|0~>d&3nh2=JR~%-tnT-XZh00ef)2I zy!~*(mg)Rgy8ddu#^9fK=9XKapP(-HjhD;q_V>!aT*chEgau^!_$z$;l}a9?Tnz2W zcrr4@EnBG|WRE-iT-cqg0&0t4pXr9Wt-sct3w8cAj{ZZo{Zw_($iV!Eu?gAseEDzl z@n=LCztq3U=TDB0FZJ;cI{A4HnvDCZCmo(YwD&b%dH?R?zvAN`@YzrC*^{|bmv@P3 z_tk%*FMp=belqNZ8nsd4BF8@Mg_AUsg`ZHfhef9VqA)J6NIa%P_u0_KqO+Lt7A+?h z`CY(a76_`r7IZ4M8aO|dQl%QO38smBN9W7HL7wnITd;|JVzIv+I6MJ6(4*Lb7uir9 z!jI?^i~fti;fY#jjM&jX1}r|D1`f4q9b(D*0dO#=|_kQ5~Y1-x^z`;v2eiAs;?qSLM zEOjo|@*gm7hQ?#m&-Ae9pQOGsCSM~?*E(-8uhXZ$p_~&f=wck_GR}#`&ZWTNE40pZ z>TK|^=!B{BDJ`D^EH-bU{{31`EczwX|Fo7@0E<71frD3S`Eo|AtkiV0t<<+hzo9u_-U5QQGla$=E(DgQGqCl>iFz+nnN#n?iQ zO=8jEHB2}kI}pzcVV+Dt_IY8J#w+k6d5I-2&k^C-TBp&_Ar>8WPw+ae!+qFE;3+LM zN6U#tpUn}TtL01%eZ|9~GoLy)X!!!_I465z(Xs2|=&&wwyby~{4Y1f@T|$439f(+T zSeNjPl;W`hwonI=#-j6O@N!-z7I`;t_$KT?eb|CG+fY4(AF)F$`j1fOGg@a5KXM)? z7M&-7^KZcpbPQX*Q^!*Veib;>i5-Yo^1cBacJlrbIRCTQf!@O={t%0P3g)rUW@;!! zEOMR)!%kkF@4~lgoeb(bV~kkzvw_7=YKDuo{`tnh6-bujh*<1Q2M)9ILF^LIAr_rt z;P7qOf!KHXB{sC5J%~Q1Leb}V3zlk~0{nz;*O_B7KWc(0|{nNnVW!QmU!6rJyqVooD_>0(qevK{610D1Mw(xQrs^8#8 z@)AqlB#vQ3%#zZLF-$Bv9OuEiwGOZ4q+T3L(l6$?%7r|9uhuUhUZrs%e#8f2v40D2 zxLWJ1qmFZ}LM%ED00*nI&O`VKJ9rnc_&_ZByQ#AhJJ9pkM2A>(hJi)rICWy!frv%N zZvUt)R&V1c)Z<~%;k*%cbUp+Qa?pW(k1gNvGY#z~*Ez(Jm(OK_b+)>?0$A)!r`)kQ z%fPn)%XI~@*eL;)yo;!_LE9u2ofW`APVgXJ$BOaWpqV$p9gbT$G@`+pfYzeej{ ziXUlPV#&+#5U$rcYJJ`Ms1ZTf{3VIrEoiB0s4i$jcu7Hg)UX``+|*KKhWegY*@+we zV|2|JHjZSS_O2+7zGBuSdvId_Ffu?Y!>lNVvN7h=5Us zl8&IZLzo!{-O_3YH8O?=T70NqP~C=z)SC9Ty4LaYF~$|~Q&B{#oD)Q91ZJ9<<6GT` zGewWBZ#Fgk?%CdrufTXi#(yC?wymn6&I^xqoA3O=*iIx{L1Pm_Zf;*xnUAQ)=$G6k zZmO@f+usR$D&Rjxs;X;i5!vU(QM<*oReM6@&~5vGFPc$0+6itxZ;w>lvCrcsOI__~ z;<)f-lxhoCw=}IkPhj&op?y^xLUFN-af}m_1lXT%Pr{YPuJ=8m(?E9XHdk0Ec*!ajx>}>=#?JYsV6v%|cUMmEq zy%U!!H65}nY<%=3_C5`4+FOkTp5uhXUIqlFz4u`64D_-f=c6&P$F?%<^`UXc^N*Lb zroB^{o_~BiBKH0f4w&}7346{ZA+)^yI0ik_-iNTa6zN&m_-IY+-34Q&y^AqmpF+Bj z)b~y(nf5Ah(LW5OENmD$uDvXuy%%7QG9j^->9d#qDLi|GEDMT!{3ZVVH^}hkj+a+3 zm>#6SA+h%YWTt<6aAHqFVixo+!zT6)KxW#z3xkQ*bwXnAy8x!WC$qf%Kv%o=e&&p4 zUMG@v`0TMPZa;B;c}$Q_K(AIqdoOxLj(?IgCryz4r50E%|Io_ZWZLZZiKNr@GI zXo9?hX`HV}S@vH0M)++Qle&}tGVC>{==AmA*%m=;oYjp`(T|N4ExdltO*&BZ<6}ji zTCU5}bLC8R6IxE<+!zIsGVfr|-r`LgqKi+cuF`-Scr!UAbWv7Hbo-l#DV?fF(ah7fSnw(}%YoPM;S->=h$i60eD$f3N3Q>4J`;m^rN?6_!L3{QEPUP)M2?kS6y0J4lx|1zson^F| zv?Jprt-;MpTOvb<<_xARRbEaDm$G`FfV|qdOrLn`UIIb#`;*CPc=@ z)aHnefkiah2`^UX>F(e>^kCvg?a|t zmTKh;u{4wvjH#Tb7|T^+@hBTV*Sc_^<=z%eoWyZnHf56EW)?D$Xr= zq$IiQ-Med+pIkowo&)z}uXuPx!oBa_QH{PcW9kaKhkE@p+P$|&JKj{)w{u3b%D%=Z zv_SF;)?jZ*pezu`8QhO+DkJ7|JslBgu0ShxyWml;O^joa`j^(Xx9h@BU(5z;Ew8+uq{guF?1Z z5KGQ|WFRT|cO|s8!lPd8gw)9|ta~oUPI6n=t$Glmjd`!-C zJkK5IPAm)HG;iqZ^O+sp%^5Io0Auk2(SYWdTQXYEn|@p8$gk`;br<#>h|P5) zFs+g2D)$8rCOwC!NQo#sP?l}SY;Gxj%zkSj5cyU_#ysA}=p9IosB#?hW|aO=w=qfw z5i5>aekx<_akhI2aleT(%CNTv+xcd|Mr$x9YmU{4(eC+*^L_86da&Bt)L~5B29v zw}LZq-Jya5shz6RZIjoxMLW{K-+0&1W;NqrC3!vj6ZDwG;n zdjl}8FVwQ`*SDpVSZ7s*b;cTus-;%v$lRXQv0uCMD5IC7&Cgi}w|%#G=!viqv1^S` zFV}0M!LHoSAZ5#4S>86C|L?4n1=dLCLTh1k)dSXo1}7h@HM6K?t|Hq(T;^y zQEZbHn=lX<4&)$SI~1Gp;Xokx8+d|u5#C8;Y7WkpDGLGC-<|i% zCyqa!(=h>ey{pkXQcoE*+MAu2-$yM~ad6un)Ja;)-%gS@8cb3}sXv%k9_z{)2_;VN z40WNG60fmBUDu3EPR#3^+?6+Pa^kht-7 z-qEz^2qU;}?Y+705Z{{UP8jZs6}qMNH%c6;v5=$Zen(vlDCd~{yd z)n#sNy;yy-gzK$?z59y~2IkBwh?|jg9Qi!^Etms61>NGQwAa9lfGWB^rrI|QVCG%F z4R6#0lGp0@UhH>XB4{6Mci-1@diSY)Cy$;ue*EOI(??$!d+o^Uqi-Jm<#1u|)4h4y zny2xKPORGVOLyRzp&iy>*Yt_1r4qGK*W*eQZ+-2@vHQ*(;xv^KO8ePPf8}FWjJ~n4@jytp>?%Z%y+W!8;P%_>G=?;7t zE#8NF4wb@KdK_~pjH3_5$}k%i8!gmX!nZXB0=UDo^;Vr%?{erRUem40aW#iG`ik=& zON%YWRi=3_h5G@!=Q_{eTt0|5k9K3*gKb}`y1evjr8!UjNaYOm;##oG%6a;yJWD6! z?B1Wi>+f?tOO5bqETtG4D34dJDJ8rrJ@>q+&$W{yAGKe_GvJ530!S#48TTsV8s0j4 zRZ{jaJ@?%Qo=u26jPqAi?N>6=9If~_=Cl^xN;;?ZXA{aNmlOs1RGw}BYevi1Z@D37 zQSx(`!*Veu^t@4sw+`^`&e3MKcjM2lJhK)?Vz|cPn>;xxi9H`V8R>cn@4KmI!SU+k zB^(tWZx2^6rMxcfJUl59J+lw*I#`j;$db~Bk`r%FR)OTA%f79Cy6vh!`fzmnK4nFC zc4zsYy07Q>?qmCo9vwS=IC0xB^d=T1C7n%jS% zJ9S}uyUg9+!{gF{{&ZZK@LW8wE%4z2j6d@Ttw3+eF=vfnWLfKCuf`0hP5D^9MMfA4{NXJ9l@7guW-4Kil+8(KjC{)7>7I4OD}$-T<_xZ~ygV=$7`z*7oM+rk1w4+FM=W`s#+& zO)cvUQB&L6x|T&)nk?&Pb#1a02waqsBYl za<%y1Y%Svc=B)E7>VMp4HMZm5&@EJCO+>rBv7T-&scUU&Z;95GxhuU;v3Aj&^jEd4 zj^0>UXhX*v)SQM|@4T}j>$Zk^##(6R&bk)7KM5wXzPi2vzn`}kAj`TFkrP<63j!2H zomwZuZSzDq%ZBm#T2@kzH!G_fY$N)g{WDq@H8o}}scUYpt;d2USmq7KPq%m6G zjApi@KW4O+;Q!u!8P(>k!5Vjt4*A;ZC&$slw7aw zTrh7ocZG#>?4RrB@~7xVo4bB?p;}V5IC4kH?78w^F#M}!Jo>-*9n|}9?<>T2Q1LG` zgA&!>;vRXCE73gvFRMxO_%~P_Un?yB;}>raw@_{x!9_kk)h_R(tE2f>eEe%ZevAC` z5Kn#S?=oLH>cr?zvxS6Y=S0jzt+d^Hu(GC9|;d+@ZZAO zw!hC9>GYqmVw$u)zUyG}Pa6E7^H0#-P)NWNp!oKkVB7clNAs&3Ym6jdd5e8~qmTFc zQ|o`zNRKaXqHV9-P1k&>>#ycl`_kX^@ymSrOMU#sKAtfFnza3yKK@-v#`QAmJKvXH z;o}$k__YQfU*Ah?d-A_@r8Iw|Tb}0c^6}pP?{#{EFMXwtf569Y_wgru{23oV&GlcG z=haX1-tnV(Z@gzw&x6lEr;>wM#HlHES~|KoH@^IrWm&zKWUlYIF@ zcK!@WM&t(jZ?2DD;Nv&@_$Pe)9v{EM$3JQC@%=s3E`Pq8u6b|1(Y!bQr~2x1nVtV> zw?8gZdvPx&@hzMW+Q3UZ33)u8wC9Q>lu7TB~Ux)lGg6;PV#%n$>hcNlG;B$eY=Cx6aE=larr;7j+;2io4NzI1Oq>vV6tYCgfRAK!mDcKtkm zHNU~Nule8l_&0t02_NsB|8)K-Zuy#j#Ha7)2aWWfVBqnY9>Tlq{^NM?u3xl0#SmId)JSe?{V8l^Uc~g_L_g#m;RKGf7Req zP<}UZGDcC#FEIS2KgWIcGmP|osK_AF*$2%3ZRj5czQ*D21^=%GPkY|=(>3ZQlz$)6 zrTnjf|1A7tJBmNUhQF(j9s$poRHk1Cp4S)n$D^zNfuVmG>6e3NAB(+3hX3*Xb*_g-Ilues%E{auFsKR}T-V!0|26n2PWkce zm2bC~cRXso#;t$8T88{TH1gBGDQ^2~{YMS`8PNX;^d}qj^~PVmdJpaO3#7|dER`QuO3Ev5akCA`^`rF0odd5YNqcq(#w!O3+ZNid&g70`d{$>Grs)Z z^=!U+8tDs-^!WC?&Th{ZsSd6rSU>N2RrAYz>E8UV(+7?8`KYf)v(;Bn{yiu^2||vi z3h-6nsYX5%d@XnsYxBQE!j}yG``}v)ehc_b2H%T}9pKZP{PE=%s(5~mkDsf4@3eIz z@^g(3j(s8a3FDnf+1R+o$4`Cf^p&L3FS32n65XeA?s^ybCgZ3m;)R|=wEt@-KSks> z`t1K16C7gtV{Awe?`bCED6e5dI>dC26Cv`)o${_gIg@e!ChITpo^3LY@*TeNe(d=3 zl${<@jL#OLz27?JQ%1g&0Mv|aGR`XBu{pdCVf%NPdd%VZL;VH5`oH1h%Y6R)y_5f4 z{7%O8=l^#2*KIyiA-uyS+P}xi&vWu*^(j^Dq|)ul>eK3rPI;QoQkOXOS!(-xm0IWU z!#1CzQhoLxbn-8@?affRzV>;+$cq8$eLommJV44d#Cj?@# zW6M*tx2AkLbYwk~S;Wo&WVxXV#)guaF{1G5btj!?=E7;=O=+BFR|o(hB_haK+j{7yeEM3c_9UQ z8Jl2UUkiQ*SlW|VZ1S2q?Br#$h9>B?A{Lz>buL9F5a$uGIUP9U^aZi#^E@p!dCec> zO$}%PaKtAS;W2%g(S{vdE@B6c8R zvC{)A>v-^7C;CIc!O6C|;xhzUSL9jX5Z*^25sRH4084#&yvjN@qrj5)B(V5EEO}o6 zmNj$E00%R*{kMpD@d0`VSbU>fLB5Oxx&m7`iwOUb!6svdSnSUQ4qt^Gh;yX$FR|z> z0+uy8?gGxw!4AadV}hH3gFMJUU&bb75sRHIz*5!|z>;^+z)OK8FR|oZ0W9lmuq@Fb z7M+dM;RQB`|UyB`R6q~Hw@hY&)UBqJN4eErk1N{=4 zthw=P;2;|t^jmD9OVCjcmb{#L!ZU5L{eF7>ERC;#JUClp9y_wm#!TWuEiVKXo5W(X z7&x4(bxMHq^EECv@FHTTeU=bAnO6XZctC@Q#U>BGARl;uvatm@a6oiDc!Le?=O_6$ zYRu$(KCl4U<0?tpJZD_-Bmi25P4rh7crCE3oAD^IWAhNOtatG|<<6QFZy7o~J;?eM zS-_I_R?0sIMG)_~M81LYVq0wAJBXaeczB+cA2Rfh8<^J-VV*!hJRXC$Y0P`BV2Q>F z2_8-d4n?$_SlXHQ0MZV;pA>8#*SBl^Ec}E*FbvAVCVANxvVH}Jh^#fiCKgOP;f2_N z*r)kC*@AfJhNfzp#A1`fTGpVTYLJrw$UaV;@qEs4`gyIh4nLt(ZIf7Rwg870Yn_eM zxm4>Ai%tiy`1TO6tYz^qaMVu>&>Bxyi&bG=}jvdHsH5IBPe8HiZqn}IVOIkCw5fn^*%@hHf8XvH2u$uo^qiQ`iK*036~=o*-h;KMWkMp;W1(*u*BW=$r)3 zk75UU4V&l?i;g`%IOV<#xs>}ZaJUvb(1+MW&S@*W+7{dEmbi`g1hKJ(B_!S%YWcv=nepaI>2Eu+bXHkQ1_5M?@YVv%$D&S=IC zL@e?Jz?qJmSmc}&GWhTgL@e^fz?qJmSmdjKgRR(sI0VBEW|xQCDAjXLuwCO0{79b? zi=8dNK_2L!er$ptA?CyY`X;vE{WjF|BPSO5Tww8mSmd_?=YIt| z(0pui>=26%uSw+C@n4^a%|(Vjhhy+T>_Drq31)u<{~S9IhlTi0EM>7f#eZUvv*|NB zumcf`oK?;2zz#$#^3A}(PD-7%Hz@$IA2YgaXk*c5KV~{|vrnIaT&#a66^?+!X$r z#>4mtKdkW);sK41;YY5|iN($<)M4SE-(U+qWJA54(oT(UMDbF`TMW!=dy$s{hh|_0 zA{P5g44rJG1^JI9P#(76qc*hHV-G&2aWQ_R-H63b1#tc@>_AJf;gutsIIT zSn_ggOJ0uK;1k$^`mssB6N|px7vG?Uo}Nw+;Saf)f4u4aZW#3cm*4Tdj;P`K!i=Djw zbFt)o5O#uprStX~Wf4nRJkN?g&wb*Lc^-Tk^59=;J1-CqYWyN_zGFWKQRr$2K*VBy z8gO_orTV!+@Y@;};wSv1#`dwv$p%!4E#JXB9tB^}{t$EOd&&IoXw2~$eoEs4`~<(N zF~?!>X^nY~2tK3n9Q^}@qrXwd7 z`J=!x#}bQt5IFd^*n#Z%&B3f{@CUZozQ&eggr+4g=YKgyh(&%FSdI~5ksk#P{vCFp zlh`tt2}CS9r-3saIkCuJ1s4B_Mg9h``2UuHKLF17Z`gr|MgKRznU0)T=TPT z1z7C!x?OMv_4BX;5sQAdp_6OiLg0*HTU`;0KCkC99XYYcIiHI^#3C;N79Tjb2wn;t zcG`9|u;e9{yqr%&zs0~E#7^FB;QSHoC+Cw4b|A={TONWu(~%R4{T;wkF0sg;0G4tG z4Lk&#@09x#aK;aHS;Ug}8Q@GuPAu|gfrF!3|9Rkympm*wKVV)*PAu|K>hmNFA{O}= z^&L5}$d3a{y@*AA8d&P}3UK~^*EY`pXN-AR^xuFy(~%R4{FlIDpIGGY0*n0*3~WCm z`jNKJ|Br^QMIwk;^74OV!Gl`oF5rCUxV{pi;NNR`Hh$zDhgkCF0?R!PvB)|1<{!fj z6vmeE4>q*1=*)sB(~%R4+@6P>`zB(MbMBS0h(%ruENwz8^2NZx_CIqGB`nk2C<0_=ju#HPAu}LfWb|}hoksLEc)zb@r_vI zr+~x%6FbmpY#9`Qh(+fW;7mtOEb`ZZ#W!M+zY8qBePH0<1B-9OqMv}_F1`_qJPkPf zV<>_+S7*>E2a8USc^x^i$fp5|Z^R;>2`s*a4Lk=}d?Ob98-c|)Vv!dEhkv5|nGc-t zvWG>dlzAOFvB(zzi*LjtUkNO})fjjku=qwS`i;Qi8?neY0Ed67{n-ed!A=7ai_VvU zGaWgx$h(2XH)4@<{ukdKH8AIY@r_vY_W+A;#3CO84*!$($392A>S58b&k>H?JV!i_ zyy6?N=yPrt-;NoWb7S~5Z9fY?GB*-S-s!+HUlEIZCUE}$!VbiFGUE)9#-dXIKJyHv z`kGnfh2W(uVv)}Uma>RNek-uli&*4~fP-hT11-TOcsa1NIkD)k1eP`@7Wr!6Fb_}= z=gEwJv7wDcrvai&M@}sAHem6MSmfQn;?EWXZwD6Nh(&(~u=qwS@+W}9Z(s-dCbo>9 z+0e$Kvm2sJM@}sAAz<;1SmZANi*GL)_z1B0MlAYAfyFmsk)H$(zlj~_6t;|?+t9|M z!^1n%krRvj46yh{Eb@1N#kcni{99o0jac**#ah}Zhg@;AwV&-+^ z#3H{GSbQTEc`mT{mSjyfu-GuMgDtW@yEUfKC5kBjGy4YYkaAJ zIX{a$&%m5ZMP3RV=79w&$Cm%T4ekFmhdPmR-wc@Tqw*sR~#P{)n_UgK$$|3PErtR;>`yJfv&d%0&WcU;AHS!=88 zwY?kaTidEy*K(!f`<>;z$5|@bUQ3zFLSw~ht>vymZYRmw(4S-x@N*XQ7XNHZwT)bU zI&R_axODyc?8oTTuc_k7*%vg#+O)J*x3*SSHMh1_VM*`m^(@xEf;ii8ZHu{pcbq?X z{kV#+A6KodYiP!+wp7Q0;G*L$u|4kc-Zk}YSOyv|;#M`bH#D5L47z&GO5m<#H|0Y8 zrkhQjZ@F;SnCp>S16fHNFD%!!)JLnd!yo6Xo87exH_c4$h_Y9sXQDKj6o{3|S!*+s zsJNL$M-n9OxXYejuzk+AEP88WGdiek^@T?LxhtZJKdz&VtyNLH)vT8`Kc6G^3g{oN z#^JyN?wl6my7xGi@#?#MgkQMj+U+;N(ZV02Y&+HZNwxLL_@7vvRpDfGL05T*wYOHU zIlq?eqo*dVAGfr-JrG;#?rX1WjMnL8KL)vLtQLP7L=i^R{lNmhU_a#5j+X1mA*b8d7qxTw%Yvt8tZIXAc&TvX_y*)DRy z9CzXRA{Q09Xts-7FvnfszQ{#|E}HEk7tHY%!gmqg%y*W{pY0+KxC`bNxv0=Zvt8tZ zIqt&xMJ_6I5nlLr$^x*zpy8~&Ur^C{e|=kYZ2^|?Z>Wnul}R6CXtowy&jtGJRsQF= zsK`ZyE}HEjl;m6B-_C#iEZ35YidOuju_dl#;*~J8946>;GZj2tE-T(|FDDeV@JEkY!^N z5_`}3>`f`qab>iJD!TUSkiqnC6lvqxTLnGSKYp`}*GII+<`MsR4`bTntr?%G3Wz}{O(q`g#ZVvpagGwr<$ezzFIFIby)0+{yrjkIB;(B1@WVs8Mzw8w9ZZW+hF zhoEQLdmHv1g&yrqH0+HbziBT4jmzi2LIQsXJ=0z{F0eZsdzTpYrupn$iN?K4jNw=8 zg?#psFd!Eoo&HV2#jh9NNR-FUOtzn42{w8vX>(_S+M)9a84iM=-)%g7n`yLn4>r>t7QnO9Aht>DeZe=bwx35Y6^2cFJD|6e z0*Az267)>}PQgFk+q1q`VH5vqefHkM!81ILy(*u*TRx|cBihR`?D2ag%r5iplQ?)5 zgBKG2TA^q9ch@{`KAiz&@$Xrme;>l$axsQqvG>}F-|g|+)3{A_^du=g1NDVmh-H!Z-B`2SM{z!veq$L-!w^^7vC-}E z>-0n@u^t#|>bhB3ab&U@>;2q0b8NjEXV0FiGkpB_JQ~oz^k)t>zF{yG+@H4M_S1cN zy#?+Xk40ODRJqG_mUNb3&HnV^0M-&_dZ2&Np5ivt&07oE8aY-{@lq(3q4N3%(y->}JL{~jNV*CIu0Uyf;Y~nWD!12L zO$)rUB-ZsOu8^G#8+t|M+{5L=w|3v$d#F3~)yq_8>DSSJKkq)t-}ZUtg^0sBz+^t&28JG%Zj!cSqh1ZNsk{97p$H(jFBZ zPEuV%eOB&c(d`&BgH{>ym%AREzpSG>xGMBecl-*#50@t_AEgP$= zd+W32^|8(qODUE5Vl{KfC|T5Vw8y$#yGf;{F8%1*3p-dfICn?Uggsb2J#daj z-s2cA7$<#p&r2PoobouSF6HubY%JfAyYqabVZ4!(z0>v$V3mL2@~7j}YLnj|k&C`RUHp)A z`Ss@$J>K7tgqQjX@2?+DO*V;LoO0uMzdyXcBZedH+O``iMQ@b*jGa zy={@IOiEPzgl1Etz2@U>5F|s;-q_Z%$(DQ`k~G!SvZlJR{sDXaMO$0}@kI(>FvR1m zwoUkNue16lZe>4TiL?oES*jZ<8|&NbjCU?YYKp=aCEMyg-?F%+X+u4pnb}EoTt{*q zz9U)J+N$(JNmdJt6gftgP^YU~nUtq)U!?dk(E93zRw!Jnnp^AIYnvK3tp_(xt*OIT zK<#Rq#>1+%3C=d&*0jF4sgX-!raqk8JMeC}*1BAk+=f+7TANvm`qf#{hU&&OSy(8u z6-!rU70xQahZ(bGu5D{;ZoT=s>#*46+V&cL#Pqs4$#NaPr970JgTC|>AAgsRf5OM#Z18e?>LPG9 zg8w(W`yoJkATlL^#2lk9(X=CqW(tkczog7p9aIYy?5=u z4EyuIb6%!C*PJLf^f!R70MGLV(<9)Q0prK!rvTgyEdKrr%DWf*Wls7Jz_$U5KA-K~ zZ|FCI|1roS;GDn{u|);gO~Cez<(F~#g6`G!2hk0o(7)b%F^CH zMR`Y!bgpS~9K5veR`9PF>0FQIHSl~!L4WwHO zJ{#aafTcZ|U}5}7efW$o0ABQ;1kdAJ`ll28BtxIiBlt?O*!vAK^0hCq_X7AF@Y24$ z;CVkQ>34zu40vA0(EqE!F9a{`^#SZJ0}rvC9zVV>QSp4x$4^$fkdHJ78(dR|wuD$F z$EgtcnZEQ}P`(h;=_`q2l56l7>UJFt+o|YJBuvJU=FNS&j!8ayTu)1g_J8H$Pdohc zNaLD4uZuE%sbA&rv+VLF*s(#P!t^$uy;~p)-J>;#i!`*4xzGyDlpFE~fWz!8(3i0V zoeQ*X;0z8*5V6?d+{AU1NW>!V2hMOV=7>eU9XQjG6N~&2;2;Mbh_M+V9@HRW(b)$a z=D-6zg)Pj30Q5AreCNXQ1>j&hrAobsP4FnOb8&jYz^8!oc`$=`90r{WLLP&H-ymk= zf_{Td>?EMAWj&l^;CyFrF;d)rL+pbsT?)MdtzPd>T6tkKfQ5 z8^#^W+aU^OY56YvA;Y?aIB-D3qQ4nf^mhP@Z^WX*x`=Na58@lK=-6Y!@$E(GIPFO+ zI!Az|ERF}ULo7OHsN>jqn>vmiV$pezI!+ybYhcbZ!5j!coM-Z9YHZIl4(8k<@=Fa& zO)FXJbLzD6G!7D9tMN2Lo<+TYh|Ri*NZ%ug z{2B1p&9>NHQ_K2{#>14~qVX89BR@gRi&)Uh*rePu#J6GxdJCI{|2vW1!DbZ`>2)Wp zc^dQL!J4lzud%G#H0Jfb#e)FEdjl(?aTal@#ym$@w`sEUe0ksqQ~b6ET-5=cog>( zybqiLJ`o$!(y?97xevc$?-UqkYKGMN-@z=%O?yw^K7-Rg?FF!jy&nLZ_Oei>_bke@ z_dO?1F@8yJz#g9w(jITk#NG+WOnYHC|2#7|B=!A!D4G5hhm;zI4(;)lPVDiyjcJeT zud;4JVs9w~racfP8|aw34SR&#c$vcAS=dOQO&S0H{rym)p3t|TXOg6S1ws_vENRqpPW84(^!^UO z{C_{kGl}&eiQXL4P1=O=w_xuX)P?EGv9Z2EZ1&kK+R{)EEoiD)cU{)U{l9p7ybPt^dtc9y-J|;sA01xw+LBk-FE2>5Mhbd6M-KERoJ=^C za5~{w!tsO?`b(qukLVrzo^8n`{GRPVpyQIS!_Ln;@N_9}&&AdVzRr1x@%`NCC6`1y zQdJ=0{kJ^tWqgsm`>63P@|^5BR?_J49Vycm+h6ka{xfQgc;8gVmrBzDZ{fds?*C2k z-|V!&#wD>s#knPqlq8qEdw0$9YWyE}e&xx^q8@(n_$9SqY&@%ZeV!G50X6Uz|Hpdx z?j@BK3x*ymihaL0Wh|81ZKX^z|F3L~3j z6gid#j~n0m#{bfdI`B)psj4@^|0l1Jq2$qI zQ-W`;_WbPojD*PR3&jF2MAeXD?T|CY)U!rVH>nTW1nKE<=_r%mUH1HD5AHo{4VDzA zlnkM_o7J2Yqp!~f7thDn>-VVzi%&*8|FW00*i!3oVddsZS8lYbJu)6egh%q|#FS~K zMR*Y0iED4f2#lEj-OuYC>P_66>W75MgXlIOdJa=Sav@LS^6 zNY~yn_q)54coxbo;gPY(ZRKdkHI~Qi?zPT%|Ho(Kfj(+3!(_7tGtQ>_l22!!$~{?r zV$ty>$Ce#kKDP1*BN6x&+XKD!mxmKQf9x@d6zlBdvMA>D^kRP9`pie|8$$T5b-`l; z6OuP3@_WDd7IIn-zFLgD#y6MGZZ6>$k{`o&miObU)1jUp*^vlR7wc@Orx$%_wrWao z!f3Ra--d_Pr}ii0Jo){EP+wW1w!JU5#Erz@7kMkKoTpL~tihDxt{G|SVA6Al9+<_i zC&LfZYIY>OxL{|>aCFs9j5qY!;PRc;+4SP*J2NcKG|KIvoTu@{=aKZ{q2B138I~0} zusD0^!%GwHez&Zq{ABt3g$EW!(55S6`s>F0=C{8^-PY{Rj(L$YL%sN3_x=*Kr6dVo zr;ffe-3p-{(VD4y_YdG(;R$2Sj^AecB^4J&hITaLOV;uADRk-+OfltAd^y58+l;R# zn^NnnXtUCF1))sS7FTQ#Hm^FABkqXI2cu}mu zN{qb!hu_iGht^1-BGi5b#<{0e9(yyk-0fYo*PxfS=saJ#=U47y3vWon^OUqSC0}+9 zRNza_DVB8-u`zEV=B3k(dch1<@^B=()QcXo&K4y-UhI_=eP^qBbBD)U6{{aljQr;x z_Vs7ui|W~1_w^&j2fpQXdpbDg&~oQ*8GL!Vx1jgYMMLga>W{ni#JBGI@pa&0d>y!X zhELop%4c&(A z*1>LkC;M^C*J`=ZE;@Cmno@CB#TAPaXO<*%&FoI7SlZj4_jtiDHN7}0(Jfv?bG?mflJcZ%iR?tE@)p_kKpi-(?A zeSz_xPnsXOy=+m|U3dp73t#NCMOZEx6j@Z_6YFn!O0)&Pl{%xA-#@KyZEeRFQTglw z*Lyc-QP#G$zBQ}88E>j;*^F6pYV+~IRK3e0y4l?^LnEF+{81T})NN?`QeABpU%NwG zN)#ov+FyCq!7a{rTH#Gr3pA0;5E1$Vw?EDqJaTA+>GoE<;i+q+{x6O?!8JV2;X>oZ zo$&v{d@iji(f&WN^C%Z0&99VXhkx3~@AL8Ay`Rp1!k50%z3I^DDRM*N*niijzrdG% zqmN(Z;~RWDpFwKUu=5T|D$I5>%uzr%6;j1KEBl8w+%kN{E2pdwYlk<_xeloo;}Sk@aeBJ`1{ZwB>ub6LX^Tv@Whun zJo{@8uqJKKYhTUte?w+E|Mw$&y#JS|O4#Fg;`>xAkM_NHO)gOt;Q4O|K3ib=ZQ%L* zhX2MPe>3<#gJ+z{-+~waXM#Tk9*=@-{ZE7cIWWtV^47Wj={S~G44!c#mw}h^*MR4; zX*{Hu|6TXkg5Vr}vM+s#{d|j>Zy+DzLf$v>2O;OPGa>S>E5PIneEP3C{5O%txDfAH z)cXHy7-0T)ef&3k_P*-l@Av6n?n^)DS3Z zbeZcId&X}+vG0YbKkO^-CSU$uhu;7_ehcb0pZ*WU7=CH*Wgq`Hni7Z3N7=n=u4L!a?j66ZuLI((iiu{BRp$0?Us zbe;v4a!0A-^c}J290QhbN^$;@xFurId7U~T?elxo;eY}Wi_UKion#yvqC+e?{Emox zABb_sg0qS7KL!%#sSqc12TR_$kjwX+ZU)YG^yf1#PcooI%sb7)l6M*NhP0gL2#JYV zMSZ8;h((_15sUs4)X&g9>^AiGQJ$&gPXS9_ zV#)igq4PX-9G{6r=LoR)e1bZwv`u2sc^O!I=KL?m+UvlQm$|~9(s?h%PpI0%VkevO z8Z9Rlc>!?PiN(2*I#I1dEIRWkcWe@iyaG6!g&m03ZSqYf4q357Ec&&SJ9dagzQNEZ z7Wsp~K{^ZS#wK}*Mdu;l@RitsIHk&5N-R3lfF<@NmpXI`L@YXmz@jr3SiXC7vmv+r zck-J4^E@p2wx4wnfJ{I8!Hdo#z;dh+iw~T8MQ0Cia3*%3!`Q@UV$nYeEZ?0v1}xvH z;x&-O;+&z*wb+5)#wK=%#m;-c;XLd>zsD8~+feaZFX+VI*z>dFPa5RnCu4x*+f>tl z=7Ft5Mln^o-E&}wQZMJzVyN|>Dnnu9IqByb!` z9f?Jsr<3sY*n!qz6CGmFX#p0U&D2?g9f(+T`hew|Rrc6(Y(5IP*d!MHL13{t1T5d& z;yE;Y19qST*n+GC=qR@QLL1uO02BOcL(X;x-=uZ24V(uoac0Eg1I-0FkU=Hb!p?

Fn9p?N=J?+Q zd4?0uL@fH>q`o637WuQlp)X+vA{IHXtHbjsRq6;f@t;_9jsu71V+T5oP5dVoo!5Zn z`&(~P$B8c_7Ma#FBRkb)0_W@gkUgn!y_(5V7dz0%tmM zVv+N34XwuxL@aW4d9ajHrP$np%Yid)r&M2yivA+-nU0)T9w zej|1uV$tsd7M+I-%wr*A0d^o_(Py7#I&!mr4?`~g5R3i^V6lJ7z#jl-IPq%4qR+m| zbmYV$Pho#K?MWOyEpMPAu|5V6jgu@?v1ISz_R&z!?j* zePYqS3pmq}6N{YJu^AOw-@K+>O?^jBEc$%L6=sKnHUNun#G>;cu=uvwz&ohlr1KJs zKCgR4f6&0g)OXsJSoFsX9bVr`-j{*pyK%g}&G@`7%e>Zo4f0G!PAoRx0+zCfMg9S> z*#C`zrzJqYS=%QT{aj$t&ol5G;EcsupIG#71kQBi#3H{HSo|RtIq#dr{$c|gv59e^ zX5&RA`qpq1eLLKOtE@4!(TLr1DRaR&w-mR@>>$QC!)$q7!Se<;y3U(xAi6?lH8NEY7wLFz8UEl#7R=B_ zclkoe(%ewpwz{chebobXElpUr@`62Sw~1R%*QvP02VE)uapUU7ExpHXumu-tQdN#}-T3UJqm`}j57{@AtIF2S=C=kbX> zNxYMVHJc0prXHJk2}zu+S^Ij{f%Xrk1e=yY$*;#}i$Vgw0Hq`di=Bjy$tV|sOTn{v zrln&$jSQx}X-MStm5|u`M*!2_G~BzVAS3PZv6t8z1UBs*g1w6&6B2umLtxs=nx^0X zq`ixrH2RkfW2Qa6hq#0Shs55eAT#aV2z$>!Mtgk3CH_?coAxe+^Y1ve_#^f>b({9y zx?I`Mp=fV{lScp6A%kfz86C*$0wJ--HS0`!DR_2p#_?|=l*PX;$V_`#Xbe8P6cWgD zv1#wEE6^Vh(7#KtiMV||0z?5QZ)()LMX z3yWsYopa+Sj4gZ_wPAU4uranU03j2n(EtJBry#CQ>M;hWD1Laai-l?%sYh-)LD{dJ%gC$n>^1{mglA^#6 zVxRI(6(9-`QH|+=jn-h!V3Nw&S8HuKCf=TOb0YSx-}4B*GlKDnC|;_x26xk9#n7&z z*bBvDW1+31sBMsOm1(Dq{9YvE1mux2vscWo%zI*H@O2}~#~N|t9McgMgs8_*zmyj0 zNlKU*H0+)o=pTioE#-7`mv{b%0SQP zl(A!>uO>}xNLlUqdp5iB$zf>+ue@k5pmtXlGTyN#DKOLi_#VfE1^uUrCvJl@b?nuF zp6;}GFS9G(8Xe!-fy&O2Y;EtNczbV`aP^;@J$urh8V&V~rpH^{U75JAJAJI;YuiE_ ze)fmnik#igrbmO1SfQShi8F(-QqO0^n4#{Q9z&!TQj;#88SFJv<9b&2DD}4?2J$(@ zGIJ46Q~p&MRcryaY^82lL|4uXE>=@gys<)!?RRBI?0$Qc@s(qD9f+9uTOx-en>K{f zlaczIN?5kUiMO0w`MRs;93hOd>=_Ns4944s2SLQORak>^q{rfp`}hdsWv?uMdFAPv zQ>#y|JJEQY5ouAJBcJY$b_5io(yYTpv06J4%^Haz4s0Jrb!Z9@6)(m!7JDCjt=^<#X}FEeL4pQ*V7BE zu`21H_$-OH((2WJ;8Ao}VQ=S#;4_^M1m8S|)ZW;Pa@NB3afAP%YdvrvD;CE$WSx#@x59&^gMK*Sjm`17 zO9FZD1$?cIaX7NurX~0~``ch`!};x8`~c=!YDjf(PHlT-ns_o5w47+^bC1vN7Bw%} z!uSDrxSg$ohudFAcW?H%+b_s%aRztnhRO(@(p?Rc<##!G=SXo<|u)xo63 z)15=##SCunoLL>ie0}&kG!~#dyp3ln$;Y05%{_HE}# z*nIxok4neY1^#nG<7wS{{O1mi6G-0Kml^1}9(PIM0RwP+iM0#wW1V~6%)t+q9Ov~q z+}eKWsL+y-*BUsxqo#Q^duPL*vHZz)<7cnqENxl3pK#yAr@!d@VVIp#>SwnG(|Kt= zO%3*??vExPY7dW7^(5a_%U;NDPwz3m zpEy15YY#5yEotU#dd(A>3WLtmxU=qjV32b?{)Pt)a?rm91{YqBhn;XnhVwN3c4ETb z_7?Bx3G^&DuwY%FD`^rvYHM0gx@TV3i?yt+qkG$#2Lh)8lk>aai=SH)sPuVx)2}_R zYEu=xz5jccb6iJBdvRNLyUgwB9w%;#;!3@6_X7>l($&p@K+i0A^wzW<^R*hhh#&YN ze49(Fngg$tJ(d#q*EpWo<%nS#F9rN{+r)!gr`tF1?g@TBdfmco-{kU^%*^({nLrG9 zWGrjmn!AVXJBRbmH(z#^&WeYAsm?HuEoe!7cf-;R;p>Jv_YEyhy>kObatz(?^f!}a z$pgvdTQY~!CcMy#+dETQvL32@8c&;@Z3CU9vx^5Fh{i*>+b=toaPJ)tRR=oCGRwWu zBY~cSWsRr$pV?4m1}$vvY>uUEtO)d0Opk}2chahlRLJp-^tUyh!l;R8UfHHH&H)<4 z%%HvNZ(9HCx^e5C#_`_Sn(D~?ROX$n|FZp`cl}e}KOX(%v6qkk!--#<{9k8&{@UNa z@xohwcc^{hOE$e!F`3aSz|0vmUO)Ix-Mt*8a*{_LQSo+p8UL7xFPt1s$p~V$+0YZ1gEV7+cMjqm_JUUeQ%h#<8}vjJ z_n0T@+rxix74}ZL(>OISxigqOk~}g!D?Yu;iO+?nJ!&HL>~0p6Tu>Eg8rc!(?y#Sz13it{HyE)n zq%);2!@hIJc!(hw(J%z#A%?K-O(Qdg-W4clea(IT=^Q)MDXse+_gqgn*zUFZ>2NUJ zYUvp*92-^H@>X+U+pZ0))j+iPASdZWa$(ib;M73Z4CuSd&~^DrDh`~Pa%^h6VUSaB z2z_wyzyY^6r{Rr8I9QhahTF@~q8Kk3K+jIb5u#goa#rc;nE^a0<48&#*^CjE>>c6M zcRy+=FWq{``OgiVKOX8F3I@8K4kkIzZ%8gUcuAnQsQ^7>Sa4G5u)lLwKNuc2%&AP} z-9d^|`o{C_m>+MygeoxZF>#-qu4y^eTvF*h=QWK=xddY}Fn*%>66Vr0GUZYp5fg(i zblepv!8i|Zui%&s9!!$%P%x zTg~gs;-PN#edkD-J+@4}8A59{mQ9>hF|j)q+fdOv`tljoI2-&bC4k@g>GTC4CZz_r-#HtBVadcCgui4Pk4XzeM9lYxpC=+52x2xpRArX z`)9L@YrbD|$*mtwsjoU&HErt8re@-rqTZrxuTEBkvU^#=^9-BL#fUS8}grgF4P%3dujZ@P6t;Dj8}b3{bF1v=Vx~c zTHa_$nq}7{&{aD#ziS6ZO9r}n>X@Pz@40@Ab2H{?Hz{V6_m)c<@@S>@JWZBsmz>&} zfz!0RJ{q5kcUCG*p2t8PShEt;<4M#{*Y5Upx_(+q3xO`S@f$5Gyxj1f6mLfN$a~o2 zof+Z4X};Zj{t5Ioyc;Wx#q8evMCrX8&ncio#q{V?pSw@Q?>MXzQx%0o?wjQiM^Eeamx|Nam+v;4sz@*kFq9=ddHo4 z!+pazCO;fhEfQ-9=I8zdEpVaHs*4ZTAL5h3`DYT;LydO5(3sPSQ}<5gxKqCM>}*3R zdQzeVTjHUSfySvLxW!N_Cpb z$oY=*(~kJYmz>Vuq6F)HixT`+r3$7pm3?jN|9QKxdFlp?rEdQD zaG>!(TC^j|Gt~6xVf@|Yq?LKsSG*sJ9K>1mAo|O_fl$Tz3N_yjan62=8Z5hj_zl&UN38hb9F&&z;jPcf!DmnP zT^xTB0(c*(!K`|e>&>wl)sxF7-#no@rnKHb*Yjf1Z}x_j=5i=&y_v^+(aO5{!_%FS zD>?48*qwWvA0s&)mN5wfP}Nt;8`YTD#Bs7Z1&6+xMHgiNt+M2ftDT>li*c(aT*T1T zy1SMy!tCguE>YrmSFdCvi^klrlGV!P@}ewL?YxzX;<<6mfwpP|=4fBF61Bd0!WT!b zbXKicUFR&oMDKNQEnhnCE-cKtY9S^K`=TBsES1Evm8PO!Rd+A1^XkZauqGsi z-(u-VQJZna93`9>r`y&V1)RHl*^)(ZcoV54*dHTTa<9y+zoUNHH|sGPc-~61=qNQp z8EbB?UNS!y)0gEgoVR>=UHvuaN?-cYmsBdc$X73{%e8H*6(%t$Kj>vIK=vz^XQo99!mt|a+?0!Q8!P!CU^ca6rN>TIuC0d=3>Reg}JLx z5afqh>oG9-=4s~{K@Ln2U$$ZeI7{x%HT$&oZj}^!XQfIxL8U}F*sDK%3aRqV*5UC@ zRCg&lHwH^PwjLwJ^}uY7ye4Vo9gEP$^PMlFGArC25uaC&*23OK#ZX$6>h4^65!GTY zx$~RL-36FyZUs8vqIy+Bvz9A&n5o@@70Z^|Q8QJ4@-;5o6&*^)dGp|1kgF*3>*i1S z6lv;LvRSIx$-Nv{P`hVgcbHwK_BR@3b^W|}yl%N#>XQ9!VR3(Z{o@i%pOOpbwA@j3 z-^iWu)d{(4R_4ZTF8k_)Yd*Ch9&)r&I}ZcySFc!87f}XREnAkWmaR1wO~Zd&k-U0b z1o`93e-Q>QqTF1hL;O|5SA~8l47|iJg!CUL*Zhr|zYXT^|9t~GqnTHY#KL}8Em_@MJOypuoZCeU)!CyVbCJ>AGJ_r)*q z$s?o_82*#K_)|W)%O~&g$@_hB#Ap9upFGwl&-cldKDo;$AN0vD`ecq7)IqlgeYI`* zJ)fK|2ZL#kD=qn32CssFB2LGN^f{FL6Z_8qUw<0tlLsmL6>fWInPW0^(DGst@g*VEU_~g+(zSkcI`RYGd zr9bQL&%w?QaaS}8_U!UzyX`yJS%LWFh`$UQ>punZI$++LQ_h0?mzI1QUznbTe4UBk z1Nlu${ubonD6gcSiu!PjINV{~_AR#ZXMML><)wU+FMfwF9w#0XbbUDnR0l23@Wpdn zs2#t<7yq0u{vBU@uN8kY%J(7aLlxWSRkY7I;9MiK{0~~?KZf{);L~SU`qx$~egfi~ z5ijlk804jp@!3rAlVNWPWDYfD`h|#J37JEqDW^gHE@Wx%U!wi@S@JH(e{acG!iRw2 zacoKOTwRU$e?>gpW0k!}OkH(+rmufp>U;?P7;un8@gIfEF~?HBJ0O1nGONh){Ty-$ zWHzbPzYR~411}tcP(^mpTzUs zP?bKz~5wnaW)-T7wi$4`^M}d=YR3yeOTd{FrT@ zV-9S2flv0XPdYzuJ}51};o~3k$#41OUSE4~tu8zNTX?XlpzX_?DAJ!Qe0=YEr};I$ z_-laKi17k%<`K6}kR`B9&o?Q4&>eDSHi_)4FAwIwH> zPd?*2zYO=u`9681>d#Ng?!i@q{ac91Ag<2)cbXt~2Db8Zkj-YdW6FZacJ_rp5=9$&n7f2`x%-Q!!! zzw*hPU&PLzV_ zEq>zu(%0L=ZoHO9`DE|@MaO&nL(6-8{53w=JHKguhcCX{lK(2r6#%Yx66G6w^5=c> zjXwDcK6$+JAL))0$MN(zSm*uq&meDt95ZqYTVjrdqM;$dMUf9U* z;Qo{EJLGxmZz1#gInu;$f~@9TH1a&iJ%}$h^5<~8{|97w-ugG#PfyWvNHD*rAdiF0 zW0>+^Kwb=4(pN*~xYFxPd=BKFL!NBpH;~^j99%Pu{1eCvAr~2WJ>)HrCm8u_kdH&I zG;(75-{fo0FZtxCPoC(0%ew^jIRD-*Yya{(c-TF*^>y)|P<9E7|DAb0-3^?DRt@>m zvmGRm|7D-OTA#gkpZu3T`BB{KOQ5}5M8IFl3$d>xP(I{K|6itj{KNV7rW(GkKfF}Y zwhVj+kcIaFpuMMk=R&icxe?z8`{&wjoye!Z{$gMIn` zt52@;@qcRS$2ze-UpD(sOctJ(*BE|O$wQszjeM7qFLTzJ_TcfF zh37-^7dUfZ;(YSHul)b$D=*h(k-#){zWCqxWFA`*$e-=oKfmzh_m+_H zm;9fa_S604GtO@k5RzOC~%34x937`SZ@D#=e$sRPR;7rVSY-^L1PaEYHok7Uuat z=5@S**w`OWjB^_U?}v*_xyy)+p4aJcnQjnb$?FziS$}jcIWf&477nj*GQZ+Ra?DKy zv2eJrWX{0t8wHkn5euJ1k@@j>A1n1D7S8R!GFN0Ru-I%M z-?SC6@Ye&&8l?{chlc6$Yy~dj%Ta{y6Z618coH~lZuE%7&Qrj$c4;s9m`8wt?;t`P z_>b@kaF{Pu4VJX0ppv-<-y)|hZ6^Rgt#XjFXNE!GXAZUjA6W9@dk&fRZx8t0( z-FXf(fMtF{e#a0#vGDWA&)0T1Ke6;rV&RMimi{>wSo-I9>hpBkO5pGa4@=q^ElH(8u63qNk*CxK;c)V;uBhgj@9 zYjJvkrJP5|=j0^_#KM0GSju^VxInkVDPU=29n#lYE2gg`9%df*(RCl>uG;P6acM`F?63mh@|HUNkCkbuyR zt;m#f6R_k(ENS@+CV3HyejE8?@Pj}sdcGscF?wRr^E@BsBr^!aqCW~8{+iYki~cxp z#0V#VWe&rW#C#|~_!YMBEjlf+q*d38ab)QAN{e{GL`VZw+L>7RL#Q`)h(&)Tu*`*+ z3oK&G*#Y1=6EqqUxwVQKSWP=&sr^||J7o1|F6c-PY0Iy5{X4$11$E5MbCaH_UkQtKl!)n@(>IE zL5stFC284bKFxfLkApAeAr|}3ST>)t@DcKF)8!!+{;L+}l!e~}&W_>-fmrxwfpenx zK_C|W?|`K|#G+3}mQu${EX@8RSz ze;2UWzt_UN$H-;}K_C|XcHkVNCl>u4V6jgu`UAjX|Dc7B0%zZ>?Gp?C7;ui!6N~;; zV6jgu`Zs~a{#grWB!T~RC=iH+&v%T%&$Te;&1 zDH`*hBs5jypAmmq<6hwGuXtGUJp_G@(G!dQD6o{1So9}>rEI^lFz;=O%sJ;QaP|zH z7qO&$2RO&*iAAsOh0J-(z8A{E^;g=zg!rr4ChuXgt351sZh$_==!r$o`<$Ygnooa= z>{%Wb&P1j)dScO60ZTg&i=KWw(hjv2zK8sIx}OjWe=V@or31LALYIO56WL$$u<$oQ zpJVjIqNhJa_AQ!EEc$Ka8$Ge;cK}QIiADbuu$2E93-=M1Yy13Gl|9?Tl9u;NIYv(` z`d5J^FJjTZ2`qV?weW|)MJ6wPgwEzgh5=a8rU2&{J+bI70hYXoMSnH03je z*|&RG`0qiVWAwzLPr`Gyl!sXKS-?`B%Pm|?{v2(eSoq^C&P~8YykS8Yfh~KUf(i?N z6jV7zPb~Tf`L&u)Ec(&FIYv(``Wu0> zJ9HgYTP@M}W7}$}=BTzZxB;pNZ*mc?#+JQI!G!tY^PtKxdSYq+0`j>N5Qs%z2%KZ| z#G)?-&b|{r2*jf2BSenT6N|nKII!!cYgjgX2o;n4yIU*~l#djQRq16gH zRAsO6u;fKmj?wdv=o^5g?-7gsL14*ilZ8`(BX{8kf$bT(TS4Wg8Tkv1sV}-u<5BpN zeZPmrK9AEJqqmRQanOevG(Uo{S;3>B`#uh=0LJ3Q7Rt%`zK9f6xPz5#!V)@huEKiPNa{!A=sGk|l9 zo>=rOL%0n;2*jeliSh%~>T^!0L*sJ%!4PB>s_+|LqVpn_w6_CCxC0RuV9Wltf(i?V zheVFi6N{eRI`oj{--AEW4#dJ)3mh>V7AwpSf

s&A<^;&WDLN;s;?HwxUi2on6FR zG~SCpYG^+GK8HR@J zM7&+&F5R_9%i``im?~04qaS&FKPX}Xzg?}&kKT>Lk&tKtHnnNs{ZgNcd`TQmO zome=07K`lDcK9qN`<+-geCCQgr8#}T9CFHV9Jt8Xe}($}TK_8X(;B}{&JQ$xoBC%o z{s36^JF(;yN(SdAnv+ZXtj6Pjr9Tr3pU+B>zt$W+`-FI4A@JEJ@-vO+14~}Sl6DC> zf1^1oh<~c_D&V368sAHOkH+hPL%kYrr2cO;=DXh_9>fTIW{EtnF`rY44r$D15a}oO z^T4z3C6cq8|qwG38g!8s_&9K+PwV+C5aLM`f%o%~pKCk>IP~`#^M1bQsK(Q&=LsHR z7WD?-W?{z3b&Xice<6J;`R02ivCWVC15@d>7Q=i2X0UK_Azov4L#fkXd-AA}NY z;rnzsiNz+Ta|C~cLo6INrEuOL=YE|pv2fld z=U4baIEPL6NuY{NV&SWI%O>Ap(1-p_C3UVQ|6BM$AQpZBaO5@383i2rwZ^~fc}sKF z0~h^=#v6enXEo-%jp(MW3al9GMuZaKcy(n2;hjp1;A1s-d}||`9A`&i~V}w$nWrjunL=`y&qWeS`RE~i6t%1tCDsr z`5)m2;rrN%ey^aj-NL(pLyj)tq-?~(SLZ-e{?X*8YW_I3^Rg=XDhr2L9`l??EcUa3LuT-AE-?#*P=HOo84(MgeKnM+IqaWelUO+1rxC-s z2e`=KEZ|UBryWMl5RG|^gm^(f7)@+A<1Jhc92u%PmB2-pY0UD-I{{)TgF1E$XEF34 zgV}!svuqKgUr+rN+U6$eFV}c8u;jJX;%_70qf90rbLYfc|h}I9GzDVOMiHkKJLHs$5*`5I&KnP=r$7swx7AVoUjJQx;a>tYfk;L__F19%aUjpUP)@z96j}myO7lKJB$^~9khIPE#~sDb5v`_ zEMKu~!J;K~bK(o@;&;p;W5iud8_6X%K}!i8qFNBUXNK@T&pOR zF6YOr%%)duORy(Pxg{vM9@m^jD^bmrUIy-}WC;toePSW!*DaX0ddbHv@V3e<@K#$l zf7KFXDoetd72m8q<1P)RrhA%WP50zBgQEON>%!G7nJ1NUTimoPCYQowLMySmFJ|#L z>^v+T=Py22dYi)ucIL=@P;S|mEt=0|>r||sp{ULy`R!bgh(hAOS&huKt*U~KIAj9kFKcHVKy@x+LP-h~B~q^qiB@2r}g$4gij4_zFS zGR>Lqt&|51+X1tHVMZ?p)#e||p1T9}ff%oMtL*k>wZ@*6ORJ9;Oaib8h)k&xJgwL$oay|btO$G{aJBv zuA0O7)Dly&@#n`6}3S^qQSl6$_jT_@4 z7mOV%t9+KaXpDYAF)nh!Sa6O zk9AS0i%MMdX;&)6`iukhJUP5qXTasgxowcf{MC2sdMr6{s)^!rh8>cOz<59J5{oE2 za#FBGP23PXtnhs{pHuL;N5y5}?+qZ?_9jAih6EGDUMYCCy$I}W#y1Sw!ynh)Z_*O& z(H9LWH;BF0p|tHCnBbLffMstI%3_xzsoFpjlTZ89rpMhMS`^7y}tf@81||`qP;7yu`SqNnAYAOufiUWO9^7{ zIwEQh__Zf(8e<3D`;WeMy_e;#SsyBiH;m+$H!`rW#il=h;R}#eDd|&??b*tC^t^ry02VXtg<$DeG=({07AYTvL<+~U5=##+m zU5icZ@w6k0404y}WFUHHBV+*rPGq zUPUdw$(!<(g3LJDqhE+^?{~2GD=~(@VsDx6e0p2lJ3q_0g7)~Dp7tc&DV!`qmObXn za2T7-J9`1%0n`7)9w)}^&)xuYoC}ZRVf*6^!}W*x^1U=eE_fr5Rs!R=@w=Q|zOuZ; z>z35xi{KGQu`#Tlug5Bt0guPVIJV2TaUHeoy$O5PX;Q_3=6ue_`_BvT=EE56jbZIZe#TQ0HWO%efrh4&2X*=u{>Rj2oLnc)iW%Q)Y| zq#Jg?-f|pEjK3K_Fr)U5egImz;$qkK{`|Pol3W$$rhh9|RUQaPjZaJCpEoc+Q zj->#viJ_1ZS4GfkY%i@TPUjj<#aOd8=6FT0^*J~r(knh+VnK8VB)RB7U=QTk;6JE>A~04>ecC7F?(X{SgbU4N0e)f zh_ z!_6+I6h&#iK`$9XZ~2;_%5sXAZvB`^JI# zlY2XMHy0n{nzDr*;em~T&VhmCFqUmEJlvVy5eyH?2tG1(WaZO1({asD)C=py6dqD* z${(!=h14qYuetT++DEAG% zdW9yg^1@?8uLoEW+HS99c{Ji* zsM#rq8~RrdKi!r@oMyu==yC|9t?f9i6=~ z5Kd`J@y7DIabzb?41#l zmX@;E?Oa>VbIiWr{%C3NucO{d&0enOvuDJxV(}3ip?zraU`1La&0_~nvs7o$+r50f z*#2y(^_j~j2gfOkv?k@`x#^FxRxt2mt;IK{;wbKaRiNA%v9HXGeYN_+s{{4J&}$1# zi+wHET1BWIUTj)f?#Hr5uDtoHGprSbxbP0w!Z9B_WZ4|GmXKLuV>K6D;mSkgVYQyI z-fBJRcG5p-)g7m>wW9U6g98Kc82sON*$K`$B7tj8;C9st$xah)SaaPQS}m`48Cu@x zlS4j!pD+F?pKM%3pw;$_E0-&;a&L8YJpDd(&~k$%|JuY1K^c;qfvWuPS@En-iB-PD z`Uagu8S9^cUn|*R4m!$sMQ6eQA7AHp)Xi_8GX{LRx!~~zcj1?+^mqkig67kIQwJ>{ z_Q|__@+qO4`aR=|f72(=@X3`v`K(W-->VL~JncUDoFyl=*C18D=Oj7a*s{HzwB&h^ z8Af1ZdrX5&oM&Y6TY+^Lro@tYCJca_rq zm$>C0>7!^MlGKY?cO#34&ehTDYARe!)TzgMh@#L@Z$shXU`+YKfUUe9( z+RNMDT5h%YWw3uOWF}#KexI!0TU=)3yAl6;U_5fF_^&~xYo5qQ!S}+YPNE$0$yv@< zP2S^>p_+5jORSz_{d4lUMFo%VAqKm3(=x~4FwDosIUQ#yN&k?~CjkkR@fySpl%KOQ zp!^G;>>cYmzi*k;I7uVFpz~Kg`y4|gf%e$1Bv9Vxi@(-apL$>Z3w-fKzVsZ6C4u&v zee#!$d<1cv({hWD@t1t#4yUw~Iah-O$_=JG--jK}VVUQ%|38F`zvTD&c_8kf2 z^Zl*_%BOtxxBKJ@pFQ@&kkMUj;Sm-d4ID1R4+1gY+cDgPEgVx&VbNDW#qU!L)3Jql z!ayJv&Jy6Td9gz*`c=R(_u*aS&=>--a9V+7KR#&Thk>zRt_t1w75l`Jb}w*bfTF1H zHDdo6i*p!Q?7s#ao~-%AV&`pOEQ7AXIsD2TihN&;rO{QOOS8<&$a9?JMJ#r%1eUzU zl4IJ0SU7ZXl(`;xtq50Y`^3WGHAUuML@5ukaCk11^6)w% zGtr2i8Ohq=hykZgi5J2(QdaPS%% zbIwr=kXObHy*^IFQ)#h_(32R{SCkoUIY>NJ~v#gpu)l_r{3g6EczOYPb~U8 zV3~VzB5*b@S_s6#p`9F~w{6x!FMWep_=|x<__n}sFE-&23#S=aIP?dXx%a+L{!IKJ z5DR}7uyCFN7MsMv;XRJn?6Ww;!Z~JfP6Er^mOPflCb95;M-D#%Eohu@cW1_*PK)2oASS5;kPUt0yR>g`85OqZ!*6ovDohbmiaY_MX%0*_&(1-Ecz~BDZ?%c^E_6>69d9iz}a8)u%vwk z`W&Mt7X8nFrS8O{KME{)y=37x$;UTO24dmA0~|4B_yD+QoaXReNap^u?~78Pm$^TQ z#SZ82kn#|Vo?}m?Jh>L;SkmwUofon2qZX$USmt4!1}t-b5(|F@aL$*s9b(aQys4Cj zSo8~lr9AZ(ZYBR4+77Ys>E9*%hl#(SIgbJtnSLUJfW(a!zQEdn7OyzX2%kS<{Ek?2 z-SK?`XE@Mg6+Cl&1AJDl`1tWKVpe^??ti4qqHn-a{Tmz_vC{SumQUWMa`RSUI7{tn zJxIkrpd}%fKY82;>g0MP_cLxJA+xw@fCU#Cp!Rv}AO`BN+2lx0L=Xd-7a;~SZ z2fW$)^=fy$)m<-i*Sp;H8uz@w#b>%75AJ?^v_IJk`_p6>G(sOYGiW>Hj?KjGZiF1kMA2L2;?=I*+fmmb0NH&MOlVG#vc`zfxmZSv+XU0 zflHv1Aof;4VcRQ1$%w#P4kV;KzCsdv zytlFKJ%`5N`$P!>SA%5RE5mbm2Nbl&*FIuzF#zqE+f1h>4XaU6VFDqyJIr5mJK;Qp zO3pVN{t@1j0K^jBWn)-D;^-oUU9w!F$TN@BN+mo#$JxGJ?9U9W2ZQkb3&y1G)Q?Yh zoCb7m#@~#M^+lI-J~!s`+EvT^j-r;| zEoGM1Qs>NfCoJ8-l5T=8(AtJy;QRX_#n$Bx{XEkxTOhVKN=_g%^=RIag1*Yb(+)IrMo$fX{rKUjgzsJF(&AG*U(#G-@q-3@A;D;1@vTM zPbW()6nEX&K=*e_2mCG?4h{^8N6X;y?XCw;cXNT|i=utJGRqrdQlHE_TmNPIKkxdd zzJEOW%VRGe|A%lO&{5J>+}_<5tP7{c8avYifxX*i9ZE~{dRQFaHN)^D3Uu8Wo3lTz+$X^)1|I#bSlt0g6`b(dQ%dKBihAh%T?POq;%Sv_s`&t@0b ze7`0W?Okw)7Qf=Qind8zrJJ6)(&??(pzvV+Wk16H z%Sa2So_2P+_3B>7T7+AE@X@<7h6!<%-%ha zEf$D1R$ejXSj+C_BeD3#ozD7bJX9BWDY{YhNU3%A11#Z-QM>=@)}`hOw_IeM+?Kbc zds{(Ed}CRFv7Q%McN^pT>%V!E_N|+ZJ(Adat@^eFx=v!--ZrhJDYqvp8MSU2F(E7Y znm|_5H9eWhg^ig_g%dK9uMK22UE33yiQXf7=C20*$Voa}kyfaBQ#kd`z+-NCyVorp z`u@!L+#fq732i;HywT!Vdod8$pI@9=ksoQS$S-`TB7fBI$@v9iCg+csFgZW(E0gnc z=S|KpzH<`dCn0`P{;0<$;aFd1!7fi|c>8&seTD$oX#l2L}H z$b?DBMS)38MLp#>#wyn~tdF+E==HXzA{-2qA9K%zdT(l-=Skb$u6ibzJc2wnwX-(w zOW%RxpH{qm?AZyYj!r)>MFzYeyBe#SMh40cSCzKLCU^{;G8r*1P7iFz&wZ>sv4o~9 zttlyq`a;z=!>uXs2DNL%G8TSU>uOpPdos0&H7e{Ne`9q&Hu{o_8p{{EE!EwsIg48Z zlf-J_2BzLz6>cpvEg~`0FWAibp4fJB+pNvWtwHBl`M5_HKU%wm?Z>Oa#;U|zbxUlA zw=?`BQ-UuBx@I*8x^Bl-i)}Hs(w5kS`1CHEGv57(E%jI54t}_?Dwx`zomrbZ(}$>1 z4LomuZ;T?B-u_Z)o!1jgE9-VUZ@<>4y680h_XU6NIa00rk9XB(8?8$7Qq$LM{q!T% z%hTRV>m1-j>BTwiKx28|dbe%q4Tn@Stp1l=&{*D7Froa+r2OI^#r6ej0yxsplX_zB z`L0dLBYR?{!I=}-es&MuzU|Z0W7g)v&4I2O>=Sq*rUVz_N^jkp6t^|SQk~A!+~n@& z_}Q18fvG<(FKF@ZIP{*T#%pPPmi#)dMDdL;JIS$O4t#Z!dCVrq3V@@@yqo&zMcSE{ zz+-Qmrb;{wCFYgayT{>GYJ$3#Ea)w1-rX#%+}+AlrLE1*&$n#0K5ph!VQ1!5mtq^~%x$d*w7xen5ODhUF;v=g9Z8o!%W2R=&Acifmhc?+ z-`Cj=_uaknFbqt8yF>Wvg=8mD4*KK)J~_=N5A@0DK6#K&9_*7Zbw=YsHP0=OmgO}i zN4O@IFH`aPjI2YZFFvf|y=St-2xb4msr0moLfzNAs+IQFak6&K1Y@BCfA;pqduA6wRF(&n?-~@*6$vl zjE4ska-4rp)&7Q3KJs&|c#hwk0k*^^mhUQGc|W7_D zEjRdN&u2{Y*Zbn1^~qQI>|c%d7-B!Mzv%LK?WyG}g>K6Gq)*=ElQ;V01wOgkk`wd4 zMzu%OjlahELn_wXhRjzoJU-un%x^1nOQ8HWkiFoSBfj`z<=;U52yFCc{D!-4^t+o! zjJ>Fe4>}*=uY?f51hfCBqkNZXOExk68UMkwwU*PI)g&Tld7$%{7LAT|s*KP}Q8{Z}PWzQR|ZZ=1fX^Si?Nnvn6A ze9na-f$~#Uf1rGoNss#m)bA>1v5Dt7Hw)*t2Ylt>xDbY1lsn5AuHLt5jm~eW$*&s9 zEO;B2oAQr<9j>W9*H@q2KKna;?eQ5O|7~CV0ryze`TxqtukqENbE8X8^*8xfsq$Xq zr25j66Ry!Ih=sc1BXpp5sO~6p}An$Z5Scn^mAh2j|CP#ukpY| z#t)8d5;iAqV&U^%OMKjJA%_)3AQldrJN!**^~VR%-vwEG=vZHAH)7%J0v7vw$XSUW z1Y+Sl11$b`y~O$WK{$d8+3chU#KIW{oMZIFqUU*5_9Ldb+l9qXe#%MkBl6_4qoVDce1c1EIIjYW9~QCbe+4Y`7Cv`ph>eZF<2w6#1r-*~4N&D6J+bJcz)}Wc(Q_Y#zl9$JV$pNgiq9AO zjBxD!vl#l&jrc)eal;Kn8jBt7uZZypIs_czg#zIiws50@3Jag@ChHfzPRpKd005~9hUObKQ25$bBKkrm7IxM&u`emAr=n56HD2iCCAi}SU3mCxmnveM$SqP z3+GjG%C!D#l1(+>25lY0YV;c#4JxLMmF7QOOui)no!Irn;4I3>`Fefp`% znyI&wZ|X%XeC4NR+L?Z8MU%A6HN-}LkA?5I@LCJgmreK`z#(1?5q1GfzQmI69&(KR zUUF7yKCy6)Se%!DBa=0Ueh_l6LM;5(EdJZ%nEDb6=L2#kYCGx4UcSV_$pV%(EFj0& zAr{VPa!mPeB4?$xNh}=R^NXEoa@J@Lv2Zx9Ozr`QMbCArByB4>Ejlf+aJWXVaJaT^ zxK(rPb#{M7{W`5Dmb8bN)|CHMD=o2b-lE>romli-k4n;}rhv0j+b0&zCBRZPj-8ag zk!|5T3ttWsvR3p6VCmb$Vw0zMSwouVWGS0{e&((XO~VfYyI|3m71V1h^1_ZV3tPzG zTH-2d9ejcG@+Fphx!WY)269ZB5DTXrSn}m{Q`&@BIFFL^75pIVz*c0&6+Ld@4B+tn z_(33+w8MZyU!~S@a2^w`SgwMe`S}!j$!9ru3!D7tPU>+C}yAR@}`Au#g%d1>QxJup^MzDTrd~Sud82$Y2)iw zTwH3pZGPG`R?o20N=H*WP}c^|wk+DhrJukrU)uD}K!UTg!z7jEnUroLw+e`zLr}>w?-2+E!`k zjV(>W6X3^BWRF9B>9REmQ=m)Y#P;OQ>USdg{w9`pJ@>7{SIrxLap%9)wTtWGW*+&A zN?}g2Y6kg>NLHLx;n4LStUo&H7@Ts@=)3-AS%7pS77o8$EDL zF{ig4or}xoMTcXl$`94$ugY_r>+s!20v-`mcptySpsT=VSUV&cf!~|_Jl+>b5Z(lk zQlN~Qh~-1He=}b>;8st?@m{188QS)4fi8+og4lZyJlo!S*qaLy?eVoU<7kiTuiEw= zHgWi)g4p{x64*T6N704^;Vpy0=5;~tkM~_4Z^s3AM^RYY9`DmwZV8g_3*a%IsEK&p zYCqdwnmf$4_Z0a3+55fE9w#Na99*`a?Jr%8Ol^Ay5MPE(f|T#e;MwK79QG^N(%s1FQW2-TJOXdgje?GIT>YsG<6m^3_9c+Z%$L@d$J*-(}bs z$8xkGfo+e^)BTl?-(_ukQ5cc^%h%juZ>G;4pTp^2AOWHZ(|z`CfxYKU`S|@)>|N%w zw*&2TiLt>yVlT^QZwLw{<-5wVH{aKv_rjie-KMOHy*c37^^L$Dk72eSU!zO;#`x@U zu8!P(>KpOdI}Cfbnfea5?0v&`{8mA(M!WfrZ$0%iQBy?hLA9S|8g9G*Vev{1IAG^V`?Y)?*=VoU4K5N;# z3?$oLL%JTX?YEZ&o^9_HG@9%Wz9wfJ`|WUCduXo&8^aOUo28-pWgNE~@Wa0>4?`YK zdh<0@zry5euST@{0WU`Af+kcsiRFFX5=zwETMH}(!G-?g=~d6pBJ6*#jcCD65{%%0U3 z9>wk6n26Fr+nkzSj7d1~y(!_0XhvEze(Hx#>C7jcU|XOkrEGdxg>$UM^WWEAxzrVS zKDNsDKRK3yZ??fS#!0>DNqGE`qnr1&?cj^yQ;f65Hz;r83N^YRG0nbpH>&XszmJB4 zFSy=^gDo%ZO)-?@Y%I{3-t~T9u2Ty!h79 zXWRF;l{6P`C~Oa+7dY;myV$>N$pwAR+P-~*H#lz{UZ3`c+amBv#U5!qK%KY$v{&kS zj8d>?s3o&tbLpTR4%wDRwX#8W$ePbqj~I}7HrJ=^EcbGyr4yTP-%|R(g>CtBKCzi> zdf9fSa0cnXlna%@N%wNnr8pEz9+?gg)}0f)813&}9!oB$bV`FQ6S@=IMR|iWhd{aA zcTa3Sx%sutXH;1(n7`EutZCE8cGQ-o_k5iX#a2093kFWJeB>>6jHk0R3!cuE>yEm< z&YF`rVt}daF#~}f+Srr!Qkp$ppc|gP+p(R*b_UyP&6V!{FKBr-T3EKNEPe91*$Zlp z*OcG7|JH)rw%(Td^>b4v=l836z&LnQ*G=d? zWcQ7N@4oKXvhHuMt0Uao7i^{du@jrSH*+5?Zt+H`&;uU(8y@hsXL8a3*(ZOzZ*r#c zP5vamC?nQ|A4R7n0%WWQP==oa&PY_~bO7obHn|oF|Zf znVW@{3w-i;pIq*f3*<%tcRjSn=O7)l?B0l&_&$j?GQV@${Lwy{&k7R%p+Ri60KA5n z-*_uNvAr%)@s%bG@75mzpJ^q1B0uEghtzm$-0B!V*I~Z)%ToL#H-9acyEjW(_WX>s ze1k8ZbCT(x@z(CMQ-nd6b|_*|dN?|XLqa!XEZpCPKg z6NQeEyWc|jvLKVk{jmn}^}zW?=Dea_7^dbK_2kQZ@)hp$Ep5_o^h4apGVq=>3wy0t zN&1KPoG09}>U+@pjLdAa@T4KHf3!TnnPKd)J+t8Pd{~=OzqGf_w5^U$cQ|K@1jaX; z^s}JPLjS$VsvqNnKK}pq$$#rB?`y^$^I-a3Bl9^c3;p#vA3rrAKIFuW{ojF?g?|sz zkO{Om!dE`;Skd|Yn~?FB{OLYf=E|d*@mKil{iCmb_xa>oeC7WypZugxe#n=L~sAELFwc!*K!l0d#AmV+IBdQh6H8t*fMp)XTgWlxBo@v>a?DGI6~N*Hc`x*200W~YUK+j^Ekc) zmDnT}{z>vpzHg8d#Sa3paNY(Mn|yDUJ%kLLr-6l&2ApH`#G(%Yhs{1B7X6jLlJ5xM zB2xyw11jQ+EQDf9KNdJVLF*4>z7SY^JI4ZN^Cb@gv2bnx&M|so(MN%$ z%*3Ln{R`&BPKTiK!aEVcl2+wq^cRy?1O}uZ5{n($mw62<$T1guV&TjH7Jp8@(~x-$ zZztdMD`Md)~SU67s=NLV)=-IbrK1gEG9|D%Ly+V$uBe8JKkaIPD5Z=NjWg`~OIbgAa3#L2A zA^WrK+bQ<5?0yI=_W3SY>=TQ9-b+c{Cz8XRhCnQwDsl?6el9u2FNjz;i^<{3F$Cp5 z#uJsn!nv26;aa~5SjtQ+oJYwqZSpudQOze7&K`1xYyAOorg&I5oG(r0nk5$fabWTF zeVZKP6GAMU-&vfLBye~!K_C`R25@AQ)(^8d#KO6n9KPT~Q2t}aH-=a^CFJnLfWWzR zicH;awD3(9o@n6;;P3>UmRM}kmn=M8>xo6rInQKXSYpvX4D7Z!IVSDn7Uvo2O&=zf zwDcd7v`5K_>U@cXbDW&vTK_sZJQ*Mm3+F7b)crjR^U@`AOA`zKa^Mh8LI`=-vWpZ{ zSUBvmIYv(`dNy}t-LKQ?qxB!> z&T^qo=xS;-&y&UelxW_^qQzw5k#%3i>EV}<(xUJ7M>e>S_sZ3uUN zsE_p@@020ttU7+OHwH4KH^zk~rn7AQxjZRM75|K$6z5H6cX5srrXZi*aY7pU{QV{_ zMi=4iU~-ofSWKpFMg6>0i`HldvQKc{F{wSj2Puv_QCuY*%9#_(6{J?*pi=q37lF6{xj z_SmUd9O*B7Z`Gf@-$QTLHw{h`OOTHCLYBR+!AACCs= zk2lhkPbJ1rmo%hN&=$jfY-nm8b}Eq9-}l__!=C*;m&Z8+>%k!Q>QE0*-S9f>VS+Tb KZirU<<^KQ}mwKWA diff --git a/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libp256m.a b/esp-mbedtls-sys/libs/riscv32imac-unknown-none-elf/libp256m.a index 3deb6f561edd2eb2626c85fa7abbf768ab0eb811..02c9a67484d88daf506f061b8d41255f8bd5bd9f 100644 GIT binary patch literal 1710 zcmeHG&2H2%5T3AGKsogh4B}7@>tx++DX2n4sO@FN32sPPuM>7t;v}-YD_T{8N8rfg z^%W`}pv-LIlC2P0!3l|x#`Ari&-VE5(V;YI{xXc%y2TyZ;BL#BQKM8BGw?EKHYVu`flB{&*ysq-nS+00BJ&VFH>Xw89yR=)|{-~Muned89`1yEz z5(I%S6ax5;{?oo9AwF7l?Z87~$F??^wfP683R%t=7H0FRWFqE6K4d#{=W6>Rie|Z+ zFQ!~oI?DWzs3?|tP@C#3Q;ws8VQSEfOhhd9;sf#gDZDzt1x;?%5`sg7{p~HY+!eW~ zhlv(-oJc~7(1q5EVn{$rT{WOERv}syz1F<$us&Sh9CbKA57zk>0C(9Z2eb!`XAgW; z6PM1Je7bO%1zuJzYn^Kck<} z59p6o{eUv#^}3FQAU7_Iv^($ZjAv(ecI2H;LdmORzZL$;Uh0#p1Z2Gn9``vmv7_d(3c^&p`*dy-3PyD-+ zvs2IWD9J)R_zV9Tz%L}k`-OE6e0T#e8V)}Ods1aun=G4m#-kwCd8apEoP`k&`5^qj z!}oz*fX`p>W0h#R1aFA2y|tm12Rz|MLxo$jK~<{EzcWjt3OisvxGVlRq0C^4;(%&e+rx9QDFF sPuzs|u{C+=xfZ=RCtl{yUYQnKhuxs7xH&R5sMp6PRIoN*Qs>+r z9M?t0<~z@i+_Pm?NYU##LwBBp3mI^qCzH8l%0gx`R~2Qfeh^>W?5p4HmZkawoiR4Q zosZrahM}7T1Ae3Z#S97YZaH-X`^3)k6bt6z7v@LaV#=_79wrMWZ0>M}9nF+V^Ou%2 z4b^Np;eHZZQa@rvQ4x32ESXDRam--2)LA|03S0E-ffzoA*BlFGVeS`T9Ael$*vpDz z5sK7tW0BgfPs4Q_FC!Up7W-@KjEB))&+U8`>yYgxQAWzZRt;PrP?OF^&37EJL_BFLDE@1=zFWa f|Mf?EXT6iQH}xLjoCe(sfjrrL*E{{U?4tKSTIEb% literal 2710 zcmeHJ!EVz)5FL{g6>}+9;NV``BFM&ZHG-Q0QrF5Ckc^!qQo1DT~-n>3xa&IX>+^HwJmf$*ci z4?_Pq@Sk|a1iT7yaW>I%3C>egn>$o z)C}ilsZnBZ_O7K(EI)wA??A-HWRuatD7~`dufZcU)A=#0ycO?J0u+4OUDU~sPh0on zJKRT~?OXUgE93EdP(0RA&G(|1^u!#S=EpQt8rx2B4s)BciTrvDP_iFMJ`|nUxP*7}N4Ufn`}e5? z8!p|ROL^%kdBPm2b7^l4m)g}rWNT4T?QW_|M?Nq3eO>yDds06CWnEhLJFwxFtxf+z QoqAaEio`l@_119f2Z_QGNdN!< diff --git a/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libmbedcrypto.a b/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libmbedcrypto.a index 8a6f335fbfbd9d0ba0fbf044a2d3b517954ba8da..41e8fe65cc686c5eb76e111a9c5115063236f5b3 100644 GIT binary patch literal 1052884 zcmeFa2Urxz`u|()Fhm7(#2gS56%~~+N3uERh{G@hB}p)^3l5;7U>HDGU9+xh)-mk5 zt1AeY(KTRL*PL_KHQsM^PtSDs44!lD@BE*8f6u-1oL;Bi3SIS9)u+By-OQ=eK^3o# z=w#p2Rs3lt2y)+r|8;fs_HN_dhD|fZo)B3LLPiGscdkdz3HcWn(>$B}kFS0xW|5P^-|X* zGXDBngUBpgR(5fu)T^rxvHDN0gcHQ-zjfswBv$|F_1u%{ioxsE<3w)|C+N^Jj=>vJ}-E# ziYlgSZ3|NFUtLFkC*_3K^RA?vh0D=-J1O;Qx{EkUubzZBe(OpYNgV&vYhFd-_@7*x z$`Z$abzNOd9RFW>Ii)2Nvupig;zX}qk4@L%E5wPvZo|%B4^KpgXhIXC5`tBlgy6`S z$V4JEgvDz#BEzIa3#q8lEM>HVbW0ImIl{01(yOnREG1^kOswhcysHb4Ga2r~BaEvNi6B-<< zN>qvKD2WV?iWCkeS`|wvf)gTCQBkoIC1pj%gqC`viSdz%8uPy7%x1mGnd4OxgF}+S z!Zda-7KXG)=ZKNEv`)S zamd-tMj~f6AB&tFUI|C1SsHv?f~3T-Hs6Sj!=O!6g+yV9S{T2EDydq2BbFOArAz>> zfNw^|suM9RE!{mKF*e@fs0>jhXj-+P%Ry|YX-P3yK`skcb9P{81V<$X(|^>a9-_en zRhTAN9gBggN=S$dH<5)#hQ|wrv^aIbL{*$|_|Pa39H~JxiP_8%@c%ebCUtDwWRbzF z*eEP+q7-yq!^a{U(wNzz5=;vQy*u&9xYB={L)(#*ANBzPlX4QnoqHKs^22Cz}=SeJ}{Q$&c^FKh%i(k*2%%mE8|xJe)x z@YHpdW(Rv03}17fvT!h|AEU!CuFVriN0~H;F(pQ}g_N-|i5!b00Ay8!UNJs@X_cZFkWOXx#_9-- zdR*`nO?<4yF@^!lwO1ovqqvsF$3}l6x|AudhF*+{l5PTwR?%W-v|8AhN#lfj4`ZD9 z{zDQa+-XUp#Cr^BtYDvEj4~&NS`GOp+|yD6*BWClQj@sZG)9-l9MrcaSY?_%Cad@+s7XSE$V6{LB@x}827|G|LcvUn`Bog8S(TI+5iH%{(wwD6 zSnyJWN*$r{ZYFURZxuU-w@STev`ak4+c`IxTF=|rwws$vt7Tkl)MQKbWbGDe%Gxc~ zm5Z@dTQ-L8R$;%gbr!@*s?ElPNqX6or_{bQC9<rg#fpiHwWT#EZ9gYR(oJ6Bdh+ z4N4?Vjx((hX0Z~TXBIy}6_unBjCsCv0lN)(#Qx{f!S_ifdKnT*JH(hYIC6r?shl-l zgVa(Z-#day$EB7IGtSC&N^l(3GmTjmX^)vIL(|js0HVgsf85$Dny*|&j_H;nM2AoY zPq01Cj|}0qQy6cU-=b})AwE@w*RWH~`hEIq3#HJY{>hYpY- znt04;^D?B)3_M2Fr2vrr_#tfVD))B6Gd z!eUGjmU1Xd%fUuSa#%R%rWGHJ5-Tv!K3@4 zG8JPMAv$?C6<}tjivm4o5w$Ne!Q95xODKU&jpk;f_?e3-mK!+S3AgArT#;;M3$e6g z*f=(sC?k#HO0^uvW)m-Uv^vHT4Sgb9Be+Rt#Z!qFCA;xM-0F*tOBZEvcO!T6CXdmdOxl$u6?daltLVlGz%^b&9k}oaail zineI9$%gJ@7euo=7+i|eLF!gfz4*qltD~7ZFii+LMJ;wS&Lpw76P0NhJzVanSiwOD zzt<2?a>E8hJOvF#+N}w(N%4Z+3txy~s~)Y2NfK;3_}Fk&BF-;N)#PuIBv8bBTJ!ox zM21IT%QHa}MIT0L;!OqNA-3fRE?ulCWjGGYL=B||3=3f&vnKIT5j7c_Ch(leYHSiU zNp_>uWckdG##lTAVoMRik{T>HWL&6e(;a~T9gy)V!2=9~F%GAV#wte8y{`EN)?}9K z4NVd3o)VApEfj@WF5DrC^H@mF&ctu-hlNEXV$Wp0Ar`0LYJkp_Yhep!FY-4k|!XyfpHpp_Fjdn?mp*+4(U$}>56ePk5@AtA5LQPC6(bB7b%N~?HHfD^oEiQ(l1-EJ` zMrw3uOKDfMH0ulc!iwmr3p;V?8-6rz}Mip%RS;B22ygdHdQ(ix6SCyW zqZI-Y@b{C>4c;C%PMy%)J2)-`j}9%|2d^<=pGi-@MQ8Hg8ChX*R+@-7P{6Y#KE^1C<`9 z3L=DSwZII|Q37$Ei#P3T%#s-ENk;@7Mn(f(j6ezICLE$ljP$5bWHO8{vC%Z&jJGhE zBpt)fO!k~dMW4-xGGHYN(Ij|VvYC}a(?WxLb8Du!^VA8VSV?*23j|!poiyWR63)GX zEQTmaZ*b`iqgWDW+?RgCj`3yMCgJ|Zy|3j6L#G2I!kU>f2_v9Cqhd`e&`cM`i6!0R(PABxw4r=tG&#cj29Yt}xH}hVyg9oRp>b>} zw8Qa&DLufU6=Q?kQfdquMw>Bg7-hz=VGS~d)!fr0Q+d>Y2TKA2yEmd4=y8DQ?li=% zRHhnGlVJ%I8wIs8W)sv*kWXS2R?n1*tsHyrXlQ@PSq#<4sKm$^Qv~Z9Gpivvo6JyA zOC=bh%*qgF5#LN$Ce6r(RSA=$qczYeYW|fishMA^sejpF6`vHB7|FiGkMSO@niL!x zm%wHc$I{s#jAgySR+wF|lcJ6JgpHBLnR2o8V((+JQRhc#u zgfN0Dg#VkeZ?|5U%2W+uTZAcucPTB6sT8i-!u+NRstYx9DIu@;LKCNMeK zu9{7If*ps-0y9dKSOnA6kX0}(4HjNe3JMaA zWflEf17RB0P+AH>U4`kSW@7``ms;31u*pr%VuQ3nk`&a0*9zFTG--|5bX+s(E1D9M zDJ*C=n}zElHlAI|=tDnN3<|&~iJ)Upt%_5r=_@4kMv{11wQt267ORlSbf?35I|+YH z6U`RGK5EAdjmO_<;&C$G`cfrf|777VhEnLg)olKMk%+3&Zx&-I7EOWhvXG5i)J#o~ zxPXhMfD4DTEHyuJ86#EUIQ5RkVK4q{fd18(3ICF^Y0#LM%}z6zTa9DO@HRNDh0#Wn zixz!RjKHBHJMTlG(WuU7`RrjoeHjza)dgX8Uo8lSVvylwPWIV49ZhlgTPD1djuSz= z^!0C~`&OEy1p1ojx67evzEwt?=3kdV(|oH8162}|@MnW;I<~c@0mTMQ^PG=0`2t-e z%7=3$EN6*GsB`WGlmJU4cgzE(xVZKzb zW*&!T>BX=&ixv~!ESeI9K9R=FdeeB%);*ut>`^_5n>wpFqmw4q?EeS(uhw#M|xMi|3uYWkB4>XNW9oFJJyR#lHnIoXE8mw9Tz=}42 zHCq_mtlh%U=87@w{)FYzZI*dujN3Nz3Yqq02E8UN%|fk=#aXDCpuAFIsd~o2ugHl! z(}gELa0_cTZ;p`n!s@bij{9cjZ}OiWF8-@2#U5sIPdueFl17y>r36u>Oevbe@|>YD zrA-J6dsAVP1=0L6MTZ&Qjbe|HSWe+N3TvZ(X@IjO9Hr4gPET++rOF=a;5bQQrpTf1 zwNc$;jABcoE~ck(IHnmVj!BA%*M#Gl94JYjTd=7mHXLi=WD;)^C2A(I@y7EmS}S_; z!=BpG8jE5;UiywbSk7sI*f{PjBDM@nG`z-3yNl+FONz%~gS7K#t+CxRG@2y@`-leb zcqY)(GlN^%5@ETQ~PWYljo41nuJ(9b)|jD$$02nleE5k{XIEnuDW$5?2ixx;ng2%%PS z(_k>$|I<{)_r9drxn;#v2jhJJ1j}jJJ~a9g>5b>@qEZaVQ43a5w&%nziBXfq2Lq|48>H!|C^h`yl&A`Hlv@0QDw>H#N*=B9X2}CR-b}YL!ggDJJ&~q1dRzRK9gX5R zD=LS+iHD;Tkqt@l_YSct4djsIhlXe=Tr~SMDR@HjmKM`+v8Cr`3+MSOY?rifOKG^m zEyW-=&Q0;y6MwEjA2!C&zbFpHU(nN+Ii+nBr4&A`GBi>cZ!s@@q|JJO-b<8%tD%`$ zP(8!y^^MzdDMZEc`HeTWkjBt2IKT-riDTL#(L2J_V0ohBb&4eXVHL&&PLM@+H^tBq z!!GMFkl2>eNGG0gU1AS*#KjupgqiS0d2?gIG+?2&FnhObB}|22De1ghSdM7f-1KM@ z_ad3L2R03Y!ibS0(56u+mMG z1vA~pSTJJ~VZln}y#+I7xdm&2rKD8c;=xM{9y-y}M@!l8Q%8su#^4vl@CI6x(MG9) z_gsP_G*MK1@=5stZ5YZ%yFHc}LmFty*wnS=rLN1^?UO-v{;#Vi<<-ABMal zrVt_Tzawn81)HD&>4A{KI=OsGU}YI0;Y3E5Je@qbJRh2otgt5T!dTz()*2Gp#N(laSHvC&w?OZ~dcV$+##nrH@!X}NlyUH1N zH#sRcWBd}m?O~!l>_W8paw03LN3=yP$!Z(@y&=TU`lj`utWjCchsxV5kgJ_5Gg|`H z2j$GFKsEV=)ClY+-zz6XmnJ8BZSn6cTcVhiRwmoGim%o!?W@ea@T>mNTcWFM!ze1v zB)Y*f8O8K>PB*lw8AZ84%ZnBTb?bxQJOG z-!V^FG=%7b4iSC+U81m&Gb8hy3kMduHyA|PrK#u38D`~TBy%0=yC&Frm+spV!y-be?nI{KBq*M+&>bOQspzJx%MHS3w5fXzTh`kTql~XdC90 zAEcU*%*}U?{O$+6Fz1Qu##A-ggE4~{?Yy2ShE*cEK|y47jv_6!yvb9{4UaVHIZA|u z0cE(ck(N{yRgk2tcF{Wf^vaA6e+kqTw zD02?iBeH^)@G@*ggNW>qhG-8Z5jPvmIjhyy`Vh?hnAb%4G#6>okT!?N4zEMn-Na9J zQ|4xc(P*u_r6ziHHc}L##Pj4*mhA8yqAh#_jup!VxIfFPaxQl`@84Wqn0n&?9h zG5Y%xQ0^O2qf5^&6?4SYg$e`#?q-J8PBy0=B0 zGi>-0tL5b86y+{iM9Z}G)vl3~xqi$1iBGnVzNdy!p41cl!I_Lc;2dga!^j$UVYKcu z8EuopOopSqQ-*zpL;iBV75Pi@m&(?HR$fj-w#}Yse{vxDqNa?pup6T<+|1|;<`ey? zbfWh;&nS!UF#G4~-hFjaTpELQ;3?64dG4eLj=_vtvS^vV;@oYbn+zUb4kh|y;f&(1 zXGAvzkiL%To4Q zixtYIjQ-GBqVKVXxM5xTiCCYGKjU$3p^xGV#zk;6QP6R5X%3@H`s}2;rY4HZkBIK_ zTt@L0{a-SU=q@}aiq{{V>>V@Y_SW`RdMk`oM?FzG9wKf!-JndgGm0qC!_+gnukg-S zv=436r>`ctD=MwnxlnOl%P26GGVBynj&;tkSNwChbB0_uv7ob}dOfUkN_iV5Xi5H( zpda*hzmNlqlYQp;)$q6S^IIxwaG25e#EirEZ*7GUZe>NZO`r@mqp#OH5p6wtBHM`m zZi;YSgzMX(|8aTAh-`fsB3oyRG2sAj?w_mdwjQg-W=0vbhpBaJ^a<}`-GsMJiUH}2 zu5vomMOS~l>>S!e6@lLNHPM$TAj-haq)DbSFp%*)t#gs16>pq$L(&*GdBrX_QuOu( zL~r++s8W;;yNJ?$Em0O;BlVE}4&!-7S1FC?D#{t%#5Yc=l)hbV%(#)PbV9jKNLTh8 z(K}>g1uVwpfjX5i-sg0KxVk7@tZ}EePOEcJmlU_$)r<6wYl&@-fF3e0jQt|Ct&0QJ zfwDw)99qKvJdqW`2SpA2m#rAxur#7P97gnk1L3tIMmHpb$(vCpS=Zkh<(y~SljF#mFvX3Y%3xNA?7HQMLoMzVXVGqWZ&nYgEI zCu`E?6ZiD%%$oFOjQh;KWX;TjBmyfKDZ{VLOyFCeuz-?)pl*A*d34Y1Zr$VMh>($I zM*5A~IjSDkvH#6$f%3nz79?TLU&5TGbAB{tF4h9w5X@e7Eueg^mSg2>Yg`MobS*dq ziqN$nkzWgR?+$YW%%*EW?xLXVR3EGb9`=NCTX}RBcodDbU@)T_jJ4p{Oz;GJ!CIih zx5{devH4n{#abYvJlG08 zY~$7fJzWdB>_`5UXjLxJpTvkQzQE{x?l6is!qosP z>4s!6$`iSSt_Heu^Oy`9tOQp1i}G{x*|jOvhpqz3lW$m3=zHWER)QF;1lDvVn2u3# zZ5+1}48y98l|V5Vqk>%tpz`TTFa#^bpvT6QAVahgoTV$ld1#6WSOLBV{l6ZDZYYFW zp#0yuPV=(%C2-X#hBY0pcJg~$QYepef0=io0meeOf*?JqS1WWyv=x1*rN~{Gt z7pMBn@+*sRmA`~t3r>Kuz0$~DtOdGMtOZ-ZJFEq=b#yHN|C*w|y}-8mVBC5;upeuI zJ9xRa4Au+qZi7AL`6-NRKMLkB))O-lVe5D>a)%f<-Am^AnO+?vydJ;OJ&etT$Sj0K-U46bmU2A*Ml1= zNSCXhRY2C~Y|M7<;nPFgcqStYM4OLcO+119LB0b~`mYD=u|5={{YT-WV)&yA{6p7> z06P%A0BeOcSuI!mV8zG^Y>^rs#M+=Okb(XBQ=d@hZSc+?I>>I%A!L=Hx%o^r8J@p@JAb4GWw(Eu%pXMR*c3P5tNGgb{-?vhS7~q zCB7-TlG%)6s12j+GMM}nl|Z&3HNn`y=s za3vFPCPP+u9DV&4PEQ`8pFa}WkvUlTm!fw!p_hL{ztfWx{rz=Bf3pZFdmz;ajFxf8 zF%^51e5(+f)z*IU5NqXq8zykx`Ak+>6jUeuGG#@LP*!`g+Nv-MrPz$h(%-AVD8p@- zUYUckybC(zU&(^@XSEJVLOMp4PQ9C%!rpgLVDK0ie7bm`qkA})?Yq$ zvAE>Sxso%NPhTy*dE)M|hew_k?Msz+@jT*njPGM+WotS4s*}I@x-+MvT>X3sit>sMnreb|}BoT*ZhWqMP!T_ysEDY2}+$*<ENBSzoE0G2aIL!{}V95o`9K2 z?pOL>y?d}YUtwL2VST)kFO@B`gqD+DRxyMtTmRq^(La7nLI%AYlpa*6i?tnFo((PU zF!4O+RnqEWyUW6InU%Etd4axxvY>KbzjJXXCy6qBBaxR=JMST`&SwI>gHrNbt1NWT z-{Qd^~ZX6Wn}5T(OmlGZ~Oi1i>4 znkwiv(FVOHvaYE_+cg_LUJEMi;(2j%9Z}u_F9HLQY9NsXh9XBIS#3*C;CNoxGNb0{ z@9#khE99+6i4jy6d0K!ge^X+}|IAc|4Iq>lN{tJ1KGTb3hWD}lI4yEBdXjn(=XS|< zBqWXYobp5=aVN7Gb@F7!b1r(&u49lJ=*aV8jZG?}o*#-+zS3A>-pAgviC@PcbzC~T z1~4mA@(yIcHyImeD;@Tl^)25!TAXVt(6>#{w;Rzrv|o3os-4lVrS{C^@zy17=RD4I zKi#{y|B1oJh94PS6jBhDKlY$krj_4*^iPhV4&JlXq#VhgePB+zj6E5ibC>|d+#-_K zGv%N%ZJ7_VayZ&-8gFj~g`~>@J>cz1=q@5apgl@->cjOmniR$1=(1wR(l$>j)G50APzs z16G7tX|nWZEeq{8F1eaHt8855#LBCUUC~lE zTy=4IAlv|#C$7f0EP6xjY-j9`jj4Atgub|%LA_JK{>+jXoGwGNH^^(Ft;e*LdHA-~ zdZe_K)z53EtKtC!N=-Qx!C_yTuafIF_DcWm$8URc@pW69oDF|`KkU*5B7;$ZYLUkky=@~YF;-E~!a zcenBF-RmxBuX7n_9Nimp6eTUl{mOiQqc7TUBagSxHq-T8pVo_sp!3FxkLjJttmG`k zMh_`ddogr25vvw9lbohiR@mmXyKIc5WpO#gk_vES~ZSN2J7et>HUG zIrt9qPM2X%bPn)cCVW>msIP9WwX;h%IyQAxF*Z}}*m=m_&oBo~v(b|07Qk~DD{edB zx$*Ga@c+ltof%ekB;&Oz^BX?D2; zs-ZoYmE6B+_QKI(Yl}MKc|BiCCcwDj8CY*z2@NYCzvBJSOE;yWWL()B$4ze|2NWYJ z5=GS!U`iu~y_>UozP*v`XVStlsjlYle>bf^!n%q*$jxlpI@Hd1V$0?(Ln&R7w%(}y zm>YU|6K>WSQ|^RPVQ%mvmoFPi`Uc%2?qaByOq8)T_EAazvvOmqB_GoHYI^$VL7#s5 zoN>A0^1+pit2(Y$xYW}oPJKBpwy+r!-ssDPO%smIIQrd(VO^eY zIk$S-vbFIC_kPxSwCeosM2mHIUW~uk+{Nm!`=Khi@+CGEl5ak$zca~B+qhcwnBgn? zw=dB*ywx;yz@Oxa>!%$f#vVV=wtLT^r%pfH_|dAT8eE&ZYIeCl?)pXe{?No}`@r8S^?UtO-|4=Z z0o5w6J=CuL=-l?3#vQNyW8jO;ABJw~aZ9FiZT4Z%mI={sXPua^;7ysH_4?eo@Tt)A z_yv!a0m-{V*37%QV|cfE`>KZrK6G3>>dV0!hngmpN$L5#LT1pSHRI0yQzV-ge9vX! zvYbDnr##B(KkV|k1KK7-6YHGqc0ICT*3lyYN%^zKzRsFF>4%}6#?}9I{ND#|^x5-# z)|SdgT{nk)SKMxw`darYcd9j?v8bPNOvr%m19yZ@y#Cv`t*Kv9R@V5(wo!Im*NCC> z0zX&Hz8W>N|J3(;Hzk~PkMB|D=B?WEhJ+2;%U~Q@EY*r z>Q{qS$}?_wuYLO{$wB+Lt3TY0rBYahNtH{_nvuBW+YsxMuzJo#W@AJrAt)x#(Dh^$eeTBV!1ef9@e zdfw^acHO^1^~yCJ?aDd4oO5_flRX=Ltyt^lBST(PP1}}a)AQ*MfB&}T`!S#2F&-;M z#=rSJAgq1ih>z1-%<*qH;kbLzl|4^BMf`I6h5ADCE64oQY0ip8Za%3+^eo*6Bw2N>M+@{rW@s?5-cWJP38$@M&(r z%IBS{4gRk2MK|UAXEVF?K76UopLuhSt^Tt3oI|ViZ&FUJn{u_m<-J)Rowxk4wsE^3 zZ}*+Fu-w?-6H5n94+?pksmPyy@t6BvZQqTaacJ9{6{C_5M4r}7i#^}u=Tr46=#Omv zp}ljJ?|!Fvs&F1oz1 zTHM|D@#S~lpX}>cdBNMJ6MB_o`aj#=>%_)h18?VAU0eR=?pr;_&Z?f*xb`nWnttE^ zIQpR#Gq>fa4>J=JK05e%>BDOdU-;LV{tui7E2B%gD3)AM&27D^?37{eD`q`XbeLWI zbN#1#RYzOisB!1XlrB3uEIV^;*r1mQovTzVo}6&F^&bP?oqQPldEHz?s z0DubsKr#R@4*=)}0E7boivfTe06-Z4paKA}1^_4m0PX<*IRL;T0N^qJ&;$TD3jj0( z00IDju>im%0AL&d@HYUk2LPxH0E7Vmy8wVH0Kg0YU|Q_0QLa@BLRR$0Kh^3;5h)W z3II3>0GtN^Y6Acn0Kks`z)AqX8vsZG0NMfo8vy`o0H7ZL@DBjc5dhc<00aR5y8!?> z01yiRd<6jN0sxBufD-_~L;zqv05A&xXafNJ1pssb03HAUM*#pj|Fr->R{&r$0MHu% z_y_>_%09ycnUjcw406-c5&=Uao4FLEI0IUE2eg^;w0e}_&zytu`3IGrR0H^_g zV*r3N0N?`vxB>v*0RZm-fbsx9Gyu>80C)ueJO%(x0{~F~zz+bx2LQkg04M+essR8O z0f1)!z+nI&4*>WA0JH)CP5}T7000jFU@ZV}8vrN=04xOnLI8k#0N_3VFd6`O0{|QV z0Hy%|KLY@I0H8ep@Dl(K0{~0~0PFyO*8l(m0BisNGyuSK0KgUixC;PW0sx8ufO7yq z2>`GS0B8;XGy?z*0syT6fb{^tb^yQy0O$??yaNCn0f43eKqdgt3ji1h09*qAZUF$* z0f1isfbRhSD*#{=0FVFxcmV*z0f7DhfD!;u0046VfGGe#7633C0C)-jv;+X20012T zfMEbYX8>R_0PqI@@DKnP0RU740MY?~6ab(T0MHl!2nGP+0f4dqz#IU;7XTO!09*wC zmH`0s0RR;M5C;Gx0swvhz)t{x1^`$K0E`9z#sL6<0KiZHKn4JO005!^fC&IVPXOQo z0B{@t2mk=q006@Qfa(B%BLHv^07wD=o&x}j0Dyl0fM5V%82~T^02l@UXaRsa06-)F za0CFD4FF6A06GBx;{kv^0KgUiU^4*F4gly505k^xlmNi@0Kh~5U@HKy5&&of07L)) zp8`qX01f~EAppP^0AK(BFbDv+0RTJ#03HJX&j5fG0Dv<9kO2T#0|0UWU_Stm2>^@& z0L}pbE&#ws0N?=t;12*S2LSv4fH?rb2ms(I0ALRQH~|2)0027w(*b}d06-i75Dx%+ z1pwLr0OtXKwgA8-0AM`;Fc1Ln0sz7RfO`NyE q04M|iTmgU{06;YWU>^YB2>@IN z04f6jmTW0f4RmKqvq(7XauC05k>w z<^uq|0f0XNfYkti0|1Z$09*wCvH*ZT0DvC>fQ10S2>>7n08jt`zW@O50Dx@(Kr#TJ z0|1%;02Kg$9{_;w001=r@EZUy2>_@90PF<-mH+@T0Ki=U;1mFG9{^Yi0JH)C>;Qmi z0KiTFz#Ra{1^~hUfZqXtV*tQu0N^43uowWi3;^^60Nw%sB>=#70H7BDUwZ z03Z(lNCg1)001KafFS??im({(C_F?}q%p3i)3T@;?yre-z~ZA;|v}$p1{p|8bE2GRS`y$p1ee|8pS! z&q4kVh5YXZ`JV;(p9J~;8uI@K$p89~{|6xdpF{p1h5Y{x@?Q=4e+Tk^5#)ae`mkpFg&|K5=QwIKhaApbu@{yRbbcZB?J1^I6e`5yuKzZCMnF64h% z$bTK=|1QY?>X84*kpC*k|KX7TH6Z_QLjE6w{OaR zLH<95{9gn4{|@qhB;q&%`F{cO-w*O%0r{T_`JV>)e+Ke@ zE9C!S$p4y<|5qUY%R&B6g#2#=`TsNIe|gCNE|C8lApciF{tt%ycZ2+&3Hg5s@_#Pm z|6<7h^^pJTApb8z{&$A_Zw&e07xI5Bh5SDS z`F{lR-x>1%KIH#jkpCwk|6?HkA4C3YA^-0}{%?f*uLJr24Dx>;@- z6Y@U~@;?aj|3}Dw2J-&{?LdgFIkpIz;|4ShMTSNX2gZzI4`CknAzZdfV z2IT(~$p2-K|AQd^t3duIK>iPa{11lwzXtg~3G)9K^`QHHY z|10EwTgZP~$p4Fw|DlloQz8G)L;iP#{6Af!RO8jJYm9;dB=_g)}Arr z$Js}Z`h58AyP3~Ed~n%0Y}li$E?tg(eE!_QcgvQ?`g7;PgIBNq9Jp=UL-%FN{ur=! z?YrCY@wrP69vqRhcW?fU&!1~_)akbN^zaxP)vDF->76_KzIpeqjP}HdJ`pWijO@2= z-RnQ^+-dR8ix;*x$B)--x_B`mq4PV8EMS|NJw8&fUBxPa6BUx{kT^=~L~=J9Zq|Gh)P(b7RLI$UJ^L zDEz>IOYv>n_Q>wu{p#YLJXqXkXU;^YoIKgHO4+g%Jrs(ThaNv}dLTIXM$1KuR?i9uIN?>fa$8+N!H_{e z{q*wF^yxFEbnMvWNNDKheWOO*^R8O8(cOfEoP%S=tgM=nvUqu)K7X#ca^?E~H@C2X zo}Sa&&!4}^Vb(0|+@PRiho3%eIPRBU&Nir6vBOVSuTK7b^yr(F92{zH`RlIZ>-SeJv(;|AM@R2vGBfAyIDbBLS?}Iwy8Zm~^@~wa zyEYFV{NdH>*EXjfKCE|4quKU)%9N}wTem)NwzaJiyKmq5=aVMQ>Rzv2>_{)K_%=0a z)E%;Z{fmTMyACfZD(ZLq{(bjVfB!x0eq!RXPPJ>-$?ehOZ`J<&SIW(qlkSv}k#;>U zZvM1Ro&3h{-d%7aENtWau3ax$%VhF*Z{IRC933mowrm-^b;yu^B7gn$bmjE) z1wZ8F4Q*GmX8rohm;ZX{#*H?Q-oIBgTD(~AR=&LQOl0J5KVP~OXOopRTbZ5xQi!{Nab~!<#gjSj)+&{M7B+k8c<_@Kf|}zm+tuRH@xM z03a0r_yGXO1OUnb0Q&)e9RR>U0H7}bAOiq?1^~VT0IC82AppQ#0AL9K5C{PL2mts1 z05bsq7XaW90B{rlZ~y=v0|4Owz-Iv9Apr0P0Pqd~$OQmK008*_Kn(z3D*!MS02mGc z_yPcB0DwLKz(@e#H2}~80I&rBbO1mC05AXm=nMdq1pxX302%;bGyu>509XY8H~|2= z0RTGypcMeH6aeT50C)fZkpRF+0AK|GP#pkR4ge$q0A2t<698Z*0Pqw5_y_>J1ps;h z04e~W7yy_G0CWNX#sdJ00Dw0DKm-6l=YL}WUxpa%eO z6#zH~0Ne)vx&r{?002(_;0^##2>>Vr04@Lkg8+bR0N@k=;0yp*0{|%iz;gf~007tr z0NerqUI74K0Dyx4Kn4J?1pxRR0O$$;SOEan0DwFIAPE3a0|3ncfNB7MBLEN$0Q3X^ zDgpp40f43ezzqOkH2`n|0B8#U3;_UM0su1rfGz;QW&q$G0MG~k$N>OW0sxBvfIk6% z?*V`?0AM-*un7Rr0szMVfQA6TSpc8|05BNP>8UP>|0Qd(0I1K`$`0AL0Ha1;Re z4gmN701N{Fx&Q#r0e~$4z&QY5H2|;;09Xb9tOWq#0f2)5z+M30GXS6i06YMIRscX} z0N@<}Z~_2m0RXH60PX+)F93k?0Ki26pg92G0svS60EYnpcL3lJ08j-0$OQo80KgIe zzy<)Q001Nd05<`EM*u*50AMEokOTnO0RUP6pfLbY4FISP0K@2LpgjOk z0s!a%fQA6TEdZb?0FVj*3;+QB1OVv#e*yrw0sx-?fE@t92moL#0B{@tH~;{&1pvAO z06hVKp#Z=s0N^wL@C*Rh2mpKp0Q>=fUI2g+07wG>0s(-30Dv+8!1n+^UjU#30I&i8 z*Z=_Z0|3?l06qY~JOE%J0PrIK&;|f_0|5LE0PFz(E&~8{003tI;41*|3II3*0GtE> z$^rli0N^nI5DWk;0ssO4fXVwB40B|1w_!|I7 z1ORFS06hSJ{Q$rm03ZVZhywsR0RX!JfG_}{D*zw^0Nw%sjsSoP0B8vS3;_Us1pv|k zfII-8CIGM;0Js4Fyaxal0|4a#fJgw~5&)0|0AvFIO96md0KiND-~j+o3;+xQ02%-Q z*8qUI0Kh5$U^W0y4gmNA0JsYP_yGVB0Dvz5@B;wQ1ORXX0JZ}F0|9{F0DwvW0OWrW zmmPxA^!s*|J@<~2SEPchWuX&`JV*&e*^Nr zBjkTi$p0wF|LKtbZy^7*kpB^o|NS8U|AhSi2lD?WD+Z^1nLd|24?}laT+tA^*RJ{C^1fUjg#JCglH6$p03Q z|E(bZuR#9qg8Ux=`M(zOe*)zHUdaFNApiSA{{Id6KN|910r|fk^8Z(M{sRDz|2~la zw;=x~L;ml9{67czp9%RN4*4Gs`JWB>zZmj=JLG>Fnvg{x5<2 z4}<(K5BZ+~`Tqd&-wN{o3*`Sw$p1-@|MejMdqDoLhWsA|`JW8=FNgf^4EbLN@;?sp z{{`f~8uEW4iPb{7-=VUj+Go9P)n^LH>`2{67KtKOgen8uI@gl4)VV~lBV{7;4aKMnam1MkNV{x|M#H}-t9R_ogQ;j?CW%Bu?>r`>8hV`IYv0dLe!V=} zC1}V`nLnn^zqpCa{r#-{yW2zMzvu(4PdBbL?^tK2GI`tfuy5s=0vx9TUw^w{HOK(8cEk;y1b}1zGlP1*|B>=95+@uQ2o>3PCbgwOmiK5- zkw?FE&<^-PRk@MX^nDXcJZ?l*R1d0C_B&Ts-@pM)0{#7()Kez8HmH}-u$?QxZ#EJ9 zC=}r${r&ufkp^RsAO0`s&Fy`HL?sy#5A5FrsrlkLkVL z&6ibuF=DNJ?y1ke9dFa5cI@DxqcXZ*J=9a)_~7NtgurTFf@KF9e*fxilIQ&k+VX9l z`wq5lzN6xt$xlz{Rz4l|wb`zRb=1*oKOAd)efyCC3D@Fc65bu%mOkq3q`xcg>z%Zx zazxRVXVa#3wYrfq?{34Ss%!4g9n#!Nks<#y+HUyk)C}9R4bDbnb)0%B?0mb6dB3Hd z+4AB3)E!n|Iteg2ew|R|GD$Y zTPL@ysBveGM^f$ZHOF`O>`0#bV&>Y{*ADiOx12VrhU3G6qSzJhUfw-8XEQo?NNN^pmOSi$}E?)As9=itQWhIO1KtgSz=0pQ+cJ6?I+i^jNs6 z)9DQ!Q*Qo~v?eXF+ONg$U7Lq=9JJ&1_;Gm$ZhHBw$bHapdiexhWzVfmGKSQWZCG+_T00Y_jLb@IZDVU^ z?@+d!qm$Gh6KD6$th8XB>`jOMmkWDethdNVUTazK4xNd2*szPfdfj!wydh zTjzW!uVm|JsXspD&&lkm)=sm#Uzy}NTQQkSmOMQ8c3AA7WzoI14O{mzdWEa)kYiDu zmTm6eG7Gd2}V*=Zr(UBlE^y^z5@ebNr?*E7R}CJbCqFjS>4671%N!6>EmS zntFf0yy0{1`P@$ZANzxlW^^4jd>9h7=dXhU+Yh_k^%CBd!w=(JXQtMl_sK#dJeNefEtvLp`TmHVkC(1^u;$_4 z>ldE%Kl3JM@sqTq;5% zmnN6xLCgKVLc()c?V=zv3?h`mAkq zHF{F3^GilP-1^FSK)szdO@(;|M8*EPj{FUFY%@6ct@6RjyLC zTJ;(=Yt=T(^Dol7)^T$;%Ofx->E|0^5|}`LOFAJk%vBwwiV1f${F;@kcQdc%Ud>$_ zL?kB0CA4eWG(0jfA}PcRzku0P!)Iw46*VEc34X70tVW&ag%qxcYQp6V_HO3gvRNDN zwhf7|7b*}RnV_CP7&?cnoaONol-`lvam|CHz2lk%tLcBHMC1Q4x_O*%CL8MQZDneJ z6?yS>fGLP?G9nJk$veDHjh{g>eB_dN8%fxXP2ZSLj=x$Em*>F7yBg!Ua1BX#Il~*c zcsD+XzY3uBq3?`xA1?fw4;tb#=u4;U$AOeJe5ZqxA@#{}zWuldLmIH<%`l`UhWx7~ z_pcxc9}tAa?JLKY=V*-Q!e5N#mm`0p{_F?!U`Ru2C#jAgX^8@~bH9MTU#Q zO-Wl(xEXu@YWQU+?xSGCWsLq+Nbcvt##b?>=fbA+E@Yvo|C>wlS7!6$C2+%s3%l|` z!i7!ayRsyIRW^TJV|p$;!B}4|oG1ymk)&TK33ru*2TQ_hCE)-;`QrYp&eo42g!^z| zKR$>zvgvplBME0q!W$&vp2que`L{~quS&wpB(jPKR07M7mkpGLnL9-GQy?z5yXqjcW2A@G{$q`_mc2aN!U*k z?k)+hmxM=3!rLX`o09M`L0DYhdTf1TjPdn|R~bU6u&alQA>L#e#-j_qQ*6-ieuU|V z+Gv=Kz<25+hA7DkB&6ft#t@%wU=bJJg1z5r#Bm?){>6L{cctS$Ul8tya8-o)`_p)n zKe_Z#wtNOIY-=1ZT-dZ8apAF&^v5LO{*wH|CE-v(_ya0d6SwF6aZl7<{9jCq!mZf$ zWeM`r_WUjhZHQ-l;h}E$E(t%Cgo7l!=qd@1 zl!TK7;nf%$yU`X}B;}_`+ra>RE)F-4gd0l2o|14QNw~2j+(Z)gl7yQ|!p$V%=8~|q z{z^%F3rV=8B-~08ZY>G7A-vY3-U(^2)9DM3Z$Ho?W5WB_^m)gJQprc78~wX7L2Gs6y%^G?97H; zNT`8@^tYueVE<6V5Trz+y(0ZiPb~4NhN}sU z#E0&M`R~K=-5GytPd{UDInx{B6Nby#iTz4q@J}`B7<}k={=V_}Ufp1)-+4RL{?*Fk zKlsq^ynPD3S2x({ci#RK-<>PqKlr@F)x>b$xA^X?pjJY@;Nt5*zw>$NzLu{8{m$Fz z{(-Lp{m$F%X?jB)=y%?}7~h?#!|380~lcqP6Prvi_ zJv6<+PQUZ^bc`)$y3pa%02e>5=yyI%J8Gwn!H0h5?E(1SxH7eJ{o+go7Cy8u_&U(< ze0tg!d>y3yQjH31eEu)?-UYm>;%pn9m1HL&1hQdqGC>*=K*b~?o0C-SPD}!XfRsX1 ziUJ7%p$N!XtCo=LK!5u}ic0?bUTdDc zR~7+%zyJTP|9`Lld#n!OIQW}NNv0KzGnCl)*NfRmH)4?-+_C2)%7 ziG^PXoXiiMA;iKj0Z!38vG5N8C+i1d#KNznzUGOAKLzaVfPav4*u1-2Z%5Q~mwlP4v_vf0_jm$cc%*0F4U8Np(+ z22?T~0aAla`0c1FL1KHcq0~mKlL?FEd0CF?}~pAV&UHhPSHHE@Sg)GUyXkd zV&VSW5hL(X}YA4tRkx_yY`SgUvi+K?{pMPod17Hs6UlXCqj2EZ^>J^E@Ro``DPS z?7hy$JdBLKHs-k_IyVA)e`@m+iEps+EbPp$BUticpOc~OF9!BrZ|khY&O8^vqW?Ik zOkIX7p8MJ+vFPxcMr;-Vdw*uz8BKj{lUVepQilbHuui<$7R0=S$ScRjJXG&ZHlBf< z)Ge{td6YVNw$4WEGV*O)N4}qp_hBbxCYH2^firYo);Yxv1Cr0O<=VIaICFrF*AVNx z_*>>Ju=y8>2ilm=?=uQ*{1N#i4&0>0VCe7+!MBbKtI0b_1*OZ>nYLu{M_ zEcKJ`z&s7SLv0<)XEe5a<`*{K9lMNSHfHl@6xrC1ozyL{l)>_);UFNBv1RJCQ-Q?} zeJtZv{DaW1#1668*#zvp1^*z)*t{bwsM4^@{H2ZQ0~sT2yd68SLo9X<0DJGSbv`2I z%{JsKY~o|YqR$Ip@9osEpOJXS*fhUhw(6?X#;hMH1F_g-_TI6!PAc(u z8}nx)^G+MnhrJVQoP%A)uWU^B%A90lHmBGp7W->}GqlbI;=AwL~G48-GH~MuRY4x#l4j`*aK8iG^pAc&FhXgvXdX-GUYtonlZankN>195Ci)u@Vpq z&tfIduxLdrJgF4Tb0_>9;N+S32O$>zKHwD16AM2VIGGLznTt*M3g8sY6AQl(IC(by zL5PK40-U0GV&PWJ&5wxD_qyJQv|LM-}k0;g!6 zSood5rhc(REc{2n8TaEKmlm|J=$r!OeZc0=V3+wD8-I2=8?o?{sb6W^Bo=-e^)*i{{4DCvxAlpIznA)& zClKqQht8;xqis@-DUYCsO~L2p0Wm)G4!h-t%YhB!lpI zfT{h5So9ZAf1a(wXD1oUY`hFu&R=5DUk)tiFR}2efyLj5g> z_~*$#Wb<2r#ovg<&R*c;pshnJ{C?mR%@YfMkowDQePZF?rM~8gg~uZ)m9f&+j{+9o zCKjDoVDW8Y;S+$ptL(JAM-cxZ7M+&B;y=W~^BqI-YCA2l@O*xnqIqKBQ-Q_bh=so% zIQe1Q4zcil;1tah3ttE2|D>%? zEPN~KYo1v6>wz=Y+xj;Gi{BE9P7bj6EwS+Vz!@9twEcm_Z;3^x5Lo<{Sa`lmN`A^t zODy~_>T8}@_z}S3x5UEF0v5j|7XDsf@mpfyD}lw|h=pHGUi&Sv@N0p^mo@-rY_!X~ zh5FiWiADc4;LN9Oo$U@CV$nHD{=BV2Ec_?HlGiEfXul;EopaRDev8N4Dr1vvCkj~n zmRR&-fyHl$g--w$zaICl-D*u=p*p@Kb@4x7v1yg`WYOqIqKB@1=go)+ZMJ z0qSd>Soqgsk+1e=V&Ut6#m9CNzi8V$0G#|%1dIM*@F|)n7XEW!@qc3BqvF8V+jfYB zPXLyDy~NvWo%Yn%eoid$X0z z@Uy6|d1B%3rT!bXKC$o*P+#-J!q21ro3=i&@RiipJhAW#ssEO(Pb~Zr>T8}@_%*;8 zwYL7Fz;Zqki_ThLIUk9I-vI2bv(s(@mh+KVbe;p2^O0Eit-x}A5evT;*!#9^b3b)X zN3iI;4?aU*>mCKp+-~a}qyASBEc#zK^uMEy?*EBJr)50&Z|$_i!Y2buUR|i8eV$l! zx>09`owmCJ_W%~3Cl>uaz~b}7!e0+8K2I!sE^y{f+dkjjXXx{*0N7h&^Fzq*vhgrr z@p)pga|ikV*gC|*-wB+#+vX<&XJ|YXIQbo$Cl>t~z$uz17Jd$}l%H7mO7j1MPHWE=XV_M@8Q^plr5uN6!uoZF>W~rPF3+JfYE|vE;1H373es;?NY+OB>07r7mfNXQ>Nj|JCe{Kk`IXAzX8@zdj2(;R;>WA0)6nkY z!Yjpx7calJblQ{&_m*C)q->3G(@HNIZ^d;Qd#U7TD4ZSi$ct$;&~W)%NpXoz>WU~W zDZZ3V7F^rq_kWF?FZKy#mCe?0Wx$*pjbP4~u&EojxP<3+)*HE1Ru=%v2U! zX~r1t@43s`>mF$6FPPXac0MtEF01=>m$nF>@AHEiIG4p70ZWj@RCZ=1(`Q`UOK1n` z5!M(w%ooP_#I}hDIdoWehe8C0PXspL)ET~u#FSVuw$W>$W21=j&|%j)%mZuHFo^@g zhcw~f&|%%eIG7nygSBjB``1I~+0MC_dhaM~LSd!3*}dpsPm zH{4aep@?g&e0!HN*HNht3>+d?= zC5YoQMiGHGLC;yf_hD~03PO8Lv5CDpm%a7~_hNyyh`l#l_BPy(v838wGw6!FG?%@h zh`2+HVK4SBciBrEh3DmnXZez_iM>Z%_V`?(F?*|A_C`DGwQ$&b2-w*k&C&QApC%&Z zs|LX`_;tjKu$QWj*VJ+JKi(EO?IojfIlfIq?D2NdY470Zh`rW2j`r?=lG9#S6yA9* ziM`vP=d}0Lm`MG#b=Yg;vUdmUEnx;)#9j-Rz5c~G&!NNixC|TfV);HqT4(vbXsHy( zre0H?hksEnOr412Nn2k1HNEf}lRCdAX;<=7a<^3gw> z_Rhf`-~Wh+y=S4vG=3e?t<-*JM|(fPCiZS{*=vW&y-%m%PVDt@+1mtr;?Er&_O3$$ zXZe=HUaLmR*8_Ua@_h$;kHQYim+r84H?Y&*rgnHXzPJ64z;a(oTKzp5a z9P5woNoY^f&FN^5KLce6ZBSMMIQ7;-&myeY2t4F*>7_wIj5y#^ZoMv!NC(V!>veTR zI$&qF9y{Ge@;&a>>)yED3vRt$jq43{>-BA1?^?Isjg9Lqbk}nZ^jPs)1n$)KSbWOb zoAB*{4Xyvw zF>ZFLB8T40rT0Gc{GxjUcXdf{1@J&wbvu~OLo#NKHHiKYI& zfS%u0vHpwRa40zSGWs=M&mEDdh=cO7DJEct4NFnJoTOSRzq*JDCsx`=jeKo zQ(8MvX+|{~iBkGyEU_{(s!Rr%f2+aPJ@Nzpw4xyH_8p2mj&zdo->g zc|J-1or%zGcUK->cW~o@J^T0VJFxfgp7(Yi-FagBCv~6K1hF>Z=Bg5`6K;Bxw*+hb zVxP#h)uVTKu+AgaWZcym>pb?vitu?@-*GtBdn{Ga+h^)^9788IVufd{w74?>trbZ1 z6jHo|6`rvoe9XGI9Imy96&&*xhdw(3jU7mTNZnQ)z3XG7k+l|2#QtT8Z~QN?&SH$U z!n4`LFg{okj8lnyYr52R-QH_w)b6M~QG28Im5e@vJX#y&J3AZEyLuYsyF5mkUcI<{ zSDsP6eYo+LCDFS|4V2N)D>=qwFCAWe`%)aMx9je{drG{AVPgesJOvvs!A8JgV+U*; zvTS^8la>;uJxqPeMXr@omA1vg@J^H z1%W-`wF%8$G4X+zoc;&;pU9bZQ*S&-GMhJ7FQa1(mPf0X5e_bCu6!{y{?f%}n_Ly_ z(Mfq?idKeVmigP|jLeD8FUMcXu0lIXmHF$lNoKn^BRF)vVV*gg z6kHAbxA{hJ*6AeE^cd!_fD!!abkej(e2M#1DDkN3@_6uIz&P{JnI}SvmZ*)72bWW8 zfngrTo1vm|aj+srrNym_OY^Mrj43}}KBnw=S(jBCSNW

^s4dAF|kA1WSI%Vm}J@e@D;vO>nNYO}z~cY}9tL_-9Pc$X!-ac`IP*aPLuHJv!wQ1q|CGnyUm_4X#qZ*dm#sYetVMjX+4!My-&Gj z%9+i~cvVAkAO3%CUAtqLDhoqr)e^KT^51LT?oe z&2OE0r^j3uRyxK7lUSB>D&3hd7huZ#ThHxV>ii`;14}f2ri$%(%2gn;niw}S?|YRC zCQX?;Z4y4NtE|qc#6iAhIEmjm#rKk(Z0Z%fuo54Ko9@o4Ov%tzs+g=wF=O8J3r_Km z(sZ;*Q>L-&EQCK_$5~cKVW@OwjhSSAS})(S&bnjLthv*sFFH>WO5j3C_@Lzl(-4sr zGj=wJb*?dTJ|iYahhgXOMu_t#Ff$iS!RI}1n>%IpdE#Nsx~(JFcZ%8hlL>aOM+DPi zcM#N1&7LxU0XovLiZC*Nfz!E*(<6(Wj;TZW?AD}Drrs5Oqw#lfevVT+TUHFleQq4X zMR56N3U70gvHLNluk|ZG2xH1NjJVDD$1iW4Ge1mggCU5) z9d8KqFC++9ushft?>ORRVnW8lF4m5B6zq=2>jysX6OnkohQS?=4?$jsjq#GKH0EzD z26wy}n26WRA`&kOgFD{qh{sE2#%pDzG2UoQ;Ep#H1iMPoU zF9Crhe*srKUWPC`vb@7lsFR_KNW2*^Fb~C6!cxSW3}*g1VUYY4VFGu&t%!%JV2i{H z0o?IEKpcf6kYct(Q_llkjvrD0OjiSY`^kZcr& zb(&-9OyjV`S`LZ-DEx{|4?Us}Whk~UviQ9VKW^tD%oF8@o_Jqgz>nW5a>q+eJ%7C4 zc;e+=z;CiAUg-t=5&zh@oTiW51k;N zX1LpEYCrnU#7L&0-}r7EJ0fXq0hqOQ*GKzZ?zq`8c;D9DAJ9^49IW=N&lHLG11x|n z1MN#O-(u`zn7$kX7s-!d=B?9axH|;ugPwjwH0yCu-@c}~5WRZo^sny^h!2lAzrGl_ zwYP_M(e3qznhtJ0aA5zTeMk0`HQ?Rf#;vu3?RQvnYK;?#71{P%hB@`Q=siI99gtg)w{;wt>!FG4+UFmjSaIF^8H(5S9VPNHRc?~*?Gj<^|htS*s$>S#Fw-7 zX1_GN<_Z}gBiPACV}ra$T=<=J@rAx0V%S<-*l&Z%`C-6!x_zYbF+;~RHY`n+l31GT zD|326VreEP^NmDFkKm|QeO;hmH+6TX!tYNveBrIN8x z{g~_hQ0h_NU(h#`#MM(c+UWX-`k|Up-zNDcyPN`bsj4t#UCF73Pc4re-((o2crUNk z$$K(ly4UH>;+)cTr76SC+&E*xu?c10-tq11iEAb%e&@_}!?1?`BbuhG>9Rqhrm}5% zGJYM2SNsNExowCy+tAr6Y6R2EY=hQu2(v`%BSp3Rr@Hjm`6Ze0M%sDO`Y799>*HOz zb=hxj$Nc6L^CLE%5mGPm#OveHcevuwzpp1f)ur>fmm~NlUyPpO(c7pamh(*fvh5tt z6(|cZu&vxXrlv>S-(6+Jn~Ptzb^EI)J;$Sub*JL^jT$14h1>^;E&>-a<# zdoGyw87YG>1gv&VWbr8l=kWpoG6F-cRq>{QC2wT$pG_ajpN}8%co2hdzS8!r2rSc* zWm+za_;9|$|}x8-|JZqma-+ww41>49iQFw$;1dk7M}xPY3IiJ9_WD)ge*R9 zg2m?~SbWIh^GBD@r!F6|_QzE$k zHg)>61+(W*!ele&Oo^Za_$l+uTXE;!Ok;0VZgo4D0l(=@ zG3LrW@y*j0Oq%b$_jSRWVv=>weJ_|VbYIIVflAzd<6SLJ8CWNTipz^G@A3P+Ip(i* zH|Aft+cF#L(Arg*>$(#AhLy012y)XUTe||+J6hT^&YIxhdHiNtY5Wntm%#}biZM{8 zVIRi*4mWM)hiTkJaNpvdFSpMH7(^sq2nKh&!-!W48{={JDDhaY-SPZTc)Ssjc!jXJ zeM>vyB7i*98NYm&ZJF z)0sAJ>dn@L$=6+z3>?_^8()(=pQ-297xUrK@)FEl`U(mp7AHDa1+Au|cc0sPAJlyY zEv~xp_WEN@M>iiiaQM)nBL|Nicys^T`wGynT5`#g4RYR_(^%NAkI~#O(}*_iQH9@s z27TKZ3DMRWxP}oQ_9S*JrVpj4?`H`<^f=~tL~t)F8@(;M`#*wLOcbrV`(pCOrS8Ox z4`VLA=)%w1Z}dHy5IMfkI{ywJZtQvYj#1eaYbp|NJTq*@@MFWvuHA9%boQy#A@NYw z!R!OW_mA8+dQVZq_J${Gb86jJ0D+V}t{mpnvj;qT{w>}C6)a&+OeuuPRZgpBP=l--{?;c%)*`cn%o+Vv_S>Ng!%$(A-=-z_H{D!TKnZvT` zs&@xErK+sezG^I~|4$W><6&d;YH%8RxJjwQ^gHPS{*pnRV`kF9`PPa@%gH^KEyt^BDmyDsT;ZafNT98d8n~&oU7kVTvwj( zg@c>7CZu3VrF^p4<49NZIMNk8j&wzjBVEzsNE&(^Nkfk#Y3Okz?V@wm0sBYfbuD^+ zyVtueT&3F>P1u7g`n6;9ZH(>`34H*BxXX~b4^uapJWOL64% zYPAr37;bIET>X*Ce#RVV@x2cCjF$Lb!+q#+PCcWbC)D(6^hFLorbeSbu#xrEt}D`N z^!sA2l`33En5i-c<3#nYKKX6E=(;yu{Xe3&9O%w;H$ls?ucoV) zH9cH?+#9`T0_cb7Jmq!4C26TE zJzu`F>s~C*FMXu6-LNlioP|Ayvy={tr1>%Tqiyqg;Bd ze=D`cIte`kpEw-VW7Auk@dnt_YyGfC=Q*?%oxV*}#AE*Vxb)cgZO!!IcDmMY^5`o) zdaXyV_vkBJdhGn#dzR1d(K~qbj%NP!`7wiP{S!OB)`xg>=Xyz}JIkZ>WgdTLed=_l zJhi^g~M&u4l<^WLDLGR=5wqpl^*{ALAN&##A>KERdE z`QPHwW7kKz`YF;K>E_Wd^61??`o$hS)1&wB=vf}Ur~RGtY-ED>fO$Vo#1EJwc}JP? zo^U_Wk;e2Uaklh&Px>G1vey1Dc>ITX`~#NGZI<_#uklRJXTy{f3>|TH*4xzdi21qI zO5bj#x3#~y&idIAPtm4W@wDz&KZ(&hsO8r5$*_0C-wG?8_c}VF$33~;?_=tnW7?H) z{?}lj@ICyFsIM=2mM`CdE}tFrvF1ev^IAA@T zAj`CAw2#3ELKb@_Sl$z7{gm}W7M~*8t>q$%o%_OER&K~>3^FZQd?wRw)d8~D@1p%$ zj38vOv&scnfgxnE=Y!>)bk0}aJui201z6@qmT9@J<^KFU`uj10EX5%92f%XgdX0;l zz=5$CLC6wwJ6Q5h7W?yHxo5tgKGwP*i%%x)V=#hbVi0?8FxzoZaxqAGlEtT(c57Xb z#a<51WkVduGz?M>WbwHJoZA^A$ekGcT})Jq@sr0&0a=Q{Z#`q$3YK+2mN=QTkH83$ zi9zhlr@uQ!kOB;O*0T~GU;UXFL5eYmy$qb&10x7GX?g#B0@KD%8$2k2wfH?sH~qfal4Aa7%kWg&~tDX`2dfj%rq2w8ln=b|kgB?Uvk zY9CG(A9G(})m!(zf>kFl2_pzu{8?|MzLCYwI^e$yBS;a3bXE`uS$qb8Gb}qyw((^Hbki|Y4oMG9?Vjl-iw@!S>VrNliSa!15 z&H714$T{`1kG5ChCq3k_Ov}2OVcE%IXT1$f(f(wySAp|bs1Vj+DF=6bu7_R9fh^ND z(%)KMve;LEr5wm&e}Mkh@{+~AhW?hFEcPaFz$yo_*tddnE#*mYUSEtLyD&)oB#Zxk zu)iNhkk>JY4_SPUgT?1vaC#9&5VH7u0M4-NWU+q&4ot-eLKgcM;9QJSyrw?>keAt&ohGi#`Q6qh6^E!{Q8I}!+4d``N2PP=@_;&ayJ^94BlN*#wR zK3{<|EIV23$#IykRsYFi_k*S1k5sVKZC}0Wz0Q;}jaYliqu9C&40xWfvEcWqW$pcyJe1|#^(J{$l=R4H0UuuVBsc&TQ z=?KoSjxS`fcL&Synk;r62c>?J#h!n8(G^#^Uuv-*g5sSe>t&=#)8{UjcN<@M(r-RF z?I6y5CFeYopZ7f_dHnDA$26drI)6T1l)~#Kx6PQrSCzzFnjOrWZok0fP5QdV6!LzD zwNR7h-c~u!eyIa-@$yuxO&rg4gT?!z6EbMM<;6T)n#;wl#1Zsi}W zuF84Sr_GA+#UqyXEY!2Pk*}GDUMv52<+5D=v4>v$lfF9(@BZPfD7K!l7vp?yhM6xm z@x3NAn#p&*A&!q{{~L{Iu+MlA_jmAb%M0CbZsIavw{A)S#^gk;Ua&pQob&i)Ths6d zyFpWCV$5rXVpCIUQ+s{SfWDkP(|CBh856kYYaY%dQ%IM1+}FC}J&$-iCty50RI}r? z^~QrwEz(6K9*h5Tov^lKBH}uKj(M9E*iVI>Pid&-|@2?tN&SCbvO0IUGdI$zwxz2->&#B zSl*jaf{Ux9T>)Dy-5FpfbI-yde~A}jHAUte)qv?w`lq4|~Ai2qrYjP^#Vv(t7C z?QP;7^CjD@Yxw?ANtwF^Rn*toNKWqHYNsV_bdr->xvcTMt~H{*;p+BIfuc?*o7k95 z?r%Y!ps(W>^-V!NF@^{59Wkdw@pe_C6GP@HEuY$!Iq!3^ZBl&CYmNKSvSyX)FalrJ zZc`i=@F8N%vPS%?(CTIM`anu+BapE2OtdxT+xB#OytftiSjyJgXs5C2tCMttMT9gn4h_I~y@dG2~~ws4)3*ma=mn>(WR ziY+_VIr^Nh*3s@RJ-uXn&+hI{fjfMqOmE|=&*zk4V)am`9Vg!fbm!(DFOPvO9N)@C z?fpxq=rf(v8Xvc3v;>WyC1?aKK_h4h8bM3Ysb~p06)i!hq9y25e0y$6Jhoqadu|H8 zJvRm4o|}yAe%j(H<_&ud?3ax&YClSLN;r@>WoXSl)Hh#r-fzWo zp`QWn!T5zezKthel-^o0=bSHI#m4t}^dvJL?@wt-@}##i(^p6`>RxQT)@J%zJ6-D=JUZ`ZY0>GM zM8#DMmuHJd-{#Su^5{EUdTf5$n(;>1=~`zWaay!KRa9K{nB{G+leUWe4p8`G;0+0; zf909JyUU;H<2?EVkIudfwdnaZdeZOkq(A3L=k=m{`b{34*F%zigO$b~16M=L-yohC znxf~=>p8dH+mqheqqE;Q@sBO<_GWyZb86B0U817x$)D_Hp|OKU@95D39vw#uYk5jB zHQVa&IS_?)mThzPn3^6jA3QgwklB{zX4m{_yNQVq)>*ctaV4A6$omYBk8MEOQQCfJYbE=q3<(sl)x5h_qbtG& zu3V!;aZ!r8G|tEpl}&Dw+luP=E2XxhD^X9?H^{6E&FU2F9J)M zlim3YSkGLTXR$NSxhxFGS`2}!Ogy)ZkmbXCiVs=hYzIr6r@`rL{0AY6&vW1m%T5;i zF0jNTi+w*>V!q|_A&bwuE}xHFK4kIv)aBzxT@P5#Zph-32A1z8WYVV?6G6!0(;J*# zqU~g{^WD-6%T5-1A8`5*?N1haUvP$HCyRYBIB<>jCyTulEbDqCxx4nM084w7X<%9J zWSN%lJ^C}X|2p~%a#(zxq7OF$$cyx`>IqqV_JO7S$zl3f^@J=wue*HstWbQ&;`2wB z5ARWk4_SQT;+%Q0ji~sL#V6h6)5qmQ7M}qwpW*be);n2zM!S6YJWkd-S$w8~rQObA z`dDR17N17?^wMRxhTKE*I&hw4-{9gcV3`+L;yg$D06i^P?7P5H_sC-31D3i+7W;ns z57BYRVm}C$xCqJ(9(T z?_Y{frpt#cKD}K&IpFk5bWF1Nuy3La%T5;i0I1XK0G&)bw?IE?`_MvBa3}4{fFo{WU=$!wX8d`*f)V?-I2w<4J_;K zDX{EA5^#X`=jixZWUC!iHdwx;GJt%M_8CmRRC62rRf{?{$NJhye^8DHLL{OgJnYSt@-7$UMtQqI+gHxwZ zUsQS9yakgg7fzi$D>CT<-F0eLeE8hsYCrX^oIhpK%qjEnEN&`X{^8SY9m|@Z`vEs& zEVymb>^bu%O`kXKwt4dvEjLe}izP7o16Z(dJ{_#(GgI-v(PKTg_f0!*u@9j=-38cQ z=Y0w+WqQuL|Mq0(KADwi^a4kw%#JLajova{MLj8khuE_&)P-hDL77it@sQIrp6>zY zxy=sjg4Df}BB%Dl&eBQOg~yC385*8+&GjS4RFsUYm^9?Zitreh!>F-CMhv^=ob-RD zXUDTRmSJkZejd#$=xNQu^v2dn}W9pFPsA)b?`j-zQ@NY^ti*N_z?q z^tjFORFe5&8n@p~7~Jz+1l>9<208J51a`+ei+E|UF&-}iB;KzO%pI>DX*_=yk>%JA zCwDxa)AxiE3BPF?%`wwB z48(}PBHgWPLeV9y0|520Qtb3Q-!rTm>F4UxVHCC_ECU2G#rPe0Sp1q&HT)wjA$O<9XFy)gheBr%o}?spOfD`d@f^oRZ8;2)P@p$qS&*xOklk=R)c@j12yicMY`q!RBy%WstkQwY*of*u! zKQoxwqen15ba61ZHpKU5a+zowR!-*5f~e7h##KC~bAp~E+-nzCUke&{S!GxU2Z%Qx0~UU;K^UWlpU z!w;3!lr@ya4}GGnX6Vn$JU)qxTvL82rXPqntyFw@S9}Q}*@&)LVll07& z4)+IYYEn~j^ZRF2;d@Q$JNJFKqA9U?)^Alb@$}V^<3&a^ahO_L{8n-NmReP_Wse%P z|EdE+4wfD2Ff`}zpd)xnmQ-B!ym?35xgXBwOjtg%Y<*>TK9Z=4N3PkX`ud&T8?;Z? z>mvTg3?m#}-m18NYZccry?+YM&r(v9^by#rHQty%oxg8c`PK&9t*?4ag~EvF+f^3* z>>@RMb+mPLTy;y%GT7Qw$8Ehg`umI2(zMuTDNEDb&*_$?xoZfXs=T&bMPFNPY%eQ3 z^Lw>$`E|>qtCt&DiLZjT9$lKY&F_A?vNWw#nLPV=5ZnLzRoF&P>@S~XJ$e@#N)VJbAeoPhPs?$xC-U zdFhTPFWvFv9M$K`t7LeX{gI-sLN@n>s?XTyP&Rj+0kJ3LxQKtvg}25&hyf5 z_Wab@Qn4P!Hma8CfpLv^a_l=jXL<9&o$6c5n|xDKny2qn*DcT4lZ^fY-0MQtL+ta_ zrRB~O(*x%%^W@|O%6YPtQ~Qseo;pwIP=;wJ!!(p(8p<#YW!ME}*yTn%*IB%{rshB6 zxeoh<7U6Rpo~JnyuVQtd`W6m?&Uu{Alb&RzJLgeJp7d6pbggf&XQ*}S))TB+-{eW> z`H~i$zD-oi|0$2Y!==YAPir$j+wB9p)}4FRS}(H82tDIioQ>Z&oMEv%)_SJD!{yKP zT93~5U0QVfwI2Nuk3P{AU%r7%lYui1#$Vw|r_TF95vkrJ0z;f@KEOEHXWqpywUhJ}y#XgF5Ydw<1J|3K# zi4kNn1}RUn_{;>0&jT(WviPiX`EXlK?|~77EIu2+8J3+a_AOwUFIntQfn~nCTs~y+ z*$)<ycG1W-&nTG&$+FPTS6D?Xts3Hu#pv`&$$fhTEU&ZOqg?-yyL1F^EXKH{j%s_YvatgcIYr?-f@-cgGtIy$OSe#Je5_ zcRZexOool|cw15O$5SeIyicL;#vmf`vSDz?t3*8R;~0;pRuZo**d33@TAsg(2qwee zj+e%BG87!+5hb4Y8#|kjkj)ubBJmc%784IE?RnT3k9m@Kg_wYo%X9}&xWWu6p*wl} z4qm`-r8SMUJ5`6^H;sWTVLT2Yj3hRb3Zx=Zfk;{_0E(efTeaW$?(Keyey)4FM^W#& zj9gxd#N)FM_wr4{d@C^nrpr2IeVj8b=GN}l-rEiJ8(5(4|9<`Z38M=1{Pdx#H~N-0 z)WS}WhRuFkeR5|be|2&RdZ-OAu3}G&!7L0tefE0>Y?Irjq`IZN*l1Z+@>wU`5yJZh zjXvC^#eL#LwSD!nlEuy)kPXt~uiRlWHvA(hFP7BgQlq6!an0Vbs@^BIpM}w`75yTX z81nW5OZe-BZzAN>&sm7RCr=x@t6NfsRPSC}qV>qiQ!4eE&pP)Q8kziC)tJ~H8)YCV zN$p&-YRKaH@*xLHWbVd>e^Co>FXsCYU!PBUIB!kl)LJ>-^<-^zOF_f3;)Gp6JmwDe zOi*(cvgElu=PP|*7_GqDNxsW>87;yQKU(!|Fw;}TcK-BTcB!8~z3OYyRonB%$3BYp z`dfu1HF*#EBE{WR=bo3j)E~It!}um8huVT#dEpvaULtiym+IoG@{+o+*qqez66Z}D zx7F?IczlzbVVi47EveqUYRCm^*?IDIzMP$F`=;~vml(VKLl$;^v@CLbpGrxTH#LgZ z_=m*RJIm>m&AIb(yd3(b^DkPGT!K9f=Dt~_`0Tl3PZL*{U$?z(P`%7ga!^+mYd@dn z^k5yEdj4r0?{AW8^o$%1W3OklaBnF4M#*^xyYKA&IL@$7TY9>;-DhzSh}I_9y#)sv z5)zu~q}CfPOG_V3Fisq(-CunEJuu%YaBl;w-!iY|Wr0LrLZoVkstEV+Ri7-VGxykL zPQBl1+S-T`O~8JlDn+4pZPdm1CmPYWb}Pj`$K!{ORguaA%6VVMIKl5XjdVQ$7=dT> z?sP_BjGAF##pw$ZhT+|!$??No{au?rWn=Na$}XR?Wk;%7;q8`z#%A=zUQ?EcCw)Hk z^A$mLO!*S)d=dXez<(QvJ z5Z&0Impt}+R{DEWdW%dASMT=LJ9qhQwf4Z(yYjL3t!}9*HFnj!G8W%GaGoi#2YP#s zCzck+BUjD7zJ}KtK4&T?=Vnf^FL%DX#jkEjZE}tSZIFkA(&}AKiQN8v7XywxY44&Na7bjU+rDeJ{+PKWj#2WcHM~H)o=q z*L-xtkXg_tAD>{&>^*bAg39@WF2DR{^pLP{DnE;S`E;4&^4YWRn3GpI@3vc}M;7G6 zBNIt^ddf)!eG2;Z8Bj3rQdN?VoR}XoRz^=?g5Njqj>3Xj1(l&ma|$Z^Op0)H=Nx=n zIaDbp&aTWq!wVEk_}r$KDCTdxI)K9CwU(B6^=)efab5=AhK}|3dGthc`XZSeSA>i= z*P~B!>5s{ZHf_nKf37Q?(_iJ$%RM@;)3oUMO%&Cd|6-TUce))(_T)dsoPU+=kfPSd zok^6T_@uJqXawejSyojLzxxd6e_l4wl+{APNo9Z&o7 zzLFNLpA;3-Gyl9U)uMGLe_F4VWXpe(N8jVo&${&3oIsUKP|_xM+M^qV~TEiOGazp0-5cJ}1Av#O5CZ<;5++TY2q)(6}3(|Val zALY_x^ONSuPr4^R>1t6-e!6+`qy3%yXx+(=)}8!l-N{e7*(ZXXJ-oRWyFch|&d=F? zyQ|w`@{?(%ceev*e|_yrqt;73>7zaRRF7Wi(W_i~Z24t+@|$Jm2bZ~)WO>qin&}CW zjJrm$%bV@ddn?}CrDS3-&>Kape~uZ?*+1ndK1-mm&Kl|pb&aKSo(9g+Sl_egV2YmJ z*}rPtSwC8L$}7h+|6DU(rWFl$#ZA4VM|ajwu4npu)88qNd{25G9naq1XuXX`pJ&fc zr%Rc!6(5)PO;7q3kG{vH$Cht_XL$-d`Ri+@-(^p)^*da8Y`h}V-`O6tUTpgpdEyT+ z{hjrp^&z&u)}8&0)=NF<&hcV^XL}pu(XUWvaXjPt;5iQK%g4}pPt|AXyHK71FnyRl z4tf_b4};XNhR*dZdNy>Hf#}_!b9)y3r&j%h8Pi|s$*lytiYiF~{)DzWNXXm5*uwBH0wuJgM9=(l64|();o_LRY^k!BBOBg@i zO0NfZL@i47_+R1CBOd)yk3Pzy&$re`D)s>#Q405Z@;g&9gJ0%nxkqpI=+3sQ{U7zD z7g_rnZqw}By~^JAX#c23f5D^kJMkjS51*HdP(Ndp-vn?+w4}|k);E2aKE|Wp?a_-p z`YeyW#M(Y|{B-pTOPBcXdh~Xl_4%qN{R@wNw^jZt5wIh+d}+ra@%wPYv4qR>q(>j- z(G8FOBP%~Ncf^tFQET~FEjr@(`ISER0-*rS==3A`! z@tm%s%2Bl*|9Y!FW|`@^=5r&))A`9)W32h{xkpDHf0$?q=NGW@uk%}=_zn}L5kp5j z>3Yl5bbn19(L?iN*7B_}(+8OQUB5LA_tEKAe#!Ezm-~hc%T5+M^C;hd!yfvegwN z=z&K~vm%R~7K4QiVbL3WkOldF)V&LQRmIglJUdse8a;rRpdJ#47!xEpkN{O0Lc$%S zK!V~0aswg(A|&3bmP-=kl7xCl5VaLiDB`soAxhOEa#2)7+F3_g7$mA{`JpS!>p;S+i#LWS@Oz&#>QG_`QeJ0f%MBfyD^!L~K8ZVEhGl zBW5O$7l&YqQaw0#yerI%uMTZj0o@1or&p?87 z{NoK~+$@j5I{r4+@wb1B)A6^ljz4d1Kwcb{jdh&u_XSzKR2wsHGPfoZIR1Q`K*Zwb zK;Q&hPAu|~z@CS20uhUxF--O11S-Jc*{ETQ_Xy*<8@Y}rFG|pLIK(Eg*sKH=n>SGB zVVpq3qH{a2*jxylX4_l}EH;Tneo=eNLOb1ksg+z2c-iADcOV6nM{ zI*;N6A{L$JfW_u^V6nLeSZorD{sCaId5AiX;RGTUop*ra?D~ELEOv-R=S$$!3vmLS zz#;FCehcj3gaZ(<=##g4@@$U}Jq*_UlNTsR_fNYo>HcZsPDryZ&?@>_nqb{OlZ@O; z9UD`Un!>XwOEB%ryRhuT@fTBr|92cey8tKHa$@nH;qW|x6Np&knZTakQySXOv%z~d zQL0on4$&VCEc(PEFQ7bt6Np&kMZg|*1Q4;vX9J6zSmc1pO6A#(b8mxnoOywQ7zfLa zkB+mAb)4<_YI+>V(CYf$+e$Oo%e<~1`BVEDImaBqv@h%8>o_w=pcZkq}#BGR?>$v3@tmBqzu#THuFC8}<>$qhb z9UV6t>$nXzaxXqC8&i@xjA!%xJkG|n8Bb?H#8Ma9Pq5|0BJTn0*^U#4Smc)idtRW_ zthXxik>EW$v^eB{(`3qRePYp{LHSOjPb~7ADBoq|#3H}LB_|d+HLVdm+kJAB!ENwi zjWJlq))fcK#yYlRjgF4(qVzJW$*z+1rAYzfH0;gU>sd=WJdbPpqS8>-G%*#W*vk*(( zp}_K;g;?Zl!n7$k*_2vn0P8MwbjN`)mpZ!R&-%s{o4l+`YLUS_rj=z;QEi0&T?+SFWMH&xxC5@Z0zh|A{5<`@mA}m(;QSCl(z&&-i`_ zK<;_Q?JTsH9XF<>&f(d<53w=ZMda;(#Xhmv=k=RVEiVm^pOmpcl#NrRJ=u`ry+5T{RPNe|U z35Q_zz0@j7&9gr7xf^(~!)s0Sb>FjnCKerS|3(NvIzAg5EIK+qHyOFMv){p@lMPYo z%|_1aQSND5T${f%I&6~ETMWLzh1pjnZp320mO8c%%c*k^ClImdtOQQ8b(m(^V^JGo z8UwMu)~_@)_r~)L_Ts}@U@+rgEi{;Qw-y=9x?9x-^K8`^%<;rpY_KkCiNS0yYnj1a ziR%nz8(9qodx?K-@XOX7Yf_E1*ji#Ov+Aq{>(^Fm8y4zIc{ z*4B_bb_Bwtj6s;ljzUXmdbp+&30s*9#BkA?lK!dayV+vwid-{N%9 zE3K@mu+t=CQE5qK`8;}O7RN#E;#pKO4HFh9ZY9zp&2*Vo5)d@ZYC(@^Jq`0;PMc=B zTa*?%u^x`>Tbw*4=l3VRiwnkW-!laB)n8@x>Ev4z4e)>Zav(L!0EQr35n{DC>58_ znJs(ev@?dD2qS;-KCc58;n^rb`Nu0U{b2vI^tTsCekr+!-8YV|^|5V1c?ZzUug7VRpZ zgZH9ZF0O?}W{=eGTeR}t6#qemM?x=ZX0B1a7MC8Ydk?S&?cV*}b;LjBAd47?j zGWy4M5qmQsV|ILKIs(v|f72j$+q((R*2O=5hY)*b!5Hm{f8Qe?zt0FsIh=#!w)Z~l zeGeu2cQy{O$Mx4}Px4iw)Aax^L_HGs>~Y(B_k71ce(w-_uLIDY_{TLfC)0pUQqC*T zbK4tzf!X_t{_z=)*!#@3C;7fQjej49+3V_c{Nr~au~&rrZvVO>p*8=mfgbZ@;~-Ug z9skgEg7$u8+Y|pPk*NnW*hCwoTf*#(>+bl+ae;d5hf^>Px&6Bf2`eBMl5!?Pk9o4~ zglAyy3t+|%O%t?NW!sZ{y>K1$u=DVPHb@m=_8v)e{PQB6dh~BKfZM;(u;&^kgZ*eF z^q40b2dQh4$xr`aI%w}6ogAfrA0&k%cD%fxN(cG%+>EhP3X zgr3{p5!iblO0<`PgK6|{K7!@8_crV$LM|lsehEFdy=Quu^%-d|6^Gbk?A`W$fIZ5D z#2$6r_PE|M{h>XH1^F>hblZ!9vDV(X9S$Y8y>75K4l>$f9L2wm@W*X01?|{c`?i6e z+g^FH^M5tNW$(9pEP83sbC>&6FQ*v0G4dQib8smE9V;%r;q^&;mw&x4F<>{laj&>pWX(j%}}VxT@txnt}&OOmWdBs}#< z38*hrD-4I{o){!A5eA>4R|^N+@0ypxKM&H`?@6M!9sL<5gOm+>^E;aKRgkhCaX9eB zB;;lDK4y_neKy#fGyC?{vi|-0_ctm({jPZw?wRNhuWydx=YjLY%#U{7o#j4u^P}bc zJMMDlaLqmQre|$=_4DQrx8CKi>Du>f3V<<$**7gTG6Z1UcT<7*}GHTUi3n=TJ%z975Q>cyj$20 zJ1^nw#TW8bxwgahsG_LAv`8!SP~gMQt;_>~58t*j_vbB7+!y)cPAl?- zgVv(GA6SvE9k&wC$Z6+Uxy)MIaXVJb3`{%U%6ug-E!WE26Zr5NEAz#`v~yJEu0=0K zM?~)E9I@}4a0nZ~A z?JkXo+*uWo7`gonf2Rg3F^Vg$24+QCzE2KVfvKG=-<-o(k+lX^8zUlLTo-{_!20&s zqUgj}U-^|PF!Q(ylvC#*bUuK^;}JP+P-<}uYP>UIZ4CDu47|Tf1wQ{PqTV?YduK&P z?(P}6Xm`KJ#28=6A*D4w`zyT4M`|8YOCuw9RYk6i@O``=sjxQvLzK`MxoCS0QrAUB z?%W)?Hpcf^0aK#`(>{RZgGk+pln){o?K}?4fik2X}y^%bvIiFs!a{Y72M9$)D!E9Dj6tgTjH)&;64Kl0)l zHTlpLd66m6R^%mlR^Z)bR`bKx9S(fzx3V_x{wVO5`&8Bq-X6YB>s8i)XP@_de4*8R z&aKCNpY5`mcP$>~uU5K^>u*?J6!@&4b<3N9yvwbB)dhBb zV6ATqM9r|aFI(SuXi1>@6DzrK{Eg3E);H(%+2F74S6DPE5dD@~-)SJ?7;iDQHRvAPix_$au`B10A`pfE%-soR^&L2K( z2-GZBkF82>^5@ed`u)BNRM)7|`t*jZLsu{H#C-V6K#gDZZra-9KiFjbHs)YmU{^J2 z@%Q?E%bUBbnCY)gKHC@j3|4bUZ1hZGWUj39?QTT9Hmkyhr zFVE`oLX5UAa%GFJ{- zg=ThQjCLYN+;ki^^;)Yk0aYYx=dx z{-|@-`4&H*&fmXvB_p^_y~$QZiw5%6tK)UeyS9AnS-k$1K<&#abJat2Ya9KCHd{^D z12j;(Qw4VJQnTusJ703hQ++VHX?dV#zgpXvUN@-GKdH(}j=rYO7j;kth8Ts zr*)65vevV1)o8P!E7kQ4Sut5Jcw(mA7KpA_fjf4po(*jKWNRzher;o5SB*N3mOuEF zzxIYBzSuvaB5tXkW&u7S~Jj1cYE&4_k0`dahE zlsbR)gD?7`KUEu7KHAWPSkoi62(I>FI!433J>_3~;YuH_jg2No2N|O=b%~9Eyc+HG z^^5U8bB3?>QLM(&o!%UxH~IC=(|$9{ToJgkYyYA$n*u|Br>d5B$7tc7NN@7$nsYzE zmA+&Cz{ZE_pKA)lKBm?qF1xHdV|?#7sphYqd(dB<`(Vn-Kw}GvFQNz|o&*6OQ zvFM|9S%=>l<%wPO?b^n)x{Su{^}d*=6h?wc(N+$6L)N4}oWR;DThf*XaQ*c}#C_4f zQRpp)SE+ZfH*NFoKR)MQ9J_m6T{3F6r7=+ZiFyuK(oXBn=s(ppFTSUjfAREBpI**! z0-Z}H0tSD7vydnsmpe!#zY zQk!&?j()RzZIdthKK1P~w8Y^i^$xDp<_qtLg2uj{_3NAZ)o*I_#k_@UIavPT14sRf zS4D0{`3G74szCHoUH&AiH@*MeTOT6#Z||>9T=jH)W@8}cQ?&)xIP0EY*Ic{y0)K7o zYXeaF2Pi$U$yc)i*R;Q&NnOjfDR^XuzqVjn&xT}pzqQd9`+~ZA340Q2kH}tl(N~_> zVLg7od{g72%h#_8RBuvSS9%UlvL0jEu@?_XtM9#PKz&AIR`SY+J=HhJMGsY0j}8@YE;0^uxBj+uzv{z!}fOB zQ*&gPKkvk;o%k>HEylCX)^oh(7jxwN1XuYwl~q0AYyZv@r;gUGtJ}`eOdY~#*8JVT zXYrrnPl#5{AC<4oah3Jw!zl}={IGX?-Tr-t_BS7@{hNRB_wRdZI?ndg=A?U;dgA>Z zdVJ(xbXAf+;*S@58oCU)^Qw0a)V}TC@ztqUmp{GSGwkbA$$tOD2dwzWK#5=ZcO5_V z*vdSNyPn-&omzk2539ax^c*O)Hby^>IJ{c#*>U_-VCfTTU4230t|tG1F4l7~JL?~7 z%5U)RIB_cTo~P?3H*H6}=_14|!caJq4T<+g};*_uY z9ks4*+DiTxH<8P19MRxMJOlL)W2KA}{>&zSK^JQf`b$dF>ka;)$g}t*by;1PRaljL z(q>hF@g$@1r8@sG$i{Fy5gexTblfnwx|MJVFQ~Udne=hfiI-&Ow3PdD$0+- zop@5O&T8UIGrD5sjc9(i`0IS!_vd{(?z)L@P8@mV)+M# z<|3>QVQsh0irJg^O7fnOFOJ;dySHjShHNp-n-Hl)ps!7#EB}N`k?Z+{Q~QfI4gd8 zqN2XXsw`2(?=Df+HY;yrV`23An#AC0Ctqe4hSieyebM`q+|`>Zrk< zwlx;)xA7nUDl!oBv`U)49^Y&#B0V+O*BNVJb*y(*B*zNzyN+Y;Zt*VBwO$Fn@4z=F zEh>9>w*TM(%hS|X`43IBJckdc#`#HYc0@hUW@S`T+xMd$XnP>a)1@DFA;`BplMbrR z3tq2FYWHN+1MMD+N@|bv_6MTeCA7)KuC$g1Baq%Pd;UY}f%!*O(t?-N0}Gy3!$VUS zB6T5B7a?`g)2dDAZrjyJtww4MQfrVmG_@9~wMa!@d|>g@ScPT2YtnL*Q>iM?6Ztscegw=2K%3QhBly!c@zP09} zU=Ol#6KlR4S2S_|#GETPU70xf&dCv1eL1RVba&Lv>&0p%-bzfs@h0^w8R%6Nh4bc> zmZ)ikW##zzk5l1)+G1f*@qgAN=G4q9oL=fR(~|xJw&7t(>9pxH%C4JPK5O=zitFdj ztE{@=#+z=w<$q{=aL$n2yrIK}j~F>>^q8@ikNd^=2@~@RCS7smgjF& z*s>x0h1Kts-I!ds!WwtirTZ^`;!xAiZ|imJS9AY0v+TB8oBeg;Cts4j@gIfzUikiv z!-aRguWtKpMERcS$A0#D<->RFzwzktb%oth?;HG^`zHPUtF;&Z<)!>bM!ea(d+e55 z{%_dvV2?bALwvYyj{BJ@qZrC#sXjccV_Xg4UyDHf85_p84ddH|@g20i4M7`*muHoH zg30oV!qT1R_9neHEPZwuf47Sd_4f>IKRcLi_;ME?svj5T|JjPq*-3mLYGDO}H#KMG z&RY0|bBG<^EY!ooN}F4deijZq_5|N4xE}yzP3-C)j!y`Jq zgI@cdD&rwX^wi(%^xJiMTyRhKw>5vZ{_TqTB>MBRM&?A`{hJ^87sAqGz%&rzYnnNZ!nN@1{1`7C-#ZO4*REv znLxxMp9U=Z8_We39b(a0NF93ssRd3w6DQD}IHW9M(eDi`dkFCNGKm$j=x}^bI~ym^ zP#mH|EIQ*Uw|yoSd67$>SmaN-^od125dA@7ODu9;Gg24y`DSahximNoB* zMSdOSbP7Z)^0~mN3?AqP9P*Czt-zivN|hoO{c2#@_xTQB+4q^_ZJZY;&|NsLAw%C=ml{(X*ADhxEQ)y3= zRnH^E{;T>o&wp>iCueOUfW7+$gA$y1*~iO1^6%0)FG6$88N@&CU&Hezo zc~2rFdK{13_4vY7ZaX`T{#Kz-ce$5B_=p(8r`W52lG|PzjO`p(7#G@+dT=hJ+ulb= z)Q1&3)hS7o4B5689yTsu(1u@%WjoC-wu-bJkON7jl(iXo7Pj%LwPpMu7-~T!v&#$Ai@ml~_|8`acUpU{r zy7~Schqk}D?b>&W-k$d6bw_3&!fN2lwk++vbmNkwHL+^J^JP{34rbkW&+%K-{dxY( z&T2{B$u7R{wkTiCbyoN2;;9?3=GoMC{^%9a{zFUgi^Wp>8uBoHW%vVrW%vVrWq26x z{kK=46!$JE z!2GP2u_wh_m__tA%rp89tI{u1i+10GnP3lNCfFa;+UT5^_hNh>VRpqwyP!D=T34ya zoimZ+muhV+=W}7E6J}do(~!6PVBMl!?U6qL`^ZM_x)@e|2Ax0E!$uV5)cm!LHMn6+ zU4DJWj+9;8*Ekiw74(lATk}q^?%b<+<8o^adQ8PmWm>`0)0(`^)Hv%%xtGvOCJ*7XUzw@&%~ z!uoWC)_JH;8gg8w*0$k{EK?ufM{TTY8Ui2Tx42znkoOv0r&-8zo79QF(@vY9eA8ns zUukFSU|q(JfxGw%4eQmn4QnPn(mM8KUJ>>znIGvtgkPl&<5#J}HOg~Et>wQW27Ltm zW#M;rA9+jp^J~$jFWY@7!Fpgpd&}Rsle)In9~1pU@wONhD0om=YXXNJR37}=>09-I zI$9q&EJhV}mOTZy&-2;&3-di!)ZiDeX#8e|9lQ^t>_gEg?@^TZca--h^q-EF=U@%W zdluzAiazuz`p`*rf5+l?>#Y5CzReTyOO3x@C#>GnNoA~@RmWbqVDuU7le}eCFZF!z z*O^{z96YVYS>QzGvImcgDY6@aE(r z&n?}wIB88g<*BYcRdz#h#U08Y74wC)X6usZVa4-5Pz#QITva%fE9-L?5C8ESRPhR2 z4TmySr?}^8#x6dz*on3LhSVXh`%sal>}B6VkBW-kXRZ0TYH*0H1;?Jp=(L6Hrfz~g z$z>f&%-e*ya@&Wd?CZVXlaKbwk3lSJ5li3$Y&-n!xA0@c@@d5KAzbrpyQ7HZLx|;S z#PVO50qR7idtTC-jc7a6?i*a`t@)3=1|rwDQ)69yo{^c+=GVbkw~4zyh?8r!WGCk~ z<;INo^2(yg`zPmIRfq^XF>rQpPFZqx{_~~hVc+WLFZin{`h@lO`j6|1qSrzg~B8fiLEX?3x9E z=qIvYuk#!@KG<_hm0DZPy)W+1<9-Tb8w)!JYV!uCVx+N#Njy{bS{z$-8+iJitNc5^ zI(1v;S#_&R2iL)?KG=miYEAZncYQTw7!$__$AzRd*Wp*g1-aIm(~sgCmvlsIWAXd> zdbG2rJ@#N&gK>Rn=JJeX{-_hDB43QgSkM{Qb5D#1{cug^VT{8p*qx=g`m5Ca(Mb{C zV|V-I*xmjS^+4n+DoJ&)9#Gw^B}8bt405>u2syG&FiKX<#kYzLsPLE{iP}~+BX9;aq~uFKl!V%uY5W7pubgd zG|sP2jNOjepGWI3H)>jpH3s8O%C5+~^Pr7!Z0Kdk-x2w@V^q$sTQqbGEL@{ruZtXt z(QDXkDiO2pU?=t(v^eHcyqIB+S2wxFtCVHdvAKEgaT?DOTE#pU7O`a1!CwkVg)?#NJ`}ZSvTYDY1 zG1#|kj5}92FY&k5q|{N5pW$t@A-I3d27QMd%(KmzVR2o}kI!C8scWqSYt4G0E3aJd z^^Tg9HaKrWTF)x4A~Vpd*XQt>sTf{+N=9#!I4(qWT)3_`d>RM81L2X2^5P)wg@Zhg zJ~+HMa5?H{E&MJ+Id!O8RrTgT|I}Nz|MAG)-5dXWbUj2Nlvb16=DdjSuBth4_x9RP z58jsj=WG5sVp#4QqI6cufrQ}&yL*njYxo;y{^=&)RgrfO-_VpgrdxCU!w26yd`FIF z)}{SN4*KM!$uV>GH~jtQk}v$T@%e<~{RaN<)?FtLy|`!2TeH@Us(f{Ge;+Q|9I|-CrS_Bbu5rr^60n?m6dmHZM$a7>*4kyFPM4w!}Cin zJ5jT8!JLvk4;-KK@FzWoAO9{~Px#zR=X7qn==xs|x_ZIr``6@rI^&XGdS>+)IHo*j z&aPFRi$A)5WPW|yk}l`|G4lJzSN#6_w5>~f-aRbgrrQo4%>K0Jfy)+q&wTUkSrLv|krgE%$V3Xc4~9+=D-T zsNlfHsM|NcHui_oroz9D+49ZKlK1Rii$Ya3H};!hnD{43}3QjjoEt3hyU!c{N!uNRk7cygciXOz2N8n{s&IG zT@Nn!ylG0%cY;V2%15hlcyO{XsAKqBU3{p1tkw_455LKWrnlAU8-w``UmkpTWccsH z(jVdApvk0<4%6Qdmi|;2@62;C`6q_ue?LrrM=(Z4e}5SNZWu57LvS<;t#5l>-xP5l zJJm9tql4ucetuZGv$s)ub%U)t9A!peXIkbz-0>Df8%fOVEqiwJ?IS?evPnp{ha<`(w_=T z-xbC?{uupFgZ>--Y*%@q{+$_|Uo#apEp@J1XXoYb0-Td0eQ|~66V&FA^e*b{5WchG zyRxL4a9Egu#&}KB5}wY~{9P{IW9P^1DD*u#{TWv}^E>^`NiON@cC=|3Jd$<8?ypBA3)X%Um+{%Qz0?AkM?V7eh_CID5(+EP2OKKFi37MScaa*sP?^Y@P9S2*y9QX|LoD(Qz-jhx>`wxV&8;rH z-G#pd_RPZxL@ai=wyeyNi*w<7fjtZWh*Y2O-dBlzR;BgMJvtAJ9R=iO)9p3Semq zVzFQ1k`s&Ei)?XSO-jw5aVp0Z!%()lAx&TXFuBnxlWOVwwa3Vx;>|CH!9BCJ6sH*WH*Cw&pc?>v?iXi@g;?x#q1F|BeJ(PAqa>@9|kUfrv#u6*$3`6N|hYICTI{ zpxHR$2WqIX=*)#E!Il$?{3c+}%|@SCYCvFPakWj|+5^PSRDCbjq)oeAV$mPu(&6}%I@shL3LMXl1|k;y zk-!PIoLJ;zfjz%8`otpV9JaXrM$YfX@k1OeI=4WcV9SX`emnJThFIhasc$pHBEN(B zxyC-R$d^;!mJ^HoPU`0wePWR}QQwvmi~Mft^CANgi~P6Lx8=klUrYUAMxR*Z>#1+c ziADYdaOw!7zX>>gq=Q9g3-j7?Vv#=sEY}FJ$oEoyov}kKa?Sxu9cAQi0;h410Db7v zCl>wBfaMxF0W9rEEIQu;OFI&ayi){xu&)tfk#_@@JzaVLOaJdpeY>v`i$0%|h<*-r z?0ON4&PeKvF?G3`I`%a}EIK9Bv9HY;z)~*1OGvrIqR;OXqJKN_SYv-auv{a=qF)Ux z*9fu5?*Nu-gjnPofa8W6n~wpfU2gD`z^OLg0vyi)8$>L5w*n{Fa$=D`2b}f`qrU@K z?Cb)LA8+KuqQ3_?!Il$?d@r#0Of2$4z~blIz+(R$$|o56?*Yg2p9zRq@_q=MV9SX` z{t2-3VPcVgMLGY0fQUsNf%{we-%Tv?cEG9mM*j@z-0EP_=?}U1KZyEvoU zAp5BhOJ3fGC)f{Oh(*rloD%c%dt_ww9WpFeX85-Hp~9IULcSKeQm#-g~4wqEU)6*04?7Suoo1D z&sfht#AnTiy*Oa6HSg3LtI-Dwt(=1Ck7nul7HcPq%T=>)oLeX>*z4CFT1v#A*Rl+(?5V0n>cQ zjL@HY#{u!0HRlFrWo$dHr+>#mLK3o4ww+5}Z?JV*nRjZo7U-R2ztoVP3Bb(;dK2(7 z9q&8X9b)W=2@|J`nlxp^kb(?R18AA*EKeOw{U5#~@jAu}T$VxVnvCa%E&={cX)3~* zIL5Fc?*UK*Gn($fIb81yJB=Tr$NSDG9N9QXUAvm!OOt?EJkvVh;G+h&y&Ukoe-#pY zZ6I*l>jQf$Afr7#77}}n$l$hj2x<0LG9br4K7)1J+Xj2QO{P6QTNQh}zjE9A0cm^| zCnWye1|_$>?_uvj$Y_txa>X9+4c+#ZB7x85ganQVv$rN5bBd8jdweV;_IQ8kwzmTf zI9!ZCPvFcjdt68GeWcSK+d%Bi0(RT$0O$EEP)O{}fPi_j?SzkDuNNAL_Rhp1_L7j7 z_9WkAG&hbsuPW+T|cR&w+K@!^s!u0l? zM(@!uy|+)J$Gwx?yW*2>)$ruWrp^s?cx+a4QhYOoe2jciX;)U7uadN;MA$M0Eg zy(7@$btJ?z5^o3GdNXj5Pi2BlqSrU9+!vvDjVR$$^dbS=_Ijd|v{r7Nou`j&V>9$h z!tBvbXS-ZUIyX*``IK_s1B)(GA*s~6L>PREUM}pp=hDYvoMb;uvUNr8DD?0bq~Wl) z4+93%<(i-?bIMAB^XU0f$WP6s&loVEUnUj3KRuVeFA8FLeYF?8unxba-0SI#-{EiT zJ!w7Pdr8XD?7_|G>R6j6ILB+zx~NmdE3hhO&!x(lzhymtNA~Mc)-lY491*#0$EhUm zLzpG%o)OPAX8!k;Qr&7@Ud(>puFDr>&#&;B-Urjy3nig>-{m44i;lCI7A^Y3!|(jCPuAze&PJVXT|JF+|fJu zhJf|_#u_W{mAnqyFb5Z9n0Ez4FM0dOZPxQCOL7OxDmXHiYIJt-ibk}`66LJEV?Ezy zbRlbk)oEzw&fJI*gDuAvS9n^5UhvoX=n=Zy6(d$`du4>X>^t$M0_NY4jvw^szAk)pKc+`SYh>iQ>QhN;9#S&Oj}IB;`Bv1z`Ni9!)y>z( z97;Tpynp1rv3tkAQm|+8i`VWd+A(eWrlsR@tnK*Uvdqd|Fx1~(wefUN(Xz(ZlHi(N zk5zN+Sj<`f*Meh<;LX~`MLY3!$9u)|tFVGA)})KYI>PlVsdz;XtN7ho%dhSXu7dP2&TGLG>-F}uoByw3d^_5-wD+=&ORN#T>Yb{0&7wRk&ll~l>3Pz>xwGoM zx;PGRK18?u#vdK`P4U#t%G3EGm9n}fZ)EVTkE915!blxCw7p8%?vIW+*>jk-Jhd4< zFUU(-?Wy_pRP*mvpNkbSS6?)|_}ym3F)pNGnBt06 zeD@6{`P#gNw-fHbOn!{uG4Dnc$L+*hE?rge7uEQ$))ijGo?Hie7$kc%ddLa(9%@b@CjYYmKMf)PGrPwpT~%@;uQM z5yew?8v8q=lwX&5P}M}C#Up$*>(E}uPZhtrQ>8QwS9^l>$N#>ik?WQO=L;vTZL5+V zwUtIxe?l)ruBYEK8$j5T73(a|T1-`$G()I=4(`!ZH-o)+0#dyf_1 zf*MHsVyimY$y&3vT5_V5@ZM2~SGeyvJ8u#E!V1ROHF=3He>YZB?%XN4y|+f5i}ynC zHqP25sKsi9o~omCvLIved5dadtiN;}yt=OVi!I7ubs{!%RgywGZ}-=nICa|<-3Fhx z&@(-z&10)hc21iASH5$E_fp~pXEsI0#9_An!TjDe3-N#5e1GI83HP$Wdscq06ykSa zxkq)&c@Nu~oI0(^+nq+v@0_B~vV`2_;$K~mr0*7zRUf+yPk~u>BwCVvFFY!_S|}6&#fo*bjt+GCw*W{NNyS9L2}FF zd#Ag;5*xQn>h6}geKnSyv-nPl>R7 z&dlScp2fX;Rw*9&QIV>wB(1PAt#}TeCe9wq-TsDX=rwpObYg-!RkJJS-fSyrtcD;x z)=tM(d4=U=l{c%=L4edYb}IHmtt?d&%y}Xb+Sv(n=1wo1U3N=hWtr{3HCI<_LKW8NL3>PK8>HBY)5~rsHO(}P$g4GmQR8A;gAevmrFm+EfS@El zDpkys&Muv+BmRpjwAr*W)P7h{=Dj{BoE{W9iuq9;Y%`T*mF1;sqCOj(AJyAVE1B)& z$i*A?*p#%YY~GC065X?0MYt97qXygAE9R9}mCTua^DH$kh#XnlJCm3Azf3K$EUH(P zm8g6)mv=;oA`YgW%hZxNX#3gd)fL!pb9SZ5)w~xyUIgsKX?D3)v&*ipDjiV*O%oRM zEC^saC~2v3o`<=MOVf%9=am%?nKK(tu~8z3r7cc!h3pCj_Qyr>#gdb8J{ z{PTL+iKRDHLTsdYH&vF-E6!JA8XYVB~V_M03N zsoABK^NI^AO5y9=O1(GfSX<&90tsqdjH}c;@#czBm4BYs_JzuJ(zrS0WyNLqwa2X< z6y~3IhMmRs3J$vhC%&;7E^+>ONp`Nns>&I2=3)p5%{N%YIsmSm7spu9(Xn{uhUm|% zNJAI6p>!^_)x^;gypu|cytt$x@>0h3L+voiC_7(-ov*mO42dE6hG@}g^65bn=nkgudit6>7i)c+&PtKCl+syMlOk+L64QlP+2ys6eH!V3R<2B#v9~p z&9=7dmk*gRPD&+qyAWk9e7~o}=EkylRkPEk70ym8DZQbrxKvFlOPi2C7X75WtZ;U5 zsds2uX?clv@Z8cuFZ#rdbLP(U_8K~P>_uwu?3=y1g|Rn{8C|U?u7fqHta8Tq34`-y z7tg)9Le~qN7yAs);5x!V-DrgkO4HJRM0>*U!RbNuGpLTep?_RI4I05L?RA!ZnLm{U zd#XwWIxq`%r~Zj7&#YnnGC zSK=f!haNg{s3L0^s%qDn$`Rqps9Tt_sV$Ww!<1R8P-VNGRE`Q$W_?1HDUmp~Q)u%E z69%V^n=m0LwA9>rg`wTT1S3Ls#?s<(RYe#@aE+V)IT#@GhInU!y?8;CrT@2-7UvE} zu@riz&6$gI@H(K87|7<87FVPX$e5e15yApwC&n64zf3z3HM3E_jC30z>&#$QLH#m; zF76Q-8PUeFVpS2x?}|Bd%Ew_VUgQh%h84y3PQo}-R8Y~dqS(=;hyc1R8unr=o_9q? zzkcZh)WxN9)D?aE_SgL=R+W^_8GZvewxrnYI#~|NvSWbxTsjC=H=%3vXQZ)vGL4^-rpI8Uu{Sb}p9r?G z=WI$me#E%EF}Z2!nSJcQMZ_v@+>9*gYWSGJLwHTXRTI^SHj+pegUR-Vha1a?wm}8> z=_r_sjS5&~!kDMCK?O2)5$#2R9tRb)`}}X#27@at7{}?i)^S*4#_C{2s*0jgjz*}# z;MpaSm~R&H9moAW zv!N%2;Zk+J}cnj0w$HYJj4C zN-!9an$HR2N4j`-doa?Wue8EUKZa~_lMf5Sy{2@dvG zmKPeI_Ue86Vclq?^L=gF>t^R>F7jR%ADZ9jJLPp$RrWwOPPgYJY9BiLK$MSa2kYzD zGx;-v_6=`OO@_2%n7?Oge|iM<4d2Vfhx&Jx)<+d=GQ3wOi``8_(_>8~CY zC-p-fOQoydqam+ACU^Z(g7!>)r~eqI7cz)>EY(k)h5pwF=P8!>IPGKdJN_Hq@joG~ zyz_K<=d%D!hVL&dcH{jQ+G9;vdA(ifYzK!f2=o5}^$@Nb66bDNYM5GyhxiY{p1XY= z|4n|!f5SWeUl8Vh_ptK1t8XK8acYe&4=*m^$AH1@PS@Thzf+#!o$|Vem6xQ;bK2YR zPJ0{PYh1wD@J@Rth1u&F=6_H1x!vB&wf`g3I<)uKr}f|Dcl5SLZFn&!K z|4kVGWEjtPj|>@q`Tmic|0s+fWcNA7D>R7Z3B%`#Ih%LJCzIYIEZylZY54s< zmKL zF$((Lm0kkur01!L@Gk~B;{RY~1eyFpRWkgGbERJh|KeTzw`eac(HM+R0RHs_FY#T& z_H*giu>D;6bAhjM=?{Z{M;7vRRs9Rv~D)0;=?M*~|i(To1QQtD~_|xgh z0P|dYd-!r2c**}y6wH|5PwT&nf*M>rrm(5iF8#gm?|xVMYWRnRIfMBp!@tcg{l4(; zSyy^@__y1|#{j?X(*GMAI|^Rv`v&~`GkBQQ{%u17#|W6wd}utw<2z7oMESfHW&B%( zj9g*@Vx9k1*t!^)Ut1Z^GQ_7hu*825{NeqZj8~cPCl|cLF9H6H2G4(4%-;j;KNeW> ze~!Y(gO~pJ1S(Pp9>r+=rEugrV99?Y{3{19`LBk572w6+5y*Hec!|&XaAYBP@xKe( z)0O`_wBHi&^8YCc{;dHo@q7*bJqljRUx9?j!Atqqq2K^`yzZj?odo~(0gL~a!oQ>7 zrTmMK@HTjewf+zA=R;sA?*ts@J%_~OE%=9L^}+JqM?wsEkDdQ<_;)UNd}wyXXf`9$Nce3@n!I9D6r92D%T?Jn3@qb5|EB_(*Hw(P$U{P)AZ`@l>5mcYNq!ApO<0ggQF;;({#FMyZ$ zmcT#0_l#`X-%H@%LGaRkU!dSWftT_QA|uxnllZ^1vl?@$m0L@Z$eS_;;}@ozMRAz)N}E;NN7I{s450Yr!Yj z?HdJuZw4>%+KK+R!li#7{9OrN`rmT+`+M+Qf~e*H^Fiub`1=OZrG7s6`#yL+L!th~ z@E1Rr2Cv6B_}d=5=<|Io`YihIBYp#2`s?7|5bzTJU$MQxL#*wW!@nYzKJO)Fg70Fd z4}yOST=}u;HD(q&{*YCyXBw#^;9dd13s}Fn*X?0RJ9Gj1UH0 z-)Zn~3wVS{^Amud!+}4|^BvILV5GiYWIW*FqfxhG;HCa&pnd-a9>wVVM-jghF8*#9 zvY;&bm55(^Frr@w(8a|M1@4Xmf7+f8wk~$1Ec79i3m-O-P3ONE{Com}ai;LmxkbPKo_4ypf#Fx1bb&+i_CT>1gTXM{_C4dPSa(yu|^nBvl}hkw_( z^sj_}yhjp$<5BQ@m;P74*m6DS&oR{fE|>l;WV|0d%;@?)4F4Vn&oH#So=2(q@b4w0 zd+qd6`1dh*84qS7V+`BKP9FfnXMq>}Z-LVpGdn#r{$s-W-{q7&t_}@=5 z<$Kf%HeUeQ*%(##=u}BRC%ArOj!r*U&9KWe`4iLtn>Y5)Qwu`uU!b_I2+8PoSI6!8 z7<)IvH)N$39}A?n-e zT11}XTB@zX|3UG{&wC$Y9}W`7>I7R(Eb>I)c=Q(%vB;Bw6KpxL$a@3Fao_>*8J34P zjy4vZZ1Ab*v!tOoQe!mK>*S`{erli5?@8Kcbk0_Nw&g8+Mt>!>@Y$BP@R=7A=tq6# z1qRYSbFcsn$B}0HseR@@L6G(t0v6XI&bGXT&mNt%rO&p!h0nY}0R5=X{HF=hJ~MzI z?X&G?4ER(&Xamt#S#L3um^TQZK{(=B2@tWgV-9eFEhiQ^n^x8wBo;aQqO4=cY-tPt zh~Z215}E!U-`&BIm#!z+a$=Fwb=mutSmfQP&&CH4i=3jk9+aX?9MV6DMW-**dg25c zh$A&gLmeNf7h@&*^e6Q~qeJ^?y$t4=b+N-6)aT{Px=>Cmb{H$Ei#u*COX?C{uB?d(4IDvGZyXgH2E+s_E#xPFwHdzLtMMi4L2xGW8Iy;v89nspTW?CuG+oLJ<#?sNo1EOOR2 z!Ip>DJ#7HB&AzS@H+CJ#%d%M(+n-qE>`Ss%AhF09GFdB-Smf+)QWmSqvPi_D!+yxJ zNW>x^1RQU-1+mC;fD>#vvB-6QxD*1Aj>%=G=?}I%JSOoh1jK$WHrWRfYWV|kB9^?o)}$2ix0Zo z(MJDAV?M^{&|O(mPsiN$Q^)*rqtgZ-apMf;_!DpYNi5~Y0VmjUVv+OOh_`R(h(*qL zCfM@u*rts~B8YKdS)}louq;w|Ol18*cT7^CC+iOqix2u*m`E#jyX2pyU2J){5Ag*i zZ@3Q$w%qN5ZkH>J{*SiHl}1Om%Orz!yV!nepRY1<-IuODjnB5ch0oWRye)jT+pEN29rNi1>zL0tP0Ve1i>RWuI*?z_Y$1O5) z);+G;VD=4>7XW*>;3|k%%H<`RT0<%3pW%q3B2;G2lq*+KJhU}H*6)x?h(%x172H<+OjpIL43nMGPp7#)6Czc=_vVqQR? zZ8)p|k=gUxVj}1j9M)zH)e+(?2ER+(Z1DTUPZ|6L@zVx>L(Gd3^gRyi4;tz{nyhCG zjzhP=W}BKi5kF_Jm-vqc_afeAaHNE0VC3_O4;ozU!pn&d z8Tm@$!v^2w!fS|+82JX`qXs`h{HDQA62E2eGsJHjyp8xz2ER!Bj=`*+^=E_WqV=x9 zJX<3T)@|{g!5t{KaVO$m7P8)@}Nk!NV#4+~9Go)zT!R3^H zWpD-Yaf5Z6@}C=MJ`U?^BBgYjeq%7tRjRHl%!+A$qAr7I4r!IOVTmnKU+|L99Fc!IzF7d0LrC2)?gi2p0op(uZ}20;2?jqw%$p9-lf>s4{0y-@ zadjK<1xCJum;)#1MI2UlgZB~hh6QwhILY86#61jtn;0*;linvzHuxjr3l091n1eCs z3*w6m{)U)0L7?x6FE*In!s37pVv}2G2D5oAdt$8~|1U9eJ^uGGm|?Qg4Q7?B41?*e z!%a zns|`GQ;C0Wa0xLDgJuv9Hn@T~$KXohAqL+>oNMr{#CZl+6Av}`4&q@3FDIt6HsLjI zO>J$mm;46p=48EFplEEd!R~TGQe5Jt^#FGuaiTEmm=Myv7plaf43|>ymn`O{S;wc8- zMa%}V$?_PW<5OhhIzGh)$06Bbqk*~-ml~{N#T#&t7l$?7U>z$qEGU(7PJROExLs#( zf6BRlGDyd*+~92R7AHr6blheeJeu-32J0BIvw*Ik{Cb0R4Cfj=mGXH8&md-p0+kb2 z8BE?P;MxA|{dObQb^n#Yx^K)kSl8G7anXxB)_PNnu?Q@gC+UHdUYoG5jSo^%%VD0nW2J8NOkHI?r_ZnP5e|}>ypt2|c zwZUQCXXLtGYYgs6`TYiaiPsw3gZKf1yUXSXVY?XE>%n6Q;VC!u>oZ^qmb_8Dxeyf= zW5IgxW%G(}=v`P@Ik&8+s#5PS&|+r*W}RMIImNX=&6EmRp~kFF4@1o6DhrE8Oqo76 zWFG-p!e8w1v*_k2rNuv`Xlu0GyMPw322NRU)u1V*v$hdZDHk{rIMS8GWYk`f#VW>X}xWhn1Bor|9*$8AQYRO#iYe#9jx z>XoQm+R`)h77{;_)xM@?m7Mm9WcaXp*H7CpSKUvmhv@bAQOkBunS#Yuik)3a3d^yk z-H$nhw&h|SEvqC6sP*YL(?}mMK(@zlP+gy{}+WCQw3b|U*i6odVPi4IE73JM*R zo*5K6D5GCcnC?IaWnjr2DanBj%J4bq4s=jPhLi3<7fN^1T`(xj=o5tL4s>J#xcQ3S zbHzdF{ewaWrDp|&4oc4q3LTWuFDOiRpo22{I_VB{P=?P*cc6nZGJ@$YlpYkOyI@e5 z(I*Jg9q7mg1oxgH3hyGp#QrT4vx12ZO3w@m9mG|Lq$@bkK^c9WbO$;p!{?+s&_Nj) zNDuRzBGbGsXhz+L19LpAWV0lBOB0HvJ-{10hVd9Z96DE zD=2hOdS+1Qpp1S&VY&kyl+o8occ6nZd``Lp9mI90r0NcIp>!wR1%twjK0%o7Ku0#f zC*~cL-ajaGPpwK}X{er@D2RbODuaoXT2W9x2bO$;pBg08|pbMot=`I)) zX7mZdbO$=J0l^Kdh{AhIFtL9SrDp}9gEBIM!gL2ZD5IZ~?m!1+^!_S259W1J~KdLC;H3)l~3@QV*?nV^6`Ox00UG$F7OXvfXXWZ{{RN4 zygcv^pos$iu?CbpEiVh02K4Kbf99F@a36bFnFJ)V>zwa-sgK4^^kIO?v2~o3X#fLM zK0fddV1UZU1^xjHPWmk0g_55K(sw_2ed)Wv(l`A}fj$m_h`uK*eKd9v{KbiVKeqIxp+iaR8vtR^HwD;CFS{D` zu$8A$^i}IHQIG35PeI=dV5T<{m+0F9VCs7m1pB+hiM|bxW0*U$!Jqozreg9H8Vv zOnnVifxe3keg6mfW$IfDeMpM$pvH4=LC(~7K`bbbd`O6W2LMcc5A|c;|AL&U?-l5i z@)&LCYqQdOPP!TsRaOP{xy4HF*6KjtC5FBN7-!nI4*EV4W%!l!UJN1AzN)J+1`Hm{ zcZ{KrLsOKlto^sNIn?Ry0JPKz=vM{=#kQ4(+s*I+K5wyy%T=o<=P>U#j0zAm8ss$NmwL|me8I36anPo6<* z@UWW3h_s_0uUdUyLapZxq0!q(5A7u0m~~%Xio)mykMVMfk;FR;n88KgQZ#zJ-^7W& z!C(+awZ{k7I!-PEQXlhC^li87%e}yHnspfdh`z0seZyx4`NDQp^bJEjH|^_$J~SP^ zlce94ku3Khv+>`yt-C)`GPyNVU2BS@V zKkY}3LvW_t5y-9aQyb(nhxwS7QSCPr4}ED*(RBIw{2vf9^;O|vwONPZkCfZ10H(e} z(DyR@Sq~;_Iab@pkin+D7oiVLo9{&5k0592>%@CI<){x$jc?x}Gf4df?5%s1 zXRrFhy>+7o%~DFHkf%w#+<7GH|qx9-&GfQxGPyA-5G-)gjBSU^MIQ#@(wO}EB zZ@Y!Re}==O#{0&TAQ{N+8->6x%Yu%-yrex+NuY{W*uib=x7g}=tC2oRL2j2j%t6_Z@-S$-{RMAR${5a0Zy*t zW6SWt@74CtuH%dHl|53&N5H!L+>n!>hig>GS=W5y^0w!89N4x0aQC#6b+61iG3VvE z#}~e|_}EP^uD#vunY8)Jjr%rE*s^R6ph%GtZsfZr_c~0bs9H(eoDmEi|I2I4@aXPYwI*WZhb$x^gLRW+ytgJ|%Q~7JH z@z=5Z+((>5RXn=ac@h;JCn7qtt7rMz+#Yvo{B*5bkv6BYF~g0u#E!S+-Sr*h{eLub ze~;+LYgcnZQ=2Xhm9qXkv>R;5oqGkf8jV{;~5zx(>U8}7Lw<;Dd# ziSSIUr6&{8-P z^FimvG`Dj>T57Dx4f3NRG^g@6v3PWkpQ;~I`t*qWPFy4I-bA&Fg z_ATmdsp`mTO^IYrPhon}kt(lr-gG-(NYXml)QY@HR57P6gUn7p=F5^~;>~G}r|V^$ z5Z%2Z)-okOcZ!>z_ald=9FO}HtKwnQ1lTnWc7!a4(F-v2G<23a6;w z={U9W5obkpgL5o#w5`@JFSm1cEIvQ5EV-onF8@Bcy%$b(JI(UhbG_S{<5>ZV5ce6x z-5Udsa=_RL1{U{a5q*1Nb#2q`I_%rowaM){gV3xe6`_4NMH(kyo<6AZ?U38~PuK4l z7}O27vm$XY$}>ejUfr=N{ZLn1#efq|>eU0Bc=&k-XM5t*NVoI+sgcA@I(H-KPKuOz zrC;jI-;Va1Qd19RIoIT{hIQRftZG$DRU#{Xs@7%PZl`&cZ2890)~=1Ei59;`x5Qei z&&hmv(syfaoLLacsj0Z@*EkJ(fD^fEz{l~%ujBk^Y=zYsx$6)A6>mJxjSSfOkw^V8 zKL1VlZT;}d?{qx>-Y1dc!<@W(*JIPryEj#w_Xp?hQ0#B=vF9056n+}>A%io;dD85H z<@p7JN92!c8IhlN_lW%5i$~^{jy*rWxbpnVTlco|l-r{A!VIb5S&3fc`7YyLc6$pm z+Wq^DR7HZsH&a3Z*o!XAXqSH zd4B2Oq4~uvL-UL79-3cxaZY~0*qr=Pl{xu&U(0#6_43vU8+UJfw7sakAuL)NoZ~n- zcSl=+pL(}9a_{9%LwKnltJ~WUKHILY)?_WBv4FXhgIvl%F6AJXa*#_ykxN6@7gY`& z4?Eo+bq0D-YeuEpGc_t9GpYpr1ShJhbI`e$*EjIAUDw?AIlGJZ@85W3`{f%aY~J09 zlXf>{wXyZy)wa-2&s@K>i(2RScwH=Sd!+64PafZU(D`^+)3?uGSGv7?dngod>~eTQ zYb0$x>TYuT-POJhcWX;+R@gvm8SvLtJwEVZr=|Phsk1iY zq~WxJ*7&KNh|@`%n|L)5oE_V;xgxR2$$OxnyJKJucDvs0wwwymP}DXzal+Rg@Vovt zk{IdaV_TocL!&G6JD+wc()UG!`_{0viYZ}A8zo2^flD*lW3KKTmnZE<~_{ee$=!=*WoK|V`f znjJ-lEqbU$pY%1PIp=D>^T2bla|ZS4soCHtecVe=IYqxFr1sZK5WrRbr>ywiu;|O> zBSg#V>C=ArHcS5Z27MoFp{>JliM{U{{_JC-y9ZYa-V2x>uDMiB*_UO|x51y^DIC8L zeH^b*PRW-VbR*;^!4q9OzWgJGKjV85mvSn6x#hpcqJzE3l|08w%>9kMIi(z?v12p>=%<|{BpmJ%>Twv-j{dXDu+!yj&mj6SBKjS-X(N|h@ zl|f6N3Ysvo5yuIo#cMbEY9 zI*V>K=w$sF&K4c_MW~}G*m;EZF7o9wyt(f_iS*L{I-ikc`K$CV^Zm0e|8u<_fL>E)#qj`HSzl3 z^l}!@0``$?G2$n^%c8l)TO9p=BLsd)|IDKQ-I6baUE(NTZ}~ssx0OoYIuXV%<@Z?f zA6fLDtneLH_#>A55X+u(E&nfQdIIze!RqyQEd3X2`gZ&dfra0+!W-hA{r_m$^D9Gu z>C;Q4JSozzS@H)hd5-Uhqx?)OesqO9#c4`{?MUQ?0CP-;j%h2_0|{3Giwv>IOatb= zt#mVRMReyLvB=y3EHZ6|46(=@pp5QJI|MvJ-%!LNa|C##<`WD5CE$o|?1+W`3UD#T zM(9rA3S%6C?hLNTJP&$U@8malj!tVl>JR}zWZs6jfO3!{^DaXT<=VS*sVv#>ad7W=3flKs@&1=M(|F(fo z1BdyLhU5Ft2;Jxti_Q;#M`}K?@bO^sZ6+2z$61Rx(E)BKaCn5m+^b>)CoI4bi~I$^ zBQ>8`_@jU&Pl$zI3|!0`2#)Vq;R_YM6j;*8cg12(K7gw+_}5Wh=fiwp$wOk%&+%lD zSq&_CxQ6_TmCief^Av6+&R3Xwg37*x+lWUi{tnZ`}@EpB}ylsBXVyNi+nns53&SZrYP5m~7C#G>bN;P7RNKM6l2WWd$n3V+Fi-rNe|&m#W{#lMsIQiXX- zMB)J!{q&Apsrbagj{+BeMe(cg6Im2sk>N8@WNx5Ly^#U~a% zo3IE4;fRILDlT>s3!lYbT!}w$%$mp&4<_yT$b1u->6E!i$qVs zJxi6mX%Dkf>?9Wb%){cVl)PudEddsp>kJuYS!9`#Ar_ex zfXf0Fox~zDoP2EqvGDT@d1B#DB44*N#KQO9-*i5h?{C}=LGs}O*b!;+%t_iKxPbiC zicc&$d2dF(srbagzXG_pPVuAoiL42*$gnDi%yi1!reugk#=Bp%p819hvB>bA6+OJ2 zBDdoY9I?pI^x|vDRp;zP{yM-SvjHr*zleqZ5OA1-;c$=PlCmHc8P<)G8TbR&jZ0*R zMdmR1Ivz!mU*|=uef!|?e%_+A)cnjMGICXah70UK&|fa zmZXakZ|S!X%=;t;^S-~u;Vgh8VQt2|1kPn_uEE4r!g?ct6yA3W+~+C<+%U{l{Ac-#-3IMK(~2UFiv zDB`n&`ZBa1?JLG*>f^aS>%bEy`uNFY>U-DFm!f4OWm;k;w(U%Kg>Z?M(!+Z!ay)0+ZHxkNBefy!0eTm{k-!Sk@eLJC# z{VUYRG8KJyp>CM^u0ZBq)Q3KfL74isqHlwJBGiYfjT5-5m6@-K(JYm#TT) zrhm&kF2+=_o>Gh2FUqU*N*ppRJ-0i%4GJ<(PdA0Y{rcB{%Ah(AzNN$LgCf40Wi_e}T;>}uWcY9JF z%yQhGv`Wn1sKShk+_;1J79j`osdhS{`gnM!vt`MaOt&*s-;p^UY3j%XJZ{}F@PG@;jXi9wRBDW)S`di4=aJ)Ogd1GNp;un^Azp(5H2X-tOM?1rzTF=s0 zX^6j>p2hI>Qt*V6h&>vLho5j@Yx5JFk(b_)c<)>Lvm(c{+=>a^PQ~KG*cmmBj*|-) z>+)(quA)rc&cW4BhEg))TMr;MPY>cvB-uT9aU?xGyu12qTPhbX7*;XiIOdadM`wOJ zKm4$hKllYFzX0>JI^8KMk25NnPiu23#&`1Xsy+0p3g&up##u#u7fQpkr(W9=h9&i( z(0b%E^|thEj?GG}+ul>(oAdad2Qic7vFJ5hpedF=_+cl|mcTr`J;>{U&cqxiJra8F zE0{5ePN9h*X8_Wd>vjgRk*4>~Mcxd+?9Vdlf(%1^F~8tp$BlLTa*Q*mx+wjfErS+U zy#Im|nJ~;*JM5h;kH3yuIO=I9zcACW=g7qTI_TXqJ=v8lJrBfGU5vPH3+AfbiMeWb zVy@bqn5*_J%vD>9xoT@OmzQqL&rL@jFhqIl*2?YG@$hlfjgGVsN+xw?rt`h}-)%V>XV(Ljbyt$II zo3>QHb6dRexRY8Gb5ahaj?Qwj{n#4_I?{iE8G25%Bl8z-oiWER z9t}Cis-_)rJ4NI2+o^H=7-&3_`d}tbQ~C~Cp#NxgU~!-^^_NT1(MlYinh}BKj`ZBL zU>**2)>U_ee&N<8cKEY(M9Z;QS8D`*xEHJATMyzMN`&HDpKxj_5u&p62*Z{6adx#* z+pCk&+9Zx93NVvR^vG{lt7!V3)IpA1~uF5MY|Om>_*b}bgaVN!8xFm+tCy{9l2}R>Bz+MoVDk53`j4lSp6%c=slh>KcJ&6y)54ROXta9 zkS5;xOPw=l^I(m%dADpy_;c0V&L{D9(9xcSCrE9Iq`~dU&z$j-)P!Mw4oL9O5ILdON{rE)ac}AJ=Xw~w?5ih)UMtb+*coe{a&Y~cRgC3 zmY$YZ3;dM$R`qnX(Kq$)Lv9>zX?2NRnE%LG(&qC%v>;`@rxACS(wywOu379k`wd|3 zbJZL7Z+y0WU+dmYn6#y5>VQ5fGyb-fRLurS!MX-$i$~yZwv3m-i6m^&jTF`dfOI=?Qk_Ko+ z9c63H_nY;jgQw{&TT(9>=&ZkFigOb4D0j6@+u-LT>M`ZBefuiLk9OZ_;#&$@<;Gj^ zygNH@m@`+l?`!wUY?HD*D6@f|T4s1}`}>$zW|L+Xb`gJLnvW^6fAYo8vzd=5`lg#%x{Nt0;pv?yB8zJjg%3V7@X1+)Ww|8nZKbP-J zDsPf!v!+~sX3D~;$EI>tYifSTd1nRhi`4w}US6lHk0ertuWQENaI*hT`|!V@a``tS z0|pFl`Kh}<6-&e8_&!d}&%pYLRA)VoUcK<@c=MZ1&eid)Z#wr~mAE<{{)6M)X#@Bc z5^o;h!omTe@a2hh%|k1fuWs4@(yW&KEVp&{x-nH=kx)AA38llHt^`|V+&6rG!<)^a z%5}|4maSf}bjhOJ=~MWna+doGSV#9h(j<=aR5>;fxKt;ZPIF#C3tZ?6D0-MdC(EaM z^5_!LF5TgpM>>8(y67!Vme26yOFaqxQFNX~2k~cE;j_H(xxT!jXIXTeK_|zb?S*Im zg>u=J{&PJ4QR0mr3g$|@*Ep7>FX>ym`AL_-)H%A9*-IRS&Qzr=vOV8b8XD< z>6X2m6Jz>Mu;^gk@Htj}2z%v^t|RTjmj4jXA1_JT4YB-(dj1^eQcls!gv7i?)~~4+ z{h~#4d`>wff5xIWSahRBZ?@DI^w4qcOA2OxC*Oa= zz4Qk4N73t45d2m2W{X~J(Hz%SPRYM5qz=EsqMx$p{T3bEPfFjLmj5Y>UgzhBlIPql z{%bvgC_B z`JlcjdV;9OC<@cB`kBd8^p%$XB!f=2ztjsKyx%DLB457LvZu^BtnVd`8@brIh4ByZ z<;$G^G~UO!vr95vVbS9)dZP11t)I^v&U1fG>nrl;H0STwfv;T{zr(fv1;9fvV)d~O zf2l`jIAKlSQv6^l=Rymvo1R)F0B-+Fo)<*AZw(`e`BX zOM0fn2aMRAuUO$ZCsiEfUl#(uq=S1+(eo_%MOOa)vlaeki=JlX*Ckf?yR7^_$MWA{ z>Fc%pIqoKo_Oo7yBmECa`7y#-t;=%*{Dz=?FSp8flVxwVR+iz(U*s&;@o~<`5GU8$ zCrgWX`S*8P-&RjP&s*n0|6v|I$~!ZVbha11!1=&R&u_K8qd`h6zs*T9|nw9=Go@~m*~0mMZjSu2(BEL z%#~+cVJd)&;wsStn{4|9&jJo(JeclwT#+Ao(8FRg>us2gA>3wMGMD`xV%>P%XYd~Y zF41GDo#f}@58OkzWN!Ks#7qR-Gq_}K`T+wUAs&T4a4+I28SO#m75vD2{nrfq7O_s_ z?}1D7L-1YlF-A@I5w5VdjdQjH^WKuV_!p7SNdj=AfJ<1&aK*&hhH?XQ{zRCS1@21n zwf-vdwf(gQo^Ie7l-D{rc3(0^>EZiwF$)&%Uh==7@B_dRW+WW3l+h!U*YQ3I9A>41 zdjeSIls`kP<2p?FQYCYWd_6$U_u|OIicc*1`Mw@5Q~VEzF&<6F@0t=;Iyinq%KYyk z27efEq)W*Vi%zbQkg)VE9+ z#9vmJ^;YUUvDn5e4qvHco~6vA0T!9(DDxG?KZ>7{sKO`k6RuR4byD;bOV|%7GfBy? z9?JaYA;6IzD?YKvj{ugq3MuoLk|7qEGV*_-_{74G0?Rq`UY(37nW^B1uTpp}!|o2S zgl(XV$5yNh=u zYZZSwej-;n|lmc=JI;&^DHpny!QF)3crh= zh<>wQhZ{O=X$nCx8f5EKMEYyHcTg8pk!uIz9+yUKi8071UzEDk|7qE2H=sJ zPb_?XS4DoREimg;<%D| zj{JEF1NPZITm*jcVkP4}zrLYx5&0VPv0cmt0Im#IM5!cUlr;ilsfdEWM69hOx& zyc~bvXi9j62h|!CEpt0qB^uvBnUzY0w~E+FEOs*4B7YRPm<=J^XSmKJ3ugis4_%*=AOeow8T;ad= zpm%;_iPq0#2+jbG98ogFqQ|R0cPhST&$kr50zctqh53jLw;BR`?(TH^ zTwZbWywx~Yaq(^bO#c-t7tD({)W>h0hm-kMV_v`SgQE)T<2Zp4NAfi`Ei`=?MlIy% z!=rJ*ik0;eq7jnyYZ`e39~F>Xa*I#OA_OC*zN4|ZDh|=8BY-VSablz?%QG*1L&X#8 zboz)`r38yFaH3@63R$!xf=n^4mH25~xl-q$I=QotH7t_Jo`9$bY=MQJ5)?=BE&CL2 zoTq888Il-~jsA)vSsK*W5}TXVQW_=*hY4c&QPSy&&|>pUHs zSC%X4Sv!~>a16HEFA15rQXWR+=lW&RUAqw-pR$90+=Ll}%crrF8gb2(A3)l2!4B zQfzFzv_4n`$BLd5$}rRN>E9;fWKr8D)zZ$xO~NH}jJuyQ^@`@R#gdkNNq%DsXO@Fk ztX${CRSakC=G?dWx+Uh(yu1hfqGYS@-5b2!>Ct!a_^pk%>Gm>NCfP$WHPEWs*yJ!G zg{H;}t{Zbh^uM)+>%T(DYq+)*IZiJhz}n$;(sS(pBNi{dr6S;qc9G~w|?eq2sb)LXwpvmXO=lm-GroIO7F2E&D^!*BQ3=`EJg(Cxf zOq=NY0|J=(TH$x84#OYO$GtO5eTxizd>0XY9J4a@Jp;d+s7O1}7qawqLf?GIFulx2 z(Z@Z?Onsc^!}mCGqHhD_O#7HAe8;0c=9}o-X4y9Z`uNQ$PT=1FnEHl8-<#l3AK%YJ z-#-DE_I1IIzUskKkTdl;e-+rr^oYKLR(hWR&G^KLece`iha38aKv?u~uMX3`{j^V% zKu+L5$eH$)K_9=rncks>zOP#Pj-cN5mEKxQ-y;_X=^bY1TWRUz*y$lL%CK*lrSAar zWx!zC$8whR{?O9*eN@iA?Au}KJ2E=354WDLuMzf``S%d?ZGgWxG4*E1nfdn`^tD2W z_VNA{`w(rCzOqcU1`=$~i9W_@>T4(n?BjQ&=(`z$rhS(}-vwl7C;AqHXX}^MBfjKcep>giL)m zj0x<6YF{7sXfyQ{^rNra(znXcS7hir4g*Ym)zCM!5Bq)rIn%z)(6%}ec20rY%jz~{!O*&OBji)fe`KEcQ)ffQ0M0;2-?TK z8@j__>Y-hark{7|cttQN; z$HjCo{dj%CdscAl#AmHxEgw66f?DDF*=tze)_Jbpi3$;)>zM0Fu-`n^jUI^>?Jqr0 zAx&HJyn;#D+oZHTi;OzE_P-nEFX}r6`Ux%XS;FksKNxXHX zdIc-jMPygjRF*zhbg03%V1F!F0s7l58!F9JXB}AGxO_F%OO};y|2XHCElMwSUcP}V z*b?cH^iXhlg1?BCs1+7_+sNNY{c!Zm<>FH-%s2oH8})_{74$0=O8B2p!u>2}>+8v^~t5ACBpX z=$A!ek!b`j!M#hzXRqiX78$m;5gG|cEPTFOMTU^8o_E6c^bA#eQxD%wWIxUcz_LFa zv4l0gGaKhM-ipspd?ItlmnF*ra-4MI$sd3&dO-s-2kLj}$1#P_F86uW4AJixN(pwiSQvCqx zNpN;wz@M}I$*ri=x(a%Q-GI8*YE*QA2jNRB?@{AC>EMq%yZ(0{a=c%~iQF4tuv$m8 z$9x#k3Vbdu+Cx7+Cl}%}dYlyxFfK7dzx1S51IMK&; z-qgo)6?v~v-vI4L`$pk1^_7BPdm&Er;d3iVANTF${ZD7;L`HqIoo*?JMGAU< z>Bo!XWBe8OqDg=$I+H-vRLYaLBlO-UOT2TYxU<1E zTl(7n;#raEx_BWVq1@RkznfpPY# z&biMmJn-Dc{jFDS#!egUguIQ}Y z(6^N2KwlOh{`M<3UcL#dG+V0>d$97C>uU=V$Fa8lMBChcw8s{RZf}L;2WQ7m8~cj4 zdgG+_XE)*WosGNOtB~74ycyl`(?4>)JhLd&x3+@BF`ON8yloCn0_sabEUKwI;+MU8 zXA8wTLd^r@O|7Wa?Fq_Q&asi*REkK(1Asob5I(8f1QiD%EuF6<4mN7b}OwPur& z`zO^@+G}t7PMhQJw($R+woE^55xfI4MH>#H1i#BS=^UKyvt0kuvZ<9DDv!k0Z9gZZ ztUdb<>#O9G>wL6w()Ah9=~a(zO1XDKH%`KezS9(M+~q_PT>sDd547g&a#poJBbu7u z>U{Pckh0#j_PRlxZ^!O7sPh}5FIGL;o^mhi`-bQ%(PLP#&AU7K9>$l!U8;_s#c#%L z5&wuCM5?fZNELPvslpB-G3+366?PE03cE#Im0!5vD(^(6))y?*+ePN|gIKrgt$+??okDxmz9HIL zg&jdsF35;vxT!~RZ?sge+vfI$u~&$bGJN

=JU^uVpO7cd&y5)|#Kft~j|pRoJVf z3VW4QVXu-Z>{W6V_A0pwyE0_c!KvBWk7IY&Evqe~wFf)_jhDe0TVBoPNxG?jZU# z`*X|xC42{7ZX}A|fn_>VvXIIYygl$+CUB|F!#b1s*^q*_t7QL>lc@`NndhHw`KLQO z5MS{AsOUL<1nJKEI{Z2>e1;W1!wWylm(Ot4YI%N(^4ykWd$K(F8+`dJr&7zW_T;lI z`D{;qnlGR2?9=jmzez!FeX{;@{BtXcJ^!%fANKU+`TD}nLS3nIJ^3M){17Lh^S{vZ zA8PsI)J^0chEu$EajwU@5%k3d&39iqzN@F;i!j;VVa`(RKh*O-&+EI-2eZc_eTVEJF*{I$*xm46pm{uf#Kcac++lz+LF ze6F)h=by4C&+^Z6W+1=No$c*S$o$);^F!75QI`BDXP@@Z@X|Nh@*nN|S5kf!SpEgh zx3s^yUoNryFL8dY^QYa@UugLkdg+hCPdP=`2#HlKyr1S9w45`-I-i14OfHWiPrk~R zFLLOe-Yd!}`VJu>&-nKl^mlamsQO!K=_~c*^L+VIC#L09{+C(u zWzMg)EQ^)pRfzZkXVVoPWE&5W6{sQb3NBJKM zfnU<+S^h6u_WYwof6t;XwDjF;(XU(b-Io8KEdTL3y=9Oaj9w*C=I=bfB;LoEDZz{Tg`58Mb`k@-Xliwv_bvcO||_lfY?Cd(e}#KLF1BQ8+# zrVZ3HQuB#Lp7xB;70G7Ws34<%|eo;nRLu1IG3zvIu|Rh((6>$oUVZZJ(My zU!WG9KZ^q_I=%e)hT@y)`qcbkVZxaAyvJVwN-hb!%=c| z-PZR=6tvh`3oL7a=q=}05R1%G%2eSG+$vlpF%NomTktlpi&FI zL6?GXxwza2k?#M?QMeF4E(5_8<8o;%oM*!{g*_YCi4N!4kn2HZ0}BMsvthKtx%hGU zvH~{>my2;)Ixj9p0_Vk5s<0Q=bcN4~Ypmku;^)uSS=WzFozY$%{!iII!-#9V!d_lY zRM^WOJ%H+!k?wHKg|}O&WW2npR@lp{$qJ{WrDqKaM{pLp4o zmDQ8|fdkIGYrHwWa;!|HHYOA&jYoJhs*{5GLlw%)n|PZfp!CWdU+LWsVmxbpuZS>W z3}iH78Z2ft8b<&ytT~_e^USVg7<{D5$cihf6agr zqfTF+{{8u>iMzox;64L?hBs5|&BC-(M8o>@P)Y5_i!+HiTeDA77+1fZeR`-AdK>rm ztMSu(m);sT!|7?ULDiwT-t1*HXl40J+4L`wG$p!U9iJ9Hm@Ms0qSZyJr$~D&u|noe z2XdH;oy4SM54;g2N<~uQ%vn#o_*GY zKiJd9SR@Z+D4nPe4Jn-<;M0$LnCgYXNe=(5gB_~yU1NMYIp4&C4mk3n!mbd^FJ>`tf=8_aIDte2lS= zK%D4Hg^(%7$NMr7!mr5v3D}Ic0rB!t%6OSJiTAXn?^*b*!zE7i{cp&b`ksM4zD80X z-z`KR#{}`;&%Y>$HK4_bz7^n``aUr9F&{bwzLCT}=C9~` z!qUgR@#rs3?EA5$uMzsB++eD&@5cxLQ9r%jIgz3azoM@Tz_f3JVISX@#J(FWeTzZo z_Mz|Vmc9efR|dICT&y>u?^^(-eQgNGcOY>fJ$F0g7$&Mn=UwQV4@`Z0#}a)ft$ND6 z*5qD+n4jLomfRDNqaJY*??o`qw2$+Fi$n;&B6mK7O#5aa(?-Fc_OV>VzDxu#^>Hpc z{l$sCGyqfI8t9Yq<*T~r>wq#-Ul!8USAF5038ucShCY5Th`uJvzG2W;EXLti>}#~_ zdkFfZK3`<$8)fO61bw-E==&>6-)qoU2DwUHlo$Ir){mt4Wx5dh`pUmJF~j=^X|CN?g33B)wm^^j!gu8{jWa^l=XZQ(pu0v0hOh>%ZuG9T=j1 zdE5t&Q=r9(zEfbB`c^?-D|pn$`X&1AMgUVE`#1Y)4>m*2)b|1ON&PD|^l|?%Q(q_a z^;N!X7fpTRP#AK*u^x(j81MA-m4ipu1^SB$dVd)guM%CpQ0uu@AV)posE>|kvzqZv zMZB%xSK{L5s>J((PKW5rMx)l3z5`Y|UWC4-S|2}8Mc+WnzAO6Cmu}g21^N=?In7U8 z(Kp4?x3nL9)t0`k&?olsGgmTorHJ?sl}ML04kNjQi4cdWJ&Wwr7{DRXl z^GiQlZv`pp-4IhORH@85&6&?KEUG4o}of=-$y*=kHRFlT~oqM7$a29*Okmo}mp+K@?zOhoHo^s zUH4u0IBH-aYFHs^SRrcQ7}UTqsDWcp1IM5SjzJB)1pb%6{}R-|OY#eTa>;X>ak9e} zoCUCD_oheNu`(cxe%_2onv)Ua=50-ptWZXL{tTR$;iSdqKj@;SA-6p4R?PYi55k37 zxpk0JG5#^P;!BsLIu`d19M;YGKUnX&!v0s$f(6)K2#% z%+ot*NIl-VsB+G>mQyT;z>>NtXR3G(N>OWSv0D^Ly!%PVAUA#UkdEwka<&eR40>l! z*Y}nk>e^oVT>18*104fD`efrZ8-_~E8;0&kxYa_jlmkCSZH^T9c6zk{v*R}m-8>|j zOUuC>oXp)YG&?N1-QJU}@%hiV+2Nt#Je<1_@IM~fa_ZGBb2kSuA4mFY-D8`w!?idw zK_nkH($DKiR_-4+48gtZ&!O8eIEf0IR0gRuNqZezy)n3_#-P<3 zgH~@0TD?NFdWC593eoBnqSdV$!E9dbJTgIll&Y`NMBLka3#-meWv^a7Jbs7&3%+Pi$9qj=v=I2^PrIHmE`-T8GNos zy5G+$^&Z-(W9ARvORFvaxt9MO7X34e&amhp@0EV8{Se3aj#;$SwK~*cu8-0~XkHM? z2luAZcfA$fAieZ#mB{eR@TV;LhZfC!_{34Zz@o?bWuf%FVfnLn-4j9?v9}xIP5N5s{u7g|tO353tA-gD-m{PofMz(BOzgrj|17Xn>nRtjDxx z5o_D#07tG+GQ<*=YXl=-R(xXNF9R+{e<9r(%3K*>k!dz$+9>lCB||JS>_e0NmhYoX zRLKyF%ua((Ec{2wuT=8H!e<*KdHalkyMgg?>AAxO|0VK=DE`~T5rx?nMOazjh(-S} zU@6lP#OEj(Z?8oyZ|=3o=c>q81D9xd?x`5LN`)mB{mUrN3JZ59<)P;Solu> z%ihk<0L$LaM}fs=Vv&CtxR@X9aHnv|{?Bg%N2>7$j#%V*FBD%uuH*a(SMfz2bkbQ~ zxe5;fmaxPUHWyg-Ugq;Ke6f-*1eP=si~KmsJu~oid|T*lm=l4Y0^OV90b5k5)2WhCH#z?>6MwE*BRldDeN+Pb~6>4EYx+qvyyF zi_FWw#oEqSD1V94`6lJ323X|zt|apB5*I3&k0^glfJHu?^?Z!t4*~Ye4p?L^qRhog zCXcvC;bP)qg}wVu*BSG^XIm+ZKnZv*(c?usT) zh40)_e@nbESQr~$(%4YHf_uct%23YuMUzla|N4)nG;t;6l`xlt(CCIUUVxmK@yA&-Wafc6&S{Nx&+WES%ke2 zS1(w#+O8Xpv_tUv*L9jU*0&yz9r|)|v zwm`V4anXWR!MMGjJD+p6GSQ^NB@N)ye#}hq(-UOXyriwf`p+a3w;%czz1A4Bq0mFx z$M}9(uBzytM8u)He$>-_^wlWHV^$djk5Nf+zLybxQQT4{Yi?4jH~nixYkC zfMM!eiuZ#{!JxhY+K=|F#6^9&iE;{&L5o0(qaUwf_`_dunezn$eqNBihR-?d1Pq>21z5br6ZgZ>k6F^znW=e;;S=x+ba{`O19Rg{0;wZR#f z`^)&o;bMRL`JlLlG37uaK%4|GIiJdfKt7aKfgV%C2n>xsB(~7;Nqf@?KM< zH54w|=5{tUMbci+%uD=f`mz}(XH1*@?CjDx-=A~N^?#bOZ0gCWgV7^?PVBv=(bbS2 z&ht^fACuEMNBg~jZtvwY?w`rncf8cp#Q3{rc4UXbrQ5=p4~6fp-r@I#y1fN6566mr zR=U0GrH8^>GYy}finQ&nd+H%KeEzsh(^ik)nQ{IRe=il!`r&Txu$c6EvG=>C@~v3Y z>W*16osRe02JC(Q?&?TddYI=ee;A9*8t*J`r)3e2Cu~LE;QT8%p0IVFvv%X-?>(F{ zZTp}t@%fK9S-!2eSGUi6$d9uqR(th{>Z4a*S<{ixl5Y04y1iNEo-4gqR-coem3Sn4 z-0zR1M9{bF_7t@SvACTDGviLec_@6^++n7tBXkPm9(x?|&1wtsihYJziDLgu?Dv}7 z9+r>jinKnMiGKA$H+*|FEOCx`rw2=3an7biTKns1 zzpDG?tbdvFi@E>2@aKzvcGC;Xo`-eqS8m#e)$!$m4lITx3;p~r z@<$~WIg#w2I48GdUb7f0x2O3MZf~(OxO%Z)_HOS|$D~aBCdMs;zUKJ+AGwKZ-iCC* zb9+fk>fK%w$D0RYkCe9^_BF46F64~=HhY>wA)Hqq-tHs@#kbz#&T5UHy4{`Ix)kSh z=lM21-rgR~`|k3YuO{4{RD{(1)XfLkXB}$U&syzPxt&F=4IHKNdxYOiqVf_SPQPi! zi5a!C_suSvbN`&I>pz@w)6^4FYp>aN%^2kW`ODi*?s#R_iNh}+J$~$^PhqsbZpFYCZe&AWM?~1;wlQ-q>jpVa$+4BJvgcQSX-Vy zs>ITmX5@t1%My5wWr)Y2o|Ko(XD|~$T0?T zc38J_Oic8+Re6c`r!Ssyd`9)`y|WAE+&d@z`uC?So_c(0^)-91$wVF%wbiu!VUQcj zc5-v4PnuFyU7lNbZB6CaF}eAp7hRs~G-A8k`bEy-1xuFVhtxN3U12^1y>?&z{7?B$ zue|o!uYa|!%GO8P`7{H>kbZyJM<*9Q!*%zN_pIdelGi9)x|_y(wt3H3K1k&P9BN$W zYcKpbE4dc?bGZL6HUh{m(t($*-(XWe+URZhh<&zt~Zu(DgZgZckuetx(f0+F1f_%C4Juu;Z4?B^LL%10%>!B2e1A$_MsFSO{n20f5B0UVk?)cF8x8*#W;dHZ*u+4aWu(sc$qvq6^`bPH(uiT?^6 z{)K0>7m9TmI}f5J&$PgupLpL)@cvSDo{1 z_;K9oD~15&`MecJ`iGYO^%fnp4JtnN?}=mhdxgL+=_Qu`Z!G^AmOZjwo?;CDI~|^O za^JxLmc9%tygd$fujT(cD%Otr*>56_w6w*e5N-&+>Meh+KM+Uxi589S3V)o0So$4H zfn{us_p6L`5R1%oV1En>xJ36=Yyjro)^sdKIY*RO!rlWc=ZF#u|2|;pqa_x8C$Nm& zJqj#icl&{5OoLeD4^v*hki9~gYW#sC7Ma(8<($&Dh_%h{0!w;{MV{@djK%RDm-Mns zWt@RnJ0T!88z?VEf1sukg6Wv>s*X2tr@@IhMtk(}Huj|8~h;`Tu+%FMUWH@388wM8n z;gtEBk|7ouj%gG}6u%HyZ1cu9w0_>-!snPqq)y2biyp2ak#WL2ct@^PGQ=WN1YE4w zDwk1ahLRx`nJdYksrbagXSFNl0}*ZxuE=>F^svY*CV!UV6AOPCa0wr_+DTZFB2x-1 zdo&OWzl!|X_yb2Qd=|f)i_7eg^KU&HXds+zgNzxjhM(-?KrA}h4vI`GW%PrMSY$RE zGFvHg1OC7fiwxTw(bEYm_Y1MeJOnIf+de@VZ8NdRJOeCx_ESdNLo7008+8#Fa7S^8 zJ;Wk&99Z3qKdZMii>B#KLDZBQ>8`_+*V3gFkS@!Y>9MsrkghXPqCx z8v@R(|KmW9)O=!*zZ7`H7w`v;Sol`}kJNl(;YWc-FhaN}F5y=JkJNl(;nx6)*$0GJ zWHysO1%Kd(g})8BxSU*!wcwIxF|o+(1QwZHz;Z5e7w`yXJRGseKMFij^NEGO8#po_ zf8dCPzYjRf#TjtV;wqWoL8lu(;fV^LARepmN&J-P^u9_y3mNVWTqE?{9AeS`7Vt>T zCl>zifyEwT;lB@DqIG^qnFaU*M=Ua>7%=~D4b_gvNbSvw7MIU!xMe}S|0BjQ`obaI zmF1r_)R;~176t8{$~BM85wJ^llW18{E?&aZf6)P zgG}B#oF6fr^CLDy*Uc>5zI;{O8Sh5Yc23SqoSD9G#<3ZbX78STF~$NX1>=T2U5VO2 zZ||fS*DLOEQb%Vx>qk#^ijI}ORO7F5TAPzMYjd<>d?!{JE#Fen_H;C`y(4rmefjD= zoWC$Ve)^XV?TDnMUFvq;_T7!1&fT%ddwV_^UCkL8b+LujU)$pL8gX}Gcj&Yb}e?re8Kg1uEyTk%_`{#>r3efr0r5l+;k6;~{*v1ubgJu+@(K6ws zRn}f zqq1akp})Sh&@X`uf2CWYk23rmcTd$CIa7pF5Bi?1H0_#aui=cPf|>6$UC0?r4J`e= zv!BHC0j+^^VRf+f&h7nP=F#IQAC!nW6NGbX0;#<-ySn4eF?Iip=_fa4AU9BV9!r|( zL_K?F7R(A#Moz)Zy=YCkj`t@Wq~4a^V$7o2JCpOMy0$-hJiavn`x$dkJ`6cw)~;ER zEH|abG0W$7Y!fkyYmYNwW@;>iz1Jg6ub-RAoGN2Z?V1y$JQRv=?ebEP2(2Af=a;g& zC%iaju7{4o@E>!ewvn4LJP|W#NpbG*H*s$Tvsow`+?8GX-A=PruX}0Mu{kf!J-YBn z+(~!5xon&EZYtl5^}6j@zAcZpw!5hZ-~Ghx;R?-AEVx5>mlw4jH|7Asbv@L5n$LWJ0*8+sLE-h3OZ*Fz!aGu3NZ+CymFSjR<3sA_<&#pwkb$e4s zW0m#jTBqnx>EWQ39gD5aQBRdywwUSfTX$wZxSLGwABH|L%?Dc7HwvT!P&$gB~pU4K?dPWMVu zr=-7Jp}lp92T?R-P;SDGM>{AyhZiys9G57+E(Z^W(4hvtKO~3O1B4ZLaGFq`z!QY4|SQX zlH0pu^1|AR#AM9Qi#yxV|LMh*73lS5JR)Bp8AGhFrqO>sV6OvbhkxI@y*z2gTp6Ah z3v`D2)~QocW~Ri832%3Q&Crq1kI=%Sc7;NPZf8Z?6Vaf3(k&;g>xqO0qV6jTj^k_& zDOu*d8*@8vT;BHFjsv^)AMT!ZvhI~xCpb^BXk+Q&$6F6Nd{eE-n10q1^;qqYnO*nS zWR!)E2dP9ptM`w*#NKE@)xA~elh4dvIOo`$1<2>TncjO-8f~q~2xpALd#xE3^$7gw zcrqB=-XSxWuX20-jCa=Kr7t)5&*8N>`)3`C4Vl%~J!`%t;$5}q)81GY##Y#Gti9A* zn>gN9hm&+9M|mfBcRSt<3yn8dS4(qVYam+}y9dwKcbZ0T;S5*4Z9F(;$!4tqC3fNR zwxc_a>^gk-(9!3P9XP)KL^o>vEACJEblKNBVN+2%?ttNq!;|lTg)>&*=?*@2BQR?q zC6i`0`=#Y}@)>|Rgwe%S$E&I*@10ywdv9&}l+h@)SLZZ@i!&PicN~-j-c`KW)!w_x zv6(Wf(VShq@at#3J~bmFT-x0do71+dZPtco{U_LiGu_S=)vs1Byzb0(l$q6Cjgv1S zch@dIZw}7f6_OUG4lUU6q&AE-MYXAR8{zIRZ!JaL4NkFqJhRzM_8J%PP!z5m$f z6X>(8+8vt|D?Qq^y&=O)XOP!!XA7P;0ll2>8J89q-=ukS*a~ws0nY`k?JnO~)EcgQ zwDs;S%bViUA9J{a1!f1Q=I8zz`?TzJzKc2Vd-0|-8E<1jTO73UxQ|02-p!%c(K=>C z`6Zh_>S2d>T1L0rYaNLP$K0|-oiCa)xzbHO&+N*L`!?=vEoxQInCZ^l)l!CLJUjR{ zkT{54JGMJsE9|whz9ib}A=PMgjTTqF1$R&8*I)_Vq}bJyr{&^&pWNwnlV?@Vh~-X+ z&Gvj8?{92c)u;HX(6OsNC2+rF5H@95h8+fCHT5{8H%;@=MX{R1o}CG{t2Uv1FI@elCwAKio6DSDc3zoI!GMma^-S@eAIMvpqnbFbwel%MjiwfuKk;kQ}- zoJXLX3eR~*CjFL02l=n$Z?OFDvFNQ9&3QYbAMLzz6Z|04p=Gre3}Eb^pN zbRFji1L>Uxot*!fo`07gzoOej9Yz!w{tAmeV$r#N{F%-@8gpzQ1#?6h{+K1d+lcR{ z@Tbeg#q>P}n)o73Gkj2<%AUROQ%=#G&t%f22F*3tboY7o4D#%mZ^Tdiod(VI)pWe) zI47F^HHJRYoO`95w#TBgEPALxe-GhV-+4|e)5|l2ZUn}1LXW0?uJ=|h)A=Uo+d**b zi}K4r-wQlK)0F2}k8;YMbc3#k|6}khz{T)4fIbd9O4G^pL8Z4Ae#$9&v5-1Hg7#AR z7x?+7=%9WKbkcNM)6nHTC&$VUb${LD zN$`)N=Ua5EMK81H69(Ok@>v0UvcO|~VR?OI_><>2FIv%V>(=%<9l9D0T? zvgpTreab($-xa;X@V^$}`Fxf8=U+i{|7P?437(HCe9&GidY7S(_5|(yVCQMj6W~7* zaWMV6Kz|K1*E*3-zF$;*p6aJZ(Pb7L)JNrio#nsUpp*6Ic==WC`zv~pMOPd2C9pSe z=Q+vraEl({@3nM0(#SdX1so96E{xyn{kBAn6VA8%5yW?tpKAHv>HDhigDv?WEz19C zD?ImZ7DxTBTJ(Qf@a1AbX6{dZdQVvD}p(uWQq-!cA9OF!rTilhGvR(S4xE{^_{ zR`^X8U1QO#=i(UNh|U|g{gS2sO+$e4PwT+*p_g;~AGiFAtn^Kk$neYXCoKJy{ zAF%WtwZcDSh3B`RIO-4DQl;;YR{DdsQu*6!0{)Lyb_jM1LHokzVnjzmT%rB*@XI+W zbY-|ov|Uxe5uFFbBF}sJ|FZW!@Kse;zW6@(=G^=tlnaM|1??~9l89+Ykt>OHtW9Wc zgb*3zL8^>J$Ta~he-_nY7E?N83lI_s>x&i=dh+H0@9kNCsS*XY@I zt*_z-fw0go1zhAhY)~Ex|Mh^yH=A<~>k0fI5SF+c&&9X@>wv8%@q<8EXm$ZEqQeM6 zFD~&3e-W_tHDYlN0xqHF7;ljQ0%5_w4p{aD{2H+M>i-V#G&*P?yo*cH|2|;x+s{H7 z%lF~N0~R0ns{mV1F(&*E0L!~_0gJErRKhO*V!(3t)lC}yR>0PHhYw-lGaIm+B}U!f z`i4V8SZJ1#W}Jhs1uXAk|CYQo0Ji?hp&=}BIerVx$MD$dacBq&O#xu>OSjw4M2DsX z|EzC%u+ZO1`l}o~+m)PI#dc-wbnt|Qej(r@HdutaaZPji*8&#*^9I6K;|GE5s>r2z zkT3@~jlFb>L(8C-5tPt!ErOVTt=Qz;ce%8yXE^q4||Yb55fnEHvyp!smUBhOp2C z(B6b58?dB@u+Z53%S}J`;0O(2p~(X*eAvG%3I+tiLPK3f@Pq}={v~I9+5L+R9HAQc zY1cdOe8Pned?)E$|8u*4O>^*TfERg7Som)MEazagX*7g|W*cc-=cdO2PYXFbze;+y z-U$o+9@4us-y_X;9D2e+Go;}O3;vjfCoK5W8lJG=&k+Bt!=JF=-v(Ti>)?Mw8dvTS z78?8fFt>a-H=RU*fk0SjxbJ4Nizh62?!mGC+My>b_*(!Mxjd^$v)7>^EHn!N%RY<6 zr1=|%hOp4olg9N$ZvZ^a<@rU@yW=Kdp>G8&^|)Q5AuKds2Q2U1Lz?HD_YxKw`bP@Q z5NX_Z5f&QmcNCgeNaOM$EHppUXwH$w%SKeCy z*!r%Me!{}D7;q7VB|-`5DNqrr3A<&u5U|zf;0a6IB^u2t(zy8|EHwOfiSXG>ntq25 zVWHuEVxjq}MnhO=sGmyOs5?tLAuKd6k|xjLKSUb0oe&n9V}Pe|07005D_CNK_T0_d z=fOgMGf+jP4xZyk(A~4ZvCpEAMj$No)qsPHgiwRaI$(oIW6CPx|IEP?mbe__tnWE^ z!h+ujxQH)DXvH<{Q#PpD@Nd$s9xU`7Kuvb>gauFCY|^J4dcuN#9PnfpPgw9f0b8!3 zO<3@33c)h`ARNRMoMnS*i123|_$dBOb76aIa`h8^Ylh`OWY-l>!y?Ai=>mV(5xcfO($W&Zy?@HCt<;FB;HLYVZnC*E~<3Wu!A(Wd9cuY zgEVe>c9O=e7s5jG9AK%t=Qa2s;NWbB=SzT#-1;2?Ea@aHe2x?ErjxMXPXjKRG$O?nqkSn#U=OP?Yv_%8wumOFenHU2f{-0yhigqz|$ze5MBZ-Wx}y+(tHQ6k86j4pX}lZ z3r~)BlkRZn2@9TQc}{lmga!XPU?~&Ag8wz(-~xva&+n9Sc%SqXx(I}YJ_EA7$lXuJ zZ;nY`f`BD2;{i`v=)@%~ajybA*~JqU{MDrACJO|@g3l$rizh7j>3}6Kgav;qU`Ye_ zEQoxoA^o2@{0R#^$JS~8#laWipXdXGg=PleqR%=sW%wua7s5ir?pkyweh}`%6+khqR^Q6BUKL~_{p53zOE@E*`1umHv z6Be4IfQ9BHY5o>J2!w^^HNZl{u_O37{2*}bkaQ9j`gZ{f%^v_uIyv_jy9Z&R9|u@y zXcrDHK_mpO|4eh!U!=h|0+#tZVc|0iu)MbtaM3*upK8Fu=T5-ZOAel}#O2&S=)S97 zqh}kCJQ5aqyFDy(_>_^xozD^$8oNEz0)emsSJAyTXm8Az7Iok+;-A=#2uob*9z}Hy z&1U=)`o{rFdI$?WMN*NQo*u%>@q@rNBXW$e&_4^fh>1ez!zD6}u+SU?TvU%AgaKT^ zm4uwOA>+tN+zb7$0LwT+Sn$6CTy!6P5ZE?k93d<;ie>JWNkD_MHJI%rxSCwBwnuo4 z19PrgwAO*yPGmksSopJ@6n);IVLP!JJXmO|G#b0jxM^MpyrgY0cv63uw#wl-0so5DIdBpFNnH~bJ~xu)0f(l7G(8?HG}S-}jjbEI za~8rv!){iz-igbmFs;#nx8k4mcOESC+kq<+P7XUxm#S<2M4e2*K^n?XZSv1+j z>vHKn;H3-+3;lzDB@K@Pmh^8Wz1s!|3;kD#XJsM~7JLt2X&bvV_}dyiVWFRZ_`wdF zjqOhm+~UCOFF`g;gqv`Q+#@V;%K#U3;s>D$*R*XmXrCz|aE*rl7+~Q;SojnGF6zP$ z!gO5I9gdYULLX+4Y&ySclti_J`d+bl1 z*REW%Y@K(^{pyC5$#~}!{1MMR$I75|aP`5e-@%iL?RvM2y zsMR77w+c0&7bOarWO&W8b<0-sQvr3Wmf86%#-m2mrS|AbUlCwxoR-sAUthN_g^5$S zDCK)tG&kMTxTbE6ee^}$z4zcd0y?$UT2f67=Ae zU_!n)XyYCommstc#7L?%)+h4J2a+L4_Z88Jmi!^l*AT``TJpyloc6T-p$6~U2YBns zH6wnJfvwvSJV~Eg@EUy*n$0X3@%iL?rY4Et;ktEeS3X>K&$2ZsA9IibaVnB!wesFX zX?d?-wRV~P-3G~SblIv^Yop#~^2^W8s4hk|7k^TYpSVc?9ADu)DiL6&05{+)3+Gt^ zxFIa41aL#*B#Q)a1J1N?B93slg`JKYrh{U7E(QOG44*NbefC2BDh9b<0Ve^&r5$bn zKseyu-{}6Ae?AxZ4F0FmJuFP{Oz3U}oQA6m7sFNzie-3sHDEt3KFh{+95*_@y|{6Q zT0Hgmy$m{?-?3b!j^R1^F+0NVqj-nT?-tzi9TISBhw%V(eqX&7ev`;N`K99$e*J)T zep#SdIs!lHtvbIm*I^CV<(H}P8%RmteR#NnFK~mT@B1m~+guEN0XU{_6fQ~Mk`#U? zvmBi%mET<{{Jsihq`~DkTH{Ciqn_XUP)W3nNWfz|Y)avm0VRYw9Md-jm!$8PfOUS` z@UkN#@cX$NrwsoYwxaP1=&nL0^m8~U4;Yva2BDja zd`RAjzZ?9fqb=|`Rd$vIvIf!lg>@_Oy`X6E+S>a*k^85=SrRV&(BCXMhD7mwjx2J% zS>l}rfqh~)hhs)!@1k>#Lq=J3S>d7L!&4LcIQz8S$wy<}H-NdHl7@<3G%4kra8VFD zirwO}!^d1E--WPu2CeY$8=Gd{ANYs79~J!lUhFW+m{mQ?_j2kxAIh<2&QxKur)+g+ z+>8arXWpdZ>GLzZ?-?6sv&$?KUj{kTt*R>f+q%o5XAUduMk>n~C`zQhD)L_0eHE`& zjK*%Gk#?(NC+(p)zb^vGy>|=tJMEZpBqKxH*;Zz%p-8x`u{=6|Kw%I0r5Q(_{<8VL zm6@Y5GG5pAw&6?Bpv}k_UFm%Rytkb=ubg^2Jh(k#&gH&-yTp$cADf-nVOSd(Uv8b> ze`&XUZb%UtWl5r>vA=RI_miD$HF}QYVj4=c{dIg_UuE-9UL~ItXglDsvk%V}JP}U& zq*1V)PrY0^&oVMB>?HP5Px^xG{b|@K-osSXc&WfwMUr>0IlH;JkFBrLJ9DJ3t+=(f zH9I3Y2eT^s@TK*g32siy;C`@?YDj9Q7`x(7JBOvsY3((s^xn|gYlC)X3HKiArGKTe z&nRF0gj4dqBP$R;wUmhSdVy2JEAS`!b;<)fDFeYQFO9uUe;J{ag5`Xdl#;wjFZIGLd>1(? zouiA@>r6`1OiAa-CzfnK{lxL@uWirk4!5#}vp2CK9XG$Z=%OYF)Y;)xYn+pudgY;K2~I{zgr(CCw$!m{_($|zTRlD_oA(=8!0EhK3Qks?n0I`^F*{AIOw;+=lr(kt4(G*A zUX~{B9ZoNj^ho-`fhWsi_3^d~wIw@vmPTqCC1qFWQAwv;EI_NbdlYu!3x9c^%V!1B zZl168&X7p{(oh6BzC5P4H=N@bN0AR2L#jXbl-b$5_wcWwF~kG8X;Q|8*jK#2ayrhJ z@>*PB>s0Kw^=Q0(;rU33y(e|V-IrP3e$|xim+lj7zh}x$S1syD8)1{;r|wGC;$GpA z^WG7*!D>-QeEOebkLUs@ZW8$25Z0|1{OTZ{S0@n8{lh8u>$UqeF1!K%xo0$)pK0@3 zm7q_3o^C&0d-{Ut&%HU8!=L^k`g6|9^!qODJ~{uRo%ahlzFWZbBqj#9zsgNJ zb$)&~WG9{zp5)$>exnvYng1A@pZDCk_v+udcg^nLGRFR{$Y%llA1?nVz`q3WweCIN zw-m4wocL$t7V-J~Xv+QXwEIRp=lnYt7xP0u#p8f!hv)q!+_NuS6L{_AleVm2&?B zp$DGd&G<|TKb{#Wf${$-B|X1#pQqvfIMhG=g(Q%^M{e++_tR6J$5ZY(WtMNO6Nah6 z4s7%EAz~=RB{YPEW)|^f_(32nc-Eop!I%eF;u02`I|0jnEXrGGdv+i!G*=P-X$MbO z@V5|O?%)Xvz5=l9+o=W|%y4LGG`JS9#l#{Imbi9)vuw1peoP}BLJ=;Z;apqx>hN*U zr6+&!%_1!HOG%TBAB6jG$@fAC3k}C6*|)=SOY%!tXxLW-PgwAe1D5?fJsJ&Rq3HuG z`+Qy`O(lL12n)?2z(q8iAsodujSUBZa$=gB$CDcT8eoftCj`R6=jVW>OnwDe_V8Q) zEPfb-g`S;T=;>1;Wk^_PuGVO#k|qKM2!w@ZI%(YW-wasNZ2OmRp%8(v&{qL28t>p& zklu1&qU8G}goU1ML-q?5kfsVh2!w@(?K8+9gekbBz6c9VF<{v{bc;qqSZEd!&&G>D zSnx{#%l9zsHthBby$!DdjqESFQd{aE4KswW1D8d?k3d-7)dN`a(hFGXg|N^(PZ|y) z2ruE1dLb+{)N^D%(rMDTX(lW*ZxQddNy38v4Pe)Lh~Ea%SB`h@cq;bpSVZhU_b?6@@?3VdP4Q|um4h`O>!94du;k1m_ipf!Jy(R~T^j&PIS>|n6JXgNwV5z04Ph%TNi$)g-vL;@FS1LcAuKeu z47?Etgzw>+G}8tz_rY@UFXFMp9Uy&)Lr+-nhX7A@@q`6WSvu_o{2;uFOTN`aSZIC+ zcv2~T5C{wY0^rFmp0MEG13c*_{2&k({QH0>yLiHa_dz~L8m357OR~lbbDb14hW9(&IdW^IFu>wHuRfGdXVf2 z;yl87`4ywNel*EWGF(e{qS67R?m^Fm#r9xu9%1=?EmnnAz^CQjx;5)p)~~EvcO}{+ zFPY+XsV*tbf_S2I=rZ8EqxLe_6j{`VdxAsa}WrvufG;`nBs;-{X2;=$T1M=(?2~maR{66QS!$lIzHa z^XAYqrTKBBhClJ#E%`G#4q81b9=?_j&SHorE7EJ@So3xIYg)7Ds%5w ze8l^%2Vc);*|=8V()k_4{RUhTgkKa0onIQ(%~t_OIcd7j$nR5Nrt{-G<~}0aApC9u zPUqJEerb3}e(AU*eHp;%{GP=9O~MTSg`XdQ&Tsu#=Ug!I)BQ2-1v8!BNyMX_LxOnM}E3L#^0v!t4CpM7iRb`{JxjMZ!??-evaqlr~6}2r^R2Q9lQsAX+*d| z`2AA~zf}{kZjOiKhoVfB-*GrVfKn59Gzbc@bXS;M~D~0(2w!JFEde-QR)z zje+IDApGtHGs!#g?}A?g%9_tP#^r$P)!(`INfYD{CUpNz3x5R;5cxh z4l9A}?*Eh<{O3KxB(zxxqDPY7WEW3Z@T4O>aSVbNdj21Y-X>0=7yGhK&w7&g5*Gf9 zZ&>_w%W}K}TjMk6r0pn|#nH8^S3^;BH4A%mEv~-j_PTY;>+Zd6)!N!+tLVvmnQpiq z`e*TFYKr6g>-aoh_HcdOvUT^a{Q?xX6osmI)v67v?^$;5z3U!Wxm;IqgoUlTjHK>~ zdPHA%NB3}?R-uxNK<;WMI@f#Z8`ne=>Xxt|&XYEmDKSnleyHDKv~8`as4=*?RqH?k zvOWnzyx75!L+%a!iF|w;a4MbN!-Vd?fsQ=Oa4}Tl!F2rR_`&q>8Fhqj;?nt1-j2lY z>%i;$xb7kRARH6?UP$3L8~5yY5+r@k1EKTdm`7TsFWr5{^p)e%)3?}thJSVteoJtt z)A3%Okx*ccJ*1O5SqhkaMgr5sz;2_b?;S8;T&7RgIapTY$Fg8pf$Lrya(?)X*Q4%# z2kZFH3e5kcVc{7E@qfTIA2>dT8fxb; zi2t9MA!DUJp6YPQ*g9S4|Mb{OUst|Q#?~y{IVYCGgJRJ0C&`QPMDcP%eEGoM&d^80Y$Fk4Zbj}a!iMA*Syl2}jV#On{zgX-% z2!v%ExEiqKHgdv(A8`=4OwfOztQJu!!ZI;Wl?PXn+?VYpfW%HPXA6V$ zhYmfUbc@E0L%n~W7MpF7f&HBDpOU?6MxbLoNsxZF5(x4vb02&W%x?kAxewFBXRM!8 z*>NXu_u`VkH1W!J{|o*_0o?zjVW7+c{|5U8KcpK;FQ>UsmmMq@2Bwce_cvk_i?;o=^B+5_kHym}{C8A(Ux6Ep6eN5ELwRXwM#TAwgZ&MM zp%i~b+sk`JdAz;CZwwAb!X3NI=5sV#<9M!(k6WW=U7K_B- zt?PMyhSMs_%OlaHyHtEpg$f7e7<^72kY6;R{WhjuDtz)&n~i}p1O4V4W1i+eo9xBN zIoC-3zO~2dkKT7=&Eb+mkKEbv2~)L%BC2I-Ots_ zO~3V#Hf423l=b6~vi=Fad#Cc$$KsWL)xUL-TGw4TU_uOJoh=JgV{{z2DfGHe}YO4{rTwXLxz1(f^Cj z8{wZnXAF1tr(I|CH zK;OF1w`O~P$@9kkC;9_B{3TEJm%OI>N1amrfeZeUulJYyOd)1qgD)JI;NSn1zU|@l zX-5D4pQ!NuL+bR7aOuzei+6<0pZgDfEnK?Y-=B2={E@EFpeRL}M*UEQ)3^J7^+f-^ zXN=+}!U3c=ZM|ujqvl`emrgK_P_LG|AF)V{@8hc?-K{Nui4(Wz z85KV8a}|DJjW67RYyV-@`?c`*f8#&+WO&nW{Na7Ojd1oM6@LC3{#(2IH+{q3zwLd0 z_(G;p@|C?`=`Z<-s{LC3z5^<+d(YQuo_K9Xad-c|uc;+ZhHre>INH6TyZ@mqV`ull z?(l&(Rro#AIJo1b9sT=|>h}Uhad&)CzOo(~zBIbMuRFYdSQS6fKl26E*S#0He?b*L z*+283+WTbxO9xf?M|!_84&M5El`j&?&G(1$X8J=@BK}apB7bP=DSzr$xA@(&lhw0s z@4G$u%P+mHE6R(ZPg&@#u}D>S2xHx^%RW_U#d6f!16AFlw|P<^1}RY0)|~JW-#p*{ zbcL^FXREK}+lPGqZ>Ra=>5EW$-%|bNa{NaQ1D{1LzNPy86OHhJ|E6YrC9|bJaHi~$ zi4S$2|8n?2Q2pC})xQo@?;lqE4^A}t|80Z%TxZMPG~?LpuIfY8;pHn-|64<7)eoxP zZyf9{*%99S6&2pM*XG}U(`gldWt$QI$w!R%>23JlOh~$qOw6R_F&)lct zH8CUpS<{FwjH!d&A>S_bv~Rl#`9a}-1*IF_H>|AFpgCwH0^kt9JJJuSr_-Ou_q_CP+IU{V#}AjZ_qB6B!fbo=5s9UL z?Q}N2SmsH(*_s!6avUS#eJP4Q!B>)FghCW6P5GSjldpcfZ1+De`fF`I4>hb` zyL{cUh7~KLxs_|zHLlKGQ1<{V7SR>Cx7iz)!R7z9aNWW$EPEigcHPQVt5z;A%Ecbr z-1RH!avxZQmAr>?*RS1B_dr&~%6oH{KeVpSe!6_+>e^LxxhvP$bYECjTX%C-`Knd9 zt5>dm;Gx_v)Pal)YS*q?yPUC$vdUeatJkis%U!o@{fY;2*EX(4j%(|R|1-?Al=`tK zrl)28oD&^Y(Bhd9BxpCz}@mdXF? zDfji-{a?Eip zd*8mFm{==dIt=Wj>~){#+V>OGXr%XAz?@Rjm-jUOGjKl3d*)}Jjp5H&`<`|eCph=d z%dPwT*_8WZDfjXY;rFWc`~+aWn`<3P(_gAIdPf~N; zv~cdmx%n*Z{hSB2yZ400q5XBZ^tS*{-{EEMJ^ztL{OI=rrX5;iXFtzz5qI11M=Sbg zF|du$H}`7$PN{e7`?2cJGzR4Vru&@#c>i$9{eMll=X}m8bdZD-b^^dfL?8rk2@PSP zxeD*LrjY`6GQfhLLcGh9u;582XVfzv;#XS$SkAyN25h+#Si%zb7Qo_zSw@%!IfP1F zLQh!eX*0A~X$XV`zXGuM#y$vGXb1}p`>UL{znwI0dI$>*&s`KBSeA2&2cZm?;O7Ar{)7epF~F0? z;|GDT;PU`acJYJ-&ooTJnkj>x9wvRVizh7fOyVT0i82rtJl8EJyLiHaF9AGhB7P7E z3;t%nlU+Pv!Ltk}U4`Oxu5adkz`YK!iqa>b6MUR8<38=56r%8jJ21> zw336q{ehAATuNyqqpa(ZlPC!=bGSzzSkEI{c!moOYWa6K?!1n1gLYF1KZbn0-Y0j| z1)RWPfN;RQce|Z?=h-qNBhb0SgH0=}%W%hGkN+9ALh+zDVYg*^_>A$mhev;J8E_m2 zBnZDpL8SBB1%6XNM1J}jS}X2#e)Dlp9YTWe-@fs22n4}@L%}#r|`=jUy}ssq};e8y{q`(OBfEW>MyBqWU; zTz=!++ohnxUm`F~yyt!Z#u0uifXv0c1mQ>jeVuMI=-wA1{1>`X7iODdXhS2p*8%Nc z((!uF{cj`j^D8zcEeJo3LFiWv@`!YcVZYCjMN?I!0ly-&Z-2y8 zX1lXDUEqGRr!0Q{e0uX>*nF<+w~aV4WO=k~kBZ06|6O!oxB3@iE=K3unClXlF%HHI z@|)kJF|UfMVZ<_Xi7|SxAN>!cj+Ue$(I;&y8EV^wg>CKi)}|7)qn?Y= zvLCAdTC*q6wu7!>Rv!yQVO<%n+-d(uowi;0bo9hw#rXAQ zQS9=Kx0T@kX|=nuHxLb;22Yg{ZDJo*+0m}uXlw^) zpK7=E<)}w;tj2C&9lwl%A)Kvr2i6kI`4^3zy{%@#uA6bffY)Qi34S4d`bBT;P~ue$ z;5>~)Or8^EM*0$VsND0;yui2v(2NrF60=@Jw&H!mJ!>11`v%?rFw%>ES z?dT?*r>stY@Y8+uf1J>`?J?FqYU_h(#b1VHTRmT_?4jH=A69XF&bkHHaHSrc`tv9= zsvpV0Nn2-9Wqoz^v`%X#>p#A}`vOWRt?PmnX!7O7ywxI{r~<#7$KjbH{E>#l3Ib0- z85haE9TKbyYv7Rx&h-iYC?3l>*FW<)^~W6RoqcFSMg{5_yd~wvU?EPcAzzPc!4Owi ziW9A+Bj&9Q8)r9GEUV1ZRyMq6Uh0gof#Z3{3XWDC;dwhXL;KrjwC?SYcj7dlAbbLz z$x{Bsnd+LlaAU7}td7#@+Pa5wR&Mp@x2t8H@wDeIMuRaGZOT;E`OI?%a#R2#*Ow{f zF-ii)xEdU0Yl@j&l!2rGJe_d-&CJ|VD8sv(M+aCQ@$z!@0Th7?Uycs!p;s~B z0C=1N59k743ZH+5obAyI|NXYS?9McJP7z8i5Wri86?p*0Td>CEz9pY;L0T;H+!*#{ z)ZWEVPnPmlZtOSsaE8#BXwx&QCI4l$KwG6U&bH)d8cCQzd*wzuGw5;q)F8cNZ*9N1 z)$WTqrkYv*SiO~g;nK=4Q-=Knee;*wO!UpSRHprloSqw7-`HvASe;^T3NppfhV4l8 zQnZYD+6hD9*b`W3++OCjJ*VgDeT!oZ#)C0e4WmbA?o4shCv54no z_IM@QUi*<*7-7e-KWtraVnIplXj|T|SYZt9PsCqXmW>|hNL#+SIpU=meDl(f zhBPJpam3oLq2vvJ;k0_JJ{p8<+%&-+ZT2l6>q<{69a6LD7Z}?hMZ12X)$z>b@$`$A ze#9Hl+7#I(}W&plTE&^BumdWb#lvAvxBz&IbK1sOdb_*S&26;PEX`z~9?hiyeyYK2}c{g1V*g4R}sv zvLD4Wnacegdt3EhQrI5PMC%@`g2eSsvEylc-bq`=U~fAmyWYNMMT|iypLwyq`FRT; zU+BB*cXMj1PF6*hZEPB97B_JH6A+*aQ66XR2kDRk7nU9aHxu6y&V<*PC*hfE zq;XN2+W8m8V9Tjds6}|{EkYYR^>Jkk+T*gFv*K9GE2GpKRsLOnuR;?ZQ=y69R0Xlq zS_@xS<^Rqoqqn^vb~3iOP2Oym%Rsa#%hn2_uwGG)L+@E=40xrVw@By%`g9MC;J6^ z#8AWvKubS2tg`1fqju~TZr2FnCdJHP58(4NMo$Yo-74-dBW9K72SUBQ;>2-ntbKgZ zkvXBv_;kJ6_XzDM$TS#Cvz)7Pf86mS#p(v)+Zy5vU7ZLVNjl6aP*<3d}_OKP8wSNZ00Y`N?Hw$nRb*>m#fiQ~sl9y@*X zwIegO^xC%>e4eRf#g+_Ard?`IENoZw6?e5WR3ogT}Q9G`(*3~66PD>kQ4EL*beZQooDpSt$U%jDM9GV~72+Cn|g zC`YQuyHGZ*{@tisx4n8TJ=6m%bS}L%SPxFGbR_BsvJ_Id>tag;zJTZ79Al5bzBKqw zKA(`vu}bOtdM-GJCQl!<7Q3hSlyvm9?`^dlDV(cIVb%wFZJE(yRu%_1clV@`adu;s z6{tWTI-Mv__GxeI^hG4^$@+^k`}8B_R^yvv!gUejX?T6|UH;vk{^#G5;q2@V>o`z9N%0kzw^co-OB;T5&i;pZhyuYIl=b|HJNwY`j z>1WY%AStY@>3k!kRYsYW#gU1vBG%qK=&!7x)_d*{<}I9;$8f@UBX<-S$781x;|k@I zGv_VX(mXfR^P~!)B{f4g%0!K1!C$zc{Fj~K*b6G$_Iz2~4EiK5UR@)7kTZyXM#qr@ zMKml5D@+i8oi7_}jsBcTkSka1e+7oq?DiM3_vBIdJo{t)z8=Jit?LMz*Wgh+j4U|q)JC|>(hP% z^^u`Tks`G-kvrq;&be0Le$0KmQ|4{Gpd!?>5~IN=w7*QWzos&@KNIaQ@crcWmyj^V zndCE~PgY6GX_ zI42fSoW?$|UqL&9ZPUz+Hqn*|ODaZ1^l=l`POMjy(gJJ3*2=Yux-{FqDwa?CS%B7A zjY}7;vl7FNZF6Gm12|$ezq!-2XA_tib7oHTB-J%+H zAx|QVo9m87wjJ5OXq0-YZgnTEZmiqpftGyq*@C&gTGZ7}$h_m|v!@f~f&Q)4>Ic&n zcKGwN)wsF+Gs}!W=KQh~Jt|_$n6`sSGRD(x?Qtq*^!$IjFR&;4&-Q~gu?3AtQP?`e8{uG;GI}Hz)cqY>od3Vzi!`&IipH?U^nkMdEpYCD zAFEL<{@kc~Kpn7b7%NPG9X!^NA5aqpgp<*;FAC~&VK_=YMhLcf@cHo$&|`1A%~hv% zR%-bEzB11BFE6?OSPf?}Y#RS7WnaqzQ=NZctX)R&mVX=5|8MJ*^$|-&yMAEAe}_>I zrE2+6+D)~p6r~Lq;}T#8k8!V7O@xQia`-bjCEfo!aPXs?@g#n72Ppk&v|p!V8FMv= zYx@7s^r;$@@_%%n`sDqA*Ykc>@LJWY^G+{#rRL<~6HAUeyLk_{qjzmRxTR$4j4j2j zf!n{?TpCDMqXVJb(Te&)v?-gGNVM=()Et9eAHz&;@JhSTX4$(ZXGHvqu&O1a24;%R zdN6ml#Uix{IRKptR+-v_M!b2*|^2yc2tDCEut8GneF7>x&*l)6x zG1sx;G|!z8VIOxazmx(?2IdXjcZjm!jZKR;zm*udZ0VK6i!#jX{k^RwXq4Bv-0QTWU{8& zSQF-Txr{B`f*CO9`e$3_Y=KY1N3n8Y&$+NV70Mf>bSR$*jlxF43mh z2RP?wL65nn{RHgV|CB9u25s(`arh%!u;w=k8hnllrF{qM-J#r3%4@Y)p#p_G z)n^$sm(BAzRyNOZdP}GP^Hr>suqVeN*VM;1nCIwa5X${NWCK?Cvbcg}&wgy%ht+6i z)7}@)>IUArV4gDu4+J2Ky%lGSfTz^~`fRk(-vT?6FPLXa(?OG-zLdTVr4#WiJ-sW6 zv%-LDiZ;Ee+~;L{9=Au_D{;k}z!g+&@a({PBYZx`&{i7XpQHW}r&C_Ni)>nbM~UxB7?OR^R#^a2-8z^Z)`^SQ)5tWlTuIIbB~X*5RF zICm@w?QwcX%pU1%Zyk8#tlWmS7Yy~FhoE&^*=#jdHpkHBIj|L=Camn~#JPRN%I-!T zp#Sc6`!CYUdKjg~MG`3+)N`U+dbyS_RJE7&<-WPjJTJSPwSZO54HH!J8(RIKKG3G? zCO~S?H+8eSDs&{sNM8O^9QiFs3;1pYqiVl$H7UunNqKqpy;bCS)>fcXH?1u#;Eq#D-p>4n)e*d{sz)S%2gOoT%^|tm?yKZtvtt z3jRe|D34!uX4cz&YmH_@^B~5V82q3AwZHKNRa#k=#{8BB%F~edb5Zp&e9{Ke;`C)x zKUI8o0B7;or5Sudwbwmn+gNUZ{4dQJNTXdR9Ko3!Gkf4iFtgq0@!nQrHa5p1;ci-e zj0i3K@hr%Jz(5*xP062le8Ad#X1DSez~*02<*PyeuS(eb*%#4^KJd9O5{qOf<}~zS zxss*723}>F{kYv9sZgUK^=MycnX?eK!V=e3h*NDEW&$37JjsI9PSQNmYDVgs9>&$P zaeJK&qf}Lmrit0MzMhOSu_3oAtZ#U=54&S1_hy5svg-0-iQk1wD`8`t!sU2j2d2GmoP9K(DZsn8cpd{xAg z#_(x~TP`eppR$lTl&bdxs1}$t%+ExIkW%kcrAf^k0*L1SGN$) zZUs!MW%ulnyqs!ZnMMEPR^Lg;*)P4x_42ehN{R9p+5}cbs)L-->N+@9v$+OdVa&yx zlB@OZ-MEDBkx?DWZ8wtgH{h(Tjl%k?zT%#zS@qG|QP)dG@LS5eo1RPK7CAHJk;ez5 zJ#}NGO|K-64qeZCqeFFc=@w{4GD1YVcBz@w(FWiWd5e$YY7EDS$0GDe)1M5m zoU5@~83})VH|7CbjM*7)Bx;tU!ANzhd-b5-R&n)6_f0?@o^|^3xJ91bEnYGnCs?%_ zoSXk~!tb~Br*A30GoxhS)}g9Hd)nUERI~YHVvhd!BHfd{cT4lYo-NTXuB>IN>WnQypC)wX&d(LPxZOjv}_JjUhVN|ij z`g zv?IA~YgJVg$8$hSnVZ^Y5O2%j3cJ_b4l5UC5s*z4&2x>p@zIp@g!5v*($k4`l-iVX ztUXdQP&KsV(Bi{bS=;n0tYCR|uU^nIEqrsdX|!4b-B9-u@OUrKY+g0m?1T0%v?RnY zfc49ZyChi>j_$fpn`ozNMwE$<-|hR{?{24LENvUO#FaxxZxed)e0#4(pv;6`j9G=f z;~_U19LCIsvyL}&u0c=1I;L%}wPLYL|A?>EVDwI_U35pVK5?G4GEE{-l#8XJf) zwU6ZVztampHgkToX%}XKWhQq@S*Nm$XwxBBS}@1PxF7F+54k}f9xyTYJnz3hXCG!x z+%3yHjPJ0)f7AZ`RL;LFa-Ni$pH|`Xz2F&CERl_oBaWRM`He2!qq^>R1>Vlo_ZGxz zJgpO280{KYroi{zp&$4nEjh3vY=0p!|8UbD#B-z^Il^ARUGPzuZ(@FvE83lVkJ2th z?(t-PK58v!I^!PlJAZX&3u3=id2! zpS#bnY>yfEmzg&x&u0?zTHF_Ck`{A;R;D+hJtws_c=ab*Zo(f7BQ-s)JR6v9Te53o z1Wz!I_BCc7@O|LSE5kGaH7PF?n3 zPY}ErlkK^DchVdesYv!Gx97YS&YV~GE!St(w72SSa_0Pd>3?Uu0Ix&4{60jax-RdMHNS?{=2gTY(Ao{?qXOmtj+H#!lu|_%UiW(v*^g^`ziN zBQ$l25wc5IPc!Y`ux$?|?~p=EhMuL_Iymdk&r)bjkt)Nw(5+&XaoD(N9We&l+ncf1 zvI^ESCynfV$dhdY$82s++_oFEX8;j>XXg1NJFEvFe_pl$+6eonPa`5q4k5`|BTJ#gDoD_ z6|`bBpUs|)S~B`$vGVLAUTQwr@?p$%`fv<&z&<>3IoA)}H!y4Kt*!L=?CU7(bb6&X z25^lf*-mAzEyKIBxw<*R5@LxNRmK^N4)D*#UaQ=#SRowklrYNscDuZdA?rfEGTsG?5!P~5ia#$Oew7rp-)1gjaS&eq};``yyc@lV>*f8q3 z3sco#L`nyBM_&W>A-n%LJ;UgkUtzovoQ+n1I{R>a${UXz|Li4+x6ac&a@h(l==HNW zHqr^!*K%B#>y2a_7ocN&>6e^GWl}mGFpbUBJg_=zs&}D#oa^oWX7kueuJzVM!i)CV ztDqUPC8zLI&k`8AQ%^=UPARAs4EM)rry(rF-NMAPJ8^fX+!;N1Uj|kNmpaln&A^V3 zgco~r1@1ncm#F!q5#81W3fpMaHX^~wu0hV^8ZK^Za&Q@y)Mwq9pN%&n*@r=67(Wda zj4cRFX)XxmJysCPz4p3L@eTQ*qVoJu;T`#*smt<11^4IUc|M-!hjPD}A1eNCXa;n| zjB=FMmsV~&fKn@N=V~6uey8lh>#<&zjS)zVXa(D{xgy#SF+#i2Kovy)-CTimqmM_I zMvQ(lQeKL3hpu-nulrh*`_@C$q~DB$Pwhs@lcyDUJEdNzkGE}j zRL;iGPXKD^H7Uy-FJyad(RnA%zIi`>Fh@O^)iS&bk}2O!aRBSFY3Gou46Ia^*{hTn zBe0&Oa|PQsb6fn)nabL--LP7pH>|B`S@E{#&61;cbrv46W@25i^Lf~SF{2n$cwB!$I^_lxySo_(SiEDX(NnMbEvgJ_+3hWn9x{pFe`yM?D18yd5po0m?S`5X7&p zS0`q7SF+R|vo*_{$`eN@O+oFmUIay~)n9xJzv;zCUZ|6^#lx$I)ue1I*7)f0C&P!%{or8A8;w$h5yat!-$hR36az-tM)@2Y;K8YQ)P zyYckqT`D8!S!6hS9d9^tZR^4l3p0X=e4gDp|HS+Z%%d`bZ$vyFD$W!E%<&ji zx(rB!vpcu0X`@|>an@((v3?iftgRdK5$wr6!}KJlBIO-tM^1~EHu4|RQ`K`aQrt=l zPGM_bbvX8HSsd+YR;0IkhNcU$w8Cwj>SUz3)94JLEQ*gtyVwKJr!rvYfo$0YjXllK z_gD08rG>4znj;!CJoH@5UIE){J*d48+Kmyb^NzAE@vw0E2wsf&y4pUoz z1n@B8d9j1@3l~1QFzc@O=G<5HT2SavnhMKYui}ems%O=at1>Gkomk13 zcqeiWq0#2F~=-g8Sq+#@vzWgnNR9P@ew7nJAZs{3w$QYs29&p{AE1wHy5N zcEI;S?SX#Iy^Jat8oSttF5RbAL95gA%DoC%K5BRKQ9^wcW@Jy|c__EnXXm$#TtazI z`dGe{$abrRq>86k;Y*cInb1CYQ^E+Dx_Z-|*vPtZnefIZLIbIpJ2~KPoj%9%QlC$gI zxbz5iT42P=q@-{>Pt=#{sOeu-2h=evf|M_-OyB-S#d_{UpYgLQ`eM@b(Gb+p{!TurXp*_O?=2&Pep; z<}=qejl~EZQ(0+9DSD@gFW6+1`(jpihw9H-RF07)OZnhAvg-hXrIp1zVRWd8l)oVq$1up6Y_?dkiY6#gYN*(hjE(R{L|WqJE0?VE z=b`aN8-`tNw|~)o^p0o~`h$4@ts1jI`=nB|WqVAg3?dJA-kg=4MV~|6Q_9MGk^LBF zO6cB*&`ObSaKwDi#LQrLOs4sCcD4$Qe%4M8bZ=nUrl$i!JW&#F-2E$mxKHN#mf)5kI!U1@WLJc~C* zRP$NTV_oGk{?HXorSoU}<_fD0mOtbP<@Mx8)ni#4hp5HtVV z{9jP*kEeYcZwSDTJKOJRP_Xy-TR%UwSv=AXT*nX8ioNze zwZTayTN+B<)bo>><a`Gmge@)ZoMBTas#3;_z zX1Du?(eATCqpQ*C_f4|)O~Sh&AG7W9LXJaflzJLp*PtccYg5O!$G1#Tp(e}BPqt0iG_5_SNU7mS7yO}G7I*TS+K8s2KJTmP*Hg~>?`H4uav{TqP1|#czcv+ z?1YU0qr{tPZ+j6=6)j1;54k-%f}Ib06E)ou?Tsf7VPu_!k#!bE)>#-?XJKT;`CZNB z7+K3Pt13sTK7+cNlUI>JzYgupLx27#JyuH)j4_?Oo;5#89PAAec<2Ll# zj*N_hiTW^l@+%7h<1_SAT~K47kuswP3&%3Eg4TG-^0{t})BhaW{~Ycn@^-S~tdWSs z?QNwOo!l8`xFh9CcI;UlFLmJj&8_ep-Rc`?{=v=go2^O2Wl7RMgf>xlh}d>(z!jw! zrNif+MV+$-_Nk6op60898ORpWbN0Yku*KW6Tb|)1sj7+L=@|oOCH7)%SFnZXf1V_! z4+z$dVOQpgmREN=AI_SWAb;p-BdjmdYyEM1fAYo%zVC@0F?nX(_JqbrOwSLD@cvWz z>Kb!&v+V(8r7(hPbMW8PuZ zSJJ)?t^@8&lrB?W*iIiTZx*Pp{UPm%b#2RD(}E{%(jE*?LhuZ*Tig8$>4$$7e&+{a zxfxbwJvCaM{UiA{&SpZp;#_!FG9D!rZ%jLfJwGgY>Od@c#NLBmGSud1`8@keWWts3 zB7YvQ(9hB=z)IIQAr+s8tw+*Qj{9BcKc2VpG8dC($gD!%Cij=Gsks&np2?Ui77hQY zG_<1oJIB^jN8DV#2zIW6?L2YO8);|FL2IE_kUs~r!K#iUWwzywa{D@X!(YdFUX?GE zzN*9M@hDqfOH+PWJCZy^ZLSpz92UR9?3)pEE z-K^p{InX4nwB2b&53sOfTtkiDemV(O-}s`LYS|N{*a!X0I-hm!G3XlHFR~ADY5aS<)mb?KoiXp3UA8Zi2ZTXOQ zC=;t!Qm2r=swDy~{QRjgA>^?XA4%{>(lB@76VwYV47jG?QfatPQ)A6yHzEZ=PJS%LkI=?oy95Q&wcgw||SjJ4+vc6{tE^K_>9MoqBx>B{k$G6rT!uPRn?_4;L!TzjP;CGIidW5HM zqmHxKr&b)HzQ^+#`GwZd)HKYGa24Siy$k(_770&>l{L6z*hZM9B*c?ooW;WIfvlAz)&&GP8w6ED%EfkpVw*6|R>i!0j0?}Xd4&f~GO-|{> zBEA92u!UtEv9a|xCt3_OAfLUP*2MT#54$~#k1`O1e#<-(*? zPW|_#(vcnhN|c|y`Zm8DRwt}bQY$xy!{SMWj^vP*mfUNT_tiM(Njj~O^p37^rQK=J z@WC5)Nv>kqT7c&*UD$4=4I8te4G#EsCUTQ!+hwpO1Zks}2v4l8#T7Tp3cQl^EfUSD zS}R}X*_KMV)Lod$agm*gp6cyoUy#5xpGke6ZSe^>@p~{&l#_z#OKxo%zI6Vx(T0l{ zYj~bVZ`)OKV$N>6Grv&&AMSyb@J(gj#^09VHUmCo!#j-T!DE=oK~6&tIB}G=1K0~O z=E0Y$+}TIl+ubr8L(6+Cf<4IPeD(|=(#P=ssfa(a8(PpKIXI!Xa;vgTE`6+W z;miKpVg`E$_YihtW%-9HW@f(}x*Fs5=u^-YE^qz(0yoyJXcx(%p1&8~yTdA@0#?-s zE%1=^__bi$Mz6{WrXhb->0dtXh`{&P7)=<D8Rm>+(qNgFJU7k)o9Tr;kW_TDYRe zG{^1p59ZttTgU|1LMFf#G6A-biN&t8_Z@Dx`v~Pka!F*&cI1gZj%L$pk+VLr_QSr> z2QP(SFqq-xrLf&TQ8h=>?3D{vE-;%o3VD?}n!|E30hW^qu$)YQDVVQT*MbOCK|BT@H7UDobRGn;zWb4Xw%y&ak>FuYk45|KswHSYw1jn2GP4N zn&(QdVyt(;;TNhjgK$P}R9(bsSq5gB7umnlGrEX5z;|s*pKd?>g_&ELf$w{?jLwL5 zr5o{!=f}i(W(&S+5RObV;w9Ack)kj4UwBg;fG6?&U*`D>_FKD6qq#CV-vs4;Rk~@Q z>5+*K*}F1&&BDMhn^$fO&qVGj$pJBO%8wJTzf!1wzpZ(Qz0H~N_g}QF{F&g{^)0;N zTdLH&)P8>_eY8u{2mJh=(CRO9wc|jb$iV0dyen zY4uxhw_XhxeEQojm!>056Urt4+NK{ux;R|>zwj33P{8wfmtA%~N9 zKmAQrep~e1FVrWOTj^hTH2m3%%G_f7pd-E1okQH(?VoBQm)F#1E{{)KWUSow$!+Fs z=Uc)h1M0u?_C9b{Rb}7zo)M4;aW@AMk!VChq`eUVk%(|aAR;6*A|iqT1_T;l90o*h zq7jkEkO+~;o0|xc$eW0ekc^0kh`7y&)X2=pkj&K76wM6Z>$iT_b=Eoy@O_@=eLv6s ze9k%F>sr5ct^aH9v**k?Jrg;n<@ z(-xNPmETU186m&Eb!*Qn4!E9sVOj6n7dG}Bv`M0u4Jli9ZS$UknwAyhO8^UPZ@_qz zOC3%YzWDmNbI!YYS&zFvET6#smi$#gT7d7!Nc!I0_Ufw#m4ER@X|3EPm%ZdV(pk=y zUFDZ&e|Q-_W7Mwcnf~^5`oD;s-iv*E%VN|SbJBh1$QSWDF@KQ}!K{<}8k~#xt`HeP zr&!!f=Aw+|@uqH8-?va^wak@*tP5$Od}|55>*I)gzX;~+5zb$5dPMHtpDlN}C#5oT z7oWZSu1{@D{xtQ0!AFwYo8PsgP4d9cWd_T1|AWi~d67t1VaL&L8dXYlk$x-viwLKy z)0MK)?pt_{)JeYM*JiArL~VwsQtRUPuSiR# zG^;F$I`;&l$|v)sZeQs6`fKQ~rZ3BE|E>Ie>9@(1@?R-;HGA#tp07P7^V)r`{%iLo zcb&g6xoGNLqrX-5z=@`1Jzw9S{Pni7pH4b@e%bCNdz<%sW>fObDZf}IwQQc8C96t$ z32Xep#d~i1cbf-ZagmlEmJ+$PUhr$HQGO4_tu1~+O;*hEzsTz9Iqw<#4o>>4TVF3o zuil0AWozxRW@X=;^1$nlB|Tr4_4U(9)#sJnzvQ{*7frtFu}#SX$JZynl)Bt1@9oYn z>p7=cnf#yl;z=)Ik9*LqNtq2;*Jy3?q+Hs6vLI{lt}j0RHujz!UpxI86rGG=vt;+G z+cq_mSlB5Zn2R-iT=oyd+vwt9o!r$-;+_52+dbzzp4|VnpA4S#(r@)Meh)k@zrH2k z(-*F3`P}2WTmL*~S=rN*mTyX)YhFMrrhHP$z@F9fiu20ke}v}Bb;`Q`(slpWWj}E1 z{(;_y+`5-ue&e{N|5a8#Qs><2Qf1}KuVu;3cB`yv>_yi$e_(&Jvb%P+N$zQ0T<2Hd z??zJA_czJs{~nOf?v$;={ZY&i`Sm8*Q{86?WJR6z+oo9xiOgB z?KjG($vGZ-APIY*{0&ul`|KYqE69G)uGysOW@Uvd+BU(by6%%J*3<8D|98DlN}tG% zQ~ieC-|D*P>ZW%6f!~7SeGvDTA$OG>{sqIm!&=mJQJ3Vp!Tvqzph0)t{lVnwDHGcC z?7buD*=$eMukSo>a7Q_7UtICcLt zDfw9s>+f!N^Y4_RFTb|w``u^Z+BL&)S?JK)iwXbxq$)MSF_3|6#)238Ts+}t|1!HM6ou_imSWyS%c?)P{z-*?lj&?1pI#Q|C;?52{}_*|J<#TRV3~F28a< zee$G+Zlb7^q?|d&_vqf^itc@SeDKob>Tc4I`f0N#%}vTW2{uWa*3a$PV_J{8%g4{? zQP+L^Bs|?RW5%4?%j?hy(eW$&{du^XBrm^RC-;y2aaQuOrsH>z%j9qBrRhzRQv2-W z-pVAApLy1U_GmK`+IK|uQ<0rvu-!rZE#;;5^HKV;DE*Zv{pl!uuZ7e4%!~Ag0(((q zQ7rH-*FOK-%BvN8)5B4Y?w6R1(yQ`VWIZ=Dgb@}o8AQ(SU&9)k-aUlAC2szk^M$w`|)J_)=_=j$<^gydS#G)=-mvqyd3>;NwojJ z*Y(GUVtKTeMz)`COkWVBm(Hj6xp;p5(w{lb(&o}D* ze4_nQpfByOOI-Owi|Mq7M|O2&`~8J_KVGyS3iPGrUFyp7`z3APf3z1B^V6Ol*bi6G z*e5ULN$%pU4$`sT`1!^BwNd)hk-avu{d!`4zkX=@^+@|3+TDQGG6p z?8{yIh7{w`_U)m)D@q?7*}i_%`|+mj_vg!#^K|}9JPY&Z1Md9f_hagxkK!MU>^+g~ z*BkS9FODbe-jVIEFPXkNO5YmUI|93Oe)M$x=l3VtmBsqe?iARi`LA&K{eDK<_aAM4 z{X*N9N87Jw+Ea_=(f0G>ifH_=bmfmK>Sja{fGMdqx9*K?dK!)e!rkSH_|T& z?9%@FpsVkgVmfV~|AWa*+F2t+Q=WXt>E}oK#=tI(PraZ2w6mg~c2!`P=KruO&yNRf zzg}psFXpGcKe9JQ_Snc?6xoe|U0R>3Tz&lb(e~p*+n>*A`|+iHeK9_5zyHwQ8>JtK zY`;FK-x{Qs*7s^x-(kgc+P-|+{(M1uWTZb4*}lHiABxg9NA`}$_T$C;{``7%w4SbU z^{*}Fr|tWjwjYmcqWptg{yxS0v@0XKQ(%|&-$#;V?_pvK*|W-%k4Eu7>f(1O=BMrJ zOM5_+J~*;{dp;`n{+Kw^m6yByd}X9>jO-^P+h5o)_u;db~C&|KqOwzC}Il{*m1n*$X1u*O&SI zeoot;pK1H`NPB4%?{H-M{-*w|DE-;U_U~^#9<}#6*WM9DJ?({&?d!wzEm8Wi$Q~Kl zb&~(=% zT3_bxR!pbeBeH#eFnxWL?%T_BKc8qdQcR~^8`*yRnSOtiUS7QZWBTGKeMMxqi}Zed zGJmru-LJP#N9*Y`(fpcX|D_7 zmG<{%lZp$N*w)3n*~Rnw0pt7g8}0gHJleiJwEccd`*@`H=UdwTd`WvjF+S~vz%K3I8(jQR#dO+!{n7UGgSKCPw5y~1e*H21K$Py+8`IYX z>816X=IS@Bm`>Z5PusVjwr}sWs6RjF;`#YRyRjIbc1>hgMfRe|_VbDP{rve{RQ?QC zzOO&+(ZzVQ{d}RlEJ{BX*{?>nzdykIZ${~Ue3;&=xL#@d>mS;Oqx}AQmg#+>`~xC; zX=JaA?8d+@9sgNTf6?~+Mcelm?WcKWRT4=}$&> zkElFtc(Igvd#vTt(z?Z=z8zrLXD z*AMNL#rD$n=Ofzwd_Wu5l00ayHZ!5^_aEB(qx8yRf7}$+pXX!0U(xpKm9{@0(SEcT zpSG_L?R8Q5p2&VEvi<$to1^;uhwI-lMLq4Qkv%iA7e}_=519X8lwKd%Ya)AHWc&VQ zyq!UM>3sXVtA9l?{qs@#zTnbF6~~A6$fBOMU$3-%f73n@>Fj8l^9b?5{-j^5p9&Gv6b9Se~qi(pR|n9gFd4caCh|e@q`0 zr7wtVKi{aI9;H7W*?#<~_w$K%m*V)-_VYvIN9jufyL5b4M(tna+CQLJAKHB)yC$+n zM7D1~^Dhk2Ki-B0`lLKr?aEsjq~BYaB+Db)?8qpuxX0D6TQQxsUtjk``ZZ49qo}7nF0y+^c2#6IM)ums_WjBDn}YPx_N|TTPkU}r zPuq_#Z9o3B{r*OKXO!QcFPQ##l#Y9&JedBZnF;N6k$p6>{rQV}zhBb!@Bi0E^blQ6&dq`wgN4DQz zn7=kk-x%5JBipY>=J)+g+h0%9_SZkO{q-g7>BaGF-rI2!Sww>dTD=cbp7S$KW#rgwEg}<+rOWry|>t2 z+VdjY@Bd6c5T*P6X8Q9{x*t!bzZIpw6xm6!z0~{h*_fPYL-81SDNi=J_E$uDzkZm1 zaFl+3WN(aYKRz3y{f_1JE7q5`KY!8o^Obh*NZ&QEOULv6Xgq2A@ucm?leQmE+I~D~ z`|+gh$CI`nPuhMwY5Vb{?Z=b0A5YqTJZby!r0vI(wjV#*e*9?r@uTg>kG3B_+J5}* zkH&9v(x87&d_%^(JlPVZZ*l!Ux;Q?x7ew~d$oBg`^-H4keUZI2ve!j+=i+>1Jb%4K zdt8+6_a~r-qGZNFY<`}sk8VWeLg*()O3 z_aF27{-ynJr1#e^O!xDPwx7?m{eDXO#US2~b^qBdzVc){=S#7FsBaV5%_7^szog#Z zzuOk|C*uz(mQQjII??1wr~H=sJ|X^@qB*TI9KqXU1?@QduU|)@|eCRNH4AbE?1t{)AsuTZNLB1 z_WetHLoq&WfBj0^j}Prdk^afZUKiPqME0)0E^W_l*PgM(blS@!dtzh{jBMXN=J(h4 zwD(7P|9*h!?ThP$wqGB#{d%RnJ&IQz^NIH6Vtm@w zk=-w{Ya;u2WIrC+*lTz&{$eu|+J3&!J`$z-{$l!@QF_N>dztRf$Fzq;>2;CaFS7ml zh53g?>Hhr((+mF}2sDArh{aO{{?~l?Cxb%u*I_S5I{o#{j>PNe?pHGk^r zU*++JuqHBZC#@As{*@J|46j{ ze&y=Zy{M->G_w8v%k-KkeOs~pO!xZ%ZGZoSw*Px5?PJCHMtenMKN*$h@5fVrGSat+ z>hnf%KK&|bsj)`LYkBgrYyYcJ{w9GQ<5L;g&qw+rQTn>5{FkEi4N>}wQM`VU{-Mb3 z8ri!ddv6qfOq4!1vi*E#e|C=Y*GKljz%HF%zmDeDZ<3ev{Wzv@S<*N9d-h|l|6A*r zB=TLF_ey^^M0Ry#*M+uzertgAVYz(AN@;z5>*D$A3)&ca9<)!IDfvfem&w?E2%D6*GFw%;!q@5Ly68y2fOnEp^?Z;$HNHc0=hd?yKx9r7qou5jzcpO3Y@ zf&SjgBpDgmehpLKAxih>d!`Qy)3t7+UHMl=`^_KS{BJ91JZN_|Gojrzuzg+N{8RFR z_Emqe%9B64c-@NnKRLTTvi<#?KSk?}`TcsP?d$XBNdHV!9&I0=_ON34&qVqE;`00b zleXV)X|E~fr=1n&8|}40`tSAgmbhjpPyXiOzZj%re0xRts{*^UfB)+8`|A(det)CA zx)`6f-*0HkMy&_!1!g9+S4OsPFVp>gMEhu@_t!T}KNh9?`;kod_cv&djOsTtvPT7W zY5%Z)2NuiwTQt5exc>9~MH_2@2W`K9)1GL_$qP}uzq@!Hi|Mre_|W$KNgLO?JZR4| zGoigauuI#=>oK4I<)}XYaP@h-n4h*kpVRj9pZ0-Bzc8|W|4_d%N z-1)X$F`ag0WcLp2()ee&{679!QGYj$;?wr=Y5Vw1qx@$_@z0LZ-xbBD?c>w-@!u8Y zf49r;$NSw;`Z+G$&p+CJz0+P_>>t`&1G}`p&UNv+7t?81M|O|Mu8C~F-!Z?RkLO19 ze~&9~aWOybJ0jbkADDiBlLAqEm2g;N8mi<8AFZXly`&{`a0zJxqE3*Cd4&(d#{TGx?()hRs zTAp0w;`#f})ORiJ-?Wbg@k{3e`(sBjopx1Z*GKl;$ley%rSaeE>X#PNX;($IA5W(H z@u%&_^S#k{vp+i&n>U%}$!y+5^DtS;}XQqC?jNdPreovIXE3%J9_MymrDYBoBZ2$LQmghfjM7wiT z-&K))yx70gcZ}>iBK^V0em1iG_XRSZzh6e%-|wR>CpJB3`}=XUE24BiADMn4O7Bs; zAI9{)k?sG!!1Ufx`jE(eE{Z=YNH5)wayQ@o`lQ|6nwQY_^NIGdD1CHfzZluAiv7*} z{{12Cha$b-kMgoRD~pK&m$~{LFS?lD?^m>6jndzYY=8Yiy}v%8-6E>5e?Od;&8!T+ zFOc==8|nK;_Q1#<64}E8yL7*}EZQ$FckS<5Y!B^@fn7Sj{Cn$?VmfVqKBMjXzh_h) z@2C3ww68D5qrEP&7e=<9Kh$rH(icSbEs?z;uuI!_rR$FY#dO+zBiq-P>HhlU%Cge_ z{$OPHjqDFacE8B}aAfz7?5iTXDzdMR>}$%t)Rv8DDK8btS;_KNq1`m;qV}`0<}2j; zW&cP2euQhF3i(~yrh0PeB<{^K2*-dg5pMIvt& zq#Qet|C!?4rM`WX{tXr5oK=w&lKb9kxvBqx#;(2$riQYL%b3GOQU+((n{mD0qdo9Zw6WQ}4`(d^BxbiMZu87hHXn)qb_?ISQwLT-9{sYO! z^!tUxbnR&u^~aRR{%X{JL$p1eT)fMY>$UxRTzQu#ujqWT`1k6?NO!02ncV6xPF(qy z>ifw?mwrWZw%V5e-xq=s`J^=Z`^w}Awc*3~96ukF$bb4F{e#I*)rJr0=w}><b0huy_RQbXwfE}eyK2vO`fHLq)rJc3uaIxn$5ADZ zieymIT5b4{{wkj2z_P1IK9W45HhjPt`u$8y|5!3n<6}>*NUlw)qVm40?QiSq_wi&& z)E^&Gd#B5PT~ZOHKcekD>e4@v{CCv;KH8rrUHYezvsw$t(ZQAX>13DAuSMdkNG2yu zbiN#Q_GgkmXgcmWS0v+;udChY(x)ZIwLK3xdqVPc-Ot2y{qb;Q?^gS$)8CL>8l_i9 z_6W5Z|8vRbnj>9dlTqV$Wf(aOQ`xiJ}9V$V*>bw9y2 zQjyF_c4|89xyg@pK6G>OZ%UTx{C?8u|09{9>!q`^KcC#BdVB`5BKbmcjq0mh`mIUV z68&w-OS(T|Tc}8GPo5|#e{r&`#QtKkTH~|4CCNmMkFXWV9m!ygPy5TsaMgEp=}VLI zOZ3Z z@HwgOw`Q-`^2}bX`kmsaNY*3=wEmpWYm(FUOpIU2KQTof;e>lxoB%6~zYyVsMKacwN z+NghTQk(g=CgplQXmIt}mh6ts$4#|;16_GLl4F`a-Pt>nfja+reeqDzK03dirRS$N zoqkvHhv@v%UH5~juKeA}InjQ1fv)E@E`3jOA{vkPiXR8A3o4Sm$`Q8* z_B1#(f5)LB*)QMt#{<=>NDd@5T7P`zph7-xxDOLi4$j9%lAXFAJ}T$sisV;G`{?@Q z-`ZZ}L03Pg`OUs1YX22c`Vk2AK>l7){EH&}k4-GE(65Zz`v;x>*aj++UnjR~f1w!_ z$#0VH>wH+??8lO?X#3Gm70K_D?_i?H(N7)~^7(`SHkJpp8H9z~~pUHgfzeOUeNdA?~jQYQ&+G||;zmwae^xL&O zlwFa$oea?Nu5xx+*(D|EXO&IX{$+a8vQZ`JXP2EQNq<+_U-f*AWg^$}Wn=XEX1BA? zDSK4+gGOhcTedCQA1>7E$sI2JJ!L~Q{zhjP%6e#gF9PISxmkrSV z#AgiT`nv3W(f->fy8gOL({YcmLhkq880qa^*)A9V{bkoh<2xwY-%wBg`N1UV35Oh* z_SROg`H}X&qsR7}X&+)}Qr!>H4XN(Uoxyq?(G9F~x(`_AM-^Dl#Y4fm&aiG$?PI*B z$+dlB;n%fU1J-`51y{(E9CPK7s(!w3J6(%lYj30Qh3W^Jf4Oj~b8R(P*V%e-8+nrB zetD$2-);|h7g+1RN7(9o5Pn_%hlJbddj+tS`>61R>Ia+um~g6d?|HDEmrsDTtha>o z_VOeLuKQD6tGHHAb)DgTX{viL&hb`%+(S$&UDl+lu+_N-{1?%W`!=S>JyIK&Vc?F` z;BNz#cQpLE;Z%dQuW&B1I@bq0SJ?8-hrbhJE&}TuSPIrL#WidCerh&=G127M9O$01a}xheeGcHCPxJ>L79 zrcLqQ*1TK6 zS}s2KZ2m{UU0I(afgheSouAle$}|qPhO#b5P26X`&5tErrtQV@Ge4G1neGpm;^wae z<4F!o7xN=@nf6H*_`3)GUV$Hbk?H#d{;I$~Fz^ov{KLT7#u0&LWZ)ki_{RqRYOvO` zCh$)MYhTp{To-Ud!1Ds0A8=#9ivnH}@KSI~d6HwfJgnT6V6EHgz`q8p>v3J+-vF+Z zCpk9B!!(=08fR<3+XLPS*7oiS{CfibKCssFK;VBEtnm*8{zn7&^c z1b&RK<;9p<-lYMr40t^l6_f+*%6dDL>kEm0B^hlj+{}v&u$^~03TJ(&=^`(t$M9!; z>2D4HhsZe1SRAm$LEfw%HE4F>KUfynGze#L5HmwZ%7H#luX4yfuOdS)zY^*Uu*Df5 zYOX^wt}NWa`3W|CwQxRDp5(Yi9yS(W(_kOV zwcKTa25cJ4t8|t;$+2D@)(>FQY=K|*BCz>)2&Woh(}ORfOlL~bK5R%fuqMEranHJ!mXlTlWVPLiXCJgi+{ z%Uda&&X*@Sy2vB_yhHbUhQXkOtf97nK~g)vHRrDhp; zA$g;`6qZvDHvKmE^&AQ||33J2u7b^fSlH_GEHqzbOt5KO-!2k|9PQ;{`ySXdorSa8 z zLOA`BJjtEb0fc#+)ZAL z`v_bAfUT^-!Wjlxj^XmKdV)3AO z|4;heeGH9>dlxA>Lyob+)}LUj!xUi~-#W17Z7z8-Of)$<$iwOnw!B@0vv0_g9Npz% z;|?}WU*UY6JjqchkHRYUKiD)b&U$gk;nv{Ss0r6#FQnb;ByNsn_mM}*OJOzjV2e3U zINL}~wY=otB4cf)%Jst8Ci>^eOTK};P+rn+ld&GnkFG3yon?WoEEJPz-fhsFW*>Vf z(Cihqm@T2#^$WI`9pTqFVDqCt?OY5t{{Z1^vpmT$SRVNnhwQ8Gl5w6*u^{BAmPhtI zP?AiPM~aHeFBc0eJb|!OC*|p#HEQ(3RPCC+EFHWmF~A`k)y3k#KkH2-x+H z`ge;zL!umehm_8k$*(N;M90l6a>h0B5Kx9o>x z{QcJYp;y4}T5b*Jz$w>q8h;4l>|&hZ;0MWAkGZxBe-E)W1-5!lh5kp>V?Ej&0Gno^ zaEeZnV<|M+4`9>aGn4sFYSu!d?}fpp*(7Xb;qN@w-t7VJ4!DJc%l0s4D|tzOLT)23 zg|+Mxu*Jt-kz>&0fIi#j(EX-*_A_!@c}agxu9O#x1GYGsaISjH`Scg^B*##B*tG%J z^rPTk$NGTH@Aia);*i6gclMK~$cx2a06su}g}h{#TymgY*)JU?mGWZ!3AXrMg|kQG zNsb=!u(1Q1rk`;7D|wP*h&&4GSx>NOMhItz|At&EFWIBy zneeNo0e)rdZ|P&yG|G$hGuX;q4!`b2VDoPlwwM*d*>B}Zj`s4fegK=klW=xKp5*8* zkHYU9IyOxoaivetKM)$->%gWN0l(G=-q}pwYepn+Eede})>&jlxE@3v8NN;p{Ke)X7WwEP0;1Si8WcUjo1O zKiK^D!~ZSD2b+JJaCTgtNNN$vu!nfIW zu*F#hzxEZ_{HughjdKt96?u|ltvu3yICS@xt^S+DWqG#?TTHO|cM0bjbAO-#o91w! zsT59MlP5X4$Rj=Bkb9J#7kY@x^7a+ZUZ-Y&yjb19rWq=nzd_9i@IT4uL+c-~>8A^4 zZ&Fh)FZsX7bLAy{i+l_C-{ghzV&et2ICltVC#hKhjjjc-Y1RnmZ&PzWSj$2m8t)di zISjVEkHfEP2WYsbEv5j&RdbOr`h!_*z_ZXvvaAbh9>oF8niKc z5B)Qt`3~CxHjUfs^m-}W>o$lcEims^F#fPC$6k39wlWUb;v5oAwT+JoXXjD>gmB)5 z{G4#%e9xBmRp>P@mXKY)flY&9&he&Dj^<$1pQ-;VM3=Rr-i^hDIbfdK=T0m0c;vK4?8fc<>Q^`DPi{ncL$ z|0T>@D_rsT3jI&2L z>q^G?)bwD}KO&rF)Eoxqq~hRG|FyXO`zVjQQvEXZNyy4CQ-CnJF+!M={ar)0EGH<2mGu#Z8ql-LjOu-hXyKr^`HGQDbF$J5Z zN;sWL%@AnLw0BLXW~6BH&yih!P9xVLZ>?vG|Bidt4C-Cq&Lq3NYZiGmVrrei7IOpq zXWF|o=8ixEw!CidQVr%(;YOAPHcfBgte*Z6!f69}6#R3@6NPPm16y9KwQMdm=#%^= z@?7w2GUipP{w2`Qqko-n;fI_LV2im)IKP>iZNirKVPTs;VACIi{ub(Ag+}*GuxU=h zuX`rg{CI1TYCUlYYjt+(Za!nWb@zF)TXze{Zr!Qhtvh8mPrg9SR4FTMB)fHYE4dN= zg=DwxRPW}7@+xSQ-MYJt`UB#(_po4V%OT$ZcT+Q8I9)|v2EC3W*!1_nuX7u0{`JC{))Vt5SH}7> zJ=pZy15GR8bT!NE0RB3;Yrwt1_t5X!{u8z(ZhQWp)Qp0D4Y?-BJ6*W2mwCZfpL$`- zJ1^i$;cPAAbP=|>1h%|xT)sg~A82$gflX5-oUWs02sCFp7p$iS^Dw`c?AG`<$#uy4 zzk4p&z`Sm~-$%xnrW?tt5mW07wmNTs|4iosjkzPxfGzJ{;aoLsh0{$e3;mXUo7^kl zD)9aEV-6Sgag4wga||^9P0iFm@8qUaXz$L24EWr#s1R{``RK=FdaqRid%J1zVi8i1R~guqRlb zfK9VSINe3f4rsJ*!KT?Qob9G&KQua5!KQgcIQ=m-k3*wzz@|AWoc)BFr-k#qWLzKS zKP8_KPJcvx3%rMn^L474PQrx)oNr)@-%Z%!41`AaNw8_~mczyoY<^rWn;&d`T!yCm z_6ErsaYp%?E+ipjRQ8#PT}kj zHG81ZIRiG$0pax5)Et6FaS7wZ$S3 zmIXHdV&PQB9rGtwcJoIW<+Xc467{gWO~h`mez5r=JCpvx)9BlYKKmo%cM2GLwY}E> zTl{{|9HoA+aISerK(G5A*z}{J{}c6Np?{iOE1W9Vf&WbZJYkzNV2jfzoE@VEbKd$H zY?>9q`7_jDK4*U+Z-rjx0NC_yK0iy%L1=W0z@~XsI6Y2HOLd?6KJ!)C`A4-%El`Gg>(RCpA;RZ<5h(`M=1Ez;BW75zhWi zUMHNYegpU<{cgU!O?LB5_r`F(?GnAsF|gHVpRm=TTsSMkGd~xXo<&9*jjM!hZGtV% z5aFx|^_VBQ<{c|+YZGkx8t9u+kLxAV&lOJb&v|kzkcag%*zztG&d#Q088q5nuxVBa z=lDlyInamcyU6Q>EhgCXn0p!i5m1h8^01g-(>x@cznhwa!f8wLaqv0h7ollI#`-lb zm*Fw46wc122ImXgAHY^tcWCg>h;j^oM)wD>X@&=Wu=$%wo=m@}ttGg?IPHb=)?|!n zejXXm+4+6pWwjH|I@4b%oL@rj0)H2BH~23lR|%)eLxpW_ zfGsBGPu7)ste3(cd7cHEW+ME$uY%2wwUFk_i}{}^?}fh`{f`9vM8Ho4{2cf)>R$;M z`$^uN{#MfG#@IvB%jxeF`1=UkJ^;3Q4iV1u%N>UbTc3=D{wUiEHoZIVe}M6)ia+m3 zcGr;FpYxITPs|Ipyo-cW&ASX5?KiM#Rtx9&XI44ze8#cXFBI%7np7F%n_kJh*aLI* z_l3U?{n#ID9KlvD_JI`tI4cMCKwFz&(_l}?K19uYVT+G_pwN$gu<4gU|6%%9Kz|i^ zwQyQR#{OA2#=Zhu-p#^Ue`@v!rynHm6V9(D9}>2PrA9PwS>Y06nbwEASA>=l~h2zW% zw!GkMC^em+S9bI8WAyhyUfnmqmUkfhx|f2@KTbFs&b&3y=z9mSX=_4%jqXgtKwfxV{=sJ|h0~v*csoYVrx;!e2SBz!vAE za5jM&thM};?^S4#lDwM zrsna0pAI+^PG?fnU)av|V2gt}na!eRq;P&Cc_Q?uIlni+uk#sfapntW4a~bhIGsaY z2%byEe6u+Qw!CP&#RQvwop7!(9~Mq;Vw^{XGi5ig=F$HWG|F!Uj7``4Ex|WakN0uL z?ZCIt@7~k>2N~Cd>3niGu==Znt*>w`k$#?Nf?9 z{V>(KZ4=JFLJih$s*E*jeFe5UKP8+krylQ@ZC!v(gE^dim6}$<=?ZcM_%1T`M(a z)57^C@|)mqlbc|??)PkY-F*IU`csUT>fN5anf~6$`!dHGYU4Zohtz~;w%Hb2<>^8!EE{Efot7S;jtIr}boG5lM}n9nvAV9UD(eys!8 z{Fvvt#@q~zo{PbzNu_VoZH(U@`~bNVcsm)_LfQApJ>cI#c57iL`5o8752zW5ybqDb z3fmk2TYYMTvma7Z3(c9(;`L=-(%K(>>&e!9OLx<6789&C{aKe@1p|VL$mD*TT=Kace>K zZY><3->rpzoMA2ef*Q9LG_P9=%Kul^!a>%-t%d&~yS4Bz`TuAwXv{OMg=QGvM;IS$ zbD&Z2 z=hkv{$+-5g{S9n!a9xoeVcz55-;rMgKS9Qv zOtnv%$=+h@?r;2_8h2fx+!h+;%78lw=TB1K1AgWH;6KnmAn?0+c!F&S_hejeuZKo?lyEA)*MMW3Jgncq#d^Z8d)myvzeL!|T`Fv4xqU|K;O2(% zTEuyiYYlAiHwtHEtixu+QT;Bk*0TjPXHk<1r%lLMBUWdy#q21YH>IXKG+KYKX%Htn zJBXv}D~wYKO>=6x2-`SMl@1mwJG&*m=rop)6EvP~N+nfQL#?_}KHSNTookOk! zpG)o}oTg;V2Wvan;`D=G+Y2_otAoa=7Ju4`aTW?^${5GONsbZN^5PmPdk^*Z2Lxt1x>Bspr(;v`AA7&TO zUk#1kG_MiPRX-i9H^dtP|1HqBXI{70DX$QJA!#Ph{EY{z+dX1u@1-7d*y3-3U*m5U zPW8vmw+q`Cfi2EH_;rlH=6_h&>Uk6z-CMw>sT9sCSqC>Kb>7BvGP{Tx>=o9}V2e{F zoOYyU2s9c8Y#P_M`a|(!#Gk*Pdh8GB#pGJytTP$?nO#C&0PaG*1A6r@6V5NCe;qXX z!}A-U`2hXsL+dxN)dzcm^&8my=)+v&JOYjO8`w0D3#S?5KLO6kPl3CUpB1*g0$bi! z;n$d8^S>pWYs`+ahg;h_V{g~?x@(xr7=NJn3+0?wV2d*hdAn0HLO9pFqXM1+);4yQ zax?uwu5PHCjvd%yVyv^CjM*35i(Dmada&uSzB2vMuF=BzmDFRbGyTDr25=wx-S{dm zg8zf`F9|eDh0_nwzfQQ&glz{~x%Ug_8V6&V_oIHVaQ0#H0dQaPp+Iv4{{Hm8B5ZR5 zZ1GP*a}_n^(uZjk8P}yY$H1n?HGstdn;+wwUd_C2d=>g49YI+H$A0zh*^kCBug#KD;hC!qK05;7?;e0qX*iX`7{IAwd==DeFF!$_lzF>=aP&n5* zU=J}q3jP%19}~{BZqI_Rr~f6eYF-siN7Iiz#O5K`%4#X&W%Ceh{?-`NPcyH34>g9| z9{$geF+Z*U!Il?$k^N$wJCou0=;cOzgTG;9jHvM$rY!Wpy0}a?T^Ps7rW`3Xn zn`SXI+Lk*44cIg*gmcxb5l$yF<|gR%a{^$~V_umbY<{gKr|^Jew(FjkKFbKiKN2b=#{;rwRmu}1P+$ZvwRjTJHv)Bm8~?aBIM zWo{o<|3qjOP~-N%FOVC>Z|eeV<*o|!>%bak2lS213pV|3Xl|wd0C*w!F!bAa{R}q! z6M_C%paGla`9O0b(11;IGSIXtm$J6AEU;237)g+{rbaJxnH zgDp;#@P+CJn}4WqemnJ}h1134ao{hKr+}A`8-*=C*y1b_w)kN4<92`gW#+{#?{q17 zN5HrRnchi1ZV%ZQfh`Vhon*_X!EK22D`dRAw=n{n9&eRR-%Oji|N6p$J>(Z ztJL6agY9Er({zXCE^2UTmEJ+drHrjLoT_ac!Il@NnRKN*$$?Wvwt|eU(Ao<&J+=v} zKbEW28EhIXC(~fcng(ndRM9jj(llVx+!JUvK%?^zY?{r&x%U4y;q-2KlH;Jf*ct?z z{x~#WqUJey$#wp`3jZql@u8%`*F0O^7UEBJ?@GZlsc9{ouO_zxtEPRRsRVzWnoi*V zBzF_GdV;O2zVPe$5p4be!nQ{Z0c%;qgl#R15-v33c@S)QtD(_4*FvN34Z)_F3k^D6 zj#lzW|BKvFxUh-)0NC_hg|oHP^cBvPyTJcVZ6kO+8Ry^ZUh*g~22&24e{E^ZUt%;s0;)5ill~97pA0 zW#Qam=R2_V1FpN$?@<31G%eWwVAC|gzPg1PcYgUUxgGZ5t)5Mf^G>cBoOcT6FecbE zxc)ak*!<(*Z$&-W{J4hCzQ?j^p*fctuxW4&Ur6Z(n;+-042w*T#lramGr@^W9d*20DN zuw7s)x4m%o5aU!rGnexmY??06{E(XN(CFF(n+E5*{72MOL8I@N!KN7^obINk8XD~f zuxX|WXS=AG4&Fna4}Ase4>mo{YnhD&GzDsw2AY+DW;OW7jJXc_*3^S7CeDu*6X(am zdDMVSvop}_hNcZQVAC83{9yAR5>9pO9v8NG-bAXE{)BaFDK7>6eo?UHZ7rOsrme8e zfe!HRl_xnm1^!If#sX|{`Us~#kS95=2mh2jMPBT?k-?^)3ys!!0W>-Xz@}L&oatJ? zX*Jy^Pjal47u(;k4Ow2W<;C(ybq_=__Fb=F(_kuCoC9DT_rqWTw!G5K zNxPqmP!6#9p}bK2VDq;Wwm9I>pZ$VyD#V}T1S>~pd8Ep{!T&=)-lLfx?=P~4>BpXL z{)xhcU(ye@vZh0?G4Vdj%EEca&R<~D4-`&+#W=$P9x0svntq&jQgoOc3&4lS%Y-v! zy#H$V8~VW(f0gis>Ia*Dld#nXY<`@B3g6&<0yh6%;q+0)KLCw>XDrw>c<+{Jogar@ z>-MB@yT_OpZ2F_Z7pfm@{#S(a-%{U2_Qq6WcE>)ce!Mp~e^ua@tV!A9%!|2H_B(QO z@DVcRMw!M*1AS}Z>`7|c3)>n5TirTA^9O1&X!L##*fhO_^QWj80L>pgn+9W@AEkc` zG`cpyrs*P_K21#@@Sn+U&Kx7-`o#R#3un*JKN^1JvBJ6L#avB~Q-ish{)Jo*R?S@D z>{y31`odH^Bcl^8MiF$=kp$kavS$Bx7EseA%REq1XEFhW{=4_kz`b z2>fsQj|O~P*zP%itq!;*v3m|+^SkSllZ^9*_^qCA3a4+=-=y4^TOn-kiNF@8op7f8 ziTB#}o(OE39)V`Ka9W0yD}Q?hmy>4(+#qai0b87T!qyhB`5T4vvls{07&b=B!A

Yzf3sSysL%NcQej9;Y{cJ24Q>O2e!O8ZCL+cJGOGcropmITQVlPJ5xs2 z*nJhS>5**rRlw$NBb=WjPjcY>ukDjvgl&HSo4&iS?GNs~t^1E4xgJAa9mgritM668 zmUkiiI)A|CUkQIJd6ENc{`K(dc>!$x`-QEntpV?XUgLvJe=yMC+?V2JfE*pk{;a)8b6;+*H>SYE_54bG1_I$I8RE<2w*N^Cnnf=yoozkVhY zY<^r*Wf})3eS59>p)X@&`B7g6KR=^e?ge{{`;{WA{wi>aA{ zm^$uYi;2F5lqfXzQz*!p&?aIXE_ zS<1`0vfOUMwl{(;FXn3Y0cwT_=NTE-X=zTb5wW}D)O3QTpPbC)0GlQgPOGTFe6x0eO*0UF9aFIRhY9CbGw%p!G(Olg?)qOf zZN;BnLp|!24kTkOSYEK@#ahS)QG>RpgUS7&-zq0zIl!iOYee-U#h-qJdek8uLaq}o zbYg#kEw7vZ@25YU|1FVsDDzezZ)a-2mbZPN=@e+dra@aQj;p`M3G3fcG}$ng<@CyE zyZNhx?RRRx7JsO4b}jP`7tTLUMn7aD$m4`lTr9}p`r+bJ`@y}>`UEwNqRU5;(I@FA z$*YA6qdZ$3)`>s+6#W~7^U>t3@PC@TL)hjL*zz6_PPM&{K%>9i12)Zz@asJ;u=(E* z&W1DoTf+Gma!XlX>1W7ovDP%c+Xu$d@807p_k;ek^y58OHlFO(wYJ6W;mU4}>-jNU z<8{be&Ae`nUq@bmI_S78L|GH)UkaW`UICs&-T?hLvU@L9L*5!__6M57@K2`ZNwBu- z=|F?`Sr!xTr;MA))=*^W!}JEmar1vFITgSC&MesaAM-YyMh&jn(&^-W0S^#v_c{8( zmUpo5h3W^JAIicdoS$IxOEv%Z@5^Z%w8i2G7XOzYY<`q=A-9$!EEjpRS@0z8_k!E2 zCfo-)KvPFerEuW`tUuV|cM)!Ywo7j-~Pu*DoDY;^{kAN!15cY)16CD4P--yodTvu@abtX*K! zED*MS0Gl5@Y6eoa%W*H3v4kl=dEsF z^Y;+WZem`HT_Hye`8&C$=`Xg$1e+h@VtpHq(NOVQSzyx-7tZFftP#S6t}F{|n$g1f z&D4w$w*CQ|W}I+#3pF(XPZ73yf=xeN*y;&3|2$!vGhp*K3TN84i-j#F*fe(tTN}aV zUnXqzFBi_{vz{2!YylbjQu+mQTj(3f9RkL>v+JC24Z4^MgP4ngn70Qp7Y8ww-!bNr zAm$xG%r6Hqmj*GF&lD5NY?+UfEho1@8^22KDx50!33#xuy%z&p-!6h?1@o>G&hH{` z5-#*^CeM5yXL{GqcTo-_;rwgVU@fGp$$f>huahzV?b;w*3qzo} zhnk_#=;zkJ7Jno(8WVewY2tk;S4}N6_BZ_?j@t*;u&hdGu;Iy3DGw_PeVhFkHLh>h zlB>j@euIoU+ci1Z@*-TejvA~xn}^{VtPA{L%X<_^}l0#Ra1p>?QhvZxvssc z`Tw=O-~K;qZ%e6L`rpjk4!oJ%K{)#kxs!0dg^W3G++En_7})xDAT-~l9`hvq9@+KV zHqWNVK9D^?Kh{zHeR37@?jR2YKS;*fNq3UR3KxFh*<#j+Kif|KbZ8#(Y#O(Ybd17v zgn5$vkoqOU=`QkW#Ocp@2(~!uq5lyzSV!q@@($>K?Ai2tpxHzJKH>Z)j-Rm+yk-o0ycjK;Y`b|6wdduKAnZFp6))0YTBYcx=z6s z$L$IGm=|N3{*2sLI8#6NbK}9nc6|u8I3tDA{mkpe_bT=|*fdjwv!7E_C!8z0G1WaG z9MeUjv2y{~;w%gNVDn>dw0dq3P7koGt-`ss1+_{K(%%mJKje-9cL6_4Kh{X5+#CE$ z`q4j@cc5_o2>p0Y50RTg|7$Y(JUdLrewF`*Tq&GBO70x^y9Mm({5Ul&#Gn0^jJl;q z$f#TXJ2L8)KS8bzG&8~KpBr!|@RQVIugLyDMjg_p$Zl>Z_Y;5qNBRc@JPi7y^kcmj zbl(8m7>yCm{zMJV3;EMz%#HNVT2k_c@;>yZfBFM}_w}2O^H$>kHxx7ta66yraQduAB4EYkVm?eL>@c)n5gE zk^T|Fg=<((u(idFsp>I~g?7|{O@sMn`v%zjjqq!qgUyfeP5;hvmka00tA$MuHvL1; zXdTLh)0dgI0{jXY=g0IPWVAhhmF(8LvYY411EGJ7nvviW zUJ&T9Us+7dRpX7wt99N1|C@}7b{X#jtLD*wpB1*eFT(#X=6xmLavAsRE&B2I6w~A0 zn#IK2GseBO{GZh0^Ootq$^F15$%BP6tq<90rS3~nQ^|-f|mhm$}^T6d~cW>=1 z@)G!)ke7p-k~f2!k#`Aa%6o+EZ~9=H5Br4eZ~9>KKO&rK9q>8->}^`XV@9x&FC>H7qF zoI5POV3JlaejD(4nYN?94tycGK{(gE z*q1EMYT-=%>)~%t{TA?h$!?u?AiMoX{d)q#pD!oSpB#rG)>2Vdw{k6{lNw19Rcn{9vScy@cZe<{q3wXc@g}Vknvd~tLGZ{ zwa)7T-U`+@yTM(UcR%=2@}WR~B;aEKzbKq_r5^XXvy9wA=6}|W+)_Bbj9e*fb?XRC zcltX)Q%S~J&a`e=%U1th!nykK+2-_e>IZ;(klkmBdXn*(qD&d<*Y+Q(Cs2<(6RWD|fC@ZVmq+ z>f3@pLU!kxA>>NeCV;x`05FVN2q^o?MR-%L3D zB;%uR3j^Uv60nUs`ZgOyO*>(`UkWzO@W2l?zgsV(nHT58Oc`~v&&YvIk9yi?Jm`Ek4-tP8YWL7;B3UHcg{&Uc)%9 zuas9q->Qi`Ckfc}=quB^KAFP2ZN;D6K&}+F`hYF3>z}FAbcaUU3pP!aa6XM1wAc9O zXP=dHtDjsupW(Su@7Z z5NExw+l;zt<8PAMP98sT+RO=2LjB|kHAVmA8I$Txsm;_0v!{-qD>a{TO40;mK7G=R z36su{GHF)b&8TqPYU$mE`dOz+H}L@nUm`$$OJ&Qhm~-xDoKqh|4wPHa-8t9XWuldzQ%=j3q_{+Z zReQT`&O~YGDRn@nzq7*C@|`6Zf>RYyWBy+S7>)@uYsS~kn)JEx4fPXd&X%=2c_vr< z?Alok<8PYQFm-(0ENRCn^S2~3CgLd>&^2>r)=$1++Uy4D7Ps`~%#=-G{ERuW$t0cT zl?=|LX?0U24Lv+sIQi5$TSG(FHs;gZ9XTiL$ceI=oX_)Crp3ZTevgxy_AtyWwfeIE~kdnZCTB@nNv7F1&zLc}pRM`;(N)P3PFGz^E6L<5W65#WQx(|YPP+}p>+z;(b-ZZ79w~{laPiWu+pyWPzfPLk ztzp8%+R5&ct5k^i^^<2$u9r)mDfN>}LX=#o`E&00X)_yUxve;^gI$M=pCM<)`e_qt z&n%r#D`y0pKPS$aGDWszi)bB&E364MH3(4L!{D1eXQK0Un>0(tUJ|1&te!dle8|1PO$#OoMAhU3C{p|5_W|IrjDHG<@`by(m zd_(=LIdT~^bJ{7@brWwEldNzw(`n_RQ_fT+&97}3kK{?G1acdY^hsT*v)B{$nZ9Oeoz#GcN@ zxHx)Tox{TG4|mAZxhhOw_Sn@2)=YKT?3&Wcn5Jb5N@p%CRVM=*CuZw#fX;4Rrsq&a zdF#YB9ExSCotA5T|Gtk0O;v?AA+YUQC0g@gt8{5uW{y5xYjg`Bri}?=o}Obv#IP^{ zqR+yyA!6E?AZ{7@v>F@Yt1WaPs*$Z`u*N~`j&P6bnAzD4Mylz#d#xEWlaXR(kYR?A zU^&@#id*@Zg}9zY4XX&IQ9QPo9|a#-xB&BCW$Dds89dQcRqDqsm1VQbdH&YJ7B^zd zsjfft*|1cfFDsy~ituTT?K<06-2|4Fd8ZurM6jehW`vqPG6OG;Npk3nM-&= zo3(JUJ00oUD^*&X*F*m-P}EhCdxh*47Qww|tctOHXW=1{d#Xj%TsK);U9R62#wqpd zWa0rF<-2=9<->XNBn$H{he~;YG^1+nyvn()`oKKFwPE6)x!N$$81u`QEa9+d!^(yE z3Y#`2OwQmuE7}974Rg+~|BQK=e(n;Z1ZxT~Ztd0RwmpivyVoY>af}=O^2Hb!?)5#M zjLcj(zfFkP$-1%K!vsKfZvAkEez#>35A%h(+*Z6$hD zP;JzvZ|-c0BXKUCy|#tL<4((EXJ0vCauz0q$SpCm zMdp;_F__AzuI$=6nJY(a5c;P(T^pDKN}s=CXN^uYvk}y7;n*4NWHYPLrnakQl9|PA zzSt$1NoE#4i8SUWyCgHo%vK(mdG3r6b>T-(qq>3Rc@v#onxD|Rtk`MM2L-&E6BAQc zLk$s}D4gth^KPBbo8ZO3wX;~qk9%q_y=CSs*tL14J4YU#)Qt1bS6F(d7VrF1wE%A# zaAvPsT<$)z#`}*-_hjtegIX7~a=V~!{dvyz+kakJCC=aTOYbaSywFW3pU?L(cKy|L z2(BmQEu3A|MrwJ*T$O6}lshiZrKrJ0$GdBM(ej-)nDNphK4h4)A5A#%1^mNA^& zxrjIPcA>Ft+-@iReT#o7;}DGnq+d7WdeXoyANtv#{l3 z=V&{{>tQ^q@y8sFca<=2;euAxY&%6Rw@Wb!TV>N-q%U&pwsYIPjWj)McsVz(R9|KA z(VUGDWv5P{u9>uvok#TUogbgiE_9#xdCkBFOHly&5Ol9tqY{YV_6nvQbvCno`x>d< zdD}f5y7PoLopAoa^QI+ytAmrQjo!wARiQ85T&%fE)YY+jaXxpZS4;nS+`NTlGi_vR z;!|%^$|GvF;p2+=OWc=CZV}dtC$9*vdDQ5{6mAz|3~8qJ_uWIEqvLJ+sIJyS;;RkS zn22d-)l=QZ%)xQv#CT%dwy{5yvXK*~06b>K{*L+Xe#Vj|*|X;@oPlA?$8lc!lt&`^ zk*ND_9U!Q$I%`FiR1O~QNp1LY&ilmdVW>j!q;a{WgB3G)*kF$xdTD8nBx{Dr!Vb=H z*_;#vEqqNndXeKG1kI!WL_qS!6i;*z`sC892*V(+B5c(E|LP=nhtN2eY7vBC+jY=s z+=<;iuw!IL9+jYy-#ZRtFba{G{xFUC8ZU^(%hP)7ToSx`*qM0M1|B0h1dsnPZTdGJ zX^im`687`+qw$^vUJ5|yUlNQ3FGb@?KF0sOFJRh^VlT_T1OMeX&m$A@+G#u1_vH(t z{p*c_81Et^<+Q+#KIG|yWp6vq8{mm|9`@qjS%91M<-g>N)OolQyw6}~;!Xdf<1i+S zcxVa_?~sL;jK*af3JKop7T!kSO@|TjI$|&WJ!|1j0$vw7tV!^GYT+fn<2YwvL%dGd z3*IB(nO(-|954eR3klvDD9rjMysOrfAzoOgu|G;I|5gKUI`l$|@ z!%*_@`UBX+TLrvnRA>^si(qH^w;Fg4!;W~pU@QJbPor(9xpVitF z#Or6^^@Ot~USk`0U14Y9b@_|mzi9^EPp$Sl0zAgV3Q2u8Snan0cqd>){{~>svN)di z#7F!01}2LZ=!FE2%PpJ!-St<${k{cb!Q*mCW_=$^}Ik9o61oWoxHyTce&NSDd-HG@?8H08F-92#-BG|jR9T@6`G{JS3+m{HxhVjbo&j4Ez{V) zk7GVD@!~K!=4dSL1n*(knRu^$ooT78U!wz zc%8dA4u-x*(th8Eo$22|6mWyay8_lsBi^kDBsTGQvf}^P2npUI*qL~BpI}Wsjh7E& z!F$TW>wtE;OTe%fy!95|C!eZs#dL(#%hMkFb0C;lzUTNShvyP90#G}KS1h3XQKHdl39N4kG<6tZP z&BpO>*7qpJZ7lz0z|QoqrovY6zO=?m zZr|AL_o+2rHYNnT`RaNDFVkwj&Ny#h5W~N3S?%{hFo5s(s{Xyv!27LL-;@;mFGdW! zgI0ZeB>D9%HSmsE^&QpEadseGNZRlBR((@2_|CwHRX}W@OpzY3hRq(5#k z@XB$&Vb*snE`}eaLX-G69d`5~PwVHMA8_)J$o88Lo%q+KT{Pa?={P6H!0QM*6YuGc z0f+xzNxX#yUN2Od*=4-kIxzNp-wk#q-my*r?|I201Fyist8N4D3JWjP*~eRA;GMDX z8i7YYgrxm8TXw73u=@qh(`J1igdP7+Pe|~#!p^L39{iK}?=~1S4MjQ~aK13{S}u-# zK1za}iT7AI;EY5@_QxFtUIXTL6Yq@-$2p30A@Q#Ub|&5-T%5}I`!^Vif3wlCCf-)u zoM6a!BzQAmXW|{`8gT1J|L!*M7Fq50Ch#g)fF{A4XSLr^;JpAl;@t~d@$Yi0zQwrN z$rCW_1#hHP--o;Vx6HEJ)`s1KRy*%#qaG`*c0Od(V;KsUdfZ^O^D*E_8_`GcFAqwy z{oZTCZmi|s2e89X^+@o(WBGT?@NWgI#lKFLf8DZU`}cV;+P~gy*lo0~V^d)l>pJ$w z)^+R$@DEeFI}TPG{xw?hxQc?oWQ6#cI)){!~lB3)2hT)ELkPWIy@E(Vq*?wnI{p*PJ zuw@#@UxtO3J<@TY-=__{1)ZY% zV>IwSiQ(T|*qQy&A9&a4_It*_TV%~I!$-&VZ=N;3+=UxIng5;>;L*qQz{=LEdxw%ZK6x2*c^0N%|p@P232_ayLE!;bakd?fyjK0mts`sc@fuXZWy zO#kWz2b>m-x5L2uqHi?b8^HSv=|WQ9Phe-_732oI=RPmMSp3WA9gTNzjCwv~;|+kF ziTCu7fWz-dvA*m-!3$#$LFJ8?Q3ZIuMujHv?*iDFc+U>=?|WKcD|k39N8ueQM1RD< z<2ld7J2Aq?+hyP#wa!O*S7QFtzHul1{nk1k<%|kAB`AaS-EH7408e-1_~<-Vtpfp- zOM)l&nt57Z{cZoca}RVCy06e{v z9#Z}KPPNA0disY-vA+9YC;mMIXH5UT9PcEE;Y{`~x^f%hUV&P=?5 z@5a6!+T11DZUXEM#rp+Ixj%!QS?&iY_b&7$>+!l#E|+jL%T2vTozDbO@VI28i8lu? zM5LX6W8mEjFcU8ucyPrd!MhViCSEo0&?T;a|A{@**l+(~&EsQ$cMtSJg15<<$M*uS z4o0l+VeAF(3j2N)cwCQ0Nbp8k_p9T_`t!zb4ZI&}Jjs{vz3BR~T+%}p-qvycIQSjX z#lPj&IPC$vN*6)>NI7-ZI6VP8nRkD0;GMOehphk}V@ZSr?=$OpSamVZ3wqrD!NB{; z1=0O`-F50Yzm2yJb}S}OCmh10fm6EMAOD5D)ORD=p3RS0yMs`|c*Knfl|OKIXY18)+HI9~o};N2XK#+wMdi2{bb;FZJ9#5-x= zy=&mzZXM_AfyecYgamI1>`c6|6aDM#KN)z}T6l5S<2`l^yonaxvF`=2?xCvhpAEdj z)_A$|20RlK=dc(54p`&m#AN?I<*x?b01Iz7@D|6wOR?}$uz2HE*s(wU+rVqE@P^;$ zIL$HeYAn1%2HxKdJdQgymyEw7z$=M?M;o(0mR%e0;x|6jX`HX##$;#WrQd}2B+_U| z7xoXZGx1IWZ<+3oe;9aqoul!xr^mhz_%`fJyt}6P^WP~0F9GKO)4yfFqu)Z}AD7BB z@to`Z`Tk=VGmZH^MFtaZ&GhK`Pw=>Qn~B#0crxFAYT(_9>q!%DBk<~wE+lx1U}xe@ z2i{&}x(cc<0ADF`TH zd(pqM*o%LcS=SM7058u&^T*2w>pCJ6c+!4&)#c&!v;6BZBes9NE&nPF|L|(c!z;Ds z`+>lVW;OA;Uks`tk7o z*fV8ju*TN z@$mLzqJrqnR}V%Ur#c4SE3h;1nt}I*#>1-+53j3rzU(|R_WQDsb-uj4%zvNP$-o<9 z^~YY|ZHVFD_phIUx6u|$~Q=v!FA6(wg?2l)GC(mip z47}Tsf!T35xwQFa$9X~X+zH+iFectc+?>ntHo(C9vDLo|Zb6)-fEajBSp8dlOTdkj zX8V21z}u_wJctF+^D})Sy=39dS>Qicx!Az#XkBmQ0dEG5eIY5Qy>-1Ya3RJY3Zs8` zB2+hOmrLV^&Uua46^?}s4n{_>Y2oLL40EhnJ z5t@%@J;z)Fyd2Lvzkj<~&oQUp>R;~;Ht_DbD0;l?2Hv3$`Qggg^D~$EH1SGq^Pdyqk&=h^I2sP3H=ZX{ISy{QJd$>O7>tQG6E_v}U`78% z7SDZ-2b52vj^p6K7i(PtsZOYEx@hG>pe}3=yivzuDFW%WJKBJ~rZAN~t z_)7x4?kHPYT|2O*&y2#_)Igu@!BDWNK3FoOc3>dlJm+i=mIRv`f+-O^m4ZGL2|ec| zhkCZ;?%G#BrQywniTCZluiG*yEzq1CsxK@;YR}!p4M!TL-FNW53CkWb((?-=p$$M_ z?t={z?tAFIqGgYI=^oDUnu7Sk4+FIW0)30uF54MsZc1qWSbpzVlz1fdQ2N2*0~7X7 ze05vhX0%ww^7z98oZ7=dCu2{A(=!RC)6)h|0E67zyhiHRwZ>ciBBBCB6^;wLA#?a*fyG!=_h4k%(v zWF)4g{KAQZUUtImmpc=^(he4GE}B?B!SAW&*!llCjBs!@>My#*C`FME9*4%RsyR&(1@ zeBn$dT=j0pwD|Q{Q+jh=YC(QrX?4FvY1y56re)UjOv`wnXWGDiz0%S#>ic8Vr()En zl=UiFzH9l5jiVZe-~UWqM%_TPdDN(P*43wDlzATP%)qF3M{>c3PUJ+L6HZ{eVEp&q zQeT(H@gL^+_k2#}`0s`B-wU~VVf^>P`0t7F-xK4%C&quzOEDhe2L^hl7UC%AJt8p_ zzdkQ56!u@(JsQ-n z>dPGs8FilR@mlmo)4N@rwD_%#^hKL?r`T)JcAFbQ`6H4r6C@>-WZxHYPOEv~J{+HPp>0lWVY$;USigLf-#^WOOojXS(?x;ZaD&>a)`Y|Q3722nSR zbZVDYcYzNj!EjO%j>7jG`d?dAg%YKnX5K*I(rQ{T4|))ON2=d*m>+crMXFEZi&#l1 z#PRb7nq%`OE`3to1Ue<|Pkl9gU-912m~T4dZ)f}5msFCwCsKXN+0K&cSkhVtT9kAO zCEbPbE8Yg0Bh!D?T37Ka)O)&HZ`QtFa5Lt4$s_x~@y&%i=0D1tQE;$e%(x)Ntnbf+ zJrj3lG}abWxk!;?KXAq@-?qFqy}dIc0d0|xfVOCGMsOxiLJzVng6P538?bM5_BU+s zMj~6k(b<7x&MUcjXJO>ncGuGHH7^w-?M^4Hxt&Arn7jF7@p1FG)MEPS6fUX2qH0U# z&Ps{QD_bx-1^+3&1k3iMI(BYtR$ufv*LS$jt zgPXA`QZ_77kd&ozmgeT<4$B#td+Ehael|{%i@5@u6X*{X)n0t-kleYs6@yFX=T_vD zM)-5*{P|V$23N?X3+#NVO7Qsv=fku4z6dVfnW8T$`0gdn2|D~#-xSX#-jyd>GHyjQ zsq`mA1RnGAd5Iz=^M2Tr-xpEa=UM6LmdtMxNdA0b-M#X6jHgp_t|fnF$+=^>b@E~PN=UeF=-E_acN*?XuDfv!I_Q#t_ueQ?b z3^}^LI=SU#dg+}kf5L9MU%rz4@uTEPUVbHyHRR~>y1ID&@uOsad@6ammtV=amDHr< zX(HmEkl4SoEZMJbSF1kVUHgYUdnNnhN6Ef_N?v2x-(|>)QNB+XI?-}3-iEj|9%HIA zj%U37^oaK(leI)2I^#da+wtZ`6VnG+@_Twdq6yRAw(x#n_`~#(Ryrq4A*S;gjSywr z!gxfP&tQcp8=_nOuPy&}Sn@hc<~uSH9xI~0?VMMX=>8J_Sxa7R$#J^=1EKGX|6u1g zibzU6-{E^zQX{s`_z!Y3_JsI%8x^3;7!e`LTeO@5zBB$~e6^K+t#03&-1M;fzy4`fhadcXz&TjfZuXTxH3ei^F4;$K;17)_q44 z)@3nS^d;akbscz|>(9Eo$6P2$Wv;+3JkIAO?^dWnc>Y0Z!4|?Z1kzq?Aw1_Jy@f4Y z?6NK|dEbL7OFvNgk~UW<8}ee4h`tdU&gmgMQy}sGn!@9KUhFxKhrg@z>!##KAy#r`kU>k|uk(SHP9a6TcgePi2- zpCRz!?;#OHUh*PD*9mh_fXIuU*9X$h;YPO`F;ek^UK z`@GncKqWRD?ja695c@Y==CUp?_KT_4^9*^>-vd5NKjdV+LWA)G;_wYeT-N2qp4}rj zdMj1VgMGh(jba%w^s4VYuAqC2tN?Sv+V!Zkw#k0vmqZIERYjb^G^5#L6^=+jegI$P@fZVcf_Ia^qUx+;q z`_Sde<|gV#D}JWI&jTO6Md`^4P9^oazsQUJF7TNehkX>v!w)DETPWXU-8FJTbQY9{ zE%Y67+UNN`FPN^+1ximp!wY;~Y}h4P+J@DZa$P_9BphV>DgM)E!KnkEnTH?HgV?h2 z$bn>qw8)$?{9&0X_v=$w{>n?49huM7rA<}DSK(_j?k57w<+}vaTNJF-=RI0k$j2-s z!EmRn3LndnuSZBaor;-2*P;@P^`a%S=a-;*Usezcqj>dM0{ww578|8taY_;W;Q|A| zU1)4cbaV1!CBDjS&KN4JG#6tneDTq%1y`i=?d&z^#XQEs^Q{(7EaR8BbXT-qQCyI` zg1>t0ad(YQC)-*kR)CB~vX*vbJ6kF?QtLHT1bf>|E`xAxPHekp%cPoh)bMi$tNmNzq``{c5#|rguQLYdwLX3+{+$8HtFR*;Z~K_W_T&90@ubbNF*s*J7GfH=a$T!e3Rd9R#W2e zJoO%bRvzEuKT;I`D@kXUl@s;5?khj(+DwsmtRuL|s{8H={) zhSp0weKv9cZ`l%04~pb%aH!)uW%oTY_LRY+WnX6N6``hyr#q?~h&-SLbg)26vebO? zCzSQ$u3s7ZuilyFy-SUs)E{phrv|3f@59^D8V?y!G4;Mx zBouVCzoDn_2GdFAJNWp$yPevX4>|FB-f?R8oOI%URp-?HYK;@W8)+|Zb=C#PB)*-v zE@{a7!N8XH_c%9xzjjXnEG8k>OysI`#w5%Lu1ne#oROHn@(-(Of0cl|U7X*njNjAW zsog!)Nln=KePARMuG;cWa$xGp!z*uGmAgB8PsZN#eYvk@@6SYwIvu9ftM{dW=4the z?K$Ybb3Hzy5dBcS2|nX}?dnZVO(Di@pr&0bH_!%8yB@jg>KFGZr^`f zAN_`Y^~X!Aqho@m?3=dtrad!uk6yl`aa&z(U3TN9<&1TyzIVv2h-pHLt*ehXN1WOx zUx|y~Gu2tQcF5_M;~rQUIk5w^;@kM`=m8uhd5m|8e{#7K*f}=8>CRIDw1Si1gzJ|( z2hnF65XT`kk$vrec8E+N&g#>F=9=QTU1=%poIp!F$_n34q%HNE@={ksrf+q!S2W%K zO5moo2kU2ey-&L#33d519-Xl^ZNpP>kz4 zrs`nvn5#Bll{%iWRna}MZ8=(hdECC8g>k#$cE|0B+nd`MnZC`*FCIU+W@m?d&Nxl) z2J_rm4s&ah8_&}(INq6*?8i`vFNk?N9%vcw6xUDm{EL6GopZ2oNKs*6OX8-yyO$10 zYRL;O9g^6RH+9wB4U1NWi%y@dT6N9JyK9CdHs=Lvh6J1QAk~L&eKI**c?>{P@1H$-ygI$2v_c#B6=<{FV5{y!@OqCt18hKOE!y zQSou0CAI!^$*f67CKXNHHZ^_PL(>wkZwGH9)$N_J$s7Y-p5r}>8w$jDpPkLxl z;?&dQW)&YPF1o55wTdsQaRR%>I!C;70i&j%!>DX}uBWr<(Jv6wH#y+e!D+mYkyc)* z$CnlqO$$GFA!ed2^^Z7zMok|~~w~ zZ&>pCmVC^T4_R_gxp3F@8EeTCEE)gCs!91j$&!y*a)~8ZTk>X0e$SFeTlLSdeilC_*}$kF2?$$3uu)&ZDtxQmZYZ|CBj_VO$F zgjXLWpRv;8tn^PTIn|PLESc{S6)Akak2U2Pmi&SxueapCSTg^|N${fUd!AMQ^WFNV ziaA!jkGAjVrWbkXN-nYF#a?+TozM9dDfwX$@l=8R_oyY$v+~ceWWL{1r1C#6qQ>Jh zDKkA}$kFxbWXDqq`uBn*dpFuhkH!nT_Wt+_Tj^ch^rar2lKt|O?6!%$oR&Vy)Nr%05{Vv1j@s z!#~OcEqgxiBPsmzoH0stpT~8^@zGDq+%f-mG+ra}F-9lV!Z+Yu`{P>iCh{^S=K;&U zoh9qnZti=!&Uor|qm}*u9RVH1)*0jB@2;eN=-+lNzlVKiJe6X-_-YkDvqC#O4Tiv0+~b|CYhO zZSZVAvEi7M7?>}~hw%eSM&E|ID4uhWl+_Jb3uWqkUiH!)FE`7YDr_S6vLgC-|N^ zPJ{dqmDTABzL(aM7yUr+(hj-crM{!cYy7d~Qxp*6r!#fC-9)|SJ0n@*F~|!(UC&Ha zdAZ9>Q+x(?;WD2Wdmf760ZLC^^y$<`l%BlkM^ist>B)<}2z=(Zlzu#R;h8=!Hj|(V z=@a2ivkd+u_$)dL`V3pvB`)hEpf4mIgS=q!Je{dAJA)5pD*K+~vlO2KJ}X=C zZcGjf1d$gUH-=5)jA35=aGP^~R*tftL;YaI^ZFxG^Gm7EReH|J5?k`1!9PJ>+phzk zr3+qf*l=u1-scT|H~FCo|5bxO2wrebfR{KE@=~w1`j`692!+Y1FnqJmOI{wLf=OQV ztZGQdrLf;6E@c9Ei6^;^`pfVGnvN~=a&qdOn#7i{$j}w8TE%qD^LZ(2DOBPEdC{)| zAJVZd4}q6*o55%1;Rmz{TV}q?x@+=DoXIYz!uljfUNGMTAJX>k(?kRO&U6dA0xKCGRZo(hfHp zd@AyX*ij%JTA6&o0vd%ar1>%6v&K@ZV{aDvyx{Zr6`#qAp2u>g&O4p_IQ)R-U=u&d zi+v0A75D+QU=w`@@S&^l1LAZXUhJ|iFE#_IuT*;SqGw%X9wRS$)+_V7_yJAC7AkRB zH@;NxIabAf2KdZtlntk_EM@|6tY&I{DfrO$sCAqb*uryN*5w6f4OE#tAV3?iN!%29 zv3Ul(*zBgw0{no;i_NRx#fIZE>uUUfzEL|&R(aiaV5LFa#cGG?&}U7>52zYj<}`AS z(|}FtOJ4k31wL~Men6~y*7Yvy#-mH!pM^^7p9e4Y2f<6-$&1Z9;Ipp94~d_eukZt` z5G_ z0M_AV+S79f3q>1Q^@s`;(v}=g75K*T+y%2s=P#UTL=LI?DPLWaaywo}LBxpIiBWxB zT&v)n*k5b59B-YA-)oMFSkw4(7syCLAK^=vIVtWz_Vs>Vj#IHXV*M(v-_5l{aO!dC z2Kh;?hB=CGAB>wU8k$LiTLT}(P zFa0|oo8VoJ3?^QGG%l}`g#>RT7!&V0;PIN6c)a}5?gUqj&E;Borp=cUUkD;Lk5QB@i9+Q$x=&W?&_?myH07`Kk0 zjm(>i@?xBmm78Ddw;onJ?+Ee#bk>T1y|g3iOkOuZo9973F0$>|rb05-aaczk=LN{b z^9&C=`or>=4~K(`C&zCdOkmbqj9V#;=j$46%zB{;o#?+7@K!vq46_vQ|D zS<5?&nTzLQX^hg_7ME32U_TpE#f+-C^D5^q;FMv{C6;yh?G+0bnafNcJ6J4Bam#4q`;n#+C}!%lajizCN9=MNK)a}39ckl1BF z!FerDCu~Kg{@~@hm1!Iw#4_>td_#N%>&-V2ZI?qO=q7A4T~7T7&f^ft3+)m{? zWOHt$U97qBXS6fsMz%AF^&klzpA|~osXvLW1sl_Oe6YT1ZX78WEAEtM3W`_1vL4%| z!@mC9cv(MHp3IFsQF`?1Ia78`YZMNa##?>D z$);1MKCjt{@)B|ouL$&bri-V@*)dYR6|&P??-8E~IpIV{TA%11X~9ZGL8pUGy}+|V zE*B3mo^JjgdXHF7ouW0XT@5h$Ddg2D8~ms&MB@5uqDfr?$2*lrLO+EUjfoQx^*RA- zXi1vv1IL--NqViT_yO$^aT(Jdv1EQpK9^c=u0-@;aokmmISv%0rHn%qr``X%8WAhH ze0byLhHR{)6+b!X)K2d2#I>~dqsOq~UR*)IUCr&e^0QcSh_*}Z>o$H&o!W36@nz9S4qAlONyw9vfD?814rjBvh zO^tPlQ#`c5&TvCQVpGHJzzCdru)dX(UVo&%#*4BO53pw1ai#={xZ<9_Vwt34G}cY1 zuPH3{`XbPrUeDI{*Bgv(%V3$@7X%9IcD8Hcwrd^Rb(3n>!)VvtBmHQ<&*MGBCfYDIpl*{FD$1 z9B)cIFA@Lkf&Y0(b~+^IAij7CR&uNvEBOPQSxzOK*xuDi3^$zmKL39KQK;Y%^No>+ z8KOS8+Fdme7U1ze2v~dX-Gr3w!FXpt&B`F>sqiP5J5dt;3&m+#rb>!yQDu209Zyc) zXT?YRRKRL-sk+*{>X|i|L7`4maYj$1K@cO#fHvD?uEBk+S@Z}>fy|{eyeK^|dM+DEFu3EVrA&c%g zEOgk}Q5TODIv<}EzAbnH|2c#I>iMlx)VQm$_V55_>CT4(FM1xbg)SHuwr{~| zEP0kCzwP;;^6#_K4_NY-mb~A}&-F_bDZCU*9%adV)@|A|&cT%V9N3h1S@I`_9NnIH zUWN7?CE4+0fwJFzK_}Wi$xUD3*(>=5OWtP5TMaoHubqo`tCy~1zkl0V<)7!;KkC^l zd8s8oVaUjFf41)%mRw=w z_n(I=`^${<==yYY@kV-h9j*52TjLmi+|7J_+sPQ&%Ti?(RG+H-6aj`AK`jp7(r=V-uqMJuCf$aU;+4nSuwN@}<~> zC_g3w_LTXZ03pg-Exeyt@_X8N4fc$mZP7C45XQ^iVU_>7CBJ9MM)9scjH?r(KN2rX z9c5V)uns)e#AEyo>1k|S!zw7=3i*ZW!ip{Yaez-S^aB%XUeUQpo> z;s?azS@@IWHO?9ES=xsEDRI8-$!k5Ir3ugHIKp!d6@U60`b>i#YVacsd(Jn4Q)KX* zSH!pLz=w)|!Aq<$-`~o*W#q;F zLFzRQdC@-#UT~UeQ>-w_i_J#xS$y#cdWO7i^BuImO6kdqJ+A?zEb^k?2VUZl5735# z7eroc-lSf~g^?Him*8cbWFSxYJ8o7tZcc1?jAZsudY+fE@ZOd*1DmWtNM7t0P_KO; zFZ$c5*FKOJeP8er6FrbNCHMi67n>aLnZ2o1*ET(`@p-Ws4OK6#Cog(-kE~@#Ui2(R z+LOHKdF`30Y-A88M&4Z2f5qYs6PQ5(~f=SjQxi7yAdnXI_FI5XW0q zrpvnDkeB%JXP}Zb3pdkdkg|E6dd=@P_(SB`7@%X=#82{4?mOVcPx7Ka2|mmY2ay;3 z8St6fw*<~zd=Ud8FE+gH5gW!@hz)tMNu~ZKm6yEec@7didC~KHl*tJX#B-306Y^p+ zmU=ypkr(|$>h<^`FZ#vcvj!{75Oy-Zkr$gD;4_CRn^f$i4atj5I(TVA@}g(c%lt-O z^m){4f5?lT%_?JY+&6jAyK|B5Q*$o5fXBX`6Ud8w59+l&dC|M`lD0SJCHGo44+Vn8!#+#@zX<0O z`9G3tyx{NhNJVMILcE7ZG{D@-^3oY|7nCjbgU07q%#EGk=UdFx9AjjQr7w@nL>vHO z59ZGD%OKS3@&%<8h)OV*|D--Lr#x~CV-2jh1PSAH!wO)hLkqsbYVLeDbm1$k;7j@9 zGPH&5j9a6x$lNN%!4KIIpII-}*uaA4h~d(K*s6J!%$>aeE0I>ZNihPRrOxvfqTzKI zMg>;-bXu)1%92nXTcZ{jMagqw#?iY8k+OLa1h7XIBhbw7b&eZ3f}+dj zf9=3}KYK;#+$E)VmM>mt#+yiTR2>(W^Rq4pK11Bb!Ud)W7))#}PsMDEW?78&HW$wK z)NBWQkfn8$$>LVg-l|}Kl$OpZTQa9@4{7N3*SXBt&1JK(Rwe`XO4*`LbbO0f>$W2F zqvGq$UX4m%uSO}{&a*T)))p_Uswm~?VXTaljXs{YFk%M$p_~{&GGbpIiD)FXe=Y=m72hQ;LRd|dak z2OQz8D*a(v2W-c%Md2YIuN8y@@Apuccqw7^9UkIItRC@r4m0ug0)XcxA;EhN3KNg( zK=Qhicu6{qc;A7}#Cs6V*Fi5Nc)T7p@pgCd{bSrA(}^sL9k<ByX~9iuw1pDIty2?L#e zD82RD^U?TrS?>KRRz%0XG&15~R9&QEcAyDg_X{)+^xgsc?_m9ihxXo^*LcL5sK|)M z`cSg}9(z+A-ts4;d>Uw;fVdd{9r}>^xmY=BX1>2JR}JEY<|1BbAXc36?E=RKCNpZH zvB6l=3cCGf90T4K`<}$|)2~I%F|Ohz@0B+pz9rUsc8Oh*$c5ZGM$Ck#R5`PP<5oRV z#CYGxu{};xVnuMvkv&d*W6iGii6bzr!49k5AqE4>vC4by+_hWo+vALSs7rp`cS2*b z>$iF32U-HhgGH%k6xL2V>Oo|Cy|>}Za~q#o?)QaX?@YuX_;23vet&0^+XLcPa`MW; z9LH?WWVCV6dsokQ_tEW(ucUf$0e(4wV>K;){6_|&uk3Z)*r$vEi|B9fsV@gI7NocZ zF*jH*aJb(Vh1D$=B&4M*cfX_fU_snCuJLx`qJ}-|c5m3VuVunp6OT@LbJ`o>^U(I8 z_nggjk?DJ#>_)_p6?SzVFHa33HU<$h&pAbi=GoRbFeJU4>~a1$@N41MEFN)aj1R~R zg}fXY_oMaNbNmiObcpe_KD5!nD0v{GdyoHpkAGQ>C36svDmVi7f$e)h?v>(>3U_|gA3Iwj>>mtXeb z8^3tDc7N9JwND)%p5JBWkk4OjdVGKXACCU??m>TyL^@Qxak^%6+%vn&?)=aH>U;R` z7v*LBhn%{oG;zU!`bhcY%m2IQKc2fbeAB(xzB26Lt2?tG#B&zElL|9RPOlApS2^WHyx{)?O6+&=xcC+GCJdd!dC zy7apzpPBOCe~K*r<%Q=Z{bcXo+Rv|eBJRxb*FJvxgO;HQuMHeJsO*8oUq1Hd`r5Or zuI`-sw~uOSU;6Ufy~Z#6*^+NRcjkrcT`9qrSAAG}cemQjd;U?JzH{^6KU;Ron2}`z zZ}@@KJ5HGYryAg**N?t6?D}t)Ul@P=3qw!7_32}ABg?ifeC5b{uO!|1yFTd;eEjj> zrmlGQvz-mU>;24^;db@m2P?LQJ2buUojVFneo-*-?caX)KWBdQcHc#(t~z_eGfRK^ z*yE?4cz^ySFQ*P4b^cFZ?)QTqp8uCO`}}{8jyb%0?1c6&9JuAP@BQKLm-R~d+ZBf& zziYrdeJ+``Cwqjn`~P;p|3n8o(f7jz3n#wR?Yk#Gza!_*@4UP0+HFtYT{`B-zt8V+ zTjcdVljHLe?mKn;llKgM_0C1Z_BQ-|>)^)!zPWE8>xntJPbE!n|3FR7?)ksE{nJH1 z!zIwgkNkMZukXLJXP;kOz9`SREMvm{r#@ZT{?+zNA9!v5D|f%X>XqlF-Mei4E#G}^ z<25Jqmmc5K=-hKtdFjpnI{^MCkHG)w0dW5B;?DbG=C;E4d3R2jeRt-_?`4ci+fguP z->K0XzP)u)?hkM6zxRQE`@_tiw|p^v%c>Pa##i(n_1e!8uRZhn2aA4q(G8;~6eV0V zvgXRq$A7W)wkP{9`uM4*=7yf1oSXgoNZuRG7o2!-Sg_L{+rPN;?5BTRx8UB*|GuI} zPTEV?-81q{=eFN%y>;}2tJZA(<<2#G%KP57@6!kWwy7m8V_>h-TYhrs&eXDQOWVKy z`|GaUaMz2UzS6E&QP%fX{PvRg%A5am?@co<&K%rz#>S$O8~0{CKWRwgJO4g$*elmR z(0#@0S%>%SKNCs!Nk6iJG;#H6SzVF-_8`h>D8eFz>eV=R3 zzhmT^ht^+^``CeZE-3%s1K@uTfd6L?fY(pnylME)objify(9aMnKt-$*E}=xi_KT; zf2HK{@65UPuXF$VH?Q7w-inw0&*`f|e{a|}c+8J~y6ob~*AJ?^t0}$w*O?uAxAgjL z+{Gi8U3&08g6~W!DgM>{RZEu+ENa;??4{BhrgrPlQuM{rYbIT^XT@U;&!+ye;*tAq zF1n!dnvG8lZdY-|-+K4EXWq#4cQdcqG`H^sV=g=M$e;h%tz>7vf15G3+iO32bnT~y zpAW2A_PdtmAAOlq_2g}D53c>BPw^Fl)?eHA%!*?>8n1qTTm6k+E`D~yg0~KS{?pIj zZOr-Xvln~cxM<@&gDU%evh&M^FE{-1i+6Ko-+TTKe$!{%#~TYSPfmR|@u`z#69RoR z*3^FglNCo++`s+hJ!8gu69De;zaim4K{X#1$U_7?cW{Xh4*mtc@ck|E8}2ezdAssn z|HeC?p&t4bDRfG%_H2~Q_s@#rz3<1af`Z=zXa0?ntne@5 zGVu9am4wGTcxuw!+0AwbDfvRDCQ9z*`m

fZ9BajtVFG# zTruMLTA`FU72Hi~+XZInA3SI0!`R6qHl5EkU@I}c@NGWY%}Cdmx!*#T|>I<>1L0y#FViq@;vTc*!f8J zg5G)ka|a)6I%DIE^bk6e)z|hwL)er3A?j-xBscRwTFcDT9441Cp1IaN{d9V7v} zGchk{8RR(cDM!nZvX7)Yc#+*`gErImq^ajc;B3%xY8g`Mk%J6%rm5@9@k%MAsZ-Vo zQwMu_%pfoP!`h#2AJ}PUC(q6cI$L#-qZXE!6n1>;3`(UY1}ZVRZ7GM+d@^+o^NG^& zFiGzs3(h0jV6YT z1}pM>p#1#`dxL47#+Ib5h!eXMdlCj-SQF*(eBwoBFzS>EjL)oeYq@=!5KoYi=fxV^ zG)6ry9OrxHvzv8N0gFmByxvzN8QJdB=s6C;{;}BPtU#!`dSTo(J8F+>CS;&c6RaX z8jLnlFwE~>zGVWv>ZJyH`OFXWs$D(E%ezsKSB-!mFV9{|^blePkvKL|9 ztWv~Y(+n1cy*;VeP3I^d(+mep3I_)gTc8_Ui72v05uLT%PLWiJ(0s!(n1ju15W~iX zbWdMz91~vNOiQoYxO{NcV_Hrx^~lXTgSp1ve`8t%&g!kPYMLy)S<3>4jZ3b~o?a^6 zEy>Na(o(v9uA-h-nnbzJ|~o?#hkVoxmA)|YAS<$;=d;;Mnm8{yixd~nsnWwABXF80R$*qC-F zQ`i<)GHL6SbvV5w7H7Rs(6w`#YilwsWZnTSwBD&LWVLcyYHKmAv^4@+$!eyy^76ip zJ3hx9=i`p6=p9>m)!u>j&q4eDiS`c&Npc?VHrcJv*hjSOzAMLEGjCB^Tj_}5Ta*7+ z(5hXVxjH%Tb#-uTW@BT!*Tzb=w=`ODc4_0-(v`|TrJI>PPfkExbHdwes>D)5@#H{8l>GzQ)nLF-uY0nA~&Y z#}xXaIXCin3#~I%Hv05#OeCE**1V^C8ncqK6d7AcnbwV=vx!(YwjJ+0*-c@W)AEwh zOY`DVh{vg=)>D(A7?Je9@=|!_CLEEHwrhsAQnb7ie1_bTTg4{g94(zc9-ZQu#!WM$hx@_Sy#mA+Jpq!-LUhN z<;udGJe{e&*GEFVtEUis*i}Z>As8!nKb$LSuun`Txz0D_o~5zlD~0E;H}Rw*_5{&C znZ+od-bK80 z+(6qf`Jma#2mXvc;sTz0C>Z4(l;Ktpqt`rQly^Td!)ANc%W3N6JHM%y$Dhr;JOf&I zd8f7oPuhCtHdmqh~H?UnW|0t&Mt-Ap=T zdZ~uCyQ=j1-*l%+2tCnh8|#6a{s0~2uF*Z9m&kT@Hx|;`p>)RcQ#Q2~rF3!ndZX@OuIuIXxmjn7xic6#_&PswjdfeeT&H?} z7eiagL>W6{AEmZuR&GqQ)P{7vnw~{^(`S)EcorFi6($JJB7^WOGEnA|8mRRN2$a=j z0=0E>0%Xu4+Ij&2vieMbwtkL3G)()cDe1Teecu5OTnP?|urDFR1(ydde_ScJD&cC1 zOFenqq!**(@*6TE>wY=EX>8%tqu+fP)Zy8dv#Yl)Tbpoj?`NHN({^uezu6ox2V^ zdFtuLk3rp(>A~-xa{dOZ+gg+U&>t>?)cX=zm^W2Y-$Y6J+nD%e%7rCcaJoSnSHMN&(Zx~JZi{WCM;+wP9&D0}0iYBJ#0jGQXVufJPdChFpxg-feWyI<6= z_SIRdW|aQpPGDrf5A~h5_x-JWuU9|yoD!hvTvvethiw*H&F?_PBliQ@+o!^WII`r|b?}Gxy4l!JTUEt28qBfz#q) zUk+YB)F9a^wd=F8vqKiG8GYt`foyK*UDpN6vi^vf_%N&Ypi5^DXzLG5s(z-^wWvCC zjvi^BoI7LGt2qP5Y9%vhsVox(nkwMh=`C{JG-7E78+>PkOg^Q{ow~gf3P$ZdRK+ zAfn$UpPdhD+cwypE6d2AwB$@PyLAm~PkZ6@$GV+XvQhgUm!CQ`^JL|^KTX)R;HB-0 zXWgT2tkPV1b;3q|;M|{$!>Z-2|B~6*x6hBOU-nxm&%Exp_RYg&NA05){v)1l96n}+ z&Hh-IUTv#qzR&*Krp@1NB56$Gi$I?|J+w z@|RoB)#n>sE(}zsyC@cU`ll6?@ksAnB+_<(&;*md@z? zXk5qN$Qv=~1D_m-d|!682`cB6r?}U+(#~ zcsqRRp>3~M3`;o>bxJom?p*z!Pu47}KeG9URxTC3`{~{?b?jfQew%c{d%S(@pbD=Z zE!oRxdo0;-Co5L7@#~!_)qg)}_tf>?oqczgUhEv#wCKSK`?GbnPcCk>cIP&qc3zDN z)-7zlsBq*Lt#7b+pO#%C{d+?69NtveQ=w^?Q-n zu0pw@35kcB{n6*`i3g#dHx9YlCa&E0_J3s*ZhM*fYh+&A<~17E%U$CiTE5Dmgx_z} zELFR8rKjgrN44v*R5sY{d49`I+mt7=eH-mWAxCZQ@;!d>0I&%F&;bDb0Dw0DzAPoSh3;-+y00sg86#;;00Ki@VzzYDl0RRjD0DJ%dTL3@? z04xCj)&T%70DzqUz&-$AC;(6w09XJ3JOcn$0RSfefO7yqH2@$J0QeCASP2050RYJW zKnnn1BLH9n0Q3R?-U9$_0D!FkKnMV^8vu|40C51oR{)>}0I&!EI1T`e0|52|0Mh}0 z<^aH706+%-;64Cw6ab*}Ukd*gK z0D#W`zzP81cK{$C0B8&Vj0FHL0|1c#fEoZO1OQwB0Dl0$0|59A0C)!glmP%@0Dvw4 zz)Jw&5dd%s0Eh+vegFVI005ohXH^b0N@J%&=deT2>{dv0K5T! zwE(~^0H8DguoM6Y0|0UXfO`PIZ~)*n0B`^Rm<#~?3;^f>fK~v&PXItH05Ayvum=EM z0RRjDumJ$j002_}06PHS4ghcw04M?g&H@0%0Khf?pb-Gj5CAv`05k&t)&l_B0RUG3 zpfdpQ765Pp02%-QvjKo^06<>=;3@!c69A|L0Q>>~d=CIv0|3JSfJ6Ym7XTOx0Q3d` zlmLJN0GI^;OauVt001)pfF}Sz69C{b0MHr$7z6;c0{|uf0Dk}g4*-B606;kaAOiqM z1pwLt0QCTXPyiqS04N0j%me@e0Dv(7z!d;s82~U308jw{@c=*)01yZO`~(1K0D!ds zz;FOyGyo6`01N~GWB|Yi03Zec7z+S&1pv+i0LK7;_5i>d0AMfxPzeBV0ssyI0LcKr zGXP)_0Pr3F2n7I^0RR&LfI$F&767OY07L-*M*x5s0KfzQpe+C}1_0;*0BivOHUj`H z0f5c`KqCM^2>^T#0E`0wwgLbv0f4#yKqLV0832d|0Nw!rX8-^z0AMZvun7RD4FKc< z0FwX!I{;uB0I&`K7zF@K1pq1o0J{Ky7XZKw0N@n>Z~y=Z0|34N0DS;}egMFA0N^12 z@CX2S3IMDC09*ioOaQ(3IKcr0PX_-K>)yV03Z+mm`%X0H8Sla1H=y0RUVC0M-KleE|Sp0AM5l za2Ei`1_0&*0Qmrb2LR9o0B{EY_5lDs0Khc>zzqN>4FDVl05$*sKLY?20RUS7;BNq6 z1OVU-0K5hOS^)r40Dw9GKmh>o2>^Hw09*zD(g6TZ0H6#2Py+yH0|58|0IL9i1^_@q z0H8Mja1#J14*>iM0CWTZ!U2F;06;qcpdJ7)4*=*60Q?C6tOfua0f1Bh;0gdR2LSj3 z0QeCASO5SV2LM6<00jW>3jpvI0N4fqqyPXq0H8hqP!<6A0RZ?808j$}zX1T_0e}hs zz+M1g2>=ia0NeopP67b;0Dz?cKvMv~9srmO0PF++ya0fO06+u)@H+rd2mqV{04@Lk zivfU306*NdQ0q08j-0I1K>w z2LL(%04e~W6aY{T0B8*W)B*sG0syxGfE@t9RRACn04M?gngIYO0Dz4EKpX(@7Xa`Q z0LTLX8Uq0S0Kg#tpe6v&2>{3f02ly34*=W(0CE6;Gyq@^05B8)7ytl3{`Z3Xp91;s z4*A~_^1l`2e>KSe&5-|HApboe|F=N?Plx<}4f)>#@;@K)-y8COH{|~n$p4y<|G|*| z!yx|;LH?&g{?CT|9}W30gZy`e{Qm>;KMV5zEad+{$p21||8pS!lOg|KLH_>$`Ckk2 z{{ZCwGsyp=kpJI7{;MJXZ$thsg8UDI{NDlj{~P507s&tjkpJLe`m=5Hjw{KA^#m9|05y)mqPy6fc!57`LBcg-v#+!3GzP$@?Qn{KN#}AGUWda z$p3?o|E(ea%R>G;LH@sh{I3uBUk>tr0ObER$p0sh|7#%s-$MQmh5T<1`9B2menve{-;C!pN9P33i*E+^1lk?|7FPk(vbh-Aph$^{{Ia5 zUk38O1LXe($p4j)|NSBVJt6<6LH=Ka{GSE+zZmj=J>>s7$p1@_|Lq|E>p}kag!~@` z`QI1v{|)5-Jjj1v$p5L3|0^K>qagp|ApcK7{vUz-cY*xB2l@XO{$GRqS3>?j zhx`wK{Qn;E-wpDAEaZO>mM#{Qn5~uZR3! z0Qr9(@;?Uhe+lG&GsyozkpB-M|BE31_d@<(hy0%i`M(VEzaQj(1<3zI$p1c&|Dllo zS0Vq$L;e>+{{IU3-yHHk7xKS62iKj020fh9p~KOS z&z?C3Y}xWifA;Li(ABFy2XEWUs>F>>)GuC2i{9R zd9w3wr%sK|fBMv?$HtAfAAkHE*m!7T-~eJ%VBHQd`a>5KPaC&H?!S>1zW2B_~Y;K&6{_8 z{`$4G`uE?jj@z>*XWOMq$${0Yt36y?8s7f;)&29!mrj42J{^;K;zZX9rAn3aRw$Yr zdi1ElfzZ(FO%^R$J-vPVnY)2C}^g@hCye)6Qw=wE(0 zQ@dQb)<0djGU4~(!*7&#bgZ)FufN9rb?sWKa6iBPNiAD;FX!M;bwQ_2f0eSaap+j1 zM)WU3hu&I|n>%d(nKQ9Ln>Rnr3kzG{V*dOMjk2=Vp1F0a*^3DiW}dry*Kg*LBSEpv znhm-X6SJ3@J$u%UbLYaBb?<(<)6YL&yAU0{YjgkpA6~wCWqb0$gPMgJ&9+w)C(h}x zb?bc>JG%;T`}UoCHh%o{&NXYs4fXX+XkNK;jREV|KTq7X>+qt2f?mh&-Sb-Y_urH6 zB_%CuTdi94>@HpYR_)(^x%AAL8P1uR>DS`p=S^m#!ZNbs|_dTW+6?NL!uiw|6 zwQG-GclGK-*{oS}2d!H5&VI&>6!+4l-86svaq0Y>JB`u;0}DX463IIF=0FD9xjsUR~0ALRQGz9>b0sw6Q0B-;w3II3(0IUE2 zDggk?0e~a`z!w0h4*={00GR{0N?`v+y(&30|5B| zz2AQJ%C0s#CD0CWTZ ztO07)0G>j8ib0Ki%R zpcw!#69Di70D=I3K>)yB0ALmX5DoyG1^})B0J{Ky4*-BI08kSE*aiU10RZj;02Kg$ za{$0}03Z$kNB{t8007ScfWrVlF95&`0GJE_ECT?l0|0*m0G9!P3;-Y<0GI~=1Ofng z0Ki57-~s?32LKoVpez8e1^@^J0Nw)trvQNY0Kh;1pcVk|D*(_O08jt`dH_HP0Q?33 z!~*~`0DzwWfIR?!CjhVj0Pp|+IspJ*0f6xUz(fFGE&%Wj07wA<+yH<}06-%Epa1~) z1pqh%0Bi>U#sL6j0Dxlvz$XBp7yxJq0H^_g$pFAO0ALaT@B#oB4FJRe0QmqwLjZsQ z07e1;bpe1c0Kj;(Wm0{}Vzz#9N)3IMbN0Nw%s#{q!G0Khr`;5Gp88~_*t09*h7 z8UX;V0Dv_Ba2Npa0ssyH02Kg$YydzG04xCjYyp6>06+==a038%2msUq0CoZZ$pC;o z0H6f`>Hz@m06--GAQk`^3;?VI0D1!etpI>x06-4_)Byl)0ssvFfHVN04*>8d06^#e zV*tPd0Qdv|>;M3U005%^fMWo_0RW%{0MHo#=n4P~1OQF~0H*+ervSi40N^745Ci~p z0|1l&Kso>r3;?_b0IUFj?*V|G06=R1UC4ggpT0F(g$q5y!4 z0KgmoU?Bjo6ac6S089e_?gIct06;$gpf&(-6#$q80IUK4W&i-C0f0XMfI9#{AOH{v z00aO4KL7yr0RU$JU^@WN7XbJT04NUtK>im%{=b9#e**dc2J-(aT*&`wkpD9v|35(fKZX3?3Hd(<^8X{`e*oma z9`ZjF@;?~z-wX1;59I$X$p58~|H+X5*CGGgK>l}y{EvqGp91;+8uDKY`5y`S-wX2p zPssoGkpDLz|2IMYhe7`PK>pi7{%1k{hd}=S2>IU-^1m76zXRld1IT|T$p0FU|CJ#B zuR{Kxfc)H9{_;-_lNwy3Hd((@_!HH|5?cY*^vJuA^#H~{})33 zFNXZz4*8!B`TrZ_e?H`Y56J(=kpCHw|4ShMBOw3FK>lY!{@;iEw}$-x0{OoZ@_#(! ze@)2$E|CALA^(R#{-;3x%OU^ULH<{V{EvtHe-8PthWsA~`M(YFKM?ZY1M>eiL z|34uAQz8E=K>m9}{vU$;KLGjP1oD46uqi1(5%xApbi;{{I5`zXI}qKjeQ9^ zzcb|jP{{x0kpBZ9{}Unq7eW3XgZy6w`F{`czb)i{Hsrqw^1n3Xzcb|jHOT+TkpE*K z|Bpld&x8E8f&709`Cl3GKNs?U6y*O_$p0wFe>cegA0Yo*LjKo+{J#kK{}A%OF66%_ z>(+rP_!<|NO%TbiWbc;D<^<>afe z9iF?7sZu9@M%>;or;Qa3RQlAvZI^=66Fipub@0ph6N6t>`+I|Oy6xdcJIcBYs+IC6 zbVRT3f3CQ@bLslGC$7*PUG{Y4wN~A>`n=wLVDNr zedpm35ZtGJa8O|Vn#yF4+BFmFwDchO+eQR`Jc)45puixZ(_jnUVuuPxL3SwMfAMmx&QobcqhZsn6D|57A3GmeAKYxE{^xclZl2h(qVnyT-pSQQt~s{De@Du!=hN1{ zx_YpSyvgKYm7N~s6~wK0`{K@tBc{^N0$U7jVuBo-I`XR8a&Mlq3GxS!O+aGf(x;ylK z`esFq;Hy2Bx^1Z&FzHToGZ(^G$*kozws!Uoj-^UFIZNAP+>D;H%g>)Hd)>PCrTp#} zYA*7ZS6vqR=uJ@jw;Mc1JU-sAtETpwL5IgjtaG`TQ@nM!v^_rM&Yay?0fo_Rmu>Fd<>Ka}KGOE+@$m9U|I>~wkIWr) z!KcUe*<&_!SebDz_VLRfD-YSXD9?`ZE>~sb%Sre8%pE-QuK%sH|8{#2(vYsBh7Uuc z_xyFRZ>vF8{X4n!{%63dY$(xFZ1t!)!^^&jepBXKAw`#*Ds$xef;qL z-P<>>U%h+xYTM*>e;qZ*`2Sy*kz4(X;nl9&L#|5=RPs7Qaj8u1lG+igK>y-6~XcuT;58)oNyG{vp0cbx$v|Gy;Q?e!dYV z!HM(__$Ee0c&MXQu_HYUe^|=Huc2=v-$ov_Ba@Qi6I(WDFfuABGC9l_f1t5}hELKU zI(lqOef&kqQ5toUFJgGWRi8^4>etY(NyFxTE$WZ}UlbrADp5U_Fmw)CyT}v9D*dAT z;v0p=_{BF2Rnz}WjKTlAeWQ5cOg5C;-P%+EYx4YSA5#$DWJDa6lLvU48h?_=@R3XW zwvw_h3kEHovKc*u;>2wdDR~CE){tu(*Du+5DW0elGmQn15+< z3gu@%CB~scb750@E^JC)M$+F3a#>XV`uN?e;bv_8eMvV_xB>AJg&VT>cgJ68;ywyCY-Ma; zh2(y&tiOUWJ{LB{cO?@={ohEE-i=LuF)BQRB1xfk`g0T30)!F-*#v2!AAB3`LxNw*;Jr_1D z3tZS=;1}ob#pZ8X*tzgLV|*^0DG8hE!}&)^{9OfM@%?JD_lq_9Ym)NlYbvyA;$ny& zezQ)9E56fdOvBp^yr4E3zGs;Gw2ll>l3MU@#dlkSKUU;#%-(M`eB6h-e-R(VUFmqw z6@(iiToGaZ{?z|Y;HTkeJKn&hw=?!P7dEXATzHfuexW4XTatdTBpfaXKSjZ+;P!lb zoD|i!3F#*aH)ZQLN06SD|944vyCiIlKH)xG`CTMocS(4-B)mZq-YyC66NHZ$?tKt9 zWJojOY6$zY;pS}lp9td9^4B)hk&YS~E-wh*LHkhtR$$ZnkwE-QKO=B42+{ayg7`GN zSQ5S^2|tpA`7y}f|Bb+}7uBaF`Alz)k3TMkv|{h?LkAc8;mRK-3HKC)7vXzn#O3>& zmiKpopN3CK!WCfSK3x7Dl5k~7*hdh)ZAeKOz>xN2si8hxIEXEOYe9T^|42!Apdfq= z-$RiXU;bc2Uvl%eH53x};lgd${EKW1M)dDELwvesGo&r+FHa{s`{C->UJ~vu33rx+ z2MWULQNASP#h1^;kn;%q%aC@Yg`xgj`GUzHL)|!k07(>u{n_#@6y#6aXP+dzT@t<~ z2|tm9LnOTDCO!-m{IoKTRT!X`#o^kLa2-k5M-r|p3D=W^>r2AE zl5hh_xS=H6ND`KoUn%i7mV}!~!c8UNW|DAo(w{a9K6D%~q=m#U4Y!o|TS>yLCE+%b za9c^Zoh0lp2?t2Rfs$~LB-~yS4wi&NB;k%^l3~0%q5fsDUz}wK^KJ6nFdu3AlqGVq z#SrHGLqzFq$)5(lFB{*UG&PLBIk1<-er&rT+!X1`lG4P*5FXCPcP5#la2c|g-Uy#k zU_@D>AP3nH`il*_lCB08(miBZ;zq0u;i+u?715`r53R#}gP|*1o=W6|A$|dyz6#l7 z2vf~lmQ*8k4PpFwXN0ShT88>clF;u;?koG>dWN#FaqgMN`DR)JV`x7s3~A|iKK~j5JN?ev=`Ham4cHH5vWo-v zy&U~cPZ05O$5o#?@u7QD{`+8jcfl{;>1PBk7kWc{B5=7lvtLOp{&A-bgAe`A-!}o@ zD;ezcJ8!4j-MtL{gAe`A+b80CC4-%Q=j~7M-K8x4gU<_G^$quZgYPa1Y9)m3=lL?w z?|fRi&*aNMzw>sg|M@b|@4VfC#y6CKe&_9r@!f?s7(UDJoiD>ieCO{=zw`08;yZs| z`klA$r11^;)9<`}4~=iI)9<`J17pjDE_C?R#>I~-`kjx{lG-2QKlsq^yuCfX*K?y* zu3ucJz`}?21z!efzwl*{_KQ0e*!T$hWeUQT40igRzwcChcX!8s@cAF?y$g6%#o0DI zE6Gkm2xP+3hum5|ltn7R4dFGi} zGtZiJnl(c#dUee+Jh} z(vHN!*T9_kEwS)c{n&ncS^e1ld0G9~{AKlH`{!l#WAm5QkL{nA)sM|zRzLRB_(bfl zw;Of>V%1Og2$ub_>c{4t_4A3NeuzaMU5oPC0WWb+ZIj)E`Hu(|{Zvp{y);kPG|xt` z=rFCfkLFYHlXauUbeGJVH0Evy&uDL7&EG$#EZhECV96_+{eW$sSnTuqM(hs-_Wp=gl)9Vxc3#AyKY=>8X`N2^ z@#bnw7tiXaF?ZE_yT+u1zZ+QUoLFow0ruwOAB5%4v@tJ=yag7m5`m@s#FCbM8s^Nl zqz7?-jh7SWX}pq{9Snr$Depjyc@D}Pr13HGgEhWDT&OXhIY_?5l5Zk#rk!sWVDAvE zPZ#(8SY!H+VERMmFwOTMzC&X+ZRVXC=io=`hgkBO4D20_e~_uzvh1|efyK^T;t}`< z;dx5zIL}!xg7+3t1APWI?_CyDY52)vgFx7(nfF*wvEL9o#8RHaz}}x|oioJuYWxL$ z#Ak>_-)hHETBjX;y!UIIik~drghN<{%rQjzMQ~=Z#;hMH1F_ho3GY~~(}8%L#;o(K z@fuslBM&kN(|RAUp!MuUZ1w}?w3%t^FqwCf)?bL9%!wLPU#?G_Y1ur&6N^pmw)dy_ z2Vt3$r&!R!qQhNHv3X+QSqAf>)+ZL8?VkLg=81)$4V+^0#KO-5PNw5Ph=qR?IK}3P zg)ae4o`!#r5^Tbk1E<(LvG9w4lUWc5vG7ZQQ*54C__e^vGw=^WEd0~JDK<|m{5D|k zEc}DKfi06e2ib`&d5#4wEc$PQO0juj;r9TW|JM4%!k+=oowiCFactX=fm081Z2EIPb*^FBf=IPQoa*4XN+zlmVc?@gVbX`b&| zylgZ`KVb0_V$m<8&P=T{3^?mCjf)&S`}VBIHGeO#X+Ibw7CY?o#ovg9pA0PiMlAeP z>i=BZBo=-q^=+P5__@?C(fY)~KSF(*Cl+kc2fCn^f{T%mQWbIRW%SakS2TYQGk zvc2qhAd`VjI-re3en{hE=%J z)UVR|#KONzeVZp19*>Vy<}$6%=Zxap#G(@mEWS-Fd;+j{xlYULdGQ}&(P;@R{zEK0 z-v=Z=q0kDzNw)vGBJ5C$G?Uh=tDqPO*7n;R}J~yi6?o{p4*wBo=-G zu=v$v;-JoJ9`*kf!J=%%z~Z;W!p{X3za|L*IwgJxCpfTUG zVcKm=I*@-#<1}FLTVk=337ou1>ktdicg`s`Pb_>-;N;C(pIG=Cfm3XrSonUxnJ;Sn zJYex#V$m4@EPhKYd?B#+C7pH{u=p*p=oA5q-x3SY_kGD*bXsEJ@1?%Y6AM2ESp1e) z`02pOztDDwg`W+aV)MkpKSKSjTAx_>$Ek1g#KP~4MZUH_6ANDlEIzi6_?Oz|Vc_JK zBUtp0flsk{V&Ojp7XK#}J_^s;O=&)z$rFQEc{IBzpnL(g`Z1(n%)VFzJ;nx9Y?$r8E1IzJ9EIQS|ay$|XzY*B`Yn}E*U^yO% zMQ1Cp9FN4pZv&R&i&*#rz}~mC%|q1rJc32%eejv~weAVvtlwyzlhpsO2p0X%9Qxl- z=U-ZfSae#(ga1PF#KI>7OI{h&v3;Icbh=UJZJoA<1NQ_LpC=am8-c~=iG{xfSbUyX z_&ngO-)j4O&z@-?UxR?XZ)$!R`5KLjfW_yD#m@cYKh-+K!ao3N1Miz#yaB-V~4TX*ko)s z6jm(uPk&ft&zv@H?Ci1GW3eRq?D4Z^kDiBhb-5b*WfA__GaHYXHlf&x=rm7-t&p2E zS7p!UTH)C<$4?n+!E9L=oQjc^s2fq3G!ppROmma<=n)&c_X6V`} zmc22a#cYiCPbkLsL{=0Aa&uAQ%WblvSaqZ4Or3PaeWcQ)tHfJzXo^|m8_9vC_BX<_ z)Q$0Wsja9+Yuu_Gwy>H$2mi9IvF6!hXV0EFsdx@rUu73!mG3LHmrjjBU0xR~>C|ac zvEsUa+8nkVGr)q|Gc7lJaC+k@ri`DeviU_;cK@Lxvas~F|EDUOL*+-09XAeZl224v zzkTZL3E{QP!%JyDGJfW?Nso-bQb}3s6K0OTV!RdCY24M4qd{;K(DSaO)j-4TZ^eE) zsVicRczXgTkPjCoPEWtwHh4oN@ddu z$V_F!m1d9S@52vTzxF{n{7xp;#V&B*;kW;IC>)THEESj>e%pK#9p zS+l$M*8ZN|qi2{NUgQho0%9Hz**yrXf<uV7?YlyZ--^*jBPzp- zx;u;lYlZF+6plu@@ZCu`IJ~G^7#9%RDT%tJ>T|*O`Ooo)xZMuRuDMG61J}_ac-&^m z1pFt)rLHAC?O*x9qaaJ>K*_DwT$J!DdefnVtW}O3_rNGUj&l&gEDz%nvHcwhoc8*G z^I{VbdmjNf?Ule@Cn(V#cSr1vaFuU3;u=9%5 z6?=8ibJ{EM<6Q#cY42KWVsDen-WRaPcRnIwui9m=%Q*d>j`n_lP3(1c*=vc)eN>F$ zSL~&_>{Y{_v`0sWy^cuW+~1|J$Ndlyd+h;Oh8#QM3)q_i%<`pUV;tLK1~#X?-tF{w zL(rCpJ*IWq8#5m524A4P&UPH_ErJs5NxB#mz6-)4v_W~?rI!gkE1?w|f%|ZLIqg~F znZyWm1uk{#WjG=o@FurjS4X4+Cb{+4=}Kk}c*L#O!x8C#>)d)gC>ybt@7C+vxL%4| z@3zMEW+IOU_16!2By17*rfrYKr)1uaZv!;6{!@?JNgU_=mG=DvdfhAy{ZH)ieS}l5 zU0&mQdtG`1uAn!>r8n;idhZ}pXTC2&ucndmHFN1bkRLf#s7@P{uVOStH)Y9-&~siN zP>|We@vlo4 zaYfwfH^{dW^u~yi9mn8LZGVydD8GW<9WK2ySJ0!IJNGwlK;!uaq2$!t2)*SjkS&a( z`~{m+ujjzV^}4(4?Sfuo_1wkQlejOSH_pmQ|6^X<_`a6EB6qWcbcn?9eKK5nxASSOr4bN z&z@F1`G={HZv1D9#`=Hno;@wLcc0#N?3jd~=NA?jhU7@w{|e_1^NQb=F;-u@cTw>S z{SWxg{dN}K7JlcRBLV9-S~U#Aq3y>|kw-cF#=gOGkE=d~z>@;I87{l2ZIJWT0)r6= z{|O7PwSE!~Mf`&8!7bK~(`^$`6rYK+^~Ara*O-5&*?MAOtpNL%c~QLBoc>L{#{8S- z8>fGBKPW5@MeN-PEM+CX4_gj4#?!YQ{_P+CfBhRZ5|RIR{F}}2fBpOaxPQ-_G}htX z-`Rh6@6)Gy532|N?*6+At|56mN&lUN&^{Sm#r#E9gbF53aCjhNgNVN$mUdMXobuq;;>*M-yWkRfXn7<_S$#H1xM*5@bo+@jt z#XYhz;px~vE%i;j6RQ%&SnHXaO$_5NOM`JLv2RUAUDsW`_eAZB+8=cw>Y#tj1?17% zDBIK7h~C@FDBFv5tvz+I#c}slmF>+p%65$~{cEak@BUguFmgltVcW=M=g2Dn{eYx`Wk26Ah+Zw+7 z5h}EMyfT0GWs=!0&Ik@)V3-%aObV_A{_6rGIQM*#X?hH^C}0G?IG;50DPQ726-qpz zGM)_{2^bevTzD?Dc&Xa_Y;YyD78>TUg;;I8%s5rjVWn^3JL=ihn}a*h83)T_R9f8n zxHQjt&)Bk4Wn)WEm1eBjyvA3xQTfVV!|IobXnCxZp2roqn_{ky&?iS#T1;rlE|utw z-W7!vDC4kpHMHfuL8@Q0?*YL1mPo5Me#J+v8GCmQym zk-`kd7>(3y7)--JDe@3RZ=rn*?)$KzD!gLkmDdZKZ3 zS=8+-3f2$UHrV&k6r(ONba0Q#o$vem0ktE^s1L@*pA9ZKmt-zXI$PY_H*U8vr^;8b zzzEg-U8Q+$T4LT+p8pAgy)-XrL7|a>IIdv~u;b+QM@FCW9U!Z)q|4Xfp z^UYahguaY3ezz>XUCSijL9D2`ccKx>+ojARq(+HzmzhVfI_KjnQQH+*jnns4j1erV zFy<@?O6tkp(KW?-OMnSzw%B^6k=4-8pqSZhfrpqvnQh z;=ge${bgxr?>tqz)K~Bh%5#_c&C(u+W*+W+r0+3b#ivHZ^Nc)CVX&!+G3VT(Lgkez zn4GW7K%P3h&ewF23dSCaeJ?OF;-`VUm|(2e&Ba46+NGEHZGn@?jo~`-vkfya(7Pz` zp9O=$HWLC|4|WauqmN6_FXbE6rYGm(_F)-CtBYdqxiE0Tpkspy25%pnQMkG=cF1_F zh;6h;JD71`(Eg$OhVL1gS*sT)#<@HkqcNc_@Bi!r+7sjhT z_%-9>)i0NY_7^GN;Bly#hg7g0$Hj^`!~7$Ti%S=i%;ype^G}P6;H-Zq1+Qs}R#&jr(-HH#J){eu0T^d+oSX=}|^IHHcsH-aOU;TWkj%+cjWX#QFiTKtA8 zSY7a39~>iQObmQreL`B(w764c!K1JZn`6t?uL&jK2+2=?C&#MwD}4!PR2_~F^nkl@ zTJdT>b?S`+{#f47e=chfd=}jp-b5h_s8FHvM^Sq?(qnydCnyugyl?i8jnLGU%J=jB z#viK8V>ssK78s%Yx2>ZivGzc}+@3UaczJJu~lg-td8S1A7cwKd9y4`GY<1LG!B% zMlfDQnI}f7+G5k!PK6f6=LXwkt8J^xHpHSHqs~5NhUS?@@Nk(j|5#@DzC3J%iYF>F zNc=}5EzURb1Ld1|mkLICj9^>`WnSu|f^A`8&C|F0%s8WL16H*^zCZ|mu2j(kI4-lhhMBl4g3}TUaWbdTm?^* z8@~FUhIu3!s~}%c=IUs}HyQi*B=|3;snCUy@P{L4U-;WYw_#=C<3{ip&d^DriGMSE z7ka@bdK$H8b#Sq{OSvj?X!mbbXxDRU#8PPDc<~MW)G&|77`}r2%3K+P`a(UOAE9!W zg@#_R`rxBg!I2e))kCz!@7&&&RrLGttlFjbEe+kiL;Z4zReGKyj|a4EoB_Uo#efky zk8%`zWCV|wvp;{RkAb7~%Zc#xBK4=GwK${fF?KIIS{2%ZR^0uzO7D8~QhMf`OX=CW zFD2IIqOClJk$*0yIPY*?zk%BZrVXOs-83WiMB4iq?+to)=&|8PMjjq@=>CJn2PW*F zyl?8B9nDeeN%g9%4(+%L*JZmpJkw zV@u7VMaH>xZJr7iEkUa-F=jrq`Wf@R5~IzUQ>CZo&s^1EW!Zl8)q|VD%Cl>t3!AC3 z1I<*2bx(M(>JMrxS`3*C+Nvz1GDAR|ildcj3Gr zV-$NrAC5CZpW?Vav)S0qeSB@EUkU=%e@07hh+DJ{%8UKV$XWZ!X1kdH!$I^UHcwna6Rh zvN9HVRiF(j4D+c97-}EtjgZdlhm*fFjU ztE_8Ov^zb|I`8Itl<&cT#_2>e8E3ATx~Arn3(y)iTfA9xGeKF+s)yUMD{Ulu%O z*+S1qTLE?7vfy#%gnoIM^p5L2wN=`0#1nk|*BH4~|GCVUcU*CRQ=yA?Rg!Z+!cccW}~qP=kqV*U{|bOK(EzBzb* zz(~hE>;_e#(v6X7g8@Ir{-#HLq&7sYR_W1m)rROchIv;&rN?Yn8)7bC-oZV_2G0bQ z9=lm>i2X>V$02>(G4{&Cii-{x^}A==J!zv>jEefnxxvMShYR}+**2sj`e-vYr$uRg zTl9Ss@odbf4SI4~NN9e^!!u%!r5(vQJm}ESgToJu+&^mHwneutGU`lE>P4ga?aH0y zy(_yeDy{XGBq(F>&~mf&U^R4Au4i*#P{sO+=)Lf({;}%TW$7g!sX(kJHsJ9u->ilQ z)(6tU*VMTMgAkVUdTmT@Ol`8KDOaC2s%h7ZX<|h0-i6-j2(BZ~z*E1#-FrFi-dEy! zawB@L*Km&P7mI%W^d{WB?}26>w2E-wH4Z6e%UL3}pQkvMcklNt3w^R38Zk)QO5ITv zy{8k>^u%@VUzWm-=MPoB33uXZC(gQiKU$St)3vVet{!`a2Q~+WhRZ!Pus;x8z$3?_ z0-jz=)75U}!Ttr*q5$_PvPZSawN0%3$=^0Ct!PD2)IH}077sc+sNdjxv_QivoRM{- zYI;|e^!rVL|7-=WNpeunb&K9E@4IMAWofNZ=Uco>87GGZ4hM#ZOXBk^Liu^m>QTXp zR=7G$FWIRA3F(*_$rE$y!tLe$hf|Qxqnabu9wTpZirRC$@ia~W9Yr;QCV8kZ_#awcUJZ;-?GS4=wIGc zjYP{wYV_9pkY}S+4o_@w?uDfElHIEGbkNgUJ=WSk<}I9~nyOIXVLZq1sBc?&nr2m{ zt1Zft5NI0w_rF!?Ndskk*l^eJw!vwItmn=%(z9E%OV2EAm)`Y>cIjO@UXz~D{hIVn zx!0tp-EmEN>ey@2vuCtLd|Sk~P4Du2+w_cA+jd>_qSD8Rw5L&6S!l+nczL4G2SZuR zCQZ~1{01xWn}FX%391i9O_)uasvY4*?i#h{{(S@DgPvg?6OUq~6ffdxo#7&NZ~V{&!VZWh7wJ7Nuc`k|j@1bb zbCmo_^V3{8e*ZefGp88TYqYyoOADLiS+(l&9(S$w!2kv`F){2_-?vr|ey>`cUnli? zMBR<&4Y|f?*PiYV``q`d+biYUux^tG3Ox=z$%5N}f@z)E$r3?zk>3VdW+B7oS{Q zH}&L$uMRr!Y{z}6^<7>)`j7igzw+l5eXi}8@we&Goz~2W`Q&%a{f|EMvvWV4w!51# z@rFyse=&Fe{NFux@t*!?e|cp6ub$pGvu4M)!HnKN`tm@}O&|Vq#=G5H$Lvjir`>AL zy114lr~iK4wmD78GLuuLj;bDh^RdwNAN;WV&OfOCO8w^5pG^Lbw{IF$c=zuQ{bS3& zZy(|dzT{CM; z>5tz}>$-el!RK$ZI&ptfEJD>cVPI^hd+YwVwfKouXCD4|U!Mo7jt+fk%E&K19skJ7 z@jK^r&ThZ?wLPEwW%dsS|7P)`>9@T;VL2e_FcosSXSN zc5pi0nIlUYfx6#cr*>7hm6tgIV!pt#xOf?I|x{=@wj$Nk4^Yu>)$ zt%tIs|9H(kwb#bx{&d9ICntUSbi0@RfBpE^YSx5*uPzLn>DwfKOVa1wzi0jYi|e=k z{+CZw&D*!?>mMHc&-h0c-gs|W*Dn44{Knqk#+G;1FKFJqcgMR27)$%i?y>)GukQFo z;_+Q0`(?zf9rLH{Z??$!EOp6ms()7=Gcf(1KOXi2^Zj>gp1tdXcYZeh=BQ=2ebRZw zhpqqeZQGZAdt}|?yKkC!Y3?((zi{f%`3KIW^qlV5u;}Q+6)$$%bI0Hgo3Fdj>+sZ0 zZRU@D@1r^E|B<<^{d4zCD@mA{_tcc-O@HEhY}D|7jeY*hSC0MY(Fgyl)yYk_riH$$ zJTW8rS36%X{r~$qGu<9|GG)P=9p??Z>CdNTHYvX4w#V;Z`p@bE8@gWm@9oD@cU6^+ zKVSJD&pfo}uG>epJ(80=q{ctxgB|jcXIXc4_hBR?U8?_9ue^51Mg59-6-`>38in zzxCOy?PxGF@R^x?FbWa$TEs>0&jWMs#h~)@``bj(eq+ z%T{}6k><-AG2x+wPj313fxmoSf4tqlkNsj?;jCv~8h!Ie`EBQAs;^A_NG?VZD?&T?^*EfD_x z8p7WL5dQuJ!qrF^&tJw5Jl1Z^s{@;OpZ-U)w3jkUdtUtObKAP#@waiKcg`^u|GD*z zulsuX2mki5!XvNuneK~CZ2hZ`exJT(@SV3z>^i@A+^6$K5B>4a=QZ2=uYaCgjm19F zD~`7M+dCi6yywJCqZW(%q<(nw3&&dD*faK(=Mp^YRn4OvKkAc|+xI@R zv)VjAU_3hZwVr!->|Y(&R#s-zj^DD?q5y+ ztV7d3$KNpFVouhd>Z0E6mYCo65364tQg~|XeUE+Oss3&IyY>|gOTLiwe5*C5H{@S) z;`x!!KJnq}2VVZ+zkd7tZ`X{@pYg@wQ%{WTRq#%H@x3oz8u|1!J0JPi+=QurIQYdM zp3J!I$!AWqiqHD>3nQC8ym8NKBj1?**ugnJSX=bZg~7jei<;77^@LV!JGNc?WX<#c z+;(I{ta?akKxgXO8_~z(3XhfKg6LJ>eKY!*Na= za~F|l^(LN7M8*f{@DdKJu|$W5%77d^!QdD+3dal?80B4N$CZPRQXW+SdzOGVRC_h9 zLHJrVr$IPHt!WTWw#uU%`Jb@!sUIDmBkK6dg5@c3gd3KpsTF@B9IwM1U#g|4t31tI;Up_PUisUS+A4VS9r23 zyxA3&@yNI{v+VVA#ZPyIOB~^b~N|TPE)Jwu-^Yp zR(V!C(zAT!j&Lr*nMmW@zj*tYS19if5zqE_#!q*|TlQSx*{*QpTc@_x{Ddr`E`Nqq zzRz6x?>WL;E9P!j{^33i<`M%Pg)@ z4a3QzcxI0_QvbofXpmnEqqi z9&t;2759jpp5wGzqW^YeXZ1nn?f4o?-&A95g%_=GYlTntELm>l-`27AhaT^{#$k|o zM*0dJzswb%3LUTQ@9dWacO$m_bU(4}W6hCX@NnQ{dr&j6%vCTFIK}3Pg`W#-+JlOT zgC-v3X+QS5hC(5h=vNucf}t6AS+|^%Jx{vGCQ@w|QdW=@a}0kU}i{ zjld~3Pb~ad)Sv7ZvG5&Ge%SOkmB$)L>nnkN>XP3uk9{Nwn^vTc@- zw{a`9m)Inhv_064EEMDx>e%*)MQ0FoI%^%vXIOAZDz>caiInP!EtCKF%gw&%>Oq`E zR?oFBW$25r*dGV%Wg^G}*s|=j+()r9o!I_RV;->BAr?F9fxX%I2kC&#+uedzooBHi z5UZSaf*TR`_OfW}`b}*110^=^2hOy0CQ!e()?Y}T2Q(xHoA?Q_q#XvF%uFD}!WRLj z*gUcDcLOKigntlX;dy>bv3X+Q#{eg@A|Ye23D5dWv3X+QS+~hI;~#`r_$k0CHcu=( z>pYpA5QJFx*}y3_Pb~aA;AH#ag;@AUsc-Yd!j}Nc{NJokvjYDh#G9K&@DD;P{7ztR4*o&dS9o(RsCMDUWQGu8(LV$%E;kQLH?>Mg|q&&o;--bH3!vG{1I4e)%_T=+5=C^<{=Xxe}Zqs}> zV6!rU#byrp)X{{Z#H zKOOuO>WhCm_!3~5f4v+yd9colSZpo?PO*7n;g3(7l4z8XdPnVF9N67JhAY202SUZV&R*U zxBZq_c+NL3`$a7LZRAUJzQn>0C2#K+vG5~-Wxwtv9;(w8Q{Ub%V$tV3#4?}#RN$;( zTA%mL-a9mYoOqDN^QkjX;|gH$XJWCr8aR2l)*%*t9dL@x6AS+=^=-c;7JfbTZJt>8 z?bNsZmRR_m)VFzJ;oqjd?YG3j*HPc*iG@D~?7dT$|2^R35fLmpCz#geiG@D{EdER^ z{5kTEXgkEhC*qn%+MQTiaR zU0R1&_>sUVHcu@4y}+_x#KKP|Z|@he@a5#~@n>SO$?MYOd$kU+ z@LvI^*gUcD-%#K7TVmn)tXlk;Soj!V@n>S;GBf`-;Vk=Pb_?U>ff*RiG@$4zReR0-wD_|TI**5i=PmSPG9o2pAZXQMBerjV&SKg zFV{ASg)bp*`w6k|3xP9pv_9`2WgUs-)VKYFSoEJJZ(rvS3%`ZDT~1=*cagWtNi6(H z^5r^TV&Tt{x64T^{8zwI&ToLd#X4;io?%EiiA6sF7#~ks!nuU9#%avw9NzI7cOV|4 zaT;~(w#XnqLGxXKlP5;7*v|%^V)Mkp_W+ji5DT9}{%6__vGC>O?Q0ui;gijEl9G>a0Wi;6T?oJ5gR#bGwK#!ISa$kWp( zhBe00_=IVr=S{nO>cp$gP4K@nL!y-zr$_9>DG+r-WEYOc+>KLb&5lgbNwvr%huJe5 zpA@j6))n{qJ7zVc6}w_M1tEf0n1e8)*ytRCde*xJ(+65rJ9FA>Yd*lMw~00Dr%au9 zl}Q7wsQ|;X2lkQ_1Xr3a&??2GS&^y!EMiu%idkaQX|& z1ATGN=OA#oYzc1*h+}oo@s3#&Fk?wJfLm`X`cM(kyB>gajvcYQ3&P+s5oY#`OT_jV zj5+PG|K_`C5rOldTd)c@Zxn_IMxXwD$@Ob%GM@ zAxYRC-|ac=J&Q=*=Zc6u&VA&xcLauHfBEQE%J&bKy(mQ1h%x+%y-!{Cw&J3W zOl)G0>(@HVR|k946A^nOq2w%IQMR6|jrLk&6MMYmciNlW67Mb>Y2Q2SG&%UC)WBXf z8kY9>C|T@%W0z0L@eLxoF@Y`Aqb$Qg#e79ClZ{Kl7J(1C_4s^OA|3E?w_dU%(gE*v z>!mm%9kANg>j93E*`be5FWlL(eHvzFPrMHPa=IdOwr^enszP>N)1h z8iVr@+njz+5j{Q&kTxTK7WS&4$avlw(C@w2#?G4Befrp$vt&M@@0u&?Mqh7R<-6xv znTKP8`SrxcHx$_jwaX37|1c*Qt1kM74O3;Yamrs4i@6rs;w$Ykd{5ZEZdH}<_4CT- zsm=+`^<3;7m|qgSa3KlboX1rT2*%cY?XQV90t5W2ol)7}@BKtL;qN{bIo{7M`>GRMRs5pZt1TPFmiIyj+9%)O>AJZ>wlh zAo)w4_-@LPYZ>y?IW9zw8IBz1=hH@M?ed(m*jTH*O6vjzjpv5%;ae}SDXpcZC$_XM zxEZaxr;U27O^g2iF*|TSxx3!i=On%YFRkPERWZ=owyLb)LVcQNdCiC_Pi%aR-@DzK z3q!}V?AM3O9{IZM@*1lQ*VuIBtg*zL9s@J*1>qWa;m0Moj>y@+s$p%(cW54bRUox9 zsHR6{*K%*}%jHj0v0nYdUcnb*v8u|deNU{nCJo>3MXVa9qBEK(s|D&3b4<^L`t;P7 ztgp|WDM*j{9lm7UgIKmjq7Cw0xw2Qq*WjDZUi?DMoU;kKSN`UmZI@kM zS;cboSW<@XY)yOt6Ks0&Yya}ys-Uvp;97=8`VidU5{Pqsj(_O4O=H{8Sq&2 zIDODta>f)h_H0rxK35t2OZ$tBZ8=PBG?+_bdnNrPFLz;H_9CO!lV2Ooao?^jvyRp=UyJ9-90v_;j;!0VC>|bIS%ohIEf3sQDJ{)b?p^8eq*rfI z2^AyZi&8qHwre@OEav3bX#uDG71k^Y(VG%f(H?6Q%qmBX`o8q_>#(A#dyEM%u-0LwbN7IM4b(6ELCTu>LjUr z`T2(J>9gtSujWU-aW(R^Z$#Dbo25nJBbUA33VgTsdcCh#wbk>@s0#IZMGdLq`NEtN zK)+|TjNR(+t8gm}7$Ex)#BQerv=2z17&-1^a!YHvmMn3q^1DfWfaM*78=oKnk= zbT2D@riMrwx1X_>A5>%1ZY$4*pA5+HdsnIWJm=SnMy)C|PU2g%JYBjKdAfi2pD^WYt)N5?O9#lPnYN9sfCA9TbwtRI}8;m?uw(cy@H z=y1e8TD$hAt(6|PX13@sPB`Ik!~CvMTnm80Jfbi=e8cz@%U-sn!GAiO;|k|F!VS}3 z>)Ib3wqKVbl@3SRONR@>_H_87Bizvb4=nq=!|^|GmA|7E-yQa9^5Xwtn^-g)e{jgQ6@+BbPwRPBTUf$qB z`eBo`CI%4m;Ur`zHqqyCDtIbzmhC7r$@AeOWF9urneV_a0*n634t}SDuXFHc$lK4e zV#)JiB&0bu8Ee`G*u0ah9{29k(ArNg6(RI(FP;Tbx?mH1V$r96X0q`hJoaP^C;Ra% zn;-7L?4N~a^_eFAL5RhsRkwU#2T8^zV>>f|r3}QPpADSZ7XKhDgJ8C!jQM06S zTYyc*Oj_l%(-u>Q&&D8=v1KxIh}AB(P6fhZzZ%$UcL1A#vuquIQDqy3zQ{^w1_ zKM0Ri*+*j8#~#2k4wL?E-h+P-V$m4{oYj%69=|8J9l|o+GL5(sHT1QTy?CBZ zvFzLYQiNsfWi_$QZvhtj#A1INu#EHEPJKEH!3RuQ@vOLLs z@DD;PWk>~1v3X+QSvK=0_y-{tp6;G`6IrEFv6*A=50Z*abTWZ6`{Eyj$5+OjzTJ+* zqTdEs+Lu^()}fSvSa|wCW`F#HFfU0-an$tYuCz?S89H{`mbtj z*7zB7Fag8((bFbeQE&Flv2(}cRRu;^M3kj{E?ehPBCfcoB^xwsNtU;iRDL=qMpZz` zem&wWR@ke;>8DK??Qd-T#>V}Kxj7C9r)epGmBoZfQ^z&X`){pFcrC7n@fVi!xNe*8 zAkbx6!gr~}u{wCgu?wFzqW6)VhCfj@{t&-0*mCUflIFV4=c$|7GmiaiDiS#Jbvvd+) zWiJn72*e&>*dF)KS-x>_rW1|W^Fz>wTVarJQ zoMRV$?JD0!*yH(C1ksjoytlJ_U%;ODGjCHE$9Bwd*{eguZI%W7Pwd_7veyYa$x83+%La5cV2tkGt$NIrydUo5wNurM+})Vvn|+_7c(gH0Ceu?KC;~rA&uC z@t4jBi@i~<{p|{Sjg@bNYk#X@PxkjZhrM@zSw7}Pc>wmtX=wdt95;Rw&0moN&~u8! z9RP`}r%N35ekcL_ie57`jB|_w*QaD0>yILOoncJcko-5Ww;XN4_&c$&UcA_NDt&0? zB&?aO*97~{F%G?YeD5(1?Qmnp{Ip-`F%H4lvvK~DdsM63P+&XW=)Z!wCOMwqY?5Yu z3%2J}=KFK_HvB?;yV?!Q_FQU}YsPxxp*1qrC_UXOmpXXU?9%BtzhR10q-dXO-d$n% z7VN+qrFiv(o#so+?%qr7ay!ls#(i1ezIH>>-b>zGGtSB}>6n#cH>6*c?;o~Ub*S1JMsQIGA}INk5&$9@Me_n{TJrwaTU?9Rp!B1h(jKf3|7#7LC<--&EKgu zBzZ0cnsC11h&6u>=IlipUj=n*Fe3ka{m@mF1?j2#)rMt9FPTkRE2Fw=g>F-8pNE~) zEnl}`S?r}&{lrU5)K`36>--JNHeYIj8gsr2-clK#Ywh8f*VT6HeaQ1V>g=fURHawH zq_#QUk^5_6)KHW#G7G9z!c9#YlrUq}lLhJ3zjKr@qY|ZTP%jNfL+rHPTN>}AVV>eO z@c55Ql%nM=E6Fs>EiuPe(K%OYBV!fD(nNb}SQ{RXQH|IIoptM5HF3Va9pXHfH18)D zIA0%M!bbI!(Is3RqIYFBW=Zy7Ue%nhqfvh$Pd@g^_6EE) z-;lKXQpXBUj6bJFG2Zf;8oXO$${PmLv02M_Pqewcn)SeLCBubA2#|UbCe< z<1#;e=?bOoije|A9s}?Yw3Y24AF3Xe@R8IlYP++I;3M?nhOOrI;*3?=hfx~Khd0AR zwp0$itVF#RY^&%VE)_#V8iei%hf3?r1#>Y+e;*Z!$4XWEzN#PlRO@A-yFO9omu;2t z!ME+$ml*E^=RTw`#;DAwF5CN6{kQFc7x0FxEk+YzoS3|^FAZCD9w)laf zT^r9p2rKjO9X`(#&k$GhY>@#ZF_r@PcPhEssVthQt`SmiK zS{S=j9vR6&J9+#3xXYsUfC2j*?O;?p^t#5tVtk&I&@nm;V=XQpBlACD#D!A#;QB{| zV=g*M!1|3=&mx}BEw$+IYZAnj7~{{n!jbE39Y56-|FSE*(-pqx2sbQ`$I6fQ#acYp zwY7x!)d0&Q*P0ABOy9(c9~Mra!^N)fP*-?~BiztlQ_CKouWD)P%CDIfKU<}14<5sUhc##D04wv>T9N~ucT3GRg;rJG=@|x-{J8mO>qcEzz zVfxlq`s8qW9bVxI4|0X?cZHWb!VT@Wb>(-BmEYX3z79`!g(LNQjVpbMD}1dh`~z3G zqm^G?*uD;DxWbY8)A5n^*Wnu-`VIFl-Lk(e9IwNX{nO!B9Ptg)cec_;_E(1^{-nb* z!|6M__U}3?eWZLk9JycA;hy32IvnwT9X{uZ|HKt8afMH~!rNWpgRbxwj&OhYb40FJ z4Z}C63wGos{BlghS^H*=`@}I3d+d1bb4&CG5#QDKbx#;tp~i}DqT(F+dBNGymJ-AF z+XU-~bBlGe^~+AA%RwZ`%`R=PFMogT6 zo(T7s-^z6$o9Ju>mb_je&j+TEH?U=~Vj;2EWNZZYL&iX~b6}Ru9EN`oVxNWd`Oh4#18p3< zwJ$UVp+9(SoChrLBZGBpaLTJF(=|8`#TAg5+S6@(_y-pA&lR!CFPc zwoR+;Y&;#jjG5r>$v6zwr#S-uAkMnw@$2P-JxEtU8P#kYIm=VEt@vxVPmFg9bzd1DH$_i)m100(~mqI1j72sy3T@n z%n%>ALB?T|{UR2dtT!3=VEMeQzZ86yjai1q%ELO8aTQkC>@gOsD`{V1$&1IJjJL?6 zj_q&6qEkp6`@z}W#J0_;z%n-$>sD|qusI6h#oK~N3qt>Utd2MX@gFSwNZ6x(cENLsq+jU4R zJloF8%7(1PCN^IN&a&-W$0jp@q+;{hI2%~5pL1FQ5(^0Wu7m z=n#tzT}Q@MjG+!AA!D$K4$JSQG01FeVux6C9tW1O6pMhfSQ(Hd*kqoj6~s2b4p{6E zi=FkrQsx(_GYA<^yrToOAe*idZ5dJ|9VH2CgqVqnm=$v%u5R1;I z4xU)}216{Y2iG#jg2NN0>!B92$Iojp(4oP5W1Xn6p%6Oe`wfP;())aE1MmN*;i38i z500KRZv52QlO{|W-}nR$e9x|v%pCjB=;ApOCP48!23lzSs|~f#8dn``p;fLr+(N79 zVHV$W1cgp=wJ{WSzA}pAif{Mr%&l=T#otqVntwLNnCRgl-(lFA=3;E|6pWX!Mw5Jp zy6qF+OLxxf2{(Q}tCPm|3M)>TGWWsJW5#jjiMl0#SY{thk%TaF#~eskUD@lt@w6>w!QA@FHUGLjb3}a=hqgdfM|~6MHqlPJ6=;uuqYQiM+4-HL%m(a@gwzj`nyf zA@&v{z0)4&-K#;oh?K7aywhF{?7aph+H;PMS<3E)J;URMxKd%Iwy9XQ%E z?Ktl59oU@qK8L-H;6%h;Aqc0v_hD}yINIZ_l9aEdYkyZDqOtNdbM0?Y%Sicn+avbw zLjj!S<2+ledl4z$-2hCJV@FJZy>eid&p8I8(q*p`4jvquVG(-?{ORGrxc7}$O z?-BSfRKxwj=dj1;Ga_P->%utOcPs4egC6~bx0_<`L0~3l-$=QD&T*WE)_=xvn~Q(^ z6&V#TNdHRQTm+Hzbcv-Nk7*InJC1@n$6)ZhMPd0UqW2(-$v%-^0(---&x{{}jr)PF zP8E-xHNJOGdjLjiYU+25!RXb!=l33iF$H}A^V9u!7xY(#YJ3&h33ZcewpAMM^j*}o zvd`;VwwRvRxA=O!5M}TOE9QDfsi>gx4>9 zqG_|34W%2Ef6O>z{W|~jJR|x)60p85QQ7`vl(%${IpT(f`5hgk9%&jJ@e7AtE5D|P zqD{}CXr?t+?KdWsN@;?D!HPL=DE+DN@?s-D6u2Rm-;1Z0G*ykQi@TyQY6#cHz4ELD zQ}=AE^5YEOcggle*^9dFnu=KKI zH0Gc1W2G8@$tt54=B*$$o92AWus;VgT6lXK82fP&>l0&i0%MF*=9~*jQVV=jk2waK zBBwFsu+mfo&o8bwkKKTI0)D0*UT3apqn5^2Rz11Y7ucQiOl;Ns-mA=}W4>K6WPKsm z!}X8ZqKul-fyNM{aOBE+2AT-}TiRH37FM1G6p^WBul)oMB_|iXq?zr{((sTXWK@f2l@YaXtupb#K;9 z^_&^8d((Djyn|T=YGplKDcuen`$5!yLI7`sc|Dfqki+-wtrf`t8KEe^1qgKXc0QzBys!SywlP? zH}{9)Jad0{vHO(xp7m9AQ*KnZ|E*}vuZ9i&L+;L1-A6TDGbsOoIU|w5T{C<9u;8W# zC(Y~UADcU>X!hiJJ%`V_$v-Hsuy}fY{~IUud0^P!Sr7RO#?6}Ad&pf64IDb`hM^BV z_)yQ>{9)5a4jMmqME>02cNEVUIb`It!YL2kil%aK#^S#cy=Q zpLE5)=8E6y3TL~*gIwW$u5hG%?D}xU^IlMkj$h&khoPkqXVo{Kn`()(p0g73n%%&i zW4fIn#|kG{`h32qB~CT9$p$t z@Chs4qt?6P?blXnA9%jAeaaOd@nwBo*vA#mw#bauB#(XAeTML_IC$=#@Wi73u7f8Q z{u5yN*86i}`=<0OV&2$LP^VeVG~_*l*e4b{sSci4_@2P>Ui3DH4zcL)xsJSVWS=VU zA@3$Ob-rVW?M7t3Df~>}tXB93VH?VK-xb7d$ttx7o8T41?a1oq7xIqrX@s+qEn2Z( z5*_-uH%0SX9GJ(3*Vcc{!SfiBcYrm(@=kIOuxY`^3BfhVa`3 zFK=EU%^jG}6f#pSTJa|b zz6YO5oT2p}CFYGGq#Rhj?_T7*%$vH#KPYQoS8{hultj1 z--J?CbZ!Gqv3X+Q2LPKn_y-{tei*RW3%?dPlNAhk z8e3*}3tGoxa*qfW{q>+yY@S&7&A?`^)+ZMJEnu9A3DV`e-YZTrj%WV%#M6;i1G7ilhHw`!+W)}V$h#@`3!w(@FIUu z*$z*<9hpQMmC`*MGiLv{-fP@~zQaCEqs5fEn55JUa3TVE`X-LGBkU#@weYi}cN)>- zHHb)*4d_F(nPZ1P!zItX(DNe9@-UA5*BNZie77OMYZei)_g4^3djoKZ)E<$vhewNH zd)U1O_Ld{Fec(jI9{W+Jy>U37ue9y)noi1hAIiew*oT$kx`XVWL>R{{#nu!1)zHfk zC0mEVXqVne=<%9VgtjQ`=7{aXU)_YA9LES-7{~1~``4z`Gpr1Uh&^^$sEX+lMLoNl zv?$T5qMl>k+OJTd+$YvEMf7+cm3<|D0QOR`FN|k@52&9fPMV1C?7#o>L|>ooH}=GH z$JEsCp0_qk^0uvB*>6Uh(mMaiRVZb{(ru|s%qy)mS9ih}N0N78PJCXZRFV2H2IkeI zcj{?4zr12;8kSDJ?(nPERjxfZ?x32N%ez+Y%Qb3QvMqtfTKB+{r{#HRtIIO>)SI!p z>PzdE=R|XM$yCgz>!~ zrALJ_S9eyCIHp*V7x`+($aj8+l-pu?eye=%?nAkE=MJk~p4&dxTl;kFyR|EK%j}|h z)<@3x7zpQw*+5SXLoGSWV2=1YH!;sw@RDk>)EwVhEw7EQ$p|>}8kXB8)_-=liqAKX z^-?p|^;i|3>l^X9@>HTlv4_r9eHpn?cLttc_dwkZ$Zg{Z{;3Fa&~C(YzcTF8w+k0F zIk;+hZlEBvdNpR~y-+`AX{gOgHDc*<)>ut2aLr}4*wBm0y5!@li+E)elomvH32=qh zD05YY>bI(WE}j%0eSyz0PkB6k?}sW7Yqaq%Z)32WEvn|16z0a~OG~qr8J5<#*3+z1 z&*FLCjEX($cWtiQUo-T?@b^c)H|pK{j};%8aCq_|JUOn!H)5A|kC;(JzumSddNAf2 z&hLuZLZkL@_F2<&^S8m9TPt7HBgW*gZ`S5-sq}ky;tBiT4C7Sr=uLR0{;=W`|1GN= zK65INAINit={@uWXNyIrSHj<-u{~*heNvi_y^iXZd*aFK2Rzw7RDO@~ZL8l5h~5>0 znu+<=KPK*fQTO)oQC4T(_&p&L0-_EKFA>zn04c^vnq-nmLam)iWsm_`yFOi)AR=Wc%d(2pb$!5E>h|&JqK_}FTjcqE z?{lvEK6CS8`}^!4zdfJNJ@dV;^F7zO&dYtyx!-Xv6mOEv`tU!KXFrB+>mPytpz){4 zQ}5zz^2@$p<1n=C$S$k8clhf#AN{DmZ&P^P4r}QCb3=W<@^u?t#eLl#Kk?j6oihgH z;n~ytcvn1Y;sP5}|~nb1}y068)(D@mu{39fN$n zehJ(io#{W9JT=wVk%?0HKSC*10(brq7^SfBr^&N%U!8S0HN|;O3TM(^`!M#S4ecA) ztMd;P9G-Jz{?P_&a(1fLD9h<{*WjG?X1+i9SVl7NH+Z5_)wuKu?8os{)A&YZj%dE_ zg;ViwynpvVtf##hZ)`4VX-jl;j=`I0mkk>fYd(E$=(1tWr+ChPfYp&2YK&99(|k(O zv42`d)IdDg{}1PPyCq1lp8aumg!7%|Xw31}><`$lpc&nb`s;4D()Sg5+R^xN%s-)g z)38mY2bWqMXNFsmL*oyZ9tof(#ETE291*Wu)_Qcuk==(6A3A#Q_<bURYtDF0#J>q-m(KTINYY%2w zUs*rAYxL?@t$wvxxJGfnYR~jfI6dOru;k`%S?6+A&_6p4>sooR(rWq8s~wekYX zZ5>=`I9-}JH;wN-$6kKWcWdv)slMKUlVj|keZCuS+l}jO_xOB$R8n6p)rlU9n@M z?=+wEo9^_Cw@_Q~tb6v<1;$?YaddwCM7(z5-ii73UG-VFe(=pXGmg)wzH852W6`!8 z?bMu5isxy2S~{lXTfvnPJqDRGzd80FiMGY-TX(d&I&<`-y@HnJzNhWC3O|Rp3Ufww z%gU9AuiJR$P0wMRqg*ZDX0GhVd|vB#7y5sRw|iPAW27%ywAzI(r<>yMJW7;%pRl6F$-I8ErpL!?yu$9sAoj>@Jvwmbv#=7PJ>ZM~?KK1~P z56g!2`k#sRW<6(ZtzI>JXy3A7$x{cgLP(#L?WYQnb|+>zq_)QuKIzD(%JDq+V-eq- zn*x1zM8hZcTB*#z{^Y55Fu$hn`;%k7{cQE8TeB196QrEuI3G@pHSZ53f{*1}$A~Xlw?Kbwb@Q)QjaW9^_p9*y*WstXE;;LUD|zaS#gxlN zq_WOojTT5ekr?0A+x8pl+UkD0v#sQ;j}ezV`--*d4vd#|)u~J8cMN`RLw@iH7Y_fv$hg+qGB8Q8P49b>$QH_#jAK|mA z1sEBV*2`Au`sC`dz9i0MoAb-sG4&WZII=YF>o<12#kLG*J`;84iNTrnOo7q99(#i1 zQ=Zgadt%T=QO6ca7Js0HmA)4lY?KcqMdFpf~R}%hu)sn{AJ*_S2QFtJB!tQg8G8VB< zU3#8A*C@S0^}vhW<$!kMI|C90m{Bv1==JDoykUR!jlQ)vu@Cb8fwky?!LFOEJ)Q3l z+Z^+~eQwnIm<@4FzB@bHeb;_)pbs+|o@2&}N^%Ykz?TT1!)jy9MD%5@UX~q``xXLSE zmi140zsUc``kzmFWy;HqFHP@z>#eunJoCnHPyX&iq-D=~%%1IQ4yEF4*}ISJKHl@{ zhCsxrr6kVX>^`*S@R}pL_pdpy=3xGt8E>uGmwzJTWX2m;CK|Hyj};s*dbJU~M(UOQ zs4e@1E92vohl~|S67t$zY`>oUJ%`%;<8maW@ASAF)M~veFK^6Bm@C69^jnpB%A4)} z1|>VOPqEK*|1;KkoX0#Zf6+Cp*_K=}*QeYX@!`q)Hm8Riay)Qr z!Yx@{_D`I0<)=Q4-V=W#UO(}Li3RoB>j&QY@i*tsI5DI4uDy3%iG2|FWON7XKk~I1 zJ>Pfwkmc?NY)xPH?nHB6B;l^Uf~j-olS`k%TK7NC2d@iRMF-dWiw>NL?@bh}3yvCV z<$n)7%C~mx6?oTZ#}kF9mGOtTY7VEi`udGcoo{wl-PIF1o*QPJ8`gVf7wU3H;!I~x z=hi;Fp=asySViGo9!RlvSK@rp;WJy;?rJ$-bc9w*Z(aPoj_Yo+ijFSUwV#zBIyY=k z-vVQ$$(|EQBym=pxn?Y{@d@OAr{E)ZJ~XmWZ6(<}(MtIuS# z8=fha(e_{szhXha?IBFZKCm?4_5teF97Vr9)^q&b?4DN<@8&a^`J`LCxIOn6h4$Q% z?!V1$hgrA_34JV-@LMCS@rQ0X962)7>8Wb0Htz>i zYuSv0{zQ{ifFn|_E!=krsk^=SWuG0+XyrTY$31C%R>r~lL-mIzf$y%=lc>W~Z9e8C zbEe^};?bQpzrn*)xC5*E&S~y_bP4PYzWux-4c~sUu-*7jZL9I) zyFLGmb2|7IO(F-gz%QrqjZ3}>9mB_2FLrgTJ9vI;O-D|D->RJ8>sh}2S>fNjYxS)O z-~UQRb^l*(3V(7iq9!@kq+Iy&49H@RTy_NfE!{B+_y^>5VI-}=I>1r6I9 z2Hy7ZUALkCab#OHt>{p4^)72V?x@rj`ubspw$I66J=k;N>63fj$ir8iq+RCbuua*& z=NtPBTQlW%_Y}@X-N1VRHwS9yVPx9D zX^o9s+mFt}y{Thk*%ZRHeg?eGt`+?J!Iyi}9Z zUX-We%&*w)NfoqCsoPU0UIbIuVO^f^bsRo-p8cbv^ET`F_V$h0IYphp%$MytN%_<5 zclhJy(>2-g*4p8TE}2sZ+xU5%Z$v^{s1eoIw`y9! z$?Ti}JaG3sdZ1=P_t-Jg{&WkD923ETAD=I3DZ<;?oc?v+M^{h6OeHeLCER8G6O1qG zjWd>c_IJX(XWwy@rjBgXm}{RibVnWfvA}XIQ~n^{ybtTA+BJ>#wE>)aiP+Z$!ms|& z^0)a;scQrHO5m_$pv&^%_&=QeT$HteGS&JL$7?%yO<}}XEAp6C(;N@qzSY7E_$wS& zZ~hSH#&Jyn=L502-F(2p`5>g~_i~n=dwjV6Ioy6Anw&MjSKXef&o~|&7|Uop*m$Jz z)y5N3PL9hCIs3b>uOrjS_y8*tUv0*;=31UnDR?ZWrg=hm>L<3Rss72$kLjxzI99KP z?bcVKQj7cTlv5IaeoCIL6e}D-;Z^ohN8>w9pE5AtFTne7i=7ePcbYj)N%)=KpK<&m zr8>R93J&ZujvaZ%+g()`w79Kjp1(}LYQSp+=9w0}4-97}dRp3>gDcA}a@Nv4=I8OX zZy(QG=CvMetzT!xILF)ABh8iBlp~FYv69&5x3J=9$1xt>Jyx{epJ=cO4ip?LIux>u zbsE+iJR+Oo^k!aHTbo~xIS|T$fw@K>`uao-ayY$?()|~p|^;~bIA7$>ro>PD~ z{=FO6abm|?d3^;hy_b`o;|_b>u>(hzYmV-~k>#30c{s9Mvww%ZD#^1~2zmB;B+uSY z^6dTO-N0`1&1ClX`Ih0h%%6BFr{~R{w+i}-Uc%hw%oD!8iBsLV{gBi0Pda_WT?4o? zq`N|>bNcqh+t@rJ<1tuUx__q+8OI2|)7d%hYR7lFE?`Pe;z~=tUvUXT~|LT_Gb4|Vv z^!O2b1&_UE&EX#GHERwOU`3trRsq)U87B*{md`kDo;j<)Z9~DVEDJ|5MlTa>+eNi? zIVN{p;5}=yyI-A_wAtAP3#)PWxe<2`!#LpVZ*2~$bF7VX+H--khh{sd&Pn0hccbHd zeroUJ{Ha}2v+n$O;{5t~_83`#dt7iQh{GQjaL;vL_=F9fap_KH_~O)EXr(FptTol~ z7Ej;k+Dt3EqpdS)ldbC3i0t2Kxt?B--QakPo^dJ_50|axT4djap1g-=lc(nRobRX7 z{>8lc{Cw?{p886!4>HnQ{l7LhZ|N?~-8b=h+?CeRKES%N9_K*MyZwZotljnV^KO5k z=3RWHYpK(36bHvcZtb4-5BSM|WB}*BFQ{9t6q8n_C0@B}JzsZmNolyOJW^3v6|1g^ zCu*%kZKAleq^2}dR$dz~iPw}@MiP-K+!z(BEsKRq67lld@^GRmTwPv^q_wfKl1OE7 zWu&4yR#H-25-zDKE2~XZRF#(|O3Op;&^psaUxO@izO;*D&z5*NKJW7 zBo>P&s>5a2Dr2R!WySIGM8v8tO;jXmFpmrlz(gTv=TSi;+l8X;s21E{;TEB~_Irm64i~%9@hm>eAZs zM7*lHytK5Uyfju-87{7lR8^Hk66N9Yn#$VZvWoJO%2*}puq+%auPUpKR43x46){vz zJX{hli-ibSlcJXRbo zFF{3Cqt?R6ud*_Zc8SHxBav`5DxxG_T?PN+r8Q+W<+Wv{CAA3@vaGVWxTLzGG*MYr z84Fj|#1bVnk@DJ#%0zi2R*g1Jl$6H9HO1ko>dIJgDe_O0SA}bftE;QyFkM@csHu%q zRFt3zYb%S(&=55xv2byDO{^BJUR_%fF0QOVZA5A!CGkW#dPXt2M69%|tRhxklCW}f zZ<{>PeoQWRbV=^GMJtpc#WeN6^iZJ>w z+P5l^C@+o|N6IT|Dk^Hj6=jL4;&4qI9knJ>R+{EqY3{hW3-1%>!jVJ?Tu8*q%S%hj zBgIwm(#jGvb7dl4TxwTNRiq}29i_N7f}ULxuPTFU)##Yju~=EWDqLC~FD;8lV&NL} zvy$T4lHyo#Rc)-eGFDw#k(O~dcig-Omd;$XWG-u^xHybb#S-y2x^iV%ZB21Syt1|` zQ4>jot83%sHQ{)5tOEOEBpeCHO0ct4p>h(jn$mc@vMfj>ix*cViqS}k z;_5_2MOAHSyf#vjmUUU~xP^;RW|g(sROPwj?p?TOY16#iZzXNN)RT+3vsdJfojcH) zwiqtYORktVH+SChA7^t6$wDd!dxDWF=+y^on z8y^>W2XhO*$8jz26+ih!Vb;G)&b9C9{Qv(Wh}L4>n5zSyLHxD|_J2PsUCy*xv(>i@ z6-~)woHUspewNL5pLgzQ0ZNN zvOW0?wCy(t9dFNIev>`&NRM3Xkr#X9HjljBBlDRA6$X0z8RU_#wEc++9dA!bZ=b8} zc=kgTuJ*(aw&Qao8gC0=`Q~_JxBM!8oF{&kA*bgbwC%a~xhr|7!&mb49=Xzx)9nrO z_&>rUUt{OT=e$%<@=%YQ=aEZ2@`oPzfSAM6i>#klJ@P4!{GLbVJ@hK5^t?ykl*>Fa zpJOuPw|nH>9+~&^3;zME2N}3eWLRIe{mn7*Pp{8WcKkhd3jQcL*CU5K@)L%fZtprz zdwjvR@1|Gs&m4c1?B=gzcmG!M1}8ryXL-_pXvF_Ymvu07KHT-s_UbX>Dev*fhdlB- z9@(v5mA~76l+5SgR8aCW9{DMcyxb%6eI=4Uy*_WS>^p4MGOqdrSY_@$3dqeXIBa zF{k-akL>P`qdn=zdhCz&#DCEv-{_HVveUcyDfvYweXF_0R`Cs?MWLryPG*i+x-cKO`-QOQM4dL_Hi{e ze7#3@{Zae}J@M}Nq~hKFQ||Gv!uHSgN6GH`MahR9`%0GQlq^fh$35|Ge^Bw8J@NZI z@-ahBug@xvziK?c#o;U2-G7wqjt@$9>sQHcfB3S;{#QKmS3PpfuCJ+1{z?vcWH&z* z@Ah9MyW_i(Ydz^7^2qM|tN1%S@oxR9c(?tP?2Z>o{=k#|phvED#$(05)+6&7WffF> zqamlaUyWT~dpk)okG#htzvYondF0)m{EvI&;hE|Fo$gnthrh)m_ju%|J@S5!?2h*;zayUb{hs{Kdg2Q_@$UGn?791glCSsh z-Qx!pKi3oQ9uKN`_jp#xd~d4?N}l17H+W?C_(Sn`81d=t`*pj0$BTKqk(B+D1rt*4Giw{Ym1>AqP>u*_xjNc?D#?8$ihiqPSSyBUo-!?M*IZCFGReVKfhHi>2E^(TEx$WLh9#jBmOGHzhk8TPn7pF$b1cu z@INs4_h_u@XS&_~pBeEi-yEb@L6z@rLw+CjN1?v2()MRScEg=kx;)(@f72u1W&K3g z9qsWQUC(7HYn8T~Y5mce`_#J<{!+)26~Oi#0)$pmIqspX@73E z<)F1o+Z$xd!>pe=b*u9G-@3f)4@0aGc#dt8GJ!55~l(eV%3@e{2Vb^YLF4~Va^{!Pm~CL3avSi?N^|1~X7w&QQG zT0HT^&@-s`vDPV1{5UNS1&7~#;ya5a1OQl13@ZLc3yS>=%%bomCt?hxy1*4sM%ZacrPTkhIf*<-(9;F@3v z_O5bIewo@H$Cx43H0PaqeAo04%s0Q(<)IDw_gh^ak@*gD35?J2)Ia0oJ$vjsA#HC6 za8Mt}5X(E7uBCp7sw8634+oZa@#PZhb{Gd7)Gr4j7Jf0Xd^e0^R|t1aFjQj;>J!Gq z!k&Xv#8hp5Q}~}aG@@%?b{VlAkb%d=UxGDhyy7?8MYAK*TcZ`Nddm}2O)}0 z{3jOsb-*EQlVe+mm5b1bP5dVo{#@#{|HPtSOuhD>SoBX&uMZT7MGxq_yN~;LC`b*) zJ8U8S?!F>oMk0*IChzNu0*g&zv1ylO1QZDM*a~xOXul6F#1~j1*#56n?QZ(tgt$V@ zSq&W29AdG*nR?x(#G+@Fi9f`m=U5(MLm`a8CN_zMlL;*EwPV^qE`AW$)`d6N&`vAw z>$A(H^$my)(HH{zlK4O@_GbWxM&k#8`>xou^Ub%_wtabT9{aX@`>UAvi;6>j@F7)i z#9}|&&=ZTErsbPm+%E!bOa%HL{0n7=SorK?0sYb?`We#i!COkc?mxuBe}Ei1h_D)) zaEOJ|1}vN|a&(#SJ-P=X(XBiI5u;v{hywOD6i3zXZ?dXG4wZ~(=SZ-Na0F4T60 z0|ytWG7?K(x#Z|_jUz{wi&!|tz@Z9dKSGYSLo6JwtEDW&qG$6+S$J+zzW4Qg;x8+k zJ;XOFyoXqq*eiA6sKSiU)CmvI6V z2zI&jzG;?=zR9=6Y~M8hKI$hjrDZ*YO}_E92{>>owfcRhEHpwlwvo3HDJ=f%ggi>? ziABF3I5ZhQ2nVr+zHUR@4G8;RQ}`_LB!x3km4#Cj9tbS;Pb@Zv0*5q*=g|Y-Q2g=K zPgA%WIM{+81Y${BPfnxa%pfPFIK;x4YjC(v1#VY-?xKZvD7*nU*oq$nVoA&M5+M${ z2;JnYQygO9^Z*y?`h1#Lm*rVt*~f{6p9@>^4MSql+x`5TP$1M{3$`PX#=;p0Idqq; zw%1Ytb_4`YMbh7hg-@G>JWxg8{v!Sm3x~Uz=!r$oYL$J8SoFEnPsa~JE;iBI{?DdX z`~UET{trT2P%mJKC9SQ0MDb1iaPoEkClxfxt=|+Viq-W>Bv= zbBOO#99Bo6*4w_ZG7#v0NMqYKeQ<93_MlC%Y~M7tefu9uZ~OL;!fcnoDuvlDh2K>; ziod{LC|r*}(Q_9HtXBF);%0^C;xD9a()ED0Lsej{;};TZjnZ#6aF@Z^Zs6;I zWgH-u_8JNt;6RSRvIo}L(Eb*gVD?EF--sn`2sp%!gTOWlwcF6{lc9$do=W|Ch3~*$ zq2}KWEPb0;Y_eO2SU3bygI%hR5etXqm3(&s2iRc|p28+JiG}|xu<#E92R7md;V8C3 z?elQp5Dg>bV+(Dup*^;Q9#yyue`23l?B5I=+NwBl`~^A{t}`(Eq^!e#!g&!mv<*K9hp-iDKaT(hI;iEfAf(lE zH?gG60}gx-KL{ag!A@nLSU9YQ5S>C`JrrtO4IJ!Hd}85qUkH33KM0N3f{!T2ORn<{2*+=CVZCbVr9%V^u%Ik9B|+V_(5QK1G{Xf zj!%E6a2?}*r0^vC1)fxx`*@+|u+PiBLoD{^0*Bau2zI%86mG(w@QH>00B~rx;&4bR z)ciHn|BceK%ZC0|VK#Z_DTTZ7SNOETOeTGpSnTfs4r!Y&7#w2Z>?h~P_(5P_lDU;w zIL8e=vFJaeUiWQc(eoH2^b;r$%7A5!N-P{+lM2v51g?<+y$VkOE__yDu8RtvQJ8&F z#yVoL!~PlI&Vj%>m;OmC9QLKa^Y}qvUy`;U7S4Bp13$$NLMt}m5DRA$uyDG`(Z@~1 z!eMs_X*+aXIK;wXv~XDeQisICd4qawpIG#7154U>$Bqx%)HaClf4_y=XDjhq$uK_C_miyG1#PBYS(^!upS=b(s1|65=w`-kM{`X?67AAzO3yj~+5V&U+dCtk2>hpT`Kb$bl~4)rNL zuNBIgjabt1IznK-;!Gtzpzs{v;P;U^0`|}Vvy4{I|(_(P=-gEJX zSUB4Z&QruMseGRy{zrv*-9~&MmbClG(LV4#C%llz4kv*_zfkxsVCgf&lJ+e1D^xub zi~je(VslU?IJ$m_g)ax z{U;XAX5heU_(ABxCN?RDUgxh`rv*+boQ=Q0FBJ|LIEVNRrO(A*;lC<8hWJf|Lk6A$ z9QZe-Uyi?!=08A=#&&&bpUwJ=f)n^(_(7P2O)zar8HuHg_ZXb}$kFo=v2a!!oDBwt zSU6h^4wsw39jYG^3x`9D%nQV#XZ1|3~V7 zrSuudUiewS0UARXWax)e|7)c$29|w?SbX5xM&>(W(N6*nol$A08XRKb%rH1SFC=z| zg~RzV^c!V|RUi0wg?Sh+a~ZMlpCE^ofxs#j4zX~aGW5iv-)rcJMQ_i8dOkJh!NUfh zSop_*1OHq3@CI;5_qVqUKC$pQ_umMOCYH2skgt9In4BM|dLR}~ zhA~GFi=OwGNZN7a=(NPbDJJIw%^l?E zauEyXDd5l_ls|jP(RPT1!}~SF&Ixj~9b)0U11!GrUe?g3%H~<}wM}B-{~lOu;*oyG zCb4kv`4B6_0ULqW*u@U9aLRziP6IjGH)7#50*C%n*;#6Eh=ubIaNwNcw2-6w39)cC z0T;fjI9q{3pDEmJ;HQCQEkP`4_X3NbF8~+nw7D=5+^P0KV&NB4zf0+fMPCUV@+o~3 zIAAH94=g?t3%`h*eu@(@IK;x?`bs!);83RG&m!)x@LX~@Ng^~6`xWNeqcB@xuAKq{ z6y63L;zWwT`8}XN{J4{Npwd4HTzI9zJ=9;N@H52P&I<GzA z5xO2f2hCl6`%WE zaJP$vvjY0iIHi98xUfLshlp=dcoWlV`^1vA3pm7%jKKX=>YP|OyA3_D=((Q?pIG$V zXGKpe`U8fZSoB8?J+bId8hT>UzisG=MgN|mCl)=2Az4Qei=MlB=tfm`?yk}giG{pG8h4TP# zK$pFZ{384yY#{!U!kh6Y`#!Ox?Ix#KaoCkZB?>=_KbiZ8h5s{P$?K58Ar{UtgL48n zREi&jH}NMv5DWhdIfaVzp1~m&&WFH-n)7?$P#Jy@{)j)ZNi6(98Q_#F&TwKjAVMy% zl#5vSQC3OTwh?f@1)iG{O(9Q`5i#pLMy znpimZ0S79TeV+Fd|A~dOo*dl=x(p7naK3MFo&+weQZ{)EA~uPI|AN6kXmE&yW1maZ z`SN%~><|m*ZD8^319Eg3iG}kiIl6rVSd$BfSU5RctAAPfJcb1Y+Stfk$aQvFPi7 zgWpwrV$n|q4t-VWImeBRx>z`k(2vr3V$t6XEH;TnKOb0ZE&v`GQ#Of(!?|gc))R}K zbCcL47X3rOVzY&uzf?Afg|ornaLyW8tvKfVwFUZ7T2Cx#w*yPQ#G>B;9I8=vIG2Su z03$q!ZDg&Bh5r=vqqLq_^m~AVf2;V!qJNS4MM_UB`a_1ESoFsYJ+bKDH1x!xKV#^L zMSs@N6N~;+Lr*OF47eDYp#03jU+`%c3n!PHI;H14IC7$kg_94}D6J>y@5eb0jB21Y$|crW&R7=DbN4gFjY$V&QY%EKDf<9r%;|lvp^kfJ2iM zXFmQ4b$?g@JaV$q6AQlyc$C%?i+(Av_&_ZB)zqi(gFr0$Hel)h>w!mpU2%wovk7>V z))R}q3t0L#vFN`KEH=A=N3sGCh=sEgc$C%?i~cEKu}Lg?&f@_+p8OOz^bPzVynw%v zQ(Y|l7oi%Z^~9pz4=nwGSoBA!*ZqN5^e2Er)9{19d0#lh!g+_BM#VWpe5=C0!=JR{ zS?cdp`Va6YZAvV5J_eRHB^Ldsz|y9~qUSmx_zV;X#G)U{`AFAQ4)Dn7ibE_Mp3fYm z^~9p*wLGbRV$p|y#bz;Z=$p!BDe%Y{E*5?S`cYa>Ec)@lQvbxFuccnsKe6a10S9z_ zP63vBBNk30u+$r|=%)iqy%CFk4sanqBWEk0iADb^@F=Y(7X3+J@tIik zr+^FRC_87!(f$()=Xb!;ULOLFO#1M|n`IFT=l8&)w4PY>nOqm?;~-+u4+5697;bQg zg>${Z;rVAdE+!U^eJ)z>kK@VNs>(tvoND0EJf-LQEihN%2I}W4%;%S+U5F*^6kur= zV$nAOOS=$@-d^u<@t7o>=rtfu+5OMgIVB;cd#!#XhEv zH&4#IfBC`{^JdOjxOn#R?_7$reBSK2pF>G5S^6Do(Y!@T{Ed0wQii^@e98S*(WSme zPj~K}*ED}7ztMgv6MQMb5^2NFJ+poHhaz`qgn5liDvcM(G5lSu2@cIk_%=pzf@k!=iR&T z!Fe;2P4h0zxp%?B`735Fzp$OW5y=%ZZEJIuENPlKZ`nnf?%w-nFHN&^@9g==eaT`J z>E3(s5%x>@i8gJTw>T}S-I=r=C1vy_I>r2jO-(bG&t5!t$)XD_n30!Af2pLG((C?v zDR)%0HC;M-`NGBDwu%-nSuw9@!lY@1_pX?ognaQ1uU|`hsc7~k?0J`p)^FUsWHd&A z%cN#cyi7EEq9>XuE}}N~ZZ!m>K^HFm)}{QihhU*JHQl#pCJZk}|FM=L*^2p>O2^*m z^nj&JvscVtvV76Z2j?wcVn@tdv}nnF^DdRxoEv5~U6N)@4`i7|vwN&EbFmmZr4ccI z`MgW!V#i&=_MD64s=T_SIsKyFG;j4_n5MH!fV#d^9bvSy#>{n+Bxg4@ElFB)uw$=W zRFrh|=oQXfa4Azw_s+36f~}a%|L-i~{{;nJ)HK^FvIn}NDgl)ON-BV0p{O+Cs9aPo zItP@LiK@(+IddiUtho!rqAGC^fo-+aiF1$xN=lqa6i`hCNK{hf>WjfB&b602f6~tn z`&$;4FivQP_!i z31Tk=9@9j1#D}nV1eo?%jf|szw_!8w@jSq8=p=}}Iw(wg`)XZ#19cqjas6uAtA~N> z#Tfp@UNL~lTL5{|MR+$sZ|1vUf;uP4a$Jc`%5et9OnZBgF83n#PJ?9HI|O_5oA$28 zCiY(O*gFAxOD|%N=PyiqufkrFwl~eEvO%{cM3eyUYlWWgkkS* zJ@%f2y<9N@p1>zP_VB@8>kdTHziSM89|D{H9YVSu=p=|e-tuJn_xpPF95wBY(s8V( zQW!JsEyqq)1ib{Y$4d&Py*F=l>+d>{rT*GIDer@@H`Gp{e#F1)Jmq~8_M|_55mfOH zv^4)VUBVvAV3zko!`_XCy>EkLmUjp29YMSV@ozqOroBO5v#e)9V*TBOjd3jRDC`fW zy~P+rbD@_Y_IRGdw6_oT#(+e7h1kU2!$@G-+XQ zOjf8uCy2c-dB%fn-*C%YW!PKpv9|{HHaXT@{}y@dJp+43z+-v8Y}osT$6ny7i~Bdp zWACA7;~6V2eH@dv9|yhMGv43Xs-qvldwPU#b)|<2$S>0`twh8 znkfDmLNna@OF$NT!#wTrA?!VAr%*rQAMc4|ny8M8!`@k7`iG^5V~@ADnf^U76!(hh zH2f2LSAk^OE4#}b?T-}xj#?9s4k@29Z06Kfj!hpEo-ufb#QI2Idd zIwy#|2_Abh=DF)^Om&XETI6B+mygMQpcny9U<^Fdzn!qh0}c9zq0q7Sre}OE#$l$Mr6Y&2`&UnCl8eLl&Nw*Rk_Kl8jJU*%Uu0dGFI8L|9Y zVo%DKsK~Nb|Dm>E9ljfT>Wt;bcg^uF)|c>=(Zrh7&3(bHX;w$qSbi@sqo*r~Z=s(X z*4#I=X4wee@aFyaE*)4yWB5jRhA)xamt{Tgw^n~=LJzIY`ou~#_kQx4)%;S}-yJRO zq`me2p3e7&@q6IGtb`St7tHpb-P77H|KRy;v5wnYt>Cm)U+)81zByUFpY-?jzWqb1 zPw)P0bKm>Jf~~by^6YEY zn$@wvSqJkD;i{rK$0)^0n19tErRx>i3n}UvhQ7 z;m&VqcO*VK9~^!oa@!isiS~Z7*IM|O^Y7+<))$g24_Bs?*$*QR9+bq znVV}f(z2%|cp~50xV|@X%!+g+&%SKU#usc0+I?uDu~vP`_$KH+Ujn7LFXdZ%Fw+Wt z^78rm$F8jjcOAr6!&8}eZ3?_}gFm@BW%&|jUgpBW%=H= zTlnQiI;Nt1{jY88XhiFNnCW|YQ|}79bu$x>{M*J~ZW>+m>Su%cmJJ)6nOyoZyf(jh zyJmH8+gNLVTXNP(Yj0cfY?iNMTf~a2>$v}w^F5C}QPc5Jo3Hn^=dF&9KDxU3w7>sf zXD0*ig2|dquFkfatD7g3uIu;+?9P5a@PoI;m+Id;trtf$&s*SUBsY)nC6}JG!u~8@ zxHT(g)HCXjtu%X@*-{-_$65s~$+NE_#R)4spfj4-^+ue2v-9R(jUj+k(9e?U~=TYIw)TFQ4DhwY543CgXcg zoPnPwtX0F4n>#)2$=>1ipQ4tIX^mDvdveyZR>z8ueaQg&|GwbxF?P>!`+@Z7px??! z&f1MKJR42oD209OaBIQ3-gO79Cu&xWcw+yfS-xK-m!_uM_3ho;niJgLxUc1R4UKNY{`Ep<`1xO3 zPj~e`x7XUb@6pT`I?D+sN`Wx%N~`062T=dX)mc_oR=D2@t7~1qFJ)P4cVt*=e=x!7_w+hz?bEMVykZTMO7l4`v+$Cru?xNJ2%&qcDB9rX#a5e%T{vp z^H!-nYG=nfFh8{?f>@dk&bncJLDyF%>|NKJwHr11S~T2xFr(wd2#fPo*uO8jW_8uF zthe&s%zvZ)=o9aDBHHEvv*LUUta3%)b!R9&WJ$yZhXyqzVlUW zH5)wZYfgmyJAK))`oGL;J=~g8z4nJ!SiNP>TUS2PTmFf4-6Oj@w_#6w^oqe*$<4cc zzV2Wr=9tcGj8cUgJM6F0A5P`9elU5?)ZohQ8BzsU5~h@9R_h5XZqI(LB9J#e8Db`xWx(hweUz zvFMxmR>#VS)m#3I_4N0WOIP@oVYGUo9bZ9j=~*A#ev=ix;&8M%G2N-5#_i#(6|sR? zQ;d4 z$}Ve8);!F+oQ3lIU*8x!(dzs4BX@1;{iMr!J8MV(f7^8D#%Y^IKYjSK(YZaa_vpan z(ib?cPR^UUWopKqA55Hs@0(ZOy60AYLi#q-OHLLGh)_QQqf!+HL@0;}2ls6mSn11r^6LVgjfBc?f zi;vds-@oC-_2Uoj-B@&_qw{vF1348uoIJbNx~3j^`I*;q)-Z*U*K?L1cyRrI#FUog ztR8DXJp9;3tMt&IYVNTE`)|2*{Js~y7wl5|ZIRw@_hJ-H-*5ei;1h*b-htk0QkMU= zaQnl)aOS?~mUuq;i(6l#yLbBXQ@d01TYuMDJ>hrj@;2tR9o}%bO=>*c-r}oIy=|oM zCz4AOzToz+SVIy8+k-9te*SRF6j-R&7Vc>~#Cu1w);-qb9nxd>8UM-6<^#p zu{plKVS4Hf?DxOJe*U|4Q|jKXlYD)rRRsOx4R#h-dlE(1m;D1; zGsDvoK7aeqH-!IBy)S9~+)4(nw0!Y34MQg8!5guYTs_F*UcWf?7CaQKKXcCGy&E>f zlAGHtdT=*9*xzu05AYCe0K0pm`SGrJ*2E9)oHPCS^y+W!`DWgXEi*Fi`rx+N=sldH zd%Cv89`*P3euzb? zyH3UijyNwuyLVmbI)82Hfnv-32EAHYS^o{ba*A^uJb=@I-#Hy8g8kpm8j0h?Tt}y5 zoU+nE$v8xJR6_8zfq%cduKj_&Os#J^%i8{tKLV zB@Z{`bp8OF@7hyMJhJLw15@8NSq>k2!)TfQqi@mJdMIQ6E3lHKwt+0E}tPx`Cv z^lp7Bd6t;Nl|HtYdp<|WHyiQkEo0$G@O5$FGtndE{*#`G6s(=Qq~2=Z-H*u6FoiJ^6pp=DXv8k`Fq3CA<5> z7d`23w9~uxmF%{!lHKws`TLH2B|l-v>E*e}w(rgdN_II)9_gf4vfH1OEayIXCDBdG zM1{6}cYjgxRL7o@Ydx~Nzo>Y3d{XjvJ^Wm!f2er(?G@z+^?%*PCDV}2)wb{N>_hrpY+ba_6s z<>p*{bzk>wIOFZ>A#v^xV{+r^K6+{s?qM+XL5KQkl|Wv ze5Z^A`6dYag?tl)d4{qTBNu;#x}z5X2XNh-fpa+y3+%vgA~Z;0{)Vnrm?q@A9&?FV zu?UL-Ow4wcOw?aLcM4<|{D?PEKW%bKv)CjSo0Y)wO^rA?oAHA{ESxF80c~d|@mTyIaGaCx zWw3q(7XZumHJF!tUt>HmBN1j{3*1DcuBQb;3NOc>_(?221c2q68Z4J^h=s#?3+an# z%(sv~2zDPRQFt=`LOKEW;Q%8MW?++VI;;kkZ((c&E>yb#_7~_Y@PlBtBP$QV?&liQ zocKm8zTE;W--%#953n*2?#3444H5{munA`|u-G9MJNE&HxYHm!fK6~W@mKJJz&;%M zstxTv5Qr*F|D~@Ii%q-#R4Yyte}Ni>Z955tS61YJ?nY@@<7%Fm?p$ZM9WP ze5=B%i5nE=_0#|_pd)Y|E}W$B2I@85P5d>b&&OYY7qk)B|D{fd#echQzd;6`>BAP} z$q58v;XDW|dScPH0tcqz2jN+40bZO&_$jtRb`XU3u*o<;ENQQz{(JaAAQt^_;Lsh^ zs=g6?!o|X2xr9>$9Q;egAr=nH7`jvGC*d#neHRPIZkKN=J$J1_c4UMoHmNIO;j^fs zCl>vDVBRCbzWflnrexb}FF?=!?`*;KEt>L11+R|H_6o7XB=# zLUWYfZo3W_3uiewNu{^jah;2WvmUD8Un@Pa=(hleW-I+R18)Z|)cIxs2j(fxAnI8e z2;4{H`v^I}qQ9PcI*Y*i7d`7=zMD`={B8Uouuck_Y-rhib&|Tu#KNhkUgt|JdL9dgRw(;?OuBHT!uFVOpThQ-aKFM^XlJL3#SV`V1K&~lC&|(C zGO=*@YW=zl28eKzor!u$<=SK$EuY0u}G4e}>EqNi%`^B?82dHT7%%QeQI@L-;8New&&8OjhL$IJ4+?6JtoX0}m&NIiE9>sXynJ>sbcI zdwFB*81*AOa*(wZRch;xBh-A)<$6DCjN^LY9wadBan7EMO@i2)2VmOE%~AJk(jJQ= z_PFjd?L7(k9&8fC9uH|udn;gX40N>DU&qluzDK~cHv~c>^b*A01n^9I+YJ8(fGqx1 zBY|me0R+yU62#tD08D%D8U9@Xve^40(wp|a3*inihJUg53G}8t9$(*#c$Sx^5X2te znQPiR0YNXnz;f;V(o^0B*qe%Y+T*DQvDXM-+GF{Dig*d)-`Bxony8NGhP?-XX>Tw# zvG;c#|2~C*R-J}_Vvp|)Htpq%ROO((AU3gA0$}>L8tJ-dNC&aU^EIZu7T9Y6hxUeH zV;uX-Vi+^+4M)V&&`S_|3qdmNWsg$#j?*4?702H9K{D+ffE*HI_!oPRLvPx92KLZp zZ2wS|j=e5V{qdc?Q!ZlfQBVCHg1usG574pqPe^b2SB;(VV*VZW`1gCmKc2>+@2tP` z9(#*nPtLO;+9~g+9(z15)P(piW8*roAyrTy89bXqlrBlGwrp(9)=Dlh`s;RX`(vjY_4lh<|_8b z9*?~pP!7>)_$T&ufoJ-ceS>R{$5`UuagV)cVK46@_I}~9muuMLDL%2c78q1#A3Fhi za}9fp<5q$G%zp{vISCm-;>H4ix>TabWBp1H-dd2%d;Yo3VPN|*2=4oOLwsNdDpaLz4~` zv>%Esn~M7etv&5e;~x3alzWe|ug@1h6dj#gr<7qqR4ye(15&r0cOv~48 z=yIXMgIJ@-V9U?6?~LbthUxd+?Zy3ygZd`-nfLc^Ok^KOu6~xe;tuNUXu|=?vEPlE z*4i867W1n+w7?SmK<6GRUwubr?jLv$@v4;_{#~ye?F{;#dxg&{EU=EctkYBQ^uUeQ zVMjAC)#O-1?bTn*b`sC|HOKLcLA>DrJ@9qEKh?drGCyVBv&TF2n&Wwij04$+c#oXf za#IdG-QLr3qrn#-1SMP@(1#L58Cy`rn^KYz^v1H&A>yB#vvX%Rd&9*kg z0@Y3~33cz5_a54!mV)&SvAXK_rzbb>vg+XTbJm`g?5LBj?~sEF+D)%}+7HFeUes^w zK-^8cIr?gJTisEo49%#czUjX14bfxKjDs16G7e`PSzxu-iv6DTzSAmYY3=^n4<=;X zKFPUrk9umCPv}Xx7DbzJyQy{C6|FbDW7v(>B&YUV)R;=Y=k|vGkG0ruT*8`xy8gYD z9h3X!mKo0*6t(oUG{o2sW<-;lKeF1QI~;G!dvhD2ZP6q9c3g0OZhEh3+&_I^!TP$` z`%`^=MJ-3r($87r+xNEbSzi|)aBDI!&&N7(bLeSNb-E+fh`X2FJ69XxJuS)2UUu`o z{8Ud%zA={M)o-cKxRpKZzr&q=2@cvi@IF5*d5qA{;@X(Ug(~#3-=!fEj~*G1DL@Cm zC%(TO@6NIPJ@EtV_!*KM;}h-O?2&6dvg^+PkG(7G^!pvYl8<=g-5zDD%L6RFqf!FbHoJ5@ zb(C}U;^<>w-j_1O!*|Q3_?wwf2d3xw2nm$6Ia@{fPEUS&Jo0*--$URI!P$t2Q9n%o zEssB3%QJBOGz4cGrg-=~eqrFbnjz>v=J5*c{kt8jekgz0U&jpryXI2=PeKuHy9|U6Iw*ZHD;tF9Cwjc|KKrEc?z(IY0LM-|nz#%po z!jss7dNLsv&K^TgEczFK<({2=z;e&dVFMon4wm8vfmqUh2wcbxgD@Ohh(8F|Vw3xN z#u(VHXU$>pf@~-RVzF5b92!BbI(`p+)y2Z$I3;aOEcyk&h1z~Lu-p@5_dTA}LKuoo z^zWCXLhVBvaF7St2*kqQ0vyW455i7tK~5M5 z#KK{J2I z+ij=ycH2!<9AZhE1stFPVGy?9tv0l=Z~{<;H~=8nHZ^851aGs|b{`f#&4u(N5hZ7m z;t&gmW4GLg#byieBo>0*=Q(I0M6dS*Q)i1Dh zkvGtak;`9!R;&wNJ}Zgw3f4?b5M$dg1#_jZP%F*%xdtm*3|S_{Lzi zDE5kZv+qrR)u`m+^r#D~@lU_NY?ofQNZRX8(*#~pzd#{=T;@%sq%c})PcF@Khu{V4 z%hiz`k1NrVHtjX1>_wheor*j5_2^5FCKtV2{b#)*)N0R6zaBjmgEy~nNsy&2mqo-J z{~7eOq6GYAXv9y!czLxB%jNO@N@f$)aXjZ+49w}4%U;HDei;VAwD+LaVy_+w)7}xoUVj}&`+R4lX>U7pTr)`!d#gPDorJv> zkm%n4Y~tTY7&Gnt9&wzzC5SzKV$t+(2G;4kc1?R+vWvYIBrxs$4#GoX4F6*9F91w? z2T-`ph^IZAl6UMa0m-z-`vuItAolJ7&$KrcMsC*jt~Tu50BqXhw<36)C_(IT?O@v5 z4124=qkml1Gmh95DTR2kE#Lks$sh08IZHU~dda z^v}E=&F{RM_W12vu2Ch3y&!m|y```>6(ri@@||%kFTV?6+KVHCYf=ef?>{{L9e_P) zU-No&3<+tE`y#^;*qf`M{mVFRY$yIpC^n8ysgt@~TqxvZz1ddQllV9P?BCYMhl1 zX>zrkb#{@uwv)fVsAX3I=Xvp-oEva;=Z989G~YP)?CVaGPY;StHsZtO-PWpM%O3Z2 zFPrARL1Nd0r1gpQ*AsYc;fQm-+ePM???}t5)jchb!QbDkMxTN8o>p8z(Qj%JuU}}} zR{dsmzb9*bFFNmQQvMgT^f=z;but~VEqTv}-_nBf-z|IE@h*q;18Q$cxmSQXwvDlN zY->y%Pfcpw-I}*<_qzHv^Sa3vTsaXhq{iy^rF$KSPK_3{^Nj>%IeKfy`lKX$50qFr zme^RE#M^$_Ym94-BDMc!W)~M zDliWyDHYzTBa!yM-y`?8 zjv@UxhofYDXbY{9d7P?(k|&FZ_;mXNYKijukRQ$fjYdtK+T_XTU7(LZ=sQo20a%F+`RmU=kn+t123CN55IeD67fiuYTm zj0$0VgSO8y@jAj|m`Eis{&kNWl1ThBe!Pw!1I*`PxdxTM_`mna9XdbGqrC3$H%9r$ z|IFk6E-eqW`Bz%ap7>eNGjQ$3>jE2WN&V2?Or3wD9Y5H(=BNBW>+x@>_J_w4LvYui z`OGHmP0{toHsyK#7xB+<54IubZwox-dCQJfKTOZ}L`$H|wW9>e>(lIC<2--50C9XC zcbupF_{}#4o=O^m{;G=M-X zcE$jQcu;}B`9sd(6ALF!eH1?k#G<#$7_-%B=RY})%DH{pPc{ew>rKw*+kV#A>a=#b zte>BA-o6^<#7|=Jll@Ar9T1D2V?`k|L|~tnbL_;zVYED390CsH;s=3E61c&J_C6=y zF81at=hY|wKla`|E~={gAK!;zhKo0J0Cg}O86`v@6>nJdl!K|yW2WoC+(%zAvvDXpIJ10-lMe;VT>6&YA^5Fk!MiN`URg3FQ&9Q&d&`oV@+7zCB2PXOe==i=%i!jzP~L0i3%X6(+6hxPT^ViQZS34?kFi_Hd8*TG z%-+6P`8Eb-WKZ$7e|k$tovFn6y{Sd|Ha2hH_N?u#xH)-cHj-usEw5ud^@%;Zsl`~X zluGUK6O1xY& zpH*T!Uf#Tp2|X+M6N=tJgw;=)dTn^5=SL?Z0KFc)vzS=#Hz<+KL^a?se4x-Pt|Jce zhr-~Byzhb59=(1WvbRfTZ>h!}HHERgQ~<5L0SNQ`kK)Tm67(oeA`YUhu(uSy^ zxjUTI+N(f#2OLbC-@BlvwbvVs%#=3S)3!I4K}l<`7UA)148Lq|A@sEN3SguQ!pWYt zz4>`W(Av9#aC$d0u|3)!SZnVU*yHP=ZEvQs(%K6IqrU!SlWcDkIIX>X8hdE!l*8!y z(%2`hy$)dLn}Uh$rRmD=v?jmJp-gF!y`}(Kdyj)jWn=hddqL3C`bXc%d_Bz2V|%o> zht^&tn6?er>kqls-Wb^9>!EFLegko}_D+GB)_^^a>O-O$wh;Cn1E%Y%ZEvRe?OJ=Z zhEhZR{R2u`|EQ9%f7mxF4drzO%M>W2eCvt$M*(rc)F{R7z3wy)E3mx%I9#P;^VQO*;|ufkpd zWE4)il#dV`j*RKqxw$zR@s9YJnbYpNZTouH-rah1lUw9(KObZN{YrY>kq)(>bwTQ8 zQ)2T%ySFX3%56++&fJ26oJVa@&0E+y6t=KME^A@4wl~}2yEeDQCN;OkJlNb8ozdJD z^=NaNy%AI5Ze$l1C9_HR`&MEH*LxMb?=NmRrgZT#XJdftPj6%3wMqv(=nmB9E-!Sa` z>4tM}%?;ii8PHWPxj9YNLu2#&{7(U zwf~P?52X3En1ho7bA!gYMtIlD9nyRRR_Wyy`Ef3a7n0Me>BX zg=eK(B(z+I@x29!o?}k&PMPPSa`8^N=UBPuyTr2!A!$yrVTmnf=XG1`(d)MO3)kCJ zzvFK-CSld^P|0l+#$8Cwy)Y2ZD39wczuFb%V!QOmXv0%R;Sk3}o21}?iL2VY>oTI; zme!#DD7oA@GIiq7iIXRJ;9uX==#XW`wzaeO&8>TUzu5pU_sCviw*k+}cj4gy;aPP+ z@iMJkY%cd4E*Bk_c+!@L%}YF?ABu#-PSJ6(E#?TkJP$8_x-P2vny{=puGM5gUMk)t z6oru6+h` zaiH99g?UCurv_`K(<kmGEev>WIXfh^Fm#eyI6GA}H^dY+cg7?&H*}VoJ3Ci}j6z>hXwrbB)k*u4xVCdW z+=Yj=dx4*LvmEQ#A1RjHZtM)>#_k^TerlG`^bK*}YV$)b$$iWzd7Kx;?$z!v7uI-p zN@ogJu1aw35FFqA^UuwajVo7X6o#)b^lvH*2e2zcwLusL1PW&jj=cfGnQ9Qu0Y;G- zP;E^3;yl)%S|C*fRGU0s?v*|%$C~@LRO~WI5bl!hE;~~8PMQ0t3wB(Rr)G}$q`XI2VD*sdTRqQ}9W0{dcY!;oP_vUp zH0Ij)*71(PY@0~C+gNkM{d$;KW8D4>=6p4FZYgPOc;UUq&KH83EUY|OxqQ#@J?7#R zY0C<;E2#0>eePm=W5b;_H`*laaJ8x)U)|o65k~!ohA2B$$9LVJu)w6HHHT|fzqjwb zXw>Dz=KSo7bTxDx>AKaQgV(dfl}c;8)0LOjJMAdr)Nosli2O@ztKhb=EWf#>w5db zDa`k#L@3_pzEH%Lw6Q6zg+nUr-3C;rj_7}Kc;%3#!>5;hvgDm|_d`EPCgX&%Ipqm< zqvU?*XUSxmP(E<+hO)cM-9`TX@q1!wd%|03eZ_zssmc9Eq@MAY*1P@fl4M_-Seepy z$%gVi`^;mWlH4Pn66TQs(#b^gDcmm~W6y&lCgitU9qoN!PAe8gDK-%#Z4^1eCXE#v zrLV9vf=ROZ{VF#4eI;y$60y( z6t;l*Vq?H3LO*9wKktwB&e&e+vO6x1l9c+{k@a@AdvByvu9_7lg}X#5;jzt&YIn2ayQp+M1L)2)(<^ zRrx3RCq=j#InZ2>-F9Hv>>nfEyv*0yRVN5n* zU!t>{Q8!WRYEqz;CJZ%Mh>?${Kytv@fC^KxG1HWAF;JSY#B*^cH2e`aR6JN_sO^9_ z-39F=0XxQz$`U4z6bVxTq=f7+=}1|8ZOpztb=~&UE*4RkF~`0RLtnfh6<;s4M&UB{ zC|AFvut!s_pj@#Y@)S`OB78PHp2cDqfs+_<=fZpF>aDQF`C?S ze{NZ*{mDd z+2UWlBc^Ns-lp{Z&)0Wq1io+me7rPx7ydE9b3p9E|26K#jm5Nm=ClZ5o*yCH5m~}r z+9=S0actPZ4Q~$68WVw6}bX03b0 zSaE8_)QB108t`<`fWX{{(Z!CCAn(lP1mnGu0q;sfY8al$9r4uefv2|}&-YPyK4;?z zK1V3u-;w?aQ%#a*>M>EZ#L(XbjTMNs8L?icZ+&B=Kiz3HWl2k%DK!W^B1V-vQ_tgC z{Dj>%?ThhTH;yXvTnLmtD;ry$RA!6%DBKqPYPc=l)OeK)ukiMPS5;;9|E5=GpE1=j_@N$bQmOAgXzi7D>oRrGt zgl5yMhDt-q@lFTiT+RwY0?)q6RDrx5XER*{t9r!FN~|?hbnx`_$Yc4y;HrO^x6@ zn2Uo0sUB-R?YOB@O)8(T0u|4 zHMrK>VC5}(n;0?!=x#Y1;5ip4B}|zjKEgYs4z=Kf_^jNy_iLndP0&t7xZeI%OA;=O z6!s-Y$|m4$sKVWF26qGQ2;2=5UDA4Z8wPK~;cYm)4R=;ILOK!fv@`7718)bz+lS%p zBk=Zb4R}j6PxjWa9NsR1x6i`cmtf`JxAgXXc>AgB?SGKUZw-3u4j+ot>U*4E{1jh? zxbsu-4M_KW|DW(Aap5U~=R^vg6ZY2yl?`@ztas1ap@F+PH5;+!2>m^4MBFg>NzxHd z60`+0^dyPLRkFgHNR(ZNk8rOfrC#y7+T!O@Mdbipg?oK4(x^YPjhgv_kCjiwY7W??o!)p z=ncYH?~(hn*22AJDBkMhyzhVTB+#dnecZy#s>QK&E3xb|~Iwa9D~*`&HrW@9{K zXG93kjOT=B<`YuFcV7y_U>E8ce53l+AMYV!rhjBWHCmoLkGv)l9+@H;@Gf%NkBEdz ztDtpWej8O76TWfLQ`u<8_Z;477mf?hIegb;%@7G+elB^w{Ey_x&c!$0X2}+dwz_y~ ztNSR_7Kx`o{27bQ`h6SJwKld68*oUW^fbbIKG6GwS`p_h^Y|4a$-R8K@D!zC^#$Lx z*s|iHCDQw59uWA7Uw2Dy)L3(1RZHJDugA3(wT;eyMVqg4ecQ=Hv6~t_mDTSD_A(5+ z8@>qZ%C9Sk>aDyB)p}q3!ai5)*RPxWk9+nnU9|J@i(`gt%iB@=U9Y>odSJosv>PKg zfB*5!HX-Nlymo48+#RosURdq9Q1u6Pt(6;Ty}v?6>Isa^KBeTP55Bv8@~zc#)4EY3 zZM~LUA^8~sgMu4H-PxgI%h0g!h#NO7HyR*+qbZUZ9we? z+3S1X{r6H>M61@gdhH_#QyOwyU?deqGP2j_p5Aw}ElMLPxnCmOXi4FnqdUa_h7xXJ z4r$&9Mw%f~YfD6{JKDBuLox~@vReBk4Ydy$GB7F5-Y+?>V?vfSx?^6aK30*H?GV{B z973bfFS(yqLmQGdBCcz<-W+#UMqXZamYAH8lZ&4zQ@Zv}TbYv=_>gJzfUkG=>wRx- z%uC<><5b5F`ZxL|e`D9zp6M=mzFK*8*!crr9(y+E&5!2ZU)lQD6Yq8TuOBwge8Qcz zX20$4H^PtQTEBZ@*}6V+f{cdWLSE|7_K7PK7N7dIf4?47c2ovbR#Z0O0Ur(=-1Fa; zn{0pOb;G`{FID{T;gs-B-#wOCv-$Ja0|q?R%oIL6@WVxm#yQ3~GSlu$iy6@6rEz;U zR3wfa^+)>^AG#-uD}MH)A?K5`u0Flxv-o$9^!j-0yWLm!JYMug$Ui@yx@X{p4>wM# z>}(!1G`7){UN7HwqUZbn$$Mw`;KW(4?mE@E{eOmkVM!m=>F+D+61sfw{j0^n&PS?t zpN&s^e&ttvpKPAzZW*&ZuJoa{hL_i_+cooL`@hN`?6R*->c;WsnxFrzs1zc;nuA$&&Y6f`gQ$DrO&~Ns2y<3S`d55b7$rG zbFPPaeBF3^lI^=k-1gR++keyafnj%KKmAVe8~w!t`^SHs9r5h(sC~U^??SC8HI+!N_ zop{C(l<;4xSGlJCeku6G%#oQJ;{*Q{{YrlIJ3S+NXSKaMc1xG@DSs?{KKrRhuGj{I zeDq-DuZPx;+K_aupLx$+TX){ux$4Hg&G^T3Y5(uO-W6v0;PnX2nK%H|s4POXgkd+qp-e|Vtv{U_(&G2%ZzPM`Q&&W_7n8z25~ z@!2^q4tl7lxjo{ib4~NMegE0m(A=lf4n8*Pi-85hU-)^RyVx1C_u;R;T_W}EofJOz z6L@`kI7?J_6b@M^4Rg@{oh5M&#>Ho&w`zw9$tNMk>7uU zWAAunX4%4~t)Cj!=*7nKoBt#7%duxp^xfCOKR>O@ldnaOnmT;+~6 zHe>>>i_$ui_#{tj0>G|8Q2mb5xM>~CxYtDMs@m%HLU7JfL zz1s51+aITX*lS|{<=1|Hc-8fBFW)=F(Bntj8xy8IeWZQLgSCIZ+j(-^6Z1wJBQ}L~ zZ`x_#4O+3&ouNEtPG-d{CvtN06_+4k@KpM87dc6K^H85SPB{m_<|ehFI`^x*^d z>h;U>Uisxj)2tEuLVoOAuyp?U%&T7?8WH=*-&ilb?|(wV>K@(QIdA)A*Wc$Aw(Aia za8E|yvAESC8-qeWzjE-o>NN{OGuBw2dSdRU?HZvs_0Q?kANQ73I#(V(@x;=3+5dh& zrE__Cv#ysPse9=-ZpyAR%<^Ph!x6|Frx)b(NB+6#j_kAE)j`v>AC zJa=Gq$p@bgFJ7sQFcPbq=Vn_ob7wjpu};sMq77>h>)wv^H9=nr_{fOB#|U+&*QeX) zEq4Bv2p^t{4{ENM@&_1@nD^vKLkSV0_ zG*(2*Z($ZAkXESv&}&}8h!C<@s|hDQiU$!upZH-KeypFO{4IX`@V^s<7i+?azpUfm z*6`sfwj#cSkwT>3O0`KNq=+A{;c1;pqV+f=tkFZ^1)6Z;m+JU?y=AW0+pP=t(}nx? zzf$yRY?eX_KTgN5)A5x${-BP33_fb@(Ogk2pQsB@*YUG7JdGD3ipC*f#Z$`v8cjIy z+jRU}8a`8w&8Hwy!oI++gcWpo4J9!6>mZtQT$%4E{Oj>iy878j_NRi)qYr}oq47Nm zHPY!fk;8rCz!W~%d%YC?Nj1+jgPH6dU~?)zTNl1S!`IKRvZhs}H@?Etd~1aiULEcY zk;3~Pf(k!br=P;nRej$$B}IRoF1)uUetrL%%lX^s)mQl0I{pEP$X z3}A)ANa(v(OP)U!* z0xG2NP2r=KPc+r%&uPLx#{D%K!8G=h{kyCQr}E@=$Y_T7ztpsr%KB}+V>r`g9(}IR z@51*i^ogIU<7v#JLSf=Z;7Bl>U($a~6Hffw8lIaPl=nkB+5S;YIO)?EQnpWgAGDlk z`AA)Ptk?1P>iBIsezcBH)$n!jWdai8^5iw;6o0MWHQ|-=i;?|*TN9uBy{O}lYxt9} zPakqzULk7E6#MN(Z}r;IusaDQOZI5YutH(tcNHn=cap=aHQ}UxRmXp;EL{VCb`g|)L-&)68bbN%4ZzHl*PpBLujHs+{U(dJIg}2l3Rvq77$4BaT zn~v|G<2&m3C>?*Nj*r&yopgMRj_<7F<1jW%p{DquxuD;uJpE7^dDQDcnAVV7qPadK zJErnyab0OHsQ1yL#^<@2b#nYhVzheiSrCubaO|k^^iHI?m@limqTd{&{tywg4F}Dw zTqJWC-;6p#b17+kdM5JcdyNCcH`noB>3F(Tc+WJ#2{@Q|9;d9cL6K^8=sm%433J>5 z8aZK>rvdX^$nhGSMVKA{pt(5A8)YbCj#~f`&u3h!(ILz_^j;28@2%GetM}Dgz?NX; zok5uOcLPVLa>6Wcj56XmlCLBWp$TcUiJ^YtX;5vrUp%hv((KBe0U->JlX4LGiof~opiI{PrkrK%R8 z$_cZa?r}@3qEDFRba^6FIboJlv0CDA0ug386=j4fC(QCOz?OKNK!jON_iuzMC(QC_ zV7^}nv%DwCD{ul4W_cno?}@q)I7FSxxfR&F0Vfb))~D(iqB2x1;=1Dms>Tu0Lx$ow ze)xVN%yBPj9n2p1{S%xxZe+o#xQIQj7 zIXz25)K;nGz;UY0l_XbjEPQ60ggNdY;E-e}g3?GwwNIFJGD#;%(V;pPlA>U`RTxtq zW9^E(8{t$1Q+{IyD43FA9|*JkT;P!Yiq0(j#Hn$q9N5ldga;`)3-H5s2(z7+fqB2# zwuFb^1R_7<6rUS>SI#Yppzu8ifKY$ZR&e!uk%yCCR z#P<|omeYM_8L8-N@46WM4{Y9s6KFjS zmcI>bc^D@UVU||{N2qebEI$a$^_DQpPXqIwwC6}?6HXw)tn(P^cHBf+EFK5uXB}bI zq4yfs4Zm*^8k0JdW zC0)WSA5Z$KoG{DNfw@i+X8B5zZ&d6MX89K2kZFp18|kQZj4<{}h6};aF`&)dN^-qvot*eAteik@(lA?bJ zIApqle;_*N*%Y%WrjuB>gQ_{~?d?3v7 z7NoDr3A4NnFz;7v1&*7o#HDr+uG@rJKMI)BCCu^|(pT*hW_dj6t8&6D?+wiR2Hyu9 zH(5y+Q+>Sq8>a$W<|=Z+9Cr|KgeoV@@?pSShJ;x@p5z-8JA_$YL2~uJCd~4efi3eC zeZnk%1vo;L6K45qq)#tf5Mh?TLHeqkFv}}}LmpT3_W<*KO_+7|0rP!LnC1I{L;j}3 zJqXPAHDT5{49xd6VU|-{k>v>`E@76RBz;v*nB}K|`MxI1@+-iWzbkeKv-~P>geoV@ z^4@{4Q=#Y+W_b#*gNocksQx5I$n0HRFY826OysMqxyoj;ag}m(C$#Rrir4R3BVH@s0Suove zOIi9ndpcGR{}XGDd@*ZIex8tbbfzu0m2BtC$jW{!oA{d-*ikg{v4~3EteJVFG$cMR ze>QZpb2H*;L7#YDFT?AMWA^-6a^ZSY@CJE{9gB%Ova$ZpoEiDqWbIZLz>za+>Ma%M z8mJ1$mt$(iZ25Xmr-jyUWe`iPHcc@m8R{0nL{VDQh>)C-vD@Rn17l ze%GEX22jOFy1SN1&@$b;j3X~U0i0aDOr~Y;V8LUKiL)gJWcmnyT5}NS(dz zNbFlShF`WfOlPksPKZi`lRdl=y!Ni@?9q2-9m1K|-j6zaDe*$2Ly7D)!omL0|1jF} zy99gG_rSz(F!U%+q8hLX_KpLSy(T!=UOSyV6P)+;=lk+&(b;)??*^T{+%8JHAo)kl-t6B*7}MGthQio}a3;?0SSV@p8;W*E`uB+JnQ^c^di`td zU4=dBdtqXG1rTWM6~NwQ=#f2Y`eu7&YJNGM34zFpmnbbF8zK;HA#-Rmg4(Cs zIPL%-%=YF&Z#{S>3M0B-rxzZsj5$$46&r;6sp)o81MY)f7AxVG?9s7LXRiW!>5wy# z4$*lvznl-hmi6yn(xdzN1)aSX&|69dRAPHqb$S)hYpDEaog0e7<#Om2diZ3kr{~wI zVS8O*NNcY<^yvA-MAw(7Pl10yO|(FP12yn> zeYz2vKn+Y$u{Yf|%5w-}nb>p`IBmML_)fZ_Qcv%SPA?sL4PCb_I=#!c(0fNx{mQw?ppQwI?P$5Z!(qo*^BT^ptmSG}d6F zb$BWRH0$tac1iA8)D1JJjj8djo!;4$+lq#cDy&>QBq^0vL%}>pKi?Yb!!+vxNL9X> z&9rj5E0tz?M;2?PyxNacrK~?5Q-oQ&eydOhUlw2vrLi&~(xt3U&zkjTdGCaO=HjRu z=SMqc9Th`0d-qa`F-3jtytlF~-d`BYY{8pM8-rgn-E9XB+$3!1rgjH~O5|CTcZQK6 zH6(9j>L_pB5atOitSbpPaPb|&njGPCKI z8y{h2_G?0Vx6p1jT@f~cH6!4u%hA&{4DkiN9Y`>KLq^;aeR*s)`-& zK5vv_PfF{D%6ksbdjIBQF5wP1-OO?NOA*xHf%OHF`a9B(3G*-ELi(cjgjpZO9?3sq zi^jb1>^nv5XPmR4x)t|nuKkYEn9?p2+;dG5YR6ex&%iymnC6+!O~u(6Rcdma9xWN{ z!N{LQxQ`W!zGcl#Z(_FpHnCBhz?G;op;V%R14wuDO2_G1VGauRs~U)1cLRcqeM=IG zUQBePr%9uW5=`4LN6dxXn=tc^Rt+FKM}-k9`e1$=^ea|GuCPVFWpaoflA$Bg#;(gr zsliVT!j1*LS^m-)Pibl57MBAX)sPm&Bu&Zg>{uG$KJUU#*}?FNu9qS)VvgHeCSMJv zJ$$LAO?b4pwqnng>blBdr$(F{ePZ14iAOUJPd+s5;EV$?MFzVoAgSboG@5PP6Z;8o zFPVxxh8^h-Nzr3+hmT(2xQsN{6K`ApkVIu?4)*smH@<=m!V7dndQ%9_kx_CCkib1f+`q84wJ9m2Gvkvj>pZennc^2y{)YmiEQv$HNxc#h))>Y81WbiDf*<=izwI5#Hf^&DW-uxjLjT(Xk7Bc zJ06Z4|MYmj2|o(QH)OEiDe(FBk^u%%-gQcX@eDPQyR@L&Z7Z6h- zRiR!5P|CL0ZKz2n)>L4Qyg%j_2MbzfVUsZWyMkT*j*#xsR89E|((Rz__i%goqdZZf zss~keD~TzJo?xD9l%%uUi`;Wuc=i>ZiA^g!lRLbys>>L8FLbrE+{P=CtpN2xQ$|Ut zk*-2}1$OS>tAoXZDx***d@JtY*=V8_8A#Ksg*(A)wEn8>B0>9eEGS4VuU>fHLfVO9 zNAZGTEgpz3F7vMG*3dc@*GlJ>{7{lwnq0JdQMX0gih35m<*g&q8S-IV@zHvcQ+R85 zJvei(h{9bw4s~^$&-<#I*Qc$AA6?u~7(dHy_TJ_7{^qa}Z_*lh}Eg#o?bl}579~^!E#Cxaqo~^m??$=c_K94C{sJ_#= z)Od}Ig`&jn*37<@s$3}!e0S*QyGrX_Lwey8)!ewT(9hrY&Z5Sbi@OxFsqxuDt8_$G zOO{))Z2qUaF%a`C0mBE^?imbx0FwEUJeS{Bqicv*0ByJP9gVqpk}B29eFFeg>| z<_*&`%9YZhfm!fTuHD1q)7GUm9eaJ?j6tUc4I8|BaQu*ULz)h~HeovIR3fI^rr1;a z4;VOT@Q|Uy9>7f4enb0Ma15;7MElnX|;8n)5j|6&xxg3G?>nNC#LFlj*W}I zt4r5z3Eg}2?B)9wrGG)Rb9Jcwg8uK3|9@#l`kuwblJy_WlpY@Xa>of^ z8>B-UE}wqz>q(h`mU&MH^c~x`UF`$^_3{Tk)h~8PFaEU4^7ylDzP|LqsxKR5%-#0M zrsUGi1NuGvTh%MiJShGb&i|R_%N~%S-Wsmd@-z?yILND`@MAQ5{rCa0evCI9_k|Y| z2-1ZIiT-MM1%Ca|@>5^Gk*rVuGAg9-zJHYzp8waUmLu|a4XdmCY8^jY$EWM~$8>zT zhOh5m6FI%!-tZd$Fye~~9zS^w^Erl=A>F?0-wL1Q?j=!qm zeQA-fx$OT={^wEUQ@r|0_y8ThTBkoz7d}JBpV09Ob^LZ6U#;WUYtjo;@lxpcp(Tv! z1C2#hNbz@!j+g)Wl@*lm`*h(WbUd}uY3)tc@r!jljhWNx(->Ih>zB9U?+6Z7{r8oZ z67H)nW?g*?lk;2bjj!+>bbP6fkJs^obbKEj@AD^2mwrpZ^W&8JxwS65wd|iS&kA4Q zwXfHY(8a$)@V%3TIDXjM#%GI+w3F?3@!C`PNFDFHU-j|Z>+IR&@wgP7-Y1giDBDjb zflM};Kj*!kHgQVD^zM-`;*RIDrOSN0ps_1N^zM>GoVZkvj}_0?<731d_4sIELVYG` zg@fiNQT<*nOX#HdvsJ^>d?WHj@jpuB*R$72v{CIT{&tq_9nj>5?9&);g>2$Da0f8- z4yOE3IE~#_$R;|0?+k{+`>N?F;T=VNK1#>mspF${d?y_rqvJd4_*fkur{m*w{9QV} zs~Di>ttm1<^DC&`or%h{lgi}dm*!V&(S={~V{PRce4`7eZxtr8*GMg|SYVouLF?W# zQ8+(K=o-`BTN-onHGV^tNsbbPudLlk~q$J4i*c@9n> z!aOd4?g#TclGYy=PIZ;%fy4lZpnei{$68J%qn04fI)w~mC`2vkTVV18ac`#0( z^*C5g{_xxny6P{!=TVu)f@`&8FBExI3g9);{D6%2^Xv7CI1RpniPIgfKQ7UX#vqk(xY#5j`oRP4y}1n~bW(KL#y;wLqD zA?f#4be0p2R`43&xVsg+PJ_1tb6yCuZ)AdfCd_iW?y=|tA{ve(?p_(n-#0w(g6>(i zNtok?0>|F3=u;JsO;j*d$JitV%l8o_0;1{?qRQnu*-sXWRFYGr1Et~MIzX7y8V}4i zCla>f1e%P4uPI^Hr~1jyf5I#;0*+ICApgz%aRL!$9V%k;-$|?JPPX&%0MN*|bg6DNmUU;l6Vb-U7@mO2JEFTSQF2M;z znB`RW;z$6Z{9330K!jO`>S2T`C(QC`z&vJ`Fw19<{#cwqgjqftnCFKOW;tb>=Z6qx zIn{HX2coU>Pm=z_IDrVWK2oyqxq^IboJB2j;Qz zD}gQPIDrVW4%O#~beuriy1gDemp@_F-%fJ%+lDa9cWdN?S$>G*lxYxQmR|$rakPY4 zejPX>11At+mitT4r;7|C%<@3s2vts)<@Da+dyO#5Ex@r3#ZCv(p@IYvW*wSu#yZ_e zN6jx`))@rM{u5^TFktqdFw1Fv8v9R}<$ zn(xQ{7ZA=;^0)w)=LryI{bFFACqS6xrNHJzN?gJ$uK*62sK~dH&SO5zI@A`$&nUty z-whl~HzlZ=bQb$C>+FY|@9{&VKU&c_3~ZU=!>oTC@(5KKp&uaH{zkvnOTD$)7q216FBF@vYpul@2+1t1$1VWy*-&xHqC2@@GS^ z5nns{S{`71s~jUk7=C@L(CmB~WjrN+YM%b;u;M$bUJwqp zmjtY}NAI}`HiloeN4{w7t%tp}kdZwM)%Dt={};9PVqt*dGO;};l(hEl4OjLHBzsM8 zuz&4!ToFWdV=jgzQ`<)Zy04Vdhiaj?C%h@iE1682WAap;HbwFc1o zR|$KS2q$~EG+ujyboOTBhH8UwCbnnS*()&eF zqk2mI!Bwxlxrm_6Zx>YdhWvX}=U*b)z4-p6CNM6)XMnZ#hTOv5ay3pOeu>6t?A-yL z?Og!Y+M5b{SrkDf&hHuU+WgLfy8Z7M5%#DJn~7l_1X};Dz@9(q7WrpW!{~W6TD{*m-X%ONLLg_Nw1{Z^IKtgz4s+0< z$CyMEM#puXz4&0|x{(eM+j~W)HvoF%4-@%Ll&jNA)9JCjRXV+NogUi@RrA65&4nHw zy6La$J#w;Fos-c)_%(jCUgUKcg&D)h2+dK4an1nHM) zJUx^(#9_4nNO~3rkzPaNw0psxcAWNAtMXo>`a;C^hQS!;mE?p)XR1H= z48>o!E<9NKcH^{rcU8Ab{R`u?hodf2dfjnQi`gCEc>G^X5q326cl!(fRS5gC08d+^ zzdy;Cw^^45Dr59$gq~D|-82Gu#M^>`Ud6LAc1^Y>^y-y4f7cZ2BWBa+Vt4U{RCBL(T2-r>@im58>_So75o2t7V0R0nx+96Yx9EF@+EED2M(7-b+Utc5N9YQK zZbs0W!i z(BTMOflwDhHzV|Qgkn!s?6EOn$=LFcBS;sa=Mnmod&@xHsRlc?VCU7cz>|iW6$sso zP~^V``IqC;ZbgWDlCPKc8qzhB?7pk!C@_kfN1#qTkhyy*#lmS97It3>h` zOQf^Uz`Lz=ehI}nxJE{lcq7>^jV5+A!mf81CvRInE$HUG-!g|B8j?J8$I$i}bOl>K zT70VFUxax6-MrKaxG<4#+>+4ReJ^S3>@9@;_lM?nGl00^|l#ucU z_TV&0)z}U1XY9WjASI)gxsMs8YU5{R?uY!PWb9g$yymSn+uip)pOEsnbi<`+t%)Q&Xdvg-amxFAl~P-z8M$uTx*cn4pY!b93vVgiOGx(}#0-$Cv1`{c zjNJE^s{L!0xYH=Vls4tJrmPxy?6YS38qXf5NU;A4>D7sZJr>D*lyc|!j=Zg(KX)3H zfPL|ka+(!#K0SM{3tyVvd>*BIc_{VKlw(gO&{4`W?V(xiPJKRn&6+iynja-j*;898 z%*R$p>x`c7&I|V_%4NbMuM6`i%4b6E7GXZJQd(#7{AUYBw>J@n%@}XGc_8kS65-tP zo`_ku9p$j|Il~Jz#{P*1o;*12Q0C#7qw&YPo#=V8&#B#& zYpSdFe!uQqsFZqXL|VO!IOs^9g;e9=g=UG0`2;! z>GR0XqCOq;$*^N1j*R|z+(#2X%=}>T`_tZ=vG=~}K9xH$$~wLXBjD@V+**&@RXQu9 z*EDOwuDdhm_nK~f#Bczkl=p?=+1vs5VRvD8F9rJ;r3vT$Ea9xo7tRlg@Qk5-vNmA{ ztk(cOa&cd@hU#c)vH$IC!lCV>eG2x<3O89E2 z6l1eHV0WbM0x36BER$gz)8JXqnTF@=3wY znz&uzG!DEMzLN0F_l_6m z@#F5svs(7TzrW@tO~fwzy36p3FKgN%&mn?^cFvf2MVfH0ND=0h9mMDr%gQ{(?~8cX8S^8f1=B{{L&*A&$dyEX{yh~@y`Lweae8PVNv=5{=WS}cW zI*l1U>hB+E4Qgq2bt+7WayhM45!ih!0=thzVE3^I>^^3}?qe2bOp*n=k6Ez$SZf2y z2D^{7#_nUSvHMu7yHTnbdp$J+f8DxRsp-kuagJ3e!?LZ>Gw0-^A+r;Y$EJ_G{|DkP zSG@`4E0#hNam>4wnm*e9&;L)CK+=r)*1S2H({u9ja%Rr3=Fha|PtCRtw5O$7v3N!{ z7AeWHX3m#|{btU{pPiFACx7N_>tr0W=49sPI5P4nUPhiZBRAJdQna>PXHK?e%uuWh zq_sw7War1F%+8pMklEG|sr?X|g#$_Fqd|Fk_KbY%^o*=*>%5%&sX6chE;x`H7CO6G zQ!KPXWsnz3xtW)Z?9lJ*oO~36>~MB&HWsg$IU~n`wc{fRc$`0T?i;87x&HgUOA{wdJ3q4co#=NCwSHrL**BK0 zJ-^$(XkL@OCz8fK@!&%P%I0-Aeg7NB2lblP?~N;Atv0lI_o{-3S}{~xip z@wdx=|MA*gryl5)TXEllyje-<6P|zIfrs8%d?WUb!ShF5idnUM(Z{nph3)(C<6ggf zJj>X0-O8i=cfI@k=+j;6ChqLmBr*B)ovurlt_>di`o*sgrZlzgy!dI*@xm8s&37d? z9Wj4+@;le&{sm+v4G9jtiXwAN}BEN6Fo1CziHt`sdZhI|*GJ{dxqo4c#g(Poo^^b* zVP?U19n+4rTAS2vOita1nm6v>IP-__H>*AtnY-WqBd+G{)5}_S|Ko)<#XnzIec;&G zcW*qKH7{XF-%Y=M;0pcvnFag*9-;ukabMK3jdYB!e9%13SYL};!8A0|S;6J~xe1%hZjPDzA|UJ9%7EyX}JKD8H0 z7&T1!q4rpXLS%j+vuFjQ@T)rhvWAaBcn9!k!u8rCpA=H!Q@gsBr*VYL_X8$hsJ)H+ z`OOpy>ZZ(bQ&kfL_YGEX~Hxno$D^;iN=(F zttyww;eqma2@>^|!-J7WACZlxR5k_W*aFrvRG!8^wm_+@(nKKrF*^Q)s!u-@PU9(= z6d&=09Ir@P;D_5nBY{~?nB}C&W4cWm9m1?LTO%jTazO7I`&51*_|Ji8JPsazoems_ z|0IZ};oz~-i-CFFY{G2w4boA^G9MsJ9c`e)ICvfYlfWF8Fvq2O$YZOcNk1*vLLe6XH6K4GsU<>*di3qcN0C0pVC(QC8z?POcfe5pFIBqLZEo(~+M z$_calF<>5hUI1+Fi4&**2kX2BZ0?Q|h%n1*fz9eemN3hyuJT?3hk-+=Lk)Bshs8?B z*Vjw0^+RIQ}!4J!SCV8YHzlNU>n}TVK zo~45ivrT%pM5uDYEH?qO4}@7xecExVO?m9z-HJ`^*uAju))pSN6<>eJMYVT@2WVk2 zN?E}>@%V$-9&H5(xtR0jPmg|;%n_i!T^2aFtNQ|kZJ8*fxWd*B75|C!1l6q_GlkQ z`sQY0I7w%3DF%+DL5b{@s7^>duOY2_KHx?7aCm_)JcMkR*gN*DoRl~^c!#K3| zXuV_lMq^@oqao1R8;|$v%LpWUbe-A1c*rQa`q~%g&|=ydJQIb{u}}SF`^`{jiI6d| z3wHq!X1xcXN7s#s^=J$Z;TCGZROo5zANfbuxgQR#y~m(O|5GrrJ?e+o>P^P?Swnj3 zRJ|^$fixtV#m3YyvNIniwoSorXq{8_NKR`TqKeESOhkGOjR`0ry&*SdLZyK80`WYc zJks?b;4u?J#_!^t$7q zF##RHDPsa+idI4LWdYv9#uRU>KYE#)(CRDoS5Wh{dB{a>PSB-wii)fv!SDZlM=i6@t=gv z`dU-!ComhAiN2cEY^bcO>~IqxI72uWaO7)yU`f zuv%JGZd~Q;lG>8w(%nUU7VRjFFODhltwTuV?B7()53ZH7V@i_*D(xO}X-DtD)!)>Z z%IAcxtdF`zVD%`kcPRZj7kjs3Ag$@Q*dmv;v02;S z5mO{pai5m&PTLy9c{vyCy9VZUR|jd z8f?q~0iqWk_U6Dq#4($!0k8IV2TD?Kxi4+K1@=VlHEV-jvo`28YlB|1HuI4q_8>5j ztg)_QL*s+$XE5qi!#ZB+dS70AIj^7Vn^$V8zxI-^mo9Gj%-s216T0;9b=N6VN1{7f zvuDpnXMy?g2DyPB3JQK z3rk8DEiNlxvUJ(g?&T|1u3G)fnrGKOx9)jd5Wy=x4S#UN$jYkfclXrP?j4emm6MHr zA$0ZhM-NXf_4817j@-MGn~|4C%$;}N-N!m`vUMP`Fef()qRH8_t@CHjvCf>4J0GWP zYktlwxxb0xO`ekv=VQ@jH6zb~CE90L=gHABv#mM#@gG~tx@VQAfBLuLf4x2OyC)UTB>qmRTTZ)b9$0Uu#rv2+v)iA5fTV(xwRYv>wQu+AGv!$p4PjT@X zD95Mp*EIUwz!TB`BecJ?y&m7jJLhAz9Davv{}4rxsinN$4K;09agcxM_$5;G+sgV^ z6%o!Y#dF9H{Xf$Z2kDbPzP9|9Vu6}IeHTj@F;3w$CsU!8g2qQr2NQ~e<7aBZw<5d{ zVf5sq@Oi2|upm8e(S=9o_%=HJ4jtcC$G6k*RvjNHE+~%3|D#b~K&aPu<$nQcM`NNg zh|z^#Q0pg^IrSBUYVt?=y#FuRAfB!(5&i!~eF?sMMF~$*?U%~oK_X9=-n*KAV94IX zy71|`@Uf~ty=8li#7nyHWh#G84sRl8E+^4?9JId8w>tanRDJrtvjt|H?7%NkCJx$< znEWQ1jCi!(&17AAJ9PHC>iBIsp32FbNEVec<911^Z{{RfEZ04j)3e2#tjGzooFv@m z5e#fjA&JsH!8-UiUYPB&7`BoIr$GelIY`CD+YrCm>Ey+LDgiAJc&_HJE^U;$Tcg!+9ahX^kPdYLhU_(}8*IngYU9V4zYQtWTKrp9W_A zwWKo$ClF!Q*#yiwTY%%#HFov@vp!+g->=a>N;;~agjwg5M&~Rrudze!#+q>gh2sdJ z$_Q$MBZMY7fvBwFC=f(-CRUZp*Ov+jq`khW;MoVl>;t(KOAlwzV>nocFzXZmvraMT zJctvBFzb{9$EkMY`bjS!5MkCKpUneEs`$@x*?+Z9g?tX7jDp7DV1Ed+ekO3Ns-H_b z>PwX{>*Q;67L(3!oIr$GClc7K`bn7OR6n`jUv0@3BM zkYNyE*0BIbsB*$Aw*s3-;RLecU^)52&nUty?@4m?8AX`ovTx)pNb4IFfyE|^P#39|h+9vk9~OG_ZLzPN35` zSbhEXkyGX(MoRZf`Y!-3gP!Ym(0@-d1X!Yt1M zX8&zib~%pbo_qV}yp#InKCxM7j^N(U`XSxAuw38gs9l*tnV|pQ?Iu-IzimgUtXF>} zia%RY!k05;Wr<8>6$i3HO)u(t6RMQ^2LIYB6h6~xw<;H!*SJpZHLuDW=xhD6e$~IQ z$b`=&b*+h;T>8svQ20#gmzU5~ASFlgC8^g!CH~u;xw0+YniJmg)XBZ&dAsgk*{IwB zd~jQv0;GpCwtTB$$h@iDc-v&K#FnR3(Xzi_ry)-D1JtGdbNB(Q= z(R(-$2NT;P9j(1fu-6JQvPb_8vAuhssI|8VVWl{j*j`U4Y3=zpRp#)MJ^I&%?Ttj{ zwf5q{^k!rDWqUMNSZnWP*dtqX&@eW(w+Iom_UM1ya|mZ*d&K}0Cs7SJ2z%77K=$Zg zDYkb2GOayY6Jfm?hkn@Jdr;EaJJ(EzN`#X=K(9US_vL!^H4IQWGqJr;0Ij`EA-?O; z9Lnrpf9Prb^Fuk&w-XcFqp=rSdvC+uQYevsW*lsf;%e<}hrLY5nAqM65NPcUfm2-n za7%gZ6#;AQ(b}|hO_RYroYwNg**81t6=5q z-IJ|n&z_3p_Wk<5+@@5q z!Pv7H{l4D5JKK7b9N%TPp~si|)iCcL1zWdG$ET1pZZeZHok79~LlXB)@j^X9P>ch#{ zMQ!N?fxTbS$yTY6N}2Ym;j-Ai@~suilNTqY)i$nMP$0*$|2p#2(b9gK7-YkE+*;PW}7?k~Yhu z4xW)m9bgYN+1{Yy3e7Hnk=Q|vuRNtzXqQq8z5TuzV}gGEQq+E>r@suN8yp2e!fY({ ztHYQHzM6$8w%9)Zhq^a`kD^HX$EzoqBwR8u+@KDG+a!bxx7P%c5Kbe40-`{Ma41LQ z@?=d&CLu^58bI)jc%!RG6kXRNARw}ch>D1cpn~Y?imV)-{GV@CS9f(~I=cJ*-p}X% zKA&{@x$0X_9bMJaSH&1rSWTxa6FBa^SOdi zyRO_he#f=jbGJ_2vc8y6Pcv#>UYZz)XGKZHM!29MttXd8>&Xodb;=AEJjz=0|6W>q z=uvvF{T?HGcw*I1V?z3}j2#p3e2Mxz$=;y@hix3zVfbCc=~;tP^kDRG?+#a=f*lif z(~}cBOGcIMD|PddHS?eNCWLrDqGxV)OhCMQ`Li&8lmoB({pbzdj2R1lYTiDJqCXR! zw23YC%8_p4s%7bmBQZ}EGpZBz6xB%swkKmpPIctzkg+9vDAVY?>T)kiCHs+)xhrSy zs$F}Gsy#WPb;G_m7F>8w4E9D<_HZ_2#{_>#hNrTm*t0icRPD$yHgiupwz7wZGEvu+ zWcQaAdq$OTosz;|nnC5;T{?7$XC>AHgnjIY9TP;EJ$FkT8zFFjF|u@LsqjYaAV zp7b(9-qm+J9r7>BFmhMzR#w}iI5QDPvFAW!YDunzKwt1+Q`a6`J9SlJ)q0k=F4hyQ ze@i-^ZVKLtGB#jKGU(VCM!978dpBo`ng?%PWzch5Mlkle^y)|%8*kOsj-2tUcI*lJ zt~2n=QAG$5=ZuW$N+S*B+d;&=1|=$@T-Q;KFH?DG0RIzYkKWDF3%8`v_X|?W5(9B; z$G}SO2WQ)7g^zEe(dT%h>M@&GghsJt1Akg8$1g-9+74rZ{nXQroUa#%GSO2o`)8FK zRm(EOv9dqIcw^ZFl#-B!?#c1oy^=~(G1A1LmaQ1MBZt;nWIL#Q5$dNXA=;8!W{q(e zb+#l#Gtvm7YFEYxLS7QOFI&hoo@F+yQIGJ#%%Sw{6h%`SF4)Ejv+gWUTZI`r66Zg4 zsxf^@h5GX1g0C0S404>>WJ`4%efMC;sk4cLmA$`@NQ zf9dJ7)i=J#K3(2yOVO4Xw!JiX<5ldp=GECPje8b{E4+sP!Tcvr zMyaiE{w9{TDp;~DWS^<1Im((b1}|z}9gjMpwxBxsXvM`V{C!)pMJ;Eo_-OfW&6{nx zq_psGVHQfazC`rX!Y#%Y>Lpti7i=s|S>mHvn|kPRV@tD4Iyay*is1v-(meD5f7&zq znqIUrt&ug*TK#Z+WMe3u#s%NNN}7+qUJ&-}qt#Av29bTu7VGIpLd5J(xH!L4pMs>X z;?RsoZGba_&C4%_bZpGDo`t06 z)eg_3ScY290^<1ldcmURlyc9EWi-l6=tcLYP@dgZc|@wA%IwZZ*jVqL>CFCa4?i~P ztOLiIL9@Q|>}O!vYh?qL_MvgZ8rhZgh;h!bxBy2iM!?RIb^M9Ip;iR6_GzbjZ1<`h zW-rXCrZy-vU-VC;ws_MhU{A+3u&Frxup-3 zwy^B$BQaFUkyM^1>6~AUVR1pTftB&RFIAjko3qes!WADe-_WoRy$bmP@kGgarK?M` zmfT}u@*YP0OpM>J6}`N;&+?5cP#?L2_72`M(l6@6hx#~SR3FKs(S&L;9_^U2g8E=7 zP&Rf%da4>=Rf}^Z8KNhmDS@yAczkY^=GJFupWmG(Rp=-Q zp8Lz|F}Paj%wNduWOA}Q^Q))jCuF)DXOfURNRh4{I@34Mm<0^ z=frEw(+{`O3we|#K=?fis{>t%xc8Xm2WMfr7>W_o@I za*`$&XtIqb{BP0hxK1WW*zb~}iN8gYk7;s(c?{r-wTP#_CgWbIpypb6T5^B8f3?)? zt-0MkeuQkdhmdcR@br8f@?WUP&i>R^vkTcyFXZi3dLiGV$tN_qt5rVXU!d7>KUR>i zFVSTCTMcbl7R7JVxjf!cnm^tv6D08PZDv*Os>!pp^!EGvB7IZMe}m?4e}`81<2^Su zzb`d;k0#?iZPov{W}mOwpV#D-n!H4l?KSAyvTv2~8c&Wo+y8uCpCK6zJ)epGVvj#U zw)>Zmvo-%cnmkpL?Q7s7{bhxzZhTb@(I}<|AlPNXNmlMGQf4G%|mZ@Iq^F2{B3_Bx3Kc>#BMdm zcZ_KsTA$LHz6(!pj|W1|x6%u_og$Bm6+#Nf>!#s#<9PP?D`brQg1WI@X8H-F@X*_f z&Uh~1>FxPS$XPNu`J+D~Z$THZZD#pUW)Hn}=fq3q{&xP!*7~6s^F4Hz!0F$E`wuYD zaTfvk_0wd#etWPsW_g-&yq+3fPoCaqrPu92Zl7Y=g?y1FkJsc$itLQPH^)2AvJ2U+ zFCp9YDP;S26taDOCge>T-d0VvkDuOJ`TO#C?D<{D9jx?1w)or*J$!aO+KT@&hh(V zZ9Kn3lS7(3P?IyPcLgv8<9YRyR$0Y8u3O`*%=ta9opk33gmWr9pB^-izkytiXAx`e z5$S`bEd1%0rHPMonx=F&e4&;fUA*ChKH8MdcRQH*L5bt&m?r0&_*1!mV|KNfK7-3m z`2AvH`SS}+@ogjsL^vnG^W~pv`QzPlNyyKql}9m)`cM?`m**}RBk;WXt7ben#+uUk z*FIAwk*CM|5|WU9rDiWO%X^68XiD#Itkuf@v?gDu$!E>@|3%nMX+GUxj#tyU9AwSS z_CpNF|A1EBWv2gL?%$g&)9iA6Y4rJ~RJ+&G9)#!inzH`v1j8U^)bsi` z>rkzK)N@ij?#iEGkoDhCNsE3U>mR(tL_N!INTCiTPDkhgOvLd4Mugpef{$ZduGJeL z-oJ(Z5d~kRt*w^#h4-YwE#EJ^FAm zDvv0KHpyS9@Vw6iNI`@u_65M1?{2ggJRsz|0N^El2jbv|hj?EnXvNqepQ%PXNdO??{onLK48AU0E!K}VdDLw(Dw~M+XJkTzs+4OD<9JC< zf>y*Jd5kAX$z09XY4xFl6J^lmGatY~9m;izClK#{oBk1jmt~nke3FTO9r5z{^V!7v z5FpV)+9bakd{1b_J3DgSVVuYLcXKrZFY$Ll|Bldum->Cg%X~ipZyF8}FUxY2_+%86 z=ooEst>GVu_wRw0@$Y9zOnd`N)(_?^$p?t{zbpK~OMe{Way{a6!1otE{8&auCPLNt z-{&mnWm=e%FBE$8Vc$i9A5A;|2R1MLQRi|EV$`i46+i@D`k`CWYabqXBI-w* zF9c2;N4|8y^R`CjMA@|Y262|%Lc3%biC&}4zn`<5mw9~y{YOF%Uh2;f@5>Z=UT+6% zUi#qKONpOKye~`m;2D0o#&HJmZ4eX@c$qev__n4Vywu}6iN2x2e*$>(ow(`5Ck+>R zeA`p%aqcSn0CFC zUgG=<`Y}TPyQ25d03r3Qh?o8W=uJ#q2lI^(Y4L5Lq^ksf3GuRA;AOeS!{1DcYf`?k z!v8k#;{?B$_@wcIFCjkJ)UP96VuF{L8;JK^E&MmZ-^AYoy~!U`^zbx>2>)2{qXeG- zex%?Vg2zEX4GnzUGfaUF9&btwUT%r z0EnKZEy>hx0DnES;+^oMnSy_bcFD5@k7F}=s^GWME(wDH(GJ>@=Wv$)^W7l$7PRxt z6?`1+lI9B@^)LC3;1>veh<3h(fW14(d_>>C$K=4ZhkN>_q1dn!?=Oo}|U*(v~g%8Ixc^>Bq zq3=Vxqzc8SQt~;(ct5 z;89opgElYIUP~&OwiWS7_Xr>K|D<~bkNAD}3H~DR_X{3*C7b@d4?igMSHh=C@W7Y( zf|vPDCtl`-zU@Cm|A@d#A2d(0iHZI!%MM=pJV3m}c?>>>=pPYy>GKTnNe@BG_&I<) z|9qKb>9d7+S(cp&zXv=rAwvE5cX8J7yDUJeq=$vR7x+g7kNWX{X!A0!;qZAx=*Pn6 zW1E*glSn0fW)q)m`Y%-Yj>P*Or+-ALv?V>kS$>Y{|H9@aChFh!q|l@Olh+F#b?$pg z@WA&yE%>`==l{~?B@UWA`L9C15k5z3Uius)mG4=hKL#F+K=d!#B#(0;|52{yzvX4x zb4V}o@lHdsnf5%SeNOmyr(F^5zN63NGe{-*9PrNzAKpJ-5d2Kq`4J!y zco_q)=S^JAmebDvwarT(RJZ>dp$9MZ$VTS-8u2o=9nil>|A_X|CVloRJmCEQq<=)< zCFUvOlg)TwGjM&#>0zGjYa3>pQKr-)j_5{B1$`78|WT zQ3s;>V&TNPU1!diH(z^mjKB1yLRj```tsS<+hV%Gy|jPg`>>+C;_I-v^X8?@TaceW zXYTyGDULT9-Ls&TEb^ijN_&$L#nDu>m~$-^f4>bckBZOET4fetPRYZ|h*)SuS)>~% z%HrMbq5he5yzA;Xw0bvv(iI=9wZfV|5evF28d|P<{>1BVoVZ~2jdLg4j#AB)`r6+X zn)PxYE$J@S{dNsUds!2;`-f@l@>4Np%yujeK8F#=>uF7v8cGK z6PCOFQ%l_i7ug|nEXEzBbbxkoa(r#ry<>%^=Y_9#U2a`; zU92CI$9>T&P*yY-n=l8?-VNEjTlu*5#SSOEu#b{bg0>+e{;Satm~TaqCWq?j1j?X>xr}In|NkP&4SR! zsA+|v@bnb=hV#t46j=hZT(#2bb~!}a?PMRhq6YX2yzWJoPE#xdyYl2p_q>?V-ty&R z!hcne6nd3^_|VZqdZtZGB`!4}X4*gZ|4bZzug!9PB!#gt@s`Nwbcqvw!hRv5^a(s-s|M2;+>(B zy9#mw9+@n>WCB;?!@1Q!+9XN5uH>iUEjeF&;{$l89vNRUB~bBjUKK4qTnAC{8V1Dq zA@J%cc(_)i;^Dg!=a5~Jj1TLRsCYL8#P12%8P4KQzaPfC0-seYJ9&EUJcoicVpTlUh6n#c|Re%46;j-c+JR9#e1c_-5yQI zS>hp9g0T82u0>@_FxpEzoU5vMp$_7GUBu@%ZRmeJX;bm06F^reOp^!!aUB;%y{96|WiL z6_XS2TGJ-+#%uj0g$#!z2>D5NjMiV)5MC7-f!9{SyVb;#>3nqXkgG+=7qn2r>(|BZ zfB2~ZKa}?;0#eJ{i}3zMdPy>$ABjPlkZE{?@DeB?;-f>^!aJjl2OX$mm_LPhN{RPx zZ9I6ot9`t+SMWa3@Gc>|@f=C~lXxF$cv}fCm0S>CB5ks~_h@))2oJwiB}u$h8s3je ze4WTy;w{kdwh-Pe5{&i|FJHrJ*iAfxi}``cLU@;uU6PCs-*HgO`@9lg4|0YL{ka)2YI)n#7xzGQyvF3G;(bYYvi>keNxbzM zUJ~I=mteG)@ja^H{YrSnWJh^%jX>g+Xm~3L57!zbNxVW0uYfvffC>h@-n2=)^GTO;8FP$ACT~PUs~* z{F=dF67m9FN`7j-UFl$x{T}@gHssrg#zo{K@$lWlXm|`i(~q0~_s{}x%+ z#h=~Vr3(FzTM4CFW!0A^Mf#Nd*_fo?|LfS+I$~3#KM|W93rqMPxBh>YU#tIVezHF0 z9%Yf3mEPk&n{V%Vy~pu3tUMa&3mHDT7C~>sN?-F0aBu8!ya7&Yq>#UOThFc?d*$^1 zwg(HW|1S4}b7ZXlZSLa8^bVGFC1k^rm6FE(PxBJvJ;qxa8Xbgj9z^pCACGGwC?xHe z6ZrhW|Je@GPCrTboKj$#q+af6D(3bY7duT!VooygWjeW+=LH2W>FLyxm!ZbRPN!nx zyut;4FxgSY0@^?_U%AgF9qcu8DKpRN6cOf0@HMD_rdsouI?uJjNGlgqhd$(nkLxC= zj{@3MlJ(P+l(5&RM&hL%*GYKS2_SlKzfO<+mpytSO27+EOquzI@PYTf8u-{{i}dBke+`k z>0qy+4W!%gyS1+ViTm(q`U2WilJ$?@sj%0mM&hL%=i$8TnEgk(NjrX**401znD!bo zp-dp0>Z-{ht_0M#&*VR7;<%`B<&qZ344udBwpIv6OaBGq75YVa-T>#*b8U_Nxj^6A|32Cw1K2v z?uU~O=P0uMQGO6&0*#;zbG%gO_K{?Qu7Ea`WdFa6l(5&RM&hMChj@-DGc^6A{c@6V zj!y7sblKHs_ z?Qxz3$`(5|#N6|`BVN`UkA-BM*MM;T0>XI;2 z`5c6K8-)28B(M8mz6HtapO`;Em?uG)4?&psK$zb^n8!evuRxfWK$w3(Nn*#ZlY+&( z0mA$MN)n#0^vo-gd#3eE&Kxw5alU_=#i#Y|WAX4AG;omRBYF5pp8I4Cq@C?% zi`>%|;e1(^ovGyECV37xdX$Z3@*GO)31{r+E4UBzl1JLXgGN|sB@Z9Tb9}{TkjZm= zsYk&Fjp&{{^0MU7>4PmiU1z4T{060u$Q(X=NV-+Kw!*ApOM#@Qe@nsRqRO@vlmxYG zDR^$Gf+rERYdQ5qDow`|YC4{ls?(WJRq#}*0!dJdjwB8Rk~kDR7d;7T+`{0ws0uSl zlsZMplt$4ZtQ6^^lok+zS^Hc-j=bkfH{O-GVAihVMr}^$Wc55FI;F~lXIy$j@8Bg z|IOc9SFllR|J(lZ+#^cXQC0uj{_-3tYUWXt|Ea$`_lg1)RVB~Kq8g(p|5N|}w156z zSQ)g3Ji(*-!FSZk%}#^!S`Uk{Z^rTZi(z}sPA=?T&F*Cl%}N#ac+DQqE_dM9)9m%w zRI`(a^bIt71J>2-6vEy}vo~Um9q~2R?2Xye=7}!OPd#*YoX^W8|21Lb=!90D+u`ha zg?XYJ;QoHi-_NqmcmeC7r+S=t%{iVtm&a2-UPt^bHUE}OewRR$ueD}x%~m+#Z>!nc zYVo&a^UU~hp6a2qb!U9%YX0Z4T(grSW)GdsJN?gR+Z_3~*X->zy!PyINBt#g{)w#6 zkzXgx-iaM_?yOp8d4>D=+~9AzAt6R9py>a?CI9`B1C^5q}d0tVn=;uYW7Sv z*ioN@HTz(e;>dr9W*@>%JNnl!%|1-4&tdFCM}3aa{73NT-O%4eeO;#6FJm>1{(iY; zznsl+)aMnN{R;NHqda3Y`xtiAQD0YS_N&<2j`|v>*~hVkj{3M-vtO;%$JOj=M}1tQ z`Cr4nbChSIW}nE?9LL*a%|4ku?T9z5*~9c@dvSD&{*$NK^H>kZ@iI-bPt(dXjWsea zhy)1M!)9pyGuR!Dc&^v%*R#2fcxGw#S!}!6J_3J^W}n03k=I%no5S$TF$mX3JnRO| z{|4^gnS0=$kmWTX$U_|EpQojtr+C510?mH`>tOa@5zmd9{YEVwA=~lX$S!g8 zubZ{>H*4|S%sM&x*R7iWtt`Wg$H(huk!D}SJP!Nqn*DZmts|a7&0eU*Q^+zL@f2zP zMXU&c5Cv#6ScJ7V@u6cRKVb+C|3y{LUT=OqyKhp(4#4i1t zI{a5?{wvs1c3p^f6MG20n!=le$D@Www(OeD*k2Wg=pdbpyvM|yOjJNRs6d-{2$W%A7aO;KA%(k ze>Ts51pdRC|HJGd@_$wF&vW$e9!4uic^=i$Kgvc?`nQzyqw14D6rjyuk8A#qvl#OK zfNZioZg=F@(`ag5a2M&H)Y3o6o~QOatfb%Q$nPo5|0&jt{J&HD=Q{BJs`>wwWm5b9 zr1-CO#1}Nu5I9kQHiJE@rGJ)vO6}z}?DFk(1y~+8^KAlkr^U@P9+|e}lb8?Sb#INdKoCY1`|2NqMM%f`G3gXqV|}q_@_AH>u=0)9KRoF=|5umlzy&~ zzOlpqW6hsr@-I^SzjFA0s`-D)_EP)cJI}aGgyZph$MOD|=KmQhBLBZC{?|MF4{QF1 zSugV6uJ}LX7$3gS{J&sFs69U;f50N1Gv@Iv#)k`y0#g?K?TD8C2+O4O-zw=1hyPca z|5xl36&&vu$^5VeCMZCg!M@h~zh+&i{p0AIUHU)kINtxM`Tvu>PVM1W{8JtN-)a8e zv8m)AQ2fgrZgXaGO+d=JtbsVMt2?zeaHUEFJo5_EK z;{TOnem|-CpJd(1{~9I!#~sJ}Y0dvM`mpm!~ZAE|0i}K`QNDc=R1zqUo`(; z*tgWaxW*vcYm1{lU2LQ}j^E$3^uMulslD%1((iHPcUJR1%U+=NctG*5aNrw;^Y?;b zOd$WK6#q{h@m*@KEq#p9h|<5Lq(AP+&#U=+jn}As@NH{ZAFnv@<2C1F*r zY#whSeWr1XWBl-I>HWr2)Lv;y{3{*)%{Bk##whY1pu{`ZF@Chv{976^`)&eM|})7Zgl(}Xse}fYvfV-36vhg2-2VDNI%3_=}3RBmi}C$ z1*M-&>CtVGez>DOhZ*}F>Ce~FpKrWL{o!UM{U(Qhd(FSS(S`hr75}dt<4vOGpJ?o- z{<4DnWq;}6IQ~0n{+*0^)IaW3{2My_yJ-GhjEAVb9#{OG<3l&i{{l@;(&S`K?xD#& zH94rsy*0V7CimCm3pM#-O}K^=Kn06>q>%sxp}<}I_|IGbyThg!H(aqk{}mgATLQD^3BxJjRBQ5oNLFGn z2PL&!JcjLmJ_exq-xU7fWxa9z4j27fF8ZA=`hU3Sch%O{S^wt4y1Y%_7HMmh9Umqp z`qT9vr4P8Z3!QG!ce@2Xct>6Bsa+Pt;eXdfzt=^Ni*P16@ZYbkud}YM5Fos+J`ibZ z)zvJT4d2A&D6Y==Jc8RT2 z_|(}JON9@Q4Ie!xsukNm|9otS-~VlGe>Z)du~qVL#N70qOKkW!JJFx5H)D;!q@SA1 zSSxtMVBF`Tf6zt0&P9(KjzqQapK#GX<)VMaMgN?O{&^Sui!S^ZN0-=*^EC z@qAVP){4LRLz&~?hOaD_st>s66J7M3UG&{t^ht_7S@1j_^G7I;U)2X){QJ1*`@85b za?xMvqBnoE)`|x=vSq!gab~;dhq>rSy67)g^rHmN>t~FM-n{q-*T*@}LS;CZ>`D*AbfexahjQPJO`=vACWieAMjQ1mKJk)kgaJddYT z(JxW-cPRR0ihhNQ{w^2&Di{447yZ4p^*A>(R`YHst~uW$cw8ni?iW1o4^@K4`Izyr z;FG{VCiq_9pA`H>;GY(J26*$L;c)O9g?=>n7X&{6{7ZtL0{-uUp9%go!OsW3S@5@k z-zxZG@H+&*4E#R?zY_dAg1-;^Uco;C{sX}yMB^jDKM(#B!M_6jGr=Pp<8#690)IsC z?}I-kcqB8v75tarzZX1I#tFgy2>ztte+7R=@Uhe+#xH`$@NN7qc&s5{(6_xn?ZCs4 zs3Z7z!DIL{>I=RX_(p=q@MJU*dPXXUv@H4?9L!$ZM zy9oX^@ZAMp3_eBh%fR;({7Ue>1b-j+zJh-Q`~bl}4gO-mKMy`6_*cLW68u*1S%TjM zeu&`T2R~f!pMbwi@Lz(zLh#>$zf$l&f*&XNU%_7^c&vGCOcFev8!^IyZw7v<;IXc? zF+=bj!Os+Y68L<<_X0m(@E3uVW@T0*O3Vs6kh~TGyFBAMs@a2M^ z557Y1Sf|LS6nruG)q-CJey!kRsm%k1x;h>~bC{G8>_gBs>_(g5_Wgr29x4;><&ww>U4TJy#30I7@)LeKq8 zp8G>V#QnPnK0rI8o8Y;>$#ee;gr57S2tF46se(@cpC{y~br$=4abd6R_4KUk#Y@edI^kAIlp1GF!v_yoY;DtI1) z$@3U)7kVDUV!;P!C)Y6H{>4Ji{g()y``;n>0PT!&!E^r=g6IBs3ZDC~6uc)kE}?$I zbA0~ht=hCZzeC3^-7ZK;P3zUC-++rQO&^pwc*w93mt8*k%CX}oTstW@Z`zFOXVJ19 z3vash_QkYl$`a!a8go|A!YM0hT)D@%->5PkHXbvcG@dq|H8vVA7%v%rH(oO~8(WPX z#y^aAjJ?JO#z)2{#%IRo#u4L~@vZT_al$xhoH2eeem4p|#hy~nQct<(PR~lu-JW|r z4|pE(JmPuWv)=QJ=Q+>wo)yyCPCpk*GiBDG#5uumtaYmJ7ZpWVanwBw46xpg86xr za(D`@En>9^$}eEUsusc5R$C>oP09)iw5AHsL{rM;RTO)zjxkZJwPLTJ;zZD`sBOI-=l*6xo9`_+W9CT473uv^pGQ zF{k9!POlX+nu}7*sAi>@(d>FLqxr~E@M6~Gz>DePAdm9g+ND(bS~RQD*P@uM0+@X* ziVKh5-E3z+XKHS=CNx9O3)i;VX`@>0(4(2P(4)C1p+_^@*@vg*(x*adMb9S(v*^)1 zv>vpwbkoEru?)1I4Xi!x}ZyhR?K}M>kveXwc{`R)a=2 z%La9^%40XW*~%W(9^C~K5$_hYYZl|8i^)X|Fe}gKfOVPeOC`1DHM859XT-IkMbE}j zDbB2GdsrFslQcIk+1jo!JR^R1x^bxE zQU;G4lT4#}_AM$8_h@&)36*Z8(C+TQP!sXjmGOlDp3lQ(xG$+s2hg@NgN84 z*r7mC9SUAXhsG+LL(5C$&{&f;*QQ`~Y8kp*snuGEwWGb1YIyR@nRCMG(zaU1sAV^M zMlHSU8np~+->7AjouigP_KsQx**$6*to~8UV$~ssF5O?8k0p7y%lp58;_Xu@~WDebr4|kYMN!x!lf%vmPrX$RV(2-)JnLjUJqBb zIl_%*kXOYVFe> z2juqtpEG}qq zX%^Sh;%ugm1!r-+Ev}cv1uZVk;(A(~#q{lM!C72yi|b`^L5oYXxSkegF@1Yka2D6w z;(A$J(Bjf8uBXLWOy8gdXK}qPu9w9HEiTRCdRm;t^i8wiEUvf3^|H92#idzXPm8md zepq1}ojj$l#r3hc-WJ!(;(`{JW^p}jj;66WQzp-!49uQ<{ceul59@b}d@Qby#r3wh zUKSU$IQq7;?3&;^9$`Xn1dupNh9%!6TD}7Z>lu z%W%On$WO&PuHcc$!W*WQceo2)mR8;bdVZx9`J%k_6ue1Pc(wlUI7qbeUQK>#d;tZo zfr8h8oK!qK<`E6=T=G-#`YCvg6uf#`drWb`i`CjAN5N~X;62vD8Q)B@;h70ZvcEh; zerkNv2@ib%_1A>J1$XEi)L?jNl^e%A2LDD{U|HYMIsVkisixZLN0cbNQ;CPW*^ zccItD+1BlqgZQ?u7oGsqpgBBOKT527TJ;Pl4Si&*Vf`{P$Y zGkLV9!-*3faWo%;uV{F&8eWZpm#p9o(dLg6E_fN*{IOrb>!IM?uZ;&kyWp+S#)IPuUQY#YGF2o& zSp5axMU7Toe5(a@9-Nx z@>ApMM|f0ZKA!ef@V?Rd-z9_>AiE?IIUUjZ-+aQ8{g0-0tGov&fg0bnBu6{mJ|Mjs z-y=$S=}@-te%J8u>~J(Ze0xmAdqu$`*1~&K>(94PI*f~wNaR$d_2>5$JUk*R+xHu- zeM<-+T7NmBwePnIUb=$UMLRy0yWn-uj*r+&?EW`M!TXDLe5`iCyIDIv+9`OM3SK%D zTy5V6T<|U;Keau2DR_ewysldPJ?4U!sMX(a1rLu4%l7y|8=s#cylBVAx7zqTh4AF@ zF-*aGS35q?zXN2KL?WkM+VN3Ec=GrdK^`)`dnkcge?OBPtv|0Ky;^^Jl=5Dt;JvKj zB~Uv?!+Sx)JEq`WuHenkj*k|E7w!0%q8%StFig&u^b^P`?=xEab|AcH$H$Xe`?gZ> z#wd7)D7{*L-CgiLCcRpJsS4gz3f`OKq~fKy;B6s46)#)C8>isqYyEEk;YI6z*K7T6 z65+}IceR2yM(cl52`@l)Nz|;Ianke}NBribkI#VZ4{eIr`^opLE} zfmVNO2u~ir*DH84wfg(r1#g;Ge;X9MSqfearB}-vM{xwmE=iX6@8pLvg-pW^VmcC! z--B~#4;%U|#uF8KzecPqm?Tc$Y z5-*^&FTR-!*!Z z`zTSg@&>i>>LtRH{rP4E?|f~%@=(7Bm@!}{%iBg9uYOeGyOsQ8d2v2!kW9k|rw)YY zGkNSJUVmcL@^&0(_vc0AC-L|@awJQTfjR z$@(i)@GjBnZ?;SQ_1EgJg79R2DN^umrOHD6d1wPwXm}_iXd(Hj<*iZ58zH-_zwvaj zNX6UWf;WczRJ{EPUa5lju@>JR7rcF1e8&~MG6iovo&2crVO^a7*(J&HK1zOSd z{&EL7%kq}d#WoesM;#|1!Aw7h#pI{r1r)q;(+}fSeGMvne;Zuz zzSQb(je>W#g4ap!e=c|dt^aLM@YX7L@fzN77d(%Kw?o0ZSHas%C(CMk_~>_Efb5dc z2B25SPi>Dw3f}!>hYkI&u$~hy)dlZ1@>B87D0mMlc*A zwY>Q*c;As;jjyYM_ppNJ)9SCn1+Rfte<20$Q3Y=(y-Tddx4{K3ll;{9#wvJ^D|q!A zIPvzl;CabU#miUlo>cJGYw;a-!FyDTZ;68Ul!AAi79Z*}Kz2!p36!VBSEb4g_o9OLk~UuLalxzB#;a5X z?{5m;-P-xVaTmP1wDW^(1@G?)UMmgHN8?CO ze<*mbQF;~6N8@II?2=^v`y2VGcmW0PZE}|V?^+En)dg>yhSyKQdq=@5)yDfA7re!! zSL4f3@ZMGM25aMKz6;(!Z9JW>;Jv5deWk@$;ez+M7GHsa_kn`^d}|cE z4;8#=+IYXm1us_{?>8uTA1Qe88s2diJdcLAL&5u4!TU_Z^HI41WS1oS-vJHpkb?Iq zIm`a{l{SB1-Hw0+GyNcbuFW536ui$&KgyDYHM|@bylXW)-(dTAJFMWX)#jso7rd3) zeAHFJ`$ECHNt-_^T=3>;^G8U*JEGwIq{X+v1@A{KzOf44R|?(^Z9dxLg7=0tALT1} zUn_WzYxBo(7rb@a{INvA`=^4}Rm1a9qX)2XUk}f9z54elY#epTE)K%Xh&$qQ!Si!TYy@_n9^yRk+|C z(B>m7<|wbno>cH2)aH*3E_nB7^G7QM@3ew!;u~R`4#==C>Rdygu6e zmZRV`QSjzcdJ?VUH{S(s7U|XYn6BXY6})8{UWE%@sfJge;5Aq9uG8kD4K8?j+I+M| z!NaElWqWMW=8rutc+Y9`#|8xtpO2MzbK;%#ciaWm*#|7_64bL~!KHl(I zMj7AXdd~RrUGP33Kcoqnad%bl5*55I+IU~#g4aPC??Vb+Cj~E7!`tA3cUFsUtb&Kn zP0I4(GpzJywZ|U9!x}7-WP9M#uxfep32%RlxF6b0!Hc2$ObL{jOq{T8wD~znE=#S^`Eu;?UZ~)`tl{0~g7<=kmrr=e7yS>PVwLfIpyBOu!P}$ZRVjG* z9Ja(u(fZ4;E_mIv{<4Sgvd#F?6}+)DUyx`WZ%M7A*WVT7hZsV%fm&T|;|)^q?$zeE z2`+f6wfSw5f|se__0!^8=7Ja0;(LPdAupFz@Z50y`j&CqWkJm2}k{v0`>96s85^zRc; zDOC{!FaG!G)r(vD_UdaUm{kAv%;8z`o6X3>VE?xAhnzuU8sg~%fxd{_nIvP&`Vu2E zWp&J(ajb}5E{b?BUg5v-bmMX5k+^WhHnzCH$Xs0D@7NasNA1<^6a9>;)3LI z_$)36Zhw?DDzD5sb#_7d59K4u7Zno1=9H2&@-a3C6ZV9DYf;~uvZ~#{HR;u-Uo=JW#L0H{`eig zR+l^xDqGS0?vGZ?i2rE0KmK@(zohA})!v6g^;UFWefbJ++`HxexNT=E-#mTxp`u00 z{oVz!4=t|Tj;JcLPM-zdLyHOb)G1H!=o_r^VuURiK!9bx|XM}K*!2vICrQ5o<3wf$m0)y$&hmGNVki03!rGmXk^C(b@p_*;3V zw{q|qig?`e56a&yUxfN=p6i{Ay4%uy^)sd6f}?DGY0;bUERmgLUT?%3_Mwf!lRjj@ zB_FWrgp;iBjV+7U7qut~7i?$e6%}R1u*8CD7Kw>?!WDia66Z|_=YL3PTHjD|aNQ@5 z9oV^l_rAUF@7sG|&%xcF?>f5kn;rk!zP)VV(o4z)EZcO)#%0~_NJvj9zngl@R|Sl% z$_%p?SY<4WHLB=;LQJOytSI>oChhB&){jWOh-~#EMwXO~!{a00M5dOg^1;YZTi)Eg z*iPLcaw=!)=zXKJ#%&tcdHm|}aaW%jHg)*E;aMX#ji@(yalvEDD!o3>$jFse`tYRg zMs@KxqkiOo6@ziOeq^QAK*{wu|lJ8dV6wfN7N!;!ZyE^Y2x?|+_ zw6bT4ccphPmNm4#%sAXIRN106OUUq3?~QoZgsM+(V|zl&GQ9CWE&p`+Z!MbD?6hiN zM`(B`oc{uAnBi~HiBE^$1BYxJ z;-$Joo2EC3+umVo=Pg5P5Jh*2Lq=g79vZ+!*SRaaV?CNV*|L7(NbV8<~|Y zJF_2JRxdfps*6ssqQ?_h(W5bJQHvj11>Ypy;uk}~qLU#U!#|ZTT2Xy^FRNbo9{aSM zawz<5arF_e;eYew+2FAc*iXyHl>gv2J{S0-)Ay%`D~_^e>1)#c^m5SOmj4{*fA5r0 zJuk*c3@l_ZDVZ!xPh=OZi?E`u5$126!YaMn&IThJ+4faM^!WRI>5Ibb{Q z_4bxVu=GsmbEExZ9 zEzLp}{Gx?X9lnavEMz}45Bttx7;$eHLvbrTW7O6ww+txrmyS8xXG!?bQ8r*n%;4s% zXt0-+XZQzqVb#-5vue)^EPQAcGX@uCRK|B=F>k~(HU3MGNY<6!#g7p7b#N&M^j6 zCY(82S$g7Z(0fICxFCV0l*Z7jLq#+tg+pG}xwta6C5>sNtaE9&;zt(q<_VfrZZ7x6 zJiKDv?_pnzQMe^7GSKShi0Xy~ey{hqQRN@=bNZ`e)_Z4_CkDnDcE9d0^sb@k+bnZl z{@lEI^JYv9glA5kJuR>>Z|=Mqb7lw9Qd8)?EfKFUU=y&nEZC zlSz8u3ops}bLU)_7oML&9sx2XiS+%73VNGPHYCNeAI{Qgk3uo*JF<7MG(xt0V)$=K z%gnr*9H+_gnw+4?^)$J@CO6>m;G9KJ1I^w@i&x0_T`8!M=HFP8eVW{aerA!ib`&7}d;Wy`a1Eo8?2@8C>6=#x=S4z>e z*JyH@JXtjD2Q+&N&HlS)HAy^~ z-=)c~XtEuj$Zv~gZ)nxOu)nX_f7axKn*6OMx6$y-<*LX_;G4@%ars$gJYlRobIOU# zTn2=7Chw;7OJ}h8;{@&4l*W%jhaAUp9dbM?HSy^(8~GadE=}o8|DL1=HKVO5 ztIrJ6U*I=jSThBL(XuIP#AM$s;c{b^V)~;En$j<$p{76DxGB8}e;w^Xy=ZGn$MdVE zKi(T|O8tL=DZ>Z9tD0$YHVh`gZY~+cHIRpD{ts&MSTikl@Xy!mct1`O?4L-1_K=G- z8SA=$ifL;~$0yz9u?YTn9$pgUO{Tn<_@=BiGnZ!JF0ensIdQF~DXlWS-ISlFeN#HV z-Z1ma;`MdD<98y`gObcLVchk_auxrV)KKB+_dW>i;%m%V{x6As7lYzx^EKxzzfbBz zhcHR5$qYDLKLNq)Ys*>QH+|-yiwV|8*K9!G{a139^FhI~ezfM zgdV)~9}m6Rkl>{reakqrfDe=+=y!1hzP72UJ zqBXSnujVZ0rO!_2%>fj=)bAzU*IxKzyzpOR^U~)isbmZoL;TkYAMn!WN5$t9@xDai zgO1?qB>1M_aexwG?(uaNdo|rT-<0|3LUm6#n3) z4~~0@IT}7@or9M?6BM5*iVt|{gC&zB&RqDI@qm{;wu9$VoVuh;SGrnHRWXiT9ZUI52%_^pEHX+I(i>R^WR>E5=}7AHkzq zeSHOg9qp3)3BDNm{({G`kUT)}=>Pae2k0f*d>3(+y#oGX!DH<5T_X7X;6s8(Klcq3 zJnzHlf={3}@?9!;%)v>61dsmgpJDT|9x$)sId@P;;*;r_MNYHwW`*-_X0)V={1Dl! z{23Fc&7E_jzQzh)a>f3}-~5SiTrgwy{E0K|1z2WHp^vl9AUSUqeHKpr%%6l0Q$n66 zeF1hVe58SrPM4QGWD+#c0^@AR~8l0OJeAeCd>0OQK*M8MRRO z1aY5UeCY`K8sA(|397@q8Mow3%$+l5=ES@kqQzjBZ^l%(D8-|4Ey%AU&8&ReTb4CE zXZDnd^KP6RH602%Z}QYUs+Kyu5D_`@rs9s1>6hZP*)DmRMrH99s|1eRq@P}aJeygQ z=h3G_b(0lEbThA6VbVTAYDF+*;#BHh^QOC0;@o-oGG6}m;dwnLF6`Nx7NW_YJY~v^ z+0(Som_{iaRT7VU##Fmrrc9icH-93+s$CYdpU~F@CoY^kb3vY(O8Y1(b!_0wzd7IG z6`na~b`)T%7ATPl%0IJ7AJU8-JB}PijY}P!4#@d4X62>OM>cDH&o4D#9`=7`_bHtl z(Vs;*e#TBH3K~W@;oJ#)oDf~VCx+$vbU$;t_Go^E6oi`ZT=J_gGo`)Ew>>$jez&>cVJcMp zFppral_c?gAx8DXyb>+GQ{<=C-xR7p)EDXx=iIXX_G$4|k*yNbt%*_b@~M!c$qu}hv`M@T1g7E*Aj4v^OOkj`k&}wImGEYg z6Y%hpMdCd`yo&b<877fVlEhm}3KcK4seSz7XOG0IAzsC6=Vk19(n*qdeY;g!n)b?+AgBt3^)}UKI_(uxHbT za`*cpl0 z?qx;Wy+-fl;w~EQ;`XEaOFJW@O6>bm#$g~P2I_f&-u0pN_XZn06$*N#k@?#xA^q6QlbOOM3vy*GSlv=OH98@Y%`$6NObjLag^ z9$1wa_?yS5GHbnx?m*>q7=71h&$tsqa)<66I&j#=VVQKd;F=pswy)dz*p{6&BM*-H z^rjir=*y`Zv~bW~SGPu7n`EwT~WKD#Zl6KsCCFDKzj ztL9=Jt>^JCt!ISuBdjnphgHWtMt6x>!rs#G@kd$FR@~WL&5SCvb|T&FHL4Qn+=1>+ z#zo@8zUNtXLbW%-a##`Fx5PaculH}u6WKoIjYA4rE0Z1w<{rMiCH$WL;5c@%d0&Pw zxK}Vz#)h+zCDd+&5l8pJ1VV)F+&sqWmtINtDm#?ywrX&Fv2l1P*U7%-R@TI-dY;Xh zqpZ?y&Kzm+ogm#BE6mG6aH@1kQu`1oDNesk#{N7l@&V6&HazxUx zCDP%z!cjHuhLU~j-hXWG&ON(#@7=X;=YbtKqR~@~niM*sHZ3jO@>*Hp8w1MHmQJ_s zKTl`ttokqxPiF_{D3Nsvd7pYWoMii+@p`Hm=}9%2(|Ppj(Q)HW4VgN0-_WdKc~r9g zH^d$6@JZ(bL-&u|H|qT>_m1CVN3?ONv1PzgLDbMt+X(p1u;yhu|odvmtkQ|d}Z-VMtshd<}7x4eORS@J{jwPg z!UYXkb!3QT@FW z1WY43BA+CLj`7u*#Ri_Ls(hh28&Pg-mdMD(#*X*(tWV{EJ`fU}ujpfo)KUbE#NJn*LNt{*w_2psqsDaY>y@$?(EB;D* zI+tQkGEvVG4al-wyYGv{Hi>PXN%cuJGMycbj8sNxD}|5lYE@NIRP^-32%`!)+0jX? z+1ji(@am0McbIV31kW`mMqmc4J!)UOJ9pRAo!!d{Gy2jGGk?Q|tS_Cc`eS3+i*%Y% zSyqqrr61J(`t{k1w69!RpOp{qOFv!x4I0qA_?T654MXo{jb)>h-nIS?<8U@h&-&c* zq35CK9L9bcDH5CBunF~}l}6z(ItL+}EUhfhwYA396T@>D22!pStU(2Aj|Oa@OS+UcdRZ&r?DVuKxPszciUw*|PgH$xE*~FXrj{ z9(Zxi)0xjMzdUtEyR3&NeA(p4FPmGpsXyxbQxA5`{Oq!OTmJQe^jnY4?28{SMA$W> zEkxVj&z;fj>v4U%-v02SruQzGmK9&W#q-yXNY6NZ@2B_g8QS%>MUjjL9{Z;Cj>N}b zzo}@^&j&9*{@Uw*x$yqGejPHu<;{IA`hEGl4W|#BGiB5c-@h*?sJQt^?wN1)j!L@z z){LcBx2wE-SeHwV4!ZyS1M60oHQUs`^Sad|7wsy&@W~f4lipqQS=L|IzkQ_V&aFiU zZ>gO2z}m-O@A;LlA};sTwUckVy!he;n^%6fIzBez$)Er7X6V~94}I|2Ip5vf_~sEe zj$J+O-}f|`bn!oZ&3E4L+6D8TIUZSbW8wL|lj1L&obX}t8sEe9ntk@;&Ue3y>Gr^P zPp90owxFbaPLEX&ABel+;*ZB((>rK199Z>{r!4nW+gr~(@ay$s&d-|mQBl{&J(p&t ztXTZ&uoLCW`o1xt`Lr&dB;2%esOO^d4_)}zS(S&^wyzld;Oq}(T$kjX*>kkdNX(p8 z_SD$0wjrRWImW!7x`KaxqtAD(;Nt2CK#a4X>h`)LFsK-y2JUMAstEw08Igx&0 z&8)tEdE3`|#(nSgF8FEFh+jC)dK*{dVkF)_|EvDNmaA(9e7$?_)E>$AF52+kqM!O~ z%SlbV?}w8qQ|rxq@RBd@y7c`O#H*h=`)i{MMpWIirv9;8Cl0@FRI`(tp2)m*cyhN!4>U>n zxZb~-o&V01niqRq{D0voshjYl-6T9CrCvY7)q{~V^G=rzrfl9eBCW97*C>R1t>W** z^K!ga@`3{W?gRcgnvCm=f`omp6it5{U)Yan_GdJicQURM{jZhF;h!_+^ZHO(l3#siMLvl@6zNaH2F(S_9*cn|6Q8>TTSk)_&e)g z#E)xtg6grACWkik(A77mKh1uWUzX{EtGSTP+l-_Ya!9c|(>LP&xDG8y$kqiZdPc?R z-69~@>Wegs>#1AvJ<}vJ7TtH0{Iy9496(b7h}G`+OZy{J;3F2*^g!{ zQ)%y^tFb6QzB?|c30r6KBK`UNUMFlJ+6)$8r%gNhoQJNy_M!C1TjnqOPAl%;o=r6U z16=OFaK9ZCqRpV|7;Pv$@{;MN5)TT{X3$ki`OJ}!J270-28C!d=;@E&W5u;mT$e}r zah(|?^6$bvH2p<+y0X{Ic!b=I$-Wq%GzRO=z9qaw;w4^Z;z0uM0`{r{FNq!ER%XVV z%vRGiMG*S5hpr~0etl-1xSH;4KT-eoGhjj<$`SBS$hnIA1;v*_a!cA!Uf_2yW0L;6 z6@S=qzgm!=;oIBAB*^-P-R_Sfzvrd9nZK-aiI02ag8VF=(k~-{e(YND*w>5&UO&bE zB*kB;`Pu2__ zhFtE!=mG>ALp<&?puV0n{hM+*g*{@*IR7)~N<7Ltl6XO)f8HlWv%fCa(YE`I;QiKn*Gi3BV=fVI>&Aflz#TB6eWwiYNLQl*w6R%$I+PxZC+P(*7je)qlB zdiI_@1nm1=*MD9A`(OW)%*?%>b+2a~X3d(}GwZ-_EEM+jVxQ4yQveDwbH~WyL`_fnM zb1$^zgQ#_WF7o*^P0~k_*Q8*!Z-RROyZrGCAr5O~zR?M%2s-Is$>$Yb_mnbh?gJWX zEMdn&#rfPR6S2Acs0bkz&P~7tHoY@Fm}v;w6P*K`Z*e~lE+hx<8YsiD5p&#_55i6t!W%LO*?T|GDxoL~lakPtS(`5rvbgZcYH%AZ*5 z^FA+nV$okuy^9@$SoCv%rEe^svx2Nd5Vpw$d?0|_i%t5#-VZE#7OV8JeU_Lv49IiX z3bHg*J8{V82WH4IY{4ExO7Zzq`pmLSq@0N*ZG0Zg@2TmkCpq@K6AOoZKPA7!q95$h z6N{eD5yB@H{X~zRSoACo;S-CV=S9*?EP9?J>0>*boL<;Lh=o%IES#~x!XXyUjnv!g zi&*rmI{CTSLDI1a*4KV-t=8jpBrLBr3CrtC^u(ec3S7_!I|xr({)HOqejS4KHEZ>} z*NR@-Y&CqZ&0$cvn~a`V;^MU|eN=T_U2izvy2|!MILy2Ipy3dUotYjE>#+NM!yy(< z4fUIio>=r*!1;Mb&*~*u=h5nUaJLu^v4kxm|6-$OxdnOhAWM|a7&z-v>>$LVUk03Q^~9pT12}6Kb`WCG-wm8?^~9oI1uW-QKC$Te?jhUiiA6sNSk4Qv=x+j+G*1PVG!qMFCa|QLSoE{V zFEME#7X8h@l4fGj^EXP?2*W29{bKU1o>=tD$Y+BGAr?Kylw?~yvFMwC<-8D!el4)% zu?0A*+}I=*&I7>NR!=PYjpUCsd}7hJl5h3IqTfRPD8nZf{bS@?J+bJ23M}V^SoAxA zCC$5mCC$Xb*#|6XCKmkx@@?9PMSqZdt0xxyA@Xhc6N~-``BqOX`lICYh65oM{Tt+4 zJ+bKj1}x`=So9}>C68Z_bEUCKES!Xd7$=E%jNzmJyIW&e`1w%DvkkH6hXM!38a_<~ z#~aK;*3~gA{E1LyTRpMpZv=K9HGE>xS5n_<^u(gCrhb#r6N~;f;QR?jzXAvOJxeT{ zCUUMZocnPIG9eIVJKth`54u*X^;jYa%ll5Y)f0>UN#Nil!{@!mr2&ZdzVjU1@@z>g zVfOBk_KEb$zZns1vePnl^mW-NG5RBH)B}r^ngCw>WM`k0xr18 z@OuM`oqoVs-!gh);pYQqTRpMpdB2czK`i=V)NeL+h(%utEa@+Vx72xJ;S2)~PBUTI zTn1+t%u6(DW(*5|EL7Q6Pb_*Cnbdh=(a!?Ts=y9HEc%;)v#p+3^b3IH_X4r#c`XEa z(LnCR7Oc`xzjqJPFk}_B;A{ufz`;4#L0GI(=ETC; z4ji109po8o15m@RcvFKk04$j36au{2IP1{l8 zdDNQcF2QfY9klv)fTgYyi_Q0erLGc-{%^pNUt-bs0M6nGfe?#61e|U4#G>yFoV5@; z2(jq<0cTr1vFP)Gv#PO!5R1M)aJJPGi+&(*)*|d6#G)SxoNe{Qq8|>NwHP}HvFM9| zv#p+3^do`g91)9t46vLdV$rjymHJOCdRAHYVeBBpqGyri*HDY+7Hm>yh=p@EuyAUD zgG;f4G-8u;L@fLk;NTMMAgs>?GzQs-EogBou+#@)3A+VY>I1Rp9|M-Sh((_O9OOj_ zNx>GpT|>RLYQY@_vz&w9Hu!oR3hp#`KvBh@!IuuZ?D8wVQBpdhY~-lXixy+#pBeNi z!|E#LR?n$gJPpGW*|(^0@xsa(H8Tn;tCobPg`t^tnzqQV<*+++D~e-Mhi*%!=>}X{ zq;(i_>KV(%K?>6_cTCOP>UpI3m=a z@~YdaF{w>eB?pzlc05Dp;!F(5(b@c&yR-Q-r+)uv9!#0*!LpuW@OkS}kpZ#(%$fdP zOWMg)%%^JJ3^NQ>=t^-?|bHky?7 z@)#YU8#6s06B^B!jnTeU3uf2M@n!RL&(lWsj^*%2Z}o{4!L2oOrkP5wkT^Zg*Ow?W zRF~HY2IWeXL*ySPY%kO*O5+Y z_2SrA)arRNYGy55Jb&69Rf`vLK&mgjcF5`1q{KHc)n4~=7tC5XZPwz2^UV-d$*oS0 zEoXmpG8i?QiW&3fEyRG+#b-Oob|BK}!&2>Ki{hQ+E$eY!$5rhaXU&wNV*8^C$Ksq9 z4j2N!vtKw^z(DI&6c!BuDMdx184yJT+HXMAFNUJ20t1t4fzdx?8ry$k{~t+u3|N%; z$|Xu&8;Cj;9wW8zCk=73aoX`!)`0`>36$Fb{5*S$)&9b(0YKEMSZlG%GQTkf114gl zUplrw!Qr*H6}m!66tLJk3ZB>AQ?M5TkM@`yu{YUg?=UzE+OapmXYX(}<_)p-I(Y1L zL;@IG%B2+H+RJaUFTeB7$9kg($Mo^DpQLXcjCt)n1$(36FCzK9A0%&nzl6Q%AkiK_ z1&Y0?0A71v!rof=i-^4&!1LO>sizr(NPC^IiM{{w*;@^Fh!I#3d(S}6FvV71e1Yi~ zM|)kc(U0eMJ2r3np1{fCw_*{2KZ3$*PlaF`4?=R4K z?G^V^>I6J#&&4L``xrW}y+WLduO|}c@uiPzigWR^d;Ll| z-w7V7LR2Kb8-4aT2SC>-D^?HI_;?$^>)#IVH_$N+;`btWl|CN*i*5SEt3MlCk4Qd# zhYWyPEneiINr;N@mVx9Q`@It+wr6ZND8jo3`H(W9emd;6qHUx9dTj94=cl4(@wCdt zGiS^A@2?&EJ)r+!!}Yr?txW`uM5E(*gx z4F7O$XjAx!dRWY?_z0ui(`&zUT8rxQR;DDPjIv^7)GwMMcXGWGnOu+g-;$h2>hkUp z41>;1*_8Qk%C5}Z)SqNNoVq;o;f}w};jQ|Vc-ozT|!2*y`$ z)w9*^#re_N=qNpmj9nFrGbIsWvn0>=rg=*sB@3?TSxL!=jY8$s>N1@giqn-9@{?iFwPzb$KP>#EYG9-Nn0#67!cA)#aBIB^EeED9=GFYL{Q> zrnNY3x|116bGo@5(Xn~lw)=8JPDXAHw%*wKIvGic6YHIwZntr2CdTTgXY`GZ?+zqm zgm>*L7)8$U-Mf-d5wGrDF-{sNsaPO>%JaEFtgQ8H4r4XF=1 z1G>8n9i56}w>bUOsx*{hw7fX#wKgk~suH%<(_T*F=4jc|FC6$T#+_}BmIUT0fSrNP z^07|q`HLD4Zhmp=fdl&w?mM*S$nK*%r@m3xl(%vYM(3);=@=z1X~68zsi_H(w0~f% z8)CYzWb%;)XICOdu?LbP%T9LT3ayd+7|K1a>VOdOepan1qG zFrXMFkjByT^B7|=HewyM0HdzGXS;91$>LdMN6JQC`OKAl$E+WdeAOr4?1OqgFIX}% zcAl4)VMO4_^Uzw&M!VK$QEuTmnYsDPGjsF4lbPGESNGh$1G?w-F6o||b4~Z$(2VYR zO=_HrYao(T`(?%S1~vFTrKZ(kV>RFzar--{Us(m3upGgcOLeVg3GJ_p<;)bbVU zBS|~IbdJ~MHR)LpVtz-~-3VXj_|XSBmXGrkq%}-gcfd2A@!*4L4Naagf*fHT8^6yI zNNYd|WXd_{%R1a0b+|j~aCg+PxxIcgN1`XjQi&NRoVq?QI2Ah|!E6&(VulPeGs5!dmBKc2`A(^+XRD)=FkaI$ z`~C5f^1k&I$F``FvauMq8Ed_kugZCF`LVGnu^NUew2UbU1akZR0HussA27-{76Prd zmyJ=yqf?OEXuCbyGs^G^WF>-2n$Z}%$Zm3y|*h>e|Jex=iDo=Wt30riEA zL-1R)u6HWt9$BY~JT;Pc^SJtoiM; zm6N{xhn{=i@4fSj^!vM|hSruA4K6RgE41vE-)!!-|C0aw`Muw${cZk^bAMa=(D4`A z?#=F1{^6$oIJkf9pvif!oxeI`=;O}#p_$7ze)7y=_nG`#cfR{h`lzyX&)rzP?k~%W zCx*Xs?cGa{bpL+OA9dRI=o|AcIQD*K__4c_Lw`AV$seA1ZO5ezNqcve?jEr3{O{d( z!{>K*dU58rtInAm{O^Y@-}28MH)rmw`NJRIO~|e2_41|vcy!Oi`pd2?UVQPB^EUqB zS0l#$vsdGif%CsV;f0*HzSrr?m+$}4M_1o;*_I_2{^_NKTZi3tlQVbbqyM__p3PUC zd~Vc-L+U=>@xjOrxfOL|vYqfJyN7<~4_BYFwegxyt{8UT1+ORmWbO0s-ut(o9((Vy zzh89K(U+!w_rKrz<>U`uJLemV-u~}jmoNSMk*!U)JaSF#ru(1!`;UIy@8phkfBE?D zNB*>F`&}=O{C4`%Prr!t+|YID_B)?Q+`N9$n*&r|a-Tqx^Jrhy4*V5XS`kNM-u)YRF2u3RwRm&?Mj&4gH6SH+~7m$7jNq zMg5Jtr~GKL_P6=`r}+F2`21h=x##%!wLUld_!u$qulBjwherJ4({J(@D<9*&Lg+UC zlYH)tK6j1Jy~pQ%$m5QWKSNz)({>7+1pI=I_wTC9|6nw{ar3*V5#w$ZC&Kf5J?C?u z@VR$--0|_9tHblXnGxf@O`I5INBeU;?)dPT+CLQaH*WSRF=E{E?u~CgXzzOQw(i$` z?s-1?3&wYo_eZSBBrO*Ai&&_jTB-3|3vV86yI{mTw(L+6NLuTQ~@vmE~8`*@r zm*&Uv(R#&wa|eSzj_xYBOwE8h46nw(cD5 zpQ>Jo^Y5shu;E8)|8#XBjv`FoMo;D>#Vy;yU$g(SvUJ`W#D?< zVdGEN{#klF7of^SIx^6kW{yn{b&PM4<%|1C0xR?%>+|mnoy(T;NixFgqW@&eTw2340^;6-G}i`unN34GppAp8}RK zVLQp0j~!$uHsS0C&gV-|$U$tbEkk1AyiUC>Lt@dhy%0UI=s)-9iAA4;^DTU0(X$N; zx*$UMJxVyl!l?z$=gEh(l8_D(nS#(1Gk)aV&Pu_oFBpt zG7+1sLvRzYq=8uYmE`oo4#MbzteB8SY_g`pT42c|v4njPSjM7lA;+F~V&NR1-sX!~ z^oM~9dSeGcwv^jfLyd*QYeCj6;I$yQ*n`IdOF0lrSU!u$cru=HS@U3pN3Zjk2L+@F zThQY5z>;QSvALCcdyNx|{s~|iAI9rQu5n`F{G6P8>>&HFNm&sK=SyH2Pj;sBI}jXM zJ7Em%*t$n7cJz7g4+UfrHd$Yx8d%DiSoo}_vep7me*q(b^us3WF3_ClS;wTziNy}f zU)E-r0-QetJIHiw5-+jvZw8ir?yMsDmtqIG16%%Z4b^I5J}5vQz$SH=SnRX{=UOZ`mjAjG2Q>6Ci`vFJ;I^SOhR zVUw{A#KIX3oIL_N2(jqL0=qTT#*d}D9&Q<%LM;57fP2s|gjn>gw-vsP3LI|nBe&8%##1LZPupVYxJ+bJI0K2wtEV1a{02Z5Xl2eHt zgjhK51Lt2wtx_Lg%Nnbp#=`jss%)z#7X1lecbVZ6i~dXCtZ_z9EPDJ{P}x>bEP7q% zdD0->`#Z-RNF62?KHnWk9VQn2U|^|l#G>c#C8=-T@c~yrpU;L0QpT_&V_3qDhFDq~`ZML&W3tBoCE(es%$Yl6`ei~f4@t)5u)Gl8YP5sUt2U^%BXaGn6pwt8aG{}fp2B(dms0?W7@{zlEe z*4W$woHZ$ih0kZOY^x_0{fod-_lQOR5%sp76N~%;83(D8#1b|GSjOiOi@qnY+^2{|-w#;oFtO;-d3?;( z6Rz=g#FXv@vEJBNIj3gvLaZoc``;p3JZ znz>{NVnj!0yS|X^etgFM!KTNt=^#FB!NO|x88*6VtfCsPv6-8;WZ}}q6;<(m)`CC0 z$L$LZpJ?x6+tJv!Vvgy%!H)S-tn3Z_HAPv2WGz7AzK*$g#)8U)^Uc}uEO6wBlO4~| zcOD&;s}^IC8*jYP6K}c{8_t4wj-0|M*K1F6{r#xFrib)Q^fA80cHEv;d6v%6?e#;J zy5j2t&HAN#GoLMtA)NW-VDa6`xfPs0l>-gtauJ>iEbY@yZ)iz{DT=dFSoUWnm=ied zR;=mEZsn?XWwe_%b7h8ea3w1xXP~emj#07r_G;9uikYW($=2PU2ib1W1K4|7_oqgu zX?tz_-*kRPTXGohYw#bH^FnwplN5FGR;^_K_Qc7?dB*(34B(CT0mM5G{){&r8~u2!@!8{h6n+B|5y<(ey!Mj1;`tUj+T%S= z?0w}c7p`r}=Ti}}$9u5XUe|L?e_+}RViS9X2=C2r2p(x-3`eoY`LewBj=`RkGw-!x zFBbv4_VVCysvUb=1ITOdbJ*i^Ez^grN9|qXOCJ_**S{6Sq@-`GFMTJ@i=7Xcj@n!7 zv$q}g@|j>OVsF0B-gIR4N${9H=3Dan6X?A8eFGINU5w!<_8texn_sSlD&+?lwa07A zYwvy7<2zjuf&A(3wbu_u?qyz}?_vFz4%TT!$`d7hNR!`3RUdA>Ep5QX-G)ckIsV@i@lv^h?hgKX}do*ExvyB z^y4-LhIkaI1kWqt_cW9!<7knQcZr86yc=Q9+ut@AGT(-HeksCx9mXUN)VIK1Ej}XA ze+D+z1GXO+G$~zeLzJ)UZ(G!Vz{=$VwVyj=P*IlIt9 zCq-Q7tE&6ciCg<-ifct}1gq=}!G*vTLfBKVVa4|Kb^DSrf9xx|&*;-?MeU|?FT;KH zTvfCoaa0FYasNB$TNwx}Kkk&Ts10C?^_9t6SyHwG1rn)GQoTm@Z8#9^6Y1=_tLvsD z=a_@FW&-8j{xWAs4K`L>7xvJYgStahNQi;D=s&-t^ zrOS}+!QhU6eE8uGoT$i(gyYE(eRJpCiIMg9I5|nXQ)Z?#*R{R9 zK()QIOoc1oa>BDSosaK(rMYBH_}))cOtJ6ygd^4X^6b0I87ZQC-x*pPVP%|YxX3%OMaCY`8&2x_a=sCpXY?v ze4@fD*Q&OA52>~_E7ZA>^^qsmM!KD+B2#WfT%Rd-(ydNp(uFEA^-&eM;X-Fo9mCRI zO_w!NkZvUPw&q(AMc$b!h#e4HH|!$q%Zww4=_U?+$w~@xm^;k5b(uDXQ+V zE~;~frljzPZ>h#W+k4%dy55N@@zF$8_eg?D?3bb*O3La`zNW460%v{TwdTFe87W-- zCh^fus-<+}h@@hK#wrGl9rmutEUnvu)uFavHK;yms%M7>lgiiparL=LC2Ka#enKT5 zcx|=Y;nY`a1Ftl@$$$H*XkXi%@2T*YZ>vQ;7w?HQ3<(zQ-_c2>>_7$nMS0$f700Ta z-Q{gZs+@+VirQrL*RsH&XYAE>se8&%sEud23h|53RYoNyxl`L2qr zo2?>iH>k+(&r|O2P)gU1Q|@h@g6<99LWyD3iwDnh+&3;nzv*wNwiCZ}!VA}{$e(7b zwhx+A+o#=7*F&o9hK4DaNK3+XL};mX`2aF%NVSK6I9`oKjnHjz5lwZ?Y+00 z$htgLQq@-TunNo$|NYNgMJL#{b=r^)NeKHPRT+L4@sxR0u~4-w|vdFnt?+j|eFwwkw8c)>$R@o>eGkF5Jr z9U9Yia*7kK_??Q>G^(~Y*D72~A*ATfH7as4-3iw`ujakqW=ON2~!HYc^sMOjU{OGQp3C6qUX-`}I!-rMg)ru$|F{ zbL7+UNcpoW{BDX9Ihh>Vwc4HZBPaFV@LMZXc-F5}Zr{l(OWfcbuIroBW!^-pk;iw7S#-`3)ircaRs7x1A96|0%d6P_9WKz z-TPJIqkF%~ed3iRR$ZNz1OxT{F6ELND^YwnrbWR4qb}|IEV1dC`89y3cg9 z$1v7k3+>9h0euT&tzgm0!uoCX+oNqCdikP%>dL4Ex1kK~Jzd;Jq^Pkhn0Vp7uQGRL zmd-f$`khQw-GzHUtLq*3oGE*td4UUQ%L^lv>%b6Y?CsP0j?3O_xyvGn-4J$AwGL-?JlyD<5qUV)9fHU(y! zTM>Nw|2mKU-q|<4Y*wGSdH;faJKDBw+i^uWJR}o$kF>AUt~rUnK^Ni|aG%+S`^@u$ zRNaAc++!xIy63A@-QK0j?Hovn-e2%c;3g)j&1fTc;9E;%O&3*~I5l4ebnWv!ZkH&)0(uTP0jA%2JJrVY+93} z-Jd#*fpM#T(cJdw+fLhy4eA$&iMsG#KaJiU-B-t=6?@T1Dj8c+cX5MC%-@SEv~5od zR;G!ZJdxeTk5sireycl=eywU)@A+rtPOX!w3KF!P{p__CWc?y>O_uIsa{Ca z+v>IDxKnk({qW>I&BlGK%Yl}I8*Xelw64B*Bf_jIIkLW`^pQ22n!}_1s(!KhXRE_6 zJ)_#n??UT@HvPPp99qRa7WZ4)du?@72lrN7E3ivzZ6jY->ov>rH49|9)A0Ar0)@jC0Wqiw)YX_x0^bJ z`(5NngZjbhwv$JkLCu?!QD#T_X!kNTsJV&mDFG+^SvTirtDkP(ojeHca`hwdlTp5F z;dX!D;JB|gsK~2m|0e-Y0!A3Fk@zrv!{$1T>S1TA%1uai9!@x^aueTC4<|l@)+xUK zf5JD-Dn+H^wvXdjfZN+y6Lb5@^RY@ER*6E-f2{e1wW#u%0$2m;5j}3gxoS+k+wC$n zW?iqqR*aX}jMWwK)MZvztbIo{Bx7|&tW&uaJ@+?z`adU*#!7gjyJC&J-gu52h?Vus zx_OD^l~_9uwKECrRQKE!@2iJbe4%pdwyB5fp2f(dH0R;kEGKvQ0rl|mqiFFf?oUNq z&k-Ch?ly^gvGU$tth~3c23KR5$_a4gy~)jW`!I0gdA;u5KE(I@K$X+swbfX=ufw-i zhyVK#)ppAfq;IQd)WMjBBhmFX8v-&OhU;y*uiWQEUg_w#NA5$J-{-j3b#!uT??Ac^ zsNChxB3;{*JNZ83fa$;4d3eP(q#yaHJF0r6>hzY!)?W0kv3a&uC-2@NPov!_Lc8O3 z>9WJLI|l=%-PzLzxyAD>+nwjl^DWz*NXL|v9cXVNb%|;RUVKDWcUD8t=D+~g9rU(8 zo!cr4qwP;l(ymzh(_v;>cs8D2@EeS4Yq^~t*%nz*6m|oD|H!TTq6^!i*P30lMFnf} z_RPh#kkJ8GChD$xIN9k1cPZTNt9{gb-+gIA)-ZTzRLN7TzO0F+SM7vXmcBk!~MyKuhM{%vVpM8ewAJ2P- z-&OAGvz@dKY!)m}+mep9hwW$E^B-X`FVrx!Jt(n}kLtE3{1V%qrA{P0 zCFs6_77=NxdlVM8T%{6!c%Mpq{MYJ+=J4}7oL}Gr1Q)Hj`wCn0x=;uG`y#P-N0pY&bIK4*$(W4?TPChMvM%w$bXAWOtSV{S_cF?c zcZfb{b)QBXyQ^c{xTo>^^Lvh)l9I{P@P1MEDBAliV^KP*RNW6>RIj0Q9(5kkr4vEv zxRZHq^lvmB+d~^pw%oCfwE?RTpJeHv79oXwn#~oGAlzSUjVTTNY;QZi-#!~+Qpb2=W4{vN}sm+A9TqWhG2>7MnpTYbzp-#O_> zLG-tu+o?FYVtR|3(-DnzisTk{Q@rlG&aVh|LYt1%;%zj?|2eIK4y;Q_=@lJY$A%5CzSV+i^Rx}7?yKy=N_NXNj>A}jlp zL|*TzOOvaSZ}F6-`)Su`DLT8PJl%D}mAihPN?q+HHzxX1!;&3?k{!Qi>OLvm_kE>% zbEBl)lyl7OE5js~;YO5UFFZeHru4u&O$o{JU}?7Rb5~dASOn=j8druK-8~2A?B@Go zF+$Vv=KJDO=wtZOlv>Lp8;-G0ZN|501l(73W`)tc|DZQ1a^_rCworp;R(ee8!n zdg95pr=R)Rvp@gkuHAc{-~a2E4!-=mSB|`P^z}a-`}5oH{N?=*KK%HT6Q6zl&wrhA ztemoP0i-kJ802G!a{>N3JDu&p!Mo~X&d1Kj_TV_D%%43t7aY6bSm%#Be~iNgICQ?? z)CH$H;|~W7j-5Jo>SO%jpaF|Ze^bEDvB04Q4kS%`)5Slk=t0N>#TK`wm_XW~rf80_ zuY;OEV%oThgNlEUBvl+tA_`JhOcgQo@PiJ1T(Ad6VEu8Um<;;S#V|TF?9dkUhO0?> zM_r7o?J`dI8N0B7aNHOcM-z`uiw>v5n=~>E;$w_D-3Y_5aOQ%vLV1BMO?=&^@T2OOf8DmGZ#(6(q39O&U^!dMJ7 z!i z#EzqRup5FMu$I$}BjZpZ9$^p1TCEqXAjGxUQ?L(V4|k|GNG1P>;TNPAwjjN0fpH`U z8?a%9#gP7Q;^ywT)U0$)TNE;}=p1DwLFvqLQ>PK1LHKq=fKcn)(p*z>ox7T-Yc$(htaT z;Wik4;3w&@IvlaK3A&|KOyahrHZqlfX= zX6Yo^hB4{TJgsLMbh>EPqzyo)U3<_^b4*%^wVpN^H)@02Lmia_oP?Vuj;w4DoD>4; z$pcOTfgE~jFTDd1O7O^~7j_JzxeP`w!@*D6U|fXc*?6^+Ht1nC1Tt~KY0|`a_;1od zok=r;*!U0+Ikd0SO)?|VHqF7rP3(k1SVX>0MM3$9(t*Gxmx_o#0OO?z1H_XTICf?DCa6X1j;?T!L74HtHzu?@lADfYY z&%cAuo$BMK`usa8_JgC;Vsp^rh4$Is$w)^ZzmxXI>tHL!-B+BdlaJpe+UKek9InSo z`|L+%q>Fa<7bj*OrGJsf9iRVm)a^FC#o%y#*!gkpA|3vHtK-b0w8yzCjTpDwq{P3k z$3H$k*O#Ae+8+Cb8R_QpKTow-pA|TAJ??mW-F5g_zcIgmwvT_lUQdB0S8ID0`1~)> z_QsQ-#qZzC$In$)NnTM#4tna}66YSMR>ipoMc2~>8UKUTv^f7Esy5C&R6P*qzEu4x z&OJ=0Hw0Toa((IRWBkP%``jzRSAL)9%Z3`tOa}zgW9p_PMwC+>d$O&m%tCVzdrsQsDXg zxyS!8xH;_E>;HzwU$+O*@;C8+;PcP&`G4Z`|I+9F+~@A?3!mb1v#+rc6Fj~b8vhqi7R|0}fr6Vdu*;@|AyUyXue{Xo~kX!$!}8y-Hx=SAzgiT@Ly|4E;lAm@L$$Dj6> z`P{MV%fvUw=g&TvVxQqK41Ag>GQwW=YPQG|E15(KL6hM(|qAS@cC!> z{MlFB8@|lre#M40=f7B=kF6em<~M}R8=if`z3%-U{$=pvkYlMI)1zr)hyoSwzQpJ5 z?{g3Exr==6u+Kfv=N{y95B9l-_}oK%?n`~{VLta|KKF2+`*NTA3ZMHMK6kOtUE*_( zz_g>LPyXA8nO9pxdZ?o>Zk**Bf&%4^XIti0Iig*v?# zt5<#b8Sit~``q}w{SU8MJ!g|xmwgDf9w1lwt&h3(gJ{}a-N3oLuoNe{QqUUq0tieYt z`rg3#=U@k6J;-NegcM>cpaIBOY+0;C5Ml{C0XW<0iA6sNILpq-LM;00$+vo9(f`GpU zCEmM%gMF}r=rr3j{5xr$h%j0GbWlCdi`bk3Rkqa=i~dIPFEV^$(N6`=wt8aG&jQZM z!wy0$`kR5Xt)5u)%Yd^k#tuR(`a6KLt)5u)D}b}|v4aqcz7aUv>WM|a7C5T_I|#Ap z*8^u;J+bI_0%!5Ug6za5`aQteR!=PYOk4|Dmp}m_7JU!kY^x_0J)gCL{VgAde4bbc zt9XGWv6y6SUq&f&sa#Jy1Utw~Z0-{pYAp7*LnU*mJOf-X$Z&p2y~VsoN?2kE8v+j6 zxm0En4>e(RTVdEnoGi_q$CSa*E#G;=LEOmxh^p(I;XNW~V2UzM1vFNMGw{?S9 z^flyLJ+bI(fu+t6i@qLM>I|{yR{=|%Ar}4p$+sa{*+-Y)^*8-J*_T{v^H6n$_<`~gFFuqOI$h)4_UrPKMz>uULh8KHL%RR zLM(co_pB?igLvz}ZE$B>J+bg>fo1*_V$timF$M~Vw{En+E$iMsNIZ@Vv-V}dc!M9q zLFW4)7MqU)%X}ZiqG$01CtwG83Y*NGK`b1Wxy+qGEc*SxZX0$GV$r_|EbAl^i~fCJ znQ!7F;>p-SPGT##PD4GeRqlhQppvl3IFGVMYC5pon}~(em7Hsh9kzR}y*GK=z&z?( z4To65@^^fY0|_C;WM|ahkSc|5sQ95`BqOX`h(=pHTH=`e~5gmCl>viz`=287G;qNpqn|*Iy^e^5b3Hjr42SOxLoE6X;9#xM=a6H|gjhIv!1=aJ z@_`GM8~!lzZJ7`YztqE@2ps$m!=DPAwIYUvKNI?Ft0xxyJYXq9V$s(C%XLaDdd{mV z*D0~+?Y`eAbxYpCZtaPBs^%azk-&c%(Wo%wAr{GDt2POF$x zg_(MYs%I>oTf;?#Pg@yOxSZYS>?|{rjn{@=n;2>?Pu!lKOZ%#`O+CfPJu3+7)Y+MB zWZEJhCAP?LyE!@29924{ar0BzXtal(rwVCZ!kM6!ASb8IQf1i_N7L6#OEs3*tZwU{ zKgvI$(wR%$oS|E*X569*+naVtO5wDHXC)O2D=Y13n^rSp<~&Y!WRgdl`qYcM-SRS1 zDz%%wu$hplce}G6nX|%$s`bo9?boX?CqL3lSF=;YSvY11Xw5N+kDZl@nH4q$zYiu% zI!oL#?-ILIoF!(Ry078r)ESOH4NP78K1|)2?M^duJ|XxS6BlEkFbdDavxfBKQD-=d zUpKwfrO_&LZK*8Xi=(YZ*Op=x-zbhQj0Vt%S9#uQai9QNS2HGRiSy0WPMG%VR0 zrJikBU&HQ?Yps9Cw0!^G{$e!JXyT*t<14UEDjRMqc!bol1$*LT<2>UWS6{Zn>ukgD zfJYN8pJC5vinR;#1>s!-+kF0XW_swCjx8Snyz!Po$9sl|*yCEFUVHhl*Bd0-3t$s_ zd>`Sp$6Hl<>2pEy+MD1>Uk8spKD&DDO^085=^Noo-yBc+Qa$#HfW7v33uHb-B)S?P&d2emq}Zdo6JDotuc*BgdQH{jfJ0I@;@G{b=to5WV)EgAP?DDq`

}`aO_Rg_>v^NIUw!tbz#hLxiU@qqXKxFP@x2Jsmy1o( z$KMIw{Eknpci-bmK<` z^Lw%NWBq#>8|_KBr_S}v+hut;s9#%LOa~+rjoSS<(w?-nwD%c|dF{Ogd$rJu(2o*C zgkD}HF4|h{V|Kz@1mNYp1zxd-Ct0uZ@p|KC*&c5M0(k9J>K{@ugJQ43&toINfL4T8 z@8@NK&<<~-pT|a^9o}_*UXS*9xA}Q&1lqB8zn|B$eV(jMFZH03jX*p0UbgmlAEs1> za6i(>>==aG5bSsqdyj?8{R1j3^rJM`>qB@uL+$h41;K0Y_h;bU;rGa`+KW-81coeDcCCD7b?^*yPv08k|LsK3V;k`iK*sm7Cqn4hJ z;dBU>urSCMe zKXINa$;A`(d03-Za?nquj@%j@nY#^Zx2`OYt*c#u$GLp0Ei3Gb39V}B(nwO^bEkEA zSp^{ZlMl3KnimSZ=y-l_O#iyDLUOl&+DOLOZOorjp_g~=7_Y1FhxQdt7# z1j9rDK0D-Y+&2SrKL-lXHu@+^`3AIqEib=`oZ^ zaZcIVGH)GXZnv$pHDPxVX8nqds^<#MZbNF~0naQzkwM+m`BVBP7p?nOw>GS~E%imN zi1<>RviruJ+nS8^<-4C-Ijm`LJ!VY1FIFEI$CQSnaV7WZQnxYiUIo^(W=_T=c;jyy z)QS}fx_$1BJXd|(ymVPx;K^c~@!x;k+?Is0ZH?3ie(z0F&X~1h60TxxKGWQj+wMd9 z(r{&>6@6~iu=>IGp=DS(HClQcL+>_qOq|&8MpU=0iR0B{Gq3fFj=_$s#9Tx5zfR_= z?XmLji#46a#gJ~pRe^@`cumJ-pQiDuz#Mfb8qPV6^}f|qPhD~Af1T*wb6?UtTu-go<4IA!6u*X+`lsZ;{+UwgPqlNL{4?hYYkW7w&P43&=qu;tZ4XXqXn$tG z8K@mO(NyF$=7xTV5{=Dgx~(Z@tK$AN)H0SjQ{pXkZ`>8NWI4OceIT#i4eU*pTw;bm z4=xMD^!3rToH2i4bcJj1J-95v!;j6rht@>&v7AH#wHtQ=s`};0^ zhpz~3QALxS*2QISmgO9AT0JqeW}uC2@LZXrgVmmva9e%sOfKJvdXW^^-?zoFq3C`D zwbx^>%xUeusPT=>ujgU)c=O~EEs34-gd!Tr1({EF5v{Y!&kMk6``qxrR@56m-ziJ; zl-tP(vnHjY%uL-He9!jA!p6M%=JHs4=8R*$-jS@M@#nvQQd&Oh%JHGH(V+P&Zry~vddYgsaZ4T&a0|47S3e9 zQ`)#IM~yC7II6T{%)kMcmX(%YJ$wE&lkQkJXwmia2F<#rV*I6(#t$4c=+;}V9y_G} zprX-t+;-cPLcJ@4x3TNX`O zIBM+pA&V*p&A4X#__>3w8*<5ri>H)Uj-FIHref5MV{X5F!l2UdqKZ4hMV-vHET{^e)>MIA#9zS>J!e!T9 zf88A=v&%eJ>ySt#I7p2yy6RqKbD1eC`fDcdB{~_W179NUGv* zz?gK@{`?tj#PH?!5?3f-c>av_`saw#`uFv@WAB(!)i-?c#izfMnrnXmO@)mFygg-n zrBQpGw0nZb{X(K~%+dUFeEBuu`7X?eagP@#?8nD{jTle9H*CbXWAXdrb9EnT za-YGLfVZJc{}U!K_O5mx@wuP#xZ~4f!f%cG8+R;y#?8DN>87r+XfTcmcpJv}Tdj_7 zXXEXkr~PB+%eV`p{PTSL?wTJfkM2JIZ0%nk4R74FKKFEwJ3c+<>+lKDAHl}WzGp^^ z`z@dQN%2<3Kj`yke;sdl_AT^~Z)_eS)M0nQe z6zd;fzNUWXMEQMu?aPHecR!!|BA@$W{DLvk83&Ft`aEjeynE?p>ju-qaYp=RClUl0 z6X)MSO-K}96Q2EFC}r3(&|Vg4m)S9Vqb)Dii41&=;wwlI`oAj<9O>qJArZRy?L&la z_L~x+I~nCGLU)CY?{B~vXrHW8Q|N!YFFe1YiqQWx8(=7K2F`l5^}k-byQ^{5{h)Sd zt8B|(47(Y)UcZ7~g!WGP;$z<}5&EC!i~lX_zaD-Wxc+AN_&>Jx`Xk;9)bCi^Yszn+ zk1yi_87Jf8I_M&FKjSGNx|dkb2XN##tSf!|u#f*8U;dI2&gBIFA(nndbi3c=-bkGO zTcVBeX*Ng$5IoqZEM8C$VhPJSoo)5RqGuf|NW~5k!X~)42j_V(-wnFcu!9hb9l9NB zho{L*&0?=zyvL;QyMn_VgyrWjfsn4)9DaO-WMFgY2_Y8yOs9;OV%mg5EF3;-2#0l2 zIK;v!CWnS0)3LcOk-@@YTtR-!gzy>_JPg>KL9J=$gkK7`tQkEPxWI;GIlD8lgLuoF z?Xj$1Ni25y0_SI9$0IhkQbUb}!!i%@8wO-JHn&PcjfGPN71!*cjK?Npwk83~8nVQ~ z4^hvAKtk9=-w!yS-y?X$=GwYPEF7H%t0xvc%R%_WqMuGZ8#u^xY@(-1;#vVL9Ae=# zc{p1<9Ae=-P7ZH+kPomG@cRdZ#VX}VEPUoM*b6&IJ~xZ|155geh0i?7TG*q>nTs8S zSU3}a3v#Jd>PBpCZw)mTP9;<_-b?4*#(O9EHyb{&@auskZ4Z#+8V<2=(y6!CCb8&w zedS+>9i#^~;SdXlNt89RHJ=wfMDy+W_48$oY+Y6}4BuN;tb(%6HOpDblUU*V<*0bIZzHV}?Gk!zV)_`QK;o$-8fY`nz68Ay&T&*9`OGB$~Y zQ|94JAjjGv7S8n^&UA9D9b)0kA;&uOxDy+14f(xIyu`x4lYGnJv!HN@g|phjd5|2N zHe%s$T!`4wV?k`%h=sG=!+93iU2M`rES%jQ&H-|4T*SiRcn*o{C^UuZ#W!pA$6Eo z_?6UKJH(=&2OPAHYGA38v?goQcLtWQ#1fY6q3DT4&-=dUiAB$=q?JbGf$-{#R1i+&aLHP}IjMc)-z)=efBJ?|s=mtzNEe)E|L z2rqBh9jIp~k||ZE~s6-%ZYv z7#2}PiSq3a)=7>dq z2e50?Ni6zC>X%>#Ar`$pkG!xTr=7=Zjh-vtg5V;w`3YU7FW%vY)@ao70@~UB-S+^y=kV|6`N;P&0BcunU_T;Gd4EG8(qcx zYOb^$mxLutXKG#H*#@Yg2FM7q+|FIw`XecIMm~uCgw9Wg%MC86spL-@5FyWvkKb1xx40 z8JjhC-aK1r;`Fj~d;7UU87--r2D_@zHy%h5I%CO#0XhRnahzdRFu!j8(s`%r7FKFq z{LrD(%-77At*RHJ#>UoaXBjP-dq-6?+I9vQwR^5ubXbIbsjRDRhj2)oa!R}uyQ{i~~e0|jGvquNTV8Dx6pFKL-B{s$-x==fYvxKMpPe-$? zPKqDPvI{q_H=q;2ZBxrk?1__&^NeFze%TJMvkk*Tg2m6`$Y_eK`+nEFSK&|dL~Qg+ z$JPY_yz!Pomx4`1?4<#C?LFqP7XVr8mHF)Pe%PM9Z}{x(^w{I8PqFtONUS$~6X92e zO+?an2YBA}{T}w}L1KRSs#EN>T6+@i0r>H`M1(xb_k8wl>T2E_(H>usioIGS&YQj` z;b(v90L9M7w?Sf~Rc;*B-|PO@+URq z_I~9nzh$u3UizN%<+mF49<%n&@!0zo!h6&A1{{Bbzlfxdzq!5X%RE=9w?Jb0aB8CI zJK?kUA`Cnu#&8sSANuTl>9NOGxRT%B`RuJgzWAIcBKA1vfj51}@F7gfkKe?^-pv4@ zMz70fVefh|hNIZ40?%u&A1amD<11jXH_B%(1MUagu~!N`!xUS;YS^m>X8ExjJNXZw|P$cRn_;_lB>&^u)!uUX0-=_FnVVmz!XuE8?I%zQz@M z95duCzo%fYKNVKQ-WC9cDYp7*JpA+fF75TgCidn7d+oiIqSOO63=d*&4zSnW&qJ7> z1p#R<*ZQ&iuEOTEcPAQ)!O)3_JwESy?bYX)cc8S_$NJIUE|6%i2peTP>`m9m?C8gB zD0V!G{fsoF`0Z7Mew3eJBkoTJq!SvSN(1$te%$uLkc6SfBKsYOm?C};0pQeC8?E8B z*B8DoNZ!8iJCR@7V16lLZ$0uWd7!=(@qUDJO#kb#vCR0}p{k;Cj<+-X*RAV5SeAAF zH~PY-ph01L1F^9$`~`4vMfLa|v%^*nZrZNb6dv68Y^?vJr{6jI1fv&oV|@a9mF6@~ zyyw6@&gl4l!P46=*4J{%6|Q7|whc(fyR{f;){ujq=SN`aAS{WN zJ;-AmXV-l87RO3jO%1VLeA_%$(Cc=>%t?nPmEN%ZhMXJM-pGD^=rPwh*4N+kSnIoc z%ucQ?94ODNO;RuJymyaVzX$y-C0@6oKH8fWt0$*=^c`b(Pbb0No|-OtC;xTnUER=g zK68Gv>FsRROOEx$Oet@`decv1&8=9UNjKn$GvJ9cP#=pk5Q{SxH6}L)Tkj;jVljJE z`+LhjQ_tSi!SaTYe_dJ;Jff)>n^NP^N z_A2&9A6-({2P?hq(tX}r`$o^Nb9_}nZHZi8J0YcCMuEns{P*)Fw}DV9)S+ ztatT7hZsXb#`4Ub{8M%hUWpoCA1wdt(uR?!8Hlr;vysHJ(KqgFY-@0K6~^_(U#qV@ zt~)y(z4oWz%9C=~ekFUF2co_8V`*S7+w}6l$oaQd+>bM#yjS(zhx6aD8sj~@J^zc! z1I@jfS%Xo31F0$Vn{iHYlo(jjF{>tLXepYu!TS8Afss5bjNyX`%XbZ~k2LL3?#ex# z+{XHjXe&~tc=|It$7AQbqI!#pKckY96}9h8h)f=&&R-cG)T#x=X4b;{GDS{*ruG7L!ChE;i;)QoF&A-ItSm{>j>ZW;B3t z$80A1_$fYjn$MlC?M;u`Gw$&ocg!}Goi)EU>Tlfj9(O!HsQJ7<8ZmDEwh?zcKST4U zh&Os$usnME-13aT-Wc@1$>+~!A|n~T{C3s+vEq$h9t=O-u zJd$SlwVI!NTK}v+$O8`i$-fwz2;CeTE<*Ra*1_N68TiHf5Anp2{*POGe1)BX-ab$H z{D19p^Z84J;eTV}V;#@HlmA9v{B1t>L>nKU-7`=>f9cE5x5PM(w9ns#luB$F&>Z*K zv!7oyhx|({|9;KSIIaKN0-Jtb0~x4KoQsOWI-H@-RUK{k7qvT6ajpyz+8^q3OMhc> z=uy*ns|g`Yz`69OR? zeIc-v1F`6bdGy4hA4$EnLo9mMhaeLIq5XV|*)F(!sWrdfgkJ`CK3|+b#$$7bYN)Yr zra&c}o5{JLoWeJ4w%Dmw$p90Ha(MTGI#bzOJ{(0CzbQ&z5(FZfN z+LYTBF)U%{LFHOKvFK}n#pb=_FryG+;e>#te;m`3pM@Qy7@M3&V&RVg&gTmf$eq~a z91#nLNe}X+2c#c1DMMo6@H9x@G}es*78oRiEyx{2rzfPLo^QszD2Bz(NT~8HhiP+5 z4To4bY#*dw+X`|<7!I*;?k6Y5=pVzuWuhR&!r24t+HcgvqK|$m;0yM4KgCs5R8P~N z+~fs5nQ;m-W>+nkhOZIJ;^u~v5G3%cp0QuO(EFK9{LB|9?G^pn<_)hy#eZni@$w5( zyqf7d(~NO^)e!eBuAOg5n&bWUb|wzLnnb^uo%UTtoB5hgZ<_Np-`-CD4y8lk^BO*_ zc}pl(!sfG^*Kh8UX?IjDUTD6H7RG!~8Wl4ZOsj;C?{ilBU!PdEabK9sxv!a4b9;5{ zvlEs4vbDHsNzDv?Tfq!=5~shO;gem|kKxRDj{6=IJI`@yTGEO$ou4>1jj)7tY3l-- zHn-hL@XYC7I3HhJtEMfPGh;Ev*Gb}IDd9N0Gkl2B2K4oC#t%`N@--i;G{@8pV~2`% zKUeh+;e!4*Wjmg=?BkXWQH*=g^B#pfJ6#7~;$&-=?YdVItb^~~{k$X(QF!Hu!^`6> z^rm)r#o#e~vGwbnX70soVyWkr&ZEy>3v{*EL?qs?0KE35!`?=aXpeald&hyj>Eruq z`&a;<*n7;^fxY&=ggxHkXfMV3F@2oJ*=vvEad@8*k@RhX-fOQbo|D*~(;iGm)As@b zc9Zu7s(H*YIymo7?vK4)*=Uya#y@Qp*SA31vT_ir3| z^YA-|-hcUT2Mbqit4}E*_pcmppTe0P-W$#R$d$XB^!xt%itcMD9~^yir+Gs;A53J` zo}{S_??innCIr-t<$3$Zl;`d1mnm=h<^%<$MA7Kz8~WwtZgYJC-XJCg`WK9>sNJg? z0)=~iGVWjJSJZY=|A)G_0k5LE+Jom%U!moAQwizs`DsyJ0q zI(g6Jj42OHiNE3F(IcXsv*+Xa`s~q{1v)ItsjoV_)yS$X3-8ptw3yA_Q*k`U9Tn-^ z->6#nq*1@dd-6+P9tYy+qekkGeWDD{iPP%5z2!-+SzucwJbS3?Y`vn)Sgy)PQRq|P+?Mf*7Zs0nbVWfGj2^nd=lc54%H8--`lWfb#BA< z#u=k?Ru{Rc)4#)y;;h&DW65VpAt6c7yo9Myeo5LV%<}cDc?oZ(~5NI zVI(9iOz=uM5GO|qD^5oe%*6728T)6U9mm3Z3ZLdnYB;9cl)c=Tc=y3~U>V^Rsm;l; zDDjG3g~_pf%;Xh)nv-I)mL;voDol#K%1l~uRdX;lv@EzHR2UrZwA}upF8jp3syXFZ zV(aOnuN*&h;^e6lr(Za8{Fw&$$f?g=y<_!u&9~Dkw?+=Tem+|3RjUfTk-%(zYq;4Q zE*b0AuzlpG+DCr%Bd zM&GVWF?#SFsnkAu8oYdXmho;A<5wzmAw##2so9rzix_27=QNs4a%6PAweEj5J-_w2 zqeqTEd*a}!-<@ur`p3%Gt7;OAL$yWqLmKwh?`hb%ItMTh__UUN4S1J? zBP3`xA?Hn-#+Pej(z4?8)OtgWA{QPDQk(i4>)iSscu$;vGOzX=Ji3Ey`1{A_tfx1a_p0BHYi)o1jWyp^X9oLf;{^I!l&N4GyH(HvEpmt z*Jx{9*~$yYUC#>N*}FF2t?ob@zWvlSd>>lx))TxT)tcy2!pI1F)|b~TE2e)UsrBVG zg8nzWmBZXC?b?v<<&N6dO|pqKqUAW_IQaZFNChQt7ZF!@jNj*r=e4W~D*hQQp7XyL zYVeD}-CJ~e@wUAlB-la8yw6lY$srN3Khq!Mlf8R1zx@PXdWrV_@4EXd`J_+&P?Mwc z+umpI5>+2AU&;6SagIM$pnx0tn>oh&F=(ht07W|g~M}{aQ+1>bww;3KA4er)``Ft=B_dj3y0qb ziXDE>EqNvu4v$^o@Oy5nz&2wL3#Y%v;rHBDq2dq=r�gS*F+_7S1@0GezSN3ulJL znMaOOKg7bR);M>OQ>5}kESy@6(@2g}E@I)V(>M>2@W;TbCf&$V(45({S6upG<8!kJ3_NNf;@ML!SN8bz&IFGTdrTgbB22J=t9fTezjMgI!*-@*ogSoCiIOaCDj zJ;xB48^C(DoB^F!IP4oTW)h1&M7=X+5{o`x(-VunK+_Y8p3NzCh(*sf3SEi~LM48J zX9LSIMJ)U!z%o~1IXTX`fLJ&U@oHVrOzS9 zIYx+uGf2}Di=N|^9D~H7w~vKXC=hroNdF`j&OA*|Ec$BT>@;i;n((tG5GgDijxE-A zY_pEdB$Cg%g817dyNr3HDNU zIss?*RJf~#Q-Q4tr6(3U?6<YAdJB;c$E#6KdNF6%f2(9lJ+GQ{c`GWRD5F5HvotFDE46yKt zg-?$7q#+i4xjUc4KN%(}!k+u#^NZk3K)GNBR+NHaE-3_RTb-KF*uMWhYfp3176z~7aU4hoxGthyS%#3nkpk)dD z(9J3PBtGAdqEa^$A|@Jktk4R6$fl=xVPbZkst1{zMkfx_Aq!y;;4} zs~0b7)t!MoA3;qb^LUbl`7_X`X5E5WY3K>|j5w{LgrqE}<1T83+(o(WA*9cz`(n1v z^b)>sR^COe_^RToWz-(A+-iy1$CnAV`Ni^hkr{w;>_^S&WB-X#c+LF1V9%HjPhg=cWzu03`$9>g`~i_X0~4dC*_4$nK-c^q_6pAYSD z!r?wTFHxDWw>%#)jEIZo@qEYU$`S+?gNOe{ffMlo?z^WU!x@mN=dV3}TpwOfmwwr5 zpqC)_ngMisV=Q&=N_)(+*t^PSkM?<d{$9g=y`*x% z6MJ32<30uWF>pTo6!2(|^(gjU0oLs?qP6_J=mu(Jl)=I7;6NN^_Q&KtM!$)J-&Zwt^VlKL$_Ce3u(z8n#RrF&wcjNV6V0E(pR@` zZ=z<8=`)V)asWUtFW1#P3cUoWzu$tV+gk{GyvJa9nNP9z3t-*eN3d5a#_(6{ZFlx5 zaN=rlkIGvJ+JkA=9-rsw_O3x;r#SoYkJ$SSNP7PE!QMlNr#%ccuDx5(p1QpUV2|}6 zLF~;1Pq#M(MtXrndza%U<-N_9zfG{$T6-+;<*x?zq^xNuR&C0r_Jb%gZ3VL#P+2BkBua@9}sQ zKM*qOg~!v(s<{i{e#@P~_+|4KbNda>{i^Hy?JiU4^+!6KzgUXgshJB|wdtt=BPs9$ z=>Jj!uNG->3DIBMA4rrqtaRjl)o%rg-4%4ecV}Z^-h<`wYdd+kxHIQBcq<)wU;Ibs z;Qyc0FZ@ zW`{SggKM58{>#7S8NU|i9FK5m)!98pR-IXrp0+1pc@1Vd;XCo=HQU3%LWRx!FBF>l zW49da{N7^DH?_Sd;Op}XJsMOT&Z>>YtFcJi5+k;EAYnyTae|e2ASPT|e{Vy)tXh=6 zKCaMe6W1ZW$EJJFz50Op6Y)G)8EtJ&oDjd2a<#MQ!gLA^H%FB6_8yz=yg zKcw>T3CxN*<<819TSR-J&YP>LuYrlx&Z7DVd&tFRPv@*&(L2GY`rs)wXAQY6tu1PN zrhe~g%)e~d-mt6gse+2|-f)pSLlN`e@UqKW8SuSovpG^5H^^*S<+f65v-O6%v9Z0| zV;=5ii~y{iUGbX>8qv?RIjfwr)kKz>$5yp43?Cewjr7!~jTNH;MpaFFqeElWv~^}e zf<9N7d(47|hR5J#D3VaN7|v+$H#Su#ACF;@p(+Ee~cmVI11y7 zJ7c^F3{MD`oLV_nD=+7Jp9Fux$`f86LJfa$imjK1Wr^(_hcwC?*}t(8BYc49vsZIR zl|NMe!>Wa=O_>83n^BywtIg`d_Q7hfE4@6x&q`bZW8EV)uzmf`(u9K8Z2{wr2l5Y} zG$tnW2x5k^c_v(O@2PvoYNO9GESr`W7=V%GQRBiRtK#tf+99>5UCgkCmz{dA?+rJa zOQJo?42Qqt32yH;TPW)@=EvAapm$8hZfR@e1$xJ(H$94&*fE^^FV5-X2GXl!ra* zxj1q>P3%wG8oSz@FPN9mP*Di*uI|-ZLg++ymp{Cw)9(R@tet(vf>cW{i4Z zRQ%|f=v6T#D^RcSuYy|jYLU9Eee;(@;^Ko<)Ar&R_@HCew5>*7{N92{d}pI-+9{k3 zFfue9G16#FTpbn=Q+Vb<1Xx|43A;vF@zh-jGn3Q+$8CRJQtP^x zE^oz5&A*muKAxVFRGuDMR*v(ad&QjDLoApVtWr4;_kUKKHb!R0q|!B|zZvGu5a-#= zjqMRGQSoAlv8`Cc-3P8H-S%+z?-=TeIpV3~61){WX<=+>W{;5jJxp|p7u^H4^jx@U zz|uw1xY!;YLkZX;rjsvMuEnpEYqQ1Ww~_<1Wo&5?JR@y2@V$cDcg&VAuRA##xT~PL z?P<1L5a+e98<*L`if?l7h`fC=J6>F06^b=zX}xh@vh&R0>x?kO6FVm zO6FUZX^vT5^Cfjw5(yYFJhMtkGugK8YPVln=h#0O=ifgVC;f(Bk67`+IIp+6`Dvxi z(S~1=pQxVOiUqr`e@ULmxv*EXTHCmjYgON5?)P6?R~(*t2tLQ^2jZdOz?t2Q*sBt8 z_w&-Uf&W-=ZKT~l23Tzqjii!IwN=wL8}}9GwVNC}^@r)Hb4{*gpW%*5fyS*5nrHoI z@}0QnGE4mTwmWeZ7l}J)vAuLZZ&(?<6Ls_g=Cy;Bh%p%c_9AT$#7G;^^V;z`Z=^6U z^miCIkm#|?Y_{%oEZ}-x^N+&b9pR2f?@9w>7S3;X)_+{Ts21PpG+?Y=jjz%gv)0TC z?+J5t`z0$s(XJ&n6zppACOq)XvhNDL(&Uyj7UZm7wQnxIqpZYNWEJ>=XDq(pNxS#> zy=CrI+ZWvd;^;VoF+3GxcxrmqeW~f0J$t5S^y``4tFUK!+VwrtQ>XV#&$;yq#9x8< zD@yB&8i%aj+n8Uwvld^8)mwqT#ce+jNi4jg$gSn9hHdzkYAXB)rfFpm-K8@*NKBar(W-d9Ctix-zw7sAs5uXe4v=i>N9qG&Lp^u&nL za|P-K-`(}ZcXz4y?k;sjR$(f>yGzA)cUQ!sp77n>6{y!V@lA+l0GR<^)v!Eg1LmGp zyXpdk>xWhC``AcI*tIfHIL^q$y zXFOu=F&Mvd{e6M<`_z*s92ffs;(VC%0G^H*zns<0h}4~$Ht?SduC?0yb3k6;rI>5h z^I9z&pr1aDbLmZ63?5H-IA({`)RLiPV+u!>q|%{&YI@()OxwFgpKDSLe_X%RO!Y!F zb@ucHGvFTL=9#V0azUF3=lC-hRLzWLR?V9;6RQl|HggeP0XpkA%QDW@v-t+ieqhL) zm@%<&f%rBFZ4=wI?{G=SU{bQxsdJZ0yLLPn(I55t^nt$f%u9c3rF`<+wU54dUDAeE1KkD==u{ZjEwRnQj-QM?x8t%q z-tQQ{FYYTh;WA9)8$iC$V5*Ky}nm)($*e)g|Fe&{my_>YeR^o-rgm*!`E=HjaYwrzEYE!;uc>z2^>1gqzbfw2J3rX|)2)SZRS9Ts>dh?(cR}3`zZ27~RB@g}Rl({=$Q`x!FDGf&gzj`P3$rtDJupa)`H+!5+ z?KtnDlkW~r>$>IP6GLA-ocj5qvW*L$YJBRJ)ZP6L)m8lD`8(oYzw3v`2lW0&!j-pV zte96AH|M4Dx2CQ={>|jl>g+$ad3*3%mtEF;@VO1EC;l#YJ1zBmVN&F_Y33N+|$_ajZ1ER@0Zh>2Sm>OxbrjN{ddoP zzU{H64s^{=xbLnh*A@KuvB95x_SV&l?tk%?4(Vsd-}lXuEmwtKZ%7^cc1xdMk527q zUeRs%fB{?I+BmWO4~^KpA9kvI_wAJB#|Hi3wH?!5Jvi#`C%-poL-8N(-!kXdf7x*P z;8**7TK$a=b2j{Y_n?1vd-1^Eua7f-_V$O*Uh`n5=dP&v&yW6akCD9Xp{oa9dB?wJ z6m(jAzPVrK(C@b-7oKYV^NruFS+(xSzAGQ;U-*ybe)8G8XU`>H`nxk%Vp3QZMp*v- zH+cDH)s0v30-rqBCr|Oo%QZPVKW%OM ze8;3hTVML^?D#Z^#>xcI`*$$Dhxb(sd{1W@{fyTf`5wIF;=1Q7-&&i&O$Xop9gTnS zB^Scu_{A7~Z2o3j!%asYKgn3))bCw3-?I5zU4D`+Kj4$geeyP+eB39W(d6jzs`R}2 zwS4(g<+b~&Z9~bG^1{!l5APkMir?s_r{tYJd52HFMzc4^sXxwNj)51^==@%4*T?VvKHf{4p(_?X}J)zweX(tI2@2MakC~e|5^n{%9KCFxunYIl~tGOw3|nejoFdf1@V9 zg81d&GFj%I{Cl-{%APOVbfdtDOSSpe8Po8Wp%6b4GkD2=*U1B}@_p^6>Ti*~2RFTq z?GEN)U>e`F_s@59jHkTYTP z$^DF6ly5!+{IT1w4?wjhNAvT1`}gdUFgrNpMe$PG4Z7Vf5WQ0$?-6!{V>RauPr&e11^SpoFIUWJ+xh7qG z@pn7NOC92q(Mp9r{$3y7`K*ZMY}|H?4n~tB@3ZBO z#&;b4Ia^LLe&N`IXxsmVue=Su{Pgz4FL94;wg2yZ_CiiP>p9uD)Ogg#kNEg)efID3 z@#)h|0_!{9Cu1oJH!!}JuYSvX@tiv*f&5ev@R#!2PJTF^CgXg!*~h=hS3fJ9{W-=Y z8$EFhdV%)j+8_pYk})3s$Y(FlS06`x@?4+1O-q3GulJI(^Dp0@Q_c8G@UvD@ivE6s z^TsUaL`|GW0s_xtq9+zT$7InHi@r$H6N|oF(-Vung8F)F5Qs%T3t05TqF<`%iA4`+ zh~IFQ(^^f9Dzk7nZd#4D+CHa?K2y^Zi=N}K@QFoVpy`Q4KT6XRi+&>YYp_8e7X1uh z(G!cF*A}8D7JV0B`Tm@3l+8gNAqPL}`!=+(@Yyc%U3URFYZZrBIKzQM&iuTwz}9`( zAP@_O?Gj3))-a~wXEhKhES%YpB|o(qW_K0e;xr+Cz1a^1Gyf@UGz4O?nG4+A(G!b) z9I%yy4Fa*~rvS@0!;650LoA#-HO>%VNtakS?6;Dx-iPNxZ*{^3fmryoFMhgN#lj&L z&IXOsl^o|7Bow}x5~h4ReS28gT>Bf$nt&Wc5<9!kXSgosdtV+V$q)j79ZcQ z0cWRRgYYJPlCFLHI%5T~?8{@;+JFrLvFQ5(hn(*=?K*srj8^K<;fzC^<#33_&NS+s zW&4rO4&fb*KH$b_mvM=ZM%f4)D8S99J zlLjnf9kJ+#1Iu~|#G+@LicLQIkv#Blm3AQ(elGPtQF$X4{WZWLDiDhBvo_fuD#ZHCBsU*j-LoA%R8i!-G#RC+9SU3&9(r<}Hp9&o8j}1Z=e%S+TsPgRe z&myRVKMGjtfmrktG(EBCnKx?-HVDL`Uj!V=r&g_9F2{HsWZ~QkESv{`rR>DQVOJK; zR&uyO;2+`a02aw9AepbA+VIU1~}WXb2+HicEu+aekO2` z9Tp)MzwB?=(EjdS#x6FM@JoT^n|WfjYxa+sEuTp+FdmpNyr%!m*D>hhyj8Iq&HC zUkZN6;ndL%J1GLO*ts8A`U$b*qGK zv2Z3(@AP3}(Fdt#W)X-*p8_m;V$r7ohlXN40$maDs?Cl-Avuyrps2*jdipA1rgz;+aydYiKBVpFe&8PJPOVzD_7SZuQ0 zL&LB^ScG57a2wiK_)DPb?&yg{ea zQrP$i#G-!yxVxh#7X4OWYdtmy#G>B;EaiO)*jk4T03DPqw-1DrBS*(4VIe&Ftoo>=sUfaRDX7X5MH zl+nr#vFJ|#cX#x}qCZ7G2O$Jv(Vr&Y(G!dQEU@_bA{PByz*0Zwfm6mPo5aF-AGo`t zCl>vO=sqfaUll7JUz3 zDc9w|Dc@E$iG`B}+}+U=i#`M_Hi<>wA6RVW1E-8rHi?CE4RCiyPb_-+^^{|TSoEWS z#b!Bh%6MgySU6*WyE}Sf(N6&uo5Z4@0UVm3?93*o!NbDgn((407X6*v_dAMz7jVi% z4-2OT`tFXNSoF2Pa*Pm*el7Jol^tTyZvf7&Q2NJ!WqcqO&f~x`J`jt3AFzxM#G*e8 zEcN*Uu#68Ufm0@{w1|cO3UGHvPb~U3fMq-(7X5i(vHvcxV$t6ZEcH(;`i;P1bF+r&M?mVISon_tOZ^jzeh;wZnOOAC0E_+oz@Zyd{qx z5t^>_J;=Gw!@}uB&J3kzy2A12K{&j;PMN9r#A1i1_U?|JSo9ng<-Uwq^wWStv#>!} zf}hwV7S5f(Vv|_(ygU_~#G+3H4$j5~Aq&6kIX1MP)yuOHJ#RcMg&Yp6z-m%_VzD_7 zSU8Qq@+^y3IJ9X!i46j==%)c&H)De^4L{K{i=lbgAXMWg9Ae?z1uUFZ8i!aoYc)<2 zaL}=NK*Ps0d}Ze|DAM797h{Ba^k$RY$KhqweIZ8o?`DLqn3D7+$c-) zZmP;zYV=yF7R~%3L$}SGH_J{~CrO4>Vc?rhl{%^(yd^vB8o40OF0YFEI&Siu9*3o3+FRp&TUmoa;8^TFPc+{wK}00m2+D)zNuJTU4>;k^&I>2^z{}`jb1j? zn2(M(KYHm^)t{+tHM_ShT5@Cc?O0>AwX)!Y5GS&gC1mxEij{5`%=j{@-D5naS8&he zAnHi>6ll9pn==oqwc>-8TjodgLA3A}Rb$ocnN>GmxN>Z3ehXDWoW5|gn+OwUH^Sd& z-PiRK=%p$BZua!sX6u=E57HYKEx5_&SP&~0FQ}g7=775@PkvnDH)_3GX4qC}p7SKd zJ8xd7#uPnSiM-j1v`3k!?4aLHuZ~^^7Y;VXndFU?({J-4TXQnl$|1r&cgq6$Fl;4~ zeNIJwr9Ss1RISgEsrNZ`U_?3F^Bn6%sqJpKXy!$nE~@V1xb$nKKnthecH8Z@ESlja zK3~@M^%Z}PM`1?L_uz`Kwf3^lBev^5y*z4UwbiY30JbqJ!?!T7bOD@DJbzHFxDmvG znKRfK#c~D;$Zx#~m-fGiKCiXXu&gL3;_NXphon}jacQm)09qyVbM?q=zZ{68nC*Uj z0s5w@^Zr-aCbi)g6<&D0$S}@9Cjpm4cK9{6#PLeJs2{{NAo+PU&OZFZ>mi0!An_Wd zfC9q4Udq=!ANMmqjBAfy4iePu?S`%fKM7*54|ux04ZYPo650#kC-!c~4!XVm5bDGj z{)#<5f6?vTm7&&mr9D=U*lX{zw-@%hwqmc1&tBgvRrzSIt!9t+rF#BOKJ*~S9XzE8A-U1Yg_c0QXT|3+io?hO&`lxSgXwSlr zaqNGm;-l?7jfi_#p-vEczXwmZ*B&>2eBMcWo$(WU8NTvfgZ-wpVy~yKyqUNGIP8>{ zQ$xhwLFl+U%-CTg%C*hG{3H3>2a=w@53;@Ets8h^?-l>O_8zw_sg2ls4?O0fz=;b1$oPUo&$U{PKgx{9T0~(_(qw!B5ZM-ejz|2Au@4cMb|Ye;*Yp|DUvnL&dfC zU0?n(F<1-|WB4ofmiY45x5z8+)tbHAo%WFZrokQ#IX5s*42yj2u?_aRLeKo6YrFY7 z;*5XjPIj0Ld-V?HAJzqbBYf%p4Lpv^63AhA!m%g$^7)dJ*2YeY}E; z@V?>WO}hwhX+V`n@>c_1nPduC6gb((JBmTMHQrxfi2I1WP8e+U@k;E)IpetSo(6AA zEA=wSXKy+hEwvTiMCkN%mw{K<3U9N+L-KYw0G{*_Dg-Aw{p&v*c zQ$G#qPQy6K_&WSpUJN<7o?qztcEzIesbA*bbwJ;Nxr0dj3hUF?{6eMIAL($m@qI|0 zo-XM537&m`R+PYZl%rYZ`bUZc0_OTsEB;w{oLZTu;L41mX)-gs<;1vHXg2Z{Y@c_ww^vNG1`jf z8`tA}QCU$x%~H!{`?BgYuMd}08Bd~y+G-^{qTzb2v?H|AwslJw+j~SCvpKeRJ+|;v zTTD4)z2t}bKwPA@IEH?T7$-52z`izE?H;~5@Lc58ldR;--eiSqO?Wl3`^f#87vjc3Sy@^7OSnX{2y2?$tXhey zch{P&wfyve=f8?QSFIy2E%PP0MgCPD-SoNcIlKX@x@0ND64$KWp|4rp!ee1;l-EPA z1yp{+c2A9Nlh%Aw*?y3}TeT3rfy3?K1r@%G9B;7bv+nWMe&Vv`toq?o%w{XlfV%MV zylkHp=w_rhZ8xf>{R}g>&CBryd( zlTN{Nq0|xmidlhr)9YE(tSC*Sht2T0&)d?kQ$p1T2aT$=H=9=c5hL7?1}{sk<@-UEyoY@-J*_rr*@W_eWWW@)}w{r--Xuhq80sy;ZUyj{W5caI`#<)uc~{VSerV=VjKr(LSfer)WD z|EJMuKfRnu`^u5Ow>H0ad)@rSfnjzZnf5I9u~v36KD{(Qyh&^C_66xRyN&h*VaNLw z$2=K7^c<=&l5zK!sI#v(V!yYf!>~wQd_vW`jNSiLkL(MCO#iLjL1ztKcaLtf! ztZQCT+Qrz=99x=UUo%9)0b~B{o8rgc8;NhzHTGp*3p{JQQu0K={FB+VthBMPeRF=; z^EODoU+agd9#B=&#_Tb)Uz=rrT3)ke*h9@#AAIci1mpQX9iF{bj9>XVJbuB;*C}}U z+JkEw^LJ81%Et1V>9?k5B&DSHT9%TYc3(<*YR~TJIsLk&hYGu;XIkpNhcQahS)R)t1VhVhmrNGBo3VfWU zz{goP_&DnZA7|a*q8whB-BVtXHp<*0cC zqtqz(%xgBU=zT0;Hf>synJj$`KI1H}A6xCrP8Dv>wz>Wv6M~WUX26O&=pNr`;i}*| zvkI${Y)kZfv%$k+vMz;7=DOC*mPp(hGehgy%qhHoyLs{Q(Rv z8mk1pb5&nty*D2<)o;4Mws!T%_c^v<2KiNnZCSajq|jiL@_>@p6mSYsfg9 zcE~I-i+9DXk3F@{^M%MO2gwW1!h!>F*5Z#kR!y5}mLJVbzO~dFZ7x>p6MX%}DRHLR zH21)wl3iU4L%rS{o@}U^Wu8P?g~6#Fk#)Y zmcX)I@aBAKeVSWOJWq5AR)#mhL#^bIxTHG?O0INmrH%e@G<&q!v?6O%o2r^bv{qxAv_p0~u&#?$UGFyPi>Ay5PVK6K z8tJd>acUHZ?ah9--C&JJaJ8JXo^84-?#Y-_>n3O`XjpN$%LuN+*u)X_xvY3s`#a33wVBDA+}x}<*xtzNyxs`Mjb4*p^O&(< zUDetLjc~iFwZAr(mByBuF;*ZcW>?@zldZ7p_Lq%c-D^Gj@#m51OO4Ch?5aHwGwI&E zf1Wg+Y<#5S!Ozl-^*C;J&HAU2QOAC@Y{Vjro9AooTz;?xve^_UX&*G#Y+7&C{^Rqk zHT`i^Z`FLm!e8~UIODOz%IJ1(*_}AZ$J}18u0=1ykyjPOxYWefnR~zrJnxN%9Y&!i zd+k?M5P%#?p6ec)X0zGE<7}+2SEY@{S_#?50vX5e9$#hr96t6vD^~SCI);+d;PGB+ z*lfvwCwN`%n>;A_=|n5RjKPS9=LK6eZYY^vy1jirERNp$?#nn@L~0vMi(_HjqcIuU zcyHgguC2A}61GdCa^6xIP8;pzly#D^#%#LqO2hB5{q!qmPQ7vR+==rqVC9U)gh}r$ zw$@;Ejpo=bJmZT8+u5$KY^&`ucu$owMA{YxJWs2$jTv1pIOdFbU1!-|Y-Jy_WfrdU zE9yLNg~0W@CYL@Y81=MUkhLFURpjs?*)~`CyI+k>>Lq5>07&pt~`+2 znA4C|Z$EkK9Wd684F}RwpES(;82XM^1W&hCIeI6d2Q!BM? zwouZqNR=jfuW*UC8WPsya8t!SAx3V!9PH83W1~xeCtmedIE=e{N&CIUxL&Ib42r(b zriIwvZS6acBiQOk7RF@oc@B%zAHdzccZR3VN*rNiXk(?r9uol58$qiednNEjx_PJv zy^onK978;x?Phb9R`Ns~v&akXg}ftuMeiel9|hJdo4>@0iyy>m5?`f$>@zIHjlb@?p~=>$<5|p;++BS>Ae`U znN|a(Zn{yWvY)2K1qLyt1~)IVZV~IA>sRUdIrWF} zOf6jE^|<-fcKd}7XlG9gqbzL1#o6}fb6qRctUk^=C2G+vaTJqsygTad&h}HWz}b%c zTd$>PkHB`Rn1XsvqMoGU><8cfUY_$;?yL(=GVx@3)D6p;t@wj+`Wf%Ycv?p80)f7E zP2o8ou95m23`E8a#`R+w&UN{9d)-kA_vP#R8&=7`Ki{t11)42^Qa%rqoSQ8?$7)aU z?B~>yKc?@+MeNf3$}n5%ZN2xDSdKaUY(DnDg#B1?t5#Nc*=c*;chikp1>pWNo(-4n zOT&>e0jsoRtUSI_Ujcyel7?LaDET$3SYK9rIA+Jno#7#M`&SA>tI>L_L{_^!tY0a3 zxyG~Y_ycXQW(?N2sf|esXRJKB(u);q{xWgZmmLjRwK*8Kq%>;vuoYVpW9Khk*1TfN z(b#1;F9*8DLc?pgqu5%tN87OGweiqi5sW;u=}EkE*=_LI>TW#AFmV6*D88^c+Jb|3CZ52a%H7y+PUW=*Yme+wia`9}X4X^7iY!$l~px#y$u+I3l3U!9J zNi5gG*s8N(12rngOOVeHlqG2~dB4NAOv`Il;hg}|!&U$ITkD?Pba3nMjy9M7aqR08 z{!sDi)R(!=U_#-0iz6Iy(Yo#IRq*ySC#!ySf_FSQEIbP@ZX2l|+4i{GNBDd^ zF41aehgJF{7xTHwTpXXiXS&agywQ>=c@p1NMCw+@VBLf^vyG6+)hNUcR+ekYG`(El zS#(s&2}xd>9FNfFkS0@ZE!~XpGX*)t4;NoD;*&{pD^6FGP2M|s4v)|1(W*WdZ_t8; zIpLjdc`)Xno-cN^MZ&cSt-am5{?@veH@&p=#iPGJ{y!(4KlR+{BUm}keV>=0-SafZ zdSh+`cR=1`ZX!#}H<452q_gF%(YeQWcR;3d=t=W!dFEzCKYH6+97v}D8!WJ#}(f0Jz z(J%H@y%1+e>AW+3Yw37(+giPPb?QAA_3G2y*T>Bf`p=l0aSxBXWYT9N7L=VSD<3%@ zz32aS{fxo4#-B-hE#q|AE9Ix6R{>pc=$Trqvx>KA7?0}*VnUSFzP+(_XnI;JnQDjV&YjU{%*nFQTV&w47a;4uABV^P0yd(!*En$ zow23>{zjjx@Rku*y*s@tf~a#Y&$xIKZ(@{J$BR8Muk3g^VdJC_a$k4Ax&87~x zlJL%f*sJXbBcXs-xV)xt^Vdw4e%9l)6|ecdyCRH@@kh*PYe{YO>lDd>c14OOM|d9Z zo;&!4oMTbGR$g`9;0XWL7_%99v&$hldu&u4o@{S1-W`(`UcTOJxi9WwxsNWluO?dj zHHEWHU9nwXk`hLN5?&3*ZpHKV`1GcOI8Q~_kzCctnXr}8Ab^ zpfalWRpQx()_yHqPnG?^YFBGoYxp$fTv&e|sozg>CE}eU(?;DtDrPkA3@eb9ZmUAi zA^JU5G>w_+vu8HxPch8qsd)CG+lb}$1oAWCf+r^vkedFif};nI8}A7NHE-Z-~Eg z?b#oVJkPAaoo8%Dqp6nR2|Mc=ltv+YNY@QH4rR9v4aKB|AOH3uh_cV>Ec-HJXXlOL8 zc1Mx^DI90sdcP`9r`-BBTU48PPv?|I+5>04)uUo6ar{ou(j>>bhM;r`r99`gjjfrW zm%CLBpN08TF8A3XM}PVmvD<`CY`r{2=Z3S2yg1G%@cI|-jaqqHe82s?m~(v2L_Kr! z#>f))9{pn1Y&#mlC0PwsXAc^DtMyf1)JU%O~D8X1Y)RtR8&~tMdpW zuU)vX{Do3obDpP;uU=O$ zweE>_E%9TcTKw)#_r;lKBklhExwZZ(%rh8i}GHAPdV-fAr@?-POk*gHqtH-y>G)QL6rZZe~J zqV?}jeJt23dN;T=uj~2+bh~6u4|sQ0+Z$P?PrF~=jiqaks~#C=ch+&F?NFM7^S)T% z71)=b^G#dfM)_JfE#|CZjhBDviFE{(L?9+D;!6crDc0`OUr?tL57(tMd=c$mA_%q~V|u z+1(xKM%_K&s`3D?E%fUkzNx>v`={Njg6$0J)E#&pe!{KA)e&N9W#U-W1gN7OdN(%E!^9Btr%o|iRsA%Y*ekB9*2M!#NSJZDnVc~!Q z`GZUP4IGqPlGnGesAOPq?f|3z*UM60V_@r9x~SF|@HNBN&XT_b#(<%D|1bag8UqIQ z8&EQIXi0AW0fX{N2Nn+Oo0~T@w|~F<{&|D@4j7a_sDEzBpnmzq_yVJEVgJD;rTN9B z{Ywf<@{6D-Djj6>?^l>x)VJTj0sZn3mph<;Nx#y*eRGS34lODyE*{Xo2rW=LXlTjM zfq4T9`<4vums`|-aDHAXrrY zF0i0F^_GP6ftbtsko1XAr!^HYb(>ZRIFSiH2Aoo=a~J#&%T%iCx4Eeon|x@G>% zMR%wKFWiyb@e5`yT{yFr#979W*h~fQOKU z19JN<>St6gnm%X2!dq^cH)cS;T*!>c8`M84M#+rH9gy#EfNs|J)?#wGx6RJ&4-Qek z!D1T-x}~`T2J{5Y|b(MiGH;#D9xbdO&Pd_rIvDXtXJTd;E6@Q%^S3Kpw z#2)w7y^>b``U^i!`VKzvHU2lOr+60!X(w4JGb!tD ztWR$6$(5QMZLgcXKifuyZoc%o+woreC|SM_Aj^4kg zZ~t_ge~rsma)BmC@88>JU&(`9es7=sD}DJ>a(nmcLCG84{gvG0lZ$=wexH2OC&&Bj zdp-uP^yROQoxg4F{z~5AlXv@M^{pY5il6AFr{ozvd9F{+(d6FF@y;@EeM`3A2U>d3 z^{?WeapSKtN}c2XBYXep_WnDyc-r&wf0eKN*)|^(Cn%ZMiYjFL_*dKfYb6@%_eJNg zpB;~DR44TF#pl`a6D1nn(U`v?pX?oPdA|Jz*!)f|U&*OH**m@m`1T)Y@9&LY1C0T^ zct)6*!1^ET;}5p^QxpYTC2#P_Q+@KoZu=^}*Ir8A>f>+q@t^j|AN%;;x6#U8ky8fA z-zeYyOMLQ1pPb8^20JKwulVBWS6Gjy4`f|l>x=K@ljr&54L&)IH#2rn>A&UlX(`Vq zKK^4q`K(XAT(dXdIl288oEYO4yFC-M@(y&$l48f-YR5mI#j}6*((F;5>x=)$m)~)| z_;TO=clzSD`sAm5@)=Fujqj@&=-VX*U!gNUhR=R`^ko%PeWv>2Gko%PU;an=;y3%^ z>1Rc^U*HZHD!pfX@twmj6{|4oh0{SW)(cwheLcSZ$O-Zy>n3qE_`D9r$T8@`hTD((SqXq_JjGOH8-mAsi_2rZMYW=6w$;mjozs<4tAFIXN?Wf7~ z7s9|XKE}A&H=cgO-rpO4zu}9&&W=BCTi`~?(=>U5)0aMjE(Yt-GW|VTJY}}63fKAU zE50{gD|xBV9eeA1@*A2QeZEu2-wZci$;*B6DxbXFC(rfCjhejCsjTDB#o&v=|2Q(w zkug|VmgOx)+o(`z{K|sGU;J2~yxS)~pvf=uffoXgBh#q0 z%ePI7|87)#ogMF;KZp71XM`PJY+K|;$)kMo!#;VFPkz8BKd#Bq?K9F&FW-$<@(`cA z)+axt$y<;$P#l7xKy8^`7Ei>x+NIXMc(>o<59KQ2Tp6lD_RL-*~%xxk5LT>>WQ!?&^!@ zxlaWZ@AV%gS4gyDuhJ*iXmWJ>e#g!a{WPnf&-kmdTh#gB{;PqEWu+{Z)BpyYWi)#uFva^TjXMu)X+6tLxv#|Wp`BnF?UVl(>sxpqPk{9@7um7uf z?|h|XuRKaV?%UsM@9Dn$RN3{*wo*aKUVSUs>wijqO6WLWvwpntDEW{t-pjv=_wuXc zMLzykO@7Te-_u5nG1Hg-nRfa`E?>!)`{V*mj&6^e?ENRY@k(B($~eje~LfEEx(dC`DAZ= zQt{(_@pox*mDAr?h8W{EyS`3o`HSuk>VA5-n?EHV@X6Ia`J7MQ;FCA{Wbb%T_K*7F zz2jTO=ey-m@@${%JukV{*FLJe#jbrNr}|{Czue~Af3aO(1ukF7UVl-tcYU?kx4*jI z_0I3N`{M7g?R(>qk{@%^yTiv<_ut<2my#E_d?nXv@;{yD4@z~n@wfJdaTCrD>=qo) zPeQ&Ga?p`~33-_o|4odCtF`#HkbkJf{~RZpEt-5ip~{*ZsG#a{~fh$hEDeo>SE zg7jb4>N$&$tZvWt_w}BfUyZo(Vak$-^PD zzYG5=$p6sfX!|wBC5Y$vRR|8#{}1walO~^myiJpvA-}E3Bapu=9FMZU1^H%8j!tj6 zuY9$}$4H+c6+aUz6G!vwjEzz8^}cvN-yh#V({6}0R{Qo}ZM>DBqERHIzuMq>P;tQg zQRcHiQbeY&M^u3;uS5T2-y7ucqx0YBOYdHTKBpPjf0N-I@j*u}v*mzstJB|8Y`Kk* z;>bK^lQA=*GbcwN@SKs1Z(MTYZPDH^A1^xPNw(uV*uEMWnPbZx4SEHXKz^ztF9A-5 z_vD4X`2V8345j!bW46W-C;ePo?rh|-AWopY9*(>jI2rG=&N_Tj7(d_1pUD4m;#K*( z+3PVfPRZSk?raz*aR0X)%w&?`4fw1!J}|zc zHMYGz#z7zd5g&iJ&;G-{^8MZ!Z)k?;eU}yK1j?`a$~)QFpZ5gG@P5lR$rx0BxZ1eX zsV~*P`WeHW_Lu@rGTyg*;G{R)mIoMxPJUJY9B9b7ezzSz!uW~P-XGcJ9cFyuYv0{Y zdZ63+#|N`+VE!w7@hMJuRC?bqW;^Ng8Z8;m`-*+#f8I%t&6W(0y7c8Of%Ydk`8x)j zY>YJi>x=iE&8qzU%xV95Hh(l`94c$7|9#7#&u)ft{F069jes*A@SR?=@onQxC%(as zA8(9w;#2MT?-;K;@;Ezwk|Eb_=j`~&#&}=Y@A?wg|Rljj&?wz@ldV$m}?MJt2oZN8(|`7FNhiG|NGyt~6E7Cp-la@v%A zM)F21oG!qUH)7HE1r9ppWx_Jgfu;|=r5LkP>c{84T0Uu zI;8SIEc>#bh@M#VnVOzh^ngZ)m5spTE6BwH5bU;a>|f9pj$Ut5yDc331#RKzFK7!# z?{ABcb92P=m*CmJmNQTjOaAW!4st;Pgyr~IhgF>r3uhzsN0gpe^ngZ)iw_{!_4({q zug^5>BlS!yHghyRvFHmlJ+bI{%v#4(y87{Jj~hJ^iEuf7!XcJ@S^ps>j!=Z3aEOHy zL;Z1OpIG#Ed7X!ldjDY`2=&GWf$eTN9Aeow4LHQa5jcJdhgdiX)N`>E1Y*(KQfUzjhlfyz2OI*+A{=7j&_pO38-(Hb zNg0WS!#W8%&eXYYHZy`?9}CV4A^ljm7I7io6e1Mi7h)tr8Gce%#A1IeaHu~v2;=Yz z@c}o&RQ!VZHpFau?E9)JBeCpzKlP`To>=q`14}+P1B;y<$Q}p<0>`n?U>mCTa_UxZFE(fB8pX*a z{)WPKf4ENJA@~#I24NI_*6XUg#F7Wra}aB5Figcy+MQT9vw($jCvgEb2>0M8`X*qj z5F3Oh{AAz9fU_O@J2ku;Sn~D^uysb|jac?Q1RQeqJw}c*ei94k72qH{7s5IGtUoF{ z#KL(WSnPaEj&qC?3+FS969W^%k0)kFM&R|kl%+keDzi+vwefbv~Cz|a^VomzN`Y_*vGGP{?(7)3EZ~?8w6t6cPg-~&&;;A z&LUF?#KKtsESzd!t3`2$g>#q2Sw+qpibE`%wHoIEa-3tCSU63~ld?lB zoITV#{ef8YF~GqQ*dV0f7vcbea5;WK2Zw;I*OX0S*|!Thqp(4+_jPavWb0+cCl-DV zFdPfmArV{aFN#AfoMhloxlOUJGv(Z*+etulaE#(`tQO2+NUn8>#b$qCxz;5XeJOBo zEH(&CGIYHS?e&ne9sAVKW_uOo?rY!6IC}kFrW1I<@rv97e?sFF?nV6sg}Dt)RG9T| zP4ckhjosHeuj+?b^sK(nWW{IJt#=fMSU45rOi`SN@F&O)i?A6#S!;R+u$&)>WncCU zS^xQI;Ot6l5ccCI*Qmt8e?ij|i~fwJCl>u%nx0tnpJ;kw(Q}*+RzZQl@kGiJ1eWU= zV&QiM4$V;f%gK2T8w6tEaLf@7-|@=$Ml78E8fS>cAr?+4aB!wdtDGF?_#zh0L`_dD z`btetEc$txo>=sEYIu0I*1N!y$b~bvDoPf9Gb8AA#$AYmRLAkdq?!dqA%9; z#G)Sy99*DmP9?{=7b6zVLh7Bgh(&)VaPStj?{adSenKpq24Gni`d;AdTNVES;zbHK z0S9kW_%Qj46+Q_pHi^aNYveCcoVUoi-NVB9K;wK&T&*}=G2R51Dx3;z-Qi)`Hw1m? zPNnY)oc&#e^SSR`3KtOHt#CQlJDV!Jw99B3PSjs{yc2dZxQ=BYvoa2jFIQ_|4r8t9#>lGdX9BNQ_ z46yV8V%fJs(-Vt+F7?iNmRR)Fz`@nZ<~g=QKIaaX~DcH#I%6=s(o-#G;Q2 zcy@?Ie+h8#`zoJU)WERTdRRDpp%2}s^n=K8%0euhB27;$`caymSo9T|o>=rVfP)d0 z)?8wzpH!2-PU(q-e;06Qz0%)9{sRg(kk8M%5r~C}WBz$^96Q9q`4Cvfd@ej0{Gqbh6#G4f7T42dTfrf_zOW!6II}@pQo>35sej0Fai?TVFocGl@KrEa^z@g2GQw^NG zRpEQc|EY(CUq}8nrEesEmckDJ2e&KyFtD@>vF!Ue^?!B7B2E7kaL7q_pT;4UeGhA# z*U0&qN{d)HZ<6zv(!WcNlNPaXJ|f3S>obi*ES!V{kCOD`F0=s}gbMD$27#9j)@~cxSU5a|hn`e=p2mbjEF2D_ z!f7I>78`^n{DiX&SU9Xc87GN_^9=RQxqw*ohk=8=r< zsCVj?SoCSsJI^PHMV|#6dI}qazW51;SU7B>(66vT7=oX0h=s%U3hl)P!EP_-9#C(u zDTvGdwN0_-lgPbZB~)UEm*XLavjAA0s}Kuk39#7VC7{?L77m+A?C`Qlu3d?R!{Jrz zY#_(E_aqih6R_CXN{(|~O)Q)p8i&m(^+PNiwzXU%5sUr>V6lIi9OoK|SUBgXclr;p z=z9S3eP4V0B^G@uFyHr4Pb~UOV7~98o>=rD;LvZdLAVA#$v?4hihx7xya=Q46ArO( z*w&%nVuMhDpKyqU!?q6X!v>)azwG@sG&bRn)Ge{_Ieb{ZQygN^?*$GuE4^K}4(Ecp zbvUO%6+6UY=MBxy`x=K>I3H^q1E&q^02B7ETB_ zcu<+=GegNUv2coj#m*RwLo6KLn+s=_#vvBY0^ne?O3S_e#b4b}F7S1M(vx6KbEn?y9(K!3baq5{^I7c(IQ*tkI79vqdv6|BQ}_N4@6%~U4pE7cN|IBm(_qYrN+pCwQyPg% zlFT%hDbgr&NZiIwijX8BBuSDfQ)WWSnCH6A-mA85?$77@{C>|L&-Zn&*K42sKG%Bh z_rBJ(uC>-a`%K7Td`3(-_GoAN8Zois>wW$OI#vP5VeTO#CY+6EXI@hyCU#XgjA$Yz zc1^(iOSGmAa+tLMG2xh@9RmObF|p%(&M!kNGsc;i{B4Xgoaw+LF+ogp`~VZ3U={~4 z;VfctB3T^7goAT6(b<5U3fgDHgtGya;zI*-Zh%z!{Q(&oB$RF<3O&N5fe@XK@QU{#DpWBSDE`2?dMf~ zHJk(r-U}r$M@)_#2AEevb8L{q+|xizIO6~l9h`6VZ_#`gA#0LW~5&e;X^&it59M=Rp z0w%8|5flD&z19iC`Xbp1}hYCD`~l;Gk&0rr1RLfS73N0p`7c2Ph`6=`(m33uD_Ao9SZ_ zlVfq-<1>6ed_-{wEp>(f*mns7dfd zz~udC#6)v4a=yR=6wGt|Z(>OKu<$IvyzjIf`hzVyKU_QgiVsQ`?4)!(SeHj|#yuo9z3k%Oc4x@wPhjSEJ{kEMf{=meuq2l~8Wfb|*v66E8e2L&f6`vWgj0$fys(0D1vbJ#OgL45 z38$9DK}3j>+L_!yOzh!+`8bh45s#7XG{(GARcgb8kK?5$V@FKvYXK{Y zKM_rduS1AE9qr6(F~r2a128#n7GPCn`do+!XFuScj2$tt9|ufw7%{OI0VbNofK~Bg z9|~f^DFxhFIdy|BfQg@oi5;g`;wNHa$0>vOi9=M8883(l2b)dC7h+=90LfS5 z2?y7ao{SwavFiaQ?LtiKW@u;f4KcA>049Fonxcw>7z%rRu>w<1#*UaAI}tExJ7Qv= z3Ygy;9-vHz9go3YfK{<^P!JQoAK;#h9Wk*7048lgOzdH3XX1&N*u&9Y3J*{a6Z>kG z9Wk*dv+Rh8eH+V;nAo#fcErSXs@Pq5EJ_qz^DUR&$HPTGQ)@Sg)Fnr{K~ z3~2o(7H(l-S*YgmX--GP18K~Iohn{DA{TZ4yy3Eu`e0-A&UPOe+nIp79%9!^wH zykH~mJ0m7KvjOu>X%6OtKBI|!ttd&Km)-Bnkk4?U0TcbT$giYz5EK1mc0se3r^8xcLXlx9a+z&xaj>W#_ z32BZkVE!-~k3;)N8oK}{F-J^}osN8lgX5jV2QlFUA;*%|2?ngs=r2M(69>eE9}bxK z5Q`ipo`?x20Wi;s*4zkKe-w?y{f=)YK>1t0Gw02QI-D~lVUL(-9srDUCfX4bdk$cH zFAwdAi9HW6Y0D|VBtD1OJCWr}V2w?s=nuF&eF+of?4uE-%GzasO!~`+nh;wy3&6xpq zeMU0?`ON)i#DtG?5q|>B4`cC{A)lFl5EFhh@+Z;!wa8)m7ct?8=P2g98DQs4r1=L} ze8hyG3z+Xjb83*oj2Fa&Q->TzvmQB2&LAcnoKJYpw9a?rFzrQ5IFeA!ccD4bup{xo z^^3F@G2wRu%y)waD7}!wv==eq;3W(34c8`~D?C8KX`18-V#3F%itsUg2?sIZU^f%a zWEKZ8;o$Wu;RLWahzTc@#aY4PASRqx7H0!;O2qC{hzTd1#mPbrvyLDpoI@;`s zi-VYObXXh*76&om;G9O@14T^int=J(X}E`t_<)#ja8Bb-p*iBYrJ@ZJ4$hw>pAi!~ zo{K+?=8Nad88jBpGtBt?+dMO!=8Qy5CZ7=#O?%Yzpg9hJ^%*|;Mz988Twi2ikC+^* z4H(xKv?C^V1HibxpdB%>n*ruyB0~|vM&g5*aBKndylKuvLm?)dGQfQ1T$mz62QlH?WpN%MhtWYyI4@b8&&Xl?K}SPtI4&&C4CFBF zLQFWbSey{#F#aGW9QvUid26jXrG2!DS3*k>? zaS#)Z4~ydmSbqsTKnZ{yi5p_V4+Ts#Bay?j3o+rWW^s~P9K?jP1u&0k%YGIIG2!4` zL^#DP4r0P7V{xjHBMS)#1u@~=XK`M$IEV?Sk;TDzhTPjnOgMNA#=`(W>4q35V<046>dgCL9aE{N*%92w0!doc0zMluH3?bSqk zCCx`nbWG6Btec35UEHo{nlHYdeA9*rXDS}cj8nwKj%_49ASQP4wQCct^S5i)SlTYc zW0@RAOpe9tH$KC`xrlHO6V7xNXBLZtm~etwoFyy{V#0}Jan`aphzTbh?M&Md6MH6L zUL4&Pacr5mv15z<#m7Mj#RfL=`D(;O2j^bGaRba-Me}`-p9~LB5EFg?VE!7KvkfpA zFNg_87BFWW&FO|XfyNq$*V7pLg@Z5JpbSEsNMkF+8)=OBz)7Mp_B$t;#u#T#3XMY% zr_wkaaT<*=hMaU7W865KXbh0zWYAa=F-}NO#6EAOaYwY{g%T7TU!3hU7Pn;wjj@iC zNn^3jE*gt% z)OS&+0sLv3M~G*T&)h)&CB7bkibN}st4yaIeZJbirH9~$W8>k}F< z-vjliK1^CYo{S#wm zNU(>$&p%S;`v&-Vg!=wj1O6g$Zb&ET581oU=Y?c+dIeFbJOqgzXm_p6_qAxvct-5?+!ED+cJ5aIc^n;_k!>1My(~#V5#n&rqoOed@9@-@^<3Zuif;P>;~X!EL9;X0etN1Dw1(d|-n3 zlY)5ALht&`_3#Us8|V?_8TdzTyPWuwB+#&zSlQDW8H_9Y;>aVQ&Gpup)7MQ{^@r%t zgU~O;x9wo@lRwbO-2YD;dhY*468-s`!9OU>BXF+I?>s|3MhJ34Okw8|Ow#}9uzyfx zhS@(Uh=;|W{SuFm-&bSCv`+$@IsJdzNMvJe+l2WK#P+guVp6Cvzjf7MjI6%HdU1RF z7y16t2|CGI6AO=_`!Haxrw^s=(^}*084xhno84jJ^W%&So#`7A>H(Lx?W@~fCj6%I zmkZ?rR4ixXjtD%AMU}jx3fd7-GS4e|a zU_6MJj9O7EFg9@2Z&g1BpgPtq7097jplkZS-etsA9BRkx?6JJr4TA$e`6OFl;@l z6&WEi)DXYu{4XE2!i!lhi`#c6{0E>yn}L4S3cs5t0k4a}EX`Dzv{A$es>NmAZ+P-d z9qtGZzYmJ9uZ3uY66{QW$72Iv^atzkb#_uaJ-n}E4;v{&5AT(;^>%<>1CUS;-tueJ zo73UfcEm%SDr}?>JwM>F^)|qbB3mG#o(ycnzi#dHGNG;)Y@`sq&h7MSSbB0mCVHLW z2|Lb(P-jNOU{Cbqfyeew!xirFLOuEir)t%^3O66vdW}%m6*f|c-bLWC_11zO#vk=M z!AAV6g3e*!qc@$1aeQw0)R&jg-?{YI}l@Ys5FpjQMu^sftS zScm>Lwet^e!Qg!{Qiy-=+xfQxZjvnm66z_!M)c0L>yHM|!~3YD5WT{7{h3Ie|yA8*?EH)}He zojla*!P1ii=h*)7AWpy2!>K9vJvF8d^_IW{#MbixJt5dhA$kjd$JX-!y%|74z22~q_+_-y+YNfZn-5aj>6Nhj z>%-E+-&tb&hrh-4yZ8-mr*{|h0vP|aSb81WjbB-C+!5+YA?=lJH-2s5#_9|pVSD?+ zM%p_aFxx*jsL(_MQ-~g<+b{9U20eTa8}<4zb=V&}VPoqpfyp-fH+ox`V}!8Bg1-@o z?**e?f7pnBy}<#t9{x5|6&}D8;vfD-0Uje{?6NZ`%8Jn&05+oM4Dn~{mBZxCUb~2% zBk40O;xeU_d64FodruS>gp!QUzR-F(`yUA~mC z^o&?~BVqDqw>J#*pzB%-@ozZr*zKjf+VT(Y_Y?o{H_F(0m7r(as@67NJp~?HF97t& z{AbG28`^HZQibQgTaV1z%~wUBrwuyTALcB*fzY39|L}hr@IT>6A??)z9^1bspjQDg zK)u1Rk@j|Lrxy*2%kTW_+)ghysLj8jEIqGw?M($eS#+2w#J_3n+FJv9_!cDkHyk$N z-$nrJ_HF~`T8J3ziQYQk;W0v{&LNnh@cmKL8vz^9JJc>;w!q?-K}3K@;J$YGGAIPr zBgk>ovt;Sn!=%9W&rFH^zs_xX*1%)?X99~ppYd-LOYcHE{~AD#)xE9$6}R(m#=^Gs z!?=$E%qJb%-z4+D>+rLGiSH!e;G;m4$!rJM*R-vd|A_jY+haX>H>kV2; zQ5s;w_}Q`aCbiSs0gLmM-{|3I0oZzO%i7{MhNZU$f(6vp>-GRx+yZ{1w*z==z3Am_ z<994e@2__AK@I5rZoSNEHy_l19)w2R-tjEGGws^@0mR1r#y|Y*65GE9&?EEn1eV^< zc6!2|@IEI7fGMOuzP8ijuK*rYVt-764bKHBO5tY>@Nk%Z#btLd_)SR$#D(Yy0kGRUHG-l}!GWmf3LEk7Ry)0M>U6)+YHj{i zw$oFIYP&ulYdy9%ubo~d=+&dcOo3`~IoeKd5$M%{Q|KRD%C!3Tq1}8MuR*^rEEa(W zqW7lVeCih8c0E3grKbpEkR87w(8GCy6r!g9Ja+slK(7~6qJJK+k@yMQ<@4)4Fdq;x z*b}{>?eh6GBtaFN7xg?@ddYBci|&wosneu?2M6`N3Ey7=YjssWa=cB`&%s6t(Sx-7#lO&`wtSw$)S-W$ z+Qm<&AN`r#_IeHN;#UQF=o@Zy}O`i z5A~!FR}Zz*6K-wOTL5GdKZSPj(}9cYP$C99^C%0KGz} zCxz(gw$mH7jlK>;y~VH*|Ki%|xfxJY77>Fz(Ti-SXSJR74fSAYZ`E^Q<`;4tHIV); z6p_U9VwuoxeyIXI=n`>zm&2a;r=vjUi!mMqB^&f)hzLB#T*56MY`7=qJtCmjUoeRa zIV1-FVj*p&f_JptrwIoe)7yqF5x}Dzf9c_A%EWK-;e$}f3JvfK&2Ojo`VV?R?esdb^kP|hZ`TI0CMMz!y#ux?T@YJ2WcwUg(H4WH(8hR zkbvi1q{}t0=#<%CJQS@Lod&FD;cy2eh9Je5#-B&6C5yc4_E7Rt`4E*P_-jmq6j@7& z7;|{0C?!SBsvzj04PoR%oRi{YsCYCB)W|5V*6V?X`y7R-hc2*5x9!7uqnXSSt!ZYQ&d z&m*iXt%<*i(hWVebhM>(F9uu;zQXo~#O;8~Fj9YvK18xr@jph3l2DX| zO#!yfl*I4+OOmFz{{uZP=y5@h3wqo(J;;f+KK$=Z_TuaSeb%^Al&b4I3q}!4 zbN?@jWf$pE%@V!nqpfGd(af>o>PAx%MH0nQ*2OW&mg!@Y7Ivr1QU#{f)R0t>Sv|Gk ztROavN|fSQM?8+O23BnP$Sp34q1~y16v45lRAGuB{}Z*gSR}QVN|feUbLvEq=cy#w zcq+!GG$!3Lsac5_oO&wxY@$?zO~hl)s2FRTxL%{EF^ZqMQ=-_Jl;~I!m67@xw_fnc^BGWi3{hT0f50!|lM-ii? ztV(0zEjLU^3hPGgPZJ#5OXZ{q@-9$Y&WdEjzFS2+%GjvLmE|agK44Y*ab>!$7d>0Rs^vSN35vh2 z_^VeZTK&fCm9^sPN^zoetvOMeF&wVec}|p;lmvI6wFJ-E$yvqS!M&Fy*T9;JGKitL z{m)ZoNd-v;+eIVtD3QqxN{|bAw`!(Pb(2oA$lRaGN)wq}q6FMa!cGY}8wGjAl&Eu) zr6BJyB{Drj309>EMY%U1TW<(OlBq(obdgyNm6a+oc?UiAPAG~_5f-G2WDa+Nq1X_{$CuFaN8X#x{hswFKm zO|h!kQk46JO1jz15yXEHTBOFT6PY(rNmZXL4<$kV9urYnDfrA_o5-|~!8s{{yz|gz zEe$D-mgWLVOZz;>;k-pE`eB?TFgr)(q$pN{0_18QgAHKp6yV_xk2%)42&Wi{p1l~vW1wH5cvA6=<0dwKCKt?h4CWdnB5f(afZ=jYH72@t0GobAmwbSSDVxmM&{Ft9K9M* zOh=C3=^Tz;mEc$kN3T+F>=;L{To7~2QmQIUqL>rHSUJV&4;;};$m6_B zO0+&xsJN*srD-iXxeHpfODK}K%@Lf?06Z4=0zOG zC6F6zDKK}U-fn@>YXTfye@GML7gAq0T8KxBK%t&0 zP7|1wQ;^}VO_tC$vuY|MtuQsI3dXqXO-f*zO=YFqq$Ig~vJ}bgrbM~%R9R}4xIPv~ z9+j1pnUqxZ(Xuv4kn7FK+L*afvFd|mrB!OO$kYY?fAIrHAngKU-38_d7h!6W;FuHi zbiPm|(+u;$BuX=7NV1~qC(HfY1ji0hLsAgyZ4;QbVsXR@QVi&tbo7X3?N1jRYsKOf z#3GHZQBM(>FMu_XZe>BTz@(l^a&G2`BLj1DDMd+h>j5^t`nHSik)ha zstEH*-ZoL*eX2l=&9;fm2+rFm%BuuTEsYFHOS6`vrCr9+(wR({;(3ogDlc7>S3~Sc zBC{KCO^}z81hd9|xHi}W*Ad1kiVJYAkmqRWsdBXVvnefu0*cc*XDCX^OW<`Wdp&A$ z^mD3qvT@II*O{C;S$ay-7(a(<2b-~ZW98tAjJ}T1DYh@tTlMspc_XUtDr$pem1Wdn zDK0l#N-8SbT8ex4ywnPqRhu{hNhJ=h(H5x!m4LfGP{Kyn=OPDYoQR; zT>-g@5wt?)8Jy8eI>{y0vgW)X4!jnE*XGR_4e%PTs6;YF&?;q4l^yqxl%&ACp0Y?2 z$tZEK4k8eD0V3Osk(GfKxm#jC8o-ZIN+4Y%%u5r+x>D(5qYhh3it?NAtZ^{*fCp`i zg)zX`!WbK@x_K?)I(4Y4Mo;4EVRaDm^T6}C3$5+HD?Tgq31k4%db11SvlfVtsu>$~ zC`OW;3w&qJRZaBpnpSMfOA_VX5TA7tSi;at$P-a)lcgHd!sM&i!UDL?d`4Ob=Mq5+ z3(^{_(x{6s$^hDB- z$7XcC6{HE`WW+rLN65g{0`!7eTGa%LZ6fm)>`C)-=wX^=J3S#RiwFHq)k$AklPbj*Xd^<|V zjv74LyAEc`SZl87XssR6R8&7ZN=hbC+IvPbuym$T(mT9Q_1d$3CXwdT6&|EgdJW_vu3L3Bq8!Mxi0{5svD zfTHs@nlYKIqd3-Dnv#-iPsr=g9yZEwTW}`a8zdIBzghaUS_aRPzOQ*#r`En^T=o8F zp=Dod?-{!(&u)FJy@O-m6+V5{7jLB~Cnb^8LmU42yewv1tMB$P5!P+b;;r^r2g7%- zXGmnWGT<7~(aWjQX{39OdmotD=gpJ8rFm25hW+(%*Ys9J^|z*mTYER`qu`ax4k_zP zJqBCpT^e`UJJ^In&V7;6yQ(N%#BGZX7uJ9z$r!F;YJch?l@&uGskK9r;`W6;mQ0ky zR`BHPW6D}~Y^Zv(jgDx&OO!{{4I-on2D&#An3wVV}fE!ujfU|A+H63H_|9t!(V_>~!o??fXJ> zDC#FuS_okFM^D(CeSQCUi=Cl%$X_q^c77JV1Ou%{wDS*@GdpH z&=r^VnB2i`Z)fwFL&f*A*>*PmmqWk5z>WzU|NlKc#D8{PAx3-dPiL)BgFEyqs5x^h z|A>{Ni?QXWzeJK9W8|fB`>0LrQXOt=qS>X`<;GdA{fP~V#w*X{&NU*L6|*Vg zrj^fVnaMjAjJjI?K-1xyR`aoVZ}Zc`^`=g>?tf3wqTzU5rqZux#azYrsj#%i?0o(c zhd%P}$FlkVa{l+mhn-ENpK*`5gLPwORQ9tNRz9@p$fPSrq}6;+#ioZjpME8JmNaC4 zjcMuR)Z+9S>%lu4cL-kTM=a+q{2<)z{j~nn=g}ki4?kR2p7UwK8S`1fyvya&jpn!t z$_FTI>%7eV)w6`nD^*(_jeIXFB8xH0W&8G9I{q+Xcv&%cZ*Eil=jM3YA-C*^)!7inf;}jj&%XZ^-wTx&9 z+M=e?L;v&RIZ_GfPo7yk+B?ullrJ9^GHANfkbwTqXQq9Sa2}-R6j^84?4G`P?;5Y6 zYC)j~H9o3eIGSKCwWd(BEN;Jt!pjZI)J84Y8nHsH{OAn%qT>z66pd?wI;pxn&^K?480&q3?K2x=OvvXq z+GBi zq~Pb!{Z2nEHd?Xb%jS`@W6p|f1^2UmX7)R))}rhF?A^lYV|Eq{A3JBpVcpMtj*XBS z9O1KNWNwO<-(`z!S6@g<=1V8Ul!At%-}UWb$%XO4;*iYP;9;hoG6zR+PB@+y>NHN@ z6!JEW?`P3Z`SfAsSyr1}?W{hf-|o4bpX;%Ds$|j7j778i4_1M;$oULPRL`G#^3dol ztBzkfHnd`oT(d3b%E~#Z1J6Xo#ZLJ8pMnD#7!vq;iMX`K_#8`nJDX24{^hV^!p8r` z=il65=K~x6n;Y;wzqdbs{_eUNV*@v(spSE6FOOc|qh`{WA1<-{h|ZxGu0;y($KTmH zaQf}|{gFbG*uw4=-j>mObzQau4jj07-H-dBvu*r4D}Vo>!`8()jD4SojoI@Y+s?-5 z50-z@p&9>j*l}ay|3Akk@agaK6qi_R7kq4(nz}nbPr-LZ=Y0!;pS+m4+kdC-cf$vp z8paBySnu598R&dxOxYv%(?^P$dpvHg{#F(_(xhPJo9(hInvZS|o42o_EZXyR<@38F z8|i4_Gu+tsCfJy;|A|8@{j<)$od3P?8TkFrxl8gFJ`_!*D}Pp+67j+Pwr;upo$s3^ zWIDu^r+DpfK5+8xmlb}6i;q|FzOAnqy`_g!OqOk~@{erUE(+hj?VjdavP)-S?GRf_ zOS6i#(<{#m-C=vU{_ddy_WX>Y3*;s* z&y!jEQ|0cJIpq(Vr}kHhPC2ve)=Bm;UdH7arzcqrDb_mu_+h{MCl2RFd>?2#hJV?0 z#pM%+D%Yg>OAfr?q&C$l;f=nc^}^yyYM$LxZ9b>{D5*VX`gw)ZUKiW6NCou`%~_tu zb}bpac3wOG{wWUs=KsI>&tBKrn2eE0uVsuBsnK!sRMj^0-+SYLR+s#hJ!+43&2@2l zBR6kg_Xn2sjw|L)>#Q3%Xji2AiM2Yq<(l^{WJ|uP8scalv1fJXFNp>3d=nMp`sIvI z$Sf@0aagKcUN&S{$L?!~mqwmj+Qq@~Yiex%kmO5uQX~fFF1zXV%3_Z~yg^pwU73f= z^9L@oYEW`IHh2xuRXdriD~EhXXA z(W$$Ozi2E_D_rgCEBQjgIDRPa+{!tJ^M+j8+gI{HK#)>z(I482V~BmvjE&jji*09P z66b%?`IkeFQ+C|g_}}>a8y|K)u<`%)-1ula#LZ>Ke%+YTNd197BXsM-ch&3dyn1Nl ztkTWY=CRA?$qItYws==7R9+H^))`)w`F=@osJ?2%nvxfHj&HrUzbyIt!m$U=K09&Y z!+^cYT~;2un6c*4djt8ML;7Y+W4nKJTD)z$>B*s)|R8dJp}XAXm}&)@x|)S*6>@g15hkNt*4j#lX1FWS`pxHK(5(ir6SyGo-Wn z)kV@y4cP++lwCjM-EVcxn6fF;Z9VMm?%&Pn645(;%6V#s>e4;hRI}WNADWA$6)xtUWKg18`ZT!A5 zmiCxE|Nn_YANluV+5CSw|Hg-%4{ZEzZv2}Y|I^QsrfqvX!~J?mapGysTlzAm^FsBm z2^tEozlonWCi~5bOR5QaO%D{FJ9Iv8+PwPQ>-*}|%wjd;^}KH<^_4$9X{k|kw&n%% zEhbuczL%W#w#ub`QU0KQp8F%>=9%A8=&#VFo4V=5QltESpN3a;Pw)Kfkw_CcxY%6`U!OI?@OZ`@&4Z2g7u z%6;cf^<*vL}g+M|J$(QT5x7i@`5{Oqv^brr@yt zk>ydTk1ubX8|2K_m^9EP%a2l)Z8=~h*EMa(1y}2N?|QK1ig9Du zO%J^vF<#*-ES^5E_I`9wJ$SLj@Ti3DCq*M??_9Ro?eeI;RJU2u&dpb|?_JlJ`tnSR@}p}nz3+!kxTJJHH|L&vVb@!` z!YgpFOWvzbjZ$aW41WV801_y{S$fKP_1JiM(`|w+ z%al8Qez?R=Vz-s_`VPSZ=f#Y<{3T&_ZO{Irc8(}lt~8$3sWKqa{ONc5VT~JeSEt0p zq`sFo85p`^>CXKHu?xp%K3(~4hGY1xDx(9JT3*YmZl5!-F!5IYAlsvdV$xfrR&Gx$ z{L#f|csE7&1Fjpq{3w$oDLscLj|0j|yA}7nF)H8|)}Nc4u6}XP$X)4nE{i_D zd*j>lq)(oMlgIUe9R*jg{_En)2C_eE>J55V-Ew^~*t({AsC=)u{MoMzYw#96b#QTL zM*Yd+;@l}&GtVYI^J#c6D6$9Nq3pWB;PY6&$!yWMLsKNex;3r&+_-Vh$bzx+OrLe+ zr*GcV`w-S2?ltDYln)c~r9zKRF72$~`CMDh>+ttG)}tPV<4?p zIjmvwSBv9M59Ip|+Mo6#R(yW<8y$yT_dD|blzZ;F4ZQr!)X|&komW43d(`d@{&X>A znfB)XPtgNg-ifIESB1iLhi}}tst~z&_~xjd4Ol-y^Q6-aBbV>tW>4!@r6$aK_)h*! zMHl;@-6_|8Sg%+%yxC`SP|SwM!E-Ecy;(0|WffkoXudIdemMR_5|uwTc)3yMUT%S= z@uN$$7mX-rxSALtx}PUmUfPWHFSh7EucX%VZcbmO&@sqO;!s4N@==Z2!?&GkXvF$z zUU8`X`qkG~&1@VnXn?8mr)M4aeO);9be*8b0IYvzk*YcA;fumL#Zx<#UUO74s7p)E z&EI4FuyOiXtj|uVzHMwcpkm=jIVn%Q6_N9!Go|8ve7|t@H;Axa{+U6HbNI5wozEUv zlzaGF(2aAt35!*FyP4Qr!=G5Bygjl5Y@$Ye{kkuyOP-8t=t8}%+*K=X4O_a_>l)Tu z@fF>#e2v~V;e_oe*9)R$-{l8s8w}CydrE%PajbXm``6jG!NVSYyko6qAHKl!dGE3M z8B&dx=kOXPW4&q0!@J#M&n!Xdk)ovayGx(UrH|e)~g~G7j59WFPSW_6j=C3ta zf5}9YduscU>Gf{5*$Yo94zw(7Ho3B@k9?Wno>>1%#Jk-ecpa`rH3x;*Ke+dNrk4C9 zu98<}hp->`Q;F2&Zacs3P$`t*>OH)5Bw)w=>qSROy|u576Aa=X#rn5bmuqxvIdD!c zZF^>(b@S4)O&=>YBwk65QkjB3X+;gVw=i+W%O5wE-#AviL0LhSYScaZVN#Q~o!ebc ztk2fqe0zV|!@6RnbZwW*1zCG7sogyd1&bSh_AA5s|I^Rx245_Y%pX(P{8y>gkR5VE z+|{-^d~wsd@<8Iv(*ALszYY`ne-L)qm0o^0+g74eudZI356eY`?|0i<+O;q^IqdP1 z<;&m2{(NkH?@sI**?!AzH6=PZ^c|nkqC5RZL!dd=zdH41?ZJ(94couWAGPi9-s>M{ zTFN|Flwz?{bNKc8VS65FoS8jsqUo(OhbCthrZ#?-IJaBF&grEn@{YlsmlD?(^zv$m zY24;;ckn9jz!KLQ?ljHdmHHFsUaB3x)#qz&%kGj}dgdpJ_Pdv^8R2&OjoT*Q=J@40 zYwf>CZQnXSXd+qp& z=8dWAhI7_-()#dN%H7~`^u#45VNZ7+>AvC7q+wO*&%W+izGhOQX(e^N=k}f>{ADvj z8uoP&wJ3C}U8Zm&s_FUXxaRMH8wyvBSTf+2;x*$B`pJPKe;mws>@o6W^qcP~{patT zX(930(8)AG{@zUPt(|F}LqB)?AQSF}^~G!NMntK`Kkv~0*onGJyAH+Ms4u*_Ld47KQ&F``N%rl|vTV_r{+kl6 ze~>zRZCax3c8=Yh$Oj%n9!hUG_;}Fnl1r6Co^#I!PAfF6IHa~@dznDJ^74WBe$EXi zw$vHj+Z5~hWwUXrrQ4t{ll6|LD&#nvUBtg2yQznEzPs*=Xs3FmdxH$`1oP!HmrdRJ z;-*apkEjka#+WZZacR2t$Ki`t2B@rj+H3p_?Pk3=?yh+y#N&OEYCm<8^HaP(>~Wjg-JrB_Wr5q|=(!#Tv&>f9 zZGJdYa_s)Mu34|xPdgU``E9| z{e1nW_+>6I*rG&DK4REcb>z3$k>O`c!ltN2B_wk^A_toXzw5oT;m&N{l=70zb9s(k zx@eDgSnR1hB;-^}h})?DuRpVFvytL2y3^ZS`Qxj6>E^ss!%y+A)x4SXY~q5YyZ$=I zk9oRvk!4d@^Z_TA=MzPjvrh+pIJ7%&RnJ;Z=ki|5nj9S*UTvr!d!cH{bvymloJ}*5 zJ;FC{o_$2-c5&ug_rjD@TJ>994!M8poqp{=Vt8D3kei|GUfE>h?=!de-xl5YG-!o$ zpA(MSpSN5vk>nJATWE2g8ua$@g{`l%^5Uadb&~W+9faYZyY?y8Sd?5JvV=8PLEx&Y9mdeCE`>zPE?&2pmKDYN>B5a#!$}! zmBT{A+U3J0c9uCZS8lN4{u$jj87fnkOOM`3+fe^?#&PW@%WvFUAPUZjI=Xq+B0SC{X++V$g-5;h*qe%;Au=(z7cD#pb3oEEiZf`9qE`JawY z?xv+`bp0^cK3W%tQfm7(|DO&#fWNtVBL7%j!T>@l)iqm&s{uut>mh0pzj7z!&|lu>nZDcRsXErpkpZ`*9cbie#zOdrg+Qo zq{XYsjER*_%hEp734-3-j&nRe*>r`HuzS>T!GPU=aT8y*oE<&*os@gUhBMlo!n#b7 zJ=}ZXz0;1iN1ulGigsSq?N!t5=@wasn=VK`>+;CA%ra%@p{Sbrv6|BQUsv|k+plYr zw)jqWm*~qyE-rTzWG{WH+E(vXp}I`*rp)q#lj@B7>?k@vD58&+LgmR`6QnBCBlpeQ zd#>M^(*5}-F8f+PIANn~^J&nCoTJmqdd2q-@P2X2_V}syw>GUUmf93pKRq(=>57|6 zJ-;sJ+{yFqQtCFiu{2U^^yDSsvRC)l)UGWZF>KGQ#*?3JDjzbdS$*N)#`CTLwTaJX zDi;YCt&Lu>y>Wl-)D=0YcSc%-`0SY3?~A4KsK?K<{q9{EwL(dXYc}SZ?Rv`%Pt!Zj z*{UgdYHFDEc>DYG*8Df2JV3LNmliIqki?+_2In6G;>qUhw z>+06~yRTdv;E{joX#B&dVO>wYP1P$d>1jFdgz}NMC)HLt#(((U%Q^Jb{f#5G4B9B& zqe7IUw@GK0$D^|m3%>t2m#3q>{_w$PcKJSIQUk`N9F%FvGaTRjnSPIbvb@662joZ0 z`T4c(Nocp*!D{n99GQ2rMkRGX?eQKP!r^y&68mUmDcf@AK2|#!n5<#)-aT^Wn1peK zj|yuSe%5jxpg&dOeqU4l&h#^1lbozm~*?%4}1r>gB#-#@;ACvubvRqVEH!>#%|r-R35Uzg_h z7-ul+yXjZQ8Iu;g`QTCfYH-|~?NX04lg6uN=X19OF1uXeAD=yV+mO%iX0^Q5mhHY% zdd$X7`6i(jjrUY{*gvs8=RJOW`N`@VSKqFCFk*iGfd|rg;bS9iPwM_j@quEGv}D;Y zB7t9IpO#PG2PaEN+eGav`X4SjT{k{mvU+I4 z{;f5Q8spEM4DdV9SAT9_Ud}_y`)b3U8y+`5rI%jd%CT2pv_0l@kE>lfOc?KCIA*x^ zZY6iA1Fvql8!TAHS$iUP&uxSL4zWs73nWC+Z~t1heR1OZ@mjv=%c39tG+a3EQL%@! z@bp!G-?$Ma#oDe4hVnDIU)Q#E-E=$e(9y$co5SB`b`Cx9kz3!{{48&iy63^I)51Af zEk`=@^tNgYdKEC^a{1&PdyNaOb$f8;X{i3OuB!LkC8m{Ly!81~p5oZ0Z>*0di82@8 z4Q;yCT;G4ol{iP=@Kf&c?g|asrkOSk9Z%~NZS{2Vn#ns^tUb!W+-Y@lx#{A zQjC%@n5=U_(X`W%IqEb1`Z^{_h3}-_%gEu0=b`&!)hDL)lqGC$?gnv1hfO@E=7Dth?k?I)Wf)6XSyr2?n)H?&mUmKRnQWi(~)<&k|X9j(Ut z7_GV%T|6yq&oGsS&U=0&Odic&<|d&pJldh4R(JW_CS@Y@s~Qf$~HUL>)ndg&W=mptsd6WQ_EJ%J29`5q|-3%%@;EI z4mub8?dNtoKfSuZS*xdBE=igcv$NA-@1F4~4jn3_Cu}^t&Mxy}Zry^gNpkU{;>tGc zUN~ZUpIo>H6686vvo#=Ij2H=dmkOM zc44{t$YVb*?LTolc9XNOR(R<+(++{7Yck~r8>?w~UW|R;HN#$N-TP(xgA-11yf~xR z-&?ci;vLyOjelMElqw&#C#9rwyxNG7dK0fMm|(ZT?5X4ctI~H<-zq7}L>)5>b1%*8 zA$6lPZ%ww6T>i`I;J4ilANx`9PGwoyJc}T|1%*ZmBc3LftV|eQY>{H_Hh|Mxg8T8^ zTR+_?s^14)eXiZrb!1FwpIP(PW!n24m9H;~?U=lE`lg)ngIr-*j>ynCbdha86ZJrI?Bb-6?JwR;jZVLEkdc(<1s?$sLSQ8`li z`qSO77xppHo!ZU!rG3n~fjw%3{pNRH;oEd_(u&T)i&Zbpd(3|~dAj75`2*}$97vnm zJ?EUd!n4Xgt7WV29q3bSu}`NkFz~~m5wZbBd+i*DtU9-;^iyTA;bgrhO>5Sqy~w%O zC%@D8?oJ(iqk8SWI%n&L>gNu&PxkvK^;^>KyLqbW(z(wJ_gqu7nYy;-aH!T;muTbR zR^580MKydKeaquV`k>}r^L@;IEIr%(_aYALpNBXsuU zcjp(E#*Pfx-{tP5yb%FDd%cGJRb@Nds%Az}c6ekM{A|^*RW_01qslKIui$4yOCCA+ z>gxlO-RCT=#`#+0Dedd^%va;A+a%-9MOml$`3?21Mpty^_IvEq%jAagsZWRAe7pKg zefwmkUM51SciwDcs<>*Xs+>vPru7}|m8_!XtMsf&?(fxqxBk(sp~f@MG#>3}?zP76 z($CsQrn~Y+CfaTCJ^x1O-QtlMANP)%J7B5&ilSTNWSpy)82M+N=x&l-7qWZAiO(Ge zEHIAAyl>w1R8gmEeJyu4ZvLKQdoCtw%z(lUZu(0yyv~1&Q0W;up8sgnE_tOjyVUJf zB9^YpG+h{5GJ^liV-vSwKz`oA$u2)7sol00pBJ2YzVn#kuO%#t(83Zm&t0mk8X==`g?OPJF2d9p_;N54T_oBK^Vonak%cc{tfgL@d&LF=xoeXCZ2HJ#@Dv_KSb~PS;2jUDnlj_?H8kJb53>7o~#U{ykLA z6f!zHY>!_spG=v_TrsYD%PlS_>0kULNLyo_^qiGTzZ^NPsJ3+2!yY@eB=jB^Pb!j8 z+$YmwX1aa4d%2qPs_0YiGK+g)qoDjym7SUUO!G~c&Vz_y9=&So##YGNN;lfhR~g)V zU1Q<8MeD5;FE8rSMexY(<*3E7gE`l0=JV$b^zZZZS)x+&as!h9a{MS^C|ceIK6vZCK?5&e(Z!DkB^8 z*PSijHrsAS*Mmo?=ABE7axKrrUe&NyjtyXR(*IgBdfoo4DJ5wQr}Xb`jpoE23C(G2 znt9;#fye7dO+9LU?om)*yQ>|1rpt;>9PqdqJ)fgui<8;zDKnsqXA^@RNkx zh9Jic8Pj4jT5j$9l-d3H^2c}keA~VB#2J~N)(<8u>@d|t!fUf^*Vyum*{>Hg*#t8F z)Vnt>8aCsoy@h%7?7JT_mJ2g7x|`Jv(0@H>i{o&0^T_*%@8KT3b*JU*kTJP;JD84ow6?I* zG-b#u$H;--T0Vyjj?t;zV)iNNy2G=e%HAARL!kmiBnD!uh!Hn$F zp$}#SJ)P$`v!b&8=J%%;79Lr-_C4cITCD%oP8p~D+>}q9bdOoCur537K={6py3j>u zAB{cyW!S;AgwT>PIWaG5nm!&LIPqzUYh(G_QEz4}w;6O_u8%5%39Vf^|x zPET4coH8>1^m*0W;A2PlQJOj#lTHkh58c~iZRm=4o7`IY=e2tZ)iz9RKH4$lo7|#D zTF-3q>k`j1Iz!A(own_g5c1c_oy{G#op~@z_hIJx@87E-HvT`vy#-ViZ}{&!LnBBdCEXw?Eg&ro(hbre4I(8a(kQJ+hja?k zAP9mWp#svPpoB;xDRO`re}6V>opaY+XWez*wYKcfJa0Vnyx)1|-P_qSRvkQL_g<-~ z#0}5Bybbr`hAHVysdD*x6Ax)))~1txf}x69MNf3Ld`cRc?UymuER=7r(t+msJ4x{| zZbO1nB}&XWi+N1hYO-lX?=u@8y@%tB;ZI??z4$_Vm!_z9E8@quhbwrwC z^?Mzo+LgE(B$m+7yy098)1@vOic=Ol^v{k$w;MzcZPXMT6oUN$m|ix_#?8I*?$HXt z5X1UpTzH?$QZ_|7EcpucWHQUshwL%OIcnNNuJiIODPjb=H$(I%8fvWx9K9stXSQ!z zP{aNBhdQghwwdADWT!F(e(vbRHrPjuwT%|Mf6hyvg%qbJ6<|+nX&==TsT-_Ur1R=< zT0P#ZFNmQ~K&)(H{Ii+!9rou9S!9G>4(=q_r~H)LnvdzB zJr(t2j|m}#io$VfT50O&ccsl?@=sp<6N`5;-zo6ke!t1_XeUOa?rr}y?=Bp*Nw^<( zN^RUdx=b%moyG-S-d|Ey&%2Z{J2h_BQaNuwV4ki>#J}>(`(atRoN7EZ*#oO7%wsQN zSqt9puj4*==}oBLa)9 z5kJQ1ef4Sisrmz+KT-+GlTW>6ey8PRVZ9TH+`j|QySI9L1_Skb<)JG*Z^aBMo|4Wz z{a&cP<1efGRLUz};qr@RbB4nwyn|cV0!~jB7azYF^6QSdY4pwB(%v1y=J+WquK^_UD410`yo5f`lx41ch2}IAj`* zM^V-ijbn^`@~6KF`$OzHFZQu=q2Dlw{uhUo?EGy*nY$6lHY_2`<$(s*Tk+>=Ey-tw z9>v*2(=~o*>C4&`1x1e2yYFImTh{2SW}e*F7wRaR?~-I<;bz^=@b~qnvW~q^s8t;Q zW_5;8vKUD;Sq)1)D-7eO5s8rbe56*w@$o}j=pyjPPGfK6+w+ufQ)xHHQ{a9GFrJO~ zx{nk!T>Dxe9yc0hi&CkDx$Rc>Zk45PQQeE?avZYfq%FgJpRYPEjR}TcU6#_1nz4D+ z`myf^kEV}Y^#t5cUyS}M3f%3AajuWozK)@+m2QtVR_6Nm^kdxC$@jFm9!+BLSLegH zYw=D8(XF=yJZ{Q?J2|=q#`x8~dtBedeNUfRby}FV_wV|~&Tvx)ubF2nYxd5kc!G^F zxLOt4dhR-Zr~P&Y_7}7HIt(#Qr|iYX0;Jw-->$E3ALS~4p!ac@LWO<^>IP^?ngPaW zza;M7676^iY8q3KNYl6Ux^B8O;;KzaYPEhAW^&QwCB^5JLw_ow`xX2guQo8l7|3Mk z{2Uoo>EkV9*dIpFjXRd)HjT%jq?J(($EtOIf3aj=6Z-G~#wClToMW*<+5jKJ)F8aO z5i*wo9+^J);zwp=#dK%1)SOju<3rHDyuk}dge@28=~UdtI@aO8UF}m za>B&|-Y-v8Hua;&ZOatpp!ezJXRkZ3lJ^!k2g zgK`hYRNG(>Ri^`cpJ3?Jtfkus?9VmsDt(&tXDs)z)AwkmVjHWnwim?HGICxq=2U9+ zb6)>BE>#&=nJbj}H$6t;nAuSzJwIF|%9*HEc$NBQm6`<)+>hgE#_=b98{}R!V&l0* z&CvK=hG#kN@omvK8NVgI%}xFq?9{j*%~(llRiofe%CDtw*lZrE++LTunUvF%!*BH( z?#E5vyi$p(X6&-|K&4%y1)h^#=p^3*TgwTwUTqlx_C|-{PO<(ByS$q+-(U00OJw@1 z9o(Bce2Rn7)^b(8lIg=II6hZ>c@H)nLmp?*B2!+b)3zbqmqJc^^S*H}J9#`E-?{Zz zLU&n$qYa-cxk-(SzK}(P^%3n0b#t_y2l0bp*mV0na6bk(FL(`S(ngq*1+Rtkb7xD` z*c~r-C1Uhwo0S#o5rvB$Z@wHU7-!}v*ZO3}vqjt#|8QY>oUXr$JL%HJh z-qUVEY7(T9X1?V#kqC7I45?`~h_{T$^zcjA1$d)RA4MwKy0#M;9c9<2g4uO+HI=c-oNHj8yTV`(z_Js?PGOvw{s<~E!ZEnFkI8Y z91sJ$=baOO*bAFP@wluK2CB`5W+Z->cGG7}`dR8Iff|qYbeyD~M8{c`=DdILg@{22 zc<;e7U$D?&3de`vz3@o}jz#i2iu>K|LiVy1SJ)c zh2LYP?(Y6DR%D=Jk+iS6+>i34KkiGHE9_7B@DU?^iqp@^hoIP@&I{EyB2yl3Mh6$4 zv}{c0q9f1xwk~n%g;@V_rSTH<#>%&x+bp$u*TZ#(DdERu?5_IvX|O+bWkzHKcW@Ym z)v%}){QHCCIJxgkV%VlidR0_owA=mYG&OG5bspmr8nWL#3jI-CXwl;0du!2=)cl=) zIzIc0TDYItkfV|3Isrz0O?l1)PAYqp7}>#T<{rKodUU9i#QfgR!v~E}y$%yg?{ax# zy4(C3%L*J@{BmCl)d>E2g5~Eu@7t63r;@Jx zWpx29uUCEcYM2$^8wl?>^0`|tL8VSrQN_s7zA!q{;zO|iFaOXL=L8x*>3=6L>}{EC zBU&fct#BMrTB04KCH`<-toc<~yrPg)WXa9~mfC7Y{EODcX|m+a^}C#{f2LnX{!pen zeO}&asY6pJP4V9&@H}~}z|S3x1?dQDcIs5N+!@>?ban@)42F)Hra0KLuu^a`GQh?thrr|uBi;iEW28L zI5e<|sn+q9fwOEWKEHUwHmLXXpy{qK;TW+mAHluHsa@AH`dMq&V(@O2E-^AUdEMfI z_lw)7aA?l@hc%aS=QYnDb>3B1jCu{fiYZxrhUr7D4-<9$I!mQ-^9?^NX}U7Mugy4K zdlLP0hpwY^JG{7X^o8vgc)w^J${$u~Yp+(?gxvCbXcS?Hr!viLRynU z6?B-#NoX6E7?f zwxR5<@i-ludW*N0;C}w!{$AhtzS!kQ@`Xj_=rfen)u0w?=uQP0TR7+S*jg@m0cFEU ze4_mKjl|>rm7Bvo6OE(a+tcQo4hQKI$Vv@*BCp!*yP#zN{UHs zKGw#DGf&KAe*~p23({A!&eB-Y-*x&+Dfun+j_>$A-P}ur-}Q;TofPFmVoSTz>VI#2 z$;zh85gqdz+$&YN7dOCF`loq5!6Zzj zhja;8zD{oEhHju=$W&|fkOptxE;vdjAoH~xw*Q~O^{E+-`5&0;ZX!O&Kj_4ZbqNIv zt_|mw=Fsnlm<{nR-*&O|>P3y~<2Fx_BV3|o>T?h?nz%MnT#uYb4kYiV&-bZvz8R_M zh%9%OKwVCMqNu_@q@GTF^sJ;Cxkg(;;!|et2Tg!H1aN*=wh}Wiq&wPy-ZE;_c#BeO z?U{pPn?nG>YNkyu(u8+$4|6B2ceiWE`yU3xf@qDeMo5*jt=t?oEtu`?nq6n^?LAX* zaY>z8Aay+^Hp~PJY6E@hzBc_a@k)y@L$-Y=#;H7gLxH~V{SES+D6s;$!F#pW;*Yq& z+O_?~se_4nR;iwDw9%~jyPoKUV7)e)O;nywyIL$*ew7y7$Mo4fq=y(1;cHFLwzC}sg z>~{Kcc-UkxcUn2AN}Z_pAjyl9b;JMZ9ss9@?EmRL0H^j82Rb^5h;kpU_-|o4{1vI; z6&U=?KT%fJHIL4&Uu*x68M9@f#VtIEdq<1u~AV>u(S1P zdli#)iH`hPD!%8=gZNC=kG$Or2iXY(1RJU^ojsy+$Q#f`;fp1|q;>U;EH(vwC|OD2 zANQ$Mx5I>i)AoD!K3FG(_F9wtWW8c9G$T2dBfvG)WU@OPp?`LLUTkBR|rDa(3BaaOIG>!j6>?l4psm96nB{i`^>+QeR#2)j4-~XQ4cT!g^dnj7&Pnhx*Vbw8e#1d8s9j1G& z2rp0^oZ1ho>ty2Z0>Mv%WyDFz_3VlF+P<&0zn1amWqx^T-+nG-9>t_Z%kan}%e!#3 zHBi8;nngvsm6th~_0)d(kNf=!qf)QFl^;8lg*MWAU#?%>2z1|LoBbksYS$IN`*$6M z1#EgrlunBOAU(PBGpCcT%D11|6lbX)eV3$Jw&Y4lf92YpIU2t`hewhs8~!SiDQ{9u zPTRY1Du{_I4e`EXPak1E=>1wso+X>eibU3{ zP*uALG>j;Gp;LPn$rS>UDZqchlfmKXwO9MWu5*=5s_Gg}@=RwRRnSaXc0dC&$?~MX zAIgY_$IA?TjskZxEqR+MW=`8T&Cd|AZVwavAejDT7^(k*DPEi(V`&iQD?jV$EuR7W z$#u|3fV25yS-R$( zFItxH`71qADDHhW!UV^qebLqilm&*f{+mP%l_(emKldyOQDhr%+9H!3ZF_-tWpM2T z)lT~-pM5>_D=7{6jqjh4Ax0BiVQtJDJ^P;Hz`h&fr}ifpRwnODT-QPyzmW$p_7)IF3(D)~p&z8%7kzP?_6v*enWLB!Dz&a%-_#*g%@DP@u1nR8GH}m`hV9#|pFF2+aKN%@&JD&%UX^gERj2$~ zM{_SaY8CNNy^iHZ@`&rCw3Mj}Sn0C2M?CL{H2^jpO;F zDzw2VX2{|GpPt;C5uYaQrx+`{CAE<7@8;v14|9+`;H#zy5G-yPmR)?a^!BF#?+r$O z?}~++-?dy@`BgtuCQd(j^=A4Wy28>`E)0dP`?bj7&h^ALc|%vXUMzcqjQi5z5tq?^ zB60kF#=BF6O7H%JU7h*TLcv_i71VbL1eff0=fu94a^1>JqZ7R@U`)fHY$xkQRIa}_ z{JOp^o6$e~TO9IoHMw8@HED_!7r;v zmq|KfO=rS-hvGSP#ND{BMON%_&yrKo9+((hI%qc~6HH7WY`sg4`u%lgNWU?E&Fx)F zhqdI%%{vzQ?@_{gGAR-pCb_-+85T_IZ`Q}wB{DYQntT5&YjY&kUCPsAi%F`Uf7khj z;Ij8DJCbwjQYCI-#fAIdii^;O#1gsJq8Da*4}P=k_4Iw?JrWPv z!|&fzq9p6V?bEM{q>DnmtHV#b#{CPEErK{iQ4ZZfRC$_IWV`S8%T2W>{g=|VTapAL z0wSw4L`wc|?;#+`r!(wkg3rff0?j+(o*3^jqdm4UIy?hWr!n(aRy&0} z##@zM)Ui8B(Gc{WT*6)gxVgsqaMsaZv(8SyW4lcfj)zasTv?kSsyBKm1T{Bp_i@sl zA*>mJ{dfXglQ0(wp{3Mik;B2xsrZIn*&(#rU>2)yZyj_=S#a)yK^a0uuInQ&;@D@} z##UhXF#0I4)+^_Gb zcOBzBK#9LSQ}n=#$wPS=+{!whNzvs=$PWBNny zaP3R(G?WUaFR>ilFMgVag+ddUZx%GbNGQ$#Y&8X^B-PzA7>IQh;=(H+Zwq1moLePtLVyd=(u)!%{M?qO8I5eA0-i>tcZZo7|%t zYbmj?ZA4K~+;Mm@b;%LO3gDI04T;cL?I!xQ#C*K<+$Q6&wmy05hvM8*CA}})`BX-~ z14f36jWK*SS|YlsME3D1ev3Lrld1o(qtyR{y}`A2^Otstu4DmgtaK2MatEo5y0Pc` z>GijU&ynXzglQxGXeY+m=Xl8RZ;D7^a1DL(RFDcA3W)ugrLkeptqZ)=&5cx{5dD*z zlK4u@5|h7URC7n+su?rAq{^X>k!Ei_v6a!I#L-g0?mho<2RzL&e643Pa~t1P@|9RN zbu)H8EK?P8583ObsuZ|8)yf**+F21?b5$vPrEteYc1Ljyr#eK$!Y#y6)2N_}vm|2~ z_eq#KOHH}aGsR~-p}n_TduES}sTbdj#Kv`otT(=OFsN2N{HnWn7b`aZDE%?gp5zmr z1B0FGrAu==UlkWVg{b!D&=Cz2_^r^^;cDWMprSEcQ~gMlIeN1_vt(T`3E6~T;2{MY z=^d-VMWYuvF7=_FB8fYc?UWNe`K$@Vc#e1MA9NROc`72i<`564yVZUuq>AfQW8hHo zA9dC9r%I5mU?WXPxi403VE{7VybXj)~J4#y!42o z=Xi0AC^mJVgb>COW^Ql3;Eu!7!dlVQSh1;<&fSirUypu=v@DNUHl+Tu`?I+8D-T;lR=y6%D=%zDcRQ@YNI7^kQ}{9x-B-Gmn%yPoSoF~B`wUtOv8 za4?Cci2jY$g7zS?VPv38lhIz>?#Rl|APK`Oc#NfNB%8mcI(?(>F0nUV9Wq!Qe`;yW zZL<4PGJRzLm%K~T(tMNj+gvcQwNmOV1B#n)mLL1=9KCS!Z%BHdtcaGBgSn@^m4=n` zko!DROQw3{)4{$T+O*!5j^W#)iHsQ-w`R*RTH$Qx8=hT3_?fTcJ=+;#&vYO^r@tDflXcZmEJKG$oi@lQLId-W% zN-y(cz7^l`#BWp~sBPWy?;Ve)Lm%j2GSBvlo8;a7;i#bGcsTBI#y{&-^13$T~a0sq>Ufm(%Kp@9gdPP0Y;6He828>q={B&E?V)o zuCYwnpuU^I^6Ge`kkyQfC(e;IIPCLVAmOiBwNuKhc^S%rLWRkkmd{Fl1}P@bB5I<{ zRQ;nwqB_Ah>i38zK6l~1EQ%9fYzQi2%w}>YKHB(r$ItT#A=;$kF;Rg$7Mpw5o4yTQ zl-d<{W|!bv6RgHkk-_bs`6-{Pp5S0yGa;FK!iAH)g--t4FO~Ju4ok}_$t^zO+=|22 zaQTItrY~>HrmXG=;n!eL9MFYCw%WG40`tF&F zt!FO25#!XzRg4&z)s!=#-5Yq*{iKLVidW%%n zO>KmtU%mK;f7!wzjk5QTx`0yhcN}`die(O-uJGDX4@LUgHS5_X)_gVXC1-zIr!1nx z8}7r4C5Ahf<-UqC07*+_f|u2TK5X6uQYibqggft!2g!EVa}^uUU5|FkWq3KMWXCbS z(VZGuVe{=;gM?t*y`XEa=#kkgxVX{{Xz+?cChl-Y&=4-Y?5%auSVktL&UeVT${!YQ z*PY!HUeV?7(Cz(*j}~7_t@BKoY^su^iaLdHNdQ0J603Ww7oW_QV%XuAxz1Ir{biHT zEAqVc9+I1@evK_bbJ~0M2O$&nBSbGVBS$DW$+1ka@5~+>&X3@jw})v`#OG?o0w3+M zaaf`_U)_*-mE~1$jHLIfRhFo1?QyIM8*iz6$~~h?*PjTyb4VJd-ddh`^IbWPW{Yuo zBWan{nT9WjgZKxbzhzWeLGxu&f5D7{#bBCU4xjrP?^$yuede8CWOb<Y8Lr*pgc?xgxbZaKPM85pGUfP2 zHq);puB1Q$MT+-7U*9e+=a?A8zFMszpfDVo(oQWhByL3RetVbwT~Prsfoi}rN$X1F zILbDu{=E+NKFPQTeNlaqY~`LSI;3w)O6<{c1FZ0#^$YvdHL!<1Lm0;hls1jz>&B;Snk$-edS*mQ}CH<=Ibo@D)8m?&Q7*}xRflt)sMkpffZfh8w*<-kACuhZp+eWj1cLgyDEp| z;8U4RVP~$bTOa8_`si}_QLXxtYQQ3TyrI!YCH&`O$&5N4x6^*5X$RCsz8Ar>H@l7w zE-C2GcfH`;Y~;0&*+av6A;TO%$L&#y+owi&=cwxSQ-v2-DI+ayeR2El?==bUtA?cQ zBsUK_&SrD$vnO@N>hgf7CVf;*ub<`l%|*;*z3dl$elwoW%qQa6D~%W$F%gs}2Bo=7 zwF;PNxcY9^pM==VgL>b-qcLI04Jx4F$=mq(AWZhjwG>Qei)Ai%&k1t0)-O4%n4I^7 zxjCdHQ`-$lI-+^>ViHxvO3a3jkEn2^%hSytZ*I|06xT_n8|H1t-k5XU^>S;m!o&i5 z1=$>~s9EY84CKbvJa67*7Sgt$6mcRItSL^Rla07m=NFwXRv^CUf+jVUKi5T|9W7>j zi^p$S?$N58KOu@_hG>*Dr^oM|#_-4JtQg2lKT{)?F&3p?k)Ycgjk`OOvM$rcJd^f# z7T!lRhS8Ki*ZFMIp0r~+qgyC03waa8+^1sk=#bFG<3mE&GsUj}!BbAVv>XoPo8Eu7 z8rmPRtqvT8R`tJ@tjijEPP_H@{YH`(idkJzPRJsaHJjG$mZ-;91lI0wtlp3{4bLJZ z*rhM(DpOQM2My~zs??TSM(*nFyXK&&jW!=gsmOnQc4*((h?jd=qf`X{!&iZMbP;a< z!1ZDUI;H93?vkq!{R|SpY=5d9Ws?;wzE5i0?5rU(?0Xl`bT{l)8?C6_10h{?4P{bM z%@^{Hv>leRlbw#l3Vk1&Nb31G9PC^VvRD+wRu(gaf5r$+_N6uT2a>PWHD}4b9;d_S zo$xanZ_Bj%-5iBr&>)hgNgke1f&$X;KTr98EIk`UI=O(|r_K_pSg6lg^1xHWUn{u+YnLw@1 z(yh6>Ss}^0Jns@_{d^>4@7b5H>hUbve)jytDPM<~Io!)vWVB!@ZQPTgm#JQ2d+Zn% z&e2HlI_AOfjC1w9JZ*PJl6c`dLP2K}Y1e{Y5(?ghhDxustci!uLpE_A<qDsc)B*{wnFhtkibyV1_+;nGcNp~(e09|hA(4ps|(lIliWNUSQi=s!@;UBS|J3orXYBf8YxauQ-{K0oP;f zR8j^#egj(G1d4o?J)fuLQ6UQ$2e*2(F=I+OL-KxWbdKwxrWd?(eO(=26W<>H>#m|a zhqsB|54)O2Ouv?#hS8qcGKC4{e8So#F&ntI_rjUx_GD3c*aq>mLi`P~}AGN1q8>%|=&Ago}8u@Iak7smSOCn3~(5ceP;_-{M zlV$pbob{}E`7z%2*`;Hn-<)(2KY}B$Sqsg}C#^;^aC^hpoP7tTQZucF%a~U>FmMNL zmbT-KMvo=a-ZKd@q7sz3Tf}y!poi)%Bvt`RFJ6-tt=S(acVcdGVHZb>p!|$*h--M@ zAhMAAi^2CwHWMw%T!VzBtCH`Vi2j_qhQjnCK!n;t(xJ(qm)e7Ebk^Z+fqV}YSy@55 zznas>T{2NLk82`t>D90?D+3i(J@_zW{Bx%d`(g;3zKLN8kyg1PCA`V&iIAA3UNEs$ ze_S2`4r4EuPw2TYY<@R&?xy^#=xnVPPwB6Ct@qcBY_x#FlwSw>afGW-Xu7+MhdkQap)#8{5|hSz^=hzU+sG`7ZZZ*H0Wwh~<-H zt(ymH@@gY|6!kFW^2l{GNk^pngt^JL?e!q+v7)b=UVnj5;43$%Ve-rmMiPQ6=6o_3{@ zmwJ0{a9X~`_j=oOhUhb#`&JGm;82(cqheU@oTqdcL5o(^4KwTIXIh`U-i@l>>$O9l zaV1+o7kK5^Q)n9Z`qs<9WW8k4+5_+dM^S3%B)0N*EDjyTp@hg+#Isfep*SyVBvsnq zfA1Kz*Tn11Eq%x&4$>v#mDx>7$*GS0{G7fe%@ts79{7RipsIBkf4Tk(uren2% zpEtOtKNICYS}hp6^Id_B%5RC|mq?gS9P)h?Z5)l^;@yMFwMdKe6U}8v;1b+HPfr7Ob;u4I!}f`>t&RPu z+gU1aUH+Zi%e<;Y&mQ6b%JvY``cKOOBK6@1rh{1{2YUrwQ$*38Etkki zpG{R-SRmDn7#eilt{PP$7QSO_#QQD7g<{~geaWCc8D>TJxd$$7^yY935v}v9F4|RHNaTE^%{i1C%4g8C$`B zth^GcND)30!@BU4o)*94evmm<1^z*!gvA28b4=ij&2O2PQFR#Gqa20Z?A%DQt{4hW zMS9hD-jGF;G^C2VCs8WYn(52GANyRq-rx{Xl2W+0mK~*vM)oVkB?)D4B(WNal|R9+ zx;}%VQ`X4;^}Qh6sYQmFUtA9wHls%DQ?tIR@y;;^f0^!8D$v!DLq!8QJ@^Z5&ECDH zCX}xHiyHqPdug#``x4Gl@uk5urNxy?3S#cP*m9TBzNdW4X#Oi>;m9NHy1LgMZDg;s zZpYZ-N`CbGZ}38U`|2M9CzGf4{4qJC4*vBSy1e`i?H~Sn9rF5Nl*{q`^a)tJs#8QN zIGn*^v2>|cNVHvCEzju@5530avd)ewrK`c*I*LNocb%`)tX!z*$Dn1(wDKjC`QR) zhUJr@ZEqj{-fw>%(d55k=N47YONhUJ1zr6>d2n%0op$NVFaH@ouEmGkSXMYMuu@8U z8XedQ^bIciW?+=@#l4)09k5xMOEAM8rRE|b3rLsP^YYOmq)S>{CcD?!(6tcdM`Tog0OnV&7vUxR^r`@FwZtjcP z*WeYsqg;La+3rexDPyV3)Uv#mv8l6s>ZqGtUS!Q>f#=p(zZhD(hHK4!bci&vN_|Z~ z@)MWFYt(MOA!N*GeSqqYOkszgXHAgoi=-^`>WkyEk0XV%zh&wl??j{860^HCEBu&o zkQtqMvK$kLY8hT!_uYjuji_lUwZY2R`f>R0jrNF~E8Lp%haAB*1>cVwdAv*B$YSo+ zVR|XY;+4OVnIiGJ)jdoiP3Dn7Pi%R^Jtu|P6V*e&bcm>mrxd;9C>8nbNOx-`~lu3Zh?oIQ*?fV7TN^(m2G?~%<-k9SDs1TN#{H!yt4fz-b(j!^QARk zr!F>Hk4u6DnkuXUYd^kymh4U`Q`bx>mCQU;4&8`qnrCDwUZ#pi$>}J@i0m_9H=K>} z{K;2+{S&Q<`P}0jv?%sBomHO>erLBK+p`kxfx z9f^EvrbZJ8sEoAD&$?3O?rezD!Nxl$ZF%qTFpE?>Qq_rHEAS~X)%(q~7wjLKwp_{x z%f^!P-kMB|=%NQLSy_ADlI`ISLvtVG`(zMAES2MJD20*p0F%hFtK7t~b7kZ65<|^M z6JzdlZn)g0t&Q*#_k?v%mWVRmuQPkGeY$$ZJ@-sTr9TarWMN#dtk26xW(rNbL%C&T zV%FPDWwkPhZbp;GO%fRwekl+20cl>T{vXpko+w5u;pbDtSCniU^$EFRj)vaq^hBF9 zcV%wR@791Ee#ih*=9n)7r4!HqI3?V(m_TM9!TKxrXZGE#_43Wz%Dd{=@@Q-`?7Yu# z{O?E_BQgKI7dpeh&Rs>vOYxWC4fC#-^XSp{EU&(wZR!j%g6wJmdh>5w1f@p`_(cQj z$sLsl0N?q1LE@GVslCNPg9B-EQD#1x*b_>~1u@cex)lIB?>e3B)Obott8|JuwX5Xz ztD|Xw^jR9^kDSzK$2m{PIJDdkCA%#t({IzC4`n`PDNnE)!?# zTbudFaaT(q*!FII?vG))NqX_A5I{~-XyfY8U)^UIw2orOld_rLQKXL z+wPT+lpY5q)&|~n?m%yS{Gzy-N<5U2cj9!dh^6j2zS^pNt&{%txR)?hMQEPh zLSD4@ldb5-8%sBWUtwq|e3X+VM0e3}^6oTA5|~*u;0>A>66HuVe8r!6iH#tpLqOmq zn=luhkRhouKVCZ>&bm83>dW#x9nw421m1^k7$HKpD-g#5;}Cqu;?+E>Z?|N375;LfLE-*V2%--E>r?YU;77Srs)FMdD78Ocy_DgI31a58?(g%rcus z-MKpO!KQZ@D{N!>y7fNlXUZRUy<6m^ia!!*%xTuB5A%jN3{JeHx#aSh{KqV-%fQH; zzfH8kAOBukPm3a#;zpDHtPm8x@gcS+F2O#ZZs{}TREHgY(t}@DbJN32EG2VV!wiU9 zoJ3DV;ey!*6kmG4h4jaUN1f68;FD*GKlcR-8*qy8B+|Tx?R8n~`n^=D38;yP=vSS^iiff$7gs?9?&} zs%-DRK}5paU<*}kN)Ze{I}L@U6zA5R{_b#`g5thDG|C(?)ICwg8xVSmnTUmH;p46Z@F>ydGO?kO_ z`MHI7g;@bf&J!=(?A$Fp0g&P3Eeam0o9A_2J6;zaQ%7DGZc~fXe|#Jr?>X?e{JTK> zpW`Qgx&J+E>a;DeaZHSK&Uo@Pu{SqP?oW5JKTtsi8cz6s3hJ5t>>|FijmUr;Y^OWv z2MIt2_|C3C0|1E=1_1^@67Gxiq&^5x18?E+A*KQT{k9BZS|AG^3}QOqB?`0wV*0c3 zh0ghR>TfXI=JaW3Ca^yQC)L4#TnH=!V8H%B^<@EEcr1wJfU9SB1O)(yZ=LOr%mx2Wb`&niz&z}a;z=DO z;4)Am44EWO>VN<*@DZ*{bFvu(H~?)p{t$Bl4Dk36a{*^J>^!LpF*hIuj}0-;nLq01 z#=io`r}%7qTwo3!ADVw*;25rZdgy`xAMg+!A7Xw$3mzY00l@I2-f4kY5O9IVhgj%r z{H$~1t03sj1<;1)L*k?l5U>ZL;rK&*7Z``fhu8rqhsTH55qNdd?zBjpygMQj|r%P$G>{U%s>b{KEy1**$qKYY!I^o z8SwZJvz?89I@eHv@|z4i#;M*r5$4|v_yPM$bJ73=3;;bi9uOM>b_jYf0)%0IAiMEd z98Q`75Ssux@YoQWp81n=Zu~z8^KT0f!Zv9B%mFuee26W8rwDqm1nl7PA-fgeays}) zf!G=dfyal~=4|}!bK`p<9IwPc2Eu%(15e?)P&^fZMug*237|k=W#Hd$+MxO>zyahA zJU^-c27J8IoNNaHHGm4Nj4nf4#tX@SOeY zpX~yxUts?WoOglSF7VHDjJUs0d|CeU2NMW~=i@YtAmDZ(K3He*ssFD(i2wbr6F513 z5&OSCc-2lXd@fjuv9$OUe`z`Yk3>A!eG{o`HW|2e)O zyT%2(!v#J)H$ereAAgP!=M(>IKK=hyKUv?Lt`FGGF=Bl}U{rVzB0PN|Fa&XxUheeXa4<9{}5yU*FVH?N<8Tm;{S;^#7_T>2XW~IUcJC)Ke{>F zMtLD$QeR-23ru@~=`Jw+1!e%S1fjv9^_n}tN_Cz+fL~|7aQe5Ny9ZpNIB)j^#NZ#{ zLhbJZhNo{%3dCN(Uoida?*X8Sci!#~ z2r!@L06+`pJO=`zjORHBFn|ROjTa0^(Vw?J1k5g-=MX@i_B=lVtWOV&lLEC51unts z1&G4{7Me3NY!3&P`Ok9%fJu3tBY{3xoKX8H;3wI6do)0Kx==VNkUa*tL2{lS15O<0 z`3VpWe>#Wi#{#e6gB{{HVEW{<@@auM{(>HuE->>2X1Tzu7ntn=vjbZK(0DW_e?TAs zz=!n(aUw7b>kHx}V3Yi$;z^-7d4WJOzzFLL;-`T0spBVw=Hvwe&j3$YUl6ANiLkyP zehzfQ`hqwW_yOw+;xvF1))&O-fB>v7h%*2xSYHrl0-~_KAkG39V0}TH4M@TIf;b0Y zgY^Y*E+7x<3*tP08`c-ZF920oUl8X58$!TYfw%y`J$-XhXii=rPzZd2^#ySeuns3H zh>L-0SYHsA03Ts}L0k%;!1{u?44{Mc1#vl`4eJZy3cwxK7sQo7KCCZ@tAI{eUl6~% zpa+f%%z1&iE-?26=DEPUKp29)s(}~q@db@v1K1+y>lF}+ps!k>0b&2^fKi0~uLmw6 z=&J!>LC{wtV2GfvCcqm(U(G-%3vgB-e_DWE-1FQDyo677ko`6A;qrNV8&J=1p4)-X zSm*f-&`NinJAf(7^V|t^(wyhFz%2av;B+$xbOAvK`sxNUsn6Gc2bd%1s|N@~&{r=Y zji9ghz#RmA^#O@o=lkmiUS2uR1Hg}K=Xnr7M$p#>Kmb8s9|0`{eSNy12fho;e}M%q zu;2w2y1>Ff3#_kGnSj6$FbV4m;$a{I))&MhKr^f_h(7~sr*BRQ#G}AvIDbJr21vmA zf_NM-f%OIP1P}-73*t$j0@fGAQ@|{&FNmlAdzc)=Uw}neUl7j#XmI|5_$#mq>kHy< z05+VzAf5%bVSPb72N1yd3*zs<0nOR&!Ta|EAcgZ6WS<8bV0}Tn0F1)=f_M>l4(kiz zC7>SG7sNjSUszudF9RvCz99Yu^uhXqcm?kHylfD+DM5U&9@V0}Tn4miR3f_MXn zhV=#UCLoFs-z~rZK7JwlHXwx%-`{{4eEdT89Y7u-zPo@meEdT8JwO#9zWaa!eEdT8 z0|5Gk^gsO^0$d33`vYw9osa(!fQJyjzrYZD{)GBF1~w4%ck-PzLi|8b3L$<-;63>G zgxVv6354gzLjk+s^Cx6S1;68+x1)i5@c9$6qk}&Y^oId{g3q6j9TQwf(BCC+3_gEC zb}VoQL4Vlb7x?@M*)M~C5cG!wX2a`S$c_uXhSwhuiKnHk!A*Kc+;rWI5 zTEC6Q0`2}J@um#R95DS4X z;QRuyFxUa-7l=hbTR1;Md;<)H^9#hHpaPtqAr=E|;QRuyILHR)XNYft@^F5JSOWBg z^9#h1U<#aHAeI9A5cDSv{zTB93`mI(KUwewoS&igav(j+`S{%eB@yB$53(Y}PXWAz z5I;qb3n6|=pbA3#ltF%k_^E)J2=P+|_YjU>HSh{T{M5m5gyZ)%xQlT7YFx-KQWx@r z^aYl=z_J%u?gHPs!16!@?C)usIQjoIumIunz7}W?`wQ8%!Eo4Lh;_gwINw053yz<@ zIVlk9f!OeTL#z+7!SfBV0cZ@*H^hdZFFfB68-e9;zJb^n?1S?S#3o=3oNpjD1wX<0 z24XX?5zaRd-vP(qd;_sL*oN?V-vays=Nrgw33kEx24XAlJI49_vj$_}d;{5Sz!IAC zc3aR1&NqaOAoc|@naASZ@$N2FGB%LHq>VfzNLc$AYY|-XM+xZ^3$lIR1j(G%n~v^8#yKVC@U6 zbAfd)@W~^n5cHM+-bc_|A}E5Owmlh?`jO`s@(-ikm21icl5ln8n&0dFAatrT=Z&|4W8 zji9%3@HK+oD!^$3y;XvE2zsjmIT7^s@`BzBF6hJX0vlam;|pwZflV*48IXw(k7}?5 zAs#hgAVNG|ff)$#s0BYF#G?*eLx@K`NQa=e22cV)Z;hZkLOhzlID~jKgPrjD2%5hZ za28%4LEH-V!s{c5UxSPA`Uv7S@B_R)g18-A#RAR>#BadQ@cIbi4saV@A3@v+PMy9v zDKsZ95O@n7pr6t|?gF0+o#$?_9$r7uoNNYxcc3r4{)D&(OhNqq2{ht8-~K)51Ft`! z`h8#-ydHtLAAFB+ei#7%A{?)S;8g^@eE`+i&iDTjbcENRP=B8;=*|3sJ}fS<H0a6FSis-)}>WdOlP6ccDM{pGSoj>iJCNKZMHs&!a-;>G@3M zJ3@2)&!a-i^n9lB|Aq$p;`dW%f-inMLp^-)`#Cho7r$RZU;4)1uc7X~_&M(HeDMpp zf6()l+IQVc^n4{AcGv6cEAfc?uD-q!kGem{%<rIARr2Qq{+l^>{iT82)X@80Lbx+j!CcdxR zsMj0f`?wFVG)IC?PH^c|J{q=r|_+f5Q z+)+m%{0=$UZbYx=#0R-O`-Z-U$17r%*awl98@+?X$Z$GLgF_)T{E`rrI1L9~uR361-XP`GTJ*_yWNf3VxR0e-iv`!Os!=T*1#1yhZRuf-e?) ziQr2GUncl+!Os_bh2R$mexcwO3BFSBiv_<#@Jj`675p;6FBg23;8zHKrQlZyezoAM z1;0k{YX!ef@aqM?LGT*||Fht01iwk}n+3l`@U?>9D)?=J-!Awag8xPEb%Nh1_z+yp9%iC;9m&- zrQrV({NI9qC3vUcUkmpA0l`^!TSq7K=4BaA1L@?f@cdpNbtdeA1-)~ z;JJe52|h&de8GnbULg1|!G{YzLhzA-A0hZC!AA=|M(`sAKT7c534XNT#|U01c#+^^ z1s^APvEU_wj~Dz{!6yhlQSeEEA1C-^!KVm5Rq*2lFBSX*!KVp6UGN!#pD6fAf}bq- zOuSnwr+ zFBN>5;L8O+U+@)zUm*B}f?p)~O2ID{{1U-06}(mO%LKn%@Ku6eA^4SoUnTg}g0B|* z8o{p>{5rv}7yJgnZxsB`g0B($Cc$qO{1(C23Vy5Lw+Vi`;CBfA7s1yFey8B;1;0!1 zy9K{T@HWBk75qNIHwb>e;13A?px_S){;=SG75ovw|0ejOg8yCc#{_>|@Qs2$A^4Mm z|3mOifW0{!0%9fH3n`1^u?Aoz!Ze?;&_s!Mh3GUGN@)_Y{0j!S@n;Z^2`N?<2T;{W(LF_ZGa5;C%(( zSMdD=-(T=d!LtNEK=1hl;GuaOI6f zJ3>tN8Q*%t-`9hfHTaf^EIJjwfy=WWh59b=3l7ArF9e*W?TFbv9&o0P4`Q}Y0?gl2 zgqZE6sMqhGLCp3UsMmJHY@dmG{eB0;Y(EwC+K!m*vjJ!7_wOKPdj;SuZAZ-ZD!`fg z{T7JXUW0mVN6hvl>h=4F5VO4r_1cb@?Ja*1J2a%4MEJB<$$xa9WmQiqCN({ z;6TjwR=`=>j+pJM0cYy>rXXhf^{Cf&#B5&!II|c0f@2N*uzfAyENw^3_B#M)X235v z5VL(f;4E!N%=R|GnZ4l`9EjO|Kj18FN6hwz0cYy>h9PGAqo~(*#BARPI8(ou2Qk|> z0nXBP#B6T|oU7kE^%CGr{XQYYtl0)QOWP5%{Vmk%_hlhwdk5ewZAZ-ZPXTA@_t_w3 z`h?qJ5hfC{DK29+rI;xrR|8>z5{TkejgcPw(mr}wj*Xcym8FQ)b9&I%y#@9 zoh)rf%=WIR*YCqZ%y#@j7tJJ7Tuucl+fYN_zZG$4vcRM#QYSA8?koBWC*}sL!Tz z5wra<)N4Cpwr@hcelHthwr@tgwj*ZyR@4us`Vq6e9rfCdnC-8i{&3PGX8U&3Ydd1L zzlHi7(j#Vj2kNyQG21^xy?(DFVzz&ZdTmF{_AgP77dqYnC*F}A4&BiW_tnZwH-0rN1|T8?+`KD$Dm%@5wm?N zU|t{ayE!xUdu9={W(MFaZAZ-Z-=lsE`G%P7r=eck5wpD#^+%E(G22f^y|yD}dmZYJ zB0XZZH=thI5wm?h>VHRi#B4tc_1cb@?dPKYXwoBQJAQ{ zj+pH?0_NDR0i0Px=OSj!TEJP_j+pK1Q9qXSh}qr-I7{0Rv;BU+nd3;0nC%Y(&eC?o zY=0E>#iU2f_Km35cEoJog!&TFBWC+%)N4Cpwr@o}Zam>Y%=UKFYdd1Lzk>Q>NspNA z+flFWh}qr=nAe1F0B265a}l%V2f$g{j+pH`Q9p_Fh}jOeFiw`XBW8OSz?sL99x>ay zqh8w)vwbhrPbNKLw)aB4wj*YHU(`<_Jz}k zdcb4y8&-w&HP&BLsjfahvEVz!r}emdz9vwa5YwH-0rXQF-v=@GO2 zRMcxbVz$pl{fVSU%=QY@Ydd1LSE2qS(j#Vj4eGTWG24@h}nK0>a`s) z+aE;zsia5D_D4{!?TFd_80!B>dc=kEY#&Y^P=vt|e2ENw^3_Fqt6PI|;_$L|u& z(ssmb?+!S#g7k>lz8ByuZAZ-ZUVt+bq({v5zJRl|9WmSSIYDM6=@GO2Ak=F+Vz&1~ z{an%`X8SZWwvR-;wj*ZyB)}P`lO8eK=K#*E zAvo)v&IYdy@Gm0-`(cEoI74Vdpo5VL&^;LJLz z2Qk~%0?yKQ#B6^UF#Cp>?Hd8JZ<`GbV%D^yrk>i`h8p|@2mWErJAiqu_z*Sv9tSaN z@cZ{!gXf2$_*;LU{{+Ha;ZG=^a8Jae2*(ibN4PiQ69}UzbPC}E5El}TBc4Zi0OEm! zvk{jO&Oy8vVQexKhhK1Xho6i$!C8&j|6agj4a)3{g+DosgmDPwG!ecKaWmoj5YH#P z9r2lje?h!}@Bp}X$XQ5u0^+j>*CGBB;TsX3P55EN=MctwnVfS8yDs4K2*&_tyhZ*a zX8#X@;+#dKDTY6pi#^O5OhcBoBW64Hk;frowqv*1j+pJ3FODH%wqw3xOW_wBYta8? zgzo^HtL=Di%l;$gbK@Z8IuWxy8*uD=_yq^9V>v4b_XV7*?YPcxo#vW@>E}8TbDezw z$1s_2;N>B9k%A5`XSpj0KZy2=2|tGRO9(sQbL>*WU9n%Sglo`#8Q~_hUrzWNw67w( z6YWkLpTp`?zMzZNBebzac_`&J>fRA z-#{3zt+_W6{sHZOChTAg*ASinICc}^(-7ZG7}rLQ)qKRakbODeoLdQBg7&q9cQrP0 zZYNC~{^Z<281tK}?PCCEybYDXftd3(6)@))G24@9$HfT_#B4{NxekBR!FE(;X**)J zcL$ttCutG09W9x6ksW`tUDc!Qzqy`!EcIynZ>dMEQTI|kneZouix3w<_1n>|>p{%+4!~T`m#BH4{6Wl`?+ndO)aZH;vqr`I zZ(x8!#T=c2V>tZ8{;r_9HnDGG!NljD3Yg=AnC&XgxPZZd@r*sLptBVIWPCt=B4#}< ze>u9{D^P5p6nZ9)^A0-9s`Kk{s!RK6YvX;&*3Nbq=L?O z@P~av%=(>xx!nk?rR*DG)^r6;=o$D0M{oEEVFKZZ!%t{2BB%p?LeDDbj6#e~!BGl7 zq30BIFovP$2{$2rfp81rcEYO>zesp3;+F_x_(Cre-i-Ja!X1cTCHy7gZG_SP&})Qa zh;eYik&XCu!ov|`z~GpS_)Wqy5x+$^iTG{8XCr=x@D+&PC5+eQPzPb$Z-m|>yb1C9 zgz>p+=mWx^BL0xD;{yJOa8JY^6CQy06T4rGhvmB zUkIyQ{7P8m0yhG1s9b~yt6aE*RW8DWRW7h%I8-j8gjFuO5LUU^gRsg4ZZ63=Ct;O~y$GvZ^dYQr(U))>+VJIKU$U!Q>_=GTVt>La7ny`r zF0u%>U_A#AR=GHku*$_jgjFsMCaiK1C)|PO9zs~<0$(74L*=4BVU>#kgjFsMC9HCR zFC4+4a&Z`8l?xQYp>i>Zu*$_?!YUVs6IQv%A*^zdOIYP1kFd(c5W*@K`GnQH7)n^> zqJXf<#W2Du7w9Y;Di=o*R=GHea2(2fx%eH~RW6Puta5P-VU>$Q!YUU3OQ9@YdVm#pvJoi|_Di;$7t6WSZta5=bxWS=vaU5Zl3rqqWDi>1-t6WSa zta5QYVU>$g!YUUh5LUUEMp)%yI$@QI8H80XP9&^yaS~ybi<1efTwvpHs9c;vSmomP zgeTxU`UBw^h)*S4gZPhx7a%^3a4X_jgs(?DoACXJ%Ls2oJclqoHx88({t$5mVSM%* zN)YY}d-6~v;W*;CgmVyA5yoesp=!eTY%_E^VSKI_nnxJ-|DhVf_MEDl{wSj~migdaxxHH6h%xR$V*3)c}=bK!czYA)PBSj`1|*Z_x`3x6i8 z<^nbXhnfpF5ms~IX2NPN+(KB*g|&p$T)366nhUoPR&(KY!fGzuL0HX&zYtb)VI5&L z7w#mi=E8cyYA)PGSj~mI39Gqq4`DSI+6b$;a4%ss7w#jh=E4TTYA)PQSj~k82&=j9 zAYnBZ9wMyf0tOxqH5dL$Sj~k;2&=j9H^OQzJW5#2g})P4bKx<*1J8Yhu$l|65>|6z8{ruI3B5*G&4ulRhok*m zm5WZoaq!QVi?7M9a`6pem5Xl)t6Y3XSmok-!Yx?O4}?`Nek81Nv4gP6#eWE^T>O`C z2cG*AVU>%WgjFtnCaiMt3t^RuUkR&RU@+iNxd;(fxxfdFaHw2_39DR02&-H~39DRm zA*^z-2Vs?qu7p)Cx)D~n=uTMWq6cA>3;YF#%Eg|9RW9}-ta8zpu*${0gyV3IFBkif zUFBkb!YUV;gjFuG2&-HiK)40#Igqf*#X*EsE)FKFauFx2a&ZXZ4m`IXVU>&igjFuE zLvW~E97F|0$_axs&z%Ec*! zRW9(2EpVt@{DH8_#i@iG9@Di`MvR=GHru*$`GgjFtD2&-HyBCK+; zn6S#l62dqHLrV!``a{bIW5`0w38TBA^9i>iUP1VJ#1|00AMu5RHzK}>@OH#234e(A zV!}HSUqV>zoh~J;_D1x7i z@3fk*+B;oCSnZvzC9L*N*AZ5GC+sL3YVULdVYPRnhTo=tGVzD zVKo=F5LR>HS;A^AY$aR+e?rd@R&(Kb!fGzOKv>O%cEV~dyhvEhg_j7cx$rV!H5XnX ztmeY2gw|8JEy8LpyiHimg?9+6x$rJw zH5WPvtGVzVVKo=tC#>ee2ZYsJz)rxS=E6sW)m-?Pu$l{>5LR>HQ^IO4d`4K!h0h6h znK*Rx{)f%kyXKIt-MaVaxyNynr%XM5(y-wpMjlacq?2b(`@^Y!JZ;wO-;W(vTr&RHqQ#+SLR&)5hPH;D z3q23F5bdECLobD1h8u!cL)&1>za6&sZ@^amE!eid6M8q)5qb|c;U9!P41E;(IP^*A z)6iF;&d}GPZ$jUOz6*U18{Z#8J3{{n{TH^eJ3~K*ehK{=YH=62i`^yeQg@lV+&$l2 z;a=cg=w9TmbT4)+T!wo9h5M!ZFZbW>S8k{Kwfl|xt^1w(z59dvqr1cXkNaPDQFw89 zNqA{^S$KK){P2qK1>p2KKNNmA{MYa!;lG6+4gWp-Sorbq#_;CwGvO`aXTw{=&xM~4zYuN@zZiZg{Brn} z@T=i%;n%|3!>@5d=~jU@vWCh~3MyU6#EA0j_Sc0~RY`ETT>$j->mkzXReMp~kaqKl(TqD!O8 zqRXS_M^{8Ih+Y`ID7rFwarBbtrP0>tWzox{tD;v#uZ&(5y*j!&dQJ4&=ylQSqc=ov zjQ%;gCVEr!=IAZaJEQBPcSY}x-V<$$-W$Cyx*>Xh^nvJu(TAcBNBK1LqtU-d zAB#R7-57l$`egJU(M{2(qEAQv8QmOxCb}j1Y;HLre7O?A^*PHm#LJh>1Q^%Z4JWqFNIUNB;0!_ZlC zJ>#5)vg*2IeSJ-7S`q4pjT&y#rxmIC3xpnxLq`|bDj6|U6rp}Z!BD?m)jVS4JfG*f zxpX5mmu}R(Tab!ITF1R2tXcQYGkW^8BJBzK?CH^{JMJ01N_5A)BGl`S`;Fi^c1IWs zhNl~K#}_yQ7C5zY5*1A~jk9W#)wAX{)Sv07A>!nf*Voo2>Y7sJ&?=TUCuddHRf9QE z+nDf5@$4EjCYieq!p3~fvXiQarlCp}5S!Hwlw#KUJ%BEQjsd$$+H_T5I zj2JO=^sJ=cIDGgh!=!?#MyV(B!bWNIN>EMt@NAx1mZ-Yb2=&xxqda*wuLeq!SAuHF zlHW#25;m11zl~A^HZ>zL_&8y4TFx7qH!a8D(jP^7@7ZRtKp|t>v6pub!IvGFIpXeV3Zl6@k1^XAh`wus$^v8}rJY zyvC-6rm{KkcVVsin|7suGHvrxL_@+W@rHzF^VBpXyb^Cn_-!;KJeyYo4GFKr8xnpS z4GCdWL&9&PAu%VFD$I#WL2XT$wYxzj)U}`za@i|UomT6(uqpTaHgeBzqma*-HG0-5 zRuBE9UQ+yaFRbLfztl@kx}6f_w|liwkNu@yqSEb@tN^=;NV=V(l5Xc-6a{=2=ggb- z^vs*3W|yR$GoNPHnU{9XytH#K3d{n}t=$xJCVXd`Zl@J+g+q7Uo~4-E^A(%zr4?{) zkJx4A%~Gt6y)^CVK`~45EY7^NbLLIER~z@qEH%3%?VR~EyUx6{bLOR;`&eKWcy8^c zn7#I$ZMvOSz!eVNb$ga#ZqHY2wwG4GnIE~!%$ucH9eZio(}QA`;#r(|Y3IzFcCR+> zlUZtZN!mH{X?C4?Y3IyKJNL1`Eb!dgO)-1zJKJQX$71PUxC+g?wPOH>{(g?XC%EqrzEX_bCOoT zQ5e3<;cAweAu{b=hd4rJsTm+?=lGa*uQm>kS!zZ{+BrCBb{!jO=g>$y_oBco@Z8!> zF?;Ph+jKjvfHN^PxV^w)GZ&Wg*iT=vnT@mpPKU3+>p1t!S8Vnyt$;I@rrx zIY~c5J>{4&YuGM_t66G>$h3PM;s}|gW`Lxf<73*r+BiIBsTmz<=isE-b!?=aLnH0n zivqL2b89!n?6vP~)9ti^)OZYTFR<9m#n9mM*iT=vnT@mpPKU3+>p1t!S8Vnyt$;I< zUckfEbRDbWoTQ(jhikzuhpSm?hRC#g9pVU?rDlMno#SKLz1lcDW~mt+Y3Jai*>!BB zokJt-sa}``o?E*qPI+yf?Q>feq{gFJ;I$W6Z02HU@OkW~uh`5+S^=lSSKv9qJ@XZt zJxeR#jHDOva5Y`WsyHX!yXVGqtq82VNV4| z+Br7Do(heyb1#OOo%h_@O))3cced$vS^-yBuhqQBOq@8;)%q;NS+D$Qg z?K|6aJFS2#EZB8>mSS$tS8TSIR=~L(8r)uBF;>WaTFwhB#`99s!)y-=IQ^Cixo5s& zvu9}qJOa`Sc!dmbf#!`Y;3$lqHFKA*aCoI=h=R}J2$`j3fTW${W7@rO$l)(o%h_@O)-1zJKJ&cnoii`(+zWUqVpo~46tma9 zV$3_dHU6wl(!n`fb&GjH0{GjEof zU6OXre41TnUfMbH($2krmm+qR2}?0&!dGm%omRl@!AlXlYR^*4?fHt$_R^j=GcWDj3wSAFSDCOBb0&Pn zrrT)++#b9Xv8(nh#oV5+*laJYfO9({u(_a8td6}5J}amc&*IFRXQ7=lZ`#u{Zvt<3v^1-3OFZe1ssLpyNr=pYKF+PdmZ8knWbicq@Ckq+P&I1 z@n)$R9cky_q}g?Bq@6<}?c57^DI#e2?53E#_ML6IomRk^fT#LF?FAN_xv-qae)@{d zY@`)%I(!A``S2B+JxeR#jHDOva5cM(RdG(z&q%$(v8xyjGa_h)$h3PM;s}|gW`Lxf z<73*r+BorMsTmz<=isE-b!?=aLnH0n3wS9aC^Wk%X0Lr`n{KBSq{d@#dx6DfF5uOG zUHR!NHnWjd!0GT6r02s|Z1yazfHRU_z{Aya9joG;q@R&`g(Il19HRmw5@v`@yVs#q zCdFBN`7zJZ&NbkZJk##gmP)*+jh~5`XJKs|oHVQP{)Nl=UgnO2D9``J*fHRU_z{AyS34P<7 zq@R&`g=3d7G9u^;kzo&rkWuOjkg%uXW7xggQsFU5v9?rnggq4;Y3JAodnz=-&f^hY ziUTv?sILk7 zf&T4n)OVYx?g!|FH&fKtVySPssBgcWo`3rq_3aS(y&URGLOCDY-)}{J zXG48F{`LnkrV!`bW>KHp8{!u*{{A8A+Y0q@ezT1FaJ?|+M{fwmK>_ul$sB)$@ZHMA zV8r|$Xw)|vzjG8g_iK1xNBzIHU{VJU#lP!$$-2oF9eyRJSzm=kr@q$*THyN5w&-v! znDt#@(dFnkbA9VUSI7j~;eH$@;=B~TXL=e1b(pt9MO?nz&vD{l=Y#9}i-=24 zNd5sVg1@X&-xUO$UCOrTmVn0WZ?Q#p6;y2MW?OU_A}(ixE+{U0iMYfFGY)n>xW7|GT;8(i4uHzc`gU4${h3lW!6i|z^Ntl8fyEIRd_V9*H1Z@Wde9UL(0JK)e@|0={hnhm<3xXcpsX!ssp zTnfP-Xii-hZV_?m7!kt~c!W z%=+>zx_dP!>=zk`&(ma7yoMwQ@7Hh`w|>5b?Ysb6-B4)MY`4au8wHM-x|J5) zR2e^u?on}F*b2I!_&p@93m@*~#cwwFgmLK!KRv|w>p3F$x^=pU-%%Fbr6PVc7G0T$ z-}M$<75HezZ>vRjwus+Oi|#uSznqay;PvAx5x*pSStVar(I<}I6cNAmFm4N>oDbCD zu~fwGON;JB5x<-xgX_buoj2oBW6|M%*=6e1TXc_!_7m5BM9b5wBr3dQ_AJHv|~ z-p6tL7VC8v!l;h*h2C0*2996&2!B7?KnJ%1se^Tg!2Zna?`Dhc!(o11hehXR`E@%i zx)DSDx>!-Lf78Kf)4yzsZh4+xS7_0#?c>+YwCG-gn+LPqq(%3AFTZYuMVAfx8neDN z7Tx%mU-z&@mv@+7*KW~GhUYS7yPsNg!(m@&>YTB``IrWapsCx>q8roSugkaSW_I`M zCRlWZhxm1~ExOaX`gIE|I#;Y~trlH8?yv6-i|zwhKh3yowCFs8q8kPemCSZWS#*`Kk27_p7Tr>KZe;4JEV_qaUv27IEV@_W zA)l#RZP9%J*C|ui20BP(>frUSn^^zaExN5@{p+;oKF{>G8!HZO_dv1!-J*+$^{>;S%MtCrw zhxgCscu87xW5oK`YSH!U@2{`TqAL{ZU%N$@eTculPK$25SpQ<5vHm43x=-PGm04e_MR%uI|Jp3NXT^UJ5R2E7Tpcvdem;w&6ew*MR%@T|0V>- z?_O~|%D3oV5cw#z=v=w}S#)u^{#kU><@#sQogvphi*9YU7=ISslY9Ghv5CR)TQ|_J z%eUw@@9Ec-T6Ap#{JNw?_k0h(uGOM@u%BPoX3@RU&97^>=pK#xb)6R78+-V5u}Q)4 zTPW8*i|%T8j%=fm+!WwHKsSaes3^)EI# zxW4^bgf1MWHFMIm?5uX~|-;c%mS8CBkdiv{YvFN^(>z_r}y}Q4@4vX#^ zvHr!55AH{-tG~WNi|$^r{v|EC7sUFv#-h7itbgqmU7J|{@ITZJnwO1Y{mZxLE)(nD zY>RHw5Pw`+ExPx``nS=d>yzuRuhXI%CiZ{v6N39&Db~MIi*Bh{|5_}%;bOkES#;C( z_V=U1q8lUTTWnfzKW2*gR%p=`iusnb=uYe5_iv3wH(t!Qc8jh;>^Ge0!Tsna=10Co zcbJ$Tvn{&Mhx_}{YSDES^JAk$_v}!AeVrEFXX5%1pAp>O1H}9&wdlr(`O#w0)#mv9 zYqRJs%JAztEV{=A`E{`qgZuGT%&#l7=r$eZ*Cj2w_xJMa)>w2~4)yEWExJ#|^}{(S zxF7A}`9Z!#_iu6im~GK*JH+o_t3~&nxPEN3=&lj3FLYXT4~ge%@sor5d)9Ejf29`P zYVrC)i$ynD_}2!y38~$m_d3bR!oM9BU8eA_aAt6QqlAAeEIN31uW$d{ZqZ#J=I?%| z1h@NWp1;1?7Tp_t{JJ|Vx;@4G?X>6)7xQ=2?}Pn2P0ZgGi|%YOe>Yon6=MFz{t(>m zVljVbT6Cw2`MbuVTOsD}rxsmO&fimm{kufW-vt)kd@+AFT69;4`P=o6!R?M2?H>oF z7Trv-?_6!sWsUUL*J06(KG3hrJ}ub4odtef(xS^0_gfEJbW`&E^*OVG+nu+sUpK*` zyHV`_S}nRqd;9C#Zqa=u_J8r&!T#;p%U@rWMR$?h|5V#Qtx;Il=ATAohQ=ExNyn{ofrH-Rx2RIColf=N|0WjVcfJuV{o{ z*J9Dl68pc+7F|CvKVlWZ?H2CuZ+E6e*C_UXYb?6U`ugkp)S}xYt{?e{VE^71*N+7j zT^}(&Hd=JU_VN4IwKBNfEHOVyExOTSeyq0W4iWRC!=gJz%#ZB3!TudKz~7IgMOPx` z$HNv~u9zQARdBnI=vst-J1n{lV*eLAJ=nh&#r`kbqKk<6TWHbs6Z3bbMR%f@ zze$U(QOw^J7Ts-w{CQhr(QOj@zlSZl^mz17uU-vWznnb`leT6DL>{q@~p(N&85-$sjWso4K* zx9E-?=5M#tqDzSVU)P%8ysZ}dzqm#BpxFP7vgke&`@d3)ZVz$4Rb|nQIo#jh7K?7C z*#E7z=&I%V2RcY)>frV7e6jwuTXd7e`qydERf+X4RvX;zbz=R?x9I*V*1uAV?n`n1 zo3!YOePaD9wdk%D z>tE8Md$^}RF0B^b8nOPhS#*zy^{?HcyG^Wrofh3DvHr#CgX32t*1vpw+*Jja87VBTTMR%T9|2i$Y8^rn-O9scUJ=Y(Xe2ebi z;{LbPqB}&ae@Tn(7_t7fT68DK_0OWKm+PNJ2cPWsje|~$u2imnX9UM@iCq6Ix|`(s zXVJZq=l3sZ(S0MXN39m!p>qAR=*G$Q&!U?z*FTHyikQD2v4-IIoh{cti|*RJ{PmSu zbc^NsXVI;Z>z_rpLau)n-EDIHv*<37>z_rpUao(Q!SS0e*FTHy47vVUbi?KPXVFcQ z>z_r}XP7^4Z5G`yx&B#nmHGbqIxV`Ta{X%xj^9Ia{j=y^mFu5H*Hx~67Tv&J{(iJt zbXSXfv{`fyhz_q8s*i}DMK@36 zqs^kbK;)y{qI)#k-)^Tx_r~6SU2J}E{GJrgoANEXjy?VLm0EP0=eY1zZzSx<;@wE~yuZt}Rj^7Vre~@p{_3rJjuhgPDcCcTU zwCEE1_;sxo-E$-Tx;D_kl9M|4{`U*9{&iS%cZ>BewlKK9tz!KvwCH{n>tE8MJ8(aL zKh{`urDFYSx9IBn`0I1d3hu{EV*Sgv=pGmA-)xKS8?pYiT6D3P-@lC(-43z-by{?N z#r`k;r{MnnBG$iBi|zoi|7)@6B69y{(e)GizYdG8yV(E5&JONJw%Gp_T69}R`Qx0l z=sp$e-x`bVPO<*ATXfGH;BVJCC%7N@xo`8nJKv&Px4&OE+oF40tbeT*-A`iu+i20{ ziTz)vMK@WjfAMpJ`+J^P|4J>o8^rq8V$n?z^R3OInR zo??D%wCL_T!e3vfMc00iUl(5*+}~Bh{kl?%?%piFuEnCu68^P;uF&z0h=!wuf1MWH zPO<;XUlv?nrtmLm(M=Kax6PuPC-#4x7Tt|v|Chf!*uO``{x50KeI@pPZ5G|0V*Yko zbcJI6=AR$z-)Un0CM~-0V*a*SbQNO$c3O0k5A~0${1w6eoi6r&NsDe;e}8>#7F|;8 z|2i$YnPUFtUl8oy{I33XlNMdpXuqz_q8lCe>pCqu{Qj5_%qdsTtNaUt{mVSiuS;5V zZ;Sn3n??7NxW08-ba~=_EB~Tk|0eG%{IlrJ6Z^k5i|&Tr{`xvCy7s|-UH-~o|NbrZ ze@Tn3Cfi?Mn?-k_*#C7}bPWUj_2pk2>|d+6z9lWX1q1x`wOMpm_3-ODExL32`E~i1 z1p9Y=H@_}v(G`jPUz|cY}|0ONDTXX#NwOMrkkk=23?uSAC`tmOe_OG{`9~RwCdHt~HGWYhk+iB6ca(-MM z>|b2Y4~wp=oF5k5Ksi4wy1nH5SQYGFj+`GB-HUR6Wzl^l_g5C(ePaKYe?_o=?Q(x* z(cJ_WBJ+CG20FNur4HWz^#Wk(+AX>VMSY!?b`KNv#N+vK?;uRSM-CsZ3PuhcsU@?!pI0(@d?>^%V%^`S+J~y06&cjta3oGP zeD8F~DcYyY)BQHBibnhNk4K%1NHmnurEveeWs6F#2F)ie@a^%-?knt9Tol?D!Z8mKUefBipu_h0i`-~Km$(syyoearKf zzgWWUA9%*{=WpJ6+m&k#6IsF7wWqx@^m` ze#=vQ%~T^Mp(oZY&4`x4Sx$r%1DE|!SXsQSc>Kf%Ck~u+XxZWx_ISh@U0&$-+`wli zJu~&6)1F!fK1BP3o+vL}6vgFXEzvf-pKWFVP;aj`)iFQ9BQeL>u88#vwI;YR7 zrV%?sYgR=Z^*bMauUndp9(VOT{%_&w#cvc(n)t}X!ISm`kJl{?tvTh4<=bw4<+hi$ zv_Jp+OIx>Xd1LcCPrtt@4`S>@$~&KeF;WP1-FLyd3p09_^o^FBFe#%)XLwbQSZv+W zlZ^N+xwU(r^3paZR5EONNqEjx%Szr~9=?6~uS;%!`q!4R8;#cRCr%dOPK5uEaTXLKHKZ<4jsM)f+v%Ty=35lz+fy*#qJ8^k-*iCN(2FIl&MJsG zw-%MHI6Mj1CEEyklPQ0YQ^OO^fE`vxebCyNQTZhA1;Y2Q6hKkUW=k!??4ZY|2 zv&iR9XbrDWur@5sTed2?#^rV*8$%`DS`?3$Or0_9_|jA2O^L>)F>xnZ*4UV+a4O5H zYv7Ml(wJ;WG&WXO#>;EU>gLAhCmI^7>+9kL`FTV0hQ_n2nwpZ0V}=ZwTisOEJSVTb zzII50PZ?5EGru-B*-(FaqP!^&6mclZr88$0FW#{BF@*pn%7#qg86yWxd`;M z{^J?27~r4Ov4<+}WpICaH|GLe|Zme{!yv(i7yxYXu%fGeVS6-=Rij28?AUpe-j4l0LRb01&LG|j(# zRDH0e)(3I;N?soy!xaAK4{ZMz!M%7=`Kh8Dws88Oa&HqrJX^FkUhty~?vHPV@&~pp z`p9tZO0|T0i+xr3MlN9zDhR z{RA&I`0a2m+&ZP|^Y^EZlMVHG$G(E^CwQhaNs9~MZ!ef%jo!&>|29kTziMA_%=d!% z_I%1Wz26gjPwfxR(O%&7XS%+<6z}HL8vf#bakV%fULHyvSpK+X*zaD>p3X>p{!BQp z7er=^INzYEKXBWwj?Iymlg;64|R)8HqgNI`}9+)6OB@n&eiqfT9q*te!+p5 zHA?~KU@+ilg`W)FU&O4zvJ4EmKG@zHc#dAgF>bL85)4G#hj1bM$-zQ6is2_`UjxAw!(#;}w?Etig4W?TFcqA&6zeFE}udnef~T4>PA@foEwuVm=pL$(R7Y;6Tjw-vj2h5VO4k z?Ka3l79=e;;thB(ypX zVz&3j{1z*-gP863fB$eCh69cbB@JF9V)=w87@DbwG0AXD1I+zG%ypg$nEN#waHcLm z%$f?oS(+ebdlleZ{m`Wsw86PX%$mcU+C*(RyvuCB0w)juS48u_5Uib(sA#HboTVSC z%xX;3RL;V^zJr_fS}^ZQU0qk*M^fz`Dz;%HRaMvN>5%)|8l4 zTUOUxR$~hNRe{S*iH16q)YUg7@{XN)VlH@DK2N${34LpEb*b&?Hm zdSyzQtSM`%tZ%5DbylLGzWS_0P_yJ$>J%L~ZQVtGDjO0Bd6u#n=Wy35nrmwp&T6c0 zZYcNpAfpN0VAX&M(^)C3Y_2Q!p1nDkrKYku@ONRY`it4i8!p^~3hN;UWvGT5!vFFA zO?jeA{}&|AA3X3q9<5;G1BSmkaI1j03sK|#jSPGWPHCyr(^CmqcMPxy{1hsy<6P05 z-n(!BaCpe4%6h`z4N#d`UnSUZz2<}KyBkDieVd>@ycA-6@Yo_%-yU#+S>IYH8xB8w zaD6TSvp%@ZRR2c_)`#~6Scd+606%7Zxc2P@KYVa~?|{LquP4;EAK0+IZn_NXTLP7t z^?eMsb@0On*LN<6%=!jEeYk#OeV8lu@2`N(`dWeLEh&`X{SY1Z!ymK0PQyRkZgPEi z-(%K?d;hz29r%aq!~ZMFtgkC{4%JfzcwfK=*LOGov%W{6zBbTd zefz)<`_~t+S>KH?nDD-V53Y~TDbxiukhCNeVtpC#!}Wav=bH6(g~6n^5b8{>?|l%N z{^56}aei^T%k`ZNCt!U%C-R{_y@gcuVHy66)PMCQ&p94+6-q(BST`5|Vm>zDU^fmf zgO?6)UM0B*bwRHsl)?$-YYE>$Kd=sr3m#nGAE6)IceH;9^|e7Kv3wN#V1MCMXUI@^ z5^Nm$g#u+EOutjFC5)oi6yovSzm`w~jbVE(yC4Lg1g zfz_J|Z@+*K>wH&saar|WK;g2(7p-J{O-){T+O@^!z%I!&D1~v9I=Vv0=cJf7J}@u% zv%BjBJ!A3Sw}!b48t46Veeg#es~PCO*cKi*=FD-9x}b56^UoaT*bh9=A3V4|+|!%m zd^7MuU5;a%$9bZmp}ryYirMa8Gb<=KV%SJE3wA%wx1Z=A=NaJLsuRC2Dyq!Ac+ZP} zZqDe^Wyh*z(H&=8oOk7_6Pw|wcE_IOvmbQ&EP4nA50p50S9UGJSGg9q;CXn~L(yN) zTea-_J!&t8S81Y!dz5$F>U58$>qGl=dA{G)fm9vvCtkCzMQ!=f-DLCE~Dyhv(^uig;zBtf{#n z5wC8H!~Bbv&4*|9Wpip0PD(zutRh}r2OH^lvaF%3HUYcfMz3_ddd44bs*jh|)YO;5 zPC5=Z67>xWJ;_9MGH&qV<@I$y#5_=)(OeC$D8$R+mCZFZWc5xdYKEx{5T~a2nPrV} z+)!6I#S^ALJOcwnMbi>xs(au%_!LK@7ewuuu4PKuJPgEdP>M>E&2wt1%i|EwW(bLX z&4rrx*J%pJ%;-17wP66<_ZQB4pnn4+c>Pcd&)>*8Z64m!vU z5Ssd08W1`0#^&;>IE>gtvMNyv(W;5hODqIe>9sj(eEHFYP@wFQ^nwWotmBvkkizhHb-h{ z39bcG>*ENjKm)@H2WCAyEWkg_brlY2@HgD)Vs(1@V0soLY2_o0-5n~QHoYi5@gzPU zLRXbokV~^rw{l`#YLsEd2RV_QD(~dHH>GsU}2AIfYb%!;ISz{Fh zW{BY}>=@@%!_>fuOP$|sMoW)_R9NSXDxI+~32R9;%y@V}1dYQb2-Yv?Dh>_ZI*rG& zx_HUBVu&}+1$FLkYaiFOA%TmUszl~TzbH;E@Pxz&H9v& z|M5~ugA@8$-`s?Iu7C>^ba34Cp#>1v-!Krha=hN=`Sy5v&Y6KR=3QesUNF4IO2?L% zSAJEKxo)vj{}+bLxalK)Ywu8aVjZuZhJ(s+ES;9Ra2uV2lvPyEh3h$vC$aOz@ZyR8 zS2}V8RD|P!)@Eav>fl#Y;|2t_tMMjWk+>tudpy@Z2FvOeHsM+suWy1U-Ei52g$ggk zFe24O7rVi&BaZh!BK6K2*!|;Ed&3=EVqgKltiqZPn^b%QPf!(Vr;Ml8Ro4Gc&fo34 z-K_`ZiH4@?O5D~be2e05^`ZoCZ&lYYY7jJU-;(NSuqM%P7_L;6^(h_Q)9A%3W!=?g zmt%QSqJcVr8zH*Pr_RTL!l{BB;(oEQIZ-hLMg`pOsJ!A`58kfPj?KY!=QpeaB>Vqz zBSvRVuZR0SHP~q17_Vqn`xm_d*Bj3=wFJ@`c#YCpxS-;$LPcEd7pt2V#$j=RJ2`!~ zQ&T;sp$u*r=~Rq@xBZOQr?!n$pQ$n~W4n-HNc#`P!S6*rtuFt1i)*^KZNU+SGoz-g zVJ^(ky87n1RfZdS!!7Sda3`T{2{^qj7hmjYbf!LiVu&{`ga-&vQF&ZFtkNgLu6x?lV^!mDUopSB0_FXtF#Y0GP>aq;uk z6ZDI{hFg2MdBRgk2Dkoj8OBhnDG2v9SXSnL#(<9$bp7L~@>F%uOL(x5s6(F`6L1sQ z0DE=VBJ;BlT#G>Cy9lEm-y!L_Tr|0KDvpV!`ttgkMsGg{&XmEWBjs(ptO8nSs%}j1 zK$`(&^=JAw?YIm!By!;;MO;;ITc!s%yc|pYt%JuKsSHAR#}&oLRpBif2ved|P$1Sc zemMw5*de}_!2=;0L+0S1FvAOv@nj-3sEc5THNhQfSq=2zx1R?7>B!R9fpG&v0B#p6 ztD$>phtDfM*@fu09p|qjC z9N*%Kmt%U?GtRhL!KJwZf;|tPjZrA{@RnfTPinbWbJ`nnm_<@4a-OKCmq zQ6{9$pF-!us!#=)P;&qVQiXc5fbnjq#_KwU5H|m{Web&~(EMBo1Z2Gdo+H4_R5v!T z;HfUdE5GE%R9NAX_0Tx%YH|ADjcz4nf30AYMD^hP;n++$jZvg zVKbti3-ALPXc`_$;!Z|A5iqCvZcc2RSDj44c|+ngiAvnu)z|4~5Zo?jf+v$&X|Nd> z+_lwpLu$(w#OL7MdRarYZxVS)tV_&=p<+H=)DhIFi^KYaxr3Wo+|c2=!NY`})u|gH z^9D4YotT>gPif|X>&EQ_oDJ_@faIxk;+v=;xgdeNI;dihuJpvZd389$Y0Sg5HMRDr zT1%%Nmnz~@ChGSx=ndP0t zg$4#86qjMfsdn$`MUT+D=3$A!3$%VRRa0L-uTej}!|R(~|9QzaeDSZvsi9R}N0)Kz z1MY2T;WlR~Eaue-xROI6Q(;w?=;}ItFa&W&0@pftunJdXHQVWSMxD#oFdnYC>e&Vl z81>Y#hE{eMJeAE2O?V@ui}5o9yd*bPsSyf`b_J{lX6Il(QC`(h4?DU>{}v3ld+_85 zp8aEl7sA_=XaV_6u6X?|Yk(~(RG`*JT?Jem^_?gb;CRlh#Mf0)Pn(R1IBsHb(3T2n z@b-&zDM@XSd{5NHT*b^9x`tFwEywFvTjCJ!<|pR*)p+YT%Qmr(UM;!jWBHT``FAntIT<3wcZYyphD zS>><=gkI0W%DFakQ)Mpn`qo50Q-N`mgF99j^U$k%hmO#LOr;K zRS#~b_2wL}y|C#~kBqTkenTbPY{TVc4!l*7@8F6`ro+^psBhnJH&T=2RYtY!1-zb^Ce6_FxS!&_3TI04ci61iLb!dvSH5$6BQywUBtBW zeJyvIoGgO2VWH46dTxg=1jF58s!jhH#kh5VbyL0?q{tmW?mz3YS5Iy zogHnf;00W>9qK1MKbzZ(cS+DBvfU^my`qs@4AO%2#<^i%j<)uOhZ z71i^r)shSSz^6Pp7%_O=6)0{bVEW;UqPwa_JA-1lBTB-XWzBF}hs?O5DJ7F92hBaB zgma!g|Hh58y@7$BpYSc2LsH|t6|hnoPssGbI&MM{{423ekSS?gm_!*8fZpO4( z#nZ+ftG$7-f!`evr}stkqA5h4%lh%3ex*jQ58yq{zB%yTZ*d~UBbysJ93I(Jz|^jX zx0Wma)Rj~%&)a3iE%&Zm$x;!6eiXaQV@VeON#qN)t$)SLt?=1PR)3E#LU#Lz6PX}|p( z<8tcnf626I$K#uu)LS7^j|bVRo|ZsL%3!^KSKVnK@l)s0$wf29A3qIeLi*DM2)7>E zhRi=?#lzRs76{)1fdiJ`?C%^qPOYvy?9{zm`V=D7ZWmBp8QcljUnraaPi<2Jn{UeX zaP`J7gaaR3!2+*tL(P*Ws*8VWFvhb>^guC3?I6cI#hM{ggaHf~b1;@BPrP zp5kp31NN1MPTy^zBe1Be*P@S_a`wQ2GTt zyjg<15#2K3f<;24!P}tVfeJi% zaGfpZ{x3z~|AEhw;OAudz|WHy6wG0#FMJk`J|lywu!Elk#^dZTey*T< z>az}HjVgT(5%?WVeIDZ#s5k_ldh^%6htgl4(i3kIe1^dffDc*R0w1D+=Ao``>ijuI zc^E#Rb^(-U8s$$L<=CI~1|I>RF1QW!_*o3D?|q{j^_>RizTxLWP(Reyp>9qbK9GlH z2kG+B;LjAm{WYHk{wD$B*CF8f^Pv5^0ORL@kuQZ$U337>*ZdA}ECy|i)BH8)_;ld# zb$d$xlj}Hjzz^5_VBpsPAFTNg;Lkq{4o#@Zic$P1wK%h zKMnrv59e@upM!s+fV2NkfPb@q577E&!M`O2{}BAS9e7-q{|x^86L>$(`vU(AIJZ9r zaBr}2JWc~&js||L)?W<%Ed!39aYg^{1^+eyXMbJ=|Gogu<7++m*A09)O6wm4|4M)l z)cgg&^Wca3_bHrvA#nV93amc_{C416-=W~&Q@}Z%6T!bdpw2;BzX1Hp2R>f&>%l+# zZsQ4>Zv_7y1J3=u8vOeVc(E?O32-jh@N<6H{v*&<0(g<;FM~g~0q1ys3I1#W&hd%? z{|@*#tsf5l9nqaWSBdqNgMYJtPtxV*gMWVkK1lOB!M~S)bAJ~@U7f)3D_-#YmEhl? z9*#3n^IO5c2H+gu$H2e4fpdIb1Ap-IuI$fG;LkAld}*OR|6t&az*#>P{Cfa+u`X`_ z|NaAffaX_$e+R;cX0tV~1^-Hb(`Qq=IcI`@e*n(m!gq z3I4qb{4mWw27h)M<=ugggwLfq$<8&(ZoR;9qDTZ~dtR|H^<**X8GdfA<6D^H+m^UjrYf z%O3^*hWGN~)dBug0zX2R?+yG0gAW7$UIBizEjfVYF44RPjJ=bAb9;Tj-z$Kh zugmkm->lwV|BeNJi-2={W`n;~z4}e>=gyk?m}I$HBh`fOG$f!N2bN^Jl2LIaT0aA@Ffpe>M2G1o&9Z{|5d& z1$=_$?}C4O!ser&<`05@Lx6L9HiCbRz~j37b?|2u@MAUq2K;#gc!B0UfcJ!p{b0?9 zfPW)_^L&{O{*?pI*5!-Azl#ih8~C@uIDZTH_qK8VP2gX5SUg7P^X~-zjsc#p`6lqM z9{5zv-v)pF4*Yn{e*k}a9_X$2nZS<#4nstZm!rYI$-w(-UJL%!13yIb%fP=@;D>4c z0QmP1@EMw~1pj(KvLVE(zN^5$0l?#$-vj;?8|9n9zdr(pA*J;1fj^DFxxFaxD}W!N z%Ljpf&jLSO^O@k^55UK1j-R<74U>!Wu?GB`2ONf&s{c&zZ!z$==8M3;n}Ltf{95qu zE#Tb#2Jr7^-~)8|R`BPLxYu4M_)`I#^W7WxCBTn#sJ(IE-!s5D|8v2=AApb7Yde+~oe+u|l2z<0IKNfWxli=S&zz@^> z0`Tu0;Ox)M;9oZgCdcdP|HIw809H|5`@=IyP6*+3-~U`RrYF-bW|2w=e`F$p08 zQVa-a<#7N(0eJ);t=fd-L=t%i5RrOgc!-Ep38GT92?8RQQsg3{wG^n&UbScyt=HoB z`^}y;GiM0aw%`Bz{=F-iIlr~`+G{^%&z_mR_pCwwvcZe~pTae50(hyf9^mf>Fa5(1 zjATS?bZWtq%RC zBQ))|;9=58F9P}b3wSyI=+7?|k)?m7FRL5DL&ea?BbQbIUhGFBe_O!#&G01T?+x%n zOnxx(7lX{En*5kZv=8u--W-pn%>$ojhOa{Yo(3=Ny9N0>2p&zsNdH~r??dpCep~RJ zU|jgq$WMRpay$Tt+Paedt28xHi~KiyXI58hyNzcrN<>Y`_qogSil;0^q-=!V$!{pCQpth|bOcWcWhDeE^B$J9+{D zD2BL?!m-4O3e&fpo}_RBak9ef&vafKKzYPGp+SYj!xSzdE>W1*6Md+{^w*;oD_llg zq%eIb>4gf@|DAq~!jpsDg$JzwD&#CZzy`Ah$i!gGnQR=Av)7bVbL#Df*CAfBjj zHSr{c7ZXobcnR?og;x*<6kbg{RpE8S(-hu7JYC@i;#(9xPMoRm+r$|PpC(RM_#I;2 zT!20xPE+_J;wuzBN1Uqg=fsyQ{1tJE!de*c4-}3d?x%1Rv0vf##JsTt@wrRCUg22c zGKG5*k5M>*c&x(7#5X9+dj@@+!s*2074AnoLE#+Y8x0{OZ&x^hc&@@6N73ggoJu@j;dJ5!3il%}S2%}wp~3@+ z?@)L!@tq3i5#OcoaN@faE+hV_!hF8cf2QzF#P=v%PJFMzcM;#GF!%Z~g(HZcS2&9J zO@-SN?@`!G{FcIOn)+h~HK?nfOJ8d3x)ARG3|Z{*uBxjrErm z&LRG_!UKu-DLk0CS>Zh5-z!{5d_v(8;!_F_Cw@cWQN({xxQzIu!sCcfD?Ew#jKcR2 zKcR31@skQy6K_{|32}?UtBLn2yovZ(g{i7Pr|>S~vkJ3F`eB9nqaRfGIPt3rv-Q>RH`HC zw2%08g%1+HtMFms_Y^)#{Jz2tpReMcZMJgF+M55>OL<OgEvX zYft!X#oHZ$8JWh)#!Ol1eThgRE?sBLyk*8eZuwHNLQJci-acOg!0Nb*T)T$)pj$8p z%X{d?mCoptue6K2&}AB)X*2zU2ANK3Gi~G_XbElPA7BY>G{8^UJMt;8~v{6<+TWCXDHfW$#HVgR&TF^%R0hZ84{#;9FBY%HOXd{1)CA5)0 z+Y;KypJfSc`b&_;g0CA3jiKU-)+TQ(?1tlP*x&=T6nKfn^&$e(KoZRGE732o%hv4l4AXInxW z`Lisc1NkkX-vKRQRzC~+ZD`8|Wn0Cxkbj^BZR8(d32o%hwS+eE_qT*L^5 zp^f}mme7IxmeB8jmN2WI1^qU(WrMP;Vp_;Q(1JGd53qzb^5W;cR)*s4=zbL{5G^@gXp}QHwc+F@(;9xHu4X!gf{Z$T0$H7`&&XA z`Ex9xjr`e`&_@0&OXx(F(C>FZ$$VBnTj+on`zbey>L1ikBHGA5&=T6nKfn^&2p=Al z=r;2Aw}dwG=U74;VWqD`w~;@~5;~CI68as`5@z+Ypx=P~63qL<@9{Gj_mg;Bvgn0t zG0qrmu^NI6iol*YQnAMThY5`zJbD_m5_`AaKr@U#qPGN?HuJENM*T>wk>~=<{4lIN zHpX?@n+3ifHX*T>4T00%5{EsH8Af{_VRPEs0G?z0LSm1%*iL%~Vb6;|=C6$zMtfJZ zRra!gNsX|zjSqh&(KI*S`tw)p4^LBT;2<)HX_5GN;Y{~rKF0l!Ak*bxVHnfB37ga2 z!3?Yupui-tcLR8*z0-Jb=oZAO>6-SC6feIZ9f$&rj50dYwZ#-SM;$GL`( zI~ayZi!40=r!Qo-KN9mt61_qIsXNNi(6xk4DxAlZ!fbZ)I zc~ZVgF9+#xMl2J#!E~VN*(r;EOnHZ`i)D17Qcl4y9}P#W~tI&9;|Tr=Q86)>xEPytjDt zP<_x@zOnb~jS)?MT%$FWKc-D-Gjqw0m-tT9XpIqXF7drlqt9H{bjy3%!lh>;6Fp;= zHch);tB|0jY>-SYZUnQ;M*r9KkrRS`OrHc zN;~5l6Qk9y{!+g$qG+ja?H78mDp>j2a$mPEb>H>fwbz!`ug=wii|(z?zB5A49(s$G zU9(PGyEF~4ZUacxaRQ7i@&P6Jo2kPk$smxzC0=6^RJQ;-}x%w-L3i7__V<3 za9uCe8wSmbJeBx%%3Gx;N1hmceC)BX1C@Js*Wrtcb!oNrZG+v=GQynSOifB2*27onhk`*h#x1G?|^LaqLdVziQ%^`_gu)U#)9(waVe zQ0v%fS;wY`lluBcHsn=pE7Zcbb=1N)kJO6)BRsj2)^y;nT2omNLzudGE-vezjY0GZ`6DztMvMlRj`h8 z;8>0B`!AePuSe>>Q`LI?8`YZcc!Xa6`f@!9SEG&Eds>p-P2Y$?Qr{cPwWP4I+QzUg z_-^lXZDaTe#OtIdp~Y^DsL_%<=e3QVwOUf-Zf#>EblSY9ZESO1pI>;kaP+Xf!?H>n zOS@c459OhK)7V234&HoVC)#Rwil=LM-=ePdcbwOJ?P|MM?rkYtvm|i3Og~YbUAG2a z(4)2NHow!VuyibZpGOON9$lWKeW`ic1XdL3Th^k-TCp3g;H}^U%b$99N?X_**0l*a z%ig_T%UaV^w>~ekMsLWhYx0cMl`OwFDfM}r1&_xBP9MUIQGMIm?k`?@tlHPLP#e7_ z-*Y6GQd4yRt#@c7S|D0t#p_5t;N9YCi7jz05uS*^=^J&nV7=j3HS@e>eRxqjt!h78 zeg<0p6F4q`6=gcUfa>TkkChf&yYpK1n(p&?!qJjrQWu z0P3thw~dZ(67TMIAy5&iWxu;0!Z-%`McL6~ z@&l9Vw8Xku_zv>enqxH+?mu+DoO}A2W9##AEbuL7mnFR@d`oRi74zmPHtIfiZFWRq z{^*BCKcqM4MS4SJkzUMvXW@&uP0#Fx&;F!MZ^k5T!I7D?PxIB)cCW9yyZh6HFJ3z~ zIHZ{0sNES1M*7a5@06syjRY z!087t%Iyo@-F-;$(?#rUcGh^>`0n@;Hs3XDo;Pg14x6;t=ql|Dt)<8+dr@f56L#Zg z*RuDyxXoW(y{CG2T~=*o-L~4W1NEL@H}+x2ti0(hX%Dm%Iehjvgm12m)z4%HufR8W zgWa2gWjb0VYQSohr~&k;xH^=sZ(N^<{x;g^Z>6^lMtGtF-Z47u1dXfv$cKEM+U`cb zTpXc!?0(sc)_LuOkn1_y=cQWb)wNeuZ>z0J3&vC>?~e(;($lr-%A&5>@2=O98Y0oM zd<*{vcNOl|;Pd?T!f(a|=02mTE6iK^vWWUIztgk-v`Gu!UmH`u`iI)G=-(_EQrofJ z#j#o`ElC zkFC=`Ue@%%d+62bw2yIz@e2CxI(_!?pDeF`uv-6kNn^zR<@GTS=-CT@r6qcbme$AA z=}mX+(HbN7FKhZ@k9Ib?(bM$q9A5#hK(?!plXtk{Iv?AF^<=vOJm?k%p}Tl-RVR$W?kZp|Lc zx_)NSghZrge*?Sj{>0!RoCPOpMmx^g#2Z%KP*;;^-QzjG0kO*XvV^k@7gz7CzIySV z`*ZKdH{olKjo&*C=SFkl-pqZKMfNe#TkIZ=Z3ky~Gd_Q|ns)*0PlKNR%YM9+-<1xc zeegT)avlvrAE&pd??Pjh_I7sN8>#85uT_yhcl04o=7>C zs;fJ3$uqy*A*pN$7L3K6lkwee32%Jh*40sY-8|Vf+pwmqwkYek{WXxZ+JLtRXFKlF zD>i8XEI-QjJfTYt|FmWRZ1IaCx2_ede_A^L&uBg@4!-rlo_SSi9&K@cczUF^q#*pt zHro0&ah~;_XYsgIzofmkZNsxDNBslsv>gxg%>!R_w08CSR6SVql$O<;U!1i!AvST} z*qZlhrrdw({t1hZEtWh7@bbb|?GyC;BJm7cRYqxQY<}_1F(Nf2))&xIbsj$}%uz2Q zbJyK>)tlbn)@JP`jCI?Eyx-r2HlRh^6no4%qZniK7#x8x-a(J7uCI;0Q16KjgMJ$=?55a} zHM_iW9F%Ur+aLD`sk&{;KHk(ASv`6TuP3Q`S?s{rmZ8qrp{=74?fCyx+vrl(*veUT zaqH+(rrJlNs}3vwse1k767^bNjam(Muxd5MQLFkH*4G-`7ut2|Jcm^H#r3J5*{V6) zr+y~%ENiuAI+OYjoOcCdJf5_ZojYWW$@iq4K(7}uxoB0H^n3yDlgP82i*l52t`0-2 z&x+7jMxGskII$gy1K$0{w~DSP5-ok0-hf`L)pK2RLi>f%U{yj(aya_(s^t9S@GJD> zsw-NO!qX~~s?ze4!mrems;+EF3{S62tV+*M4A0OLt1?>p;2O|(QAJv_XV z20Sawq$fYaH7Y%=WNLIsJ#DIHx(n4z7atss`7XNf?T4#srY-0>`_|>FZ|PSR<>tRD z?*E5j9KXuLHrTNN8pLrh**Ffyu{-C6hh-xkek>Aw{yHfJjBHN%KZD=&XZ8K6I`ZAk zdcSDG6LW?hPyfjG;ulxl zva`z#FaBY~O=*9*{5Mm#r2l2Yi&t*>de@DwUiU&)pUuBp{q=_v-tQ7OG`GvK_aFIT zo8Z{^Go{-bzxmI}8}{$`_CmX_i_<L<9-1fS|n>zH*{_5>7rhj`y&%VEUZtU`x|Lcw|Z(iT2?tfk>%6z+AY_k541R=>6X&765JeiSz^|c+ ze^`9|uQJBOUzL6DuZtgBweRMlVZIBQTR+=Wx@h_*J(oRo@R{Sko$%qO>z!>Np{L^V z%!!6c$%?O-t9~11so!RdeUna?sbB4k`c3$o`pq-fgH776_zF&DfEt#n-{!~F?`d;Q zkK+FM{h#^K$sH zjj@lVzTEukkH=Q58T8G$vjyvK8(r3I$M3#qICbj{TLv^e{LiHKzb(#%kH0>0>dBY> zEWb}Y`PQ-jZDstwxjf;E-#RjB_r_I!N!|PWyqy>B`bYCxP}O^HpF7KwubtoL+3KUm zH~ev1pC6=$Z93h*<-VjVwm+KL=k=JKWz*|>-n;zP3EQi;dEz&=8+2>*_6LWIJH2w~ zkH!c8mH5o-6Y}ei44cXft{n2x)Us~B^^UIB$ zx9&+v8+_=#^vCpf9^dpon+C5q{Pxbu<4f+j{Y2`*W7{`%4VKXv{eHaDo^P`km}2l@XU`Srg0(=NXu_(;z`ZTa(?)l-7?yV^f`X2ZRA z4$)c)_xIgC`4_PVOMf&p_H5w;Klo$vn}^@J+`IkBvt$32_{?l4?-vj4hWe?^yH=KTK6 zv*!kkd-#fsruXg%zoqEw#P>gZcEArA|6ipekL3*+G3mBBZAR|@uRVYHMeILnZ*)e> zxrfHy+vfA157?MiU2yNztCqa|>vx-9UAV6C#lB-++qUGXWhLV~{A$Q!Pd(rryJ+#i z{pWiJ>i7IK`h{1|PpPfw`sBY7pLu=xj*L$a-F0u)j-f3-{B&L6fBrJ=%!qam-um_a zAAI@7!+U;l`oc4d{%cUqrgLkC@6G+;D?hqx%JyqIPJQB?hd#gO;ma6*!qPwgp#3A) zfBNN5?z(>3BWVer?A)35%TrT(G>m)Vy4%Zd`@B>0%g;-SDgU z>s>t8A1m^>(r;s=KS_eI(t-Jz>f)_Qc{4o5vZwTo&drFU_(oU!tq%SX6W75;7)E57 z-rJ7w(E4hty@7C21vVXTwNk&30)te1a~U@zZC&MSXXxAYrT82(Hr^CB!pFM!JQr^t z52bJ4yea-qF8ysT-dqL_snS2^3XihtQ-y!#2oJ4~4n}^>+g)fW{v|8E;c}& zHT7?G@pD|feLPkCZ(QMDx%ll4zRXPf5M*ImCnLY+>lKhFdv<$Le7P&XDK0+E#TUEy zr(FDfF5W&LI=I@0%Aehy6u-+VkK*n6QT#YpxZOTf_)b^&1_vK{JUbipQ)-1P-nOrJ zyM7dJw?D;aTIE&zd>4O{gAYyLXQY3#mA=naKV6OR0xMkc_W7fDJO5o>@w*%GQ>^&i zUEw{9@ZnZ?5A8DKH4l7WY&yJFtv1j91ju!~1>a5jg9!4ehA$~bk2Um@G`?3xYR0DH z4c0&zi zoIHIF2*2LUpUO{f?Ml*7;f{N*k_)x}@o z;;+=C@9T)t)8E3&tOk=f-g$+IKSCR%|Amhw5WfuX;;29J8CF|W;XF=43_s-xmun5L zA@t|q2sZ4GFzqK8;q5eWV0hf%J81hI5orG|ljr?P7p=4Lju+FPi>(X1Ma&}uQhZm< zZ`x0VtP8wij50!zceL>?IDdFu6rz3m+O5i0;7Y%*i|480Tcs=za~&)x4x86(_lXXi zMr^iM_S?SI*nx;8F0TpcrcNQS=(Atj)-64Vr3*o%2*5|59M837TC4$G3kMhu#QEdy&$NxYVOI~!2jL(Bw0`>^?Z1~jnP zIR=sVr1*q5M(KQoAJHck{q`t})CsZ3uYyioHx-vy!cBxzLxXBba-X8j~6{e$@NvN3{K z4-%JH;+_Wf_Q4MH4mNL+0gY>FMzX>mQEpxtAva zi0#~K>KNrR@g&Nx#11qATSmG8wK@0^{X2luGnD*3Vpbk#F*Yd|v6RbbC*}g^Es%Tr zVF!8+o6m1R1B-q$MCoRJ4gh_8>h(s^=#ZpG$RqY1{b^X5?sAEns5 z`3BT>5Yqt2NUKm`7B$_(43_#KmUP*Nc#E(Djm4J1&IV+(pP>p@;78&TOWYNdug4BV zEb>O+bkj~A>c`6hfl66#J{yZZkEwTjo@s3jXW`}$#upDb* zvBUE;!;A~4rH|%by+0w>uW0b1Z`6a?-iSrc_LE+Q9f-{<&YZ0z7M(occvDU+a^~N+ z5jzmE$XUENRtAVz=MR7M^2XfXS>m=Tk6N^6UCvF^eAYzeE0ggB2#3G*# z95)_25V6R4Uc{SnVv)}Wj$?u#Vv*kg9B;~rMZOkTuDQe_e+1b36YM~2&vDEwh*)&C z0LPnhVv+9vj+=-bh*;!1f#Xd%vB-A=`!-<*A{O~EU|&6@>Ut#dx50ZSQEFa;CM)~_ ze!Q$a&^c^z0RtLX;(iWMyeTIZ`PbBEBLxwQ`~q;iDJK>=uWNDBAOI1IoMS`rrkq&h z9jVU)2qG4F7wVgGVv+Zw{w+$MSmZg>H|4}4=d~klhSDb%`PI}n<-{T{r2b5$Pb~5h z>YH+6k>3jJGy4Q$ksAJy85{nM6LDHWP zi+ne*_coR89^klHHWnS;x5t}uVv+9!mVSU(SV$m5zohd306C66kqBF&zGlM$jaU>RS`X<#{y99NQi17gwn+@W)UI_A9rvFJpH!_ItF z_TIp9pFk`+Dbz8~Yx)WDE>QZV4t-+LA5EQdr9&S;qE8<{84Hzs7OTYV0( z$fJOz&mk6hdthm+#3H9}+Kf9@8GBR5%p0-j^rO69=@5&2Ag~=w;5Q{ zB9^!ZfhF!?U`gvF_06_QEc&M%`X5loY^%hgbB;P@Tm8zRLo7NNdb92WiA5d(Ecb!L zB5zN9^L~$5QOi+l&L zGbk5C>0qjax#K@6s|Ec4@U)(WWW#VK6Pt|>h+fJ7zu3+aAiEmA(z@VMdib*Ce1y6RIdjhR+b8nVs}qgSbu;$N z1%W#YP1tBI56Or40&^lGN}EK!i}B2MHNQ}N|xcZL_v#b@TGIkPG;nGG{k zL}p8vK7ZOJV|-VbvNmz@RQmRU`OLt@p1n*@W@u?fGnvSb;30Rn^EY$m9TR8HnL6#R zR)Xf1Uor@v#=K-0EV4C*CIed+3j?hQ5gi`QTG57y)&rQCONN+VC~d_aj;vG4CYWjX zq%wfztck#oST2qL%*vZJc|my&!VPySwl^6o9P#{_bji{$LG=vZZ$At7lDOTlXu=Ti zxK;__QN^GiVNZdiQL_$6&mQ)8pF*A|`gc0yAzAl>$5S zmkE2E?-UYyMG!d4%Q=z44$58+GmOXM&uG82mxYaVH7eJ<{W5rlal6MXhuD7}dd-H0 z+EIrz*t92l_jFO`xe8TzB3|XPxB3!#NiKWaFQLb0aOOeM-FFGSF)n*=UqbJ%E_(kqW?y}V0Y=`Mj@f*5hw`>jjwDKw@EgbU$xG05;`3?$|4*RA#Z-R`!B z#?)FlI=b}wp^;Ru0huIOtpiVt=48-Qy_{aW+9*9V zeTzho-%fG*GAhG$i_M?1o$otam3o2WxQVx9Uj|{BX zqGbjbRn&V{d>Lrotkrw^eHnmn8iPly*$e5J2yd>p)O#Afq#Z-@72Z1cXn$Q)VQ?QT zsxXdA7|Y?!GwLmj*TEQITvEbV$HZulVK{zTPhecv!dSlvz^L*tUWfZt7}uvT9;-ay z5c)S*V|?6^;nu#vX+ExLlc1;L%6T;^OwLi(AbE5hCWRaALO9lBsJ`OSHJIda>9=v| zE8eyrx(0_wg!b+GF~ui~c{3bche`P6pg`ldoe@95k|}&+_>fobP&-@-`}Nc0&@JCr-^Fs`hnVSnT0$z#$#oF7#T<2cHi9G*|I zu7-J*^)pPD_L(NJ~)5<3<;KOk% zPuQVaQ}8+Z+eBAAlo|?#!|m^mK6k-nHL@_cBQw)zxo4R^?+_w1K%vGq6Boh*EmjMfjpkXY&WDF^<(YjnppygTaRr-Nc66OfHw2Y zfbGZxv?51WwKI|qT&-aBA;zfXHS z-5JLE<1iuZNxTn$Ct(w!9tqc5L$9B~p{$5B)x`Xv4Q_qSU;G%fok9l*%TpYOV6FsF zueJNK{?r@(?d|xfpf1}ViRB=PJ?2}=KsnbJ9>vCR9zT|YebbEFrcQS{nf!bAW!Z2Q ztM1(X{(TuMiRr1fpNi*FUF$Wk=1Ak=Er$*rJaXXJKKdKFx^7$bVC_NZy%|gby;NA~v^G>kTs((l3wRoDyPxt&zf5 zE06HARb8m*4GZT*zLK~<<>k_rBd3nNed4XRPM$h(_V|0p{&e({BipKHF7&}xprVad zQ1{XUS3QusB&&8utzFUpuD08j1SUNW|A6havvqodc;(3c$@=hY&o8iT%ggTHpr!r7 z=Q-CYFn6=AZ0Ze*qa@dhqddj7|3%hjR22P_NO%DE1eGIv{d;QncFq3TG~H9Qt$Jgd zN43RKM;xB8^fQa2+DFZ?Vv#@L@DxM7-t#HEeu`Zc!{$cU1hijh(`(vC-E7s9FBqd` zN3YL+@8S2B22O9%^+I^|sJ8PS1)I)ex+gEKaD8F)u=C@mPdG85_{QBgrrfmlrpTY1 zA2AF^_}}7{Ic*wG0F!t>8zqeK8?Ny=tHhFpJMLvE^cdmAR=DCbUHnKFKgGd^rq{-> z$1x^FiXSB`M&6j8aSq;`sxr=FeuI|bBI8IM`COMhuE9~H!gmX6>T@lQGd#w@kG3#1 z+G?SEw2NiZ@<;9?6M@rl!62n#^Kp;~L@YX2 z1N+Pj6N{Yf#TSnqh*;#wz`mZ8s&8_NJRQ8;qhAH=!x#jKSab@3Gt7H#-gC&k_*7uY z8?ormqK>IQA2=ftI}r0A_uPE0k+{SXmt_$hrYpFF*t~aVxiWY`2aUoOhp{*kvDhgC zjyL7RBA)~7?T8)dE^HaR*n{rD=Id=h1B-qg<(DZrvB*~g%l8{MP{*uWV$sVyT~`^od13ojRSBJPTOfHyB8L9&iw`=oeFNwohV_%gn1iiz*YKj>iD! z1ZQi{E4bg8h#A=VlLMFsoic4|`K$#K@i;JJ_T&IQ8e~j*w({^~Oba>n)l6ol>!HeR z@cYhF@-ED2-Fo5@gO{AAl&rg^B8>-})~6wv7HVKFW<)vBC@GkR%p1Z>&OH7z(_pi3 z49%{}IM#Ecum&75A%Q$~iOsIylFv+sThW^##_$_v;#cq+fi2JExz>UG4o_|7hhgj@ z*ta;-<@s5TO-StdA#mC|3VYR%(H?KZ#U9(T)1DU$uQx(sFB>way)qQMCjx2D`OL(% zqKuwp8sOSLhdBe2=PAbDex}~fp*PjU{9zckRpu{#4Em#F$mFR*Vx6L%<{Auk)NAdT z>2p8)+6fM#p4-9bo4VR!4nP-!upwd z&(jf}Vy6Z@gr~r(xx)`CwL+{Y-u6U%v0bKPry5>_R6O+yzv#5l^C&z_FEsDJeXtvP z-@SWOO4-`7$nocgO)ouBT72#9Yp2okYUju!iHB1Tl^z^;a#J zJ>avj2YeRB!e?PDd=|#SXJKrwi;ltAy%U=GTniu254ewoqju}+Blc~Y@9+0}gamfpuTca(62j6XVNYxvd+h3mzF1+s{ zkKPjAx6~6X;v5V3h^oGIp1{$~+UVdR)N-ZciL?@)BaNd{f#(P#R8r8-R5ttC9nw;& z=^K7*wZljDnbGk6ZhI+(M@{f{yqm!#TF16>N#nznr`@)zkgK34DP>QD?YnqNsqLM; zvREG~_0yV%;=D-PhqAjD8Z)ovmB#&BUOv<^@(*dXZKu_@^~`HqB>79L-WnC!i;aAf zHQ@HVNj@pTqseTR`2O7*)fm)=R$6{oTk&pec=7yxaf5ii4;H4pu{A24BQ746TXITo zu9uR_935uz5KCg{E&sSR{mdn7o!M%QnAqr2HRbf~d~yAL@47^qmGDjPY@w~y0DQH! zQeT%WNlUP>wS1=pU&_lYe5A1Bu&>9@M9*QD(nhVtv;D4C;^?U>W6Ivr=B(<>ngJMi ztx9gIHF?%(S&p+HWpz?Qt%h$Az^nGE!mwfa`l5=2gpv{Y*Gw!NT`)8ub=2sDAqi#k z7f!n(;i?4f;-KQmvlgf@(-wuO&ul9P^b*b-r=(%qWXOu1IF}KwA8``R+A0)J*U5s;{bZ@q(*Kl0ap4aK9=-Ls;|X(b@09bz&p(>*_TwiHUFEyF>xM1cuQ~8l<4cKE zrNg76zkRyHyw#t!Z2s+n#E;@muN`^(*Ih0zK7Ie+o@x3pKBxZmU#z9y)W!22T9FFhF084)&%uYlzzl`)Oh^&O zx56;u*V}v`Vw=#l-iE!Ws9;d6cEW7Wd}gCPwimlSsPr$G+8ohic&gb3h39)`iefdt znI7A)4(~J6=lqg{ldo{_N5Bt2prro?@GKjLo0uQYk&#ld=~{weuZtr+j^~h6dVP%W zfsSydcdLUBJsxq|FA;82PZ!_I#rJmcm$~=^7vIOlC%X7#ZGoA13Vt~T%rQ72FTiZc zJIcv1;r_xSjNy%*xY++48*K&)~ah zU%T>u4dkRbkat0Q<$HKS%pceE3Xy+K82pkiGt;A({106`#|3<52S_aAdu*@1;n;zQ zMV<%j8-X1t51YtKfMr~I6tHh3b|7NW83!ynQ-DQ>Safc6=*$9^^__P(^od3PK8HU0 zVc&Jwfrv$C8L*_g4%o*`frv$?0a$dl0!!YAMdvAp&Ti_MX%UOgOAehQz_NzsIIxV# zp9c1slM}=eH%o{JOMbJ6YU`O8**HTMJJbXvs}a?zZy85jTA+H- z#G;c&xp^#zMP34&-W5C0RBTcY#G-QtaC$fFKtIJM{&W@rXRuL#7Gv|8b4=TSfmbB&o zr<-#z^MNyxumkb_MEvjE<-jbX94}(AQwJ<|mJlan2U?BIn_@u2Uy}4o8z7Rnn}8+m zc3?TLiA86ZLuU_l%=4O9boM%Q4pGN!Z^WW=f;xS%1D(PqWg!-w_kblo5!7Ktf`~BGTm>9& z%85nJbKExxI}owRi-F@ZDAhD#k(UDZH08u1XS<4H=K&%X`DoyHQ%)@MvA}WWjSsQN zS(WjooLJ=3fqhg25sQ2daC$#V)xdh3-^QZDwi<8BiABzK>zl0fiA7!koWV*3u?_D9NlzbA4em7w8QN{P3M2A>(GJ(_0@^Y<&rFQiw^J0L{2R7n}EFomHs5)xIs1+ovDz=n{r~2&j6M-Ni6cYz;QfrLBt|2 z2aY%8#3H{7Sk7x=kuRp4CoYIszS+)+Mg9n|v~yySH&XwH zDqUicZ=t>^Cl>imU}@*XBHsfn{=D{4r@gXCEINlBI&V>j9SMk7bj~_-&N+05MdvGr z&ey7mERww$0~N>AQ$UpYxZ}cM*#`0oXTL z<%d}0S5a=ZRbr7BI^@J69}X-&&PD-CTO}5qGGJ+|#3CODEO{Un`4q|nDsRLh=ewKI zFLgw)v^QeW=>i;YUSEhs-Wyo1*Tf>{bx_(TvB)!jko&_S&PB`CBq-h;H(v^$IBib( z{M-5Jxq1WLUI%gUThgsWZ}oj~nf|x+Ll#g>S+D@_mE#TI+owAeP5w1_+oH&XF`%@N9 zcfZOGi+_LFNNX!%EXxiXBlMHKK|exP89;>O3-H`w1w&dv5FR4Opofuf#j5 zMZF^b9fxb~{Ap8X2KWs%*7i)avpIpklZHAf-+gdduiveq4*$eEXTk>qUYy|S8LK8* zdriT3*PO4K8}FQ3FPCRqt^A)^OoKk-C5-Rj-=Y_LYT7pr0lIaAvalzPRO}_!)68x~ zFU5?*A9RBT&A^_|40#5pX`4E!F$3x{d4}=wb_*gn(={$(^PsH%65`=X#oaWY(F#Q(&US7=Fbb->r4pI|+NSrak97 z2#v1%eE@ssTe0^GSN_hy-eJ=o*FG^V*55RD{t#~`X`8__gE$FcvyrxPy zc>l-fk*3}z1emu|hD7XDL5XqlOuYn*f5>r*flTcE9ub`O=+nr2G&5p~y^{b=djnx_ zFf^FIZVr3At#aBsjYu3r6%xo>ZKu6**n09jWzjo7?(Mu^=`spGUa z4*kI-$Y?Ll45Pgd%;Uj+fwUO*iWD^Vw8L#BwkT{+H|QwzXkSP$pLM7&<)R+TCd4q( z6)wFf7$2pAjJ@c649;n99Q0CK(c@ZFr(VS+>~TnfdU8yULT{?e9>f33v?oD1=D4Tu z)FB)DHK z*6iEM7dT$hF&DcfkQ7#Xd3Sn1_V-^8HyjO)>8Z!jRE)dpT4hW9+Wy*^Zaddx-|#v- zguJJDBF}W=SK;{v4?tpN;pR z@zyhb^)n1RdS1O7J;`_zy4RRR6+^K3Jg2Sqq3aQ{!daG2yZLr?!*{w1wfy2zYlTnv{xZF4f1w_JV5(kqpj=P%WZ&|PRuFkMa?CP( z>0Yl7R_o)JC8fTq`MQ-^Z!PIX!J?%0&xbizK-f9W#VWy)VJnL>s{`8W%m;J4zd9WC zJSM37#(MCL`5@|fm$p&crzPpfwT=2FthQp#wpck^ToR%ky-C{`eOyaww@=&HZkKkn z#OJ}c>XEy7-F&&-v~H2IZicHo4wkGm)=Qni8|+5;=kC^eVLjClek0wK=|xEi&uh*S z;ET8$u*z-(ot%{N^yK2& zm+-FD&g#tSv~(lpyA!tA6J@Q`;k!)v#m?1O^`3TmR8(ijnlD-J6BX6gAr0?)tzPdb)#i2e z<#t8ggxYKjrdTVwu$~XPwqCtwa#4MxUh2d5jO`l5n_6|Y4M|g0QFSP`-woqBr|{%! z^_5tqvs&vsTyOBT&kOT;U@@eu0q<(8pc%cv7u`yc>(Mz2xKgoyI8zr5K9ji0XBz0Oj zY-6XDXhnKyz30p@XYFn5_~kBvG8})0$+DBz#g{EyWP|;rF8)Wq!Z&={;E}Y4%C%!?(l*Aru2o|+FB3KX{;;_U}b3lD@y}dSsK8~(kWP3It43B zr(k926nqVPayZUmd<}atzJ@&+U&Ee+bARfh3g!(x2YgoOMK}Xcvy+Q_k&}m3!ChX^ zQ-9!mr`$E{_1TM5mZE<$d$CQFVEx$L^CC|q9#1*8t$IjV+8Mpjvxbgtc##l@%5L4(q5UIBo{Gj_N*Kmu(8y z-b6U>=M*X4er^fZLiIg{euAju4utVJcBRPU(r;sg<5tBa#ml`DSC=rpIcyCb#pj8- z$=mm*ZCv)-y7+c3zJp=^5zC(93tYT86bxwxSNu*!{B@ST;u~B%$Kn*J@J+&ET?Nax z)x~dj@lUz<-3~sq{yQ7?hFjr^KPWfVcw2+%O>u?yl$%3@Hz1tEA01wf^FN7wyO$LMO2n4V!huS#NnB!yTj7usi+nM#tkqaSY+f|h0%vexAZP7!u~^DJ`aS=N87 z1NIHY4n!;jHsrGkh>=Q-ebQ%)@MW?->NEb@cElJ46M9b(aW z$D#9)Lx)&&K6mJNah~{CsUTv}i3OH5D+$!$pa6(ibW(xiN|l^g zqVp7Wu26PfqK?^4h(+fBaJspU(IH0I_7aF7Mxp9YroOdnCl?AwV&=K|$sn;{l?B|_GV+5%$H$pV(O1;irfyn>`lEOLI&Rczkm&>9pcge9M7CFcA<=7F6d;|5(V?-?S2I`w~Vv%nJmSaaO@~431*zE$AJ|qekV6R`b zu@qu+kU9-mz6D30QW?ogCy%(F!tL>s-d|zfYo+s|4dS&`uyJiQ_u|+@1eXE( z%mHy?$@5LXVrK?*Mq&pd7M*JoOEYC&-Z4`u^P0vG?!-H$&7V2FRUh#x9B<{{KEHh8 z+=WwS%?wPuggbeqI&-#L)mjZePiltyw8>Lot+gr5S+f^RoHMQb&fDkTHgU?`nBSjR ze*46QbKnSWj+(pv&ZPn>17;?js|A=a4AHvbjBSBN$t~07pxB0Uh4O_)N@k@Pp_sjO zNn5SG1tHmEDk1qtA>DrHty&0O2HVT2C$4^=B50~ht#ey7mjIWL)h9B^Ti84tlD>YxHA`36iysbbp7@DLyIO}bKS`6 z%koE-O)MB+R&>2JA6++j~{2y|Wr*U2vr?y42aDRIWG9g@64XVVRI8w2W zu>~cNDAz*Ct!Lh@8j7OFHE`$_v^*7ETY`=u7MQoZ%n!rZS3Hc(X>SzxL~KH0kN3+? zdz&2gIG-c-?nDHqz4-_$6l3@md-DOD_FjNJcHhh&rp_#TZvs2*?FP?&O-Sq=hrnqs z0?$5D-nM2K%R9i8zkQHVE+qD{T>0ziu-6XCOpEcxVRPp1D0tp?3yHn!A#mm|2li$` z#`5wpP3&a=JMH}x%wEWZ#9k@{PJ0b7vK2Dg!_ooE9>06+v^N+A_)IJ$_P&Oa(_RTG zc>@|F?eWo0^2fY7?cE2R8Zm}nu@_~=$uq;=!3C%qnD%_w#NIkYpgoBffrBp?Vk3;d z&%5*@FQNCJW*qZ!s6|0q)7DI3E`}yO=Tz^9E`bai(jYPA`O4i1v?%B?fKZ7xa_io=1GBm3hRKMYd0Z#U;MT zLT#m$U(5@J%p=+}h3*`vnZk$uiJ3y3-Z*+=9!P8RiKu z!#rUxg!e*tFU%A6!aQNGwCeDpVEBt=^nAFZwxk3pqh6ypS83F5^Mof+(~oJpAIPfp z)fH=~;Zl3fD&QTXN0kJ$G5Vuw2DA9o8v7{qxHjOOrgttnWzC-sFWFWXsG!F~%p4gW zCbnr&dBgL(g=K|l&6#_%_T?V%My)LBe62lu7gdsWh<1GK@`|H_gJU@dL9Z;wY9`!o z&qQ#J54pz--x_#Cg!M=*Z|vIi*qkVPuBoIX;9bL6l-lUL0qwM~0nz9aqN6qO@%Ye) zzU?*-YhRMK6mugLn>D|Y%jV+xg*~*J*VMPK)GJ%kmcTa9wk5vtJ+#H%(3z{nUgyl{ zVsCzNqg8hO%*vvtqU>4j#op~9v!;u^ZHr}Q$(~;+DVb@`moE06b=Y#s-@Al7J?e97 zj%!=>Vy{^306#a!f+wu`*5M_A70=+D=%v*^&@L=6X^8$|SKn^V(P9RvxE^!bsg@lz zyHk(Z9m8A7Wth{t40BqSVNUBZ%xU$;oK|nlY4ygOR&UH{^}?K1FU)E6!kktw%xU$+ zoL0i3ifQwbQs6lzxiU5>5uRfb;5jDK-#sZkzdJpV?5Kq=lJ7MSZMQ_$Za;_Tn<)5i zXl-WDJtrOQm}hp(_+bXRRF|5MiYnI*S#_LN{av%pc5B0oUo2`T7PS+L+KEN&bVu!U zACLZI(W0uVe}~yHO}pN4(cpa8T}Iz6yKuudpKx4Z6B^z|+l=`4SPE@i;cboZpIYIH zU*zJ=Ax}tExP9GMe4R^wnTucL;@3I&(EPSD@-x>ev*PXiDBezA@lRRy6u-;GzvJTh zu8Jb1Z;$D>)83FU{D$EUjrGT|D5rjj=wQCW2zT)lT>Pyrey)q}?XW-3#Qf25M?m|- z9pU81Irz}}Q~7;CvWxsLH+A`=;|`JU2-xK2y{_=iF5agdF(dO{obx~L*~X0fmw~2z z-Xj~n^R2R~`x}mxla^rPd*Le#PVIRA<4`y3nZqI4CPTlimhDiWKJO_>+mSBkkDNDI z4FA{&RXg(Ey7=2&_RhKZH7>r=6~C7&{5}^S34Py{DiU$F8K3uiKHl_$h((UuWzA>a zXcCJ&0T`E9gVG&%Ah75Yi+-L%XB2h%VFw}>9X^MMoLJ;cSLUCLF(cm8gA%dHJI#C! z@tNaO#1hxYk12QNr-b@u9*9MMibGB;@>_vrev8kNGLLl^a0VYnK%D!Oxv^?s`5wVy z2WC4H`PJ0-Vh3U#1hY;AvwaFS>c>15&iW~L=&_9uPW$=K2c43paM}ejOi6!pa)G_DM&Qm7`I}owxTmTk3k!Y_n-_{;D zqdT=R&Iv3&cZnr#GWB~Xoh;xubIg%gbaH{?O*yg1ucCggic2i=tEq3wiA8SAshAH^ z#+*t|6_@iU>Ae)50i0o8pzZ;dbB$Q+ET(*b(kB-A3Sb$BT}K@@SP-%3G&pp&QparD z#Ggfj#%VOUXC5H$P0kwee_c5nDtLAI-?yr6R2YzJ7Uq9LAe>1Smbko#r}NY zICE}~Saj|HjyL7RB4@uOHi<>f`xdde&Y?prIt>mTp6@>MxDbm@Gv%xdP%}1>9|V^3 zkyzx1f#rN87CHM3IUk*U$Z_hM=OeM`vu}~(PAu}=zWo!vbKHNycaHjFr2PAh`7fCG z{YU)mA?SZ?n16u`TK~U4$nVUebK>Fu_mO?a>_cGwG!ER)o;LrsS<~=x;Nc`qk6rPiAJ>EwPiQdZ)@SZTw3|NhU>{wu4)}3Sc?0cQ| z3J~7jjKd$XmjU3kx7}gSIfh?`I8J*b!7rg9lf>S2;GOpN!5;6wm_H7uGK~4)ZLibb zTi`cg6B2tV5IF6XM62(h(w=h+|DrKy80USzkiaMioc0p%Sit#O+5@!m$F*k8{BfSu z5a5R-_IUku+Is;9?FGnak9lGk%X>c}(4NFgL*)vF*fKrSrAPlqt?BJCP$u-I zDroGP7PlaF{1sZogX$m&FAOO#3dhdzO*qC5gSs$h0%x`(W=V z5@0y5;f#Z*+U%(zL)zvz_NB+P{khrwvy9-s|9zdsxCk*lb_t( zCCz$^-~b-_^adk5Mr0R-5x3qoIapMN6Onpxof=z zVgCoy&Aq=QAH4`t-NIf37xwy^Nb~H;4DJkGRU_q-5(kSzREwZA*`yJ`uZ zz>9)7Bb*AM*)T3Q{BScK;sz0`;IjYi4Buc(91`nDS9IKzwA zXo0!8dZ;h-Ee_B1`k8bs8J^Uozu>!auml@b!-5*)XGgrM)q5s|+cQmu213}6*gZp_ zqOG>&q0-=%V0f_yZ*TH#qW;U0wEddL6Ijt-4==(SgZm@2U_{2!ByE%Ci3qI73CWq* zrSEmgkNc}|dV?zO#b1ZhTX`uGM~9&4e=lcT$(!HZ(q`8M*2Zv@-lug?pb9;-QwGL z=g=ZYC6=u!3mgC0F#5RX`&NlXA1|!0_MFpO3X1fWRP9(u8%lM|XGuF9QP^J_J#19b zh(df`P`kb)-_KoER*v!0KbJq*0}ZafKZ~673%vjF<|&T%-!UfUy_sM>H}o{+ye~^I zF>VaBeihh(`23Prp?)c+9^=st?J}LeOaBJnSDwPcn8Z1?zQP#4;o1m1K=64>QMh&| zD+9#gM;#-_q52*dA8Eulhffeg@pEXvAjMA=7U5ZZV6iC5h@WopO8;sXU*h6NyZD=2 zy!{*(sr7f1pI#0^%M)#+&$22~d~adVZ?b+CIru9=^55PFAM6OHeuazYIGrM8Z=A5E z{pl{g+`)(Dzr8E}9gXy(t;VW&j>9SHs3nBt*K6q8^{ezFT=CzL=valu@|<_^H@o;6 z7r({DA8_$sJNVG@d0pk}Vx-UKD@9$j?jhxgF~Soh7_(x`Z%0{m7h4x6Ox~v zuKXx{J3orI^P_k>KZ>{W6X!bLdb;w{+epto-+OD{gq)uVMtE^JHn4S!jB-F<8184B|gWZ6s2l+BAnwOVt+SyA9(y& z`tK=a>{GQT5fJAJKj#SFgz!GDa49q6FGqN)BRsVKO>@;>nyY@&jd0G}DN;N#8p6*N zR#V}hxcDP3zR|@$=io#0muaNm#R|`K<*%O+evcKd_&XeYsJ$#h-#&j7pJ(Z3x$Nf{ z`u6#y_yS8`@wdA8LKkoMZ#gdexrTkV1x2~8^I@QiALQbH=;DXC_#e6Wd>4O>i!XBV zLtT7{i!XKY!!g>VO41WQT(cq9TAmYJqp`+3nIAFuNNuxya%*154!QW}UHmB*f6m2E za`D&Lm2234)y&^wBmHRYEt3apgzK*Oe|Cj;bA?~w;$y>T34W?@j&wm!Fpwv9H72f3HIpN<^TQOd(X@~lYsrb|M%C=?>(Q)%=eso?z!ild*?ornLBr$ z3Gmf6ep9vm&g!W^JpUNrUk&j84Djs(@w|i={UBpMSuL|XWsJ{*0si&?zcaw|+aN;B zpJwB~2Dk%$zt#uZ&CzHZ2c(ifLSYHTR(P-4*2igK2p`c7ag!7 z)wk9^Uh{Rp$b63NFSJU3|6uucz^AAS+;2e`K40;fHp%b<)DKbo`HE}adFdBLz4LyG z8mw-LN*}82P~Z5QrY73<=ew{SFrM$%*36Fn-D~U1-=q$zkD6=ivr6-s>TRQ{=l*oS zmEZ&$zXqM&SB!XX#Nb1xZ9b&OF z9$0iHP=`SR5sMDb3(>g}IK&$QAY##(2^?BaY4qCXW#H2p4A70(Lbq$EvE;3!+~y?~ zIb9KbVvz$X$IgjjlQ?V;5c|Kw2VNkygv*ObolG2(yLwps=?hVcl@p767;xwwqfaby#x1?Ok&nkA zw9&(&a~VWQJ&c_3%;;%w2@YbDSoG%ui_J3X+>0HESacXev3V1)*sLVBYbewJi+y6r z%YH8Q*Hh;{>_Eh#vjJG_Gg<6E2rM>6 z zf79`K+{l~7XPc2Xi%*l0H;c~`M&2ww`9`keGu&VupP>fp_*kstGt9_!d@R=S8DZqy zr;j$c4Gu{bGq0>iKrAt#9a)cnSmZr`Lr-A`A{IHDGxS?Z&H6qf9|J!0v=%F3kzeVP z6N~(6%AdgwL@e?ffyF+t$X8JQEOsDbk&|~=ASe!-GhRb8rtzc)=@?#Ou#VwagLMoq zHCV@xjbkajKoH_N#ly*$dsuv6xhYmoEONGE`V~f>J|r^$AY##>KPgu3Zx{B@(DT@V z{C)LI@afaESf%2Se3ggACfh5;%85mu1}rv-MVzyUu?-Uhzu5;{@_z)P-@mJ z7WswX#U`=H*_D%bVFw}>`Dox2D<>8?n<~8!I}n>Nxk$sPcMv8)lw#$?l6NYw_&_Xj zs*24L;N)WLK*XXm8#u+viABzFUThMJ{5s%t8UQWEmRzb~)V1GD5T#f-vE;o4SZorD zd=+r|Ozc24*pg>ysIlm*fhfhwiACN3EH;Tn{tMuARtU5KTk;$tgGJ{)@F`YKEb^_u zVv|_pPXH(H#tuX*@~44QtejZnJApH7o9^-9eZa{SfQUu^CEye*Cl>juz+&eBaPnU4 zK*XYR7&yhsiADY~a54)45sUm&;1nw-7Wv$it#D&Zje(I*mq$Sah!P>D)-2myHgw=&bR{iABC1IO$sKK#yTd zTBxDEN0GG1;8$@F|A{5<8^Gc}+fn@Yx9L}u-;N!KSn@K?88&WAORwPG{9Xud1zvC) zV6jgub~;k$dh9^S*aYi#S**qSe_M%LZ-^vsrcb{wu+))QbO!l!MpMVO5wYk@@aeEE zM2A>(X8LsIQl}9+5V7c#183N}Bmt+h0YSQs7M}_}{U=(ipJ$8Dr$Z!m*bgOde_-*4 zSah`gn;`%(CZP>P28)i4&rgk9+u;BJ^4rM+pZ+sS&2NhQkHh{fcG!nAmQq70cCYj$ zMCSggU=|~O5=-7{;B@Ol4RwBp9f(+T)&gf(9j2u(Sr662~T;;+Ev&IWIW- zo!!pmEvr(GhP^39}v)au?4#j*{D`GZ!4s3S0PismPAGN+(vp z)TR?Fm=1G-BG`M5m+S@5=mZwMYPs9X3RrqcspeseN^Y@ZSPcoajbcE`ju8;qj?r8i z4r+S!vdS&j#QXXbT6xa=S*p+6x!29(Cz}>xiL>K$n*Y|fv(TNQRsd@rwy5M5!xngn z$c8N-W!M5D8@A@sa8T0=n^kT(Y>dG1KG&tky_pNlnqodBTVZ_S3SY%4p53RsuxM_n z`)Rb}`FpUJheXzw?IQM)AY*pPcMzZ@|Jp+Cx0iZ`=O3@7#oj3} zMtf`{(%+HqIs^4y%4rwyuN?N+cJ!|UHnG>o+LL^<(dk<9kKY0F`&V|R=O3@{#ar+7tgSL#CGEHzZ*1kyOt=>WhEvFb?_sD@Vc_qzg$o zc!?>>zqqdEz7XSwP`dWIS$mQ%4(CBj{+$u9_a*E}{8D}P&VfIE|59PkH%z+y9IwYk z`8Tqg8OP`!pzGhc_WYIp+#9@LsJZrfLCzTEQ3#skv)2PW(|8{9e`CLYeD{>&g;0zI zeQ@;Kn*n>7kkP+hHjVbawCyWC^`{>!z>?VeJkY*tV6Q(4pgsO(h<~)>_iqpcVw)z# z9(DZw?d#>mFU_XWzp+sC+ZzI798-nF-bl#&_71|{c*y8qIyUj|ZUDc%spuE%??Pg4 zJ@owcdZ3bnphSCpu!+5yf%uif-YPMMqu479#BT=dy@7PvW4nmG!@z$3et^C4kO_&s z*C6ow*Z&-)W@z4YVQ`$xdu3ZFebG8KDA0`~eJ$KHW}y|q4j7x?Ve2kZ?yj=ePjdmDWA zF7nyy7qB<}IQB9F_8#=v8|<@J9Z1Swt&6a$FcXDfW2Kld-*^fi#O9!c2n&rsCj0GVc40KGTZ?B%9bYl1RbC&JQcVb^CaAIF7bz)zxa5lCc(zYle z`=c9F+FRMBGo7?ImOWqPEZbY}#O~gNuX#T1bc-Ew@&_kxY_~J6D6Vm4tdn!N@#D{( zoP&)YzwP84$gk=4YV5wHfc8)u&BDGEkyQ20R6NkhXB{Y^?u6pfi zEU9&R?acnm^(uSbW_;%^KL(!1EZbWe6T7=2rd#aJlOi2gJKf@TCZLpgu}=1<2c5DnM#JQcGiF z_f*7gjLH7<0i?p(tdCJbeeANGRY=_w8@v1Q*o_I{)O5J1w$rh&)%%E3c5{hyn3_hP!Kb@5&ZC1it;B6Z!FrZhU8}r&o17q zy5)Bmeravm{_N6uPTEV^^PX}V=bfdB3S!T#Qd19KmLHoI@5G*$?=-%5tJCzr)khjX zi#WND@BO6lkH1v8*QNHz{;W>r9(-m;_Mgvon!4O{H2ZIRoTfd?M?@-b9TAEztq3J- zYafdH@NbdjUw<1}y}79IZ~dGb-)hXi#QA4!VN?;;(i6YMMH)xh7KGt3!6; z(^xB^TYYE>BXfCe_Fldx{Lvb>W)a&X0`>C3L>!t0j%g zABM)phR6~6^G;pk2*kQ-v-<1mO{<%FocUF#vd84c>ZerB+6&i3CXaBk@SWi7y_?j- z4Hc^g)aEwjZI2`-_RUWGy?SchaQJ*w4c9(z!wLvVOwRnEHmYd6+M4nOWR#3MS@yH(@vJ!)QU zQ>XI|hbj-nH`Fv%9Z(zV!?hRIN2XLbz2c|UX2%^;jUx`Kf2_{!JS--ZkdvQXwOakK zDy`x1)r`^E&QpvL+C6*sa#c~=^zl7!L@GPaZmj-6ZEomVI}m>FRukwq+C4k}Yc;1P zH~!$CB5_quXUG2$F}t7!J{_b_wkPlYP<>z9bmaZ6p~_kBHYVPoHm-Y8_t*+&GwW7~ zHXFWHUAsCrA@})E!pxf+g(RfPJ9k6 ze@{&>&!2?H;mp-))zQ^W2@7V0DjPBy6P{5U8#b+Gv>78rJMnQuy9s@*X;NBkr1HLf z+3}yLt!p1z-GErrBen?6_7OTpBfdQrS$_7~Y@8cgO^gmPMq_Kc)i>r>X|Jzcj^E7L z+0_rJN9()No5S>`pss1=-Sf;Dfit`Mk1D63arm!PMNL<=4M)0fZQ7pWX}U)tKn>Xqu1)okr^RzFoAI#S>~9RFr* z?vZyd4kfPpc4K`;ZC3rxy6l7}6h?w6@y-zRhTJK?{R%6WY|E%=#QE0~5zmglTcNic zS*PAjoVL1Y?{m*amM8ArRND(R+g9IL{i%8uXVPxxw)l5yo0i|%JFH^huaj*L3zhpGKDd>StY7cWVf*9$5eGE!oRoR5;6Y>C*EQ($GPm5f8^ksk>%@R zA4mCzSpK@k_*J_6DNY}H|Eu4BjNHGtr>@(&C+l+R8xuZL+i;Gv?gh0?)f>->R9F9Q z080M|rFUz{u3Ce0Ix@LIUB$MU{NS!g_2ij7SNDSVPt|89KCkXr$)3d8BeG|o^JOS; zM33LpJX-%y&E|EDm5-{Y)`pHuaUN#biRTW@sOz(CKwVaSZm+cugetH9=gvJJ?|W`|7oB41N{)?n#`V_anMZGp{HOoqXNE4-W5tN%C&>Zr>7!;!RGrvLEDgxUkI9zM`?xcV=V<==f6s%k$!R6QgdS`|u; zwCnLnWZ4znBQejN8(Q6Yz-?E&d$9WL$gVGsy0JJ9bQZa7pE+56S8 z?8;#`OxmA3Bkx}D>nT60d_jSZ10+tg&7VFMc;em85!z~|F;cPmJ1 zC@P4hKr^cRx^*NlK&M676bbG1S{?Yr!?U}GEtMcK>w3Y1!hmIbN?bFab^#!a0gD=$g z9EDX`x_5gL>%_o%T;s}3dBrpOI-xczoeA~+bzw$hMSm&#m9^P%eFul2Up(VJ6>0r< ztOc{#O%27xeTOx5;)>r}shsUj{^P>Yp(=b=9&4Aiuk*ejkMAYyIU4Kny?m?1;Qt-?=A|vk z+m{z9IOv2r_f?U}lbq0$gR0Y#?kjf1-MgYPuKUUl^bu7qOiXMxe;#D)@Q7x_8N&s{7Ix)V)ieRQsY+Z$auU zNL_~1WlyRVBct+GBDE5!RY)Pj{Jhi<=0jp-gt2Hf&H&$ zVVxhYl4Jf8ls3!7e|t@jzx;VF{@ZJsjQ{N7J7q?y>Yu>%-R~mRGe@ND>$5-WrJPr| z9!xLy%MJc@TzX@DA8(y8Cx6@cUXvOoC0t&L(g$3d@NT!ad%ZRKjd6!39GrY$>Z@11 zQuI>VO6TILVNLkYJ+iX3YHEw)t!-5<{xwD)QD=+^ejmfxG1=FTmThW_|NgyoaC+kl zC$G4@%y~b)Emt-2Rw^o9Qt3DwxUY)a(fa3YLvbDB?MiC+YDa4&D?CX=oDJvXyLcGB z$TGfY(t$}sE`Rj$Zc}fY8gs=L7Z;7`in^tyV&$4td_b){wR_K!fvKvjaM7aD5;e1M z&RiV+$Eomt+G1f*@&ByJd8LaM70xP6HItD32W-Q`lG2&8X3x3$nz{4lFDScq;iB@2 z>#kpX!;Sw<M1J1U;s{*P^2 z!q4CS!JO-R6|Ql{uOD>al1C0VTy%5q_kXtVpV!Q}`KG2w?S!f4g}45r@YUzPd;Lh^ zZ6B(e|21mv{#oyz|62J2>knN2=Fv@sr>FmN@ZG4u-{PH0{(YUypKyN!{(?i>MhNgd$jy+`%oKS z^BuWPY8%o|!G_zM(C?_8w)&KjXMB0z)(}=506$V#JUJ%+ivaJ%!=$qeLx!&t*5=4K2i50QvaD12VXAJl05R1+P z%2`nmvB-;n#U`=HAEVsr6N{YZhUgQEd>rLr>_EgKp9*~3?+4g6n(fnP|4QzJ9f(-$ zqync{IkCul0Lwe`#3JtvEbq({i=0I!cfk%sEOJ&g#mb3A&NwHtq9A|F*-uieoLKbP z7Ri_^L?RaX5a1LmCl)!|C_NcF&=_o?ei}A^Z_sAA63LSHYU70dGws1i)E@m;yF!*U<%y#A6b29}U zg%r;&T&QcJCzPA%__RQWrx#VsoLf5IovY}|7gfwteg2(^+3tMl;4J3m1*tMjcP^jl zPGxNN-QpJNOovW1Em$Vj9w)1wZpsOye3sdKUTBMrgwSzTDCT_zCvaw_vXA_`^eTSW zc#SNy2mLt|BOI?q4Dn}yIKlFL?NJVrB@cq2o*m}3s_4m_1nQG&I-Bbap04yK4qH2H zkHDDU-Vn%=unCF12cX0}c{brb*y{mIdw3-7+T+?uetY~4U^zl!uP$J3pU*#D6N!Jt zz@5xG-3Ff59zvqW@yK6~_k88Hv1#DQT z;|k+KJ5mqM>Ga$C1c|)%5fXbR2kbqF--dh$ z_K1U~m!Rh-v3DPYIIrBIsCS-EQS>qZ{PQz*VLV`+q%NZO27uI+X1;^HH7J1T=U`)f z*?#AR`}Olp$@tN4H{=Y+vg$uRKcgIlu{?9W^~V2X;Qkk^A3PL33-N#LJYn=PRz>p| zz4Y&||7W||uW9f{FzRI;{)km?KQ#N_oZB?IDTUU19kf@gKm{SpHht>C&v{9j>H>!K` zBRQSa%G&QcXa8%P%C5TF=^9@=V++1jGNVl-eocJj@G2*CWEGwpJb>p0zr}Nd-{QH! z11fZ=jnn;>-{Wb)19)2S7d$Pv!oeIDtV#c2XH%pCfcirsswTDJF2%+RWDhhi zhSn7-cK0>N@e{Q%ku$U~cM0>SrmfDeIaIrBPg~?qQJ2=n?l~7$&WFxBb+8eKSu%fW ziE#ATUF@v^HtTb#x{@VU3FLCv;(!VyHWn`6nKZy_neQpYZqgF8a&>64g7+~ zx;~8`Y*N{OWPRF0>kQN<134~G8(VRXm8nnmC#{@ms~bPT)3rTgk$0M|(>&z4S?a_m zuQMmA>{*FUc4;T)P;J((fqVD_hV|;(iZzq|=)C_$e$ns{zC#~5jOR>8@SN#Ll?q)} z?L;n1Kp#PWx#eHBkNjRm3aZhjFWSD8;@rEmtrO|gQC(FXNr?ZUczc3soP3{hHZ&f- zPlfROGJD-e>dm^?5ecfW)06l%!(kPlP@J^M=}>S>LFlq7JkyHDQ?M$9GM&)jc$D`L z%KIzIdk6iey%RdbXI{^syob<-UPd4KUft8a_`O=^KyCKplkg-a(yyZmZR@DA*3PSC zFI+n2q_*8t=QzF94)^Ix?^Yh3S>=5pq1Wh!(FqrSaYfOU2d*44?a^ucVnXzjre{|^ zy8Pa@j_SUlwF*^MADeSsaoGwLiA(sqvti)M_z}fRK2l5H|8qs*aDJY}M%HuPpasEzgM3TXh{S(n!V8le?>XRPmB{_N%z~SDg)it{5C;aq0Uz zFg|TV>#eH3Ea_Qa>&4{XhPiJWho`;N=aoRxrf>h9dG?sfjD+EjV*>6+ht!~JMM)bSgf?=95=-*AZC+*cR6$1qni@kfWp^UNZ}^J_B?5;$JN;o1(T>qOQ58s++qsmj4Rz`3>6f z=*joCeGMb-*2<;tWyg=gNGL64zN~WmQG4sk_K0F4o`7#gDWSIbo!NkKd{s_O)~%7a zua3p;i^sX&3FmK5od5lB4(DS`!#vjAr8wIw)IIUtW4=SH)u7cLM6107kJ>r+s?(kB z&f93Q&s6A+zG`yS1b1|DhMm;5I&Sivk+yA*HOAeM_x_bv)#`H^=VsCW(YcAauKA~{ zW%=#!EtYh(Z1^D6Ek1iT=F;YmK_stK%SOyqvH3SCj=lwT-4b_V{^pytnB6op!5NEj zCT&k_{u$85xHbF&~5#JuBlkG&asFJmO)d4Ul|y#qarLe4W7 z+l$pS^y=DUk;gl#_BG#kZ2YKFrJ?u4tL~|z@HBWbMt`prjyL8^J?@yp5$A++o-6TN zuCH+1zBf7-|GtIVwNp*_cQ~@DjjA0b=TF+cT-?%oLB*wpY3M4?EPht?IUC z*#m7R1>fh?h zR-sl3b0nr#Z+816wPSnW33`5U(tWCTtDX7Y91W(?{!EnWjF7q+X=W?W-o_|vv{VmE zZ~0~rFi+MnuU=v+z71j&^Yb>}pEe{PXL)SezEfKNynU$ctue)G@b$C*Ruunl#;_`1 zYVD7q^ZxN7=)B)New0<^d-3z4=e*xi?40-i{m9+iR>y5Dz8g2zpDV~q{GAPHwbbKL z`kbU~alZhxMPCn#+}ZBUn7F#?#Pg5RYFjG7*|1sY^2;};rd~WHV{rb&jGh&#ip;=N zy>LgWnOc!*r&#nciQ}VG#|L#&qo-x?|0~>DQK{I7dt)QdEfZTRHk^$5o(lhGp`1F@ zt*CfwU}VNkJD+>wmAza4@aATSq9~)PSF1B({&hvwS9k2J{_N1rd4HJpU!z70dtH=H zNjsP_a`N7uqt}mo{p5ERXI~L}$H*-W>0?iCs(awjTSrz53C$bSfAoc)zA!am!GYC( zWTOx@1A+z%w7!}FO&58 zx6W4k7reQt=cK=-)&8UZf-BbEv-zYq?tA#FHnoKhOz$@Jnb|`Rrsme}Ymf}l$GI;b zsya1q-Cqtp|LY4!yqbPm$DfS7eR{*tnLnRgQ4{LCx>@+5a}WOP{>cZo#{Km1-;MjB zw4v}%W4C>?yW|7=R47_ibK~yZ`SjCs&kViZ@9FJdFS>fgx63Ea?DX5Z;#*%@I9~cmJxpPs;8kSreYR@#FvMQS<%pdQ~KT>n=YisVyA;-@mc+knaWs?<-A@szt1d z=J7R8+#p%v>KOh;A0Mrs7|7pR=iln;8(!9q=h;vD-v!biq7)pWhNle z)#bPCWANo)=I`Ole~K-;6>K<|9m4cpu7AdUFP}csPYUq7Cu+#(_Yd%ceEfe|+q`$> z;O;o>dGR&*zxC-eJucu+M;{*@FH^rh;*PCvnyYWpHw4nX{$$dh2&C@`@SZ&8MixqtZL8x1;z@?sK!nT0dFGb0)B% zlQq9ySiJQZviWhbit<7_{b^r1e3P657ifbSCEPYv*= z1^DCupAz6t5AbIM_%j3iSpmK)?&%m}`*Kd#Hp}zC>%frZZ^Myux^`Ng2c|c;ZDIIs zZeKFIHx?Uysnzd+yqp7eQ6T>co4*Ea#yMa1(sW^t_8HQNonZPnvEC)D=13PFC zHvF5YX$bbA`5uc&8740UWBp4n!<=+Mtb+>~r}f zAHEAXbe&dL#G-#6bvOWmIM!vHWbnh3pKS1UVDXt)@^U=QNHRKHr$Foziw?i-lg>d1 zv=2BbWH86B3=T}7zfs=7;7s&A`Hsp+Vmx0aT?Q;|K`i!5d~#xury@^M7v?nox5>9n z`hZWe^S9V`GG|Nou~Vsyc>~yzES>}$vh$^g#r~DRGB=BJCX(&kEMn0q0#31VVv%1B z99oPWh*;#jc9r>CmB2E8tB!K(PXlne#dlDiiXCV(HiS;QhA=aUnQe5y}QEOK5CCUZap z5sQ2=aEg@^i+l;N#Fkj(9|Oy`N4_BLWo&)}oN>0nN$7{^y$$Adp?sI-bYQ6?vDoYZ zoYBqbbB;zvcY`TP;vfM^$Ch!fhKg+}=Pa?&&L!iCl>h->gQkwA{O~@;1nw-7Wo+9~Q6+nCqNiADZ2u$&{rB7cSQxyBB$$lm}?=Rc94w}3Oo8T_$NpIG$&1}x{uSHRMa z#G>;pu(Ttw$oZQh=LoUL`J0lSXUgSoiuC_J)VF<=SoCvz`a`H=>qRU&qp5R=v3VtR z>^VX#IwjPx<<16{au-tHmP;)9H~RE{O3Z;1v;EGksk&YKi>ux`|na-VC;VYoIKgXlJ{fCQ>>g=6V>qkPtU;N^j$(vtGIi>7<^ z#scCYsLfBovnt(4fguOQ!#*LadY5K)erjHsrIm^B&(g(oS-j{l!<*YMP^(pvo z?V2zq;M8;J^j?_%?GxaqNK+B^#0iFtn(t2$%xJn3`=H)QHjM|-YXFYJmWPeR|5fpa z`549@rnSSy+W>xhL%`pLO-Ssug1~RDH;k=;jP`gNNbLOt8T|GRBCQ8DA+dKIfZyH| zu$KuX+T*=bvBzsDzrAme#(Ql-V((@s`R#oId%TZAd%RaG_IUm0w^xaTG%*4_fujQU zxTf??NTfa9$`O0KhV#7LnL%jl8rc`G%p<*_J{~BmD&me!Vf!qYWX^JKNgJvI*m%ccm!d zNIh8S^mZLb?@s}}SC6B&J)rmYarE-wF;v}p@Ew*J z;Dwk*;u_z6y^(0t#U@GbMUVeW`SrF#kLQt)=SX`TALv!l<-v{iY7o8S`G)^TTeE!z}#tauGp)$F-S zd9$~i9V_x)i*w$`JjhY8n|2-Ro_fC;SLL7k&J|<+-z%lE#k%av+hOanBCq9|q*aIF z5u=@xhMY2@c+JNuY520?oiUd&0kar;VV+}-+K6@HFcT8%E9IV@stW2N2~!RgW41G* zke`cDHk6Q{*6fhC0s6Ra12{XjRyp}E<+t08`KKu3(Y$WM20NnHYv<_g&W^N|!v@Qm zHZqfHOkVMtdbG+)<*lXT>}WNnkTt}D_+v1VtXg5!o=dFR+#gj`aSEotmobz zx~C>MH9P-P?Orv!SRGO;^}cp^and2xgg8g46O?%GZ1^`M`3Hxr-_a3X+nPkZKk|R; z%z*FkSNs$&;Vl@#=#AZl_&=AvzYN}NtY5Yp?@4@6yrcrFn_|7TM69t}$C8TI^l*ybt9C-m6aE!R zOpSFmOvQRx-uz~aQIA*0MDjbSn>$68$H#`Qulhb`-PEf6RpY9kb!X~sttu!e-d^t% z|Gi!<9Ui-Rw5qM?b7y>9@r+$+=}xS=_U)tNyG^=nQq1LFj4B#^VDylSAHBHSnA^tW zqrRc|?f<-GNp}40dCmq5RUlpu3-NbTep~%={>HW>$8ULya{lhNq|g5iT9RX6aplwz z@|TNK*ConX2FZW@N`G3CQ`VAP{#Oawp+BPUj|26Xb|UiYOI?G$Grzx{^!s?^ubq&k5GQo1B4{fX?ewlq-9py7FeKq;(E3xs*r0#y1-&bqKJ^0g3RA0Y6 zsjpuq_4Ui7PJWsAENOH^e0H6(pl5NPo)wB)L0qhwQ<70wp21I0E|@=#-yIvOVXDF7 zpp)S0RLn15c!O2aSPeybqD{xwyb9;eDZfFDaRE|W*;IUAvAk4GH2XN7(|@#5Fu#bFSg& z#Dcg}qB0F#P*SRFj$&e?uEhm$apF?NLS3zi6<8kx?J<#UkY*ES&AG1BG}8#8RIM?B z8s}OK-cUr97O7DJTuDJ(x|k`QU%F67{L%`v*~~ep{RmfGd1}0i zJX!18daaCnkzV3BRIiv*q6*MlsiR61v734tQ%e@0?dPLcm*LBQ_{!=q&8MQri-4Ut z!R#FheLv^-BuQ zIN2)WHfRACFjN?h>bLVae3+d5=73gsJj-5TvSnXb!l<=;JM~x zm}uBk@a7brQ9aVB{$_}Y)cn%&Ma6|>rSNrOx&F4|I4emV3JGdljI%U#(hX&$s^E-N z>kE}_()a~)=M>MuU1q5s| zM5&Z9o+u4xy|VdYY`)^TbC4L7Z>Sa>C!Zd~P#({ziF0Pn=XW@HQl$!G?dvlPdU|LW zzi>f0;>P0b=-`vs40`NBhVnV{N-=WHE2HH}U{YPqYPPnnUov#!cqx_G??Rk&%ZEKB zHrLNtR53qeX5svdlG5wu6ql+gb226tj6=K4ol`i!xHNV6oYJ`^se>1m7N(+&u3xb5 zn$+II2ah{P4W55Ps*X6mKVe2YCys04Oqo+Yd&0!Q`SXhx-cY9N1uhle%AC!WLtWi? zg)bgvgioM7apd5zt9}yI@d?=z>t{g2&C*t9>6i0kS^DL;S=uoRzGV9&S)k!&Y0oV9 zbnTC1frdKwq}Z4TGu>ob)Dq7jrlge=cW!5KJnG)#;Z4}yk;>5uj<0npZg^pUds4%))m|(={ z&RAMJzM=?cH3k>+8-M{Te`xA8V9#9|=jgG%w0PJ^6iZ?1%moXP4qgW|76Z$o(&Do4 zfUJdKjSvy~YGzTttguDMdX1Y^P`@0Yb9=kFKeil-iJC3Ap4j}0qyvW&3euv{7&7o*1{bBgH{b}C8J&BHYG z9p>Uu()3t~G7tu#PXb(Y#k6)6;HRfxIzAQJhytB;70B2k+KK`_b`{7N1*e@8 ztICQ>dCtSP!ShS9Gtg}(p-yv4rIE%D$v2}O>ycVGza&*FrDj9HvlAC>C+pv_qm_&u zUP{aLy8rt6KOys9_eu2(N^Lza@SuVbeq93XcbYB_Q$;KpUgkC^yuTUU zKMe2nuhRndQUd;`D9$$_F^{7zP-$qGo^akDAFq8(e$Riyd;X^c$~z-a-WlqbF}gUl zL6?`IdZ0f{LwPO7%jEaUGrU(GzfS3=vjXulycaLSr@C1T@5Sq^fW58(|GO$&<7?vF z2}fO|5^=tV5VMy3H~BsP4e$BiHBer6UET~+1oqw4G#jsxy1c<^Gy2wJC{M;GwtpX= zK6$S{8++q?>Cy4(smo*EHDve$!s1tVfyL4vaxfo+m|jECt(EQ7&cu(-6{{;-42cG9B^$+9s0h0tUQX2jVG}L82{YGRg^677be>eK{ ze*^z+_31wb|LT4EzXpEDr~fGYd)BA_5d7Qc(?07!<4d z2>d$+KFRV8@b6^!ApFmvcoul+?`wfEH9&Q+`m2$5ppU-|{_#84qF)RD3Vi90!oOKQ z{vP;ugHL}M{JX`M{!{qJGNrtwFud8Pe-r%swJ-f=z&m_AWBodKX}_D{-#g&te2VTr z=cv2k-xo-i_OF3|3>K=P<246{+JVP3B+bu-KPf)`YUIrXk3XGWit_t|k$6Uzcdjai z;Y*P&{;fdyBxFPWTy;IlzrvS(IUFwqFY%p(jPrfzQKv1JyYASK~{+Cd$9_RT2Da@TCu9U_qw*LFyv-x51Y_5dLlT@fQF;hE3wr zAO7tEFY!GehFgJ*L?ba0e;h${xJ&vqmTbH{Q0X- z|3mn56ui{;Pw?ko;MolrpAQh2Rw#qbPCh!GK|WKR2}Pb;GG2B?UcO3-ueZL9#40!&GGJie_8wV`;JHzn_;HCXzQE(x6 z6sz@rfIn9QOMVCZT=0^geX9(-_|2HtS61@E0^n`yK zz)L*8g5ih2OZk69ynYQ{%6}LBG=j(UTJ7)qaQszZ@&9f3_a=BL{}1r*ZScsZ_1}Vj z9|KEy@4&zR0x$7+0|nt;qg&qhP)qTp_MU=&bA0)qfq(PBOMiI+{_*`biT^t&colfKq5au`gnD28 zdy&BJ=7{}Yz`tLCm;SE4=#wyu>#G|M)Hy%xL{vP|zXp z(tagSd5+SHQmz7_oO1{Nwu1a=u=U zgg)RU9@oLYJn&*Kdi={$m%zUQU;feXZ>}$YKK%PBcqxznOWp!r`pZ!G_jB+Pui^0T zPM`i@`1ecj;?FP``VDxg@8$4smrwsP#BU#X=|5SFA9(S<9}4;#cquOv{(a-q&xU{P zQHJ!#KJf2s@Zx_M{+;VfPltc`;HA9i`1Dm%abofsNXkDK{+5G3)3*1i@b@#yb)9(yNAN1*;0>%A4{f_YWb?_1&UfX^I9>r*T9pLX5KK=Ia_g~;U+w_6(?-a-+ ze_Lei4qp8E2L7;)67TMbu&$0eR$1^AJ`>|0e)bBKR>_^3h)=`dk5#Dj;Mx?C*S$V0*`~{ zyCZ?ueE8FRFVt@+7^!bp)MdPnkFL)}>Mv;j(-92G|1#p;6Fd&u-ag<=U;2ws9N8ZAU_rbqEfS2+1SMcvUpS_LnFA-&m{$BXUYg|_!=dMRX z1MQcuI@$D@P~!SUZ+Xgk%zg=DCCQ}6tLaw11TwBaG+L)BedKyWkK6R#I=!trir+3$ z7Pbx;)n2qb?_qYpS^sm(8~Y)}wJJ!Hv30S01`BN0%_aYg4 zXQ*21kI_F%k9A&pR~5GU~U2;#8=?uR^K(<$R`7|+{uYm;MOGUCtQUgB(Q zB#vDvR!%JPZotWCKN7LXdjY3dIkCw504MRp0`w}PUtg#;6U1Eo}3`95IMJuG?YdWw}3i=6kg zCma>h#P;*T54lDY)TO*$8eAl6aV#bG~@b$WE4nQfw-BYZbSme6ybOb~!a@JSYzX{eo!>)6~?jms`mb@&RWwHH< zMb5sI%#H&h7CA$fV&%jlXMdBjSXGuqA{HHHV_76(kzWX$Y}koNI1f8%y3^qEtKiGA8bbqjZ>i#g)=p^7k zpGm~x1ILgQD<>8?`;7QZEON#{d=B=XjA2Lwor+D$B9^>7*Q6|BkuxUgtOST%IVoR5 z^ZUyRfppAA9Vg~i-Yn*$P2OfPxAI;{79VuEV~qX@V?NgC&|O)RM#tRxsr$(#Mo0TR z{y08cc{86cHF=x)Y~{^-o@n$>=<_6_qkW!Wu=d&dsr$)fBTv8~8NQK-B|f^JSb4L4 zVts4YPprIIKbfMGQDzO~sbJKtuiRf0C8cm83Ewrzq)KgBKEW2l^?tj71u% zY8*m0IhrAsvg&{{%C%TMh=b@5i_R0kQts0}{1Wjz>_D$#ORvySeTzee^^+2ZjR|Un z&ADDfb5Cut!KYGwgTbl9HyYf7*sjBrNqm!$vmZJ)8_ak*tSE^6&H0&zil>va#9$5w z&QgPC5Z_|(Y~p1Gvl*O9gXxx2W$+SW1`NbxXSs&@eST+!!RslvKHo)becnR6(&#)w zyvpFmh;KD`J8_M{`-p1|W^5fc4(JVR&T0+Sd&FxD{*d_R2LGM-HiN$*ju`wM@mhmh zq4}M9gOi9G4DLw0&frvHRtVIa_;!Q2hMZtZoJ=EcMSQ2h?T8rwP)BUeKn?XZr*pT# zsg(c1;NHaj4W>Egmj?GG-e55I&V>f+vNjs5%d%LPb+3`1PW}4~PW543)+Qs@Woi^2fhY@cvc%%=HC%)gvFC*S+@RdGXLi~V{&n14);4&XxO#G0MFCl)|;7T8^ zA^x?IuO)uOU^b874aC1Oa=Pn0YA}m*8V!Dom^;wZ*qp~TRNINS8N83U$>3LspD_3! z@skE~@7UkCR>Z$G@^-{D4C;stpB~b5I`OjxrxHJBaBt%624@oQFt{)APJ;&#KX0&Z zi(LkfqO{%LePVc*S7u zop^(F-Cr|U*ZqLONz{4WU>yer52WL8$lz2QoWln9AU#Ja>zKT0u#U-F2KUFo z`Mtq9K5rX5jPiF3*714Q;4zf{!C)P$_YBstdf#9js}BsGfrIl$gLT|KG+4*&BZGC^ zJ~p@<2j@=)>ll7w@Dj@ZY;Yy| zH~2x~e;E7-@fQX^M*Lp}KTZ6l!P|+C8oZ16D}(nDe{Jxq#NQZvkocblzd`)1!3@3g zFM}B-=R1QL0_S^!StaKOgXykw%wU?vDkhp?HV3b&Xu`qa14#1wNqRiz;-Mftp4$%u@R=swV9;_t&ve=wJc#%t zgY$^_@o3OUVmbmELwt(Cp0{a z3^Bfh#=Wh(odBxqeu>f1ZOV=b()GR6;8gI=1fQL0)UbBgc|qDvfx+6&WP`PxDF&xP z&$-NC9kKo)X}(a~!djhf-OS>gg>yyAR~5UMqL&u6SfyC7wJEy>U-K3t zEhnP@S+MN9KaTDBna zsD&{X&9_Tqo}iVa15ej)lsD^hi~D6|PA@DkU+7P7(KD^IX!e4I<zk@hr&6o&_m&VuFyl_zOK+iS=p{I>_HD@WqIiy^r5hq?t`u{E7OHx z4|=iz{oTsDDBRzLM7G!4MN-4LZlZ_6Ij+z{;eM{rL*c%z&_h|-t}yID4`pR}=^pf< zu$S(Gt}rXpg<%hRvH`hn5L^`Q??MlSb6uf_!a1(cL*ag|&_m(AuFykS*{(3`K@VkR zdFdYXp|F?kgRU?u(}iIVda?mIZslDR?(agPU=MH;b6ph9aiNF8cp2Gt8xMv1x1bNVhxJI+7Mc4;jVOFLK!yfcx1F|K% zhr<0`p@+h`uFyl_99QU}a6eb*p>SVU=%K7^R~Yu7hqAJ~bPxJa*h}|8SD2OQ!mtND z*#LJbYob77_jeOL6wY;p9t!8ULJx)exk3+x`?^98Wo5gyGp{#6I81|rtva;NCKXQfPun$U{vNAoP54v3d|1yO8cq#)jB_mO=o4ASnn&^5jiXOigL7RCtttM=~ zMK=OGl5`sXzvlNc=!2Ad2XIUFc0kW>FE7ip$6LuvqrJ-m{?T{||GtAg z-Up$*w%EkKFpT>BI}B!w7{gKQr9;nO-*hza7NpZ&du(FwbL98i>jnb|jZ0$hQz-fE z9fUpc?_{67-2r=(V8A|t(l*83_JF;(e&!h={X4~H@7935+hCxj{!$&Vw*vMagB{xA zEk3DlQNZ3eus0d$LgF89E&1y^C4b=B)*egf65Rx_Z3e@)#pS|wTpzmxCJ~Hvw_g&cg4l*IJ z$Hy}M`rd_`pS+FB`u4PGwAaD}`QBe*YfBfH)UQw090RvG)^T)>r(y3HJUDUP$a+2Z7&SY98J%we>yMrm?>3 zV90Ne@7ZpETuAJ3obcOwaIlFp{ma0{G}^legCXt7nAffi;>-cp64SVS9w>J_27&vS zU`fjTG*IrAA?T;*Yb=-JrIgDtli8uJ>C4Wjuf;rwJ-8E9kJ-b`oCeyX&ti|?hW6WA zfB;}*Ns!tC5ba1%Mj<; zltClS92>?Nr=A<}vQU>cRCz}s!LD9-mB>QOurgC)*}g9Sz!s5GQP(B)<$NkM+TdH zPT#&dA*a7+{P=e^^z&Dg!Sjb#cdc0Z|AIBAhH8J!j%!Zk`FOTcG>;QbKdU<76RqI$ zqNv9XxDW3(gX)9-`pOH7aJ*q2kN*cW7P{y|F113qr@5ThH`oWb$#`Vi$5WJkgCR%j zNgtf;>0{e7JEAkiO^*ed`QUn$>*Ee{*h*}vUB zUOLb1-|WQFgFPJG$MN4~W`Et=f4q;k>Tb%DKA!ylQTI0RRaIxY_})oQ2;sv+4nYj+ zKO_)idXi%JkW!^5At#22G-ZGaQa*AB4H_VP#Hv?q0w*y9XwiUG$LUQOWi)jh3+gzG z<0VunQc5l3FqW|lacqb2I=$+zTJ>6cpJ%Q0?!C@V;>Z8a@BV&$lfBQg-u0|^eeSQd z*Io;;7v_hY!UAlQLeAFKFKx^`TkvYpnc7$8pI-3t;!{gsT7I(r#G2!OxXtaW?3%s( z(DtWymhXH#S+ZkB`}dIQe{Y4wzLMmc_SZajZ`U0y-6KNpCz=tDrx$(C6*^Yv{BoE!8*dP9In@You z+W&NWx_4whqxSDFZ-1w*e&MNwl}ipRDOh^X(zF}ixwd}Zsd*DuZEZag55>g-N}=mW zJe*})#VRd3j>H#uY4Fk2iwZ)$fA02di*Iow?bH7lnV#!RuP)e|Xnn!?Muyw7DkDAK z;_6a~WRG>Gw%1ntDxQcv<>l=g)xI^iKN3p1zq;XIdvC0wdjE*T;TN2)_KDSA+WOn7 zBH78b$jG`hm8yV? z<6z^rJA`QzdIrk{ef#1II_BSX+{;_<4!6%r3E~?SPn>($Nsnh^T_Gnu5q<$U4>*>U zSownEbA6;r_83xx^jvjtEZMugti8=^*KP5(>e0g=t-QbH8;goUxiwSo`XyFP8s2XfMz1ylX zox68Tz3}(W-J$q*3o%zkduAg1cUT?AUwewHrmWgnSTrWDa8g@dVZq&bh4~XF6qa3a zQDL;=qFKqOlU%W-q^mefS~u%uLC1dUXm;FUWF9Sez9gAd;r7joNw_Q@ zRf+CLalPJEh0D1ZzKN^uP%Gvf+5TMDtnD*)9!Qq$=-rXs!L#`Oj(RUw{@K1HxzsE1 zt?`1rk<$&h>Xh#dg%WS|I$X6UlCcu)wyiJq489ddxLcduv7p_y%PX9JEV?~bJRP;| zXT6ww{no03BOZ0y4nI0?!Olp?$tX%D&OL-Uos8wUQu-^gwe6hRzQZYau;_62h+KT3 zyw`0z=cl}+V|n`-&$_Sg{qsos1gEfdgmW-7xuUS=@0_U}hhqLQYo)cy?YW~Rk`X$O zG9Gf(p5RsgP}huPc~{x?-tGP|;+IozdvTWQooje>Nlg;(YhT=9yC+tk@^V1`sNdrH zdaYxy*y)Q)xT3%{m)F{;Q-O2-WOsght!KXtxvQw2@7YgH2|}c#@^hrDKax58kCFD_ zZWLEWtUiz^<-!ZI@~1`P^XDvBQnxT(g~`RQEuFi5&4yX|oZnie8IK0^n4H{JRe)+S z=)9tQCg&#)vM~4hU~0@XuGN1E&n87Uo<;a*|Jjc>%(R|K-V!K}xr?FQS;J+Slvk%=4-x+Xs1>7H6 z?r$UR3lSKP^SJZY>GK~7GSs{zw0#e@G(7Pz|6FrZi%x%a!2MgxKKbJ;|CMm_nT37l z65nl>Kl!sP_t)XB1XuTK>GW|;b}c&oli=9y*#Up9OK$s*4)6;CZkcaE>T|W_-)JoH z{ZblQ3)9PYKw2`?TD4z;gJmlD>#_Xfz_eleKVCA>nEG z+Lq~A?eVh$$78ngzuxoD4*2W*toQs!2K+~>@cEwq=zxD%`QPaIYquGC46SzG8StO) zwRi2`8u0H4xXtGW&}#n4fWLqK2nW)q%jXu4uiXy?+_weX&j#F2Sne+G*r0N(lj_b5 zxG!{iO;~i}qPEf<8TS1<)LRbDSN^$D_gA!dWux8e1MV$W{OsS@6>vWm;J+Pk|H`C? zKMeoVfctpB9^X5QkUuZrzg0Z(OaBK0{{I$me;i0pcOd-10RMx4`+|U*?}aGr`^~|u z2@{QdUNdr#qU8a;6}?LD->cAi$MpZRMWEXZZC3=kUsp))=;nJ?5xV)VM1=0E0`ccT z7tPR&D1IVe_c2~ID`DRb=d7YIU&0|4&OG3-=}_bOBVrD6V&Sk|3nyuDh=p^69MjQt z6gbbEaEOI-9GG*cQiw%=3OKTaTE`(4{TbjW-ZN0nVhd+0sNOe4mik!uJif#1ygvXI`x(F! zjGkEZBY`FT#G)Sy9L>{l$YdW&ythDKTBP-zY7X2Y$DHCGR9|4XQYdg;a=Uwh&;T(g0 zg3%L;{v}|sNi6zTfTJba&KcmmFZftEXQ7{9^u(h74Y1fG7X5F5qbBd~0GINl2zj4; zbDR;M zh2{_oXEAWp*k4MHIfoDnryf|^VIy$3T-)KjoZwbs-sD0$fFid>UBVYMAnj_$M=YxO>jqURBDG<^sH+sPh!!t*+na`gYZ%<9Ae>&r{1)GV$l~^dScPD z%*76|=%-M>4m$|3=vBQia}Z+Dt9E7d#G+?$hv#4iVKK>EO3ZdNPA%qs$0qkJ#1i&q zV3|MZcHq)$u!D4Ble7^Fe>ZTn20O^T*rXhYh4X!2Ny9#JOqz*>^91!w2!vSlhk%7o zEc#=>(Ye?`Ud9%_Rzc@A{D>W5;eP}it<@Yn(0ewCg)^FZlLlhZkGJ^5qMu3qa&41X z^!&_L%7Iw)^MIusE=I7(1|61II7QSqYdx{(Rh!wU^>&-N3aY5-42S_o*r*{fY!a5$ zBb++m$Y$&y#KK{f2xld*aEOJ|2rL}cezrgX8PI;_YyIu`iM04w>~vDUOzVk7{|IoH ziGn#&GQx3$UKLsr5KSR!D>>$L#VVe=o8^FRL7S1~s z=R=D_ESxmdwbSf@VyU3;^Pvq<&B z_lfvMF~N0U?T-l@@ajR&w zreWRY2HzlvSXz4%R!uJ3w03ji<}!W`y0*S$3zi$k2oU_60rGa9BzcVXTbtHyX;@L; zvStmIv$j5>usK*y7oRt4is%_}!Z%# zY1I}ilDcliZ4H|?ti7$lD>1~=(!83>pbJ%%&6*7>)TbTl>sj$xv#G(SvFuY6EPJIG zB9|#-M3UlG6_BFAvegYUrmbjLuT~|OBp59k64xrnh#c`qtZKplDbLB&q5Sw=F1VhW zX&gkYVuyZekWVwJ$*$m{suCBi4Ad$kz8aN3^yjqRH+A0kW!^Vd-uFf+-`ub%HP_#? zdX4{`30l(zRNN|#MAF}%OvzV==V#ePac_!$Pnz&7@t~!^;jUyN_QaXmX~u{d2Y%8F zdkKY+-D+y&3Sh2Rae4 z$6IpSUe9>PSqUBOF>hk89@w^b3?2_aCnENEJ7wFWAzmM7FU$BbeY|(H?bV}yYAbXi zVvmogw!KFzd)da1_ISHv+j|}M7_W%ftAxU~SC{9fk9O$C-^mDI+uMo4;5A!B?BxU4 z_TGoRCXkq4*0b2-IDFe4*KlH=qKMcV2c2ziHTpK*gpT%Dr($nC+JFBE$;&Fxn6JH>ds3Epah`6ImB0fSpmG&pc8qmGIaPW{;`kaYheE*OdVe?F+IHBg%3@43-?cUF{-CMJIf!ZQ&4+PZQ8XQt>gA_ zjK{KgS^L(znBLTwIcBgti4lWcI`!^r2Y-F9)7HOja<YT#rxn-P(E~+Qm@gNUFDU6v?6F(>pN2VMmE6Q}^Ev z{`xjoQgs3~v~{oB$B|zTISG8bm5y||eIw&c)7HJ0ghsU`njdvkDljTbQbVT6WzPbP z3n}V2tx`X5$p9%uMo;|WbBUIsndI$J95|UO2>5n+b+A-Ig3#h`#a`$ zeh+Qz-&@h*`XxnKXi-eh)ajGmw_B!$dSV#)*t~AnU~z739XPUvbh-5r_E#OlFE zfL2~N(XYkOC>&Ff&?vOYHHVAZU$g9<^(?zRCt?xAyJ(jm>!;h+WjHiXjzFF-(y@HW z+ndzUQ@BmlP)$YJwn%&0_^qwjhf^6p9+Yu$#l~+%h7B9v_G9-*`XeE<|12lHFbg9% z)17Tt0wnjE#P0LXeRJBcNrZpz)Kr{63`pa!P$Nfv4s#U_&uVA7Mpm@-Js7X4&}W9R z6&r7EJM!}4wj->4Xzz97y51w9Or|iDi4^v>Uy18E&U9#dI}!dE^0jvT&8wQ$uFkJB zJqSG4TJk3_PX8iajErzB%%$Q`zv*gS315}rTn&Dar_k=PmOC|krsCsv&Pb-iu@4kp z|F~9fDnCo{ql&?ucKh*V1^C&DpYQRtdvU$ifSdPTTD1Raae|*3e>mXIQTF8ihj&M`|B)A7yBh;;@5aUOO?LrUn*UIM-y3kV zuSJXI9}%Ys|EA?mP5)SxzB12WyKfG-YXWXRy_)amXKbK6#s%EtReaBQ_O$!CfcyD? zd#v1;VT2RQ^IX6`&+<>rU!LOQw$?~qAUzi=|8e4tne1r)V#}Rs@6rHYyM6wp0sHxi zU+vk`ZhcQjrFLHx@Q(%De*NSJ>=!8ee)}&7_)k*)c$_ez-TC6g7hI|ND{^i#Wyxnc z7x$ekj~tI*q!*%tGVOGS0!% zB)>tW%)pj|^UJ%+h3~nPJ6o-*XH@DORbuSXRt}!Z?lbnbD)(sTa3DS@OSTz~)mUhZ zaeQD7{`f2@LYsZYUKel<#@<|G?6FPdVC0?Y0(EAn@Z;6GXm)tMqZOgONhW{P(QT%P zq*J*U1pK!vAH5@=>(o(n`Q|w%wbLoUZw^}a6DjUXy|E#+%0J)XJ7x-Pt>&4F60z8i0#7h{ zV$sh8j$VKrqz;?dp*xDc7Yg$wSfwYT)G9qu7B-{=n_$|H=2ENQ7e)ABYH&)t=Hyld zKY5pXBXFs)$uJRVI}jYUld2+KUm3WU^S3mbepu)L=tmas|Syye(Ih(+HC zJi+LRMZXg`&%7Ha7X5DWjh{j`@{LhBTsqp?aumBwlK$*cCU)x!PK~GwVrXgH)_nd+?zBWN!+CIinTZ1)U;svpl@1kT5&U`cwM7kTyd^XuS0*+ z=2a`OZN^XY=FNttr@!@IVoC2mCSTQdK7oMgvDPbZD^RnJgi~i}zro&<+{70i!FObq z5$_F}yb2rKhXX_8V?$Wp3O z@m4pcDw(O2pbd%Dq8hx=606p)SiND0q_ftB@ZyBW^=r2b_Ii%Rsp`9N6<^H_+L%^1 z)VE+3;6Y#8F__AQdbPUQesMS8jo#qanK)|-+<`42t+s{dObW+#1bI9^iU{vDL~8SR z3NIECeuc+%keQsA@yi;e@5gxgrJftlq2mMg)qy6p$4uDcwSxATH?j9u zfqZO*pSg?y`RUsSo}IoeR{D6J7kmE;*v{`WaGT2kkZ=@_IUZCJzo379?Q~B z-;;2#JVeAEId=Lwt@JTJVsAdMZSPq)_{=CG_U1xi+v|b7x1eMC(6l{!e;>#%*E8>e zzlhl5cuL#e?hEuBF|@~9d`Vvg0@&%h9^uA`G5m@>ej8xh%R(llKFAk)8-Q(le3!^) zToJLyHe}n&hds_!#q`mx*yA@9w!Meo!S*B~_V^u`ZErQ6pCo;JToHT6fNgt^!=pfq z;aBYa*o280zuPT)JU+!oR{*lu`}2Ukd9YU`#_%il z?hV+RWZ9c!+1rfvVW)2s?6G}{h&{F=JAGHdUJXdhFXNZ=l>yLRIW|fM?3qV+<)$CE zt4+LOe@~!XXpb^85N{IkPJy2B@)1tr?FXh^`cWQ&z1143y~KM9A|w{c;t9tR@oNM? z)Xm~W9^(`d9>>?)@2;Oj`i6ldT;UZVp^{hHmQ|>grxc3`ENZOYUmEVTkn6H&zTD3{bjM5T_iHH&HLisf7f1^|EQCA z>xWK(_wD?~mhOzuEqrr}-z>MM{?($hu%7X5eew8xc#|#fX%lrlPDw{@{4W{~W1Pt4317Cz^lg=$7I3FlC%!BV|UL{;5x`PI)75 zk5Z7a69eDJFF#uU{L$@4lCyVWghm&~C>*(=#EZ4_aH9D!9q%o{x9SJ3EttnQ>jmv6 z+n0BoQSakxI|paU=!3!HN9>sCY1WPz922mk*NdBDA&QXC`LMkl@A?O`9rxad>tk`dWcu~u)d>_S^lKE3^b8kZsEj2xq#^0*w_Rsm)bs>L{qrI_1gFoxt*e);CP;Q3Iz zJ9Ic(;wVYFeSX`L*+^vMjbHlWBep`-(n=%4+MU0}X}NO7$;unDD(b2p z-;s82=V8oX6nncR(Y)V@w1;qBVEYCdvUO+0(hHN$$@ZlkXFsupr)_fs$1&P;7sfm# zdod2`rK-of((Yx8?u@+}JB2e5kKNQG6l0t2(ye%azBS^y&te{)O3cGkiFtS`F%Qoi z%)>JW^YF~UJUnyM96ZULh^M!UrBsq!?44;R?iwB1xCP^|LK)}Wo*GaBa+{yL`{VXqG_#+*&3 zymrKM+1o95G)iVck^~}LsJ##QuPbKE+sl;48mB>kzZt0=8KLZQK ztyQ*<**!tFrlOA9qym zR@v85@0mVJ9JpuuT*CXV&m*|4{Cx5!FjnQXm8rqzlza>Kskn7ClJ5LF+`fby`tuo2 zOS*FBixYRz^j{fp7YE$YfZOjU(&5?HqD8x_#A)pF9$Jg`UnoxFzszz!Z{?RWp&cf4@G$dCnY^d=5>+ z%=a-9QvZx{<{N)JYQg`4fd2)~&yDRS+CIB!Y}zrN(C z@P7NsapoBQ%^;=W={e?;fyOHSQcpM58D{ufpi4thXBV)*r?AdsH| z=gBnf%YLvlyqS;rWS~h7$E#Cx`4t8Hi=6zF@+%Jb7YE`ic7AT+%ZJT0y#0^i*Ow9} z+mxS9Pc+~kb#|k?E<*sOhvoMrQy%PBOLNKs{4!^S@z?49V!;24PESgCP6_x=aVDjN zzarp&g>z?`PJNe(zdYbyuJRw#6zsLTCg5IaxeJXwo&(d+;~(?<2&O4}Ri18|bDyc7 zm!L~SZ+Xn~BbcH1{`pV4ANM%g-E6rz&l9B>TN=IqkI~`D%s_q4blx!OEdVDCZ-ZkV zmtdBYdcM3$%~4Gs7Axy7)ql2g6!l9#CS#!gSDb%t`6c zGp4+!0FS|25mTL{EB?<+`xE!BK=>b80ch_E5{=MpmJ?PQy5A1ild)?g(7!TZZz4U6 z(4XZdLU&WZ-eK{?Fa7ri-2Syy`+pShKN!egbHKeI;GPo*|8D{J0|EY*0`8kr%Kt0Q zGb!#0Z*1EX*d61{aqdm=kE?dZc`zs=vE`ZaAeONTEQbk3Pb~T(;3ylj5m_^yRKcp9 zUZ4rI>6!|l9l^X72xh;xYue<+#3sM_mVOeku~TeeUIRtX{JK1lAk(mkex`-5BIbz~ z62s;)fsiU}?r;TFKevnbL6mveT+^Y=B!+nt0%5Q`9+VJbDIZmCMsJr}6dajThhbb6 z07R9W!K&QM*e%+0%}ur{H@>uhsB$wON~v-)W6xB%89Vvlxkj(b?Lvlh993=xGd-@s zs@!M*G7X#PRk<0CDmOD;D@G0@hp2Mng%47L%{6!)vH7m6&eAj9$TsXC#8Pgvfg?$3 z^*AfhSHmr1$#_l3YbQg$qY=)0xF;ArvFMipM>?>B5Q}~daO5s(2hK|&bNt)_zeuN| zsI?v>EX|d&P$A#JCb$PUvK>1}4>sXH0vw)<9ppH+NSA^G=E{<>Z7-9vLvx75&a1$s zyorFE!zO7X7S3;hB|RULvlBZAv2ZeRu9R_c{0=^Em!hb-=7htsTN8}l9>>LRd7USi?b1DEn; z5hMef)HShicsPlkSoB4}GB%ILg^YijP5y4|AjHD229BBwSTV5JBo+>zJ!B3W)voS_ z0zxbtHYo{9EP5UzGDpq=a_+$nLM)u2!j^#(HV>Ljz>#k3AjA@u?#LeQwTONsoN_!8 zi=KzK%BbM}3 z0!MGsoErR;Hfg*NKXMKy7XBLG@H)*|k00T80!K|)7IB0P6GALuSq{?Ph(#X;jy7Wl zQRQi_9d>);#qA}~yjcUwzU6anS#N}E)o_M;( z7ZcCaIG@;zDV;=Y#+?=u$FPIYw97(;s5IQHG4tzIYpl{xqp?aut;Q-1*J+%OANQ*o ztGLi_N>OpKLLe%x#Tu))Zqax^TuZb*A3vYl=50gRyg}>#OVfY571uX3R%Krh?R8)M+QP+4ZurKERhVsL z<1SaGf{_ub9CX=yQ)2TKGSrsC?=UgOmQ5RO<+Ar`80p$|%^NmtQO-%Xcq2O-63r{j z_|TU670sJ4kBn_K;ANKb8FWA;<77g-fws0CojMt0JJ4sq09&CjeaHa^uVO@|HRp^T zXi9~iI)>5zzZh4mN5>96q?T#oFj>o2@}Wjma84RM*GbAqTn01aGCA_X9+0U=&ko_q zaHdGrkPSPaB*hf$p#Goa=VxKipvC8?0% z)jkgqrzpuxQRu2NDmz#DC}tg+!Rh*f0IA?lJ-^eMh)~#83}Elwo*Kpd8HUQiIO+)YLJoA4Na>C zd`_Ug9nhn!&AHc{00Qk5c88>@>XOV4Abv)BvRL(%0zTtBOL~cGOsy20QK@#}+$&aa zIctC^3QWn@7sk)9KNm_J7yeB=^S{fRQ6qR1Q*tZz#NstgtGzw%YbkR<2=eN+m)Z*t zOAV=esF?Aai5mdkHeHJ?9UJd?cz>|o*pqPgL05-OggnaHfW21OdkcEnLl!-I@4{iH z?>zj>Ed`K%e&O$1;L&!B4oEZlVW#mWK7Rjgm)}^}<1>bcr0=WXF-**O zEVI%F=-G1v_F}M?Z^H0L?0pnS-+eGL1^%p$i?K=iCLp|>zLjtn!Cyq|jf37!-!a%* z2@>tGA4u$N1F-FJTr>Sd#NLPiuM51vj*r)2%(nM^@QTG4e#PFug2Z@Y#;+KCu9JY7 zz5;CY<9Us9f!p?u!XE2iMC?5ZVB4Dqds4r&EB0;#gMCUDg%#YZc3Sir-hCTL6h)DXD1bB7e4OY$%1bEkjH(0ykcUgA4O+(m| zaq#d~vIU?^5{F+&-{wI1jmJSY3I1$<>;ge_s{LI8o*nPUu(u3;B4TfRz}{7`$M#Em z)3AxXdtl7Aw-gu2m&6!;#U38VQ|hAz_LA_Yy&2fV9CA`aTrf~A;!~Qi1D-+Vm$4Ih54&4EG*lY3;$gB=N1CnD#UxwRLnD34)EWkF&9oslQl9`XyF!@U0-&--SdJLm+(>X4C+hbKuXVnifdLMi# z?e6NL_TTui^moR#O|C%rAB-*A+j;n{v=raI4_dmDq4B+Y+77p!YaB0@8^`;rM`BIR zn|J-OaePzODer3w%=5Q@gbSVjRYkua8ora<@r~nWVmx#$*7p>v$Z@hU3u*So6gOI{ zD_Y@ux|45?QEPc#i1EP}Vtnw07$1Bg#s`nX_~3CEA3QGo3+}jWU+BwCN6BxCR^+Ca zy15r&41Z@Vfz>Km+7FMxn!<~&b|SeKW3IT7`0C^r=?63SJL%VCI9%g(cxEUg5k8H1 z3@gT_UxpPzi~7b!GA28XS94+f|w5-d~ zvMxuVxGudvv$tdbzlcpQ{CPf#u)9a2o~M)+r_Od zk?c@bV&y^?Z7L(N@?kfz@+p*w((WGNB*LSxjdT*bM>$icKjBXOa*um(TC;m_daFD2 zcMm)M%9Y(%A-SXrq4~`Y+9dWFQ{P?fmYnE}{HDG9q||J|arbaCXH!+dj>O6*-Ss;- z)8JCC-lt})t~j&DJy#!h`&!4mQ&qGBtB$%i?kK=qls@ZVa&^VhJ#FV$&VC9OT)U}? zCEA-zkGdt1(C_}(J<848nbSS;?cCjCBBS0O)%zFgkM-^?J6gWC;ar)WV|V7HYMF9q$E0dI$By*YvUU5HClf25bw`HB zhKumcjikWszhkU>?zLUZclt4(M*eHvQ#(e6Yw<;lFb{U!R>8a{aQ~GI>$0qJ7l2h{ zm6DX@^7|{}o2vG;xAmo0hnzp;hBCWve(!=p=LO8q*>+^XwXf}9PTcsBczN|U+|;FG zFw~5_CEtrIx=XeGJI4JXHxa(qt&gwY$+=pO#0x%ww;$`9N;-R!+pl9uaYb6U$In$H zJO6{u930(Q!t5NA;tJcYEV?p;xuAVpe&6Ld)-T7gemRcy%Wih|eTu1+qb#WVPo<+`^RmaPYl5{nXmdvHbD=qzR z6K~^g4Y>I%q($@3iPP|(2>APRZE60S0si~|pM3&aG`}w3|60I(%5w7=)t8XU&uH90 zXwmLgapHJqemev1rvvUo0r&3$?$ZJH*?^m4JGAKdJ`$&iKO^AJXEd9CD&Srg;B);c zoBw#gpM5~K|8E2CR|4*gfW272T@Y}~+;!{;WO>#E{FevZodI`K!2LwPy(i#4ZMmyG z%p4ALQr*LyV&i{3emS52U9x;Qk=se#?ZfMVrn+dHZck+iwW)EvHI9`%grez768QFWoN(+;Qmp4w%T7d@P)C7AK#aS(-yEoMMX;CFjeU zLoA$W7N?3FJ}^Uwg)@&Fc2GkWlVc7DV&QN+ndpf{-$eav9hO-1TY#m$4gmA{i}I|c zKT7=tT7Q<9jS2EGaO5jK7ModUXHw?bz_R`tkALA43%}gr%m9}3@LU&(Y5T;&Urf$u ztzU>AX;;L;sRx$vuQytFy@lCU!x8Ktw__82EAd$DAW3YZ|2}Y}f?CHRmbe}R4&xmM z-pLx`63yqFFVV|2=KVqV3mPYhqZ;odr&Qy|s4vs_0C2>#8Dfd+ zIda&+133a*da1@oiA@L5abPJ2VhQ^y_2xWAEc!PrJ+bKDxAerK&%||1>=27SI3Oyq zwz;uklUZ|!D`v?nZr@{tw_=v~t=hc)3cZ#V*19T_nf}DrgiINOq}FWmhad&0m^|$> zE@>4Am^vLFBGHOLXPU#HuW}6a!nmzfTh?wEdZj9pe6w1WM9B4^K56|buSmA6`leTg z{w!}CuJOsU<4Hs&`hja+1vFkMr_6LGR#bTp>Lb~+m&#)1=pMSbGR?bhl2Ldt*iWKkN1qUHw7Do z-*d0lQ0?i*jn^#xip-LX8-@7&HQY!JZ#k8aH&`EZB?8!e(DLG*>7$6frO1%viF&@1 zdII^Ne>pbhk+(an{^@=f^r!bh&zL$RU&*J>eKazn|-`|{Oi77?f;kK zzdZTRr~c{mKc4x;*`L4mGxq;&{pr>hx5vYns-WyATc1adO8UN^B*ITSdJU2pJ8CLQ z_MCTjyVJ((^ZIYxzIWN@8}8lX_Ozg%^w-0S+CQ#azwqqB`AeQ#QnvK_OGn@E@wMyc zjX`hfrSW%LCRekEI1zrqc|0yNFHNqNo*TFS_`=>r=od`if4ZfGtC$>G6d4%`Kfb4K z`1$bN)%*Q;`)4dV6EFE$+1}pM=ff`zw|x2zX0*F)=gzxz7i}4Cr<8ikMRCyyuOC&V zeZ1R0F7BlOa|>m~Ka98BJgTkt#WC^jjLdLi_rp&1qLDT18_)JqkiGbUMdv+Bv*Jsy zd87L5HS=q_v-&dao=CSpyWL7f|NQFFnc3}chEIEab?nLZ?YccP7NOVKIUnAglB@2} zxeu5E@y+hA@{Bl|T*wkjObf7BUMy~e9+x4+4;T{b?CH*S8vYhvXO z-S+F=1l!lS{d7z2-F_P$Hzb>|WWUTIzj4uP?QS1Kn?75FMgMK6?MPxbR&%PttSZSy%)a9Hj-F3( z6|{d?cjLk{3u~7gT2iv~fu-3ue0c4R^Ulnxz3$L;m*bel94VLwM~+m9oAab_6|9nu znvUO(azi7X{QSDgYpbfu^Natirs9grXXS6cX>D_J!|H73PoYQkly#yWtUq-kE(}Z6 zIh4C}hwj?~?v(-eGRr;OT<1_4I0KJT;a{`-X^+nxTC{!kHP~+N!eZj*vyAQke!zWi zzRaSLpuVdNeCZx(alr`j79aBKecUi{iU zBj8@?+0*{B0{$Nb{2vdv`8=ydhd(DylU~0+R{LKZuwNc$}BjUmOXT>K+|%hn;r~KOevB&)n+8t?wE9ve0h7ZneA9%d2*OFA)ABD?Pji z*&pCrbajuy`xVM}u(3aKtVLk>EP5KD`)dLF6#@P&0sqYs7{3gEWx)SXz(4qHd_#aQ zbD1z*Ip{C`r$GF?#}r|FX@T%J1^CB>j9>EqBj7Ln#cUUxJK!9CMabu4uJnOc14q7~ zeTn6Haz3#1ZCwvs%9~wC5*uESDe1yKZ0(G!b)4{*dhdlQTPL15`)?FE)T z*5}AK&*#L#KT5u-WcDk`w`;`0IY$o0ZBTxLP3*q~EcqoC{`=&Zo92&!CBHl_Bj(1N zSok@>VsjihQxFJ3ESyU%4v$|cHy$s7W5AIsbXZ~u%lA_e)6j`U-$=c25R1MUSo&~p zCP&|7JH*1d)8cfIWBQw%%c*ddJN6ri%3#SKqDW8Xcr7!hy^4Yi`#KM0XSk`!9 ze{0y(-4SA*m>?&BrO%pJ!m>|F>iP^hGc})BIIok#h7EZGSkm@eV6p$6rDwmb^l=l5 zolAkGzqJ6iq>r0eI3>W*9PA*ha_QqH7S3$yufh&OEczPYXoOmQ{f>_&cvdxqCSQlgjn?Rfy3je)z7ceKdaJEq4mKuNFOV&uhK_M zEH>{177ou9(q~63oShbDH#u{#gAfbnK47ua11!e^v2Y#%mVV(U$uVgr7S6N4V&@1s zmDoXug>xKOI46N6J;cH}ZE;=!mj2&&h)tj1`@|TNN8vd{`fB;iFX<;1o4m$LA1>c% zMJKADjyhME3;0avOAEE0&-&6&O)PfmEIqO487ewiht0%KUXhQ5!^3Za(G!b)G_dq* z6N~;+`x!ss14;BO=(WVlS2V6$l^A*%6B0K!G_6^I)$aYpQcMq*UZq4j#Jv8wwV%7o z(k%9YPBN7m-C5b(vSqW^&nI4LrHIYwMq9f%adX+KEn7CNt#3iv@O=)xF!ksrfkSj& z;w#O>x@M2;C45!WH&?80X=-xH)^FI-P$pFCsXcl}yB*n8z{2T;8<>WaQJAKR-p94iCeNO?{>1&0(Fm$xX z+eERq2-vn)506X57=FcGoe2{&eq38(Au#RnHd5^6pfG8#92=z-9+Nawd-`$v3-inS z2+Bj?t=3TOg?9r0u}GG=7Zq+uX{Y=fuWbx?Fnb4 z>fUa_Oukdf_C_*7`4|frI}$J3yKzgxneIk19-50ecbH*d+ZlTeb>x>=u#To=ZO8a=tKR!} z#_Frn4yPSSd%m{4t=he&?HaeHt;WxV%6}bZ=8x};afJCm3yd@EaLJJ}T8O*V1FgKx z_E+cjiw&zZ`+fX2ddU?JxtJP98$&-h=J!rMJa_F*x94(>)X%|q=^Tug&cS%<2*y)K zFrGSs@zfEFr;cDe^%(e%f&Uncryhgx)MN1OpyHzHvh94o(c~6*wZJjQqZSrrxIK+t zjb&8T#EM?*-IFzZifh-GNR-chfB%GZ||?h(|}!qUY4_f_5wR{>ANQyi{WpGDcoY z%_gZ};u~|{U6g26 zGs0(trno&>!<${6Q|y%0*3OETJV2lOt55mqP-ha9yBGU5ECN;Z6ZhQI>ARi(#O&ax zoeBngOwclwN)rPw6tdT?rQ&C z6n&1zXI1;F_Qkp#O`*qKgR6Wrb<)wq3TF> zMS7!S*XDon8i4nMPdT;m^mqvKyGL4neZg>+)fAT1p;|xhp-^IXugXDt=#FsJjZ@%W9Hd{SBuWnzB2#xf|nPcTKdxRll3POxYtzg zT6a9XqkJd6$LPxTEFMgDx#=(b?vHGbBb-p&KQ4K0DM_BT-ft~XZ@bQ_)gt^=N4S26 zAIi@c))wiJ_ID+2b|aaYc*_~d>T^zG1&lM^Z2Ny`iFCaCd%Qb~sZ|V)@kpM&r~vP& z9&+LfOK@(xgKzTQ_v^t&>iDTiv?iSeSX-k$bq$d|pXVcgwU^#@U&|{hzMGj`>y#WT zJMJIJr@U+Wx?OfjxP#gr?$!Qhv+ZBswe^%0P^=i_EWz^{R(E)xCFGv_d^x!z_f+-P zcuw`y={>j_we0d*6wY&gIr!~@YuVtA0bkSTGA?L;r>=hCsfCqG4lF5Hde73d8{WCL ze%?g1Ikq0Q=+9Nxb*ipSPCj3`-D+|o_eL$dQp!!8{XZ>Dyg!f<_yf-jNXb)Z?QTEI zXhFMeQNPu7d;b60WZ7t|!6OHEfEzPU7rb0_s`jP%Cl4gclD*sg`@Di<2Saq$-hbfi3} zAIMw=rrZ??)9p{?x&7CBEWdmQvg#B|-(L-FYoW1a*VRB>KI+J$Kv)>VlfWMR{~?lRr%v8--hEic!tKR zD)>Gw?O59Jv=e1V5A4PFdV%^rP_+s5-H0*FsrAh(SIM5>amgbxZIQksr!D*H==L9o zZ>sJd{^BqzwK)F$dsiImA^n7D~RX zHjaB&8n?eZ?pp~DVWk|oEkSOZv-YKgdbOm`|#DKl(MA!#rTqH3v%J545M}Uj5P&yW@+)X!S!x(;ubIEsWd0}RQgic zsVwil^N!qm7VnGK4?OSpvo&^SWR$4=U{9kdcJ5i^U#0?t6a!k>iKwpIz|k;xkKMDSO%dG4EXt;Y;O`t^<3E!_DE8 zUV;9Ch2@J-2jS+du_=P2E%9vq;9Q*rUq|zJB2AS@^bfX~+JK#hnuN;YDswdG)^Pg6j`l zpOv-vF#PY@@0Gy|i}r`)s#Ct0_b;he9l7$RUM1WkSV=8evfaN@@4r9&g%5E5=4<>r z1Kz{geHi*$CN)-c?2~#hva+{ElFMhkZs* zz51rbOOE-e$2hQ*mR?zv6W@l`mR^Lumpx_2%ZKcJ$+B7kQq@n&V&`Sr_PpFe!JI)}~-_FZt?Q^E7){%AMc)BDe{ygxH*Pfc03>p-las=}4E z)QXPO9xmTrf@g!rlXvgh*pjGw0%N-}IqoXGF#nfMqV;L#{&-^d)4123izf{KJgx2z zR38}bAVVP>^O4Z6`BWEUKUU$SM;)A9Te1#M-lcmhy4xSVT*rP-RoYyppp;S>zh>_I ze5^2)U${bs=Zj^%#J zV9wc|hBpz6?~LV7_i8T>I)0AL(4yV^#z@?Crc-?!^1-odTZ~T)e$()5omw6`e`SWl zH!F;Zb?#`0(Wp9r}9?;5ndH@)|Z!vpm(LfJDz zeh@>j{f$!or@i!Q_imFqjwNLLe)}-|fd4!%eWRQo8$1p+)0|ut{?!2gtQFtaVV{zZ zjrr%Clf-;SC*|>)#b6~4edzS@+fcDbe#~-T0{3iqa>xnun+^9jfH~|$ z@}Fhd`#sLDJU%Wq{=bF$USJL{5&klZ&-gg6pq5e2ufcx;jv{R2a}GL=g_&gBspk(} z9{%}PyX(Q#qTLI`iFM-`-+IgaD-$>0@ufKzDS!X?(0srBY4>rj{I#3ozO-BrXy3X% zcy86A-K)jvXm?$}{Yb#g^3bCB_lVPk-xF|uWVxrCy4(s~8dh*){&#!n)%N`JpLW*- z{I>?&-?!YU^`YBur5C?;FAKQ+`qKW50slJ#ZvT9%`Tq4%yZ!UMc5_^m7VTc+rB}Pp zi?=!6wpjkD`O)VGKYiN0+zYSWEL$zw-6T$PemP~i(aG&>LVVfK$?@=8%b)c#+DlJv zpgmov>d$Wv+Wm|dUb~9|?q@uE+W)zL+i&j|I{%2{?L&l@<9!3ta}oIV@jgEg-fs`u zzJEQ_?guUYb+9)B?g@y4`R8|LUxS;UYSW!s{`z?I?+-2t`0MuU-w$Z_6fghU?H~Wz z?O*@3`(}&(SIECFmpG~JO9SqF=evf?HpH>&t8rf?5(c={JGbfa3MT^omj(Qv3HV=Y zrHA(33Gnj+e2&u-A^$G}{{JeT_@)2MfW2n};kyFv6#;i)Abq<7?&kvbL*{(MWHA04 z0{q_u(#yGIMaX|N;9eYXo1u{^2>DiWReZMw><7OEI4Y6hm*LZm0nTxlgZqttv<%X} zH<13CK=`gee18bIHwDUrV~a&-e^$W$?*jhc3b?P7!1!hOra*XEr;;@KbB;$5y1yz8 z{L+18AiYI6UPb7CN5FoeNzY0A<~SER|2>et@dy+7D{X;T#(Cxg%bY1Cz%p0GRlpGw z2eI(0$Tw+WnG3&;{70~Z5DTBjyo~E!11$Vz;IJ9D-vu0b6gvp9gyr>C<~_L&IMRz9 zgjhH|z_KRZeqfoK;~C({53z#~3!m47$Vh4(hgkHl0!K$v>p17I$^0O10LxhMw}?%> zyhlzLJ4hDFTH+!WoB7m_(HvsYmjFv#{6;{+5({S`^*K5$vFQ1XQfkKS^ZFWjOmm2Z zvz{E2PG0i_^IkCW*P2f(`~u+USgq$dU&f!814ka$dSce zGUj|KaMX-x=QUjLc;F%1BohcJ!B%>)f@*A?jJsY4m4qdhv@HXcG2UCq`5WvY#KO59 zIC?3y`a2h~e=po(lUVrQ2Ns)$$T2pFg>#G?lg^jPc>+5Kv2b1m7S1`~$d9mtoWmv@ zwzsG`nX2|?Y-X??4W127cp`R?YHX1M3Mwpi=0g=`#X?vYGPay`5jjY${x(7Q&2UGa zRBAPtQ1rJz6`iE@Tk#`vc60)Z9b)0{rrva(5R3jnU|IX_2suw<2O$>DOTdx8rB=^B zEc#dAmia!;0?Qm9zp*gyaPM?&%|7;SdXlWhZSY z;V~|DiYyMXaLO#sG>bzloU1Gj?<*pIhr~jNg;QtgiA8@su*{`W4=i(|@cdB9gBx-q zajC{UKgfJ2w^Khw>pOwvSRfYre1?%V_j)W2v2Y$ChbIgO`#?&IG(JGSsdr-GA12>$ zPLaa{3qmZMS1moU=znABiADdGr6(5sht&VQwofd2ev20^)Ovm^6g3{%z+r>O0?Tof z2P|!sSnM>CZ_02zaNaa+lUO*s_n2Vx#G=0qIP$FK6N`Q;aMakmhn#=V9Ae=-04($G z^pNwM<`4@<&3!Xn>z{^R>iP)z=H7r<_{V|6S7^SP*T!({d2L=NXR_w}mUjM!kHyY= z7AG6`JrWnOa5#Qi>|9Kau|q5zj$0QF@1MmEv2ZGZqvmFe{bAu5Iz7B!6+W@>my=`C z&-u9{hc%yAI5z`FXKMYOrJic91e` zksm9luyDpf6~0RAc^!|u;A7#?MD%K{CpG*PjjQkzIqGBK&m$+M^^5Tn`H7E((?orR z))R~VHtKnyh7gNB2^@KmT75qt`kin`E0tQWH#L z{Y>EKwOU_8&JTSooR!qi(|TgjH!`eAXA?Oloy5YqnR=5>V$ru!Z_-ID`kmC9bP|hx z4{-E4orZ_VG3g{0&JpT)QwAXx{c&JPC!gIUoy5Z7^-k*aoP~M43x8GHd;>UY>ixIC zl73>bqpp1>{R6Ijb=po2&*3Kh#1giIdQ;BCqAv%Ieocp+NscLJV&PO$e?oJJMPCan z`C4FMey1Ovt@*bD=PmTHgl&a>g3%L;K1u!}%_kOpC;3KCEc*L^rT2Cx|UVp<2w0%d|~m(KnNC^u(fX z1(v)Ji~c*nl7>CR=9uDjT&^j^!hamNbg7PaEPf(C^RaMBs5kdc#G>ada&)=o$M7T1 zU&O-UDL%RaJIHEm(Nzkn_u!=~HQs`sNWG6G?Cns=TEsiaIjK3s!r5bSzE6&^LoA&A z7UyYlj2&X(JO><2U`CuVWfb?WCxAcR;rbry%uXkv$0I4dnq zBRR$nv2dC#&MoAad=U$W*DOhMCppFrv2b=<9A3Yqzk*me4_cfaa!h{(v2Y$ChYb_* zI5~%WES#g{G-&+^a$fSWa9)PKbfwmxvFs2F=QZH)8qIl=d}H%1ViUF)-g2xFOV}yE z(MIebv$4ssMl76a;OJWHAf$$GQc(3BiA^4B!sqcNHamgk-kw-EyUA(74stKH$S)LB zSUCHkD!ozbAGh!`z~K#A&*MnaKrCTTS)5mZqwBGQ@HmPzE2yyWc^pMIYW+LpjPbE> zKD0O=1BW+h&PbHAq=8uYs2%3(gR^nVgd z*k$CK^r+*76#`jfg;mD|3kEXaxLBw49kl{`kp0-?-iBB>Y`0NH4q^7f-&Rmx3(S4a zQK*D}7Fg~liADb#;Aks$kTWEmvmXp)2IhEx6 zwU32UYjGBmW9~7Cg|m#D4(uRnu$A7WpnA^|dD+LpzXz&lr`CTTKVidv2sm%M))Nc= z5#R|%Pb_-22kFZq7CrA7qQ)lML*$>ZgAfbnCE(I7YR!4F>5^SZHv5R1)cfhQO}vFHy2=k37`au}QFp9h{`^u(fP6O{XKV$r__jHxJ< zoX0+Tug0u*DQ9BgzfaEhH0NV-OgR$^ClmD^Wnn-r29|Or77oWqNI4UWJ_amls3PYv zZHHJm^MFfDIu`(kzpFWmf%ES7vGA8dKf&mUMZcW<2Q;5p^!4N$J+bI{o{=&n7JVzQ zq=DBvNx!N6vM`5;g`L{Q-86T5P5J6jbk{1uwSr-efae!@PL| zW)@nZRy?m?yMEQCTRq=(&1;9$CpI*Lh#7zQVk>(4`jiYbN66%b>k<&tZ21q@ldPY>-2njoS&8^MB21Av4S*f zvUx_ac3ty^O-R_PZ#jByD2bm5`{t(R6_~Q9X{|NSlOM<{I&Zcj&hjMTS^k(&X~m#3 zKWXC|TIkLB=}jFpH>?XNZc262Xi5kwSg`e$73!KewY@d5x+#CeyK2*_b(}29Td^Kq zEt?xwSYE+-r0nGBrq;4%O~a;u5ncNz;uV~TXy%HR^$qLQY*-DeIRXBsus=KZichq* zxgntmUZQU@)ANf$=4fh2uzuBHU`>3*!b4#;HLUk)g_X6grO9)9)eRmdSz5dPQ)bBW z_^|C6VLWUe)LE6`ao2BHe_O+*4a#3q?s=+-vr=l1Z2%QX4`E9_hg7Sj2{6UJ3RTwB zbo06ut5&bxw0W&>!;3Lx9xf#Pv#lzij^PdKnwuK7_!Ie?rnu$S<`mu9^@A=Pz{1xj zIki@RWG=-)4%%JwsXq!5^q6a||&7Iv@~DDWd| z+OSG3Rv^hptZHi7kib-4X7ZtdlX>acy1pdScFh!UrGOa%rVF@YnjjBcF;!Gky;d;T zq+s6kU>>*v6NL>qW0;;vYzi1t^7Wdr62YFk>2>gVX1kS(~!$#Rs2sb8--2M_a6vg+bc$7?@(bx?7a?Pr|%Usm?Yw*y$i63y%Esa_VN(fzCrBq zy@YLV8E($_{)YDW_$~In3!QE6+0ptt3{aH7TS*syZSR#?c>aQ}0KO4yV(%ZIv+d2q zjpn#P(#Ll+wmk>$op*vqd%2dqOQ5su%}3%-4q}h}UbelRv-LL>w0EIp@1FzZcQF!g zADc*)60S>b+dEg`x0j17dtXEVJAHMqx7FC-kJu{#uGp~K}#HBhuUBAT`U!OX6-GUQp2A}Qa-k1G)HioR&yjaQ6vSa?Y^GCedWw_e1 zufN?X8aUSm=cB6iIf+;X=Epd0t>McVbVB&@*GZ?I56b`E>NwOb*uy#1{F!<5taF2< z$DTjVw&H!&-RSl-t9Zpe)?G#nO-ONY9ub7;4{(!HC-{jh6dBC2tYysvF@@L_z zujR}o(>G@Ryx?a=KgHMX$+Q={LmgRThew9}$mt$dmsM`9m+bbBj737R4-)70I&}RM;2y!;NXfE$ z%a7DJ)@)74-#ziE9g8Xwb%!0yRrJU5BY*kb(8rPCxws~rw!VGu-OjS8aYj|2_R3$E zk6rd9J2(rKD*flnjuw0AI}o=^pO&SJdy|Peu4H@?-`1bP)>hTkKE+w;`E$J#d)}A& z+EcZa*Rl-LF#7;46?wA`z!uUt|Nf~NbKRmn^z(D7{c2Pj@?$5zXwSh6%sJ%E7g&}Y zTiJ{C-jHHO(WsetOrRK^DNrs?v?uCvLpUC`u9kwhk9aDVYShD&8ku6{Q&B|-LLzjs_rv# z6*E|Nji~$Ayb>`bH~b;R^;dz>ZK4t79M1OHz3NCxjbGOYbw%D>Cul!N6+=6AXrr}L zU!v-|(Fq08bn5=od(P}RyQgSR!QQFKM~BD>&m?~8>{g)Wv%#65(aG-c86~RqXREqs ztCqS*UCSqNI77weuXe6;Sakp3`5u^t<9oOwR4b^?XKN?EQnXOnb5C zp>PLfN^U*_^Ddbm$)5RW(AYhudyS-%b1n_aHTkjQAIR;tuHP_kf;n*@u~Mj(h3$udM}4|F^My6Z1dbiTNMz z#QcwUV*bZFG5;ge{Oy!^I06$#Wczb)4DMsiVG)?U!wNds^~52e?Q>f zXSq-PAM)NlKC0^67hij3_GA)*gbWFYFAW(IF=C1gNtB~D$;pHeBSj8DMXQi85j=na z38JkwA(=oT!RQ#QuQx@Yn&aVGMv_V`CrJrKF6DA4AabpTP^D^H4_X7(W99dK*4k^Y zJ&S1D&pG#xbARiTomt=YJnLESYd!02Z%fu4h?5Jmaf%O}6B9(|`_!^sj9&w@=P+cGeY}O^{g3AUX-`lXf$x$Kv-z9g z|7PHC;30W*jxQhf2^OaGH^DB9@c*KO@c%8)Hv(UZhy0fTuYx_p!kNIz_*pz2qv3RW z?m8EFNcVwH*?BAGeE+J1@j2jH4bxdmX=skP#V!ls|4EHLO~Vd$E^Yg>@B5dFuJ8NY;8-y`r1TKL;E{0mEd zE&QfpHAvnsC9x#$Ba2RbNGi%R9l!EhIAjmvA(Me8#fm$%Z^=V;$x}-1)*S${OZWNY zem(xdkX^c0!9LkTuDHvDM}7;3?2=~%?DG3k-y@zv{DUF8? zg7r8uoA6xe{9-R4*Mst%kSBc zUGjecyZr7^GRi~d71<>Zt%J$$S6xax#qb0}cF8jhcKIzOs-H4H$u4;^;75KhhwRdQ z672GOR8wG2p#>$F>3F2Q40icF8?sBkR8QnR*onmRclZZGcF8jtc6k>!pX?XlAIvN~ zvP{V?`EP+;-pi$WBFmKQl4l9=jK)8h6?kMhl3nsV40}o{{=uxrBYDU!d3YW06Nfk# zCEa-)7$e+Y#gDu{{1b=$b%%Wq?D88tWS4Rdz%K8~Qn|}-%adL5@H$}S$put)g&@L^ zUGmU6rOda9#8V`A$S!#%6Avx=!jN7e<4nnr-;*c1Q#%9%&*R{ubD>0U$bH{c%(*`@n3*i&eM6J`}2d2jYX z*rj~3OMV)s0JXEH#&5~WZQ<=(dMD>%M7HVOR<&a(Sq`)q}N5#*wSaO_aS+a>IgNtEPVE6l#UCNnGJXW0fxt2n~ z<2=_gi+CmocRHscQj}_;g#8V`A$S!&MiN}(&ANDIP{=*LY+px?2knGa$DcI#5Iodaob&Twi=X2QQ zomD7&cArUh$>W1v#*_48nO?F>o{Jqkw6`JCOLoaK)xmQ;@f3;ll3ntY5|5SMS+L9W z&T-i1!!FZHcImeYc6n#GmUyf-MRv)v8urPTiE!(Qr&!q~&pNnEIZqSM^@4}&l4ld_ zQcf4~6bl}*OP=kpOF49ZM#>?()krz~ZmJa@vP&Min=0e; zCG1iT*(DF{Ye_kDPe#Vad1oerc&zy35Kpm)580)hsl-DACQJ$OSn(md4?*5zb4~FcLe;Vxao)X!mI~9+--%Il4*x?Lo7V%t#e=u|K zjGxM_+%DzJgVRNpJK3fCeB!qN*`@m(#BTwzOZO_+ucQdV@UhPtPn~05EodouoQ2<8 z7*B-*vl5S#vl{k`EO)X?_wT_zz5xGV$S&RMVZX?7C%bfi7IvARWS8z+VV8Hy?c)>b z_zB;9!_gpd$WEM{a~#}}XFYJbMQ{##22PN0@@SY-aDrwXQHwu|M#oR8SJOc?J7UV| z&alIoAJ`F+hCO&jCtLUdvf;iKNC!Ra034EVs_0&9JubrGw7aU8tz2BQ7{|Hn1miG` z2(aqBQ(-nwe5U9JxXxpvLu7PhOcLZ#Ci<;<07uot$t~;DoFk@mZ0j!<%AGg>^tEjK z5L-NtU9MDkbcXILKZxjv4jt~2X>d5-8(xXyTH@%KP1n+Bo!a`EV_728od>gOmn>Xa zbMK0!chbqR#Sd0H(-;?j9PnJYGVb&hoga%kk#*h?C};c^^W#nShV)mRXR^;K*(a3j z14`=T5h8i-T?{eX#IvIc4-s^#Ay?%@pX*^$rK9JKQwjKiRzk#+_pzCk&h1 zP?xUr(b|kOl8=T=51vAcFb;E&6W|*MOu-W^84nF9PI>D9ZikyRQeHV6obo>)Dn?_S7j7gk0gsGdGCYuXnJ;v2_G&2%zfxWTEKYf+ zQ^mMP@|`fnDLjt$2c2-POb25%~Nu5;2pk1Pj~0Jr^(P*f-6!U&!(R_gGB za~KN1mY`vL*)5Kq6o=f9cOuSZ1RG^}pmL`0=&T^wB|ZVWG9xwrqxie9h)yBVy7-SQ zW`RxiFBV2O1bPCSVPTS=iXQ1M3sW6Tg_JWErXQ+z|3||F>3pR$QYR#N7g_FPm+r(z z{NzSPx=Vig9gd$fYy8ybl5z4=ImvLzF69%S;ivyrUXBrV{}>-#Y_Ps=9lm$zQs`;c z@XrU=+=@GItX^?<^<6WT+*`G930(ltPx*7txl&z`Ez>$Y{}sfQ)eBeLb?^O9y0ouD z$LlS_sAT*!^)T+vaPJfcr^U%@d}VnUcI#-hj5SHUv!-rY*jB5g2y&CMbHnFpEFv5K zs{gsD+m5QjMgd&!Xdu!`wL}@Ci#8?K9X68hfDj)AwZ75PMw4DisVsV zkXeN1E^ZV5h(^!D)~|47{C!5!PQS!MhQ?9Et(F7)+i$r^EcrIT!8x`j!xN>6@{f$< zqjheXc5?p$&uq96{Q^9c#uPl?#9*mL)4zOP^s0jVzj|!F3xQC0a%@cjYUuCU=>CPt z8fSRfb&m$vd(1RVZv@{wJi^x0H-^#}eWP-dd1D*SupEux`^Y=k3v58rO5w9K3p{z? z`Pa67ZJfdqL)VHl!!KVd3fc zB|U-6WNLIU)HkHa%ouKPJ#PS2H?rh-wEAA$d;8j<5yP4smhP-uxp>JiW0N-a)~&?V zx`j&?-@ObM>*}z|a}_QJt*l%W5U6x^Nix`408BaMvT&*9+Y zdmotEg*1{+A0IQ}=`P8HUy?!3wbn0wxM?OwhmnxRW#p$lJ`&$>bI%Imt2lQre(Leq z=QF50$Vhp0u*P%#=>9Zv7Q8$^6}VA?@ev~<^qQCE8(pT zm2J!0e7)|0N^n+#vksggmdQuHTiYr(+|>3^TN&sbpl<T>z;4||km8vhu^@Y@l)Ig@kV}$4{a*y-x z$Qk{{Xzzi{{n`8IOVe}k6*~IX^rE6@ONra)>k9>2w-nCm2-lVv`y6L|-!IJUc)u5? z|I3X|=Z%xVCXXi)ir~z@I@=!floS<(!V5ODXk`ftdS@C$e-h>U+j{IJ)OpV3Jbm3d zqxVE_%$#Y=a)hG3WSv=VE~IsZ;cpGp?7L_0vOW2`AG)RSn;6vsA=Wr4!WuINnEP_m z)p&Wx<<5z?8gm9*IlYa!rrUo3^p%bf-USq3{(qaqqDL~>rP0#=5nEr$R&?a_yDK)F zbI*AGT;q&w=iDW`&be(3j^j6Z#XXJi#Svjo{KxnY-iy=uVeH zU&>{TCD*e}Bl<_4G>PY=C-}R6G-AKoVZ@fMWw8^)I}1E_u*T3b_<5LRhPs~LAC2I8I}C`jxKOj+L%p&lq>CXRgcpOmNyoEVycfG4F|B-bVKw9kKi~?r!{F<%+eQ zV!?uRcW}g67F!Gcrn#CIo&Rhs|7`}J-c_!k zH{IR+LiWp1(0@zU$ukOt9bycPyy~@)56*;3z zyEZ)?YpHhadM?)Uo;&-QSkrs%ea{D9?QnzI+~MB!bgXB{9g7UPyPn$l#Ih&0Z#@3w zhaJHkFR@_HyDa$HGFPw_Pxl_y^-S=mAGvov9bEg7JGf(u5lr6Ag0DXBzP=;2_IY<~ z!?r1_Ka_>hhX5Nioq|kdaO7RqnxyKs8p5L(IClecE-V=onjeVeP z=+WS6aQzW;ffeBTau18G9&5z@xQczJt#O;j*k9IOvAZI8_aYWM)sI@ensq(Dvm<|F z5Z^)#?%2lV$F4rgqK7va(Kj!^++hR0I2mAvjTi7f+ko*YW++dvSl$j6orjsl&888Z z8(}*;0QBUk~}gZ+t#tOvi* zmP8hYCN(RfV&(6c%c30<*_@8!9qmQYj+HFZb`)+h1<{TY_D)9`D^hoI2K}F2%;l8Z zX=|v6lo%&)x6Jze^IQt20E-*=UZ^e0=)626QcO{I2p>t$z%zYxbPkaeBrzWBUrPs84)u-|eqw)YkQivj*SC`0}Fn zlD;W7uG-+O)FcU6DC;(^+g_ujo?VeO*D;f&II zSJW-dm{WZpR^`HrGG@@54WurAV6*sv zjFtDUs=hC&Wbs`YcR#SAnp5vyytHabb;jalobUdHRn^mzik2+NSh{%WeGg>ZUkx@A zP<8K$d+#RSlaq=pnM?0oTAi_C;mSq#W!zi05-F~#&i(H(2mci*f|j8=ZW5Jt%zV zH;&K~X?To=(=?o};rMSR(W*tf{PFAtD=x|Sr8SgdM}4GuP>Y4hPHQTy7C-GF)85KL z3)2tr)L8u6V5c<{3lf>r(<}$t-=uF~?Xob{5jvAE*PA}&cr^PvhX9iQ9v*23KPUly z3IAHdG!OUZ2uHF99dvo#-s|8YyX2uW#{MgX2eM1|iR5m{B)fDcPWjy?N{9SLR5tAL zyHL5X`>hEq*`;5a4_}#te=vo3uB1h0m{L5FpX`#K*2d&J-N-K87r~xFl?i4w9?3&? z$wTc`euL@>;<4gGcFA)9?LeNLrhJ`jEj07^TY2J)KlLdxEV4^E$`k)& z{DUF8be{&hp9I5@UAh;-?w^8xFok%e`z+X{e6maTOJN^B2LE8lF5NR>zsPbYyL6{G zjK{kb$T;IeQNPG?C%fdQD2`9ZKNzx0_o=X7WVw@Fy63|_ek}gMkX^b@hy5bUo$S(` z@^CyYGQv3Xvl#dy%bo0!zZCZI*4aq1OZRf(x7^7t-6^l+dGdL%`z-?5CC@5yzY70g z$S&Qf{`jeIV8|}r+hLdAg4zhXJbzB(iQhWEM|R2oBJoqDfa$_>B^4CRD|n>)cG$0^ z3t2GTcv3RR#@J3g<0o({w@aD3;B=AYPIl?u54(&5*`@nF*ssjMKbQk}{Q2CRl58;t|fNO=!~$tiC$ zp(OS5SUpnkgc`jt`r*M-- z#*c=5XZ)HVgw7U_JV~SUrooNm(U?c(4CGA`R{o!8^enP|rTj~MsxA^E@o;0wOSRwv z@Zrxk6eq%);DP)|d5hqf0W6J__mRf84t!rqCj3gi0?STyj!ZKu$z8(A{}UfQpIg7& z5&u4<%H%Lo9*se$MzxYee3rV!oh09tusHWG4kB}@`cXcUk$iNIN2ZnBFHVARFcST8 zJd`gfc)mGxO7L&l-@m3HZ>l&=_m|Jk9h+tF@PrC5iCt#k>>TPh?clF4A8J@rA2T}( zqeDXp4ShlLmBNqf@D8Cn!-ZQ}G&0l^?%l%vKrUy=bNJ7*+_!)6W&Gyd;`^~I`H$vePTUe6WgSfy4*4unVt_Tl( zloi6i5ifW7MR+#F$J|SD$;CWqg^935NYyUCcY!OspqsUtbPmw(^rbz#=kjJ)oMptx z<;}L_-Qo!KUdqunI|Y!lNKm8Z30@*mv-5LuiJHBiix6s&XMXd<8RVRK#GP0gK7q8D zC%&-!Ma){VeN1s$EoGgyWH5`1>I;<_&xM0R?kkXp5+S(}^C#r&eD0wtiE>?MIl=Po;f&Y`BnWEhN-a>t`2Ozu?)zMnWRoQY^O&>vtT{E+JaP zJRQvIWDliX)xtT)366HjIe|Eh{xtB?zFZ!j33x8VW8xW&ClOChb4!hXZ9c;9L~r&B z_Un0Dz1ugY%?K}ellc?cU9ov@vPf&g$w*Da8^&7GKq#>>T zx(>J&jrQ)z+@0N@)8xAeJ1gewvqtB(CevQ!_8l~E&bj2E(djp*oK-ui(jV>0D4(>S zYKFGktLp3EyZ4}TFVzS+C5c@K=bkKfAkd$7o;CWfZ|QE?-sC=Nvgc|(-q3P)xc&@_ z+#PN|gVp|NIEDQaypKt)#T$dO@ZL4`jxZw>$aspzhxBwK-0Nj(Z`EA5rhdoWk1dL> zO*kD}0a?vH)R99hm-|1^yl<_OSMI?_o6nA_+Ys@EQ__vE=M?!Oa`J@DK1`9}ECI<~R)NyVqcV!F>^S51*1IwzYG(^?x>NhveJbyks9lP|sU>9`=uo2o}b7rsSeh4As;ChCsaR>ws^fe z>kYQBE$VsYY&a#t!u5&FKa_a7CyjZbWj#tGHgqG{%?#>)`RLY8;}mgVq?R>*u9W}-nbK*-}i$jy2C=@;xpbns~ihA1520D|NDn%ZG3-3f56|R4YHD)Cm zbDa4-*qAjl-ldQ4(-l^g94aZExqW74`QtcUfn0Z-1G&CsdK2$!DowVdW;EVa<~{wv z27iJVBgQEW1y?GtD>3(&@9IeMaCr9vH zpz9F!W1F4tgWFVzw@TXe&OqH(`|Px@PH~OThdH~E6RkWa=JA}kE4r3aes14Pxa95!HiT1}S-AFTD=$XZAkW(Oup`&t>sSLUH?FO+}oBZ;ikq?$O(&KvZ0C^eBE|8@E6>?7$NtFFDS zJyZLsRE_@aObk za&|}8hFtU(y;+e%j(P@8ydgJ?Jr>ngsBbTKj2!Xrm_5YbGV9(l6IwSudfybT-NDSz zCOcR9F^0b6GWwplDUjLX!pKp1InJVO!uS9Ui^q5F`EeL@XC=aq-$QytW+*WFCDvCx zm=-=weki5o5mkFBb?&Sd7U=A9#G2AkJd;{I<;#?_xh+O#D)oh0f0)~n(^OK_csb5E zWOy;^D6PX7RQ)a9(m3?#DD>GSjuzNgR?>%g#lWZ!+NkUs1{*6UvZ9)W>EYULUayT# z-dlpE>MPZ68oSI=8l5INPCuZGCMKd?W;@>f>K-Uz#$aY>-EJe)c%;er(^G+Gar&ZD z)rxIRjYsg#&ZdSwccq6>Z?|r?!RK`0$*F3cQX#ervJKmYfPo22lb{+Tm{N6&B zjHPRjYj+?ckxd?#h@5ryf>o8OmeL42XD;<_(x0x;R8>lf^KG2jxS&Y_Usiy6vk zD({BAC~rSe-eP>d$#Fh?s3n5li1U6WH<_WWcG^i>FFAO?(J#!YOh!9?O-Vq0QLd6E zrTeU^Jalu(!Q`7}-}J;k9Q%jp+8HiY>ZEBvLqK~pI#rI6c4KS2MMj@01?ahq^wf9_ z*9V@cr}k_-AI&&OZ&=y}ZNbI01=C|7Khjj2&2(sxROY@yW02xQ{U(j@N+%Za$?gXa zLNodueF1uwb%jQsatU;LkSgj~{5)3YOUY@X9-AboI42i&q17r(X{ET-o^{5 z&|AEh&^wDgN~1-aLl5CkeC13yCC{K9#|SN9+n#do@!+Jb$s%SR&gVuv;r2YkUpIta zY!UU<9$BA}2U;x3Bk?D%;`!-~&;>r|XRA%4$H!cO&IGj7afTd)sV{W4(djMuO+8-r z{SP)2B%oZ{Pq8sRe**J-&#p}<|G}xDsE1OJWl(=$gpz%^Pq|B-DKL?OERll22I%k3 zG>9@(EtA@#EWvF}$wgEy4SnkiDZf?es2WeB#aET-@HMkBg!5uU?~S5T3%EQuU-znA zQzNA^FP!?=oWq#U6}b+Hx{GnT1@Fym<|Bj`$HhC%(p+yvN`7RY-76S_sq>Q}%S#X0 zEz@t}Pi3U3<>% zdHwmV+ncsw^!63`6Kl_6%tNZp7W|f$KsO4X-i`Bqq(^5$S2$$nDOyWkLwO+MX^zgieIQ|!?rzHJOw=HYglSE%vbo*B%HlsBA^{Tg2xLF>2T zIOqlKIvcL8EN2X&% zWNK?}(+eXESGe9sy-A^{eUrzjcTgLHCvWrlmY2Sx>fTY;v1E*`%iStIRQHUMK<7PZ zwIi5&3*}{fA@b5hUV48TmzS!)H%_RQ+C9@bhBlThcZX{)GNK+TxyCIcFfX|Q}X*65J;w4B}IP4m6ow3mT- zs+ke4$2`@*AdA?vg}52 zrH`Nvw(M*{>s?QyS)kL0RWpay-KWMLSu?6`KXg0gI%!8{O+zo$*yM4UkyCd3`)@-J zz8;z@@`P%R`^X6PT=mj6(gGGir&hIC)+yIv*U?3+p?7}oDXV53wbP5fEaXononSa> z4pu})u>RX(dG!YA*SxMb?~JSKci63l&i__LjL!e}Y7EtvzrD5$S69BXym`;2-CO(j z_0D={&fD{j&p%e&vWwObTBkljbtJBS3?`xm&{(-7B{Oo|t^sJ@b0?vsH`zJQXFP{o zhbOV)&GXhCT1z#$p;z_@Y9z~Pnre@YGy~`^%r4nj;+^@)tyS|6%`d)fA!;6tXzqV7 zS%2|!;Rsfu?qmKxdQbPbv1Zli&Iq&nSdX9Eu?_{haK~!;eJtG(;*K!5PX}>$<}tFR za5=x)2!1zf<5Hd6qJ@z*wY`w^UuQdOu-jSV9Fq;*H=0Y1HvVx`?2jv${{pPEiIM!FO0>lw^^b@cPcl1M5Y%KPA>5iC)U+fb|a3gl0L=SBQr<;v*JNYPP z)B}*7r^-{sX}FQ6>h03j;zzDuPovNF)@@B)&EB~`Y$z}jF#hCW?(JbDk9x;2UWZ#T z4s9H|&{kEx!}bf*D;&D55v~1_>JQpR*Kq&nS>s18yUk++^ZDlY&gswGy%lwW#*>qF zt3Pz!N|({8+A+mWj^?>db}bsj7ifwot~BSO-cV9RiaPmT2bJD`QJ!SP<;mco+nhb! z|D9A1*B?{9V^qPK%NE>e$JoZ)Ste{{*uSDDUhnOOo|{8jIP{u^!R<|rp(f@(lg5mb z(_8#Q9zIg~6R-|k_#?g!j5X7YaLRi$!s)BLDFdt`#jJ_Tg}$6ttnJKqS0>qge!SK! z^;y!M1KA#E&zbm^PrNo^l;h?`r~k-iwvg5uu__xe=}wF&cYjj*SvO*hZzNTxv4CeY zbI#lvO2pi)p+srKSit~)^gZH!l{K80<5)KpTDSjuV!9R3h8{1FdnC6)~E!hVKg)K0O$xr-A<&DRFpSSbbbFNSg|x$FbiUNEu-Y`QY!mxXVy`gzTW<#Dj|k7VAl&{V zgy9=D4l+KN4a8~wQ}J~vF`M2-+CFj_TK^!emUK6fu0O}_Gjduo?a`oY_qxJZUWOR4 zNz?bnkJx^kRR}ZahFH}?equ&J5@{|l%OQ~{3wTYC^&ozRK=mMgHefE4Gf|qU=re6z zM`#v_Izly5u63M0BIdV#RT~oe)ZgBYmZT(V?Z{bUjn1jJ(Rg~?&Ovwf2+Rs^aJew1 zQd}pqc^ECTt&vssd(gCbnGD}jD1RKIZG0QSJm#xf;8%^wwC7B-Oh4xL2zNl#g={;{ zIZetQMG5cS9cEZR#ZBcV#!IkiGdq9Y?_47gbJ@S8?64bxmPd~qC&g$v{Qs|7E68u9 z)q$KQ*CDEhG{PWnyexz2Ta>Rd$sDJ-q`z*!T8W_9Gg|ZagLQoO4CfwppvQEsD$rbr z{PcthJ&)f?Z8;Wt4Yvkg;ZkmFquYYCzwsPKRP0P)rV*_(YkA9$;B?Zz$Ld~V1*L@^ z8fy!@MIQ9gXgP0SC$85Mr5!x>79&~@Zl6Osw4B#iOZ8)XHgXk4NU_>hkk;#=79I@Y z_9;I#k%zTo73Ms%t|1Z%cF-)z2+^tp_33KW-@P@_)ku3*=+mur3gnZ_6EzM~ee@O5 zx})lw<8R#23W%bC-?5UR*4bwrn6p2huQpKb8-3eaC=W-ri0>J>%jaUZs??gd;^ua3 z2=-oR43pR)yEYnwlQH90{S(ceX%#iT57EmLv-{bZb044Uy7iNp;+uYxv16j7(C9PM z;J&J}kXxe0<~E_HW{m@;HPVVTg|3LJAGL$}b-b-G)9xv;mJ^y__tFDrWIr@~?bl;C z+$jX=>#Q8Yxtt@6@&q-Bue98B(C7CEh=<-E)bCdPLH*(Q z{-FI;yFd8x4dD|H8tAdC-XPq*neDhCeELDd&sTt`7kDfr_Wh_eHQZoyMnbV?wlMNn zHcrj!ky7m1C%fF)6)u0?g}96Vfbme;2ODB*A1w0uZW))~dwu_WX#MZ3owM$Mt@CdT zInQul7p)gNm?<8_cLe4j<&J$Dql9MtUC$Vu=a0>I92I5aI;={C@|$vs);hXdC#O)~ zt;%H+tyfS_bAy^;1TsdT9_b_9c0T{4{bZF^+NUSI|B{*>+=> z(im!p9oY#TwFT!muotH=Rldql9|Ud;8a-_pX1J z5$!Q(ZL$a7g12HBgI9&ZC%VwT$g;|6ll^x1beFZ4t9otXmGiDLHotc(R#}enIk@bj zH&qUw_g_`-PxXJ;OEtgdJ3SGr?wf&(k(lWYust-lq?~?a37H&P27zHj&&^2kve|6k3c_!UXL-O|o~0cuhm?H8Kp*HGHN!YJ(} zkbY!bhko2BpJUe=(nDn3jV89AjqkJ3zAti~ubZW{WLib)Mjc3`v!~GI@INDY+|)>Z zv#P7b^D#C-3!)WEr8UIY*4XEp8LeH0>vuxK;`KGdf5d}*zkO6^Q^M^#akBAKMllTc zV)U;YaxYKYfzcOx>79hopW;N;5BdM=(*95xUVyjtSUWyT&;w{CsM7IJY6lt^Z6OFv_2LXvze(pvtpQnZ~7vBeri+gU97;IZ9)UdAlcl8 z{3t*fz-@MLpbP0rF-6~k6wO}R)`-$bO~f4Zg4lamMp8drScuh^t5RJZE z($kDkOJ9h}x4Xq%*@UrdODQDRe$a+fvF%4#MPW~K@3{ix=AYAt+Aym|E*@cd<>3XT z7@M40gw$ip3VR~G=l-0=_nJ+L<&|y7U8Lzst5@_th?Oi`BQ(nW=8xkvLHee$t_yyB zjXGZsBpK!LnqcQl#8_x;4vom588YHbsZ3x#4cEeVC;G;?{Vh#*Gx+Q)X)`$EW2-{KS5UP!=M`eSh>z_FKlejL1#mZc-6(#nBh=$UDS zCy?WR= zSMzmyyn5Vc#qI5?)tu~pk&oh3M`H2PQUT<9o*0fs6^4;d{nefyqT#ft;JN0+SYI z1+tfCfu03=Rv_btS%KUi2ev=b)s|9(k?Q-)+j@}ix$CL-oEo9g%UJhN+H#zdM(bu? zXufSMe7epE;Oc7BlXBLL-(|KY5$J5=D~nam`9){&RGne;2b=4PoF({JX<+j&G21~Y zmc}Z(Sp*}g2_53dIsch6ql#ukaiS+&dx~9iw?Ej2HzVRbw^WGOPJx*&On=i^Av^9H%4W) z(R=K2@HVCL$USyX>n0A*=AwH#0_*=7A$f4qkIufmjCc43aDn&*xXzCp3RRUJu>Eiy z16){hfhIzGkLo>AL~GnK(r|CR(U@=NG`X6kkQ3)}&r@h+o-rvTLDomqpiaumx-|a- zL!q4NAkQrt2{8$TChf(P^B<61?+AoaJvVqQ~0uYwi~?%zAT=NFNw?oQAB%oT4oE6-HL$6@3%klN%;B zPA;10zS5Z3cx7Jzz0PIWk+IgK=w?guB5`xPkAQ_&u*suOMc(JZ9VZ*>SaMj*>(DbN`=-thoHS>iO@`E}P%`UFN?vpOwEI zT(tvtMaX}cb+f!0S_@vhL1PqCOUW;x z@qQ0;nIQ)^W^)vKwa!Yh=lQ_%1NnmdXdFnyTT%aHz}*u)6B!k)JChKoe~Z2F=xgku zQq+=}qI~Fg3Q7yVX8oU>ah+wyPsD||{1Ke|nzfes zCXcg2=Id!V&1c^msG936i$F$~i>JRinoy3rbFHp2AI^xmN&C-SE2Vr=>7JLvSCn#^ zRIVB)ibFX6+_}@P6I4Uw-GcTrinG6jPUA^wbcQ@T?&idovzN_%XYQ<9cioyh|M~eB z-1g-S%PK}M#4G}3y5LV(VL<=m)bXhG)S@)EH9^BThxJUZ?@@afyD#kfSk1$zy*0wu z^GxW1SnumG&$ZCnu*=pA3&8W|wD(Z&H!dKbN}n3x0 z9!n2QnlLtyebv~&#GW9*f?4EPC&;=)Kd?d#7KB zlIWq-U~QlpZ$HLrg;)uMMuhupTua5iIQpFLj86>l^w!df=y%4O0xbv`{*D$FOUx@W zI_X55VV{YOU!Rz_Z~opp_Ehc0Ik=Xb^^EJ33%O27GeMzEE?)1C4E@_6D_p77ky?3mDi+wg_p@55aaqys30&K@eC{-k7s ze7mzM4BYcXx?pq9>WC(VkgB>g_*<}*`M>KqJ*z+Z;HRS~zoXuil;Ei@=#5kdp(mPC zGDJ)=u(pGfjJ!7B{y%y+cj#qfWQ*wYl9RThrN!%VG(&wEC%OklnI@$v8RaVc(_COP zWQ)|{7iYg;g1khA)hik;z#BC$q}>k3OhNdLnkLHYr{F;>(7#d`(YideYN}c8@|O(? z16;HHb<;8C{FIM7QB&4Yy?&Cu?X01gS#*j~oca@zA@nKaX3`vtMM@{dxsAlvskM0K zVol63N@0ERWur&bC+NrnqY}**l9O3r0)-55Vg2kVKoJJ@U0(Ma9Hu_F=8 z%lHmC`Z{_?h&x1eEy~Ah)K%1dx>F@%%XJv4`46JzCj~}Upx*Bo@82;VVPiKpndchP z9l)9D7x1=18beh69(W@9$V3*X$65LMX~rFKH7?k^xaf|Jb0TWY?`m?+a@5R7#tz|j zBV4blofHG?R5(uEOkJDPG^QxGWeFQyGu_TfT8+w7sFSzW6l$d<;%o)>ai@md^Gr78 zrdw{xbkzUt=#z78pQv-an{ZA;uB*`+OOK1ju6bM|?l11aNTyCkN}ZR^Q^fCr(5Ye( zSJVKk>toczc!+mOYcWTNIJdVwu zV^bf&E)3Ug7TV<{Pl#`8qMZ<#1N+J2F^83@F9N0!vB}m! z7g{bJLuzhPs>JbcSfJa(^Y>cwLAn*$iP4M7n$EHu@nBbEX&dhSL(^G;x1*`PmUP{z zGigt#+^)x@*?!%fV5{tB;%2?8q0gN?6MDl;=)y8J+e0K(^#Mlb-a=@Lqexq9Jnmuc z;}hvk1pm>+5)q?+g6>0o`8>xujxlI-u7ghg5^fJjsX{BK^LrJ}_zzB<>AX)&I`$=` zOSN}FF4y8nZ>xI{YqqFGM_OrZE`eH*Gi<--K{m2p+#$ZCI$T(3jINHFX;|ag$r8CN zf8})Sy{Dn~_j|T@s2$NB8EExgNQ(&1UpXG@ThYoqw(u$9+u_dakDsN`U1_>0J(cGj zNtr@zawzHaV;E~_Z+ZtxO4|56skzfx5ryXrANtfKN&d6~ zi1lEyLr-FXOgs}!Ch?C$lAGFytXHyjN(r>9B>9ZN9=s;ZJ>bCzh?`uSAa65iM`@$3 zG6VIS?OID^Wc$H<$9dKcXDr~K?+n3*(K)*ax^76V>dNr(W`ky;g-`E6?0KKXXGvW& zN=3R=eF*I@Ozu^!!Ce|5?Ku=ctET>zR)kY#esvf`J3oxMq4+S?mpQ{ox$$e{fi{f1 znVP%`r@WlzNqlvCTImx5D~k{JO({M=d#^_Ngh_V*S8GkBibljL5vL@!IA)x5%9KVk+~4AqGVCuT+i$ihQ~L|pN02qehrI)7$L;Ri zOvkL+xg&7Ra_>8tZ)YDbKQ`-VF0>ZPl}N~Sm|FAP!pSL4{e`rEO>-OHq8d99^=ObS zw#OP1ZMzcln%Cf-hk4CQZ2xTaHlworMqlQ<duSpEOgIgPHcZ59jGbI-4jojVSL249Bh~onH{?<9a$$X!MuOH3l!l zOn45l!crA7-yb^PbOpoud(RX3#KD#ABC(NFP*#gBy#aZcW z;{79kWgKt$FN))_^WvEE*TzxwB-9^7Fe^UFW*1=<1-lxg6CK65DWL=T`HCp@<1$}F zZ$)da)blz^gKnhmY|W>yU*LSYD3?G+0_JnhwwTTn6@Cz3-g^?+LmWgSAr3es?lo1&snNC}+&i;5s@)B}1c)uk0!CZeeePVn?>n zoMbR+7P^$Z-a|VKv=caz`*GGlXKBh?tcl<h8Q@AYi8>s&F`RFFQ*F44BAF5CIDqMXh| zKYlCCcB@KcEsr}*G3ct4?rP?w>i%EBJ2(?*4}}6rKg4KRWaOp&iI+&!te>p(m?aLK zXliMH2%3@|f2H|Wg=EgS>{gC_5G_>(=H(IevoGN!0iH>Tn4!PM0+U}uzEd5HKMzJT zhUB85w2@e&alT6u^_cJbl@;Y~?CwY@USIT3S}-4TppKZ?TeuWo!laYwvqQ-Z!V|Zm zsMT@5`Qd*+xBCxX*B4;bHomS$-f-0Q9aPux_LRT19#h??mOvxQORS=dR;0wZbKzg8 z=QP`N)N=UN>vnmwx;_4vYj&E|LZH1MkDuas+~LUMikT{pE0C|wJf686yVB{{bxy~w zb9x|S!dThIyY{Ho9-n^|Wh410np{DnEZxs$X)7J0Esb(hXF#J(8RIK=>~YXL#;}&2 zCTphZ)v?Eg9%&yRp`2qp-}Oqzx@kJrP1CV%nqG&zL;s1LpXh4bG^ATV31@LTX{>== zW7rcga(+g&HzA=tT>m~J4%nxV-G8??qbC9PlpEWiYoBHQv*zi7apdbWNcb(I8$!_p zx*2qq;TLnQvycQ^JGu0T8%I+(^|vPO6XD%rjU#>G_5>q(c4$Dt>YY_G0M+*|*ryhCZ z1#kT?7|l0HYV7_~n1{ff=guMtY}8~^lzPWlGV>AR z=dB3^)(qhK4mVmoW(_rocSpxo8jCkvv%#D()ELa~Wx=s$*+c2U)u*s>ka+jv4f9N* z)irQh+K)h6-sa!9g)LrV^y9shs1aM)&l-YxdwI_NVMBgoO?@!*BBUE-M(2&bV8}H5 zxT@wKcQ=)X3vu|;zZUOCOnYF%)Q;=$rpq5;#T6;QP4xsey<;4{h38tk9I3@BqRZ&K zN!Xx|0DFwiUnX3)!Jn6o)ia~>Kl|!a>Ib(qQ;exb_Rt&Z*3uj5ev9%TyEntCiOux> zxi@ic8m`T_#ZP5<%H(x=%No>a)D%Bj1=0sPS^_(Uei?Nizr6O6J>?kIHWLi$yHIbN zaYygwt!!{ntn?U*_@dqEEcOf3U$Flg^+5Qd_H~MK&60{xxuiFdyCh+_I2E9sZCNuC zaXQ7KXK<4*fm+8YhW&}o0%}QKlIj($)@#MpE8+*KUXqGf+bKm#YP=b7QdgZ3QgH$T zar=JoEN%jNnfWp5`kPpJf0Gs9%r)*Vo(m2gL9M11;C~W3Lu0qH35%k){K$x%F^%Ba zJ?w)<0@rRDdZBh@Sf)0#y_XWKH-w^)=g?1)Uy7d zT2?*YmC9R|IKzVW(*9ett>EhSSRz{2`@D7i0l6Bb)+Jlo5wG#Xn%LPREO-{J>*wJG zX-3z&4}BA=qeouEH`z9^Um`9In8S@Vf^}X4D<{q2)6~QD@D_>MK&_fmi}&In{a^ag z0;6k>o}-?p`^n*3Aox&*Ubbsv_eZQQc+WhFsR20=B43=L~Ir2cb(5! zt^R`zukltN%Rk6lJ#zW8Qx^RLw0ok~HE=50J)I+kEVOCriEi}8_IQoxPjI@(XSeb^ zT2Dt}Gz)sNun9_;^zQ+@)sZ?T~^=+Vu~npQ4?Al;-)oN_sTyX2XB%2=-QjKQPfsd(it7%|NWb#67rCLv2H2cXfmp z^k6>*ZVb0x*{+Ufi~K&^$yvL6hS7=mK%3zA{?NHDxV7CCw@vx9C|zp&<2oUm@c6A$i=^e|CIPTU$#Ty6P>`>2_ zdk*Hl>J_W1SA>@=u3okhofzIAf$v*bzx3?@Gz$Jse|%1WrHsJ`k}l4eQh0F&|HZ*4 z{*5xY+J?SMkb!3ko985Pj>yU>6(l zbd&wlg!u3B5uR@g5cKsLKBeJeDhO@_|9tyH4+5XCs0{OLl7BH3A~ynmuJLDT^xcx( z@=xEO5k~m`!httIzA_0syfF?sg}+F{tF`c#Xn2K&GaR@P@+#~AMR*%D`5PSk6#hC5 zr)%k@Z>9(%(zi+DAFttV4e!(NNe%Nx!~+oWQ?&4>Y5ZjxzEs1XYWQsj{=)hOmPk(m zi?4r)ynHeQ5&s3ArD6JJmN0_8K|+gvg@#pm2!8sOi7)~`E1~6|zNICMpdXUZqVLgg zzlINJxZ8o_(>sEvce+g%c#?*2_o!=?+ItKl36j`u%` z`%ky&0vBrdS_h8zKbrfmvgrczzL&cRtokE?Yc>8&4jeDv&*js1qJ;5l^)F4sV>$mS z$<72`qG9>1AZF3;aM0t!zmUtj)^5)NtMmvwMWa7x%M{s!?~LL`5La! z@EiyJM{7JGKQ4BWmR}d~^p)ED0$*>3FR(|WmuOhkXTh)1FYx1le)Z_;Inzxc?QJf7L$<|FbpvK@F??6#T0-`biC|_9OUJeHGYc*9U=p8dmK| z(9<1sAAQUW=1V*-eEEve&y1^@3I{6ts%r=U->%S+%{8eXsAUJb9%@E!+_&yOp4evG%{bEQ^Z-{ka6n=Wvw zhO0EJ@<;G5aM0t!zlzJxx9I{;)$nu&j`ttr{uRH#N?uS)Pafx2$N{{>d*yIITMTiIUg8|s@7ri3 zUEX)Nyi%KAU{!tsKd8}_JV9USpvSkLJGJ;Pa8MBtQ07rUGDFSFw#_}6H7p99CIPxx2;mB5)c|J_>r7Hjbnc&E)T@XHPy zAKpK*%jjdrFq8~~U82ngmulhNtKnJ=FX!=5^HG6Se=azeS_J zt6^1N1b>r8SLqXURo()t^y01BRM57mhwJQV!TI_UB8@8|Nz+w}Xj z@E_oGmHz_Iw)q8C^+RBl-vWQG@vHn1^tUzorw$w+-|zDHTx-(>p08n5pTDc6=OHb< z4{7x8Yq(y+4H{mf;YJNNX*iPOwMsMZmQT>m=s{RXHE<}(N z&Y!E{1$O%q^!GKoTF(=7)qVw58-NkBXGWki#5DJ!y7fM>aUPj@1V!Wr=5p?u}v4a#DU}aALsn4{2tfR^MpnhSoL25 ztNvTyDRy`QtM(zVijTmH9Q^U|+sMPuu;~J;_zHZrMxUo)6~B#I`hLLWtNvVIRel01 z{{pM{3%t?}?+2Rvr@4I99t3{S<`=kB!>Yd%bk*MotolEJ4`}|CJ}>AWYV)&Rv$L8m8l}~2a#tkwppWZ=J8kk zrNGnd^a{L2!>Yd(bk&{&UZ(MH(6A~`!QZ9PueQrq(A9V(uv#w{Sk*Uy)&7#eYJW;# zHU0_wgcjcO8s6!^@#Vi&%g+~ieyaXN;01R21g_Dr8h->`)enI?HU5(t-mT&1HQcJ< zehq)>!13wp;^|T2i@>vNet}i|1zxSu=V(~PNANGv=qmpB>a)it!tyeY&t%)_WsSa# z(=%+kz-l}b_zsP(;w$JXy#lXu@W;pJ6&{{yF9NInQ{d^ge}T(2yh_7ryb}DX{k@{4 zcRLSXwMT&$*zyFvR>P|N1YM1n0;}|H*TQ?1ho|ySU{$^XtM~|9Z-+0iD&JQ%`Q2Q8 zvCS{=Tn(%85%ftKUG+cRn*5(|`I$Dqz@KRNsD@W+ShW}7f4xTEtl`%+e1YAc{6vf2 zP9DDtZ2p}Z{dG=Hwdn$nbKv;;xr_6w@)20|PXZU(ZA{>ewmgAXXjr9R&@a{ek8?>6 zg8sRLY!@>o2vCS0gH7Q30jhr&{MTyoCfoTX=yzy%oyM>9rCqEvLxi^nKQ5Ne!<(-0 zAJgQOJK|pe|0E&>kHIpy|2Ymitw$`<@b@(N<2C%E#^0skckJ_3BE7pc`Wj7MzQ&)e z;mI0apy8`ET(02?4d1Te?`imb2Y%E#&qaNji}h;txtG_^LePW}SoN1We?R9}bb$+{ zcP6mvKLy@o$4B5M4R6!@EB#IIud(Zgz^c9o+^o@eY4X&3SMdAn@)TH|uM_x?gPv^3 zA|1=cj`Q@tuZ6c-!xuRGQ~mr%qo2_5c8!0PmOtuzporgb&HsZM|4EI$QIr3fM*o3E ze_fNO&KHXCRr?dzqw%ZriGse{L67erck}!lW0#k}N*@sTE{(3ngWc>|Yd?i_P8Zvw z)$cuAzS55ce#e$4@EQ%P@kG!!YxHL|{I-U_(6E|M3VGMs`LD-!FKbK}p0}fqaj|_` zdiL@3Ota++tn>+i7isi|?fe&Xr9TL~UE|-W;Y>Tef`5{RZ@24@psV^MusSa+uxf7t zuhZn!Xjt`cf`7G^o~>H=>U^uo8kkcQu=>n_zeURO1 zwKwWhT_&?L=2Q)m+?jHpI^%_?Dg@UfuM+Ba# z@waPO=`(`AT%*s^@Fop!*09pAguHh(`d$tHUc>zw{=$Ld%l92#ermq>j#j=WI9<(` z1XkrK@B%x(1)l4`@!_51@{(-&NiDp0IeolM7dS)1`3@W}{}lIsflWW9$$wu9|9y@A zp%%WtDtv)e_#bNif3L~^y+;2?lP|E6FR+sTk>>w2_pjRjX^s8~r;oGKFL1qvReKlo zRtG&kKR@O2vTeG+s=f%U^cR6u{Sa8ypHH>;p5gLew&e@_iiYQF_^^hLYk0Q<$EW8r z9-ivY1+KUGKV#pq=4W2G8SGL%KCAFQW1%?uH#lAO|3cmdhrIakKi9$+ScNaJ3Qu4q zUtlHwb1gr=(8^2T$##4MF4nLb?*;v82R%OiUvl}^+Vn5k1<3*keV_6CQ2qt~GzUNF zC#rk|y;q~J*YM*S{zSu{YWS3fPipvm4Xg1&#OHGd{r9N?OvjH4*Lr7+7kDbi9!-A| z>7Qozw*v1JUg$s1pVbVvqSkz_|fU^T@Mn8rF`1fC?Jb-zQkXF;#f=*4#a33{zYU!~!vHLTjZ z@P9(1AJp(^4gX%l>O6svm#@VyTf-YQe9F#W;XhNuts4J64ZpA9e9ix-8hwpM$3SBl z5&l69r)pT$N5OwaqffQh2Lye(hSmLPL09YN0+(t0A8PXFIq31@iMZdO+NZ#({}EW# zCxJJ} zAutA7%LuIYa|BM(=yM%-HR4kuy<72_?x0hDq2{kbUWrC8)9@?@j_)tVX#IuQ4_ae~ zFL1j9$Cs~IzglP01)ihfP7N#hf?t)tz^`ch4{P{A4R3bf`1p96<tZ7wU!vhlHT(??XJ~kWhBGxh(fIi|5t$3{lZu7fMb`btNoaGac%Q?e3_(B2 z>4|K&wf_Dp$0OM5R_9MTc`6&p&N<#EkOH^IEIO4zDjUU4<5wD@FSY3VVNYeFnOa*G zI^_L!Um)=Rusl!Y{C*Y~Z#m$H{?f8(>dmm#}YI`A2m+m3@PGwfy|1r7Z5_^a<>Q-Pelr?9%W^YjAJp`~miqMt{zd zPkl}*%VO7S;WcEyqh%<*pKJN`Yc2hkYxM~){j?4FKV~Bl-!n@2<>k?4mG5C5pDWn! ztolpd$iLcq5O~N^Rx&|LWmmFAN_pY@nW^LxIu)K&_D%LD>wGb}k-SwGlZ`QIiHGDrOE2Vs5$)$Xw$j4nM)XrwdMKMy*|*qhTKYy3lV!+yt%U{u-?I;_ z^v(kRiuyS#f2i7|vVUNQwftId`KK{DmEFurH2;17A9e2^XH`}9{qF+| zAfayOpdz4+!$?Sbj|d1vWCH;r5lw`IWH7_bAm}iR!+=PnBMd(zG(sffCYwl!xV?=K zk;n`Q35lDC8;Q&a4b6;<%#_IV`Fz%OUFWRXoT2XL`~34=FU~pdeXY;B*0p}@wSSyF z2h~%SAKVzMN|e7<%Qw3GF9atO<+~^5WV`N6G0YyEo~>HitQ`MUmb zS;!A&25Y^)x5*D`gG#Nh$o1cCL8nCh_|dyeVtwy)mCYUa$PZ=*-_mVbnZHf_+xB5C zFZ22K;60tsQr{iH#>D)7FR}hERsU1rFhBTWP@Jf5NTR;6&FcG7@LlbnR<8VA!S9>3 zzagk=wtaW-F>OEHZ>>+Z7Y5%`|FYc}Jg@P~_M+gXX8Oee{$o#lh;`J!J1%hVt!56`8>tt zuMGw#=J)SZFZ1Q0U|XX6cT_L=O~L#``Tg2|+zs-Bb;01oeEUYCf3Hrgr&DxW%C8Te z)#IP6R~v%w==NjI|Hfcm;`msl_4Rl8j|LNTe{6Ewj|EriHa6XO|3QzZD_#Dk;Hkv% zb(8l0gD!t_usAUu{d9fVd+^^UWfJTEQ)2rBcN9&` zZ_@FQ>K^UircP;Nyw){1&b64VQl)=&9Q~-S)xY z+C)4{bpI)E`Gi=Q4eJWV1{;=u#=RmXk)4}JoJ<^}=2KWzDT;er#K7K{!bYgwHI^l1=>iHdT zK7I@Iv$}2d9m6;>ZNV!)=#Y9;w`pUaF?I3AxUZN3R%>HVHanNM$o4^SsK*cXU#NZ4 zgRJXdZ?dj=1IfC-3?=Ja7)923FpjLpyb0h~_n%3$Yu`;JYw$H>-RI_#RevYAi}n@S z;$Hyns&=y3SAxSd-jLSd73#d=IEFfh9wqDkw3V#KlBYf13AUK`(cT$vNC)xiqWd=4 z>OBnZs&=y3Uk8VJZu%Bk=jpp-b~aL5jCrW@hxeE)Hm;c#1D`FhYuZAx?oYkQ1(c1~WT6Q1U6k57Ag z-UkgoBzmrw7EeglczTep6bDfn}8(4(z8$V?A0FE zdR*`ET#x5_+~9Ge$4fn4PG+Yft-#Cra1~km@IlYMmaOx?$+JI9*0I>&X&xo3pG_Wb z@pv0q=f+c>eTQe?MbWKA zKM5RiaF81C3O_@VbE=(Bi3Vqc{Ph=yz$*XIMp z?)N#%ru&PXY5gNfK-H6`eRZT*?e-0 zV$~0%M&luyW)$rj583SFz~PN}L%Ins^TYX;{ zw{I05O?$O4r&>5ecpAAznA!16;X2xtIe(1rBiD*%H9jKcCfaWk`=ew!K-z>?Jj)^O z0>RD+i?kcBaJEC-eF4uAK8TO_cHtwmYuV!-b4)|ka7>N){kios+4{#_mudfWgWc-l zc%`}1AdyYq8ysn0@qU15$fg-ejrOfu+vkZNt}UT5*Kp&J9+!gSFX9bpEMDP!hwePV z>}4?7T0ypY*{!x-k)WGg$7cHQsD zX6Mv2pAk5`8*fPc@iKO8Trai@?@#V`=}${MWGlcZ8!2Y1{5qyMS7e0oMc$M($_(+eH_{rvz>xQ-WGC@7|3l23JbM>#nv)BOY(Dw@g8AgSVPi)&%|L3tA!WI4#P6IT&Jj=Q!PDS{FBW;n`b^*%=TrnX&$5IVZ0&jz{~2&2S@Ai zhSV7^{P%n=u}`86!o~P7`yjBLFOkjvP;m5Jydkl@c8)|gO{r%mo4t~DJ$E9Ty^eN0 z&mo(AKJ9v*LpFOOINXRgB-dA;Ym;HqxW4*NXLk2RW7Rjol%61Zvgx*o_-(-eViOv&blYmOa{$Yvh~jyT{* zqwuo*i)@;);OKjJLz;kB^nHi!oZQx&n_x11HQ0^?WV6qqU5{U6vu~lDZ%F(w`(Ciw z$!0$c#((?d68p#aD47cz(#v>-TOCSYDZdU=q?-4@wkDI!KkqGDpYWVBd{X@IJQM$E znoB*X`GK%I&s3j0w~Up!=AXu&v2tE6e-L(GNv) z3pILNBb#O(?b^>|vo8QgKa#S`z!v99>h+qPZ2Gm-Yh9bE`Mk7+Y?|%hP}{=$&+${@ ze-~N%VGr2iAzRsl)I2Ww4)}9u z?wD(H(x3k$k)56_b&<_aDL8so%8n=R6z2Rl|C2m+vHesuj5*pPoR5!mx%elW|1O@U zfczZZkc#lKwv$cY8yu^qpT{9M`WfDkT%S}(UCBO)_KD`K{#C=+(o@6_*pYVpX2e0&uHW@Yz zr*Hg*GrR9D(>06=2`LB3GD#FY9fo%E`aIBhP9$yBI{)RWC9(Wl?9v6edxABI=ag0^ZaZJyW z*vM8F$1!>bZ%EunqEiloYJAw*OE&!+YEFx09yK~A$);Hi4*wyV&G?A^F1!UFvHEv? z_)oFBx%!?k`zm~2xBwsN*%C9^{JZw@;sdESUQtT84>)cmJkVpdH OFN>LMKBs^q zE$ha;jrbv(hGP`+L<5O2#O;LH&vu?hHa+W&+KYz${J-9J&XKa*N5T&XFQp&7HY8hJ zD{0q#hivvW;OJZ_yA2%j<{Z)vyy6bRhr#LFrJu=G_9)omKMoFgk%#meUa`i*@k(o7 zk*zHIDhfro2z6i zTT2a3kdfx#6@N&0KDoQ_VsOYCen>0uviVFlKkLEKm7?MPp4J~LBb(+aaNJ8YyU1GC zLF%=C$fkdrcAfKNvvZfWIZrk_cezkw=5)9C-TdK+Ka!h2v9Oyz#ljMMW?zMUMSs@$bB$8hH2R3>Ij^EY!h@;Ta|5#Jhk5!j)aZ2$*)+FM^HK3r zO-+NuPc{wvFdi%#&OK`**)$7i*Y%BTcJ{5s%>5gOd0axiPVB?L>BUkn z+3Mv!9*z`^o1dz8eZEBWexG-wpB!_;?H8XEKRkYgyud{ojaT|pS+;t|!5;A@9MU|z z!cPm|NiG#$3bwgHwz7}WzD!~xo1N=}jWyZqyTFmgvj-e2@ALFz(;x9P?Wxf@Og2pj zj>bxyUBKaIg$uy3+6%!J582APzPds5uCK-mpS7=4QwBfb=S1)3lHC*V{JS-Fx%7{} z#y$j%#Y47u+}f-DH^Lq(yMESv$M0uIf-W~o3}o}e8oQ~TY<6l|(s#|FXMaYM#D5Qu z-99*3>_cG>%Y@z9TQ1B#43*v5J4Ni3u-iD2Ew*ZKR3VyLa9kxk9~@2e1_9aZo4`?}l-&xBZx-GGw%GR5u5El798D9=tKjtg;*)GX-=bdqoTf&{g=`wG z=h1ZW!_y|~LwbvD75jPMuv+*ck2ycX8Dj56eT}f2tF^)-sJTse6gXB*DecNPk?TaW z036K{UP`;xyUODxkJ*ReY|(E4N4E>_CaeEF;8^WE)`#_?IZB=>%>Ink&QnZ_ts_}u z;AxyOPj`%Yni9{!8jCw80eLPa1>!{axMK*m0YVH#MoExSgo8~fV z?iP)k8_L(h9xf0&=R>$qcnmmh6y`b~DwmNLiJfh<{gG^S)q|tOqG7vYt!p{;y4I0R zznS*0OFxs%{uDS`B7XLHe1Q5jq9>c4^T+lnve~&0MoY!dTV##r6xd?perIhAsaYm^ z9;1!BfzxZHUb6Y`N&7d%PByz+>%J_0xDQ6lh1t)M+S$+67P6IfV|t(HIgX|wo2C`* zUl$G8?2I}553v`3vZq8Sekn}o~2Hr8a*-vW-lC7RXX zaGmf&v@36-{o7*am>Tc#nB!~qBjkrgf6QZ!WBiENPmncEj-A6?IY?MABn`SgP-XNMW)cmJt$fn^v|LD7-xd|WPL&8(=VRMpf`a3;4 z+3cLA@kYEMoo#%h{}N3RbfI!YeoXBBz_Ho~(*8ZMmw0v_3(}8CTgVmz=V7!-^qd3f z?}>(Nnn~1rUo_Lmn}w^X*Lg)Y{aV^}-zS@$`+NMjlx+{TzwaQMrX$$?zJqM`PT=SX zDa&;}-YQ%GrXNO4Ha+`_erP9~Jp!jU(F%WfnVo$YsZX~*ZWI4*f7CYm`y*qE_yr5n zMRd9vA8gTq5o)~%DukJ0|T*tdJU+vB|+A0{6b{ZWsPlYc4p z*TC@+;WugjmGCLD+5?!ZE$zYK3!>rqr`bD^e=YWI_%Q!PU|U1T*2ZFRbO3Ki6RFuI z<4ZQpG}`qXm~3{QdPXne4T-05;X&bfLYVuDoimWl&lqs@C(%rxM*EX&ntE{fhG-hde->U!J}JDM z{1@RB;P_2pjzz5gxqpRfUr+mAMZ<9k-xA&jPCq66K(-hTQ=|G9z>zY?!p_^trhgr5 z{!e<$ak2g+o8I-++Y-ZB`|2IhoVBk`iKYSm!@mo=zB(=J`syFTuCLw|c73J(U0N`nr7!`l>Da(47(CZwb9VEMR+EwZePgp5=>L z3-`fx)JAw9*!rJr{a*r(+lt2Zzph1O({MeH+KFa7IK4yKPBzU{+Vvha+3bzrkbi84 z#Qu-Z5ncnf{eo=zhrv+?(QKeTPk0mcx{r`ezaJcaKr~0m9fe;dpDXOveD%Y=4V7DA zIOFp~(*YbRbImvIOg>*Uy~zAyK_ss2>1U)L$QDn3aD0JihElISN71hJmU=uEoZcyZ z$mVAf*y60FM#qJ08lE$U`r~bj$!V!~B{=RRyw>CWWF1G&pIme4BG{vgrEDQM>@3VV z6J8?BwJYo*JdWH|nEPhjO?VRdQsGMSWx}^m|3Tpev=<1kqFu}K*kSthU^}*wt?iG2 zqsyi2Hfo-gJ|vrF2Q`JF*-h4X_JVB=lTFWk*5)wT?C;X9bB}Cx&KYZCN7$nxsmqs8cG%HBj)pJiZ+nQZ!6+BIgf z*&hO1Jg)8fgN)r^4+n_EBuHs*W_3=oDcCJu@9!^qr$^H&1i7?XVMn3 z#lSfb4Ho@Gvig}sy{^w>)7Q|hZ6TX|1=wQ92S@q?UIpZji+}ciR3hy9e~55D*kjcU zBJ+=-k%r=BWjQXPYD&TB|CY9pErtoye?rPK=1BcapK?*n`K7t$88`MH*Q)s%qaPfJ<0*LaMl z8A~1`8tyw5GueDjrCr-gHv2{3@H0}j5FCvaW<23%g z$Nfk=SG2NZ(`=z#%aYChG}!uQCpB6x*);oT*Ro`@9|FhPKS#mgjS|D_)Tovj!YhiJ#5jaH=r-ExcLy0C}45F>s`O9NcBP*vaPqHE>t8lg<7nIKD;n zr^p(EJ14wV>;>qnuv)k$S?%tetw!v%w9gct54Q6Mvem`&v{3bH$m(Yk^|ex#Z2E1~ z+$MJ3#tQ3%dAlcFD}75gJ#VR)o|mbnA)DrPPs2+=(~wQW%OUgA5mlz^q%N{)c)A(Q zka#Y_N33!3v?iP-b{-BRWgf1&)Qg>Let7uls&=y3xxB`+@rK0RESw|E=@{NF%pniw z3NOHi`6rv7#bEPKHv41X@QZju+De`;{FKN0z&2OOR`v)rU&0&Go7Cvokxg?N9Nj6J zR=EEf-X+ZcOU?S6Z2Hb%(-(o`2GK{Jo^1Ml)ZZ-{{vLC*Q21Kv^%+I7>G>PXF@IbH zX#(|&g!z9DM)QOxQBx^A4Q%61Hb3>?kR6G{|Hmt0XCp16Ui*P;`jymZKdf;YnM-8T z@c-K~&10U1Y?`f}W~Zkin}+}ImiakEjm}%LXiQA9~QPYXys?mx_jLWd~EE{n-GvzUAXA#(W&aH22Z2K7m2FOnerC?O8jr`R@ge zzATy|^1Z^&exGn3+P@+^5FD=%zSiSm9`pEXe{Vvzx+Z|buS(fFJ?1eqTq*X|;OKr~ z9xKCD!Vi-l5PlRKuNLMpG5nhFcJhP5JIPwtUaQ!VP5Y!)0LWL$a0S@hJM1=+{!C zeMmOV!(i*fN6G6%zlHp5;ltqgVd10X^}@W>Yy1Y-{&tLP{@(^i8$|yuHG0lNHceY( z#~Ve%W01A03)tF4Hhm#D{7<|g4WdTdMK;Y)aP(c#3?u)SFpo9q&q+U%P0v%GNc)z@ zo%9Q$A)AKFpJ{kViyp-r5)UouUyGh>`bKKh=W=TFw*ttf;VxvFHPqm|WYfF{j#Sf%YpMEg501VkWzX~M{J#Ng zjL7Dv5FCC-^nx+%_sz(r;s4hdu>+8J{IdDO zaz~)*JUxYUegZ(hug%DtLq2ClW5;A?0hQI zr=4Sy%@41|>>QhH_6BhLL-E7&{O~E^b+l_;57Vx^4Qz3e&Cf2{C&^fl&CY9q=xOnJ zh?*~mhHRP_srj*JI$&)HcL?)3DEyJ|W#ngsdyzGsVsNbXfu4OB?OL`i>-~w8C0o5c z!Qr!FcVoI+cm(Y~6&?kSl-d9B9VzE8N3 z{NKXM$@_&LB>!A^9r=LpCUE=<;jOf5S@vysQ0(m6@PCAllMe}>^!POSd9k-gzuCDW z+4?GE-yRkXuesu13iJEB_=s?CYJMf`#zOm~gm&do9!~_@T1U3Jcx;Vd5I;PgTFgA2 zhQAj30x}m!B;Ie2HU0-_|Bcvrth9D*Bp(&~c8_;}ZGRzK47_(#$6I2fJ~9s#zx$X1sBZ;svbA)B4YzF5oNLe>~~>P2Ul0YsF>Y_$4XJpGdR*=T9)$afEDTc?hw#kj>6pD(RErhivvcY1eye zWV0`&UC&9#W?uoe82Biy@jB|Y56PzA;z>)evX!!d|@zV*MK1PfD{j%u`u^n>aBQXYxpKO|e z;OOt7xrv(7SvJj7YW^YiT57b<$)=eLj^7mxk882|<@#Ze~OhXW?FtH!3f5@gU0Y@p(l!8N^TqCis zj4Q!$Yq4{TjM*pFpJemd0FJl_AuYwrzE>riW;N~FMzYy?tT#K^>^s1*{wLst;IN(e z=X|rdO*Xxod%u%8w&&0fFKx&Vd#YVQWoNv(wMAHo%o-6F?j?|<@lTXd> zMME}?Yl~`%JPp}2+;_|m&l}AT*)-Hg7fM}hZ>T(&`up&PL^k~}aKwu+q)~X8p6#{Y zNFkfPjCTF5hivvnaMVTotf1x(ZSXFCBWap7*p9l1rU`8R$)?!=j(Ot~X%k-IrNX<& zJQyPFC4W%(AlQBblWcxo07n;#=0$K^Ap9!zI=9KDe}nqVMe{cG8pFHP>oqUg^lf+^ zrT#mTdGU(GYlrv};fu)H|J}f0cd_%_HB|q+j);_b9vc^lW)L-32)pyx9>ODN|Bx{6 z7sWk=$C0lTotjWVYla{ z$!5O@99=E(boR=UP16l*Wyxmm>FLR4k32ou?A!uI2tH^&La;J<{St= zD$KEt2MeG|{_m_& z{$DcFyFU4Bw%+t<(J%(n6oKP$UOYDl_l7;)) zo`!6ianxvC<2?=8G*fBU;~m-T9N+Lp@z40}IYzQ+iowxD(Uef5=lNvQi~)zA7Y*wT zZxWsaw)K{5`f1?k3!Ivf+PJ8 zafX4rREkfsX*f5!s-0~1Qn2|Xn|%Vo+_HfVC!eH z`B_Je_KEAmX`*+1I9=HFq1s&^D*r$2L*67n`hVJo8fO{&w%CWaO1)?8!)no-wGXu} z9xKBd(YyYfDeU^QR=5b7_%>nor*Ut_scRb9#)y3q*JaCwyorLuvgz4bHa+KUG)L_H z!SP(-Yr)|i!XwCP=eiWm6Z<63&N*iK8uAxKQ}5a5k>`uOk*q$Kf#WZUeFa(VtEtf# zIQODEMe`V0|D&YsWYs(kjvGX?8*KeUw)P(PG$+6o!%5l~NZI$m>4jOgvb^7$PURsN z<-lg|432IWeNV9YDQS4;X^FDBVx7fR}E?pF_sC}FxSLP1+2??xd&K8lu=ymL zW} zU^~{6t?WM9TgluYoBc)F^?nZ7?61SGAMP-ii7Zq9>cZGxcgGo88s5GV4FQUpOBc~&t*JHgRIV&_^E zeN&k0Po(}iPvR!AH<8sR=ZwX$!DFsb;kQJ;#j|e*$Lqwt6Krb~+1h)Q8m)_S!`k%* z^|~&RP4CvLHZu3fW^c>6@u1Yj>wWXX>;3e@VkeuP*Z%Rh#on9z4PiH?>xDUg!tV&X zF;#YBxK_xmYw!1jFQa{vFxwk{U)c47azAR6hmkjnW*qr( z;WF|T;c4V2gsZ`^+TC1LW?M|p_{}Hhr}280)tI-^{-pTi+%w)qR?Q)gUjtiN&arTt zlzr1_tLXbtvt4*F`G>+Iz>(@l)2=+;<1%WV5`8W0 zPYcf_|5*4=aJ)l!Decb)uOROfew6$Z;itfnGVc-DcZFn|11){;xgVNXV>k~JCE6uE zL-Mo2oxs+X2yFe(oBSiujH70^@I-KzpJv%&m;`%QwUf#a*82JTZx1au6*c~I(zQfb(^O)xn;ftc@K5NW< zHvWa!PtkrOk-wN}daCl6Z=M1sh-7!MB(9`!JYy8)e4@lWk@=L`hvian51y&c? z?EAs->*D7CIC@L?5czMyhru>pe1yXK@HLO$^0*Uc5|7AL!Xfc=mCgy^O5$ z#~q{JfdPr@On6Gz?eBjV=6VvUhHHqi+xOKz7WU}0=qFM0uJBayKZR?&vdh8odtzTn z`}@M~xEydr4FVpQL*;GY_#dL#@7WK5yQD-twqoM-S|C^dAv4z z5%-I8M9*i&x^&30`Q)`jSGAMP&f~SUaj3^UcAK5YZsV~YPXb#%BeWo;F|+nmTZy5) z#~sPqSMFG&+==#9qVG)RLl#KxSd%AQfbCQ};Uco?dy-Yp`C$Itu}1xKZkT?cr+3F1 z^kjdd9~%$IuUKT@s(+jBBx)AM*|&&iO@-T;o%;%6P$ zejA)@8XgDj|3o93onswdC}kO2$UkmCDk5Jj?5+(v3v*1PON9G??LHpad=93ji)e;Y zqxW9Orr~(ST}3k<9IF3`;D~=zfmDW<`6pXhUSpbn_M7=9o2CIAUn+hUd;B2Sp64N( zev7AZeeyvm+Zpz#K)3*G@sO>o>z~U-)0-M?FWEFD;J8pUY_DYwuv2k{#2M9RpKeH#29EM7PhJU0*xfjbPGuLO8v~bUEUynp-=wE~ghS zCr7#IGcx6D;!sspQ9HSXtU6?SS&0tza&pvGTYhWRWKJH)s;6V3bB1ts z1v~moMIzFFDPV7x*Hlifo>_70!(eworxgNnBC0^ zb2^?;plEKcj<1+rI}JM`dujTd{djr#2p+gIu^;HX?_$rQ;?%3 zuZkSGv!>r%bM`3CP&AL>Uu2)Xb~h|J``F9L5w$xUZk|$TbkRJo1?tzVareKX3g?) zm7R6Rj2Tt+by!zh@^GdihaYW2W!2f*V7WQUyErXBR~sxZSJ`ZYrb>D^Q$asml&fac z*1MAnw<5cRXLgNS;%$|7ww&vCav8dPdaazUadA&(W{>BSr`Ocalb57bsyp~Jy*9RP0F|z^;(e!!QF`tzT z&Na09=9xG{pEhGMPN`>1M`>w6-Ata3ybN>??rXGm~oH010`x^794quT5ed-h7trlZ^3 z`8g_dixp4Fs;g>luAg>B@Bgd(#NMFSEmQ8OuR6n3Lh5GaWKlA(x+;d@rcXT<@hP)& zxL~K8T`>o<7^7W>zYsRvnVpN)$Ms~ z$n05FRy>ob`*)>WnK~(3luMfNQ(N_K`*G47W1PK+<$gB1Ho0e?k)Ojy^8sko=*4zQ@$U3)VYU9DL083)pT zrx2^ptax=pU?eC0szv3QGp8k=RC;%g<@nx`*o}Tm znVkBvF!1D6Iz1?^nOR>|eBGEEV(f4gw`NAht`6{->s||e>4d~CIDOW%WS5>PU`Oi` zWOt8sY0vGUd1j8%tim-ocll&?4i9ee&RyEi%2CoS(z#3eSvg92OF^cyDdV!}=Oq?9 zKg-`GswyhaUa+FPW^(0BcfTmtKxUSmGlI$HBtpq%oEb>&yymkVA)hf_TsduH#k4Bi zKgEI`6jxWznZXOvI^-v3SYpR;N6g8$R!&XoGAsG)8hlSMyP|$}U6s3$j4wXwF@fe) zD4oDp51~-_V0`) z#{_aSQ}^R!Ma}YZl;u9rLeaBiwQvBi6SLX)aw%6AdQ;X_%B$voaT|`YiLCh_Rp^6l~HmenrG%H?S?9MSwAaBNw>h{F6n3GD9JI-U9jbx z%#^}c8M#JT@~daooY4g>=h(^b1KJh z_fN$wu3R1A?B0%Vde*6JauTz16=`PR5uhdKZeX#*O|F?)Q*lO@{TsQN^A~ZzpfU?1 zS5n-0nl&Al206U9Fd(&hLg)Ho`YdthPS~ecVi@G!m0pfiPv_TQXV`Huj{&0HIwgB2 zkCzC^(M&A)^7T?xg;c^j3^QiossiP5jI+0E;E0m+oX9Q8MpWVMqbBuT@YetX{qe5~ z%wL)MvvSq&^&0XmQOET8gugahgMh!oM1Sp&Z~pcbG>>l_G7i&$CadSC1`vG(;Q=%E$eh>sl!1VV4e44+l9h&<)3V#E&3_r}@ z_o4Ist-u4we3p&=&c&zs`*OnHMVJtL&drkfTb%HB1pdk(qCa$P#^22ee^cOZpE<*) z`J0mPH}Ho+umkz@cL6>vzORE}%FNSZ3>KgLvSj{N!Qi*|6#VhIF#1bt9_QbvM0{oN zN1Y|}H#`wvzo)YE`9g>-KK@sTetc`;Z>~ARr}3WLY z)}=An=5xoE%-=r~^RIDt5In5@u7ue9ErHFCZ*&+0hiK4b{`fZqetbRmWY^~pLu>y2 zjKF+<1^GcxXwL9y{$7X9_je4Fpa}Wwzu5EF4ds1*L$O_x!{5cQ`~KSeEC|-BzpFfd zwcVQg+k|o>a`?LyI^SOt{Bhl2d{=w^-ooPG$M-h;4b9>2&(Qh)I%Cltr~dd%DDya9 z-o?xJHxTn;HEfow|K5SY_g4*nJZ>?*Yc!AkHg;+5Z$JFy8jnYy^Zgb4cXm7mc>eyG z=)aTjw*dK;EWT5T{u>5=jSw-ukKohVI{=G~-`=`TavV(h>jRx1-yZn0@%X6cZ#C9; z-`{rl>toLFY4Lp(I^SQ({%m_c=J`8@gPrg11pHx1%_Q^pYv_D`mGIXYDz^9I__X#e z#r*L7y$ydSGTyTBEribZHy{3np&d-={r)k7B<0{`SKk|2EB%&FAkx=ld)D zpCC915&eAzpUmU>^7q94`vOjG(6mf4e{UuB-;zVw{`)M{=5J%7|4zbRm?OSN68$#; z{suzF_-^q0El#wTCrdo8TC(`=PPBK$^V#-(&hz)fM0?v~KS0q;GJjhW?QJ-mZSReq zzn$2>7!D4HE_H*yb;|rOe?NlGACCv&?+EhQ-p}LH`mZX{-lyTOk&ZN(zp_MoYk!&D zKfVC1`8yx|@5eV3?LyaQlKJZZogZIE1c#~R;+u?5^EWgR-vsz;$au@P_hX6pir{aq z`YZSRHKGzfz9aC5qM2mz-36T=-&**C$;DTJPmAw^IREzjoq)d=GTyTBb%Dc~guX%j0 z!XM+XWbIvjZgbu1E$AlUdd+X|8_@CZ^DLRa8=>>t8~i#5N}*%_-3GDsUqxd7$iE!F z`;)`pq{RMF`eJsyn&tWX3)UwVxAkCfp^RHHz7x>-@h$yL5FCey@y+)99e^X>-@EYF z$DHBQ+WRx;e1FwPv*$y%d;U%(&aaAb@sz9o{+c+yS^<9%0%3f2c>We7+B>#L{+|L1 z(c=43qPpM0>ZvU#|9EmuPRvv21(4D|4u;H zh5}8dt4`=nwxAo3n5S<+hmbSL{QWf1f2Ui}eK*lByhzRE@8^l}ZQFuwe4^ftE$F%@ z>dkLKcW2mqo_2;V*E)0ubnMp>?TN}`*>!v=Y|O)u1$SQ1++QL5E#r=$$@=dO=zM?k zj|IUVou|v7HGlaDe~9ewRJ&ukif+Brg#k{BgavWbr)>ogd!;_$z{l`}sTj**?>C9~qA2$|ek2j!sn@dW_(Pt*ZzbX@ zjdS~3n~1OI^{l@p&)=TJdQe|1zk>>iOV)osNvsE@f6VT0>!7s$tI2OZz6;=wzhhy^ z{7r|>ACGD9$KRLWcs%U+yD70AjK$7@Qi@@5eYVWH`1Sl)+!F z>$2_8`SERmKfCVP;Q9Mj!e8~(LGV~6y6pb3HsSBY8`7aUak=kPZX zIzPVG{+zwf|ETA0EIP|?Zz=pW zOY?Unbbfp1znS&Nad!KNt=kK>z$9;bzu95o@ z=FES=05KF!~BEmNX-+x{lwNq^flkK_9ZynKH( z@Q10JN#^fbSp4{Q!5_NR#rKrv(O+F+{w;?;{+}F{%-@W}{Cg4pYS9Ob?`eoxg#PYH z%)f3Q&3#|FF){x}|08=HwZrqb9sd3HPJuuD`6j5c{r3b!etYM`Uz5hS)AP3`v0nB1 zc<%eQ4LZi0^ew;NjPzi%YQ*<4u@p!jYDl@)&Jbz!hsCobKrs-x@rpe-)3!UG8om!`Y-dKbg-(F}fzTaUR|1#_I z=Ha>bx1$jG{)U~Ca^FYMAJ-Z4cL{a|-(T?ve9x}2@x$Wl1fB2i5d0M(pZ@ma)BN#! zIp5!S_~a)e{XeZ!e8ePq%!BH2R(nEO^ip| zk-5+R#w5n$B>X|@;ydK|yZgfC?VSfv0rD+bd*?&vw|5{8s_K{sC;3%pZz1i?7YOsmy&_+!D#e_l4HY{mp^D z_T~gS!wJy&?X87B{`X{z??unwAS|A&n{hJT`N`bt)iu!h{zl_w>~ZMn?8ux+C89vS5m5K4F$A7rN^_cO!?D=~? z(cWS3SAu*?=I?Z(y$$eZ^N;Pe_-b%p(C@!S_`|N6N#<`lbSzV%IeWbLUWLv49YA5< z--9i*_h-=g{tkKmUi18Y^Ze%iHnh;*HPHF~j(P3Hsd*;8_Y?8G)k`oW)#2iG_2Ki=2(`)}Z<Wd%d@6*uv{kIhU<|3c-52tP!e;-PmKc9fVd32=7{1qn7pZTQ_*A@DE3!fI> z9f|c|>X;xnroQ-L{^}F!!4dc?fG_%c8#?p1ATb^zJ}uWf=Fo@XZ`mA0$@1S-l7|F-(TZ@ z*XfVP1o+#Ba%^u0&)-dn@jU{6E3A>w8-6Y^zC{J8fWO5^f4rWz`0iGJR&LsaASi(! zOVlyVPx$NDJr(SLo&L`A{1v2|w|4{lO~Jlz$?E9}o!{Pl@W-Fkqd$JnYVmz7;jhC@ zcKa3AcSH@qupm}@W zg}>bv96qg{^PuzF+vdZm%yU8f?Nw{KW=@Z;MOW%pk!4HAwBWw0E%bPPJK8n%5ha<(~JQ^nB8MltNdD z@|GAMU$5$UyV&b$S?4r8=jq1{Ts>Zf+~K!%?{Pu5?nQTZ>t6WPZruwmzqEVt)m^(sL%MeF^_i~S zdzN?Ieb3Nk*M52Xvi|oJH*Rd~**@L2;gY+De+?df-vBS|*Doquymzr}r=Ho^m}+W$ z<&aBTkN8Wf^%c)t`gq=RK}GEo!ToK@-s#!ibUhX=EO@3{Yt*~2Xh^r#SEjlxyz-f@ zt$W?wbz!d|U0Z)R)%A|@1q};(-hJtm;R_2>mp+*n=H0(2ue9&No~er9iQvh+(!Bc@ z=M_{0&j+xF72y*>`>@N7K0Eg=8o&63#bcN3Uvkk>t1Z>kK3p_>1aiCV8nyWF;)zQR zE*Z0QwU<9+ctyA#9$5O|;xS8BFB!3PO(s9%=cT)cwI2SL)WR!LmyLR0=`*RO``a|V zWACX8+U_sh*JJOfJ!5u{-8Ft^|7Dx+d8~2a^Lat*Lq$QadzLL8i@q{n8yBVXn%=ql znI{+Rcz;0KAn%_SK0bRpeq+CFX+^`c!GN|UdH1(%TTs#PJZ)jcif4n?&$n^yzH}-q zwYS}S#R#^%SKICdKL{$qXM_7Y+!KsnWd0WnAHQhK;&qw&Fe*9A|L=UH^H!j}HX2eh zqHc3fP?)K?aMAt@TQsScQo|QM&?e~BAw7O$s(bzqf^WBeE_kzK%CLjOhF-t<`od8w zN9AF}hg{Hhcj2yHjqQh69X8r&H`-{Wj&?e)G01ptYI&>m@JjrT6|bD%z4gOEYWU`o z!eK*F3mPuJt$XnWUAjkicj?~it6jSHyu54o9+>wR4_XXu$N8GdXo~M@$TGs!| zk2Usc?1@omHt&OVi+W(5Wg>W{7v{a2%ftQ>RGe%?pRlK}2XuRUQDX`BfHe1jOw5Jc z1G-`l=!#NZu?KX;9?%7QKo{%*U9bmq`3U->b=5cmB-fCM=5pafJ z58w>J9^hsOWZQBrRy>?JJrOQ|1e74zo^ao zV;ApVJPLE)O4?`YCCvH&F<#nt(ZeO(3%-lhBa_EHBDiOH_kynnsiw5sALL!ea{J<5 zjT!Ar3o#n^zj9&Fz4eyB#-c^t-#BW`b(2~d~U%nbJ{)HoEqeg3|Up6&dW;M%T1QB;d!>a+yqYYt2!`lID1@x0G zpK8j@zF)>9(WEl#&b3&hI}Ul0{j;Q9X`kH{4Sx%sWKE5%>45-N)buyhG#~TVqD?hb zl>PKfTkTKL?lRYIw*KOsZx((#qo7ak z;;W0VF6cR}zP@(WpsTLB8NYZndkTM1?5Zj&auxsJJFcypc?*6xq!@|vJ_t`oauP0=~aM*8!GmkCMkI!gYyX~=w?V7~)Ly7IViS6w3kK&K_ zjU>r-N#>M8ws~&r=a2BVhgg>Tlz6k(fwIl}NRni`$u_lp#}nH;pO%!z+xA{+=h{Ca zW0CEFiS2Cvv`dsfC()m>oz=^Bw!dV1TE@R@Z%Aw}NNn@EQIhC+pUU5!kjT&Wuju)^ z?WS+u{tvkL3oILddDcAt+(iDliTv|jezv``eQm~{Y|l$XujPwxLq?xW6tE`$aXzGErkHw zrf`WdHtGQ7fz z9J>AtFBaxnm1gH5kq*CWaO3VmS#M zcB56EjW#>?g%IC&F!7je`v}=$cp4ny9v&0ND=Z+%-wcG83m?ZvdP0`1>?5{Ehdm_v6T z+PE5~^etj1o1c2xSqT!^?DN5q`r#ObAIBR~gjZNX!Z{UQ;Sh(ee?kV1M0aUcf{?cgLz>xK^)=vqtpEI4yq0Y<jyk>r++}wNB%Wr<`f7`=qn;BT07@GeoxaYwA($B2s-O2x7 zAZv2nnZtx1Z_4p&&=zB+@AxB6SzYp%l}(=G=ak)#jaq)joessBKfZg0@?ZZm>bQM5}`RoG`JI&iwgAE0BraB+Y&Y&{ST9)=K{GEBLwF%t`)Mop zyRpqmW%nNawKS`eWfCS~NLiiWez{Ok{dWr}6} zOU;wZ@uOFkn{5Vv3d^k7mLz^4%LIwWP=z1LqE&w)j5~jhAF{IY`kQ#uYo^YWU#&t> z{GLZo_9%$Ln}YrsI;& zYDzR?3l7%2cHpTWFR7T<5wB7d@clJlgE~v*?~?%E-zl7vn?GKrm_J??`2KdGoE~DG zOY=8M%ak}Pp7*~%zT0Pfyo57@#-?aMvjv-^2 z#=sAYkN>5t?{7Z*Z9zWce1`!6{2{oR7W($hVtvi>$euQAcyQ}DL}`IfA`cO}}}9@l9{Afi8D#^3hD zcr3*ZwZWX>)BHUF@Z&oMC;O03f4q!i9`_Gk&$GSOXT32wE3s{fd3;rAy=Gs#e0_v`^4SbsJ2>kia6mZ>OVth=d`w9ZJHqpKd{!XIJ%pZXl+Y#b*RUds= zK%XV}SI-m-82FJs|L!vd^*GsPef{v_-qa0S_*>Mw`re+Gda_-RR}sDw3|O*b(U&g1 z3e&-l(SyEqfNTqJLgxFeh1%%1^5Q&oljTn0K@LS84La<-;4#XI2*nt z>s=AP5?pazs%b#G9j)EBX2`?VbtNeA&c`bbe1|1UDp;aj1H9u~FD=cI7oubyUa*&n zrbNDjvznl}1o_N!WwCt@wlBr&0=zEA>s-9z>&~gVzun(Z-;===!+YgbG&~Z}a!m=p zZ%gM@l~k;FB)DYw-7lk@=BD#5>`iMrukE|{=LPNiUeko{?6=~Z+o0pQc~tUy!gE}i z3y0smbLq~_iv}&W?;kI9_U()Ft~1L=ZfkqA@Wmc4j5;#r@YqA+4^BKVXxY|fn;VN8 zTmLFA*mzI+1B-%*nQ!=7k1GngH{F;Tzi2PM!@GOL*DzMUZ@|bsvvE;YRT1W)9WK)F zyNEPs&u@lX@7WbBeD+Y#diU{Q;qJGB)<10w7XEZq(0Uj0p4}3x%NyGE<+khE^?fZb z_4sSMgD-q#;qGBjj6d<8z*48QO3XJ7ID$o101Me;3Ps%hdPK67#~ z`%U0W1BREhsc6`UnDH&*ijBeD!&6OP9iDAj>ZJjB4R?K`s_)wygD2ZIwCOvWPfQ#R z7D0DURr;bEQ;SA?_uknH9=~Q&(0BFj;GY-%<=%6qetUsDSCPK(#?5v&tH!3 zF}E*HW#+}g5yM@}_?>k2JLKly8?Sh0LBk!lwLM&TsK>!k2gd9lyKns7iF+pPp0exO zdj@@ZYh$0r;$<7};S(4QclDivXKm19>lRhucM}&r@?5LdyKfBEJ<#{;b`i`QpV))T3h@`o?H z;+$aPs^SOuL_+uV=d`LQt8^s}p0z~ZHkCsruCa0zwUsG}Z_ER?ECTyv6w(tb-sXP1xwLTH%5kl3eDnG#qYjQ5`pM0oEF3)?r>kBHOHw;4PCn$ zbuX@eVegUshYub)eDH+>&7X%EiRZv}w8=gPHnM%*b!R>iGj{lsdBI&X?!|i>&WdU6 zEwofZdo;?~ibol1sy+#y2 z(0*sC>Bid@A6|E8{lUEl_U}Kq@9^Fi_ONZ&F2gf!?pdFaSZ|uOO`r8iU6+XjPy6I2 z+m@}bS=+Xj_87N%T-zJpzJBVc!=pxgvI=c$J>u>lwR2=}I5Tp5!Ui_Xp8KEZ5^P+9 zr@{VqL&~)zShj>u2LF1xWAqK+XB&-B=WP@X_7x8kv}%E-P_x4 z-oJSP|0a~FBl@uwuE3h-w{!jbwn*?U+b1*rWc%Gjeyc?Osl;|+Vmlk3_$x}}^ZPDI zlFxhi{`OOe?S~WFuP3$-dE3p~drqSLA8_q2wCZpL*j#_E%jfyFB-t*tP5e49=O@2^ z@bk0Jyh#4UME+ruYxxC?d)}oY)`RlTtPD4@!ocG ze;2s?9+~_L67{8Bel}j&9+uI|cDBD{duk%TI1C_m+fr*vYoA8 zwzKuicD8=m&ekv6+4VrSAIijYVelRFUp8Hw*uEtAmFDxg9zKJS-M8d=ZKRGZuR-(i z%+s&4&fN9f1DUZGefvcI60iOcc|8+)-Wy>O|L0_Wf0Xw^_zc74E?3@I{zmo3a`~8F zo;w%Mz(jrTsGtF5`OL#%uK@jhFrnA4AKZ5u`MBdSE0O`c$v>NVDriOWBf2R=iv=$6JGYc_cpTD^)%S@ zJ7{M|Ann1+H2cA(Ip{Ih7PE8RFh1(>YhZgu;3PR8Z%C){3V9O;iEF&o#qV_^+~;B9 zvkx(E%ph@{vhUJ6dwR}E`(B-Ep_T0iwz7jgyL%2oeGa8vna2ftj)2@(s&&7?Y(Cxh zz^dm|Nb7gzWYhPc{j*Y-Z1!tuFBLo4?3^=^euq4onsK5bn}#O)9)1#8Z{SSz_${z~ zFU`JJT z#_vwxLZidyvgki;;pZ%TkeH1T=%|H{1B)HLe?-5kb%-Thy_GNJ(htvDE4ozsB^JLU zDK|EWMP33d{p~FGND)q;c{mEq2fUkrr7wLgaBLz@phg@q8UWpmL;A_tCPe88L@Z(L z0+xRDJ;2eMaRL#G&hx+$PhycD0FIgX@E(_b_;;vp>=29o`;?pX5{sO5Qta?vj!cFC z#CuuNHJbTv;!iAo`5q^E!uwakB^I4>%1yY$BA*W&G4bcKQS1yu*s-Z93SI#&5rbpE zh10Zr5-u`sf>>-`PPqw-Smf&dHGbJ25i{cg<^o5i;{;lWL+mdFmh=*foz;{t#|cC% z@`1oI79a;$##RuE4y$;o@evGO+9+btp8*_WBLrH2BT}ZInkOjsmp~-?D}ZD41ggSe z_vgp1RARLjccfh7Ex1I@m>puV^DwaV;Xh8D8*u^=i_TNPqH_>f#<>uS&QVL}4dB8! zPN4r(KCl2mDj#NR%(VBK4=iMm$_FzRkI(U#!5zeNsiE)3Ui0B9t@9`@h1Y1j4;RT3 zVoC3dz%iqLf;xN%fQUusEnv}k54dm^P9*M|S|1FCkR8nQcnA!BaC$1)uUd0kZ(Xl} zZ>7Zk_p_+>Ida07ld%)M^!FOA-p4xB)UW22N@{y_XB2}tN%t!@fND}3O8-|z86-!$ z?{NmnkvF>@FV4~4?cYm^y<29+X zKS;DA5t{$I5LSp(DKn8?yo<>#!%kU1?M7%>%IQWkfx%86IiR z?qB~m$ZUIak-5z@WJv724<*}P+c4d~PJ4rK(2e=D3Wsg)DD1@`6B2tXAh7LC!*7uS z$Y{^*Uw;6+ZIAuoZ$c&{_V}!_?cD@>S@1}ENV*@t?*ZHPUd0XYK4d~-?@0)3dsR7l z?F8C`Y2V&)VA?CjLFz_js?t!M>Bi#_PP_^gWC_w&amxWfk=BbV^~~#^5{cdrMAYsN z=Y39M{79mA2zrtx$```ka-^B=^KmeZxE0VJKIJmg6|OF4>kpqeb=owofA%@{M-d3a z<2xv8{~&PeXW^XYS=ampWWQ=gDP_jf^4eP}^bA<((@mZ?Ii;;=)9$vG10|co71mtM z{ku0M^-*=T%sxCfv|lWvw{TlQDF3NRq2^cEzf$}=ch=*G>k{?vs$RQ|&5s<2To*dP z_$|DqsC{418-bXyFNl58e+oSan1{sdHpD)JXWjqpd7KI`yEhZox`m44X! zspBs92*vcj$ha5d%6VP`aE-EY0};#nX)bV-9zeM`M2;rWpNBIVIEpr$L@YW5z%q}8 z@r$x?0uhT2?-QBd!rwYEKA=E+9!PwMMSni9%z@#(E^~Mo#TXwRAQc}ImK`5?rw)b= zV@7Wsw)><5UfAqcV!nX!om%Zyxvs9VW-VTP8Y=6sF>u2MS5fx5#D4I7D`K{>v02&J z*if^gsWIhCt-I5C^5)X=o~B;V3amkqdizgnkYhq^W}51K>~oD|`~&h7?X*uXfU)P{ zN!?=h6Qjvhq}xEl;394F9l)+0>$#BVZGeDncHB5{TomgopXrPb-3HwP{#xB&L@n_R;_(O_bjcp5J2Vj#pcijtH)o zmRzP6oiPv3vp+YdOx6R*&i>pi$M-UZr|Zmkw0|LwPanN@!hsn%-SULfPbPV0w&qn} z{?6&aiRIU;=WI_+uG)Z=WGp@Lt6g@tXO)Hahi7sHm1ui~_jz1fpQ!LU(-1nAL2RGV znN@++1{QfU+mmgKC~LopBi@FDljQ@;5GuxDxboJWZkobZ=I2&J&&>s$g5K=(Ca16b zu1t?(J&3|UOUgR?F&)2h(%(8hNMUm9)9I2$KUvl~8O-b6U83PQ+;yz&65$)j+cOqi zdEm;6xclN_%M zkI348RWxhAKURq2xk|7C&v&t=55~z=49qI}M*7SQjI@O1@Z<-t+Zx7Lt+Aod{?3f2 zF}h5T4QnaS%1SlPOONu>t%@5XyA)Zo&i(%Bt^W0P|MaadxnJg#isX?i?@d2dZDr}Y z>HNIy%IDQjm5*JB$F}P_Gub*G^4p>Hz1+t-A4ivkXC=1v3$5=ZU(Qu7`QqyTY5b0R znlBoL_&e@Sz7+VB?j`dX4j*>-eh%N?8-bUxJl|e_$NfCz&fhkg&U4()SMK~xp-J=n z7AAah{02Mvnh*2`JNAbt{ai7JuS3c9qRQR;)Ph#janE+#vmN*0%6)=wf4Jj*f#d%I z$9w(BUs~_%AsAzu>r!QSL$hk8#}d9rt|4eXQd?)^Y!$!;g3PigZ2Y`a$_mblgjodys#nj{9WC|76E~s^dP@ zalg#rzohho`uruw{maTd_*U^{$Nei#cwcec%N+MI$Nfsj{YuBZLb;dt^}WJzzshmH z%5k5q+%NL|&vx9ecHFOa+^c_gYv%KabM)PFLKC^mjhhO0ErW+Gdt$(@WUTg8m?bi)XdTwyybE9$(>i><7`_0NdxIZ-?=-=$< zFLU%YALuW0^edhCRXXko$35Y=S3B<2j{7RdeU;;0quhh^)j00AI_|eR?sdvNNMD`f zzRvNl`9Oc2qrYD12laQo16|-eL1`iQiWE zT{LX;(-fcK{oH)RL>C6!!`}A>_?1z8_uOOL`Ms9kJ$E?n2lzn=q`$lN_b>^;CkFM1 zac7&xv68DD_X_j$0B3@8_Z~sb|2-j z4_1ib|AHqFvt=k|EdIO6FU?=%VR>#v+W!~4x1IcJ(a!4o_E2w(*J$#KVwzr(s06$907%Z$@*dcbRvKQ~s}+_~t72FM0p&#J|DZU)uf4-ZsNSU8Vo2 zr26|6?`0?c!%ThA@h|gA4KMzGl@$Lgy=$HNJ=m1TG5Rd|;=oz0r~Z7~@H&6$yg5$$lWlnIf1OwAxc^hq z{lDJ(z`6gklj{EluheOOcO&0PI{%uyf6}ZvM{r)Bl>XbjKX=NP#S!h$o`|L2jgsj7 zTF$e`sUu_O`5qeGOjo_PQId|S2dsb5ElNf8-G~m0LHh5MO;b@B=jel4pEyb1+zU$I z)Dxw@t*5@yVMh#zc@up|L4|FbGPa$?5`9?f5GUzyPy|Tn>IlmP|9|^GN zFuf5o4qe%KRO|Ez%M5Z*I^XQ6!|EpMwJDvho;oT%W3*i5|IPqQe3VXpAdl_}aFWj0 zKpuTOz)3n6Yq?7M?f@t0T%zTw&O8}l(NXCt4CK+L0xUYTA1l&wrC%KAM4t|DlD>K1 ztNb?(D&O{KePYp9HYaPj%C~0%EIP{0)WC0aUx1Tz%=lsz)^j~|D2YC=DK z+i~MNdF*m6S8=#PW6Gm123YJUow$}Oo819U(wPy+qXz<lI;t+s)bavc zqK5*Uq%$j!M-K;BbX5M&(Q>}eM~?(JNoQ^#j~)%M=%}>M({h#eV*yUmnIFibuLL+r zXF(v39uKhSs5mdwa#d$u4RDgq;y@lf5n$0_IYyRfc`h!ZLo7NIfMaI7HgAK-Qk*~~ zI3hPHsMdXp+@vv+7c+7OUugW&xzNlHr~;0@juVJj!cuv-Oo?^7_eOw4N0ob}maF^v z%>avz%AZ6akG>UP(HRX4f%^7albSNU+4#wxEq2(aiYox1~h^uqur>D(L0qh|t~q|+S8qaO!YblhPzRSh** zk$>6k4VCrvxT^K~AgEb+r(XK6h(lc*rNp}WJ2`0QEVioes9)EhM)#aWv8L`E73(W+ ztzO1~K=4splc>?g>&*InjA?2OwTNM=l+f0SrkdJD3_Ut~f>u?pt!}7ntUd=-llJ_k}u!#VxHomr5=mdb{8O^x+U7(4^q{z=e+P7~z-_`P$Nj0peYv0y_4DD&lb?e)bsaP^$ z#?BeXsc$PDBSs%4WWC9xOseeZ+_ycG0GZ~KB5mT-w;h!PQMIik zIh@5t5c!mrdOEX#3fg!~M#6HX8*0~KEU1hP?K?z{53O8z(q0>LHOZ-OOLpyK z+rPG{ZrQr}V6j%lv^Sl;EeCbAH@m4d`nIZyg---o0=7q)*^WhO51gW;VXxJ-mAz&d z?|741n87qF+j$^ zw$y0XVY8^pRnDqU8o0^xxQnE|mR{YA7!j9|KwLahuBNt_!ntpIrY1W}Ut7hp1uF3R})?O4prq39tq3Vu3MW(j=AG> z4t8|*+3St7tgRyGxtw@%Mc9yP%8gp|K1HQTalh*&$Jq!}RW^S9b;n>h zrtgDaU8GCt001$+8<8gIi+@ft=l~R4J$@Gw61~sR2V?6^gMzqGSMWbOdeh;SLj^;k z_bT)lPTa_!K%dG8;CpbeTaIr0#`>gVkKZ}@-AzdB{f%R<+p@=QNwN0=jN0i~0=MyE z3|F!DEcER7y$*W?aA*A3-6i%Oa_lw3Z6ppMvA5N+_laeX-I!wUD~PNezenMAkr=~O z>`jNB9lu;;UNPJmKX%)Sy zM8LMkIrOR0`yljedy_1C?1rQp%j0KgUu=6^*MQ%Tg(SWI)2a76deO^=+_u*RCRO~n zFO(g>C06{nY?j3D&wy=v&w)vGzujj1#Bn9vZP^lDaH= z>{=Cj^WfjM$MptM+2h`fc6tw5_Sg+8_C5l(?Pa0>aI5+x<-smjTaRl;q|)0D!?xZ~ z=%uR9FF?>7?=KyDANFGJq+^e3GZw%O%l9hFUZ>L@#1Ihmgd~0sI_<$E%ie4#OZ=uf^>2PJ z_DY=kx5Tn{wPi2QdHy!SUaIoA5PFP590%!c%bq-|_&ne4yiacF#ojjOeX`54cP;EN zEZSS+#BWzG_Ntxu9klFSXW4ttxj*>aN!9-S(z!o=ZP~ltvNzwkKTh;w?`r4%7|Ns6d)l&BZQ1)5r@k!c#ooJ4eR0`@Y4R|S!i{an4_h>Kn3Lv-bjmAs8l*g@>y}xwq9RZ)JKJRes#Vvbvmc7CF z@nXmC1Ncjo-T~0F<5vZHQlHmZ_FjfD+g={(ZL0dmHQ8)?4_onDZ`m7+8_KrF-}R~N z4S=3)?>Wof2Fu3ZJyxgFCZ@27i zHRUU1uo3pE;4Z|t^B86BBay!gJ)5XQdJ}R4U9UN;6$SoMVQ>|_pCd8$dMO3DT8Zry zN%UTe1Z^DUBk&%;c@A`M#ld`mig#&g$uzT6in^R_y_CzQ$v$0YUoT}?o(@lcv(x)- z1#1ojd-_b@gk7OF6}9bdyRdrif9&$UUOlBfu?@TSeDvYq&TvHS$}+k7>)7=ve7f|^ zE)RS7L>9MmXR1(lXSmVZ+LHGGcW%L2Vjqq4LZ_l?Z<^?9z$c@lCVSzE&T#jDzd&k# z)r=VJpRhSPX_&vdfmp8IO1p(y^{z(MTcb@M4SvJkX$SjIE$~+#^R1m4Qk~fLx7g=q zbJhav`82QNM2EP^HFSzDKGzk^D8_C?(Tpyf)5i|*j;Hp8{ab?Y0+eU%m?L}la7~3! zd4BHf5O!z5>KA!O#~qn-c;2A}2NxeWu=$Ej&u^Ntc~3`C$Aq@@MPaXXQGu7%Js{Yv zW&iHBv~t8{QHJ;Z>a_A9EB~1No2`v=qnSCwzPGjW``O;U?fG5LV~3dq9ri9SyW8^o zR0U{UyS6mxlaX&@k&RumvUB8}tVK};YGWI{h{#F^>32I#X zF+VI{7x_I8>)kEz%MW>3PQT~3aPOwPv!qMqavO7bx6b9)kjn?B`SmPxs`a%DZ*ujJ zm8{2m&!~OYuoKwhSm*A{7wWd|Ea#44cK%Li8|TL|Kz2Nsw~N+y{AlM(kN@z<{&_!N z@UtnKa3^iv-8Q*89j}aEU)hRSFue6!J3BHXlTGbjuWEN_rlfsBo1iW8J5euN_K$0S zFar8O+W?$G|#erm8k6IKY!^sxU^yS-Q2gtkB@s1sO0q-(XR=Ms)w zcU$@`C-ZYJLk+%peaE4l2OmFhqOM%Hh_pvKEi^ z(q5ewxx&vQ?hTiBWBS+!!YJ>hldYYcviv=rI!BE}J!lNoHFai$BWy7;BB4{Ang7@i zI|6#qtSqlKE0VReeer$A?rWJPu?+23nx~)5_A;X#AN_eE{v`2#L-`7IqSEI{R#Io2G1e}o%ib) zq;=~!h(_qt>Z~KU{{nt*cy=f&E07>3{Zt0&Z8prB6ei;pYcQJy*b zgBw;XJ-&3tjeBmaWQk+HH?G2xcW~T+-EGl~_N<^pQ{ACEtvi(K7d=#7=C8VRS&zK{ z54Gu*iFb@&p2zOU3d)mrcf*|Yv71?*H%|6~RL%11VKjS`m)N!oZYQvxn&ggLL#Ot( zuL;faQn>^zD$9R!)`+Z|yai|%=Jc?Fc%Zd@`b?_u11kZ-9hzbXyt?)I03+Z-FO{p@cr=%2Xro)jvDfq$0q^u^-QR%8*c(9aqwlR8ApG-lM3b! z!_UBW<2Z?f@@^bMNyWv*Wy6OLFZ&Z%re+Oa@C!%YyKvOKj`p}JN!0>f6n5Q!|SiYW8aS^&CeAUJ-5mF=PCWwzPsiZ zJNy$CpX~p9<-fttKg|dEq4{Z!`wripcIR5jnlwMf;hzy_^z1UfyB+>@hvyoPnza6V z!W#cFkDfin$>|xa>`(Lc2RrUVl>7U>yXLzc{so5*%6EukFRJWujZ00Me^^+ofzXT} zcO?E63Sq_SBS=39pR>T{DF2Tr2~XO8ke`}opQt9yk8t<`hi|j^B_=%WKif;@a~yuS z!(ZTSV;c!t0h?UY;zr9Je@CA1!_vPizw5Y{Is8q=9&OS;`$B}sw+VwQ`7b&4-!}P4 zHM+m%@WkJ>b~uaP)JvX?3Rm|8Vl_Nuxgt zZrl&8zj04f;Sce?>iFlkBq7?9Iog|*K1MP)@hfro3mjh7eWgv>8|b8GJmn@%yoVyj zeU63sJd?GYmr#!1jwH6zvL5pa;26I7l2+r8eZ|%S$1*9^-^HU>1(^Mkq>VUa{`Y3! zC^HL0EINCDqq8aPxgSz&pq6*z5@p0e-8jVWVc_W1IDv>o{t9r64F%{`9J24)JHS!% zP#_k4wrgUCSmYl9i=97E=Ngo z-h((q{xGoYO+_qrzDc>UPb~6Xz_RDuQ`A|46Np%J_5q9i0$?dqV$q2K$1cPPGy_M3 zg#cnwrA&!MUzN3~S9V#~QlFUzA{PD2f#p6W7CEbz?2|++au!=G7bg(&IW|T?wa=np z)+K2Zh{f-1z)~NGMSd5s)CXdbw*kvOUc@5b0vyZ33G@&Ssl&vg(_6Vb4xK_1XH_ny zL3hhV%5T$%rsG#?G^LaD8$$o6a5*G6_HeTCgoiDstr2Ha$?b+3oLu`@m*NzC$Z?TJ(v5DSmbLc zH|+_r$oW1|Sft|+!A06$V$m4^EPMXt0ZSediw>)cB^G&{auXk7k+W!} zZWD`q3UJIYtol-iiA86=B_|g7O~A4b;!5i91mZ<>)&fg>h(*piALBqLP%{qkODsC~ zQ*P2iEb?u@;+OS2T7?scSajH)h|ZJ1(N#Esh(+faV6jgu@)v;%nK7V4IHb-Hi_R;S zoLJ;o!@QBYygVS6HRCKmY%z_BlD z{e#q56JXIfO1UX(Vv)ZJEPmglj`2$@I`2?!{1S`&ePHqX0kGU(#G-QsSne-kk!SF} zz7+xxvB*{1Wy0#wcJbv1q}s090E=I>Uu>P0+xx|S-gisYj+r`Uw`21dXH&IC>0vE=09Qd80@GBZG^k)rKC+e5gufw!DEDlkFMGscgtgUPaHcPCluSx9?_-m-H ztV-oAmApDph4~+PVoOpK6055dw=Tm%3Ye;4&vdcpsxru6Dqvq)!8GKgKrmlWEz%%H zX;7#7ETP&H4U;UYG@iwCkGY7RziUnq5oU{;YE^}qH+}3W$tc&ZLx!6*C$N)_HNiTt zSI>mjSJud;kY;rV7N_1N(g;u>tBoXi-$><-s7|mBxnZdT#Txwz0CYX5Csl1}3+B5hnvNP7Rf7v2&0wW^UCr z)p~u*`ILCkf?Ye+#J=8R=$98~bM>Z%A_!)*(>gWRaUxPt(cBHU*EA+p7d2L{sI4xt zW0A_&=i9L|X}?M4fz*X02iAoofhuxGQok(G)Norhs)+0#x~c&M7;Ke9^Q#)xHR)=} zT`VOns64gn5^ADuqT$YZtOfwx6w|pxU(JhC;nY>>Xy3^E}!sfwBbh%*g8$z0`=4{NbLO(0^45wP|v#qGTOt?GvD4$VB6jV7knnI$8X8Dy$;wrF2-;b zdr`;U3$Q2gJI}Jm@$j}iesA7Ffg!Q?Md;b_8gPx;TV!6Ngo`> zY-D({2Na@oR+4cVbGj$Aaj!7OP>;b#o6TJ^i#F-_7j6G`1;+*q2usY1wr7>4wRdJ@ zgo5!P0Sa}&-`7f;zRU40X@y&(le00NXgkJGCHrWv7}xH~Y%9sy<1o%D$S2pWH<#35 z1eP$$XumZ=r7J(T0BH(xLH4XVYi2@0@{_rVkrSUb` zDzW^h-sVghneqINhi7c;u=Yagvazm149k|L#@zAl^W<+RX_O*Ht+g?yJ2PMVEPCe5 z;IgZp+Qc1Te^A}o-gNKY*Ix75H?{1y^F4h6$FFdV=H%??^lWeBfc)HVcr6$Y8cCan z(JNAi5~s^U(J;sS4UD7Ia0l<+K1Sca%lCPk!!jx+xPOCDF8Y4`&+`(8&?%10v`0m9 z+}^pB-)xQ=%E73i9E=*u!Kk6(`9%}6^J8V%`4g_o#)!DKDVs_*Kec&6+kp0Hrk5Su z4f$Q)@CLN+^vBU~49|(A5o8>@V~_Kp4L{D^YGh3gM%LtDWK9l6*5tHaygxgALQ8h* zgtF`=q=4-)9{=i))Qkqm#lh!H9Eb3LiiD^8pTIC0uY(UBLmWpV&nqoT_b{YWeaja9 zsHM+0K)RdHmr&9A{H~-)^Op;2-0ybyc@BS*!<$bzkfwWljs}E#Bw&F0srcmjGR?CL zHEDjSu+aZulD+=Qf826s`uJT(llI>rtO;+A!*@7*m&3o{@FyJp6Nl&bbWJ8bPJDuK z68)U~!EScqRb9_h>6`D%&hws6O8@!FJ!ZKx{SP_3`FsVbwztG_f5hQ$ark2ajX;KN8GRzZ)ZuF# zezL>2nHwU8E62&0&#cNO?Y-_>*YD%^I{Yq&&$ezb`u`Wl{UL`BIr^L@lLM(py zyb{05sbe0P#G=DCM0D8SBYjK6q66rK_z?rdp!wo1Ghu}fLF`jtE5uq^<^KGOVD`V&36v#&zIkCiHonYcG&qm|ej04!sOU|u&Qrn91m4P=7S2O6`~_37e{C~kzTthlB=LvH)-UU084!GAR1-l#3G*r9KBiV z6N~(E;KF<@SM|`m2-x*-o~1J%I5t-6v&dx($4wSq2`pnWh$SrErxF(HXLLDEAY##J z1{R&oz|l&aK*XX$K6Ek9<{lrfvC8u=YOM0y#8c(D!79(0F(8%a2CF=0LkP;n5i*#5 zWh@Abc4Q$=AYzFRtKcXjCl>iQVCgR>7I_hHq506p_CfmWiA86+r8A2<)i{BOMTcb} zb`}E5xB+6(QRQO7T27r+IDwYq5S?0JsoTUN2lPUW6iC(Wi5jbXHcBd=V_L5A*1)rmu(}s&w7z{WFc|5} zCzg1scZ>?HzkoU`0xUX9A&MEDD(bMnLByiNa+mg>SmbvA$7bS0^1G$2g&n1Hj@_fG zgHA7KuQg0xW^X#O?6=$P(++*_(|p}mox*|m+R`a zi4v}&$DeSt8OK2?IA6cZUj)pb-gM(Lh_5HKC;pxTF2Er~JyHyZZ7+9_9#>9#VdF-7 zOJU58AD^B4rXnQaupi&Hw*~e%9)b4wvypDJ$FXPhF8;Cr3cw3dk950ZZyO$}wUE;u zf5M8rJCS(WlYEZB-cImB5)RjSqo25O_yqPiFNF5&{{Fu-_Qc;S0IA})!?Bk!G>9LH z#*g1i@NdWOL-36z4!lS>-2is{IR4@jxHEpNBa+@<8++n!HR6#fe!p<+)kcH(4YBM! zjmX*Y+X8#3#t-~0lJ z%J&&Kd=qjZ$%k(`>3tJMsK@y6r=!?AhH&xk=lgtA_BePU>XGK-pk6T<&^G8*X{gS0 zq>+(Ms$WffAt6Gru_xd@T+Eoqec>-Co|K_ z#Y!E1ue*#7VDGN<+fH7e`IEet$Nl4+AJ6;If|nNmaQ9}$rZa>6)+L*Z+NL622s!

^r$uPHukJd!7n^(|}MgBfoV~hL^s$!0V6I1hR`c^FA8(GPtTp!sA*eUKX!YVFx|v zx%S#2yW0aRp;NRmr~SC!BPl7`jrC&K_X`VOyVK8ueQg|{Fl9gcc(FpqV2sqb^GDvC z?O&eR+26}ZEPos$9;C0gWP7A+eMMRa;*zFwX0eqsj44MlsD64Zlo0B=t|HX+a=5hO z2OdX1jO56PPd~~&0^5lceaHweEB}cJp~UHLc$+(-{k*Kv$Q`bzASno)+FagpGSt=5 zJs?RwpnY$6yO%yQjM3jK)APNTys%m~WI$VK_+hVf^Ecw1;pOSUiXYMT0VA}J4ET6F zQ~L<3^^!te1KO!Q&kwbweBS004`WmT>PmOmveGsnEe}1xR_xmIup*K0yU{Cb*RGcC zV4a?E?SF``DSxAU&g|!BPnh%QobxL;HZ$$aJ*Kd;e{*K2izV}NcrWsA@8qYwKW2CS zzCA;BsB zADr3`_u;m8QMbcsVvF||#!Z;jQ}(n)%0dUGwApnaqnqOkWRwo?!yDFjoY?v5Q+qdDiMBSy}u2 zyFC~cgE2BF54-hfoq*9R?QeV*{ph2?Wi!(bCF)=DE?XJRyzSn-i}vYp7uHyz^hIr=zxs0fmzW^FQXAFsRZ?h>t6+Hd|RIB0DRHfYutwFMieLqnaqau&k6XB7Vdf2IX0M!cV$RH~t5NrobD#w)egta?m26@e z6t$r)XCzLKMIGIy?sK+oo2`694xLKiT`5$txxMHc>F7{vJrwrZ!;>GpZY%DsZDT_m zb;5S>X{;sEQm*cf42e79W!BQ+3OdnH=w}$ek%#dcc^JQuhw&Tv7{4(F<2S}&{KlC4 z@s(rp$E_bTbJKxMFK(W`dCCKO9(W2PVboZT+@Q7QIF4~0Z*?s7SGZz+1fw;^aTSz2 zjMd1)SdBc4)yTtGjWHOjF$QBb#-v{o8q<2o{#?W+e`9l^c>u zI@MC1J~ot}pF1|h`!kOFQw~5yah!QHI|o=r+i>RhF7?TzVgrYpZ>U+Bo2ac^yDAsc z6gFVod2UH@(Zr&Ox#L$iHr8*Le(9yFY8qEJt>CU^msX3HOF2Tju)bm4n(9Pj5j1k) zRH%I}D=99STs*DhvWvYkej`)^=Dkn>U`8a|a9e3fO-cR4WpyR>#mf>r-BpJ{>l5qc z{zp-8lIL;$W9Mm=4y9_TO!TYD?8Kfr7FA)}REYx3a@yYhW-dD^E$!!QX4KE`o(Y$sK3%b?F&qJ zmOkyV4@8r8x5r`7o#TAPo#TMx!s70u`%K6G9Ea!J98KDOy~F2N_Gz!#apya&?Z3m} zpL6)P9e$=`pJQTedkZZ7T^~~euLwp{U(R#*^Huui`Z}8DcTG*_JNko_ey%vdTJ~_N>72dWhs=Wm0{cao_=W*PsKM}~>etrHn6{33(7yWzYUyUQv#r075TStic+;2pP z{7;0zm3+0sKjiS&Iq~z0&iH5Fs1WUO9)=M4J%-WoJJ0)jon?{ zAKK;AH#aV^=+CG88k|7HB4;@jns8SG%h&~C(E-HDggk2!`7p3Ce&7P(C#6?t#xC%8 zWn>_wo_7Tf>Hi=WzYBpQ{NMswjziWIVYq^C1D3G`#NwBE$n~p9Z8&6{0kP<80gf@_ zK|63r-#@YFe2a2M1Vk+ICx9gmPXbH2_)RWiD*7A5LvaF~#4$2Tq_Nm}2mB}_Cl>jK zz%r)cQ((z+V$orJm2e}(gWw3tA?Ak`&`1lH07ph>`842>rf;5DY+epL%E*aD&gWRf zj1^c8EMqB%MQ1f|>>_QymKf_Clhy(k<|^p%`4=;o?XQfhAQn3h14qVa{U@kn8hK*T zIZT~At#cGu`qWQY`oyCDTT4zX@=q!Ms@N#7f>=***zDX;m!QjUv>M`@e&z}#Db)JXYQjd_-_6dA9GpP8I6}NxK?OKOe>^b_fMPhrX0e4Q5gYq#b434gVq-r}Y|>b6 z;aL`Dw#xVtwnc&$S~^QCd=s&W^KuJUS$MUDYl+RhP;cQzVkR1N2M)n^69*6Plx-b~ z$cs(D3B+uQT%w@A7Zh?-!d|uLygDc zO#mVmomup|Sj&k;z5uvzx|R>ZCB{kw;w=|3;}R|cmT?uV;(}E@EP?=J*FzRh%#34T zc1Pkkfp|Yg$`tgN)L2~OTX2yz26(SY-5{2D#wnkN6DW>DQ*Z3i=;AeEE9i6>*HJN+@3!|d)XBN3cw@?xil`nipdu<}7h8KfRp zpmM%u)mj;);3wL6lQOnTN-Un+RDIv#Sw=4~CZgi|aYh>0vFLkT0j;I>oTB?3$|-u^ zoumir0w8v}N4{hkC)uNGUiZis=c*g%+)jVM1JwM?P#(Be-4&JqO`IbBgdon;ta^qS zs4jdCllZ#i>fNne^hxw`!Diry;~+hQ-yGk>bu!njxb-yZ`-3@DTg?{50&PO7Gu5$F_HQG)S-A|NebM%(nL&?6KV!l6XH2 zVB1>=d$mwv{P=T_ZY+(+4SSbEiT3ytQS9*x&Y0kt29(+y7BmHoOl&# zWaYF-+?pXn(btO;^)3|#SJC6|CA+_z?E#7DAc-E=m5?-0z6}PmrtH{S;;x~m!qHsBOZgv}4~nKjftyN;{l(B<*0Wy-xvp zo4ywc`oBV_xMRg%z}l~xVHLe7m?1ttZ{b4=({89hkIe@a;RXQ;=80zku&|%D_-)xoLzcZ7eZ~z z3Fg}`iH|NHGIQ(9aaOk%9pj34k39GLZHRH5wp46TQ*lS3RUNTQsqn0n(L`6AicJSTgjnF*NplCeH_7 zd|+w!9^Ln8a+f*EU1N$K2v;PUAM-9me*P`OY0K$kSeY3)GN&CqhuOhS0~kk8anQTW z^irO`DL-#l4*Oko@BUeR@3&`dKQt%p>TspxRQlL*SYoO=2fXU-ZQt#+9>lIBV>5EX z;nK|Q9z#l;=E#j^^b;oP9|ht(bZXi&)H!dRw#IFLtU~$0oUaR1>X?H;U%MK~p>h%X zHdOSCS8^WiQ}gMcMegZ+BVO~0HeFo7(HP8+mvn7JTsy;)k$YZt;^aOrZ~MCPt<-TC~`r1@rH zjeCc~-|g_fwfK9@1B>r6X?PP%j!#&H$KTMJ!v4Hb+DyZnO0quYy&`@$i8|f{lim9( z_qD#e<{KS;kHbIW@Gm%gu{?C~rpWO5&ZRibcWBc3MHZhN|MQgn+e95B zIg`_?dH*HCxCi;K-TjvY<9^Vw_o>4lxA^4voUg*4;=60!d~$*Gd?)`0EB%@H!*E{zA-Qf{MpXguGUJg5I{{lz>s`L;?d za)uk>4@*!ShxjEHorRRMFhRs3&jptLL$)2#e^^2s#R)V6$H+L5#^RUtVN{&b6!Wah zw0u4;qQ3+yOAk0FGXX6Np%BvX4~u42Te$ekb;eO1Th=KF5!U z&5^JpeV%#57vTg_aXwC< z=W#^McW7eKKLA`>zW$to3Oxd>d(|lrDpBfGl#biK3pjV}#I@68EWEkRAsELJdk+|gpAe?$}qMmuYDUs+^z@Gj6{9{C(ZcGPB z^r~S@(m?qx*yG$jy7Rfr^hR)8I%(qP+lPJf$yWeQQtPf%xhln#ni@-}dY{ z1z}&fiL*DleiulB_y)ZJAIxTdK%mnzCN1T5D){|B?O>=Y=$Vim?qvt|2@i1h^|V8c zem<9!Gq-~Nh}K2tdGo?$E%{x$y&}x{IJf=QrT^lC*?K>C#@mg>^iBJ?PAI+#?;UW$ zTYPY}ABU-^kzC96ud3^|OgJ>|a3b;yW^Hg!ddWSObUh@(V+LLvbJVsE^Ae}Oi(^t~ zZ~LS11=hFT((t2RX~#F>EtomC0CVdCTR|U1sH?P%zBsc*EOUlp!10UsH@xK3F>Q8V zf!=jp(Oo@8*Q>b0%vDdiTK^))Ei`8D?dIxdfm-t;BbIs5zgd7O=Q${*wqK`$bFuee^ zo4bqG?obEsia)0?v`X~k>0^ejp2p1tV`l;o5iCCR?PlB+{q#pvrh9+c+Ql!v;4UDG-5 zE3s|27j4WqJ(c^xhgq7tFryW*RQMU*Pbke@-cq+TE0#LRt@>LCgj^`)~mpGfb6y| zXgMTzQ{~<*htQ6wocsRDA*=qF^P305{W$Y+=H>&NU)+>t-GMuiZ@N~or)|N)Tl^eN z)bCRFLm&xI&$_nfYTofPZba_(Q@P5glDQ*p!5wj|W6phV__N~txSx943NciEe>ZB$ zYi;n^&)cecTwyOQ8vbZ-wg2>)(9vEI#3Zm}hjyZ4fw}|Vu_1shb zgR57}JwA5~awpJbT=?AHadpQWKgS|Z`Z=}~Irc7c?8JSy_$iPWAe=>8Qshu+)02L? z$~+1}^L_g5&Mn;x;dsZq``$$@JmH5C>iQGt((=afWy}!!w0E2UJHM-F3VX@!{gnGWaYmm2?FIUp-|V>Wa`=M| z|ANCGvH0Zh`>XJR{OIq*?>yxm+4{ryoadxm;3sf58|u&xZ{3{ z!#6nmW`{rK@OvD7oFBg-PW+-Oe!=~r`MZ7pnh)Zy`5=EazueJ3=tw~lesHhp z^jvKs%zl%h82z}$@Qf4n$2j~`hR;>{QIC862vNVy;rXpX#{3gYKS3UF#Kd(R@W`ui z0uhVO1mICdPAqb^pV7HEfrv#u1Gv!S&m3Tx3rQ?GY-?ry0kIKI8%c*lMPN3yD zL}v}K%)z_^SagU*XA9-?aRL#G{1IT;E4~X@`brnzxEb`O9(qH=_b*{$=L@YX=0?Xd@nJ7z{2ShA7?1z*2gTx}AVCfT!obwPR zUG|*BC6G%#6d+vLE1OvS7BfEls0iY7O7fOibX1vsl^V%&PuR}OTpnW4UrjkbDuakc z&N?Y|m008xfJZLH2}CS%KG#PXIkCuDCuQDiIk2o@N-R38zB1o)A$80{f>?AIXX%Gt zNz5Azv<8RtG2aF(^S_A2FW(UghvEdlQDVevZyBH5#UCUxd(9b(a8)=1y;V&K9Hv`!V}rXRZA!fXd*zUM~Z=n9-b#A0(Z zu;Mu(W%`BJTo@CU63E;Sl)~z=ap#1bP~Wgi9;e zu!Ku2@?*fV1~jqAPXLR}H>qRtkXUryqkJAtAYze!2rT*e39ytqvFNDw$CSI>{)~o> z^wW;x_} zI!{u^+zZ5_^9-=qVSST1tp|Y%nE{|9I3!)ifF)hTV&^1q#4sOIrv@hwvFNb=$b8j- zd>%0~K*XZMdH2%J5R06@Kco&5i=5B0!a{9_RYcYYp9C!BODy`Vhq0+Rfo9++yi7q| zb}U%XJRFinV)4uNN7nmZP8}0}V$oScxw&76MgA~wJPEVKcU>j zfmr1H-XU>dxl4NOHiW-%CB4MrcQml9X-+J1zONUWv0{9;k@&0jCyu~D({M<+6N_J# zb*v005bskdJ7UpUK)ES9Vv#QeF6504x)+D!C$Z>k298{b6NvX*a zC$OZQSmdfq*J{6RnMyvhd`15Na3K>1I)+2y@D{L?BeCeePx%U*K*S!C_oh()gM<#kX5+4nN%>=n+`@~fB1;2;@o(!fC|wd;cMEqbqO>0~B}nUobZjrQOsYI1OsEj!zQr_^KCXvxe)=lb4#B}>gZ zS4xsg^o+q>sN_{uHEUOS$&18`mRi?dO-yE#H`LsP@l4fqb?a^m#x)_k>DG8>eYG6} zxj#_q>#C}kVIOj(A%>GiL%~E6-(x##4_Ye?o9pR0F_Z;+plQMbJ+G*#+SFnTBoyaa7^3 z!+j7;2V_EG&mD8Le5f9ePJ3Y-V($uI+ukr3cvFnwD)ufje&WXM9oQ>}N7};x65rlm z1Kaja!@zRLgv1`7lXiN?57T3|XwM!KRe{9Y_U41dUHu2-<3rX*f z9D9v$cwCI(D)tUI_O|4BUN_tsKYL6R_jL(M)x;0Oiv0Lh zKxW%pf(piOgF<324w;?aTtrOLYtNy6!m-ze!pcoy?>mmY5%_)m0%S~Y6o=&BuZ%tO z)56=8m3k~zf0Hi~?<^LoMG}P(NDx%(#ff_6=Z_MJ-aSyV$6~#T`;vLV_>n~KD~PD% z5#`euF49c***KUE+*%lmHOXG?`>cD6Pnl+x{?0x79^<&9v~Nf?pfxE5eKFU=5mm&eEM$4Y=Ysmd za^Zp7N|7!j!{8!yhiw}5q@Gi+3Wt!`$%BAch`;G<5;xX4#Luti)Js**OQ<*ZGrl=D z<52rB@XGj*#NLg-5?9I(@z+<`gWeDX#!GQ99? z>=i#hzo@{P(I3rdOG`u^=J*?J;iF#;riGsK*lDR~lZ@v`KNOxH-i)z5Z*vuHwa-1) zt;g!t2QYG|{GOTNaHt!&tMyQY*K*+1YxYig#rtDU>4*EM(S@Tt{ip3|ogM9I_vGwr z5B&n;bTYX%cBngCG3#hBrf+A*(RuCR7VQ7N4fDW56-SRr45pqqdUP+=i;iZVIJ&ic zZ~IGWSWBQel!Lv$r~jiHMr@Jb&T5_RJRK8D}>~5emlRRV+NVZ9h4N!xa0T6+8^`Bn_!$KLXb3ItW?D-*Mut) z%U{CiNP8W29Tp|phGpT@&WiMxD!f;&3GGkm)5Mc`z3oh3A@3kYwPnWBf;G5ND`vG^ z*)pSL7Dt#$-b5eFoF7g1B1h-7>~HTk`e^HGnO@8OqcfssutxZSZ8O9DmUJghANJ-S z-E)89bT!H}9G-PJ)YYDrpS#dYoUHb?%xq83FKF}<_0M?&Un#o3v!f#|vF%VuRz^U9 z{s}xExG#wipASvKsB5~H%x8F)ng%KZcP;mQPIk}qz6AFXzKu-BJxjS4`0kp2!Qodr ze9)e2{mUKqT8HO%JxyAFfv|XLGk(uG{Jjp(Z$Fx}{y|~kKRLYvls&vg8XBP9=gF+b zkp_<8vHjOH!11r$Cy2ArU*Yg09iHE~G->|}g*E<{T6}VR2dVfB^4&Gh=a{BJPW&Pc zKg8jOI($^w=kE_qn$Hy$Z=KAKX%?Rxzij0ml&|KCe0|N!^P6KalI>+X@foh%gZiWS zz`o{h@$GBA%Hfwd{91<(>d$cR57zy}H`!!{C2qu`!~0d@MlAB_z!EoN zku#nWH#^Quzr>AL^jX$2W*`q(=9U)#iydOo9}g^ch(#U)mUX0AZZc<^_g9QRXhDpp z^ohrTW&P)Q#71YnrNg#T)_-O@B;y3CsKXzjAhypEA7Y8m8eq|>1r|Gvz)}{(qQ8+k zLvaG#k3;g|L14)TV$pvHSi&V1`95IjTW8ggG9?zBEMVmq^@>>JgMg(EeI#&{HwuVY zbX1)&eczdo%Uo;LL+Q(AG9=E#;+N(m&cq^T9gu$QalkRt_s#N^{ijQS#U`=%odPU2 ziA5dWO5`EuEKP>Y^(r)Ju>#fXBX8dLTGw&(c2b%GZFyf$M z98%WA5;uk`_K8KV@}C(D8i6Bb`e#-Cu!4hVUu+VK-y&dH@0a;dXzb9Y%>5=7ecn@& zpTr_()FnTOMNXU2ml`LYh!bcQ4p|47_m1?F@;M>>p*H~+PR0qu`$+H_U|HAqHVgA! zkUruJ_X{k)%vNHOZtc3nt?bEIwxM=iBR+yJ!&lsO4R`9_>_z-myRN=^t=rc@IrgjU z*$G02`lg0ex_89y)UdiqsKLOi>*^ct^h0)|*R(b%Vy<(_*sBS*w`0><%c|d_ARPwW zfz_Y#tduKjYkd!#WSykJ?uVMnT72G4ts|e5B~@5TwlU>QZ9mN0V6CdMQQJczD;u%> zjo0@VkRZlMzU#Sn&W1+x(BK2RA3zN{ix`HAa7`5_2&>{^PtZDD%ypG(D_2#st0l!( z@}dQI*b_My4fyV|fhEgg9hE=JBrA{f3bDE{X3KHi?&$ z@IXJd9`9u#(JOTHcpnWDC0s?1O z;VSm#LdmxG4m@|mo$=$V2;FFpW5rp|(s7V#0r=ZohJ4b_=$Jlyq4 zUlGGbmpY_6065ia4)+F_RNp?ij;sCca~Ikd+F&|JVlNNrkhCiYM7$mc-7mwzbg*7r zI_dMRS2|^yOwT_1H~xAA#_;rg`G3CgTidHAt<~W?q#D;X-~pB5;e@O_C*pgPUCsEN z-)_rTCL~^Y*v}Tqg{1!ccmK}691)hdGVX_Q#Bnfftml4RpIq{}zVrW|{;dDk`m<^p zH(=@e+W$%|*W>8jdcFeXE%g7ldcG71JC}OSH{Pbkn%bg7(Yh6DERT=BwoRK72(roIJ=#_6^ptQt$Wd?a0OX zo<-;>Iq>yx`ro|t8GB#u$@z9T^!CP%^zG~i=?ri0f6Yv@yD*-@nEC7#Z68>+z6q#! zV|#efxG*izUg(szrrbtsY*yDSb6st&cbMxE318~U|L*H;pMCb(uki8iPF(-h`iQpy zyw~D+cj4On=bm>fuXtgho(KMRULVF9{k-l7V)bX#!^lkJCh|Hzn}6S^WFPd`*l*---*B0A7|+^eL;G(dy(U=?>7pydyqcOmpl4%9e$z1 z-(>OpO&CyrYwk6r=Q;d9hdp{zwB6%Xcp7k1}#%ku$8A`Q{7gg$DDi-%kWH+z@{N zf@m{j^l3*h>!M()hUf?yjYI6@5*s`0+)3f#YYJ4Yj?vV2C6K zL8^uRdVIcuBfm&BZJ>4Yt;&4jvh4Sv<$qOLRlT;F1BH7t=PRaCsM(OXt*EjQBaK%y zHC7{*?p8vnehcWwcZ#*^{xiGYOu_wazbA3L+(PS~7s&gF_-wxi_NLH_Lnb8eC{IB^ zn{ngt3>elAwzZ58-B`!p#9@cq2%c?&kl6bv1h&0Tz!X46d;Ezm_G*A_dk=zV+ae_P zsvw}BxN*pZ5s4q02eG#mnD)fqY2f)dgs4ZlABSykHSAHB@xx~<-yUxp+g==ux#i)a z^>{7BVe4@&D(^=j3HK@pY`tw@;-ZAB=&=c-9`AM1D`2WLRA;*J;9L`4g(gYDjX>N! z29I*AxAiU+23OG=31EM-VErS>GgtIDCe#k93e0>QbpHYlrXzx*0iU_+swPe;HZQpL zAVrP!dCDX`9&uvn#9}Qu`!|cbi*$Hw13517B7`2z><+h7$j%6SyX_7OhxbUh3is^T zid9qhz5K7wzWe+mQ@>gg>1@v~j%Mz7E+17ZKQHVJd};nm&;IiG52GFL{-iT=)m2!P z=nIh_FZ}VqmpRU>Zhii^A(8xo7VIPP^+K~t{MJw3e(l|Vdhh@F z?N4@hxBf8fr60}qT91zP(hp7c(hpa7=|5cLwf>~qOaF0`*LtkoOMiJgcHwx;OF#I1 zul4XtUiz`uyw)H8(o6rxkG%9F;ZW<#*`e0%v7z)IO%Amls0gM1WKpQ~NOh?7ADcpX z0}l*bky%=Ox3~NC(&``F*Ig`e&it$1Aq%d?o$xOQG~1z7}dd_RCP~Pd*Ce4LZ<&#d$l=Kj5wCS6Y2h zX!o(w>MwT52hwBp{_!b0H|#dI2>eZBZ#7mRj@vo|$=eCJWf! z_rCwU2WIj+&-tC_Jm>q&?980rJEWBNTs86UhIjgqh9CO(gdq=M%@MFZvN&EJWXqNc>3*!<7<0O6GQH|3KLN}IkH_m(mbQy_PvFAqqQx`J8-VXpeqljidAsP&&n{3_wu`p>!3A&CB%Z$HQI@}s zJ$nv%rq#6e1kMZ*uhutDSIZaeSBj6IC8%9}eaiX&5`p6Hi@k^T`G!nX4v&zOiPxkj zJSjbaO}#>yI9xi~5ZAb`p?iDxwi#XWsTtDVFy;I?A)l&{nj-?|dWGt}+_z(z^8VW* z;2k18F)gKg{Eonp2q_S8O>{M=_brjsJCMhVcS!rT$2Z0`1`ZdB361K+zxD;rUlQu6 zLa8-Od7n_6v@hcKwd$;grMSpI;WZKPERh0Ru1bNfD`H*MxI0qKQnO#}g0|jnA)nB+{b3W(M5!&ZqfS1N zFYUE=)F|Fa=vpiVCiaSp$CZd*ND~_5nb39zw4K``PWu)6N@@MJ>j&ffKdnuN#=rLc zwpKk=EVbH|Pp$|xzg-#@@m5XlJ8Pc2=K*EhLNomDKw+XE}F;JXPGQf$P%HFD1|X@5k1ZMMIlyyxwL9f8h#@j}f( zzghq-ckDs=pAsV*&Q+aLTh!#bk&RUMZ=tM9r1*$H(N!V$_@yTMTQzdQ9nyrz*|lB% z<2w}3NhzVmixSr@QQrSZ%x}2(RLfI8t9`FQKK$ptdtr&D;X!C9D3jt~zueOxGZni{YOP=2 zs8pm&%}*+x`69U{&o9p`kYEM6{ZGTGj{<%;2=p=Hfw@0A-25BVPqulcy zY2QGl_ctQ9A+RMMW76L3ilPzM#WYpy44vqfy1YyAJy$w)me)qdFXQ@@Zc5Xqs32U^=OTrkHAXgWOrzJ)*N#ok_LfscG{h{%+1&&7Q>nEIoPj>7xyS%j<-vPIZ6Tccof2 zT1UHRe!8^L3yV-g!_ZehX%|atRnL{az?C-fR!!cvMr0bq9mw~@<%lvt8s(u#Yo%W-+ZnsF+y7au)*j2A z7x^{qvyZF$)scSFO20JHo{uphaJ5(p^p*(q5VZFBVYA*}{G#H%uBPUus|^8Lr=*@l zZ=+UI^ol61mC(#V}( za~AbNE%sNampT629TRpO^as|JiNFV5N%dm&^2kYytXhv;b`r5@wnyuzS5H1C?X>;2 zIuMbsjlona${$eITh>Zt)p93lpzK-Us#!PrDB7n|-Yk@|kEFmNyChRvD*G|!RccGK zYm_aYO3I*Xh`C(!Zky0}X}Yp?x-?-&VAB$5|Mr$9b=F!b&el<N}-!^ss$h?v|$RCX{Pemvj|&QVC+F-twU&^STaW z$MyQ=dKu#>>Jux8IDf#mP8)&LhCS%5U0A#1ONnU7-3z`{yH&aCnwFCY2_sxVx|B}+ zJJKh~Cl~80&re#!uzAaN#qN?l*ZSr`XPQ*#U!#}v5cJ9SKR|EwNwLW1{H7UAX31jh zaf;@&cWRVKj2Bod%2;_SrG7CVbCP=aTHiZ$G*9kq43yiE9*^C7(29R7?TnmPbMXH8 zJ7(-qG4o(v#2W7)%35E!VTFL6psn@J9~Rz%HjGoU_gdd%txob9lr2Ni$B+YBoqkNC zWs4MpvAeS_dstX38ek!{p0{e&YZhu_?t_O#paMO=fzl-l zBc$|(Kn2D%%NWYDOT?^wMy=$7nNGDbi)v+FE&2>vq1GGzcv+0c{6Y3jgMInZ8rWBY z_HNi$gb~zOVV9~iP{&vM=0V#qDF$^sOq!srooOr~`vSOfOrM>LnSk{!k0?uWhZEi_Ef7gQG-MG z2<3ub#6F{XzR>!9nzR!u-j$L% z<7rYbXG?rSvGoe&%9ny_R#|rx^Iyig73)QP>!G_%ZX;|i_` zR?^HPW9CsFK95m6k*X=j1|(Q0)f>g3ub(NWj7qjyIa zR&cZ~@YJX$NONahj6bmUKLqBrLx1VR+7R`P74$Nnc)a3qb&a~SLGeXOB-O^Q_qT|p zbv!?kRr+0luJ1j*qhv=muD8A=jfb^+8v@tf5uI2`U&l&X#;Ad7w(}L@qQ4YZc>Dds z^y_*W>(C}tZPqwhgR;Sh7`XZ#^4GS#cl$8^b*v}$k!@H({|Re7Z8e0JsLrIm=BY{d zraZF-YkTzs+0j{xH5DwChwQ-!P*0Y+F_W)Vv8HdC@}AnOj%+;M5Lo-R_Yt$_P0 zs0ZyjFMzqWt*IAl-`tAaoole_<1v9}Xl-5rm*$l~=@rZmO4-X)n{+qh8dghKJ>dH2 zM)?ITIWm5X-8hkI?fa=|>I*PB`}MjCJHs698Y^qG=pFsIC-);77W zsX;0GPpvm$WqY|rTlcj_1TM6QhWx$iC9H=75i|zsV}bGst%U+ogLb8fYq7&uv5NW} zx$H)}XlM-B-j&X6P<-{0Qe~G)b_T+}DFy1bOSnI``9rB!&1+QF{XyJYEo(V@t4{91 zYUweoPq6Ahe_3=`yoVaks}EG3!abs5v8FL#Un*Vlcg^o)}r@0w~uoQZ0U8r0-O{U-W%kYxKk-pV)^| z+$Rl-Ru*5tNK3VjyIZz9B+OsN2p3p_(Z1|;w4{Z#)FJ~{yG1_GpZorVTBSDi4(`u9 zj+u|fSKNh|MRV%x+Bkp8Gs?PWiQ9!Sc`;fb=Gb`LyTW=sALIM5|G*l#MXW*XeIUth ztm)To#mamnMt@o#qJ*`aVeE~V`GOqLd!n#Dd(MnqDZB2fD{Q2z{tjICE|TJHfua)_ zvGYayoSy9g?>|XDs%^kZ25pG0DGD(k=F@#ex<5j9F5jt*@uyEMR8!O!>L#c%?q%^^ zHHCUj!+hNRIw7UiWMfs1@~m$WG*ijagz&&3H8_jxtv_0M)Zga6yDkxTLcZ(^e1zE& ztF~5~^2y60U>hne+je0`psPUasl~leglJb)OJ0FBG?LG*`SOX!F+b^7Rmy%FaW0iLI_1qPd99>gf$BDr`|@t&C|kOf7C&&0Tc?&nc-F<4Y;V3e5K_PhpjmBc+5>JLmChWMka- zccNT=Ue|0Q$4Dt^AZ)zUwmlnTi@v&5BHoquHoZ{0uR-m^ zsI>SMv>0s$M=K6^#z?d(Ol*)(Uf#z@ z+_l75pv{Vb_Zvju&~Yhn=&}@7ub#qaP*0=5W#pFb0nMxPV!lt6(s6yg#+_TQbbcaD zc#_)VxLWjI+TMb~!oYR*mE+4!^C z2@MSm3hoClYYI$!NBVi)C9JJlq@A!<)>bPWbt(Dd{RbP;{Soe{V`2I0{UiO&Gq2Wn z)w>UEpLwwUdgK23s3Yzpjzbl{zR;PT-+H+Fjf=nO`EAT^*8O(Qf0g|A$X~DToN##j z8wXFfzuWenx8ulg)xII35x-A!f~hZ3wj?)Q(U);`R@XKxhO)BM};jxKsPZ zjY4P?LI)sp0Cw^5=()F}hGws>=xILD(tY&JluFv6YLfBGGnZ2aeqDa`mEV4nfnS$j zEl6?5_Mu6t&;J@`u-~Z_B@^Sj5|5-DO+S`FzcAbF{}g|G680-I_mP?;jt1*w5}w99 zU}w#er+s?d%!Zi}vx{NJ&G&GLuau_v+^^z62DNg4cook^soMq${vyd;Q#0^*fgBwz zUd3OvDjMylz|sab?-__^Cd{vaOcM8cj|Z)h&e{hS;TZ{Yx22*D<&w0U&OX~)1O9!W zY#W08Y6b{=H^NO!`pOAC4I0eB?r(d7*nRU|V(voTMva;=dAetsI{}XmjKbqMYe$W~ zd(rq&g0_?_UL;Bu;-O^gGZFL@!2bic@c)61ekv9g7WMQ0uRSY@@ddxd#iJH2U5rxs zU#r8LK7~b#ic1zRS-R}O zElQ43q(mv*TPEkq&T)IZ6DLj1oicS=-uI^8JLCH^^9yF(H+#;lZBI&0QBu>=GcxHV znot)EGg<#DWay{oU+|ob_C6Rr7e&ti(etj;aqPO?x2N;tFJ>+r8`b#u`74v!?ygB5 z`0mpQcRx7c{{v^QSgg*|8W1)V~Yc;YF;0_`}>)>y9RCjz`lF= zx8A+H^K{`KzVp(#fu+gA7KK&(Y5bNwtCJpW`=@&=pDIiA%=*_U<1YW#f2Q2?lTE)W zN_p_F8(`!A%Kd-v&6jUl9$KR3m!tY+I9z+5%oN$h55PAb4~5ts5*``i9}wb?4)G7t z^gSO;K=<=AUi5?=rB@gdUKQf62=SMO_;*_T{quL5rr%8Ow%|7`vJgkYlWqO^ju8J~ z5oMI$ZjFD3uv3GF8-+u{Ta!KHf!hk6gl}Yg3{20<(KC7y-g5l}f60-I{FL9BnuJb+ zHUFd#e^ZFxEDxRE9uiK^5b913Kfqo?|3Qm?9MY%f)!06I_tSJkM1TL#5dW|c{~aOz z;UWHSg!o4YdhV7SwK00$+B#Fv^K%~?k0c83{O0yB+MJ;@gpyyA?UByA)Orh_1lG}=dzL`SLEt8|?K zd%mPV!;ya(d+?Y1q?aA}>G4AOJGz9hqC@TMq=yLMG!8vrX<+71uxvcUNSNh`Fj6-7 zgjr7Uc`uS!Us2#F?!mNkdtDKAz9ATE10Q2+aYk-+Um^qt> zV+<%2!2C^;?Zh|oLYVnuiElhto(dc@7$-Qw%%M4Egdr!)a;kGV1t&PdET=Zda>6X9 zKFM`KnC16b_=H)$h~$QcFw57F+$ev-ET^^;V?1L{nB}8@M;LO#EFS|LGYlsD&_+_e0IKnKaej{g)RPRG9r}A`C;lZuL!QVW23|P)2=}q>M z7^%y*;!gq%c5pO?Iz|!Fzv0jOkL-d!!LWHZu;VVA;GV+~L!AbWFx&Gy@CZXrnB^}5 zvps}a{xWcaq4PE37;7`a%(-LeVE&N0`6hz-xeNZ3MexyLddUXm17FNW?n=YqZZ~+@Ne}>DuBorTFrMX~n8FD~qr&$7>5WyhdQW z!(ejBSiGXJ2H&jE&$RQsfGtH!7UFZ?#Vd+dtTLaS*78Pl`r`Ht?<9Ox$&?_g57BqE z^_MhE18)A&>{V-!uae*=!B;I`xVB{FniUJy7q3}KU(U9CbmYduDqBUL3;AjezQt1d zcPQFdvTrn4E3p;YS3-ihxXF9hT6rd>1#?{V&{`!W=tB`ECnkTTiT}f|hQW#o)5uX}LjC^Tk-@{H+1<1)_$pAAQrCKcj?Z|Q5QZ^BR4 z9~3qS$NNxb)t3z!&AaSa-+Lfg^?d<-V?ZK(*7r3Igy@@ra7u?A>-$BBzEK#cX-Fk~ zwANz#Rsvh?n-4#Yt?XEz3W1eJ;}or7*fEdRe%5?sTGFNIp3~hGl8@`qMdK7Z*4G%4 zkLl1yV;JRw^3D2^LiDwOaFvzeFYBZCC$09`zK!=m5l;H3o>^ZJB7hofFS{^?Z-t*7 z>zfZ?)wc@z9sr5-Q9ZN1VZc^>V=xcA3mH4sM@tQ>zBi$dzS~av1{-0N@9#lI`ciOc zZj}D5D#NFRQTTBj^q2L=jnc0TAkrL#k#iaPC=GHi#R@S>L;8tq()U`HX_efsXj6($nX;1t1D(yaX)y59l zUM0+X%Fq!mvACmb@tgzR%7e78dR2RQ z{5IHZ+h)1vDV;U%e~ym*i6G6t32W)M=XnvXpJe;C@NUbUcIoW)nPhWVfovZbW?H@R zfYc%F-gqDu@+p#~Y;KX8uql)uviqB>D~>lGYdL!K$nmc3Lp=viADI7M;kzZLm%Uxu z6JLIpJ^oGed%y8D^0=X}=}=hw2~*lyBiqZvG+^uaeX5#IM+C zl2Y~)amg)pl;C%f`4ug}UpJ()%A?~XIqjRG+oQfRR1|vU^kH}c8&8y#y@0#q#E+{u z=uMf}Jkiw5?eS_>iMz+`o!mY-F1H~!V#=la3+Hyv&7Rjb?{3s(tnaArs~G%VTK{&M zSQ%gCcF8uMrEMa;O8e)uXL|VEx%h2BWYKRcv6i|r7}Iz6lS(LG^d{TUuz!Rr+p5C< zAs%|CS>I;L=(RReUIbgvx9z6H$~KJ z^It(qjxIY=+U4DLuxdi}zHRL_ZPkf2ag!S+N94wrt0>VpONmJsvkqCmoDF|@xM=}} z+d{(K77L}bdK)f!0&NyI5Q^|ZdJ*1tkMmvdl~~#rwP{M}BHCTB1)VLzT7uF$XB}TU zE=@0-**!CRcH8XOIos!i-G6CH;neP_+0)vl(XS&#Vj$w!!cO~U1T|4_!Dx%$VrbNK zOUHe=6&$^MLPc8U?@#*7p(4G!e!KzTxusl-jDNw?f4|(GYmBn}W`^|2 zw#r20_%2JE{H#naw||Z{@RfNsSznoRZIpv$wwvU@eq#;}*)2K1Y(bX9*Hd4RZLn## zM8BZ*`&D)mz2_Qjz6I;LJ)$f2P~5@X1AEJTo}x2;k%C{7i=MzQng`5T4kILH%O|5p zkEx8-wA<~UTK6LezuObNX+!wkKAb1H^l#SdTH`Ctc7a}9Za*WPm2G&6Bv|qoqoRr) zctzYhAlK683~q;+ze*3WaxHB@zS}N7EBoP4()w|AoX=`e|B*7jocj~o;PaRkz#@CO zP;H08Hu4q9O=e9oLh0cVk2JAm$R3BWJ1^MF z^nCz`MHYpYy;<6cm8}+=P;V#~Gq1472aD{L!S%}OwP;~B8`751ZdLnaiLEkr9zfXA z>eySBK}se425;7d)PXjFc~#mS9ju8rv!X4fD|N(|Ben8!VU-qT*~RLaW*kk++ju4@ z*ve?k-TZ=E$Q5o$-clYB?W^)N2g^q~8{MzG;>%54(ivLQq^*wlUF>h;ev|t~-r*UY z1;3ut@!osq-fgYY+jP+eyTEF)Jf$kJ+UF?<+Fss~|mUTBDWH|J({Q2RF0Fw8FGZN!uXQ zyN7(Pb`HhPBcGKi_T5=n0l>CcZw_cRg#F`?NcE^1jLOxjS>Cr(C_iWbW5cKTE_P zgJmF{E%2SQ%oAvP6-T4aJFE=ytHbU+ZRQx|uWqXfKN4m4zSmFsy!gyh zSkWDfO*J*iQSEpsSh^&UD{^g<98-f6lt6+OY6NN08F6476}3h8wR+Y4P;HCsm0P=Ar|NqBzcEXA^} z1wv!V6;n`}+agGQJZM9FrCAQSzMHLmXzg_Ka@5z0t(E#Hw6VimnO!xZX5Y5->b9D_ z<>7lOqq(JEznE$jKV@9lDf{9vKhd0A^Z>rN@RP}+=z*VL2HWT{Taj%02A*LWAWC6r zNyVmmx`IWF*Ju{+uQgz+m(GP=k>DBRfc<_~qTlBk{qQ(J-;`94#!+?=3z|#$5xZ( z42ZQag@#EdcdXAnxGQONvX0#SH$4JZk-VtAA z%A?WVByTY9nB|txb&`!GCX?4uu|9sP>gwc@+@4(Tlw!0KbA=XPwFFOi3Ck7DrY>#0 zx~=F;t~6ttMI&ZET6c3=G#ma=+-_O}zooZh?T@<%X(L3yw@6C#uM(TFKT`N%8`iEv z#LsI-Z#W_B5qryvp4fw{q84Ac=QEq#9;jO8dN%S$Hj?A%Ew{A$(bW+>u_xlXbKlH6 zKI2%y(K$!vcNHEgIk>kv9_{(9d@A3fGbaV^(QKpV2IY!&QFNwLOsE>YArdR^L6~tB zU%so-^EL0YVjr#&<8l4cDOL~lO^L5oZCMd^?;Nz>O}jRGY+~bC)pxnCXv11*Z#i9A zxA-=8;JGlHZ2zKhd866ZF=m??K8t>Uz%K)+nt*|rEN;= z)a_F}3;VYQX*bq!KKpBl{#)@kZP>qc{MPm@o8vsu_K8Isdd0?b`zx}ybZucx8@FgzQVeIPp{QImWnNU!k=}o|Ol^WefjSd9*U{F-bl4 z*S-t83UNPUPXE4)@HtvcbB>eFQi^NE1ER+|mUpz4pQpB;#qF_wPl)s3iPVXBB6T93 zNS%l$QYUWyc851SexrADyvrN@9m%`-I~|^Il*MMJ%M+e}Cs-3Y+$h6IxE2^IP1@|~ zu*ntQ6qm)t246(@M4Q+=5qY$Y5dT{DPL16bx2@=j6XFX<{?w=V4&yrSWl8els%4_& z4V1s^y4WbcJVeCR`yvD7Tks8>Na3URn`~#Y?xNXEYVh_M!*qZmjH& z!SlkFZ7AMx zywW$=+vd;n$68i2v}z0UaO$^3H}BlsIY8K>6?`L5wDQ~S(P-mYRcOW+YI($!VH2V5; zxgy=S&o`l>xgyun0%^TxUZ=(8@;#2tdvb+6m=o7b)KO)B8P)<-^c3(MwCTK{M!Ir1 z-fujKFQ<6seG2lK^Q0*^Wzqp!$*OionAsnt-6m6C>CV9Vf=k+11HY+<nEucRN@QKON> zqi@)%cDy<3+lNv56|Jq}p4tP;q>Z_Ad;wc)Rs!y#Jcnzc6MgcaZ=+mkb@!}z0kJ;) zdZFdco??GY8ZGb@(gRpKga;z-m(JD8TXMyd6E}H&6d{+p5vvo=wVy=W!87I?J`kff zUKY=8oQW1&5FBlqcMkRZyGJh11*;XTXt4HywG6D|s4vdXoO%WK42r~aSbv)9Z9VVv zeK(s$Jy_$|?N%Kdr%1aGZVeP-lz60QLzvk3zHE=ecY!y@Vvfxz+E9oQJWP1Ea;r7l zFL?i#vuk!0X3Wa;ZEad>kBUNBWtn#|ln^2P9vIjPfq*$sW$%qkLFf=UR6_vim0f-ps6nU zvPo-w%PzI*i@tOIIJAjwOK-g$U>ON$)TBFe&~s#IwRFR^>G;a_%9N_TRp^h$!j4Y}mN7;itj4*-mtYpPtkln% zAri1N>MqN=c?sT-Fna}s_y6T>iRGOMYZ}_`2B;U@tLt}1ovsAOZ&em!chp~RJcl~N z8W}D9TfXSTEgOG5VawlUaVx*s>KbdjZS;HRTQ&6SVbK!(C9(REjVKGF&yV#)`>?M59IYZsa9QwQy}z5+dh~|UG1pyodLIe* z=YutjR*F%H?!IA{U=vcoAs9xMg=?Z}jyWeQHP#1Yq`-^@AvHfzQ; zOO1ZlrE71O#C5xALot2da`@;m8;9fjmc#LV%Wqik;%*(F|H8o9GVoXv?aCYN>+rCQ z+HbUveOrUM)UG&&V^usHtK#8U6%U_{migR(DxWzzYb&{O`{%9o8_!6)O?m5YZkiJP z_J-dD&wryTn4Z)Tu-z?fJacpY*sy<;x%D5`dF1vRb(*=R5mY)5`X-baE}gaF8=0@- zK@Yr_C&qqbq1U`K&F|4|9dOorr$h3_1xIYD!-sdTY$7y8w8I;$FtuEc8Sc3A_JxzI zBXW3L#~o3(JHNp-DRqSEMAzQ^RXSh^av!QkE0NuyxfN=8~{YMPRiuDCOk6t_Dar!-GSMus~hGc(iUPIjkddzG|| z%=F}ONnTfqH%0Me=OksOX1Y8sx7#%?CC8PXLy@zUl$=y|a?-eLPm)(jcc;5N8Ocgg z_P896JHwUZ_NJxgcylt+($ZWx$*CSswkvy_;>sMCnXGt`L{6$VGbugYodQ)!-i#b2 z)0LU*@+isUQd7nyXQU=6UT^BS)b#8mSEk~|KTlGc$CH+klkQFPrllvPd$ZHrso6Q{ zIc^2olQNT%U1^?isoB{X8QDo0X-OF=isDMj&dJDjaN_I|aDrERNa*8)IJJmJLtz>&$ zDAjSvN@hB8k&!V@$?$p<#p_a1kY-9|W?EXNf;=T>YefeOQq#N{9#3XYQck*(>K!)@ z(CtPwp!hsV2+2sv$?)RExa8E7WHgKPRJ=cz<3a_dpygy_W@jd6DB0t@nVBf}%ycCs zB{eC-RpI@4H4}f5%bA&Vkr$F!-ux^r%tOr{sKpbn+-{AxPT;B5>4ALh-(# zB{Ud`zE3~up{0vUN8KzE0uo29!#Cqg9u2DGcS~D;aV$Jc64;-kukZF)C3@hXW4|XS z{(so2Lws)le)u#Tz3XP(yMvxKyo~TfCK&$5Li|}F{+S{EB_aNX5Px}yf3L;g-yXYW zkNNDc?%xsQ>wbFPSa-VLOkek#>FIvc9^GHT(Q#Ey`KM=jb*KAxvlrq0?Tgg-t^8o7 z(EV{Cetw^do^mGrxgp`DA^sy4|FZ^8#osWj?fa)cK+_i+ueO2&S*c9}?ovviSSk_cblO;DfaI)r->K z6x6T#dqe#7A^zt>{PcXT?)3O?ve(f6fyLk7p08`^9|(r){`L^RS)O{h`AoU)H`}xB z-*1WEKfT*S>R;BQ|JV>ey|1J@IVAqj5dW|c{~aOz;aYlYSsk97H;NO z_suji*NQ{-T!isulrvL@gEKGFABErQQ|pVC6Sv1S(u2`^B1nmgcuc4UV8W=9BlB- z{;!9d3M$kpQaZ>;OO0lFzmlT zWsr!e8@UMsHH^ofse3{(T{SdQV4pI-mAI zvHE*M{8ugh{`Mzn_M7cN_nYOL6jFaFA?2g{&G9uQgr6$DW%P&FU_%(*DD9tqx~8vy z%||%(7kd9hce>x4-*mq@zvzB*{iOTN_N4pG`9${*4wgr{2#eBFBAsE_$+y3KnIZo1 zntkT{qWdQq)(SCRR2cdm(DHka#y7`*oo}`e-T%BLKIQ+55Wl&;(D`Qn8y{kyp5D4( zeBE!3Kf2%SFSwa^*)BWapPxqVik?y}5OkelAL-d>LQ$4&sB)lcWf5_tRpPy_kKf8kI>3(xO z)BVks@c!}LT6})r3vV`Q{yT$wcS!krweZAXxb8Q{Yu#_o@4DZtf8B4k7u|m(MBfIB zzrVecwDcXpaNQpl;y3M^6k>m_7T;{|y5DTyx}Wy{)m?5#{Ha>}7daSjl=rtUPjsU{ zk&~c95;HWuIo{=IesjH~`@MP;oOS=45Px-u-(0`ui8qiQrL_?pPR}gQJn>V6Zwd)F z=Yu@46XD@u{p~fcSMtQaBix4dQG`Xm7y5Lk+goDs{~P$x;NM~4AGCzic=LqCzYhMp zz#nPwSHMq>Ugej>_r*zLe4{!I6VtWwJ8g;I4*rvfPw%sG{%Nmw-Q|f32>-4{Kc#=C zC7k?ALj3gI6pp_Y;oB|xe+Bm{sJ-2u&oVB=-VbKrZVlF#X>4L!%@2T8)f?%Fn#MJh6C}J!W#|# zr{K}IPWA`$s)t8XLopojU$U`J5AO}(|0Gy;dieAZ{y4)P8bb%;`q%JkN=g5BjriAr z2jlvYzGXwM8^>Vrb@5$8-))-zcCjc#|Hp>C)CUI(?9OW`Z_+>CXn#Z-jBn{g8u{1# z!^E@3dV|ysMyuetev{@OE~<=hc(wBTbBO;>6ad$NV=zj4Q;2=rL(1oeMgf#+{5!=x zhP~~Yerzg!e@o# z@0yVxn)3(aZQwYgyizs4Q%o`Z*R}j6iZa9hgchD8ejcLlIU_t<3r`V$HtL(q9!y^> zFv@?B=Fb#f!ym8dA1`7<+V5>4`F%emfA5BbKV;~;N7Fwc_-!NI{w#4ZB>rmf$i?9p zjP=7#%_l^!=J$#>48L9;lQ6^SPPaE#Of=HptMR9bkw$sy?J-Ym3@IOHNPRpQV$abK z|EZAt(b~pol<^o~*|@kStl%I=>q-9ZQ6gcZOwxgwPnh`=Ec`5BhhcLrF!KpBe+Dq? zpGkZpPxCE&!ptwR@RtzZ$kQ4NpD^>+6W`!85RS$PZWj)Dpx&SeGoRKo2}Zkl$%1K4 zc2Yxwi^G9ue1e$cYUT4aO{~o=tUm=J=4j<}o6ebpKdgr^bEX434Lwvoj<4ecr82Bn-TI|4G$HDkZ3#RKQ*`ep1FzclIT+ZPX6W<*nj?wlAGbf2S z#&?@&KU4X3oZtvEht`|?4JW#9mtg3eW05ZcmW|1mFvnd^9D`p)c!Z{2>>$336C7dY z@3wHx6Nd&2IKs?{fuHk2nB`-E9V2mqqw$XMJ-}S%gqfdf;ZU2Gslea}GiMI4)6h8= z*kOD-Y6&pwB+UGE#4-4f6UWd=m^l@|tdr&;)2s7s*Fzfl;!XeBYS{yn?K>%k1PB6+rYoCT~q3zRgm(Gu| z@W(^Mc_GaDX-;;I*7;O-%puGisypUT-7$wSa|$h-Wfl%$=B%-B)>}A)nL}fjlLi~O zDjbfxH7IH=c)JBR5T=0~ZZ{6uxbP*+I-du28hToR9pAzUPOD#oZ>`_`2xI;MUeW!PB84J`eGab zEYqL}N0{T@2JDzXQh_hc0)JP7+I<42fk#3l8#j>%bKE#!rxBN$Q9>3@aHNyxS;EY} z6WHm&366$2`7Yfa!pxyMbr>8fCZ4AVGiMSo>!Gz4>mkgX0$|oNpE$94T7;S7Ao(a= zPMGDCN9RPG;50kQa04^P2|sf*8^-8*LTzx8v2b&7Bp5oW&B%A_e8Q|#D>uWQ8_F#g zM7U8nuYBL;`+g7Zt5IrjiNr{DyajU&O}YxW!EW3_(>I9!i}S&vqa(;$GO z@=3_kAbw2*f2?jBVdhhF?3_+gd;QUfMapaR!f98kFDiMB; zOZjEaJ-}Q(gqh>D$O*HY%w;}dmd~-s3A22WMNXLIr4~71mOo;V6K44)i<~gawX!wp z*IKp>7CvF-w~*Yp)+5aFy}-@_oZ#AUB;2P#@jCu+yCuy0L%@#NI_DU1jCv=`oF0pu zFw4(a7lQ>SC;0QCP*}~aNoCKXim^tmh z4#S>977k(N9J6rVCQc$waD{_X*|@X3i=LXFYL}bUlQb zv&q7#C5~Y;VdgYgIJ=2s)G1-+Ja6H&5y#L&m^t)22$#^blsw z84KqEaSVG1Gv|_pL%&aP`4DE#AYis<2yu)#i!gKU1a{u9H3u;Un8%hx;u~W=Vdke3 z$7r`Sp7VH1m^n0uI_K#+X&u6OB+Q&_;>_1MdBidDNSHY^W z6^HyUI)^ZGc9NVLARJ+qKL_ksLsI?OU&mSSf^vUb(rw5j>nSxAsy3np0G;C zWAMlEsE$)Dcmm<|x?Jl=KhQB%gOfT692JM--!!OQQ#*gCaAmaQU0_HYMnB`P%35NZHfE}B0qQ5wtt!y)AzinTDgb z&2cI3a*8e|%<^1dM+HuBb8s+T4$NZ?Vdhgdm_zM~aRc#<2M-7{pYrA0f)gCI8Scx3 znL}-cId57xgqicUh0{x%r8vP6X3j-mCm99zIS%eSgqah8B49aTmahVKP({H#PI#M+ z%YhTBb=*$!8Xb25J86J~J5HQR9luMQIvsytk<(hy`GhXN2+ZRlVYcCO3*QNxchL(IZ$R`<}4w(F`f`+`5<72A1C^Y!$}ngHynqYt?MDo ze6me;>2ks>2Nd!SI_r+*)YqIlby>Ov7Xaha44Qkug2^`LE={a`GyPWW&}qb_F3NhS zDKnoi+dx(2d>SXXdK?aFm~ixm<34Y}F9Ih#gA-gE4##dn`n;B4q)YAAVQ{E#^0-Qv z(>+6S

>mQ&kv{s;m%8pl{CEz{*@T~3(!)O9(((}`ouiG-PRA28=-K5>k62{Y#< zk{kV$Fw1R7lIxBz%W14|?$PauBiy26s&~fs0Lwqt<%Bt|mpD|YaEoxrlaQc+nWK%d zhR#PU9Ky`m0PK7LCpfA{wx2L_sL488ae|{d}VsY(0(gtOkIM@kT9o9RA&GuxbrwT zzl53Nu#^K~mQ$HHUZ$9M_JBCX*hrW;Gf8fgAz_wNpJJP%5Z}?RsloT1VUK}hNdBrW zA4&K%9aEXh6QKZ(FzZYN<~~T69_K^^ZP`5_%Q5&pG~ z_Y%j@`8wfFU4FnKr@5ZTXTqFT4{?mN&JiaMCpf~)(dKtU|0smKc?2i8NjP}jPMA5G}z? zo>9O~YFu!!I2;Cc0w?^Aq{cOxF*l{d&v7RJJKrRR5MCTSe-UPmR-SJWL;pR6=fSz~ zGiMR7vzr+D9x&V=X*^^Oje*YpBnIxC;z&55LGc)2!%ph6JVp`bxV0oV<_^LvZvb`} zahr%^jBkXQ^E}CoxP)0w#l&+BVU~XY%(iLu(gOip6b`3>hXFfIkraE0;c&dILGAf# zdHRiY6o+8>d%B!3r$ur3J~LsKQ$0FQ<3xXPFo!U6QYp;fP(3n-FmtFLnM3u+9Ky`G z&%!CRa0oMJnT133$a)Afhw72js<3bfGl%MqIXf&I!pzxi;j~&fgqhQ3;k<6)5N6IH z3rDN#XubTcbxqaD_M8Fcd=X|n=Yg4X$-*Jboa@B-FPz9B8TtEqTGsnH+M48DokC~l zdpf=ifB3fv!mN|p1Ir1soZ1h|39~%KA}7ppt!;c;x5wHxaxHwq%rCIW3A0>l8-^Zh z+bFg02{V7aMNXLITH7%6Slh;S3!gCapR>pbvz+=M-!~@Aa;G2`Mw6V=T8!PbzF--{Jb1tj!S(f<|CbB?MJ&H8ezx@GhZuDBVX3?d=VVyIbF|d z_``M*=C}udozx-Vx^S?aM}T8KCaDmFnSTs;gdr!)avJ)%YzecRx(C}prmzi!nR9_S zbb|X72itH7IOY!|6@oDHuL6%S$zkM+*7?p)^tc7UF;tLngqc4Fc!VJ*%yPOekckLKnB_}IPML!v%<@&h&d)Tl zSW6t^ISRtedCbCjoG?`&+y>y7Kbx5O<&cjsimVXM&Qi20g=FmvelV&`9V4!v{6v0ZojO!!9%qg^RN`Mo- z(DOyVN5}ll#LQm~`3OT!nC0}FHRp>k%O3%bp}`D}Fv}kU9%0A{vwQGy7~FT%`!5t!?XFw0*8=6n%m`D?%lhEDo@ zoa>7)bM^yseGz8)o51o^Juie={x-0~7?<7!b_$*I9&n6gV&Us#X9Ip=s+k6->*E?b6L;!QW6J|NR6Uya7nC05<^7rX!S$~%w2@bdOc#3P- zLzv@gzs0|=*B70g;kq6Nusqwu%pVE4!=}rxNWmR;SFBpP;Ndk(*A_1*Tw1zt&7=JS z))X&XbTfI;%2kivbPwBy7B0}jX#e0_Q?OO!Ltw6Y=%EGrXRmIhi-`{wJ(Rp)U2@vr zp|8?;+LyF$rLt&AanXYdu+8u~eCq4(kje^)LpwmpJ!OTOO;$a~`~p3+XeIV~egu0<>*t#r!(|mLRG5b-f0s<3CHpF>Wozr3>(Wc% zRw?NvaH~+G1dG)4c$DW(UiUWDlV^S!GnFM$u8r z$0pfY+bu0dyu_lFD^?J&D%JNVFDzcPcKJgKRxE*~&#X$QCZTQAQ1}pT0#4f*ZdFcdkc6 z!~XKc3zjUzhVWKvv}p!Aqc1I8Y|RN3{;D;_XcL&6mM<+`MBy9{wTke59k{GCxTpNh zM=G?71wqP9%NR|4;c^(UeEGT+3y{$@s3H-vCq0>u4pFjFtCfdnS9&%I(W$2T%cwtE zNvr;mJ?)WoDz4?lYj3_;y;d|@PqrprwhCXG>}QTidC0#qsyZqbeOu$vaEQRoX+tX$MDI@RzE{RTrU(Sl_PGnSUFqqzNKm^w6> z)tX1CI|NxPm+I9)e+wVQFcu84K(jVi!5FQi5IV->7A;)9d}YzCGQFw{Ewf19{8}WU z4X<5Th`*1n(EhGjNnidn;9VM%fj1wk?_ z)l&sEIT2nx@#G|+q)}J|{(~-mfW99%)7PvP;xCY~(^ry0yaGTt!U#xZg7FtiXwA(6 z2<5dIVf2T2GXQMxXOR$Y$-iQ4i-`9DWBIFv4Z>f#6=u~(x7+BR7dzHB9VDy1`U$2! zJIEA9`u;t#zdpKuK-a?TSYI`GR(%J)i+6^>Bl{2()b})G6rIbZ7RDQwW|~UYw*w@r zz8771#tbsjN5#$d(PNhQAJlgc0eopr3RzzwNLGE-Ii|jW7JcIo!Kx1*PuG6OBwgfK zA6-LR^)2_{ULhiqeP6@D_LYU`qr&JWMTTR2t3vdpPQ>q1hQ6kxT&^Hs|q)*1d`tFPB zuP+XML=8IDCm|hcy7X;=oAI7TW3=*8z@xO-vA#hdS$XN;ZDJDsGA|M&Yd*f1B(T?| zo{!=9%lY^S*sAX}=xczC9qT&>fmPpglkqJh$f#Umj470;iNAP2itcdq@C77 zU(!wN`yF^z`!e&*abv7S-)ABDJ%mnc++qdGwC|50`4zMD_pHgjcpPjWeSgYYe)|UN z-yo>`7R*1eKFpS1_vMZaIk$%A^IK}s=ptoYcump-wCtkclaDLzbO`de}c{Z$`AT5 zBm^DXcOE3Gz6YRhI9OyKtpV7+yF%K_LFjvp5-=R=yECM{JOX{sfk*n%aj?GY09O0f z-=WXnq57_XM{%-@fIH`!_GLoG`m#dotAM`vo7nd+A@-$0-xP*_&`UP7Tf za1(t$0MBaQkoo$2PWh#N$M&rVvCk2shl8RyF25xq_T9Gt>4HJ}u;dBqI{;g(_DzMp zo3-a(fMm7rHRwA58R^Ti==&mMJoVmr^YQsw$aq@4&|HUQTl75$Y_;zT=%ew69p|?M zf`0ZDn&Xw*2&4I^9*0$5>^Jpivmw?T>#Kv$s_!!N@w&uogps~qr#w-#yTGv-X!`#L2>6axXz2&mWlTg8Ez`?XTpYgxIUa&`)gN zJt6Jyc@!wEC#im?TJ#M^1gm{RM%{eAl)QKL^vNH19+oqENlvkEJgMig~Lmx|$EQ96Wj;@4XrC7Mz~*_WYj06D8ft-Yh-7 zdiKVHZ)(EbQf1d9zs3Zc~Fg)Gl>wL@u!-mnlU)_f(1~*EcJFIFxqO%fRKA zJaC{;>`!6OJgY5JMS*qSwX?n{f1B%C@xyN_YoC+UuVsb%JO#mANFB1@Cb>2io%yNo z*>pU||CRbWq}`LyryWtpEqldcx8$jlP+n#}iDSw4+5T41zC~6$iX3GU?aayXi-ce5 zuYqEaWO}g7Sz_)nM-uxWrR+tiXw`FIoAywMo;%e(J-leuD?-{m1Fa#?vO8+%uG6b$ zZamnIeP;Jo##g0VS`O{SY2A;GcB1on%>6<2mSx%34lRdvQ0Kf!9pq7T z^m6QVSlL=-wpHoCBv@$f+b5l+y+^GU({7f;v06P{&@On`2RK~PV)y;MW=A9W^ExpCmrKC-l0%=)N;0Ls0Chb@q71e)7>G*ACFEit5 zdtRO?65GTa>}ziwDL$jUYtK+EQ(x!2NoPs>0PHe80PW7KeUt6;7p&W40n|1saWugyKhTA4kLOVl95$NtKofjTewf7;^-kfbUPOCi0sr%MpexbewZL(V~zkZ$gEzU`p2@r8|Gu_x1 zFR-TbSksDG+b8*+HNHp5T)kLPU;I8HU-MMwg!<+tJyiC8oY0cjq}H3)k{8Ik-vw(e&U?Q4z{B7A!I2+5`K#Z* z^ztA7{Fi@xC_XXen{RZ6_>C#I*Me>XdS2HfUHXQ?N10@kN`F>Zt^cNnf6n0bloWeR zY9Rtj`y3}IQuY`-Hu+8uf6&8MJKLc0CwusIgLksp1*F*JPmXwd@eN2x zve$#`{2V_hQv7woB8bcFyUfFH^YE8@`1=e#vAn^yz1>c_;x~Bsn1{c`F{1Q0dU*GE zsr37ebO+itKjzsU#Xs(pr+7UL6H>)L>Pdgv!!zctNa^Q#_<06D*EyEVG1QmH5A*Qp z&RFm=+(8{}hgfv>8an%_Q;0thvFJPmEOKIzAEsP0#3FwRSl<79lsY=lK`c7Q zs520MpyOElB{sCN=$ta-#3FwKI8X0G9&bMbeIR1d;gmIb?{ylmzsy$g5sS`n>R>!h z8V8)2>SEF1vy<{Zcw&(k1N)~bePWUG@p8YeY{Vj;4J>7~Qb*SfV$oSfoit^$12`RH zd(vj=>#~SNe+T8dEMk%00i28RK4~{_p5Dg&)IV3riADcG>T4awSj9JD(K$>V-nauj zMV<3pEILQ2qwO4{j`odMbWQ-HJ807>>gfGIEIMycXPDA?hdR365{nLl8S=jCG+?P? z#G=D_#ZngM4@+Go7M<~i4(AE`r>k;_MW@uzsUT(m4pc*Z?LV>TN2sHZ-Ngo81f0j4 zsUXhp_2VA3V9DD_9ld|jktpxqX8R*$5sUsr>I}ypXa*M1Ar>9RA=5MP2VzW3bcjV~ zF0klaZ0Hb+4nlp7KWwk0O&}JXPD4&C@@ptB#vh1Sb#R}aL@YWdfTg`67Wu1&oLJ;<0?Yf- z1Jo(RA1HuDbS44k>WdJola9yvIP=h(-1rvDn#8xo+o)MSef9*a=XloBfkx z$cZH{>v`^3_ybj7N!OU$E_Hxd^rOJJh(nU*VG)0bMQ4#ACl+}Ju)Is0+na|NIq3>4 za!wJ8{x;zB0RBKbut+;bEIM}G4nP3fjU{)i4b^)*G-f?d*Z4kQDT`R_JVKoS{y>MZ zhz_ynJOwN|N2wFUABb3VjsuI%E5M>dEIO|nI`0DK2Ji=Z4~yg-Xt_QROWqN{qH~s^ zLo7Pu4ITE8le{4zbwbqfPRTbY6?4{u7JNGDC;g zW!bmHqO$=wcbqEg8tUkJPAodx4LPyMAEI0{#3DZgEWSNX9ledjqVu$&^BY5lSagmX zI`%bpy7IHjHCOK|`L>=uXvFO;>FYVh8A`C?>AWFUGdKv_$08@H)64W8d!XIi#o;l0}+dkeZK2$NoIZ1+d?clLx6Lq*jasN z0*eo48<_Vh#peQGIbVpy&bfx1SmcbG$o?S~`C4GHX+M9_+k+1Y4-1&HLG^@iPBJx~ z8!+dUb~ksP)0@q?^PC1N^XYrH{(h#`!}v-}OYUiUsk3c8PK@u- zy{=Yb#8JW zvxLozOWW)TzTEVMD?8)M7O(7BymnoFTf#Q4T*rC5p8350&IDS1i%k!0?GtEwCg%A- zCWI<(Q!@UE2P!sUE&)Z7WjvI;dW;DP3H$_2RMhd*yG$%)7}E?aK?y)#9kT%roGdnaDN?%w8tTz*sDff zW|w?N;e080Au-L@>JaP8fNx-G_wxy^*Y+g;3h0?6_J#sr^ExDrdfm+@U?AL_Pr&*| z;&zb4-X?5-Yy;)HVXp!k$#mM~_NHT5w`^fBzb*gLMJuM-(**jOPf%1^Fs;Ay32wuV zWqIl{H3{WezUDR8{&w%L@BP(}fAO=Q+jn#~yZ1m{#JjG06YjXA8Fx_cGxAK_^8HAD z?5^0b`R~=P!u=AzWj&BRF(aBi{_1GPP+u7;o`3LQ-*>Ry zxplD5fBgvDWlY2U!)KlQhprXtg|?ew)~PW&Q_=_e2X36{!Hl|d!rKe##CWjqAakn@S zXsHS11p}Rn*L4Q6C$yg%@O9wvtHtfUB@36Y#A@N9HdK`NLCDyS-(vih;I|aNW%w<} zZv}pr;I|ULRrsyO?^66a@LTgfigL2xJhk7Ec?#fbx6de@HSp>chh|Jzvmx@smAj7~ zyL0nxGpf%z@0Y6&9hiOh-zZBp1#p%yH{_MWLp8eXC-#u_naB;D9>4)J? z+;nMBu+81whvWFE+SoIOI;1JioNjhQE!4XAwC>k!KGk=p=6UV1(6V2pd0alg53;}W zyHd+&kL7Lj@Vtg9Qt5|<)%y2(_~RaaqbEPdx{6YKp8=pRyoQNC*BR;bhp}Bns(ki^ zO`d&e;rSXGHrZlNzamSg5Ar4QsUCi?hfnkHAM@}-eM@xNttf%_ne?#NE|2Yhi;dJD zdB5YUx;{MPN!PEswx!h9Au->r$jAFS99sx6eU>m-lfTi!bL=R@^lOE|nmjK1KL6QD zNL-|#dbgL3?=V^96M^MhnCz4I1NZ|Giw>{nqQiRWAB#T_vFOwQ`^QnL=5mVM*4O@+ z`m>>zspG=LqR;Ki(sE*v$Ec6K3W-?cjC0BNYR#C}0?0F2X+XrH-wK?i<-{Uy2bTLK z#3Ek?EcZ)@Mcx67hTEnM`1g-@vFKbwx!&i*BHsp_%T5%C{Yr_y-v#WSK&g61s^}j8 zFUN&ge#6^Yp!qXMiOyvE+RYSn|F|9eqrRMdwvR=daXZWdRY3&U?VQ z>{OCam*pFr$-tTDBa?_lKNUDj%ZWwK^T2F&q7L*Bjp6WS;3_vB|hwmX;HXybxG?AQm~>bgA3KB4=Bcu21M|f#o}(+o(TDl}jx8 zw-`DDQ+gfIvzr+=-Z|iXI^9lJkDPb&c)7~09x%^eyL?^SW%&y`@nG>HJa>#?Fdv`P z4@A1pjpJ1nt2&$^vTcFAkNBeXOYDcS<#9?nW+$v$j|Z+-U)s4ie^%q1JUq_cc8N1| zw6n{j&k0Wv%NRVN0PnNKcB1DgUS*OG-r}iLG8n0L9hvgMP&_l*^}%Q6aJNpL2`vby zqtw5DzOtKr8KGe~|343zkicXJh;?(-<5;#8N?yHIF^2U3jrl!x+N{ugI}G0h%+rqk zFpd2I@}|98!1FpIB=*>BnfBg-z0okl{A_x~-a6!E_ChSA92gj@p#9G@E^H6D7W;Jo z?5_whjkF7ksmJ%q&~G7@OJW;m>hXInymknQy<7;03v@yS^x8#9r!oC;jU{OxcbY+B zZz*I*V$*ID^`;7gwdkD!Hpi4hutT}++@oJibl$Sz_NHS&-7G9A zbw`zbjVX)EruBPFxe`vXykaaqd~IzcxQsQ|{(kTC_x|q3|NCdZJ+O64xb2N!`*tQD ze#hFwS;INTXfe&0)A{d=G2e@VXZtR4<{+nSIqr;5F)mF%XvwH_=irSqRyb*CTR19x)#0rd{yB#8A2BW+ zIo|gjoJ>2nr1e44UvfQ&Wo+hzEP(fes*oVs&l%=gN!QyFs|f8Yarl)SRNi#87p zx24~Y(o&L%_5rDx%3e*kEZ286Z_}$ekz-ju#ZZ>d+_JR6{j2y3YSfG4i+(1tUA@CEDVuZBVu$3JyoT=s)W z3-7sg)aAPmrvGcz6E9 zyf$FJDPdvf@=I3-K76BfoT$!N{lhTceq0(`_}$%j`x9tyb;u7INj~zeK#CL}6Bg-) zIY?8S@!Fe67=Te|V)`K4-b^R|AiQHuF|Alxh?KHCj$;%J^6A%;**;jf`Z4`R$LJv6 zAn+u1VL7js={sx*|5SPVJ^UggKlRyfSETfh3aj&vHuPW9X}k_wxPmR!X)4|@%r5^q zL!b8N8T`+XkG>AF^DBQ(8tK%3-NSG2@XHLI@!Bkpy}d^I+rZ7HvFL0A&KyRm`lh$YZv>yE<-{Vt6@od zrx5PC@}6Tp%->hk$0@s;pbztV!afPFUQ+{Q_4>80?F1$Dn-vs-I#Shh5A2`O zAExor#A~2wZy)$HEJ9+Br?+WuG_ISYA)`GrPQ&gg z>gmg&kMF2Cj|rNX#wCtFuBF_sK#%=uA*PXD!eZ)0;5d(y5VwQ$IV{vGAOl)}gmwk( zf2MJnf4vPUTkhDj^!zHIGQLnprS2Hr0@vds@XXLYw8%>J6UjxXtQvL?)ZG~rEoEeRI(Ki*XmEbVu^>l6xLdBs>H-Zhj_rxA!MjX+ds1fotO5p^2rM!p{W zAB=n-Bs&*`(#np?Z+SgR@J#r{%Z2;-+q2#?BZKrzUcFHe;oXW(KY7}`NQ(|#{9}B zA02tH?Z!{s_RaGG)syBH?oay0*Vesu{ERoNKY!)DY4s0Q<-Yvs$ME5i-3xMS@5^s| z;Gt0uY(M;^|3nPTK9S$YA7{F7c8gvuSKRUywh+@?n8w*IdbLV%t5(}WOnYG(XTRvx z8pW+yYYW$`UB@)6I`wM(`*86CW?>u5#+&nMe&SpI$?!cFU;nK==P$qGiO8UHatpsc z?D#L*GOusFuMeS3(U79IGiIGSf6UY;ulZ@# ztd@+dQRkhP^2@1vHeUPEgKrOi_sJ(S=Ukch-6fCx@$WZxww8PI-#Kjb;5F@?KS^D^ zsWF%~`>a2WxNEoX&6?Nk)F!+wb8Q z8Tpz1swe%ZhwnMoILwJPa*mJ0I{P1MRQ{gy`187l?=9B&GITj~Rn^FG%jaXy5yk$Z zf9?mC<3cR*gTNAp`zY3kodIHeQJ!TYmVNb6tWoWs4|}X}$eC$<#Tqd-?r*HIXj(!X zvD-Ko%^C5?Zeoqp=q=W0Tlk-jHPUrArs&2RS(q#DIo3$M4-#u+{yt)jb`g5UnLIhA zzk?tljIOap``ZL%YLZ<(B8xp86FmWspC*uve?PO*ys^f|hJCPDBja}LW|%Qa_BVuh ztt0&jO37GPkO7@Wz>R%H#_~8WVcHNZ-dNrvko6~)cMFsxme*UX@rSV2pIGDlu-9Fz z(Hjdrhz;z{KW{8_KlZcu*ITTS-*P()ABDJYN!}RZmDp+hi6MR$dh9O?3493xViaf7 z5bQMWe<2xw;ZtdV;Ci8UU^erA1Q zy&{P{Z>(`8>~$Aw>|Dmr>fn<(I^5XT+`7_fqS5#JUwMy>{z$Abm0WloKGw5t-SQ=Y zwv`K4FAd<+ZtFM|sIVX(-ysQ1TGrXwvF_ZdQ?nYOhpG&ob7m?Go_jly$AQ;hT$4*jH&co|?R4Vfs<>5S9EL7UWqMg6JMGB6qX7sROk83g=KawU*%SCJZva6n9m(5tp4R4$E9VZ zOak>?$JgMIyzdHLkNxbe-wPlU($&O19>gE^`W?eI^rwF7Ce*oM z)K~ou78h%kzUy}fcDPx;hk+|gNlvTarW+*nKFA>B>UG^eMvd{I47`XI?owyFZ(W2OG?#;7gUF&&%R5r zphP$BeYfr7&r#(`-v#dr@P#r4J~8g`i9eiu_;d65-sv(p;!jR?o~>}-VQw8st;k5W z@YMjTcJ`KsD#lgss2)%ovaZ<(w?Cqf_CTL|prJBcjc!4_CNwu354AM-L=dSD#b!1| z8{!S&hNkFzM~;_11mmIlm?_|#IFE>NDN_^*x5T4O4e?m0vOe76WUi`>)P$q)hNkLp zysEOQd-=@D?&Yy)xALYQ^ykI8lp6_ESJyVqibv|ITFSh}B(bRxd#15EeqlJ;)T0GE z(N?PuH}+&H(L%T?60eTLTd)q67e<5ea3gn4wUgUW!0g686iP~aS3oSYcZHI|VDAcW zvaT;D`%ow;?OCBRf@;*W2bGatx1chD8rO5~syWfQ;lh%VV0lk_+14m7p4M%8V{J<; z-V}+|y5~o@s=6fx^9YMd30M_TH-*i2BUuIYyoitCSB z6h8G?AeFpzt&2x}Dk+cpsiyW;uZ7ZHyuW(g6&tCGM?%q-FpOaD$HI-(=D8G&Hbvtt zv1r%^)pHse+%~PTDeg3P;l^0BDdMKVDhoqf7H^poi8MvsmXEDQFg_Qb1a=xtB`FNL z66CFl&X2^J;#KvvFy37Xy^S`8>f_PISx$NjzU&l_g$WD{C&#Or8X}>@GLSz8m(VgrYeV(57lvrc^$W#>8|`h1 z$7;fj@rICF^I3@OdnB}AyV$@*!-*x-g~O3}B#gu=Y)b9S+Nw}2oKQkE+!&tK6szr8 zc0*`hd}cH>s{uPRj>dLYtR^96B-(_XjcZykUf5GYQ9^>PTcr0yZDnnJZEU`MN$O53 z;Y6{oTiu;++z;Ap*9>7?^BTfY9B=Ol(Q7uloL;kX*MvjS`uXwdP%IR0sl709r>b4U zI+Czuq54ST;k9c~s4-R>kA`t#xF>^Chibz0^-b})s30@DNmVsH&XWZe=CmYw(SnN0 zx``IEE^J(rX&hA!M&pg4hH$*Lv6}V5tb0hav(5~MVsoNK-Je%dP|oudrv%!+mM*6% zyB}^X4Yf1|bz9*PUJ$K~p(o<(p2|>5xU|?5)Z$GN4Thi!uGZJr;w*PEg>c#!Y*kf) zeoY7$hQb0C>n!D>YAmh#dO8)NhVmqHKNcINWa=Jiz6Q_ zDo8M6TsE9~6|IHS)xlD;?(o{=TCzLm2`nFrNfe;3o*>{&?gRn5?uGzoWfiKdSr>Sw zRy8%%)p~{Ml=kMXuk}b;qH{eGG)aa;PIK1_`}{^jVkp_7Dzq@_qVLhIiq`j#&=Tz- zA&N$&+XB4DT$KzvlJFsjrtUOGg55oX9z=jgKbi*3BL4EARqMu zj?E;SS1}9H@6Ygu?|7P^`Bw0> zA^b1k51)4w{YvnB7tL6$|1kXFyOf0IvsLs-_&vbCF?c@L$>+w$>imP?AHU}+{Brom zZ4~}l_;aDb*MaAIY(Js%KMH^DFnE5u<+}!d7w|DG& zAb38?$o=ys{AmC${=~qq1~2>PNAPDSc!alX{ZjCUjP$Pp{~n9v=evCvaFhI7;mZW@ zlK<~0pYN4roniTxfoGkWB>rH1C-{k)e;)ok240TOC&8aE_y>XiiAA<&EbtiUaIP)w z?|?tW;29?+p9FrU!SkCT^T0DE$#g!$xfXmt^L%b~hoOH8@_pdt`1}g^F@rAwei4iK ze=qz=MI9KY?TrGT175c0I`}gSe6~*i8~j;e=&u039lZF*=S}YgAJF=oBmD$;HE(#3 z{SBbs8~lI4mv_KV)cRAv^Sig4I?3(b4S$-zmuY?|_-nzlonSiWiW~tS(EOj_&kNwC zKDB~>2fUpBoKrnG)!n{%;3tAVTjzfU>uT__y+43IOTjzG5Bw%0eFyxx7rbm=68Im0 z7k@h8-|xX=>W1y_%kbw<;2FoJ|NPe108E+@{+IA)6nOEs5&R^B|1t8FgO~Q}TkxkI z{2AKbDDW47m-4QIKg$jMzrmj?z)N|2Uhih`Qr_?2&tC9iuO9q2jr>o+pU1&7UQPe2 z!9N3D$~z4Ciw6I7`11yMu{RX_zl{7>!oM>R1ef~%XZSM~yx406Kh;S81^fwtm+~vY zHyirjhd*)fQr@}XSA!p+{pH-+YYhE~sCzeom-4TJe|y0*hR^N$8~po*p}zwB_YD4b z@b4!^{(A7wgO~EY2mk(J@ci~r3U1_x{rlkGaPV?GCxV|~@EP!L8hF{>b?~po;7`Jz zdEn*v%>lpM$o~ZVxx(Pfz<&X}9RL0BXCHX+cMSMPz{~#M1%I9ZFZ(kC{I9`FdGErX zR}B7Q@NXOZ&*4uhZVril1^6-GrMz##pFHs5&p7av2EP;jTmW8$%U;HQ8;Y4E$@&p*MRsq4c~@O~UT$$usM;j^~F z-vm9E26_4?sUAMf{^kz#tFiE2Z>5{rKISOedEY4O0PpMKXQvfuUG7WX*QK0T!WMSWu=!b=KoP?&%XQBR+ zxGfgy2Fb3^6oBlyz!L&w_mf!pKz5tUiU$f{v6u-o9*e~a1)7A#V&wqkVzK--wC@F4 zGz==nVzGjOreU#oFhSF?SiDexDzI2A98`_P;sFKKV6k{{1Jz@(c;N;`uvl~u6vJZi zf(e?3#p1;Tv;d363o)n_ixt2hs2z(n)`q@i#N64Sl~}B78`?J?Ep8~N6N@#$hQ1BN zyjX&+z+#8MYAYP*I6~s#w-blPm;myR$6~2ymg~Hp3FH!g=;*|>DLcB`h+lW^yyqow^ zh4&D5D7=q&jl%nh*D8EJ@j8VcB<@uBAn|&IA0fU>;YW!-t?*&u4GKR_{27IxBEDSV zr-?tS@KNF`6n=*Ia|$0LzEa`mh_6!k1o1|NPZD3P@G0VJ6h2M7N#Qq$H!J)W@fL;O zA--1OcZol*ux|kHbqezuZEaOJm3W)NLx`_e*q-yfUEvXw-=HwZqSlQH^IMMA7ZeT< z-=whd&`2*6iR=kN`f-9Kix+mT$5do_(=Vn6*{^}=b*gSJ^Mu-#EpEFcuC4MVyfXJl z3hMTSynID(etEe(?J&(jWezHJP>F+z9aQ9?V4(wD6bw2-0~I(z7ff?}a8Q|pN*z?< zpkfCVIVf1@Ko<1o#h5j&& znB95WlYHzpFn%sXJ<pgxdhCjt^DKEhNc5c~dIx}w-Qe2*d#!_2 M`YlM~zMw1r4W4{K$N&HU diff --git a/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libmbedtls.a b/esp-mbedtls-sys/libs/riscv32imc-unknown-none-elf/libmbedtls.a index bfeabbdd0f5b720679e3ec1a95a2e20e0ce431f1..bb802fc7329bb15a6f9c9d06db58f47ff48c6b9c 100644 GIT binary patch literal 659408 zcmeFadw5mVoj1Ntl9Pmhc;G}-(0a(N5R;G_*IJrjf&mc`BUOrq$@&{?X}jv&AqI-FW$a9XF<##$}Li3`+qF9bjf0)vN=bo z&}^mVRi8et8c-@#yzw%nQpK(UrOqZ!98l^%UrZT8SpzC%Ty&WV{fWi27jsq0_}bel z?SJC`)WILw2QprLR56Bs*yxK{nRV*F9Cuu#vOjY)DNfn*TlHUzT`h^$fzJM>)2I+LX0hWvU0ta&=u5;q zn>)JPJo@`Po8ry!_JrRhk8S7RanTehO!OtXdT#an_o+8^HE(N5bPx1(B>Gb%^%a~6 zJ3IOZn&KV3?TNnr!H$7oB2UoN*4NY3)ZtZ+lWkDmkBqy$&OsfN%+8>xySdBndr;vt zd3dT#TNB%xS~>Qnf5A1bsd-r0fnXlhS%cJ}zh@t&To9jQ8m<~xUBM^~a}Fwh6IIH@I#IV2nOjw+{- zbOOhlR1Tn5#{G`7iCUYs^z{t(HVyPNp;3M5Ol74M4K$+lx^Y_jEShif-1? z)9q8>$kW@`)-Pag&)DELycbW%-z7o9RS4WRl`@o{wa^!a;oYa-sa zy?3C=9;#^G85jE!y`9b5o02Ok(VaR~TVf#IjzhgS&~_M96W#ud+d4b8w4-c&&E5U> zV8YDXItTmPo6rG*b_RP}QO}e#_4Z&yMy>i<$QVuPBf3YXC_WDx&1Pl86*Q91B80cX zAIDb=d%c~B0c)tFv#7bY1do1<6xQgf+o-$s^ojcin$f`R&E2j2?af;gzB3FhXvckW zIO;zz+A!Lqx_nB$GH4^F3;HCzXyN9*gq1c$9hpk+=uTbdM(kyeG7Sv++r{op>gMI#S zT325j*&!D__%-$S1_nh`V?U&)S8|Gu!y|P?YU!kXn_abKJ4c!3Tj8azEc&qTMS+87 zAy%GG)hUgS6YuPS>)kyA9c|lv0_WIl>*?!C)w2gsj+UN5RI#h(OU&^JWjURS)3B+! zrD<7H9^HmMQ$z4%eAgPZgF_QZv4-S2@n6zQF zQ*;}r@4!qzvX-&PKNS03d`9_vd9_Uo4W@(Fo<(LF^NV?b8A;~ z924{4Y=GSqr~T$Fea&4>z0L8h!7Oc0K#2AEvgP+6i z3(V;qW^0RoPEG$>I{b57^122FlYMZ;yi^`Cg)?t!ink;ulXh{|Qa&-$8L5wdYjbCZ zGg-2x>plgiESAuJ>^M@40~J-yiX*YjoZ47_DKz6e%VM_M*3p@wdY$nM8Y%K`<~g&& zKj-3bfg`iO+glCm*_6XhX^gdiB=J<{jI6c0sU1^Bzw<_xvS&~>S;uH^=48JaLr+t1 z_2blBkZJM>vPC!8=BxqMv|fC=1BtKx{5n=c`n1e^1tVNZIm!3H8*Ts=t_}l)o{YRPn*STT`WQR%L#Dr=OVfmrSXA zZaTG|>IA3#3-m9C+1%NS>6ux!C1>Xo`|@&9a}y%fghmTdSCa~z1E?=?3%fA)CX#K- znromv(T&}Xz?z(m>6}4Zv4X`37)v7z3vqjAipP-aWm{h}&JKZ11V`GL*wP%|jcueJc*tLJMnQD7|ql#MZ&XE3S=KVSlP?WN*#-K3_||#o4r&IBdF8)@zFizlDcn4X=Us}{44?rq-Q*%MfF zh#HQ7Gid24Ztz^e^r=pA(lY(cfqg*{BzfXZ6L5(5_lsPSuX6PYee&+^Ns>-{12`a? zl3YWFbp%PSB~9npwK0Y!%?S;^HPP0L?v&iCktWF&2V7?-v)8}nW$}|X0`>l(>5m=$ zNlzD-*2W|Ud0(B8p_6GfpHQz=ongL-3yr{<$P)XKu?uK*Z5ey$W~VM-fQmTRHR&8W zF!bmIDe|JKZRfO#+8!4#r&V)%kzNuL5cJ)!i*zxPbiB@;?9-L}%cm?;-wKtPBwCM&3%y#;mYXeDL zL2EcO4h$qdU$p6zBJHMWO=}CD=KWpDt4gy~pEM#mole_u*LO+Bt22${!KF9iC(EN> zmozC4=lrc}6f+#`?e?J``wGhvRW-G5ZRHFHd$g@s)wU%3r$?>R#Vu5L+J+vSdjBz7B|E(_0*$@;r? zTpynut(a4F4B(PwQ%@UK9jKLdY{$2n;mCi?+X;0${IRL*D{{%hfwqqk5*r8HGqc8y z6bOm5EgBF~n6f!*1%bq@UwthEPwxw(X@F%w-}mBi!+R?L6^x8_Ft|#{pny0y5!iFT5Z^ybG#cS%Hm}`EjKU7=|++Jdw6xCUs%qf+`F5=&vy<%pQdw3 z+vez7S5N}1o%=C6(G}2YtLRm;kK;^b^nshq*CSVu@9YEm+|xa0GVRpXtF((9aWS9c z6u?ldy2`;XMtx`FVdCYfxih6>H3m=G3ZXyFQEDembO7 zH1pIYW7OUJw2FpLUGm;}UHcxXzo%yXefjDe>LC?Y7p-qtf4zEebnUL^cJ27=&e*ZJ z=>@}ccfy18`JuTx=O2ru7Z1naY5tC(&@ueJn#yDCU)jh{2FFIjz44(Z6@B$Q9d$gd z%6_|MaVEXWRPBzxPwiTM$MHMF+ub!6UDI&Qw$pk85At>l#o;;7kKjuIYOesbSAg0p zMC}!#_6qa!t|`oqH5cZW-I5P^KIHlN^ZpXG`Stumd$VhqKKmN}FWc*R`3-e^Wcj{D zdn!j$?bPLAd|brubOJygGPxL!&TAIea9&#r!MZ1kP?!-?C^ zi=TQ}9U2YQ4cC=DGq&$MH8$;7+SpVTi%$J|Xz?`E#6S$~d-?h5}Q zzPTtg7Cx0$y#Gg^AI-=g`j!fx6TjzZDEgcCROr~@x;+_VQ;wxY;r-$%@O;V?*xI9x zgzv0b?b<5dAN|ccYBVGCTDwzwdG`(P6Hi#8$xDLXSBTzMh~8I--dBj;SAgDEu(P^Z~QL2>36iUV8%InQPMsLnTZ_Pt*%|mZSZ>`9O z|M~DgAH6vry?HL=b0MFL-i)#0>vIq7)4h55NPH+OWuMmN%NrGc4!OO1Z0a#{97d<9 z*ekn=+!Cfge2(tr>ZBPNh9^Q-M$x06#Qo7@dvnl>-%cBAT&SYAkG`K>GxnPk@0Z;- ztu}h=zEIWZ)=!;1e|hJdf~|XNb|uH??=PG`qaYkvHF{Kz3!HR($U1; z`ySdC#_0cWXtX{a`G&fvCYlA^tc{~O52>Tj_~eqwym~LUB4hZ}&PP^Vn0E!oVYK7m zAJ%m@zS_9wCjTN@W=9QLjD=e?xHa|zTVo8mQ z&an>`_J1%ouW&Ht+=l}}ELPZ`qo}nkrecNVmD|9I(bo0z`TvIb3fEx=6S1B)D{;p_ z|NK}-|FRr~wEeOC!d5_qn|w=`tB!8x!fkBbl`*qXOr64hg}agmJ6mJ8O()il)o7wS zN7Y|m*RU*hjr{f+aGO%~{ahLKceKTDJ1!hIi>6p*d09nSMQmRCz(8;RvIPsabPTi) zwv=IEydWV-7Ib#r+Et3B(9MbXKp8Y*5S8kbO_k-93(J>OE}gGx%P`65>*$Z)szP|U zLS;n4eYaLsc2xFOG<8+>mN&)u@3yY4!On`_awr7CNo%5(p?>v#wojg}{>I2Nzz?aY z^2@{OK$=qbx@k1sXVHHBEJuI0E7x?dMQ=A4Q%2;M8^~{plYTn#)Irm)xMi54c0k6o z7a}q}{X1;5m71bffnEU`6AD-Uk|n49GRq$64_I^$=!I7LO`tyn8i%!OZ?mP(^am|^ z5$Fc!>iX3F?X~3o`kLza{~hS-py@9PsivxY*jocy$`b*--lF~X&T;HL?&hcIZ5I6= z@byT4F{0F8wIyeHCLq&6r+-&SrRnm3{yd9*3wRLvFyq=^ZOQ%qp6mGghATf;eFO== zfV7zYyXiLp>u|1m0P>H6z{JdvZv#E#U{Bxc58D2BA=g3ENa&+~C#2Hy7XtJOOMgA` zy94rEM5(_YS@Hzr!;ndPu|69uIq3%j^mhXEOBP)M{c+ffn*99rH^ZsFMUd&B={zBo zrdM0^g|K%7H0{v;Owiv3miqh;o5Nlhp*9qR+2OV}9@ z=v%~K$2Wt^!54ps#U|JP;t#R#mjH{MI^fyt3<$)c(*Qij@QH=bu_}5M{vi+xpL7K4 zN`@N5$T>txtwa>eHW5FGCG9$3@sn8ijlhz2Gw|%`_=m6=QFK~?=NLY*@cV$pPh#Qk zC*O2xV&QX)m%JV&J{SKGo<*D;aiD`m|9PqAQo0GFJv`8$ATU*KU$y9@j|hEFW~{lMY_vG5N7mvBOXz;mb68?opd1(tdv z7Cy&ru}Lg^+A5jD|EM3t5;M>gTeu8Z`X{lZtpt|-Ni2LG`w?Sj1@LU1#1V)^hy8z! z;S&pgJ+SymEc`a|ufabAV&QiK&*or&KrH+|;5mj*Ec{Obi+y6@JN@6-xBEX-R3yg# z=J=hfF@260%wtwCeU`ei{oeq-)D^Mh%dt+h>;=(s(0{H`azA; z(BEcrkVYVuw3)zj44+u|JXc9x#KPw}tz@pYQwCgGpfQirlKC1}l5cc20875aVrL_; zV&SujBbRFXJT3&6TiEIIM&~l{r4JB`of=^21H{6w0~VW&z_Uy64}n;8 zcutvP_{73*2cFG?5`kFwoxpPppIG?pCsIaY;XeR8djb9-5DWiHz;g_rSorKqQ96h~ zEc_>cBNgN-^%P=Br32M>@Kb7(o&kF_3pXY)SllEp{ zsb^x*`6O^;nYKAX%taf*=csSSA7arT2QFnNLg3smy3WI*^OU9Y9Pn&2*(4U77l7v& zKC$qB2wbvM+dKsvDb+X)Kar1UoK0M#@ihFD)M`8vKeJbOSZvM$YmVU)3x77S_)jc+ z4jHpA$3FyO;qzFVWBA0vXSWtR#KLE_&gQ{{KrH;_z;g_rSom~N>YP~ksw>eI$I~+f z+f*6v%~NH4iOyyRmZf?QoX=x()1(X6o|zVxGS8HRH{zB#+a+bq19(`t1vet}tFkp^ ze8}_++1ZbaZ(CTtv<}f&u2_3rDekbq^Q~vF%}35puM&95 z95)3zm+a1v%6XEpj9W=fc+dt9ziv5G0zQFyYk#-%Oi$b7%FbnD_bL6dmj3=SeGSxm zbibfgnX8J5)jQDKg5T|3&aYG9WlK%XmsKngP}R-O_Hr0r*Io$AH)gQ}LfTQRElS8ohT8Q|9#Sqat;9M(CFr9YH$Oj#DN$K&*IL}?JBw+%Gc_7ViP1^n9|!M+HD zw8v$s*c%15{o9So_^uekuh<&`w*9M)DiuRQ+GAUZz1M(kdn+N}`9gx&`!N`{y~bS7 z#y>7i#U96P+umTD`XNE^oiNON%``+&?|D(eFJ+9Jj_{X#li>n1R;z~2f6-%F zVhNvMqgp{^Tfl>Fy&|IC0wM4#de;M_uX(=*tRaedTr#k{45IfsfYcHBkHX#%+Jy2| zh%7IG;}ynJzuYmzJQ^BsU8*=EEso12JBv?*Hr#h|PkeK6=(#-yadq^w@b9NX zxO}pCRcOO#Xgoibk%nt*;bpb2d_KRdI+XolymwV78h-JYq47|C#zcM|ZtEz>Q29j} z>en?bbtmgqtUA0ZZ}q*a!?>n&QSI>G?wnU2N}u<%iVtP03$BUx{!CS6W!1)epH$ah z<)Fxu>iFmKW3xiT$L~5myfU=%_A!xp58HZ`*k~pw%?NZ zO5RIFCs)6?_J#G&Z+LFwvo}4{a)NCzd@O%FL#1Duq2d@Lvg>vhXM}dnuM4HmuR|%O zsK~nbP>zcCKCOnYtjal9gZm-IS;yo?!{f+pxIVP{$keB6s-|qOt(vwf6yIDDs><9H zIAJG$Pj@2b&Np(Eix3wd`Qw*dHwENg`L+D5fc!fF z`tbmLGC;p!(F?5psBj&@PtQ<=Mwe~E>mXj;>GR7wM$XgJOw72>H}>vz=q&eqMKzv} z1_%)LBJw&&gF_KBPE}tvH1~yg-QzVw^M~m<4~d#JslArWvG~O9+6`E)O;EqYOl0YA zDJOIY^AP1a0@sg`Y;yIQ(cb@$mTP_;e#HJ7;0QBBSdUoBNf-k6WJ;$w(Am3_J^ya< zO}=TsC8je`RrbbryP9yX258)X^!9N6+K1nP#Uk8@7$$JR0L6Bm3?cExz?~Fga z3JvjfYm;s?Smy9B6V{NtEyK6Zki4H^rNOQ2&P&^pwhnyDcVzFpe(m(WIu9P6L4_}y z!y4W5pe&wZq5elKcRzx$1aogUtifEl5j+V3&vvcLZq77jC~@Y$m0}FPJgymdOz;?~ zL1fsE1Q*~pib#Jb<8l8BMB82)Xr`4Q_Wm6V+uoy=y|9td-V7MC?G1rx=g6weEwUZF`S_;Q2#>`1j{v*!DQ)$Dl`h_F9+gN+vHyWOy6~S~Yb3Q^xqW z=GS53U#{KBEZLpF5OH{Q0`*d@{eA$cz4l{2WuSiy%#+~?04WpcI@nu>NO=h&%NRlA z5rn6a;t6yAyjj>et3i$Re_8u2S|S=}Ui-BpGv=p<*m;--f%+4;uk3R8EP?ay8X=rt z+~?t=aa5TdUvIQd8a#tLs=i^-3}mJmlEyJ#Zl@!zh7e8chHO-KlS_GhgKffyL)i)D z6lf@~-|+aRp7e3*rRw8(Mh`zu;5pL{w86ms2LIeXPQ6rpoa3b3$5{>r`okdhJ_>C2 z@n=ET7&-g5^zj81ORU|EGd~})Xo>d(&Y7MM;q`m^^FMw3^rwFGao?j$|L?tAscTT* z!G7Kho&@P1{AK)8@8>t53}@5Nod?1Arrfg}%d5*P&iXm1%P?tRT}nTn1?uHQG&7ct z=Y=lFkA>BmV-f5!>Ak&0BaKRS)$r5_cJjDaH?w}tHIeJ`Ml~&WSo`wdT?~3W&PPk+#&y3df{F?=WsxU>-m&|SDNBI z&%P8I*V6G6($IL(9?HL$mR~d_E&pIadVcJXN-tcMhCRrF@1?DF@2}4<+LJZ_|FLtn zQtUg=Uu`}#!h7Qn*N5F_l0wId_g1c?_DMJWp^?yQe2OC8n+PQa$1=iiAFf~TN<-tQ z$&7FW_xfkV{*$|!9qFq_U$II$Tvu72pSLPKzu=LyqS4@v8F$NcYZe_pG_u#LpV!jr zcGtw!0X!4ca9!wFJTj^p8lQa`J8zA;s`=+Gg=c1D-FN)+ps>9S3{H zj-jfe$5mD4M9r`EO>_Ge_l=A9WYi8%Of(j`rS;H*BcW6Iu_?;lKmJpgbtv_Q3|u(Q zIPWmaOHd5y)}9#Y3};q{yqZ|f_i^y<7MnGT7YmC$x6`}uu0PW2MwEi+n?)L{1 zW2E=y1Df`9H0|Z5=^@virbhy_oa>z{HL$-wAdk3pq|@IMkUwhC=|-3PAZe^E*yH^i zI_UJj6Oy}hkk7K@^IRDLHgF(c>GCv9+d634t4~dHE+cZkJ?&44h>d?-`{^(((0*jzHbTW&k4|9ceHV@kE1``z2BOBmiIfO z1yq!iKm_6{2T_JK5EsJ;tiPzKME;15vkzz{oH6iakI&J+6buAgpLJG}Eu!bK_q z+o_a=MrcQjL>;L5@FQu7CGBm%lJ=9pvTwM9*x2FRy~OMxjsr(oVF=@hV&^Du)Epqh z!ao5VIUoNJo<|fPh(+fmVDaG;b&MTi(RmBF#2heh14qmS&_4i2&BB6M^m)HvsmXV` zg>x+&1D3r%Vo5uVHcek57Je?U+zUG!SngrXBmV>VhfshRF?*mTz@>&?4J`FWEH;;u zUx|MR#KI?C661fp$07GM^4O8`5{o|bjT(Yj`0REiWFXLg@qt)$=%V;QEPRe(C58CM zU~SU5bI&Hc0RnHdz-JWjme$}sQSJ(vw@A77MR{qR_mo*y<<2QjW0L!%JcUViFDJ>6 zw*vV-`v8x-de!OIGM0m0zD|joZcFs_;MFJY8zS(s+5zYF*CMdeCKoQn*D2&JbiQ}M zO}0bodEIYM;)YxN=SYS2tMEUEap=WUt$*F7_;@^9~w!L=PGs7_?&a}h%{Vo36_71=v z>zelHm)QFXux;;t*yETaLCU)mO12)KFJqfa5Ix=>Yv=oOD_@>ICEp5Q+AB8(UWI{H zgZV=l zZMc3ctHFIzJ)C$FlCj;{YAkbMc{IJSd@OCKc;)EqJL2je)djV+;n2T@#y=C@|F?}R zj%0mPeI{%8_>9c>#C0lvJj<~@TFYI^8lMT;P}>(aAGX8uv~J84?UrB zSJY+>zrJHAy>R9G-uko%_Ypk_`(q;+>e-qHE&ID0j?w=3?i#(ql>3v?>qo6UkA~VQ z!_mR;W%@3q^!kU@?dL@Ye{=4`^?aL1PWVZb5j!WU?7r+;Q2ztFQ7Gu>f%%;#P%m0Kd72 zOM$z*&XZHbYN8E!rh}eV}N4y5{ zO2n%XKaBWAg@|9Ci#Wbi0MAF9j#!FVh?s#mj(8j5Q%b2?#JhmEA?`*TK)eaD1#unX zYQ(jOmmxle`ueI;>Pf`=5XZp#JYo-G2jZhj;TY6w@q0mk4zU}t9q}tj`-oENVc@Uf zcOT-Xf$u|n1aT{30`bcV&wSwbG5p?zcsKBV#4jV>jM$2pi5Nlr5aKe#rHJ29`rg`7 z{C)^A4Kai`bppSL-va(7Vj1Gs5g$h^L1bXRXW+dT8R;46JO&u1Pti1w2Zka;^Vl$S z8ufYXFkEHiJZ?0duF?^B3~3s7&LQx4(sY_bvu-qv%`F7>O-*MzH2bNhGaZ`kpy@1! zo-(27a9G>VF?5!pdHgVhr)c@56Ap>;X}ZABSvi_6F?7VxUp4eRqyIIJPILSy?=tkoMt+B(FER3{p~GQapB!fxvJCyf35P`aw0wb~ryF{n zp|f(dyxhR-!G7qTzz+bwcKe_}#2E;jnN8~PGcUXE)Fk(`i|KgS`4=~Fb#@rWU8XpVmjS%zMqNfi!j z{e_0kGBn3bhIvMx<0AuTr+ggq7>bOX;~N8LN6vAMA=k(!9144QhUOT^kZbZA(WIJX zXpWT(7aM(!%?y{A@=l*{Ncca+DgU{K&NB3Tk>f2|Y+sJc4ATu=JmHWkD@V(DUSNnA znqxCVuF>bYfMJ%AbNptw*vNUlV7SD{GbS7o{^dCN^BlvFWoVuk7{XJuoaYLL>4q+v zAO-y#EiapJNcg8|o--J7jsD<-L&85T-)-oNjeL)xFER2jYjxzO$G=Am9m&!3V}=eJ z`PU4cW#o5>9CJa|?>>cA`5}*Xs|8FBp23N&l$QVfqw(zWb`7BRQJpoP!~3O``s^{(Xkd zGW6#rG$Yrf=bVONmPyaK48z4nJ~rWyIKH&KYYbgu#skj97#16P-GoD`rH9fn?P=x#$VH~F_4dZD4W8oI{xH_oFN790BJ35P`fy1%v>dZD2?mt?3h zloDB$6exXUQ&a zsKsApdFi^V*W6H1Rld-Ym+}>1^`+~ttu6iNs>X)Wv(QC~v(i3$yX&sK@~m?|J6+~| zcA6~t*=g#UvP#buWIJ8H;&Rp~8_85>K#9$KMkULVX}i?Ml6yvKJu6eww`rFqw_ZYp<$bvu0JTUG0-rmaBX=HQ_3sP4&9Uw4Ac;+~aBT zKH^icT(oM>r{YwN?rHuaCutdvPNQXI=kFUnThuyz>D-DqvvaQMne%p4Cv6MYO;{foMO%RbA$2imF3`)}?lnoT@ySzUlq3)I7N6WI z4xm#apFCJ8KB1L3Ii({sEu5Un?HN9ilUu4ZMqqk`o5pPw%gv->xJs70lPg)4{AEgI zW)cnB2(*5(%k(DD@;t|TlcC85Z@-3BD94-A+K^(WRtmVBtYqb758TNPowi(VMOsyz z+A&x2j2XL{DXQLI4p);lQ~3#XnP5)Z0s$S%J+BP{I+GPPg<7h12&h>(`dT7|+8N5| z*2h^m=<1$D_O9+^En>Oq>ZWKDcXlj|5vU!X{A|((M#H4^MlRLrlUsGRmvnn zGqNS8az{g-$jL2L8Y3{Hp_|67M$1h&<#)zavfNE7tE)sylU2B@l%m#ovUB~Kq~(%y z&el$#1ykAyv|^HuRYgwyBq>%L$#z^t zs~FPCK5tw_S`4&wYQ+?-ghM%1dk5Mng;omhQfOI)bxN8-#WIvi#aGJHyXC4{CZ*spA3tF4RwNz>;ee+lC zB-LS`L|M1YG^I5Z#Mj4D^afqlREox;jB=?JCoON#;v_zDTkmXKOsSW`!z8^)989Sf zs6(E;k~=}56Q@=Rc$Tb`!mZRwDSS%qBPo1JR!ZTMUuhDbl9eovHnfZk})e*eOby@)H<^hFl!*UxhF=ecrC=LYCv zi}t6V;@q!AaW-NIZ;xYrT;S?Yap(ez_NSlf$g5qsroH?%?d7lO5=-B2?;OY8Y*&7c z(=S~T&-2i~n9Dd<-ER!A4noeC`CK8ujDY?Om2TR1nxj7_U_TnrkE(LhpI8SWJXz=W z_dNAGV^8NgD?p#G{&tG4Tb7CSn+-Y-Sm^6f@w|sd=+9>H z{CmrizY2e*qD@3z2D%J%snPF&e;>2xzkxq|N2bWn1^o?+Zi0WWgU&bUzXpGBYn@BK z4;fxR=hoj^__x-gN8sOpMSlJU^?MZlT#P)0&H%j}^u@-0J?jtjC5FBa_%=)a z6WIE!C0_{o3DEP6{wVzWSBrib{$;~vk&zd`zcP#72>%*EOZvZnKet=-FM$st#!UKh z;Abp)2zk9}(J#WEOxO_p80aFF*`)78~#*V^i7$x z{qraArOu+~fNlrpW)9-7Ci&>I~Lsx|8mdq^uG@OszFPC`8E8x#-dk%?glOW=U(`C z2WaU(ufv}QEqNvAZ(H&m@b4AS(tbNoxBu6ozX|_h(>?in@UPyYuL6BD=mJx|yW#KM z7X2#xJ8aQqpkJ}*Pr~2dftK;$1^74TT#x<$=*vJ$`McoX4WMOwcnJP&v*bU6KlfSk zC7_Rjo^Sly4*&keqQ3`!GBM#1`GuetSab*cyB>6rN&hYQ^GS=wZ9(b)=zJr;9{&BE zMc)no-U5B8k^cbxoHxUx^Fh~uE--RFPt|JCN8!(Ii_QT3s6{uzzZXGE{T+Zmzq06e z(7rQgdgZ$u{(Z=zx5K|yi~cVB*=NzyK|cXn>|YK4{?VfU0{;BgqJIg0E{uBm9|64# zbfGEVr{Q0dMgJ@O8?k7P6^~eSEBt!_wB-K?{Q0Ft|0n#3V8SQzWuPl8dN2H254yj_kD{Vhkx%{^e^ELza3O){4E4s13F}A z|9tkszJtl} z_C%jp`1G-a1`xQ8n~na#KrA|Jr8$OAEc`s++30VyK`eY8yK@YmSoq6;<(&vCfaQG$ zb-<-K4j9%Wmf(EOumO?%o8cxzsRv@Q*$OP*ks}s9tC_wr5DT9y`o_Q?;j;|#ZUvTI z-kZQWETIsA^(HohbtpEeDmG~+`a1q0*!39$U4k)~p$JjlSs*^sMk=4l5Ben^>1D$tbg-SK9Bfm`JM&bn;vpU9ue7VL4i0d>yN?fn;3F4I+zeIe6#%~ZeX#5WGDvkM_ ziO_0|bBV9ixPW+##?{1EY0NP@v{vIr;;S`oC0?iT0P!^%j}Widct7#A8Xq8T)c7dz zbsC=_-k|YI#2?l84dUxHeuwx5jWg1LH)_mxdWJrxaRKorjjM@o)VPkAgCasBag)Za z#G5r9Aa2%pgt$fH{lsyN4-mI%e3Uq$@d@HKjb9?(qVXHV?Ha#B+@Wzs2Jp=qbH66E zRpSEUPK~RHyELvN<_Q|1k+?_WR^ncbxn~l(MdK0TK8^Pi_iKEBctGQ$#Df~2Aih=O zmxw>E@f*b3G=7J8yT%zf*M)A=IG6a(G%g_igvQmxw`*KS{7H>DzYl#%<5uD!jR%N_ zH69_}q49p=of;n?9?|$H@uKdo^q@jV(35PwGF5#oC_-cLNH@d4uf8XqOTPvaBB_iOwT@ntvc~TaKcX@B$U=uS&L#ee#s$QWYFthH zRgLS2AJe#z_-h)s5JV&cNp~#_V)Jl4J2Ca z_ph5zZ^b)$+Y^2LgB=42eCiBuMCusm=;_AC+W4)pvNcUtCHl4`TCeErX=&~R_iSFa z&KL1?cJvQ4S+@I?=Y)@KJ_?5~fH`k7N`7^_^I9LvNxU`57;f5{*zSG^F8QrVR+>S) zI;g3)AK!-yzTNoD`L*@+bTz@fj_#Bnb)$QpOS&HM{kJB3Ij*^rDfAc4%GUIMykj8V zUWV_obtZi8lR9ncq%ZSLmfwFNGbgFWv ziHjDysA7=|JyfyKWqPQh+GTpEqRM4@2zL(1H~&0T;eDmhLglWe3zoWHEL`HE#V)E? zkK#1xww}DK2r*Vi#2`a-oMRaQmJf zAj>>dQSCB4R8i$JJycQYGCfq`ec#bS<*ud+mb%}1T;ig|E~;4MLJw6ebeSHisCJni zs;F|A9;&ExnI5X}K0axoa#zy@OWhAq;_*{cYl~e}vB-rUs#xeUJycQcGCfpL`^2b) z$~{f#3QOJZi!O0d#bOtFsA7@J^iah@m+7I3YM1FDyunPe^iV~m%k)r%^(j_QJ!EOMD1s#xeUJycQcGChRHt0f~3RaCl64^>pSOdF9| z9@8_^v-{tN^*sLEu=sM^=YjdHgpdIl_$9{j%?Z`!SANnA7{G5(&n)>J4bkJ$pEhe8 zF5cs{7}sl%Fb_2Sp==uBAtbQvJqX?h5G6qDgogoadq??P6LC_(JC0ND20m*V;mlxPo28rR;-0edkR zPvzf>0ehz`ds8iY$ANACHh_qMCjn-hz$KpT-}TG%K4u>H=NK8=qZ#RKd$)op0AGUG z+XTLC?-Q_h8I)-6Ttv!f@B0CJ4@_e3`GCD|TJ~mG_R`RKpz8M1?@nUxJveIn_l{*R zYT09Z+V)-tLBAzPc^~Ay0GO3V!1tN*UO@@Wi}8bq)Dsc!Q{X*>5~#zFhe%w5$WZ2>goPA{4;){>{s^udHVV(Yp=Cq^#sW&vH!H@_z-*azqdpEUJjvLB5DY zp2qsWd@~7iwZ&)q{>|Sm)cNVLcOI^p;>zePyIy$k`Ge0r_v{PLoILT$@gGgx^lHnG z+kSNO54&F}9+5X&E=KQ+W@V{8^<$a$EakS`Pls?n&Zgms>^i;`v!o_8e&5FqO%08g z)THB5cj(x&HQCRG# z$MMk0(0F-G`pQfdT{KJGKC9#Iqm9GI-$7*RvCNus=0O}+2i1!wLdUafa<6N+ZfrCo zG`a1GMR}vI-XY};jeFmnpyxHl^LaJt^(^zwhfm~$jt?KJwBG26FLsO`_UP9}>(@nc zBc2_WDm0ES;%3}?L;AyeRoV?>;qvmd7x*U6?1r(03(Lp;{yc>e9!pvFC7vaGrDJON zZG4da<Jso~A>&EHblH9PC?Lw%H&uXVi}%lP;A z@O|6&;+rAaJ0I^5-Rso7_uY@65BpI6Lm!A{tF*k)lWsjVY-+%FP0myCw~s2vtIff5 z>_?kF;`x5l=({y-b+6Q|T=m4NqSg1W&b;#1A8Xlka?^?%58qhWykjVT_>r_Vn_jG6 z`}whvrD?~)-WNGGZA$<0->Is-8KGlY!CdHFBTKK}^ne?T~avSccKQxjzYQ2N@ zHLvXHU#?Tdcd?W;=jXX^p_OCxO}9Pbn>*lhN3F@fzAEvkDtH5Yhwqdh*k#-GFO*X85;cn`t$l&LG~k7RwNCi?On z$mCiF53mI&I~homUGv~|>Ge;C${x6IPu0S4l^Nz&x?it9vhZvUq@~$g>V0}GCM)bI+L*e17#5Y3WJ$$ooeCV8%IWYxgV(s;nGU{mGZF}eK z2_37BY|BpemsXBs?5+LJ+~JAn%Oj}sM^WcrREu$zkK)Z+(l^*=VwdKjvh`IReL|)xTm2QU-UV6 z$7(l^{JiSWXnh!8-IkP-jrqMF3XPA}=UGSGq?(u6qxNK46RuB>c`wrfBI*Yv@4vp`?x2wFbP&sYx z+L~80tvW2gG!#=uHws+1&$#Ph-k6{G+ zSncPXGem8D{!k7|aR{>|ye+RFJT<#!?9Q8Eb4JEb2BUk!o5kDs=06J^8VQH-rTbd; zi~ON4sGWr;-XEQMlhvEDYYu*42Hq=PHTtpI{MaL^V<;}4gk7p-2O^hK}3SMr-)OK-`1HSfnoKU)36 zwXdvyX~W5lFW&S*%kyo|-TZ9#Gf#~?vG?$vLwC)qExRjp45!gk=?_ms>7LHcAJ1^# z_iooy@ANjel}tUI!bm^5$JA3?WvHDW%~0{7ELC)3ETdCJ-z!#Q@6A>hu6hy+g0a0h zn13AG${PMZbJ)Yi&utssuuJlAYcX<;3SSw&2Tui!@4PNUh3mJkjBkDdJ`KgIHawxi zdqc;|Tu-PGU3ebOMc?@4@$j+XBi|SdRsG+G;l(*B9kQ|TPyRrDg=0hVV2Y~2L@0C& z=YYsm6+iWPRWj3j-uTUICiE?k+kX8XQ)GW(Eo`Usr=vh(E>Fk<48tH zX!zeQtk0{9M;=M4PtKIfXL|K{-p1mb(0B)X-vy!Z`SsE4@4Y{kwFcfl@_ux~ZZ-A_ zyur%tA)G<-aWV9v(6mr~+K<&kY2Qh*P0!x8Z0E-cLi2rnXj-5TtsnjMx|YV1jVo?A zd_&&GdpD+i?AKSetU0-6#Z`x|nu~t4;JW@qU;lzcf4sf9xpP5(Uwpxqj)C^UmNHx+ z1-rM@T*tC;Y5(^A1;X#_Xz6S2+rGfL`qSBgFR0+U&xe=CKHi7xrm?ugiM1#29TNAe zBvf_8P3_Iyt^MuITN6!P{abwUw$6?%?F0O(ZFj%((QETX6Q*r$ZEb4rZ)$JtYZ~Zj z!lx4BTl)vQ)L?IGGcMJ-^kpAT<-~eq+0zwk**=iyk8MeGC;FOsSvS_!+|ik6Rq?(A z=Dk(WtA$oYmc#~n2AVr#`20?yyPwW?Cc3u_v@eSl-Ztpd z^i=wN{E`^zFlJrEL(=lKN&fadX5P@usr{3lBEqy(M zz5SLx9dpGoM?8-Oov+rSAzQDYJ~NNaixqB*f!m{%V$HXrJ2=;))wObqfEL;2|9g)f zbgOt-yK;|-SpNX}Gu&&9%`5DmA1hrhQ2hx!$a{}$7-0{C&+%sC*9++?&ur3s6wDBI zF7L$VFYzox^V=G$-2~~1^tu4u5}@1MjUTOlQ$T)efHt>|fvfe+txPWcWer5libuN_cnD%SFO3c0X>45-!SAaelpbrJ;;!MwIU5fB8DjTsy{?Wy?SQ zWjXqL)@zV5X85A*+nB`19}K!4Jr{q}YLD0AhS zUS!b^!QR)9UpaVEAM-%#p!FX&eV9ir^WPhwz43Lb`Z(nOiuAKBd&k9`Nso+7(DsS~ z^v^|X^os*>Uh~pns^YQnpUBT1Z@y{CKMeV~XwzIIVEJO8^Fhn_)rI=@!a2%MPY=)$ zHDc=K7w8jw&S{qEFSNlvb&Z?1rso@dk*^NWuLaWcnRyAc_fSCJGVkPfdqDqEt2|79 zUqId)kat)HsqfXj_J1rOze1eDFZHhs*z?X6TK;T6pZDlXVETmt`@EJYf%3Hh|E~$8 z|LZ{dzYfTM8lckx{>pnNm?!i50HQqqL|lc)kcTMGbrB1{2za)!Ni2MhmvaoCSopkl z6z#)51Y+SY2bS;Nt{^sJWCO5#qjoK^IlwnihZn99HX({mCosRM#4vy;&v@NNJdIpD zcZrB4yA$pu#&tA?&mqb;Z65$GH9CjL=Ls9(F+`~!V)6elu+$H+@SmVQD;9xR_)h`P zF??d-p8zg3o!}W@d4B6T@{K<~Cg0#w7Jds@zMuPRVjlDezeOxDnBSQdoC7RnAr>F_ z{aGmsvG8Y7pA!)TV&U^W9&-$zSoj6N(SEH@EPT$lq#ett!-hg27M&Vkd4_B?a0v%E zgmuK{YrLM=Tx;F{939krVzF}*buQHW&A_Ebzm590YCf^(b8c5MTl2S3=i?q0ogwOQ z07V!9ma=>fSiZ4)ko=3a4(GGt!y#a)b7Hai7_ihivG5O5p9dlWvGAXuzTp!K|2VK5 zU&O+H5m@|u1z4VSdz1W_V_xyurieMdGB9pLw`o4H*vSPJog(UN*E+XTUPYy>Vf}Qntzl!w|iK0_znQ6Lt^2-04#M#Ec}zyFVl92h5rim4WC%}KL(aQ zMlAd{fTg^@u<&%8ZzCnz{!HLfbHm96z$N9He-Zf=8gpGI{u7J+JYeykSolTMuheOY zg)Pf0GBM$cs0}F{yPR@NxL3c(r%*uGOfe+HkEuxW3E3-FVmRo=*WjP z{seIJQyvzZBh)cve5@Y`f3m<3NVV#y((mn?)dGXy* zB_Gi`Zvsm{Ar}3&fTf=h3;!3?uhD6Vh5u{n8$Pk{(=y>tpVlW9eh%>LTFoaG{&e6u zhEFW~7;w~_r-+5W2spAr+u?h9qB}e+I%~<_srkgh-(>NLh2IK1`*N*MEc|xhIfhRx z{7&lEX?07bXsEJ z|B(8IPb~b`fyJLUfup;0T4K@p1#rn~&F8zD#2;eOc^6pxAr}7csDGtSODz09P~Y&0 zh0ph#i9fS}OV;SL9{`qoiA6sTSn?$nei8Mr(rJl>Urc?&Cl>w^V443D3%>@qv_RXb z11?#s@jB|?;bGCg9()-GIxYQPVDX<=^ap^&e`4WpqrUNzSooiyzTp!Ke;2US8{c0Q z-K~8i7M=Tn#kVg~=W4A(EIN-;$F%if3xAXPd$c~W=pP3zU8ngk0!tZ*Mdu}8DI>A) z-vEy8)oF=^|8roO|IdV2#uj4HiCKJN;d6Q?V+*nHIn|J{g;@BUYRK3^EPS3aWo#i9 zJ`YP7TZo0vrJAe_iG|OuQ*tf-AvnHa4kTD~9N!E-$+t$WpX8h2+rDv_7T<`){u=V{ z)OLu4&%KC<@vYs$hk#`sODy`|B>yh_Lm(D@47g+i{vrH7mGPrGZBiKx-!5YfRHcl> z;sX!M$o2S#z#qW_z$G`3i+7$ON<9!u+Fih+f3JlPP~WVNh(-S}aLGpeLwFTY>V#Ny zeg|A?{9&Dxu(J8fc%uW=GW^K#LM&;Q1IzJ3EPS@_EjsRQx0sJ9h(%pTxpHNc}keArK3neQA#26AS+_ zVDXb!_)h>wTJaCzJBX2l1Jwk6O4~Gk4nL7C8vhVKB?kW(IJ!^siN)scfg>g@_lpE` zk4W^1ML!R?ga-!#_k~J3G%f;;7+g$j>a*IyYk{Mz7zARm$vvFeH)}qz@NWj5WBA0v z?*^9oAr`)~x6`8S>;gZsRpY(DZhKk!cLTfaW%2K&ey2`LEcWlGzTp!K|3P5!hgkTJ z0hgM3;69JwH-W_;V$pvKSo|Rt{x7KCrTrlm{;#QT_{75h1F+0piG@Ec4SX|R5er{+ zCA#9h+r4)Y*bj;iboN(NnR{beI=WkNZ%$KB8y^pE!fi5rcufHx?8ki*zI$ctR2{9j z0|zfEz*GIH6I#!Kd-vhE_eeD9TPU0?Qfl&sj3ftA+{`nH4xj(WL-mu}Z#OsDXbpKy zgI!0H-5J!HXc@%I1@Jb4fu_F1k0bt16m1J8r|RP|i(5x~On3S|8$wh2+U8!>oG7;3N&)iC)jV|YVHe|tcoEalr9>}*;F+k6GO6?La?B=cU4Fj?h! z&h(>Buqt(1iqO-rLqt&Nq-K(W_0`mSuHxlcc=5W;X zb|&yr6TbIBYSy_w&nr=r@2w4T-yR>G#cMcJS^xGf=T|>WTj9M4!Sv2D?*#Ph`k&r+4k-!#$G#=XphAadtU>#?R8GUb$c>Q5POF}+xG6dR5|xt(H@ex z_PEVq+v7W$d0&hKfkR-}_8u+4yV_9)w8yp*|MsKsv{#A9@Ej`jNmj54lri%99e=sD zU>J_1epZs#52z>MC(yHl$bJL>)n1WN&um>gEYa(MlKreC`yT_#!614Mqd-!2@^f)L z^=-5r<+mWRymV#3;-&VZlIHnH%}VvGWL0%lrIv2a`BeRym7$R2NZbG6<`2^nyI|@C==*oss!W-ihLo&w}&QAMM$I$j$GGEDi>F}TQr*X+0bi+?tRmTMtx7hyr#9hry@eH z&BNW=Dowlz)gNA$*T}o@pV$GryM8h_Hj3u~kHv@5)I}>CYIFS5yK33)BfHY&+2z*L7TUa`lVFBMqu} zA~86Yff|{3>W)Qs;JHxLT|9D7mF>xm;^pFSwCN;ubiTG zuDnpCU$Ines(UbeJhLV9pY~mM_xJbh`*hX9->4%Q<29ji*uWEm4eD2JYvL(Tw9dVa zX*aNi{seB6MIVn?2VtsvWpPMaA$TuYrYc4H0#_q5aPL^QBX4x&*#UWuBX4!(I3SHb z7fAqNsH$C$_o+Yr)RqN1?NGD_g1xd%FcLo zzM(mO@txAo8GA(zovB{8>~nkz-i!4elYWzXW{vi;H&Kh9R;jtw;#GL{I7M*Tjv9k?0%1(_yEILkGumTWRmJ)-h z8o~UIp$t*VPAqAc0L%NbS?5t!00Ob-u+BwiEwQ<;iawOGgCTqZvDD-{0xa!CEOwIi zHp-IUJ?K2n;w*>;I=T`)g9D0>8g*gUVzNb+ega0npix#cUFL<27Tw;}9LK^ROD%WJ z11*Q^tQ=D<&?i|Fn;cuS0!(bt2O{TXs}7VSy3pr4Pj*&W?&J!gJO)_f{dAGyQbo?%ru$C0Oy~12J=Tue*`!Ku?CTW z&ly~R-&{mYGTk)+4;kCu1|!3d6U5#LDA{@&AuTdG{1Lssfs&ms?=#@I#C+*9WgODD zPi@;90=)@Qg4p{y7`DA{!rlmYw8wLX*y{=S_hZP~5haMdn*;t`2B#XJM0*^9#oq4% z_Ub^7LoPw={U%_K*Ul%PM0+f!*n1Bcs&2cz0pbDB62#tb!C;yiBjEMZF9XvahcU6Y z2$=SGE@0qVyH!KyKV^&;;U9k`ye=6ThRFT`H2Ouat(R(zb~zH*Yc%#}2KvV!_6m`Y zomDQ3uLFZ}>arXhq8BV({70?P@bb%wvwfe0c(I!#Av;&|!@Z>6c>TOYhy7z>Aoes$i(EBU0fUDy8l3mqH#|CoCl_^66=e|!#` zvw0!G;1Wd8cFmFyVu+9cDpl_WvLOipBP0kE2+3wcf_XD9h+gd_Y&H-eh^|5H)!vl1 zDy{x15wx#2P=Y`yRW6`#s~2tcS9@>$W3SlOUzOkYnK^UL?AfLEfA8=Aay~4XXXcq_ zo_Xe(XP%ieb4E{f8x-7j3aRBrN_kYuDkEi8WQtY(|5u?e7xv{CI<;ZF#V^SOUvm&r z<=^VD(*AlVmbR*t@%?}(ZC2CU1OC=&x98nA4F`L9s7-|O@}?Vc2+6n^GiBV2nMNG$ z2sT19@}?nF(~6sh`CpMz(>h~X9^iF(GiG3QcHMM*PqwbEwmy(IRfh7X;+vB^Zu(Sw zV3mhv(ic2==r(Z2Di_RKaQD3nSX+BFzRK)xpGI$)P*7w9-B%oefudQ!UyDpsInJ2O zXhm~ADVnld(Y!hoO++}=_Vz0Lj2P*Qt22` zCJVCa(7TPhaPDf(!g@hzCMaA|pkuMjO<;afmuMsn&~P*`<$QI)S?VcF8E!h(u| z2v&_oQrfWUue8OSMO6hw71RzwA!7U(wwQeN}m2;mdS;j-58IcuZbR%)g!H zmr2oT&bv|lh*HsQr&Z-weMy^M6|0KtkTj81iwnvsBYP3bqbk?(KFAyC0B3gmkFH{_9OWOnI_g#|^hrqJ@gA-C+! z|Fzsk*#+h0Wn{j&#rQ9j{#WvUx%>0~9}HhRwy3nXH`KZPjn(*gh_PS5oi{ZXUuSk_ z)pvBXw$Hl7_H7xFK!P2|u03(0>k=517)_^q(r}7cfy1^CybbdHy0Loz81?09NytE9sL# zpXT8-O_b%++JSf+><-Kep8=reua(KfALwV<(wmj^*O1-Ohl1}HRX?;f0r*v975s!n>`T11< z)bc(sQb~S)1V7Z?GJP6g>%mt~EdZf-u0O<&cmz!Cqr#+5D*T)Tjr^}G@J}G0cLCG8 z6WPAol=OMv-+J)<0l*8)hYoWFsf}g+A1mpEZ^<{FrJ=l6fiKqUM1R_^;5Q?k z)^JpQexsy+73s9^K&F2S@_G^JVja%Ko<@29tiVUX-_L+g)gbT%0B|IOdkY4 zI{>>7A^AyG(z`%^7GRaWwI?E;JqmiQw)}1-Kiz{HRMI2$3*QQqtnj}hdHaqv<3_Ry zBfJiOHE^*M{2T|(Q5>c(9IHU%~$| z%BOR%l7185{|hk5obrDKa2kG6UcW@zG{7=_J>Ywl^uGr`?SN(dG{Aj;>D3+4`zMsY z53nqc&LbWNJjF=Y0DlVDZNU2x9*ek}4A>9&R=~1;w2q07_?i3+gP*?#Ea|NU{2X9f zJEijP2S0BD&NkpbB1}9=xF7J%fTtPhMS$rnpVXf}qPzzH%lgw9)@K3Jm{0UqBRm=U zCfo1#$Uhsf%)bTj3I)Cc@H)U!9=`{@Cl&ZxfDZ!3mLyL9ZouyXCYw#=!Q|sh-@+## z_$AbLF5tV2^cuh+1zrLEeg@cUr2iV_J77#C9I3BkZ2CLa2HW*}ye<6(CT-6plt=H_ z>H7fmWaBU0%j_2*Z|`ei#k-C4S%|+D-%t5bMEW)6x1roTeKfbLsgMCZ$@s}{V^CPW zPfSHvej9_rGJYK4Lmu={SjLmCU-e#O$c~m3d?wEBYB4PHiXC1W->e! zmN<7HJi&;ku#7K4csvbicqlC6OA(%6#8X(tmm@qr1^?lpu#6{rJHd#ju#8`Z@OT=u z@K9LBuS9r)5l>+mUyJZ~8np0GSjN{QJi&;ku#9g;c)Sb$;i0gMZ$o&35l>+mzYbyf ztqTgv_=gGK*ponE8NY$>jSU(UmhnA=Z^Tnr#&0EjV}AmLW&C!+H{vNQBRMm&XO{62)oQ>Vv6VHy7-!V`>m3d{JH5tiR< zps|}MDJA)GoL|KaiC zH{Li;Php8eyiG9TDJHYqhlj#4{sh7kjCcym_}3AZHiW`5 z{tV%#<3BtUmhl%5mgi6@EaTrnSe`?ru#Eo=;rs9(9tz9&-y%H0h^MfO{|MpnbMYS@ z3d{IEAUwf{r?8Cw6TQ=ua@>DJpJ2qRWl>$m zFBkX}miTUjCm8V*mhqVgk6(fR@K9LBXCpkph^MfOpNg=oBZX!Bbiz04NMRYzVG#c^hpL@z!BfWiO`vFymD=IV$HG1;&?O z9vqb=VwWh+Fya(vT@_uZEY3^*Ep)GzD}prbPmFcolAnw;_?G)J|0-@2Re7#e9^t$i z#h7?e)bKK-qs8CSSY^CN5ywJfpWhS*g6R@-E-?l5%NrtQUVh{+YP)LWzEo`cB>9MA zlsHM-8o)ti<74`P+L)U?`K_GRCC}E)&enC#)*a5)#m#x<(Zd*r5Uo3yt&5kf+m^8{ z#JCL9x>s4bOxa8|1J)JE*1gEqWysbI$kw&T%3a6inMW&No^-UXEw=6|wk{~PZYBP! z$0e-`hOJwLt*eBmn!x4pdSB~K-@ke!)4Gq>x`fxddDpsb z*Scf(uO8yGuFJLV$h9uUwQj?;uE4$8vCqXFF{k7Jmwbo6w zc_tO*cG~E(qbP7%6&)DmB~yT_zI7q3bqlR^^{jQ@taZt(b+hb${Uj=53*kUG3^ULF zOvD^Tw<6$%@`sNl2ssUSy75>3AwPtk3;0nU74H%y7>~p|3z%qnjra~Ybo4#-uK*@~ zD2>LcI1nRxG9UTHG+xVx@aVaMpGxmxIGt}Hj_6T!B)zEyJ;`4qU|O@3k1XeA#HsWu zur`!~2%;B{pQN|gpeOS^g@9WUGw=wcGej!A^PkbGNYtNZj8#`wP-A$ znvbMMu98~csW(~t(K4i@w-3Zrdi0*mZBnz^eGiaSde7Ws(HpJMy913)^zsZE3qfxV zIX}ijY4j^I{z`tIg3t`Nk7H6<^w9KEEjJ+@@7Y0sJjTjM33e)lHOSmQ|V0vJ@S?1Bk8>kB$eLxK(7KwM2~zpNiPXuqBj*kdc2@l zD}wxgN~0g$K|p`yvm1EoBhy@nglJo38sQmBSUgJNc|cFy$1V>d5`Xkayk)?XvZMGj zpf`YyLFrH6NA)0ImHY~P`61Vz+fuXU7I_z|*xDZJtnoB#c%8`;zWl85)*g+QHy!2B ztm7d-;tX--;eFlp^R+{{G4D(BUYn`hm-bxQU&_Lj6Ipr>oi%=(&LeL$L+f+y=`znH zXU*Txk9((RH#fSc%jt}~7tob%p2~fslI}ainP#6n;jG>lo7ekdZ+7=95K*`rH+aE3 z(H*gL)0B6Nb(futr(2@R$IvZzr<6PY#I1tbp$?q%J*C{fh@1Li*Ex;u415xD`k(93 zN(1~%@1L}RMsL@lR`s;-Rq}s7jZWq+2%RwN*w8sRjCi#U)Ld= z72a-_57q7BSW7;cA?x1K44mt=-+s4j=wNqVFTWSA2se)wkp#ZKo3wU!yk_>2A4`rgL6khww~@!m}grY^QRtUt(Ds0fX~1EJIs}E4zvXvqJg4KmrfZo~^S2hqtVhPD#O3LYbn_$Wu1o(K+TXFK*BSIxqPzgg z>%_TiAKR(VcD{#G*$!O(5uBUGDz^oTGQiyowljXkqd2jxSN6Tp=SrB!miBELIyvOQ zar9+RIDEKG&Nqgo>+}0Ios{>-N$u5Z!_Fgrd<+~c?zv#LO7OLA7JRN-lUSb@eaqR$ zaTc1lTH=;gZBtqHQ=YxGn&-JV+yKXK^)qjxy;{4aeHQXX-@qDn*8WLtE$W|;!Z3Ir zCf;2;bnTwL;G2nw^ZRD&t_ofAr+&g5yL+9U-A_BMR`wvq4-X}lJ{|b za}ufz_q+@q7lhKSx}Hr;)b)l3{i&fS%Hf{4|J4g@sWmP=@l|N1o(S4$_xJpA=P&mD z{KWB7ubmz~_p=L!R{mSf+jalC=6v&;`}=Zx_icV;xt&wGL%4ONq(-;z1)u)~ZsCLO z?McysyXR|kk8yBMpQiWuTcb6fdfCv*#U?*#71?p=p)b76h3^zDDEVngZt1s5N6q`} z>uZ)@SYEo~hbyL_2b7xF*_$0lf1x>i$5R?Q=qm!Q(A($}AErotw0Bc{d!P2F;(o=9 z66VP4#f`&#Xp3R?Q8(54vn$Zzi+gbYVF^zOW*x^_=`qZI@jKYFH%8NS|E2Fl$&h$v z_bpZ=t_|Gi^RK!b6VqLDQ}N_p9f zX>L>xq>`ul7l$mp#*K_|`fs&?{LtKjuwF7^#5)^?HXQbR?*+D=)sK^MaD~uAd~wWi zG>(PhUh4DU_7^?QzkN3gW+v(`eRTYPq&D{~G<(#{CA1sE6=#hnkD=u4wc+^D@u;`? zeF#TZi8UacVkA+mV&1oqAICO~RTQh`@oKIGzJuCfZ<9q88ly3s{xj#F_Wr z_0(W!M!{hBS>_(yI4$CcUhEXaJmUbVz6+WtK4s6~fXN5_-A^dMPip=rk%G%beaUTRS_&VgR8${@8hQfnP(e@EtV zwxGY!>_OV0SUjz2wOT5&#^5MI0-Qfsnf%KeN5rNz&;}ki!77a`8LjC*}ae(Tq&J%a2`pSG`(`oUo6dFD8B`3iZX zKg1csG3X_+YI|v|sMXH?kS@a%3nx2>X@}1xJhPnpP*WTzO4GZtl+2?6ZeR{7Rm;H=?)e%+~ z%J+q|LG&rTi+a}lKF97p&6T0EN7C{i?$ic5p3(HJi9XNw`p}d2LF@1xA4iu@a##o#&yW_@FF$JpBjgDns&eQ z-_qaC{MXX+3*KCKcJaR~dt>DhuO&Yb=&yo`IvqaW4 zbPTu6Zz?`nO!r%FFH7n3uNsD3I|93A&rRC23U_tKivRvB%MOUK{Il{k6&ET>m;P{R z_Ofp-OZxg}^VXDIC@Y=+!}*gV$MUVg?;T-|7vi+w^MzXQg>Egs`;Mp)kj9ToUt0;O zHk)I>Gi9R#7^yL4$Kt5`j?wiNPuvn+!foUy$>N`SmTZ20(ogtZ>O5_gpZ!FuIpG@q zpJv)Cq@#^Q`mR;isL9a z`U^OkKNxy}Ju=?2ei;00)?9J8*ErM{!B4)vmAwy+US^w4Y6I`hKV5XPczdyHbGMe; zAM)j=?DhIDonHW}QVv zuH+I&SieWFF?&BolFTGl6Z%MrNlsPMtuT$e+1;e~38_+BWAQkI5n$m~M>af&>|V&b zL>uw?h|?p^cvBNn7n?0aUeMl(w@k~QK7hV1YO%ny zsrIp#w2+nFkh&71uVn{Zk$c3_r6eiB)&!O($%!Hr~@O7!H^u=5`MuA!R4vyP;1{AlAxX5YA)e>Am>`jDhe zEsR^h;i)zE560^Sb{SKB2arSJ``I$>Sn;zy@}2Ftq%%|JgW@sB8M7hB(TR}vbmn-i zkOg0>z(`XIyV8L3hw3k8lYwB`~AM%nM8Svs@Mc
  • HTZz^mtkN z;ix`KACINqkEPT7Gyj}ud@Q}&^Zy%;m+j~u$4K*Kw&&-2IfuRZREhcjF47p5(BFML zE)DxLF{@9)80C$NwJ@udYA2|2KR2 zPvH2??VUb9Fu&EyXZl1eT@j6swa4GQwe9lYcR2p9M17nS9M9)5P>o3I{8fhh2}q;b zF#jukg5Xx9wLWzpPg_sZ$9F+^?Y;|sozECwdcK<^KTV_wUH(B^2}j zn2Yln{;B^jqJN)5dbC%b=XTqyy}hyYfmnL5*B-}XX)N6*mOks1=e_q9v_ITy|6R{t zg8biN{CNsd|K@x7(=k5>qJJY@egXUspgyG;&jHWRbgwMy9ry1-%%6Wid96=dFrTkO zy4cnCD#o`FX|6GBzx({M`zxHQwpluTe0@5|L4038oh2}wTi))sG0!$j&sP$AiSee7 zM@!!k%WsLL_j>75*uO8L4joSyBmECZV@P|5$L>Fljmle^*LJp9dWDjhb&T)%SbBz+ z=Dn6*!!rL>;<*@4kQRerQEh-qP!1>3OmA z?pT_?8E)Iq;JetDeXtm6y4P`gj={yn*>Q9PROz zEyu6>^-nxKB9{NzSo+G~pSk0)Eyln8c$eTSE=>))Dmaa~u8rwJCGeN&eeT#{vHn4J zun*Vr+#bRK+8?h+zl>`+ZS?&&1k)AlBX&qkUoV@|iK(Sl`>R_9nRg)5HASSbI6K_Nt<_$NaNn{aX}^ z|MRi@zl^m%Ki2;ASozLa`)gzQe;-Td$Nbr`{h1XTkHT2GI2O;4Sos~X_P!AtkB->* zeI=HEYplJl*m!J@jaPc@u<`z8ES`>7`q^0e9jq_fxPLE>wKq1F{#`8oF|qV-V*S|| z8;>u<{BvUaqg27*FXQ>QSoyEU=Ip2b6!z7U*nV|E8P zpD!e^k>zOu7dV|PeHFML&L`Y9;UC|(;Io0C( z>AS${3t9Rpa01sO+}^@J#Xy$l9k5~`OMj1koJ+ZprJn&8IGrs0V{qP=Z9K`+b8$TM z%Y%Sz09Y}Q<+%*37|7BG(a#GHY-H(4`khXeUJTYakfrmz-vlQzHhvaUJd5n!tDOhV za~Hm3m93@cGAnxrSn-qPX#y*Lvh-H^c_D+1ES;aHDR4Sj`YLe0eDl8m&a1NVB+G-F zSV7(b)5+5NgB2TD`arN^BTMJHkw4hlB1`9MjRL2WrKi9eTe9?V-~?anV4LDG&y$H{ zCCe&cbh7l9!5Sa3^poJkXRV&MJbnkPc*yd<2Ua{}>1XI4Y4wn$zfZr@ z$>-Wa$&Zs)sCn4)uiy z92;5s0&xCSRzF#KEx5qxWa&%6c{NrKS$Zcp!IKiUC&)#{Pk}Z5Wchc4HU4Djd+9H> zvSjJc(eHG!^aEfW%ltlr+9Jzy7_7F)(vQ-Q>wRuy>Bs4JI$8QDu*Q}w{atXs607Gl zSTT_0ISW<{Wa%H!UuI>=(m$f#>164-IL|8vvh>Tq`7S}0J_uak5@hK~`pd0dvh-o} zJDn`Okbd4=!A6$O>*NBblckr@KgRrI>0{`3I$8QS`mZrRS^9PKJDn_jGB|au`KN*N zYHd!E<(UOe@S+CW0`ljK>%m3ijqe6)K9f~;D|L6>LYBTAocO$z-S2tG^1SZpWa;mL z6W3YU_dUh~7=y&0na+S{RZRH^up_{JYG;>BTMfC zPRz8j{lSW#EYCo&;wMYbr~g(fOO`&Eey5YAj|A)7Q4h{*uz1Mw@H;1pfh@fhtQg4B zm(oAmVjxRjLBG?<($|AEhGgkm!A0&h&Ld#OK$d3*STT^L@1%c@#Xy$6i+-n*r9TT+ z3}opCsq+F58(I1haN>5WA3t9k#YUFrRj^_sOMi`icTG-~eu{pllcn=MRgt?^AJ!Z3 z++p#M#BERQlbu5Ly2DV2v|b`a-b!LY7`n|9q>HEd37p zolcg%46Jb`OTQ1Cs z04`c+{sZ7tjqxFJt?@B%qR#kLk6#DpHQM--Rp(pu)SLedIJL<51M*_yKDcL)x5Ubl zRdxjRCez8%i@}L2tZX@0V?vf^ELdYgmOh^T1}jUJUI8v}I$8P*uwHAErOyEu-C^}? zrKj2AB+K(SIB}bnWvHC)m|7o!LLYBUV{tl~$ zEd5#folcg%A6zul{QSxoB zR$FB0Z_>Za%95qOO~2F0($9jmzLBMW3@%!3_3#4&ih(RoFR)@DOYcqp3M)&N&d=W$ zIGrq=_YoBXS^6-r*3uSw+_eW;o)uulMwY%3tk}rX*ML)ZTWp%SAo?-r6v}tUt^p@ZZjSTPOLRfk~@u4OG|2N^j1QB)Vf+z!vvDt6!zS)G=67=YZ807QPHi>5%+rTZf57yyVEnvC zxbgGs;z{IhnLd;JZQ}*x?-)0MQx6$0B|m7q4BU@5^|7r1Yfa#Hbv15e^>;m3<3^Ug ziT+2d9HKb})-QRt#k6)9H8T zdb0GH^gEp_eLh$*kfpbR6~js}exfPd_+8(`4~+TQcf}Td4&LNo6LiH!R-K#acjG{o zzLkEblchfbE_%W$vou8x2{|hTimi{FDPA5x$7OZg~OFsbCI2;5k z2C_Vdz>0w^{RsVTog_;?M!(a^(ocaE16lfeV8y^^5hw<-JZHg*fh_$4`k%CMAWP@> zdJ3FQmY#b_ItH@zNz~o73RyZoFQ$0N(r1Dd4_W$b`v1z}Axoc2zthRm7lSn>Wa+Ko zqNl8$mEgqxGVY}QwDCHyVk4{UMzCTdOTUl)A6i+m^!w>|I$8R5uwo-ie+sO2$DRx|5bsT9;?3&bh7kyU|q*<1gkBwJpAsz z+9FH8pZ;g8Ewc1&^gEp_eLGm^izmVOk;ZV_164-{m@_c zJ_T7iKd+tmYpbUWtQg4hi~%bKvh;EEKW}Bp(yyc6>165rZnI(_OP>Qy{M7212UZMZ zc@}^b16g`4{V!Nqvh>CDJDn`O9jqA0((eWr{f*VLi5~aa7_vND!HSJ6{Xwu|BTIjn z{(V*_S^9SRolcg%2dv|lEd3xj@uJmp6r6JWs>iQ;{02C$-R3q~^?XFneyb<5Kk9Vc z8=Ti+ezN?RQFr4&md@|z=PflqS$YXr<3pCt?+j~v$kNBs|1*n+EPXuvPA5yB3f8_O zOXo976hB#d6F70e>R&|95i6bh7k!z}k0Y=^ucLwpl&B@~|)d);Iw!+HTC}ttd9~D3gPM zV8uq3o)6Y_ELr+su&!gt(no^zTD1(EIAjfs1?zq+d6a9n!t+c9D>kw`Q^AUjEPXmy z_hZS@XM%MlatZ^VqpGN=RTUoO78T31yEPXDx-$L^*1ncC_o-<(WBeFd2gSC&y(m$mCAFM1{`p5J;oh&`~ z(sT@D>BGQ@lUC0(dfahDmS=&dlchI-i~iBdE~RI=jX7DKmEhEC=DCj^_gM(CJlnvD ze=-lBd8Bb5%kv0W<3N_agZ|g8ELr+a`khXe{xn$cM?42koU*b9zWz>0?~ z{TNvBkfooX|JPP0S^7!(olchiHdu3mEd4C?uUb50={WC`@njAO_u&JSodLGpyz8ACt03@;KWvPtTz zO(#nq2~NCYWsAXzpDa%qSn-pkkD>qHtSnjjIQpGVmOd4%aVATj15Uha^~?h+2C_U0 zz>0w^y_WvpSy{65#q>L!EPW|h#~oSvO0f3zI(q(()k&7;K5*i+>07~ylPu4JV8uz6 z{xJQ&x3XmE+v#^YS^6%puG4md^Zwn+lI3|0oH%RxKCt2;%X0v%c*xRUrvDFCmMr}+ z{Z1!KKLOTfmQI25{%B>%^1KaBd|>)}V8uh0=L}f!kfpy*|9@Cnvh)w>cRE>muglW$ z^aX2wk>wc(PW-3UIS8zH$nqq?iia$H82xU)kfo2L-|1xOWnhiZc(CFj%QFd__%DlR zDp>K5<(UpvJY?xJ>38jtrO&3{>162(z>239thUJVEC#DBvh+s!Kejl@(p%_vI$8P( zaKByV?*yywWO+7$6Zi%uxBJ10hb+%Fu;L+0e~5n9N3!%s=yy6<`V(OFeLq;Q#}87k zvN-vSM8!Z>*&|@ZK$d=t{tSzsEd2!iPA5x$6RdTHEd2~vuTT44j&paW)j0sHc*yc! z239;|>4WI!gUPXxr6=ikI$3%Ota!-MXMu})Sv?EEschpGaKe4D{%-OGrmq4kPO|Fh z1S?Lm^!1_N%95pT3jL;&r9TK(oMh>{sIRf}7g_pVa4Og8d4V4H1x>O%hrx-9%yXQ6 z_rQ*mVD*J8|Lb7&g)IFI`Y*P6$kN}U-|1xOXTa(US$f}mjJb^t&%BlBJKO-|1xOlfa6NEWH+7l&~0@z^Q)5?O?@2mVX&o@sOq8O@DtY zOP0Qhey5YAZvrbGvh+RF-F_!ae;%C5v-)44r_)`Vd7guw=O{h=QW`e0>Uo!Xmz5<; zKMPJ>YX0}ZS~vJ0CXEAG{$5~>16g`+`UhG)Wa)kAcRE@6Ah5=PEPWU_^(m`o4n6Mu z7qUDH!HSJ6y&kOC$kOki|H^Pk0kz9*OD-QA-mOJ595e8$>p0;?^uJgs20MV7vles?dLEPVz2PA5z61nXS98LYO*@@xgG zEwc2-!Ri-T`eAT_Ukt@|njUv7kmdP+o}uRX7_4^5@??HG-7Z;r4mkhTu=;>3J(qr` zlcf&;tB-v4YGRnRTL{iuXKM>t{&MPHH=QiKg8F*X$z5k9@m1^ zU$Xp*!5U|>^hWyKL$1iuTj+N>S^6rl<~CXSR_YrpezNpOz=>@(o;$&cjV#YDuwo-i ze~SLkS|7>Mchm25vh;mm-BTq?KSX__#YUF?4t2LL$kO`^M$99v-2oo+JGF@`O&KO@EzsS;4^j~FV$3hK%^8?_#du;xY$!HSN@0&KZ`{{9?`z6bB2%IRlwvK`| z{$zQMgEjtS>95ki!RjYVe~o^plcm1}*5`iT1t;8tPfvr@E?NGwV6{t@{sH}CEM~Iw zkLY(gS$a+~J;xGY-4`Oua~U{sjnz3Ata!-s3;`=1vh)%3|3?sRWa))q-4`NDF9+*f zJPw=~YwcbKR=Z^RCxX>3S^8x9U4O~ar_%3qvh-PC9cv4~x?e|@XE8W&t;N#>Ry<^R zTEU8kEPW~cOMjDor<0|>57t^u zmi{p~G2ZIQydur~9#!J=rVl3nneh;?;v}n{5n#nhmR?Bz(jeT((u?VLI$8QyaK9(a zUjbHIWO*im)fQR$6#6SN!opwnebQ((nOmj6w# z;v`FdoBl}|VLfE&?}7`QPL}==SaFi2_a6e?eO`zxeHe8YKUw-1aH29JY70(mR<`ky20A22dgczJa>TA7Fl`|{jY~12W083^gEp_ zeFeDRKbwCYSZ$Hz*$7r!Wa$rq^*W0z{R!&#WrmfKr9TbU`wn}-YKtt-b6~Yami_|$ zQ*2Dg()ZKvbh7kAV69{Cfb+hQ8OB4F=L|S;qt*EVSn-hM`3S6d$kO?s;ryvqmMpy& zxWMUT>3zXE&kg`5ZnCnMfz>Wq{y|{1OO~Fb-z!$nrFS6;C@@@sQ37rb z+9gY0MZeR@(l>$?&sK2iO4~0Fdi)UCyCv#Z3Ewc0+aQ+vpEwc1n`khXe zJ`k+)HCg&FuwLKsH$xNyS)LSF{Uu8;q2E1-m@K`Vey5YASAZ1*S^5m>-?V)}mOdBU z@4GfW{5=`PMwVwGSh10%*VBKCjSpG+9rQb$EPWYRv5}>(1NYlzF>C}Y2C_W&ffWN; z`u+6Jv>3?Jx6$u(vh+v5TF;*YCvLT}hsk`f8Mb3!#Xwfs6JW(amVT1{+pH{E`s?&N zohv&uOsQB1=C@|7>fEEd2xeolchCYj}Fh$T zvqtfd<-ZK9c*xQR(eKXDWa&xzolcfs2-dl~9IUp;@{9$mEwc3S^t%V4lBHMB?{u>C z>0rIaBuk$S?&sd$UqFvL7n9{#4AvUk1Xi46d0N4WlPrBH{cbHKOJ701)5+31!I}^J z%^bBwmS+=KZIPvKrvDM!k7Vgv>32F=`XgYS?{iia%!bzsFqmOhbwH{Zz8C)4kA zvh0?~{S5tX-;t%iPruX2()nX7T3ZH#^X|9v9a)|c;8eB6QwUZ( zWO<6giia${jQ)jImMnb?{Z1!KuK??~o&r`|WO=56)fQR$4Ek%VEwc1k^gEp_y%wx} zL6+VMPSsjH%gA-c{4FZQLzaIfSn-ghuK}m(t!yV)`-Lpeda(8jS^E88-5+=moVUgH z3t67+;KU-Ue%M1R%~SHPtm{F%95q;rr+sg>Cc0;U-p637FnJHV6{b-{xbb; z?vbS*rr+sg=_kONll*Iz{Z1!K zp9$7HCrjT5PTghoYy~G;jUOVn7(Y&KGv4j-Ua(>&tIp@ZikU3^1^U~q98U=NMRRk)@xYf2oxvOFv1!)5+4`1na$(cfpCTSlKh=WyT+P{1I63 zkW~+Vm_zZ9rS}5oFSmNg(tFeIbh7mRVD+89PnW;K%97=|3|!!Jvh-nK%{Q|2a&9h_KVF{~s1x$(o~mBvq# zzh?YASaFh7&pxo?BuhU)|0*j>mi{vRPA5x04A!`jrN2&ntF66c>2HBktF8XG!TLi8vvSjHg z`khXeUIJF%$32F=`g*YXMV9^`^?R)zvh?lX)P1J!0IOfSz(uaV{C&d2H_Wq} z?E3NoSbZU@&i!EZg)IFb{hO^Gvh+jrJDn{32v~g~OMjjEH?1DB^tZs;NAG~um($em zH~;%&7k}ne>G;X2CkL$f$165s!HScRE@6WU%5SOP@`Bo7F>>J|C<&7lIXM6IgMQIR-Ajlijyq=vtY$Zmi|2b z-?sY6()ZEtbh7jVV8uz6ew_M4Ru5VFYhWE~Z-EsXS)O;mij6G&J^H_6b&{o@q2K9b z>FDN);X6rLq`ed-;oB~#yv%rdzEdLy^;v`F-NB<)hCt3Oe`khXeUJF*7Wa%x`zi0K3 zr7r_3&J|$Axely2$?|UmD^9ZX`{>_p^^>LFPruX2(zk&XCt3RAV4b_4AU9c^Pl9zG z=kN6@HnPg@1}iqQ^u6>yYW0w%KS#gQ$iZUF zK6$6{V6b8!tLzZ4VjxQ&LH`e|ELnOX{Z1!KF9-K~-0laC2d5slvJ=6HCyb|(ojx6` zc*v?}CRp*1rO&4SFRUK2^ttpqoh-c;tnpt5PVBO>+rX(Ojh~?Yl=0Kxy#JME)$=U< zPn-T6SjX2s>OVC75c#i+kAf3_X?z@9wA=V3JwG!3h@QR1y^7QAlGSb>aO%hA=?hl7 z1E{-p`TGWmXUsE_`W|Ec932F=`h2jCYqIqFz=`Lqo~`tJ%hq$UJdaR+&~&o&o#518 zTiGY*`MPM&rJn#7{nY&YO=Go1 zmghCF+9FFoMgI#{mMr~E`khXe{vKHSk-uN8w#f3F1*yJYDD!D^Q*oxiz}zt7qwOCLCrh6Q?&sEI{=U1~BFi%sthUI~r_=B1Buk%3zthRm=YiE0f2&(#lc zt1Yth#q_^uV@Q_XNWas`(wBj?@5s{EQ+MxQkfm<}>pf_Wd`2G||6b%$ z%fXs6WO+CanlohS9FzQ)tt?r31-QWJWa(4EMSpAl>EOg64Nm;M#r6U{ z?sovm@*D)Gj+=*%o=Lo7%xS7;S&-$=M0V73g||7dy&tT87m&JwW3oGd+@|88v0ng34r=Rc2q zjX7EM%%bkboGiT^ta!-Mmw^=zSvvP){y$k?{C&ELey5Y=-vm}XWa-<$MQ+@3!HIvi zItP$X8D9ogY-E)k1XgTh=}EBWCt3P1u;wROI>%YD`D0!|-HjDley$HizqZ)8-xL30 zoDWXDX*`7bZ;ZL$Q*Rlw{={#M%fadwS@n+vt6ya4BntbUQDPX!mfZEZ~h zt1YrTGr($#EPWRJt}U|kIrKZ7EWH-2F(gZGr|!m(EPV~Q=wB_iPOxGl%d;M=*vQg3 ze-xWPmp0SyVk67{5V+_aYwKZ_0 z9LUnSc4-`rgB2TDo>#$&jV%2&`v1-PMV5XFT;O!F^moCEjV%2vxaeK0hijug&rFtQ zAXu@HrRRec8(I2b`hSQ2VIxZ)0xobmS$YXrv5}>Z1?Rtq|6wCb9}g~YI$8R3u-=Cv zOXn_6orZvo>x}wBmZvXReIZNdIb@U+tb7N&;I{7{y%u}zwgEGbgqqho+nv-=XFc!1M?SpTn^SgBFjG(tbIh5KA!&n zuzJYSE5HR#CrjrVu6;z7&M{X!bIBiCo%6tohb;dBu;L+0uLbA-rr^h|xlq}CvV8uq3z8kFA$kLw!CqA}1_mlr*%xkKA{s1gCviyg@ z1x_bRKMpSX$jZI}*1AEKCtPz}%>J75k>@ANpNs19zGE?vrS}J`k7Vgwi`2*Xx|E+` z^~Beu0;l`yQX%Tm_>)!tb>Jd5KP$lbnN}xRo=M;Wr<0{~{n7Z$0Ow~}S+YE{zy(ex zOJ4}qbF0YG?*J>FVH`vEoC>l$DR3&=+TyXJaU;v~iN{fnl^yT-E5HR#C##QZ>9f2D@&HnWw*fTWa(?b+K*)Eo4`eVte*S8ih(T8 z{b0pFmcEVtkMTcjWa$rq^*v&;^qpYEK$d=tx_f2_S^7zE>SBxSO>m;GF^?DV8F1di zrju3nLvZR6(=#zQ5((qpoImb40A%@jETsCGhv(l!f8!BgjR{$P9t#>1|F|foKhMgN z163Vjx;7@>65{U0anjcuwo#~!{bOXkfqP0|57VUmOh()r<0}6rGKFL$CTKYd_ezNq%^gEp_{cdpHcg;_hzKOc~jy75PR&eTa^FKn*BWadrCq4P5?*SJT z81MJ^05~zobiQQLZ_JTZ4=?XhpEeJdGrdM8%flsJ_2hz6gU!#O$^T56_#Za1^iALbr<0{W2-f^0OW#4A0yeVrUEtJk)1Sg0z3)Jl=Q-+Z92;5s zesF4p>4)$~YwuyO`bd`lC|G?YOFvHkXYoI5Wa+Ph3!F}t{w7#+k1YLNu-YX{KMhv9 zWa($=ABq2ABTN4PT;O!F^vtaEe(VKSTV#29gVh#UdLR0)w6@676ZAWsEPXIoeI!dC z0WP}8>gkWTQ&$-e1Q(@@^TCRZtg?f_ij6FN2>nG?mMnb){Z1!KF99nyvh)Gq#MM^M zWnjfXmS+%HF_5Jv!TOCGvUFba6x@UVVe_wlijgiVv9>0G6Q#yez-pJQdZvNZE?N2v z`d$5G>9go}I$8Qcu=-AxzK;6$EC#Z4UVEgtKE7h%EhWaM38M zC!DuqjX4Jr@!70aM$&*dL4qSAD@nlb*>M`e1!g)APQjQmZ^R`=Avf^n3C#IO* z0@hfOKMgLr$?ACloS0^O#N!j>n@v9nR-9zj^Ey~@lBK^vzw0|$`djonohr4OM07W@wzS^8z* z0;iLu^Ac0zK$gzas$vL=Tk9IDi`(m#wHLRwHCDA$x3<+))igHLHMLi@wB1?NPz!2k zUmh%}TT;`4KMU(>+Z)@eTJEe`TG!f8zdRVWEC|c@Tvc0LTU$eOQ&oFI&7F1aRcI&f z`$}s=dtFsqM@vg{YkOU7RZDXN+OBVIT~giN)>8qCFVw5WaYIrUf*i>sSz+ZI>fS%)YV zo#Sy`YFJcN-FV*Ix>k&MRa5nny7P}pO+)SZGwYgaT9>!9SG6y$YpPmOU2{$t^>ytv zi>n%%S~}XJ9bH?uuwzkGODlIuO>0`m1gNbG>kEo&nwM|{qB0y=?f8bKhVB{ljSY(y zBZ$`OrnV)_t6S1mm$uX{UQ$(4-B^PPYFa(LuBLWzj~RY|egOtiiz&LauIkRZu9O1#-vN{l(zQj_Kvpr)Qr!xZd0>ovm0a1<0a`f!{8TT{-effPiJSBa8ktd(C=py zw>GrZEG@2XZ*Of_*wJ2xP{U)^pRhH}P4!jb!CBMXd}jka(~8^LTf6m~$Fv)jme#r@ z)otx{t>>!?hWffz^r)_?xfO+?io)=)(>huriKCq!&abpqw|JTCChS$=ks1}LX|Lj< zvZTcyNxwts`r2&nBUqVRo3RJ0i~pzg*aC-6)h%jnZ>VnP+SJfg-yB7Sd0kW8R8^Z+ z((43{KQ3mGmpQF<)wNs-yJet~wuVJ%BhuXa3me+8NJPasER=nXRn|1LEJlSLTo*fV z9C0Cz3Srbbcr0SqrA3ws_k3$zOJnu&s+z@hHFpNZP0j6f#Wzg9tq9W_X$_Wt#4KrP zh;-Jnq&8fF>RX$aV1KqPjxxPM^;Mhz{$7hmjitM$$D&;QqAFPm!-N$SjbVte_I1nS z*!W{XZx1${j!MhIfwT$Rii3}#^BfY^|39fW?y(9On2ktK+}OBuNmX@iE%tQxFfAnO zg`ek*Sk=Og`lxHzL+w1hRjsINZEjdm7iDlf*ykn9wRKjV*ZXcRe_z{L)-BskIW={y z?G5z}HCXAo<=U#&Q?8q)?aN!bmx%8Oo`bqo8P2yVR*4B)y{LO;8_vGix6E9Es{uc| zzO^pywabNbGQz{GwXOyWQMZ=4tc0fvyBfjX^5>;yd^pqSvp3>zezZd*DQHa65m@o>Eg_d`q%PX|3^uueA@ zv6e5wg=M(1RkgL$rEB#X{$!IsnBlUBN?6#Ae>+7Kqfa>HwO231-{nifzu`%+_}XjT z>9BZgMAt-AIwrz2m5z?YG?kV|Vwy@vMPiyt%OWvNrKOSRQAs4GVQds{MAt-AIwrz2 zm5z?YG?kV|Vwy@vMPiyt%OWvNrKOSRQAs35aP2iwyb+aN6JeT4$3$Y9N=HXxno7$f zF-@hTA~8*+Ws#Vs($Yxus3a02xOPkwdPJqyM3|=1F_D<2($SHarqc3AOjGHoNK8{{ zStO>Zv@{YuDv87ht{okP9#QEv5vHkhOeChMbaW)9skA&2(^NVt64O*#7Kv#pEsaEv zN+L0WYs;h1BPzWn!ZekRiNrLOj*i4Mm6k_hno37SVwy_JA~8*+rIF}SNhC&a?Wid9 zh)S=CFioXnA~8*+qa!g*rR9;BrqWT7n5NRQNK8{{X(W175{aXtMVu=pPjh%pgx7yH zw&da(hpT8+nfi5YL}Mc=y(Ypmm5zzTG?k8y#59$bM`D^vM@3?qO3NZKO{Jxg=ut@| z0^Dl?tp8=j)Thq6v8<{z>QY2wBPzWn!ZekRiNrLOj*i4Mm6k_hno37SVwy_JA~8*+ zrIF}SNm}%~R9Z|u>{3b8rHIBxRC-N>X(}BPiD@bw9f@fwEsw-Bm5z$UG?kV`Vwy@z zBhe>{CCTv4)&J~&f1eu!c*`!@j^<_r{Jm#wxYZVJygy9Nv1Ir?5QpI(-0BLqf53YU zao=K>$3OBNhp!jX6%?^8SQ!Mo=X(|YF&^gi!N2E_@auaR8j41n>bnO8d>`LicnIIA z(I($I_*i#^%Xk&-4#Q1rw#&XTkL^ASV0|iAQ4$0#NNb~y+m8U`3MR09gf|ZO*(%n@ zIGM-#asYmOPoqAKC9+@^TmfRA-oIDOi?LBP*}u-%LBk9ll&7ykL} z&cb(z_!$~)s_**{{QCC%E?wWnE|2vMi0zM+WkK+uD#KsZcL{uceS`i_5X^J&UEZHkXyW%TPy{XPhuK+LQ! z5C2pjzed2~+E=fY2f;#D7yqcfS7Y@ZKN|%5kk9%q#Xr?|9PHP3-RPd{`;{wGfxq0g z{vlo8r;t{Cw}AcnwxhmA3T{(;(~$Q2I}11dXSx1f?((>QC!nK#eSNOM_rl=QruxRi z=hyedf8h7nFyYx>el1P$EeHGcm5&R8T2+R>s;}LZsc?A*GBSeAVAjX4wyC~eSg-v0 z9z=aO-!A;sXp#kzrHn}3xe?!+@|^{u}p>2@9vcm9B}nr z;qt=q!&v$Cy)Zrq+}qG$N!2$VKEJ+-3(#M;KZbhseGikH_2DoJx3kv;!S(?zfj`XS zzr%^{zOA>W=Pcc9m;d-SApKZY!tEjWY8~^B>ief`V`Y5|pTE(^jmHfBYq3-i(C00? zVSUUiya2vwe`*GI$;1${4*R`}8F>r|L4U z$qv3Ys$*C1hr{OQN~WE2j)xcaKcF8*O5a-e1hmrqumTl!p)s_%NE zYs5M!qq-grh6Y_h#=h+A*Sm&9`iQN09UoqT8hYpDKF(TZ{O!HDT`HCF>)b9xmzcfo zNL0eKl4M@aH?KO@O+C~#H%b?Frfb>NnXzw2XI?h^QO%0^$2jb^tjh^LJ$Xcwm$ALB zBQHDq^xEW$7&cXe*Lpm(n^>-Mjkx<1{zEjhh1 zw_MOGdqmfIy=#XI-oT*qi>DZ)+H}1Z1$kh9%W>=rv%Ki;#7K4*UWXyI~2upZcDe{ zweG}@<2#QXI(p>DvBM`0?eDy9{kRQ#H=w1Bg`GQJu36PP$m5)8c>wdMFgs)Wmh9vI zm$s7CP(f+>Qv(Gwb&q;#z z{_%VECuj2AYp=cb+H0@j&pd9T%EDPGyc5oAyXrb|NW#Kytfn=G3e2aK)0vhi|wrtpGJU zj+(vFRdsKkQ?tDb@)kX`DD}pV=B}(dUKNK8(OyS#iqMN9=tTwSMfvDOd6TE+Oemk4 zlYQOPoN&!lUDKk@9i3^Z=rbv9pSdrX98XJ2?o-pzXX2ZouhnBhfBE2?v!bz#r`14} z^l`2>5ClihK_0Q^0M9Wr?z5BI8gY>uC0X3aE zPPc@om4g{6vFgXIevs^MmDlXO#`3vQBU4tXSB%l``BCVr8%N>Um)@?+Q|?kr_U9#z zpe?iSJK^{)+iPT6a=zZKQ6nbLHu;aa{C$J#`~PokS=Y2Qv!2sY&(Nq*YVz#f)TjLy zrn&Vr^kzL%lJoVZ{%gwQ*~9P;QP2N3?V8*+(x#|u*R6qJ+UQhhkT3LheJhyUrk~{l zx28=T)(0+H-}TD&m-~+#dGVFQ#}4j=r}xs+KZK{xrl)`Cc=~IDJYAuuvPWYqo`SJB zg?_&K!^agy9sjt+u`RFZb;9YXK92aIkt0Uut6hot&e$NM)5O_Vs%*=nv%BWs=eG1m zWh*O=S5(g3J2$T?7rrvsU*A0Z*1>(9d%JgSEZ7(*2&M#bNBRO4TUAkawmWWY>J73+ zpFP*uJ-79*ZqLQ6A4*MC)3Fu|jToW2qrIsMCNFhl2jlJgL&4~M9CxFg1>0h$Z}MSH zkP@u+^%bjL%mp{7r5JT(B=TXjo$isDfXucMaNX;0^^KY1<@!3fc9vWTX~I>kYOxwP zg4KXf3OaqKrenDoN=b1v-i&HB7VimgbI!a1NTHW; zR)ddivwW<^nK8wKE}h+*)~@obIX%ys;Y4Fv+!u9Xed87tr1<)#2ipRuXIW|8(<&Ox z4(5z~H09YN+h2YXyNG;{;jTt~r=~65j#WZGtlV#`x`v;7_AV~yEOM;pJ2^aOL8sTY z`^pL`wpEOr`_YXnmmXhQdDC3jb^ZF(UuVCT_p7R3&i}>2pD+2@(wAm+|G0bR#%DW2 z_rCVG-q!y{KP~8qo&Hc=5f24h?=D^ZI~DBq4fF)j8x`hlRkZc9W~A|Hc?q{|hV#*~ zX+E)@$AjscTc%x@wlLv(SkPL>+?OUTG#X=&UW0g7AcK1Z<>4!IegE^^ZPQ&3_U-rf zCHA=e;Bb2!*D~&U;l89;c4FUxf<@aFjlA*Cb5~cLsH(c=TC~fiwA)o4#mSNU&2UZp6L~IPAI=`j&C3k-RiVvq%3ea>L1s$quX~N&>zh6 z9q8zf<_+CyTmI3V)wV9$0qO0Pq3#dv8J9jE{kO{XFnG*Rt*Wl$*~D)?*IXFL=h=i; z%GO1R=#G@$)Zzs=FLcYpD&S9C1FD2>8|uosXnN3}9!hH;vG87Z zlsS{!p<66`Guzl#73%!UJ>yd5Vo z3vi9L^ZF`h6xcNWbcWk+e8cpO)7KC7cG^pwJZn6y$5>kNAZ7&NE%^Ma z&WYA}yIyr(fi+J0&hcD1zCIq7bL0)H_aa~4J47gyo@^4Pueoi$@`%Az!rBV!3U`VEf2gzmAv{ej$< z#`ccfI6X9K;}x5uycV$J-V^uw=J+3EI#a(M%`>Q#U)uYnP+GaQnk8KYzL1yrw5*}x&5HSRe>}IS>N{0uU-RdiRxc~Wcy!(k-gPu> zQhdWQRb`x&pLfHu4AUZwH<+n;H@xAj!kK%gH#Nzcr;}1eDt$TQMpJ4qiaGH-sS9T- zjCd;0Kg!pEHA2R$MJhY-*)ze()kzlW^Hs>`5K8>zp2xxojF6_y+OcLa&lFMW#9)fo z_SV_a8qp1U`8see)@Ypv&46BpH=p`sZ10~wIOl?Bta_?1v~{90t`u!e!+PHrowsaz zWpB!#?%A3Wx;HVZQJHzUDsX$+oMjJ3dq*VBkDZ+A>q(bY@BFQL2J_8%9%n?ooheCe zae8gGaYfOzcDTVz@kQNpP@aKax4!Gw+h6Pd)sbJm@{40XKmM~5FTMHGw+_AYlXnLS zHigU6<|NHUouL%W%_-XxzRLDWchrVoZ}NH<$B>-`weYQXoE|G$G3|5%(>Qj2zN@CX z?)JI4H7gHg1$B8Xtl-X19hbix2o#P^k&@Y-ZMEca+w?5oGvkkrm$+4zA=a0tk;|GTiLFwJMi zVr`>`T<=z|OVYPuRg(9+TCYs}ctO#k?<_j|#!u%qRJ~a>|C%3PQ#9{8^Ul6@Exco> zzBxLjBX_h)o7-^+y|cUpy`a`<;o+>;)|jMC-$zS&dp3^h4SsUZR!rba6H7i*LSG&F z5c~9K&iFY6n{YibsXx#2^{rgGO@4|bH^A!5&5N*34j+xSP zmBAX{;`Gtu#(W@t#MIMP>YGMtV8SMAws?7LXw>HEy(yco*c#>io259@*0aSX%oZDqw?3JarvkxRqDjPaoS1~ zPiu!wWwl?@8K~T&(s7@~ci>T+Eeu3?2FH=`Qs0cvwa)bQZI6CCxVe4P{_jUe@7Jqk zu9W48-KKbR>)J-Xqkt!tSK?9bFdp`f-)_Aq)r1GQ>TipMS2c(2#8|kd(Zz9r%?3-e z!O|RdSmI#_4eOUdP^OJs8s4A^*Vf}5swSptq+cSbTQu+b@Z_S>NLW8w9sURRq4Ooy z`(X})en59H!=zQ~*2X6_wKg=wnX$9<`3h6{;)J#SRQk~@~Zz)`C8BTZR^(HL3Gb+P;MRZb`&eY7kYGys0!#f(P!e6d$Srxv_ZMMtKz~wgcWl8qX`sfB1eNe3J2+DXaJIq&UEL-H( zh4JE8c25(`Moj-ci#eYIUCnCY8SMei!Xx=4=$b%7>_yg6i*p7es3%Vm4CD@EI`S^b0c1_U~}JqE~7D%xCcy^c0~`e0wQ-sQ8$ zX|1gNDvDc%eo=xZvEOzZDruNp^|uX|2`O*|x6Z@a?pn*Oq=GQFHV)(7{>5I&toj;WHu)misI- zSYu;Y@zE#a@h5d5;$a+oo~aCn!~v}!ai-%rB|k3X`|+5XACHIm`KS?Yk@~Ux^7EM@ z$~F1RY?`F~Ps>%&X1p+m_pMf9^2X~qVf!t{a7l3yo;D8WuWD&&Y@Ru3(k+-nT5I{1 zFQ;RjWfEV9D{O39w>lncDFR2Bv$oE;qNKQFYVnMcD<-P)A}DLUyQ+K>08=u8O}CYn z)R#0)Ua_{Mv3Ny{KXcC$ zfO^zM6ys9`7C-ku&_VNaPd76@!-yxB7gTsG*9xog>sKQzd5dhC!j-dRew}`UlRmiPrTC;Z#3e` z^3V0?uj8)%I_~PP>E1h^hYF$CzzAd!oi0RiarMaA?EX$jMJZ7`8t0e(sa=AXC;a!p2_b%cdg^^8tJQ$ z-i3HB4$A)ogYwhBd^Vi%F&sz`Zh%ku)%ogWq_aObUEVI)1;CU&kLb;=jUplZx`f zpo#sLI^}Er4Mu!B_&L6E>=*vO8uHd7y$b1hM!GxxUZBd5-snmHrXl}-!#)oo9yap3 z?R$ZG80j2eFrQlGC)*>-vWMIMbo@T>>Y(Fpo-B0$?Td!Do}HKayeaH>!hAW(8$fy4 zph^1UM*4ptKexo^v*VKP`kyY3_SHeh!=AWnU!Bf9Mos?vjCcjg8wY*Q1A~<3j<-7h z0fV3Z=8orCp8k4~Wv>}h9BM&+*PnI#$DZ_RBmNTFlUwgy2%6|~o>RWgzs2CE{MSA4 zcRca;jrcbqpIbp)1{&qxf_MYsL-)r^JoO7(^+85E==f^n*FneK{-NV@JpAr_6jt}6 z{NG>X09hFTnc^kTNxlScVfh*yEws8_FAJ zr%yxtVdTHe;GbgfQ~o=Ke8%7R#0!l2Fum4@{}%mW737IOJd1cQ;$geIV#IeFappg1 zZRkJC;Aj4&M!XaG{~PfvoBw*m$KYf@;@OB7BA#id zA42}wM*J&?*C3v2lvjti4%$B(jQH2U{}%KUes^qRj%>9E=_63zX^2UCeWZn1>D1pH zFSFI-wlC@a9I@KJ!Nb4Th_8Ts88m;P#s33M!f&?vccfp1^7-x$%l`r5OALLI^_^hl zZ*%fbP&2{53H%f7{M7diTSvAMPq&Ch*-CI7#m{r8|g;$PJF_n!Rj_@MJYW8^3QUQhgGBmOw* z$GiRbq@mN^+<#Td&qMm#NYA#@pN2koRMLr4{sx2pPNe4}UHbc6#48b(`EESoF~nv3 z{}J-vW5m}Z{w>7C-pTE)$CvSR|9=!qA2;+K2k z5l_6(6EE__Cwby{qZhVicm!=a23Gtg#eOU1;&2t0K02p0UzH>bTvW+J58IQlououdjK^KTctG zV7k4PsYPLYkB5Je&C7pGuk*zJ+ryt?x6g4)-wV_sJN~W}&r-L0^qb^~=X=`sYEO9~ zJI*!r81$+e?DE;4#^4RY5AFQ-fj&ls)k~iCW8ad%`nYQkUB7ER>AO)51Np|F*Z0`+ z!}vc2qtd4y{yE?cowl;z=>m7pLH0rJ)67tfLonwO!FLhc@*e=swChG(ii6=H99cG< zSm=)chw!c}1F_IK)(f3j=v<>lY~2qVJjBBDHtF`_l33{P0dw8L@G*|ie_7DN!h^xo z;W-;vc!-6E>t2y_F?l}Fa)^b8b4v*C*fJ0co#%iNjLi&JljkEB3r{8Jng6Zn#6qtE z&a&ymLZ455RtSMu==^>_mQ5!XI?ww;c)yl`Sm?FDg?3x#AuTl0VzJKggr^9k2v5oo zX5kPXV&UO=s_<|=$@~j`5Qv2*8#v3R6AQfrIP^#SAP@_ECUAr=jw39sjr%~#%gJE;s=3P=qG_i<~zXB_lbq)55R?dSsdZdI3i&p)Q|n~eHRP=c+ex4 zYWf87{FjS`hx4lNaD6L0#KKc%@KgY2u)`s63@OafnEU5uOwhQF{5Iwu5MpOyk+}v~ z>`W~57GROd>m4#S5)04$q}yX7vCtm^j^t_`wgF3DAQm33(WNgC3w=BJKh}APh2Bqo zn@%kBXMm+I5DWbU(m&F2h=p#ACzomZ4E&4O_)1_IH;9G53|PhuVxe&f( zeAv#L2mTD6fFMl65wY=1V6h3Y$h;a@Y(gybIlzTQ_(7<~kuiw~=leJ^ICvxU;1E5D zB`@tGHZg7W5a?nPV&UgFAT}WuI_(pgj2{H{cPY#4`)`tN+k{y1(msWDUdvDH1j|os z{6F%ODG-cc`N>p`SL0s>jg4?W4$+fX^kIF)CT88~Gh!3de|AxhT`yvhvky2j9X|+% zaY$Lj!t)mCc3xtkzY8pRKO&F4#v>LU?nf_qiG`jCTxgejG59mCzz;$Zj);v*fW^m% zCGRv~@iAhd)87i|j0j6{WPHJb+O}*Q1o~UyRTfk&_$N9Oi=4ZFXk{JP9D!Kqvw$li;1Kps zVK|9H=)VURJ>LTs9f*a8%OlZ&Sm+;+e=dFyh=tB+Da)o43!NqirD+|Ag+8A2Dlj4t z3q2b+V%w1G1ksIHc=CZoH)5ej$bXHNNi6hY^4oM`q0a&q-H3(GwM6DTEysIql4aA) zbCYG1WBUxT$XP@BM_LZC(C;+p#6r<E@kXg?=S)#(XV@#Yb$s09g7FvG6YfmVQJm z^ku+>|A-$1_M;4DLSTQ9G1l96WQ;ZY&KB^?I6y4&zX=?<4nGLr!4XPF-bu&l3$h5kOUtgncL&L)xd6|vC& zOny2q0*K{K@wjg7Jkk(;!DIr=WtW_CHx>%WrcuWhrj z@Ek;(eT{Ttp`QSjb2MV1zYQ#PAr?BvcBu=o(BC8f3j81t3;i^3mQ5!X`k#RdtMP-t z=A_PBY%Dx}_!V^~omlAfbJ3Yt=-I%cGqKR~fJJ9wq0^r;YakrK^z9<@+jL^#w|w3n zhfSZK1)fN)mQw*NIuJ|VIl!U=vC!v{Kc@2%3!V2zvurxC(3bRcoNFcJjBAY060>QAB06Xq`t($!=Xp& zODuGD`%Df<2*g6K2F|kS#6l;j@K*dFtid5=5erWvu#`nC^cM1y5rJ6fw*zO{bYh`* z0T-^t55guKQWmlBuwO}8#6o|N{0;a)AQt*JfwOEnvCtm}mh}m-(02hBuEP()3pm97 z#KLnBIKqk|yof{eBo>~RfkjVZp&uo`ZD(Skze;|aPAv4dfTiyc3!Ur6jP)QOj3(w} zf^ac#VY9|o-?z`p%)ZY)E9XAMBGc-p=YoJ>_S2OhMOw7X)xc6;V#(V8EcGQ8dK39u zbzWkj-$s6$PAv2`VDYyuV!JIK01nx@5exq|;0Py7gzo^0Zp6aFu|jk+$BlmS+d2>n z{|@robYh`%+z{P3CPcoh%iT{p9U0;G#J0|35Rcqxk=1zolk-7hky${VuV|iP;=44S zhJS@$)p!Q}Nxg_A@0Gw(FJhsW0cUbifKY}*=oP?OHl0}L3xK6B5DR@7aN#}pL0E%B z)-c4vL$`>u;RoS%9HJ+&@UTjvC$Z4mfMpFsEc8xbS;G(u{eIxWcKjf0!;!JUg4Uk3 z5gR`XlC0T?B`^E6tl5Z#{sM4e2YwKKj6?J%7M=sZqCc_F50jq?A`lDx2ym87Cl>k} zz|xnAh5k0M*!g{6(ScZaJ^~gUh=tBINoE2+2*g7F6gbPK6APVVh0I^XLZ1L0@lRr* z&jgO#haZGlI5N5|Xx*a`ybL5cMqYLVpuj^d}bj?}5cnh=u+hu=okF&`*mQ5!X`lrB!>~IKUU;^p;#KOaKw8$3Cb1|^!Lo7Vmz@iVa(DTT@ROclYdI9-u zI`E5F}&}RV4{7WqKO47fj(sOEnb zSmr@u;W+@Dv0d{V1CH4EIIxTx#KM09SjG)vp}!4W_?VXSDX?4*Cl;R60OUWec}43z+kiz+Vxiv&EP4_P{ciIAFRdrB z&^M6ZrV|VO0bprIVxfNrICH0#LoD>|z*#n(Sm--}MGmphUjWYhzLrBQ^!>nDHl0}L zuKq94{bS%Pn@%kB)F9;8*Al4h=u1$^6b$(Wx&$D#KKbnEbU7y^f~0;tMd{IeIEI3 zIa6`Ukg%}O(zyQ z&)o`N(EM%q7xL?}h=u1qU@42I1Y#><;pqd;_-FheaJbL>u>~zGJRJVAY&x;f={kk~ zqWNhWu`{voP(`sbvC#JeXYvPOKMtWE1kNG>fmrCrfTfQR3;hIe<^X;Wh=u+paF$Ic z7CO(rq`ioRK7sTUZ9`(AUrG9>_(32RdIfOgC#33Y!czA+hzk$fTIx;LL;gK_C`-BXE{YCl>nMz=enKgV2K`oyS^e+ML4 zI}uCX?ZC2jA{P2Hz=c1>4+33T>_99$KL!>%5DWbP`Cr5j0=I-+#fjtMuf4zQb%Ip84oOVBo;c) z$7O9#Ec7t>?X^9z(2Ibjt%-#`4Y=@St-~zx*uF|EJWGHxey({|0!M7jb82Z*V&QK9 zmNq38`t87luV^_u|CMpfJQsch^vEwX56@v`Y%$Mge_+swMgD%^jH5a)&rdVUT`W8= zf-d$X7CO&iGk>Z1iG_ZY{5G9f=sbrNdz$C7e<1xMEr(e6KPG)Veh`R-&T~nbL(TI_ zo-;;X)pD$JLwgP#bZ+>X=HdCE)R$P~F9DYN5)0irH{7f94mvlq>E^lN8swGw5{sM` z;6e_Z2=|f4{&o(r@bEk?!j6T&b2rh`dmblxde7rBf35SH=W%_IlV#J1rK}ymg+J5$ z&k@_Y?FW{2Ar}54baen&&jI=ua#>9{`K~#6tg={PvohSm=Kx zzfC6=I?o41f4&1IWf2R{XkaOeSm=C*Bl9;}Phz3-yKGrDoml93z%uR;3%v+9lan3- zvCvC^vurxC&?|sN4zbV|07w2+%h>=dbs-j>E?}t(vCwEcE-yZ_|l|-Ulo? z5DR?=aOS^hImAML7C6hM6AS&vz#@lO=r00izNzI93;ku_ESpX&^f!P-4zbYR0nYrb zmP0J`cY(8PI2*g6?T1c*W5(|A6 zuw3&b7J3zM;qUN+@UibNzW?^AwehvF#yiZBzjim$0DYQffRMeZg~-rc60?}+N1+}708#__T5rufSG+tq~Im6cslFm6UDg_IdKTt|GbUWi9Jg&{wgW-v^&YoQ)zUf0?J4_Q%rM@xLj^!kS6Wcf&PO-oBteJy;8 z#;tFT-Bx5$tdGl|+3JHgY818Ip5EFxRR2SlL4sjux1Q9_&dz#TJKPzJQi7X7I*8en z?(TzU%sRwwg=gfKqTJU1oCU4AwQeOoO5KQk_f}X9sfVT^I_Z#mI~HL#$avB0`HKtT zF|k{nfy?YtYnyLTMclh=MNM5@Q*-?-Lvq!&u5{>)*ejGfG_JTa-n6d%&bZZ3-2Zch zT~CX!wkGDp4dWR0uUQjYAv=VEwJGkDV7DXNaK*}|b!%6&+|lT!uEfrX4y#qJ#mJ6i zF|Vz2Qdyc7W^IwF)9dTh1eYaNvu4e@n6ZB&yr&skr50gFMvRE~f5%$uzdNrC;Y+B? znYU22tAvgWJ>_%NQ?3wH>Yx$_O?Hq2rp$0MIH<%ylO5!MDbt+{4k~fbWCuB5$}}f~ zgGwAU*+BsI*Tp~g{4r!lE1Ei03Y_AgQU{edXtIL<{@$X8n?j4GI-jtg;-FFol{jd! zgIwT#OWr}o_valNz~@yrX|61CzZCC&9^U;XyzwD;^ONt^@LM$1`DD8L8Fu&E>*fd7 z#rVkJel1>qTAe+hXsYx1a`)@!?kCTU@0|agUo`(ws{VesUM=F<(5=|FCS79Odqaok z@sAknR^YnT3^-l00zTX_h>zDVBnV#)_^`}YWp={BX}C^-M6O}6q_@&WSQQGgBbNhP?MZ@|M6Mem{h~|Lc+W@zt)pa}0U=Jo2uF zae3`d0+Ow;$0Kianf`7(^*a}b)He@#&H64)Q`S2rmJs}iyi37k+HYC8`@VC?karaI zGv%eCv4-;JpMlSmH)R(5&u))#hP=@pdD}GQ-*_~c%D*ne>Dqn zkw@P#EBLtghy*G3 zT~9sUUZ_+Bl%`$6IHVpi6l#{+iHiaDWnoLC$XgC3<|(tN*r%Zyhh2|s&_rG*fGO`j zG-{ZMb`W{@fJSneO4L(xtUzAwR6Cg0czL-W0XamVB<249&YP1}Xhzu+KWF(U|# z;H%Tn`ehoAdu%_Iq*uXb2J$eRgq`u%sAEczZ<0jtU--TYdFJ=vU%)&~Gqc?ogzqOH zitR{G$wm8OfMog~8OMRHpeB`+=nuY!buc3u>tFdE{In_4XUwozKl^*|E${2{^co>w zRiO0pb5jpzAIv*Y&^f34cdctHdpm=tW9pEKl*QVD&NnFn`4wu%y@S5{QPJL?D>t#vb?(rvF9)2%u@K?ct@!r(m{lM2}@MQ#5d&RZUB-*ff7ypoa zyUMaF9;hhyosXuw1?}fb^PMu~_)g7PmVX^JX|GtERKif-m!fXt_6;T9YmwfrMf($m zJ@mK1hRSJb)?P8y(%}r+fBwVE=(5`{%#8@Qo!WmcG9H zc=03m53InElOLR^kp?)-@=MeaDhM8m{9muk*clg zC^##n1K(+Mzc|+$EG~{^?6J~2a(^BO;j54Qs!LA(&(+a^-jo8B)AK~Cw`_j@Q!Nao zDgSDtokEG8=^=b2+5M_jM@4}@6wL6)PCh>57mAK9bTzho?dafkdmbZb@4X`wzZiA& zAHDp&!Ej)39`ZIW@bHfB4OXYDHop7htrab*8r)oYiM?fc6%SRU&VB#J+NH;q&bn#W zP1(yHSmwX^{cCIR)tUh9l|Iv7amXu)_9?!8HNFm+=X|{gR#-;1NUDBM$}+ja40oQg8<|p?25rRlQrg)wP>@TgR!`mY^yf-J?R?6I84^ z;+qu=-4OJJf^*dFV5FSii7efiGU$tf)bZ$I>i7-#{QqggK80=g=GvhNC}oPu4wlyK zQLBw_QTa}Fr^HUz`376t)Lt#dHv^%4AU~?w4&^+#V^CdbWRX?P*2Y3I+;5M+nX?r8}a@#Ct$H=>5ZKIU`p#QM{#S;%cKl||Exjky8uZ67%9jQ=m2Hl)T|=WPQ0^LEAPOr+X~o^Q?m_yR@>q2%s41Y11vT_g z(0ASDYd6md_TC)yC8Dbn4PEaz-y^eRrhEl0*yfLw?eR^H@;BCYmYNuiZTX(EyzA!G z39r{lJFZTgz;~l0Mrp7}aK9xh6x`yEwS5owr*`^9R=E1_lQlI;3FVG18L_`Fe<*m= z)}c5cIT?XPP;SD{&;Y0Tjjz2g?b`6r(5os+JGsi7WAZv#J4)=x4W8XT zusX3}>u`Fst=4*kf*;=VSaxvqV-td--LYf1T*bGVcEKWQkHj88)^ILm~TTP^nAN>*>EXs)x)J!*CpF; zXvqs|hRc5%Uk4sKPjzgtRV{y8F*Ln;mHX|wsuv3e*AVOf4>om2rRU_Ar7eyv=o>U+ z^>$Tk9JDI7W}2k0Y7XjSyYF9M7 zvgn~jDmdGumQ;?J%XO~%6?fmM?TA;MvFBRlf6ZJUyWg|sH~QKu^2L$~nB2DgOG z*0;mGny|NSS;v)Xm9gT`mUQ#_97|Rue6z(Le5YW^3f5w~YdKib{Bo`Dlp$q^uQ1aR ztv#kCyjHD2e|`%6`HuCe$FpC}J63gc{woV#UUHs^eqgSH>4$J(A!-ft`?(4)paK%d7qFYk4~KAB(Eaar&l^rHthM=yo1 zF6naTm6FOw&+MzGaCV1ppSM?V{@|IWwbHBhwsddm$gRoVyK6!Aq6ZfFZ+w4lZPl@= zD13OF$8+Z&9y}_r#iHLbB|-aWt~#qSw&jo-UDk2v3DrK3h(6}qqxM7>sGcsP?^)KI zvkYHnOzRnzQXG3$?cFG?M+;u zsM+qL$X$~_)yZ$R7_ z8E~CpX!}}r`L?OO>&d(3a)h{Ied?RpZ{(e*dVT)!g|99-w)E)oS888gd1UpA4X|^5 zc_0$JES51EHVixy9TCIz#omnynguczSJ6#1*?upIa6 z<{gkq&fdhK(ZcN;h?J3*(;vS~Xj+1IWUxlQq`r@SlzS-e!g3iO$g$tU!PVNKJm0Cb zvQ;++k9)pmj!*EZ1+|NgEt+-X zt{bzLKCsk()BD%d&O0`5*0sB?y%av?m224-f^CeQIrR&VF7kqlV^}(~liI ze&EFZEYY2}FwP!YI)bIW^zhW~ zYd1gEvm-V1SU`b>dTrXkvDv0;Auc z7N(`f^$$&t4?{oHZ`y~~7`Y01q-=1>^-pm=7BAGg&P(HZXXuqZwb=u0htg+rbXi(& z>W5Ep1>?%ZN^EZ6&{p-;aTj3b?pGs&qD2Y5G`|%qA%CKLF1{M?KP!kaEnWGEbAhk3 zsN;avTj)|CU(`3(;tG&!qQiA=a8r5C{RJa>yL-;hd3>J=^_&>-JnjSZcBQI`vzMh= ztE&C4z{ig{SGk5=**-(-xz}{_67DzX^Qs=IO1QLthu}9(i_EEu8f=hm)W}3)sd4=skE{Q*X1uh z@^EP65B)R7FB^Y6u@GPF-tgdXwQSufv!}1`*q5e9(=ktsdoncYVHG?1yy_hheDdlO zq1W#9^}cqm3LPKe%TZ6M#}sC8AJ$X8KPhJhlyfkQM2~-;HDB(mKm$+ojKCVq7g~}~ zy-R|=96$2=d+zVdP>vx4jMZ+o9&$3Z>*d#Lr;!XKd91iU+O7k zT|-Vi4a(!VN{j0thsUbWH*h_8%}-VOCh++>`bVZ@r~Yzt&O@pG_JRIK(yx)#lgv=% zb$_~M`slV;Xmdn;b?lDL(%|=SRW$AkKwbx~G0WA--SvBLA1vL+E0hgR{de5UnSOuC z67+M|QkS*CbOa>+U8O%2dCv6Bz_d=JJtjEKS^89&3CWtKllt@hY@c0orON+G_V2TwhLH1!-G-9l2+v1P;UchcaRJ53X&0 z3l!DSe<%&--LG*?96CRtx<_`Wme&6i_Yt~P>1t>=cBF5ht+chrY9p+e!P%Xv+vr=W zbnzpKZItKOj4MQxv-nVn?-cKrZdKERZ8@cjw|e+=t7Tl_Uage2bFZ(5x*}?I;ub4@A`(2=FTaD=TEoIds8!}ojJX1+G2U(4=y=S&>cH{NCgfC zRd44w6}&&z*rkT=3m9*T2A5@O-dI#Mgk7qPk=HyA%&vN%isyp6yE|2|s&`~raqRRI zU#zhQ?V66eA6u2{N!=-TjE!Y1_Ib5qO~b{#Bg%^1l83WM-z1mEYBlRF-4%(`aR zHM~9%LW}v(Vh^3M#Z(Zjeog!S#GtWV=3Cxrim6tg?^Nj4EbAP$I>^y;{=Hb|-Fl5h z>9Z*AS?wodgDLGN+bcK%=ZuI4e0}EKHN0#1+nl^}!#NY$!#UYs59fq0y)>t2@+CQu z@=J0GuDc{Bzvhyhy!DqL{Su^Kk`sRPlANONU$k%2wC<7~%y%10Q-+@JGQ$1$W;^pp zta_WeG|D^Hq0Jc2t9SSUKf^qC5cAx)jkxcbz}UJ2quo?r|HGksCxYW$P~I)W81Co# zqc<@Zw0$b@@9&dVfTKt(R1aY5em;Dd{;GebsRZMg*ILUY8~2gv2S5C7%Vsv%h-mw zEa3}O=Bkd$aVjtyvjNVrvr`YG){eMt^Kb5d>HZ&#x-xA!?t6$Od;?!ydZ4nQYxN_c zv(~6x+j=)=s#xQ{VV2yie0`iV7ED+^?48n%-1dvw2eJ<|aiP`^&w=f5Z+>L(c|3#Fn+Rg|A7751J$pIs-!ADoHb_dx6F&TT6%2IqFSmecWgT_`0*O}EdZnCEofa%0UZDYSY9{2{x` z9k)#D=rw~Ynb!*3t7p7^Gw)hl?fNLHa{NKR??9mPcm8vG@INnl&+~b+)Ie(M{jrSW z>g&-Q{~rHPHeLW94tZ>DajaG}{JKf+?tE^}Fg3%Ms2+u1FM~r*z8Wc*(f*1e5VXAC#}F%QPt7W>juV%2qn&H?BRD%0i1s2B`} zixTgb)m9v<;B`EnY51?$uA)^PKP0rnJ-M)xuMim3u2+z!lB`Q2P_^J(;1ONh?0jm1RAF zfwkU}InQI%?(Iw-wcF0S3liNk0r3O&)Gd&bmvrBBmEzS^N6Ud#SY4?Ui3g+m78ESn zwrJ#yf1bO#>RMQ0=&@@@cYb+JA6hEkxn_rJ6eXLAHu5?}H_qYr;EX4faydNzXk<|)%%@gStv5U)%Q~+jzBjzHtw}H+Z>U z%6S2P{8C^}G?Y3H&n&)B7CU(e*F>N8cYt~{+B@nCn2830?i|_i-IoG^Cx5CAd~3iN zo5Yg5n!dGtbJQIfq?EgSrNO((b$wZ00C%$W-RvLXKI+q!4r$R)=jG15IhG%IGBL!n z<5npfhA5@6)7RVc1=wvFO3G;;g|m@8YU`*)YJTF)q;>1yXIvCv+^?7O~> zQnR~`J0ooAeYck9gwuUuRXiEq#oA_fop5;A{`$WD<96D@d)+(D?G~*Fw`hS+q5QpeXLvZScLOSUQg|&hkJdGy(+w3jIZr-u_uyW}`Q7v?>)DIkU>+^#8?dZ8=vg?nY;nZ3p6xj&AI2H{ z!(}*A#f-schv_?JUpa_-E*MAiSc{wu2Vtqlc^BqOiM*Wf4+r%}Yb9iqLWxo@_LF4K z8Mn9~nC#PXhh~R!kH4UEaL=&DihC2$JY%+T-x=A^Hfhzmwed+!tql$Frb%C3*L3To zcynW+{nr0*xUl(-=1Ib{roOhRrsz4Y$>-sjt)ehjZ)HRac8ZOXINC_{yt>qOPrnu!dX0*8U>lx|)_6K-j=2 z*-|dK_KO>uTN}B{PrQzrQl0R+mElG6t}jyBOuEoWxCy&utXmt_`FD@LE)* z=9ai8k6poVeVr%4*gaxRJq;XR6OT~`BLNLqJmvOqA?v{M*2HhAiQN(AZW!2jz|wSW zyk*t8WZ7Y(MZmYBc~wml+6miFgzKBb*tsLTrlz^YKX#(EL<3Fh{x+-nn4Z84OuLH zQ;4gJ-JH#aG`Hi}wQ-aYW<#CE=3B#5DSmqlJFMIi53gNU7eA9U>Lbi6EM`+$a$7j9 zWSg*NO=E+hsJR!2R+S8fIP9p>fIWO5v}VmM>(Fsmt@Wzrt>REw&;>bwP;fXOJuW;^ z<%b~}+olkkYG5Ci6|0(8tg36`zCp27@z|}+t!q_lBf47LjeAX;?1NSfoF=kez^J!3 zx0lt*e+!(L9#|K)Tu2Xe=qeKxbTm_}5s(QO30l^Lo8qx}{cXs`E?1D*S;ur9o|23uNjlyQ7jVWTYc*j56!%Fyhy@nB%Y>bIgrw)LeT2uB~stu31G!k6X8LWt`&(ItAtr zHvS6Dw8APut%Da?^T%)_*l>D=>tOCW3_9GUO3k-T42@}mbxmPCHx#J_O>sRq)LFK- zYNwo9nU0Fxoam^~R4uY5mO^Wv7A&oqexINn7 zaYkX1JChQIp^Pa*(P+9|!q|bx+B}Fe+RB>xHSxM4?4We3BzX+5%Gv^x z)C#UCR>W$P#w4zKR+L)X={3Vzb**bK;kBS0S6F+mu_d)rS_=mZ09e%ES1)Q{;o%b( zp>?6j9brsB&1zvBP8D{y;R|D#DjV&PRF$Mi#I~ig zkg*F^jw-UenkggQ^;|D<&h*UrT(;4+=5T8a_pm+ID~byPDNN5JoCh$9V+>C=B_@TW z5!X1aI2b-r9Mh~`5I&}Sq;TS#&*`ttSqY)LN$K(23QE7wIhMXssE4u&#yWBfid|GI{i^|xTrjq^14d<*k& zx56PZL2_8n|IO$+x5dM?aSZ1e(y{R5S#47si-368t6iA;COV^v7Ql50cTtqpgB`Vo z1TSmDx`tR>7_G=m^$$&PY%|MVjMbbc&Yp3Cn*#NeF!6OQOylU*nD>;6=j^oFxI)2>V@T+JuOo$vS zvA)L1nM^L>lHww4GZ)TZ)zZ?~Jaf{dTX1I7TFYH?d4)x1nZ$i53o$gV#yNKpIKsRT zqjRn(DK42>Jfq}_iK?8NA6q+-D&GXal#F20ZKWmkC5@9;tSxCQUJ>KZoom;&u9@6e z3mw^p{;OqU9OOS6 zaW@1ld8-@(c5%UVNQN6|JT<~fKW*e+2Kn4S?h+g*$gmW7{J1K7V2rY^Xw#Nb-pdvTe*)@%+59(H{O4Hu*xPPf>6Cw^r@Z%! z{7ldEq^BDChHd-uI|hF20#^!seuVtFI7FX_!T&m(jo~iH^kY}Ht_-EJk|9fa}e)oaH4sj`;^3Hbbsq4o*;&d3HzQ*=cxrg`Gkw$D-iTd)VeLowbc zzs*Qz{+*uu+w49i`t9<>k9p$nd*ao0ACdgec;YwMV}hhlF!U)wd%kMe>tVD7!yEYT z$EZntKfvUqgSOWKBR|vM^OU#AC~q0;S&jPUKmgk#4P`O#do6xYnSYx{{tHI_i=f~6 zkk9=Xr9IEaSg(WD=d{6}4*$zSd6_o|bq$e$PW6e)CS|lMj%8HuTH2^RqtB8T?nnA9jHMGCQ67K{6Cu_0P5RIbrZ0hrPZF zd7=;H<$LOjSH$d~>(Bizb-?(5{JW7q2L!R#g&u$Tz~HC+Pd(|?hCV-l{>LE?VjX$; z9{wUv{01YQK>n+sKh`x){!Ky9iRxvv?{1WLsa@XBQGSQfesQ$-8rb6tc6u}9{nAK( z4F1ROrd(#H-;a0%{Nhjl0YjF9U;Jkxkc)Z`v&GhF{pI4D?`tNun|3fzK?@=eenrzvx%1B=adu=iF zOV)psx(?~(aAuhwX#Ym1e7$~qB75sEjsn2;%d81T5>a!N<;*a^@{}aj= z`%*r?JEg-Y)nfZrB?x}B8q+I{^yeY(ONM^Q`k$q~f`Yz}^it%fKJTHu-bUP?>Xu?>^&9froYUR z;+0-+R(s+Pc;d@E@jOSLbJUfPzYy}X!6WU{56X)2YgD&6o4;^>yd9E6O{clG7zK9I8|7D0jg1Fh< zT>qK!j(Osv(U;Bi3M2kawAT+IZyFe+ef>syC;HphVNaP~KSX;xZN!t?SFf)RNOAZ& zFYV8^(IKQhg}gtayh0G9yf!-(&jMNe`;GWI@Lz~FJs&jkCzq$sFRC1V9cSOyVVpV% zeM^zQ6okR~&sWzWeI?TIZ;12@EPbA_rEyececble@i&b0XV5B!gocN_dn|Fb9E-Q!#HH+lFoJn^s*Peb`Jly8nlFBs|f z15ZGDF3KD{e(3XyZ4SSV@AJf0I{u>5n;iXhe7q-ph9|zm!~dKo?yeWKyw^SHzxTu& zJ^Ec}#P5KAZ9#p_{@>%#=LRGGTliu>_|5iy-H^xj`q+ps0RMm?KiPlu`C)~lua3Lx zMIEp8q~GR=Z}7zXJn?ruad*9$qe{^CK81ey;9+|YApUE_WxPn%SD(+7Ir4Pe)mO*w z_M|WO#9e>T{QEuW?)p4ejm3C#1s2OP|38L!9^x{7(cW)*^1J;-%b(!1hmMal;>q>9 zOwENnem}w-58e4ppI^D_MIEnnA=2a!rD*N_!pgq`&Klk3{>MT*l|UL&35Jz~T+qv6)U zzOueyx;tNJ{a*K!cfUu!_Y8T=@6JCuf0;ACT&6m>a7O6I;m4?F)!!q(%HU`EY9k)8 zZLQ~@tF8QNjP!MO{XezjPqNaR4EdGl|Nn;iUW#<~FUo(#NN0Ser+&+f`19&s>85``F*{&?L8OmHn@$F0 z@ceYS8VP$`kNU~^(o)p#Da7S^1k3xtk*EFjRS|FduiM{s`g@-A9wYyisLyX8f4r>^ z<-6n0K)Sj9>T>#zmhWC))^T_Je7X7}>az^`ne9<*v)e5 zzXSEFGwl0Y)UN|^=|2k)|F#iNmOt6*FT6IZgN`>y)V|*2&gVMaou4PGhtYmxF~;z= z0R4R=;+G&k$&SBd`^L+N`*GGs`@ZV<%VhNx_{V(kPqF!#e$Yr~e56OeKO5=%o-soj zXnvf9k>5REo@`xPX8L?9eY%zYq(>gVp{2uQbt&>c1AWGW!1}~t--C#Yf3hA7$8q@8 z6_&iWjQsCm@xB541xO#<|4Y@+&>p`;daj*LeSZwBL#etF=^r6o+Aq1ibp7TCyItQK zjQID^k+BV<3WLV-DZk1{XZ)lQ{~FqBKKSMQ-XGyYxFRRZJH62X7QH#l>rj=%4be;i|*1oG#3n znBMRBwobp^!~a`P`X4>zf9%nBnn%77we-2mAh7)Ze%e#tN8vjXDDQwLe#oQmR8RST@wCVJ99Zl?dG5V9ZSO35eMlCjzvn6M zA3gS6K6S2^XfwOEnvCyZG-)15`a<9g+g3|~ zGwpg43(s=kESpX&^wq%Fm(vQwLT>`ju=~U9z)~+_;kgS~>P0N{HsDOVt%!x*37loq ziG_YYaG~864*-Y$s_RHBJllXX?DpPHe#~VI{WwBg5F-!^|FgiN|8u~iKe6!q09f=V z7CO&4GRNQtfmrDKfwOEnvCxkIi~d||gvR0rfmnD>0*5})^&%Gf?|~zBz1{^bJP$tz zf4~vq!yYyk{*MqB{=Wiej3)=4MFXqYgzKvi9TtID^72|<#BNjG_Y<2C3lFcCh)sxv z&g)#6yikQeEc7t>Z91{g3xLHY(||)fNkbqOo~waH2V$Ym0u~*Jh0bdune1=~#6qtk zzfC6=`VwI2FT_Hx11_}tHLvG|!j?!yEIfCT{x|#}5DT5xW5xdW0gKHa1Pa3ojr?*JBkb`smZ{Ty)UGR;FQd0zmQcH9pvHY64vuFJ)S#6o|O{P|iY zvCw%REX$@73;hk?5LV9o`?Sakk9c?z^lV&Qq;;Q5q19260Vg@^aoB1M`$23YFO z>$-yZ44>4ISn^&BEOjIndN%ndX_>@A&m+H0Cl>k?VDS@Tp;Lm-ZX*ugK6`%PKOaw$ z5jbr5F0`OE=lkq&m_vXsr0MLULMN+_C%_0{973N!d?|hq*bG9a$$Z(Q+V{0=`Trkt z?;jskd8dD$NiqQ<>c{}a47Fnd5z*$NgED%xyUOKjkTtpS$bK?~$@zKA&SNpQ4s(+fQeaX_< z)$&K-4T&tB-6&yovUJvu+LtVy^$?Gs!I8+)Sq~|@!Fnj+7lueIdu*(a{`cZ>d-2M0 z>DXIn!wV*)NAOa)$gWFVjV%3b+KN&dJjIV(hCv^T3LMESs~yih(SB z0PVj7XGmn}gK2Mdvh;k~PcZgm>F3ej>SXD~V8u+9J^@_99}ys30#?jq*?j6btI|KT z=Q+#jHIARtowFKX6OWoUB`e=nu;L+0zX_~5Bul@A_7hD!Wa%rx39FN(-vw5kkfpx> zR=#BEd%((SXE1!Rp&&>2HH$Uon2(0V@WwYa#S6hI z7g@(H0;^nP=}Tx|ZTyg>H`3nfWa+nnRkvj6?cmsCsWsGulUK*`5OVX3t9TJw72a-mi|2LZM%@A@1nic$#!m%7~e=?{+a#EUeL`ZUA*t+iq!>)3p- zVk1jGkM`5ev1I85w6{80dMQ}3k)`uHF3oRK9i9n}ea-k^>~J$!agycd2C(8JOTU@+ zGmRgz^cA$XI$8SNVD(S3^oPK)uNyzll4l#pR~kN#JlAjm`6|OB$X6R44OTsnVYhM0`0$PjwMU4q`lS2(yPE~FS7KR z)UPpq$kOM6WAluD4Y*{!;acho4DHBGa zt?@&aevtN7CrdvJR{Uh?uTt-0`W0C^f2SPdLKunPi7Wn7)a#AT`>l#UCz^?$EI)n0 zik~dKKkb(oKV<26aJ`qXI$8Qau;M36FQ9&%@k5qg3XXB{jx-*ux+Tlz60l+;OP@sh zrRG?&^vSfhI$1iugH~*0>2tuUxA|bjK$cA{STT^LFQ$E?iGeJ=f%aA>OK$=z2D0=O z)a{QR$kNw6^idlPrBFIK~SX zr02kj=S8sMAD#t&KgVcJ`rEd3~0@sOpTq~6br3$paL!LerJ{~fU6 z`~a*t$+G_ltT@Ti`J?yz7UPF3JqMhyI$3&Ou;L_3A55JWqex`w=YeBwMlS#>&Qh@A zB+GsjSaFi2Uqt&Gj32V}3ADF5S^6Y!JkQh{S$YjvG4TK7#BMY``TvVzyhug5hBh}D zo)1=>WcjHDD^9ZX#k99;Ewc0m+FPA0y@~dAtwomJN_(r5rLO>M4aVP)C^oWe)`1lp zS^7iZ_!*{7$kHFD&P6v8S^87p)N)e~&w`Z~SvJpul^0q1F52I0jwMTfk@i+6OFslI z`IfOi4o=--_)UjTfn(n`I)98BTVXgCtk}r%nFm&EWa($o{#J7=S^5ClTb(RD3D&(k zvh-qb%-+)&3r^i;d`@t<60F$BI<^X|*vQhS(0;Y?LzX_3_EslLp93ywH}*@w@iR?3 zl4a8jPIVZY8^DT(ESsCbiia$H1?|_EW69EQqrKJ1(l>xrS7hlAfOWru|MyTakY)1- zSTT^LZ=(I}CI+(ft>A>!$kJP7t1M*s91K=j$kOv^Z^s&0`gydsI$8P%u;zy{ zvK@C5!0|gx3}o3?fm3#Vm=2EJWo#DGetm{zzl1iUjowO|v&=Xm%Vq_*WRWD1^asEy@55l_MV3t$Sb349Z>IfsOkQN^kI~-hWa-<% znnQMil^0ny&w-T}S^5jK-(d10OW#9#tCOW425bF5md@WFs=vJgRt#j>oB%5Zvh>$! ze~*cQEd4FoTb(TZk6@MeeX#N(%jQF{@*+$BnD+OYyvWk|AdQ68$SXCfVD%aP|6S!pmQ4z*yvWkaXn&u{i!6OK?X6ChehFCR zsst-9vTUlr%8M+03hg(VyvWk0(%$N1>2ts;SAQI)yvVYNft43o`as%$7jH;p=|jK? ztCOV<1FL_MrI&$Y58w@HG+v51A5eG~1!k2fT;^sV58)ydL#g0=P_OMd~Z`gxHy_Q#K8*&L;Q zj)|Wv{S|PEK_R`3SNv~$?DpNwA0f%+W7_ZwSR}IiKdLy{xhj>G3!b>rbWzz~)3}opy(f%>KA(5ru0!~<+Ed36!>Vz!) zKCoiom{JU6*>FrLhVb~x{}FZ~u`A1-V=7^Fvh=6Gx^GOD?vEWiM%=M;5H_i8ctbjl zm&OQL$DRbs<{jGDF+!Hj`;Lu2j_ereF^+6rdF;bK#z9DA`Qdk(smG1ZF{Qd9%Z6i0 zbrl|8`9CqohR0XJ>hAa|gCDgQS^lSk)n4bpU3{P!?_}8&ffXBBdNEkBk)@Z?{-=0D zB1<0yPFS5ReG*u)k)_vw^Pj{U5?T6maKh?j>DPeehb+C3y6q2S={JB=e~UMyoAD~y z;iI<#A2D_)qz!n*2bnq{>sa>Nl(na+>c{Pe&q7!Ikag_yw0|0JNMz}|zzM69r5^>W zpOdAZqHgb#kfnQUYuj(h()nF{YC8;(VzjaSmMohgj?FOgPGdg;T=I-z_8*nk?Ms}W zRbF?lzKHg$03@>V;`i(ctCOWq0jnL!(iel(MrXm7Vj#9>IuKUw+)uwr-!9NU98q$lu-56%i$_H3S%jrmouVkXPx zBv>(%rN0YS|0GM#Vf)(tNtWIpoO%ISXDaVAUsC`Y^bN?X`Z$`wWjK|AXO5d?+@uj;#VKHnQ|7;Qak~ zLn2F`3Qky^EPVzz|Ce|}B1@kIPFS5R{R(jY0lXoRrC$wBSe-0=J~;nZcte_xm-Je2 z!s=w{&EV9p@rHC0UNOrnz^Ox2@&5|(O8ujc-dzr}f5v`eboS5GVZ)oq2Muq=M~SW5 zt>D-Zqq7gk{>d<>Eit=P%;vQRTw-llROu(c@y})9-SbZ1rLvp?$N7T}B(n4mz^Rw0 z;{O`4Z=7pv$g<(NK6T94a9&maAQKI9>AWmdzGUfKy5*nnv-QZ**?kjM zCrd8^D_^qo3DoWNJ6U=ySn-ghF9s_fvh)Vpzh>egOK+mR)ydLt2ABM+vG0$M_~#)Y zk!8bkck17$!Z%)V{t(!*YznZQdfk`3QTR|<$g<)5Tw?u90IOVN*;Im6F0%A0aQ+*3 zLn2G(T%EAGJ8#c{u6icRehKw2nE1)kIcKKc#2XUl%#z>x=&i(u;v~zy9jrLX((eH0 zzlAp>vUJY339FN(bG}uaWa*p0`h7K7I_F;fzM3rkDX{#IrRPykn(~sR4+N*)#v9TQ zyyE8@8?tPY;M9NM4QUu&st2-cMu1fhWa%l|{{e4EWa(w#gw@H?F9GZNnk>C9SoxBr z_XjIqvh*13-@zLaSvt#`usT_K0a*1$md=>t1*T5O(%Ju0r|^c9#4GjRB=dXn)E^C( z;zKc$bu7n%Vs^*HSla(zydjZg&+(G5I$3%RSTU2Ow^A=OF_Wd=1x~$-H>A7qQfy?| z+zVE0Wa;4(7ytCOW42P-e0-jo+vHYdQ!i!A+h zaQ=sQLn2Fm3!JbzSvspv?Ms%0`mEkBy)4V8uX|%_U&PK$bp<_Mezz$uJ<_fU# zB1`9bEI$ixNbcHfKJBeemVGN&*ZXAYcYtH~+X75?<0GGqU|BZzLP}VjES>ACl3Zi| zl*2DLyx-wN4j*^;eQ^G;EUz!}CCmSZ;Dpu5()smde7Knh$kKVKnPR6v;xbqDNtO*y z?W#|*bWVl&XPRTl(z%97SlwOEjD@cGoGkmfVC74eehpaplBF-C{aGeovh+o?w>nw+ zO<=VnS^7$F{@KP4S$aD-VRf?f`@!-9-;%}j2yvd3*3#=H(I`#^%VjxSun)aVF$C9Pbr@ht5 z(wo4l6SDM&!I}ff(!0Q#1If~#0Lu?q`abG8s8l4f^jE<7Lrk1x=_kMmtCOXl0;`Xa zrT5K2UDWwV>5n$CDS$c~0Hea&zGTK|6EWHY>c*xSHg7eQcWwV@X6p9dDOvg*)a`vIvh)q$*f}QOhspVdH-SqMhPRXd>^Ft~7Ks`iGX5{2 zVa}V8eun##`xuUq^9&Cp+dAhOIC4hDCiR7kP3%0wv`O*Ah%^+hc#-K3WW~?5U;F~2 zyX!!%Z%fWM#}8~xV?yfB>VXrnN%gC#*ZBvzkk|exm=5V+2qCPFJ+niQ+T;T8B${ABrIzg7IXR(}6m@$)lPsP0LKVMzUvwyR#ZQ)flJ+)E zvh-oJw>numr&q;KmY$-$jh`%?*Cwjli@=JFESm{n#YUE1NqZXuS$Y-itxlFch4wZE zvh=C6w>nw+9I#@W4^G)Rt(H1ZAV|FSQOsl=y9BJ5$34t?!(9#!KuobqjsGNhis4~k#YvVQ&gY7gEImbgTZd%noby$;Wa*=6{~f#`k)>Y* z*6&)$(kFpSE;F%JffXBBHdDZgjVzsOC&fmVK7;l)X0r5Iw70R5rC&jNtCOYIf>q~a z={HliV~Q-j3mltf%Cea}-7wEzdVT^~_Ak(8snw+t6-IdEd4ET$>qk++hD~&md!h0#Xy$M^J)GJb1Ydp&!-8iyXV#{m?{Rc><5BN zYK))3_)rXF+2n&216lfcw6|?dmR>-6tCOV{(cZQ-S$Z+;txlHCp|1Wp80Cubq>7Zp zEB1B6?EmTy?pU}4ddVzfQwdhN$nwvAu5yv3v!AP6;Xbc&h5NjIUmfoA`hB(A=jX$} z+JdZnZ=i1bHd*?^;Mg}zS-QX~3t2Yo^C}Bj`eR^~g)IGX+S@iFOMjB~_BY{V=}*z# z>SXC0Mw>nw+e6X%z$^F* zjLte#8Oe%)^{FzFrE?zB|6w6Ze~0$B;th!`{UfmMmy)IDAp4SQO$@pCPz+?*u)P$6 z+jeKs-u82{><7@^>SXEu9JmpgBlVaAt?tf&!*FcLV!R>w^IMLOKFen@^RhZwI{S}e zBTFAedm9^B`dHfA7|7Dc)86W2>0BNuw#i`C8(B6rV8uq3KArY92D0>-w6{80`W)KZ z7|7B&6crm;I=h-;TLe~YWZ5hMD>kz9M%vpL$kLl>Z*{Wt8)$E1BTK)T_EslLUjx=W zK$iY6bvr+krE_f`yAE$iACVgj^S{@|zlb*^vh4X?LyUnV@%x3?GQ(U~i@7$AH5r}X z5yY-H%yn;!g+tl^j<;l3{vUvzYBl=fw72m*NnUF7r@$pve*vueC(F+su)hAi{ad7HJ%o0;~SXve^t){gb6XM*9wPELr;Fw6{80`jcSQKUq5O+p8~~ zB(t+4y+ivPG=gQ>e?UEDbh7j;%xxuY=GeaA*zJb^qpYEOqTu}?bn-_$JoPqMv5{r-4p^~~rT>xkHU_fv_i1l+vh)vW zZ(|@!|CshxCrj@e&BT@mR%~S1oCQ{FWa$HFZ(|@!A543zlcn?d!HSJ6{XE*+*vQgH zfK_kBV8uq34WIp@*vQgH(cZ>DmOhsDRwqm6vtkq*S^6ckx3Q6>PXQ~o8n9v`%Vs)Q zv5}?Er2XBdZ=%v48)#$aRkCbWfE62A`fXsvMwZTJ#pHj- z#736Bj`mh3OXu@p6r2037(NFke}nN8ekM%9>h3dPo}wSmoEOOQzaLz}g&Pu|@ltY^ zVLsPI<#nI&@(OM2I)4a`N!@GglMa`HV^+Titok7<-w9yV4_SI8IKR{QBulRXC#+7E zJ{??gpRwoldupTMT5!yABUmwzb!;G z90Dr_vh*Xgf5;q5md@+?gw@H?Pl6Q#S^5Xm?fHu=y$Gy$$kL0!iia${l=fWUBax+# z0w=6amOcrrYjd*nnc)2I8$V>}bHE9!lclp?sa#~~4dB=##?K87ub_QN7T(SGda_@G z?bP2G`@6wf%aLWnzLDxOHoW#%{eB(QvvrB9~)HoPH`rPqKHRwqlJ16Fy-(s^4-^EO%fVzA;NOXuaK;vq}tWo`bC z@rFc}&P&#W)ydL%8K!v1((eG5JdQV{b@<5tNrq*^Q*y%UWa%8nI%kokvx}%5$Cb{ycCz&6!74jh`YzhrGLoggNPDZ3r5^^X>}2ULgEc3d1gDX|H^_c|2k zB(P#2%VsiIF_5L#(0+%Bfh>JG?X6ChehpajGgS;sB}t1ZaV7tx-B6^Sf;2{>VOvUHw{ z)gQ>xH-k%lZv5oarW_TCM3xQL74cCG#ookBNaS{Q=rroh8mhuKD{ea5~PoX;OE5ZvkuV zN0v=HSZzU;eg{}>L6+{foqY~QkG8YA+jg6Atm=>~KRdxH`+kRygH!uW%qPH#nXF^q z1uJH<^bf#_nJoPy+W*q{Bun=oC9F=Ceim3Ulcf&@E9N4Hr_g?!X&18W=Yka{S^70# z#YvXFkoE`ghD4UW2%NAwSvuE68f)$v={D$!^FD_+(f(I>Ln6!1HgM{o(YbU`%w*Yc zI#$eN={#-Z{~B*dWa*ra6ILfnXEC$}AWJ_2F0td{BsletctiRFK4M(#Af3WT{5Kia zu^&Jxp#!83Y4cARmJM%Vr>y@xaO|kD83tB)$+8~-R(Z+Nx$Mh7W{xFG=X8*;I$8Q8 zu=)~N`b=>CZ;cDk z=v)J+9>}se1Xewer5~aFadRwL`Z3yDoh+T->69EY_HUAHY(o%}@+HfDC|LQDr6BGPYtCOYke5x@*mOcR-`xoP9vcpZZ=a1cx$g;l$tT@TiSArEMS$aD-|5f9k zEZv`1t?tgN_rXSSl4ZY{`o$(5vh*Z4b;9^BBEM#M1XyvBWuF2oPO|he+H=4mk)@9Y zC#+7EUI|v5Wa(FcW3L-O3(5axm}>^{yC zij6Ei7cLaTFzAYbESnKv#Xy$M_RW9G#1L-lgw@@)_Scs7dnyUS#>_{j2{Uju|Sre{ovGp7(WNWsw=W= z4ue%!Wa&p~&yx%iS^CT1gw@H?-vsOYMV9^!xWvYpggcE{vTTOHCiRZVD+yMdWZAHN z6=%4u^Z&~n8*b}_)!nwf2!2%OWci;Aj`2i_G{fOFV8uh0{W`GXAxpoT_Wy1Ckfn26 zC#>#{@kgL59XnpDdevu;M36KackB znq$e*3ute3vh-14wL4k*<{WQn-O_Z^a&PIvy4u!;mU%5L4fF6>UNP^wy5;j)(u?bA z+ZyWTwX`m{wr*bCg64+aOq-gQrR!Q+=B4YJTk99qrx&!=&AXwlxqeY^#y2+CV|Op6 zrOkB>3rbt-ZfY&fL}9F3>YCwi-r~B3hGp{>E~{Pc4ZF$nO})=Ps;L?AFJ91GSL>Gv z{(C>DX+d*K-Mn6{m(?z4T~Jy&wdKb8*7V}i)&&b2>YN}y<;Y%&WUO1-nwpk1w<4%( zo0qjUwaoM5nmTXZqPE8Lym>vm_iq1JR$1m?RAWp1vPPR-Z-GCw)w{gMJ&va$FcynEA^YVGkb=SAmwVbB6nw;HXB=c^SRo7TM zZxK3g1F8h0GZ^Q!bqm|BMQ5*XY@L^ObdJ1h>ssfbacVJWuB)5Z+Pt8#CEZ-#gh0~E zmM*Pp%y^-73r0SA)V%t}`tCc-G=f8#+A!eJFWQziwbF9wf|gc{=9aoN%Gql~)IX(h z8tZNhvTdzTUl&+6n}HghK6VEolJ`eWnMvaV}PH!pAEuyyQRXQtE*3l`Qj zv;<{iK&Gxuxbqe@EV#A>`P8?hZzx^R+S**d5S7&Z0L;0NF!eTf^TS?bCyjZn%X;iq z|F*kIra~> z?bRmJn{I4g(A3t{dky!nQoW{I=kYYPwA*ponQ83I@%DUyZl*(Q&-mXR6gn3Lr@4lD z3<7gD@=8xXWv9E@^)`Jhs&8D-P=7PdPtFOh_sX$zn``G5#_YCpb+`V4=Bee`m|eTu z4$~onZrp93ZQ8|k>FY3Z({=SXxIMm`>4MtYd5c@-Ev{{5cf^7reH})6Zzk+Tr!!fG zsbMK=qE`pqr;-ItO$}URa4zw?F*791hFcS{E*B!(@4SllsO_voKjM zzOHr=W`-uro)|Eg1G?1%GeT8isPx{(Ep-ib=z`hN zF=m>3cvkYyp2ob_nY@==%=8h;!#z=<19i(Ah3HlT;r$q1^(~8?DheBznp{+eLWQhK z8yap{IuCst<0g}-8_dGCML{r44GUV?3FqBh*Srk9xcBD00b?BtNz9dXIQ==T9Qff} z7FeCmzyuvkMwvBt@40rHIGpuDw@i)C9&3tTZ2ak@scj)f;JmtY?P9yO?qt%UCcA6v8ta-_9~>r>Ss(^*@t7c-fW`$hHlQ&9 zjSi^1BESrlj|#*Lm6r#iLuG*&z{R73Z~__^(Aa>+1T;FJ@`?a6R6Z&YGgMw4hz^wn zVgMIc1mOfUE}*dijR~lHbbuKuuL#5pm5&O<43!63d0Bt~Ts$fWC!lcwjSXl_K;@$Y z%usnnAZDn1R3K)kygU#cDhtE_E-nuu3us(GV*?r!Q2FQpGgMv?h#4v$6^I!sFAqeA z$}%Eme0#;*+FV{ry=K;BW%J4mlp8YBCpDig3TRwFV*?r!Q2FQpGgMv?h#4v$6^I!s zFAqeQD3&F03-hl|Po3rQXFfrC4$mZhhBserGIvou?`PO1=URQV{nUrKgNtWb!XRun zT{~ec{3+~muw7{#^j!jg_7!|E9`5Up*YB-A9mnrMZ-TBwJEoIie@&jZ7=h3qer_K4 z8``IPeEjXx75(VJB<1rt*tzjFU61Ek;wC@+VOQXfe}CF7?<@p8mx4|5*9JS+->h}` z8%5CQkJ+od4~F7<;!NDj@5SGJq4;*K$Ftn6zcU^B|m-OOq5bWIe`r`k9 zKaSuTA3_M?`w{YR{Vk4}=QzQ{Pbx3}ADip%sZKm2*!nvgmMZTN1nc_Sbq=2ABqy*F z{u*|!zX|svU&PG#a7f^90Lth3n}EK|?}U`(?@ZXa{_gu8z9Yhc^cTlV@x6hyA%VYJY=6dwpB7^0RLlI3zZ*mSc?7;#*?|4@_c^>2 z-`@b-_@012{vB&2`FjW&agg^V!09a+> z=5KG@`1<1aOT)5_zb`oc_>(%<-(x5&f1jx&2gpTRtYK2CoZ*nMo@>q6t>X6)?WOMHt$<74Pv^aC5;NXK6`z65mRTZ1n| zhoD}R6yL|_yKa1o|H1S4_f8q#7x7a4eH(VJzelihtDNCe{%#8S8}g6lS;_QQ;`pl% z#aERwf8R_l<*ycYZhWu9Uyd#Bg^oXtX*a$}$m}gS!9L-g_Lxe1GQIU1eAjFHUpcl_ zUjEe4^;cYG%Hbb`H~D)3Ms9o`95c^EV|n@gr~GB1?p=TH!(U$tHp$;#0It8Xm(B0H z=x+>O@^@j#-^U1kdN2NpVdwfAdK_~O?C5Wt<8L3>jc+P~M^S>L_;y2a{k{IXOnEQ1 z``Diw(T7}r1z6}z4!mXRuO4=;zoA$+@%Jr^?@M^8yr1A?LVx^TnQ1Znm7HUk@7%{1 z{|^X174HMpz0bQPa7;TigP)#)U9Dw)a35dq*nUrqX^2}0Y}1D6+vr26>L#;g?ASk* zWH$u!bN19vmO)?1eb1u2jFshOlHKz-uc{2xry$>5g=YVsV8nWf;dSAt(W8@2D(k^U z8EehPTs&sXDBos&-mTSBCr2X6k-q>Iy!=i2RemaZ#qFYLN~1r|J1AxW) z+YzyH=ZKu5j_s8NRrgj+jG$%C$vsqXu;@U|{^|Q>zPN2|VOJl|*6sYA-uU(>+T(fG zdS~99odX7ACJ?OwcNn76Z|Am~L!_Z3ERP^USlZ+zkvj)cAU#Hi^V zTW_CvM^M7*!sKO(;UC&Kc86K~|T0oBD1W^d`|j5uzszMvy7d&J&6 z^zp3WeKN<;w1=lp)>T31e@ zb*6{0|0<7d9g*tnt^IOV7vyZP84;?yk@YsRl`(NF6 z^2Nz_?pgc7y7BE}*OlH?yf$l3XY{w9#NT`G?A?@kDlV+MKo(Kp&U+cCS$UlZxPZjiSlx(1`HEmDZT zGm+^{+d9fT%mF!9cr`&gY-^9a7VkS0e_ywzV^hbRHHX&B%#5Pl+uFnZq60OzYfKIL zg-YLZreWVX1)Gz%Ula75RaJ$_Z$*kacFri8b^ol~E8o9tQO&WM$(QfEyl842dQorl z?ZOwwuHC+N+qw}GIp6lJj^|dEJ#lAx{$6h_M$$c1;n>)!C$i@RWkXNQ;f%XH5??pV ztLRuhF+IOJ(iwd+D}F!6#8qDBqTJXIZYx}Q21d!xyuww#@*Z9FJFoDz?_nmdEL&Br zGWM3!jA$mO>@9gYeXBd8Wo79TTj2RyIKJ#Nj(^fQK8~1_*XqrAIjgti+`9UQIjL#u z3m@CO;+lt6{eAY!RjJ;hI8~U5Lgl?IlKoOu>fGp#j?2&sw)7a=tf#VJnd9QoU0IrI zvo}_y`bGUw5Wy&jZ1d>L-_F8z);15ZrLvDzrQ*>g!D!4riu`iuCnyDKBztT0)~}%i zTUPY!BaC5#6MLizb?8l<7JskKD|jf4doY>ORG=IWR;TAb-D^n>pOYyG+add^y`$o} z-}|_8P;R92STu6}rRh^|qTe_5uQ;~Pi>{08`T44G7)dxAb0l5Gk<=Oe*?&!3v?scI zRsG;J=F-|}t4=VU)x-AoO|Q&B9prd#w8h(_A271DIp<#<@88saQgq^~Rn-w^u35eD z^-s18if@cY;&Y;rbkm~9j@i#+?4~zFeIILcBCkcd2F+StU7VAiUl$n{U743i2+->+@Tyr{(cN_}l@Z$C~7W4zE;}^=@j179oxkN-^+U8B&Y;=byhpQ_U|!&v^*MWHecNNbjm#+=TvyRs zA1fO?2j|v;U@XUxo7y>hD|;(y3UlAVX|pl=ZCz3D&_>Kw-P`Z`r)|Hc3o`8&j~>qS zM0lMtt+TD#TlHF`sxxOU+NrnbP84O1Uxj(0GiQkxt$H+TU60b=a@t7@j;k7qS2TcBdAY|lS1USqrD1eki(}N0aX(}ht^y1b%2X;+=b>=H`j?aDh znqv!(E;_R0aO0uk^;b{49`*a47vFe+mpQWU#H@}b9Xl(Fs_w7Kz3h)yE}VO0?xd@> zUsZ7Ry;o;_^N-UOEcjfu=Ut2S{E}eKWS?49RZ<=4%4n;qmSQ_xGtt`4+|duMtB!8O?9V;V9-X;IH*{1-tCl$DkMyn_FTJw8M{7mvI&(X|*WvizIBQ!@q$}%SZ;{Np z+l^#nby?q8eKV0oUfT#i?nph-ZToc5&iYR8<-YF+Zd}>J&&1sK-mR;L4{~afYIgM- zqv$&m3G0`8BD=GP?=6bF2KE+TNt?bC`98asn(k=mTyt=pTfQHJ%4gzt+sw4%@Ls&J zUI+ccjlZs~GbehAHJf!HT({3)#ngFwA8#$jLDQ|7a;yzSFb>y`@qYch(?v3-TaRLN z8DHj@aL$agZ42Xc*BZ`Ieoy^;55KFbqNgeK?5%DcuB!TSk7FJ0e*eWBmK#lWMptHK z_Vm&tuItSGkDadXdqTCd&7Z4}RGnX)ZrbRbyexa~NN@GteqQ#zbG_BY>$6wyyVxs; zPRczQoxT1y>v#Nqi&yyAhq>WZYjjCx?(v_jM~!4w^4WXq;ps|vy3AX>Z#lf|i7w0y zygUvscFo(FTl_@m*k7*2TBY@qbkp!2*Hmiv&fJ@y=+>|NdWm#p51-bzqx#Cpg(H5R zmyYd4pZ;|pu1cS-PRDwlr`eX(_b_*zH=YjFkorxy7j)*fZgOijyq})m>t<0>&9lIf zX;IYm(-GD+t`qj2i@zk^;Z3_MzUDts-ZedD83>*!X_RaIwJ7Z&`aM}Ev_(8E3Zk{d^Ldyi3ixHFo}UeZw% ztOCOI(YfXici|kEyW#8MJ@Wj&_o*WpbK7lfjhbLB@aZM!_{sl1x6a%@KjXGI>-u8U z^{T2X{hGuz#HXCmZdBVS4ATg(PCU{v_-NH=6TsK=HoB6-{nZAiyDA{-%Vx9yY1*^#R;!*fOU@QyP$RywNFr{I5I4MzQ3uXE5E@1^ze z+yCQ}^!#VMO}Vr0PJ6lDfsNS*mw4aL+tD$5;@W8XL`THKIVK1HN3`0xDrCNMIyQAI z4Ehw#O~cOc&N(A;f<3AK+V$1vUz&;Q`0eBRVy^Go*IPA3kwv-+Q|r%)Htfh-9y#;! z^og2CLG|hjs&9>SRjhf?%Pz+Gv14S`wvFkPxaXByHk)hg3f>vGG(GKfXA~i+}faZ{m0Q;aG@SX zBg8uI#V5lNR;;OtAm;9o^tfBlnLF%n!)NeSRiF3AF>eirYuKG>Uc!0j$h7pzGrfgX ztE+On)hYC%egm;q%n6Q*cl-sj`NrVBj(hx;PRtpXzVo2+=*+##_T)&=Z__Ks_be}F zxxH)MdF#{Xxad!DHr#t|R(uTF9pgEB_&QvVRhIEw5v?v9@sm89Ny_kvHPn)h>1(zI zZH2qW?deKf_jSDc3D#F%9^|DrJcZSFq-){iBa=B-sO^nkt|zOrR#gr1uNJwYQrXl) z-SW>y`NR9!+n)ZZTebyU`^9)Z$J|oAH*zknhBEm^USl+2FK#YvPh!8Fr#k98*Zi`R zJ>|gdMZp;&TAk@7g-<+=SvKk&aL!;w4{rK?`b0^jqN8LYXSFT3Q#aB}pIDC(gcZ_c zoVho4cwbw;W6gSu_pM$*?r+u?ZtK4yy)x?6YApx;BhK=lX0x&5v&PpOpJ}m$ZJUd^-uYI;jbqS8 zwfyi6&aTGY*mYZSu^rjJyRbNK1dD&3$C^^*P85Ksx@A*2~{Q*f_!^?_ko@#t}^LudDxx70GcLtC~mQ)d4f#&4I?wN96+9^KWix0ZHeI`NqnvAo`V(EF)yY(qMu^K(AEJTrW6kFLZDY}oqjzQOlu z>>t@^oo^4qJ;f7Syu7H^0i_%JPUJm?td5B_&*XVo>+^U9QOk7HqD|Jk`(2J?=M3UK z)uSak*Hk^w!P(i)i|mDEPA|k6A}c+k%ado>`Ss}7`K_?wN7byA)nCMD*!(Lme&^_{ z-Djj@vm)2vZs45E424oXgKs%H+jD~6&pyLZoy?Y}M;{IebS~zT5mVf5U;rX_sy0FjFqd4;` zGS2$UwdkQa-wT(6wYM_8q~lem?$Yy@M0VsYnaC^8**Mdjfiq2lXPVllow*>p=*&oQ zJ4SWK_HL~g&VjwbyRQ4)kKSyW=4T?#v=rlxqYtwmZ$Ur)n%|>0g0A=J2khH5k(x*s ztg>nKqrmE(yw05V&xP}f;>zjZj_^9L^Ngc?p20byb4{){^3s{R=5%m1$`$gfL7(C} zC+rQ^6;H4Adv@VjRei!e7i+brnG<_%=KDv^t6Zb3uAbFr%-U(|AI;mG8^7_rvpaKN zdHNpTS}nKKTyqC^K0flVC^LQ6KjX~!v>wIUudFxgqW;r5&-kKu$Hd6)d!p&sMz3=W zzG16--dnYsa|vv=+~tpF+ylw(i~AoNac?U#vll*gmzO=Fs>f(&58BYJebc8d#}(xn z_%%VewiwNfhDz<+G0`jD&vV$gEtMp!#OK~OXm0-SfZpy6SG#{$(boZ(wHe7%DBh)X?_1ER*_%wda zD36gYk+~0;KC#4K<*Ah!(fk%%8{F=mSNc15NI8N&qs^Co`u>&9{!D(WF3sfFnUnm} zr~7DX{HzhP%eUZc+U*XGAN}^KNLSB!fc^FGveWHJULWc5&w@{OMsca%wWPzXSDk$# zyBXK2s&DpkMMVD_n!C@UY7HGXEm+~e&Hv9*YGU?2d?QmG*)!vtkv*w7t9JLDxVm~y zpDELpt{=2^$Cxg!wBxpw{549ZRAzM(Z+q|T-c~sLK52U;e@|k5!&2Oy`PQZ&IQK@XKx;H@p%vTc!8!>%ToXUAYtA)u~r& zT(Je3Zgf0%r8jKx&Oux8K7GIH{*?!(6=wY?3myjLMcrRH44oME#hyFk=8Ufl^>&W& z+x}aTuFU$br$?^MPA$*)@q1e`(v?w8=Q(*xf%DBo=9_}dk^1dU)@7`{c=S*HH$<8J z;nMjv1+Qw!RaM!;`$eW+-FM<0d;7l}=`!ub-yDsYxO(>9Q5$D1pS&%H_tM5;EwW>_ z`IQL1R~jl0k=-i$Gxi*vx!2YESgh>tmI`Zxsu7iiMbV)uOV8gS;d^L%H?L!I`qWme zKzaY`eyjnbnB@mymhZ&9(b?;Hy&d1!FA~2p8j0e*UQr~wIH$+=t!&|4=QD=PJ+|!O zc`22sa6n!vT74j>qr&92RAl$oj+$UCg-kGuio{zW+%?pd2&TLIv(!i;nPb ze0pom%7Oyi3y~+?Yf(F59Ia*DZEr7a=iN|q_XBN?GxbL24y}JT30IH(a?;*?J=PKI zH7onn1o3`)$qwgcEHfqRc?`XJj@Qh}vZh-tm|v%v9?pA3;j*21H`gJ1(Hn4=7Cj=n zs9%oxCZ-eLqfcAkIWQX8y|QrN)}nCzu_qj^s&U3xCi3*D&0b^|Yf5$NU)A-py?Qu) zAy$N6h(*1u;nAMu)D?n1S0Fd}`^>t*+?BEB9rIs0*O=Lp@msd&(LSqD+WTr&@4Mgo z%izxU-#`0Y-0%Law=Vcj?z#K#o0ML;wbwS?FgfG@uc`fT{jo%+sxv;!x95@9GRkRZ zwoBbwk97UT|Go?7jc&j6+rGAV?TCp_w4?0Bd$BIYWd!OU+&7J1m*5V1WjG?XXyp+4 z&is}ned0mfB~3SVpoicd+}?q~s*v+V=Y9RqJ9_i8!S|!q%ATEvRdc_*cuv>_iGl%mp@79L>_@gmDbG(0y zf9+i3d}~|KWA=zt6%HO#(Y=oC?6B6I9adKl#5GWkKaM)@@9<`??;PCWt^UToQ7^6E z6YV^TUmb1uuJ<19Y;44RvXzB9UfRgtAFYhy3KXk|$tqW8wCjI*`=*xhH=UP>f6%Pr zoKLT<%Fk!4-P-D{W)8zPb7$DMPV(FJ)71@sU)m49fmPH!e`U?{_bw;iiZyF1`Af#k z>>Le#4lO*m=)jWwjr)r4Ty<%7 zDwfDNoT59H?!|AoevE6Lr=jX>$h!geRL{jMdL%e!MP6H9ea@wGaTYs<`;61? zSQUIju_OBP2!F}B`huyqsz#%A97)4}%p)@E_XuWRS!nI0Ud{U>8z1}h{ck+hfv8l| znUlrsm|49m|Bpydn-+1k5 zy`_@Nme#kn(u97@<5ZFj^>~C>C;-eM>S^D39K{EB@0Sl6tC4@Bjy=`g%N6${b>!Fx6|&!9(tndSqRuqP-qF$0x6< z7(e=(r`b{QO|Nko%CPLZ`nqK6vSbUMqxPkw-wtfMBH4u=LTss2jUl3=;S`MRg) zQ6(KQsRy?NJA3#DOs2IpwAME@)Fr3PoY|7p0p9FJJW&acU&1KFj%0mfvez<|dQ0o^ zz&nhw`bIq1F3BfD(zsg@>+#sO;Q5Z~jeHmrA1{f%gaO&IU>+WP*xI~oIUCNco&|gi zWw**P8)g>p+>MmFI-(CUl$Kn!C^>8D*Gof3;BkJn%a$e=F6Z;+G=QB)$BY<4{WLRh3B0iYww6osns;>K#=Q!dx@rPMUCjTBz0we!GXJYc7hvl|T z@T4C+nWql5<5jC0echJ)vMO(;eTEwPtf>uX4)&NI{732}7cHo7KzBs-w$+*j!{Ero z@~KbiY|C_KJ^U@`A$lB~Uje2EH`Fy=+qxJXIlZhIL!uS!#AlJ=kw}`Q%?ar;JLCIv zx_v4bdf4J+Z4I@_#yVt`T#V&&cxYycv(ZOXB%r7);J{XPw8R1=as4 zP1N%dok7h0BUM>%wWu%!0-ttz#c;(C4|doQ73{}(w5>U5d<<_(C0iHQ)n~SY!!Wjz z={7u=)|%GWdYmMUHl8D4cH?!8%WiD!Hfxr8mxt%j5yM+X@&t*8vn7KzDnWxU&U)#8h%dL@KwVvl$El-%cI22lvnCJ1pwrd;fFlpg2T&9lAm zO@3urBcE~U;aPTg<{z3IE1jj7d+d~pN8dFrXyut5&(mFo=Qb~1>du*tM>%xr455Dd z@#s&O*F99BS=&`N)_!$SH6Jlug>x#qM6Y^p-P88QOgGiz9D{!9uab;Er*h2dyoby) zXzvfN*0{k*t=Fg7CcR+Hj8E1sYpi4OOwYzcXp{D#a7p{n+Mt8#G z?<-u-bJ2vk)Rw-)H^w03sl=S=?B#>I$E*74H>O`Yvnn=lApW~}vaE7w(*OLNH^hIc z2fzIIyvJvthf_BGn>PN_R2F{vnS~4BEIh6t3;)GC3qLu?@~T_Rx@1u@-GE2V1xuz; zWuRwG-L@@u}g4*EQLjqmy71ed85ik zjVZfm)WsvciKU3hf55L783xRWMVoJ^7*#*2seInjQB7s@(tNvl>C(1_@+SRfcc&0J z_FlTfl;i(9c*el@uzw0(EYGX>Pxt=@#^X|g z^6hf$dHlZ6_QBA${nIb-knMf%Ond|>>UFPwQ{VjC1Sa+IhMetrm&4y62&&)l+HKos zv9rAm?K>a#tR~ub_iyTRO<>>88;AItVUKKju|LDF&w)XC%=VJt_%pn>ZGR|$O%|Sb z#QNCm>~BK-{RP`>f5wxA?Lydo&Te;)&m2D|IQ~rUch)}+!||oQ|Ao$e=9hV{hB^LK zXa5gT5v!0N#|rZwj_objW;67xpR;}cqk`kjws{@`#k0Me(LeaNo@m44ng1VbALssG zB2fOx7d{(E`#)5M1N?({*li970&T*p**Zxw|;MO_WR`vZ9fv)&c%dilBqBLoh5hsWN7;= z$NpZl$HUlPfCChNkyD?1=Ev*U&-p?7Yn=Uz?`CKFRoL_IIl1+9!rA`|6f__8Q|S2H z=Is9(_J0}s6;Jp6c}{3N4e;CF{`nPn9N-;Ac`|9Bzdtjcjr}!&f!V$*$lq+|_K|_v zZq_FJv%I%C+y9Mtzl4*}=b@>7HaPwUVSgL;;}LAZ{#`-+8-LF_+rLA9nS}gtUJUH> zg8n(c`#t=vz?|*+Tj=a(dyN|1GC{ zw6}l83t5`u?Vo50w);BeqkSs0ZU3Z=Z$Ad(sSYRh^RT7*EDPBepnsWU@*5J0zsT9Y z2L8sQJm{8zzr0ZU);jht!G0e4A6+v4v#`*p!}b^K_MK>-N3qTGq~dD|#mDE*nPlQ? z2*vkgX#b0$?T;M$9mwxoWX3sA`SI_Sy8efTwu?jCWzKdr{7r*DG;84R3THptCo5Dx zcRBkfV*fXB{7~ok<4(Lh{vl`kLX5{}VXyw&j)pjhZI}i5H=?~w8sI&Rz%E4p()@iJ zcq8l!9s6e;|IBYis6TE9wa5L=_Je5O^%x)SdgA@iczNCN_Z`^3j{dLn<@wnDGq&CS z`Lg4m@f17t*NlBXK>3C{@xLFkFAbIFS@b!RO#d0>?EfP2{~_W{SbwWgUsqt;oqs+E z`Ok8W{|B`HYG-`?588GL%A2zO82^07{#xYM4jY}X{}%1J9POd@zY_lT!Jp2TJboV%Xh$G7G|BFBd<46K8-)x^Vwx?ey2EC{bb_5DYXA4r~Y~T*pPiLH23(T(Dp9J z{!NrMj{0!tx0B9(`sbS6^*0@5cDFY<@qHD{3wj=+{_vD@d;$FZ6m9IzcauZ@t_W?< z4Q)?$>i<{R_XG4%hRpoFiR~w_J=n?rZO5MF$#u3@AzrR;H6L?7mO(ZR@aAK#D8PJL z;`nQJ_Fshk?Ks{oPp#vh{?<75OR-icK>O?b_+QBXMI7(;hgTeX9zVZ#J_}d1%>Q7>{uXDO*S<`Z{`oTL+wXJyeHn8@7s{*a z5#1Z&vxKwItLXoPWB+x`Xa5d+cYgZN*-!fyocw=pbE>mnYhm`MEUe-gUxBlq+t)bT zZ=nC@V7#h7{fAwPuJq#{>K{MXvG0C=aA4?ugSmfNU8=ZD-me>79)O@eAi*e0GoD%op>6{LJ=! zq3xHQ?Ftm+E%;M?us-i__VZ8HK7sw3@45d4Xa5gy{7cvmIVjHoXMgwj%zV=o>>uVm zgZ?)NV~kUV>f@-hzk7c%$2Wxb-yGDJ+0W+>rf%AiojbNc7hWF+aHH zw+$itEXSVtz3=S*E{^{I@s5MWcz=TaQv-ka=p}x0{kk(a-fT||ZD+=#+5bUkKkrAH zWcE)8ZD;0>;?Vb1snB+b_h-aE0rMZGFhAb)*sjDjE)o3gFJQX{+vvvr_M<2m|85AD zc>Z?x^Id7k|AnFL^3e9E(DvxyyTTJF(*S(mwvB<RdnN84$%?Xx z+r0Os#BKiF6DGPHfV04Lc6$*9zySQ)ZMSJd`*wm&+>V6y^WKRP_w!zc61UGq+bMDT zWN1I{l__z5ZYbXDP<@{WZGS@tgUxn;*Lis-u+MaFOmoYGZjuj>-C}Sl!C>lA8+V*{(T80?*FMa@X773g!11M+Rl78W$dd$@y`mC z|Er<)ES*?S^6ckw>nvR4LELp zv_O`A1vqB=(?W+EXm8t@EPJjKQ?@>Drj4x&vTQa`w|#&t{Q)r7Axw|qh5xMXrzh~9 zZ|jgO`|aR_)ydL#flGKYLfV6u>WwU$ePGoaS^5Fmv(b^r(hq?XRwqk84pzO9rGHHQ zH)bLxOV5Rr8UO()AFO&H%cg)fwjNSo#ZQ(E*Yk>>EPXWX`~z4_W$V+H)a>M3(*-?X6Chz7rfjf;S|xbp8z!{Vk0b$+mqD zIDE)qx`++&-T2?N%KlZyhI=E{4~JRAUbC}Xi`fMuwjZ+j#s1pzEC@)5>?e?|e-15;L9*(K-7Ce#9TMYIdy!?su+&~; z>5M<0Z%F)*o&+bXPL|I2)qlv+ITw}i1})MAyfhZbvZ(^6&chqhWV{q7SvECb#YvVv zo%UbA8xmRiOmM>LWa-y{6(?DGJ~(zh-jLWX;z{86KcTZAk!621SaFi2&j%|`vh-ST zegWQ)$kG>s6ILfnzX`1VPnOOmkFgUW@k3k+Rv#eCp7oy^jyI%B@X|a?mJQ>N7vT-b zEeqpJ*}NLTYCE!yy@56t;0@`1yyS;0n@7O%vl*;4`OQkMPx z%mIPaqd!~S?a#AdS5o4edyDZAD>dBe@CtDJn2CX`81AM1TceYuKMYP;KTpucUUZXX zvy(O#;tlCJywpZy*}MQ&8GG4ztrcthfc;vvh=MPS84mOg>@ zWAKJVmR<=?Se-0=Dp>uNEPXCGHWqJ4i|`WrW9@gQ4#Q(jaXtcj`Pl?koMh=+!TG#^ zM#CagwF)2gg_eNXPJs+t|pm`G3`>7t>=eZEAJ5P2Y!|Vk0YG-owzC zB}+dKoElH>m`lN`H?nL-fK_i~>Hd1`OXk=f>oKdl>oMM^(0oFcAKnjAn_l7Y)nLU# zmi>IN;vq|~r9C?u5?T6U+FPA0y%nswB1`wzUG{wEuDkZr-p+eu+579LFPnT%Kv&FU z*}M)`%w*~R4{7fMA60dy|KA}A21FbfK+K>W14M{3F(l!Sek~g)L7+&HB5Nrne>!Nj8*L7X$TGw@5`+c5! z&U5Ev5^R63-+8^}=6#?0oO3_t+;h+UGk0#@q<^N#OP2mN{Z=PS{{XC*$-f)yKCdJ+BQrW~^L68f!9mOc}#*vQgXfWxy)IX8jhmYcwN zvyD!czZD#{I$1jZKWc&p7No79LGkRRM<`=Ci8u@VUCkKbjcGilNN$YzAu^k>%kt zblOH_>D%dFU}7Un-$B3C$0%+6-00?~{Vn>Fm>`j*zXOh1ohSXB!V8uX|K8-q03XsUsXM*E(zU-lOK+sV!Q>@NZ=v7nWa(?ciJOd{-@|HMWO;4} zYh7gNchKKx@{*-*qTlLd={vw`PqOsA)c*w&B(n6U!Qs`W{DbuHgbRr*&k=g;{(b@+ zZ!-QD$<2merH6w75;vRpEpXx%qrVMS-N`EdELe3XOMj34Hj|euo#%K_tCOV<9+a*- zSvr496!}*ek;u|71&29MAx!`$))<~dKLbZ1%U?{tZ3q6IN#h=WE2Dam<>&dH>gAsM z&8B~?Sr=LUx%69|EPW|h+mtN52Ao)D%Bcq{2C_VjV8uX|-a`LhnY?7_?etrnESh@mreO(>AS#DtCOYg0f%ol{>Q+HPQ&}b zk$*GWjx7Jv^xJLsJpJ~Vb(ns3MkKQQ#~uGEdj8#b$nv~G&qlM}*THIkvOH(NYJakH zo-^llnY?7_@6c~`vhSXC*u;L_3zZ#tP zbyE&mI?w;3R(G!j7D87!Wchh+ALfloq$;rLLYAi%th$h;*VEr)@{*-D(r7g?THz*-ks`f2)m%(}?Z z-=N>>Wa)3x-)sD2>2K3-b+Ysi!D<0ng>OTX30(ief% zR%Ge5)NNalrSmtzik~dK1+4hV(%b2O#Kc3EzLtKglclexU+21x-bugJ$?|UpD}J){ z`@lLz@OQn6nJmu(V8u+9{viE5CT6nq-Sk_XEPXHi_P9ot&gYeNydz702CSIL(oa&i zZBCZ{GFb7GrN0VR{AB5`)BmW6pDg_h{Z=PSe;2HH$kIOqs}1qWkYG%k0aiR@`L6*h z9z zO){in@=pxUCO>6(9@*wy0*?HrsV`aOFQ?~e?|*MY-_OgW9<#0!So!D@f9{Anw+cChw4 zvhSXC>z>1SB{atYU zs43?I^4}Qd@5CeTn|?)>fA~=7|7CQt^fBP@F_V|i!Ri?#vOMMV{H^gUaCiy%xY6qz zz6q>0A*-Awu-b$yy_NpIGv$z_uc6=SWa*p1Y7?^b`>3BV<&dTKg2TTy`fjjdBg?ZF ztk}rXAETc)*OAE5_tS56vh;&s-B%$?KLSqJYweTZ5%s1_z6U_@kmY|Fta!-MU!}jt zSXEffpvZQ0XTfhtZV4`;NKV?4pz)$Dt309e8={5AfZ1R$&*U@ivvh;Saj+%oaVrkvZsih(T8 z9bm;kmcEJp9+Q_WeJlM|CriJZe%m+5((j?)>SXCV!Rj-+!Qp=}>)P+|F>vI+P1}-{ z_Y^q(it)chf2ZLy z_n5q7>6_`dI$8QQ`fcAMOW#hv)ydND2dhu=-6MJbY}Q4VrxzTxI$8RDu#PWe>CaNP z$568Lqu}rvQ~pVM>~l?Id0wUGUySEXhtHDVH2UBR(may6$4W9)o9K^ zy7>Mk#YvWbELd@prH`Y($K)kTkI`>+vh)e`_ZmN0`Xu_TPL^H*9`QZn=ewj78(E&K z!HSJ6eJ1@qCNEj~Z2GNEmOht$8v|MT0{X2^mcA6M*!Z3##YUEA1z53>rB~74V`3vq zuchDWWa;(v+wqDly^(&alclc#YaCk(R%~Q>)`JxrS$Ze^Jtj7?^e+0XPL{rzetVoE zOW#Jn)ydND2WuZEOW#M`-rFHde+oRJ+Qjn=Sal)Ga}cb$kfk4@|36J$vh*YLTb(TZ z6j-s5rN0hV3~!O`b?&eWQU3p!afvK{7#y`aSvuc2tLs^^^n9@DMV4LwR=vp53&G*{ zOudT0d4EW=JSEI)b+YuCVAYWQljT1RRy&ZTzX4V|kfpy#|Hr0Gvh=snw+$6&=zmOea;*#2nB83|Sl zWO>Gb6$4p1e=n&0nk@ZN`g=^7Wa;_zd#0_((hKOfI$3%NSpAADeGWJgGUf37T#A`2 z&jPSwCQDyLe~*ccEPV<6RwqkeMn4~-M(6k_Ye7g zLd8#(e=}I|lcjH?zsJN+mcE^StCOYgpx?eohAjO)`mIiu{vde7_f7e`!HSJ6&t9-% zBTIjb{vMN;EPX%yRwqk8K);QFEd6QvtxlGH2&~xn-bTenmgg8)v5}>ppufk&MwWhx zeyfwEzeK-{fh_$M`mIiueg>@A-U2H&vOMpA6&qRlyYvq>eS<9hefq6VmOf}ix{r~i zj{>WY@jaG`fh-=Z3nXSLi(*vmR<%{`^*MM_+o7& zvOEjG;q&aiM$R?70-QG_&GJ`4k6N89eGNEqzVY*Yf@%k{Jhy|@4rJ-u!MgWCmd6kcY;+WS)N|7$|OtQMgIjRFIoB?`mIiuz8{rdCAgG({FXM^tZu^fh_$a@Q5FpJ~n(L;u&em z919N4VZido=!qB)-}|SS$?{ABD`v8E{?K*(6tX)`UJ49yZP=_#YUE=5Ukk9(u=@~ zjV!$ctk}rXr-2n4S^Cvr#YUDs2dvl@gX7~&f4GtQ`=&h`!Mcx1E;X{(4%U5`wcrso zWFxcY^c&81izly~)yh!BMM|r9T0V;4PF) zWa-a<pd7FIoCA`mIiu{vvq9-}@nWuY$EMvOKSYwJx&s zGxT3!)4XwF6oDQTmI`y2#Rx z({FXM^jE;z7G&vffWuQvId6mGC5GPtD;~1^?}8N%S^E3*mzum}=^xT>b+YuqW76@E zr4I*d+~a$N6$4qGQDDVDmOhsL9@96-(#O$nb+Ysr{k9K~rB9&W>SXCfVD*hMaJbCW z_Zsq4!%G}q0apBEl~V;){AB61^iMP8kfqntZ*{WtwP5YPWa(SM;pwIvzB@TQ!|-16 z)rR+z|BvA#4!;f7cSB^A`5ryj7(ZVI8veB5T=GoAVe(%X&I3ov)2wpx>9OS$fD^Nf zCr*8~;WDx9!eLMYDCrjS}R-9z% zyTRf4rks7`1%{uX|Fdb9{~73sg+_mtp6k*q&k>fh$mo0*cK9m8r@*QsS^k&6sv}wY zn_yknlck>phd*b^e4m~yGk%ig`4}9xomw_^oa`dIp{PL`ez))>O~o+~!8Jd?nRjVwJ*e~*ccEWMb1tCOXd(QjiQ zOP@i%)ydLlgB9Bxuwo<2GY_oT$kLaCwe85#>%e**qaLg>$?`OURVG<_3;jK&zGUg` z^jn=QeJ%aAUS#R(>9;yr`X=xQd#vX>;uRZNp1Z+{jV%2h`g=@lWa;z;?9A9ku`9ZMS`H;g$z^WHnd5?irFS7I#^j~kvBuhU< zztzdoUj-+Y82{^Ft&1$r8L-wxmi`v~pEr5Q(%+%q>SXC3fVHmdi^29@eJ(h>)RZ#} z9JwLQ$~y|W?$3~=j|J=g3|aa(aD165=Th*9ub6FJ08ad+(fOWy)t9Wiaj@!3mR?N% zjV3QydKvvzCrh6V*7Jd6=?lQx)_j+KlkYHkv7?uf zw;Fv0d9&eb$SVw&lWjb69G>U!LUJo6NQ?0a)%xhaGe7hN!>o3w+c1j`Z8BU%w&gQh z=w74OJ9?wTE#z&+(@q|0+J7y1g5mY#iH1AL;|+I_3k2#f2_6dM-HrCBwrU z=5~>u4c5I5vigJXuQYk{pogmr$G~~jX_kKi^r+Rz(&ONSEeDT$dXa2%EGEmtzM<#A z$kNAw;fw`vh+RRyk?V^Ed3GstxlGH z0Gwzs{-?ldH?lm>fYokf>4)gI?L(G+gnp}&r5~gJ7PBt0^b_=3ohowvsH z{RLS%FApN;nV8AadFr4z$0Y=6Ej)mtf1fOWa&47wSCFbIaVZW`*6$;uQz4pIh;@a zveD-_yb!FI$tsg|QOsoNtVK~HoVeK%P3BFnQEta_29KSqBKCP-xI`@uSICrjserSoC3^rz{! z=fh;_hro#qCbq+1#YUFrC|I$Pr5~ri2NNW+^pjx4Mwb2}Sh10%zf8Z4jV%2PSo>WuO@FYJQJ+Ckma8ZR$a)_=hAg{B+Cy zIXl3LnJmwJV8u+9zLWm1n!IG`z2KBRo#bSB-Ur9;F`kd<8Hx!KSss4P6aJR*6yT4po5=DMf_2?Qmd>wL!uMl>G!1`L zU$Q(`gH>O$bdHC4J262bOP>vnTAeJNw_?@iWa+ik?LI}8ej8Zvkfq-aRy<_s9Ln{~ z23b0XT0OHtmd<8XJY?w)fD_-r1gRH);@>vB3x6WR2KhQ!{zvFxCZv7%qnOF^JONhB zWa&@Q|6NRw$kLwyN3BkleiW>8FtYTMV8#5R!!J8L2J47_4+7FSe8LYJo$VWya%9%e_-@y$$JeSVctE4kAf4noMT|s zg{*Q;fK?Z=bdEV11If}~qQ3_dB(n5Zzm^G+4USr!Ed6b;>Q0u#&YIU;oI9RcfrE@&dSV5Lv16G{F zv5xSMA#hy|^B5Z5Z}fTO#|`tmNL&ThwkE6mMsWB^<8J}0?qqq|!Kyo1y5ENnn7sY^ zu+`l@ycu~_ce2Xa0Zwp`K)M$n#Xy$lez0O7OJ{#pUm{C?kp3P_kjT<^gLO}sEPXFn z_k_vPxi2VYvUKhXiJzL7xi2VYvOLGZikU2($Kt%FObX|VPevUK(eT9F3;xukYO%aB?YlX(uCgszpQ`O>OjWkESFcJ{rm9;T2eP)b zHYZbUZI#JXYkNaoL$VqxSd(gPs2j*^)<1x?rLDTMHr3YN+Ptn3EB7X>_59ceu0~6B zYa8N9wPHn;Ev>-%>ef^(b5^3l$kbe0-CkW(w6N{ghW2EAQG0bwW6EiVKV3l3c>Np4 zRHCM#sW#QxR@q!Pa0Gv{0J{|$QlDIgt;)H=_%ln%=m)m`9W5=*t?g(yv}0RCb5omX zy@i#PbsbH~%F6yN_WwCYbz@7DU#eRHyZVMzmDP=_>=p~!E8Po?t-iI@-?08R{!;-C zU>;~cFeUrFoIU4Hg^+A+zPZ7=&fPd}w{A_{(t+;WXV+>;HPu$up`;BG%?{J<^v}w==GMwgleVofuWnma*;u_U)wdwqyINB`V6X$50d?Sr+#wgC zpJP<-D}wr*6Nmy7XR?Ky2V}NCuK^S4uY<)Eax1W(`)LJ$sdIKucEG@sk*V@ zwp67x`(3b4qxbKjZqNg7ID2$7g$+0?XcPY#PWO2G2_@o;A$hZo%VtkfS7<=rPu4dN zP%V4x>9YjAA~-1ZS&*^U^;u?nlpjNDDw%3nx*irk)9G!98!T|;&7zVP; zPbq|57LFqPBp?3{)S z;IczW`ec3J@Xg2_oFENQkiUzzbkv|bW6!Rwwt_agww^>6UzHjl zo9bh>Eq3MAIAg$-$N*MT=sAsbt*O4b{Ma!>G`H6FDUBPA2i{}{t}H4Wn(CS>>sp&v z^Wq5?P5rFK)>OSZbxxbJ$&3fZOh}iMtj5_!vQNQwXY@})a2nOR4kuIoxg_=;biV<- zc9Z(;X!}TITT3eGrMt8_vJ@pf9`tcBgum-n^RJFZe)se%yc*}ItTWodo+K1qb(LsF zK+^-77SPmy$^t44s3f2%X(|pd4KsqZ1vEXNX#q_Qs4Sq;fJy?IlBVJS1Gs8>u(p7v z2Q)39sR5M*R2oo8KvU9G9AE%fO$*i*(DZ<&1vE9FvVckhDgoJZk7Qf>lt6c=I1mH4 zYHG0VfTjmDEug6Zl?7B9P)R^j(o`H^09Ta-YYS+4K+^)68cN0S0hY zX|T3{rUx`Fps4|s1ymYP3CO<;`IEN~oD*dC?5SwVl%Oz&iUTo#t4e}^1DYPtw1B1t zR2EQaKqaI;C&SvG)4RSM9Wt+O5Nc42L&bqeSg>^d^vWrU^s0bn1T;OMX#q_Qs4Sq; zfJy?IGQ~lyWJ+;b40<^Rttmy+{eX%M6ju^BpcP#e(2Rhl2Q)39sR5M*R2tBfDQR?w zSRBJmwm&mnG~DCAr3}&m+(f-T63p@zqo1C~lswqX`v2$GqW{O-x%Rv+m@<8*RS2B& z@o_5NBP{oG<9}qW^t`nQWE$of50~*?A#W8jyYh_!lw)3rJ|^Byb<0~(<9P?6vphbA zsq&7aaF(ZfEJbp^3>pSPCc=iApS>B~idDAoY z^Tn5=%?F6DBx65ck1vii~Or}2tGGy*>LRV*mNygMjzu+lJ8q+zpRCSY=+*+Wsjg9 zScShmI4|F)a2}yHq5dAqI~z00{|+YBgY9%>$+Q_UCl&W&qf9F+^OuyCPA@STs)l~0 zV&U9SNNZ%-{~4?wMSFX`Y}QxC8E=wzIhKY-3_hNJtl;Q^Ba03%IW%p{{w+mY3%fQ{ zd=rj;>4g8eygdVN+5Ury{O*EH(h9oY zEw7n#a?b4e`{(B`$f>@gbN(&k3r36?KVid|@%djLGd_0NMdOR6j2<7KHF|vE^`pm6 zsvbSQ;Fi%?J{rqM@7$>xU zsNB{l_LuZ&kB5h4=g!|)@eQ5CphJ!ubPYwPJ{i@nI0Zm;LwoKP0(e#705-+aJ} z+<$&3^2MQ{&~qCr{@~@zO>Td|i(kLtwTDzrVzKa*DJ1_pP6xzxLc|`|J7X_VDwZ=*fv? z)j7Q^)EoK3|6HgV@7)r)VQWZpN&IV(!mXj#BHibA-ZHvpbWZ5G4MXN8t5CyKg*Q7V zvOFjBt@%rW9)#`t)y&wrWn#nK*s~r!mNn`6NX`qxjypLc9dG|}i@zsjmf+Us;PC$S zW$Sce4T?I{JE9_4^@x{MF&W$EDlb2$^yVkg2af$QS(OT5YvwE+6gkh!9ye%Z_p)HS zBKA8o*X);kVgEI{5uHUuS(8HHp6vNvW`4g{UbtdVI<|`|lG}fPKKBoQjQrsb7tWe{ z@*k5eFL+ngMFy|A{qY+Pc->nzJU28){j%sAxwAsO8!F5;nmRf%bu^v|+51nATx{BK z}nWbg~aZXC3z`{bsA%`a~b+Ta|uIT%jI66*a~MP2uTO|J)SfDxegOSfz~{NSP8 z&mTRw=+z~!EPHwRODkWjIaPP^rV~xa3kMug_7!QZk5(+s9hF;?-V)f~L%p--Uw}Pk zV(8@jtQWAyyl}C1-CdE6KU|2>W`Gg4DO!AI+jO6y`j&t?D4Uj!KK}kL&?rv{c^CMp1!PqKc#*!ujjnZ(djx@^GFls2psBN zw1X{j_Pli+({b>Q3?1s-bzS6wIT*YD@coj*k(`O&DLhn~^PTeK*@wNX7qW45%fa>= zk5yhY<%H-tRd<}zR~Sr4TG`%)4RR=!N0z1{N7== zZ+LFyHzMax#JawXxE}R-zB&iF{wkF9!UW_j!`}Y*O;2L!U(HHZ-2gS)j~HV>?UUZ4 z94TTo&e4oD;$G@qmbkX2d&#B;@0^~CmdMTZHq6s@d%Ww5q2%e>(8ljC{7UGv*dMQD zj!v5+6!=VACQt7QVMM?dyXN}L{>Oaf`RQ%(au?enYvM4BQ{6aD3_8Xm#m0%lvNs-` zh`5s5pY}E`czA&G2e*%${#5@h?=CNng?hIvVDEe6`VG(drSGb^oX5QG%lqeKpXr^L zGbbIT;!Aeo{APPM;yspy{*#?ExAE7>&ZC~c?>!ajo$#feoEOg9K8tJ0npBa!aZ-17 z*%$U)pLO}d3$MxD9gGS%q71m_pO{qBeKI)0`D!%x%E>m5=MM_sRDsmLI(Ilk=a&az)72nsohTbA#vytb4dH-QLOYP_McpGBl@Z z!|5UD1A7PD-xptz&XJ<~KJ?5vNt}iMZ{E6&*E%8x@^H+{*^cv@s?v(R-s2Tddpv&h zJUJTU?=5$QUaP6->BtG6?Aq{JPe+Bf;kDnV;O+d^ySSZua`p|v`A|+6=NCOWy@T9Q z_4R8v{35ee*|QfX(h>DmVOG3Ttm}8I0v9C|O1LZh-Nll;gc)t&C?#bEi*P8WR9z-)x{>7KpIA>#M zqmI#N!JdwZm|nI8XLmWC-*PAX@(%jb)0nQiW$=snrwUFkII-yXl4Hw`E~j{n|D~tHw1Ut^wn?1}ywKt_i<~Yr-FoF6?(T%bLbMqdxYtisIa*x#`$>r55Ua{kp8l z+1X1L+;Jj_yU|$_e^n5AEw{Y>3+Q$63NP6?4BC(oul8C7@mg=jpmYhy|610h4dKid z_IuK&*E`PK@{N->gg0WG$2A$R4KuIPhHm(T@t*sC_?q;3zp-?0cIG-+*YY`OkAKB^ z5w18d!WHL5xZ=DBSDa&T#W`kU;jA&Z;v9o3&e2(DLtJr=&Pw14H1XW1i?Q7`s`t4{ z%nA+L6KWikzDDHr$6l}J{K;8azd7GadO2QX%jCg5-Pd_VM{dbma(Gr_cj_lNxA8?K}ErjFrYs1PnK3tK@u{aC=s5yymCbr}}zNR}=x@J=- z>AmQyTXLx53_EAmhGh8<(YuPvP46mRZ2wmAFURnl&fkwV*KTKm9vXTs>*e#kNXLi4 z^9hE0Va!&+Qn=85&&wp_iV0!CwFMEX@gBd|g3M9Yw@V1=K5h1geuqU0KmF^|}F(HOCc=Xl2BL|K& zRp}%APjD5}vuUt*$z0WlrHAJCKL#?cPG=459XM9pfKjgVXBa0R^#*?-a>EvkmXCT5 zZAgSh45^v>Gu#tO9~oKlNhnV1_V&G(HSnHZHD9s)x?-`nbyK>QdvOkmldJOL@+_Q# z_T-Ey?HN3GdSv=&Tm^W}9V(6p1GU&$M3ZjaQ17JjJLYVhSTUWW-pKhqLq?bC+Ctm? z>u80u*XHAF`}my&n-!P4G(3+>k2*^ibRT!O!GPybEy$(PwCx7EKf>)?h4uIG`u9cL z?VMRxZo8@l>0JHq&i&foF6pBVN6_@P8F;&tFH#i#7P!{g0)JNPhZpv3{a^d{^wLod zwAEOX#h*)i(ly~d#&~&tMb;0n{cy$Zw<3CaNkvch=+bnbE1Ao>rh8@RwFfi$q>hh; zT|dDc#h$M0;Ep0kf`gw+?@!w9{@#bE(n}hh?diJ0i_hiCU6H=J&RwCFowp)$TQY{z zi*sKYUzCk~+ZzTf+;70Egn9M;8*km1WXq<0qxMgnyPYk|`;WQq^4RhP1MKw+oIZ#1>d8a0x8y`} zF1{pv&wIn1@$oGa`fjhx`(#&dIk2T<>tkJex5j2YloRp>J)haK+!ANMs9xEV^JBc_ z%{_MZ{uj>(&B%o~Dt_#JCpB{J#@$1+d%AMMzuGo_t-hsjOG&VHCsKPa#~*Vl7j!SW^W>fB`#Py@p@X40ID^g3DyaBM zPxoZ6;_fHsjxT)S_T=dU-VofA9WzV!WV0sbd?j^P=(!O3X|P?L(!Hw8(i=J=**Q4x zI*Y5mfpYAt&dh-;lI)y)JvpZb_qj&v_bt%hUG`}EKi^+H;@L~K4Z1Y-)YqSXaKxC~ z{(9TW^Bx%T`jI`QJFl#7UY)wKwWA3?%eeB^=GL39OtrNn>_b)O;zZlJwkzdnY^Z6i zZe4d}`T;Ea8xK5u={}t0K7zW$Jggq;Xu{*ysU&_U5(}RDj@hSPi@Z0R^bb6edY&iUZ5e!(};ItMJB(fLoBxzW+tUmVD(dJL37%Ys<+oUfWD z9Z_~*j|q%T?E70K z(*w`-EcxP8D}T-qTm1Q1iJIy*1Xb~wIrC!XCu!!HeE)}1!4u}#BEEqA2tRDBw2!A# z)el0vhPGHkV`FMnbtAE(Dfnfa^SHG6)t0lLX@9VLYHbY9?l<8lTdk=Wp6PGKuWIX8 zPnuXgl*sK*tcUhv3S#Zl;;Sl?+&KP^itrm+Z&D2H z(TvtY?ORf*R(F*~KsC^+eRRJZQ%nE1$KDl#LpeF;WrYNT`b9sfgTEh$1;0mWo9yAo z9W3}Wvtrnl8k)SzVs7w$@%HCBG5?oz*hn+h_SvQbc#@6yv9yPukn{<-t-iUVu{PF} zLJn+~7W^F4EohnFH=K@T8Z?HHr{3Lbuo2lq{7vY@+Aq8Ep?3TQ3V#6Y6dv^20lEQx zl#uLbIW#3r?+8tW4F=c2WfueM##&mEhj{ZCy8%LiPK`jL6I zh0g=>qr~TUV)*cxopO9M5A>7f{bzbA+W7OFx}>GJGRetpt5=IQ{2I&`SbyL3<#=at zXKg2zu^m<3gJ6?#{PJrwi+gi*@c$C?@?VDe-(fz1kMh6h_!$r1nP5_m_e1!f!VDf2 z3;b2ia{6mC=EvAJ;8Vz4elTOXeO&@dG|S)2SpIUx{4%G!d59;5tL{=K9{bABpuBmG z|C_kRU5IO6J~qqx@;w^=i}~?R{xZkUc-Lmk-|Nh0Vf~-S`lmSg2ctZbOnoLf^GC3L z+#v9-aQuAc+x6e)%-;q7kKm6w{yCVJe+iZ!#XKGf_3OiU-*@tJ{zGS8eY4#6U*>O* z!A^Pf56zfg?9A`R@)t2b#;&h#e>~4SgLwF!B>YR6Af6>)lg{(kw@9;iik$1i<8(He z`MWi1m-F2mCY|RkfgiW<`s_bn95{)dQvVn+OP zo%PetccqzR;(aD#{_TwUof-3UgY9vicLe=swo{)AQ2r#$^EqS18xH!LSs$ODcGrI* zWB$#I`MQk!xP99v|4kXopUPOCi+D^j>t}rKe7;j3w$Gl7^6t%8e!!WZiTbZWd2aum z;4J@dY>zvz9FLL)?a}Bg=lWjEn13l_{%pql>5TcSGuo@%nSU1R$G0?n`rG>%?bDty z|53*LW~aQ3DDQ_E^{K(U+n)2B`JJdAZVdUqk5GSD>@1&$@}9|9zRg{Z{Kqjr-f2Jj zwZ1GY|2^iz&hodM-!jKMi-OR6g^M$yh$mnSU1BKZN-LXZ`ig@^x6w z=kX^x%Lh5-Z^ZKDh*!rmuJ27JKj#-Ze$Fq+n7`4P?>n9i@mkQnS7ZNm$Fl{tcHAl~ zZ*Io?_F#WE%WuqBUX?LlmoZg#U5^lxR%`cFCjLx}ftPJQ~; z_xz0U*~~8w@|*eEjCr2Vm}Hix<2Un-T8v-i^j+Tt{%<^ZzTj@ZwEqG>o^*L;K3zXE z-x-u|<~L=`W8kpKEWbTtev>o*AK2b2(4IVp)&3T9mS2JP>%_bp?;XK-V#;5TG5?a2 z-|wFp^Y)ctSfj~bo{>NOP`Oz?Di~kQ{Irbu*%|Zg8T0pK%x}$D-y_ca6KIbXw8s^; zJ=S6V+fMu3gZB7)%*UMeddJB>6aF7z`2@SX@AkjYJA?kqh5q(WpATH< z&BXft6Xi{E)|cKs7kW>iJpNAV61%(^^VeZM=J+=|<^MO9N3p!m{_QOP9+vYJg^I6l z{3E;-SboA;&h48%e;?r$V)<$(9xm@fEGCWc>$hLCILdMP9nSnk$p2PG`G=k5edCFE zub{p8uRqj(zlZs;nCI^r*q`e#e=X*V?L61FEhsPIJ&pNWo&0^vAMMp)`B$-A{r@t| zf8Uw!>%Yi*1@Zp^%hi5dUsbTai@a}Q`9EU0JHDTBmM_8bLFiAPf~NiPptJk}EWZrP z-Sgv*o#iJ{-)pek9UtFymiLYKV!!?82FuO-CTG5Ru;-;vULiEalO7L^zt{2iEkEk5 zKs;YVe(eu^+av0)e+9O;NoIbpW>HJ}AIq2@>iG9z`Qs?xJzrYvENA`}XMP3d55Yh1 z`TQl`MOgkamLu$-zMaAPFY)7fCu2U{pD*!FV*C6K`B6-e|8>WI7nXCp(Dme+++ZQ# zQ(oWsSjPNi8T0uW^Ao%hdoIIkf|0l$AMKRSK4D*v=&zLX$FqG5=4S_OW%|%x+Qqf- zjl}iptr^RCuBycH?CURmiSu7XUsvM1lily5bs70@&4?$F5q~M#PKo8+pOJs8vjQ$Z zlHosK{rrvRNL)W1#9t-)U(A?am$CkbGs=G{qkh4;I(#EBDpzEzKYguk+P5;Jyj|Ge zlo-$X8S%t3=Ksak=ZL?)A>Nsc_8XkhKHs&=Z$sH5(Mvy<;s0hvykE1yjD&9_j@LyQ z@ovhffBN2qso&)p%PTVGt8IOFOdN^5VhndYn^=F2bxNH7ruBaS9*MpFV_V)c{(Qt6 zo>8BF%gFz`jQ0Db-M(x5{G+{(GL}DX%OB*&caisKMtQf{?Zq)_B<`}Dvh%n3{;2oa zjQ*3pRyOVPCh{q?EPXxwRwql}437K}6C|?qo#2QanaI*vN5$jTw+y=CAcvJrC z;4lwRNN2!`lPv#RV8uz6{to?io06r!OTX30(%+}wZd0=K59zl$S$Z~(r3qe?A@TbT z#YUEAC|I$PrSrWCc@s@uvhPEWH4nu-mZ^94;_r^8Sfuft zT>*|?Zv0hX#ZQ)}7OeQm((CD;Wb%@w^ISJ-b+Ys|;KXF(=XX6?7g?V5V6BTRy_0^s zy~xtL=(jpq`eyp=_99E)M!(g`(s^%Q+p!m{*vRti0xLGM^gZ+!ntG9?KSICN$)1h-eh3`C!jyB0%#$pnH^6brZ-VpqB_$GBdEW*{txlHy9yn2C{2!2c0|Y4_=Xa4| zrazG7F9gSVQiD_kRy&a8DFLe;$kM0LKgHxFOTU_atCOYA1?wDuEPWAJ{rN_EE--PD z<*A{^j+xw?ijyo)K3H**rE~YlvomDr+*DCJLzd2SIqi4udEFf9_I!*i|3Yw_Mx@2~ zB&PZ3pRsD;xi04;*a7dtDF|F;wMXQr~fKUkjT>4f}>U^OYZ_JezNp!;KcvI z1nF*k6a!hFd%%i;Ed5^k?S4m=en0(ICrf{T{%bHnB1?Y|9JM-G`eR_lOqPC#x;=)H zr5^(;ezNovV8u_Cev1CTzyygb{UvbJ>SXC}fE5o}Is8hfh^A&u-btvo!6t< zj%4Y#({HyUS^6FH+wDb`zKMRTlcjG5Cq8Xr>jj4^4DSLfPO|)az>1SB{So@-n!IG` z`{=hiS^Cr9#MQ?C3|Q+T%X1K{b&;j>960Yn(kOXv3*>KkO~Z-EmtO*!v_ z6$4qG55bCoES=}K;rS*n-x(ENV7SEL8RX9zz1-nN;7A08A(2()a(WgTe--&U!?obV zBExmmKWDg+yx1_$EycH!uQ&P*hyC-(B}V5tVR)(GC&)J#KI$;f-y)+-obI_C&(p$F zjo-sDD{onvRhMk&QLB@s^ZY6@+LY;@YmI>({=6wC22R);n0)6~WQ_5XRZcnm^NfEE z{c{X21Zz8zSXDB?nvVaSvuDlt~TXdO8$~zo|}bh49@^3 zl7^RqBV$cpBC8zUvyayrPaRlwAHmi3a26b3&>kS)M1rsv}wYQ}o+@MV9^y z{Z=PSKS;mrS7hmj=(jpq`f;%O8=qNHY-D*(ffXBB`b+fN;~iQ0EA(5PEd2~v$3Z?1 zrFD_z;d5bH7g_pQ`fYv5(%+-s>SXC3&~NKYmi`g_Rwqm6cMxg^K3k>O$np#WD>kxp zKKrKF$kIpAZ(}1%A4|WDfh?WxD^+Y{=>=fL#^<~g8(E$>Sh10%7t?QJAWJW!-|A%P zGw8Rmk)>Zlztzdo=Ykd6Ja8T_CXmSTECffbPL_TnIFe`fJF@gDaQtRd4xhtPeaZ6F zfmL6!^qc5!G{LV0JW7r0cuQp|Fr*3%%Sh10n_dc*}BZ&I9YZhOG5Y0LMFwzW}VdljSJ{tL|j!Mf9&RdCAgC=(jpq`b@CuPL@6woVeAL z!)MkM16dwEd!-o2(ihXe*5oBiUrN8#$nw+0dV54jGymbRy;?+iia%! zNwDG}OMelpc*xRUrr)lYEd5pbtxlHyHdx1Evh?@Bx<`SpzJqI)pz=DB7CXGm z;S~;#K{nNkto7!BRWGviOX=^#1c@v?9~|w(1c@v?4p!eLOXmzM&on~)U)%U7F_ zrI&;A*kO^%@sZ9LqE;tM=WPzP30XS#9qof;>2=`vH!(rt=~UudKKj2!3g2(|cKnHd z+i(|or(t&Su;pH`zRM=7{Jr3~EtC6*>Q0u2`-tjJmi`p|BQQZCOMeEe@2ttvxgY6! z2eR}xsb`z*PL}>2IQ|_>klx3K-(MfIEYF9S=l9pt$>|t0eObD@U+;zfbla`<7xpTO0m?(T9_*XCyemg98$uw+*v{BgM$9IMO7C ziybZlCu})0sau`{j$DeBBas#VLU7!AmeFIsHz&)(dz<>+oGjhHxA}-)q}K{P{;1(Q zz~NrQytk?E&B@BUm%9Bfl`MTfIR2Q)`#f0R36kYG4AysoWa+#w8tj{n&U>Med{cL_ z{2x;vZ*;Qs+$_ZKBNM|Ya2^K|B(gkX!BMM|rH=!vKa-^wf%ATB${|bV{nDt_-Fv4q zpzHjNEdN|^c$X<>0a$&NEYBja`YKua68iU>ykzOi=(jpqdJR~0AxmFNor4e(S$Zc} zWBX=@w}SIHcp#DGzZ)F2I$8QX^iMQ?vh;iDw>nw+PH?2a_{q|Dfy4LttM&GR6OS8y z1gv%=%fAn-b|XuFf_@$}kjT=XqTlLd>4(5-H?s5-;P^wPocHOm*I#6LJ_al1+-!L4 z`43s1FgRiB6-IHY3t65~VAX{zeJuS4FhL?q9|w+Foh+T_EvgGy`ZVevVS+@KUJefb z1QR5l14MXmuq=;%KJb(;`{x6S|0YQC@V0{DCrjt;fV`h#f<%_S1{}3IS$Y>(`w?0C zHgLkmc`q3Me!x$?m?|E!{JX%4hb*1LblzWMf<%_iVKHiTvh-)c8l%Y44}pLvixsRpKRKkEd5<@{AZXTy@!wLNS5aVuN8~NJp3en?ib_5z>0w^4~GNAka@nL7&6Z{6hqu8X9id?kX1gfO*D3qr7r_3 z9aZHS}AZES=Xliia$n*DM+b-0PS7p{sum!)g>8S$Vm?E4Ivi zKks=gM9SRvqgHqK{e1Wo8(HO-Q@8ssS^7M1{1=!YEyPE$k>yzoR%~SHOX)v^2@+ZQ zjo_%&$XUP_k#RqFP*K$d<69RDRINblgI;{sWp_rVG4 z846Z?$?^;btG;CEBkBJeOpwUZ$AF_&Crdw9pDBbV?-(XXWciE0QLB@sUjtUVk)_Y0 z&K(+wES-HR?{BG^=YpiOFGa2H_NyA`DxWNW6ZM2CpDdmICw?3gq}%X`6d4a$9`+wS zi{kdByP>Pi$@1R=R-2Qh^SG1ucbFiNrQZ*ZTAeKY39#xymOc!u^^&EB!CEg_`Y8H; zjR_K2`dDz(>SXB?z*;X^`W))Km_s5{uFYF%V`)`PV!vh+@H-bbtv3mmmNS^7O- zolB6V@1$O0+JP*67dZY~Opx~Aqu9vuJOWm1Wa<0pe;E@bvh*jwQLB@s^YlXPa10#( z2TYJo;G^}Dnwst>nfrD5=@ZD(x-v*UZdLg-1}C5T2I$3%hSo4{WB&=ncF35b$7eWfKM@#RSw62$W#-vJ0>iJ z9zKH!lD}X7i{U%)NB0cLD(7Bs{7vKO#h=JDQzls+?rVvE#RQ4_MP$11kmX_jkH3Wp z(u?@$8k{W8%V1rDlcn?AL)YMB>95mouffUE8LqCu$?|zYo^7AWQ#{{(r*+ zi7fqNaMbE#>A9$O;%x{>d<-talYPtbjDr;acVG5+4Wf1+%fs74Y6r4(-d0dMkfj&W zZ`*+^orgoU16lgjV6_8T`b@Cefh>JC{qLBV$bJjG-Q8cx;nVYkWR<@F9REEgNHzF`*+Gz6@rhf$jr^Zf zaUU3;gw;F2ikYl3IX z7oArdW+dQyY?%ZS8oM zX&cM7RW}9qQ{9F!Z*Fa@u1Phvq0cn5CD#;Hx3{-8)O6s5pncYj_f?|tR{62Fx7vT& zey;v$-YT1Zu@XewoAUHGu6bmP6j1n9qb-84egD10jOf(dNSUp>n^IUt*xwY zt6bgYH)8P0UDv{Hpcf097y9zmxqVhZi+xq`IUI~E2)S}~b=%E-3&4h~Yi(X#*>ba2 zgty$LimqLBLjt`g+1Iza*5BT~)qex+CvG6qWa=c`)BXPJzw0(wy}K`<83LURhX9Z# zy`3|co7a|R7(Owix)k2Co0);H1g*rDz*|K7t{-_vUOzcQzi}0NS}>rxUB$lkJ9A+DgSgHZ@NrYwP`oT^Ao#^HkICw zi*comuNwa3DwwGI<>}Wpb*-sX5NV$ozw`4Ix6MuHeU6I@Oz{|rnp}H&)uH^{j z>VCIuXsTC@?V?H9GRx8kM8UQye+ z)%>egO?wgM0IxYNTF9J5Q?IgzsiLxgN&_khXi7iKzlr#lhA3X_g znpR2E{$FF~^Ac4Q#qo>PP-JG(57f<2U>m_njX;8i))FoR7cL^Q3=&ij7t$iAMMjGP zH^D4ix~T9EXcI(C8*$;n#Vl+eGSJ3FP@nI+_uP(;S#;oe&%Nio&pqe8H^aO;Z;mz7 zZf0#fYhzg(&DsrVwJIO*|5GYwivK~Mz4w->r*}4Y(`rhr&7r%%N-~ZAb1Ag0)E_<- zYf5=P-Oreq-*x;>GFVTB>MiOXGQkjizRoUe-L&V}{JdJ4nA46)jCY#8=RISQebt^aF`jCqdS3Tk)^GbFPwuiQz8@vt2L_w*cDX% znfD&B&v&IKey32t_+z{c{Cs@3XJQ?0@pSquzIAlZJA~IKV-n-Nr0;qA@P3l0csd8h zn`O-NxT!4aCnj8uPtW>#-q-u__w?eOcf5BcUgKg2M+T#{_}-LwTMt9fb4%h~aJ(bN ze0&?1s88F0_X|HCU+WS1vZHvUl=J<F@$EejGq`cG2R4zo>zZLeUg-KKhDP6De+cW z^jYf=-}e%4e}VNOUbsWB1|9D)WB&NHHCYGV1N?k^?ZprdQhZu6w)kG9^I>_l2STV~ zH!<`JUIfxdlR-6EUULnZ$fm8HTH`gY#xaHq(Y%rd&hoDny%1XX%_Uup@#fhUAym9zRb)k&9d|ALUYx$Lq1dtJHeiUdj=xZPoAhn>Fvu zWD?Z&yZ3vZ`#j(KWcK{tcfIRf@A@-q)=b`+x$36Mrs%Spldnr3O!+QWWA|@*df}A( z>$S>~WTjM8sY@;yx?P{4)c@}7C%csLZm08<@@}7&D)ql`GuB_ChTZljDC3pX|MlA+ zE>*^t+v=-os$1%sD;mEOZJu6H+fdu028$Xio0@AXs%x4&@}*5RH6BrO?cEJE)fLs1 zEtM53YMN@7t{PrpS!MGwufocy`8QPDUDHz0jEt3ac1BxXS$B6uLu=jeDMQtpnk$=| zD=QkCQMJmZ%KGM^Dh-wOP7UmGT55-rqH048Kv)5{h9=akbXw6gT;0IBd3?|{9WFuJ z9VX>FHLEI`YwxeASXNWl=;{))5PDt_t#2Ick14HXD>QqYl9Z*bEv-$%v_x}j)jc)Q z7F4mNf^AhXq*{7xc=ZOC&v8=m`6_0&dkPzDgc=Ra715femWq~Djl($0mT7ISyxWsh z+pu)`7nE+QT*R`Ob`jIfElsrzcUQD5HydY2-?p&1Y8skrmp2Tq%Y99?Ej7dC(FsFF zniku}JOxFY>NvnXhp0Iom^A1pwWWg&b6aYf8SE=funoM@7N^XLhUL-ajn0v7nQIxg zXm`H*YFn1EjVhv5pJVn_6hlobm`z`eiS2VVaey_| ztXTe?n(CpR>F$X(zzYoH#uo2@U`d|o(r(1YrsYd(>p1@|t!%CH9KcS-3bQdS<)I!} ztqD z*LHK0Gr~NEku=Pxc4yG7G3?M1wV^hL89z`S+A7vj$}?4ELq&9XeZ8kYwZgDX>Ld-R zfs@n>)9A1v6UShU`syL4p1}$-mVb1S^ z%~+?!rpo(1$E6jOb+y&CEnmiKoW5$B8Y)|ASLj*ybF7+2`WG~ORb_K+6#d?SL!z>_ z!E;jgRK+@}apI`0u4!ngU0UloYY)y)+1j#fInEEO%(>=EWf^`_8f=z_!k5vz=qc7Q z=UxbMmU2=WYwCw<+Tji&D-)6~b{rsy$HB!%xutNCfor9H(ZIFTKDXOFroPN*a(o+R zN#fL<75t(WhpCISI8xZ+*Lg3-T-Rd5!D$5|U6O2_Wojy0YVx9a%d76W&J@{QI*hQn zNrcJf6@$gm=Ebf8r%jn+7CAY8`ea@BlH`AglocC>fr~*+hWZcXa7yi+s7!u}nLJ5d z1umG-H+fCuGM`d+E1$aI-h{U@-pqcZ^!2%?=bu`5GOq7;tBn4F&b;=V_5R4d*!Pk1 z*Q=GvIhZ-IR~h}i?b~Ce9U{%l$T14rCmOREjsD-YcD4IY^lpjv#Vezy zt37G6`Mb{O85>y}DfI6MM+46*=6t-^ov*h&=pXnvx_O84WvxfKrF}UkavqO69(OD; zke|p>jt*1Gnt{$Dqo=;LD}Lu|^X>HP*!g)?3r;SWdB?sxG8R3$=&H)KtK%X&BP@Ar z$#lO`LBC&R6}v4CCpGJG#ONO`ZFuQlpTjs~^u(3F9qH|^Z;fuwGJ^3(RadhAL}K7* zEW>W`l(4@zy82c1lLfu;Mo(5!=|Q%j(|*0}(STo#jl`Ag_h%W=)iK33@w4rxj#mr2 zQQvc)jNkvkP8Ho8uey?wjkrT-SJjmeaJTE3xCI%JoGpog?XkIb*+&1uZrB=N&a%Y0 zb}JkGW*K|we^gl|9szeK?r_|Z#6V->6y>zA_OKxGyVk5?jF11nqXg6QeNA{&dElaP~VEtvU%-l?;Nq{#9hbt zto zzPH^tQxFl(=+9X%IOdY}cFvDQ)kr&6G_Xg_jh%MQM*8^o@Ae+`ao;{an@9dH7d(q& z#vH4dg_zSB2}Zw84YqH%c3+V*gWOcMvaGiwF>#mcIDo(X>GO;M*AdWT9P|%qH+R2I z>)eNN5@ zBfE`oE(vb%KbG^vqS)ZlXU^U?JEM#~j4h3-WaZnLta7$3jGY|Rw>cY(Gfau9h~b}& z{vYXISGv(3>GFpYoHBCSnJ>dVCd^!!=^GRLBQrKe0}%tQG27_zW4mjE(bL=R^i}o- zUsh+F_n7ldOiI8p7H9M&ESq7PMCja;X$;_ z`rh`qK7F2bdyTUs%Jte!jx&$m$1=K|k&{vSXep0z-=26C7s+`%J9acS-<}KGvXYg* z*eHr_epT^YQC^&rFxi~7=4>+hb-B!8mwjekcx`F#w#-m(oTQ$1rEUzzVO$3jk_~6p zF_5P%YrSvOrp%n)xL`u5%El4wwis3AhJiCV&VD|Y=A8MuYj7mY(<3)A+_p1G@htAk zPLB8OECJqy^+IWU+s;mVhQK_Nus+`Hv)cwr_q)?@{w>-V=9$;s`uo~(3>|J%-zy$d z;`q6b$6wDx<5=J3Lp=7RjoG?69kV+AILa6irvw=`O0bd7M)5YnawO8+h`S5TwM)~Z zb(IZwr&|}W=>_?Dlk+C0Pg>T}(%5|Cb=TdEn?9{odAMx8u12z4S68>9J{LC&c(*YR z8tF*N)j2B)@(ZTsUte&;HEIU#)2pW1=I9D#V0ozG1OBEJg$1<*jgu?t3mWq)qWrnP zzP`0?a$`OeJoJ669EIZ5A3pm>Va&Zx4d(so1L!Zabu{1L;afa>m4`p&;otJ`$36Uc z55L31KWs0OwLeEZ=_fq=+b;b#t@`s{FosGq>-UN){l6leX_9^v{5Tii5B^FQ|04KF zF8-gu7r1z~--0*@Ow#_o?<$Y!e{%6>EnEiuI5oobFVB;Iu7|(g!!LI6|7zhz)7}`< z-a%J7%fAwvCcnDND*qW%Kd7=TJ{|iwHQvmh@6sPUUbMe#4^5g63yb;;)=x6+ZM4%h zzuLpIEi~!$n}t=Hf55}f_wdg6)%uHE>4W_lY5J35r;k)w7M^I)|I@eWH}kf6kRYxIUvj^%?E)Uyp~Gc7Dw}?W1|8{l|Fn z2Tl76?fjZ|@@syjCw-}h-{|4-?@5b-p7QkgnWAGz`m?oaLiVmn>)&he)C98bD) zyy*0NPkO0`|BHt=Z$g+do&QSPU(Hv!_!q6YEUuMsRI{)34{==sIB(>j_ zf%y+&6Ef|2^55d&2Sgcr>fhk;C)2|hd-(5K`FRc+i|eP|7SA2+ea}3FjCUPyE2Y>@S;e*y;6Z^zse=~4s zBz{1TVGE2fp*nz_=o5?nE5M;qTIUF{rGE@qd^impY}Pu&lJ`U4KtRiRET)ceu;_3g zr&)4hktYHNTeLp0$OFKkv06SBI5p^C(YX}zG)qn_avtwulUU>-;E>gZdBCacWDv3F z6ac4La$=F+2rM>94k=YHTcOHM5EwZLMNSmf)0Lsq|U1kRnHZEgh) zjMjKJaIn?ElJ`04T(0FWGjFQKN2s6XV9`HGeQQj?Pya+YCtA=YIL>99 z6N{ZofkRhlor%<0;b74TQRgdKJ_T58-bDTTw47MUuqEiVHWf93%PuGI2HF8Mvc z!E`Mr7CSA}xBOr0!s~!#{1c1*MqnBL#3FwbSo(`ttgA!E^@pOi%u1= z*kN6Q|9~G5vFNZaq3bEd?E`GV)kGSL&I91(yi6?ecHqzr_yMiQ7P!%b>S64}4zcKO zrOw}JogVDuJWeb+yMc3W!Vl;ewp^=@r(F0=;NTkkfQTjUJHR0;@B6^HU&9aR18m|C zvFIma9t*CehEl{L=Xo$><>mP;d-Y_b3qLF=)J{88XwJEckyi_LAof!UNQwF8^z_qs6aF8&ZpULM||Irst1 z#}@d82~{A7Zh88aT8NKcF|Ti4L*oyaOEi7Jfj##}?v& z4*C#VXpsrkpRkj>#F96jWBA)zC&e{}iA9IwJaC8B;aX1W#jzy);vQGokcaNn`gz1l zG%mnSd>|J4Hvxw#waz`%vDPZYqH{lRphD|Bj9tjW+knLfV$t7DoxAV@dJ&uG5Q|P9 zu;?78P7FUFV$m_%KWd8AZ?Ow@I9PNzZ-gwJkAMRlbf8bM^Et~l+d=s#&D~QET5wPT)OPv+kCb8%&1`cq72XP%M`u9-(ZY?Jk{U(>r zN?>XK2Y_>{wEm^oN!t=jUXF)Qt=3WXHT6+fpkw2ABx*0Osiv+nuLWTwd4pr8%}D6w zO%?8d=Zh*^(bIp8t~=6t;!0(@FenD6LSlReMgLYdH%vAo`w+gQcrU&lp-F@D+2Ly! zbyr8m)zl-3MY)u89Jv|M%V_YXW;6DZ!9397&HKE{76i^#wYJnW51)^rxQLUAA}VD_ ztg9=2)SY>7tGmKs(PM~*{v7vA?}k@kOe5pG5X9S3QCH(c@!HLI@sM;Y$Stp7IYMi0 zom-xZz{}`&>?U4bTWz+#72cG`e}Gg}R#zkF&xt0ti)pEJgvg=W_I^*qq;#|u%ze=+ zSDLZj!zN2z&7kK&QPwEc6fSLAUVoAJ>mgBp6&yl?!n+1BR_u`#q3rT!a9<9}Q(vtn zI`Os9%DTGcQDuc8sXWBvA+#0yRrTh+jFP-*Do=x{0;UKk6i^^wGDgC39#qVV|64(x zpKcxfUuyS{KE=xqo1RNo>SLDxQ;tcT*NGD}tEO0c*~MAl&)9qQE)gZ{Mejr4cx+*8 zq*G&+nt**eHWtsc6l~ov=C(HzGTtu~5__AWCw-S*}q zVH{*aVy_tjx4joHS85_;>DYMdOYD6W*llkq5_pai5__o-xb3|Odjrr*hn%;@#2(wq zZErmqcR2sJq;=bSInD8pw@1X@FW`XN-czt=EeWCJ^v5yix$OLCI}z3Kso+P)f%Z#3uIAJ@#ILJ<5c{UYf_=2e9`TWa&^Gk4^0T z3uO4S$IBZSOy8xzBC+=pWN!a9;=~@0#B}IghE444gUoI3b_^!2>x9JKPXOHZHm5uN zfv&dgy=#qUt`kXHJoZ=?w|}+vJSIpdpjWM-`73&bmVc5oC0UT(Q;#$Q07ctfPd(Qq zyjdpocrVFU_Stg4)#N!}kFgcj!K z7wG8FFOCUK|BfzC&y|zZ4Aes6*%D@L;Tu8F9` zNY05U=CcExIgc|Mk7#SVK z$(AzCFe**jk@1j5&)Nk|kzPb?1`-!2CoMQ_yn?k3|A}ec4_gi5JdEO*88PEd6O%i-UD3&FBd={*1B+K} z^7bC1+Ee`)w*i-3s>Ae zFE;x^YcR!s1o6EGg9-2U7aV>%1+Cnlb0oOQzw-B;^DssOX8e=gzh`{C@oIh~XPb_J z&PJ@7lU7v}owr&cw#sY;#u5fQN)Sz$9doxj(h(_@xnqyY>)!9*5nk69owrvpPjtyY ztNp)xS;acn;Aj}HHk!wH=B_=klZ5y!mzDm)_?Te~tPV$2k&*fED#Y}4Ay8L*$$Vyy z>g{AKGfPV{GJ9DXN(#hO<}-}hDl&MK4WH|tcB99%-*d1OJ&riAeWeTAeLFW9j{Q-X zbq<8Hi?$Xel$^h#YSGC>Grzs>+Zl@=T^x7k`8k#7J9q5dKD4@bM!WOY=<2ho@>b4h zV~YGG=8W|c$}34K^845ILQ|{4y^1{7$uM)3aM29ACaEvuBTDOeANewn#SS z*=g#UTdCdk;fJHUIubtVdI7m&@5TjR*rgtP1i3CNegMm)YXz_GI!kp+a1u}s%?w5WxEU7+220{KlZ=#Yn8eCacCpfulRua_is%uqBp@6 zACATuuBddV5Jat`Jhcwf7(#E%8YkTb0rU(UJNzYj;r=fopA zcIO_Re<-gr<(4)5zcVADZ)`u%Ua)>&Y?>VdYVKPS-J?v9N{v^vf|;~DLb^YE*PJoaUk;MeGB<+BMZjh@W( zDaINc?T)WliFA%h2)>h$yxs8*`I6MJ@an#Ghv=h@TP}?`XF6+E-;48+71eIWyCT=V zNM85HtyvOVu3yek(Scl}E7s~WdZMdS)Prf!&2>f)=cVZCpTHiDx|rV={O}X?L)eQh zDK@%Bt$=RVs03e9JZ+&IgMPZ1=?w~*4v|{vZo<*FQ@U&W%oH^;~Kw@&2 zzjBPUZ7@FlW43SaCg0&hYH%9m4c!LLtrtEECY&1)Ogu3li{-RSXN3GnHZs$)x!-gBhk z@V-v0x;D(3+2s$!%>Y+PYx)}=iVn0J_dJx{-Byf9R~%sro#T$@bA60H5sQxoo=`e2{l{pr z()OtOv6A{TpNtx;1K0bP$#I#qu`szaJm2%w8lPXODmz&=bI!gwe2&GLB{`!nJa}{G zjq4Bad7SpRzV)#J+cus|v*ws=SBbbvC>~CJf!A-gCyz(=C*cXb%`d6e)akezfRU!I zDt-a?L7=5x>fl&OPR`rbmYuBHu1-=HF3ZLk`%tYP@k;k&Guo~$v1{u*1>!DYs^36UUFAJa+o%8%N$c{Pv-< z2jA~&c&nf@e#Wz%(R0tKoDDb=C#%Ho&F)HmcTZP}|0B%vdxN8D_8i@mm>5i09p{`M ze23yyEI#94X8IEVxs`9q1k@#;-d`ixtyu;BzF`leUNtC+dn#tg^Qn)q= zv>FBFBFFj|PiFdd{ui86{gHnAOq99nCzy@!G-o7p$4^v7By;;u@MK_S&rj6$A|J}> z-9jIt15+^D9o>|%VsY-rg;Eo(jj}+t}X6=F57`ehMQqI|)aC_t~Up&2>4h{97-K>hk+P z`ay9pKH(#-x7Pcm&#|VSu{O4`2lMbJC-3-aQ*I-H3oah56P zxn0=q$1_^E$8c3KTJ9sZZGrtf>{agPVb28pohs+B32TvxL;d?wCmHTRlQ&%p(FHV9AH z9c{EnyJL^qTzwWqV&<4J&hUJRvuNaGr0rEam8zZt$C6$}NndOa{aBot95EtvRm*a(+OK6ZXh+)(|>HydRqPbYwr)|7e5Neq|Ibjbxas8MjZi zujZPj+dvMqv_Bqsa2>7N;I51G#}~DbZXcGGKS9dLF`v`U_`&{-8^d3eziFY>gN+?% z-+S!Q*HoVK1J(;yHJ-j~n-x)Qx0Ea2+#1z3vsL+SiK(`4bgQXJs>6wWEyR+L=w;T=mConBP@?E~M=Uc7a2!kr(^DZxxZU93ED z#PR64&^o3#*ohSx=4Q9e`Q`fTjmb1uw+MJ1fw?A{U-!l`{W| zT*lv$s~zj6zrL)ZzbV(mzadv_-I~5H>z{#@L8r=0FEQjiwXa0qx%r&lZcRuu&Pb2_ z|9w4l4F7-E*TDe?ne*uA`Im2Mh#(QUVtrQcFl%dj)e+*Z?sN5;WK>MLvOu>VFCp9W9A4MAjh z%OV7*0ClRZ47bb><#ZDc*4MJ4T0Bf%S!Wv2aZg#zbC)-y&#!50t**rz!SLp`tmfJ1 z?MOqkwh^6Y2Et`E7a;`5E2G+syYVthONaa|2vsw!!^|!7%LIzG^lvoOtwK^!jkd1& zIYm>|ZL?-f=1)Pv6mvIq8h3@)o7~jN1!{iDyvUrQ$A+Q_$NL54iCS@!|!(SgZ&w=$B&(^d8dCh?~MQPp88y7=69ZXzDzAb0h|lsv2i~5 zDtN|{^01cqVI8n0o&Ql`5hcg*{G5k(>Z{ZHtT}>Fb<~Gpi!|?yhs)F++?{7EAG=h_ z=Q~9-Y5hFAzb{koKwn}LMW4?Oh<*doF9Rd>WBGi}PtwUd^QE@`vMaq1`O~1x_))Qc z%4MJVANKIOJbZ%7U+TZ_N&mfvzrv&cx+ndthj)VTwEv7@)TDVQmRIxNb=8mlyzbF& z_wZXi{4*Y&&vd%W>+|r3Jp5Z8{w9wq*FmQ$K{j?c^0JY--xo1FPKfX@S_i{yU;{%T+h6O(6qE(X@5?bQj3_dhV*Io>tj z;z@VbA3D9)lYZRAkB7a<;PJ04vwW~FN;As~+mbZJSXj1=OJT7QL0-yDA){w`6++kKe6%)>A7=s)I3FZHB9>q$T5;otM{ zpL%#cgQZFPw$KH95z4u+|zl1%m_hmk${Uxq+^3L_a zWc7WN7eiU@_P)oZzXtkGBb{T4{uG1%Iq)?WKN9?JT|DilyZk$W_8Jd=V zn_T)gfqxSE6D<2oKj6_n;o8|CpCbB>^>Csz4`$KwsEANA+>jMSo`A$QbZw8ltqZ-WLDz#b*@9V%6)M z%XEE@cR+w$==NBQils~h%|gDhSYOY!`lrZj?<_UJQ{Men zI_ICUI14>u)t}cOW7W0lQ_KE5lh0L;c-rGNEB_)h{W|qqD?i^`I2Pw)%YCHk_PN?h z=QZ|N%-{dh%0JQcZ@M`T2COnCGLNOt_6S-N4RIkh(oAgfPPQ`OT&sTbU6^A_Y5=-8_)CuAT^ddINdjdF@ z3rW!H*aY*K5_}F=+LKsp#-V9KR^CM5;0)bX#G=FdlA%kH2{aB^Y)%9YT75w*`s_Bb z$$Pc|Uc`bp)>9`qSoC=xH_eh0i+nzCkOn}+B3}d?;)9_eUek#`OM&HmRy>!9{JX%x zTkr!S7CRll^3E}y+eE(?IKUGx=vm5BHRgIJ_!S3>otGh(`t~tzKqR;<#i2gp8{!7Hy;s|ChW(2jjsR>@CFo!$Bw)cY!Y#SmKOkv zO=7Xh=`573b&7yw)Pe zH1Fr-Uav8eb8pbN2s>#vVzJ42KE#s%hk4Z!kVuU*7n!w;wzTi|9Bn(G0Pv(0nA zuI1;cW0e~Z{{?ftlJ|gJLTu@9z6ykOUbeZ|;o4jB@|+f$p>?=!%blt56v}VW_-0_y zFLmL0E_}NSF9Q}I>RfVO^M%+*pcT}asWI;r2O=6j>5@O^!efyfxK-<0)=T=jy-`AH~<6z0lIXTUe6N{W{9x01h zza?atYcWXJZ->hD({0im&pz(3a|6b$Ml&{u!064Tp_XCBT80#+Opwq46Zj*J>Q1+_GuDyVb(8AWwZr>kv!b%Yf4?IkCv+0m~RB7WwVK z;^$%)ZUC0~jac-XfMtFo7WoR`z_+zOF9GLT?f;4kA9Udys0KQPGy4h($gNIL(q1i@XdtbrXI-#3G*uoMy?1MZN?$@CbfDJfuSw z=Aj$fOsPKC1iq*7YV4$)iN(%3-~dmIAi5=ZD=|+9pr^0}x=g6gk31oO%r%&Wd%>r6 zn__c4Cib6&D9w@+i~Inv_(Lr6L%`z05f@Ge4qAaf#G*e5IP`t|fY^7bJVAkoMJEq9 z&5{#~d>XL$KrHf`fpZ_n4`?Pf8PCL`Qw%KQnONj=fyE}V$QJ_#xX=JC!6umfg@-*& zYQ(SjPb_&k&58fSBIlHm`Xqip#3JX^kY>q=Mcxh^_yK-EY>ogs7Q}u`{YMj;SoGPa zX_lN=doj>IB=1z75J(1nwMQ=i5Uh*e#6|_ZjV(X}ptIO=e`-R-wL$Jajkz8W z%r$`EDK2~?aIgYDAYv(tmvf?@jkEwA0fn%oK5s%3i+(;tX_lN=cwkqu|q8STvO#*I=qh*#A4@9z@fuhKQ0b=Il+T20Tz8?(dRl%^mAM~ z#G+FG9I*T`ueD#&HfKVfYuTs7IH2Y6#C;kk62Gi*3bEyXfVf}F$GPMah<~o-R}gc; z1JP#SKbz2;-(((0hDiLp6j z7CZDg7}auOk<;hUFYp7(!xs3jCN#eh7CNQz_1NW})VSD%=eqFc+CQ!HW>EiMHO|2< z^t#4ox&Nkd8Fqm;G-iDRZ)%*6UFyF(Sp1&?QJN(u7CHS)eM{>Ti@X##&5{#~d?BzL zkHjLcqTHJEiA8=7aA*KOpgL@UGbU6ku*-d0;|D1J?;5vbm->!_#m+j2(kwZ#$RDNt zS*=ej@~yyWmYi7RPXY&ijUP}Cw$%5CG!~s5;L|KQvB)`prv3&$AYzg41x~Z%#3DZc zEazWhk#o2Q-p3Ewx8)LM(Egzr^Naz^Q-K_K8L3N#Ha~ zPAu~6z~Vo#$a{gsfAhY9H4a~fJoO`OpIG$!fYU5FvB(bti+y5|9|souJl_c(p#FUP zfQUu^J(tdJUHBv5)Q`14#G?Nf;5184EOMR)#UEmkCj*NQJSPg~{R(MY-j_)Ivo4ER z^5z4lS#n~L^S-o{MJ#fD`$p`CU3e}r4wpT>9r-nEn|b@Yjmvc~|2^>=!0_!Mru3v0H>xnSacd7 zPqXC2B3}V4z7dPO16X`p@51JqXAuOTA!{B>z7=U==PBUODD6)VaOx!v79DfVW68a1 z9`WrNm(7=f#kW2eJ_0Q5MlAM^0ZY3Pi~JODXteg{G;nIb!J_j9^ICFZk-rTrz7dO@ z%LVc6Ll@?>D83PkKBp(~jacLy7NIfPA9h>nSO<#^-Ac3M#3G*nEWQzod=jwu7II-; z^NMf8qJKTG_(m-9FmNb{AJ9zfQpY)1bc!KLv*g4g=d>=q5sRGb9PzEng}KfV--t!O z0a$z^7WoR`5QA?)E3r%E0?@*u^8iF?mYi7RTo;LN?lsaD$i=tET(}2Vd?OY+JAlPE zVv+X(hc3ep=o#!%CpcJi_Cl0q$%#e&BCz;IEb=43;@dG7=G+)cg#eU}P39|N$vY8P z<||^6PXf;6i{n9@CsVI*u;}DLo@U93MP5LCYYrq9`84WVa$=F+3@r5`7WrJ@z*ls+ z^Ie!zjI=qi=-&k_ZB8umrNE&pwH?lrsb6)l=+rT@ok+8Zw40M zh(&)3u=qwS@+W~q>Dr&CfK#t>u;^@OUQ13a@?K!^jacL_0gG?1xbR_M@r_vYj{=Kt z#3DZl9LmuCoB~eGbg<~W&b*eKSmXo1;v2EZ&jE{XAGq*efWZcBxl8 zSagaYO0(p|A}<3L--t!N7+8E;;=;>-#W!NnuLBm}h(+E49GZk5&wSmciai*H+9_$grVjac-z1B-9OA~)woHazGV>{73Fu;`d`qb2{+bE7qf z9D_OW^AzoK@&FNw{nvrTH)4^$1sn+B2lO^}sksgoowE?7S#n~L{~lP{jacNL0*gPq zW)#dajO&mHiYK0`aUyZP#wo;);Rh7JCU_k2WUVuSm;)Ac1#zLq>BLhsR@Qg8@WCtj zR*?CrBz`KWg0EDmt}wrgRae{GQqjDOUkSR;`ZU%spBXa0L&Q%i;cHLs??8!ZJH5Hp zd?QIkWnGI|iq0_TqhF@3e2D4Gd~s{Y*RuwdTHU~JJq`Lw)}VC#+LtfTsl6K>-~IVY ztbS8-Wpi_7MPqYw1-_qES{6?|<@#j={ZM!d|0>Vv<&HOPIl zp{O8I`-4|QKDKpVQ*BGl@ZaF7s%^oyn(&I4iiXy@x{Lb8Dh~NvmtCNp@_7S9H@CXj zH@$3Qwnuiw$pJthGCnsMwiB zM-n9Ou-_*8-1hmRZSNRXa^9eWXz16>#7*1(hUN->F;0J$ z>|*|zUoZP&HI5Pv%OMTPZ`NTh!5g5=WB>CT)H6|BRM~XOJFQsS)@R5D)%NrBht5O# zD|ml}`OnQT)V?|0Uc~%RZMH1u=8HB46*z&kHdo$#aV@h695rd4L0^e8hgoyYy{$D3 z(Hi{)I@ed@WO!S{zM{IOIcj&e^+`F7t-R>Pz9={42KiiEp^XY`G}%Trm~y?H!A1o( znha!qKho;*yt3x|YFnbq^6(M6x|+dc&V2LR2l2u`t4p^XY`G}%GuOV0-cOBa+(zP=(K zmVgQhO=Q}fN}0B9qe2@M*l03QK370rj%pM1J1|6hQk7C4aUo`rwTi+MQdm=AgStsm zti9~8yfdj1z^li5aYCZU`|(`+g{_1oxL{sl@wmNerg06J;jy=!GHgOfHt8z>ZhL*O z$MsW$jJfTdMcR1^EE0SCpPSp> zIoNv-iDBp^VH0~kRNifm_vN=+wzvap(x(7!d#~T1R3B2p*hXR#d)rZYw>{o7UpI_@ zKY*Uw-eWiFZ|Kq9D3`riP;%RgLq7gLLP+2(&~w|%zX{*EM#eA{M`L3e`(ur#zAvJ2 zZ--n+?D5?KZhNP`hUcxI6vj3No7lVFV=sWQ{0!2C#9pDt-W50NXI#Qi3}O>|6B2uW2Z7ta318RuyTg!=x6)YO)7aehLg;)x6DlP37z*LGR|k7r(AHtdFSF8U z??Y^Ed*>iL51EkI+sk+bcufN3zAF{duu%Q7NB#bf4>4vvG=^k-lwofJt48jYiGBAPeO_Qgt2`U zo7me33{`txE5_htnvmH0g=buqUPNyRGP>=}h2AU*EE0R)2JiN7H~gCiy)fjNRvP^s zhdy`P+lq@}#&Zh^91T6Uy^l(idJ~CZC}v@k`rcyMlYDQERVp3nLQ?meJ@!tOIrHhREce)(GDkm;6Nch7*u-8ZfV;kY9(17?!(QyQLyvjFR@&{b zx5VPF#a`@v$3NAPkj%-o^_kWv?}&q@zi$$ZuTyK zMi|?5*u=jB0E6m_#`^%i2#LL)LeK4A9qe6^sO?R5*?Y&bC;8%W5=<9kmLAz(dF-u2 zBQJqGjI9tG%i{RE%CaZ@I}!GHk4H$#xx!=bJ=nVfZ4ibc*A8OuH=gzzn~HHDMxZC~ z9Z&nkFUB*$mc8jNdrzSa=uQDP(lp!%IwMBFGmYE7q5|AY(gaKb6Tu77KhjC)5r@fu zUar(}RbgP96772Q1JhnUHquS7SFNG>%QSBPfC9M}>fz+$B1z-DO?10`YM~y-iIC{= zSpxSrSh-#!h0R~5tb0)p6m8Q9*xP)mPQL-hSVv4H>bm^&LF8sN*1yxHOfmH)=NC?% zW}+|t2J6O&x;(vBoP_n5q5igSk>zdZ?aZ^^fzR*r1UvkyZKq!?m>DSc{U}LgX8$yh zIq4UH%$)u}+#%!V^^5Y7jUJ89ZxS8B zcXd|g_02!{MtfUiB%&#U{uB73>P~#Q>4~s>y-U8E)V32};MyF+_cb%@FE{XuG^33E zQO22Nac+4O-#=J0$6to8#O&ClobTH8#`sMwzy0=nU$!wOGw11m^Q|PKjGlDGr=hHJ z!x#DUXVJh;d}-|O4Sszyy1Lr%y&8`%Om-W=S3me{QFmACcxd7~TK?8w;j0zDGQYUB zXgunC+HNs^J*IbKEI#;Ls#>@uXT9?^3%&(E6Hh`sIL@Ek8E*`<9ZFHb*cB=>^mJf< zY_TyZIp6vA0_v23uRh{|mnE;_P52XywyZT{rjNgUUSWB+@^>2jd9i&R#zB77D~dOl zd~&JZzvdu(4y33;{}bWpydGtgb|v>KejO+p*kN>Gh~O(y=jsf{qn!2!%cE)sqF>Lp zBkwuX7uvb@7baXS)t|X~J-(F|I2T0?V(|~A#*(80)kfin@C^1gdm3Zl*0vr0McsG^ zUrd0v%k0`LwOc3SR?%i}v}Mg0)1sU&`;pIScSc`kju9~WiVg++X{xt9IP$`0(Z;{W zH^Ac2ZsYJ(vn<0X^+)_8qvyV3_>h-h0CdX2mr#=ZM@%`sA2eeOzCD6b_!o$jql9@o8R`rHwR~!-+ zMt@mJ=IU-WtHkd=>K@$@(~{r6Qh(Ptu7qEo8vLgHg$Eb)@e3=)!F}tElD1u?_`+PN z^6gl!e7lY+-;a`w`L3@&^|o`wQIgT|hJ6%KRv6!H$;B(J8^rg5+!m;ty(MRhw&B$c z45Pb0eus+o#jCd7^+xvN(ap&UqoRcQov+?pysV>J_}!=8_QBtZe6%!fHotr0{o>Q2 zBX=FO26IeXu1em`kwf3h#lJ}vQ~KihUC8~%h(E_L^U{+5XkDGv^k>vkMd z?AE0xZ98EH-vi3tQaEx4zA@(?qLK3i#tz2JdUF&=Eu@^%K~i1H0-e#)Z*s1nN-6MD#%wH^#8EtnjeZl4t$_@Ir7-aIDmp81c2RB3AUDHt0WLDd4Jfy0Z!`X&gme)5fZ{W8fk{-?O>^dK+HZE61x2SaU zgC3duqR0OU-#geTg9Kw@xbGb>PMO3pX5bFmek|Y{ObLH{CVwTa4K!(fo3K{8_3wR1 zb^2MmOrQG9&Pn@YRlUWZz+_m0 z=;j%x?&cZuF8o6HdI#)rE@S)CUW+T8{8Ju&nWuidw=MRl|Bi>}GxF~A1Q#!JoKE+f z<@5fzo0m4@9d+8DDaqgm=O1CFAF|Umk4tllH2=cpHE+Zavxh{{)`>ujiYw z>bu}4y7cFO&vxl&gUpN9Q~z}T7mPJlarp=R-U5%?IHo_{DEJ*$dO7&_z;j&F--+PQxzc$*lgATwW;)*;@kd~3&+maZFg}sZ zOkV=t4_@@I14slf{gViOj7y*Q*!VvHv9|$+7+xy&W&<#6Qrb5a{B&3PZ(#55z;o?M z|6c^pS2Ia_@qL^N!DDBp4<7GhJ>xy-;m0e+g_0U!fbTEm+$zK}tq?m?ME;ka^sO9- z7HJ=a(>^cp=qGsin>_h{?%{8?^cTP^-=BKcGS4|_ERNLYJoZXF`CC2dS)TMuEdG#b zKgm2Ur3S1|o5kdt<&9L<;|r#g=^H)vZ-Oky0|-Q1Xd?a2kW_XOs0f?LX93GQQi(;* zV_M|IB3}v|!WbddVZ*0dO?nEyA!`A@1DOBMBRzvH)mn%Xi=Dl|X_lN=AEIF~r`+#xV%A_Os4X$*s=$wE^-fj3gF$XVb09$Ysk;bC`9(Z|w<2m45>q6lp zU};-o(dY3OydMG(vB-H|33BoR5sRGbJ9#%F!yf~jj6qyy3Ff%V<-`vPQy$cK7BLT2 z5Rbb6|7i)Ta^VJG@rPK-T|ph|;$|InCg{AxqO+Mg{6{0`Dc}$%Y7obH@Bs&lKL3{} z`iEWkC~>ORe-k*ArZHny1;6LgKj)J3|MIz4X#EeUW7YjH#QY~C$b6m=_sU7*a0~^~ zO=!N`TI!Vwx%ipw(&6*|ApUszM&Q(|v`u2M!*>FtS#n~L^M8H82em%2 z$jgAGtcAd0e+jX*kZ1(X&Cq%8C(hJ(EwGFqVzJ5R6NBH?I>aLHrTibXoLJ;9x%7!e zei%43QR|-q4sf9W8X(Tn_v$v-C#8Q^ohL+71>RA2|i;mfb z{O2aMLCG4nc#X84tht^T8Kn{3w12th{fhp)UkZ) zrH=2920Cg-ozom{MJkqElPg~z(^r7oNdy+D}SdQBUcq45>i<%Tt87Y1f(%w6CXjZ3kU_n=Z@SnHES z;$ljmi_N&zgywaZ$kQpGrR5ykMv2BeEDah4v0RadiD%;n#B4^H3C)-XV~)lg45{J|{-&0%Bc8AEX5!m4evEj5#y!O48t*2y!1YWa)A z-_p2`m=1!DU=#TXVqWlpUdJZo4iGQG59mE?#xuA7Z&jk&%uYBc7W%2=xLESG#9@!eW}JMl7&mk`%# zyv!wUB)&(>R}z0m600Q90u?s{G( zkAc~Cw6iN79}fvE$1@ho>MLsP?*n_Eh*?&%vazzZsiI|h1;X}K9&d2-Chef;Wiu?F z(ellfd}t`RegXiF)HF2X3%peHK4@~WFn;Sv4|vdkSn@9_!qPEgY|Tc%vnvuY?y7rJ z<$V=ZtxK2U1~=?CeBL7~%?MJr9jEq?Csi26K16tt$5*ttYWZ?Jw$iY?r6%vzx#hXI z9UuM9aBkv}iM#P=llAO~)Pv#dOPiM0yF{_S$(A592!GIj^juB8vWO@x-j_r*ovw@|eXHkM9b(uZT9);QtrHMBa-VIJ&rh+#;lE_m{9hd_|5r!I|J8Bv|1YB9 z|2M?D?~l{>l=RGpXCrZq_F}wnm=i6?OL^i1i=SfcWd}1RnddGbw;t~~35ni*2v|(m zO89LM*FzBSGMMU2OTl(M=VI)|-VP*Mr%Xuo{Za1usH5B7u?b2oft>dI*u>rdu-hKv zA)Wi)j=le8yFP{R7#NJBqZhN!RbUZojv9HA5OklUYkI<0T=?^K6e_Zyu?fn)Dxml3W z9`6B*y(Msf_Qa26Xbkp~5cNnr{k!#Apm)Mm57Ao!J$JcNzM@nQjI-Q;l}7syK#AE4 zu#t+;Xw@!zgxtPm?enoG?Z!g2T0`?!^cZ_jER@1VbCIMy4H<@r-DK3WF5^sX(YpZP zjzi>eL}EQiqQ`GoN!w9=6YT9x)afh0vn^O}b14vQs>_S!Ew8%gy7VuOLoCR@{!7Lo z&YGyp)5q{6_-Lp*@9j9e{m`z1NBic!HUCXBTChK_b4~xg&bX6tr{Ye>9g902cOvd^ z+>yAWi07GuIKQl-(Z(5nq|3j0^!MTMuUF#^cg~JW5Hpytdi0uz$b1uvMn_jCA^z^T z9jTM^y3ya;eiRWpqLrC3#fU$2d`selc@w%2;p9a182wJPpc&Ei9wJd}OFFJ=e(XRv zyJ%}sLdp3%suoouhG%B^$@0RE9pUKaSJkW|!&%K)?^uCdzyG})Lh_`{O{#;BZ}>#C_YHk6@Lgh76gvR zvhBJd7R*%#L_lUGsm=(ap$2)7?B8wl`2E3z_Di}F4qcLXEI1;5bXg$VuB+S1)J56J zM$gRh#Mh;6PU{+H4wla^@9hpI6!{V-NDCWhW|pViK5EmfQ;_>vD<>tGa45koK@?uc zyFZJnS5?mXV9fs#;|W_1Yl7(v8Wfl z-KeG{y88M|VBX9~G_Xs}ns+iHd5kj|3!6--aj>9#ZMiLXwW>KX9z*<4!l6-#6WkWz zL7*GghKOG6oLO6x7|z`OxXRqINA+$AcD#mh z=Wd~3M<;s7ElCW=9f~$~tF{QNKC>q-bN9~>9bDqmws*zm+hg14j|R$(%x97iS(+Gb z%Sy(7lAlLBTfS8Xx7CbDN;t1Ou`jx$oAJ6hdKPsXXHvq^b6E!G5vRQ~pWPE@^rwV- zJEH@LAC2srm$Bf{1#x$rFR3a$St@aQcg4&YPyfz6*x#FQI^$IK$Mp_x2H(0D~b;z!VM9-L9`=UGim3ZuH<+3#2sn0{C2lre7GReyQNV* zJ}BDII8$KNCy?lFy{L*9#+gR-y^CnG<})M4ndrboqwv*<29C9<|cdm z?paeZ*Atn@s6@;(o&LSOj~hLwJB^+j?oD_rv+|%rAOnA z{O*otlZ^gnH?HX~*pSmX%Z~4jVqH)et3w3!h0i{rt&fa;e_62g3PgE3TBWhG?kG!? zILk()+Z}}*(?=I zG>nt6g&k)Rhq=a%#Kinm^k^ibxYRX98DH*{6g{^=o!#Q_M%mIQ82Pi zMEoXv%V~FXwu4_&a`Bd#wsBu)Ugu+Td)udD4HQgBP{-|2e4({#qkkD=AES*~Mq&J( z@c#8Xl;|ytZI2DF8^dVd5$@d-+b(z2I>WzNiq+|ZJNht|!S!D@r z*&7oI*E6q_lGiuw;KJC+i-f8_|}Xl31AB`&U@m zAMe(t&%@WOTLt6G68CS|5iZ=&tE6vRTf0*H%cO^Ag^m72v9~ZAI5u<}wi^4}e;m$v z0<*DN8otf{t-uc#*eR4m~y4SOQ_S$Q&z4!VVENM6#FwAisc<{jWk&}%b9J_?#C8irv4YuO^!{OIz4;`CcuYpomuIqut67GYzD9lA3Fj_H=m>MS0k{a?D#`}@#n)*p$D_jpIyqRdG z2g&}d#NY)Xl&uQ!g1j-OBx&N8YW$T z{oQ!0wyK&h%dW4HAlLKdOhH}!%4Ie2#zHW{@G4Lt=NFAFnlSdpqMNR>O89Zfc{gSS z(BHMvLc#jg#YIbt>c-7qQB*f}ew;rKtXQ#X`M5fHS^!VGYjCF)cd_w@Pr;w>>Xl2i zC`UxZ9iFm&tqQG@pZ59h_Q`y9R!;GciYWHn2M6V!ArBSW|6L!y+~?0{Y2{S-1wMJX zPv-knlmEO=zR{N+e)|>v7|orD|0(FRuspmmAS(Vl4E~)u$d@x6J~ zNqkdxydJuG@Tm&%s=Ub48uhKH> z+fHERls&I}mCWyDra!-jiJYAN!4|)zkA)|PjW9mipX=7w!B!3A82ql({u~?3&pG^@ zOa9j(w;OT=6*69%Is6+T{}z~WN_@-Q^bL06KWWH2z~{1*68{>=90SHA zGW+hVz#W?6Ha757mrephO&vu}Lg~R)1h%Z^;7UK{* z#KNfqj_8Yy??UZw;0KOaIGcg(JE%=ww|F~bt}{XRI1ZZ^9vrcReG0fh=l2<4;SdXl zWhQ%2ze$dci&!}4fFru{oF_-eMJyb)D-u^2*w)`~iG{=asf?}TeMQF2O$09B3tG5R z>IW-43)t2-RbsI-4>%H1oN97(dWeO?c0bCw)i#l>-LHY*eyv2ZxXO*ovF zARJ=hIOE;eK*D_idKnLxL#)f0?Uv0(9*$VTP6U=cv?l?}*v84gA>MT0rUT0uI${aS z@oSPc-ZNy}-vaV=xe*J$7Ff#dJLKr|PAr^OV6n-uY%*qW3;Ft+Ke6y1BOl)==yn+V z-PC6*{ZqgamRQ0*YjA!{j!rYNa1H=VnvasRK-nY~&Iw>iGw%m-t(^syunZN!Hv>AJ zDtn;=9V~XfKz+5+6N^3{IHKRv7m*WJ9Ae?zOiozoqr}%LT#A3fCl)@NGkcNZ5R0Bw zFqEV8^pgVPNx`pc zc*8@$GS2ZW1HWTnmP6zw{J`bl5S$NeFQYbjPsk$3GPbT1IHEgJmBjpr2{!|WeUAej zEa{&|{Vb&?7Cno`-MgC{9d^0F*$kX@3x42;B`oWFw$_{Ve>?P9U&Rj`vG5-U&enQj z(LW1pGeS6G(X-ziDWTS~4&adV6AR}EaAY!m;Ev;v^b-r`6tIlHdxIQZw#35u2sjeO z4;||;8$Y--1M_+j`@|CVN^dIAYr_}`;jvG5NX z9QIcw>Ln^T1;NBLj~}0bh@8Bo=-iu<$uQ zL-2UutQjgj#KON3I9uz9Mb9}Ik{)8w^Ep^-&M>esjxuRH+UHnzT=>qA2o4eCFic~R zqpQbo3CB+YI0N1oAZf&<_}0~6ye4MZo2JB1Mqelbmg2_PMRz!#<0;FFCxuXN%hht> z$sWlIiC<>KrkfcI4y|8`QJP|h$;Al2MKapbC;*|jsaA^-FZ%3N#93lo71)i%Eiz|d zWs+eQq{`qW2VA;|H<#0Pm3sYMt1xMF<%Mzh2UIfRq$RH-ubBTpP5nwN zoqpLf>6D3^Pd8CX3s$>YetvPeNy9gJ8XU#t%0DTDPTc&3wH$0(Q*-I@n;7hKsb!Ph z<&fPWmhN)I-r~YCmUFxScNt%IQQmQvTWr@EUiil@n2RQ34BnIIS0zpZvL$R;KQt6* zmK?_}D{;CKoxZMy&ObC4j++gVpU3x#;so9fQW}&|?J;X8*6@U4IAlgozf2s*5x}%J z0-n5=ixYdl1TgKr4MQhDqCLLi5_?_1roAn&cLj9f#NMM&nD+Yc+&=<3+UuwNn7$ks zGwt!+>`W@O6MNj&!nF4q>^%b=?eTS%q^}CtwD%r7&S_ixC-&H^oAx%2w5+hUH&FXA zeajHQw8ymw*=GzxPLvnz@!5c`5rv_*<#1&B@o3Wj$2wZedSbxE#|HiaWb(xYSr~>BzkvXVx=y^v zyIutRcX`N=IW~~j2OaZ4C%myRCV8iRJnV&0QRqJl2lE@k;WSh6`o_;YHn4cY4Ml4F z;AgK2BRdZ7K6L2dkpsv2j`yD2KkroaYl}~= zxT_H3rV2MS_1x0-LfiB0MeW@i$}vvxR7+k<^Ul(dP5Td426`|GtMpV0#<_9a;K=VH zj^D0v#tn{e#tn}2#tk-)Djn&JIXuQOhZuj@o6?tZplScyS7#pI7rZSnCR7*VcqFkA z=)oAU%;1~e7_2~-lcxQ-`Dr8KYZ?QdPj%vabaCnN(z2<~PtB{?R*`<&yLVRKb?mOu z7|D`TRWvt$`@Z0^l8t@wH5kVd3sy)R`L7=A3-oL%J?V}U$n7c(`8{)Xg0p1#h=14@W)ab^UbJygm{Kv+G&Kl!*0zK|H#Y~L*!Kg)hqr_&n zrlpJt8FtTfZtR1mG2?h*u{#=rsl~WUjOI%OSkAltp5y)oavbBiU6xbwYV=}j%ZSd_ zz7Yox+w0OsF3(u(<@ZcZ)t>!Q4qkj*8FEKe5yvaGrUl1@q^vROuj;AjpblvJAAGH| zwPiqZDs!sd?7O(Ny;V&;Im%wYWP5Lya_za?ojWt1>a$z>GLtRts7l@4l6kQ5;SPKC zZ$53S%-!*9W<0blV7HbI8WT#Cd1=NdGUWaK?>VbZwx(S%Ce&v7CY@PzM#=BM7{=!; z#+io^GZpJ3rz`=MY?UfmjE)==nqgg;;nfu~Hr@Pgqa<7Vt{M|cwvQBqFmkOj&?Q%TBI&wM9w9vY-4b6Dv^ef8&|93qN|hLE7U)S}q!-ujV=H2g(>*qK@|}C{ z%(-jxT`AvuciO^*67P?2f5E6)%ey)_QY{|Zfb!|=A6(CIUQLxLeKIOZ#v`p-^)aua z`|^7`JAyy%+z|XQBSXq4Bg4+9>>nEA8l5T}Tetka;(>oz^46C4g5`l6jP`q@jefYY+omTj zR|ad>Tv*On?G@#kZlO(WJ273xD&-|kCJwpRXLkZ^P7q_*_G1j&xf+aN`)Ty)EgpBr zCAkS}(8i}RDs(_f9>%#zc_rIZoIlE1(6pA{u2UBsfDv}>SlhC+B2yqwIb#pnvlZD*C7HY46{>=TQIDT>}PS1;qjT+8A2Wo{v#> zT#NBiu}ui1{-Aw8^A8RUNZm7FVDp}efvLON2R83MG;m+rPyQ%7`&vvsQ+}y9nfCS( zh+{5UZ5Z?%I91Fv{j{29-$d!3Yl-EX0@2C0`G z^Ze|sir2k>_9*qh_F?5Qs9 z{_BS0{8M)w8W!le0lg%uFU%j4gMI1GM^g{9Up3Lm2lF8I zc@~U3pnuKruAf~dj>X*-!~gp%8l^n^zaxc)y(|6p)EV=S1m_C0)qRV5i(0sXYfDLU ze$e_6de)sA23j}ZzddlEh5FS$xa0;r?AV!^){pSNb7Q8}p75@oK+od+i`QW-;VB$5 zJGb?e+w!{OR7=}7c5gqsA#ge{HMa|+?Za~e6~1xY9J!uTxw(?#x&LRUbK=IL_QJOA z_8;M)q_ZW>a<3D&L~*BH^7Mu^(c)Dtfk4k}jM<&rddyd97$>~pFEM(#xUwa1qV$Qh zz(2?F#4cA1!+0SuBDYP(XsdAh`rlvTA1SX&nB|*VmKZjqJ#aP<10Ee4zHs&Z!}py> zyYsDISu1A8L%()fm?st|(%GLh=*RbGG-kvm+Kqh?`k@Yc@fc^(#@q@gE|}?6l{%$a^FR{m3*gWT)YZ@oKSstC^hgt1u=$~Oe)Aknr z=5;b^R*zX*-evoO}8`7 z4etN7&WzJ3*G>QU>+F}>sS~W!vLIXfk9lTZK#q@CO}+Ma`vn3&-?#2>Qult>UN_td z2IHsS2y~QT_C&M2wO^p5DZXG2c)4qEPhT(}Hd3ubN+M_nabB$9IGZ1T{R;_PLpW=l z#lx(RZOoEef6Mw8)=gaZBiva!ThlG+x!-#ukGYWLqA`sI=TbL2;ld-`ExBF&tRwG_$lE1O(jNOvfuVd;BxaREs{jG9bZxaHUrGt{@lGwpM>y1RU+tvhn ztV*=XU0mt?jLp704)kdxSB! z0aqa{ywi?4Z;dSFj6lYnuu?})#dVPgq>gU$q75>em zGe>?nqPF!d_etGGE5SEd4^J!pO}n$hgGy`jsLGKE%rJaoPB6ySAUXG)&wUT~nqk(y z_g`>&%e>dD#ruiEqsLIsHdn1Lv1=06`X0P@$()V4Cg~6K(640i?H%iTs;9*<3N(P4 z(t*3F9h{bGmRoAUw88NZ{JYGOS{qx@f%h}Gst^kEa+`N?2Iu>qCd!Jp9kBkrqw~38 z)`4K4>qo&9tEVG1?-y6d`3z1e9{xAhs)y`}!>x*R_DR#MegE>ZJD1EX<3T9nX@TzK zGCpJGqj}7rD^kZy!@Qi1D;P`j=s|;72PX%MUw_j2a6}Q_Gri-Mao|jK;w`rf9>yC) zd(kMT)Q8T_nEXanNk>Mny>$Zaxx=inp`xv6J-In(^#;VOBd@XE1iCO+6!k52)JE&w z()Fd-R|EM!Y#lB&cPWvYX20GaEu6h5Er6Ju|A8)+`Wti9IVq~z5u4VLf1ERz?Uvtt z`cVHdq3K&Y(_a4c+jI6#9a_;_u|C>;img`juD(y-8!;36IIP_sIJ3H{c^9tfE2njE zR_2*2^v+wmO+16ER`IHT2lu5_tM;M=Shhj69n>z{;JvevmKgI*@h(*)|IAlA(U&Q; z4A+tS9(KllEo6&Jiv7Eozpj#1iQF$ExmNA)YCluS>IXV%^`% z!IQpmpFKml!n-e=$%q!mCYUoYf3l*(+uGsL~V+Q@rbPwjYZ_sK&ijvPPs>hWVIkDfYm_V62r-a7csfo?r- zbyC~&ZF@WH^aEFPlzF9=-{Cyjbq^Yhy>|w$$NPwQT`bT!AdqG!Iy?h&r(U}9<5+zEF1~BUZvrjBb9_gQD~R!?%$B-B z8-cEB^ad6=DO(?nFTmSR>{fB^PZ<)kky98J|3fPD$;8aE-m>KI4?Fgs(DqLzCcE~T zQl{Uj!B`pKuaFa!kHza$PCTFLD(;Dsh&>%-j6F3HUy)}G{(L_&^a4%J1)6F%jkL=1 zbTU!z>F_1M?!bBezPewixUpx`RV)#tY0%40qTZq{ERMy@E91%HZ*y+4gyvgOd=J2p z-{H){9`u_hmnF{6SUl_atg<=J&&iv+ZEpIV=WknFdAzc0+Vj);<65G1etj_aSK$sY zPvc6?4X5Lrrepp}@;4o)1$?G(Yw}f@5sh10EzY{0?p@99$_zgJnN+mIc!L~cOYDU- z+X2p~k7K_d8`pulYMV#*=X2#-eUNJXPw4 z{^Ej^qm*JBqq*Vnf%5&CefO{C)lnQ99Z*l4ox$Bt`r91OdQn?p3v3@yv(hhSdwq0o ztZ*x?FQ=yMdQ!@XZI=@&!@S*X&X|O8-B&g&3V$w9rY87>5JDT@L97n zJv1OG^qGyE36FIpUcuGmrUrA}JJZ9-@nCNJ#%TYt+(Ot5WBq`fpQO<4wH>HGxc{ly z?kiApE;WyR*}>Wae8X^I8;=^{%!9wwZ1l;~_D7c ze7I7+7Tmw8ldWDa-cvl&8LWA-aDV4Otl@z*0meFYFvoa044g@e;(oGa>;-E8gaaVyVTK#@RS&g^~9vaa`U>eu126Ichs^#Znz!a2Qs6% zIo$zgZG^h5`Wi6T6u`GIz19Hh{bt<%bMpq^S!oo%hz#2Gs5HK(v8-`FAU zdrmur))4KWch71b{fbpQ;W@lt?}~c6IkD#4KddeG@vQjiUASH2gbO4KlWkJ zm&EglJZ*HQ;VX}^vldp?xGrWDw!}lPSb^U4rEE)U%5&B=Pw8hh;|Vps=GWFs55+fO zhoJKx4C-t>|NHoY6L^XU27~?hz6Mu}Tf4dwgUaxPz2FsVQ)zQqI^ObjrNlSA0XxHi z@iqXssi&zdm`vEr)8)5J>%b}tEx(v*53o{xQ!(zgZ_f$rZ`z*` z-56yl&xjtx|J_zbsn-j_d*w)<)%=%zs4ou&Lgnkros~|?&G$NS>t@`KmIvZ%zKr)E z_XIM^H-d$hx2LlFXnFGi^lOoa_?kDY34az3O$l_KKd(yg^hunLV0r>?C{km6f##R{ z_>_c+X)Tq-HCs>v15+>lHZq3ujnD9S&;9AApAP;5pfj0O60V zGRddF;Os!AmFA9g9Y51fwhR>SRj@2BOVg~yk7btlq zyo!mF>_-=jyRm`U3Rf>}Y@nukVZ+jR*jW#-9((#UHXu#6mV9M&gVk8Ss>WK3je%+~ zEoH^R`{vgzY+Qmh6TdRrSw28Axp28;)S1SwO0n_&x*8{gP97Q0JvH}ZV*bLrU9~Pl zt{;%>Hwp9h)!ESN1BB~VE?*kQ2t_9d&d2Bmo|UTFdumsHs}}17ENnoDj&as5Xjrmx z)$&DQEYlcXvaqhMruI5irLTVVt4=6RubH)^CTy%d5MGTHVSP@k?{|XY>@+wbOPr8g;^99PLb7aL9^XQC zS73PvETdqVdaRwGP6^j!AgSS=r6}V?*4L1kdiO-c7uKS*aJG>#q}B;_f0zqMR%6Y~ z3yaG=1z1zF9u;tDt&_vWs~T6;*Osfr0`;A{c?e3+!n@w*YKE{ zyTdcTUJ_p25RTni`t_3Q{%AwI;uvgPxiXAPsJ>BK)Ya;8N%HdX zImnk!|K~99InvEd-DI4bjB(?5Hagy7=s32GF6{hz<2u)9`Tu(ZDx#`uMq5_ZHDO5q z_b*g}MAmZfr*>ScWUC0y|5R&@F6gtkho|7pSh9c6x*j+6J~xb#qdr;2R$2&8ewojI zxlbM?CtLHM^7)_k$z4AA8K3;TPmcKPKjM?e`{YGFxxy!R`Q$#IeAFj%{;+bYJUGw8 zlt1*z1EkXH^0?ZNH)z}l11VO4Q@-3k!n8L4=T79)`hww@&=ia~<@p$8_*0(klP4PT zU`ZQvDOhoW{6&U8WpA%KT|W%}+r2;%Uo5T5G~Nd87a{xW1{ zk@i|47eQu`O8zT=l^g7wzj-1eJuJTkK6#@dC$|Sf9KL5y$(}tWd-jy<+4JYmwzwVw z9rGW+oo5Kr!#QWTOFQZRCCZ;CU(SzHU!hXYcG9y%M68%Y|Hpmuc0=xhy>!_75_Bw| zim^E;m0c#eih#(_@C8Zpb6_ z`CSV_3R)4y_p0Gfxz;DY;FI_GnfD%3_Rf#;_v)LHc|S7wUj0-4 z_2RAbv)Yi8)AJ|RDcxUv02MsNy4F{pu64@8tA9%Nu2&_q{Z>xN-6F!?$0%QXPDpCs zy!0#nBL;t(zPFr!E(N=Cvi!aNqT=r``1CL0#pyWZ|1%L0KmCvRWUoJ={NMEXzvYt~ zefF36Wbb-Y_A-6t;q^z9|2$v#i9Y^~KKU-6yv!%J`{YfA{2iT_2k}3}`m$3VhYWv~ z&+9(%<1Rd z1HSOy`vArF+BYS8_kSgGeF!sshkW+9W<-*|PiFtz^xtU6*XaA>JP=awROj4J41dbU zeDZLg?6qIxtT%Mry^g(N#~#-eQ*NB~uNt$Dl49ND__O~j{*2FS-^N)VW+y-Ln;`AWXoCwu)X<-gqL-|CZ38gg>{>io=g{gqtglP4MSxdBRG6BMwf zI_15|@MrmZ_kU&2i(kpF`S^eE$=>y&_+I}+$=>^xn|#;1>K}}9?J3zSFC}~V`LZv( z>aSJ0;g#%#SF(40lpOW(5Bua6pS;Z{d-Y4%>oxq7&zI_t9CZDaJjN#<^2uI(R{Xs_ zf3JV7{H4!@?`qEZ-RR?Y8}ePo`(o}opDa)I$+!CCQlA|2$z|5xp#L3DQFGz>{Jae^ z+lLs^K>3@He+`-El=4K#LvVj*9j1H=_4QWBwwC`2GT(DH+jYax%;@@nF8^|0c~14o6+XGr{U(0}>~Zbg z`NsL>ecgMuRNq*xLEPf#KQlu~&*0xs^e2{RnOgd@9K=z+)4i7|fA8I$k`JS7#F2l- zC%=bhGja64Lj?S%{J(In#8J-hrS~bFKPHoF>n_lImH+-$ujca^5i1oZtyN5WKli2o zE57(v`SO26`$u7yYw>!|ek#4*y;sQr)NOH$?|Pqn+L!;ZFaFWK@_Na~ALf&Ppx+-d zPR93dKKUhI{JV90yeAIDRdz)4qmDexx<=>!K1aUFit6&_^*R*qe*!vvZ#w0hZH@G$ zKjAxHv`fe9cc}FzR+BD&rgaFeiZA=}JIOvpZuuL-bP=2__B{b!580Aoj-McCRuzmd$)(PFS6i1ky^3}CtMOmf zh7KE;?TM@beIv0hFZP*aU1mN%6zFu966-YZK5ws82_}}f?f{OUU8P%q!{#D0a0_q< zhxbTXi+K~U-J&?e!r{4<^@VqklTaLD;dBERuyVjXgCoMlXyBg5fkCv6dlA2Os|rgj zVc!N0vEbm|!y$Pg77lJ2R)ilD;L?HZb;=I0aB_ePhAK`zv5q$iEcqf9emStLrOST4 z)+f#8V6KG(&QH1N4g%8FPxGk|6N=mq3#RCb7kvjkY| zaP4MWuWL*!oK}OgjU0Vmh=ubwu*Ajhbh4)KGvw=diG}}Tahd<^$+*GkR=mbH)hom2S4!p|W;SJ~luVp2beg~NATQa{H7OZ~i= z`WzLO`y|+-JS<^nlB4r@2k~gd;d?GQ@5>oh*B@dD+ep3+%lBSVC)>$q#fKvn{$_*I zW#ByqehN79MU{rVz+#73?C_nKaC(6yorlT)GZinf@LvU%be<&6Q}#~-OIcAPZ8fok zWxFkUvkebJANmr0;Al>;(}qVJwX@%Pgq>ZuY8+yRSnMwY&SD@qV$s(EXKOvN=o^9U zPL)Su(LV?r(ebVU4(SEA+JOsnIyVDLT*MM~8?eMhEc)%_kHZffvFINM&enQj(X*Ym z^$Q?k(I26Ht4cGm=#K+Ov~Utw)<-@?%!dlN*KycvI5n2A&i!JdqqaW8zk(YT&Hz=) znOOK&Qm^e0i~ee0Sz9>_ENK`;e1o#-+($H?NPUsg-^{SOY@^hVRr*q3Df8h_g}$ux zVf@Rw*~5|sUY6NfPb_+#e)|y^gCiFGEx;kYrt@S2R|3mg%*4W<0W51V6N`Q>u-GRS zJ?o*^uQl*@$p4;753%qcGB~VP5|(x5k6G(^5BQQEVzK{Y!{&4a-w!PI`wV;p zIO|qrpIG?(hMcYS#G-!OcfWggypxxY^^62z0()c?HIA>hvNP#&&!(aVc|?>Sgj`(eI>Az1F`5i&QHpr+Q1KxuQw$k7XDgb z$;(FIf^wAxj<3r4hKGf}8TxFkCl)=&TV>s$_{5^$PQKO?i+(4tq@P&y&jL&Oe{A4G z#AV9Ai z{t94;i&*qu0G7B$8Te-MyVUhdEc{Y~GXuDwLM34)aMqn37XEDLv$dXB^b3F`J;b7~ z1D5oxHt<8_KcUh?Ec|T-X9sXWrAot2;H59Yex>@r)Ec_3l&(?Zk(Wl@!Thc=;`k}y*o)HEvB!9lLPb~b2 z2Im&w0(My7M&Za>=s*Vxe+*RFT2Czc2>I2DPb~Vez}Z?)Ec!{nS#kWp5sUs7;B2iY z7X4)4tVQ^NBNjcYd$!gSi=M@5^JWW2EP6Ick;T+vY%z|4yB%mP!9OWaV&T^Thp2#K z|6lML;7ARA;QoJ6R)2Acvbsm*(J8Ct3SYLYRw#~BRvNE?D#A`K+!t_Ut#qJ+rJQr1 z%GP>f(dUuRlK@97`h4JQttS?JA#m2c_<G?4jj1;KX5G1 z(ESc{#&Jjfm%`K+d|Tl$_?Pt^4~uUb7RS53N!BDE`Si0b&VT4jg$9KX7c~ zLro5J)`u4UEU1Lf`Xl@W#8}^%E`%e};y`DwEG#|bxU2Cic8J9eueC_4L&2)hz|9KZ zh<^p^6n4Tssp_*oY^Y6fn6}VHg%=TbD9qCwV!^{PSy&9haqID0@Mj9sJF-dPXYeod zu);48w=4WJ{43~Gct8GywkX_Z;Df|lmHwEae+@XYP3ceJUja`(+-V$Ev^h{g~nqOZiVG=le=uMy%6W zNv!kBXDbP7K4&e0KJvH-h$2XNmZ*7}EtyBxK} zu8G}^A2?#M<2-Zeck<>l*N?#|ctVAJ5m;;<1eW*S#A4?tu#^MqVQ7~M%j+nzTj3(& zA1EBfKP&*`xH9|}>`{0I{)L`YcozOeGAiz8*OAtl~e2e{$^;3y0TZL~|Y@=Q;eq5etXaF{0DSsvp^hA2?R! zg6AFRjNdQ#vBJIh7vhBrcL+!1Cl0g@<6pr~6+VK0p%)cCM*Nb(ui>AhfmqV;I&egD zc%2roF@Sp;huD7yIP}-lTGk(M*n8BuBNjVpP(}7b0T%)eF|lyN4IBoRvLcqSW61fr z;`6$W^e9|Jy)K7ahz}?|uVukAfyE}V*yOtrDcc3)zpTRY`Yreyh3kOrr||BN7p@NDvbtuWtLM6{mY zRC0-^d&sv80FJT=scQU61wCl>uq;K)BH`+UDqz)A}D zEctsCpIG=WlK+p2bAlXB7J?%d4&PA}@TLUEcM+1ucd7p;rRTed&}oG~q5kg_=C_#8 z8HKL^mUBcb_H)QNt2oX(ihowPjC@^Bh=o5LIKm4K&UuIM8-*8B|67G?8CKT^VhOvN zoHrHcLEsQCR=7351^=S(dUD=UcndlIkHU{p&kGuk&;AAfs_=g5d2z!Xr~cm*=C=Vzg1ydsDD@C_0;R@ZVT~yO5X)6Z3wa0-vb=cVV@@c55<25xIo)^ zp7?#G{~5797kvgk2^>1FID9S+eW)}a29ar1BJf;T=0>?v#I})!go=xaW%1S z$DDCfT3<_kpW@e(qubB>h<~s2{FVDDvE=ts`gHPjKZMxiM=W(-t|aG29u`iR`c|bU z7JWYT?8v|oi+&=o=!r!?nfjk7KC$Sh8+u~V&o%VKqF-$2iA7%r97$338x4FP`7bCv zvGCie|Ebawi+(e3C{^hnAxGz(SU5X?BLT%>c}9W?k08Ir!@>`f(@*Kg02gE^d?WcU zd06;S@-?U2;1COEhQY}M4h>Lt!oZRSV&O-Cg)4GDE4-ZeYK7~GxycpWgZO7NQ5s8nSd^hZQTp}xCvk0}KCJZHh=(Z5zDyh@GqS#1d~GIXd2hz!L9a>PO)R?ijI7|7*bZXr(6>JFf#r zbosmq9AW{(y=&mK6pxb$EM+^CdR@n^1eP>#j7sQ>%8v7$NT(qmdb>yIi6sq1z!9C7 z@xWr|X7a}a-Gt%KPKhV4lHp!L{7fqY@%M*)otYK^mkFO%aeUJ!7muN&%g%_eAvK8 z4ea#0w9Oo(TdqN3Nq;_YB%;z*3LLs#VW<87YYz*5Hu+pd*|TJj5& z-f91J*zXu|tp}E|Si}-`lM!|s`9;dkKMScU~`gy7gFhrX=vOkjzNSmNS+Gjg-yEC3GOq%g}c^c97d z0T~V02gRH6gYId3Ok&fnF{l|z;+Y(#TZ3m&2joC8ka#I z`MTm%02fp#%=BFB{gTt>Xb!ItEN72j%#k-R(-zVC_0)euaW+#wTj4Fh64y3^zny#? z_9@~yioe&;vt9}3AaLXk#W@6Ap!3f1kKC#BEQiQ96=vHaxCl6;^^*)d8CdEkv6Mf{ zN5ak`f1a}Gl!?ZRjIhKKb~(e&SNvLrWhV%(o>-^BDZ_D6aTU zxoJDQ4gNFaS1Zm7hW-HccPV`uaG(x9aG5v)%ar~~;(HXnnwT9lxKYF_6lQq_Y84(& zyi#G-u|S=|rNs9tTuEH7Fv~E|pfJlYz!%JLEVsZag;{Qa)e1Kfe@o#9iSJXmh4_Aj zHxfUf@D}3#rSN0K4=Vgr>ScBZZp12z^$j)iv19W5+LiH@b@$75)tBDow{gB&LeJeM zxb7Zp1#2+Yt*XYFXl9Jgo}G2|D;FMKy~Tu3CP%jkvjmH+JflB)VI7>z%ocv*ae!SweHZ zv4o}@+M)cH_V2D)zECpd7{gwyQpye3wY&E22ArkOv&lD3B)0hWC!afV&yQm*!}+qt zrknPaOBZo_amQCL#Oaazb}mUoBJrnpiM9aaOX}SyoE)KU&Tqh$+VhvxEU&BaJU{;~ z5%z|zBdtXNx>CB%P5^ltLhr5yJ{Chwqb1i3`?Y;&-}YfXLa!sTxCj(H~F z|E>+!-Mlr_+`Fo#HeNG-W1z9dB_H)#udFY~zME?cDfX2Hc#<%aTk_*e^>%fxaGRg><->m--w zgN@26t`3`=9oF+pcsW5mzsuDH_nzvDLTUvPP*aN)WsRsl+uR=+h<9%{Z%G2%&1A(r z$+B~4xtCQE^?{oDm28R^)-Fm8vtrQ&WzDi&we;fpg{vB|h%8oBc8cHHohoxcF(#D!EbR_`73h$#<_?j_F>qcEY#O1Dh}^}^Ox4G z9xv9$yQtVj<6Pu{VhK=x2V)nL!XWBbF+p{;su-E0w zZxIUN$M6>?>3h_d-w(fGS$wU=^w~HhzXyH!eGB%YVhsPq-p_scy?KsTUxpd>u0mxq z^P7*tz3(FShJt72cNXkD3m(&Vm0@p^uRia9J-#0jC+VButIrv8EobZ{?Ty4C`Tf1G z{9c2-H<@7V#NK&d`P~J39G^ma**L`BP@GRQzkN9QYsDD;i@ibMnfX18mn<#tr@d=% zh&|@bv{!}~nY=E=iMnD%CT6ZIK7+WQmj$Lr&Sul(l09@lpiC-(l%SALJc-iPxO+@2ft0r!Qe|lF#0ohP}~-Jr3b8%kNFt zyTVPKcRqH2WR{;*pGUx+TyNKbEakTuWpAc$_i&6~ z6Jz)<_By~b(|6Zm)!y-Ze95qvKmgO;i!jD_bK=C_8UWMY64>K)NqYr2Bz-4+`5lXk zah4dvf3f!~Uw%)+9(lBPJr1$gABi*5*TRb%*OoZ3mj;rVzVUaX{y{-|<8X+*(|&td zmeni9@L%lxgU{abdr(iIqdmR{7JFCuu8%TY-19DCZ>aD3Xk4z|wN8V5gN1Cp%*9iIN!~*_Zr@r%l-GOAd5Y|ie`Q#+=wvV(~B|9qj(U9$r}^CIPZR4 zU&P*xm*CAuN71xbehJ2e#bZMJ(!o=k6?c3rh;ddO9uM8 z=b&dfm*J3dxm(98`51*p4^58i7#H1}=>M4UUUvx|KQE9s)(M5VCg3g7nE&X<<3%KZ z|HW+v&vfEfi-h468vK#D$d+wziNI95tXvLj{1G#fW-+e|vH8 zg=p@cZhV_=4~)q;hTV9-i!%7_8mtf(JpDWFuc>!te6w&XV#Us!1F^^51*zJ@)FfiL zPrYE}?&waDlo)$1pE(<==U#}d?eLX2uy--jkunIo{&uIpFO6w%eS6H*2fDP?0S1Fs z%L=#6P8?~iFm^<)kDZOBK3QRpT8E4r2F}>66&ana?HTsE zLmA60Zx=l?e-rM^8;G5bTig4M$vEVt4JnUXqXS8$J8;*TxrujYRL?p#Yx11Eb8_Zx zo||$f_f`zt=IuCa?vJ-(R$&@<#cS%>+ZO1}Z!1oW52VJhJK&im?*4&%;=+|sQTLP!|#wKGIc-C{VlHcOR`fctcjI+Jd zs&IAkKfDXCka)uTpT=P z+2_+!@(%^h+FQ?C@hJB4e!mR+6*l$GjEO}_i&@UqW$|+_Tl<2~M~j0$jdG82Ri7?i zGKxJjHt3Nb1A3JpP$dO}*j~_aD@YI2`eQ)%>wZHaMQOnaUg-3Y? zc!$XEum_ZIAL>*)7z^fOC+Uu0exDs26wL1(S-GncEj{*H&ELSmkpHg0@>)9! z?dg_`(D%xACuX`=mg7@3Ggf^Nb)|KeRdh5S+8P*Lb^}@wTybuzLY}f4GVV5>*1QK% zn^N^|Y~LX48;v_%%JGyFDJN52O*xhk8asmbt9RUMC2%I?&g!cCN13jZ#(vk(SM^p^ zAJ0FD+H@4*LMOd2?oPzC_b|dqsRz!ig|+TSxwGezP^G(*y4ve{$Ly4E)P*V%ZzWDS zdtL9S;$Ec9qdU@vI(u9P&SHn_Q7@%qhiJ7kwX;Jt_Mk>9nSuC+mU;1D57nx9N3rW? z7kzS)e5ff((&S(V>Ul>~s^SZtGxWuG5e?6b-Ch;@`m9UuCVCNu+KY60>>FWY*U^jcV$(~*mt~D^xb^EZ zjU7n2Q78Ap)L%;Uexj3{{W0~He5<%gqwGhD-95*9yL%2WgZ`Ix>9q1&%UeGf6zG42 z^*>;nx)?jY+HsG%ToIiAsqPxJ9ABJbVSo1|e{8~z>z#AQlvDC15y7YbBR=_RAOD!o z|3#n7@qx-IdmK|}%6cdfRLWluIdbLo2LHD@WWAH0Ax`?zeCe5N$jSNb=gWV8Cw!l_ zX<15s#*pLEK0_SO&{KtTm>+eg? zKxlnLkQs#WKMMJE;H$K}8S?LeM`$@6>0z0RoP7QU z`O0gslioWJRyie?iikJ)$>CLf8SbWE$unKPlKGuNIVFb-`5@BEA>eo%b<6X-n_tC$ zQ-Wg^UY4)-;HqRjBo-b@=DPvqlkH2{r%Zb%eEb7G`7NJ(&L>y< z>~SuEX`k~FL@q}8c+R$xxO#`bP6u=6}W(XbbSpPMvb%5&VfmCWx+ zba>qldxM?*038K>$d7A(>L}wip6eXhXYU%HTe|Ks90RjmcdlvtzY&M6UsMrGShoN6*YE>JEczM1vOY80ESm~AV&OCb z+qYAzz5|HJUiu&ft799ZHa7CXF$NnD&eAZaER zPARagP0gX|_AC`Iv2fVFM6OVJzT>p3JS-dzeU`PRd9Rc75DSNGvZQA-IrAiz7p8J3qNqgqNge}l3L4J zfFldvsOT2p5Y8gtY^^62{Sx4;Z2Z6xi+(w9w$>Ai{y|_#1F`5^fg@Mr2W~SCDQ9Bg zJWf5n^U@KE{wd%PJCJa^t|ct7aPXPO%Hj_k|A{^aI9uz9Mem%W`B1@c-zoh7luOIOx&BNjc&R_wDp1>Z;h0{p-c3x7SZa5fs4?P1on z_<4`-@2{>EpiA7%yEO{gr{T;xP=DQ5cDJ79n z%Kih?=PA6FdR7X!7UJs^UJso0B@c`JjnHRnJ+bIF0ZV#_Mc)N1>Dg`Iy}$+dzDUPs znyiS2CG3x(&(?Zk(X&r2aS@CD2(ZNUs)64ozed?77XEv{5uJuV02ho_9QOIM_+g$7 zSonNa&DMHi(GLKY^bm{QnS-qDhoP6W-AMjoWu930QG-(fT!8OnbbQ8;wY!OhKNDEi z?j{yJ=NC(Qh(*5ySkl10so+-f?^baU3;!X5^9XUi;yeaipzBFGRML+kmat?-#_?B; z0kM~QSU6cw*~^rkSoEx>_B~2ZEc!y~mn%K7=-G}%ijGWir&50pVO} zTt`TUVkm+qwd+XL}Wytn}M~L$@ltgSb>-_5(vPh1qu5^&XZqya0Wq zMCo4ymi2FYsh^_seTM!pu-%~a#A1hSm)JRO@K2H7sQARff5YIvY4F+BMamVQea_G% zh1t)P^`$>D@F&0pHz-aZwmG6-U|_aCqOUWsOe~ZU z?wGBi#ST#^7ArXmiJ2hYak(NE2{n8!#j-;z&uiM(2wERFE{N) zp(~TffCawdvzIv(-$P)C_Lv>9R|R0&W1lqx{^G0T3LP2|c4JY>Q z2R7~T1YRM=@L%k)Yhc>D5AQ4_zk{?N&qpuPW7@j{_U1w_PVBt|o@s9r?Ck-GHV5O7 z^qm1V?Ja@5dNBe&fv@Q>QT(U7@oGGC>hp`L#=B5QR4p88XK`@_M6VxzGu(9r=*FQ@<1T zW}xEHe;N*!UkC@=@^4`hVvQd7_*vr~i*C4KqBHC<{Mq9k!>E{yPhIO{P_F{k#YS>f zA6|TD*}>Wag&XqQFzT%5cdM?6+35>1|MiZ4nK`7qvn}}H(;2_|#>qrWNqoUpYv1f` zR-(PBcTKFb?7dIpr{Az9ZHb>=Yi+Eu`^~aALL;R_{#Dmhc4jWfT=C7${=p9m2R%G3b@V_hzThcq->;ss5^YUA&7(G0 zsd;~kcV5R5yWP<<7(o{eI=Vbp*X`(1V*~MA9?T&ByC}2YuE94aaPzk0Z0*E|z4+;> zK!7}*yc5a{aczuu!smiv>FScfo2m%5Vpc-8kNAo9X6a`UN8v z-@UE6@>u2MX?v$}+*;K&xc*`db(kUAuyk=azI-9ZYGB%P!_t+t;i9pHm@XI|v!t=H zu3^&k*WZnK(5tH1lfJ%2f?UteSOHesSXL8nECeGAuL2cve$m*X31e?8y6HNrgpcjc zDiBs+6ku8?SiicsXlYU1xcMuJ>c-BG^XGvTD^@KZS0|S>c%B~`r&){mX8Kc9t^Q~rxY)ZzL3uAK7s+D0XB7jMniuN9zG{(R+MWRJs%fqt8Gbq4=bzz>hai*Bf&Av%&j`=9 zOg|!%;nazy&&;th16%_8)Ei9fDYF&LfAF0B#96I&H+lsV7IL zjr}9p&vh-a?$fpdOITtFy9HR%&_#~U7qM{mkYlSfJP(|uzqJqxhwpK+wVqh?eZaQ9 z*At8WD6qtP0$BETea*n94g9)+-vYM7Dm}zvldB-zNNU95 ztPJCOy1)4Ix)F#E=aM7m$?@V3dAg^BH4A)e7wAd$?(Fulx>!}=e#S4`P<^>N%oAuo zSii*yWb;9cF0SJ)^$fKHzJ4CtOmPC^P|#*ndz^#tCOp|iWqRnxORNaSXixgYe14*z zIQsEmIQ}1tgO1-37Affb3a=LuvACzfGoAR^P$C_5;z!=a`ozb`Gv)%Z{OFh-IW|IbGus#U8}#0#n0`sR#X)R16}#8 z>koG(N{tyYomKCbtmu$f*RJ^`W)mE6*eac&Ukq_`7l`eRmIP2HL(-4r9L_sbad7&9 znSDiVPq%cpdGW27byG!QS{#dLR=8=PWGDKkeg$LNrK}*QeWlEpc~fc!yMnoY_GC)# zx+gIY9NwuQ}<5IsR*LKic#)C8Ix~fbKcF&!-XyRZT5iM12g+Lmn(MwW_eji2cVE>@kf8Sw*%`;}%R9D21w;^RsG0EGIdt3i$$3O1= zheLmV5Td>AXk2PU-L16Fp*#|N*yc!$FHD_Z0f1vB$*z~QT zk|kEAJL^F`oeYafD)%MYqoIt>wDW(ONXu#Uo{>0vEhmB48b6s)JL}Y}>2rQIr*Q7$ zbB7>(c?W3mcDGcNP3kJ#d@=VqTkZa_08^9f=kYHnuYRMPXC0JR!YnV$OX@0KmtW%7 z9`a^`btUk$YGp{dsal!evJhkGgXdOssIwpF!6^NH!4Ge7>XWKRw+Hh3asq<9dltPe(>r0cq)Ak&zlH~nRz)=>|mO4HWNmOK-bcHbMuA_%^lS=G&kqr zp}FB}?cBm~LvkY}Lvr(PACfy};gH~d`Le_Uv8IZV zw;fA7-Eue<-?YnGAB~4<0>c?!plw&{uHaL>?Glu=o-!!B- zzhp@2mjXkYztj_|LhX?=^A`huXr&x1&&YRblbwEV;0ZUq-Ro8i`&||0U06j)Wj(sA z$>11gF%Wn@w{S>#ZltL^H~-=C+%eZq&CMG(HFs3W)ZCogr{;ziPR%X6cMANcz<)~a zm?x&>=KXNW3vCnIo^J1M$+$f?Cs0=0ff<(JC#ED~!3rti{0)IK>t{S18{%p>7xeHf zJH4r_GrgqDd%{*%3`$`tN?|HWVJb>tDoUXorBIGiC`T!jqZFp3A{EV%k}0VLfho-e zJ!QDcD%P%9A8m8ytUOb02Lolt-Ih_EPo*>7C^%=HT3$mQn`e67mVEUIt!Zh=`uvT~ z_0yV$`A=q!sLg*&>8joIbt^WQ7v?Dc;HFs@v2h@EbW_>B2@3*+hw?YLsliM=#x@so zCy#lv9-Z>qQfarA>XH#YQ&YQz`9AyT8;{Q0lG+-yddrHYys+)$wjJAwH|)k6pmb|f zWpezgOmZ;G7PEEIf=4kkwk6QD7{^>3#fhqt_>3;J9q)h2^7@NE3x2YxGMIib8*{hV z1Fv+_)c=CBzA1_rdM_4A=`K+pd}nv=mU&x?-5N31Epe}AU0C9WXU*NhFy5V}E=qqCnC<$TrY`i2BqM`!Hjs8&YaqPpmjtQ^FGD`4k&DkE+~zn#<*6?w0&5fv$NtE0}GW7F>dR zzR_bTY-^6CTb=3Q)b5t}xnEiR)1NELOL+YdWtkeItlL;;zKMHMeABP2)YxzfGX+yQ z-z+tj2OLdhAM2&hX=h;)kCvx9DV~lL^B(N=e0aYqaeAqFy_{(%<g=XIoX*48}3qTF_b^X#H?hTFG+I+5-M$*FWg<@8^>^bT?O`n3#LLwxpZ$KQJKHMqF{471TnQVk%`s)l7;%xS=o%o@g=9flaAV#;wCBZn9*$9_D|dEe*W z^Buos7qdTlckcb3^PcCv=RN1#z2E)rdCxs2#>bC|JpD=7WBueG?KejGok(9450D+gMU+HKC`qxPJ`CcOQZbtu+OqpezpC{!5*Ixnpk>~l9**he~bRH^eajJ@g)6n zl)e$i^ATw6@}~s*#rZHLTMa(XPd*!XbAO%@_-k|fmgf2d8w&iEwqhh}F6e{M_4?@7{Ik~GJPP0apNNxC^Hzd3*SbVhPMSouZ! zS=t|+q6kYrqT)RLaFV_&Nv}-OJEC;;`EypNe_Nh^R<<1dHx_9=US+ z|M0f9bY1oZ5+Rm;XZC$ddU{m$y4!1kp7XedQcbU$!IzQyvj`lA1_Th15%s%B>f)eKc%F~vA+MDKm zJ>>1Z2i!8Q=e}G=FcIu~{itAiVv?Sh)c2>}URGX1_L*SGc0B%xgg-7iUzpGLC{b`X z0e?=<_Idqy4KCyQ_oJlz`#qo6+%m3bFDLzl`?DYyhvTPY3%xz2!%i93j}=LK^(FRy zlbnx}6F%qINa+8+mB1&{qY`@?lKM|g(&ssU5soe6jdSTdINH>l8{&M-09fN&Y&*>_ zAr^;2Ptp@h-yG?Qr9X%IE3ktQOCNl=Jg7q*rEh{t^BahzKUse8{~EI&`_C8)jg2(| zxB6IA3vlIH>>$J{mt9k0unJ@hHpQD0i^FS~;>wAor~ev@nig@0#o_aKad?lR*mGiW z7Dsww>DkSS^(L;;-v9+9);A)p`B>~D%@djq+)BqGGqAOs7ND&Gh;0 zX}%P%E3(6LueILzOYot%V`BNq)1u^KkX_{Xg_T&GZgSkWjpR@PAr@ydu ztu!UTuwJxm{u(Or_mks39|o39VsVa;<2K&_uIGscAr=Q;@>zrHiKVXt)|{0xaQ)P9 zXhtj!<2M>yPb@vJ-RehT>8Ap>x<4afPUFhN;_&opIm^mo-&MX`U~xL3DzU>M7h)^5 z1{mVrT3vq?RGMc)tYcRKYn~0U^w$B)XJYBuzp^=-oXfC-5R0<_xHN-W`)yF-g#^O$ zNBR}Om9J83V|Y52WtBX^veeha;%p>`CpBaXHuW{JIK9A%<$r+qZ0sOAu*oK|_>Th1 zw_W6PV+YxVO`K5R0>cocX5z z207;ySe$#wX*d1D5r`QD(i7_+~%|7cpDOn(-(1G0B%`m{``sj8w)J{ z(TM*#IbKI%al%^e^X=F&?#)#$u{ia>YPad+xE*3~=8)t5car1&6N|H$9B+TF@viTE zVsW~t_wRjT>DK}4*l&>2V?Gm$b5F$CM$R3^Ar^=4NvUi$J+bu91Izyx$?;=}#rZq+ zUUy>YhYl}}Edi_U#Nv!2$Lrn*taGC&!uA3Q5hDmi(4)|$1emKo)$Ro5;5 z{1>?#*mYMIYXmBe3$w~Ekh8T2iM7yC=3mg&bT7bwQI1}4`vEtML86LXt%uXfy)53bWy@;hLt>+ zNr#1xwxZwX)}YM?SD^t`^fSwOs2-;yo-l?Gy@Ew=y&Z4LjYjsZ)4yn3wo|?6r$4TZH)#ox-#vHf`Bt-_UwiWoKiP|-Zx3qPL zVqS5Ug#Snj&L7wTlJgTFcjW|OocNdJD;u@IpInIkLy~p>#HjvnMlEi`~fNg^IEye-2RvDPN&B(nEQ zD0obpXN(?eJlcCVHrYcps_b>aUbi2^57}dxvAr3vcN289SMfa7_cKZR9mavwOJwh& zr2V$T-Z+qG4^_|odpbG)j`m}37kIIMyCQphM6ddO5681EtT%=40<`^`(vzl+D?c__HFcLp}u`z>^=9;y>$!YK5cV}8h9A9y^bjY>!l z8ja8VY41#IviDJd*xo_dTf_rgWRGi1#rE!+RP+ZQ=gZzEe3#K4%b_&m;<&_M*fWpY z3hemlkBYPP;H?M@+llvm7$%ndffw6Il=oKvG~rrhk@tQj@F`wB+9jU*qOl$ME8e-N zhw4r<9LIdF&g@)@H0xW!_WoJ%Y?sCX*TI=Rd!{Xj(>UE@p=+`aG6^Dpc_c<{iX{fGNreE!IDNB2Fk`LR1@ z-ZuTtX`4rMAo?I*Qvy-qcMNNOHrx2@k59QXJNisd-H|-f8xg38Vy zJU-btn>sdKAb(7AcgNj@W;bo@tm~^=ocHjM-8&G~yA9hRY=^PEc-z7}w|UbOZPVKC zYaeyNtDjwY>HbSQFMI5==B4*69eMeypSS?Azk54YM?Jl=bARWyj~(6n;}L6yyp%1x zeR1xcoddH&?DUSkagR3N|56sGjrmfTw^Z~7+v%~6gS|U?*-NW86|++q?T#Ktw0j(f zJam^@;jKp^ziYq<IFYDXd`l>e)xAhJ*K;_t$khNqSV09-X954dwB9yUD59zZ}u+A&3U7F29uUOX0mXFV|w z6Y9G_?jbViR+PtkVDi|W{EfzE^t_K`dLGh+r0LU={P*U+m&!PZF_pY0rto{ejPqrB zNZF3}9EWmW?H+{p{1hHm#+{)aCs_I&*%I6sQChH-5&ip2NZF3|zUytv_AaBEB5_`W(>@7>uOA~*NB=%lQ^7&g%!t(A`0-sF3%kvil zmvO$0NXjE!v4glR%_>u=vEPjvE8=f2>4~MEMm>K3K!~Mhx#AN`-$cE~-w;br7b|{) zO4V;5&-1;W6@n0pGY7cA^~BP*0m}zs=}%ae|9A~$@xch> zO=Y=$FlF(7sxmv6sfuN!O}#gs&tWPbG7ho)ya>3&e|iY7cP*6w!@9Z^77n=roA}oP z>)jsffGZ!y4ni!>df*ZtfIzljlO1Al?g3W0+sJV{#Ns?c&RFaqJF)5g@WkRg3at0T z6HEUy;L17JL5QW_3oPFb0LwRGaSoH?ZE}fE##Nwb<{+rQZXrW1l0(`-@nd z1LSyr9U-UFd>|I*7_jR2dW3lit9;P-#NzYcpwwvkN%+uv_=&}725y*W9AfEt9j+%4 z5`QmDN4mlF#NxBs6<*9B#M1X434oW>a(q)E036uMNB_c*+*=!_?{9!Gyc2g7im(y- zc;M5AjPsG!w|%Hxg}sf#)2Pl{9-cm7w1sy|-WYkG3}V<>^^8VT2Oe)mfgEq{?}fsV zt+#8e*sJ(9jupS@HN-f})?DBHIgAeG!?|jlXgty#Ir*XC{%vV+b`Zn4Ub>Dr$>Cf- zx)__4PhkjlzM`3s z+#vq|ItjiSgG|Mqc%&u$xveMgG1TE&e5O4AdJhco-oWpOn8&Y(S#E=_co!!AZ3M3cn?(M7Jn?S}{F?z1{j0+! z{}>+}m-|EHftri#an4~}-zP!hcOUJMFMAsk{~q^zd<2obFDL%>MfTWkvd1yP*uSTc zcd?nOviH-(-pjDp1qS`&_qFUX7B;pw7KvK+{tZXt`d)&u4cWt~nA@9&<70cg|Kx9M ziQqZV$M*KX-a07gAJ0Si_f8xT+gpi@#WIFZ+2cK6Y;O*n+KPPI8-q>uz70ToGqF(~ zMf%EsY{xuq*Z3#T5z3emwa13ebpMQn@nrB~p)JZ|*wEB#LjpVUYK;wTgS~ici2vsl a)`KE@tKhflPW^V+yUXjwdn&;2JN`d^A~mA` literal 119664 zcmeFa4R}@6nJ>O}k`qG+a^QesV(l@3i18#sg7{JE1k8yfL`soRMI9*^{$V-_D9~m_O-WHH^)}qk$z)1k)|1}#^yd8E}C|$ zqp~brDRsY687D5>X1=A={}bEJr;q!i&oK zbld8hy4u!;ma3*N$69W#s&A}sRf(de>gJZZs@l3{pL}_9U7b(VQoo|HuC}VSy0yA$ zZC!Ky^7SJttgLQX=~q~H)3jTwR@AjtwIE}4gPYNnS2wJvYHVv5Ipsq2=9cP~mg=ge z7F4aexq5ZWg({8JtGyby<+Rq1Bt_LOGyq{0+`2HKZk^YPw&B`F*3IXGuIWe#+U^J` zU#?qU)l&a(UDe9Eh9;v+>_X^yRXyw5;wxTKmbbOGHIGo|mbRKzb+J}drnTzAR?#Ei z(mL$9#+IsBU2|(y>-we<%Ao6QE!8W0N%f7(*Hm5Fwykmz%XZpDOt-W)*Eg=HYF%U3 z>4L^@twJ}|HMZ2RX-w?FhnnkK>qg3>6D}AETI?G06%=c3;0W{`Lw1KTDd8}3r3uHO zE49re`braQ1HZJ@E3>L`O>9k*cPKjMT1PC}%=b`z>q@p!RjlR`<}Z?Tp?G9B^*nKr zI>c7i#lBp1k?xIQsA&be>1#3bTtXAaMRVQSHD9i)z0fn?T;(=UQ}deT^$nc-mRGkm z_>L(S?>KKal%sqx>nOdYwYs^rx~9Q*1klh({f(}0%5OvkFSIMEEo~UCBlVEvUeo9= zv8CA?9zMfJ8evF6I)aO0=0Xz}^tC=lMy#rrbV0#hQVZr6wDtuDYof;L+6(66L zFi;YlPSmPzX=$r#=4iTvl9;++z8ulkCuogu(n~bsoGY5EAG(A~YpWaTYwKGt<+VFY zUBXOFbxVD$Dz>H(6KHjPqwlok^UFDN@W`vLt!r$pUtaG!FC}KEZfjk+1{3Uh`(XW4 zSw=pp6U}m(`ZRhMJx6)w%u5|k1zt*1-RhB=ZKQ+4$u!c@@FG=qd>i4Mo>;+8YH^f)krqb^Tl_}PB1ScIgPhmSz#A+twL&GUTOUk)Gy9F)*UMj< zcY498MJJO6f3@BkD(orf%G(r(?vH;1Ie*@+RNkSS$pgw78tB>;FYgv@N~q1^Jpyc2m(BppvWmKL0r#!`-sP)f&{o)W8nbz5J`o*yl6({tnJ z=hrMexp4M<`|rzMylwHd)f?KAqI;q&d3@Q;0i{BLfSOWjS{zAg*X4*cG*a5g(my_j zb=K-nsyr7R*s;1TwsndXN;#_f(gP>bf=A=oZi{CW2TEh@ud44Y97wVHr;I8;#1{10 zZ=fp{45;zZq_P8nDORjKuGl64w*5^L)uJ7!?|Z+Sc;Nj#Dz-I6^^Homl7`W)sxLKY zw(HrXh1t=(?Pb3b> z9Ls^df4h3i{^IPCZ6!%%v#bs6){r$W^?3HN+@s}3<{i%KNsC%TVk;CFmE_?cT`4$u z%BZ}~$vyejkh)uB*>USkPIy#a$Kb|=o%>Q!FG$;+l9cPV)A6p@)=?^F@+ft_xTfS} z$?UTIWdR%=)*xNTw5edo(+%1@R@(XO3&DXK6!uyggpvG$#qQPXjR%q}gDA9wB9 zM`3uO6@V?IKYgLEi;pZlTr+&Ir?6*WQ_`XN_I%{F5zZx{&4I`Bo?IMHEPeLe{d2P` z=)?H(m`Yd4d(u_j&PDN)34NQl**eRVn2K6~x#<7VfsN(8foNZ#IMpj7uZ#Jz%`su; z$_e+T21aN1#)44`tufc?4`5rm+3FwY^7<-wbMlm)B>yp&Jb6?qjgd zd%WhxJI>@xPBG@LdHR?Pk4i;3#+5N=>)CS;s=2&MBLc$85>T8%PSJmaAMG!KTHS zsKiN7qxOJGvp0qJrH?Mn6 z_x~PaU6!N-SuRR-QL>9tT!hP!XiF1r;alpLhhq)ZjVr>=-DtRQTEX;!>EWp>TU(o2 zZoBcu6?kgWR#OmLv--w5$#P>u!`jvPxMAm0wgPB`k(94W)o2FI8xO;f@>b8dIP1B&@qi^8KQ7A?I+aLZ) z82dL_CGr9FKJ-_*I+}0v@pusKkWQ}=R%!l}kAKt0ANTR+ef(}8|EPPBtnDB1rQ;t1 z4(arBhW;B){rOJ>OJ&*hd&Nlq??`8wq#p%8!Qh9$Ut{nuf}d*ee*?bI;Msl)lOV83 z`}0eqJf{D~;NNy|1@x2DWww6>zWnoi{4G9yiNXKG!A-WkakjlfMmo#C2AigUTI!Vl zjIAG1xeg!3Z<3m5=bvWiCyp2GFWWIY+4g$fbj`Q>c(#QmoqmU~O7maw z@e6#sH-5GLVk14#pV78I8E*P$HO0Y`?fQ@L`9H?iA8_?G|D2Ea#-~pA#=GWE`}E)T z@$dThNlu?ArSrdMq$k#Atgk*}eg5n5Fx$j6V9QD>Q$$$9@G6L!br{Ik)p&vZlG)?ew)g*yKVNB>dV{wQ_8$iV!EunF1reEIM6@n=LC zztq3g=TDB0FZJ<{IQe-F8jt&@ryZU@wD)yidH?R?zv|;3_SsMK*^{|bmp4|m`RYH$ zmp{vAKNa>ujoK)2kz=3sA}N{)<0sVQVbLjoD1yr<5|8Q7gEq9W=**|QS<8ta6v! z=tQXV87-dyEH-ba{zF<$EczwX|E!i*0E<8KfrHm*`C>!93OE$ja$>R5N`1%w4F=u_ zEaRV8^m~D2{1c0O8?f{jvB-AZ0qrNjo5sN<0jgf4vGYFjT_;v(1v`)*3 zMgKJAIa*FE@-x6v?uXRjjUb3vbZ}~Pb*=`MvT`YRE@}%5`3wW|a25ZF#U{HsavgS{ zTx|JMZD{Wz&P4~On8*!UZrfS!VX+g2DD<$F6N@}T`JZb!vB+-+j!*z9#ujpH5{nM6 zVIuk1fp}hs@MHqA&kNHuUVvoGEoXA*s~#4e+0?mN%jZzXIoT77j$Ic=hjo$Tg;;cIfW;2$68a15K*XZMxXr*-=ABj<5q(Rms; z|90#^$FSu)bv$L@H-JMO*nx;8?_0nTC+{zT^FNOr=zVPB53%T{VIB)@poUV!BIkK9 z;^gJ|E^>#~$)vtB#)w5f8(93LW~5l_Uu+Cqjbu5Fh{eui;0QY(#4ZsXV$mrEj@*eI zh<%q|Vnh4cgXnWA6n&1jV5!zAz)$2ZjaiK76N`R1bvV#K3$f*w+0Z^-1hdJ4R0M6p zCh~2-p)N|5A{LuFfrE1?Rcbdj(H}4{>n{EfOI{w{k-M=2Ex;E1f(=zIenLD5K*XZY zHi^umRH;^M!7tiSU%xeZSoF6-6uC#spTdvWBo>|B)L~A4s-;Yj2~jLe;PQl2s_a0*hGg|blw7vdDhKWUo<2-nu*5S3B)Qe+D`o$bqxsXR5(E0_$%QP;;kN7|=_HPG{RBN48 z)N!s=h(+gN;9!;3c@#ep2k!(HABaVN7j>3m2YL~k=n#v}Ah75hr%oI@5V7dk?H{wn z>RtSVx;-p9oHrtl&PTvO4m!~9vE@5{rlZ~DI)_;D^0`c~&Q@1f1B;!>lsh)38TfW! zxvn4zARC?1cH)Eo7+o`# zc=9@ByO0o&QYEpi2~n@rEsfI|K8vWeR>f!Ws}Y)%n9q$xyQsT5;;n8qB3+cBq$8#6 zP-VtDH@Dcqi;UHQ79ZXhRJS7Xw5F}Ku4UwWjAccfR18rm7X*tM0hngy#8x-rNzr4g zn@ml=d$xBYD=@B*abAdmZLMmk^TJ@==DT>%wG**c(6|PnHFwRc%tv%%?8|Nwuc@!K z+usRqD&Rjrs;X;i5y9uhOS{FiR(nF^&~5v$FKSUb+6iL5XpdCeG0r0eo%r)pNsaDL?{$pQa?U%%evqJ&@3`w%zf9D?Va)2TL)VeVhq1x@1K449*1+&kRHay zTXFHP8u_8>w#zVho+pLG-V(@7|Bk@kdr%5v<0CJzw+`5}w*UzfAQKXMEfARYUc5@F z$&iJy@zIyq`z)|&Z#fcpjuR4lnGl%v-hjO`&$g5 z?ajbN{~(mY*h1LEUf5^vCD@}(NbF_#?7a_rk3$xQ;zVp>@4rBXKX<&mj=}T@1rCY5 zmmo9!>&1yZ1&LwkU5QQX?T5^?cP|DLuj_=w-uD1Zdt1X^f1s;fdp~o=Gp`d#+kN&} z7Pp@`zdR;LC!klWp}iNqBF8^TnvpI@|5A@M3jjsCT~9sZ7TzwCdVH3YT=9oBfbHZt zUy;K0Ui(J)9T=0kldpxnrZkf$l5fb`|F`!FNUA;efQk|p{2s7j0GorqyRJJ^%=1fvld z4Q0f!4A~J;h$Tr{98-Cg)(DQMv0-7XeX^qw9#JD{VGJ{wwlU4nh+)2W%UM_yoosz9 zv4-(IKU%#75mAV?``M3lyj9ZT<|x{8Q{Y72&a_}K?W7wcqoX+4Qr1~UrAa$79@6UH zu&_BgfT+!2+Ct@}g=S7vu+|+oF>}XPuXqqS7euF&GVb!+2yvIz5IvdlfsW>kTIBY? zuO!&MFe23M^%DgW!Ppjft=-ngMU?;|8-u8k+(^OhoLOk)=+0k9myu$@M@{Y_g z+Qb>J@EjvG&UO#Q14nfn52JWyNA0-NwDj&BMs)Iq=#RE^z~Z%A{JqC0xd$HXKD=vq z@1diE^WI$W#-i63zqa&r&8g)lSDk1)zJE(W&p_Auw)JzrfAzid<8wb~3uOe3Ainod zDD`JUg@?bLfmR;MI}+LwSoiCm`52=?JO0V--?PaBDQZD9Z>Nrd&PA-6msV2}o8PVw zTV=NbV+ljuWr!xsjhn5GbVN$!?B1seb{q)oF5Wm8oBy0*p4hU#QwM(hvWoX~;Aohr zdhKI8XYW4P8HM;Q!^%)mO5C!}v=_%ziIwx{dc^egAy8L*$$4g<8t7pxGfNv~l`f3EqSaYwe0+T zHH%L!o_+uR`?Hs9Taxs^`MaypcV_HdVb?&9e@1)Yu2}oqs`@U@Xja+R8EqCweaY(Y zDG8JX0y+Kra7|^zb`JeZ8sYj6L+>faR&b$6);D)R!d_g?iy&vuk{erJ>_+W0D> zGgH)kU+RlrsrKEKeE5Sugi@FPHn!|-Rn+}q68k4O*a_+HCd_=SFE#ad69(gfjx(I2 zLVI$Pivs<{p|)u1OvGEhx;AaFqa-IgMSZ;Jfy(>7lo#;Zd*8MXZhu#D zSpcVbLtmfI>?m%|fPwuOi-H^#^NXJw-W-?iqd#k^VZvd>b`g6iFtPYHJ&sUu9d&Z@P-bzj1<#~sEqtvnD_Q8$A z^if9#m&d*Hi8FUThgsi=9k-)Ok!ydnV8_R8QzX_szGolLY}Y@SQ!s9PPNZXePTtqY z=S;mel#@F>lrwo&C@1@ip`37aD5v1TaY!GB^l>>;zdbG|_ix7`!n}8&H)paHoQmrX z73>?;p*q|)IkzR&o(}$I+*X7}k5+AMq4YCjzmE&3zOEGYeOwRsb*HM(sKCmbfpLAI z7ImH5l2&4!RTb75t3Rd|S{*|(yO+m*?arf&QjRsfU>(@ow^ifsYPyY=-S8CsNR7m<0-M= zlS)Skv-QfmV(Pm}>dbu7W;iQv3as?<7Nz$TFYvuX#J34*Do$3+zI*@Oe5=4an&us5 zr1l*>w{1GewDuG}55Gyhekr|#eJ_^i(B%G}y| zG5KZ*H(3XI_7xup%$QY>FeB-B@mcoUF8jL+y2Mjyuf8b(RdiEawXN;L%)5FE-kb@f zuGH_h*zdMP(LUJjd$9ZTu2XwY9zAjV_{n3ZkG_87&BN!0-#+xq!NQ(rd-Aq4P2v@u zSheSuuE28x+pYf2$zxP=C2FH?!j&lA?%IcA_q`d!=_)Oh{b@lJwuwx+Uk${0KwPszv|E;t+uF2Z|k8EN7L zuKz5&>4DjBGv0ekp7IZvO9Rm%cLvJI{jS2B1w)0=oXOu++0mTr@8Z3yobY$mu99Tf z9oWt?V`pX{p1gc>PVQ(`^y&=ns=sT`zF+j_#t+WVUHI6-)cZaxTV8&;ymaotxw#dO zRixfshmm!%%j$m<+uPWZr~Jr`YtKO+o3l8_9a<50Zn!FK`(R8c6>ofW1wM)u@5Mcb zN@L7Cj=40(%ZK7+m<@}K7V0SBTN!-;+~L`J%Py*S74(v??^5Nsn!}rW#d%Mp$LHfJ z)4Z3${eazb9cOSZ@5dWPyRhxXws(}es`TrnIZyvcjzZkW?Zw?zP4>ymj{4ln-txK^H)smQ!>&Vt;9Fuv=-hzx}f%Flgh`J6a_Y^Jlp=)jh3$H+W9KpYg5mIxQ6P|5i?cjEcc%-;Q7qvp1? z$=v;YJTC3)&A^oj&&7RP0w2x6_%n~t3iPHNbJh?>mbEJWW_)=!-xKW%eDH_ZnK}#C zM0Wj|B6H9=-(25jor@mW{N3WbZ(bXXZQY~JN3V6yxMDwsyYNffDC(kxRX8VHtQ?+G zw8ngIuCT8hyp)UQ-Bx*E^lp^UF=UlwS7zI1E_&oYbG2E}L~Q~odEbmRv7ayPx30O> zFK36Csy+?-RUZGa zczMa`lG3t+Wx3^#m8Z@XN67){j0)fz^Fj9LBWqdkZ9w9iV;3*dS@ zG_l*_dHDOzl^km3oIORdz&LLY#9=Xj^W`8$;d^m4rng|H=!HH=N%79Te?%_4RV8Kq z5xJ~CC07^DFn@emC4W+`$$vtw_{NUGPwStBIUDnPxXhBf1G%?Jyi&r<;q`V~YMOOc zdhGx2>kG&5|9gEM`e4GJFhUNc#7?BRSDBx5yj*;Y1ZVwAW#6JwT;Zzg1_H5VKT!*# zcwU3wNo7b$eJ&Z&GjFSV%eY?%?df-Ey}*jT%f7Stz)yan;+s2u_&Z#y;3|1f(U*Rr z0-LQLejH7UKCtM(o;@lwWum%!3!ky{P28(~v85osp?#G7EU2$-rs_ER{kp$Q>Wl9< zbl|3gNqwossR!aePC5`cSllu60c;}mkewPhm=t>KRqN{=|Fq@i(|?U~+QFs+FTAS$ zEnxLK@BLY6Dttp&MZ#)I%jeaf{n_UcDt5!|cjSC7dkG|J%Cy3J@pBuZok2+dGZmgX zr6m%+`>xXI`2^F}QRjLnhp|3Km`if0bTFXX+ZtQinwr)$x7O9(;R;t*H!NS%yxI`0 zX@JP%8dg>O?gq*{T%Woap*PCF~Bn`E%Vkih8NT|wbj;R;Swz9HKk=P`X$;Jt8YRx+tD9W zT1xPLZ@-LcvsPd&J4c87oruq{t;5Wn3n~PPweS}j8`dMKq)uDc{M{utse9(kn$BHe z;SBrdrkVUHy2a*hnqH_Dl+BOcT{3;9{1*)WY8i?CFL>AVLEPgC@m*8=tIVKe^>?@z zp65z5&;P$_(mej%mB7~ui~sB;+QY4qn?`V%j~`{1chc3-{OdmcO&`Be{+WoUyYzRF zFP-spnshq<*KYERyE6Hm!aDX2`_fSMH{3zSQ+s^UHndZ~OQ~KK+G0{&FAB|NU#y_NV&z^OB6~V%B%IFTKLY&-d{w z4L-5HV{Lo#KXaute~Vk5=I{0K-v8-!dV?>0sgHly$8YuVCw%-FA3w?UUzg|APxIdK zqj_(B3EzWgCOf2JfO zLWBJ`)5p*8@f&>nQ$BvTkKgX&pEmf!`b@OTpY5h=-kWbU?~VV7zWQ8g=YQ7ik1N$4 z+;d4B3+IDY@Devd9*-gIxgrH+l0S`f##JHA!JR)gx&CPTUVSuw(3kGDhfd#b_`~)+ z<p|28B2PWa0>6LY>RFw$Ax9X{SW-mg^Skv|9drM`*%ah2Vk-dR}l zUjJUD{ucHbPr@SDe$QdN<^yvGlRpbS7Z_@8doBUir0sdfr{=x()qJa{qo%BncmC4+ zfG_>H!LNWm{pVpse-i7LW!o!u^|RFP&>lB|m+`>zyz!^?J^PwJYUKY6D+;dvEyCz45Hmz45B~B*T7U|K-^A^ZeEPTGzhj zf9vDl_VFitym$W7`6syLYyL5xzMtqs^clh`&EIbDiT1Cz?T2~r+jPD9 zcZ^@QpB#Uyz%M}>=U{0Mum5y@@A^^m-ERA6zDXO$Uh~_0>CgE1Hw-=v<#!<`V-cnN z0>fXn?{S~~Oe1|SD$KM()d zj^fXt;qNk}N5M1pl<7Bu=k*2t!RYFLXy_k8`c>fB$6{}u;eTR(-C*}u1iG3uUn{J- zLH!=}eZW`Vn{Ihpf2X1UkI?7!wdtRCeBGd)Li$5UH|v{f*!w2h>o36boGt#}ZlvFX z^sV5fJ=nh9{lyLH7pOniKQNCs?|S|Q^&--D`|_VM?0*gEe*=DkQ+{H5<=gG$9gmu? zaqFM279sx+jr{a)g4_OD|8YZq3iN*h{qaV9z44c?-bZ`=0_iedXfFl4rhN57r2p1e zo;RQ7t8GXRqWqv?zsbno2YWnT&GfxSdKuEEA>C|m?|8~r{{#Mi&X?c2p3PU!B7Lrr zp4gr@+U?ma)xnhn>*rmsYJRaV-J9QadcToA8};>Qy80^0zaQnNK*;e_0lo@6)yQXo zuLX}{ZT^=?__D$O0DQB-Zv?;I;Cqm<9elczKe7BmmB`QV@iW!$owja7ey-)gu`k3v zVO%pQ8yna1_^B_QzLIqMWwtL`qWe_NUFVT+JdTPYUg$YQ`@eSbQ$&89&;Fk?!6BwU z!G;9!o@P9b@)|azLrmv55h8!wDer2OGamPEvd$9k*~a52-|j2#$BsYG*y$m~IBX%> z`>j(xW#mfd*1j|1BS1=JV$toc!nUJ091c|I6Xe z*?g8l7>7%=f4`HT=j8F~GpgE2rQ74xXVsUS@-!b-W1adewEewSt#bH5o6k|BeD)u4 z^3S*JO;NeN_Ib(4&tqmh&eyjK554g?OU?4>JMP+E(tpNxlYVWNe}g*XBk`I;Fvo&mnhQB61Y)sc%hR;CrhGDV zWZjZ!#LfU@xuJBePb_xIfg>5%f!KyYo~S^Juu0xpV984?c^iNuW3dBq&XT;mUXi@r zz>=3(@;(Y2;Ykg|`y0u-li2b3X<*4qEP0=!P6#{Di`XRZ3E+HQNP%9%CYaaPg5Lv{ z_9PaYyrzygdD*O?(YmdOMJGs|E077qc|>eZ1`auWK`i<_Pm4`n^9OlT1DXSzImyGK z&*wr}j+|KJy#EblU?`|GZ$6F+(i&X97pA#SX+dQu>!zbmjreS{(NR=jUJt z;`1@VO~64OWT3BLld_1#&PHG<>nUK#+i&27z>=3(@-6|E^)y(P=n#v}I_mHO8^m&h z&IQxDpFt7C zdoGc$rM%b{+xHG4=P@3crR4_={o@Aabwq?G5D<^Y;GG)to-0_QaZ-|pGk`-;Ehm$b7A{jyhLp9b(aG2NvHR z1(r1{wgE>RpC30c&yV>FumkPFCV2-8dEJsc(@<)I(d60pKMZN(z%aId{ycby3i`Yu+tZ~7<$am_v9az>$c$_-RumkmD z3uWr|Ar_lY0|%?I13iOH@JqlUzRU?C7X3rOks3;sI*Ltf5{u4B;QSbNpf|CJ4zcLi z^Mh0FyO2w{=Yb=&*nvL6CUQ<&k>$47UJoa8g@?r^FF~>#IkCvc1BW<~gNQ}W=7_A+ zcI*jxp9mLn$?c_Xm21F^{00!tkqHt;53 z8LPyi|0uAGRbr8EqrNjHiADYx^&L5}$ahlT8I!~!{}%NfIkCuhQQsMp#3JYQn2c3o zkq-a|o$;B6W(uy>ZN<}SkOvLuc5InzY-nT2TMSW_BPSL)r|--r>_EgKp97rb$caVH zIU$n|??A*NpAVen$caV13^>?=9f(6P;$U`pq?J-V=LFj{ZpV-GDY4ku2pr^r4(i1w z_%UKm44`je3qE8+Jx{LFcrWD+9stfKBke{kb}E4LcVY)xfDNw}*~DpG@~#Ayyu^~1V_Wia+y%XCV*%mA3N|algi|0OvdQgAj$Tg8)P<_9p>H_E4&y8w9_j zaUp&pPit%+o1APwrP%Tv%;Qn;CG8I|r@oiW|E|UypOI%YF2GOldm3{b2A|cK=ZN5Q z8qdH_=HGf){HJeOj+|KJw^M(=)+ZKuF>sb6Cl>i4U>R@3BCny`nIDKnz6v<mN}MK&uizz~cWq2L2E@^S@vRA{PDM0B1RJVv#Ehaj{P<@-$$v&+B%a*@jN8feV2%2W@plEc(2j&vN9%BIkTA{t%121Xz6F+#+}(aKvfb<-n4cSn_f{ z5&dQZw-Y;gyMXhDw4a<$GTDJ3b8dMQ@+?PAEcUkpOS!}%e+pR2?KkiMaK2OSGr*ZY z)MXJ%-sga`967Pbp9c;OYyB62Ghg+v=)BClj+|KJ!_?2^KMySSKQyrYjOa(&KL0-&x&etG zV#&+@kp&NEoqK`vo#Xl%h=Tv1<=Oa=dmLiPn+q)WIK(37+?#(4J5U5$=0Dod#-cL~ zqAW*FEOL7ucJ7;qMb5cb$|4qdF|f1=vB>8G2ajV1T8K^X5@5LpBo_T;z;X{rEb^7W zk^hDrh;wr02^(JcEX9#GB3bgT1s30kMcxf8{%kTZ=V9@USo9wQ7T<_P{w?6hKVb*z z$Ck+n64Z}PbU0UMIdWo=KLaej5sUm~VDW9xz#NX^8?orKo5eR`k)HyN{CDg?r?F*H z03sHh*MYMfIkCvk0gG?MB0mo-zI|xm-vf(p#G;>s;V!-ri##1T@?$81I9F%VDF=&A zka-IAnADJ78CGTWlnXiaNJ{36se_#jVJehfhNMq3{0H1Y+Qhm)V@P0N_dBDN5*nt*c6TBE$+MHPQmjX+h6N`K~aD)dai1TFT|FofvMW+Fx zEJsc(@>XE+jacMez~awF18)Tu--tzjJFxghEb^y-BX3~``WCj#pV`pHqO%L4EJsc( z@&RD+jacL_0gG?182B)-_(m-HM}fsRVv(N&j=YT>=oGfhpWD#JqQk>G%aId{{0y-8 zMlAC8fW^1>4g6bR@r_vY6~?ppMlA9);K(~r1aY3s{Dp@_=W^zC44nC|9+t97AkT8-#3HW%7T<_Pz64l&TV~*u zz|wBSqTc{4?M5u}R^Z6H+8@r7nZNR|=se84j+|KJ8-T?(Vv%nH7T+E-@V9`)H)7G> z1uVW1i`;P4*LX z>Q_{8h3rcjVr`mRs#{vBtD0I`s<3o-^=cODUn!jJxU$(?s5`+Qyk=a**Nm%H)-^QY zm0GG};cwA#m(m__8Sk3+Zq}!S_WOcV8w6OvYT?Le$&mSF19SVYs~e? zt%0lW-#M)Y_S6p1n_R&+5)=yZ% z-5!W7bq}`HHOA`n^6*AK=(z_A|5w$wRIROUs83k%U51r2+^TBpT4HYN$MkCOv``Sc z*kbTAZk3hZi(FLbqUkPj!Hiqn3@$2k(R3HNV8+dE1{W2&Xu6ABFvDG-zQ{#|E}HHl z7tC-MvM+K`p^K)w$OSXJ1@B#iH}IWh@u$1U1Mb53MJ_6I(R3HNV1~PZevyj`U4$3= zow5MzFJ(Au>=#tDJXGHrTUmhR`WxyJPi4}_7@92wH*q0;do}+VE-G?Sp^K(_2qpOz z^0)KfG|jc-q9PX+x@bDlw6Jp$|Ky)_0sSteXr97N-QZ=y;d;PxzWyKfE#Q-}F^$(OKk(Vx1z9#WA+h(o&)#ogkJmG_ zhbp@E>X5cb9=|2JaRmP!g`R2e6zn|?J=z;% z*gJy!roALIE}sJn3H%}SOnVKuz;1W!jWz5|^4YrvjeD;c!>`y2`Ru)m0XPTg^luzC zmc{Y%-;lxdZ!PRS1G$jcI|^X>hsnu~jitR1HnCR>Y}(7lMRgNoLSpZ85SaF+;RawK zWVAQYNuz&zu$lI@!QQ(RI3)J^!JGEFVDBlk0qtGsq|x51*i3tmq+|R+CM5O-Au#P> z$r-nQuX568kGJNgy(SE%bC3y%y|*AR?Y)Qw;Qv49UzU?bdzFxx_7*^hqFoYu^Pyzg zYyG^}zn_6N(`fI0Y^FUdbZ4hQY?IjgqHkPny@=i@7&h%~hu%U891?pe&@=se8UFF! zp7p&JoA_7jv-b`Tp1~39Rr%~q{xf|X(O!;WkKZL>cA0md#=$cmypZ_U0zK2e;#uB& zIt9w&-}65IK7zf)Vhq1x?{9qm^~0Ww=j#l6Gkx|J;O3IwW)KoM-DmH8*t;5Y2kU!1 zHYD5q`)yx+pBb;;?eW{=vA{gVPD1c5&)yA?iM`hW%=X(k0Wlcj6!ZlC7<#5X#`eDG z_=i)8Ywvox(#kp~U*$XxMug^AqhAVk2$9!M#bG0?#yV z6CFKC%E&~0As1pc(LR@U?SFNJ1O|xW;RasN| z7}hC{t8?*ecYRK4Xycrr6s|72AZ0k3zSoAidxi68L07Ele&n#C`qx_zJ+B-3m+dZYMcuqL zkFB9&B^9rR;+ZP1w=W%Qi@vwY>WpTnP~d8mwg=t>w54);UDfo!dkf;7f8t8m*|4Ek zPR>14K6pphZ9NCOLSMU5b(DSs{rB^B^yW}SSx);7H3wfEIBK>R)|s={vs|aYnUYjy zucbUL^?3F%Su1nVp~Zt-d(}F$f0I?#xwqU({%*NS-n~gB?>(xLzmsk)FzP+f#kDjk z$?ksL?H9_5Qg%3U@k;BWjgw6a)Xm+Vw_V%t>jp>AJ&>|n#RgMU=fEZ__lek6jG2C` zjQPu54=!HT(d}IQd7vwCrQdDkNpra(ZQ@FjYzwY_97-?#n5&Avvgz5b1A!NcV`n~4 zGkf;;6a^}0r47Dhtg)JgwXSy*^XnH}VK!s%ug3;{A5YK5D(c=kta+PQ=P{*}N`0|v zIb@W~>pt3T-6e8L7wufUBX6hGzjzZ?0NjLC!=1J9x%%bB{bv8!{aBWaKJ46^ZUs_* zcZJ#Vd3N6=Bju|Ja@}_0N=;q*(YXh9usU$=_M*|du}XU20*$;UFMOjz zemFJRBzAGiP2m0h@cxb@`u=o({r&plhvdg4n@v(5u_wHftmx;R^HgO@vf`&Q*EHH| zJKhOFDg=!DL zHaa0obwg!ieXE`Eo`pzFQ}}XZYuy)`=QpoeTaRaEc2XVJi=2h;Mb@>nDE&}*p1oov za^Q0yYmmoHu1pC!k~`Pb)k3;lBe#Pr})v&`s#)jDBPf$TI$+r*EFtQ4Q`fNQHQU6+SN9VM^x<^INNyV zn$=Bf8oBi4sBO7Dedi;!)>W$HPONg$(!^TSFAv8WsvB2?u^?s(mZ%IDPAk9%7{gOn zwzf94+;-!QSk!W5TMa)}dSjhrxsl(^%x`L5v#KuES^$kOlJa%Vs={f7H%+^x@K(J1 zj)w%w{*QvPCIhAf1I=rT3hN7-rdO>lY?@XT-@k8+@YvWw!pXo34598eQ`r z`qJO`@rMmQ(f%mg{w_CN^Sr0fr1^ef@l+`>|7bgZhFf3Fd;V#Dk}rLNkN4VJ>u+?+ z(|o3(pJj|cK1DjmYk%mYS?%%jw_rGTa(?A_Y6p)?eEa-E{tMtIfERtP#W4vy=Rv0b z3ic-(`iH^i8v1_)J`X&f4^e*|cs!0~UY(C(3&O{FP4n%ivpqMW4^`9y0VB!T&jU)|vJ%hoQd&=J|;{ z*Ct_q3;#{<`@l3!heGtz6obG+lnPM;3&zk#JanP6f3NPYM$F92Tj zp9at4Tl%L1{5V6O&mH*cu-N+zGV=8YrYD(Uxv{~UN;uh9SNz|RFQ z?e!t-F9Hv-ot`+p$Erj==;Oz$oybS(hYhZsLt8>DljBr~{8V51?I>S}>GYMvG0C-d z40XE>hwN1JClbcvNb}}CUB?ukJ+7N2MEk$;@uwaBMWk_Uo^zs%U+Pym{4~3~(RK`w zs4%_NXYY2%LicM8;vx<0V=lBrGv$W-Vc-Zm3-lFiLFYoO3pmqxKt?QfI5%;3^>R^2Vx9HhzB)@SakLRM>z06&tQx2AOJm!E#J9-d|BJNFz_khd>+go9*05a!jH$G;J1j`xS-!)6FW(0YgzXu6*%7+T#U;S zIsbPd^6|jZ7sOI8j=|7U+q^v%4|MQ0VT*jWo4s>2RMEIN+>iye+Jv15+6$Ef4@vx_>89b&OFK%Fe?K+j_n z{a1+j;2v}cTmIEHRLAfmWf6;=)4-DV9Ce(sh(+g@)N#r>4=iiK(8VA-1eA+SFxy}H zg;?yA8ah0T#UEnPS#IbwQOEIzSacqy&S$X$@%Rm`uwlZnycMEgSj%_fC*Se&TL$JZ zm33nxz@d8VK*UnkOki0zrUY1gCKjD})R}@E=w58%GqLC_0}is0K+V`>tr*rN#DN1M z7X1ytqQ4zjd?OYe)FjPgP)UrFp#zKM8-majA9 z?Zo^iIcOs`ivtR@6`OUl4b|hsbPCju&AOFH-y@0qIq=qPw%A@f%le$ggOuN{@eyK2 zeu9`6v7pzmNx5f;@4yc94mJz_Un0GS%_=6+>q}U(H0H&FHCtm|V_A1<%0*O#aT_c|;P|+V%XoMb#Ber2D9I$nb z9TxRTMKmIG3OaU#N@9hy3kaWE17B9IuBvyx7&4MxbM-@2HEqk6V&TKntqRk7weJn$MJhAY8bOY53uGlEvadOl@bSCJdA zb;)S1A~#Iyk}+KWpNQQ0&k4Yq;f7fKXM|m;NRqyf)H98~cD*h|ILtu~)c2m=|Nos+ zkE;kXHf_hAd7M+Iecj7BPDu3lJb}d&I|=Q$r{I0y1n|k&n3jR<^I8!sE z-v0=uL2laX!hHs(f7%OR6MHWMoA$ye(|Z=>+55herx?GaW3b0(gtW(7GqHC9GSglJ z&cDbE4oQ9g0ZOKSQ$tD(LWlNvODFdD+{U!Wbyit7A+fg*0@L0*u*Y}FXpem*_GSSy zyX2dI#-Pta)FbhfZrbZbuuwlT(H?J?#NNNcA7*zhNz_~DnEMQSgxq+U!ry7wNS{v| z`TzR8P@DEv|Psh;yo}`mWr;<)59ZNc%bV7eQ6#x0Wo8PA`8O!g} z_66FgnIKI5*wupIw>un$*o}UF++PkD>LpLvt`aH$OEjEml8@HPBkU?c53&}e!z%_yiK8a;H8)vP^=wt zrkQ%y5b7rNL7N~wBOx7S@;l0&-|WFXXRZE{;USe5bnLiN4XP>yr8XUVPg)y&GR4Mqc9^%4au} z@QcS!;JeBD@D=G$_mAv|1F4I3Hq_mNJ~Uf3tvG2o*2HhU!|F5pl5(E@K~iW_S+cgh zH@?7)xZoFdE3KSoMkQJOX~msW($#^K7Z4>djbB5CAEwppXhw0tjV^bE9a} zrE&eWVt&Kh-=c17c4f!C2$_K%e1CgiiP~6_g0D@--kWTN(2i)$QG53F;oILyN17bJ z&Gt(vE{qOrZ^D+YJ&1Xlgv#~Rit)f>adtdO5 z@7Z@?J$kvnqikM0vBs<|=As^a!~6-W|1=^TZhbKI&FnXFUoU@c-suIW7M)ytV(Iak zW6O^w9r@LL&yKQ&p6%@zD%_mcGshjXF`U7R;tf`E^n*YAjy|j53`EotKS|6W#b2^@DYDQ}3l#0~O+}_lpP0TCb!7Uh^d1z7m zPO&w#7~h&+(CyjKZP;cV=)!lepTvBv78~uNQ+KEd757$L zJwJJBNmA$3uB3{EJ-vBP77S9;i4T}iLlt%HE?&GtEbnsXb5jewoY7M}@YM24jQ@Pn?C4!(^TPMyU8gXCPe z_yDTjg^6x+cg)a;XApl>h6QzN*L=CIHq6)S5PuRwNiFtQTXhhN^W9Z=6K;kkk{Jp@ zf8h2fIfF+IjWFHTf;TyJjnw}I(IvQ6$GKW)r1%p4|Ci67H6`2s4|X2eLZtbnlI-x$ z`uM#*-n+-s`A_)Lm%29>Iz3HpJRJMyefo2J>9_d!Wj?;a$MadECSBe^AAgI_AMg7Y z$?pGm7a&g(u3Fe$-v4;DJ+7-H_V0Jld-&zIJ*nShq?14BC=4a4L-it;1kQc@Y}8|ufT0DU4QSMTl3DNTUgb+_sl@^{NIHp&3pZ= zdHx^NOg|^AW3Swop6BCB4L-3xy8Vy2_B4Oo#~<|Zr9R&CN9W(_OMlnk6U!fC_gAZ% zu6eJ&H1FBd{2ZVDDuaIz{Xyct6)i*~ECo+|rNgtob^~kD_PqAhJpTt|rt^P1!YBGa zR#n0t#}nU=VtKUhy*n~iRe34$Xa~l4;hWu^dHyJ$RN&XJJ_&*i=De!ni zW9xqw{Lg_|rj)nJ^-ssEyl(J}54jS&l)nNzmqFtp#r)^pV+(={`0>8<3HEa=YQBYh zjQ{w+$RC89&&Y(xyRHC}FYxKV;qc!=8sk5_V^Qn>i(!EI&-?gq`s{tp$3NuLzsi?> zz{m6Xmk`UV@TJRKemT+@kMe@g{^uk!ewqKTeCaaRF~*GFa$?^LQGd`^-mSj;Jr2JX zdi=K2oj&~^iZT4s9{-;vME>7|!7q8vm3;0dXX|_!6$;Be61!N0As8VzILnI1<$MYpCP+Lo7O+C&Zs- z;2@q$llVVK(I*!DZbP4OR}#-eEINE{EHN}sQ^zTnSahBTmU4%wTp1Th(+hOhE6Ju4bdSM9ex)?zW2lUV!_$O_+J8v^HhkFx`QR} zOvvT?Ot%5&JNmPkmnRv}Jm#I`VadCQc|%&xbA-gcETg{DZp5O`SW0QPN2udmJQ0gd zH?Y|31(x`j?bLUI*@#8|De7lxA9fk~dnwP-@@If0FR|o(-q3lGI*!l8qH`End_F;) zW!fgO=)49jK6Cz;W9=NUov_$k!VB#3FwLI7nwfUDzZqvFJPs9JvNN z5T{g`ONm8i60pR$; z3|NjeV)21jj-S8+(3s{7Hvg{A8?;d~0eFu$-re#r|aKJO4!D^>*+&ZGR4M zK05(4-@v^7l5bG4YeUPaf%hA*iA}l^VW)v+U<*149EVazV$tX6BytmWpjFsJhgfu) zfkkHnbyi>pA{L!Z!14_$d+a$jABS9Q5{rI6u-F^`mTzeB92&V9JJ5b?K~@5E6kC3w z4ef7w3I4SqXFEi0)jHV*&I6WsGGg(8=7Jo^pb~5m=fbOk*oh^Y4;)&B9f(-+E(H!P zq*Q-*P2?-V%QvDLfF&=n=xhVdyaPKBvB){*vmCiO{&zy2>BKD&i~hH$@5qTo{ycE# z%h-X4Mb7K$$Sg{gI*d*HCl;OKz>(S5flgx+|A|HCOnch#iPn^fv*E&Z7qAv5+|j zI}owxvrn@ex!J#mAQyj#MgIh_*gs|94}mkCxHMwXXWwNxa$=FEvA>-5Bo;aEZN)zC zNd$9#%VeX1h(&)YaF!z{7I`7C*e4cwF|gPyG4Mj*%(>b=vFP6moaM-gMb7Kk%nGe< zUehk8z9T0VeLmxgu){%XfyFms(Rl<|eA{5)?bKhR^Ad|buX{zm-@t>^ciNU%^p6-i zyuOvZuK~+<;COwT`2}5;d9C{<DLQY7IXC=LfV<|~C$Gu&$F8+D7SB$c$0znA@md&bFc|_&JvQ+Yk~mef z_Vug-?H^1DHZ6jZUysigg#>;PN+}Q)I|(btqg)8C0MFu?mVxawGMM%zA(7WtLSpZq z08D#)K%9n*w8zI@Vy_?Aw098pE{9A=>^%vAX)kS(e$SKkE_2f8Up9=H_V~Wx0ty@w zd!K>Kv=@fG=OCj!KH?JpDuGRVSHSuA99#Smdz`vWdnc|^_H!uO8||dgzg5U!+Dk~Re`)82cTN}X~18v|wWuM;xUUKowRXO}_(c`i2XowyqP0RjCRi%sl3jP{~E zUjLIGLu2Gq;1D6V4(E58BmZIg$T5Wf2xaOEUB|{SNYX|Fpy(z^qTY?d;Mdhdh0GX2 z9v>vugCu&45t6!7elP6t*(lQ&Vq<-S*zBn&*4+AOV+f0;&n(od1buQ0;UH?m@@8OT z3}F;pM=4`CB!cNP4|X5lb!_j^qeqS(J~@2)(CdRs->i9K`Rl8f6l5T_aC67d9X&7g z9Nbj6X<+jl#1p>RmD|<1yJTX=;E@VMYV}(sZ+0Obj`4*PzkxD--fqViPO#$(CwlRP zos&x@+Odfzla3@EMV#WHq~WB)9fONcEjWE3FxQ$IYzi{cNNiX`h!x8Syp!wxC*SI~ zeHzTkOPLUBZ?(LXn)rvs%S%p|l$ISV%PoJbJaz8*`)ih*TrvgmEZLQXi}Q9K2&|gb zI~;3IM|@+TT*}Bhb!6BY+FJ6uTSiWQiIu&$u(G$LC@_E+r@T`Ih&Dv@Vn$${)t}R! zqH^}uS{sjvw8FkS zUc};P;_Q{b!2DY=LytkvICfyV4WA%&vTAcw}q)D?5g= zwY|#{?Y&#V)qHYx@6LE;IMh9yk!W#OW%Ayxj3X6a-x6B;vp@7yvR1U<Az1LX;#kTi(=H3N+=l#C* zu5bP9wSUjI)|xN*K85=gyl)-)U>N_(7v{xekwcrnoT}SexW>B_Vyvj zV@T5v(}!;8U|su?KCZ5+PW1l_H}_@u{=$W=;o$th^Zprs+K=mACv6ZOFyEci%`cC6 zeD=sprTCp+ zpGU!{1D@BzcxeCRHgPTPs?7THSu|QX>(5a_!(Pa?r;eEI4^9vJnu7~_OPV=5Uh{;e z!l3gMo~%3XALLw*zu`fH9Q3b&!9~~OWhb1G;XH-EotS{Py~RI!0zC^4EL<1pN}5E^ z**UEzy(_QhtyA#*=wW*3;-T!Zwb6iJBdvRNL zyUf+;ohM$4;!eG2_x%mg($&p@K+i0A?#^jFX0;l;h423ne3(nCngcJFJ(?2u*ErtT z<&0q(KLz}9+r(2_rQ0{~?g_TPylP>#Z*qA{W@dZfOdtk4GL|)e&E3QHox^qKn=d)b zX2nCla<4FtE^JACcf+y`;p>Jv_YN&iy>kObYz*D+^fxnP$^FUYTQY~!CcMpy+dETQ zvL38_3U8a8Z3CTUvx^5Fh{i*B+Alkn@a!EARR=oCGRyr@B7vTRWsRr$pQ%u0`Ydej zY>uUEtO)d0Opk}2bJD7hRLJ>_^tUyh!sv)-UfHHH&gmJ%OrO2$Z(je*x^e5C!uj6W zn(D~&ROX$n|FZp`cl}e}KOX(nv6qhj!--#>{9k8&@!H?N@%&qVcc^{hi#NAF(>Ct@ zz4!0lP}r8=HNaVP`O?6>v+|3BABK8{2l+h75d<9T<=3Do)|T1%ZZN6419yXzfddAY z$=P!lZP4O$lnpMg@vi3>Y0`4gIhyc3(OiWZbS;}%9Q?z~{M=`7?e0uzyL4dL`sls5 zi?rbBFOkm{d$0`8er4g5=Z$;bjAOG7W4zADDL8(mFYR=K80j&*_W6!SmuyI%gXaoq zv&LAUEa`aZbzRQr%QsA(7>sQwd|}Sf+mF=sRd$58T<5d|_hsyIil58xiUjhvb0*ie zbV-X*aXYIpXT(q^fBO@N$rxzI1alb^52ZNCBRlXe+l1$RzdTI+VC~cmMfh zW&EQ$zHo9lB_oL0V?&Q)PSK13{xyhC*b83{Of8wYZ_wjWJY$}yYY+d$RX957PUFQNJ^XLqxpucWoPv_X7PHFA;dE|P+!FIpZPlto)MoZ6V;TWjOmbaP<+jebW ztp=jS2RTV6k_)Sb2B!wPWVe8*jZ5{&2Yj|$G&;K5Wm z>STqpXQJk4z%rRu{ zmm#!PW7))66%)H-u?-cyqc5LPjjO?{DFN&kq+{PZ^Y8>7pTj+G&n%23&HCkr;*)6k zly^V6BpA88cuQx>b06J1J8Mqwv`n?j7)6CbudHPFL`H* z_XX^+YG2#zy;mmhEDQVkGVl2g`b^OuE(`Q@L>qfL%6yHWWPEqycQ*fgj5mx3_|o>~ zz^Mz(42}7Yn+u!OXg;wQ==tZF-N9l!wKrXp;^f7;AI`&7y1=`ubIJxuG(OvOD6Gbu~n{#eM2=nK(~gL}7R9KhE^-1p?$mVY%HRR#lgatlTNNZu(mhpm827U z+%bm*82cr)WbO^of>`0^hf%8S=BOydtdF+F>P~j|7H?U9VD#nY8+P2O4KVEhT2Xr)qcmI#oZVrG-Ej+xU%^6@G5`PKqz1d*nN8^3IHK;55H(KKD5K8orH{ z#$sk~e!TP^j@y(}_*Mi?9yX@=H>5#pww#;3u=;p)`Rx6(3+8N{llrxDQx;YouPUFq zf9gP7Q%Y`wWn)Hm&NIFnXI_48s*~T93a|deuiS2L-&4FL@hnP<#+@zh=-z4m+2@UE z=Xg{@kM~=QaqkJnIBwWaX`Z(nX&lFl^5G!I*zzoE!svE9nK#@!jAQS^LAOO>Ey4WU zpP~gWG%9t;;krY7Q#k)hf_k{4S}!!VbmG*#Q#rnrUp+h9P>PJ?QF zR>@btyH|IjjK#fp-`LX`tbM%rK<6Ng*~bW9)pB_WBcfBHxN2=4ecp)Pys638rl6mH zKag2I%lHz3-!C>Kk8DS4;kgOlq=T`ZnDo~Cf^LkX5A@`ZSQ5z3ZO3=MjA(vdcfcL# zT)#yhxx}%+-biR1txc2h3qe6To~%dk%jV#nkH6Ix=voV{-ye$ctW)e=9UgYiw-)zF z!oM;$jeOoIz3wOYPSzFmXSole?d~4h7W+eW{M1ey<*I1m!Qw-syeEf}SlR?WiL`mo zshzl=nkx--Hz!{cbFeZ(=y@m5yS|L)d2L1Bx~543oThSoXKeVD^Roxy8}~b%=YBi5 zv-RBXUxS@tz^7c?*wa`Z zOr_K`3CE)0*Ule?22=hptPy8wWAD9J#6v&jxsX&lscBNG(^N*zcb%Vg#5ca^bp944 zSod3$;J0q7U@B9Y_qP7uw+ox6Zoru7=3h(>r#ngiRyk(My|V)c8V{sJJEFWoO^+VN z-(5~xnSX!9_o2u^TvZREzuXfDRjjXYXEvxX-_PRCcwCQ{2I37j1>zg;2&7eXfQ4&C zPgTVW6-|fmeFk-iH@xOt_nmlXQlRtPIn{!vPT+V1Q(J<_C3Y~-^xQ$%`3VM{G*^|@ zZblCbOz!`y0^fPn+;AU#^wFgs;FmQ{SbGEhxH2$h{ABFlXHWNcar{XL;C7{SL+XGJufEx7Jv9?E{Ckv>3PW)udH1#Jlz?&lH*H@y}86Wp$W&m zGA3c5sXNojjqcdj#PP5y1&6rmMHFSAtZT^|Kf53|7vocPxQHRDwRhDo#%$-GE>YsR zR=;E;i^klrlGV!Pa-l3!&HR;%vk?rYXx^ zG{3&Sw(c5qr7wQ*i*72q$X73_%{6ViD@J0Heb86ts1+@#Ne2O%6E7>g7?Bsq9 zEU4MDa5(fKbB{L~Wp&;Bc)YgWUAmI}ZBcQ5NB!dxO`nnr=d|2Wwcp5{@s$a=YgXpQ zZYlf9glj&vA)a!yQZpX|>sPN>QyXy&u3El4*IkBIThtBzaYgd$aS`N?FaJdtxQKFd z(GBre5nmPhr7-Xo!w^z`oLv1ks{c0VzyJ3QsElS_H4+Q;U6l*zzyG2ZDCAG10f9O1 zz!v=VL$Y(TZfLGIkc4k6iSa?_tN8YQ&`Y4?s3nV!6g}F=FSp{CTJi`v*qZ-@6@SW- zyDWK+CGWT7h-LpFOCD><3oN@U~Ho4#F1&NVK7gb`2vEK43|$d~G}?Li(%&b4m(1x7s6 z-)715EtLEd`_BNYKMl0xL9YD@uRWB^u@@>Rd5MVl#UNGZ1-Ct%@;ABZJB)aiui20X zLnaq)gC74$Bc6PYUr<5iS8kWblHV3O%ER>USn_C#@At<+R{aON>Cbw{bFlLxJpIgq zJ+r*oUi%JqRv^9}@t0v^{ii@)2h3-1%2|;A(vVN%m!zj4U#H{uKz`GZzYTdf$}8!o zqCOl84!2jYy^4+eS>J6&c`4s)#qY4GW8*H$Bb0^*wyFYW&*0AmkV_!5Nhz~^DuGqF)Rk`+ z5#?e0JWKY^$4jm9WLox=?AueaZ%@g-J-dEkrxImlVEqG_A@uVo566e#F71~8eY7_Z zz8oL7ze1%#*e%Z@5i$D(<9$DFC2uq055rz6>|F~T+b8jQH`Gm^;qjGxqai2qFLU|1 zUc8cdy;4ERH6o(deV6q?P{;3PH~m=p=VFY1(wY7 zM+Frh5fQVAB-Ss-!3RD!+>Qb#;jBoEzsk+ux2NPsJbOw$YRNp-DqQ8@M=u8-H52-4 zokSx)9?z|YJV;+FUWP6Sqlg&aXT($PvSgW`f@d}3cU$p?EcpdX_U{)e{W&B4K8^3e z-z3b|Li@QqS>2%c9N%loODy?_cl}d*jxjU&4_NYcOWtkC{`1OJ4*lR6Ud5J#y9mqo zEi1oQtn?gfuYxKM$B&tEk`?bi4=Mi3R{SNF9I<4M6Ep2|Y=J2+v}FJOr1JCUeNyrp z7XO$fzh%k2R(o*mEi?aHd9u1e*_XLbq(4Ze6=AbUQa$_U0;SkPP2NQ)%Q-5te}5Qh*;CKw{`FJI3qAXvwfO4!{AMp+$rCNvzn))XrN7oKALsi} zLCGDK%sD{Jc)$FLUvI_x&%-MITUNaPe5~Tzz4KeiuUaza5i#@USXWbi){@U!@+nJh zx9s`X7nT27EB>gJev}cOOOtoTOL{v+LS;y9l;=8ezSKZm>t za!kuDkbec4$CUB6L(atgh<%tc9CF;b@4{Ms2hX4U-XZT>e+!xS&yhNQ6J&R8MJ>;V z+=KXHEq@N@`+q=|_pN_}{qz(yR|NBW67o36JclX&1>_}=C4Dtyjvu{F$LB!)1?0(E zegpXp!^t&6%Rhy@2y&5@*F)X{d4iU|3i&wXN-Zb0|IJo=e$kSnmORn>&F&J|<2-x2 zjN{Au;9>9FR`45R5ssAv%7?7<|E0^vKb%)@s^+Wu!y6TC%fN2{S@^#55&D`0+Iz|>f1#D%RaX7~ zTE|CWm-FzQwaSxj*?-rvpKrylx9UIG%Ku+2xz^(UOxKTfVtu}(kDtijwd5aL`SV<1 z;5{Y_@5^g6KkCXuo#(WCmn&c9tkdnm^EC_ahvYHve9XdGwOZGgWy!?# zI;(wZt@z(qGS4ju%wx87e12)=_m+_Hm;9gU_EY`kGtO@ksDY{PjntRF~uPk4)1X?kK#sh^g{))aCod_Zouv2Oj34;h0_fz>x}LppM%B`_G5#C zn;V|RK3t*F5=+`Qfo1(selwQ35DN!45htSOOH2h0PgZt_g_8$dl!ZhHg~U4FD6rIv zSokc8%!9}0Sg9AWaBc^dIU#F+#byKfx~+(XzaBU;RF&ZY;LtFIw*nXO<0!%phF6=Sg5$|E8CG%oo7GZxA64@JDzVILwc#8cW(!P{|yFZ;?}_IK;x?d^IxP zAm^)*xi0xlSmseo!!=IyA>a@@FG9AV9}OIyibM#+VxQk0qzrrykhUTg&U9dz`*9vQ zY;Vc3cJA7XX>p2ODh0|(qwvwZd3$bv104#a&JBQ5gw}*V4FR}2SCMVl1j`IRJ z`UXub9Da`x4!?cKI-?(upR3Xm3m-q{dh;1(0Lwgt{2fF1#KO-bKVRA5JjBvJiG?#7 zSo-H!VCkRZsn1hsD}lo!d@N~akfZC!b*p8r!Wv*X?n{|g_a9Rs|YpN#1668Ujm%XLyv~O?nG6E4=#K)2zpC`aqCXBC(ZUH}nXB+5F<%N0Ud0x^Ri!1CwC??492si; z(IVb35z;`Fb|x175bCuZV$oj-EOQ>_0!tZ25MQrsy7v){$5CIR^y8UUw{4XA(Mr$T zu(bIws6sa>eJ=iFkN2^Zfv07T))R}Khd(?A#t?`_e=~4M&#ySqz*WF9FCww?LoD{6Hf%m?;3MSU zrpiMs{8tRlDFeR=oE^mufmrxwfpenRArOoHcfe8}V$r7~OR3`}24??}@(>H3-)w|G z*1$YfvM0bW0_KAgm3^+&YiADbku-GRS{hPpI|Ez&ClED8u6bQt^=Ql>-=Ng!E z<%Mrod~@EsGV13lJ+auS0`}%9C1;-EOgA|EKAc^q>PReUZwJoNdScNp1(rGzi~b&9 zDKo#p3VsMU5>xiK6Hik3F>)p=%x99&6ovUr5}K;;&xyaJa4&H7mwhbx9)dnc>xo5w z6j;hhEc%ncQnptO%x9Y-ea$%woIOM3MJ#FG0nX8SV$r+LLi##pJ_}{x{wwWYLi`nF zlg}{O)jk$GH$b1G^~9p*b57Ar#izeT_ADO@XCl*TJ+bJkfTbOXMNdB-X@?pEe~bM2 zs-F-Ge=V@or31LALY0C36WL$&vG6xRpQH7}qNhJa_N|IfEc$KaYdx{(cK}QIiADb; zu$2F41NRY^EBpMdDtoq%B`u$qaigSLGoV{#Jvt9k{4Um0<^P_H8~E{$tSRXg#s$_X10Kh(*ue zTctdQ4SbUPuPgh+!hg-+ybWA5O>yWqlzqF8h5sJ(Ia*IF`Xsz(OL>Szp9L)Cx!l0T z^OD^ z#G=0$I7jP=ML!WZdjWO`#G+?+&(V5f(X&~@3sip~7CkRXk%ibH@GuvB!-dWw{E_w~ z7JfZ&hzbNg{|jyaj?`j@@c%_y)n1^j?of4f+iI!8AKO;T6vu5VjT@kf@F5rBYHZod zU6?Qrd>&LeT2CzPUqC(&0s^t<3xRXAo>=t7z}a_Vhd?ZPzCz?^J+bJ^fFmohLvZ_y zzHi!nCd3LM@X{%m%@J8aEq=$r7Fz8>hpOx~K9;{Rcy6ZJzVhlH2iM`k%7CSuGBCRe3 zvo``aDSQL|6s=P@4S%xlQ2m)$(q;hXXg#s$S%z>Mb_m3xznSv=)T(Pvs6*j${J~IT zH&kICUaImUmbAA6M|c1c7Glf(jtgBZ9G((6T2Cx`cI(iCivKPAk#-;!&RXDz=CD{{ zb`S(&;cNzu=yEyK48nFT#Q#e26XlJr}xI_&35txK7z27X3uv$oCb$nw;f| zLo6J=rbd3CI7@&-bVNp2L4B7Cod)7Z72ZU=UEwa`zfyQVaA=3Zd@l>{^s(f1m>f1F z!YSg%6n@L#6AS+waHLytJ|O>bh2hlU6g{DE5^(5$D9qpGLc0~t0*?GhVSW>iX#FU1 zw0<=4|5O~lmx+EnaJU{BA`nY?%BjCo>4`;u8})231Y*%I0FLZ&)egTE7qR0YtRkNd z#u^L%9`b+esvW+6g;yyKv2eP{(dFm+mmGIu;qYB7vQOFJyOh~-CE5uJJ{5m;5RQPS`pH}z-U^(u@l2<4hoS!OAF7Y!8j{}zeOe}o9 zD@FcVaro{N;)#X8cb~}56pP26>C#l!{gjmYPcM$0(#G-!>IP!POW>N|` z`Wz<~PBHbmKM;$49B@RJ-+kB6*8%fggYOs82Z$x@BI*~bK1M8h_uWCa^IgzOyU~YK z&hb{_=T(_E0n4?QSnO;Aj_B)27cnn{2=4pE4uzkDzUUE!pCLY=@BsrK2afb9J>LaF zyoe(3c|P(Bg@*u#{$61|&leq4csljGz$46}UgO&g%s9EP5li_mq)#PZ|6WOK@+1Gi zRBBDdFh784ESy}(@;f83=nJX8Tk(lS&u0wL6N`Q#_1{u_V$n}C^u(f{W9W%RzW_M$ z5_SlSunArY9R3SspIG>7sIO3ZV$rWR_{5^;tu%BTJA|#+BrUOUx_~1uVux@!Hu;T= zSU9=Bk(aSU7=^9qA6@AFmJz;3mFEVigdYWtXif#NaEOI7-QZ*ZhyDpWgj{S=24dky zfQ2&}IPwa12;;F8{j&?5sDX2VL;r#uLJ79;y{eqVVv}h@r?5k)!WKI1LU)ZMDFbgC z!sn$k^skC@1b>7>EF3naaNZ#2K9w)AaNZ{8RqPPXVH185sA7{?`0lr5o$oN{L;vO` zb*?7=+t?ux3%>w3@|xm|0uKFJVLqQkURO9u{V9dr-zKzvI`#is>G|0-#DXL6H8u3_ z3cJrLZz{}NZ|FA)vnzxfutOl0@-&n4mg1}jF8U9JHv&h_D$Hja(QhUHKb8IwVm27U z4q~0x9^mkQDLt{|^)zrq=k*M**z6_05jzB8;r9Ux{|K<~Ujz=X#SVd3_^$v9|0J;R z&rtu4OLyJ?4xLe$&s0UH73MQl_+1~1%@3iE=r(bmsn{tH(vo0DWA`~qbFQZTluL0& z07o<~0G9Ib`6|pw{t<{JuN%n!t*dq>0*f6!Q%PF)8@SG^n)*|Uf2)D(41AY?`5Yzu z1_Q4*@NNU=!L;;wVku`KaO8cJZyElCK2X@b#@?suWnN=vk^cw9xs7~2up=zQCVmve zV!sYJ@;mGhR$-I0_W?^@>wzULv83g7Rnl%H|0C=Wet@m$_bzm{8+bQx$Wdk9Z|Dyg zcoeX-1F_`gUh9%n+8XF1DGDzF4r#msI6J8H#FBOmaE{g!i=O2V4N!cRS@IDSg|EgRDI2ly-D{vO|7h}46@MK56zROiQ$JYgd0Q2Im4QPnkA6=i7W>)2AwBpv zmzae@D8MGa84(MgeKnM+IP9NdlUO)BrV-8g7I2ZqS-_#NN;{04Aqw*x3Gs%2Fq&9% z#v8aCI5JdmDuIhGQ<&wEZvw?Qi zgTIY@o%RXh9L3*j=-ID?a~L?1tvG$aMY`^6{|FajL0~&XKBI8Nz$L&Tt-sO06M?0F z5=-6LK4Pbu{9I+zZ4-_8%qD4xCGAqC<-lNsI&7glg;x;kGPrG+uk>s~(XTadE3nvM z8)B+0?A7-W;qRhe+uQ>j8KF4O82Urh^MpW1!4{}@q3gdKh$#IK>WdVS{`11mS9hoY)epb-L1KcSE8CL z{S3U-#}XE7`@}*ns9iXJ_0o@9$ZeHg$gQS!!K$UmRF;0zE4vv-##;i+oz`itF|Cu= z3@+tQTK}zf>3pe_*W$WmF^Lo=4O)rAeKCu~;oxD3IJ@{<(QPg#(wQssK6zzdzIXwb zr*mV~OhmOl$+mMrA_|HBdet${wp$f+#JMZ67TerKwM*-3S9p;ZzkHo>0=Z|-vikEX z$mQAQ#uFnFdKVT>lCJ75Z)eo(JYK^3cj)4nd};0ie?>fK*bbQO3o~~)s5bu?_PhhA zPQ-YfS7om^yKCtgNzN;Rf5kw@uU%0$f2n80HO~V4_gZ?-tJ})jJ6G4%#cSs-U+9&2 znd)Qg2A=LytktJGfS1&50=Zu3Ijy7#r9ZnIT&w1C-n7J&Y`nUa>U=mq)<0Jg;`C8Z z(4kr`o0Dj%eB>mS(s+HryL>LM>!&pRuQ{lvgPV)#;N~W*Kj>O@bG{%&7x(;RZsl>d zm_7Eq(&|eOC)tt<|Hbezryi#pn_sgu!MtBw9uHm*+*#|+KPVT7a%<|xecXBD-TSO8 zq*u68i(zImqZFTP?o%d8SRFD!@Ro{{2FFoKAh;)ycLF6uEn8q70k=tcC|55|(2HTO z-{FR;C)jgFTxj`8EGY-upK#w_xq9)c+8VPA=jG*JwA_xvgB?#u;gw4FFQdQUBI}ZI zIYs}$YM6H~bN^NqLsLA~TL!b#LnR&>;~@`>^_I&l^-zh2#(2mBW4&cHOFdNLp)nrv zz*ukj%~B7Qcxa4=JTTT;FoWJVQ&)3 zVwNw0ME%v5zKf>41BN{u012t)9{a!?*RbQ-YR?$5qp`2y$x15RH3RKlYxn?0o=xPlCtxyUeiHX!Ymqu*dHx5~Tg^ zvHJ6#FRQguY3~YbYzy`mrZtbpE3kJtbP~kgbx@e?mofwW1v=Wx(Q&l*8T293-aD|z zd6OiFy=?GIdsVP^02dS5y9yiQXpd|5nD%DiV4-SW5PN&UGwo%}_K(MBz!rPIw(QNh zfW0%8y%C1J;fB5Mp>SsTYGALw>%mr#%<_#l?ByHw-m&^iJ?!oFYU`gL|6%o)YS@$h zJkqdtHyX$+-_=9Zw{Z=n;qOAGy{$NTdZCvf_WqY;FJrD6 zlSF$(*u>sHA%SV{R-7EusL(;|(NBbFqFO&>9_CB{kM=%?P3-a9H|_1Z0>8^aCqeA3 zgu=A<#C-M5jrPXqIMz1^l4&n58)HqOmmv0N%(OSU2EWPc@|A+jINGCMh-vS4u=lDM z!(Xwt+`68Y#r^BETq|ggpXq5&(w)M^B4pTOz6^)4nY^L{R(C4}E zI3Bh?-Z0#Mm@mIeGvtCd0%;{MjvIfMGs{<&mw4ZjdVB#q;wUzT`UPsNQW@}gY>Z>O zdA~0C zRjSjuGWNvSu~=#9jwsg>$?wK0B>ki=Y)?qf^|7}h<>VQ$rk#@mg%6hoe;Uny>~SaD z+=jJ#`>@i}cTwYCH(-{S;Hmey&Wy3{bvo7r!CGi((eq067)#R<%YWjhSl#XMBq>Rs zSL?uOtp6M1`qXWRl{^BcC$bz#gEwFml_bQaunb;ok6HRam$sU2Fle>Bc&lH>!08#W z-dOVElbz&UZBFr)l7|Zqhnt^IO-rkG%-UgPuGYzEovm$Y;dRfaRXP4jAZFdJn^Ta^ zm7d!MB$NxKjyof5Xo{M6<^>2sSCR!drjRr|1-PfL)@t`e*e!=u#l`2Ohy z)my7mXP=wAu=03i`IP-r3aYkNrA~eO>$T{K=Cx~Cb#V&UYiaD+i#5gz+e%x;s#V5M zFY;Elk@dr|T9Lc%?II_f))+`!_xlel#d}!$8xF7+!!P7YX|ah|16=xVVY8p(yl#=lY|wY?k~Rop=pK9QeuB~*~FECYXkeRu6MDwt~b{f zx)67ZgO#K=hf~{<%oT{tm7e4E+njxESc%(P9h)lzU&tO-j{NN8w5Ec#w5HEKpQctU z4yQh!ny|{Vtn+;Us~VlXF%V8^OYyHx?&{RePh--8fu6Ug*Hj;?o;Z8&?7TUf<|KXX z?I~RGX%UIYdD~n?_o%(SBlrME(%k$CVBc;JUCwwk7sjx3_ zCcNdG!*zPY@0Mc)oyOi7F==Tji`mXK<-Er13+|7W2LC$hugL7@dOmwb3@Z~K!5P|z z77tdWMbdnB;518h2EE!TLepYj%{5jF>W3GbR+js*tdT2k`N|AqX84<52S zj=N@%UP@y%7gym5L*!vqp0WO_Jn3fAKWTLxr?9o6^|ylq1MwRC-+y@t&MhK=YfIp< z)CkE=6CO-+y$4q%ulE>A-e}1oi{EF(KWWL@B?MY!PrGb+@+x_V*7161g%{so#Q$2` z9)dC?IRoADzh}g=J|#x^66+gu5@oDs27ZmU>0quo%J>wg!vKq~@;mC~H_#aaKHXXH z8iS|pOWpMN)T4vq(@#?cB_For-Ijbx=(>JSTk&sN@(fF^wB)mvO#fCDRC(Gh`J5pq zw$~uHe$PsBe3@l?Jz>c6Av27?#`c&7nK)0&5h)nw<41NmaUm_l#r9692 z8u8?>vE&ae`94dgZ>tJ}-S+a2w~|{8ei`gv3zP%J17cH7>@;FX;T0WuIe(B+wrFl?2NBtoUoK z`qWwZFSO!|tn?gnC4u&vE%{4YK7u&TUAaZb_)ETadvmpvIVXbz$_=_aKY$(1Rhehm z{~toeU-Ek`IoYzO-8Wqp`TUM6f$}NK{&q{Qu_V!@y$yHF73nhd?Zxw}G*&xf{-5FLNdGyD*kI zcLQCQW&TB8<0LO)v2!J`BxIUxKi0C77p(zGS4D^uM1C69Ae?r zlY`$s7G$*Fq@|?=w;!V&QB8mh$l46z0i{KrEac=51{NB0L};hY1OGV?+lo~HQ3!r?dxDNhEl%o)jXsA7{?_+x>^CcBjM ze`4V<7nuW+O%P@WM<5msK38LIIcnj5k4^MEzry;#gIM&%)PDs#1Y*(O036{>5P{!q z!__Wyv2e<%*Le|(evZK>7JVMD%rQ9;IGZ;u1Y+UPPL9@_Hfx}lzCkSfCBPy4hQM$S zHsKHprx{o{^!t`M_I^PAOzaSdg})0}I8OqLO=98j8AojP860Ba95Xm4fn^R$p37pB zSopsqhd=%yq_gkobCXy&S-`>>WpIdv!+V5qZU7Elt!zfg*Ed{Z;a8B)9|;kv$iGtI z>A*$!9fILDa)v9skeob)dH)OLE6nHgP_Du}uft#UvE;>PnFu=|!g}DMTo*bU$-mXd z!hgu%Z!`GY$;WSg48+3kHuz5%{N2FP4tou}pB$bj2nT?rY`lgDzmNEG#W_X3F8><_ ze#^iiP$LD3&r?V+O$eq5nLlzAaQJK3ArMPlMgwP4fj}(!vA{W6Pb_+#v)R{Rhd?a) z@xVD+Pb_*~BEz>~hd?ZPszQa-I?g<7+1C;&ESv?9bF`jV^oxMABiJDji+(9^j@A>4 z{vKc{1F`5^fn`q02gtbvI|O3kYy+0Lf`~=`7_iKpxtAQBmRLAEC9?GoI>e%9x6aXe zV$rj?WgZ}6(X*XpKE?3{=Cw=aq$C!8C9up%Ni6zmV6jgudbX|DXL}01i~M=mArK3H zJ+N>(49x3Zb_sR}#KLF0IENno-6w1JP4KOZ{;V&T6AEc`bN{0?xK z7jgt*;q!SW9Cy_YvFI~^We&~=IcyjNV&RMf&K|4u#G>brjU25f7CoaSOLE%l#QxS9Ayg?W9Gc{GW|eh0A3qe(1!_Zo=b;TecU-vumX z*kxc|$BKAiKzI^3`wKpnv`<5yqxHn1|2eSKomliofhDgO4g4ng_-&JcSorS%M|2rJ z04^G*ID8h8IX=zjq7>+5j!$B-!?`-7Jj9~s7*i=vu7NpbG`vvdMJ)WN!Knn6`BtX^ z%N(D?!k+=0^F?KcSo9oMD&-*-{UTr~Po05V$^VA3Lo9syaS8t+;+qub5#S=-Ph_x< zxXZ%lS2@b!Q>Grt^GA%+5o?~?y){6F14>rG1J@eJvvS49k9!fb?hn=dk7!x^4LGEK zgF_%zn%=l`Q5~@( zgm1Gb%Mi%;r;drM&866hp|y;V?{_6~>DcT(D;FB0QuZw-u__U?j#1<*?n zdv}6o+B*e%2SB1degYDEr-4m-ufPC*uaF?{6(~%5T`=@IxzO`dkl33HooVkZB94eL z{1tm;0H(e5c+cK}gtW&`NMeuAHm1F2(HQ)mC_&(AkW70KyoYx{L3{k{Blea6(4KzG zbmpXC)hQ};Amnz3{;MA+oCi_K1)9S@!g~UMSi-w(3?oQf004)iUZTkB&xeceai$L! z`!fUU!65ej3&y1G)Q?DaoCb7m#@~XC^+lI-J~!s`$|XzhM;nsDYCmr5ST|-&$+*!9 zeX37M&f@(va@X9nSy6ZCzw2FB73C_kFD4Z?w6OwxCe^4AS` zUI{iEI3+0h&R{fXd*EdBtZk@z3EMB$He~#AZ3FFycMd!?Jgo95=q+yUZZ7tGB7PZ* zpWW#!n^_zTbQQL)KhoJ!W_Txc&U|;mvJEWhCiwiUZTKaAXFue!Rk=gI$n?qesVU@?FO(a; zS7qT~S1|uOk0<4?dmJ7LZ%1p&j+ITEymxY5We^?+@a70gtxfNf8Apnn3){l!Uk=PT zm~<%VaDIBgY3vCH&kl%Bf6n<$_3o5FSKvTAnu;T~)bmH_ZjNI*sz6ucWNc-O33^^M z^h($_aEr_L{YH=idNOgOlcg3eciq@P_jgMN{4N>}4h)Lt%HZ@A{{{e?0oDV=o>5hj1X!QPNi2-rW|g4X4H$JJSP!z1wCTN=x&5 zSRB7=hT$(1=(;mDZA)mvA}7Q1NPrIw$~rJ6rQFxj9u1{+rkwkBOG;krF0Wkl9L#G$ zZmT|=URQmxdfM!t&n}+xgE^UK?}9_L_+_tEluha?z4Xi_Z%cS!EWpwv#`*m7+H1fF zw%0neSBu$Rjpc!^(shLsY;E5x(^m7hC2oL@X9Ge0sRGr#c5nfasUXXY2&nOWRk*tRIC z@F2XMQZe1AcRYSGd-p)LSRmF|dBv1tExVhK#Nr!wI_snHP;KDF=tj3kO0B!^X9-`3 zn*CR`E;Uzp)VD3rbrRe5 zwrMR*xjk9QsCCnb30cY41hSg0>B&qkY|LyboRFD(Z6LGh+Mdu%^d31fe>LdGPSW9u zv_iKxg;VbgJnEIVd)>03@6U|S`-xMM(AFc%8x4+e6a#_%`Nf$P`H{wo{K5w-@<$Dy zoL?|za{h=3lk@YwJUKsi{^b1PJ0~H265=Q2k9u@ce!-6?J<~Rh=TdXpm-F)i<@+|k zyEXU6lUiay&+jpCdj0eVW0{^z58NZw;nc?R&eRFzzSomFU(g1V(FT*z29wbSlhFnh zXoCv0K?T~N0&OrU8D(gSOqi5h6qwXh)KiXgta5F``e<8>-fep-!ofiKG4EQaj;7N2 z9<$x;ZqEdhXOPdPcGl*7={s=#(~5tLeLLaQ(dp-<$bh$FS7TMv$Uynws?yfj1fQW& zCL`vB>46RTxsR47mQa_aH6 z8-2+|jpa+cmg;U*oF%P+Nn*8d15!Q;1-xuuObEI1J zAOEh+Hd>YDr>0Na`sqii>(ky#>m1-j>8&~KKx28|darHi^@db4jQ*Eg&{*D7Froa+ zr2OI^$Myy11aPLIC-ubMv+hmFBYR?{!I=}-er6BezU|Z0W7g)v&4I2tI41BoObIT+ zo!)phDQ;_ur8=Fdxyjwl@v|>E15J$FQKbV zSCMr6Gn@l;)Xb~$VF~YX|NWin@O<4XFTKF@t2>0hen@r_<)9@Gu;esL9%#wwmORLk z2V3%`&S<=l=6MBDvV4x@h}FdMWx9O63#*W6#fRN^|6MI?#SgXQ%Ur&^=W&E5%fsJi zR8TU1A2H==B5MA0OI~QndklGyesSYFS^y*F66<$`^EDk`h?lt}jOa{^&vDClvu97q zQA_6US1PFZ%_71c>-Q~7#!G?@InKYQD!)Q0ANjdPJjY|s09)b{%XgJk-p{!C@pmc} zl&pUShDyn|Ni^ikksodMZ-2OJ@0`b1a+M|f$4AAVwc_8gJ{Wi2cO=qRQj9r;@J}x-Rb% zmb}Z7H(K&SOYS!0#Qd*u+av15U*r5C6>Dfi=BF2)pYK5CZzyy>p!_$G{b0)xE56wE zV<3M7Hu^1o!#g(W8_mPoUet{bIv?S$gb=_4ef+4Se3x!ZHZlDc|3SC4lGB{kBqAtz zp!28_wVdv}sO_=O(y#9&t30W?JSu*$Ge_GmbNRSFTjepoW3hZM>ikBy{7l#PO{?7U z(=NjrY+UpC9j|Yw`c=5GYDarJb-XIiQ0IAzucxMV4!ZU(bB0^>xn7r_7HN-usuCz) zVb$k5x-YBzu5i98Wc($cb6ZHD{G`zzC|{-1&@2X0p@>{0!tA;WQUd83Q{3Bq8YoyP!>a*Ljztd`u&shAot@s1pxvcVk)#A^w z>d(2(CAjt1`B%B+y~atk(vuUOqf!v_++tvRi~j|&=r1?)#G)Tz=!r#t1NC3W4uM$o zESC3s{zd3{{N#6CVzI+Ah@WFFa1jfO5WyDyh6`ORd^V@7H9Lfy#fn2L9A0n2{OF88 zEPB>U{PhZfg+nYHe#;gPp9{iEu|psh&NN`r6N}z$lR796h((_ZEdG53z@ad92*ucn zSa5{V*ksLSw+t*e0-xQ&^)5_U7pe>@StFU}xY(&8W}_m^!WO>Mg)Wxz+zyraxUqWS z6^cVFoHgX=vaKa&rQ#3^r=1-9Ho))*w(M*dx>z_}P~~VnvFINI4(qle7QNes`i5n; zVT63$&xwUU7Fhhb#se2=e>b*CSYNz}h0kX#@nyS}999&8SU7C%@HeSdKQf5^F3935 z$NEaU5esJ*u-M;2&PwbMh=ubsu=v^a66a%wa0Hv!Bo_X0V6l0I9Bq?WIB$@XhaJKP z*s@2s(8a>R4cE!hdScP10T+!_eEK0~vy&na3uhQ`j@A>4p4VA9j>MuL1ze=dlL}km zD_xTgv2ca~NASA`!+31rZ@KV1UsUl~n~rE%=a^lgh$k*W4L0#jBNqD$fyFnCSoG|6 zQf6Y&^Z1I*apdU!Ml76(z#*Qv2yR~*tuXtK=obKo?@@YUNz1%KW0anG$+0FD&RTMK z0YK=$CdZmsIGce(TIeFy4-MVGVv|_-Pm-g{e1M#l*dZLiCY-~-V)JES@wXxt&MUy; zZ$&KnSAnHHiADbwaFNdUZ3ACPzCPB(!sp=(v9S?&UT0tLLKh3?2B>nho>=rzU?~H! z=y{C7-^LDsSoA!!;@ibOBOJ5;EP+0BBX$TZZn%L+VX?#G716#whk!%8Q6L<{7H)K* zi-pg2ll2H+CufD?5DVvRa;G_Bk6GuhM3dqwNrjoe{v2SBYVVSU5M5qwSOd z7e$rLYVuh*1Y+UePW~5^eib=QJ{Asrgr)rSg9}ek9Ae>YC1;}2^S5f@5DSOD2TR$W zAxGDdSU3mCxkcGIM$Sqf3+EMb%9Q?fa&(!Ag>#l1-4673lV<~B;c)z8xLMgD7QO4s z7E}5{a_;f5a7v&T`}9YXHBfISU)PIR_^v;iZfE+V6-`n$*AQ#{w+wurf!7+CK5N47 z01okHh_DM-@+Fph_mHFQ_mZ*^mmYF6=LDPX7Jx8N7t8FI3JKR zQQ1jP_VXncP8P7VVF5YX4zX}XlcURjGdU}jO=98jnP2Qwle0!~h=s%PWAY3@EPAdx zC23p9X;Ep3g~K&>g~PRS!>x*AuABRF>enefv7|lBw7UGS7-@-x^A`2G?!=oX5+Xc~41 z?1DvKa-mu)kvDdPS=d4v*AQ1xtHyOnzDprXzC3J_Zv(L8ODvprV9A&FO=%Ni;XFdl zm$5_Gfvrf7A9~Ed8NlKDutOl0w8MZyU!m4y_}QTQh&@;suLWVG4RZ^ZBy+#d8&< zW^vv86?bz&>$*!AVv7WLxGMM3D?yBW()mC~{c0DhZG0yi4JMOHq7gxslt5+>r zjxKVy>uR}pL2cbCOaouL;^I=%J@eD1F?xoXRyvw{099?^RLi0*TJ{M%^n$rHs~0Xr zsl^I?JCzYTBC#KHRfbQlDoLJYZ$kJ_>eiU$n8)>#&GW?cx`CIGdszFA!pX=!J+y=qgrntZ|(^oC7#%mth?Uv*+HTk%)s-x@9ypk1jy z;p&2!*FVAIS{2lE#5PJpuWM-%UI0ISVtSnN%a*T6n9^JlC$=XKR=*R=_cu|z=b>+$ zzV1Bm7kB+zU9+S%uIGins1*7l>&^&&Q3>ch?z>-KRFY3YPw>RX^__yUb&UN_RM*?0E-0(j3#Gt!@ z@33Y_(gJ^PvUz+ikRZGXAf-SV)e*N2QGU$)S1plNVLb#&WxiyuBU3+dq~IOj~m3^FOb0G@i~e%BnWRg6eh0=a(}$vd!}D>H8M5r9e}+uT?YP< z@_h+BvwWP)qyq6g9+zTc9LsSOn`tiv!U*Ujh`r~bFzr>q9(lBvspDvm{nNC^Z*_c@ zmLT@XG3_mdy}O{Jy|9j>y}z{j%MXySzxLz%k7@5!*t=ZY1N7><66u*Y%gN9U;h=)< zUdmSoy=m_Q7>Pi~@?D0FaV$q05}5Y*KHXpW_`9rWZxoD3`S_Vz?9H_7@jaaW1ri{- zVY+263VYA$^6~div3HqeZwK1x5^aNj#9o$V?*kN0%6FAvZ-LdH_rjk3+~!&pdvn1v z>pKLM?6<>l@1eaCYz#+W zZa@e9)>(z^cE=S?uGXkFib3=l@~`NNZj87pb6_GioDN>fWN|f2lmWy z7rb9GNI8Ue0tZZv4db7Ny{4oQTyFd1!bkH_uPA|qD9Qgi}a7HvEEgC=dBd2uc6Hc%#(34U& zy{y7H*5do=EALzC3VdH$*T+9OmV)1GgK3PDdedX@_`^px?`zw^55uPzXN+TTy^1T` zQ4EP`_N}|o9mnwdXgK)1=Vdt9@W$R0LrKoY0-fny?+3a%)8}E|-5%)L)jq?^eO8M< zyJk)0vC4^4_D;#G;yjz5-Y5KEzoqD2=lg{JDK;`cW!uWqC!d?WaL(~LrSQb-|O~(aqyb1ozQ*A>>CB&d)+Z*)!$xs&v5@(u$A`5PHgVp%wx2q#UG7APj?(| zc)FV&$Vms}nEdfR$eFGW@+bKpC(Jr7+R8X?_z@g*&BwEY-J=5fm zwq(8&Nc@KyvDpIf4q|@ejrhd&y2OpI)M@xs{vh~FE9n#YA&Vb!$4}#tM*Fi4v)V7q zT9V2nSjq+tdCXdHs4dm;A^R>)*Lj5qzoj25%FSFz;y!Tkz zq<`p#cwlAVvu75LTCpps9iJ^vcx6@3n)hm%*=FI5LO$~-d4MxR+hcoX!L#|WGUe`R zZ<}sg6`$^K4i*WFZ`SE&L7#>Gd$UnL#s@9_|F-16waWXNw#Ph}zE{h9pUOgiz0TsN zCd7xFxVHa0@UrmlAsW(w_C{Fc^UoEP-@geNf61S2$ujpH)r`NwviFZx{qD8oTdnf{ zmnA=8$q!oj%lLq4&}X5)=swsJ{+71Y*&%7~#)TtKMl6 z^f#Ta&xT6obfg{ef#f?~M8AL0l_bIfB22_4zLAx{Vf`C1vE(%aSmtHCl^k78V&Ni4So^UMOWIAqA$~|g;CpFU`=}5LXBTiN3p<4U*uqgFg@yBT z$f2;Sc75JtUd9)p5}U-rKS{pM_YHEQ*dY)L=WSrI$?s#?L&(5&8dx}Kz&Tn^Ecy^| zSRW%|(O(HH`HlcC(q-Vco+5s*LMS%$V}ZjHl%CkL1C`8Gb|tXr3xUOlb1ZN+Kjt71 z3+D#l9IYo7eH2*AOe}iZzhGYMbO>%<`1T=K(zpBmXf+pB!>qLfmk?Ihz>!f(Kg{3|3+HNb_#qF$^%K)R zFvP+sA%_HV$omN+XeGa@fTuo zbKy_i-mlQ^kJEpg+scK0DtD(k^F3C~pRBcOgy(bcXLmi3%#7dM|L;0!pt2Wm(pcgB z&@P2CerMK)#A^uec(^~xf4uXBm^145$zB)8kX{!TnrP0j_2=@K&{h01dQ6-*J>A7Q zNa%umdIt$<=<|=8xDs82Q-jW3QeY97+7)&4S1n$n9K}AtNk^yl{TrlAt{cP0`$izG z?d%|_jl&HGm1~&w2w;JzpxIMaow?E=k zCFwDI)7c%U99mY(18FeXsK>hJX>higXvFnnC)C$^S*pCfO&C|{e$#QXc0n1sO1uIf*X?KtWDw)+pFD8)N+Bx;F0<| zRUe?t#NM*05VE)-G1B~eJD+!EcgIg(rCKgthdkPr*n>^%+bBA|&rd^Wg+JWnp7ZqL78N_Sm!#)E32;vv5 zNhwsENHSl`aL(`x*SH79N^$dmr-^ZfzO&}F`V0&s5Y1^@s6 literal 1870 zcmeHI!A{#i5FIz60-xYak(>)q(QF)(qy(W#6{5KyZdH$tv$2F*99z3fRJfE+=m+#C zD?Xr|u{~j9A;_%Hs69}Y|oz8TkvBS&^q-33;yxo za8Y3F=0ShZPQ$56=CKOnnNc@+mduP6Qe=~_9oOyH?O;J0+IX~c~hUaR3|4Zj9>;^+Z{zDZ3qL2p#)FF7*tcLQP?nFz#0YY;L^Q@lA4v&_U| zbn&^ZO(eg8C{9I0#;9a+ZDPID!&6`zNjeYgvas@gDu9l6-@=&kc=z=@KGQwSSzjUV zT~&|ohw5>RVX+p~q$}sz^n6N_Wz3!7GwdyAit+{w&~qMn-V@QkaNOabo@vnSZQ{VM zbFo(p;SIjHLqTO+ZwoP>2~k5NzEnBnIIsK!DyglYt@lSP-RHG+hl|iUFIZbb{%axO Z`Ty6_>RKv(XCx3b)<|7TyGT5yrN2+(#5e!| diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedcrypto.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedcrypto.a index 6dca7f91a0f58ba735fc22f76df365237f840db5..024bf3e58733a20817bcf964d971f7295c165bc6 100644 GIT binary patch literal 909936 zcmeFa2Urx>`}aLdFROxLZ;QRVV8fPx1$#rqE-bJVrK}4mSOFVgL(~XXK%>~PBw|az z7z4&`iZzy~QDed0<@w%Ic4uZ6li&0Iz1QCFFlZ)wLU{#$#$ zV~j%B$2MRT|2OZaA2N#nL%W5oj`_#k>o8;SpY9V27>ly@R25_KZ}!|CjKzO*zk8Ok z;CIW_!x*!Bj*hV`Yd`;xvHVZ=H&+?U|I%*Ny$kan@8N40tN(PL8^>7v@9sOS7_0we zf1SZt{a?0QXXG)qU&NHXj~L9@3VT)&WBYIRO9hOru;1Rt*!~B*o%JxL%)Lev#!kMs zEMe^a+q-rou?i<6{i+8^)#$LXs6fyR~ zzPblvFW>VS#$MPTq%rog-NCv)W3rbEXB?bAvo{^dIQ;+n|EJo(ab*|gU+v!}FpmFb z|Gfd@c=;FOem$RY{D)o1_%o8degdO3w||+-D9hT%+-8*WJ^C1<{M^3MiBbNid!8qw z{7?4dZy4o2?QgRf<^N0fa`B;z$-dNyDM$Mn#0mTMIHsJiA1h(X3H#5whyZO+On9`P zMjP!H78w@9hz-GdtyW@)i!qamj3z0gwJ{U5@qXIKK#2q19Hf<+$we7CL{Z{gVUaOf zeWWIwEjZ4ikJlN?E{Q}gNhH;jwfJcR10;pxtbqa2vT;@v!(7_n05^9J^AYCEQNd=< z7^9cCh}MP&`^9LZjTO@9!!%|aNMskc4x8RgB`LYIm&qdSJhGT+36WV=X;F;0B4jpG zljuk{zYuMVU${2XSZTo+qX{uJ21G@Ln_AJwrbcaKY=o&bLKkLg3&BV)pX!?b!oZJcb#l%3X` zPt$S80yb#}G9$e)%G4+I=RrjG@nE z<%ZN}lSBo^U|5023RflQ$5hGiQ^ZgE~x}jvCw~9XdvyP8)|# zfIT`YSlZ)4L~JC@1xb5^1j0{LP*~(-zo;N1KH=IAQIe#=Vd3F^dQD_dl<~Ss>CBkO z9hF4xQm|_$Ya>x5${Hdq51&GEV)L^1K2?&GHJX_iygfu485E|8^oxn|3yl(8 z2B{isl327e#-vHpvXS78j5VyeEVLLSO&GvNv145}{*4g<(sp4ZxRGuy3qJ?UH}eCqfTGEJet{KyAk-GcA~qzpO$L2INzjJ#k>D zHgKZfRINVB>=?s<Z2k)6J5p>4}@L}50~Er7_5?uoxy76#!Mb3zV|T1 zncjcMqQrMv@+j#&hCEhupJ9kHB}QN%!!tEDWWm>j6ZKN&9ivUdeprGIC5e7a>`M z;#-34abaYLZ%@VX{QQ>OzVh)wS}J}_SX87*57E7qUwBm1#8@4;g4;!TBSy#SbW!>k zaf{#rtBrs%HYOD;XgqyPn8tWD4`gE^q9)Vbzesv=_COt`sZlu?jZwkDlKzZgFMqg$ zktFAvGC~t*f?`pW`OXfcT;@BKjWRo+D8^7}c7c$*==8yU;^jRyznMuGqxTEa2ZYGL zBv_@>La?G0;9naQ7D&B^+oNbK(P*&VWGF_UI4RaJ^tj8UOOW{lkx{f(Rc18R8jB8) zAzD3Vw5bnyV+tqdGMc6*ccxZOV);$M$_w3EmX*NNZrZ9r@&#!!NZJyHHqtg{E%G#e zv<}TSH&#Vsj5q4!kD|C4OCgN$vJ*_vYK(XNlou|M$xs!eNwVlIGK)nL%x%bnJDnE* z5W6u(n9I?otQ>5FEQgteZYq%J@-AB*Q^6)Oi^UrGFwM^;UdK$|?qN@(2=DfrPgolZm+Tg|19;gWid+_8y zbnziS(!m7-N&wCxN>XUk#?b}_h57~JHZ&;8kdn3G_S8=&EdZA`Dnb_vWr;OeU_zdU z>ZrrorqnKJebx(FL(~$iNm2#YVy-FK2y<=EMo_QH+FsG7fw|mx77!L3|Czj80&zE>l$<)C!f0Y* zaqC$2sbwi;e%My~H*TZ}WnM7C#Gv9T#wtUYb(%2aI)M-+dg{lSWCLr0jwYX3qil3> zDdnTkVD-~Q(c(*Rls-aZRC(G!E&)qsQDrzQTUShQ+%H8%8ZVbZCay)xju&N*nIfKx zoOf|{bMZkK5YRj_G)Pa*OHAqrf*of#A`Y zgdXuqXknU!7XC%$#py9=B=-(fCa%L|T~9>?apfaIM@>Kj%rt`Uck%OOuEyj>HinFD zOd=#J??wkEX1XZQI*X)!VbP{Gu3TaXY^*dl$)wL*jIrFn;a009r{P?(na#vf$FOm1 zGD${?;=G!VW3x#wbyOUKN4`(Q*9b0_b84EC7Uj&N3ZsQxtHQIV$PRy{%!87sQ&5Mo0#F<8Ga7E?G$tVj_HX-&%?8Ws|Y zTb{|=i_=9LpOS<}MB%k39zT*XD2b7rii-)0pxG^C6%SP|o}2w;#}ifn zW87UB;YWHqD2x`f4b|nG$rLVC$b6X%c3Fv`JU&xiG!M%v!Kt)1(SEYiN6;dM*_BN; zMzku4V@W}992hQEj4)u-iEfX`Af4v0$ObdKaC`LjuMnECS}H1FpWeHS&&LnD%0tSY_vx7m|aK`sKqjFa9AKa_oJ{H5++*P7ZTx)lYQw7%RI)_5?Q37T?IRR z24JC$%WD#?n@BEA%zUmgVzq&E4^&pBGGaM1olSJZBP-=+(+F$tW{QiU{+U{cNFba~ zJ~srrZen1xo4cPb0FMsMoCmKl;y#mBza?)dQf~Ify^MIBRwic1z} zhMvtxVsIr2&_=tG@GCi!dLTRUxP&s| zh!Tjzn@%vtXf^tvs42#NqlF)O!bopeNKb{g3EbMKWom_<U&&H-85K(p!_o=k}O#**L_NyOUN$IhA6drVAsQ5+2#^9L= z*U8dMWv1muqA0O(!cf(WCo;WDp-jexFg-(9Bo)SZ0`{I?C@L4p4l(k>UW!mT)(dqw zUNEHv9ExKPxl5_xkRNS^V}6twj`?el;W&_cnq>4x20U028Q6Ox%0T!1#UQ8(8T#g>7v<8 z(pZ`e;#gyAuovvu2tz(`J>_x6Tr9oV^B8T^_~BaI_fz4FX5$bLyEZxyTO}^U5u6j@ zJ7u4*y*QPz7~;B!Q;5$}RvM!huGr%I#yCUa%}1M7L40ac$KqJCuEhzAjm+P52rmN} zCzfzKV&DO9;D;11vZ-nL2&|54^#pb-DvQkUD6@#BE1y*~EqRNeC`FFMV_8GrD-fq) z4P~Vel~tThZZ=eaeW``51Do8~SnMHHNS1<3c&&haOOr~>rsJwfuV~6l#$!>v*(_Wa zvGMGsj2`;2Vo(G|Sp<#2K#filNUxC4iDdCqw9m!!*RFtgy3=7>I~L!jiD2EZkJ>Rq z_4uA99w+0iFHJ1&pUj+v_d@3mWb^++B2uNFbz?3TRe|s_la0Hm8LJ>`0xp^W7XoQn zW`5){L~25?>K%c_UVLqUzBOh9z05Zq8WOYFDTAriFt+%&!KoAm8zq-q^d&K(29?-_ zHWV8T>WuvJ7k=Z#p3^MseYGe)2!jkSbF$CYX*B8Z)g`=>juk&eJ)LGG`%MJ zc|Vlqb3Sz1fA&FXKIem{N^~r~Hpr%9Yipd??4fad35UkEKo=SF(VQ}r+L%@-gTbPY z!t0OJf~o8ZA_N?oL`Y$85-laXNi@}- z8{)~k{!t0TbyNApZ8F90|?`Y z`bxCGK$DI0&0pJu5{u3%tBWYc^h(b=GuN}yBC^AWT^2WY^TN+;S`5}<4$%lB)bKZ6 z?BfC|hAf%+I}TYQ^2KA3d>ZlB#2}JItB7*`mIV)Re{zeSfKG8}cTVh)B5s4^Cc4}9{bpS08Wc(KTRo0Q^u5H*EzX|q4LQp%4J-FkW`&gn4dEgQ`Uqqb8jlHvM5@(OwlmI zyHV^i63Zz(M`3OBO#`egVJVFUIj!JuN|jyI!8(V`Ovs`4+DP{pqF7JV#IzcRRhx;@ znAk|YHU!V)KuLOT!KRkku&jlZNxV%Iqm5(Z4eMQ0Dq09)S8b`pk{FPe-mwSEIV}*S z*Rlog(}Tm0gTCEGP&2MbcT1l#Dj?8+t(cmK{ZLoR#>YH}SA^BC#PUzV8sF(L(dc{?HJ4 z;iB2cMt+ms+L=wm#g?6$buRE%TratEb7?r|=3tL;rj&(IKf77 zOf{0cBTNSK6CJNp#Nvxp7#CP6mYm%fLnDTrVv&&8=F-Tgqv5*5F6>C%8sfy6@J6|t z!7&|}DJ{(I?b?e|;joN!?rqISv~zP8JHVm&bZtD$IY9GA)0f$3I^zw60MYY9ag^+( z2Gc0NVDTSS65_du9IR!(Qo*#A|Dk2k-&r;nY~Q{uZ}xWx!1%<AfC;Sy z6K030g)Wo^D=S&Jdq2U3Z%^YNJ;O6txO-5#-!qu-6-|7<4{z>ZAPGjgjbdNsk2baV zMQROa6<&74Il_gM+(R|t9+G{^Bt#h=g~rB&8Pb!k;TEC{$qW{Doz#q3T2G?~yu1~L zGMULCy*rI2;*jDA3pA4!wKrp>n(gf?eO+( zxv}itv4dNCHmSeEte*Y76$%9-Yzk&PV?1J*UhADVrPC%!C|1z-Oks?h1W&H4WuGVtd1e znTjO%5WE}CvB;v)?aGZ_luOSlSm|Oh&z(^g&r>kU``!$r+@iE-S}oJg^J}jK`A038 z^OlN)Yt99yROc-%m}}0rEG-irE6)C*f~DB8-yz4X{o43W_?TY&CcCsWD>Ey@KFgj- zFLJrpL}`IKXQ}XG+|i9521>>oLDe1*3RIs*%_o-5w z{$od-uwp{X>1v{>B@xtWu|U@1Ip*O0KDIl)My<5=x!P@FtdxW7wmt zPh84`QU&5JRex4o@}@$`NA=sL`r;RHwshu>Y@4%xQ!S}qQhg(ORq(WteS3*iw z!7}Gn$r(*D8)bN8w$JFD>76k$(>JN;O}FFK?$)=kQ8DqZO`X%TN--=k0t*@DTxsde z(o$u;k5=O>LtQ7t#o4Cya_ZZ+n-!DSBdfQS&ciFMjZ>#i?v_kJn=B7Y&+clS`lVnx zOD1&>wGQ1i6(je?lq?K`81;lf@mBqUgTLK1VbFxQq@Qj$wi{7z?Sw%HHF3_c%e2a< zmg#~*Hc0kJX`551^u9lkPImat?ujeE$O=;;Vn!3K1X~J8w zVa(2Ohn5cF*^D_aR!7_$*VaJ$pVbW>sZ!&!p$raNr?Q$&b6Sg|1 zty1M!Ixt(E_gFe698zR$Q^BH2&dTkbwo0AbWQ(TABgfKmkEO+VOXilP;+dswfTfL( zrByde>&(Q=-Fi!9x@Eb9OlMuDN^e;n^V;3ALP8sbE?SkgQWZBcZKXPMQf6Voa_7OB zDkj(&L(#ufm9}1$HddXm&iO2ihny3(D)P3{d2=;s6V&NN)sig|5?$+Ml@^wk-rDfN ztF-iKX(@X6ZW9ZesZ7n>VrLKMEgIEaCv|dGvR!WVtYq~O>yeY<5_OxrZftehx-r)Q zrolVegI(-_|E3ibvx7ZI8Io(i#Vh5eYCi9wDJ2)@^%v*OGv+N)7e6g_Gn~02^7)JN z<%#p@jQNt)DXvKxC)IW*_13IhhoZ28t?Gp1UN=rUoj6vc#DVI#llo*K1$5NOnqHl5Cfdism+S$Vhdr1^{&2s%)}3 z-{N?3sYhawGsdz(oR@G+3LsuxqJF6YiMxWtOdDr)2eoJK*uK}!mtzvHDb8L{Un*34zVuLZ>t0?L z=cVsnF1@=lAvrdwyJJ?u%cSlOH{L8QUZz7VWDWszL#^Rz^_3$&cnq-h12iRqgNXmDj_m?||M`IJhy8J?PFJ4EA0@F@tc> z7t<;&m&^OeqNTDZvS6zk9eUg=j|bgWb=r?kDgx(7ufbsDWUo9Pk0;gsGueY^u=1oj z&Q&*g1;x!0&`Bu78zb?+tr@Oy#`eHXxX(~ z#t>s6Pg%4qpRm{~&j8TeNm-i=?L1Ol@2JW#Q`ux?zQw%Rr5By=Y0e4+v_OY}WX8_A zu~XFH#?D@AiG(T6DTQav3>A)KlA&_LczO?Y$8%>F^ZcU$f{P-Z&%i%A;0BmzaOA4D z+&s%uv&g+5S$*R;+p)#y2)H=S9#F4fz#dArqz{YQTz1qDV+lr+B3#o}JBQ%J(5RZXlkJhj-%& z$_OTMGfJH$a?(@XXX)8g-bFydd$n5X;EWo?6=y%J_7`Pepiap?i@_6#`-%*`f2KMs z*Xt}AYiEuF19g_QMXmOKDI|b?@}HpAdBk>le5*WzJGC2k)%SP%`vaH(-OD3qjtH1} zEHDdLU_R?^=g9(dFb7Om9+++fOfMdoLwI0ncwkNfFmLd{Q~{W!rE*}>eQUK2`BwFI zU9VkIWheut&SMxPgs8PTWi3z6w9jVKTj%V$eta-f<#r|In}j(|RYo#7yZ)HhpK0n< zrM|V&F2xOgQd}2Vx3tZ0TeS%du_}L$Ba^jFy=qTRKc;48@PT`|UXZ*N*DR7 z(Ct`>{-{&Hai>KVzCj;qDX9$BN9f+$rahyy#9@kCExQzF3Me|dCfO*{ZAi5yq^Qzu z$}^eHIW`rbLLot6Nl8qyu}inH7vde*ct>OWq$C@wbQ^0S-iD30HO6a_Y?yQ#g%EGS z##_D%HQNO5eXys{WruZ`=y zf1+A?xHj?fo%3AD-!GJwmVTB^fxK4%H$O1q^$WV3hIm@rKOHNszfumu+C9c$+u5- zOZ_U{p2;cnNZpFQ!CgX5VYSq)>3x}+$-()zjuuwiVUa)Nni6Xmz7yUm?a~pODb0|& zSxBAyG~LxH-;1f~nXn}>N8^;^>WpyOs>F1SbH+^yCMTvmO?HL6Nm$q}*EuWMiNR1- zBqS^?q25!c+(dJrQGA!b^sdAtxjLtugU8Im+^1W1=ifY#ebI}l?U{EXvG^%Iv)FSW zke0!oz%?zI+~VRWa=V&y>-}SCl?!%CyVR9A#U-dG^+@vkWlvD=ZiP*h_W46r)>I5| z;Kt`ZuGjVyR$Fz59il6j-D#9xtJ567sME^y;u6#!=R#9-%1q+AR@zXP?liiJtmcIno_RJ3NNqP1u$?oP6{O1BoKqBT1etwmEY zJIR_!w-%t3yAn96Ly$zGlLEX~cy$`d)I^T_-d%0f8LpE1a z#3g2ER#sDVwRP`VVTMJ`DK&!~dvr|nUH%+*E5c-idPLteb!}p$eAoCO$HqR2D)m_i zIs4vX1~}xpvgdThblYL&*rwTB43l&l8X-x&n3_phO`OQJZ>5jPil%nr=0)d&q4ASG z+B6-KYo&a<`2f#eOQ%dlALk@jmlTcCilv>hD8YR^Nr6rp759I_$UbE-LNqoNJY#=#+|C zoMI(zE`yLSBjD7yjEMik=Jq%3k~XSS6LX3frF9GCq|(wO);Dai7POqTVIl2^b#Y?+ zQrHkzPvcU>hsnnMj4h+rR8m%V&q|;nkd6Pa=0L%x^xsYT?;NfJNt%kTrKJ(p9Sbve zr+GX1Px8u|@7&1)qo+zW#ZgzM5iW|N?A)hEER$R-VTk%@N_{k+d^8_@G#}U^`0i7n zWNZod6fvhPlW!tbSBK zw1_!kg-eD7-1xS!a-8D(*GD!2zG^AGN=x^+I^VFu^~8b-*;|o~nz3c88SGJ*vAa=l zTbom*LfFmbM5)JaN|?+T5(=j?tkJc!tX+aO51mDQG(mS$?`zo+!yxupz~xf`K$ zO~qQ)n$ps>wtXh0WGD1-!j&n_)hjEBZ!tSX(bFktFiq|`p~3W;_j=7cz2>c6^G2_E zq1U|BYhLL!ul1S_dd)|@=96Ai$~EL1^9{NCxOLgB*!@{SI@^j)^;|0g*h#K0(p^8K zYw-We9M_LI8vOrikL#yB8vOtIsB7s_&Fdr$5+Djj?#$Fj8*Zc~o~KWAz%A;4Q`R5L zV^I=aVENFoo^Qo>#xB_7>ePD@dcdR5H|{Bf6oA&D4{UidHFPMKp@4q}&ztHUcm0Ug>Yp#>fX}e2H1?z-fY`SMf%ri~pw+g{6qBor6I~E;`jzy(_51OHR z*Gj%aPaEAIu}YqV2;b2zRK<%tLp%x_`6z7^=<7y44mIm}A1>wCqBPfkTw8S$+R9hl zR+tskR@VR6R)haVTfqz8R&9>@Zd9OB6Y`BU;TmcP!(iqJR#96~>XC*Pa%5ZRsOc2I z*u)GFT59hh!BcPK9fHrq%ve%t{41u z(>UX~L4f9Y0fyJj)XW@vz*dx?#3%^p6c$L34ndHq$jek^WvbFOPcqJ>rkGByJ(yg= zbA+6Y>aE$C4xgW)IUCz@i9R>Yb2fT#iR7$E0xN{MoW8Nks--FRLPrZ%sG>r{*oj`3 zynBF6OKUW2vRg)W+K8ml`IzhTvqJ6I&Sq!pDI0D$={1$(4fD!4W)AbSYdbf)80hei z^e_h8oSmVx>`>7feahVjXG|Jx7^HZrYtQ)hC3<2WMp#w3$B&_IuFj2yRrFRcY@kBT z9^NxcJ)YVO;zyFcaM%vpBbFl*Pg#d91)fK5#;vb40?KOq)tzOk0b?moTi6MsESpJL zN~0{XW8nbH7O0jJKe+4^`MZ+~L9={KZZZP+WnaBU~o&_-D6 zwLJduqr0oqyf+`A?-bZAuv=lb!|sG#h20Z-0`{8N+hY%$K4sdoiBUhQ6(P+({l0DT ziKOBg??&}1+3`!xt~DF=1^YiPYt;VB*C*S4edp<^bv zvG%iD)TkLbI?Jc?Z+n~m*?P{vhuvc){QOvM-}@LZC<*5l>jZ!fz#l|DazN?GZl-^w0Uk8PgWHE3M*X#d1PSL-!POZI-8@AAiZ z$16A7J2~{RX)yNah3x@LSKN;OtEfZ7qF)DY3HN>RKs$A(-NCqqt!i!Bcl_S9n7aLr zEJ)RT@l9}V%U9(!?M57!S6F-9%{Lj&VV4#!UtMSZ{nNvnTwj=-Qttb^-9o)GTUN*$ zcBsmb7n=vq^wJKkQFY@Fof?n-s`IvqKi6H`^Xc|?Be(VY({hVN5iR`bpA`_iA=J}Vg*b}L(Z`Nb(4>+gO& z*EXQ;u}z;++qN3IHs|^9EbG*p?i*kI9qTyzVMkB@CtJr)T5oeC(rL&SuBmUox@Ob$ z+85S42i!g4y>!^3ZzdfZXKiKkOO*fM%B9sa-Z%K|$o-Wmp50G|Tv|6J?_RefwkZpe z|EfO5BfjYImF(#by{31oaR1GmI>i`{jD5nq+3w9B^{(Tr+a5kzKk#Gu()ShSdiZwT z`D>l_Eju=LsBkGLbnGVA)nkU8YtX(`C#6Hk?qwtXs<7|zSLbW4Ub-%!;KxCltE!yQ zQ~HI~s#v4Stz`!t3bLBr=~C}T_lh;E)-G>f&hgoTpLVqTHur!_oh?Npo>rf`E7rFE z_*&6u{aF3W!##pK|2XFT%(e@DTRNYZN9fk_!ixP zOy}jj-}Sm5R4@0#!edz_U)J!Q(c)sgHfc}h_Zj%pC69B33s2;H%J{{x{ic_RXTF~L zN0ZC@7dQHH$M+jsbXt3Ra9n!134SM651Z*7@M=+|qiGlO@3rdqdVJCkyI!szm+)QK z*=5tCer>tsOv8$Mi?(NWcB(dG^Sw2Jkykn&ns%yDoPFe|YA+tH+OL>BXjSgr6_MJl zrFUn#9zJ9Dr1HJH2me}qsc%&K(+}3$|I##X`fqL<_v~u+Wqr5fUoTg;%Ly)s8F;wE zholpmZls;fYqR-c<)>B|eZ3xDem(2d;PO?MzG^*rz;BDXKgk<#a_fL$x4*KwzV6&N zfA*h{T(hu6-F$EDkXdWTKd@3PY&Y)R{FvzXj$WYZZ2pLDg8_h{0Kg9bz*hjk&j7$v0AL#c zunYhg4gkCY0G0v(4FP};0Ko46Kmq`;1OVs*0E7Sl834dd0KftOs0aXT0052y0Dl1h zD*%AM0f5T@KuZAN0szny0O$b#OaK7l0Dy@Az%>BiTL7Rc01ylS>;nL*0RTw=fIk4x z69BjY0L%dZY5@St0f3PJKy?6MJ^-*E0H_ZD+yVeb007MZ09ydS5&&2Q0DKJqJOcps z000L8fUy8Ta{wS604MrT_p(0Dxowzykod0s!;^0PX_- z#Q*@!|JeXQZvbFB05A{$cn<*h0swUYfW`no5CGr`0GtB=IspK?0e}hsz^#H(O0N_Ue zpe+C}834En0E7YnfdIe>0Kf?V@B{!<0Kg0Y;0*xa3;;v`0Q~@f=K#P%0N^YD5Doxj z0s!v-fO-JHF#wc0H6r~&;Zrm0DuAj$OQnj0KiND zzzzVo3jkaK08Rq{zW@Ng0RX!I0506qXf8vvjZ0I(1Mmh7zF@)2>`?c0N(=u4*-BM0DubsFb@Do1OUDO09pV5egJ?T z08jz|3jhEw0ALaT@CN{}1^`F{05kxA4giP&0J;GHn*jhV0I(4N7!LqU1OR#h03!ha zO90><01yEHOa=h@0|37R06zl&Jph0W0KjMfpe6uN9sno+0Ac}v5&&Q&0Pq$7@B;wW z002_~fKdRzYyiL&00;vBiU5EV03aR!_yPc!1ON;I0CoTX+W~-106<>=zzqOs0|3kd z0Hy!{I{|a9+2LN;f02TlMV*r510DuDkPyqm_ z0|3zcp9cUu0swRXfF1xS1pqt%fL{TCjsUJ3INOn0O|n%&Hz9I0H7-X;0^#}0|2c705t&M0|5L908{}0 z4gdhX0e~O?U?BkTB>>O@07wG>1_A)*0Dv3-z!3mQ1OWa302TuP-va<^0f2M>;3NRx z4FFUE0P+EV*8spS03ZPXSOx&J1OO@m0GR;53;-Yy05}8y!~p=+0D%1fz$ySB5&*ah z0Gt5;?g0R+0f6=ZfIR>(9RSz^0MrKnmIDC60Kj1Y-~<40767;i0Av6FmjQsm0Kh8% z;5Psu4*(bd09XM4-v9u~06<*;U|Cf;egCPHZg#2#=`Tq^%{~wV54I%$~LjI3~{Qm*+KN0eO z5#;|w$bU=7|H_d6-$VYdfc*aj@_!`ce;>&I#gPB8kpC|r|1%-~8$Apbu>{=bF%*FpX-f&5<%`R@byzYX$V5BdKma z{~pNy){y`6Apb8w{;MJX>qGuqK>k01{7;4a-wgTx9P)o4cegW|05KA^+P!{>MQ6e}MeI0r}qs^8YF1zZc~HEXe<= zkpGh*|GPu}pM?Cs4f($g^1naie<9?*H{}0X$bSXo|2xS4_mKa4A^+1M|L;ToM?n6s zg8c6Q`9BKs|8L0u(~$rBA^&ee{!fMcUjz9+9P+;!i=$ki;(|8kpI&l|9^%2?+y8X_IP06*Kejz zpYwRil+0JtrY$Oc_N?4*6DJ<|BPwe5(jR{u=C4){wooW6PltqT@onCG#$TU4RsZJq z-vb70+jjTilf$l+-dvv=~KH~lO`?OcJX3#fScRUW|b>{X=i1n zT=COSKHl}~YuEnp!+3SIYE3$P^;NcmwRMHot5$te-qzN>LB)#gYbGSDzJBXg*HeH0 z-DqIr#$mJe>^b!yHg;?p!F%-NHwYT6n5d z{(pY>P&a<}?xJtUjCu6SgbCj*`uS(?kng^`r0>|V-}1hF|H$ay|ChXxBk#>UbEfa1 zvu7v%_~c2mL0h-pdG!8$m3iH}|F~+vfZv1Lv>EO^ckc4ko;}apfBV+S%EH3t)2vyE zS%U|c#C7S?qv87X2m9sb{+Tmm$n$XTy1SbN8nE0eF>xY0St-Q72)Q>TG04i0tF`}Db@w6SsM-Jn5u{@Ag% z*B?DP?#P7;k=?g%e{w7!U{lAXOLN^;tk`(r_U#VO;^PT*QH ze#N3i3wQteYtWj31JC!_vgO9b@bG=xeSP0OfAPZh%!3CFPiVEfUQC_3xYy2|_nqwQ zszn_<_-jdATyo!r4Wq`kYNhw6Rja{>O`D!Z@7wp&%Hzj}{Cw|T{p@Skrr(Q+S@T8R zx~^aK>vv6a3l_|)keWL8hEA6@{fjTUP5S1WV<&@yx2E;(ebL6!()#tQSBhHY z%U3+A(QKH|uASe`5hLD)9XN2d>b!YNGYbnxcB);wapQIC4qUo<)8p?qZz?s<$k{C(_YLqKiRr~$-mw&%|*KJO>ZpY7thUO=EdHv8dGc#{=%a&8> zRH)!QEidoq++o8$L>xNwTZ<}HI(-cQ%mDy00f0pSKsf;52mr7f02l@U3Nz#sr%ECBEV0B8#U*Z}~`0Dx!!U?>3a zB>SOEan z0f0gPAQk`!1OU_kKn(z(JOB^@0Q3g{TmXP}06=R1;3fc&0|1-^06GEyBLIMB06-D| z&N1povC05buAZ2-V*0N?}w&=df;0049W0OA3F zTL3_90AMlz&=~;m1po#D0CfO>D*%8401yrU+y(%~0RWKzz!Lyq69AA40Bi&RIsgC* z004IYpgRCC3INy-04xLmf&hT?0Kg3ZU>^YR4gjzP02%@Sy8wX20Kk0!pc(-1D*%uT z07L-*dH|pS0Pqw5_z3_Q0szzp0Hy-~YXAUO0N@$`a1{WU2LQ|k0MY<}ZUDeB0AMQs za1j8o1^^TQKt%vx0|4L$0K5eN&H?~S0f3PJKw|*l007_t08|11_5uKH0DwaPfDQmi z0RT1w0N(-t^#Fi$06+x*^Z@`$0f0CFU@8Ex1ORvg03-kaRRMs@0Dv0+a2x>02LOHm z0P+BUDFA>o0Pr&a@Bsk$4FKo_00aU6(*b}f0KhZ=;28ig5deq+0Dc4j)Bu1200;p9 zngalz0D#{CfNcQ4WB}j<0FVR#6axS=0DyM@z$gHq7XVNK0PFw&egOb-0DxTpz#0Hx zBLJWW015zr{Q$s60ALva&V`Tqz2 zPyqlR0D#>9z!(5v0s!zc0Pr0E&=COW3jp*707e1;X8?e+0KgLfU@HLd9suYL01N;C z+5iA^0f3$Wz*_*o0sxo=01O5Ix&Q#{0f1ZpU0G0p%=>Wi50KfwPcnJU; z1^~VV04@Unt^j}&08k15JO=>I0|2K003`rW2>^Hq0Qdm_D*=EW06K04xFkegyyq0svb8fN%i77XWwx06YKyv;e?V0AMEoUE>!2mq)806_j9hx~s7`TrR5{}tqaDdhiekpF)`{x606_lNwq zfc!rV`R@z){}<%{H<14WApaji{x5<2uM7E~0{QlBY{2vebUkUPm6XgE^cK!nZkpG^L|9?XM$3y;q3;F*G>s#$o~w; z|2)Y5xsd;dApd`a{2v7Q{|NGb9_0Tj$p2u-e`m=5RLKAPkpEVY|DPcLvmpQDApaXe z{`Z6Y&w>0O2l<}>`EL#R|0U$VE9Acp^8YF1e<0-l6v+QwkpJBv|5cFxcOd^iLjHdb z`JV{+Uk&oV5#;|5kpJI7{k;U{9gz8zX9^U2ju@S$p6le|BjIV3nBl1g8ZKd`QHTce>3F&VaWd~kpDX%|F1y) z2SNVFK>oWx{-;C!Dceg3y}ZMApd`b{9ge1 z9|`$?8S-BN`M(?Te+}e+AISfUkpJ5u|DQwtpMm^80r~#|^1m14zZ2wt6y$#iYp*Ms~& z5Ba|Z^4}KnzYXMnOUVB&kpGn-|BE62=R^K)h5R23`TsTKza`}VD9C?%$p0FU|60iZ z-y#3!K>nYF{7-`XZwmQ88uGsmk^;;{(kzO z9g|kKE}h?YarYj_{<#11uxZQPHyy3t^>P0dj@{nM7aU&S9%-Gwx2Mh7 z7Il`K__BgU;jSZ=ib|;yJ1uqg8WeK%!OCZ6PM7Sv8~xSxn0kNhXgBxP+Ya|?#a@r> z^|Z#M+D(5c18vUZ~wcIwzwm-S;uIMzXal%7C z{~@!sRR5-Lxt4dPu3uKX=1JC#&I5Kfdzn}C_n|Jchh}Q3Hn*C2aLR9uZicx84tG_~ zP^r9n4pl`)#b`UJ*uM$cGAvSszaSOP{tXNE&!V+*VAxbGdv@>EvSFK8Rg;F%O*^R= z{PiFPf1Ze;zd5T7a$tmH-Me)cC*$&V_wI(DMK`q%@|O7I6A$xgiPXZ0IOE7+L&e5m z4gP8d&f3Fk!qIatyNqmOxpd~l`+wi){b!wZ4MVCuOK9ck z_ZE(Dv#OM8{b9WQ=ofQR?JhLA5W2YQv`fLicDh)2XzuwP@9s_8ZS|?kQ0*73dwvsj zDtXVzlqDsdzr56Hf6E=JHf{U7x!2`=-=a-DJ7n$M^5v;NPwiM=>&}8kv2{Z>{Jh(9 zcf!J_^EbY@UeM3F-Sly_%0D=EJZk;xXLnB(m5aLebm6wPM@QKgukwlsISou!ZSVS3 zjpn+lwYyGjRVTIfud9=H7u~J!sLs1%#RY!r*KChzF8?_2V#Af5)^*nSJ$%)@$LrjB{*O+o`)ixL8ue3L@Yhb43V+))->UQItG$Yyp+0XaI)$9<_xkI} z!>2r7H?x6FT-A3se((O<>ALPimj+H=`km$Y!K&Qtk(#+p-)3D!9^qZE2K+fb_u(wt z>dCg!Pai+LfA{vy>sK#dJb(7IL>66d>GW6Yj)d-cxO)Bl4G*quN8{L2*?kLE74 zII3;^eR`{7!>Wy+P-R(U$2OiG+n>x{@V;79X-vY7V@;MNJ^by$@{(P1+e{oa^+Sy` z$5wml6!$rwe!aidOh?zDuJgWLS)<<6l+Tr&;(GiKx8^e|S81~I{HATMD<|8Z8Pr97 zzQxgbuP>Jm@+oq9-aH{K{!YM~2j_iSOq?d9^Y8k%Q{@wrzH1)6vt;g!DT#I4wXp51 zvHQJchSLUnm+LQX+m9QxfAik>mYUcNjVd|k3;D|W9AcGiQzcb@DZZT7&y2 z&Ij+yBZ@xURbOA~^<5KrzQQxTbJw^2cYC*Fhx97f zdi726hzxCL`^+)ZGn)QxadcR)Dll9V8KUCiut>}nBEX``;X35~2j-t(ysl?o-7df#}=PH;1%pKu;c*#@23}oYk z|16oxLXiEmWU9)Jt24FicoSX@RWO5?mqL-)OABaYxy4SJ|pK3$I6b!$&Sa%j{RiE{<33@>^MMn z94I>uk{xSh$HB5=d4Gk<;=^Re6J*B|nV$T3q6jDKZTaJh2v=mRnQVT13Gt2j`BI6E zw`X4RC(& z+xVodBJ35J#!LtPd{x=w=FB#pH;pI_(;9QoxKVv-^6|cisK~Toj`Q`q#vXTI0{HR2 zn9bjrsm>qMg`y(!B@@i&r;%Kd>CV*W>(_wI--}r#YoD>Q;|%1ZO=C~_`>|mKKkNy$ zE~55V@WUNR85fZsNqWA$$dM#H-)^kkf&S;dU!dUrKp^`)0|k#)nl&zby=a6`nA}G3 zVJg=Hk-bD@{~7fb(x2nQ!X-n2f?q>g@?KV{@M!Oqr;#}b>ynM=?BA1(+}JZ*|j z+$Wp9GZ$vtp$ivg+kwA4vhBdP58Dp>xY~iFE;O;R?Zr-E^7kztCVvO`F!@`7F-U31 zpB=^*g~=an3ck(R^6+iWmWOY1wmcoVv}}34;KJha?1IUqDrf(O50k%qK1}`&@nQ0} zj>?1d`8o>>}-Ac^Ro5jeNvfRYT`d^bb1O?dTKHXQ$D(~Qke45rr`b5L)e8MJR?P6aT;-% z>rk576w82)T$ti%6MV9Dr-b|_*z4oig}{xi1$GJ>^74#g&-EpngsU$Nd~9reVW%jz ze-Y@6Fx$TfH$s@^gD}q7dFKTKHWhXSKjs@y*c1O@qcRBnqNZ>tS#eFmu7J<(_@v=Q z;ePm}p-*9IOHT?@0&G37E4r~krZ_!#IB%|8+D1z{>K+3}AV!G{~*lZr+5CitXcQMd&@i}`Rhd|u$g zweVR%!KG0n?8=9!EPeSf)oDB*rh0_(VGo33`7o7pDj%kD&f>#e5T3(_dmx;`hpB8! z`EYN9D_C%4pt4ox!=4C#&4;Nxr}!|P_bMNz^WNmcbl$ssxIe;w^Wnh=M_O|Jhanuz zheskD&xh%}FZi%O!teMnwPg)-2(=-F2lC+{gyZ-yl`V}AQ`y$=VJcfTAEvTx;=`c` z*C!^cxUuiShr?m_7KMk1(!}xM7^K_hww!{JRRX{ zd^iE&zxePRgdg(ZWQ1Sx;e`lqx8=&5hHwENrZmU-Fy+0+hpB9~c3gTYTXQ~4WmEHE zDqA}~yd2?9d^iK)?tFL+!UOp5c7(U^;ar4w@!^dK|GNMmGEl_l+gGm`nd$*_!T+5 zCj7H$$e$sB;nzdRoA7fC=6!u8Y1uA?A7S_xE{#cLZAne0qb88qse#Pd1A_zbe1(m| z0vP?Za?`xjKkV-@$Kp49%4%Io#QvU#`O;I9$&yGKg5v)nJNIiL+6eqeh-n$A-hpQ9 zRBv;3zTRw<+0nxOwRvB&J;^OGtEw|2%Y(6p`MbGtG^%^+5CH|m3e!Zg=t#9H-O@r{83n2`CpCU3Q z*zns8hF<{SfBT#-q)9EPKiOZR`Fxj)l9;#<#hGhhQM5@`Iy;5}z(I5IGYx4rp^3YH z<;o-xKh30=5tT{aaRKaaJe&5DHZVX`3zNc$szA?LKi}SbA&m)5+?k{>*Y=V`X6nKD zmqk!LK67Gz+y{KF3dS^GLMtJqNgcRknBJdh4SAX}oS@ME=!8v!-yVt4AT55doBiZ_ z-)AW0=UT#>4S$9x0FTE%o=udfj52fl`Ztb%cSGp{qhs9K8;*R2wK0UfMPZ*|?jpM} zOpG>MuyrwQ%7_UR$M_6$6ZtZR(Uf=yV~Fw@rZ$AV5&jRhLaZl2Y8o~z?)6$grwAJ) zGP?!he+nZxyOC}YZ;+Pk)*PBwo=%9P1VXqG(oxuxjMy&Xo{qFx6m}{P#nCb8alU5P4IVFR$rCKUj?KT{CzL;w-9l)I9C#X2W9?Ri2Ttq zoZxRK0^;)JB96)}Y(n|AAV6VHKEeb38Xz2no%)aBDBnT^#QyfdMr)XeU_#1{#@>dx<#gV@Y2#`O)g&pc;uD+*b{_;frXcT)qbIr$W52Q99aI zARUE0=>VG*)-3$-N#&z;FTo$(=ZXFGfWKFW7dF9Pw9H?S$RC!<4E_RU$Obs=-d>bHy(BYbx`XfQXKW7dA>qTLYQD7b1W45ij_=g0Q&0 zhY>;N6*j@&Z!l2UlaEkhai%xIRKAAT1%G=H7W?}J5%j!9*aUw&VG#QpCi2&qkE8Z$ z1!rP^_W(0<>fj>18MPYA)T`1oXfJ*Ey*NIyPl>5s^ITXUI=n9%FHJ=Lusm!i-#EEH7cTC9vG+FMO%>_i@Hr=Go2EgMQbM8NrWK(mXwvT@ zYEs$)f^N%d1y&!LiiNTuUm``zZW^^DC|asQin4~TN{aHg)DH?QYg@Gx7PPRsqAt6| zT@_r#qT*Hr^ZxERXVTNO1)u+Qz3>0MuIHJn>A7d-p5NSa&&QcFbI#m^L5`PqRv4Zg zcwB!Dg^&D`!tkr+jllg!UB8b4ufOqmDEKIiUCC*d3NKHE z_d{6wdlGoGKg=DM@4K+}HxGEcKBlPf9tW+KuL(E%W)7zCk$0U!+sOl00lYNiLG5oE ze!RT*fL7y`V?)SE6GX*v`O4r|m$#t^`vcGc;nB7O$D?&>!o!8Rzv1SWtk87fc*m7` z<9u2RB2{|fWE_;Q#?vOMKvd*cO1lr?U8#yxkz2$0_{{)3E(HZ;0`vw)G&iA$f_$nZnn(txoH8Y9ie_TG= zqfzta<@WSt;^ce}D0;@Q%-qA^!!0D_h>!g9!t#9ze9a-Q9=t_i`QDb-f4ymQtpWHZ zhUGhYO8@!J2-EXJ;H&1sDH!CvHB8TOQ~T!&gz-HGzW((5tis3R-UHvfuzaZ=Dil5Q zs4N<6RgQSbJqkX}j35o4F7nU9ItV@YQUE#5cObH-uTePR`4L9(m;$hI$cQUed+sSy zSroNedYnwl|G7QU^ix{1SLp3oc>rL_C!uuM!2IJ#xiun3#Q&hhk z8zkGurz>|n&Vm4Sn5eU6mmXL7W^ol!bv`*P2I%}+)``$zildfD+X3L)bcWJn3)YwmugeCwDjzsYxnqX$^gN~DMznfgGL?hfDs$YLC=t2G?mWYt$H8HG>S1WoJs9#uBHg#2M>4WWpip$PY)I3T}G;ZtKUD~Bpj)Vne&gLr9>}BiT_e_AD2AG?1`5ds}3==FZ z!Qkd+V5G?3WV8i?dtQP4A=h40_0twt!&(1cGPSnnPb`d1e}}!WGqAn(IIPx?J+yHa z&-FElv4HdYjGLcmj23nm0vMdNXX<)#<;TSJZeU$RvDR&IV4ia_O8pR;t;SY7p| zBf%g{vQ_&WCvc8ls+ZH8!`CZP)5& zEXB3f>UM`8^s$u?*!7|4KV@{CHgz5+Bi+Z2bR4p}I?f6wO&x!?fNuDswb41$#YAv1 zn>?;|5mvLvmffQe#u7N;_gF0+nEkXSJKavRA$e^|DOmL!JS?YbIAl4HDEFE@yAUhvC1h&tUKz#ph{bDiJ!W+^nOgAZ0&_|p z2l`j1$Jo$q@o1W~YUpH#KgoF2gd|CDC7Bu;EyC3%R{=9Jemks=lacYgVc5tTd|f|U zXQfU}E4bC_&okasicVB8)!~O(P1(|_srb01z<$>MoN@a$*fyi4f80V1d5sZ0%vB0& z<(7g4D;JX8HdmQgyx3BF%;7(7tlna&{=m}ltTjutesAqsZFS8zHJ2J;sH}?V$O1`j({n67$sjCw3NrW*1~2iH9+ss3lXj=G&y52 zYwoOtLNU~TdK&LZ*4z(~6{_~p&3moY&1Z#ECYYrH-LcoY``T)jpjvM22QX+;Z$#I@ zuoFmwsWa5Q6`9>Aw-?-oV7IW~VTax44@ARy71}_xY{2Sci))Wqz1`@7KK^YPdCvd5 z(GYVuX4eSqc!U2?bH{0m;rawmhsS8|_QQ~RxubfOv1`Ff6x_8$tPUE<2K)CGluEqlm3>1pep<)@;i@BM0U>E7S-R^7WD zuaPQY(hzna4$Jn^&9TC$u9_&pJkH!)Z<@Y#dw?W89{p9!7u^d6e=%oj#I(U>5z|kX z{^@kx!7g{ZG3I!}p%2FY!yt_r{`NT0z26eE8Wmpe*os%*Y%Q?D(|*3zbS&C+!4x11 z^Iz#ZjyVE0)Opty%Pd{Nht_@3yAwOQ&I*f7U8R<9+P|AR*q&jnY42VTU3|6G)oAM6 zYqYTDisomxoE36SmRw82tJZ>KM{|;~;N;5APb|$>8qtnjw~3b9ES;ZPI)7~~c*VLq zx;Wry-fk>zT1hs=UT5~jGQ@^g$dZXa*J@|6b{6Y;RcuZ(x?nhXFU1x#oE6ed;B0^q z+3i-JsXn^nd8=!W$>*Rd4LE!@R3}i2!T6b};ZMX^Ke&J)7RZRNiOrv~`e2Cu=d8ZO zYB1?YXRC_lpH3EGDscca!Rk69TfuH_4c!I1lCXwOGXs?|yGpl4SEJ#^>|k}B;<+)q z0~WVNTZ1W$GOu8!>@cN~ty0z_R;a;*NQoswcJhRXZql_DcWb=&M583^PBdJ-yQR?| zJR%4m?!-v<;a2*`tbmw2Cyus%w^(;<5N;IB#~cmEjh>w!9lKeFJ7aVC%2`|QUn$?7 zJ3g>9R2V%Q?l1pJC*O3No6o`&t;ck*osDwhQrxXBSblJ{wsozEgoW0F)`pkl+o+7Y zSo_gmnN4Ste}|>H<1DiJ=okV7*oFJZ(%ioC;M+0~?qLU<&F@-We>2&FLF;j2b|G$k zXM({Wj&w15b4T}o33+R+4Y-B>oo?Y%nXTab9IfEWHFdma5pFhBTh2CMm`uhnDI}RJ z$LTJ9AtH1i-(smHJcjB`h9HqvHXw`7O%Dfbp6mW*u+Wj^Xn@)5jKh&IoQ?M1^{u7DdKN(o zHcZS=Y-tBA9miId@BHWkrg^dBT1zJrqqBQu7sU8UERYADuSpDh=UL%96EZ_i-6u}| z0+(uJx5c>GhhlY{bTphcUT^r~pUlv#38m`jJd2<&K0|{pt`JC=_3tgf$2QwuL>?Wc_xkft8FUTZ&Ygi-@1J~?>)+?Tkhi)e_$oM>!D|%aUM%N+48{+QrmR`nyK)mspA%l>pjz&!Aq(79Hw>sAs({@yG3Zl3t*N-y*zN4Sry@2du91rs5#Y z=d6c}G|79%YB}jZO;}JXr!58FP|I*F7rXvrp~^UK?Sck>XKLPWX@)`McHAi)1s-D; zS`ua-UyB95qdPQi9InSKuJ!CDT3PM3x~k6#$4t0A`)jRT^;Xy8nC*}#m|IvqMwmIX z`>e22)^72hIM#CY@ef<_&;NAngl91(g1+mUZa#MBNzr|a0fHa59=%0}8*Ae&T0qs@ zBDex8>uwqB@}I4{qYg(gYq~HG90l8ik`OYg3&X*Y zDT4V{0}u#rqy{p2#Y@-r) zmTd~jm|HoD=>hy5rxWp!{;li$cuwsgOg_YEABT5pP z#Y$6-KWKh-_QExTJY+NVcvO?4+}2*Weh{--ny?+VdF`8x+lEIb z_+mVpQclLC?s*iGZA_0a$#mxn36FF%852rj<@TTFJmT(NCRM|iD*oU0XS8UNoUv}d zY|2ya3c=v+GwgZYFt)_+!o7x?GBXc%f~cJiyhWpkpq*&vT49FXNW%^oGh=WEle5kwq!J{In!zF|ASJn~AWjm$LO0oeNZlh6cMy|Hy;uhqv8gy|Rkz4!Pm{i-1 z^H$z5%UcK|d=7}>wJp}HPAog)uQJ_Vu4o#c!%z?8wbtasAVNk@JuPl$99exF>e-5C zX-}owIV`EAm<(VqaG)aS(Rr3_y=L80xTn^&6mW~#>*^E(*q?I9eG*fvTM}v{KFO1q zwPH!5OaZ+XWagH%H4>jAN^FiO@i`(f40TJo8i`LaB{s#B_!N^E%x=k0BXNVv5}Tt+ zJ#$nPproxUsnv-3D$4(ElEHJP+2h`T<(_eMEyeqIh3|(EdAm%8kz6!`GxX1Ch_I>qTc{Ptoy~bO-A)E-3CmlG@A&nk$Q@V#VMUzj91Z)t zt3?A$JXbR#f}gY$oT2;R?m}1x)L?O==?obkWPR!j3km@D3OQc%nSs?n()EuzZo>{)%9^>&Isd|NL@(SwVxQ8-TZbcufL?2tm^h*DZ zERHB^A$WN#3+WckXGdhy){t&zI^$+Kht71GXY$@vS&lZsOO)gsGEOd0YrB9(#Kx*m z2xDJVx0AI%bjUNIW;7=zdna;Tqo}r|Z~H~%k}f2rZVlQTXIzeRXpYmIgYF?KRRdLN zm+`K=(y6I0>|8dndn!gO6-7+fD@tfPaYRkTOCjP(f`p4&cg%zbgZk+M(za~cK zZ6AEv`0ok7`)=Gz@9x;JzP$aZAFh4pu|a_Q-RD2>kapS?XMS1miy?nI*8Kb1|M}(v zcV8zxe#6NtYd#%%{KByMH{RR)+qbjl|8(D$$=gnJoL%ruLfX=ZKdgIybydLHRyh6g z7sh^{e)OKvX7}8WK3iG$_4vk-&)&JjrC*-=^rGsRU#G5_GxJ;L*8ep8^~Q?DU&VDk ze|^#`-QK@18}ag<*DC){Kiko|pf+Lc?!@wf?2k_@k1m;X!*BoBV`uz_{&3Z(A7B5g z<*oIVcc1nCdCRJ{+b0(dd(S@N=H|N={c~6QyoJBop5-%q_w-l4OSJGz>RA01|M>dghfU}HX8X;N9mA*X zE8KYcUjfHQ!Na#zW&FuGvwQDl?x|&)JE#2q4(;@`p{vJi`}?^6s`=odQ%CpQ`R&^c zZ#;M1vfTWu&;NVL``^d?RIzl&Md|>1Y zfBbSq^#kwDethc>6TaCgJem1y$2HH~lYFDA>-xW3x$d>kb6(m1#eZg)QZ;oi7318< znbREdv6b^I$@pH3j;-VeNAhDU!?^Gr6LGP_EGacR&9W!8!p%b!ZXQa9S@z{sLc@4* z#$`XeN~ppcemG*E)74B#skyh6uJY7w-+Soz>EH+PKmPT_c{5gQsh@k@XL-ZQ$K*Z} zAMx?$+pm0X!8>Cn{(kijSAVeo*EeKzs48uoEB|-=IcR8^B^0~MC@^|Hf z_J4b(b0ZGdyQ1p-xKnR_zI^uIYmS?w;ETFNm(QHI&b9Ef#51>DIJ*9iX(wKM;OU&n zR~>8odiOn7?7UHb4~B+^-`96YZ+|cT>Cke#+^6MIPub*YfeV^-xzs&`>h2dz8}0b zZqp}!$Q%Cmtwq1z@ab!Z{_EOr-`M)brnz~`zI)`v24{Nyo4S%a0zVZ!Gknke-`=Oc z=g2$X9jP62L+zHo$LS{Q-BuK{`nk4Oi<*|Md1vJ>e7BzQJn;{!v?yg`Y22{HVUN@{ zZ#~o4Rc62P#s{q4PyTROVBsIyAD?aSn)AVF#|J~E>|O5s=hQR*6K~_-`~%g?F#VmM z_n9a^wVJU0DGAZSeE#AK!bKrP@b>cCgw4JD*Rt~l7y{$B3f)S6&ms^HYP}wb`<~Ai z9TrbtDfKu_pY&KiR5?wrufFKLAG{c=avEWT%1804LsSr>5t72<$AtN>V&_UwAie)1 z3K^mI3N6f^CTzi#oc#VzIy*aq{1*H~Ayc4t=E%wMS;8*atKek|X^Q@<5iWxJmR|nr zgb}^`la$o*MI)%+wxaS}8x~Je_c)DU>+yinpnla(!`|}m3DK~V2-JRhA-2b9pbxdv zpuB3QVW++HglKww^+Ne`?Z`YDb^?u>e-d=k<4A{>)5}kaBmYswpNDoy=ba@e?eAeE zjD^;BDt`L5CKe}@#Hau%{SOKjy*nCM6|tk8r{VFhFc6vWRlTcXeuUakr! zKgVJ9qP&Pbi+B`T&67ak)WHWj)RUMYuD zTjcUsh^F`R;V2nl(p@51p{eVQS7^%GN;Lh0OT&-&Y1F0ciM|0>@{42f56+ICNMLZe z_=)2fDNH5$Dw&=^G}7LRYXQ;9FiL*$YW#yET@lYhT&a!m^Vy1(a2Kxgh$dm-7T`zx z8*yDkv@-NARl;Aw^MqK&wcxI_~hsg-EbYnnonUggCZ}>d3zjmjS>FF4DTLI+g&HGG z_M2ZHuHJ`^sDQ8<@iTyWxcUMqbu#b~FqB&l6P0yE*;KC_f76N-&^1# z+O9-cuaM^kc+UW@8ccTlFzko$=v!^Id@liDB;vW_ zc*np*v|Wi9KU$t|kst4Nhw!kE(F?B~iD-R-JC4^9hIa?>ZUvJaKbq$fAC>oO6kaXg z-=J`gf#?u@Jd6)}l57r6Jmh$qW8fp&PJwU@qvd?;pea9!qibv!o(qLEBAh#pHz*A6 zk19M&`9pYLLkH?|R0EHmbGhSqUx1HjyAsh3JZdlGr~E07?Gy-C0X!<7 z9Y31ubNT)PT8(!H@Klc{A-s2#GQ z#qlPE;oS>7)nigfzRWN@zY34)kK@e=s}B$GbR>Y{h>zTDVfFD6@Ti=2{OI|J<7I{6 zRRfRKMY!X5sbP3;0gtyo3z#|HH6YabJA~&|jzO559tVPGI|aghrz&p}{1iv^9SuT_ z*8#l85Y8R(k<)@8+D;yFV|vOv8eWPcysZFJ;}xUxP#kxheg;fL+m(oT;PLhcGK5Fx z&#Lj}0neqRp$o^OGi%j&qg8k`x28D4Ux}X@?_asT4zTv7!6*)JYk2+&Ncz;m%QV>nVesh>?`=gsF4G9C70wIGmvr-k zg2$tNtE?$5$OrOpb_t=&? zm#^U8dm2e16Qo|pb-7ouJ7*SG#&x-H`n$Naz znwap2SE`E<>b0&1o3}Mtz>segTK&Ikt~ItE`0=Pe*m1~s)PMeiKkD5tKT{Pg7I9|lt^i(|Y z;SHS~czs3r-h@85^3y;5eG1+wRnkmAn$qDDC{1gNP)YAI?bCGPCBuWFM=S-F1O|hC zTkWtd`p5{O?qz=!j&FMT_Y?G^y6RqjCjUavFuazDR&_2&RYLL@=u1WdIxc_j(j%)= zSR;9&n6#rv+9yXM=P1e<3Gjgoa-N_!H{!+O9*L7)e#R%7cmEWKa_i|!E?1Ln6Dt_F5wcZee39UgI7lHT25@NO| z)EZ{&uN4itO_Me@cr1p529MF))J+UAUay$2uI9i`6<_R=@DXJUeKOI!*Rngp8E-2#3y%ZRWr@9 z{8+s$M>`vyL6F($th(iTW7Syt(R!ph2JCt<>dK-cD{rW{ofZeiB;3#MzFr!rh5Ai9>6h zGZW+FB3Ybrjbp}Mv|TK-&0dD0RBrZV4o9w=kt>Rm4=H1);TZIpP2bmxt4#|EXE_pl zwbF8(U|(yz-FIDUi-p>a$3{)?std(yjXqOg*(P7C`JB)$9jgpD_eFV@QRJK-Sq9Km zX4c+-n12eN&PJY8DyFATq^p!9OW32Nx|e-;8IH8XT6xiMk;-Dw_pf|l?vTs}g=M&P zPsDqCJ0gpUf}xg;x~UYV70z}TE<2TWYV@hNQ(Dw1eO77oCVEXCn^$c02bT}cn@@>tJUbCzfrF){`$h^)^nT8OvgH;(Gs5jA_nw5zi9^|7kg!s)&6p0+Tq zr+P;2HqB-QX>HLtmHr$ln70dS^r(O}F%zOjbt#?yTcoPh`VwCleyUCY>Qc=^klBR>rq z{*0mo=-qZhRQ?HGH%|CgC$2WF7LUsP9$6^^75gyGXG(h6w_aLRE3S|7iMUMA8Rl%O z{ZuvPDdUW}L<}UMK2RHhnfN!JRHy#_fb=Svw~5e$XTDboj75q<-Y*MeMF^V_#BnH)Yzn`8Kdz^+nwW$5{G}PlXf~Cg;O2by{ zdxA7<Gea^FzzHWWtMj#TibfsV!d z6TejazhVB%+1aNcg+}I25`L}ZN6!SYc#zt!s&c~9Df*)+eJq|fX#ba7CVsJae}QaH za7X=lt|o!R>VspQz?nbqUT-5F+Nt zL{#RQOdbn`U>y!W z+J`2G$G*_MHTn7eD@FI(V^;EIIAe%Y-YesK!_UJ{G*_KSz;FylwE)89RO2w2m0^I@ z7w8aO@iCC8XP*qfAP|?xy$c%&YN3Oc8_y8+1BX0kAjIm z+lrWbk8|2$QB{=b#w|87%=tQg z=zM+>y*G=z_|L=db|FHoAba@2_uVd{KQ#4AmAr?g zfB8yyQ7#1(&e%U3ig76*#?s3O$3Q)lsvnK+Qh+@y{mZoC?qw^nS$Ox{C8d{w>dV>} z^4{f6vZs7Eb{KyaZomAzTlO(H!Xs20rF}&R<*efBx5M{l^dp-y=JbshaO4#Pc{}<@Cqk zBic@Za4yVAXbSO5{3x7$B~$2$#Ljc12PHFXK$ol?@+aV7Uh6&}r-I9>tLtMO*R!)2m$oSv?P+bIyPU4=*U zWR7PG!z26F2UrUEAIGD$VWRCy+Li$TaeRB*-%IV!aKQ5mu46hh?w3fpi@sWEV49}p#n}~Rh_f}Ya_~GwQe{U#q+X);l z9(cU{(JCCrdnODo06(oQamVGO_hE^)D-l)|9=#*Z@%{u_t-p39osx|45xpBfHQrQJ zdF@IZ>2m{qYP>_hyAomCarquafEw>s6<&@KM|k0T{@)ECAB|yZykZqzt_qLFezkn` zesF)|3vJ1(@fNA@@>O`lFd09<9sur@t>0 zJ=l?k+(Rn7o8aeoivdP>G)9oi2HrfGWdA9Se(g%T=TTe0r*_0cZU_3MdM~;f`BEJ9 zBXXSYamWYAkn;ntQ^|wcHOWWwHhL&pwH$U?m2<~0xfh*f&0>fC{){un+i4;PCqIKE z!^Q;Li(W6)&;dNJ|0`yPcAvf>;7CZ?m3=m#vufEirb5FwtEcQG+lGTTOWj(gYq@1aOA(pmfk(lL)`1O)chk(rN z;nw=*+b0ewsBf;;%E(>V4jFw;Za@gIH@$=;)%i*l)S%Qac;IkJCYL;{uFps$-I_;d(+VT7Iq%z`cqNuf<5 zl$^=#k!8LC(6?u26$F~=qs(us%DwR^sS-_z#2__nTqyPuqm0COn8cuRk&>87+1~jt zNPe~@c0A%MDg&{|(OmE5{Zi5E604m$$Ugi|svuT+rN(BkfZ52!FeV?}E>eX_;_Q(Y z-cRyTHc=F?T~tyIrj(ONk=xfM1gdDS|4CVZFnwJs>uXz_SaGgLX~Sdc>ve|VH8%-p zZF`zuNYKS>uh+qANa2M5j$uMbp5Em{++xWv3>9L~`65|0%tStsIn#uMRraZgQ<6{m zBC(-Or@sYk6+do!Q5&-g8zzi1nK)5hgdNEXc9ZCdWc5#tIC3T{mZEk=rzFpg0puYT z#M3(qkSQ~35}@X1XB4ygZe#TwA-A*pLiNp>9kP|19c3Gp!y6r|?MPV@l>mG{nV0%}Hw)_1X(8=}~i(Zss zUNcmD;{VBfwbcBh(fqj3x!vgB>WCBt##?>P7_-+r_@{)A(Rz+Y45%IKL5Fm+^ns_U z?{ZiJ&D&nTyJDTc-dHfFIic-!@3jZSn6`sY;tVBHMa4N`s9o5;)n98w8}mdJdzuph z_0-q*(OA$9y%8HKO6fn;Iu~+n%AGiyT4&YOy{oZTJ^gq4r(Y^fgjuRI(TO1te&|>%8wORn+zky#}wjr z5djVZHmJ4Jh8afe)6NzVQa{#wklr0Y3nq=+8993jhEzmHcxWfR{&w>ojnCwX_Re1& z-IQqlvtWJ-d)i1K54hNfMuxz~rn}CY{_1&{pMS@8q;6YyHG;CL@C!p`1v}!{MY#JefeY-{}7UL%giA08+rq}F}_`~C` z2=Nl3VY_ZUL7LDP=WE>WISwoQ6F|obICDy+Qi@liSrW#tOk^Hp{4v5x#ZS+1v9P$(p`{PDs)3LwoX=^O9cmGn8xKSF57l^m@D;p}4}TZxzbR|@NBvIKW4ezC$h z;h&11=B=^#0(N{azfH(i)&XMWvZh9rU+HO(Kh=5IBs!f=G*Ga0JcwuCG*R;=NO$iI*J5 zXE;h)mKO!UCF7@Fi{Sg!44?ifPE=mOP~)T{j_-$0RcHk^^vyfNQTE9Rip!rz{HiV~ z;<=R^y?ky@vVOOyepbr9n>})}zPr`^NY%sCv%e)LSMO-EZB{NJ+oI~r z!*{(0+OQnBEEn61x@4+>O26E>YHrEO($c%bKj-X632NSf@GiDpFAI684SO}$K)J|! z@dL%m+wVVf4_wZ!XN#LxUq9vVVHzms@D1*ZfQ7RT1SxMuhI3y8xc>wL!7sV%UhI&| z?=4)qf%U^Z5HS0?*IBX%d)(}$h)aVHkYb<=l#cgv(feZ`2zuqcrCC2)?7qwc!InAG ze>SR`xA%(<1EJF^47|~zrOsVZcK_X>0M#b{KR7w+Y*LHd(9k=ri2`CNf;jOUDGoLcN}kjSbaPSKAPij$N5^pN3>mu;CsGQ z4w@?Re4h`)dlGm>N*cOwJbxITQ7`XN5FR}zaJ;*b9)BS{e+duAKyZjIR>JKR2*>w) z36G|c94{pduM2+V(SeeM@Fs-e@jYL{qeldecNb`|hUBAnlKa!&|5DP}aV1B4zO;5t zcr^Xxc;i8<@#uNyK7?_{%TBM25^Yx^XpffT(Us#BBE1^#QTTI|G<4y3Z-7?wb%2k@ zsrmLOY3vjTw-otOyQgwcKj!&v0jP?0H((Kasc^= ziPG5dBS(9$Tt3>{;&}f8t;XvD9<5n$M||Y|fu9=hNflnA5=Zz}q*vn=V{qjdhz`+L zD{|W@5RUe8xqMf^Pie?MC=72N@cPrAE)4G_72cI9JpP?1AIHfqY=7;v0s^SZOMAn- zUGX+Y^4$g|b$K5G-mM7djxfj-gyD6l@WvsY_z3T#Fg$+l0HT=Vc<+bd(Oxds-__vc zcnx8Ae}jCqhQS@jdoc{}I~5+?A2{9>VR+vGk7E!fr!NOVw4DOUVNmAsT?;S8k)P75 z_18Usd|xa1*pY@D-y6OOv<*LwXAK*7jfxzUh8*#cyE<&#rM+P;A3YOuyr?idTL0)z ze{{AIrLp5jZnO%I);>5M?ZKQe9p@A|7HX| z+D;z0Vig{}D?o81Ut5@bbk;+e3jF$|CPXgQuk zg=fdWqQ-j&cyu4Crb+~4Ka-<;$#FhC(gQN& z+To{rE5-A91nH^7x#I4Ov>t=mm)g5dv!$l|+`a3!pc8WP+&vlRo`}MWI9(Y*b_&nf zDwy->LuOZ1ovYGe$gXa3H@whnh~6|pGz{PD!Fw2+vh)?*ZF>5&7bYP(JtlLVnAtRJ znynIc3rv$VWr+su_ZdUhNb}Qv*On?^@5^KHV*mTEqq-)w!)8dg*D+39BV|`+!LaIX z=S>gK)JY{eF-a#_>KvW0VLL@=cAI>a)v$5+q{CHjVPRrtmC09#u!4=DFv;U^J#R#G zlXKRxx+$9La;LA_mA2!i+mgiviCLBNU!9roP)>y4t(@N!Q4%5Mqx(d<{pVc|8C`Xb zS*A{WS&h6NGFe$p)d33&5huO3L+eTORj%EwN2ZewR0oWR$eE(4n<7nLWm((ovw5Qp zQqmOc?R*x5Ax!*Q@oT{kdx%>kw?F8rHICd|y}7wM;HdZk#_<|k9WI#Hd(lWAI2$KT zYB(G|I{wG%r;XK{Ev|7!c|SB7)sAmy*F;Ve$C=zOzvqR~D6b7RN|{}k zLTscZTxrnVtXr&GNCsI-55yJQ+nN`? z-DrRzT(P0a_WD&u!$;emj%hTAW1gN^dLXGSOBnOCt@MCYl_6|=V9<^jpJUV02A^&1 zZV6_j5wD zEFB@`Um;XKXDl}*Cl+mwvDZ1Ox4T`No14Vi7=xk7wttwo&#-p0c);edxgIg185T{A z-t>x8b%kL5KGL8WS#q`4d*bzAW03=!;%E9NnWP^v=c`Xh+ZD*MZ;r_#MFyE~si-cWkfT z-n0Ze+i1?cK)EpnBRWZ-;SVJbhbQ zW2*`3h8A7xU~W~!xUt#eO1AO$5m<>X@h`(kAOD(XlBJx^NEidsHu_z#p}VdUCPUDB zW?Y7G3azAQq81#DE!sOCU50=te8a98IMp4GVVt5=9}zB6%`hN|`3u1?j1nO(QlJlu z4N>M2vdWVGW6)yBVMDS7pS>)Zhp(C}_ujqY-idwA{SWcs*t%YPid_J`Fna1eMQcmu z?0aL_hjnia8zDaV)#I0&Uil!}@cJp^lBCl^4!#lS+wne(M;QH1@S;FK~w{Cj5 zVEPfqo~LYcVm95Bw_s%vpl@HEa&3P0;-9sDAm%wJaUW;4Hf226PBCo=NWlYEcUV8%Q{NpHoK&g|Zx_}4SPK{(jM&gM(c zhxuuaO3sU4EKbOxIiHBR2RTe7Li?c>g{Jw=B!wp4tBF=7OTScT@~%*5;z2)UJjxVC z5NTlwj!MJ#F7=R?Xi7`-l{jVcNplLKDSVbfQ`7?rO_ zq7qGx)*FbX{F4-#@@G0kIOR{zNW??=->A@(=dTo+c$gl*V*%|{!U^+Ug(i6)RA`bb z#xU^Cpgb?UGMUOoB+YLYiwu&KihSRa{J{8TG4=m2;+{Ebfq7S5#-Y3OXxrK zH*%A~6wb%T0gC5*H-L#~I|aghiJ_SIXw8rM6UC7~DGbk!FdF-~<9MUO@VbFF8cc*o z!yCt|1Wn0#IhMks3WC)%!rk3`3`f~I__kMevyNUz2l zFZKVtO=nc7@n!&o>jgtV2ycEEUK;S|9>5)!uOtj_7Vv1iAo&QF%hwH>l5@Shg-Rek z?l|6G5uoOyb+9(hge&JeqR@6FZYlDe3YzkzA(!V%x>Dmkhlpf^amVp!%p}^bL^J`f z95mt4kj(L@OlrJCh@g8NcN~xI{AxTa+I=;`2#;<99FNxX2`>dda<`!|-6WIjKgH3H z_KoO@YGCeJ@YxlbE)+*@TNvLzz(;cd?l|8}1Q1R7A(w@UnJ1I%KgH3H+9Xdy5zp`n zBo7>qqx+6~0FX`q7Cyz17!dr@Tcz@G9L{k&1SzEiv9V^k&!mylFboXb`0Utp2*Er{6Y4Y>M6;J-s%@Q`9Y=bz~eX>xKV^92N9_cxKiO?pTc>BC{#YFdhCKbQl|6 zU|l6ON#?yG;yT++6i&hhB=R?rAHLO6%1q7ThzZJ@%`!4@4N;jjIEpMXQb0MK^uBo~ z9Sw*rHITfRF;U$*wtvb<^`HgpJ|_NP4t)qqepYU2N?%+F^|;jKX1POCo~wS z2xZ&VbPd%N+2UTTH)m+722+U_M<6*~&z~s;B-AGRE?^&t+7>1Fr2Fd|Jk1mwBe!GH zC_oNVh0C=IIdJOQ5OfbI5L+8tKg6pE=~mH`VHnGIA4{Y!`X1UQRWnppHP*^vpX80U zK4x3$u|QaAHRprDUjQ474Ib0lS1cpDT@Mu7aMR4okab*NniA_Fnznb-Lkg!8(9vlsy%Iuc@ctE z|6oVwOKP`pr64`pI<&~fg`N*NdWS!-&UJ-@Cs9{Bql3ZVjnL2U$b&^8<}z9Y_nTi= zyj?MTQXSYTU~jp5w6k?SXU(lR@X!38xR}~He0=nxVbSr3`%isynefTG9sYZayE4SD^d;}U z;V(7re_i_I-2)}>KFjHP#R}ugD!utWM1GbxmEI1 zns-H$#Pzj>hD8;?4S+_BT+&`*%w@?FVYwpXD^k zo|z`)Cklr(tDS2i;U%3*3zo5db*H{4{Xg!O@!l4DWwCeX^1=kW-0llUfU~v5O3aaq zqxMP1kRrf~VXWvnt?dw-rtKk0An_9+NL|Q@m7lAXvVvahQgEe1Os+#ys&1 zFmN*f-PRJEB~~>DE1u7%mAl>!ZEiV+kI%IpjcctRqlQmcR4?EPjgAdg4HC?0nuJ|U zcpxv<7k#E>9yTVy`@N=J!y0qUzYu<$`nMr6AB*q3JA747ho`#=(}G7T(=C^Kx-1jj zgIlmfPf8IDqmC9vKrI~@4hprcEvjsJkKyf}Qj5xcym#p^M$3HyJwiiw+S!%UoMp=l zI>Ru-_jg8RW{7v{4B0nFWuh*1sy-=b?S9t=0XJUPhU+{_ea3a(S(R&Fi}Ee=MpwAe z!FApZ-mQkXX*)4j*cuFO^GT5wq1=h?l%GTcmbp7(WOTK!!Jr=>)9Mc%*I$S^DRrLo zfAY@xS(knCZntomy}-Jm`B%nsKa6=--|@bs=w{)#J~B!u{)_Pp*4_VcbdYd#idgWT zLm{y|dt7_rvZCMqSaYBox9wx+*aE-Di6zLTMzd+XtpQ4`AwR-tbO7N-0|Kt8Q51l ztnJ3*-V><{4HUQuYXy$YuKnDM|GV<2#``|9UMx?!~PxI55jUd5ciez_GghN?|=pE7KCiG)} zz+ZRpJZ^b^7H~ydOb+gdrkkUVCL%tuNz>5eZ~XK5_L!oV1Y8*h;aO^~(94kYT-4 z7q2l$TQE-(eLAEEUsE)sz%^!j(N)1M66K<=8=~1qJdk6LBF7;n2l4D9o_+f27cJ(i zw43&7lYIF2Y1i&3_Y;!KQaq}w@d>HUC%rHtd1Hd6;?E7c{RwEW=G9`mX3wE^!!g|+ z2>QXK5h&LFeV_U%g?ZrxgJIW8M=I#Xk4YsToiO$&;~C~Q7|-I}g%Q@@+c3Mpc!p(t zUMD^Lp?Y-+cWS1@ig#+q4lzxMy-eNiidJb1BkE>KB|}k(<`<;S43h^v?EFNZFB$`P z%A4oWi8R4Ttx%unpgw`27PtR7%KUMfsXbyU)h<2()+#p_bKXxAAHrNgY)?$cufaq% zV+fLIJtn!q%*RQu6Fu#T0o|NEyLDR(+pZIR;`G$%p2gZb4Mn@pmy2!ufL#W$R1rGq|VIm$0K&`rN71v48x+t`zu|pEp?uz$G)!Y0&P4zDS zQZ^3-4+KN>hF}oQ9IbiRo}ukh^LD@Mk!C!8sV0@}T4l1z?n{UD=9ln6t81Gdt$FFO zW&rKe1Im1pP_eKILQvl~=zHn|vKvM*k(96QdZKt$QTa-qkcuC6*E}gzd)yU2tgSaI z^>vu0SVem@C4|~$U}K7gea{HYHTsRWi%_%tIbYEn%*)npde2~P`<6cQ)w0f~JO~vR z7w4bmgCFv%xG;cByuHcyPik*=-rjKkL^9SMSfA&gl!nT|3GB5RhONdO((7DZ=(Twr znKh=AmUzk$y$S`w+~w?`DK(~?79-(ldEoPgaf$0SCGi@s$^2K*qjOdHYue8nbhB)M z=%TAc>Z7GaV}gryZCG@+Esj_pwMAPuTw}gU@C1QOH^qy`qdycEzJ_hIG~LikROw4)G@V$ z&~!8)&DN*Pl#Xf3O-(f1AC5dp$4PrcD>hO+f_s=$6DPT{-JZmhSyEk#5m^ANt|cD- zl~1wx97ANQh+Jbo|BC%WWbAgvx}9-so6y}ZxSc}`QOli)jV&{r&~XGk|9%vk;xsLH zUTzqY;`~L5bJTL@$P{P7a_5K?=kVoDstdPsn7d_$+i3=kDxfFGitcU6Qq}cX$2E>S zQ`b@sG_*Br73zzY$JVth1rzhsnaWP26yA_hI1v-}tDEXt7T8cy4e@<57(Rm;BL?$I zgX?LC6T-j)TGkiD^GsXNgKq>VSl zAWPSSexD9!lIsxFijwG$9r3gv784rj0=}HB$QjjDl4vqF;v;dnjnl3CdI?2pl>!AWu{8xBxGw0K~0KN*Rj%vOi{K$aU`%+f>3)uf+_J0ODxEidZx?HQV#8VEH z$of4``jtKAPrBN^3PKy^7X?`%hiMAmy)5Q&-_Et!QdODYI}+Gh{gD+TZsCStu-5jW z<13vzaini277yA%UGBQa-xTS((H}T+YT5q1mzPy89_)UzJD^K0JT9>_(8nf-fg{Hp zCzoA_Tu@00de&dP#a|!oD}4PLZOxnC`J(F*&9(ZPH@kh&wIh6ywO4)gY;7grWi=v2 zRwYv^eXU>DQjACYU~q8^Abv0uX9*fLA5IfHIn@Lu3hBYOEXI2w+PCwV1Fw5jZ4PFgG531VD|2`@Iru9 zE=SS94*=`iP%}%)zawanB7Yqk_m#OsL1->fz{mEZp=Tp@$B}PRe5~T56YdR*HE7$b zZSEE=UZTP5zOhADNW({Ggs@SsHL$*bG5&DmadzW6CuNHUGd6sbBp#6^!KfP{{BXn-M7IQkBL{8&_sPqee=-WA z?47lh_S#Q`T2oi81q7y~Mf#r%F}rHDJEE(w@cvwL>l4zh@#2o?dYwGeMc#%%)brWx z_p68t)I*hfdoR6Nxb`l7y$Vjv5k3c^I6Q~0uAJ?hwjq1jof3LY_7V2{Z_rNL+1O%5 z#q5a0AXCx$*$Am^n&64_;Jge>X3R~d+Cqhwab|768flcUaiVdy19PT;23V*9ROGhT zr2OlIMzbbBbpl^orr_Do7_TvZtf@0AE1=iw*+L{MuQ^3Ct;JL5Ju<7({I=wYF#EJf zO?sjGiMz#WJ{WPc9^)%pO9?m>B~@U;JkEwkL2%+$!G_@+ZRaa=lL*i)^=7HcER3@y z$;%it0mbOL4vQtpHkpe(isT!>Ga&*EXMKbZ>xT95wYmwEdzNE|rfC_a86n-Q?`#a= zn)3utM3D#gWXhT{#`3wR5M2>d6Vl$sFO)f!e9BAFxgVAC(3GcW#E$`5dI0&AKA>rj zJZjc-x0Ksf?_5oH<$d~7iHP!S_$FR+Qir(q$biPvvLP63a&CHhuy^O`t*cF*op?wN z2JxO$FF%__W-VihJdS`4_n>|HlZhATE`+65U<5W`nI`{G(4+V0*h_-uS>Kd9R7*A$ z-L7?3!#LD9Tf)b*6LYJmeUWTPsoED5cpF38J%T6nej9JEwu?5`Z#%yy2m86wM; zq0P+R>Ta=kHv)`K z-)OFQrE1*;kJBBm=?qYNX`;HUPc$#o8lv_^nTHBZ5gzABoey(S)Nf6k#-nXdJWzQ+ zY%g3DFCLEmPquh?urnAe{+qG2Wh4dZOO6Xo0<>P+luGQ3~nUR<$% z<3DMS4>KfM@yy0VgDnWqo%e+iqZ{McIIJw$Oc9U9YTC67eV<0TUxn=l^~nRzapp1` z?(>OdCNH%JluLQqT%#`ct zHZ;i95LD+aGz^`Mhq^dmU?h!1rB1^`6W-YMXg#_DkFn^arpz=>#Is4o7_$zm?<|z| z;iPeivvGS>)fcwv#z17cuRtNx6Wa1M@)D&|ql@(uuwOU7AOE#PdtNi;7+ z>ms;-$n>*VANgglVoci?LBmjlmW#O2&>erVzNqR4n9~|Yk4wmlJ=uGrX6t6&E-jYu zdNVKQ|JT=y6WGg}>BO**;xx`alYL_Lk?fY)JF~aW-jH26ds((~c40QkY#$lZ5)3+7 zlU$>B1cODHXysW5W%Y<=k*UGlLG6cDvG{Cn#f*aK7Ciq!V~X$LF>lhEYlN+6JW*Ij zyFLQh$Twz%nZhSFNJ#XF1d20#+*J5W}$i zPlG+d+p!Q+^-p@k7pYgHML<$ZYm5CTpZ-wK_+A!PDRa@-vsk%cYC!H3|DE!lu@{yRz^y?BP~BI+mW81nwOH9pO)*$ z%E?X7o}8AMo002qJg z<;a2#(^4Jj*=ac$IeED$nGUEXH`SJ#=15P;M=V5iWaXy|8P*g>PG;U@ux2_^b2D<% zGpLLy5Izr*q-W=4rDx_jveO;b)N~sZnFFn*BEPJxT-1xhk)Dx}ngd1Ha&xjFe{Ra; zw8`oDX(_h+JQOl5%WAddWTxb0rDZu%vnD(8Y?Cw6^E0#Z(lZ=6sN+0aN^a_8Yif2* zmcyEY{PWVYQ}eAkIXSt2&bQ@F&dTh{-lbsx^JGBOkS%lW$A4W@SPf z8Iv_|)em^4(}F^LIrUdqOqV&>)DC6tX%92*N2#-@xI5f?im(K0eEE;$y( zo;)_q632`+GI2~i8jfXLB5HbU+Qw*Gpx(t=#>HAv zEF;IISdvpxlass>jyJ{RtSp$jXvsXXlEo5_T&0XnOGDL8P8c`Fl9ZM_Zsgc8iDTna z$EA%J6Q7ovl7#k|7@ruQ5{t$+62=*uGA1r9EjeNAm@y+zu1RPBV-nIVBga}$Xk#s@ zW0R6bj*Ckhml*4nbb=`+Z!z*LC#@{H5vG`;yhR21Ii~s9Os`y9UVhFzlWm!40Ja*x zbum=V!8R}ROgV*xOA3dY3Uih%FI;TGa*Z6*^`-%qWGtSixtgzFBApEv&FcR$0Q2`S zSCZy-hwf?_7V!6}CJjBL{|DAggwO;&PQKPmh%mZ$TqD63|8XH5o6XrCL&s*aE8WUj zq=ZKnXeXUyZg+swdF?1nZslxHat~9<k4_RRAY?zC z*ACi*pVBT2PKQ;WjhLfJl#WY_oqCm|^E!cm!P368-MR@NAWP zzRG>4%DqJ8E>gLdtK2J8?z>g)dsXiHRPOaE_Xd^wA(gvAI^0F}x)E(fD^;q(A5*#2 z;hRS**+L{u!aMrbgPPc1bJt9W{1?l2M6Bs%BtB9|vW!WR~Bvhb^=yEs1e zgJF_MqO)d}_&b4q_H}&t~qy(r^L=jlva%69Zg4|KvwO8@Zd7`-I`d zoGqagBKE9|m+DpWw5JNuI$UAc!*d*$kA{DklqB8E(<2#TOSt?{CV!)p&fP1SyG)wT z?J)xR3X|@ain*I=Qkaw_?dSM#GQ11Ce>#M64#O(-5}LHmiPD?F-8APsOd2mOR+S&s z6Cyc$inK%(-;cX#y;T@i63tM>k7u#v^;lsz!RJ^I_rQ(Pf1SH0f)A7aB1Nj|OCWdC z>a{RwuJk)E&tm4bN$(X^kp>w8n*~H?x1Sl&wnt1yy;K^8CnnC6bP(R|0B2_Rz*u@!*mcll$T`iyWz{n1<}Baw+T zq%ero3+H7pk@FPJWNrWhA{ot%jAiR&G*+3Xswmb!QvD;I;tk_G#k-#KqFH+Bkb*!E zvi~65!g>9qDo8x( zejDd0FY7o@b~w%XUbxfwXCzNDw9buq!XCwWlHbC4((54SNiQwxILVVEE66gfW!!q)RO4ksT?4^Q2b_=Si;y&XZn5Vjo~iPeX64J9j=W%1}zQ~^_85i*$OnR_`80Ku5XFBwh`Done3|^1?9kM^A5l)%n zq{);S=1&hVPNM7>zEbBbS%AsY!v!=LS2%c*r7nqh3MbOclke1A!y{#${))0@bw(JL z{CPd;knRFGE|pXGRWhH>d6Knp-jgoZnc*n=aBg$L(JaIt5UYoG%KUJ0lTx7RxQHi= zzi^)LS8$%{&wZRHyvI3DctoOIu>P&D?8p4`WS;4kEAxb_$(MOnjwYEOf?GIvk{!W$ zPae(i05SZ2GEaX+x+d`9RG~O^YFlm-);0@dVP>B+nWrih9xd}j75uZDC*6*6o^<;c z=LwI_ZKSw_M{=UvSz0{rEG=H{tSorhQ8lH_c8FM?!25X<+!|{1AW}=zu^8eD$ro)L zmu3QESv%73{yc&Fx!tHuiMBbK_##BRq4_Mc2Vx5-rE(`5e{#PfRC z1$;O)Xb`hAc*-jqJAo%#&BaABWUFG%Q@%HFp7On&^Sy9?o%58=-#Je<_=58$+<)af z`Lp&2eDc3WBd0~SxsLPXe>3MPAM-g+He1DcN*D96nVw`nHa-C++3!{Ep8);<=gEF2 zI8S!{j`LRVe{i16)tl-kaLBH-_a*UUSF(|)C#bek_%Qqd1>ho{!kNr%Wkc@yr;{*a;c zBPoyIsT>D!o^)BsdD7(x1rMjEuCjdbx=rbc`o{7#k0gPOOT7EAe5EjNxzBXSyoqG8 zWj>ntG?}Nk;n&JMYn$LHO;#ttQ<`hJ48=Roc}hQobcPJ&%glMgvv8htp*WA=m$;pK9F!Xx@q zIxLlCnGR-|XJwrs^JHI9rcAeZ*`MhK-lH3Mk8a>Sx`8L%R^bWKgeQpEjrXg}ZY8om)0x*{rt>)2U#T-|*9qu{B!PC0}(_d+G_%DM$(;xgT=%1MW8)O_4 zZlZoh6Azh1kcr_uoyjwlcwSx>?tc&bDcdAp4L+Ik5)3k$_y_O@WW_}?bXHCp=U0JG zC%zPaK$CHi%){`X%6Zxob_VCWBI7fOr$j)rafxSBCh_;-4`?1P&3wj63y25i5X8;r z{7CQx#HYzJ%eens__KEb8mNM(n+^vLZ+Ywro@{32{#16PC&}n>pT~Iv?u1GH;kY|E zPw79zc}k!4w~!&(1Ki()`(e&gS$)p=XxuMyp320CvLyVW;91`V-U6Pz4}wnse_-&j|1OJ*r{tM2h!=H`Q5O*?o4a%Ev$Ob()Pxz6Xp8-CO z^Hgq0oTqXd&G}65DV!(!ZRR}TJj?k7;Q59|UYixsi3ajf9a(vcZG|{X#^FtNysCUC6J-sD50Aw#JxB`H;LOQHk#d=cy`t|!oU;(V^e+@dA9LP1|BUSeo0(7Chh=z?%1M=R@i*R z%3iW~-dq;cNudy*KPI6JSpfGRootH6_5K!+$>ASPwljSah=aJ}8Y}5~-2kguS^jK;S z_GJTai4OSmV7>x?mqZ5u>gO&G;4RSsfcm-119(d?0K)Y47J2U&(ji58AdBXL2f$?t z#fMl2C^kgBB9fQXpWLq$CXvq&>%4FGI%2FK-?l7wN#P>)L}h1>zI|24r%2P^m)*i|Ns|g9dzp=G>gSau#DWNWIiREJZB&9CGI6DF8q~>;&bYZ=iFK;dl7eM6>|>U8VqpgfdNT^o~_Z z1ay)bjU>@U66BJ3ogL6enNkTV(`NZqg?EyisF9aXODWYMA@qNpnGQN!#%vTS(6UjP zmS6*6zH6t)-&1_(dwmR=^NZk%-f)?X?yDBjT|j!GF3Pt_bLTF{BX3?_JoNc5ZAE+o zKK$Twm4^z(V6{5@1mQCZqcAYU2XHrit5K34cRUV8EhoZAMDUM+A>K-!psDx}MBk&{ z#6|j07`a!2QR2~eA^uYkxOTkdD!kbWJo=qW;9VE!jaQGbAOhk35&;sD~ z!kzR(kO!~33eSzO<+ub1ysj!dy8;>9TN=;sxI*AJ_G#c<^?ESK_q-kL(~w=(h_V zN<0_vqTxq)Q9O*|ZN{aGxdVwW|Kv1v!xxg$w>( zRsWo>NSA(7Avv;Bt_tsI1cbp~kifI4@Mb9R@N=vO?-6v?%JQuTfWRP3!9N5!;;rNf z%2eP{Ia3(vN9V*T@m@oKuX<^m1RnjC@+Phk zxP*RvRCpH){r7w60C5-)q1d%3{cW1omtd-unu?8x?pzhj`O|61>PU3{$LyML>?)g;Qy`a5AuOW_9FX{P6F?J6&{_VOXDg*0`IU2 zZ>0k776=Qx!QhqoeXA4w2Jkpm+=nkOUh9#i3c2fT?07esPIB6!U8W=WxsmhQ96PI9-Sjgyp;!p11}mp)tC9W1YVd5?=676#N*IS;B`^q zB`fgq6nKRyyp?!)qkc$`z+0rkn+-hi{Jj&xLcd#7cxAxbEx@=OId4|sRRS*^{*>QE zxCGvHXb;NrP3P}(5Md1s>U%@I+rr?kE-BWZ?DSap)%SdaCfgQ{XM- za)kGa3U40p$X}4at5xBh170+QNWUUnBuDX{RN)l>kIGAsz^hW>MPZO8@RmbZ;L*A8 zO8e28JApx%f?uJ+vjUIwA^lcxIdacY;k9;RKWq)au&szgG+BX1^Y4UyjaqO0&UK>S zYmlQjR$N3g6?k{UE%0hoco%>-oW+p;i2QC*;muRv(f2Na*P!Z$hIaG)UEpQNDfKG= zo@gKUD)2U|@T|b=O$EeB==Z1!?|I;f_E8L3q2C=UyxACxTLl=GBj+p?-Y>x027fBw z`)~=o8&!Bu0FT!D3KHxn72Xrcl5_?_gm*tKfme*YDeK?+;c}Q7Zw-Vfj+F;IfR_YO z|JK7#;AN@sjswqE`OZ<{RVwgG6nN)V`3*v6fGm4R_^p6kuGAoQ;rE>K6sPR$-sjs)9(o`NBAc6J4*Xq zfKW921&RDdLQaV{6?iisMEQLZ7ljetdGxbNJQE6cJ9%&tc)vnUiT5<{RzimGT(|_@ zDV2VQkl7f73lexIRr*EYdP^m|%?_Z8mTmHC|- z<-2@OL5_5=;$n0|dwDzy524>%D!iG%gK0cOazt;a@Omlms6Q8Y=|SH5Jpw#m{n{AF zDfP1eFB&*xza0v^!799`fj0@^f`onpRCqIhC;GMLAuRNJKvf=RfJgOIkic87Dv!0m zBfF4(FW?e*c`Cf1t0d_z0mkLXIZuV>23|V+39lBHzQGC zKoCCmi1twjKY_PZh35j^Ydj9!1YV5_Z#M8U5l;HO%;g{=J*R4Kv#<88-?OUr_L@S! z-3q)1RCsHE*NSjKLcjGYJcG4ezj_FZ{L-2jrTu32_5C~=2_cFD7)AwP7Qm14y9bxR zyGn)kKJaK?1VKW-UMjrfDd?9u9@$&qEka{}x93~R{r#}MR)D~t!syxqKe~&gPUE9} zG~9wjl;0pga#Yue^w-F9{bg4>-e5jH5dH;_Qxahi-GTRAn}eX`4oQR**h)Sm>6}h_%5uYUmNyX6NRI*PL$-Iv#xFJ4@@2{;g*+ zTR%@}ZOuIMgQ@k$SnMS4`oZFEakm~axDO)@e^rvThfMXs$AgZ1>mzb4i(I?U-MZIM z`-Z9Z4gcCBnYFu8YHKr(>^0SX7VF+;avcJ?0gA&MbQDTjM)+^SCP`uDh%Ys3&QNhDK zvHdQ#?|YwYe^l&YJQaHwm#lxuZ_WAuqZILzPCf{Woe>j=>KyT_Rv#GUTyp^1!v@+9 z8uq-8Gs&bVtJG3m_OaokW2d{c9x@&1vSCN$-d7*}bR3#rAnkF=>LdRn*Qh)NnNdHTFc!(7%~?7 zZK#So`C;X$E&dTBal%j3hBb#yhSYvza4RK0`sLIV2{t*bS675NS z)tTLI4Yoh*Uf;bt_FG561@HLyc$X8QllF!l${5;~)X>GW-9=}vPz);5t=fnp?a-hC zr`z-}9owZ3sSlO{t+noQ>Lr5d+|B2zsa?cpjFHcyr5Xf1aFon4gEc2*_gj{Yx}@Ea za=+HP&WH|Vqi#n-eP}~4#dEGtJR8w0i8R>`)e)PtNxKJ{*10ktb`K3H*a4e12T47x z(kIom`%Dc%Qi#=ETRzDdT9q+Nw6BPNX!SUHVqehDLcSwt#=<*EV4_=o<09ZmKJoAGtBOS?B)7(5x-}3KLd`yqiI{WMH<9W@qMvVx1X&^u z5^=sI(qxHLNTm9fm?29{hs1Q>67yt-AT88>tH!Nk69x8A&f2$%$Sy4d+u$yciLwwN$zFee|KnwWTQA$f}l*S9@z( zLQz5}!$tXp`er#S!a+2Weu8hd4@7&|FJmCzx*vm^E!> z%7k4`zmn=^vr}JEK2wKdk^+z0zW2W=U_mT4mv)v&q^T?u>G_*dXC|Y zg@B#@i|ASAb@Jq@6?lRkd?#A6?r%My(QBu*wQV;y7-23tC?|81tKdF2j-m=ii6b2y z{G6K7-P?>Ue(cE0j2-?FxA{AoF3iXC?b-jk&$per_AH3{z-&@2t)eqOV%MD02W<(O zkYat5&R>gsruI=|#Q_r=D;|3n%)$XQY&vsV?DUO=Q}is>bPZRO*a{IO7Ly8#^R4 zG%X@cyDb*R_h+_P6tYuWp8^Nf%gj>4mcUKD-q;z4XA_2Y^0~_x&rbe*eS@DqnVwj^ z=)vKrHdU0BmPE#Q${%M8;1s0_vq2xSeOgrtPO&pPQ%a0D>V}s#4&6KH|9!wk8s;FD zI9o;7C{d%CZtIb1!!c~#2OV{oO(>R#}jpj2~@Q|7SF zEJo*|6yYISX|OL(p<@n%WqF6WU&*vpXKS|_C!gECw92-%USue*yuxg*u!TqcUR7MO zi?X-28VANCyPRDW9YEgDQ2ikN`Ib=oZbxl{JM&J5dsoW-Q9ras%a7cZ({=_nRJTyy zf>TOt#*)BHd#1x?z_D?b8LsKJh*>yqs;6uX4DOoD;V1o&jf;LIpCd}a(=L=a42-U4;~C#i6|wW*j$bIP;jXY=J3qg>%>Xp4yB#At!7N zOPwh=l(y1nUFU#Z>s>hAi!vC{6XT!CX*+}V1-PEGM0}~+)crbFZKkU_#pTMZ-CdH_7vORo&wRH{4UaHowq{htH0_*N?zs^nd-XdS^6G+XpI_|J8$_L!}w>zM19tFC5Dn%i^ElE+q@Yg)~a226D%=r(f6ZnCgMPGg{=p0ok6vg1}KZW)1Z7wR=(-p zq~9N-Et?XH8g5?_yXLounr_sO!?r<9=E%)Br?&Qj`xulwIkU^u&)lcXeK!9fKW1;k zV>akjJZ6JFdVNwA1~DI9s4@4fGxzbB<@C{rt8uhl)E4bG+v-D_gH8q%oU|O-Yskcl z@m^Cy2pcXBy0lYQXO8kjg2G9?`s42wbno>+*1d-2;FEq7@sOeRHB&?IBqvL4@Fg6% zM}0hE?vISB56Xn3PEJCW)Il&y|%!Rq65g!#vr z!`J}eWC;2B({SLJ4K;_(pd6-)Ge=aIdr)P0J0hY`x5Z!YkM@lOTeK(rlY@_Z;f@J0 zJ?Jh8)%V@l?ZbG@M*nMW&|LH{{cKXzq#f*?=m9z)kBwEP!vOyEpEsGqhUrTh0UrnD z@zxHDOo#3m9oQ<5uJ3Jjn8V4GmoX5uqEZM)OhnW7s*JT)8A!=N+AaQo)HVlO4;hY! zeD7EAgQfMP0iR?Jgpfw~ax&x+^_qr=JY5C!VX`P-$Oib7)!9!Na46g7=&?ylGDQmEko_#`a5wQq4AVWeB>Kk`QLOo>^#Z0foqLAeo!a zYr|npOZWM=Xpf1r5MlDjs`_eYd2=xi5*?S+hMwhrU_*QKOaBaP@1#2JX^%-23PR;m zxM-aReFoX9d(__`Ze-+@vz83y#I zhSI-AYSPJW`qmqUnNhoBC))>y_AGyrP%PxIu7$WF9p`3KA;|Do^?c{urydyOi7 zqRQRI^M4~`!=!lW3vS;%%$+2~aymyD-1L7X#X#w7+hia#p^@v?$6veOGA13(ab$v+QIS3?qN~}+l$F-pJx2-Lqzi7 zio9#MKV?_bmn8U}UgQCyZ~0;m=9@Xsi$)T0sf@#Ue!zPC@so{be`TdV{r*n-B@@wa zd4eamz{E5W&pyXWf2JoH1w_3J?PpBHF!|gDatj=#Jn5|&LZR|pLb3nxaJY#l+0Qxe z$s;vL5W^us5W}H@1d$FJDnt;OKzkP%t@3C45{d13I&K%j zFjzW0NW^L52dSA2;1PF%UyO6R); zFu0DQz9CgRv~;??33=G!~Vd@0@t=Nztjv zyv2M&iB808*N09KeMUMZKa2vf?@uvsZr0Jn_mQt-zyK9f3#Z8z}R;5&;5(a0I^^Ld09i6Ld&{N3Tm1 zM*01V3Xi^(6vJPTz{^nK9S5GMFPPTp!K3d95cTv|^x`Zq2vhLgzz}aGPtX~KekQmn zjPxV>EAi-C)nfPy5_sS8arte>Z1YUzGzw~X*S3mx;D!)M}3{f6202TSIQsEs3UV=!J z%aQXD6`o0fNByP1dk(xZA9^U~>-kZrN_RBms5}LU{4P?Zn~Zd$Aw>NK;fi!`R^icH z^zQ{2mm}u{72a$G9(~pkc>hK@Df5wxj~49RpFluDzq61d-b$VzJMb*HlYX(d1m1oX zUOMpTd!itL*QCO$Rp8P0BZ2pk)>}U(@Q`H>3A}$mj(95%X$2l@*Km)(CGhH0cxAxb z!{g9R;O$i5eFr@JXZcOya)ckFDv!zd#^%d@{Z-}Rhwoa#ej^ol{wloLz^g~NAfX=( znw0rXP~cq$VUb@tFG5+q^o`Cez_=Var>NR*XKR}$LQa|PJfth^d;`ZL_Yf5xt!?I? z6Dc{5od>G$3KV!&E=PE?RnHGP-_MtwZ&N)#)&MUW@u{AsD)3@dcx!-1zl#W>JQDR+ z;kgucPD41!k$zRGdLM+rh_8D3h^pQnQRH`=0&lSj&j38CFM@=Ac`Ce5fG6r{I)sIO z_kmZ|11s=`3NS85PCr$B$%kBw54rbLa*sex=)`b%96G~={H@&miz2_1;V1NaR)tpy zy#726-2`^E3QxkIfb37@do!0KcYl;6L_N>n*E-SfYRD<|(<|_%D)4?+>E{MsG{OZ5 z{eDsD*Gqvn9l|6>`c1D@Rbv0u-RTpjC=*+2kj}${?p)b3yNUM3fIAAs2y0 zgCgE9iBt2YKgZ*W{ zN3&OM$+IW@aP?<3ukU00#U3Be=)GR`@~%L>JbN92VSW$MvuKjX)n0C7GP=-RGE$DM z$b;%B5vm`P6ZMMZeAO!|V_pp4r z@M6Bcflmpgx%d$^QXK+l&V8$AuBfoR)aKzlOk$(f;kr;-T+=M+119S+yMA8)rn^n5 zX{t7CuV(xfzf_mIYS+NuqsR9)5ByrY?sknnxkQUaFCr$=!_502DX;vUu9808XBZ~X z?J6lBUlpkjTJw92>%xxenuAj5j=B&-*?-vF|XJA<-bMwAbhe(%G9e(9QLn$yJ|1 zifu4ib{HUIuhL-sBxdJTxE|PCUU5KLSXB}{DL40>7Y5n%LBg}NYFlvq1k8@!UNXs< zTmKbH9f@UORY`MJ2&?Pr_J z(M>kPG4lY-?#wa|%(8`5mb*)gyD-0hT0=_dw~ofqKQ%|`f1O+(^+&_!sa>U^SV8K4 zPiXz;wPOwY0;O=Plvr&Y;+C{lS3$XDg=JMY^1G)R9+{T%f+9=Y;R`rE4Ss9L?+Euh zC;P1?Kex5KV3{TL@Gq@G*D9MyPTjNNYDd{E!D#?@9?{gYnW z+Sh1r)0{aMTh`_(Y#jZ~ij{$@x+0?Psro6`jpLgPnr*a>HDMfzZ3>Y5$pXcKgZ%eS`PQO>iVMv z@46+uwZ5^|R9;qL!AmRrpR9)08RpUN?F&^}@_U&4TDjjj+3#`kv$)I4p0G5%{Y#a8 z`rC%c+&|LRKk`^*Y`uB&$_z&j;^m>x%B*#(}Sh0J@ocRHD#5twNfCH#% zk!>sf_C-JQkU`LXD762{JnSbbq2W|Qr2XSnjT>fFG>$%X0Qy(>OA&db|04#ew^e!v z`j_49mIAG&+H&_^OG8)keWMy4neOu1*DOu%U1-pg-%I3ohWnk9{VK@MQd?g3xTWsB zU#db+y=RELm9(#9+W&FtaEv}+Wp%nOdFk}7P~9l2UQp$#YaG3BFD*cf{9#h=hmW<2 zk{Bu-Ghch+Y?j%QWy6Hr*y%Q7oH;HIIca?NYviFH%R^VMJiJuhe6;KkmBEpM^4eD| z4O-Io6=qrHQP^~$A&~rbliyVCcTV=(LVlTY9-5Gceoa)bC=ZUqqxHd1RL;QW=3}T* zSLy978h3MS!6Dc2&=dMedn2oos=lZ%w`_1=p-X8=rLpXB$Hb~S*V;W*dMu6FqmI?A zN10Vc?oE39i>uD`d+`&|ze@^2U+>gnmhg6qt8zKI&CQh+!IHf}<8uF6;cCN@@}q5S z2V0u(%6rI2of2DS{yF^KgC9CPOg6`=^2WBd9naTScq)D zsHrXZwQPl9^$(};O8bKm3%P60rIfW9&L83k@0rRTH*9t~f+YI`CVQpvNR`P|Whrz0 zDm54ZXfL(cx24$YHQ>uOTegL}wp+G`m%)p5hui$%iB)GMejT!xSggHAJH63QA3zT| zJj?vi`vyrehh-SxhlON>1z^oUpnk%pN{v3kwa!@4=vTVEZg6Zv&$_{J4cF8Sj&De+ z8Jw_ve2vS!V|&y7@VXbLZqb(>Ja*^;*3t&U$h|ila5SHLweoZgqL$Xg4BI}aCT95d zku@>bZlBA(Aj7+`4F^{6?=aO?8A!~j!3sN<(^MIT{8wtLj7@&sj`?-1@zW1VIpx=- z&@VL0FXSh`py__W6@GznegXab{8Ih=OEe|Z>}f_*nn{W`+DkMRr^)Ix+0#>M(+p*g zm}o(R(`ZlC*w>nXUzt)l$X;csvf1x9o^hI_T%-LqO=gbCzRqM{kW!m#D7Z^RY17yr zG8H&Y=TgqyXm7LpzSRDp5$fTIY5$HMm#0(g8%_4(DYa~pdxM#$v`2#{oZD%tzZnba zoyLaZrpEAyZ6O=hU^|556#UG2N8Q`uS&iX%R0OvANp){W?F_`@inwTx-%yWVg2!(( z_lx-1&oRJ=Wkkr?i~eVvq|`Q>%V{aG)eH!OqYUgc$AIw4Vq|#RQVLmGGoZV@v|XM= ziu*NLL*q}Uyz^08&D&{}wguDbi_a|$&`34!g)h)JL+lSB9v~D42L_BQ+{c%n z?$i3M+5d&bxnYnxeHkQyfz?tfZQly3INH3e+MQ(I*!t6yF>B@|Y$yMC>i(v?N&a-_s$FZ;D(N(gfXx39ma zt^;d^2F145T>UxwT0=y-)bGWQuvLK0KVq#>AH>%cMg^5<%x!H>bLnH~S4y8jAA#mt zy0v1Wgn?T9X{;*LwFI6FWJ?LrKC!A6 zuswX5BS5MMU@ejGwJcoM9-hLq4uICQByFRvbQ8virLWY5qW`nhOkg?trmoSj)4$p1 zm75vAcnq0nlUf1>nbGvgklFyVw7_5g$NcN=iD^6#+hB}%SQqhrK#2yU*o=3iZRUE- z@z_?KRBvpK4NY7401X=h$&wYRQboEHxvqABA+lfO3Tz>^&wBi&xLEA^cE19wC8}KD@$ZM`b)q zmRO2@z2qoy)%3?ke;Ube7jd8G6%Q(}N|_LA%`oIm%Uqh`ns3~^4oj9IDm40_^*#I> z+uGJ)FE)Hq#>(8bwmLH{W^$gjC)HwYW(*dvR@zGQRu+RPtrKdr=$uC(SnM#?;l*OF{17!&*cMa-`PBsZ)0+ng1TcX>g+N|K zP*6=!un-7g0-*|lg%v^inxHO1peqC%LEZ3BVjZfU0RPDOFZK{ed zZNWq{4h>g)O_nys*NSRbkGnu-Pii3o2}xgC9fhSBH-WdubqBhmQw)jZOG? zaEQO(*Vq=cf1e6sAXFi+uqIev7u-b%bcH}ga5s#N@o2}_ zf(qN6gPrSQ@X|S-shG=DgfXDvJW}z0MKg4xbNk=Z678kM$EYQuMV{ghPFwKFhJiEY01x)Mu*ETKS!#`ubBR@=Z%fHY1an~3oIxy z0BQj>ik|+v*uw;WJ?-3*l9FYc>t1WDJX>1Tv92_suC!OjJFZmQ=3J@1&hA*_>2q0o zb^HsOPD#gh@BMUIbNP;=!gkN)d!7p0UpsbP-cP4{6_2InUF@mpEVi$8%?!#|??;V% znZvnsbv^5kQ_=lmk1N(sq}q%VG%W5K-eKqS>N1;Emwo;h{hT)HiKdM+Vt)$;H0{3y z1T|Rlp93{x^;6FBd$bX!sp_B(z-!kgG|*uDDn%*i{7>fZS=>DsTSI9{L8cFQwo|Gp&3@Xu?`f4X4URkaz;rkDQJcu@nQ zQI_W}bIgelji&$D`6bV_{CMe;J(YLOh@&6eB<0s_9BHo$3JwV!cun+xp5Z+rBHP;f zwD}-E|A0V!m#*Cm#<1>fy?VFxjk@Y;A7X8Ucl`}Fj;654UcLMDH<|kpPie5Y;E~io z@*})a*Cme>Sd>Oe>KH53=t<#2Vg?Nc8%}&!cY`q$Al(qDcb~{!S6$sViu@>y$YdIm za?{w!lP9DM8#^X-*ns$XrkDXmgGQO8c{$lq&f;t-*Or%`GcQCcz~UCVhe(PzV^YT` z<0wOBOdl2-mn_ic&yP)>@mO9_&}{)3>EFCQCV6!J;OBn4_tOC_<3oR2_EhZ4RSBAx zzJBc7&HsGws}CO!Za8|^jqctbt~p?NNUU2dEnC@#*Z06_9Huxy~sWhfrlqdO5A&<%L}!y=$d1ntNH2h{D?t6uC%`W z%xA9zrmyc75HU6A@P-YyXV1*ensLL7!ReOgZhxz~#yacPi{?iUKRoC5b&nsN{Lj>R z=PI5(IsDCkB>jEXn+cVP$Jc&g*!kIlwO zWG&eB>Ze1@-%kCaPv)(I?s@EByrt#ru5}^z-P!p1so~bYJ@)nWe>E08+;i{?!%AZN9iXp z{|D|?&E40mxcA11J=dKf_X`WAp9?e0KQ!sLXYRUn#m`UvH9BBr&-1Mxj``rdzHzsd zXWv!+y6%ptrfttJw%tGIch@KKZ^$M@jmA~r82a5y*SP=r<^8vf_(uOiO8+14e0Xf{ zXUyMsopSS4ITicX)xY@Ans58QcZ21Vxp%xB+UMENM;`pg_&L{~(A@sPw2b_lHgwsX z`^TZ$VavjXn9l54TlLxGcbgLadYAvASGUI=?dkVn_{>qZPa};{aowJXxTV)m{Vt^) zu6y&9)#cGar?+KZ$eX(3i0hu}lB`WL{&MxBt!?v;8Qzl8pZab2$ECV|eH47-$w$`D zzE9gSu`Ir5{=a|Ta_<|brayjsU~|$t*A+juWK#Fnvxk4ZYU=}kTm0ICgMR&e_q7*a zp0%BV_rvoci4z7d7@d6fX=}{i@7{Z0OkyO58T z+>-Uw@SqoCYL_+bOYE0C@9L35pSAom?V|HN`#?Ge!OO4wib4(e7P==b;|=G=e1_x)GbUAp(}r;~O~E?>Oy zF5R$C9~*ejJG1}()0EyfezNMS>EHgm=#D?~>dwUK-#`4ospZ=z-nP~_HuBdmyB6&@ zdvaEIe#MLHoy4Zl7#zi+R_FJ61<{w}wic_QbVr(SsSJNvLZw+%^r z_U&~y#b3;w`Piu7M-3~Frylxo;6H7BZoJO1`{Va3PjAqE8#45&+9eyEU3;&;Idr>z zmGRzwU(NdbqwAZ){FcqI{PpFSTNg}y{m5If?+)JC?O;J$TwYL?6n*rMJ>QQlE?Ttq zZ$C_Yb9kfXUjx#s8eY2l_xIlTZ0Vqu{OVCYNkFK_$ih5mPredhZqS5>TgaZTSFKDi_G*^&R4bK>@C`5QL>QM+u& znYEw2n{d~n?MMB>M}2CHd*YU#E**Yzb@b`XydAFUtQl9g&NE0)Eie67@X7V}wUib8 zd&?Wsk2k+lyrg^f*IWPg+MwUBeR*ZTS4-c2&bhI$;oS3ygGZmW{(bM59y?dq9p7E^ z&-+K{Q+|B7x4G-hIs57#`u07`+_(FDesKKtnh!E=>XLhCSeR*7)#RqX`o9|6^TV08 z$f#}+z51oqy;2^u?ZVU}_mph<%cE__-b(-NW8FtLJ~CT7F@FBf_nvxuVA6GuO?rL! zss|Q7`0MVAvnm&k+cO}w=6v9-KZHzJkoJj=hIY{@~+RSa0MZf9(+w^TM%bpZl$cGx+cn<#cW)_+U}(Zy$A?H@(^L z^ALO4s()sk`{vm6p?BUbP%^Lo*3jeN($|L+y>RCKdsY(FIA zzqlo{m8Ls-(XK6hTi#v%t@GNoPn^2x{=-F2{A<#X*;|UvP8l|5%X^h2EuT$Y_n0!m zEjao+KgX0slMqacismcBeDbQNBaJ9%w19y|BnBjXJH)wyJO(HIz2f{2%sHD#6QMYD z+yg~9qk`sF&}^=D(qRvdW*(m&vl^^8f13~QTHw}V#|BzwL1e1en0muk)8YxMdh54`T?qq4QmwTjiqnCRW7nW~2wu3~wmyWHLSGuuy zLP0tyQsE+fyo*@pHDi^+ukq}X;zmpj_RPqEJxt)~qWllw_Q_;!i-g~87?m-1oRlRy z+1xY@X4;E6ftf6Pv~&}fm+c)deZuW0yAwQfq-FOA>3%Lxb5OC9wDdm5m(#mJ8pq?y zZkk2YPCB-OfYLp*-2qPLwE}|NLR(o(=QRVI!bz)k(jk9J(s_0emwk0?XNh(R9iO2o zd~|H4zi<(LV!H#J4)sMzIr8t`Y_P4gMUq#jZUZyzrJHw-(5 zT+7`z0w_$nN($xep^C|yr3RjWgSiJtzo_)NLFLA8h>Q+mo^F^li18Y3W_U?n`>`a; zvRGo_y&nsgC)G6E#1vQ4PnIV;X}ZaLIPv{uz8CS)G9N|!0GTIIT5m-(7MIw|#irmN zO#W7#fQ8Ug{$ zz@?!@GoYEcDDKU;&nA8d{(v%ZX-GlPJY1S#jFlD;Pn8Iik4s}E4)2_}G^7A%87>X4 zGxT~(`@IkmH1XlMv$_GE>_>3qPim7Xi6@)Uz>Ihk?rEGSl_qeWFcx#(4|htJ^}qi1kRKGlQ~au@8mq` zzmoH$Cw?Agn6tsJ=X@ska?Vp)k8yq;_{TY40N%xUD)VPJzX1GR&O=4EZ<(VGib)?>S!CQv!G}MV*kYe^SiEWosxHs`DOcBcmQ&9@`{$_EyP{_y#G;S%y|Mm%bAF-YUhD zTnEX^0@A1FKL^+@=^Kz&rmQRCwF?TJX;%MbnwT5`b>K>xDg;$an?$u4cME~Yb^VqJ z<8MltJ0?A4`YnGV`Rv>*d}IG}8hB)Rqbgb!o9IavDkLZ!@k&RW$B|vMEWX`^?8FY| zqepbYe}bMyr;kULhx%ZAaW^05lP4avjObZRJRSp#=((gMdUg=?f{0M`_Xt!;N79ZTZ=Gy{}UweW~uPpz@u>j;n6#Tz@xoTl=d5n3PI0)K?0A)V#Hf{ zz|aBmc#-hv)k5I8RCuF-*TUn_P2fGQ!kewYqt_FGN9SHD_0yxUsGI}|yrZi8J^;LE z2$6nNegf}B6<#mkRSGaJN6sB8yjlewhJYSCJAjq?)dCO0CJzby?gm4=m500!Jjw^@ zNAGPEM(*3eDDmonNAK@~NRH@MFvMHQ0cr(aFWd}Q6X!U&JP2`KTV!c$-%*uy^uAtl~C zg?|0H9O0F!@Mgf%K|q`Y_Wdfn0tFt5#-rah@JjuT18=1O<8tJDit|=-fYtzy&i|wO zat$t#U(!X1Hx-=)ecurz^t%Th%KUx_kOZxaN3XyF&kcs~5X7iYg!*S!+5Zk+55%)z zBIK-c5c^9QCS2lNVu4o*IT!o|ksMJW7~+N8U^KEA79#%_PrB%Q-0%}5qM$jj=t8a+K0IX#As$9fao(noTM0Q|<#ve25pqH3qoN^6(FO2_4hg2>rlk-s3qv+}Z} zPqJWHJrGLcDMc`d1($_ylrJ!7O>c@E{Zq%M20YAvZOE&qiK z&KQistR*^0p*2Wa6tX5RB2nv%z}Y)aLvDTV!u`n<8i+7BWrkwqhDVvcyVO)75Nr=VSYct z^dph4fyvr{fs(T(Vw?ZA3VraVJ{o;*SCz5VX{>Rbb2$xIJ5-~U?4?+SVybKk-44!? zDmfhyRT_N=7GdoRan-mT6T3z3Eqe~@MpBxa_K*55B3TRks9?lF>H&U|^VpiN$%rul zI8DhhE<{>0Dj-;bQKAA*HL}TzS}e3+$C&LQ)nv8Dp@#?|o!c&X%4nx{O&oHYlst6c zfI(3>X)#*g%YMHhqZv~SOZLp#F>>>SQpe!F`azWT!oIT6J^99&PSDGLYNcV#sEpoS z^j#um==2Y`D-9VF^!iCSH6>%awz6V;gEnB8RLhhvbEdHTTaasqRzoWSQZ>lY&MxDk zC1>44XJy6u2JJYrbV75$=x9nVG3(Ej#6|@;>xMWh>2Q_O3i~r|>*{P&4qa2QbSzYI zw^*7cNTE3LGO{XT$EC`;)m2q>rRxXQ`#CGtS9L$d&bZlT#`z%u%p@7-HLK$b(%c!3 zoOf1K)@{?&8`oF$fFbLU8EA=L)xcyjbwy5mf_iL@Cr6 zSrxe>W80-Y>ju^bIPb4~Wqs9vDBZAtMO{ucQp3RckNz#Xlm0h#LnS^LutKQFcga;M7?)(tHyt}!O#r>@R_)Gxj0cM`|QA$g}MH)bLHX_4;tIwqCTq({A2 zSELW#ytNLRG{$VE6@6I8S%<|vRhufms%xY(fwq;i^Fp0VOUET^2ENR7i>7Mn(F?~C zu{NF26p;IJFs5DaQOXWKr6Woo~lXRoiiF*uNBZDKIIJaxt+gnF| z?kr#EEGc&u<8N{Lw9GU&W#s8^^xAPj()dJeKn;#2fx}Ni8Cm2)9l+W_PG3kyg;E=) z*}a}cFeqZIgBhtouN71>t%RLWR${E#pIo=!5T!fT7<8)94>@e1Na&^NB*!%b?3mwo z9F~kU232Y{JFy71CWtN787GCNVU3G3^45&Cmueb=kRa=?l*zG5Mg0_O+h{Dk1N9|T zmqulzOU{annE~h*(xu9}^;LgyHbvB+I+xLO>7IxS0C+9jkLZJJ~*-OxcPg^TgD#t6w%ddydN3=NuDAvlc)a#XUJu6gmut| zTnzj^;3UpOip(-c6`K1v%)Kkjy{gJfidQXlG@^sZo0iwX?hF~r=;ZaR>{%(dJhq}9 z$5wvCAEqR*CXCvET;=`~{pB-d|6JLM{QP(BSi9?Rtz}DL^nO_``!xRSr%fgFm<>pC zpLYhHWG4}aX!JcJruVKE6QajuN%{zcvnlirTNvsE4%dSRR<_{7+@SJVOD8m9hl^^q z7KV*6@;)zY%-8!xJ%DG3ACkywoIF%d&wubEk0$Fdqn;(mnmUfPOAku5jV-jLW!c7z zx~tHZ>M(~b2+Fdho)D=9DrlWDP!h0RS4h=Vi}eaKmoE4``RKsJ zu~_^l_^FfPk&j7E7!d}bJ2DqW_b}&KN3*HqY-H}Z?X;``tBgcZtSlaev!+GXp$RlV zAeK3xllOSzQ%I1s(l+jwHY;Xqr;QyqK7GQ(Nt187c?zaZkGW}-2_MRr7ntNZ*Anv^ zmNNDhQ~v?WM`1;B$Enzuh=p0<*I>r?kfFndUu%hti%%Gln1l)`#>jZpl9cnk@X1D^ z_bm3lteWrEVH*>Rs`mCr3ynfd8ecze# z#`B7gYhTo9w*UHSpVf~?ee+$*rmsS6ckMXwbZY4{>0>JXXsoT8_CK+2nFH@>g8nOW z$V6Pa)0{8yEvFW4E#|l=spFh2bvRzy736CUR~PC=~-cG7hSr!Oh( zM02FZbG#Ms)^?cF#3zjKC>`fK@reSS@FeM|Mt0;gyz6<0eA8i0nUXrrLAp^HjQos| zT)cd!K5C@#(!1Q9$=p*t=NVC5)<{#N;Z#{cvioM~b1pBtCrjtO+!LjAE>CSlgINN* zy}~C+ckpm(3mWMrg7%OO`Y1`qW>U2K=-8|SrF&w#0~`)iR=Fpu-0Jjb#zi~nkY6Ry zxn`RcFU@4L67Ht&Ry2oekgh!jh5tYeoD;ceFJ3|9rgkrg+#&~4!PA^CyDI)rZa;c; zra51{Ixq-|-@^4-z`~7El`6iGr%%7>)0{B+{`G&@dlT@git~T`oSOs!Tr|NLgMi*( zP*A|IFG9TmL^dlRB3hLs5Fp4BLl98V5D_i`G(;?kYd~5Sq2g9?p$)hIiY;z+rA2Ei zTD53xT?*y@`OI?eoXNStw%_OX{XPHZ_ddCqcjkTPGw-}JXU?2+=FB1e89%NGdr#?e zPtR6PwpbTI`7$Bz-JX5lMU$H_?NUcuD8U-1Z>)6gbN zXTIKwXZrJs_xz@85M?RMZ0PClcJYKqo^q0_>=F9Phr%}H!%@)5;6o=+K7Qn>d%fbR zOLEnNJK<+`K1F&Rl)zW(#00(?K1JPmfPk1yuLr}ezQDC`gH$>(_{@%L?v!zZhdDYe|-t8#U z`;x~!OcI+!`y@(!2>yW>xWHsN!^o@pj#B9?XEb@<*aVHkkNPZ!^~&JAXpm@M@X6ps z{{&BeaLAxe7$G6ZGas9TJnJ%4@hqC}evu&%?E8EKI}wkPJjlY~u-*oe4AjI{qazR46Mb zomeopY}!Puv*G$J%Sg{_jp#N2{egG^YMv(pWTxK�{)CQFTnYzg$z&pj0JnY>gg# z)!6bpE%sLC1$RNTOc~eUnSI7?4o{&$?a{yS`LbD4%ceDoVQ6{S@&GBGHD&fh@!`B1 z3TDj3(mzWsE@R_~^229bVP`LB3qHc8z(aGUHBvpT;M+$!(c#Koj5TUv0b;?d$rH;8 zrZxgCI(@Ku13w0<>0aUa1Z`?-o@ni!msk3GZV6Vk>IHiZ%>UNXu|b%Et(UM3RQIU00G{b zOCUk_NFd?I`4Xcww6g$xjmwXH#{avk=3*(lR*X|hCf28`>r$rTlqTp|#cL7IttN5a zKq|*I81tBVT1L6%Z-O5AC=)^BaKa5U#EFB^Qjk8}v>Cf+pQ>HfmYB8@l6>MsLSJ^`Zi$aBq-iC1pe$7L%TZ;*u- z1>Tpz+Erya@&#FO@akzbyO0Xc&!Q;(ce~Ed-uEe$O-TUbFDhfR{%gMH>4R3omBi z@p50=$M--@|BVA)h6Yo5jP`>b^F$c|tpT3yFXtn!@p3G@X~3H&a>#$$zB4Vn0|s6< z18*EMnD!k?;J-_uN9?F9#tCE4)BfW%KV^(}vG6`h;J=O*UY3E!TQ(Z67mPFQ>xh#n zWtudf3nlVVCCD-Gc&kL?g)O|!z{^v47-+nv7GAD_$6It7Z?A<{0=%H(<2eg&0Pu2v z!{dXu(lp*y3vVItWA%7FY5VqoH}PV?beKV-3b9W)I;z=C@f}Us%XrDgadPfAEcn#xePIZ#rkvU21$ed*C$ULYbDY-gH@93N) zc63fMc61(Fk(64Uq<4f)5<5aC89PE3RwRY1lk|?#Nn%IoBx6VE(u$LhH;E_R$w zYQ-I)lTL~62whQ;lu?~@s+MO8`Dt-^bwyHEby90BKV8V%#O3QNlG;`$wbSx5g#667 z{87DR$AN!_?>>PyUORy|K0JXpzCz25Y6|D0`M5$X;*~DeZDrotqN07Ibayn|WWe{! z`e#pH!>zrSRbZ7{EO+`{6~nQ5Ez%}dQ5b16W$K*=hqia}d(^W%^M3jIrK?hgyVJ)l zPoF-FdxUT9#&u`0JQNe#-6pntH#Q2ti)b6wM&TReM&WNC9`t;4>KNwmb_(JY*+rU+-UjVanV@5CKCIya(La6-0}@iM5RRq z)2CG}&BX@sun_A_M+_fvYsseEy0RytThdEVpO^M6&fT9|KYuPh`%tnlQn_sTm#ood z+Rqwwi(!9%UBkB{u`!ja4k7=(qN*+F_$bb~FX6)@Rfkx=L$#5^*MIs+-7j+MdJ;WX zpnpL5-nr$q>Gi1pu21*XArAD~^tw)w@9!CnPgKBH!nf0(KD-*c>K{7tclkw$%G>Ku z($~Z~GClJ2&o{q%2raQ=Zn@B|{67DV+?h@1cT>Ke5Q!C(FUcJkQgM8GVBOO@wjazr z0P7B>V-NkiKQF&Mw|osfgQc%e?>KNzF1Fi;W%xG5r=1QjF0aTfe~0xxFf0;#q(y9e z>Y=yOV=XIJU~yEe-Hunuq{q7K_<&5S*ucu$D+*4DU4nz8AR~57<&uhmQ)4qLZ>uQC zj4i6XwW8p(*s98v6$M$b`*wWEEUjbPDk~}qPLJ)ZyrZI^P3)D*%8G)vv4fj-k!ctE zymDzp!5Oh*mCGv%&J3sS&91x`{kU?=rsnI1JE-@g!;{bt9~~a5+myF{xQkEly!}2q zx_`x~J@#@q@4eVvkXPL8%Ix9kV|QhYO1>WJ?ozM}uBlV_LR2h>Ys&SbdM8>8&;=Z& z#|$dyP!V#fLwbx3i7`54jM1wrLdn%3Jw}Jb7#%Xk=yesL)asBPqeEhh4jE(gBNd@= zbx4oVAu&dWj4^swMJTO0q{rxx7^6d{#K+KAD?%C7Aw5Qi#26hi#^?_!LRr-zJw}Jb z7#%Xk=r1cmXI6*KSRZQpXsF%Z^xXyNa?fS-XYWfKTpQQunF_t3@xdAWr18-iJxDbJ zTn^W7OWBdVx7*tsLh&V-Z7FCeW4IP)=pXv8_qrskbZ#Q|_g@#@yL>g9c5%hJdFGzO zOv~fHZtMry$`SG7Jikv>^O9mV&i<=CQ8O+0t*AD72vOXZiF|OBOT`I#etEIv*(tT%q{C= zZrJ)m-I74hO^_~UXOu?qo0mu}LGJ&T{6FS_yjcq(bLJM#ES@u`c=oJF+3ZN!w4%uH zi^dI&V26kzY}he5Qn)}Q4xT-$thBgrZrSY82sVp|l*}!hQ9P-jjQI-YL<(lih%gmT z7bCN$L<(j}l;PZGV^&dFmm#GEQy?jgj2$`{(#iOt=rTN;nprffEHblTa#3VnaoMzD zSOF6zp)@?CHlYe8l@;GmT(%%mJcr^r#gmIlVIE3qFAVk!ghlPUMlPE>XiyUKE9SM_^KRai3&&hBY}LG+Ll^FNdqkhb7ee?Bku`d7A2THf!&Yb(z<>AN>Op1kR$ z?kjq=9dN^y%U}NOz%46g?C<~Z1N|24JFidVXzcyFK3}r#S1I>Su6^p*`raQO&e}e* z#dG(bvFy6m7yRq;;<*>bTCJ?F+;Y#PSJ%xh|7(YFZ)M$^cjkoRm&U%ZG^$f|G4nj^T*0(wErsme`9_2m&Of%|9*Y8TDYgW zToRsAW-5H{Z5Z<172-2a+?X&Zsev2|p$tmG3auh_4vZq*#d>V6JtFablZ(5LvqTK* zZc(1=obBvTaz1}>vC{KJ#L4UURX+W5R7?g*Vz;+=Qp5G%IdLJlhU>x4w&dqHBMg7@ z-pa+wzP8}Ge)v5l$E`rbo2mOEj?)Hut#CK0PU$ZY@-%0S(tl3GGf>Ak5&v5iiqs=)9zn?G802Y7f5o%jQN<&0ZdW|*dQ|bWcZcGMhc5`E z>!pD~tBTYuM{gxygC#Py0%t+q@)fZrL{8KFX~nZJb62Zo{L5X1OjTG!x42BC@ z%jPW-(q;aDHEmk8v4w4xj$FwjT!BSCdKp@|+nDs?zqydBxX$rKlg8toVQY#F%(*8+drs=ixnK;Z1-{4dDV(+qc!i`^doKn5*q${Z0F3AkHyYlg8t@ z(bQXrIM4T*v>wNC@=+x?f^s>QvK;zXm%A2uO}rXJGzPP3zFMV6nFxyDB%#}lGdYb{ zX5rn7IOiXlG~R3rud{*2dTYEDmY=hfKW)6FmY@3?cwjxeX%=2v#Glh(N{`V=7Typ8 zkLN#aAKw8)RlMWl5aRT`CS6~A3Q^>VD#2*r>2oJf@fz=Mmj4bTALqlGG~O4M|E3vu z#MO9z1#jB-5e^ECyJ1C2zd7*B%WR?$o_aUekR_xz^g}^CXL5FNj|Cs3vuvj zya>`LBc9&luRD0s4m2*;qiAAT{9S{840Tg|4817gnkXZ^Zt0zaLBMPetrx~%NFLP` z6osBW9-s(k3Vzhn<&K6PuV*xAys=0y^?roP1?im(CF*gkAa%y#!^x5r|0(0I1Il2i zsS0`~X<0Amna`KAaPZK#Y&VkDOGbSSvmN5)sxowcX8q6a(@#DwR{u}GBz|c!JDV$k#7MH^evj>JC({54UK$5_hB#wRY7&p3GMKT%(aq z=q1Re%h)OR_OQ^T9sG|y8^UV;3~FA}Jo9p=beHpD2LFefj7njVO?P6W3rI!r*oFlk zJQlj+-xQl1tcNP7tX3E>8|t#ERuVAT;*Wf zqV*4N<+dTLXNbm1(UyOC6~HbwEUNNYxcQ4;ACI>L+MN5J5@Ga%mC$nVnvpowi_1t=KmvmWN$Z#$cC}AGVVQ>arkvQ4{Xj zGwp*3ulC&~e8o~0y{w3M)&BLj}@rO*#H<*)w;r4FmRU!9F1ix|L?1T7ie$1q;Sh>}rdxaI#UEbZi0RhT8}%-_{^% z6Oy)K|CvpEz?1o@;jH!#Z;9_hVz%J_4By*LUKAQ5A4%c6fGrNCpsf#AE-n-w@!ZBe zL)e->huwlbQ2F!txPhH9SRX3wY@Yd$gXc_FG+%f8_>1X0Mk@;DRqVpIjc=&fl~z$O zmz#Xtz)e2pp{uY6?(Y%WT~~^oH$FhozeTHwWd(qGnNS;300n#69a+CC@`&R=wEziC zoXjm0Kbf@7ah8Vh)!8)I(KhS}&JkaAY$EG{LV!!BJ}I7kr8pWi{sgSc=-D$CbnB7Z zEB+`3W06gTlF&7NG;KhmMNx#N2WC_v5)Hs<0kf5&-vLNGPrJxa6EFUcG1 zd%jk_xZ>6&w=G>3TVAMk>awhub;lE z=j7Y--@9q)!_Qv!*PC~5*!KCDPP0<~wfVy*HunCa@OJ}$wc*;8o2Ry_`2L^8?^c(t zIQ{zHH^0A0i%u!O``IsVe&vGR)dzRp(q-O?l{HDf_+!UrZ6!OMmm?$b!t%KWK5~rOiH^esfjVmk;DOS^d9p8yV-2 z`0@7N-$(XOJR0unp>Bw&B7^qvn9mDO&?5Z)C-(8s_mv~Sb1{>uMMx^e&&A!rhd2QO zaenDypO0Vp;@zFwgjDPIbaIrxIRA0QT{WeE;Qz$8k@S6WmP#AeyW}J>Zm$1locq?2 z&cToOsaL7`F^%$hR(zt0pDXm6iEo)umqdMiJ%CGC;I(x68xuv!GcCOKmb^x_FH{8{ zuf<5bc5daQJ6uDriFp4~cwCpvZzFxABj^7el|DbC%LSU&OPWv6ep9 zYLoapf!{(}ZIyqGrT?zbcAW2peispQc@YJosro)OuLtz~ZbIt&@2nGf>he}GdFqnf z2>yWtPPXJtoF+)p_v?9oL+^djUhy8zSu(FESNV@AZU>nz@YTI|fq%A47smiQ3W#>P z9R-VCgR)e=r&)Tx3)Y@IF@`Cg7$u4)21)M&AoN)YMcO~Y9(Fj8X-_A_^}ZQwfAZ9w zX7FbV^S>qHRfJvs&`p1Kz+ z-m_ml!w@*#Ap{8=)t`l(#&Z|lUc5BZ&q8=T=&Jt4Y%VaFB|^S6{(*Av)6YU^qJFMJ zcW5878qC`pA;%b(H#$Il@pF3!R=k5ko$-i9nNG)phTz9^j`hRH^MC-2!jI{TiJzpDV9Mw{ya|4XUff|f^%~qX_cneb}Rl_CLi5zJVX8 z8t^bc=ml(!&Fub zOZAFXh{oU{o=Ex!jskBNg+zu)>nFw)Pv{w?YZN@QV3K-`hP7zq`QN|!$j|AIlTZ@I zV@)^X(#iV{E)rcOn5TF>ZQ^;sB%Z@ai;;nOOg)~vG-DI3e89p~X^+E<4-Wtud9HWJ83m0$w!n4k86_3+pZCf)|b zIoH#q@u*|sO*ZgaDjD(l&b5iR18JOtXwrD!L&?M|0UqZJw2xQklo9V;3vWNt7UHK# z@k2ebOAp2^O&OA~4NHYxkIDgf63oN_|h%Xg6Y_8WNFP}X>}E&F(F z%=x+|jW^x0kKf(V^*sy98gHb9mxK5s4W{%M#TLdQPm~c*Dh^tW*8y>jcMd9R)^`K) z(Jz{`eeIz{KB@$LftLfG{^R(o@s5Hw@wNkx_b@bRyl;?T;$3av@iJB8y$asM3qvqY zgDE{m_bWci2&f!*w1xJaho8pV4Bo`chk*A?G*OSV0YCCl{74INO{DR-}CRbOpi5>9?*f7W=T!H{R4Bb@@h$&wZSDdTT4fEa3;$CIf+ zTJ{d~%xA>&angW^qJ62Z^|&{RwvFlYfj1g`kn**Q>jD zo_ykWkSBCT0U$Xi>gdeztdr@z#e2lnc(_#@Li=oLmU*tb;;Gfgk8f_asl|$CM%IoW z!B>ZnfUkTs3%9Nw=42no_aT@YdGSCcc6zv3CcXsH{G2wYy}TvXJoB)#;_3A-9o^e} zTZ?n<{bDHkV6!f%=3`Xk$5iX$kDt5$I~u8Gj+wkI-WGX`>`&~Jp02fMva0I;$gR0lyDC0%p9AvzI|HejZWv0 zP&<_BZ2Bs*(v5{;S>>_0)pZN;$qBfoa(OH@wgb{pBNy{|EI0x7z;W-nYx(`hkBfR| zCMAVKD3s5q#UroSDGi`DWzOdlx6R*VRyzH#FMKvVF8(==#1!31`ahg?Mc)arP-fqh znk+mF+x}GA_-CA|>byrEtlwUnc5&^1E87om70WvN)Qs|b^TOZP)uvVNI~MN0v0rlM z;b@%B%}_iXi4W|o!>#bjSnA!eSn8&)%m?5ovs{*ouFEQo!tWB{Bl{n0iiu~6sVQxn zUHnu^f#cwbU@QxL3!fiZlsta3Q+{V&+n4GVq|NKu1-?Tn%H3F-HD$vYo4yij1jK`4 zJT<19mnJ!9Z)maZ`0(nXJdhTey=_|AipR2-WGn+U0 z$8q5B>G3Nq4z>_UAwx=Q$-CtLS8ySU?& z)`R-2xpp`-8g$GoI{U?zG<@jr={ggJLp#z=q@0}d0F2A#WQ}@hwPr|2>hF;)QR;=Hf0W(2TgL zv5cYe`&g6yvE@y$vp{wK%VXK)L+ZaBQ+fRDf|~TqubtfIKODc%#qm;u6+4)^ZEN}B z!Q-*+;qaa;_m!mjvici;jgkk3zZ=8yssU8pC!=fNkl0asvgzS5vgmieiZ!_rMQUbsr53^|2PA^k4Xm5`DW|^>=Zcq1R;gO%FG#O|DIei9t~HyyP8&G9Nm*d@DQn z(`oBpKK75w?A>*LaGFQ!>sF(0*6&Sw_4x6(+D;3%t$!(PTeHjo?$Yk;n{`64t=U`m zhK6=^&OWczlr}$#Rfn5ztO*T0m)-xxj-prgtm&S4<-c}(2+2K7%Wvhtwj*tCH5^3e zVEn>Cwl{4@`zB)T!O}L)wq`?5cSK@M_1b$ch<8!d2V`rZs~i)nciv4xL+o{HLgD7C znr9X}vDV@faLbclL{INtzC1GY-QzW(*r3c>r>1q=@9UmQ!;l_su}v=s(xU}FE-BXi z;9G9)Ygk3aQ=T`%&#P{Zgc`Sed0KfSA48nsb2aYM`8?m(aA{cPC!rdCMFyu5{NGp` z2@mVjHw%LDTkB$}%Liesl3aJJuoB-@k>`Kpzxb5Q=&ki5;K@hpj#muFeiPeYN^4WQ zY`|9>Sy3)@Si+!|nHeqnSG0&#;9E;cJ5%ehvA_c+?zw%!`!V((TC9wEB6uN4}^p z`6BJmpCgCq2t}E9*DF# z_|~24S2bJsJ@$XPf z9`2U8BLywm0xjC?KW@<$Pc~@Gx`)}AH5)g34JeO=5$mJR)r*M+26Ztpko`B@Y+Ez- z;jzh?ImxxjnRh0&s95;V{(G^_%E4w<&#eD#x4Qk2x~;jn@1`A2-j2;Ue!-5sIk`oT zZQ=2E9<5E$lV^#&DwGZ6n3Flq>6eUIiCo>NkJo%2r48pJSR==I40A3BZR$AX^!7M> zF~)7?;;AR^&fN5ExW#K?PccN7N3R-BaZQbr?qg?d8ao=ZcIoZS=3}P z7hsAL?$VDqBW&{8uH+8^fVo1GSDJ`g0%qPf1chqSQ?B?j80Pxd!dTx(~BYeJwj<7j6aK-8Q;3QWA@dkGY$^s$E^{qErk|dulEXw`g*T^X|rt zPo=EGZLl+)?c!=-bK1N2pIwaQyH3hZZYOb%%u3220 zUIU)bSO}piuc2TR6=A-Re&k*CP7@Uq;xvv!z%TnTp9H zPMay1A*ARY_>h=G-rafogL!RV#z`E0d2-ErQ=WXAfS;_cRi&eB0h0Q8lc8UT{VqN~ z-oSUp99f>%)SNx;zipvd^BQp~>y(B~i@wS}ts*;9dhZbwT-`D{B~t%lB=gynY;{ex zXW)^+V?ODI zwV>Jf9AG*=2T14p)`QMCysXu@c1JdSzg!A&Mt-s;IoyILb$($_T&d7A5_AC? zYxVTfw~q@P+1-BF|BL37aLa?@DUnGt3a~2jhN4oj%>=ew>(;efq~o-*vXVLd&p&@E z_I;RJ*cA_n&o9zh&gYZLE+wV2r(@TJuF!};)J5i;*gdyBN_hBbV?qA6&- z-fVSK#)XpWOxLO+OcGB};z>#3iG>-*%^rjPll6N>c05ly%Zws^jukhb*zoyNS4*C2 z#r54knVjUUM$>Vwl!#N3c=BP!qfU<|GJYn4kQ0py!6i9)R(z26{_=;Agq%T^e2Bxn z_(*K2kXVT#qT*kY*uBw=4|PhEewENi-#3Wg$$DPd$6H$=@uVQG5cJ)w4NCvFLVrYD z8C;UMml01&!fL)ZRr#%i{*U8Ap+DM+k8yI9{uM%hj3wuar8p(wj`37w58tB-`R*Xo z9ZuC?NYR(y&TxBK^XmVBnu2KOX2rGasq>zKShsrTk#&*A#W*HfjO zJ(2J6e`@9bls7g(Qr^<}Qt2~|_{)?&?;>$M+F&l4WmiD}KbX=b#nmxS@&VFI17e2wPzv zhF>UsK3i*rRZ`Dc`Da@G{hbxxsp8j&{GFZUmj7f$Gz#*lH`b-wzt#{QET_q7$fw->mu9%Qim?q>qeR4^56lPIHJB6%Jh>E=(V3`E1tS^jb865@+y3h zSJ@-{gFZ%iHub?%&gWrzO(=^ePhB&w@Q>=h9FO&07NZqU-7Ngv!T1N_a}{@pV4Vp0 zizJ^zeyHR-lD}B;9J=+|QuYU*TISgIG81+s@<(3=;i~od_h_ z8a!`sg*JixtmusuWK%HYz@X@KMFn#)FEdjmH#E z8#pc!lRWpV(fllf=X>EgeXrt)^Occ46UV*Qfyi+&Rosb?bt69jx~vcRuMi4>7qXcx70>cX?pPU${>g(C#Pt^ZW*}`4b>u(@5_Rk@d2tNVSP;6MlL4Ok z!hZat&1a}|VsunIG5RQ;brEAlCK%1LaLq>qEB@&*P}q5vOc(u=0~<)#(@FBe|CdW% z_?ev)B=p(wK(r$RJZ(N*@wE9I#WSC<6FRhWph{=HVTxxtmnoig6uwer313Y>A}9wx zSJ^{9xN3YBHg}@ykQX^-$5c$Uj5F`aZie&lHc79LEv5^dD`l7fB|91b~5M;Py|2n#Nlb4JnK$#$^34!r zksfq8<7@2~l5WROFr}8KJL0gnqV67y9Q&o;K{e!GhNS9slZCPhn#54c6Lay?9ry=-@j7LWlVSm!3-~u}oesoQ|s| zuq=Ugkd5a0`-wjcSbeI|&<+BgQ9MUiD1nti!*fS`4ZCTQ_l3Wy_+(t5fZwt734&Iu zOD8tE8I@0^vG)+9Vq@Pw1=5(Dix1?ltX<5C%+RMSLTGo3|QYU?ht1<;KJgZ}1Vv1n&lDhgqL|Obm?T=i*zB z!EZT8G^v91LpMfl!c-_2-b7##fEr=`XWRYlpQ&Q(OUJ20eO$dvE z4hNq?f|gY}8lDa4%NB$icQLA3JS*XMCv6w|v<2`~H0g~+rL*TuEWsYM0!rH%Ac|L% zLcAkBksrQnB!2=GQ8Yh$m_Qyche{T{ul*CreO{xnCD%;~sH5lg1{$7;{)}lr_yMZODAz)_5lSsIew^@Ehy2SYE593rR$X=>s44V zr)c7g*|V>kTLM=X&d^{%r8f3nl0@^peZ(#acZ<=$$Qp#qbBOBp6K7%vjT4UNLE6gW zT}REquHciVbrsd=YSp(vNw!>{pc|Qi$&px?P?Ye)v&tbjWzLzVRlTz8j%U15733b- z9~$|}t=UJZrVEPqFY)XI@MKrIwHMPP#eK0So6yb6} zP&NLO$E`>~Jyoa!&i6^Y=VI$|&aX-96+?-9R0+o6x*-QVuWx7%Wz2V}g%?FyU;H#_ zyb%`OeBcd$67hI#t?^#M#fWL&d?iC5NaMW#J@QeR>^u%U+Cw~E-)g*d7T!Y0)TJ*t zsmJhM3$Nb5<29hh`v8n--&V+w)g$VW-UmZI$_Qvb@OWKE``CPx(O$i_U$@)iNDH#> z5ex4l1FxllcQYEtwC^Lxg6vxWJ=4CU2HwdA-enfvXONA;PZKdnKeq5PP+47H+zRvR zdr8P|UtiTP1c=fjKMZ=NeVqYDf6;%uZ$%m7T`fG`17vxcw0)f{yuJqBsZiECE~GsjW6SVleTY=<-cUy(_?y4kry9JEd9yzEN{yfrnH-aG_Rg#!tUtgqAMtiRXW8!rNSVxtI0rf~%f*~Je1hfWt zIMjuG{Si_|ynC&2cO3Ajr%B_jwZ`482HpTDYrN|%ycxg?8pmf?c+UfG7;xx6>TA3% zXiu}gTY<-MPm{KqLyzwwGEY>=!Wg`De;K6o7_YSO z9!I@8sXPpHxl=7YtS|IrrryPt-bc`@3c%w#eWra`hJ8a-xwP+BmS4)yZ#xIz-DBz1 zss621bv}BS_bzZTJcF$VZhRA9#9v z;p0Neh&RB(<2&^eR2~KzuaAW{A9(qYb3CBF#yi!*TL`?)kZaO-X%^nwz~gy{cvs=4 z@xHYDw+VR9XfUP6=x3JyQt^;$6Vi!yHGUc|6!QCTGA3pjkZaQR9fOm}N0neZ@N&Qt z?^^sc-iOdL+hacPrm8#)G~PiA?+xH_Tqa(=(nHn6oXf;J1iT>sJ*V|q78hA8SChtT3ndfpfMMSh zC~LfbfH(0*0gvmeG-m5U)_6gI8H(DKodL9N-ob&tj ziI{Yv{mOgx?)HPjGTiE_B2@XIQnaWuG@W*3^<0 zII&&J)5TKyL|T6Q{~p7%z{EDwX+C7((;r=zwbX___pT5dS9$Wbt=2_0c9;zvAJCmsRuKH2of&>IYN4K1l$HSERzBb58ek zROeT9S@Iv(MZFgVoF7`&;s3ZS*o<;yh5p^+QRm~kVn%yb*@B_;A z?D;=dzyH1;pZHi=SM^`E`G0h*z?b3k!epRtKxmr{%^JUN6!3-izYiSxKMU*602Jzh-{rnHM)x z&qefnj`J-NF4F{IY9a`i6M{JRBVpPmh;tm$#WE20Fvt#9aZJYqaqdXMbXyRwfk`7} z;9%M;h|d&AoCA^0mVx&+R!0@@q{4Gmc%BON^sJSN^BDk1&pq|MPkoKZd+;P)yOD5P zQ4nt53F19)5^m23YNtY6UI^0nV)Qjc7nRO?h@|sn;LS6;sd#r4_E4dmi^=tlOzN%D z`>3$53j3*$_pnG8$Uw|-$qrQUAF1#{6-HHqbzFjUFJjfAz zzwRF2y;pCKr_SI(gFPM1Q%CbcXXqdVakY3?JTO{qH3RyWs420Y+3wQc6 znh7G8nZPXcqA!atfmwVBq7*v|J?>$MQp^OECBUbwnb9aVgqI_4tkD88qP#C6EK&4) zttPs%h$xSHYHWKEJrzSe7R`Vj-i=G-i7)R3) z+jFM6-#Nz?c2zhJtIzI4=;-0)o< zJn-MhE4<@Ku{1-c3Wd>zhUBHnXgSiQwUQ%c+9~o3k;V^tgR0ugGj`Qk@=RZqBhP46 z-Q|q5s)wABR`rxK(yBpnMp`v^n9M&!&Pc1q${A_ZWpYMZHBQb*t2T__Z9=DN(?}7P z6rLoeawU^amf_?y8CIMvGL+nUjtrM{lwoxz8QyuW4A-0|!n9WD!oajsTFEejPn207 z`4(r@S*OZ)PNodIpC-c|Su*U|T83j!m*Hh?WH_#^2uljv@f8`TWYQTjoP4GXD>{p* zZpp1(WVocO46DzV;hniMT+>a2X|1{oN2i^_-KsJF&gdz^s`kBPcvf#2=Jb(a_r5ah z(NBgw`^#|b1v0#BfDFeC6k$o>kHplsWYUE)oE(*5MP9nF|JFe=TryaO)k9=>=S4DH zGgO4B>5-1qPi@scM}(*3L>Las&KBvz+MgxThn>|yq!*Np5>xwv$1f36__W+87zWK30ZrT-Nu0<0Dtk=!rGz6trgs>#8XUS82=D1r{4I|)9F)uqng&3WI~UfnGH9#*`Uw`Yd*e=kd}uRb+?KWCrM|N3fF%k|Z$jt_LW zUV$X*tFKOFT9R|2WYmA|X_BLwMEYM}t!n+jmi|Rfz0dy_S#o&}(23lWi?Hpa`Oo~``?ug zpX-vOKd+P#^*_n^i50)b`J2!G*I4q2R=mKO=<|PpC7)!)i=6L#{x7oRQ>}Qh(@I_V zN&gpH^6RYlOy>*V@i^0x&$i;%J1c$mTyM$eSn;{eTAw|0E%`hvzQF0E#w%(60!x0A z6<_2$quQ6%2>EtpXM5ga=`VIl6h7}ig}6JJK}q5ZP4R>z=Qig}Uwhpa7lKQ2mRa%T z&UNZWmb8DlC0}91S2;gc7p~HtRhIk?E56!!kOwYE9>1$)MEy^4?zG}}IhUv#ZPK2* zEcse1UhAl7o9h3ymi!(oexLKQ@A$pXl0RU@*Eti^@s$oqh&zxPl;k{U#OU9jITtjO zNmBo3mVBcX-|XD&Yp>0g{2?p8&FSuIuWgq6VJrTKbDz)tM=becR{RO4+-Lt2mi$R8 z{**JKg-nv;&r_EC87sci!5))>TH}96?7|RNNpgN2kAO>Zb~(q?@gn`X%aT85#b0m^ z`Re`Mcot zza-}y&5AI|`OX>SoBw=g$^U7^k2xKD=ig(N{J0f&-I2cjpcZB*tt2POH8WuT@BUTQ zHwyyH|J|Rc2OBKbb-K9y*)Sj(Ki_@EC-3G~ss|%d-oq_s$My7kxu5#vecUJu^5p&8 zRy?r1_yz7}pM0RZ&xd!Ro8l`!&;8gZAMCDE4}zpU7r6x|oA?*I+?$0Y<-^_ATAJ~Z z?h#-768Bv7AW7<9>VE2rk8vw~@ypy19C$!d|8lpvdXOaJSGZez@+;lxKKW1FQVxt> z{%hPXeDaBIjj#R%?mS=nOme^V$&1`QKL1a3f9~^Fv3rg$ew}-(&;K*s%YE%L+x^TZ zzux`5&);+0`+feM>;A|WpXW~X`D=lDj?W)AxqE!_MeZ`6{1*3OpFbA6AN%CDy1(|x zZ*%wf{JG2>?29jV7x?_O!kysr=PLIdpZpGYlh2>4-DN)i-RY+K;&-_PK7Xxsd-(iW z>%QcZ-{bz;=g<4xTYUa|z&+C!U*`_<`RhS9)#s0&xto0QjqWs`e6!op=dXv{y*~Li zca2Z}uzRo1e~-9XzW8JASw4R~;STi0pLE;!{QHzU*5}V>+!?<3PIrXQpTBm0>hs?& z_fp^S`kXt%7k|Os?u+knZ}-Lbxx0M+eA#X4^VcixM?U#)-4&{Ra&e5hPBUvfZRQ?O z^^etSaw{x%X$Yr`N zv)zw1xG0Tk$Sd{Cq3k&5HN1;=QbRA1mI^ zieF&G2U_t9t$3alA8f@hvf|uDEl#-qVZ}#U@k^{Y-`b56?r&J}%dGh2R{RPp&Mz>= z3HK|k_%&91q7^T&;*+d+krkh6#fz=@byj?)6`yUzueaiJtoU3jKF^9Tu;Mpa@kLhr z7AwBkir;F*Z?oddtoU*(zQT&Hvf_7G@zqxRPAh(w6<=$`YpwV_R{TCI{(u!>-e2;y~%;GZJK4@GoLmY3rCu!~2h(-Qeto*6!`jpAUA86Ho zLv}m^D^Nc5mN{H?x)J*7 zzM{~--OyL_IgzeTM?zm+=ZN$w!yYw%73u19#aldXwbbEte1@81a;i*T-2!r4HCPG# zH3p{Y!!$7iyr-{DcfuZ{AG$v^@TD z9dBP|Oq6N7G$*ggHT}88s8^xX5dH-3*{P;a0^dAdiln~qCwR|>trAn%FwL+5ye6Lw zYC0x-d!5t}Hh}kR_=Uu5V8bk_FKhts>8mN7=wsLGQqhOE8$K*E(jPI>=Najb8tFG0 z>820W^ibHpNa_gt!F%>Rp1}TcsW0pY@9C>4rm+83sl)&7FAaN^8tG~ZD)g5d={pSl zl}5Unq6+;xjP$1s{c0oKtgo8Riu&Fqbwqu^d-gw@puROyU(^@8r>~~O;uyRqLAk$@ zn4;YKjdH4Mw?U`bHyNP2`#)DPv25^le7E={Gg47kRf! zomRvF@7c3Ef!`jJ`oeGEsn4IQE)9fFeks%VXdwf88yu zN*#g!YpEmJ8oXz-y8ICKD4&aCf49`0&$6k+fVX5oxA-d-hf#h?@ z50E@hf$l)b_ay%#$qyi}Ca^=uM`ijb@_CXUM}CmxF zKlw3|e}nv3$-htjGRc2Lew^e#Bd;coUy~m%(~pwBLh{K7+zFBolfP2(8RV~$d|UEA zk$evMt0mu={56vAN&Z^Nvw7T!lBX-(e95!gZh_=!qFX3=!nu`mE?;hzlQvD$=^%~P!Phiki@-rp>IC*Y<2YQzLY{@@QzC`l- z$zLz|H^`St{(bUuB>xe48VmZ2{9MU@P5uVSA0X%ABmHb@EN662Yyui6h@&e~($qSstl5Z4eiGj212jEmn9bwNZ$wv^lRgxF> z+$nis&rc;U?5UM}1c7_6(#C;ME}`c-8F%zu3@M-A|;et|fTY zJp`|sPw=W~1i#O~dDGxOF!;|6{yT$DQPrpY=?34<;JX>TnkI>I)f7VT>J%(^bqW*w zN+a)m2CpvbgpQiJ3;uOO=VOEar@@DD{vpxkb_UNqKy~_s20z;13k<&0;BPhfH3q-U z;9oTOKN$RH2LGMGH&N$B+NoZ55jIDR^ezTJ(BLmI_-hP)y1~yg_$3Cv+Tiau_=gOB zhrz#K@UI#C#|D4Y;M0@ier|2>9SmN+Z6e!9zBwZKp@z<727k4|&ocN02EWAM?=bj# z41Oc{39KI}f~KH=_gpK*WX?!v{?+E8uip3r@v2SV#Y z4~Bjg+8Ej#dMLCl^l<2r&|{$|LNB;4x_jKc?mqV=_hom#`-=M;_qXl=_f_{b_jUIT z_f7YA?pyBL?mO# zaR2HaaldrGa{uOj?f%{Uhx?8Dt^1w(z57r1sC&%)mwVhT4=oN=gl-Kj3EdW28d?^L zg_egZLn}fnL#sl!hwcbfg;s~ELwAPOgzgIcG~{h?ZEPBkoxQIsTHs0aXB(_!?uczA ziBDnpGfP;03PYxM<*wWgKQ}wGXjYk5hEcls2#DTxTbJ!iEGU{Yaemnx_2G}gqRC}5 z=1iQ7#0FZv1RCs1pt-(;g3{swf6AnSnME^Z*r_P1hoz^#_~FNcO>!rFn5(uy58ll_ z=#wCmGdBWe;#9|egmvc`jnMhgmvc&FzPZb-Eq2^FmDIA$8pZYjv@bh&o~ z1?EqvAw8hSi$*~_KL%<^AkUR$r9}lZgG`CLvVn?#;E1Ri0-yQ_LP)G30N4V?k&pnS zaV-IKVvxid62LeV5||;z#o+1+2+!xiI=XwEKuti2;U6$PaF*m(R1&zh2fZJp;{)mb z13-dwG>C3ud_XLL9SJl9fYo>jKpNK)Kt=;507qQenatR^y0YL1d@b1EspdCsdHxjp5FZ?&VLYApksQH)=%V zTG|gi8n20HkHBIqPt2ZD7<8z_Jz**6@>TIglLE7&_+SOA^aR=CrCSOzd)&*GIG`OY z4FOTGltS!p(Rfod)Uo~1P(#tMfvCaY+_b8eo+&of$cF)pn?5hPNacSIA{mkz!HL`?86Q7s400vfj%!Z zl;~M_Ly4YVHO7MIrC$FCmI`06kpso?`X^NJ z+CC7#8(&U9O?7>p6sRPCF>hTB+RMGC^+_j$OF*>QrUqGFiy zHbm78%4uFhskSJAR5xg_I9_8kXt0W|QvxaR*;>J34?nSr*Py`&qIz&z0;z7$V6j&` z-5#vM6OrhZ4L!?oF@Y#SGQqqug8>^8>$_SFbLvJ`GvWXR-OdR$yn@9fO-|GUaP;Xf zp@MGk6Bi^7;)FOTNQ|Nh6?D^{xS&RHy#Cd&vfk(`MYCp?6?MJ%$Cr1(s6OdBe8k-R z7O{R*;^pyu^EUW#L&I;?`cX<|&sZ?g{?e>*Z8NECzA4rhT!}Tr)fTQJ5@c*B5gF*A z1UUjkB8$ExNsujpSY%~aPLM4?B(jLZD%ckRB9Vp1Zh}$*MA9&JxCD8`@ovdvIr^Bj zgkD=Ekc-UlF3w}Y6$_Hd67?!>dAGd(-*|Pj~>(KY%X7-FTy_HOJEjX0vo}X zKo|QGg#Uag-f-kg6}9%Ic-0Z9T?^;TY4C+)?+eJfqLT_{%$PmN{2;P*$e41krQ(w{ zdd^f4epd&NnXa=2h;;jk<_*e2uLhQ59y>u96Ujx1`Uncj7$g&!^f45aDM%(V>7ytp zQ;$u*}6xbWdcMYbG1!`jQQE&2-yb zQ|2=_NT6@p`)u;=Kzpe)DIisJxzYtCWt`D_%AP?Da|nCl$&=)_%K3~GUm`afSn6Ol z@1@dNG8L0eFEwtMFEwtMnQR$miVVY;+;vV_DLxsGaKTK54Na3Xr??}hdc^w{>#a@uMjIGlz4tc$ z20hchG6RqAsA&7%weYwsxix_lQIGVdg;#FiLFD1Bf{~_u^t;9&j^<;~BOhfVXr+M% zS9o|cEW9$v&SVBf8gHtFS7YF{gf8`<;)JaBSfgYJ1Zg~e z16h#&{$Sy4H}KL8ypI8F;ytcp2n1>SJ_JKPDwCaO4LrWXLmBJ44~&Vo18G72d)~s^ zYv8fJYP_3q0GW7iD;WYo)FUl`9{DIEpf?P>(-7Bq6D_>=A*218G~QJf-XQ~z{?>Q} zSeR_ucSOl-ysM#S+V`1($5#ylg0IymqKOAiQysORa z0T5pM@^v3=6OujtH_&5xl!>4<1|D8N7c%LXJ0Dx%=&ImU|*7jx5L2eW#H9Y4K(oDpmPAi z>wiutcznr(o>||oftQ7R^v{I`o@?Qy0xxL%J8F%8;hu54JOl4ZYrN{1z`jSV@hZo_ z8*Jd+Z{g(vFKGO$weSWQco!LXDc12e40yVaKrPN&$J;pIv47Bi7aMpVTI1iS1oj=Y z#=m?6Z@7WC$QrNs4q}jf^R4k}hJiQIz`M%An+Cj~@$YgAZ@z(diGg@ct?}w!1Me~eZ@7iG zHGzFYEWAwy-sJ{fQ(Qcl{@b6xz7X_G|2=Nt@x3X^*dPCBjeiG#cM8%qY5(!t%qCvF zfp;a8HQuMzc=b^N`~GB&SNjdTpBQ*AT6l*O*tg5Vd)vUf#=skIjaNs3hpZmy`i_B~ zS>KOHw1Wk{F`dveG31Zc*7Fd_b1hlqAUb7 z+Q2JDoMjRJPu6@qA9z9jJ7k@Yt~Tm>oq@OC!kY%Xp!VHk;guP9GY!03t@el|uq_c{x&DuMr|Sa=%@yz33T+mYXFk4=aNweND39z|Z#v%u5sI|p%X-z*Dn zE8?e$9P*#WF1GOY8hCRJya+Ow_C2riX-JLN1`PSA61-vH%|jYxw3qMPnRt5>*!PWP z-ys8Ufr0m^HQpaWzM%fM%^L4NGw^OQ@Tx7m!@xsV^GMfsm4){$@bq}F$iSP53}$^( z5f8Gj5b4B@s*=+1&c1HnTMWF5Exa_uPgi*u5Q8)b4EZP{ptiu%_AN%7GUD&I#?#Ia z1lhO88c%x~c()pOzp(K5MXsRZce8~z%D}tLz$?Vd)29E%C9v-r=&?>w{791xyk&?} z#`<1l;qe{KQ<1KTdZeg@x6r^_4!MUH^4nJiL6HBV&|{t`exx$g4d(GE?TzX*Edqe_qk zJl(!)kwzKg=UI3kK@c?mJKMs`G4N^)yxrFI!neRBHSq3%GWBTRgBIRV z2!gIZ?ziv;7{7ffscAmRfjK2Hs`^uah;NmL#w*#~M#J8F&vFcxe{ieBcEgzb!1h zdIN8pfw#u$FIB+PeFSPAe}~my-Uc3z2i`w;*ua}(;jIB)Q2(1{;eBM_J!0U^v--=X z1oo9${pE;(_n3h<-oo3Oz`ijS-cbYZ2?H;$h5z`dPhj5w=$XeyYTvm3o;2{zvhbb< zUeNe=hJ}}5;5}vFJ!RGR?F9BcZq+wp;5}pD-DBas54@o9@23`CX9I7if%i4?o9B;j z6WI4xl^#W2QeOk_*NE%!c0TbJl!vFYt8x{?@?TY~ht9uy2Ef_lAM@s)4uNYTuO!{P&R6zK4wZzHZ>H zweZ#eFQ|R1Exd0Hyf+QJ(YTH``^)1A>>CL^v%jSEi}$~`47|P;-m?k(*Tcf=XyCnL z;ElxfscGLEzzb^Mq0lq!ivmx#?|TN`c^2N=3G6%D!W(7a9W?OXwD683u3l?2u;f9&*>H(zkPa| zK$8D7UXg{j(7^i>R5hMs;dM-4ANP_n?TZ!oWjWMF2 zoFFI&=!R>8PkY1W=F=KtQ40M1>7#8{#eCEs3^7Dm9?h6h)JW7!?#~ zZSg`4)GAsp!CUc~@B2MxCYcYj`I#yc%Rkw_iAdeh)!TFJEJ1d;9%d z!`tA%D+AuS2vHHKC}<$? zc|bJK80+)R*uYuG+k@{Ieg%f7!uuuUbiCVshCO8wPP}*x zuL+&Ij`u|byyqdO3DtcJE$}Lx>Tyrpx?x)9|)C@_S1Jyc$P-k860`laac!JbrNCJrM!#YX@HUK)ZgYX?Wh`j`n*u z0$vx$>GsP8-YDq9{GP7ieS*#j&bIoO45d3Oj}IWH=w0 z3E*W*{m#_z{EqxCkAOG8k>Bq$ydD}}jHA9h90AXC)R(crcKx`|rYhgd9e96B zcN_3j{p+RSl{@N7RAT4lal50wJfq>IYIyHB@P9X&=le9gi#5C|hkhp`;N9oYuSUZgt>HB|%7ZVvY%hvb6L`i^ z9#3d^muPt3JMiKn;GJ~f)oXY`4euQXo;L#Cn-08v8r~QUZ?mJn;#s|&<@ZiUe|1>H z<9^Jlea!0Cu|8W7@TNmfug~vlc;hv^uO0gJi-7lqL%$XcZ-R#RGWt(A+uEBy0^SRd z)AjpK!{hN9D!<1ac93 z0q=+d&(iRwYIr3MyeSdz);jP8YIs*@c$xUv3};(;%#46H8gk5202e7;!{f0d3}gT7 zLi^Y8awFh<@4y?Y;a#cWRXg-s5CQLg2i_D7k9(9W{qi096-L0j26BuOz(u-R!~400 zcP--U`CSzOZyx-0yagKGH5%S~4*fzA@Qyn4Tdv{F*6_+4<8L?u-bTmx8`ALdG`uB_ z_k*$sc-K1K4{p=&=4f~=4*e=3;Qh;?UxkJ@Ps4l8G5%IYz}w{*e;?NH=4*HlIQsjV z2zZ+v{e7*5w@}0D<-n_rfOnPy?->nG{dQ-2yU8*B)e`?RY=)bL6*yrqu*p5J3Sv)>{|f4@e<+o<79ag0al z5%4Z`j7MP&?{*FEphLev1iXC?{qEH8exu=4B0ijL<&hl$?_T)pYIsjM#-mjc@OC=JqvIOh{Tkj%$M_M7fLG)g zKfciL9@Oy8aNva_;3YZmjB)MbQI&=laP;?O5%4Z{^!FYO?;#D3lU?9!YabO6@V<56 zb=UBItKn5T^ke($tbe)Jf!9aF+p6K^I`pfFfcJApfA81u9?|eDM}J=%0k4OnzaORH z{a(YXcj#9a0q<#te%Tt{b`9?~hko@D@YXx@o37zKrs3V`7(bdK;Qhuie&lL+J2X76 z1Mfftye*^Ta$~3$`X?PP6AI`S+))E0P3;z0ebf1Rzw1zj=fp;uN~t@Tm-yQ$M{jN;WcP@;~n3dybH?@oNeXN zJp$fr2i{=~?*$F7#(`%=z)>GyGDCBga4Cx8TxhJ(Q0UM&*Lb^O=k$-0*DY>hAx7R896R#E%gBZR6H@0mI zfyPB?X~Qjz{HO4?&+wr`MM&C+;Zh_w;a6Fc#+jx{k=VazOCQiin2CUfihDn!8$w$# zIb(RxNO{=hi7T&ct+$M7mx23Ew^8|ff7v!~W!UP`yT_0&V{?*!*woru*3Wx(i^p|# z3owS~8MAyDX3CujxkKwc32VN+Jz;;s%ZCvAP@+*`zWf2WV_l8!J*#{z^ZmI?qI1h~ zbMu0^xw&O`TV)TX6)yDFZuS?p)|Wl#6+Y2rExBczf@Nj7Et{?HJ!{=E+7uaWN`aNT zB&{&VTU)?rxvk!oFRhl==(P!3`*&?YtP{Z&AUtT5{VMIi1OCFz-b0nG2R3^{rB;u9 zFD6ID9B%c*4T_`k%=4VMz|Hkt?x5yd8jmD=9CzRcKhRnVB~W22z|)$4<*jY?Hy^2Q zIpRI=H|xMV(FdAy4;&00IFQ?X1kSXSM_eDfzK=&{i@F+xYrSCdyPDS|*3R%xDexBF zU@_z}qsJ#*T62E$J#FGK4*Z>Bhb9?4wvE_wGZcb8p7`6{_ndCt9(}(nCB?Poo661p z>L{bK+PgE(D0|vl`FpE+jL~Ckk1$H3Am_XvR2gKLR}P=F=A_5HJ$iQ(3azp>x3Vf& zS(#hA%?j=E*FKk)veFfL+FxOAdEtobg;0vakwXCpc-m+y23#>Vd@~)q6-7v3c z*}^5)TZ8=%#GO+I6&5YIcHW%j7ec~9 z&>%bJ?7{xQ!~E%kGy01v>bQNQxuc8|sJZRr#$RxkN#`&;lhC3zO7|||jxjLA3;K<4 z#~PdmO|s?V+V&W`5`IZWyz#CGwdW@#83_iJN_I(4$02&c*}nPY^4W{$End9jhIz9W z%`3oJdt%Q(wFlcA5jv-EH8y)Lz*czB`7zHsq8Y~grPY5f1nnNxfZq@-sN^UYd z$OmLVF7)F!S^RVq{tTo0R$O|zg>bXZDN=as-*vfxaIh{aQgYA3LzjC7j?VPE&>{B) z+!&E#W=a&ErAvafn$uQ#lR`M!nziJcGgEFK);?l=PmM@9+ zBPqEgFggVHlqi$ojKX}-c5@cz&AD*Sg-i0Uy-19GKRGrI9x`mOko@VfF})8G0I9KY zGPQex4U+`_eV9y89BS$@XdCIyN5zw zVmvJid&`@Ccrqhq;Dqh5_f(wYIcwmhkcVW-Rc3X*w`UjIyWLD+ z9*2_H>Ui(Yc#h@O6O1n59-DKTemK@ZA?O^tKl(^4M0ZDDlaMnkF1+3ozj=LVV|{3B z{e~gebeVW-m++KuV`PbRJ?TIV(A#SM|_HDSMJl@!_b!UQ6cCWvDqR}I~ z{_YO}U6X3#hD{*fPUO2>8-@U~NAGLm!fERVKktc7nQMmE+u9n2G+lW8#Bk~QLD3jq zG`lPN4{tDnut7-@43M6b;!dIsw&Lw0+`ZJ7-{9{VorWyM?2c}B8<`E(_Nd*_8L8ll zVOH1f7*RMqPgeLsv%L8)!e*YtH+)ytO)IYqZBJaktJ}^7@3yD6?QQfJjh7nZqK&N; z3GmwRbor&mUegevhc3lnz4fkxB@NzkBoK{JxiQ|Tea62t+vu{b$L1d4oNYf~`;n9v z+$9bE@&+%4IO^XIqWN4FSEZrR`?8x5-$kKfOw)FRX0TS?2=~~ z%`pZHSz(Aew93nu`PiKeQO6n#k@o)BBVCZtpoE-86W*wO+ui$Po1^JdZNRw7CGY@d zCnd`bZRB=WDoU%Lt0FGt4YR19H)W;iarIwc{i3&L4A6GR01JBZ(Rq0*wTGML?J;@4 z%8W@lEhgok(J4Ho zskYBvn1ZdKj=}qTyf>Dcom)?!n?GGr@gC^@K6-RKYS59`wFxp1wi$U*AVJM~U)23x!cyJZou2-s-8V z)53YBso|xiZLwNg8OvZFy4{5ehZ^!;%B)~UaT~N@G*GCX(8Jns*CqcXZar|fyJiM$ z*c*HrsI7060Z>53+N$Ps6OgMTt12VdfCV1U%^IYp=fJFXJ!2C7Lp{SmQQ338iqSx& zU72|u^vS5mpqd`rT?+JfW-)DHr|?(96O&S6RJFDOg*AxHilo}pe^YUWSDD*m7v{}6 zI^keOasR2Asl$p=hXVJJr9gh#j z`jw`xnmS=qT5D^Mf|PrxUS08i*7n{FxyVTa@V2|^PK0+*<%FD_@zo8vbqAY{9*GWD z39po6E>C=wfpKkXl6ial&c}YeJ^HC6b9;Qn(t?b|p$(SjObq!c{bEwCi~@R0H*_<( zI~%4nHUxy709q7X-7uvtZ&lj<*z8o)3V1c5!wS^-(8CJnA=j#@DOXZE(ZT0JZzP_* zX+Cm!u$4c)Q(IflZb_MMLS&rV2v5zKX~ejUQ{&i1|4(c_{HQT&$Aqek;AB@(YOj*i zb4m{mPVHHp%D0a}@Tb00n-fiLi zqJOc+g?=+n)Y;OdLHn6kjOi1jqhl7dUve0Jz^ zBece>+~*DL^VPp-)vsDnbh-P$KCAw~mxnHQ)i(tjFE^WCi$3(ycb9%}f8zTWm*9Iq z**(FsO8Kd#ax=f>gi5^=%e!o@#;a!7UoycEwG=-yT7p?uSU6P15YLRk;)%0gj3HwY zFxcWD_ktZF*aX9}`YyA^Ob(8*maWJ~sC91Nxg#xO`MhQLP_Sy=oE6LYp`jpe;i7qS z6O3ioEi5b~qdW@pmMx>Z9mbAtSyVvaLK|z!v~d!6z%Nfv>Gy|2zx(~aPY=hxcKN7p zKly9-VM~V;thu%MH$}s1{{HVHkNU4YRV)25q?V9QUL5J@C|$N3$OL^;CaT&v6f3{jTqy-!`0iR>HJTzk0Aw);pKqd&c$w z!JFP&G=jflNPH&a3gCMB?1lY5m^Gr`uO3>PbnlA!<6;w1p15vuaO}VDJ#znniT&2B zy>;vZzx(jargOJGx9aA#-~4@Q%d^k@^5Xl;znif9jMc+O{qXB$wf}yz>)dHg-p>bw z%2xj~|Kx{Bz# zweO7EzHR?M(_Y?l^WSg0WBvo1w?3ElzPBtU|Epi*t(khu=oJljetdUq)YwP9`Q?j& zk4{#-{!Z7AS9e=IdF9NzXMMiKmpl4j-qT-R`s{#Ze`vXN?aJa_!v@A)oEP`EK^5MI z;*;O`;^l)MyZb-z@uL@R*&JGzI_09f9(pt8iqUV)yk^)C)00{GhO0FHs~$IVMHc3=A0?YE71{_4}`pZ|8;syipTM)hjGc>Cfzj&4pZoBrVS zuP?lIVDzH2>0a~PtofzC-~Xw6n97}a=#?8shr@65`0d?a+~o7^go)eiZGm6?>a?x@ zUiV1uzV4MzZTT#CasA>EzufOVbK!k|9v1rg$;saeoNev6b}Ht%_b-1xW5^kI*N^<* z)uMun2Hm^1_Rnj-9{$1<|GD>_`0~Pn_(c!??A`K9t~<6l^WFo`t&aMqVY=K=(J`@c z@d;f#iCw#W{0hG-*}7nv6@CDB4EOqyPP^ry?1vw|=G>qEzV*Ar0h24YR3sd~Y4)W1 zrX_#*WKGsDCJpMJ_<--ix8grZ?)BQ-`ll`${lD=kj(bWd>g+q53ggpl@T)>Qxs5Ky z)AGmuHSl(I*j<70-Hh#0oZshMZC~nbPxmSE_`{+`?hdP!iHC*g8o9CCC%^xY*al5w zi1CKh#}e+L#*NZF%4GU|jeI;w0bC|FS}K&^G3@xmjn}06Fv4BUnlEJ z06u1iFIklD_^H=z3^2Zx@_r$oZE(*y62G;Xm+Ef^yeUTai?Y0xd$O#*3*eDtM5Bz`iSl@NY9qQYka#WN`5m8o?vaKgVv>=FZr67E z@kqiSw0CKMjQ_4ok5Y7V4<|)*H%a$$@JZNRC(98&N!CYGq<6Nl)}h~5670_+Jk|Kx zksig(EL(`SGNnnGwkgfYDC%z!>;cI$-WbU<-c-pmUcThnh6MfuFd%_H(dGrF)P>)c zlfhH=3dvKJ->d0Q{%y%qMqo1695&*&dZo)|22 z`V)hs?7%pt#24wx?umS|EQh|5rz~3={TVLeN}XAR$?>>>df_6^a3OOUeWk4~w|SAT zY?~MPy42=HA2iA4MgKa*<^{eO^d&xcVxNzTX8}+jp&NK&6OR7G<~T{7*w;#)*g`is zm@&S|0tX3w^m@|8_Q#YXBN;s7og;b1drb07_e;qWgJiNIfJ9od>lA7EZGT}079dEZ zE4xc!2icVhJFpNy_>;H5B!)$PC~lxWxJ>y+j(+52H#(3!bRag9G-Y?nXeKKQh!0bC zqwF0i&ol$%Wp_H3yzEM|$;)nY5_#FBP9cxD=i)h?yzEM6lD`Bu(ABui06D|R#bpj4 zXaAjqaq-_+fXgHRNZ6c40wwbTPg|ZPdD=nLH~3SG@hQXnvIxnOCgM_YsV8~jiM9!z z`CTOaY2zi5xA0scdD?iLT~i8K^$rlK#KIlVxVc;Rfo5i}LgF97sL~HxSb^nQ_oiT$Ew? zpN=az6*mx@B6;eg^$$v(>2P?a4D}NIHh89arSzw*_?w0@7M_ig zC(f&qr!FLOto>w|nQ8NkPo3A}c}m`?2#ETbV+3pGogD+Hv%ItZFg<05Sn$c`;ReDm zBY38tD0!xzBzdMU>J{W^AJLD2XZpyVh)bJXAbFM<&5rUp4GF*+2{1?f5G_%CRAX`MB90F^5i}HghR}rSTZ+ndESNM6g+XX zAwMj2@D&FI>b^XAkH;N5{dh95(~pM;+kW#F<=GP__}A#!i&rdKzOWDn_2#dhy`p`p zMrUE1tI_F958^DFx2Rw?zi~;4Q|5d)gfOFK@x1FP?acSQRfU*WGjHx}OwfUH9VP6u z9V196dqhHDxHzf%$KvxSZAW<9lotD}#D&){RJrUpeZ>wIri1Qn(_&6BMJIAjBiNq~ zmvxf)_K=PRN!!ov7^o5!8g&vbv=@Q%=UtB(I?Lz%7(gd7w${q*?TNSh)7+i;vpTl> zx8=lPX`vhD>J%-fB`Bq`^rM39$uGtnue|x3!*u=pm+MBzT934eNLU*Br+JWMirpiEnDDF!jYcPNeOm1-@CAA;q}Wg zEvh{YQ6Err;=FV=&cY%Uu8iENh)S|>QQq=`B}I#8%b8Wqeyzg+;t_MzK}w~ol8`;5 z$dwdy1o32Z9L2n3@$BWR3+J_&SST)w*Qr;>9kAdrp~2rWN`0Hsw(M zlXb_X62C+8Y*QlNC>8ec5p?K8%&z?Z<)Nk+v;Kh}cy2Lz*|&zX4P$vsy9Zut1l8kC zUImGFBoSiYIPQ|h0?aALF;p8ffIh%e`tj#G!>GrlV064k;pohM;~aRo!1E(M_2bWGh1b`CR}VaXPf|oVlI6fF z)AZx}l)~HT>ZspIxI44ocK9<+02gT=@cQ6M{kq{&c$*w}Q7A`#H&8@5(rpgB77dTT zRTbVzi-q_#UW8;e8Gv@⩔oMPvL`kjVL;qhCSj>oxxw6h|G_o@TW0-mZb zP_+&3IY<4w4|sgnRHX2BIqF|J@L2b$-x;`+ew7ZqI^Zo=U{a3GdmVTo;7x}=@%TQg z@W#M!dVYB>NoV!%XOLr@04~yBfY%34;_)vR3a^&~FMt4kUsOan(pe6?lfYB$16@)Z z-pAl|{l+3+iwGb|;T?yYd_ejSh0(?$BK6~U3x;`cy@E@}s|6m*T#>@t3lAM{6$-am z;-$(k;w?oz)$wjYXOXVJq#T`#AgANa#1E4D;7|R|#ijI{?!bEnc>Md0BBkHu4!kdb zR}UfL^~I&|_M(31`kh4M=!bAc3a0#il!jpLXw8b#ul{)Y&{7_sEe?^od z-2#SufDTYkR62z>2yTWE?_pfJel@^@3EPNrq>Z?Axmw7*Btq<)l3NES`GD0f>R-==z6r6oy7_W))>9W0zGZEPQj&xOiuR;VJ@4g6lMG{-#y$w0qMUhI^bfo(QbB$rlW|u3qpqUe1su~s?bI%zkD&!<+vZ3KE5fu&mHx?26AkVij-U;81gFY zFy!VcAv_tzi|2*$sb~~mf;3WLOCYDOJ$MxT0pA}cNm(WLFX*Ri!XV=D3>b!I;bMMi z_c_apX3s6kpRd**{M6cmjNx+Wf%VgC4@PmI2eIz5mmZ_#(2GF=^Qk>u8mj`ua(-oX zqlHOn&0^MbY0;XKrJ3#X+@yR;quD046EVfq*EoZ+;7f}{1mI>&1IK5+{VeHy878Xr zer(^_EhSZ<5p_|$A8R_hB_mU;_@kU1Qz$BK!>f$7u9PP*-;HyyuY?Wn%g2-E~a8@z#<6Ph>a-lc#gGc3bG{A1vQ|g`TUX-dH1qq1OJGnQ6_@MvvYlRd;MC z?v2d6=&eZo>P6Syw_1TJqS)GtIhIiUZ*GN?-(-2>Jg22%=3`Xp)NA4(56i?HiD`B* zkK@g7@TwZFt_X9YeaQ>nCtrAD)zp4L$U#SXvD~VgjGa}LuuXG}tsy){brBAj6^?0NQKi9f>V|R{cW1mAdfHd{wAC2zGWPin#k)fvoAs|+wa-|!O~KrKUQB;b=?xw6ajN9u6^ACc8N2?=#tE+4y5Pd zSfASDJ8YIWB-^#%8Lbxlt>S%T615C@tVzQf4*{^!gy+r|te*C&5qNrH*BJ&p(cn-W z9rO3mhCPY&S1XpdPd(StfgzLxGxz_cC z-SZpbJnqJ-5HZngX!hQhRrkIewSp})|FL~J-^4WKr@U^KG{n7JhY*CX_3Wo!b-tXD z(O0e9AB#e+^QHXUOz9(}Y5=y_Bi8KfkD0iyx*-l8yAu#&aY9ZGR;19arkdv%p6;cY zi!p^dZYR_beN5YQ^R}FcwJ$KuK$=PP9hv!;56-_VJwIoNG0L5hpPh*g6MdF#UnG@t zfotH&5p}UgVpl$#FwSN4xH)t%xU!FVB#L#+wL2OU$Jw=YVm?P5#Tu59hYj>)gCBc& z@0Dl*#(eTkd#4*2Xe!B`SW$0t< z)@>i^wwZ^zefk?|VY9QE{TXWZryXi`%YRn0KlFw^@in7nA763o)S4Z=5;Z%vvzqPO z&jkQb^&xl9xX_+CFQvlV>A~&pI(87@RI#!wBX~G1XU`Y;4P0LVOVW;r^0+&k*&|$< z>2V`uTo)rH<^+rbkw;M3g|SB`q>M2Zq~V*5BW}tSpG*?9T@;C17D>mt{&AwSxHwk+ zzog++?xKc8o)`?(L1c`}o1%=O7cJJ8*iufSM`lWwmgMzb^ZDSsUKnWlSEWo7v%jN_ zS)1Tq7(FnqBrmljbzx4n(GzU1>V`!-utKA?^&pmK#H6;ie$2i%TjMz|`aBDxBH z(m&0ZFcobeuO!cc_|ArblRTb8Xn-6?89CQtY*wCc1Z}?yuzsq#VIYtvc_0X}lnYGY zg+0JqmA7CMI$rj<6H*bknDhBrdQ~Zh4TNWJf;^tMBNUm<4(^T$Pld$x*f4WBAv(-V zB8&Nv^U@XBSgT%kSibgH)|lzjW{;hgIo|3wWtuhGnm%ntR)1@x)ybT5hvc~6q${%eLo&g5dFJ<@ z{b}VZ6aLct^J5uP-q>*M<1bwF&hpo9{msE$bEn_*);TYH*r)y*Puc15R(a;&;aOR0 ztsAa;t@`w)iynL?d`alwz^76Uh8{Tj(&OPCsac;^{p!`G@?kSBc;oC}C#64XUY6ed zhWkEy@-L@7IdEnD`|o+ikG<>Js|xS>pg1sX$fhfPx#F*9-ha;a#JyYpzNlC8huw$N z{4&P+;MI%Xdh(5@GH#7}p+2)QZSUFlUN!6FFBA9W-!#uR!~3rXMnC**&uhEaFMsRE z`>u26q#nrldh4EPw_H3SP&A-+(S2_{KW5Umsq2;vU3~wPmwLZ@Z{l|c%C@&$e)Yu< zFFXI8{Y!o~a@E!5!u+k@pTEBP(yyK!|LKUEPdxR}xY%>&+&r;|Ipnj(^i6MF?)%-k zsh|C99R($@~-)*?= zw^Kt^WzT-T{jq*uJ$2UyCqDn{J5@W^9vF9%XT_J_+;Pr5$t!lQ`GdRq?&-(Ah%fkX z$XtKmV4&N3E7y-a8Na622Q97&<9}hxf*JT7q3FM#C*94s8oxbBN%(={!mpPt@`p-a zlWu-(Y$vz)+N!(xYp0z~ofqwl-^2J=;y;UME+e%)GC0ng*2#TJ__=y8@i#l9-*3%wbx z*4rz0R~j1B7Z>NnULf7E!rjIAgG|qMdyLnmnHkct|8(a%-0Nierz0#0I}+@d?yH5nuW`1NUj{vr@O87VOrPKFlQ6G)pd-Ik4ts5a z9BI3VZ%-03nRyVCGS3sN!S9Zp&7~FdQ;??mE@{dSs3I;uwu10kRm_JaFXqTVCx-Jo zkD4dTFjInvxcG)iqL(Rg@EKCfZ>2vzRkY2A9Vq!W9i;vuuAkEO_ZgKJ+S#p`C1eQt-18JB#6PB3pv(TT4fQY5+Lm4$cH&yb~bGzh;*CKh!#xh+L4)M;EJn=|8`-Q~n z#rd#`ly0Joqz*z)-atZ6S$4!#x(x!KoJa|2H}J&Rh>QM=ey`+-@r2}wLF$mMEIW~| z)RRdj%kNwRB~ScGl9%dr#F3r?N9ru}mzct~dfkxu)$2wd;!7n*N}d?kNS;COOP+Y& zOP=K}=J!E>>5r!U!BgiP$~cl9_#hyugMDP16?tJp0Z|V%FIeP@jSnR1 zyaX5dl0%q1amDDsHg8_$5` z88ntWJwe&H%yR`R%1+h8DfFizpy{}X!+4@kV5b6NUXsB_;Ym31wBbdPrwv9(p0>F} z^0dd5k|)MhlBYeck-UXxzT~OKa>@6@^LEJ(#B+z_X%Ep4KnL1mkMyVf-y~1lyeoOy z<|D}m@I060j=0q4Jjss*-(T{y)5VgX1fKmr!FVjYM;@iEZJ6~MS0iHU9$M6%0x+Zn19rUL8UmE5%V!IgKS>W4SCp=t3Ay&IeUJV zEpvUFj4Gs`5bHc?J=s$sPtC2Sr4awoy~9qO5SPDb$(-xtT))|Kopa%wp(^=Prom~( zQ8JF)|5SlErn<3Vh)HWdhO7xFo1c=pEz`NJSMl^?A@7u*y?r3kA1CyoE8s}(# zH*1?oNQpT`s|(Rw=j2D6^!Hy*!Mg!34eZ|)ZN-m@yZ9m@3B!XRj)ml7Y^P&2r#&7p zh~t%0&LiXS!EuAc_aE{BT%<7G(>ShW;-WqbW4u>z>39LS``}Wf@b(jN~&lv51(fbBB&X!_xGy$$bOD68WYBCM~B!-v9q2XZcaO%h3 zLJXsReZc5=74TzviYP~_fsig&3BS(dUUSIRKu-T6q42mCTE}aOfVbU|-vf~AtbA)6 z`Q^)IAILJl$a-6TH#qR#Mi}3L6e;~~b>Q{U@c7D0IqGqR11}kwvf!^s;a%py%LX3b zfvBH8|1RBuHxzjMuB1re4RPSz2fRfPA|8LIEB&1F4YLuC^UiAyR$(xz;#W!k06jss0gv`4 z9$ytHNB31=biCW(racr9j^}> zE#nh!fRv;AYv`iuw+eV{KZ+Fg7ZB3%{2JaM2s4a$VO%;M&sm=dKSc`fW_aj$qk#7v z{HWhWGK_fnxOBYZz~gr}MGB9;xB3_ydBi=wij@ zKHsYn<%TLK>H+1I+%HjX%Et63UZqTP4e zd@&e`bU5E@iPR2%hr~RuO3q;rlN;2`0{Ev?8#@soXFX_t-^RSKNb(3cRX%Q0YwLz; zY}#78Be?5Nm|e1yJGT~uKWxXmom<>tRzcG4_+3qn9;5zX@Xa@|qx;|Pi|O%n!Nv~< z#Vf_2{qQ`@|MIwkkY9)Pi$6n~*SIGB7CV)4TfLNPjg2!3{`tw-E!?4v^S!!(nCsTo z)^4AIydb)NfZL6Xe}|`NFcv&Th`9HG3(Y8wMTeqPfh;ZCE6(m57$804jNwO(61P$A z7Q1C`wyNDOW1DZM+Z}qvtbEiGv&4c8hEc!G%Q-&SCLXiL!e&{8Rapw*sGaU;dzR24 zcZ_kwcg!6d`oTQ#j#azcsy!U6KjOvq@AcX&p#!_D+J}RoZGK{6YS71i&o_^lm4EPx zG%9Nn4t(Qlz9Bg3Wo*rMijJ zdohvVK-e4FXtmV&D&O*A4#1ml9Zo!O#20!$NU(n$@7nx{51Yk>K2`1(fFH3!@87Dz z;W(xO%k01pmAle*AA4O2Q!~hKm{A$_ZrB)(s}K7^w_EjfUQfKIm*;}8**niyp69&> z^NH@@1PLQP5DIPb^sL7|iigk5!%+In?cMH=H9UdZ!cD7B7~KQLTUEIqdkdenDsS>l zMR&E*JFUu?b#%%#-UE}lOJBx8|5)#o>DGa_(RF!Nz!LPKDNcgjku z`IF!Wo2FG8v!+h@#M}J7bzntsVDzjiz!hS%yc>f(qiweKir}nb&-%g@!oTQsPu8rZ zN@xbkiqflAwEWwPJ@%kwS^cKKcji(|Ezc{&0R`}b#$Q+EF7ei{^P%-&f5_0UE$czw z($-d-P*4`O9`V)x&T4+yJc>CL`@HpGtMWD9Cd1gARwi79aJ9B#?=#_QIV$QbG(K+S zZV+<8vTSeQ6RY`dADUqRkPlcb7X*)Dxe+>f7wDm|Awf_dxI9%!5;Ud&|nL z&;Z}e9bgfj+S)pElhv2(f&Rgn4YqF?1diJ5f%Ahit8BJs(#&F8wBL#5-oBYjrNryM zo#~r`^AR>%E$^5!^K91prVrTGAR-qc*QHkF7PBqaE#<*>{%+r@G}{g}<4T_$=45c<+$_KISrnwZtviT|Y~<&A6BeCYXCW7BtsJ;z@9?qt`mJ#Tbv ziaQ+tM%+vB8^h%i7Z)kL8Kat@)W=2)Yo zGPL2LjZX;fmJKCqKJX;$tUTHHhwlzOwx;JN+dkj5>gD+hVitBQ`djO&*wwwZt;&D# zyIoggM^A`ZaQed7HxZUUzgPZ?AwI2Dy^59uS9L2|64?35$&K3vY<@rE8I^Ngzu4Wb zAJI?P>Hk|^st=hv_jr-1HOD>iJwL=q^8A)V#|Hi41JAKRvp?v$>)4jhi!S76 z7hUq%^{K}OopWqa;LxC6hZY54+l@~T2yab)rCsy?P>M;2ym>35o1NHK31@Oim?KWpVpe02+2$+TX6?iv^R%xK zgUs6|1_~V7fqA3NPkS+G^n(;W6ssqj`|vfYl#&6O4L{>}c- z?}CN9gjdzBU3Fb>R7>dDVBssmXVc3sH+kyev+gdmY(^{Iupt~5D)l$t84Ud0EW6)2 zoKiO0KjjWF-Vm`Y?DyXtES%uo)Y>|6LUvRD?#qIOUwDJ9t>1icvRlhZzaMDn+?9J| zdb-(~_IG#D5w`Pj z+~2#=d)_fu%u}t+#X;`_Ci*Xbg}(-chpx;I1C><;y`n73FvWbEzfKeY3~ZNPweVwE zHH#vwORN183prHzC3fRS+J;?z53~I0SOZvEb;09PQC-T!G~>g0J10klFqc`>x3c>z zcsEXtMfI=?p7jZW+pOxzILgH;tNn84(Vxx}5#(owX^I2BRv8>ob zSy7Ey(L1wTHN}Io+~rwDNtT(p=j6tf8w+xhzrl{ZeYiFN^I79c&5{^5rbx!PFr6_5 zTML)OnAkHtCbl%KBqpXbb#P2n?-=Z>k7PL|F;wF7hpmcKW3#U&4Rf{ePKW$f1kpNc zrlOJ6-j@Mak%FiwR3pRWxG>XESf$A(bT3vOPi$=^c zX}GLdS}iMvR?CW(TGtfkO#jlh;Qwu(a}<5fPxm+&!~X|*9P}ZqZ>U87NsoiBg|!&9 zvsqOyv3L~{1Cv175`WK_esVJWKNJYYt1T>*hpIMK1`3}eS4SmYc=WO!= zd)x2PB*XqP(LNhmTVFc3?NQt3?z;*f@!sF%C}jR1eEbgw1CO(S>&{-BSoxOU+ATVy zhRUZa(NBc^2heSZUQ6^@aK9QX{LTx^Z@xpX1NUF=D*T?^)HmM?_wJaJ1JD^+OT4po zOev^b5Yv(qES%xRJL*-lW=2mb@VESe?uvuT`PE%`(fgq4n;$-Q0pKftXl^ht)6AV` z&Ahl@aqc{SbB?#7p=?GaBDeZ;1=u5-uDZ&03aqQHwjBj`6&84}UA!PBx7CmSFLRIg zymwvW9&i1uGW1RLBTGF|FP(VfXvNZrn@`4va3<9fZ@(QDHS|L%fm@yG6~Ic#!w0Xr z#@1OVxx4FesOeDhOsH6!JMxUohchlwa7WVn-Qm6k6wRDG0*8u+g>GLie!0<$Ah>z2OiRlJ>#a z^hGc*$87n^T9Aw)MFwFX!Z4bExpt9;G4q5lheBC!^qa3lT{_tZH3^Z02C^QZi1d2Y zp@7T?o}g4YG%@bx*hYHwC>9iT?2se;u19nllFx z3}IoDLxXsY5JMP4?1nDhIO^E=F@)j00z+7x7^TDzhUn;BIcSOZ7%_wqQVwApnVz=n zA*@LaMz>k;wudlAtO=rf<5*`8VNgR1VPb@e4wb5b5B@(kg#G{H7f00p%kis|*W!iC ztmT(2S!s0=^j~?EVQ=oFp*gGcNW+iDj&_w)9S}>suvDTlv{W1i6Kmj91boZFnhE^W zPr^GO4idmS!47gqdCTK1SW-E+bQ8G~ycK)GrAsrata0Alr9pZeOu575>9>A()ToQ` zHFjVZPu%+C=!0V0Lv-+?!lCsgjZNuQnC*WMuMgpdlDyNxJ4*7B!bd~vD#LM=c$1O3 z)#Zr;8^-lCN~))9C?1S8Yz_D0b5HkZ*mxb*#N$tV;n1xS zEL~iZ=i~YiZ+NP(`K(R4)qTS1F^RT?Gi|F2TPmyTe%rZJLz<54%%hp9rwvX``s%zi zhxrf~K3d+8Etb{oYzS<4T3cCH5Po-Eg2TKx4l}a!;5=_;p0CG@m3RF*oK~?Z^e18c z)Rbv2k4z zyLwMMJq4Qs_QEL+=k>o};6-VJhmJ_Uc=XQ#W3t9gm^kV3sne!kIrHb&{30)Z?)(MU zExx{R*@_!h-?-*ip_^}ASGwW0-)t(s^PY-(?|-1G`r)lLzu*3c+Q5+5hT+KfnIhH{N{vo#uc1^Suu~{OHpYpMCM~liz;-1I||!^n;{cpst{1&xW)Hbj3eB1k?OO^A9KR z4-di6IHtUrk}>H62NV+_bnzd(7(kW}5(Pj)#Ev9fLPW^OKt{DA*;0(k_yI4z$BXas zQAWTUMb1mV02mOS{QMpTKZJ3yKAzykxBLJl7)BT4h}ghE99)#Q{e&F&Q4rk0}bh;m^2226v|076v_tPkH-ddX$BJ@Uq}*iO2yw z!84-Q=HWCf@bC!`5Mkiq2M_q;4x%4;i$O-f<^_hpA|_&x}&}rcc8Mx>MXY#V( zL4qHzVqU_7vQkEb^G134lI*x43%KOz173vkX|-d~&&1`#M-<_w;wcEW{VGb{J*J2`qsxVo;Xp8ErT+J<8G_|15Bjqb`sIg?JNLz+J|rTVhy}N0<;4 z7$Lz@hBzTR%racq<;)dlM2S%R-Hp5}&cdJP=x@OvJjjJchl_+K!@x;dxNV*dle?xd zu82ooU;9*@9^|JL;m?8~Zcc#sBn6@n|umlf( z6G0~b4vEV&GMNeCXBYw7FOE<8AsoCdlPMPfA&f~08S<2aOdP{;i7-CxF#h>kq(y(h z;~}sqL!y7cPFI98J>_S|wRMoPDji_hc$p$DT|y_BhR|K$iVzV-J)jqJZn#8ALK8e) zREQ`D053iG=UDuQ2W067K2F4izlcB#8_Nz8;glz=2oOAFi6LZ(X{T+cLoo)};R2RU z3d=aQ9zss|QwO0JVQt;O2;D^h!-R~jD|z8hOs0)msK!v!hyovlQ4vp8HV_Jh4E-qw zJ_-VqVW0>SHweNLa+GBdZj2*j8I7`xhcJP`w8&CUrYoGpV1RuglARWuwoXik|7|_! zXY0%;GCib28R84QDa=F!rv0$fCU066&h6?uXHeFd%t3vJ%(eRUUB(5@bLY)5INjHI z3>OdLvLlSi9HU1t9cMSGGnPgSsCaJLyxLif-ZSq@ziM7pbz#neh5tPL?4GaR^WiP$ zE&KNI^2wjS@W;$M-W)MExNAxNl9_L0e|l^3ye+evR{iB~w*(iQ@U;5xqt2r#{a@P;MtsfBbl<^#swYZxgw~YxXzb*?~wwyOylRqybf-C)*k0IolDU+>TKQb7}icu zAugAgB`vtsR#_0AyaBiHRq|>SA<6NQ#Lw<}A&xt}L z;F?$!mD<7m3nQb0d$uvPgFDway@NXsJ15w1HeSAw)xkZ-xTb@9t`xQ(?o-Y$y3`SV zxx;;hahWV1&U-VB0;84<9%Q>07!8>7)b5^d+}$DkT4QU6@P)Rpyt|DV4mW4ex0Cyn z`sS=pKW`TX=k74;lWxukY$vzDQf()_PW-%M3x5y`8IVz*4HHPT&LaQ2%jU{Bc@g&Jl+^2!)^IQxR*5+RN)>Z z=01W&Ov(>yTSsoYGmML6eX`v_<4)QCeGNU5u&bI&y1B+L$(UfgDc#wKmt;&fvO9!N zHMmEhBHEK{21xvwmL%(^84z9^+}qZ2)5pxT{p0B`^C|oTw!e^<`4j%Syv&F2ztEPa z7taq;#4{8~Y|_aDlVr+njnHPc?I~oa2#9k?lfg5b(M&&XAkk*iY`za3YJD<4qN=ld z!jfk^4$br@9{WY|v=R3OB%chvujGmSxa2MHdnDfz{JWCx2mVXRv%X+DgTSGBYa~Au z{2h`{2mhetM}e=Ed;t72k{=8HWyxoQKP>r4;NO+}6!4!(emeLcBtH}U`6xH$g(J_+ zlFtQym*nSyuaf)%@Z1N1@{7Q`U|{mJB}ttX1rZ}zu7y6uUmIdgHcAj++UgREU#*MA zG}E@V&0ss?vjIzrh{FN`2^{cDhh(y_K&PZjL6DHgtxbNS?Jx4BO$?8SBe(w$IN*uH zB+bD#4(o&|hhB?33mw!4mpM$Z_Il~zHqW}E)?l-)n5-BeMl&-6E98^UviV=)L7wTB zN}l!kQOSGod|vXb&&`sjxe{1E5tsUkJqW;4-;1Qb1wJTw>iY}Hvu-buJoV*%BE+G- zzmdGmX4_d>#O1jyq+4(){(st5=P@lR4_bqZd=#GRB~M#zlRRzJAbHyA?~YWB^#5A&7M|Zpo@J8A`Xluh zV-|Sg_mKYmz-LOHWp%ma$AZt7d;t6nl4m*GDS4K|1CqZQ{6mt@1<&^eraKq>cF9}d z|0wxI;Quc9DDYxTggou@sq|;r4&~S+^&cU5>YuIoUn+UpAxHAeSC!gIb^b6XG2fSSwkvy!$@^ zJw@;oID2VygvHuSuY-Vy4&Nd4=CM|eh@Av=h{E%pB1Ex+C>_bDKXoRRt!>A1tK?n~ zy0JAFwP{5si{c6PBimCrf}Lg^@)L1oxZ2i2YALKIwzq(p+D|u{mfg-z0dJm<$qHy!#g+5&u5%b)w~JG-vjc~ed?(u^*qd%FnLAfj_u0$y@)xzA;lsp*F3S6q zZ3w9BkL-Kk2tL)~KOT38j_r)BZxCSD1?M&cOxP*b3k&v-Z zN5falh&nmN>_ULDL&V{2v*+Z`k-9iTu+@R4r89YzSAIr~nE0tePMG$b{wPpqVx2+> zgZwmP7sxt*!Ut6N(UiqgMk)|T{2cL7EjrAU6IK%t!$fKkvT%+him*WjUTGv2&ZhS9yxfyehF?dN$L-ir>rH5y*DhIbXfA=;LYNiqx%K}x?Fkkj=G zYj`w|((h*uJie!$WO@O&EHdhoja?v!D82vYi$z(qbFe6he%!(;kNzdZ0dUIpCz4XH@s@i&W(_qK+| zZ#4>UFnArWPKMzjNa69PvyOLM!{hI6g~#@&<2?g6MB7N=QAWr6Lc`-HC588tqrSY0 zF#dK>r0{k^PRHX90RCoR`|W{C;W_sk`3PYHaVb)G&izKZYj|fvSmC`2Ue9lLI0_Y* zl%w+{$p`2F`87P2pTesJuj7T`Q2VVip3?94k`K@mlnp%giOg>*E`@j4QJ*W&`6vv= zQ~aMD^|_*dd;fQ?hWDfc?>^wMzAI9AI~;fqYj}Mjtn~W;jGo`x2>QJXImQXdglaWB z)-Q$kq66;<;K|QHA|~ZXjbO+J=m0&V;el<#TjaoN0bZPlVc!(qdLYj~Uw&(181Z^L@GRhU zR-gI3RL6_DpuN6e$Zo@1i~Q;Ol>x6a`*B|w9nT9qWxpXB-Yf@R1@KZ4u80_<=?=Vp z8XiA8tNf;d(e-;Kf_^1Ag06c%OpT@je3HFW{$0;e7}X9dC_>$4{FIZ?L00CdGDM zzJna)5!Uj{Pnim@s{?O3@KTj>QjX4e2VSLy7nE|$|3>6b&oB48Nhg3LmEU#Jt^w&^ z2fSSHwBHz9O22Czc(uUe-y;<%Jf06nJ|F|SqZ6nBPrNK#3h!%2ejiP+!(=oeNB#>( ze(Qm!%6Ghmci4f)bME-}QAJ9>KRfXD0Z+BJ2^!u(M}9x*(z*TiIr951@N$8}{9dZz zJ?6mcgG})6wThH}+Z=df2e#X9vW9nw18)%qBZWas#gBC0eFQvZzsohevmJPa!0XI@ z-5q!*fv4;@Rl{2Y+w1l3QM~MS)}L}e9_kvvMe?GPx8O(nU4e^X)c5BOyqtL>+6)`OKB%~qn&c+bS^i;DaV)6PVn-i9Dg^E z-nQ(&4G9NsjKT{C9f>C%g8HP|?L#`-p#LQMDfk zDgc02DDxJ82kU_s*W3k*|GWLA{KJL}wn+cM{!*-aAp6@&KjU(#-Ei(Nb#>c0VQq_V z;ExqvV#}$v zM2_0cQ=y2R+S;}gi$Xi~3H&^TJm8RcD?lGINCC@5v?Je~y)6ami z`(pu>GSTS$=4)rSgxxoWOWoR532n+MdkoJriW+Ps5YICZHlcRlak$(0F3$i!3d`R8 zCKeF3+4*;8MK8tjK#UEs)xwwhY-8yaWtoML%rb5)354q_%+h#I zLd@5qUMPDgz4eTs92UF88Bg1JK38gM>)nsLQ#QD1D|!^|^=^HfOFr##JrYf0B%ngs zUN~M*dadcVK50M-rm(e4+uMEPlgIY@DG|Lt_J}z5D2!Wtix6sS5rP_DL zjiqNfTMX1H?!bdh$^f(Bg0_Px^}Ha?T32doYswd<&<4QcM|Z%D1CGft+hgi{O{qs%$Z)Se zt8dQBM)e*Zq*!N)(*rKhXg{y*VyHr{rjTa0T~Fk>p#l#Wio z($TF$eVNZQpJ>0V(1Q|$>3JrYJl(PP^WMzoxgb^SWrSw4t4l_j9f1uJE#RKy?6mwn z>7E|wE|FQcIP&ncg}&-N0Z$LxIX?+_L1Z$u$=4i3f$_e@IPa@_D$o2&PeUyhhfTiU zt@`Oly9Ok(iTSrsW-4B@;$Nr%{1f}Uj1;2qn(5CF$;b9jR9Tm zjA-GK0wbdOnR{PoW!f+$6lWPDqffc=pAUEv;ExodRCca3kxQW`d|lEvwF+%0kMF7Di*X=62R=uBdbtHlX= zEI3C$#5xrERQ0Oh_qFp3J4?E;4u3*%b%O`G(}2_66L0PkEob~t2$u4G>7?qJX@p0s~v7zTEo>d7M9L5-4T9LP5HN5k9 zfFo?r?#tNN2%p`eyGn3FcEgQSK*UKoKL!l47H5o0F|vabiqq599mkn)GJNm9Tf=!P zyAPe#AolEHuOqO~)?#qbB;(RAR3ho)tW&CI%d z{^F_AZ(K5L>C8pL3Z~AvEMxj*Lx&ApdEMocM)-#f&c1Qgs%bfsS1*{gc;(bN^C#Z0 zATc3rSzcOt!Rmr(8J922$(lTC{-VnZuUne4Wc;MdMl78>EN|*%mn|H2<%o;M49Llx zn>{^q;+*kUO0a#^Om6FI_QrQO=6FIsU1ut{b*=#>BiSS6#Gf zMd6M9%T_PRDZF9fiiMe%Pe_}8*~0WCH(W9E${U08v&JMQ{D^@P@%#OMVX28xhxboK z|L@nD;77Gaot-(yc}Ap3xNv5wu|a+#;BR$Thrf96?{oZd)=qBm#b0-y-R=O_*%@?d zF8!|%?&|Ot3(EI37E6TlMEH2=vLC0eRl&zqjodh6Os7-VrtphoJGl*h0c@vJ*PaB8 zdeaX777tU*($nR$+8y9dT?@i5JniI0{3|6Mefhhhk94!7xYl62EDsg#m+o#NJl=SX zKS(4o{`wB#iH7>UND+o#D$6qfJ_&z8m?nSh@LOdPW^(dpv?9u*n`$GvkF>dLyq6sA zg${k*lj%{6@ijQ%#sSWP9>zV%IM?`#BftN4#NQ$1`wIC1Mx|^oEa@byMY>YDXAAcb zF&`GJAf~_8q2DHlyNlNTC|@ZReg@AZtX;wjN*ghJkJOLtBMD!8hiMsP__b1BMxy(5 zM}8i6;7xb9FO=^8L)_cIM^&7Az~}5HyCGRM31JBY>TV1W5R@Qduu!v#5I$@T)h$pd zY=Dp`5fVTW3N=}6vI+VYqJ@CklBhLun_Eax1D0MkC`1sipsi>xEl{iYK@0eWACUL| zpEI*Ld$Oqa-uL(32Tt~xnP>j<%rhTn&Y3wgtZ%6}6{^z`{(Az07T`+78&j?aRK)a1 zx(9zic!d!CZAGT=Mm>eUDW0BX@|WrHhwpGmoJY{vAVK8QkSB(-49L@u^@+S99d>27 zzyXifX9f;Hp*n-mwJ=uD8BQ-4hM}mrxGvug0&y6F7SMtQT zTJpr;+!$pjd$Z(;M^fvbg$`MUpU{B-Adz2o03bImo-IdN_GaWMd%xtRxinqsFK{HL z$cyZvMP4w-Cy7^cvf~i1!K9r<{gJm2CZ7hL>56g!Pi$dZ@Wf+pN*Si}W64u?k>rWJ zQu2|yN&t|^qcjNnq%`nMiv2Y)~)PQg=_cPRQ(wnto6LXgP&)dnwc zXjBkX*V4c<9_uK1;;_icQ)f|*;E6F!`ZK??Oni@Yr9CO9&YvTeS|=~`k#-PeF$RGk zQ5M4u-h&_Yy+#)KT*E(`yew0Ss&6+&l9y#Vn!K#HjHbSI5_!k_V3H_b@YJ1fY2can zYa~zIZ;(87|Gwm@`+Uh$_xmL8!S4piQ{Qcpr(PdQp1QD~V_MYl67;3ynePFT_kh1z z^28~YJo8;8dFK0J$rFEz$Xpi6-PSVF4ze1iB0YqEyjJinQ z^*!Nj)Fm1QL^wTOp6S0SdE&eydD{G6k|!of z_uvmm*^O<5dh0jQSN8dr8$9(^-+(YaZCij}VMFjU!81Lb83i%V>RTjKk;u15{Uy(I zu8=%s*-cQM>4-ibJkw#Z(VsFCBu|;!B+v9`OP=YIbXE|M$d|lFh_)jI7$*%p!!shs zW|b}}nX>{5+ZW6!EV(;SUKtfoz929^mjAr&6AQ&!M7(yMBTw!sT(D^I3M}~J!eF(Q zv1c%2NulV)i~usN?2bZFtCoq@Eu(yy4;sE=YV3pRA z1yWvlFmVAOmx7!97h%Ei#j-jtuxK9gGOs)$qD-a`nAvD4V|Atq7wgO^B%YbM!o25- zY=o8u?phEn5-XveQauVs)QG6GVgZ?@l%_PAQJ_H zm5J0rkpUL;VjR>MRe5Nlo}oRmw-BipmMrT&!!cI!CLxtMR)DB@F_FI+wp${SC)oxU z-o4yZ&*J3?|EGwFlv3$CqqykIt&Y43a z!75RSvwd3qN|!I{>9=^k@VhGNv7>S-BvRY>ZDFVpcnsKi#4l7Kg6pe2;VEu*G6ll|)p*`x)*L@cO1QD#Pz@`@EL9_JmSWtn| zSUf*sDhe%}2g@&>Uvl?7bMOtw#oDORPb@E7RHBx($1+z>sUDd!`iXA>GE2c)TuXnE z_3Qub_2qwb7-M?gH%X^3CO-;4MHr$9`WgO`S3#o<@5o=?Q%M;RvdXD2hAW=m(UZ@k zCuq^7#=V~7RXZ+*@!sEs%Z!%`H^={q6y6u`FymF2@Hhrgc>Lzwj5ke&S@F0Y!;E*o z36IZP3Xk8=nelE#7{};}C@08*x7LKmF|NYFi$KeRxzsnHDa#BPLQh&&q@wNkxI3MQI7OIi+-npmk)p9@$pmPO$Lxz zzat3a7*>(On*cfTc`_gunN<1Z+z3@_BTC@_;uIzr?!&m%@A3qTgD$JqTB%@J_(r zjJE`MD!+putngm8;BjA(dli_JqjR4HuN`=E;ZOaB;8J)k7CgQOkJUaNx8S9t(W?5# zXF!ElYr*6Bs?=W*@!rOowmbpCU0xwqkXn-8!&X}%Q4|yX~EkLyg3M0r1TqX z!Fv>Ve72^3e3zv3+W_O4?U#lCwo63{uK_~j^JKtj;I)7!-nF`U4m86|4R|Yv~VGp_5njWvmHLt(OCgAnr*NtAE*K!F$+* z$NpUDHwX-~r|{;3F^`=nNAiFnpGODix4^5wFZ0XSTnuBq<(`6OJg)cWyE#RaBXQ3G zGhSAjaW5p^4Y(BE7Vu`ghcUSEz)z9FdlDXIytjcj7k@U-$IW zubc2D!H;s(?-kge`pH+g+7#dw!mWs5yxQ@Hzcv~0TgaKqjbWrSxXANfKza&;L)t(Q z!+1@A0xAx}k~ooKA{F)|RGbETSAU|_wMSbc%zKJj98 z8dfgicq6QVIovV82#GsrKNWvoEmbohBY&&5cCWF)x|*>mqr|$JRxWu0j<-%MN5e68 zfR8)nIPZl2h(y25R*@1};NqUewRR3W79MiVNvk0f2^QKy?`)+v^MLb5e@oemECbT2 zuu27TIP){TZivg4IY}Ga_rOACh#6_#x2OQiR^q`d^MS!Z37a3Ne@gs5f!}z(L&nM| z<^qf6pq`Md?EiGy|5P9gE}|nT}-v_&5Y;v-o|Yp39eDkj&tXS{*WC zwi^La4yUj@kbt)bGgIB?;>vB>fx@*E{lZd7g{K#QLnGV!qCJT?2yvc#icZnlG8M$1JcIo(-(FdD|AGr{X1># zy0WkTeVux_X`?nszP=k-)-T==uWFOb#)b`Un>k}!%(J9 zKM;iJ3OkmKNMK^NgN{=o!Tz#3Iy&{E_ET}^jU}A0iqf67Kwh&%UdQSOnmb@sJi_zf zgOEP5akndBM8c$vy=pfhA70iA{Hg7KmZnu0D*x&inCG3Rpk;ts&ZL&P@duiNo1dsJ zXF45+I~F00r}bUb@xerY1y_g(3q9y~>e^w5;Hq5P!lNtt>#lxP_xUzqwJ$_kbjWww zi-vJU92PS_=opb8tt(DycrelNW!L}7@}9{03)-OP`X2Uv-DKC$d7H?tU1D6djgVhyTy6~d(;?>-Ku#V0o{+u zEaeD!hqej7iWuH(x*5P(=4wiO2b%R4p;G-oenvCH74;%g5=43&T3d zUnb@q&EcKOfnVa^ZYl!0mrDJ3A4|m(yV~m$P9eY2q931sNqM-qo~Fi6eNh)Nk;Y89cL@Ip5<7|M>ol?I-&tW)GETPS(_2-2@G zeg*yjgBO@t2G4haYX4M@hsjfRwB#wv=K=aNEi(??I*kMpn6j*CO75{rVlk-wRs|;f z8E?GwC(kxY8Da>0vmIpKkv%O-g7NDJd# zlE}+2gBN+Z(%`9zKHT7msn&WhdubE|F-h{oyGHWF^Glv$^CVA<#gZ4U9o`b2Ld&I_LoJNSuS}=6kqNNgi$zt>TuL?6J5JXU98dxPq z84*iP;1({JPdJe%ry--gnGMrSanytcpAF1`);W>x@W_T?J*J|BO!Ry&Wnx106zi!D z=cB%MwpJwAL#ii`F`2`4*=mkCrcOP@dO{hc@r_VD#d<c#Uf{hfVr%@>xwbU zYz`|~I%nmA^2OR!JyV(&xO>iggjl9LW6w~smPE}$irR#tSXQ~Dduo!Noc%0cuyk2~ z+c9CEHKmQUxy&(zb=TOaDZTC*8|6(T;SpoLU6{xe7_&&D(3l7rR#y2g(;Hv6w1gM&B%{jMSZDekKrWvQpM=^c`O}#~53x zXP$aaXvWmGr&v!YqjG9}!W$PuBBabGFq%}kOSQ{4tPdECYY zjh4UahxY-}vluH`<#-=cq~sn3W0vDsgZB?bO70h6$mhv`RRH5Xo9WY^7wE-a9BXvwk1K526uLczmB`miriP6-Hsje=7Mr zdV)qmd8Wg3IhIrD{uR6#?;PB6=nJkJ?@h_)(GxVzgvVjF!sD8AGoA~MG!eu2qx9ps zAmsC8SU&JZf~S5Q-YUFl7CaB|)O$TfRd|yucoo1?<;EeM!fUnIc?s}n7exw>``?n! zlL6a-mj#~sak!=M)>`mZ0WS~XiWJ@&3*HeEo_VhGEyTzFNW0{`ff!>+K!x`w_><3* z{$H8!I9^ryJ!`>x8SWAphd&B$n+4BHQ|+7@HPW) z1{IQ|^eeXDbplV-zbhcC^!qCqh(_#p4tTNZ-c_T28jOJX1}pwDjMu9ucm67>R|!cE6?P1A=D7{t z&q+*|q~vD7eh`h&1Hd~i(@_0A+W`g`O9Q6Kjc=OU$Qe0u%xE#o@y&ZjY#m@EZ|Ihd zcOGJHBiQlTsvT=X$@us*UFSrHdM8`;`|f!P5!3396wAvH+ruOdWYeh;GlOXPG}B#vvFdr@qKoD-I-$v8se-^bWdJ~BY!hr z7|l1k@#4eQRp*{+vDFl4Ll4dLRR)^F#nl?WM{W+!mD32}8ONMj@Pz?&VV4bIb!D!0 z*MW6iT^o<{&$ffM$KvwWl@!$F?C{n;YOBfBGG2bEx-==N$bHWxZQ;4Cy;k??@TMI0 z;?!v1j!*Po;mQp38LGF1i#rhPJQ6=}kt*ZbcR7w6g0KJmxQ_4)Ojz)JYx&5t#;)voWfU_E6m7F(z!Q+*Z;wd0nY3(>p8Zomp4i?440Q zIN7krEs5?ITtfq6%YIs0b&an%JOMgG`QT>b5OYJQEj$gi3wu#;ZwbtC%)oiI_Oi}(N8?X6oih?tz=pn5T$HbQTMP|*KLl|Kv^S;MoBVXy z#z0*GCewTXF93J|CN49uInx-!#KMvhJGWW-0*jrMbBwN621-!jvJ8cq!?(e9uv>F@ zn)o|G{2hnC-91ErJw!Y@hjVc=eXb0&rx|7VKHsS!VEszHq+oK+jUA)mKrg^uV^)3g z)RRMt3!)OyjPK>GiHvYyI|XkEI+y%FD|ZB0KkKX3xMJ@vM<@j)_tc>0+QPR%Reno< zBnLkJw;V1fN}PU9n1xNzzX?rq0t8WvXt!*6E92nf<1Q9xtZ{4<&EatfZZBi#CTs^V zP6h4PE2}FxHQW}?>IhFb5gsSfJLdzkdkS_Va2&*z1JYi_1^zqF!nG^0(+k|vME}Y& zaJH8TbyxJa!J4Jcn%%0!a_$Wi&jK-4F-FQy6_ELNTX&g`(QS{#Pxt!VFFH_u1?AqG zg5DeJs)OFVIuvH!(@g<(pOe?Y`ZtDiVM&KJD$sj+AQd(DP-VC>2esCV+Qur|n-k%j zdu+9}Hyw;SxlYzu_jGI$k*BHyx355T#c=aLGISU<%+Y>MH5s0TUY2$}NF4X<%>Hwg4aQ-WLaLxD-{ ziQcZRy+<*tTk~ICZC-9n(^4R!O}3ASuX#h5^?%!L(02kCTQSIHC6qGFBC|~To7Mnm z+l_KSx-((yWYmAyra7E|zjrQg4iD%Er;E)pM91o0N%Z<*du>`M&{$Sqw<5haGG&Q3 z@U)1R9Ke1Qw48s_SHdH~aP9n(wdQa~@riKq*|0I+OLc{+{?so+Wh>I-Q8qR2;q3Q` zCsl0|_XU|Zi2D2MZ5?wvI(TzwwaKk0Or5-`u65f4@vuEgUt4p>+&0WmBd@~4sW*2N zV^SMX!o&S877G}5gq!;(xtulUjq>3-f=G~IScMN+c>G`N&VU=7X&@eJ{&ow-t|Y#P zu!*+|!YTgroX?d5NhxBFdJ5q?B=b`f-D%xm;OtSOZo1{*FM{W>$Y)vH*%tS3i(8GL z4R3p7#H-x77Wr}7Gjae-O*ucjK<^e|Zhj)|Ltnasmhd)<`xy#KqWnm{P?ALV%ND$H zi~E?x{g&y44&&csaWA#FQ)GI-hhC|gqsM$J*O4kB-p7{oK9%8|hfLKj)%Yx?i1K?Z z`87F(eQq>8lThAc!N1?4FV`QE`0gnc|E5U5>xJ8`Wm)7OvFOizen}-Fzx}n%!ezWK zNX6H#{Vej&SoGmOl!~Y?-{mQy`!40cFWtY8_DvA!WomqfNiy^utbHlNAAw&gzPvsu z!}-1@6}tksE%=iy>3?F$ug9W4-{p}8<4VP>9_RHGQ9tW^{bUu0UlDG>UnKGQT$+lL zzV^v*%BCV$YJQ$D^uy{DL3}<;#n-6JjxL)ypXGHquSi*)lfEDZtNCiScy*4Nhdf_A zfwFMva=x0aT$km_7Ov*2N0K)^FRJ-xwrYNVOB#nuzg)25dkQs&KNenU4*w>}vuiAn zJau0rdFsAg^3**fdA>7PCwZ!|Uh*FNo|ZiGk%qd#w3v@Ul4m}~NuK%O9_*AE4gQys zXFkMPV(@1^NV?bf6?V=vcC8BYHd6apc*ye)C<~W9Ot8lJTe7@Z z6*!+yqK(Ki{qISh=}(e8)8{>lGAyHd$us>8l4traNZy0rW0Gh3?@6Ajo{@YUeo4BV z1E-u?BOv@`eWskM&%!2D0K^|vF2WAdCc+K_g^1>%3}23dh#ytwM+k4@9I~qno_0`m zn{`FiZQhC1S_8hTR%;Eel|1b>LGsj5tu>(Cek}c|ub7kXW!Sqy`ZFEg$B4;%yd-(% z5_E5_yVEWBI_E=_N3m*{=&97l$P~Pc6P$f zTyOvqcBaB04=#09sIaZ9S6=w5H4)P#&vfpTJY_}RlfZy#aZ#S>|4Q=IzeDm&{|(7A z{r4nK`+O#O4}MAd7~_{|sC5& z&Y(vHh#?9$2=#-1>#TO2}xtv1Mb_Ytc!4J4}nH zO0aZ3noiMTtp7nB7Hf}81*3!vt&GkpYAsUq1{&W|JVrj41<}Wt7dm|%_}4_Z82o<= z+AQ3it)7dqE@~`G5q@i{eRI4R`HL>wZ=KfHM6=|X&FEq#F;+(QSOTUx@TdSb(<%pomB}oe7qv}=IYY*xG_fE|)a2Ps32zxi0lhQwr zo}fp8M|)8}{wloxwBY>~?(ZU8k;2<=!D}($!ITlaR!ezMkKqbT%F)?kDUa>ItAIcC zqrH`W_ge7yZNaAqSETe?X~7!~kozG-JPx519@j{i?dL*(!XT#N`L2U}9z8)@fv4=p zdd)Dpt^1%J&|FyZmJL*dj5-7CiII z=MRO)H7n-)-j4vjYg9xz68HZwuRkt@$9EHEJf0J$Fc1{s8zi4cPml|R zpzOzIHifqWyczFf;K^4Fj26KwmwX;QLFpzuJ})Xfo^NHw<2#{j5ySYSbghOz`8*kx z1-!Z7nO_esg;!v~8wWSvohnjz(=2%R15efGOcUN3L@?_&0WT611~C<11BQGaJwacY z@|y)W!)VV!FlM}b;KizcvmwVgdALXkc@O7_>xUWdJ3y{HXlhE`MK^zi-z!muXx>5ZwHs^!ix*nie4- z8O)ix&&FX*5R-wt>2v)5RT^r|N!9PV*OxF?NY9miU3+{1hOx=osKS0+HozqZ?k{YU z4IOszw{%iH%W~dASoRi`de(pZTDi=6v#9Y#dc&rJC$C?19XJF?#MiutwaW7te zWiI_6v^6Hc?fzVAOm{!61+&LvrDLOIg90I2t#xGfZ?Oe4`;84Wgwr<`Oj%m#t4wJu z*r+#best3bd`DildmYY{3T>W|Fm=?89iBi}*VEoz_Lp*w^1FB}vv?oJp`_OpFdCLw zAs5^0PvA%LE>&oiR1jBiC z$EW;o=An}6l5pj=N*`8>iFG$vEtZ1SVo2@n`V&)cEbQ={#nbUCA zUmu4BUk1p`Ls+(R5r_}#Pq6gQwjgpRB8NoeomfhiJQ4>(74TrF*lRqve+2VDQgwj* zn1DVia7A-?I8=fnh2b6gbuSFpO{+SAymfd9|mCE(|RY&;4Y4v@*Tsb zvC;*JOw>cp#%;A56Oq>5x4T>pR4vFybZr*8LLsgrV_wXJwO8fF#uBWdSiXvNdgQRY ztU5_=mW(7=Z^2T`e z25(lVSF?9e?anwatAAzAP~YT&nSrXeb{F6bD*Nih*0}LlB3jxD%d6tCPD&j4RN}3M zlH8U8YtckJtklErF&j)aTKpZZoLO)ddqa-e>mI9mV>cFIwZ=&(e_=w%;nlPi?LW(C z-{B|(+C=Bp+T9Ct?>1~HR&-(MZOup}Jn794s#jXQ5)Jpfc(wu;dPpT0T^| zf{MUV=Xt7x2#0NL;n5x8tP`j{urE$hI!_xTWE57DjW$;5!9$$X1x2B~(f3h%uA&;Q z7Mx|l*|QMM_B7RBvp3c=m#mvvT^cvrhL)Hap6_F^9^>gf)5PBi)uLjvBEQHM|EH-p zpLmfC5Jy58$MImvXGvM*nMyR#4=M9;{hv;}n2RNZV$pN)y7R2`$WsFr8e?hOgu~(a zB6?)mtGfZYov*SYS2-HVqND?%vihaLLH$bYMd=wMSu|peA$FlLU^Bl8ovEK!7)W0D zT)eldtLDS5xu5Os7}Ot$9fm0FdP-_g{y9WzxHxrCzjdOk3njF~L$>ZX`yZ_J!^+%k zSU%c>m8#p&|Aeua^bpGMIM$Pe=bs2qI2*Orwftk*aa5z@usL3d^blqX8$8<6%#_Lc zZ2K*??C>b8N`qd^zyNW071j|Sr7_vM;<8h)JT3=qoy#x9$zv<90F&$3;3K7eWa|hg zw8pjThQLBSm}a{*6b#;G6Q;#-W@eeKkMU?Iw!Vwhfu7oS`(Vv$vp2KBi;At<-q1j0 zSqV<1dfK}&C+N+p!$S5ef?iKuL18$LsWauwa4yOd6^XT!$9S!_Gl2UmI&@>5AQ)JqNA50bGl%t>SalhIoC7z41oZt5-UV2Oh*^qTSp3YC znWD*K&zg_x51;5jVI;5OIba8!=Q;9$&_sK1^UJ&oZm&N(H4{}9OEQUp`-UMfCbGKM z8QFiQ6dFdY6ODO)s@5j!H;Q|U7-q3O*;wtBS$?GB);hJ>*c}OL?CrQ88M%+TADQ#~ z|2IFTDIxgy$olH$P7RF(6(!g_TDZXaaKy=UtqI=Pi%JT)l3b6v#vjK9O7ieE|N8?} z6jw$h46*&QGTd!ilg49vqA_^GY1R&hlL>Q~k*t4ZdZ$kTK_Gy581D7&Yw|Ni68L=( zL#l-s6d#rrTU@4beQH#U0;GY(o1AY znP7>o*czY-_@|)X2<6lcu+R+WSQs0FGIef&VNI8p~`SqNaS|s=RG6PrUgKUTKhi>`KI;TkZ!{oawFoj zz6YH~)WlCaeTCuCuB06))o8@*=T*KU)nk|AT#B&wMFdBC z0jaFpPb-8#m`miu!4DKDwKa{@i2D zon;3Qa#P1F)#5?(f6;^5HJr_~JzVY*TNgy;o>YH*MTDblnNBr@?!9rk6YQjSaWj z$M@o$qVmvD=juyO8G}ny=ILRQw*wWC0s4C!De zka$UP4t(2%*GV6}-b#vioDwqo6N6rNV?ou%-RKYBnQYrTSo1Xc(6+a3O!jmx-@Vb( zkgsiRORjo8rK&^U`UlU}&gC8X_O*|A)^7czE#J1b(btf#17m7Ms9;6zPeKJtLc53L z`l*~4&mgzMhGYiZ&@JDKn~@VY+&No2U{!hUDL$DI-qjl4Lmb3sbquIT5w}vD1=_Jk zd|T$+Weom};esl2*bVhG#M)nb&77)-cK>GP%&8}jeFS)p6EF&Q9OR1y|FF1_Ue)M> z+~$qRRqe~SZuGR<8m4NSTav4`q*R6U%^^=!%kt)__O)Qve$p`2Ru%FEr|KaaYx>ks zoz3*{tJ(?bwR<~n((AgqV88Z+wa*8)JijBM?ItbbnxqN-7cN9M29M|Fo2K0An|iZ{ z2ZwmB80pCtTcixV-lHuEEM2-_exhcT$?;?xYeYQ7fxG8pw~o6OP~0ju3StXzu*ZVC z=PihqEDDq?B5N@NiAM(=j;+Zu&Uu~c8k9~F7m1%+6ql1fDpQ?WT-jv?ucqB z_J1r5Tr&Ev6SD69=*``;GRJ&b^qU#umrWkI=HFiNlwWWc4Q+VuiaQ2rSEp>dwYGgo z?y+$X|M;`!jkDkSPUGkqzPO+L=I>ABFS+jNV}E(0p|I`cA>UiEapYI&d7EAwGhog; zC2!b{PpVA(VA{Lq7cBp`%NE^xXwS6|ZEBgf^STe$J@@x3xAuPiN?+U)znt;fRfj(K zD&76NADn*V_OG_@pVYQ_#CKNxE~WDQ8;+0tab|m9eV+S^ou3Wg;Q!^D<8L|rkAC;Q zcRFw0_y4qE{zEHj|LFO{E&qJ}^Y%X{UNa|d(c@bl{?5%c(^j?q>(S4CJbsOS>4fi{ z{{KSBUgv&1-t)m5p*!B5zx%=X()rmJZh13%<>L#^XRQP{@}vZLlT!K4*bP4ZqGxvEc@W5f86qM*7@}#7wLWfqj&!={$uUa zuZ>S>d^5h^b=Ri(;`${zmt6M6)OY@UVC6qAbNu@=6AsQgy5*05TXL@O8t*m3Z~N%> z(_dcLci*XNe>FSlv+Gt~_QLxsUzs%S(UdEFFTdXZ#XJ3}zPK@o1Kz*pt9N{T=Fd3x z#QPon-Yd>|=imPj`u#`CuYPEA_P~rYUnb8j_{;i-TmF2q@X3Gm&U*aK6BQ4i`R5N- z&Fr^vLCeu8o^|)H9+COC@BL%WmSH#i{)WScj@`a_<*LAkUp`p%q1N%z2dQ?guP^Sh zwkrqDPPyXPzkdC}WA#_fOuYP-Ri}nu>6mf%FNV2a|KRGkZpv;>avnKfbkA-3(_j4l zsK>9_eE)3)?+yNEDDM2q(_5bUjW6zY_xsCoY%BCgl z5411#Y#+V1W>(X|O2^SvkGyj2pidHpEFOH{B41p|pT2+cCu?81A$8)i5&v+$H}>Sf zf#DYqG_IMkC;6rGZ%)7Eq4K1gZyRvmKSREL1D|^3$lceZzCPxP@Snf8tZ~!MDP4#D z>5Fsz?17vUm)>>ixw+wMAA0B4eg63Kj@88nd%fKLLi(75b*t_epZDwEj=gZ<hstG;~fFF(^#TOPf7?2yXO=jWv@e?Od)ebXPl3R)rpZY4?!F zNBcfG&~#zZzIRgl?)mGG?Z$bKoQM0r_zdiVX>OwDH(;2^Fp*uuM2?B<;&j4p54-rP z!tBPxs)@L#C-(s%VM+rt2(z_6NcT{ka~wlNnEJy#KQm;KE%3BO?JCYSHUqVCF5m$9 zaoNNv0KzH$^xPBlita#g+#~clhvAhX(*L0)+^Ww|txitF+z&|`c53*mjL&@}Y+|Ro zZit>|_Fml`2(ITDzSmg7uN7-K=(!e`Eo$`$jEgid>*F?FC zG#&F;B$ls^6aKy<-A@X4vGxO51wF!D0*wvw3HP1SW&GH2+TokhhcJ577h25!B#ZoH z?JikX9+X2oVv7X^=*8-OCLW_Hz#XaBRUSM$-S=U(AVSK-AL_j-%_Ptt9~@1@O` z<)PyLRJI4@Hn&Ko{|i}vjrf;ngQXi&z0fCFt-!1rVsh9WgVwa~wB_%jRY z+r>VTr)-|&Wfju&Tj2o`I5J^@Gu`m#nhvh{BMBVv5ghQ86>)D9B4Q1QF1sx1uJfh~ zVqMl{*Ty*NJHr&o6T>5UrpYxklp%&s^2A`a)whVeKdJqPSq0Shhg>hGc(9r-Z*f9T zIoudb8Ch?5M30a$u!+P^r@z$A zLtd6k7I|4NqD%<@qNv(Ccc|p4S3vT#)gs9g`(DWp!0%eg6Y6)8r=6dXya&I3lswZX zsd~kH>OT=)#`sL$K19Bz8~&{R{7#HST=I;UDS7HSP4bKBQNbB zY-O%ja$z6!)8{c3FmUPf1#5gyyTIT*^p|yydZ_QHsfV(au$#1%Xs5jq2omK8p1NFz zi)#<53#)}%hj@?VsY|`&iM>(s#1{1pajD}g(w}xaCVATJbIE(~JBl`eJoP0hJ5UdO zq3|;5PqD$X%=8k27dE-m;Dt?OzUa@h%}Ju)08hM;xYYUQH%gv(gi~jsuarFTgbp$K zVWEQ@q6i&mFp$te>M82;BEw(QXQ`(LUb-wV=2>Uw1fm`Fy9N98b(_GTt8wwHZ|cak zbmSB8J4N!;ajE2~KjF`GgiXLR9d;#@XFMiJp6QUH>YlkjlxK~-77+)_J!Nz?@+K2vW?C?OuB2W8VDS3vElRVQU=|3=j zMHzk1;069NgBSU|!Qe%He`N5YydckPit+-V1)gs8Ew_ifd`w}O&P;={ap^^ZHR}0n zgC9x%GJ_vYe!0Qtk_Y}&{8E2C4}U;;xO5*mlYM|}f4jr>i9|E=UF82oMI zZ#MWDrfK*hN9$$}O4Vx65LXbCPg7NYs6GqX@3`PKMM z!j*P8{(xvJ@(K7AeJ}Vp@MEMuZ7=Rw@Tcury(mxrxsqo&(3JFNIWP_K#12Z{gWpEU zvmDwaPnqK;{vF9@qdFt69`CRauB|i@Q zUw%1H98__}>9OL-H)2t0lh-{B@GA z0RJP&(71YHO}B*hCrfk1kZGeaixK$KCB<) zsn4^LXZrgj&-CAtJkviZd8Yr75IISg8{|kO3M|jp$~Y5vpDHb9Y{Jm zJ&-8t>kVF%HF(NXzcla>dGtB=!cU|Hz6QKE$CG)*put13hYq`Pc;qW)epPOKt!aE^ zYT4a@Urk;#Kzu8zBB)&r7S9hX3tS}^qR-(3o!qIPU&F`#6k1H>$z+UO{Y|nxKkdAj zcvQlR7S6k>!Z=~z>k?hMU{R4!@}ghH8>w04#0R%3lZJutnY>|13)ID=%wL~&pDyu# zdlHF}*{|Ih!6YKjBT*S)U0H-_VY9te=6PVn(gpL%BcZBTFDhX9q}fPTe*7O3NvWX_ zW68z@h03xC6fG_<4M2aToE5UCWOjgg-N~EJs_A+DNc71X z8j59JX>@F(h12({SQ;-azh};}6*#6ORv;$dWnheBXAE_X27qI4?w)TFy_gkaOUJa8 z=wZGsu0_~vJ+*Jf(q-l5-7LhX=Ov49mI_uVEG~^QIBKl9B6p)1S)NzCVBTF9uPHLv zvN=Y~PuZhtHXx&RyRarJEA?FwRhb1gF8oIOE$+F=#n*0p(YKcZi$ItR#Ne4ImM&H`E*s;;bUQME}7bWG<7Df_6})*Wuf zGwnJNqk6Lj(w-No-Im}ebuj$7NGyg(rLO9^$3@J_S1~$vrL4FnmL*uGFp>(h8p0GD zqhKmVT_mZTh(G%9oU3v$p#7GVfQK18Mn&ip2G<>Yz>$QZxuAFPmpsSVq|wGt@c52R;r-Tv_XNUX>GzZc?_(1lpH&nd_u???_Z7m@ zaVer4sTy+R^XLGjdyHpM+K=x~6y5?0UK+q-={MJcmk+#r;1G}R5f$D*3*I8&DV-n| z;kg&CIUh^l;Pap&73Ykl+}3)G@?g5jxKz56P>5!{`!AC2l@_@WB{32Wf@3%Yw&m=eI=Ay7glz!_hcrMh(PJ}C>9O(ftM7> z1bv-Zzt@4sdZ$R?VWn*p-Z|ingb?w-M(}R2;Jpnz`Fce_D!hCPUUp_T-W4Xi-=lLd z>o*Pn=Dt_q{X68y=ZRF%#(}5uJII8$!Gg!{uFLvT@!_L~RB ztly((SG0>Fh4&LMHDJi+(E<7jcx&-X zJif1D81brX(Rc$;Z)5eRKZTqb?}4oD{*UjQ6keePZ#3}kN4O%&k!D-)UN_-!PDKmG7&NW1Ku(qyZ>Ym0#ZO6<)gq??d2m?VTdZk$!K%`z`QP`QmkB1dn?! zne`iudf_2}B!%~)CBL@~Hr`#bJn(8Sg4blhyA61(r-~HbqZYgt;LU{)@i>jB^80Jl z53_zR120zjZh{=+?2`=ZRD>hX_2S-z_G*Ptb3e%cBZ->^BrC{Z2#9j5pV$-wzBsu2^h=lZ8BJSIT59a^X>Ut??gXA{zq3tvzeoSX@)%{n zX#;@wpyc_(FkbH`7{4mrry+-`8X?M%9+7xTt{rk75n}vNa`#!}j$A};q($!BMdZ>g za_M;Jh?Oq)hN2Eizg)ggr$XS*aRxnz{D$}9bew^`~u z4Q}Qm85dsoME0ZdfWB!@s?j+)xrWR)pAR`;IT8RF9-T{pBF<1;pfF+z>M@WTg> z4fv*VrfnUT5A1Nwb|vEb$8poPy!Ym%Q@0%W;7HQ0OZRO$?dsp0kCTz=-t=-$8W93GdaMYOC#^c%Zp`6t!v zVzzCbTh09=z;;{3NSf(37@JfWSyE{g8;p{NoX7}1{KiMf!}K-HYkp6zp4M*LLxV>? ziH2;u*bapWMtqHO$WZ3M`D1IET^Yn!Neow#8G>a-PaE{!MVKL*#POy=X}LF;NuOB} zeRg*1qxM9K`hd4PANUj;Y2S&MI6RF97W%h{B)JJlx87aK_<4RIO4epk>5xtuCB)hmviP#~_Jm=0#9Qs{DI4{J zy$}hTkvtpUsE5j34tI8ZsKMWIt|nD;Pl^kr6y|FoZ(aP}OSRL%lt%B`M$bm1yP|!l zE8j?{vH(zyUCvu${?$0 zkaP#kk?jb^Y3|O%jM~~~Y&D~`x}1#dA~QQu4myo3E51mgy;u@ExT}f(i^O&vks3NL zJUi4j(F3zI=4|L=+dD|xdL((x9>zAdT$$+Qejs}<*M78NrNG3NDdOw#w;XF8hdlun zvbi>HXiQmkuIibsE*EXgy;}VH(q+! z`=72&*&6b+I%Qm)fTKT}iCZtcTvNuA=@w zb7creQU7J!VN6s>Q6G>YxiM5K4z`SQv2)nPETWe^i+z;hTvr-CEOj`TN0q$^|-sb#%{EKdTkv12cB-2panb61=F?Q1hI#~1YH}PE$owaZFy{id8*bm1&>4uZ?IqUwTZFy*$uoHT!SuB4Jc6QQ|BC zY%5_@*b^5*E4=6?iZ5V)v*5k~!GODMUsib_Ewo`&Aa(K~-rj6$o#GYpDT94m;?SSsPvPEV;RrU}Z)`ghhjBnKe8 z(7YLcaC5}pj1}0oqpCJ}Vea2b!omjFYsqCB@G?>pw@u`Bn8d7(2}sHxfO-W*D9^Y-4_65Mj_ z+>ODt5AXJm)vKy~Tal+{aNKyns12!~9S+~o>`gXY(S;rUBxAyghqs2p4PN)! z;$)Z0)lcLz*r^@fe1V`(2e&-=bi(P4DX(r!o*K${dEwX(-V6vCZWoD71-)sjc^c~o zSP^;k+s;&ao4qMF?my|u7?-f9ZsVEU>bjh&H9_nMv%|Ock>I8+PaiLT>14~9r}_?@ z-g&Zq`=%F82)&LRKZehk6CaF!%<1kpU$eC<K_jv453+aST^P5pGZ{79WkY3kqSB@(-R>XM zwYRaWv{%DmcS9h>{dq#e;J%Za+(VOGLtK+<$J!=dg;rHFLKBE6au&DIq?pG;{*E8w zBxW=PdFb`w>AbfkJ$+o5!GEHlB#gVExTgfYX;VWuz#VlXfI7ft1iUtH3Pgo#{gmjIvuq020?df}AFENJw@>9EcX=O`aHt77M!^}K)F~8cA-XzmZ-2S1@zB~% z-gCqbOd?C8#EpO(GSTVKIeaLM&uMi2A3pogi!<~os8AL!+sCp?`89``h?7b=ysn}K;??3!u#=hq89T;86t|nC0 zSWvse=4eGt9(pFXY__x1R&hpQVBCwx;J$fUeNzMaq>Z?_;*O1B?yRDW6)PTkBO`Nl z{ECMCFj+7`gV|k!u&GY%cO7yWCgVo&P(rZj(faCg6rU4)7;?Zm--%%o z??l*@Pi~%BXfOAsw(Uc%A$_=$%>fPdV3Mfy{-C~Qg$jW;Hq3I$=FoS#7q=h8L1jZ8 zS7o)kn7dMFb$KfH)C>2vv*ndeE`rm->TF|EM>U zZl4=U_UC`@DC}wzd+C;Y(^{P!-sHpHK0?%=36r%A;U^t}7Tr`$GDS{~w}sE*3Q zI`NLFsDv?%LM;4;$v;wrdw;G*iYt`hviY+$$KLayB>ui|e(!&t$Dm1#!M@G7O^tbDjkU%c*B-NlD!mvm zB_xJ6y4!n==ruE^M6XO4>n-#Sm>wRPgDTD5WzCcL)BIvG{<`9W;pAB@^t`?3#j|Zf zXtu2tBmN^fsQc`S{Dt<`_zLeXXQzH7Mfqjo;bElQ&oX|O^Qi1X+t``4!b8|fjvSKF z`N@$3HxJeLoTc6z#L7vxAD(}j!-PZ(;}M9Dl?W?|Q6~1@IyDnww zc-G@%#Q94Rsm7(TKg5=yaFizc{bGk$_J$6JP&E?rtZ>?;AX623^1=2NM-+zp0#i|v z{=w(h{LlppiFY5X6Q{NraZw*dietXKZi9Y{y-j3;c4gY{;`xQ7%HD9r{)@dxF;MR6 zYD~!3xG^Dgvln|~p0r^L+JYNjz->DKUE*L~_kO+7J2t2MMfjl~hsP`(PlcHhf5#VV z{?y`aPeBhT8ezxh1$cezZTB5a$}Kp`{r^yL%FnI2#t>3I(?1)lyOMH!xS>G9EtiCH z+B%bqy?Bv#!h48vf?9aK)jX7DzXT zmfU4pWX#{j98)2~+3_#%Ih`p-U50eWKj}W0bi`+<+HuNoD@8j#l;}A!`~&GW#yS3u z_k}KY>?$j?>3A=cv!=bpEAkPq)wFcEl3FN>cb3B7P-Eib>`H_l1xOe5;McMq#435z z{c`bINIWC)Hss#vEEM$;L%{@X>S0$R>ZKf~pl(l$U-QGmVZKXeeMkL^V~u}@Rj<`{ zFbUnC@c6S0LZXrIrVfd{*xflQ%Ck{>-Lg811}NY0P*>=N7r!ZD>qFJvPC3r2$4rqO z?r;8W>bE)XqOOZKEj}a}$L9!lfAkfh74DW^p$+(h%1yPsU0v(%ynu%1K*QtUVSWAi znck9=sgnvs+vJ<7Ri8dJcn?br{8NK>%*2MdX#v?KKRdms72;lWqpdCM z621rJYm`hK8^yyjq(dS*Wk`P;bb^=B-4llIlHn&?7^H$jxFPXo*_~=37we|g(I`+MGiiYW)exar}6UU2D zVVmFd&vP|4rqpii3(svD_mp+Ng^idM-=Dnk4oL11eU{M$cD8rOCYcvx7}}WM=~(xs zALBzGghD8`p%98~##YF*(E2a5wtZs%M!K+5`>+gQ3ooYxTn_XJBKPquFj11|lEmhq z*K^zeR+uZJal@v+H*CJJp|O|iN*R8h)h$wgtnUxRJO6YW-WR6ZIyy#6g^tFZGM;l* zW!E-j2_3|r^33EV_xUpT(wgd^jT&O&l>=V&)sC!scB|3{T}$wSYd}EA8pAk$`FYkm zHQH)4FpxBd%JTsG0H>HfTJGn=aIphI~1SH`z(zA!Nb1G<{yUE@Nvznq4Y#y!9sMpByi zsWB#rq%`IekrH5Vvvi2G{O@aRP5%L0r@(dB|En}{?|!~AuQ`CuANDk?XOu^|J6}hg zo}o8)Fwf#0Ue^isJuVoR&l+k zMB+7deivR-cYfjcvMZ|mnKtTxv3>d;-@a!O(52hGtO_sLgQ?fJvoT+QKfr}b=QQZ! zz&>#d&-`73s4r1<16XYxqSE!OtLA#A@@xLZIU*rj8M=rgwnqDg#_Y7J!k>c~nR_Zwa~<&T@4PS+o8m5kDPV^3 za55MSf)eDM6FFqzRGj;t_71j^0oZN5O^BcKA`C|mtU#x^q@A~JG}2&r$(j}<2*+C* z9L=4{?KyC{@6=aQ&PWCr1~c(5sOl3xkKFfQ6Zd^O%+k>@_pofp*ojy*DQGhAG-R^z zTx~W7+opSu)-K+UvXAs%Z*#v6^Rk37+Jnb1-TfzJZ?+wiEe8?Z$g7s*9XO(3``zA`KV- zwuQ!##MlMO^8BCfQT%n)0nd;nXC@yXdnhxI47cW!~P)d{S0sL`PHg!77y#od$ zdGX2pHjH6x;zTFg(6Y*PCHmNEmPZ`QvE@+v@#1X<9Y@ZfsyiX$zTMW0m+3oMX_04S zN^~7HHmym#wnr9S@gs2RQ{y_wJv;Q?%7ReS)QVg^WUotUsSYL9dGWTnS6z-P4V_fe zfP}gLFzS3RTd1inv94F0z0=w1XvbkGK$@NCkN=!1P=S-a^R`fd;rrxg1Zk;m&v~wK zNGP%0`&^?Zgh|rp8v9LMkuf2(Zc^j#Zb_JJoA`Q{E8dmnPyA%!TV1X`m0bj5v9G~|^RD)p)50W4J$er!?e6XO|*CWYbK zrVEZUU9NGa7_+`ajOnY+)p<(vtgfgbnyHnrNppLrJg|2vCSC<#t zaXe)EbGr>1^Et-dpPc<5x1k4k-wS)+HO7y^PjuVwo-;Jy0BQa8dd+8DQ%!aU_#2-> zz<7vuIrqMS=Q9xj;{IWu?0qw;bS?SuPqD#ZXb%qP21Q~RENWUex`JTr%4fN-FcJI7 zsU7O|qA^~Dazpq~7LZkl155b5i;++=yv0byI82HV0Ko8egAMJBcfaVgVz|aMX*jWF zU1|K}YP`?8ac?qf9?s&zI02jVuS}R6nAtSeJ2YqNbT1x0L>L?PdQ=GP$&NZ@XN9Qg ztF4)Y)LZe|r8J>402Tc^v4CN+4>dC&7BAElk5^U0_d;sv(* zt@9J(wZeVL`Rh7f5D)n;=|;d8V!VRKe!kYjc>rHr08c&syy-&bKJ=YV!x(A>Y@ zh6d?e^$Ge3ujqAZ2cgf|B{~V&VX#TMufM?h@9YT}LH>FMbrk6ujdRWN&?qd52|y1H zqxn_}b*=v(qf<0qE&7LLl>{bNSC)+}7>}k2S*XX-gy{M&;=#dAR17`Y&oxvvi6-9u z_-A=a0=wc0UrhEPl4D0TL{Z>hd}ngXEzYq8L(xCyi2R}k^1*xkN{6VI60oLB8(}|C zZgd~CX>OT&SW*Ztu9JBKIO@s|5H7Jl5`c$8Rj4mmiP43j91z?;o&BJAPlFnUJNy@p zi9gmdUreuNzENkyC~s$<$z^C?KJ@%KkgxORrv!g_>3CbCuXbpEbpAPFrcibNqFB(v zCTrPxtF598)^i*+=1=|oQ&f6XdA!q~nB4Yaa(?xiWdZ83BOuxV3|)UIPoog_st5>! z`e$7tG><##3~`|4pT$Qhc2fSGN#!pxTh7kFQI`=|pV(@v#LGek@9#CXY`hKG2^@?+ z8ZX0nVk1-!;N4ppipamxX?AVG>yq{|gasJ36L&_sROFp;GSth^x9o?}iP+n{ojC^f ze%vM6y-ax+pC(!g+5@;d`e*5(f;BDeW#l($p#l!#y>N6_*KfOy0reE?60vCIQY>L( zjfXjACr&KVTw<=?7}vW;xhn(B;Q`P9iIm!A$6@@-2?5O9UfUJ2qsgQ1#$-K5M*e^F z#_fISL0eK5O1`e(C11$7X3=5v3IW-JLgwdqGnABh(BV(LkTgHr=XrK(MPTY1c>RZg zc#=@Tzx=Y1_iqk%epQ#_xqs_pj>68<5B93V3o&=Lea+yu@PJn5LECE7z1#xSXh7cX zD$WTxjC2qrJhOcj0slV|@e~g2cNx#dvlDX*igWxw?-g>aX+JD*k|Y97AR{b0GXZ(C zv)vITajm0Ar1c zDTRB_C50*i?wil<)w$N+fmd=qlcklNC-_J6O)E@{mj)PBMs+^uzOh#mZwm|c zg}pJ8T{RyMug16nVjuZci%uf7yEvs49}KZL|+L9HIyY zR8&+{L~>FT5D?P{1_Tw!0t$$TiV6ytz%<|(025#U83RUwqJRO+m@%L@=74F8h;sMt zu7ajP=Y8+@|Lfjwt=Tijda7#IQ@eJh?&h2>`;%>oB-~EbC8))g*@0czq8J>8_!Y^r zhOWce1z)9x_ch70Uw?+L;p6+JSS$s&4HGNEhQn8(nf3(Zcevr}(QG>YW&*xy&SDwB z?FdGK)=V}0OWqGhFe#79(We_0@rtRf2d&rkLeqGs!=O|D6~yPA!Y0 zvAL76(;y=YLnm`9Q*(1W3sVP2CkM+xjG3dIxs!>dm7R&Dy`}viOCv`Ma|;VI6MG{w zJ3BKob1O$93rk~16GJ30uIJ4Kn$k{Ab9R zSs0l)4jSZWY-(m{;$&fGVQ6eJ$k^1#+|g*N;D09neK!gE&yvA|fn0P(k0VD6!SO+U)5732D`Am3 z)55*{;N?P*`a1Yx6&?0%MmmG(X+pe0aF|dFg{DOY1w?SA8q18B78V&eEi@ov4p(9G zf~Y$-EFda8z%MeuUnd|UVp@d04!pu@W<;2d-!%UK9UGl)hL-MlLJ_=?D%{N22rjUE zBYc9x!lz9OaWOM8hB)S!SeiD;;o_KMY-Ub$08QnW=H(b;X;$0V6m$?7Sy664kQQZZ zW@co?M46geGTgaII(pq^_Ecy%or%9H{O4H2;Od5pj2u(_a&B}#yZk+xZVzkUZ8*fji6`B)S1qaR@>^BK7PWD` zkjQaHctpUA8Nriv{6c)f0(Ia#ry0T1!gP!c4dA67I(k8ok>N9}`}PeCjtrXVYv4C6 zv~K_{(idMH)F(V*+7##z1JKZctUg>xFJnVvGeb*btDaa(6VZmnmP$+Ko8a%%QSdiH zB8L2cgiXQsbjUJ8$d9UUaTURv{2btSM<|x?5iwFt*4%$S4+VbQ#1qLTzvRXG@XdjZ zBFX49MgU2&zmRK8l5FxzLd=IB`SC=u;a5RiqGXd_UZXy?qEX=Kdt(HUBx5UxI|$;= zg7|ReBW{8qY4DL?-&V>-*?%M%7Y2VnhH?u&63itQ(|;tJ>5rjVY$(~}%^qmqL_xl{ zAnq@S2Qgi7vjmZc-{VQJZ~o=t_^%|q$(4E#f8!^?++ngv_ATgX3Fbcgo?c8cXY(I2 zN@RS^g$-N+-j?jcUI}pTEtO#2FtKF3++)knXND2|NVa@E(;a?4hjJ1=67c5bHSl{i z6u1tA_&4S%iLYhj@tD;hlFjT7Z^%O+32(4m0PRG%4Ic?+E{o|ul1+Y@j{3sEH_`3(OyiX=0?F#<@Ei50|!?O7zqPhj$hzi=fI zF-oGSCUF(P{97R?pCpK{5yVpj@r{Cbx*)zy5XV)cQ6!mNjS)bSOs*h)P!P`-#ES&+ z5=H`FoC?w%J`(We(YAPD3DS`rPv^J@`B#!T#gr0#uD@Cd{8J{-Kf~N?(!YwL@+NTw zL3v?)7X*C5`FvTBkH3Cw6iMcKV+4>SbCby>mXq;^Wl;Y*{sY3**PVGq;+TeTD_IX{Jd%{30txC&FQzw%cVXiOOk1*lQGGcQ z@4@C9GtY>BXnq;#0i;ofU9q2_J(6P7^!s*qg&(D-9Pf0hZ_zlZos9}1|$o0cY#xH%gi&x|Ji8OO#aF{Na@ zj%MS&j3mh)$i^o#-^lpv%*LlMA4va3vGG-mE&0JYzQ0`^PWLDjjCW6g{q=(J;6eHm z=-BpV2;x;F&eb2mj3oZeW$T~CtP=2DC-F{f{t{-EfG<%H-$~k&!RoJu1DOGUn7~J! zS;u4&`?>j@#^C$tPGK2p@GgAw!A8O;~^IV9pSIKQ=#ySxeRvXEwfv z$s+n3|9-}fnFp4gs=Rg_rFu;bo(5>{0r)KHAHdEV>SF{8*x#wsaWFBL45EC;PQ6j4X zdkv)X#yU-Bd6siJNTEUI2ksw;8+cZ5I;=jQlZ;pFMta5*YKm5I`q-TsJRj3^mgjd) zhxK6+hmlT{%wd+3j1Sze=-EtoS4T0f6Nr(+n_yxRBU%j!AZ%U49=0x0FKZi_Pq=L1 zyL(U<$2wx_cF`J00AYQo%3=Ihw2s4U-|^Nx5xER!)75$UX&gpgJR69Lh+L+#{A7LT zjyizR9u(1LE@az6_*s22|GGl924Ku*b<#O~G*^U+2MAJ&hz+=3i!w2loG-AI!>n!O zngmV9^MjDD55dSWj9}!zJ66=uhHxsu$T62-tp60jsPlwi>?6LNY`<@ZL=e_y(qF92 zJGgY#X3}=#5@m7eI*9Rt0Yn!*qEr@g{e>Gb2o7rvz*uKrf|0|KVB`)ZSO-GZe$dCZ zEF|e@;~Ij|#%zMo#(aX2=Q_b?3kvl!a?yFmwigF42;1JB9A?{_!(rqS{mEgry}LN9 zgXzRSY`fZW={Te`0Am~3@dFs^)F2&NzaxPMku>sRJSMim=fj z?AS&H5FPl?^MF{LZJ0`QaN>es9U6c!pVf)LRMK`bkJ$0tkxTCl0X^%-fM9HkDZ$v5 zVFY7a_?#>cZm=LM4`9q^c>p)?07f1Zx~{Tib=V{}PXjQP)rAjYEX&q~WFRu|(df*j zp*s*$5gp(VtACKgSRWk&Y`?GJ($PPnwH#*qJ%z(;zmvY!L7k0UI@&|ew$npQ=CVHG zL!6EwVs8$k-$cF~wnTiG!~GHe&S3|{c^n>&csYk%5C?L24B}u8yCX(2kcsdS?P4M0 zjX0mf{)ne@I0$h8heHs1a5xh2G!920w&rj&;v^2E-!-~&7=|N@(XYJ-#{3Zk>p(b~ zU~Hco!D#Png2fOXBpCYvubYwI7H|)O(I5E!FHA>$yf#KW9Pk=~H307=SQ~IP!Onoc z5sdy@D#4XS|FP%e01xViNpk7P6Hjm(z?lT2PAEVF86O2CDMzAj6;{>Dqcu$4;`hd?9YzTM{7=r1hfKL(JAMjOzv0czaM#P_+ zu-Ic7=4s%<55nq@YZxfXh)mdIwvXv}M&HqKhM($Yz ziy>S}FmmHm$Mc4eJDXtSMxpBiYbV*SSvyI)kV|xsRps^$vTm?;?&8u}JM%e=ZKr#p z4q~#Nuxpnwr=tvk24Jkyh+wSKfncnYol~HLe3N+T?7j)<*sf@jt^;8L!B}=Z!Ki~~ zVO?nN1%eyejvFrs+g{Rkw!LJn!15x0R)xEsS;Jwry=VwXv-SpZ>ADcmH5P^~qhZRW zBPU{PJ8m0@v3|B60b@B=l8)GmV6-cnVC3k9^Bwdx09z4^c9jy0c3mJ?2QUh~9>cn6 zzq4&W%4Tz8lHc|eE*YWZNif=sPq8r_ZN?=YG4i2^j&Pwo z1R8kLMughQ_Qggnk?jjIk63#=xOB8ZM6PYvz98dG2h-Ex9}u*SURUcOo`L4Fm7htr(4?dWVd?=z~ zHsIC=0}e|hErOAsZ6lbxAtfgF@?K{kEM;!*+^@uUNljap~+lBG-`E_jJCqwmEV- ztZjg?E_8ObMn0T!sE@X+AQ)|V%uD~oOYbA%^sz0-OYbW&F4_wJ zfM9tIC(bu`8HX4JU5OaWv1N%qTQ&nV@c9tvz@m%x=o5^(uvM_>5O8OGf=+`!w_z%| z4tM4-%fFGsEdMeNBd-V>3c~uF^dswYGL~4M|IX>KK3~mYX$UliaJU`8SkEYev7QM8 zV?6-`V?FHtNXo{MbgUDn5OQLjr37Q0to_6u6-*z>rF9}00#@i)V)fT>X>5DRm_)2G zj7w+731HM^=N(|oN1A=ahIx>I2|0g*bhNV~LpbOMk?m(;6m%Ex~qx9T2aAe?Xk! zgF1nbE(2I&IHr>40D!Trn()DNY-@Ld#SpUVA*5s9d69H%YcRpsMRY`fgK^sW$S07e`13C4Ox5RCP^5R7$35{&gMCK&5qPcYWGgJ2y94-}r z0T|1%>i}RZ2TL=Xj^)M>jO|7Fsm;5%e6}vqM_7iAJ+@!`IUV#DJxiMH7jz7W8hkWx z;Q?XSYQSh)ANXK8>f*AF810-)FxFX1FxEL3*9XwSI;Rqhb)txlav|$0;vd#mDO|b& z1R6dZX0NFLqb_R?VAMsS*W@e@X)nuD!R51k=f`2JTLUoawkNoOXAY;+%${ppI_pm| zHdud>x>$eW#tXvwllYMJC$T{X@~EA!0Ag$n| z0T^v$#|dDxe;`Rm8|?{3ThM(}AGcD(Xjc-!sQ(ASsDFrHY~Kfhv3>Y011zfpSeIbb z@h2GD6iqPNmP|0VuZCc3-)PuVk;f1)3VqgxZJ=`pZKC&OSVxm_OU4ZA=j)IO!umOd z!#WVq{TFSb&+b@1TXQaueRa03syreb;c^Jo`WRty1srpopUe;o_s@dHK<9r$PfMt*cXV&q`g zG{DG#LOI!b@j?cK^#keC4iMJ}XOr1)D4Ti~rzQXIS8Gv;NUI+?f0|g;1v%2|Lt&%^^@}M!_ED4Kp^_?;qOJqGB^T&gAg_gzzV-%_wKg_9Ev! z3&$iK+c-9xYc(Tk=vQ_;2^K{@mrxOz_zNswx1o=`8kJfa>n-Uuw{T{}tN^c&;2E^K zmYDp6O3i2jBf`Cc{r`!lxmGixhQpqJ;Vhv}GZOge(6oqOHHa$s&X{3hIemikk|_Z9J&E!2s^~dV#4e=QcAE5057UavB`QEg<1{c*~kC60&oT-N^odkEckh zV%O_X=tnSypN0++rlDJeX)|W}vT69^q0oSa7B#bz+h>Erf`8TKW=hRyU=a%U366j& ze@WDWS~Dtc-}?t5o)X_XY$<*Mu3Ele5^C!V z#xFXwB|UPUw!v^O7{BmyJ_BkGyL1JFO!mT)u?=7m!^sc^{Y7i|4@-tNE6Dnltc(#s zl#VVa%`zHJ{D!4;W;o8+0GMmI)XZq&AskmezLc(c=W+WYj)h;ii0qB57WD)U_!&XL zlOw%o$!6q@Q;+TbUsTYtW{ZUE-1|@Xc#3fNwqI!Y&jt!NTN)Lp&uL51_l-IbA51 z{6f8%g@OV8i{`eh*%Bd+INqfBHK$OSdKd=+ch$t*Gkb+Jc5}lZY0UabcXESrazwzd z{KZqEwew0eYazYR;OVr~3oWQMqv9?#{(*?6M9o77@Jcn|#XRgQm?>VN)BJzpeW4bg z8Lks}C0iu_XW~YUW(3?;46D~Kt!u8;jEG&@eo4|)qZt9a4*rs$sYVk5oW{bbhSNLv zXFmT`fo9Bf_}~)4jerK;X1Z8w<0Zte4fvUEGg4vGxO=*v45yZwMhoE5hxv`yel(|X z3C4W3uY#ijgzjsa#~-MHez4t5^A8T2ydPf_J~by>$b2 zVt;a3YYdFj*iF5~EPU|ztKvpKFW#61M!~Bx8lQ*%6PlpO{SJrfb)Cd8Um%SNJbGsZ zztfBu|IUkI$^{Mo;xl}d8!hP3Jj|!~GUy?;#YB*8@JB!VyMY!|f`4YfJd7U{@ZsM& z@NWcEDBoTIUoMXivKsh0LIe2iu!TIVhYICu3wnI}jsl-9D4~6_5Mmyd`zEk&IHXy? zhYIEUB(Sd<_zXb_`S3d>l&=;1af5H)B9bTMQwBXOV@onr0iZp|rwAeCdklYMQd|gdWdZ?5hUEU(J$B@%)@cf zL%^pEe3(y#@^umLMcX#=;kcoEcLaQ~4Z zhtY!qzI5A0zK)Pj`QSjzCjN{4iG3>teEB>+9UfnpfG+{~^dO%KZEvuEufn#`zAm6l z?K=;D&;*Kx^)weElmj^_E(1NpwwMU=%(k&VbRmv;*uOafzJtKm(zx0#;QPSi!|z~F zzNs*&`1Vym1d28Y>Y+>qJ;b&cL9uIG*U&$dZ-{`e8u;*U-c%@`gMiNv`1*qq&dXj9 zQob$%zTpy_AB21z1biXDr%U+sd3-+v{&NSuE|iSuVf3rOe@Q$(1EPohQ4jXQ{|)^c z4SckXklcW4K?&1sF%je-@L_puuOWoAy$>M{|2Oc(0$&e^Q=#1W9w9zov0WpdF(^~M zV*jdr9;PKglHszZu;8O*@z71@g z9!6&h_;i4e?yCSB_y#C9^`Gre?6U$rw80iWD3&}v2Z&SqS_}A`fe*g}MFsUxR0Vu4 zJU%DLr+m)=^ZPdn_;etR3gvqQ35ab;MiB7P^~#y#L6^as8k+K@0ACF$g8}6$B-j=c zLAC*32!yyE422N&kk1|BeESk01J_$Bly5XBA+{wMs)OMB&w!C{IE0k1uYfNXGVu2{ zR45<*CX3G(4t$G13Hg455cAN!R{*d$Tt>5k*YUapV}N=nPXQpd#R$j;o_#J5$2{aa z1Axz034CdgP6hQ)P69w|ixH494vqdB1#!$nzU^=k&*zH-LtC03>7d8wD+WF+kL?}9 z<69u$iv~V@$ftrFD02mT=YfyT4>!n1J>(xN;LHAreJ%pNM?Cx7d3*)}K75Y|uD4XE zeLV$yZ+Z5O2W4vCP{Dfe4EW%dq(La3qhLLdb8KwyL>`~6fUget#x<~U^fKLbb z=zN>R<0}x{SB!yn!Pea%)V_m)`-+LcNBh?sv}t>j1bqI$H@bnX(Z1yZz98VkeH_P& zFORQQq3QU`2R^Kq3bpSe=pnWx87Vyb{2`6ncU8c568PX2vq31|MFHP7;L`;yv~Mzm zl<&RZK1B*9M@#dgMsVL#&a*Fw$9GP^CkC?44c0aK@3esL8t~EiF@?w14sJ@pw)gP`)r--C0={tIqyCHF@j1a{;J5b~ z@M*WeX9s%x_9g(IGw7lJB6)n;0zN5q_?>+Vd|Cp&3gE+a6!~WH_-4sBweKMC>9)W( z9rXD2=?-mN@1uBpt^&SF;Je)d-*5q667VH~9@;mT$2S`mJHG#L9nounF9P)V_UR03 zv@e>+H%Y*E7x?g6o(giHcnJ7b0N)}=NBibOhx4u^sC_#He7ksjOF);l*Fv(X|B`^ul9CZUj2eR;ma)YMNIvk<@sa>>%GXN3 zR}OshTj*b90iW{-hN%M{Z0|B2-%D6?`2Fh)o!e6XJ^?+xeGYJuW=Qx}@c2#(_`HEE z3i7ES2TF;6FB161KswsD3PRf6bOB%GPwd+u;4A0Zhkm4dF#^7~z?T8}RH%JX0=_T6 zN7t*>piKEB1^dw&_#pz0D=L)lhjLT@*^X>nPuGAl<+}rV{QgJ>J`+kt^e}ouz~>Hp zx{!|kTSxTJj#P!FeAj@F+637Rcn#=bx-BMxL<1j|N4^vYseQ8qe3ii04hs;W+|vbo z2|T_u(4~Aag7N$T_~a-V(ZeX-H}UOT!}H%pqKEcQ67balUr!_;LhbVq@a^L9Z3bOx z-v|Kw{?LQQw$#7Qpoe8_Nj)cdeCd!z`FaTWOo0#Q5f#)!=>h<;Ek;1@0-r8~*dLh? zVjkKd1%Pj#Kk(^5Iu+DIsTZ^tf7C(8^ESw*e2)bFTLgUgPC_b_4}aT%*p_5C1K%RR zXx|P9DPOUGFCQKzw&cGf0>1OW2UC;f%jWTI5%8S^K0nB(LhVZv@I3-PT~I>%av-Gk zt&nc&KRvj3QKe)=52H8jqM1VqlY(Y{>}r+k3|K1<+3KT|SB?F2IL=M!sAKF%RRj0Py)10Uva6gPJib-}z7*iog?uWsy~+YUQ{bcHxe%0T zd;Q`1jNczefe&uE8iev?!2savodi8>9~G*X33`ZaNyc!fR~In)r3gaI!*YoNz6#*$ z2kBHO-y#8DIFApXMNz&00iU=d_gqNG=Plq{1ALD_3GFN4@i_?i+<_0@JxYbzH&DPA zHM)`S1ds2l;6CpyT-3GXzYl`@yooSKQ4j4q#pA0M@YMldcWNBb!{{9WUl8!=LOSx5 z5k2Hrg-*xjL33Eq)oFQLDS{rh-ImpY-`4?O2w>zp10m)i-$#M}oOQT&7eE#()PHXU z{`&%ai$DYU&Ou1|dIPffrV3w*aI8PUV2SipA@ z_@W>k?Yl(uu)Q7BoBD5JmzMq42K2B^w(vpe@7DMn^D@L~dw-}k<%pZ>$0iO%-wKRVh3ivE}d^dS~ zP`t_bTLB3gkVb{J7p7s8_D%#ox^H3s(e~mv29q1cb2{)%fH)P(hdPLDNyZA`>kk;) zdj~?whu36$zB=I3fixzU)4-<$`zIhPm^Xa)a z^4%wS$mb0oKHryaE%z__fX|lzd{8xO-vg3|e1qV_=acH*@^jV!q>L?uD7$!k4T8>c zg7H$p4C{pDW~3q5caL@QvZ|eFJ6cKYPLaXaj=}?WRKcY(NjOEy+j%K3%{#UcN&}`FaTW zbb&9Dl)-@VbrJ9#_-x634#Sm|6yU@AHY${_pI|?)1ip=+g!YNxL+x`=;jYsq z34v`NZhQ;*20|y{^*mqCk}5$+>wQkzYfSQxPl0Aa8qOX3Y?kLj+K%ByEnnxPf*uyP zg%3)kXXAAao>oHJQ7Pc_{|Vn!0pC#`AD(tX`A*0*ZErO2@tViU6O1yU9b5)2klyA{b_@)Z@RC#=ODiig~MFHOm;M2j5Awqrh zyFhQ(PxOwG=Wujfod-S2fs_=t1t(xT@EQoE0`&Yj$o`9Y_z6_vLYiet2O>#89h4ZT zS8{m$G=Q-f*M|1OB|keqFi!RSpdHkAn2vnmq>gxqqkXFI>1$+Sp~DlyW|&JcH#KE* zj0`PI3@s6QD=csv?j#b?8nNz44fO*x<6z6>ar?9$Ge@FP7xSs)q)_zFq5YkfIsUoi z|35U~ETI++fiwS_q{A6!P2$1`Jrhxw&X0?lJSpJkU|+$+{)NQutFJeI0Ov8g!il?h z-Y%ZSD_bqcSjj3b6rWjIAR%*|Nv^L?N=Q$TOP6Ef;E_QOh_4P*PYi@GRV(pnGCW=$ zhxlgV(!?wvNSuxTl%ei=M0vxqd>E!$hS~W!v&G~g`USg*A%yj z4^+zxRPFEr`Lm@VG6LP zZSR-X?vD&I>|xw6Co-kjDCF+^>|16EGfG>`*O%CzUMJS3I#6J>D6>pkyn(B%6pqQ( z7q{o;(qHoI;??2pkT{rkyJZrR**cvw-1eUlYh#rOam0#pN{EY*ws-QuETqBpF zT<8%MHa;*|xk$X;OjM-gDV}XE@>D83RJ=uX*z4~~ZUx^_JBDb_9TK!>sGEm!jCj4N zC`M_7IM7TqLTPSfqjq80@_cazu`-lUOi?)-9ISFdX}!7Vf^x-r)nWB9%5I52AX}wI zB~&R!F-7);mHS|8$04#cO6yHTH7Yhr<4i?1DlZ;ZtWzB}J5&X$Z!4CqlJ%4iRs14z zd$05498)WqD*4aWqAJ<%@`Fu8-(_##Pui|JY_g}UTjBS!7sVaLDxoSd$|;IdcDgUm zaU7x;s=VG>6sodG8Mrs8ObMduf9gNhzb-W>MeS3f#FBOODWYYmndLg^sWW0zi&vj{7=1Q9 zRdv{z%yMn9A~!lboC5YH^t*67-mSuLn&nz{CP%IbktCgS@@2lzStCr~tD`C@tYaYjl zzu`!ffRPxZ;FhJEAn`0JTdq2-I6pu4Oz{~xvG}RAY?V0AN_L5eiT<8f0Hd?`LUCoA zIYv*dAzA+Hg`52~#qy`6nBpYw^)^ysc_;YW^VhQ%AP~3xlJNF!advrnO!1sHVi~cP zr|jqcB2O8Y)Z#1~QH)G@YH@6;D5=sYMK8MUjNQ#$^0$N6o2!V$Kvz-hU1lXO7DK&a z?bE>WyW*6$BHjVeKrAf z_DGh6XoU38Be6$BxzCKgxI5cD-6sFy&F29sVnuL7b*^{bKzXquGPXy?Z!g}YUo1ZB zIeyL@cW`Q_3o2OyL>FX=|12(2xe2R;OkoZ<RG@C~uomVNsM(Q0JTd zw8RQB(oAl#_iianD66v)Uz{D?a<_Ymit;-0_0)`hKDdO2ui#fdfS~N-t8e zn}Uog){Rb$TCFZAPRp`Vfw>SO7keh1j{ZPhacO!rJDRxVR8~0L81oE9yFG8bl?|CA zN{~pAb5BUyo|2O4lXEL2Kh-rUrZ}ZMb$Zfg=<3wuq~paw&%8Gjr^<nBibZgBRkkyR3rUjS6bR`+4AY&(%sTny=-}MnK8wICLFTtoE?|dPZT3f#(ud` zwqDs*`Lk!U`g7fl(+G^=b@$n`DRyZazqqFDtxT@CUF;oG{4B2eY4LM*3e-q{hRUVB zOP5)RzDw0^c#&Ep4fR@!illPE2I)YsMhdKfTGEU1jLA=)djx9jUHr_b+P?UiPxYhX=a$eRt-ecwyT2>PNM>1yVw5*YvYnH* zac=5vNzN6}LA4l3F6+njmSlMx3(-ZA`9^u*BJ8bfpDfs0lnomUbk^&fmnmOZnAPv6 zCKjelPx~`1?OAf#y%*nW-N3Aw#n0@}H_l>7u||y)bbpQHcPX&#yW}RRJQz5VX&b>D zsr=+TaExS5>I;a#E{PCQeew{ZHFh{DC2bq5asOvqlF^p58&keNi>sXkW`HfOXp8$V zEx`^VcI3yg)w7n^HCW;*up|gA`DMpV**+yLKMuOBXiD#A$-M?ZpZQ^*Jt=-3B$j2Z z=_jg@<@_SMNecT+mh%hr4cH^g`31WMAnPp{zAV&JgD%4e*Jb9S5wgTd*+wZ*<(;#3 z$>(^iH&cU!TarnKrOQer7Uy{20;8QDSGc_}tAR8sh<+_f00%fRaNurk;a zgjKn+Re}GrGx#;Yn6S*sl+Ss-9yT*sSZdi3Auqqy*`+j%MsF@noUPw@zar~O1D#6$DOAE{A@+Be%Ay^1hnHcWO7 zPG@2Dkz(+B@@E@J226dufxYGc%ba`KHP|K({$_1c6f5H8LEBUjULJfa5P^LeX~)ur zt=3ab^%)wR;yT46#c2H3lzp|gQj%})Oo>bCRh&`+`$N(n#i`D?E#$#emC`KI4^&+&yJ>M?tPxSIJ*dm=I*p?KCqU*r+WU#%ry`EYx|CH%qxhq(n0hX8C zPR;hgQR)s0LOUA;pth0igRbo(+v}+HkqZig;VMP;EP!WrLDOM{8C_f=<>pxVQzpt>c(7)Vg z%6Yg*zLkJ83!IKKD~p}Psq7^7A@p$J+%R#0KINb3Gk`u|%1LgWNI`nCM)2qdbGA2K z7l1zdpXrlUS*gaCo31|dw^)2eZdih1s#|bvemBLGfS9EANBb1x5@Z$RaLu3c!FQNYme%3wFHU%<+dCrJU|fRZUOXe z?IaT5l3`=n65mVE0YGKP9csm|u7iOocCo7X`O*UEjQV;RD`ux!M2SO$PZzObLFfMGeb`4QGEDVi zHM{zH+j3Pj(h}P!TO=JL2j*2TRI^P`EiEtKEuG&P9t+2(CoGFAEyus#!qzSU56j(Z z<>EVcjrZxCSt8E#(b-?((0>KoFvq9IE{n@7XW&s3@L}i8m0{DMFfBP=I$mw?;RKbC zAxY)w@g)xI0{~hHl%@Jb3Rurv3Aq1u9n4xlh`CYmqQNRcOu8KX27Q_!VY}9@{m$rb z7vw6%xmAX@#KX=j=D4-17b_IWl`FPCe@1bAq0F!&?Q=Bieq=CA<|v8S#Pk$7!&JCa z!m%SFe_d+Y+rTXnjZ&8!dIJyJZqx!2><* z5+q`E({0U)AuX|U>_XMpNWbbbHT1Vkkwl^q==5G1@7i306)kwZaK20CBwo0L3ZrZHt@_c84r=Mrljp3#R;8L)nXG>J!N8b{kpjJ1S`-4 zcov8}3DU7+(yL3=pqO+5Ru-?;tyconXK_#|K@Dad)F{oXk*ltdf$FmDiWCw=Py}6D zPvi#$B-~fvRPyRx{*NJsx)Faq&r*3ByYX>b>CXP@s`c^T73x1Q2^oW4>Ku>$lw_Ez zoV~J*n)95F8MD96xPC!*YK@wzU)1gL`nA2=${OiiIk@l4R1Nbl_fq*);1d`6x17dM z#6E~=jLVQX8?>PRZ#sH_^IA*({JDQ<8PwqS3t~(=SUuAdJj_*oR$^qM%)v1e7Q0dMoGGc}vmignVz4K{{!JaB)JZ%jw+mh}Hk z=lt^D`+?sZTxrU|jgMj8S9%QSf3e@E+|lQAWjX{LU6L|uY|+aDPyevasWdx1eqCuw zrK45Ghjf#ded1yyXTP`I=J)u?(JzDT^&h;ytTpwc>v4-9+r#HBPBNN0&g5cm&CM#& zLtj2!wP8WKAAi|D9O>H4udeiL!QYEEYh~@OeR7oAgH|BMu(AK?c=&gGaDKsmTk_BU zxpdkG$cR|DUtk(v-t>BPwWfS=uT7T?maVjMJ3W4BE0^EpG$hsS;(ml}?9irdpDz!m zO0PqS$&NT-^oZ zY~Lyi>E*||oL!pZrTii(y2GHko8snoxVX<-p*a8Tp;kt>pGRw?=@oVO@TKS7)vJ%E zZ1$X{-+kTCds^l*dY(EzrR}R%bF*@t_bat?zu(8=L)-|zGQQ1xjO~OwAq;pS9dE*P zR*k1e^Z!lf{P(XP{DslH9Z{TXJm$M^LsDjuad?~nPf zT&>!=J&=F5Dmn3B{@<++q)v#qo%z~!@!|B&X{$S>X|M7r7_b(ui`B8i3T;MA_1>%ZrSqYI(pGW)8|@FS?K=6~fXx@4 zOG)L)tXd3DG8mW1m$%GXb1cEOG$M0Jcz-h=+1&$01umy-yMLIJ8u5C){^S8Yw2Jm> z1vzXOH^kv%%B}V>`Ukz1O_VC`mlidprxm_iPTt=#xnth6BYOsKOw2!Xs9(i)`OnUx z^9!b~>wA3R(j~67|KucY>3}r?zPJn07}7OGn9i#4^l1LS>74)m^~3)*KUlnO`MLqy zf!{}s38{Xu@ACEzrXTWRC1P^B?|DA1Soz(^JDd7Wx|NU{bSnCQuyG2=gZW}}U z_T8}Z`@P61PQfZ#b?>|LuSYn)(0fN3(s@SXG(>Hjk2Frhf73a?{P%tcecWkKlSYhlL?L)+kHaE-WhiGFOQ@HbUITN7|Ir;ZK;b(sMzn|W>?&p0^`yape zouc(cb3)vEk6U^d``oG9AR()`^x|6I^s&2+-2FO#^07Jj*Hpj#UNLxM+cArGI3Lvd zo-L=QT=#98XTZs=-DlsncDA!KuUIkZ%JF{b&U>HS-BZY)|FoWe$HD*o{>B=b`8 zj}Gh9!MT-=o=*4cT|e~;i&(jEQReo zT0hs$aOS7i;|%rdX3CF`IV`)PzRlh9Q!hUFJh7+dqP54PZyw>7@io4fRy5kdy0mN2 z!v{U?73|H6tLy7LO#j@t`R5AuTv@(8SgLQ?m<|)itg7kL%5iq-nGQZ0?VP@>|9iQ7uQ>dfqLY*|2n)N={rgnp_g7EIlH*!ogd zH>q7AVVa!|{G`2HztiUoG^FE`#%V~$1C7)0-*nE8|N7y7n;-smwsv>(&e2>2fCFXE*xYP`+~Jz=4&9=Va^7nCy9SZQ$~g&+p`K zs>(ULrf&9#T_sNo%HH?R(o$P+s61`?nRf;X8P?sh$9vZFIqH}4;;fx%wyNe=o0V1P z)|?vNb(iCG<1TQJwnLuad9$@Y=WE!4l0|hr+kiEdFE4@Qnt>oyYs% zGN>$iv?p%0T&1;2#|u$1W8P->?S1z09={&TDuuYXLqVg$4Mn|(zr;YM@ ze6+dNIz{E_-&3v{g`3Hz_b%-`Gi!Llr3sI;w47JIf4ih+$fX}sbGOU<*=EY!w9t8j z4bv!GU=XTqc&Pr@`O?iKg$Z|>$GDsqb2uamyx{sdh4=rju$Mu zr81w^AN1c4`Q*vg`y0<2f0%XMtJn9%zOnNMJbre=@2}k*!{-dJS-7h8kpuQqGNL!Q zpBvPT(Fl_H?GLqT<1r~&qcRVUGcHhz8I-Z_o9MyQ9pA>Q<(Eo6*6uyM`)|>wj5~e2 zn*C_4bHLa=w>-B@>9YIQ`K=?;wN2k_?eF_#(hm2S(6GtNY_#fCK3~YLx~wzt#ql3n ze_eXvcQ4ZQjOM+A`>Q;Tso&hH;9@d*>8WM2#>sj=?sU5S5u>R+FuNY~N^VIK=keDXZ=>4@Fvk^`2a}*30a(`=v2{spF&_r%z+N z0^|m#`1VQ)4Lp6+aoLCj1+&d28>6+vUmnaIBC*Xu=6A*LzS9>EJNI?fl-uol4$2sK zQR|Aar_z;>c#Fq%L;HVNeQ?>@#f#UyQ!wotIe%V8PT`W-BQqZ_c;oF7d-Iynt}{Pg zDYV-%wePXyn|YSb`}QnO`60bvOY*VrYDP91tvqHvGZdZMp#7`w0pLvj)pr3fzxr!_ zh0T?#wH?2wc5nNmRhYK&aOdbuEs@RER`7NkhS{Py@%Nk>75C$(2ATdL-D~)xhaqQA zYm|1oIw<5O=ARg!(y@HI{nnHrZc$&})C9CY;(vJf7_ZBH#U|%5zjn?!1G)OjCkCCa z-5mGa%CYiBKLzcjc~f2*;@i>Ti#l^6)1DkDEj>74M_@_vQ~$U3E#uqj4?la^!0Hs{ zro{ge&cJK?MBn7!J=?oW8{nkOB(Z~SQ$WuIrd z^1gfP?l=y55IYw0`^W#-ed6(@O5IFftyyo!*AB>kyen_AWzPEVOW687u8R9#o}Byc zsK>#TNve67>jrOlGIrUc*ZYRtiNf-B>uc`SAGq(VTCgzh3A_RWjpxV1BE!HlO`Bge^{b7(UhRX3g&s z4i2#wTUo4LGb45m=I4zFk1kB%!l5M8HWscT@Z z*X^jnpnS~t==NvH>+t>${=VbbVQB13vuB+~^huNcaBiyVTX?$-!Sdtkt0b-(+5A+1k$Pbbq?f_vOc8m;bpO^Us(bICykR?xZK~&e^k%wCZbj z`m^cz#Lfz5O{!S_^Koysy;oJdu<&zO#L)Xy&jPzDjF!~&y`nhldw(o{P9vi>z0EOM z$zBg`=7yx-yIh=m+E4ewZzh)d`!N6Yg%}<2k6kC^*Kf%@?D%=!+0?(U=t#Vj8q{XO zJk0N1H9Oh+#rLZ*R}bAt(o$~6e9$X-Kl+p35cj)2n4hg9`u48K%dujC%x$%Eg*&qB zm~HJ1P3C;4?{OCM|EJ&i2rn;`${Tj&^Pi`?TBplfdvw?|{HuG{^YQvcAR>dunoay_DNeo7uQ zyxYjMA9|C%zYVpJ48F1M`t9AThrHeLb;h90d$TV89cU+eKWgoOj4n2ppY-4Um(KAi zo}BGwta-lV_#SktasQ$01k<{dq9(dYGV%Sv3&yL3_-(SCH-4hL@cvYb3>(Sx-UHY`+# z8@YRzO1-^Z*v`!Kz8NDsCC29r_&Z-^>hCLV1id?O#5Fim?T>(wDl3b+t2`?>_iC!? z37buiJUgmhclc|J-sXMp!iMiYkoU0Ez4)8ypl%!Qo5|W0wLKiB`bzoLksIZg-V9vW zF5#JC&qD>(XSVK1aOybw!u$iOhdWnX+o~z|I^%5if#W?>S6zNDU2@4Y*?Eg-$esB6 zUe*s}l6F6|+;;NJ73*h`r$RlCnN{rRFn7yYla5!;?Mmn|_HDt&YNM*uB|cv_7_YN) zxBNQ3SN=NX{liP5^vmQ@+v?_d=sjOF=80yNrQw}$eTB^EiJP8ZcT)6PsOUY+BBtQX zB;CJl<}3(lv*5AzNN?TGy=p4|N?wpSWcB(igOyVbSjDwUJd~Ed(thJg$0x%Ej_lZJ zaKI#wF6Se>-u=<8M@Q3B6a3z9cc0kW;Pi(Dh3?}QP4n8l!+ieT&kq8nM&!I6H_Q6! zZ}Ypi>C$yeeTU)xWn(1q43+q&g>xwoHJ6>gso`|!(Sw{{FIl(pz?-s^|A>(Rd}?zz;hk2R1{Z9Ss)bB}=F36nEt8f?^L z#^)M#YiIv$iG6Iz$ypOREL^olLifQRw?U+YTqTzb#U^s2%;uW%%%yNl!+UU7LG(NS|e*RPQxju^To_$(6lT zn)%w}*xI9ApKNm5uu7_JDhg`e1eNIOFP#mzi6t z`6Kc_C_VJPo3?+BRS(UP(;xL4;Vs@ewy3RbZQEYsM||lxD8psto2_l4?P{ajyE7iT zC!gnC-F-x4<2S}}THd_O?!(UA0mAU+w8S9ydBej zl!|QbGP4Yinar}y1ipY){GJ74!v%+;!y2g3I++_z!t!;lLmzH{9Y4DYIJ zIg+2VInGM;gWT zUE}Q3xAL%G^mCV6D+)AjS@_*kmB@G6eQ};;{NO&5v!0uDUH$csHQCMwMm`_9%T+F- zZ@b&O)4#?&h+1!*=2uxbr=6Cm(Y(3iJ!ASTT&F&)t$cOf*k$8h{}wj?mD;A@y9aJp z$^{LPlr)*9H`Mb^mh_6hM|@kgdSCV{CI5cE)qSrRmeAgF;YQcsi_>R(%pb4OwVjin z*U{nO4s9;HsVN;&pc9Wy|)_S?{dbH=Zb@@(Jx_R+LR z*IjO(y^J8=W_HyGc^eGu)d1$Tua+AbPFGM*VTHSOxGT`Nv zv{6^aM6Z8eZ4y>9OosoGxwXYJPZ+q1Cp$%rm8eQFnU>y@MDw0_Q= z)^3Z=6}!3JQI70M`-Obb$rP8UPPbS5OKAwMlo=gdEJeslUxQC@bhXW&4I{Nx3ZbsGNZCLgA{Xgf?_nx8Pxv3>8w(x)6ow;s^@$7Ssq z4-F=pWLyo_-gKpUeBt3e?bk@{jZB(2F4x+zs_!2(;gf7^4{u!8!cDMw5>R> zzgKGatzLhX#LcYxe&TR<-QV}_emW%2f7rT^-`4Jy{c+fEWb3DW+U}H7Jyx_!Vc^vI z+UiG<8n?nbOn;v{{YYh-b-i!rw@r#Y^jehMS!aiqv*fgg9gc*q(J_7J5g#~g)o;iC zI(B>Zm#$-b_n9bhubWw)NY@H+zM@s(ZmAv0dLtg#JZkUxO5s}m$(6YSf-aVh9U%_g zp!0`u(v3ZXtD^oKwE5+XJvHl3EZoum-Eoy}-6qR*uN`Lh&A~JNRli;CNiPmbrB(zF zecvVh<#)%Wp4;M#>uO(5=y7D*l-YI@J7jds8TnTAfQx)&D~-)bH=o=o3Llw$Sw_F@ zZw5hiX0A$-CF|u8Dp5*4x=yMgp3E5Vgt-rhp`teFvu62gY zu+>U=rjY|aRJBVV`pEHw-^h^{kKDL=;q}V<183yzx-WA$c0}B*(XBtWy5Fkp`ZaQ2 z5134j@BHIqot0+SL9>+Qox5fDuhs55XjkiTx9+9uX?o?`I4A3#@AJNV%w^-Elgs+O z&Dm7>L1*NNBO#M_b?Y;&o9g}tcK15;e`c6(akN)T;W*LIj!|0{7qz{huIM__&2X5F z?lw&i>0K|cdKk=%7Of~axc!zv&*4inrDsYUka_)Q^p-iv??!eFNQqwbpx$uy^uJ2I z#@ZHL2o6{}@MNj(IAucx@79-foyVo#I=pA!-VPgLUuUXB7W^&wM8%>+HMOJ9?oFPt zq8&eSRaARz(y@FQ;(hMo`1CB}!b=+Wk3Wv=b4a~im4}4q>GCsQJ|1p0VqT5ozCR9R z&bb@;>C)#XJvW|T>Jkup)I-5T`K_*5rqf$-QTO6aK5o8&sz*w72N_t5S@!v&S>5cv z2hKEIcYWxrO;hvxsl3QmSL`x*pl2WLYn#8t7*v&o{kiwxyRy*F=KoBgnIyUx;t^UEGJIux1x6a&- zUq57PtA(-#T(+R^*Z+F^gR(I3-C+i3VBpFQ_RbaeFyOFm^eW`t{v`FZa) z*=}V~Jxos7=dC@nynM>hNzYrYJMiG^>yJ*klTNIWln$NH)6lNn=EJkjE;O2ubnW4lkW@V3c{z>8f6r7jvhIKrXRgkF0} zZf$c(@PnW5&J3QxoHQDi)ZuR6&~(Z(SV z+}+)S2MF%&?(XjH8l2$nPH+tb0)ZeQxP=6l;O-9&`+WDD^W%>3#=UR6#b|oZo>gnE zs;=tYG}TqS4|rq}WX1{2uOU@<$ukEtD7gAUZXa_c&1iqwT14r5>rYY+&3|2Mj2Dq2 z1OFXbF|jsQvfyjuFIP8ZxCr6!;rJr=cX}j^PtQQYOhyuV-FvarzV-QP*PFQHHYJeM z;}h=xMmZF%?fu2l{jt-@l&D@h#(j)XsOfR2qHR7bUDcEK z-)H_5P7OLRB5;V)!viyFZQMJq(QR^6b)nD!5(~%J0x7flSDQUy2+7%c=^w|cAq0j$ zHZZHYct}vO5v~f=IB8e)+O7quSBibx)su$5gRPcR%%xSb(D9X-8D9pUbEEtfjXdwe zTuLUV|3e6CVx#DfI|&=L4!Y^CRA?U)&YS?1Glrk(MTfE`Naw|M8hwi+24YI{L%T z$7Pb1*LN5y@TS4|MWfc)Co|hJ66+O~NmO1`cbuuX-u7F}#p7sVIx%y#E@ZN5A*_5N z=y)H3k8Z?g_3zWTE(@JaIPSfBF?MxXe~2eXGAQmaS3!R@g}kw8!@D$;RGxig6%JS^ zsjs?%1WREbBe8`Rd#$)SSB0)lVDFhXTC#G>Fc_2*4 zsRCtbsQI0ZNvRQU<&=b#$eck>SwN7R2C6!5q*#!A@YuK3@AMfVkag92H!EyKeS#u# zru@yA<@j5s#Jw8ItXDlHUGyzSo9Zkhl=f6>D)?-ZSe@rJ`?sT8gt=On_-q0IQL_~* z@OkPjE*#sh^f&}5Op#z`Y`m#t8Y7w_hWcz5R`XA1^$46s(Pl%B3#;sf%|Z#1>84-y zF%Lb3GEPh7?CHE;`Sr}o!Klu7u~?S0VX&3`aw>Y)c7;Ia${JemlM}VG=k+*+V9{CT z-A9SO&|qo0Zg>p_uMDFvr-9gbF7ouN!iBFeqYDY8uming3)tPm`rpxS>8C>+(X}*J zYpFd#0!0#Ex7$B$=Qp8gjizVSrBvUo`fWX=T2HX0D;vY(M7itIRf18=g?^uw43;$r z97te(3)Fh?)EL72ZeATq5f*&NY(6S({7_RJ8IdFSe`9R!^K*p%8{>1I{V>%t>`^go zFQiF}P%P@`o1=wNdoa4Pv0ADlIeU1mDaX$JSz3Usu4IdXJJs-BidZ|O zW@!i+MrGx@t|CQ#Wg@sU@P^0|2m90W+Of};C($~{sReMrjIjPXfcV_rPxE=*j+{6a z+S=dyx~>(Cz?=6sPCgkp?b>JM9vHN8mGJ3V?p<;sQ>?H+SYxfof{kYtC86?8l5;W#N_K;OFK zE4$_Wp$I1H2!}0n#1Pv%mSZJpfLdJ-T;_YRGz#{GjS@>?h1r1oq*X?X$5xbR_kTF* zWLU}$0Sl{h`FM6=Ue#5#7ALGz&)K(XM1Z=wg=&{m~C0oyWhwuH0uRdW62HwXW| z-P4r2FJ_(?VkZHin3HlC_c6#CKlY|gmFxko;m|Ww8gYt!F@s7p@K=OVHI{LKbf<28 zB6UpgJpZK7LOKKwOZyJbggD3zJMt(4@W5KSZb!6mWiJZ>=jjW#F$qDU(bv5KV=6fU ztN!M&MjnzXV<+?B(`M*JS9=9?|3IrcLNHkQh2mB#9;jSxB^d83iIBrxV5xBPNvhAm z;o|KS;xlx^G9G60&kHcNeb<&qZi~FzKEXVSt|+?0>#%_vWx}F{jb&K#0_$pmBkxsdoP|!kDj_PC1v?tz$dxuW&R&vhxM4oTM9<;Ms*&W4d3j_3l-l zmX}!M2QsZnAS@CIO%NJn(*Ee>?J;TkadBZs>HsR&03WjlGPa;%Dgpj4+u(^LZwUBv zCL72!8~*7#7HytAg&?NehbuSkP|AfYj`O4mnJv2?zJYK9lMvS$666I3JD_;*JQ3bo zr=0emA?t)gaF1J5A6@ps6rH_e-3E^|?RVm6jMz;zhu2*xb2TXIa#^vk+i+Ac|Ndih z`fg*;z0N=87!=QkFw4=`8C_-?Se+f3p}vT*Wo}gg~)}Kzh_$EsdS=gA4|1sle}!g z)apk?kRK;FK~DnN*Kaylu-o%a?EI3nW#wy!V)7-@v!E@0&e7yS{%*5@Vev zIfW{vsS37>DD&k-v&z5awugQL)ibOgp2^vEvFasp`S5Av#_!<$yUO`jZ7{I*Vm_lD zk5HDCj#|l;#KfN&55m=nswWd<_-_63qhTz^VZz##Imfv`@c@(`+g20SnmmV8LSXse zf9RIEGnt5{%Y>(55-p}ue+Z_FeJqeyopjuk=t}29Reu+vxzN^ZhHC2}n7DHG&X@?~ z$1luY{*(C%(+M4+KCpYC7T;zSIoC5=`YnT%EDt!^A4OBT79;qg<`&c3C0O zU?h;djDxRwVP276{qOet=OL~R{wJfK=a25gDmTYM)omyEs)u2%YVEx5u>PmZ0m2{~1=B7PWE^n&8~j1v{9QGm1vHX`$Z*^G@c*ou&7 zaYzphPge3VGpj0dc3t{p3ipS{=)$&P?pH}x#cwAJp%<}AEni0IJqHlw|DMvjO`zdfC*!VVOAokbq@*{TL&8c?p5j-B&?^=v5;^=*{zDLo}81E5> zn||zlQ1E5B6H1a<{NO2ao>h*75l^4mDp@lym2ySVM`_n#+y24mmp{I)W&az^%S)%pgCNAdcwm{>|D zpXu~WQro!#Z{TDX38+@CglIL}@28Vt=V9v2;QZmQK~oyYWirIc)&15cS9?C1pc#E0 zcJ7BC89pc;4988riMp*(?Le|W3__xtirOO9kr3w8AyhR1T5q~h)|yRlS0+Of%wtH~ zzjuw~J2w6bt^VxCBmnS1$4hKcVzVcWo+rP9^(?~L@{OIh#c(?NbvVbkV^ou|v&=zo>+ zC(MRhK-Q_iojJ99J)j=hR`4KxodDssXhH7o^-JxeF6v~{Yaz|(74xRY$u!?FWZsu=du#6wnzRx>WT=b!fe<@{g zk_osdP%qU*Y4E;c`pxhCyte(bQJ!5}d&jRZ69pX_<;y4!Z>GC}wZ|f<)ShWLt353H zT#Q|B=d<-`!|5+s@y+=QeLhocZS9?9s`1sBn8K4KdtQ&_+1gT8fH{(%$(Q21eILP; zbqTSA$-0IePaN8j~bq;s?*4DU^Y5hAvn?jGc^YL%6O;Xk*|!z-%C3)5ZO9Xbn;T1EIrHFm`Y?<&}2$Av%X`m$fVS)yb0Frbe4 zbK8E1(3w2+iyBUL4$jY@x4V<@F{ajor$|BJHgk+*C*0YR4lF-wy$+{aG__J~fnkWkDR7M%!?9L0-1=JOC z3AH*+5ly{nfuW&!!Joy~dt!EO#QERUhPwyhkNcuAgC@D0TR znvvpn@|VKYUqN>5Tf!7|*rtt=&e-fKn%bR4VKTifnI|a)9R=*BpFn<`G>z({2^;5L ztB%!Kwi_ecS%xjL`C6DPKo6^maL~2eO!f1P=2#ZJ6IuVnvMG@3Cx7F*cKZPlwx{TEnqcFe_%&$y$XuVL# z(U~L)E3g1vHO{-W_A;yj6p!>oS9eUOft^u_dQ6QD&V!fm`uv>tmf(KddZ-WM9Wgi~ z7_F^Z_XjHkip-iYPGKq1hHvR+EjenJ@ke-YRF_{t@!(^^9&(#VvcTr8eJF=fp&Wf& z1z<=bh%xUqm7#2esNycUb%HpyAsBlI^Mbv?`ByHt*StoVhz^-)KFWDD6jV$$$j|5_RB?XJofuH7B<_z?xF+Yas1;`wF9gzR(+?w z)ApJ-IDPxXBtJb#fUfZ>z|+e#tpP@w=@b+XZ8(ztcmWtJ!q8Vc_V8l!Wd4M_N^-)J zwoY(%hhF_OO3ge4$N;6#D>XZzxR?afs)BFDKhep#fNw6;o26TQ`k?w@cP@*|K{QVN ziswGq%XPgp$2(r;HGA5>te-Jdy@Q){H%_NF9hg#v6X8ljG&uNuu3SsjIOSSyZxk|a zG~wrfBPgDTse1~Pbi3WUU@*R0wPLx?JWDR0XUDhWx{j9%VIWq$yLT8hLd@L1&YVAS_cQ!5Rrmg9-c_jZ!}Phk=bw&)*@5TqqYII z*K(s@U$=glQeo&T?i+7F&DHH()yJtqkxDJ%ZZE}@0lP8?B`JcJGfVu5Iw?gMz@GXH7-t%i9 zKikUX`-X|Lp_G#Ix|wp3?5(JK8AIQCQ`nbMFdt|fz)arM&v>-0a^xb<|w+av{ z5Z2aHF!XNCPIq~sUjKdlA+0C~(2X1YD#7h(l5fu2!Z#@S=wDT-8mPh_e8kt;6rL!> zB@|V8u>~)Gkds*4-M);IdU9mV*nPMBF=|7GbP80@Ezpux>3&zJZePI^cQ2H-gd@%9 zh%#vlSCCR*=xpqA$om>Q5{L?&^zBrry|X+SAw(Zb77BtL_kPA?KW-SypJ(QZzhB`x!>4!==R+GK-cBx^^oEhz)Zpz zzaj6XqS}z2`}_NXKw+-4SB$iy8qpxXL18K^pq{eXR$R+ov-)?B`kYak=EGQI@v0pPstylvCQ!MUy~-xn%r?xJWcumd0u@*f9AR6Pd}^0O zHOZH6nZ7TyjH>NaC2Y2Bm=F)-t{<-0(#OSoxFGGTI*X_%n=Q8Z2`U$fO-*pUs_H?V zd5E}Auuh~lvg|UmLEWZiDTf<5Yi{8SJ9-N_WaK2kDr;a;e8Dv<0 zxu;MP$WL?3XSUm5YN{d#U%ec}I?@7gG5@xz4l?L{iO;FBYE&XkUnVy3{W237u^kz_ zXB#TTvVT^1yswv?wPgG~FY)shRIb{`95_dOkq+1FJ z{xf(xhC271E-SUefdSyYdx_FgnLX#J&@aZN(jspZ~Y-YudZ>y$+QqD>s5! zA!uj-Q-KP*sKud;V0;tb%p}1fqrHfNUh=ISW8SasWNK)keRjP!YqR5aoGb~aN^2+z z-?jI`Ei95MmRkCkJzKlpWUAFtN%&B9PY@i6-^}HkyYBgVLu$ z8uaOkbLa_D_GBO%&szWvzc2W`{@l}Iat>>pd^YRG_Sp&-xwB+7=D~s<&`qL8{z&s0E)6Y}fsk-LY z@bqx{o$J(M+AMd?)Lv92=KK`AVE6UlVEbwQ=TOa413~Z~V)#-;gZpNkeOZiRO4#A( zkL+5mRkE%LV@y?dotsH|;j%;6JHXx>TuUbyEzL5@X47C|^Lb|_DO|oqWiSUL5N0G0f8U6!{3zw+z`P2 zYxREY*rfVwA57P*dAm3P-(i}KZI6vV>OrpgF!+LJ#Sm3LiRYkW$hQqG3{L3wrfF=M zd{ZZz6JshX%TC7?*Q+#H2Zzk1Eo{d}4DDP%t2w}{`AEV6jTS>CA zZ*OrgqWMb2#$B7~6YrV9nh&qHmu?nXX@rIbp=a|pt-}nt7k4H(=eF3(@4vpU|5o25 zi#aRiTf4f{@m*|d&W$DBZEy0-<+u5q*_H$E*INBE4RX1C9pMH{cJ-QxWft_wqiu9( zG*tY+^O9?XgiCWxUe=m#TiqWDT-6d(JPbcO=kPvP#I7VLy&SX%_0~TsBUJ%E8&z@Ji#EpY#M&A=%<_ zU#Z}K7Dd1#3&W`_yK`PTaJo$zd*-iPzni6m4Vz)@(qLL~tq9H)a4;=(=v_`lYW_7o zZ@4f$yVX6L;8l{a_<+v!eFfktWYS8(PovWK<~jd7f>3-gJd3^xW6jq={T~kHoz;R{ ztUQ5HAC!Whd0aHFu9{?n`^3zYMmvj-L>Q9YiVtQOE}NX|56}EX=7Gr&UYGlVK3h3_ z3x!fVT0Pfow#PpA7T(P>f7{R^l4uPCeFzfa$HvvL!no>LKj{4=;>Sw$@tHr%5HgCU zR3RY`b;q*XmSxjO=e*5R{nX#=vHIfbC()lw#ETT4gmkal( z6QfyVLd&x+kk=F@XSo0k8;!#C%;#ZYqGBxpep_zjHXrDlu7e!c>N?~UlzUxbVD4c{mjI^^$+VPM$lgCWG+gyv^tKl642m#b2vnTBk#TCJh*LUFEgUk^N^ zdr*2Txi+_BWWG?Z*Ax@6={)oQr|&Rt9n2D%hq1blIoFp@k5G9KA)$-DBNue(hbaa#`^tPg6YWt#jBZQOflw2wPmXyNG=q*Oe? zO{~oDf^1Jir}uGPb^7zCq3$+Kax^Jg6H(Nk?ed3e-LRi}%_?4Xay&4rvV@g35`4lA zG^Y~kf`tk$T2`M_AU3XCk9YX)Pm*gFp<<_aa;_hG8^SMD zQHFD_Is`K}hTGUTuah?w|C+g0GxG{ERJP>a%)5^}^w+1O&pVDqIp_>+5!A=s9_XjI zh;3kIZ0@B+XHefOlmTu+@ePZwJ+{o#jJ3+tVDJNB5$PzJw!7vxj^F8>xj78Vv}NJ?Cb_sco9;Q@ z+&>mWL#BfVUu)RCQ^Fvzz=5|IBE0<}M+KqK+cIE;7W&>_V=of1fxZe|DJxqTZ%DC9$HR@!9s-S zwoxC}W*0kY<9;_(_%8CtqSX>b-JqZfIEr-%iqRAUjxSpSu|H=;*Och?=bbORTC8s= z{5)&7-mR-RcC*WUuS;HzYx=zG3M09L&jc$u;NA=oVc&{jUNnh+TD<28MsY115&0T= z7o6cdjrF1)ip)8VPJ!yxR_R(7Ce+s?)K^xQYkWWTnZygTNO|9I=n|95Sc-a}*Jxf% zeQNE=r|^sTodB`dK&OL}e~A9N-}hnaH9_hd9UKQyTHH-_$V`W((tw?$53#y!K6yjx zl)^cOY71r;co{^I)(OALP3aQSQZu1_^|W5y^y=eqCTEX#TjN5lf65IR)n#u~yfm>n zOkF%NG}inE88MWLm)y3&5yXQY2r zy%JC5|LHsEyaoG8LosW`PDB0S?~=SGQc;x+`Q2c@!Ns_o!S=ZYKrO?S>>u=Vxy*M< z7q`&a2@#_XKMi581e_e>y%<}_=*{wzkZBdMB9Ku~JL{U0cr|8Ug+LW%UA|8-oP=ND zxK2bx(hGOMw{l!Kdn;Ov_EHH;l$MI;oIDu}ZXYQbx zVkYe;gLl5FG521Rc=Jr_8rr^pq0M#;N9!mK_;paQm$#VOww!?&hE`QN^Cv@vfk$Lt z$VA1Ja$gTh7d4EGOR(M!0ZODz+AgV_aP_MR_aBlC%N$|1IYe3p;%WV{qhW?j*Mb*q zRh-#7)Hm)GAF|*fi33Uu0>>!O_{o9Oj-d3E7ICeyct>a!gr;AvE(ucMWvgULMTxBlwMldje;#m);7Bvs zDh+8EZ1)WredFR)9eyl^LylNn>r(o~I|dCety@pfi0l^E4yW#*1#^z;G6=tuT-Gx! zCB<($wVk|Jk8>Jk2oAxovJuJ>8I6`yj3HlevUY=iGmKszMjm z>$od&kdWsZ1@D~KHU>vw!;(Pr4&j*T>fImJbalZ}nt0(r7MVV55d~ehZ_7ttv@;+! zvA9Vh?^Kf$tO{Jj*iU$bV3{U=xJe3yPx{C2<|!RpF{=X~)eEC!@p$hF)03O{OyJo2 zW|c1_@eQcR1Z8i%bd-l%F-&zrlV__q2e15UY><`bP*l=H){fU@OQfk!)N?Mr?-5oo zPg-eY%9c9YHH+$sU+i-pI?9$cNgC>jUPv7xHiYmPJB8RP>y!>KR_5#>#f2+SH`eH+ zNu{xb4J&pJt={VrZGWDQPv{RhYX4%R)gX8KOMTlKKEC8W`#t!TU>wVh*2SBuowbW! zQd>Vl<(Pva0%yy&4;pP-h+6)rTzZPzLYxKCUrC_k}UaD1zE zTC`TM_eW1cRKyUIv;Q1~y%Z@2KhIQIr`WAs-;t6Y;+R}umixFtvqewQ+5@+)NV9swJhM?gz5n+PZ z5R?+?d@R7#hbDlmg#1NbP0J^WWlqGee6^3%fTynV8A5aNsvj@&hM6<|{&rZBORjHx zVEO1V24&VVyG#GgPNO(Z5MLF(0GYrbxEQ)S&^-io;?85H!%et}_48x?M(d#CpX|Bw zDYJ?JA-yf^_U~UvEVL+ZXR#;&o%SfUKdyaQytT^PrtIB^)Jx`2UsvEg`a&i1I+2k1 z8S=)byv{k29t;}n(pQbDA-5!J_109p_DgcG;aIkzl0}wULzB^4I6o`6Vl2!IAbl)P z;NNZwtft7PbjG+po-p)ri$jB6lzK!jm4K&p9{4VmrK085+=qpLpV{PNd!&^XdW~ z`~(kG7z7?cJ2YzNF2DT>^ku`oC1Nlq6bV(re(x(IzN6gj&wPwZg;J4YtIA?}Bv)gf z2jj{qg;;rROY&l+GjJewD{TpH4-62R)p)rUV=7mdc_!v_%=V(Mm$tOQo!3T4zpU@0A%~Cene_Y}meI-!rz!A{f3?;E+yT zMpZnxseSQU>=!RNkg`+F`C2~k z`^h^XonX|1yWe^~P;{`BsX}+{O^jV3`Nu_RONRO5!OW;y^WXGs0-Oo1f%Hve5OlRn zOxaq*$mJmmhRl(~XgeQ=o9&eLAh3x_Y;y3~!xJqB^M@j82W*0!zD;|nu%$QKuT+a> zN(;&=;OSQSv$O5cICp!niJVG>-~L?dKY+j9(+k6tU~P2~JUQ@b?+RQ~y|TIqS!kU` z|Ck#!jmL-!ua983`l!7*jcC*xu8fyhs1grMSRo)%M>96P6=}-zXw?PRXzCV4uReSq zFH6f>C6Vr`^Xg3;$5)$_DWcQ8h0p6U3B;!qd&enzH1@=7feaWMXnrQq)uo-UvHdu6 zZnlGnFB!btmA=swEP8F)7v~Kq=yYz%cM;}JZ-3!yVHSl@MP4k4CY8gg@facy9+qR5 zoDvU-B|c4I+U;z_ZkUp&i99#uiwrxVBc5)w35P>SkPE7p6f^tcNp z-`6UOadnJoJ}~VXUKQu~Cpa+S_a*}(O1_cHY8mV1TJVH|+Qw)Low@zS{*b9{`0w`$ z@9#5|5pN15Wu#WgLT zh=%nwb|X}~?4bPXZI3^cSaOrY3#LE5&8Pg6!juw#DuwrL_mg5p4a34X0)B%MhvZaP zdM^>rB)<->v*IP)*YZ*fR5|}NL9;rD1cDx+(W^eX5y1rCk?0XY+8VcgHS8~yl~&M& z{-(%82!D8?poTB@B}Ty&Q89Uq%k~b9KKkQ)q)FK8DZDtIr_mv4USBqqp;~!vXc$_O+3ZiY6n|LYQ8Xp?D5;TOv9Qd zLZcGoE^|)tg~38DG4@J0d;&Rw#ugqjOv=g4)?7+uxq-|SN%{767I#e2CY}n9U{f6X z>fCR)PLD%(*=Kt4l-eVCMo6C)tg-Q`%g3`cQdMt_vcV309dX~Rup{Tc4U?#?Ga-$V zF_%iA=AxMOCrj18IqDk^vX#Lb7_c2l&CP*g#*=ndW05Op_+k+%e^O?bDx?v4G{gJ) zPahb(kZCCRduIW)}$0m%*O*6r&U!**(?c{g{0|Z_JfPoC~)}8S7JTt!oX5umZIZb-*C}5 z`gAyZ<2@#4w*_42?w8oHQ7e*Pfm&P zDp~}ywTsT;->x}cdN_5N!ohW^`Usaj6;;@YrEC6Pdl-~?pw|o^`i1^pjvq-dqOB>BG0<6c0#)mhys-Z9+3z z6~(UT_m~`qh71R9MfD@{&`>YQ$_J{Yq+r0bTV3kq_qwL7)vp~3pyg*fAERX@ex==7 z^|vDzzE-N@LHYiRV-tpl*)QOzLXuQ^`EjrkKXQ~@Ac*#^!B#X?(s+GQ>0N&#j`qk` z{|@VL@g5RhOJ6Q^1tl45Ugcs5TarE#(ZzmS49Ss+4y;x-1{+Jqn>=bMzWwbS?%i0f z#gVLz(E!|omd-rUPxGWGtP4Im^F6ti=bcd{o^tGM(<9Lt{Q0fa$f`_-9pz5`yG?8@ zsBK$)v{wZ4LhcBTc7MP$OVuC}Vr>%A-!StZqJWvG}PJDAY7*g5*LGvmHKoM1>d zW?E;dWf&UxT!YiI5}?vwb-HGq7m|9(@-=DI$4gMu)vD$|gJs)d#_b2ALT&ScdTRVvm=B%`yqwMbZ#@Jgt!ygt-Khit*#h!3g4#a1zf6rC&e&uc(smwt8p z)R5Si*qivrT1tY!Q%_^VvN4qM&yL*`beaWaI9I_B_)9EYWib^X&yN-<;iH{{r_HZN*m1^wveRL1JmAEN56av&ghb(0WjXn<3PPbzQH5dqx? zX)%TqP1bRUv$sP|H3)|j+Ra*2pO{3i6{os4=pVHSBPyyo=7K+qU5qb{VKg3&i-|4j zC9}YP^x|z>TSIXaB;;5FYw_(g?Y@IC4KLl6STmD|n__<7XcP9!xts8l8pi{oUigdAPtAp+Ix>JW#*br zRa5Qv!6J>D@0=y-%svWceWT>0fI_WyHjW=mhY3^PO0EZ_i$7tPA6nhW^uwJnAymZh zK<-A`B((Y3@N5gNuG(0a zN(>R=RG0Sp$=gj_;_yPd(DQsDlShE73y_j?VS^R%D_p)EiAA;h%?HngUGE5<^tos# zQec&6OV2{#eN80T6vAH3f`$Y6$-2J%Ai<23y_tL>fu9up@SnH&(EerV>yvV{1X?S4 z8XS^YZLF3=PP7g9&Z`jI>=k8udb$#aHO%Mk{suU;f3oj}=W*8Y)G+irXWwWN32V|1 zj2#RY`5RAl3G`gxL<$q{CGNtQdWKCtwxGFAet9)SnRD}-2;thLF=k(fWCw2fOm+^t z|AK>iaHvY>#t+wU z?fC4?ICXp$^3UstaPPe#v(|;1 z1-=rjyd$F^WmZ)Preanp9F#0%%m%6**LWxfWBhmtcd$^r!I{jEve_@xzrDUSpoq<; zN0WVWbXkUlieGGOg=y zvoPyeiO$x>mn9m#-}Ef!@TMWUo7z-@O@_NrNQD=!xe14(cB$0AH89&tQ~BZXbym)G z*b-*N5oZgAqsextOh4h1_{V@$ja2OB8?f&T<(XlN2r}#N3~Ex7Nl{H0tEQ-7h#wmT zWqZG^_sv=xR9-w76`WLT*yKFK^dWc=?NC*4Gmr%aAx>W*lVPX!#TTPb*ZJGD*@g7y zngeEznU`nKOF|Dy=M2{+X$gIH82<2tt0h3V%c>$OO;udp)O~@}Md7aBa;u&}>*UmR z8T~vYflkJJCB|7rRX6|9rLkwXq|H9pgd>rW&O-o-&bz$9f~Q$(b+MK3%`96qh3H}A zSlJNREu#18wW17auEDx_XcseQ2)793n_9+J#u474dS^{J1URWE^2k8c#|}G3PF%Bt z{pL)}E=XeC+fONZS8RokqCXQev7L`uDKz$sd(qc&1dvb-VY0J;OEsL^_V8;A1T$Sf zqF(Ac@z>|6!&C>-WOR{!O%`9Vbo(l>z+n%Fvv*BO(G{kA^~dw3Z>~xQme6C|x?bU8 zr!CbP8-uq@YikWC*3U{~a2x9Cu>Q_*z#CIEnZpiN%Cs#gQdPrYE84wdE>{g$!{CVS zfc{E=^|~69c;;y2)L8ikmDZA2*X!z35+)P_3`MEkH)}~;)4>(5<4Z>B?>lgj-l}|6 zvG>H)d?&R)o%kW!e@1$7Q0a>q8x|>1{ZaNmHfan ztZ?xeCkCr6lixXoK(g6DQ{vm)OvO=~O=M+y+0|iwv>Y_fpLB;5$nojq25=hoB%g-X z9K3!}9luYmfk;c+!#ce#x`0Q3d^69+oauR}+JR24i$#FBM<4rkCf+ zmia@3;!0OlA=tZvxKr_JJWG0e|CJ=4^Du(gtE~0(-#MKRBF45X!j1=5y)img(nppQ zU5>c-84p2Qy}bu_T6TILtk`1tR}_PU~NxtK8W*^WIysdQ+G+tUUn%hBqADN zn0nt^B57tZrQSbEcGDs(sc$K%+%3w?J-D|m-g~qxpJ+7m1@bmf_S44{w~=o+A7p@+ z&s&)qoEoj|+`@!xz7;dg{T+u;_Zu=Odk^gsU!FvP3oNCZOC>zbHnW{R1e*`nn5@(F zTi&8hADuDmfL3zRz+*UwR%nyUKgX2y$hMBCjMbZFEi*DUh( ze0hI<-J22F;kR$;6kWrLhH{Mwqi`cLzI~-Yvh(wg---{@b}%!%DPl2vdeu<74Q;8W z)@$z^*lMg)^=$`7?Z;^>HDBc9v2 zG5w2}%kFkj&L4VUK9Ib<(k~lm`Vkm%w3YiU&K1rIQMr0k-r>VwmG8T2UaLmr@~;F3 zUuG;ZTdOFlM3(j>RCM+2B{FB7EQ_KVUvp%b!T%xe9++x2*y!VFrxE&bXek`->PT3k*7^PRWfG8eI&G?9hdG<5WRQ+}5t3z+Q0a_B5SDdBF zvNRlr8^31+2h*z+l+&vOb8ltBj-xv^DX1&<2ooU-`YK?fMzrX(S7Y6F*&5#bAdxj% zdw&5PP4~IK{>ROEeh-8d4eELMp=$Hfv|X7htliMUP4|~G^Td(eQ+V5yDad1u5uTeR zR8_3)U4w-sHCf)>`Nq+svV1G49lq|RD9|H_EP=%9XVu>N$A{}G-Dgn{;wz2HfPY<- zMM)lJy|cYGVjnH*ny`uM?QI^mYLuKEyGpg;Rv#@E-BoY z5?dtWUkdT@CTBz6_YZ@yQ6El$eo#X7v{Vb35YZ>$=?l@Dm+En?#HxA>Ol}Uaw(o=K zeqUVCNyr~L7+Rv4S+9gYCNOckl6;BXs`p8>jDaC73mUInz0Fg3XRKh-C7-uKpUq>j zh6ml3HH6>7N*F1olbfUHO9x5}OhMBSk}T31f%)dK*q-C8AX&=RFXZKJ%Lj{?0sZE+ zHafl^@^iR_aOe8t7YXX77(&*zO{dMD)Uv-k4x?qta&3|sOYjc=u;86|yYn`v306gN zLQE75#zD!>vtKWTV`W>5HE>~)mmyiZi9PofEoy8Z2ggTRZYEMLZEP8KjmC(1XBaAy0YGm($x!HF-i& z1hKqHn~Pnb=j#yCk+Y|;A+orrWq^~DkONA(=AuLZx2qlB9Vf=wC#(+b682bX;!51N z^l_6F4669JSK#yBg0+@aS1K&%`GQfKKQ-F=z0`x19~K93!Gi8^EsQQZ-q`Q43M1n!aqwKGqb$tF7HG&i zX6A{^>M3NIV0^^U6R#_KHsyaBRW=k!G~gp)CW*QmcM)MKsHN#bckWQ(XLw&dkbL1* z{e6E?_B|D`>0=1rmh>qK!jQHwPk*@M!3}n)`$3>y>aO&`O8J?*&qv|hsTFo(af+y7 zzQ-c)z7&*cWRD5DmTtsXJL=cJ=I%OA`@v=!w>(zCZQ9U^wr%aV>xM=@6%ZOP%ZHI> z?rwJ|h^+{>1u?vWVLg^h5v+Nyltg(q8Naj#2_-swtreN{CCFG#m4FA<$5KghXJ4Jo z!DOdOMrxO0X9qrg>$;qt9HI9t7N)tr+TwPX5A>!13e%5KkW1z8t}L3J@H41K2~p;OF-RzyL>Z zg1<(;J&k{R!r%ZCpakNP|Kc6M*Foch1^&WOz~0mT*#w?8Fd!O0{A>2Zzi|wJ2hw|9 z1O^O<1;U^9&nED+fdS!w*2^^eARGadJ})5gWCBkc7!U~@g39we=nEV`0&+q6&*RF$ zfFPjcY5#05I2afK#ruLofZ@MJn>{7?OFtA41?j)={(t~T{{;sCrXc+n90=Hh^oXBa zfB{~B+tdEph@Unvz#GT`>AhedAQ7Y&@RSb>@CC3ydM~^?Knc=&!5#o7Nbd!E0(+qP zM+ctEO9!BXKYe&I;-?J^a032*5BUW<1H7R6e!(t)GN`^^^j(3bf9cx;E+GBqu)zQa zU>c+C-LG|&1tpSC9>DvG{|I)VwhCuo+>CJ(Nf9YEQ zJO9$R1T_DpPX_RV^s%2}0t1WyQIP%%HU>;U`Y+f72>qA7DXdKtbO8m>`TzOk7aYI?SU~zO?NJd>1nIwEC7|`$(UZMkRUita_kxvygclmbs{r-? z>JMtbE=a%O$qzVy1werGh@bL-0a5@NNbdzp15qHo7c2*8f%IOm3}E<_@7ai-HZVXI z@cdVQkOzW6ec_j%@__^JfHO$%r9JQhNg%x!%m>_n^j@$4Fb>jt!Ti8qlYc(Be8KMk@PD;8 z!51;mZ-~EEL;7EbAOMiq|L}1Ci+uV7@f6=b4FY)mPx!42Ea9U7`tEW9U@OR^T zIS2uef!Mz>1pxoA{LY}>|2I$dpY$}qG3b20=(+qSJ>7rOGyDfL{RjX3_SDN^h^Ozz ze;Ne9{!jQ+{{PlD*MIo`mKW3*L8%}B(8cC|F#mt@zxxjs_zxBY<~d&uy|l-8;F9p4 zI00y9`zKBW=0KRF#nnU15i!>Pn-sP12wsq z^y$C@=oaM#X8`z5_e#(9f-?a~>VM)afE3ikU-)d`73Dwq9Do|sC0_Vk0Ga%sd>+6E z>OwDkK7dL3Prd+P19iC{wH4qToC^g7XxjeQ~Z*?1egVNffrl~WPqB;3oZj% zasQdW9N2rl5I@-qUje{9fA}9<3Gg!h6aPQty?J;PMHfEW)iaR+B1T0-L2VQ@CfGd_m#v5b#n{CLLmoQ*QSJg^97jq|b0FX9h4t7U!>U+Zj;`9=Ie=O;O(h(F}) zF7u1{!_F9)U&J4AX3G2`{-|@6%rD~WoCjro5r542Qsx)&$DOduFXB%)-^nF|_>)c- znP0@$J3k)m_y_T)oD7*?#GiILAZ|HoM<^NV* z{*p6F<`?moow&>|;;%T%WquKV)zOa-><9ECPO8{AzWMH}dOU=UgMd z-gBBVs0-x(eW%{YuMeCXyXp21or{h9`pCI8UAKSiEHmLy<`?m8&YLp7i2vn0Df5f?-_Cn7zld*l zHp%=V?ue~2zlaObBJ+#5E54NZMLZ-fk@-bDEN=7k_N9punO|hzMO-ZNi+Cq7Ugj6^ zh?p(&i+E?T5&;~W{AuT zy}sQ=h7sRAM3xcXJw*>AzTL$TBffiy-bQ?Th$D^o?kzsf(d+9e{*qf}YTrI$!%*G6 zulNXWWZ)osFL86W&U=fe<@J;7`-vZo{M%n-81Xwmj5gxuiKv{PbbcSP;xOI+fnu$^ zev=**@Y&h*5HUi4PHla(syo70c!L5+5ek$n}NzaPgU3Ux?=j zA;*{a2r)#CFYzPAWI4XXj}k{_QkRI26a{j8i61R;<@gdmMw}(bm-w+_oE%@`xuRH( zFY!@gf*fDs$BDD$_!1v2GLF>iA0x8ldPMfI;s?3D5FaOYlj}F}&&u_M_$2X}TwjQvB%*SCA)YTT$k6?t zEN08~h3u2XMRI*1K1Gzv^@aFUaj9Hih@T>A zb7TINi#z1{Lj9`{&l>YrJsqY#gq%VG@_Wdc!FZJMnT!`PUd(vRIaRh7(-@xLidxxT z;^&AQ*jxEycdbz;06Z{qXC z0y*Bq&lM}>dPDqQVv!tg;tRwox!w>zPc+E!CVsxSU9LC8FA$f@@g`m`?vd*a@r7cA zalgMvtd;8x*)J4l$n}Q!VliK?H^eUzBjtXP_{HLMx!w@JMC>QmbK(u+D7jxGzC={W z^@jLTu?ztm#4i<3%k_r%GV!5YZ-`$eGUR$r{Bn^c_lv}@5af-%hn(3uh5d2~X6{3bD1<{R-(n z?tkwPVVQ4aZx#m{_rG_FQ)Ir8{Vq|1i2{cQU&6Ut+%EHt_&s8?%s1lqir?h*jre_H zFPU$|?`Qc|>F7rY-XG~l$T>%+kdM`j*DxMuyw*9?$hS3OtdVaIh=`GIYsDc(zC9>T zGxF^rG0(`ihs9k+zC9vZjC^}k{3++32Q3rMICB%i<#=-(C^h_MjA?`d(%E zHjj+*d&sF{d_LpnGX5{d7chRFQ*Oj#i@4N?$7^DeG5=l{Wkx*S5H}g|cvGx5;_;Sf zH{$WO=w{^GJ7ScPZ>^%xn1Anz<^8D19()MrJ+VgakBGl7n&keH_y^*VZXkrigD>HH zC~h>LKZz&P(W>kpi(BRX$b&NBY!#cjpjFvF5qBB+^QmZw==RS<$q1c)E-vnahQ>BZ6a@9UH`TCm)w7%Tj6{ouH9R=e=A-xt`FadZ;bi+U$LK&Z~qfV z8Ts}-%eM>2x%?h->KR|i_#(zHWPCB>7df}ce8X~E9a~H~dBl|AyP3H3`cc#oYvPax{nQz29yAL9OgLoJBHJNY3ySiaHpNXft z2g>!0_^$3LGT(@Ib8BS25#P-{$cS%-J1Rr3Z+Ew!5#K%Bnrj7+^z`V zAilrb&xqdv?sPd{$?m!5%K1vXk9)7Yz7jvseNkRti67)XD6g-?`?{~m>nrht-N)qh zmG~j3%4$uf+Sg&&um7@x$EDBYp#2iVl4b!OuVGN62Z=DeRw?Fus)WOBr9r_+`!ya=pm~3p}54ca!ZUKG=O- zt~bQ9-FCU&5I@2_NRBu0A?_$S-o%Hxak<_QALcHX>kaYY?z3{eA)e!YCf6I{BitTx zyon#_4w2(c{3y4#9B<+y-6Q3A6F=HLP>wh8W87Rh-o%e}Gv#;_&vnPi@g_dX&649y z{5W@l9B<;I-5=z7Lwt<8n_QoWk9A*{>kaX7Zo6D>h#&7hDAya}dG2d+y&*o{4a@bM z_zCWTay=)0qI-&5Z-`HDYvg)Ee4=~1TyKa^ayQHMhWJVDadN#Op6|}caQuV#$!?xp zZ-`HJXUX-3_!M`NTyKa^b<5;>L;MtXs$6e~Pjjo~dPDqFcW)zp1@2JK@ei_}=61;W zLi}{MhY`Os+;@%qo9_N*YUx?z6`HEq5D?_*J;K%k_rzm2ADa!qJbA)2LHeZ?0r~IphCkd(uw z{65C-XM7Fg4=}!#@dp`yi1CLRe}wTz8DGcvV~jt}_!Epj$@qH4pJM!J#y2p&k?~E8 zKg0ND#-C;UImZ9PcnjmtGyVeOFEaiT<1aJ*3gfRbzJ>AE7=NAdHyD4D@wXU%oAGxT zZ)N;l#@}Q7ea1gv{6oe+V*F#qw=(_-YYL#Q4vQ|HAmMjQ_@X2jjmp{s-fKGQN%RzZn0U@$HPmmO(p0 zj$qtnJjA&AYZl}Le%_ba)lYvbdnaa(Fy5K*E{u0&Je~1f8SlpUZj5IzzB}W4Fuo__ z-5JOKRgyeHP7lWSX1pik`!K#QW6ywJ+KAQ0{jH~~hqWUwA*^g&DkMZ%0pTPKu zj89;EBIA=7KZ)^t#?@b`Q|+J3>{A$@%J?aaPh%U`k1{@!@gl~H8ILhOi}BfvmoQ$+_}PrlVZ4m-a>gqduVlQ6arM`ARQ#%$ zy@v5PWqcmvb&Stv{9MNW#rOio&tv?2#xG#Jp7Di@FJk;c#uqbw5#tv#ehK3Z zj4xq)DdU$izKrq97{8qHD;RHN{7S}`GyZSJS1^7R<5x3&4dYFWU(5JP#;;@idd6>H z{6@xaVtf_jH#5GP@mmOa#@8_Z0OM;J ze~|Hq7=M`YM;L#U@pX(p#`xomKf(BujIU?>DaM~>d;{Yf8Q;YCGmLL${8`4IWBfmi zw=n)Z<1aA&BI7SH{xajQF#amzTNrRe~at3D{5{6sXZ!=k zKVDgaK`&HK7jEo z#`*i_LCijw@odJAV0;MULm3~&_;AK^7$3p-k&GY3_(;Z&W?cRD2o=v`nLU^BQH&qQ z_-Mw*Fg}*?af~0&cpl^989#yX6B(bt_(aAhF@6%``HY{;_+-YXFg}&>Qy8Dd_^FH+ zFn${2r!#&AGlku|{FJycM-Cl1Ipy$#@at#f--opT+oW#!DD4W&CW$=P+Kz zcsb)0jPv)wRm^@4d6q=raoSPcVOznZK`?{SC%DN0KL?zh+kd3dT__8mN=_ zT`VDtZp7(mbsYSW3sLJszfVH`5|*A=ektjDBVI<>Lwp(GzKAa;oQe1f!u=695*~zj zG2tPIuOysN$L^H?Z{%pa_ifGSZ;fl zA(mU-M#OTvy8^M?S~nq<+v@8P%PsXP#OJ^_IBtb6A#dfH5zE`Sdl1W8xHX97?b}0$ z<*nj6#PT-rNyPFNaRcHC_y)&j_!9EbLPPK;u!fKgcutO2f7gQwP+4vY&aYv z5zE)3xrpVf(J_eSYtRXZi%6f3_&LH;5zANk1&HNq`ss*qK;W2xSia6LMl4_5mmrRk zrV8;Y!g0hm6UI;qOd>ci^kOyPdc^WaP!=P;jmnoHo=&(C@wtRoApRHOCdB6xz8>)c z!mALUNBCC67ZAo}O6~4SV_QZ@jBUx47~3*dVrz^+^9_j|s0-%~mWKgvl^ApRD~ZzqW7?r612Db~N8BCo9};69@hvo# z_Xdo<5Mv*^N{oHnUt##{D{(rM50E$mFir{IKj0jRdjigtI1}(`688ptw!|Lb#S(7? ze1*iH170a{8(>@-&_DL6Sz??%_*4nYao*z-Bg7qm-;{V8V0?0e<$3UlPhAk>e8MLn zi1XnSmr=x1;S-ly#0BuVP2%bBDWD9?F>ZJ_jd%v&t`cM1@Gce0F>ZJVhPW8Y50^L- zFy854d4Iro*MWEtV7wzhJOnWA<`H8oaVL#<_80ORkYMBE?n_Y(I7 z+y@qPRX$kaK~O$SVmx<@#5sUxOPmQ94{;j#1eZR>9E?beb3I*RoO2lx`)jAfnGiGV z8~V8bF!l}c0?>OBV{EXkSdMvxbtA^{!Tun|^&Z=exG!k%5G$}%u$Cgeif|{u-Os>M zm=~Z!j22%b_YZ#i<=%J#*t+8d2M+&w1Q@l|@P*~5#UrRL-w$4t;DE3>-3xu_;N3oA z^n-WKi2slL%p^b8fP?OU(a&uX2l~<5P)z5(iQ@x*pGF0z-ae1df#P#{k~sIelS0~^vYmdLucLONFCoW$cfj52;2Ru%+W;rp1{m9x2VbZ`e|TGh z82v4f82#ZPZh^#y!;jUig#CKu9PEjj+o;?_d^=%mzmPZgIf$F79P1T#63$0_7vUL* z?)b%Z0Z7Kz6Q;~r5wP8hGRLOy)RMEoR`<6cCpC!C8IHwbXx{z*JdxB&46 z!nh9*xN(33ul-^ZVdUZ&!V$!{p@1U;u|5{hQn`oa&k-Jk_&*CT#~a3f;e$iUHrcnjfX#IF%vgZOpA8xYF}FD;1Qr1Dn8 zxCw$|D}0H!3AZDDhj0htR>J;Ryi3?03*0op;g7}pg#EGjfUrLn9}@P*;v>TTSbR*_ zAB(Mo{jtE!7aaard`cL(_>6D_@#lmy5bI;{1(kbPjvF^P1|gOYp>hznQF$KXuLi4aT#xvFgc}j##t@Ds#O;Ke5&uAV4dNdOZ$SJL;TFU{6K+NP z3*oJZe|J7Iq; z{3{MTN5Z)v@aiMS!X=Dc$X|LKK^&&?48;0a;N}+&55B}Mga;w+L^ua=gm50>&V=(3 zcOg6jaaY16h|>wzA>Ng6J>qVJ8xikDxCwCv;bz3U6JCRO55gM|?@71?ad*P4i1#AA z6>$&3?TFvDk;OKNkBE_Q#?ZVSg-o6ZXeqKf?Z4>`&MqivtMzW8o3@ z$D$A6Djb&s3D+Y&h;ReqzJ!|)A53@^;zJ0pL3}9Tb%=432}cX!euTFmK8)~I#D^1Z zL)@Qm2V%U5!2?o9WD(9lJdkit#DfTDB9_0Hdl2GmD$hlH1mQfyLkJfj9!huyV!TO$ zqYCkG!gYvq2sa=eLAVj|k%U(vK8kQN;*o^cA;z06I5r?YhVT}|#}aNuoJ+V3@hHOW zh>s(T=Zn#VBZ$Wk&Oofsg|SrbVfi@1gAgB2I0tba;XK6S3Fjj|f$$8(ClW3}Jb`c> z;)#Uo5lVbvsf1e*pF(&m;%S825uZx9191W2 z2f}!mAL^BD@CiY{Kghmk@42TuOKg;bJD3|4gfkFV67Go@ zZ`R?+M0^h6L5Qmf=OUKBY&{QgoXQIj*AkwAcrM{8#PbN(A+96bfOtOPM#Se5UWNEy zgqsn=-~Yj59pdu{Z$NxL;Vp>q#uJWK#Px*R5HBR$j(8Da)QJlTM-VS2oPk)M3l~wj zhvgR&9)$Q3!a0Z=2a0GMXTEZEKR}%IRUq?6-@%4mr z5Z^#J7x9gR^AX=fxB&4g!X=1rCR~MhHDPE1+(!_OAikAw24a0IZliJ!%Wo$<2=N_+ za}YNZ&O>}B;e5n*5uSngZo(yq?;%`=_+G;Gi0>oZi1>cOO^DYJZbtk7;WdcY65fFL zLBcJFA0pg}_+i3Z5kEq>9r2@tI}ooU?2pA`g#EF2oUlI@PZ0LU;z`2(Sga@PkHu4j z{jqqOus;?X2>WBPk+44&n+QV_;68$I1o39V8Hn|I^hk7-yqzA_)WsC zh~FZ-74h4I+Y!G*xC3!3VSg;%CG3yIdxZV5c%QI879SAy$Kpf6{#blO*dL3J3HxKQ zm9Re+pAh!P;#0!V1h|hN96|g!;S9w3SbRa{9+rPeco5>R2PPiHI4}{ks{*mwo#6J;kLHsk}R>Z#$-ir8F z!tIEEBiwET#|_)x;@5N8r@L5vUY;n;%sFv43AA5ORpaeu-chzAgM za4(TXI0NxO!aWfWBAkhMFyTRnvkB)SK7w!_;vs|!5Dz6h1Mx7zRfvZZu0xzdxB>A9 z!i|WJB)kgoQG}Zjk0iVfF}{?5V*}!22ya1rEa6tfxrEygk0RWT_&CCNz8Fn7f_Mz! z48;0e7)#|ImX9Mm2=VcRa}ehd&OeTJ@l?XCh)*HB74bB}?TAk$+<~}&a0GMXG{PB(Pbcgl zK7(*3Vtn}nM-JjM3Fjg{i*P>TLc#@zXAmwy93@u~aHpFFwI}n!>b}%<82xlO!B-|5m72!<8=MWx* zxSDV-;u^wvh~tC{5Z4l(fp{+AD#Y^$*CDPW+<b)7Q`12Zbe*AxDD|_!tIC`5uSYFn4^adIC#Ib(3GjuPCcby!o-vEC!IWYT;BNO zPdMh-QOD(u9yWZ$kvSu?j~J3QaM0kx4)1@+p_%;-JgD#f2Y7wc>Cct&g%&%#eFy)0f4uZk_=HSxN5L%b>85^sxlM5}mL zyeHllABYddN8)3#ReT~o6`zUE#TVjB@s(&3UyE|W$v>|WwFxJ%rn?xpTB_cHf#_X@Ysz0zIo{@Y#QUgcix zUgI{o*Sag+>)h+z8{8Y+o7`3I&F*UV7WY>7HurY-4!7C8)4j{R+r7uV*S*iZ-(BNA z;I4BYb02q~aG!M7yHB}KyBpk%?k4vcceDGf`<(k9x5a(leZhUveaU^?{X4WGbXDl;&^4i^(6ynJq3c4|hi(Yn7`i=lN2ob;XXvib-JyFz z_lE8Z-5**LdLXnm^kC?r(8HleLXU>lg&qq%9(p45WN3ZpsnFA*4WW&pO`&H(n?uir zUJktydNs5q^jhfk&>NvQLvMxN4!sj<4ZRzBFZ6!sgV2Yek3t`ZwuU|leH!{K^m*uu z(3hdFLT#b1L*InH4Sg5-IrK~D*U)dFj?nL+KSF^ho22U7yeJUCH#E&h472vm%=ZHUkSe&-V%N-{CfC}@SEYc!f%J) z3Acvd4Zj!uH2hik^Y9npFT-Dj+rnRmzX^XE{x1CA@c+W!hugzHgntbG6#hBO@ElayB?eerM z(i+pQOk1Az@3a+ZSEXH@c1>DS+O=sb)2>UqKJA9I8`Ew|Ta|Wm+AiVJ@+v2*I#w3V zipT2WS+Sz3!t%=E!a0>Q%Sz+tN)y0Xb+jzST0S#Y951UWEUzjptd2#C3ul&AM62gJ z<+1Xjs`+qoWpOkf&8h*f*+Yj_4=$XYESy;#Ev=}ktSrkfg!-Y`gH65fdFZe?M$2V&sfAEoYN701T_PGO9Z#Cjv+P~6FsV;5$(CT7 zlX@(a9Zwb}oyd+SO{kY0Hw&TV*d11wJtVbIcD&Bf6JmCCRRbVbn7GrLu6x77xkZT}{l>h!z(YMrYO-qMDM@S@FW^ z#F+Sj^fMG^17&S8WHf|H3#w@>l4VIXxA?yO>`bb$jK(Ngmh?bFl(e9lM#wCq0b*tT z_?TrhJjpVQG){7ylye4WO%Af4n?Q^23@vKhFz7HAWwDAx=!$Bq=f<*!4jnwAuqs*| zFRYwZ$c#gV-SSeAu< zuDK8t@E4wE!qw&(YF*rjm@OFiq6gb$G6|qEH&=pPES=F&* zG0OY`OYL+@S!J|XwlAmwDI(PddDThQtvO0u#Zt~zRj|{L`uSRuRpeyV#H-`cneaKk z-2Y6uf`QGlJ|r#4#7veY(~1%^X-OugSw@MOEK7Qz#7tU}iD{NmVzM$nG0iec%$bQn z#nCIOtd13ymqo4J4YE+zf-KbJq{Z*Fe|=$Pe)G&SYMxm}Yr)jQ5rwB&TWDI7gJPB^ z!%D3;t;xYjEvEr8%ah)y$EGzoP^slKSOMjJL{iHsDyikF7ums~*@;=T+BjQpc8Wnc zgtb0sD0X62^%-aD^`#ip$maxB7i2|usu{s&1zGW|Z2x*OwNO6`%hky1<*6gDTlFsS zay9ZP<#ObCxf*$1u6mKJ8}-V&;FvD2Ic0T%X0P>NCuGeJKVt@saERcsX@`Lc$OM@Uam%7FHd??ebTLZmw34v`IK@w^1NJ)JTF&$%+?LbX6?kR zT5X)IH#^0kMq+SqeSv0uEG*}#b{b}VG*S#|I1EFwLJq0lO0kK(ye-cc)5y?UY_)(!lPUD=4KvUNkU zSvxVSRvTyQ%}z0>kr*6YU!YkZ3(I+`orYN-jTD0#4#SY_xayf<)_ay>P$QCRQ0c07 z8C|I{Nj<}V)-tv5h#jV@Zq-AimnS=e1olDmW?SGB&(i zg@%`_US#WrWV3c+R;@P9)|;JTNaSO1eSv0uECvUkr`le7PRxl`>t`Fy=7vN*>V{-}fo6Ry1_z&~+G&{e(MU0<;V=xz zhNzwyX1!-A1~nq729>UQ)6tb0lhiY0x(?o9y6RRVM1f}|BBWW30I~8!e6;d_@Mu;e zI;=bq9A2(s!^#t(Vdbh9N9dhTHftwlHK@kfdb3ju%3=17>$8|ueTG@DFU63^|KR!p z&FE0Ib8zr^fo42U-MJX&p&>E+!46f=QqH5-98(KZ42cZT9m*!ad%=J+5;>4^hMXRQ zwB$(UfQpfB)kCD0C(lw5(ye-cc)5y?UY_)(!lPT!n~DxESHVdsm(zontI+Ur)r%u^ zL$X;rF{@S^XY0*QF(`-GJFd@SR`nTXy}lHK8r#9a^#z*Ip=zh)yg)OamzW-UeP~d_ zZ*i!4W|;M!r5IEOq#D!;8PEipH{772Fru(vhi^ENRy{<)XQ>G3Ry{zxT*XH(Pv)Tt zk8ahY!^>50Qp#m)c)6M$yj=AHUPUB3pKR7n%&OJK*?O~649X$Air7(o7PG3)FzfZD z7}Ut;1XdShMR%%|!Dj_o@hmkp^s}&Bjl5o-46*8yZq>WQ%hkxIl*^IlIJ-t*wIK>%xWYIv)=3!gQ^c+MeL|Pi&@oY znDzQn3~FqL1y&biMR%%|!Dj_o@hmm+`dL`6MqV#Z9eLfVcZrv)kxwa?BhSm#$n$d5 z3wRZ=qmi(f)kqj-z1b-SRUf>H*in5Jv#QT9>-D7=)YuLUtS-ok?o=y-&kC~QS!(3< zv#?x^yk4F<^14;;5-(RHpHePIo|mhU=jEyw@G4?QBVjSCkuc19vr`Nz*6>t6sJ=im zI#lhnoEK=u^VDb<=b=Fjhhaz^55uhYEXANkB-J2?B*mb{B*mbjFl2`@(ye-k^zvkf zRD^V^9w1(>;-i-*y{UoMt$K8Lxe887xr_}jSE1qMsu%DoA}D=!Vpgp-&eofqVo)Oi zPxXW93pDFvVL4B=(=h9!kz!E8VHi@!!!YYTOEIVsNj0c+)w_(Y)R?56k$A(gqZl2b zMNkisUY_ibijZ#A1H{W!eDw09H#P9ORgVrYSHVdsm$BjHDm1)Y^#Wc+1chcNX4Pur zY`xhjhD1IF*B5Bk#{%94?5LfFSs#rQgBlLQkUAcQS?^hjL5)bNL8YtSbabW0B=wBM z8;+p9su*Q!kJB*PQK_f(3c|e3Ts}Uepo`{cDp7fRok7h-0 ziRiHML~wYyiVZ7Igoc%?e1umKL7~}+S+&|YTW@xXK{ueI*6T|#sIi6j073Nyn$e+Zr{%mr zGoF{29(sLfP{VI=sCs6Y^`4~|R0gCP)Cw8U1oegkV}bu0Ddm6FOf?P3OpuW>&03^P zL-ITsDbuV)D%Bt(Wg3zWWu#2A7O7N&j8uSuB9&^8vqc&b|C7o8uX^ww=4844|CpG` zJOvtHJ0)r2rwp~9qDfNt1aBWUK9zq{%!5LSs86X);go<8M1jH?q@kbgZXo zM)Nd(>};p$M)NdSXl*B<=^r0m;g^ilZwR7OnqA>scXaY}_!SubF&%#&1fX3cA0j{1 z2mPi9$GH#$Tz8Lh0%D~*A9RRwrGqu_%Sf7_0Ds>Fwg+wadzqumAO5Zm{JTf$Q2wSf ze|aCm`A~-bP_FznOMg)89|h2Vy)Vk&EzIB4&m8A^I0OB`DG7h~jx_tb42%(S?SEJP znn8y+SK8XaUr)g3uQPnA_FcvNtpI=eUj$YD8kxVy=ShEEHGf~q{=$cU#Gx{bt2&gw zPgs9F%^&{l6x88)FEM}h;BUEdCUr>v!~ErdzrIk8{oPIK(BHYNzumh8x38A^e zf7iEa-%RGu1AkGdQyr+o<4oqSUh}sn*pyIaV{3Z(Hr~?f=|qs{oqsex19OQ1%L8S z0^w;1et<_Wd0obvTas%-;s^7Zkq}nZE|DzkM`+!nZFK8`#xm;+BARtG=DA3A0}x~ zzC6SHIbSC8?{Ljucjm7<_{#vhI#mAc#{BgJe|u`6~l|&}6@Tc)3^YyPEmC9{lZv6Hp$?-<8Z? zGx(bU8tm^8@TvT{yO{I$Ay_Pw4|J*UXKAKx9q5ijfjpEB*Am3JvOMw?t*2P;FepPC z#s%jTHXEwF+&3v41FksL}n60e^W= zhV8?@Yk@ZOHz!2?px8gsdj+@e(oUwXuSJJ{E)VNg{zh7KuYg9^O||HLgof(6GK=mH z=#;Ko47z$OkcW!PFQC)ovJB#~40ITmQJ__EIhDmFyr1KE%9+$5oyX$>Ivh)NsCw5z z9q=y^mt2ePG0^C`=@#8b;8@qyS#+PUxU2wOJ)S5J)xHl{TzY<;j0@(CiVObwf4$!B za1rv9GpR$`i^XM#MK>9o>Hel#bf&@fvz4;l!uB-8H>xU z-z4L55@=Oi`muZ&(ud|R_cxx!rP!id1Z~0QsCl%)qFVwQUANhyTf^e=vqg6&i%Z`F zp#tceI#gV4WpNqw9jqsy!+A6f#40ZME2{PO^*tE=wv}=wbx0p$aVfFr@UPbE{_e5p z{sy1AuHB;Z(oEfuLxS6veUz!I16@#D27nIxo(o@ijQlAFVHp$~N^{0ocU3X5(SjF0ZG$x`ppAkuYfEV}6|ek~T=c`SZgL069z$V2s` zj>RwU$K-sAfmX#2e;u~oz8SDt3R-vTS^O4&PSu4~EBpzIU%f@whsAHPrQS>yzf~4p z9*f_Tp!2X{@=)z7X7T#~bV2beWbu3Rr)2!f!KaEJ{`z!1e$!!d=&4Gj4rv*WALvw@ z(5~>yJbo5kI**^F-aT3TZnfx!u=s7Z=uTwu`y6yZ@f*kDHv|4~sM;UkpM6&G+l|Gq z7&gNm21FhzF8j0iEw<BT8mjA7Sah3M{5FFw==!mq#jma-dHuKuPEql@fW>d~(Bw4- zW2oXcnZ+**Hz&C$kcZOU#Ns!`qWgfwZ?Q%98Ti-Zve}~Bh0Wja@Zk3C$>#4E&;`Y> z8=Jq2|4hd3GB`!WuP@w4>FpaM<1WLJh~H~akFLuDUC?#bg3M zZc8sy*J#m&Adhr^%@$oBxbM_;8!Wo1uukZ@R*SB>hpB6~=x*z8>LM^cLGgPA9#-o0 zdKTTUuy4?HITl@ac;2V$@-4b;hnl()i*DcDOkKT2=fb{FueZsf^L90LYb?4*UsKm& z(H+v&)NQrsx*cfhIxM>WolRW^JfsO4w=E+~U8Y6%KhM^Ox+-h?lHdpfewZ;aj5IZJ8b>K=hi{Gm2CZMu;|wHGTYZ|(R~a10lmL1 z7F}ny{et zS}Z!3t$%G6-8ToD^+t{jj$eeWf0-6t`$49^Jd3UyTmMQdx?lU4{u(U0?ri;Qw&)&Z z>tBmS_ZCbBJx|*#x+b>%MRJ4V_sD*xzf6m6K3o6tEV^sh`d4Dny};JL28*t3Z?k>P z7F{p4{?g^)E6iIDSjn`j=_ZP2}sJMK@=Ev%e)4T^3*eEV>DN{j=yU z;On17cLTc~wOMpq*my*a3y$Ca*mz`Gbba{xXVD$Y*FTG{ny-HrT_a!rEV??r{#kTa zcQePg&7wP>uYaS1<99vW1Pdp5f1YX4E#~W=MYp<(>9541TiVCeHCS}b?7p$tqC1|i ze->TLGwW@$=rZ~GHzqiKtAGia6fMFOn*5R-3+$=l~{D=v-PjZq8r85zZQ$Gkgb0m7Tt2T{$-vJ+}|~9 z{VTBOK4a@&gGDFUeq)_QH-zo~+AO-sZ2jwbVsJm)e&)F4S#%zoZ*>-3gw3~Ri|!CM z-&!rYZfw3qCIt7RKbvnk7F~BX-%2dH>@H?pnk>3^a!g%|Mfb}Armn-HTQ}6yWljw4 z@7ujiU4cb+ZMLavu;?CT&kxpFblEV}+|{`Q<2T<;0HoAu7H=(5@TZMNw0cQgI9TXZ>W{^pz#+`egS z{?=P`$ME@U(M@ObH)C3Gy<^z?EwJcjviZBpqKh19#-+`oJA~~!2b~(+zORRw{^~5c zPV9bbgGKkk5vIRLL2$ioZ2y;U(e)Z^`fIZ2M)WjwTP?b>EK`?xT5$W8?q%w#EV}iF zo4R!t-TQl(I_LD@dQao~KZ|Z&hUu@-qAO(kzgCOxyl$pH?~LH~#n}F@#G<<}-SoG{ zqMO6^e;pRx61M-#ogUo2tPy6t4Hn%5c7L?RqT7wlkDg}+*E@jSAI-4n+Oy5}HCuGu z_BD0w7Tu^prY`5K;Pw@={a?LBx18<&S}eLX-OYM43WMwYj9otpEIPsF$102NYj*u; zv*P{_SIQ* zlUVy2ExLt#{#tZ5?PJDegGKi`+yAv%bnQJ%f9)3CL2Uj;ii6`fip^ioqKmWnn`6-} zXZyc=i|$-De@iU7Cbs{px9IBG{B5%6Ze;tvH5T2)ea$$xSai3t{ohuLZW)`u9TweP zZ2y-L3m&&AN1E-+wCK+1W9o7(x*@|&U4cb6neG3oEV{jhnEo0px+8j-x>Xk4EVln! zXVEQ&MMA(T;mVa_i$(V++yAv$bZ@c!pEE0XJRmTU6#Ojy) zIm=Vn`d4Dn^@DA|4J;n>1_RLu;|WZ>tC})HR;> zv*?zw^{>RDi?j8w!J=Ev*1u+p?nt)&wODioZ2fDq=z6jBFH#yDzY%Qx%e3gWvHRaV zi*8@G{*_pC6WRLLVA0KC>tC})cOzT>S}eLJ+4|RJ(S6VEez_rpny-Izg5$S=uYVTZPwaY>XVLA>*FTGH z%wgvG(qPfeP>_>@3H=VD4 z7Tvj>O@GZ6T_3*wS#-zp_0OVn`TAEL96yh*e-_f1v*;%C_0OWa zh_8PZ-7S3mv*_MF+#I(^MR5FnX3sY=ExH&Rk35U+LN*>H7Tq|$AGhd=*?2Ttbl0%) zXtC%XX5-Oj(Y0l<_*DkSZx_D)S#%@%oBr}Fx>MQpsKlaM+RyaYV9_V3Xb1H>838zqPzYeQJFCl~{DE**er<(QSyB{+cbi z8SMFPi$!-n+%yTeZ&LSzZ5G|AVWuu}PH_AR+4J2@i|#ug#+ShOK`+YlHjoI$!@Rx^}ky z)me0{Z2fDt=zeAEU#mse#MZya+~9sZ;+f--W6{lL>tBgQcMV(rnk>50k1*?PvFPg9 z`qyF6-Obj&%z456eV(m<1s2^lw*EC(bo=gQ_G6tzH<7J>Z5G{}JxqT+>w^2yi_Nz@ zi*5v)Z*>-3A2#2bExKdbd~3Dn4rTK#GC#Nt*U97X;Vai_PCWi*5v) zzYP{$8QcH0SaeH!u=dplw{Jb$|K(Y9@3Z}1gGJYk&EFP_u0NZ(1tHo<*0< z=5K>Vw=bK&Ef!r4o4=7o!R_#uEC;vVVJ3FvFO_NGj);0!R@=7?f>#Dy65*b{WVy0+t~H3#iHA{r|BYv zvgb{C7Tp}S|7)=5Ze;tv7K`plw*QM<9NfMm`TozMD`5M-28%A2?f+UVy0h5+FLFt6 z`^Ft?#yQWTD^53c4Hn&mgG^nEMRzva|3w;t+qWB^9~RvJ&#bq>qHAZ@w-$@88=oIb zg4_2RzkXPB-}CE-MRy>d9~K?{zGvYipNB=32Dh(<@Bb{iE7|_9!J^xIm|1U&MfWMc zeq0*dz85l0e|Z*N8^3;7bXyKF{k2$h|Krz>Wx?%xyRYdl&!YRetEp?S=sw`r4~y=P z&ZfV}Wx?&ciS7ULEV}gvnEo0px_Ul8EV>)n{x5QQaQjXOoAu^_4wkyafjNxFY^Ey! z9aNDxlx{z!i-RtbP$l=1A*Nek(S02<+qc-Fo9mJerl)@_16{FJFSZZA7N^mtGPQ$F zKU6=qfG#v)dnMTF(cbts{5%r08GrvN9!j@or{o;Ra`d-hJlPvS5C8ml4jepmsHYu+ zQZSVa8#2VV43(drH>1l1V<(IgLe+@A&q~yfbw;EKw%%}L!ry&>g0VGK)v=nI(pg?n zS+rudH#b&YQ(9T!We>_4oHf|XEQ!afYK|N@aCT|Dq;_UjQDynSm^x)(S=rq30aewN zXUB@-S)lO1G=R=5%pR0IbWl$Ah<<);`nN2Ngq~L*>>0 zt%t)#IWMkG@4D&criI(LZ;dz$9p_#bKKE;kvT+Ix?0Y+AH(dFi#MEg4@r;ZLzUl~!+b0jv+doc3WSIJ>;dw7F>$(#AQ? zdEv>UMrV&Yt|7ZehgiGuxb*&`{C0;?Gc0tkyS~%QX+FCx$AQz=cS%q88$+(1 zbCRUTm(J>q?u4#Tg00+TzxMQ=OR}G9+fI#xekiTcgJBCrzmpq|>roI%?|jLf^BPXh zZt1&dRsE7taQ5JdozLrh?d}DkYom*v`MEi==$ZD0$l8s)U*FjCu|6%M{5CWU9uT=? zFEOCgw5!9d(H^_Hi&kx~e<)+q#@1c{HNAJ4!+DP^@-FuB`IJqJ3 zJhy50OZu)#-(~i4cjo=itlrrBIpNH_f5XMD)7)q6s`_M4wD|s0h~p4BeqCDi{hKfD z<%|&HcVD!r?~*?0dquZzPY+#|HZcM@vWs(GmubVp4aeQy^N8j?FQ?rQTKmGbwytYm z=xFV_KJ?YmVtsl`m-PL=>McGDt-N9N3*EamyxetK(_cMKbVhbulhdo$;^jAsYgVj< zN@i|M_hWzWE*Skz`?W(sde;f*n5$Ui=j?h!Smj@8EYxTE<0r$orQrZ~^2=VvYyltB z&JHOJvZXFoL^YP|tJkZO5*4TfV7xdY3ypFMl4| zKdoRp37f_GU0QYr>A2Tqiu}{i`nq8^hgWYLliq2 zkh5vdqE(BRE}Yroym)(hCz!(PJAo3rD4f+_48gw%)0P} z^vH6sprXf!-?8|6<%U|2-l@mx-=Uw+eVUwS{qF|by`h(JwHTj(>*#rKn)m}2* z*s?vGu1=xUV|({-x;cf+-ym&#(BIz7|5H$=4zy2X=c`L7URw8XdN^;h^EK+Xw^Y_Q z01SIL`#ZmC0`xyhRh zTPCNwtQ&5(eVowCw1aK3(_Iw;7BU@tKk$qf58VF?nHK4Y(HR`r2C=^n{lA?fWW9bn zaAr!3_27mb^;pkBiMzum9s)ZA2X?8uc2go`U;H-9Hk^(c zYzQ3J!53oHP36be%Q*Xe^iWN8t9bf-l<~)QsQC0mEMtNnDkdIc8I!(*eVKw@m;6B1(^Uz8Zz_>sgO zeEuRawsC*RJM@EX#KXuvc+P+a)-4Y5p+7b%C;j-yaq;7W1#tNBk>ldWhtk^dz$W0? z3LbuZz(2+S>lT2qI_y7U440ovy8?g%!`dA%wgt~cjPW@}VvNZ+iLn_~5@WkAkQm$5 zD6t2her|vttp8?Nj`iOwvEO!#4`@6nOP3hy$3w-+pGR`9-OVYFl^0dbSNBi;pA_}~ ztYZ1hSaH0prcmzq3u|I!vkLLr#s0?P4s?l|F}v5&iqf4q^d+j6^5R0`vGST&+|i2R zKCe1nBO4dkgW1t|NvwJ&&6gtGaV%b2wIjc^RmIVGtgt*cDt)Je-^~6ri9%9S5-p=vl8K}DvQQvRaTc5o*S#KEIl`-_f}O& zEoa?hMy*;Y*Gft&W>pr>s;(?AjL(PvVn%BaY(ee27IeD5 zFo;z9aOqe6&S(B+fK7k;ggQLtGk?7`f1Sau{Hed~q2jj;Y=@u&c_@F=pc8sO9s;|v zp;Y0ML4-IL3*i_7^-}9I z`vt}Rq1yK&FvPijspGVPKkOg+!)ved_ZDE?Up)|c$plNXeHaJb-_M#q+}L(u$viTP{L{NXyI{58q($c8dJ{sO~6 z1pV*WcKkX+eyZ4du-F#+3i_sW@R-imD-*u!&=1t%(FQ<&{=5R(hc=8K9!l2;?Srl) z4)m8VW1!}F23Q9U9zI-qow4)h&;S2>w;?x@Rh4CB0sD$Xgm(^(1_=yH;#dc0VuB^d z4#yC`)LJw|(;&ng!~?Ihs8hLxx}e;`aaMT&&}qVN+M#S7lz}D>x@-bS5_z9Z0!8q#^9XcLvs9N-1)nW1=t8UC^ng}rVFPYo)^}CzkT}! z_#goecs}nfoN?v$?Trl?S31th27s50=vsf#C;&^BWJch5KE9N=z}b$sh=#sv!}3+} zOGb2t^BNmgC8Q|x>+ym1t$rTfXObUP4E6VTvvYdag>Xwrk1oA)X25gI`q>#hzQk7; z_jcMEaX#$Q<7H>#_U--y&h_EvTxTOZ{=lc5>%;zYXTX>AmUVL+Mc$Ej^-s%mx%CohSUEb5LS?r1SmSM~~0X8#~z>;7u)wd2mw- zuMK0x-mF+OURxdWN^3m074o8U;pu90W?9Th$d8K_d!-dswQ;X1S{*Hq!TnWD(mKw6 z8tcU?y=YlkWf9!Zd2nM~Sv@}~8SkGAw|Y^psInp+Ev={lhjXK4rN!W~xVRMFd`2sv zk{Yi%hHo=t#mSS$#EPotSHdmSxE2GlnDWhuPcC{j2 z3XQ?j=y|c13HNEOxaDI$Bm#3%9Z|%Bra~5c^o%lwz<(O_>C5r~LtyX@mE`(KzN) zQDt>C3}M-P*@RJ)71A@MhUpQz<3XtBRhL5YK>ugK^LF!qo! zvtt#p>S!EJmfapZI^QxNn4z=a&Jp|QkPN#rvv$_3STzoNyt2}(DTgFRCAB49sVOn( z;33Wqrc8eiQ!J4&*x2Mr{#$c3%W7(?sw%57&yy{I*XtF=RP-l^6ioD|l$v76td{2E zDGoBo)exG>a!QE)UQKOLi3b@Qt15|=L$u1gIkEZBRDa&e^T(^%SY0|7XE1a_CJSh_ zHp*xvW^oiNfmxhv`z*M4R?dSU&72P-1?viCiS%$%6%H0Qvb4g3A6%G?Kl{+%E5evZ zXT!4K&4ZtF@CUgD)){@Kz>r|2r4_X?XX2QDyoUMGpy_F3gRdHAUB`Sgw7tTgp4Bj> zi8-xjYW`SU3no>12ueT$X@!Yd2|rJPAGH<54r%Z^{MZD#lhX%>r>=@tKGN8mL-xs2 zMtS3>sq-OpC9%2zGz(=dr&J`e3`g9HRU{VDXxZ#am~18GszGwtQHF2T=2ce1M2=P* z8i!@iiry zUP-j31OhWqYb`tsommP~11BzZey1avelbtt zQ$yBH`53M6#*Q8X@y5B}pZm}1$8~LB;G*U`;o~EJ_J?Xv6A~jFkHS@ZPlVFM z7-A08YGa*QSy49M!~DP%a_nd?3bQbg3jN4Ke$WW=5yv3@KOb=Pf-5a7D7-h=bhQ!q zN6kh*$&TxR(Ogjv$Cj0q!nUEvODw#pL7Fsv%2cw$zwb$3w^XD4Ur3qJQ-=Q2-l6c63blG_4fGq1*2#$rx7Ilrvf|R&a6QL- zVmn_9FP`}SN=Jr+Bg_X{o3%8R!7nbw4G3&kJ$$&YT?U{Lc&0flQ8>)81-a*3?KVS&EfBb1btvR^Fzyg4y3Tr-WQsHMS{19>%{!STB zg|`y_C+F{U-tM#oMX~C5=`7sV$BaespSEHw-lqCp!>B>flKYlKPlGkF>O*m*npK(5 z(LIe^yb`55+U%;~m=>$1PT)p}F7t`=F;Ub|!5HFQSxs%Mcp#)V-0%3~ig!JDyGA=U z2iKi{unv&y|IUpVojIiv?)&^?qkW@ST+NN3CEaV+%nRs7=`5a)2mEu8_A!p(k^2=kYPv<8jQ)GjC_hObG^ki zJ-Kbc48xgG7OkEQbF`wec6N!@47uUvcO$rykYzDAy0!Oql>fHp=t2W3UO1 zR+YeID%pJhqL|npXL(br;cD-1kKqn2RxQuRASLfEtatHL*-oz$Br{S|4ox}i(WB7m ziK9lVdj{D7+{V-P9}D274|k1tZwxR7`@~|crLbsJ!1k8*{>A@{jk|)Eid-9~?{mS9KVs2?M%oUL16vwvt zw~Vo*wy3NW7r*3sg6&eRhFg2MdBRgk2Dkoj8OBiiQxNWJ&=xhHG2kNw>3=jiPq>3# z!h?la1-7Xs20uDo4SRLiBCBU1xE6uNxCo;je-J#`mzDu#^=0cLy@T;YS0gzZLL!BQb&y-qEAH z(It3`2Ev3W5fq3u<*y3DDC|(;qO3+%PYwz*yk7RIVu_?41t}JXJJe_y^Z}kDQR?mV zG-#iUEaeX54Wt0vF3u{2?)f`>wc^v5!fHNc(s&tN3=p;fQ;yDnrwhrjYMEQ(&93wv zRpK?WsH_sNku)3ft1FA}C;9PmOwW2oYga3{G#5j#=isw3>XTf4RdAR$ zHc^DPSf(p{Isg~^IJO)z5f&=yW}?-w29?0L`!f#Gwix;jItT$g9jdLy4Tpcv0h34$ zLk)!Aga6flcObqAaI#U!7Q`xO2aOL4Vo`W3s1_ahBQ!NNWreVG%qsLxF2o*X_VY&N zj}LAUOarr7=vQ-<=ul?A{=tSqc)(M|tr%0N7AB4E%)hgPVoTT5IO)N~X_{yQ#0nlL zRTROnmEc`ob?NNcun{bVuE}9Uc`|D9L5bc3Y?u)mOH$BHXwsFGjgG=a7_Me?P%69rb)InHT;89et(V$%!>{N~@|Mp9Xqmv01n` zudI-dkW{^DBB`~|Z#h;2Yg2h?#lZ4toi`I7wnVE-jWsYC_=?zUnCbe%VHprP^*p$| z;M~KBB6nU=kWY_V{rgz``GJ=io82EqdJZ&QyBmbFi=bM#dg4UD|LOz51_|7hgNuIB z=_wU+DsX|OB@4DjiPZ7E=1(~>VN$1zmp|krr=+jb)>~X${AceHZ{+`;Ld}M2=xP>gu>5c;hgjrD~tm5qgb7+-EpZE3NAxa{L5ROe|3Z5 zfV-Mxq-AHv;7TX2zvZ=X`vpq~q#p*2u8R65O`bC<=q8vJJAb2rGm}z0s+ug%gbM?% z8Mv$@_e%bK7CaTen=V);lehS=enH;EVD0o5dDzv};8R-ZYjpBLAg_D){(uKqZX-(722)%#b{@YO7(vgEf|t4*zGHx}w&U_!$ZpoMKoH z^v=O{u&AWE5;o*;?MU1w$Y{WWLwI$A5uOh}@kk5EKWa*{ztL*A!vF{V+9_SY-bOx1 z00ZXpfLZujEb*{Vn~0;wj|tilgNI~eX(y1_;Tjt!m<;~^2ZTW5Ww3O1Ev>YP&d~lF zzQg_)1`7K~LeB*W zOdPOy<173<3*|CA#Gi+kUhqwuUu}1c_p54K5Qm|HJ12ODR-?C~zrKI1z&A-)nSXp(2Hzo1YL0~aCcG#nH|~J_U8%p6Kz{h~I7-QqCjVz#X>vv3QVRJrLe8V*SL5?0X5^o z0zty(_Wq4^d2~K*&}yQyVh~GpS%nm-fjfCv=KLY`YKmY7R$W>N1E^jTRm9@(_#YM* z7*V*s$D;6mJ&WOgE>_`0g)YEiRa!I0zbC>y1Kx|xg+|5kKZ}AJ$kZrY>FE7H{)ywI zn`D$c*!B41>yHBXgO@+l3%Ti*y9(F|!RtW(JrbT=4X;sPz@Vq6Rn~fPLGa%k=^G-r zGbvQ*3tO|q>!ieh>7zL_23H*j5&rlyb}s5?baI;jmxDw?XVzAf!Mdc4w!9JYYOC-{ zHBM!;}2K`sHY?m~cYhX4_%HWxx57!VSWOSNuRgiRC+@j^gplNco+ zD8yR?X%ke82rW{4U%b#aQd=)o8xSkCO8%eEoSDtplLWMVe@~zP^StxqWIr?WozHyd zJ9FmDnKNh3t;-x!XHTBY@hdC9khf@VJPpKr8bDz-?l*Czz*B?mf;w_qkFs;}RCP>^Sj?7I9FbeYEGPiE|w(XER)jsO+M zOrDVGo;-QlEt$8Bbx+D1Gd6wJgmDwbxMz*kwI`e~ZEEH%6K17Nn>{NtZQ9IPQ{7X> z`Y-Cbp4yzDNh6?Z#}mSwJ-f{FGs%(epAw&jD->+8QXhk=JZO(G>9ejMlRo+SF*DPD z^yIb7#!Q1YD=uekXP=E3qow6z4xpo_I|lB{PAMB{^&Z^tERE$>)2IegG4J{VGH-q6 z9Vjd(W(|yD`bQKzP_j+-Mw9dA16Kv(w2(62(v|4*3RT%=`qvG#nj`U!{9N3b20R$N zgnSXYCDDP1sggmC#3EdBZ=LTLIZ}15tI_r{=VOWhrOqU|Vl$p%0bPTO&wo|Ufiv(jy&D%%x$Fns zP~d74Dbn#{St*c;r$X|1b9*-)Dt|RsrT2n&%oleQx#CGO`%8UXf-2zM6mDb1Gh9a8 zS(t~x4LZskTrt&@s(b8AoZ1uQd@AoR3l=P0xMGnO7$I(E^2KthcH{LZN@?!&34u=r zjG-!{cKBvaO@=1ZFeZcnMZ6f=@qv)ING|0gHo5o*ix^hU=jt&{gke&fQEcR#vO{{& zfc+O=F-%pWW5vZoaN`D$)VPfLFL>gTqZg6Yt|ppQp>-wQ$QvDn6w@E1ab*^!Z~b`& zrby+@py9NaYIiu&8ui-cNN2nn@$>qosIq*g<<8f3J4=Gb9FbW0i@ zG?+q+rZDWp1zS|4HhKc~;ozzgH-_iJUaFaKG=T{}P5@B_QD)dlsRUDEX&fY4DK7g6 zz@HgtH!b2#AB zhp%!jg(K+|ST|~Xi#BFfdS+_+=}OjgF|{Su*Xbs~=ox1#Zup=& znstDfk`T8P;u(SvVte9Jcaty-jSl69r!ibk1Is@)J$)Ki8;|GOME~vXq^Gs+vUkr20rfm=lY_g`Oq5j2B>V93lwW*CCBYIcW?8Izb z+fzuFx@-q3$uPIm@yeYvJVy05Y&Fd)n`>+Pg*kY!MF-Duf@VxKL0tU(jnR=fR-PKh zR@*lqNryFL{9FN@MVe!zL%rwlf4~1{f&a6>|5@PwEbzZzf&akXkM~+y_5SgDR^bIy zgR=#^)y?-E`6ghi6MI(4{H{YV_k8+=j7|{#P5~*HdaXe}`e&Q`snY+HNZ&=g?`x4S zE%Hb0o5c5k)xJrQ67!vLzPHVA#`E1pwWp9sYeN7W-(}~1O6uK93pb~MV|t5x@to-` zc+Yl7lH4Cjnuci^eigzU#1w?`xy01bCo%KAUt-EUA~Eyj z`=Cl6KvBj_loMGBd@nG|z_Rbaq3resFu551DGp^f?g>S`8U7Ps>P>tfutVb4fD0tf zMBOZtcsTG1iO<8nt0g`H?2)+MiM?ed4niYj8Oh%Z_yLJ;2i_#{cHoC4egl~0rTlqd zzROM=e=YVNkT?~%TH>X^H4;Atyj$YqzP6EDF;!xl$iC@PH)VUJx0A3_4LT-@pr&JiHBk1g9jvD1kC*^Sgt34AC~w{VD3A?@Mhr0CB6b1WmHH!9r&cg zKM&Hh4;PVoP17DE%Bh&?7=w{kRa0W^I z6>yluS0c_XaSAZ|QOXyhy~RrW3~;=}&A<+cZ?NMWleh>tQQ{YX2T1%6VD5oJ&YrO6 z5Q)bEr%3!$;87Ca1MHIcG2lfKe;J2*l=vv{3W?VN-zD*AV2{KoxwcN?>w$d|PXT^F zV)ikcB;Eu3u*6NkC0-4gc&-YfCv*c|P7iR*ytB>n~P zD-ve`*GtUrsJtfe7qOalRO07=k4tK@xur942vm1lp3s6M!QmE(GSamubs^ z<0XCv*da0ZjO!(FHgKZE&jSyT_$)B@e$P&- zz}9Q!*9b@Ph0MzckCynF#MW!&=LlEV%6SNPNSVk%tz(Z32*;n`nTv*wtOY)Xz$A&E z>;bNpcnR#bTjB?SpO<(v_+OLwj{Z1zB;MT* z=ZnN|1AicKXUKdcaT@UF5^n=;mN<4m>vi@ugkO;1lM()%#D7J&OZK;aho0)X7LUAU z$?%21>RPrIda7&FmniQFDHGHO_K~8-O2{GDm>b_2oO@Y8l?0_L2Ao z+DGF1pz|vd?*e{J; zLd+d^u7UeHo^g|TrNbb@abd)MU z1-;;RbX0VIGyonITxM_nqNSKg<>rK99=@F&Z2rZa@i6{J{i6HwyW?XtZ5P6nQ;@$r zLS)1cB_Mx;5ChK8o{{Rr{IE-BYI0_BB)nJ?Ro z%6B0!xfNfpq52paLBc7%9QcfU=Uw`khrQvDY=ILR2djfz9t#Zc1Yb>?uGN07?cQT{@5J zGo5}8Cu(D*cEj8nzb3J%7<&tuzaycikpHnq)39Q#;BcQmhxhq9%v({v;Ra6R}i0zQbN*R2_0f--T7;e8(4+xsl3EzSU(t{5V zwFl2#J~w;rjJfW)$?^8uhKMuR#-Dnf4%bB@(B zlxL^sM5pI;_vQ>u&xtC_8PeBMcqq+28T& zRgS&eXnWTxyWMN=QvZJBd;fiAN|?tNS>bbNsgVOiJ$G7Ms~nyU4$o@$rd1JHs~p(G z3h|y@7Eh^T8Kk_WbdGj^-? zW#l=#4TMb}J1U-WRD8nnG=J%!4v_I#z}$4f(Y#Y=RkFbInFDN9_K-q*P>wzL%oNR& z7r89Yp+Pv!Qc>+lb7t*wR4j6D%8T%FO4jH$rtBobZJWF@Nf#H64_H)aVVWL;PZJEZkLGbzj^YTuQzGO5LJZj#-T zqUz*chbLv_;7K;ma0{x`vnp~Ko^moI)HBRN3*<#+&39xmB-}H^vMDvflN#w7;{es* zN!{vEY4u+pnj{J^$#Q&y<8G@65CxnR+_YYg7qvL4Q}a5l?YVAgpWRg$sx^O;^x4nPjo0G7%=^tJhmJ(Kzvdo^dLV<;jQ$Q zdIzUzIXUS$IWu!|X659}&U-T6ew62B=s}*k-pW;_Ui+10Y1;ZeS^>Tx)7P0lBi}uJ zWADwl&8}%}U?thd?~9ZTzi#E;UGmJB{)oj>;y|sJERPQ>iFCHK;A|N>f1_=C(4NrR z&f1|)+TK@^YA0&pzPPP%yE1An);RHLjnF2mHZnD7c74X5zgxVaEDWEmh*-R<3ZJdm zmIPhm^73B%c#(5Yh!hVxwW$!7nN^Wlx$dl0 zNo$fl_e9jMid?&9Ntg77u*I_zg0;nO9I|VUqe+Lx>c(hvuO@ZP*B@JO~kLK95wVCO`TGoQ3oXJ|; zs=Svz4!@Z3%=vQXrW!Z;bI-1bO`=-sl0S*8ni{mX(M?Km1|FKKdESlioR0KtwH)8- z*mP>;iK(HU_eID7%kcvah@F^ft3VX`x2YkU%H3sCgXPsi=Q?ZYUA5+~lg^NTEFVpxNQZ|0oc`QgsDcQ%ZFF{ohIVVgD~G^ScB zIC9H#os#aWA75wVsWhVareJSE`oufv^puI%jPEewT~pA_F_Lng?#rm|vDL`+Cfd{~yR-nDvuZ9|e6 zXB-PT9r`^7C>f<+FW!(>*Cmi(S!#V*Li*Ygd*>}FQQJGCZ1&EFgYj=;=k1->!*?aM zSvz~}m$eBqw>>tot~Muq!;L}quyGh}$L`u%TH?)_*>~UHpSO-1iQaH^skg-9tz3bh zVsGV2{4DoY-ie=V(NmVpfKK?NR9Hzex;rQ8y(Dsb*CoNLXAJCgs@U5_yQ%9Z%gefI zo~<}p92c^yy5Z(5vNlxnyk)7_?bx)=J!t*b2+H|zrD6{n=kt`i8CJ6r z&Abd(?HWtHKKv+kAh2pYHpLX}eVWG0=~N9Ss@d0=e9HNS?fYO19$=%1f2!G6XOYHD ze?0$8i>q(MYiO>)HugJ$i~XExjShF24Ark0vuZ z|Mz;0f$`xyuUPe{(hTEe59juTNK}HQ#L0_ZEiVjVqP3j1L3~Q*nAbF<=GYeAkgK&R zwofAKP_MWiqJ-aDV(a(6__}g70w$#~p$v!?i@_1^b_u6y^PB10Ovg?w#ay~~>gy5sa=Qy1Jk9pHHG6uw87ydpcg>8`A;*FzxDVO}JEPN` z-E*8#h0e&)&IsC%cQhIA+15DolUKV(Sms8Gc2hS)4{;s~J(c{0o#LNq z_)?q*{ls#C=b2&Xq34S0O@sD5#&mnEUT18{j2!2c>CQN>^QtwKC7b6K=P&m*3@FJi zar>5+B(ti0n@b{nl_eH@Bu&#W%2A)>i;2R}rM6)JGOL+^&Yz!Pi`jpXc?Tb4V=g#j zXi&KSi%GBu#So=`AMnyQf=b)}x4*;O!S0rpglwn$c3Kd=owm2M*xRUi8yzKY+dEaZ zwCvNgLlvIW;Tt=R&W_%?{LSo=;tF5nk(8G!YqKNY-Fzau=gxgq+1Cv0RF>@+oE`6V zI%7`pi)e4dUbaI{M-xe#ON$E|TknBGUvBVb$H5dZNxwP1;Jv;`ZaVy?y*~o>gdWPi z>a@+9eI*2zboM^`;D$%Vt?)zEkO`KA?Cy~9W?!B0mstQ+&hEQ>zA$fglsCJNFBqC_ z*0j>O>Dj&gCCTm;kN9i76%~5PvJ*<&Ugx!F*-m_)&+F`666tmJDPi@HiWJc0UDUV1 z`wtPD!p>`#?-Qtl5>=r@G0XV{ykoW#*|BG`dz{OTX$sXc`b`pH8mYUUfRi>!f8fj=0jZ`*@v^_`;pRRtZ1AQhq+` zK`V;xj6LJ*an31TPmwON8((vDc5Q@fWu}UbG)DAL$L@;jz|`?FM0F z4JCwa&!Ay-gRYeAjOLCL8Es88ztN}!G`1toz)E2IbEqN(R05`2Q3+OmMq>6#wmf_; zz|iun9aI8Zo?^BKG`o3M`oqzD4EFD#!eRVF&M2R-{@NIr{>8)`71y5OQAFQam=i57 zV{Lcc{D)_1g|9Ywojq$C{UsdWuPR(I-WEwR)i{ipp1(WM>tM7qnjOF#p5*L3af&v&yxHibdJ53f>%7L> z7~##nCc)W#QUVOb&r~|%eS@9x8=}J2|LS6;rZHiqr>?T}z^Topr)&0A9m(<)$N9>a zH)i)qv4%W&(U?VIL(gXPw8+%QZ+&@D_vnP=38*W@nGJ`7%k{B_d%;M&fskLYVjxy~ z<28GIUqrDt%%IMi0~?0V90G~MT-!Sr>!OSLj&x|)078>5)wh0#5^oN)lcH!D zK4hfQb=LId>YXopF}&FFY1#S(Me$1(|MKC5N%w}C{UqQVunWg1!vQFq1^?B-xn$1s z8xPJSGo8^XdHxz*G(74shW{)0-Q>Z&FRTms^OJKsz5eXieYUONv2*4XL%w-$(B!0> zN|Q?q<44&ad1O(inb-fmYp)4Uz0iB#;xE45)#Wd@?4SSh5m!BXVz$cDs4MZDGvEF0 z+g~JQ54)%5E!7{7o%i(8@h1m--u>X$BNx_2-E#1Mrrg@^tLu*CJ~iO0c?bJH_3iUN zeRJ9?gPl*l|M0h;&igp(s`103PJH~U8$<8Qi2HEj?yB$J%6|OyXId_Xe><+<`B5=j zk54~#Lv86BMc+)S==%0oQMdFOdi~cMJ+=|oJ^kSMlXF%^H~({MuN{qZiiZ7mU#xXX z-NK2{y|0|`py%xPUk=|t`{0u6vL9IR!Rz<@K4)aFPScK7cNu!ag%7^YYv~)``#@dB zFJJw`olm_xvs>vu-xxdW<(>1NKl|ESMfV?nyK%?Xt+zM#`DytJCre+xa___Mz5ecy zo&E=qGSK#n|Wa1?6{FP-2K~eJIY@B+1Lr)FAl0XS3S|2 z_htNpdmCRk`TKdFp53Ntj(Ar}Rxi)8ih}yIrdisDj_+OXX1(s&T(Pl!XVVMHuK()q zk&F9(^X>26-}A>K7kvK;$3xu{ZezQcz3K6JE$R8Y7O#CIW#+WID?fVGcH)WH9f_~j zzd0kr^T>$rn$L{hc6<7)m}lPqy5f(EZ+U9?bC3Ni`I*yP{Nmf+{c+E4{-%DP-t*oG zv&{cXzs>jF@3LNeqU@{0LoY9{y}0_v<~91>s}DI>t>`tW(D~B3<0l{g(=O-r1FY3e zLmPf^ZQtFMgPiX~*Urj&DE{tWE}pl0-LBxcC&EW8?!0@;O>>$ykH2~Deg95+>Y6?D z#>t5x4^3Qk&)3&f^&3As|FM3{ryV5C3L!)RV7PMb_-^({I#~Ukun` z`DkbLKdVP=I{HCv@yQ47y5qkRSDx5i-NQC{$TNRt`hVAzf86V?(B_No_&&cFvu^L- ze>B|)&yny^+9&S6hJ5?lhJM%Ga^J7wKYQwL@2<UmDKG;QzM!-454HQ?hPf8anm$KkWZ%d+d)TOdr_Lyfx$Q(DU~Uf1=;I z(Rb&LeBguM{<;3mmE~0jd(VD**8_VWOq<)~z)d^$-XD?S^`*T2_p9eWw0~{qSKj=4 zPKoD=J^xO6>iX)P1J52=efQvJ#y8w}wmkK%XRrEjO8Az=-@bnRH~;IIJ#aKl={psZWgxs54=xs z%+^{<|H}IW{3b13Fa{`A@l{ye&;NYCpc5Bmz&UVOG=5d7)!Ev}VqY!ewBZ5qDcT5;`e4z4!P&GM3_g}uUm2hRZ5kF^7@SSRVhMw@X=c6@LoE5QsKelF+DLhP^kpIj-6~04a%5%**!&zQBRTm;(nb#EvSKl=6BQfLYRJnw_v@P#7qq~Y|Ezf{g zN=(^@C8nO&QBNrkuV#_miQtr73FR!Z+n}x%*=697v=)uWV03I=#7s9vVy2rbvA>M6 zdlCHd##r#n^71EIR_;`ZDSMm5l%-Q`Tky!Vto~>=C^*rs@Q?9y7I~Qw^0JE(`6lY| zqFe)XEZQgJg}r53CW$4M=N-##k(VY1G5^8!!eL=Uh9k8FYl`VeZ6P6C5)Mm(fciS{ zemZ6`EF^%VX)OH()Lg_)9j6jstK&3cY0t^TE> zuz%J-s4!oNwJ|{+3R$$sM544MnGz@{xD)l2n~QDG78><1%8D;~WMV_tOzeSn3C=({ zxoTe#sm*CJxos7;ziTyv-nLgR!;23KI#MAZw!OA31ypXbLijn$jwlUr?GYNH+gMl6 z3}(B8F&|eK2V9AdZ86sQUx@Zv6S(VO*#N$a`@H;&LGz$3Dd9mW3N4f7K7Vcj3|?WR_EL z6i}GgEn*h~;btZ1*WgrO>cco*lLwgicwNM0!S56w$B;(8ECU~lqxjsw5cQXX*UDHN z$|*ixbB%lj;A2=Sj!+p#{jSAf2ui50|?EvM-_W;O@e2IwQ zbyzvYw*f-LE*a4bK8__)afIVw9QpWew~=oYB6!cK9OdZpO?(a%OqG|nAByh^Garl_ zCK&X8ijVKe61!yFt>B|RsW>=XS9}%|Un=-GN2HwM`%b2D$%sYZW4)1&<7~zE3~Ud| z*7`+dwWr@s$T5uz2c5^DA7_^o-$oPPEb#qZq|pCSj?QP|djNdB5T1&I_fLwir-^Se zl;gNeImH)i;@fNB>j7cK*8*D^%X=&MI7gtI;`Ng2|oTF2Ya&&)#9I=ZYIG2HsvvrDZib=mF@UdMfr})xL z`pq%$;kLogcfE=4bMWyVS~*~y;`_kB*IUZbPH*F2@l-!v2fp^~cT}cv;g`-15>Sfv!duQDhT+(Q z!^rm<_-;p-a+IU1!9nc8L6>CU>kGf)TZ(pXkA96;%S>RLsL4N~Zx`{6Z zd~Bb}DgCCH_zDbs10k&RD*-m@Hw%1sDKaTX?>dQH^uVnH-wGs51?Kda;#&l4qEo|Ctw$KS{fw*$C%BC*_iu zKa`<+0>s2ht{!sjT`&J(;ycxWT&an#xdXZDO>$u|?dSW7NzT!MT$V{L1#%u1P&!p! z&ixt7Th{>}_scNK9fzDlk$_XdZn8eqn57w=w?k!$U)q)aNhZDs7`Yzd$|=78GRYl> zoJR@aSIMn3$xTNm??ISyO71I}hJ6p+adfu1Iu!pY$Kxs}s?soG2nRF;H!h86qME50}7k`S%{n zIgo?X$FhkSXDRLUaQ+|mp|&RSi;&a7InJvKojuc?@#pa3A(neu5894#_3)I=89`PN z0MD_``ObU`)*Fj}Q;}Z;e;+Djsv7K*!;7)L2`g^>YqmWVEiEc1tnaPDs}$jrnG{kn z^SQE9&*gOR7a@Y@rq1ImT5?NE%n)s$t!Fd%#By9LNdM^K;0EpRxfadHskkroJIrmV zY-w4uJZ4MO&f*c-6E+t*6T#behM!sUZ62S}$sV@hicWKr@s37K@wl6{%`GiklMf=y zaxlcT<&bNqw_->AhN~?0*wU@uik7YJn&K^W){vpv%g!~$=?w)ei&$#UWw3jKu^yVM zjqmQ9aimjK!vH%M)88E~?CEpI_`>W~=%Bw15xIK#5?hYDe^o<4U3TMU-wdS7m>2>t z)-fNmrbIT`;16bWa-)-;wLv1XzdfG5Z8lvLIWXle>zv|a!9MrGSj({>u7rjSSw$09 zxn|eTEsh&DFv#cLFzkMN=r|4fA+4SeTA~64$DUAqefEFgDJLk4dH#8&e*}K{oQmUrL zVy2rc zG1JjmFlM9^oRVK~N&!4x@jut%y#=3TF^W^}>KPaNAoYx^jh?uM&Qe7Y>WOASDu0DYyYRlpUa=|Ct#1d0q6|0f1#)D8s22 z>y0wZZiB>3S1vL2+AcBm`cz^Ee%b9ZZ7;wCiK*8>iK&;G{T;-KCvA|L7*%syOE}4c z8P1NUFnJ-#L|SgV-@z1BfQW&4(UR=>YWmXx*s~J$jmRHmw##y zC0&S59~Bv=3p<=ggs@P;G!uy6j;8XY4VGbM^Ag&?kV3*#Sb4SXa9;06&Q9$?{j(h^ zcNFKrQG_X{pg8Xk7$PHhE*Tw~mT-T?f2J|YsXl@NO71TbyBG);goq^k@-(47lw+I! z0}dl!D*WsRl~a7bLjbW$Mht;R@$uAV9QkJAF!DVPe|!2(MYxeK7oJ`Sqkimu6yFWN zM!wzfkH?`L<>&_CAa>!P^TDI^>jb~zTLUs9-+9DQPC3QL`y3-*9X#tGME%%RGLGe) zXX5JxKd&>&QI2l5iEk8)wh7_nV|S?d_-u>G)xFPc7+@Oc1g4+eCV!RgKZ9H@{K_$o z$5#2P!Vf{t=qN*1kHa|TWjm##esoIi1pp%j_jPk2jPY!fEJp+mamwZv<}8#0-^-18 zQwEP1tdEK>KjsaR7hwGyNyHq6u3f}+80(7tJ}PpH<+u{R-kcc23t`aB=!RJ=BO;er zYeMvK(cPWxVP1EpJ$}1=f@Q~)bF9<%HT+q5lW!`7fTorh8Ji6zdrGLWJq zI~h||GwMqsO5E<27KSA63GroPFgCDrMnV`~&ksHpiXj|)qeE*OGWUcu&d|N-As8i| z()NVZMK)UWpoHMshHLhOGzC#S9V0t0Tv* z50c-wuS6UD1MOBCyv9Nu_1l8C2J5!53GR&jHW-a&72fom*wHyXpj^frOZ=$~!-EF! zZR>bn{M;=sS@6cv%~-uCKk}?vRZ0|I}?6ER2z{4LWznn>RV# z@mez8%a`>M*zUgQ0!~9L`X#-8i1F&`Bf1tH1)Db@e$5>P<^MO_un#TvdEiGbH{ot9 z%N}y5BG=8g7jgdLwXyW}zScRloH|hB0e{){oFeM6OA0!vjr_3OA?k*#meGvOnC+lTq5auptY5Yk71z)t*1l32xZW>T44DmTI@ZbNjc{q_t^BVHneARPD2)Y z8feOYjOTk@BGw*?g0DZ{I_KfmmSabk(9&9}sCRe1(22g1P`j0{ZMA;1ByoDW<0i+f z!j%j9Iz~GDFIFwfF2cts`R9E%Go~eub zUwFdu^tj+#J3Y1BcXo&C%dbAX)%sZKv$oVVLmvC>U8kR1^T;jh^PF#Xzc+GR(a7IE zFtqUv=TCq7=xYx?cEbZJ{`Begi~n=Da&g^Be6Xk6kf-nYeBK8;PaPTA{U=vE{?zU< zhc8t9CgI+RlRI~A+1F+H!)F_w{C!cv=T|j7I`!mlqplm*wBh>~p8GUz$V2ZODF610 z37=$k@77p7_a*H=FjH}(90Rcr_}`ePcu3v|@c!Q_o~X63HAHd7XC*16Rh!n&kQX zL^;OKGs&ChaXvN050UA=L|V>6abG;;$oHI-pA5`-s9&%m;5c6sg(tx2!l(bE{2Ma< z4iSH)m|JEn?-ir)1Zbb+*ZuKg&+69ro*MVSru#FFD9z!2Ce4-w4<9}x=Z?&m>4@=>b2#=CGJX$zW0!JOy`f73!tL!bZDbugkmr~y1z&|+N zXIZEe9Mf771k~q@uGKN`@i_NH$EBQVPRb=Q`6fzCz9|xu?=KQZB9$9xHT;@eCOCm#bE=w;R z3w@*=k`NRfs)w(VnCaF_OdZ4=7G#)??njrGByd7c8Xk_eQ|rJT5>pJ2{UV&@zDb5V@H%u1{_Vr;CMO_Grn6y zB(|G3tmE}h@?ed!TsoX7zshHtc)gUQToWy4#qpu}Yyth7W4Dvm#IB}r+m%$)>;}Et z%3oq>aVu%S?0im95!A%O%RBP&xMR5DRMXY?6l^=8{sqYTa!_fk%%yiMfop3yAf&2^D>;ods;F9p^{+i%*5FF)5?RtB3;2u!A92Mx z>i@l`4t%u1sYbLy@Z&S8m(|uUXj;sS%Deo7iAy#l`IJJJF|R*vwQAdk86qwqwJ>FC z5^28qci_9Kf%NUmsH#MnTGy|yShGx}?x3a&4^=u=UkDj8&=YmQ$mX`Ja6xYV{1y3k zEX_nY@^Kn0oqric^zxdDs`4}!S&DV2!GaE-1O+snOVj9WJQExEFXGbr%d3V5P(>sN-ehKl1UCHXavO_Sed7$3P>G7hLJk-3vDt|A{#!q2sm5=-9v0HQ_MJg)u@p zCHFr3#4Z`$h_Mi_*BpCOAI8!D8yrSHUi)~RQ%>={i~u9wN$^pQd@PRQ>ko1x-z>zn z$H#YjjC@=Z$!jF}I6PK-p(efp#PR-3Im*#lO?*R8IK{^yu;Sx8tVaFB`-_4>|EKt# zgdDL;#@z)z+J^c;RX^W46W=nBPnK!;qxkMI@zojlFbweXsWnxq9lQcQ#bM-IhCri! z=fQ_Rp&uX3Gmicl0LJpx!y|{Jh;8MbY~tfXFU7~PvEnN=)yFCDaZIQj<>>A+)rTE? z9QV+Ed}gKixW>|`AKwYyiFoA{U#^LdYhD!}%cJ;y17PHP7CMS7YGgFrIPby9&U_$2HjPoxe{*$SCLN zK<;YjW0d3fi`wIhz)5P9p^tLZk1iZ?#&Udwa_}5xz43NXmE%vQa_}2Re@47= zijR8)5W8dq*T!Z6lh1*JakR^KP|m2|5Sb29!cmUy8weTs%E71FX#(OEAKRsoF9i|u zwoLFSzCW1wsttU-41AxVd`7Hhj zZ=@XM=s0IU?7~5J9Gy=&$5QmYk8Xa7F?NpV?1$nwf=zNs@2EniR*gqQi zb|XMeS1_57<1b~5`gsg|>^~IWE%N-3xAEE$@J%3rbmZX?ihtA_)gm0{a>${a!s?wE ztBjyriW0&vx#)@kh?U%A$QkQR$#Kn@QSNcb(N@YSIknzF@x9go-(DnS8rpy^8imT$ zq4>`@9uq;NxEZmUg*P}Aw;XcD^$F#$GfXPl0mYTvGz2Q$7*4+F@?2nlMEgbHC|GjG ziXy|J+{>*`7&>_P4_=>;#tS5zKE_JK%)Eu`61>l@zOE+1`|O$xQCE4NUArMFHshS7 zXS4U&B^#omywBdbp)9hXuxE3@xt`4l&pyb1n|e0i1s}QiY%_e+Q9fh}_>2j{W6HEq zZxv(8!Vn>v3E~PayqLPU%%)Y@_^}LZR$PUbUa;M^&4%5m_3eu*TUvH(9cQ1gHGNdc zmWOYe^jy3hPqaXWjX-VDWwtB019yp|%od|u)As+c2KyIQ?^C&@#izo&Pi2)B*Mt?E%NV1@L}Qm?d$=9e*&cQ%JL-** zmhItDHiqwb{Crh)?v6)KVCQ%HmH3yj`nxmP-6x#I#X>@w~V)i**u&C!?W!g2`qOgncQS#M7Nph+yP8T=`7TQo;#QPrqz48?w^bsZ3n1 zl-b8EZ1su~Bsq;*M(PzR7M}rfb{8i0N3Q6uBJE@9_8qeY#y*TavCFFexNWm{u5NXd z*IWHZQ46wS{Y)pjdaF;D7N@5fB;iMW*?Sxd4djisiwYhdi~Y9uz7eTZP+Vwuq77Ad zGRI(B*y>ZF@(+ffJ?YgyBvgrsy<6jE`#!|yl*a9cDbU#LLBnIwEN}vfb2DYeYG+OI zZDAD;c*`255A0mJ(~zr8TXtW>p3s?k0dEHf;3Tp8lNU_KBpLoW9#?a%pea7!MkLdVqTHxRW zpUw!lAhi9ae6)709LO;n3+{+g1N?jf(&}shGZ`EM8tL<(U50CjTPI&->{pEk-=cFv<^;9uIz_H2tBJ1^1M67@GQ@In%G+DPS$C zXT_{x^-e(_hRZ4+Au+v18Qv>IbKnU#83(aUqN#kzZ;_J%Y#|moA;R)mspEqZQ^&m$ zQ^&5T1F?4v@C=EmQh~(Ow@_jS@G6O^?^=ne?=upU|2c_SZmxePKg;1n{Ss5R$I!Nk zS*9l>b^zB%O#WjMQ@#`aQJykgC8o@5iD?f&%@T)yaH3x1DJ7m6V!%h2fkQpJUM?|Z zuMCaFXAtxqd)k@w7q<|ZcP=Q*&r^H%m}kt}5eb;0*5mOa!X1T}BVUu$Z zq$pE-7Pd&_zHq@(SXsQkvSMWs1>|!85sQZj?Su-A10RQ(-g5DmtKHXI)RTrb@1^*Y zwS8El(&)vTpItD2WdSz7G1P44d^{7#H|&VhejWdyr0rC=wCE+C;RIM-$cd2lo=BMZ zWsTsi8$8p15%Bm!e_olIIc4n3neOppGsjGuI&+qL>a5Jsb7zg6X%Lt`d-UW9W6be5 z#eR_c41EMnd%xpcKEG$K9J&+XzQ=!JbP2-o{5LxG1$5j;!Ys$@sd7qA&50D?jvDxA zH^sLT*vMA{KgTJ`DZXk182L_tkJm3J4opY-`F;*;)5iF!Ft8(2w?3e3_>DI0?QK5=f``xK7c?$F)wIAmhXljYIKWXX3+m zQ#FpOlv6Ol#8(YIu4y43hb)TEJm=bo#z{LUr}z>PK9ddy-!Vqj(RCD$M<9AB~|yu`Ap7D7XE;_$*J~yeQt7W znJuWw7OW;RL&QX8Xy8Pq)1Fo``hLS4<`0^q%v)G)U7w&~niAjHP0%<~xiyS4m6(h& z&Q#X%BYpTB;a<#2@jHFynM&ViBr>E3YBRTqPZ*026pj&J#~l-Vzj1C;Ok&1t3_UC+ zF^5<~PPhCE^O$TxA!-g*R2u%Fi!nAK72M``m^;X8O)2;$=94I2dY?ts^%F4V+9%Dr ze!N!jlK08o8)B@7Q#EgJP+4%WnhppN(*dEa(*bx~iH{}WBR$oNO7Fur0L!ZLw>?tU zNqqAWGs)G9g^#JKZ{PJKzG>T<6f+62)^P(c+ki|gm;i*msxaYzIcrQfh)+a%_^n5G zLraVNMxJPuGr})d!l8>h{By`-^^a~_M~^p2bX1cFHb1Tjw+8T%Z@C!V&>02 zE+_j6Z+7$me48xM9$J_kvj!jdNi4w>qw7p{?zx85n46Gqh-J*P<~Lw+Igb-CvFq_N zVYOC%c3Wd@!|D?ab08-s-DBoytKa5CvM>EuD2=v2%TE@Po(T>+J|LM@QVH3T&Gtro z0Ij;9q}U!?vTy6ztskb0_VVLsm=wf|fM**k#TP$)#pMlKx?6nic`3eqo`)m64Ra2L z)tudNrRAXQ<>dn06oxsXV$5lAR%J{$>fl|#$A#hlzFTFf@i+?V- zZuxe64L4FrHg#gkzXSye83gc_p&)D1YrQoH* zo8)9zz&Ub>dH-Q<+lU!_;((6H4Kv6|H_#_T7kmw~$)@ErI1XWE5uay<2db*N!aQFn zwhM8@+q3ziQd09gyER4I?={40b1bd#yk5JcpZ5TKKjl+X`~j(tK3CUv z|NTEmx_d-=yiX$i$AmvpthG(J&1hyeE>SO{|ARi>irNA&J5u=)>CtJ#A?rvJ`4}SKe(AVi0RFiSd9^tJfGdG zdAoHIQ=a3efcZI$!RR<{R=TkzsJS`^v0UiUi3m0(8Z^?qf+Y1(8d3|a2A0bYAOx;N-FHapqW@D?ik|i~huT zbsvR3xwjzzU6^oZ@t+u7l5jlljgEZ*-Eat*={RY zw26;>Ag|%dDZXwdK97NqkB}4}`%;Md%Q0ETnfdlW&Zyr520mUt72hvSeA5xv-aKBZ ziLczi$8J^e9RW7#mkU4bpd97sUdKV~!a-MU;NxXg@l^sF`If=YYn^h6?{Nee`SyaZ z7s4Dkc-d8aD}jxC&G19i?-U>NG4h=>=*Q8a;-meId>7#7m`XXtHy!~-z9#VT8sfmg z_MrIs0~`5x4R#?+ImOop0Y<(H;M;^S2M*(!W|rN^7lwM|m`XXtM;jRVe5llVggJ0< z^u;*VV}GPI@?j_{-`+(eoZ{;PIU`>h<^>B7@4&%JyW$Hq@o_J9jf9?$6GA5!+f0g(D(L|4I?^<8_|kHtmNYs7LY|8ZlDuNqDpkXAh^swq=|_N z@mXUUgKMHWu_(nmWsMF(X?_$rDkYL{6ueb4kh*e-LS{1kaHBs_6A?7{JXZ3~! zH`hfLi+g{&dA;Lhv_bTNEefGmkajfZ+pgcBr{|eV>I@xX28YMk z!tJ4J64peGu$J3&ZTDLb_u-Z*N@4p|wG~Z}h9*0sVoF0{!}ZZv>Q-Cn@`v{023R58 z5PB&+L8N*fVe-bvQhgv!>!i@F*Ys@25W;|^ozS5_UG8@%Dr zF(iZ`qP$o+DrB(UK#zkB0=5q_XCLVQA$qP3f}VYY{CcLC^$ek&P!MN@{!2yax9Goe zR`N%v^@G~|9O~7nRj*+`UaucztRG^l*kFH`G2Yl^;Fc~}v-dn~VXML#TCq_Tsu8|D zHn|ZQTW3$SG<_2*75am%#=a|E^IC&Q!G)`v5+m3VGJLR>h)%HW35__;olSmQ^j@O1 z`}0Gbv!%tq%-G*<5PrASZjISu&2DL_Y-yQ+`M6LlU5r_*)%3YPFQapdFGlv7p_?%j z@QF@YPflIREag_TUHgqyjjkI9z^DMyC|4Q`Vv;l8-7 zal0~VE_y>WJR9HpEh4eU)MBAr5ac02KYlUg9jf;xhPhKTk_!jNW8k8@0qAse49X&h^+dm6*7n*Tmdjrk};r+%4^ zjvRF4qa(L+%cG5CVBL)vuL-px@=^!j)C^!r1&)Res~$8}Du9 z!(CbSw(D4pcaN0ktXZqWdgoRTP}_B^aw1PkwO!Y0e6xz_9VWg6lfReA-^b)nH2M3P z`~yt>K_W{4@juh}o-Liu zpQ(G~e;eN7<9n!ddVH3^>Yq)^(xwE&XR9djYs0KQ-}j}{)92_O`5#Z)O#b;Mf3DVp z6C`lFujI3qrNXDrBSdMT+8;`Tt?^A2Rs|oBTJM{8g$0L|)AAS2BJv zFxO@8llsCd;!92b!zTZ`CjYNZ{x#CSK=4Osw;1{p=KlmUl8*jgC=Y(=f63&3)8sER z`7g-!-+*wg+m4ccijmL!tSiwJKg#59k>{IAze)P@5Di@f{Q8^X z$D8~SCjVqvzdRG8uovHhvc0jVj>6u1$7T80^G9JXz}Y5y=b8N6hd?=&|6|F|d7mh4 zm^MvDvKdEVccxDAd}Xkx51Ick5&skIYT4d<3IAxEfx6T6N!6O9pFd20Le}?5;3(`W zHD2m}t?*CMmP&ixD*V&57%87D{4=#*N`03L|1J2Beo#&rbF2~Y>{04UO7#t2s%zmy zFC4F)mJtF9-7F(@%&VgMjxgr|Eu-{sK1;IPq+uc$&#U}i1!1ZK++dIB@8&{JZeC-C(M7kWx8>;TLr z;lM$DV!_YG1t<8&=~!@%*RkMC)3M;3pku)~QO6GaSSIP1cCg&6V;g?d^G~P5%u}=( zw0Gt?N`^BZW~rWwrb|p+ZZ(82l$iN1H-z6Mu>-#w4B_ne$w}QS4B>kuroJyoOuN#t zZ(D+2VISZ*z`{PjUSMH=;Df-zRuT(a0S`d9u$9Erm7Hu&4g(ha>`>qYzZ^yh{;7Jn z;Fq13;GeFC3w|~tIMEKJ^5UEYCiitXxQ`!Y*{>0k!zD5EOq1AeXUO1BIIbPwIVJQ2 z9s(@%1ZGpA9A$FxEA*6D=m|{qgr2~2fQ21^2Ld~AFzqP(3jRm{IKj`04xHehrDMS_ zhmnFmLk}1HdUvVYp_?8q>;UYy12Fln$HDK{Gau1k0h5nSmf_?R?GTuG(pdm_9t%Bz zhXM;dfyV+1J%OnC#?6(83-wwcjI{^Fb0L(n;_zfGs9f19I0QTDfnDs97lvwBq z?6-r&!VbWGJ4h_-&_iUY+d&T3g&nf=aKWFgW5J)JV_}E+Iu>@gLdX1x#y@g9B&IB{ z2Mj024HDBP>>nAh?|MoLUR)&axG_p-#4IU+H+g+5XT(PpkeAe?A3 zz>F6%KNG>aeWdm@Ps9VRi;3C?!xAb6Y*fWs-FMFUgzT8YUc z(oP0|qu;VzK)vlreS{5*^l)KAc5-lnGr_uqEOA6|41Vxk4sj^$H{luv?&M z@r+s%5a$&YNwuqC-e0|Ow0iNH2t$$=q-`O6k8 z$;Gsy3|_DVuNrnx0I}^KcQaH1=0#R0Mu3d|T3yk~Wqf-RJ6h)EFT_TpMIF%lw-n{Z zsqIh)#LHLq38@DNQtJ zauGHmoxf<%itL<%1^$haVX?O93JUIA!re*>i}I15*@*wrZnwxM;N9nT^bd${Td@Jr zW}QTT5+Kn|21X%M#mb~Aloe|Vk`>!FG}$cKTCqwYv$nKgN4x35y8F<$|+z7W=l@i5+ZWR|exA03D1v zOmYTmVF>0|9M<$>-H=8vhK;h!a#v)<;JPgP7yuGA8jHCZkWN6HnV{^l8q@V92 z$Qk*D82ET^rT7*B8~J9z&wEPcC`ZTr5sh-W202(i4p*HV1LOniJUyg-pjIeL>#d`H2@Iw2qL;S}F;$*0QuIQV)Y zUOA;-fr-z7n?6+^p!V~<4I*Rx*29yi$fO*-MzffG-Qb)Gr!`((eTm-zVT} zK)iBFzr7~D&%yURgviHv1;y7a`S2s$Zh&4A^GEUh)x=i;rBr!&FRJ(!K_C42&)?%n z*Ixb3hY-`aaM0N?8KLTzb9#zzl8Ntg@a2gV`ah-LI1}G2@TvM`{)*2h`9LGwEOY|B zB<7FeyVt~513pz=-p4Dx(>UoN>M!qV@U>UoQ;=gC7Y@2;RDvq61AfIAh zM2ISHANUz($MG@bjC_19I}_o`QI776iSPfT?p@%cD(?32vzP3KWW^-JH3-<<5FjYg z1OWlj?s5s?rU{n_h%Z@40#PnW009eavc<3oSVL4uP+vo|8d7<=cncskL4|zIJ%b9cb%$%8g@TvUrdQyBT z0OV8oErUCS1X8F+`4IrIj}AyP_*8!Rx`ko1@5*kS?Ryjfk@DLgdPcq!Tofw5gA9C^ znD|-{NxuGtmd?R*oQZD{_*8!R+DF+pR`RL*dQgukB#=Tq%8yNaE#Oo6<*Osb7n1D- zw>cqW;bwoKMDcO`WMjR}fgby1B}(u2ru;5~9?MmU(tF2b-yqz4Q=n9YV+aoFG2UJi z-zxC&9h(xx_mqh*+rT#r%8D-&*qD!M@F@;*D(sioM^DId@X;RHHynrJ+5?3@9`3@%^si>x1}4z6asv{Yr`AOOkf`WWYx7v0iE4C>)CK8vrBU6Ntz1 zP@?$003i0sfaeT+H^7f!%>O0GoRRNCX@`s^^oZl2XXN|TkY69d72h|e`}t|`rI0`h z^(bGM?!RXZe4`Pr_-LEaJ{Q_;q;`4)N=Cij(8DDX7M1RcP$Krp5Ib&GEMJ!MI2^ty2EH2*-)LVn@*k;PjewrfzWczZ+UW!XAMM*N>e2a;#6CJ8Dd0=Nnfc{?PVrTA>&%Dg$`RXNIrNP7Wr0t%KRzcYzS~WFXTev3 za3$2E6q@+fflsx+n-Q+~2FdcXideXJpz(Pm=1K8A3XU(y7Kuz@$s8M{DnoO`=m+l{d4Hmne;w9hhD&>_vtzG;!Jv9okMS&N$=Zp z=&d#B*-<}G4U5X}aQsMPIS-a0F6dno*3!cmJ|6w2u|9mzOEKsvzR|MZ_Q|l}y*t`L zKK!W1>xIuMoOn8zYTgup$_Fvq-*?kZzIy>@6RF;s&f%Of%vKo z&`rKPv}y7T#X<-=*OnFS z{M*oe;&K?)_@gKLJedP0R-?1)TP&N6A zyGM`sM|=4G4Kl$~e+kgA}NqLj@e^dP2^S?gy(+5)jF<{##ccp*+ zW>lY$eZ;Xh-}zJBdw)K=rr}2gxlg<}HhJJzTiUM}^LXF;el?>0-fv%+bxT3bE3SLi ze)W0#Yqzeu>!zPJEl7R@fQ~JuyRY# zhA&mr+Su4$fx9Ghtc@KEBpis|`&!Uuud%5Wvut9;ESp*}tH?7i&?9JzuCaBKOKRC- z1WRmqT`VkDbt3v5f6(Ttv0bE;x(lU?4N7rAtZZeAtFgr^odluNL+X6&ITdi9Z&!!a zp3=ajtILD7q#9dK#c`S7=p{L3d8P)Eg0|i@wmwSXa-r}esqlBtmw}#t_Xcg)Gs3G> zl7&j&u&tF}1Ot}^Z7DUjeoCdkP#F+b!TtupK(C-JwZ=A3>0BXnt_ zKlQY)E*|Th9jz;SE`8TttV);Ov}0crzChd8RR6sHOp|3-lV@vF%ii=|`{G*mr@!uv ztGat%h~c5Keg1l}f?ZRndSCjk<~Z!b@bT`WzuEU(E2eGi--V?2$G7bFRJ~l^oWAS1 zxcdF+Tes}1W88=d&&p`}C6b0+5tFXE=RD~i|KjMY=SjEJ8!wVRSDw$7H0?Z3t|xp@ zweEb0Zxe~5yd!2hb<@@wWcyrc9}k?j#7D$e{k&`1DADTuEYYKfkZqCj%j0&*;zm{0 z?`KtRy|MpOo>7%$`&pGukE$H+dCSujFX|cf*s`DXxbU^A3Zx2~LuJqTTVyqd zQ_U(r`r`T0efWIoK60LPtA3&K8X?uAhtHGd+KW0GSA^W2^2Rm&*Le~?`$b3lijefJ z)}t?}_7yJZ{betw*S`{1_DcG2|JHle6?d3LjVo?n-L50@VqEBLdhBQutEs8}APc(% z7uCDfucq&MBCfhAJ#|}Euqm{yy}c<^_5=&NKID0~v85_~-&0i^WE~7`3B~UUd77H* zH>4kHOW*piO75j!X6wlvX$hs*e(-KxRpqAk_N^goYNLro508d+J(ylrm)`XF)~!sV zu6nz_y3SIMKB2CqF&*h2Z{2sG=~wzS|J=|P*%r$7q7|hd-`&x+k(6j*P5Y~lrlXIk zs+i(98e+CWWi3ptCFI!`5?xUG!ji3*Q|hXbIa#I195PV#bC`lY zE>woBg)GSS*3g=7Ti#1QcHC2aBE4znyG^gPx4+v||L%nS^d zI(>KlYnt}%{$0PjKW~5hvHhN=zqFu#{I!Rr9oYJi>LGXkDNY#lNnHzi*S(&T2rlpF zeE0iziK}vJsO8t_d_A~mn;usUd>_-r6^(S+b9>4}&;7}XeFtclA?f`s$J39!=czxD zzIF4vb+oIl`ZXqej19Qu-SlJccy^sgKiyjOi+4ke8!CH`2_Hk2kGE_{FT2}Q9ZEm_ zMbm#(Rk3k}%9>`>i_Lc4J>627UiJ&mu~7QH1{L_&{dpqrlTgc!^!i56$tLts*s2H1 zgVj}UW4e0n{AW6MhN??%-t_K%RYAyb9hc^8s$+5O6~(o?BTFc1QJP!#?+GN+@b_31 zr#}#eBVVC1ly@i|hVKgn1N~SZ$CmSWWo6-3+VXOG%TZ6+#`J@@bv&qA z*8|KuT2~V&`Znf-uBh5jc|~YsjkoXCQ02(b#2Rl3z{Jq(8gD;<*$u5(bGUsB9*&J) zdh;9G>CqwU#M(OR`Vn?lw@myd={f4_>`+``mjUUhW|0lcoPwNCC3C(z!$)+Rm@c4&iN@Qr@4rS!0G z{LoKxmupxFV6Dyl6~04X7+)1^XiGZa6l*{l?Gn$Ser=(3)ZeQs;z|!DRXx6^z6>8z z_i7sTlbrVU_19fg_Hv6@?*PeGIJN4wbeF@A&w;t~4AOO;jM7GJ#7-@AFSO>}^~>Ps zX?b`1gQKVB-G%=-$1383qq9Q^t`S;KUtXv@IC?tw;2M21_uv|x%N?3V&yYlTycwg3 z9lC5{hc3B^7an)U*oC)Kc+2%~xt|wS+QoievBEn>?B~@jG&MNJCA=>d-ra@wMf%Sf z`HghA2+Y4-<@groKRp=s4_74g}7dYhdyd|C1A@lC_5}D1DugYpEIdg+r;C+ z_t741VeaYMFMp&*D-JAMR*)ZqpTC8HqD4giatZva83Xg?|7$5R`)^rbL4ik~bNMge zhK2bBg$ouI-FEw;#n|V)q;%Qx6?d#$wffHgm*oD@W5$ll9G^8|;-tw_ZoDZwXX>=+ zGjea9IcxU0lS%1ZB0{3!unw*NBP5cr;6Gl$h-KnCL{R7pO?AlSU-?Zy@n}57E^@E?4{{8l% zwQHWe_wK2)ug+-tB5>@5Z{K)3Q1hX-_Ma0L9bNFjb+0Y|Rqg95-}(BNf!>22_CNIS z&7XbMaOEG5%y?qLyH|Og&)oU%Sh%*)@S^C#-|FKfl0h!KZY@XmJEZHk_blxWv31(D zly#D2ChFi7x?+?g1SR5uR#t57f38 zeE5zG{gse-{O7mW$7Oo-WcU_Ye#~hCR(CK2i||`yxE}u^?IlKpcyS~^gZmdzKEyk^ z1k7IOBlWA{mw>n056JMp33qSpk23s5;r3{+84{#DSDM_MyH9Drks#k@s&!^ro1MNT zO{Av&4wc_)D&aRM6uf>6uVc$#wMH%9xf1ieqWBgBn0_o1`irpx*kzIYImmkVP5w2&NfMU< z50-cx@Fa;tzy%U-1TL4j8kpavljlC*y%N^~za{a5z@JN84;+g|M*T;D`$^mg?3efn z;Qx?#7x0}DKLxy5;%4Ao5i9ZD9I0W-@8n_p(SK?2BM@oDKc#gzh0k4txEHKwZq5ikP?@FvX z3w3?j5oW>IEF}d8_erLV!$HjOSq2OkUSrxA7iNa9HPR)*gW-acfe?;`(4WGW!^F}V z=1hdYTGu#<7~@Wq-Z<2?>;g_iekjx-W?FqDCTFt5)Eyvk9L|FzW;(+qCdX)rnGVIm z&J!Z?$cPZ~s=egMtJZO5u!V_3g#D64*w4vG5Me(CwwWCd4#s5?EFWT)8H=8K(@=OK zX8QOPRA8o0e){t)@(av#`b&S>k}ffA3`p$3`4w-n_%fwn zQQ=%Z51(_kY$u)YH%F0X-O7)O^clHbr)sNjj?VMhQ20xk2;cN{gmq23Xvy+|(j|dK z_%3GX+~U%u^YK7?jtoUq<$ia@FI2$7GMPJXMd6}?CE*#lWEcL+RxH-8`XL{Kgg>u1 zccG|{Cpv$#pyoZR6k&;0jL#>Q7ltPbciE&Z;#BDHcL3+MK+W>+TCU8nac+C0N;QU? z=I$f+=bM!-gT?6K51WZS^c#Y16m_evteZo&#`u4$Ev@wBN%|2_83uh<*YH zU9XTK@~lq0rYUQ2Fpg1Ag)v;=RTBH?32DY$QC{0=IA{;`)U|Hp8xDWjjRAG=&5_tg zPsob~KHR>;e7`{6jC_-27~@cseU;E7_R$k^%)rM!P1#p!;>$*u@o8Q0EjIDJZ{TCM zulS~#`0`~KPC^vl6cgWR179pO72i-3-$H~%D!+6S-&Y1cK8q^8=YWmnw+3$Z&q|bi zkHEvIw-IiyQo>p3{inn}6^5Gt`+Bwm@~U*X|ACQj7sKcwMe$LI*eCtd!Kd04>qYUM z05kWKxgLFQ8{sFCB%#a#2D(%H1Zubp}5E%2a&IO?;z3 z#@|*-6yH)4UnBTb{qmlz_}(>@-;j$m&7;Vq9-VKQ%I~;=kB=pa?*$Xzbnx9s0x8PA zUz_-%QD}M4VflG*D83=U$V#|hdlY=Ba4S)KSHpwYCj%COZxt~4l5r?LTwa~{UIAYN z{FEp@JVtfmJ89rckzuUI&yf$>$LCSX5=88)L-C(sJf6cpo}n&e6ZH6-UkSq~To>P{ z*M^Ic^`%7FH_@c`A@qus63&Wmn#8Po%5-!>`8pK;smFu+&8RpGXf}3MQiuNBXV^H0 zXD04j%m&MuqBx#`ry+YfA3PYY`U9A(U7a!FT76EA{y*K|(6Ro1*pMM2Watom^=*&m z!u#mCq%mwmY&A}%{%=@M@+y(O{!hH45}$?|Hup6@(sgEG#IUE51I9 z@CBJ6iSxp-2t_vJ<+zA%NF?mwC zah@7&>SR^eJZ;zq+5!8(lAyP@%Ra&Be#7ZnU44Jt_?~uGRrSOcFU)-U>WTMnsN2$P z&3sNTjP4laoJ+GwP2%7)ukyk{PFMxF1O}t!>&jPg@T?thrW|-4&O+YJg1H z8O(G9Goz3StO#aWgTjUlkAYCox$Lv=tNyvaS9AX!*35yLtLo-`*31Fg-uR%yRpU^z zy&Ph;m!o60SLN=YBf7?+ri?knlrcxgl(EWfL5ID@q2`=niEKXw zCayWe#5G69#I?%uJ+0WL?o{ho)JtQ@366lJ#kj3W&GGoy>6^U?$n~+8<53i7B@A@T z(OgB35+K^^QXP%D|{lWyWgn`ID@1I2#;}Jr4UpM^t5b*+x#C z(3;}Q#Iy%g2uyZrHBMzR_L)GIoE;|DIGqhn#~!Espfjp+TZH(#k)_vL(~+mfl2@Zb z0gK8lHrw=uEtRwg#y;=1ginC6^khgcqpUf%=%Hmq#+KYOiZmABW}^@)}p(M{Ln zZvP91!{ci$mEBy{22_zVAl7AeU`6Nj1J08UeFA8N>pFY|sq1P!d>-n!_Ob5u0s9VX z(3|A44s_PMbk;B0b%kH+-(zC#BeA_h>z}qdZjkLe`r_;t{3uLR|MiZ~9E+XbIZ>Qb zVsh`ZY-?|y+M4d-j8w6~;P%~9tnN=@{P;=e$V}l?QZYz#m3nZMG{)5B6h2+h+x2>D z(y7)_h@q3b=?Ilnz7`5pwuUyL1{%w+chrngBgZJJF;N&!t`DsUjtb7*)5Ug*4I6od&tkNO z)-mcyLUAyuy#ctR08TBv6t@-X9@3H-u*wV7AF0T4PPxZr5)%AJRoBY+)d6-vG zeN)C_`$JeKeqhPK0QxM~#!5@s`z@<;Le3HXs-HKsoyE?OFz7R`^}T&J&_mYdi~+sS zdInq;g)+y+24(Bw8ol+8A&odpgDCUmt;$*G&%N)=@c5CBx$MaI0ec&#B#dw#YDMEP z-4EDq&^89DtKD5Q z&K?{mI+SrvUgP6LhcZrdDC0zjGEQ_T<1GKP?kD8MZk}#y@X*=uTP&_bUvf+AO3xNg z?!Zq&mfHBb=tI~PfqPpt`rBB@ydInZG+1^G4Xvr-oM!8I0tj~t|F^)fRxCfi#uX(V zKg4wdbI=MZzrep>AP%;=2G(V`de(6h)VkM3b*uZJ$UCcb;HJv**`ZMMu`F(^igoh0 zAs6q^(mD@ykZ{3XUdjqdpPdHUlU-fz2n;?^*g8iW4K4AaMRmm2T`$3&^?0 z8;8jrf^&9KXm{!+Y(9aULNVx#3$~@AghF2g+tMq)m^5SFAy25aR|vggdH-Kp4?Wu+ zz^CshvsOIM)O`Vj{f$vp6a2LwV9(>qaunXGcv*7J&~9+*Mx*S)Cg1AF&A$}0g1Uy} z=EsFFbt)dbRkP9@GFPx_p(wUQz1XnnhV2BpYvybuObwUV^~_y!tDd#3-F1FD9tfSE z>9uxuOm1WM&c$`9UR(#9pSeP!td7Q_tQI6$4-Fz4CQ&(bzKJoRP3~2eZTLyO8(nj4 zV6oLb(3$1$H8xc4uxZ#snLd><^cnoZj~cvjlbRX=agAS0YTEuqV{60F^zE&aLMYGJ zy1GE>riwl7;L9T4A&UlB%R0#N58r(#O3U)Yc2qrbnCaAp??!Oj_pBltCTE3%=%L>u z82&Ashd!62?d?;X6`!`(ZgLOg&2dU}=Ev|k^f7n+sQ5G7j*r^IJTANAukDX1nKkP% zk7v@&Y5sB3()z9NXmpJ9h_$9X`aB(voUe100x_CL&E=tXcBi=6=EyPPH%SsMeh&`* zKH<9zx_R(7lm`c2hy4hL1qc19L){fC-W_>w-kO8YAOFqara!#%7`!@3+Fkvl`&j>Z z%U$1WJy`MSTWfuPxb?p$j34`kQi{Lg&0bl#hx<*e&3fbF6RWPd#kMu8ar2-ly`TNX zuikq1?a=5Ri$@Kgc*7@0W;>R?e$Qt=R`JZ|`&)Z`J#^&v@6~?yySAfC-&_34Nz0$A zyZHTaEe~CCPtI@VJ#=bk|3CKYe*5HJp67d3?<#n^_Jb#r^LJ!7E?-`=uUq|;*UWsj zAKm`;pD)k9{+qk*D_@#_^pUTZ{_2x{SzrIttf$;#M=iai+s{ij-7u$o^0xZXpDw)m zCp{LYjGVG)^wL9HE}4IN+r$~a=$7y9`MmAhoz=U)P1{%1Z|nG8tJc2tmhaPkZ(hIN zbMd?HFaA-~JMNh`ZU5%wuZ^#bMG~tDPF+08Td?)1qS$#4{$bRMDqVH{`t0UM4qQF4 zw(sZeE4AjRw|{^6qlNu9H_TMw_rE(pJG%6pU-p~+*DLP+V))Wq?%VcQ_v4TL*EcbD z2Yxj-dG>*YW8U;!dv_bh%_7L6SKqoT$+zV%Z@sYdhVjP+^-TQ9l)AZ_#}sbLU9qu; z`<^bv*O|iq>Gs?=o9sV*`nNZJU$8mw(UfP-zLbB8pG`%U8y`6M+;fXA@A1aa=UV=@ z?6%N9)=w+EWdASbZ+NA=aNWX7s~7xsd(}hTuj#L1JNDiA=l@RG_}y>&uW(!-j zlwSD!Z+PK?v^N-Da{TM(1@+MW#)}j32F~2idWTGp?;R|-iVsRR-$h%*)l6+&xWBbg zBJF3rSSsY<%y~g-9#OS$57fBU2xS!x&Lf&2-Fzo$!5h!APVTZIRaySJ0OpLSBZZx!*c#QzSlb;+-%BM``@c}?zQle@3UonmtLGr7a9 zQ~2Au%%d{CF=qM$P4TZVxy|_*r1h2MLq+z*YTi>kFy~cWVG3U<>tE>?nZo(KvJ&zQ zmyZ9yne(u|ljTcqhR>6H91BRmEF}Y-2zQ&(yWHd+B>9rzpMa65pBf0r&u@8^(A^@# zxxXa$4>#_4$?!^3`~x!b5W(L^xGb_-#9RaezeQGuXsfa+$Z3()kVq`6fcHW*my1^o zF|RSI5|e}P-igVPDKR;2mYCNd#Uj%Z*Qk79?SQ}9+nn*$-sa-E<)8vY*eUZO>`d4F zg`F8X=6%{CIXNDp=9Z0>m}%Z2F}c@COzuq*L?TCvhsyKbM$xy(}^9dQW1O)khMOlZ~DHv?Wnu>i3hF`QY_O9i}xxVvd_| zUs3vdfM1e01^7*gY0p`S$nPRyqvho~c9 z>OL?1$w5(^B3+O0($h`Wu}IgeW09_$!zAiXPCpfO$4Y=O&z3;~Y93@*= z%(F!fSW#8YH)6Kc9vrNG#%0pOiRBZ-DCy7Z&nGdd#uE3%KS&l1i|nE&6Z2sfl8wW{ zivuzphlNH#X5wI4*Wo-zVz#3^VmWw{Fa6m+qA11s|2Uy<(y<-qOC)BQvuL;{%$AsC^K*$=HmwqqXAb&N>iB@4keGG#ti-Gzyp#|+dBDGu z*aQ55!T%$P^Wo3Fot)&c*g9}`iCHJT40xc#dGPNRebL3;dt90rp7qsrHjf;F;i|m1 z7py+VR2q|#T77VSQSm~IdWECv%QfG=a<0y#oW;8PTr%` zX-=I~Fp!6Qgy&JotaU6#Dz>iY{4tfQxmd{B;4BvIt|hagxPx=~-0+;TE-OkZV^%C# zSsLKF$dQ(ljHo2$S4E80$+OcmEJgGK(vm7N+XbuV8YjP@u9vP@Zt^OQ;5T>ivISk# zlwY{iQ~}K`4wNo03M`5+pDtYdh}^08g}c+(?1iSrp)wXPy`y6RQ(5Qdp82Lq?K~6M zI;n*7rC%o^npB7|NUWOHjT5F#pF8R1xf90Z4i4wg;Mrv{P+aIgQ0_`oA*2= zijVg=Bi}mk@!mqdZZeE~vygcs-;3~LTqTNcI`oWuuYiyFAYUvFhLLZCiSHHo@m{M$ z@eMKYeQ4lg9u;3-+0OUx9>NJovjx@x5>2TLnJ8<4~gb-Zt^2 zxI5~DKPeR7Q^1U_uJg%gd13i@%!- z2^mJ`5fk4T=&g#NXP(!#5S>MJ1ij_(Gp2hMdU+A_j+@e*iFtQ?XQhN3lvw~qzNeuV zDc!fBOFgzr$~bgB`8pK;8OCF;OjiYMXD4M4>QGKY&p6*H1s4z7pW;_~520N_H7rkn zuNr;~?~jA+B@V~ZBCIcd)zW#lUF{Kaq4`dO(}xe!XVzVKKHb^tkpN_f_@9b7=gK!o|(0 z$e@^@a57qRUxv9Lpf^NAdB8*LG48%o3ysu+P(Y^fU{P+^oBnT>fZChB&21>Kty*K@ zyhBO3RVXg8-#W_3$h}VsO{}zqW>?x-ikeQr~*H4*&l` zxpvAAuLjXKecGiHNHX+IXW2LDU6i=EwDxx6?#QUGa&577^R(DdqPsc96;-pdw$8$O z%Bk5|R+mvz|Fb&(9IQeyYG7UbTH9w)Yo^xbe6-h^nXJ{O%&x2HreVHab!|rOjap;I z<2{!*`s=sHRsTA^{x6=*f48IkU%SOs>)mpL`_ylC9gja0t+jGK&jII&?&xtajbPB~ zkM=r8_4x>Mi7eWvi@<#9H^+4yF0Ap`6}?vOOKK{tU)d5$ban4FgLBIM(2faomtT~; zvz~p$gZcs$#eG{$os!9wd6b>tr_u z6#g@`>DuOQ!X`g$YAZ*~%rDwQ$+bCHfyUKqhco0wI*Vi6xz^_7a@N$VPI$loF`Z#` zLQ%47VWrjO$oxb5LW|>_c34vJcDq(rSJzWqC$4UF(Z_AcJ8Q=unAC8Qw&&=vhWd8Q zT5~;c__~o;J?Yi-iLdlJ@d0i+JJ)twdBcD+D}$?}V;9eJXt%8_J$!6+^gA~9x7xgm zw0Vb))fdLaLV3ad-=%d!)q;P`Sv1ET_5(4!Lc1RKKRe>4a~*f7geeQ&Y6qrr5f}b$_X~R#hVFm><{Y%$lj;2E*T* zO7KV$ekw5f^Eb0aDjEIxtP{zfI+6VO?l+P@f1@gYrlrJ~E`Mh$p}%^@Ha_nYNAjmV zk^E^-B!AkY{EhjAclfsuaU?P7t2`NPSI>dQe6rlnCC2Isd6#;MJg9n&WvM}e)F&Dw?gAF!*0`x^3wv#)A)XR>5?0{(bE_KJvzP- zI*zc;iY3cSS4$;HnuAAVvl(EnN^; zQgmlvd66{WCW8kynw?>fji4D=G-FB8a$yVfJ#=U{&Csr>$g23;MV4+Btza=$MDk-3 zHGWJzE{!e^_f(^EhCNDIRZxnzw>Pf93(!(+ns9iQ=&ohPpc(c!8KZb9auO!a7OpUH z=fD~E_)d|=EX^;_WQ_U5y1MY5VYe%jR+NftO zqUDPUwCUo%j%V1fl41EvI%15)*E85VZ$;6vg$4PdWf_t%D$cO`W%S}@1uOEGE?K=; z%MPOsziu`CEARbsP`<@N^%X_=+6+{eXF|S491iWt(EO#S`z2`A#n_2$$#QM1aC^|= zl?NMfnoM`alA@9o1rze2sTT`c7Cb;5_UWq9rw3!tFG!mgSXMND%+e+JiW_NS|Ig9% z@ECn&^to6nW9(@L7p~GK6|DB?XhxrYG7yU%z+3knw`zI8l6;h$QBgE4B)M$GyxR)q zFZVCfFNSHl(*w7D3FlR0St`zs)=O$h!SZGE1H}cfwRE}IweCjg;~4`V}wJGEaxY6Lv|>ZqoFd#!SmrsS+Dauv>y3Vs3+;$CX9PRxC*? z3@k~@FSw&;^Dhe!_U*O3sDp-{7@s}0^JZKXumzLh{NzL@%I8gI1 zS?v)uyju0H7ChqS552i)`NFBw{Nt9)FI`!1 zBdp$?>evVM{Q7Co2uFz(QHBn?P!w!pCvOiH7o%V&)(b>|MmWkvjDk&AFAxP9+LhgH z);^5*o9i)dP%uA#Ss-mC$|X(YbljM+s+?5Lp@&A?S&=#HtSa+NWvf{kc{3^Nxuvqr zq|97(R+jmsvfZT2{B%~Pk1EF)4Rt`8ahk{B4-i}9h@N%qTU{ks?gA3Kv$;NY}ROt#i`9>|6ROv>7s1xeTaBrx9(Jm zu^j=~dQxFU-KiAuTPnt}Ixp%^WghxM)XCEx%ydn9*aj zv6xKGvtINz;h$EJUvN#@{CV?5=(w@tt`REi@(XNsi&YC0EXx=?Txei2Iw2`kxLbse z7#t1eRTq zCZc3$SyTLDcum4oy;QByDv&0IgXM*X2TNU@GFvF&JUIBX}V6o|03{Ens|op29*!CC*$QHbz!z8GJ0AcGqS6&V#x(%=G9h zD~RK_{4T^O{O)6ztb}Y~&n?Da@R{}HWM8S(^}C9`+E3*LnGGFFr;%;iH^9VyrN;4V z${8G%PPh#{-`!{KwiwvOelX z_Tt&6_7K8-UCsLxb8#MY%e&E-+hp$uf}(tgeD^){3KB9nWu$-Ttn zUTSg|o7^QPcd5y3u5WXFt<-)d%bOA7aBxpuiVp|BqbcmFMD^#a`10!v0`PZ-n-r@E?a|$SZNJQq&NoiGPPT77e1dkT)E_VS zrfB_TdB7>k>q}|RDJ5fr@|*n`{qM2LGCtek(WJ_=6rkh`83PI ziyp#ziCSklUSjGdN-VRWS(qt^;>kf-cj1xw6Fk6S9)K`UMrWR*GOUw5GGA;%{Jw)c zoM%TI=8==I7^dP1dyvPgp(nl_kjj@bE--bIB@Xk*0RuK2wN@;kW*Nx;9r+z8(^hG* z924b@m=wh17d8V&N;h zB3CE-S;-J#KXBN7VCquTw_|3WM9g`lh;jgCxZsig46_X4{|+1O$NjvE4Varq5pjXT zHUNihI2RAftsb1BJ+P1BE}sArrGIaU$xpGclY*#xZI5Id2_V8Y;IM7LVcXJl z9mV5EL+z4B`RE~dfWth%7vf3e1WSl0XJEz^Jkp{YUjk_8ezu(nS&z{m~od%OpbdcW;}`| zM?VXGHg<@xEmg;Yf2xjoSz4y)_{TUU_SLaS3z!@)N`LD9Nn-Me@78h7o-XkxzDv7TGE|YjT@H&aJfvY7B0M|-Pn;(>zHaAMV z06M!QUJCq_#6JUWk@z0qHi>J2Uy-;8__)N+0iTrkCEyPwejE6V#2*8nmH12GZzaaC zs>XeXSypb~IEjA*oG5Vyut(xCz^M{X0Ul()pcFjeejc3jprh)v7?|yrX|b>FE%6#) zkHi~*Qzd5Ko-T1c@DPa`fhpt(_sPJm@Kcnt7!5>Ekck@!~NHi;Jj zACveF;5Q|%0H)A}@VyDR4*sexh!dp_?=`9}9tHMDe_{%G!u>z+MD)XoCkI&Z%m7wA zw*Y%&-1)$%5*GohI$Z`lMEb7<9wqTzz^YE~0nU>Cb-;PvXoph>zjCT;g|dR%Q4;aGCV~GtTQI{%@Q^2LFu` z<2`=(8gT&EO8=g~4@x`$xL)ERz>N~~dygk1o(#N8;#+{9l9=DiJ}2>F;1-Fwp23R} zR{^(4%;tCIhVXAp z;2H3DN&iK_i4yZ2S#ODhz#fS=0jEm*0C2j*4+9U8csKAUiC+XBD{&iemc%E3vnBp3 z@Jxx%0?(27B74U*H~?5(gI593=V+i9ZKkB(cK*AaVHj5%Rth z_dAvMXMk1P_%*P~?_pq%jQb|A%I^ojDvy5wR&C=OV3kJ;ZX{!6+*n|hM>nv_mls&& z>q=miuVKIx)>rs<5HNp0DVw_iE1UTqLD}2~*dybn0xO$`0xO$u09H0n09H2V0xO&6 z0xO$u16DS#1Xebe0V|s~0O!kex#qqq|82m<(tjr~h4~8qE(1OSf0eI~fs>?;1D+m< zgUSXxno4k%>RHnf@(xc zc_Gfl#JKqvD56fPs{HYl0zOqZU#Z}l;2f+AkayNHl)ef;QJrV?l&dCRh5OZ28N-Jo z9euHwu-C9IUe|W@8r;AYrNgsbI^M){yIGIVg-Vp(Z=px*lL23O z^=HF1aMK=!G2V6)pAUXKlqf##H)`ZdO77r8P?+yl6JHs^BH1_7#5c;ohgZL0z9A;Q zjR^DMP@?R++QgS<;A3&C{N98DHkRKj2#aLjMCcjwyUxJJM|8#KHSrxs7=J4$QTFvV z@iiLwIIgAm3W1IG@%=_5`vNkK4`<3N20jdLhWYp^*U0CA<4Q)5qU_6no7gA)&lvbP z2BhqJ3zcK!7DqN8}iHYp&s+~CtGK}C&0(|uu2r)N$3&#WI&mLk3)=#ui3=+3i#MJ zDN%e+n)o(?kH1M-eoSBS{ldieCivtqrl3@Ol_tJN4SZe$AKzVpBHT~LStHl)WE0)~|W5xkZRK0{%*kX@m+7?dkTC$ge##Qh3`~}eRM$TL54rU$DwtG(T;c%-&f#^)c#y1z868J z+TYa%zSF=^4Y!wX!58WJ{iBTI!N`^Ttu^&moE)n1%i%ti z-`OU<;o$QjTnY6kGfaFb20jkyDZW$_->P%i*Vn|CW#Hq`p5ptv>HfA3e0Hf9|e5yUOy(+%@QU1pIc{0K`5zAkqCh+KV4;_E%249A%&1+SxvKtbE6=MDdM+p3%O^;2Q-cwwGx*6rbC~ z$GM1{XQ@Q-#hds-;LCy%`DWlye7k@d9W+8#IrT8<6neyUIE;F0pf^`3;jGfVPhy`8 zJBD;wPfT|v4wY^N$c%jNgO7G8QG8bcP!HJ=G6e0G&%8>M-ar6ipA2{(>GIi$>E42a zVYK58^mj(Sb$G7LhQAWUR{}jF-!429EP@jGZpESaehX~mwSej z)<`~viRl*N zQ0ekF5TmPha36joJO#HB#n&Ak#6B7D1UhFAB9d<*4#j6Rm2(yr7%h`=cv5`dne2N7 z4>zh@Zj*Y<{(iJeqkV1QL)5UStaF}|QSVjg!IZEly)0SID!*@>L+=9<-#h2f`;AHO z59iRk-=z1abLa(4dVe{G9`|52=JzY;tqSM1qntVZZ>+aAG%(gL>unhhRd1Y!X5?Fh zA9oug@J)lBk#7wiB9BYH6$ZZlgp!f(Ecmh_@YO-j$TxjR$Mv?-z?TY4J~TTazTWy6 zrgVxhhBx6K&q^MJo>5d-5*m?l?ZyX@F2h(Z6s313@~hek{mGY&xC|eKgSN-vC=TS~ z{pRiA^&2m=cH_`%hIw?k@Y;>a7?=q8|Lb1J;S$pL3U+y59?q*5^ZY|)I26%^g{2wD z*rrsS@ytVA|9ZKFqlr4B3%5q0r`i)LhO*Mt@2T<;(5Wx2as)onqC*1y*3Xwi9o^&z)_X;n_CfYhl+A*jC+QwxfS7JJ<{a2KJRk|yNWt4t&QK36gBnGr4^bs z^-$6j+mMg0Gb|YjBip;L%PP8?=loayThqw*& zpPQ`}tF%3>91q+%> zLf-U+Ew0lbTHikoX}CTW8qFoO@$TEY<*rY{ysa%s%U#i#y*2lvwzbw!YidbtPG!&4 zSlq7Rr5?H&ng%lt<#sV+YvSOS`VP9p<;?t3`)R-XKb@|H3sS8P?BREZwW6OkC~5s> ztD`>_uN^dVz1y0ZuC=u`w0clh2b`IGHCIxbH!Z5_=UDo$u+GtIrpsQjxjikm&zX>A z{WDg_bsEcLk;)OXCmk`d9gf`DF4qc2s@72j$ZMZ7{d0$}wH6j;A7_HSHz3JZofR(4 zH6yc+Cj17)I?&prIcwPjx}VNK@mARNaIyXFTI;LUv-HKD(W8-sBNqSMldSvJ$A(}v z%6`jrmsM|Qao2r{ZH*5fbZJ{2jOo?%?8q+JeDpj-Fa-yx2`Ft zb{;`kr6ss?d!^Tvd#imy{KO#I)}FRw_5X}J;C$xcOZK!qPuTsLr7?Tj9tLdo{%u(Q zstqkqrytuNr}gq_p>4k1{(Vn=8LO4u;|WgECe7$I_U5{0QseanER{Lt^RRMk8rd7k z!>EQT$WTf+T>xz3X+7cijJ1O7t+yU~As!k`S`>=R zate~>9_h%k{X1?V&n%mGA|;Lf-hIl_XvG4@%?UcATJO^JGTfrKF%^@!AIBP_MLC~E zP4y~> zuiot68tN5V|E!}jDtYJcu)JryyBD_j*6VdjjC)Az!cFMbrZ5F8g6TM3a=Kh@O71Qd z>onUdlC{+(Grc>a7Wz**v{z#gcU8^~=K<`G4kNHDwL@#VId#(ni+i+nveWg*VteuE z`M9AtUbTm);Y)5AxM|{DgR``Wg}r9xTEAbFvBN33pym`xxX?gzm&=-ry_Fk7Ib~HX zwegkRYD>zFw4l5WaA#?p8!b5ZIpbv~(WP-k@L(DG7h99{;v71{#v38_* z3fBx$Y>wAMzhp#chgcTq+NLrXslbJ$SJCr{ehK}sx1lXAlyR`_43uHnq2IS-iLUu+ zTn%lcXUL#&H;$P)D|`C5u~=o_^b0g;ZD%r zk>R?Vzv?^0rs2nqL2Tj+iw+MP-t>%=_FQZse{x44kWDl5@yWSEY~m|ZqdT#~0c3-{ zMzM)E#T`C2F>}`F_H;OaY+dY0(R#s7%0)O5ps_%@=|}4>GdzgX-NWSOIG+-RFEF`5 z85V|rBKi5AD*;dbH=5GpJboqAf7BHJW0RZvbt$1f_li(L_kSw~&UEuVoD#YZnB0$; z;@eI3+-=f-!{p|;niBGFHn~5SZoDQ${x8$6GsQO~C+w}49v++%w9Cb}5JvtrCVs2Q zJ;OjqdpN$LgzgNJyQj$>HfM`$c6{Gtk-v)=*CLxIPnIP7gYb0%{i)`WnB#on{e--H z&{+tb(Krv0I0xt95--G=?+(cGGn{?Ic<)BZ!omIYDA_nHcyB_Pj>B@Xfcl(nHfYEk z92UGQq%doVGQZ3cG4q!!G0nSHV&-*+#LU{$5;NcXB!+p~A0+nS%(h0(u{b+X?!>fr zfW)+y-;U6q<+N7f6yOaKrvkIisWTav?`w!X!2C{!I31Yd{lqLwJI=)9NsyR4(|3UiVAhrt^bmTYFbX$7pp3%fV(lP7I;=w;i91e?DK>gc- zWF7NegIebxUSjgm4*HXiH2Jcs$Ge^uz(?K7Ky;*zFLXNhlQJk4*59mf%??py_1;bK(VCj zXJKcCj)k3a&_a|y-Um~J%|mo7Y#yp(VY9TKeT4eP*F!AZ42EXH>rXH)*P>vWygZ1R zCaH;;=4gqT<|2t1PvjRmO!I!}PyDgOO#ds1JvfIyQ|XwxSzNGKe05TEhiSg1F@O_h zjq^PjhIz6$#44>3Vs;G`lWrLit3RG6V%N}cL~veno|v73)rU4}dM*v(lGWkeD4CG( zxJo3T^k`uxJxsgp3KApGBgd*1PF2(Z9c>9Y#V}TjjS7IsRg1Pfn6c%E6?9Ov! zFQC@NP%Nv9FK;fyWYkhA(Aa|I+?=yu@%+WbG+FFxxdh7zUp4;58EMGM{M*BY1@%JY zdD%kks!lWd6kJF z*4Me_xU

    VdhEZ;b28Bt(=R+D?2B`e3lk;m@g{3lMmM7E*LgMeo_=JAL)zhfeWy! zWaN}^^ zC9|GV)0_;_z1_Q`;axFOOW@=;&$u?&oS+!Jyg{FG3SqT=|3 z3$}re_YU&${-pSh0UP)Fe4NJ<$-bE;J|AwT%0Av#m3_R|8u>89|D&?+&<$ebPS(&p9f;{OzRp z{%q~cmxRX2`ck6!K7gK)FAsbvP-6WuKZ@_Di7y3w^08J>D!!LYeCrH+d@NLaTaZ~} zekX&E&oxREUk#LqeKMfYkYDO6zGWu9h2Zlr0V#@aiHYwF`0}8`{Hkk_<&=R4j1C$h zA^hG+k(ejNHwb{(M^8vL8p$G@$>+hrF!J>RF!DVCKE8`mLOqHbfY?U|!I!kK)@ zI2cAgez(u)gK3OX>RzXig&nVQRjDenUteE{h zh4xXDUU%3B)vz>!uh^!C^EUD-OIu-wPBP_#Rwg@$7ckT0r9Y-7Vf zq1w`MMtjgaNaK*6Ry+Dx&4)v?c58QP4&hq@rypyH&>Crzr5JVOgPUU2oLDo%(cVK| z23)+B+(?Icz!;p%>7J({14-Jd=wO4kzQ<)Xk7`?bbVng=>0!m-#x`6+R&85*J4&G8 z5gT@^JN*4OBNDgAhpeG!?EK}5c8z>|#IT2=54p6$o2?aBX#Fqce^)OQM$O~x*KW5S zxWvnL$)Uk!f@c*4XAAOAaktQC%5f#N(giuJs{N18}`fWY30Ysphz z=c$>l)p{$3AZ$ysWzFAfrdt~09RoF2Y{=@eEw+hDb@jw(IJRrU<4nR{%l3Fs?BKZJ zwOcK&9_e>^`X^Z{Fg_gf`28GO-E&6n#`uwatZWn@Jik5w_PIY_HfaG{%j9RM}cZyF^=Kn^f0>#`f5% zw^yLBuuWd4`Xj&Yt=j0Y4-#Bav+V9uY=yO2ZFJ$ROT4_6f;}|Uadn6p@p43K9z2kz z&2igMDs?x`@{0EN%m}u&RSC1=8=c|tN#?W4vmnWeYH-CKY>j@sHU8A28q3fr>|b+s zK&mzK28=kx@6AZ{I#Q5hG-i+;>QAx^lF2b_oeVaCuOdSWUV4o?+BM6I7JINYesUUu zCF$mxm^N=|tEh1s_FLqLC_+Vo&0e8*$fKeDGhgQD`TEUkkbLkxdu2vr!a+6en-;S< z*)h=DoI!n#!WvmH_Mc=uv|o>X12jNT^^?`+_}1o(T`OC3g3e|%W}plXundgDgs5W| zM~pFBq@y!JHK}?H*PX1<_TOShOY}L$zJ`5axWaAdZ`jwUeh2*!`XYx$4Ym=#)ckEY z#yP<-Z;!>+$!)>o-KxqP+R$J1-Uv%Y7QE=M$5>?8p0;rN7ZVQLAF^^=+uL6k^@vxk z9Zq?jxSPV&Q_)M4JoA#Ym5J;^$_nF9R%N+y{`U6qmqY=tzdt!-%T2PEu$PzjhaT=v z;#b>3PS>R?lP0)gD&n=tr-iM1l1N@Qj?H&VB0IPBiPp?_+Cw(?S*N$Xy(3EqLVYx} z#_txBDn#8h_Grr(e}6PgM!K06+ODf%0Cn)UHTCUtLL!w=bah+YmIo~^SIthXx>j5o zJ-ctyw8wi!Z^LEM)9UbQNOBe0_e#t~N=C<%>DB7Iupm_9Zr1k3BfaMM?LFMLMGdqe zjk3Fh#YvXMPWB^@#p&rDh{0Ljs&W&)YRd?D*WZ_=+o!x6zHG~Y&uiFfvb)mGY~;mz z=!JILl#~qb^*wvLtQF6mgU_A>FI? z&m7k83r4u_v=uJ6 zI#d$kd@XmQ6}@85eweLgvxZVvm5A=pHYanA=#= zoYCez?mr!WHV2e6H{_Ies5bwWq*zxBZa%JVsri2xG_kn$NgWiN1Z+wF{ZhJ{xpfV@qugnPLRC+^!%J@*pxvEj*p|zv`Dns4r zjFPt%*U%=^M3xh^>HcF}oqxopqVfqPt8-=rMtge=_FgvC+q2Z0gbK7Sj)h?d9PX;_ zh4UsZ+!S)~mbRqU-Pp~2rvpu1!(4||C9krr&3bJ_>xA8*ZLo1SY;1*%ujw{oyWY0I z@$%C--&r$bv;*BL`kz}Fd)byqWs)9<$?V1F2R?I%x?2Bi6s&f*wNQC(7M~j$OAw@& zce8(cx%(4a^QKU&Y#NO@Y#L5B4QFExn#QVL+h5x*+P^4wPJuZa5b5OJqJ=KSzTdHI ze5wq2y;$8dt)YeZSNmFHD=ONHipxO7b-jQ@<%xe?;;;Ij#~05es7Le@JFFowc{9uE zPP8`L+%H>dH@NF8ZL$5=I1A^vL(zpviLx1W6W4~9&m7MteIm}hmf0S3F68H|7HY;n z+3|#*=Y{36jqtf1ZayQ4ho_`IXNs2Gf&CWqJ=v3ttx4j4!?cdm_|2*$(wq(z#&g#> z8T@h5Azk;e;M6R+CA_~WTn@5@_2uAB z*sXq9>mD|3m?{29llumfd$h?t&g9NAxjR>~O^o1msMxfr9S$HHz5@FK*Osu>=_ZWkY+RyTN2%2=4H|M{kC!IYY{==F}*6DS;H~a}8t)_lrot+o&zlt=r?#EGB-Arz>InD3g7U zsz96>UTP}e4W{tVP3|gFc?~ti|C6cwdz->%n)nWy+%^+GzcE)rd%dRo@mnv7ULL91 zCfT0oNBzSlK7J!jnT#U=Ga?2Fmp+c1fENh?Q+iwnmGU8u1dI^eA>;F%XTtx(+}prM zRh{|ccV_ZN7%+)3MnpRU5d#8E05K@G6F`gz7ATEir7*ln5F`W;aIq#+3KMF(kXlJn z?Ix*}h-C$;HMp`R)MBJ+#o85Z-4(an+84XxTD4To|NA}nc_wFWCg8sOKK(zRxpSX$ z&U3!!IWPC#bI*CsxtRTbS@KtA+!LKap7hR<_F4p-JSXC85w|Np*_oE)p6a|H`71Yg z*EyR6Z-{YEcTPzDcxTFUW;*jd<@*(n8)6B&7fy%Mrb0>WWXv3~q{~yjU@%Scbn;N! z3085w=rurih8GLZa9$ri0)Qeod_&2(JO1phPPZwCLG@C(8JM)*14PYJ&Se7Eq+!BcOoUzWSt ziiF6^V~qN#tp&?b?XQ?m9}5%2GE$oj=8bz~l31o{+e3V{?J;c<*I*X>*mUU6vgPwY zWyT6mna>GNeZL?)%V(wVO#eRNDbprA({C5P5a&+esmsrW58?c8!ZWYG6P|f}U-$^l z*(^8c$^3EuXYwKNmk7_emkZBgxk~sF@Y956nQ{LPjk`>E#;q2f>E0ncbtb7jTRQlB z7Ko6q)Me=9lWv8nQx+bG`S&qV5V5o#sh{pQ&tSDVVVUaw@fGCh0a}Pdzt^#xymV1m z{=Td52dc*5V?}`0;qYB;Sa%O#d4O-G|7TtQTJjN>-$I@@4-lUL`MjBd%>4v>8u-g_ z(4ToF9Qh#5Q-o)}XITE97oKHc?m3WW8StLZxNHN|hkOXad@HgZ93*o8r8^YJ({0HHw^Phy@g0sWAh7K%hV|N6ebuwD~CxRa*d<6WJ z!ZY7D3cnEiD&d!a=bRNWsZX8othajMS#K@Ev#$7jr2Izkj|?Jd6tdwXGD^b8*DSX zbTPIB#y-u}>lfJ}jN_Vir3i30UzUJsNG{!2&D}-`Kxfsegj02}Qc9hS*Vj!$5hVd6 ziH~BNbQG8yIwutM23o1Q+QJ?RTNYQ>z&w!VXNiJfc5$r5se0{NDPVVx>mK7mO%kYX z4OjxbjI@$uG-i*o$e0y7*%aif`TewF}m*ULdKN z)>gBW?Ux10t!%3ntzWlvtqI^R(jM>B3R93tSn>O?WW3c_m!_2U>MvJZvqE5JSn5PAy$FwHGE6WYT7_9TDoN2%C)$%nR!|#CcLChl0A*wlI6*sluU}cbnz1P z@|c+3x?pkiwgpSD8F}h_pe^@(t71ELuSL6wvO*SBt)mU6=7wcX?;2P+u3nY!rk*(T z!Znx0ZD=3dA>9=5C)pw$O>4>0MeDKkcZ!N~LsSi>$L5CJ5teWpb=#ln!Q|5HA)eB% z6oHgkYnznzvNi2hx{P9NAMI^t9`n;a8*WOu#GblqH&m@#ynHmacUZa9t_e>p%`S4{ z2}xb~)cp*5P@~{I65ia&jTYB9jghHc-)*T+Sudz*C7%eg4@ocJnXGkhO}4>h17e<~ z0hyL+tbxvC$g0JT@{(sOcmL--tMAhA3MvL~7Uo95`)Ch>H%p6GS8tN1<(X1RC1#*f z1?bh49M)Sg_aU7~Hl=FP74V2^3W|vWGl}(<{vTQWI?h|@90sI6$J6ie61ZH(2kAz) z)6f^ekjD^;A@(C}(!Sy!{JrJaA68Pi14!4#i$FlbD62g8#U&r1Cuj%y!0cDf#X)}_ zbno)uO@Ut+hZ5yT4IaGvEIj5-@yg(^^;<4s#2_i&Sjdr&&=b^d;ju5Qc;|ZXRw7Kg z)r^+F8|cA%)WXASUjok$U|YW}2xEFmOqcWrRIV*|H~fa15cf~zegir35eYktbg3W9 znXicqV>v(LsoxIq$H|c5Jq0-%?}U{Pyv`-?zURSv3SpyMs3g1=58khVR|E;_$JaNe zMg8stW9Ro>_;H>?iE^a7Jmr#uNY!qT`B%9+Jmr#wcP+kSGF`l0CDN_*;MD?;^C3!# z$2EH7BN9*synT=*9$&v0#(cbsmn}OVI}i_|2~xb@g0bbep0_X|<>Jv3t4!&&l)aIL$ni*3(u44_lyVc0pOiL zIQ1JMa@6lJkA6h}=6tA<;_dU`ZN~dI$A*YkgoAR#E5SY6uHTUo4?%_$?=r}dkGS5> z6b$}o`3-}g;-!1=N`RND{2UM7Obf5r!W-nhKLd~B9ZIU-d7k!iGw=!_#QcuHq57Rd zdD;1$1H9=9CUSKC5ps5Z*8xwj-;pB6{13%p_mw-11{;ZF2I23P{r+%M8yGT{P%RTj5jGKzq?|2Just4~S;N6aJC8kR%_uxf< zr}bNgaMka5Fn0M($HP=Hh@<>7V8}=4391I3ULRM&%`m!u0LI3f2|T8!L^;wwf*~KF z1GL$~>yhR?lmmrs_T;_Z7QG$MFA<&raWE`4qxd$(Z!b+8H zu}3Z+a;efC>Pff4N_VQ2?$dZa+T}MLc=#nq^ZT$zZZ3q%6H;zI=zI`zj1!>)v=HeQ z;mrJAhePvQ?RoCs2fS4Io#&Bz0CGcsqon%Hft;Q07AwEgA*|{C%yU2O0-jIA*}k%!}ZVl;604=I`HiG3Wo7mDCwe_ z4gC>vsqRBx^rZVJ($)LM=MhuW-31`xGK};g@Rqo&`PX!(NPTF~LYZ4pH|0nNA!o0< z`8CpoDyIAxu5y3IeNFQ~f8v!$8n{G_e#{qM2=M~kvrXgK*4>O5Q&tu-boO;O{5B1V z_jy_>oUhvb*tLr^HhztHO|Xk?>!h*l>*?4laU+(5Bs}30&xIje1&nOHo>w%UA3OSS zaKf%KA9k6dO@6}c+%l*`%E{@}8N=P!v5&EVBI2eU@=wL5#dF)u9%KPyCx7W6|BzRI z>>BPeemP#t4jfy4OFe3GSs;MEpqy6_CY zNqD`dXk5B|xNne5Tq!E1lP~vUhUvVikx>x(%Qb9p7zko|YR7}Fkl{@f9iicrNcCzA zXDx6S_E+5&t}LN|i}HeKq>b6EPauofqhHWH?#O&dsXzD|?ThrySark=&#m5ZrIAVoGAc z%GJ>&iCb^4fljuQPeLE!!mzJieyb;F-SqXkiGU$5mxSDpds5IQyD^0v9#;ucIod0b zk4Q)((q!KYuc}5LhB4k84_*X*yeB9r-se1c`+!#jA>#27qIlm2579(ETEM63+w6uv z<3w@5%44B@8D+ipTZ7HeMR* z4HC>R`y`6@8}PP%Z^E7Go$aK=iQr7ivG8~cQatt(ZM-x%QkCBni4(z@#J!_5zxLQ$ z5yEV|ARN3mDluKsr*M#u;2@2&@a(a-sfbU!5+em01UQxm&lAIVaL+BCmAHo7CUrgm z#_lWe`XI5KNh-(vx$sL+BLi^o#A}AS^ErcSdP7aLI?-7=TVJWPbNM39df6h6QV4=7p~-ose6cHzu4nJDfWy zoKuHB7kB%7C~ddER+U%D5~uX%0w;3c49m{IE?Vu668*la+RyyeH|cB*c>@3~-8 z=_al#!Rm$u7x3h8InGFRubo6h@ zqi-<(*Eq(cVl>UVd^r9)WZ#!RNj$m5e-cq6qtB>M8bMxZKdJcNWZT^h?BocY{e3Up z`HXZ7`E2)_9+$>ue=gH$mP~WpfJ?A#>b<@zJFy2U#}m1yuT9*8*Cy_{nDnZJt+j7P>%x~*QdQF`K3u^?>&f%Jo3YwpGf_LjQlW9c(L;fsUP-5{fQk| zT(JOVYxylB;nK^CZEamIw-|g|Zp~M@ntT_iT3d?VOk=*hva~<*@NcsvY<4<((y#_-rK1a8E zC}2jpZFj`ESIXCwkMsnB3t)G~uS)s3;gdY!lbwepoP9*U8GY^%3Bcn0j}q>-rzt&w z-~zCc=9n$Xy}qt-9r7P=rh44hICh_f#3od$?TT$ zU;xW>hSZO`rFqh6!aF?j)h5LKV|+UWx-a*Hb52Q#;e5|jqWeZqc%jGrSC4+LdEBg5 zCE|Tk9XQi{i3jhHC;T&>@L`hQ63FFZH=`p`{;vCrPFhmlhh*d{X^=-kZo1 zhj%3M`fi#Omz@X@-)p(%fW$j8dCK!1q-zntChIRvlkHCJ{W%}2_WnbKPo&F%d=Rs$ z_VRT5=J4Ou)%OLLXB@SE=R9|k{kt?k=FNAbE6+gJj<0; zm@khWGtLM;AwL&^AS1&}fOxOsx5BBHsTc4G`FWI({b+}|JpX+h2nCt^4tII}C*}8x zuD{9eNS8PH1)spb+4VR2+xh*p>u>T4J|T}hUWy>2KPwQ#Y~){USa&TEc*+lq|RBrQ``QyD7P z0{BF}zU2Cwe93K@VXR-0(K+Dq)Wb(XkgY$j5glLV7>rNGk=Yb{%p53$!$(0-5f0r0 zzL>n+d`6PL2!9~efoG!w2WUV>2VRIEqXWS}Mh8|9D1;+vt>Gy8y6aGVB`$B$8td|! z7R#wuT5=-}A?$yG$;-bNCOd_o|7-o(#!Xu6M1o9NUFGtoeAtLUrjE*8K7^C5ZDLXS zu66y3$xn0nw2XeibMnqByzt`CkV}d$8(lhXeA$%~KRfA~it7{O=rob7zIE~1QeEg` z4@oBm@XcbDq&S|S-YYy@P+k9^s6EN`THl}|9LdI@el?8wVfSopyUe)uLIrC^fkAjL z)Ri}89YE43f1d(o(tx32(9A(N&rC$>P!rKL)bBfLU*U;VrF_iTUy5W?1Sg_0zfy=2 zU8giOv&o@73kDdTBFv7SB3Lqvsw+ogd7f8tU;|bTo>RTdd zO^$n0Nr7>u_@31|askLf9V?r-LD`;~aFQqWP4aMCn0RTfDdpZ_+4N*lkDD$RJji+; zcX^AJfE8fFSl*sHYOfHxO07UITB_~fEofIwSp<}H4fYO66kaNEW=z)-t-Kwd2UxPC z2E~zhPPrxLE?8tSVL@9>&lc-$sF_3V9muQ1!s&S;B?a`k89X&hl3Z*qkDghcUh}e} zrO9D~_0rL$?(_ST{MVuLBi%eBJ~q#BTG$~H^2vE7&gAv=ah&+;iG3;3{Wc|)yBI>`BNFf^(q%u3`Cy-nVa!LC2X7txq+15gmE$?!!J};%yRO8;Yi9zl z9}3CV?@@#?9VOL|^S8EswDD5?D6jgxjd2?r?=Zq5IFuBRYhY|VzRwmxi2AYnuXy~{ zmyJh9D*d>Qz{V>Bp6bW)R=oES-^Sy7u5_m%<;wB=4*YGrnU;QN+6g?`_1Jh*;7Fz4 zw>)_3EdAKGR{g&0!J7%UbjPWdk>h!j2k&l6KaN)@9>1*w(Zuz3x5Og`iE^Z!p7PrV zJm!P-!E#i*4IaE5z>`-rNcG^=c<`RI@OYgl-u+-~{T_gW?OjRrYXn0+A^}}i`SCrG zVbu34U~Iha!y&JPCMM-bUj{=yLI>z|3-4mM8AiOfJlDswedzb5=lb}-!V6h=FM04@ z0v^XPlvKZ;dGK;@QD}P}0%6tf$&BRu{;?1J9*3Nr-(m}|$imz0!Fv~YAyrP~=xp=g zMJ&8wBFFOkndd&qaW{^wDQSLh^vH!E7giyhRqjjB2fsvno&q_hqoi{4AVfYQ0dt`r z<(A>#*c-#>F8AQg1YQXKN{TnpgSP~DMGzw1NF0h6@zifM@DziX%JZ9hxFic<|N%Plk_7JjDxn@b0njc;8n%evb`VNt9oEANt)O{t=T3p5+!E(^tGP9=z|v zovJ;L^5A{n!ebvm@h$;l>&G>6sqP0M$T3a?2dM*idVP$CTk-mN@SX);s`~-gX4!Zz zSa@X?-X>3d&`v6qe(OB-@ur1$rG@t;58k`LOI3dJJb3K9XnrSJcwfhLX_sG6;z7g^ z^GJ$A&dzTk@bvm%e}Z9j-|oSq-Bl|6)_CxWEWC(?cbDfnFYW{HdmcGnSE>3@R zoi3jf3{z76phxZm-V=f>~tBx{)m#|y#Ws!Zw~N^ z;I|CNbO|HgGdOHK?(??|eoBh>6g!(1{@3{-XbtI9{1%;RUh21kZ~e7 zNQbR*o(VU@h&Kg{jrRcDA^0m%j`UeDp}oT6Qp9Yu-}1dP>>NtlVA^;uB_LT6u7Q-NnCiTwi3x|}Q8 zjc>)C<+4qBu>ZkU?si_kX7dO2(O743{jBnx#^cgZy?ThBt8PhM+1A)UJO?s39pWYZ)*szIuKqNOuMeL@^+`- zS|?01#aGrmvvYXeg#9p1Y^{&hnWZ^bXBQ0hb(}lok$c)(6#deq==`?M>LaawARgkE zFWT$k*%SNi!dEY@aze54hVLH67eVTGhQ3lh_!)BL@j;CvwqN(P5wX^F+v{Ro&h=fv z8Fj`MmC-A+{c(RRx}YKarRI3OKh|2iz3zznr3k;lFL<>dlG;9^;GKSzWBy#zSMI(aF{QgY5th7})7cRRj-oL4`U-vuVFTD|75DPE7KfURA@PdZug|X6f zTOaFoTTi0RB{inL9pmfL7e#X?Mb906G8R5ie>@i6U%x*V-WQAJ#9Hogzwgn1QA=$( zmdkZMm+^WU+uDRvSBx*19+(}?yK(Hm4P*Py4xd}Op8Ncp&k4lBxs}CE<+a@?Q|$U* z-^!{pH8QfWEtzrN*LP^Z z-mI7J^X(llVgHVA=e+za-`5AUu%*p%oTj>E7hDu;g@R+coQnO`MT_?aU@Pi>J>3aS zIXq%)<)a@53+p=@ch=VDRP2vMbBBasYkh7(hcDKOlxw=2(2~VmvpyQkibc;w z-s@-4S&qM0G%wbMSV(qnW;_aLB%OXFd~Tedfv9|SkO^(;a^mH5pDt9lDW(HmP8X_# zAJM9uc7D9B1ZA+Mpxu`cqC&RN>3mc{k^r)73;fx3ybk1o%c_{O_^!QGQ&75-B6bvxGp3%^n-@J3t zGfu%%1Ft)^DywW~!BoE~Dii=}Bb;BmWHFN2n~Bm7xTTMhuAK65{NzpX`jhefSfjYT zp{<{D;hwhZ9DG`3M{`d9`0l3PmUZIu8Te{ML69O#cz!!&$u zrM!Q(%EfU@qo67YZuwSAq@cz*Bag- zc-O*@YZG7enPBtBXZMjFr+Joh%u$Kqwd%l`?r{>n5q(asRs4=8{FffL-9Kmi(N_NG zzSSeY+mn8_NB(V3_%}Un%W3pI;K6^}H1)>ybFFnU6Xo89n74;&X7*pY`??;hFSd;i>OQ;i>PRgy*>Hhr(0eG?W{0 zsP6^BQ{Pd-vp>i6Pn4m)3x$t>H~UV*pJN%fi9hqf{cibZ&+;Q_ zIWs>#8nu9!AGIH1e4h+rn7ZJAImpz-`7Y1A`RD-(;m|$pO&!U=0rRYTM4LKdBoOng z7@*jcuCX8kWO-ojI}wYySL#PTZ+fNNHyYRa`*qzGwEDsAik}gw%@mkEWiW zdtjWoAAU->gbeZiNFJ}dhIqfS373kYHHhn#(=ZAszY=ofBlHBlfQy~iIB&<)hhcPk z$K-i$A3A`QfqkepBseZ%3+j!5y z&Ax_`;uXQe#@mQz+^^wBJU;Fi#{BZT6gD2`jP0_f9BCMYY`mNCoK*d2U#oZ-9=swH zF8eALx#>i_VT(s3*GuC#ZyVSF5xUy8$sOL?rb(6i7o#V5<4>vvvo$4Y9C_l%jqJBgY_#(17V&V;|{;*5{_ z4}@!>N##-JrgB-DzUu~~@vCD~?&t+yf1=E}%uO7eX?OFIfV`D@3GuxVS z4un73ispNt`<_*BrNgft#=;X~(c*^i747?XH_d4Xmo*p1TAq@@l~_xQ`<^}naSm~1 zZRK`)G5vxz9T7sTOAF`sNT(TTU_$gJC-%s9 zwlzO*WG1N0k#&7Ic#1wMgM8;*p!Lnj+yk7$(vFpFPJhp#PN^H-~TDr z0)O*ry4l63eBwXb!k=>aJF`cnceHlxEO`3e`1!TpDsOAq*wU2K5G@a5JJImCVb}S$ zKHFXU&GNy=;N2F!eAgiV)UIv}e^vgS(^$9bN&nHOx|dy;Klm>gsA{iE41B@=pSz*F zo5+#yp93}GrSd>hw%y_0&n-|@^e zEeKk@;hPt&npKsH!A@vEDK2q7QTk@NEG2h6P0G;2UD9gy2Rh!^*@VT>800GLb8J*D zO!uNsx=LNg_*UPh)~Z?a%I`!|zPvuVC_Jt`6FMNd`Pn$v@5i4Rz)6D_GQ%bJ^LAE5 zug)l#oCke^74>1t)eXnTIXlX`X1(sm3)ZOY*_|beI;$&VIR`pN?#=89o7mzx<{U5_ znu*sLZwkIMU_vP_7reO#kc4=5SW zr6Wxfr?R1+_z5y_DraXUgU-&JyR+aY7)vZ^K>YLrShR%`On|cqQ{93gC`JaOR zqdshJ0-fMBJ+mD7OGjHZ!xlVAWu~Z?vw4jVa|0=qI}6Q}KmXS7FN(5~F|qRQ?p1zl z1<-2lgK5tEKv`fyYpio*{Z6!+)_PxjR##Sh&6`>Ax(~8~Hz9UM`H3jJ9Gp zQVbl@oi-|?;2i>eoekmY^kFwf@SNs(O1wPQ6~b`ztn1_W>}WLBRa_s9uYqGtybk|$ z*N=^tQlj+24O@TN9X!9_Ux5^=x8k@!Q>~b4c*VvEqq@ttb|3&!B^3Q+%#?Q^3 z;>DxeIa2~j+Vpmyi{|LTcR?9OFnt&Hb9fZtV1I$c3)%E3*m2MUEZ-^hxIlt%a@N8` zn&-38{|mX#mrtKV+`i7#X>HW`WD1@w0}>uw*mcgmpBlL4zaDz5=#hna8J~XriU;ke zzhCK_@${(GcRzRWDuFybKIq=*@4Q{jK0c}P^oreIsOWe9vsb+Q_P9%4|FP@) z-}wIRX?Z84g$HK+>BQ-*b{X#T>8PE%9s7IQ>c1B$Sr{Eh&OP(vG?ex2;d; zKHqso@D3x64?FRU!$nX5p4W#D);@niIQ#PIE2_zNkTpx$feFG_@w;aYl|0?>Dlc+hr=VmY6hN%ti;|d$Nup5<|xydC%7Mj;4J|^E2a>GX5B%j5NDq^3vo+ zl4pXTaX5S-{DI1F_`-%Y%agY`~-mdD=<&+_<=@H4?b zAUw;4gpSAShuc6xV))r27*`?zRL`2#wR#dOEPT+JjDn>f0pMp!V}{r;fb+G zc!{1EABX9Q`Q9f^hJ2&kv(as|%M;fp217=-64&48#z_Q_X@_B#H|=nY%kxgn_3PvmdQ(qP_dFsncj(iAbRuy^5enEKZyHt4Uvq5<3^CRJ@ z`_sZx-<*Nj|BGpW%Q3)z>yl+-7A#*CU3`|=fWBnSGAnyPn1V~!j`;*|$xh0F_cTWQ_a&Y??y8)PubJzv^L@0GtO>(>k9}n zm$7u!;#EE00830F;Gy_jaC|HPvAmCRElgPo!o8Bs^DFxziA$O5Y#6O2p`zVaQ z{917}2SjUH#`S<6`Sh6~!0>(mnevyVD;;<=4qfC@L}GRg?w`Uq;o>|ATHx% zNIc$8Ew}{#_wb~DMC7*MA;5e7P#n~UVRWwtW8;;dp19%niBObDz z(2wgcY`k~jRt$(G_&MSqp(hCsajjpz*)k5@<2-mDzip6 z5CB37CUSH(dGHE>HwXShaj-k2`qg>xA_%Bu0SKvnn>~0dfwvGc#AE+Y@qQ29F2BQQ zoNUudiuWJzARm!{XMxuao_OpRDIWVRHXiMx`QD(Uct_x2Aw@lShatDngt&i9mq&NN#Z|memOBoiqKbFiBbS4V z=dcRlta6uwAzvb4FFnDB61oujvZ5rC`019Eqm^AFz%C3#ncDGRqh#hY98oM zJldBqoUgjfE2gbD zV0>-f6?2@Q$Q)yxv&tV#pO-ri`-|pJ98ibX)C^^A9?96(j z)9jR+f${pp#0R2bOdOHuXCnPXBE>hrR2i>DZ@1?{0-=Yp3x3L}roHaGNu~e8co zPsP(3^PASxV^*Wkl?xVb8}#X5c1C}90&ny0Fk`l?`0C9a9X^^UK=lM4A<6& zDl0M!-c;;O&O!oH|+9HJ>E@s zwu2p75yRMiW8SI3rx>E*ri_9YKirDf5;LJ-Jl*+;S}DKUo^N0TGdEqb>AX$pN8Cb! zQT}V`ERq#0v+W};db`a8xOV2-jed{3xUG4Bcynjif@UAeE^S$1K|CEv4x8(*Jn?b- zyvq2;M{!Fnu218vfYzYnNZPeWd(S&JAL;R{-QUCaMDBwVEX+N}{mYgY##$b5C;wlx3tTIGiDi&m{~@*O`Oh~^y-f*w+xzaDkdU` zhB5(MtTWP>9Sp4L?k@PIqNdV@u8~dAhR(==XGR{Jb)akT!MX#_ z3_iH#K-ai~tp}bNcW~!{uKa_Y2cF44xc{de2T%U=;KAe9&%OS-RoMn*2uz;+uV*?P zrj1a0RPljKOlUWRKeestmRR`8hHz+G)0a@xd(&Vh>xad0di(K?ljQD5Yv13|N$%A^ z`_7J5a#se>%Ie59``c%AM9H1@nd#H|aC`Y7f1GoA59PL(3X5H=3$w3(FkVpE_};4Q zQGrAOWI7u&YNErhKvN7mGXhuS`HzO2ts$o-JbdeLm?0F$x<16Uvl-1dZH9mA`LO2I z(nW=!bSDm&WhSuFof+Ac?*@j$gnoEKc*OSMUculh%&Hoxdwi%mh%MWQ>FE(@6hWEg zE|``!)$btiiag&8f7z);osqVq-QsSTl7;#tr3mK zv92TIweI1V-}dGeiKO%9G9&xwOUwdudeAEtoN=%fVwI;)OgMEUJp4eITKu#fTGsER z!rKG3f}S*jGf>5de5EfDwXG}P*q0;SvQtxU&~#1qys@t~v18#8m3P1xU^p!wMwFdu zY(cB4Srx<&>s zL{8~bx#D%ZNT5a6IMvmd*LSkqvfl>2TUDX5Q(Fgg^VX5#nNo{q&t3nC{keJk5%-+8 z&V1jgJ$&Zyly@kkG2Yxq3m(X*FW(d$z9tqfte@4^S%k8IwiD{6eWm}#Sf*3(W?I2- zvVw!)Ew}fwH3jdS3+G;cN8NLL1Y!Ghm^jcUfPKN!u-SKpS)8*f+en#cmG7l-`|?p) zXx^PAu1Q1@uANRi5wK*k?k#*nsJ;|n;qLCz?(W^+^>4j|7sj?`|ItNcMrCgs zKFXrq-DPWLq3s7y18dAVlVe_&-s_)wqce|l)q4Zf?nLy>SpW_C3s&S0FWno6uYn7( zGM!*v)ZB|R@Hj>F8l=kY1Lx&dh2w$7bDK`qAIAzE=!OVi_Xqt@Wa}tgY)3~rJG;Ag z4VpA6d*hnQ>~n$zklD+p&LNXs_mN)NHZY#qc)p^TA`SX)X{MdgUjNijyV*eTR%ZRa zDQuO9<8;ER#1u!I#j$&+f9s*{co@k~9f2D!(ma+K9O3GP6p^;17|ZNx?bykjXG*Sd zn;w%9^l!buX+H^nsjcPVxw!?~14(5u0#A}d*=`w3b8FHnz2ee>?I<);cE#oBhn(!# z+0_a}=vUATrA(r5Bw7zD8CjeAD=TBDYCL-fo~Zk1pvhQccvSYTyurxNk<%#@Z##YT z58bAGP9%fib}Jxv_Cu1RvNtsNk5+cKuc@5$9&w~GI!>Y)!m?!2dr+}`&D4J}*PL7s zwbrv;uaU&_9@nKl?_tk&CmO);S;NbRmre*z`vE#TM>-294nRA79UJ(r@WrEz;qBKM zZ)0S`iz3nQTeGZijT<941D66K-1Ko{v?JX7wfb;V?m^$Rh2?JWi!CiCyu;U+OFOMW z!z-WotARdf1Z4mF%HR9iI?09nzJo%u&PizW^zhl&9{^^W=G`Koe2co_U(*<^tq)bs%|sa*V5stgjINy> zvrI~_`QP+?kn3tVIXxr8Y47Zq)y3=D_!X=*b)A8px+#JB8w>qwy1TE=+}a5{vO-`k z4Lw?KHR@JhJE|H(&%ZPPr>tW-pf7@UJd^# z7m^!G&0}FzcIDJ_C)AloQEUCq#Qiy#aU-6qBk|nI7|FHdTPNccVlXVXP*OSj%`+%C z5YN@u0>8`sXds@JtN4t(u^>`;bO1h>QWrcQX_yp{;Dx;Z&n-3SBf$sz$I~0n!}?{D zoY8Lso}ELS_S~ak2bx#Teb-7%o(r!9B%K@Y^=CZOT{$(A>EM;QqpdRp{4PEWS7m3M z@3gme)WO5_JmzN?T$9ecv&eC4Ta~`;TT>>~xlua8&(Rx^f@o(_eo?%xV*N8Px_G^r z@PgaTHO2Bv$c=(MEy|zwukXk`%-oysjT(RLHxEB}LFmOS=asaHS=%o1FI!c3{Zjy= zSu-#SelN|K@9bf=<+#7Ts4<^QrLT}x$B8crS?yzd)R~aWD=6(qr-S9zMmyN-w!Qje zykU3wI&zPF?Z(3NR@{Hgd!Koc#5KeamVrO<;T!a`NRzI)_PQHF_y9?0=IrY#%jaAZ zy8fDZCd4uS*W57W454o9YbKu|a-V^2+`dyy9U>{-FnRX8nRBk0a;AjOB4g$J3zMc_ zH@UBjrwSC^Qw6cWW_ki(SNQzZKA)rZg#-R3-#FnOTS}?cg+?&uNxBt>AEW8d%K+R( z7;N*K(Q6ZI{(9SCarC{1dVd2GdA5jlS=^h1G~7r0i<~jyUTNGHIRBXx&e7iJ9hAALPkj zzDGV?!vBnTv|Bsu!LRegU+T$Erzf1>6jY*qOT|q)sXQlaf^K=jYV6jKR9@wurn`elhtF{y-yf_}pY%TbUuo+qFL%>hi=_d$>~JsmnFOQ67QdUz{4$t4<8dB}JasVkQs9X( zTl^_c@=+NO-AT4(Vk5}>&~|VIbToA*^ChP4#Lg^485SCdaB34qFQ3?iv5eFvjQRAj z06`OR_*iM62o4_=2Tj4Dc2pJQ2>_ao!zYv4Gs%yquR9;q)%{$`wugvZHzrATegqT){-ZxcR(^Yg+}$G3#1j-y$Rz@&~_gwF#1UEzb^Ifq6W z>hgy0EaTq_UkLucgl7>2*rp)Qyz={AKZAwjRT*~v_ zL7wt_Zjhe>{vP3r!S51&BzW4MYr0PfPn=%}&pLTac-GYgepjCUpB0||(}ZV!zaacN z@aDRJ4kh5Z*DBK*2mTwvGw%n4F9ZLW@DsuRO8DvE-x8kqq@?HIaMv$Le>MdNna*RvXW{&Y z@N7Tt3D2ZI7CwYCR!td9)(gMMtov-|3s1dBedbsCBqon?tuYO~)qD+m^rvIk!B{=^@cYY>ll&~FBrGQY-%xcB6#E?+{KJeR)&Cw{|= z>68o4bfUuJ%wc*bKs>2EOA5R{*2s$LBX;|1pP8H=iJi`H!FF*dHQO7@4DboHjx zCZ`LGRnmgB>lan8Uj&2JJ}pms392smaQf24i)oR)Kp-^4d?O`Vvv#RBz>3n7q{o<8 z((4J=Z=WbSKwRA^qMkiT_C!n#3|&`NEv8-Y*|Ka&YBE*^+&sG*%v9IhE;|PG2&UWt z$TIac7XB*EdcCEldI3z%S60DbU;PuN|TX-B43e7 zq(r}!s7t%GAh#4lGSQmosmU$$&%jYpG2otw|^ zlr30)n|z~d=@NX4My0i}K!Z;fA$21`>yTv5lt@DH-if7(rbW}E*xIFwOV6gfN2WJO z&9cR1<4Q};hGUCaipzouS)+ks(`)*c8Z@j#^U!qwOBb`9nng3#0t_}D`SOuMCt5E2 zVftQm+gVm-B;x@5TCkCDW=$FYa?a#(($wO5aC6Jb-7QQWiQTKZTzX9@mB*07G7b z_*}P%&s9q#@l$m z2HvyqBOZpe5_sHq+s0$Q*k@8wyfKio@%EvQPy`|3VfZ6~r~8|0xpV-J^Cn7)=iT4@ zCE!&+hQP>%Wii9cDtBDj~pUrF%}!=HRa0tVyV=WX!BW4}}J_IU8(aC06mzoWs}`aRHxe#0SW>-Q+|iV&Z8e3xPv@v_0#c#rm>UpnL%CxU}? z!qRUz+=}-k3XXU(#BVO{&GZl=YtoZ)W*$kKF;=m}WzE0J{S?4fbmw&$(@;?j+k*SO zy&i?nK@#&zQn^Q=ACgWG@oFUvZTBbwtVc25W&FhJQN~{(%TYpS-%Bqd4=ne(EXMn` ztDS9+H9qRV(hG|xGM#0E&Nr()a%r&Rz=LLIg)loyciiw17m7W~b7>iVSl-mZCOQDK zaoRqKQA#4eWX4Ca=Tl8|s6oZHUob*(?N4IIJ`PUURhG6lb1Kc%4jfw^Yq{HO_Vz|+ z+B+>@h17GIfUO*ag$`|x+;c_Q1tpD#kA#OlJt60C`{9TD2NbC-Jd|lCC7aR#o2Os~ zwk<24{m4B9OLAfH6m^%hNDl7J&WT5n$Zsz2AHACUxknda$NoDY0~;mC(8hg6_PzPo zz^yPi5egm(7|Y^&w+A1}ofn1>EN9Z4hkWJ~{M51$6IY!R_c!M86A{=E4Po)Rc-H2F zI~sF>&AXe19_Y+D(wV;#@v>g;hrP=x&&vv?f0RBo)0v+(^&)3}#?dqw4i#c745_;! zA7$M8lk^j_3Pz=Mm8f^(Mubpbv)Tax-}A#`V(?JF7|7n+ z?7QQud*)`OJFCudH9%I{eZYWC(0pv7chTD?W_^^A@mr3mDWQ#^z>gTqZnOl{%d5@_ zm}#Q^#X6~{4(zt2@l&0R{VVq0D<}$~F3QVM4w_H3uwInA?7-O*s{-Ung(mxHl0_;7RoQQ7w{ zDuhpPx@pI5ZLY|ADC~u9&pOaqh`It8^L}NNV z+QtXHGv7rSlTRd%3*aSuUV{*6D8YNT|M?;2S^q zIlFhnJ8r>Di?hKt`lkL6)@(G5;{qx!RT;(sH&9<|5YQfjgZ3L6e^c}Y=cl2*!%=q~ zm>-KHXse3)ea9E;%&N!zEVS+Limuk~ZbrfvHT-V{K4LrWF)~lwzCMj{!@kl!Q`<&+ zp6_?HGR@@9?1Ehht!PKtqt%#@f|LETDI7k28 zzR2BdJL69})jBSMeWTXv5DVd@ae0MBE3XhltBnJB?xgx7amuLWUJycBkcR=NPV?7$|1`dJ^$_jwjs{$J z6eqvf{ip=@Q?seJT^)PnJrw8_f2i}S;8V)KJoC$UXY$n19kY>{D_=6ZoY^BWic5YFEap4dBu$H}=z zcG>!OqTXubI1qe3|3H`HAkTQ{Eg7EiSibaU zyre;VcWS{50$|d{oj^X*M6oL=Q@rkXE_7Z+Cp<8hktC)5oRv)qus)NKh=bXNl;9}@ zdgGdDT+WFlWzkKOlX!NBnK^QUFtxF|rfS`COq4EJdfU3HWmWj}OCPc+r(QYh;zBLz zHCd@zCNdyX#l2@K&o1emp6tolCqQEXP)w82`5m4Yp=@L>Pv-ut;=$%t_Ux<1_htx% z;F%LXyJX)P`UGfZS~iiWPKCNEWP5Rl{wx;`1wiVBm zU}EmijBZR0Q-z^mHpa<_s;PG8dN%0=_;C&x>k3xued}UEQmY1#H2?T@?uB3Qe zuS7l~0Si$H72t`-zNO+#@Zf!bfSV)^Pl`9rgVzqcl?W%EJ@@yI9=tiYc*+PQqi*IJ zIa|NEXmol%;3xybsGoOlyE(v%!e2@C^X_dIxA4LcR=ka1sNWa?cno-dR4|+w#-kj6 zJX0r9Yi8=Xs{xW4>6EP!{l7q>l7DVtMNG zQzx%VLOta2?*I64<4nMqk})E3_PMJMp)1LKh7_ayx!R2{=e{lREbqiakN@lX$r}^j z^`DSchw0=jSs)ER!{MAfb@Vs*mcdFbbZDDutZuG^v+ekLjkRSuS0#n>uGB-l*VM`j zponlRE-djGlVf3gZz8d2@LK>UjLWs1;8>Lm5tw(pJV=d|a6UitaFy9}_G}~XN;pq+ zlYD5$Bv!GG`Oxi?c5D2ZVIlQ5Wnjm}bwgq_j)!Oz{XQwfeA31To}(X;T)cYKD!gR4 z&e4e;oAw1=3%t?E9b*k#w=`O_Wc3Dg$34B)(JNQpzG^{q$&#A2RkzsvNX0k3ztpd5 zR#56xY18X=?p({U)G&HA8WZ5&;z`ibRZI<(6v%yg6NN-g7c5(U8@iUp(l04clVq^! zlA;sJO8JDe0c}%m113fd?m^q6z0yNjo_R=fNU}qroVE*&7kTA0%$7SBLiCT&6Z8Sx zd=9X0LVXxUH^+5tJU#>MD^Rij0)HDX4f#+!yWbi2;7yl!I2lsBufS#F(Y{IXczH04 z?rI#iely{g%K@A#$MdbiN9X{t@1l5izw>7Zv+)+fEtf2~9=v11N9YME1|G|fhu!b| zF5EWWa=7g~l;)RXHg`uy^f(CXIq?1rbI|a8}@HcqEyKBF+tWrJWM{6L?EVpYt z?ychH7%`vGB%d@&wgsOw9Nz!*c}g7eCdfR^dcJ0S=7*O)vGg9E7#-1ozMfaT44G3u zUV4co5?a5mYUTgtiSY>Xtk)`7XF3|>kH`qIeUfM7UX}N>Ytx?XitF&cd^w7vAf?5drgKdFlr6-h;vxbG> zwy%GdABp)Osodk>?d$(ZxED$|%b&V4&Fa-FH`_sQ>F8!YO0QY_X@1FaB)7{;D&WAXlrXk400!~A~SKE|}ozxnzR=z2>EfA>P z(i*k>i2UENsJ{no^ z-f7UzCe}J$>&;MmnhEuyN_wDyWi=ICX-dUDA`}x1lPIqd*;9Iyf1phs& z_hweLzCYf#H*3#Fdo$mO=Dhq_@=a|6ofilCYG2E3*&BLspx=2d_nmgy?gbyRY^=m({-i#Hp6Ou@fiX3Fo}f9Xrt)dM)^NOo|hw#18 z_b-PcA7$P+*7s4?E3;N*p6Gn~YTv4?xkzN@{I-gdFNSj>GumGBm$in*wp}@8&jUB@ znUT3`qHjjl>E`0P4?07SwC!nnq6wRLo&xXzsB~4V<9Ju=z9(Z({CLmJ?fY9EiS7Ab z^XV1$bmT5Cf8vMDw}$SGHUGn*%%<}9CqRSyGk1R$xq}8*LW6_YXs)>Riiyyv<7CCD zeN);DVq3@YeFxf}_`#lsry=#HFGuRr_EhXI>x}%M?TJ07_cS-R*R?zdMcPaE9Be%G zLQ|~$IQGzMc{bL*v!yMz=jP^bwV!PHZfws(k@sS!Pe1Xa8JP!5-@ghlS2Ovmk^C+u ze_ePl(UJJ67k-LFCxvsMLdQ-f{^*{EkL`Ib^Tr9Nf@95dPgZo!d;lq)ZbBBB^p#ER zVJL9iltaf(B){*&SjU=u2VzfrcF&Jrcp$dt`!jzSd*X@aZ_m$c3O_!j)pfk$)ZwSvDt3-R1x#)$TT?Q|6#p?~x2yAoXWNeLd16n;$$dXW z0W>$?)HG_q3lGMcZ`%CKj&J46Y%4!8YtNzPhwsmP{7NM7TxMDH<*T4~^OKF`&A)^% zn{P+y6VD*uObphFKSFWbnH4On{c6q~jc+`k(|>H`=bw-Jnz{~lJk$P4<3sVJYd(tY z4`Rb|gXa~z>909DZu_>`6%O1NHa0BF4W6z&cDQ+WkS4!}Xl%!8G~-Y@u3)-?{;sWG zeDePEr;&C42lt+?-xNllc|HlviG$-=y+3~B;w70f@BQ`m!mNEL*GDdbSWAytd{kLVlkNhux#y8)8`m2q( zJDPLa!z~Zz;Ca#R+takYJ~laMVx41R4Xnj?XD1J^3s9duxL^5dI@6|aoyGguA=+^A zS(Rxvv^4iNxrG|OgXX#-CL>xs_u;c~*asE+&ZY(P09C&;)^b-p_dUdic(HXslpHrO ztS=u7JH)6lmaM03^KjpFxdj`XR#TPf&b}?VjXSqL6tAn@5^G$u{a`#=yQQToYfNYH zYk~MIXm=O_<=YSL4Pb{we7t*vzug87kHPS9VO^;c{{TH%AEIJdIwbaC!Q zZ*P95;Blsa-Y)(jd(qqYsIGJ&Li|Qh=#upz`J`^B7$5l>Zhu(!tN-%P8*lu=svkUu3lV0=3)!I^e)Z(|+{cBjwlq`NF{sk?;NC3qRlfUt{B2)82dR?Q18T-x;~A zw%`57ZhkUUz5Xx?ZU~OMaI|M!)LAlX{Lv$qeeIE;@6v~^DPPw7g837LsM7RtX~zHy>uq&bZux+P1VYk zRkw@`MQ>XYTDN>@Xf4bDmTwBJTYdY|wb@gumV|EERI}8C-cq${(aNQvs@sg*hUlWD zS7w*5Tp3zbwQB9A(1xWDBfz57HLGu7?2*~!g1Kt-s->Zt=(^==L#x-XLyi|M9sRd4 zYHYJQoT=WS?9%RS!^lyG9-@sR$9PCzLWk9#G-|^>yFH3ScfKnu|AE9CvFpKau4W&c=IhRR#e1GtvrBzCPLdHE5|2-6NLOl*}y=@%XQhTWPUV=r=Zb^?) z?2CU(#M$BHJ7k%p&t)zg=Y3ehd7}KE#m)UMIPPn~nebEMu^n>U8}1HqUt#16u)Dbn z@L3Z+$Z4?vh);VhCAuexV=vBm@{L-x>Ek<(zSmMr{aKdzeBl6@a^<8Kh+`uv69%s~ zfPAke&-W9)qmgGkj#-muJd)b+QBKFIIquCp&`4L}AkXkc7XM}8aWbTP_1HMW5TbT@ zeD6=P%adkiIQNr*h~DO)7`5S)vJr!G{N_IgZ{$&hE7#3au&sTO(S zFg|&PUnV@$H01_=rZZOjnWw9T$I0Dq2Qne>-@`#1>e7E;P`@!Lqar)s61`kTj;>qs+Q!%{mq7Wg8|B zRG8DaQU)Utx4LHa;-&aP{3`d8j)^bx@dJCkCq2%PMfs%TSu&|oNwX)OZ#E`|hf-MS z^r|uWR^wTcO_EAoh}IxipG7D#R^6ael4|lNQM^6jeS%U%oX>Gum0HG}kA1s1Pe zSC(-6cbE5LfRxXf9{S=y$N2;NlyHkQWbPN>&Ng;-H)I&cmg6<5r2IB`kdJ5pZV0?5 z@LHul45Ry295!AV+=;;(@QSxg_z2FVpoPcVx8i*od9(22N{ZLdgI8qX@&2fIe*|yqw-9c*O@r&v@3+E7=m{zT9`BdtUWc>d zJp=6b@aOYBN+D4lvKY3 z9=s4LU)uq@BZ@Zxyp1;!7sW^g6FEA^2_K;YG!uARaAv#WGhOl6FR=0E0*`${CDjkN zCle;oy@uOz=}YeU-@TR*17do^?QK#?4}h%bI_N@!+0oJS%<7n~Fsm)&RyH z>z|7P<>gTmE}FkIU`+vBIljJsT>`OK-ra=5(vueLxF#*Qy3Gcso% z>o3f6wP72ghSU768)No$_-GmilP=g%oZ}9xc>V6OzQ0#X{%L%J2S@im;lMYpy78@q zZhnsh-wZV04Wta*=6hNAMuYk03}no=G&*s{(R~QVKSSk%9WaQpyn9L}RSBmG+VIdFIH!x_sm&9{NzR}1-C_}%p#9RC2G$3H@b{_u0) zzUzMQI2^cZ@5329@*b*P*wAtp<`;tfun@X7w6G55UB#b4FXsf7fgCy5XULTfl0 ziIrZ17Kxf311dzNO-4;7s68a2nMCbLQavP|(nxA0Xw$=>hS-)Kp|+xxThUg*URtq= zsI_x{zqQwd$rkSEIp;q2JkS66uVl}D*Y~^L^{#iV^{$UynZWOAh4IL>X0k82u2*4P zc?`o?%MxK^Ia_?+S7p0WjC@Un8TqOiz0JgjUk8)rA6YI&RwmL}uF`3KjfaOpo#q9~ zrF_0{Re&5nn2~o&c;JZ^A87Rb7JM%75|KNwQK5g6iWHJ*`z|tL&&a!x?!KV>J-2*b zA`_rM_X+aXR$hRVZkzI6?!b-s{MFutCsA9|kmD~}eBZ>UyTStlthT4(;ekCZzHh@z z;Xfcz_3;CSxdS&yOj>+SrrCZ=?m(^l)>4b_@1?`F<&UX?xqA8Cw3hbD+<`h3Cq)J+ zX?{4KJ8-+{2KI=W;qpfwH1pxdT3Xt(atCfAsvE}T=g1wngRXa;LGvja^#3P+>_Oa1 zdLH`OsgSF9I9YYTO@o_8fr-Hi+Uxx`kQHsGC4XA`p+D+Zb<95pH!5Y8h_0SlUEQ7D zs*fFL6CHsHgy{%eGUYvn?Vlpu(xjV{aP;@n-v z)eL;*@Koy~{3oKK9qgbq*5hK{jEF%zEPuk30QfgNrFhElC=-X9R$^M_)|hlMuCw(9 zL^QS&$F-jE#^UjP+0GcQ7k@bYrKi$&ry^5efDg0v;tl~bjBzQC{3il0W|W63dizB8 zV^4NJQ`-H6_T&>m{l@JV|3c3eSta6Mdal0X$tS$VyPtLzbZQ`Aa~fMC4)62AgA`HW zW^p=0rk{f{8^Q6rtLwhbbm_Vyg<<&tv(Mabqyiho^`LKG*tlH`kv2#Q7Z$X)hWX{f zM2S^dE#V?-(jt0(OR)}Yq-cz;Z^?A7AE+(I+{Ue^&AN{W$~#!bugBI1!>0|#B>v_V zEyhZy)LDQ&Epo%!ybQgl^@d1RdpFm$I|3fvhD%)_8=9eb8Mp&-Kw{aF_0zF3Bx8y? zVaDW!SvqmkCh@;AM=S9Cuf9Q=Vu)NWR9cf9*YUL#v; z$)CkM0*ho$vqmP$jAfd*TR}Qr4B8==sv=wY1hXwpmQm8fy>Jh<{{THDap;In-u|#3 zjqpV~5SC;z5QH)Oq>}z^`itHh^E(3^X)Jex1$RCJ+b# zHfCvco{h#M>YH1{3N(=4T%4Nk&vzK-sSKr<^Fz!vIEtrQ#hjFjKBG_Tvl&0tMsszy z@na3N8Rm^VL%9)OvmMQ_As3hRuua;+VeEbY1oF zyJ<*pS65C)ARTqp4HsCmoN(XO(IOi|=HUAMKN+VtAb*X?SJbsNr7 zxK<5;ehni|{B9_Bi1Bs38Fl@+`n^6&+w8f1a#WERqv&(TV}^Z>amWrl2{X4z-2qkW zG@c@xEE!5$GjMyepA6*65PEh!3c#zd!UG$Ot8A_52-6=@!hcYH@KMr8@}F@MOPV9t zUFoXhAW5!q_f>+AU_k)#-MY%iLxtUO$&GhN{o$FA>zK|@B?t&k>DkN1q@>~)r$J!EG()U=s;2qhL z9L8&+n0F=N!W%k#u0`RT9BPGilQ7_+;&goH-chu29oMC?O@LAW_sO{NUCtGDrp+6D zaHq~Z!TJVG=QMjk%+)sIl<2zxpJ9|VH#~oZG^l#)v&b~GQOL5YQ-29hVtZ}bjXv{s z*L(5Eq&Z8y_&ts$AY`eZN?|-TxREmeF|`@@_!r&wN^F1sc=QR9P;(q z%)CGqUn@G(L?Q4_=Cvee31ZzHa^gh8k=|G^=e|mgkFdnuP~T9~;24Z8(5JK9w*9U# z*{E$gf)#hVQd;(%Fms*qUUg+fX*ffyI)RSESS8vgp&$8W`y?%#p@BJiAP7*k(O5Y? z=arft3RkA*P7=A5-lbm}+F8K%y*nLjW*7Yhql+W49k$si!?qVSI2hYRBpn05NP*EO zA{u^-^`dH-$P10U9*<1xk3|bQcSd^}TfMD4D8pc^Xm5<)r3G^MB(UwnRY#(eA}9I+ zTf635p(=WvDAN$@r*tHK{P>|+*lAf5?!^lw9`Re&97YtvM9Na##UoSV`cWY7|TR$ zhwCNex?$w|@dl({JMzTodW1N?N?V(i*1MN?RUroWrgvZ?D%CbNRQWb4ZfxAaN<{rf zZ0HNt3~V&kIdtdRK+0JB&8})2Brg)f=vvC$^VjV4>h8Tgm%$Aj%~~`ewu(BB;nE_u zs>r9CUC0`&Oup79jT}#E7m{(*kC}JWZa5sL`$;s2>&>x)l2H-c+CZU+6Ph0z5yVL| z#4~o&0c+i{*)fs|A?Qkjb%X981_Jl{u|%gta(PGzwmY|Mib z7OD2n{DwWd(~V1|aA#@dm%HIS+k;Y~F2=fNJ*6c}8zZ%uD9Xr=Bw|}n0;4ECRTSAJ zA(hP@(ErdlJZo*L14t&81)h5Z{XTB6Tdp58$HQae58YAc81VwJ8+BJiTN2GR7THW$ zX41}>>r!eUOjjPSGmVsqKU7W@pSM`Ok^-0I(E90@GF#`B{h9sC< z@pWM=W%Nv2#e< zPq)!@xG9prIwLEH%EzZqW%*DKx&!{3!4|6>F6`47xUtSDt5tSx1(e2U5O&_@=E6&M zZn|r=%XQMyZo$iSwumbioD7+2Hv$N|{yDGiq(G4EiakukwKnj!9%!}qj*wNPkf_5g zjE3to#5oF1H_3pY;30cbGer83VasfvlVJ_mE?efnK4qJ;z5B1|1H)y`q;`gQYRj!6 zZIYj$;`%HGeRLhaSFS}|=yg!6=5xgQ5%1n!vx|~r$QhHIdmp1Djm6`GW=pdlCZDi_ z(1x^2M@V?n0h3c&SS5Xg@P>lRrEtD15)7B4%8XlWk!;LRTZ+GY=;6_O8N+?tOdvdP zdyDVcsx=zO=W2F{guhGqSH1ahB4HL0_3KL9cSjmfzXnz^=k>`nu#_KRA#)&ipSO>b zyE8r~ck``s_n#?u-IT2udPC+C1b;Pi*24LU94ecnv*0OMfg!o&uF(f=X83FVr{R@VZ1K(Jyp48;5M+b?ndqvPTgKu<}j|)jCmRw zZH5+cZrR@W{GM6dUX41CRFO4CNu6lhU5=KAfL)!Z#W+PCTpP$t6!x$=8LOK6iSDYp z`xAT%9EHO$^bEydIU>Xpg~3?G0ZjEQj8@qEtBRfNHb=*{i>>`z3#T+_boSK_DT3L< zO=ISmx41Doru1rdiq&oi zx*B6HgHTYc@Kp2|zoUq4tKF#wFqUd+t;c7?n_9{IeWgQ{*ca=>+?EYuwr2#&9Z!yaA*=Ly)=7XAh~sN=*EvbBW>J0dyjLdes4@} zu~#nNaD=t&mR-)31GhC##MPwHtU-+GE}qSqS+tTL;;v}I+`J8C=#gbO>^fR-s?<#G zL13>NsEL&W4Gj+6wWc&1{5H?fiX4&3`F(Ttjq#gYCy+%3H$J5C{@F8ej_Ed6(;5m; zC(g}|VLSUG<85tWn%Q5QXd53&d6~FubJ)&rg4a}3R-{KT(<+Pwm!Bicz2AA*b=>Si zs!OZhL?;rA)Nd+i>8NBkvchJ3go=~Y2W~6SjRcLmWoqUiKmNtZsB3ZpL-uW%eP?6;9cQNSzq&cRp?yXdPywPAg< z21KcP&A!7H$!eK9`~A@5^)*@8{#=u}sd9Zypdl0vWwxe=Ls_lbo0vt&J9(irMI@IE zSM9X6DN>MVrIH=`N=GXXyN^3R zGrOQOw$g;mOdj1*FGoW?ki}qL*w9p4UtP1=u`(1W3uR)ACvi0Or%?To3Xi%g3Ti7i zH5o662wHYaMjAR=Nvhk*KZ?h2bTf4@HkJHnlT@7TS=v^$(jE3w|A;X_?m$CFbgl9C zw$W`vcQ?c$rL8;H71Z|Bh9W!BfMc=&??43{tvOZS>=6+^`rK3XM{8P&3;vxLsIu7} zwB2?L4AxaHZ39i#Ro?H~vOQYb_#&IRqz9W4X?8spt9}N#7AK>hfyGBcNi0qdrplMR9yk+=vkiP5vfQnE-W$i{brTQ9bh0_m zM3Kekn=C%>y!S&HYicHK3azj4H-NDxk+G={;|Sx7jLqaXpHnvxm+HQIhAs%>{o3^6 zg8Y!~Dv%w{qps5(j?v{n{=<&_&J`YD@uO36?WrT{b9*F{qgjyy)fs5sjab*&A zNR#rn<3eNGqrSBi4_6szC|@aSx$Xc1nh*L!IOJ;&rT2#90@K5@2M5HHKQb4a(qiV4 z6IYQ|^;dS5;;!Zp+ERL?Qlg8NgAjY3HDeZV{lJX*@cCy5ZH_+GN)cNTI|3}RqOG2# z6a0TB>o|}7PsqBlwTOR@&NTu`N#xP^j5l&18Ut_adw53g02W=S@7|S_w)3=(dwC~_ z3=-p7>?YJ)YGToi`tO;&KS;#snmR7re~7sM_uHBz;D4^IB@Qo;UrWf9XEzuR^@c)& zq2S(7u0G*lP5Qwa@2e+Xm8)E)5-Q*}mS98zhI;i#MbC>(wQak1_Q$FZ491r3?cw+y z{e?LUk_%}o>|p+IK?;tS#`j;f+Jh!8#ZBVp)BgJ8S0Tk z-_`CUuO~Ru?ynqblU{pc3&>YHhhk`!SWW4#Z=NEGj;yw?uy3~4){kT>QMAzM$`rjJ zpIZ2-WQz}nyhW9TH5f)1;hIU2Sh&U?X$se5w3=gc3S5jS42~%#o1(+9wC1>D)q&4A zs6b9o*|-?{!`#l{| z8?LHPEZHX4)7h&Cdo0J-5i97(S*qy3=_=yQ>gLq?a}|_6u7aYdngSuH{;9!Or4qV> zm8=>YB)9PdM-rfa&we=xawmCp$*QSG)zE8itSG5!-qreR%5y}~0kdj~>uYP8GgakO z*OwcpoOD$=%UC&)6Vdwi8e@IUBvuRRCWCe3W8Gx57I5-}x|zhfF%orCiK&jPnVM!B zC%5(GxQ4oBX=Tv?r2Y9i>8n?DQl#pnW*%!~UexA#W~@f2pG7J1$JW$Md!Dod&MSmm zO}u55c~!-+ttAZm;`)R|&b|2wl8se;6W7~Pu+gjqiwYB}wN5Tr$i)h$?DLE#pgwPG z35Ls3MlQsXcuGuupJ0cn05NXBEMlRvJR99pdw|1n%zMiQ8g%>i&Z~6iLg!|eu`g-L zvCw0@C1)~rsIAzCM?%$w(SV$S&5EXX+K>qLbTq!`g&IUpTamIW$A;t}HnFfn;hE`L zkphx#wufygIGG4_N?8i@82F9`^tyc^kO_$b=Ok~qN!G{NLI*peGE8L9WJdlNADf4; zujC)+CS1FB;6X3?8NMz6ve`h}`)%z5V(SB5ln`Ra7`1KB{IbNSNd6YGPyC_To2JLm zk7mj~6~hDesWZ1{rpM41WTqX6$6v{mYn+{nF%(6DdfKi`CsOU+9fU%yDjUO+rg(hI zy?Sd)v0u*=ffCW$)86wA2D>aJ7G~hxl6}aS2}IDVni;>@E8h4+P)|D%kAL*tr?+SJ z?#ukAS27>@=nI`A$HouBsB>|dYnQc9O^|qfc0JIDEjg(U<040GNS_2=ltU#5nDnU4 zc+Jiw&Duf?dhz`l$L3U!_{zx_K({~Q!FNn>_!N}@)pmIr^!*!~srA1NDVy%lVPNSK z(?u*(MWMV)p$e=l#mL0%>{P|b3X^M|v$0SBzNG$7PrX0Y$burL)y8l2IKy)01eWM5 zM8dt@e+8Gdm!%{`mI$8aYY8R#Y2}Q55X&q&xqT=j7f0MPw}!n{DH+vJJ$07W7OV_; zK@+JtzzW@F-DIIiX=6ATUXn6WDrP%ZyBe_R#2+(1#i5x06R}DQJ5!>ilxt_d9x7^ z2l~TE4Jr3c;qcu9XpH5@|K7%pauXa6D(mkAcpf^PmUd5J&$s%|NdxOw2 z+c+1*cTD71NU`fx*jRu7QgJw@LPn#58`g|L(+9fMr+&xk?H`9p-WvzhfaPaEf&4t=y)BGs}jOFuN?6x%y} zI4!O>Ad`e_D+g~vv+umOP)}R_bK=K=Tf~5PG(N=owypeN{Ln+A&G5lKKiYqhutThy zT5+tXFL@vOavO>zd3m#EWYm;r(ml8HW9{59cl(RM4m&ylK0;2@PeAbR8|@9YpWg2T+)KpyH2i&abN*H zKx_`hu>687CHa;BM|_1Wd5^{zk_tdy@tOO$3;U_mnxu($UMdqI7YqXhn=8bohAf9& z9~T%G*^1MTg&^w9)k$MM7gra0Aj^s3u>DlQ(a_lX-k7EN7y;T)QI=a>)&V-)D8irX*(=+E{QRQ^a$Yt#ohNa!u4h zlY~8Zm{v*3mc?d8da6?-?Iq1wSl0Cz$xqKW6VkJNyTGtp`Wv2E?YbWMLlOk>JMfPyE)N|HJ z?3)rZIXz!-nxwNmSNgTt4p6o#_uW;MPzYluj>JLEu_HZ^l&eFBXHae}as%0*tb$ zt?vME2kow;2)*By+yw4-UWo?aHg`@qRFlm^K8fH{-isVib78rUwW1Q8ua$ksEEo2W zedKCL#(9J@xq<$067!6fo850lrk;X<*?8t@?K#ZvRO*Lx$GWDLr(Jc9y!z&s;`scZ z9K)`dXc)F*r5wS^ZwRjN7^@o=DL588w)0qzu^BwIW5VVMa6j%j zw$u2d9V=5k4Y9-Sz5{AbeLmUdO{#J>wKW`R2t`hC>g<*Jufz7^K;kndi&esbcwYUc zwslR-JK~~I$^`D2{+kTekk;3DA;2BIp&5Ha)7ONi9Slt!4CU#LvYM>2n#{7AKn2xU z+|I-?O75}Pt22h+FTwecr#lMFdh4* z6LM5B8{1VK!|uMeqF6b!5#UgUTeXq<>BHJ5cM+^|sti#s)uW^oI z;3!oh(1J`}S!0ydOj?6hetGq&kq?3TT;n^D`nv32dS z>(@z8`(eJHKZ6HPtpK6a$@K!0ra&KG-LZG-l{2HN{dtO}Q6aj5`{ zOQFaC=x>im{@pRQzxY(WEZvyC`~NxrLcR9?^Y4Ef|58Z(x9}PB#au^@p>6xkDPLmr zeg+;yJG)1=Gqf?;*5qkvFH+H11k-4jp$+13dZqm3I1&4G*dB2(gfq;Ua^FkUI!D;% z*FVPSxN6AWyEm}6Ckh_yPnS|?V@3vKDii@a#~ElGYp`X>&50|tiE!Crt|QiYjEAVf zll>s38WBu2unjd}#?jOE_B<*1nym|)TmUyNmJ?Hd$z_cn5*vSrzuT_DFK&rLE>*`q zSwN)1qkqv~?HKAoXDIE{mu60n7~#=B-MPDCXkv4=lrXA9YlcE{XO?l7)>3>$zsBuX zoLM42%s-`NL>=9H~_Y1F7DwN{vyJi6LIjOc>=XC z7^CC&G=?TFl6@71>`vRC|5(4FWBx0cE3JL(z}mnsOiowRT?`nOAbV_@2Kl8n#;?1} zPbBz(H46MT+w$Co&9>Gzp?6=vEVJ5<++a2rdmZNfcVDC7{-vcoVg&&$#Tk_ z*qSQm0g~x3v@xgJ&E_l{o2}{YmWl=@t`RZHiX>ywZ&cFnT}=0lR=NB6=ownIA`3_X z!jU+7nw}X0Ua9+VV`SQ>?|=}mJfc0C2EwlmJd0}x<@P!w^-~hf++$;wfJDQhctu%p zAqA4DG6Ct5mEaaUiSij}aiuDvseX{O06Rowak{$uAze1E&AQrn%%PtTTRUXUYg(Ug zCzp52rw7i(CQ^iO8EgXFobJ*^U*VGZ`6W;6=`UOx2&vjO2`ky0e701o%>7_bx2Q`! z3!AeoptP(vvj)iENrXQ``D7WJL_-KWt=%}7QQ1&hgZl*rHnbKDyT^7`zu^+bCvK#h zk12~{#9>>Wb~N3La@cMBPpvwg8`Grj!o}lkmBz3$l1|;lu>H96RHy;phBs26KJcTC z`n`JxHojP3bU8sKG@)ucnh@Je#o9orS$CVE;XrBn3yfvZgpH&@Wj*ZRSax7zYeBOY za$v+IqJ_N!4gCdGnOd}LNwHqixu>&idSEy_(13B6%^1}-r=7L07?x`HG|8*uH6#56 zc?Hl70n=8gTJvLeTu}b!D8fpjBW$iGwH0}S>03JR^3#MEl!|WYiTGR zuX7sEqe2aYx~VkcG*-#Rii}RnupOK-VAEzjIyX0Z5v<(sY+?Ww365jMB=UU@Bt1((Pm&TO ztgZz8$dTz5BGwqUr50CK)PsCiCdg+jgr%wNZj*MTV-;CwuaOb2+M=&CE9oX^J7AZG>CKEy;(2j-UD zp?Ru$mKZZX#02~J zhStB~4HDXGJfjUA1T>=hau2pJ&q{+RF{Sxn?~{;LE_t|3%2_nmO(K%p zYUi8`WRd)0_7zdM&l^fb!Ie*Ou9~=wD?bYl8oa{`qD(Wke>CAR_I8Mr1bxQb0L%?J z@lAU-_FQ0T9~;{ul2}sLvORM~U5YVeGhR+QFLT`UCbj^?E;D|RQdr|Jt1%+eT==38 z2)qubp+A$wh)gq;0$F5p(Or_J>sCoT&%cF)c)#n@0^_|g->-o;tEr@yCv=e}&M zVJ8G_YZKY*p4JoL7rxe7AATV_T;mPDkO>_Eh}7CfSz7aEP5Qbc#j%D;^m{kG+KYy6{$fKwD0hFX2|J*bmZ7~Vld>DS{Ha742@nfw74E;Cr|9)iYJ_UgL=*m z*I>wJS_jV!htiR0O*#)b8$zJ%}yS_|!KXTS@pj4|XtZ4A^ksw(7Qz4&6HX z4TMQxR#kO!Tmox99GCfRAB@Yq`OjwZP*}TVrPg^|FUIql8rNLQbDVoX3dl9y-;A?xNa-|B#!H< zq@3a$+EuHqeLklr9-rlYAF~y7KeqjDXh4--Y)s=A(Imm{Wol=vb7!X;=Z+zwDa9R_naJ~BIMQ_rUzu=V zq67^<6!eo9<3PA~wiWjb#^!K20pnGY3r%We@xe*jXzbM^cii9j!_wUc+H*()ur$&I zQMQAPU*~q#l74SxJbq=@RPG3B^%|#~x?@du{Q5_2&9Ul?Mw$C$=BM_&(4DAEChT4P5k zqfHQKuCIup`s*`o<(H#s|x0H$rd0}q*0S?$6w z`As>`!kR2{)18n3vrz)Y9H8Ae))=aDic42~buQA(M{ct3^aG(Lq zHrw7(JmvkLO%2D2T2DanjAYY>dPeJ|{%IH(FFg{*T`t==;OOfaqAI#-jV%(xH3)7V zEzjdM2zhNBU~OP&>_hdddYB5EW?#(6dJgpp5KB;Ptr+mux<0`ew0y5QDS`}QSgGnh zp4e%BS`u*{9gCamM-23tsWq7L9>;HZms>P4NJ6;C4P+>X7r`h7K3zt^sj!^q-B(nQ@%*ZsvX zYIByoICr&sHjbJBOLTv&s~wof6dzw;cYVxz%}l40d9UC3=aCQ08a-X^vq7jA<5!q? zA--f1=!vdWdLkUt0I88N?rYNNk2*h$Q$&*f&1y$R@?k%+3V8u}kq1)kylfJWyf@4; zuQ>}oHi0p{aNfow-M*yz+3ITVqSlC`;K_m z15a1j%HzU#%nqLF@LyE^7lEyGpNjS#ts`S%dyh^2+B-6ABOi*Yrv#L^#_!}g8^7#w z{I-!lu?Onv;2djF$5XbE8KQ^U!tQ8lcPi8wqH(*ow)D;J_#3Z~Pa21V;T{dl(_ARR zy>ruJ8SMPXWnH%N*C4yHjQb*)i1&Fzxl5ugsZi&J$>aFTeZ@x*C0pBmqxm%LE>%yu) zR(RiMZ$!LL580ZpCw)Xp$=0oHruy#H0B9{a7^ureZwwiTi#a;bUg0^G{%VMY{t|NE zVIS62Z(UV5ZOsc`>m@?zH*~lqFO-1=|;AA=eJSt$B-R-}hNx zIy`z`$X*(Hdbh2)g-0$#>gg%bZ-U6Gu@ztZaNQ-MSIkbCo@pCt5XL`in{`t#Gq3&^ zjGyw9HPoWC>UphK)c$JZc9H}dIeVgh-p?Ajb&NVF-r8cDYb}QkRr#5A&QL`nO7A($kRg04Ht>Ny*>xXRRSBe)4Of)E17kZ4pcUGih86C5<(s&%TjLQ}y zzrrjtd3v%H zKgRVycO)HbG;%(;=W8qzYOZdAypZ8h)RvytcsGkCYYXgwR89_Y(_k`h^s{Z@Lo;By z$wVys3Lu8-j4sh~FA+24-XeTNM$-R=jcb-@xl6>%jXT^!1#ohR8(QX!?m^DD?1vrq zY^8BY2V51_utqQX9*1Q?h50EU3Aaf+fSLM2PfNzB z*>>FK1u<%#2R=Ra zivCz_KsG?X7V1y$*UX#$$fH2LKi%+X`C4%ZxhW~wEVp&_N;!fMWBLj6{B{sYD!sv& z&fp9@0NJq8JmWa-Zb&bA)4U7{Gn_%(>UfCMQu_n~=dzBX`EWt|mUk?+Jop>fR1`U4 zHCs9mV;RR9D>!y{)SrFfr#zfng!pdXgYUaoMK)OW1Yu&Q4gkC!NZb4To#DfI{L{n{%f z$U@FkXM0xFRM}FB3nCAqUX4|@70$i_+!j!L#i?ya?+!md6{p!W6kP>1-gmEXmY*XS zrZd!1eEDFOR+uGaqJ1}eEcCZ4?L+A$>fj?))g94q-EnW@d8PTKSaL?^vD(phx6vhr zwwcMUs%hBPaJRAeBEoIYZ=%R#)U3*w~Gs%s1E> zG~jxl+L1ru7CuCh+KK*qmexSkpZ{QAK{SLr&){zEpWBhv5!LV5GV&X4%UtakITD{Y zH52)^WGqLRmIr2a-&M*HY&dsxS@|#JrOFu>)BgcqcT;ILo2rgg2zX!IJeDlmGp~Js zLeupE=AZaMGP$GPk-Y>|dRLYIYy6Hajp0%ZLh^#HAA?!R2SGfncN+39>z8s22E0VX z)m}1_l8O6r6yGKJ^CHoXXdwK{Q;l7v-4P9A?30^P+vJ#)XYVA7jtvCNw86vZFx3=D z_KIfCGVh(38&6=J*p8dSl5qh{{OYj^hIO?HZWV5YqUTe{x9}3drEISeP<(?B?cE$W z!KdAgl{}+Zw9aUq9A2Vbx?R5)Wk6||OlBe(d0)~J>rMdRT!Z{vqTPi(ax1&zYxCWg z^?BFcj^>LG+Vy#>uEO#KZY&b|d2?X%u;WD1n>~m#M|v0?Bq@mpzCkjVVVUBt!S97eK5l(!i)cJjDR5BHFKJ$fG0oRaJQzISg9^$*t} zgzWty_EukehP~JBXp|rB?X^3_6PV2eJ9DGwwXc~J&1hfakJ{VUWXSm5hBXZ<8_M)R zxJ(b1Wi@kOK6MvzK)|X3Qsa$@+uFQI+}8hPWRK8hRoiqq#fLBh$KjHqzV*EBIc)m( zwbx*Y@O%MPSl^(rg>Q5-C=v7;y^Yo!OUyi-nDfiI|9BMS*_)JBoVU@}238;P4aP)F zowt*iRPDlm);wjpU7nfT-uacGs1#E0?_Y0R1^?0LP^3l>k4;*nqczNL``!lD zr@qvhe;M7Uj8wU*NmJV5{*aFq!XgA4OALWIU>DPIOUWDB4CGsOZ2xR zF77Oqn*dx~b9vgvd=lqa`r6U{)!vGVUdjUVN>H5Y;W^0$Y>|UMyAk?HHSn1#3n*Ff z*gGDN!G8yj!6ZEP{>^xd<71rukej-2=Ll{}1@bO(nR)(m9Ixr_W*(!3QSl{wh9C61 z!}f)|jSY8GdW>3ryfKgIDeHGE&f5N@UQw_c_&5_G`eRz?=cF z6W#B5vD8>@uPCUljM&!(cK1HV`+bHqUUXq1cI79Lj7^w1c0?aB^<@%a8!ojaLme?m za3&gHFT|R?IT)BN_&JzG4$pxrZY>>kMSPW50*R*L_R>?%NF~ls4MHf8Z;&VUEJy1* ziUMdTlF3Xoc41bFbF*%<9S&huj_~m63)RSW(N_vat(vSwd`MT%gM?6FZ)XbtU*W9t zbAO>m6S|V_&$jP2=cm!7kZpQa$NcQ}l&p>iCauj#YflMORg3nNObGkPswG&Lf&{Es zC2Je$L~PRo6RS39Q7l=uWMZ2Qv}O^Xp4kz|)cfQ(5Zz2?S9?2d?(}TWbm>beXg0Om zJYA8rJjf`?<5_Eqa*Vei6f(1i2Fo%dW%?{V^{~z*>nS@@u{$U`is4h(7NBSe}_L4 zEQ>KWbk&n<@DcE+BQgX1^7IT)vL(YY%LBdV@+_9a6Ly1n1N{Z88p<81`Nz$9A#}}p zUqOO<*Vh(QhtlrBFiv-EAF7Q^UWtR!1s%~_^V3<++>Xb(#xQWNqZ)fw6noZrB#*5M z$q^nVP(S4A5vHf+L^OgkWF@`(D8(^ z#dr_EWa*fWEzo+he;s;r5O z`#s`{0=&|0+m|)v;CAuSL9bD#Be-jhVAx*o0r)~YJd3zI`LcKGHm_0P+S>i$J}lkN z6T2SGW;%Pl!J$%p^GnZq^(i8|L=5+k205CZHfPU=3qAu)jK4UmD#W9>1Y+I3XIAT} z&E|Pz+%}qu1a>{La#z<^S+;H7dBAv2-1TqqT~o^TJ$fy%c#P$L=9!bvt_H3mtz^%h zHhl^c{kfw@i0*&ECYo|T3puhgKC&mSXU-WY#pad9e0*?;@dv%ZzEb_pJx_S`9DYON z`#nf!-@~?YoRIP$C*8Aeim&|V{0_&iEC;sUpv`l842$->%=>ly(^oE@mXme_BdNpP zhbDAS5IH|{jmBrCjf})|F2(-t1!?8a$CszMo|CEMIP^58lHL7mdihVtk^e<=R^B)7 zw>ZuJ-`;cAe~9NB(Nb`J0P=YWmcMoiZUFioN3Koie)H2>vhqo*F5b{be$UFHHOo(a ze=dpNb8OAC#FI~XTe6dHpmOfYn$l&u|}`2P3Bdml)R-MQNSiMzV) zcPX3WC<^cI`viz0by!f8X^a;tAU7kJP^X}_{f^Q@&b^+P!>5wHY z53{8K{g&*>@>hP;;_k#pEjSZQ*>ksdAFj%|m9nRCo44_M6vZuF^IJOS0e}@p?_1Dl zZeltmXk4G-(h~6UlRx%0KIbiY-D@m#ZGCuy=;XM)u{b!g20ECXyzgnruFge0;JF99 zVB77TMKRpA^+PXQwzoU^n?1RAyFj}#UeoqHoW+o48|&i7KDvMDHD=phdh$b8P%KPo zULlOD#V#y1?Bi7c#wuUOv$l~XqIn6<=3hvXJiHir;<6IJul?ra@PZ>~9urF5c%w}} z_q{)Qji1d2BHvK%edzxBq?nPpCi_(ji= zc$``4DoZpKIV;KO{&_l3c%CmS5wg%KvoO5_*NCK0t=V z55DVX-Vf6z_3!A$dr)BzM=L~chNR!9DchyGA!`cHabk;HZ8~nYaV?UKSvG&HLYbp|m$|Mgh8h^ZOj+8{QxE4%Vj0BW6LsPs(7f6OM^X`*e5C z@*2$fe#55gfs?zldyrOYNq2Xf zo{b(Iw;myMR|Jb@7!4szM}~I4o9kO;92z#h6+|Hh77Y;a(`YuaEeu4mpg+ar+C2!le4kjH`I}f*O8Suhav$(k|j#TQqHaxHZOW zwxn?D^`))8F~tc|LpjY6tf>W-3uE~1T7qnx6GVLYbW~hAumhAPVNduc-1)v;<&k** zSJU_Ufn82;PDxHszQy7VH?PN+tZUZ>uf3_}o7V?#`^NeWwg2$VVBwq#3N9!J=B>Ns zmYX-szwpBAYj0V1>zWJj+3pL!k%)33zehbA-@?A(8`s`)0YU`fHQS8&KMLm*erZlo zVR3$PaU?wa#nVm>G42==1f^a4R{7)8te|Ph>2WdaiRV zprw3;BIYvvCxD@BqR_OcU%UK5>}e;vC^~HcWETr8_7aPIk;T5$VqY$v^6dqkXIgN7NwV-w$zaN@@-T)ypA^eo zD8tXO(8C&kYa%K6wu@~Rd(>io#A5FjKUVbm34CngpDq56S?pH-K8yeNE%qnHYg0|9 zkMXjJr!D?ZiGNZe;a{cyA1waX@Iw~=AB&&mnoiqg{Jj?cJr=vw|9Ol5sKx$si~S{w z{bh^&kj4JGxY2JqIq=fNmo4@Ah9&&l7W=yvyOlo2E&lIY?4MffvRfK+vkRwInr&KV zO8!g3?`dNfsTRA{pHk_xfjrf66+itQoNZ#V#eb5;ZuQT!_)oFeLl*lqi#^|BpKY-h zXltjN_)^l@aD&gB38sC6w9mJM|B}T%*J3ZS*sbvwXpi!v+c0MOWtQ+I7Q5Adk@l>T zAN2@n6U!{&ms;#r|K%3{%QTNF|AW8@^4#Koxy5evUuE&X+G4-PV!zH}UuUu3WU=3D zvEO2`->&_W8V__y{4cT@s!J@A_C`ziZ&~bC|GTsT#G^S6k4?O23EyI|->ZE^^;c$l z{yR&1{zvU==gZ{8?`3)qTH-%ov0ME+EdHI^{YrkWL54Q*PZs}2wXYEom<4z+o3g!_ zBCVoD+KVjsS>yLu()*spzFoV_Wu`~6+r$ow|G!x5R{sHu{|_~XD$gY{y>pX|pIYp3i`{PF2e-wZW;^IJ>-#=Qk91q!Ow(R2?HRVoivP{}^V>?5|2L)o zBujedSnTN*dxpjCx7e-e85aL6i~S20d(dLfwb-Xx?AGyTp2h!si+z^Geu2eq9lsS? z{4cWD=UVL6_B-F=zrbR*jxVh8sl*b#)M78Q*e|iz7g_9!ZLj2+{NcsRhb51J$;tLq z@v33kdl1uy`PdJYe7r}7_lccKelrx)c$YsgGw|ReoT501gX#64@~7PPi7au^nAXFL z|5c0qMvMIt6`$ixpZJ2faSi}w=yg=VS$O04j<`#;2RhUL_va82;>&n^V!GI<>~y35 zC6@9mRuucH41d1JSM*4Pe@DsJgnhm8r@Zxv3xxMP`rvcDczj~6c!(1Nm@+)r(kZ5? z@|pCUFFsQFlgvI~d54psO+);uE%xtP>^oF`4c^BY(teP$#&TxEaUV*kiO&!eimlVo~ViPseWB+^Sr7-$iZ|JMc7 zvSWtjy+_$|0sBD3kJNaVf#^S1jjz^9|FvSyZ2Fjn{`JZp2J90zh}X!NFco-w;+vvV z+3Cjcag|=et||GLu-7Vn-VO(!xJ_Jc@$XP})Bkp{>;lFV;x#-z@h$N+Wv3hS>r(b= z=^qwz(&%Fv`qwGD*G7BN{F}0O0QQORiesw0J<{GQ`jj138U8gzuQ#Rt6XJga=_ACwczl>u zpA6C_#D{o%;s@fZieLUo+6P4-2mq!Lk5BwU^alaJyp6{vo)JD3p8cIq{6x%6Qc)4# zca(esDDlZt{$~0=6;&K)K66t?Ze2{9!H^YA<9#r^IO!&kp@yfXTKNk0nvwtE=6h0)Y z4_`Unpwdr~_P+|R!pF47#SVp!8D7(7j|*?tUQ+m&;T_t@IDU3(8#oFIVB)0sF+c+N%ox zg#Q;*do%g{Jni?E_H#ZFgNfkri5c3Xihgus`oB~5!?M0+YMzPoF%A7Im3^D^zfgNX z@gGOhKJi8EG7EnuRHml?m$hL_dKZkNPr3G63w?K5==-LsPhv!T#5j5M7400=A2=mG zE491lFpy~&KBVfOWb%otw4W*eWzzn2Et3_c48vci>{|gt{%coS`seQ|`(Ek4R%=r9 zXA+FRSJ}^(_}rkqtLUHbpP5I97aKACZ)&}G(@>w{6YDjH!jEoDZ>QpiUciw5+CS0* z#^kR}TCHgn9A^6jJ`AAnzXkI=pSV-|OS&0=FMM}NTklg5@M8LZQ2j4mY0tIz?^g6p z_-Co~682;b3*&FG#CKW3r>OEK;$Jm~kZBnI-$EvAm-yeKy{-74!$hBG)$X&I{sC#f zU%OlJ!`G#~P4lSn&{w4WVeL~jzPv!%AJ^Vc@voKke(eyVtL)S)`NVE*ORgE&ly@=hJ19rOFui(<{cGo$zBl3J6EA2>6M^w&_-QIV z&UAfZzc!bG3dXGeUunNq>9N>8@v8O*3;oOH$l$^(?_tfRqSY$; zGnh}jr8N}*fFT?E#M|1WasEfO>lA%W|37GdH_rb!_sB|P`oE{eXPWjPUOw@@_Dj{i zYoz^S?QS(5x>wpi)V5jLf0i0genS6~fE$W;f|qw4n$k%%TSsd^g@?ZMsMBE>!SicwemG zKD-wx`1^RTQ1Fv@->G2c-=biW=6(eS@qS3b3-IQ6hk2FY{kVde_P;22Dc*Y(%yJx5 z@Q?BSje_^!{W}FekN0r}kK%n&!9T}4uHeh@rhH+(s{p4f_-epe3cdz#P{G#$o~7XX z08@L*xLW~Vtl({c7b!Rj_%a1g1zfG*Jiu!dJPYuR3Z4VFO~Ho%cPN-;>Q?Yk!2Jro z889_q#NkfBKT>cb;GZa12TUy$!*~JjS1{|}0p6ke>wqUH_zl3>3cdw!NWq%`QyanX zF9D{ef$+G`OtCQTX zQ84kmF3Fwslt|~MB>3he_?9GiQxbe<65N;s-<`qdn055yB=&pFc3u@et0zdzONOcweMo2j24)%qS%a*6}V^uov%D3ijj8 zu?N!(;7y|)G2fi(`Bndu?9M#2x01rBKJ*I=519VUPkRGDFw8Fzek$SL(-oIY;nCif zpu}H$$AlT)pJu`wcMxWpEHh!2YlecEk1RXfS(b&$on^U1!Hid-;2_=`70moME0}pc zpkU(IsbJDr_BBX<4&Z*}&OB+fW9FMA@Dmwj67IxXV}-*IZ|x5fl!v7J6HJ(0HerU9 z{U%_BrO}R?Z<)>?O_){UpJ>7*3Z_4e_MZ8c;Zc7sD`d7}A2U18<*#Nh{_@clygV1(@_<-gL*m zIA6gG%QDcNW&g5*gLqdenDJ;dW&*?f5^bFMX@91xnO~wFnVffHi4S1>n`2r4QvsJI#a*Ic z#$BOc#{GK*2l1BtjJU-2Cgo0iHz}B9rAf3kNgpMXiJ$hV^fu+HYIn>dQC|}P``P$l z^6?O68WK;yEbmpyo$0MpFmaZ3hcHYpIbX&}&{pC=#)M%U?WhFJI#Tr*r2GFe-KA_% zdY4={`2jO+Nl(B`dy#Ty+7dUolMdG__aNS#3TB?NtsxBYlw)$htd~5^On;1qif*zj zN(M5%Uj>kI2{8R>U@|Ae9VZq3HdC`Pry{I~pI8(t2BXK@rh9LCt69RX$;@5aOM#6`+Uz{F)DvZp(7xlqBxg*!Ot z&UDr$xx6PMP zc&0~_kXMqnZ<%f~UyqrW%va?l^Hn@Ad0?s;9_%RmfSJYx3T7HND41#7qF|;$GcMme z(@p04feAC5pPeTR(3LRLpRZtsrO_ssc+xLH!%2YsGw7@E0Ze}yP30xSA2HozzN+l9 zysSVNS>AI@Sn`#kgXF7ZI*`~fbMW{9Gwp>6X4+RNm}yIzAPm!%Z2>UTzDI>&+7Bt1 zVI*z}Pl=ntQ{u)+Im6;fv>l0?qM?-e>^xy4O#l-&IpzV(v?V*t_=by!pN^S#Y*a|#!XIL7IiYge{W@k%K z{%Bt`VJBXGHV9=B`O3VK<=D^60J2WiHawO=`-SN)X-Fk0jHIFJ2W7jPV}@b&e!#?& z*%M|ycUT948!aRGtK1+CJyTrOdRf1@EOaS zobSa52qVj@+85&_#z>O3MKXvez{?Mq`QD&l<|}ys?o6XyxibxhON^x@Z56M|ymHO* z%DfcKCEqIkl;aHw7?^2z{D7HWv4Y3S3wNd`c@Hqt+o8fRJ({!9Jh|*=liP|W0i@$! zAd@rk0Ze=rD|h1a4+_RhUiQK846{|a6Hh5m;7&YWQ0~Mt2al#?a**&;lRgGu|3du0 zoQH=n(~aVi@AHOun~n=#9fpeM_akfoC5ir*%|-Cu$qm_>L96NlvrX4=;%m^id3nEC8hF!Oms!OZ7v z1v4L+S91N%FzZ+LvzH(MOcowLV5T2bFw>WH4R_*mp>iiar3z-gD-_JQQdT28<6f=Y z8Gem|na(W=X53~46X&RciSMw2gLu=NwSJeF{>(d3ziEK|BqU4_4`Jr}cS*3s6Yj*V zLAf&xnnaz-G*y2m>y#507~-86lgm0)^z_h=9T!X<9>UC5_6vZS*Ieb!w69Vy)Bd)C znclq$WLO{O_r1HEIX$qgz1*2;2_>b3TAo~0SrSN7AcrGT&7^AeT{;N3(Z;S za5kR2)QlIz%MX}%N}g1(1~xsxUl1rwL=CBcIVCSDvGGEL$o z*UeIy1k-oLZJ$l~g<^PHa^LL#4Wl8R5>uZjfVI)lyKLnZ18R}iub)^};7%x9ymVJSOS$5g>;m)#u zQ@OLea^44b=Ceb&v%Ei4Fw6UE1qbndSHUcA8sU}rftielF!P{5T*o=R$;=62&*GWO9`LA4~*nnc9<}d zCV-jm96Wx&%ty*nz)S;Oh;(NfQm(?C^pQLOnDn_-g&|GuRxoL@MZu)WRs{#~en`Pn z@qR?Xd3g6KcoyD$3MO8%T_CTE0RL9GlLj9vm^4Tw%@L*qu&fKf#F=IsJ+C(1r27#Q zX8E;iOgM$GI=aPjCTPfVYRS5w56tj$@$#=WX;P|S(t%Y=cbXgU5N1AM1v8&P1v8&v z1v4L-#C{ct+gHpwmHhC(iF+S7tEzH+{G6F#_&4MLM?%Fs1EY@0p8*lk&<;vCddbib zsmPhb%)m^}FvBn?kkv3E%qSKje{4s?b9C(E z%yKcjT|D!x5X^jzN9Lu;IFDE11LDT1_LBK)3U+W0rY^wUUGo3_zUyv-w~pDq%d0_I=oF`j#XZK=l_=x0dfBSRe+uUuSX_G3Wxfcyy|E2s-Ic^1RVxB9S3m%!f}FGrn`0^ zJ_YRNLtygVf`j_xbJs^;`gxU{;tHAA^d@0 z`uQh<>1VzwpbhlL7{T<%a>4Wm>!5z4eL6;HpY~PSr+t<7#c#w1g!aW79gHQ3<$6T> z)St9Z{Ym@O=Vt*Y7U2WJcw+jNz9Xhxn7$pRT}uViu1yB-HuxFAv^T~&f`|6<5ezZy za{JJLY1d4NXZiOEW}S8kP6FrSNO1Co48%c9J5Lf!JKcChJnf{!KL!HGJRFGz2mjyw zyd>aBBKW8M%!Ma}^-KVVeg+Qx3{3l-pMgU^3wC}M?EDNI`WZO%GjQl<;Ly*&EZ_MV zIP^1c67iI{{5iApTXPWS;<>nh^uv*8aWL?w%#*ZRed7A9%){l3zaeM~j)8b(fM*a_ z1-L(Oq7@$ycijZ0f1Iy?$vqthb?7U%{sCq=H71@WQit4af|+-n-~>W9uR@2u`m)5+ z51R!i5#BGD<^N1@DMGjAL0F|Q^1tC_4!RfoQr=sz)1vpjiY_>l|el1(|Ln+P(Qo2kojRU%?#G%gSz?ivluda*plvtH*4rv0vth$o-xW5DEd z;}Mu;QnV~`X<1B5e2S^^Y#Es86rInVzFY@cwze0`*14MT2|5qr><4B(H&+8Q{Zbs% zVLr#RFz|!pkul}`BW-;K^|8=kx~nfR(^C?UAb2*5c$QTs@#LmN+3(7#3(9q6Nx7~q zq+Hh)vUVa@;xmpes24EHx>Dkq&hAbfa&Hz)?uP}FdzWBxQ*zq&$rHD26nWlqbip;{ zvjHwckN~Eg9fE1+M!~f6*Me#18-i)){}D_(`@4a_}~ZxEPp{Rj%!aVuLI9J;rbLK1=LzZ7S_+{gx!ZwDnNn z#43D1K7fOmw%s9^b^W?vmicYLwDYHe>BCn9v&=sUW|@BzoJ7bxS}ya%n*#fto${`e zdV0_3u3zneJ%bUS0H!_8W?;%GI2fNqc!prw>Bb%6S&r+sz$|C3=+G8YFfZ+N{(Kn# z;_NvZ;3NW_pG%3K3*yU&M+NqeC4OIk%Za5flZk(U4@e3}d@WIM&5Jh&`V~0WzBG&Y zEo#VqzgvU4)1Cw{>&|kCY41$I2!eN@h-bYXlz7(NwHM-P%O513e18#4ow+cDoKt~o z1k)$?2u=dKbqI9mgMoR0K5aR}VD6765B=fx5#SW@$^g$G{#1Zzcl?$B z)9(1E13a7fm-v9p!J*@59`R=ao%zHC0j?r`4Ihvi9J+UlWhFWoEAPdCS@#=pFn$2S zR>4IGxlCa^`_+Ad*IEl( zeAl#C`%!>hSOCiBrJ*8zy4b)&1QEa0T$^B%Xe~PjD&lLxRhI|64Hq{jOm8 z`(*Yv@X+6v38udr1=HqDf~$ZZ6U@B7H28JFHHfFgKZ^=M5FJb0?x6dK|0KX{n=Bnp z%#Z;%62MGP;)t)u2gKcH-5JEQZ4$uLWw$0~o3hTtY|{yX*`{m{#xtK=TLM#3I2g}5 zx;Y0p2~5$si+SRFpa`K}{AUgZwiO2PEH{2v5I-0};`0F>E|_&WO)zbqDwsCAa-mO~ z**45en_C65{5HWX|8BuagkKlT^7jcYL-?Y>fX;`HBBUMkC(~&MG4s(5;wKOm3#L9r z=L(niS3#W1dryE}Uc0{H%?-q@8-baRHYI?W?=r#6=lt0P07>G|vREIzHZiZZ#aLol z50n$LB9O^Abl#wE<1a8a7#n(Bn}u_|uFWQv>)JeGxt7f*K8g=W4Gz7Q4FpbX4C-={ zVAjRe5%Cn3OPvHl<|SqwKPi}gb!&LUj|9F|;^~8X1y4ihp6x(q1~7*Tc`6WcOA|56 zanEpotAP1^0F0;4-1QDP1HBsN%Z?&q4fF!Sulo1k+Ei3Z|djHBmUv&{W)dfXD+SY@7QwXn>qh4>qw_Np{|6I40uu*0+2&&er+}{!OrNY3%(Au% zrfqu#&j)@h0?04B#NI1<1thZ6tSAav!*no7%JiYx1nfeyJ6Ukb46lfcY( zro=P-GQs3vyHcMVj(->c#MMhU;kH2Gl8hJsu)KH`J|NCN;s=(YesKPI z%c%s0rU2T@oaxCZHcD>-zIn( zFw2e~!v}=r#eeQ#&?g@Zuv<$2(+_Sf0XzWM&D+4_7=t4LOh23>n0|2c58~+u`inX& zhZ0{8Lm;mIKkT6U$Xah(oks#4mYo2mJ(R3>&0H)%sH5|$4)%ZnGw&5R62R1@ zWbyFD9mMf$G+lO{G&PIcLwpUU49o}`Z4~M zz=ol~iN}KYQw7t8GX>Lz^97TmRxsP;vx3P-iFXH_%&%j?)mNScSsPrryIi(lTmv)T zMK}_`%y*q&=5w5!Bp@tX#~{mAKd?{ebtn#=I~zv=m}QL<%(5;N z%yKFOvz!|Qvz*0(SY3x@-$=%;}BXNSx?19*hs3Sjph zR&-_J_PisQ z?dk62h0{G(6i)X&Ho#TT;WyQ?TVSi#g`6mh{|3!ky@7~=&hy3olm4L~Aqv(+TCc)(A_vVn3zAD2J zKZFkm{X)#L`r$}Cix0?qa1a+DbZbc90l-O#FG6^hV7BS|1t$v*AUs+=_bbhl>U z4scNjSFgPS{s(S{LD)Z%^#98p{BN_ z{-$&*e$mV6RHvKM)vlCWT8qGx(aN^ArM9u@rdnrgO}aH*xv-_Fv9b}7Em3CorLFci zHrH3)jB3|bE~sCe28~TZaxu^jk#hdP!jxbdA=Qrd+vtr-m85W^Y>7+Puv5u!zEsr<;qk ze(?!&`l=yi?egZPmRyFJMC}qBFSXUpmGzBbKAW^~VNG4Gv=(GF*}Os6E5&vqlW0q8 zPTyEt$+3d;hI$Ms)4E{|`%BTjb4NcWIR<^dJ7ca$3Ub{HBC@gJg zYOTB(zr9%5+=RMDO(6f1{LzJTHuz@?jLgF(Tei5Rc2WIOT*fNhM80e>u0@rN%TRPy z$E&Vyu0sO5NBvFGr$h6i60LKi(*4X~&kX4!7_yYe;9HV&rbI7MWy^aa`k|#^>C6?) z*Gt6?UN>-piQc!ncapWTcWP);W-f6vc%QRPpwY`Bn=#~dMcR~J_Vi|xW==1_1;ejk zM4DxcNDfW$+Q`ydifA>*Vyhf1Co0{lL#V=%a;4e)OY0Xcj?V3;*j%=_?A2PY6k8{g zXxUujSU-d{=#^sGOrm9T>!?V!UMZH%Bw9AEt|H0&1k2^8_1S7mThr`cn%@>~8&K4; zy`4)z$v7qE(&=SXrosC#sh3i=LD9+99ACrMSB6dP;_8+a&AG;0cB-ZBJ9|y`)!emr zZmzzxt;rEIVegGdv*u*NtyYFKDQB_w3n3wBoBbNIu_34H_8IP|W5~mxmQsphgf@KRAV&#_G%v_q<=)C(+ z*VNFka7oCxrOOt$IR4srBUZwGE48F==Ayqcy$HTE3f4urbi!(QSM}rZ^{K8EVmrHg z3y&=_eaJQ_;4^@pQvVXDf2X$}T-OX_l^=lzP`D=fV!^|?L$@;{pvRXN)j<1~|PA{&kX{rnsQ4v;E zN2G_Dy`B-YAV=|{$Qqu2dPp65qq#PcD=IzAoTL6ZsE)545_{{z%oA_UmCKqV{CB(@ z+H=?ga?pjP=Sa7Gy_bsR&%Q0mGC3@x4;@=hq?#?uO+j+g5M5GE4O>oxk}XBdko9tO zIeqBZk|Nb?SSjbQtLD2- znTA5^*xbSM^U8F%rgV#~rL{JLt?P;A2@AOiD_X3)f;DaH3fxHYss2)~au+tWxT~~0 z#LZY}3;bvE=e+m)XNj`jNV^A4&e&=^wl~hSrsh-%oxwI=h*!F9kq@6cU(lsuT(k>L zJeOJ8pGYQNT(aEaZecS2hm@M47d7 zZkk*=A&HdJSi5v7$5w8pJ{3bcSKjf-qSZo{97_-`?|2&^^8}kQhbEUcC#ad0mynJ( z`=KeDwD)}hV}m&+VtsRhS;CrTy~xSQ8l|PPC%u4|M71p#Uhc6L-Wk?3HTsiYNRgFn zJ8-l{XsNWnnek0_R%kW)sWJy ziEx#v$1b2g%<4leq~b*+Sa{ z7uxC@{ekVWRoB&GyFgGx@SG&`;))YQE+spOur@M;126g|XI$u}t5}-bt3! zrdrb4>YBc3Sn(4qVJ6Me1y)9BHjswuN|5j(yh2FYOGvY+tTC`Y8$z^ z)GYLZn?c;vH8d?+);poLxjsm+y~B+_naBNBib%69la*{aIaTDK?44v8vrl!GUw0DxFw5gWR&92dey^}1VO|^t<@MykXDVDBRV%S&0K8ZJk5tB()vNa?~XlPoj zxjaUbVhzciO`jK4Vl*nJ%^8&*mMNW6?hzyE5vdSncfBol=7{7ltBf_?>^D@(OCG*| zkFeo5s?n6eYWzePjixq~$>!KK-rVFG74>#5Esf`kT$fEFWP)`MV6qazRU$4E!9vm> ztFE8>scOgxW)GMBZmAmKcvpz0MegvL!^R=0HZFO)ZHF{>I

    |VU)EvXJ$^$N zU3xdD#du`I!U@}b5Uyx+;ew@0$1iGVT7a2`@882VsjaTAT;w)#xIdQx2?`C?deuu? zCr$~^B6bnEuJ87J=Xh>C{(|7oj85qD+4F<%>`>+JzJ%}novdg0TPA_`^$&2NoEsGv z!@p&s{5$^0ig~P_rZHXdGteVWF%r^sXYlv1SK{v<^Ks5J{teh;9v}bSj(-oPqI}=* z__i88{=KB~ef_=J_Ekul&$k(R*1jEv53UILIz7HwNQ<&>wa53A;Tvf9zJV{Iu>PBm zwAXQ{Xnh}mp0)2F`1m()^xt5FTHnukd=((y3>_8a>-6}Jf$wSPk#C6MdtUgIg5SIN znv#hgPY-!~Tk%JDyM^y0(PR5Qcy4xmUxY!WBoI;iKJDqfjfC4&38CsOhaPcC(&pn2 z@f(0y5B}XX(^&4yXe8_BHgpo@KyrwWLeKIY1RwL0kAI7(d{26OtHH;=WmHk_Z+d($ z8a}uz6A1s7SVj4UdVI6Mw+%|G@d_(L16h}m{b_A zqI}@ha4#+~x6=8@{uUu6)zLZ|$1}zNr3pA@rCh zg@ZB&eA@rYaISnM9^V}Bec0s)KGeQZ9$$mu!_W@->SZ26GdS4_K6H&xl&{8{hgO5H z99s0>ScGcd6&~L%@SPvB1$sQa%;Vc-_{JN)-7w7h?=|qvh~Rq+dbA-WX|IB>6qxqW zPPK2X$2S&@F@yz(P><5?@eTMQ+6{W-n}l@b>pv#jzG=7!vAtB3FAsXeDM={4C)2)@ z5vP2wj?U(*0p9}2!$A3d2|deK2EOG;r+rgIkNtTRt}E7m2f>#>yo&O@7kZYj8+`n` zaq@9KVjB7KJiepgyAAOw%E#}>wtPno-^EZ?zCXa3*1noSL7LC^Tj*K7kzJYjfOab1 z_dLEj@Ug$EP>-_L<100M9Pi3^=Y(wgHi9o|{B}Uk+E)&~k>H{KQiiYA)xNFhSJr>Wz{mcsqI_S4p0%$EeA>PPwmNdo^^a$MJR< zCQs|Xhp~u^>VKC&&)T;UeDpKxJKOM`>hbLYUsQiN+2ecI@Lg;8p2T9o+V?8>Mj>5A z>-$aUS^J&_pSJHDC~JMYJU)Ig%N8XQJ)Yj}@$m16+Qazm)>~W3O=<7$szu^ zH{RxekNL?rPxN@c+vD2?zLOEJqTG*pd{u_;V^G%m7J}dUZ!h>tl}z+_8iyY9q<8{p z0ACeC+BYAe^8Ep1mhV;Ytzm=+^(enZoaH+NzSW2)-wgkySwXbemwtdC;0+T5Fs-b7?J81ao4Bv-5zEbeD zBVC0YlnRfp0AIeU_I(oRYTxr`XWO?8d~7Eb-XG;JZ@E zM31MBdVDp8Z?Wjnj=D3m?c>d7)cjWsJ!@YF_;mhjHheQYz5(F780jkHpnSmN>o$BX zNZ0ySVQ|>-F#~*~97FJ-d>{A5+ivjbeAR0BKIrjPf$#nZzLdvT^p(tfaFgNt+!53v;qsO-md|Ka?hHv`#Z2Jy@FNt&&_1`q;S^M4v zpI*;zfilzBU(WRSUI*XLl}z+_n)LW)d^L0Z{fy|5?=Fw;AOag84?VuE;5#6B z7%1Pf9$!ay=K0#^M33!p-6`4jHH^q`AUWil4Lxh$Tiu!Zt`|M>UEuLGgD=W|t1x_D zG<>&s*Q28MM%#C@cRgBd___?=Cp^9+_;y9uH_zkSYxuro_zs+v-M%m8ux}sqZ2P`z z`0h1)_j!D;f$yFO`?@{8sarDbfvGiYk7MU$+t-GRYE=9F0(#cIR>RkA_`c`yZ3G{x z5{mYhy&m5V!v`4J_n3D*pNf79%21T=8{YN&b;GyS@O|Fnxwi&+1J-#yVy+VUTw7&fQPRq9&d{xllczX~b(>R`g zpUk$e2=its;#HLIwPZHm$gP?6)x%I$zGt9^qQm*L9DIMqxr*{Voy_Jd2OsN6`@Vrt z`DS|eTU^IS^}p%f{nioi>HM<8@SW@NO#>e;t)ZxWXL@}6EeGY>Y51Nm&93iJ@FhdG zpdLIu1U+)6cmkOXz6yk_FXs=Yu|0NqeD8wq9mK0pkFp(l#3`OYy1-Y3kbK`l$TaeG zC$sH)`}FAc{WA0{-`n8hI3nL}gvz(l;~Vw9SnM}QSD_wdSu&fi7=uFF_erEH-$1WD z3eJdr{#@X-$8PYIgNOD#W%z#QU5^srTZeQNweL6H_2@P5Y5Q`#t9|=NXZx=kd}xwT zly498h*OeMdVhv*FXEK%YaZWI;Dc%?%J&tIuL??4&|-b}BUHY*$!z;-a9)aZ73I4o znQh-*@M-%#4Q1uK0D5-(cHsODq^l@jc`}>t2>2SHMEedPRK7FL$>vLxM33K7p~pNa z9F!U8EZQCiajtxY9$y*wzUp!WA8KFR<7+c~&lV$9D_(v^`!heE&5h+rFYP!TTVnIH66HUqjE@w;Oy_h-ZCYM98!v90xtVso+~d z2Z$)&cRjw5xTvj%4*7n9Q2DMuDce5Iuc%rm%6BdFh*OfX4SZF==4LYpH?+|J|o*0{5ZU>w~ zdsLKf7xXM&=_8rvAisyQ^4;U{Z3N#}luYz^y20bCFns?ldbDFKI=S`BWYml60~NLJ zkAt)IYM@uDN(fc&b?6bNB&`AERshp4Zz5zG%YDw{>i{3Wk6%Uke&F%#0-w(JZ$Vl4 zuJ-(L_sPm%h`+09Zm<7FlN+#v<^m%W5%z<9iIJ(W#o1a7PLO92^ zM-B7_M3j57r`G^IxG)s;UorHEQ<5_F8=33xyNFZ&HG2N*%2DnhufKHX(Bu0`TaRry z^x8bV9ng!a$EToY>oLRBBaVW!9%p;?IGUr}XT5&#Y7V_UxR15k8ii(<4*!9-)$JI*1mhe$Mva-+Sdj>Yv0r0Q~wP$eAOP`F7Q38WC)e- z29K|3N9MUGe=kApJLSx5``X4w&j$(US^KKM$9k|mPBwghEY0TY0N)29?0X%0mT$S? zd#~ZE^~TXb@G+l?;wtD_zV+Z^d(uAsR0Gr8xyN@1d}k{eLgky`@!f0qPBVO$d+qTS z_%IcRqI{Qn?XeAfx^CxhP^f)pd3*yV1kZJqQ29zczE=(38HVp<^beed&wcI%UsV4q zh90?7Qc&{IO#dq}d~ajCTE1Q2dqwgvQ2YJ_JpjG$B<+~t<8O#Cjs4{p_^|aYpBRiI$>#Kke*!(rSB!^I z4Txv|JICLJrDqkM9=nC7?$>&X;Om#e1^tt2sYcwz6&kc}g5kS;NVa`5E{I+a-3C2t-@#p(b=XA1x7g!r z1>e6RT}ADy_xMuZ%&ec!H+-K!KVbGkA((t&bpLz5r#Az7oS#*++$mnadJW}jKb>OA zJ=?3tI`An6ITerg>M;@z5z#fApQjqWcfEeK9(+sHIK%f>uV0lKzKadtU%h@%Fg3c} z-t_uGIrx@~ebWrzFFd}<;EQUvpLl%Rz_(5KE;W1`J-)Xt%J_`cR{wq8#(ycp zSMTw?4ZbM<)p&gK4c}#k?@VtU(Qt9bCTm~PTSwFxKK_;%>%sQU_xPH@cQT1Yw7&oF z)^)9hZ>HhfIV!u~cYrUdKR*IJa;K!6HtsEzH#VT``!ZI9B9#hvkl*`FiBXxF7R<(ucCba0X@rC@kC~S=e33}?#)--mqb4w zf7e^ry$illv2Tvy`?IhRJSJBLHh*0&XW zBgMXXhVLKVedB!ajf=4F9q3uUb%u|>P0cj+m;GLQtOH+h1m7O7J+^`mQLcUG8@{a` z-@V|wDuVB;9^Z?G?*_y7adcjshW+m~@I|dV=R(icx8U2E_N_8}@AvrL1>gDz`=)q& zW#B_sb@g3f_`WbH+rD+U2^bZ@w;p=dz8di9{8D51Zua=Lfp32VUyH~0F!*%5Ei`;j zpmX3f^j||N7E4C(@&3x%$Cp~lS7-RX;_o+-#J*mF2mPi__lfXc@;CF?faT{pI7jm%=m3Je5*aa2JmfB z=OLs`l+Sv6lfl=3c((6NhOZNGI1T+*{K4q!QMIR62EEe}r=sOP;Emr3=*?CogsR7V zPsAxn>xO+C=d^F7vF|e;Ul;gVl?3_KjQDXYCXQ_@f`$Tz7~eO3h(mxI`;9m6$3xthEVxl!gB$fhW+Z$ z)fo<&qI^f7N1S3Lgui=Dzp~xd8onJK-*e!5ugej9DBnXKU()b(8opb>Z|!>xd{O=2 zGtjg4jRl{!+Z~4QV;?3+Q;9fwR|%S-<^iSIyH{iq3^TtikvwZVSeLrvb zuJ`!Hg6{@34x!q2t;bgfKAku2GJJ2HlWpHR@Qsb&`)}x3`(6Z}UKj2*e1|-~-QfFm z1mE{PzT&4d^Trnp-$%|3?1Q_VbYl{VT9;f6J!@Y#_|(383}1Xic71n&uQFda$3TxbCGoFyeA>SE z8NQ#QqSn62;EU>iFF?=QH^=bZZ}_%*d==oUR^t$ogYuxqw;FufpC2%MSHN-BzK6lb zeyO5-mqE|kw-uY)hDeZLJo zYu~%ZzU_wZ9*^%`@I}pk8$7id}CTjlX> z1Rvi&sHp#L@%RpcZ4SZ48-w%29 zeHVN>Uwzl`jq~_k1YZN}R#E?zd3<9JW%ez7&+wHYBTmElIrZ^O8<11^K$qpe9pEcM z9Q(`n4IieBEWR1wV_p^IW0}M$NqEZeJ!AMrdF@dLzS)w8f%3iAYmbBA)BElp7`}H( zvhCXqK8_z1<$DWy*1l1PGw+iR8@`j?m(ADwiC8SDWC)dS5cDix(Z6Tr=N}rr7jUzN z)380(gAY?oD9U#jdX}#gd{xk5dpvLW#tq2kdkuWbK~lwK(6fB2!Kdx}Bf~eu<9i)^ zSo(ybd;>hb^@i`qhVL*k*!mV=vPafXl?_oMI$oKFZa8`l>1SN{_D`d}jw)+^6!*@c8Ns-){`xNnSnX z<*3KUvF=2+aQrspsK;FB*?P2^a(`>eE%*4EbJXKJkFU+}{m$@R7PaaHub`uQH;Q{bx*zCRnjX9s25cQ5#gp{JtueGhupzJlj6 z>w~`Y2?;($Gvf+Ej@D1&kZC^3Sk`a7G(6jc{fNvV~=)b=izSp6I z({Oy0gYR<@eE$hO%hwIQ2I2d=;VbsW$6oM7-M5KJ9-)4Bs=uvh6FbiJo7chMu*r;76JM zcaq_|&*Lit-?|9Z#dX{e+__W>hyWTj?KR7&_ zZ#DSp97FJ-d@1NzzBj<9#r z)p>l|z&9CswC^m#H|&h;_Sn@JJ+BRcp0)4j&ob>%X83;jzHGkNz;|^-fBrf2EZBwT z>`M`Rbspct;9D(x>^Cfn<9Dw&U+o4T<5kpu-}dIK@|QCAWm62_W{>Y_@U2xcgvxiX z$2SLj(~!>kPBnbjB7>d(W-W=n?tch++x+f zeA5hHZ6dG_)1{O3;8PApD4uzGpogqZHs;X#Iob`bi78(f^rG71-%rZs%cXbfx!HPK z!8b!}V4(J0CF5M}dkuP{BJ>iIv-t{IGCsF_g`$VczmplzD;CUvZOZfULjzpSNXQ)M z)dbLeQjf=3X9b}q?S`He>QJ6I2fmxtgHaZ1jI)F2&M zoL^|)gh^A*PZ}xjg@c$WlP9~B3ojCotQz#$56+qyk86qKz9B51W%8bY0#`xG@O~qs z8|zoxFP1mEUo4IzLZ*}yta!Qp`Sz0AJD0SVbaw7*FX`xfw54Qid&!#4&Fv+(b>7up zvbuBCf_<}#3ifaAT7}mkg?kE)4T!Dk=>f_+oc~fkoQ)ea_pDFAY%dwwS<+rItaE64$?(p2`@Y$CY(sH-`oEO_`@+BHtvNY1Iz9Z& z^sxO-zw?is)7wjmJ0r6dora8u`~N=w?}Z2Y#}+2ILKw%dxgY+rd7z7}O< z-CaFB_lz7z+;t2|oq6rUV~AVdQS9O_yQ78q`y>C6`0f(m!hvirU+>gjdXMx!%(jL4 zmhCGJ9P4qJ)}EYK_#ZtPUB|6`0NQh({4>gLzcz1n+n=Ys10&im>t8fz=JP$QZjSyp zWqPb5&sF0z_c?^0UGKeP3rZ}^j|E{o2vJ0PUg3uBe>m#GqP)=ax%t)8Q{n|Hp07u* zUeoz#rZ=~j+{(_~&OX1YGu=|swqRey@%wkzUGtWdp>O}b|J3xseRYqv$3MJ$^V-MJ z!&j`C7;Afc@8eIfx33u=d-Bg4N``I5S0rr8Ta%1!?&-PzlyUAeZ|0e?YtutVr;FeD zW9Q4A6FdIMo?gtJK9oJZ!u9l-127_nwx^3f`p0u#J||Ks7W;cX9D}yNCr00b0$9_w zc5i3lmVFg)BAq4?;|flHW8v;GL9yqUl6HRo4dj36J-^Ri^LkIFe@phz%V;YQK9aX5 z|8T)eg&>~$ARDCUl=U6S_R9*{Kb^aK>phv(a88l^fqkE2!jnv&xXAU1lU<*yKh$F;*2> z0zcAj*Xd5kcH5uNRGYKO`nKiGy#8CZ-}KiD zYj*F0QJj+|I-^c?^UuFL5qA}K9VV~>ldnb=9zKa?M!gpO`GGYi(^_ zdhvt_i|SkJmMs{MU+0=ot63&A;FsFQ;b+4>iJx{J4~-;}#sxVmCzVgSpnU42i*Uv7 zEyabIxPsUp-IS&=`B)Lml?4`VQ?L%e&ApNQSbuZI^@E>2*h|M^%t(ILn*-*T3%%&% z$4)caOvlZRk^HPTkxW0^r1Jbc_wHLGxlSq4g&Z)?|HV6>;GN%S7C+SIWsdRz9K-O- z5qo(8xg^f>ez8f$pVa>>;#GKVPF?x;mqss z3e(@w6NEe;=9TveIS=YL)cwWKpAy^a<^R2R{&VkqzS!5`@?-Ju z`TJ@)FLUW7v75d6Jmj5!!8`x6oL}bhpBbz5{I$V5|EzcZ6FJB2JnDN+Y?;&-r_Ntn zyz|d{=f9EjWiJ0XW{bsT7?3(H_Tly@7H0!Mcs~{&>Y%%~hz|>JlJUa>TuRJLka8Re z@zceE$=xiN_enPi<~`Caf?3=Hf_V?~ieQ$Xk9Hy_ix?_634DQImQUgSJc_efhA+9| zjDRF@sLix9ehNMyT+7FCA3>RhBQ703MN9$+%TBN&kTE!jc{)}w>orL*>orv{>vgGM z#?2JWJ~T@(Ipzpv`Bj2b2p0-w9Ty8`-d4fPdy8P!sY5X9^ku=ceVbsqVuxT>?McB& zgtR-3Zcm}zaok^0m_IJl9lJbWbK&pWr57}{sD}QyT%St4ep%7|03Lovuw_N_afwt- zOEC3HFKeyC@2m$jn$FrqCa{iK3F9-rx~iGOIx1_Rle3ng8dkrJwToLr9~&$2)99Ia zT9*|;tAdEyMzm8Df&2BlrD2L|zSeY0YbMGyUqlpsQ!@Bj@}+$?D1TitTQ6sYt*SbW zzp02{<*RLJX=>@S9BE2+zGcm#nX{xQ<>-zijc{VLQOe;@6uN#HWnI`WB+>hAc=d#7 zb@`=nO<|*XQEar{zelba!V@^l6kx+79ml6jl3+Cob~m&GlpdSysC3Me`{9la!$|u_-u5CVkeLK zrBo#e+a{x^NygQIiIwSe=7&o&Ug7V4hIvBAWPS}a+AyWmUlcu#dq_uHgWt=nWbYo| z`$scFGwPe`YFqe=tIKMa;^%9d8ab?aNjXs&jdh*eUbrkz;X-u{;#9C)axxvC#F`|R z%peh;yarMp$KmUhxs>2T^>*TvI2A<4UdLKz4lpnEw1;WDPTq~f^3BIN?;}-|?{kQ- zd?_qamLraQTze_shd^%m?#0Orq^l@j1@tW6Ztzt>iF{m#DBt-W-!bt04CyM$H{RnL ziORhSCGv4eseFrpt$k17{>iNo5KmFQdci41LipVsr3lH#^_lX`0=9fFf{)J~RFv-u zL=dMWA&E6q1u*#lL%um6vwR8EE2@1z3?<7~2NG>x-ny!Nc%f&`|iDE9x>CWW;a`y1=arJnNL27lT5wjp7Rl8GKq+n~ohDV{)P89wfX zRz5tp&*IyP1g5Ddjzf<)B?&taJ z(|G<73>I78LrCD-Rz>-)hMwhX246Xp=s(_uE8jSe?=>VeD4FQ-w9Mn{2A}p9-r6eP z2fg~vK|b28LOn{#tM6Oj<2a&yyd_q?(>=Z_@J01!-6xbnUP=)>|e@vz~kGB^UGY0;DdUUeI8#G_|$)AB3=3Xz4iP}(kT1< zz4g0{eZ19Gz6Swpe<{EPqLBuPsD1YV5T_*mRbwCT51Gbxe90Rht>BBY?}#@(rsBG# z{yWd`J?ZhS2OpoKsi=M5^!Vz)r~VrUWwnogf6w}|EJ{CI3~B=CKAFa&R?5|+dR{b) zP>1pl=-GGZy#7+yuPCZ_F6>5E4W$8mZBhnY>Fi_H36rKyNg6rcJ9IqL7yaYEL$8nv z(PU>u8J@qzV|cH78%{rq13f7g?~z>xTzmr zuB;!;H$Lk(B-=WRH*8;df7h9-u*H8{8D5*5U3LZV+F_poUOQ~D!+8hNv7)Y-qxf27 z?Xb}^Zy-2(+f;Wt+0>ShiKc=%p= z?XbK9SH+6TX7-B}EiWvH6;&L_ixqXOiN}hj&O}e&-PsTMH}~{hxa|}Y4Il45$GOkE z!fBv8P!zj=INwXJ9iDgK!r1PDSp(LdHlnEFtly0&EClrdu+GC9qN3$9K|OWh?+SKy z?|q_R#E4jDVbOr1)1JpW{lPyS7C$`Tc})Mq;(G?%fA^rh4<(CE+woxW+(83T_}LGh zx*7gCcLMPJ!)^e+f7m>Subp`s-^iZ*;3e+#a`zeF3)duqdJcB=WIfhyNVWgyD0I3z zivO~F@?F>x)Y08B;J_gFR(DuG=H77nmLDB0y7B(^pM;;GI5ib}X!EQu(~y-;XL$V1 zf#U{*Z&T5>>DVKASC$mzofF@`Z-9H>PrtjDlp{{Xd$?`!5huqU=y!0adv||~?{_sj z`bE+EV3v6sn@J41j_X$rYX9R&Ge6qUm)iKML#*JI;xJG;dtLYlp{+@|_L!C3^}F_j`$NSN9AW@$L7hUSt2cPo9dCu9CH< zHRb5)7uMT8w%o@p6Al@GwBoi&cC4`e@j8$&Vtzff_Ueu zwsk{ybR=UB4sF{M@80C>Te5Rs(f;netYhKK{9r$bJK0lkxZjbX@WI?q4qk#+V8aF= zdhM_RcHqkc4SHzq?E`Ugq@?XmH;{K0@55kOvAL(``(G|BI_+Q_ucn^cJ$?PRi;G6Z zPD{m}+I%p6|HydJ;GMJj-QRWba~;#M{b9t&{GwB0BU7=?&6o_%K4<97!!8B5XV_GJ zZb%#$%zYsD3_Az?^qyg396p_WdBY&u^sfa)2eC>c99B>?fTQ(D`>cW@Cc;9~li1H( zb7tQ9n^ZSHwdWPA-FR~Nq8IryEZ7mj9xMHgbD|OStHb&3UH1BI#gF#%{A*n@hu6you5gtZnYZTsv5wJ2`HlG_>S7%uN4>MYuK1!=7xf=e zI^+&);po_jYOY9MRI+L4h~53R>>u^OHMc+5wr20A3)-%z-cxi*5nkmFWQjYk>ge2g z)uGhQdq32FQP;RjieA~5gm1Pj*?rC7Lbr=4sKDHngO;Z|`gg7RQU~6L59r+arRxso zPc7*hx@huMS57SIk35~%K(%xFGjT_|Q}KWG!rzi#ZViox>fofA7tIVgUwEEIVwh-4s*W|LVRLBNqga_0d1|-Bc6^y0cAguf0$Nu_3N14{6Km4_I}+v zs=7B%@9wVJ@nEuh`^5E67T@yj-UrLq-?O)SQ}OyQC)a&V^>(k2jMCOTRPHf6LD^~**$$+;U)c- z53MViH}T*#BaX(l>?;lG_n|>^6Mw_mo9KDi(1zV}mta%drwd&RBXPz%9jl54KR!Hu z`(th2-wVYT_Kga2w*IwaRo9Z+J3IRo6|DKWEEKf1nJ`oDczngg`jSuQx0j5@-l7up zgaswZ%l0LT@}0U4I1%g9Q~l{8rGP7rKo*hLTfBupI7ps!sSEv z$4B0oUpH~Y*!Y%x306q90>1gT_V~yPPmbSyLE8b;BJn0V7*erUr?J1=l!6Yn^PT0> zQPo6z<*sI@#9k=VP{;I@9d7%_OIpj7Jv}`MQ{m+`kKJyQtvIx(g#oAwm=exZ8H)Qdj?B0u6{Y7$8 zif|a-+&6YyCYG5y6}LQLT^7-HUIvd+XThp$hG69~%% zGo9_kcs>i5CU`8us{~gd{D@%Y`>0^v8&wLPim+BNIhG6NZPaH3^WJu~;3UEgf>Q{) z1kXVD9l^5@?h`y8;r9j4MtE589E3j-JP+Zkf~yd|4}N65XhWIcslb;Ct^uAQxDJ@# zr%HX=KU;7q@La+4Po>}n;99}7`9{I?$r8cM!2FIla?+n|f|J0wJ96>#$>#;P0(S{s z4*WI2^gq87hde1@e%}Of6)+`U9E1hLGJPa~`Mi?CvWb~aiQ|5n(hrC37vZ_?QE)uN z7!&lZI6D-C#pwPO+8yVBhOj+!{|X*$yZsZ4=d&#Cr63>g@ref@{D9yhgd%}GQ+*nZrfK`FiCOGyuf) zVJbkJ-+*ZguZrAzp{|aXQbX*N{_lAB02e|E-Am-`EOF7!&bX8{22tE^L79Mqm}Oli znEt#Mh zc5RNkZ=nzM6)7Q#fvH% zn`(NQ71YV8)MmZ95AsL6ypQmul;yw2kKW0YQ@N=o-I^Xhe%8{P>szbq#MGc@e;wM)X6G*5@YG$gzFG1 zyxveg2H@-65+u1#)w>RWI3;NhV>0J_em)M`!!(|k16aNth~xd83iT-G0T8En0^#qj z6z2tetPa!2_iF&lw;DQnEk?4_V|dKtJ1FliX&*1s%D2bkTL(Vgx2RB$vfJZ3X85?I zQojEKI{BQYM!N+n{ zl<#xUvwXY2R|+NCXZIc~_W0I;kIyeul&{|7I|9DtP$Hk*doa-BJBkU3>suA&EAaSc zqmz_FiF~{rpdRb{s@J}6fbR*!t0>+0n$6@)7f-i|U73F&y z5yUA;cpZE?e$SRP^8FNt<$D)=j8jp*7Z73jCgVQ73URdW97!YJERb2g7cn@Jh*wd* zE1+cgHiA#>I}gfCBi~sbAHRp@drBsHJT39~jvD*Mi5~gz?#|hV?%?DpOy0adQBnJv zrCjzo$`R<*1kimV+41}kM8qo7aNlZ0)5fAd+dT@rPE+VVit3Gl0csoL$=57pU`RQ? zFr0Ay#EE8$Lh`tK6sArV_2chR;PVMeutq4u{cjL41@Gzxk6Op)`1}iYyb}3ecqk6L z+Gw0e)N^tAM}_!GIl&OXb5cxT5bh15pu4+gUhYKx1|YmG3bv-3wItZ>#ntw}>wTgFl5d7PKrpoGudTgtYSok_SPvB!Cbfk(-dnB50 ztI4PRjUkWYtqW5Tdg!X5DCXa45T`T+sQcD(Mu`D`3a*ZQ&# zPB{Pke`-(B#EBP83I^=)$7{D3pyPE2O6OP|(3vmq$FZix`^{k+x_j1Mbg~=2`X|$W z?~jqpx4WVVz0uoS|96JAzOR70(60X9Ko^AHC&&IX4Bn;hRp{e7IXMgAF!X5l2?{P5 zIOiwYMLL#yrl$?(#{GB>znYeM{JnSO%`NHXW`v6{(ibeNZ)mMw%n@%N4Mk|zE^o$P z2vs&OThLHnZS?K5;1v*&h4+y${#m*E!x|RTO9_8D(^}iIINcB%-{*wVXT3OsEm*d2 zA*#8Qj|$A}lWpWu{82z9{urmVzWV=RLW1wdVNlpPsS4+IpR$fAJ|84L-kkKa2tD=< z6`eyW5n=gKIM+1lD*l+@6eA%O$V5IK)Zsxq0f*(Afphjb73Dh@5yUA;m}B@@H{~Oj z!g%sE zOM3PkH`Ojfj=v^3zg+Z>KgaFjO%6ooxbtWojY#46A&%)dPEe+#xzVHz8>4!9TDGsa zv)}i>JhHvJr>(ts)+zUN@r!(d{g8L|yMNP=5x2%ab@%$ar{6Pj_<`BjyNIvH8L@l# z>{Zj}R{!I0!pEG7u+1gVt9<_Y!sd+P}#M-x~ZohTI_J8B%tFl6Tkx|R`rP#|hZQwnpj)z&$ z8HZhrS8mw6_nzUGpY^9p*PIh;-~8DN%f_^K?_E25VterZ8C#>CG0)9Cii zZEJ^*YTtq^BMQ%eCQgU6ZyC6Dc>fJsitoAmlb3MsnA?_t4RwEWyX zYYRHCb?Bb1^Clgrb9LF1e{iDPyCmt{tAg)k;zkbaqHNi|65BMl6_T{jDvr1??iA?? zW7D_+^rNo!EvhX!pc36O@|JHvvt{}AU8Tn|Ye zG-20-mhaZ#^buY(M|>%N|97ii`0l8edwPmaqL1?TFg_>>n_D)--S;UWx{#ZzOcKB5 zg*3=;I1k?kRq*#r>Zb>dSoCfY_k})!?S9BacLm1v&_@w{9lpY~KCWJ3pUZe@Mt=J+ z_nl2$#hdv(L2irhw&LAv7Hp~19YNc8j?y%AE{Z5C%1u+!@vJgVi5CsPQUjarU{XMf zT3z37!M+04TE2q?orms1Ut5&7WnaP0XRG#MdL5$rbNgej5B2x-lgfO05F_wtFX&3l z94uV$eOVc^9>wMzdxc--dIqqwK=3YGTqKWm>S6qXyRH}G;%f6{4Zrp6ySB}x~snu&YgJlYw5;n}L4`=;*SSC07C z(r+(uPMJD=#M(jgt^su#)P>mDRgO=5yZJee!L=2s9KfgRl5|J=_81Dngfn&e+e=zwB3>1@Qv7d^pKvOJB!dqI8WVC4F1kX z!QHv}nY*4T>F8yyE1T{2=fF(&eM5z4(RtU*z2dE_9)r!;63K{}huuK;ypFNevOhDP zR>t@5uXmqyx&A56f_7-ot4r$l)^n4l?p+@~;fgU!Oy^?>`<4|{z$b*>u zdE1r*t%8#`T92R4kvmmbBspJ20hf4lhQ zo}T~w^11BQ3ra3+DY;})$+V(^%hKm#FXhgW@%HXRx37BTU<_`61H^gtLoX^>G4ZnW zq$|_yCFgG&uyfzY!2WRVAj){8-yY5*ECrbWN+yXPOD3gJE=Ekr z`E)Bj3(?F_d>Qj}9&D-@%8k@@6JNqt{IN0m$3|QQ<^#X&=_u$*e`*sh_G?eMZ}j&1 znZNG&UwOi@A$UaL+Oqe3kX=D@J*{^+LDO^JpOxPG{N%xtDE&|N_1$XhD+bTwW^u^# zLtc7=cYdC!0`aNrD9nTIFg)d0t(g%rf2XA1>e5e+J?G`; z_sgnKpMPhi!tnb#dm98( zpU;)ZLw!E)AZ9&=3uZk|6PyGt7fjn{3a0HJ7tH!K31&TR7989sp)P!R1z~x*$By=C zeVsq~0U3cq_x6n!%=(gx@wESgg30$`!Q^8fq7JF3m$gqz+QOA9_i?UVewhx$wWI8p za_z_uND_zc@p5fJV<4_AfO*O$4I7Qd4idKzF?ML zA(-Vm-y$!I`?$oj{06~Egl;TAhvie$w=6GS;-Xxd?q#Ik;&dcrERHxE98!)WE+mtQ z&tz;YHWi1~aT+lVgQRe1eOuD zJ|Q@T@CSnFH@;(IS@h2@1=ByT38p{a5KOc4IIf|e1U^|X?U^8$zPUs&{Xx<1cw>Fk zhpdl&#~bZXKd{O5`?~ndotXJ(6EX9-b_ZZSN>qDMFJ9)7gE_~J{j-C3)+c^WfLVWS zFP5e4l_aJjggUx!)r}EM0JQB|iD#L7FHarX_G!WN;oX8s^^jolxpsj*%iJgNNrcR! z^>TKy(hz6o*Z?OH#K#4gZJ<76wbjp5jdO5A*dFl-4!XHCE)6u5@iK2rBbNHYEVuua zIo$k)mkz9NiNv$MbS3x5vc7Jt0n_$Ii6_-^!L;4&m4^=N`+&qJ5pEaEdORh-O)l?&<@r&}@`JR6(q zqZ2auTJYs9QQ4y6YpZMUv>eax>lbFqAl0JU#g)x?vTwJMGQPU5w)#dsulJtq>wYiy z@Ev;c06wFoPxOzgn6)WP>FOKZdxGQB^-_$aL+xr?((vx_3A0qyczVLQGm}5EoL;XX za%^bRYDVb0cN@0cpj)6|_&D<=U_nDJtzWblUvt*#lFUn3&9CJ&G@*;gOP6MRKiF~1 z>aDKtT9lX$fl1Bj`j+f3En|Pp`W7=7S{L~>W-g&R-B69KsMRgz`^{VeUn{}VbYteL z%(C{+T0`oWy3L&S)srS?IiRJMUt5fq#&}QDwD?4P;N?)(jPt``%z|ih3%)+9sWFVE zpBk4%yoAc^nN`xj)Xea#tV=Jg>(j_+-H47!Mb}kMh|<^WMaaIGUWBj8;_J6cHdh~J zMk!~#(huvOYh!NKc3Io;vJ%+wvLakJ@?tR0wKOeju4D%f+X#KIp{d%w+(RJ|ukqB- z+Ujbd33_Bmlu7ufzar~vSkrR-u5uXHJbrhJ3N9T^`28@%T#Hb6?XkjZAf*Fjz8*q&3z6Qkc*@24k&GGm)BJ*A-k&o3;KCa2EeQ)E0 z*I*UpI~Vc9DM^?!Bv>nu4@hB_agYTzC)p`d~F`zM(}YB zq@sME^7zVNR27tHAD4Z~H_zjH3VgRBT}Amm;_-EWPy4goquPcHPz~ERh4UFohEVxF z1wfqAG%O&MkM{sfbK?WR@~y@>pCzeKk1_{kP_s||e$olfOpK0Xdo^8wbDh3Z! zLs35d{jTNHJ)q>{;{xTI=kdJ-K0e!0QNE9OeB1-7{e}0p$~O+c+BX&xQmK-O9#6}l z$2=*XKz4wy0U_<ePeJijrRH9KQ$kG|ChZtfsdj{-^XV%xd?;K1c=CGPlz1KG2slC z22=z@7g$6<5hf5M$Pp40h_HrH$s}GOiX;);5U&sgA|4wPSrb%@F}M*gjN--{P!L(x zMLhC*p6aSePiF#rclY=4|Ns2HZ_?9mRlW7pTSr${*V|P+k_t#!keQFOCx*)tKpA4U4Fz+h3BZJHd_`2K$EtziHKx+ahrGMq6+5W&UxD zZXb!*E3EA>nS>J~d?ImAm9RqZq7h^QjLg77L>ay$YI;u_l7mHO zceP_*b)=oP*dzQ{34(5=CUBQKg^3zI(=9&h%*Z97#nqA04pZHU<`?M4Uk$(0cUxi} zqIq0cfb|_kf|dyEg7=2FAJkx|irE_O-QSeCX-ulmn(Nc-DOtm3-muydnV6fq!QL4g zfW#DpZh%!Qzi3q(Pg7IOyH?#*-iBviQBCAFTVuE-rh_$RmId2K#hkF%yJ8oL2zX9k zBsTXb-jN5LkgwBd)T}0K?P=8(B!vQ}RW=g8cAEACC_!ST;%$h$aSjIBNA9k+yaT&a zILiJAs{`iJl`wZl+G)4i6{Y)JhvL-V$ABSG$PB|I{#txthxd7ZIxN6Vq5vZT)J1uD ztFEEUVWhF1Cq&fW>BMGM;#)>d$VXapUV?E$tNBHyn>vK79{~eurz^`t#wCar z$^EGG_gF&q46+PIWAwVt&vp&0?z6Q zj!&j*y+)7vVgF07-|=?8p&Pe;Hgrsf`GbD0d*G3`;~u``r?msVm^aUU%l;qN?F`xe znkVDkzjuHC{a=$kafAMO!JP1=^>@unzIODH&i{Dfy7o8Te%+fx^8a8@ZT$M~m7hPE z-SCg^52khdVaArB+rAm%ex~*h<43H{csc4>?{jfKd)|rMdezRFFMfV$QNv&6et2SG zw?B-1?9<^_pV&VA$T#!SD$j2l@l?&xs3ob7hWzr`-hX}mUDe>wy}bty@N7u?ZS$eK z?r6I2577gU9$$CItG|uxGHKbi^pP+8@^b&(TG;FN{cy+Hm^*gv`Nzbb)jPjG<-2)o zf~WTln^e9-6!ZU70bKC6Pd*)T{mA6=ZP&j%_{66_Z4OEBJiqMC559ggBIBcOJvaR8 zUq@%&Q+BF){YPE5|JJ_EUG4KypKot};N{C!Uw-1(%cp++;nnZXKmK|5<^Q~@>4xpz zr#CN_M&=KvPe%-a{;dX}`y1i03_Wjq!Ula9m{mrNTc;Nd{U9_W@zW>OY z3%~4k@q#`5hpBS^-wOCWD&W!XKP+7~_0^cGPyD>vedx=teAm7B%-T6)Klt;KPAljA zt=qM>#L%pNUjM|O;_EV&52;!I{qylTM;3Lr_Iq^Uz^xH;qc*H_zqaI!RX;7?W=Uw% zr{J+cZ{3~Ix!X&lmnT|AU3AUcTYtJYsxHdAVei{-uKnA6Z@w_=cHiSSU;RSKloMmT zpY6%9{OQKzIg9?c0sNj<;P2f4+I1ato-WcdKD^krV$nCZ-w?|L+CxzZby&vlqbMPAn=Ny3I1_M@vmY_p!6$Kbo?A{;xYPef!PHk6gC!_HR>; zyi<2$+k0N!_2X5J@7KQ=KlZVweSNOIe!z+~5A;latM9p8tGav`(kH<;eBX|+FQ-kO z_{QD0c)h*HRaFdmbtxPS*S~TvQ6;n#K#u zC%a9&bim`+b^qm_#)_Oj9DMPv*}tWgJ-PJLeLp|_^H(|UQ>Xsgb@uX-KMh#X{bcoT z>wkN)^4G82H{ITD(>vWJ{Hx^h(UGxVg>OCKxyIW4q6hD||KvR%+;jI|Uf(lzlD`As z<8mer|ARc9-vx!r^S^WY9hNEnV3>#q_72}f8Gak`^MB)ej$Kr_p)9QdE8aQxeV%`> zIu^AxV0N0}oh%>A@@8FF#q3>k!Q0?&kGU3-9$&s}qI)5JXUp9xedN;`@HIu^cd@)G z!}a*a*_tyM{=oj_Y!WWr9jI6EZiL}oT{^G_yKVa(JI@6$eT-e z>+eOy>U<~4^w4?Mwlz-YHS(N11kuadQ?Oz_-O9v4m@f6dhsU(kdw5KSJaxH3@(jO0 z^2A#v`QA8-cOW1y%0v2hz*)Q(0)OiGs`RIhpGjWBnWXmdV$-q8cdA4=aPk-=%0cE` zl!MII0EF>fG}15}=}!!jRl^U6a;ls~x_yMVp01n>73s=%R+u+c z=A!)Lba_$!Qa4ey`~mTGHub*OAjvbG1j$q9iIQhJvn0=SQYFuHypm@+Bvq%3!*`fS zLVr!L|F!nRwADLI>=D#EOd>BxkZI1A{>;lt$y2Y#B+tA&Cwby=o}M_&%lDGka3-nu zP({5E1SIlB5D>l8dyvFZd+agH8pU5(r?4}TL|n|#lSEur2uQ@09ZH`zZQGseY~S&` z^Sk&>v#q{H!+?MnW%T{kT6vdZ!2-U_a5nFz1ea`KN*7`Qubc$m0f{dMv?d!IG{~zZ zt?rv8kb^`ZazGKL-;%_Iwasg9PghO>mjBbdAs|u@6jrA8=C?^&>@%Q5{3RoH&`L{L zlFWCR__mM#lXJmdMG}byk8;}mtxlVq(kbYhDvTNA4H3}*^_NCYzfxI&GeW>?4fH_e zaoaHCOAO3m|CZnM>Yt|PPr;ooL;dG3Try`ezREo~0rmGkjCbX~8E^8O!S3Nh|DE*y zy?B%742>T=_}@wI--|bSP69SA_;=F#_u@^SGsr#c-%3x$OJ3|zmEX#yZ>McTO!_~B zh}S#$v-q`PER26Y-HrRhn_+&Ze@w}Ji19DRO$;5}EFw7GuSopHxLK~R9wdI1TssJn zPn2Pi?RC2}hac33VZ5JyiNlCD7jBM66)8Nv?`*_d0lYimM?7YSVZ;l=n9PVb84h`C zMW`+(7|0p%P6BTf0*J@qhQfOv@r`)%;o$R^BFd5K;cvtnj6@Y)8-y#oa_~mHMmRM1 zDN=YGPZ;r1fj1X^)KA%^ncw?y81eWF%<;G)g_i>lBVN4$ubm7dUNR0NUal-BcneZ^ zbKx@Lx$!ay<5RzLWf5CIF z^dF_)-4HVBHy(J?AVU36)qcDMCcH-A@p(m&!t$kH>XP)DJL%K4xR5 zha|;bWtKxiDvY9ve^>e|yiefHRDlLL?%zmnC3geH=LRu9&-dGma=IDPJ#3akqf=o?&OI3FCC*Co5 zFkHjI{4$9Fg9i@L-;6oC_hW{|4^Ge}&%BSv4ZOfWgT=4@e$1~;O}`3fkRQC;kk7pm za<+PRthC?#)X1)Uv7@jkzfDmaOYv^UI=pJAGfhq7u#)#9>w3I_p!;JbHyHR^CDVw{ zu0&>s1biebNSey)bb2Y7R?fG>KLon_LSn{anKwQk!#vz!&(0d&g&E+dy^12S{GIyY zRT8nK!MKimA0hJ&@tQ?`$hbJf#OI9+LiR4mqrnaF@BkES9D)3{Gs%bq!rKU6yaUAK z>|OAECL$>}BZ?4g)$o*fFM{s{jYDr9qGW>Xw$MuUb??)apC}uYL}9)?XVZvS<~v(2 zlj2t$JB423&apJ}Z7tJfLB{UDeh)GL*~dFjdIazx%{+AXg=E|G_g+q`<(YM*gkN7@ zG1?)jag3oF_4bCE(A(P{=p-r@ALa^Zf&BKGcu@t}g@R}G!V%K`<{Mo{{+_N(87}n1 z<{QN|zvh-Yeyr&7EOrfuN-QheVDDO0>4``Z11k73s8fvx8#O6C!+XhxU>|wjNOcrYI;=4g95jxK{JUVLnWg)%smJzSDU7-#AxhU!0Q2Qzo_flTl?9t`vUtz46g#loxJC0INUfAaVR%fLCVeW z-(v#-?jfrvnC(G@@oW<#?q;8s`w6sZ4ixgdvow=Uyt!?3<7Q@{Gk;e|-VkJ*mirO# z&EaOE?Z8O11sI8Q`$n=^Tt+AId!gTU!2s5;`mT_2_cD|p!-t#PAtv|rj0l>6gLCgi zbVy=+K0hg<+xW~u_m?UVXS$y^x%vGPMGW7g95~ZG%oKjVDg2bl&F3gZjQ^5!e*``n zBZuuA2uNahmdX99$^C)Jz1ieWmF}B?#r+RHGK?vSUuJUiyf6c;HQBXdP<&Hl;;&E^prgNJNoy;Su^kgpAX<5fiEv*fiLH? z1-`tb1wO$*0$*O*0-qE5APtAIy~L5%@B`|N!|D>OzBW8o=iT&|86Ql(hwk4FC$%=8 z#Z8|2UMP9u^^<&GoCirh0cSqnQhpT9qHMu4f5ILDUIU+mgEG{S?VdbkZjn68;7^jL zdg~?6ygn#-md)b^e!JvZPL+~p{%R!8{E@8T`X1BF5BckGX4>T0_lWWb&pe6pmppMP zgL}JP{@}NO7v&G0ZAQaEnT0qDd}+rJ_!q(xB=CFcyuk0J^8&xO&Wrk$4=5-azuks+ z4`sK}Bu~7)l4m+sNS@eJBv0(wl9$zOvEtUnybC?SUj<(13I0;>LQn7`zzaPkFZ2Y@ zCMxulyeJ3o%$kOS_~ZpX8x%<3U##;2pNfM7J{uHB;P=;gfj>a!1-@*bqD`@9zgBFZ2iRFCWPZd}-Gb`0)T#m;?q1OlATk%7l#*Brpf-yoQsN9TX@Ihjpl6 z^=n_2n-gCA77>YEfci$!ILR~p>m?8M^t~M*Pc?3p{!E__aO#^zKFMo1^V*<4(=U`f zbu5;AZ=6Zo6W~6aMc%>R1zzMG{3h^Bn=(6a7G*1WQ4ZkK;V;TT@}eBTuYtdYgK^1| ztg<{sT2u@q(sJv(NNbqRi?j#~5@p375bLr7cw!KaJTWelJTaz8o){LnS9b8FzFdks z$M^}PU{_ z)(vvXiX;=l7Px6EnpbQyDU+8>tfg4_trY{LC={6YT6}^?DNK_^3!&CZ zR|1(g5S0iYjsn`r&T7+6{@quD3?AxL+&iDzYmQt-%ujwmIvdB!nEHaaqEV7oq@n*^9 zB9p?WEu_WEmY%tY3_`8tYo3rXwS+)V<|@!fW~zl}yh*M(OD#m%YUHY;8F zy?~DXILvaqA1UHJgT(O&`9vI~P>hep<4k|*!!X`Q#Qg|omF{HlGjJ$Uczkp);!Oe` z??J?4b`;(p!Bf8w9HbH)ae~u-6y7y(8u2iL?6>=^BN?^%hb^2>Gbaqw59@SZW@ zWddX|gowxCs=~Vr3`G6)VFz%q`n?2ljFX6i^d0b2{i2Ea@mwan-oU$A#L$0;LF#J4 z8;s1U`sJ{Ma?I~SiKp^QyJH;u6;X~f4-EN4IzT=|R{3oYH^Ydx2#wL0-*Vt-@K>bp zk|AfrJAuebKh9byyemz3`+*m%J&!fvjYlQS1rF=uJOf^?!~={VH{5ZO=Sk_ucWjON zl>krWmyg;?zeoTX^UHlK`Ub({_q2_89Oo*$E(W}>0A|F?1m1H&@ERdx#LEQUoseUG zIo?$I&6fJ9{0>GyTo632^Jkny8OCp%Dg8L>r|>lBW7Ka30y@YzJW-CscchJYslXcr zf9mJLq40i@`l^2mr1{840t^ttnkz~$sjJM9s!Ax=SktEfoDGCFy7)o zr#GJhk{HH=?HZLB+NFtg{>R5#m_1B@7rIzThnb5v=L&C(cX4BYb`sg~& zv6#n*U9|SVAHTDsra#ef{Ve8PrPFh&N7(3YrNtyCYf`xVRMv>WUEhRtsjR%Hylqii zOW!u@?SW+mCDu=X)){-o;yVVg)ODSJVnqdPIxp1T22bSn^NR|cSrsAc$8w&jNE$_x ziZWM^9k?a)x)=KmcMhzM{JbdBTja}Gcf3XvJ2b_<^|T~G&nu#)x?&TY(=W8bL=|%( z7JiF$^!m>E_Q+8w@W?6M8D+_>bnl#K>Eg@U_?@>pa#qRYJyoM_*0VdpYj0Crw5YIr zcXec8-EO<3sLs9nDodAwO&br>hE*LYB*nUQdl(|l@{TCE;VnJ#SkY+Y;{VxEPlu!n|+ zv!P;B2mC%&a87ZJhJuh1%1{VATnoMRGW3VVBw>qhVP>BYCbv2;^%X`Ns?yDT9{QPX z2S{Q}32FS(FEOPj=^q7C*gWu=aoC@bQ_{GAYq%L5nr9*x%>EVKF6Nq3~}#vUAw zN%no!_A$a%AIf&$F?<3e;j(4#1CMJ%*_rM1&~Godyr2+1*@3vwOgJwLQ9#=wd{#Z$ zS0YOoGCONr@Ue%L$Lm&6IM^ZsifCvx%Rb*SDe}tlHsaL;QRF+TMgBvCy|`c0^s!d@ zKv&&@Y!B(xIYjJqZ<)lG41jFHRf!B;7s~H1cwKqf_^`r;>@i+fZgzZ9wPufCPmHYT zpNt@O_^uG{<1aRXz@8h$xJ)&@F1j5n_l%F9F=pYEn&mN{H2Xudyk99rBe2-E1U_lM z%na`r5q_*G5lW~->7(44@Gu^53d+T=5642feup(?9FHqHvz<4>@>i=a9g4e9NDI3y zpD>!~e{R?1h`5=!M(h%Kw`-4dLt5BnIRb2^v$5MYOY?cMkC>xXejJZnVHgq6jp3%B z=)TBMUUW~Aq4RL2-FB)hACASN@dPKGLW=S?n(&tx1Q=d!3O7FUFno?FeeUa~h~ev% z182IonB3n?oCJoSBB z@*2)xNo@LKx9^$k7evrHd zp2RkA9A}mt`8RQ9J{8Y=lBe#}L-EWr`A>0Xp2l{7KY-B(6agJV=x?4XPkf&Muu7AK=Mq2Wr`D9g=6BUX{Ft^GV4wUEYJJ1Jfm`vZAh57B+}!tNgM!I4?x% zi-SC6FOxiFNvgjUII=wmoLD`ac~EIF52_FB4!(n&m!MAMiIFII%Fd8H@fJv)c$Ot{ zeWO^~=Qn~G?T{_ZElWJ}&S_Lm4!WvHuMtAEW78nPUs- z)0_HQh$^dyRKXZOXaR^#k&RNpj8`Hb+>%=t^cSx&oXKAxRtrc$H_@T=)z?r1ERqVarBqOhWUJz5XBjnAg0dV2XrnTul96>AAlrK71c;rs zcBCYeG1^sC^2S!FKm#nCN-)*DW3?ag3PI|Fhuv`@m*LW-pdG+!*+1G z9M9cNcykSSP}PrDXu^9BVZ6U6Qu=K);VlMU352L0@9!$V>r8lk881YkHS4#=gvWQc zSO&yvXTW<=;wcE)f-;-oM7ng+CTJ|b87RC=iO1Wi((eoK@bxk>WW9HsbAv zQmQ_Twz*2k8S$P6Ua69(k~2*QNLrri-S-<97fyR zLBu!W(LG6l;jHk!fWHxs;~KVo;xRuAqki9@B8+&nRVfSv`}xlyXT)0wJXL;1+gz0i zF9DHy5=fH5t~BATFyI+&b65itpx;~o3|3$`D?FbTsyyw9akHdS05s$W8BVGwQ3;HWkc=wz1dk~E{4no9p;ZS%toA90o z-c<@r%F(&Ngja6B>mlW+$0oD`qkgULH`8q3p8OCF}#8W|o+1VP1 zGNfV9&uBa3eT&5Wl9b$aP(bNMf8uf7F~e2A!KecU4|D5Q!?Uv;4s{PX>pi$Xk#kad zyYG$qP})(WR>*3J;`dc?Z!oGKAdJ1a?O`)F%v?8f`ApBuDKp2+jGyV6>D(#4K`M+p z*ns$h=$+MZoU5j>hi-&(&e`vVNr78w``zc3FSmCdgL&~#%hu?m9qBO_wJXQo)^K7a z-c9!Mb@t9%t#Dl(74vx8^5~l7`-DkC#a|y)vtb`TyUO|YU9{;T&2epN*6pkAp!>-! zyTc=WW3pp?&TMQ3ozlG*;b@p{?2D&B`H03a8V_rxJd1SsMO=IhyT*fHJ!FIxA#gAR+iYWP*xInG z!=^x%5rsF4fJU%>;rJRhzFut)o0>FpYSIj!HG7~6LslO8#Unt&87thfBrN$+$ugZ9pLdvplvW z8UT>PH^^gGM~fA3oANb#@9crJ42kt-2u(|xnU*wz8Wii|t3%{ByA5~>SDmqsxWtR^ z*?#bX^jRXlcgx(IeOUd7wQQfEsJV#kS1LNav&}cqj*ruiwhs%(vPhUz<3yf|Tg1Q; zLB@!=i1r~c>pP?5QmkpQGuK;nE@|f2-HwbqlOio$vb;$%7v=Aaow2DB%lsCuKi6{8 z3u3)rJ4?>!@cQRf58aDo&bNoHSz`I&!(5?{xX5 z{cZ!B-)gKYT<}1D-@xhlA>P;-BlCf|Y2<<&FG6>=3E4S5dS@H!&hgH?HkQ2c4oX0Q z893)`+_}B1qG0Ft9e)`<4EFDwtf}KI@bAL#oTs3+wC})gR?Y6D89g8CuwdRLs)A_J z-I2knS3dHxk$Gb2F;6pM9{Lqn+h|~0|Bohn)VSkpd8WLfoyh#e3AoQt3L#X%#&-k6 z2Zm!Z*x-P|G{x#wz})^EOnx|;%FyfJQnBoWdj}4Zygw%3eyfP?8%*vW zP44duL-Hd1T~q}0F%GUdJl}+8w4Jg%!X&_7g?vY`cM4cR48KhB zoM+}Ylu2q%l&UCumzd*}14fP~)x0J#)c1E8tmcwCk>?MHtwzl~_a)B8vJKSp4jsw&om#CJk!}Nd8Q-ubbb?7DinU@5~6Xz1iGtC~hP`{ZX_!65` z&&}NBZw0qvT%0m5WyKl3>ls{LO;#q)TOMb6KsB0q$P#Sb{bU-!cfz^;oBU{R4+|m(Z5CB zg*JY}LVtWSk)P{KhMgfjSeYsKz|~u3C4)+_xaGo+`S?UFj7cINYyh`lh-TdM&>Wtc zjBus80uO4A5s<+ol#2dJ4<;16I*bV^7^RFKP8X6E92Kh4(Ay-wS-EunoE0mVwaALt zy0kg?3?(&Zaq`kLmDU+$Jn88xm!-`Ya!OsMYuMZJ>^8CtYCdVDo|T#I7JMSPMIjgq ziA$%HR;myUg=7p4SZkzY13WX5)0U-VB+tS2ochY7)0A(jEElwW-FBvTD*A)OoRs+{ zfBn&d{z}`HpCM(F?B8++Pjr!IMeWd;+YFMgprh@^4qg(51cKJ%mwdSH444b07yD|` zK8!caa+m8t;#bM-g&g@r8FnXb2qoa-a8MtHvCl6v;jMxn$I6Nn-qR+$z8D`IgAnnU z9ffzd36HZ>yq_picc&`DE&l-x9e)qtGe4-5KgiOu_PdpB#6y7i3 zjd(?9Ou_W~myDB$Giep@lzv7#N&~`-c>Ja)pKTN={oaR%QNJqSO@klxUW5YlZZ1(z28DSqaB5HW5l}$c#Nxv>5_1H1?ZQ6i%YdxD4ZU{xTTiq51_S;-Xc34Luk}de0;`t`)g; zh+xE<1UXclpA_CaDaW!P{Q+|GbyoaRj>jvAtl}`>Imj7Fh5Ze3#`*o1kvXOtCxw+< zN5ofoWf1Kx_3&UgUx`9CMY|Xg0;eAX#sSPmZ zFck`z$=Fb380KH?op%{rCl!Rp!L?LXC6?^cdi{1O=VuLYa zrXH`HW9Oe^C1HB}`Wz>x>0ZJY7_m9s!mz3OEAiZkOibe9b@i~l5eFiUM2N{*G`fCK z)2CtsGK(JHzA7`vv9eQ08YU(q=qu(6jjzd{G|hTL|JBx2)tEVV7Drq536p}<@am}P z(?Uv|I)<(pX7{rrAXn~0dRRRZevt3~UmXQ0k$-jW7b?;WR))>xmSUYXKZWopr>ug= z-6HLAR*TNS3c*?7wNYzMt}KZ?mgUTPVeoZ-nUwls6=G})-5Y_xjK@=7ufkS^DBreN zGK4b%SXdOH0B1^5r|U6Ta_|y68*Y<)h|jt@(qBB*#J~z?-NK?E%7u{rWg^pKt>xA& zO-=A)Aso?@Dv>p>&VF1!YI|JLHXI=Vm$pAxF+&5Yk0I@J}OnBN@$euisP{(_R_qWt!@1@iRT(EXm0<*@Ng$+kWV`vE_Vc_if5 zFl_x;g8)1C^@H3=*Yt}*%yI|pM`(_jo?|Ilj-?r4Cuq&X~@eQ-^x`?^6$mjUB}j6x1}$X<5M~sEGo@5yt&elDyqfXcBWX&!z!auK-di69}-ovd>qQGt8d0R1FC8IBHOTyQEQs8 zEDAYY-;Na%YDvwh^49!z()q96A*m-X+dszVA`ELBY3z+SLTskinZ_fbI}#C`I*az* z^f&a`iOpqz`insQafsL|Vf_!w2+bLQ=&)FK`IpUHm*QEye5$Lf*VQF^Lz=5|lI#3| zu1;w9)%&X5dYcjLdbleke!`fUQ%b7GK%Y>HZ^KjNQEcDckw0{s04-UURoJhj`dQg_ z_b)%_5gn$Ufqqe|rYsyYeRpU{HKK2g=ocRD5M>Qj*s9{ot93yoK0P|5q}u1nes=Yi z)lT2D%@@Uf*TMLc%l8~?V!N)^byQ~*kD(llZJ0Y{Mxdi(+f3s^NYPitoWf?Rbl5~c zWiawsjs57^lWnQhC9wrt^=xT}APKQ!f|F)5zxE&Hl_ z`^$D`SjiSW&&bbHo2~|*wXtW(mI)gs`1^qawu7FNQ}o6mn#H&_da*b6E%_bFw*YgS z=!wOBfwwuU!d7S8_O_rX`f+y z6U?q;Y}|%w7T#xL2kI^HS0F}6i|=9?-+bcuNe)zGqAmBXyuk8=#N+rnM9dINVVrDY zcGT#;u-PHPds$vJn<$^EGbuh4tu z1_$j#n>m1$MEnm;@zdriJz zlE2tgKis>6bPz{0O6v+!INu{vMEuRtT@OB5?gXIhOH@_8$IoXSW$$7HenSo;B<>GKMrKf{Sbp6L&eJoOqbd8#p9 z@=Rii#FlU?L!)Ll2!7bwLjh=V>|+48&)8 z^32cbq#-WT8v|5MnNK7W)vjK;X<8f^46X@uaWPi^Ks;R>pV}YJ@+Lq zb#{}NItxAJD0eXY)i=|wl04I&D|za?K=RaivE*6Kt0Yey*&h;z$>m9&dKF8aGA~G; zG8K~7aITj;b#IhBbw4P1>MqLRA}}CP4s47d(Ke_si1Sea9I11)9tipsxMxyYTcLU zH!!EiG!vyi^KzZ!soQMHGw<^x&pa-XJoB|i@*2(?Bv1c0B+vZ5BYBqDhm!A&^JkK0 zb`D9NbwoW>nNSba=ZLzKwo_4eR0gEsQ0o$~WhaXU99ONn6OY)QzaTy2_ab^EN{gjPel(Q^bQO?G`VxWks z-^&K+JoBu|R+O{sA9zx0*r>N!!!}y-Okb2OE;yF$wbGwy&XPRKLG&AtpS8Z)ZrCwOL>bqtzxkgo~0 zy4K5(Aruh|`UdN}Q60#ov-s1~)v`b1_X(R(0*W5q$?0>Jd6HA-Brg@##bDNH8umQt ztCzrjord%SC4*H$5MiULdJ|DF#t?%(^OMh3pFqho=%a*QuG;s8Ez;#5zUmSvEg;4rC1y zsx7u6q!JG>tGD=qCDDb1p=(rt;>tDTj-RX{P{E~|8CX<$dX|ABq|3yiUCxJM{T z!9&?U;HStcnG7)GF?1C)Sf161_g&ItfSKiZZ&ak@_$@W^i85df#ssUt_s2nf7{+_1 z%Y-){eox|1r0}@Mi4pGv@NywUJZ4AX?FDbt&khIgsfrX{4Lpo^cS4y_@FQM?45NNe z;V|OG!NGgGB8A8Cy%Dbpk;lW2cpTR-jCg;-VZ_UXgZFbq3U4($jChe43n@Hg-H$f| zyb*6R9QP_PDMu&A??$}Iz*`JI>Ic@3_Xor`;`I%|xCh~ilztN-WW;+JAZ!Q3!%)YM z7i+>x1l|}0CgtetX2Sapc&a}59L}^@eyhPi)Zb3;1fH?2D*aY~A)knY)cc&~_J>Qr zk2lSP$2~-ki5U8i!sB{hBVG~ko`(qY%ONPksNV%>j7I(V{<8*uMGCJoHLjhG+cuZVJ_-%QuB;p{Q1fJ55Q!NVb zBgh%?@_~0y#L$0~e(#y^=A+T6`gIxbHk;}<6CEbYL6O4SWUAjzFsid3Vt#wzQ2M2t z@a_TL2n8nP=v->Ta|169{=~Zwhr;7GZjAY@0UobQMM}T>AV)q?222Blw&!)FZEM8)u6MT4}V3}oySqM7oHXMjZ~a|R$rek1BS#8(F}B^_Z@}|9xSEL{LREjsf^y9 zd*eO>kKbX@jw%}#hOn*3Z$PL4_vzn^7nGt!Oz&Xh^OITIQ^-g z-nIq}H8d^ljBP7^n3O+r+p6K90HoU1P^6AkX_vz8*>hj_e4@PuX2 zQ!^J$$Y``#lJ@lO_0Tczhhg?Mh-Qeix2~=ZDkUPW2e==Ed9j}HV3<7;>r{6>Vc8bB zHnMcj{>3q)!=`Vtu8myKuS4kv2iLBRoc>qK{%*Mk9BU)9x>?uSi)(xTrSN@wSj;z} zzMB^Gj`XeU8ENa{%U-!ot`nV}WAoh8YQK=p^ktf8xH)L@ewe9GIeY11(y<3o8VM$8tjui_o8dNg#sr>%F)jcEK z(0_G-c>CeWPTlQM&o;q?y<+zhmePm!r!43fx_{<}ojyRu-zYr7bVOoU8K@^l9V26s zLduiY9Ljyzfow16(Lf7yROUz75+k%3$ZIOm7BCe7UzQkfh<4kk7 z*MV(5J7Lix?D+Jf(YnR^7(+dlm}0RxC`(3^OU&mm;G<}|30;X;V)bP#=oE%JLO~-* zA*OO5^Wnj+rG9m$H&_v;v%ZEoro^I0Z)yr2ow`Nzoh0(ID+1u)^3bO6a@MYhy%9^q zD_R*d#wW+j4;g<;%wS8Grk|3=cN|#M+^d1OHd!zTJO=Uv+-=V+WVdx~!Yzq&!d?w{X z#n=K@tAT9IOQVIaO{|D%7O=s3c!_i-;T#h1^u%X3X$+Jywie-Xa@HSCt3xyKyNyQT z{+~v&`FA4FeQmHB&64@yxFj0AX}aueF~op7(!%eGD`G!;kqo~Wd^AR9++&bbj3XL7 z@p9>A$wcGn=3$9HM7X~T8$3$B+%ZCz=_m^nwtkY4-^Eo0Kqq&7RlQ_PK#;9zw zaOux4(U`q{N4f`z@QW?~kofebzRH$+s|X*U+j3-@lu>qECadg`Mt|O4lpPmU?zh8H zAKKp3{ZZi<;;SMtOo1>n#C0b<#7;17u9LY_DxEoKrVY!!SM z2Jx9mt*0Al;2Ea!BIe)aeNFhw*D{38N*T&a9Yk7EhQmdL!z7hmp|9i_K2Y+EM+(4U zCO`s5VzQXjo_Rea&$w*C^rtLI?GI|qyC@$vD3B9}vL%EXCwe)w;^ZHfax7jp?`BRh z&q-gr3~R`ia{IJpY33>Svx?!LAX}E2ywtD?&F_zo<6!2$d9vI%Wn~WYM@qdV?WWcu znZx{%Zdsa^d{as~)?Z=b6|=8cG6Z%BKDV^WG(pLnomQHdXH|GXfP)sYSah@!Ul8*b zyBVGn#aL`FrUA`D#xiR~PK~colb9NW)e1Eua;rlA66S<>if1ub1gX{& z4Cpjs0!qzCss@Ig5An^k*6lqkQ7PkBVrQqN7vOJF|; zGD+J%DLuXaO^cT$c^1z>L3qT~e|A6IFN^)0qL0vl95HyPTSx*J^0EsLm@8pi)wfMS zT(g`CGsR*EUWEIY5pS*x!%2|BONN{g z@1y~bc~f}fOnCDV#&Limg*V287YY!iANy&A=Q81~LYV5uiK+0qn(!RJ>x6LTm$x5< z*M!U(^P7ns%No5eLa<(2w<}@XYJah;JOhD*eps z&x#Cq9SnHX7ZCpIgY)CT^kd$P`jrDuwHJx57&|;qg5}rm09_FE!zvFyPT1q43Uyaz_0w zZ$&@u6V5n^Dk1b&s{Hr_pzyu~Z^Ro9JUJ{9F)2s-I}RhB-GHabFyg<1_(nW_TMD9n zQh4W@%4II(I?moyF^U(>)#leqta-j?(eg+OB z-aWvh{X>yT_ZD~<@kSZ&ddV>2)!;DV)wH7Dt0ug;20V^ynHKSO;4tF72fRV>Q>64O zg@;kUI}Ld32Nm8<#5dwaqJDy1m)js`#47=w>UaAY@HUw69KhrAlp>`c%hiZiWxyK% zVWr_149o3FFtmtj19kou{h?-a1~pbW_hf8(6ve(1+A zbqy=I_aFyIKM6dU2A?meAN%P6L;h#`^9}KT3hc~tj^F33nu z&*)kFUIrOs)t1BkM?*YSe?0Tx{e+~Kq0aMHwJ%hEK>MOxu=d5eR@h)I`TQ}E3e(_c zY+uxmr1Vg7SHaKNzKEycU^xAo+t={_*_`(OllGF773ugu@#6oeWmznI@6g<~u7;l? zRd+n|P<8tMwYGHybUT~2C7!=lq%7_~um7^7MFY-kFBvxEtnDR}JJsS$Umfcie|f26v=nMPvSdNmd^A;mhT$d>%INJFd@@$8@k> zd`Di*Z+QilP0{CG&*Fmeqcmx42E#1DDvR zc01PdAD3dCX;%9o40zyTdm1+X-0dx@%6hv#q_$)tn_L>Sbl^(w3xGjRaJLbpax4F%inLg&&Cg-LO zA$wvidBx|6732?gJGRxiD7m=$8q@{WE=M$mSTdd)TWuGsr$a39NGlY^3ansm#I$$R zLm^?>f+~pn{T_-6Em~id?Yd|YK3)jbu!LIwNaaIQL-;vEt_$A9Reld;SQmLqSCzY{ zzrMEG=Ug30JB-2hqp|?|&AlP^2eJD^zAD4_WT!oC@62`z+h6J(Rb6Hj zi*@9yth*wx6qm{&XR)W?Ywt^SBdG2y3)Jl$R5>U)be(m$Cnm&pn-{9EG>7-dykkuE zm}5R?*3eGb*sOQrbH&x2c2{>8)oz`Id%;t^cp zDW8J0_l7SVb0B~jzVM8K$-S&j@XH8?yk1jxmp;h#Ebw~w`0XS@>f}7hBYm8 zdc$S;Jv8Gtd5FS(h%ebGgWo+tQRXLBdz{1gRu+)CN zR#LU++a}gw26h---DKI3-junW?pvF_Xl z5an)b%6w%tj#W6|_wwSV%u2|;yr{|YN)^Hzaqz~GiK7iWXvwp)CU_MNLGZ7_5lwQt z-DA$PoHyq8c##3hj5gd5TiV7919r%^Tqi1x5qho=ZZI|od5)@@$p%}|SJKJnx)8BS z!5H4D*#XYhBD|}3XOTh+afHB@WF(tKGddC99Nya$-p6tR^*|biBN{O}vED#EanM%w zz6|FWG};njsgUJGB<}zDk#s*Q+~@jjU2ux$hboCj6G$}vBpic9_-Yxh+}#cJ!O|OI za?h3W+YlBFTVfkixO%2gcE8ioK7&z4!-V z$*WexXFK)ooZ^`V`O9%;9P)i}W*o&cZN)PU@*2)en>;b;R{n94Cl2db#id*E%olm; z$T5)ePcZPDf1p3}ohW(ckGj(TBAmxdo@Fpe@+_Oll4m-k0Gpv4dz}M+wPuiWYyq}P zdVr9OutN$5e$<*%)|0Z=i8AC%jvzY@wf0JsAqxl84~Mc(UM6{Bq)DC_>m^T&O_C=D zDIi^$mPog=9^M}(wO6P|^2A>)dCHR1+C!ngG>r=!76wS@FT0VxaC1EuiDPE9w(DBS zGal!m=+Ahh0DOtV;#T(0>5^yqYT1zCg?453NuD8 zTPAjk3wX)+fO1xe5^6C|wJbQW0s%_VD6xK%L~;7MN^FV~}Sy-SdG$UM`umHvPjdTig;S1V}L$PZiVM2|B4)glEPcAN?|Iuh=)^4|MV4UD?CX!uU;a~!Aff0 zoSU!(W-6-}QCrDL^1K#eLBDaP6mBUmDzIg+|NB;IAw{!H@|MH{V2TICOnR8g6;eVk!*Z#3ZzhMVJCMG7z1gjZw0GukY#GvQ5wn`1Ub3U8_j?>*pgjKy-M zywY!w32!dk+Z33Tqmz68GfpBMAO{T53Xj7lh4%?~V>_U2gyo<}>GvT#jCkB5G!A~$ zkL^L>JqO;1$F*7a!B3IG+YS#SUaA3)!zP8tKE{am4Di&riC40z3eXS7*nA>4?!5RrmiM_$Mo@lF6wT}PS>W4Ygm z!-&TD$MqsAPxRjpyhNFX(dL$hcgU8^k00um z6W3>Y&p&?PaCd@O7;t8rTZfC8vMRskJu@+PX>WT&9VU##8`=J;Dfq|aS#Ef19l8*{ zs;vUxFQvts?ZW%mXZv2gb=pA3Z=Y1;XFt97duxv?Zh{;zvy%`%dn&oH{Nb0KvSaab zcyxA1Ke2)1*LN3Bj(g|o8~$-g>XJjZF3BiZ?VYvd+mDuh@^Y8^ule*?V24D#AK znZnHV8+o|Rcx|2XZ09SX&O)e*Unu(>uV;wY)-})8O^I|DA{Y2Yyq=*~ zM~?M4y*8AJOG(8FsU8NYXs>6O*A|y&yHLsW6f(UGG7hgN!E5WCXX~S6E)p^q8)V|V zp5b0w-#lACCDUKX3^2&_@OnmgZSFiaLKNo=x)fTXS4{$esI$)>z;!%wOKrlu?jdati>93bc}&OAEGo za@TL1`;s&BdQE%5UB74J+yl<4(VF(E`_P!Gx3#J_-KBr8-J4NY_2FHqb+Xk2>p*YTBpn`T{L?vwP8dg^vInas^KK438gCQ1+7B_t}X36}vJj%ie!t za;3ArQrmXUR%dBt8KQsdtiMLn-g8%dy>V`xv$0OozH>Jo(i*>YdtHvwgu`EC9Bmx* zy8EcpeN>xuwEj~qcj(5s1x|N?rVV$yE48w}x=;QvYez+CMrqNrUpY#hWu;neMg7x= z-lMjr^ci?p)4QrvE3B=0a^u`joJHF-t-;+09D%A`;&zYJ+@svsjIi*}BMPAY$ScZ3 z5)+5lzpIr!v~g~wGxuRld&!MFmpupQ3ntc7yo~(3nVehctg6%wSJuDfUii-84@4<_ zl$Dv!{sE1}B1%d7*p0HTdeyzp z6YZk#JhPOFevJXt;QZz6}Uy^z?PL$53L@P1_Rp3K^7 zi+s*1pH_OXas9@*Z#y$5Y1*A`_nwV&-*r~))v7*qXroZ94)+1A^vQ;XEf{7Ts2_G$ z>H#Nw3J+wCc9bDrr8DzxEpwMco8g{()X`X}eeUW}_-I8zX+iFDue%GJWd&MoLE=je z=vfPO&|*-RLYlm%AGjLk$3>956-#&xTjMC6~N`-bJqK`5&I|4 zc2q%uI%noRTIODdHr}0xjMpKJxDiKd-!84I`s#_v;yS3P%l*zV`KXrW>QeES!(r-Dm{qFit z9cW+sT*LNx&M$nVmc_2}KH{UqM;wz`FtH=_QbAJ}rK0EkZD%en)f?RYiz64QC{`<%Hxt-|L<4SeCueN@Xm=+Gv(6R&n89@WOW z;wzpX>*OFvdW#Dm7=fmHN{Gob<4iyKqgYL%BS}u|+aI(jH0D?o0dpZ{WSzG|+ zY-_v#UeX?M=Z@4ekzZ($ujSqW!7e%X*Ro})>k#R_<*rK5WZ#V|@Ll&**N}$yr+T^{ zK7evPd~J~|SEhT!kcXr0!(SIZin{-toe0`{ZGm>g-8ej;B#yg!$Q02+#Fby+)7~_v zc-(b6Ax?6N%hb!66MryeqFq`!sY4s1d(_FEIn+~(Jean7UPZ4Dwm}1VI zB7^AJL~;!>xw1Vh`>MCJs^{EE=*?bi;H43m+{eu~iQEJ3u`aFQJy8ZuIW9gsz|<_Zf$F$XyRC z(YZAqaTIOWN_XVs{Ls{N%9n`-jpoD_n|a8gCAfJHs&f|AY3^qnjip-Y6BVVWN{cG5 zC=+e9p`xtB0qy*ExyC~R?#Tv9q5mm$*5d}(Q2(?8mE_Mr<3UP&?&?;$y_SONHi28- zHV5vg{uYZ4PzZJ|-CkIDsvx(Rb>4b5&>xp>&&feHAn0=ziEM0jpb7aKc;k0EqN{Yf z$O*3Z)8^!Hk&}JzYp2giCz%s8aB;(HB_~O)*wQCOPM+eB<8(RcDs%EU8*uA6DSb+0 z<1crmo-P~MzPNO|$jN&zB%UrOX|9f?Pl-Bti&d--LxR=GR99T-6Cx*DzH*!{Cu3b* zN*@<>f+3tgC(Q$>s#5o&(u&d|bRc>Tz`A8OgE3mA`*WA;aAiYf*~eFuiEFgBvaG=^ zyFFYB2i&s`)b6c9zSJP*V|NjHsZuAJYtaEjKkx8?!bkjLJX`^vxXU0QZcb$s=yv!( z&b^sH5Pc%LsgDfmQJ@p9$8AMWKolL6-EYv40_Pt-P_e5Ftt7aH8Pu@h+M?DpM4tx@ z{kQ9u8g>;LqT2|rVUp{DMbr>U1lMrlfzhE*Fjx`d&T%hBY+8e_)|ZL#is-%yYpPI+ z>sgAKIa=m62y|{JEiBA^jN=?M+rwLnHoFf*eYCs`{X?Y_x2s~$MMVYfovwt6g2M&5 zxS5IDK~6!Qr*G~fZVrFyoEVS3v~H)Te^~)~`yR6jaf8+}9hk#-#1eeBGArTgTTQ^w|7SW&j!eefM|zu3w#2nwsV zAQz={$ce73`KFFe^C<2u&WyUl&3E;jx+3&`NTAYr4EO5-H;Ul6EBchrP!0|Gx%Z*T zIRctQ#r}Ha;fNDM5dWh|6}tJOxSzyLtUO#nsi&)*b35h#n&Y_}5-Sq%J;5>$bOP#y1 z&OL$+>kSSmF#xYPc`VyK(B&HOFzP;^9fBCB9Lsj#_RMkOQD@m-wW_xqkZpJ)htnWA zbyeyKrIdqAZH@cb2OH-$IqUzfrT*$Tb`*ox4y8K|m*$ifVb~z9`-;-4Qw}XdU8RS# z)JGk;f7U8qEPNQ(Ke`&xSQ-k7UUFzZxvOqvji%OV$9{33*pIuqaafRJyie!;?9gs= z7a?7gQG=Gc%~7;NJNza3=+YvLkwl`krDeeqJ?`pW`?tc)NEd~mkJJl_esXB5-TuKr z>dTI@SG0zAMWV>89E$`^bgZkhOc%H6)1_Pcx=2(Fgpt``i5|z5uV)th-|5mF=!!Y~ zg~;z2(mn3#baweY?&>O&R?pdoD|0_~Xg|A)P$8wx)Kcx(DF@n7lB>(%uNywiIZ%&w zCWl02zdE$F=K963PbU2;`>85Cp%&B!%k@;(`5ejQ*12r9Ig4m%;!G*d`>0i z%Fqf>zv9ZN#e=iE@moz^JU?m29>sMSSNpaoXO&_@0f)ASw4y!CLshL-wcXwDLFqO$ z6xBVSD&?sAuzGU-SgZdlfX+L06dhCZbCaIj&xRrQpWTHI)E1y2VU#Hw64Uz0kk$@# z7p~GB4ZIle7$+|1!y>s;hU8vxSG;hz5@}(GX~N>?bs2Aw!}Sm zv7_;8TmvzOzZUJ|OJ1jVt}d)hz0Kk8?90$GE_Tmtax{Lg9sa8DQDg}{zUY)24mB1! zayOx0i!1zd12c=RUQ7(s{&WnP{kxbLKzD@RP4ocAa1q|@p1agh{{hm~8Zb?S{Gxuv z_@(rd)U}RAwCwh>F9FTOCDDX{C=>uqxCjwN~W!6%HFv!v3dh zW4cpa=QX@9(%pYcrao>uO}ZBx{$6AmPsbw575*%D=JP4C>>nVAEWaWq$W{kWI?2^h zW*Ot9GiKQ(v+Te1$SjL-ugG<|9N8LkUE!`rA9ui+dO$n2R@CxRN9wH_zAloHUW@x) zRR%|kxFr?Vm923!-x$9YH6v;n_Z69I3{L_oI?2_w@F7%mcIJZ|#82hT*~v zcj;rbtY7uaP$8x+#b^OtX6la{=dN@DPP^Tmx>l=NiOVh~t$w9D z<5rPeI{Q13J0zF;A_qZbFKODtoNP`l0B&3%CeF}Ya9a>Vw^Lg&pecOt6#dW|#8rdF z^^lrQ`^la90drTsQqw+kV`R{H0MF*#8a@!Wa&=3s{rK3g&7Fhxw3{QrQWPehYem7K zzY`Bz8MReA;C+7ScF}d=3Kn;GTt?_0esf~XQS7-;JJsBHa1TsfqcyHXqCI3Dn~M}h z?jLvaM)9_WBK;i05&e!;!(kBakqrg8e}nfWwQo1DNL8b+sAJZ?abgmCpQn#@z>VpU zDz<=84WA-+cV||}sWJ}Td&Nf(mOr<4nDj8l8Rlml{-DXYObj*s99HA zP;g29jk{fa3ODa|T?E%P`AZ86i(MC&78Kl=-@n+^_oe=Ym@Ud)>MeROXI*iPWoOYs zv`!ek0=KfV;9c#QX_3B=iTMQ~S;Ir^ZN|Y4dj6FZqWyhMQHRZoZKGX!{6D=fuo{ zb!a*H&I0SGpYY|kQQ4akLh_1MWxiR3?V@1cfI%;UJ1E)j5u7j9dzl5JX!JIpuMds(FLZY#W_gm)X?RPSYW;eD>~K1X=B^CfvN za|rMD!aG`cJ9X2dv^n}qIhY-h_CG~Kt=8EgY0x|5hCLW7ZHw3yvX|=`z-N0%-xP1nlN-Mo0o z(q*a3)6!Sma_h=ft26#hZ~_vOutX*}@tFiuVM0uc$uUJH%5+;zZp_%rF27>jmE$K& zylT?b*Zg7fl&OE5cJ1`*X3U(`y6*1yfrADQ89FRsco0~BShLiB#Hl2#U~D+}YBS&W zNx*Rlj>$MSJMVhp^+Uf*^Yo6~^rwUW9KZ9zd*j=F@<_i6Z@%PE!}h_qeSPASJ7$f$ z{kQveM*gdDc7Ddgp%d@R-&2qQy%nr}~e!{*}U!|3=d$vc(oKvoubB6w_YcI#< zl)hc2SAO#C^^f#UelGRim!pgRm@sj(-S=f!(c)g8oG5Ha`u5_o&)Y7I$DVNOkBrEA zV!3F zaxIK}=|#r31?i8!ocbpTyD*~Hgpl#B6WE$2&>ir{U< zE?Rs~lBD6V;?2T&((M!P*z{tMpKJkdcoNSXZhSM5;eGsZ$=IOZ4ucQhm&%uJzRSaJ zoOLt2?8ER=(#?{H#+#N>JrRrHeE*Q7$8Tr(LU+owI1UT<>LIPg#lU^%7E1YC_(kK* zuJ>j5E5hB?a{vEf?``0tD$cg?bF%p&te8Mt5JJ0w2vGrd^BqOIn`A=*34{24d9Q2E z%;xOL26+1P_v`z-|MyPLo_l8Qx#phlIdjg;$n@birQC#l9yG9aaQLWQJy?8#Xfl88QdgkPg$0D$}oMVNuKHBmOL@I zW}Gq%bC%?txRX@b5OI{%Tf~tC7{oBtx*dk0%XK>pL;oUvKq6lJSP~@Ssy!vYJJP)lBX_&R_j|POJ3p7o?)g+d+H_P3w!FjLfSL@Z%W>Y z`=gSlE~D%t0?T0d?R=<32!ZeUDpuFj*H&-{Hq7_?AtluklMu@r2Ia*$CZV@ivj`2{ zJx+bRKPZUR8>_foo7xI(c!{A)6|gR+X4MMpST+dPxN7B6jI)M`^m#oP%NGWrn0Q!t zvPvX+L!&m-MXUs|F4q{U=Ag$~q}{ORn}iUvsucP}lEzhtS8ZSwNMn6fbM4Ai4Hb9R ztXj#_NzR*_YZ|%l-7x7js8Wzv(8`TL8SKBf;=)K~sbPRjXO|3LEToV%iA1h7R1fA> zh%Hjo%95q4n^RK|bpr!g?ZzUK^QG2>k_ol+;)r|Kv9D6J8VzKJ$wGCPqK$(Px(Y#Q z@~&=d4@uv^ML%Xa87~WF+0=p?#9J519)mrA*ElDbfX`V((fk*J#2+ z_Z`67Z^5fJVVLpuS@71I@Hi?B$Hny9WWi%Pg-X9x3!dME$1#h-dkwrfzUyITAEJnI zq~~y%<+j1h{$G)jdj=NdJ<{QUBx5}W%K`f%x-lNt0L+Zn4LgVih;pQ>AVl6n1L!3P z(LeE+FLa|>x8VH_b{u0WQh1-i!i@Jj;MK#9c#OBgtFWZ=%~(UrI-^M8Ew-d{!4*ay zPdxVL3hz1#UN!KThKdwkh6S$@cu5c<9{YTScia-+_kqWBP^9py5${GB-xLWj28nT%T@N`vD=MNJ zX_mxOZCSrl)9@c4>g2=~C*>5x+pydVdqoOQtxHsL{=~sDMp-3SA$jI0sULFH1}lCk z$LoIl@UCduB*htb9)2)ooo0pmc}2^=JFI_g{$f`W&)29+uQ!DpM^A21*h6!FSG z__VVx7JlKgoo@s%TMPxRU0lBAvtYrRk30LuLC{YrL&S%zaj2fcO8>C4&lxOo*~h^m z5$|{QB?pVV^+B-6ug`Y&xs(Vr{Ph`&``*xCs*0^UD5|5Kr@3Ug5NK`!HUgm1T14Giqx z4mBc??NDL=LBZSOH-vXq#bxf+H`t)c{$62wUpOr8v+YQX+uyo(zjF_bdu#{77jeTUG3a@JUsp5sCd?Au&Cs z;4H9r0DD~(P#*+p`^&rL`(MW^TaVwhBQdsRofBac+e#BhcfRP_pD6t8Kim0Y*8Vty zf4%fY&w&WRUmw#kFfe6oSY*297=6hi9iEa8uI=@Apz5?G#yLLL{jH8J9f`Gk`+-Qj zt6`-mUpxX92Ur#NU*@mcIlrYnw*TcGf2`e6>5p|3P`qnfr$lPnbdFPDF6vq$fV?0S9kczsXwfynN&n(Ho*G+np_&V{6AHh`QU|dm{YR#JA%<7FFs_k;hM9muNyq9AUVFJ7E1NxZOdS zYzVWDRPjheDI1SMx%GB0{6?W_Kl9F+(xb8VNCS&;b-Z)#Km=W``VYgB0W7;JtZHCj zdZa45z;(PA-q}})a*Kl3*|%K$7Kq<*;x}3RI>j#w=hjZaE)>5d;@2a7v&63pzXrOw zjJ9}8<+B5E$v!xHb!YFizTV`Smmm&^eK@zqVomdR>^!)oJrPai!)FZ<`*h(h_o(Xc z=sswVShRgn>!PMbRg2~?^7^aV-TtQbM1O00oPT?}$g9Yc5vL>0aZ|7ICq6YG+Ybi8 zmB;+O`=H}Gy}zULXe^QlqWIlBKCFEAN6G{9jfq))>xXbN*ux+A58g2@49&>&2$hbE zooG8+wG-h-Y&nVXZHZ&r6WbC;x5uGiw!5)-s@==R_N#iKzBT7S_$eC-W`t-{fWLoq zf$n%wG!@)94Q{(_j$@*+K#>z>Y=hSAc3h1nVqAY5ZD#A;iRE9_B5hiCqT}z7jYWHf z$?n;MjmKc355uAFD(z+DQB?3|aby+ym}lK5MxKm7!-1YF%66rW-fTX$3rai?p3N#5 zp`u&|%xHo1a*_=@Ptz4j@IwXb7$=u{#c-183IfhY&h;r#op!*wH3M0r$?Tn&d_CZyIb_Xk*^HEk5E(u zkohr;_K{us$zb8~tIh?<{qTb~3^}Bj85CtMNG|g~?IYhq3=lXG1A&)c#efFG{UQ2w zoNENRFf>JB=fVah-#H7(pjbIKFWBkcy>pj)Q>W^}RGmX#gg$`r1pxb`@sa2Q>J+)wMn8{ghx%LxL`U|Tj*je5Ulz(OI;&4L$Bp`-KD5d( zVZS((IDAJax~sMNrgKsmlP>G@y0}G&4Pjf$?O{MhYsc>a9EZa?k5VbHF<_|_*u{G1 zQ7Q%Y2@O?Ku;t@*f1=0l+{ur990gh;`(G+~zlL29MTaUn+e1g4hK{?#x)RZk9y-eQ ztNgIu6(>w=)6m&=>A*g8RCKoEP0enoYJ#+E2rI>K0cBLw5;5$G8ou zksC{JI8urAxpB*atJY4B35-`BN(o~Hf}`l&xCNjtwpSGLV#mTegLW)b`M|g#E*rv@ zkKKBcfIxLaIzH~;R*?R&JN9XtpACz2q8adt1|eK~Z2W4YO^7hc#q3B&Zba!ZQvA zH`=JW`Gr+&iScYp$FzIds-kI)Yj0w!>fV}T=ooJ3h(e`GItrC4=_pjHq@z%=q@$dp zAe3x&c4%68SA@T*d|^Zt3e@*G%Cq%X(f!(R)hPGR7v{l6*)7ar-A#_)0&iS@BFv}= zk>My?ey?LE1L^jnrH(WgFZ8$ek$rpDvMdGGxXWh@xNQhSe%QxlW{s;Ia|vo(D;rPb zlH*P-XW7J*WeNOn1#*)nCCK|kBduVk#)#^ywB*2Mq1Lek%K(u%AV7FxBw?SRY|3K> z?2&c&m}KkY$myJ8$tlOiy>X0v1U_pCKWRHB`oqJYy>iU;#<8sTj(J4AKxt&_y=;8& z_(C&ALuHl!rqv#DeGMroVx7aG7BFuu{trjNKVG z4AmJsF;qvEBy!)`B{;neX-?hy$I>}c^hpgd<&n0n%R0r`ZWxJ2YwJILyeoYDQPjqT zWBZQ9zHzKTI>wx&b3=^dL)25|3{3dlGG*eKRlmcF?Gw2p4;>hn?qHW ztvV}n%X7iwJ!K#2-tzpQY(|xM;+ULfmAI(IsyXGIcfZozDmc=@ZtzUL}FLa$oB05ro1LeS%tUHH>}bp*HtZVGQ|8+?1MyM z4);^$=tQlq3ix953$y(wFtCg3xc2R2>&nJ_4Sr1WiGQB>5m~gf_-(q5#|pt{Q+~D_-@VdX#~chM|Eu>l7;!gqRroG z@q4rQ%@e;f#c#9tEfc>*;&+<(O~Y^7lPwz}Zt4nK_3I<{=*}yTU$h^3QMgiszgoG0PKAMv8~l zx5N8wU19$D>%8r5JO?TFlac4xaM_Uw38=>+0pjs19$u{NQmA$a{V#NOtd4ANDxAM4 zvCh4&YDpq`;@I}M&PfvuNR(TIu_wmyiLI+@@1kv2-}87@djIInGhJ8WqeMKG;)rGM zk;v&IitUi|dzTd8XTtKX`Dh)&kkyXYL|eKgAJd{u+@|GvOgwcaPlTTSCdbb{U(~cA z?9Oti(Vf`u7IpK!nDT|^iqVSun_9N^-1*>^cI;_xAKzK1?TPBIa{Nvk$t4JQV2IX^ z*!G02|G1^ywdFRycej7SLcjh-@-$r;FTd zQe)>MyCO8Co#?kV#5gi-OYpS7ouAdN(fl-*CDrkPzN$B&NX!th=Yek{PcXIu3^SWJ zbZUs9q3*H`o%KYMax2)HJ`xdQ18w5 zqJWhT^M0{#Ll|Nr1I6~Tk1D^m)Nxct+1`mq{e(k!h6~f4dfs&?2j`cL+%;iR`Toy$ z=oJ%o?eJE#r1lUw_2Y$lM?butrYrfsFA-p(x;e3&|%-Oau zt-N0wdC!!~M%)tZxb<_Cz55~@{doKj8@UnMg`e}swdG(c-0_Gup%aNCKB30F%Porn zzJG;r%M)_i#xz%qaY);wgel|V%g5Q6?qV|WWW?#nb5W6z8mds@x;VePUAJEX0K@h4 zCFj`Z43?SmmKBC&9tR|jKzIi+IW{irXqwhFy6rmyTej@@?xjegqb}{))@+QR7rE=a z`{?uoW1x7@RBXH$3U=Ip!P z=&csYcF*sxLe;=XoL^J+7TiTMFM0C>%MQu$>HVZ>8MgFxYal zdOY<+_=VL~I)Zzpm*atMH)c36#*GPUK!00(XdfR~QSm!_lZyBhcq9@z)7?6Kj^E}DqD~SEtPm)-l0#l zUxoc?w(YINI{R%M-W|OOSO0Wp)hj>!+&=2as6C?^BHpuW8%CY^$aSW%^2}N9nKPA* zcRSY)-0`G-m z^*8rRpU1BMsPV7ZB&X-p@z|bUI(vQ@(eqMePp`M9r}Cxa&b=ahEPQSGhPx4KL>4-` ztNMQaL7ls&c4_53u?Hd=pKxvaX3vhFp4+=C7CUR~O1v+!1qyPD*HQ$IZN4Mom?vh8H(<5?v6P|k-$&PfX{95cD+d3~+z;q>U+s#Sm#-ly{ zsx2EU3wl^T`A!4+ zleLA9C+7O!s_mGRfIf1{<>ShqwYASTCM8YHz@{iX)rzh<5nXj0I`s241}GM2Q~bT_ zKiTDOPlP-g4`^m?SVZWw@VVrUz%s$Q@vnTrTvHG5vl4qQce^b9N2IUPM zJyvj_)%M4h_ebp7zHWYYQ(!YEt}BccWp<9KQg(i z75z0v0!RYKt)fl7YT}vY2d~|MyzQEg);jE@?fMa?ZL)JG1 zK@6jXG5zAX*<=zd!a0F8A|+d$RRaTSdmYJ|qh3c3Qy#6qDxM4@#E=tD!x?1C#ZU`!TonIW1s9C-Nf4!?K)473ilqUTMH%x6XPOhKk0N22j53`iSn)7^`5$ zBSPyQjcI`h&GC@lKYChVZX*B90Vc2xADdpsG)4ZY0X(Pz$9R2meS~AN28Hua(;7&| z_{JU?`DarML)8zAEwDvkQ+pNOh7@}7P)Xeo3hwwVj%h-9f8f$XJjug&mjl~bW5V*Y zF>x`fplSBkw)%JMy&KbK=zPC(|L%<(nWSi&e=r7}Z{`mo(4lRbp%K^~exI#nP0x0G z2GYIxhv6GWY)aO4>Df3a#6GSqUtc)CG+(H&aF8GHhUeoIS=e8&^rsXIcvMC5*dGt4#TwBn^WLk z2=~$g-M$E=bk5oXQK%I*ICdu<-gNE58zK%wZoYgRLPS_=^?aK)p$l=x1eO~X#oP+Po>3+sm`V&_pqRH|bh?+;9z5BIjjf!3*Sx3Ex^K zIq#97k61Uq4xL{M2QFxU?U8+=2^Q`5fe6<|CrS{D>-gA0Z-E#FZIr{H>$LrDW}hgH zVs_^6B_p41>rFT;&jCUWet2A1zFT`Xaev%)v2M+=6t6$8A8~4ghJlFVwHUv5kL_^` zv6696i(!dT`LYpe?(Ls15ON8l;>mKcuug-gp; zyo5Y6p|9bRp8x3aqd}Y!9k~#F&gMP8ZQGZyrS*+|(QvsxmZADS6V``>H7Bc~j6LF} z@dr@HkE*&9$TMq3!EDqgJft#8^o?Y?DXLCiBHp@-#~HhL0>L!8a4r8~cwmNmLrnQ^ z@a`v^uR`vvLXi}2q8`V`5qSNMLMx0v)M;evA&hueCZNR_eZ$~vIUavdccP@rE# z+lFG|Sc_>LV{QNF zkAsn@X8W1FJzit1 zjl zL(%|GE79dUIjBIIq3)^#IBkq8<@sHvyvB2{e@y%6t(};*Rhe`LJ~faNx5&kZM_^|B z&ajzwc){?H3f!}Oad%*`KqA=xl}gx6E9Loc`t(^#0Y4!w|Nm@@Ic%5&%ik72qA z@2N@-y-;G9?!ZS33lF`p&@erW`Tl}KFBBLil#ss4LoZYsrr%&fe)*vnmJ5^Pha%nB z!n0_!O-^WAlF&AJV%w65_NYz9Cl;od2D72cL9oO>*OZ~#R`nW>>(IAt@2g_Pu<;r} zwATqEdj|%P1*mAoJKM{Y(4k&Cs+p#pw4b)0V>g0KnTnZ4yYOO2PaQ3!+xoT6etgYi zNBfD6*Nawkwl@3D^32#^@ytsH#qnj2ot?B0eEgDN!N=``g7}bVP;l(XV8O95gMye= z7!=$bEgU*UD`Y5tQxu!`Qmq61azr34T17J8aWq)I{AV_biuknc?b*`0q+dHYFp#hr z^0HA=9uA^Ew!hb#%(RLUCEl?(%sw{Y9U2>fC=Z5-g~zcY!U$sB{B^o=7IDS)qO>W!UwWakvLrG~d9*7*?QAOErNtpYd z@F9AK@|e?(KCu>fFk9?jPACE>qHo}q&wkGc8^HJiOTk&i>``~@4m;X8aP&vUpbhN| zR--o|9+(rz)h49k#KNQjz6r}t$xg{k&q_;Ab!DXHWw}!G@-py~?#s-~%*)Km%JSv8 z^U`zjQ`0lEGThm&d~ZsAN~$j>*Oir)<@I^<^1Rt8x!#Oidd^8r$xX|1yRvh9uKd)D zybP}|)1B(d$1V?lhk-$D5O#>dnf|a;N4ah}^XNELTQG zUJ9UG`I)(?S>7zS*O%(fPD{ylXQsJQ^YhcP(=u{g-mKI-{P|qzK3{rfZbp83etL#0 zBR?lSFD)lGBR4M<=&mf6+nesoPRq&3%*=6Rrn@pzQd7OIoZQSDZ*EpTB9ob|R2LFBCEb^i2CXwPa=mGpDLJ`mX|PLmyHfJA za?-rnd8s-1UZiTaJ2fi)~SdR8jp%6UIo%8mp`Z}!Wsav_?T4!LjyVwXY%sq=El|6UUSW| zy5{9;mdwD~v}Vpurpi|w6$JMBVglDip z12~)ZMT>c|#XQwwzS?5G#$x7b#6hwR(Jyn*5u8oC&SL(O#q6_~XIsp3E#^{-xm;Tv zXISx@{4niii~C}W+3Nlk&B2fIK~XyWbJfit*|a5t25>ff;U3Np{XtC0u%IvA>0T?` z)Q@cl-mS_>+-+hN=b)8MoY-bI-#%ynXVdPqnD5e#N&RmV`fs$jw`reTYFOQmTUgK+ z|HQM(V<2xLo3_PdqWssjFUa&x65%~yao=GvTiqYBxbL=@zhyD+wU|3C=Ep4NCoJag zS$d9t%AC>xk1G1y>bj^HGME~EE@%;sO zeCw-?li}SZ%vWmbEO-w^7`|CDM&p!|9Txp}S@b((iT@vDcs~{CcZF6W&Cd%ww`rw^ zk)C%;{a+OB+1fTsd>2UbXyJanc39>wj3Pf4%kYzhyH`8TNQ0>MXzY5hR=OMJJncrQ zKVe2=)%!it%${a6PUt*r3I7^P{yd9#k!o>`#;KNZvcK^NbBPuq!-rAmmq^7y58@h) z6T7xq()(dcc>R|2{kg1f#31yw7V~~f{yb&zzt0k0x5fN`OwVTI!)R@x_KpS5X^GDb zGQX5QV`9h|MA6?`!vCYCeDqlKXE{_v{}0Rbju+*pQoG!eK4&cEF00v6K8{=BJJRC* zRZIN-Q-;r$bTn4T&6Y!uTw!huoGVJ5>Gcum{ym{@v-XlDzH2S|eJtg_FXY#1^JIFL z2>kWh64~BN73LN#Le@v_%`;l_Yc(>x4fDO)A1&#*#1fx8i}`u!{}q9^O?%AZf0WEW zpK#x)*)93|ge>ovXofzIXsp*Ht_K{g?bF7>p0pR&Xst_YkY+>Q?}~NKbpNeze@ct9 zq}NX^<}w+7p2IX+ds^$T=u0e}nFFF~dY)j7wXci>h)JMJoOts2w3Yi)%rf`{-1Gv2 zcakqO_$2bP4L+It9D`>uQG2Fv{V92df3@V9tsKqKo>|KNhCFpyB6%n7%Oy|juS%Xe za=bx#C+Vdze3s* zpQOw5p;@0NtTZMi_fjDdnmqm9BKd${8J6%{0!I+jLg9#fnJ=ux+C!a*1fo9r0>O&7 z>9P%F)rsd12#+&?Jz4OyBY1{0M)C~DEqSJAx#St<1CnPr`z25P4@#ctNmAho{mTqH zq5q8rFZ3@rc%hrD>uh4;!4p&LR|1|GS4w+g+#q>kut+I+uz|8ixOh|jQ)OG|a}yHXW1CpJly4WW-rE0Mpl9*J@;+jUV^@xySZ;)(}P ze`%5rndZzuP!g{AF@n`9B~P5&Bu^ZYUTxfIj+aVOPOmlWMf-M{!4obXJl#opnQ<2~ z4uco=vaX3Z%JxdcvEGnjy68+iknlU!;6>R0PkdU%{I>`s{Wn4tOWIrqL7eWvu;w8gkQtFMu+Nhf{ zUqs!MWlz)#Hi{t1$Af2Blp)V>L>mR3;an^28O}|Tr@uPM)89(TJ8@qpc}97&i4<{50~ioV&>1ZrG=hm+6p2ewJZBll&b9 z?;*d|;Pc2cLZAX%`kjIm7w6l@YGvxF?i~&@>J9{CJso{FYv^kj4K{IvA-mFVzau^p4eZPJhA^x z^28Rp$#zNT)(T6I(5>3wg+6TtFZB7E!BZ7I$>5#jn+zVwpv8Z|;CUm@a41Ti;p9o4 z;fQhqd+NDG+B3{&CC@N_BYB1?$^hh@;7O`o75Ym(g$_>PEcO762Tyl+)5udFl75eI zr&-~MxNkD-MZU;15$RBE*o$;v0{{}~;5T?DZhE`HCy{4_K*_lDt%5c7o@1tgh#wE0 z;ZK!3!@pkg#3+zFG3HA?8ux{gCx%Ev;7~`=MuDe}cS#xQ_`KwuxYNJ>HT-}?e9d`x zg<&uJf~PE#BOW|uACx?G=B01M4@h9%Yw(ndM?*`yt0Yg^8zhgL;di*Q_f<+5>7yqZ zyh#5#vv{E%llbFUtTMZFlFF5|-R^lkV7F+6>{U_}{F`irt8^{0G10|iaP zMV@%Gi4UIcqOAi@yst`o>c3U;)L*oFkfF}sk@gHn==KdTAY$n|1S{TR#9wLHWx|R) zW#>rVkb?XSgNvg*GZ`c>hs)DyLx%dPagNBxEW=*JJ;~sml#%I1nRq4uNYo4P49A0u z_SAikq}or0&5s31 zBEH`=coAO)4ifQ|aU_ zHta>b(hOe2%bbt0o{G5aG-O0Mxz^w>$1NT_G1+{Or>xK)Jh7KZdt%=ydB#ihL6Bj* zgbp06frJiw1#9SkoxzXCEgn4Gosy?Ns!n_AK+S4O@w?N%;c{GUqC*G64)CPm+EIr$b0YuD#N8S;Xw;= z(J%LHyP5p`wAHjqT&fN-IVe*DndOpi0AEjD*6~L2ZTJB-f@+=oG zNPa!|Jh+jjLBz7#|f4w*@bRhLa86 zW!NNm+tStUird}k7Y`lU$B+OT4LR`@)Oi#RAvOeR>GGPTw^d+^=iBjh*Lko)$qfg# zX30finZ<@c8RewWEE6h=Lx>H5YOGqdx~AfSP$9&IKpDZEKXz7`As|LT=LZ>-Q5%-C z@+@1m@{Zx^Le1L7m8+U7R#hp9P{}n!Xozxk4Hp43L}&<%EG}!7h@y4jauqBn;85Kv z449=Wu@QS*vXYAb}y?jodzu_aK2G-es9vx@y>?0uTq2kU10N*QPZU^lf&iuBl$L)UXb4s0B@pu^rtp?FS6~p-u=4hriu#&b=uy+Kx+Yki`XGyH97`ci%~0`S zOfqB69$Kn1zZ|{Q`5YrF<@aRf=me51QM!wrAVuaRW*&Wgbpba2uKap z*lM1?Acv3~7BDdAx=7ei@9*45+qld2WfD;omhv=3pm)KuVu@^D#gMMKr<+pHNDY&}FtOLkYRUCXNb#wh{_SxosTXe3W{E5IWR#>I@MaWyuY6(hTW)e~^C>7Zr(au!y18vue zl`D9_ipgCm5>iBk#mr%gV-Cuczh-M8y0SV*ly+6sL+#ic2KlW<(J&o0BT^L2VB;Dz zjLWN5FSq1Skds+g@z{r>QR-GKGbe)*VWOiEsR*1*Gi)UYk{VK)MCw;pRMjICuI*qX zu^ePsAUgty+FWI^H2McxTMoiOb0&|#si+$~9tW)+16$3Laa1grszDYPb%qY2&Sa~v z8UFm7p&~{LX zl(j0TW|sgIk^+N0*5!&dD^^$42B(r}L_}tx=d4(jVwDl6@|dxLEL3)&y@IYaCTM9k zRWt>{6cDn8o6>!#^N^IKnzCGqrpa7>&5cE%zrdglEtn-I&L^pqVEK`WW({P`iY4`R zE2=|)2D=#AuVcGyk!>(6Rah(Qi~`L2l64h0>PWemStzt@DVm9u)paXwuUJ_(0Ay!C3=Knb)e_v-HHf=BN@+$BU1nq>l%TVfj0vZU z_`Me2`Cw`@K#BA4ZUT0SFcl}LE*x`O;5gSw;@qN{;4J8i0JF+*PEwJQ8xJ}19_dhz zcN?5*`!O!+LpM9F&oQrN#;b%~pHd3E!uterX1q6n*9CXtMMyc~&AKEQFA4r=uSntL zK+cSJFJ2OigAnneaM6wardse^z>}|B;X0__Bn#d?;3dJGcznmA@Qy=Sb9`?eM!#c_ zGwauH(vR;C6yEnNcsyT{bEAqVN7`?}J7v-jst522FAdi3CEz&;AW7lnLC&mSc$P6= z%=p47fOn+@kKgcc4UZy)mt?_P2)ud-5ibrG<(MCz!LK>}o`OR>>=h}zk03c@8=3U7r4ZyWG_0e3}8zd8%vHsJC70`Vr|Qg}x!?Mo#ZB&LHRh1YFqU)}`X zI0zB%i?|ftH!XPe!25;*lX5gZWWoCkcuBA)ULr1q_nIZXp8?MacSTCSUt8kq#Jj~x z2oY~GE`|531up@O57$^JQg}~W@LGUZ4CMuHwirBi%%~Ccy0)p z@$Beax}+c8h(VeLhP;OckPCP!fAI-M0Pl87eR~>sq4KxMQr{|pr}7tFQvk2bg4YAQ z7pZ_GrQbXY-da<9QI!LDvr#_G@%2MFg+WNg`ygkI?<2rtJeYpSngHGm3*NmDG7YZ+ zcvo8Rx=eU@of*KJj}IEm`t1cCs$77SenpTo>-V$??@K1U85X=Q;3Wsp3=A5twBYps zPvwW#gm)B$&8*)`!|1ol67H+R$Q2v9im%V4-&Gd8H-U$t zMSv9E6&AcVO?dotf^zVx-EF~pAC?>+DpGh)Arj_zd=|Ce;oVNjb(N8bW5gwZIG2ZrC7a##;`&B=~2!pKHQ< z!%{E(!1KUe5iv+7E%owV;33KauLO6>QNMAhG-mz!fyZzaDZDX|Bkz$8{lHW0B*$$E z?^6sK&3JzS-hvYNK$w;miX@T45r^=$SS-A z7QA}kJ*mK?9F21=cprNP@otuK%-^qLykSni1PsEHV6RB&*A6-I9_diz9mM+z?38}h z7CaB|_$`bgg;!z0+Y7vU2r>OCaVfmNqkNe4D?{a_-ij37hma%hkq-8p!FF;9>=fP~ zEO?c`n=JkCrtp4m!Ak;O65Od@wUnbCm*B^&-$vj~gS{e!7Y#Y`9_dg3ytUwoSBr~o z#QVh3t~~`jexs>K;k|EZCwqXm5kkaUj!WUaW66(hJQRg$U*59hM_%q=`rT^6d(MK_ z54>-|U6Io784KRcz*FsMJ%p8hUNqX~^jq!-oxd|7M?W4J(7h)8R+#WOPB-H<0}rAB zQu>Xx;O&D@5~P@ZjkuJ4_gnC~ffp)&ziz?n2VSMbTV=wlv*5i6Jg#L|r1Yz{;3ek` z=5MnJ?{5~o2QWBrDljQW<2x3-?*dP?_qR(qmcJeg-qXP2+IdAvzvnD?Zv(FqLQFrF zYswKXAA=-wek>m!I)A;8qaP10QUL}J2wLFXiMzr}wBR)ZkNuS*%8?Q*c$L6Qf<5(H zk4xb#f|6$aegZs&0kHsI207Y$XbIW~JjRcBci~caNfx|*;7x_QB8B}$3*I&pUJHa3 z-j6JJXMmTaz@!|F&sy*v0bUvGsb3o|g}2>;7e4{t=!M8%j+g1jgNt+qc=fmwZzC>+ z_Zb*-`n8~QL(&I`a-@&IkoV94x;cL^{Wif&Hw3A@491M-2Oggj6j6?J91M964WQ+~ zQ{}}EGu?=HGoHiDct06NzndUu#%nR@x5b2)ZoxY~jD9W)-n}OM?ls|k-+~uCF?9R# zJqzAG;Hmuhx(N^G>;}a*4S27>T@m9*YPI0S&KhiAw!vMc-({BZM)Vg#k6&Uf@)SjM|$iJInwy&}qy z-nEQ(TM7r;7xw=O@Bg#lH3RQ{fnfY7ykA-Heg(Wrh)}=1xD?*^!83Z1xJc2HLbos9 zgB$&LaFNnx54JCzFe|(*;LUikz~elLBBkFwurT9!fTzmKKIz8v<2T=CyaM2%NeGa_ z8v!9R-a_EbgcRfZ7%sXI?|tGK@1X%yV8VL}W`;$)IT68lX-UR98aN43`eCE$ApI(Vw-XU# z{vN`m@UF7p^#G51?I==sS6J{qE<(ORj(AVwQg{zp+UMsn*iab6RQz^J`y4%Quzoya z!rN%U>j55y905{zcU$n{O?cfVyf2S7(l13Kyav2|wg8;SE9U=fDW{U+uB(l`T$Chb zNUx)CkY`yUJq)>OgB8DYY$k+T4j&VGnI}JMiFchn zFyh(QPetKy(?8iK90*_cvfzJ;o0`yQ#eoZqsOQI430Mc%P>7Q{zo{>?W~_J zk54_++3PX(HJ;R4fb%Azv{te2I?k!WHupRbyS!8{JlNS=V2^k6yg%&yZiB5O44dD3 znlv6t07v{zJcGNj%QAl3J6aCMLhG&PuEcSKw10Lx0tDQW&-`co(f(-rIvnrP-a2cX zUhq1?Y8H-izukUQ#d^yfKZ?D4DO7|xI#LZkN4t8kwuI=sX z#ZkcBt*@RHC$J!x_dbC6brEBn3xmV7t8hxn%tD-xk)NgQteUXP-?58UJKbB_jc~;Q ze~8(nzi;Zt0c4)O-hv}Bubw>}DNZ5-WZ#+o*Ng4RFT?GK{ZyFN|GML6Q8eI82C45~ zhv>2DbU=^V@gu;WMOsaXSqgvlgd;H`G0P{tD_~B<_zxODqu+rA;)v58&l)!Gy*(k% z-_f!$Hu>e9+xuVNoE?^bl3EH)%HPps40q~0_v6?=^8EaVQ9=N5AhQ3gJPK~pjsa7_ zIuDz{vjmWPFXE`!DwGGFa3IfUJ-{8_9~=LlEKh>_GY;D2>64C6&l%zIbd@RN!y+eZ zOM0UdsQ}Wdvsc5fT^xOZ0~a<#BNdROt0Lflbl?fkFt*{qh3LLsQ3j3EZ^}z?41=&@ zVi-v=3CGaG5^+0W9Fhs2Z)knO2FDFBd>&RDE%)n2$Sj@fCk2lB2#Pu4x(-J#8fQ1a zt0R-AJU~-yEymsXaRNq7M4xf?vT>LTY<%I4XQUYPvKe9@gi(wU7CPJ#gCm{~>!`Ts zdceNJ4gYamm;s8X1D=OSdFmTD*eSFwV57OI+mMfS|`AUy$lJ^A5lA7^Mer zjMC%x;|!&33u7Ib5%zI7HOkSAQ!RL^iae+c$J}f})g7l2hv!cx4h&3n=vUzw*}*e- zVfV-JVVkZ)2*P(1v@DMq;r0ntI0}cy5F65wF3moni)Ti{>(Ob9 zZRC^r!uK)1y$HI=<6z2nW;N830d&qm(!v zMFAlc$~y}(HO8?v;WQgZJHqCV(7^)r3`?)5@$lq0tX1J$7Kb?c=rXNacf1=8l^vbo zj@5)mNkDfZz%x*IrRJ>90CynKDS^&~bps`|mdBE8c3c7-Hanu0{Kt=2TbK;0)Upil z&?iDg(ko90SvLN6M^6rf*&?DwUJ^HE?8Gl#apl$5q+fS^?ySOj3l>$?EW53t>F%$! zZ+-CLJ&!(q;QK%Laqo-A{{4Ub;jKUa?d;$GC0l`OwWe`asJ*~dz2|-C-rpn5&Tzlf zVwQsuY0JI6cbOzO7P`wcV4|7pT@}&HZ(bD9+^Y<@)4bNCKh60T`DzQ^WQ+Wz7V`lM z{$m!rTP5GzQoWwp@kYSvzXE?YRCsI(F^CL0PkTjR+Oucm~2BNMiFKDIGhq~&Q;|Ju# zrP7KJ@v@9D@5wW*W=o!7E|xrHTO`jg@0UEo{I=v7<_{&$Fpo;!i91P^8HSmI0Nu;NI=AHvH?J0YcC5iNr=^)aF zf*_G5GCiFztMVrDF_IF-w|3ljmR{Vr$P+tX^2A;!d1BW~p7QG@PkE6(@Jsner9I`p zD|yE8kmOl5j+pqLN}l?1PDknUuH=dNspN^n$79M6N7QlfPViHtJ;T*z@VoTkJ{Auw zIXnN_(GX%ozSSSHUNqFV=O!Wb%{srlx2_tb9oNX1mj{X!9&*XxFpCU^T|GGLl9pk8 zgj#QS!DWC{QLOVDM!!HZ$_0MIuZIXNIb52Hl_9IGiw;aHwg#ig)r0Dj{uxCTSpKqN zb@L3B7hFFOBs)VwD*=%S%j;^fa73Fi%vvnURM*`eyqHO5GTa6iJHXDmj*5P{ZpA96 z7Dt6%Swvr4Btf4wx7VzIfy?KX)dYnVyj%rd)Ortdr^W`ZUb!4jDY%*xvozg4YZ?jvo~%yrUMp_kq^~A>yG+2;lKO z0{#Q>_zAF*U{<8?!Yz3G-ji)I@i?4Q`td!28Sic2y$U-;3h&pjAn%b5PDD=OvCCC> z>%g1wdXN~Rot6F+9@D{$$M?-MVMqPg6)8OSzh=B&0k0i)iWFWcEX;WQz$=3t@i?qi zcpU&U<5j}J33o*b?-2-@@e%-{@Hhlkcz0UxTHwI(x*~kDCV1+{;gZ4| zgYrS|xCz<^j~urvQqUP-$TL2q*C1DIu;Q0)ycSD5<#dA_lPEJ~NWXxbd7hs2oJ9Rd zN^TpyqPUL&U8jahlYIt||VRrB;IS#rYOdEt5b zBpHV^gu|zbF#+v_Mc^kx4_nn6i}{5EQKzCgoh9x#!SYX-vY@><3|5?J$s^lcj4^EE2g-kMN=S#eaoDw^hF z-aN5tU|>R;V-?R_#LP~lmfcZz5Kw+j#9tp%J|?C%>6*3wT=(Z+b~aQL!|OQ8E`rm6nLk*oy|3?o1K%dsJ_;zj*`QkwY61s z^)=NoTGf)J|471X^jMAm8vNJde;NLlM?fdWx?_T}e15@2KY5K~4#f;W9`e4*AW&4Q&i&p< zvv6^~Da_(tCtQsm`rl|VXG$}1Ip0K5^9^hV)iWZSD>e5c(nikx5L3`r9LkuZ0?&SuZ8YuKk7SXT{fdY$D+@@(7d+LY9OqpazEkql zYqI2N$FL|vUEGqVF4sz)QOl7$(~#wo@{IRR$ur)+lRVRvT?l1}JyP=2m*@Y`p798e z9R6vR{oRm#nyinYRw3(Co^UrF^MZG9F+9pGTd>_7Hds+lQNoE0XvLB>wZ<+Ya>XvX_7X$;J8P@GN3|_6YHKO37g!Af?kkwhUb3 zI0@Mopxr2Ve%L8eEbqKnE=kO9GqD_zmO{uX$FihI$$bSv5!HQpo#p^Hfj;2r0C@}126j6q>6&HCW z_dFPeqe$tu4;E&*e#n{AMd8hra-vNDACAIPt-z!kWe-bUIW0FAGLzfy!JEg`J5j)> zE7O^z!o2~EiUaM5$M+v}ABl_cVEcvIkdmG;II_ObxH`?1o??u;FFdYpW<|C_ zOGaYYhA{iMo4Ug%J$diMGfRvyHs9f4h=Mews%*Zh{T)Dx|i3z&QCqU#bB9lOhONG)>8x6NzzqEx3%ZO}`wlN3QMN6s_4EjyJ+O z#Ip%J!eVW2J_@DV|2j{!7iq&p5+i#2iU%vc(X~ec{=TTSy+=PZUXn9UCs0D=>Esa` zCZ$EZI%!kRzB`U|-uV5i4m|(nk-gvl=nwUK9%p8)$=d3eKlS$Gw;aBu<6OI5^3+k^ z%};-@_43lvD?~ftT$g|2PW$#(pL@FZorkNo%sKO=oQ0Pc9Qy0rKOI;`|A*H)e*6vn zm+yGJp5Nc{y-AawvQ<6$(AYa4c{+BW>OJkU14;MYTJ=g~R`**yQ|`ClP?`Pc%r_TR z4zM=moph!^ub;(?l^l{(wfOALej zb^$OwJ-&;b(q$Y&^_4<1%T_;6G2kSVI-l0aS- z1t)o_KoWUbB$CM!1VsIH8DAH9IpM}Wn9p3Sf4s=gz@1|j@|+X&ke9_Mk30hh72u)_ ziH~aP9V}H*?>|KxkQj_Bb)Y@tI!p45Q<>zc?;^=F9yd##{+3FfQD~4n!#ON@s`O*Y zJ8}P5@{DUF$_v9~{8*OAQ}{1Pf9?V_N9#X>w}QvG2bGwG!E1|9OCX*^C2 zea@t(!6!|%W0#@up#3oK>tq^T=ovH+c8Et%hHrTY4SL(Af-r9wCwDP3oG$ty6(J4( zm})rwV-Kp_2Zi0Nq5)LQW>b5NA})w`UKe^!ErwsK9P5*!aLE)vj=V>jTL8>@#Ab;4 z(2eavss)erl>LYzg*U^3_q+)Y)ir?E4&JQaBht-^w^7=Aq{GL+qdwFx3YXHa2D}+> zFU+#p24~3eUMYDG?xb*lC_M9XD(Cjhcu&JzL=TcweEA$p-XrZ}f%hhO>c^%>>Blh4 zcr>W-2%Ll*?c*-a_D zr@))>SoT7tAIC;!yfY>|$}7BO03#k?1lrl!s!v5 z@k2LWTuaS6#0A|0IqIy4Zlp|$oC}IGT@*1Mqz`e?5Bn?9OgK~+M`G9Sh59s_S%?C`m@O(fm=L5pS zFdxviw<$0oplKl|1X_kn2<%l80&v1RJUow|Z$jYc%W6U(-!dT}<~c%42#9%r!3hC; zF3LBqp(X@|%m7`%);?9HDIrEasQ@U(V?qB`x?=O8XZ}VM`#S}f2 zJMFDIUYPK%_Q=iC3ZIxU_rRgC2k!0p=D%z{Kvc?q;D@h8`6^W2>I_ret-=!TMCry? zqw>~Zm>O0HOS~hc8()>mTa#gGS|u!-R;{KRZq4$x<{wb;zv+eTX(KMqTl`#G^CjP- zU)lPDz1P?6K3Wnrby~`IM*aTfrQ^3&F3uhJ^68dMQCD~T>Gz3#e*SFYLHvgr>`eKh*BW5>qdc-Qo2YhU>Dr`ww= z`I&1F?HM(0L{oM1&!bm-ZLT|JcEaiSZ#|;DS5Ufc)h}LbEV}B;QQhDFUDjWI^6vK@ zKKbh1*SFsjc&+yt5?_6I+xbtn=&U3Fa)mR+HN!o_?Mz_VtWXTqIyV#I)xJe6#Jme7hM9K} zo`-wEADH{Fyx*ttgYzqc^DYD%v>$%ng>wI$c^CS>z`TnHBJ{iqoGyCa1+v4>yBLoD zoOzdJsJQ=%d6&2God3_9ci}gZ3eP<6Vx2d51ofD0up-4<=M5@>r{)dR90ko!;X*SI zn2*{EUN+m{2C=R42K6Sqf5yDaTHw8j@GfTFh2s=OD!wXC9_es1lsW_6I`7gBJ9B)8 zn|Ij=IbwTok%~~RRQj3cU99s~!_B)?0>g~A(1fSv1Bf4L-lYfjid5A9JM$?Vrzujb zbw1@)C`)}5QFoGczUNIi^avN@N8wrLUG||6S6k#LYn^vNcN0Vk&pPjd4@)m<-i3I> z%)6ux&bm0|H_gL;-<+PBVK`pI_syb!Ar@-hC5jgRg69B^dlZTHuW~Jy>e;L-aDrFI zU}g#_H00wi1$Ytnbja{oPEj`)pEBUC@|JgAD(j7O8x&M!k9C}K90QRk7phFf!d_uh zZYO_Cq}-gaGtcEwKa$cz$?;oF^IRVBoVe&td+Nt9o0s#fB%G5Z3)Y3c?MY8l5*Plq zCtND?Kf6qsQs}=?u&zZ~Tg%mK*eO!^#yc;SpZ}+os~qTdQRS+xVX#o46;h>!4U)kd zziKVU|Nq*mW|>0&c%kC^B5RqN1v^FmQ_9qrpzy_%DLD-l=mIZPrra5>G@}E&a9dR* z6H>KRVtr3Uqz!Y&i30fX?@}EnpEp!lq8#&Sx}{lWp0#MBTgF(f$<$rcu?QPe&usIg7^*1 zXh`iACS|sZavN{Tbe#_jAofdYZwh7!zk??+9P+APr98D9A}*PssB;sS;B;R4ns~yef6W^?4lASmk7P3w*^V zSmd%`W*CZ;+*nwU_eh6r0O#`q%Pj4A(fk1}bGROuL*bo)y%~?|O~=8Gc&e-tkI%Vg zyaFkMn;>G4eum48_p}L*;Vb>NgE!;d409;`?zP|@H{s#YB!E|I!K;RuaZsf6tAd4D zzc)>IjHlAi3w!(r-lN|RUVcIb&TykUr&4)$;UaCt#jq98jTgW3;$6|-6eI7-?Q$^Y zu``&q~R<*#75%cmx1a{m-bN z7#eQ;MIVEG_TF=RB)Xw{`IU3jDeR^-9z9VjK0#c*^^T5#0WZ3!h$B&_!nw`XoK0Pk z4bhI*&K>=9Ak?mLgW&&<`+q55NrB=VUmk`o6cpcwU~b zA~z>D*qomeY%VJeGS9QPFDwh-m3Z^=3g^zMD4CPHAX9l#mhZn4IjSTl8U^NiUqj4vr|gl6~4KQOrBH80wHyf@~TZLQY9YjdDtmlS8F*Z!9hMrKG33v#qHiT+-6Ag6!uOE-0&*S5j73 zj6};@;H}8>mHA4G3u#}NtIhE(s_-q$E%45r<*O)JFel(Q$RV%bJdS`ppK~d~92S_4 zDo=-mIIN=);su@_sa58in};%Jw#=PZTvF;=uz*Fg zv~*r+#e%X@gUP$GxOkB^cV0!HO8e%PmCh?cot{&{Fi=%17Tj1;GOx4@R=Eq@73J=9 z#ih8l63FD1E-ERTSCLy(2+w94DpNYwTU1dxcb2vQ+aOnz`4*sMSWpC9UcS;Yv>^)? zcxRyrptWdda_7yR>&q=GoHw_kFmD*^3dYH6U_rhNL7^g+7J7>c7klYd`18#bx>b}F z_~up=dvgs-nMANy0R32hOMM2?9G|bGqQnQwT&PxwU6Eq7NEH^sEmg*#FsHDnuxycN`OL0Cf#B+O7jADYr)Un$aEm9O)P3*3-ijHobAgl68N5+hkfE_vsc6;_n`P;eFrS7BM; zD=L~-QI3qrH`y8`qk@G9K5krKB=mfeVwtSwA;WwU&u=%D&82ozEFD!H0>!Cbej64G!}X<->U7A?oSz?YFmrf}BW z8;il@BB-LGLX=|7i{e9@Tw!0}MZ1&YqJ>~f<`pfX!RV;KpghrBR$7r)nllS*o-gM{ z<4z^=3J4=Av$(OMz&N|aJBOOEkHD`{+sKKEnXAnbp%=`_%ZFtF!;t7j#Y7bi=A4_r z73Ybcbo|aMB#&;bXkP9da=zj~^vSE(qfWz7wHAUMbo$@L-A!l|XB@}z6;nu1Y``2u zti&dW#fb5xtxAN&jhNsTZ4yHcQk588Y7h?*11c(}C?%B~qRk-%D;9DH_=2rD6czLk zY(yy*Y!R_wQHw$fHsm1U_xJ4YSvRZTMeu>i^Vw%+|1&#zW@evf=OxvsP~kx7oFg>_ z@mLR81B;eahsp9b`$R)MGpVJkg~_$gU^COPKV-UiAPc?%1nAe}0DThx{MS>gYORyt zb?esF#~0bE5yzzKt;U9Ci>irY^+;vw1r?0KP(@PIxa__$SHKn;c9yZAv7w-#fl4+Z zKwL-Jh)f>~-b*)5!Sh1@%fDQUw)W(3F9dystD-?ODV*8;>I>cL_k%4-EO<3K{2nm3 z;PtnDog&xuTS^o9YScg?sl7SL4MVm4G>v{^Rl6zn=ctVt`+W3!q^!57y)G+8g{>G` z7L_Z8QjDqh$ZE%h`QndpoUi&t!+a@EVl}Na{aSLh$K_`7&`*HdaJkEM>R_e)4f#C# zIC+)*6M41$Gr8JqimCRx`Wobi`DZ@kqW#~J%W)?>S^^SpQ2N!($#;7)rx-e>Q{2klG+Dv zKf>4Sg?QLrgGcNy@hv-pZ`%j(9s37-*S?7F+j@r81N$L=9gJ|ACYCJzQ%)#&z~6PTONx{e=3A+IKYB({PKeXZ>xoXXDNGCs^B$ z-n$5A?9Xw#y%O)TYjKC2#+`OE-e+&b2kmXR%if8P+8wyt-iv$eBe>W84)@vL<9@pz zpR`Zm)Aj%!u+QT``w~8DU&j~hn|R39z1e=X|G`)6r}&!vKOVMU;1Ro|nEG#*;oJ5c ze8*mZ@7hc7eR~CdV5jgSJB^>%8}O+86@F%ajmPah__^JM6YNv;KRt$v>^@v1|{A9v4&iyyJ~qfj-u=_kvz_~ z4yPDmit%*qV1B$J0>yY#k6b+UO>6n61|fCxSKp^%it$P*$d8vKUMCBor@XoU`%}hgx|lxGO2|ub+-l15`@i*nQ_}J&#p$l% TypNYyM!X)6*E-c_)MtGOiC)s> literal 907990 zcmeFa2V4|a`}aLdFRKD#Z(#2(*svvF!QN1@3kxhoDa!&1R>TI_5H*4ou%WTXD7Hk5 zF<{hKQq)96jYf?Hdw1X8HDz~Zb|JZ+|NVKM=kvbrB;%gB&N*nU!-b2-aO%v$AFqUH(Cgl2mXTJu2|FA2n`ZE9Hy~6=U@!!}- zG-njTuD-=6{%_xZoXRNvckC}dF^d0Sx2Uj-`Cs0fr7#x%vj#mz0!QfPS|Ts zW$gZwy-Q8T?w|G{yBIt99{h~4``@)^`!RO^v}5ktncHutFn0gL-M)n%BiZ}>oQb_Ojif+6l&FuXl@aC~I$&$2gR=cU!_Z{Qvv^ ztJ=UZWhV2l_S}7p<3H`+3}PIG{rjnmu_-#C@2Anb?M zGZlpWc-^QVO-OuXT!2~=7Z4F05zmMXp*oF5Vn~cPlZuQcDdRNplQc;In&@DO1Ku2> zk($Xx8978z;#?8Y@fuyUI+86o&Z0}w8p|$;L@r4r)s(daXo7{z(sWnO) zVQLJDh>wfcMMTR^7_U=L*689iD0*xH#+4=@CbXQ)0nrJOvcefMN}E-vq9NLxUv;Fc zIMh-wnmG-54~SMrX+i=*)bVO*8D)_HkrCp-L`5-|A|NhY9T^!jMdm9aI;6}KP0>Zf zYfSr+Gn@1#XV$5w1Oz37hH6Bko{Gf9nsgRtHf?9l9upBFEiPw9o5i4L;ZXq*A)4s; zh|mc0XEPmJTz-?$#hFdV7iULJ!_X1t1{9YdAwJZroM&$_RUgx?4&lGDv0) z8Nzg;QAvilaJ1MYL(h{bI7XW!F~m(#YbAzATw){!nq6oWi4AE?Y>{zBY}2WbM~pAF zKoL`oZ9s;ogh*6O>RYE#n+y_4s}2b&9Dwwa@&-p~O>A7R%Q}-z#15k*PtoGEsPW>CD;W=b#Rgr=tcpNr#S+r_&^&6JU>v36=JESg;XK$P^G75g8evQ%8ry7_U=g zH)D#3MrX%Jvzwnk!8AdGBd1E5n>CslsJuN)6CDzvjt+>A2?&o7T^y(|Y?1`j8)L+z zs@%z9a7|Fh#YKb}FXD!r!4zpS`Ph8yAd?L|V?>a2M6waw5HpvBAADx=aHCH)(x{Cv zJWSh&oqWb?yrCKxH>QcBB8^vCL&~U_=y-0r%UHtJfR8oxMf9P_0G($*LUf!u)J#>% z8ZTU$ig2A|BdU^HXoqn>pf9IgqT6fjkziwOvpj&n8| zV~MMeM#^0_GE^56Wj>lFj!qL75t2ZvD?UM*Ssbg=L~3x+k(8L?u_r_($Zk!jd&H3@ z7Zq`&`SYSvP0l4B7UTs})g+yKtWi2Mvz#^KvS5;*9o{BZ(oXFBGBf$OGw|^y^G}GS zDQMPh*(WqtWh#id<{>+g3yLO66HxXD6pCX=Yqm`08*vIz%j`%KyaubIW1=I1aeK(7 zr@BsN* z1LZ6;!b~fLtAoSUo+?>W307(22v&J38tk%`6YTN^5$tT;jg2Ch%POTdCNjxfIa#}z zlCpNQW#wYbm6nYWx>ek-Y~e()vSPC_@?JLPDYGw)Nz8YeG2Tq8L}GwDJjI4A6qIBojb6 zlfub6%-|{@!g$H!ec>7|y1(L$Lhp$tCFesv3^}X3(>N<9^(0f0i{J!_xd_RUA72)> zQ-#jgBpMZrIG&%vP)8>5AsQ-Pd_+vNNhic5XtgoAc#Wu<5OeL#{2yM zP|7H;jZtX30Ctc{3V>G70u`b1f^qhk&``;+i4O>mQX5xbsZb=1%TztaNE6A!>dwe` zxmJaRyowYoYM_gwbz$wK;5d(f$sX+?$oXkutO`HmP&$*Vk|@gjxDKXV<_9+$Wp?gR zjN$a`vNd_p>Oup=i_UC*Gdzmd1%&8=!eopVtWrVWc^Q)04fYCsN%H}Ni@|O%VxOO(C9F3Oivf?YlTV8@G z8nuxnlou|M$LVRYrtaV83F^p@FyOag4vu+$}~#JE@Yr*)KSJu0okL}lQh(0ay#`j z7BNK^V566WpvVYOQyaXP+Hpez_TYJz=sHV&q=O3vlmL$~5M}H^SWO#86C4sww=@AE zF@}_^4a-9TT4@2ev@ucI1c+=rDF7y}zm z(4=zmatUPTRt&?eRYw?ggb*cq z=FFL718bs|CYf2IY;osNZ+P*AKpS9iD!t%QVU12r<7frl zJgP8S*o9}TDNdFSYeP&zkUT=XI7z3*F|G8Mbp|e4(gN%?(99{xE(|TYCo;*zN1C%s zY-|(C%gwd9+{!lq7UroDBwnzLk2_C^$^1O$Ix8|pw2&eQcBncv!DWo+me|SV#IPN1RYa;0xwMJ)jg!dK9 zM{wz4j48vg7$>PH88A1+ZOxjbOHpLvt0rnWqt#F)GRbc7$Yg#^kz&j)GO=F7WFmu^ z22sa_qc&JrB2d!Jzo8uAlBl4_7(BBnBY_sGgWyKH(I z60L!-&`k;mO2Qjv2IrJg5<^MFStTjU7y*${F?f%UyKRupG)au4_*_gx6fsQ5DxQ#B zJjb}Q<4MPZ@3=AH&kh$P;X@+mk$|Y|R6v<%rmCASv%xMaF~m$c<&C2Ut7X>4|hN@i?c*#f&H zE;v5XP+CN=)5^5*ShHyhvSyQJw*wVtHs+e>9BrI7bMy&Wcb zR>s1IUXi8LT3t-ACeAqF$!1ayoCOz1(W5b>5|tEZFnKc-$>Rei(KBCBc?F~F;wqRW z(@8K+(TU#H5{wDaX3eI>z-xf)NL9yUi7+mlrk|uqh4{qws!nu~lHOVfv53HHF<>R( zBOy*LT45KG1Z#BkHeoQ!niwqHM2ILVBm!~Sw>GgNWn9>iMH<>wu+wJ{)&#k{CehkS z>+!ffD=SkOvBJ|3GiSr-EvFD7a0r!>4|l=NF0^|FXoK*)*35bE8ZYj2 zX`Nm2hAtQ)9cX0W?ro&+lagIB%E-XqBgs-ul6jmY%SiENAK#(LrL+|c^eh3jGR}EK z$d;2}DQ9iR5Nqf-gGKUK3Rb$do4u#uoF+7ICS}BlKDyJFfS`jVyJly1)-*vTv3pmL@n7(>Wi0`Fs~)aSrgVk zWky;7l$iJ~l^Xd$%r45P>4Ax%SjOQkF#*Ft5Wk+>g+baC!EqF;iSsNwhb+dFf>e2S zlNfGa%|~#h3cz$UJrQ+|I0B*$ z_b!HX()kRrN9%Sp1u?lOp={oY5{TBIwSqZbqt=DQOfhy@qWDe`P7`qDSgW+%1glId7*fkL zfx#{l1_rzM5v9Rs9GNs1Irat6eWjs7xVxYzcFr4&nqazI(HdM#C`B`r1kYYr5l?p` z@w$XyTGHk&(BKSrUrWi@AwU;p?wbX4`w|x!6VJM!1v&PTj%8k4R-lN`qoR0T&2w-N zN9Z(BF<2U<2>Ol%Mi{-r2%|2Ebvy;CmW?%>3RisG8nS0&Q&6u`cG4vgL3nZ!$C~*& z1pbWd7nx*s@u6{cQo&798>87w#@eulLgm>5_TF9{MC(P=XzU?(5i=a}1Hf?1cf8@4 zzk4zq2Xjw^jQ+@gheIL*dy_&L=%(Iyb~<7iZ7czq_zR=dC@Pg9o2X=>d@`%Jc*az0 z;n;IWK@>yhVc0}O#z#b(M6d?FNaoT?qm0?vrZsWO&H-u(KATA@k)8FWj!TM)(qQZa z8?M2WU1S!n)?{W!hb}=IAHjZ=1Y<8sofr_KTh6RQ`* zamHLMP-OL|#*ftC2Am3KOllkgV%J6oVync3ID&H`d|R>n+KW>eiy^M3IEDBuWu-BC z;fgKJZ;Ue(-h8xa6~w1Dbu5lG>sp+^*vPz|7hZfaPAooxA3?mDrIy4Bw?;=WBP*w_2g~aLPW-2NB zo(g+bHl?AGGP|*sY%n(};THUI2`(v;_e zpS^Jj_%bM)j%^L&Y+(;EB>6!j92(mSy<*HqW7kk>V_KmM28*F}SPM5|jb7NXW;~>> zfij{68&;7?x|*GZTye!?h&2niF^LecV-g_+tx2>LwjqMMwDrd zc@7Eb`Cg>^UQX#^I~ykOi@<;B4NgHz19UaqvPZhji|C?c`VTKr4|#+Kns6E8eP?pr_(bm82GzS_GN70B`5Ct`DSWjCX>0&l3bz8xRKrP$=bqr zt7*=+>7yz$C!lijmu4FA=KM(RGG!%@%|YZbwQ}_HZ$rqwFe*PEvlNGV3W?(hwwS zK|`9KTXH>VF0)Zynu{f3O4O#As<3C_nnNsi=v_5>M+>q9ucXA`)=2hf0arvyBjUO| zyXb--k22-GJcZ>!JV0siTsrj zYp&R33^&nC5LZ$>1x)PR*f%ko40>@2dVuy%!0tqP3&B1=z>^D^nHo|PrH$tv zS{R-!keR-k%)ZbkIATwb5N&ERJU5|~h~_9l#gW9|<|GcUZ~(cS2#L{hZ@033F^lju z5;$OwvR3c4a>`NM5*T<9A2RrQu@D#fY2>AQ4ws?%Z4&&bhf5 zhBr#xKCIW4b?WmT4**i0I} zwXswlYUB~sNII=ykbE73Qkb7fc%hnak&#m$%@Rn1sQT$(Xsu9>mMnM+EV2v4u0@#LN! z9+}IAUoAweI0irXiT7J04K|wFcug-LToXwuNJuISLw*1n?6?H*Nx0!v)?YR0(5@Yu zz_Sx(6&nh4nAK~5uR@_5l%+OZ!^87&{%!G}>gp2)2}n_+fZl-MzK zO1X5fSIuMgAwsVgM^Jj(pxo+1Dg80qvoh&!bU9-6Q=1rxNC#pC0rHMW{Q=Fzw)7diG$Es58OW`PaiZdA!6WBP0 zJ<6HIrA(fpK-~Qry5cv9w%VDhq-H_IAHr?4lT}HbN?)tq_RTDI>VNHrby;;vBQ5Hb zW)?LR6@X!CpZV_<;GUrX5BUNF6_;|MzByq|6DI}PFn+}^Mp*}HRN7HKIU}6LjPZ{m+D+nQN1$=SJ55 z+P@ugEut*^3YAJ*nh+Sf))=&QOj1=YYu>7y%K9Iz z##@HFPfSd-&FJmauU~g7W>3$YK2};UpNzInojZG4GRNEIcv*V)P-#^!1=D#lsd}ok z=&q?4xg}F_Fbv{V69*?*^$!g_uzTX*iHRvclsL8@S%2Nc!3Z^V&a%t4%Br62ib6I_ z^-61(SE%GBwsgLy$(9IbXWL;+C3|-zQ_WD!=JAb&*$|rR6?Li;I@bElb5SOWPnz8$U~{?v~cs zv$OZ=ER~s-6_T@^wb^bu%ZixSo|cu8+bXniZW*iG5=UjMQf0?x7bdT89+K_GggRp= z2I}21Hn?SsQzfr=J`dv&=j82*J=^KL`Ra^`s?4J5sTRqz-RtM*3-$V28$bBy^-uMB z^zhxL7B*9vTKUD!Ue4RpZu6W}sX3{3`89GD=B6tdyqCX-+r4<+D*3wyoY9#T%0#hoOh2gZ;`6_X|adl%$<-gP@Hd%IG@&- zFIAQ1o}zYg+u@|zo|ErT6mfjJD*2R8$r-29CySIga69FsI+IhRO!Y}VquLYdQxfVl zF$AnQqtZsR2QloykjX1cfY%uqp5s(Q&an=DVjZLoO+K}f{GG+&R8{`yZ9YYPlV&IF z&3AX3>ZGC(9i9aA3^DqiqDnUUo}w!7*b};v&Kt!sDmJOmP2;2r%?YW%!dLR z^PN%6aL^j_MXKD23^m!I+9R%`c8O0(s#E&XRJ-JKG`FEcMyc}E0HEV`Wz($%7N=76 zUbBmwF_yh%yUlkx&UUfAyn|G`M4g)$D{Jbs3+N&)Ck+nO7SXWKigQYbg)@f496lcn z3CVDh3<+cDkJ+!Y%ITx(`xJwTJ7X8)px9z({kFfp7-txZkflPJ)lX+zVNxh>@~<&UL2KHes7 zJhW0b6IB@^C;qC@xo&fL7n71ttF%%F4^~*673W{b;(`Ktw zi9W(HDS#wZsp_R0NZbu1X4*QdI;y<;B=oy>u>zBPO>zE`>Pn%?`=ytndyk6RL?2y` z3Yk5W$*Bn`JsfkAU#9eMC`t86>0y7Ohush|+6I!*Ce2S^W2@6~!rnE@Zk0Y-_3`xHt_t+^+0)ah-@rarI4Bv!9`s-jhWM_en87&chiR3O z&*gn&(MnkqeSEtL9eT=V4-dNSs*LZQ+z6bbe1?FPlYRE^cs!#DoXH-u$Dkd-S*<%1`er(PbLpzUB)j#3pn5}HOs=#9Y9Q|eId+PH70WHvBAephVN_L4l z+}PRcERitHIj!)#nW4gwOfpnTjHmZfb-HkV3C}+oAh;;f`3(G{18#tc21mYX+s*Sl zHH$otr>aU$u^n5Cj)04E>;d%(2JESodyYCC-e2IjCtMZrG|?IPZUUN10LX&w$!j1o z0#kj?qjAVW$jnw{tHBJxM973`s0y&+k|>hXRB1kGv(L}rG8Ood8xIgq$iusF2W12k zxf!j>5jp9l>bvZGI`1MV`MpXdb?}o4#1&^hstOckU#LpUJ&(Z?jr)o$U0}8UB>%84JZ2B|GH_3CIs*Ymvc3+?0o2mNTs%nU{ z(k{)}9rtv0X^K?m^e-~)ne@$Q3y9J5t(pCpTB)H0_wwCI@Lsbmv0(fsR;2UcrlLrJ z^L0O2s{6qy=#-Pc)dycsrfP^%Y3Z)l!<%!8jWW}QlxlLCTc%A#CfhmBrV^AVWG5_X z>J%HhOdES4-hqvGG{z52v9Zduu@>TO*mzrGyibY^lWC(6;w{*COJlqTTWA}u&^0X= zTc)qdL*2gK=g8!Ismkli*6hK)LM2m7Sm#nm)6d9Is(kyVO&<+P`n?k?Fk^W2@cUD)UDbf}PV@!oTK z_6fB!0y*1e=c!!~$jF+Vsji%*&PY`yFKVAPG$YlC!Laj5PF_~J2Cc4w08VvhyEL!R zJAFIXt9gZP>D&2^y>+6{E#IRc_L>q4ApT=sDD5&4n~gCb%3v47%(D{f`dHO2! z%<22L&Xr=CmRwVv{`=w}=Je%SXI`(nEvaJjyGn<}4nif<$!*3ORrM+Zy!)ihsk8^Oa217Zx52Q&z5=Y|51< z%@tuS)lJYz&0>|+)71RT?#xteSFzL3l){F!Qqw#z&eGgz08&7qblB#TVy(=y7N(*# zI~A=(Q?W3`+Ah;tn2OfyRJ0aN#l0!kR+-kqRJ3NNqP1u$=B8LPnbyKov}UKGwP-3X z%a1)~ebzeF9m5|<*V*c9nBDc?0Y%<-_VqG|(6s&?zTnvLIE-T>Fq^y|#v-S=* z?NTVrn01LQ)>T%pHY`dVvo4;Uv!YkY6=v_v@O27|^~qV_+}SI|-L-0U#R+$( zk*jQ1 z5yjz*XD!)Cg#0(!9AAYcGT=?;?jlqsWn*dj>=Q-IF)I+%0&e`btuDgemSXGTlF9s`2m3Jok@zYW(|ZpZlkMYW(~9guDKP z`gMvL2@nM%cV_CNjV0-`FVZJE;1+ejS?iA#vA~BeuzcuP-{0k(u?uho?GuY0@GA6A zXZv83u@5rcooi*M<~ELSoqteoIB@daulLHGzmAqW`9`)N++zH3cpW+$!_f!-WZEh7 z>?%Mw(z2diMFz`yc9jgvdf87i?dLI`BN2~E;KhlZ9sbXMj>YvXLE)pVA0S9z-t+#-788NOrD!RT023izNIs&lXGKkS^*{V}W5SVZ`baiuC=<{9Eu*w{~L zqd;Fb_H(FJ-}k7VV~f&U|8Z^AU1%$Raa&~B_}zpkU}0bANF>& zV@F_`dZ10})8ye!)QSa6!O*ZOkVE-C@Yh}Kj5YWm_4DHxUN_UT^X!%T>?1r?Ctj1+Y1RC*aVKE1W)tqt@hbl3khu41h%3CrMUd= zvsVZSERZ16-ZD8`u_xOtC)+Jk{Uqx`dYb9v+K0&{tjXtXQf<%8b|`;_=51=nB`R;4 z=WX)h63JPS0#*ofIdfCj)yvZCg^m`kP(_7?u@kpGb?-o%R@P|PRFACOjFBm03ZS(Y zO?oz2eHvo_pt(y6N?8RnI7%pB!s*A8xWG0?Xk>A?oLIVVeL+0n&#Pni`v#xO|n zgw&q#???2+JdCocdXFDN-QArV4|nlZFl?Ywt)9L!^(yv(H+G zF9V*(Y{iYFH3G`&{MDUhssUqZPg~jvqb!$6TSlX7cBjIDmMu{&Cw_3*DGK(c7J_C4 z>ik@8eqwm-Y2uvvw0QyBZh%eEO|BjM8(HKP4mY&sveemJZ8xUDH?HRR*B6X6COMHy z(BTpdTfiq`7+n4HFRbp26VN3`($vU|WKf$n*DN2|3eCBE4v@(wM|oN**-1!~;~u6W zlPg?VFa^=DwR$!VvG6^Gs||bQ7q0E(8rlf!rk1BZe)M#An*Zh_Ie5f?an@E`S?XQcW*E^xg*!SVMJ&(02gZ5oa{acM`;vXy@({Z-U4 zYVj|Fwnh5Cc%YfO%kFSuqt>;z>_2tyT713!#}=k*Kl?hgkL9b1>h>cK%`dF8{^px3 z=ZGsyR;;PJ;QqN0O>Zp9O{?(j-R|K&*{v$=8GfYd&=*^W%=FO=t66Q+cb%I|_@c{~ zlYXqXuGiBY??!#u|F-3FH`TilJ10lIN zeeamQjSkle>-C^w*7#4yZ+_P%!D9A+QkTWPt2R!$^!AkH(ty9JWUgKLZPe7iSNe^< z`tvt)T8)Z#ztp!RqS=z-qMivS(k8xGl9ZS|>a$5r4#i&k=H}o7rKvls6}#;SopG-7 z{@@$^s^6*Uk+N!N+rXeFrt%TbK8IM2>a(P0vlQ z{!Vb5^RSb5;FIkWVmH_vi*_3NnS1)%FRs~iyY`v&u7P)t`7Rs2`0Ln{wUvtkKJFD=H25=*p>BD_T1}!%rR&a+dLNJo%L<{|FKW?yuy6Hhf@k~pKtM1)yQqyL)p$N`n>CXKcs&CheaoINh-2q4=!o^`Oa@Qwd}m^&moDK6($Cp zSu=d5Z_um7l}}_`F1Xja)9VQ--|c?6VSMs85$BgrkNKt5wx1fgd{wj~yNgrx8C&nI z4UYc3%aLhk8zg}n zogGrK+Ok(|CJ+2|agQf^2A#xGjGbK9CcKBz8k zf3x&tzQRhMPWg&hJLOl`FYo_zZHRwi#?t4 z01^R!NdUk#0N?-sPz?YG1pxK~0M!A26aXL)0O$n(lmGy80f5>7zzP6h6aY{I09XJ3 z90ULw006fDfRO+|a{#~=0I&oARs#T=0f1)!z&-%rFaR(P0B8XKWC8%C06;DPa25dg z1pufA0Hgx|>i~cp0KgLfNB{sj0RY;eFM0f4Uo0BZms1_00l z01W|vRRF*l0ALCLa0~!Q1pvGNfZqXt-T=UT0H7EEp!q)s0O$h%>;M1;0RZm-0Dl0W zE&$L300;p9+yQ_K06=E|U@rhr2>`eV0IUZ91_J{?805AancnJV}0{~110JZ@D zUjYDJ0D!FkKr{d_4FIqQ0A2t93IHG<0MGycGXVfQ0N^eFa0LK32LSvG0Q?F7>;?cl z000#La2x>W2movW0QLX?RRDl~0KjVipdtX!1^`$L01N~Gh64aM0D#*7KrH~E005W; z09XM4;{kv;0H8GhFa`kd0|43r0F?oNMF7B50AL9KkOlxe1_0Uv0FMBGt^mMj0N`@~ zAPE5Y765nv0E`6yTmgXj0KjYj;4=WAB>)fr0O$Y!B>=Dx0Pq0-VgZ2b0Ki%RAOiqU z0{~h8ARYkd4ghQg05kx=CIDap05Ayv=mh|b0st%lfOh~u6aX+802lxO{00F02mtg1 z05$>uV*r3!06;|m;5Yz~005K%0IL9iw*Wu@0I(JSm|Q>06GHz{Qv+D0H7@ZFbe>f0s!m+0CE6;763pv0Pqn2hy(!M z005T&01E(MDFE;#0MHZwH~|1m0|4v*fCT`+W&mI!0FVLz)CK_d0|3tefLj2-3jp97 z03Zke_yhn90{}(<05<`EzX5=U0KgLfU;_Z)1OTK105$-CH2`o709XtFj0XUI1^}u6 z0Pg{S`v5=>0AM`;&>a9+2mp))03HJX4gf$U0H7`aK=Xe-0PqL^&;kHD06-4_cmV*v z005l;fGYsN764#40MHr$2m=8A0sy`M0G0s&-va=+Km4OV08kSEI1B(Z2LMU{fNB6h z1pwd&03aU#*aiU9003+OfNKCiAOO%90C))ibO8Wn0szebfKvd#2LRwH0PqI@Fb@Ez z4*)m=01W|vZUBHM0FVm+v;hEA0DvC=a2o)q3IH4e0Qvv`AppQ40N`@~pd|p10RRjF z04@Lkc>sVT05BT>xDEg;0RX-Q0M-EjnE=2U0KgXjs0;uU006H6fZYHW80CfO>ivWN>0MHu%Py+x;0KgRh=n4Qd0RV~tfI9%dUI5?*01yWN zoC5$l0sv0|2}MfbRf+MgTxx0AM8mpa1~A0s#I5015$s zxd6Zc0AL&dFcJWO{2vPWKNIr5Cggu-$p0>o|MejMcR>F4hx~Vg{ND-rp9=Z^67qjA zi0q{@;Q8Uj_Le1o^)g^8X0r z|0l@*w~+r@$p58~|0^K>{UHCpg#6b*{@;fD4~6{S2l?Ly@_#<$|0T$O736;d$bSpS z|3{Gj>5%_hA^)F4{ttru*FgT;K>lBV{67i#-wyIW5Axp{@_!TLza!+oH{|~W$p2%I z|DQqre*yV_4f1~=E6D#q$p0FU|Gz^1r$PRQLH_T7{I`Yt{|oXz3GzP| z@_#zy{~MbBkpK3O|DKTlbs_&FA^$%@{#Szh?*{qb0rKAg@;@B%e+}e+L&$$6taA^+z={$GUr-v#;q z1LS`l$p1ee|0_WLPl5bz0r|fT^4}Tqzc=K6KIDH6YrLjDhj{C@@cp8@&b8uC8{@_z&5e+1-z4CMb$kpD%H z|4xwq_aOg&hx|Va`5z7W{}A$j4&?t`$p7t-|L&0gPayvfL;m-J{C@!X-wg8K1MI^|`M(bGUjh054)Xs!H4)XspnXU6&$?z&GhMWA5WQ*{c75@#rkK@D*QTW(y{9? zF?*MN|NZblm1>BELScC>ENq*9ixxBf`t+&B*T4N1H1NwW?>?M7dG*rMr+d{)Nm-Xx zTDqAK~=qa(~e(! zk?UY>U8&9L)n8Y%wY6{P;?kj3a`KuRw{CSi`}g0C2Q_IDF>BwxvkwvyHn`Z^*QzsT z&iYX;TgJDmS+jMATD4mJ5gom6|Clk4$L8d`-{j}_YI2t@0}uZCt9r&)U!C)7)@<6f z+qXZP(56jn<+*cLZ5cM~<)I4~!fEanK6=#B+s!TT_J^y_y$Yrue?_lz2KZ{ANo^*eI@{G{)nJZV07`}RAJ-oLLpzekVn zR}UQcTWH(1Bb?{WTan(Y*H8D~zIC#)u(0_wYu4yB!@y!t$S`O+%*=+PTf4jd@lef4TWcX#(-Hzz06 z9lgHh$LG&0etYp^)agw8c>-FnNM<-0URn^h4&d%R|pZt4C zNtX~$PyhJNod>x(IMmJT+xK^+jg3Q}h7BVN#*O=P!-*5)k6pSH-DAg&Cntk~wscyy zEZ<}0%1xL4{Ilb;q@;zv{PmaT!lI%c(H%REz8V#EP_cONqP@TT60&yCpo@LCZ7aDP z8M%LlzyG`EFJ9RG^x#3G(;Ch07gMJ$>Ah>$eJ4A+>M@58|5BQmnA)#VqnL56TkE`P z*KRm+%a*5c`}hB_>eQ*BKi<37Aotp}>G$H}*M3&7p8FU5`(INZJN8F~g$w6bN>86x zqSaRIFMVAw5^~QxUu2`|P z)tWU2y4I~*zsiCInZ@_-yDd0(uJ85{BlJU>Hci}o&dq&epO%(fvqFVx zns2|o`rF;R9&@{QKXpDlydcHL=euUv*?Y#cYBi;9rAp4z_U!pFfB5hZQAdva+OlfZ z&YJ;%xd1>m0I(PUr~m*Q0|52{0K)-*Apn3S0I&@Jm;nIP004pjfV%*|Y5<@Y0I&`K z@CE=D00310fWHBNVgSGq0C)%hgaH5_0e}Ypz_$RvYXIO20AMTtZ~_3R4FK!{044$e zV*mgj0KftO7z_Z60{~tC0PO$(I{;ug01yWN3KNza;<=2msUr0Ez&BM*zS#0Dvz5a0LM9 z4**;T0DcAl?g0S(0DwsVKyv`#4ggRU0QepN_zeIU0RXH30Db}hoB#kD0AMx%PznI_ z1ON^L0Ji~v=K#Pb0N^+PkPZOs1OSc#0DS-eD*)gI08j`3Bme-x0DuYrs0jd61OTD{ zfB^u2D*(_Q0B8dM+ynsf0Dv<9KqmlTBmnRX07wAcU?u?YB>*r705}Z*Gy?!G0RUYAfFuCm764EO0GJE_bO8YT0f0dOKwSXf zcL2Zv0Eh$t{saKV0|3zgz!Lyq3jmN00BiyPIsyO-0RT?`pa%dj8UQ#504xFkLI8k^ z06+-4h0KfwPI0XO{007?s0DAy{DFA>o0PrIK@Bsk$6#(cA z00aX7(*b}f0KhZ=;28ig2>^%z0KNwRQ~-bi00;vBS^xl_0D#{BfG+`n$pFA<03Zbb zC0RX)KfVTjE1pqJ$02l%Q zbOiu5008*_z)%2SBLLtH04xOnG68^f0Du<&@Dczx3IH4c0ImW6?f`%j0H6l|o&x|E z0f4grfD!mM*tuS09XtF`~mQ03ZSYxB>ty0RUD20BZn%x&Xie0N_3Va1H<% z0RS`w0B!&PivWOJ03Zzjr~m+b3jo{&0J;MJ;Q)XS0FVs;v;qJs0RVddfZ+hZ5dfen z008-a3iAIA`2KoOE^8X3s|31k7C6NE`A^&|K|G$F#4}kpd1^M3q@_!iQ|DTZmYass< zApdVd{&$1?9{~9u3Hd)0^8Y2|{~XBwaLE6mkpCAT|KCFX--7)A67oL?^1nIcza8ZN zO2~g-$p3Ya|0>A;j*$NjkpFEU|0_cNH-!AJ1^Isi^8YO4{~*Z!S&;t^Apcz;|LZ{h zkAnPf2l?Lt^8XLW|NW5vV`SOkpEeb|9c?+=Ry7-f&Bj-@_#Vo|0Br% z`H=ssA^$@m|D7TK(;@%wL;hPq{(pk}&w>0;g#2#=`QIP%KM(SMJmh~eqKA{9g^4|&aKL+x@6!O0x1RLj7gdMNUf+6eTtEByZ||qy?v%2ojebG9B|Uncyng@3;nP-l zZaLAQ+v5Q%9lO8#ZjfE;+|Z_18t$7sHm`5g!V8UbZ(fDW56`Ol^QLiU#%m5_Mr!*E z`S|G2)d^L6M{ZrbZf?fqFPTM0FFCyabCh+#SG{b`x2(JL^yif<3U?o~R8&r%)One+ z&)~2>9;|xy)49_9cjLa;5nunWo$cq{dfV|{?SvcAy`R>Mt<&uLw3vfI6}MOarq&1l z&-$ObnB=zl_v4=u&yIOf?^=G_RNEgs_PRKYZj$^kAaLlcZ8g5`SE1FNsT-CTuYHnJ z(q-VT<}ddY{e7hCoMGAOYAvj09-i`R!qcP!acG%W6hHahNg z@$UKKUnO3vc6d<2fokEWc0QRtt&i2s*-P&>OQ^B&-lCBnR+ZDOKTNP6^I~qg-KD0N z!k2WLb|v(e&X)_1%)7Yr-Mwjhtv+=frunQ*udidyrtUkFwzRa%=T}-EY_-#^ZM(j2 z?sa|NuV_oJjyYd#`~2+fvpYA`zO%4#LcOq!KkoJ3o4n}hf=w@O9Pe-4e){;@6(5{D z6|>>>v%6=DD#ToSy6DSxCq~;Bul9)#I|ocw>)`%H%@*2fb-GP$T{peXFKbfw7TvA% zsP4Oy#m56Stlc(ea8CDKOAn9gZ?FGj=GwF|JLw;}c4@k|$kVxN zu*V(mX*ZlIH>`4}e`fAy=kps+z4bO>skXC) z&$PRd9i143g{76Xjjf%%gQK!S#Y*z_n36VRan)r@Enjx^yZZg0%Z*lfTi0D1@bFcS zp0D%k2R=HZ8lY+VYV;3@p_`qq6#lwvg1kLGoLIPcK=7RD_V=nWg-%wA#j968IR0vM z%!sv719y+!{48pNo88FMk)N&I;n)Alj^gI>_89#4A7S1X9Xl5-op`zV;600DzwDhe z|6cT?=j&>ZJ-q6qouaX8ov`QA?hRWyX5nAnf6o0Mw+F+h=wixm3MTTv@5hIC8GW_S z6-U?(l`k4)F605x{`K`yV=jwS5 zTNXTd**BIGhPdVLh*r;Q_BQ7aW7*cj;;6AE$(|U^Tq(HnU3zm+~;pz zRkQxowDQVMaXtTsTZ@@hsy5wqam$yltEAfhG`Oq$d`sf?yuMm7#IMNdd5h$Xq&q=x z9$fTmIcb`ZF0k9*PE}6Fe$yguSLwVNQ)bs|-_o{=+U~bjSxy`6U2nYj(|-KmgIm8! zYNbxt*toKDfsn7P&!JYiHdWJgSCT6DJYI73QtIEW>wfUPIv#Xj@4DZ5d2ecQJu0!oFRRBr*!A3LSfhQmZNzzoMMQ^1YTVerb?g=u z7bcD~8o+jTBQmt5t(;?~R~-G=Yg|OA zTX3X0I?Rp#5h6EFRcnvd9&Sy;E^78D|OmucGSi{C>vSOYZz6VHFOZ+F^EE!wzA!2D(8#hY^ z-y{@mmP}>l3h$pfSHTR#myh@ac*#@23=*ZL^Hq@@SCbvrV4UrE6J8EgFoT%~LXp_x zAqCV=VA9|z)7!Gtr5(9g7aW2fJ{nrlHvc;Ohkf*H@mOXAf`q$EC&X~qvhu6#j^ zFoL<`U}hYjKZEr*kr~eC=Z+(oVSIii8y~`!6G0}BJ=QRL`23u|Nz8e^|G4;2=78il z47rS(CC0OOvosmcgT>Jp-$P`__*R5yvt;DsQ)pc-ktH)+l$z$t2-&fGyvfJcC|UZ^ zvg0wb%!iD*q8N}zOk?g|sU>y1S zC9}u9nG{+3^pqWEAsuaMd&=LR4J-IzPv~_OwZDQN?nuhGiu_2@^X)~BB@4W&6rK1AuO^Woe0q)n(h>yw|(;<~UtY4BiUeRkx+tWPg4%=+Xn zB{VLDcB_D}D}RZv!H4NQG|S0O=TY-vI!_26rt{Fuqcn6LnpG60^E~FmbROCie3@DQ zl#$;AJ6kUvOKcivE(D!?!tG9=^@l@^s?TvgP@V z3yaIM8z$Fkoc(J)O#TY^F!?*ehsoc1Di6|=zY0_ygbn54(ae^I$2O&NMWd3fDj&uN zyD4~dv*`mlTT^_v*5tzee3;@Vi|mbPydn+R+4}P5V(ZKMq%yhI!avy9K1G<)Qx}q* z@)1ucO!;V2@P6te?8*yK54j9n3Rb(g((5Hp4b)L*&x%0!ZdNQ4Zu$6i9bUq z?2CV}4actFmLa-}>*&tLO!tgm2pOF-%6Jpb1SM+9s zOgx1(TsV=!NWT=H(<$7SvnNxy9~YiWVHyVWnfo?vO#7Ah2e7( zKC>uH6~(p|yTXqRGC33;%Y`YOf|qmo6y|SDc2JlqjcpHh1vM15{n*Jr@t}ah)JWKl zVi)*X31L?^{DZ9pb_(0!vmGC{!Y6eJ*_HUDrlGJCKB*`acEu+Zm%{j;8Oetm;**L+ z_NMrxVo|syK8yKqb$njp!?p2QNx`L2A?(hFsVx2YFx6=SAEtVQ^II_r)-eJp?IRoM2e3;Ul;=`2p z9v`N%+1hdGscbFyFqKWkhpBAs`S1#aJM-ZzgnRJewFnR7!#fb(#)tC}-pz+MA^aU5 z&O!K`$o?}Q&WHUaAKrs-6KE)Ee=28BK1}5t!iNhGuJ7KkLDMG9n|Zcv-3q_Eu89iP zCNZsbG4$8IThnj;;}3Sn2PEQ$qv_8Lm_!7}>&!>Qga)w@1{Y+&9~x^NPrroUTBnIr zv%%KF&)!o)KO8iZ#mY!nu~=*PZI^HTq?f1f>p{u)IYtxJj6zrtv~^weasB$9@p z_=&Phgmqk?I|6#!mG%XXoq9MwuNg>~FzSk@*Un8!hrQCN<&`pltu>gi9mq zG^!N)w@UE~`w8@y>Deh1r8QrD`codQ>6u;Y-h)Q8!tdq>Phwir+9m#2atQvQKp2BR zz7QQBYWTwhhTp-Ts?o*ZujlZEG^qvk8~bM;%I{iH5)&7qICBjtiZ;ngXGfO<5H#n? zX-KmPP2Bw}S0;)0=_JL8s7&&X3u6DCylFpaf`df0Fe#j<3iKSc{PyMxX-sJ1&LoAo zwwEL_QxDF+EQ0D$&WZVPA5>lyjA=0UTMH>o>cAz#G%lw#FKjggMR-eknq5chGU z$6~Nkc_@yKNsEj9kuJg#hG7%@ImrB}ME)Qf4gPG9LF{h;A162z{3#Hius0vkRpbw{ z(%|m_3M=+E1aY*kDr|zkJ4h$?*GJ?JGSA@eA)JZ*h4685e}5s7*xzuGKP+Pz{GE~c z3rAc%!5N>94u6pO3l#aQz^9}B_(4|RR6Y(L>?YLrgsi@iB7c>TlG2gCtulX$V5^N? z*aUxhGJlC8f3(~t`1=9@ar@;Xj?N=&g1==5P}rM~mFCGE0zx}Y$ zny9c*I@)3ops+U`V9STU;rJwfRj^YW`8$FD`4e2&pwqB;jcRER6cj?faOyz5YUGPV1#$tazBZ8jG2%F$<7Yt&5 zIU;{e_&936)^H~FcMmW#SH5OQB=&btsXYI%9oA{mbiS?E1B=#c}OQNUn2Yo{o6|9FGA+e4gMMdE|NiTw3IYN7osaQzYYZ*m#s`zRYPn?(M4iTu&}tk~aN_)9jF z&RAbs)1@+a|3B=#4R}*U+BbeqlBQ`JBq=3)6f`LX%9kenuHs`-+EN63N>|Ir>Pu6x zv@9SkBE>Chn$?ovx|XVt;#XRCrA2ux^@A3c-3C`E2ny`FR(IJgtRLVi76q*c=Ks6r zoM}%(D?ZQvdar%2>wO2BbI;5@zq#jo=FFVAWxr+x-b}c0`5ptU#M5A~ZkG2}fkMNGk<$L)oX@sRlnc|bJha}2`Q5Q0}W2;T=Gc=dzuRU$%VyvM-T zP6Ek>%SZb%O1@3#1nis%PtLbW&KGpc%p3zBhLB!Ed}Ln|67NaywfA!M;Vln|w?1p& zcr9pKO8HKLkE#|oTs{jNlzc{XJ_GU14#CR;AGKF*kiE>HI`_lN17D%!#eR9b9U=9v zc@Vz;3gI*442(zn+{$#U8ia37NIoA0U(EpW-3~A%Ug6Av`5Hs`y1_S4{yiu2aX)je zw7<)vrnu;DiJZ^e{UPuv4e^k<4}9u5LFztTWcT4c2(5d`feh!{sqJe+)=dDN|hO|u7i^cLtPg2=HcY}YzQpJUF_3IOHdbX!S}aM_)s_Dd>C|$?hhAh)k1@s-_Eb5+xc6d(3f8z zUbnMWt!Ys6+x>Bnl>8O9`v-nl&0XEGTJ_Kd^))SO{XX>&y|(mR5!B~6jYZCA*I^?r zO9vjVG{=4BxYZo01OiiQ4;tz$8(vlASa7V=P^*SF)4rsRChbV-VSU<>&biewwd&#A z-^Bb!^!np+?&9+fw|Zo)dKBjw&3IxJJVv(~n)=3ahHDwabqa>)@;|y(J?wbP=R-?711bivZ{M8MZ#&5+StB129k-B$7a3Rx$0#zkn`9(wE#uAPm6^m0hCi zr)G1u)$Y0=EHSz^n>|BH&J_Z#1X}5ew1TUG>0z!!Sm<3WTp9{?e=it8Z7^2^Tx+eQ ztkvcld)#6;3Poh^8$S3G^cdAhNQd|71r+nq!{(Z!7yLUU4P_{C|4Zf?-hq=?@p^BuB(WiSix&14=RTkW??st02-2R8W&gq?`ZR?L- z$Cw_k%^jG!sKU3Y<_SZ4opEc4r+!iT?B_}IcV|_XN@#c^i_vAEJ~TSilPVCtBgp%2XhuQ{aWaz{8x15KB4FaKs>b(f012Kt5;+9o+X z<9zW@kkwn+QJ!0$K{ZAGYzhVs9Yk$F8IXpA4uca8`=#oE5=O?AVTr#1H62x}-D7tB z%X~)k3~P;XJz_;$+5I{-3RXOaj!2=J51S8Kq*k+g7kq_1giN*FE1|d^F++dZudS|D zV*pE+Jt!In+ErhI{Z*YDQPD)7M?KY*)RBiW7xh8I>4yvpDht5%`#F~<|-8nSC|Vs9sU!BnrF;4@0pK2XH6HaUt7D^SzSww?ZpPD zH|<($C|qmKwUua~9K6H=?S2c4d3hJ|ip|g?xxle54C>RN$a_`LToL2i06nWz0lmX7 zhqVDXaZ0v|{-(#(5zaX43w!du#eRPkt?S>i_phl|g z2hnL$YedsQx6_ymRbeQ5Dcwb+1?x zG?3o%ugyrKptpCg+9Zs&3uo)QJ~4MO&Mt{_rC4*8rRZbxsl1qn`9V9FcU4o1z6Mj}I42lT7VR#@QRTH1ec}%)6g4FVN+^Z`~WwW;xn@L0DnzE;fJJaXxpbJ=I#<(Nhvp zIK}E}F?Q`Sm|1m2^|PBV2w6sRmbv*=YhHq*Japt%(R_!w>mzg5 zPpx^cSlc2B8y)T24TY_1pgFt!bpu8oSE|_j3TZ6yXIbsc*Uo%huZr!-1{aj=?jhg2 z<_kiK5uD9Xyt>`$Gd4vW{jJrt+vsypkv2MfHWVjN3&HrYvHADJ*fcbcA?8VluZis+ zvGQPu{@+-AmKreWD9_dwEIpebLgnBfs&$oRMEZ5zT!Xj^dKsZXoMr|JWpGt)wXRmp zmBB$%Ir(#Ca0kt9wWbzR8hKv9RKa0NBWZPPg0E1E36bneir}OP5e?FHX7|34-jgjV zq0OS7(iUj(2agHD`#aIoy|BnZtqxg=uHU-W7t7w`#VDkYs?p# z(M=|xn-t=V<`XoEUk>XX$Dc9RmDSW-sEIeXAGfYMS$m+z7tv8w^R%`3pyANlkfUaS zqxlZQq5^cOt~-qFcbIGJ7f5e!E+Roawr88?1%r7XQZ0cZoUYHLS;C5;)H@y&+y7`j zXlu`PImtZz7L#vpxqBD5%?$35-r>blUi z-P}~=`qXGWYw-6tDvqrR8oItPo6lOogLZhr+I-n?vFFR7!qId`GgM8d9??SCH0po% zSLUPE3vepgbYrTle>!MB+PS7;=LhexoEMMYVD4gKboH$1h8W+Ac~Zyo1&Lwrx*(i4 zA~M9(bMo|cc+?=eXAE0?NY>HQj^?w5oAsamlPPC4B2`DbF2L#2kKrI-`cX%b^+t6N zrPyKf|IK<7o%83^IiDWdSl0Eawf$|Y9kY_p44|&sSz|w8K&CdHJay>O>1!yPs{A{w z%^yhh%g^NY)U()7Tu7+DzuYIx{>C+I)I-Zc0IK#j!PU5?;kKbJ|AmIzt^u0+wjrc={I;m0(7tg*+t2f?COw{ys-ej=rV3JVwO8Av780FC1{Viyf~wX43Xybf zy6YP^RwXj0ov7^^VTT&3RH4s{H02fSo<~dLBddFe+8W)dhZ7OB~(={jeU$`YZKFDs{totL|Ljod-pG4v6Bl ztx&JCl%Dff8y~2Ua~hw&ghOOrYOPK*O3GwU!0n77&5px8^;k!Hs@%>Iae+bhuo`T+3HpawJJWrQ!!1yDz!ZQ^O_NvTcxR0 z@%f>O%@0+4en>fx^AKz;{RV)}JC2wwBeOa6DOhidg;GL0uPBo`G^HKTz1> z-#$GYomaT@b|LC`AP?EUL)%t%B>Z#LWl~FtT1E`KmT6F#DBh7`$+_5KsTx&SCZuLp zKOQ6(qHn3L3F@JjRRYji5G_>ITjZT=R!Gu0WhU>WusOk&6UM4^hE~>#f z`f=*RY|8f5TMMMd=A27|%3w92JWzP&Pp4~l;Oz%XV!ksTI(XNKdZt6b!O9^{E+&fGR-NNXwCoa7qtaJe2)X?*ScoJLz4B+};Pu?an!;wzObyUM;og`8!Kb^Nkv?hSkHHgF!qM`I9UxugFM$; zjTS{^>_n{V<*Y5bvi_oQDKAuV+3Gc!&X`Q+@Jy#E6U{@)R5h|n%|ys_#`k4vhzP2^ z>Yj5<1S%_pkTZ9*x+D-=OlfDuD`jo^PSaPa{jAFb`Me4mWIL>0maR$qUuC_1qgq~+dSvt4{waf-ahoK;a}4pJU{8B zcXn)gw4&q5Z*O?}i0%PT`klX=oG|mRtp^_eP4rKK8?LdXS{CGrzfQX^@z9x_yI$14 z_s4?F3E{rN_g`-_+CMY@YOnv`Lz-FR&i!ZJb;JJF+5YVOf4=eadu~!a_8+Im*M2no z#N`o9fB5s(U%Z*I^!xjtnX&EU(F-MC#wM={dw%1)>#7^A`{&KR_JxUGryO4yZ*njG z;Nvw7UrcQo^W0tcx+2T7o?2cL_0y#Fi}Js6)_>Fdms=`Vd>+&F+neKF>GA%(Z1l^! zU#t4R{r*O4NnPxQHcLfb#$QjCM-)x}k6-++U!U_Ietz=U?_U3l`HzoQ-E+bF)-!AO z&!15+;?MTcbKCD;{?A<cq%#|M=q2`>hxMX8YN(9iwLLowxbyhmDR8f=BMC zPW`}m^x&8me)rkxnxDV3@Ui-D zr+v9ocp~k&qt`#ZGT|0i_sxGAzwxzCGG96H={IwXN$Q4|3UN1N{w#-dHRTd>0=^rg zt10>Ako;=O5H5VrL|p8`N(#+xtn3Rdb8}ajo4eA5l~?l0t|7d*$8rE(*;VEZy#Vow z8`O+(Nm+Lkul3Yz-*foH+2DI4zx&IJOXjS8rfKm_A7_uKn2`1K$gsbDvVHt-O5UDu zuBropa}$eCe+Br^Ebz7&E`)_Po(w53P^ca_af)QGc&5cy`lA zuO0rc8@~EO{U5e0&MrIu$jMF4l$ zZrYx01ySpMv;WnC)>Z4@UUQxA_H&-c|6x@vPuyG_Gr}_Bk-GN!b1mJa_VKs;-0D5` z{56fsp6_^Up}l+2duJW*4V$^A-1*PkbN`N$IJoaXaS&#pJMumjrB$gB?><#Rgs_w! zdV#wrBnsYscAK!ZpZx}QzW_sE{8phyj_)}*VxiV=$$RA;e2N3C;JorqzR>V^cc?Jx zeqVf1c$31H?4v{Mii=XpNw8JhnTdg%}}90Z8G$ zm9gmDXf#gh7s+_Tn0<_Jw;Vo+;hBXrx&GHO|9D}$jOSwZ1Ytyod|!sd_Y3fm`6&*2 zMY9`EQ0{WIBxsR7DuKb-2tmZwDj8}8VjLr-dSsF47;>lc*f1mUCz|mClYl=_ZaPzm zma7S!FN=}oqi+F;ra0$AMxrUsU&}NFuajxYryVj)asFPWDb5!Wj>6KnYOl()8T3J! zjtAX_JR}~HD;W_IO>&VD&G>;~X^)d=mUcN^B!_5`-0Aza7`e+JR-!3fl1x*$ESaWo zewilun`D~gznvPC&G>=& zF=?p*UyR(HJt@-^ZmUcaKJ}r*L-?5_GiXZ7T$!e{{9UFgEo4NwNmKY3?22&1>i}h6 z41vf-l)D5bvt0M6Ea`qSGUM>a?<%`TrpbMk!kz3K$4u_jm|zy*kJDu5Jh9|X4NNv% zW+sE&1(Wa(qJgBh-Vp|cM>gkt%b6?3(qA)ldv!)_#^(!crGVe?s`|r?l0kaAJNz22Zpjc zCWeu0)FWC0D`gqc20TezqKS>Nm1xS>WSORXrEi$X-HfM0ruBH|>oGEJCUWO^0oZ8A+bJu*!=(HLL|llbj29S=HB zrb!;th~XpYhUzP>D#CeFb_;@SF)oPcea+gfeMH1|)eDJ2ndD12codQ_ z%3FQ7Ph!Z0K3CpwL!3W!-%hW8=!H9dQPAx)?Eah(u@V>Gjq6Va@d>$(hoebJVPOWA zRlY4`@SAi9DU^v_qv0f<;(HfY+#7lekJ5+krlN~=e(>=B|K$E07JKJMZ zB$vtHSHVzheN2?rK`w*oV`P`K44ym*jWLCMr6J`>U$rQ|_da%03eP2$)7)`@Tg3WA zknWHAp}djP#O~Ju-#~YK8)rmcWhHPuy^_J_OGPyc#gs@rQ1|7w-gwQ_A-e0LH+d8;;irCZg@KM?$B|b{;7f8HPzP};EIR?CY=@TJ**pp;) zaN;4u!*qg=XgfK=yc93RV+T#~ksm#yL-1Tkqyg^SaJ(TQc&!RNO!<59zCa!*(@_IF zTIX`Z@je9~(RSJ6kHDk)LUxLu{763fE?9{-5}7toxji2u-+2WdP4zimbqHQE@Mzu5 z4e^nw3c-sX-&by!KJ?;sgI3D70GYut2#3@El4(0R!c+i{(r3pX&Gor_e*&$^uumPw3{ z!l#AcJ*~i_^5b}mLdwGfJRJeZhWNp>{47uHx+nvKdv3_wC3Y@KLM@8TYz@}^qz_v zj&~azlz2}}#D_d832&R`^CiNY%!hb^u}>n|F9o4LYFqT=>3so>(F{8`;~{nGLEAbimweAVcD2Euz&mXFJ1!n?vHA@Ne)d@JK|uLtCJirh{- zWFk;t%I|TxPo!68$X=G8&ebbztDNPl`8T;&`*t!t zF*%uiWNE(oH{PGgg(uAw6QD&!k`CuzeX5%0+ubkwUl<+N5`pjU#O7Ap<`>1-rY4m; z0vkF0$J;lwg@GXl-G^?PZfy5H|AY8|C~A*>`mX8s2ZF)&J^t1xf0Qs`beB6q^lGLw z<(P!mZ~YT2I7HeIp~9Cfu8rn~2({m1_G)G~RbL~#zUWnWFBcP#WFm!E$4cP}`zDuPOXSD0uZnNj}JUCSDZ*KOO^|8$!gQ>NL7^1vhF?M6^!S5?S-K)YUGEwv?2EOlW3-gA@dg{cex@~oz z?0=7!1f}(*LDEV|?#pK@0WNGw2-?qny0z*dZ2=6Px*t$AZUA#}V z(d$*EjSOped298zL49OSk6f1Zyq?^G$XZ^0b~~Id`pa!B(qa0 zajXUkwu_~Qv=A!M?#T z-*?l#fSKxz$3|6f^5wz}2A{F9Y>O}2bW!L~byhVx_lA4Q$aB$mECM7xEqza;m~#f7 z7su0m?*Hovnj1$8BXGF9^1VmeBtO>lQSZlqI(aWE9w@j3zPbaXH1)MAxp@< zfX*qmXRTn`F07A40j!Uj7CyFHZv0;%RGr3Wd12I<2Axo0EM9hUYx?XzQZBG=K#MR1 z?_Kh!yz#yms+MUZry$4zu`Y~wX203Twe}*o#`}g#TtmxW-m3j5sDBGdX{3|$`tY2S zylkAXt+T8%t`m<-?Y^(0VjtZ3jBzjf9#yTa6CVxtiFi!Y=@)IQ`-u8txgF30d1fjS z8{<$OD2>K^{7j{+Q-0S#`KmH)6Oj*|rCwFzL{!hl`S{sEM`#M4Dr(uGnjrHYT<^dZXm^#}OS-aGACkfFV! zXy{igkS9y?nSH1*LgpXN?8AEB=}7k2-gy?h**q!_b1O0wb2M(Jt&{CPWA<^vU*z~& zn0+GC!vRvD^+_~NV$hwN+!#R6C(mT4WJ#acFXZr)Q=~s^MF@Y7>`!4R{3$tpDZZP8 z9yxuKlcY~d`Mx=Y=k6?B zSnqSg_kt-;`t5hq3nmyQ&p3&ut!}>GjiqewemD7w3G^$U6HvU2;qfvYN(4+i{$fZF znBU@$=-zbELK_CJOoSMEDJ2^&rxJ(BOqB$Nr3-W~4pj~q#zUDT8;--=X}!zcsWHM( z)gs+iWTJcZ6RcQOy14uv=aR)mr7NA~q#xwUy&)`Sm~Mi_E1fIuSt6;aSY8UHBCAWB z%a`A~cCa_}R}V+K1plol|GQBQ3cmE7`>;31Bj=Z5NK*#}cYB;YyDFdqv#;o|S7>{7_DkAPSy=L5l9Z zclp&o6g-1~l-`HU6=*(QymHO*tHTY%Jut9y`HzF_;|txD{DDG3qq$nj`&b5+uZSn* zYCxfk1H&O1R|8@!{Zy3<*4C-`QGKrl*vB%kOsnrHTZ2>K_bk4*_-asBvR(;!U%8Vs zO5cP1*B^yDAU|*5SEyy-9)oI0p|;Z-vw~~DuA@IA$G)3-%ew`|%ON>mSYms7j^4oc z7Gsw`Bw_h7!T zL7pp-BcDc9%QW|r-jVeN>m5TI5P-rc`S|!s+?;*}Ohnts5k?;=&8uz)P4bW*O=H|4 zcy;90>$^3jxy<4pzu*535$ z>&-jeo{ z?;!;q%`rLNSTOU!ww#rmq}N7g8P%$@wk^>y;1J^!3AgRe?uS zT8{Tghybl$4*MXVi)r8=k2Oh^DOin)%f_F)gUW)>6SqL7jV`)vz z4ad7D1W$)XOYN1?I}U$bz9S%%`A2u_aty-cG@auh+D?uzbncqt(Xxj8$nFQB#47> z12-IRIrxaS%O2?pyeV+wc(c&?EAeQblVea&PG^CSXgfK=WGV3IZ4voVdP#4m5|4D% z$jeFi_TgO{f|sYjqyC)ZtpTCL`xWd1wGS@0og#s`6L`FR*kI>)b3^c+fIW?ckba1d zOfCqb?PP(uPl1;NJNZ$1n?urjSPlm-W{8i>iy`U#l_I?<@aK4shTt8A$5e(O{ct=_ z2%b-YN9o~s@1y=I^Y0Qo2Fkxb%k9Q4$MqXUdg<*Q$D{8llz1A*F;M$>H3aW>3OqW; z&GACd6}8IglEq+rM2DU$`m-Xv^bU;U9YVcV%J)0qDc?2{ADK77N3@+RFkK3~TVUsS z*I=Ti#JdE%f$}c`d`i5}6zO#+@IFR(C7uT1sK4cg%Xd=F2fOT{L1p9hc?R6Le7^^+ z#EX~Zkb^NkqTBGNly401sQyxanl1a0eG~qacnQE84>xYOe7}N&5-&l4H&gZ_ywGzU zbRL^y5GJRo4^!eLEAVLiB0s{TGeJuEZU^2#{R_*|l0)zoDDeIhI9$FJ5RT-dxiy(55pIb@vS0F}KYrei zdwmN&r6C?N-=JM8&l@a3yyQpqfDGp&ojqtGz2*||407A&^A}nd(9&*gIdtvH_sU=G zyg^zTzf}I}=M9cVOVKB@M*`+CB3;IezaZ^Xx&05$Odsk~S-tHak5p;n1pUbU*TXe9 zGkv5-W%aecFli08Ayt{VIG&(S$n;lfC(>U0%=CE4JEK7M_Na)k`y925H9gbs&KZL} zT42!zpa~GX1EUWvh|Ur5TG0Tie^hX|GRnL<<1ZjW{)cT}@5#NV6v#JCt;> zu+LU`am!=_eX^G(2>pOKQ+*xnT0m)^~H^xiW{$=|$P z>?cGi3GpxqK^a2{>&+Zsn>MT2CMRt`o?yWjg)Mu4JB1V8t=P|IiOQe?nNG>xz9F_z z8zmJ~1Cle!LS8IKWL^VvSO{MIg#8}}!6e5Vk`FgX`LHcUti0Hl8Ka__nsoY6xOAye zXWiZYLaZ)ody@`UeIgehIQnT^&d_rq4q=5#KLQ!8*ZH)_@)t(uBOWcPSnOJRu4QJz zX`dDc8R#~_MqA}~+g{W}t<~boUE)k2P80)SYmqHd9*7<-%LA&E+I*G+l%svQN%HI% zL>|g;_|sVx$ds0z0jQ-JNrk)|!&tT3oZ4HCtTJun4%s;()|44N^gzNkXP64`lVyzLs1@V>kAQfzkd@N&u&A(i>j#C z^p&Ul-D zYjTTaI7^^71AyCsBg5DkfQ2}`F*Rx)4sV3v+=O0bN(-MgLO&Ym3lo|qnjX+nVx=Ql zxyD&DO|J^vbG~V^)}!?sSrXj1m=D`TC&J2yALRRX{|$;ykf}Q{ zW^;4(GYj;VuFqU~{{fBeeMZf`%v9P(_1-_Q0?w*_vsijZNpB_kjQR?HOP?pG|H+vI zC4gF>RaBq3@_T>fDuCj12rr2ee-|Fnm~l;z^N;2?(Rd>xZ&@-X%8ff^{t3)KLbzFx z-{dcQ_wv)bAu?|KMMHCsRkmNx>_de|f;sc#=U|fXyUC%lw(lKC<^cBE4^l z7Gj0-a)gq7T<>=@^O*lc;aQqQ!qEJf&Ln(-`5PI@euHqnpMR3@t{mS(;E5J)60Vo| zmoj^ruu-;4^4=oQS#fSC{S6`caa)L;);eU~#~+k6C=k9 zQV_`jhWJF92(I55205;5a*rSm$qagiLCyzdyi877Y``!%LHEXMk=$9lLnNAh zMWy>SgSgX+XW57Z3^N~p{mw89AP=q2_!$P4&qjqj1MoBX<+(kRA9Sz$2^6bj7bi(H zE8ocyP08kEM>PMIe~L^KPL52I|9XY{uVk9={4z~E|0UDpzFR?eDCmC27TAJ^pIe}< z^;I~&K-*KwUA2BYT2hEBH|>9rsc&;m3a;GP@3&FU_SdfD;hX=1?Y2rGuseG%7H}mi z7MCu$XXSmR#ijRzeo8xlls^#a%6&R1qH^cj#YJn1i+>Efg7+#%7bI+UGGV|CQHB2? z`|1*h;?%(p;7DA9rBFI_Fqp4&&frIG_De$b?dAV~Onpp)#T>em{{vv5tb;*H2XaEW ze*k#k0E5Bbd-r`f3LqWO_@SL*DVql19t@a$0gM=6?0=bd?SoDF| z2ZLU7Uvc`67W+!(!C*_BDL)!j$=m-#$6)AmR)hB+sHuxrmp*V$uY=+=!(id>EnRZ; zG9o4(iQ=pSs~y*0sd{a&4srE;_m=6aJU1c;KCPl5 zn`rJOy$2%>$?!4rc`$|Y(OAX}=c^9kn+}F9&V(oDs{$Xn`umUe0G~wZOe=pu$A$Y5R=a$3JgX1j-!J{(| z9FL}M#7A;W4#A^&Kdm9S;dt(l@`y(`9cRLm^Q{LT(RSI7&K}U5jM72#cph(I2p*kn zpt(Oc9Pg(gcyv~P$9EOJ~VUq=WY?PU&>e{Y1~@iPE~ zH%@^^cOHSYw?Fs{cskg*;pwIO_>}U|8310d#)FysNInAyCEj`9(Hfl_;v*9Uf@nKg zU}(>twvz>h z_Sh*r;Z4CG`H}taNS`vjOXP6yVutw0(B8BXuS9`24gMVO&yoX>PNWQ%xc>D|i`kbM_`%MU*0eBA$fcIPoUWWqjCIwzqNd7%BhMiQYq%3_mpu$93@d0VUkCoU ze8)rZsN;HH4nq%)cO(SQ4!q^?C%hRlAC>nj_#^o!E;8=}Z;3>*U-F~BT)Eu1*UdCZ zQyAhQ6ODM4d(Jf9B}4I&;e2m`50Jga4!m|b4nFQvJ{37v-;X8tOW_JVsN4nASRCmaU3(7EM=|TJ)N)Q-`frElqxKf0BSbB>JE| z?&ZIX?VjENeJ(v-$0TvRDx)eL3UAw-w?3S&Qx)mNIGtc_aCAYp@JylIZS+;uK=ReFPFjIX~*6g*rl6TyCM}k;lNv~S^YJTiP znPGyrYH4d&QJ9#6=B{=7FS#BvxEdS_j9vIL9dSKmw6d6L8qLf_oc`w>8jrRwQikm5G$cjML;X7W_{Sg_KNw!&z*ztPZT-|!z z1EgN2_~6LcZT=TlN9|r4tAAi0J`9gtTYOlv|GVJ&$hD^Bt6pe-;LR4je5JtalMVV0 zwmlWqq8BGTF@7|+VYfMKWampD(4m<)>9oO zz`r12C{6~rw$qowUDyP>@fy7@HY;}R(p^zGCxUw2&ARF&VZBx#WlD~+Kkm>k^Vhju z-gf;usDuUi^SYYH9a}w#FaO17GcAnBbu?Nw>{jicARLJ>jfiLy^_nsFPCtGmVuj{r z&9_Fp2zMX)dc!TFH{qm$&R*l9jY514?-OG0fMUi^F7F>M_>+tiw`yXua6JL)MX6m3adFOZD|C>}L6PW3;+%sOrxWIg*q54ec&;wz^I+^@?PtNnIjWlu z&(&6+2|gNib5yRQS|#K{ab&Al^Q-ooqr94F>apEOJnj>qy8B~Hs*^s*HRY3LoGvYt z|7cqLF6hf;T1t)ugLAHtGO*xA4LDi?nmd102F`GNSFRpB)SbUZ8j-$&4+s~b=I9Z` z^r@g9L4n|>73gDMeYmNJw6NrS7c`qQSu;1|Lymiw;5!}jefO-s@5U?c`S0b!HFf>? zWIX_pLVWJZf(=EB_WohS`wf2_FC;*!>4D+Lr5* zgOBc8o-WKdbNiN;^JX7&?0(X=C~C{C*(GZV06o7v@rIm?6{QuKcRL-6Zoh9?MRNY? zjJt2mnp3nYduDoRT1npQ)obt0S+aU%>fHHjXWf=J<+ime)+Rf$^Hvqyde8lLWZ$1Z zuc)kGZo$2Cman}TBh0^Ho3KLcs|Ej)Jwm#>hm0M6B1SDb|4n8g{zQDotTbvtv7rDD zb-z)L>_*|IiU8ENe=ggtz@_hc8$$dO<@j98KSFpa#Q**fJIyo5c=1Pja5PWhdo38& zdiS5qGEHM8y%(WIJD+ zvhfX#-dBD1EtZ+kNi4p*#97X+cKz?(^m%tL4Em78_dA!b;rDs=dnwr$)xAqNL+A_d zfp`W2VV%`gKzezk%Oz!K>ILzMBwgHjr8|Q3&W?oZulO)a3IJ!@^|XHZv4-9UQvKp) z8S0!LZrpH^p7clUii|Xel4$xxRbu8t{D$($O^o?-zJI_*w4J%)2f)NfYkQK1{K)6xBreOOv+hJH4}?x1_7aGdIZsx{6Os{(X~5nMaM;oKM}#l$Axh>1Pd#brdV2&031 z$gct7p*SfnI?tAtUgC@1^2+?m4wu)zBVxknA-=ecb*&LmTiqR(OmBT}UA7uR&{;*q zc2}h7Ni~G{PVCyxM4;n<1B$RPt~6R7zF$RiaCYqurGQ;Kqew92V^~`BYR@oJy1L6} z+^bt3F(KCA8TWt(kvHn19;rQW$@IYY9<>*#-qkAI(}gHkM4C)$?NFR-TM=ejpvIkE z$aUn3o*h~vN%w~fzPJaPnmz60EZB z1%uZi&7SCHk8#5*<}p34UmC2BJL-c$oHJ~U+q%^k(YvZiFvv&Vq_WZvpZS`m@=#8+ zV7v{fgB&IcX`d;NUVfR=Y`nUnZ!uC z>48f*bgG!0E@kqV64bspy$T2Xpmwz8Z~oImj=yETtP+OWyH;)TuQe2WBE$xZ-#Ht5 zc<+!6PoF^Oi&OfKi}vY=jfM>y*Y|==eHnl9^?+G0m1#o7nN^T zj@r_y%E=b=5q0%-o6y**8jzGvhfFG)dc0}gM7$W#ZCt|Z=K9D9uc)eRbgp)7t7?Cm zps#RkG3a%Zj2lLY`jM+1cWi941%tU|J2YKt)a1B;xnO*hK6Zzu&DrZPJhCy~6GK&o zPLuAX>g|bNsPj4NG^Q=XqBb}9gZdZs%TI(oaOTTvgj4Sv^{+JSN)J%J?_9%?@4=Ap?7De>K=J||U@Ik>l!HTlh5sed(IIzOQwEfG<9&b1(ZAWl{xPO1J^0(D* zUb(bJJ*yaIdQamS=i1;$58=}lGzoYj<0b}kpoThL9lHyt>`tu}kp-{QrDk&P1M7Zu z$2h8wQ6Iwj1hrhfc7Ftx%2FRCH|65qrmTfK^sAx@#FgsSNllnlQS=$^fZ(-JK8X6U z?^}32821GfQ7T#juh~~VQ%|zGj+(Bn+y_P6RkNI>WqO@{g#P?p;c3a@T{?Znitw}y zafPn0EeTq?-?d2yv%6fIZt|@188&(sRBd=I+*gJ!$BmY$^X~M{^VaK4rJFpe3A&$G zIMFz?7IZzP)-ZjNkGNk$9FpRxn)U$);tb$^Kfh?rBsaat}#ak`e!k+97%FvPZe<}~c4Jzvo z`6<%TS4VH$IOZE)baS0?L))lTjRyHeuIpjP*4Ey<*{xl*+JFJ=^*5}Z=nb#O`r>MQ z{@R0=x?V8){e|1xTBF(`V2$!@NIhrjz)V9inCodmM4={5)vfZhBj{%T-pGy!VT4`y zTYd9ha~ln&?aiBJ*ToihL?1}~XK#CCX)!$oJmldKnq5gZ6~g^dRpUs#>KT=3x9Cf# z*-FB+MijgykQCbsCI_EUVeoqql?-oth%X&7K+N%ERpk{jsQZrc$wU+@TYlLry0gI(zz>Pj3F}zQdQ^`~64LqG*Kt z@5r%tP&xLJ9D5^cUNoCNRd3m&PSB0*-qoh{s9om5vE8leMjbvz*&M5`e5<)l5^9~; zF>d$a4t;0BZix2Y^wCJtfxRF3iQlyBvR=RIrDK&}qIEg89g|CRNFBytaHn)s<@W zj7Kkjqt6$C{yy=IOHsuI+Mre=G+7+1f7f>M=JM5A~-r3 zT8ii+aT2L@*xEhSmCJaRLq`2rRu1yV9Na^Z5b%_!^QzrGO^wH0`R#_L;mQC7+tsCj z-mhnKc{Te02L9_KH_sPoaAhBI6fDAIY{Qm!^(O6k8gezPS;=3z6&4m&pOteEaaCSc z!YkzAbx9gmsV-f9X2{GPtTz4Fkri{t^%}jlG*G%zA2X}IbW>^7tg^IPV`3nIVpaD} zPloOd-&H%TJTQiw!Q4J7q@kEK!cV{@cL@Th$nSCiZ0z(;Rk4S_LbsB_^M zb`$VRvq(i%_-~P^Rbryk$Tl(D9fI3AQ9mrvIU&(GULRiWv@osoEggar`5V@S%SUgF zDR+)5cg7_;E#*#gx%0Y2=e6a|vE|M&iO$$^=jd|hs6^*TcOcj89HCElJ57mBRuMI9 z9$wkAEkU*4j@NL8N#|Ic4GbIg5qlhw1ufAHfeLUk%PC{&NkoGPJTX&R8v@HQfx#pn zY?%hw^d`*fm^FWBgJrDSGKN|r8WWAVZp+wpx+2V7S;#_(@3_8nQ;X%g28$VNV8X&{ ztHFsYi$O?m zg`@y}^TjAc>-weNr^6k`I_|#@DT?eo<_RE1OqGf*$Y4xfGi_!D|eTT`~uIUiic?{AX6XazTVmbRQWWTw%4p*SQ zX>7M^ot5(=K9<49zoXoiET&UmGMuV z*DI&RijBuQ9jD7KYmtA*tLOYR&-j}neDhwvUQ@g8yf31`GNLZBc3+P#qHeTLTQ~WG z=jy5eFXyObYTF$wy!-Mj6UJ00`08DC81#EeB5Ez8OCuV0x;FYf zI`1f{bUG*`suDU~R(s0-1$#^2cBv5cx@`%Yy%w;RRJp2=F6LPwvF zQe2*s685Q+u($R`^<@_ihp6;p_eS!Fiv9sfa&7<*!xx8+#+KpTfW_yezd>MuwQEGl|^H_{Z0OsLzncCWAw*@!P8N~7<Ix#h$2@zhW^ZJ*AoyQx?@(`*W~z zh;r6#>ve8twA(qUB~apEUA;!A-1qTlRnFalXS@e^xb8@+J zQob`G-#M||IU(O^%6ASgcgEy9N98+5mODo@1WKmsdB5nk3~Nki9SJmd!*knOwfd#4 zCv(Da!@(D=C%3g~^z$*doYOHGx{4*I2I56(x;HI&&quxt=Ur$uwW(%D4aX37iT(`SXbc<-frt;nq&il~(xES56t+@oYfPuZWMhRCm76HRJoO?_k zTx*pAE-LG;@PZG&Lsecda;nZ-Rc?uXl5Kixnjy4)P z<3f;+gROzsJw9i%x1C-!Z>(>$_#4el7SFu4z^+lMoWBP>POmK;S<6x14@kI~#|Opr z*f3GD75FYmp^m6KEmD|h{orBBe1SSk&c2{0V9E{GtIKfhear$m-Xmcr)Loe5qLpDZ z9wap$OE+HgTk_CRHOjfr;W(j@!j)?V4;O&6fr9jJ!NIFfi^b4U&lZ-RV-s}4k)e$z zSy}2;>5iPp;LTy$h#(clNYlvgS)q7v5e1!LO1NCv<93b)7F(|Y=m;(CFzs`Hm($G# zK#XBMF{k4@hjm~h!!u!_jq7TlDo)IDH;*%6^j5NG*lFS$Kg;2@VRyp;oelwZkBNen zjRC-2XpDLY>vtV$Prg6s#PUvuT5Uw`=N&Szr3o};Y!u!~irqj;4!Zh{uy}t@TbNfE zti@(IuolBAOg~~>RcTqNbKSg#fZ2gICa-laU^*Vt>OeeL291ZsjNT3%Sd$Izc$y-I zG>Nk;lZ@-C*3DxtpVu8*hqWCTTLM;$4>SgUszU~N9hM;a2|7x5B(imrX|~W<-vzxS z3(Z2ps)&2H$Ojn|k#^BeSim=5U#C>v^JlG8iK^^pZ>VrO(mJl>X3xqTjXnO>@d zzH_{y@MQrF+@aYfF!BImVkzlY8E&{z>;xPa*b-cHj@VyxRa28%DW z1h;ck5tf6_5m*TpIftXicRPm_(Nx3ic3wvy7<}lJulJ<)SZM%nylJ)X^p;_pC{V#< zl_!G*`Ol~?GdFHvDzxLl{Y1`i&u2)_BoOO;GYP`lt#5)|!mFXQ$BF)3Ge2B&h0_%W`a~UTW9?J-1>|9u%u_>c! zVOfSV1FDD`0t?1O1%fpAp!nBEI)cH1G&HR_%#}G6q@i@}N;_(8a!X*rzJMKdU+S&C zK}L`1<1uZ~m}-T3jF90NWo|~pUEmbxTr7~;uburSv)=^vJBIxl@SFEbgJ}UfM~f*D z&e5X3f@Yn1gs0*}%wtd@*a!eTT=XMyKEe>howviG`k!>{7Jln6purI;~c<|3FYbta?8` zXDkOo_RK+~dOBi!#vz9(7mR1&&Fy;(BLKI=nOHyiC z_9IW&U=fanMJa-vDP#&iZHiM}3B3C=$xX`39Gt%IgD;4@SQQLDQc{IJ%?8R#@8-Os zdw)+WW^u_(1Pn_{Pr3JBB9{d2GV>%#wcf;va)l8?3`?CqHRWEYH~_W zmMv>WN_uK`YKAR6*^!g%NU~*TrR1a}WoIO1rsN=Kjw9KYnr=-`P0MuHY*rgSlt@m_ z$xh2iNz6`6v85#?rKP1?XJlHlGSjWusWyirJ8edKR@RKv87VVT9geK*%%o)er8^RH zlC4=O*{MQiVs=_~PF7NyH7zAGBgdMQlarC2F(Yk8iZumtS(B2p5*6z(3Oii7Un2{}5t*NOFTSmGqJ#~gHeTL1NnV6H3ot2T9l9-s5 zlIX}tPqJpFW@Ok>vs02%W~Ap>lhabL07yq3CMP*kGLkb>GqbZ2(;Uc}tR!1jvLhui z2fh%|k)D$xq*@alnQ7TGz?$Yr%1X^lNu@Llw&qBF494V=(Ntwt9TUKTU zwrxggN={mOc1o%v6J?xjOUz1|VNJ@&Om|ol5r1|{MpBM7Gcz*_&^fm389AwGX*LvL zPP#Q21u?_sNV2BPaO9xWGjnW7*7P*wM(T`ITUK@oYK9e6!T~jqX^s?IwqQ2T&6~x} z+MCDO%n2*jEMJVz_9tC=@LotvNk!F5N=mgN%_)hHG%*pml$@5FW<@z>I5Luj)Kpti zPGYJp6~&d5m6M#Fo}DoxD>;3}3|ms-j5LSUF(V^sMjBE~skUY$W+!J;y-7<#eMWg_ zWM`*Xv#hBpX*1H&a+1=LvoowoGqO-|XQU=4_7gVIobdlK_a)#_6)2Hg3dh67B>)u;SUg34h*g-=_r^1BM z8AFDor4AXIGCV6SJr%{CJ~}HUO=Q;ap`!+I54tf!QPWeih7X2mnW(6l85x7Kh7U>` zl9e_%YiP!xQK)yRDPvMoGE#<*$w*1h$V?v=5b+>)a{jX78S@t8F_%(O1|d}$qqDM5 zwbKWW8I>|DD}BuH(W8cr9+WvIYsjcUS(zEb&_0I_8agN=6^(B=GG}zgsI;uC^ueP? zjT(Y-9fk%lYH(J{@X;wKw9zSywI}QvC`};(A8ueZhB*I3I5yr2SH_{t`D^$%kq z#fo1C&Rf$d*xqJpZ!J7I0qo_p!-(wZFQ2c<55=(dTD1n1;| zk44AxzRZ8lSC7TXWv68Pa0>mukpY$A;@)}ha{@o8FRoauWa0VlB$iJsR%72I!>0&$ z4`Y^ev!=#kSLrXMeQYVQhTE8czD^PC8!p{3;A4$mM!rmcoN%9OI7TI$nFQoljy zPdDDM$lsIsNl?beHS45WT(MZuq}KhK_U0Rx$^0|j^9=4QPhw9Ui(N)4Wd08p`MbpM zSjw|P+H2~sGG3MXH;M48*(vym_IxDWYhYKb;WMt1`9&ql_ey(}n`_1uQNC5Cmun?r zjcVg@OMSdcx-WoktZ|p&vf!VR@=Jxh)`*pOOJP^6ai1~RQos6G^7j&%UQ8i@K5He~ zv|N10qOpw-ULq}ATSwxWG4hlP9WJ~BF{^Cy7RG244%4Y{n0&S7j%|=UG5SlM7>tts z#K@F9F+^M!fdPrQWV|9S8Lx;-+E4s|cnJVv*{Zd50w4aw;N4NJo8vka^2C@Uc^TZW zdEo(~+osziZD8AsLqaJRYw={6&z1i8G1uS0pXnee9D(T-UWUjkS-xk%OYKwHnY>mH zRM<=CuK>Z@=mDZ?z@C-5zg9nNtVEzT>GBG1kw>=iCNJ{&Y?Bx393`e3UN%-%kjQ7* zzc6dKZwvENx3gCtM=4U%WsHA;h~@P2(36iC#6-Vh|&t~MFrAFq62vtC9)Y!>=mP5os2 z#DQmAvn9{8kZjYkCx+;|;7^Rz(w}ybRGk<7m1=bK zpC!Zs%SK~C!k&DS7j=M{0ZPUd2cGe!NuIi-0Q_@IKi!{Rac<4Oz5Mi=IwBur+ZSz3 zwj*Xi95VwXY><3C-1MhyuSuS^eI|M0CD}|Jf1b#)W|)AqXTSp_Y>?$8Z14(iv%SlD zDBAlqra!Y))hjo776>Q_mu-|_MINgDc>w*-HvLn`%QOxqFYk|iz{mA8byzLP)7~=4 zGmQ^Pp7x5gLx=YMDE&p#W7^?Qd%4b^JmbGX@(f!od4_#N^2C2m^0e`&w;2^*Wp1Ol1 zPhBxS;f+F40H!QErr9>nRA8EIUXy2jsrD|)SJnYhzOo$M)Vapgrzy4~lV>_@{Y{?v zYa3|t%sU%z0w7VovfR_*R^`s|cN_~Gvk z+y5;68P7?{)82DgF3@3`vLx>Yf2HK9BgzpvOw*UrpK03eFvBuU+hHJa$S*|aLZ0a( z*%p|;>_+4InLPh1f5sh0KuNY@lVO^9XaNbs3nPv<98e4{@|2TQ843L{rXTY~l{NE4 zwMXWQP4;P`Ol8^829^Kxk7GhWLvWENc8=tUE&5pa6OYNGjtjpI<}G+)bd@~ID_!!8 zhZJy+W+8)!6_+YlvDYSfe;Oy5{vwU?-b!5C64PJU%#IMm>K+H4y6KXqE=lEyz$r2P z1Wu93i+sy4d8SA8S0dl0oBoVTwLv}KSe4`0_(02Wk!L)Ol4m>zB+qz$l04%{Vg5j$ zcylDrIOj>8agsQuV)+aECkQX|J_Y|OIEDS-*$#yLg{F?MAO4HsFYE_@1?sY}pT>gR zxK#cmk%!Ja=p;*i3HSlzC*mI{1s8Qz!GEyiw}4NVJfA;Dl4rvOd2vy{2mG@nza0En z@=Ng##3WJYR`@d-@;`u|B6;?m)5s6QKhQO}R2j`AFUvHKJUu{ja1p0J!WKz>IQU}n z@?Nu8`p#o*(ZAW$YQ^6(b>3y^1?O_lyEQ#L31Gw($o1>Oa|T>8i1ca!89|9z5Y z{BKHrF@E2Zyc@qCNuFi(AIT@-H9ky_=(`ThpfWqITYll!2c4-v)m>~p5-=4 z@-x9_OFj?$qmpMDcT0W_c)3S&z+NZZ?%CX+dsgB6oD%GjAFyk^+Qp?EwKh;C`8j!N z)BX05+G@1{%3Z+y`rEZdh}EwCZTF0)xwA_aEIkc^DQ3LwWy_-cqJkOR%H=dDR-HEK z;ODOPj})Mtff{W9a_1GF0U%JL4FJCmp5B5$jkW*_@=O5hMmn?}pS3jfHeqw}ba60% zK#ev4iwE01 zf7+^{YqSBMtpI|h$uA5Zx%`wlW6^?w(^(LphQ$h$=U;o;@TS6Zg;+I?;-Z|z1q({%%~+9NvOpX#l0R?Wg6q@eovm8I@GOdYRASg*S_YHaNJL0Y(B9c8v|5t|GeU^lL?APz zy{KoYY-*EuIR)u7wMl8{amo=yK=H$Lc5fy5ZO(krBsz%5Gt~M36s@nr0O2%dQL4~# zbBc-gU&0;F=otIf{re)a1iYIZ|=i*5)ZL> z-1bwg7w-@|_??)?VG^H1$%jcd9`yn!M7qufm{kv-dHkgGxUamf$LG%ozn1y@P3Nu9 zV;C5^2hlh^$1MpON#7Y_M;92B4o?$oV`B?FK15DQ& z0KH)K)D1m7-lVkFdfG*cH`0PP7w&V0H`aoe1-uvq zCiUp-V8L6X;q{VwOvg27^tyf1+Oh9S=;`)VYIuAJyF%70e*aPSeHa;--rIo3`E806-Vx}L_e#M@;H?2qy#BZp zo&#a^{Np(r>{k>iyx*XtW`tf#K%3~(* z+zL$U(fOpMJVG!)m>ukC2k3{Dj ztbgukx$i#@Jl-#9-*64@D@%RO0vPjGk+ScYr9Qu_;qeoLvTwBIKC=vX%m+mZ&kH^B zUMcticuC-C--Wmop2vc>26$s+82%`{L<1OzV(@x>*$+JY`AOj|fDd`E zl#B(Q%D)ULW4b2c((&E|Sg`z?Aj5d^OPZ$i^Jg;2OzvIAD7{pQhT1$OCuBDfCPT>_<@O}VZJb@%ByxA7KlN#O?&{cS) zV08POs26J$nAD?l6zaLIcN_HTgXryplCC#W_Df1t*~jm4ublpXP`$LytqiyG`t0HEBop!cpHE>P=ql5sr24$!OPR|7HW8_E%oIY z;00?RD=qb<7156yvEq3w zcs~HIUg9m)@WL&4BZ0^DEQ%Csx8U8CZWxE5MEf|0L)o_)Y17+peP>f<#pC-2hVe?l zVhkcx{ktB13U8JL?_uBtE8poByiyHsm4>&^lHPZL7p(p6v7~nc@REST^!{1HyVrtu z40ty|u88R%-DAOP(C}76uF`w4r9Ky<@+l1BD89EvZ!z>1Q$do_b6e{Dn_9lCfiCr! z{(m_F%k3EOSf3RsynjNEyjKd200acsnh4K1{&e4<+LH za4Ebj%ebi?FH;l-F%^HYW!y9c4-=|hRcLqvEqD(DuNQ$NDZFG0-b@W|19X*r*@y&H z(Eon-U_16rf*!+oagmBNyj$Q_co$pn-UMDB5yJeZ>>FXhTc+VvYIs*8fNtMO;Gs(T zN#RWeL*6STYk;SoQ>x%c8KN|@!031(3BljPU2MU-OT)WO!>hHVcO>xKkSk)mq&qF? zeH?gG;LrMU2QFpbO%}XsfX8)MiWFX{1up`XekPQNSB*>I-5M5{-un`R=ie>RV;C)Gb zegCxJ{Q$g6{b;5hoo`t1p3(4XAy;^jmh$kP6})^yEah<&cr$@R`|32j&oK_x>)%Y^ zab27umEMn`N8T$1-V0mt?t`DQ?;?Qdc!%A=-`@|1l8#pkJkCF*eGh1OXIbzjdJKc> z@Dve))XjnyftL%MPftAdtIEFq7&pM%e|}SZ62^oI1pbuqnh!tzs;HJFo8=2HK`Mwk zf0*wyNOwUm&t%1ah4-E8C;g(ne$KB)rVpOi^mCbNy+SO~L5_GNj&GH1!UK2>GLCf0 zak+4vpW+T6-D&dX|Dl5i3%%5oAw$yzcjj}M8qgPz28;j6#+9aZr9(4}JF0BX=#7}N z`gy|or$%(D+?e5h*|jGk{^W0C(4Ha&s@+hj8~<+yPCmM~w&BK@vSxSmp!i-6Y_(d} zd~{n?b>#Nw_+7u4K=*Eg6-cyAE`S|LwPfl{3Sz<$?XIoY31xehijfmh`LSLyzk(j&H}1Mb>~-CHBZKLos| z8Xwm-bQN*cJFrEL*u?zFq`2|7MnCS1XpSu1;2vKSy*vAY7Ljmg*W$S;$d~OAMxt!IaTA{x&-{u&hX_wwLa5H9KneyBeNx@3Q0g zqDDvQZdc`mCbPxh^cmi2u%Eo_GPf z%-yWxf3!Qp6MZXR<_4OjuehFm^APG=qSrXErSe~{cMcuvaCE=>Vf=c=Km^tkXRi&A0__p;YV|0oOULQTmEuGyZDcdiEEoG9%Md-9AILLMd2+) z;XU~Oy70{NCTK14=ID(vcSl^Ao_crax+ex4ygde|v%HGaSyrw)5?cG2tKpREm+ww= zGCF#XAKlpWwJUpm$oiUuBX3oIcz0<0aBR$2 zU)dN_abM{RO=6GZJ>f`NV6M@IMKM=C6<-V;o|Pqb0la!m@z|#6;n*N;=@b1lvwXqL zy2T;P+Vo-k3-;*SoDodLfruj!wOUosZVXpx`36{p)atx1-1Jj^3X=pk>&u4(_eB z+TjWD58C4wp>5)*1^2By%flJf7-@ui8=5w`}joIs_Zy|6zAV zI(yt4+32WP-yHJF;kWGvqSjq#I}mv!>Zx?>-~Y}AoDPvSzGw8*_|e9TKjM^Qf1kqg z^f#7|h?8)0BpS+>u4a41yPtpcnf>PIw=S~X9QjrBOBdR{iu~LMsGiYT@ma=NKM-v| zBM>$mbCf>YbU5VTt4%M{ii=>y%~5Y%0EAZu((rLN+pUyk|WW}Ybf z<%Scn(1`VGd@3}2rbd#f(GwaygKG>nHPWDw7F;9C)X0QJW^j!urp9DwOb)J*XKKuX z#;o8Pi%pFZXp{ug@MS*l?zzv6sx#s1%Ey}GKSxLJJS#AhIxv%*(>pMeoMtBZ(7|Ql zq?b!i;V{0GnkHutXY^rv1&TJI=0Ma_-E9Y=Q9>x==HCC9dcF1vPp$Id|~BVniu+<uDJK}ifp7Gmo z=ehP24$-!uRU@!7va~#S74`hIyd9Q6D8AkI^{he2j_Qf51q&RK)~rt%a`Kr^U8}!hWDkTFWa2cP_z@@Td7yoLjG5V}*BCoh)%|tdt`O%Oe4(hS{f6u`43sDQ zOl~Z1HroPn}iOv*$Q*!g>DZY{zl&|4HYp}9#2({3;0`i z5Uj8@hO7KBjAIPgD;)d6#yXR0HkQ`p)~q(VdyNOSRC!!mC-EGooS5nm=cTnZGG%V-io4Pg=HcVEBRXX*+!1R)6sF4q#U0bgnTG>$hOH(5OS6 z*kc<{nMX|2PpV$HsjDseLEjtAJHXr=Svs|;_6au*ZevR|qP*B3y!s7nOMSd5rZU-` zu-~_OU7|g^f7q_ntr=JCaE7kp(KH-8A!%2}#bY1ytDDPeTT0(y+phD(?i72T&z+jE zbm^^cwn-x`+UJSUO>)`~*r)BN&uC0t6~#1Uum9eEKmO6idtsx)yS}O1esk0%y!(mU z=G4m~cn3bwa&ri~S=7awaiT)}V@7p^yRUn^54ZI}EoKLUzQDJ)P~S0|E&D+Dkx&$y zHsBq)ntNww6sBS?^%!3&_sn*g{f(nl@qb`nwsJgQDQdefoA%HQC5QhFmKnlf;Kja1 zXWpkRPSYkH-+r`G+kM*HtwL}P@iwB>%OO_o>F$B84xw*8#VJpRSWT&1#KQ{&jU0wo zb5TCp;vR2tU+$j=*$0wXJfYqsvn*SD50sB97PHLo3c*hzK3V>CLVmXK zf{g#q!rjw&R)$|A+Nl{AW_nVMX6e2icE;k3 z#TU>cvE;aqmioT%zHko}=Q2}HqP=S@`E{<0Psw*!YZrYz^{KKL@Ri>u{%7Oc8JxoJD18~J+_ZYrABC)2&;w@P(Szf(_ z`!ZvhbSDY-B!ll=)qYF;$V+=;$ZKh{$)-auTX*~eF)O(L5Q*`VS3zv@y#}*``w1yh zVTHd;3uS6eHth=7TZj_@K_XtaV9hn+vMazVf3fEf<$sVo(?n93^TEgAosc5s&pEE# z`$v)TXY%6k?vKP4sCc@S{mdq{e~<9j?Zo>l675j=!0d=)gdj|B6FhBxL-Kx``@;hy z(#uQ*2^`tg&@9_|!rRRMPA1Rqpxlp#;oOpExKzo@ zF?nG_lF17jdYC-hh>ekeSR`?*IG{ne$P;6zP{$vyjEh+rhi_(zY|@{15w-VE zdkYD~5`f&I6~=kN7F779YS}Q?NSqc5>kRVe=N0D6pRstsj5!Oq5V&37Ai8bVV5lVu z=7Lu1s#GlM<6?v*SgSju2vG$O9~F&$!+(Kuy`)W^H5erJ*7$iiPGjEkpeE;&&|IY()uJ=-FyJ&4ygJ*2OlFfF}0#PHEAc|H{ft zQJQ9#kbj0nh;3ArIW*C~MlxV=Upwn(1rnDj7OI7R?Pf=SR`87Vua-MQ&9~?U2U82| z&VUuD795Ie?9JXIZN`%MTpxX=KBV0c!6Wdm)jNZ+7QNtL=9al;XPJS(xr;Fm*k zH3SZPLNv!mRP_YW<2Xo>;)$c<@jGQ7rG#IlM;-EBT%=kIb~yIob0YnD(Y+Fh(D7zU z8GZyQygym=@*pLaBBjT*MC83v@URvyvxhRqy8@RU?=w<{A3+Ll5?s1o6WlpM!~Cc8 zCcvr3+o;9Mp}&gPhG!HVkNb>qe5gp_odl!fJr6uS0x`|BU*WwCM#mcf2cO*(QIGT{ z81h~^K<{dJd@P`hxPvVD%9+}4Ugrl@IJECm;J!YSH?*_I=R2Nj+dh0@li?P+0Y1d`?zM1<*tZ& zq>~o=MgmXOzeLCt-VsZBy}+vz2xNw6ZL;7U10LV?C{p%SS@70qcs-%4@Sd=wcaE&LR=fsFdMh=&Bn_|9f>#8* zH404X(YfA&cbA6ON9wU0A4B2l<$Jsx`?xnH)8xfPs@L$6;a2JWiv{lo;H?%R%zxA) zaX)b#?{VO%`ohOpg*V?)|CT{8LLiv`6dw0M1f;(mJr04AQB(0;qe0$FPtblX9eia$ z8S{nbQRsM$5R8JqB84~3f_GTMJ0HplZ<8e*?5~6MyZbD9>A>f^Kt(FvkKv))cM#>R zzui@Ov%u(j2JnNm-|5g}7_W@zBcvkaU*O_SX2lAlr=>VM!Z+$Mn%Ymb1dEv*2anX8ttfid1^bOD*276e+yUV90x=paFQai}ulvGTQs2#XjzjUIl+e3QzSDUMcue!^?!9!sFa> z-M)I@1*`WHP)@quNA0BJ66opaNX9r;rDL=fZ?XmN1n~F{T9HaeFAH9thIfgE_W*d^ zz6fO200k!X=uEeycQEu=Zi-aAJz$HDHvxJ|MqR~sfgX7;Jwdgw52~Wv_^y{Sy1%o; zI}x6};IByGeFZ%ok81)H-epi$cnd7{Eryc9Ag1EyTI_4o@GjTzMqBWf0WXO_k`$iT zg7>_JHwn7bqrETSV*arYAl(JeJd+jwDdY7#0`S*Q9sHbNl>Rn9yIbHD5$&1bV@yfZhg!*|$K zn6$BS-@4mzzBoS=n-l8dR~Wv|~hoTE~46Q+i2O78$Uf{4i)@jV>#!r{h*lcPLQk*B@K|Hr_j1_C+L z%hNEaVde8s7js=!g$%^Z#`;M|Ux)$T9!^t4n4JO-{Jik&9>4lL<(bZqaUN%U*k_j1 zAkV71tZa_&8&V&;Y4e5koi}YxuaDcbdC>9l7#uoX?{TYZ<6`yQ<6PS`lYb`l5?2zP`Z)LZ8`w&ra69P)g+ zy|Ifg4z(u1J|-14<*9D=G3Og%W-H+0`$gCDP-3vFqF^|dEg}b^;yaZ+KA0U}H%%XiqpAxf_7&Cmg^VeU6|EqZh zeP3L4?7EuHqD(MVAq3?@NY1uTE`E~W(i4@{0gVwR!bRCMO~ z5x5C!snUMlTVsvR#!VLeSEQTIWIT85kP3`n zhX2;$<{2}JD7RVc>tl%@4Or0I_#bN|7<_J1#PB~$w;BIAMujE(Kcu@Sba{?h2aEk2 zcPJv>6e;JuGuAlQ2(ifdeo+ziU$Uf!<9yO(xOnav$;JT*h;>HIO`zLG01%U4!}AoW z2QJQ8pdW2k^A}Pz9&F&A^>RSZx?z(|f?n#oH^-N@uJ{K^#HHpwxXH`84@u-PMkiqi z`? zUiE^%nxipT^3>%s5B*j9P~YD9E+}BWh8rFrf$uSSfiJ(kGd(sI0*F!CSO_4IpNt$N z@{O3rY z+OkXXwB;qqyYc(F;5N%cGXRw;8xhD)po^p~p zS3~H_IUS5fov{%QUd>MtrV5z$*;k%hJOR= zwx3PJcfAF9ONy2(!mI-9N3Gi+zT?RcmTjfM)y zHTpHITNMXlmgwBKj;cpLZ3+wlP zM;4hQ%l!=d#kNsZS=MGF*)|@^Ika7H|NZ}R2Lr+IB+;TV~RFz&a7+r4-q~d-nv|7{4`NIt3mHyAeK8`V% zUOt^sMtjGC(eXCGF9Vk%>XAl)A@8LF^e*s{@Jl@0{{4940jA>}gpA`0MGBAS$>?}Y z#7rm=k57w~(LSEfsNV;W~fNF!iZI{GRE1#jup2gUtYE{$Al`#|SdZHyPj2P3!Rfw3)A#xgt!w zx|T0j+w(V3#Cua`^}6_|g0=m{8q_eGT8qk;wMQe2o1?OmZOxs{Zy;PMhxeqLZ7Z8w zmx~K1#3OOK2ghmq%9rop4|kC^i*>X|q8dY+O&>($e?2@j$2b;xxQlNp*8>-d6>a`d zr#iH10?+iPnf?0t!_z=uI0sM~zQ;^gVQTSBwdJ1jKsbIkIHfJ6Q`ywk)>To>u&Fh^ z;&)Pn@m$y2Y7)cw2K7mI6(pOhf3XtReErQ&3xTh|TjRnyzs|>f{Jycw{Jyb09HH=` z;6?k1QOB-0+_~8y-|?fk8C#II_5#24o6&#E4%i;tj~3uktxBOVOF%<71Ggkwc91T0If6!?Yrx z{)^gug6?yq+#~e67^f`uUn2E;33+#82YwYX{7urqt~(Z|1#8iX`-M}hFVw$Y+Q)au zv4+Q(Z;@w9w<+&!#K;>I@2Rnvx#W`hY1-S@c+C<%Rq8`s#Q&Zpz56Zs#q%dg<8Z}d z7w{Vc@KcS4EO;MV@`v+&NEhIWHHI6H$oK{bH%kroYk6N|)B*4PWpx++8m@YGPbl^7 zo?|HW?w-##T*F8?$Li!s{cw?2<1O`0pJMecTZBb~{;*npsQ2tbpMzMCuubMMTO;40 zQ%v=Taw8O{791*@1w!{@%w1{`ZoaGHaVUVwt;6@ zK2Pv{v_Bu{0pfF}dhblPS_j84>b*9@*jRWVj(gO*Y(4|3^^yV~LWUb6{TYs>O&x|K zsr8H^US_$ANYGhm1`{-Z>r=OZn)(A@lps9>7ub977y1^l9F(#HI;M+ zD|eyK1`87Lf+wE2A|c?-ka%y4w>rU>;PKs&(2(op+JAL)<~QE$y;3?|Nc|m_u;ah9 z>Q24J(_c%szw{)ScANOyLIr;xig$d0Z?n%FZ=imgm;=QoT)T0%`=0#FW}G2tyHO(h z#M^k}P%Fgg*CDDLKSR)VqikIo_&butlOEd~0x9a073TEuopBMNN|nBjuuW;|!ZVa* zz~_q7H6p3lCa(7U)ylmy#DC_m6>Pym>$G1i&JfM~{L`K6r!tjVZ4!vL>|B|r{M&pI zIYZ39=i>*HsOz;`M_Rvfn6aL&z*=>c>Hhv!#KlAT+DQ1`Ul+9bcp>Vv8GcrK;e!eM z%iB)h$)EY72lLAM;X@eJ8noT)`#m2%0Dt5v<#(q~$eBNOFd@`xQwIMxUqLtr zS{p7J&tuGVjXwV3eHz4}D=#%f*58{^F7D^}od__io|5T$Ua<0=2R$8+ zYjRZm)4zdmEtPKHG&uOaK#{U9%Yw&eQHAG$va;_oOMTe@Jld^D;f=M_mjS>_f)dM@ z<)`qtW=OZMx*hv^Tks}oc)c||o-L>2ajmAZ32J`c4n6vN=?Pj4JXQbBgPIC z2jTFD5avIH{R;ebyiyI1?OowTKo5WZ`^*n;;BnDU3eRD|+W@>2XfglvZy-nD*6}#^ z@-jb~884lOaq0Fwqu~vdGNyk8!s~cb;8r$4?B|zAe=j{jUux;)n?jY|ObgyLxIH3- z`A=bAXu&(7;qeh&;g!NT-M*Cw7cBp-hZ4hh&1j4e+=NvA4bt$gu;6U~-Z&YCKgzy8 zSnvjGczmy+?AvR(pC1MulHwb&6nK1prbyvgznQJn@c7O{ z*>^t}J^vD6M=<+pp~o;@8PRPT9^+SdWfr_7;0=&r_(MI?Dlp`|bbub#@OZzbjP=ir zi}tasNE~nFnXLFv8Lt@#z+Xj=Lr*6qTL3-%n;yr1q)hY2k1+-PC$iR0#Pi}Jj=KM{ zp5^Au%P%S_%sDUjyalu7p6@=>H@(!s>GGrAnZM~(v*Cb(eA9DA@7of$y6rcm_&Q@J z1pESWRQpn9;ux);N~8zAf9gl3CkS zv!ld##P_ShjW2dIoMVH^oZYH-lyAJGCczo8^5?qR zliRk`y<${s+ZpAm+?}%X(ryX90^g?qN^NNw*=cTdU1Z44$k5W=F}1th`y#`zhWJoq zc8#vGb0=J~!?5>GkU+`1B{l)iMevT=t z-Qdp{krN`lWzEK1Ulmp>Mc7KW#Z+!{?~Je;yJN~C9Hq@R*jD?HyS6cdhOKv}Y;!@U zw8mCj<1Q_CSJiIVys_$KV{T1(&{B_p{nH`M*(eZ0SS4B5| z&@kGyC)|khVnb+e|0cuktu5Y|vNUCRC;F}00*{#~8;cjEq`iI;pON6Vl70uJ-wD%i z1^t@58;cjGWWN5x@{sRdcO`uN>(q6(-*!!hgEeJa@X052t7r2o&W?4pE!A7Ta~cnx z6I0q^JANXyvZc0U@5s-WE(>4YDPjNkuiv`o=&m;s$JH#X-qE=Fsa^IL&o`<(=hp14 z`8LgyoR;JI(9`$BoS5%C{k}sQCpBhlzJB~{08D-<(fLD3m=V7&wE6>V^lo(Z8h_o= z_(t)oO@`CkxVOQ*v9c-!AD-ZU&lY$c7al!dI9X$-->vjJD*aBFes|I@rD9fU?Y7G5)P|bc z=CGGh)e>5k{`KEIJ^lN_`T?;1JI}!HSVHHqglPSpHG9`zRke5IhcCl^?7I+ONc(Sd zai`%IVSnZIO-8ua-LSD~cgn7g^!?iwc+70t*zioszSmCfa?^r$DoPJNzZ=&=&Vfx)oznNwl_8|>D_px3v4P~#7 zbVkBZGXa~M51~q()gx<7`Uk~o^<1NglLKXiCayWKd6V{c2#wukGY4D?xz zu_rn={4J&7#FAf*;82RvQ?`cUA1jx-R($;-KAU_UbNp*}!-b!We{UFYuXH)z+ex_*PVUQ$=vv~BCYm*RFlI`M92#Vd#QpTxNek;vrk z>t8NwKJirbu{s2;s7oHWwQpVWd0U6qC7-`_Tv>8T`Bf0`c4~0VB+QiePwZ9h>^7`1 zL=??csTlH9h1g1K(9gT;Fy7u4b11}tDu81ca6>_Yci;#aoO-g&-B9DAn$K40bJzOZ z)v-u_wY?^0Ur47zAsy>NoP9Gs4Czo35bsDL$sv(dA>nBuVLd}aGDAYkZRL|n zvtry?ZevhPX}K-M=l1&CrDHQ1vRsw7xf^`0QeRAIrmb|18~D{3)qP8AQm|M0O)ze0S+ucj=srh5}ddbt*`Ut@JPMVxRj&#)*qdTT*^rSb9qg%)=eC^h@3@ zk7bnJ>@Gc=(Qw3tJLfKsjOl3`?r=>$cjF&Qcc=JbcCFsGH!i+DYW+&5Jvu!DpH%;} z^M$xsd*g7c2tOKP?0g|{dpK@atHvW*YYkkZ#|#qYIZ9lAW6O`|@e zc$=#d=i_X1*In*xcrv9yU^X0Ea`cG%(B%t$E|k{(Sa*3x5v0Sxa(8Lvk5!jP31?*BI%TXw?wi_LbDbwj*SO-x z8a*F<2gk-ZLgUxOU@fr+4X!*U5&P(ST3URbiaXG+RNRj~0?oDJ!KzCQ4AdHrVGn(7 zFdpvX@eF96;mtOTLo%N~UhKu!yR#NF|RF^5|B1PFYw;RamH!hY5Ljt9(*fm{AobS|ai7 zLhfjlX9%mqU^P!VxY<#$31h^HCw4}o|4XSGCsOwL&b_Yfq0KP?shRSFKO-?;>_Avw z51KwR(jMk9=7c(boqfTo_%*m=uqiU>?u(n~2E1_q?((I5^YdaY6gB@oGiAsc!b%7xZL;coaJippF0{a?6 zoF|`p#_XZS+2T8g&GNXMv7%@*Yg^u)lzoAt-m^S)SH>RuD(8XF!;?fo9tdyDSeANt z(#_6_+mSU1+mI>V&8`Q#hb2@;`!=N=iyrj!&FJr|kOp5$*%%{XeN!U_BS^q=zxZss zA~Zwfed_<`&(It!e;+IE8Vkj9OgK(tI4*|p1Dv>pgd5Jds@hUi#&4Mu3(>Eazd>#b z|8X&V`Cj_%AooGx>b@ImGRCEPvt5OgW-iRAogK4zZCQ>h9!GFRtm_iGx20t*_6;_S zE#e#soLqoP<@>gDSc7lj+~kIJG1WO0h09ihso1H^INaNO}Qxy?X7ZJ)Q4=RKSg>X%wuqq;=E+SGX zL)X4+H|AVy$KbaQ83GfTK8XG|n8=K> zreY^j(V9`S&y)`ZXUfU^wh84!UTa3>i5#k}SiP?q6|JFSbxE_aCluYw4&+qXmdc9N zDBA7e&ENVyfJgQS2Tmzl<8p>%SHG9MF@Bb9&ZLBbEm*3GjUU2|>Ws0eeG1N7o7+Nf z)72+zW{We{w=v#lKo5lg7{qBl;e$WxIO-m&bq8nS$OzO;sGthBw46S3YIdAHZ)#Sb zK5J?go<3*HrZnm0)Wndc>8`gu2SwwFud}opUq;1~upj0kDL$O*ac%YLs+_s?3+r+U z8*_H%%-NZfSC^Atl~YibGaC)-r3N;tNfoXd*=2qp*s`3<8<>XX(=2Yd(>~{xxznyq_u$u$fop^b$ zJ7ynV9_*LT_jNgQTHjAlAxtQQYYK&Rkr6v1BNalFP>9wP=GH|zcSd$l3LT+P71;@6 zW8B*DwxBBK+J3&Z$$03TEleyBCL%LnVjfNWU(pPk(7FBZX^Ev3s}HdyqD6ivTVz@@ zo6Vlk10kn4!P?&_@f2Y;%3th!m|Ke4u`brWc6kdLrroxsrDY+;{Ncu7PoL>-3>5i$ zcEXY7)Ufd_XpYO+=O?GW*aQE<5?atU*$Bg&T@jagZ`oT`TWa1%w$N`i|B3re4!KDe zh7AlaUgQGQ95#xsp*zIQ1poc*JS8JzR?dv3H8IuSR@AhuEBjDaTC3xq&Q#l`pQ*lH z)3(O*by;h5{3Du9dE0g$cz0TP`i`S2XVvL@o~oQ1+IC%mcc(vVx25JC;;!jiUAm@r zT157`5H|9~WxjelzU+&n_=}c1p_?_ka8M1&OYY&;8}SIRnpX$oB1f z?32BxY#@%b{J$nAoRHXTy++S2f9SwBzrFi(^>tIy#0L`n?Y3dFJ0c>ZqWhei)Vph3 zm-vL1mL4rZC?qs2+}WXHCs#~t=az2WTh2*5>+B$EEyTO9l%;-va|Kz^?z{Zh}?d*z)21q9a>fR%v+gWFylSn_x zNN)G2jLSw(m@qD5;OJ4A1A7n3b0_y+)OUp2$ji?)^5^Fo1v!O9`B*SjjEQ9YjWV<_ zqcTV7VRXrq$pcf<(iPh5*{SJM?kHRoab;Nc*w3FGl|Hhl-$UR0`Mur;E{XnW@x7^! z*9^8j_SqdL{_yc@pT2cxxRpkC=<;HtP zEQt(t{OWor>Fkw1OyBU{*O!bM!u(@CFu#~T@!_wJ8$WdS@eYqPJmF|geW>oc*JsD~ z{brf>h5O%sB7E$+PGRvABVJ#>{_5OmxwEERG^O9zl!vZm8q6ctgyh zTf6pqWMIXWXFDFg>z=0;JUsf*TPCG6Cyu%InvY^W{&jEn9#NCOLDf_ra6~mVik|#e z)07LYdS~q0oV;N(j@qt2cj=!mzO?Jw<8(hVXYz?y*X;e{f4cv=sY}1V=Z2)PWnF(c z`qrp_zIIO96&rJ}+xV>GPZQns56{oJsqfFV@0#EI+z6V4tGH~ymyey>^zlbGT{+}) z=OY=tzPa|+(cSO&eAV&tKb)0cwP$VPqkmcX#W}BCl=AM3KfMs$H9{t_z*_)YjBDx`w?R&}nba{=@25Uygoc?mxOsFB|jzKhLd58=v{F#Cz@< z@k;OOJ1m@W&WX1!x_jl!UC%zVK7R0J&z0Q%&@E4|c+CFz_PU1;Z|>S-$o`*da;`p> zlH*(P5syE#<=j4}B?<}}t*1hLNJeu6Fc;B9(J=62f9zNiKl#jDc`Tm-}?%E%E zjdi^-sp;oKwNtlb{4%QZ^XJz;IkNxWmgf82PrakUMYl z6nyg9SD#+++n-;!Z`h6r8|UAAonzp8cl25H;x&K&?(*&zzq|ab$zOaw?@zxL?mV9A zeDn1UA1>K?>6L3@MkoCEQO8BwzCChPTv64OgUgElJ+5@(ga282>)IRpz4XV=zW$5t z!t{*z>)yU~=65Cg9@@Ml?8@4WKRxks-G)Pz{|SHa+*@{zdvDY=Z@qNUkAIncPPh4w zp8w%Z9j-WjSN`YsK61~Or30_6??3c`7uH@j=v2Y9J4Qs_?pk&@bN@GeKF;ZJ@dag1 z{_D-^W9#i-L=8BrVZqJ5j@{S&A$qHGdCZ@CetOjh?_Ag%8?tyx$_wkXjZ|^Vcd!VRu z-krI3H;sSl{_+_+y8iIY-^aW@>`#~6_RGmXZu;%&heu9u4EerSz|L|l@dU4h8 z8{gfwa%pyG!hKx^pPhJOvODgxJx4y;a2>Ys`@g#U ztg5w-t~}?WcmEXq!0>-efBWi5Me8^J+OW9)@ip(iI{3PITi*zY8}VLD+Fe(C_uK2w ztw=gHvv6DOmRVEIKAPt;?p;#xN#v1rHy)^5^q;%`Hu-S#i>nuO&i(AczdqCV=kp(5 z7WV1FHy`rdT(axL!$bRx{MP&T-J`l}Us_uB<+&f<3Ze`a6SpzTFliH#BUCnp|URlezu zx3?U6e(X>Ga=df#ZP(Z@9W?v$XD1v z*#0+kiBEpy&;t+s)WsM1`sE`7rG|0KqK2Q|>6kaU+4X(@(#qu@&pPq>p~(ZTyad8Y`qbS-8)`|5oB!!)KIz(6eD}-&L3&CP=u` zjR^tn;l{-QZthOiN^SQb)Mt=#J}hVawbFlQ?cxL(ya~TH%#g`Pez?K&vSCI_Z<#+c zg*(N+M_r|Gr-^;nz>2vT^zu z4ZCx{DYOm4jPD|2j0|tOIRmDZ+OEAE&?*Gy2-uaJZe^{h)^@EXt!gEQSP`YW^%;T0 z;|!@*a>yAe%EuvAaw!+}hqgMvwOtFEZjp0FQY$$EcAsbX3tENX+Mbzd&994$VKP4% z(1pt*-Lc@g*7R3d9!fq+&KF`$jKwZ3T5u8m7Ab!K^_pu*-YhHWyNIbSPaZKTXz zPHj?qA2P7gr)f6XBpKG$lTumNJDGeOer&Q=@{E&vXOd@}^O0xd87Ijmt2Mm*`{4=uWpx&9D^;k9eQdan zk>tTep5Zt*PpxkpBYB1+1>}#casprGX9wu0^AXuYktb%Q&B zUTrh|Syqp;twD#TJ|%hTyeoMo=Y7rp3&}H{?L`3c}3kUZ^t zSn{;ki51fxlDo#o%it&oaMX@^irNmOM-}_DY`VdS3F=z`rDU+V%j1D$ln{ zp8kK6Jni(j4Rt1H$%4F`#h6?wXPM4eoWF=iXO_&kHh(!*SOt~N$~}!VKX;apS`ZPY z5F3DUVOX$*TYl|D`9%f72&rXVUl&v{sFg@VvA&gP+tp%zEU`0a@b!FwI`aI{cJc)= z<}NnG;fRa;c~>|;FMnBnt9vn)Yc48Yut<327v%(Qaq5pQw`6&-D2OxVgRa{Qe_Upnql9t`i|4efz=D+utUU9$foaeP0fZ%*h4cMWm(5DW@TPw| z;gEer`SWFZ#R@{dg$4PAix%grO*d7YXe&PL0#$6*I)CwhZ5e563?=#P9Yq*SCt&@f zUjaL`qE*e{TjDcRwl~#e-v`*L85~enrdemiYgJUK3%(#zNoSY=PzTOrsiwGS zamnHwo~5{ap7@p3ZOjz}F{|Dc<1V=@W5%el8I!M&z^6@E!7RLE|9uwZDqUH}7cEX5 z>W>yC4AvckbVr)sk-KQ|pjH=>lX{*UJ)#r-9dsW$ecZDA)C1!SwMPp*ajO-?dog+3 z1_bfGq!aHQq;62M>M0rJith|1@?Ls^Mkbl}`AqP%hce#xf5N5X@jl7tA4Ll9J9y}L zV>LWJwkW(20N3$&Uso8!RQwR=k@wOQG$pCkJ}j&7<8`;-O@vGvw)*k-45Q=C)bRL> zLmAV1lLapier{Zfs7ETb;1vOn;|b;;$7>4DdcNfv$oTxHNa1lGBl2D;Xi752hQ#AD z17)=D8GB&<4M2t9y;~L;<1t#_A+-AXR(C{z>^y8HRSg(H#z~fj; z5#uFY4~D##4$zyxWB$`VKDSXu_tju@yhh;h`CSq9NK?U(_tF763cPOkC7!;Pw2uXE z4xTxK+2^s~ozUz*G6>ftxbo@tuH<$Mdxm z2E=}z`%39}d76E_q#p5j{-KUH1)gODlBBS2vfveKcqkgbef8jVyu-j-rof~go%c%K zO9yBr@a7;O>&v;gRC;NPjyDmV1>f%|QueKaho0V#05aHa;_(q!;WdFF9z=qA#GCa% zI)#kG51h@_c?L zO@`halNJ9d<8>Aiz+aV)r=d3!Zbg)l`dZS_1C>hePpL=uNiaHIKj>8wK$5~6ZH*Ut zDM|^yO7Bez-skP;u_*O;d!VxjhPTQR?*!Y(izv1rVJgPCN$5ymUJb{3}lWylZ~k|g;+;~ zwWPHxS6kMSn%d@n=&Z6k6ESOPyJHVGL7f-1GA$m5lNA&+b}xC!&9LF{7QbSt&cLX6 zy!1ZqJd0tlvno~|n!B6&VSyQ+W~ueRNINgiJVSYb^&f!>d(kI>iVo#&0XF~i{@arBHVwBmJ)Ybl0>%*?C%bgKr zv%2r>*~1z2V1murqjp=&(VCc@wI{H~r|RVsJMBj0ot(#6XI~usG+0dAj~`+CwaOV) zHqMBy!SalRZ9DCYpBnK^{8(exAsxfgQ~LBCm>6+oda|=y=}oTe2s>cxHLfYIOnRC0B z^*h_ymsoR|Y^^}BW`Oa8PONsV9Fe`NgR?_?p2NAJsoItOnbSGG0l&NKRXuxLvWth- zH3(}eeHnFj18cm>GLbDdE(gf8tqn1@cUap8Xo;8l5MbRddsr{yZQIK+W&7Oa9_NYj z)Wk3d`}?X>k--&JrS~^^SLC8rh3|_r4n-MF2U7N79Y#&Uw&>m25B*lvGjT;t)vUyd zb$uE`%YawY`NO@OStfuTKzd!>a>TQiN>uTbiQFXHtkt~>t zZ);#?3cLLU?XQVk18rQj4w zXOeP_ap9;}59>O72{qB%vbX*A^x8g+5oNu) zSM^FZ*|3WeV+20*f%jmGcn|dxt;N`jm;U^hr;?i)nl#0cpCb#Yi$NS zwUC}N$Kv=#OoOeq!2+@7r0Hqbg9(w*H3_~t$KnUmKlN>y>nqU>}3V*^6zOW!>v+FUmUiY-sw;)fX9}z7MydNAn+?SRPaNl6&V% zu0+S7y+{Vv93C(e5WmwXJNN7qz|B5;43?AZ4XL(m_F;i+U4&T1gC#IiQDz0vS=noT z!)n3AXtQbQ(TSSIeoVAwG^V%1oaL-zBeJK#vqyFW+C=yGY3OQD)>F#ti{sOg9aa0z z*&ZP}3)xeA=L}DDvX8az2|r^0iakX3)%N(uM8E4mgW$r*l38aD;E|kEf^&QLTAV}h zXqCU(W9?#@r)!lbzRuHSrzdVXD&p3KH90&&(w9@7>RVXu@vX+@*Bi@i&I<(20mqRL zxgWD1MQc2gMV>BCJ%T0X<1+R*w%aFr;xav*XL({vJTW~zY_bR?$j})>ibzid$VO<@f!bW$u}inLyk3{k{Ls=l^>?nap#Z=Q-c= zoMq0OnK}2I;+&B#k>T=){JnD3?eR^;UaHZW9(zT;T1UP>H6X9invA_E`*S{J-o`)0 z&JiNle?R$W^3|F5rgPAM^ai}vKl+Hk#!paLiWNB- zBhm&J3@t4fQdlr};I*X%`4u@Wr>7O7Uk8V6S1WP`ugs~)8L~2?B4;RW1vxEp(?o7I zVMUELuN^yv?jHU;xpZ$-Ub5Gv4}5V`-Dt>aK3~aS3XT6svo)#X>Pot7Opm~;)SbKn zkY+{Q=!$|N;|c~N(eU(Ga7gMkY!fLG>QaE7AbNZZC9F@V{tyACg@q0zgt z4cp3JLg0rZtHjz*g$%H zKck9UP_jrHgk;JHrIzcS}c$K{!G#PqwLEeJ;(zPU?M)c0nW_O_mH=8_aN z=j$Z(5LE=Th|@7?46gqA^|qdGUXsK)Rl^nD0*E8^=0I@M&iNvw=VY<0d~?w9q%k4g9+Ibxt6u(zHmNQl_Q`slT1@ebm#cWjz<&p1ixDG#MvlY*Hn-!0f z6GQ#bh8Pzpo^p~eErpo_dFDw%?eGRi-t$@cBYab3D17TK?MKkQx#X`@JZ)zxp0*@c zec0;;UeBQu^8WlU)AP+qRNbY>`?=DFZBWk_!>ho+xpIS*oatVwcw$_wcw&%z{;-2n zr1y0eej2wZZ7<3}l^csA^E4T8f#SV#W2XudIDAj5NVh$K(?JSFd9q?bBEKCaFY?O_ zf#{;1gC_dxu0kyO8a-z%Mw>2DPH5kpJ75xn(cDhbhL@;rV@%%7m2y^zo-4o<62m&X)6nxCODCHdcRL)0CNht)9c|2PrEkom4QtZ2Bb3 zx8Xc4%Sm6JLu~7To*-U;nSf%!1nA6i3sBed;&|CH_5O5CO}$i=a?0$PGmB>F;;NT; zL(}w-J-NSk(M+_$(CS5LmvJth*=FqO@C@oX0Ax;4ySi+8gBXUDhb?B-!NqB_<;Ee` z7L?4#6hKQao=wHY#p!kSY_@ zLD;qpY*F*V&Fev*II3-Vyoq~OAcp_PI#%9#@APrp* zprNi8RVIe*6dI_%qz#Ik)9ga##c^(-n99i+y}*+b*NU$V5Mm$r04Yq-x&svW$y|sA z%_Bs^O*_KT>idaZFX{{b$tiP7Qu!R1q?0h8V77Y3q!hO?LC+{&t9U;(iDLy)c|^uB z?X-@1&0h~Y@^K15Ww_~cT)}%M{h^NGsTLmZ-F%MFr12(Mc;yBjvgqOEgJ+(!f4tAb z)FX|@afIpLO)$!XjQ;U?Li=|ncoXkRggNffr13a5Hu0V@@c3w=@v`BpiMIthj=eN# zyi;Ij;vEJa$6WLej~O1Gy|=-`(6z;(N#lJ3#>7j>NaCFYW9nER&s+8Js*>X*NaH=KpV7$2m12&8$43_Gh@XbWZQ>n4AgF$$uru)%8+d%Y(RhEh z%I{m?#i7?kJJLbenRp4{>Gr}$A&ob|YJdGzJOQHY$X{Z$ziPw3Hp-6q)$>&J^>!}s zju1eR_OGXfx6Qz72V3pmZZKx~bwxR$>3gK{c7Y)uSDG5&<$-7Ya_R_m^lvK|6YpH$ z@m-E4+L1V~n0%Z8&>`Tlk04$S4(f=Pg8Z3y9gwe}`aK3C6R!h0HC-QP8h9VU&cy2q zydvl|5rg!Bg?Fxj*AaT{UlsCa;;jQ7{nn)MZiAia-=)Co03+tNGY*Y+orPBoyc;x_ zvSV<*g}2baK^DRr7O zp9drIaith);Prz{iIVncoP&BPa5w}ijPwWx(|41h{)@A2o8<68@!3fJyH0s zTa(7y1p)cEQf$LTNuP;#J`Rny2K^JGN0i+Tyz@2h9~ycx+Bx~2%5E3z)N3;#p^ir% zWvB7Jg&o_0CXM%zm2L|R(t`TkUs`r;Ejx|(TgxujveV@<%JQ!_?9Bd3o`<&FbhxFQ2rR~%=w>b zc%FePq8(7LF>ZuV*BRx+8-qflp0Ckaery+0rWfF^XP%w}dc66c{rdIj8xwT=`JY2M zkOTD=|8wykSbB$fNuwJVaK6XR#s?c=5@KAOOABLi3KR6)Q>1zs<|}OH!~}@TielIF z>{hsF*3?)pY+G0W8)#SdT#D|dJvp(^aHJyYR7Uk`%u%r#bJSRkd2mHEr825lbB>DD zoTJ8S&f_YgX_ZmE8gx{w1|2n4gD$LyrdLMwYSK}$nsn4yO}exq+M+UwMcKt_)6te( z4LW*Cay96RifCqK^i-|S68h7U`pSxEc4f4c*0&b=Hc9=aifG%)XgjSxUFgq9>UVgv zZ%{rXcO9oRUO!H0d~lr7_yRRIx-kkL)yG+2F)wxWB}<*GDa|U{$4Ym_(;J=p{fdD( zGuClg?-do8#g@pMaXY4&LER=%Q5b78?dsbOyqM!m?p4eB%>VTp7f#HWaoI?B#!#*f zzO@HiN+KVLBzCn)tlWhq!Ufi5wM6)@o(JS+|m4>7s)f{_>8FlS3%b=l+b2Qua$KQF(uH1E~C+J*D6<-?rCu~jQpe$E_i zrT@%Pj|A5C*E!rDON?E$<{;v~RCMbD8Q2i#te3Ir$gKyNzk};zhvt6rarJ-XRre-( zoj|+$LHV-0K@kgI}qQxX^AA}PpBT(xRhMZu|wnX7KB zD9B1IS#?82!D)##t8S_&$WGi{^EsomN^Dl157vf@OTVsdU@>2HAbNR1; z|Hck3=vWbPDkHj&j)*=wV)W5#Dnc_UWJfmvks;!B&<;yFomacj-F}J*LMWSHf zp~Tqo<<)!A&`&I{o}Ma2)Si{Yq#MS}hTSu}wyBjgRF9kC)Cs(vc zkBmR`-EvIfRDta8+8tT^Mb?UAuvv~p^YNM}1%nC9@S9$Mzn*z9zF&@YoUdp3#d2rQ zFPk&Jtc$r=>xmXih@BfEm!mUk<2d*&_W#lUN(to8S`@?f&NGYW%`2WgD^@l;RyMsT zHuC&ShsCfuL=hJ2m>MfwB!oj|&nhb|E}UOByEHZp$DH|vCB;(;${4R;UaX*`Bt|K| zD8^<_ixte0C?mPX#;l^UZkWwZ&zNV#V{Qo>x4zs1)uYrS`&M&p~+9zI*JF`BSDR6PSnmOevX< zL}r&3l=$V+Q!GKkGMLwuxmkcs2F1CwxD3T094;y;!b&i+XBAID@-t`72P1MnPdZ;v zCbCpkJdNTIX-qQE8S644MY4^MN6Bm!Ye8ids9S)vXv;TsAGltZBb!zs;w$H8jb@7hB z7U6pSfAlYuz%T!PWXYG`pYw-{`;~0^amBnj`IE1@_u`8$-+9xquI)xGy6o^-cdT3e zMroH*_k8(Azi-}{lX~(!zxdtoC!V`^{J|bC|Mb@#Pl^vd*!jl8hrb^+>hVLL>>GM= z?AM2W-(>&N%`cvE&ft^BEgCa;=l2Wd?cbW3IsDNsZQsvtJ3Xc7va{}gKJ|%fFZ}6> z-)#BGzUIqDetJvkzTXu-nA&OW%hLvr+B37;w-R>-yPw~&?~jkIDp@<= zz}w#xPy0CcFMTfi(dLpXSKNJlpEvK>@t3pH=I-4#W#xbme!A-PlfQc_xA~Trd#>)& z_S|bHu6*S`2R*R5-8*2>OK10s{g8O?_D`2>{7veHsq3FSx~cC+hq50Y)$F+q zr?0rC)sOyhS@Hby5-o44UG>0SQ(oIRyZp0`m%g37A^(gC#V?P0q2|0_&i*3n$+|b3 z!rwe|wA%~M99-L~_tDLFF8|wKs($O+s_@92Nw zJCQG6d+@p!+r7SFcFt2*EI+4T-k%m9eg0^9N&7Ey{x{}Ye{Q@0`1j{pt4VpP$wl#% zGE3oeUBig)tq{L);>CnP(RzAJPBJKpmEelhJunWr>zwKQUWNI-$;I3GS<3#eNY8aT zIWUpww_2kWUWf|+auKa#Vo-(|)7rcIb zrSWG_&O{Ws1P1lTk%@P1np}QJ1_92S--lO@PA0)YVhuR()RQzm-}$-igh;&C(sNx| zi+UYKeuvTPF!CK3dHUH)@hqeNK$%faJd(={frLLX!OHf!tBe`nRn1=b!w;h% z(SE@*3v3H6KhS|P$i&6^{n zp-x~Pn>KA|GMi;1C-R7*z#Jbv^(@#;&dBm6u!Wbkv=WeNS-5$4>x$Wx$?0uIs$%^( zOjgs&zIoF-^$TS=DN|L4PSsZ0)7gCU(T+FAtD&aV@RTlHm_DoE!ZT)S=}gqCVqv4R z*1&8mto_B6#$+k}lk=E(S5sSD)VYShRf^F#lh<8pZyiCMc|DW#Iv1v$)={td z0RYo|0Ohrq7r;J`eF&4Mj^TE&Gt*_i&i+M{#^ZWpCf=(C9&ZmC?{(zY#Jg1KY&`zH z#l+ih;NerGhxdquHvu};g$qdS-!=>HLj#X}uJ(`lH~lL?n0>A$jmLYVX}1_*-tRSO zJNDz`<4SP^>9Q|nIxJtE?j4A0;#DD_F&I_zl}a9`5ER2rLf0EdavHD9!rOo_#~+$B z-fRo6tAWRSYrNG~IcKZ#wDFc(<=o%E1MA^UxA58`T&Ka59fMOWyrBjj?|<4q{+HK0FL=h*h6k~v=@14BGYrHQ3X5t+}JdTGoX}rI}hr`vG_yFKW_wdmu3Js(?2FGPXZn#~SZG@Fw2# zxX8>tM&sS9;>2+#9R%J6oQbFB3bH-^42OyLE%0g~)1>j(CdtQ@VlggWjTeKAI^yZ| z{d$5Y)u3`YA4L<>;&B!J@vN)rBiO|e)N)L|Ec5A5oz$O=~md8q;-8@ zXMSJK#>K<3WxbKKT?+DRxa|-xPo<&TGxL8=p8@i7vHE}9@5_DhR#wpQzb`+=3mYWc zUoOV1+B+$i--yK*Wd0U>(^51;{Jg$;->OaN&D!3CH_`}Nt7afhR!eTxXhaisA<=Xi zV*P`L)~cv;($yLn{Eh!rO|vd@O6!~#Gx> ze_D3)iuS!PsH!aNy<$L<^t9zJc4FR!MH{j!+xNjoqQXA1pzujo?|E*Q&r*D~?cb~_ zJ?oCX*H6ptm!69>ftmi@tqWUZEr?8X$JM2#H%tG4d0<`yVB54gduk!snL5FRZ2Z8K ziuQd6!i~Nw2Ds^1ilpBRdt) z<}*TPrRsryco|3)iz$p>bu_){i(eg+Ekd=60_GuWLgP-kY16WM!~5m8KjYShdO3HKP3(7MmqcW$(qOt3-vIAB^$;V14W3dv-iLHo%wWAj0ENO(s5}p43 zgxC7liLzpruAx{e(%p1zsl9+ zD+>Nj*)nTbhgMt1S|3Ln73Q2;fe+kRW2B-k+n1R(0!J?IAtKAQy3#7Ek8Mv|^#ne| z@2bmQ^{V_9f9umN@LimHet($tiAb`MD7*F#J>Xkk#H`c*4!*COvLrHAexkx2fz1x4 zqV5l^T3RSJ^xV#+h*-P#BQJv8x9a|6KY}GMm`57zY?}3;gYQn4H{E#b*ozswW-AI7 zRMg?K-?bHWEh-A;bM=mExq8O}G#w_vg*zgu&$W9aZb^ylcbV z_uR{2y1z$7ateS%iN@v9jVh;^PkEO`Bha9CXF^p;_~$V8QQM zu>~SpVNtBOtos|S*Yuux^W@)Ozx<(RF8SDVr_(*CjagU2`b{cGXx2L0x~ zpWd|f>XsGX|GoI#%F@-X=l-GTJ&l@mN&Vfge*Lq(Kk8d~VCT=fEm(b1RrEjpl-s1u zgzq2i@ZtBro4@X|8_QRZ=<)V5=Y92uBR7w_?(RQd`+Cvx-@Z7iAglHJ%_d&lIIofFKCU9nd&)s32gp5*67ghnPb3n zF|t~((k>O@UQRU!L?DhgU992ps4v{pxlw4bMyb&Ec3P?O;&{jvZ`qUqPX9OdNz(7h znJRtQ)f97G8Txzed$BOa&gF%}9KfZs}w=oKvrfcwZ_!&QorQHDBIQ`Wg{#<^0;h-=M;{ zH^aW2ldbH}5#bz%bG1n`ad00btSjdc(;H{uy{oj}G#%uzfsNcy+`!k(E>q{~P6!v+R2 z{po_RUK4}$O`f*X4Sv4j8Shquzu&L{>(xcQwCEIw+1B471}L7kR~tO9dD<{7lFQ73 z_?scF%c04o(iQl*P=aDO^qLz# zQ9Sh|SADAx_C2JGxVqg6e~j-dx?cDQroVacxzAPYip`yvj1nW?3jaVIaOiIybW4A~ zVYYQy<&j6+zBse*aQQ+5)E|f2Q?TNr4 zgXM}RHvOQSWpKCRSq57a&ocNA#j^~aQT(|$zo7Uy&TlE6W$-7(kHGn`;#me?D4u1| zJfmfcQ!>N9n9RXY(ECUe{QG$ECf&5F_i|j09=+Gz`jdsX?~n0K;a~Wuqmn+6&pLso z0WbZ9UBJQz!LR=VtQ%UgAX#3={n#Urg#Fh%`FhPi0qG zEemg(fyex4yidTGcq3Fi8}HAsW1P5B95V9D=M{}tXW@+o9>@2ZXh-56(d6R{fW9*D zFx>O-_Mvf`{v{A#IcU;&ufWd4qfrMKvHbWZf;z@~(85~>Jl2UOjd#C=$KT;`Oh&v` zI5ggE5x;+<5f1Y2X2=;Qj)PQU_{TA;#+zl~O+c7qPEFdsVhit9;Bo9p|2THnc+IW+ z9#rvcyrx!uYk|jn5RcEY8t;9}zYh`S^R_1K-+PvSuNrtcFxGfeE&ur3%Q3npjW@~i zkNfH9{GJJ8jTg7@Iv~76gDE=(e`MjM;iA=e9hDvP-x=)#e_lU+AL6AUtV#RV9!BKj zO3@#9+2C1z?0>a?KY%y!xWDO4$TVrZZy+%7xZjV)<0GiXdkwsa*A|LPHJGwv@Kwdf z830WO9(|#IXXDU#Tfv)nbD-e+5KXir-G_sG90zGCo`W=AH-xEU`EhS|;;F|!X9mJ+ z5Y|K;k7??RW+Uhu*u@mj6KzOU04A^PPD6*ybTnzZ2Q9lZL+sWfqKS77>`FD5(lN+3 zWZG>EvCB~T)&8A=o1fX9wSQy4kY}4Coe8_Ck`@1{<1rCHJZoCPo2fxs_gmPR-+w3L zrU4g4{nA|9aorQ`8|7R_KwmR$5oW#7U%3pR{&jKe`1{NB8ql-%34Z^*vLg}z$uUtb z+Q0Tr%KM7n2v_1;SaAgPv!zMaS?=m5*B(2zwaJ!dtDhdVe*6XeSr7#2O}92lZ&f+M z$vK9t9T*#N@o^;4I=x92Huq@Sxy@;>JdkLbb;w!$)TWnz*wb`-v(6j-It*>FNw+lf z6Di{Hw^3Q&@S|mJc2=qT%80Q@yXVfv2UGdAX7#e%lnc|w@A^l#Mmiqitl@W>T&A|e zedVd`&1y<(nyt92Nlp8Hccs*{9Ns2v^;5Y`$B+9*w`||z+6OpV5 z(W(jQXJgx&@gtq8+~MmxO>951Wv5e5uF9@_>1g`E%>z=pjzr~jZIW1cXCjfd3*+I?-d zd?CK;iw~6JUq)oCJm2ZQrla58ygqeiDl0jWoxc8#>{F*r?_JY=%NNKNKZBwKXEt5_ z%`rshxB9)!4m1;@@xT5d(LO6JGBb5rc3t|98a2Y?fUE_7-?S?i5s{0=uv+xNu#bvt9O2f86>5(o~r~%x*MMDnAtH>kv`>4vER-7qNRPiit#_xiSnmUQJ z(eK<*b$X(GdfVMqZaRMKyhAvE#K%8?CInxGeQ^x7@+&aY*pO^D<#+q*UDQ3k4@VcW zm1kX^nV$YqqyATCJ?AD)W6_-1X?pgw?4JGBjU3sCMU+^O$i~M^*bW;e6Kmwk^Umh{ z(En-5QGRA^be>byc=Yd|Sf4$zk<3NP-sWN&!1DegAN`!m?`>LDIez3xdFwvFwn7zq z{sGMNmE2D!kC*+e2{gRwG^eKhv^J4pU7hiFHA_^M-&VV&XV#rfhhyiVvz%2GoAz*T zmYvO)r0->|B`PmStgOTyCucZ=P%iLw#I9W(Uf-3wGv&n;Xva@)G$>u=VmicoQ$B5e zH1)-1uvXIk6PHeOU*FZ?11guNYM2QV=T3Ab)CapV@l#rSr=8)x=;;??K7`EP_<`7l ze0!8-FWkN3vB?(JDb0h^W9kdl)4E@5YFbp zC2V*SJ(Pb`e9~X__e7(CiIt7;JNwFkmnCw_ht_^OcGa;x1yvbYUpaZte=vTriw0SR z*(+$++tXis|5&1Ddiw5ccW<<|toFKRke6ojOVtX4O8Y`1} z_p3ys>yXrzg5~=}Ut?Z(fxK$FY)`VyRz=ZMr&ML{c>1}JD zZZZDvZcW*n^9Jw-tUINPl_HCaivN;NiV3?vS3?zLchB4NXNGNy)k-rP*y? zRF|i>-kEkFZEy2CzbI|)eA;xy9qy-T2S1H1NqhTrcS)0npNKt~LOud*?KgSN)*m=| zT9bYBX+w+h6)o<_=6oj>PnzoE;TsC(*SW1OsBE@A>DNozFO<+gXi#M8UX?7Tij=HN zQ<~kdsuEi{Rf}>;Pj7Re+2&sEf%M(2-JR+C9*kv8z=RrEQYoUOWHD8JY8F%Sh9mC( z{T@rdU{n0LS}_v`HR$!H@O4cj2Q}0`nw1hof18qZTclYcy%lC6MF#G9J>A*cr1RbG z-bn2$u>+AO+PVj#NN#INvtB#X$G>s3KF)L}tG6>CMf@Jy>aQ`shy6NJ``F!*JFRuA zEv=@_$lCI4db8It8w@v-W}ilnvVpO2S2f{%r}?zUzTEOHbmFGe=(}TxEfTe`9b8xX zy2E-M^1e61scMhA$dc4<*ja^lh^B4RhS!Xl>o_ldf2;sQB5`Zzz9el}bgaEE<%40qQ*Dwlb!C_)+S#V#|z;Z!gCGBt zIPdP>{bVZpq;}4`_jFpFKkb^*cT%@}QM~rMr612-RInZs!Kw<@_o$k?KBsEw`iv?@ zZiBvk?@0%uxb>wCI|-Zope*;|zJko)*23uDt^IiEdPHC3i-?=t&XdHnt2Ep*(MPAE z2Tm3JVAIj>?Y^s1%>^5e9eZNkU#30rC!&13cD+hc$4vXQQKQdU9>b3K%0smst4y{; zs#-5TRQ_ZOta$Q8&S@1nS*ko9JUM=Uj2+f>sbhiF#+f)4=iP&fYIoK?ng2xptKMBv zyT7*6%88wdBg@-6HTh3A-}1#fYhPNrXzs@aAN%$QLv1ogxUFy$a8=WiLo04Sy-_Ca zZ!5Wj*q#;aDcQGh-z_mikx_DY_ zN=X4`OI=%3Dt?ZRrJ1lrd@Of*S=pR<1J60&TdJ-W>)ojn7; z&h8G27*yS4%t<}-diKfd-*bTa;A}WB4)1C;1-hKR`ys+fR)~ zJ>NDa=|txBV66{9m*al~Z!KG?@EIaJP%72`sCb){6xILzW~ZbQT-5h=m|?zMNYe55 z+Ub)t2FJa3Op1zM%q1oD_ue@-sRS2we(YfECx|r@LD;1Fd-KGdY0ADx*vCzC;0<;j zQ03KC=m%T+Ay#;(vr5_X8+t^1IZv8IongrUIPSIcib|jFRU_gpX3`{RubocHK3~|6 zN*aTU*4x|XBIiQo58rD?e6xsXKgNo0zMZ0ef~CLG3QxAe=35fRXQ?JBidh|5c&DbR z1(>Ir=#YH3QOXMg)E@`uNj<4v=yez2CeEL&_y_q?1SIt*IamTl5Z`-p9@8S@g$mOf ztHK#Vf2vbwTyoUEZM;BaI79iz_aQCucA4+IN$269)kLet)Lw<9UJC-x;XFG-7(|tnkGOPnOp>=de{iDN6sK zz#H#icRN87MffMqYRjL^R(QGr zZs`;f+Hv#5NxZ*vdr6+f=E|3BxK8lhN#%?0OZ7Z8{w7M#Q|oN-gwS%Zj>Z%?M*g&% zBE3Hht6R@0W1pbsl!5hd*v0sMKdx>QEJ{5uOxUaLSKtq#ME!2=QjXXb@8GMPnL4pb1o9`h5z7* zU7+N|C{sMsxl{4P+pc(G2ply85WbCs5F~u#1q2elsoMfgxknRae1EL>YvNs&JTaI( z^28XSc={>uF9ZV;_!miDuE4nrLXapcg)hpAg#i+6zN_S8IAtonlj4af(t?~AY_haT$61sEc-F~O zB`5avil;BPD4zEBD4zBtcep$YpIO)-+PPx|E8Ao@$>-pd37)p1O@gN_vr0MrrF-Ss{^LWc?Oe;ueD~C>1kETJ-37n=S3+?{}d?+CFVHlDQ!v95YIxaLxI&k zSCdW*xW07|a7pnzouLpfg@sof$=QXz`J7sRHMaH%RD|q|735NbYkUOKK(_IgHZXkVZWLMm0MH8Sf? z#|VW??nZ`O7S9UZ=*uo$pS396t5KWR6_w7$v}LUNC!n;S0ji`!RN_~7lep7Z1Mx#l zMAF=6Dny@5hej5@P--W`^j_xXTr(vkZ+?yEl3$$kggKryJGhukxj%;Vou$MrwHhen zdM2JjVGwwki0#Lw;{Btpe-TADBz2dWGQDWZH4SYBC)mY+!P<%(~A&w=123Dn*}- zS{f+WL`&(kils&DgMC0jg`B*!%NEVid*Ow6W!dU!X2f{LD5& zGwngLekqmyb`RR(k4tX-OPTH7LylWd(* z-bn`DB2SIv99( z<>KLui1_`}>yZ(Ir2XSsnx=nw1|Evi!|P(!XhOO+#gy z<;UM12i0#Bb|&5k;OY9{yG)JuF(R9I{SoL5y(Zd`K7^f#H`%~z1--_z_Zuq#9!x#b zc)P6nSO}vIuwwo4(OTnew(7SWc;|U&(vHDR7TyNn>Fbw|^BV6mtNdz#r{4zN@Q%dRmX_IO@X zrd>Mh_zp^wj>EP=KCTooG$ytqrrQArbqvqKVdC-k0Bs@Dr16R&F!8zqPnR=aeQ3N3 z!JBwxzKUwg8XmYSMV8!j61gDRS}tR^#z@ukpUa&B?@j6?ps}rb**{ z1v?XOD)4wOWPW?$(0D&q{%MH!a5L?o!IT|?11$gE10Jz>^ueL==7TZ)>x;-7-}X1e^IWA$Vhh>+J}kv74U-Y)A_J7^YJ0@^z|{uz-w>erJ#Qex?i@l@O}WEzEATrkuI0N zTlwX9p)K^9Xh-^+mEW##PUG=Dr}5sl@JfL9pg@rSG~VkL-j%>x2ottHwttOx6oqG& zUpDSfLFM-?j2I`5gY+iwI^aya2{<&~0Shk|c!`z^e0fv5A!PfZ%{Iq;@` z%YX+{k7!5w4G!{g9Hd+fHZ|Ur2y475@Fv~{;C;;qiZtGB2%C5lfTzbB{3NCEI8Hb5 z*5RQjsD4j_k%_m>@Ncq#_c?eI?_uC^UWF#@-(d($y!U`N88X&Kq0*(}TojT0B5u!u zo`=wY6Btz7fObSV%mvXd=(_wF?96n}#dEwa=OVy@K-pa*VveG-uAIGdw zW7$g1$Caj>qi^UwZFICTdRkLo;3Vo+W~_7@u=?-DFg-A_O*!3%F1_`RjoC{bu8-KQ zX;!Js3j$vLl%4P%a((vZ#A}@Fe*I4cjxHplAae9i^n7Jy`f_|9H|3pxk6B-M?)lwh zKF<~+^-C_JezgB6hg(k|4GpZ%UOAmu8r6&c%``;1-twtNK9IhlGm4)X1Yyqo@!R2v z*cj>jb9J~e^WV&S`V}IF_3Myj-+)e*ONv;j*DJCAKa|%s4U|^{x__;_ymn!>3em?% zJpRtZD}B`_MgLP>{%^L6|I7Yv{O|GCDvxA)w8{y;XG!YRvdP_=Ry_33ic0>bNpwK! zH!rZ8_SMPB;!clrZtdB~B3FGrwrc+O`}`A4>(IZP7W*ys-RY-`Oxahy)X5CnI%b#p z)}u!ut|-&M+Z${IHZ1g66e-6dE{<{>CUFcx;y91`S{x>6J;zhj%YR7=t;ge@81IxT zm6q!>hCV`H8=}W!ksL3HM3T=EIzArHgpcJR@iDv<`q~gZ$7o_K8-hO^dgiel2T7-^ z&m$nCz7_{b%k_CAWYp{O(QN98z3^oK>I_53D6eJu`>t*0IJI(=K;2`biMIS!Jo?+h9BwKzz& zJ{L0T!|=O6#WqlmgJj1)3o`0!agc2N*^p5mhR<&*ERS*=Ch79Qv{#|8HI?AC{uHIx z_}WbC`HaJ=DOU+f{PsISFAvh{qIO1&G-_lKVCuN((S%k_BxWDT{?fl42S|0C$xzRGcsG_F4L-9ba`bCA-9 z;r|$Vwy$y=B)k6jO_BOq93)#Ghm3lSZ|n1+YN&k_`#fLi zYjGyo_`@J;sC~wuXZwodFiH3XL3pMV5eXXekuk|_L**@bqNLsGXXF^7O zIS!JR>vKoQsISFA(sF$s4H?HMX8jmJ@oPffv9uq z0%0*W!I|SM(g=BSMyj(YJMbcpI168J=D3E$@e7IL6cWcHB<+7E8T8hO%vIqo>dgB; ziT8OD@8=}mw@JJ|lk~er-fu~~uabEGBp4HEAUq&#`Ts{WGLuanq+lh{v_*dLSF?~>TRlGu-u*k6*^FOt~*k=W0X*q@Qu zZ;{wPk>cWi@|(_J6=wfI8Y)lXw=ZOesc=l4+pBX2b>?+R;`K-3bw(O3Pu{O^d3}(0 z9gxPzlf!mRV*4erotl(?{w3Xd^z7g5{2_xK!4K%^@jd(W^?2G089csQOVJm_CtwtxK%`}`fJx@IL(wl5?_yAwY?s_>hP(~5!FZ}z8=kLy&lc#a4Tnpx+sVg5i3JW9sk$g z^QxUQLk;kyy&mn#IQ7@Y$#KT3fiNv2j!_u`UylxT{Ep7IYG5tPUymBKzO!W1|0rgn zJ)-hUq=;{38vWO!ejUG?GuW5kZWf*%jcfZJPDfvU_2^vdds*@OIPHA-)uVN7uSe@T zJiw__`Q`IP#2dY9y&k>m@F3?kbR{ISkYeg5dD0!Pg$yc(e{O}BI{Ci(U25rX zu);Sw@A>-Y8!i0`E4vl_jhZSD$RQl?7y`{g)3g7Kq>Z{+oE&aV#c%yTN&wit&|D_fFm2-iwet%`@H(TMY z&aNg>B=3(~E&YR5c)N2{)mH{I5wUVi(j@9Ulnj82I*&L9)%7UtAF=e0TH(i?4|!pM zTH*H{?ms|cHAloMCL$>QMa6Du zX86y}W?%XIIjIB}bw0AfA3KA5<@2$n|1T^2sdJGUKS+N*we+7^;m@7`fsf8cg|Yn&uP#^obN3C->vXbr-{%0sHHzP2u2hOX1tvTy9JRxhUc{?>IKatAUapcoFP5DUe~P6)#cj!s6coeZI;UFt zQ{An;_?)Gjq^NV6`;yPUR+he%o9fFySC~o?o;Tc&eDT{^`gZO{Ro*c~bDc9R{TXgS zbBQPQIhH=hb$$9XE&Z7;7PA&4BAxXwA2{v3C%FTKazrs_k8wC`cr z_i!KZ;q|igz1$hT_-4kq{oKF$;t#O&1KcWKd*RAsNy1vEZb#J~ z<@NW3yTEt-4YKS9x!?Nm&a?FAxx0PWPrjwkcklPL&moq6h}+qx=dZt$gy$>w2H*8F z+|mzsFY{f0BQ5<%_pmSiC`&)e{e$oNxX{vH=-%UN{})^Oi`^gl^kXgkSodmQ`{Sx` zNs3~XxQ|r%%ldfI?d)qmms$3gxx0OMms|SF-4(w0-1RL_`0%*OL6V|a^1SK|*=~WaJ6f^7`s(9ZH_g|6 zes08}Z?N&zwou^yDa@(F4vPFNq=5)FZPWO z?zZgjcK@czSK7bgmiX-Nwe0V8JNU|Tulumiexqf-(Y@KH|D~n>rCaB_K7M8Cf8{oA zA@dW%$#phc`pxc#zW7@$y&e7!OaG7+e#8ntYK0%S!cSP?C#~?)R(Pise%1=tS>flb z@C#OWw-tWL3cq57_qw}tWO?#Gi?+KJ?%Uq4zsu5_R{-N5R?mx!#qeD*a*`PCubzJ> zVfb}2iWt5_JwH;!@FFX0-m$5F%1W;|2B9MAx9I@R3{SQ2dRqEFS>Y{~{rQ&uD=Yk@ zW&f2`URPM*Vyk>>-6SCWZ4>i{U$(-hS@!Q)=^wDt8)}6ww$eAR5T+ls(%WH$Q?2x0 zw$gvZN-x_Azh%|mG7G;BK4_vp%PsuomjBmU_+w%^wyghSR@i)EA^sN@em~3pFIIS$ z>VFYcw66(d6cO({SBIoN#cKbCTEzc((p-e!weZ_m`a7)f#g_jIRRUEJ&NX|`Jwv6> zePlD7?LzCWl16+r$~DS0x$5>SWb?!~lp0BF7R=6ft-HwHQGcASv&4#_YUr_6+ z+q1A&;|3wW)$m8%zl2=fp7{#Pt&}!QK2zP3dFvvtUU50D>YRlAIs;R^Q=yA`9cN*q zZqEV}=KjLKi9xBzRkv=Dmov2#ewsd489sNCHo|A{p3mwQZ~Dwv^qF0x zJ&TXLXMd-}WcBE^n`!AwR}Bk9zRsam&NJj1!5+>AiDRZK@}fFOQC8qRdo^?r>GqMB z{O?Qm9wWc~rH#lhcn?PnDe9&BBWW+v1@GBcOHAS0kEIR&yK1N* zn&m&ykZ&>kztWJaj$Qaa$&f!_luw}{f6$N@8S-rg{&YhwyAr$;MmxO5kelVBhFhY1 zW=R`SKH$Clsv%gt@|i2`MfrgD?9K8iGtxE7XMrJq*zo^4L;i>%Ut-9281iyMu7-jl zzc(0iGry0?xFWyHrH#lhc+Y<|gshj}mC|117rbZxYr~(LjC9q|Q}}a>A+Is)D-F3C znhN{d4Y}$6Q-=Rl(nk0X-t$KdY3uoam$VoDgZJ#8G5op5NLLMog+Ch&`ELyS`=p$= z#7ywSdYr~s>q8ef5woT zb^W4DOT>Lv+O#ANcn@DaUexnvm$VoDfTy0H1>HpwlS2~sI>~D}&q4C+5P63Xd0vS8 z+z|PQ5c%aH@@XOR`62S9A@VgL^7SF|UxmmY36byA^6UNO{8EVgEiGT{w|_rG{%MH( zJ1t-0$Ki8etAbNSDS+A{-LLq zTR7YcP2gKN!?fJOxkSrX_|v^o%M*V2EG=K@moEyDFAI_15+c7VM9y`LMZQ$J2s-YI zqDzo{CT|=dK7PBe2v*wfm3#-v|5Nf^$-gG~-sInq{JG?LqX7-Y;l3?c@tZ669m!ux z`R^rvCHVuApGy9Zk}o0uzT`Q?cmE{$#pM4i`DNq}N&Y7CpGbZkdEUH08*sRv3D&uf z{O6M2M*b_wKSusx_HSJvZ)5OrAGH5R-8m zOP&yJ6UnFG9T~&z1c1e zNPaZ=BFSG${%XlzNuC20&{Xm>C0{~*j^xY8mr8yy`7+5bBY&;rZz8`?@+rV_(RY&g ztl{zj1(c4%Z6a9lp3$WMl!?PPCxs6Ipbj|nK2o{lIZy|6#o@LQtoTi;%NJ!Egw zoQg{Tkcit^@*?h8l8@o!c9XnFOYy>Z+|l20dpzT`#TM@T+K`6$T?{EH+n@W)DC;9n~F7)~x9B0$1k@xngL|DPE4iWl}_ z{$C~S({OSpOJ4XtMe@RbKCpmdINV}#%AXR+3;fxV7yg$@K8BOahZ>OZU-1q4ztFH( ze1ra9FYSf@Ka+e6CwHmjMY_u*FK|{!Uii66@+mmEYa}mlZk2qD^4laYaDE|qfwNxn z0%wEd8^pQSz}eI=PFtv5KCFRaINUAdR2eE>`0${V3m^VN@-duTKG1=L&x#lJk4d?( ze?syxoZP1*FYNiy2NL$Rf|b|EbCOSK-1MXtr)0Hidq(??xo3Cp(YxQkLGdBOMvlIC z++`E4_-Vn^t7pudGw<3(i+^6>-smRqy8mXpqF9Gl*>}2kyVdS5-TU3G?l$)!cZd79 zTjM_M{syl_p2zEiJ?_iytL|^zeeUb-o9^%2{qDQ&d+s0HgYF0Jhwex2$L?YGukI1| zOZRK{8}~c+@9t5zJW>%^7FixiL{>#^irgHzHBuQ_7x_hGedMml-I40ZrpSGf`y*Q- z4@9;{9*R5?c{K8PZL9N8QB&&X?$HzIFE-j2K*IS@G* z`5^LP0pP)U^m`xdbN?EB_Qo_gjV$ac}%Gfgvn~xDq)`8xK%)hl+ z114fS8>5C4jNG@(w@FrmMgqp4OaMfvfr!pJG;$IUKiooQK=&67f_UW^XeEKXqAV*dDwrAMO0p>HnFt8> zh^iv6;aLzuxP<^<4H#EK2uQ3ISmK{gshS21=>4e=wyLI7Bm7Xs3-l>jm-Fa#vrLIN07 z9EK2XA|UL#3xPR~nSk;qE>*0K%PkE4d<^%eTQP+y}*;q^6ocwJw^;t7_r&^TNR(DJ$nS9{eKZo*VqAPwM$ zt3CX16H)1?umRC9s~No7&ByD$@@S%sRQB3QKzR79{knUQb={BRRp5%R4Ab{7u90y<2aUg=q9R^2%YOmUZwO&;Rs*~B{ z6&Prui;rX1`bDoZAFgG?3D$~?Va!_}RaYp7dG)p0qY$mG&|q~k$EeU?6P>3JE%8}f z!DOP<9ZY{DCnXqEL#mi=OgDnv{$FU?@UhSd74R{fZ| zlGTVfz(Ch?sD+oX7^KO8dH{~T{e>Fn3O{~A;vx>kK|-Pz4K>hJd;EkN#PQl!{mgp3 zuT;&NT~^e6_(hj>L$5yN8mD_n$+c(zQ>T{BE56$MFyO_JJIz~i(brEaEhfO+Mo6>}wTQ~b84@i(C8CH6 zCAcgCR3Zwm#*kD3RMIgvp^!M@3bu4I9eovAN?qjMb!6#9WRx!MOu-oo(#aI{OX!e@ zUX%0m_IEqcq_mJ_&g$|BeF3%spMX((0#<@gz#{euMEUt7UcvaJBG*2NmmMMPUN~=F zckTL=;yKfcN+->mKWEPD(z2qd$*ZfNq-6G#1}-X7@70w5x-(5gxvPuEl8mIxQjku%r!TRfSl%^e zDrH*cMP_PsnRtyUutdE}DJW{7Ql@HNXhBiErkPAtH%)z2CBJKUjgu80AZCmpF-t5! z?&UZ@C$a>&{>)(}Exv!~PZyrTau=_~J(c0EDK^~oi4Av6x$Um0^SK+O(68ZrK6&qy zJtDW^lO}C_(xhXi z*mBHN8IDoheO_5|X_EhQDn6y+$%(^!crZFlwl6zTNn-a}5?IidfZ z+H?K2Bt16Haee`rCRZ_Ya3-&&{dxN~Xgkh>B9-IEJGPzHQLp*yVMjhrA?O**RZGYD zbws8=)G=IW;q`~?R2-T#-c=Uf9s@5G#v1Qi%vCh~8>4hK-j}d5{d?2E<8PZZ-n$ka zr}4GYV9Jicw=BGa1|C!%-Wp`u^pEAP^GF=cCtzp#ci6x~QFwSI7G4>2XAnq{#=F|W z`_{la3AVI@i4(EvW1Z6BBuL{OZR+T1zw_oXS z5=1-FBG{3SGXUys;GKrB#+zi}y$2or*QD`&V&TONJeIe{D@gPEcSPxIyena6`ZwCZ z<1}84H`v1a3c4Ww23dF$47_#*-i4SKY?fad0*LC7&hH4=nf^@$UN)@Qzp(zaf4wcd z7SJ<2O&aeU3vaQ3mjh#s_gQPdf1JJ^cSjPGzV6nrKJ55e)e_1E76|e_ar! zj(7vC_PiK)8Ut#N?`^f`Lxz86D?8$4S$O5Z3u=EE7T#9|9;c9N|JtIk0O6J2x)A?P zgPoaQZdjzt?;Hc~JKRi6ys8lYzJi^Jmu}$key{z@wAwR&6A@Iu&8_yF4Lp5)^fK_i z!Np+u_ZR{}*T)wSn*QY(czq1Kn$~{2H$(h;6m}-w2m`O5fw#fJ<8L>Z4^6}%-C^NP zHt=w(^U7~e#P8o%z|$DS(fo6;GyPi#JYBzFJ-n?J-nYODx_S#cdCWA#lXuq@Y=WWmtX%7|JuRMEWcUv{*k)Ft|h&c-QX);ORPr*yB@RXZm*pc)EUvD?5fiL3|UBzr6|a z@6RfoIO33gFz`kqto?h!st^87C#ZgRSoM*H->2y7ca(v5kA=tI`UKVQdJ8XR;9Y3o zU50Wt^SdF$zcH{g%dfwIcd>yt$im}w5LABsExa)X-dF=K6_sN8_YClY>X(&i`ZpbT zx_&P)@IJ7{yR{+y9e|yQS7zW{X5cNc#=HAN{99;^cgqbt{v?QL(chm~c<%u(X#9Mc zg?E#IH_^a59fN(d{JstGuNCaf{8kxwR~UHTTJ`Y*@PfwAUt0BXpMiIkfmecuIn%$k z>N7!{TX&<`5iRyt~T&qwD7JB@vqLpJ8a+; z8+f@WeAB-b7u5e%TX=B;Z?1v&7UG-b$KTWIGJ~1N?^E(Pg`f$*)BWE( zgtdQtqq2%2NyEkKw$`pe(*n|S*} z{QJi8Z?S>5$iS<$`uigx{ylB=_Xz{pJ3+k_gMWs zH|C{3e1C9@fp>$2cTXG*KkTu@T2A;lu+-BgtVd3%p zNjncMncv@9czFii?FQaTtH0k9;@>i>zaL@X-C^L(vGDc*FQ|XM#=@Iy;H@|CMxlQ) z`_n_f!=Fc*AEx@nxY8^Hp03}!Afp|_XIprOp$PJ?lZCg;z`NVPyV=4^QP&kr1Zn?P zT6nh_c=y6m`!~zNvyV!H^#tw z(!jd_ot9aCx?R9Tkk0S-h_Wa*Ka2augt*PY2fX$#%qUw zr+uP>n%`-S*UAmNXAQhxT6l+n7j*sJW8vLo;MEy;>#X*irp6WYjimj%#cI!02HtbZ zj^#Pe!b=BU(DggZ!n@DFd%?h4VD(qA5dTW8{_0@^Z?}Or-oon;;@?;c?->K{B?E8D z|6%X#fh!F*31E`=uH-HEVx{H8-pada;)j~oDpg}?a0foAW2phyU z#HWByNu(uG&=9SpAT>!*qe2B+>mxN#+oDAcKBA)ez29?ZlF6{E?f3WnygvVYPjc@) zGv~~E&YYP$bNAl4b9;4ce?x&6>HPgU^ytd~Hc}Jt)b-1&2vbJ?jWh59z>9SLjxz9? zHN1Tq-gn0J#>^=8ePvv49M|w()9?-(cyoal>HIxt;CTY=(H#EF~MtdobV&4Fxy#zG8H#I!3f%k9} z``iZJ1P$+P4X+mGzuy1V054Me+a~)RzzCWKM)~hu#HjXHX5iHU?<^;Y*sHp^$H2=4 zo@&nrHM}`UpxgIW6#H_ZM{K|dS^-Ac_da4MWB5t~uNin4D%yy8q>*6A2N(c_1MT)5 zLYOk*J&N;4x9>z0`!+yN$E(or{;uJL47^yhvqA;J0{-zjsM>M<-HN4TTj`od;VqXAyx_wr#y?+0#;q@`_CIBx| z{hnpuxq+wJ-^UtWKAf-D@7yT%&4He7UtbOHQw?u|fmZ;$NcDTAfj3;kJEq~KqHwx> zrBUqjLQl7EiiY>OhW9lt26Vh~;6`?!v-Zr{Ti-gg>aGxYFpp&Jmi zKZHMuS+RHP*Q|-A`!~2zi*8)78s%^x4Nox(fy&4{u zs#Nw}W3)dvjEiL7c%%J&py6@3ONBSoz~gs9BDKFk2Hpt`k4t7MylYdP`am@cN(Y`# z@;s>WUJX6+0Y-wlj%@cIm)%r&1JT$JWU~=8Aqw6A=;?Ur8XlMKRCrGt_T@*xd(yCP zl!nLUKNVha*N*nBi-NZjdb)i#Xn0&gRN-aA`FeS`M!~xQdOF@>4Ufx^D!jvneS4$e z9W?A)r{QraQ-wDaja;|yXcW9b(9`YPq~UQnRE5_`_J1x}zr2p}NuCGlk>ZU0?>P;R zOR6foO2fYND0mMW_Web}db)jEH9Rf@tndySc==KA4jOoSG(0XPtni8r zyme9VRvLKkX?O!Pypj0vhhSTOzcmWp2du&~Od!A`R~*-26hY&41}p z@Mc3#$D5+zU992#)39$s6ud)*efb*RFb%KN9Dk$W-EEA&t2DezHM|AJ^})I*csCi> z2M=p_BQ(4g!@jLi@cwPs_l$;jxrX<=IsQh$+i8rydo{eEhWDt^-ye;Fx54P|KhW^5 z(C~U0cy3&z``ExF#meKE2Hpt`Z?uMYyE*N2g^9-X!GtJy zV~y*BbPbP7iYvSi4Ey;0hEJA}2UXtp4f{rEcwClT;r-PZkJd%OJ7A1QH)wbhHM|Fm z@p5Yvy!FO-xmd%yM#CFo;O&iqmto+o)9^AiyctG+e>4i-^+tccNyEEV!|P@Ar*4dk zk?P}2qd$F4!<(w%J#W~T9tCfwVc%agyz4Z)I}H0KM8UhwuS^>8r~#hJW7v( zcahtU84Zu0>{9Ky!mw{|6ugHFyuBJ;k%l+Zuk>uZ;0yl!kY=hUYQx)-qt91GYq`J8s1|XUbTU@Hwxb42Hpe>uTsNXZQvb^f>&hV z+Dd`{C7d)5A)fu8Qa6&l{JHM~{>FFgw0w+7yQ8s26N?>z%= zLKM6=4ZN)y-V+)gKTn1Kw({l!uiVvMU{zjqjTexjJ;3AKf6m|dt%i3do?9hC2O>eS zI1eT;14#;RO>ZaPfhrz)Pb(qfn1tJ%#`Q}b&I7+p!-Gol3*-9b;fa=&4>|373LEwC z)6}}iz&jEJ&u`!*UX6Qf5^uYPca4G94bR0Q**D(68wEV-(Y~iOymKyt_5LG6RqAMMlEA$H3d8+4sDLx6Qzt8wIc0!23eO zYtZoGjrLL=1*9?-S#CZCVt(4~^@!p_%RN`Be?ChfyElD0rtE z^)Xk&+o$2(iaJ8Dt&DZR%SBibW!yGNKdbm2=!bQp4(S=_#Y|{j05-&MIr8lRA^Rbc z(z^itvo;J^#H&Ewl&{5({iz4rg~NvUbnss)MSo9KSNn)Q2I{YAYp55V^=9V+1RQ^Z)h#8 z4TbIXt*slwp?;_``Y&~geNW7s)9ia(#fet&NUQsx?!D0{?h_7&{JJ51Qg_&w-1UfS zTf*+dD^Ig`C)Flfwc{+bo(;)cvNrzEed=}3zROzt&uK`SJw0<=_QaSGuIiZLw6jZs z#c6#@ii%oWn-i@YJB9m{WK_pEp(hshZs=QNS=(F?)y25oiXYI)J#Ect2@?`ii>=j3 zR&hlr%jGIb%WQ4k7PC9HDZ4q&8qg{0b!%HpUFN<75lXGHssJW(>DiLr9b9#=X(51v zt*zmrr9)>SrX<_lt;7qx-7(>8hyYT20>Rn_e{(EDRo{gdrZ(Bd4gT_A^}^kWb51|m zC*h(sJ5C8_uHCUMrpfDAGVpl!rO2ah6M(kGI8dK`g$xl8x%B=joY9o_N*%(&^xj`? zi&+-jod5%!@E0gpf|D@k^Y(;eUU6C)+>iRIJCzbTYh|abH)C5?d2x!C`>S2ux1hOI z$8_I#q)bf-E>$;csE-kNcciP-Fc6TS-8mvqDebQAM zx`*phb`1S!Ktg*xBQJNt#bvSE5?03{*KCn%yp^@ls!Kr;;;qz6;H{o5u%JAq`-ad4 z4?2Qsf1RuQu8LPZr4Rd(H*9c)?)FevA-V>b6jRryDW$qM>R6Z*f238k(Y|pjnnL$g zY%Jb*uRD3gw*!)!65mRy|G0kt34g^M{(?_D^$R>RKk+qx8dvj)Z~t@k1-m@^U-Q)O z^3}W+SN{iJ#ozq<_j-KkzT&16WiOvV^Zv_s=%&zBIX=6`Reox9w+GL3jp<{RCsxOl z;(V$My1UoB<0)MqEdAK?VQh6bbfxdauXwd)XGOT*&TvzoozJZ}aXfKZa?70hf;;^6 z*ZC*qd0M{qw0z}jX^pF2=`UFBX<6!N{+I8=*!}POO27BjxB8bQ&rK}Is-HQ>Uq8g} zpXw>N)l;yILEd7&Z_=lzWW>R*PHG6NtYC-u86HKotgZc zyL0mK5uIl~UZ47%{c+Mq{V-5Xc5%2G>9XHE&%QC15$Kyf$?I~c;;9UT4xeH*Z}EVs zx&~d=OZPUG2UDN0>g(#!nyYQL=8SoX?!m%XTjuy~osAWj7u@0-=)VA~6#DwjUA(wp(IppNIA`ACxl3~RQOgTwt0Wh4 zk>&vfg$r()J!|m=(C|Stz)3k{pnu>+{-Fbh^*^aI(vh7IBRQ%aJ|G+}YxL{-lSnrQix_yp(ee zehU6_C^Cxi1HkX$4G{c8v0WykR-~e)eplh(jQb|_!Tme z7`|NvaAY`Wq`ysuxsF+im1^;~z9Q;(H}G$f;atd4FcbW4!~S<tWj!dtZWLjk z^^6Qxif~%T>qEo^Wcm5|@DzNFm-cj(dG?V!O}`7v_+H)3bbXVj3?e2$#Gv*X7SZWy`_7%bQ<+B&hpyHBw zw=ABK-~QF#`MLOP#5{y&&&L|V4n&7EA}@TFB9CIV=qysrou55x2D;{x5;2!q3kqi= z7c6;gAX12Uq0<45A4_TbK(APkS>-irvG_pBkip_Rk64Ad5UcOcTRgikJ6|`HA4%z; zV}dN2ciZe4ISUr#&zQZ?unJi?KAkZyk5ZL2iiz?qDTu5-zo1=Fm3h{JTaadHHj;?1 z@^&zSrCyYsHyiHhsAU!>l41uW8VoQ|nF1^uL*$%WqSzyaKWR}1y&tzpshU;^i{@u9 z!WR-uQJcY$#iDu~k@2kstv2$|Ru|2U8a1obYF1UHtqKp~0W?Y1CEEnJd4fAf9 zBlXP^{dkfNA9y&aFru9E^4cAqJ7do5#WPrlDAvjLi50JB+?t)g1ZolNIY~(?yYWp4 zv`yx?czMBW-HKWH3vL0n>HIeDB9X4{EVF-dQ-yDMf=Bn9kfQ0~yhVqyc;5WkST5UK zquS}m{*(PibaHaY66(3=%(tk{5i#ig1aWvFFT2sGYe;kcfvLyqD@6+WZj7tCUM>`P zU8G3qyySVc;&0(#^FQm_j7js?$rSss-yugUP=Rt~QH z80lS9j_9ph=ixy9!6*@iLDx;_;m~9nS}WxCViYL_N|>=#dXF0Qw8?SRcgWQQ?g+ z@cKcJ3%Mfdk%k(0oCB=zcv-3N4!}6wKCb-}$-cc%VwwOpQY;Fm@OYjmJU;i+@$Q3w z*YS#|NBWI{*F(c&dr)}1*3|J%K)~MtiWJ_Hh|u-8#z>`7!cpm6Y_w-KMAnlcr8m%M z&x4^vJ=RBWY}8{o!NB9%2yEku6rRh#3m|b{C=riGg~!WwCg(XznuKfFT!$5V%D6Sl zcA!Lj=TawS!ffQL-`nT7Kw`cmrB?+50NF;wtB`rHJmI|sAW5M|9Uk}N7Phvg=ESBBiVeF`kHolp z;$Fx$*Y22oyt|k6tt;#bCzdt+@a(Yo^l{q~9xOl0eP;Sq(1A4ddb=ve(<9jlxq0Jn zTLSOiRkpT{`My=p5BHyNk2SS-=hV;L$fw#}*xQqOrMrC1+_|YqaiuTTU-{hljccl! zJiyw`TbrqQ_B{!Y#8)MHY7_bJp=vDd9Vc(ddijUL4OD`O3H#y?CP4MZPFcTB2(NJ` zZCDdpT^|}%zjo00)yd(R;l`4TXZwxnpXN?+Czg1TsKgF?*WO!}WUbv?+sP_@$X_-d zsB0eh2$wy=HP;TWSu0G$@-U8j!fVEdOV$j) zvkASd%EvJS;b<3_TFEqNX#;dF`an|PY zPKa8&tL!T4McWe6*Ky};%jO3T6gTuOYv{TyzBb8fOtfmA^YbP=?#$v=;g%n;+GXmC zF~tpC%Nhp5ka(=d@_Le0zt7(YZ*LK5yRz>70Sb@A03y+9Oi~ceef%w=Hh7;M9*IB5 ziksLe>lq6LsJ0n}h$@sdVRypZjOKXWNZ*}+W7u1ACo&`}ZcoQs&LbV=I&nms$!Un~ zk(>$qc-+knyOzy8+(2w(7r!szAklGaz0t01h|NZ93>*d|+-$eD#UghnR7DIVckYSG za{%rB9^TbU?dK{_Onuuf?B_{cYP((i*Hpda=@E~%x|>;|PI!o1zslGlwtY`L@=qNZ zpL%M1>ObOAcf?KiF1N>Jl%(Z2jg^+t?)crj$3DMPR(wpAknE0W%5Y--X*)4>-ljAs z=0&)RO}&mSa(*W#0CqrpM|(o5OqJqX9(YP>>?x^#?czQUX`z0wQ|f@E>3o25&eN{= zzE-izJtC>h)j71m%Lh@eF4hKbmFtwy78?(b5QE1muEa7|l9G24^5k}TMzJfl%oV5P z@j{-^E>A0VS-8inwl?5VZ$;=(YpeV0AlvEpam}%!zRyHuloU;0I4pa4=JJeic1c=z zVM$x6)>fv%r4ZAg!J&oxGj)1!SWz1^9$iwYp3oPyq&nc$e3b&7yo9^F)#zyZv2yYJK>H9ONsx7!)t=|8kH92AW`>#KMTRQi>L*Fm3+ zjSi~WvCXAGe`6QX7fud;wcPP|3Rv0N3KX^=o>nAvKK(b%XGo>JEn!~v^h4tg3@hrN zIWp~{!nDD_eS*&kpE#EKZI^#`b&VNjg|nAutX)&$b;r~62JW`IPvfDIyCCc}47I62_*XRUoPn9af;ui#}BZUw19bOudfQ!7`+W-N=0G`Z*}& zfmS{wOXDMx)Hya(#>80R%&civyvsT{jpOwH#OD}Kr*9uuIV?EQRhZVRIPI*G0|V1~ zRHgBX<%uF>|HS&#ok{;Z-L?80%N>Wvl7-x5)2Er~V@om^O5?79JMVP6`_$BDgolIs z;)G|9#DCT>w0eDAWz+Vz7Rm>?;mkEDiK%6F@l(HCQ#LwWRG#r*x7ct|-q2yyX<7H# zFLG2Hihle+*y~h@%ayvAr~)y3VC|r*@~(UE-hQ_937wPLwN)v|M)w~ywjm8x|01^w z{bsgkvn30I&M~_P#mVe3wj_vF(<4zUsJFk3hs`e3SzY|$hQ8I=O_^^6QDfrzMhwPH z8R0aTowe2u7p0E1s=d&?DzES*Pxsz=0~@E=t6dfZ(^wwXJTG;4t%LFNoM#g9R*mja zx7xyE^fk#<$@jUF$GG z@Cx6eB{`7#`kbA6iO*U*dl4S4Et@@S$znd7%gdgZKRdURwdm$~1qEbOL;>y_GTaX1 zr1$w~fWU<{zDbkENZ|8-aawA>Ctv@~Z@)e*ob=i?!@v9FuiY+MI4Ez$UCqBL98&$a zuMckZ-*h-{?>ET}XMHd~^U|9e{&4t$z+(@5IN}%HMfaY5-jf5?UUyc^)`uV6v0&@y zr+%5~Z|X7T@f$wy{^PrbGtTTZ`O~i+>pS}WYaTj%+xfxU|CxU=evy{3PHysietxKQ`9E@wfAsp~^qX%Vwf1K{ z?#;aF+{^xX#Up=tr|N-{uFnoTr|N;LSMFVN=@Y*joqk~D`(w6k+4ql(SN7cbx7+TW z^XP`n&u9G0QyQQ1)z7n6WUd;qq~X4gA4rHD^~ATocqwr7c;y@KclmhvDa$7=o%X== z&o_E!j`+9dv{x4X;rvBUw%oOHX;H6>(i1MtPJDAfx##huuJ3>G%7Kq#`ak;d)(bXn z2(3<=bm9GvzY~A$hZ?t6*L?i=qK-mCf2ZS(Ivv>~l@%44^@G4H1IxcrPM9=p%zIVHc{ z_o+PCD%|r>=T@?50gO_W9XwTTgU8e`3YP@=ix?pE2R#$z8vEwtDo>Ck*J{`BCo$ z?>fD020~aDW*zIxw^~Z#Klqh@@%B79{_m(n&{x|2!Nd=2)1Wxj!xnS!j z&*VoWPmJ#*PYjasgUDCni+pAGL|)B<5c4}wC)A~w@sx|S(q>j+*CgyfyuVDIa-l;9 zfCTMvADDskBr^w6i z#0x*L0zo2Q*wCdD_CknrUfcisY$(rsU~^^Ci#n4VFChNv3a?BJL#LW(ZZsw=@={d`lk+ z-%4Nk5LW&XzLoww1MyvX;)4(+c>0Rn8RO}zp^~TlLCG^84$st~T~|q-d0r=Z`ij44 zsN=)2QS!w3ljLa&$sXk#DYHj9Jk!(WH8`GBb{YbrefAZCb;{0;0Tik1Y(LCT`5^&( z*K@D~VaO3Y^Y1Kq=AR;Y<}cb6^ywebkAY|YD4s}5pPVOo=Fee+_{?*qRa;S8}@?`GvlP# zfo3cxZ{g-o2TjJ|cGO968N&w3xY_yH&SWP(*_||9QjgmE1;gb$)= zD1ZEzoWA)nIsIhH)s!+>V`BDagsFj2EL+Fq;i3qIZX-J5Lt2+0pK?rHkjza4Obl*b!9>vz)20oG6Q# zud1cvR_#@=$GX6nwD}V)s>4LiA9I6J>@Xd(pb)c|^JEc3y^HpMs$&Nt%2H6Mlx+%~�Vi=PfjkZ5&llU!dk}cANp)ev%p$-potM?b1HjKqJ$WS(*F{3& z>^RnvMgh#!0J&z@&PG`g%Zcs3D{^4WgMr^GVsPC?gng%6y6yIUO(UshZ6Dl zyH(+(A)wp02{PuRNa6K>9{GS2a4i{L6A+Kr8Vc__FgjihWX;$VDZH=1kPk?~3e7(L zWT%XFTm?qQD@6dRZA3lN7%=1m41nsO#OqDkho8i4cxM}Un}ElANQxAm&%isP*~e=r z>e0ShS4aEaLYVQ26y7$(lMhHiUtDnY1yB1n)$qI; z9>4jn;|)c-;I*G3h4(p>$Ooh#A9ySW?K>5lvXA$-bi4rY=x0R=?@tEaGT^E90=5nB zd87UDK0L246)C)(M*AxT2-`mGI~|*{ufo9NJ7kL$nABtNAp`F%;7vh1@%Xzz;a!0f zTrV#LXbNql?7IwlTxMMRJfNWp$oLbJq6lQK7s z3(-z>ylLnxhRQTND7<{=>3B7$goh!geSM@J@unDfrNHAe9YqT78Ut?ve$>=MiFjvY zqaN{IMElU~<2L~MAzqQfYk;0^pBt5$4<+KAi%sGE#=!dmcyB2%smEZYfwv5Js}N7T z{@4`W6JR>nht4sQeVd@iGy!a+6Tn-BBk_1UOW~CmcwYc-4djZbM_L7je1HMaVw{u; zZveuSxv_1+rrWmyKQ<{-r1-lLq3ea9$Ma2*(p!xP@&PG0ihP+5%fWtzGKOd4{2(6h zfspE>sivMS!$yh~F{tOH zbZp~(NTs#XmHLdUO3c~Dd~Ci^z^R0op)O`aCx|e_!;@h@0&UA{I3TUaGtCeV-RI%FnuFTUF=%TdQ`e%1RZUiHWrgDzfsBaZ$#9eK8v^N00EI&U)A+GK%!AOt9Nu`|Pj@H$$h_|% zhpb_kYu?qJFkGzvgZB+ywrNZw=D53$mtzp2;Z7o_+4bChuGJ+K2HnNflnb*rL5p@@DzJkSl5& z?X5bvo3qp5k)<{wYhUp7Xj_ZOov_-n5Q)~0=G1W#JI*I}XGW_xarjz|eiCT>knEUc zIXO=?;iOnv=ZZhiDhStKSLb^1Tx(Le{>nPn>a*d8oQ6bqOk-t;m}t3lL+`7rdSAmA zDGd)-dzCx=SVDsJL zwB8p#es5JnA|iHoLW=pFva;}22E%H)b(RHpkDQNb#EG>qL!9qzQ?A=egLgjAAGj0J z-GriLBXh19m~-{eoUB3C@R(saV@IO%LjOVc3XH7tT=kapEPEA90_^8}D!wZ?e#*dVmltU2VHR$mHx`ni+Qf?8XD&(;$j zSzfrNe{6ViYQH2@k(LJv9q&%v6UX+IiS`vlfiuukU`B2l^h&&i6|Lc5hh|nFo7w9P z-KsO|GWN;2|6}6AX`$R%wGG|yPD{Kv`S2>zO@p#N_^z;_pOYtjgB)Ls36Ja^E*XjV zx%TR0ywCGBRp9poS#&7fYRfphG$oRy=6#8_hsfc{?8>;%6;4d?noN70bZmnkcSgz% zZsd6Kf0Kq(#uPT>yW=sO1%>_b&9PSDOFou2p@b8>QLK`M#o4`Ad_FL{7Yy%TnL1g_ zOpddruSa-ZTzX=0c3N@TysWWS53s$e8uGW}?SaG_2JK+{mZG(rZ27k*FW7?j=KL3*B9LXVNqc6p!L`OV##06c;u{YonPGixBOns zA9Wj4{fl_thkv^8-Dlt4G3>6`7wShgX1v(*q3fp~|3&A$Ik(UDPWAlz(Gi=z>v2=J z`o-@a{FkfGthD{ZzS+EI@~TV61q#ov$$$9WKVC86yR_Ad2G4(F(#yR+c&PJ<{iWMl zuDRjTO^eQbf8T=NT(ay2dtT1w@6TORb=6mYxboAB?>x5S=$M2)v+f+<-5&H=denByX5X(@5O8{d+A@{PwJYFT>5$ctKQi+bHl$scz){9x4oAy{Kvmv9lhl9 zzy4EWy*_Mlm0SM{YhO*pwYH-Fe*W+&)(!Z5M)Kk!-i0gt zjq+mtS;Vh`;f0FHm(Uj*K;VyJE=xl79FM6H~Cx~#e^`!Kl6Lwo~$S`Z3^GUCe?Zc6Gv7VLq zLxtQc<|Kg?#QZPQ+CRfHjqqxj|7nn=;491fWcUUVKHKUk^}E216x;zkTjtM}oPrsS z=|=e~rM(b~@~lEda|CPQc4WjkredxP@}!((%bScMEpJGIaI3Iw zE~%J10-Gr3y%5eTZA&W|krwymNQ|;24sLOY`JjyFy=*m4G+pv-I1%jUJq+8A9f*Fm zouZ0+7Ph<@$ooXfe%vl-%a^=bBa5bxr;WoT&wTHcJoDKhdFImtex*L|jjYr7ddV}- z1CnPxqz?X^bh0Jyj8kD&08&!JTb~8Pu(q&r=28Q-b-PV;(Sm=9qf@l z6!vfj686aY626u841la_XQ3kAgCI}8-7Vvp{2|E`;~B}f*`wE^EW5~8+Q}@t@*x-~ z9UFP#PmsJcucJR@q`;9j3;QLeuwVL|b*9>kXdALzy@@Z494dKYOqV=GGbK-qt&(S+ zuSuSE{#}dzR`Se;WXrBq)P>iH6Y;uF^wj$OIPr*IEuOePv2fB8DF2KLPwA$hq2^oFenCFS3K(> ziSr0N<#N`YKB+?8`fQ)1hK2DK7cRhxfX?(3HSy#}6y*wnV&FNShQeC;jGymWfH+muZ4}&kf>Qv9cSIB!eQo=sv}O`I%#<}=Uz4^Pr{O0V2@CW zv?`m_EX=+ocftIhsuQIZ-6&4%!`wv7rkY)dRq6Dm(B^e#u9Bm3OPh|Wq@PfWoVA|q z$&e@2`$_8NT(h5;9F~JwQ8&wZZ!>bud10nhWq;C?ut<}?R1N?5%r8Sr<-ijo`T~5i zsx<}WbCtf$_l{0vU$aqR3FX{*v-oN@r=iZ{ntijPtW&5Om}nS3*}!zIXxY!s{V5o> zLA~jnR6eI6&sd5zo@Zc5$DhJ8)fFE74R>(j@$6e>Y0r?_X4O$+R^jpjoUXHSPFl`T zbtnJjbhKM>(ZK#)(bE|C?&pPsBn%INI2MwRcY?;-jLvvK5yvZ2&n?sNz;T20FKpxk z*hu`&B*(Rp*k})BO!q1_9WQ`zUu=pL-iwIP@%8|Zdc;uR^ps|~z-;PD!W^`Xy2<6Jh~FM|=_{Ub#RZ;*jk z54?OR5s$yem3`|CKaWK^oN{fX@XWb)=^p2Ljd-VHQ+V?YJl^BtHKrnkHy3*315z+o z!{hIAg~xYJ_42CU%`%zLBfkuKI^HJW(f_oMmx>DSdIPT;!t{qC>XD{`As=7>RHNbH zvc3(Ea}{;_{74kZfA2$2$9qmIFWWz5w71T{8wCOH*D0bN>1hM+xQ3Soxx(86Mz=2( zoe%R-r0|{xLp~q{gVBilf**;k4>rn}?r|_Wo(Fh0AYKvmNRNUcA7B79O~Yeck8 z4!Dk&k8lsfD^hr;AYR8?0X%hnoC{@zcLa=%7e+eXUs9y-{tkwGKnnH)Zzgz_mp_#$ zqkTPG9r4OB;3y1;+xXL=r{nqM?>FL|FZGD`4Q$cvdl+~;e-tU~FQBC34cG8^Z-O%7 zg|X>)&j4>4;uI;oI}xGdjRoEb#L>PBrHptv*mOKMI&t1#Q>5_tn^VUdg-(j|h=`XV zWyDLzrsF-A*nZCpB7wo9s>1*SAkK|eF2zuiTz2nfE6hV*cW$YCBc-m=`vvMvm4PDSRmeQfMws=1F44lv zWop`!nDpcqduQkH&R)%Z${0Fqs1x(kYnbkp7Y2io59dBDkR`f zKs>(HR0{zfLvoQfDRA^Fqv=C%vVP+F*4DLEnAB0TJ-GAt{B{*r3e5|D)Q*Yoq$S~5 zs5@nM($1zvw^e^2_|7}8cedVqIKKO?yt_XdkfaQQ^+U2T7s~AlLVq>RUp#KMZ*-0S zHJ2Q1jNki9RAIZc+*eTo<=EPoxX>t1Z_RH10ep^amj@FD_Ty7+cl%oEycO?y z@T~uxci-x~|DZSYuOPwxeWXkCC*J*k^MyWDVJv!vvWEV3my#oJSP4rV;YTW5;e-#r zA(d$v^w&gzo2BzG_Od11SEwzn+X^C0H)+{=j&R#G4oTJP>r zkG1^X>XVJ3^tpRZc_hJd2Wkq|FF$5=3s~<~&ivR@fG=6y?#)DZwbV1Y(wcr~(v6<| z6S-2{umk>4o=H=D`$vh;c7y^`efYH0{>trgG*2PyK2y&OWSB82Y8p_n3EKYioh{($^E-`rr7PU$GBi z?!;bCeb`s=ns+@uo03r~LInu5wqors5o$Rk+AJ(S;+wfv=mks1dII>~*8^Uhh5T5YKcnH%PdV72ud;`NMvYXpxdc!a{1`-06vtK`(OG*9;pcMlp6bI$MGtLJb%!5&-h>9l$Qzj7rAeP$7R zMKM!M%O9%z!HO@wU6KZjNn$SEne}VyHjn& z@x~`ly#CaR9-nOaeCM)P=FE+scS_-#t;-UY_u8^7=cN-nuN@mVE`IK5^Ag^HEN4!y zoR>m8`j+)7To7D#O5uV)?W@P{-g5qie+_$1m0Y(kVYll??4w8if0m`{b-Q+t2ZdU3 z#GTaRBa9?}-1z$80YCrHeR#l(4}0u9yz%qG3ok3Y#rN5Tmw$Fk+Tj6b9nKHDKA_j@ z`9b*h?p^1HHxGTa-E!TYAF*AIFI)k95U3Rc&K8hU!_oJc&pR%=|H9&!*fMnam_^I6 zB3_IY3Hn&U^HYo!Xl+!(Sb=jj>?^}cp%`SgcuTkVYB9*{@-||SdC$f`!B1`01)F#A z>w6z&A~m!^8|;b=zM2ibQZZU=$Nak>zN;Bp>nEF0Q|GA%)JA`4#g{c({MJq{*7Jri zR29UR__kZt@6(_Sc{898T`i)K(o2w?-q79t(DQLEVQ)vgp5)))5B(-suv0`;?%Y|IT!WZD z1PfjjG3#G>rO927nAP{=%x1EpwQIwPp%Q=deZj!r?9xYkZ>5%w@K3r|j5kEYmr?x> z1PjJ_*0;8fA2&8OfbiA9f-gM5*4A&oIDSgYalapEL%A~aB}0eC_%HV#Kd0q$|D>lp zb=zyUVEk-(Hi%CdHdXF?4%Te(x4;?%*Q?;O_cK@|gZ^iNfj`Jrxx820N#1;D{h?Ny05)>X5p!n%x_-?NfK6<=bK zGxD~a`rE|%t78jbZPf*jWTLs0HZ4Jmc`LhiVr&R=dqsQ0MM?-Cn#?5 zRZXT{h8$8Q;Ydu_Sog>4o;c z&E;MeTIEUQJorELYszd%SK}5$1O;yvMcn0WL28J6tcKF|OT#_1JmQcm&;C zLU5L27rYD|cGJt6jRLc(VW@t=*3KRi0&_0h47qvL8vyQ+%@j*clC zZ55BUNA5X(_tLxbvby5Cj;Vb)Paca0Czja7@iCYR8Slch#ds`lTO4m=-R}5=l8oZ` z_>#1N@v*(*v7kG$<|ZTTn(OU$>**8NLUn$Y4cU1V{q10jdszAqis5FbOOCLI-Xt|9Ve}> zF3OtnrQ^Z>(>~`A`kbHcaWIDe5A-!wVpj$FiLie^x((55 zi9QSAKLra;c!2rs3G_M$|MmWY@7Ya#`@IP7jz4}rIwRi#&-Cq+@+#)Ww`2tirh0IV zdj0fiag*}=Ek9?t{D2C6bw4ijKCJxqhmTzV_{ty34F;y!GiUpzUD~f`=4^j+mZ!X- zbZP|>xB6!auqW1Ef4vhFSl8d+1oG}L$n)GZe{THDRzLc`k$XJneBc`Mbn9mop>M06 zSm=&@`Pkcs$`_8`a6Bp0>Th1)>9^fS3;i%k;8vx11h6vltpnHJ=-4cb+}-5}%ruNV z118pFd8!*KI+)nBURfnf9D3~fYc(UM9lB{Y%tRmEAANMq0uSuyo#s)_x_+{gt5dog z-#Vlj0Y4=R6a4VgwZc!s94~b=;QAYyjyX9-^-<_o(ns+-Tg!{e-nKVj9qG3YG_5Z$ zI&a+ZSikU5`Sw!!D74z&k{5)3;iH>wg6&~{%PkBGejW2>5E`smW}V%&h3gS zMFHU-!Z4YDxhY@6n08FKL!rz)^zB!oEgkQRmW0H@0@;pGMS45xP(f|JX>UV=Bl|}4 zO!+YZh_)r#Px+yn=D{@4f}A02^{!U``k?1=(LX-nuj8qS)0u+^hOn^Bp+Q_mh#`y; z=R_A*9CbYTF@)i|0z+7x7^TDzhUDm7IcSON7%_wqQVwApnbZ*0qz0pPK14f17!y_p z(Y!Kvy(hd9Q4v}wK1q^bVP$^2#)Hq2;HQ2Ht^u)_J+2A1lRLy+ zHh00|irkX*2@$eQJ1nadt}hP-t~UII#j(GSarXZ1K^6F+Hr}s!3~$ z2I7UThDi-#UHbUgljF9CG48E ze$GIzGNiU)?7rmiF|1b)cmx2uk1s?dPt98LeP(NG)*dWmAKFn<)iAbcA+#WOLhg0V zcpYMko%%Uneh>xjo_9{3XZ6$g0t1iRTeJF{{UScafX4xJhx6@*A^_k61Mqz&IlSDH z%VP#yoi^{#^z50L!PLKZbaJ=QYTV6vuv;8_yc%;m@rW-Rx+{vOi;A((VKwN zCfb_-l|&rw1av5eJ9g;8X+`eDug*#T5i5)$j!Ck9M7d+*DNZ{T)lim}f~%T=*(sB= zPwhTxMAD6kOYbWw%TB>rf%;eFa<3B~jL16EHMA0Kse7JkFX!Z)`Qq)OExBG?j&Ebc z$MIdD<7`jyHg0$*y*4|=$&T}zwp50|wEYCpyNDmNat#X@<#@Ck!+ z`k$A6VaCA07Z1I3#ASgiMvoace!?}Glc!ua?PoXsJUb_M&fJ^l-%_w>$*s$8TX9F| z&bwBZtX=o3^=0=xSpLu>k5*P~+FbqHZBN!b{kvy>zw^208yfe#)b#4UKkfhX8-IQK zo%h~v{`)`v`Qb-LKRx!@7hfO$?)x8XNk2&H1?mE71|0+0z3|t??jjGi-Hg9u_Az;| z?H`;!d9Zsm_iFBPtjjSRdg0Ke*AKmZ=z>2S1k?OO^AE@Hhl60~99!;e$=HlR0Hz5E zL;PbD1!Q?3Q2``WoJ1ldRD_NcGO3fu(PC1j4|s4tUfh?DwE~`4avsJ7z<_Y%?e|#3 zLBKudV+WI5w;*6Ql@uo zWE$kh9EIJ8XIi0yJ@ajo!4Be6-`SWSbzvW(e2Ddl!~q<^Goi=f5wv{Z5fdOFWZ)5p z2*hI#VjOrMMOMJ!1%|*PCUg)FnUhBHh-MlmKj=DXsV^`@e&ne`UFIijpltyJh|eR# zAlMG{*N(+F8=HxbBqC0wQ#iIr3tS&?pi;yzj?BaI@d!K|Ln2=B7KnTZ zdlL3O>=E{bJdETYdB{8zVe?QN0*@nguz`0p+jS66U8IG?A;C#3q!+r5jJo6mmcSP& zsLTAUHXNBBbs3L8A2{gI7U+UP+=(J!FViwCF?^DTOehMBkYK4poRA~)SuV>L>q@j@ zg%r=-$h#7Kcs$2=AL7A-TsY~lk#M98oYY0w;dx?0Cen&@
      hMLcmx)X|QxLtsg4 z;zKHMg)a0(9!|dP_DQ=OI~AtL!?B%tGaqS(!lF&Yvmvti91@#tjbtH2oMi=^xI`Wq z2RV30XC!zeqz>XOp+lZ}&`G2mn~?G7$oTkL4%o$#TP{(PumndJ4I&Bz;AI3K$KoFm&}AI>M3ENp zA^|ZREJr5f)F-SE2%fsc5W2*4@^DAz%oc>nZ~h0=!tmRAnYQnV;dM@yAV(& zbR1jBi+Ex(Z?pzAhT2vv_*jgJII^*UP$^^>Pd)IlP@oQlLL_!jL?ra6OA&TVBXpUJ zx=aU|z+hfvsVDOlL1IwgY)Itfg`i^-^Wnc^2jd)@nMCG?e5gZwVKW4 z{`}GcmqgCfD`tIqniJ!mlyOH<4b8&8P=YpIC z)7~EY>0MoCZ=BJz>@RPYy*=gZZ|nQK4~O(W#af^H)eAY_@nKiy?<1eGllo4*Gl} zsGaye??QRL1Q2aoKNH`lriK%~fovO{{QVow$Z99P-+KjHC#V3MOU&{TL9yfezB>>OfF`hL$l*qPBGSu_5ipTYo-y-Ho`eZc$N`1{XN@|=NaKSMtH6fHvM&zb-An$D)MUT zm~5{p;Q2mwiy@yS&qvPJ=KI$Jq}MHHi<9SMVC72{zc58&T z$2yThhlYSSC$%eh%9+geV+RuFY=*=4#X-H3%$um>sUMa+({X5KJn`5slBbWjMjrXD z;Lnykv7eT_5Bwg<_W=Ka&&IM<lo)%8p#{uh#Gz9o`R#Br`I%4tGVDO?Ce-(5 zh((@t$Fh)TT4Ir>k9o?G_uB_J=`aG*2ANczXAN?lAj5l*A2`!7yLHK`@sKB^7-KZCiz(K zVoZcS{qw1eXWb6w*d*=0Sn{-gtQLQj7UTzTP07wdCi&KKZ)lIQ!HECb`4!8332{lViP_&C_r>D>PP z&Oa~G3(R;^gP$pyF>CH@yns%wAiHqhVsoJe^?veCsCRh5TIq_{yZ;l=lN3*ab6$;( z@^Urv>!2W#BX$s@`H3eZVFXc!B>eVKlq8Ob+R>c)Q{QKDtnK&>C%G1c?raT4Em{%b zC4Yix>sOd>;TvMpt%H6dt(0Q{3HTA^UC{mkDY3i-+|>T1pUGp}`3d0FvJ>Wl2q!Nc zK`Yq+ou;^ScJ|GN^L4+Nijme=Q2G&;NpOm=AU9Vw_Zf?`bMm>~fFoe$!WI?X_Msw$ zNn?Lx-2+2>vd4cs?I0c7Osp>u&~Z5x-8kn=5UU78ZZK_Ug{Bjs;Y3n1EfPA;m%?xt zGpbFdn%RzK<;;?{m=Y{?pjl~VuN=bLs8KUNS;>THFX@j0MN*3hB^>h8P@0-qY&ygN zFeP+IJG7a-Tp$9;f5acoA`4CGzg&F- z*9P&tH`h+r%4&?6sUB&Yxv&~6-W z!A5&1V|cHD$Lk~Q=Xo36O9tKw4KGf^yB^?BZ7atFDZ@dKvTrK%bo;^@9^IqtyUf7j zb=s*8R0q6a2Ht%d9&arvyuP@8((TKYG6hLJQZML{4=@0#(C~2Eqzx~@z~eP#B>#y= zWRL~0k+y1hoe@^{Jz$h~g_JQ3N!hpFC~uvH$J;atZ@GaNf-I8%78`hbG(4|{w+6iK zzx$*N2SLidVuZ*CL@Zvg)bNK+x8wg&Uhr~4AnMLc+}DHzR>XW^*44H?d1cc<8KE=3a=J=Iv#%j z@HYd`-|pBbDUx0JafH~ZW>-sC@Z`_f!E914S@m$CiNJ6S@Hn}KzgoY1dRnA`$U#E4V%Jy%V^K#=zJ6g(<%PXMtd&r-`@ZA z(eR!%@E!&p+q)u#x81ll$v3)7LmkhjTfG2MU ziImhMHG&}@U;y--h6lC{FW<@TvPuce=cpdL3@P3XsMGEgDMCf=cG(6tgRCoi8`k0Uqxqb&2^%2&}%UhWWuZw{< z1$b%7IH|{Al7UyD;RU50%YQe@rDPdauLIsp@bupm*pz)Y8F)3o zU*;0#BW9<21YjMtP4WNA}-dqr4vgZzgb9-m5gcrwqKlC#0Y@Qwpd`7cw$TLIte?QbhC zb|dwtT#tvg2C$Jl=;VEfqyMhOMj7q>nSs{>7l(X)tw^z12A=-{+}lPwB_1D%D7*@Z zrs9Fl|2H=GdRzw-8x1sl56uo%>>VO9) z2Lyt%Q{}zU(0e$Fo{jTW$9s>Jri=os@Xj#xcu^WbFT>P3GqT<|Q;!#=5%4;jdg5j` zbR{YK&NlUUQ5pengsFE{WWA}T9xqBG;AKla{%#<>=X0J7i2!y?!VMo95=R^a^-Xim z4;gHO{=Mw4l-}?tdeta6ah2YbD0+_>c==KEere#XilX-iWQzZ`bK+s><*Gv9NEtWI zY2dMqdbe?cQL=ZTr>`$H1s6-`O2m0YMWy!*B2`%h0PqTA*#d}QJMdu3ojd=(TVKjQ zBx8t=^waB0`PimF&b^g>)-}?)ARh<3f=j?7a zVY6rw!x9MSZj2CaO1NXOW|2#{DM4I;YGDI}M2V09LMYS_E!m{{FGMSWYMaChf!Dl+ zcnersHY!FCUqP*Cr3KnrywCz##S7&3{mz-$oIP38_x=Aq|M&kSXU{V;&wS^ZXD;V5 zb7p+)k(F2!TIVzHgJOLYZn@*s0+VeA8pNJ-;H&l0*1^~UN(OBaT4G5MiLWU=fzf0O z*~=f=izJ`yH>f5-Z%xn!wCu8%-=Dl;m3PN|dsk+4hjItw5!EwU%Xsgs<6!F{xX-jAW9$TUHwYdiXQdsig_wd1B#D-7yj4Q$CfVdXKHwa(q zi;a{b_+-joZ*LzFG~$Ro=crm>i*vRv%mGte=Q_}^%?D;%c4=#7Q#`rk0W(D~cEz&O zT3hUc;#VaP8K)1%iUs4eYljcGxzV>Lt}UB^`}NxFnj5fgiNE3oZObhKe%53glz_!x zh~)W5tN3mC)>WZAu-deq?i`(V=Qq%)w52d#`Bd~q3P3+y& z=(H;HJ)T}1Y8y>>Jl)0|DtmgF|yQ5G`Xl|8Qt?AIDz$^_q{i|y%98iQQ2 zJo@8H)-8HR6Edf3w*B|vM}*Nfe8^)TTUp8MywO2?MS7hJAB%1smR$NGb1JL!AeS)y z?CdgsL)Z%`$Y66V{Fc6$HugpC00v2ZyNEE)wPL$J#~x;Ank(>GN?FMudqe9?cRH#* z><+(Yk{ep*xzi2D-;!EeX972f4Es_45T2R@H>CHt4%!T%&n{_b9dn{Jw>j)ZYTNv6 zB}duTAv?2cYwJ90L+CQ1E^w1q(e6uJ<;SjL*$_SG3gx|;Alhk5P((!<$U@-pE^O#y zUxb3p2(#g-c0e2SR}Rth>~SESFWd|@-xAs<>pP= zILg2NB=(h);rqU550$J;8#W^>)&pY?C$P}2o!H%wap~u|TXaQtJ3kcS;u`Tm2g|I@#?JZYpHxsTfJzJ`?yn|16GR!v2Sy^ zQzq#AWE|y&U?YzCQiVR!{R4P6VG*&Tj#JD?V7KP(1v_I=Gj%B*L>fDO;-nkB<8r;z z{WJX2#?Kr-<7VNniQn-zj*AtBPeyX5c`=J4SiBH>CU_Sw2`;#{)3$mp1LI;TbahRe zG%?q|Wa3!=d3*vhvcqa zwQ5FST3O-j;+1*x7frsqu&XP3SulH4L0Q3!(Ki(Z#!s8QXz@);?<@%{nK<>vktGX; z2lH;cv1s_MBd@t(Kw#{G+?iu1&!0GFa#`8*;bVuE%wIipNLSbB;;ECTtXQx(uwp@A zaNeprhnL(kIXHdJHLF%ET|M~5vL%6~cNeWF8hg{E>_s;gjaqW|&9iP@?O!zhhOVw} zF;G{$8~9)Nj78gtds{{S_rGJo1G|Z0?OVq=Or#tf*bh~!mhT_<9>5kgn!>R^KKONz zU5qA}-Mu>;;9~7#r{?M3gK%5aXb9!6(uyTQ9}zxLx{OojeeUq$);(O2(%o61z zx+2P>mx>VGMrS_I3zlo;y!1z0*{8d7J zfVNqNv!qk-ozrybo-5o##avskf*7A`)+?fWqs9G&Mc+E9a2C={!FN%|Eb=c&`RTw) z!P{hxB`6~P9a3NV(fzgs|7i=}OpE(!>1KUP!H!dHmhh(u3@X5pg151pYp96nk#sM9 zKpb00HR+>g2yfJD_?zPCnI?ak9#4EfL?VvfN3aGa^2BhKK`MBLvp$hmq@!FIE^xr( z)trF?p08c_{*E%4I8$%(eEpOvdAxEKq*D+ia4s=;p+6G^2_3*QT*$~S0o}RyMu9SY zB+qb?+Fwk_bKUr2(Ak$vc>v)YHwCwXFABY9$Qtc^019WQy} zk<@%@p+lzOCv+eHNaT@?9^}EH_M~GEMxL_wNnV;r)203bM`DV+$ZlEW1@Bl$;#HsQ zEW~RyX-@W!*qTmdCD%9Jh4|xK2kpk01|nW24O#x z3Z7~4(53z&FS1Noy;8g32ZUGef~PF6O7y2}r?{+mAdz=zTY*EPf}pyV3ZC&;FUb>! zMNXbNi*f`{jH%L}`JH3pJEbe_NjX*Dh^6M;3w@*=L|KeLAV`$OK!f+iBtOdV z&mu3&l%ncekiq0-T^&YVmM^2JZ>L1w@qU>k@(!N5Ux9<)xG?V{B~RUX1*1Q8zghB3 zXSU>-j}pl}nw^vt5p6OGb{tOp=9e9=tqtTz`a*O1d{vyeH zab72R+O|saEUy~LGyQEQ|J{Ax#^;(Q=^+WB9SCnibv;s>Pc#&$!!^&9AG z=&iG&fvC6ozJ&2<+dQ0w4Z+U_&-8R=6ohUx@|_c9_>B?MNtZm+q2BbTeR%yK&vb@L zp6Rftl+1X^M{EdrV*gnBGkuayL6FFoyk3ZQBn5;%;0=A$blc*kMRQkT()_}?`9*gH zOUojAbuplHVQ@h#|M?xeA&SY8c%?m8?h2N_aPg9rm`un?$7)7y=U~Q?LeaA=0c4sr z9)+SbCR&G#@};`-ilri&Dg^M}t6cW$OoV^}1q2l133!_C;*(e}l zbe8H=IHE>Gr4ojtXZy7J z6|Y#_*>A}L;dgb^hY_9Nmj@SVOH0w<3!+k4Rd&`*a{&YqtTbU$i}GOg?Br2&*WGiAmn?{w zib4xlp@iUfk;Z9s5G(Q*7pb}OvFy}Ys#9)^4&u9j%u+BDC+J^fQv82+()#mGC*M3hopfiWJ^g@G#@OWy0gNU*YjPdNbZs8D_=f91kO6j4r)1@99R9`9`x-cK!f^JJL7F!7x0ZPxFc36IZO3U96jZvnz$>BqVJW;_Rk zRC(}TPT^evW19239AT7GL^)DV$eHnyfXDl;8*wmwg?9mr8Lu2+IXDz4yf49!&yfLH z0LcVTJU$mOjC$N4^}{2DpuPBIx{4@A`k_U?sldyHKk@hos_-TO$gJNHgz?^0k-{4X zIr2F&;2~3f`3S7=`dILeA&l>06e&EP1@9>n9v+nS75>8 z9JQMeu1MK0Xu-?GLxU<`KGG;W%~BrxMuyK9iWJ`0@F$-m0~SLl6Fl|v;ZS%-A&37+ zKlwf!kHf8qa-<{hC!a$HXan#D<4n9OaVWfhSoAB0+lz2T3hxB`&3Jo(r}BFhgcaUv z7Q8yR?@?eP4*j_m~B*5O}Ko^)umBTJW-fNBtG4 z{8m`-mIF`qFMQ-v`f<*-xjd!=FIIoWxwedxBNMvcgvaN2g;#9B;~uRHSETeSwBS7s zyi5que%IhocoQvn_X96h`xtA%Yct_xoA5F%c#i{bF2WTl{jRX!eFD6h5Tbs3{#N>J zg7M7u<2re4mx>f#4TQ+&$bcMNq#MB#Z#WKxx7>o4g8;s}SETT`Mu{2kB=Al{hPBtNuM_=?{*elUMa+v77N~K6CV3>rQcOx%=X(0 zJoCMi!t;V5pM!&xkcxeIab|w6!@)4tTiV}@_ZjfMhQA`pk+_b58Lu38d*M&K>v1T& z?cmLLr*U)Rg`XmY_XIr5csaPJ&4VBD{4$LC@x7H9FA0TF06#?v?>=~#@#=u5@_T~} zBi;fWX1rCvi&eg?<7T`x+{dc&9dE+RwcwQltPlJY5rd?3$Pq5|%_h8w@S_~{djA)8P!r$Zz?Mj=43MPcu4sNZ7p&b2d185jegoG35+-s%U7jTh=#s<(>s`#8t(y>XLM%)i8>JZKhCK;|0wo@RR} zqabb2fd)WJ;D!>+BjVV*=~eIIh?{2M1sz) z$mro26<2E04&+neW+G-FohBz{5n*1;c6+li1xU?m3{=}f$&*i(|9kIYV|u7lOuvNa zS6V2!RAiuFy*eRQWy9Mz@89_o(mz@ATY_dd=1u%H9|?V-K}X{Yk*LU%k} zkm?eJfxvyTh`>S$Ri@#aJGM5zxJJ2ADCV@FKdo2a-d>P4S{TrdTbe5UKuyGi`GdM3 zGA0-~Pl<$k%BtyX(~sIuInEnXMoqZ13G$pN@;q8U(9jCwU`haI^@a4owR_zOgAyig z?ozo0`SG!y;HR?ZS(@0ao3aJZz&sy+3YrF~>5r)CthfUW6?N}dmolAJs(ToEZqxTr z%LiP6Rh%a#Z1sS1>+t@F;x60J$jvc&>h2!p_xiVBelhfF)FIzyFX+!XlbA03fOAlS zw6mB``GCv$b^HIuB%eXJwkzs9$A>*(2iZ0A)rjvdcva{id(_he!*L-tkv-~ekKuBV zLdw`RuSuHWnHG1J#XV50IY>{wr$|8z^ZgpTSo2&0y6=%$;(cU_=G3;}tcc+arV9hz za!5sp&^;CR8j9#nmv|f#O3_?m9Y%AwLpNM}kCUQZqU}_HI5U2m#XZtwa)vLH`pf{I zf)^weP1`>MkMG1&CT9?(DGOB*z zRzvW_;QbN(8P5A-@@y&NBu~6N$*UHk696PIm11zKHSdIOe0c#9x=Edht7B}CM0M3X zmn$UCc>N{McsY`1ylIlBJ|tZ>N0And1QKaUCA-3{)ECkf-cq$y2sK@;C|7GmNvqPd9jh$;3f?52)5-6}kbCvcsf5W%(>X z8Kz~%p0}YX(zIrJFq&1{%Phoiooi%WTMA-DH9W_vshID%1S9cgNo9tP zJaO`WtdU4rf6+U9+W=y0sm`U`d9*U7ww=W~LmAcgJC!nvQOg+Pn&?iy7Y)OO3AYpx zI*sebI9{wIse7iGaFfSnS`e>=W@0~2dJgwORykg$6e+p8!IhJ20; z;93s6CJ)6ye;&M++ziHyHx7QhA5cU&(v4uq=gj~4Yc9=DU{a3Gi59%&z*FVH{3yI8OL;5?9_^t>>Bn_& z&HC*CUM7U7AM>N|Hdydh0dJfFlX7(a+=BO(36Hn!3hzC{$A6@~{SFS=LlNajZ^NH_ z4jrI#COpZBjw9ZI9C080di(Mb^@yZ%QWFVV!?9*Z;I4`Ct{E` zfgztm2Ph4AnK-jNc+bu->XC?RfLXs;z(duF5amet@;VA{4DcAAcv(0U-ao*Y@#X=K zc2T78PJkhwBLi|x`t^q&!-&uCcg%Q?054Ym?1zvUZ!z#xc?>k+Wmxc@0bV)66%m8P zx!Y#EM&RYbpZUES2g9h}MjX_SZHF`r0SgRP{4$Kk8#d#tf@%q1BFd1CLC!oL!Rs`M z>5`P(7?cM@BSbvLWjLR?3D0(l+lFO9(}2WxjYnh;&K@>Q3`l(Uc!ZdEfHaJIge>%f zVmzXv^@}yTHiVM!ooJfQ!3p*5wEXFgu?0lKMk5xt@a+6EqF!&ZhinyX25vUKBcF9e zL$KSVofR3~JdKxU1XIWQMppPnV7uB1-*D_qTj3jq4V#T`w&Spk@Ua99u^#>^eNz2c zUuwonQ~3rqPJD*C=G@js+k_&m-|^XbWhE7LPtE7yDW4D@YlHlk0oUUJ^gf%Y;&8|N{J(fPWY0~J3?VYWZ5MubcU~6Q(W6| z=zy5^u5LTBV6X5ocQbsco-JQChYQzXtRt>4c+h!-Uuy??c5M#d#zd2kIz*a*ulP2( zap&!>W?#3qyec21cDs;4c;nl6<3rspaJPnU+v5^ndIxqVz!JiZ(Uib@Se{}zf{sHN zYbJc;M7{*35&5II)^OphozN{#eC8f_&p}@39q38EL+6mcCA)2%=h{=a1dQ4kF}}v{ zw`qKoLbUM**?XV9&b9Bec55xcxI{%p_n(CD`n-I_e5li8$3Ry+bGO=#kT*6ZZ))jU zzH6@tqPNRd+A8XSUA&lo_#=)5AeLRkf0{!VHLh^HNMo%8>`lBE~yHJ@~Zry zU{!Xgq{l%Es z^80cb5@?N808-ukf}=}*vc7z%zacyhI>Wo7?k!Wb#U|uI)^7~vI62aiAKwf?jybf| zAK3|U_+>aN!qcy90fLgU#hrdLSpW@TMVu}SB?cOh2HMc*Gsxy~Wcg4ijI19*){i6W zXR6TVl8n5^x0JMPJQ{bh{+y9Yv|7|wWWu}#$B1>XYf6nTxxtsTtz>hsDi4Edeqf_& zA}#C!4rq=KqFiE_RhTbg+ve}tpZN8%lA?7DVGfAG91Y>6s-`Uv^=+2;or>R%UMI+2 zCypJ?Imhfgv0lZjbxmvm2zhw5UKE_E3yiD;wm9J97j4>k%)upJ8p2Z%+_Db%7z%_7&0Pe2q`TwGHkNUOxH+8F z8lH6`JXP5ITpqBo?oF|4{XwiaAk9@63{;neOXRVAoc z+v-sYn|Dsy2*ZyJkAe}M+K^zk8NpOk+CydGvTRgXUxhD~wY3`u!#VKSWNWEE=s3Ai zR#(pq9Z;$&jDnp|Q*kSBdQ?eic&0lpzwYOZ6pvMOX!JWOD}t%mro1&g3W=i=VPku^ z`D=JJhiA5i$HC*_$@cz}4G%;;$dN|KlzwS=jgbT9=zAttY|jk^C$_kJ7%DxAQQh_L zw>SGz5vegxM4MzE6u15z!>0c)+YI_j;C3`Ap_FM*oMqC}G!H;~#wZ8$fwQr`Myk3d zCcr{>tY`>lwuX&`GDJt}SuNJ9=)cdVVabe*)m1CgE<>g)@p_*Y@lu1R!?avr%QwO! z!Eo*VnzcrZot_A%o((66`p60-lntEyDztHBS{!h(EQZ^*?;qw1LP!1}9Jp4%v^Jx} z*^kJ@C`?^@q~=A%6H7HUw65V0wZ`@fkM07hq55fni|rEfmIrY$N$C(4Vo5by1|b%e!Cs_#3a7Au!*-3!YO__kLSu8R4MZRhwLT32(NzpY4b) z3uH4 zIWEcZ=s44RL(0Es$*;*N@;lb_tV4OP1^+&azMP9l`WOetuO~~uYlYjRWm@EaWznDO z2$T4X&hhCw;WFk)r{Ig%9v1m$E&6bsOGVUofJOg1RUpm`|An+~f=Dkzdq~O~`u5Sj zmf?>=mgCJQWjN=lb3EH)!JlMF|DTrpdM*0%9U+O&;VBs98zNlB5A~a4aZj?i=UDI; zOMJ?uU?;IxWH_->@b$PFuO|%sFgHaIpF2~uABtyBHQvo^9o{k^TU>rIDKzt5W-;s|Z&lg1?z6Vg>>2hdajp?&| z)R_Kw$+K&`S@P6ITzdJ~;n?Jo8Z? zdFJCW$ul3PCC_|(DS76Dr2C9BtBsyv@YGw`S=jta!=LYJQ)T_?CwV$KN0|PMH%{`5 zN7B9c0bPYdjos6&#=AvYvg|}!eHd!g1--Aq(?+ViXd|5&2hm146#;p1===d?;?VmG zR@g|D7pnrt`bo5r8u$O9?~iB2|H6^kQayAi&WTF+R6uiHAjNu3*?#39g?T)D#_!dRZ5=ei}ntA>fb8;nf^PH zXZjyXp7!}d@?M-tIwymGn1-51LAO4Nzs5Kn*I7}d>XonwJ1r2?R%<_qyk8@{jrJw; z$o!|2uc3#YBUoW~-EZ)se8(ERz>$?i;DBd3>?XLMF7>C$$TJ>Et--)cu3Gm+ z__N}J1ZIlC_q*tbdQ^ZIg|)1C&@uMhX*Nof2M5>NEEa6ucjfh)}VM45UM9S_d?^7{;29|3W!R}&=rP@=t?8v!}Lx| z1q2s#_T!Qtj2nBRP9!s2J|IS_X73IQEnBz{E1|3?xOgQobf(>d%U6_Izw%cJ8ErSV zY>av>I;ro6X%STk7B4{4DOiH}K&ZoFE|RHWl#rp7(OE^!O)_L-SFwwV$H)h>Ao>{d z#HViq|CR_Bga2-ZXqG&)8C}dI#!Sgh zQ^HgS9u>f58s*W^f`s=)&1njaUE88inT&P$ijHfym^UUzNIR_ zqT{$x>dl)INx0n=lmv#nd>vqU6J^}nQ1G|5&T_o>Qp9^8QUZX?c)9S)VSpqhXNMg5 z9O*v__j`|kzX1pRdGP+}&v-U5SRU zd=5Q9{8nD&m-U)qbX(U(S%3ifxP#CRJnPyhYQ0A4XP#R%-ICur;PH7u5z{4cOnDJ_X7pwl=4mrlj!9kj5!s`RK!uyK_@2!jI_nrlBu?dg%R(Q`_ z@QwhlI~9;bIa0F)Z#qW~!GKZd^9l)bL)Q|n8!mG33cr8_FF;9HBPgEk#_0qp1kp zY4?Tm?^ufE8Y8p&zH@Hh=)uEAeb2dlds**W zo|ON#W1a~UMVjukku7m~xSdVXhU9xWgwKfwp08|^3_bR6p4{!Oz;L~y9*RR?kMm%> z@bh#tX1l<#UVO7TC=SyC;xH|M=^5CgoI~<`+*!uQugs4DaY*O*n0H-sELv{<7rSyv=$|-5Xm@;4AW~y&K!xH-zeD zB}^GIww1fXZ1e50znXoN-^F9P#Yfl@C9Nut(J<8t^BO*@K7lQu>}?T={aPr9DHip{ zmQ?1saKc8%wb^-4U?XmoLfGF+C^RIPR8>-SrXrkEb$s&8vkw)mD+-tGEc0W+n3#Wq z31i8aFb12AsXoDSJUeA$Z)19Iw_Nbyfvowm`K5)4mLt*@rNJ=OQ4v1bM3Z zY$GDKA#zAW-i--mNrSN!RUWsZiZ#!JYf6a9g&$Q1M4rO>kl>((@ThfSdPjbk({Gy8 zIurPk|EcQ3tkNf@lrkWG4}&oM>EU=7!c*v&e6z4ZP2DqFHrBkVZT8R3o}FClN1@cG zMHR}qgu?=R4{Hnn)?-HGpj*@W2Qi%`5!2B|Rn$FGy$3WIAGNGPC_U&F}3<9ycW&HXjkxYkUJkT^f9YDt9}4 zYyxHeetDCEvrEd~+na}duk34GO^)lZW=C-sOtp%`oGG!%R8ckz(qxC)n3N{sVHOoLO)dW`~@WBOfh)XK!#62 zX-rto#ZgpJcBTvsH5XFo;od&+@^s9N6ZNKWqg*^DP@`k2DJHrd#spyIH!|tfQ-l0Q z=1xx+d6NmFtb?JF>SYyId5i4@Y3YMmIK~cun2Bo4P5mZxrh0yUFlo{AaVV$tpR~{W zVsGnJJ|uQnik@QAgI!C%gy?$AP6gaX(cy&>8si{ab)3BrX8vJb?oLc3t;dwro#=(a zm{xiSz0h&Y0Sqrc5gvCIGhI24QsR9kJCAkfJZ#R_BmIQg#^fLyGgK1y4n5p8m0VQHL%Y&jLvPQP0*8Iv)@W@JKYq^&ia(B!}dUP54^ z9&$_%RaCL9p;(Mro@{)KMO8)PyGR|d>S}h6@aYY{J~h6pLS0nb>sL~?t_ZtRZOh*5 zukdA6)sOY{t?*@51@kct6nUYkGr~C~V7W~f+6aEv+8M;DkhY`FQ;u`>hW#4cuywd1 zJgjObj2y1gIh7Q17)$oV=WaZR3B2dl8Gndk#dqLit=m%8js<5&}DeF#<#vQ zRmmA%HO{8^RsNIlh1thGN5z?XI6N3AYFc2k1D#|T>!-vUu@GllI27;0GA<(q*VMId z9o@hD;l1g*pC6r(Ub{KIAy;dOZwp6cp+$|R5Zs(13v6JZd8&5Gyhj@5x7Z(cZnPP( zx5aIJCJynP9&JWA7k-#EEVlDQ&x)C(M`btMozv7YfqlNeA&jl;xObT7h)`V?MX;3r zQ8pFU2jYP>>VvtUO+4x(g6@cZ3sKvN|#m!EhEgE|%8~foCt!V72 zYq%BI!T9rR8W5UbufXjaE`XomvYmn2dcwFq;+kOyjEKzgjgPFqQw$ZO=8ML_zF04};j8&43#+|a`T4ZED>RM#V^8e@T2*0c1v4_MYd^8kP zl8T05!Ufik*HSaIdU#`PDk#*^+P(TkX`eaJw?~wN3@T6T1P5;tG7_F!{CCPo^1m+m+6clYXmh zX1}^dDvK$`va~5z_XPYr{UdQpto6ZT)9XcLaC?mN1Q^1@mZ4yxOO|dGZxnyDQPecAbZ8qltiK3FKIU-aCc{{&qgbM!tAP;}c5$KsO92R*pk+SDtU(Q{?ah^81Nt$;@UUJRZ;&$_4D{ZrKG)mSDx4*(#ekCJ$GR?d|QOqNk6@| zCq_JQ(+7_&t_q*0Hm`j1Ui66{OtLxqXx>^s+V_slN#3>#xbxfiY!OC~xJcABFOkhW7Rybu*O{_cO?C|CNTe zvwT9|=J4DdufVElkU?nR4qn+s$U#>#eDQiZSzJr8A!zH1v^|iFJAZMnpvoIIVtC^zJH71pB zPc9GXbs=wg1$e4%@XP zYZL>9PG^!OQ!U@)~hWIE?c&6 zflIT>WP7uWIU?S|;9U!_w#S_dDQ*=T0g4>AiYieuXcXKYzi( zf<=Wzcig$S_^u^OOG=k5Uvc-!Rb{JxvS#g1?^*X<;o;U7UwV1pD{ZgtKk(YY*Z=E{ zLx+L_jbL8Fk{`CIQKmX;p-|^Ic>CS)s>=zC1_85BEgz`D7p8fgmH(JL1{gtY$ zveaPZ(LM!DTi3mCPx57@SM{t)%D-a%v@=;x<^FZu`MbV!#%F*2(Bpnb?>F|`KEB}9 z-@p6%+JETJp1eBYy}R%{PX{K-CKIWQ_!#G!z*vQO1ma`=k&^!zN3zfdFV%9G;F^8y~}Hd&GI{b z`s809&s{ol+p#~rQdpa7~pq2{>xc!UVZ4}Z_+%!z3KF?Zu#b!{S%w(23@}9 zx5;H6U4MM^k1|?<59fHk+Wp1AO@Uv&d)>6tfA4Y6ho^Jq-}v^X1rM&Q{Jr;g)BgFw zmo0yE4V~*){Mhz~E+4;s>YAp1J@UnmuKT%u$+#b${=cDQmvcY5&inB@q1*npVDAHQ z#S5}7OnWzL^4w`np!Q zdjH~CkN3f8%Rj#1@6$fZJpb_E#d`NYT-NieKWy0c=5@)n@5c2QIXua)_TT?y>AC!&zM%tWetOI4uP?lE@2TOxzCH1ak*hC#>7&)J zPaN||@&Ny9Z}oinjzEgvF~ZgBqoLn?;P19z*0IMwYVGl1VfF|A`Mc25pRTy(!Md#8 z>1V!9nwR&dhaYPE{@rfCyx^4PzA^YNqASI>4`F>TGM zfdibg?)pW4&s!f~^WF_v4TeJh|KIwPd z;`!)@Gwa?y(){|WJ4d~F??|oR6My>K_(vZ7qy9`n!{iSp+*bW++^&!9&%RmI>#|>; zyS~?3-b)uh^42G#Gt!>;_2C=dZ1c94PTsP#<^Gl>-e-pGTR*4%V43sinqR#>{HlK^ z^j*^D-o<`L(c3qk{PBj@uTPn&2v3&%Zlk+JmKu<7f7| z_n#qukKS8fKXTX5l($A)8UEuBm)CCDJ-PkRKmCsQpWdH+;*vX0JwGoz{J{@?)9v>^ zYh7D-u*+*LFQtu0*tq7l>vDec)aVNrPF_=5^X8JSS01}%B)!rE&9`E(b|*7-4i9_Ojv1T_g8^F;*|lz3UpXd%p$$#fZr5Iv z?tVJQI{KQV8NY{?A(L!Gh%IUd1BUn3%B21Q5q_m5zR%*ehF_(P#26&$5|RGRhC}|w z+LyOV4#?aK85>rp|GSLO^(kzT)fo(c&inRWW5Lh1xQANY!^NBqdTzjBi<(8k{ExQC zn`fCY{5ngxU;C1V2Vv?8>_1QYQre%AHhe*`UE0$t!h>2(lsjMJ`YWW{aoDip$n{a- z^R>QF?giR*S$_O>OUDX;4@9{OG@S!*AeOI=UH&eY?k9x1P`k;_P)+mV(6u6HY>;2L z?~pFz#C?n3l|F>gHS-r*w8un?{3Pv8S$=&GVvAbgh4ND@^3yEtn=I};?M~#Av;>Du zyH)V&$1c7oQZC}((%}GS?<7B4yH?uE$j@Sn{EsYdmP!ZNqjoeP{=AMraCR+dapzmy z^DXWL7WYDnyTIaJWN{Z-+(j0*wLGomw^)qXsz@CBw0?7VM%te;3?D4p>m2ahhkCuN z|0;Zm#r>$o{l0V?@w;eu%JNY0D`b06ZgY!d`oEC%cNX{*j6(O3ZVdUtouqMY66p#Y zDHzqAF4HR$?(W(-nch>vovwvtd^kn^UXtx)zX-oV<2p);nEnupe!sEU=dUt8<52#u z7JQG?PlZ2W3BT8Zw^-s$hkpuIK<2(hiijV!;C*OuTlbZ|(PHoO7Wr+m{W1;Wd&x+m z`~R_oUuv<(o6=s(Aj^HRP1zB6%@S*Z2)|ydwBWsOvB!9e{k;-!3FNr1HQtd$i28kD zu@3|FsfGxHblK&wTIe?#{>*}!kI8vITVKzrX<> z!2wTM5qD;Xye_*e>aO#m3u0Z?<)xEx)OUu-k|%~&@=TL+XDCAqzvPL*Y^!e(d3{pr z5wi-Y?+<&Lc(9r-FL6RodArevGP2(Aib|g0#gdQM#~gPU0zpE5c?}c#fM;CNMazZC zf|xh`Ho+P;k@%d0q)XkrJl9%No%9H>git>9fraM6L)N8)vX{);=PwaJ)?}c-X zk!5-z4wF`D@8%;_TE7oGkEe z$x~m>ZzaxP@FZmi2YG1+VJmaJVgm&snx?ZNfP~!^7`(96LWB3>q}m1bP~TBg4`nN1 zH)$);PA@|sNR%UZ>cVSTDtPKLPx7?YD#=rq`z258UrC?ZRo>^9Tzr%w7(gBNy_{Uk5{+~=Ca zxa3(rJtWU`e3EB6VyES!{ZrZDfrNd)GoHAP zfM@s^9F$?YB>g7iEbxD5@B)9i!HfJ}Z}1|&w;DY4(;*L4MW0AM6FlAOTW&A;AK?eY zFrAqOW#P~Z1Z&iDcDkU!IP?<1iaCe+3WFa-f8bBSnfmKF_yOhMP~QxXBR>Q`pj;g4 z8{nzr+0a4Lap)8T&BUShK%YgP7X;94IP{5v)#i~W7-#_wos9`ph(n(wSZy)+yA6IR z`I`-%=A+Kc!YawH#W@j2>J|6_(N^RWaL$mt1LqNvr|o|rdD@=Ui}LiJCwZ0wO-X;& zXQn}(*cFoZ;#@2FOq`n~PnqK;{sYNp;rxx{2jbj~?OI~?lswBy^xM*ZzDee%k{cxkT~_ICqmg(6P)dvVrSCxOZIMP5qjiS@T|q>d7- zas2|%a26;1sRK!;u|cA&uQhm4*5D~m{Zhe4C z10!EC^AkwpYfa-TQ_JcG{A%)|0peRx6+x|Puw+4SdGKmEA$=|f=;XTo{2D&?r_f?3 zPbOpR0br8t{AuUK#G?{kylDQ_tBf5QzAe#Z3l|p%B`^AAypft!PJD2yGHDnHpUE4R zv_M@<%KSNP$8HnhOP0o{?n@&ZmRu~kZ`q7QRX1)} z(viG*@0!m0kwovbp`lpj7e~i7S~z{Lj-~Ok(!1v_Ux{r?Vg+LGT?WS3hQ?6WXaLv- z=dJ}N(TiCzwscHei5}+r;#!2w)>G?dEL&b`Ud=*$dS0{`d#hlE!jj@BgQLcpD{=># zk>&Y?3+LZ?@tPuoEsJBs{FFVaW&<*6wF_&qvQpm}QI%O>C9t&xIzXSgt|CUQKr`FNi446pf`PxYbb9 z);P?k@G#j>X|wvyrN-66lJdpEg~}@M&hLn93KticsO(&gEqRuAY{z3+9cFHRa9KxS ztW`B)^d4-BOYY)YATa{j7LCB~)fPKMzfW82kp8Z=*dci_TvJ=5a7Q&(cN1zjW-L!?qyLk1lqc9z1qtXP~a z`4?)h8Wy`!t{NK45-d{~NrhPrVG52>Fsp`KB&qC(KQzw1Ive-3-9Z9%F7xWMOlIOiPX_#?}{PLcf)ECcnRyp2S|kYk)29Hb*Aym+`3-qRMm zMuf%E?>{Yg-?#z^LmYUM6@5@qbR(E7Q9}-n}u*i z3U8hTZ@SlbS46z7I22xQ3*K_zDGXvNo@?SFC{kZm!NKQ3MN00BrQB-0MtLyZBpfQ; zi6}%f9^aiP3}PyNfJJTtNJgL`(VZ0A8&6GS*VQ zzw>tBbu-~{-5Ya0eg}tqoQG6LKGH0BZ+Sb~2Vb`;{r-i@XvX8W?}!>9mEVsbXU^|A zZ-;(-=2v(xS@3dz_f!O}L%%;*@REETcpOtuc-*(gtluZV%Zh>b9OM`$M}}nqZytD- zM{gVoZ=(f|H`9W58hG+Gi-1&kH(BrooA9nQ;q6A}VAd}e0Or0|;XMmEvwrh{r}BH1 z3Gdeyyfui#IcAC!-ewEl5#TjKi23b{gL1Urd@yGHxYiEsqDbNW7!3Iw8BmT)-Ups| z{ctdhc%#6W@s0qGb0!o~jx-bu`5Zbxj!a`N81V+sje~gQwrIR8)Z1A7=}#bM#(M~O zxrk3ZzIRf1`4+q!;N6RGMU*4mZozxsgvYTdh4(%#sOJ2#{lzNZcOb_&IXFm}DAWx& zQ$Jqs72Y2#c$_E0Ie3aFN7`+{dj@!_eEB+3;c+b{vwmFD!b<>23h!l0esAkzyu+k^ zc*PgNtGD3I1Ku(PCgtelT3E!+p#!u7c=K>39^bbr{eFY`Vb*n=e%rvC^;?5>pQON~9G#C#K8Fra9qOe5b-ABPB83zUO6q;bGg`b~pd<@X!( z8|L!3A9(CH6j6@!1?0%*&;cqm>30*{3h!zQ-Y_VKsudxH*Uy4i3%q%dVtM4@Pn(Vz zfVTwUij;oWTJY8YFB3x4kHgFn{Ve%Cc`^Mg`K>eQH`|0a$%6M8@cJNJk-vFL!zpVcXZ#ViUmd6kSPRj(|1Cr;7VLZ+x z7-yC4PROCEMu;+`28pNS_Cn4pLX00JS8b6yb`iOe7CAml#KOD6BImt`T!U=CO1~V) zsr^2vq0;YX7P)FXY{ioM5`8h_D7?4uaAI!13XgkknB~@ZH0=o{C`rjpwBY&haN<=$ zI4ikXl2_^aA?J@F_okEstf2cK$Ff(X_+c`?N-lH}IgX7}hrtrye#k9QU^p|3M}fTV ztDw`6GZSS(YqGi2DGSVRFxLcd6`|&^Y8k zMqp0+pe|}1h)8&sh7?<6PuGElmLXV5BGDwGaMs$~HczD?_;@huX08Cj?%-(EGGpAOV=6R!^fAI_vJTDJ`DcX!7GscSeU!CHMxF3vwK2z)wSK8h({V zm`8#&ti<|UNa~mq!Aat`m-x*Rzx>j_p*2VRP8Gki2J+igD5Z9*GTRPmVI_>#HAogI z@!MynTT%CrJl937--Yx&8Tz-XXn^CFvZdHsFRf2ncPMHk(9qfo@C~h5>%=#=6&bxf z*o-gZa!;1c9gj@ijzyPxS8s*hrLSbB--3|J;h!{Q^ftts>x})~EIBdKYBmtvg-yHYX4>TNjnp`zhN^5?R#*Tav4cQj49E!1ePNWdvFZKx(r4;B1 z40k#)RujXWXojE-=xL+<3Db9r*g93%NUjfN(q~RYpWPk$s5OzIKH}}j2R;Qy+IJu( zwowy1cWxI+av=~TD08FMa}sN0?Tr3Toyy?*Wp~=dmbf6M7mU!Vd};x>M_s6{Esmn( z&{^p)-tODs%w)gCTZ!r zkoP8I6}4j5ge$nZ)xO@^196)Z9*EyG>Q0C^*;|q~>j%3a5*8$RF0NJ&wYr_2thmtG zK;yafDVk@ZBb1z$#Z zVOmvo`ZFRkyOIya8_QOFl}LNBBzAFSlfYN579Ejl+AciT&o;pev(#p9>So(_mA2zZ z(t#Hl+gNsGf{$y0?7Kp{b<=8riDgs77v%3b4?Jen=a9|4c~fojnsepP?r^(lW3JZ{ z*zYis)L7>OAK76^muHn7mOS^_zC@&0(5=5fMDV_NtsuAO>B{6CA#anj@|Ve>6JaZGEWYy zqF^le6iJJXR+Tl{OcVS2=dQXu9<6lBKQYFwKn%0AGQ?7m93>Q;eo`!wYW06M{l-& zKHLHS-luEEX%%hfD$=xyabg{Uak|Ky$u^#Vkr~4tr<~_`jbXM#d{aeHaZFy{i&Z^U zxoMrb?-OxE*yy>jrU%=dHa6G|M&im$aC@#5I)+;7(X>ak7o91q51kznOvZ-Oo>4Zp zTmt;2$-t4@B4QFRvm!k2+D6I@UG(7D&>2rw7bO5>p;2IekpOHEYXcfyTMFIjKp)~u zM$6_-uZuF!nIz(>1IPXX)em6v(_gDEuj_W0R{ zCY2Ng%htKMS{jz?stJ0gC9HK7+h+Juuo_x*U*yTo`yD&4T=-2Nhjl#4?@L-V>Munb zOR?{_%$3{L>oq`&E9n>q%-X+^5i=&%oGoc@&+uJ_onH^3M=0Fs*^gzk*8iC6E6qB- z{%=|+JTFu+D8W-0=eE1kst&PS!}A_&)q3QF4r!tK2A`)cl+^4?+0j_h>bq?FZSyu) zY({GI5=0@tP-4$o`wrJ|>a6FYeadM2k2?fc-aO)yUJHyRk7I*ZMJOR7M}6y`;CXTcJmHtd%ww6y?e|46GE9IVXX54 zQ$JvTG%nCHVg0|`L;lkttQ)$aHfdIN1GXji-8%ZY#Glpd&vd&R>I=8mH|*CoyJ}v| zoU%RrwO49CRhk%TU}dt8uyW;P`E6-=xI2y?m5sIH;q4g8PQ*qT-NCh#4irp$_-s==Hjzbrops!~ zOv~UoRN^`5L{b&`y$u6~k}C2qU+-acOLb3v)KR%xe>5IHYh8(3tMAadO_OFC*1R77Do;K%1luS3_LWYI}Ju7kh)?ERh4h=ylFJq;_l)z-H zv}QDWR#B(8ym_{ytaT0Xc~l6{RkK8!1ltrJ_$X0?=C|Q;%i8=Tej4_%8Mx!ncTii@ zr8%Oe-?HeJr%LPELmQXQN`h%?cWw!tNYIcIlw7kf8H@IDm7=n+XM5M{&_x;Q%sP$& zaK|g8)uJm}xoFd=COelu@}<;llo zbi#p4OucAyDA9_n-sq<)Q~FMGRn)cDZY-}#a`)J4D|x8(w2mcNputShuP)=EW;!kw_9XS;2!Yr<3Q&XLIc z6*Y8nAomZphju2eLY}G)xzo^_yAvvc-EPOyd?@|HZK!9dO?DP=Vu-6Y1zabf$7+_n zG82}jv>oATA)W99~tmA|fE>yR~p`QJpJMnNV+7^u=dVJU-@DZDZ z;g6)@GwYD^dECC4?=`>k-ss!zsj<%FqqfkiKHQ*Wxk6uhj&vE+Wp;LvUY0!Cm+#A* zVXWK9+w22R;HTkbKDna5uvdhW&{e?umXW_aiw83 zg}yz`HvLF4WZ{>ATkM<@;Ux5FO>ujiN98)K&7%3k1GyaJ5)bG|06mCPJFs%(CTtg< z14AG%a+CQTH)oOiVZ<>W75MmyhVAy?_MHoXd8+MezHSn}cf`3b0X)jYeh|0)=PyB| z^={si!HYL?#jZd=tl7mr*onI}AuL0l6HdDnuFi0{SOvC==po(9e8W zNAjet$UiA>>`S=83qlv}bMM)&m-$9#m%hxKzIb}f(eX4TxGj3`(^6;Lx`AuVZZXzd z?R^@px6!xCk9zDl>Ok{F>Dta8c)roc=ThZ!;%lr59uGIK7lT}D?Sa;>4!qsyYe5%d z)QHwE^YDt**Wy2zI4bWbdujlco;xtq5K=xfz8I~$6G!>cmqWwtT|?Q;ZE1x*Jn&N%t9M%r9=?5!}oi zQy~_jE71Bc@Y!w2N8N^W>p$r}n0Ul*sM>nUa4SVyKauF!GW=udPL}aM61v!ra6N3| ze;CTfbCFNv0}D+ww!0G>DU0`d!r)M2!ehLo2|esp(58{rqXJ*?+F(Nlz8@icY`eSsfTY%1+*Z-4lX3utss_C4@;xcdBTUs3XuiFu-3 z@@>wV&$sq@ktGIxYoA@Sv9N4fP_~qYFzWzv1+zNZe5etkhK$9s-Mmd`iWm1{DANqR zA)E%!5Z}gRCHL)VgHG^5Cy81~7`|(TpKM)_s_4tbd++scZLzI?1Ix3cn-Ch_@oAB- zFn)$uJFtm80~2DGA(EaE5A9b%`)q-a8>%?%;hsz#OGC$tCg+)PVf|%H94`-H0(>Ud zGsj(9n_RiMJ3M!4Tzl2?9u_NBd{6SmdlI>h@>xa~*jc{5TV!6K2XrvM_pq+tKEjW3 zK_L{{PzZ%KW65AD{_s~?^D9%C5xTINdH-}_3m;#Z<8~hPmbs5(fr*ktcf^hXFAml* z43QG6Yx;KIRQuPOx(l0XySN9)@bj!}k@|zW6je{eJMlCd?h(>#t+)vnYZ!CIdfIi6 zYfV;VO{UO6{FG*NUwW@Uy>K1%#CY=yoa!sud;0v7CMF}9ibOJwf4}bu!bj%j$B*lQ_nfQ6yTyyGF~!5v_RwrYpNnG zIPccn&V4q%32hL1Py-aG`$%QVJa=tn&C`8ew(aYS-fhi5qrr(j8xcSF#+~Sct>R&A z8${U;o17w_0K*v(`oywlCqQU7M?7zu$b#6?Nm zY}AXr8;qB&anHTv-e=dwluaD%a=*K&R;=mDcNQ!g871;=39nsq+wt19?JMWkNE3U6 zsPtl;N7Q4DPw3=1XREbus_nlkd$x~d-%z~_TB97edNc0+#JEiL&A6$-rVUQd9IYjL zP$Cu>uEQ`*^?WqWc=!aiUnt71sJmah34&@cSUzs;U_DkiV@!jbuf6@0!*g{UD%ar` zvl_xlA`b3}A$raSfk$0|A}oh%0JZQ|F)-OC+;}2A&4fCmd^PyG7B?d~qlFRTVZeQk-{&7n;-3%lZ82siip#mH1M5JYDissFKT z`9JX+u@1fKU=%>F${<%qhk4oaO17fz5%IE*$+Jo1hganZYvRSmljs2XxQ-Vj;hExT z*W`tT+!5eT&lVBwXaR^9*jvtrr&CfiAWRkk6yFJ7)u9>>uW zu_cT-!in%q#A&jHr1&2lDs7ZwLwFS~O_BI2#QiH=z@UW377OugIF0E`Ku@c-=G>yJ zc;r)DITS_&y&*gkX}|zR_9Kb0e~|_GKV9ec+v>rH<66;~NykSY$_OUGu5L$FcoN@E zPO=B_<1DLhi!b%{>XqojXWKhbc?#C=H>sK818 zd0U9j0Pua{3xYJRYsr4Twr|MQ;(NZ<8^R#l^R+#utV|yl+BmWHx6=}Cw@rAf-5uvn z4Y>Y2;k|ZuH#{2$LZ7XF$J#JWhQz&M3F@-(L?#~6D7GjTM5Dr` zNKvGSibfQ$UDOyf7C?=FCL$3P8;GD63nGXuCidP7wpb7qzH?@0U|G;4&-=Z9e9!0T zvcH)*^P4kg&dkp4y>}<2s^~?vtQRzol^FB^N{pCOkzk7JQK$zBD^!zA7k6rg9}$9q zjUN;GGMxU5EvgpX>zj9T;1h~LAZh=U(4Buo9+#Rbl9+HPYwNO#2aLXA22aYnFU$ z+CZyL&VxsQ-Jzq1)m3U-0xxIi62@F>Z2b6Bkvi;s;d`W+`-;Oy$-VCh13s>li))4_^rmSI^2S zz&OABl~UF2h#9Ubiw*cU>JR!P(}Wj)lZxQ6R82)H1@OR%RkY|yHTbrdGu(Tqz~f)? zNm1T=ypMuOK>{x2dAS1bOYq(sW0mi+)T1Tj)*nZJXXV>0b+~O-y+&d!-hx%&mK(&O zFsP^fMqxFgxLJnt;S&7i(T**p~(h?;ZWfDKJ?vRV8MOf}&4FchiV<4`mn zRE2J@DQ0WH2|tqr&wQX>epHrDSNIxVRFe~}`KL7CVVBMLxlkQy2gM$@54IW@G0Vfz z+4``4Cpno&K||33(vm`M7N`>|^D7teG# z;}2>A1Ir3#d{dB5Fo1QqYLeCBPAy={H&qy5LE!|XT~*}HMa$tnK&4FMnkpF-@EII( zYC=_n(Lx^-bBHMICkH>3(+6Q-;!M4PromQ@5zumXIgD3qxaT-sKq}ySnqM4T&zl@!!%$_tdJU<_-vP$8p~ zUyzTJD4a_(;OQUM$0?j)5e`yH1nr_gPF93HiOt44 zPvc1AVCPx#^uku41ynRaB~&d7+h00bXOd@k7(_7EVa|q6dT>SLscr;Ub-ywd9W(4- zj}x$YTj?BV8}>}ig2iC)B%O9;nx2MLIt!wm6HLPu@#a=b(u3rKvF-wV-~m*l8(A($ zjW7O~U=Y3_eo1^}@k3aFn$B{DwMS{kU4^aSsiR7$<~0om4=@wR+sUF06q~V*%OKi0^7v~V zMUdP$;8l@?^MIRA7=N&L2DLT$JPj;83AS~xB`X7T_%5)X6wNy@&#|QyxqtefUe}R_ ze;fn#@T&u|oC1INud4&1A*>HZ@aqGdeoLp3>nV&}bgka-s2%+dr!{mmPhUx3V>MZ` zSbzOpbWH&ZBh0B;AJl6%spQ|RLuRV;YYs3mS$3%7LZqWwsoy#B@D#3|uw;OwckmFA zEKI-wNWug9coi-;e8L5;Zjl=0_{9r+T`lU-@#oLU` zfzB|d9IO=1i;X1?&Ruk}bnvM;j3dt_a35YBdqlr?negRl8=Eh)zD zC&O2NNjm->0KP^|um<236eB?s?k4=D??9s%1siipOor_~@cpMsgdBWT9)A-_cys}` z;gkep9t)QLEm(2=8xC&P-TPbj?`LIi*}uD^ZTIfZ_O`BW{aqdUadvLb-TT`(I6B)n zxH!1*wO^>S|}}0zJ^*p`TkndmDRaOE*U=YZqI`?lvynU7#y%yMqS*XW_qhlc@h3INbbZ zxXH*dbQ>MmBF8UmD!fBvYLrP>xVIm?KqsoR3BEPNguJoGWB}VSM^Feh%xR!dSX59z zBwwnw%+Ro@QGsEh0gBB0HPFYnrA3q+PQE5t|YI{TU|{oZB!6 z@y#c*=k#>W-EQo8r}E{-qal~2KR#J+o&9N%ue!1Kz+BFI{p$Qp!JmtY(5TO(gy);A>rO~F7O*13=VKexOW7z zKmWY<2Q5qssFGhfvC{C{67qIRVceuP0!Wqo3amCswa%~QFdu%%CJ3rEzkJ~nRqOn^ z80E1QwE>>W*G2%Ta!#VSt0?X+iVxvN;>8d`3LGlr&734k{;0y6MxCj>FOmF%wV8la z>&cH2<>N1jYJ)0yE2%K{^7NmfK;KDL^_x+LtKTM zEy|A;#l`t^xOcedfq>mAfsO438;~e>1Wqd4Vc3A4kGqigUtA*1$KO?}aQFF4`d5{k zD~iX8;^Ou#5alblxzv8xjbKtq-#T#>NU9C04)&^BBmwQ;JzpA)Pb>g3Dg#oE@;`;JM`Qq`Z6y+Zl#gB^OMckj% zA9_NL3Rfh`FBZj1MDdfN_$g8Rj3|Ci6hAMD|0RlF;6zRX=I^EU?grS9bKz!)+T%szT}Xa^Zj&f~p2!|nBK-^m9)$I= z5mHY0265{|G+K=yW!O$5F zLwI{o7>#!)@o}7z`lknp`*N@wC<&${K9Mt`@xCNJ2{t?y=7(^vY5(Gt-;i6*Inf_c zO;TWNdJNcojqYdRinNPG>qo9fSx?-UN-v4-JWI1IU8I9)nF;JZ)^VfTj< zG~bWp|Hf^k`EN)(vu3ZRZX~{)vk;A+^ThF_zpNMK?-a$KiN;fa zDBnXA2Q_Q<4#1`v3G|gjVlG|VMerEioxRVW$kX;CE$%~vQJj+5oW3!n1^zK?*h>IZ#}~vy_)1 z@O4X6b}yIWI$O_!EzjPLjxD913iopf(g^IbuVo5b;o& zjvSs8vo4jafCLDnE~*cyi`GkYqvH*y86&_b+lpe8#US~aKNA}Y#-n64pHBJ+322b4 zctm6^kr}r-%Ajt?Y>VrYDfj^VBP<|p$ulMaC+Xyh`6Pb;? zJgO^6EaLOn^pZ-zt&L}%JxMCV`mbfPnDJJI1eFoQ#qL?Eu0I3v7p zLePN&G1l3QV&rh67`a0!Hi0wIALOwu^JzNjxQb%bF@s{%F_&WG`IBPQ1p~7)a?=SqrA;EcSIE${~d@of}lKBBJwig4NGf7z!l0@>1 z0ApD*I1po5Qdd_15Qsjed>S^@2rvthT|6T4yLpWDvHm4KOy>>Kr>l4w(x*Znru}Gw zW$8SC`mp_O%n_%-9|+h+$sPj9lPbvs9@}ENH;)|<@8xkX#B{E6MZAwsAA*?9`NI+W z^Xa1yPvWr`Vn-g2M@)Us2XPLcj>Xu189|7r^666$;~xm&a7cO*NS@(He&R9di}pMw zehXL)qQq|jV_y(o1#AM?9S$SF*ruTrqmIE8%ixTzi85&WJc^Cre4Jvm{auQ&KVMO7 z0_Qgrqx}LUJdYD#T)!fxE8w*hV_lai9s>9!#aI{K51>5iYeF&FcpJrNV|)(~%AgJl z1-LyJ0Mn7*kz#Ye{uE=oVkpKwSxYhUlvC^v*ct{W@=O6dh~gl?V=2Zy!FTwej27TE z6h{Frq1XrTZHlq1HVg)o$M)`{7~9nw)-0HA26!CBy#NPMjJj>47~AqY#hn3fr`Qs( z927wwTfop1P9hwGFkxdFav9;|4S~ogcnn23i4Bj@cFb?lUd;EfZ`hoPe!#{Bs8F*{ zO*@K_dmzQg9ZfNECs2&sIE-=s8sx@l8ZmNXVDkXcGnr2#deU|gJ?Xqb^jyWu5IyNw zBYM)YhHYopH50^i-hi&)jBvt(pa%zHtka5OtkacZtaBvA$Tv}t9!fFlGKXRlI4dZ| zvZTGhk21M59rZ1vxTfv1AOQktFKs(%FD}p^koL-XOxpW1k4bw&cwDc&{(QO_oFvp% z;GUe3EuW5@h_UT3^%IQs51<&!c?d90mne^VWl)S97C4q6-3YKF#i-X|iczmJicJ7x zU~4L@oAoa`sW2?6V1{fP3o{|*MM4>9r)p9GBg-Dx`Vkv@WS)S37sVC2If z+0UP)a5Cz}WBkkXB>K>64e1L7FGKX9eMI_V6rWD|g8G{Y@@(YO(WY!|Y>s#~pWYcU zDhR<64oL=qWNfqRh&Ch{_2$!22gKOkP6FJIV$@eoG0KKfjQTF581>yuG4hb{2%M;U zE=@-p7Eo*g=lc{R=QD~)o3MYOEY_<=u`S@v6eE8xim~196l1$RDaLk(3*=`|jQU{t z&-O(cWI`Z)ktx%MsrOjJjccn2zlt;~g*t2RJYt+vP$r%3yb5I&u>o&=?Sq zOLCAver#^#G11{y9vi~R$eAzq4aLZ5K{1>-dy0{d)CKaWgC9*tJ`9pW{29x$d0rK; z5h@FzDIAC~pR^G$>We|5Bqx4th7LjlyB8zvQu2v})0M|~dtd~(hG#XOPTIbi$Ed4> zwwJX1H$I(=gM2nSZFv7@CfJGblz~7E_G6 zoE4rcXolL`dF zxs=DmKGbf+KJ;2f?6aJgA@*6pV|6$g;RFnU*dH*~GY$?+$9nuI#(Ky#2-2~h=`ZqZr$ZK|K(@OG=Y;5V63wR#aO2~#VFgCVyx4ZVyx4j zVyrWeVyrWgViP!%aRmIBj>}4{3wbcGJq@vL2^t;(X)j$HVBPFqlC-y!i161Yx~_v} zaz?nQgkS;(V&o$}0~q;iX*%+uTcZr}O{N&zGL>R1yIFvDQ;a;h6eAA?$w~f9^r!j| zo%8v0qBCt5*1_gC(nouF8PZ3%fQ4WJ2kUFnuF;rE*I;E4#X&HPBG?VVC!4LL)%Mus2`HP^C6=AIv+5~ zlItVj8lGrgrk*~h_;g}V>KnwKv@T*#YC~)r8^35H)<-6YX}_2u4uU@r%;8{ro1&d1 zv|lU{{|tX15dD35O!@^d>PY+qFzW9DhY?`Z(T!r%#h+r7pG`69h15)*j1ee{@_T4H zw(kwa*ghHd9mtpf{)S?dA=d>+$2O7mHejslM=FEudq6R^Zo{wQ0*w`U< zrftVM*qll1Onrvf`7|=nIiLEB3B=j;7jQC!w7H^5sZffU#UBIE(;eU2`eMx)La^sf+4Q z>Y4(X5U>neACh%@7)d7kP#FP6*$_Aoqb!k+g0&b7OyZM(rvWyBJY0v&2i%$B9|1d1 zyaBK)#ajRmr#KrhOp&B)A>bg2O92BNN&gdYEX6kfFQfPo;3SH1FCPr30|wGY!06XZ zXBeLRbpg_Gh>?B-d=#(|9Aq5@XAFotfX^}>d`8Q7G617}QRWd~#)F?VGoHzSi9B`) z1cK-Bc#x__pT0lD)ZK#)cFZGNdIrx9@D7chO*3mZp=&sw?wuFzJry^Co$~p@4dvGq z_79uxJ0$=&zxzzp4GNIr!c74i*p>NndxNq~6+gREbDa#q4x07rBO5o;J)QrlI-x9M z!aW;>>7S{L-|^5dESzl#&ANv1!1uqs>j~Af(LWH7Y{rP1@d<3J>Y6EdtsJ% zM|+lslLA_PS`fIh-}I=nG#k5xrOt zDP{?D?rA~6lcKy?$$I3qLyvU-7b<92vOz*J_Wli@KoGVg_6rUF@{p<(U^ZthMcebk z4rN#>X}^3@06K_2T!G}DNPxg+CMQciH6mKt+ay!r`FLOM%0vm zx=E9Qr%a(s^E#sZYW;KOgYol)meuBxMzMhjzrBl+7{RyeSb1&D8eKh7ScaP2y(D_&W={c(GHL4OEq;+JK?QzwOaPl^l+ z^`0sZWwH%T0ACQVry+Wgz`?)J+=e9^B1Dh-*PLQu)^2nJ;oYY9l-h2taT5Oi60<&I zIo>HJMFud5hU_H}VzmoO)N3JIXb5B)Vr@XI9u>dT_y;0^5K|8gKuQS{f~U^#4h{2f z$P_4#{Rg8*AR^XUEF~m|wS%B!orbVtwRL}vxK^Sb0e^Xh8Lg%P4UyEBsz*eoyDyT| zm8eHR=Eg4))Rm}1fJ0k6{BXzzvu+W$>K_Z#qer^h^}?5#KPOv{RID?91NVj5;By6V zp2IfPF7)b9k%}>&bV6`+fY>e#<<-*`Tp7xLK|3nI92iOYQ8Xn??q74Y@RLuO66Ply zFGO=(D8X0?h>Y@vCpe;7J}*(zwAu%T4Hs`Hzou}Vr$-Ic-B5l_Vfs9<;c5k$(1@4v#wu2Aw=;LW3-yR-#AHomyXn;q^B;>)vX2kf}C%ie1>lWK#2Mcm_%KGur+~Z`SbzqU z!*CtsgnX$2K3&LXd=o@`n`s_$U|@V+BED?`zD87z^oNKq1M={*9u^p%g@`X#z-Iu$ zOusC>y6r87yoUTG1LUxb6C4KFk@tuJ@{7j1lrr#V9-&Fx04kxBx z4-wx-$ivS%Szvtl{c&NxHG>GtLs^DLgB)TfOoZ@SU>9r;=AoS(M0~A)5A#`Id^RFJ z{K5^EN4uckFutcEK3m9d$j%Q$d@|r;cE-nA2 zCJ|rkXY~6;#Meu}XCmO6C*o58UsuRyf!S}ih;NjDuN?@p_FjWQ02DRzX)Z(<2XZoe z5#$g%VIqVnz{mQ-4C0uF@dF~heBf)yul9-fq6K{Ty#>ZM2R=9y>WA+z!Os#|KsgLE zArY|?Mj$KzK1(>GznH_B@r@JlJ%oH8$Y+7^jTZ6k0lr=!gnSloW_&gxK6e$~4r0Ep zBEA>EXGZxt3-}s|_(lOA%CW%o(-!d=Io0x^KQR5OL0|Y^)4$Qc$2gFa;Ytuf?1YIB z9Gq(V*An84?~aIX4)Arv0yHo_d{>N+&(*1x&l+SI-$4=I=FjN2U&J?Dz=vx9#yV{UM+6JpwG$FADff zAdLmacNY>6JJF1%0N8xx4rz?<5MUwSD&Q-pW$?uK@+fw~LRVX!1Mjq!DZIQ*{}Z`&XPfA7HpV6f{(GIs z_Zf@>IQOH#t9=3qFrkB8xC>I!|Pi|07Aa=z?TB)ET9~Q zb^s7NVFbcO;F|(x)NcfwF%S9hcY8vxI* z3`<3P!-0?avnS*;{U(X{HbcB2{p2FPAc1~f0=~W?zHJc4`IZHyUk?#qlt906Ak6gp zUNj%vg>nt)=P8;GmI?UA3;66rd{2STlqpB$Fls5{+brOlNae79bKrhK*uVO)E`v*V zOW$mRtWU-2Vth)UAT!9wl@~|V5w6R7~c($L+nIz)Ld)VFOwjR@u`Z|lS<%gsDG>U z>hhTbAGQPA8zkVn3UWgIih<9R>VPM#7sCY+pDpmQ@eu;~OuuiT5+NVnk3muSa1HN65&H}TaxrnbBkl{Rvd^6z8`eQK|3zBNC9~XhojFC|}jK+f; zmT|%egeky>{fd0(4~)-O#P<>SE@J^2P!7Wc5#L4NON4afn+<2iH(m6c<|2%Hb0naF z@r8??(*zBy)o%{SGQRO5K70s)Yk3wJ-xv|!dEi?BLa5(dI5WN#Ms@9X6XNIxEHJ)h zkdD}iW_S&%?cZ2PV|-B}z6yx{Ov~Vj@r8-_QU!eR0=^xh_AY~mB#cAImnmxRL*PSy z!}cx^@U0N>B?4btB%*-7Vs?sS(HP5d)2!3+X;LQlnYOc&l=WsHo;KT950&8!fh%X=bMu8COw;ax_y{RI;iqGh`PQ<4_v{pYHcZ@Ga#HSC9O=HSY zIgGOVY$uFBZ~{IU!bHE7aAth?E+sTSEHg;h1AN%;EU@-A5?zlJz=w9m_O606<9n)G zmrn^oHjIqQVe|pWVHqckKu85XGdLsP8aOk)OwslHHSl2`3k?4%x}F~eK5Pf_CBd2T zEf(=r0ACA6M&&RXFXB5R;7g%$$R8u}XMA^#7820F^othx^Ht!3s)>H<;mq`#DB^1c zeBUxMDu>arBEHuGzF(*u>Zb<8!v1v!J`+f1f$3K*;*)(>>o2Jw%=Eh}(k}@3@V##= zFh2YZ0AeSaF$(w=0LK1Ehcn|-iuhuoGvJb56ByqC5#L4NWA@uD;M*wTO9Vc@8aBRO zjHZbAUI3pZq@#Yn!I|l|1^_mXjgQyBX995+n0_k&AaFvIHP`Jw-e4x zztJMTRltYu1!RHo4HxmrJZkxHJ;wO7b?e%%bDM_krw(#h#)($+0{F0fsNWtqGrpIQ zi0UwZaR9y!v<#k@eosM8$oCQW%pf26_E9c>!NEq@#WZsT{V~1=hDh`z4t)Y`@+hhdMaHf#D4B`M??Z zlyGMHwHNW_n{ebk-XKB(Yi}D7pCv2~n0|*rlJT7s@x_`p?0?5ad>O!J20WNllh!_PZMf}Bu46R+C&;HrSHyNE9d_;4Qt7MOlkBEBTx zTL40+-*q@M{T}Jp)z7O_!~KiTQH1)n8e8jsHwAn}B0hiMYiNEc6!AF;_-+gM7K{8P z^)vd#i~Pl3z;{=`=P%;h27Hc?&jPj)gSUuJA>g|Y`OJPzME>#+_#mk!Fg|^ezib1( zULb}2@et08?``9{{qYg_JZji@IgGvpIV|IZ5eN?je2*c{_(qBJ8*b6Ce#1oinT@NR zpPvf&>_vS3z?X;$(7@VjE#eyme5}3CK$htzZBn;8P z%-UgY+3-3n6Xb;Lh=L1`JCs8^zlSqx$0HG+(`WeZium#cd>;gS_&F7b*0k3P_yo_zIFqx0cCfy{bmY^gI>$jA_0xx=o0XNli6B_k!+c72 zTU(N2W$9>VO`wnVJhvhJB@$L6);+PNexQbTM)7&J7=fqN(byrPkeMV(5JX+B)Rz}z ze}(@83&du_p5299j0*09iMwRuPOq9bwKzvjou6gJYjail-{aD%t5cIxlccFqE)E{i z1vZfd#RnS6jC}(eui&`kwF!%ZXRfHOPPR|z7~B-V%E0E3zB16zH_*U0P#sxX$+gW*3-DUx=6v>qlhj4#fxJ2FhSu*`vtWs|9CWQs4ChVM-L``=BY;ldH4Hu=BBZ@~?bop_0D zzg6ob)DmEqf9E9C)%~5AC8FzV3chPEOGvJD?Ejf9;saaz1~y9%Y})z-c=Z1ZIyZ*x zdJ;5EtE*eT=!JwhR_Yl6Z1GPNU0`!32Tkv$gel(KzklB}gn z1|_5wx|#E4>1OGGP?l_GmHyyslMhx*h&g? zC&)mH3A%ZEmGkrmKl`NXne$23TBcW~7o+=0>fWftHYluz=h#MNx&v$^WqLz(L5rb! zB}dN$>JP4t(evC#q(h0cL!*%PUO!p54Qv#uYi}(H)$6SbRrJ;i@jEkym)`p+^Y@a> zki7I_eN+h)(vH^4Bg%jl1-eX!#Z@&rXcHZV{YxFRi4I|3)*&xHA};@RRtM{5`uhED0uTiXpzH(tn% z^>uXd@pTR!@yfS}wQu8DD;*=@TKCG=(Aw9)+E@S4E5~z}4m+mr+~vH>*GRd`d4GK3 zO6TO;vGL9cyCPuNX>#el#_5NL0FY_L`?gU?;(c3N`!-AWh3SdcCw6Bw89)4<@K5TE zgQRHp+?1oaS~6W(^DOCp`SG5TEby@by(FJ>Gk4@ROMRkDP4y{|Zs`NIPu*damzk?@ zD9+m*Bi$co-xF*%%OE^cSs;y$n~4%TGnKjKc_AQ=p2N#0nP1F{ERc4zhm`#ikSLG_ zI}^`( zECZDpUQogAVV17)kX7dI6>%?~DO0PI@0)??%B4ZhTlz}M(HM_2 z!|y8}SH3qdm)0azW>{rDt(-f{AxruI<_Fyu)mAam<9)!gvkz1r$oxImG_T}@I~cSV zGw7g_6JEl2kG%asTY5@1U=1lL>8Y^B(>ET-nc^jd_tKNl?E){Y@rhe7H@4Cd`Gk8% z^F0omEsj*2SKN)4H?9m)yiPc~WZ%whN`={y%Q7ul^K$7Wt1Z1H<86dhbXSR&8$9yJlG1-NV_dmx;5>14@s!jeo2-TdMit-K<%)p;pLMZW!JX9xl!Tz|s3%P1}p9-Y!S6t`|q_0f%Z&oWUPbxzmhe~Jm2FeWQ z)E&wS$%~W9ynQzhD9fb|XDia8SHNsuu2tbtnR)Yx^5!9{y!_$_%_&?@g#f%Js)1L#7nyviPB8S>QIiOTKDT-&^mO3wmx#R9Du95XRm zW92V=4Zxl-2(-B7PC*7Hlj1TbO^{vy7u0&O!>S@;T=k2$%24!?P%WR+%GoC~x8*(d zdI@$&J(iepD|MSP*EMhU<9E;`tC`rOPtu^mE%so$7rz=nExn+Yn>(z4{I;p#@Mm$e zpGBL7KU2m?y>5-cyzo=XN}e;@@>rq|(2b&WwIQ;ekX}Y}egC3wBj7aP-7`53KVANt?c|{Drru3Nrt;DgZ_2LF<8~!$~@=fNB zPuTKLT9uiXGxHv26z0B!ff(0gwsMSe_#cTGQJJ3}??7&Yca*y~&;1fA3Dp{5s^8Ak zaNLNHfC*CbIGB^fv(^kXpD=p`#&wiGG9ss zPGvRBO!nA9%hT#UQjDnEouU&-}z`a(L8gdC{2#U~k(q)%#?IC+<8W6J~J ze-m(^fzDx8L#2_XjlnuYwVX~WONz#wj5IZvJ+fqas5DaEcnn%ic^ZVEzM)!!MwA>2 znezDl&_<8c%FwmSw0xdhm7K~PKh_8)E*xPXoVl&|Wy$PWW@S?7-!d(jO-g3_WGOR` zpRmo6&crSXKMiwJU~ljdpBw7oF~s!_o9dTTzITN}aD^m=GGX9B(kMYvr4JbI^a=kg z={w{hGbuC#JhDKUm!EkBU1Q(n(i2g1MmclZ3bHq7r7SN|WGYssRwpX-jos;#cGN_s z(pgq_O5@<(x79kF$?#$vqwT5bqiC0;RZ*Ps+{L`fMMwFmTqW!&SkYuXR9A2>ovC)3L(FBV>Klw|3o<|~t$&3To#b(TR+ zy5`zEZCOhVRc_}_pBzUunNEM$HsV9l#bkNP>=EY1vsV`vrkuR!eCDe1VfM{(<)db@ zMzS`cdSlbZI7&hrZO{YDZfKOUE+jciFSjrUY|$tap)-N0$;ymuoLC#(OjgDwOA>Rf zlFakAezw+!$#E&Oy$WZ)Ns=d?RywU$CY#IjWUWJW$AB~GZP3Na^hjm8xpMHPEIp_J zT6#_IObx$74S(C(RyD#_RVP&>uSgl^;5_c<-0YOnfgUCPxp6yZD09oa&;*=RxE9t3nyKq(k7alzS>-${Hsim>XD(N{SnIB1v8noa7Pm zKB=&BYf?mFiZa;?)?+O<=)mf9gKig{nKqIxx)#q;eks=(0QVcZkCV%FqOH8*#(>vC zq)g|b{6Tj~nQjR}4_vD9un^`~gvAkXZG^=c>-CJFoGsG4$}N3At6^nQVM^bW_9M&< zEdr8Ogq%o|L#9W4cq#%uOq-f>yxvPj!oX0MiMtP#RTeKpl08 zqX#nrcF)OODfYwleIvTRp#ZdG;bUuO_}T-5n`LPqQ{A(!jenFHz<>% zae!^mgIj|Qje6_B>a2I89+@dAFs4?x^P>s}n1dCJHn!d=)ElHvL1zN!ckM zD*clpLQaIk2vgt)+n_rDTtzQb7pG{w5Ufu(Hv-47US{&lIs>dY>7Og`fC>UajwWR% zLIp`k54IH1!>~nim>=rWXSjR(a|LNoL14%+oFOuher7#-@Fb+KJ2@2RQtHMsZ4Khc zS*mM$No3l2`7jz~Ex<=Ucx8j?7n0Hvp)Yb}GVBXfUKXl{wviFr=*BY9Pt1{h7+JiG&o=h@a+v{~s`<^oGUPCgIE=n!0SzeM3 z&ODy-Ql>3ybxmu7cDXc3x8?iyx*KF$+QJR{q~;ofueJPT-}d{CDoMrQ>B+@iH0ezc zzut|ly+H%i-5J)toxc^WeWN?ZcQj=e8sFott(x58@HtABW`TN{#x-@gwhYxyKkhD5 z8B%iritnhuGOao>Nq=RaeydrqPKjL*7awTAm(rxA+65Z0J2Fytc6GIE3fw!A%T*Wc zdUIE7kmeEeOuJcsLFH^mS50JZPpmySVYU`6geXj>VecJtdbF$_u zPNcq0N8X(pHgv7+70A_L!I2a+~H3m%@T zbF(xCPikqSFkEc&IzBaVN!;OL4sLX_RN(GKlk*%WjW_)!UTzw1Y8EdyNiUS8%iHZL zbnUeaO2((gE{RJo=60pt1l@t&bG8Oa1B#mR>QH{4!eGk4#NyQWLRY*y(ovu;q%tVY zN)%|5`cz!x->@tsCXaqSAM@h1#KI0_hCv^bNW2UO>;=n!4XovcvS#seeOV{CN3t$7 zvX(c2yDOPyXJQjou!$A1NvwaW(?X?_!Y{%3W-;+1)dG#)TA1hjts-7-G-i+NM>S$6 z1&k7h*Xe~r4i`GXb9m5M9c-j|xNwNjW*W1ghZ0Pk6g(*~q!$`(HNct+G!-?KDzLf? z1M&zv-qaw;IRz_Im@eL1KyS#8p0zMuAI znc3uW1AV{f%f;2JziqB*Wqxi?_KC?x-7Bsq3#*WTy)~%q#Terl#OXqLUgE2a&?Z9s z{|Ec9HVXX;F{baS9^Jm5qfW=Xi-#`c>~tOOY3=;x_uXo;h1%+SOk0mP_$$`hww=LY z&p!%P2klR6Y(4MLp2-C=y&T)Q+`{CzKVAI?XpT#r-mmQbjdnvmw12l(;b&ja+hY89 zw@%j@_j!?fGu^mut>~-xc|Qg*7W(t&WcZTx%L?Vc%KY!OkI6Zy%oja@Fg~#-FNA>@Ve2({&n0?zvDukg&1wZzIP?Y7{?$^7s~SzUuA?g5#q1*`RW@& ze-PrYzQND2!ujYwW1O7&4xfC!t=sdLww-$`ZcMY&Je1wDKsmzrho9#@^>A$Nc}x0o z`HF-+xqmm=o&0^|<@9Gx3-_g(rmSq6(rUSUf1lNGkIPLexOdoU?%en5TtXHW?sm7i zo>86Nv9NWO`Pc`~XHFcPme+geWS<@86{dUpsyoK{uXowAy8WcmKEISbQd7&(SiZ0b zIEGI;yK%;S-I!+ zKm2rN!20H+7XIeGr|G8*Ed#xeA2v@2IJ&9B%*#F8ot?X%SvK+9p`NMkJMLfIo+q4t zv7Rsa=vP1f-|K&0>i7RL@5~%IwQXzn#wO+_9sX?pw&&EyALnmK)SlEQf9tcfD`P%v zy|mZzZ`Z+t9!(j4wL{_P*bfh?XFFR?fBS5VW#^C6rQ>4uX)dd7cJ<`sQ@7rY?_|7S z^`SWz4hYNmTAxZO80p&MaQlKgw>nkD~olD2eE#1HU+|sqdYTb^HYCV3` z^71Z?-DVy>(OPcQqJPEOPe(5wv8$LnYKy1)+IYP-iSK@s@7*-paan{&zc1P0tN(xX zf8ljqh}jq!`Bc-YF*jgwM2psmowoe3t-V3cyylm)4flACDwjrdYjVT+{_weB6B?O^ zI&6w>vwv9!^Hc4v9nVmEa=yp#L2Y4mTpoLxxwbS(MXb)rl*sRUG%s`P27FpI`M9U4J`wRr6L%PPaL(FN{a+bzI7L z+w3?$;P$S?&ole~)!p`HhldaK3uIL#^RC<(_HyonO#>8@`xfTJ_4qBl+U<1E3;$NF zn~dz$!C5ul#UO6QOw<1T^~^i1ct1>i{Vjj5r&XPFa(qYpd3yEoC)wjSAAWB#z4gH* z0Rd`{RIC*}^^eS(yklRF(_6k#+cssYaogRWX)lf;;WINK7LG4rx)3uve~IU-3_nhV zb`#>S_W5cbp+5-m|90Q_+r5XEr%$H&!lL*t-Kyiv@5gSsZ;@8E-6g1K9k*_1OoWzA zc*%Odzx2+X*uDEl%TmpcCv3LgKi_xh(MMNuH(bjsS@m(|&~1ee_8))s?Utqn^Y#{} zEIskEt9DwCZ!*SBDDRT*m-M*A*)~Jp_r-=2F4jW6vD-&nrz=a3=myIPx$^S{*fV!_?*aVxbh_Gr|mELvmKi;QmH zmYm)0*Kx_k!6n~MboU-K@cPwV261f_-yh>rTm0~=8TU^5>QlSu(_0TcRz9`%^PJ#t zJtmmjx;}o*;=R`{Ptc0{BfIqg{cZD_%NIE}@33`<^Y}ia!~em4IB(;72QY}SaQ^?C z3}3Q-S)u$_nXmQ{`hyUE^^LE-@n647y7relK4Z@wJ-niz-Gwfi1^c2bPTRaVc(z;- zF*u`q?ui!5E#BVHdpM-gF}rt5jy%2Ih6_C0+WIH`4+pw5{rhg!#m1xE^us&%8PP}n zQf%#NW z9anYII()d?eZ!^;J+mD5^i)sD$PC^Udg<)YK~vYXX*$W;v1m-p{gtWR54*kReD^#b z+yAQ1rJu}pK62i?ct%3w^Lo1~jXkew`<~0T-StvqSNZ5;1NLe*Y5KO?sw3A%b^G+& z`DI&A4eh#raQ~CLMi=kuvE8aXAz$AmJC&B z+x=p*eoj+a#jV)`RW`e7{G=1!En?x|()Y_lF1PH|FRkyXrsu3D=$@MrZ-4LOpkA+6 z?pd;W;led9wQaja&HW)QGjGw%Vd?kgJ@*+Nd*Qs*wi8uPwOeeQ-0k3s3poz%+1nQ; zRjJS0xZ>a^1FPOfjmJ)ZXelXO*Xm2(L&f>=OW#Gs{G0D{&-6a`M`fE&$sL+kHJ;i^ zZ;1Px^rn*Dn;OI0`#5f+@%W!I%NuzeI@ZtjXLXAqckfIoDKa|z%^&@yT)_Mz%C1<-j9>e_P?$O_E|6XN=(c7gJ zuUAfX$r~DB_dwP;Y2B}Fw`2Z}R)cSR|H>mrJt})#Q6oM1Lo=!Gj*nN|`rV2hjrqOe ztFn&VJAKg%ejh*M#kk5ox%al^OmfIv`)LuWf9xN!US}ume3?IX&yR`vIq7Q#th+yY z$=zq!1FuA5dFQp|*Q&ui%9-N}ZrU^_ufTrLXHC12 zw;mn5**HJV_^G5t3U^}mk!ioW-FiK-5X)z*{_B#p<+o>Mx=7XK7IWjLEl5{a_y@dK z?UJ|~^R*vzT{t>+&a6g-+oJdE_%QX4Bj(FzHEZi-+yC@H%=h!on9_fKzskz3KO5}R z91}IuVuNbJ+zY*aSmt{g^IbbP9(%HK!7m>B-SfvB-#zD}wu4#M9_HWVYxm2={ITEs zUid7$*R8*=xV0V>JKgSK+o4@j)L)lQ)_(zSi{m)E)wixTS#;!wr&l|k^-MF;9jo)# z%l$)>3uRweR2j*xzgQEPN#)ceujzU!^;A1w=?rJE*q5Q{kFxK+uYL9X4dQK zjwP7?fBK!>@ZvnRoWbYb{a)0*N2;{P*w!0{y!UE<@`g(J51ke_s_f+y{K`pZQ_`s& z8SW~&tqgtF?U2ro&Ggz*WOy)q)r>oLV`82!s=i}??aHF1S{>(Hc)McMkZ*>iRGClw z^di(=HTbVJe_qa7Iq=2C_tX0QvSZ8HzXP2$Z$z)|lh&^H+55eIy=`(RWWor$3x~Fk zOFy{gb%n~2%_aj!J>DIErR$Z)Drcv+@_n)J^)ExNIwtsq9vyR0bwa!Fd0j??owz(~ zgMa0os?A3)SlI7ZW{xdd+Slt+xmR+)J4H-~WrN9^6?W&ivn@Ba>>I3=68U1Q!R{(Oqsw#j{+R#vVa4KiA43xl z&g(n-+Y60PTfgeED%9muR>~c3mjesRKd$aHEiJH*${ov5cFVP|1*%?1TPyEbA$w)h z%WJf4`%TFcjJhIUh*Nz*OwXIRL zi}Td2>8ah)hP6$I&+PMeZllRRE&D6z!RZD+2MlZUV?l>T5BHZooosug_lCO@ z+UWo3dV7@lFWE1r4$0b`bLX&^@`G)^Z`R+i({wIqzHh4jQ@y7L{whBGyzl%LiibL# z_U^xVV$*g-|28wr=I++tXL{!RCS$E+w+aSm=aw1ZHkVgU+iCh)9PCCBKiAu)@z)-9Nv$! z$X%niYe->q=i^$*&CPPgnm<}F>b~(c2g@trowd{FjNkC+&;B~z^L2a%+sEubG12Vr z-m~USX*Ta(t6@H7?<~qM-d-^;Vc^QOTe|)jvfDAPal+n|+#g-m|LAsqaNl8V+71Yq zIJVu%Nbi?Fx9Hf$_SpA+uYUC!-=u5N>v?%z;}(Q@XZ_ZF?$vj<0@a3QJ{vQm#~h z?!I9eKTmkvBU$B7o!)oa{J~k>mu+`wrbLs(d{1|2}hl_{X)eT{ZNZ46S_EF(CN+N$JzOt~ch! z?X>)+h0BLUF0qA2XMEp!{_<54?|4W1@aJvQUR(*$|Nhj`bz%C$4GheN4Vfix+9NW* zD$=Xp|LyNA_g~3%j=s{?zUkjjax~uU%kQ1v`Siu|kq<^p|6$YbM>;ROw;|g3?TiK6 zMtMFQvAZ;*AoSJt&HEBsUY0aE)oRY$;X{TzNxVPw`1#pq2XpJ-9l*{rwG|+sA%rn{;~HirB>&Q@t#;wrH)g{usEi(=Q8N-%9R#nUs;=YztShy>~72-*QW0d-!(sb-KINJ%4~dRdnzoi zHrjX~H}khYwSD6DA2W8%?Dp5IX*Zty{X^7=-QTYc-KO@WNwGKgcJFW#^Rtp2FU&)S zS;ci*<=(&B#eIHr9u2>=Y`@VZd%x@YD!Ki$PW|8zKcLH`Est#4uYCXWstott!yXOV z=AjkYt;OZ6)c0|>qSy9F@w=Eet3^{=s~={Mn-J4w{u;x<&80VUMlTuj?7OLRpBiik zzPkJJMXjKLs;V|&=7T0&*`mJe@1Y--uguPPs_WnLyN{pF3|6$9Fn_&A@TrJtZ*s>O zwQtei&pUrexNEbr=jDe7Uh|(jcj(G=>p9XhegEnldUIHSZ1$)=#+4ri?U^-hnc9Sw z-(Jp7iSpRy`Oe!TNT=v#>-@&wZBxy8bL{>(MP6y8o_Tw(z{+R8#16iA^hT4rFZI0c zcOH9KbzO&!$;RKd)5-h$ry~~YK018tI=^?-FTGl7jVbF=IM8A5YL}%p32h%sGFvyk zF#JHDC+AW|oEtS~?W>zMQ_C+c9)4_`-CSd*Ci8P`zTN!0>Warzg##R)tB*aCc*sn5 zhQUa!9c{Z^D;VyceJ{4vg3-}NPu^ad*ypz$Z;z`zFt{C1;=H=&_W2j@4{fK>rE=ak z7MbS#*Uq}q#B)KZ($n*bp4N#s=YP5Hd#1&l#(!$YWR1LOZJMe)<`8GvUhmw2RvzkS z+Qe^-*m9)fp`y&3{iOkJH}>~$+W(D1-(A@gN?Iv8P4Rnl!96$s<%Q&Bht-oq?@x>m zy*KyIALNxWk}LcC42rxQUl+xUCT{o<12Su2l? znR0o>!@#CWr|4x1=5BnQd3pTYU2Cqm^ojIO4ea>dxoN*U4>KlRJK1lpvASya!KdAS za!$OLB%8dUom&3*MSiooh3GB0-YKxJO74nzQ6G)`Q*B;P9^T3|VsWmbuUpG+7pfoo ze~5d>;L5(JjWg-kwrx9|q+{E*ZQJbFwr$(CZQGiEzmxatR87rH&H4J&{?)VAxo6*f z_uXeLK?M{Zs;^mWhkaUOrrdcm?990x^|q!etOVd{#~4kO8cv~2x_EqIMVzQN*GxMT zEwL2D5mQCt9G0)+0eTWY$eC@t++oK z>~WwNGxc?psigTjd%b>6AD{hAq{PwHmB(Vuh7w7Z(utK|UrqEfD91DyrQq;gofVLO zEWY1%4jhqJZE@`GYV6uq(37avS}1M1gGfaoVjC@R@Jb{7oeON_Xvb zt+~7qDN)gA{@Nm8p>dR(fo_4~XsZM+f+d&Q zS*jA*bS)RiI(MkLOzsaT;=1jIBOx&cCw-IPdl%I5zxZ9D8gteNoH}DBen*&d{wWlq zRp7_?@ph#_)?Q%l!l#Loi(4jh179x-;fREs6|;P_-f1gSG7CzLAx&%g!SW`ntKf8b zr_*=N5n_=IvPT#%gIUrHlx5{PK4TVI!jZ-Ka&7u`K@5(P3n~!@)6DG1^RS7TBYq&% zZy+Nx)xI=8c@?$&$Dz4m8??z+%5PNxHc2_rcH{I#CR*q`9*@q+`ENWd8uLX;%e zFcF(hpaMl@bt{J)Ri}kpG?sXR=59oBma%gn{P#^+=E?)UOnAqKaaE`6_Ku2(Fz3{2HdX<@4zJNtvHE{5hnfUDImb&9p>N&-XZPUox-G`1ejfj|= zYQMCGMn+#An~+{?;9G|A2k0>%GLS&76JJcZ6U~h<7@`P`oJ4t&o^_2fB zVA|eCEI`Yq82&uP^5Js-$B8*pYV>k3ac+zl{a0bHGt<(jZgZ#~jqY)$K9onZzN%gz0SC7Iq+WiSYAXXX_^n93EP0nKh3>wAb z`~-Zmf>MSIVbg(qTFHf6=r?eMpMTXws6ADG(eTznwXHElnoJQ1qy{R8*bCxmP*(M> z7RZJg{8!Az$;<&@fI%V#XB!h>#SEl2Oti#S|JplTN!H^!oa+mVNR-GRwh0DUk&8He zIE{q8Kk)rKTg;ep$I3KZb9^9PAt)E7+5jswQ4(qfR4%SMN-S@rVaLf?0U}f&WGtq@ z<&QQ&!+(1q!G;sDy)M0I%H#cB8nuRw*^RLTwb;0qy9n1p)xA3mU3DGyMtHRnkuFoX z{EgqEWv#2hsY*sfzC+S1P*x%|$%)0V9s*Md4qayi!^&n^N9X(@Sz`dh^$cGwDtQ{HiB?F_E;+96#FZVZnt90W-NKveB7%P(K~U z3NM)hinq~IyMi|y@5sU#8-~NRx;Aiz1C^L}MY1MJT|X}D@f<-o_|j$t!4gj?X_uAN z9s3_}ONL@GSb{|1e)}?njnSq*mWIXpT;&U*=7KA_Jte;W&Z>wi zTw%igG67TLEi=?4N&dQS)~WI+q5^DD8ToX-gHygkX%(6 z7MjKP|Hiv9|Mn67-*`XfABV1%=A4Y~WGzKPkYrs`#{?;e+?CdenbAxI&cW4vUmfOsQ3?y}xX$at_&+fKpP1k#4abC+&ZOIZTsqimJ5n={qM#3=4(J@uv-mDiuF--> zwhVw3a)nWJl5w>oP*U~r9N-NTbfMQ6o+w18$UTmPOliP$8R zp*DDZYlY4%c=PPT2FB@#*umQ_E6=4h=K0rBfjAl3PB~{qemE@flQaNdjKv4m zcxx{0jMPK~J4+WuOB?Eh^9ffTd4z z$1PYtakUnq{4K|W4{-!1!^|b9eEbCwV=Wt#rWKs_wVeByhjQYzzd`U`;L+L*_ARt6 z=K`h4{7XL_95Hw*&HTdYN!aSg&ym`LE0=DqI1gK(`NmzE7jIe`3hNFP%>{dgEH^Hj zf3w?7++75^KiZBzuCKqu@>{!_MYszeZ}ICwi@5(ZuhtI-H*zH1KI{3lW$M%g5<@L8 zGndcYUZPB*YV_9w0( zZhBXEbUwKx9PAydfZ2EtAgD(=OW+hsp2ZIa4bF2}f4cXt7iW$j(zOiM$M{*vW9vCD zKZv1upjTB<;=HTVA3s=b(0?rw?*|^>HA8?nrcEnvo_oOx9{w<%{0cJ~uxD)uJxely z(%LR@(kC*Kt6iF6eCK>Aspy{xDJHVd_fYQrAnEeGC6n4So5CgN=To+UiVw zbg6joHQd3#_V^NZW!qRo9Y9E$rqId`=~#>r>F6CQ+^`0DvR2rI6QlWD3vK@n;krk3 zEZn>kJNU!lWbNn_Mfhu9-k$pmmDRm%O1_&H{qeEn_k{s@cx=X@J&E|(H4l9ISOVjx zHsF?$e=iYd)Xz}q)F>kryRcU$_rtM=;B))0&>d4d1A1G|owawohLlY8Xk@NvY6ht3 z)(S-q@NQ!!Ku3#SVqBE{JR5(x1Xggqx+zd_8(?bH*>@$vg;uR>JtD(7P*x!=8WBf!k2!GhZq*rwTk z`~Z;FweH34H@b}~27+@#&1sdm&>0G)N`@q%;;koyQ9L@0XTb7j%hUyTj^OY9#3N=%J~(m%I{;2 zVrU-G9z6Wy+3~XFv7!B z^WfG2CnS^UjhRUU%yIG7N41f#q{P0{Gb+-T4x2=Q&juPApVYaKYa@(;A;|0G_+K?o~fc&2(T$=|kvd!uQ1k?++fXXUi z={P(LFQW~JZ&wr{1IB~y*cn&VHCYjdA3sD}yia@$zY~X|c6Li|ShS87+B_z(I2mWu zX&pt7`=z{YB0y38!j3i0ohQqBF?{gHORguo2|i}zSXl&JJAI zJY{vvVX?H8dZ(Btb~(fpxJD7;!M=IqihSZk))gNn7RY(sl-R|6N4ZW5alR3TUoB$W zq_Jyu;*deXUATVjhcgkS)`$i7P`yewOTDuKd|mOd+*XtCJvs?4r(EQ0!W4;S@TEMn zYFGBuk1R4+%wR9+`;@0rtc6hT@j|!DR?Z ztbR~+Q2yHVe42Va$z|@>fY8}6=U(yQ?|YDIY3W_2tMXEvUBHqen*YgjYvMM*3c*&w zvj|sz9iW01E}8&Q=a}7{Z5y1-2A^Wr5(lZR0wX#CqcB)9r^*iCQk=}xHi<8(hD{m} zh{UXj){h?&KzsTaG&y|7cRnM{2AV75$;mRliFUAsDR4-G)4Xr)5&|E0jdVYFi!eb* zpCBEtEl&(hBT~KP3VjOk+Zn(Aoi`W(ctg%hRh6sdpuUw^tz!U7&E>d-*20a)e zqO?&!Zh5kz(V}lMB=i$1#XjIhhoV231etY`(0us2o?#Y#;(DjxKmw176?t-dr7MM; zUMdf9&&McNsyu-L98|{0%);36|9v(O6=`HKd=KXzV!1*~bjOh?X3MZu?S56WW^3>h zm$Njb?C0N}b9p#VXM>e6p$nQ;>4&SJ>E1-mB&{+vsIm1q)4%Eox~spsU9wvxM`<>C zru}dSEU6~gf;aXI?H7OiP}A3{;b*3hyFh2Y;BUmV)#f}L^JHY@HIn4jC{EHcovrfM z_}1jJXMbfz@qUw8ab^~Uaz@x7H*s9y{i&5PVEEx!EoXhtv6ujj$)ITMpC|;!Jrk$o zjU$+X(vs{Z4CW{8_*=If3y{>H8#RbIptC5dX>{lZOZGOW-zDa?=dl=d|8VTp^lKz= z8&+VHrfSUE4B)NJg4db7ObypS$CLzFsoE?T2Dm4)%nJSp9&|Gt@n(C=ygBW^C&PmG zbYhFvkj~8g@$Jqk@NW(Q5DpBXk_q}NKTt;Bc-u>E(rPAxP1iTC$~iAh4+33M zy9^ys2{|W45J91=KIo`d+;j*u;p^xRM;*41QDZw}kt~UgI+TSzm$$*}`+O(?d{jxd zvP=~@lw#tQ76hQvDoU_TxulwzDg;L)TirNF}mL6XVNW;9zyddk&3d_?C;o-GO!ZcXQw6Avy9nIDEWK3u%}R@kU^DC!Sb-`I48%b>7O2oF*5 z)vAMrHpCcr>Hj-F%hy*I!pdmx!nusySq(mA$DsdZGPOL}`H1k1!SIPm((tt~-Sb+Q zq3kuOw;%7OlUba{K~{zIb#pgLsRxswyZ`Y+83Ly>od*aGJvw5|5>jZA!1G@bYhv8H z){b8+w!Jzjq-r^`z`pW9FUr>Z(UGx66?x-@Tgb%h0OOA2N5#keIzRbgaVUw-f;C7Q z!EzbyWq;jR;hHXSU%nsM)JYqyJjIOvn5NQR^h+$k2z8>s8y=onDOHy;NPLw(p9GGc zjNKZt`|%UH@JWJ@YJFA{0LcBWTqxbgx#8HiJbe<~dApep2DInVbxNxmX#8P^@5<%| zRb;q-S79_VN~cE}e+UCT)H0s&?(odL{UT+=TG@Z}2x*ojO z>~KIwt5?Nlg_(Wc{P{EZu)f5g)7C@e#0p)1#5)s#s<7#YvlsZen5OKb>DgXjgJ>=F zf&-rGpP}#Qk)=uqf`h{1mKHj#3F7*mP+>vm2H{|Gv6ADva&qy`|9A}5>?i86y8pvD zQ7FCCi(3vN6%bhl{X#g)aa zt|g)AJzieybVq#s-}#5IEYDXfdU8aR!_6?)gsYi*SnS)UqFl*Oktg7WyQ48APMn=T zy!`1HO6DpnuCS|Z6C>&F#)7u%W3w*&P?B)rC(q5GVil?0FNn?~fO2O~^2Y*U##DIe zl=<6miC|Qg)>*{;4ehab`Sv>2isT*{ZnQu`-$iSA0e0tG(P(V`<9qZ!ajhi$Asxk8 zt%67<$Di!I=S>`K)J@0TaMWnk@XD!+ykVNU5)9vb2gWglE`TTw?xCO;AOS3HE4l`I#U{_E@c?;^0Q3aC|5x~ee= z6!8qu4AX#@+N9U5IZ`WTbtY!a&fMhpdoQ3xG7U+H{Z7q+(9;UYb*^U9bipkF4jw3V z1p(d}qF zmg~!fGq=iI|JF(^o6+vBif+CC#8v&B1wlx76lIA_j)bL;NI2nR0#ws;57N^Q_f8_p z^8jV7kiuF&pK$J{NLVn@OZeFKQMzp!Ol21b+kdBeB6s@3`M>+VzKshvOps_vsXo{? zPJKO~B1rI4H3nrUEmKSrohYlM#ySFW(Rdrms&~!Z!suGt@xx|hQbDQ>jlKDna$Y^GdKLmpJ(lgV?K_44WkB|PbV&QMIOu-KS)P=x$ z9jd}CYMjJ#N#KSDC#6b>#kBJQ>CxIjwf#j@N>R#*ikU0fi`0M}4P-%i{3R3`*C#o~ z>0s9M&6myVI;dK6s_Jv9+R+eqV=ayCXnmnWzw~o9qI!xwd_y7&>n|L>-E=*VRVS5v zNTdTb6gO*e(ZHCB;f$8Y`>mW@oP0*V(pYtArty-PF1U-HAYb}r@TvjM!VaZ<=lcIP zr~f!Dtfwqj4)jw(*SN-$<5zlL?z?D zF`pv1i-o71nyBMG=>eOrUr#pP)>&Uup`}qq3+}&2BOv&)=LNgCZef z`#l!DLdQOvs2P;U?mc9lhlZ^C(`QtnOEq)3O`{e5w{G~qssZrtk^R4_1Mp8zwIn3u z4Xbjei`xxRW~ojOtp;ZyI|IJFQTY6y^J~2`*-`ffiu4@oaC(ZQvnh`R&sdE(Pu|}k zYtjG4!;?C698l;hvn8TM^ru%$)ULa1Zz2Jw{Q4mLpDCll=vJNW+O0AbkgXz3L(b^U z38_@P@++Ou-^Tdgcq#20-u|LJT;?>JX#`T^AUB7SX(~ikw$^$`)qncD8-Nlpa||Y= zB6gn;G!{`XMtRAH!^V~Ud;HWt{l#ggf6nKP z<)>!0xMbo$#tVoHX}*4z0l4uSwvg~pC^j(t8@~$89}@t@prc4zH8QL-XIt7)$#=}i z=@*_XAMj7dL~`$}O3?j`OHXXDHm$=$5$lrsGDdMcVmtWyr$41%8IEFgx~%CimqIm@ z$j2bnvcG4#UUD2`z5UbQ>zf7RECBqI{RMf@F;&e`UV09$db))S-}v^UZDfjv1>{4-%?piiwL{W49v1M^Y1kbW zisXMf!upc=pg=*c9+Rw|ZSLt53W~K3AavwgP;Of0Kizuhc~5*YU5{Bxy=Bj;NS5(W z6WTttjS+5v+P~6S04_3~Vw2YATp*)(%~C1DCX$~i_=)ZKoI7_8asTwa>v#G$M9dm@ zN#X{LQAs%WP3^!$DbmaRw^z=8x_LgW`$n-ssb{udU>(dCgI*Yx3v`&>#oM>f|J*z=LFh4K zKRSt&93(%eD#T;f{HOmvt)XyywTx>L%;-quP+PhDYx^&ESF0B6i8eA|Kgd$^BJl^(w8zF|KSw72+J8%sVv$&9;S#+k zqH|Tv-tPmY#lG&*u2wZ-BymbZA;hgVnQP@P@a|sYGRO|rFM1`0;Nk|HZgf8rGX73* zkbr_sm3diwgYttI+Zj(gt3I#--9QJ4wV>!Z0k@(Yq`5eouKzX9`Ujgj7OzW zu$3vyhW=H}oP`(|`f9cG7vLbNqEBOwevY7>?wh_-yMioan$}SA+b&n+dra6?Kx1Z? z;(`Z|nKA_c4qTB#(~+Ld){h;gaIYkp_(BCG)CTKQowIZbdAqf`8{!tP=A86C0J6Gm zhrAseS}D&hcOu3LBi-R-+ycT$Bn=m}an{|`j_fQN1LbY(E_0N;O1;8K+xS<1O=-xsS6{~f* zJ$729dABGXx!)2K=S-mlpz>zPxkGB#tvz3-qA7If=Y={81P`74{L*4t)u2G zT|P$h|Afu0n{SZR4D%`eLa-=8&|jdz@M5mV_hBpRTo5|xI~_bzXZ%g#?N)vK=Rnb} zi$!{-CSfzWv2W7}Ozae!4qR-=r3on1rUk{MU>^Iv@Z1fM*VkqU6SZDXus0yh-*0u7Q@e@`W zUYJGfPN@-9Y)Vo(sF$`nB1d?_*eYdm99xHT}(*jk>sKolCk%2x$7`HvDUp8IIQU&;6 zV+?jfMX~324e2G~$1b~NrJ(cN3G~;I$J=9XkK`|-6T6I`Jbo_-lXnt07^83#YPI2n z5g-=IECko|7Z8+TD1qX_V3u5xo9LVm6OVOwGSQQe84sO_Y+*j(wepJ5w&q{JUpcwS|~gMVn#`E7qy?Ll@*4H>hIPDNyEcVm% zbI$kafsMG;%$ z&w#z{yrghPl%3*PAu2DkE^}h_o2OQO+9CIW<1T> zufdz)n%w1@Q8;%rxJH97&p1g?QWcWLLipym8U$L`TUQ){7!q_=@}sJ{C;g-Pj#i7pG+3_h}|s?@cX9_lM&9$r7qt^hLOuk3NeFWm@3wx1C|bxSX#DSdUy* zkr=XvW;kje(6@9ie=d|#Rrrc2Vg&pcB>T|?Wwo5gH*W?t(twW8I0(W%loDdi^Bjd) z?l}3u>E`F0#rQ+!ePYgXp z`W9ni2Lf-}1})X=rQdf{PAs5eias;{{(9kyW_VM7VyZaZf7%g0o(q(o%p*izK=iyM zXogdOM*{&Rrk0+?&0hY~n_YgxmI$PcI2C|JiLPffeWF>IXWJ6&%$e|n(~Gk1Y) zhI`|3;JH8XBIq%&^L){;J##&Mk6gCTo|og!ah9~3(Uf((+J4=NKBZnZ=z&VKx3Y)4 z9idHw(6Tc3P;(SVP-x-g$fmv5&*%T^ni%mb;fj1q7C3vqZwWtXB!B>w_L*)RnqoprWiZcYSSsVg^;n2#tSEuY3JYigTeaZ3u7Mc49y%^Yw9xtHZ3#E~k zJx@bYOwfMt;RK!p!`|(Ldof6eBd28qu9YJ37Zh-YQR>#%{|*!0lK#>lY&XI5yCNG= z+;gv5qn>e0iz%~?n9xDxt+@1J3#mwXsr8kN1m^Ecp{}GiW9ea}1)vj*yy-zz1zVof z&DE%W_W%OXc5@g(n_`#H))>)+h1ARR)CVWINwM=mBV7)df8)Bb1@os6(S#6aHbQ|d zE#`TQghiG5zYJoDq#K!qo% zphUa7*ckALv^b?|$DUWeT1__8qSt<|2-~FXJXM}tz=}*70TM<&lfaxA2lY|@O-cNNC+XyTy10K z5t>_#bU>dc(%1_(*RvUp&2{%0SufcZVKr?roLgeeC3Bk~o;(6%1L*IFj#$dENJuJD z+|!vE<;q@KKjX7KL%+pF;*fMvg5w!GYh=8!I=!8E>A_aH*F_`i#%~U0T-zz6pl=ih zA(;zW-4FEiK$Ctl#lwSw_xy!(GSJ zZ!iY8y0JBdpS%#7;xB?&!!mw4&m4Vj+ZYf9o1q{b&>^2Vf5&$orVc0$a5?Y}aU~_U z5Sj@dkHX6(Ts@YGVjqy&{L27V`Wro4%;)=<7`t@;^w8$bcO=5HS!SmW(`kbUhCg=& zHZKwH@GoIx7l5u&kUJMnV@(d+Bebo$+{2b(yNk?~#|7iEA%5*+^tPEn0#kL;_hmFv z0L`{=<_o9(46bU06C;+cYw`^fkdbXD*Zv@}oDMj69-5r#1@}kR_%Gdh>(o8{O5kI$ zYVCbR_sgOzbO?qMkOaYvmY@XWX0|?ACzQ3NA-KBISe}zszeM;il>F-Vu29kAy!NfZ$_*nuHn`q5lgd0!>{wSNFlbIbYb0`qPVdVytC;VtOGNl>5Ly43tDI#M}*WKq<~Xh;u&PuRtRI3>haL$ zNuG4HU}XGe?*0Iz;!L`73|OrC2@SW{7S#vc)?2Q8y9+QB~8?Wvb)Dmj3`t2*dn7;+CwJajnWrr_f(PBdBKi32y zV8!Jt#sJKkL&K6s&^G=SY|L?O(fXy@*d>HqdHpv=ijuKHG}TEHk|~;X#4>RK@BVzP z??5sZ|DNRhHu0Ro2A|oF2IUaR+c2WCxB~{=n=R|@#2^2e#@$7JoFZ@C{m7;;XGm7F z<4C3xH+%79kh_^)2uKNjy(ofE8m-E86h~l8nni3uBrpp9K9TOMqXE5sL9{CD(TF=N z_>KyH)=Ac&@<@|<$7`F02aIPb8@&l6?d4|ijUUH~&k_e{6qbrk0A0SY!C)7(8FF>t z6IEAHz-wz;LcC_YMmjQ~cQ0sL=H{$1-S!$@xsOBZo_duU2Ag(*PBFx{#(ua_Hb2m% zdA7Q=AwuhI#rzQ%FU$-9><3?Cuc_ zEJCin<6a5l(SE?Jtn%SxGnI+W;pM22RmkpN*}tD@3b1eaVv^!}M1gOB4PRn@vpf%; zLiRh?FfBYbTmW!7Q@Zxl%@Zp?VAkrBWSlIr(s*M!s%N1}oz@^ewN|&uMP?ktP<*N1 zzjH}166q3s5yi2_&${Kxs%X}xp|R`bS;ZEDQ+x3^=Xo?S9ps*=MoNoO5T$)m_>60S zVsU!-Ctv!hCir5#CL$*ID65<=mC*;w%gsUaeT?Aopf9*UK*pXfMJIpBA);~_l$_TK zcx={r0;t9Ctsgwb&cLEmst0(|?Xu;<+|n7i5%j#-;F(Ncq%aG$KfI=gJ(_));21`? zu5)y+)DKsNN5+5OlfQ91y}kAak-CS5NiDjqAZ(pWV+$9UuQ@W8;C9YGB42$~VMylN z2^hU3*juu^#gMG*wKE4MP&SKPgJ=xMClZAHeSzX(Nxp&6~w%VCpJK zr;yNO!7g8t?MF`%pKD`n`avgQ=qCFOxWIa;!twj~{x;~0WvM4ezAcP%f)HEym!*46 zE|!_Tl1fXsC3+A{=x3AcskF}tSe%CDtOP>ZN)m~(qg=*ChLTTH_&6uLxh@kJ;Hj9} z(NH1nT^pl;;0q{Jp&*$LA-!V-+=L90-e+xhvRENDPPn0|2i%0qOFPG_bYR9)QpdE_ zUM|fmRpLO53IiaB_5^NwcS?che%O9a-6TiapEzb+_pp>k`6zsDPT*+uihR;0F^CK} zHGAVZc1nG}vB431ZSs7-Vtj^z+cU2ap=jz<2pfZQItS-9Owg{aJPHU}Ck}cVe!lcx zb+rCS2GytpDeiLJh3`*XIDx86{l9nj_*iAle3=>r4>7;@?VerjJB=Wq0LR!UEm36* z)zqi*V;a&rp2^si3~)HD(b*cxQVE5^sGB__i@1wH;VR$5S1diwL};^&xM1o zguRh~`Leho1ZW)}pV~tIf>D42k)EZ8or9kUG@^l-e6Bj!pi`U^M5PEgri4x)uYk7~ z?GL2fnWOh_W(~8)<^bIR>$_KzfE)n)@?4$3p~L!rc{*cjQESndaXxu^;<|MGzSUsnW%KAQd}Gi zP@~1MR_45O(L&|bE)P^@x#K%RN^~dX-F%=8J|9NDf)in8hxG`Iliu6+rc8`bV)J{r z96M~1nAe~3quxp=NzCA2UH;EN1BS-Lh)=skh)53smzfv4imbdOI+sGBs1-rKq0st( z6^huzY&%*DGmWL0-CGX1IQQjA7ROl>`}#yi`=l@CRdYvb!0^^#e=4wy2*<(j| zk()G2>*7R28c%KuIlL0xb$hA3&sigLGh*v;KjjO~D!&V~o%IEvTCp-vY?NheDib}= zHB!i^dYYo~t*s$-v$dTU3q2;x^(;-Q0o?&ZHO=TyUlm5rwy)wq#r?iTPGHhA!$|y| zr#qjJlX=yZD#MBClJgv`Xfs6i!WeU@=CPrG)@YV$wrsiSw^c|eO&el&l-I(xO}$fr zl7kgm97i(}n~k=BUGW$i7UOYijq7#JT0mOh9b8ae6P~>ht+i0AB-fXDB$Z1NE1{`7 zl6bPgFZd2zP@w46D?`((h_F)I^(hn&zfs#LeMYA>;g?s=E~V@Y_hkL^H@G?=ZZ2W6 zETaN&>_w95Q{FGL4Yh}GPrQ#b_f!IC>HWv4Af1XbfA|0uvl!=lg+Kp)*HAh;wTQII z3>9dX2~H|jo@L7{f4eGvge}_Vz0R^)Vr1ICR7O_8j4~^@l;V7|bFwfVbjC*RYMk6v zA3tWrk;k@(azD?HSggUz=XD2Y-Uf5b4FK^#W*$DQO6M z-W=33n(ma-OQ8+E+SWz?La%ZQU5C`) z8n~fl740hleZo)E8&fC^*VDqn>)HtnP<8HHt^4~3c6_+3`+&_}9Y$RrU`8RuC!+ht zqR|WVe;X`=cO1HKyOmkLV6{UA%VD`%Uv+$mB`I&WPzV&`0;9}J!bKc6_-p@bKurJH zn+~lZZ8@<$xL>-sWTFPIDW}Mr!}e}n<7)7?@cO@H`mM0>o_^Ig{K4Mox8@@)Vc4O6 z7&JwRe$~3sau(cJ2&Ik3)JA%?(LyEJWj{FFw8`m1oaXX3U&c5o8wm(vrGr7ta4J}^ z%5g$1fJ9+8dg-ueXf#>@x-zs3SG!Adw6-M2)Ywv?DXP zpm+Y}`$QC?^)5FQJ9@3%ulT-#(J##S*7u#{1BI+mH#@C4MTho-K^3VaL}I(d7ZFv0}z&*RR(jNF3fznhVq<_951 zNweN|@t|KF8zL_?2~Ht4AEZ{$2cB3thDR$j-^>bfEFu%IJ?vOjJv)V`nsG9;&z6!T zibT#2b#8S~wo+}32|5pfTaJ35#O7~+0S-XclkP$DF~83oz!}R@nIM{&t*<}y;Q1L6 zm~S7LrpaS6;J02wLp;t$ja$~<*0_t%a&Gkf6&RI(=n5IdF%UA~QR~T0onk;}46tKF zT>yiyhL_RgER%8lR^q&bf{(OFNC3fo-)|i*R25#Q{SF5S{^E+H2MT@|nB9f(oldY;l;aE2(y0=Y;j!OAa` zJ-^iq0&5{~)E+xmE+KWWX*o{zjfx@@(Z2|@Rgl%J);TuxoE5d&WE--^(Nekcf>3#s z)|+xRiSMnq;4&>UN010zhfS4?0=~m~?7hlKB4+Czm;`mwvjuVpk}_4(w$M&+71TPY zNkc=3hZBeSA%3@8+p%F9UtKn(qjm!0YrS_T=DaZHe+zBJrK3CCGLopC8}uUYXYs-z z>Vaiu06Z&WytjqCqCgvKdE@nx*NDJ8CXJC@Nf1$mc{iGlplS7&q5T5C!p}T2EJl`H z@Y0#iS$umb9@;>Tbnb-2L{HhMF);Ymyr`i*Bv-pEfx@AurOCLPWs5Z>XSjkMAfIlP zSD>Vf!CY|mL0_umyN|*e(GEI-g9cNHiobL-ac`h7N2b0Z+zC^eL_mk2iy|j}#7DgGl+Mb0)71FcMhs~Z7gJi zyj3RepZ!}vVI}(QB{=j^`63>mO)NuNSs_kig7!PK?_4>9Hj1Mb$kgL zSTP9LUA^>1YMM*jn2~haVSc84`5*W8UVW%rYbTqtMCGAddbeb$FtW7v&V0GPGkSto z2{WI$`8;_43FRSO+l>$-`6*^w&yY`_n6nv)5bLP@4>6Y!O_B z&CqofRh?%RQv$;x;RdVp|HhM`7nbk6khfkGWJvl=O6Fo(V&ckiV*1y$dGk)SiQA8> zo^*gZvapr-(BUfWSLv#`k?y_z{^>hd;L&ekqwL*i=$c(%|IBlwZtfh>JV$U+XUB3V ziW7Qk9Ux{;_9-d**WX+P9iEy~=)Nt)LVmXpKrNt#&lk6(weVJUh_sc6L)N(F{l16u zkXtJjz?w-R8dd9DJ%fKAUwhNS+PyE$>?5iekq}-{!DQbgr%zsF2~M{zyth5+P6Ftm zj9?3)QY%K=EGdiC)L}fbz$=+!>o#JhOfL81b)lE>=+H2HGI?KI-4&4t6Hl%gR9I+2 z6~3xHMUY{qCfrW4BL~(|H(jj59g=&%k_mpl=#&gK&iMu29A}S5J3*MkDpVfH*d`BG zc>Q_hGH-w{9l^O8Trxv#sUWEk+&C9i)Y7pLO<%S*D+q6ZVNElJx*+ZvT4>Te?B{Hw z;NQvo^yCqMZ&T{{&8|ga{08Cxgk^?MV2qgL@k>&$amy-YcClpdQLyFjQzVEf3YC3_ z*x|ON;PQ6#d6X}RVQ5+Nfh|r3a{Fm|tC5!R-_Xa~-mpAWdWEBR8vlmkgYPy5xAHzA zi05VqSIHRosy@LDG*^+~1vCK+$1EZg!`}{hsbtO|j;uQK$h8a=VCA3bK!c0JT{Sp& z&<+l%#~vZ`%%6K{B;3QS0SX(0p3??OhzK=3%u-}=73iob{Cb(R-$;;NcVMR2q9x z&S%W^OmhTM`ul&MKqIL725RTt9&>wu%qb8bORtrh{wv#+uE^L0D$w}(ytIlR*0q3j zLYfFa)e!1-R76(6*w#6mUsRRh(UofuF)78poz(8-Qj7pP0n6ZrfACQ0p>unEpxE^g z4kWVOpa9@g6K-0RgIeogqXFAb$+$0I==A=cgRT@VZOx+Sn~Z`xewR^5HQRn~TZvS; zl2kCLy|$?|TQ$`S(VFwH!t?uWvk=cd6Ap63ODY&cY#fJ9 z^^5GwDR`ThioTYR5$lV%kL=miX8H3V$93YYN0wNSjY`Hx^{CI5O<=K@h0C`E(@Fvn zz~iWh4W)A?eXPuHdMaZ-Lf2gZdQAeTI7)y}r5b>W@rKZJV>LCkOCXg8&yMe*@pF?k za}Qr~mKF~*NkG&&T&yAl8dIqxe?i5`vnY^b6scWz^{v!)D`0c9FxJ$gDLcsO zS&`M>)S@W=a6x#Th-V|v(}S29`O+sC%u;165%fzQ(alUba8^)$9jV#%al!#INtgLmE9CU>28t9TN z@V$hvHx39ObyWq*=z7M8ZtwQsf$VZMYr!S045<|T;qU$Y^}{xtD=)hcT~0NG>R#Uu zsUJw?M_7S={Dec?1Uqa6IdtqkGu+L*bR1mn?!Uw3s(8iRS@E+sOJ`h$U2zQ8aukNW z*gTAt5@zKDVM`k|*jadcMn>Uo9NYx-;6;SYeC_S|Z4pw{)X#cF0)^WU2sEt^OKy$!KB8*!$0j(sN1cdV?-XqhA(8HdZF&SHc3c1~6 zGJXYF!a1~X>lEcLn?;u2S7?x3U<|aJUaP~0v|YkH+@r9aTGab$C-9&BqQ1$9z~rX~ z6<8AUi@TkP8I6rMFCsi$g4pOcLrCk3gv>9ppGnu(H~m~M`SVmF#( zpuaUmg4Z-QiKACZBuWS5#*dhVDepOw+0rksFA%NAhC_`Paxv({LzPud(E{x_CBshh zc=;k20?un6xuOV!*33wf&Yy0h}paX$dK)Nt&&_sg;sso=!Q=A>qHvO5pg zU{fZTF#YVLT~>Hopw*uS^8X<2J;0+XzVP9hyBmoR6)<8{)J0JvQbP-h8k&M2BF$JK zBnt_onF7HY5H(;!M2(6+0ULHy)F>9fhKe0EcI?fpcMT=>Da(X?SN{&C9utDc=(IC{dqho_%Y zGIqq*-=EZ{vgqr(M;-UgL0^B}=DM%`xT9<5jI~=YYxVH`_Z0ux_w)bV`|g%*d+&aE z@M+;8x!D&TbN1n%96hS&H%s@9cuTG;RHdq=!K`kAi}eDR#^ z_&(b7;e~eeJ6x~Yo4&see}qf@Xz#G<%BpyEb;;CNVQE46wAjpeRdq>4c`T=A_g>w5 z#j=ZQYAUM_@6lsgNlkI>lc=*mesJ#+f@ z%*`2~e!R|fLw&C^e>@6URQ$BfHb&sDgY`OsYIcSW2BNokJ|Lb4-=wGra-%k{46fDs ziBKJg9^wJ5k12gwaG=%`FAp~8pJ~oh_KSu2f2xQ#h*ur|^TpNbC)9+fhk7X%h%+E| zSn}XYig{uq{*fIhdGIC0g`$(gFA^nsycdBz5W9(sb^G|U@KT&FE{E?}h}VnDbo<2T zh@npVb45qpKH1L^kLmV^pDRAr?GZmuoTS@}K^s!c66yyM0TZtilbra>78$y|Jcy$d zXNe!2c-Dxex;?tSR@|@KBR*5a)lWDt!`VE~X9wp*Sr~T<-scxV2 zMIz9D#Dm(8i$bUUsp3ti{R73py8SF@Q;JEVn{J=@WO0ygpLl`T=CnUWtkUh1{WQ_R zY5#OF%W3}%@wJZUP}Sba;s|XgK2g+Zf5az<^dm7ELe#)lAodqm>i(b`DJ~U1pb-k` z^Tk)X|HMxct8{;9eVig@GNmP)2pm;>LNBjtJj?>;z zT20>~>M!6Wt0F=-uB#$q=cEx(M6_Xi7shvE9Bxcji9mep5)pgY6#VbWxcSW)R2_l& zW0#27*QRj&{)~4Lzv=klvXbJ=po>=g1m6SEpXm=|{2=j>bA1&=Jy{~+kR$;V5r>NB z9DOy@t6!&^xF#aHB`|^r+~4d1cT1asUH!OyqAnu(CNP3X%6RnT)~blmlOe(NM20{R*|!}t-npgaU+F7_S?k;dPxyqAs*IKj`$s7qdv_Nzf-i*Q4g^XJzNC0SJgMgw@dw2RdVUdKC3e&Ei}*vLo1S099~P7K{38B{I8VD87-;#)bCf4J@2TBaSr1)H1;>@ov#2xw;Pxddx2l^IB z{44Qi2e=SQ48Ek;EV?=K>uWL6nP1i1q#+>*aB#(09cd$Iz ziQge|s1v_z`L(lt50$N)_;ryl>hlMU=PHUTHQSv#xzYsrKex7c(pC=dS{e|p<(>~AwEf7p!XNzljV$TJAMUnz7xMG@=Pawh4Km~enoPY6Ti5;TJJC9f2us! ziQhDNgWg}rUJU;ilihxaJj03KblJ&?-wb)Q6F>7CH_1mtoJK(Z8xf~7eg@-{7@y2| z0pnA|>w3SzZ35oM${+Q9L%du*p!XZ%74kK`-w>~q5uI=1XUa}G-^8orc%5(J)v`+G zn|O`9Rqr>%Yvt2=zac(T{-*aE;wFVGO9ndM#Lt#7op0jj z$aI}=;^)ePb-sz8CwJBPCVsx`s`E{}UcROG8{%{1FEI)+@wxJ0z26YOKyK9g4e@#M zTD{*8zfeA;_Z#9D$<2DdA%3yk2>}%14RU}!FA|?GPtyAh@da{$-fxIsB3J1BhWMrI zepW=z^}i7jXM8H-(-<#iyoB-T;!!={VqlTtGWm|4Z^SQ`*X#L4{0iBm=Ns{b@>_j> zBYvgaSST_L~e1O&u)~v>iI_Y|Hht;!EY@dcF}~ zCf`Ezp2pDXs&`x`DJcpoK?(DRM>5At6<--!PxJL>(7_!fDB zo^Ql|l4W|n5&u~()$@(`FY-w}--vIOKk4~K{8zb~-rtD-CI{>JM*Md-k3fFIlSR8}Yy8cs<{U|0ApPd?Ws^Jf)M}-ZojM=Ns8Yu(#gd zh|3^1X6u9CFFoJL9trl+`y26S@PVFh#M6R5_p-0wDd>g=J>WXR=E~Tx3(Y-(Adj1LN}b`i1!cf zZ7WnEo*P`F_Z#8^f>nCIA%1wUMDI7mj|d*q`wj7d!E(Ld5I-_lqxT!)M+GbNenb4| z;5ohD5YG!{=>3NHpkRJXs6u>jFiM{vhz|*->-~oK(4d>%&xsEUM(Xne@neGXaH2rT zgD)wL4VLKrhWPN{RlVO39}#@7_Z#BJ1u?y!6CW8IrOyws4| z>GeYVgkY0iFT}?L>-Bmeeq!*YUN6MQ2CwM#LVR5Con9}*#|KyH^+J3?aGzc;#3u$- zdcPrlQm|037vlNBIKAHxKRGy4?>EFx32xE*4e?Whb-^TdujIUt)4#w|f{4U1t zX8az;?`8Zx##b_aKjRND{vhM47=MWIhZ%o_@g~L}W&AP5S2O-N<4-XDB;!vpzJ~F& zjIU$-X~v&n{8`4IWBhr>*E9YC<1aG)65|^ff0^-D7=M-V*BF1D@i!QMlkts=zs305 zjK9NpGvn_v{vPA+GyVbNA2R+C;~z7=iSbVu|CI6182_B{FBt!l@vj))%=p)gf5Z5< zjDN@Y_l*C*_>YWlVf-h?e`fp_#jQ_#-pN#*-_}`5G!}!09Z(|&e zXjX~9k4IP(?wcvr^F{~clcb!T?-7aNSdC$slrJcse# zjQ3%@FXR0f@6WjT3rMCv1DO4A#*bipAmc|eeiY+JGoHuzAjZxA&0zXBgxQBOK8*2W z7(bTr;f#-9{5Zx(GCqp&;~5{#_z8@UVf;kK$1*;S@$rmLV0qd^Y1}F@84V=P-UQL<5x3&4dd4`-pKfM zj9<_A4U8{g{6@zA$M{W*FJ*igA5Q?->7{ z@gErfk?}2z|HSyujQ_&;R>ps2{5QsbXS{{+KN$a$@xK`VoAG}b|CjM?jKlw;Y880? zXFOm$!g!SNG{$#gycOg4e>Eoy{Qtm=w`RNz;~9+a!uYO?@5Xpr#?AljPkoAr_RPLJ zM@5J~4j33B&XT}d=-2CjE`h|6ywJ;KAQ0p7$3vrHB8K1!TM8;2IJfHEC89#;bQyD*v@zWVUgYij>PiDM;@hOZKGG4@ZobjoQPh-58 z@e;=Iw@@TYM9g5Ee;!=M?B$GCFkZ>{nT+$_$50(ymzL~LTY&bAKyG_Lo*s4eE7|p3 zb|QN-=-R{Y%dmGCyxxug@(WtI{?;;ohbPSf^(D-HjWt5F_hR-5jL&6ybT8-ApzvS0 zfN(nE)6gnJ27Jkx3aa1ZBQGIM7S_)r+!67mgky;HFD~kg_(H1BMqC5`KT*P|X4@9h|d>&#w-G?I9Q++sMy{twd)=O#(V!fQkD?R)JB_F<|zK!GXq`rku zMyzk&MTqsSyBP8A6tq&r`iM}8SRW5?NKzj~>k#W>=sAe>5wsq$K7P(atdF`4i1jh| zQpEa*yAW{|`~zh%d`bOi)reR>RxLrSAE}li){j%SAl8p=D-i3)w!0DQN4AxSE8rg} ztKduOR|QRo^=pF15$jh3YY^+#1J5AVuOikX)~_KpAl9!SUPFulgR&96LwFP7a|wTrcoyN!i0cS{hj=#OEr|OP-ikPfa0}vIg#Sid4F6z(D!GjE7)9KN zH0g+Y6V5=~k8oSW`s2k+#Mn5LEX4X_%Z`YrQhf}u{&=!8V*Sx&He&27l&*;NN8&vZ z>yOj1EAm;=`GQyJ)-$J+u@wtSH5uZi46!C1rm59$ET!Z)=!k8*~HepPyJdZGLL*{h7i^fs- z-bv$h_}*1xY=5A}*#0n$vHj5+WBcPZ#@tTU82eJ9G4`cKwM5PtrIG@KlY_ z&*d7&0AH_hXTW!8{2E|T0scqhF@PfxYHK+7-(6$OE&lF5?86wqhiE(= za5s&y{{uA62RvBg(*Pf@G4{Ve;E)wl@o-x?PK-llOW;2=t4uLPW?@p!74S@rGXc-h zxF_I+8e`0_)3^`d7c`Cm#v)Ipy%4Gu#{8#ijO!*tW1QD*HCFqL#ucE?(s&JEY!7{| z27OFp?0aX8ajoMRP=oQqF(Af068nuf4>VZh71%5MU7dh&Kv3`qn|Zo|VlvKKz+?dp zE)*zAug`}AfoD!q)$0EUMV!!U|7yIp{{qtE5h@cf>hWzDV$@pw@u^~dC0?mxuKR{LmW!xf#bKI~i2dMOCSbH=Ym99jrZM^(tTE;g zhN1N64~x8reB!?n7a$Z!rO3pa8x-_~m{g#-*rP8~a?%4%=o>uxN=pwIRrn>ZB0aWi z@@~guPpHqVhJT=_@dCyx`oS00<8{L|#_N<%9Yf_)`&T{}Q(G7pc{O1b=W7V>kA7<5 zA1FQG3o%-TXpH`*XpH_AYmENzScdvUoOK`YdS{H+Qd_D&jf4-uYiGefP*huh(NYRu zSdZ=EQ3)|#r^dCM=D+Iy&4goMGwY%&;#;Ub7xArx#~{9q@M(x|CtQPg1>t(ccMxtw zd?(>s5Z^`kam05MUXS=5!kZA^OZYp)_YuZ3hg?Y*@0ap^!gz0!4-m$CvwV;+-iPEW z!g!C7cr%1jiTGi{=OBKB@M6SGgqI?IlyDQ`#|S@z7&j{@A0U35@MgqM5Ek%FK1nzO zG2VEgbVj^}Fuo0xYYD4dtRt*)@igHWT;t^88LC&gc$Tor1>Ve|s9ZcxSmk0p;d-#i z7YM6dyhvE(;w8c=7aItxT;QPq$|m@duMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnCt6bpW z0*cDTTZC0E-X^Sa@eW~?i)O+q7w-~Qxp%I2&-ItOjzY& z6JeE$PYA1Ad`ej5;xocA=(m%LMJ;tRqm7he)qx%i5(%Ee~F_2}no!YUWv5LUVP zmaxjjcZ5|gz9+m1ul<3r%Ega_RW7y=R=N0zu*${HgjFtnA*^z-m9WaiuY^@Dej}`M zfd@b+Di_?xiG1s)i&z&H6XVU>$*gjFuo9R%*_sF8R# z(R)-tSmgo_8&G2K<>Vqt^(q%>gjFtfBCK-Jim=Ls{>8ra=x1lDSGj0SSmmM(VU>#v z!YUWL5Z;8>?n+qYVmHDn7i|fvT(l#sa?zf!$^{;lp{QJB5>~m`gRsg)2f`{BdlFW; z$RezAu@_;Li@gb}T(`x92Vh!Iw~=tOup=H&pw;}IW7 zxD;_`!gYubBD@gs!GxC}#)kkXxE;%E!fOy8N*I^A>_QlqmOP9wP9xcsFs4o70|XT8 zqU=r>&9VpKp@@4D9)q|S;bO!&gliD@CXBzcTlOK`h`2A|m5B8(NPZk~f2!YzIG6Ay z#P|>cr3LZfgriZwM-c9acp%|y#77d&LwpqBQHYNwT!c7}a3$hFgw?(@n6O$4LkP#9 zZD%cD0HCO~FpRKT3&#*vYvEYJYAp;WTo2dC5roxR(7&wt7OWph^=d7QBCOT|KBz(2 z1YdGAVYL=cAgtB`CIO0C3nvm*Yhf&5wHC$^R%>BAVYL<}5LRnpB4M=_P9m(4eoSgi$o z$bzEQLM36f7S1HB)?mVYL=8U{KUrxQy^7;PP_9YAswr zSgnPHgwAiVYL=+B&^oL{|KwKa1&v*7M2oLYhf8-m5b$sRW5EO9D{y1xwwVuRW5EN zta5Q1VU>&939DSJAY6}r?jWpkaVKGwi@OM`T-;4q<>DT~oABCu39DS(M_AEoYDi^B=t6V%pSmokj!YUV!5LUTpBCK-pC}EY0#|W!jtR}2-feQ$DgjFuq5>~lbM_A?JX~Hq^>*V4Ys#m#qmaxjjbA(kco+qqw zv7T@}`gwt{%EgO>RW4p4ta7n|u*${Dgg4=}uMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnC zt6bp514ZTHEy5}nZxdFzc!#jcMKfWQi+2gDT)anE<>Gz9DiE8KG0-`=_?+rhF1{eFa`7c$m5Z+kt6Xd*T#tUfCaiMt z4PljwZwaehd`DR2;(NlI@Y){;t6cm@Smk01VU>%Y2&-KDOjzaO7s4tRTM4UN{7P8m z;y1!77rzr$xxkwP6qSoV2&-KDNm%9LFTyGpe-l=@_=m8{#lM7AF18U?xlnIC%yUFk zwWV@_FJ+;qTto=RfIGRsn-vt53w&`4Mde~A!YUW72&-J^58UfPCwHcLm5bJdZ^8OD zgjFsw2&-J|LU3=2Vs?q4un-M z_9U!wkwsYL0$)f&QMuTgu*$_ggjFu^1`b8#Vqd~47yA)bx!9ku%0-N@S{I!N({lu2 zdX6Amis$^!gy}hg@ItIVm@qv@5T@q{!fQ~2FV3ORa|GefvHmc^^c+Dr9j1%yMmUDJ zJK?T~dk`LqxF_K;hA#VYL><6IN>hKRkh=*1|->YAu{ZSgi&8Pz8!w3nvp+ zYvB~aYAxW0El|{2IE}Dc3#SuSYXLumfuh!e{)1I&Elj3*wH68p({lu2dX6Bh)&eFF z3Oz>A@VS0`rOwSR7)mkVaOwSR7)moTAn4TjDtF=%@SgnO}!fGv45LRmeClM62 z7S1HB)LH?6~iKS$plh&mJB2 zY}bDG%w2ZfZRgf)GLAUEUe1wo$(8bc`G9;-u96SQ zhvg%(Nj@qcldI+9@(KB*d`hm7Yvnrmw0s7B$Yz6lS-v7)m9NRyMz6BDcz4%uiPfmjssvmj#yxR|E@#D}zPBRl(xm z>foB-+MqGGF1S9pAy^XJ82m4|DOegT3zi2r2e$;b2Db&b2P=X*f;)q|g1duzf_sDe zf|bD|K~wN(@K~@qcszI_crth@SQD%b)&)-o&jil~&jrs1>w_197lW6A4Z+L7E5WP5 zYr*Tm8^N2w#^9~s?cklDIe0gCFL*!rAowu&DEK(o6nqkV8hjRf9()me8GIFN4!#b) z3BC=!3%(D22!0H<1V05o2fqYcgI|N+f`5Z;L49OSWNzew$h^pfk&7Z1M;apYBMTyz zL@te77P&lfMPy;*%E+R~RguM!t0UJ$u8lNCu8UkBxgoM7a%1Gy$Ze6^BP$|zMDC2- z6}dZdPvqXneUX)s`y&rT9*nGtJQR62@<^m9@@V9-$m+=BktZTgMxKhSiL8yRi##29 zCbA*&a^#iBtC80tuSed9ycyXTc`NdE?h1dGzM! zEzw(}w?%J{u87_dy)$}O^zP_A(R-u!MOQ}ek3JB6FuE%GQ1s#GBhjYlqtVBrtD}!c zpNKvgeJZ*px;DBl`gHV}=(Ex1qR&UyM_-7(7=0mS-$lQV{t*2!x+VHk^yla=(XG*6 zqrXLekG4eri2fPO? zU7mJD+QPIe(-x&&m9{wT>a=Upu1#x9yDshev>Vcvq}`bIzqFgumZr5zkETs8KT~wC zikB92uZh>ybdMKSPAaP?nlz(gN@+>WS=t0JUR6+~m6&m3rXG%A^xL@T3X#df;v) z^c;u7Ds%dzR_cM*iLxp2qMFj`NoAEKlcrTw%o1w$2>d&wW%2TwgdLhhdu`>UlJXL$ zj+a%(lUBUClvflK6-_FbQk`&tqUz$3sWp?T5}_@ut(qCn>D#y0fJv2ZWuHE|R+WmI znvh9ZGD4KGqy^O!`ea>F%`M8env6*`)=^55bx9ADk)#FHln}R$^1(NC>y>f%~c2cL5)Re}{-PlsVStSNMS*3!a0-mf(27m&dw4j>8 znygEzxkdR_0Z*#2jsl*nOM0MyCoQO^fV*`Ra8{=R?$%Mj%bh^c)GQU<%PVT)-H#nT zp<8uLLE#KXQ&wAwE5)h9X^wT>@sIUR0tSEIcbZNmPWg)RctVequA?kQl?b;%6Vj7nOPGb&k^RMU(~T9Px$t)m&0tV?>J8I`moXOvqQwjKI_jQVMvjel~wR5%I?G%G? z2zSA-RP4ZP+HX`ILH{d0uZa&+E+?b8JJhTRSkDUOQLY z-A*wWhrPDnp2uw3bIf*oDF&1Ie%sBwZAEvcmv((>P;4t+Wirp}P3Gr;bbTk$HBd0uZaZ`UWinK9W`dq}+AWIm-{XP(!a%=3CP#vI#_?A8v6q&(97A&8W@L`p9$AXPWF*yKrmH<Y>a8l}ZY*&hlB=rhCU30cOU2Ur!BD+30AQK_mY6pndoA}uENpB`Rw$+XfuQ$O-sn@aL z^(HjDJ~0a0knGkD%!yvxS3BM2hQxfd4axRG&2}z&g6q&(97D1rW@L`p z9$AXPWF*yKrmNj`bY*gqdWD{@y|z1DZL1Ta(5n&=vaC*kSbZWsR((i#EUOb8R-XtC zuQ#z_^@-51dNYdN_TZD<+JV_5)w$a4c8b9`%-Mc>97!vb8yuDB}IyC+4 z6@Fc)8Lu->F3xpmNTfg9p&41qb@chf_(>^-#0;<<>Mp=1bs<+I=0M67dU^D;CP#7( zm>AhsJ4AMU@+uP{+iC}h*PHm*^+|6gJhm0RndtC(6P%QKy*zlm2@S6|qv&lLlHJ;Y z+4S1E+U|CW!8pv>etRCXY0oj+?WGt@ZhM8d7iva_rk|ecLd|$xVtLr@p~0lzS7SwcYI$gK-ESMQpDvJ`{KNUA}nB*kEIl43AX=(F7z*;YG5c71X{CPKE=4iK+5 z@v-ZZ-b~_cs~sI)Z-SFjuVcgOO=x(%83lY45jK5xU^cyWuC}|KVlbJ2xB6l2g_`YL zc&;=3bj)@(QVb>?jv+N4j@cerios+g)nKNpJ!Euca*}#Q;uDVT#i+LxK|4fteR4o1 zLblZo5U)4!vFnrGOyX^;9UWe8f|F9OW5erBXn4ID1$-0{7MdNHO|PA+?QW+S67w;< zy->5A3-~l(d;N6Gb~aKBCLN9;H6M=I9$AXPWF*yKrmNj`bY*gqdPU+Bj z?ZBMqwS6^qFVSsoFtLWW`rAu|W43eQ7*hM`m{pwgj~b>J64N!jBW7eN*O`%}7)(Y| z4Q9I9En(kGPExN(e8REa7+Dc?LS)s4M98u_0b=!u_*nHxZ;9|&R`iyL4y#WDhu53f zu=+%3SiPB#@KHoqXm(&Wy>_m)yPaY%4&kGS?X~AIoAw;D-Cl|zu{^@t3pJxd(@*$d zVSD{_%y^yItWpe#^oKh%BTKn1F#+uBR7>io($xnU$sX!1m`^xdLt+kuxT?aPv}fp8 zO^j@-9U{9vIiXDeZL1w1UT@-K*C)N1@Yq)LW}?IE&GJa8*UN*~o6zujGYa@9A{onM zw{~DQy>_m)yPaY%4&kGS?X~AIoAw;D-Cl~p3_9Ln%qmE z1HMa=CVoj@|0TxcUILN!U6M4pm%wcGU6M4pmq2KImn2Q@B`W^Di)) zz;*b0TTC(j4gj6)ZzcH40ulP#8NM5TyD@(oz@PoMevH4?%-?#;UmMHcWVqhWM=mrL z*1uEPcsE)8cCq{&!~Erezl*?bis|1V=C8%_w;PDfc()$m_HRA-!@Qef{QU?z#Ch7# z7XBE9iC;UYGyXnc{x;%xA;zW{fA27V+2F4;h%g_!!*}EFROask2yR&aCNh7ctp4p` z`5VIgZ3chOn@(vRd=p18e??aR_O$%1W&T#SrM{yNEXMWY%wGfe!*Sqv_tHA#cQAje zz~7#bOH+)$TbRGamcM;KY~r_#&*u)5H}3CGHlLS*zn&n%{_Sh|`-=Jd9Q@($G&05X z?^EXQHSjkaMCcEH@4M;Wi_Bj>1UGDbJj?uL!Qb>T^RJWTZzc0L8T@6M&S@ReyO_V8 zmcIkF4)bvp^H<~P-{s8TaLeC8mcQA|-#MQC)i8gPEq{kt{!U~57JB-367yGQ`8(9| zH<s#{LN(k9tVFD z6W&ON^i1Y&1NbxZxrgO1oB7LxNrm&u6w|*0nZLimAA~^l5AXM;e{Gq+uHbBEyaDK9 z{Iy~Jak_D`v+_mVe#vzugQb&Sn9!_8E;?U#vg7aw!h)v?VLrYlv-evL2{wEo~>EP4Mzje0Q!;#cF*ozLQT zi$`}6^u&(KMvv}77C($r*f<8V`1Ju^Zw3i%8Q34{5$C}dmJL!S?yGZwqYd}Ji7bAr z;P9FU^`;nq8(93ddUSg+U7w@F{i)v#42{6_SEa_IdkL&|{8o8%`0mEmZT09bB^L9FH?zX>dkM3-EuVw4 z64cgJdUV^mxVi?9Zr}EK;d z#GMDZ9^E-?|I7F2irD^F=h4k&`(L9+H=XT&O&(nX+y9z9y2?)Ocw0QW%hO$5)^XwS z>&5oJT#xPqSTy$f&G+cqv;D8mqr>-yw!cP??w1@_*W}T)WBXsTM>mx1e=Q!}6t@3m zjSP?9)olOE_2?dC`(M6C_hlD%ymcO3l+=g}R<_dk!WnD2ic-3^Di`DpU!9%cDx_UOLLcKx+@bglXRcYJvK zem>asm+R5B<@=vU*V5VbSLe}n$Z&Oy9^JnOxVk2fu48Lg*X+?n`Tpn89l-a$(c$r1 zo9nil>(PC@zpKml=$7|&b#)%y8hF{~?0+8J1$_VW=$7r}`fK*+Ho}LGcDpSe-On9d zUDgTV@jIxStIPH1hVcE*qnpY1KaXy4JGb3NkM1A7|A7v+oJ29_zkS&GZ?i}D5!?T= z#)SL(o9%zYJ-Qz3{8#7E9nbc^6&_uEcQ-E09^L=g{+E7Y_&8o?`(Lg{_aoc?iaojm z4t4w2=+Wi1b#?1Kx@>m-Yw_rg+12%zJvMy2-P!ps-=iDF_P+*?4nNPb*IScEH!W;nBUv_P=J2u7&M?>Epx4u{y_%U#>^@ zF5CZ#J-UpZuD?c)t_wT=t@r3oXZv4^M|XCn+iv!R@bTWu_P>0OZbLiQUxPu*7`8svdvv?A_0i(d^g{@dcwHL>$w?&R?Pz0J;l^&Z`m?EJUhqx*oJ|JoLWw>x)$JFoIR zx}`B!x74F6?C0t>dvtU5b#*n2 z7J76av-?}KNB0lAzs078_wNgKe=GLrB5b{_^ypUPx^Zst=$_l()#XhK@85iO{%i2) zZtv*&d(ESp&dz^X#o_HX?B)8K?9r`e_m34G-Mj4mvBjgyVCy5dB)orJ*z-}nM|V0q z|E>4v&SvMow$sDgEzEY~lJC*YVe4b5M^|#N>ur?Zwtdc3F7;`m^;>>CwHw&wrqUqg0|q zHTsI3|6cRx?quh`%^ux)cK#FP;qCs#&VN}R-Ck_{_VnmRvGqILqnpmw?_`he#;)!> zsPpJnv-96VkM4&x{w9^F{B|22Aa7qb1Y$)mfO?SIW4-P>&cYw_r|wspsmRTUn;57_>f>(TwWtLrb{ zqx+QYe{~+6VEbRAN4NPvx7{X>ZYQ??HG6bFbaMT*cyt+T|I4ZlkKZb`|K)mgZ@{9l z_wjs>?rOIG)p>Levi+~oqnp{=ZMVszTg>*qW{>Xqp02+ZkM0Y$|7F#L$1jWRf4LrA zKeqqndvqmi|Eu%pE^hCRqtTFZFW$<$82q zv-f}b9$iPi|9NzW^Zn1GE93j0M|a8Y?l_t~x+nSm=h1z@_rICp@q32ve;(bZeE;+4 zUgZ0qN4Gh{9dDyY_Zr{-Jh~rRyZ)Lzy0`iM=h1CVcl~9}3Xk6neE;+49_9O=M|Vy? zx7|9A?s~red32}ucKtPZbZ7JZ&!fAS?|&ZMhCSVOv+Ba*x2>D2%k}8?-NV)8dvs&? z{^!w^^Zn1G`n-~T+iwtWBd=(_X$&!g+W z_dk!W58wYhx{iGR^XLxe``_8&@p~`VomaUYT?>1EmG9B5?(6!i^XT4X@2?s?x+OWT zzb23FvAtYfvq$$mJ0G-obZz+lcTRZxj^g{DM|WDL+rNB|?ust1uFj*or=6>7^yv2J z@9LUB2e*JkG0(rf+4*m?NB0}s|FX^v_m{bk+wO3W?pU_})p>Mrw*Rg0=o;Dn*X+?f z%=W+Z^TNmRHQWDkJ-Sxx{8#MJ9nSW@MvpF^?SJb%x;(c3wRm)Au>CLl{P6J}!}h;? zkFJRAe+?epD8B!Bbko`Xx7ni`%l5yl`tWg7vi)zkN7sIUJ5TF8x}Gstx5A_Qh3$XM z9$mYAU4Q9w!pE_Z?SHu*-Op_QEB5FPV&}g`k8TLt|JHkSGui&v;?XT;`(O6l@bNy+ z_P>0O?hCg6HF$Jav(LAhJh}&WbMvv;qq~89zLj-B_&6SA?}vtabj#TL@j8$0sWxu^ zR(N!`AK>bmJ-TPv`=RuC;p3Rj&j%h|!~Sl&#U9;Awmup?x{{8rzx5tnSGGP{Ji6o9 z`pCX8e7xtf^Fh8xcS8rae+?epD_vb(lSlU*yMJu<==NvpBkQ8@aU99k$8eACAhtg0 zJh~xleXQ{44m;Q#Z?i`?f~}AAi^Ip!tF!Ab*P}aut&d`lu0LBJjUL?uwm#N-bbqq* zRf|WL#nwl5L-=^#XYbeYJ-R>G`KrOAD`fp^0$rX+mZ*kv_H*Oh;?WId{mY#n?r#d~ zU!6yHH9P+`d2|o5^IwZc_a!_3RLRyrJY<| z?q%WqdotbC)p>Mz_wA zlb!!^uL$qoVs`$k^XQ)M=C<49(S5&MNQvR!{o9^D(e zxw;mQ?lE?M%e^wZf6cqN{^~rsHSGS@n0F|8lPi?_UEu|J8YPBXitwGmGA z509>#uMdxIB3~cZhWD?AuMdxIFTOrJy8e89cyxdEar2hj7~a1uzCJvydxnN{YRp^Z0v-u^8QD zJ0)X`_2_Tm2(r%yJ^ZJBzjVC3rmCWHcK5>W6;r17h{bxwl7%q++pkX_W$4?tCxO`H z*5?l!b&QmzMf80}qJ3<$Zdd%*{N0Ca`2F5VZNEVxqs^ni++|}HEMK>5@tkejHl>T@ z>)Or{0>Hjo=t?0#*AN_>zCW6jCL?|Bl<{+yjbE_*fn^J+>YSGO0bT*xxd)8zIN;(t zq6gf!Zr?2(M=Wfdd;Ov*B`1$9$sb%YF{fn0J`HenhEgki$C2RTp5W!khf!#@TkB-Q zrUUT3-zQ>J*2R7Iu38&p?1K8}6KOBE0)1KQi8G_4(vE?&M8^&qk~3&nJRc+U;?FcQdI8kXP z-WHkrbW3CUih?_@yDmNF>CAnGHk>#&d;Gb_dUIQZO7-Nm~!8m zivqEt(*sNEQ^sM1(+e@q>BlyuRo(Z@F&)JKIiekmYQfz3oig?)*tRVra#`B(>GuSi zb`s~do_K5&27g;t?-iY1PP;Mkz>9xxZu7v4EzND7hx})r>L@>qTz}*8 z7c<*5yxeAD<3Alnih(WH=I*o4yhY38wTthEcBZV&fS^N;cESL++II_7WV9KTficIb zv1;1gllBA>XtvcqXh{QNzEc*l=G@kB@x-tGM4uVxGjY}Je~fB_j$0|WFYojrPM!|O z!4=PayiJXx?V@F;UB4)!^&LAedI7pSF@GEA!N&^u#7^tmf%>Aiwt3^`GxQtOYWdnR z8LdX`G-%s4n0Y&Gii+iH+iG;;wrw58ie<3g(nM83XIP1gmM*;h$|*011-HS9e4-Vq zpVO;ObsV}e@y^KHPIa)v4$bK}a%JP(1*Wv92V)s$}9?A=as- zR#3NY?U+%!z&LQcU0{MOTrg+(dW;=ZWbE1D0p0#Gs7O=sSA9LQl~F#hc8u!w#4dkd z)@sq(F$=C+v@?!j!JQAZ77K5PEjmu@(=fI9^L=_xz2L=+^hIDnMTY@@VD*p2jc%}2 zhvk1jQ_p=$v4pkN^)4{o6L}d||A;i)7-F$uqsNauVa&;~ns{~1;W06_prkZj)LK*) zR9EA7cz_&MU0D^ct}dAxD=aN2pB9@Luc|JoD39gz?B1(;uUK|*O-*I>;XQgxE2$~2 zozlIqqO3>UT+*YobY@w%%BqU#@xq$!pooE~8(ldmr)N&zp1C;#;NhK>)69(v>Z9T( zXEH?amx@~@qW*GDvI4dmF+krRYN0w1?UP185$7)rAm{c>ajT?D?oijmL!eb6&QJQ| z_1q4J2&+UyOnj#Mvj@}%0uFOliKxE_k*tWM*t5mzq*?X;cE;hcK$RH$+aCTh(K6j0 zRt)xzS24d|Wj^iQ|&L&s} z!WUxHo~$wYn4vLVhecwipkTK$twWpC{ZZ{||EHq{mME5+;0v+os_~=rI##NmI8Z36 zpE@QOV-rJoWD-)33u9=;g~Kyrk0IV4{(;gNzRY;>vP?aYI*rkOiN@F$c!W?I?8~hh z<0bcKjD2}TW9-WYjj=DEYK(os-zAQ1#QSvJV^rhSaaQBS3Mgv4 zI?igmF;%VFkb4qV;|2eF0nLUl2^gE}sxdZ)Dapj-Ls9bzF!lwn#d?gxFpaTaBQ?fu zsJMX!`_-W9v0r#Z#%p8n{T7X}{W~?r_8-<5``%h6^?PWH?PD>qg5$Nw#6<&TS5X!( zE3BL?y5k>((|-p}{e8HyDef!?UGl-L@E?!n0uMx~tT~kn1Q@y=5rxnx`$E$WQ3`Z0iklM(cqpbqn5v6K zcf1`>Dkv&~JNPtFSp|(uO-L(C3u>lTRFzFSD_&Jma#q|9oN1PN&xXj1EDO#hq2Zfa z6*rCfGOr}ev2~dfz@pl+ve}cWD{89>xm(jyR}$JO2$Jg~R5i7>ypTo1^wPAYB${*w zadk~qO~DlSKD!LR8#zs9@KphGsQ^`QxT2N$-~OEnHw=9%Qx|*!o6usb0=58Ea34af zZ%fYKDMSJ8O<3l`7uVsnrWoBks6d>j4VS|HiTf4qN7y{taE~j2FWcWh;4%0z#rP|N z3ftc;mOtFDjK2%uK5zRw4QyfkI}dcWzsD_qxYZkfh0I?O*t)=%DX7D82J^Sk^0zbC zjlUM=Zz0$)CZ-sF$HO4(aXbzJV?(XM!$E{N4=bU32kl~9(I%e?8ean!%=Tm*`IE@cUsbE>TEEPpHTKq2BoG!2E3nTP=K>u81jlT~8+y07x=vyRMlKwCb zcugLBVZon`GXC&*X8bLI>urBEKtP%(rhnH$z3uND5Sev^-;KZ7%-=b{@j1m5;}6@h z{Vlfq;StvOI|>#lNE7=(HpD&KIMX_$13+i{yBqw~K|RI~&l|?ye$3w(@P~8F6x3na zi}}OUTW}LphKL8l~C4$KQmuC14kS3$C$r0 zU5lmEr0lgY5ZNN^N|B}Sl$A|fdtjR*mwLoRev|JZ2?`8QqVs}_XGgMrksYG zvQ>=jGXVCx+fC3vv|;?P7+pE^4~CK`=+EpqW}V~y(W6)IzR9<>|KZ)Oeuo?T5ASZx z^J*W}i)?tK0KNPF;k`%qL=-T8@ZLk8#S_P8cFJ?lbLPZRSy5UVa?-GT?+6|V0!T}u zGyyt3!IHVd9OBoG&JuW^MV*;j80WCLg?UDuDUAl`@5UAbZqF_39~RROqZz2amSwvJcGf6V&+yBv|bN4t@j8D8$fV>rDYjGZ|d-WAqQYun+=0ACum+LSIn zY~A5yv3A=w^%C)k=yQQsE7Y6e$P>{I@s%+cF77Z9{>AIwjw&5gpWeDdtsJvz&BLc2 ze#*^j)%8$&#Dxob*AHETqNMYLKXeXC?2mT7@0KAW#ta`eHr6dRzBnF(hfsK>7%z%V zjTh9^R>fl_)iGEdv4WZK2D4yFXqH1QUorGib~+EXhAtNQXQ*` z7z@bolWQ&(HvoX>7be4G+2weTrdaGKjio+RO0;GcXYULCKs})=nuc zDU3lpYat{w+EAai(A5noC@rjo=T{wN)75H-eZ0n%Vz35{8x3!+RYLW&!3W=h8k|ps z6;)M`!qVBg3xjA@XwNh?T#q=M7=(IORS8TU82?mwhwe(o#cOIXIM^}BUTtYDEs-Olg*25k)WQ->vI79JS62~Y=hC`WBJ9TQj3e#RwQ4y;ygGr1^>Pt<9rNl`G zFKxE7WV*(1iX~-l{^vbRNyC<>GaHoZ81Fu&%+U98wLGgJ zr-?Of&(tx)a4#5L5kpW68kkl%F)QHB5`L>KFA}7|f8hlMy3@-C(^FSTJ0EHM-68wf zaf4zbCYtLZbj9(yZnO$@D-+5SvkWsHiVPYyAN*>09WsqkagZTeF;phc-TG&wdXt3+% zAn>2Mjee2?w*zCjq7e=&EiHj#Lt!kj@umi8^oVie$qu)ZkSI+k_f1m_Z&67#9+cn+ z1=+!h#Qd;sEdR$_B~4BkXGLudp1DG9P%ywD<9g*lT>ryF)XHP@G0!>U={08u##(pP zg?PhAHa2GPF#FE0JlXq}>D2#)DKlhT-~T!~6iz5NyQkGb)p4|rP29Mx!9mK3N~Xd6 z9On}|`C@qS!v8A+=?{)@KG5E5O;a8Gq7poSz;QKJgFBKLi0VCF>z{)K<+E#WuZ&gH zz^5>9+k}k@Z^SSo)lC19jYG@cW2wL*ok{D^YCSG+2 z?o?AN5;}UO(VJJIc6*0ila7h;DjEbHgy=S(xZaL41y$2vjh0u`PAj&$p%2{rX#`Iax-Jfvmv_TY2CK!maibt*gJSA9 z28ZB+%3`=pCA+U~iiz`a_t^Liwj}`FHho?q-HU=1nb7GOzQ`j`h;do1D|01=7i{N|`8+O7m ziFlZn3M*<$i&VH18xc%5Sn}|SAyz#bULb&@!kBvLq%Ve3_t??Ls>b2DVrEGZtQC;s z634!&N5*(kTUc6xn_qH2!G4)u!=pVsJmIAzgGYb34P&U)5`^a(v=zAT81R*X_CJK2 zC)~j(;l)C{9Q#xqhlju_IIF`E*}MzEy$CeUO&Im~Lt@D;4;nRQG|q{dio%N0>g0J2 zI#U3*jzn)`1x3(8O-Xg!OtkS}tC-~;+Ho7Kig$w#O>tMjW0{`d@M8cp-g0=ok;ou~ zcgUdFkYap917Sjx2nxiS=C29DARLgnm%$4mnnU*FpfJOy%(2RNVp0!+DOLkds0F1k zhW~yU^iM~Y<_^pom;&&)IJE?Zr%w20$ETdaZa!}G2pwGv5cUD599;o#7m{JMW^Q$C zT7_~{f%nM5(h9ss(rOq}RZ)mP<%hRpde<|=x?91mxd?(i1K*8NDD?J27k7a(3N4w~ z==iL0=%=E5d`aO9c=0?sJI6W1S4*Tb$*44F`C047qAdb5D>t}4O%I))Gq|78WU zRY#%uX%Gm=dKJ7!fR(8pY+%DvLxzv}sT-qVhpViB#^F?p%LgBHWATD2c$`oNif|P@ z;iSmCPhaF^ctKUsEWD8w6c)l^M86j>FKD1?cqxe|8TCfMUg|rzuzE&GWhGqKBUT!p ziif+3a{Ug%v}-b97L(d(uo;-#WhLc3$_naYQ}AiMpsK`KM9CzU$EU$mvEMH02+P#%IP$ z^*(BRz#R<2gfBN{sU3S3+{tJh_$m#4ng`wh(QL&i&^U_B#nzGCED6}h#;N^rxY`~e z9dIm8Mp_Sc==f3N^v)bBtA(`zQw4627&O{e?Yq3bW>DBu6wPq8>~Lk!G%he*)>p#L zf>R&Ybn<4a4(jk&iKlj08_8!xxQoENiNk_Xy968ys_`|S_BABAljw~TUtm+a_zq0V z)P9{f^3=e3hLu}uoS;?TzVJu4U=o7405eYBlXowAg_dj{wivuY>o-%S6%{k8_1inV zzv=zoY}r;{+`Tw4wMxqAHjZP!vkh(B_DY4#yd(~Ha!6z%tm+nBQf^)hLEMqRy$)Wi z!W~(yc6yvq*P45nnXcW`yN&;cy>|hRqDa?(duDQHkR*f}ue$W_5rH;f7s6c^%!fU+AfNvEV z^1pBOS2I1G3Ezg6|sTVGwey1KfnS~nOq>sV^`>}Wi5moHhy8zBki zYty<*URtbLC_3#T^as|=VLUOrc*%_z(Jc)ff^oQqnJ3KsvxHaT^*FNwIWJR!`7Kz2 zAu0$||0oo=ILe(U0@$AW&gFBJz-*J{L>xYLM7SXp7=q(P^HLHRB86OeaWbfv%~8-O z=D8*FmYY3oAT#Cw4*xO0LPar;rlK)zV8-CH-hXnievaun;m8ZzfnSaMps6i4dn}y> z8};zKDVGe-8-L00$$3BeURjc{)9B2%yxFxTjFCeLu9vM%CRw=8c?WByUC0_e4^nlT zcOH7dDfUohxev6MsYaWs)~Ikpz{{uy-jqdOFbj-pcJt&-KiScpCa%%z;dWXE=e+h}(4(e|8F15* zxwzTJ<)skswdy;#+>w)UYLAuMH;zV1=PaDJtk?(*P?x?E_4GDuxEZ9zhPioTLnk7v zzB-{We3P%rge6zw3WQ6n3cnf8ZUd7vXp(r?D9;-4%w+j&KCCvBAMT+U#752=3&d9q zSYN_q!dz5Gs<|J!8iU#l~18kvi<(NTz+Id8`Y!MIxt zq!}7x1cwgj?u1X9-RjU-Y#nAklMFtPRAzIaK)a!&AHD_)WLWOxk=a>hNm^!&0~AI; zLDvNu%o5y4<9dm1Usa?rY%E@Y=0hx8UP7Ch=jLKQlhseYRGv{z+9Y*n&SzmkigV65 z1QJ89&G{_V{pf-ZF^+YExmrAUHy@e>6G7B)rwm7S=CBG6aINW>`NaI$yyd)0LXt=s zLrje1@oW|u!T@`DDW^6)C8eeCFO^yNv$3e5XHm&bC92CsJ~+$Mhb4yRu5fZ7fzyu< zMbAbf#!wk|M2qllv$Z%|Z8F1iCyX3FKHRxy3DI@l^86bF?>qi%n^CRMvFCQ8(in?F<*k$ou*AGXtGTI z$&(uCA7DMtzCtV%uthY>BV8wQF{W&aaBAO()e6c!btP5ZIADIXPZY5}IB zS%;`;jp72FQ-yQTnJXo>C%#!{Q%17r)6PGR<#HOD|B-olSM%j2^(sVQdQkhS*%DMq z0s0F(bvGN5o^_r$K6lEftMhm!w47Z)aZA&-sD(CJ+vICt2*h_F*kJX_5M%Uk)w}9u zr|#WaobQat^s?3#Xh>H+T0_={g{g1 zR;?{^$N~u-^gan(b41Lw5D9{@v`g)3L4SrbOz%IS;=14g;kr5QpTKa618aOJjPKw- z2;)1jrst7#bFGEmmw<8UUk-l{F%==*@T31@@W-Fw;G#-M41Rha2Cj!9X1Z#9JpjWm z7JpK4Ee&;8HiHB+&C4wQqXnnn$n`DM=UTRW!5$oM5Zn#Ng@VcXbHTLHFPQ1xEtonF z2xhumd!p?DRC%02iAmm|XP#3_o3N+)ILX)BmTyw43-YV2|L} zfJ+6>MBOYBd@1lU!KY>29pfGVE))Mtut@Mu!ApUeN9x=Me2?IFf!7OmcfopN!P&sf zFZE{wbKM;A-N03Xp9ZcLd>pt&a2ztSOYjxIwSsR1en#*f;CjLCu7>fl;7ft`3LX#q zn&2CO8wIZi{z7msoTeuQpG29Q7JLNwTfsYkzZd*G;&Sm2^D-I72*C?+;HO9kHmyh!j!;AMhifmaCr zE81R};6JoQTN3;|uwQUC7FpgSxEOf7;75S(7yKr0rQnmmYCSD%>wrbMRpLJp_^9BY zM;OL?f(HXP3GM*=k>Ed|&-zsGbHHB+egOES;DNxW1-AkIR`5rt3oagG`80wvLh#># zV+40Xm|O55VD_WbUxN0QBKQg5RKX{KJ%R_g(FY1%3e5GmjQcEbAHn|wR%;~T-xcMV zCH^CU2MN9wc&OlC0OtsP2$=1RoNaObE))DZHZ-|a@EyQqf{|O}PQjM|`vp$`<~~B? zVZX9o@NVGy1vdd#3XVtlRSC`kf3@H^;2OctqC?vycs_8g;J(1m2>xeBocn@b0e)HV zR^YvYZvlQya6jOKf=^>%_F=($fsYDa1AI*IINE?~TO)9U;IDyW1gFNM{Rkcl94~kYFt4|aTM3*h_z%Dy z!Q79go8SWAbivO6_Yr&wI74t27TIPAo(nuk@D|{qf{y~{2u{QT>hXfF0iGiGe&A_> zyCA>Z!;5z20xuI>47@_{8ej@_-tQK?4thPo>)_wJ2d{%g@JBY4etM7Kb?{#Jqj@O* zYvGSegTimZAAbs$!5>K|{114h3vTR*G7&t~YpzeFJxOWidQIXx;6F%ou7Lkg!B4|K zNAP3dA0gNWo5u+L5BQH4Tm%1!f|HQ$6v4lP|1`lv;Xh08V&Gc^x4|H%Oz;TcI|X+G zzDMvMV9))6{{~zw_`M5**V7+>pArA3!2g=y_b)Q{Sz>;>03Q|q9N_l^uLS-`@bkc5 z2#)O*yoRm;J}v$OfWH;|67cteX8`9o%(|F^^3>O?yMd>O{~v+%b?P(NsjoZNBfrZ; zXDRTlg70UU2!4xYBKRM`_X{43yz6Vn4Zzjn?_>E0-p29~d>VGXEVvWu=rzGPz>R|2 zp&=a;F)Y-{kR^};C^^&>!Stc9!33@%qcBULH+c@Vmw-zsoqbTiRVL@6mDfh znO4+f!h5kP?KTyi@3BYdl=@%?_vC`d?Vn-=@Ssmw-G*8zGuLPKZAVe z0#q3Ja`3bAmBJl^pBBw`89c0fA6e{+mN4?A;%DVs1~*RifM`D2VdXmsKKAkS$1pcw z-(?`P@>L?N4}MxSUpADid@-43KTAFgy#jpPr^L$l8p0maWTHoBXB%HJ_zuFKd>CE@ z_#P6z{_vyBhkGac1`(#k-)C}kihojX^lg@grt|R;!matp0&xrqnCZq#7|VGce&p4B z>-(DHV|Xdie1&jX`GyWQ$3Eo4B|nf4)*<=WMkqy>gx|m6Iw(<3OC$8GqQlsqTla6^ zc|>8l6s>n3fX)N`$=4*|Y=^X+`JOj>fo1oG^Vq*3YhYH!dG6m3(GLkg%yT&17%A3e zb5G}e*p(T36gZo#yEvQrf&a}4eUQD%DBa)V<2F6Mj`3CPUDLriYQEv-=EK!7dE}o;3-I3FCr%#$*Fn#g#%v5(> zL;Q!>OqcPFw=v@-C;1mw7SvCw$;~SqkXP70udsbyVPaKd?%U1HhY!YAeY(8qpy%-C z@nv5olDg8|ytXkHp|xh{UsdQ!j;5D9dtdU@6%JdkLf4z2pQ+GIj;2kX zy>EK<6<$KMFc@7_oFFT%4=64+Sd)6QG94SomRW+{lRqPw%9(5ur^&duZ z&f)J@t-q@FpAmq2-&*x%5{|Vmt}0tt`$E*Bvy=LESprD^%fZd1zn{OR0{f6R#LwTk4I2z^ z&VVgl=FWZYlVb1gC{gVj<=Z-K?U7WsZdIx^TK5h|d1MzDV;!v3VLn$o_xF42<8vOW z^>?a_J+g1i;g@PZ?XsfHe?77z!QC$P)tZFwUaV_l)K1AQz?RIHL>ldLntH7&@h)&5 zYI{6l)|K<842!dtS;wz@jf#)xTq@Kgto`shoXwTpT;$9%Gmo!{H!l) zKfS;}v%NF7?B0x;&Q<=5{g?@f-g5z>)b3byczNxo9jm@1f#>m6_0d&77p|N~YwP1` z!BH1K>!sTIHpWYe<8G6qP4lgB+b?vEI@-LbK6fi_TVIM_)VO@_pFGnXM@G8W*XP1x zJv?wCjEtyyBfjilLfJQtz0IDJjm!6qY}eG7TXitLX~ptI2R-{n##F70FS|LRY?A{o zWGt#&UNJHnXGayzj^gFBHhC&W8i)VWbNJ-fUyZ!r@Uh$@BimNJug;e*9f#ld9R76q zha=n6KJTe*`uf9>QML8Cbt5CIEN!E#X8E>}uD!cGRkdH&jf|_R$=x(Iw*Kpi zk0F|HPS{+vmR6PW38>*sCBu$ZpxOaY(E?cD2LU9UJ8| z+?{S2uxP~I&Hi!NhJMQS!4dA*Q5ctW+Kg@Jr%rb~_e|!DCGMz6hOsVc?Z$1f#@eUR z5UL)}*fy5iTGxNho(|13(&+zc{IJ(f`V&SEI+}c^!|y<6foAH`E!5v-K${Wy)o1k1 z_JLE;$lhvTSMjHIY~8V8$EwlKMU?K`?=r?lCs!M#2d;TKHsh|nqw8I4yS}u%agFYF z?w=gLV9ij+@pctyliz(|<4ZAXhQ{R||6!EVIMHs+%cqZDkl*$P_fJZrk6-Y{rOUdt}0laxecm#xC|xT3dnY>9P|QvuJbt_D)eV zD%k|&O@jKvB^%n16>}x#vgX=`ZgcyIp z=s`~;--({_=87jOw;{o|*6usvHo6=?GTx{<6#pNoQJWjv_}{qf($XJij$|hq zrM%ffyUbPH=-M;BOA6WF7u>& z<8QYP-dOMAwc_y9gu^2ed>7?;(BiZv#}cL{y6mS}7Ew5#VvLD*dK$gQ9DBFm%Hc^* zNUm>_Q<)3ivQ6b-~9D86dohX1PDi8z*dg30E8ZXAIx$8?`MzU8+Fte3j% z2IG)xx3j-DCC%HZ!rR5??Y#1-@~xXDZQ9Ulm9HVAd~ta$DmBx;q1@}=TAtv4s@$Qz zgRm$1&4S|*CnA5~Hd)C-6zT5h0lc5dXP=H|453j^O>@Kx2W zUFB;ue2t#+58P3?&COd4qpqr~zxuR^uORhM+`6c|f~1m$7YYVHRlc~&pYUS(jt$!i z65d?3ub}JLt+z!L7I@MMI{T_lsxK?-i8_Q2G^8TiKJSIe$BeDb%@`x@aqjbaa1}w3 zEGcMz%L;#Vtv>-ns^F4X*ng`UlyuvwZyaV;`EBHzN zRPJTA&D(ybe^5;Sf*$^8SVW?7UqKgNLH9s@3c97n_zEuaRaKe!D@ZHP^?5Hsd-rxj z@8s={PS@L`oRzfG?~f6dcPviBSi4d=8)K06PXDK{#muAn8pxi=eFfel1&JRPbo?Q@ zDayznGCr>${`%MT>)rr%|*}ou}-b2O?E9jtk zecqo)xqa*0+T7gVn*-;}JeD z3-`9j{293@J)burw9L}Zqr?J?PS&b-m^blw#D`ufgwHS2xv%qfL1>{jnPqceNFev_ zI&TMf<$2@tH{)wDrggTQ=OO1|v&5VmMj>(@Wj3hrIfsH~cB_0xnfbmxE`MtOKnTC- zg74@=9PxHk^_QVT_CzmkZhqlZ|AKgQNztrFpV#wT`YavZ$E`AXq|q3Efv@V}wX42r zG>~1^=jRvuyghp~I`{8F`}b~f4Qp)jdArm#dIE6+F%Cr>`=BY-$bT^%QAVd^MO6hV zF)Y0_qyycdUg7m_OmVKh&k_S>z#vu3AEJ@9^WwJLY2?3)JG)wSW}0nr7%C(Jc6viA z1YR$CdcCc!wADu%>cbgG%hnPNBhV6^t+zzYY}SXg!~E}30{*HsB}!e~(oy@@pW5e* zM$$7~(;+ARO#F8=z09)p}wcVocLep;u|_2l(&7~C|6EeKtS{a*E#cZmwOE|*p7)D0JlGv^a$jin?LMH$b5Zvqyp_4M*AS0^ z#fpZks}6qI2JbD0iLrDMwxHMX;tca;S-b&o4ms2OS;gu(OH&uj|Kn>zjA`jnBAzZRXk~sYBflJWw1v`I6sV&~5Bv&vt)m{)w-5 zw*AXBFV6n?;LcATnfl*J^M7L;Yh4jf`|$hUes_CDLG~}YUQ_+a$Qh3>9DTIU7wz|a zJ!D>8;x&8zbHa7K|K9UZ(PMr7K4Z_tkA3&dwQpYia)0lmf4cv>&t`m**m-nz;*n2& zby@UX`CUF3w`<$?ZxuZJ`V-A(+I%;v_vxX@n+{JrG@x$n8%w{rvg(4j|DJeFw}F>@ zy{^nPxaZ^do<2HldD6-M+SF}(k3SE2Fkoy!Nw^W80tUSMyc%IN#haQ}3;9eD>(?W_)&Pvu*>PR1@V4 zGLN&mna8q4=CP{OJnkK19-F3^N85H-FQ| z$9KPbC?sMoHo{k(rjs+%(RzSP@(Ie*5kJ9kEQd8EzY`Ek28UOug9!{{rf z-}SG=r>zA8FB_j8b>Fy~fARH&+j@_lTJliu#aAEN|Lvu7KmO;>OP5`=w5-JV=-1uq zE{Y#>{_9OoByF8?qTAC8 zyZ4_^|N7k7{l0qX>8tM;o!;)XiHolJ;k{n}xq0-3%lFU8J$m%rx8MA1NT)~dy?gW( zRVNF-Vf-Vv`-@Zm+->NXjN}==eD9ylT|e7;>@UxZ{@cQDp07-wyKv;HPu3?snRWb~ z4^Lh??V(qJ>93iz4M;hd&f*~`_kpxYwwQF_xT6C z{*Rx`zVF3b;$D99ABE**9d`dK@oDR;H}ySrV8w0ypBUY6*{RAAZ#~)hg9&Xm&j0T9 zOTPJ!hhE&$bmm##?+0g9pL}5azU<51xMD@&uHhFHJ^s+?j_qR*jznXmN zo9kChp7X2To-ga_dO!JoQKzbDk6(S`vKvmf+xzPCWnYaL+4qsZo_hUQpZB-rmT&Z2 z@NK^lPuzY5>Um>A=Jp*9`F7-Bl(9309Vw~gy ze~1V9bKq`diMY#fbl}b=LELQY4!r4)TW%$Ll{?FLAtZdTalMYO_=Xt&5PdU#wlO9o z{HI2rkobd)--m=>VN`{L4>Z<!E*PJA7zDvS2Ej70AewOx5eZE(xg>K$+ zYN7ibX@B&idmI5|AL8*lrk3a``~mU!Cv+0=X3j22?~lseLA@``_!RPWk#K&yCJ|qF zyi(G;TDiT(uf;tJx`{@2<6Rsn<@hBUy^KX76!}flRLgKg#$h>SrqK z=&KGY?@5;U4tbY`P0EoG)Nz>6%=IGuO@DGbq46_H!zm$lN_lebB?;>vD0A`Cc)4K4y35xA`pqJi`Yj@s`Yk4w`Yk1v`dvf} z&XqVW6U_5wh2WcUbm5nTj+^D}7L0?zY|uXjM`o3n;i_)|X4x+l|0Eo55}bnLD#0xK zdj)%N+#;BKFAHWFaH@p-tcU*)+y}?@Y}@e90PZR{3ph>iAmBcNSr3_lbASg49sxX7 zFzbP9xX3vk_;JB3=Qjj1F9!s(%pXPHOnvG!2xgsd-3k4f-*zZO;#t7G1Q!8k3ugU% zA-EKHU__8}l3;R95zKU-#~4nh`=#Jz@b7|?hyE*oGX=ArlT+GvPE9iK`Z+)DtKT`F zU4pNvEWxLImtm_3dEq?djcmM985(N;G^+^u+~>@?EK z>+$3XRnu?YTVA=R(gN&|WaF@Tw@6-nWZ0w$R}9u~5L*({Wvy~({T6XJ4*6KIjwAKM zE!$^ux2lTmfXRksTkS!+>c2)nU{%ct_Tzd#?p?(}DaRcJV?wL-{ugtIq^ z!om?+f?KpIGckOQ`7DJI)InlrS;~O3SbdUvCO0+#pZOKxlAG`y>7qF+!UQc^)@l&8 zJ8CryjQsLi2&G#(Bm;v9NH?nyJR zxg&sS55ss3<~7gCHwb>XBm_kBacpSitF-VjJDM*S*viLiV`_lS)T5KvSSw#O_~!$gJ+44IL#)T`t%We5xZ{fpjLV&NEjjsrN zoEy=i?Yq#%R|7tMet0c>58C*i!O0!3$wZIN4K}`yz^Bh&RCU0<#Wudzz&DEoBHF%E z8(&iQARl0W?`>daPoE#%aNi%Ueh*5V92_YlK%(oHx0psqR+h?n_eaL!tlLi(@TMI;q>O)^eWNGm%&eqrv5uTh}rj0 zQZP^{GNJm+_BM zCbo<$#?XE4jj|dt!xIz}oBy-r+vxqXGP6yMbAQL0`D7G)6mOatjY&?nYP~(TVz9(1q zOmAE9sWP^>Ft63Bt^e1Ww$U^X4p@xfHwjw=yTts$$6OLa3Jd=J@%OhNzqK2#U|#(fh2% zFIrk)&Q>jGZB8R-nN>I78+L}H#fBLRie{><9n7>qWc0Joy@XL|ImH!7b|%!-ESusA zJKGgrS5^M`{Tq)q%r>co_k#bloR=E%$e%Pt>2Gx`vmMek9Y4FCrMav2O1&xg(LV=2 z$}V(b96Rz{q&*CydjNh`zCmzPM~mj}2M;SB_hQm~Jgqd}6TntJZHJw2hmDW(=bDdw zujcdF_@=?l{zHql?>2Z??c;t=nh$+-fUgsbv)Z>z!t8uWP_puIZz#=Yojc(5%F4F_ zZuVzdw0(bthn0`}NNGOn+`$o>efJ}tbZv@K^BuC;$9r7OXPrCPVdHxkEbL#kXufJ2 z9~%jVO{y(e=MGlc_zpsc>1xq@1vb57P+&iF z@lXsLv*6aE`Pg=-r}J10N0C;NFowqq)F`e zVz_R9OtbigqPf;hE6zDqyHo~ko^y}YDw%mmminKL^3&ES5A`qm17l^viKyd|h2Ebm z@pjGgrhX;+M(lAN;!?;7arqHWjJ4Ea!b5Q--Vz7aY$}gq30TS)t#r0ExW~6yg)CyF zWMI{6Srx`#B3LuItpQtQjAvA6CC}zMI4rtED#s&FL@A!j<3>5S_9;2b=O#cRB|5we1l~Z${?U!7mVGo#G4M@UXudMhJVB8L9y8rYA_l@x9uF1aJ9gSh~ZE=WeMue59 zK*g~;+Fb1VZy2FspB+cAHp7ikgQ2``Ndp(paAVTzBy2Q}>fImD0 zwJ`j&IP!7in6;-4#F60-+VnZksDwaAC)vGv#UvY{8?swEXK{%*UKi>~x zkQy5Ulb?N%e$S|doiYwroV@r!RNgrNhp^w*Ht-tckXsF2_Z?CQ9%5dYAl>kDaKH{p z$Il_RB7KP2`9j!j>vxgJPfWX1IRG%P^TeNavEHb|>3cyok`%R2J-uXWJrG00yEAU7g2?uU|bXu)G?$yTI9@xUWwI{Ap zOpEXU`YhI> z;vD=aS#W4R>%G8agjxAG_6%p=Rq(g+6~WOBezcF>55ss)4#3aKw+rsk_-UaYr5}F8 zIrvfhaA^DVSd4rtL1yJU4L|B>(R|CGWaX=e<4!2iKI^@}3>#lJxOtt?qWPxU_=cj; z)j@>^6DSwsU^5NaFCoF#a~l5eFsvpl228Q1;?y9rLoC zQfMDV>pcr#rQkhW4*VF-Hp%?P`;$M_*xbn2khKTy8cj^}RSjU?C9a~~{ zyXzCyJmlCNvwm~@noSXJdiSGYrk8u);*JsJ1(}BN=A^yl@#VR>&CT@5+#TiT4jz5u z^3!6lw^rn#=q49k!=mdNX6}w^oMbxlqA*H4X6%ltPiS z9E$d5nry>dR<=SXU8d?bY{=DI>BTlK+Z;2omrw4@vbFITx~_h&+3nocaG@UbwN?t* z*xycVPlu5@(#oIVD!@?J)f8nMihFAbG9??+rMGPBSDk=ti#t3aZ5cy5Wc7(7h(Bv5x%q}klwN) zd4MB1LTS{%GP&;=cXM4sgfdi7Er`n>g>964h3&T~?>*$VYzL?9*2nCE&~jTFxsv;d zpp38=M%-Kd&9ZSR?)(>BC^QzUa^@AL3@hviq&J?lH*z0HtocIIW@esQzrSUjnVZHx4s+I9~%xC^8jBQ zbqR|zc?CAL>d+%4#+TNa~#Rpa$ko)1eG|F zd!HHAmB(d~Z~4k|k#F<9C%D&C!fvN|*YkPAZf9{W>rS=n{Lit;&Ymc9hpFDKJy8py zXDyq}Lh^G*9_)v8%YfUW@=yPlS(cHiF!DFU=Jwc|ps>9=&eFC*+uez_Ah3j@Uo!iL zWS?n1g6q&xuz3UGXzwVf|34wwA2{5-%{sUocVn~MQRtv@(F%F0Pr`Nz1^pJ|hWJD7 z&eEhFdX&UKtwHU_f_QsexOZkruXEwXd1Yque5bqP>d8F!OhvU}qE#_@XN0@s{_#e6 zLNBkojG7&R-tQJ?lK4;FsjmC+2xB_e@!`d`>UV5KmygiA4oV z@zpnOX<=6#RZzOr)WywL)tiq`JN4nm)$jjw&(+`j^xhaz`%YQfY0=*JTdK>ucY5GwSME2u{^F|n7k~SRiEJo>w(Xe7fcO7SgLmmcY56S89&Vj=;21viL9@$93z7l3)GCOemkW35 zZingS7|nr^b+!bP$%&EVO%gsxg=ZP%;-0A71C0sdR`=V8T^JJ1yXv60)QH^b)+1HZ z&t>Qlu6A>z9~77EX^2a$VzP#7>rFow@9M=K`fv=&`*RBK+c~fE2g|^f;VCx#36>i* zhR?9++vjmUvxR3#{4Z5{u?F`v)(wn*-J~pMB{4-XTqyZmw0KP~YLfKM3#J95f2T zxQ;Xh%{ilsOw4;c&OK4MJc*cmIfBVIPB8f<2qxcO1aq#3;^=N3l|5pcvPaTY_DH^z zJ>5)w7B}aBD4d!irjr!J~&2h-%}aNw^3D?&qVg`6 z2{uOuJs=+Z^g2owC3*O6UpjGL{Dbtt&mj*j*=8Kl{bmu<12PCd#$|TcR*5ghF^5}6i-(}s0|#{gFdrVZ?y z8JFeonqb=STfwX!ibL8G>qDPMF5n~@2I1*M%#UWb!(x1TCt@Xd~|j&gKf^|vqZT{ zEc8twOEE6f)x-ri)*97R!AzT<;67)8Yqhf^$r72vXB^AsEWsML|GB3QmW+WP-?l%e zwaO4G+SZ(*1ke3o;;aoxo>G`P_E(jHrP}ggh6)Rbt%@=jMT&3sjriDoD1CSxU6sgF zaBbnTm5X%jR%*)fP^ESAm69a^Gg2#zXp=J+EtykPGMl?M&O|;+a2hO}eGWs+{Mxdr z)3j$<)LOM*PODFXLK@H6Y0Nf06CYnH#!|j>Gurh7Mu&a(%{=*k+3Ld$K8|}>etc%7`ATejpMq}(!nJ6= zA{*aO3m@~N`F;an&F}pv_i**g{f8JQM-nOppRQjHxisIyHa>nIllS{ts7KidK%7Gd zq{hO>VLZcFo}B@#_VL}iaOW@gJ+SI|TG9In?6KU{j!mJfc1@?(T+(R}X%5a&q1AUqhI1x!8CR z=n>~gKrQ%mKiLC*3}Za5U$*jHhXAj{;X(7gYU67JUpIua{L)2_e0Sq#I>oFf5WfbSz<^7Y1#VdN{q&&qcg0h~9|LOlxS42W~^qZ~%(Qwcrt^}&x}8)k>+N=3TECSI*jW*t?wsPqMT8r zsvS^W>s<{`Z5#c`H&M<7_D8Ibc>GEi+_-G1<)z$ny^}jID?96a-%qIL1rm~_{-@)7 zau|3vnY`3-tH11yS|cXMvwlOx2z(vmTYTtbK>n-v&T6zrEJVDp@zSvWe=N@@Ya&)SHO;Ysg_Qp{En)}CI`E;uJ9I>3wkA1GB3Redm zCmAf;TpjTZI(&l$bmha`(e9*m5!WO;)GrHm!CV>)LF8`1H2wqU{eJ!KbI(o$xPz z#rGc;v>$s49|&2wYSUBiGz@E)h-b@NXW@zD?g%_Zjpox%R%itF_eUj6h|AAvyRBhj zsv959@uGYpo1FCgs7>ALcp5y>JreJ6D4*BxoO<-w)aoFrqba~ zuHByi4Kwg`G~gar<0;b_5pAla=mufkyAbWas<}_>o|t{r4<2aPchGq8;6Arebuid99gQN|6J0(D$-Bp_ zdC<{k%rnu3oV z)xMDsq(%wAc(ggye5zyZA^5aL^)XfNd+^nicxjB$TFrk7K3%5zKfu>A_dkz9K|6Ct zT$+Lw!ETQyFLi}#NT!Fek(_y z-K(+FN_CD_s>4~T;@$i;>_i&q^&-}BWq>=Seih19E2(RytN$})fccXe;1Y->nTAJ&9Ny0>TN`%3GuNMu!6*}vlj0Azlc z9*6g& z#K_wcU5%@bt59=IL?V3d6gTf5xSqFzjc3~e|bsvr}XClQ$(*x;C)3B zBZ+8!4t4pAjKX^u{Vaz0aL98^&MoNYdc053&+Iss)z9EO#9i;dLIuh!@L?plX?R}fQ&_tnHK z1B!zWAtCTK^m_=Cf%U$!3k5U0OLS*^o!Q)7G0Z~%bxSexra4PW=IVVG?K9|MR6?e# z&2TJCxN!;Q%$FCImdu_R+_f=0TWi{3i18hzA3+>Oo16xhbE`Gd1%+URoamfuc3s>R++011(&Ro85Y012W=Chx(K9Do>FBw0}Gr5*}s1`nNqisl#R;YF3 zOO?;OISWxMYW>Ty<;o&?j-W#EFv8{=`rwRY)*LW_kSqpEB=qr{ZRf>6xrJR$qn~WF zSO*h`*7D(yj$;W3}i+t7JM4bz~crq1%rD5R#8 zp7IIz1jNQKHE3O}Z$2U!F>}Jm$&+(OkDNLD>Z>MC$-QdI%wf}~jGT;zH(Fuh)M4Yt z4!4Kn6h1E*hkgWq0r?(%<;xZibWuuvz<*+NCrZrweR1HxK7;Zxlk&CkaVCvjseS5jH1-` zeGNS;ABSx^zdUL_+GFMWRKgUQ1^-TPjs&2R*3G#$KjE-Z;g#_5ZoNsY0=PU<2wkx@1aCKj!!h7ea`p` zGh5kz-OK0As=6Z(tLQ75mJ7q!N+l>7R|>rtb9!tK8|TL-_OzRSs%!b zlEoO1YD^D?Q69GGEp0__7$Pu^9{VhZUXfxj|1pfei;)PATHfJ6*djWN-%PO1$$pD` z&~}y!MeF6kKC9jDkx$ZKJ7FBQYg}k8GqN7fx#ncE23>mIYsQ*bIS{k`rQ=zMY2A;R z3uS!jk1ODsjHW2e7S5gjQ}>+dd7SVZc;(aX5twv}GUkr!HFntDnEr$wW>}+)O3XE? z>CH~o=}iP!CO1hA0e?-Nd+xl>mtrzC>rx-)IE!8G(YZ)58q+-yM$ND*U)>W8aJO}i z(>j^yU-QfxKYlXPOg``*U97dr0{(W8of`ogOTS5OO!w#YD0W6|#e{2*G0v!88>P?t z9^JJj**WTAeCPgO zqL9}`Er`PeC6-gLu{}Q`$m7>B-U8;Mrn&ys1Sblbl z`^pz`eN~kzm6}zD%$0~*cTZGfE~bQ`_*kU&wQZP>XY6I1ouP%&ys`R2}!(&zOg{du=zudA>j zUQG=vLve~J(^=P?9YpT`7(E^H*zu|ENrr(Z3z77DFv>l)upx#~A|}LQ9VB(3gavL9 zrp8TJs>DTAC}tJoCYOKMXw0B@#Plf@U8Z*wiq>rAW(m|MAYTYSqV{1?2Eb)zkn?`3 zM8!5d_wn6v$G>NStS9<*EiLEAEP+rupS?UZ7mr*M`LI|cO7!W+ zaEnv9f6oBORQ$LG#6Dkjy9zbmQ|FqHr)=r{(?Ur8t+sIP$E$_m-)IMpbn7)e^rrhE z8{Z2ycZ`iskKZ1Kf1Ipfw3siGX;5DG_5765p$CNHGR~uk({RWO zMOJ;jYoX`V`Uwu`Tlpm}$6R`Tjbjcy|3wqE{T$Qjxi*f&^jw>VSjG?Ch~?dPjtlj? zTOVRZf@I*Q=apDqdR}P|u}taq2If2z1$%-4$^X@EpOk zozME|PcvQ->;Xd zb9iC*Jmef#7+vxOXSdAxzTl+Ozc$miR8Lc#b)GL&>wk2X&zg~cGr*smtwr$zG(w(;F*;p4SZ^F@Iis)2lr zmoPh@1A12b)?4^^-PU}6Mt^VRn~1P*b7=2F&&tR5#dLnr^#=G309*NH!Oi|!3ppsS z<7efo0U!Hm4}R?bwS8NGt$f9BPsLA*=6e_(R=&L!K3>W--*R9p-(I-G*|$jIFjI4}RA7p|6$m1L{h+@4UwJpzV~)ZF(HEhSSSH z1jflwv7iIJBEdW`j6eIn@YXdMT93y|kcf2-Z5H|~=F!7I2)QT&VV~8WVx$`n4~FYG zW{!6j6opKoopTN?b3k^6`C{X__ZsE5I4EXcnQjz|b(phi<8zm+863Nzxp}?6id(vK z_Y2OI#gwO&CziuuMm_6)=qIN|`JKtfB5M*CV@H(vE`LfJKbg}vU`p6u<&UXSJGDeb za(|H3F8;@tiit7&Rd@e2iI|9}Nh`qA@prg;^u@%UtWUtSQcW8C-EXP+xN}*9z2sXn z6gIANdSP3mk$j&~8IwHLsBvMsrt8Vd&TTfi=WiTxdTVoY)uyV-*s55gzI{y!%!(3Z z7#O|OkNv}c&n2P_-@SsG<|z>f2^o>@V)Ntfakm1J86F`RjUpM zd~b1qYg7bP`7)`*cbYKyw4=@yt9QfMk+v=xTe3i3&8IOQ?l_|Pj%zE~GQBNjVAl)O z&x%M?POr$yPG+r)-5RVFRVSm|Moo&lOB5Ol4*Sttrl<{N(5TFCOtsQSmCJsI>50sQ z>?mYUUEJqmUvUKN>lC5w8)Uan8HPebQ#ad?*o6rO<>p-F`IvJ)wv3@I|8!|vvVXiS z=VOV%?=-YhVx0Fj&#Rb7ea?>#J?Hnw8Sbtq4R=>G616=Q-ik#5?MG8nyN$VI8?yb% zd$)F;yTXuma-QLHs+qT#imK-I>G5oV^zUz^Cz`#PX*vA7{HR20`8Z#H@Z9E19*ya8 zqkwb!=%JE#Mxx+NI4%H@TJnpoKtNm&&IrQqoZvBIZssmh3c8&=H#@!j<^?+y@Pz!M zzw!&@6H3ziv{FymAJEq1LN~hT6!(g>7r)ZXW&IP@KSOdh;)_tN74ES|?{s zWAq+tXd~tFinI=Um1F*H*c)s(=78`|nl)R!ocB_7Uh65iPiE;RQC)cxeg`8%#a>;Js##PB5 zMxZ<@BZ||KM@8ht#MU)%M<`ejZR8JOU#R-F{I$**&naUHR3P@Eny-vQ@lbF-23pQ7-RH#%UMN&7jjaVRY1My&_?Crf;5o5cJ4$%ULb$9tINj%^L* z4tAK%X3YFV`hY8t>*TL6n@t~t2b+)Ik-Xvzw#7<6BkJZxa3FC0Kp)i>Nf>pKCp_%u zc_i&?!ia%J-q?vFCydC<&M+pA$<5@y{{6GmVPG~70|qJAz|8)1Y5N@j@j0do!(}5$ zFvmq2W0+*5ioY613C3{A$SA`D0uTU=m2W@?kZ>Ag3|I`R!=YxsOA1v zG8h%Dmit|$+v0P^H7Kr-yA<+s7C9)czzE;;<9<|G(l9*mau@|cWgwT@;UnnfQoE8^ z-MK-B(jRGakF~ic*xY$Gw>|wr<2V~OgeA{s6$_Qi++Q{kEql79Nw9XaZ0-d%_b+Vj zF*f(xJXu7@*Pkbo2;JR8{|4Yhykv8;O@E@zeUHukYnywH&3%QqixhvnaolF#BVr2= zwC8r4`+1xDO`E&I=H4PVV0+=8i1yC+Q?-zv-*nVMce*WnsLkDM(_b&{If%=5kvmF# zl9PP=2Dlcw``W^DZSDx0`vHkR1#uIxU))XX_(aGz!REfl=B~22XWQJT*@;5fQWNpC zVXCFSBL5JZn{xnK7+z*`kF~jvNd0n7KN08aPb5F=c@nXo+$_m2?}rnyzunb1QW!1K z$Tps^l|SdYDC`LnjLCs_@lE$sgKNSmru!NrEyO+D(0eJH;ny0RV+-nEZwwD{&osW2 z@>&a}MC@Rso3m-}P@_r3Hvh3aj!1hr3Y=(MVf=^W_afyUZe$DJb;>>3NEZD}<-XGB zAmz7Mxv$0m5ddPQH%VbfnmVYJ3n9<$BrPW4=x*w;934GO%se}KnwYja(oLL1+{?u5 zhaA%FvbT3|G7G{vD84_>aQf?a=}AY-bovTr`U3=$d$3@pe}!PCKVGoDsyGml@s$1e z$9T$qV5Xz&7p&|DR%s%Pafy}vz)S}R!$AUw;-LaW@$@sX;;xVJe`Tj& zWhZdH=HbLEMDegNAu4W`iB;TzCRTB?O|0trQWJY{a4;cAH~buZ6vXusX-oU`2&U~B zf|=%Jf|-sg2k6tEEthd=%e8{(KUc5^N49zD(EnD!v~jh?e}iD!`)iB;F2S_-8Nn<+ z3fE;^gQF^E;8I|wL4P)H>S?UX3jVq9Q)MMsl@+iL{)&euBt-EHF|p!d0YDTF8wEu1 zTyA2;^HUS6b|pq~{*(L5k-LXr>Qa^dR8!>%K<Wgz)VM#18^X}@XUh0vJ;rauIvQv2CVWc7ze|Fe}Vi8 zR(1l@RK+9YiiZh86whcAE1oeXR{0%kV#PDg#45juCRX_cCb!Bja3H_Hf&2mo@(av# zRDOX2`E75>FK{5gz=8Y!{LP|MD=M56mfV=pwgOZVwG0DiB($AVYo_*9ScOIo@7VpZlc zK2i19#q?MC1ty<5*MP~V@&!!3>+wqhCf^H!sdGRuxs^R)LnQrKI1n^Vg&D4N#5QHK z*spAsxXQM!j4Atw0yADW{E~nfFIzCt%YA^sLzs;MROJuVcJf-%{6zH7g#JNs?F}W zhu>MU5uzje-z{InHHveJW)_vq!}gj>TPdHwMw60j<1Vkv5gs(lv}4b^!J84GpIx8RI^ZQXef?*q~YqMRd&Qo?QVGz-L!5+vi!5U}J49I9QCPj%{gX z_$I8^X@-4c4y76r-l9N4gY6ZjnokHpYi&%FbZtsi*nHW>Y+g`gk+t;AwEG1MN0h@C z2TRUejftjGvT$DO-BU}=($bq2aL>#oSP0y*zxr?Oxrz!1SrHqi{6fN8R!~TA*a`~K z2$O)SMNzUd68Q^^x*z;hAaE3zn{_ z8n$p37A%+(*l5|Z-r1f_OHi2dwS>0Jqzbg+S<(fwxLaZ^Y}Ks*|*_sw-)$)MhAOSZeXIXlN+}(n0|Qu$gzOGZQI=Y@(}K z0tH|W+s^BMZ_FKWjI3oM#`hKQ)8Y`|!I3yh+*xwe2aYKzzk-5YPlqvF<4w>b&Y>sd zWIJ;lJP(-mFpT5Tl{P-!J8=xEMe{AQ@qKUM<9&$cD+adOHxX`3*#t!Mox%K|Rc{tF zJOQm>KK=tVe7z~_e0W%*QTkCZHY~w3K*bVq;(doW#<14oCVJa=ahqv^VeNG|x z0!O*kQa+lmBlN8HHG*#nG-w~oSKF6jvyXfGhvRE+vo95MTw{dq0t?^wwtDLZz9NKc z(e`~~tG6QXY5QPmz`jexKAm5GEB5ub*;jAj!*o!9?A-_Wu0@!O|+5w1n&cdCuA6nxJ>iF~{V*L)8M9}Y_H0SH$g>ur1< z+>q+><9VX_xIc~6zM59}WelbN6;N#v0R=(H3H%H>|pz}M*#`m(t zKITW;$ND56Xq5CpClD^bci8yiQ3*P~yv^5q3vkkt56w%-m{$1seyKITMc~u<^&qC^ zn`q?~J=zN28}O$M zIrvegfKTVQ2i)4eCvAKu;pTjW7V1%U+V~!}*vIop^L-(FI=>?j5UzedvGJX>@NwQ! z^F0+4n%`Ni@a=*gnGvnTlclqaNi!8{a+P)Ai90;hOJ& z@ag=%hk$VTeci^_WZ}!O@TJ(=-?!jnf1yR&Hv=h)!3xu^b7>vG8TXk9y?$7{JQc2Yfm3*P{8F z0ElxWU_AKt0<%BmSb<^Wv+rkK3cj`Q*P{9C`AJ0efjmA&&wf%pn zdl&esigRsz?Mrq-*lH4Di~_n70t8GjK|nxkcOV21vzI)WzAZ9&8!)a>3p2q!*rA=K0Z$odu6~eEx#NFQ+#KDb-p_AWy&}_DZY;+ z_Rtt&n^p5=AE!{B2%D^Yxr&?ENBfEe8DRr}*`mg4(N_G_qCAs>KmvBW$n zzB877Z4&rYKlweW$8vfJ@pb#ABVM@cXtB)4U?u`7g5HfL6#vP=e1v`_^+B-!zTyF6hxtW#98%@ZDkIYti`l`d!(_ zHKTOC)-L$2wD7&E@y*cqxJHrAceo3_7cAv>MC0SIfwJ#!7QW+M@O@$7`-8@Jx5js~ zCBGkZ!8gp3-_si3OpPxMnbq@q4tySjD`7q;2hiYky%@B|aQE{z=rN9$ksx0nUDfVq z!>!7NHjs~f3MCDE1tt{#8OCF?%&!Wnfu1hZp+uuU)xWPAkKgggifGRaS9*gHA4MGy z^39TY>jPif$KPFe1rhRr)uq-b8j&${m`BK^zpu)W1;^(H{^}Yet;76jclW#2t2y6+ zj}JJny4Ju4IdYD<3V^@V7W=si?|Y{Xj``;w_S989`{t*%K4a%X2YgkN5w~hI(O~{d z#>8-ZttCIeS^m^LzsrB=_0zvE^`!je*ZbPGUvdAJ0}ren*CQvR$@WOj*T?HBO1A$s zd)?0OcXa&ncXw4K$JWeyXmQ=wKOVE<>7=OVC(Q19?N{Dkcw6)C{6W9w*I)ej?wA|i znG&CEU-jXZLmj{0I)6~EB-}1?W8J`}D z=KUw+3 zryWP{Uj5+re$=$+)Q4&Rj2~lra!YK~?Ug^8^4FoCkKDKSt=|pY_}evqW-Sa`Wy8|< zSodBnU2hjl*E<4B*JJ&meNnrQRyv%ujtHgX5=xO$sl+qe*Q3%ARqN=c6rzPfca0_f zWYoJ^l@52U<1(dmxlp=7Q;NY-MwO13T1TwXi4!_Kq|V2l_k9T$TWWuWr_6U1mJf0y z);g|M9M=ero|0pRXRnQnpRXWmY9qCGCkWjfn zs!Z^V_VuoGWYjt`mBL`5aAS~TOQrAHO2?2|$55p*OsL!xRM}YRyROnPyw)*7sf-jV zHwRUGl|E0UV^po<7NznXq4M2;N~JI9mZ$-FT$3uf`lnoT3=b*3`$g)_bZCR&36wc`T-(KBJ^<&x@OXx)aOc)z>`#g10_)N4@7z zeZ|WeJ9fuZ?9FK2wx@Y#N5`J#hF@i!YqsrZ_H1r$-JP*xPfY9HjJJ|vsyFQMGu&UX zC#%74+u`>#`)l@O>}ZLp*_-k4&O^W6^Ku)eB<$URr1!?Q?)6l^(a@5yu!y&0P~ z?Wt$nunEt|Z2mcthFxKkuKvkI(mnp!p*Js*Zdp>SNV=;$pI_X({UW)Z@Lu)mizU8A zB#!b9o9Wbzn`@EnuF^j4yJ(4zh^>C0bJ{4;n!PO1LkEy;k@6d3cgW&KRW|HpRc?Mn zrTfx@rLvw;l@)tgmCaA79PfJD(;O@68THt@m-SeDw0aFvh0Xqom$O=BH3w21zv|Gd z7fbhvi>3SIMbfSQvC30Acr0=#LdQG*j zKtb=Vcq60Xa7@MFjNw_EA5vG`>nv(qaeL}_9F!MhaZ>ZshniVU%?Wn?lSFe+GFtpVl%S)}LVO_?N_KeL> zsN`Pzd9InAh}3!}N>Ac`{M{LwwX zI<%LJdv|n7?Z=(cYDZxp*V8jMKcaG7pH<_xX}NwYDYki=%J_3bTkB()@vW_O8R!XD z+V{MKo=|j1FR&cZ6E^QgN4cXuBQ^HW{>_ikl=>QEPF5*0hYVCd08`M%`74k$zYW>m z?7#m)>+ds;9QV|m%xK_0xR6Hb1U<$esTgBMkbaz7@UeZqF$MuL^d)d$V?kt8%ly z^_S>;J-BF_pHU5b57WgJjda;_dn!cF{mIEa`)HSz^xoFv8ApEaX*ij&`Oy>gw5z`6 zC=))y2HbigHh60M8K*yM{`cx?HZFff z^RxzkEF19Y)~bw(AA64YGxjv9z^5OXB?3S3w{FX5X!4wDMjzE&zXh)`>ua_!U9)z6 zmci|M>N8q4p4h7@2pO)ov4ZMZT)Rba?F?oKMJ-Bm^WI&)WE%c^R>kS}gyG1SzXIj$ zkA>lT{FT1GtdHZ&TJw{rEQB{VAm6gGa4T(nBct_@r(%7^e%v}9Q?2W#%sX0FGbs8r z<@pCzud5p9A6c8!XS2U*r2p31q!fT#{dd+T^#!=Iv2FZa@*7b7dwYHxIW@{}zqPL3 zzIFswbj-nT->XM`nd^@!x;mmRu4jFHoDZ)T>+F-dRjg=T_PleY!xd-L?oX_@Rd2;N zlaZ%fe5&4NZ{e0lrP;0b-B=R);<4Voj*gWM@o}fi82pNN^sB99uY1Q0J(FK<;DhFs zj)X6;P(pERb!B6FB9{5&8loX~Wf{fxQGcsh6H~T7vHF=^4Hdg?HF`FW`e9y2$J(1O zt9YYTeW#Aii)z|4+^#Hq!pZGIkY?nm2xHWGY_vglv3=HqKd&4;W!8qQ%F&Z&J&6B# zN7lqvj?VSRxkq5nsagJ2m7}L}x1`Z`aJQt<`P^V<^fXC?N1HK**h|SF_ENHoy_9Tt z)EVOx-jTxFCA=fJ^HP-X?k>Eeg?Bgq3Btd;jfPR5*{fT9620&>ZB+YUr*FYXk5TGdvZN5} zA4MBQzLNPw-@5p|ZARbhIo~ejg2E+Bd~*vu=4`@mfg2VU6c)`bF1csk`~}#zdvV#4 z@}>7KTfXAH|4Z_$(POg5=8PLZ;nsEo zzEb~w$+CXF8e4ANsJFhiq6+5DOB$SW6q`#WFl z2gb^OOqhRY?t3>MEq}J|t!3|i`Ey^dv?sD2f8vg_Uo>9-r-Rd;n{Z-KQsj&G{VP^E z<(RONOMiEb7q^-?#O(Q?ha+S)EtV+;x;5$i9W_fkD4oBPPBtd9av-HRY?z5ZQo8v% z$%gkx97CbpgnZb<*Kekq|2uy--9H#8!c#5o0mdfHhwsGDUkQoDe|~p-T&71)hHsMP z$DGC)-Q-&>hMM7A^NC`{zsz{ebc*i_xQ7t;nW21ucXHfAsJGOwfgktuQEQlfBHXQ16)|hQQQ|bEpDg~YkQ+zXaEQ-RM)JRO+ta_N5;aDRzs0q00u09+(-G4O*D z&j)@=;!@yOBrXSjU*hG!HgJ>we&9rjD}V<}yc&3-#D3sHiPrrUjW}P@p<4UB)$NALSoffsO!s#Ftsjk3NZJ_rHsX)_R8hBjlv95*RmcL z!-8T@TKWkd*i9LXBVJ;bcRbzj?oe`9g2;eBt+ze5h3JNdy0|QCI<=`tkxkG_Dd3Bzx?(`*bjYX$0Or1 z36=?YSWYbBc=`0m6EV}rR6>E7KKbd-v&b(n)9EMuX-kI0w9zNA2j?G4Oj{n6nCV~E zJ+RvrCzghvV~TGp3g;Kis96mE$a|J31-&bS~%ET4$&4lY(;5HnP!MJGu z2|p$3aYytM@I*H(WQaVg6R&B?N*s)%>!~n?E4*A{FFhemn8V0xI~@n@p`NF+hsa`x)HCUg>`h>9Vh9J0P!0Hv(ij-wuY+LyF>~lFsMB zO+~dU){Ejh39R!y4+noEC{cXJ;i2=Tkq-@&_VIqD`1qW!^VOjec+DtLd|caA=Npc> zb-dS+k3Rzx-&Y{h`5M4iqsXKlou5HT=gS3O3jE1OUd2~y;mbgwgtKphg|A$*kB=~l zuiU~n9DJW3TnY6ki!6NWHT!taR(vNc<(G1qVR%R&Me)6DDZd@yQ|(2ctNe9rF-!CnEr@%K0;VeH74rL$vJ7gu$uRRRDRJfHWz8l~{?3DptRKjv#@+IR?d}!t& zd@qBq5q?S(A0DGZ_*yi+6dA_${VDQ6`}hn>`2iyKF`@X+Fdi@CAJ0%1vI=_qZLfr3 zl))Cg7F>+1FD1&pTP=FWpjWDta8`U%BxYSvve5|@m{9zu9*>!lPX#sUot4yK*uO(h zpPQ3``xdjoa;A`r@*+I7>=}X&9t>Cg0ZcY-$Q(M zFwZSo5*LNp2t_vOQIYljl zi~6T2CUF+?!}6PL?x?ko+HMouSYhny&4`nXxdyunb#z#k&xJjTVbVl}XccVB=0(UG=p&_Szg^)F+L`WBPYgK_Xv_?T3d{-Ua%i{!f-FIcrYe^d4HL5WMz)4 zGA9D5z>3Nod!?{p-P0fxbZ+OJ57#`9)w88v4|~o4!(DyH9(zuIV|Q$&%U$bIv$tGg z_LeI+d#h?^r7Nn|rKW(n#1t@Ba0*z}mP(hi)}`io`*rMnb@%R$owaU9RhAo#r&k2xSNTTyt1?$4T|CKJS7f8hwaew)?~15eRk5B^ zA&lnO3NeiV6#|nZjoL_Ma-=XhGH7ybWMpHcYgeRme`G|}mN4;mB1>^x@%ly!;UX^ zjdL|LWi^hAU}EDOOl+K;iH)tR}inO$Ai~8#v=DQx7jO` z;@!^CS=UX7tbOf#5?-^n*w=i==+`4J-{HpQkuTU?H_N6y{_@;cvfgU*pyqFJopmjU z{5ldPnIFyZ!^v$PH>Z}0tri=zqAD9YDyn1Boe9IcZNX1L*8+#Dx42IF8}20;yiU5^ z)~(+Q_M8-KKKNE!)cb8|XfLEY;q+%#ZS*Hqt@7ug5}HsMVmKI=q^KBNP!0a2xTYE^ zzQkqKfPv*4TVoCu7>?>C*I9S_t0H00nmCT1rbo9&x+6qu6~@hAP-EM5?yIt3ZsaK^ zV~VqT-L?ogd!Iu#p#ytPMx1q-nY`~G$fSD``~-=+`z|w&n`7#2O&c59vyS4jI2_Y( zdg-ado+Bq>Do(~?LLVlFv<~!m9&XJz7~|g1dbahp$m5YEu_xa7{LS+xyRYoNXVGkz z@zLI>S<5_SS=ZtEnsw6iR#sHcy+!N(v=ixFzU}h!wvVo}ZR@_$x#<@;Rcwg)C=uu4 z*!(*`ANaJm3K!VZyQAPrA`cww5dCMM!cBnnr3d7>?E@me8WNF-+twoXjSd@@yKZzi zb~)_(9T9IiobNj#KX>6ut9P6kZYgCT4t@}my@*}Uuic&nt zF=uyi#j?thtXZpfRJNZRRaKu^m9!vgLquJs(al@hxN85wQ-<5?*|E{>9G3=rvF3Ke zvl)$CaJ%;4`TMJ%seh+3!l;c<*K~xqrX#d#IwG<$!nG^Hxj!PJ$`|IEUi?4pQ+Bl_ zvgM_|-!=-_YRW^VZi&wSQzZ7%+*v!;Svgj83S%RAosJcq!dTHMj1`^2SkWnrwf*fL{*y3Nfw>V!;jVg*$mdS2%ETU}S#)d} z6;-u!K+=p=e&3ybf7FrXv1oVxwhhRbE;(e^-iz5CiX?YBjqM42PE3!+!r^K<$f zh-6qx=9~7Dk*Bj{NPfTM+amp|cAx`Hs$SvWS@l_!4Qb!$A09=b?&#V-Z}TGU_V-RY zs#ur#xAubbPJeq;Wm3%AUUt_4(DI(vaVLpanyCwlGVPnE{KI@$7X87N$Y)`Fv&wsSCJ)`RA z#A(U)G8Xems%H$ylBLzrai2d`lvaXS zTKin%kG|b6=pi4h%K(XXdWiZI+b_&vcHnE@8oj==>IUNNHVZme#(A zvu-g-CI6FdD6Ia8_ME;X!@df3lkT1L=sZWIQX$@i|7snom0F+7bpZr3FzrA9XB>+@;C^+rp?@BZW3r;7SL+BjW>KXRhKacI%IKkqyBF9SDxHhj_dAKvox<;S1; z_phQi_@14aeCNL6F~>YNZD{9MRv4N8=GzY@dN=*~?N_#cXWWsrtK)xoTm8&O#}sYM zU%I|W!cRICUnoV^nXUQ9nw>v-;WxMcv+z;hN4LFr{ymr?e_uPL=*qo6p0n=os-o4!SJlk@&DQG2FTb&$isIUH--rK|vi|Ge^jjMF zccW*g!clsG^S|IF2-04xy?FTc=j8M-{>qCJ@>`s_@9;x1J-!RD;VN#DZoYrDiL05~ zrf?r(UBc}Up#KTzyrNVmzKX5fKE$ldsF!&mALg~abG_JE~=nO>lEh&YZ;`Sl2Y_0M4>DJagJ z_ipH82~V-O`&!)A^f_`K6i3KgT)vYU5DWxzh?QM~UJmh9zV1#l`pEjGFZ*IO=O`AK zbD9QP!ta*#uk=eS;ry0Y3HgRg#|)e~2TILRqBq024hMxThxCf#N?PPF|Rp_O{OKTNk)PoT44UwWfC)7 zT&H}o4-t0Cya+opOn+e~9(XCdFWV$1$0XD|u55|Pd9TFeUM(@XH%g3?@w&uJrxayR z9;UNaVnE|35;N`&O(zDKp+0R9_H$4WBJ7uT3j3v_1 z=j2dE;2>r?w@OT1QReVxlw#@c!MR3a+Hy={+VX+KET6Lyi}aZ<@KDDiG1Iz1V%jo9 zVy1Pw#C$FKgv1`;*CZw<)39aWAB0>sStg=<`U!85o~lRst9dLFB_>BQIq~#H4pIKV z)D?SZ1Jh=TDnpU3M|hd(CYxBKn`C0fQFDYuz36j?y$j{<&5Vh`{(iDv=x zS%5k$SFR^T%yQ*8DlvIZY51(fQ{n%24R?#W?25~KTp1sjRn>X6j2zR5A@3b!S?xe9N*~xt-Jke%2w(U?D># zq>zO>WQ6ll6UC1f@J6XO;wgnf!GPU(n%l2uQI zQ6+$(MC_#}q&3d$|Jm;{d4{3uGX4{X&d0tu7KakWcM2Xl-(igpk4OPNKH}+oli)^{ z1ETnNPt^I2gO9fH;PWlRXdmy#I$r_Ye1=z|_;~Nq`Jym6g!c^cb(3M_`z|uC^R>c{ zag`{(k2)ZkdKdn3?tul7QS})>AyY|AJ@at`HD3@=27wW!TmzF?-as#&sC!M zu7#e?R{=iW!)V_XI2515!gm2-{EebS@%U>-eaW$04$M&H3UV@%(p9cYHicIR! zxy!=mjW?fT$Oq~G-y;^jN#NseBqdCjQe)wJ7<{epCm)vL3-JBL!so#S1=WBkKJFDq z?3E#0Z;)I(Sbq#-{r(~KJrB(2>N@8>@$(g#)T48| z#9lfet>DW>MB2x>;)?Glz&c+!`1qSqiL$R69>iW5;6x@XBp-iWD!vBUp3!WCtUzPe zuMeh0S!dB(1wEA(!}2-cB;}n4Lz2>62-mTqW47?di;Ke zyo!%x;rP~B^xR$O6tbtu1vo<3)2H9B3kKgF-~_?;9~1L6f=1^gJ^4+q;z430%5Sl@ckqS^P{;1P1E zIYXH@-86W((7g1VA^#9005MOgST|W&XZmBV&Psdo_O}w2*)h5@yFDJmB6-+$?7+G9 zDF0P!AB$}1e=5RA*aM&VCf9}9N|0vxU14q7Ao4ffR+m^b;fj`2WDrCBVz=UiYcL-GP>Y80fX6oOb)0aY;U8%R zp@1yovZCDF_JqIMd>tH0LYcKEXa%;}Xeye0AThrh#U=KTMiJ@Udkp`rRSy51RZf;- zC_nTz*fG9WdoU5q2-|h=LQD6xKaJdV@O(@6n|gNNbuh81+vDBy?*#c)XXU{&sEr6~ zZHV-~wYp^u!>)dDz569!UNpG>DzuUIR2Z4#Gz5+(wh;r=JN${^a`x@E6H!h@iBV`9 zNYfQz>=dO{_x*&cZH;flxBqls^xDVH!Io=GTg=qIT^q;-JHC~2{{L!z*a}6TaHiA6 zm#Fm#=h-KiU4v-UMn{Lfdo9Xom9fD7=#=jM_=J{dcSP;>x_aA2tdEdayS<`5v$o;i z>a*^`N(rL|)W@!LoQ=4Da$Vj>yX`s2MqSFC^;lRRbH-}wGV^aYnlhicy1Xf?VQWmy zFJl}2?0NKWPPDt5Ho5DPHhm}I{a^1m9(y3lXyY8VeUT?G$F+>1^t2Tp?T#GP`=b$& zc>gl$GBCgY>*J;l7k_wqV9#ZH5}S(}mbLoh-Iw>A#>r8C?7$?jYcEUQ-oR`0F>?`x z(mt(bXTWE6B{l#a6y2Zwe>i{K2EzLDo)Au-zhA=n^BGO~Q%8xOE`O^ip}%@g(Vv-U zPdI=2h4WXxr^u`G&>p3)mjm_G^CWRN(e+iHthO_ro=@7{mFRXUK0U6wH|u(ePuElV z(ft%wXW9@g4blDZ=qE(?!{d<llt z%>$c4Pjhw;qv@MJZDC2dum$=aI*jj4GX}01zvi!(*}B<`!Ub4GB@0^^@x#oq>2!Ix zqY<6coDs^Z!m<+I{M(n}HBgx`ML0YQP1h1VXqq!d#wcBcoCJt-g)2ZD8aT}v8xm>E zqJlz0#+XBFstfOFPNy{3rjvCiX4Zbo( zmX;V36bSfCbEYYp!i9xpqQvu-qRxs+ko$1~KhNTT=iGp2P;r{mEosV2%I6mvQ^kK1 zPje2EVFe3=F|sieA3IPjEm=}rSRh)KmV~Z2&6y>mmo6z>TCiy0iUme)00sTJ)%L4; z=<~D!n~myAOA3r>s4mZh0)sdZdNo4}7NPDJqE(k-MYsTBwoF8qL)WX8@C3AeGg|M}(TWb1rV_I*Iw1vtt zD0k8Pk~t-Kcdn}kJg;}zA|fIkqEhCSrlU&kEiB7gT3&2SoixRBN8xM_E-`p{=*RLz zYPjkR8PCr25O2=>5(I|C8za2Bh$lKR#=|u=rDX0xZg$3t%A*{TUtD3(6J0}Y*`jik z8cmgh|*-e`My)jdARjS0g2~Jz(2Ypr9EGt>E zbYXgtZ(({t;k_ku3XMBT(x*(j9rZT9#J6xxp(m%LaDIU&tE|xHK^-kyR5s6(nv-?= z03&PR3Xdr96{@$hIl0d99VO+(lc!{jT{x#~MXAUaTpsKJR?L;A0=f|fwqi=pyomOc z@mZMx^~rtR9WVe%1(ruPUfidDO0l2bEixRc-oAzCBD#RVHO4kRB^!-&dFUm z8&@?t7xNx~4r}Zf&pbGi@yNYiWRFd2xPNi=kDrbLK3FA!Csp~HZ#PjNWxQ8rtoF`NBq>7qsRbFn!p;sxBM zQz>>22IQJa1r$xEQoKx4L;>oIrjuJIL%HhDts*xRzxu|KTL7&6Qq5)mcS7=K&V z7+xPR)y%a$N(IuyK(M?B@X%%N7EpklK?SqnQz2R@(AawX?d z7+Urwp{}R@?o&3Xvo-A7c8A)gQZ>(fm}7TtB#HmY;(s6U|2pyCBmM`9TK^rHB&l?J z`-akoxOBaX{jS&bR6Xc^$_Cv}{muT~olD4pjb_YrfXsF91qX51E326Bj1w}M`r3%pr6&*5yt z3j$pn#tpg?@o&VstELynS8ayR5`L30MV4=a2*=x1O&nrIUC_f}eAjqM))&X$Y{r~m zAdmxZM7T#BWjqc%MGCC`ImE6@%0+!^`C0RC&7al2DM2zIN2m5-Z4c8e`gdB~-?zB$ zvbgopKc>f-f*+6S)_E26z(LWLADpKaQ8L1J`iODjyTL! zSL;!Fg*)9ii8F=QOB{B&`as(674D(N4I%c9FusuXn)#{M#+CzgioM%U`{AiZ7JqGll`Vm4y5zlr&<>?R$}VLORV}>TR(U}6i*&( z>BPf8h~NPZ@BjpO`kOioqdj-Zun>D>zFEhdYfN3v^-%Mg0S#L!|4VyhUW7g1{1wU( z(|`i&|8X7$*8(I@vcv&2qfnsC9L+B>|co2~*q~2M{ z5Me(sb%p)F)TMOA6VJ&z5K#`mj4ODgKf`SD7NBhCiwC1lHY89}#sv=8035KPkEx@0 z?hePpLV^ezfCD_hm*R=XJZp-`3ozpf9_i08TL%A|VYU=pA83%B@*;1sA}(;i2H=1V znV~$-hvVVI9*E!p4)6ezhi=-y%U0Mh1^}Yk60xX9ImeuLj(A||E|QoW4@t~;6mkZx zJK$ruKosZ4z${|wd0m`1=$_+JIgVxmr8;NcSA04(nL@E->}Uiwc5&XpL;0+{pV zp>rSbEa|@vxLD#xfagoR4S2c4zXYz3xE*-4#HWC3B>oJzPGZ{pn8dWXN#ef(?~u3y z_<4!1z_s5h@pZuM5~l(mmUtxaafv4ZpOSbQ@COpl1wJS73gGh+W3dn8g2WF4N8!H0 zGJG01M&j+j@e;QIdnEoXaH_;7fyMrFh)YZ%PoVDt{v7_QPT3&XPN>8Frsy0;k;X8;e8csMYHJb``&I1m0REn<<@08>|`^?mqzWL)A@i3@>MS_^?yTEwHM zGZ6nE**KW)a`=zea4zxn_y?JegF2Paxl6+Z#A)~knU8}y>!DMs;pN2X_y?)LK^^Yd zyIRBRiTR-g_UHdOyUG!3T+7VlfXsrcT4{T!0{4uA52vj%YZ%7|KEU9C4LZC)x}SMhe-c=U{M#~ z-vXR1{htLMFYyb&qAsAb4_MX3>%gimjsh1*{da*?UHl1H)x}w0Q5WF(61YO@{{win z#8G@mkeCofB+7x00V?n85@V!4n};d~R-Y<|!N49IEW>P^aT0hE&ZFJhf->Kp|=C;g8BpO={H@?VhnBVYpu_0QpqaSVa~hBMc? zqyN`9tA6_`JKC7^=eMSb5_^F?5@!RaNSq6-`ty8X)t}!5%rYhaEMS%?G1p)nCGk&y zy%PTvc)Y}%!^v`|KIgBB_XWVafu~CUSAg%5m~%O2Nz8Ah3M4)WTrBZ>z@-wO0WO!g z19-W_{0{SeiF*LAmiQ`Qzr=%p*GudLrqIs7?;YT2@OMl9`M~iK{|LC3#FfAvi8lhL zO8isc42hor9wPBh;87CuyN+y$+kwYRd=fZU;=ce-m-syJT@qjB3|@o%fz>s5J#eYi z84FBdz5>6$fakzp<*OVxM(Wf8CrbQNV3kMy-u6iUL%=GJzXeW{{@mwW<@a;o;nM#f zz$(A7cz*LrfBvRd`Q@JIlcfK5fmPmb16Fy@2UdA62A(DLmjV|{{BOXj93BOxFzzj>4_Q^GT<>1xcMPyc#?1w$kSFl$4crSIz2fN$tavhj70(D@kBplQtjaA9 zSe4bCz^ZK&0;{qr1J0Ile+aC~Y7MX|pND`|`8)=!%I6ti3T+NN=L7!={>tV*0;{^d z0PK7`h@x46fybG1%hU&VVbdnz>=iQ$=V*%7Ma5O3;dH~2ej_%iq`n&L z^qE|zuLzYHn1F=2M{{Ok76~UDT)d#dDu*>%emm!ze<{jNiduCv@hbo7q4OQu?<%Mc#c83OpO`&w&oF$oqXJTCR z8yFr|SxYZ$c-UkY6nul^LX@;*lz+&_pi36Y&q2ei#ILRm)$hy{vzIP@X@t|&Y*;>Y zaK=nud3l-66*j9vX-V;-vhtZ?!rjG_4X>>wjBb-3RnJ^1W`A8IvrrThzdC7m)r`7~ z5H?$~#V;thL>FV#3ri*&>P$?Tz}5<3KY&(s7)CWLB^n9mBV2+lR7)#n6@X+f@+t42 zNrTYO4$8b~IMOk{lMZ+d>+Ch8lh<&50UYSdnMaksqOwH`X8M*aUeLUNVe)k66m@ zu=K}Ch~lfUlwTCy&!#|w<%dVM0N-2--*JSE!l6X*&9?BRX?z^>Q1;CP*7M8Xm$X}n z;=2vqWA{FL+2~k`1r1xVYK6BG*F$7zdaQPf&+LM z^mM*D@G(Bi4?_?Ez8)4n{(hCO+MyNXyWGO}l*Y$l31#0zG#=f)`EZ0QzZ~f4_U+K} ztAA@e(89;xzxw5`^3FZVbiQL6A4ltzeYfM{)9q`5LviT&od7+Z@4S{@mXG4Q-op1B z_~g(4=>pvSEPPH3HmUjmb%2k1VC_a+ue9wc=i*O~>qx=Jh&X=O`@fEz{ zI|i)teF463?e8}hzVYBw?T>w);(OM@cL99iuHUCEe6uwBIIO4mes9Td8m_Bw<@XNs z^!%>Y_-@qrUa;^D2cH+=O2|RkVc~1i_=X}}+1C#Ms)6T-QQD`_?$_>{&WJu6<@i`uU*8#`)sre zK65Bhe2Xmk9RfbyyVzbP;!u1qgNV@;AIGS36`9ndlk1f+j+YKdR3Gy_D*0~1q4;Wn zb-qMASDb^N5@p{8c<6lP;9D>4`<@JAyO;zkaFAoRx z$afFyAs@%lC{5tY?rviKXBdy)SkgU%hrXv6AVsCiciqHZ>3;#~wxaBr?o=EMW4b&T zU6peU9{Se9twiy`yb!*Zar5IdIr%tCPw|aMz3Y6vFejw~;Yt+W80ZmuWx&G&gXJ6S?O_(f^Oe4UFe;$=xysl?_G=DFS^j<+yy<| z-CgL#S@eF@g`N`yqVu&wFWm1VemSp~a}6Fc#-lt~Z$2EVoVQ!@!8LQ1BU}mfD9zB* z`Hq9{dH9oW4i3fl0os~w-~HfYx=Iw^AEBr7txpTuR|sXrmjp~cbq{(KdaUZye?^<E^bfSD z!Uci$#I|y&Hg(gm!9%`jo0^5|hoail0Hi()`+r4MC0E5&VJR7eRs7l92dLuH;C?_N zlJ5RXFs$Ni5DPv0J0`;`G(8o@bHy3NLA+sYM#BEfOY&A^4e(VaB~~q7j8!)xuxD5# zw){xKwp|HB;B>{0f;PZ#qd)hX1 zs~(9_?tXRloL1vt(l*9#&um`bh`nj-?yDY;oO_M!arb}LB)t@Hxu1PJQo3^e zt#ym5y7ioryS}wo$xiHjlzP?f#W?pW%A$>Lx=uNbmc{Lv3DvG!u*=TtL+!4g8~)7P z;#PO`{?iOycjb6}Rg`hm(Q=J~)F zqi0_atX{DxbpqD3>2?1$`z_8>4kP~>XX9&${>%n{Ym#An*kV7h+}PD-?#+ah>XPzD z_D+5+HEsHV>kVOL!c7q^ZGPYG#2Hb&&-EH`i*r+|n}lgt;K%{XU1&EpHw^M;-eUJ4 z(;ely$~c{u@Rw+J@lC1roEwayCH4cE zMq1+9hwM3njkM`&d)N=$VzgsZ84t3)<_4qjwH~I)9UU;)HOXRfbX@XlebN$PN93B5 z9qz>T%$CKew(19Jql}_@SI_D2-qexa9b0?Eu6@y-Gm5MH^qRlYu`LqDCG6=goTg)> z=17mozsK!fUS;!Vu5=veZ*;B@Q9}Ku3@n;6;W(}BwGNZZ1WN0^#udoHzKD~TpUy(@ zx}0VxHlpG#Z|CWUx_;3>I}kO^b)H(E781mwI6BtN6fy+7oWIt zSNpFBFMn}S^se?N09%s&I;>yyy4Dvmj_i#wdU_527VpliJ-_(8yHW8IPvt~o;|FBh##x`!y1EU(-oW0foV#6O^NKwYh==?jd#aXXiZBFz0fyX!- zJmmg+C+%k)Uvoj8mC>C@;F}(4S%^zZewYtDvfPlaJ6yVMYr5`m=~_rGm2Mj{loH4< zz&;1^>pII?LH5?#kGv8K4JIuLMP@lg?C^zMckE}KUvoD_X4%4HO&WcDlikTz}+~$~&1=w8KvT=`p$D>)B{XP9_UvgDNByWGG_qiFd2|cmJ zomrQ+MJEjDUc3>F`Zh9ebMA8;Uwj%nMKK%E31y-)bgoG@RxF;Lv@N1I3r4>gjkwG6 zwngs4{(#WKRpK(5??~M^!Im)EJ}J`uUM%<(b|-0N|Z6wbJ)31(x7&q6#_LH_%$3ASEQ?U}C+N7uleJDZY_aC&6UmFP?3 zd%3fO5BIuDF%xf=(mhMKO6Y#n;{HUYw*c|t442qnLf7ZqQzeYg^<|aNeZ=DCoKPhU z=X_%&bl+_Wf6C&1(qf;}l0M(vDIwn;i<@H)N*MmBboT>}Gp-3)W0~O^y(sSn>A`ut zamKY`ey+}UzlGm!aZl3-$$yU}Jk#Pvl?R0SY`!+x%*6XH`P)a>Dw`uuHre#p;%xAs znnz-eeWVi0%LT6sgwAN3he(`<^KglaapwCN^86dlUgE3q4>BGH_o<-d;!t~cOeL1h zeLC?K_y@TQhmDOHG7E=Iz88!Ijz`{^KaMpL(>%VHAZA{hBxcrjNX&e{ATi7{PDt#< z`7aV@w$B-8Fv)$vl7$hUr0=w_exw0{6~pd z-d{@0dT^pWk%#&NBqmR$=08H>0{DMVV%mA9#I%#5_A}wThj{*j^ua;w6fWpoX9Buy zc)v@D!eR5^AB6R4OA=6AU$$fu$J1X9^1Fc5x1yq*V6q1JXb1ht$1)-&-$aRHaL$*Q zd=wiEgmkhe#q<~U^ffW#+t@KcI@v=-h_DAZU=MJ>9$=~odjJCV00->pFK9a3!^}Y# zU+oVg?7_QbN+)~dt&5jgJTUFS>r8=Z568pkPrlnFCf^+r2ken$F3N|EAHsLk@ld88 zxrmk6(o7`uWnV-c)h7s>C6BN<-PGqbtlE#TnFR@9Q-}v9-&Bdo_d|)vS0l0DF*(ygDd_=<^OU(4Ykl2HBn7wIA3m1q<-zE22 zroHI_obRVkn`0Pe4&o52mxYPhIaJIUWJKRZBX$lALUIf|wJCKfSGGFi(zR4<8e3Stv{bZ+1*J4u>@{PV_O7WHAaVmBA%V10#nu)efy zVmg(D7G|Aq%Tf>Ff(;>VQKun3SQ@f$*pQip3&qNx$|&iJX3zCNmG2zie2jzyoV48B zriqO;;7$9(c#EXre-wY-SJzCgTBgz>OJ`p}67)uX2VovA>a^T98|M`Z#5p+a zl?75ddtO12b*^hjK*$7F_8#9z&f@-$zksCRett7MYANV)h1`Vy#Jq1)*x%`*qFf0j ztDbx`6zWRvJ&Rs8LfKa;QF?!X9-)iBasxv_nL*TLgV94LdCZUnbq?<9(?kV zP%tXKS||~Fg)hb?wfs_F@h!3N6@ZVw$CW6)g%-Y3;F|>{=2u;dY}bj1!04b6azB2* zq)5z@;_CrG?4>8fi$*dZXYzS)FpPY50G+P^e0<-egnE>(9ie>Bfp0nd$(M{n@uf+= z!SJJOkHUKz6N>+&=JAOnOS1rqb5^pa3-nmNW+=;@-u#z0RW17?3up?wsk z_a*WH)qp$)zFF{NIHur;eDL}#4NfWWP%b$JJVZ?_xb(b&Y+kSs^Inr`j793^7_b@v z7JE|QJ+9xLP;4~C`I}DRJ@vX(+%ghKjSnDB_e%GOwIjN1?C7ZRH>6^akh_Rfv~_e; zv|@}&?1hr>fUVA+Kf>mJ2vN7jCESDG@b0KJ2H&2iBZgs6pZ3T&NOZiBgjWFP7I$>` zH<__c7%S{0BWDbpaLtHlrXj)+2Wf1uV;_~{hCeF7Z}^8}%#kmlbzbh|fbp)cBUjp! zIy&;pjf@9935nqMM<)0?^84EUW`ivv;@!~+h5z(Np11kOCq&truEIc!Qw}_l6VYYn z!RL>y67lRx>FdZq(q^8JuE^KR=Gk~1c5E>?xRZ(9S(2`7Op4FXH*(i{@>`sKXF{

      zS3Hnam$!EJKv6E~j^5|;pLO|H!9ctU^0j2PCmqi^9eX}c8aQ$80W9J+*N-t1RIoqF zef6fqTins-d!Fu&TrC#)LZqzYVw?a22sXd3F3N4+U{Ba>G`ai(f@xxOQl#1BTJtG# ztLjpe`4*JNfK} zV)w@SRV9l{lIm8~$JTAEx0$6bGZd&8>=9C#6jz%R+n5xyb#c9~D$k!)mFdr`O7i=v zV*O^;wso#DVYjR=)|uf5baBF|{tbK2*oStsKk2&nldi2z>eZOk8)M+ne#cQ%-S9|O z;GepGob_(rLEnV7t&3-@s^3_$W%o{0BO6D;!04j6lUXNiaHZxY4D9B2B=}wasG{X_ z{5||pb&G3#G4&Yr?WoxtvjvYSyFIwJwneqCI=r~0dp%NHB?eg5^f1yd zLrY#<>5D;5KSM6x^B+Zy-$RZ+tBS2miZNTMqooaVds})4O^oX{bW~KwfV-y21A7Ae z>e^A)6u(U!KRI8B*HWA4TQ=D1qQILl!k*x?H#rja*iKg`{MgnKUG)9Lx^6{RC$#ivO628x>T=N` z2pgWc`m{K!{2e#yq7tf%rbN-EwSL1)1Nl5}_*?L=DGrlTIDJI+J%Yt-6@m+HaVfE| z5;0L@A+~QVDe&a-g_c$R1?zSG5zkFZ!i_DdFrGV)4e?GLl+NpK@`)`dj*ur(^65`7 zbbErzK#q_n2)fl>(^SLQr$t}gwN)6lLGCek*IEw9hQBVFuSEp(Nvo1Iw=^KU-oP-u!d@6(zK%!QyVWxc_2t zGpvVkwEY$YQ)QO=kHcxhO@O3GhFD)_oH|e z7VAplB)$Pt>rLiJf9g}z*pblZKM2E=Kl88N9}68Bk!@M6JvmEaUg@P0Q|%dv$#G0# zmWOU9ABokNLx#i*pC@s^P7gdF$vEO!co1QyM?mp=z{Wrb)3EgsQ1m9Y6ce*2vGp~v zhnN=}gu%A{0*cjq)%usBE^txPo@^ZSXCCKE%zTwe%rq+{W|gg#m}yo^?7{g3iD~<< zB@UDi_-V@^`ZFO2dnaPrApBYR5aAC@e^D>|p$`%M!1TWv2gf3q7Hv{%aIzmDrVho1 z-)j^$uaGeZRtSW8woC!dGM7J)Xrg+5-!~(3@QsNnVc*!!n~5z@N{YJLt{p2?sBpfL z47{krCJr-kEWxRC$r7n!F2NFf52xPh1xPf7PA@T4LYhwKOVD}zlzpKV9EKvGp(R~v znre-0CC9r^ZdHOez<7UM=9@oAqX>kB&0AoYAWY0an0jHaeVwl*AYN9pK(UI28j1+R zW>K?dLAr@Zj4sA==9$R{$2?5EzzP;i zu))oo;z4*#Kfh2fE>;wVDzGrcMNFWD7g^{8&Dx@2&4by2&BSJF9KWIsT~}+Dx>izA zmEVZ63r#Db7@z5~d_zWWf)&n2CCU%Wrtr;Dm{F1cyI~IF1Ke=rBapbcd>1zqhs(Ur z@V|O&*6-H%+pM)NG_ukghhhe((9 zW#i!E4#Sv_e@7hVl3??3jB<(MCo<6w3nB)e5mJW#`_2n^nAp_F;S7> ztoYssAoj|zb}b+JI0qk{b-r0}C=Nzdm~C9=JEPgh`ePXFW82pG3gF-~s1n6T9i8vI z#;1>StcRY?w;GOc?U~QuIv;l6474jgmn-|`S@<3U-+#bQiL$Q<9y%Y_L>v#lY#gdA znBO^;`sG|j`YTaeNmBL?%;=9ShR|>uqD3LE2hvMVB zGo9}|_!I{@6&?aTVlO=*4{P?Nz|An)cddnw>pBdFzY@iFwS})i<72;|_NI#j)6EB#{62> zVaP@R-%Ti?9%U91)zh7hfG9Ia{8xJ8EPAsL5U%`2LyvL1l4CXOW4q7B!QX}qqka7> ze02y2m+oa2y$0xoOPBo>X+0ycCU39leGVTj-T%29 zY7~PE=0A>y2A#>kVADoS zGgaB(0IA4E{$MdyBC--{doVvD7r{(@JGto0aswZXAgm7)Y5#H2*-ABc7f{qE$8WQ2 zC3!QlCS=}bpPiK2*f!m5Pn)z#eh-%HyV89P#^>NZ6=h&7c`3hCgvTiNDudtpB0!9A zZgoBLQY;<(z&A;J6wESOku=yBU)k2H($}N0ZBnKn+86OA$DQ7ce!cPf(LR1BSLwSN zQ7iM(S|4m3*#Z;ZYMTlVC?Q6|K-(z{U0x=V3a~dOU0LEQ;b`?fXL}}wg7eOEWH;gO z#!g(uVl+|Mm(FkLgi(lLa^{yA3AdWxpQ#py`bU_U3UFi~zU73Q-(kDwZHsy-&bF=F z+BkfG-H_^0`fNL*SXq8Py!u}dq2k{ieaA~&TBi3o;e#<<*GcDT`5hVdxjMJ(1rCav z^9slzt|Oc=&O0M%Lgt9r!AWtGlVV3F#VE?H&SyZ$I3-!gGUqI?43Ed2PCB27Oq*kT zf=jk{+7vq@srcyhHbwHx!&k4!T)_epv0cYw&pJeriCF-&mjo1__os7{0P7>wsdKVTM+ z6W^ekU#p@4b#$z)qx%6c9+@NLfVUS~82s=;-LU&iJKy?a>x`58D#ent2|2{5RWM83A5<5IftLuHaDPx;9O4aA z(5LhK1pSvC-&bB~aE~iW3=X@Pc_*CWANLC_km39dVi#Wo>f!vw78D15soX3dM)^!` z5BcT7^!TPCC=R@7_=7Bh@4(w0@}`mco}e-izjfuhq?DmJI)95RA4G))_4^sSq&*x< zw1>R0V>o|V2gQM3#wC(J7T$L8OIZ(33p#)t_@&C1`KKL>u5 zw8}=#Iga+guM`z-K0%u<@((lC$R@ydGIqFiao`v36S98z+s_{IiO#c*# z$&;$#G!3&%7?<|)&Y<|27lqkF6Eojli5Z?PG0SGW#G`TMbwz!ajmV>{FHyF#?3ph$ zCyP_C)SN8ZL(DQ5DzOJ=-bLuoJo23wG4n?oh{?yEmzd?jUXqw)MzNs{Fdbo!#G=fB zC%|8nIWW^97xe|7#I%KJ)8B)$D05(P(yjby6EVwJl)1!oD}UyZn6`^DmpY=%B^G54 z%)EM~KI1VCG3lfKS-XoA?dO#a5=^2{h9rdq^7T-PvX2b+C_bD&m}R`yf$IOAx3>?9EC4%*3yUf z2*{@i)|d+k-T`N}^rtK-A?`ZEF9oLzCJq{bgFNMF3-ZJvCB$8C_=&i@X@gjn8Q>{D zTJrI9H^2iVY{En&>9TG!j$UGTGEN2oKtpkmkL$2ecni0xlLFIc_zQi&$K_F>{0I{G z;Cbx}`D+Y$)~yWiart`50^H#|dFD!Y=lM-wq+dVh@ zGZuU~ zKt3FLE;-pZm}2lEt?33Y(wb@TDlOWtUs`OqKt3G*6U@Pg*AJ5oIp}{||DnJXX$6Qb z@Aa%uAYq?d3|^E`k-__L(r+_(nqI%%;IqjuHux1OgHwlkuO9WqtZT=OpK#-(sd+ce zzBzwR;k*T3Ub0dxe4%DgauTH2J55dAxQ7qtTz#ci&}3O+nlZ?C{brq91&oSXbm$Jk2Od|GYZcd zDkHL%a7O7sSv0DsH8df6)M<;P1!`F zBWJ?*$syqcPwJcCVbn0`WzLmx=V8^86XXq3nCHePq-_pJye9gEn9I%-XilBp|E>A= zhIVp-eZr;JKP0aAK;pE}XU)^^HyK~4ZCKJ+IEiM%M;hgQ>+cw$VwI!*fxK$s_h|D? zFCl=MC3wg+ed3d72ADS<-$YVr31RUyi80|^-nK2x`sb0gTqmCeE6jaa%+H&)l)F;8 z5c?m_l`lYtkIyZNPU1Q7u0hI$KAdFl$C*5aQ3S~@v2+>zZ8|;$o>k5lm+F)I2y*N< z2V~eTbY}Tzz;vh&!{~m)f_EqU7T{1sInpT$UIcin;7>e0rzpHJ$Q$*u;UG2PSVTsW z!uulR$OokVS>T-mPdxVX6<(D^Kgwj|P^9p_X3_67#tKw^X>Nsgw*`;uqAXQlQjX3g z7QEj8uLAzmkI$zH?}rjk<#!A4XhTIxzo#sC_uzT#QwR}{&man~6}-88Uw~sE`+ZNw z3E)gxiiZovC7yY%{2sW?cpM|X1V2Sezg_SkA5Z~!Ajv>P;vwsC{m!C-Cg7nmDGWwc z{I4Nr#>>Dnrz#IV2QiH9*DQFMz(ZAtlfvU3ux31;36GDn3h%2Hylmi^hGv8u!6(5E z=6uY(Ou7>xXHItl665n3?ZUH4cen-bPT%8_1!zgfR+CjCYsT;Xw@Uo+lgaLdPBfurz#Y{B~`@Ww!b`f*4=;bmFy_-=b3 z{YG2xo;K;{GvT=`cxU0Bif~0rKaS^<56FNXlYUw7Q~DjWl!p%i1L^mKr9A#<(r=6j z?_mob*BqKGb>NBVk~qhoe1Hy+!`o-Sv2^309;+<*U4;OJf#5j*6-$1zfyekPk8CMN zcfJL04ZwKaDpJ_9EO=8)c-KLga>TRl$y#%qFmApJVv&o~NiiwTd{9mAMk?xk$TYlRzC zAx@MdHGm->paT>!;Z1^@VZ_^wo0u8zI06RJuL5#rye1PK`v3}Wg9Wb#0lXd+QI53Q zg4b!nn}%?O*I;QU&mv$T{rncWbCC0kl#CyhZmBIXzkKIKJ1A0e8z4tMAOl{9ew4c( z2Z#F@M)x8Mo)36F_$yL){C2^N_ZINRK!|v3e-$3rqA-_7K-M!Wo)dD66Hoyd6ju7N zy;OMrWx3ww0*~ddh;pRgTdp^c2`_+fh1Ue-%=&RpMTJ2e#eWAv6hF^${q6;xs(&2%r5xSUEqL!-M!!iGyvIy<>{lwhd6w(^ZuUzRsr*i{$mPI2LjP>)#`gyOsiyl-y4tM?N6^kDJP4Is6#Lbl(P;8Si=E zv7RbYcw9fBIk;~{;2|30I z;2>=?;jMw2VJwdj7&G2p;K4L;q8#ZSFysStfWB$MTL(A8h<8@z*9M-{3Ox2l6e+x4 zTk`t^@E(E?%VPr$g;yw_yVX7DH1KXzU^r8E9{fg(XO%AZvK=Vh2Q2AkUwK+~a{~MQW~}a;q@bBlEX!&mdji z2bnHO$<0SP%Et63-XfU>?a2J5;t&I@lj5JgU2zT3DY>72AITRuPyu4UlusX5LA$DV z=`H!LeHKBYj5mk+Oz8 zwfpv9no5#3JJ~x_Z=DmprXaL3+*GxrbC4fqGrpBOxVRxy5c+CCXhlKjo|f3Au4daF zeglPQ5gWGH%e1*>X_543R^5?rWQCiz)a?oPXt(uv7DB4sb|fEi!DL&+77l&2-oK(T zQfmu0@2cC=)uSQpc3UR}yfe98D*SoO^@W6JHdn)$5O>~Hr>yg8C&mpi2 zfx;HIjsYNI8QDBxoW0HTEw^I){BjxfQ&9`PX_PxVLbBMBP?(vN~ z5T(GM=6&Xi%MKg*)^f?$-N{R1d1t)8^NDz<;wcf7024O&G+`a`*^&1VmXEl#dpt?u z&@j}Q+A=yr_zC0d#1_OV?$O$@x-5{f@t?cPKP*xPKKT0)BDAGP6C3sgldo28VX2ND ztp}x%LDA*IBh5K5!#;1T9v7lQW})O^Fn)pna%~p4kgno(#Fj!oA|FlLkRN&f*=(=j z)$YazNhu7tE;VIcu=yWG-FBE zl*m&JzhhxwLEf~;K5vii85B8L*N%;Ak2chGbfn-^KVRD$%}(8u5Q*x0a6&87uQ|No% z$ufQU(t8=Sb+@YC8Hg zq%k;jY1C};e31j1fJ4oB%OTGfG9dO#bOM9&aOkqX!f_y7K2!$C%LmaS@>CSG0Eb#n z(Fb15wheK|`AnEkh(0+-b>w$= zieD&s>T8`^x4LA@hPCB#tDE?n_deg1+-ZvMt>a;#t@q^`dr;knr5)8ekm{|rjF~V; zP3$4WIcteKFiBA?Iyd09Ocun%H5CCVmtX9gVWA=zj}x3WR&sx6Tgm3juX?z8Ywn~3 zIm;S{3Q=k*_f%58+?ELWyzDMZaYJnj{m&LRR0+xC`|r$T@rm0$VHHA!B1&Pv5S2ai z+zV!oZeyN~W#WRc+m>P#s%EjMlw<)=KzWJv{1|P3HT_sCKNmfS`i-g_ryR7Q--e$e zTo!`Z7Lk|DvwZe5!uZSUl5_{+TICiQLE=}*-3~eO0U5Rm7jr9kHqX?DVZ5fNTJRo% zpZWVWg_mQ&OTshdwxsa>6}%bm z8Q`&>ph)4p4i7V41aq}jegPfF`!aaq<=`NVhr!nvtoUUZkJ0$yS<%C)V5El%y92)_2!X^gY|G~->||J#}%gLeEz*j7RdXtQ6AZtm#%By zecc!ns5;p=yPHJjBqHs-aoyy`Kg9G z>-~9+Md79w6@AhUAq`B3F4w|`zFX7ynvj{HWV&Kg@Ni_Ldfi`JVpGCR$HjA()PKIQ zVvUGoj34yb%u0&Ai>}NDcl5qJWh4QDh!O^(f?}kf5G5)Cr@;G-5*58VGEOR zDBq9AO#hUzMK;&J^hR#2_fM_4+E(~#FVrxe*t+~vJN(ly&?68HzZQSaDgWem{gcl7 z3&Q^V+L*{nxJRo!Yz$IBtaDG#K3E^aCM`~a!LD)`r3GV5`LFk2({$t%cE=MYtkv-wyPFn9YO*LQv#n$aT%RlNJT<5BOHiQ8_EvF^%N_HXxcz^7JI;yb$41eIs(B1f>@?3oA$?h>WN}FvcKCoI4C4+cr*qHd%Y|tS zPehc1U*b~0x-^lK(O3hPU4bcbjlDqnZ-1gLCtWet^R#BYvY9I%?M6MES{o|%Pif_L z^+;|-GS0OeZxCY<4tUA&pJn@sLbF}oIq7~>|Dswy<@Ss(Yj=0%_bh(LhSgFgCNGKQ z6vws%!>Jvy3GMD4zlbe8CtU>wpiVK?Ffo~e=LgToMO}x5uq}j&-Qt-C%Wvt3aSUzg zz7x*cG~h&Qdtk#&~ zLNnJ@7gc{WSa*6fpKnpYZF37J`LgdQ%Fi7?)3^2Bk}X@-u1Us?=5O$rz9``y7$4RX zRm+~xiA*TzKDNo?wmuWT zA>;BydG4jAi0*$h-7M*T*%H3Q63+gFBFdY@1^!oL;Ch@n#!zSypgg)qaiY5`?lSbN zv!wT^wC8I0b4*~1C47(t|0@>vcP;XtNcT9T%RNqpSi;pF9#o6^sWnlQ`*92Y)fRV_ z1Q*#Yvwt;PYe$rAv? z=RGwJAo{+Tr%B>-xOy(0MV^U(0yxxj@m%s={D6vZsOREE?EDlaeRYZzPYC_669KahbmNq!7?juTNn8$9QUkY~Od zB%cHRN0O%vUXna*@F&UB2Do5F+yK}wNS-zbNWKXCV#zN6{}sv89wc3k2~a;ZCcylw zF#+aZjRi6P`e^)sSe$$wCw&nId19z>17h4F{fV($^28{XJnc_X_-siyXGxJxV35$w zCs<=V#BcCIw=9Dfx?N-NEE`o%M17;dLBnuxFBcNCL7qAgf;`jtlH}w1!=LFqEd7~I ztK^wZDa!&fOozm40j<7qja)0d#B*B)!9jf9ATRQc0fg0C`abWI&#f2;;75O-@%bJe z1B?xHC#~F28e09Cdv07_w%qlWIye&v1JH*M;- zAB2)rI#>ov%m8uJ%_VEZNRm_q*w`#$pe-Tdu{o52?>O(Rr^y3NhakSAAdhB5&=h%AC)G}J&19?Gok|F2C07GE@&OsP z0PW3j@LXen$uo@Y8~2ko<3-@dK8qrSx50wvK_ixgh{Q9G?<|4ajK{U0*hVT+cnjfS z){lEq@m@we^Y{+$C1yMa^k5%Nk-{4T4>R5(;1$7-cx-PO#{8axK4!d4GG7Q1r11U# zIWt}qc#Kaxc5f8k&n$RbfX63!-R;&flRJ~4DonRR(Q?e&3Jhzd{nJCDZIzvLp~rw z)&P(7fOzafD!jh~Z^jD%&;0bD@G51T0M4XcCOqEL72ZLaUp4>g4&YrYVi-S6i^m`3 zImhtUIL~*Dzu^=l9b#k=!dEhC*twhfZ-@Ykq`DY zw%ofVRK9g>e5CJ+YiCcz>e)WhmDkRGA=gOWXk)T*-6`!1|Hc>Om><^6HhlX3VqMi0 zHjk?$tt*x>YcK{E@X*YaO2rV|Pcf~<8C~31(G_!?iY4vAYa%{U$HyiRr_WEscu~fP z?7*}bu3y{AC7KcAShDwLoHx{N3~dB$pGMNwWqvW@h-NgD)necw(~$FI){I!@@l+2p z2FP~(Cze!Qm%Tbsu2u(P_?1hZ$~L4yKeNk77-u@0AUzF!!V9@nO8-e;Kwet1vhAsVZlsoqT3jkP-UgbbeI;# zxJqr9mo#fI20}51!2XWYC>L7U6+PS-nJ%piAo~MG;FTiSGlLMtP-0b zW7FPTY-Q|^?869FvoV6@c-#G+`=VRSZh=zX5uC*&U~63ofUkT^Zv(Ct`vEufgKKwS z?uXmJ6VoVy*ZoyN!63q>!3&?n+4-MDT+=gcWte9r^UwTpZFio;{YbTZ@a9j0zZjup5D$4{rHsvuCVQO7n0JPE*~xIvl-hhDgn`uh zo+%Bv^*w=xPAqIr~UiN6&&I%^fckE?0e81~Pr_h;8Mg#5HQ zrkU8Z;CyH6na=mgwK-Z3cgDyiJ6iX3Hj~?EZ!PQGL+%w@>*CH3x$CeOIC4|#Z_Phu zi*PXUU|MUgWFu)$MQzpBXt#YYGBgNbs;UvuMx+I$Vo3i}5@E4nVkF2YyzuwSiydVjC+LrnC%31|9;OUw!JS+W~OZ-n&4=O|8ThSwTal< zJRF-~yx{TSDvfD0(CM=GoEKfSY(xCLz38qy^*vkl7>3j|+Nw8^nV4KN!q#14+#*B0 zy?LR(RLupHos!imWhAKa@1vEE1;RB%l} zGmdm;CVQ?kbW2F}{GfiRvg>2>%s9|#E1ZU;tEXzMClOPY-Uk2DH19@df?=*h>vb$y zm^FBv-E0iemMXwJN4pKJY3s?;izS|6<~p>1!pzyZ=+d3!dq6`|ZzFVPJ4X}6>zZMK zieFjt?-_Es?BWoS|7hC8V=>9`5)euSH^A47F@VZY5 z|D%`2?fLoTpmz^~;Kbw|^|tO?dRs%mcmG0kS)uV6kgCdfyY}v1kcZY#_v_~ComW(q zsjp$W!VDJIc$JKRzO&KILy|Lc=l`fB=IM&1q8BY}8r-Ny@}s$RmBO3XmuNZAMJ#^v zrxWpNIkFgg1%z;a`4n$v5tH{Rh&b>vFnCLPM@;j0a#@|<_Ppo0=)o-t{x7B)qDtuf-K)Ny>KSw(s&8DYq+H+cU78!0+VQBZyQvql zg&&#A{Bq?T?{l)u5BIg(DEHlHJ;pB{pFci#hMxtW)D_E|H8>x-IMAumBcZ6jZietS zUNS>P+@7-D4X_sMFu_(k`fdkgq+xGj*_~$>Org`Xyrdjc*J9 zTU+a|KlI({nMDT1sivl5_68j=QT@P($-(8Hio}nIP`Ud=@B%6-c~JwSy7wrrS{Ra7 zEj02^&s?X_nvdCM4+7f4NUw3>a*3J zG_F&x*k>x;g~{GAwy0j1p`nlO@8K;I$?i_}esmr>2^|)?t9yE*dSp=a>INfSs7^4) zINSgnya5pe${DW@Eoc%@fk(_ej%pbliNCLPNbD zI%>->5h64`w=$oFvY;!r2$v6RhO6OCTSXZ@aj5qXtwXUOC~(S{Yr>KdRhi<#;^_1> z8dsH{*9X29X^90e38G8g<-H>~48ci6X*CVIJN)U*82)?Auu1S0*Li=&yZ)gi%_TbK zoOt*RQcvjgVk9FjkDB_ah&=k->BBuSL!pM|+I=N^(3_Bt(JI#2kmw&7vC>}-X6apG zRtg@QT&MHj6V=z~BC2OxWjCJLH#ED2-vIUbyVB;U&)!FzyV3f|>wEs3lsm&18)$XJ zy*%7{s-0sJ74=k-Fh=7AIT3J%LP#A^iXOoq~3z7gLD^bz+Ix+wLB;i2Dntx3A?6z*%a+mSEQG2tGqJtEyZh1+ig%3nK1^&gb> zxek6d4Ns^hvL~#d!Tf$vv&-}r2>GcdX@*&YtiE zI^9-%CtKvL`c2oyy81*?!G0?3LtnbTWeIPygzvP34>nZ^#{VUOKx1HU&Xy{_rp0~AqA%A~P(=A(S;D`l0&!-zDLLW3$)eB8mh`T& zxPNPrUt+OOzD1uOTjGzl$hTVX{>h^M1e3zlpWh)UqI-d?uk@q4#DdRvtBQoYCB2_m z+>coBKedE^Q|iOLwbQk$HLeGyi1_0y?&&HJXNKQk(eG6Y{vR#*=RAK!jQ@$nzV#No zn=S5NN`1eMb2?V0|FT6tV(Vj!6qvO7eva=-^=l1(rmK%NcrjmToWYCvO4$bQ!%5Ad zBb@qvj=^gF-30Qo3E;Fk&LbnypFGnKNS^6`Me-h;izQE8N+nNS>LgEH8YQ2BbBD?Q zCCU46eqZv`%L$t>UE-%mo^i$ZVeqG3YOb6#k*3Qgi~8vl0ExUvyN`yOYdJ74G!uEs z@;xtkrX}WWNf|if_7|8F=_9Yz8w{R0={FiY-@RsVq5z1+L!M~~TY)FWz0#j)bxWRh zJ1KeMosm4_lJp$oOt&tZUB*{+L+F6!ek1H8>VSN4E$V=5mVK0;f*(*e4qZ0SG?PA! zzQ#8+y1Xdz;MVyAnuSB3Ay`od^qB@fm;N^yd=YsHf)?P=XA4%Wcd65;pgVEsHw#vL zf2#)!o|jDq-gOg?@9oJi#hLS2$lrsrC@=7&LLBs`J=RK|Nta7Lfb)6DQ?JRaKai(h z_eq{*Q73uYl56TvhGp?H$em=N^H1J~GxM*{!4HT!(VxXfoyf1inL3f*i8FN~zaMAnME+@2odpY`9rarUYt$3jF0mfy1OTnVq2`&cAurp&4dhu_K$~#r z%mio)4mF>58+rLXYX$jv_yO5*WN_jOh@Zidr_Fe&lMmp`YE7PMd|C1fa9%BW=A%^d z%tx){lW_i~bWehkjXB)<#iF3Gcwy(IaiIRA^} zX*14)r_RKGSMsZHwzF=-pY|IpdD?HB56Mj;{00r6X&AjS#DEo1`hofN}gp{DtXF?>kBx{JNqF_mu34M z$>)IQe0cg#0sp+@SAjn*d18Jj`8@EPFHiYd;C-kZ#pb(nQI#zRi`q z2j@kSr!K{kr!Icl84NKtNS2H(%wBZjVPhFmqJZ;r2dCGqxdFmyuBjEVJr!(&oGfVQ+m;Gk? z({9rxPkYXlJoB+k^2A>$`6=MV{YzrPd3k$Md62N7Y#W8$WZURNm}(n^4W(_VhiV(C zpXw7*C)Iw6do*t>AU?ZhfTun4CC{W6NuIF6o{*s~yQDvD7?wQsdPMTfZ=2+OIG-}{ zzm+`oy(oF=#W|$Zf%@i2p81$(@~3_Y*XH%`08u}EiC_&|U4woE;!!_+lHo7xc89?W z``l^p!X|QZo)2Cb5M(;DBu_isBYB*R`vPQ`=Ka#2`F%+8w2!!7K!)izOMf_xH4?xu z??00MKAhi>JoWmuF6qy7R!JTwqwfcQ=5M?7Xa06dp81PNo_21KJn^5DJn_3EPyF9Wp7!{?Ce21J}3NVfe)DEmq^|R|D}?rxzvq@?i|U}hVf4dxbei6&G^b- zrP!vTxa7W2dEaLzrCUla>%V$4zfVd0OvSVd6;`AWpQ`jNT7m5%`1Jy0wiovWsTCCl z4z+xUvQo@`UAc98@qie86Z9`5DBxsD*jZyhkbc1m)s#6S11do5ud)GKj;u@o99Z}M zIae@9*vMX=$iNUtWmCy&vHh2^W`(k0KO~c+3Zt@e|FH7V4$Fck%;Ng;Ei3V{%BB*0 z>eD|`+$;W_3P0gda;z`-mIgc546t5`0ls-VgH79dZCP7t@whk9P0)lG^pIP~B&56v z-}5AXCZZ}_s614<)$%n*UxhP=sv5F=>sr=SbC9w!A|`~Y%rhg#MYMh0y2OpV%tb4< zcgtJ3{XV&g*4i~(m!-dQ@w)Jt5tP1G>HjA9K;i>K=YAe-%|iWQwys@m7BJbhFBfr{ zxOMN9%it&v^|8^~)vU6jB{F@*#X3@4vW?pbsR*oprQ0{f-SHX>Iqa`ja^Dp`_lnB{ zI}XBhSmWtuT0kZ)d*9~!cCIboYzkM|9Z*E+8V?j7iuG$lQJ?w(6riloGE5;UGhNnO zt#D%?Uiq6e14`?$Gu%ciy4`j*L&+HR}dlHkWZuZ(Sq5<*yZ#%(HLGo%Cu zWzckrjRX4ytS@K7liR{)bu^iEY{(S`)7)tHow! zecx~N`w~r=^?%{xGTh!Vt4;JFc&jIQ&^P-r{1l-JB505eeF$(a>1JQWOzbz1PT;W0 zu|K6q$@Rd4d_V>~guZkIcn&GDPs1?wKc2#2##;k7-|;9?crEZS<9!OeXW&OXrwk+B z&)_iQMc`onP?5spddOzHr_uRi|B84t55tJpVZn<6ZxQ?zDZF+IUJvltKP28D914%m zjb{DM!ohSEDLg)Fk`KrL$7rKpOg#3h72b#7&3GEh@vMx)lfrvn@&S5+rU36woQXFW zhr*kT!ZG7<409F26)C(MAV)qR10ult4S3>VC?$?({l2US@%WBdkz%dimu*7-n$LU0 zOT$4qmIt4q%=+y@VX^OWSoHT z#Tb(bZkg~7oyM9N)%`oC!1ICQk1U$YY zS426|7r>AY&;e=!p1OWfb>ev6u;8si<;)W?j30$pZNa;9OrL%*WgKs#1uqIbzOz@P z@YY)JUIpH12+@9i9F${z55V^3{HifW1PM}j^^hYUFub)VuI(8 zB89icf;S2e(aL^+j^q8sg7+92zk$k^`=XfjdmVVIfW!QbGvW1E@LmTV=SV10`u)^` zmjjT;AVfS44N#8uJAt@n`~3nJ_gwfZQg}TOA|H?eubS|#ho8cG(t?+nZj5QlXhM#B zvjuNMwlP*m{U+j2csniaeG?iB>a9rWx82g-KY~oE_T@$hE4<|vydMH@p!Vf13*HZb zHwHM=kI(K3?}9DSey4#q(EaTL$T3a;2kCX-F(1U6j6>o5y9Mto@D?Ck5#>m4TJYWi zUJm?;$KhRt_axdomaiOM)23u#T#z1;$nsb%(}a&^!TNymwJTVxtz;LCi_o?Gq}dwG8D?`x+`pFGJY=*r*MdSDZh zab0HP9g3lyb*`%+)%QCsB)(m7yyMo^jo2iI1JH@Kb?jze+|pbI{`KHkxKM~U7Mb6^s_QwqBv?5%T@ zx?RIKPZ5b;HzF}n&h4FXATQbD!PjtQm}H%)_4xbd7Gkb2l!F@zb*E`alamg`r?ac- z?%26ucXB*ZLDdlD8z9uZ(rA)ZrSW_3Qx%@+PKlmL|9A`&}rwj4m-}6^K|lur!%7Nl%ycELNiL8FS(H z2QNkP>mG`xHAXg8APma6#b-06$@`!D6dtoYC?KI%<6n1Hw{38}*V|_Z)W22->PS~i zejO2fQ#-Bqq#-}DnEI@ErMldQYH+acZd(>DJO~yp3&9@lcU;=o5w=3VW|~$EzlF&g z_AQB}vUoWU+2a;fz0{o#4=j0q!i`U+9hhnDEx_j^6r-8BZNn&!_*Q|_UMD8+@3QSI zH|FEg3Wi@8lafb?dMB*A>*J@gZQaYYo#D3Z(dUFhyaxEO)?$7FmkMp$3ya-Tv0(9sh71yMQkC;qU@z6 za>BPsLTKjMM4_yY_$gFsyGwowC4_$e+eD#Le~Fjid!AB$RwcxC{yITyRrrpb6|UvI z{Higb6_eM%87(}<`?W~b*8Gl`Xb;tF@}Nuaf{$^Xy-jPEqV1%}F;R1kdE;Zv4?^++ zn}!S~)#i4@($T~~9v^GTx}IeV$2?ehQV++{eUalkdzyQD4-1*MZSUDHvgMSQ^Np5! zE}^a0_q5oAQk#)dTABDp69$thy=%wC(9V4@){RJFDwyVD$L0m}xNeM*Y+RQ#p$jxk z(8A9POUyAJa5i;v-~4mSbZQx5n!jzCxo(O&(8TtH__y?*yKag;VCdgsZO6pt>;7vy zvR_VOKaX>_&BV1H%{0(l>|WV{!XpFXr-zNA?ARvhiKV*?# zDrHlU4(BGDk`wqo8O{^qFSW!UYl^_|$E2I@ak-YG-ID$Yi+&$KP7&k(ALYQA?%zv1 zJ`-?l#zU6yJc~ZxvAA!y=*PJ^q0Tq;eg$y2Xq zCC@bf)x^_ {jHOWubwNzI=imRc8)H8Mk%$<30NPED;RDdc54Dr_S2B5WdUC2S%u zM`06L)rC!{42UvneZpyyCpNETwLalW$rJnUCC_+INS@e7B~NUUj`22<&{JMg7|Idr z5YnG=@ihs-U$%T@9z|Yc9z|YczC>OI6H(4T@CjDqN!5)p$y4`k$a!nbA9<+{<8o|`B+3^*Oo!E!{!9l$5Q3-d z1j#d3mu8KAgoh0)J7p)GL?1mrLT|AMXu~Nf5@|2Gd(T6#?(A49SG| z{pvm3XG^Kqp#}h6UJi&6PoYmh!BSfzvY018y!cxtzMxuLv1N1lKwc|Xo4myfMgwNR zm-T%2mGIKt6alXuHYu4Vktz=yZ-d`*A_*TupE$;UkJT8-HzX9GTUs+Pv zv7Z=B@_Epdn2N7nlJZR+&`WlzU0C|(PwaoAg4KnXkV7e~4(dZZ)xMhXmcpO?T}3Kg#v>n)0jq#l0iOQs1}eO7gE!-?frD+jB8B%Y zc$o1{1CQ-G@!T?u`fbNy#@htP0{AIXcw69M#ye-iV;6;C#QQeloAG!b=RHJ`!s9$? zGhPxR-w7e=2k1B+^)ci90uJ`?6)C*+7QA~*c)Tww{WzE1jQ2X+1KIC=_?z{68hFZn zsA6%vUs>=tZ(iPtg^EhQUs&*ZOnAKQEB($uIkSGOOj87s@uTqGvgG$2;O&J7?T1$p zaXh|LG~-PH9-n6vDLj@F`G5@A0;9bOo_OpoD*a9)z8P-i;DifahJ?$Fg&8%Mq@I+rl0xG35{oB=muJCy26(d&PCRxe6<&u0?{(mfLAWA?*KWZ(2RwCs@G(Q-eanLP z7vQZ?U{a3GS_|G>RN_tWr+$7M3hy>Bw4ZtpwbX6AFNK#NhVkHhU!G|*k_Q)&Ib9`} zCd=25!uuif#RgBxk?x0_`8^cdaT4_-DY-e&4_S#5@%Bm^sOu;dq3Xt`UPKvdxEgPo z4Bq&iHf4(NoRl+3id^|U)ThvuWL%fo7-=!In&RbZI8Stwbkuhe ziiga0Tg+DVaN%;#KnB(F)BrzJt7gQAWoiW4I{v1QDQX3Me9TLU<1UJOHTB;K# zw=qoY=&HbNYeVI0Ht#_9+R_V6Tqb{j&bOG6XZWk0pGw*kG;pd=Y2|7$HP4vXH!zI4 z8aV@X0PzH91I^OcR{A6at_f`m#f?NwSFYQB-)b2%Ay8?^V5Q3qkVJ=jTc{Z4%2J;H z8?*y;Nj3u_RypcQjj4VqmS-NaIwai78Bx`XObA)!RG3+AD1_)ApeN{KxOx9&--P-w zjP6S~%y@Zlo3B8H{R#Zdcn;)4;hFoL5ewb|84o8x3hzO<%y_9LJYF6QBmNc~X8jhy zEt`CBh8)lLN#k9nhhIXFm<;8-I#d8Q0$1rBrnfNQ(sU!==$CHDXr`YRH6@ME~DFD#22bMqz{y#aHdz|1H1 z4|1pEO8G1I5AKwOqWT9zkUH+?-nDwzuGKrVs@j}zfi`mT$hjl4Qtk?V{Sxl<2oKw| zdYfL=kXAL`r}_eu3bdR^ez-uVM}kbPuij?U8q!*9_Nq30Z==tM1sM@%d$_=!Q}sc( z!1lT06VcIPb5^yb0j|a7(%RBGZ0@Rm(wlzZ+dI?8x3AP;Nr9uFKwA_+67EGz!nKGh zIs^2v2SlO)rS#vR+oAMz}Nn-s>9Sc8PTp zC^AC0-QqiPy5|UYlJ-M7KsVxGzvQ#;<`tXqt;%QKqSYO0<@RkQn+CW|S$YTCx8Ylu z(5900_u)&J?HG*Aon~kdzc+HA<_aQP`k_plaz&JWBK=V&V-J{w+k1aqAoBTX5kys+ z$5=jG?32{R54U1@=5eL_F53dDoP3Rg5TiZg`9U0JxjW$==zg%uBFFm%>y;waj&jd) zGhPJ*Sl<*Wxj(|gEcY1PtcQw}+{^GV%XPxd`l(3CJqZu9+^2A}-YQaZ*7lpr3loD<)& zS3bOn2HfBi+wW;P(~Jkb&#{k3kt|r%evg;hq3v7n4a~3*>)nbLTC~aDdU|t?iF~~4 z?d`qlQyfrJ5Zi4u{C3f{qm{*bX|&sR)o$1N_VxB+t@T=4*zTyeJ9!77luJmtW$PZ7 zN)OwUTI_?+N>|nSTI|VerR^z3D-9n4WrgjY7W-f&GDL`6l^`-HY)`GXr>V5kMOs7S zY1I~l?HTpTFA3W->+M&o@DU<>WM6o3*gmS>K3au;L4<#?FTA{^%ja>A zS^&EpbHi>eT~kJJy-%>^#c7F?d|*HCU)z;z}`e&wNJ``u% zAaH&pT%6WD3{yCteI~H+r-5hkJ)>1&c|NXsA$3<$)kCRu>w>#%SY#6MIJM7{gh-x| zLJkw)QsA{}?(q+w`R5Z3@2gr@aoWZoF^n1-59rg*Xv@-~llF%58_KZOMniNS|9w|Hn+P=nm?MRwi3q37+i^F!=N z?e%~6!RM7X8&5p$e);`3W+Am1p%d<>X6q-CS`VLozo|WZ`pkKM>g&DX)6KrO!*8x^ zo7(up`XP?4Al)(HUQIhS#9j5ae*ADWuN_0puJNMzB9mZCGK{HcM3EpOZMnthX7X3lMU zVtLy__kmgZ!lVn0*?T^Y`3|+TH5_f=wiy8KfJ!%oJ5TmBKmC08=ug}3X+7L@DBSk_ z#tR!C=}g;@fArbLdwu)EjsI}W-H`v$3~2DU`>C6eJ7_Qy8XU=OcV{5i78KWh8Ie5C%;RHQz?t>|!GEbyb2qiq-38XH^pG(8DLT65cuMBjhC zA>4Yh%b(ixYPfY@Q%kt*p2kO8&oq56+;%YVVfey@qd!^bK9c*3yLdUM-PUwX#CglB?`=yyi zSxgpXf$U#Q>N#2T{_z)DiuO%H0nBO1E6bTA%>N3q+Y@{J)s|P&&Ls-ftJT}cU z%zM^W-aVzRW=W9-_sD4dx-`#)s#lITKIP#Y>Gh`LQqkS^R8x8WmZnut&reNx z?)cAA1F!lj3U@wMaet*=v~EMNevY=cVte@<``#@dl+Us4t;jE*qwjXUGy_;wb*bmR zlZqyLTmi%Dmvz^dRqfF zJDKAVv91!ahE$=yJ!i1lfa>0Z_DaVD_XX9QONb4l-*IZZSGmO+xT0;7O{m~Ib=Xge z$q`8j^f^w`VqAya;o<7Wwfn+N57h1VXU?noq5^-xn!(xh1S+jg;)(Qydm*BxoM_vF6g;_f)! z;d-kd+45ur!l@oxFzK%@7xsgNBRegacOg4%^toN>Yck7JdvB33JgC2k7p67jAwjYP> z*iU)@N2_aeENAhw?yl>48O&nd6mvTgJF^3awI zC98dfo6EPC`j)KSim|=b8+^C&8(e_=zenTl+!5O9D=shDgy)F~zR-PZeA_mx^=-wt z;D$=yw$1mi-I_eNWQ}iqW%*hWy1t~ec+*;6$$dg@N2qx1%;fw{n|!4urCTd~JJv#s z0L7cjH?L>x3CZ~qvvhOmT3>l++lH;a&D*yj$Hi-J_*;x}Yg&t`!#U76x7pnN=Xr9} zsE;_0lVfzGui`<)mN4qZXBYD*9Nig)u>7^hM>Gr%JKmlim0E>EG9Je>Y3B32EM;+wS@sy>$JLI}h=@{jISmNI-!bfOLCII4( zvA7FldhJ5~3&N#KvvX`MVVqz3)0P=1Ka#MkdETLv@gq#lU%XZFd_Eb4^y$xdeCI%( zV`QX+d604dkmD0-Z|0ejCr+`6|2vZm*!Y}I%Bgo2V=2Q#K{wz?n0F|37V?=w#K@O? zn52HXoHr@vw4rNCVl=g8CoM;wNn9uSc)sM*j=&#{K#;H-3j`$aW!0ybng>aIeH0~( zu{@oX21GA4x6(%*_>>(Z`7E5XB~M+bF6RX@O(sL0X)>#7ej(K&PaMW4&+zLd&oqVI z;Lmg>OMm8Rw&Zcr{z39SoWC!5>XI_Vqt^4e{07tVreoUZ`7*Ce1`v$D9_m}qLcJJK z&%?%?vnxOv^U~Iq8q2*HGjDhkf1M7y1hLN=jhF<8CS6yn5}{t!kkW zks#mFtQ2#?tRrHdkwv*(^c9p)QV9!kSoVXCkF*UiJ*uB&FpOl5;kiF~y+Flt};WkD&TQW$7lQBJ~&mkiP~6j;4=TVC9Omu9&)=cnB`O$!xdj6`2amhXb{*Y@LHul zl%xAz9A>;cxZ{I2;1%9F$p>&Ic}#fbcV(QHY{n~stioVC#a{x06x&b|60 z@YqLFr1Z1Sz4D>(RXt#LMB&Wk9{D8_m;FD$F@mM6s}o6rp2Q}o*^zM7jgl~^F$fazeqfF zZEu4d{^P`S>AqdcDZE|q^u?w6@QzvJ9)sMa0pwP|k2ej^ zaQ_5u9>CGyuEO!a^El(sAXCKy>1c32a0o{Sjvv7fhxQDPAA^UV26yk%I3I=^hX%hY z$XCIy_q#aS;rEYlNm=N`q70n`0G>C@e)xmvXFp{{Y+E5e5! z9*0lHm%(`u(F?z-g}cf}jjuUkD{SDruf36`NKzBFuVZ36jWnurWEzF{sWeJt8r2)5 zPvJVvRST@K6H17+$c&YBs1iHn8G4VCP~9t4#Cs&uE%uv&-i1rFLcue8*Gl>7yOn&N zVA2mVx9Q*OzE=u#-ysFCr>T*D*9ztH@4c>KDOP>E^ej~AR=?3Jb!R-#?AKg_ljUI)3?sK5=HQ4lrh<3-+QK&9}Z zLkxPdH+<-LP5J|c*&^@h+|M3x*l{-N(7l8!5&G7ouMmpt$~ttv^jI(QesAG^nN8Ot z2D7YtpY*Bzdy${?*{(EYlW!P7Q?m}0N*Hc>R#QJF>(C~qwl%?bNY+t`-UtG@!l45}HL6mCha`L@eDMe{6y5GKERPT>gSD8`YF zqX0)1i^T5JwBBpb?->Ig2OrKI@YCU^^9F&=8S?Wm*1_0`wxVYIwe_d}_eQH zA^cB_{rQlwzfKX^cDn4^x<3!{R8&2PA?Iy^YHoNa62{Z16Ye zFb5V?fo!`|sy5F}_@pBu}M!iZeJ6_@7efLlgdL@z6@Ex8O zuW0{9aFbVT-HpaL;;qL;d&Jf~5sSQ3>OK2At51o{i>wFVb!^a=h&^H3xeg3Ljpbk5 z@3}A1r<9v@d)Hy*7h=K#2FF_?$_a#4-SBSJ;qA3yXKQGTEmnoB*l!k9z;JmR9dVS> zWaC;eK)l7+FO&GkY`d|{l1SEjKi-m6pXuE|ESVTy-nhEo>aBcm{MI;<$JPCBy@vTN zJ%BT>g#hY&5+02P;TVd;hQp47f5xj9KBC*TD#)3-ov0g3%h=Qr^@66Zuon-fZ&h_F zD&v8ullIu!6kmY zGqr3?DD1pjx_fkQ+ouyf#+3tGvh7gqh^Wh{aQkpb!gU)?*Pz4RXe#r2b(V?uk~j3p zOcr`N#69-bXK^-e@9|b+{`Ujj$HktU;u4-`UZ6^)#l2N^RAXmHYz&sjVOhP+D-~r` zjIt7#8}?gCj1F$~~23oz*@24RQN>4q2~T_d!NP-r?;sb`3>d<85U=5|wpH z zLQ%G*vZai#AtTZcC@qZhG}z=$-Qy~uO+-wKJu3Evhl}!wqy~FL{WjV*^mh$Ii5gEo zY@S=zS<`bM(NMdSVJLYgSU>zATVXsgd@)fA%+;0GpxGa77}m3~jSr1qJTG^=)B6OI zzqNCa>}NrPj#y?_EQ9voMUM^V>ujfMyzki`cGqX>4f$uI^|4gmWX|`9yt(8ZrXu8h z(~d%)&c;VnZcmDA{{e%Ip}mhgKKyusXkr@Dj&WP$gEiRvIoTaeYdCN^(*3*M@NnH5 zwMFx5t{#u8r0~67WAA9Re#Rss=<>=Zks5CV<+;83x4n3$emC!RHAkFKzwiv(H1Td+ zs6FDN$hcZ3^Fc#;kA8$ze4G`b!e92{?!G%Ixc-CgU-d?FyWdQ((x+N)ui0*w5Q;Wv zMw-XD%#oM1f$z?t5byt3aL%nSwCANMTkS^fH5LYLL$x|ur}9IU-jB7`EU{BEl}Nr+ zt!dZyc0r*?Ln|0eV)F=pB5gbhZkR!HB8G|Jf!HB&cnHkb0in@;OyGL z{GPiyV{oRu?1vN8-1~?Y$wg;0lJ6}V67eGoku-0%=G{3sGWB3An%{6Z+FVteTH6ej zI%0t?WqGETlI2g0ricA$t(kipb8yc>mpZ!V!%tG9VediofwmX&Np5F%77T{S8HRlk zv&CKPPmNT2TkR0)9;xL;mqu`9%Jt3AvEAsLQIGjL%zXwqO-v##0 z7LWNVeV$QgcVodv#{$nOajl5P4kdgF#eZ)^zcqTT*WvIa)yEtycCBNO*7SoMOhU!C z4Gk%CgHK#SM-;7w_cWHgb1abaJCP_9m+dADhGb2l?35b{#O;kdPz*M%3L7RBo2d(H zB-}6i9>U^rWgbj%?>YrlhMYHYqb!OXoi}o{K03}j7AvwbM^00Y?m~{%1)r2T3T9%K znMrF}4)-=gagk;|$~ck?d-B?|doyv1V)+}FvNubIU*{!O8~Px7cH?v*7H zJuB1&!}|Z8af|aFup#|OJg>zCj*^6&#(N^DCW_ykT>V#hXJOtsti%gSTpKFyGT#UX zeybhV&_kkItmJSF-Or@O!;HLk`s>a7_c8sYXK=H< z-{ml_&SUns*@EHb{gh*#6Kk9nIJ{GIPg0Fnk2veTSM|d237mfnk%-OXYZh*s4^T=4Ug?1-LZ0)XKk-q-GL|2N|a%e~O zAeO&qJ?<5fP^Mo&tRF5@Hqr`dkyvf6C$kny=|*yEMSI)-iqy2vsDo%*mMxx_zrtSN z9~JhG_Sh%o-!?tdTmu&fZG`=Bg%-O?ay$G(vtnapUmt41o}skjP-<7~Hp)6hj~cRJ zdsx4%<~elS?nfT${X==fh~{#6*m1ooDkuUJNweeC!)?D;*x^ zlKk5+v2gk@JG$ zGdY*}mkBey8_QU5mB>}RzRI>VzvjTTUN;t(%&5mrF-gN6chNH6$aNzlDLaBsUEFvP^6tr%6#@4P zbjL6D5|=QZm4Jv0RksLO_{>V8y)Sa0vbq|=K# zVt1;xd}4Boe^{y08`d6oMeGnGBKbgcW=kwb^uv#_(ZJ^kp^VzHaA;`H zqn%&(uC`Skj^x)iFU?)HZ<#;R3=17*9nOJL-5k8CB&f@yU0&?;; z>rrPUe~Eus<5PQk;#HiwGWGQs!tX}QTKyvW`y5-javeM2GU`~d-~WHPdl&Gks%vd{ zt(_}jgF9inNg(JB0*0%AC_$kO2muwVSdD1)Kmq}x34{;?yfs9d?4X_kQb|zSB-#?J zmWx(`mzJPHyl@Us+oDHL!Cut1o~pGftu+7pjycxO+ABNg>GOTh|3CkPmHEy&#~gFa zG4GeP_EA(YtetdYWMng|SHD`VUfHa34T;bD4+Jc49ow?zd4E?Gvef@{W==9Fqnk|99u%`m46aCzpIrvI*j%;5f$l|W>2D}+DeCp~sr8yY<$JO;qLS5m&i(i(*vVJ;b zmVtNf)WTa&P)zJDL7-x6f&uT90;!`kIcm%<-W%jq{3q&zhLyxF2R>J~Sc@wNo;(bIkh6 zIhGvOI1?>zTj%@|-|6kv)}#A7x;Kv8#Lr)mv&ZvHAabOk9c6Lwp>tbyVDm1p3qN%_ zp!Y6pZ4XEy-ZHx}+Q~rY*bYY+w|^KmvgIdEoGn9Q=)N>l$dlByp7MgSz^w%smRCMO zm$@*<-k&q{XwHz`Im7&E+k3Mq-W_;n#~SILleu}&chHCL7rn9k<+Xb^T-v;S*Y)kY z+spPhn~BQXIydDO=oJZra|U9a4vkhf2Aa`!vwU@p#pBy&nN5NO8E5D2y1Hn<)kRrt zH60r<3}ao3TKEyh)f15o^+)QbMo!d^i+og{gJoNNdQDEcnI)in-fRB6U2CJxeMYBU z*S~Hw=6F(u2+J*UPp7$#kr3D7MfPf26CwjX{XBuI281IXr_xeSpcl8Uy3}O-t9okb zK~K6F8VPJ}_`jne>A$F<`{QcJ=w>)y&lY3cx#9-S9ghIVj=M*mi1rXr1+iXv4BqSD z4*{$y{Jc+%FV&ybn1hYq!r^^3?y%NxV&&L8Lgo-z=KybO>|2{GbBL@UomqW1KCWb_ zL&>>V08D7d@c_n{=+a_y;_4&Zv6MZl%?)`i?Sbt)?$GtJKVee)q+OH7AKTnfS30iL ztQFeQbyxRJ{DMPyQsFAAfV0>&b8{f0EIv{(yT^i_eFE!6a;dKX3;N_KDXmA~39ryP zymPO#n9X5kjSa>@A2#Hy=h`K;1$%^Mnc>W-obiwS2ggI`jrxRcO;ZbH_>cz-!<#dE zGw+#6>@XU>#;MQU0jvR8P0<)Rx^b@b7ipO9AMlw8)NygXS@XEFb&&ZV;KixFKl=p6 z1^>I5c6rLtpIC=~5%|cmJ{x2oN}2y!I8&h6#v`t?WKJ~`zaHy?CFuEp@W0UayX)NSLUZ6dVCb}==o)0Th{*~e9kX#)+>z6wF_DI!(Z+&8-r%rxZ!S-UcebTwhI!RDceVffM7=ymld51luQ~jO#M8G2Ioa zaLvqAv;Ct4+}Clst^ZXyqRb^8Y}qk#+0y&N{grHHjB(@cpO|yQM9KX0{6raZ!#FSc zXXiauKHQynGWI1}0X%kfBJU(v{ea^b-D}|nOEWiE_P3y3h1zV?dTBIJ8}~gDH#U7C zJ3NWW7s(#tJ!ZoTyQ^{<674dt4ufqoI;Qz%QkE3qR2Yu{D^3W+I`X@ogMVWcUzNE!wL#DTtow~RUdoy}^im?>*1%b1c=*4;}EDZAzdDQkQOKJ7$?oTIsKBh9XM%sEl` zf7k9WoNB+FP?M8e-;QmqqO+05>ibPozWw^<(p|gT?{KEwH}!$oqtl9W&Musm+`mj6|B>t}FoQl79D^_=y7b^9bO=ajmw*ZBV{ImL=?+k2b+mp+jq$Del` z_^5LaR-!v@t^G^q8_Q3w9gg1;DnquONZMNz&A|A-=Wh6X?Gq`-mgg0Hkd$m&@3faq zIb-++UO|~wlpbluy7m4u8g|`u#_IOZvJxV@E{fEDG*ufxSazXD0~#Z z#KT=mJ-p*SPCD|wu^(r~O?z3A?VX*clHT@h+uCpa+^PP%j{iPj_09kA_=bZI`9eQQ zI{1+E)_bM5#$B!F%@TWNJNoHCQxW&zpo@tIUa)Pe?LP*7+p;pZrWPbY0O&|g6_(6F z50N}N5&g`|&8!!AC4ckJ`_Gz+y1qW96K`zZ{PlM`9%#F}6c;C!%qcA@joBf^Powg; zt+;tWEl4hL>#e_iMM~kLCkx)CrmIEQykjG#^V|ErVdmj0SPwEV%rU zQ%QAa_l6VQBW4b@S^T?b$9(P^7Z(L9i~2>@ViFeFfRcR;7-&RVTn73 zOWdhk;*P`q2v@xQxZ(|RPlkJcZzsIB3({eK`5o&}O6Xx6OG3uhBk*gYP7d2=Oz5Sziq*jJ%0<4Foc>oewca=yBY zRSws-*x8;fbK}B}gqoC~|0G7#!psD;#Pqs;{ZNl_F68F~8SAo7*Se%?z3%V_A0Xi3vv&unI*p#M}o) z8FpGd^f^uuM%S*P4$Pf`*;zI%2mSe(oJzs5YKc*m;b zO!*s-)p|oFh~!R;5ZV5NtDZ_K-f^o;EqT%?)8O*7!VspG=H&4ZOAzOdi+Jv6%2eiF zPMOldOKH+?{iNVe(5sBq2@-J)&JJs3PIpX2rmpGJ18^Z zJ&7V`jv#L6gDYCtn3d@${y25ZR5VmU%8VOFFP{8#^*bn}MUTFPyx|s3dK7zMWWSsbef01#IQMzu#LHl6Bjc}*oLxF|(nPYBdHc+u5u^thM5m3YB}jTv))dCU6)Q{B zi`$ou8Y2^Dwow%9gXKr|)ld9i$wOH#H8sBnSx%*VkSu-98OT?v$dqMd3T4Uq!zELe zqo>G32vnHqi_Dyvmrbc=MvGB9ozUs^M7ipXT;}3rS0SNIy`6L@@%eNt)7E4+TEJhF$IZovnD~V@=^7Pqxk|+;TGc zudGIHgF5sGB4(8Y(!J5rWgr~?o~L~^ucD! z`4k%hZpmFxPHBw3-B!s>l>!}FWdZ#59fsbOuozzY0hqBE67Y}orWSrN;QLX zLk%f4O-<`sjK`g6T#r9mQ=D7l`=PV{^}~WQt=8f>;Ec=mmB*9eIG%+2_j321&Kf#f z=-f?b3!VEzX}-3jbnb`qK%(jS(r}?^RB!mAKfrQqcgs$!A#rnyOEt+8FPROlmrZ$T zq{z7OZ-DgwHhquPp|VMl%3Akj*tE*-B6?WCK0=EiotjDneo z_xHli1Ih@u+>mBy&6I|r&A97VlreMfknu(77@3C--m!eOY+kYwu1Oj-5T|5^5;2pL zg3R9@4n3BX-?*=FXjhpaCW@tC8KxL4mWP_NAKup(xb&mY$%Nvj&iM_2-5saqzZ&@T zxncX8^vuiZoxgA22LGVLuLVM1SnWItYijGAJPU&__16r%@A~3q-I8D z#q@ol2}3Yr#_N?0&6MxoE&L+ujLd-u<^FYRd)wNM{)vEbp|!NS33`?H@&z$e{|bNpG66Sv_reZ0PQ729b-8|U1k)0Py4 ze1A(`Ztm0jYAdXkmjVcnjv5DUMtciAHDLI-rU+MV2*ajY{gIlNR%5dNQl3n-P#V?M z8|rsW!kv=R_L?N@f@k7W=S{7@dq^5B^Yqh(GJ2#T&6vggZH- zQ|2B=d= zuR96n(e~NMD?RI{BB?vmu#}mYiEWqC!s|Xewz8vyQH*GXGx2-8?)ZO;NqO-nF)6S5 ztKr@@=TJh#us+bynOjs{xu9Wfb^X4E6X@0&=B(R`JmxLOo*Fw`=(HlTuVzM|V(`A( z&Y!e=cu`^T`?=%Tdz98@bmq>%CQIpeMrFM5eEJ#~smejr%?Mc%1X%Fff+_YV30y^nb>_aH#; z@Lj_bc}aa1ZwJo8*P;{sXI_OV#(U@?i3bJ4`3{q2tSqecC1 zzrXs)sk@6p8?&{~E8ejND!@rk!RtH_s@NVlVOj5P8IJeZP(MShDgItpH+5dO)pwxW z;%k0`d}fEVeG+mSy8L0UT4cvMXq7)`UVAhOTa(PtNSW z#g>iT!aoL!bIz-2pTE0fw!=~GSc9r?M87pTx7R{hl82j^2eh`wh9G+n2JZO0v54I| z??#WU9|xBBjGcVJ4&Snyiae$qN{TE;6zKlboaa;UqCu-w)7xqohe}*?IpjAv0@WNQ z_V+|5eF@p!0g6x7t=->&d)X3>Mn0u*?%$nw@}|r4X$-myKh$oRp}d(cJVR*%r=+aT zNzTTC^OdY-6_EoD^%bsIG3H=B_PIdirymi%r-%fj@E_5of zbaPGnjWtD?_4daHhafUyqKn7dh>{1iwT(Ib>l(+vTXItP2VZM@WJEpnW^!4}m3v}s z5)vrI&JZ$zNe`NollRr_J-m^^&ZK3>gR652c6UxmDR`=rC(i{>b8gDH4jw{&L4or_ z%wIa|(RKB5<}w%RI&K!4KITb~r}_a*Uzl!P7T0e$scq(XwJmEvU1Ki8^}0ECld7L& z`=}epzfYL%u5i3HNnX;#lHIJFDadD-wF6{$a}lEsu6?ekSowf5Exd(WcJBzYT1B;nd;Az^8j}Z$@5w$+Tr4 zF35x)ONQJ{jZL%g7I0bU#V_8-d716&{q*X)!o~bq@%_#7F`dRT4zlCL#N({WczYp& z@sIg|yLDXQDlVy+W$y8vCw)^6al?5St~)-vGwsvdGiy_=>`9xyZ~OZ<%}lR*VB@I7 zO9z`11)=e0-I-Q5=`WF->ghEHoQ;3zU4HGJrxm<2h}7i##XUcjcaHgy4$quk^w#~4 zPjr|BJ-Uor-_bH(YrTy(^ltLWT(r8*Y(H>bTD>Yz^F-&myHNo?ozwbtNL_vigUw|NU za>JVg;o21<*#ka&a-s62fXa7+6}fg8zG6^rMSi*N{>x_-l*zOUmlv;*H2V8$aUIg+ zoJ63eHm)Za@13Mt7&qf)%_87 z7>2x?tSioVKZhB<0BNK1_a8E6Hib3AFd63Dk~(}MVM?#(*&kvW`tcAf!DeJ_Ov0O< zJdnlGvN61I#sF5-kgwpo*2aUU@*4v!FAbcP^EBSny^q(&&`NghZNJHAO&?Fcq>T|5ASt zsj$XQ4ltjEA6s~hNMy#6$?prb_(;PJ39s(vY)!=OD|$D)8=KkGk}*C&Uq(FJkS_ zlo;qMK~|pD%8eX}Ew4A+ne3e2`s7PNxIc;my^ZbDYufX7;hyC8Mzy9j^opd`ek1BJI6#cx$7jo#$WA_oY&LS<`S> zwFaxe$!IWI>|-ahWq^y_o*J|0A)90_l;6sM#WCM34asTrvE>`;$4H-u^i+P6pW zjib6fy~pEhH^mw+`g_xpj_a2=6XAc#6K7 zgH}U{rQ9hj&Qd{Ky)jVJUeU}w_NmuTott{;xM_N?`3Y*@+>k8EZxC$Xt&zDd#?56> zzs}}+(sd7C_6A-{Ma1p)-f_Y+RG5rm4HIsSU!Hbrhf2R-YI26PWNJaW)i!SP5RSLlib@{LdQ{hV%T9dvYtnlBrbNeOa{6zKy$)APOE*(p$xn4+&48EJhniL%zq zY%f!e>KbxyzqjDmoe-h8BXHn70+r>4g5P)Ees6URze%P_n^Y|ylB3yt7Q^Q{MsjTKzW?+`8vPpMh?T?r*&j85>5)98Dmm76Hxb<&n+PuFkHnY1x0#ZbpS)adD`)SY97C3rn0s;|RmiP3v-#FY1VwDo=J+ zV#etV$X&VULZ!U?{=43!zbS#X)p zKfu2jiON8_y(RQ_o@-%af-q>S zy1OVdAgAGYRV(xe?zHM1Lu{3JDjry#GToKNkI6$3?^2v`GMV)-vwvxNxvMS~`g+0p zRPvH^*2dOA4OBkjc8tNHl_{nx`(Y2*{_B!^VYbSDB9=E#ppxwl^3|to3{KT(myx70b|rI;WnDHAg4Qyqa#OOm`_#i&*mHG z(axZF$0~f^A<{dNF|M<7V#EAdb3#w0MV5z_q}AI?SRLn}J|*KN=_IT06?`WHJ{|G} zr$5?&PRPx6S4iO&D?1lGKz1euoEqC-)A51n3UH{nIdAsvmX0~10lX*Q^}Q-A1Jc|0 zdmOFl%aLn*uVX6z6yZDzDk$(XMky4%;V@4JWT(W>8^9{q@vEb>f47oEz=QPY3Df57&cjT4i9#m4C9uk_4C z*T?AZYN!og=Zn!_Jl)v|I9*R!lU|dYit%_+?v0Vq2JXepi4-o%yE3w9QQl>^B7`qs z;L{5fgL5R*{b>pBrSERGr^)pq9{9)`k2j_5ZoZ0CT!(g1uR7D_1Ojt@$4|;L?)x0( z{XUMhyi1bMwHE2D$K9D~%i5PfHH4V9&!Tn+JT& z-wR*)+<9o=RfJ{ky> z`$3LRn3A?7a0H=v6MPh9+4*_^FM)+FOjFygDD(f!GoL@`32#Uo#^jPERsX-e@9zIqov+5y825Kk z=VxL^c$dX@d>`TZWG&{S!+X~a7*1Vn;l~14-vY0kC}_1&}O_QS7*%|!`(Ij6}aI*j#4 zTFepFzy9)9zODC&B>I@t%Pnd99tj-Wk~k&tK#jEr!VVm^7IVdi*wP?=-9YYa)(w<* z$nSAJp2w|_)P45^4mS7-R&s7xy(v)r2v?tVTP~_=oCp9XKL5uLES8Z^J{s3Qb~Xl3 zmv=rFsD2@k|5hM0C3*crEAWec*z2vH6h2Ul?TlS~A9&`T#_7$da}NYiZMQY%wd3l? zlL7c_+nB_^1N*mZv(TGP9Mpn3GkKYo0J|LhO{ClLCX zZx?Ft^SpTCXJ@eUsI=3&j-#EP#di9$<`Xy{9u)NV#(ahh2fFHQ)9ZoIP1fOkf5YzQ zzSjc>2c6fBqTf0LfA_s8Nxl^?Nd_Nk>hPQGvVBOhgIC^PW0KkV)_*iZNG9pmB+*p- zY%1AJucbo-oF?V}GY~r4-goZ`E0W%XYbEvJ!+GI?G^=o_efaf2;q&-~y@L-8wC-i# z`n)js?3wIKzN^!pc;JrCgU{OjgwfcglD5Wnks$5CLjRu*7xql7Fdo+!Koq%BbYnj4Xbs{O!6UL@<`OD1H;jW z4%_qaz$RP_yX!bk7S7^~;``L#@jnJW!jaTjk75^Xx&@vP$=oe_Y;Shjo{Qd{-K$+M z9W~)ys8^B`tx;(QeAeW&THDIL3<{r}wlxiMAwArLTZ@hEXZ)Y<$s3xT>WuzgzS2JU@5pD6bSuD{x! ziBA?pG8W|xjioCNz3Fq&Rr+VuXGHf|D1}d1m`OM@51>k&NCEeq(TG=uwq` zGr8@9L+iMQt2eAJ9q-R`amIm%d}Fe6MM>qYC6x=xN=uejaS&r6IJOO(f`>LYQ362} zUUqnFes);w0Q~s70el?8-+u_>8H*<$kK+au$_#N!_1ap!p4Lp|={9`|T# zG=GEx=4#}`XZ@K)88r#`C2AiF7^V+Gd@;XFO?h0(0!@N-fzUdC60AuM6gxqFwX4f3 z0UP4K)hs*-Z=W^O`j!4T{IA4)c^5HIf;GeAp6PL4>T!GHUtyJMdPgO{AA9mU#}ofr zkNbL$`zDXO$m1^YxJy0ma*unt$Gy_}J{ttg&+z!H+XXv+@Ld_Jf)hL4WF@Ut>Sdh6FPi4=#%N=ISl6I&s6xWfHo@zth9- z+aCAb9(SGn^TCE8M;6RJJ>mCy+~4)Mz4Q-w!Z&-|4|&{P{r%Z*-xrX0xaUb`@Kjv}2>2bg1asRi+?d5mE{zFW9zxU94-GA_e|Iy?2 z&fosW6aJyc?VbO8;tBW8CqDOt|J~#M!sGs@$L(!DK2P~2dfeUS*PifHkK0=x(mdh4 zeNPNC<;!U=e;awG{*LgwpyY2OAJq=%F$wQu&C>GW%qRoDLYd@rP;dwEH1Q7%yQK{5 zPVhI`9K)c?HJs5htp5BMVAL?^#~$~|GfeQkurjQH);3L_zN9~E43RN(zo(el%COG1 zE_R*eGW@5?&&YR*T@o=blGo z4Bfx-xMz6EC&!~N-w-FZ;kV4IUsnqt|I5_v`?pobXVX$g)o0$*>->`e=Ki7#aBG>=#Be)EMUPW0j9SbiaHyk!2ml zlVRa|RZ4H_$B(UIPyFE&RE_A%BhR;$-@Ty8u%5IAD!q|skG04{pYCzzY5Z!5|EyK0 z;YOaHTRZw_;;@*0QeWdf0xQFM!8)dH`Z9cswy#$u{8j5Q4h%4C1{rwatTV>_3#&H^ z9wr4(hV@IULDyf#{VRMFP=e(T`47|fL=U=uqv5B3GpskP+eR?N7=}Nk{OCjX-!%L_ z;0)`y)u8<7onigX`i-Z4-_{EOY8d}IO)p8>`+L@LPyLzVNv}xLn}fI+)}O79m7huP zL+c9FN0NkpZ2dMS|9`cX#<)MR9@O+XEM!=Jvwo!fjr&vU$}|MP824vZS`7W?R^J%< zlhzMa9z&1cW6Lt}O?y0L{l(K>|5L+BMSZ-^h-&B_uIo_~KgphvV*o78-Ouiuy=(u5EjGFQu)}7GpuyGO6iw~`%K$E5X%MfE2|6_IE0i0o7Vej{pN7^Vu8Q_w`Cn_Vf!-WL z{_W~s1)O1BZx?BO_=UJ{vcIduroPRyOVw@qule>%D*rz*kI1kV*l(sQ0W9(#pz_m~ z?%(l`8p3Iw`PgAk_(2{2KM?-6*x5SX%|l#_m-Zl?UvXNTVXd+U>U`$k#J$#@LB*>f z>-Tj&GaWd?`i|YK^6nLPy**aljpDxF#_isyVSGEsI8A!rv;UeH4VL_cV&-Fw_N=a8 z3IBzM{vvivFh@`h8CJ9Xh({kIJ@u(d-D43a!}_7U-y`2Mp7;aQeVx#6x9h_IFzgmH ztRLIEwf>s=`4fBEXbF~`{0wWSeL>i`4gD_rC^HUY=%2FZg~h4-p0<~0e`dn>+HJ#4 zIMtS6J!=ow_Hcu^_uJ!iJzFX6pV`0F{*|$)@4Hk#EfRjfeq8CD@H&-esf52`57P9F z`#?;(12%G%~~6zsn$ZiD@W;^$y_fg>Oibnx+ zmx=ykfuB`80hqf-^v?t4&JVF4_*aTEfq$bo8~AM09nu7Vhbj&N=PUjMxIppez}G8| z0MAo=AMnkJ_W@TZei3+$;%k6w6wd{|SMgiGn-m`h-m16)_(zJXfOjcw1>U3habWi4 zlz%etA;tN?G&b7#G58@^@H@b%iXR82UPwcK=AZZ)VCLWPr@n|w;7@%y{$a)Y;XlOX zpR1T--6)qo%ZYL6Kf&dn=kjMB9RB$(|LHFOSuX$CikZi&Tr|`*`Ou%bc6i?C@}KYW zU+D5*;_@$ZVU~x(hvnhm)h>L83s<}FJuVz^;rkR*x9eU0n-o)54KDwO6<-PZCYS%C zidhz|E}F*`lg~~Ue#(X06tfOI=knj@@_$h=?>96|&!NvHK4|C)I*E~1~ujbA?f-8x|-gUP}Z1g0L&R!lt%RZLwm4bo62mnml6 zuTmU_eZ6ApYMx^1YPn+O>u$x2Tdz0_d!u6Jw?Q%UD>_8F%&phr_%(R|X%(OZb zGc8sx%A61TxMG&k9~DzKl*8#m!o=D}IJFI;VNoa41u^Xm#fh+)9{s5k>7#&Ym^S?> z+X%&^mHq_&QN00&;ZI}hI*5E7d6>5SHbb@FJ8UqrWbx`34Ru7!cwbY@cvmT=%uL(< z4gSDLevb>3w4Jmlb4=c`E+$XOJ1}`l-hpW(@4yT{2Tu@~dKj*l;>macf2NtQ{$beP zRLnG`o`8n@Xqbu%zMCVRl==knxxC3z#yWr~Z^@s$%k!bU{OYCF)Na z#<6wXBv%DJG8^#gt{IV#;_#G4;$ULY|cCL&cPf#(vk>OwWGLV9DeA1~b0R1_2}aQk{!# zxqyQS;|T(j$0dr%;~K@3ZN6gWWtC#`UZ`Bx{wG5dCjFlc&Lw8Y2{Q_hGcGV2K~+dtG4nD`F=dgq2^z|BrTSAADHr%tmRr=H zvV2D|*)}Q;!){T`vTIdLx%McgTr^I*lXB6vPdRL@SCqrvK}yrEocbv``M~&#PF^sW za@hZ4aG3b8!IZ1&S%lb&4s=HpPs0LNR5rY!jEVoUJ$v ze7?)SP%&jJS4_FMm&bG|7xz<%!@xB5hsLHH!EhIL=n9zOH1?;)cGF`Rwt^&t5qkWI(tl?Bh5i+T zDMw6NLyW)l55T0Iizf(7TB(QXFL6&A`V`U(HCSW@W?T$2;!j#Pz35P7NFWV6Q5cyM z0yA!ZJoIP0n-oWN^#wd&Nax7UIuSgVzBr4)L(Fg*`=7=puVAjh{A-UkI0;se0|<=p zbhnF_jK9dd%U~&Yy|O0l!e>i>vv1h zTK$>MeTtcmv*Lj9U>I`sHZ^FI9{NHIdc_}p{H`;V~$RFx)mTUBi%Xkd*?4G{lra`Ve5sz-mN)@}c^ODf1Ut1MZmgf|QVbj=?jV)!AXR!ERWw4YH17Vo9Gwv`AJ7Dt5G@QIM z4X3=q#E0<*=1e@niv(KJ6jSEeikZ&Mim9vH6f@1o6f?~uikT+6Z}McCpDPZ-78%^- z!p&3|$>S7(re6YPT2hyQnU?f9z?5wio*;0vT!1Nqv=Ly&y+&ym_a?=pU!a(LRw`!P zh+@j$pqTRRQXGa&V^1}<^rc@jSp2Utm}xuhh-t@^3ooz0Fb!MtE;>0Z-f~tR%r{u_ z3mnZaFy)_shcry*QpHTCOfmEFZN*Gyy<(;#@|yaf;AGJTqux=jW!OwZ=wD9jLIZmz>5;|Wd| zDDjDz7UdwOY=afkFIRCGcAnxPuvt{3r);nUQ?{!VQ?~hvDGNBWJg~aMA}O@?R#<$PXNqADHqN;Rynh$5zFZd8cBg^K%yl zwCrd2SI?dwu{nDNjBh(F`WSP6gPJJg>%XdFJGpR0|ZyAFg& zqjg{i@hBrtF7arCM-d;!ADFZ81lizVhTsRz+5Fy+M1B{Y-`%}g+LQmB}^ zk~Rx^%5|6ehheuWrd+Qord)3-rd%}kc`kj9b?H;(XBxq4gw*tJz?4nO8kn-tIQbP_ zvB1^X6c8o}PmqGcFpkrX@`zQ3lZmGo8S;t0X7F_4uNypzSoJCObFS$}C%``lOe1;& zj>-wlG+BhCp^R%3Q|B^H!9NHr^$<7{c$3mlw_6m4VK*tJZhxdW7xv?dsoUL($HJC& z2cDGiJ@wCnEo)o&GvB?CJ<663EbClg=5?g{6Vt@#^9JK5{!@*9m}h&M!KuWmTjtr( zA!Q1F3x8np@enf}k`zqZm5RxO#yO)G{ya2>k-q&#fu?Q)Gn~dri}8auiI@CwWD`DG zrZT3ZA<|FUCL5(1d!{R2N-ynbo*}pxRuDLv?xo%7L!_B+=*KH2z4WEA zb#es=VHhVy55?jw?I#FKJxKosOny?nz|@1}9hiDxbtFCYz~U#S9wLgV2Wgw|4+C#f zf9gTnCj6;~CiSNteyo^!Xj4piUsFsy$ejwrr5-pXWxAy4Deqx~+4`Cl({{!krtRo~ zat9aS56oG3h^dDQ6_fWhim3-ADKyl>62;WRQpMzVt77WmL&ag(T)LA#Wsy4}z?6k) zIDIVBaQcBT@f=fjrC&3Dq7%cfZY_Q}@+bq*|@;H|G8k0wsv3;$<(}}rR2s4XV_d0q32RY$| zk+uw+2#lq*_%ltJ&%mE)vfCv+{TYpzysH$G_uYyq*9OJZ$!5jWNt0sgM8*;D2?IZ_ z{-a>OtC)HEK=BaRe^s0dTk0_4GOsdr08=(jk0@Ihn8Q3V)4D+MWMH`q1pho>c5S4| z2d0V9f2r|fe5XGQ6SKpBp-hhcDU+jT=E2eP0N~)w_yZHhLrguBo|w8FqnNsyp_qB$ z6x^Y~bVo3C3vmTgu2qV|ud^7jW0-hw|c zVLZf?f0$y*$u#KCyyPn;Kan5)5-Q_S!( z#jwQK3tfCPzrsg(UIeP(azi^`G1G)9#h_%ios)vRsIRYKf@oGd^|QA9L#h)_98={0vv=;%wr$L%p+x`KaI2(;4rYv z-+;-3Q##Txzm1BihsP8%{nr%-VZWuAG}5ObZXWO@5QTh1KZ>b?{fe1yzR5`%=KHTM zob5CI)WKNAlYu8I&Ig{WnEd6gAox%QxxWWY{=ZQg>hGV5nb!1#F8(hlrfk%geG-3Q z((nX1;KO9#A!ay@b56%N&OMeeaVatZBjxyAfu_ znZfzQf5IP_>3HmN<3Eddsll^}kKqr@Re0=uL}qT|+@F~Xw{vECBeB-Q`NSXK56nV5 z&e``8;=}Yc?bJD2tbp68x0E@!niRTb0j7S6@X$XM_RWe}ml&7+0oYB7S$|~Ag?}cn ztkHm}S2knPhhhIt@etS)m;TgoFQ|Z+^+f6(@K|6jSLiks%)_qmFx`)?>FpKmD+13#hoD&RK7*8u;g;<>;<);;jN5qO;9 z`M|Rkljkjp7XsHPCZ7isv#g$S`L`=Bga0AL)O{F_eJB3FoPj5Jn<=kM#VjwGXTqQ5 zMO~AI<#nE7me&P}8Bh8R(9lf9Lwd?QQ*jtJjZhSO)Yb?|)NF`OyW4KhvpGOdcB*hhaA;W?sLqI2ZP#ibuhwvF|pv zj2(9wEb`xDF!{#x1KPgG*U3BiI(Gue*KWffn6Y@Ab~=IhY5Hn=f6Cxlu$*y$`E|yH zYlwelXyy{@STmnk#{$u3wb7f5alq84%%gy5C|j`FlzV|<>h?;-)UAvQ)ux@UR{uQM zGDg5ZA9yz&@|h0%GsVo)DaAL!K9_B(+SEsGbrDa7|0Kovz_R{@KQX&J(p&|6mtyAo z5yjLEzkom*>gKnK$@7$A#_h{?2O7qe_6y8%o2dR_;Ms~P^IeKbbH9t`r!N0jT>f%b zyjuGuwmV?TFi|meQm!}*{5{2#?MI4PhB6*ioA&pv`m?@#p?EBCIMMK*4}7uWFfa}4 zD*Ih{3;qN)%bWiH0o$*bGyxYDdM>bFgkI~9Lr;I9KTKq3g5NP%>KHJ2Wa6Pec}!7E z9+xX74@pZuBf_v?E&jmd;&Jdu#iSJ(RJI`8_PzK6!?c_>6(&X=X@=l&>OXlpV_6b# zkevaH$P7&WsiEy=&Si! zZ?NPGI1$cKc!I!8e}-c6zD99A?4^pCuPVjN*IkM!<0i#S|Hq1%kCzlvZ@*U@hW#hS zLtuZQm^^ueOnE4m?12D}1(v=YI2V}P$D|?8>lITstVZZyOq^Z)}J#z3>Eq8BcVpc(D4D2jwOWdC)lgB`r=Q zVI-{@gC(tMS6ZBOz@*~|0yCcUEx?Q?brLwrpNfZ(`uu>w{Ohzk@n@l_iShrQ@e~=f z{;+K9`;0sy!-Ixq0IVP|xN zika3$ikZjhikVKOVy080nCaZ-@&~l+XZcrUUT<_FGCybhMGq=7({Rd5@}lJ;Wx>f5 zjO;l8Q|1wPg23b_^Il-`o2CBbccWtRqxnB3&%=hF$O9ae2RJGZa8w@Ps64=whjE;8 zkvg!|@H_`r5SZaK_9Mm?z5UQ&(c31YPtn_tjK5oN{oob+zVVlK1Wca0)StBfrI@^b ztC+ky6_YoOQ!XOIbH-0(&@vSnw5&x2t@Bb3A2f1ilaJPa$#09{BYg`nWgCYl2+VXQ zC}ujBC}uj}aN(O2lV0W$h|BcRWe6XpPnD4;)2HEDfP6&%z%4hMG_O1pdHCz521iS+Ih@GLEn#GET0LvZ= z{HdGO>OTtje#O)Wzo^H!R{_iW$iUYCKd$~PlS7L0fn`mnX`NL6x$x(g$;gL1&rnRB z_%R#tpAYV>!`ZcqkqQf0hURM*_1vh%W#RE4~Pr zx}ZPlsSAgGlw$H^nbDt^W#iDZY#e%)4KevsM^0Tm1335-{DG124%iPo5D)z+J7pkd zUPmZqUdfaGLD-ioCjA`6q$yI&xXTqY-|H2V9z#)-{|^*1?k>gT-=UcFM--FiuN9O2 zeZ{2zT(RhtWeqvQ@JmyCBXE}Dxxi8nLBqUWq5iqRGPi_3^*vAh#{!oqo&YR!PS8-_ zcd9>iBlA!A=L5@o@xY{SQ<~|(KT|vl_<-Wsz`s^}4e&dP$^Uc3WX@?cjFHX^+L?FlJEp~;txz; zJj98xWljQ|3LI8{KkQ+O1F$bv9E3epaVG4`6lcS}MKNjCDkhDLS>R89G-FAZ{(BXN zVgFq55ZJFOWyb#EB+&F%Hhz9&Xt}r(I5X!+gCinMW3gb{8^R`|9r*&1ADsS ziOB0L#hJjfUHB@+)WJ0_JXdjF_}{3wAMkv|gMb$*9t^xhG3m<`lfFVR`B%B{Y8U+- zF8XT4Ejdb16I=}Q>2{vDhR!jSC1pips!CQ@jj32sG;d+aig_zas^;BNvSwaI zQDte>8l@;JttzQ3D(i`;ytrgxRoM!O&$#5_#E&v(z`~Ns(p!tFN|!AangvA_MGGXA zo~RasQx{dNw3Q|0%Wf?ZVHXxv70p{zxvYF%IXo-liG4b1NB;7P(s`?p?UH%LrAv#z z#vM>uQnWDYUsArH!bv46`;wv+OXlI18A=y9L2kXdLq*w8MM)*nE2^k~T}1XVk)wRO z2f6un4~<4FFIo`G(jCtg7)P81%PQ7TwcaY?@pm)y1VyDlt*WYA=H}*()jc#C(NklV zt*ok8DU~x$t^6|Do|u*{{mMMMNaN_MWOc=|O1E&)1iOW}bMFd_!?d(K%G9Zeq$*iZ zF|UW9N(8%tJng$%h+7m_U>s2@if$>H$JPk4vQjkKc$MRHMDCMI;E+!KLY;+|-tS!X3FTDovv*|G(<%&V#_TDk&50e-25 zLeE=KwybL2s?w?@^D34hBTo0?PT*gOA3yPbCBe9H;*`gN(uyVMwOPcaw|46!;{>|1 z_*EiDYgd$g91bx=RDu;pRHFFiyMiDD#{9w0~@hPIpcgbfuF?U>7U>xD4 za=A+@%CuXEo2e@>4pW(h#bw$p#Ld(d7>6mRXmNRZ1KcdT!s2jrm;H*WBDROqRx+iD zExb5PgupFDcbYiTbd_;WvUH<}l_Y+!TMjQp94WMomn>aSxu&A04k9+xoq{KNoCKth zV;MxNT%0gB^O)dxtXHflFE6R8#GIg~1bU)~Nv1ndoWwMz3rkL?sMt_jz z(Gbr>Y*lH6S=e&E6lZXa7aq+>*F=6^>C&oYMx5@QqJ;~)`K?%4EPi7aEJLe7 z1drM)i&n`jwPWPfH#r?b4;CU7FxhadG9c zmDCTsJ^7V(yv!ZsPS_pl*0xEYq#SeK7>$=z&6C3DmW+&?PbPXg zpwxEMgXjukg|sBffht*gTUS$Y*v9C(sBG~vZ0am2pND;x^3p1Y$emXygdXTBmvMVZ z_P%-`ljIx~QDRialFG`J6;-9hWhJsmC@)$)Z&`(tbX2}CBXrC7WwbpoWrq`+de2N_ zXrsA~P1xZTr|P)}eX?4*vfO04n}SYHN!C44#7VYmj6Z#%r=ug=_~CI9l);8ezp|30 zi>sD&E7cyt-FokVBwB`^R1Oy9$c44jXfggULujv4S!+&`kXB=T!aYwUk8IA-iODZ_b zE;U(m=bvPZz~x?2cNJ4z}! z5#&?|$4m>CmAhMqo3tB+(+ixID4N^oDN9T$4iDxsK1Gy)7L9ZekT_1~5T7E-Ko8wm z-A}`$XR0WpsGwiM>U4BbX5Eegzk+aG2bf;sDBJFh`ZRg|QsNl4uHzcBmiZFSUq6Iv<&X&%0&eqBtu264Gcd6P(HvV7icC6&uW zfT*-)4WPSZB^9M*%NDPMfSz#E=SPF%$Rlk~J6Erga-`pQC4yE6KzqalPexktW-Tx zxK$d5D2_y`%as+}c=XnWc!BODV#DKbm--T)clRJSXLo2EzS7;t=i5EV&DR|ohcByP ze74;}++4c_Mr&}i!QgsWoQ^6cIF39fylmN0C$fjJE5t2N&(WNXjd_*J${e2Vn4a)x zay_&};Sxt~Z8o|F^H!_4p>8QW1aT6O%H0F|IALz)F~Lqhyax{UK(>ZT7lMm9#MHgAvQl2i?B_D4)(EbS3KJr)P;o=u zNqY#KtS*q723~F+In7qu5_D=x=w{qAEi++?Z44q}K2=pz40}yE?KnA%Gc7W&H%JmV zjkd-VuUIi=aoMtBY=H2f)-#5eELfoD{>v8eWDC-o3b0^B)wm0zt}(M$;4_TcOGNpgiYUJ?Lb3d2A@lEo#xah3pMlQJuLAr&0Ui1A z8x@XxUsw4Y7Gn|cp2JM(=)A}y-@-f1cgV=Ex6)C6uc3V1<&gEQ%ka>>2fFXXq3Z)W#>v;P>}vCV8Rg@p_Dc=%O;-??O@#^HU7hu@~^E`F?E4!>z0eh-6Rs>4j_=$zu=*HqnA zU-*p*hhKjWzem9jMHDrTd>I~oZPi`;Q1nrLA3~XK{T&0pu~BY@j?O=Uj=b~ffH_=k z=vW?n|J{-AH4nd3RQ7urL5(BdK@UH^__-c5lyA7wQN9~I z{2m8CewV;8j(pd8_$A_H&JRIEej{N!@|}d@-1>V9o$YjonbOhu3FsInpAMK$z;6g_ z^5gd>9DW@he&ICpJq5<0Asx*N9)6kkpx#3e@;eXV4!`|5vGR>Y=RHI?m_H7`=RrrD zuVG@XRFxHBNqS0G(UD#M&?@e_6Zu#!P2ModvGo_>Rm!M;ud^%vh0Kdtw zDc=m(4!<@Jzem9juYgC5Bj1xAetD6u{LXaoJLKuF=AvI`y?2bmufx+{HGp3kh$!Es zupRlDJ^Uiz_bZ2)($V>_hhJiS*Z6z6(y@G}g1=jT^U-)mk%1aVK7M8kLekjVQapZg4!*8F9-#0<+KE#GV4Hw1hr z-?c7&dp-Pa1i!ga>ALd%l!xDk;OErm>s)435AxjsI=6f`y7=AX;q? z1ulO1!(-)Z>p{MYLFbn5IQTj3qr}B;h=<>c;5P>0jv)`4vpxL&?8@(Aggg0NKPpzf zPrwgdLex0??ggD&zQBE5^{>>$ugb$O5smHUC^y4{&Sf5cx!~vM?-m!ocRl@PjB(FKYUT>M!79rUa;a6U(h{^9PvIQ3_J}>$qNS&_#U8Y_Vyn&ndDg6V?{}}v4*2_@ z^XUtddDmL+`mT3f=DKFjIK0UH$>aGQiuW1@5jOS2`PD)2qz{M{eIM+!e@nrOAf5i* zY3&%^;qVTD7uJ4HI=q#NcbDQ_Js{P;O0cmZC1RyVNAOSmVVCuemr=L7ZG06+28L0uM|dXzk9G2UXH_?0$zi_tQ~{C!#k{a zIJHdhs!)jT-^1XAwcquyqYrT`l)SGc+mGdoe{qL*6g=*4MQBGkA9mE^3_zlacQ3+B zV>@lceq8%E2{(^~f#ih#AnY`6BzVlv_CwVZystXEDd3$+kQHGsb9iGE@9VG?|6c8z z>R&B**t8NNyr08P`!@l+aj>F)>#!EylMe4u@P3(~1$GQR?(iDHll{R1igyf+r`vB4 z27Orn{s~6fzoX#E_VJM7{inlQ4x?Fg$cohWHHVjlMibr!*h+o7L{t4c45LzkSvv;v zqN)D%QoN1Uj{W_I&!_V8dU)PDh!+w64#SRm+$IbIZ!>iE$0Jyae_4Z4c}Kw$2D6IZ zHZYZU5Ih-w-&DLKutU=%_NT|d!={=L;r-U(9Z|e*!&>~i&lxY>PY-Xu)y{bN5Ih+# zn-p)J!y5%&XF6;}{JYuVja!>MetZYE;@=*pKgQv>SSm1U$KZ2Le>?@AjF<0PJGSS; z4sQ;4uM=QJ{CmjZ?E_Ex_i@;Ye~&x;5x2)hm)Gp{$0BUB(!X02ufgGs0Wa+OZKcDj zRlM&j-kq`3@iG&alVQ!J7jk`u9Vu z#lIr#+YMes@cUP1IrV*2wcoRf7jbw4z^g^N2z{dDI=my`Ek!)r?>VfczLz`oeG)ujkR$py zr@qs05R&%Wt$0Hm-gfZNgb5MeK!-O+@qVg!pL9v>k5|FNkWPs3K7t+fxJ_9Ko?LIW zAdYGD_g4<@D0r{gJX{Iymkw_;c+-&1_IttFkyoFS>L2%qVaMOQVW<7edoa0u{7msK zb9k-b4MDny_&3(!MHTO57)yQooto<3C*X0vDq7-I}BbvK~{vf(BZWz z-haTBcI5xf;T?-6eL`}=zxN&98;ZyACA|F(??dpy{A+c1hZOG@ikICjwf*=3mRzKZ zNPX8Ar`qMEvHMR{+DB##FCzu88)kK`g!dZksK*%zIST(qVa@)16KkpOGY)SIc%L$Z z72)l4cx4YI@5jCcTj4c0`};9{!jG5Lj@?Yy{YDD4JO*dNPS@i_lq=^E2dy1k^NyaC z+Ad@IhTli}J?u1Z&Nq_V(XSQn-yGf~@a{vph_uVk9NwegNjo2cv9!zA^Hcph1fDR+ z6nzcssK*%zIRGB($9{VkYvIjzc!$A*D+v+aEe`Ln;vH7JD^N(vxGD|WMS#M)1a{Qp zHsP46?|&nXY4mrX!{c>nHVd#KyfTM302e1XRW$WIg0=9bpmN&3aX9F+91-Dt33k-u zHsN{jN};p;{)n~khB>@R;7zo7xDwuAhj&Qvjw;?CI;Hxz89ZTV-eK4=KF&x;R%5b% z|I9EJ)~nUwJqaFMNrkcO;G7 zT2w~&+cDUM9e}9{d=n7eVmtC-+kbf3Jh!EeF!`1ahn!Z zJbu%jY25GL;`GNc@Q^hj!n@Jwj{)FG`|+Z(?rz_QrCBc1C@o(GHx;SF`JFI&Nr^SaL~-sui+DR?W9 zF2Zst-5g%lBRIE1Jog7N#jC<~8MDj&Fe^Ds?>!)}RIrW`AFnoS+tyA9v;7R-On-J0;%N*W=;Bh>ONPQPMJboK& zrS-4B;{C*_@Ag6A{ypo|w-G$??`*|uc6bND3-j-r4(|=+-$2FN)+4olj}H#o!maNU zuw&ihHet%QlKa2Gig&-m`vknO<6FJMo2hseiZ``as(-~8RO7`ttffD$g`M_qK6sOm z&hau-@h)iX!!AMKJ2uA@lDC&?}dtYox@uR-kBl(O?G%w6z?L% zyA^{2!9@Q)2_7zm5+e1jhMo3rK6s_D;&{GT@vd-qd%#~#C(eJ9z!@~j-k%P@!cD0sgJ;SF|p1HhXD zJ8o|`DE}G|hhSp7%pVcHzn|gQ)x)kg;zXofp2v2nd7EK3PK>Y?yJujh>)QzbmLi@0 zRVn}0IlN=w{WCKO6yALfui!D9+k!*h48^+e$H03pr2W=9 zyhY#hyzSty{ccgbu02!zdoUi1Q*lxH;}qCw|4KI}+i$Mo{f~3Lu?xJZ0>fH(e{{|_ z%E6QI%x`GYj@!rYaWF$L(SF@4!_PO~g`M{AQSi`3roIal@23uL9C+`-PDK3svBTR3 z-dY&3{T3=-aY?Fw14bw7NT%>kg`M{A`Yp-!Tda70bheLj@Je`E&D#!M1a@q{yA|&lhj$-%V?ua49p3Zcm0I3C ziq}|}>ffv24G7^q06Xp9A@Igo-fG30mfp) zD198>i{MHB-m7>y4(}j%8v}&-D?H!feF&Z$-|knur~9O~-_lFM&rf&2PPgBjA0&?- zUst^Q99}(m*M#`D+TpDPPwKl)@s3AR{W}bv)R9=x{{lPh-&5ep_Gc}{)zfmaG6ZXX*I??^1QzGdJo78usT`z`EreUE`B z{ku`|=nI00{Xr9W!XQ?3?5;9M@lzM-^|2;@urh<*fy;YY1=4;8eTEU?*kKT=d6a zr_0@kaygFJZ~PuP(-^+p;cW)*OvH-_Z?VHWpm;w}yio&F{d*NWoYEvjc!Q&^{))P zuzF0zMTD-$DA=40d>VJCoz!S;gDgKh?k4;Kk^e z74fyKSE}88utO0E5xc&y)AcAuxwPZ>dtQ}$io<&hyqW|p*)E+N-T?4$NH;uwvz%qI zf1{mK{p)^Z_;%hCcG|y1;K_bykK*MxyfW~v4e`%+c#kRGUd3DN>~~j!7Y*UfclNt) zfHw+uY`+&3Z-T>n47}zL-enH2;D^cUGJfY>+V88*_Azckc>gYQwvXlDNq@8|UX{a} z2Hve9{$20zUR1n)Q@mnl+`pQ}zf+xYA9*V2-#*3r$noz;8vj0U{F|hB|E_p3Xa6^4 zV)%7HFWBkv_b7O>e|}Z*vK-zt@P>u7U)z9G-e&M*dwX5+ith@EXBeiga#ozf!ypoc-1IFNOE-d(Qr<;OS(498|nr4sRED z=*onMe?N41Ws3J}#oJSs+J1+@!>&Cc!rS7EgMvxn3;4QOxxFUm6>F_>O^*Ewv?;SPTrpt zZyIhkBbexqgWyd=SVVZ&!A|pzfJcAG<8RNH#_(W=H|iSvZbzI&y710&cpri{40hyw zpm;-^`zi(3hwo1ZI`>t|o=^72hl8yN3>*6QH^rN6{gWy_ zcth~KfXkcV_*c3c&-sEw-f_hnU6I-!-M*4UmfOo$* zhqctV*x?-lZza;{-zSQ9CH4mhCdSJf;IZFDgm)?Iw0|>yn!GRYPsJ;Dc!$7SEikNw zcecZ;2X7S8>7R#%cJ$*ZDB8c-xap0o2@&2lDAeON=aoKZ6{?htLPcnDbfx_7}*XU?`4QEjq=CAsdi7N zvHO!9FW4O!c^-D$?~1V80xTa}J1O@l?BZgCwfJ`&#`HlL1E!_k_huTG5Bdgcs7BUK zvx;3wJ)XqHZsz#5d5ErM(uY3{o-a1z0AaEFD*O}QXh+`m9zi;?82?z0!9#{rM3t1c z(}S4d!-koZ5$6sW8JJAVzw4s$V|`yrB>O9g@_|m=fE#84Wq4mz($>qyotg|>4fwnw zXfMNKS_>Lqb9bxF1D&+Q(f$yhIMtZl?^MVw@ip+?cLP4 z!t=J~?9Mur=dEaKgO;&B^X+Ve2Ify5eae&_$2XO&8~M)c6$f5h?_d4!>dh^yf1KTC z+if{Ry#3j?-`5-~-r;%AoW5j7TiY|Ip9g(^muF7TSXJhIP}TLSs-n88!u3@J8!PH! zg$=Q~SW!b^U94+^U)M6>-pwd(ckbJn@8x`&v8tQbr>g4*RYiM^eZ%_=m36U#hR|%0 zp2)aA_r1(db6(2zZhZEFy;WW7s@jwHcX>PKy^Nq*raH41OdjIb`B$%5-HP7{kg!`ZM(hX@A>O6q#i2R)YkTRkLpeMnRbssM$f?S_TfcCMqO8LU0d7Q`U3pj z&=|jWI%2oxAp0&K+A7mcuGQ&|)z+N-S#Pt*u`G4j*i(qyn6crZihFD550lJV`W@l> z^Cy@2D7@~fj0v@W9rZChs2iOd$s3r5W=S*VhF5y^8T7MzPxH5n@%glSo8f6rrWdUJ zV2vW`GIG{8{nLPRA{mL+MjNK#OY08zvzEP9jgh>nVMlTV*TwGUfUe^>U(rxi6RVxx zGVa7891sU{o(#RpHe>v*(#-Il@;B@_zi+^|2!M z(Z-BbQEwBwY@qp@F}9y~RaIf1s)CQ-Z+NGnqW*o3?gEbPLXPfnW^|+RKd36Kt17tW z{r>Ot4>iJ1nKFaEz+Y@})3e}B?dm-ZIn6EO(1>g_8!<4e_puvy^$m*cuS(ka@-g(~ z+o!yjx$0!@<@d*KRgd&flbt z%iyry=4323c7Hu17sYrUtBNc^JJN46=uXOaJ)ZlC&ne@%9o#g%9n0z3rpmj-w_D6$ z(>lRce)hf1A7D>`%{#-pczE|96!`yk_IvECRXN_pPj|wwG<&Sx$AbE0*?l$YY8tMj z2>Y;lzadw)u8!(j<$aKm+q~_zk4DVg)dHt5?b5x%ICVPp#><}dO@+;X3B14#S0Z!v zpGvnf5%KgheFH-}8Z`Fgd_R)ECA%&ox6yCtv4n9CKaDL6aoAHUe zL9mD-X<(3Z>X7mw=ai2ea<0AvPK?X~bz+m{z2BBdfRc%Sd>13-RV*3iZN(;N{$!^7 zx`_6jl8MkVJ=_pfl4;)ln~cazxl2rY++b3YY2GHAjL7sppA10DOqoq$7$-7HGVwN0 z-rp7Bxk*G$qM$Q;nG+uDgl|zNJhbPbjq*h-MP3(k{m1YHD5nUA#UZLaY0vp~5r$RJ zl+XD*5vJo&l!P$6*-0OiNDch|v*T}$+Uqd?X-@bpC;!JzxX3B*1{)6QSLp4s?SWHE z)VG^=svRGtCfvi@rX>`ZotUHqn$5Or~F9%PTYKF>i@epYJ>2hn(Mp1=EePKq)L zi*E;hoH_vz`dZA2Ko~`x!9G@Jy*MryPg`yq)LE|)Rv(Eqw^hc|_9Ckf!1{8lv;3>A z9>*HD8;pG^*0Ze6yti1Lc^6upb-L5)tkZg{v)vxGI-BA#tFsD&N8EZ zz+@fGI0T>Z6xoirxfQceD=G2z@MPNjjKILO`I&)EuFsB!&=0AvY5#l^ZH{Qg&{;>* z{?J*RX>;ggRA8YE+2>oGJTt}+&+?hyKMQ{#%%4)0J!~?6F?8B;Q=v{<FWC(H<@f_JKG^+|@qrBh zF+L0lbaa(h+$GStqD~)}jXHhc(5KFP1FTNoc&oF_DOP8h#)n~0AjXGt0^Rs9JkX5~ z);HP|pAy7#w?&;kaQsoH4;&WM$uNBfo%yb`@hsEyBjU+Ue2rzs>?-`n*EyE)!`k>3 zNFwE?8FSsJ8ObQ~9W?!A6Zz%|KRseThf+0tUdnT%)K zr$o@JAY#^B^ivqXd`D(sBE@vyqNrgXpR`uI?n-?4QLL0((yI6b@>G2IJTa)~Ou97sZniP= zrSFtn$$gCd+M5)~JWdpgX#Y(($&jdTib>k~y6mJQDc=J#&CXAfNin9;8PU8#0s7noRI}TD;B2EOSN=7R2m%1d`!)1_&zdZg? zp26bUm6?>_kJ#-*ka|3b_735EW)gHB=IIa9c#M1ii{@RAFs~s+g!eT>Xx=cKpe#ik zc|7kD-sOO6-lGVNLAr?W#=%bWo&;|ijL73Ti13CwyhGr`XXLLc(o2Mu6W&GEIiz^Pw}r2 z3Bn*#bRTxq~@W*YrF==k?25=s#-LOaTvj(<}WkLT>d`w})5-F|zJ!1G!W z;avec>T#Pe6TEWhY(HLt3vZyqJBWliHV;?AD|2`cf+ypJm$kyX$f@r*^&c)SH!YI!lmJL=STIl^J>_j|(YJIiURGwIS2kk8eBM$7~#M!u&hnY##$~+>-V?Tk(GE@K%DyduSr! z-;W&L_25bS4TQ1ycN-dy?Z>hx{5I6gKsA4v#$}c*SCVevK|={`DEwWgo-^n1m%?#M z5xcWcPDT)A{!Rn0)|P>$H2yK`;30N0JQ~Oe=gfx;4<^r}C!RCUi9M z^SJjQco!D*yyv$S?8$1&g3f=O*X8_f;hrq72uoL_T^P^u#$fSlvpm>(ap;v;GWKM) z^#!36?SUl+OI8#>#z8RWbwB4p*X}YCyN_h=XlvVEU%(0zgVTgAVP`H@Fo>cQV#Z|MHH-p8=NMlL1htQ-KZeJRt6+>VK=$a!^5 zwW}Y@7~Qm|q?@-T8#&B$a$+XYv`gf3h*z_YDm7?3X~RTYGkQM%)S};Nv%DzY=XL6y zpg*Lq+Tx~<*az%4{Pl)!@~R7`cl9vCjRJEI<$3-6Ycd9AU)9x*WEvl;W4m+qXTQx^ z#NGKN&z&N6b8{#E_;dssW2<{) zeZpV+a1=2ORdrc;>$5sZdcH~ToJ^lsmzA|XD_hcYOnPoIy|OOLTc71idWK2QOr}?K zoPT{*W^-1?&Ma?lmfx_V_P)aH^-=GM!rF~~(?;Xpf}Jgqy-j;q$DFa5!Ltq~usdsi z_JKmQ!Q`7eFThk!Q68dK7iFzNw_X@nu!SbC>4d<6Snd6sqFlSPpalbG*`~I(mmkTA z^lbGp6kgp`x%Rn&NH4Ev+6)0@y?ez^i zZy!2;-=3=*r@rF9+rsVf@|>+%yDIl*FP-={hj-xruByq`91HRJ7^tDkyhq(6V?p2k>N#pIbEzx0PTv#(Wc zO?7w`3N0ClY4Y`td3ZK~?b*nOGjOtTZ}UzwO}?KGCP4kF{n; zGD@ER=gUu-r#OzcF$@x!xs~midoz3_FoAc*=wk=6KJi%P4 zl4QjEWfQCMyiysTS2~jqf}GJ%SQG0vJytrpr8Lrc{62WLHS5_ba?Rc_EAf!k<@qIt zGmzZ4uC^g?p}4N4)I2=`>-wsJd8;4HADe;AcS(KK>SCV{f$XXrm~%ny(!$xXDHW{~ zOAey;r9s^<&!1fU4}?Bwi6Vl9T!06x?#waWkHj$_*RP0lex|Fx=7+T}?}6d#W?Z2p zBrf`>ensPgH4P2fk*rm}GVPRF;~$GUFFpM23j>iq5_iu^T0YF|Qiia%&6V7>7$$;iU@*x#_p{e1g7R0N=UiQa zfc@M4Sp+woXJbkEzj!v`LHH%YbG~bB{W!nMX9qH^|GZ8t!rg^sj{RNgM3VXQ1co)k zhj3mg!thg0{;#C)3(b6sw!g^+O0nkLezn6>I8)wEn|{6VzlZl5$G-_q{xTb$YWTgq zeNOtbw){ROJ?7o73S@n9Z1_!+-p~884gbP~`Z%p44*wnoZ36D%9Ctg;vMP zJZ-{wUcdCS@hpeeAu{(}VRg322&?lt^8%|6zl&-`8h5GHdEN9?t4FbJuzDQpuUmZ#*4wQ<9_y#A&hnqPIjr2*k-Kb zG_14Hj?`yDr||os6w`*PkK~yIwyDe`vrYXXTBptfvJNswOrLyv4T9T+UNONC-XEY& z9YCzjJ1}WNx*39QxB%XP-WA^^wr|`$pQ2g3jOmQ6B@Hzl)>JvGJDG*>debJQz!OP zt25tftCPLa>SX^^#lNEB`MWoAXkTD;+8h7bDG-(+z8RnGb0EfN4hjf$&Y@FcSY*z< zztzb&*Xp#LWOeck|MO5FXnHemPTjN{{?HfRE0p^MJ88H`2d*+*NQ?P=N;HpG6}#*=Z6)mi2@tWK0^XDBR_^1tCHtHJxk zlzv#Kv)<=1&GLy@x)#kGe?Iv(#lFLko1x3nqr#3%96PzqM zb&^@iPL7F$d!{_)llDa#x_xrG+2^2MDHF!&DwJX*C5fY|M6nBf6;UYv4)BRBk#?Qj9wA#M+6EwlPy?dy@@3b$->%nbo)6GrBJBH8G!J3#`g%4$KxK; z$m4GpwSU_Y5C)PHI^1-9?xkskJlOYG=;bX?-hqPMe%Tokl_6&BbCQ@ z6YzL0BEE7?Rr@y+ym2sMeR*sb|28_jD8j6pi0~eCcu#^?3_J30SWED}?C`n+APh1^ zpWyKJ*kdDkJlCQf+tdAydM_k|wV(SP^?i!R>lopE1v;yj7^g_!@mYj+lxwh1k7J=6 z0FTFa`lshkd0wS?qmZc-aU#MSh6v3&rg%IrWg6?d1%q4jrXhjliU{v9*lAwgDM7jP zkL@G8l@4zy5_kQiv-T-fuosXx>urqKFd_-f=`|UK~8xe*4-q^4`Rvd5z#P zPDFUGBSQ1)!JCFS`p5HHrja)uFwL8fommv|BEq{EMw)j-`FAFag?EO-TMHhqr$vMp zb9m)A&P;<5{o{3v@a9_{#}Z`*Hr|jX` zySb+1T6<^wn!05*L$0#7vKJ6f5DB= z%caB6LML+{)HJ32!~32UDnI*EA8Q!?yS3#$k@q3L;Ml9684tW}rBq_!eaa_HDA+gf zH&GOyCm;}xp_F?YcEDlNGWVRAPVwznHugL@fG|op)Qjy{G50*6)Ano|Z?k*8&C6Q~ zJkK*?uSe~p)`_d7;0a)LCdw0WToO#hW$M(K^X67n--;94nyR_87U8#e&gI?7*d{JF zZu$(+6WJ!9__d(LRxMgoQ$2n0B3#F%o-fnMa5LwcW>Dw_N9x&r)tou=W~7|l&#A^U z*dZtPw%Jc+RfWN2yVaPl#Q0dC2Ars7EWiSX0wclx!UnLCu6`dn^JqI68?+X?qgIbI z67nH3@tlOWGU*TPcLEOC3c?!?UGt_O%yLA8cQGO~ zkLQA=h@*cv+$4B?p=;huge$R#2#>d`G;f^Z>2vW-u+zNFHlNGmHHqfU0gv^dfBIZ} zDZ-lfB*LXwM8v;^h|s*HipM<))5zy>iM(_oah}oIC8Z94m(m9WgvOo}Tzv**d}$oj6v$2k&sq zGQViXI(Zyh;o*f6>tlt@v4SlVH&!-OG{ovFG0#4+!C!&f*}RBeq*QlyatrGrD996 z#88NRu)tIZ^o+vDf=HJFNxv5g&gp#Z4+{TXF>B}M*?MV&9(46kjq zKC4ZY*Vq+KG&i+vIPdfId66C)GaB&Lg3I{QhIY-6grofWj2pWbD!XWJ(4LW=&t|x73QF=f@QIE|dSuR>=u`Ug0-rkRF)GlG;bSj>=2*7uZi=mjY0~thZNcobZIP)*A~&9g zI#9H?W!lb`>ziAqtZ$iwm#)0q)b{2V&TozE>TE~xx{WKgEO@r+m5HxZ)>q*@77MTq zt-xln?j-8*zqxIoO}d))?s=~shG_B0KlUQs8!{sKtN0RuWokSAf6RmNa%!TG_FZb) z95%^Eh4==BkkQ9}gk52RW#5{^2S?1~MA+)BP2#ZEUA_*ab3w^WNZ@1~$cc zrYVw5ApEXqp-dR=e1W!!Iwc=pv3?W?Y(HO%5jc}DvNlCY8&x4|Wo;sXO$ejKTejeM z(Yq~6UvF8ow`Km$mO0HWv)8xGtZA86*VOjW$jjl#)xRAJmrtl!j7S-%5gu?1uCHH^h~oUwR(L89P9JO8W7O^m_r9Hh;AyQBSOAKK2# zU_1ol{N(L1#?Ws9ZVyfN?f;5RNwTc)fzN$j2KIS3_UIMt@R;EQ`)Lkm?EAUBOsH!y zyGi7FwhiX zi5&$WF5HZL-Yu*68Yc{cNJcYgiD$r)+YigccxBs!wB7&7KCGACgx)i++DWq$W8Vei z;j`rl#ze4VP}{O>4zgbe-qZl7;j|?Ub5pHBy2ySF9Rs;+>!hlY|xkFq!9iEcYAP+W1ll%^R>U< zV{fe3wr&5;o#6h9O~$n>X9|*%X`UF-VSP2rYv10Sx&gx z3D0%H3!Ly`C%nuF-|2*L#88rHo(xGwWTt$fk^bMGOoW!1@`XBvA9B(+I^l0R;Z08X zyH0qE6W;2CcR1l6IpJrW@NOsE;)H+ZgkN#O`PWYEj_$?>=wiABG3IEQU&KnvK z-ghZNi{{wpm9kAZ3qP)4Y9PD^aHvP155cMkxvp^1@3HA;n)J@zNGJWLcJk>WlYXif zb<%IP>3m+N2zShvsvAfw|4JL?J)a`n?frxGA3<~f_9r$Rr1$iG&x%=L{uga{DD)!E z9H|?|O#c;Mo&n*UQW1Vt`2ZWj3e)G?FsoUFcXHkA@Gr7qZplTsgL}K>5yAXd*>I45 zu-76tiER3#HXNi6^(yWDlGQHq&hd`f_6fqny@#Fl>uPW0^fC75dcU#HnIUM(m*-3e zoAe93Iw$`Q8bZ#%QiQv0PdVueEI&xU$m2IFD7+6@=S`zxh4ue}4POVn z$h*w@_fC=;`1hm@2jk;PudPdJ`kOY)`JN*0OI{b=Y_~%G?|2gp5~N@4y{~R;G5u8= z?hU=jyUx4a>HlkNnD-uwFthnnxmkuV^MA{RgYhxLyU6LkekuKTlh@DEuamw4aj(zt4uF(2Kk~ zylu|-F0orlJ%^&8kwqd$a4k;QqKo)n2sBnv=KmPu$NAUu&cc$I=Y#H#W^8b5;&ay`{+K}H z(BS*fMEtRVX5!Ux${!cRa}1`uPwdhlo?Rf%Q8UILui|b0nD{G#_;RfHe3pnmAJAUySiP@r#0ZR<)Re&We9qpqTdI0nm!SG*C=DH*72Z?SW$AdBC&c zFAo%UPjS>nV|&`mrKP*(ifKr#OGkyzN*srbGser2GWa=9b6;;#x66W>o_!KqjA zXQ=o!D*j9re_x=RaaGnnJ_}L)*MfLQF{jwC^c&tZebo!85GhA zbYc49>N$(>M9PWV_oi95&Z?6*iK#{9+8(HJL3PnRWK5$c)p#IHg+ za6Z*sw{U7oySFTcG_vWFd5ag#Uo5{J>7Zb3tc%t09dCZdvijDOFDzaqWWr%GB9a3ujL~$zt1Q(Pg(!?bw0OQgS=nbnUpX`leeyQ=Qxl zx<(zPowP@06rE%PD_iY{ite~c)4q)~WMfjcx-1plaanV#W}NJ}Nt)`ClCd2Zq{o$c z^XG|=h3&KGg4?Hd>_BoDoMiEC23@$D)^X8xdrtjX+KG1zVy_DhMWx$}%qS2_;9>`* zrdaDTQxZC^Y1P7IcwsD_lAIy0-8^wOhvZ2qJsmP#t!)z}ezlkK^S+Qx$g$UDJ4q*~ zJKjT?cx~^=wYK=E%QUSm2`4Bq*)*vcI_l;2c~VMmpUfspp2^|Yj`;23!a4JB@Rlch zJNA-K`BvS8my?<|37@cG9P@O&Y+f$halv{I!85yC7tftKZ+_UbyUxjQx{SJ^(%E$E zQgXlXnH&nwrrim*=-3%E()et1_)C&QHkEccv+7eje&{OS>Gp^md6I zm!7&G4gCRZNc}@|X)i(zI`+ggTiB0wJKBi3t4YnHy-15pw=t#e=RRX=*j|$6D*T_)b&RO|w!!CPP?4@(u(AV9mDebPAlgWeJ-))$ah;$vN_C4~$@)MnOw9lfOwtZ^Hy=gbJlPx^e zTo;_0(s7}Qv3;_|x*2rAZd%7hn_+&k#cE?+q>k^nII{;i+2XXZE>6dHT%6igPJH&< z-ZAl>hAPvPA1rlv5Ff?5w|=S>bEAed!0hZwKv^@GfUjCk=NOGuHrD0o_>PNHJ!XoXgP*;fxJyEFX$L|LI`$;d&7Z-KkUZLpkmQbi zuzQ@)*JY$X19RS*LBlXmx=q0hj*~4?8|$j-_>SvnHvN+=P8;jubbQCfaVVZ_Y06d? zrlLD8E7;8D%)9j@hOn~LWvS?n%d#Wf9{f*wlS#EtHzdr!O*QRcx07m}j%j|^*>Rmr zui`u`^urt>O?QG0P+eayk?F7t2-=^oNEuk}v_(%okuqkR<(S&8L^?FPq zx_0W3hQypKKPIN_MuDOpl}OmViTQPHHwJc677G^rb=XmlGZJzf^ZOC3k76O0X$(K< z@WvrdO{pe$k2}09OfUhO9g z9_Mj|_cSKYb^CFuH_X2suw#523#Cl)_RXMy5 zZJNuw-r>a+kB^WDZ-m1;j!I_E)H*|;z3RDe&lR#Q_}di9d_Ek`HF|3l;GXv@c2%fF#m3M zc*_-!yAP@FbJ$pbNbEP3r}6J;*lGXj6_1a=2=9J}R|}qc^ugG{+^ctZ4=NrXkrCc& z*iUHxo=W52KGXmIJ_qnkB``he>Y+0rTsgQ#=q&X)Bf#J zync#zuERSB9{XQ}49YNv_oCvRiFEOAl+z!_)A%>S>5o?xkB{vLFXHe%0q+tzWJUbT zb$ACA?`+r#?-Hj!_|5@g5Gnc?r$3G;9v}4)UWvmS4_;XN6*{~R6_1Ys3GV?YsA6LK zn4QMIufdLa;#iDyPaco>sF3hxI6S@+AQS%+?>}swIM$R=igy9R;vbLS zn)gW>|Gs1M#IdG~Q@k%CEWEp*YaUMq)uVX{|M-ZZZof&2SE+a$znaJQZ8M*U=rgR} zahotr@h(K1_&3tw4M^kPP=_~1@h(!l9dJ(jHwnBv>jPKf-xTQD?)o%#=ODATn+ZE% zXkIz&7$0XOWU2Cx`!}g?p2OpF(bt(A!5?8~I=q#NcbVdS2Pc=>zZcW^_bu3I|JEwr z<%)Nk!)pbP?JFYwEpT{`D&CbamiqoXPA;{71xOGEnWDb}JL+*pLN+VjM1+~f?d=hV z$LF%uBbf=_HyqwmiuWbOJBWuRwSQy4V_71izX?0)ahtG5@xF{WrqRDG4sRS1!u;cV z{WNc%;$5wHFJs(m|M(t4<`WTpFYGk$fZ|;PW2Tw*b9l>pqaL>j#}w}d#4(Njl{&m8B=og;xDwvy9o{F3H`Usa_YfX-*8aT+ zfG{*~E$kQ{XCx#K2UX@jilqt*(-^LHc>ESx*!kZ~hgYn4GZc^S$J72DL6~KUh<=)l zkK2T(;>|)F?dae8*j_d7C=y_r5aAt#9rd_P8K8JKAx?PHaB-t~dG@@~W=r^b9qcr3 zq~cX8-Z>600$!MZw^5cKX#?@Pqv#l@=&%b-kk^w?=Te2dmcR8 zN=u0N_ZukG<2L1a#p5|2)9By#o%4+YY5e=1bH354cqyLC1sc+QbWnmDoKaXO$7mL()=BcUecRY=MQ(?zEaV(Sq z#k(J2;SF_opQQ0`ki+Yxcwbk%35eI@xy)YI(+7&w_cGXN|H>3^owZ~A`#QV<;Dzm9 zKIia;Dc%E$_wRse|Hh~B?-kf-|Kf`Gkm7yY;Y~>6-@^`Xyy9(8yjH|(|M*^EX)~B5 z^cP^K{hOkA8x`*nhqow=f8TI;GZpU<#T()rj~-0p-$3VhG+*()sd#w~uMxabq>D)1 zGacS?#rrmlX@@5EKEQrlx8L(={Cf{}y8Y@EZ8 z9J==J7n3_IqD+l20l_anp!ueZaCfEVUp zcZXN1c+V(ale0e^zVCiKM}WSk1F2J5huKL&iQj0!opxy(eJbI zaYjNmE8c#Dg*VON4L~@|zv~>{Q;PQ=iZ`TlYJKZ%KKeir{|3U2dYqAvJ&N}l!s1_! z!(+X|_Rqe<+oyQHP`nqN>-{&<`1e!idjEjp{ZjEBad-#7>yLC1sqZ%&-eJXi6UI{C zIPTNv@sefhHliuab{l{h?pAE=MOtQ~`e4(}7i`!8$9= zzdSsL!u&_EysdcmIJ|Q3qDU8!_N#Sxe7}P5egk7^zZ=kay8R}k@lWQ}Iy{+y3?3W+uju-OQ))kEJv7wRQT(4bUu!#weZ#=c+Fa8}5tbL&J&dd#s z`D3&3(&5^B3MP*WUbH%4MdjqbeERCr!dD8Pja^bv?MF&>Ha!XQR=(&I-?JXZ&xCK~ z3x*?ktGoJh^YCTuwFdrp4}V}DOKmo99L?R&9J}*NZplLVCPx)+tK{It#FIbBs*g1m zZfG1**Hph|kpb?`ZLKhGz6>m0H{U+V+MNqVP7Zv-7f$+YyB+Rs&Vv2!ENzXKri)Xu z?tQG@za-DRRX%9IHneA@)1GLvWrfxL?3PIGve?cdzq!bJw_!a6i7w{$AFn$?vJ-vogQ`B*GWzZVf&wGcdRJF_x9Nn>9v!Kz$uwt4SJ333pdE zJ!$n)gTeUg6CJa4G=L%@5Y~br@GA-SOptlJB*Z+}_rw z#f(>eq^AYDd^6m0c4xdzx8~-TjKxRFIRX*FU$a&4jjq#8KR3Zu(Pnp;N2Fn%)dZTWKiy<=tVg_Xxj z3+q>$xhs1?TidEGUfm{qhN$-5g2~6Tn`1@5H0(f^Zo>PzcQp8~|J(ANEu;3flq3E~ zm3d+Jo%tgxOFrs6Wg^g3Xq_B`&haLn=JmG(Gzd{<+#;hH-E6wLZ5|53b~Unc>4Mo+ ztNT-*Qn8`?S!P=+7@No8!iXMNZ|L5&t{EAk>wn zG$;qv-LeBV8#i6E?wVNRrj3P-J2v{Sw_5+1JI}oSy%RpTH2I^y1m2rY%t6eQiId;_ z;L;zWmC&nVOpW}6+0@nlCGD;`2>ABFe) z*TuRu#IA}JqXX7S&z7PryG?N)fYCcJyV_rdSNogp?OuUC$V4AR@Hgn*m4%J5)f=yF zZs|U;t?f=YgeqlwfgN_q8CjP;19KCJJcxNWWAi%nlNra8i!xBd&Fj|u>fM&^AGAae zzsqkeM4GW(g>$@Zw*b8W_PM6mTo1WTU(1>mZu=XDb{iXULHoL%%<*n`RmR&{`!ny) zScl!lLj`y{_$F-M8^5@|JH8*_H9gD2T+?#}@3gi3{*kjd;%j18Tot=~bZmSiXL?m- z)0Tpr-Tk^vS!-6j+nT7oX~1QLm&C5Am|hjHi&fU=b*_)RGB9WLxu>F>H5>bMGP|t$ zrrCL@r5#)50E;oYc5@V)ivjM=X{|gk(X`2w*yNoVJ7aO!M|uVAQi=A+V$=5Vcg8B2 z5J791sFKl{ODn+Lnr%i33o%XK9E;mFjm4`FgY7C-$tK3%9P~O2QB||QA6bZTo4vH+ z?c7hf^8&WyQWW;mAKL0O@Aw7|_^W$7-e+6&OTTN|gQh>k=J#=8fTa^pgshJ4@z_0k zupGj|_&r#PDCOnlm8YF{TIIju17dLHw>YO1Y5z`XoUkj&^m0{*�%KFlL&sStd;~ z&DSG!__SmITBi9rVlpZ-WmcZ)eUpjC{!Axa=Dnf(FF@)xbppz8AKWt#VR*M=-&a+U z>3lX+gyC}~fHlJ_o$yy2-b5$dVEH}R-+1c%HJg72*8C<~)RtFe!kxS;o$~+W)MupQ z?;a=orV~~;E&vU|qZ2oz_-IYEIgG90Th17yM5+C>QC}miD z+;5}|z~U1IDaYdDzBPr{G(MhTrLY?EK1|$>N_;bqmu8H|ttfMkfI6?SZ?N%n<7TU~ zh-Fr%{ase4{ry&FJs!0>*^gO0iuH3=r|%rsEQ`MX$?Bz8bHB%U)*}~fMxFJb_;z=| z@_ZHqp?^|e`X}{ewdFmZgRIW3CX4a(|01iCccs) zuD!-J{n$H*XOwSmJV&X2K8QDcVaJ{63+N1z!)M*N?q_xK&aygr!>mqUzGU?%*0Ze6 z_!_Iz$6Bki9&4;ln+;Z{4Mp14)XTQ5sh1r~re1a|(Wcmr>poT|zs&07n>L3H>owfQ zGv8RNlYNEN$u{k5$3OG?G5moTf9y75{IP9o{9)k`)6Uk=NoMpGOPoEI)2_mOswwEdO$=v-~Qnv;3Q^9>w}LtCwP3XZ0x7rv1UEJw@7_e)u$o zunm27K4btE-`2OB`WcM1+qFHkjYQaICdeo(zP%9{r*7M140YRgtc$dd>APG+K$y1} zI(_-F)$_2fwmN-TVfA5HoACpC=KH>lk7NCm)mi3`tdZ$8>r=z0V-U?}J^iyybg&O048nGiex$q7k5THjA88}+4IW{2 z`eybC*r~A0sWzTve%0zM^BY!Y+y21nz5`xW>D8HU9lVpMM=^`U`2in<-caq712sGi4Xg(y56%5y_8 ztF!KBTAi+%Z5H;d#{wJAdYEGw;#rTCHlFoZYxOABPg}hd>*uY`Ivun+eK+G49Qyu& zji>MbuzDQpB924YunkVLI@_SPCqHqWHDmtN`Sb8<54>2l8ZX_PUVUp-&9X%D-1*hv z3CVmld}~ffwy^kFGiKtat-&vj6J-!JWA>~Ww@k&WIq^eO`x9jI^Ivh3KYyiN@^vK6 z50y`77>Y~2fa?S}Whf=l9lQm_yhv2X1?_l(dg#}uoS^6wQ(cg0;1iV7?qw_|C@jRD z4X65w9cX^1Jrh5#W|I0vw0I}IHD?}%hJD{EK1D3H@`LCTo6D=v#FA}}8qcq)uEASn zs*`?koTfxzq|LT5!H1HQ2qes?nuC`S&6-g&D~T{U`2H~S(d31RD&rT|ram<_^J)^2 zbfkLW)Z1s(%sXKN)XbXCuNdFDsA^I5yjxGu0j9~E9Ljau_z6Gg8GWv)x)q;%PDIna zxr^s`9lUTypg~_HH%s$^&<>ppw+-385<`XWA~+#3@s5jh4T_FWzVQxwgP9#MLyhP0 zC+>p=jbFH=deMy8gBDdypEGNaZiuj4DX(ft7|*F%bmP35xn>0D*RrI1bXpJBlmrgf zln68UoEYpC7uVc23#0hPdBLyrZ>qtlo0-zfH`UBrJbx-jO(GhD+xgTr{1`OD8?jYjF@?3Z2JJ`olCH z*C#r>If&zZ6A|H!cX)YSf_rP^@iInuJT7bh>Ji|%fr#*UET18)c7M1=QEL}=cF;PD)ZJh+549LOaSwu+zK)iWft=@b*E`yaMbj#u!5Ihjx^gp-_)A02zZpw-#&q*B1-Z z=wCAw&6`9XBdpMl@=Ykz;|xIF0FU(`uOAksk@q1KW=C@yY0L|*&1}%vQ9mE;pzZd- zj{5--ap8LaQD@&%-h$oCKsA4v#^v|6oh9i4?(~!h?<|ZD{ai^Cjz>&mJt$)L3GAc} zjE{rIZJp_|zv8$ZJoKFM&+=T!h>BtMIg}GWS8~0*ZVirwWw?jud!M$oeM*1A1oM}T zd}3hDmbz_ABKJOielJe0J>1mTsi~9sLbd0u3Y50CvAJH!TmCA{K;g^Ph{q(O`GoaY z-ztarWJp8Cz`T>2;Oxk+Fke;NUC=Y&dwoU;pI*U7tXYSGMTRHU{c zXp`m_3U-?Q8+(eE)H{3TF(5P~9*Mx*Vqk>oXNwVZJTxHj@V!2xAyYjO66#_ivLjz< zl<>E{8RHP$SgE=(7;or_V7%e^vOsZ1VDPQ#ptJG!WGC8x|NDfS9d0WLKk+z8bL*#T zpD6g-k9+RGjCOu}`}TE_UVEM^DEYn_Vr!a~=8etbLkhjl-OxQNl81hdbZ=T(cu982 zQ{I4{=#H(y(;`cr%5L6v8%Ab5XSE-e+K*j_U9TO)L0#S2hi!l6yTo9l?)akovg}Cy z$u>c<0hBh}&%6c?f?b|Dq@^H|y?4_DP(5VoVwEt=5nQG1F`IZRFyVD6j z?}X+1tjt6E2b}a-HvB`RaW1{TEq{gy_ciB(zV#WWc8U3Do=f`NnLx;ud-#l!d-%Mr zmbnrRGtTo;aO!MyVxv|kufNq<&Pc11U1@c)FSR<^6d(Rxj5S%*zks#z6Z$#Oji1mb zK{tL{-S`QeTb%LJ>fGOva|YH?r5irZy(xxoH)X@O^N)tliyw&L69zGSyJ;JK$b4}r z?EEPHK+3TAF{7IEUcXPEmowg0d>HkBZ`k>j3x+AOv@+rZ2{A)fB7vhl3zgH~tTJf?IrCk1=9({nbS z^=q{{>qqf(f@c<3AL>_Q&9bR;-(%VzI_qTG-|FPj2FLcG{h@DyZrUF@$4nFpZDwO_ z_?Ww)7=FJ%H~cdK-SE#0bi*$Tbkn~aybx3=F`vl$9GpWWJ8E_E23VctTx4~!Ct98C z8?0`-+w*bgV%?3O&@Y2-{Dl5R=*Caz=Rr4qTHW{wokP_4X?4>M&{?%87V@bZzC8>Y z{@I9x7(N|`7(NFS#PA0Ny5SEFbi=pf)3izFAl_{I&=YL}o$UTt_{~$6ImGH@pKo=t z$5@@^Utx8YL-7F_iM8<`I^8h-L$8F+GH5diYvaGwjsMUS`vI#P|Dh+^$Lfa9NJ*tTHf7NxO;9qg~5sqjarnZPI`Eq8&B#iwNnhPBXQOZ=c_f6vTVmVvFsQp z%63fq*b3J&*)i65P|ECDM?Dh$DFN{{v00>=wVRYQjS>15_jaTdt8`6fjU=;eGAEWz z=0w>hYad(TS|*#!8h6-8A+L-V-;zzFjMCL>hOv>Xwpyu?tW|1^tyH_n3db&4rFN#= z<)lo5n&F18oF(QXZ6PT}h{I6RR>>kvH0wSiczZfWK*(e$ce*Dh({b{UsZ5XHSW&|h z3M;-^Q_rzsdziJM;8?)GAS|vOk4GXrW>9!OLOqU!l7;i5aac2+{xFTl5pz7kTFRXO zeF_#4;qlTz^Tvb6V-R_)j_|$&o&IHDp=`!dYP8^w@UB2m^Kb{*%x{n*8kF8nBr$OAgzpF1BGK|WqyytS4GjFEDLORdh8 z_;;_v+YFx6mzUb&AAhT$>&y4T4hZ38!j5_3HjU@G!t04R;r$LU&8r3Phc*va;@=?{ zX&Pc9bcOe_0rG;-8+MjKUx7-xL6f1BCf2yq-?` z%?EE3Ea+bh3+*CU_#R@-n}dWIh!+vwM~;6_Dqde03$MTBVP)i1B*d-GmGEkyvs`-` z?-gLDH0`)v0j|&vmmm+pIBft2@c=BXS%67zSfWbpY z4E=2LgeU*|^CxYG4Wk3N!W#td+V0xZ=4I?bukFF*8An~J1oLf6{dI5`zu@I>?+Sv+ zi9>nbOPw(Hhbbj9Z4=C}^{(4gyQX<(Q*AIM(Y!YrD4Zk2J;q4qz0G{Kdn+dqF#DL8 zHbgm`X~^JjG2hO9kG~~1^B7_NwV^3xZV7Ftn>E#WgnSN?5E)+OV;*sech$Bfs}_6J zoR6zr6;$CmH5s_KtG}}=JzM?ADOYW~{lV%oPUYDR*(E%Gy%ZhZu6?vpb)5gNpKh9V+ zn)jKS?0nMnrrKqrhit07`ssn^77l62d$*~UKVe<*L91zYc#7X*XTp2o_BNBN8Q!wdXr9SG`)4G3U^afK z-86gEp0;J9fnJR!%0Uy2U$tTQf4%e^hS9%XKFhclZ;|KzjK(}nftS3Jxe332-BN%t z^UTBDnp+FdM&{?tX7U?NgO@4LVq>uBp3>aP?a^AuL?L+C7RrJ)Or(`e$L~$eH2Wpl z!IZDNE$TT`@y%W1H|u7WQ+6KbVCS*Z%n`yl{094FF9_MGQOp+h>Wn%d5q_HO>4yB5 zD)b(v;#~Z2clPK==D8K?U;30k1m9Tjw`XIhrPnFm)U+Kc>G&=3(=| zM*dQi+Z|?R8~yQj*X)g=)bWwmTOyTa9zKiXzFW>E%!JK07+{mXoW-5l&ML<3&pec4 zj51p*kQbhrV809jZOyIs;WaqFGgZPVb75-?F_G+D6~U}10vwTvCK}$tc5n2?=Uu$3 z6Morjn|o)Ase1-~o6VizYu7}34(++I^O(tx{gdxG zs4u{-3_r={_Mg$*;*Ga$s0vGzih1`HS$vN`U2J^=UJ$UZp|UQvwxMErOEi+py)&wt zvzvP|Zf|%M0)Kb@9=Cn`^1KyQZn16+Y<BSI!j;}r=SU8xVvgEhR55~8CY{J_bS^yJU=hORhp^`3Uh^DUqCD#BI9uWkFEVZuGVzuPb|T2kgc^Jr(8>bb+)t2MY5e&+jzF~{Z?l? zKVo&Z-*&6h-+#Ay6zjuQFU2|^W0^j)EeBbhZG4T@nfGp`e?#ftwt6{ip0YaI{%8Lm zdH(_*Rdw|b<7Z}aBMdqdU_dVQOhj&i&g34vJek}Cy!?P_1gnos1SJR<0?4KCG)$FD zg0?XhNm6Y?>Lo;xkXjoOsYz6bH1t8LEkIY+fm3+WcEsPnlX@zgdJ?DXltbav znfUv7QfK1N;3>)s@YjIr(*G}bQcp!s-4s1_CQkm;LE+Rv(NhOSFUpVPpCSDzf3^vq zX~J)m_+Oy+91~7kkSF8LH{o|E8ax-8@I@wki3wk(aPTiQ;j1P7F8tS-@Qo7x2>t}h zKoE71h6e~cb5Ru_?CdshVP{zvhB0i2;m>zX;t_b#{=^w?qQn{RDv2`*E)9}~d3&A2 znI=J&p$?gNLfuD4N;`3IkwI zN}RfgwhlPsF&h2JJ4xc?JwxK;C+an5DEm#)A5LQrG7ze;LHbjt8i`Y<-4drxuS#6U z^R&d7F8dtHz;p@9R+LrgNE2{Ah;Rpf#2HRd?W&-c`A%6a@gi8{hvG?DRa^HB;3MP^ zf@u>cj|_>EcD}^P?;eR$cWwFN<#!iiC#Kl^7g{+muQ{Hxw8G16%>;w(@-xwduQ$qz zhK)^p16K%T(A|vvf3cv)X!4R<^NQX1nENB2fWAP2Ev8xvst?*-;VA0}b{wtNJD*CxpgRV86m;CFk zd75%ZtqBg0M&*D?MrO|d+Vf|{05YXuI7^Wil9I`oS4EJVRASQ%%J1*8)5twnfO7}5Wng$es3X+{fPo4-?lJ*h2U2QBFe{p zTj{$wjNdfIvnp==@@)*`HyTW61M(YY;`fr|r&w^Er?{V;NS98o_nGZ?2aH!N`LX*{ z^8Fq-yhG)s0sI)IK;azQn)$s4p;UgD*WFq`XXf`J_zjjHFNN{@(8N!z7m)vH#5eQn zgq!0M1xmiZO1U#+z-Qn$0r+(M%N->ZZCxKOGBiIMilW^@!lE6Z=H#sdEMNkyAEn z_Naon`M%)=-U4?4j#qAM8^I}LuFGJ4|N7X*w&7;?kVfO^TooSEG}k@`1R&oRyEo1? zG`eH%5zK&N?pczgMg}dV@j+*)wP^PStV3?E%nVp!?iqbez%s;`{2n)Dd*zh@r#K2W z=(y)}e9$ZC#snbNP&bq10t=N5d&vwPLRvwEe%DL!m#2<%u= zcJI7s5nZfSS;vho*%qVU!3z<$5VGfinFQX*T;!9lkJsbi!$x+);8{#(-Wl?ZN zQcHf4`+!G^-&lXyUg@1UJn5cQ3j~9}j)i4M-fhJ8t`DFE_jR4+gn!-`Tfl0kHLtO! z?jME|RyX8Mz}dh^(i8*ho}n17sa!Ha)Z8&xn=7ys#V^=mF|hmv?`CdzFh52cTN21$ zu(Yx4`Ludyhuekp=9(6lMJvCJy>|CJ=A~jd9DPb4e*V>!V7&e6#bp5yG!C&g z&b+vBh^2AnMHNG|ikZVm0V(F=S+=e5g@)#;#us+~JU!*zqOy{CGc|aRWpLTEkWH>| z!0+~s_Wb!1e=_2pyRTDu#D&h?8<_XXXCJM+JXY#O2lblodi*T)WC7ap*FJk}?x{Xh zK~Y9jW}>V}eI^KI%r`4+$K|^2NO1zJYXi$0crZn=qZ5(8^HVH?;n&xInu}FJtr70s z_`waHk67b(-;26ZGG#byQ8MK+)|=5+3&YJAe{$pck|~$cG5S=+?uzY|lW?Hy_>+Pr zPI$k&KSJC1#`e*_-dMW55^Gow$du!EZybM;`_BFi%Qae-YSf|sVCyyP+Xy$~XBA(S z38(nOy?UJYBrL?wI$$)#u|G${{c!Gj4o8puaPHnb^JtI!R0Gn6tHi&H_Xj3mI8+Jj${RN-zfFV0nT$?e<=C?Qn(|vWip&`NPkgS`ZtHAcOuOF z&oK8TVeZB-e%}uZHzhC9-$y|J@8B1Q^{^vh@pp&CkCY5r1^q~IUL{Zg)F(^goZI9% zt^{>9Dow?G00fS+EQ|o)SWL~y(M!$Y>BKQsAWXndtdz^R%=eu$hgayoZ?QPr3}^2xE4aI0wK!>S;8dlWTH;LD;Pi@O z@!d-WfpIz?J{T`ryvSh4gyjtA;4<95W_95jMKag~nP5DCYH&scE4~IFGtuB|zG{+P zh$D%@XW5k*#58;VNnUqh=5fWU)dS8#6KsSup^4%vagdn5$iI9s=8abkW;4Zp;69sh zn+-}8o>7BNh6|ZgbTfrYB2*9tBO2VCgRxP#=4-;O zXsk@b2kjBGeT&(ENl;^vEpQW$lKx5ZsU9jy1^V!Cy2*+NPeu0#=!j>?Fdcp2Ex_4q zQyzw~?JNxAcL)4_iJt<+@4hg8tHEy_h{%uqjpE1it<3UGhJ)?00>v*kjNd2V=K&G< z0S)m}-(4%aq=6sD)e02931R%kp>t9E%=61xh;NpU=i&_}-*xaO?+lsHjo>!{IORiE z6Ozvz#;+3Y92tiXB_GdsHuEbq$;U3AVa$&g@dIh79Q42;hb8ds=eJwp8T16yfZt3! zDIdo~iXYyk2Jrg={N90|0wv$W@G#5wA^0tXANe_D80Gr{KeK$?H!+xe|B!Jq@FdJc zCMfyL^UGZbGxPfl{8|}7f|BoTxXtpFgP$tT9A7Yu^3A}{%#ZWmgXJ&B$!30k0KWuF4;Wt%@J_{h0ajT(-gN$8ToLbo}ORA^0dz z>9&H1c!mr}L%PZ?mV?%fOQB!(jj14gu7+Bl%4Qx&@D1h@t1V`aot13VZiU0 zkO@>+2I$Q5l)V3vVYD+r(cOvoN;dlUz?}gPhI4F4_RPntlDzWVGGn&VW16%yaN}=E zQj!QsOY)`|BwsyG$vfN$N#gHhyst><3Wdkue<;)-fO$)Ngl^22Y}R;RUP;v$`>=O> z@8Afdm{0rqQvId&XRXOYXc?b4z{r+7}-7 z(WTCkF|qd8{T7}%mOD`Dra*8_&lTZC{+U$Tg<`dUj*0o_f2k*!`BIa`CC*wE8=G|hgbDDL;hsmYU zplfm>ZR{|J`jFp9W9uc2+_kU*3%e=o*k>OT*HMaj zSn+K?rgi@oR+-M1hp%vzr5})o1-|8xhp_i$p4*v;478>9XCRbE1_g#L5E~r@#g^vzppOWhW`u}|FBxgM7YB8wul!m`#t$Csy_|CnqoJe_sa7j%;i^B!p& ziayRF!PLfZ4ME7RvQ9lkN$35Y1L}}fi$-~mhGERzP`{B(81B%ctx&{~gu27iS1@-y zwmgh3T^VqXD&1VUJ1X zL!xK5-wC{A+r+vZvmTu#YdY?uwBgFgxhC~+lBO`EY(2Q1Hvti0ly#DsFbdjLVO7yK zuzj+qwA6F_$+{guf9azz)#h0%XSsu$ab4x3{cX%q?}xs#wknKJWL7zctz!J^=lxx(qKYT)wtK@=%N+3KcS#E9{utv% z1$6&bIq;-Ae9hu>)A&=+hs6)S3+<7x^f<0p!1yao_NCh&=3Xx8$Ab^|oGh1-Yw_fo zM<9&;mN56rlKyr{{vpHvF6iBw zCoDYtyucC}-XrKQ$6wfNn0N?T)Orlx8P$4>uq*!nM&PH`V>tJ$)?@firPg335GNsE zGJa}ZWEyd~F5)517fJx%E7blJ4yx4p4P{X4H{$zh$WA}E^ruLP5~m%nl{k~WLE@D0 z0f|$_??_z7vqs{S7j3;ri}H3#obvWaobrAoamxFd$scIw8+&G-vIAvR-`i7GwWo&i zsXaAL;A&q_yu``l3W-xMF{h7mM}9M5obD_3n0#TLQdf1?U(*cv%rL}lDLj% zK;lfNT;ilBsJ#qKPuW)JDA%rpj!X!^V$D4@1RX!(5Cg5Ofs= zW5GNKL8Qxx8i24Hl?DjAae@h;<7b&jOs-8%GVsZGD0@yLE@k!*mokfTF5fIt;IHnm zyGi0qKVRaMd5Od+^9qU6ZW|;{8NV-aCh-G_Pr&mjiIe8%5+}{e64&uOB5}%oOyZQi zSK^eNaV%5t2cY9;nM%w!H-_gQ5-2NiJ~=N%oH7f2fz!s6iT?Pn3EhEEm+PfJ+ zKhyk{^w;qu{LA^pN(RvJvrs9(Wcw=`6bIR`6}Io z9b|bXU(1#F10Y`ul?Ei?r^;{|aWV!V`Ox|$b>^BS?L&ICmMQWS{vrDSC+%WM!}OO* zoN0!H67t#$%c+P4hsZ96Goqwe} zj8Lfqsj)h{YO!gZe9$xox#R7;J8n#p%X{2#MOJ7PE|j7v%-AxfWMX{$R?*U{R;g`R z<{RbuQwXt@kruDI>wf=Y-1)acEME?`-poZuKd!UFigZ!I-C>k!O<2it9%2>DRE^T0 z5;TV(RLQdl_r|R+R38MKV`7s$11Y~k9z|?U)sRPpTp7Na5Bm?e^sfIFyn!3&1}w)b z{-Hw7OV1W9?!ViPhTtZh^BJ7sgI!a1;Q~8Y3?&LV;-^Xp_hStx42Bs7cvIE@xcr?E2}<=D`ODsNIVe6|A^d z8+d4@q7u8-#O5j*VU@U)Zt?Qv_dn3T_KqxP*y{C#i_Mu!BT+(>v-=kt73=iX6CxmWNK}2>cXSB(fL? zaXH)-;{!#*C;L0XBE0*A)3I+>py=)b9q|kq@CEw(a^O?(Ly!n#Uzr@nZyEeJU!g$p z<654X-@}OfB8bS3>M)G_eu|%2zK7vpU#dXydjTG1ei?W{xdwjZ7cIlc?-BgW{GNh? zeYyh0F9;7azm4EG6Mp13M23;yBK*w!IFma8ehL)7yWnBw_Zs*ugdh3Alp%eu18(NW zZwzYTr$F)Jw}xhZ6D~5&%p*Ur4)Nn2I5WQv@I#Raf#P=wh|K)zz>nh*^5ZazVbu3i z{LK7#M_m^D6exb5z{AY%DEO)T;1EvndjyD?pN?{oq?k!MI)k7y^Wz@yb?~Qr95yO` z>I_I#?r#A<&L1ft9pUaUeh-76Dt~;3Qv8xo7|rs{M8E{W!T3Wu!d0LnoW`O7I5#qYH+elx-E?~0kEqw|$8eskiCxhKl!mUNWwzfgWb8fqsq&{(9wtw71Q z9&~2;#-Y$D`7Q&olJAx5yH0-N#@TXbhBfy zZzGcBHxj!3)!#Ei||vR_%NS|E2vb6e5x=VZgbh9 zd;}$jqRWM!xonZ2jvvG6Px*|pmEtwNqcQ$|RoO~PNk}p%zq)KS#Uc@aDqB|}b?hkm z53HdNZL|-uk8Z;XX3T-BExU&7if@&Zzh$)AnlEvVA>#GN z!s2viXJ=1e-**uIQ}F*?WB~jx!FMNl^Reu@b_>2zxKwkc;aape`})THv%RJ-uzS^} z*yFKdPq-#oTrJk2EvF7m&L2Ob`{KN3zT6V4ogUxX=WxBEo!+!**t3^*Z;Fljdmpav zd(O81vp(1LwyL#IV^?%fjCM9U_??L{`q*IUci>h0{np~|x*z2=gn>tKjYY83`nk;> z6J>=I1@<9TwyJ?wBvM~2uo^ZA$=rXhAx}a@BGY37yH}S~V3*dq@h7P#^TDuXN$vP& z;;y$3*#otAuWo-@tA6h2)ZfNkTJgr@168N6$~rAr957_5csi!KvU14win!XNk--fU zV_cAW!%oPDEoz7?q+GWJvoX61I!O=>s$-8p;c87KmzUV{I%cGA+pN-xyf94ujk~X&Q^ZZO4i~5#j=E#JaK2MUv z^_V5?^06mAic5XTmR_{n_V>>mTcWhF^*iTbZ`|0@vxW}kog*p|KVx9zhn2y{ml z9hkg*`);QHZ)l&@y;@ZMtJkHYv~S5qGy;8`CDij7rn3#)qKNhu16LE+uyV+DnBd3H zI^b=D?XydSsXw-J!Z|D754O-(iH4tTz|Md2o2reJ@=gLt95lRAHlCw}J4Snq4W|UQ zn}3vU_FHing^iT%XNB8=kKGJnwtaDU8%U7uF~U7YcA2P z0yuu+Ix6Qf3A9U`ri;0By0e6Pg7$*sPe01{faK3{ZyaXX`97uAC4q+atx;{YerNV) z|Dfi9k%ggkC^qS89qN4af~V||;z=*@r4lFaO(uU-EkVQK)WZ^|-UPLtE98;=3HwyF zPmJSWwNFgY$f6`D3Ms{z+5-PF%*$Pn(FMo^D>Wge$_5TZTOBUYd1ykSJOD8k`Bxi)z|{WL1^2Je zE<7L?qxUPB>VVjV*a=p!YBi?J&zVvzzc^JQi zG7Jv^ik}|FugS!Zx+#8^Fn)^=#(q+P;>SHH#4}{TYbJhd>lMHEKxfu>Bf=Q2K=J!+ z7{9~d$8@PLn{majIgH$|_v*nj2{bxl8=3m z;@1ltq@nWi8t`ZFQ=s_$5gx=dWWZ?fn+cryGJVCbFigH>a1Ulbe!FGnx6mXX$03T} z4PpFN!)?67fk@KvnH$D$or&KFNk=;-;|J1^zIAX6CZ9*f$-t9P4t}aUbHu0QgZBV_ z4dCZz1PP=gFio?*Paxt1_|bmM7sYQH2uVx61dfw9PE(-xJsei<`K=o5ra;jh45Q12 zo8vkKiY^}>=5%?d3iVZ>=pKWInQjs22D9JyK*u;4_z_y6kSc#15i^YZH{fUHw+#H$ zcpE{2j?Xm`&!7Wv)WlDRTk-1vZszy=dE|Rl#>v2waMHvt9&W{NH*hn*7r`%!5hRd~ zP>&z+4EzW&XrGn76W~_-mLtBI-)Xo9v)>Zn7xb0+n}s@~86j|KG}14rKc}Ws7eVYgQL5yYlWU@6TU))mN^uB;bPDuR9N3BinM- zcE!PBm^%#YUNNa|cwqPaC2^Oy;;n(*8%iq1#P9wdj{VwQP!fk3+~p+|I2)^+6Q~t9 zRO^&6H|mP8-0;0bk+#`#^9a+>>9xfiS*bIfh{wc__We*5t| zAkOd#)KrxP#-*2}k8=0*VeYwH-uVOz7>a+Dvq59d^+*PM1pV`Yqd^{9B-8F3=uv|w96LRd2l*Q%`dX8Ce9%7tub(p zZ`iNUpJPzI6A&lu42d({|B(1NJhLS}0#AYk4U$?%S2+0+pM@v+5}$@A`6`_870xt> z>v%E^;^axU@}D4a^5Hm5#id)})P*?pV7*rUX(s#{iBqQxi8CJcBK=f6XG)xYH%grL zPq@_-%!m-!iyaM-?c#GI*Hj z(7b87BEnPAJtXlA8OHY=J8;f5v(+FS-S^;U=Jz7pH{+*3@$pr0eL`ab*ru`ddgx%~a7t+jI|ym`|df4#17`9}{d-%zzaaQlvr-&yhA%VWQP^Vx6i zG-R{}Y+8lQQe5RMF4Ze=hi;X#)@CcNx0F}w@G1Qu;J+$hi>R@7NaRGm7z&4@6cDbUNC}<{`XdD55TEI5B!Ztu(<_>~tRP z)C=58I~!isdw#QR;R)yA6T1Gs=Wvx?{)A`gTh&j3Iq0gK@JaX1sA|~j34So+X!E`e zEe&r!J*UNaxJBP}(N1T5O9P^R>^yw4uD|7J{nNIEoz9+4UH`<>^O4^3u_xem)Tj0S ze#42L#MeD1oSqZ8dcKYF8>kW@@TiD_(|Dmq$^+4x_pMv$Jvpbq!hCXjBE^l$Rw&=Yrhkxl= z@@DUEgq7Y|TrR9s-PsBaKam=Gpkbo3=l6Oj!GPOcT`3YwV`f07`t-w(=`@S5lK!p- zwr+jZbHp82zw01XeEsP;LYLn9@@h}Jdw6eW^%D@d{cXL<*;=JHztIY5-*Y0X^>;i2 zQk+2*1MUgUO*2{`dBWRzixc*neKl09d1>21VL827s(89>_J0cvU;9}`zlH&KeD6`H z_;B&TTWf;O)}UVhVb7Lr3xDM-zERg7^mz7fTli~d>mj}MeTRMx%-Eocb?v~E zXZPXMhYGu$@Tu-DzShxzcrDK2t$Oi3hd$pk=Y*rDML*`gtoldIRrOWnKYiU(0gEov#1ha~OEHv!Po*{IWy8(=%s*V@`{H%Iz%s zesi!sSiE;}dC=Jq)Mq#KeC%LJ7maN34@J724%n^TeO0?(pABOoX{aoW+4Y9!2}e&A zgu1lr{pu$Xa+KMGVqNx856t|&F!KUWD8Cw@^$nhk8yy+lNIj|S`=|V)yC?vvL(q9R zsLwb$=T1i}1n6`YKdcuYa_BQX8Bn|vX-t@L;^439J6r$w^c+zSnmfxsam+cP7rDna z|Gc*ax_`vN1|yYy+yj08)7g-t>$fP~uhl)jaOl7G9DdJnxCN2iWhDc2uWp+2EmP9J zbm&Jthu?Rgd>wJ89`RpN{p3NKUFkmKos1_Pb7+|O8HQC*)P+?H-GAjQM^(MU6RI5L zNF5dOTIN;0J2Brss%(o8pqV9w#!s8`U5Cu5eR{*M9s0LKrgwupZT6q?{jRR}QAR%a zqodo|!!pu(+)?~J7{*imqdPB}=O15I3QIorx+mx?59-Z94|3r5&hj7WmPc0uGPztT$Ph8-eVw4IprT& z{bNx9npoCY0ru)oddjcXi=i*1sMO293&OEw-#^HbrRpKl{iUZhO_yyqYT&Ou^W4c@ zZ_o38qqiG&?Y*@|+Lh@ZH|cP~)BC6DA0h9Lu@OOeKUk$7_w=L>u*50%WimyS5K;4+ zgZdlcDV}m)()GLMeJHEHe%&LQu-+Dyv#a&;-%!oN@92jg^Ax$`tGD;Ew0+EW)<_Yy zADCjHY$CZXnOwtu+P?Lddh1U;`Do2v>SEOxnB2SlokV%JC)2HWy(Mh$``10f z1_!&D)yMT>WKz)S3F^fsz-v_RpF{;jHB$uwX82@)rHb5__WoHI>p6;EgQlRW{CS7| zk>@aYiN>wxxTEF;y?%FD*{6MdXM)8j&?rtUvBe)b^fV9qpiXB^r|x;)(NnM2Kiyn^ zroN^nr$Lm}uI7e12c!%2ay=gjcF%N?3hht5^DsKNuEWnckVzp0dOjr8G57fT7Y>q8 zbrb0Fb~(_ahDt0NKtVXB{)Ou5Ggala%=7cBf%drmg|afJ0m7iOMyRpVfg%(t;60xh z9NqOV2u)DmFQ~~=LX#tJ>lfB!wA2IzTy%Kn(Inp;U;m8I7_G%~%1t_sH>W|=(St1w zT^`x&p)PcLZtp&Ls1C(ggt7KkOY_Xb~o>9Kq(nq!VQ$L>(-j{Nr*NN z5{A0#b0r)nBt)|@xPZ=+!l;1!M_(e-x-(7s%)B1O+auR)Ii|25Q=k$&<=Hgr3-0*_u!#72Lv6EvE80%nF zIjr=N6HQrvr;bMR1o{@|hR)vpUcIcd2CW|wXmOrIe_iE)2~N4=&IC<%=&CIL9*Ue} zK#^!ZdKfw!cVY+T572 zP%Xm?$e#GyJL{jXF|}t<;S;LRUw2@O6P~5aZgfJTXDs`u=0~2xVBYOKiGfR}r>E01 zg9YmVhm;tAH=jOP>Pc|BXZ#R(U&#hR3{*~*I?z3HoOr_7@C&{5mk!W&9Vp{8NLgpA zdPAw_AXDGyIr*Dy3;Udhf2S9ob(}nb!Rv_n-M#f?^)(nah>pT z7dGnB3wJqccI&-=KpS0OgE5jw^k99%V2Pe`f8*ePS3iMtVFY8OURCqCLtpO+4Gs!l zb~L=Acl}x<3T5S3WY9!2-D70B=&CQ2?!nhZqG})vWd}?26l%VqEZV;drJLY(_5NPy z`xWV)a*zIc`kr!+lS!-h?B160cOCjaJvGRXdS_w1e)5b1ewFQ1E8bA64iBdFJohCW$&{59tM0Y8uCPq+e=!SsdS5JS!CV;*brvCRPBe{Q?hTK2)R6lmG3Iz$HOj(ea*5{_QcB8p) z*YECPWx#8ksL;J4xihBZUhy>lthWVeVTfr`ZD3jn?(s4?^a>Y9Zk$X`jgbaR?v#6E z^D83757!i%QVbb$J!&XypjZD$C^*oVZ|Jf^U#c&B9@7ZlsDEB4s2ZmY2lbtvn&*{* zAL~8!=ol`oe{KWKpvJ08>-CpC4b7^J$JqXd?1iegEu~4(9f&recQ4-&|LH_)ftCSH zNa45j)_d4KEL^59Jb)H^^uYt@Rytcz7RA83>ywjTI`kG#!>`oDM6=%TJlfs(dJG;> z#4z?2t-c23-srE-oJ8yTJ2BO>!6T=s-q%kacj(JK3zs>1 z{)9T<>iv@_AAevy#d~#iOX0U2p~k)e4dXJ;!ahgOU-aHTR{sbpp~V-Ca@R*a)sFJ* zXxAoG|G10FqNx`X0|!4p31xpLCI-+Pp>-22z)4iX`#cL*I1c{?>FQmWCW5}mUon2E zf3I+pqX(t?gcFl(hfV3?eX92_1Dc5D-kzO~nrHR;r<$1+YLt3V==%zX4X|+NE!&*# zJol)sw?(=~*AyG$rVFHdY42Zz%6K~#DmRBz9>e!js2my~2$f$E6J+ZLPa4OLN|iBQ z`bw4EQsq$BBUKjTUZHi99NC(+ZuT5T8`teD?AA|i61lv>QTTw4Q$07VI*5L+bpuC> z=#r{C8#X%nJI0Si&WKz_zaq89@MJ(n=ex&MKaPwpE&c%qIp|@H;lY!bB4??VQ#zOt z!TiAYbPSft9%^o4k!)#L`%qzvv#>?4|Mtm$=%IA^0@|$?a;U3gUVx36X}GZ4Q~#5L z%wP4+&@84d#b^OdX5rtrEnMpaJN-MJ!cBVXT2wpNhBeJUM{;Y}wj#OeZ}wn6?I*-L3j!L6};mQ9y-HHs0v5(dz?x*&Jv0D#{ns>*AK7tYMz;0*mx8bqx@;d)$6 zr+w}z{0+4`yjItL>%qvNryK9)u3545Bk8uje5^oBzl?DvEQUHd1&0t zj^bB3OnMB%5u?ZI;4lb%WLH)Bf5ZE_gTLycNmZe5?xbpec489yh<}RS?ZI?ND@(vN zUGGD?t;Nl9s*FSTiPD(ZHtL^zbY-YYH~Oc4xaa6~&HE0vH2NoX+%OACs_H*0udH=X+k0g-W{XN!1ZsXzwz;-LYphv<(uvhD z^M+KemH9Q-Eipms?8+)@NqU5RNG{e}FS+J#b8yGxC6SeJW2>s-{F>&fwB9(Rczx^I z7b7;=qT;lQ_Hk8~vYj~LJGv)|t75yXO+5CzFuQd_VuACex5oSX`Zn3b4$mkp;nj@H z*IJ7XWL%&8N#1HLDpK2IbA5)*p-Y@)f!dC7*nt=UHfGTvSI}A+XP=>s$tbScj8aqS ztg>A5Id;8XQ@TCPT2ZsE_>ETV3&q+77W1OD#x~9Vu)u=xfh-LparxgWvaH2H zUm(j8ObBE}2=8d&9VNUYgPDP>7~wrsc*hFwA;EcpEW7Z&Sa@F~yoUwz16dB?JzRLl z32$e=!B;w`+{==9dk?P2K_e#Oa1x#M~uC7|DXHpajv&W9A$xF z@I)HpPfoUsKdI~UX3fdDDSJ9UVOza;)oT5+%NNbiHQp+;825L_YWMi@{UC4h{@(_a z`u|<<=imLm%W(N(oGW$jVtrA;y|B#x0&hsTXz@MwE-6@g-?HT^?k`+fv}*O52iC4z z&#&ylMF|v$At?ub(+<_6;}Qbo2k2Gk4xM zZ@D$^w)qQgKfmlAZ$e^Ha!P6%&&UafP*^|J{|Hn3EkJDeU4-8l{P>Lr_btr9?+NEa zPrv@r7q|E)$87(v5C1l^@$yH!L*ILH`sMds_fgjiN#Fj{XYYOY_T2A$`Mt)NfArj0 zx#5Qqv%golzoF#Q+lPK}XH@B5W*s^6$D*dqdoHWH>x_HBT`B(J*R{yH<@k(}r&oH`H(olo z^oMJ%%(?B_8`3{}_ty#6JQsN7?u7gPSqvHfNAPdh^L+)4E#chn4^4rfIrsZRxq(*3 zKldzh^UfK@58u;0M*BN69FT$ExqHaDqop6X$6MVOS_5y3HbvVcAMnN1Kp_->Hp~IAzlDQ)zKukJ?+_0|x4>;WhYxi#YkbjStF*lh0BxAWl9X zA_3x52j?;foT9#s#OTj&Ls!AB#C6~Vi`0d(sxwa~09Sj_b0p621tuJ5=K&Nm?X5AL{;6ow%$r)J>h|OL}!br`Q{hUYvG_m;R)kByrkdn#5@b zuf)mYT8T5w>m{z^Nl>y0U6@e-rlHOYU>X)O2k@cJVP_haOX+KT$7hjMSm>n-ZzF#% zHsqZEFUF-jlO?X>$$^R5pHCAIrz||Pi#TN=YvPpUGKnib^kYA%Q7h9r{l1u2qYd-E$X*T4A5mUXZf?)8EjSy64i% zt2s%bHcX#~=-ln<=Mv(p+am4{KR+u)ajv!nE3jXC1@>6?t6f-h|J@i*ok!^lMlil< z?q@~g;e%nEJGyxJ-OCI6zkw8HWe5-QJZDq-xnlOSya%>B?{S@jkcEph_yL=RMbPV> z(1E0d%lxbFxxZ-nT^kk`-Op1tO-DSOYyUNc+-QFud-aPnfJ}TceJ(4U)v)5LIhm=> z!$_RGIq;;3b5oN<;U*HfwtP{4ZVj^CO?}yZ_o~&22~geOfeiIt>Aj$}zRFCfrC$$H z(IK%pR)h&uP4n*h@1SH9)daw;5d>=o?G1I9qhAX^G;u-V=T!RLO?bVg| zF?rI_y&OL?zcjcxCQzXGErAE|3>h%f#1CC*h#&7*G4s1ohRJ9l`91-incpoYe&}LD z{Qf(P-yDR=Zb7gl4+8f^oB1s?@k2Kq;w*mUn zPJ`KRa~QvMCVm{7FkR+H7k*~@ZG@YBhyo>F3p~tp<#4mlSD@%#f(P*o8Svl)HFDv-xr@>Ew;>SHvW_}qc^bf+1^2N(AmcQZnnfcuUetg$Zp!i(`4>P~lO#CLu zF!H-q>YE@L*kFvQ66b?y@%JtK;SoRUtl zI10}i_$yHS)H$t+Zk@Y74@s-&?vgn3l+XmaMFuMVl8!%~Nyevwaq$W>o+>N`37Yqx z%tZeNkwt!xQqlbfJe6$pCqEq?3|IA>?U6Wp+t?;6w!nVX{*#21^mOC0*00`w^49-h z%KiIKo|4iPzk+?30L)>px2){zb3LYQt;N=oXf1Dp&GnR4+dgey1YOlu*VAyNVNw;Y zW{c|?xOCh{30IfaWO0qP)V7a+%T>l1-!gGNAdVKiyKieP+&wYc&bZt&A}yxJbW=8q zdjT`uBLeQ>rS5<`uGATDJ4?OzxW3efsa)5$Ewe0JGj~Pw*tERcBR69XniI-9<7Qf1 zuM5#4F(HkxYMbkT5H7mIC)`$hbd%S01w_(2ob;J(X>#X%o7aLhxn2JR?FdZcV{&A6 zzpxZb$R&_L{-k^W+t_XXzP_E0!bDNpov|>_&OHLRkJuDZ>vyJBTQ=EXrk!oV_mK#A zJYuVGJ9lob*{MHC=aaTw5es&tjW z6ih~m9`HLhMa28#AoWh4pqL&z^HcDy0PppFaNP#3rEgZv4Ss;-zl@-#!tE$tuOp3{ za7ATY?d#b)-6G!3PitSFv(stdAIy9Gj$M%gzcv;#*%L=uqmngO+^_`}M4G&3U0ZNR z-h3;v#C6&d-0Z5eAS0JNipwmmSW3a{`RzmCv5PbNJ4Xinm2-^`A zd?GYLduGfk`%pj9i`;8L=DTJ`xw0bX9hhbxipUJUMPLZ2kC=BLE#!Tz@}6O0{#>= zZlA5gk63v#B2=a8m@C})G1w##NTTB1Q~+&>MCh-lF2+-R#B_ova-Y^ie!mrhp~)dYfkIRxUuM`C=OTh7W>6np&aL)&Yf7j*!|SCkahp8HU?VFUZ<)U?s} z3?ByWn_*X0F;tMud#5JcJB2HO;1M4`MLwsB=j1rGPWKC=Z(#W&fOff6TqG>&Jh;2Y zAknQ4_`o?D#rmb*lk<=rQA{ZkT?5kUJu525OH+Sic(O9yJJss%>zf{>lF`D`VZ9_d ziQO_4<6c(!tj3v24oRh6{hoCXPQ@B-~h=#Vy=|h6xB; z?mxTbA1qF)To07^t6jw}_m`2B&0+-cQ;(5X;-cu@s|r>IY921zoZq3X6#7NuVB%u2 z&X2NP+qPQ#T_XNwi@&UowQYBZzjMUjY2q(yW=EW18ftN8Y~HOCwiXHQ_-eq9{O1C{ zVV~D?%fMus2yE<-)#Du5w&e;jcuz<5pNyd-aZGu z`(nlNHua4=*1j6nREB78%l7f+V$@cI-s)iL$74+>8GC4-gbwQcw}^-rn0PE1ws{Rm4_nx z{SHMd?w3cjw~sj1j!Gahax*O1&9(^It+B$hv29w=3%OmlYjZUXM?iPPDK^Nrrj#9TgEGEvy@H?X^SQ{-)R)}puf*<(t!SvEyZj}A3+sx}q3^w$~X zhi@HbZC-AxZR6d`kcl=(2*giz&5U5OnXEezsJ`sFpxVqN5 zjhrCZHcYsTu>A>Ix~PSLQvcRKsn31@iIiG=;*R^$xwu~2J#?+>`q*IH(5AGNyKIM| zj&3$gc=-_eL8^YQzeTsVO<3Y*`=s*V^{8v3{E!Ce&-6h=QMlJc7C4cN5W}cz8z(RE z&UBZItjPPBP4S3QJRY)wW7Ikya#j}j#TFxH$pk^j)fg?Rvv0m7WTfel!nWqNYcSi= z#;`B=xQ0jJZfgGmZ-H<9N__aoVU)Wzeky{%9LLK4!&bSn{Mqs=%C@H^cf^%kip<&qWK!pC0g3DT)gmZ=85f7{4<@k6C_^@ zovXjxkc>o{ycp)PS$`xpZ^_vvf6!9AwROW|Wu+AzU)smi&eA$ox?a|X@_W%HH^`d& z8&4OPc*^FwIa!$hwVMqhL zhG<|%{$t^H?{@9C;JSj!Rrv6zF;;80Y7H-Y8Z&Wx{Lreg@p(JHtgzfQwyMH+S8-x1 zIVYZ;Z;AR<-<=WrJNrZ*YA$~mtMBOR+c@*KCcaa&YzxM1Z?fj%m10Q6^_uIkXnwRb z#cQ8ZalK`Mdrq)*z3+-i6Vqk{I=-l=SyVOG?%EV_Q_TFi=(hRY6>bKwYIz;n(1#|D z9CBxjYw4FLZI48{I;?m%ANnAqi#Qu}1~Rn{x9bUQY%Po zUx(yak$H-7Ng#g8#L*-2M%!q2(L;7e9*;U39TlY&c-OnvJA>X*i+vav7@^09ogG+a z1}!U0!#qZ?3_&`3@Ul7Dnwy~2#RZ=0D=Vvb{$iTuN^S4TS#w!Ccly^m15X9ZHV0$y zcJtJOWt-Q<1fD{NyCf!5U0r1{_Q}O%<(2-Xl_lx_wR7dMwuMr-j=5qil-C@wer}*` z;n;OcRxZ5_RcVW-(qEQ-EPkqwrEXu;p-9xm2)x=@;m23uL(zx`kEs?UbEHiNKh{|k z5WIjaM@P1>@hOgD(8!{1xsfj(`=XE!O)IAl9e?ul%9F1+?W2pI)7#th3d_PHcI{ZC zcKCgMZ#uSfXy4dd^LBsP-nOv*`3`@3=a)Z!BEmj2*RC~mwib7;I?}eVt7YuF_MyjW ziq8%$8m1NY=_d;p_N;ZBT&owZ^%bx6H2-{T_t4I~abGsqqi_~)#jYn^-mx&BIh_Oex-uo-^wvPSs7Fk}+^*O~K(;amvVwW{A zb&4DBfs-SajA8a{VfLgY2cGhjZJrr(tc^8U3{I!V=Eb8m7VapRF5bXCMFV-p#dFOojWVSl3fuRJKhVa?$)fj}Q4` zcIg$tlEl6El=S3-&iQ*v5?{C?_+&)MPa`wF+scMtw1JU(y@zbmhd|cg=B?}icCIXC z7qHVeYi_zfBe7NgZfn^?Bp;DEOB*`BZpXgJDQ$;gGjux)m*qUL2>2qRK$ zdbDE)8W7b)$byD;CfK&|^M5(7Lgf_iP$9gZ=OI+)Ia_sqU*Ebm*JRDL%z{=XFUE3I zye~u^XA_S%qZDmA-a4D&>|-z%L`H3l+KKo4FX;gnI;Cxql-+3jqGwu!)t2KG%wn{O z>h;OxinuniDGo(oR|Fz9#o-k(lH*I^6b{$pmX5e-V;N5jTt4Un=Q<1I$bBF0uTkB7 z#=DF$KXq*+#;1NPdGykoaYRRFkJ|sofql1Gcl0kf%4cP%-&GMY%ZIOV*={3&n_^d@ zZ2sWl#mHa$n(~vEbwJJ-xcY)hJI*@CbKX+cPc1242fwPS@ z)UUv~%eI_DqFK-`hjY8My-sxn% z|5Zcz!_-(=Y|!^CLMCft*!y6B-Z?CXlZ z>*#RbJKAz6;@(P&-GyYX*uMRmyOvHihM_MX3>4069l8j1+GTyieF$Un5B*@r7ZO`{ z)DpMn@sqf9NE?z-T>faSWn6i+qrx|?;1!O#F(i0=m1Kd><&CNu59x$@g862JuTB*{Dtr~ zUhj9I1A-{_$lJ#3hBb40`{p~NJ`$BDlt<=_k+@NZ=8CV_MMZ_3Zi_CkzaafN{N>>=@*7HK#SVBo+G zQ;f|vVMIX(cwyL!am94LEh>4@R-$OQ)@gY;#vD-~ek$j^>_d**(0Ct@*~mJl`cCkW z!#Wk;tnPq$nsB}amgUxUXan713dO4Jbh@go_A$`dikE3vrK&{hNU^thVf+tx*`*dhVVtcxza~8ju_S>Agald=7fbPvnvxd zHtJKM3zFExS1RuPm^5Y&1lr$=b4AhSo9Y+dU&8Hzk!ws|rKrGosbxE8ywe=#lo-w8 z<{X>JAm9-kUK+Qx7E^kmjKgw{oYX_U9TfEUrjSy zlcHYt8)z3y_gHWqw&={3|9%}fLAxZy4r9(Yva5_ZP`x^=g%=g zzohZiC5G#_7QXj~0{<*#1eDYDbJ54LS!am}Ts9?;KP7P4)Ik1Jd-N8y$_5=>^Teb{ zEgA;20i0B*#S`g>zhd5^UCg(&i#ay2fVY(-LNY-l=0e)VbVs|Gj%(*M-2h{n?5fbg z%AgAS|HU)KZ!2muUJ+rGK+St%LeH2U7xio0(6+ulWHl<+)s`vIy-0$ z!e@sKBz)H1Pl&0ie!@{h2NI5o?I#>zCM>};nxX7wp(ljDEgIsv=4m@Lj&TMC=XFJd zc^tHnROl0^c}+~z?!nc3C15ApR25+lK5wy~YMVw|MT?r{y4`9Y6^agt4H;Af!^INn zs)#g_Snpqtf^7&a_yu<0E$>K&c8rs?&zEgJg+?B7a|Yki?#>r}nB5hkv85Mbt}@Ba zK5G95eP5raeNf;_h(k4e8nDT+@ai0aW|h5F+`h|7kk{*F7^!dXN&!caW{e~)Hke^H~W;4HW)|M_bGPa zWcKK_)z6?BvYc#N^bp6mPmG*O!o+keHL1&r>>rY9w&dsCA9$#8w zHvZ*!l5=vBQ?pWXlXH_(JSn-E$=OMnSt(iBiQw)@^LTy9Iq6B6nW?Fnp44PdYC>Y7 z&y$&zn(50*%Y`zj=~@=#^yFlw=4NFlq$MXLBxZq&&zI>-&dl~fse~+#H_MmpP0#Tq zr6u{&Qt?boO-)Hm&4D72Gb=N}<4Mj+&Ps*pac}Ic=2Jw1wlDsKti4ZN3Jbm6Ak0&cJG2NG%p6p3O z-X>&cr>FSRVGLh#c6v6lD=piXl8B5>@a1X=No1LpoRpG=JkHI|PV^*tVBm!0oRlO; zosyE}OG-`1%t}gvU!vEOkeim7%b8^zMJXtA;NxA9iK(n)v4KQDh2O+5mS*f|$$>dE+@S<3x zBw@o-mJb=2fRdA%mYL>FP0UQsO-qB_(^3)>5|TWrzFco^PB!GuNyyB}Oi4uqZ*p#8 z4$6)fcNc)KHyP&k=A?ZtMjz`y8`C*uZ|C{|u6ZsJopbkIlfGUIKN)&2bxXH;0AK3v=g%xo;11|7VyxUpp>8Hoa5G&#!#@!G_bW|G|$00gvHl z)ryIRz!ti3)9|usOG9BqY}gg@+AzcG8-oApu<)WVcX;>%Vc{FX-2WBkE)H`C!rXWf zGl5MjGr1`5_rly2VeZGZ$+G_Nn^tS+hEaperd5a0KN05sQJDM314<~r6Fe=;BMIq# zDuS3MEY1CJOjiNJx8Yku0>7WoijTF-{@J1X7$el!km#ybeui)-X^({I_nDMe#dn0ccS(J>iTG)l?<1uFl=sFk zen-Oe@rTi`33FG-{N%pRIPDs(CoKIp!pdKhq^AT-e^yw2m}?-z?~&z)BiA_G+VG<= zd2bA}=O4n-iwFyUCM^BZFnxxEg}cM_X_xY_=EY&x^CeM009p9OX}4(iN%vM!zUOOG z!sIz1!*3JxcWB>``pgmTh1y%NBViJLarol+DJj3;g4d813tViMu-y-o)-2Z?FK%|=?P-9Prl!4`!A5IYX?Y1RT zpkhCSg#`wH?EsoZmH|H0{#*>_1kQ9Z+7md_87^@aQ?JCyJ5SB{ozlsNgYEYhFxk|eIGjm2z}Tm%9p;5UNAfQ9%GC!hNy zE`ziIab=!z1UN#L(OV_XxVKCELUDyXW%*(;908nheG+HfLX$sG%`%&R4c*jOj&UqE z3U8xaNo6_u9B|LH%t!LI%r)rE_7vrT9RWbdChLaK5jfKk`)7fZ#}xc{FEx2wCvoz) zLE@w*SiWgIMY>W3k?t*qzetzH1BiMd>kyM40i1lq{%+vp!BH*!$zzVh$>T1G51OtV zDvETajv_5NgcoT6XWWtG1Dt71kT~P9+R#75-)ztM2m}cJvd#*zg&wqsh>6nUwTg-@AV=v1 zi%LC6r6pdF)8eUGPxWurN{e@G(ch!i(&m5PwZCs>&7PSg$ND^;^FQZ%X3u`tTHkut zw=R3_wb$NzZERjCp910q_=C*Are)_H>~8>o82hEaGWIt*{>FY*4#e2s>|kU6C}jnCbYjWdbvudcn*KucGMBG_MxSH18M8G!F=7ntu}P!=B<5JB|Hf zr?G*Z5CmP1Cli?A#vWkWL-8(l_H-)`ZSwMyFA06Bn4e8?a>pQ};W9X)`x36Nebib_Y{0^Hj(048hbr zPcU{)T)XYDQ9z76(ymPTGb0e1r8fJBrEF7yGg+~a05)Q#WzH|aw9E9Lz~uh1=#cvf z!9MIS=5YZXmf>>2OnR+grf>2qcAETlz!PF@7JE$IzvB3tb1pFBO~;lA%y?CTscSe_ z06+|9r-N~bdNO^E-&umGYtGm3SMiQ>5WCmRF%CAIcG*h1HFmNQK}>tjbujbkl`=Qw zEO|6-b*!U9)l6V=n>Gead#@LNa_40PI<*lhAH$FIq|v_1M~ zve7|s*c;5euvqC&zWJ8_5)0oTn0b6!ut|sYg}6*-m|*%F+obK8dif`KLcWA8^Q#8( z*#UzYK1DF&l?kS86nmVk=Mj^(l!M8mwA+}rDs9+Do-4`bymOv8(ZOhT9%80dESNT2 zESR>La)1ug+$jD`^I5@6liv*_59?^5U>~sQE8x$1r|5aal+R+vFP;7^4mSCcbBD=S ztK)C-CFc&Nq34Ssz?o+{Iy^*)$<3lCCb#JyfXU4!LVt3bb1N{puNHrDZxqZj;pY7o z{vhPaoMfPx%_a`(taAKKzRqwk^`q)bjzNLrdoip=l~g+KG?-Qf5$dA-(Sl3uyy@)IL)4D?Asd^&I` z@pSw_%CYIWxSE&^5K@cHyWBuCK4DzGbI&^Uu5|nt5X*7eNDQ4O=qwi82HZ-_Ku9|_ zZ(xxa*<6hIpOhzgGOW!GArm)Jqrf)%b&?V#{P{*?}KJ4!ooQ?epf^)D>M*UG|BCzRKf${TX zia+b^G{MNGXNq9f)%k);fGY%-0tW@Nei{X{e)#=Nrd11krC>kswSrkr-x17m+9r4& z@NU86;d&e7VSTzq}8lVw7TNTG|Fc6QdMEBe`F>(3Dgk7R6OG zbo|J)6WXv0Yr?H^FM1az+|r7%D5f!nVkyH5l38ss+|VukzR39ygryqqFtbc?X~z)v zyW$@#b?d~CIJMqKB}6I2M0aYtkLXbfG0~;XHLP$~pk3OQlI<-It~7-h+YV@KYFydi zc*k1_&#Awrj?l9DruL9L+0sW2P$Th`V{+qYN=Jd7YM|VSV#FliDE3bqPcMed%9lLA zGq6I4R!%@0$x^g>f+mjwP81_10Y|Za+Gss(AUthiamNr=Pz*O3`gNc?vi(pxA!$hL z&#`184%~LEcZhhox@@LRYF5b%do+TqMH_WY7Ob#%1rkjK;}$h_;%p9so7y^>EV~=| zeS5B^sp-<{@Nv;zzoNb^IxLbSEJ7ZR)drrX&Xw(9kA}{Wtbv*M0Mau(d#Sz~P8>~B zA~Y6ToM0`K#2PV0szl+F{s8TYryoP^G^KtREhViEHZ0VeSvE9=l$FX5Te-QV6^onJ zFKt}bCS~eGThttCtM9nfUCv?erOP^-a%WdwcqZCI!=+J_Z0xWj%CBu@Ypmb0#u&f) z##lcdC{cWkp{P|(jlnoT+E?O`SzO<-*kyE7kezokX2qJEElU^Kd1o7FU(tldjFE0@ z%hJY3xZO-*RFoQR85B_+%*v(Vbyedm-iq{aG=!p6G%01JRZ&`Ts}~1WeJgU)+Im@A z2!*)e(bAkr2(z}3Ts*JtxbtnevMU$$&z%0 zt_oFaor*GDrJVy=NLICwCzILc70cQ}ovYh*{aBNjDT_8F)27~9?skY$nFV3h!9y+D z1MPA}lk&vm#R}6jl!_T~f@5N_I;3HQ+Lkp&u`?Pr)18HT6`ZRhYMM}AnrZ~|)3Wq3 zrV=Sl_~9gE{Opc-HG2$qtvH@ax2(l!OWZG99m0CK8e+jnQ*1XyfEuzw8|qtImo?aj zrcy9J?JIF`YN%#3jskRZp@!qUvwk7=tJ}<8mgLPXXGrdJq!P78uXFJ`fd2!-_*`N{ zUiN!DAHh!r(*i~cp+wAUYYL_Zq9jFJcLBKdIRB!edba@(`z7EICQ&#Ca}PG!!!X9X z0>I|;!;kX}D%7K_0wDI&0XYJ`Z0yN52phx5w-Iv&Hs22M$Ib}#DAz*I<{K*9M8 zd`}7&cgpu=7hk)T-;*r9OAx`%?=HCG*>@5A$?eBRxz)1oWVji|c;^Awe2>C?FZ@-g zN0|;l?56|rBg;O{<1>tWuK?J5jW~GX+4p~3e9u_+aXwc0Xpha;4nCPWhL)qp{lB{S z-UOf4FYoCo->-1+*?dRA$1oMezknXGUjjzpJ_z%{_JUiuVZMi4d>?}E1c}3)^4;&^ z%eMH&SbUe^;Ir);jD|fp4&QR<+4kjGd}A%X8W&#%_;TX#Rl4|QfKS`=IE$|p2eWNo zVFLSZcctr3ptlE|m(5oSJrq?~wET`i$=0ieUS?P;QqCVk$u5^#$SADV2KkI(z!7w*>%fv*{E6)l$y zF1}-yeayGo_X7GCo38+coS|f*M>nO>v-D&w-4beYG11BI6n$LEx+@itbFebjn40W#N#_iD$4gd z^oacuP=foOT7L9XzOSQSw9D@p@|7)dxKqA)(jWUJ>{0NkeKSQ5Q9V;!d_MF`y%L8z z<;!*PWfVllB_*OqzCEt|`p_=uucCYpx$?UPeA-XWf-?0OZ;Oj>BKXECnds4Zmy7RK z@MXiF^~-)n`I23H)!>_ma22)h@90m7{SvSTd|DqDz)$)9?CN*dfRFEpsVLvuF21~} z&OKGySB_2j9&y#j`Y*-rUv|6dV>kG;{3s)-dg73R(oaoVcjf?LP_;3iD@~aj- z)(6jfcKa*Hh+n_QLC-F~W0rk9KWKj6aoOhwUopZ}wESLo*_VkZM>2A(s>gA(oIJ!R!P3H`gB-_77-y{jl+2K0#i z65t1)w!d${Px+3z?ArmpYKg<0^1b7-Zyxxv5l;ISh#u|uWpcEApMXy}5FEw_phtf{ zJt1qr$N1!1h>c-%Z*lP*1K$Mrt0?zfF1{{{uMx`1cLe7jyZo|o5#v)b(WCSC&|@4w z9gthWr|qv9ZsmK@#a9A8zQd_PJ<5I;-%H?I0DtCpF*fD9%f+`n(+Pu$5#_th#W$lc zQhrOIseGL-z8&C;SANS}e5Dp&tHn3P)t^2CzKM=$QTFA!`qNtQk%#$RicRfHb@3eo z-|r2R^QZasy7=~k??$MQuN|B6{nRyXf9WKr-8*cNvV0hNjN_MpYCP|w?|3@6f8KeK)xHHiA#{+iCG##kU!J zd?!vt?K{uKcPsd47x~s;Q@%f?N82|77v(;Lt0>=F&?ELsK>9fm`*>Zgd@s283c+`a z#Nkf)u*_r>-vaP0KsfDNi%t0+0%rEmT^czAJ{($MQNH`(L+qE3{oq3qhHoAA%6A>G z&G$U`aH0Q0wtU82>417pZVQj@$p!-`6hyI z7yMMzzTd*b=9`FvZ2|nq*Ck=JkMnLe-%H?&cYK6g_H6{8=9gv0w8-ao@x2Sa>F`%k z`_6IkZ3mwo9~+^pe2u`ieL17z*KbJT__3!vZ`t?Ha4R3n)aJ_r-z$tDqV^TTP3#x{ zcP+jfC5-tEy85e((M~*xW;lo|T>VwbxsmpFGs4xrX)Zp#8^Q5|irSa&;>)o3ZiTY) zjRdgs+X+6FuZr@W1VHSUfYIRFgotb}w_#%#^ZS?NXg)sJ&N)yO<@*qNHs9{^(5|3I zzD?Ma?<>Qi`Hp?X33Ky}gr3d!gg;V#cUpYMyZAgl=XrHE-(VNtGZx=wi|-BLn=Aw) zeOQ|Sc~fE8a{GQQ#% z`q}ee>HkK`q`$LT-FGz;?_03 zuB$iwI4m4>$Kjnr9(nfFGO0nW-n&&FB4j9a_)JO6^N2eC+a&kSR_Sw)u!p8z>{xO=%1ciSiFBf5*a zpWQU~+EehoA+!Et_wX6>%#xqob5}jEbI_h=O)j(UOy)<7wp^bvqYNviZaCXB>Zgy; zxhem;ZlrTs&y1Z(W_4UH9(?d{my<%)V}G6XZ&;ap#$!FD`-Z-F_`OuKL^;g<;AqaX z6<8y3#=aycfnTK2F%)b0&UK7??oSVbbWoV9?y>iF4$65}^qWTxfpLdXP~(R-NK8|b zb-{NW=g_XL4$;iF;eovG8+!1t<8#_uqe{ANTDv}D(^WaoUOPQ$*2}a}nCss5NLH~r z@Sdd9Cwp`1Q#YY`u=r9B9+oxYXWh~pZc~W>*44a%ZS6^XqNX10fU94cuf?GCqygVM z^8d0O8T1xDki?G$WPSR#g+1wGnAWRFXbW5@17FvmdtcfWgOOpB-ikp8z^661#wncZ zu=r;BV?Cy=IZF-K1+gTj@nXIu*Z6FWvpU_=LnRY+fABo!EEtG(VYHwi>!%^*L@OLl zO9;%cAHH$b=?m@P$txCF@~PgH2rZ5}yB=L^YE+ z=ko~obVp>3~;nl^E~OJcJNbChJFn>7w(&>v*{@pWCZAfO{(0N`bm5*>tG8HZy4UJSdnFfq738cOScUuyc22R7r zioT0{q`oePTii7@t$N2XhqjptdK9#&ZF5wuOvwrkF=?WN%{PaT?8E6!6UGNDoO-Ui z4M#`{451Pa8z?n%d0HI(9lE!TB@@WV7ybc>&R1dTD znvMk2S$p~J@qsL}X8lS0c;GuJFga^mN>&HyVFFGW#)N5Tyi6`)R2B-|G143xXrayg zoYJ*f$HRtev(gs+=4U)wSPa@~*#@}qH>vn>DzonLqLD8hc)2$zc~IJM#}7a8es*j<7;pI`Tf6o z0v&kvs-vT&+1JoozjP7Ta_itiag+0M@p)xm&f?C__KveBO#$*R$P%u* zc8BHWc!$qPsL*}BS6$9{=t@_3PbAokm&RK5GyY_kezl9w>(YPErN7g~f3qvR&gDMn za=#|&&4EAH&H6vC@Dn8b38ceyv(`y^-Nt>q=Qaud1@=msF!S_R!OYXCC`-m=p2iDio_Noh{v0o# z&2+FaPn4)KmvS~`E@jJ|mKE*R@;7BJWkOrMm>;6hRxKaK)pdnoxKA+Cc~~&hp=jG6ueJwczto+vUu-k>OWiT6y7mxxiOIooBqqoCmVcGy zf2m+{e@igADN*)FTQ&CZ4`OVPwr$FgBoI@EVslIx;vNl!$4sW&ubCs5x)%v1RfAwA zXY7PN{Vx}Prhk)Q>aZUpCv|=-m^vQ{rp__J)cF$IlGrd#F!N#FnTJ2~(JcP7?Fqq* zOVRQnuhtjC^xb|_K2i>*e5eR9Wg_M2gIn8}smD}m;C)bRx=vHRU~=P>XZ*=MPcXS# z1v7~?f~jxH2b|QuNBpV(Bf-q$gM!&+_F4Gf1k>K%2`2wLg30-*VDj+Nl{S-SxL_Z! zIey{KbUnFz?ljSZmf^?y`+jLAj#|vqtT8Xj#CvYjQqspc`D|*ucPRL{xcv?V_4K_8 z`+3!cO^uzc9eh|e@hcYQ!R$Wl`7AGGz?@dTKas$eaFNN26OLLu8{%swDqr(FbBClF zk1qPH41M%9w>*T0wwHEv=4!b|7Z~2)$Q5c;Fa^H2r5TUBdvg1DC!nzf4;H)L3HV3e z6VP`8q91g(t%`m$8x_&lv(0wIMGcMo7&xAz?+h(&YHi2hGPfb}@Up2=K1Uq=JTZ@= z0m&4ci|`9e2F47$7ovhg)Cl+7aEKZykiG7BJX2nRl3UMjLYzOVeFg!)y3BdKaSBj`z^4|hiMA4h7G)pDBpj;MeH}eSZl=Mb~tMQ$nQ~v`92Gnb`{9-95VA+%kG=jZK>}r zT5->t@a)c?>!D%YSB)<1UXJv;>*<<{`Q|b8y}hFfvR3dL6PP_o^-SN|@&KsJH{8x0 zT6f~m=Ilx9w))JsOYp&~w61*E+lJ}kJmZV+Up$?LX(OmMq#f6s^^teOC%rQ^tzEzF zCVbWL5u~+t{g#86j>&VBPQ;`OVy0imui|!b)*LY(Pd>PO|N3?K5aJ^yXd8k!?_4)B zDeDC9R^0M@0IsgB6@$kYo_^rD-ccpv3z7~z)0>{0n(QeYL+eEco2`NUrlMznfboXrjAbE*l~?#`*i7ithv@)-_qLDIMh?Wu;H^5JeI6m*wBby6MoJ3 zEy8axel7Sd!S7Q1TJdYcZz+Du@N36!`DaT_V&U*G*OGj1;QM!+H*I$6RZI4sH*Wc= z>c?6)Kl9?<>o=WOGWwk7mhQd(f~|jamsZvW`Z?|k)lJ168f z6<{TyFJRV)>kO(4WX|YAQT`$JUYw0@5x3JP9&fG>=*9Dn*R1L%3fLu^vykm(tcWC= zvx@B=7WKRt`gdgOpZLkEgDvGj9aU z^CbId`tv+eNG#_SlV2Vz5R+eEnnyj(i!gnkVA?fSF#VVob!bbzVA`T{D$LqU@n;#b zT~eR<-Xxg$en~LPm8THuko!2nwD)Ae%tuOU;ww*{?_w5{a9_)~l`z%Y#`ooQJa59C zm)oOXWOpLUtL#`}rma2l0w5D+2O3(qve~>yt#1Z~13FgXW$6T0JBC@`PmX#GS1+@S zh9=;CIoAZb-e7eo`D!Ty93dlTfW;xf2bKV^0-@+;d~Q zq_DniVLPHUK*_DgwxptZ-+&UaUjp{P!G4g_skDb-Z0~bie5LT4jZH=QX1Vx2wD|1n zms~`&?Yj|frmLcSr^AETF9CTV*$qtlaJYu;qm4G-A-L^+RQWWHAK{cE79V>?>XB=; ze%~$^<*O7u z(xwi}rh_6o2)uHJ+OMq63V6ixR$0L=sa$;W#f3_lJV^TGZL zN5kZ)(;_45{>Ie>c~b}c97!h=f;eqI@pB~8#w1;lls@93Jt?RCc;l%@7dm5XemxOG zJlubmd+UENqil1p&-r*`-D75yjqxl;*=I&Z*)qnSR)hxtNMXKJhz~J3=6r7d(|VFB zlG9TcWe!3j8!+(3czf%%?Vj|L;5JrgU7Yd#p85IPdi)53jjygBK5@v}?)}|Y?OH$l z=B@a6@qTB7{s0H@bAuSfgQE!de7V1=Y&q^Cw!A;8IqPN)+xOHz%{#L#&#pcU#(gPf zu#8)tS;y^oe^pQO8DsIK+PO~;>MBA?6&QZ|aaVNEtLDyb-H_u-vOe^te##;Hbuwhf z^DWnzA-msEO2uH`zmAsx9J1d87LY$YXz}~IHVogil|y#t>HxMKXJ;n_m3s?w+@AufJ~2(er1{JEio&KUKc5a}ne3U6u9o8@#`IyQs+j%Gd8dZS1b( z`g?9W`J0<}XY|&8;5lh$_P3YRKbKm#=e7OgZ%IFI!Ss7(9GTzPJ7&>G@4ol^DZfkY zdHSiPm)w#0*PE}}`qUrRzi{57_t)N8y8U+Fu#~pxhn^Zf@tK(`o12?f_{_Wh_2z?L zdZFT6&5UdO|K@UrT^h$gyq5VQu18L?I>dookN9CGWto?K>G6(3{&~GYf64-EUW`sJ zigIUqekyLBXS|-Q@I7muPrT*}2>>Fo*C#Tt4Tp2|8^q~7!F82*C_XjSw-s7%8Twd?oOd<#`5qSNQYLz$n54z%?=yK<|+jVJx73^DddlQH)2q61>=aZERP;&qToA7S28jEZxwQcmcj=`T&eM=S

      6&Z`I^Aj$9d=>`1XJxx|l3snhbvy*|$&+@pkKV170;6d6G}$xn=j^?i#m1)7{AZ zcFvc~oepErA;Kan;-PmsyH9i;eq@er9X*>j0IyH%i{1O zAieZX>-%I#FJuJYe8^|kt=Rv`z*~>L54j^NGTEGX-kg6+fy-d>uA+6DSu~BZHr$FhucVuR=|JgW~t@F+*k>tdI&d^o~*H)c#NE0uC;YZ;x zvBB-AO*IGPH19ioYG>HH-MRR9o2Ir_Yd0xpBrVmemiS-nYa4QwBjd?k;qcGPZo6~T zsph2D3uisEN1nJf90p`fhq=*{RazQQEf&AU9JEM17SpD2-dB@4f9#Ullf0U#O>=c> zE}uYvuWdZgu`tC=b>=;m9#|m z-$wu2i^*Pd`gcn$MKeo1IR&08HjUl?OE$rlpkyExB_VZkW>3;XCPi3O7_`98wP(L?!qzUcPakR ziLMc35x-7({{_z%@Pl3`!JwN1)_!QlGkRKf%g@ZsvnA4yHcCx!dbK2fLXvbi$@`28 zxlor~J??H9XC9m`weKjZQr}4SZC%vr+aSlwDT{}E{c?rx5MuA^f}FnE`PK*Gx5o$i zsa$xrBpkI59n!iWxRPKh{+@HbZM*eAT+N4H4b|EwNK1C8zjCUzNfld5Yn@9!Qu`}> z=b?(Xpo;TQ#YetO#MPIiW+wSe&+KKY2#0$&oQ?a+3dEBM%4-tBY}s`qB7=*W)y(Ak z0!~VZs-xDER1{7oG-C=W9G))oQbf_Ga;&JPXM)Jr$jiv;_}_yfkMhHd{Oyloi{PV= zuBmgaT8nL8E`C14RggCWd!Ag`4I4MEe{{~xH`lM(*zlN#PLkdHpzv}tZ8x8e^J5P^ zxN74JaJb+!UH7@7Ag|!oyuyN_941K2Kbp4`#wvXzax=5CNCrpPSR{0U490?;I1Bju zMm)`Ir%IH;VyrA+ZMn)FgEoV)u-l%a78Wd0|0Vj$`YFHV@6^sDWAf7!<4)&s$u!}Y zjGaf{HB|akzZV-k(0dktZ)E(Vq$gwCzZdhq9DKr%fBFs~nalVkV<*hLG5p3c8S&Gd zWx~+=<6J)7f0}eTM&3X0_e}66vz;PnS9m)@W0Mr_PHn4c6#l{7j9&^5r-akwPR7LR z?+l_z02mj3;vNX{mcp3{j%a!v$7u=^OY_X0`Z**Q@eouNr_t2v-)4e6%~_XmdkT~E zNBk~4$%weXDk49HVd5PLG|^Iu9sgjK;YT#_HgKAF89&cT6t;=}!BB2ZAx9W;CYt=B z3^JOWp5ipcTuyMBpe}Km;=;mGK)?{6X*?r!9TEeK4ZjrhU&!R*M>K_tt{tNZ zV+p4z+*dgr2^ahXb(-6g41eIX3(voDn)FG=G(mqd9df-<7%8MY7!r|aa*ysmU9-Lc zhfQ(r>EQ>(F>JPhleT1TT(jz7ob;%F@H;D_uHq!kNDSmN7P|JajSVZr>6L4_i$f{o zKGNw}v0c^>sNsyO5b0W6{NU;}w(Ig(>WB2MeJo)Zn+Qql$<+_|;WR8x_05PmK{aF8 zAt2%N>Ju}b2iYktilR6&{Alg9kI-;=*nZz@Y_BzF%g8otgRX(6@ew+d`S-Dg@m&jy zZ4&quSR#f*smX#f-2mnTpUq zV(9y0yb5OQyHOyE4HhO2QiCVayowt(_dqPH%;I?xzgRxuX5<^HrlDcMqqF$r5J00gviAfk*d%81WXvjp`s_gsim3gy>@Ku-Sk| z^|iqJ5@1HWd*If@{m?_;(Oo1)Ji33I>Q0I;Rlx%9h8VmPaGQ*uFaj?v2Cox%#7B74 z>4@#R1 zJHn%;UEs0y9q$N^nf1Wi$Z2{AJZc+^c=s6alDHem@o(^Nl<$4Ki1r805xi5dH{vw` zPoxL6!9u=6F?f<$??Vw586n?GF?emjqr5=zr9O$kTL=GOjl}l~-Y4T-7=cIMcqh7; zJG^g*uh0d>w=xDV1BHkBXu=3Q`i8v`&w)%Y(l-sv9a5{W^`Kr zFXm3B(H)n>!)8c0r$#UAlqPT*F^wJ7N zHuHIah}0t!vud%#tvce--<*g2!weE& za@?Rz@@4u=-0exY9WZ}o(by;(gY=7>Y0=-PZ0hmC{s-XlhS)8O+YxR#jI#J%L6T7JO8DgNx7sO5(i+OuZM-yPlrmvL$Fr~i|iGU|pdB_B(qn48-r|iIOT(U#;Im~pB_*4z&_Ok!EiTCe0YjTzPT5BTr6mVfAIUSU>YJlwr% zXEtKQO0F)KK6goKmQ$q(#Zq>cF<85bg+^tLkZ%;&ZL&FYetR#ldiW{#`QOi`Y; zDEC+hgQgDGu~Z;M>u8$8w`0@Rr5h@1EAzDtn10&|W$f^o&O@_FNQai^O%GT}XCr%7 z?ltNDp~k3B+;K*>n*zMrH7U#VV2Q!B`#FeTRXJj%+`xL&Y7h}Po$UCKlkQHfuio*Vn1txJ`hAs(gAZ( z=21&!{z>aQrmx~2a3D7F8E?H)w&sV!axw%$z$?8wT$)q4C|$9Hl6o_T^3Rx%DQ(iC zThhzw%FYf82Ju%d@pAXhRH_B^JnwfqeM>nPxx1bIy?GrpM~6Z}Rgz%}TDVUh!5y*} zlt`r|mSRlfmY9pZpQ$A#plM5bFuA;#Wh#Qw`Kn7ScQL-ZM&he^m*mivAR+bXMS~2n zNd-Lc7VMooCj^C{F2UQJP%TKiRPA=k9VH;Gs1fGuk>x7THmN4T%9xQa}=>HTP2_vD<%wS{AFqNrs;_Rfw`@}hoB)9jgf9$9EC7AhFe z?cmwUTcb>>3mL*qa3$V(;2q}5F{Zh(A)DRxdA^16ghSzQ zE%awcGnS^@VPzKVEl+uaRXMz(VJ(mdY+XW4Gn#2GR zpQ+a8Qelkvu zLsz2&bweCVM)eeDKa$+WUevvlTlc^P_Uhie);)M4B;UQkUoFRzMCg2}b&pQUGfQtL zx%F^i$7+1^8V0O-O6_huuP20^t;HY#kqS<6>dDhs=L8y3sIe|3bQ#Z0 zmoq63`lmQGdoVRVxO8055nneUJGkf5{oOrNk`E`S4u_ohO2E23u^eNS)Js~DS~&{x zFiA9fb+%g>7q|K2&Hu68wkVK$OS(Jc*dAXqHJl!lbM;6l`#)D2DdYJ&cO8wp>&?y~ z`K)8g@{~Wvz4?coFPNL>NdI~9$~XT!>h&M}<=ry_6D4KWsLtQF4Ll&Fzxs;*H*;F$ zc>fX!63VG+<>=s=ahko{A_cQ2kyT<3v+7L^zG&H(ZXUcz>UGd_l2o1TQl59n4*91$ z&<0FEG!KQtCv9is-`(PrMisZ6+tK+Kr}9IoW$v0q+M*No&%-ra!avVmp4%&rhpen{ zAen;=in9OD{w@i=hitFkQgHA@=Nb8AeCH@>ASl^w(!h&Svqc)%BiYT;z-|epWMHqf z{yo>}Wv1d2u7PFJqWz2RZN3yn@vIy(@sh5ROe#~bStd1Bz*1!2|EK3j^_df8i0Vb^ z@}X@I1)ld;SQFFe$!+ww8a>k*JyRP!?nX~$qbI2rpNM`+YOJnk^xRaAT;jQDQ#E^= z6m+Ncv)qjO-c!`*DQxu2ZY+H{=+5isYqX7?xs9GVjh1Kt^h)ia_t@vi3I)eZWB4atB(#IbliL2Go}=ODY}0#A}|SJ_h(WMRU-(qE(sdQEVtzfvvg5$^@nO+1|G z%!;t9J*lOh@dX}5P85PNo~5TN2Z}Bb8^#XCb~!eIfw9G$33dNXQhq6g{-!)BX>q8H zlvI=*HOr|wq`Fiq7$#oQ&@Nkd1`0xx5EL|ZG-2RH)<2FrOKbTU%3PVGH=TPwI3I1e zCSD5t4IVHSq@=28`~s+Qn!f_qXY0|Rcx*9mzO4LIQpeg`Znddn;}-T>sM&%)q#XL0 zW+fr4#rd&>XXh&M_@AwGf2C&UC>37~eoFHMMIPYcDK~kaa{3y%t}-IJ3Jz>! zat!ZA!isbPf6Covd4l{VEGRY;EV9ElwQ@pHLcpwan~%l^a%+6y?p!-^q#2oW16KK` zqT_VHUQ-hWt9j5wEexvfZZjXa0khO|V}a)eh;RmV#oKy)fdaQ99PS7N;@d4mXf!I~ zGQiEh$2(GgR__b%(K-T^@%}yAI%C!^x+TH|PC*6f7j$JK(+rE_b~AJcZ5EkG zi|L>vP3WfPDyjINt@I+q9Ayb=bL5c^c+4wJ`|+iN;Wl@8`pWEM^${SPAW1XGVYM^82yJ?E&N?4Wz9@-C$Z zWgZ$)tDdR)M23hPDV)a-I?~I4#Wv5euy7GFsItUby=VQhKq%g`XCw4=hv^}$*P-LV zd08MQ{vj>Lfss7oK*JJd*&VNZAw8s35+fh3h&dUS7g7p5WA&t_bn&~#$*IaFb0Dp4 zSBd;ZXS>sX{A;;m=bUj};c#brXK(xqjsuR)Lr zx5PZST&im_H{Ta!xNDxHBKAIEFGTrNDPhX1TWe!2 z>wKVpg#mXdW>f97$C2hlhcZ#Cp(Q+xncH5|P!fAndT6fFPLsKI)@$YU1gQx5o*^>- z;3h;5I$#(AnoEFbVcXBFQq2+Cr)OccBzl9>6IkbmF)}pZ6nJLxcG1P3nN&UEMGuEw zCKY(x;=RB#iLCT@E{oeeA7!n@Z;CYFBh;y!S6N^JFKfg3{HT&ieF?JU{bbcMpMZpo zae8#VvW&d*=~2}^|49wq`3mTVflwI2Aa0HB`N|W--!eXl(5N@3&%6>v(U{NTT9QWT%!5X_u1}vM8-)*}mv*zyrZ&YWxXxnK4VIz8ij`PPG%HQyPpAI$Pai`V4j}EvD9;Sfu~x>*DlmlNZQ9rh2+jon|Nt6(>?rdH=|)~khF{F zdt_&mM_oV6{vz22q);}}0jYP*Rt`8?X~4|ZOA;_|v@_L-#KTw{UDebCkm!~%eS#$C z0CjdLtYQ`%#bLWS;0VS$YTh-4QujWTs>aKSn!l6Ufy))&+ClX!W@ej5OTA|Zqcbee zQF2W^iBjULZLd0CnG@F^4)?v{Wbi zf`T3%z8`^hQ=mtj@|;)ZBnV8jBnY(kj560uA->u6p7VEeQpxpf=b2GiM@M;IH685D zNBBK&e#t~A#A=t6*vmvqB@uqy8A`}HG77tky;?p5Qis0e9Zr_-p+ER=)bvVPa-w!Q z+bTQC(Vf9?Q8W4Xx;r#ARl+7`e{z$YurJNw^{s+TYH|}nXCp)EYLqVhGbi}NH7fc} zeM;y#x;`{LLCs25940k8g$*gi_;l&7+h3n`aECf3)5A0}I-7z6cwp!}0@ z43uaR10V{Ek7BC7);^#?Or#D31|NdaBFdj>6RMtP`QBS58tNGlCWTLXm{IR2jgs=B zBrm{DR)}qXPLjX(^Ls}h!h8x%RiQy}NcWe`zIBS0td>ct*{qhCG&ki-zPT7Xm6Nb# zm+e=!EGo-;`q8|hJ}sG*fX7*pFxy?y@+B?vmTConNZ;Kv;5?o`P2PaP}sgxim>RV`|E7woAwJv81MSj6wt;e)_xinJjJ((7M>`OX}xkH

      #vklhkG2>n) z%`F1}#u9A(?|}6I`6Q+MN!ycUh;U6|oa#<*-RU{LqJCb3mwA8%3mc=4bhXSpcVmxx zf-={1r##?J7kT0&=GD_%pHSTyv2j``#l~r&g~w?j+xWfEv}j>^bIZIq6?H#UR+jtt z6R(-evr#an;oUw(l1KT?n-INu2|JIN2d796w+B1JotvC~vl%0*q5LOao6tN_dh&(M zPqrQD3%b*X^7qYsJlD5hd${R|dEb5~pR}dACqlBSaQH50JMP$(rU<*HcFd^ zFC%40HbuVt@NO1H^S_}$aKp-=UV`GN1hMjik|ENPRWwwVsN4vHe9GRUHjy!%V4)|< z*cP+$LGrSDGEvBXnq2&R-{ng4;Cqs4m4YuybmC(CX{+hj{3h829;ntyvj~}44K+?xlqvBdP~m3=c`Waz(0rl zfOcK9<(TAGfBECfh33JZNNX}x>rx5rv2_`5`mOi3HMmNTEms~Nqy92f-)k=4D}9(h zf0Vw|4*4-4!czM~+0Z4?Y*igASu|&@EX$gn5Lss@g7Fm4f;*Ho@e+m%h!2Xp=7Dzp6=#Lw!t+DMvqSI}xlC!@z2=Y7)z4bq{9P)R@9tNl)BvrmtgIOsxa z6;_A3u*qYM_bl8r&jI1>Pe|%7zW_0~Q97RVVP^34Cx1*+{D<>T+UJithv|GAz93)`a6 z?W#0s`40u!p6>f&wz+wkl)Gl-(|y5ssVCm#{Xr7-kGhi}?wQO}cQ_Y@%=T(Y`5ZGC zTiFZ-sWVr3axAusSXn;4qYl2$Wd5-C|V6P|`JYkpUDm z&XCAH3our{-3Bqdt*CRUpq@JH?5R(GxNhb1eXn$z%co1q#lN!o2bR7Ql!p=qveJ** znM8xV;bJ6Qp}83wUNF9<>>_%KR&!gg3rKUzlpmYH^-AHx^GB~kZb9rg)Das&S+z{O zt6Ax-W!PC@0qf5zih;(VD6Luatiz&*(gMx#3>;19j74P&$C=C9k)<*zUp-Xjk29aO zT+APA8(yXj1^1&Q!^<^D)EiwW)CE?}tX#CPZi_`r&N#d?H6QU|eSn&W%xnu#UFul4 ztBz51sca_z^$%+H(_vMZ*nRP)P9!{3-d&A$)J3G8qWuk%Wb zn?s=wx|5pBJpP0(5E&(Chc1@bvFWKUHBohsR~pa`rYa6=BnoW30AbiA*_QEgemJZp zFHDtTVZkmIC5{@6EjDoD8c!Bs#!9=JXmNG84)jSieBUHSHeIslfBFWOFwY5jw@SK5 zxE41YE@A1wmgx{4ZP%!2j@Qh7N4z|tE^R`eJy97%TVvEaM$gVF*VD}YGBx?CS_om1?3c8$+BPAno-b&)I zbqgF{9j*(jv@VVtrI*46+JIn5--gLJ~uMA|zcF z8S~fIGqlD=MyyvuF6@L*o*3!~3dGurZf{#o>K;246R<3-5#6h>f~uZ7cV%XFXAv_E-08Y;B3m z1n==O>ketjRKOmv)!Z9a_neA&dY>pAi_(B{wc541wFM)z8VzDEiMX}i7oxNWL&yfC zL&oJ3T>?=g`OqoS=1rrZ(8X8$7m@2zzAD+8Ay(mOoSZb0U9c^C$C3=PC{T zscxei7~K3lfj`ALAFQ{b+U;)18D%I#%}zFu#7cj(Ts0@cZY;(L+69a-5do$a)V z2lL7zJ4frzE}ZAX;7@fIVLWPZxBo57s)@R^iGfmDp>Ch#caIGfDILQw{~R{@`A>Qi z^;`2F!+}aA{wvktj6k#eTYfIQ&hqnZQ?S7Oxqm^Ny1=e3u=zW`_Ajui3oP;yb%9xK zP#2iwLUn=k%&O1@IbD`7^rvnJhmYrDRV}E|w42S<~$qEQTV~`1e}(`Qy)aboh^dv%O^J%-awo z@pk^9qj$jZUi#w);uB!FUUdK+=aaOIQH%tfZ?@ix?ouRDg!v;>R^;*dyt!3sc ztvYs8Resf|s$7g+L`)XdVbC{}((Zt~Nv_;*vEH<0f=j!@sw8i!m@ylmfO3nkfSg|&Qe_kj0d zDSa=?3Y%=3sy3O}>g-$5KFn8aZIzv^rn;#)3k9FIX}^yt_pEL}2{hIXhMMN@lGvBI z#jK654TozSR_%kDUJI6U9nP8}3mW*kwCMqd`$bDu(M?)vOM&Z-yDPgYxwM9MgrvEH=A4m)FNdjSI!SKAO9hn;YGpB3HMS50j{aCzTx zsmDJ3U7`A6$(svUmk&b{D~2R=Kwa4*g+9>JrTI))%}P=0$GYqBKUu9$(mud6CQCEr zj!)Hu_$h%=ayyoxnorUU7P>O{Kc`IFP^|S`K4Z2IVWZbr?Ss?V(|WT5asGJ6P}T9S zcG^^$8Q9UD6zFO<4GiUN4TssDbeyUm_gD2;abQDByV-siVUHcK77tXsSADD`u;H%u zzMb>TL9cZ38J75AqD8@%l_ zUbY9rL5I}iFzG|r0f$*Sk#yQ&@&4J=_iNX|*IX!27fa5aaH7=GDE3tvzoJa{?RRzG z7d-yuf)Cbb1s%>F2MRKcxCb1`EX=XSFs~8fm;uM=(+>H9 zV^pv{`+pK*PH-rtcf-CPnC!YRRpuLY0)*X34oc@nC*q(YR8T0kjqzs{m)ulY4$W_w>e~0mYMU>Z?H)Bb&Tq@hDuJ_v|8j{ zr9%p(EGnzH<7>=QYgV=XHZ|)uW$1XutH@!jh@l6)uqSJ5UrEg`+m-O(c;1(In+^(bGtyov;pXJ$dg&eg9mSt$=zDKqy#?B( zpI3!>ExXbx9YVRXNghugwocJ2Vo0xPLHF3&a2WLfEUA0Pwnd?fSc1J*g=UHi)p$X- z^BksX+_YJb{@bO{$0#58N4C)oRG|x~cFBSEB1JvZUL->w8IW{#;Ho{chzEUJIlYpWS?CuP|o5URs2%ma>+*3`l_Vud}l4rxtQEo6#v4O*l% zB@wPK$m3SMulW-{^}W{Que081_LRkMu{4%B(wcmY`ab{GDH-Pm_lZO&P7e zsjC(Ce_TP?DC~~ORPXU*IMmg7(1E)8X7$C3>gpK<_avxYCiR{;wR5m_cMn!p*6N|v zjlVhA??PHOc9FK%B&|z0NqG!mmE3r`|3>)+*dDMRwKpU&`0?j)j@gy;@6Ys0!pi5x`u*6RD;b?CNew^~?kh);vR*L66(-$!z{r z7+a5h*23DloBGIU^&~kVxY}K?I+ML+;JTXWs%_ulvY_tWbFNp0V6^QTEQ?|g}| zw?1Jjv9$u^olKf9p>+d6$L0jsD}Ea-5eJdzNOD>rW_!Hd*+^eG4vWFqA%o1?=*el+ zH^-1oF0;V~#i>E}MB37XBmI#rO+8oVSA-)|3(odB;&UML>bQaUBU*WzeXr(gn)I`Eb3Ybi>A=39LjS}_fhH(H*e`C%58Kij$a zV+9AEa>mtck~D`udy;b8q^3!jGS5BSg$_h~r{2&*1x#fjRZ}@7S`m+2}o^d01 zBu_Ks!NwXUkD1GJI>UZ45#EmY*m4O7htlfVb!*k@k0B-FGdpi-wJBE3Pz z4IbEL#p`cuYZj)op3wJezlG(s@zUjA*)|~kCQ3&9j%(p#?hN=iX*UetG93T)==2L8 zud=Qc zmC(QZD$J`}wXH6#FTldBz)Yru;gcWdIN2n2TcKDS!ezz0L2R>&F<~DD3V#^_B zdg{__YPM2?mEAFFcBay6^`q=9wdQJ&zCKOP4dH!zf>LC$|2LYxbz@lQn9N<&FUJ08 z{cKVwDZMqL2z3Z{ySH_;6)aVJNncSXrpMfTJgjB5JU3TMQkvorZUEaY+OP{{i85>* zdW-oZ)>hib@Tm#3ukq5AL-3nY9GQ5~*Q>{D83P?q1tKOnaMFY2o2Emo$2BiElTQGh zq+SXFnj4W9+CHEIOnU}g&7bL6rp$N{T+cFB{og}}m$~_gf&Qt1Cg(5losye5-rf9p z>j?OdaJwh?bC$`3Ox9Ep=@Lm&KD8ET>(sb-c|WFZcd+pe{^KlE`(tDQJ+bY4?GNG& zk;5D1v8O{HFCKlNc6<-Ub8{06@y98&d;peWCV#Kyt7_fo=}%oOA1|Sh?AU{Ek*fEG zmc2X;pPM>qrI6juWg%Ls0bN2o4OP7*=*pqH2d9f#;N#Od(|U7;%mcFHO6ljd1GVGb zwMtIrK<4=4Nkg^AO%GieI8LK2Bm`=b5A23{BiLe&nChqI0;%zhyr504oA8~U{?vi~ z<%o7XmJO7fdDRdZ$Ff<#%<*ci!uQF)#RlYv2I9@9oVBNs-WM{*+Y?CsheC@JA+fGj zhI7EI(J@Uqt~o{W@6|dU><@>b)Q;PGt@GmjwMsj-ZVYwYdjK5`CLRR;omp0@Fhk7z zlOpK2vkk6RNw+gtPz6<#kHJ8UjCy=&Z$r;+>Ng!AvUyje(z-@{Kf^6@9loDxpo7*WR>18F`ST*j zxk=!mA2yEDS2A@!v(Dr2$C|g+ncbP+Rx=;)^*3fN$I+kay0L244Xt|@)2Hzcf8;w4 zWub4`veTMLJ-W(6l-@L_ac6>JWkV7hYp=R@)XkZyS`+0Qbg1R{ovCTE*32pkQD^Dt zV6iWh@YS^Ppq0-tKaik2I67#J2QE;RBcr>kmTt}ILJm^TU^$2mz&B$P>D(naNTI|BYm@P5ylQ+H4`0DcqOagl$h3N;ms6$!tO4~;Nxi$q5!chdc-fB+ z-r6?xsfsDn7G_i`lM@ba=&oJ5!`I)OBOTum9Godyd?VB8Qk5hPGYKDU;|J+OqcYxstCRz4ZAG9kxR0*gJIz zRBFvWkG+;p?!Dt@sIJY@nJ#sDwK8Ou6Xi67c_6;&t=Gq!4kVt(wTvGP9r|Fr`BFzx zaQfZQSi9-MZ(Q?eF0OI#9!kHsimf7o!ALuces0l6G&q`d00-uoHWW845(wRH#Ww`? z90o1)u)!xFQ5l}sQt*+_>KFU&8gjBvQyz%x{b)WNfkq}ZlLm!O%Ks96!PZnVw4uB; z+_vY!vi8pQzED@Yz2`;CD?6>N?e=ZPbqH1rn*TM-;0fCtI^WxWmNF1Z^Ybxn2V`R# z%WTcR3l~D99c&!||91wyAumEAqxV1`B2e~4qCALpV-cGch4s#>@u=~d9@qTK@RA+M z^OulWHqe(A(YwYf!yA-QP!8xtdE+nB69x}Qs(OqCrrhnQTR>xdYO=925+}FU(7;UJ z;EAdcJgjO!=N#@-($4DpdibD9xYK7WV%@0^Vl>qg4R4TQnRw^()!!EH#D;cA=I(S`M4- z`Ly?)ZR+gQzar3#C4v(54$1p{+J(z#le)X09$R(h(0=b`3~B6J>~*VV%ui7FzR~)! zX1>yUF%&$ud|-FM>3(V%kN`;PTd6t|c?cU1^h}ANqJkyL8L&Zj?=pfB9Jy-LmKA$DfbM{i-4ck`=eC(ldQ8S8JFaHpJtI- zAbFn`ky=0jvv5@MG)_e5*Teg$5v*@9xv1Jx`fy{OjI_*%+ zk|gzZN#Cb+A-x-iz=>+B4b1hH@J z=QMfBXzW{CSTwoV*H>T2r-b5I;Dj7_Xt%euFW6nUU-QMww(0cY*pW?ZY~G+fvHtA5 z&0p-CdZRykMlkzktsuSka6wzgKzg^FCMTYZf2AYom5i}FLy@f?G|)ep_{y&TYWt#i z+5}YVJG1{I(h-j8Smc_V-MA-9h;3nP>g&M=@=rX-X&b0VF7g)iidq8wVtazz-BMI9r%9>BlCR6Z_lKyil?IzX%c;d-ntsZJ)S3iK zaPMvVyMqZ*4K~KJ9Wclzqp8kU+NI#0&HKAU2{kxPlRZ)SVtgn;**~7!w+G^DFxdk8 z53N_?>2OJO{|pPiVLU(%*ip?tkdR)Ew!@4q8YE;{v3&{G;Lzut2S4knv~~tcda`Eu7eQgOf|d4+ zHU9e9d|Sj}l+}juq-lLi3X30YNx5$P8uBrfRyqFvbw35=tR0wqtZm0xwYgVB1#+I$ z!$u3x_tixJd88>Bx`7I@ttBD-KJ@9Wm=|7Ja^3U1r0}Ksi3Ul!|Hf$kBkGZuce490 zo-e)6MCUlj{(g~nefnO`C+HpXAlvELjBP!_9k2iVE|!Y%JN*uxzYB+dZ*YUN^tR#s zB$wd;w`<398-5K2o@OEE)^K=*pb3Z@tXbY^Rwp|f9p<{(R?XVz;Jd(BpA+h2xfTps zg$k!VEw?_bm!|fv;NBl%vO?*`W`S^9y)$6NG9KnCrZiP5f3)P(;_y55myWX5cZ5AN zR^H3iteEG^u2tS~U^mwjsrShh_HmN-slU_fZ@}zEzv#CxL7GxT+2-kp$$We;rh5Z6 zL2cDPZG&PX&Sf94eicV$E`{=qJcN1KfGaq8>dp?ge{yEVL;Kn%_$S|pEs^r8uXK!Q z?LLHg<`^U(056*D~v4?Yil0V*zk6ELgz~WdJ&gAAJIXb>ai>|j|>-OA9S(x=g!JmBN zobDdfZi!=i5@=yFm|&LPNYWSMdh-u1b6);GW;B?~3T9(N>Ky5vlA7(v2rAA?U=@3E zUFuxXe4VHCWD9EA`)YQoQlSL0?@Ke=@1roL9u5^EZsDAD`%oRThGnRVSx=`e ziCNhRTXA(wNlS9vU>=?|1&N7g5nJpsZay83sq?H?NYj{j&`Y{LFF@5O6gBTA_E`uT zfPn{?O;xOpL>TO8n7Sgl;Ys^+aXj)=onkIu7X||3U}=N{G0>cG*IPlNHw-0*6dn)Dep@2xHI)b_Icx)e-Y+o_{AxrG)vMxPOApH?FRas zfsXo;q|YPvCRQhrn>?vL-OlY6^5;)DhBt_L+AgWG_D-|1%B-#4 zfpe1hEWy%zWysWcEY*<4NS1g>J(e*@lk;o}5T%``0bBxB^>{_&@v=h4k~nqp{2F{( zEjo@tf{^Z5^-=RV4kabjWv3b3p(LhbUd^~C&u3|d(=0W~reXC8!$Gppk@G-PJUYpK zoI%$DR%8njVRK{74X1N5h8)_bOLr7)U9(|LW?(BeDeP!BeLS=pfrM(0#{HRknClXh z@|f`l>LBVWYGs)8T~bw8vNNz$?K}~vZOzfM3VBnOVYx1l+}`Ee5$vA~K=RPVcHptP z0?XQw?8)-7jVj3Ov@U&h1l6RY<@@H^aQIA_W*u-q&I??w-h6_8(kK%UG10<2;JWik zsWta;SD|;C1SHJL$*Hm#A-v$&r7Y)EEqaWw`-rO z*=hK+36AU3;23-*J#$P*cM!@Z>$KixlQb{290epqjRnSl^hFmIH|^7pv(uCt`RG3? zgUAh{%-d*+IE{eUm@sRECzjfLeD-McJcs?m@U%07AB3k3VW-=)i{<}EFCEKWJP*e_ z9^v*FpBeJw1_(t9+$0<&OwjFwE@<`7R_$?OfgP)iaAPj?4HDIzQte4mJ!1_R3?R}8 zd3=QM+YNSm476l0FL8VHUC_~QM0LVuN0@#}kO$1@!Dw#TUYBZHQy^#i+*rO}X3{?P zPo3s(n5N4Zx}ZPLe7xr4cP<3X+B=G79-5CYEe3InXP>iXzbW)#&q*g`kuQw(m5xrI zl&nj|Vy&& zNh{WmQ$&0VFNvDdR?*-CLh!C?_)jG{al7{?&{ zv5xC_)qSHMdGn5a?HTNFaeZ2WTser3U>Mq1Gqn}D@=HSZs33#=lK6lO=~zDgW_OQ! z>b@V`(h-83^6OwdNeQ6LiB7umXvw+rsDI7M4v?DvG^}r*WWNrh3u2D9Jw-ewYn4F;pB<Htz)Ypq^K>_EylCk8Yy)8TneS6yWc7Vmv!nW zt@&M@m+cB>wTWXSHzfKLtY2uf!f#zHXM)Q-d=3?hFK{|)8#3uGSV|k7&-6vMNDyo& zgZxG^QZ~>X*awhADbu@hDA#{Qo)MB+2S1@bKJ5JaPw}Z?XE0S!rkedjGq4aY-;W)R ziSK#OI)69UhONx|#wO+-52i^k$k@7v{Xx^BXR*&3b&5G6Zx=r&3H^S;-M;)=IQ*sH zLz0?r;^{~A{dvqA$@Vq27@fzlB`hciy9}DYL%R$vH<-)UN;&zJRkRsUtjOb&JT;9t zLhZ(i{KrXH#=zF7!sIncMg0%oB0snTa}t7@fwm011w{sHo!utPx_1rjz?VxmV0E5Wr2-299;)4!mKA)_depkFeT#pu z)RJQ!bkQc7j=;~0reP^+XX+IHUVIwBRX!e9JeBy5e}2?@kZ&wloEQj|U~q`{n$InP zs@a(4EtK-GR!)nrqyyXML# z=qCF2K$y|~-H>3ne>WufA+{y^_u%z;{~o-4*Zzq<*vd{C>aTlHG2|;u+E4^D**EOY zsEbYR#gh7~FQBis5Ss{HZ0-5gmu){_hj|y{pg>Y5Hg7=G#WwFV;yn0bOW#v{flOaK zl1Dw07;sEWz?PwQ90$(M*E`n7d!j^}f;f`l~gkvEBG=(go}_{yOQ@|K;s#;N+UlxbNNFe27JC2SISdhD~i^ z6B`!6MpgxjB!VD1nas@Yj?C_io!MlUXoILwDkVtKiuj76MSY|`+R*rFX;rmVO*Ke; zv|3ePX;JV0f6jAe&YZck(f9ZM-oxGVKhJs2|2*e8pZCtq%%6jee+riWY2+b)e{;%F zk7E^mw&t(PZfkk*$uWg>8Ecv4!}qYP(TMW*DP;Z*{iyI^%vaw398VB2Q@(%uA4V|x z&LK}fv(?IB%l?gn;p%ZCALVlN*@zu~YTqxMrz*h5;j6Nk7C2lN&bH^;KH}7peUJV; zk9pVPtr<&a$tCKX)m^o0Xm3L!{IJuum}Ns7)Vn-*Go=b&tF`aXo`Ps^Z{3P@`0kI@ z`0kH~wqJ63u;fB^Jxs>?YZo1K_9YkW+p=Sye_8FWE0^E24u`3W@Z$AYe22qUmt1^c z%iGV48Rw_AUo&jSv#YUZTs#$apE^-}422uCTkuW6N8sP<&pGPqt=A5_i%;^ayd7Vz zIp)FxTi#f+)3J-@Ogwp)&+thlN}Y#$yY0V$TOskKcD=breNUe^xCCnNb3J^H2MruO zhOONG{M2Fm+7uL4`|vmZ^?Bnb80%k=*IDpG#q<<@m&fvv`L_ocYqi4$hVUOloF*TA zcaJy=%Tn_qjJ0#Va#Tx3k3@A|hMj85#6c7PP-j^0H1Fsk^QR5nmESTZQ)ybwArHt* znr6+UY1T}dR*ip8an4O3gHP~)i=U}uKCQmdQxl5IJk8a?{!sx+M#}uSch!=U>#NSc zsrsU;MxS3j!hFq0?RWIsi}+w^?Qk6L@OkGD^bLkC_KzXBty=uAWkYE#{-OHNQzAp| z!M@?~Rp;7E**JBec*uhaKbwMz`2Y@n;*k_DukpKx)fbZCQ@y`xA-+^uB<2-GZ9CR~ z4Zgr%)K0AfruqXn^6tNP%$Ls}Gw$NECXH!W{g~Wn8TX$tV#oW39X)Yi3HfG1ShO5^QFTN3Z>R0ZNasFl`@a;}9Rr2I3 zK1TB1$69o$dq1)?U;9vL;;6zpPX5;iDybFs{NPVDFQ0VTHY>-R@?-o1?B|!g_VihJ z%l?YTTJEaFL(Y4T@pk?GuHV^u*~!B{fBD&G&cf?u_g6jnr_XDvhCZ(Q;zrZGYaf5i zo1(r$w(9TIpV=S0>icH(QX_O4Lv`4%+Xnm_9`*>z<>M^bcnjls*TBTo)Kh1kTebQz zzCaCEcYS>Fj$YTB&iS4nUn5^VPJVO*lxuksRLjQ65234BSe>Kr?y;oUFuc2rZ!s{` zSYT#e9K$;k$3AAC@rOM#=ChiMw}(15!)42Ae|AvpAb;h=eRdx5n3_*eUj1a#l&$|% z^VZC+sh@F{Q=|5fU+V`i!&=5XSBulA3_W%GfiZJ1 z30Pct3(_}gBrRHRRKv+N^1x=<#M_78K9i@Km|4Fur;e+_^W&lFjRUk&o;5wE|7l^@ z_N4Rpp3!)`y1m~?xnyq+zl9j@ipA3V<$B}JPb7|)Uw`7yB^o?FH;~)U$kVC$y|Lbb z{R+P^;teyeSUQymX1AXhOq{TPpnujY z*O$sCC*XGgAznCf!X&S+XF*Q}erlj(oM*&3-rr<<$IU(|$Y(M^I0&MLThBiE zAOk0R(~TV>#1DLC)5$#idt$N|rBbJ2YJP2?xmhWRO&|2S2lhpSVkK;H%#bguB(RvY`)D%ueI)q2gBv)$o}g&80e{ zu`~v3S1cDK`m*U%936w<(39^?C37RxPXtMkM6x5+mqyVqQYN3yO`P<9Q&~yDFI;7J z3P19ydMMkMSKWio;^4K1nEG`*V}6uBj)=jZOwnU#Q%{UTAb>YAz4$fQ?t=r&;eK-H z=@+Vk+!M=-=B$NARwNjR(bn065zvzftB&?!bai7yquUY~oePrzekU@gx`5-hFQ1Hd z$8vcLYgtt3;Y_wKjV_Dkdoh18p}RTb?Bd1)iLUNwJeH2*=Mdw)$-LJ#{kVgJV}pW+ zlJP`Wi303QXL>r5Tq6{FcPgK!le>~wvmiXHFPY2JTJ>{?K|I-;Pj#pPL>qDoQrVCk zE>X6oh4s1=>+MW723!yitO+^iT%|c^9??jz)}^V(%1cEp$ymGC!7}|CEVAH-4@;)~WUl?Rt~r z%}Dlgd7YMA+Nm!6fOz^a0bOVo%fwypuDzs58^|9Vu5>2HaqCL=4YaVlQJt@p39zc3S zO2pFH9<8d1q8SOyNNF}Rt@`#I>JJ$*tlIYkRCzc#nhj_?hY^cK4)=)}&|mC5B*V=x$^Hm}z|x#=J+8HjRO@i?&T^`+s+XHmLT5**tZB>Ul_>FC9>G!sv6Hg~&y*Q9@k?HJ7 zosEfUb&}T|>&MTv#yYz(NTPcC@OT>Q%VAm4Yi{8<5$){F^kp%i%viDpqlbfbG}oKY zdR?e5KR+4Ed+2ht#iJXd>DU0q1%BT=pNVJEQFAOqmZD20loMq|R|h>;v3w4toDy&2q=ixBeqYgpQ zuI^aeE83RD*)AXD5){KqVSa----X|ErlOjI2{cac(Po=9KR&E)4|w9h#)3o0*~w@+ z#T9azI&V+sp2|ZhJfN}qI}1DSz%1$Y&O#NI&Q}7qfa>A5*|5Y`jN*SIcsWrdG?W0XSJUi zZJRoKDo--Ajz22E5L$>OBBAa@)GdnKxeO$+2AY%a1Rj`!6HjdC>QJ2WJRS4Qw||hq zfq4r`lSE1FL)t1PJxoetKxpJP+d0T~hAq^)DVnnJ(9R?@JZQD3* zG+0p4%K78v)SWYTaHWR|9=fp!#24iHy1oCmx7RpZ#wT=n#r>bF1@GMwLBm+wQI5w! zO2gujp!5t^I75|+rA0g*s2_1ww*>}8e(}K*l^E~jAtiLn%Fzh z!y|xHPd1ZD&zL-M64K1szooe(N2i%HY4QQ01GK;{ZRJd2X{9}>89GE04>H_9ko8ZR zJbB_lUVn3Qi@BRE93u2WTR3jeAv_cn1RRT=(GGC>!LeH%n~EB^fx>MNPc|hbv2OEh z9>5|VuQ4~U;EAk3RskHE(f!H9xWa0IXBT!UbwE>_+5noS<~nc9y3|?BtT0ZQY;OnG z)>0zVF5x1tx=%>xO>00|Vzol_vPran_ku9rT4c+%N^?q^#t|LlyU_Kj=(Jh0S)BLK zdcnrQu@8?&I#Hj!!SJ*xUBPO?mCQ*msy6mG?)=rkCyKipPt|5yXgw9dI?$0(9>cKb zD$&6ctfw`s%swmAOxA8Zb}5v$6{cmf1AN4Ur#U^C4_wEJr|+Z9g8@FII>9^!V1maD z>)A>wi)RYz-a9yy2SFT@6Pa%P=tt?!$J3w%MA-N-gZml-Ja8!B)WQP9mLs@uf|K8S zFFo59g&+-4g-_LaR_(0zj!}BL!L0%wUggob3)!2fBQOWCEf<=0dCaP5z) z1{c59kY9Df-@E2NHMJi9BBew1&>`M`QC)RSHB8{&>Y+o24;fxF+{ZE62aV)F>JP0R zGGw?vq`C&V$l)jc49{%$^6D{Nk2kM>a{f1$Y#9CPaaG3;zohfoeAU)Jx%H4QUAO1V zV}=iWtGVV+?_Ra@kDfbt+OAFej_CeZG;-hxuTJjnp85EZn=ZV6;ry?D?a2??k9hmm z1OL8Y>(A#t@WIdr|Nf7b1)rRD@eQ~9;D-9`7azOF8%H;E%zS6l>4!eh8|k$;Th_ z$jX}c^6B9}A2nw2q~%}z%7g=cdC2SEThuse+iz4~x6cKu-x;?0^824SOYR*oh4!Y{-#eco(%)jjL!rr4+{%6R@9eTfY+9h{>ze~6J^UwEPhd#i?u#@`r z?%h0%6|5SdM zk}vVuchySn`Rq&nhBstBzmj1nE|m2-E~;?Vc^lO@VZZML%yGl9Rp+h4rN`G!z`Fr& zg=;E4?BqXH;Fz1LevKPIg8AAAGiGQXgZXFtw2Q%fm6G|22=f(8=BwRk1B3bcPu9&~ z{Syf-z+c+Rc9>w=Zqg>EpNu{9CH+8unU6%-HqIsbf&OA!jD3KGVA@s?SirQ?5-I4; z&+SEl?X%~p@rzsje@fFCY%Cjw#en00?Pbz#qff6@*9@T_0$fY13s8kXVwP2YIx@#+ zsJT=}5KrS#1Xn{IwJotK-H>Oi=t}Pqjs9BWHD41MwpgW zV`N@Thal{MtI9i?!>bUgoe@!u5xGx`&OQK9l~?a=B0$jT2Az<<)%b<`@zS1UV6O81 z?eNz-`g=QRmyfG@F;si_AjJyRSlPcLMe>m29Ta=2z+VS=zurd|;CQd{rdXxv&x4(` zn}3+MsDyu8hyMugVadl(ME%=2`CsvF6o2XZXLy?q)K%(qyHo!$PTI{s-pQZgq-Q(n zIZk@6lb+|K6L!jWM{ha*$o%DfD`VfB{ z4MRxas`92f`G-4cH-DOwf0UDU_m^Xx{1g0c@y~G7?|a)Cw+>O zKHX37CINxd*!SwHUY5hx$w*guG5;gkA|opQOH~(@=trt{k+ja=q3UYrG0?s$uhV}? zrA#{EzsYbJB4qop90}PP)@cr<`=R zlRnEy_c`eSCw;DyUgD&eI%%E)ilN%O)JZS*|ICE}A&blRMmzpl;pne)(%1Vl4p7Ct z08y3aS6wOlt4@FBe?D2~b68b*Kk$!`e4YNj!?(&wyW{U>Cx4A^TFjNa3imI%HvPBS zbNTOd%KyMg-|eLDb<+1a=?9$jLr(f9PI{gHtG%>shbw#6Ir)z}X}nu%g=+8TPWqQl z`UNNbJ170Jlm4@le%(pG>7@VWq~CSY?>p%ao%F{}+C86s;=dv5??04(hB*ECnN$9A zC+$1>_;o-lRC_MpFel#~KU+Kb?)la|kGkj2?Va*c?| zq}~0`JukZRe|M++9!@%N(tA4Ty_|HtlO9`j&;;E?tG0^EIM0H-^JwSl4Bd$6; zUE59`R&ZOb!;_Yy_hGJn4p-+jdo%ff0%0|-IJKFAv-1a1>`-YjpUqz_W*6TJzJ{mVyCTL+eZf2>LA_V3OI5)zm{ zo*T0Srmq(MbAao-lfAzfqp$?%~A!X#XE-f7;Rl4iHnd0+LOC`r%vekSJymSKHM zopi0(cRE&G0uSutftPp!0V9y*7{35b7I%|7kZndJl#--*Y(d101$NgBJX(~ z>=5YoI&YbGk*o-s?_%#>sZXab@kYw|fzzhWyUaUc97`K}F86-Zq|^LM|72u;Z3C|J zuJ#%^aS*b#ZS4=vzc}H7WnHW{jf^k=N%yFxJs|}_7neUzK6U+Infc0!&T=!>iyQ4pWBK5 z=BoUkdG|c0*XS~DrWoaGgDj7~n!1NQ+z7v4!ykB_-?5VN}`DVvDQsw`~+gJRj z`}?=vrQ&~`{+)M(tXF!x{2o7(uK9HOC2uQP-*oy9-UOLnRIBqgcz4M9JWr)JdT&bq zaM;&*Z+O3y@~tZUw)d9!N7w&1?@Adzn*SZ|^OE%6z2B9L*ME4^nn8r1%fIX8==ehV zpI)1+Z+iUv%llO3gVz7RJ8uVD|3mMO6Ycaz-cMwF=>6?uFHXY{Xm*{q+55MQCr-mU z@84dFtW&S4n4Rz?_^Q3=u z{l5RI_~$^SKg54m`nOM|xAHHS^ngll<0obQPgUuWez%MtBo+TOF6;;*poU~e4SQvr!%oV=Zf$O}9{@$|w^{ez`|8yBI>s0z6 z|LgSt2+MHQd58LkSF5D@L%#Q&_RVnSbC;7p-^p*aCOr9qJxckn5r030dh5L7{F`L_ zQH%N$gzs_SI`1Uk-=8_2_aCJ{)8ASA%V}Kao$B8fFjohb-;IAH5Z)r=l_I7yGM-KP z_c9-nu)EGX!~cQQKOYKp-U5G<(_c|p9~xAC#y?Zq$EeQh_2&ct2vo!V>t8PWot|%t z{CxuE!Y{b$ymS1=_hZWQ4#S20*gsDE)1uPn`+GGpSAR~5{nEc;f=(ZUsLs2@?~wA0 z>b!6HpGm$>U*T^f>l;h4{hx~cCjE-+SMNZ8{m_5Z8L#iMkOabaWxViC4f~zHgZPhk zYIWZC{C5MRt?PSM)>}$h{>#uaf$1fUCZ+Qa7d}dvKYF~**Z#fL|IyYu&A-gQQ~Ybv z*E#tYIqm(8oS%5-S?AsBpCj#^2ZB0pt$&F4!|)wHmI(Vf)}cD@5r36q@BYqw*evtw z0;T`7f0LAdRE^*DeiH|d1ls?Y4A(uJhjWSIPPNRF!_#Ps)1mxk^9p?;z_x zlBzu3+fiW~RsW0r`OfcQp-$~yt{xkX8I{kZ!)4xxl z9uvsN?lgDFG|hip=W-b!?nTTY=F6jSmZAJ|#GLB>AMpo)+Ysfnn@1*p1O6ZcxG0~E zn4A%5FU=%ooooUz^SK=ov(71kS?A$`S?6hjSaldzm(N zHd77(Wk(1`RHDN@K0=2f9E^*Y`V9U?6_w~KAHJ&P%5Se}to-)6#>#J-G**85i^i&7 zhHA{R5n$HE=}k=Tg9J1GXu;$@MKHO$1ylc0!Su-r!K{q@Wmcw|C?G)QzA0g zw--#^KrnR~{I_(h%D$~J>+{7As_h%J9Np|iw$hl#3}SL}OCctQ@-r|wz9MpRoFSNP zXYjYvv8tB_B5Z>zg8h#&PHSQY#ShH77>vzK`)id*m5Go5p&l3U7WKs#r4L-t|Ba&2 zoYwm8|4qx4AFOr9$XVY1nWe*qBXCMbfD8OPE3rzOvdRxqR{0-u@GYp(L^GFFUqJ5r z#rgXz@|CaT+{f)80?fL`3MTh7!5m{V1S8UOQ}pMHociYqrY)BVX8p?r(=GXama-o8Yh4hLb&+6Xzz zF_4p=N-6%AwM_9pp|RqJ4nG;<^oYoWQZ@s#+&Gc5+yub|{(1-y6#t$YtNxXBT-glF zd5 zh~Pp$egXl4s`pckRlSxCk-fECjW=NG*5jg_x(vSXFdgCMAfZIwV5GXgm{RqkUtYkX zt?HG&GyQb~{TtBf`@vEvIiT5sXOBS?JdQUnz3(+$9*po2C(S$fshq&EKe?9zQi&PT!fap~jDlPx{E0vCaDY2Xxthc!(~`Hsg&;mBBXq zpDC!??Egn&GnSa5eH@c**xP8IKTMaUFZ|&ew-G;&KM2!tnXxyAct1*U&x?yZW56?y zSmuJ78F1Prp^a~=>sl#w0R!lD!7lBZQ@%H z#I3+H1k=Zh1hefI2&TXJsTuWW09RFM+z!l7!ziB(yq{o}ohFz*yF@VST`rhq8MvNY z1sVH*_-nw!Ele)Tvyjv8Mu)y8J_&OA*U0H#g9E{*Lx=vQyc3xIC5{0%3hoAGFk?*F zBWs|tN7g`PgN%P=18-^&lnpYElntAdSl?@~QxGr|y$CS5cM?qQX2Im1DVXi%2%X>->S>05O9vuga*lJnnf>7@*n$d>^p#t;`G6t`WK|s$KRR->B&HJ&v?1 zAU}M_Fa%d*qJnxo2WFkjrkr&$o0xT~a}+S^oGWtH*&NegBhzbQCC%<#XoOW8I_ zm)jdr1emrp3Z`xQ38rlfJ{MO6RhEl^1T!|aMLKeT7Ak*oaYbNxp9e4mN-$kWhXH0RBI71>uJRm0cJfj1+$)01hbyg1hXFHPw2BA20zfY z?E)NWp+pCNijIdOitq+Yf?4xb8>QdX8SfCSp!yV;`A6c40Mlm0bEwu)V;-1t22~~sVA}ar!G$r| z1_8ouxFSa=sQ&nvOl+&N0eF94WrJWfCIu^h0yjcOjY*NKF)4E8XORccBR@Io1+y%J zKhamQs`n@bbw6?-AdJNo0cJjf{}nxcl|C^0MA<1=*(q4r3CwA$>=e1OQ{>7{kq5$0 zPGzU)DE?z0L?Dh(0YQyDVA`@fF3OpIf?(FK`T}y+9~XImI3<|%oGUm$e1TxfuMr#| z{;puke<+yk_=#Zp^H+ic#A>fcz0`kI2DVYA@ z8&QS_NzXr8`=&-P=hJY(uOL=q2|8<0PK_nOYAgv>V+ok`tFa{VKzP0hIsL`D$ip@p zOq&dDvT(D7TP!?9F#Eq%@U4j31mB4mZY^-OTX=?rXIprVh38s$p5RLnCj|E*?h?#n zOjwt1S7=f^Ua> zjU~U+!gpKvJ`1n4@FNypCz$h(ZKIv{BYs-&!-$_1%;y`=3#Pwc6g&xX2ESQ@8sfnCf{DTBEX{%t7jb|=dplt*25*9nDv}4cqC#5-gB`o z<&(FxOxgLi##ntRb%Cc(=;}Ipbp0beeyE0Mia|9b_j6fRQy3u{sE?qd*h;<+&n`Nlluh0OeFnzK; znnzCRb0`~}5=>6M6-+sO#Wz%mDQ^?ZvS$dU4;lP~j#V2sYCH^4B&IRBh?&pwzW9N> zehd{Nkjtzs0r9K&gV2D>e@#JsPyM>aO_cKxfzV96NkR3m-Xd{b*A$3|>4%J9)^odH z+V!d605Kl}QJ-}xUja7)t1}NU>ueMq*2$%o`V2=3X8Vp2%=VomnEpRcFze;Iz_PT5 zZ|)M)KSv7=fHzoppK7f``Q?J^fmz0ngA76WHleZdEnh4^VBO~4mcHOzV_@CHpFk}j zmU%~BzeAT*{^uk^pfCJREm!{U(pdSQg9xF8Iy}%Jz)UZaR8a2)z_j;3k<;EI1k+wj z%YuGPFl}ETn6~!_rVq~&%y#4j2Z+BRn6_Ujm~FaIFm1n0Fx&J~!Ljql&7^%*e>dHfU}WUp1ab&lrM&S2ymnme-LN`G40=4FlB0Ogq(KmD014x z+c4_WE;Yx2X;+`fY1f5<1H>x?BhvR%(5FwX6*=uy_g0Y8-aAE(NZ)5c-UNKF$k`6s z>dQZ$p{;BegYp~jH_=AgXWFj(CjJR1hYtNiJIq|B9Xg7Qz7#`_?O08>|;2Y|^p zRpi4Fw+Uw3j}japo-LU6s&Rs{)K}vKn7&ox1ems`aj`DizF2SrVg}R3;eua6zq7nq zLsZ){dJLFx^39<#PGk(I_M+|YqU;H;i`b7Cb>cUY*aR!J_6HL1p%$}m!_@S1mHfD9ZR2$FInDv=wHLAV6TF&}> z-qa!lxct1v^rQKFq>1=V{6QdpB(0!+ehW-L93yhtqRw)VQ&;sJFm1U=bZCnjpODj* zwIZi2zZ4uGeo-*n`$xgF>kYw;h~E}W8yU==OPh>;wgQfHGnen#Xv};Dcbq(paZbC< zI8lD^N1nCN zpNq74-)0_ht+t_y7&?8>$qIh03P08-_zqy&AK_wyfT62!9^s%(!0fwOxJmP?R|-btT_-q!_0m5Wl5n#5J^%4(9e28GS`!K;H5zi1zKHMrOefl6Sm_ATvHt=u^-zD+@ z@vjBbH=6|0Hy-;D`t;3Cg6R+SSu^BKz%xZo8!r@0-(1N4f=(;&j|9^lGJ81h&nr;cT1nZ9puaakFivuh};9T!n2Q|1ZJMwwd*x z^+s~|gP_hoz%{_?`~%E<_51;tcClXS)90*U>eEy7=b?&Nlcw03y(C{{jWI&p*+)h4No$JcW3J z#;wE$XnWd-`9KIADBL1Tc{I3O#6xH1GRSm(+8@5fdgQ*UjVb*ak!{oi}*aj^oKepKu*5vMb3VF zSTOsMUB$BW4Vy$v-@Gok74Zl(k8=8Eq+t4Hg5Y-GqXpA9rwFER&JaxBFtERNM1$!I zU&g>Tz>y{RgP``-B|0BN#fzLzsrYlL#{66IEL7$xeQM?=ePQOBnqS{wDVayWteP${YB2X`~OhNU>|DDEYju*MulK);~RqrJl??s(&S~|~bto(41 zu4@E!F4giKEIdIlbs5aND?@=Jmno4RSAxfh+|^h7-_rVDq7E>1ngr{dBEQnVTuYTb zf+_L2s3Rzy5 zhc7Ety=E@=Rf2Vx^_lJQzpdrX#3=hF%5t6)Z-YVJCU{@qcENLjX-DKrJ#UT`93V~z zCU>`BMEd**{U+c=B4?e81=C*jYz;aL{I(MEw*d2V5n|e0x(I`jvZ zU1It}J#zyl|HUE)RNpp1oqFKwEcy2Yw?clSVEW)@!Q|m{e3oT+KrsFBW5KlH5y75~XB`|C@B=`*z^L(Y7)W&%fmn?;8{J6P~̉Y5VMWsq|fFGM&v~W zHz1xbn7&l&2K3pc8%55x{!wrq@mqos>GwII-w*r`k+a?J37&#@XO0c%FpL)547`V6 z_SK$(sn3rajsAgxTOmJKF#E7oFx%HIxE(kq7|`RRXYwoo?i9QfSly#R-UO`XCh!bk zHNSuv)cgXT4SbuF<+$MIWaOls{5+U=F7U&G=K;SY7|{Ep-~{k1g1dlU6-@j8A((z< zFk@*rvD}N*63Yj&90%sTlnAlxSsVu(Zwvu0;yMhZdSY378%4e!re73iRm>6T}y$kwx6JM?6YeoJz zQKt#<-f#hNGw?XUY{xXgQ-Gs_S?_$ot-wjaZNU6UhCI`O)t(4UecrlI{toch1+)H3 z1XG7cF6wLq=5c{|6Y!OS*%q}|LjD%;Dv`GX|3EN#?h!l#_&&k2fgco1o}UYz1N@xe zxxmj0rceGRcpk8tv#2)#tUi|nW`7Q?(srhS8w4){o*?*AVE#L9wuQEJ30@AoK=2CS z)q=CYk6Zdr2+l*!XP4yZ2mYs}^S91o9TaOM%a@bmj?u1oF6G@^lEMJp+Q-M_(7b4)`L$>w&Kp%(j0=@YBF|S#q9t zY5(((|48t&zz+y!UC#-A5tzZ8Z6NmiRg~!O{)k+s*NyFvCN{x;Oe1x_#txEDBELZk z73WPF4@cx*i@}RfOZ>Qkh36Q5!Sq)v%Qd-$a@kYbh_BcB z?ZnXe1vqC5ejRuY@prY(Tw)FY1oA{~)a{)ncr@aK;0DAO31&Sj1hXC22&QkZ70miq z3#QI3f?E;OT-HT@a9Jm&j#>|aM*^$$5I6$-Ptl=oJ{L^=Dqojv0v;l`8CZQ@kFso& zdj0@B1$al%VY}2B26FNoD)Je?>O2EEeWun}VERlwqX2FM=11VPnLOVVOrCEE4uI9# z2p#sJI?n(z+%7uw=MM#whwllIb1sz-d^nH&P$QW85B){?9f(;U@#BaY%ve%75Z2&k zU+Ku$pij-`hU0-FH)}tudo*B%<8e{WI%f(dAALbN`54@~_I2uFKT)R@a<2kIT@Hoyl!a79HH|N z*niY{7dmPT57Y91@)z(2fj%{#3CI9D*BK6^v{2r%7Bopr!x31(lZ^ETw`ftOfiFA&@c z`8Nc&0jqrk`qP2g<>X{wmlNL&{IuY9;JvGgI^zV-gS=620{A$=Y~y^vUBEqp)4+Mb zdEjpg2J}`4UJQJV;3dG<3SJ6)yQP1p;2DtrP%zu|py1iSKM_p-sPi-0bsz8xB3}#q zieNzRRlyCwn*=uk|66bqm8y$=s202i;;k+Dwu0}3e0#yPEwFU<5_1`GS`NCk2lN9uT|&_)5Wm9^YeNzpn)Tj^OKoZ?SaN z2wnyG9fEHLzF#nHX5buW7>t$Gsi}+H+Ul&Xp&lkJ`@r8ovKc=Z4AihyBBE9ZGUJtC+ zJz)09UvW{t5%Fh&5y1&s-UL`Jn0+-=FzXsCn0 zv%pUYX1%`_oB*z=()@YgF@pPn_ZJN49Uz!}b&%jCz(-m-(*-Yu{8+)ufEhU67>45_ z9*zCCme@Xr*T5)*2<4j;)aMO$4nly7Wv8I5I_KO$spgCT*8pR9d&I0~TfwYHy#opP zNZ>IdXFZbyk3xL3U_|OHNS@KaCx|>i%;2_VZdhA3D%FyvlDW{8Gpp ziMf~{a9o-*Ml&(W@{GZ8Nz5}wtKfT3R<-?32oO};f$0+*y}Sr8eZn>q*CIYZFnw~E zVCJUMV78Chls6)NKrq|)2f=LLp9Qmh z>OPl+5dMjaWv3v1UvMj82DdMs2DcW8dvXYRk+M4$Ix(}@#WXNJhfqci3RJ{owQ;GKZg*uDz_1SGu(F#A#U zFEC}Qe}QX(cNQJ?BW<8Q!{NAy*{4ScrVmaL93WmQnC-qza06meuq@mCv|#F}{(_wN zQ;}1@3e7Y6b%G(*-+cjn_Vp-{(|^5|4qsx=2$p0mnef1wp=QF{xA@{1Z&Fn)4cO0HR zymWnIADFSnJ}_qh+T^bWF#>%`9o}1+@zxC<`p)d>t;BQy0&O+pmbRMr*=V27&P1Sn zJ|8wC%)>?g^TA14ha2*~mxz%_`~cmt+PjW^(0VD=w%7}R+HcqH(_xF}~^ z)p-DzZKa)*v#nI1hcGqZU8yMN?g=wK&;jrVERdoTVVR>hoVCp z9~8{Cz96_2v07(@^EHvTA^wYCa=s^+oc|U)9kCBr(gp@@SHvyATuO*p_Dh0Uc2~h1 ztBr!`kD~<709Kz_78a75mSO z&yj*xK*)YF`!9W6@*OgpAwXb%uq;3SY9MAq5!gP!yI_FXFat-$;Uft=023~W1t@!|IzAF>YW@Us`TjrhmV35fZDA%gMY zA0cl=+RQIC{y7j3M&OD7)1TW2W}PDi)1PX+g${jkp2!jD{T*`ZUTVoN7fiohA(-~6 z^%nZH_Xd%(FIEc<5W@w^9z@=c1k=wC3r3{JEqJB_KPB=e#J?0wAO2l1B7Me#KK-xG zc);|{N4VJbR>W%U1#SaoaQ$z;)Acv_lWjKRS@~alPFwxA$ROi6ru#zq@LoOkvdD`7 zQ@2kr?N@Uaa@w!vEHJs(iVh;}2guo9KeOa&tU?|@_Ke8ckIxFOMf@wlv|XLGpwE8U zAad5F<}&0An{m-j_M?Yp5OWMLm^QKw<16J8jKiTAROB`OVIP~bgc@V)ScDyLMS$6s zv4Y9R`Y5N(`wAxa1i|D!N-%9cM=WO!B(HggMEQ25wm+bJt;Y4ldm|vTPrN|5F{)zQ~U?=HC+eBbMCm3yc#6)fd2TgM>V0JhN^7!`g>seQ}wV z2h@=>3ERW5_g|1G|NjvJgeF{+{{eEgllU3nDT24%Ue+e*qv;~w3-WeiPF93%aYeY9 zBkYEYnEe$9rf>HW%r@;U7***$g+AM))+k`M=~&TWf1N5gK%5fH`UeEFuEm1c7hf05 zcAqbp?Or9A?NVn!!UYP`2QLV2Mf{53HpH(Arau_W*^+k9hYV~d@ni56 z+xdUncWjS2>#_~xd>))^gZuv2+mNfilYUWq>pCbR(7%y&x?gq@%zoKLFzr=+w@%xu z)Fuk($O4$mpaoEjc2k(C!NYCdt>R!YTe21 zctKk+k}00aEJ!7z@vdZiK{V0V-3>lNRVlw{lclk!7X}Q%P?8_gpnMd+ubt{Z^<|my zOizc&HC~9PvR%nuI3m9wIpAe;v1lTh%lBpmqD)(EQzpjJaUqD(%jsliEN-+)T3bOe z+$7awv7S7;ESruE6nildP4#qSq8+`N?r1!Z-zhG-%rro|4h>6mMYFNqn5}3``Xahz zrgbLs(Rg2PZ?Y#J?aucVyVGVXQ!1l@XLWJrRBC|k)L1&(6D?|mSs$ucRww+BOGdu{ zoug>COxM&E>q+FgVhfVd?p&v3TUnJ_J(uc4wYFmAMwIK8k!thG6~jm?=~g05_F|qy zdt%*5t675(JNmY(I?{c)u4tw&pY1~rmsO~yUD1*GRCf}(l@!&gwFRAcvNw;pa#l1R zi>6b#l3~U9Abpoir!!RR!;F@ZXBs%TR#_8zleuJ1BHA?wqwSDz^)goFn0#-nCzs9i z<_oi)wq;peM=T#pV?3d?C7JYPI;nJ0JsfaUu$BfA#IlM4i&&K23Tb|sMwxw_+}R{X ziN&ClSV26UjP;gf+x`vLD654FL{~1FS%ht<+)~@E;hJTH%B^33u2j!dlt|9+>x^c5 zQ&{%m1;-Vd-Iq6KYbM_UtwBO>0L%DTN~Or-lO7b#;` z?ZkM>X3!>koY;KkB*3AY$F5@(O`Eo$8_#riW1|R})HGD@$e4<`zI1UY_fKv*h%Sb+ zGaV@m=tQz37OIfyNfnF9j;&9Qa}r%8 zCCm7?z^bwhS2B)0-YQT=#-7FwWT}K%TCSytII4<+FodI`LT?6hA~qo;-&o$wgN)UO zRP9KoI=k{w<+pCSHncfWbvT+IOLWKLSnH{X11QF5$%?3y^x=u447pnv8MacGk4mOP zp(-?^i*`uqaD#Dx!DLG&qTR6^j?y?<#(OPuIUwRZ9y)T>xnUXhf<&SUElc3kyD-U9 zYi^KHYHL}YqgJt8Svy5sp+;Gb6Ft!`tQV*?+>vT^FDg|&!D8gf3NTm;Wb_s_!+Qb8 z^NIUMlRdHdSXgj^>cLLhlU!7|R|AD7qo`VZlf6YB zGg~%^iut;Ds;5|bf;HE&I$Jyu?d;9;Wh*ww7sKYTa3A>Hj;*8shn&B1}^DQRf5Z8sO zlvGx(7*rm4sQbP;ua=LM;=ejQN5EY+fY%3vg-cW=u~vU7onn? zx?;I5m{OrKJ!yGnP4>sJ7j@#cD}(#-!otK!gGDKy%pvM670azxKBKZKu37qlhaLmG zr^EervUiXb(@gL15@k-y=J5DKFU1%ndJ7nYeGql=wY{7SqFrW)Iv{3pd3A>;tIr^Y zgsR(hbG7Gf8GTipQaLm=mQJ0G?G7`PM&KqX1_xBqGVT;DQ$z7AsBYa!V6uu&X!^3! zfU?HIxI$)yT?qMx5!<+3pp30}3R=_~%MMChrfTYl3u9Muy|WI}Y+ZlRyfVGr&}c4qRaSRNZ!#R0_IxKP!w=Bsm& zt6esXlo1tc=Wx(ZOM9?l$>Nph%cfIt+fq~g7gR4Zf?kt3H%Nb$Yn2gkf!H!piB=hh z@m}|U$}5twHzBf7wXSNzDQkzmk2p&4PHQ5#3e`$`I&5Anok8QnKHO)X#1=K zbu@)X!TbaWG$E6lrk30oRhqN1PT&wZNUvB*_WEX<(}!&!T4X6RUrm}~e%J^rs)U!u zZ2}H7*azc-Rm7GTZb|vLWw3@-R4%iCo3ZkDb}+sYt)5IiIpL_|PZ|%S;|mH$6#LN) zK9Q}|F*FU6Cf5UvFmKuUW!5TJvZ(1UoNhbtur1eROVnd45m#8!QH~#7sh0CLZID3{ zqG}F+xkagbylX<9&s|DBLoO?0?6sWK5#>{`g56dQKYj}t`>OH1Jz-fK$b2l>$&W;{ z=oNfaQeftU)Q2yAO2V89PO*BK-U;uYGNrOk((45K5jTY$Nqne^MIJtm;>of({8chR z>v8^T7Y@=dA*x&Km+~^{^uq2awjmtR!W@fpcVV1_Yp7mH%rCmz?#TIl9iBQ#byR9F zoCPf&L-LF@W!c7!JOR>=3uEa%(}XhHs9@~|gZM05GnBBn zn}2cY!OCoLM=!6Y%r1B#r9bN{J^~x0wS%aaQ5TOssUCbdz)#N9c4wS!ddhSRdu&T( z2C0Ngp?YdIi1|f&SG$b3cuPB&y|$KV2j;1Mw@g~DYdnQTmeVIckS(rgdd%Xk$h;9$k_%5( z&WWcpJ;rBc78jNZRM;g?3=-cASk&j3RX>dhl zMa#L#?R|gMVK~O|hAf0}OM0?oO=vGUK~*kgMhZ2Yl~$@RYqi>!IWo;B?uBVsc>F4p z2Y0D_AjU%+9HY+=+;nj#(jCM3E?SyZbR~ymA(NkRNa3P}dLC_xTN>7<9{R1MFdc1z z+N{f!%Gz64(+25WOQ)>7@|PLz@fgkk)vhkAEsmmbo*aauczdk0b=W#|1IntDrvb6Pd>4;fmF~a_`KBt_s#rXWI|;f- zl{fkHo_f(wKQpbwTRcPHaVp+5>rG`6;=@o=)$0?ogmoLuFb~nNP~~vi)E2o48f64r zoApa{1)VU9LexU3)O&4PWGdAvBhniIS;9;y=7v8?RHouZX}t_vhYqzm4>HETP{A@| zS;|`R)$<9x7j2=cK?{XelZnm49rDw&0~L6br4YxSMZrBs!{F+@IKzk}~#^VcoT1#ljO2RBz{FHCbr(BfOEA zO(*loQVq4k$&OXjsIXJ%GrxXn2A;}`cc@~S=k#g+3(&cWWlU;@mM)G-+!gf33s#mD zpcRZ>AJ=jHishbw}80;cev$HZ%zze&Y56@j$nV!z-3k4nBRuzZ)84 zc?i=Bc|sMYRysE1Xv2=fKT4T2`2eRD9he>uVmq%ii*yR z%ut)kGWDJk&*dl5AB9wN==3Ue;r=Z~%Z!)`E-We*+FL#YVQx{cjL>yqQMEuB;+dkB zO*p8c>%wvh%Z0^ERm`3+T>VSm#Y=GBPmE4-hTRt~r27VwYvKg{E8#B|j+(50tIKGw z{21S%#(x|s!I${DD*QW5;GvS{zooPT|E(uO(}Z$8lgE66cX0GrCI6kL2}W-u^oUy} zW5##%zaQoItWwU4|DH5DzO-KcTh)48CQy&zH0TkxGJ!A`eDe^Kk8Lx2tqxy5@@~Rq zg5f*F;d=yp%b`R*{+n0B_pZao@402Z35M^l4qyAV#rE>wkQ=^d9lm<-@p~{#Fnmur zd~?7z3QDw(elvWxIDF{}_N{XGvX*`Lr^yAr^BlfB_>M8gi5`=S9lphuef+n<#=awf zK~Wfg>yQYLHo>%)-&;W3Dj6%l$Facn)*&{0y93*N8<7a>-<_pQD`JMXz?Vi$z6fH& z_rRA+`IaJ|{x!kacMtSz`(|IK$0_-CgtFng!r@zve25Cc@LlHc^;>-GXTx^_zUaYj z?<3%2z6pl!80ZnVO2+lz3FCsr7Wf&R0-5tJX!8aZG?VR_Wd9zx}~SbUApHGD(yg&VegBavY^NNKPSJ>pgh5uUdAuvHcKHjFOii=faB zs)YVy_2@plOHY`%@)<2r zk7oeZ#r~O&FEX+H*NzM{tq`ckFb#UdtxO<{{BCi5=J+yvV;sINWUN*t^dG}F+Tlxp zuOBLGFQ!<5?+T~AwL`-FcbU`P4d65WJJ{mucK9OT<6dEcv9HVF`@rIx0%gn*-Ei*F(}C)m26N@u-~SbWD@e7z3e>9?x?o7`$3PxhO*)7!1oH;?M)2R^|*X7=-Kw&48D3O(Y`qrU#r8%?*`|7V1lvl z5Qpz+i|;fj8~b*4_-+QD;UK5M5r^*`@R{*9*W&vSo0;9-HQ?iU-2}t;Pv{Z1O2%f3 z@2ik8kNl4~_B~R;z6TxqYE~8Pn+G1lx60vLSHZsP9KMkj-+YU&`b(wleGz;d?!5;I-LRuhVNB}@A*~wyGO~_0bRp4dqgSU610o; znPB)%fF5zHWXxTyzhjepU62{R1023h;JX1jCK$en4qy9CMf=XQ`1*v;P%K5K^Soq& z;mbOFFWp?cKTkv1*moGdug&(~ec-D%WTMC9LC|BFRwfX-ZYiE$dXP4J+c|tMf$tZp zg#JT4h7k_mBjD?Yoc_xqHheRk`Em0$;r6vV^P~CJ;{9r`#n<5QJq^BVkZ*#qZ!d>$ zmBp8bvaxS$eX0NE;aoA&kcl3X0rXg=l?jB}+luFxg-9E||Lj%Dmj&OUs)YVSJ%$gV zXY)<5_~=K&*NpFvv-|gM@EH#B7`z|!Y`!%3&~>Um&bIirbNKE9AG)#-4BrTcuixTZ zZ1GjQ{Q*9R3c>JQk8_gUj^``r-2f$9@1+WQkH|d2cBR6`3VQ$Ey_D}Q=;3Hq2*$n( z0PK1Cb=px2y)eF49Q#H=4@*oTn0oU;X}$Fo^nQ-RfZdKJ z=wXT!g5f(4^VHUBgr303 z;(D;c;yc*k8x6iT5=k(8lO4Vp7T?v-r5@XR2+G^-orm-=;bLU?);M}yNGpGduF;#B(4)LnIObaIz$3mwJKo2_V)HElAEs6z818>S&*tm0 z_;AZy;M>FDTT!9CyEuG#@NwL89N@@U;Nt^j+rCxcn^~|<>oNHW)?M4aOTkwUIr(lx z%sl#i2r9ApJ^)|X{CI4)Qax@S!%^M@@-f`(=naQn*!;Z#dbWLcTkXY>qF~=MPJ09J znYvh?!RsCWJq9pL?Iaau5|R)K(D@_RqVHKLC9*1u< zI%}!$-DmNQcleg!J|k?NH#mH&z{hsbz6UJ6tsTDW!52rq32X<$P={|l_@+QkzO{%= zd&fEZs)zfpuzst?Lms=|YN2Q9Vtoex*Lm*aeZM$A=tooUi_o+AMuP7+5=k(8zjF9$ zExt#gYxpLMeQ2Hv^T5|2n33UYf*x@zg$Sd-*N>Qf`6*(<_nSRS?OO)E;VdA*@cj~c zHs5maaUCMxV~7pkYKLz*_~sfi(PQ$v4&NG!?`NXN`8Eubf&N1^D!fyny;ab&?OSKH z_X(6V_MPX9g9rvG=Z6W@V_58*uUhUX_U}{3H+*v)zBcf!qrnmk-zg4X8~C1v9{u+W zbPeC_!e`oBgT?P9LneAm-t6$zVv$;gLgf2}=+S?VIP2*K@P+m7gV3W5t+*Ig{IJ-+ z&mnE>yVBv?1ilkg3H`^k_gfC%ofhA(EWT}FFWrUhL4{_N3$t%4=-KwIxA=aIlE%Kj zfXwEb0=^@Kn~||^Bb02u4Hn;TEWWWAi`@F4pX$8G0+m-6AfZjGC_I>W? z-CRMh8uwRrz4ukn8;kYR)>{uf;|tp_0rYIYd;q_29C2K|Z29Hi*e`6pr@;po6oTRY z0D3kbf7HeBZLs)O?_J9G68NyR7lPsYF7#}^TJV|m{uPVwYYyKB;G0)qE4F>W;hPRV z>ao2W5wkAZ`wxe2HpT_zCK&tPcKFtSuO3R|dkwMSd&c3L2fna%e7(c>ti`v<;(OIO zCoTiu2xFY+G5LfuURG3S$2#cI)>alm_$TT${q`o(rXANhe5=6M$^sIo$8eRy_o>y6 zw~=r7UUT-}jo=Gg4=%&HV~@YLpcgie{_W^(uAuik46ylz;}9EG@1f15dLt|7b>nbh z^Np&YcL?ORUVyam8U1GPPL5tZ(qZSTIw{}E!U(}V#eVx2(#Fppp|D+V3(AGH_naL{ z^;#?F{dQuh-t-E3Ya2`TWi9 z$>Dpkf_?Wn{ks8r7`laE_%3(!-hm#vybz4ud2p(2-)87xNEU+8yU!W-BXJ(YQKt}$ zUjLq@eD!i}G>S$q2R-6e$!N63!RL@MkMnt^!`A@5Fh93Dd@U9qe=p1Mz2wZdHt>aw z)89bPwyzC*W*z6x@EX4R9lkl>J5buhhJG-*jkjU)ajx`-a0e5}grd-+2z-$a{TM50XRFGiwCPR<7Rpjkf zJ4Rad9z3bE-VNZZmokhBe9*J`=77)mnZFmyJdXR}4j&I2NfJpgeAN!$D)6PD!+wic ze5)M3F7O!+QW|`n!&m#GV!!QZ@nsyoH282NECj=Mro%VN;^Xh&QjhJOGPKlxi@_H* zFVoI^TMj*zH^J1~>CCr!t6u&Vsj2s9hwpmuwHh+ShOf=xYXV0#yYV;p}uabJ~$7%bQ+BYf)UtbP`o^4+n z$go5xzI`mdJsiFOd@#8XjD5Q}d~+?naTeb<9KJU2wG`Nj{yWd%%Y$zo^w?hh4yS4F znGWA#@U5yY5*quG4&RI5`={`YxA;zsl=^RUz23JBqv1Oqdc>`gvHpJit|u_<+t1<~ z@9@n5-|JF_k>P7__~t!;=M2av-$aXVw{fNRO&J@0Uoi@Lwtc~a#dUIji|^BhQoaQE z`e~R1W8cTnv-!HfXWBd2;+y51CpUmEtbdP#p3PUYw)oufK#Ol5hcANrrFF(Q#Kyio z9lmAYqaOWtkj1yKzO=nBg0C@z?=0xq_D%nBar_-(@tx@KdHdiwO$gud4&NH^Ef@O^ zwfKS|rS>fYA6#Duw25I?=-KwQJXCy7;c$!ZGbkZh*w60RAH^lbZ@9x1MWM_GI^hp!EMdxY@Kb@--Rd`DY+-x^bDUjlrKL-;O+o^9Ve z@Vx{*j^|@7zB3)Zjo^DKZ2fciTJX?$GkC~%oW-}CYt_z-#M2w;i0p! z?*xnQMTd_+LiwK%`+nu{4PS?T6Z>Xbd}E#Q^6A9z^(An|%gD!y>&uB2-&PJ^GwgWW zG#0UGZ;ivZ0(>x0`R^o)ZzLYdAX%7i^rzu~xPZ5Yp54E*Q7QLt_Qxp}-`}??<@*$T zbtIBtxZi@F%{R~DJJsU*B`UG)8;N~!t|3Eg_@05D&6ftB=?}hl#yr}4o5Pm|Uy>C_ zFnp^WzWmSh`I_xL!{Yn3v);dm#U*V1KI^Xc>x=U@YVqCT@NEF!$;LRu#=cb!-ztkQ zX7T+BW!OAScNLl^7da>}eD?y|dM(fkYsXzurWG;6TGUIw(k}_C-pe4f`C2Q~n|1Ws zD%86GdbG6_7sGn1-cGCDTb%jP4!)7Pi27^VyULj#&x5ZC8f-_(;yd5rniwVCiLv~Hi6Ihx!dB~-{D&iK5R*aVA?yu;hSRdWh}lJHVY&R z+S_8so%{S$g&`^>=*+U=Nb)!S>;J1Z!ycjN*3H)l;lOgm;d?^QKH&*V|p;NzfY z*E`#)x6i8g%MM>N_`;sojdl3uS$vBuzP~ztnO(uYzc_wLTYLi+-{TJ79Pq(ag<#tI zsKeK9@ttGw{dm7pKlfL#Z-t|`7-%FN#->~>D#yP~cuLXQz{#yz?+rCdN`<7XJCpvts;5$Z} zr2ZQFj(7NmKUwtOB^KWqPJ1r}pWz^(!E>DUHiFNrYnNJl;~c)_;De|T3}3y&*8)B> zUicH|)Fb}~PJ7o?ufEX@XK#hQ4oZJJsnFK|}HjEf1NZ-P! z&E=yt8Eyf=0<|_+Qxj^_pkg7lEn01f^?i%hz9o1eDq+57?X&jGo~_y7L;m&tj~ zI%_|B?Y-Atd!I9B&XM&!4L!mse4rA1MZh#Zo>BPr8u-RwaD2jfXe0R=4SeUocb55n zr11R@*1*{HkB_L?`uQ7iQIdS!&{OSe`E6hwTc_}~8u)U+cZmw%B>7qld~-Vk_un@t zd^U8lYTue$`aiD?gPv+%=SfX-AS1QkE`{%-0l|D9g6~Tzz+m5p&{O%&zmD&T!9{#O zQTYCAcrf3&TQ%*nB*RwLw+4DDU&txkGr{&XDtvhczV{HEKanH~pVPqC_7<)mK#%P6 zDtv=*-h^F$|8~yrKfYWKJ=MNXx&q^EkHYuS#9+SD;KLN)8Ua3Zxu|cm!Z*mk_Zj%mRQ@FSt~c-{DtreOzAv!;QSFOb z5U`0zC0`G(r&74284BMah3~Y1F9v-5+4qKlFGb;dLE+mK9c!<3q8Uq zBt%*YzGiI6UydkzWd^<-;QO2!fRp4~Z{Yh3d=%%2@0h~(2J=BIk~^*cb$f?_uj&th zb@q!2UwLS7ee1x7OP2m5?JI_!THhlI-%AQ#nt|^S_#W`H1=??(f$tpn=0cC^+oJF- z92;z(?RNe5Ns?09mjXT2z7c;6Tt|Od;TvJ#s{~(+Y)p_!z99y_)8M0VOZHKmAw3!| z9ixNob1&+@KiZ+E+ERQr;<1J`X|SNPT%_+A9xDrp?H(mwjWT;ruxt?(T+@V$9Y|Mnd+@WuX*rnR9^;`^h*_mqKe zMh1SLhvPCy`>G9mXTe8)M|@`$zT)KI_IvZ*{;%s5Ku>MI#`EwKw(nhq?-m1J;z}s> zW8X{zU(rW_c<`RWSB=FAWw&w#6XDEQviXy&?@o+;Rj&Yg3;bHT?X?>rU2NtT;!;2ZIefS-0Ne77NkYTq;WVNRE1*h;=R0EAQcnC+9m_eXzI z_y!vI&Vi5a7m-QwU1#7c0-pnVSZyNX}-j8~49@*Q4+~j`K_G`un2{e3FAWCEf@<)xNXfvoYVN3g1ctUnTf(>D8Yk-(3d2 z4;4OIr;;A=kHPhI)xJjX(RxiL$u|mms(ly0w+l+tA9UU-`63K_?}5)v1#pslAqKwf zm}J_ZLwt0eDfzY;&Qo%n`Y|KllZNw@r9FZ6`&!}4GVm3E&mqaMmG-SQ@U2w%`V_v~ zah(ji{{D4?PjV2g#Hr9DoI*mR9EH!P@QpI?Z3mx2H2q21_frGk+>3#AU8urG*JknOZ@*8n z0&PU3lJ6lXsrDs*8t}g`g^#}5Q~4%l>%X&-21>qV2EMn!C*xm)!uMmISEn<N zjAYZxqVjeo>KIu?n!8ccDjCy8mb)E#YCRf13(UVZrQA{j-;rzZ{mh^@=8^u-Q(iEX zd-?Ogb<7)-a&rd;*JB3w!j*bZT`8@(Ay{uN^yHjF$7MVG@AbiYsnAoJ&#(7=17F59 z_y!vE)?9<{VH85PN;}G+Cj?|1lB`E<J%Necb3;fqsiK)MFF$`m1mEb-{ct=&AFO zwC5>9JO2cFp|ViLzPk(>g@DasM7*9*M}MNj&RkJkqKRnhTHmvq0PcA+HozI$`P=Sfa{ zZNv5B?_giH%amz1Pjx6s-O;iBf98xCLhGj4Q>W^Z2O__}aA}&!Bugaj`~BrpnJa7P zzr4>V5$m>qu6_jnf8_J|@qY+rI|vC-q4k{TiSiTrFV4ue4Bl~!(r#b zwOKEkJJxGcx3qZ@Qtzv;Z84`6Xtr?Ie6uaqHQ(fF^ttA1u7uR#Zr6MZwyyaht|r^I zUz~vUZg7AB()--oM%xF6*g{uDqXbRsYFwujk?^9qIzw}8X|t``I@{cFmu72mrJ7cx zYAaGhQA%ovEzy-~S&?d9A5RSKFi&_y-p~glZ{0+NuUD1SZPihtC8^*TZAXojN&}0nmf!D zZbN`rui4UTLJhR!`-=C&pNq}zFUk{# zi$bif@Mzo69qy=%SX6-kYw)Ta&iPHVWvBY6ZcB4M0Xau=KA9bsC)9)Jp zophWg4^F>U@c$@y!#rJK5avpel(rblvhlqAgUq+h=ldPwPHY<@IWIP&@f{SUNxZ$x z$8O{OMZ6`Q=lR%AmHbB({0qjvRAiJ-d&cJrZS(oAyc&pGU)_f9v|-Ckd`v0$T@tot zd_+>>+kBSI;q719o=36&BtA7Pr+lSKx#f%>ma-b3?{SHLpxf~j@1Nkw>J4m9Gu92k zIRNjQpc{h^<(z=+EY6$CTd7am`xV(ez&X7C8|E61`OTPYiY!{UI`ei?(RA71;IQCIT>bWO^5xJvK;g@Em<+8HR5XnlQ} zb_JhrOb9XR@!331=VCjLaTc}(j7j$y#W=6<3Y(5vF6-U|z9}We`az?LkF84au9*A?rEw71o#YNZ9bc#7+?-B$y z*m*ciOarTijJzQB5Z0={OSEY>m=NbWt~0q3qSDiCmg&wlwsGw~-x;5;8$ZFLoUPV# zp_(fs($jhArSaypBbxhCR${E(zShX-BA>mFbAk&ihgmrcO_oX-jI?G%Ahltmy%nw6QqS-Z4SUg}OaL z-e-lzBrE2Fu`sl2&-2JS4{Z|GN{wN&qg-LMm{_|e>r?5TpQeSFl(MFY<&i}z7!pU3 z|D0J{8)^IOa0tK(XLM?R&55!^bD}M+=PcTyAv8zAqUv9fz1CLxU;Rsc3O<9|dALF_ zHqPf8c>xtKNQVVMZA&d{jkF!udfc4$U6XC77Mr5gG&nwOu8cyHL+-^&giWEDiG`sp)jm)h~FTeZ#lIa3^Ekzjg*CU z{7mz!BiwTf8q~8!Np)+pXqSh{QgnHspJh&0s9y8xOPXHu`X=wb*v9%O`#VXSlLXZ_D{+SHjFCovx;`ZJUpEYF)d}qgBWUBJC%}pfu?})!R{2+=#;3SaZks07rSk zwQ-Bg*6*3>!aNZX`Ss?GjV9X?>qgT!Xgm_AjHpSd;tR8TZVg=jr(dU^JJr=iXhq1itgow|3^;<~yBoZ-X5@gwagBf9piP{m^5Zj0So zZ%$ilwmnk4#*BUtW=)FJOQxnz`@UEwN95O;t1n>5*YPiZucZAK9>yJqJT%N!^`M1k z9Jc5qZu->@dvkkW#I=U@g}5m)%pQV%bs-GCQyXitS-lBSsr$aO_+Zvztrq2druF!I z9iOUW&|0aj>b4CQmLfn1uW^mLs{QmuGJ0qAd9frsYZ=En}te+6&f9xBVXimeqNkWvjb4?tSD7vh0u7Q5lle8xFB+PUz3aQ!~ zUA0XtOBaPgH??z(XqeVWci8#n-WE9h`c7my9P&QfJ^c=UFY~w$10Pc@7n)Xx2Sk11+I?kP3{C5 zFZXKhS;On&p_)pLYs)g!p^#ry&1uxK4asG$&`FiAXmdvh4# zGa#t#+g^Z!CMLO@Yj$EaQ`hA4)xK;_dx}Wqm=+AsMYN|=B0a7`h%l98JG5EY$pKc0 zO+q2i7L(*)rq<{`xXaimg1cGk*m{NA;!oX5TfCtiiyMfp@-!Z5Xts?&@p}Jzrs&q` z)0k*ea;T11{jT3J!xRt4HEZLV&D9%BVqo4|XYTl4lP%p!|2lps+w!DdBHFUUN1hjO z$SJ57X1E2exHUMT%%8Q`?aEJvn`EUcvFksNTejh%9ZwC=E0Z-(Y5(e3K3k_JVZzq> z93FTd)z+<2XU+dKN{XuI#fFJ8QKH^$V!o{YDBwJz)!{sA%sqIFlRjyZtTl9H56zkh zQK&sUs&kAUmTvqz!qP#_wz&F$W_x4(^RRjU@$3BEg7LD*{BpW0B;;5~Xw@6hRc|_~ zwnravJC6E%M|z{a+J?ww{TRy}Ouw!WQ_W^qh`HuLSBRx%r|p*G-6wn41nS!_kLm_s z6_Xy)JmkO`j5+xEfp%Mm7<%q@EP$?_f#K6~0nyUkdj=eZL)<+XiJG;y&;55N#=}aJ z7w4s4X~zYjoQ$9q`xFZ#vNK@3fzOFY4XbZ+R11Y429(0|$u(zS6WVc_&*$!*;Jz4c!4eV9SYtXI)^g@lXz_LLhy2qb zqW$~Ur1(EgKMNbg;%H^h`J=r}1v|ZsJ}kg6mO5@S*%n#xk7IE)mQHfq7X5whPuN}Bqkk8oIulO^Je`T zU?@&rzP2UfG^F}VtWM$+lh&s;`B2lwx`;+xQ47Zul;)sSmGnVT!8kGRh+2#Ilva2J z7Q552sKV+dtwOUcsxJ43EbCMg&XOK*JH~A^SHGgI$e)NXiFl!(TzpHI48(>$Ye6># zI!-TSb5qQLWRe9=^QAW-zIKke`Zm4Tu05;K&el1at+S=a(>czYFoCAfn=}uWd*jX4 zY1;7~OnIwJ+eYhGy7qhyeR5nnA%w?<9Se`xj9r?p4&3g(bRf1a>{vwjv2?RLqIc+} zm(3m1wEZpSw5giQY_4*fJZ1|53}TAM98y&ujR@i~hwkWgAV{8R_xVn?ckR6%CBR^@ zZ1U`DZfH)LzN&j-C`xIyoC>WuijrLBcwyDr@UFcv-BiDpGo9^y7U4k?W4HcXT&1Sa z(Y1F7?tK%z-L>Zf$(;5lI_WJmc^Z8?JW*JXcFZJinMvWo)3~LfSFYg%H|lB2u};6@ zbw*=+%JXCD>#n_KNl7ib%9}9Lvp6IlE6X2&$zGr>cDutfHqwGNail$bPID|)($e*; zFQV1AUA*XAgSn=@r>dq+j5OO!n61ai&D0RB)|xY@vb$&732_qrb$p}GQ6E){6Z`8; z@|gpQynkFPk~Q9H4SsvGS} zi1#Fn+E#PROkB;)vYPV~&DH-!mZQ#l9s@<%VLdc=?J3jS2>qMncDD)cW`r7(dltU-5_8Ng|UBv)<*_xtC$9;~jh@5#?<>bfD+p z0Sw*6C&if_pX4D6NYvd^e&wk8NA&5xIL^19yEUp|*PQxW>ggQj z7R~3044O3fKt$i(oPqiCC&rn%uYJE{E5^zT7elUCy-`SRirclWxLNn_)k zYh6tXwr%!yYONuiN8L@Rg)3CUtm_FiX$NS*k1d$}JJ$7jd4V?xtKhs`Zc_i~8)B5{3XynYQx zZ;-=bi9MK3y>a*IExWpUtvRV+)=TEJGrqL>`eK(fMXaH&o;wlsLc_5yh~WkoB>$=E z7V*OZmq3RE1$6yHE3}m^(cl<`bo)V?lri*KMgiZQwNhEJ-WrLM1G6^$8keyGXMue* zo2(iFI$;>RqiZhv^iJ4Rz5TK+5(h=uGrj4d@y^vWjC(PR>%#3d7{+J2&!6cq19%cg z61FeWnup?>AzLIou%*S_e4?r7_4X5QYA2k_UCy<~oNMBptHw`5AJiykPv?HncGTy4 zx%a7$PT(>ZDrbG4;wM&Ne+(J}cYTdE^u*m)RYNCz2rjP0)~e&tRZoeNzQti93S9ZK zo~qFo@wP8L>6&bFbx97|nS+(F*m3LE2qdSh4tJETX6x)Ex@PojledYkoMb#=)_0dK z7JCC|@5v@lV1fjYp@&*igq~AYd!$W{;p%Y|-JbQHOrT}T%gL*~$0Emh zBNM7#k3RAWtwPD{Gx4&ldmP1{eyy9JUiaYjhRDed5ht#*g+#hKzeeMD z8v76ztT$e6iOq+GZc2d7O z`$a^3dwkrQgjdWRd75K;+t!=S)j8V9qqDIF8--IGvj|D%KuFr@^W7SOsN`xY5Lek; zO+_NikU8Siy}=|b6W35OUKgkIbj6jf{4S*{!Fd=YNp38pj>WBBj!ZN?+1J_KM?IZa za0uTFr2PoeX<=y*L3Zv?PmW-+w;|`c2~q`#L@cAo`^C2ND8y- zckXD8f^7$yYA7U9*F+spw?FTnt86#5V`bv(+RIn7EGygl=&F}kg2bN~-L>~FQBJF+ z)7fVhrhtM@F6+$hb~~0r2^qa6_oceT=BEAi_PXTe_WkuYcsr@kR&!@NwZZFYqICd~ z73Xc~I9cj!Kbc(DRG$dVR@&>U_b7P7=$cd2fCZ9|WkW^Rq_yj|3<)$+brq^!2G&utT&!k)l6U7Y`V zP1oLyQlTTp=Lt7?!?mPdESajdMf>}3YF(83D0d>-(9I+j^tiJ(m(E*m^G|F3THbu1>^F3|mK;)6zA4-L)@5)?>-fH)F*;TbsM` zQsSZ!8)0(VXl-ILl&!b2^4_nc-)`2lYKNBhs<}E2D?rkjA$7V{oguiTVe6>Jz)U(x zQs=nT5rx7V=p=noWZ_Z!^swrWztrdBy`73_h&cl(H?`USN;zoZ29&qM#?<>p%Y%A- zFy-IUPCoN?klbISJzh(D>q~d{wtHI6RQsV%&Z9A4a;{>zcN`bNYieT;CS!8mwnFlaZo&RMyYF#KlS@$Hn#qh@nJ- z7^4T6VNtHQ)#D1x9cftG+~;*J2Mvy+-SOY+T#+$BtNy{|i*akaa5Qc;0+GwPimZ#G z^MF+~Sb<~hgl`o-5HtBHYc&wzyY?+b-Gy9y z%|>I>`dg0GdyiC~(Svx`zLai`XV!y#u7r6RE5$bx1MDPr{3NkoZ8QwE9)hz4_mFtUnTcc-*MS~mL^O1)V{}2NOi*%no0-Q6HV@; zd9fdg3|;%ma47AvZcW#|b=d3Zy`p|W`u`)IxmnvdkY*jaGF%*anAWC+%V*C!FzrB` zdtObnTRJ0Mfz!V;G53+T%^qmDAw@S*@XZr^^hN9Ndoc%wfN_2*V#l7WFO0gpE;0o^Mze;v%EmZOoX^F&aBa7r8+%|I z?j?X-c`-xWX58aM=hgTEvW_kzY^}FY9xnGMQ~=dgFW|DoapYzFbTHqW5p;y_ThN|D znNB}KhlG|}G+YOmb(ij2-rrKOfqIFxBAKAqOI#@Mz7(W$ zqOl~%HnzXDBUT%*<>9)F;n}Wud=(ehP*=W4^PIKXhIz5wXKJ8pMy=LUkVW+J<@xCMwM5r7=`slChRoQ8Vw;g7wV$2R6WyX8&*3(zb~L`|LU|zjaPQ=8cWr| zXzh4((Q z{4D)GkFI^STvn)zpyYuG8e5COW2ojG0m_COvi+|;#iuPXdE>PPjNhkJRk$`D^JZWfnJ0yPpL zZa>}Ei6i3TEq!$&FpRZ7s$Zw?+J76$mC`uj_d)Ug@+BXVrqTUaC=a*)R(YeK4~_#C zNAtYRV%>Bgq|Rasw~yB{=9qDU)!@ay9S5UqN&9b!@-~Ma^x}J@`Vd=Ty`@^%Gbx;6 zKky8^KeTY76)74%t6+ns>KlQuzM*g;U-02DmANwcrfP7Hcay z9RAx|Oot-|{Om+yU)wLEYKNPC5K%QD3X|19&pvI|fx%?_(=W{)fVf^eDAcphQu}oL z$P1pm+N|-{d-g!qf($*K?oIFr=O_x9WPPO&9qRYuEk=MMv}+%}w}@S^w&{YyV)|D3KKux-Xdw z_g_j|<^7&lZj%yh)w|Si&!IR1+r^gd>2;D_+n(5|X2_C0TEH$F2o~sL7 z`#QHh?!$$l?5BJCTEuxLtHkgI4d`&vWQgtcv8h96;q_Vs4%PCS^mhBii)C4=uMlRnO#(v zTT(eWTO-lK<%N~GndP}9x%s7)h0e;t(vr;Fjg`u=iVbCDrR9~mIhkdpg(a1ld8OsW z&dLgdR(4^IK~n78n3-4Z%r8b^nMJuJ`IQ9*jogy#@<+-lGb;;nOEQa{*~Y^gD|1V7 zP;RlYu!`J@3No~^FnfJ&rN~y`EXk=TaIVjt9j$lm z9Q3UtacsqS$E5E_sNMPnMfU=!mS+4Hy!RNe)MG zVaXiFeN#7%-MDrl+Y;D^@5vo4m_B<$Ihv*tonMSmHMVGj;dnWQTxl^{r82j|aEL06 z099754^-+TExWL+00wVBym1tk?SWCJ zaTb-8D492utS>2jSdqXZ-~?!v4UWXZe2h7artv|;HV1>`q1?>%xsOz6MY;LTY#K01 z%VEr7WUr@DSelpT@DEWfNGnsgpFi4Td|*03mP7=_4duDx`=u6M>cr&nF#PEo>B#G8 z+$8E2jt_*Ren)y?2}TMPpH5R#h6n>I^e7->g`=>-QCV8*s3^chEFDyiekH(2QFdwR z`odgxGt7s%6~cN<+t~#edt9CjTNQq(^hhOQo^bQ1Me>C^+P*Lgw-Jq!u&?92-h< zHMIPx3dT_^ zCSAlQ!=xLeEu+^}ldV{HQMiNw;3yJR60xYH)Dd*B5CN^UxEL##Am({Xm))t@7`!_N zz5xT_8q`H)<)xLS*`-ARr{#c)F$W4PLrd~=sn09c7nTK2Q9&9s$>!7AEIX$l6O*wM zi@3b<(&EhQT)42}vuZBs@6yHlJLV|fP@zxDS(x8pL>W4&KN~SvHWcMJN^&tO5DB1H zqREk7SW<>bGRIlzgcmx-B3{E>v1Gu)h?Wc#Vz92{>Q*2cIV%wwG*OdWETAetSyA8* zPG##ekqZ-eU^w(^lkQMdFIreEoWCI5k?kyVW)+VdW#4==Vw36_4uo4Ia zA~AnC<|15cI6B9%%%N{@m)ljrbrNf?t1H#Ng;b-34uoT>o_{^3Hh{8HQhc#L4Y3+g znvQe&y$xqRXf;QFS?`i3KaRVk4>;x(t7+@Br~5n?Aq<88d{8bk^-`W zX99%yvf>IYFSEQPUsHRVdZ6-=vRqnYh#2d)0TF{UlY4WqijxMyiSX`gDv zg#{{*3{#BIL|-tUY$Fs;QBA4x)n)r#v?TXo%sb+on@9fZx7r1nIgYvuV z5d08GRj_ClZM#XAEWpN$Ct7S_gw1~snYO#Nt*2Ks4{oA#Ry#InYK3^+h zlkODzOSGwMf?mHnwU_y~)Gl#+x%L;f=T@;lL>tA=%Xn4n-=f{b?Xykn&(i*cEu~a^ z%-T)bJA8bh*q@>$vb}nFN!nkS50BGi(#L7J&-IxPh6$^^8yEfEZTg-KJ|Ja zS%Th-O8Sce2Z1cw62tx-hJEtdK(YiqiHq_t4;%!tXm=U*?=kG(YuI09*uPI3pbX(C z91Z31NQ$)2?oGS;^K$t3TKMrmEmZrCRUGmkU#ARt%Kwnz_;(G*e`DAmX(<00<#+YO zw@Z0e1MUBi#}gSq`-cpC>hJRD_$NF*rM}g`FMo?JkH2C#{bKl;2_KzXC&kuc18^^F;Z(m5@&Sa}4>>#r{Oc|7t?0G#P<_Je~dEp$CC#C z8D_{o%~0Nl275j>+7nom-GJ{aU{f$3RprUfL`pQ~l!kcs9Hc^^hz z2jfSu9mANO&7R2kIcz5~J_Gqw#z(Q8!8inQfP9DS`8~FC33FSeu>2ynWQvK~D4pdt zaME+a(q?gPx@; z<^Rjr0r?k-{4!(e2WoezAIX^dVW1+9Wt<54aK*@ObnCaml(1J8y>oN!SUU zR@h8+C;fpK%MQZn_=hwGAJZZM^|3|P^CT;~&!7 z_>j&L=)A``8~7YyUUr>l`FhAdA)JAKNT1{$r>3d^GOghvC@vn>ffiuuq%I9t~rLpVpriG*`?Je6>&ru_qLOEJiFn=YTra*GY`=Ve?A z&ZUfhM}5KgIOGM4{{&pd_!96&#tG2hL^x09uOfVtj@^X$l;;`3d^*%fI91cWi@bXn z)4H&kaK4`R5aHQ6K0=sJjb0>tt1f?ya4O~;8$fF=+GD-{(S_!-8)uaGZe91;y*V*Cc=4-np{>ld(mHsTz@ zxE90b0V5d4V7q{EEVhdo)A2hPgHodqPkF~+o5$FJEe%(aCt~|O#we10Ln7p{W_>Ou z9g3Y>Sx%gX7&{<;jWNa1PZ$%=zZg%&_9EjM*nZBKczleLvArJkq_QY)G~>B+oN)^9 z5XK9D6BPYPjHA%!QzeED&7s6ebKM<`iJ#_5S=N1w(bd}hjBUV9#$@Mu#?_H;ybJh!#>77gZB6=(z!Mo0{}jf1fTuHV2F_P>)-hfKzGBAdzz;K~ zcHYgH+W7!uYUg+qBJHHuM>rjFY9qo+fs+_70A9-&8!ekL#mjQW6pw2dQ|#Q&m}1PI z8IwJsi0Q;n_6%T5_RMBX>o|I+m$YpGV|s@kt>;Ki@oza}>X$4z8H!HRw?;};>Pd7bjM04Feh26zhN?Z7h`Q#;IN90fm_%Qyx&O=9Sj zF{bvU^#t)#dp^mSc%EWR>+z=j_b?{TXBj7Br;ahLr(R%8b$^>N)%{(@RCoM-N${sYe=N?g zs4Q9o-pM!zI>n4*P;ND2sB1Nh7hq>Q<8+`M7{3SH$M_uZ z4LI*2oezNrGCmKS$oNIz*^EB{PGd~`^vrC^djWVU6(SqAIEqGGN&^pAI@eR3%pU$e~j@O$iK&!=9g;56#svq= zfclFuty^ADbdEAUjl7+VslP5TrvCbZG4+=f*M_A15sWoz2Pp?0D>3ww7}NRIJ&OE3 z#);6spYbNxR?L{zXg^o|;#+V~*18-vW6k;{xEp zj7euWV>(y9kuh=3VEhT>a~NL$Udfp9-p`oMgYy)55#!IGzmYM;r7FhnLB3Vd-^TcE z@ce)=o$u0lGPOVDZDJe+Ih`}he)%QiBG~*Z#$~{7F{b!)j`0X!6V9b6ZzJr#o-ru3 zXvPlcjAYyi`9#Kvkk3-|=P;fM`K^p+054Q@(ity>d4L1 z+`*W}`(&vPo|%kyK%UQ-@~&gN5xAJ~Cg3BC-vn+~^j~8<5u9%-^501e{w~JkZ|9{P zJpW)k2J#Dxk3jx4;}poRvj==Witz%-2Qf|u9 z_A-7E_*KRZ;CC5Q`@GNiGsyp2k)LOL8S;NHrZL{jco(o4UnI+T70x&uq~jTrZPOU1 zpnn%KUI6@E#$?02jME`6W4si2ALC`fKVwXO{vqQw@PERXc>cwB7i_-BxDohs#(RKG z7`S9J#e@*X&5#ddOgyoSPovy%jLBDTQgmiA?nU0Yj9-DyJVobr#w)>tciD(?*8mqW zegODs#yP-y7?TYL8Pi<+5@WLASBwiF|Ba&mhNACNFwY z_W=J?(fK*!7RXO3@;4c`q5Xfy_%+~98FvC-H#}fZ6yrA`AH?`H@Epcxfm0a22fTst zIpFUzCjY^&>qQ+~Am66Qf57+x%J2i(;8qZt0hf*@#u5YQW={u%Y@QAtt z)4ds@?(=mWT!z$QZq)HO#*~ljCpqPt!kF?=`j7b?BAaNR7+~U`j1OVrpT^kF|0o1V z(tg6y{&oP>eyXy(H$e0k>evmP(U8Z)Q%=1-2@_u$K7@(yUdAM+TM9@{91k$2a*7yJ zIhBmbM<`L-Qj&ItAifJbxow4=Yjhn4HZfy#EZP~E@{MOX<-3_N<)g30NuRs)sLv zm@4i{COM@$@F7gx%NSE$(axMVm*vD=#26dx8OBtPM#k7^`xsN54lpLpR~S?MUS;gS z_VT-ecwc5M}?L&FweNdD~`d%F6O~gN>1bhfnSrZsjzFCYZ zAKk`5I@c=e=r@!FH`QW@7>SA`Ol2i8rm{pIK~80*u>4wO{q-BlqFW7OCgLB`SbPXm zS)yEEDogk+unk!FE%3F<3XSZi4dHuqe=OyZ?J511?#CDdc?<;%BveUYDr*vBvSBu3 z;+V&n{3o3;HrkzxiF-L?$}4;l{FGPtBry5X2G+qwdyFyFU3^as9m-4l(q^*BM2bkF zE;OMaiSdX!Qj+zeciB-H(wC@?GzMow9uFKd75|V#djb=83O*z!?)w=NcMfCX&Sy;A z6^zM7VL$RZfVU{}?To1|PctUYdd6heF2=+u#vOQw^C-&`v88<(4~dH~y^m0|3CBZR zI?`gM>$+$@fw2*DpOhn;kQ2v3#>64w3G!0iDVa9u+y2UZP?ozu*P%S7$8{|GVn1|5 zU)-b1scvNRPa$_O{sr(D#`JDPs;BHPToTq|X5b$ZM`FPvvAVrgB98LT4iIdX^LagN$Ratz=B~s9{XD{DiRsTS_K!SR~4C?4ws<9N8!D zs}yZT!3l}VApNsY5N*Z%cpV*^NgBAOhYw-mraBO&x{DYHOx!oIoVZgMlYSawDrXU6 zDo2b>cjF6?pB5vWM3D3blBq5)x zWBPB}tYcA@OUJ||+fB3;+9Ux$v=z6BXsai5{aDhcN+3}kC@B@GIy$fU{Um`s)~zjkIstf`3S| zUW7%xP{<2(trz>!H$+{sNrT75lR8eshU(Y_{i%#!1fD^d+lQK1w!;F(PeI259Fu~7 zNMsLTY7?@7Fxh2iO!;uCD&)i+$2c8Z5&u(kj+HE@y!SIEJ||F)V@qEdc+Uzo8(ho7|oN!nD z9;6gK4rs->#o2g)y!^SUv!Y}go*$5#n_1$-16?xdr~8>jg%y>Vc<2*7ltY_biKi|2 z_5Huc7Y~P;T%KFx6bh3AKm84UsEMLigeTOLJB$7uRVq{H;b-j?x%j2@RnMi;i&iPW zMb$_te}LZ4)3>h4{jGWYh3LP6md~k>PujYg_?z_nWO~iMo$QR0q+U=;kd$SFhD*Q?dlfQ%@00q$jrYF4}Lz{wV3)nnjFVS^!gBkop40>h+J={RMmIYVo(W6N4j0qaccw&sdJbC~@w(?*B zY2;PU4Uh+NabF_JBw-A+}+kl5oh$qxZT{7kNp8A%FCr?yl z!X5mjQTFW8lDtej;YYYnVfIzW@$3x!aYkk9waIvtPwwQ~@4ROcd@Vb`qlT^Gvce$# z;v58FrU-hFkdi4+JUq#tO*tYSR-%LgwQAzYLF+T=p(B}iKwqX>5?PI64ZZvy=cdPI zWa0^$=-Yh1dDLof1%Iv7V`BA2hE+NP8PxjV*(!b_7)+|-sbs2YdH@qo1oG=rq2f88 zc=So8(y6Mys~mx$iKn39u`rmO^Z@Y+IRGkO6=d`~5}8Pk(#-&b zQ)mb2#l^S>02zrd6dyW9d{028@|^=0U00Av@_i3VD&I;}VhogsFAN{aN5At?`RKdg z1(J;QXm^!?Zxi_FngQ|AH6_VM*LYRF8E6c;rXdsQQF;g;!YTMrIs`ttW9Cj=_rdGI{|8S&AzLON!{=TC3|mG2Yq6-g4-!$#|Zp30Yw3#N&< zI7EE7WaQ^NXy9839eVzSOpn|3l`p0=(7%HfzJmrnH~8rL0hy$IdkuUG z6h7R7v2>r)pwzR?=1LkgIp$QUy6ZmkHR+`%98JK?hkaI zNU`Jk_vej<{&*XFbWM=@VROz06#;RBn%C&zCbWYWG_2EI4Jm&$o)Bl)Hq_zr{|-H1(3@`dXy;6s(jnQC)+Ox$0grs7^m8|;~Mt8 z0VS2MQ?YN7!uPy^Zx8qul0lrLeftc2y^4KPpeyZr3s|-9lWW*_lJlfsOKC<$p#5mJ zmwfwxRX+NnB$YC7lJ+%WpKuDxbHFFt?&2HkL2rxajJbICg}Gg82LUm)b}j-UW5|y-J^@48; zl&HS*@R5AKHt=l%-wTqA^=S832EI*L&@@9%eDm>|-Pl;}5|gi~k- zY0Sfc{#}TD$ya9JTMEAZ+K+xys`70FUlDl7zS|YP?1!bx8~84RPmbRuI4C(q?AVjq+@0=&6ZxDD8qj zTbBB;>eH%dpUy)mk$se;-UQfZ)Q8!b(?)P-KxMZUQ5kNp;uGI(L2Y)KYAC~imV~2S@!8!gXOy+ zPgCVMRXrOhlYWELU#esMBT7E`KC4$*_G|SRlhAL(WQyhEaZ;}a<;wS8NhNH_no`oi zd+z8rT{2ZExSBEjo{LgGwhzeTc(3J3#`CdF#wUXJ>33?W=zB`bu_ZsHM8D&c>7Zis zP6gL8-lfRsw{($c0cfP$hK;Q3SIqjWi z?Bi_(Z@mgX>Aet1|M6@G-fDQynOEX%KHm$h|B{k#4VS0qM7?>xl(%KPeUP{1yd{10 z*{rnxg*=u*d+;UR4?%gg@|b)#q^_dPQEXYN;K%0a3Qw`@1KvKy+Zou#;&TC?&savk zOBRX7@&Cd5;#p3zT*Mbj>v+4Kx4KmS|2WDFWBGNwwPQOHpLpIU&F?clrpP3Zd_L?S zaqRDW{JcT$V`X1Hua?Z3-oO1ZWsy&KVZv_JR{!KJx#pW&!Y7X88P_M&&_GiXmMgz zsQO`}JG_zJK?rxjd-Lek$hN`a)yP@Sm=(?^z0NHM;#_f0(z~@|#OuFtDNVc|S-i5+ zqOBT&7XZ?Wv_tF#WqOG|UpE&wqQI3u%at(Gw#bvNwOn$Cc@u}>{eYf?na`i>dMD+B z_GKP#OvBELC+XeZeUVPwt~f=rM(XcAJ|lUonl0SrjOhrWcWD-++s3xzkpg_MHT0ZC zb6F#82k`Rpjux}cuEnNk)lHs#H{wOC8HrlQ&&=*i^iIOwM{FUR$u2S3O^VEj*Q~?1 zB-}Q*)P#f8J8Ay2?l9S`SYKd#ym%>U#(1qd z)oiP;O*W_H(hEy5W<}due`E%A2VUqo&M$)%R*<>F@ZQBZpKsi7bH_9j%Jb~~V}sj; z_a)XXnJ4p;?x_%H`|FI|RA)39lQ7fe9N4x0lWtKlU9IzWK|9?!$Q3tmNiyD?ZN^Ik zVhT;RnO*yPyK#D?E1!sq?z5oB>%v^)2UAOJHG_3}+`z}?r#heTCQLo*^S%7~2MH-% z3AcI25Ak?y4LgsCo)V3h_G+M;&}RRly+FUfIMfTT!%SLE@7<-BMjj43KJS$1uEvkI zZLQg9TUqnqW}mNSx$P`o-foLUO>F5kJ+9p^)O3^lj1zAZO|EHo?S8rD=scef&II$E zg9@A62^j@wt%(`oro&+^54xAbdnQHVCG%FZ#U17ek8s6BdE*A|A8K+x7@sg4zEeYr zJ*Ps?cAr0kcgI?_i)M6ZOFJY-|4D7@!uvwwqHAN#*0;bs(i2YaiFDxtQ*$(4ds|iG z*ooVhH}B|;vdx@E6*_@-6dhx6#SKF77tJP@*(^%x+Wnhu?heaz9Hef>3$gL$_v+70 zWcuT-gkdNkqh>i?vYRn}c~Xn52o-Locei5;H-iJrc~pOI=k9j}8CWm~@<+S!#}+hM zU-iLP-05gBctA~ekdGb{p0RRB9GF7U^>;)TTZZ2(ydc#XGrhkdjS9&j9h&7Fgyxw& z1O>Rl&3VZoWPGG2ZlE^;j=%r7xw@HtYd9=LJJ57&-;GBOM%jmrKi23wg13vi6TJyD zmxj9*TRn?IU2)N_#UY@vx8P;MH{=Zs^(2b-#)gUa#;!Zwb71FV+tBl_p_(mpg>#_Y zJvFJ`7U^{kjKgh}KHv1+mQC*-IO=Wu>cAPiHrDHm_U_XTw0rlW-<6C>q17OsHv6y~jDw8yD5k;96v=a?f)u(vqHW#b_BDd#&|a zUDHNM|wYKd-3qd{YI&;T`kf6HiL$qT7RnK0B7Xxo< zaJ$1ZHqyXM9BJU$M=uZ829jnp&;aMw&y!Af6OC@`4=u9pCkjZ3 zVY^{(%^BKjr+-K3Uz5Ai-n$?l!~HswYYdHs#>A)xYTA;f&q6)JO&Hx(E;7xPrad0I zHloTSZA&v98#5>=4=*@3yL-?$@y?j>reXP3!ghr}d=9vF}W`2#5Z;q+R;7@XPAc8Wtsfs&%<1WP_(0SL)$^eiG-Qn zr6EV&iK==(x~krE8gKhOyP<1o7`^tl@pJD|E4}=8Y3Pxx@73?>wv$G{_KqclRx!QuJMS=aU%*bPj%df*?$zK5!+Y$;Q%W! zje8;@vf>8j*PGLBHreJ^&oJ3KJqe?>9X|$FMXsXXHZ1imnK>w5r$JFaoj~53Os4FQB*jBC#$@8yT4J@jB)t|Jtc~ zvxYvjx~b+gH@0?TJ@q)uqs1CUy<-Ve5e~3Q8|OCX6^yX0gbcIUf)Gza^6&%R{A6#! zObWKNkn?n2@iu;qSZptxg*LKyX07Bbzq^wRTNw`*YOV2>auv zwvVIw2CR)}^F{srIdj^xri+73N%v&@>xwtll;qAh*k}Er2}JyAZ+%S%|Fde<3;jdd zonWsUup(hXYQiYQ@Kq*T8u+{RM0Ar6v|9T@gww-N_e$)C$XM6KO}6JcD5m{HUnpP( zs;x8GI`VHecce>&VQ5p~^w!_0YfB*tj^jL;z>I#U5@oKpB0Mh|Lf3fuUGX$;Zd@7V zNtkFq8Ba@(iPlc}p6xzSEj_Bn;gs@%KbQqvUI^uSu-U0Eghmu>bmEM_y|b#iO$@S` zws$Zax)Nrh(hY8`z;-+<2IXEJl-~46PkKb~AjD{syrTLeFI)`K#N5)g=SE=}rbt(a zh6R^3%fI&O_>(?fLa?s$hKFh|NALJQ4nzdh@=Me*sySiYFtc^1$-DQxg9qv&FJVlr zHV=QUK9bG`#AM229^|NV+Em1zCsN#PuK89EUSRKz5>s3|0u<{}uOmv*^bq&Nh(b^P zES&c2K!*I}tVLS-kV#f2T8jqtt&v!$i70UO2^R?E+N{;w7lJSW%~eAT^L@NcHxcu( z<;thFH(a_>)tZV3m8+$v~AO|Qgmz^k7csh=n8r@NdB{UsAL?vJx?EcjHgDXO*YfoIq zB^}Ck;`ZF9&w=Q)v_}810()wL;DC1Zj4QTZ*Ih~-A8X%ocG=SoL@mt!X?0u;Ua#n0 zSski(TG#IV)x%6Uw^$OkG~Kntx@Np*N$Ao?JWE2Be&ktVSp#HV`lV-y3DYZuk$ue# z%@eJg#WheXrbyHzt0I%XxR_u@h16)4mhIX?2J@-Vb$jSy**r39~WGeaW4S^+WTJ13f56c$w{l zCnoaVW!f(_TUy$Gqq(A! zhoD4M*{U7r89rK+>F$9`^;=}Xzx()XY5WlPB@9SUM2LO%eQz||tP_{Q2C@1Sm0B>) zeW^3q`&z<*o@1R+dNa|1n)V-9Y}2O&VneI>l%^^`x11`h4|gc8HaZCrztzNAGZp6=a&peW^K7S|hny z&51|hYJp1)E#0Tg@wiSvvcu-Wp8LkR66O_0(kLBa(qr!aq1{wpDA;1p_PFk#aOk-s zv^fE7dPkW3_4%HJ)C={rI&|F;?gDm4yY7f^HN|fG#fgN}=Wji1$%3cDd7ErP^7>7} zb)dQJ3Dl`WqgDI5^ZLmHt_X};E{Y2!Z(rAp`XMUq>ul(BhxN9cZ|>T|jo24ye{P|_ z(Gc}`O&&+{6|$~wb|oYuB5ykhimG?o^z6s}FLCbzA60ek{qLE{jWBA0aSVbwfgk|_ z1VjiF+Js983KkGCQ51$;NHCC)1W6RzWW+Fu*g{G*ply?I5m9=C(i*IsLny>(rLX3A zTI`Wltf!?HPnBa870mnlt@W&#Jws5>`M>}7U7t+$cR%}C&$?gsnmucqDLwMMd1lbN zS}T+O5pjxnz;d6wvtwVZS$Q}+N~!kj_yl>8^X%tp5E=9@hvM6Jo!q3?tV$K*g{YD?6oy(ssz*lii=n4y2R?o}ne)rI=3J+Lhil_C z&aMZoM`O~lN``f%QHx~s-JnhIMh-dLygRUc&p5PPjzlhNVbqX2e&+1@XNUiIDtgw9 z2b^6$cc{tI@?%3K4&T=X^esZ*e;zF<|Edgg=)0IARA|~ZRuhU#Gcu6uA@iy&vNhCT&#;+ zjU`OJ9uj@{S_rv%L3)MI)P8i#wePdaupDH#^)#-+keZ$0KrJqBg3lslbXLGKj9iw7OV#~+agqQbm`9pk(m}j>8l2%UU=<;R^E_eox zKsPz1)PFK-MdpBIfg{arGq(@N7VdYcW!y(({<8aV6^4#)drDHnW2*BB^+{uq_-OmA zrSfa0tdN$NJr~&Fh&sO3zQSY|>tae$)3)Xns!rzP{^tO0`@28O2w(x?!s8t)5M?!Y zbib@tjnJI-g{>KV@id?Lcp+xFnlxgjKS+gZ7Kz@u!o;y_?Ps2w5-`U@d@yGif<>x0 zEX4XAralMIRq-G_9Xd=@Wu0M0vq$4SH(c&HcUkFa)epQb?PHa5ble4}9+vzmiA@dj z&m2KD^tUH9)gSHFxpgY~Zl{`xqJmVujPDuzz748JGUMA>-9BRxEyM#sPm5OV7%?5x zBH7l6qTX{_PXr?6C~D827y5UtZ)yz0d2$zGrRSCW6S0BVhFc@BB#lH)KA|2 zWSYAinP=*BrC?zn^I2RUnp1aPcZ0j1Q1w^WmZ>HF90#uFaD{nLz@Ot%YbMU4PU~n+ zl)o*t>G`{MOVm;A_Mm=F8Ofm;^BAT;X+S8`2O}>hq^sWz!x~aq&xG~w>A6s2Pqs9~za3r4VGrib+`y$*tz{Tr_6{6kI0l)Rl~q!!g?A zweKUJRqeK|>2wu*=FZ!Am2-JY;t1_Bz@cty`H@bfH?EG%bd@cZC`2*8VBoN>EsI_4$;V<0 zj@&vps^_w#jem2yZGfCU**?AJ4Or3R)nwqXmBm27= zIC80??HbIE*FJYNN(Z8Y-59Fc^qnTXIotHirF(nF7R)S9w#1%0bmnQ??H=7Z0e)c~ z^UCjfO#r8HcTjpkQu`2NX8Ns|t)GR5;rwARj5>>#q@E%8g-;rf4Yg48-}!q4TI<^vd)Akr7M1SYfLqZ1Pva|?L$6~A)cx60 zKX>MAu(sb0&pCbz?RJ}E&^g^^cm4yO_xO~*K@ShdHfn1-TV*p9vG=_PSB~>b!S+x z@DS5|vC_+8z2%1&(4Uk##&@SmKI~Hp7hEba{0`IO!7wn~^U9T;i33z#_v}0dot#fU zGuex_(A9Fj)`wNmDcjonIWeJb?&q=&CAL1}#k9Pwx3_h2!j!EWw-xX4`9~%MN-$ih zFQ|{o*PfnA`C>)2tDIS!TsF6E*v{-V?X{lqM$#HSyAW0bxDNA?q)w-`JrpsPO2ccP zsfDn5&!M_@3~w(SSdqCmz_sdJR7wnY?J4!P5f38VzCeZ{<7r3JC#r-^*MPwRQJ_jn zz3Nd*0Q}1Fhyfk2|j8 z^`^&A6pNeiwglJn+nil*TB8D!GXEU#HK%3YF!1JpFA(RC>tCFfrOR~Jr?A_QWF2Wh zUzXVPGHqXf^BH$cz52@JaP%qM59yjUBqLbxXs5rmU@8rFu3i7j!dE6SC#}E-i#u*o zDm}X$s2eDBHLkcvrEh{Yl*kN6&(5DCyc)DOeJz-1j&xmbeBQJHD+34O9Cg1;Y+d55 z+m-m-UT;S|+Tqiu_ilT9fHUSftL3!Hno+sB4NArw>Xb!c&p+PdY^!m9;55Fpoa}7C zg8)%Zc7IVWd-s=?a7%OG^xgfqur>-Rs)xj`F18*L-%g+0_@hh-=j&k+zvbY_U)Bfv zoW%p0?wlDoJwI^7J#gFp#?y=A&gDGWJ2>y-v`OxkkM}%SjD_&&mb+u)kDTc4Z}=By z*9tDNqQ30feX&_Ive8z0+Q)nDP0xgnu36U95+3Jr!nW~xXG5N>&+Zx*;ThL4ig0lY z6TqH2cXHzg4Rb8dzeL?|y))((Yz=x;9F{SU>r;VaB-hx)aY zU|w|Sg9E-Kf815Y$*WM*w*>rnJ|ybVs5u{?-FNi!Jb=aU0eK&^rzAAT^I?tlc!%{$ z;^rr1QGZ*)<4;_}ktUS>Ay&i63%K7}+^?TI`Ig5zVg}v5s^8*Yeug;_zw%EQHFMI0 z_J(9uEZ!?zu?A0ne(-2Cg4zfP;qxs?yP8vQk=yn?VKE7dFeCSh83BJ_m#4LI@YfV?Gb#9=VaQ5t8j`L6jMpWt^ z#v@uSA2*I*jY>({mRm0ajJjpl&j6?rZcjb^jk1uA(IjJ|EuI2i^ zzh~F=G0XJgf6wk1Xmz!J9@y_W_k)H9KmQ6(xBZ`0nV4;jpB{XQIl{I)*9o1#5Ko8m z=#c4yHf`K`mEUD;eDVq|T^<;;qh9iw6(4oF^*$yj$|_EZhMFf+uLk$Dej8%cL9Bvv zB*nlYoT9!rOZG3%<`-}XAI~VOClc|@v5F1sN5o2o&#Cm~da#L@rS_vghQN_?(9+x_O|K*69AeT`S{j`u`I!`{e1ejG+H zhv!{aAhELh^HDb@w<=$Pmq5yj z%vaMKc+woN9gXSwU7u-Z9-&Mgbb3B?!2F<=+1v2-r68(_-=^L%?)8K7(szAoaQWb+tao_q}~t~cbz}Mxa)zl zjbo}w6J}n63j9N`xSO)QrE-qdd@{y;O*@Xe9ozRHEIg{HYS2yDXcKKeVq};bxB=x# za&2O*qo=La*rW7Y4t? zRkvq3mMT@>+V&^p-2&zv9{h;5Jn!~HSClN@xwQQq7g5B~TqAL+hiV5N=!`nyI>lUm zFy1rV84LtLZM?dG{~y0s3iLdDH~hV~=4|(*m$RpLMztSHIPg-!IK;^ne2#0+*~+$q zcv691?9`(^MIBaIuHx2yr3s#K#!NVBc`jli)<4I^n3M9XK)Z!A`gdNS|4Zkc$)7Jf zesS(z!Z&^!GV!#k!@Mv_r*xEfOm^Zmz;(JD>2cfhwF)0?l3c|0?^`Rdq> zhthO;?BLWDS&oO1QCW4n+mU8uDeO+_p}<5g+*RiJ)I!$W$!_*!5}r%+)NpK8S3UQu za=+3uB8mAz4{T4n>b3_m;}*}r#qnv^w)+x1dp$Zs+y58prwY0B1J5t6o|BlL;*N4p zMBVVWziE4J>ok_3@bDJ;-Zp>xUmCL!VBNjhZtMu~7!H&y4Hx zV7ioWL#{LD1}38=WqY6`F5qfTyV0LE!H*>_JaW^?DGQV7u{`JSfaR5W{YDjU!Ozk5 z$k(BFTyyuR$8Z(1v69bqNIP5zX`gZv&T>K(IiJ?Dwu=Co0s zfsW?1k)A_Vb6T1w-}0x8Se*M8vGPr5b#3WY8H|ViCdZv~$raw7!amcVn^^Key_60H zwOQ)sZH!-0HLRl&V|cF;Uf`o0Ih7an z@e}LuYNKowDj&KZbO)BTqpZ>e`Pom8dpaeM-Iy3yVCtrNIJcfrQH>~nKtwabn1mGK z3q<$T6&&U9s4%|;QgM6gZbU=*MdaKa{ux}2o?-cCL|4v;a*t@9;quRLx=R|PVAI~V zCS7K0OXxGF+0Mt?cqEwfB-f~p=MU=d7hgvm!Iv&^4h&R>u-=^*yhq)FXUu96?tf(C zL3|m}Y1Yb2>{8U2JVYKYIl-2J)wZSb_>EdKF{*gTHsHEH(C9+C&vvg@IgVgY+r~b$ zQhRzvNBrKY4!NK+Y7A~pyV5hq(cyY-=Mnedr_!gGh{s%QwWIP~ z<7h|adjXv0xfB0KEFKwJ!U~O>Ds4Uet@i$oQNMiIRrf;TYd`mT207|}&c&zwczW^v zgd;nTtlJyPm{3|$ICgUtE-mS>^HePExE41#F!4j>U$^ZFgpX`F>{c1(+3P&#;xHS` zl29DnqmH&#p)XK1TG`Zj7&bfkwykVAH`!o2-(?tib3eF9&g&l0IcHZj|gzu@Q) zJj2ktF#Fnt*@NBvw)v*UzMSnTbMUK}P3RW8t(G{?h^Y3~SNA?0!=aE*;-}zjqu0GVj z1nYsOx+k*dZ%b%*S&whOu5L&6{H6p@5XjtMMi$!==o6AB%ut6Q+B94L)z8MnD^+2$?Tn>R1Ra}imamtoGHrA`4E>NLZg zR;beob6WRLIsvA1J$%BrzNRoL6fS2nh)vS93r((016%g0~` zEr=^d%T`c!9$i&iHP*<>N|#sqDr?7vc9qiGU5+WRG*{oz2S~;Z&lR`wGLX8jVZ%!?uiLl)rGZ6_w@H zE1#l+gDjwx_X6)C^lfM#_oJo*4hf} zfN9&t(H@5Pz8llM!4mrN_+v}DHHhe1Z(30e_8!AtYd9HU6<7LJsI368T^cswn+AoT z2x(hUT|!ZitQlpch+1wDc0~&+`l?IIS9`G&q&KuDoIR@PCKpTn!Yjmr;i{{?u z9XDotLtN`bTngKB^rEZWdeB$Bwi5dWmaQnSL=Uj4>S86cKc5$cRf;V^3%qL6 zz%SCQD91j--s1AgRle$r^{_*9u*{`OTomezIWsSk$qvij>XM?>-c`PWixp~6-wRPA zSNX7CY^ArV2pd#ZU!-Qr9Z9*jkIUQ++vaEO>U&q0ud_*zF66py1IR$++v*h~*yf5# z??c$AhD&G7o4+W3>B3pJ&YJzrMRT$j&H3i7OXu90^G$C^E$pKAwi&lA_7<+CDKzNS zMJvjyOI3xl%8FL_3TnfJ>E7ko)A3#^qq&7zFRa_Vs(mU$3Gt#|tfH4RWDClCM4zTr z^HaOQqq=^fIaW?IVQ-p_A-aI21=wM8X~A*}vA0+5DsSm(FE_F-UyYcrtwtEDix6`b zu-R5?=OL;GEAO`X=)c!A`MMnx~c&fXEFhlCfGBiPlWxk0C?>tWfdRqPE0 z)mA4KaW0gO5;A0USfkKcNfCN}W?`X)QJvWursg#@0@r8g?g!T`sr$M^MnLzkHKNL* zl`5;J*y|hy74cD8r82~~maPynn;Zi|DR0K#NimE$9mt9Z*EM8lN{+nB$ zmctvm1oYEd-!fTWgpLhmrZT^}vX&VfUIT_^OsLUgxlPWht_oyIaKz~QDl43-ml1uN zbxC#9`q6k@0^^I_F)yuGwYF64^y+1s(8C7?l+ub4%)4-@$QDIJBB=e9t7n+4%Az%E zk@Hnyfyp!s7ExefSFqJ|VJT+>cBvOr!BVu(u=s}JZi_F{t)>ZN{LC+Ixjg#>eH90fiehOD$T)pd-$7HZ0Qcx z90`V9gxO-);>{%Y9k#tPL2o3@PJ>0td31Qg4f7w_s_hrOX?%GHGIfNt3O5aA<{PRg zeMLwnC2|RG&$y4hCd`_$U8Kku?~Uug7JvDaHs>#!>@U5=bT@itGUP{>-#mNt%LY9fdz*)z_BDm$O^7F_ql z_JP6lB;iHgmxj8tQcWehY6>Qop;lE=jyfZTFj~*NHB{7n84AY3UjOxaMP#+oU5Z-D zfUmFx1bdAO79y*)eGhiq(tuq*xI#dEWp$|@$(Hgp9&4AEVX}1zufd>LU(mM}pepg! zN7s{Eyus_X*L-M$ra06EyU&Xv!MA;s7IMy49eSsf((3CqAR+J4LCLFILUNtLu&XB4 z$nY=ERVG#Cs$`9760`F|buMh8cDvlg&A;sy-0w>&qA4OJ}^18H0sQFIP0R&!yut#^02YIezj8+m|33_nI|uoJQeycyb9R>A36cK_)Bh^bE!8KhXgLQQ?>n^J57h2OTG2cem*L60&=Oh z$%aHO^~Oc}`MA)D(!Vj{{HBQWNfGBP#gKEUoqp}-(?Ta8SJ=+!JkO4}J|p6MR>V1L zVaU0xT&tgLe==^3$bD9gA6_3Dk-kr2c||*3pB-_1zHQ$+ zUcWLz|8DWi1Fz4Dh%fiYHICQ0XPFOaJ*1 z`Oz6+uPh>cEfM~&h=`wC`VYpL_P-SopWzYuFGb|%e@2|Y6`}u)i1Vi-^6Sxv^VcHI zPekPRu!!{KMZ|YWM0$rsT;CIsU!I8gpNhEtY=ph5Bk~`QwFMpXuPGwFuSBHGjLi1SGi@pnYT|A$f^esTlbd%X36lpl*_0D6HT z5%pzTg#YG<_*O@x_e4beuZYO6k_i8sBK&WN2#?LhA)5~~jt=Rfnb(d9_y@G%i7Ig)wz z?~`Ok7VbHGXy;kQKi5V%HoIrLk|H*5V?k;g;+9QhV4?-2Rx@Own~ z&){QZRtmUo@;uG2iB2B+x;MzfwfrrS{|NTq6>f_|-jZ+CI`518O4$F9{7o%CPoA$i z3T=hu)rGp}79InAwjs(NNkBf6Cuse2k^dR;4Dtdk&lLG9kY@>h1kM%S1D-E@KN|HS z@-?4*!7s4RW5ApCspNep_^+kq>9c zcWOD`Z9>0;AwMt7J)-dgCChP_)`=r8(d;J6L??+1zc;~eGMO*WhVzP?`)j9?muh)B zd70)3qVoWBrV4Wp?3uzPkmm_=KkQ|~_kk;fe*=Av5e}cWsoqzSfxN*uu|afx2j)1y zcsfvrHw$N>zHKEh*M3_>eh=h3g}JBmv%=fKFA8&y=Oe=E!~Sc+)7W0f1={{e zGCNVYx5!1B-z6h%eDT%$!raUHobdO+=Y_k$9Ehm@3OG*qS+JX2tZgQV`~>8Kh0lV$ z!Xpq?s_B4?+26=_HIe}cFIa73g2A!$Ge*|X<4`w-%OSOJ3d4%TqImA@jN+2%W-?B3V#b`Io(Y{y6Mow6eHWzJMk#TaE*Dnmh*b5Z~~4T z=Bb0Jlf|Kz%^JI#*Mol|%(>yu zh3g<^JEuO~uY}p(pS8*VA)Ele9A~MY1dfItITe1#3bUT`eV>%Go*xm;1^+^LD>x4M zLLHWaUl?NRVPW2Dv&~Y6^WxpYsnB^%m|^`|m|^`zm~-b3h37&ZjW$m^baBGxpwnM? z5#))&=vu9THvPfEgCW0O*b5#d%=l#6^k*7|{n^4%;03~Lcgu|qxJa1ec!}_O$X5%W zfxKEc8S-tyKd<0>X32%bD%BFLla1!#ZRyYA%FC2h=z^2c8B*u9H%UU=S z+#@^}`fm#Ztv?7)h0Y&^v%vqb>3k;Kf_zwr`wH5pyIr^t`gy`7;AO&PVE%T+=szgD z2mb4Xc|Z4*F!Sw~!pyhVh10?B3eN@qLl|hC6Xsmnf%_bWm4|Sz5~fbF@Dj-RJ0$8X z179aR6FPjin2G0T;q}nT5UvB?Xw&C=o~XYG@=9TbwN`jDD-yI0>jU2d zMt#7d!@KY~LJI@Hy&VFIqd0m)sJ1-2e)hqlr$empO!ts54 zt`hzboGi>a%QWHh;90`7lPlZ-`7OdPf)@*KhEA#QR&cE_{jL}O8~EG8XTaYVZUsLf z+>QL-B@8j%rK02fD&)@yzXs+SCDZZ-_+{af;9m>V@0-GJLH?HT+u(PM4(jlK2uFd> z2*-i@;|7NIb75zMup9Dm!U^CB!b#xi!pY!S!h^x3!i-P3uov=Q+vINwZ$=&XoiNuQ z{wll`{JAjKV*6vwm~o@KT$uL+iNdYmB;lFR87#a9JVy9k*?N-yoka z{63g#*$kI9*V^!}reik~jg`Wdg*>q}!k3jy2Fx&M( zo6ZZuT<3UQm~9~n_vb9pCP;xoFhCFX`e4#0{eFfGvDqJ zE`!`BTmh~SPD8oW+w?aGr$fF;crf?}Hl0>sFXTIfQ^C&)=YbE~^p6Pdf&67*hWlHa z&MDzVkpI!9^RZ3mQ{g)3IPnFQ$-`*jw;_)cei!T!W>~{*`XhxaARjH90nWAQ+$y{i zWtT6!2fWOtQ!IQC@=D3%>~NH(00r2-q!r3_MAA0&LC{W;|yLXF{H5liwx$ zEaZj4?0eVRbZUf`K>mR6GVmsw&Ub}3K)zj=ef~2xogWKVL%v_Q2K=^7=Z{7QW%mzZ z_J>Zai<`C+E&MLhHNYmnN;nHPuMuY7GE6uZJi(?vNq8>gvxK*T7YjcJF0knr3m=5M zRJa3tzfI>s;X=skgiFAU!i+$}wKJ8u9@)`BlOvQNGE-Z-FNXw}S7n>HCDAg}hMsIdHX2XPxki$iw@EkANQ( zW*dA&m}T?>VVJR6h07q{Av_=aj7{gq!aJeAUw8xfW1G&W!kNgc3&K;u$=*<&Tqn#t zNwdkv2)_aOe49L9_*Ka3Z1M)-w;}(&Fu%7sY18?ga4zKk5I$&O9-b14&*j1$kS7Yi z2p(h8nIOCfc4ioTgnO&-Yv64*{T~T4ZjK?LuwsSNU?*9a-#6vibnX#81Ha|Me*-rO zzYG4pP5%ku4A|K#JOTVmo6hUP36Q@noCN;JrgL8S9PIZSs^fefoG6Sev91>8cW7zC z{0?orO()YZAC=cJ37RLS8DI3SMK=Stpzf`Bve<;3sW5?ZWRPp8JJA1Rt^K zbP01k{@;Y%;Bz*e&xNxfcc<#KA3;0^2?MR`gpYw!guB5bY&v6w`5oX4n|zKizn5EJ zldrS!gTnmIuuga;>_2JKX&0Ugo&Cbgz%K|Fg5AS({7b;IZTyrlOj`SdH$dlkoBXhF z8RWkce#2o||0!Gn`6t5FVCM}wtT-2*uM+0`Gg+8nT_;=v{WP0=l<=$286*4}`0F;E znZg11yCBoh-~aVAxl7_#KE>cnTQBsN`?r$a@2Z%kL7?g{Oiu zge!2IAk6P}GKH@OPZj3(Dp|t!A}U&0(SSGWoHi*tpa2G1AH!n*h(8|MlC0Xj>B zyTHqYuf+XUq3|lmON42s%*H^=v5x;GKbasnm7m~S@x6-5&q-RIfP;B1LggWJRzn9< z11pIc49C18vwX$~)8031@>#;Pkt@t_m`3_#I7}BAe>x5~0^oRVo}n^vpj?$B;=|`m zyws66t8y%-2EMDpCkc5&Hw+&#ty#_?@o zriG5rQP43w@)qP9!!z+z`7H6LACu1`!AXn^98Hj^%j_Tr^A=2hvqjE0+#!sEdbXAN z41XCu#xL-qxG@heiksvimWr(;)LA-)L8i^Ch3RjoFylE&m~o?v%!e-u3(>V46O^}L z`Thp^<`p~q-Y=EBK@&itaz1aO-0J>Ycm*YFPxmn~BdSsfiU zl!l(=UI%@2?^e3gI@e3!KD+!r?1T#mqnE3FT2ZqWBdoz&(NwkxOEVnLajq+Gjd^!n9K;%<5(}uJby-*Hh(P4w5z^X!a5{!=HZLNO!vPC)27Np=ra$0E%GcJuW{&b zXM*`#bH;(`TPw_b`hl<)%=KuK#-9kMLjE)1H1Hu|hTAF3a<|4*7M1zNRAVEWF`+Fb zWV?*8ohr0q8MfT2^p$;y?y90y1r?#qEke5_sDSzoQ}#SC8yp})qIYqSmsAZVL+^5Q ziCuJ-_HFyC`UwW2H{J*ZqIR6Ax`g#FRgN&Lb_T*0jM$**3oS%!gj>Dq{(nClMQ%r)dY%WSm0Z|w6HuZ*K`MFw&XLqOuyPg zDe?l0aEr8{37oT9EibLcHh@7XbDUzkOx2mtK9@_^qS-G+eF%D@f~rq?2kWKSX0PC0 zYYetNDjGBU*4sy;O5xnZ(B76;Rg?zhw6dy@TO#Ql;?#CyeRwKXo5|VBJ~D!8zqCFw z+O~rt`cdre8VoxuPE{*{a$08h&y7r%BF7N9uxrdJyH)D;p@z0LZoJA@-88V*C@Otb z3A-6(|Et)I)X@eQF`aAH7;ciZ6q^EKlg999>L}?{*ss}>jg8iVNs|^B*fi}Z62FRqC>&Zf@X@n_#(>ftNF2O z*=wR61Hxjen~i;IFuP|x8|mw+v={CMA7(GI3UDG2rl4Ab-bh*PoEml!yJE7+V-qp- zX;s`asm-1l`UuDf&Y~!kDN2(EV*n#0lwa|`*m?>RK(caROPJ|(B*nOXwdSJRzQHDJk z!-G=UEt8YJHFWhT#*C(_B*L?<8y8(d4r9AHd(N`3q$24&4ej>#CHF2NMUz31d*T_n z8cOY(<(Uf%TyUSenoc}3!Ys6G%gbh zU;{2UXSg31EXR=?Bj>!&wmaTO({1m6u^#V@jWc@RhaNdgF08*puT{;(Ipf1?yw|=r z!XEFTxz1#qu~!^nuNC%qpHF*Sw=?$me1bh40bH{sSLs1y6(gZ`y%xw?Xh@t1*9Sdv zmdM{ixcpre!;QnoggZIHUIxy&H;{40-h>EyORzS==h|owW`p(~6MIfE@NT+Z4~ew5 zCBoijtgrC-Cfak`>>Z5Amqnv>{3GqXC*k6t+!E+)UwC~MH3JHp;3*yH-KakN1f8(}Z$p-_5J{e$-Y5@D|!_R^IF{m&-8!8Z1(tjdwcw*VzB5deosTm9>3IwL-8AKv)345 zZ$9j0;kt3OLAN2o-XhpD@#FUl)N|w0j*mTln_-W7#u++5~%w6xA&pV9{VF+qrJc4pWR*w>}5i3oUzB>>)P!lKN9Ls z`51$-cRa#gE9`MDVVtpdB*I<|?7a%5x%f=O$Jk@tvBxhHnUMvVamLcT|<9|ZQ9=}3l9(9Z}_Wlg8+uQnR zXuO;OWnQDbUjpp*o`XH^F>D<5=(+&pES|u*zk@amJ%&9CA6}z97bbi3j%KUeI(%{W zgslVQHGV$4EL?BEH$!7KJv!y{Bk7+x_R%FnuTZ1Rf>!D|N)T5h@cI2Ad zTMn$_Ip^baCJ&9?am0^tFizQ%zJzIGdK2&&J8p8O*XA-VVlA0CVS>6c{>Jf>#w%JD z|Ls|Ga~uv6BIAFL${Q2r{CS!ts6!f_-4b2AhxUl>B))BZSG_Ya6xC=oEjA|lJWi~S ztM%otnX_PWwtr`CQ+-~Xf9K4m`b-?Mn(Axf+B?1OsH5%A)#GP`e7#>A9t&*!WJQNF zC)=7Ew+_c|@VmY{I-D`n_%_@+KVL}rcuV!ZD?-){q`;XIhMcucTM#RbFKM- z?B@1UB0AMnKfT-f+Rpu`E@k7?tAd}Hxi6|?4PJHVvQ}=W%(XlltwDP_d?#WdxWD0< z5`U|Nu(`vFsOk47;^o9oS()Ry60A17z;%#?3kTX9*}c8p*(Vpg9fgx1z@vvoDJoIO%G~-Ld=ee){#V z>ldKX$LM(T>Quacbxz7Y=k%0>+U#1#*<)ELy}eH-9(GNOSrvUE=2X;suD6}m;!hp5 zFurXSGzg1Z{aC~91J3eF)&jQq2wb^(bZsRz2Z0(wSU+IFv2Vv%i>Eki*WhKZzQDM~1&u-Fp5tlmF*Y?52qom}%?^ab^X%V44LkuzyG|HUu1BVCk*mVRkB(GgpU_T%5- zZK_92amUP!UBKFcm`0=4zpbQl+TNLgmV}xVZEq=8G`IF{UYM|LLGexTgJT;mv&P}& zp?6sRqvtmV65O9W-Z5wkf{)AEym^cJn$~Rzo~NxXc;{`PwI(jdX${WY_jp;<6rF>=-2(!OOJRY zm}VA#FBWG9+MOx}Xk)(K-cziSxb%l;UTSmT1<-4>cOa5Oqv|1;YG+i~oLs75Ag@k$r!v8vDh*1D#Ki~aT-uW@XqSvBi+A3UYJPggxwrUSYKJvb9~+xB+K4c{r^>F$$05?e!371}gI8w%SPJ?A zX9}!?DSZ7lJ5Q&rE(SZ(t^M)5DL&R?dJGC)xCBgeIP$Y6FPP>WGBhDDy)v$!|D_8b zp?kcj$G{_%fz~|fF|H2w7(*)f`CQ2wq9d_i>1HL6!%=f%+M!)w-W z>Es*RGoUkFO)#Jq)tCsydcL8ZZ%fWya4PCdwlcc-s59S}k2h?uVf-@TX`ku`0`%Y> z)w5%=hysjpT8bKF_QfDd(dfFp>S(4RU)VlW)+X|Q9cI&gJHBf>+Z|i!yRN-++2Box zuSz-x_k{`Q5$hTg`povoQR(W|b&1Fy(+y@~cv|D{^fvlx7t{u;&g+;?eTP}1dOnpI zo*@o*JVZD_+HwY3De5imJ1xKO8rbtM;80a}lXpDkBc00*bb5O_YamyH+2WOs_LS>N z*OYS5=bY$N?3wHfEIBhEtbyTJlq1x17>{zw=V`Xg$Z+lZMs;7D((F3b`{jAscUE3f zIGGjWLGJyjOwDpw93@~cSl&2c!L*dh+Jk>ZKO2Byjc+2ow-^**FiHC;c;Pxtno)&87~3y@94o@|*$bXGKO z$*<3km_cmcf;RHzfzAxHcGi70YsSmMwYeIE({P1VyT7*0-?#tG7x`DEqb#uQ*C9eE z7xhAU&l^s>Nu14S1MDiP>RK??&yDq|Y8itnQi19jV~viw_WisC2RbX>!Hkmar`uPu z<`gG;^WqmDJdgPgW`gP!_B}hkcbXw!CKzqai*5L;ngL&;sAPV8(N#TX)H9)^JzGuga zh!yiR=0a3Mlyx>XP7;4i%lE8-!ED@q_rn|G{jDuc%R}Zin1cRSqpSO1^-RyIxQ+$Le0yE{5M`C~yIy$C`F*eQLG>uy>o`tD zLHF+XJ!?E`8DW<9XN+)f?*-mU&5Q2p>Gj9QZs(pFVwjuuRghpq>ORC_4^EH{jSxFpI#Pv1q@X|z|{^EAPx zKhfcw=NzA!5STF}uAlp|9^dfJ-d?{e)m@5e<>`p_@1EN9kU!aK@BTCM{)L2(9`PP% z?Zu@2KdhoKB*Boj0!dKI6s4It~PsF~*s*UP!gLG!Qqv#9uDC$B?&Mla#BnNAg=4u6c9e?7L4+QFFWKZ`EcXJ#)ES=UUROIB=Kw{$-Rn5_UcE?kJy{zgbu-J1TWjN1S={;T2_3eJqe0 z8F$pe&eX0<%N^(U4a3CMms**ckT)AMK#V85=0G=v7O^7ZZ{6Bde*kH2-K^b!dqx<=f_dWA8Q=k}iuX+VCz-28j$m>ZN-o2))rWXmTNmO}^ zyW_c+u@kRp3HJ$C*#hJvuXsl;N&5OSKirN%heK5wKy3ljR z)t-8rJBF&wy8|5ywvTGwy=VI^?yq&PITib!Q`M|MeS6w%fqH-1LaMoMIT5Wd<<=vH zXH!z&Ng3wvO!fPQs>Pf=<(}zd)VJaaate(k z>O>4G5ei+D&K~#n>}p}u)irfxi1L2+cvjD@Cz0kpuFUV*)oS;H8TzhvB{&fi;EdjV z&4IRM$YUUe##C2eMt58w_CQ=*PiJa9>s@e+ka2MLad_vISltNba{y=vu%BppXbzTP zQ(4GrPT`K}+Su2O#rb7@@5IyA@*xTO9%%Pl2oGHZ2D4}@kb|44qn&Qv>u}h0&`rVPDwAIms_i*Cx$ z(A9W`deyW0V?;`YujcZ|)!m;$qSpPQt>D6_q%$<`+eU;-jrTT{|2ZORcFz-2oYS2C zp$Tj7)n{HHcY0jEl-^$NPOn?#PxQfEaM#eahds8DA&CGXv)x3At4Ry zs%`zn-MAgi@I34aIMH3eb|AMKy#{Z2kq%Bh(P76J<6fjA6eD=dIm3=4=a0P$mtTcb z9g;gH1_Iv=yz4u(W*l2u#c5R?uqIJ54s&u|tj~A!?5)Fj- zdU|Juy5Gm0PR%%Eg;69~0w&QSL{0!_mJzF79Y&R8MF8JDtp3 zSnyoq*dO}d2Li5c1ss@9J(S((a(6f4M$0^MiFd)ST~$$CTD}?&sTLQP7I^V|Z&3{& zRxPT;BZj5-6?jXkymGO?>#GQHk-;jPN|jBe${SQE!u!iB=zDVUY;_PDPi9HB%Ldcb2cRtk!#*dV98aU1@cRcX+7ShJS%p zsF;U`<%f=sE^rec1S=K6vOO~EEnQt)uJU47p?VW^arxTSg`#1*xYl;jq|7|F8}@6N zkPt;`>{PAAPa(B6zHM5EVa$Xofo>?a2k#?)!lBc}M|Dy6iVD}3A-AjXMEcSq=HR8X zK>rxXDT_15&htKOHH3#FxxT=7*@;Qj4Bc1OWSqHn|xAtceZ%R1Q=RlcQ_ zzIEzZXx|Dv!>@i$M`>XZ9)K>dcNOS@wmZp1_%)huUsvoF{ zmd+jdp>N2BeukY{qI=3vE%JsgUBXxCeV6itE2s+goawuc&QsOOBoNuHGY8{Eu+W3K zfH;Q#gf6Uuu=$W$8q84JrJym%GRe{}(2xPfrXi30BRW$g`C-vjxu)MAuglZsRcEPp z&f-gZ#5LsHmt})Wx|fe4*&aty&sKXOUoY(oh&;J+y|1aJ%|6jJ% zy}sTv?{esr#^B&kJFMt){&!ii*4uJ=H;zuVdy5Ega9OqmICXwm=%PBmBI2A+eutb( z?e<_l=abDL=Tc7++s}uFPCzc~+*BaxyAtVeUi6;yQ4#v1BhJT0ob$=dkaMXgA?@dU z@-XCF*4M2nW*po%@o@&9B2yy7Z@LEg@3Jt{v^ke`v+a!OF;Agsu}fJEskkmGp9P_d zAQyH5sg?5N1=d&FsX8Aj@io`iMU%9n{v8qLgKY+Qo$vWEj_2GT(>R_xBm8?K&aW5$ zIk3z3wm&4_NHXOE@D{nRi~f5!Pqc2u7q!N^PS53{{~M*BX#G@H1P&{ES6P3O>)fAX z0G_-*F7Z30&abr=$@y7zo}%{E0jhma24ELG?(Jk8({ocq`p1ZU>hSu%N9f-k&nsAH zRPh;MJ*rRDf9n4r;{4i(^zl7hbl*|_$63cBuJb)e#?jv8k>zPF;>hc{crKFe+sfWe z!5a2k$Ohn-0^gGO4^ih+t;ZtDi+e&DM|%Yk`SDD|^&du@AC&OlMZOO}4?9Q7>o{x; zz^;+MmH7V{`8oi<5P4AYk6|)AI)@kk;F9q%?|5Xt>`0+h_TXUx;L`AM3{|N2<4M(= zLHRJv6UaAc#^bKR_Y6-Z(*Rr+K8_J2Z8J&YO*>>(qnX0Y!g<1c2KF{#jujh(8TUqE z#{H+lUL4h4GO)?0{z~LbJIjb+F-kGWcXB%TDq+TDm@w1C-_lTrX__R=G))oC0@FF9 zOcKFKOo%uKjl)so-~-NZjBApV5#vYZb)}O6fMc2+*DF+I=8$fd>30m*a#ePcx3p>U z)=RdB#mt1`Gwn%Wp5_QMoMplc|6yU~RkJX|d|a4eZWm^lox)xm=^S4CgH!RmPP2-q zKn_$!Ayc_@22v~Cjig0~4X-9Hp&y4!@A?w<%}ftfZ_XK2^dJ(d5G=bSwxNq^uK4(18u%!e5w zXFN-UX|F;!m=Dlr9)9I;WoqN49dIyQa4=jj!z~gWhPz6b;T{nFZ-q-`I4?d);9$7m zV7TC5dcnc;f*I~##V=03dU`K|GMpEmByccXa4=jj!z~sahPzsr;eJb);nI&OU!FTy z3E}9Ud>4-N@0fspaH;q>*y!QX@S#ovj_G9lrh_g6AIhJ>k>0}g4`XKrHx(c1yntht z@W10YlPqoRYH-r!I*kmA%=l7=%=q3c%=pd|W_*_jGrh}&5uDyr4Sv1g`$f()Jt9n- zTZ9?rR$->EO&AC3pMTmru!w~OdQ`8rv6`qnFkkyvv9o3q0`0m(K)>M z2gfve4+1v(dtkl0)@uz;XM*A#_c6`W;-a%oesY^Hm z$6pIGO{_Q6XPSN|%ryO3*oz~7M@5}19QjiYGX1LYTKqC?CZCxG$5{M>Q+dwF!|}j+ zOMhOn)Op66@*5y$yiJ`~Wx;=N8TdHHDAer&`W4VuWx>e6O~r?HZiYNdnEOu7Bum@L z6*>1rn@g7V!Z;@lz&|)np~y_rbYYek{Zfu3>ph0S^tV#vOlyTOqM`SYgN_^gkjSai zD9m(!SD5K$d!~IR`Is=%-6KrDCxw~TPlc(k#yI$;eiG6~JJeTu$bp$fYU~4Nf=AkP zGK8}rzfsr=o-WLMx<{CK$@?#3UyYTp$-JR+a4?5s-Z{RmP`ANvXl7opjOdt;ik+}W zmioZUjuiZZ^Wx*k!aq3X7xk}#KJ$zG2gHTxH+?MANqHyaE->E*M>h~3GUGK$I1b0D z!i?8!8>{{h`m{G+v;=w zyx_}`2F96wRhfdB2dYfLEMM+vZ*)|7iOwvM)4nPT8i!+=nLo3Uhm42GbJ{X(ma5cY zJ5_lu^IoQt^40LmyfE#Q>7;xVZLs{1d4}<=C@*wZat$l3S@*NqSD zzXO}Ek!6f{gPeBBnF~HBOq;I?Q>RC`1pIHpW#Io1t^l94>GL=8OiMN7p9$0E zb*LYd(`Kr04S2XP%k&$<>%nTDY0+OK@(qxe3NHiSFI))TFB||L6J}Vi2yX(P5N3Sd zwCVg__*uwVj~P$ud?@@HnD2$8{0%VQK|`(s^Zi@oMc`E7&ET7a8HcY4Zv}r{nD!Ui zbojnP+G&COZeiwgx$u+Vb;7OS-wE#o|Ccbs`b2mS__8Q%lkzKtp97B_yfu9qm{htYUgAWPM1a}F~2lKsJ4C__!o5IXnI`$!S5G#&F zI^xI^DAnV-=^K-A?zmBj_1GbOPAcUQ~GEQZY$KxN|OnhkPdDzJ%%NR6Q8hDAwbHK}l z3&4fK-v*ZmKLIWy-++H`75Fd?KSkQB$+IYxF*jRt9S+oCTi-xtWZ~lQN#f)ePK{Y$ zL|N}U4(9cd_)v#oGJnW!9C;f|W|>SAPQvk4VU|gyFoM=&7WBQ~T_UHQXM|I6{IPHv zj=vI4$MJPxmeqU0j7zUD?L<3td{}OA!i`g}0UYNW`iqxyfyStj#EUJYI)ydL~5 zo1G29b&ziqrk%%yYrxOj^bZTqhy34!7lFs2u9&z@63&BM^~s3O5^$x+mx0-?s9y;F zfp7_!&cTGkMd4%Cds%NBEJQfwk(sX!1DkgZjS;3l)z4g`>l>Rib?7fG9Z&b@UBYcU z17G~e0=`!7`?;9#E&cu*9*t`FLp_lXgz&s{mD-Sz4@21E7 z_2ub{gRwn2^WP2Z(q6wf$WZ$-k7a$u)Lrb6jj_6XDf1eSu$EU=saCEYBP%UXyYQ~9 zqJk8Py2`zI!=+}o&WnpqbtBqnMAuRNzlnPr_^7IDZT!qkG6`YO35Fp+&>27oCLqzs zm)Ir*Lin%-)EN9I3?z_9fRF?U7H`9d$po>56eXdy4M8waX_Zois=W!-h^^de>TS{5 z`+~K%*w(&4Tg58oeV%>Ro;hbv z+G~9Is@Q04J2Y5RQ&qkMJyExtK6Hg|{cInBex8ypPNB;a9hPB{yq94R7H|<^Y4y>z zs|??oW>={I^}SuJAYX*GuQJM*WNk>%?A#3Mb(k*i z-3qvMu(n$IzR0LI8@jSAE>)pgJ`bJH_q{gwr98|*fA0;_D!UnPO9Q-^RBJ$b9J`Cy zfVLXjjxl>JHpmyT&SD~%k;zAW7H#se*olUuwALJz2OX5(#@j6zTZ*a0i>6_5FaBo! z^EyNCsjS>Z0T_Bw4QPet+HCy1YJ9f7v}`;qD_4}p97SL*+jOt#wNH<~A^VGSidjO8 zzv2JFB(o8hWWN8v5?i^E)A3x=U*BQ9F3<-+j7Lu8vc=aP*Y0#aEcoqoGt4OUtLc(K zN1P*ZqsE%gK1I04V}*+2y8n*}vHbX4ldpvmI(WvrptJI82fx=4PJVdYj_|u5%&qcu z;6}>?vIt%aIxD{#Jp57~@)h}TZ@&bRTav+(N&V$zZSZ*W=V^Ws^J z&rsTFe%%PL%C`mlQV~Y^Sbdt`Gr(4Uso=-`X6-b;rx0M}_k@Mt0Ewe~wEb%3R||fl zG&7-7x3==W0DgSlq#-;f^W#h+vte;96dYa#pHh%tb(fYvSe1zW%NMM!k zHgx#j?X?{a&{6=9g3s3>#G(Ud3X5~j)-=Bhp{4i8U_}z*0 zOs?md0;HRPd+jv8+d*gLSAz|~O&}sabma)Y>umhCfFHk)*G}^rXXAGs{LX-g{LpkF z{7#{NS>P8+`x@OxR((9`@bplnutm3YC> zj(Ey9L+Hrw4Gb7o{bgd33?p1S&F?kPS^1?xX=S3nd=N8^{PdX@AXn}X`0=}Z?KD68 znHP0mHg!e$3UFzD_uAwu!6b<)jyTP))Fxj?uK8Yy{N~`&{BmvlYQXQ72se|Cx6^F= z&RF=(v+$cJ;}EJvxu1dG2ZHHQw{*iWJ`rR1QSRw9tT&K{c8ufoiTIk|Dokn?vIxIZ z7>`M>>1sg7exaS#%MKge)1b@IMDR7;onS_O6C~~o=t?YfjN`Qj{gS?Rw~f-s^mW{E z&{=I{`=^`FC#(-TP3M7px(o~_ztlHFB`*#r5aMuf#`KYa15{$h02GB>()&EcErTuQtLPN*&}YFw%a3 z*W78(V-2j#J-va?ctnq$=XIW*gmDQGi#s1s_(*xTK-lBW|dCl>R!_Q5t48V?2i}&d*9SuiHVD-HzICSTq zhyB~SX-g^}?+9IHWVAmy<&F`-ly`%J4+eeR!PIlXAyvUao1aq#&AMqy4JOszHI47M zjs~w#D%tSyn0=X}2j;>~dr?z@XGA9(^K!`6<ba(YgneNE{86jzwfMz3gt?cY} zz1nj$aP`5!=#4DrxPIXM9p|_ta2+$&>7EO_Fhd%eh6?)!PBGn!PUx&HFyvrhcz%-6 z6dV}Z9oLxG{I|v-VOI!7c4pH!Jru}_^G)w(Qa*O>&tccH5fhqIcT7zRCpPVNHXL!* zmx#`v{3(R$P3ObUgwiMaYGHvK>@YI_M#}c&Y9w$c8L$_%4Sz*zF7Jn)xHDX?>}?6{ zD=B7)pS&NmN+i|A$0c-afmO5AjPvJ$!!n&Cf`PGmEO->3=7dG9OnAH5Y^NAmi4W}w5QfG&vbrwo6mZc_!0)s*@ z!P6}EQ1?8qvO<++eiA?_@_P2=9bB5(iKg;omrBb%=^TE>7m91YqAfUljbWUm#ox56 zVInWV7!e!+b4P8#tM>&$fzgf0p}>fkvGsuK9J)iCvG58^Aej#%i~4JNJQ*8x6LIH{ z?HLQpxN{p|kGLst1)7EX$I!$TO@X0X!yRpb!A(idwj@^_de>e4x<`}I!P){Ttz*4o zVA*j$@{iWv>q_1uXU{>8&~GBYeGdiFTITO;hJu@d$&DN*LP4+ZKgWaugRcoUcFqll zf`dGXXgw{v`13|%ZsVH9Q!sHj(i=*=`otT}r*@<|PV53dwAz3d_9ctXXH+qRL6zZ- z=Cch`obDeQM*}J0PMqHXIClr4nu1qA_@)FWhX#Csr-z1)gn-Uzx zzT~>i{;gqu2h6$-Q))T#%mW?>&tdO1DB@0tI5ac7F8zAXv32SBzFD5pJDgobhB<-l z9dJt8ph|l%aK+KUP&4(C%&vt-Cevg#H|%icXBwG@8wNYw1xDAchUWx>t}{kI=j_VU zyh{4yb#!!BzLCi^UE_^ulffo`qE1D-sj3&)B^W)>>7FFx=HBs|3buoD>#x^|`Ax8y zn7&o~gIBt*Ar;2ty@filss~gQ>H!U;C5RT&vc{MGX8u*0A$wo1(iBZk>l&n~ruRv; z#Fy{kD1c5xn{IwKY4l0a_BTAVbB)216O)^k4+oA(ch-L!U=RdC>+P!S@$|#NEWtrM zcLRNK5M(}|h&7aq#mDm(e}?9GArXen*Qn@WW`|V^lD&_42C5uB;GBbT3S8?JcBr5S zoG&_$v$tbl?Us>n@8hS?YlneS8fdc@O+H*)^p=b2Ox5%ua{<`Bw=@58QNo@-LihQG zo+JL6KlL*i*Zx*N=`*BlUi0*;9nhu9@Lg?N@hN1e#4!!EH+<$vd>}D@6sD>0=8flM znmWAZSg206C zzoog~E_~wO;(fB^3aIJuwu1$uIx*DkJ&6=uuuVJ!z1`DqYlC-L>N*c}FHG46{|FM* zu#hkW6UPf_|2EYX3XE#r*w`<2?Bz2@_ufySUr8}yS!#mtLsg|MNE~&zV58!Pg+(e) z9l_`_XluH+E1d;oejn)k4z{kWZ`Q>=0-p8XlRDd*4Vte0pK)E)i9JW{_G&C^uOI4r z5FE5%O>g(#6&gHWt#q2Je)TMri}LWKpU`Lyj=ogWaNZj#PDQ8zp5=0@B~$)bLzyy{ zX9gx!k!G6^)Bj9v&bw~aqTFd{B8p6{{yZ5+J7KafZllUu4U6aE!Z_+@^DnwP4bLDI z{(;#miWay|IF1F(>4jD_F@}zC9&;R~eRl|`0tPxD{(^$5)4m@GOt6$ul|!BaYQKQ4 z?7C}->dxeYW;oV8uLNkd{*G`MSLWcwk5X@OJh;$Ru(Pq>mN@3Fx~0SFp2}4 zU(Q(D-RV`OQjH51FYm)(y}6;Vwj=b)XIL+6ZT4<$&TX2>=^3+f9ZnvZsm_>E#y_KN z)u~M1VuZ$H@`?WE6FsgeSyNC=pzu7Tbc~~@ShdGY1;3~*>=rF^n$6KXe+d#4Imkqh zD2E-M-{L#&AoygU&Y7dM9c9|`E?s{sUG9(cqvwluUFtJHK=315+^=l+)ct=&_5Ogh zzh|MXB%E{^p)ua3MCY<8am@)${gT>RdpM@PpX3?RRN(Ub_GqWK8&+%;t?FS1FAHZC zBf@o&QxmNw5^SvIo%TuZeBKQQ(b*W=$J+KGaOOf&u}7d zrQn70RWDFY!1JGqkB|UA-x{TR_JXH zd~+NbEjeLt&VFyh(3FfL2>MR{qJMrC8tlkeSCsx~*9@aMt6^+P(-W>8si{qS@H?<+ zuWLv1?{J0|`q0j>XKcfi*Nbz{$D8BU6C0>HHx%0*f3US~qp|{8^iSM91O06=?|nOE zk@ZCQ6ze0*12l@SE_&z__o<$?!3LCmAqi!{S!9}Ut75AN!|_e6ukAbxI^j0;Qz&No zo(*%t3lr_BC(TEFKCxS+=Hr**0P;Do>VH15`w8{hzey6nreQN@?e6LxlT=xNTgPMPn021*V&$0AL>T6 zA~ePAXo@al;l|l(_65-t*Ptmzimvvp4!AEQDA8y8_=MJbtHN0NfRfbQO7RWE5p!jO znGKsUvU$_YX8!ElUbn~0$;dRMJ$tYv7t6lRQp-M&bxzO{O_BJi;zK6XlAeav_1}p4 zHs>VYM|eo=lnD^^kAs8MI`IuP4CX32HH&VGogCB%>hdKzY6of!!lM3Kx5w~|3F`e{ z*uhP}h!DsBeL&xl+n6*zJ`fMRl+RyiR|n=_a|m!^@s9`EffsLjCi7)aAFj80V7XZ> z7m|F}npWe@a_aDydiwjnUQbtES{}1`#;i|twJ3d#!5X*B8`aJ|Nxpm|4G)4w+Ow+l zESz6%*OECl z__5%PQ?W3^xIAEh$zh=QSBjqtf4bnA;_JK;^gZ4=%oTn!#m~`sX=3;|Tk8R5IH3u< z{BI?MQv3OE5GbZGY^S#;7W~nZ5!Ca#YO83Hm}28+|IvV!!@N$k|^+JtH>%oD8(0R8S(ad&yfYYlf zDb6^`jK_G&1%mnTs&#;~;T8ma(aHT(R#%-X7=E4O{iT&DMy^!X9a$+FR)AJ1e zGP%FCJ*hPb&Cwlatc>q+;^kz$!$`|V>-4yH_4Ksv^DmjP9;dX70`~Xh|@o z9EBLfM|vMmVD&0cDC60)yMDOa^1pAS3>q9{#_GCj2Q?Kes z1LuYK;%#`%uq5a!cUZ&EZ$zkP?$OT7?#^`N2A!xyQukE_e=Ocr_KYPTrLF+}W_h^b z$4>V;;;$_i`aW}h{yp-{7XYskt+m7H!*SC0-1N!4b(P2Z&sdOAa{LE|| zZ+b4k=c9%%b1PKq+suWB))WN4y{R$xOqgdT7KXiNn%82*8=7Ghe$R`2tGXXLw(j(A zZC~3q!-b|;xAh-QGn`xx&%pG1BrDQ}4{%I%8Hd+|GKS;Ky+SnH_O;lhYnl;P*zT>{ zpIjGqv|=SqMhRR}laX67ia(bzTGnCf%~jOhiA z=>^95;F)koM)87R3ff*iYtvk6^E5f9;)I6_bM8*SWUW@gY9%^7m@?a3=|i_Dz4?fB zc$cbNY2roiI?!(0u$vw?dT3lz>Y)BDO~r%Kej8~3ST9%xjQ>e!dq+jqd{2e>=YVt8 z^-lLFW7x5L4B%kGT$HOZYx-_iXtxvH1l#+` zE1luoJ0_DboP^gcHzgf#s>AahNSZac-vL)RxnXc^7y7!ZIrV^RN47hh*z9PSQkt9%ttieW&I;jcs#%`QGBfCQCP{Ffm8K4NKWq^>n zGf%eV!>6zt-t~9cAKE>UoN@RSJ6QdP80ytJ+@ji;mu1jLc@}mz5*rgHZ0hg~!Pr|g zx!?Nag@IW=S~FkC*f<~T8goM~J`6UwqIE5tAT-KcEn{CVuk7@abuf+w0aKZXO z(y{ylSUUdBqmC}|B{+-Tc7y}IVq;9|r204`oaH<33?*=_j=s>GwIeld>rPYyH)YG_KS{ zu|A#wFE~+g`D+ZeFDxJ=GJsR&j!e zwYllZMFnb8VfS07%szOz+K;jfY>!0;!xqpya5d(o6#<9)FFzn+8ze~U~o_cPX^`q1!F5}sWH)ej)DeDX{&Be~W9=u!c zL$S|B^yuTIG3?!>*r{U5z%neDX?9+_*U3uj4&V&*a865DV|yS~p|3#k`Y? z*6Ar|#F>osjodnGOva4lz!*Flo%6KoK!O?q0;iL)tO`4DP>+OgP(Vml-3b4%>-#S& zdiGOHz#|IA)Ss03p|!65*FBk^#jTbvyFaxs0-LS#vUCkZFN*YNTKE`MZNiGWBd z{fykpxtILTVq$JwRWNx;(5pt~s^CC9G`FQen6+Valq_zt0#yCc6r=eCF7OBlphzk5{rQ zJ2rJRUFK}NOubKi-e31^zE6F9ws+R#+mCE}|I}NZuf8$iXa|PEa4}{v=KTmh2k^Zs zZ;#q;h{zRbcxdx&fqZ?gW82l3jR9o?!Ty#%IE(=7i@S z+weEv?IQ}FDSjio&6hYL)L9TZc7G$*?8y&@8?!vz$7tNaMoV0<}o1+|+?3 z-V|s4cH=~6_!M5k)^9g5o_iVvO;BHEBsdH;ZJ7m~yL|^<({91}ZpU`DZt2ME#}~K{ z8)M%Xc8z~aM|YC(8+6u2W3-*Jex5a^+>fZ97>nvdVch3$UkDDGy{(#*8#k*H!?VfE+$u*C8 zZCj*udQ*ROXlyucbn0bArvsh=Z>4yOPvLzJ+VzLsfs`gkM^izq=d$+^jAMhJEx5Yb z-MoGRCbAGthnHrSvjyK;LXrN;r)Oz{L# zaAB*8?HShHw)d2*%W!x-yV*2y29E=7cXl*&Aad?#WVo?|I*dPc-?(U{XeaCS9_xzr z!3W$618R+&)tE4Q8=iXR&WFUiigg)}$6s)%HtQMD-TEp+SropdZp?+?zPN$hFdgCx zC*zRJo}PWlFS3I0+`87w^2GB@X#|AbP3c4Mq)~)X&mjmwFTzq??0@pzQt?#M8;|T@1*qK8*wWfpL&dDApSnZl21c>gMuD*HX zs;?jzPHEa5wbC;XVV%Jh#PqH^) z2Dkndd8q^-ujR9pDGfd~H>K&M3TGfK+DHQS-9uxqz$Z>^V^i?p=|b@#abm+zhbQ$6 z*OIf>K<#&_G+$F`F5rZF(1hJ>>DTzKafH${8n%0opXkz;^_=4_F#HCWo5g4ASpe|x9$@uCOah)W49S`T%uqTMD4=Q%w;ZoOAqbv z^gXi;ckeQn%M8L3jLS&R8h*xwIrCFIo&Bv^{U`3?xzgGS^}J~f1I9VuDA&5j;?ffH z2e3e!>pdUuz@hbs>-Bs@Jd&bJ4L-|3ex9KXDbB7h8T+!PqXT3)|OL$h}VwREJ zt>{k!4tCysw6i!8@U{ovG8_#I4t1tB;?vP{oh2&jMe_}xZ?inN?c%po)FHX-!aCz> ze!#&Lp6fgD{a2uSR|hE0b*7>hVfUGzrOuu|+tIzN6Tu8P7C6tUTKAYc&2u=n>kE|e zSfcwM%=2)rrIg2#+tj-@h=J(DLl(zB6q}+||>Am5uv0KDgi!uxq~InHeV>>hT6*svM$hS zaq!;HM&N-6C)n0)?+Bj@Paf9(BtA5|!6;7-<&9YKvytI*$0qwKoClA2(E%{so;%>I zoxFa{ddE3@mUUyN-a88?Ba{1=wa;G;xknp|O}R(n4NLf=aC!hAdYXGx`P?zU^F4RD z@*Uxi+PU+Gr1&Tubojzdq*QzFh*GQijQUxJ^O(SS<74gfcVti5x~b#Y^y}~Gch|D+ z&NS39U!AJ)(l=DTywK_KjkCE4d%%qfZlA9X)LXN88F!uWVp$#4d_wI#7-WTYJN9a_ zF2rNzHSZ&=FT@umeHunmY*e%-Y&hLG|4e;H)3ML|`@F5~xox*_Nrm+dH{ot^s4a`R z_qd^FQ{mhTOy`%46CUbl4m9>t1lc-HofqrkL$tipEzVsST7hJVRh~2R(DXbz0ZQ+f~A zjD%p^D;ckboUqfKX;kIKPvfZ59B9fjDwQf)a??)ZIRe8sco_-Ycu@O;zJkPuZ++MN zenh<;R+F{)wt(wEQ9hfHtO({lxQ+YRI2HZr!?_3Z-1}dy+tMMQnB;K_1v@9~R(T20 z@gmPPVM|9dzEzzz6?K9diD^LT0ZhNxglI6=>tMeF-&nlWV`|*~oTY z$6lUej|D%rQB=e2ZaWA4t%1}|EJsk{N!d##Z0~rs{BG4$mZ0HpM?+bXr^Z~am(kur zdGQ?E^5XC?MxHyv=TI$df!%EvPDOc{?PY|e2R!1gSF77`mL1J|Wqx3lL(Z7@)zdk- zT6Jr#iHD#0|Kre1^VqrZOAYf(GxOF@J4mHd{a06~UtKcRVn(F0YW336>gq-MM7mO# z8L>p0N7j`w6sH%~RISJFnzcCh?;@JgRZFYZSJsr4z$8sg>8ffRFIa67ttQr7KEn{6_hz`+^naC8qrTt4oakS(U9UuU$Ax{N)vZItljulj@GS5Z5&VKUYs@1E;;XGA;o}w)vslTFh z8Be*a^7GWvD!*vHeARLuP}d7<$X1P5oRA6QQhs$jY56MDpha&gRczhezAAD6BlS#W z`d2UWL(cIrw(m?6EalaUBIG7&qPX+`N$v|0&Pq39+PvTOb0sB7k0QMx?1biJSEYM>OQ(Uqk&WvgRz zi0T3+!m4lvX<4uey#aQ5{N>fEeN^CZ#wgWzL!Eev6JD#J_^$+4^7vk@O{;Ysvy#nz zyb5GWk7nA4HvP-h`I}J&QKLVSd~KyVZ@6TUqO7(sp@d3UOa5P3?O$6RgxMa6VY4M& zP#*v~{-O#;v{_~=Z=Ns9bfvX87I@Y2Qvb@;I5pIgkzG!5(Zq`su|-mwTBD^kwGphS zTxDT>u?|UKVOL$gd=;$2p{{}z%U4(7h~1S|(JoGp1SC}~()~ycgHa{^u`&HBSW>d6 zta?#dNfk}e;XvA@D{%U=ffJu;;Vp7+FL!LwR1O#EZK|KA1eaEp;Rx2MV1>~O!6hSk zaISSgT8YMtb8`J0XizCD(c6MGtE*UBdITSD+^RZ=zwp+%eRUDEm1sNELyoGE@y1t5 zm#?lVN6Aa{U^LZ#7kk$|29m7|!aP)L-^)~Gv|7R{FS+UJS~FM~_(BETbah3oWh60M zbW~~sdHUH?O3ZFyPJ767tby9G#;Ey_5g24^R{N_;mzMH0Y(K|}@y5)&83oto=g%mJ zvcXiK_}sn)=SjuKLb*;Jb5{%L1HS4KOj$NwDvaT*_8^&yzNzGHHt^IfP zvSp10$1qh_jv`w^cm#EDZA}^ViM5l;evukGMHWt>x)JLU9a9$mN_5jDGo?06 zo%^*VHO|S)g5?#ZFmi*!>gaSe#lTu5#+0f4*qBJuWX!TfTum)nx+G@g;f%gW9h%;| z!CxrHJWJP{KGkv#P2OD2p%8sX-nN=;dewS=!GZcB(x{EM_EGnz2(g*eSHp5${ZdtVo)zY%nSc}-kpK3pbV2lkMfTN?SxnMPuFH*_- zSm5-PCbr|Lf!Hccv?p@yz?s{xa*4Ug6kSFZ7cweF$1L5DBBSB0Tq&c|np0>r7Yt0) zdd#R|8QSF3bWr$pX66LXF%N?khCHj3nSKm_F#}UHCmW&J8hT}_MnG%7HP@1n^So)? z(5#2r+LAJ5hFMSPwoF8tSe?g+w5ldrFx{zjSJxt1Y9Z2$t))hPslqDzVu`f@!pQR9 zY_RGechhzub%lu`LSQy~5~x;>W$O|(uyb|J(Z>`i@+=fBN;QXxOT_k?B*M`8@MP(+ z>ha2C+6P77kr=M6X@d7*JmTzui9sKW&Q+_G$gn0z$AYeW)mV&at4hkbwlOl?j`;Wl zd}3rJ!`ebkB2)e8YThU*Eg7q(0n8OxdPL?DOLwfq*sB^1`Ak*gxj(X0^GB9yY~Zq# zh<5+jw7T_vUh>E@faMug%Gak{P)%gQwHDZ%-fmTvFJqeydUv&IHRY?!MuQ=A*|PGb z7{}(~v3lu!{+lcf4IQ`Fhv!Q)V>MY;*6{Ipr8);*Y&=IFZ>Rc8Rs%+h@=7Wqm z%_6v5t@cYYIY(722`*isr#KAbm!@C6YFYVmETZuUg|1M;bhL8XOCoUgn-gm_3VL6u ze@Q7ubv|W|S5MbfrI>F^{dVd6D`6fsGPuahjK;GFqlccTSn5u zM}y0%bC;EhOxCrA%+9^6LX19@9OAGKHYSs&-vz! z{JJiZKUtkE&FJNd-#s>ZOJyR)1&g0f(brhqJB>9qdKeS4IF~wgFdE=e7BsE*!=pDq zF4T|Jx%kzB#krIP$!LH}om6SP9}~R+av78|>Rif#qV;}U^ajYKEEqkm?srI$dMsIIlx7y-wx82`iySMYZ%Xn4V^ZlT78bRZi zG%yDDEH0-}YNSh-OIPxg8(ZPiZO7$QC&#K=^@IPEMQ?yy>h#KJkPG~+&SfmM-h#f= zcE8+qUv9f!VY^>xyI*a)xA&iFTYQayZ@waqL)&(#4+ir7BN^ZHy|slh{wf&{b^Por zh)l<*IWoR|6M7to@$3T||7&dgzbXBn9GL#QmLZS#kJ#t~GM;IAsV?5C^e@@?-6!>} z<8QLv=Uawc=GSgZ|F%t@|80xE!SWv|rnjh9$@6HeXyf;qE&dr> z{0Lilif#9^Z2Fs%taCT@wZe9P%qH)7>Ay@xd7t2qIKsvH20rgQZ2WGu$@`}5{!ttK zOE!56ZThOV$#GR0v5#Pm7b6w|PhHzkEI7TaIFiXcM6W>id!o(%SAbcKv8L=Nf za22>5vfQX42F(umwBhQ&SzL5=xERi`u;39GusGzT$h_ne90#AGFgy|dSiv6nEE2=1 z#%l$qz|R$&3ZG>p4fA4AHJ`5v-T*%+xDGyN9?~$~dchU&DW^{Ru;5Dg-w@2QZWmk( zf2Uy9)qcU*@Lv*4UH(ci%f)pk`7eh5mSF1me+j+~{vQRC{!fB8!T&%oW&DTWE$}}P zTn66({gQtnFg}k~cn0tQ!7T4pg8jhb1v9TK!J~k)1*Zc~5}XMBbd5j-81|T@KXe{9$5D}oP3E{4}MEH z%foQ$hUL-pEDtgD#QM|WtUqFwk7dx|ECVrhkYfp_el-nsLCiMA@({lSpY@?>SjWU{ zJ8VNb{B8?gEST-I#1dX6nDtp<39l5)x~&m>H!z(Zui}W2`Sl1_dIk;yD?Q72rTV6f zfvP_OGaYr60?c&R3T8Sw@}$%JpVIt=r{XV5M^%rYAC5Mff;3D!5m?n7J1d+Ymtzr; zY3rUew}M91(P9;>Y}e}ZO;sI%<{W5L9RdFWI0vM9ES*7&@b4pB)ltyoGf%>kT~bF& z%y5tz4q3jcIzqrq(5N~B{wnZd(!f4AT?sDo$DcOLaT2%4H)2|sYJ<0Ac?2!B)XXDH(dVm4s7 zcW{wr2xv|UejYNsM_h&ndXNZyZ70~}(@SlLs6YEDjv^mlYccUE& z{wHWWg1>}tuiz@+6v1}^rwZN;oJPFD%-1jBlakQ>i7U+T2@;-*aE_C@e@&Kf_OEGz z*}rm#W!~r5K{?-oUm*A>{6fK*(A#Z-SEH>K3r+yWkYS|A`eu+|s8fxB3{M13mv9e! zE>jrphku`7c*aHxZV>E+zgch!{Oy8M;j_KzeA@(%g8!6Y=J`XxY4D#H4A1Bk%yOI) zoC$v_?#Xik@Ew8yje7*o04}wJS6cAbELhDc;6t5llJFd)-61#|Se?%b8oC!Gd@}Iw z1s4GG{2X0IpJ3LHUogu!QZUPyYoVVdnC*qn`Q$SSn0raY>A+tV%yzU=FxVK?g4w3- z6P$za$1F5F>xO*hA^dxS3xN*`MsqS=vCtpaG~lVua79|y zMKJpl#}uUpU^f~*G5c1LV6Zpt7F-EjA-D$k-vrkIKPtEuc&FeEz{4?KkY^Zpu3$i8 zzTjiP3kAOhyu(7nF`8+c5zakN;>UrHTWEeI_%OnMEBFQAzgcKL7W@*zlQ>R+51m)= zo4~1pPXJG_&`cEk1j6$Kw*zyG(|m%0w;;S+@K)fB7McdZPa*u9f}aN7Blsln5et2% z;P(*zsU>_^LNwozf=`2HqTs&(&$ZCZ7kmcc+{e~3*IV!w!J9y{-4gyi3x2_Zj|%=f z=wB9`1AI#GdEoPcKLzfe7|oYwk5Pt02p?hzze?~s2p?k!A1AmK;oKM3^4}=nLsK@+bv%bh z%Xy7pFT!b3M~CMKjzf5XCHyObJ0K4o=QTQHrSMA3j~-%K2c}5)lL${Emi68!3I8#| z(}`E&2W|o`^862kXA>7QRMzCHOgs&qW3`EMh-aI4263f{3y9a4cpkCL#T1wPH-kT# zfRQrHq`|Giaqzi4z;KqyE0|>(DHxvl+zJ}TkCpHg_}2?gg+Ea+%RN&tJhc`je?RbC zT*TDJt%9kKC4%9p9aPd}0+&fR^~5C$!>OnH1y6>*MKJaBgy0n&k+mUUWTDFAV=16t3C>3kv7QrR$Ws z&~-{(=sIQjb)B;O4k`>T8<(zM)i%I?KJvw|YNT9A3bQVW=r*GA)#FmPyqM!u`MxN;u2ZESP25Czxe=Rxr!-vS7;chG2MV zjm>;nzrT@imX+mkRN)7X<Z!!I}mKJ~?L z>ik;4EK{yvKYTt$l7?lf70h&x31(g`f~oVz1+(1W6U=fyFPM7n5S#=5KLk?;rvy_6 zE{B=#C}57=l!1Bm7hDK@nP8|_jm4yy2TZ5yj%kRmg8r$Cm_8--#qv99@B_#EbiJe# zS2EPpm97_-jXbC6I%VU9W7!za=a(G8VPKYr;a>&48YemU!KrZ)n02S>5t#C_o>G7* zFL@F(EGU@rZV;RXzfCYaV~=1z{QZJiCN*Ax56kqLglED(Ef}6TUV&x;@LwgIWj!yL z^*99Op*)mJ?Sld50ADBJDZpyK3*mI?IR$tI@J&KPeW<#CPUu)R>gR{h57Rr=GSqCB zj{8i^a+2maX#B+M%y3m-2>&(0SvFn2ESsa&q+xlOw*TeQAJ?1VEDytHA)MtQt_RK` z<|F_|x%KlY%Je9{8%Rk(RoAPQp{+9~Dgfy&~8TzgsZVo)A0={wJ1jwHFGW z)ZZZ19WdpZBA98vESS1nD44qZy5Jn(trq&n1XE{imhe4-ixJ)~nEE>;croyEf~m`w z1yhD!2)+&YSAu5%^V<~ z!4u%qIlgZCESsaw#4H3zeS#-IUgDLaSvZ*p| zRHSAZrCiK|X<05^MwUyJWt>S*o+-dAOMk%(!?32pnUCrVpkY2#0qI#5W<$(;?iS2^ z=LWLGbOslLhnr^fY2B46Xo|BTGSZ3}=Ia zE5zm4q@eju0X)|u?P7)lw*r?5{t<8m@oN0Q)!-t{YY49s{3qb8f=A(bshM~we&AYh zk)H3CpA!6K;6uda_<=i&ORqOxAVxghOSqW!Bk+G+@H<}FD@OQ}z$Ybq9q@a^QrD*? zoOS&d!K`aPa0)v&oNBAUalopr0w)5iwhGL;MmCBb?2S7Fr@+5YFg){}Am~$pH%K_^ zeWPGM{6_@CQ@WxI?*M;G!cW5gwqSV1cLl!*f0y7B@b?LZXYQ$j&uhRxlgLaaN#7$Fp5cVPNHYpJUT``v_bVArH%4$K@HK)b0IPM8(5Q70 za5lo#x(IkOaGual16F&v2%iDGSi%c{)t)WFbAZ1u;q!ohEVvLDb|511yegRW_L|^g z;9m;%1OLH7e_HU}2>-L-#lVKsju z5xfE6HG=Da*9rCmZxOr+c)MUgV~5}l;GKeB0&Ww04ESlmVc_=!0~&u6yao7Ag0}+m zT>|TLJMguF(}D8@Hv_A^T+loYyi&qjfqx_z(0Eqx6Tn9-G_MM7NBC=kp921a;HQC4 z3qAz=q2R;7L*q=@UI3H9fc`Z0a@Ct;d3g)|lG{I|u{enk< z`6$7pr!JT;=`#hBKY~;^akhnivW0${VDirqO#XBn-{@3XfcdUdl?9mZB~@8C@W7?u z((7s^KPO2zB|qp-;bGa2d-8l4m~y6EXO{Ir!SIYm!G8E#1T&w<1hd>~{6SheHRcHZ zA@0eO@*WgSd4DXJeEwZ9b$?VaW$zXY&-k4M|6VZ5@!x{UN9p7t063+SdK0TUMH%VH zm*wSNveJp@O6>z=D-xxX6kzhZnrVQ^@9Tn@*ABtt{T;z6@LL6wH=Vt{rX`4MOU!sJ zoAsSF-*sAL^OKLPfkzQHm}%3AZ^JwTo)d_}X82?YUxRS94w-0%Q@#{nmTRzJma9-O z%f&}K(l8&@1|+STkARtHlh9B`HO?bE6WE9L%CwY4JqJnJFH1P(;=4N1K&7g05Ytsl zIQ4O#V9L8*F!Op)FzdZuupgMtu4ik%;Jap)O|SRJSL@SHEP7Kq6x~uj^5i#@N}ucm zaH?-2{0PExa8H^yfv*Qn0U_mlPcY^DhhRT^?vIm(I?NEvJe7W!3EWHxXZ{6(Df$KBAy4Xmi(o*5-|z4JQ+rthuZ zQzh*M)E(=IeEtN?JW{5b^R9x)$$;Sgjv@)R_m9UeCE-3&)$ z1?U$G-T+)iyc9ohmAFVV2jMk>_X5`n{sZs^!LI=i0#2ERA2?NCz^s=maWNbu_)6Zy ze)tCj!!v#)nDzUt;B@#e35I9<(t_W%;6GTfS{oxT>ie$}PJN#hoC5z7!K~}g1gF7Q z-^d{?b^J2>4)6rvlY+B>9c=#yr&E0jn7U7raPl7|m}KfZ0e~D}^_>9l4B&@^hT&@6 zi0}enwN?aX9sWRQ3W1*$d>il?!DYao2rdTpxT3NR6wErj#}Zy;eRIf z-mm#BH`|%+%Pfy$3x42Iap^uaiWodMf}S!FuLfqDb8wP}W1DkGKg}iv&C8&fESTp6 zLPW#y4gA36;3AC+;WLO?5V!(d3?GVcwkP88z-&*%Jo65o;rJ$g;MAHVM?v$w3^2>> z$CUz%qMP$9um_k+2ZpoU^985CUo4pA4hg27!-DM+H+)YD~y6*E8=(IBEVS7@qO5;B5HnTiF~_e^;_!1JkKzKPfBy1cDI=CQ(^W$Q>q8o*a_&u~S)}QVdl$+tMBzgW?f&e((wud8}WzcOhhnS584qe|! znXaI@t_G&w*v=T92!E_#%APIQ1E13>X;R>?7R+> zn05WUU_bny31<0T70mqAJO!RC-#H1V%%2LT%&JX-hBB))Dllap$2tY3K2+NS&H-k6 z$9DX{F})sJm`3ZLtzVSDYvdK%I%m-is(2~0Gb)N zj~QofRwU*)bBl=!NyC8wt{4~P*?_c*1@8qe6Z}))O5$?-z+H|jg_*$3#6`?=BQwQY9wA8_2!K7Dphj7;WPbJ(B|9=S{1z)WbK$8xv>Ij%=y{s4D zOyDa7PXJcWUkIoE_)QyWsK1*9Gp!mQ5Y9TiRl;+Civ%OeXb@ZgtiE+b;5^_H7Cyff zd^f_?H~^Z(z#mC?3GhD!Q^!81DNhBk+7kmkb)&v@1TF+#AT*TocEPAJqgXKOkWRNT z)&cP^PFn|+A%lzLZ!l@K`~@KJGp)#8#^2&OEka>bMSSufZR|C@p-;}e46 z8BYq%hQD7hWj`R8va9g{`Q`whm+%?%9cEtC?NGs)z#|1y&n%B!pXX2*mPhN8Wgv}z zfQ-+gAJygyO&%;y3NUqYm0y!sV8N74)hWWsW4MHq2lk6rmabe{xxN1SmcF?6LQlSu>QY(68WmE8oW4+2eWtTzX4+NklltNUeNKX2 z*+&fPSmv9BEeRSq@*>;iwGJikDqUbBf9*Sd6( zO!mDJ_sLdUx3U`P-&_Pr#sTBtHr8?jhvjWT)k8YLBCu~T_*LaP-^Q%qaIOeQea zrmQe2`-NYi`}9TMEAxnczX0P{+Fr_|>{Ts_m`1%+nR+o~+*eJB7Wz!lYq_jrtv1wk z=?r>H5mUxeSW{aD^I{b+J&Hj;GJTYkE?K)AW_n?{a?w&tI0y9QG^7Z_T&TMhr4}oE z#(0=KTM2_p5iZf;Uzu-S4ST=kv9V%T=;8>|>YKKq)~8)0T^OspuswLG5gg`>Y=)pe zXO`$QLDgznX1i$4>V;m58CA#^w~cH~YgS0au37b^${8{G#$KRpW?#Cw^qRz)zga6V zrBv>r=(iR#k=q*YqoxJ+Ug z`dU;GTwfY1g0wSb8;iC<#W-n) z=*VaTil&!2wz{TNC(*h6YpJ9;|7(eC165=NsZ5ibE3rPi*CmK;Y?qaaQdUH&iv`b|#SDR;zcH|gR zSgPyID6~}sAz>G=+Ksl7tcGpBl~l2^iAbx`)>sh-M#^D9c2TghvZ8z`Y~0b7K25bM zqn3TsN84)e)U@WRtzGuPkR)Q-un!99r7KF7K~I%56RO6km|~EN*Z{s*TBKSH!?#gk zX)4%C#)&U7meLC13S&Gh`<9NM^_APlVTfCb``(^?dNF~lt&NHiO?KqV+hPLM~rt~%80O*p!S9dQ@HjOqvd>1 zP-bN#d~F13WPk-))!Skzqq@;rH=8wx#Y}#LX_VB|O`n9zs!B^^Qt8#sMG)t5&aE1dS}hF&4VC%-5b^9+ndTE;$G#HHykH6?#8>zKwCq1L5Z z3ahZIm&O#*Yze0E?wCVoFxV}Jadw^5UJ>RI6QZL<)s>}7E!KO@WeJYO8ILtA?Bv5= zzf$?Ks2V@dH2FMU8PT^qGW0USTgTAxS=m#dR(a5>9Ai@3K(;AdGK$ zx$!R!TdB&;0wBhxg34u!uRZQV(s`0DrrT;psb5W(06O9viMt!`re+|6THI3}#&Hkx zt$wlmUP2gc{%NQAy$L!izgF&z;#~>(ao<$)n=bMpO1ayFMs5`y@l7`Qp1^)=naG!b zc+Kxayd1OYj`5q|4z{AwYPKC6&2YWb>c{7x*yx6f!iUugu0TJBW8C z5QO~L{58K@piHZLeh8nVIGI11-yF~p>$r*~=JyliHwc&JH^#zQn!KL|qipFi__c-{`=CF2J zzK=j><=0wb7=F-^-!NR7-vwKJ97AQz)69g9x94s3(NSuCD^GrWkD>YfhmBv#K>RPW z7x`Yb@w$M@k@`QAih;=3R1G`}MVu*!F`+to(|>kFrp{vA7sV zem}AC+W>yAAzVAs(f!!Q?=<+mhj8-Cz@_R0wgA(xLH`wHN z11`-k#m4V$3_hc^P(laKxZK9?%qoocE|cFR3%_dNr@PoD3>GuUK%8d1%Es^MDzjZt zzA3o0eA&puS|7*2uebKX|M@UY4lcS4)lvQ3h7TbXI* z;HTSPuF$bPe+A{R%6AC-_zqt?E#GWgc{A6VcKcY~JX~5ne*13acLx0UJ->FEAHSm^ z&XI_x!S6j_@|%fE^ZS;qJ~jnUa6-r1=WYB>g5M#8Q@)#V zY56_?Gb=w%E}Iaq9qH&!gNQhXH*nk6N9W&LaIg9C+e$0HP2e|OGZ8wb=YKV<{2s@L zIIly`lyAP!vHksQKrFvwV|!l@{SuV#?OBZ=F48{x538m?tjB` zfXH{dg9CBH?uw0s+F{CIQ%zwy$JbaWeR{EmSi zdGQM3()_vrtnzIDKZqD{nqMaXagM~~JQVG}OA*F6mY4QGt^A$>zh@;4J<`!_2O!Sj z4cvC{>wr)BN^voc{H}_R}zGm>lkQH%S zzE^GhD#4HQD&<>)OUw7p6(&DagL0kVch^9C-#2gM#Gb^K7PF$Cxjnxp5#ICzN_LF=9-6o@7{3=e??(T<9x); zH;-ArLmjhT=5*g~ln2Vr>69ye1k{-2yEpNH{_UfIk;3=3Bb3xH-))#@lJ9QP{1E4f z@0!6g-;>`RJ*<25&`@VuW3bV2!1-dr@wjjn2#W4?hu3Ug*Pa~u`329%FD5ih@uv;O z(db*lt>MJhL?i7t^=>0`Fpja9HrO3!q}|cwG}0zF42|;)&c}>1cxC@~=SDo{L5$7L zu=CyYjPCSnqS?458{Zt`o+S4O19>g0dL;l!4WoPaFHf=9VHSINcE#fD9T^P`Q%W*h zn(`c;_yu{!gvUDCUj64YJv~qV+}m+1_h??+&fjz&|Lo}(%`@S73Ves00v}&@AaWwS zYxBOtx%>LJ2O5)Ff-MeF%e%-73OnGu;6i@m;)kD!t)>6DyNT9w*n>SizByWk%UIxq zlc=hJ(4NQHo*=p#swu9}6vIZC0;sw!~KPM+x^IUrR$H7qg*v9#dS)opEW1ulPoYm;?3{dG_M5976ijw+;b2l%$+3lH# zKGXd~G7{_fc*IZG)X{Y8vt1ZI_IX>|bKCNax|ZbD7XQ}fT(qx7@auje)tW}Ni_D$i zfz+W9-q4Bu&520Rl6WAYE73R~JiR7t6KJ^3kOKLp8sn0NpP^9sKettx6K$e4(u;j} zI@`yX`FNaAEB80Xg%Z{`qJ?fa$42nSKZ%GrhY~~ zdiB&NzwPi0X>Cak;87+!t`GLo;jH3%shfNc`(li<;AIX;Pnh?*|s(859PV; z+I@6)+!{2>1apADdjNE3W;5CwPH)=nYM7GxwcVcnM|Zm-G%GdD*v`zKY=rrWT@W48 zHl65yxL@n{{rmdeIkIWb>pN@DC-}ae)U@Z#oyDO+Mkwe-FH>W4Tb@}Rs?6cDV-7pJ zsttd*qiK+_qGiWnXMUwjH*K>(c)%U*LC3x{EnYk5@SE=pf^8!iu(ys?${sG7iLrMbv2bThY)Juez2wlDFLy&C!#%c|q76 zuJx27r}Q^!&-&gU(A;^)bI$w%qp+dlLrkFg#=?zenRX3V2~YM@n%Fz7WzEj!?jc6g z@%KNR;;b(<(%#zf9cTSgBkg_o?lnf!4?bxL?)=XDo}R)M@2;Mn9Y1lp?>3s!2NkV1 z!tSQ@k-pi3LPLxIM)+g@m9d^Z4wcuE+tk|A5@>3Dr6rlSS%vN1!}E{#59hK9Uiqv$ z)hK$~flLbrA6*w6}fD{+8~A#`kNhg30S;b+BvMDRYiNQ}z7dA1rwY!s(9Q%VHUEb=+Y+w1FGAQ7TqTyc zdo5V#oQ90Q-?7C#Blkzd=YJEGd#I=9n}YwU!z7B{tvU=f`eoqj_5IGCo{u#adcOO# zx^GzS3k7>EX}&69%Pe#%eN%J}`7IVl+RYSv2EIOLY@USGi0=Xa^@6L!e+Ygft~kVD zZZ>w{8tZ%tPf&1p-lF>*--Sn#8Xq{g0r_@l+ohCc<@uW!a9 z79O%z0?(89&nx?oc8iZKX&GyRRhmA%_k*~6FFm58)vLc@(el< z53nTYTM!)77EIX}2n7Z;CWit(J-_amD_uE3t%Md19)5;nkU9PojhI|EI7=-ia3*Au zr>4Hpp<}HPX@~OXL?Xr|6&=jB#(EBQO?P-)*9B9q3tr(F-HG+rlW$@?JKNJUpIN== zJ{gZCU14`89~#s>2ftlCJw+q(rU$OboZN88nQu521d|s8QbO?~=7yVI`mcs5&itv4 zl}X)u<}U~&cYSPNWe4-wJw2y-dMI+jNtY2CFMVt{(RU)fY;ZuS!3i~_-B!QXSTM%x$>{9q zc>|`qq8WM~KH532+Z@J4g$Jh|3=H(7JvYr+|G$h8fh$5zqsi&0+m~E-ufMLIi;-=Z zU<$mUUwk%eva_q0Bfcs}*MG8Br6yu(<>-}AuUdPlT6xp`XA5P~yJ;H{rzem}YQbx& zMTN_PH%e2~JtU^KQu2ReplDi`xk`pO%&Zp`ZTf^0fAkD#y4i6ZN*JCr+37xHGzGoU zLbfE=wfNhdPGf)aL8q(k7YF`oUDyFdw4V2$TbX9A z9fHZG%qU2l(H%$*jZ1@`u;8oTU`|4eR^^N{0(gD?U8@QXdSXhny{nBS`aj*h3wTu3 z)jxb@CYf9qHNiMU!1fGs2@)_MLPWF)Vu*kWh=_{9kOUG8BqX7L;@f1zFp0Em(Ml_+eZ^ZPRI9f7zCvw91@rxW`>Z{4a+08Z{{QFszUSLdPR{SF zv-a9+uYEn|>{%OyrQ(d0+Tr8#9;zFk0G22E=baHTmGvGZ?j+~g_f-#A;&_v!mqWYmRQX z*W*jAIqExm)ALEb#0Lkv*8OcSdg1v`X1c2{b-moWYxCAdcElr+YWD06`u82&hZi^5 zc#pPoE{X-_L`lS8V(2z}X`!GRX*zaZi(3|bWGC*7jt$4{jZdKdEVK|F9tXO;d9HBl zyhHBL&gS|(wYx^mNsj@;v$5(m%aouWkLVY-GM$x5*vZ&%C*n?V51D^3^y0hdJ*)pD z^W~jqB2TJ&kGSfB$uA$=*LeMAWC9PHqvmMox{px2`#RP17Pu~u zR9oXq+!gQNIj&~quBz#wQ6HgG8rk~so>@QHU*E~W=mFP^e|_;=w|BSev!Cp*i*=)0 zYl`(4PbF{qnTfYIuWe02--r&ZZM*BsqoG)%F1Fh!@LFz?@2-QoF7iDNMx`VFU4>5) z=zfMq8=1<52gB3iwDbTT`F6hE5lDLL&i14G!~181>ksY?BtxCHKe+xq+Fku;S12~7 zE;g3qO|4nkoQ&@G(XB~M2fpD$S_NNuipfbwU4D*Ch!* zTO5gis?2tQZqjXB)H$g-^XP`h+|`SX%DeYB1(LQ*a#t@jiVjXe?a7_?m^}rI)mdC59m+t44mGGt}kld6uaNZ3@C~c5G zo^vUft}c)a>lO_P6%F(a1Zh|6v+NK24`uOU&$BTHc-a(4Uc78jcu#2Az)<3vx`tzT zCJs$svur)p^|_#Kb1SrMOK=SdCXY%R0qS&@*_*D-jSYoKOYt&jifeJuU(|h^AmipERL$W z&8Y(S{_LAMfiwM=pEV_zTo*_=G9qcvms1i9|J-x>-H8_N4MxV{>JyR3-uiEvUL1%% z&bJPA6|(0&WQ1Y^zL98d-u>v*>W}))%)qOH%;fOMx(8zLHp7c|Ll1arrj1*g?i;0Y zbRhO!_4f3J(Q^XH_tj?l+!F`7E^%LUbohC0?=#=D9kP<^*g2=u(YK(UwEe;8*l`3V z*c~?oW{NRF?qU9qhAP{1?D$yS0M+*}c&*gf?cEg9Hq=0$y}AC1`h=}%9fAJO1Q^3LQYlee9v)hgz>%!WVWM>0kd(M*1rTw6#ZVw>x6HoR5d6qrXvQ z)3I|Q^1C|@RCJ^>ZwX-9bGNazb4sK?M%f<;CLxPT?=O!cW2ml%fjL7w=RT_QMA!M% zFr?9PRQ2XZ0!hb@PVcJkyy4|9o^j{o7@uw2zhQ#gJJlF<^|WW))pr^p-QM{^~v?5=AsI&dxOOLy& z|Iig~JRTq3YR-J`DU%g?(OSk&|zSPi^VL4}7g#;Ztt-6hV@k)4zsr$kC}g zDj(bGhO=WE(d+;CB>uPEb#ioK&W#cEI`w=`Pu-XgHSx=-h$!Bv#C!Ngv~7h&?bz{! zqFU7$iQ3y?&ShP`8>>VopS$gLiPLajn=fL2L_aDv_WqY<*j9~3O>=cL{Jae>*jZK` z4UHCW+me&vJtr|fT2I?n|7Vpss#3Uh!#!^Ac)R?Z3C7y0%nw874)(_nZ$1}g#45Kf z8DC}U+D{JlqJFKZ+VX_kTh20W?CNUR+EAZ>&(h0d+g2Di%(0co#nfqM8WdSuwL4Bt zl)|mk({7I)@f){ys9|o|A8y=w5FKHgiN4Cft5H0a8funcJ(6y1-87%&jTZ><#+8Z9 zRqfNE&$BV_`lwT)HGX#NY(NTYkiyAW%d$Clq2`9;(-Zh+w#DOYBi=feq*b3cMhdm9 z#)2I?*LSM&T~k&4;5V3)o@YI+FV4jy;F-?_QhaYi2d00XQGNJ?_k$BwRaMX6)B*;Q z`akgGs8G$ya8)?IzA&8N&oyRjy{`UW^^MJ&A53-CZ{BpbiP3IrlK*YkaCu6NaF}!kh%h2#jzE#Nd zTlHb*Z^SZUm&?1-z16W&S$00=eX(n@7oTJXqwh0(-pzamU@qpU8)~emJ-3_P^w5hh z8hDZO{H=JGvpASi6o|gdK{?%Z$oDIpcE>#HKHxom5Jtl2Jj7#r4#Hh%%yH+wW8NkG zD{Rj?%~c^-4*j;fZGf@(vb9PP-^D>x*@$fq;AOAmmfg^sDBwEJ8dR3hWteqzZTcw5 zHv|0#b%;|FlkkVWgt}Z;00V~GP*u13@e=_owW!J*kPR*miVAO2p4jaLz~j*3Z+Twz zSfyJupsndd_+Y60r0=W^zq#qgP|d*&6NBM{l^gcgxjjwpm`Y5!Z!;^m@FQz;Yr_>u z(=w+_kV5>I2(i8Y}96%3wJ!oH6+bdpK?MA5yxX-&*mzXQ~!{d#;z{3 zqBiuEXB-Rqzm%^KDh^w{iZ$fdb>PV<;eg1zyixs$p1{1*_VG8;e~gOCop;2Al-ju% zMp6pG&D<1Dbas2&&NkA<0|^z72QC2(~o7(9AjT_27%`wCb%V)r;T% zAN<3*j5Ymdv!B3>a(N;;f>@(y_C?vd#_kG)v$4ivwyqX<6Jm|i?vu34Mg7%>czjFx zvAZrU3Ew0zm-*OLe;m(lO(O^TC%Nhp)`a83YbtA!)QovVs>^4^(Pra!sD7}kdhMXk zcw7h{s~eJJO~bi(LVfcv%q)Cc`hkvWoo(M(y5F#_?B8kheWZE2d+~@Q)P>sWa6J3^ zFu&t&I4^bHA?tl_$AiV4(PKFE3?@=Nej>lW= z_Q7?CtL@1=(N^gFkGQS2@Zcug_nyvusIZ(0vH1G1ZiW1Rp#*vNMy}}Hjv{Cdtup2 z-OkC|>g&!nR(5p_{`;0ma~csfA*-Qbvu_YTw*KAIlr|rVL3#hJ?mc|=!&qezZkO3f zLn|}^2`h=1$?7=D^~IGH&c}%FPjEH;>g$KLHgX!3)CgCA`yLq`*UL%|IL))Z+nn<2 z4U)lHsGHmq$NvZ`etc(d*tdFA-qP{6FT(O4d{8e~mKQPfS}?^KglL{rnb$V<;y)nloboai%~I9*gc%3J|{{dN>h#1;`czGo7v zIzDmyg_8Htk=J`%M8kC`+cHPpF)j5vtBN#K*yaNLuziiI zKCWqG+O9y|$dOxNZA zC#8qK*2RTgmU*{dqh$nG?qL_+HP>HJmypoN_F-<=I-)(fB~Yc(QN7C)_7JFC+n02T zUaE(P$h)Z%oz7cbQZSVe)6=*@=}}IVT!J3$Cs1A!8rgO+x0r)vFRP5Odk&VpT$r3u zv48Dm)p}5W8#f@yD%IRs>n7qkdYFM%*;T9YzUN#cgl34x95h4QV-99}D>ogN@@m{@ z2^bmJ?fx=YlMEq)|GM~BUuUa#fj(6}*`Z(GS~IrkEaSloh8c-jX65GkDs<=mLat?v zQ;TcDV>b-U#^R#p+4aFK^%IxX)~^J|sB5QXzT{0rZ{?}}N~Q>nwXhv)Je5|(x>Clw zwtiT87Qz^ZUNBsjYBUG8Y#U`6ym2qIEDT_+6BSJVdZiWL>H;v;#x-8L*3U*|{Eq#Z z8q+GzRcj#ddoE}HEcL$>OFMn3TUrXE_5Sx}<^8Ppd$2TiS5n7_q$4{g|NY%#=NJ$E za?#*-AAHvBHTek%c6#l#%~%fOPo)i^^~pqQ5NbS%yy*Hk>aj;(*iTciFXJdI`TYxc zoOQp=i&EUBm&bfaDH1XLu7K1>>D+K*!{7~}UwvI$^Jq9}Grl6?OToKc0oA>6Z3Dx5 z&b1V_I{7~Cxw0y)br0Y@DZH@~*Q%Qkye*6sdhsXYrd{A}OEYQ$YsZcZ`Z8-~BPm~Q zO*Sj!NUjI1pUpS)!;KkvOF- zy$5pXXz^cR$D_;FmY=Wb#YKzDf@N#ZkNUT;ym*X(KZ{$6O3m&*N6m=8qjF1N6DqKXQ#P>$vD z!YnQ-uP_`6h^M5Yg7V%|a6}*DjBkl9H;Ps$k2|LFo0 z3e1WUvm8DhFE&+KMhefNg~jY3N{NY}-lI;^bXqHpt~g<#}TYjflS|tF}%;bv4t5m5($>U#g*T31GR+1&#Kx z)6GNPWVFn3GmZa78oBf~I;WtbZ0($am8%NS)UHu}?-bq8PUcJ-(bV3FA~$=;h_GC_ zs<@)4w79^`oinH0)DetpSHP`WL0$!_0&bW^E6iSvImSTN%UMf`R=~xaNynOG?v}-G z^_gjumIoK+BWGnLYguFL<_VUSJKP6ama;l5!+w#jTP3vb(HPB=CFb0j*Nkz*fET>{ zlI7;&wH4^7bYEk0sFXG=WBi(tCcNtgmlwd-wIh07VF}u;X^Sw4#fCU0N}Xm{9LzV1 z3zi1+)}pO1M<)q$m8^jID+){UyGe^SjBfQq8Nh1Y^kQc$DOt55zt0Z3FVl7Joo#|5 zt+zayeh(oLCKb^(1SvmnuPVTC2Diu27C1xU&)gww@>6^7=t)f5wM z>y*vQ;3U(8(?T?+#Rd6v@Wou&d>%&3e~KdN>1jEl^U|`CRi&(!`7oGP1TtkLKyyVC zkKB+J6}gWge^r@j$r!dO-K;1qD2iSi?0~JC^a_hEuNZSx{P7u$87G5u#nL)kn}7c$8|SnMF%ilyC|-k}a^LEZ;1L!$i#9Fr|y~nR&q#ERw|q z=Bjcq!z_j7^57bCNm+0y-9)21Q>`PSgmL)_52mMb*R)< ziCIlG;;TGjqr9k3LySb$SQjx-Z#V6gLHQd*V@1AWx45}3E`rz5BGp%|G8{BC zgS>)*{Bm<527K3zv+uDcAw=omcuntbN9VlEt)G48^Q%yAcujHV@MO62VV zf75WZ+q*K4;V~ZL56%&;z~MIf8CStS0>fAwZtOk90pw90gQ6r4>w_(Ll*gVZ z!Gro>4<6-#Cra_qvys#vQt^`{;~Ds~(Sg_ccVeXR`X>(lA4+|xM}6pz_BfM_63Bnh z*5r8I3_gZf#eb$TN7_GWy#JxpCw-k^YvR2Bo`YZi{z~(2cIe+}YvPPQ&`VD2JqbDe z;grjiE`rJS$Lgb0NB%B!q*v^a|BmDOuOgpmFg^S4|9H(k;dS8kAV+=&oT2Yp@#oln zBSrqp9O<2O==X3mx=R0V@=ljz#?NusBh?`fZH zzhC+veO>3U$23R$EXVaKhdrh`;{U^;&tcmT!1Q-I%6FMVKKEkRf&96S_{Svu&(C6g z8EQQ5;J-#k#+mV39P$$!?ZNIdjQo|3{QTN+eZX4S@O>b^`cWtIwN`sIQt zbB|yX=fi@Trxf&8l*71cPds4e?*~Fp2d=X5Y!J+R*9vC78C)pCcW|aG;@{(}>@Qf^ zANV!UnK$wftFi!o23VB^a4WDX3*a_j69@UEOsac~sd!pOe6am}`HF7!+z7Co7FS2q43u$iS$Fv1WV z#7v(vA7b9(T$PwA-5{8HtrSe1R|}>tw+f~%8wHyr+ z4$y}Ziw#v;$si!8@&#s^xj0gQsY8)qroTZj)BlBFroUY<(|=Gf)88kUJiilc;{2Ro z>cZg4vCd4JdNMF=;=RyW2lxPEWzc#bBSpfgatTUC>PoxpZE&=Lny?-xc7sCV`rfpO|4?1l#Q|Q#EOfYS($_qTS*-wQ|Irj)= z89ipBw+J?IenIe1oIe-LxL*mTUD;NtTRP6?!0uX4wpC)aDreK$GL)M0iQ2;F0k6q9Q^Zv9~C2E^s|8c%oi_S2f)|1QieQ%AJ2w6g1?PkQ zm0+gJiokSP*L;F$+Zw^-`KjPy;5xx9BL-K%I+IVgHJ{)!Fz8T^Zu1;w3W0Tn{BI$m zDR?pXSr1%S;vWL_AkUqkX9?a1%yJ_ARbYzK{m&wyzXf_e@m2VTz`VJxR?uokSr%s5 zP|i2tuOyye(ZfPN1M}RC#M19=BA#sV+)s?WvmCb*L(W9-HxtjoKZHkc=zYr{CkD?f z@H``UHSi0>@(B5w&_9jC9^HaRLAQ5^ufacr!#F5sGs^IN!G8n(MDX9ie?st9VEmj= z@$;F)M?4od5xDobi-Rpfs_=CAP%gxDQixy@UuWSo;rTsy(uvs+5XK9A5$J52uInv& z7BL4#gk0gd4?Ntrociwuo=beA#WSCHfrS?l-(=x@;+rj8OpLhaU{X;^ywIYr5&CtY zuNPbcyisro@I8Xtfg1$B58NzxJMas{i!7P13Vl81BCit%E&4k`{}=cV6EC*t9}(wS z_%q=dh&+ByoNv)j2t5<@c=QR(3;oj2*Df)i<5C4*h;&WCHvmr-Tmn2*FxMaD5*JwV zXA&>5F!x%g%uV3W7yK9CLgI5Ro(iE40DX<%#2Cw8EaN5tR|@?q;Pu2yt+-)gHY|jV z!gB+7HVIx0e2?I5z#PLUa}RI>ai$e_JMnoIZWf;NW6^d5&jeCOb-Uox(WYJ%JOubP;$@bc*NJbj@FC%O1#;dI{1xzF!Ksk>iQs#H zKO<&Gh44A?I13*a9`$UA_DTI`fFHjgG+Y@LPrT5Vf$k$7W6_g{(=D7LJQ?6gB`&t; z+zW*=C&Qj5ahgRRN<7@cX~MG;`lk!#vu%dpewBklcowjjPrEC@8f)>;3S;cyvgr_9GY9lU8{LOzr#ka6PyluqmBNQV5n*A7tA{Q zyx?`fZGxFDpZS><)jlGabvXrcNv9n8fhNwtSv_w8j|WzB4`9k+zek=-ocSJ?nEl-4 zg0pa5DVR37Q!wR+1^bZhU4oN-nDGV#NJGFw5$w;6*qa z%o~JIhcg5Z27Rz#6L^$h>NZC3P|(K;W?sh&-Uyy7!7RJ01ylYa!IYCHI39S3<_9hk zOdGBh%sl>1FsnD)m(Jr6!5N@`Ab33RKLxY9_{PTXLjD=|IOuFs#3z8+j))ED++Q%q zkbq$7KTa_9zff=?c-R&gw;1?h!PNh9!5nku31-~u1y_K+KrqLmg@S3r3LF1w!Rx@I z=5e2a}|h2T{1 zuN2I*Dg>Lr|0S4dRS9NVKNifiHfap|-z_*E_?LoN7LVHSA;E`1|BK-Ffjb4WPU3f# zR+&QQp@JWW%<~0vo-$tWOyJ7|Q=gfFH-f&&M!!$+BcN{;JQMtT1V0Ko){v`o9|!(W za4~p}3#R;U1n&pWK+HL`%}v3y;kkl2K4%CX3i<_tX~TJfDf4>4?AI3vHh~ukrk=M5 zrXBuUa5{M26#N3{9|_I?{hxv<|KEZ$LH|k82Dbn8-e%Q_z^oi7ScUaa0B9|3TEB7Qt;=9`$NIB;X1)=3qKOv4E~LR zhk|~u;7y=63ufG33BCvP7QywvPYX^1&pU#dE`4WG=XXF4_$+)Fc!c2hf%$Bv^L4Rc z12QkO(YYRgJoCYSmF9u`*@Btw5*t7LE|R|ma@God1~_cvxl8aS$k{CT9^iWf&xFhd z!K_Qog6qNa8^Oh(|64HYsvFPzO!sl{EEBvRc)4Kq1Gfuq2j+Vgo%gWdL!jR!m~+x? zf)4{fB$(};d(!B*t%6?zy-o1zz@ON7{#WoLp!dUj5FPh)!5=~YWWk>R4;K6xF!x2& z{M;Lccqr_dC792Y*VuUG2~Gq3W*eRR*)VP?Wd2Yv>*`N!JogIbGv&jA+ku}J%)aQi zf?4jrx6%J#qrWGZ&ut$Fu7sRpf?1#cCHPUuJg)gc|5|V}=&^VhQ~3owUNF<;H*IZ` zfr9S`|2cvifQJdD4M*GfFVOtZCrdE%b(vtw=N?*=UkIL{VCr0K!zF?%Kra)_cD+il z2^_NV|Ja7>ZTJ_08MjgJRHVDt#`7D&??cb01hY?j)yDHj!JmNMA^0=k_XTf)d`_a7 zFV4L^g6{_o2xcBf2!0hh+$?x5=t~4|0`RXeW*?Y20U0WZIUne zb;!9*F!NO<_z>tnx6vOE{0`_(+30^1d=KJw+UV~KZUFs5!P|jP?{DeZ41AX0M}W^0 zOdUoGeiS%E@Z-Q22;K;Mxs5+p@av$@5PS%@z{XQ3xCQiE1V00OpWyw#TLr%W{E*;w z;1kejj)O-n;9vm@N1(>^5C6`|Y6M_dzeR@mJXJ?Sel7&s~Dq zw{H?mea=p?(&F>+B*A>oG)pk;IZv2()zjJ&w(Eh{2B1?ZTtrX zvuz$0%=cKI3TA)UW#f;<$7$Mx{DTEkw-Gj+DVX(ny5OOZGgmNWuCVb}2k!#=@$Z-FLjxJ<+NGce4dFrOt;1(VKp?lSS719rg4aN!^6Lk08w5cA+NEqc0O zz8}gEO#bnL`TihNa2R;9V7{x%5={Q7Hk@n2GX+;7-B~vJT)}lX&lk-1f(ry^L7zo} zDL>za3vIaAhD!zCjJOqo*~hFA%)NTo*>I)c1E8uvn^+xQy1ZU#hDR?r@{}4=>M+Il$OuM+s@ehGIxhfR2`kz%6W`0~hw6IBxa$%q?h`C=M z^RLSq(^w;g#zyetAZ8h{3KBET3j{Mw>PkBE!m38hG%puy;ygnz)4WPB(_A4q9%rh~ zxXdGi){|)y^BXkzi20p`e7bI{yh|NZ`32ADIH~8d_Je8bZ_O&dSA&4S@^EDlNq>vD zmm;pp?C_6w$+*{sRlR~tWYJn<1I)ZO z3J>%8uwdH%SAv=EX9VM9t+7Ge4B!`q&bWURJRWC;Q`wg9t{A5`+p>)HcRg+AO7JV& z!ftm1tF}DavYWCYFavc;0Vc1iKfp{UOXxTmIf7}2D+JRHGX;~MpS>xEcHk#xVupMi z#MEo4VDhuuBHhGU)iGe&jp0;wP~ZE=BmF1i=zdJ+eLwPRlAeHn2-*&BfS!(P7YPW= zyNe1VunhFN&@5uu&4o-(C1zzo$i+eW2+)~#-8N?loof%6?UeH^J6|XmC#wyDP90Uf z1*RP+ll&&ms;&Z4mm;BO;`}4QI2m^ej=?!B80r{z38qX{harbq`?=6@vie5Qnf={D zPs909!L;Qwf@!DM1ZUvfDHtc?L&39f{$Ig!asEc|WSslCtbEaa>iZzlWiW-#e56X!VE5Hcx;zs(`e1Rf-qW%ND4Ch#c1 zfGTL4Gd{7spXYaZW&cyO!3SV0=F_#tlE<`_9MGAzixXo6Ou38{bUe(9Y8Svmfmu|f zQ^s|IaZ>BBNvFI;IEbmsa>0~+n_!%bD#6Uhdcjb^T8}4jHw&G1R_z6J1~r!erfqlP z&}ls?*u?oU!7LZGt`ht#(*r_hnX2#Upr-+AdjeWE6x%Xw+K20=C`tST)nDT6;@Vh*PKE7k{rgRDKu= zgJlIaE&8gMz47)c)aLl))T-JTyO{@Gl@=~Rp%%kF`0;+X=D)O{VqwJDgXIb$udJxF zqW7jq?x@SDg>?FmhacZ-?w(ogI|6<&PfrTnl(Cwga->kQuxLe5uXo`=W>rN2+!6Hg zyKtTL{DQ@+mZI4ft*8JqRCE}(Fj#KSi~M%|6g8)>U#OqDP);37>7+Gw_U@K%C~+#I zehl9|sqY@IC+D|1B!c~|AK8Di^rjdl8qE zSLl%qO}@_owba39R~=On?E^k1R+OtYv=H8H7E+jat+zs#1d!h2^DoQ=KZ3R8)9p&{1?x@Snx% zbL@%g*Da|&TF;UqcoTwKmxcBQ)Xl&$Eh#QS4`j73dsd_E&|cbh7f*fKxz7l8Ls+Sc z?}%=CDF-gS-EcIsZjq$6C_hwi{-WGUvFTbZ(m;!Vx0-G-;KpNNVY#Y&Xq)gGly?g{ z({3y!aJjKu*|4{}lB9ISaPL%Hlm}-V@X?`aKk9vVY2EpwrP(_-8-{k&(uY8@h(n@2 zIIJWKZ^>T*Ta?1Z8QK~8l-|o(dKHdVbZgYTn~hcn2b;Z2sSr%c*mg1pON_7Vmtdc~ z9`~7Iq^RiN1c}4*P{EjKS6w?Aaq^<#?Bf}_jc&a>N z%jW6JZg;zZqIH25RGqlP{NKiHzi-(=_v5z5j&Ax{T+#<&?1+VEL>7nvYbw?@Nn8qM_XmEcx?Ccl&_#} z>{cNum#mz=m952pREP)263mm9$KM>-T^+Q%ZD6v?`wYU0!9@L%acFrrJLD~byjUh6LCd?|A#VYU z%=dbfcP0)kZw-ve=(^q);s))igO*ngKH@C7aUAkk4=C>}99rI7hr9~hkk8#Jrj~cL zLtfH!>pd{#4Y0`@7vEjKM%l~MgK%hh$uOMVevhCrR^q-6TAmMl#94A9bq3zgA|mCTgG0-E2l4Il z(h-lofppOD4e;6JrO(9oB-B;P`#ugWZy*|1^(IX@)6|my|WHl-ZAhIXUUC2MbUmE4K&`PyjLCajziuh z5{D-(?eBhbJv>wnN@5n>>8ti^$vNsDJlE-ppR)-3vaueua?N3_jKa zj`v!>Vu!qsAkRgGC20MYI^-qYV*Q?)^6+UUBJUn_{`UNSf=ZIEg$W-oe+oXkev68u z;}JetMC6q?M;ZkP8s)4)AD}pkoP&{>H6{mo4nyr&aU6Ak=A#2EmF%1 zfQdLuZrooIoeyP$#(T8iQ5<%8&5)N(f&?w^6I|QnEx^QX7Wint%j6#AEpe2`C+GyS zK-WRb3p&c>o*kZ$4)>F`&RmPh9=SJ>p;=aAP7d2i#s4m!VF$7k1XBjkMsChCWwGm>BaUfW(C>qlE_IGpkt z!DpAZt|F@6l{R_h4ted6$M5MnX#My*KfAn-AW!RewN2g=m<%%dI1%vYF<5Vau}}xz z<8dh}1J9_|Dl9~!h!e~c?=cjJy#Cguu>^dkV4fJCSTa*do$E!Qz#*H6mQ5Gfs=<=C4E|*S` zvTu&0&otj*g+myx{->e-MR^s;@oz$QWPddOL~Gx<^mjY0{dcS#()Orr)S`RosIBlE zQf!wsw!Oc6+(;4of^*+8>^(Qfl0Wktksl|ULxn~J1{ZCqPYsRueqFq=rw~J%SE!bDF;QBvaa;U%`Gw*aauH#yjzznA_vM z=NS{nuj1ZC1GYT5eAL}r#+Pq;eSee3c+TUhd?vZ!X|wX-XG~5x5vmp|v(6yWPojhu#RYugyDl7q` zA#P9fZ*coY1<6?l&fVC>mTZGM8t<060Ln=kDJPLzfrWGT#wR@2nmO~dBdz1B7{QVf z=UULORcs0hEsD)zgWuCzN;a|tji?rm?JbO?tnXKHgzEO)q6x zX7KY!d#=_r*SGTpK4?Y|RH%n8p-wd^`X=-1*w>7i95u`(Ve1qP2df63K?X4l7 z+G)(EcN#lxLQv_|N!-D##i)xvW69aEb!q;2*Bf=i0{)j>p|cHtp{u#^$SaFSZ7mHa zO-s!gwF|_bC(b)A`@OQDf6a}Zk;5M+&T7uSDIR5j3;!@<-ZB?(ePeA6l-Mxg zzEE>4U~`hMV0ogoqg`Vlsz&%&C@pnL!>iMqAf_{yo zudXtFN99g)Z|j;+V@7RN zN4qie^iX4ZZPl@M_6zN^q43E>|4;P>U=us>s$h)lBiJ~``&3srh@Pb}6qpeT=0?i? zVrZZQLd4db>*S zh|+s^Y)jR}iVe6XRi@0ovH_RfZA&uI@D6pWt#`;E~K! zb+pc8wzw7F?TPaS#O@88=^Ov#<0G(-cgW{zYUrv%Gudj=$TcxiMc#ld5W{U$>wVQ5 z4?r?2IH{=MmaROhf?IpYHN6cEb(@WSZ!oFu+@!4sceOTzldvOZozH_ks_T5*UTxDF zGyKn{v{e6e*7KXVlexNvnt%sl#|8V(nCySa^YR|wz`c$2;MvuP8*>8v!~be3O!e2s zSe)1_8{^gLmPJy>|7EE-F3`XF&s`yKALk~csbH(!xZ!Sh+YeD zSQL19?7r-W!lMdvkB;ojsNTO}yt{3hG2@!+o^V&^8nddgRjP9vyw^r1jlec|*b>&` z+`jR(+$7)A9Zl@NVAS2rhN^0DXD9>tQ3%1a)+UDnk!_}%X8V4Nd)N$*tmj>r)|q=0 zIb8afyY20+@K|h0on07c!)m^MKkjGSox16I6|E`IAF9r2*b~PyRV{Zc-@Ty(BXx>qz;+=M!%ngdge_a90a zp6YHJfto%up|0@k;RCj%{|ptadbF;CUsqqPqsDr#BSgR5)XzIzQ%C1a(=elYYFDtU zYw4Ex3%HB2Wp;LGR{L!l=#4Yf{mgXcp~rm_x`B=YV5Hl<)u(qs8}!|YUCJssPj#g~ z94Su@Vj_5Wr`0w*C*!=ky7f+0PZf{;%*Q_MzMlP*#bN!&UX50-@xY~!I2Nk7In6+S zHMpZSm8x0uhI+(o0y{k$t zaoz}5OHh$8QDd`%NzwwD$zt8BJH@o@lWhgSc_mB8dKN)7WmJkG8a`m)l8G6iri2Xx zF9nsQao0UYR(rqF?jTxWl+?Hqqvd^okH z)87)e>)_Vb@MV|~hZ?8WRy~K=(rKZ_tlBD>b+Af9V7_7TdOsCU-1}D zH()qY&&n;Gu$=#?GZqgpFn6xpDf8wl6N?%bHD`ktx34(pA8O2d$_1gEIcJ2Eo%?iQcny zK6(O=nx=-`^)2D%BZ0G;S2hJxni}dKYHWJNXbPSg3ihuHCT|^!(Yz)Q3Y=Mk@eX33 zTl2w|&I2*;dX5KG@iz@%3j)O4GbPS99DQHM1Dz;;G-~ew4~nVdfg?y2Ocq6rk%hBI zZ3zu<%{%mwl=DBqq6#(ru56jNs;cVw(W!IkQI|P;PnmzMg|4Ysp>~=A(Jn*TG z9~xlz>%VGg4b5;>q7$1z?dk%oSoS>v`pE#e)=KnF;bpMSIbm?`*_GxI;#iSwjq3wonBv`ux9L*EsN^2 zw+7bEUhBHy_?OAPsVtuDbHQ)*5izQSc)Mf!JWx?YAms*7NZ42$*D)>0$`JmCWG=mZ zfhya>Uh8?$8`&(J&l@N~(7Qh_N~^t1NylyW+=s@tXAho1`BqlE|Nb^3_cH$SeT>y3 z?1OBTA1IBiPuZD0y=C#v^~(;0-ACf%d$-wrh@%v+Y?h)5BBrBN^+;Jp2>DkkK08(E{8L7&_4E~S+kb%A#_(q!`3w>}g<+@EXs++Msx88N|^G9}j- zoEus?amvz6yuc&hvmDJwC(bJ)`;^?_qrH}-9e$=tF@2;OP2Y(obV46UE6ha(&e9v>8S8Q{m6dY-UDnG=X|z! zc+#lHLX8ErJFCzTn8VPH!rJP!@jiEN*-`mW{h&L+gYPa@z^_+zo6dqCns00Wh=e(I zQSudmJWOZS~g%oPfrCf(b5IyzM5kyF3WpSm{lJxh}BiVYW?mEF}f zWp*5G#1}6$*=Srj9%D*!oIfUh^)@#y!`bzLP1o+ft$x$p*;{@S8^i-mnlWY0BSo&d z;Yp#Q>&CUF&UnD*9n4n{s!Ffj3{+D!Wwvj(J2d1v$lkEeweEOmHfBnTYHw9~JWCV# zC%N}@8^ZAJOO?sa37tsA$LE{s(~Rc0j@A^2Yze6C*Zs8;OO1&T6NxnivB1~tI;ksC zcy@hqO+xjF-b~5&GRZ^5^!9fy+fc8njOzopyCG~hA77Vq-dvOIbB`Q5GC7>Brw%)B zQtkayKI6t3;Xq||l0VafnhyJJt8Y$N^pLqLVbtBex3)|g)QBQa$ZCkb>%x;jIDSzW zk3Fa%unEM+*Nnw}@=@{F`(0$Ge;q)%Byi5u3*Wj3-`<85V1%-}^+xgkclV^W))30C z5yo)KQmj-gTU&}n&pm!!Vqf8itwFhp+O%z%8(F8Sca1*9w$Jtjl9meJ{nr+eZ6Wib z3sd#BlTjV8qPQ@+b80WFJyp<)Lv76ZXM4S+*{gJJTB%l9+BXj+XHQ~poH`%9MbP&m zy6Cm3+TKxxdfbVm)#FYir5<+>Cu&al(L;0xQQM04=-#2u4RF7OU9Vt|Y&8mHdL$W9 zJrB2*7RWBzrdqZdQNEXZbNK5K^O|dBMz#*+PRiWF*k1Bnof}EgS|@M)xNC0NsuftU zUyyIpDEhmVZZfR(&yn8%tC|@z60y__LS7s_kt6?YEa$Kq3UMOqOTBiDGmSO!4 z7ln%ML05#*Tcn-yhXxU9bm4lBY^(j+ZDxqHK($C48sEA~?>(+JS>+Dz_AKj#=cZO- z&4n2kq3cEAsJ-0t@q;J(Ud*Kh*frReq@f7NhGU~*gL`V*`Fh)D+@^?SdRw_!o5ETf zI%At|tsZQ|0#Ft@RdlrxG~#hj;#EazLAXtLWOL()+^ChY!aZ+QF`JH6Mhp2XTV?4U zU6YN$Ov4W5OGeA?!uca7NeQdiW}2?vx`c4Q*K~9-{V}k+;)89$Iygw>>Q}LhgxaMlWXz-}jclK+pGKq$sd#qj-y$R$|tFfXa54`Do3e+j2nnRy{lHM!0*B^W8KJ2(Z%#r^lhrFj9 z`8k{I8sS#R>5tX(&pGUI#Bt3v(hRF0w?9_1|Boa86CBsKN&K4;r$1JguXO11Q-{7D zxqp+gU%)ue*4}B44UYT{7khqB=`+l@Tdto}>5asPRR9T$U+cJj&ru%vBL6n<_J>EM ziQyMq@%pYIPAeaGj*W6hp~2;VWi66 zCB`2e>D?moOzJUHu;Gudx&82ju1@Q=Lwc14A&qK5PH)SOK5xQ3H_@4M3&Q7}%%790M#V5ZX`nCUzqnCa{mO#L4f%ry54#!2m^%5)hH z;vnYb>w+os4Z)Q8SHYC|H^G$2pz9Um6LZO;%Dd!O<^6k#)v9Brg_&nvUSwt5a}bxe zT><<<7>dKiN`#Px!*#BLJ^iO4?jyK0o;<*1P-ZIeFpEEzc({dU5rd~4JoAZJF%cHv za4`{tML5Va6m2Y@SlURT(0>4WDe;;3hfsmTg*DdH zIAeLO;%Avsf5v6`{8%tf#@&KhR$B#|I6o$MD9*nXoQ`v=V476<0fWrRz*CVot><*X z>p`Cg69HXBbaq+v5lWTg&B7d=%qG#jSc@)a3Og13N8kI zUT`UJKaVAc_3nFu0S)?4ru;R)BLuUo)xJoevpzDg9x}w>Am$hzPt3wa@ZoUT+bnn< z0gd&8{6WYft8Tw0aXS7X48`FZt)SIrv9_Fnw_P&LWm&rT4}oPvnHk^*3NUS%B$&1wBG`xXRf2J{#uxBYcF;y&Dwr~s38uZN zGv%k^yjn1Ae}`b4j2gkz@fpD;&MymQnH(0JhVwrKvrJ-Gw}&wAh+1+!i(6AWnW@hWm| z6FTkoUxI13IvanzVAebSE`{eUNHk(E)?VWX3w^P<97c+>!`oy@8BP}#rBZZ9>L5-on z)J2Vl`u5k@bu?73ZK}mT8$_>U*zXoGky(;5UJPfrD|W`)>r3e+YCU zo#8ye%+tk!nWw7+Gf#Oo{vyH5AA|PS&HQLTji?T4pLgC@{Sq?B`!rb!F!M_@5i`FG z&N6x#>5#9tGNN5vCjKGN7L3a|8*QZLY^ofGki)Wtp0m*wx_qgFYce^kIf0(1W#L-S z(^wX+H2g!Dg+o7^uw3-B$$VmYHd#OneK`xGK3WTj!7~;0s#tIda4E6O z@hXIV2k7gF?ejM(j<6mF@_UK6)bWVWr{esfV4RFk1ylDE zf=!%Nzm2%*zx8b)j7B;C3;IxEsjJKn=`rY!SgyMLvRp|IfX;Gt zW#b>hWE{FJWD$dB5Oh;@I}ro~RkwkuyQRpj+4P}_~g&RIhpktn08{IeHe5(Uf5eXW+@hB3-V{f=FGn?J5`P{KANOc z0R*0OS*UVkMi5jvLeAB?Tv#9os$B4ox~OsiX1Sb)BL$e{a*<%1j2{SQ8BGyPy{;2X zy-EesR<{Z^ajq6j9k&RkjynY7WcjN{y407!X)F4Hp?=-!Jo3eMPn}#-8B1&hy7sT4 zeW6n)7b_Zqi9nxRIHJ@s^-XyE8`~fPdQ5wSJ^*c@tdSix3IQ9eoSRO z8-l+PnEIu#Vj_T~F!OSjVCtgkDtO4N>Zi8qU zCeA+*jFTF>sSovi)JA_oa2n401T!rLrwtzgP1z6`+9P??^_g*WKdfxUgb+*|l=C+D zNlH1x(plvZnBj69q?3NGR50bJwhVsS^LC+A z-@64`TU{sD-4vSeTJLFVyJZDA^3;D`l58;0&C%3m%X28DEo8T;*Ulu$S=RXO?$#_#R z^?FY*&HH!3vvB@GFlC+)oP~3jV9HEzS@{Aq&JaxdaX%{Nmo{c_vGYKP!9m+z4M5xJ zIzZd$cQUjE>3QHWiDkYqROoz;RDD-62nal-;2+4=I}>2arX5MAY*qh(p^{~PVCJ_} zcqqF{Fyqz_SJ>%+cH={_Syd;xRaL*J`(EZ^^1q2AZ4*jH$1PFlRQ zFXz^F2bEZO(rrmbpX;K=IK5Iw)~%@Zg3k4Wr>q6`g@)f|K|3#M7}j=0^tIYS*1Djbh|%s#t?h%i%^seFzfH|PBkDAu9Gl+aq6()+V#g{&9f3-H2WQ1} z9jljH_TdhgET?uDOwA$|vRv`n)nN5fu1!n(cF{|9m*=Zms94oHyi-;M%VfIha%G!x z@~T$+Ib6-!m9eVDDI;rkd;j5d8w_{5NHAI*o%gM!X%2={=BIZT#2j?`_6XiMVVme|qWMN8Ouw+prry-`7r8U3%+(Rr2=Xzj7wEPWa14?;mc5J|venhMtf5PRi%yqxuk&sGeR@ove< z$LAj%G~Yz<5ogJbtl`#kHDBXUAKs%HXFBBZxpM*z9ke{Y-?z)V$0m>O;k3Mq@L*`y zFN}Mp7AAbW91lLbypL@1_-v`=#XICR;~t+Gbs!&u$02X>2L&@f{KGu|Ah0 zBX)U%QCNIGql1>W0(^FP`!lR>f|NG^hn6?hA&+Z(xzkN$m=v@qf0<#O=Z^&33SdXGqXd=IAOWjf@&19|-RqJ!4&0*AcukcTWQ`|L%5QwwnMn2>fA|mzsJ`OGK1z@|p*CCJVfpyUGeg}eG-m4ej z{gKqafZSvGo|D*J-gs2bsalxu@iG;Bc6py)XuYqae&-4w<$Z|G!LHvL$m9BB9khN& zz-O1&j7~BIe3Ul~2k%i{twX>1{+69_O9d_OPKSQaOpMk)bPW-C^BnTpA@50%#gmpd z+aWItmA)DGr{fqYeAMqoM6l<#5{)qpbRD$3c>u&&a^oY&TLVmaqj2yZ<&6fg%WH-QG;?D`c#-g@v*9;$Xk z-me|<+9B^Hk;Rji_mD&0Cy=)v_bCrmJ0kBbM}M^monvq1`)Bak^?T&v===axF(Pk= zLtYEy?ZkZ@w0;c^c`S_k!9@K~G!c1o9qnxq-v7_n!i0~PS3BC<{gBrTI^{vth`jy| zc`cB~_4PVv{Z4bpn|eufJOYf!b7L}NFW>hu81z=YCn4Bwzwo6|`|({j@3H>93SgI) zlxi5SfUX1i7+wM(&f*2aJCLXCmyK)Qqr5rzM|tRORd@^XZpPTC1Ml(3lX{OXRE12_ zFz^=%doHU<$DlDc^q399x<)&SLy=)c#jACL8-H* sCj~UJ&g5YzMBeQFeAmFZ)PePYLGulPU9@hbQ(lIYC915-2glj}2Q^a&2LJ#7 literal 430242 zcmeFa4SZD9nLmDK@*YM_FpkQLP7pB2TN2)aZ<|1fK@fS9g4G>|%!EV}5+;cRtKBeF zn9#b#l$M0PEJV~`#R7F}Y|C!KS{hr~Ro305yLFfJ=WlDfwF|D>+E&f~`#twLGxy$^ zA+)=nPyheV-vcN2d(QKm=RD^*FZY}?=iXa*b0Az(cWdr!pWPK(f+n{9_4yXgFD^4# z?#nd{SAk(%KkLH&)?XS%GJnUn4I`Pqr^_%d#((W!4dZX-C-<*EZ5YY?M>iP8|A)Nm zSGO9;ygTc5<75A^4KAh)q&?JS(5GjQwfnCxGSdHtJ|oL(WE}ohg3r8pmhlJr#*Lw1 zYeS1a7~0sj$=?!c^|#iALoIbp4MD?BYYx|MZuK{|Y)Tp*4z(tY-`G~0G`_L9K52ZY zra5VRO*pCiT7Re}SQkst*xcd|hXTP+*k8Z7KAyr7UmFgElJVDuLh%w?_%~S!W{Iw8 zYHUoNK{!;?5U6jA<mH-&o(;5ZY`jW}HJ6$KO)F$>02dKhSVtrO4*wu~^05))Hz# zE3;*lKyPk&z{apO41@Y>8tPFW{<=^@Lz9hM)711peX<5&#;a~v-xz9YbF=}IoKTY@ z4$0c$y+>7&nLufiOaZjY8oT1GqM(0MxT&q#-`eCyrP|Vov67Nn1874DDVoDgtxYve z4gLqw%<7vq+ZZ_VG>2>bt=pQDBxOB^+MAog7?i+ZOUcq{Guc&CW%9SeeD?TYs3yFv zxz%qSk(7;S1B@CqO<{WrSL0$h)Z7r*=1(+KXmfIL7(7Fp?Sg7Utu=M%{mqW*tZk^@ zREM&K1Dji{g9){2YYxJkezX98a}x$$7|&J_wGC}8btI<{n$Skf7MY}&>^5dJjSW>$ zNw%zDu-Xv&HpT(V*hwvs?m@p410!N{L#Wj>66B zrZk%tl-z)_hgw^P2tAG2F@X-e)GnrHkd!gW=l*Cbi)g=sM<-^ z_N3OOJZAmcgp=Yo>rYj_jo4aW^MF#%G7n*gk$8-|7(tSyfXa^hgd|C{nGjUXCli%0 zBGfc(u0;c~*9C3ljAJ!7ZQYzSzBz;moHGG#!|MK#kfkOtm%65w)`VGxW~gauc2vB1 z`>_>_dSQ48sd3Ob>9G?V1CG1Cot&VDIfIS~w`J>~*@qUBD0NZW5ZGiVH#OsKSN{;Z zCT?XdZT7imAQ<%5wfO6TVcxYb#DckfN*1%doNY8ABC$=fbC`F8 zlr?TDMYVB{cHHiD)_TCP563pDts+zdMz>RU-9(BiET<%iBsIhbHn-MeB<7?c1;@rf zurW}B*|+nS&-RO(eqd8L(CBXt)I8uE@W z%iP<>K*5sS7O%=;No4Okii&Ay$sDz;2(`=YjrL2zS;IRprnI&74N1(a#xrmv$v?pR zX1#r4#o+=yvt@I9DQr%eRCH2dEF_ZDBoimJ;AVdvCX9CFg_g8skd~@p)CD-B4`Ar= zJC``ha?VJ}#~H18opnwN(9-4#Gd7Ue>}Th(RHThd<}4WDnp*;P3hzk4I`k;^tBsC2 zP@2W4HLdN*(l+`VF=I)x9EFWD}l~I%3*v#x5 z%|}HB8k#Wylckqk8trK#CzhBS3CZRwN;FN8lBoJeIJAW=l=};bvh}*DwJx+7I~I<0 zHS0>6Q+D`$(uyOCxum@? z5Bd%&F7eL8^lZD3A*&(u`fUwOj-`QSLqnE@Zz?WxBI+E`nLgQ_M%PSBz_CTA2??6S zZ{}#}_N|*3$!1)P#kc{bZnber!tJRQ{mP%9TEg544N-9>=*kv~kuG88Ch@^gZ2-+F zvB4ruLM9v*)uv*zefP-{pRgxqZskdPthY~18o4+YksOL`He-aD%w)3>%@w5@jQ!k= za;#h|WLq*e0h8U7jBRV#G;;_bBko9kGlzPNAZCIjd6CsB=You;JT5U(vWf1Tv9xhl zA)x@VCT1>eYr^%-_Tj)>@XI|cVbcY>?DY?ZIBl|5I!B9m`&|Yl^16r7h&RkH}^P3RYiRU*lZl$}U9;YP`%_!+~aOad>tY&j(Q%^OqwSWnzztkq2QKf1J9ah5rTNpP)vn4m-mWcl2 z+_N^dNmW@=l_5+z!fGErp*l?tH8a3SVbjGFos?v%DK%o*?xuKqvxu8gw#5^MJk@Ya z8L?$nLWfkdIrbiN(>qljEoMm*@=*6#)1sJ(V1qS`wrDFXOEkw{_dt*{5$uNsvAEnA zvfuwqoj!gYac;>I@x zUVt^w+}yxkrS|I8)awGwoI^BX`vLpf~<{w<^Cb2vwdt~A;fysLE z+G%cTHbo`xwPuFwWGxs3gKgMZ#f=j?o61^A@{|cv+)B;`j1&P|+-=Y;&Uc~wxgk#O z-^WIh#99Xz$|9~vs`hRwZuZamASO-qt@wG+-&Bj$0jyGot?!@=NA^B%O=#A`@0-f{ z>sR7%V9Lh`iFG}lgLfNC4*%=?<72Crg|_}t133<#sGdvO2VEXGIepZj{4q| z^!Eg7@-oMsQKJ|y@T0@@{!fx$jElXcr){zEC`CayQ6*Grrfvl z&*sD=Yq9D&a+xit0`rH{w;gyhbHkRUfrZ<>i>^SOMMY(qWkUpE4CcJvawE(KL(7G>WcghxyUoykpte zhB9FB_6*b~8{3_|gIB34eyI@3!;+mP8!Fypvm#z~*lpJH`uuk?KFm^90^8w?{=zpi zqb1<_;jc}WGZpV-C~}JI&H6u(zO7_}#B(=iM=GX9DyGc9b+V^yBSbyjy`|%&SY9^$GgDWcqb8FF=MU%AZ`p8u>F^y{ z-pB;lwrqkoeF7}oKVDgOL7zLb0S&kuo#J&*c2}>_vkLvBr-I$%K-ZHaJtahijLYvj zFw!%~;L*;&JK5uZ899jICp=^v&Vsco&TRSF_UM6F1sqQs8a{I#Lqm=c9xMk-$xz|a zC(x(z!BQPSmbXVE*~ZlF4Db5%s>_V%>$gXnqXXT8yX$HqPebr(2u2@2l^H#X6!$;I zQ7ksfDA_c!k~6-2eC5fXkLYBc%o(?_Rb(8`JjJ0Yvj5fUCw3h~+dj^=GyiF1 z(d4_{-o9?`+bO#f?kQ8Rzh>%{m#q7#JFqej9n^Iibjwqi2S?j0q?}ljxeoSi%`I>4iiR)WiruphyZp<~1w#9edlpvsi zW0x~;HR?C3U*CKym-%FSkUUdb44e~fYY6&qrovZ;HA`r7uCZisW%Z4|Rr=a2;330U z(t;%ie#5Wz;eaF*mrY_{Y4NO*StY)ry4Kd_mK$f!-c;XO*S2vMmQS-oI?3#Yh6fvG zV(xl>sHSxmID8<@G*kLZi%aJfmz6G@meA>b=8i|D8|P#9RK}*^-;aczjOHUCma2uA8NuFYh)PPEak~VT&{#$6g|gy$U*Ox z9F{8jCB}Uc=7s44!oSHy`T0f-u5^=B_-bR=3>x?2I@Y+txJ>AbX8PX{h-277R`elD z1nGYwygx$xSYx8`ywGn!{8*zqQ2EZo^(w(P z;mS1Bhx+;iSK~Skz918S;ELgina>=-%;yt=nNOWyX8oXG=7YyMR9fagESPytfUPOh z2fR!$dFZsQbh(xzE}>k)%>1bTYFvp6q?=3dbaXex{?d<;zNdQ~82< zJuuVg`qKHTdS*O`ZMaT^FJK}#JZ_>eb+}nDNo;rIp}a2(ro7{VS+p$L1U#v1vK2g( zrS(y|;ZFzRly1`9ncl^UfK&A@?LpQ1)n>d87wW$g*U5sZSCQcDxXvKH0)OC&;rZ+j z-CTI4-H$6rl!6@mfnz)|%f3)B^<69&NsMa2)R*-~eu`y3CZ@g~+5wpQP893|UL%}c&qY37(*P{!Lb5Yr(dGq0j(FIu_p=h61ywHz=;b*(r_{kki9Q0|1S-5wHX5F^p zu9?^&#aZxCY{bVlM%N(Dm8vN6+{UP)9M5;)H$b&DFshn(N@Y~p>ZI{3PAvR5BZtH3 zI!!92)zR_M#qxmpgDsoYp}pGFnyRg?*t0el66@gH*wQk~+~J8osv{dF#w;AzZw+k3 zbz7slhMTy}&S=cB*ds2=op*D76n7rnZ}Th>=-SGu{tG0xEj0!SNnKPQ1o{T#F^!c^ z)5xgtv*05xXC&NrF%GeRbDUxJq%j%O$jb+nL z>-PZ)Vb$*q88fLLZ-ZLDe+8elyvsr398EhdkMkg_ykA)40mkHg9@r{x0AY@Y+G%;a z5Mh;<4x>y)9QEUThcw!+0p2R_HH4SKYp3OHLWEUb5#$vkj`A)M8s)8b*pG7!=Bu5S zx5iN)>mlzxFi{?7)8wPPc@BBykjFWyc3NJsLta1RwS$TBc;C?S&H!7>+lO?#?`fyy z{XHUx%Y{%3qj4TVd6&a$d4CCPmG@o9yB~4dX?aHwVU^clk;hxRmUlOVS>+X>vGZQ6 zotAeOn5^>pAg>xs)Q{5-EpLHCUOD7(POqJoSL%>=4)WH5iSjsA(em)vuT8%o2<&s( zX?YxBh|7ggiOTE)raaD7v^?69>ge&{D;eNs8l{YcBj2kgRDVgM=Q@B__C>mG3_d{xMlxAFM$Wn}7BGed)Z?*i-JK?ccx8fg8@8 zR~Dh2n%ZHn#gjE-xw(sybvD~rx^dy^nOU*DnFP9>=KTWhD&9Wh;rFZZjmYyKox~p4 zYVVM{F5-RAUH)Lr`taR-kd2*I%6>d!(+lqA9Rr<_haT$;Z+amo^8ANYY1o14jKG(6 zPFgy4p?jwKEdlv}oeXFCT-n-rXkr(?Xb$oeX!An`);f|hx1wAWv?dwVRUSTZE zxG|cU3k6Q*8lEvn`Um>P9(i_P!MDeF|J(KLo}Tnua(B240>!)QGo7WLoX2x|7BL&| z&yD?G7>GRoLDla@BG3P>>bLm&!O8bWU?=2{g0&k_XytKFJooUsF_S1e&JP&gIn+FD zz1#ae*V|*Gld2cht@hTsx+C6#oW1>5b{rb;T=v!MlNrXtzs{Uycn@ZUpa1R2smAX2 z2hRO+z>{-0=TOPBpT7MW&n2D-$30uWo&D1nbG@$`JMxX=m;7|Wd#5g0_iCDF!oYX( z)-6lx-}uZ;vtM!T`xfgdbExEJg}>nrWVB@0)6x80e~H+kLe^bmTi83t9d&i4Wo8*3 zl(Mrl{QPfrV5>i8Z`p+1-2*>e=%uwg!=9`O%eNZ_w$4~FnJ$BzBdT)$2s=)O@pau< zVBKVUPRi)=Cr!;7;xTFJE^Q6xn;lZ3*te<$bA0BW(Cv~R?E3Yp{OSft3e=+E@Lchdbc{8-uJa$#Je<8Wfzqp`;8!45nwPG;b) zhu8Zx47)gJz;XQ3JRB#re6G2<7ehzA^?uFEg30Sxq<>SA-nx`0(&$$!0 zQpsRWeDq4zfT`GU-YeN6z>*El7N{r2N7X0B=v=hf7BNsrJtTf%3#c=hqvmMgN>x7f z;QZ)<)Z_KB$Ma{^BrH`}l^5gs(LOCr%P2iTsGIn#i@BkjS z&>uWX8V1KJG`X1T2f95Liq{)WMsFSeENroM&oP92x?R!6$=Vg`n0(rGYamxm^C4_) zSJaPA>!JA;A}rA52|A}>aYOTJl-1(&)A9QqOPI7{%)?Tc&uV( zt|Wr2cDHA&cc&|Wa}qmu?iq794d*!0&t@9l`;GP&*X{ji;<;@ZTpGqR(dbJ!hX#o{ z$Sd;Skbkc`n&G*+$K}1s?a3+}8EMRp?l2{1LbBWN{&U*+tT1 zbCqZ8&10ya8~Qzx>)n*S&gMep=GhD?R^-~bue`s|GggazJlDHEZJKMS5WIc)o%zSJ!8kK_ z-9}?Zc9HA0{%iUR!P=g$WNO(H&lTY)P~phP#B)n`ZpT_OiwCNZX*9ocZ?v%UnVFe( z<0RI>x_xe(6LIYvm-p4|=u6%+#xvdj9sPFaODH}rZsY`UeJ=BAvo-3+d(73>wZ$;J zKQQ`x&t@5YT_)enV_>Q*90dW7C%fY_YdR;z^-%Td-Q)@w28>euB1)7A%~9M(($~H9 zku;k>!p#qDK(ztF+|Lt%a&SFX{sguYmX3yc|(o|YMllLQY6eToWCRAX$ibvo~zF4^njI9(tE zJNH6~NvCsBNjTPoUXL@Zf;jgUq#G`Dx6v)6`0tEi~il0tol3w z*JZ?%&5cQ7%Ko%q%HAcI>U~Kt`3D6vAKH#-eYpNeFta`@n0nFaJqJ}5(O;EC7DviH zGG23^o4=8hccEbN(&^u}l^jV+8h?|fV^r+-X<*wK2rIudbE;AROnKIggxGz_j}!WM zE&(ro!w=o+CvN@wby61lPvWr|Y2t6=@zm;>&skck{_WgJzmSCZujHwv#CdF64e@N^ zJ1MD!D4rDQ`8%rZ9eFq$(1>5uFE|;u?4raqQO5Q^6bd)t*_D(=w{vN;;ng6m>SaUr z44RWq^)ZzyKKA(?d}Rn*?8j|!_)m30osQ4<1LRg$~^#Y)$a|2--p*u%lirr<^2ZnR(XApHyKQn$M&V={j)>f8H9P?*G|j(2Zy{@E%FM$ ztmS>#A#Z{^dHeg4L*6;a)9sHlC@rtuA#XC|P1ec@AA>CpdD&?G zJl%Gr3z|^B=_NZAkaz z92glnIx;eh;eKS~#H)EY+W+C0M?8&}{M74N{r$YUtVc4|O&vLD7(csgSm!pl5Y|B@wO?F53GshU0(h+=-p^t=d8X5WQm4nfg7a96c_&SsDX`bH+&(ghRY0Qe- z53Ez#g>(FL_zd{IR}JG3{Il>g2GAGa{{nV9%q#q4_#*fR46H41Er4g!`39~}!taFt zEc_$zE%006Up8=Wg})a#0KW!)Df}JqOW>!&&xZe+VHnTx3V$8^_3)bv!^pw)a`-vG z&*Rz)zXN_3{KN2J_y^(t%78rhdw}nQUkzUkzZ||2{yCKCF#OjI!*~YaGWc%-&&L(^ zHJ-rr%kX>QzYgCBzXg61{Idquh`26*KL$Jx*WI}8#`R0^`{192Z-8%xuZ16h|Ed9x z>n*s>gD(ZX0sb=hS@2WgGvE)ve+nM|jYr`h2iOMR3Eu|qhp&NO1-}gbPWW5kd5`-F zt~cX48@>d18vLd3GvTMer^D}ue+d5DhGA5|e-5}EJ__Fo|EKU9;a9@n4!;8aX87k} zufv96ya@kA_%9%?2fhiu9{xGQFun!92fhp8Zurgcb?{$D+Czq6JO%s>Tpx%3Jn$Fc z55YeGAA;{Qa1I&Q=W+cU{GS8wf$xLAA3g}537-dl6a0rL0$&zla`*Q*SVLbn_>0`x~URo-;l7I{CYgRL+I=` zba$lVDHS;OAv2t=!t76G*sa2}jTz2RVYW>(oUOuar)D@)g;@_~I7@|d2F!4V+mxRx z;VcPXr|Ib?eY%7%mGETEpJCExNH|Zzhb3Gj{NIR&-7Md85}qpb=i^~T4@RkTAzTx-1FLHiJe67ER=zC*dp!bIhbG z5`K=4bO@{Ram=HeDs+x-bOJWbQnO*+SAx=ST|!+;7JSs5n1RKj@@=GaVEApE=+(0PT< z@tba<(0RY0yH@Dw11bppa+Q9($IxX-nD+&`3>-M7{dupTyHvtc2N(i>hDo0_pn|Ax zGt7GiU4iho4X7aWGwD$YPZWBmgs&BPpUIB=%<=D#g!3}Y@bePR5c)SHoF(+nX}a6w ze_Ycg%zF-9k(NK8f()znaZtijh29qrD?0B#bOl2H;(!XGd}e-sF5!tn|Gb2+75cL# zJIZH{-(Qz-UWOSyCgBXBe^bI)Lg(CqF2il|KVb$@e`ffZ0W+dV%a4bZ{!dGIs?eW} zhZUW37PAx&tucUv@Fx{o;=Kb!lg!3}YFy|a}8A9j$gf2_yd(0s0XYzkh!dVjT9xx*cBt7Re zbY4l{HK2m%UuOC*NcdWzuaa=Nj0c>H(Jheh$^jKLZk6$ab1Axc5^fq$L8Dyc)k}DR zgf~n0R>{9k!t*5jfP~AXy>T8zw?M-852zsWH`{Aa!t*3tBjIuxFYc7^0ts)F@U1ew ztcayI$E!dry?KAVBbMF_bN)?ttK2`A52zr@Z_>9&c!AV+bBu1bmwP2#F7tt>mH9(;EWJtRe3`CX#+zjWDhT_S;}hq*bhpa*bo+n`LO+wfM#ANCzgr^V1rlB@ z;albYSSjIo5^jv8H~Z73Sb8(u5KC`{Yb88S`kUc!ZJQt1jQ0y0YnQJnnK@@>#ga8M zOXtm>dE4SUX0EBOm{T^_N+~HV(-bf{DT~cCDJW%>XQ3^wuE77&;+ZS&T)v@XPVqbo zeI_3rUovy`nu?j9Sh}`)=0)%##YJ&nyxf&*mR)r27st!IFOHKXzc^0QQkK%Q23b#w z7cHhmSxI6}2NSD#R3?igsk`LD5?e-cK1-(3wo>!i+hA%ww7XGCiH2F0nnjiILNbIQ zm5jv|cPv@Hd})Q%>?w^EW4;(m#F#I}yfJ1Dd<+0|KqSe^wNis^HJ6em4ZYd6+Dv^!uG>VOANt~Ec5v7I` zQ^i__jiho*mPQEDB4TM`wPH~-p%^hHi@K?qERyVHN+u=+2W2>FKT&0B`xXVkc*EsGP`T$;&!$Cn|Koa>Wd3F?DjqVw|I99OF!4dV4uyoRpbN zPq6C=X383H@L1G~*MWm4Rbi8`C94Mqn)gcf{cc- zG%+(;)Pz!YWnxSgbrZ@OW1^%~29Gf%u{v*dF}+gMTmsL<%5l_SQaO%VOyIGYNZBWW z!D5~ZFi7nrPaUh(1hQ0Ma=}8h%zk2)jG5e`J`_!q6JxX#L)WrRn;0V{I%+yOW0G1z zS58*nj(SSMl|;KFT$aMBk|trX2uj9cE9HgNim_TmYRmB^9;=HKtvZ1xiMm0X zTxgsUd1iQu!FMUpnfftT)T2}jS@m;I*~Iyzn)&Kyov4m}-s)1pOh;D6GhKmT53bac z@zi~yVA59$CO@5)p8>3&lTxy>aL!C|#CepSSDTS&hOu{~ULx4ZugW4#P07zO(~coO zF!@zkfSvjzqn6edxiF0{PpyH_%oYDaT zlsypU89dhKWWhJ%I#=*ITq^~Kaa}983)i4vo_T5&{0m$k73@XZ*dv(j;1>jU z0lzGm&-T3`co_IC!I`M<_XN)Z#!vZ5=XJmZfISJd{FRDfL{=dpUI7v1s4IoA$SGwTY_7G-xItK7(Z1j{Re>A zmTCY00G=$^i$*n9a0PIs;0EBef_DQ41-}5?D);gd z3w{Xr4Z(YX-xB;S;P(Xo8!(O%D4ny>m-y@>^`8YiS@2rmxq=@7t`z(<@LItqfrEno z9k^9+CK~0Vf~NxS5xf}qpy2y}Ul6uoDTY`P)|L+N|1jbPkl~)}wpD|^=p9h{S_*=kp1-}VgDL5VD#ah9|z(K+H z0JjQ`0zWGF1>ik`-vB-+_&wkk1Q%eed0FsW;5P)X0)9*IX5jY(?*ztC3#D@}FyFIH z{l5b|S@1ss&lUVT;7Y+hj9+U7F98k;z8|<%@Sg)eD)<=i9>MX$(hTsjrZwYP(eoychfpHW_>HGpP?=95-P2kCbGjVg8D|j|=rQr3z>>K3&G;mPx zLEu)w-v@qF@Xvww2)+V0#Djv%fnN|D1b$g?6!;Cn&jG(B_%-171fK`S(J!UL*s;)G z@J+yz1qXrW3Vs~8Qt-Ec*9!h8;Gp35fm;P%jj}x|_(tG8g8je;1wRV>g5X2IFAM%# z;5P*SC-7T>^9rE9;1XaQjZ*rr2Il>i_G|~9Eck1{?9YsU8MspL&wtQ)x(xyI`DW^Q z4tTQQt1!u#EBF@RO2Hd}*9zVV92EQnD;mW3p#ulknQLvE+?! zX|#sb)5s|vqmF+LOnnqozIV=#!pV2ZFYt))=xGz5KDMN3!_&R$^X~~yN{_Cq`pPeg zhA)*ko|Cp()nW+qbGEh=3Ci&ks@5d@PM-OB;0xq&!9?a;vS%%C*;Uv6+hneCJQcoqdzZr02D2NZViS5)o;pOYW+nV)b?4uf+ z-yHru3ZdAol@nG?iXHBfyegtr^2u90k1 zNX|WK4JS*co~(~|RD6gp;jK=y;xB-oJ8Le~`h(sFk0rb9+53HSF*in>c31`|$16Ri z70Q9l<}lq;ZY%ye`7nIPoaPH7hPYfP=WZ~cr=?s>eH9JUHe&_6Ro-%hKLM|umbVlU zR(ZbZxc4BA@>m?wDDO?qt8vxkI0%eebwrAkh4OH#jmbLz<*fP*ftF0auYk#_U$;fx7>m5HL*8qk!PGIQ^=ov- z3P41xev1)EWy@+Mg1VagSgHv(+cFNgs3 z&`#suB7(SF2y-Eic4m1oO^V4o32c?ey$aH`)A9xpVU<^Ik;knh(kLIt)@|}SQs~D` zV5_|47J1yY)bjow>G3~SACDqXh_H6#qx)OLTji~{$m7EJmvA58>H*;g>7K= z{1TtljrJ~yg{AW0Uf<~Nl9=m525_cs@%R0kvG}{k{(iz({O2w4e2-xYmz0u{JB5%x zB>Hn^&hrahjc(8NgCirSpWHP(GE#y^6lT9x^=RnWp!@kmhhE*b#fO)c{XqjNy%D3|;X`)#IL5rk}{oshyBM>76ppyU*yIGTt-h#c{3~ zp57@v&n8c=_J$G101>bJIOzs?eFo7mkd4Yf9*q^Dk{b^u(e`CaD2d~;;i_x?5Vjepx)wiqVw3XJVOzw4#x2YUngOSjBO2hXYW&S7vZ3S70+ z<+*7P^>|=-cx0r4Hh8x%|17>b`m1Q!`0n1qv3tLr@0m`HCw~GCrPai9eOvC{*E1No zeNyySLuIRfaNV(?yu%q$ij4m1tLfEcO7Ocwc_RC_DrHXzs{QsQ(acD8PVH6qcAtND z+7a)a?nv*;yEa6wFd~7gI;o6dobL6g1nT3#ps>K%XNJ26Z+nSfL@w_cI50A@e|_HG zdG4w+BaupDe5LmvjOh7eMMn;&pUOCUiE(!&z7HF?GCFu$zkA2ujg&_RepTeII)!i5 zMl+*z>$8{UPp`z=N_qlI3%#M-W!-pN<yv{$XJY}5~)rDPw{6&GWQnovC z&s3o?3>BeP)1$AWwBEaoMTKKeUSS+IzYcxqK(s)WV~{3o9Hu?{D?ZFX_lORH6Y8A& zx~Q|`5WhJ5SYAi80!8TfVtz-bPhl56{(Jy|&ZE;Sy9)D{b*|6(YWBK$zm85_cg8Ii zePmebLKX4km$b}1Ba!{Eh|7}=nbRwyg&mI$bO&~K=k4yUxHr8zzY96_cLOE;LhAWvhq<{?&POOV9zD4NMT-Ni4l3`T;KU!&-Ua_ ze{AOq?vq7^l*019bDQ$LnJ6`N`l)M>)p+Fvhzh&xi?bPfJu_UYs$)M)hl``M8~)UDYynffWuHL7M&^yrqZ!m%A22Bb&NT=rO`woH{5#BE;B zc!f`mQC9MvaLee{hrD)-!x*OIpueiYcw-vK==)FhgM4zVq2)Z1JE<_=`^<}y`0%j$ zZZU@HET+Tvbs~iY9p4*3zl^RwR_Mh5Ws1{d`*DaYO(}E@kG;sdp0ZH2|k_w~UM| znEP(t7xR5q9baLO?^>L7({ml)&O6dyacpt=Cx6`WxEgI1 zyE}f7zx!)y3|O4qu`mBfkBKunzN$x|#c9VT-SXup&AjS)yE{ySM<(TUJ#%hfv^yJ} zrzhL;4Wn4OtaBYH*Zl4LhE7J*9VwdSt-Hh=a`rzytUe~MUdN2Vc)<(q9kUD+=T~*^ zsu_66^MvfkVhm)RC6UF(!omkyrd22bec9f-(|TOX))!*30#mq+#@wxQ|E&4Zf$?A3 zTefxMZARpKAM|IB-+CBd3&((V|JG%X^<~_fz3#>j`wNfk92m;)^hAb!`vhKh)R(uv zucCKZdPg*We^d>=%QB)MeqaumUCZ2{>=sJegj}>E*Z|{okV%D*PWbv3!&L1?EZh6EVxgNuav8d?Eb(KamYf;g4p3Ds;^%*c9`pN$DV!o_S z-ict0=#~Yz+tnGxxZA;mwTAbN{78Y}&CZ*aUthTJ=mRyLdKks$5AORJ0f@}d>c-uqB`bjv1aztFhPyjL$Uz!|A>@s3z!AT!hU zALb&u^SqiU@D@83MmU_M^!sYY^d8j1S2LnV_tixTT+=Jp)%{mdVfE44`tj!AabQB6 zyO1wwE5vb^bDpPGSGp!u8j)9idtAN3%xo2v>BoNf!R{}sZdA#3AT6XaqvNx>O;o16 zH2jil*?V#iEgCk*CU%ta9RuAZojKc~9tSv7rM2JSjoVKAd!V6tbG#6a zY(>-fZ=IXMO>NCB7Je!gBl{G&hy|TytUyHuZzDf5_Z9i3wEGa-WHR{z5287!pTvwc z`lnQrWEGDcfvaL)I+|!)^GEse3f>=wJr(Veo#lMYWm1pg;x_mLwi*7p3SXk$1IL)3 zBHpcbjZHfLCZ65ou6*1je!q>o;&GRzzH({}b5}a<(&YPUIwlRL1Q+YgFhp{%Wl;1b z55xSvk9G|I9|u3rerZSgYYu*kI3@2{2me}&J(>Q5gZ?E4{YMsobBQ^IKjqM8m4m<4q2J{WeV%fJk4pMxY`XERD$mzx$NUN$`Av7o zPj`fwmftw1BZ-*5O=S~HVJMgJcwLw}7pl*iato62g^1_=t3G$?lX#v#SbY<|a0tMB(9VzqENL$W${_p@-3D5W*#8(SG2)vRQ=Q!xr!n@>$gZ0F+ zM|ux2(*6$oLBZF-ZgqnB4&Mf1Ze+qW!@H#Gv=YlX)pp`B_yhMaylb3-MhCGRbAFUq zHlw4&$oD1W`#Hh?2Y5HJoHgA;jKPSm8=m}!aQ%wlS8?4>d@cUK9fWuJ@CU9B-c_ie zdN-wOl8KKn{yG!CKn$6Uxb_oIHsil5@sHy=AoyKehXnr^SDK>$wxQ!lL7a|jp5Sa; z=Lkj?>b;bjze3^%a9t|+WnBMEFfPVpf+>$vU7Z%Ml~S11$KTQzUjWR$N=)-s2`&Qu zq~ICApBD^hd{M9u_^X0h{1*im1M@c<%A5=QuHZ6Yjsses9Kkmu-Xpjic#4H*x?tMR zZ;1~Hu0;H9OZ=AvS0kR^BVk_4f%y$v;`@Me(3go<0$(b4E%4=n*8{H;3~1aV_#WV+ zmiQM12N91~X2!~uEw~Qx8w581hXpqScMEO>{s+PBz`59ar*01emkRCxzEAL@z@N47 zJZ<55M=)57{}LPp&dM}pehzrLVDiinyc?MBm1e%r0pBC|2yml?zeVs1i2sz}J;3}< zGSkv^3GN2&7Tgc~tcB-@;O`>-n}Q2~|HZ;HEch#k=h;QdC(lQM_XA&#j->OQBlsZV z?-kq!Ovipo2Qw?&09o0@G7gjMnu5m1v8&731&WYPCdWu(37&Xo|KhLPtGg~s0^Ia4VZdzNM(FXPXOw< zPU0zhgJ82qD%Uw)Lqs71oKH zTX857X8@BYG>nt8?68GdsaqO!0bin=IfhghzFE+{I-U^POL<#s}mMQxlU z#JM?377hjKWZ7%s(1*O@<*_sAPwZGVO0~cbhBmh0EF+Ffw)(^PaIiIvwNlKrvtR8j zP?eSh&Qhs}3v-$|#g?A2Q>cmg;$&=~0bjfETLq>%!DkvX38%J|ReloYL^77iT-)=M zESC4S(x%uDvC80CzE~mg4WO0>62AJQ*{wCu*s{r%Q%h?g+`!qDbsPW)`2jX{5HhaWW3ZOz7@&MvlLZ^6&41v%r1gP%C?sLRRLs?1W; zY<5u)Q!-liMob=upq3E6KqYM&&AquHgu~XhtgI6B8A+;Owh?Ta%|gxM*e$Nx8r4;w z&u(cgng55LTl^c`0B~!Fxk{`d&he%o4nwGNyf+ZzHmw}TSF6)W`fwj}^1W(d)O=5Z zkGNcDXR#*ZcUE{$p+2PX9>nLntnwJ(x>GwXZ<|Bj2e@hRj2-1+dKZ)TFw$G)HKSlY zEll_r+zKYEesvI3jd;pq_FBKY9rAWV9`{YO)B5onCRTYzAm~0YQC<$bmiKF5u*U3M z38D{S?X*0uldSUcus+oKae1ia{Rr49F9>-**TRI4!8Zh#GXS?9^6tZx`f*C4G~mWH?EXtJ+~M^*eY)iv zIMUc&h5?wo6rS!=h+M%2C5|-uzZX6Apr{W+h{bny%XgyZs8|_@t zocVL+n+Y!BToD^4oY~il44-I+-~afd0e|bed8l&{e*Y>}ABsWz!bR~<#>jVT6yJnp zI)#O9O2_v=wj0L=jTs&s3rRE9-I(UN9n27ZJl8W}JAPwlM(cjyQatgn(Tg-=5C+wg zt3Kw+^GufCDxuGTkrD5^8Q$+@MAHCw&RyHFXW(0}tmrNsf9O!@?!JnnBO^zi&D%ZH zHt?*kx7s-JQeMY*@;iE5{JF8e?O1ghenZ^7|G#^y-TbYx+SQ-7?6aNf2#fnv+MDU` zWPE7;m}{0w|E}mbZ#Dk_$`DO2gaY%f?s#lq!Yg~r^6yPs>OwJZ$%Xo$c*pT~p5+y= zYZ}huq#Nsg{t-~-sVw3fJ~}qYLotWbz+LTHcf*H$>4=%|D&i0mO^*ys=uB6iw6UJ) zf`MV%$Y6S>YYSer-J9-hORs&o5D}+`CY*?UB3DX*Z>v81>y3lynVGm&Wf{w!L_lS6 zoQ3rM7SR)aNG(*E@w;|(5jebk?yfWgHtS7u8PD?IMsJ$C&ZI#(-BWr)h|c>7%wn@E&j>Up_1);>-NZNnt_4b;?mUU5|2nj@8dJZbPe$Mps&LE z5BH_5F4;F#AG0uUxM-9xmvP)z)e?BW8H>BlpIh`N{}GoYz=dJ`O;fIA$Kp$*+z--@ z^h+H4U)MxjNq6-FNvG5Mz>1$Y2sqZL-uvafLd)SjpgjaZ+gJ7m3O|R3H9BDSRhu$}4z3Y8r z)_np0z~L6EFl7`9ru^xGDepGHl=n%&l&A6)oq5sw$w~*=+hKfxjQQLeCT6-tf=OQ` znCa|mYV}y5?TIk+r$|5N;H~wIp{BN0W0qd(S(e1s`L-l6Kc|}d0U`Apr}?O&PTeSv zE?UBMje#1h5&6|rXRKPM=qD4^0#rm7VUMW6CspM$swo}@ zG;>qGQ;(jTusOcSYRO%dnonuA)EUWFRu}z!RZ}sw`W#&`lg+7!`J=nl{`H${n?`@8 zP8z~!-&!>_w0&$96<|pf+nf-Aw2q@JmKs;ocsR+Ti_QLG9N(cJLz7}J$HM77%XqAZ zLe&?+G1|H+2p*=f^09Afr?DRq#N|TRjR5;9f4ZSQq%m9pZ{jUa(I(&#^hKfG%9CitvQ(|Q4{>rIYBbj+7d^Zf$pts>4M z!1*QVx_{74vlsrJ-$X5$BMZ*a*PC@ys8M{qIU}Z>8UMfa7wf{viC=nN*|~6R;m8Qi zb>d5((d_+d9fs4lr$;_d@0}6t^R#h& z(S*oBCY-sxKV9j8Vsu2*hhAgp zL08|y?RqkO=fcazboV~#er92o*&eJPs|BB@`oeNNb&2$rP)&2m!qNvyaEMQ#u!%}b z=Sm!qj+-}M$IY8Bad`2hpn0VwKpUI!`bu>*DI1&Tm6RgfUOI1H$wH%j?%Xn?wl-K7 zDlOJ%PVs_LGj4A2!uckeUov;DiOQgzao37vcYb1p5pD_K#St|vCHyfA`Pd`)4on*d zayCLWK_p_?lwLYvJX)#AXeN(GtI{xrj zx1>v|kTqX_<((@WsZDh)LTs5!X)Y>rlx}I&hGfZ2t^JFauB?Uy)~sBzI2l*f(iKbB zR4=Kt(M0=EBnVeh302GQT2t*`bXQf?lGST$vSG_gd?9Mt68|SwSFF5irH!~^$tV14 zmaJLB?Zb+LGjzoKd_>%nZ0NsXpOf_c%BsykON z@s~n{(c1Q6r)*X5q`Jm9FJ9(oR*YBYohZI7SAN{hKgT~xou=gSt2U$u0{^;-<#*Y8 z5%N}iJ02MTS^=Ex6V{LR({ zJQr8~u1B7);L6{Wh`VrA=U#yM8!3NdWBjLa<(VAfR$P68n{Z|67+;5Lk>LAqogsKV zuKbOSJS%Z!-o#b7mI>zX+w_bt#kE{8OoAsXbWQ6k~$I7W-KQ$?XBt^ znB`{K7*G3^3#QFzBgV5H=vcppaaCoJLk+4d_;bP)Z^P=DPT}uEyebQL_zb8j3vdM3 zCp=BSsw{}F2UcYP4gk*(o;!e5SrESvSd|5s&s3?h0AC8M$^!grq$`)SXK__!LHyqV zS4;d~;ksP#_mQ>`nCI5YaaHXTI31YzGM?pDZ4#LItM&%WI=l~_Jj{QKVCwatU|ft( z31@Cu={yDBt4)yxHVA^JnV3wmt@C;nPCYUyRQZVh^Cz!gk&M4D|>oLKs z2Rc`#Stgc~nCY?wGau^5c;>@$5-Ys~Q?{yK#8bAaUtsD&$2RjC@>cRMG2V3;qyzx!{Q?;7Y;#X4YE4_W-XK z909&Z@Hc?(6a25hLBTw)Qzw|uA~y)G0d5xjY2a4DJfA{Go&OcsgDdfGf%61kf%c?% zih+@x;#mr;>mmpYb`}3;z`8EJ224kp$ANX)w}ExqaTv>V+7-Y$?dO1XJ^lb#*JCad zI=>!~{7fUxSK^f}emt?{IBciS2l9|z0+a0^CSSwf9Io}Z;?4UPl9Y>k#TAk~64ND=_2QG#0+=ng zHq|sW_+_HaEPp=<=A*FuREVmVqyiEQ&yP>=kx^S2lRf8{lrf3Hlkz2Go2;}KXpI+O zPY|8N3>T1`l-qHD*M3r$m1REvi0419Y!W3Wjv|8i`h`+ImNAIDSeG~eGMg1B4=Z(*YN0q}HqW=|T&r9<#mc~OLS zz-y=F9Ylmx-dTAzjPf|lYIzh!dAPkOmxn;LU|zJm-w7^fB;1e38^#%2DG$S8Odj9a zV%2Xw0=$=Kr{ygMpH;sXa5H=hOq9pt_N1}AlN|CmhkOz7+G%+c9rC)d>^cV~${Pc( zG%J1vj*C96ChUexmPg+}{*59zJ)_NUNq0P$9NS6Sq7MXvSh zameGdtv=AT)B5dk$SbzUV;Qx)?Z8(3hLA3q{T`My<+##STjbF`TArGdAguc(-&>W; zexHyu<+#$_XOV}l7n8?#L|FBEJB5DZz(*a*;py5f^3YXc^4>#wtGsh5^y9lPtnzkS z@#wn)6%An`Ds}bjUl4O5=P>J1x)ekT)0dZUz(OO@=2Q z+x@UZ-g}UTAtvUuydOK{HA5c9XUdxjujO%!1FM>M<6`8Yvjqvnkw#xF^`YZi*(oiK zJap^9XFY?=`wSiPrPF+$1D~!l##3H1h@|U&&ar@ZN4$7oR?V!YjrY&?jrz>%{5d!W z=%X9`407`s=4`GrxFUHarkxqjv$2z|^j>AY<$C$O!{+-m-5>JF%-%^}5Q~phoMI^9 zNmrHjDo>Vo$OTSt)ZTEpdN1caw+zSMGyCwblfAN*xpz38?KCyA{O!S6)-U56@P53X zbr^31-h%g!?hirsDn71zD(h^9u{58rQ$M}GmO1j-+EZCdb-cGWJIC9P*IKLROx?%R zPVueSkK}q^OqZA8w#CYt1qyD&SnuQXES^#&r}_TU{hx4;gr3|SMa(4U)Uoj(GN zsMtcAEBH@!9Bfh}SlI>wHcNP|T(6Mp`@Gq~y(U*YJNse!9q#V*-kcoIm0QQ9d&;WN z)M6V0a-tPXkuP?nTH)m^) z`^a|(1`T82cX@rezy9|4L#qy1b%ty_bS($pe^Xd{b^1+TfRL`q<9c(lj^$*Y$Voq) zlkt$TTuP$y;H-J$E^;I+m80n(uafNy!WTW`i5a?XUz5gr5fR&ULlV_5ReTTN|z1RF;J|Aa@7%_7^Cdoqj406{Xme5lRDj+eb!9 z3-i^}>L=1CMACi?!p^UZJ#;>@|6g}~v-jnRV1VJ(L+|%*?K@w4jQRwCL5} z@2;4c{&-f^HO81-p365D=I@+ydvyN$!6NUuuKc}!lC!I8e9zuLai832ObX171g`1K zj}*?9o_PAHQ^R;Qdx7C;|8?07o@gWxr<8+Ib*YR~PxD(6hcobUd#JJF^^te~?)~2c zqia7K?OglWoinrAmu~&*3E{wOss7VXt%5Bydm(GObGZ5Q1D!!n=Ei_;W8m72foqPv zGP!rKeY<)eL1eJ~{%BWr`u)B5{KxKn#a-3u<7;bo{4`RSf4Zn3vj4lgwwDeWk^TL< zwjUefKKkLbh38MDzr%qwQaB5*wMT(&E5tjrpV|aP1Jw0+7G8Xxh9(WmMlV+^r=MyX z#v@^a?Z0{5q=Om_b}v4ah7W4=xXOli{nzQIwy2UG&w9jj%5Bnb+toRAW#8QX%AcsL zN&_>CKRfU&j5Q;&|Giz?BhV}`y(@4-Per6~I^JzwIHR*LQaF=_hF+2V-MgOIJ~Gn( z`kC{p@8UBhZh3M3Q=f%CpdHRoud)Z)+2zjs=E#o6MxvI7&32n?*>9#~Gu!MlLFA8? zco|0FiRY%?;NEe!vF&xwO&BjuKlNipJC$WtdUSqw5Z@%|48C1;da79^lPpz&GPqB1 zaEMjMveQrf=dgL3&cIF6-O0~BoG6^td$Jtj4-Fr8pUpBJ&&6vJ9?9OJ+u2h+nW2%Q z!J%N^aR2L|Ka#ud*LaadJ1o;TjPwk%{w3i3ts4!#e?A+M>LD=B^?ThX=Z&a)!|A7S zTNnGXsc@nY4TcNzyBDYm?|yyPZ#>Ih8Xg=OdFANor`5Z}Ga6N`FEAU-)7K1-j7%DA zKb(QDLmWjVsRr}wim#I9$N_x)h|>%Pzb z#9QQ=6u4%ZeA?jY+n{e|$w=?X$%lrS0opLKh_1Z>9W5I4y*===V7$#;V>Yg*Z`caf z{^3*ZH?uxe#mx0?)B+!aPOz6Wu!-lk4fh2jXjuEkMu(q`j){gL{d{fFW#eBwnXdc# z=Q7hrpntS%*Us_%5ZxJo4#m6jI=46P%6lYxe6;fkw9W%Y&z9ZYEt7sUasXQoM|U2( zsr!lD(Sgnbc)!W(b;D(W!|whA7zz&!-mqi9XY}IzBw0~@UL!i#u`93p^?ltvuaBP; z4el)chm)8kAW`4z?N4Z)?fd)kp!XrZ2)}t>UNqP56XY zIp5LQ59KohldLOG>(k`)ty5IF7 z+O7Go4{Z8!TOiZ^RmY3*-3PWl5R9}1muP|JVeKy*w)XvQ0L}B%)<=~w)9ei5)K)Ky zX!qyYI(POymmFA$cYWkFecWRoyXWZ0vU#qGh2@u9TV_k^-?gjdA9JTgkXn_$vdx~#c=X-YBmNC|j)}EBJ|GM1TS1-PIkB+`a``Cj#I3=yl zx3yV~6Pxv+8~Ln{6TN9^!DnY7$M$YNYHe+Xp?K}idsg46ep~1E?gKuN^rH9YTemuy zr_ktSamtCqHMRSaATDd_H;q&s+4ZASSXx|dnDZx;e@oo}?dc!y8_~KQs}0X6m&f7q zjO=0=3akD-sn3}o`|!5N6F%=@A0Igo}R$GT7&_Hy#UMFuApNvKBos2?YH zJ&(B099xOGMf7p&m(6+!o(Syh+>W;y*=?`-@Y)?{pWM|CMP2J$WaWv9V`%B#v^2T+ z5^TnJbKfW)Na|@ zvh8e--VAqfB7iq;sT#dAuzgFrwPgWDHGCWPu(f4^QS;6!Ep!fPY~FgC-#r<^XzKt9 ztMjwN%nww8;Pd?>Dh~AgqNn>aRe0`GXRR!Wk-qI-k4o!El*#;KD3jd_jX*!L_K)x$ zTL!IAK7960w2=?**(JV4#&>kU8)@-JYQe~eu1ITdWYo#X$oC>+&O}CM9VmMCn=|>^ zuz$SwJ?*_`zdm`5cJkSCy;p0!&wkalRO@>7-@&W2;In7_S8D!ezw|Ca3&tcFQ)O@e z+18bqb+23QjQw4}Dcw2Bd1TWA3mA(%w$44l|9*V^|s z-c+W>>%b*#-6JLKKka*1CQiG5*q1r*KeS-`{2bV|yG_}JxnGQ4hesgmuR6KAUBu_C z%4EH{!^7UsU~VK!F%hHQ+KL|4;y*hYtqVi#{WEiW*H0W?%X#g6_a6{X^zwm%Q@+Tp zzv#cD=-A4m(JBwSFY!el@wKY$8CLe_j?khKfW4*e5-+~6d|&j ze?MPs)AWmkZTp2AE<$vFSNJ9lUsT;E$Hj4O<=Wd4BPfV)E$)_Yn|#4rhIjnsT?g$0^# zk7GlEH$BClJ{q$I&%nUVzB%2)^=@d-J<#sU#@m(DI|)ahNuTKWd!jde{J*lSEtg4G zvnSZHOgoc4es1$zi)xc6^bL!cCF>Cfl;>nw`_h?h?H>MHZlAPV?a#I6@N@?MrSV@v z)50FStjL4<2$2&1waO*9?|V9LyTD z@I42OpqMe;qZ~fY&KO6ZaY4l)K|f;%*|{|d=fh6ZxgEe z>>HJOxGk`VC1^|2w6f%bzVxyzzRgix#`<~1g{rWbbgY-swI$6192WzjKIvfWCtR_jmnm$$D4$_`b~pX)H$d&zNzCT(wUgA9Oz%uy$q4ICNw|S4Jl0 z*@wos{JRo&_|EM7`pha#k89@$#I>JGrGOPLeuJM)|K9WHh5n2gr?CtARdI_&+jM5^ z=`$HK&Qv_9Pe^wmU^4zHVnIVrcZw@pww66 zg7iI0O<}GU_LyXhYLlGbV#v|&d>{Nh;~ael_MlZtPpCcS^^#bh*Ksz^>zeC0J4|oM zXu8sp@tB<6l5++I{I0B^Yi5`0(pFEarQ^cKN(0 z^*iE3fen@2(+8utyNZ}@%euMN*W)dkdq+fJ#aBM7-xh0+u_te7x7;1$cV%w#J?35gAKZ?*u+yNHeSgP5`!UK6Z1nge zY+RL1FS0%phzQ1N-Jc!WG4bVgulrD2U?es`miOnpG2^2&6}?1vQw%y6=&w43jgXf3 zbuqUkTPjZB;sMxlb=>{$kM>5`0-v=7+>Vuz{Uf>~g09&}CoTp?_=~b|(OWb}wcSHI z_5~{r<)>mKMLce$PW=w-y`Pxvf!juK}DwH?MdRfyKe%Ea8lIUf=90f66 z*X$Jqwrr8dW{VunZFX+KursdN_I|G?UgqN`)L^BG4IxA2<<9Q)YVP>*X0Iu6e)pj( z_abqD5gR<+5j!4eo975z;%L{T@Q{Oedu_!*6ru|2DErf^;|gDkL@uBt3$OiPFwIIB zNK8GlXK!L4!Cx@E%l)Kb0Rx%~(U5ejRNEt?qx7-VWb--ha88SqhVXl%-;qlDJ2_YF zEzytKmT|Z(IbU_7CscoAMC*0&axmj?uqe@6dD!ck7tDCNE8|F4(Y!9#{9w`iuF9vq zl}Akd1J*v>9!%AI_e{h>_E?$v7*KRF;YNjC_wskvh zHD+0N4h&p3@1kW__T2wIM<3_B4Y2L*zG1zWViG73mIn zepa1eUQHW#ykL^QVz6nRNIO3h`RB%U-K+Y4!7%+KSzMlt6CN+FRoo_oJKJKJJL3*( zQF@lC-Oo@d!Hb#~tIcz~tULlQ=Wa`m@~eA)e%$+O@9B)`ii@=;?T=lYV%cw7jz^Nz z+f{qhXLc>+y+Pca<79fNHJCoHD}8=%`i!onk-??f<8L&cTpIKEt6!X48qK${E{)>c zeQ5;e?n|x8i)Gm__&U<2g9#l^JE7B?J_}*OZ&!MvV}5)v{nEYLd($&JUg<#{`{OGw z?(9v^dhu9q`s|L!diEX&rqAe&(@w@&n%+t1Iqp0eXVu22@>B7szSCPiCzyUo zuVt3^SaMgt+_kDWR#cv~tcCBX^{3Cmk{BzLrmaq{ik4Ws=`;Q5m!cSMzCI9x+mmIZ zXSmYm8fKt+YMNd>)91xFC-?lJ4vz_>VVARR;JPmEis6T`7{VN^bO4x%_-(i|Z)x?k zFR#q0OvA0w1Rn--`+QHRU(??qdnSG6^`7goRAmBX{-vg6-t@UQV17Lp!O@+GvNFu+ z?fAPruIpE$F#_Ce?~m!V$G#JZ+fF#8IKv%bDWeJgGx`If56jPz?|?Yq!&@6 zE5#d#D-PCGJmq&k;jifS2b*^I>I&3cj&l~qZB={NURPRbWm~}Rb&bP~sMIBG0gIhu z6vkDfk3t-(UyR4d#Qao~o)`}aK}2gQx0Nmahe>&eO#$nfj7-i*=N!YjV`s)GeXq)h zJl@o!izyg>#FS)VLpo8}*JM*oC~hIv++EW zob&geG3Q;9z;_GJUV*J-^njC&p<=1JlEWSlqa#rS-TEbQSl-G^JIvmJ-6NRdCIYv;f~ z$6obj=z>T**T5gC=g-qe@g2VIt`tlLyLgu&7WbXuO-vZn5 zQsxBJ(jB=MnA&IGG|Y58dO@-j)iUY~W68opAA=p2T*DG#OzN=ZXt_~*LZ}a`(=7WK zoa~KuTp6hwh~m?;snr29y!kfVb(@VG@@72cSQYh<%{RBuH&8h@dW3oHk$Ryjg_dYm z1CxD9iV*j6?q!mv>1|VA%#J->RQc49z6;gmymNF+toP_2uHr0E-MheT0{t!XxQ152 zzGIhlOH!0q4c+*?MEmHrpINgDdSF7+W)3dchikgmc-eWbMGx~?nIkZKDgq z9(MT9BT*P+%Cd&4seVE1X`f-NWQ;y4n)6?k^O)KA&zaJw;Ak40YS2w)jD20dmF z^-q7X1-|Zuiq6_$VMVt^qne;bdRc3oU9NPy%|7u;p zY&y$_E%p4-(~unJca8DJVo|Ts;By9JRT^TAG{j08{IM};cD+c$1@=5|nrrzquBX4}-B)@(9lqy5oIHNGXTiVD4L@{f-kt{+IQ|}i zwC=y)h2&TE4|nYQ8p#~!}C!Ur_kfSN73ba<=y3&S3w$_F;!6TaFJq>2hN&(Ocxkg>82> zYh$vpMS?4L$NF6vO|4GU0KIlim+w@vj@1kQgAX6`kab^Tf_}>Xe$jbY+;)?HUVl=~ zUl;dJ;&Lw32j=^Sc)TJmxmdz46Zd9ujWy{;IjygBYFG?&oeh69pq}!zfD|+l*fFdT%gloV$Lhe<-E=$_Zp06OYSrnJ;PH5GcwcB zEAroodoA2cg)`ue5iS$EMi}Xm=PR=%->wn)m2y6Nr+I&BJ-R;bK6+hK?a_`6yjc_) zw5#h+t^7mT(E>~Okyrvg>dW&2^*SM`mpof0<3|1a4m)A3jleCac zxTe-TeO9gTu$EioLLY_yxkZzq>_}GoH0;N3ii75Lo!00HTwiS&xfQ2dMs9BDu(Dr@ z<+S+((mdYpn#h~yztv{C;vEYw*>CMi8`+zdbTTdRy|e@*-$zyen49Lvf5pO4uh>5F>L{df zSs>o=qSd}+n=jrTi=7_iAs*0%;r{VYs3O_%xgLzZzM$DJm!;&D<@Is^*06O zDr}|Gq$3K#T zdWBnwX_#T3-Ojn##%;f1ZjHg5`t+`xBl~u|gx7w(aCqKz4r|K`7Fc60gPZIoyUuP$ zf{_L+;+cx$Q4COvPC{$E+N=jHyMubs>dOzSn)i+@oUFCjtV= ztrlH2-$;F(Wvscl{_;j?Ykf}dBF#Vkkt^H%#gDK8Bv_1E{l=+}_|Ry66w2U zR6`X=`UBOXW_ApqQQ;;cc4Qruu|*mC9c8g-U_msnBUY?_b2EOmBIB3ge!YnWTkg%) zrGs@T=t}XrMq`U-yQb~%p@#HzbGL&xk&r&sx>gkNPOIJ*U{l6ir^zXlk4qAF$vcq$4W2EcqnlP|hDkOVPetoZ1Rx#b5HgmJ;Z&Nn4}iE#8Uy3p*EjCqA+rBh22O zGifRRnrF>Ft@%CZO4Hdy-9{4~%#UcRr7JC^EIFkM-HL1cmZx(=iy0{c+&D#Egrz0= zl>z3}cyvag1;@ZZiwh4?L3$=_j5jTXb&?${TAzw9M+F$E;TtoKTP)rwNkx_tZu`Rc z3@x=_i-TpX5?+=ZqjE~mCx6=5Epyj~qLIF8IbP$G=1}+T%0^$0B)5&U_U#=AB-;Oo zhw%CeEcPRG^DSQYrH*bbup*_seFYw@iT<8$W5{x4TlD9MIfxlN7SIUx&<@@uJZ@`A z)BAX9{?7)YXIXktL{c+QvS09tB=fq_YLqNOKruzXF%Yo&V;wiy3M;=b-D6N)@p3#A z^XdSaR%eoZDasc~y*m>A9P<)PYagW=y-Bk_<9DUJ^kQ#O>Y*`~O}?$I-l8#H%Z9CY zd5gwQ@p+3bLQO!Yh4I0gmg-L%LxpkPw6PdFP|vpoxUU>^jm0xh`d3%D7{Aiea^*Ls zxcXcJ2xW`I5ngV%&%|C+4>_1NHt2Ehwa8OXdbNg`?AE@9f5gSF{#f&8X(%@)=x_$> z#1tu5YhTNN{q~2j`!{BX4~x!}eZc}P^GLkUy5|9F^Z|{ls4;u6B^Y=5NW!qaZS#Mh zvZLiOt+kmQ|CJr+OWhaj%~4|$SII%Fl4VsrtfSJI)f^bnzT9uKVYThG;j0Xz@G~?% ze1(Vm+1pk*SzJ>03)UZvM0sHxUVek`U|7s0gS<2aO8OKb`Y`&f@RXvq0^yBlE{tB(T ztMr$4?nA?_VCjCx&6Zxs(#Aj+67(1Tv=rPvE`3CA0dwsshsH!6k7Y;p%t=(c<5KNf zckB-qjq#(=7NvDrHXM1T3zhHbuA*^WMHh9YjqNIOb;Vima3*paE62jEm^;|Yl2`b6 zW6yn6YQ>iJeDpB(kK3{?M;Gk14KGW+)Sluo(y0bu8LME|O>y=qL(-%gSK;>`<6XbO zKG=StN-`6I9>?g72K%>`+s}m!kES}%_lI+-8{3kdzFhyVh_*oT8CRO#qzC=8oqq6* z*EJ<2;4hluPaC-=9*+}X$hMvKCE$A^ zE&Xh5Mt`Aq0;os7HMhY~*Wl6$Cq`5p^Bus**LUeTea{>n$Mk7v;Y2NZI(JHp zFryP$Lk+u(uWX=+wtS>NHE7g*7>snaaBxfIUW5t|5>r@8sOJ#SJd;|b##EI&Pr4`gwKHOiB+mQc$TtTztJIoC|bh5HQI zmVtpDgMAnqh3^)3mvIg2w;cv!{dK>vhA>YVj0n{pp*LOKDoJ1t=r?#AiP%D;`1-cw z%hcStk6Z4pN#m@2nb_1Ghr3$jS^BOYiYylIAy!J(<8 zsl9z{vUilUC4aBb_TQlb73*O)?v&{_b+0hh$!5t@b^SZ#roNC#)iw;?){y(1 zG$rib!;lzQhq#|MW$Im&v)Sl3#^o7CUXL{WWMPzvhnqNF81-X4zT9Pv^;sR=Ha@P@ zug|R!@Evi{7ip$vtCq8!s%NW=?V?5uvO)BN>_PSY5{H%aeH5&>}!ZPfcZi=7w%ru?PF|pP{ z3_+OPIVvvXheO$TlwHhLb{!s5aTL{b`?aq3L;$v5v~HOtH9zyZgUGcFbeb3QRP@k+`s|&k9Z(;-`-&P zxM2B35blqn@CYSigXO8^$(Bt&xuMltJ_flzB;K*7Wv>?-sJz>8BmKRF#m^Bu!omUD zJ|E)a!_*-E(o4NXV=>6LA-Fq_Y{lFXg$Ms$S0*R0xaA*@XW{0*;dhO;&$B;me;ZZs zP7H@LA-J=B(^mU@`|5XWCyQqIi&EZt<7Cn7lSP+4jaez5UwcW-M2jvu0vFTK)P0<~ zvTmsGosI&{<#M3|k~>Ve2W0x;h&bUSasMTC;S+IH7*orVhnv|j%K!PipA;*lg->qg8tUzT)`?l!M(J-X%$}zv(k`2o^?$h@cZ~2z%d?x%!Lyq=FFR#n_QA3Vr zzk3ZvTK*_$``DDmIJur==oxXt{aj=RME~dF-YfDu#k~V=k+6D}9L>Y=0`Ac1JB3F3 z^r+Sqx}TQL5*aco7xYhhg!hrae1ZOLlRsE5J}erH#@ z({T&#EW4T}6gyU`d%h9JS;7$E0eo+{3mO$3misXMW=^`x;Y;zRJ16_{*O}J^eFw2+ z*V>H8Ti4sIsT*3Cr&i#rKD#1Y(V+(xY^vS z9*w>!uJA9T&|~2SSK;-R!1A_0y!l!wuLW}20&{(f18HpmYfFU|NWhL`^m_CpSOPir z#&Ak7K?~wOW*qMBS+SZmjk$dnYk~B#xg#)n$e4NmVXbpc%8|o!+9q40%QeJ?NemVq z>EpcRPT#1&j5c>H?)r+2?5S*=RZQXRB8%&HBe!AoeWRi$N~DD^MPgCi-HZi={Yv&V zFLk9)-t)kmpe^3<*T`UcPT>u>^Ek{gIkNCeF8%n_1NTuP>{+d$qP{7vd}LnXNJk64 z1Z_-qSqs!d{i@TPlsq9nOEa}wxoA)6?cnzbRmK*+G@Qkp@=^XzxOY)L6)6i1T2jk~ zw7+PzGslgWQqFo+KY>mH;Ze3WBs*o?Pv^c4XUmu;1{Q^aW}Yci)6@Vl{}`&a%-dH zTSi~bV#E#Ef=hkPNcWI@f&r=ht)mcsi+Y;UXm`!b5t;uF?UUpwcw>BL)AyVD2A-q; z!;|j#jS(Bx@_cBoJ2CZ{7pAP~c1@apLsx9P{%w)*F0Rb}O0PR_?a`VoYk7Eo`GSmG0efa*I$~#2*(m4(Tti zHp_5rW!U+ou=Ck+K1$r-;@&8(S}TMK8NW!Q+C~)1$k7&$ZmfWJB~;BDIwc8vR*zq$ zz*Ay_s>V}ds*dD;9-5_3i`#TIy>rsyuKB9YWAU7kkTG;UfTv$!0Os(Ri4M-;RoH5l z7M+Y|WAXT$qmw&{$~HWSa**FJG|D~SuHoyj<#Sx+S&m+`Vm!K}e|Hen zvD;}6OMd8NS+{3!vK*tEq_;WlWDZW2#Sqk2N6;GVU5VK}*2ernh#=fx?<`#q?9Ik$ z*Uq)fHAbkd3Rjl?U?yo z%4L}*2i+M&nP>s2^&`;J7>BUDfbRhaqh6Lz?yS#t?yx- zQ@{8@GdS2?zZ~07Y1ppz_RRIn>At!$$3ENcZk>Va`goauJ|VY*I}Dr7wpuX$&FD{i zBjMACbJ4yW_|HCwF%fm%x7_P~1c3xRZQUuu%F3c&bK~(MbGdVQgK4X&KB4bq5XKx1 zX~u1qC*tis$6MCNJ9{#p%~^aTW82f2^X9$Oi-$(-7x52x-TY zJ&WhzOBY8Yu}AJ$Iq*_fFMeTVeD#$!E?Yad^Ykmub1{yx zZ+frN?86ox>Brao9A8@SdkjZ@w(Vy*JN)==f<2XY_ut<6>ONR>+rbB#K6w>9%;IR}3{a?_b$$G}nB@z|5Yv^@`9lJfMhR|=)k4Kg31#n^w?SJ6x|FO)>{9k@GTfZxMGu!l;vT`f9>=7#rmLpGF**uYMwY zO5FFweM8(r@q;-eHsLVIelyzZb~rXfWA)NHBNrQut}9wS8S8!PXS%a}>+9U(?YSPK zPeHxvTz`}+a@L}`+vn!YwPdY75xQ3s!E0wdt;><~3;J)%$}rt8#!nkWX?Q|1)Okw3 zBX#QfG;d^tKax)~HdQ*k*k0_#_Eq8xy=osmRgB%qb)EUPhS@Xtc68ZSLFPn z-pk4l-Qj)V+1Bkt?w{bU(X< zWxn_`ky`8ajOL64AHvepg#^d+d!U`QJ`GJ?HBZ$yvQZ)mRmn28XIRcWw?MypqwiZp ztXhr)?~j?h`HXGBSNCs7Ydeza+}h*qKi^JtmiZqIOpE+-`x1Ffc8h+apAdW zw%CZEdlU)^H{N0@JnuvoOIanx zeqoL-#S$HlERB?W#9qL0j$+71wJ)G{6B6Y%kIdPSL6K;MzMab|dc1w_dl#j6`#$t8 zO7caKby-+lfro>srHe!8JkRasQ$soOX`^m~PP z;WK_WxpG};owK3FIkCjKu3pnmOE=V3)|HlMmtF2O|FU#(MQQOZYwAjiYwAig-EkH* zmX(#(sUJbC_0-ju%H=f`rJfSV&E88&i|aPlHmrdcZNX*V9Wr7qtyZcG9j`ZbHq?2l z>&t5D);aOB$hTIOl$Ow9QBvU*c}kpO5q?FwvAChJuJpT=OA%J7;eVd9rm>;6vB6pE z*;rNMDbZG_1Um5>*$t)D4bF+THzKwgXO*X}ymYE_oo7Sky2f=BYYUg;X}Kx`2IE4| zM#wNzY{Jhg>;7@6rm?(2!^>k3B^1_qibI*Su4GLG&ev?%ut8f==xnUVb$2DKsH^r= zWekc`cC4#xfd355Q&LjdP+0>FXNjl5qx+%}Ig4`gw4$)2;)g1$N~@ih(fp~-%Ie~( z#*#|B>n77#v=Kj%?yM<8HXy|6@{m=+B0*>{+$>W@}mQPWse;;b&k zPmE&=ptiQOT5GIlf{hy1P=V}VAzYoaFdfBF+TfYSeAEgca29*2iW{pu%wK1jr?Lud z0yWq0%i4*`D)m}b*8i~{nj3)>hMQ^3a4vA7*;Q2*S2nDvymbvri5D`Qnn{gX$Y|3= zsVCaXoW-i>zqQzmNLg%Qp`kjvot3vDL=_wBcky8GQ=BtkncF!<+2%xK8QMC$Bgs=< z>QuP~lkvhMqaMo@1mP^HL2Y8SU*~Bkt_WEbs^3G*m^e{4K~kJ{nKLuwqqspe3g){x zqml1rr3e{y7!66wMf-15W}ya~J013MMU^#fp{v4gx-b-QQ@2(PM<{VqD?X_xEQ+{VQW)f+=ggN-G4S^O=fP6kMcIf-}! zRcUp}w}{XQS5?&@LX~b!4<1QG=U9y*n^+<(s|cN6O?A~q)v#_WMb?NHeF!M4YOJr2 zPLjniYIb@_w8CkZ5&i`bC-nf+|P;Uqyha|x;(=%w^ml?DPIS>Sd#{e#>ffx#75`k&WVi~regb+(eSpq$_8V!3?B}|jYgW3`uVXL zgH>pNn&+&qyuDQK-pxZ*9^Q$4zW2d_?YsOn)}on|u2DmOed9Vc(2IGhJ1tR?@WgzV zwV{OQqk-~kj4A9*QE@mD>sRNYVU+WI8yv1MS{d(SyUcmx#Kw6O8*f5qWg5H*mVdtK~JS?Mp9JT+_&*)p?s5B5tem)GBkz(P7k;uJfSKtIOBOoL~)_Ji80_ z1=_U@l~q-+NLr8QRtyZDqN-AKMb6^Jx;jQ2Qa0C6)o|A6X=IV>xg=R}enn!LVgRd? zuH`%hl|SsOWi&TsRYiSBjv9X}>U)W)@TE2);?l}nQLoDy)pY5+2sj(4XXjB}T(Y`!xs11!cp4h(k%^e-Vail`Yh_JiJ$hjk zsRYAnVm87k%!LcDHF9LC6J>1-OnOldxhnHmXk^aZFqqK`VMuxDLN&R&7K1o*z8+KS z!FmGAq=HDHVA_uwaGu9$uy9=|YlpU^yqY8Hc`9fb%=Z}=UxI1%x?1FRQ6*lvvJnGu zNolBtda6q6Fk#RO+LWwv6bnY_u*=Ngc}7>DRn|K_n4&dc8azbL=|&%cp)Nz$D6XnO zW}}=d%MiI9lYRxu47A)*#8s(R1{KU;el?=pWv-J`%Xym8%HvcKy_y;*hD5BHL{*r7 zR$YdsBQXM5uqF+|lu!p*tcu5}PrjY?h~ zHKTHKE_=SZkp>Kvm6(6A&8lAZHq$DN<~q3ssjMzi&63@rrW&LgTg`ng^5Huz<5E>$ zbYkMpMaevr5m%p1%xo}w@f6>pqQR=L7-b0s)k?#>sL7u0uigoxVe|R@^tVK%{DrdE zNcVX`=plbw#26rrdZJG@#dy@!qEcp@*p0sCTcSrLRkQGijogLcS zgzQ%OJVW19Q6K7_YHR8-u{P$F+F&qT>V&3$Q?aONP}BH|8n$fC7@fscm7J7SvaK@} z)iu@A^p;0r3*+KjZ$7L;=VgOY*`;q|%2a(0)!>i>aSgWDAq{|S2d{BLhhZcsRjcLSJSV$w z&f!9RDCVXNM6KS8AY@)*mi=GM0W&vD+z>tmWOvLt+K|)_%`XmznA{n0B4a%zu(tsv zT{4)*7i*F%HKXycEh0}<=QVFI5lj*E^jQ?DjJ6Q(Rl^usXN1l^5c68>kg;#7E3K{a zY(zAA*hbCarV}@@pjBEDs?8k3)qJEBGd$P}146x))TAZVeA_UapyAtT8u_(+eOhN! zMfQB(Hl3S@-bf<9SSxF+s@kZbL*^n0bPX59p>D$H10i7-2Ez=W&S_4yca|$5eTyIL zWEEFkjGmj-Gvm8LM)hW@k#A~68nQ&iq;g1&oMK>N)g?8zu`y0#HP(~OlK9^Qqwgiqv&kbWqF7=S7-!$ImXiUq zbVG3|`w~_KOrx+LHH{kr&Z`z_Ed3@(3kT1GFmqpTZPVP)10c)E{*&DJzfts zE7#Sk1=%|8W7OAru%^IZQdU>0hC;*2uuQ;@bgU@#)YoHriJ38SM6Er(Er--DnyTYP zl@04WwHg1fVF^=fHAgYR<{c6t^ zb;VeG7`scxLT*TCMp`GvTATMwk%X(UaaM-3417K#m@6JjUJ!tnDct$A#t)c4EAp3 zIz#dQ$6cI}(JBFY+@bzDlo=Xk!}XQi!qJOgc~ZrXHi{h$cDQOkm^%Y#eW+PAw^TwK zV=?z#e;SQO}w_1*4ojauB>C2N6zC9JuRbYo!4^FKZ)fmEU+d|A4$~LZ$ zy<3S8D+d)MrybaiR%5?f-(zE6Ni^L8U40(r4ZM-S-HZoQ zx0({?LN(_vpkbO52WNX+(5f6I7=0NwcDPZlqEwk-n1Xqc*rIkvHJme}WCx15Z0ytx zO@i)!h*!ys|BY{zTSI4=szi;rSaprNBdGI(iyBi~=UqM{r??xbcZJ5y2)Eo~!xjU! zSV|-=**6@j`)yNZ=qnqYx0lw{Op~79==1e04g@-w)SAXR_G?&{;6569aE_{>oeb2& zP)*LOxz>qM7qt^nVCZ1QGQ$0qtxt9_#%0|KBh7}gKFL7mjq)ksLVR%H88VNn%4z3! z=GTQi0>lE(T%ASa^AFLVGUB9b~8|X-g>L#!`s&652 z!ewm04{8tIC1ESTEo5~ps>k*p@}~^_4|e53>!+ES7tgqOhSOcq&`?`HZ~F9dOyL`g zE=Fncj=%0@dR5h}>!x8Rfop+_q2c6%0lLpMGc#vinwd3oZiXJukpEfo96p7S_!^`6 zVuTi9KE)Z|!Z>(DX!r@3X#IQ+UXo~4Z$va-H$7Aaam0DoM`%}y%7qsCA3Nw->Eor5 zrXxb*n>+`Pi1YNvsrOD&qY59ZHgQlH6rqg|I}g8}9(H|7*m-8y`7G_%QM%|BI96?* z_Gg=Z{sVP>xqc%5@w`sh`Mj`mzDaZNh|t3QXAfQkMQC|p=LOpR^6Z`)SFGA&+WROM z9*gm@s$5a0>R*I<Vz{PpEsk@~p{@mjTG+E?>OWcD*C) ze0SLSzOZxV(%=!H{c`XG6rmjmJ3kn9-W_&+B<%c|u=DWz{!Q5RV`1mdhMhmBJtF1D z3#{trr2S0;Cu&hzp7cjk)p@LTt>iCGmHtYp561a?x!wqWiP}i*mN5N?qXTkL@b|Mr)hH@^3LHYfaxxR`~@vkLOhSzOOBk{7Z%`QM+CnEAh`#=c~0V=n2R3D!ps9Z=`OyHjhI^lw(@_h=V~ zmFMrm>T|Bde^8a@{hA}JJ$)wSf#6j8I3)FPva;`CjL`Z~4ku9yYOzwjlrk%x4m)2i z=a(q`Uugd!?R%m+@6`Bi1RnI8sO{BChLqp0@BqEKtlkfvs6C-gl5<`EDeY@HH^QK6 zVP(g`q9${!Vln{1b!eJj^ z4u?g+xVFP(x-8$rKOC&n7Re8`N9sHR*GXQ6e>f)KV_B|HbCaQS2<}w!3SFKl^54N_ zbxNXdCFp=#9rHyRYWGCDb;Uu`sJIZNSy)Yb& zGX%Z?q=aExc3MzfV)e00^BZPIGCyE;V=)L7IwnrVU(lFbL5X7Z9wJuQvEvZ zv#^rjV7SzO9XcvMr7Vm*{2S!7i8||1Ve*830cLQP@8cg121lLeAYUy!30xw)7vWS1 zUk+{%{wLZW+eVVKTiQUbg*!!ia1z{3 z;bge|!YtD_h2dy#3$KOyXJMx4Jz+cCzY4R?6j}z;a=ow<^3}o1q3;yF z63l$G&=U^kBXvBGPbHh{Ff#`S(_>*J!ol=dZcwPvKBM1Y8W_%RU?kIE^f}B&%C|z! zyd$@PnRgZr{5Tj5<+~wg8IWHEuO(9vM+rU_Uc^y>4|URDa~1g}O7(hg;oyg(0Urx1 zIF1eYSk{v8J_&p*9)(&H8R2|}xHglEbh%IDOCY~X_%+0}O?WiQ=U(At=mdnF;0MXY z_=lqdABLX+`D4NsbgGXF{~KXGDZB?92R7bQ7B391`dDMr``cM29geTmXBfG{sc;dc zlH1`ji>br#ZV^s``x{|6+VjFpw`#x8=b_pxn0fFaK89_d3Ma#Luq}vwsxZ@+E}RX{ z6J876AUpxQO&F-%FT4%hE<6?dr0~7q*M*tiQ&0wsm-&6UFi^`A?f@?qE&wkV-VMH0 zxD))4iGM8&v6?e7e3siEP4ahzosbVhnNf#n;hLE222T{G{d0vg!QT@GYPSfpJU0ku zf$tVx0REY9Huzy-ptf5$56pVQcniQUnsiPGFNORs!pp$l2(JVWi`4xBwFKc+;0eOC z;ZhS{W71zKyc#-dgx7-E&S_5x_z_{C_H*G1aHlYB{=G@(FTz!j;|G>iIJMxl!VO@b z@CNWv;R)bRgg1c)gn?QV#xdH{1hxq?-gM#3;CaH#la<0uI}f&B9xzSu-{2y+(EQL& zmcBP$be6K7lBF+olGoxN4%%w;X>KyYzYqGXD@LEpx?*8L;FyKa|J3(pQwQO^jd1eF zENC1|C*{9`ob`arw#Cb2jth*2{3_}-%hKp$*NU8dY>6<(jtXIp7c3|GT@S7m{yD;7 zIZ@8>ljTH?fShGRX8+kF%)QLbWJZF+hYxk?Aiql(U*-+;l7P1}ge+a`-X`wtG zyhY@UlWTj*li@xfd@tOe3&YVK6=wRL5PlHuE5fO8KNEJsbt26Sa{_pVFi@K#>;_*Y zOuuTr1brv?fJy(DiT`fm5y*FjKNb4pg)_lRglB;Zg|omF!VAE)!a%*hML5~u|1iln z3$s4HF3h+-G3lHUZh)No7PMyrI7@gF_-f%M@O{FY!JWcD?U%x=Uk8Nqz<)LAL`CZ1 zQ(yIsi0dx!6q9_0@KVU<3NvrBO*;9)Y!gi;d5iEW$R8434Sw9Db5M9KhqW+JBoEsQLuDyvF_^9yZ#@EC?J)_)vZq zhf;R$ee3A^EbEj$&jnnQ{`+*6|8Cdj7=F9k0U25Py& zcY&`I_JMCO>8usbhP+-l54^>sbGI<<>@dlHAzT3YFNGI?pEBt@Elk^95N7_oX43hi z@G{8XH_87h%zE^>@M^G)eIU}#yj6WNm~}+0B_)5B4ZZ!>!91 zhH4AY;jtDU>N5-;MqDaav7K0MR;r;j_y{yo)lLyVk2rjiz>JI8O=fuX zOJ;aXGnukU!n8d@nDvTBxIG)f?4cj(1R!UaS=~Dd?m^NnOL%&Ry>Z8E4cb>?d za32?@y+?%MXh((JaC?NO!aXhwM|)K`8}9FgnWndd3*i2jFdXdz;RSF%7G{`V3&Y{7 zoRrP9-O4r#o0(^JVYV+GmUX&|Y}Aslw`UyTWtV|U!u&Gotx-jLd&HR^nrf zYpco7`4enJ0hw1~E>2u-3-zj8rXtVK~h0}%O;m#C>n!axd$Obov z9FD#x40$S8&BMV?un!-G$-MceF!RI1a)F#jiLe`7E=*f)7pA`28x;NDhB4KlJS^3^8%eI$*+#xv zXH+3AiG_>9jSrc+%y%+%d04WQqpn%l5OFBK@<!302bKZjItBd_;g`S_WSI}JjH%;8 zyqm}}{%#ie4#@8keiR%K&IWf1CxcZRcR_$dwQ(@>I~kuOFjVxu6wLfsC2}}=9}YQ+ zSlLN^C-`Q3$Q^K5UC2Cc#fQ8b?nYtS(jp8;YZZPB?yrR>!0i{_2KR(89PKsXd*Qw= z%(SX|5QytRu$qsF4IhgR>&qv?NpL?GX1X=@70`DBUBXkr>i&X+^PtExA%8@87Fdn@ z&|#Sz7dcSlvmFex3H*EE&EU68I;!u2&H~6!i98$pFX24!SHcD0bHYo(!>oGvtWz1n zE5Y9v25PH>tH3u3mw?xqbktnJrLSGoTmnp;ABs)|_$MZPpKvYYcM3Ov?-AYr-Y%R4 z4hjP`?)frLR)IT(SA)AuI!_7vAXoh=^zQ=murP2Oarh*SSE$cDCg{xnY$H5u_>iqo zwv(A@IFj(8dffI4Xi zpJ^k{gAVhNd)zc2+nU?nKr@#LINg6b5RS3NHg^2{S*gHR-5% z0{mt}uI35gJg}N?gA2fFUJd4Phxp9`Hwm*Ge8O(<&rIQ~`-AYC3b|^(U?+H|=rE5T zH|akiJQebT!Yu#8!YqFtmaBA^`EJ}dSN$go3Wu5lgL$0?%bEwvhRpGTWn1!aXg2Q@od!_Wa!Mq-0NN8YryZ5We)I($e%*^ zp9}v0VSa5e^f@+JmcYefBO}a>(1{m*1e_||3!Wf+8Rk`P@^am8rpT{@e1UK|n9pu9 z%pZZ53GW535`G@c^)Gea1Xl?!KqtnzI_2L$zKQ%FdR%OqmLKVSFL{&B4~qUl)SunL zXTgsNyHSq3kIyh426vOM)BW~{{LxX!XR=$DzbbP6-u@fH-@}CPZE~Kj^S;Qxg8Z~_ zGs5{=_&8X@xMRuJ^&`oPb+(aVk3AV5;o)FD(?|K2@S7^^fZQ#7E$rc*Ds?UgFA%;T z>CF>fi#%LPZqnmgDe@0dj$HfGuNV5HCXPk_tzWrTl7m_>X<7(wZKcL4S)?}(gr?L*l0=;cM87-oqL4Y zcKN&-{j%*oZqk23_!Gzv3bP&e2)~ao-x8+HnUQ)pjO!BN)!^B}YrzXmI_f?w;w^!k z&vMZQ)`uUNbiBeo$bTYy7x+GtPCz&S`2)faf*%v^03Q?{wT{U z9y~HyXWEb~?1Vf;cmnt$Vb=4jgf~Hct#A|g2f_@;Bb<%;ULwr?yGnR9^luj~fc$_k z{XQwY7V<;F?8{#>>Hn9o8{wQ0rr$4wr$T;KI1~JD;U4Hj#pvms1v$T?z6k(QcmN5G&-ZL=#UM2htzngT<2rq^F3*lwpowmWab_<_{e2?(g;2z=4i1$5{{$GSwLgyplRp8GJ9h3z( zq-cL6c!n_h<~hO~^A`w1Tf0Iy9&&!qh<=m6OHDf86HbPFg)rv`YfL&t!mlAr?&mU` zH^7^O-v<9k_+7A9nDzES;rGG66lU6I#p&SywK>9P!CZeb{I9`zh7R&!neb`IxsIjI z=iox&9`MbEK6sr;zt*JRXwv_QN#7?NiMZ|*wt;_c(&-d_1@cFQUj;vJ(&-mo3;D~! zCE(u+vkiV?(*L_~1LXWJ6w|c|nwDsZN7EjY`h&+nwsZ!-K|F3ft4 zx0x%s6I>#EFZ|vr46(LRH~{%3;RnI|UY23c7U3+^ldZy>Gx|+B_X$sh{2`OPL-=vT zwM&?`Ju2)3KPAk0#8F}PSG~ee(ViFPzEQt0=bz}=8RVY` zuLS=~_;aLvlzlMmV}##@e5~;M;EBQ?fhU{vrwOxtWeT%>@v!_*cO%JH>I@adZv*1V zOLaN(h&o?G?iOA>T%TW3o(o!W$4y6WNP@ zIB=>Z%}}V_E==3+5N3UA5~jUB7G^rO3p?TdT$p}4g|py3D$H~|A)F2O@4`)R|1C_v z-w5ZywIJVV8`B*tOdY$h4b1O|QwK@ZMwxWR2rq?vtT6M;DNOs_!b#xy!VLd%;i=#p z;Y{!n;aOnz9Ukzs4HvFo!0K(Y-xmpW=SymfOe$~1F zawp_IlixdqCqRCWup1mS>HJ)HE##fTCE!PeX`9-ELiiQnBPPE`g{vU%5v~P4Yx4WD za0BE#EKSPMpCOs4GxNy8Kya|kjCR4e$q%9uvJAr8MHl2w%4_fs2h&D<-s@-C82cV9 z56VwKAJcFxi3>`){D2w%cwxprN!SiILzuQOOzP9$<-)B0Il`>}#llXwb;1m@QJ7`H zvSc{4m)!xGVQ&?t{@ucvaJLCF9XyQup&t1|q>Hv1`J?iUk>H?x)QP~NoAw!bLOUoQ z4>__+OOn9jgqbG@R>>I;!=w)5xmcL8D}>=_xx&n!MZ%1~K$!6t3d7OA&xJ6Z;MMpr zeA>k$JdIbt&hygPtm_(Syzx8ISP!|IVK(Xdh(?9)hdf*OO)%|byw8GFo?Hq64wWb1 zP@aH8c><ZQ{kps25sZB>9lzP98DE3B%FvAwq}c_ydvCc8{alW+PP4e{_=(CZ>cctq@EGJ3KQX5ae>#2 z@Kyd-L4bp{8qf8qvY4;LdRc7Mc`9`f&IAOKNnWPQSr?6a+*#yiUCw-_{u=1hHcN#r zUnz1I)`hEu{m|iM>K_6(2)};O;5_6UxQX&R@ehX&AL_ft4St6r7kn?}P56f+fRC}4 z{vde;rLt!Zzpo*#$8gSY9zys}3LgbOBRmf}&k3_Xc~v+L@+fc;6OAJgA2RcPq%g}U zS=bIYMHpW7J^}hkU{#J_>V98zSPpB1op9F+Pk_5kH~_a(nCa^krVY;vzXG>kn6{r3 zMs)gpXFwI0YaZG^3(R$ek(L_a4Uns6V4$-JtmX!yuf})qQpg=v-ER|EeU}Y#+H7=`2s5qfITnO-FIe5@l`z$JF2Eg-H;evm@ZF{`w+Xu;|C#Vq zaJ%pV@NSd-9%1I$ev?kONk=_1gLr$OqrO`Qehz$0bTYwzFzLT3ybAKSg;#?=5MB#b z&j}+O=9SvR1hZ__9wzuPuoZm-^Qr)xDop)x!X;q!eLd(@fZZnjOq2d4!r9Pazr!%| zz}Y7Kr6zs#{XXa{gU$+(uLRecbn1m4hx}IIC&6CfwcxELef51ngt-~=Z6f!9)pr9S zXCCe}>8tMsLf#Fz`fecj8Sp;Qp*|1e{tNSk?V5)jA96j~bv$_~rARkE7EY{iu&Yg) zr%=B~0A?6#MQ(#zEX?rAgc)A7FvH_v#7jTqx1pqLFvlx>Y^vz6KXHOr6a6Zh-!pwu4 zgyHCA0UbA3l?8YzxDp@w&4k-33`gBRrFFD>W|>5=U!?+$XyF2|TDL;ZvQq0-uoJA- zr=qXcr{J}aJH;={jb+1fp+e$ZDGDp-w9WZgQCy!pnL+{ z8--~j56gDlRcZI@Oq-0c9?d~ZVuU!l_hdKBa9^Eg~5fFx>eyK$ zGj8LV4I|%9K+gE6V@JYOzO94+M*%*R{{{uUjLd&HR^dbW`;e~{9*@dXAd6L(SJVyI*)^^MNV6OC=5sc4gz$#!ObG4 zjhlrTFR#%yn6Lld0+`3!_)s2z`)A^-yrOS{3hWEV6~q{k2p4q{4TKiZXM*? zzz>o597xKJbr)v%u;(N$4*Ct7jv@+2ChH2dMo< zn6~u_Gm7Vhmx5msrk!sHuLQp(yz2jO_wI2~UFZJrp8Eh>GoX%KG#SPVs9*$*0%{6K z5Y)60m8eNdX5<<{kV}MA-vc`dY-n;0PSQG%qzA?%qOGk`ThYY#08I!cvB%h+6O+dN zqNnG?rtLY#CdQ<(^M0ST_nO%ZX!8Dk?_clwFzmJ0de(P6>shyF-S&c=>AeW}AnZ)< zh5cdJ+4m@5FNS@xL6KWI>@!t+GwcHH4cb=IBrL2gsdO!@$7KTxwI5(*w|^Ajd$9Nt zvPy$ngGy>$l{Y8ThNlm>s-L$ms;X}gSPX#=#op{MdZ#Q!yY)2D@a8 z<#H{xGVFHh@yVHpit~w^Xz8+oB6oFlWl_n_K)HoG75b{0fD02FyXJ7rx5ib*$E8i_ z2h>ZGgoRwZJYGTzAqnP?mI&WwFD|+z%vg$vQIrcX>Glb9Up2Tkl|G(6R#MtXCnOIg zKq1668|-81)MnAw{Kp83DkHn#772CLG}I`KDcZ2W&EI3l*@xM2b0Em7t28v@y9+8; zh@9O*_qBxTZFO3@pol0Jl(gRJZqTuE`i5b~6$pxlUEWi~E?^0yotHpr2`8xW+NPD& z1eJ!^V3*>c{Z!qdQlQ_#y=7AEy%~Qt27q;dcCnZr)438j=r~Fggeq}>nd(43GJP> zHwPY1HI7HFchcPyHwV&Ean7}QMxnVot{|(&Ej(34bm0V=Gg85;svj-6S*Eg<=N55m z{TcgI+7yw6-cL9-0XL`PtP(}A0R@NS#Y2~70r>87#MS z;S;VfyhWnFL9lUAsS1aB$wm>~?Qx43CZg8LCBW^?@@;|(635D4i#7o<_tv&KXaH{( zoqBH}DZ#f$m6nP}z=H4>Rn^wOjFV%aOJJSEEh3wca2(uN)%+H4A%vV`l(SH7S$oT_ zibIdL9fJb8>?{QNRy2%9BEaym)`bi}Ys0ReR{A^ARBMYT!21T|NNsf3CCfK&BflodxG0pN#Q&=(ZW<(zDBRhLo8H)c zbx?#BZW9*P)z{X$+;}!sv1e^HT_(41TV4GUBwl#|4ek-5`L=Ipvatw(X}X|!9dpdI zFrgYui84b=lw`*=J2Nydsx?OSHY_FWY1Ln#K)9%l~KGCKjcT@eiMS1 z3AbeYxZ!xe4#8Wb!Gl)-Z#fd6O$W{0PQ>3*&}sSGsKKLkSI!@u3(?}y9BvYR+;IM; zgy1!5@MsN;<2`%ZSiC;?WpXf;j$Z!>bXxwN2VN)KNq)2!i{sUV;9Z8_oA`0V`P&|X zmxRTIDOGR7nmde7xtE`cvSq!kIKbuA$T)T znCKoEZa9D8A$ZR>EBhvhziIe!yg!DI*HW59libmbXxwBp1_>G%HMRAj`$l1 z!CL`Gx~GL3&fic7-sLB;=7owz{Lz{)=PxUyyqt{+uE7!}$6FCnUY=-I z3&A@NJlf;U4ac*E;B^9THi!t1)BFCe>-&(xib^t_`U%UqIdF6~BL|VMFz-xp% z;VrUPB08C-BjUUkwUPVYd z^kKZ>4lianUU5h}bp3}x`Q?C;<#2InIgu zK{}H_*qQi|$pjvn7?$2VJUM?mL-5uCZ#D%`4d<^i1aGqjkJ=fIHxiQG8sOPDm`X>l zLm}y{0p23GQ+}+&kK=WP;57s9+wkXx^Y?5BUXKQk=sDh{u(9$x3p|cNnB4wq2;FZ% zhoTiQobEX2$eyYCoJG7;jwl`L@gqNa|090da{nptj=+r@j`s&RXz@M(-dAuVybY=! z;hn@!i}&Iz>?PL2Q8gUz7kJm=o%cfT1RddRQvC>T1@tg2Uin-l9K4v}cy!)Yi`V&F zFunJKlKcqI7J^p^JSuJPZ#@%|6! z$eyWs^l9RK5Nw`bZ`MW9|$;BLkmk6chb&5bW z98VX5_u%s=FQ6m5hwn;h4m|2#xZ(WG z3c;JL!7Bza=kGIEw0KMAONeFVfDkLs2d?=0|Eb1;>T zUVk2fcV2@><%{E849Sn^`O5xG!XU%>qqFzlETZlw!>8^l|_Q7$(@!kz7 zr?ZnFH}K32r#lx?POl&xec+koyc0j3j$@`I1Ja#xZ-fz(0y&oc%b<34+8*)g_-@k#5?3t=Z`A?O7a>U;* z{5XI6L-1y-RQ%LnjE?L-3c)*eB-oxdY4EB;@EpLK!ogHJdVM4WZ%~8xJ(Uh5LS2ab zmH?0RQf_#9cZA6AZQxach|;?UKc3$F5WGs@p(q3l$IA)9OFJqEgP2ir7wH6i1Q z=uG8|Z77~Igl;qFzRQX5PhA$X0zqq|qQ;ru-ng17P2puYAa4PFZDTKT<*L?m%Am5yG?ZH)Z>?_mAt zQT?dApgA3bcNTbMaN~yaXN7|nZ!_>Hog_b>>PL8algHwv#@gqONbB5sM0Bh2fE?_9-Y_Kro#ceRQPkl)3GW9uTjGvy1D?KBLr_F@F3EF;dq~fl)qxo zO(d5;hm^lg#QQMNNG@nv1M!{>!Se!-@{1cD?^_{wSAaJNBElQMkLakpEQduamz=eV zAH101c=Sy_vS%vJ!jZvX`8x?W@*_M4ELyxg;2nfJH$+D!4i>U!(hJP1gF!qrT>-p@ z!^Yx$3cQUJKs6k%8ZOl_7W^ z458gn#~-i;@QR=;6MwwS&A$)lN$%iiiXZtGsC4KKnbFrM80ss-ApT zT}Yu_nk9%4!#zDMbOioGt1$Bli2m8{CtCQOGD-SQF{b&wL8-^z{IqRdd#5aQ6v)%; zdBSKS`h8LC_4|LBv*O-KXImrRNL#Y@C2=OOfK>RHzScb_JG&Fd!aW9Eb5~?@yTfD9 z3tf>ugQ5A5uCv<#mv)mFo*d4ir8tFu^7}I(8*acui{F3P1i(Gvh|0d&Bu^Jlw58v> z7ff0+JDc~4F`cr_K5CE?JiS6&`jTvSLaKYN+dXHk&*k@@vV3S33P0BQhSw?944oLU z6Oj53EkfZVf*8kaS{5kor7ePQNDwVaBBDn?tFTUPeq8EsOU}7IXM(uylo@Uhg%_3> z@CwKNAt6arobJ-g_O&nLi@S}9ZeWl+PMOaT#zWyr5tJMXn`~la^0R%Jdpm^5!++VT^w^qp&uA%{H9Ib9YdZ)#hM4p1dw!^o-i%clLS1q|vB$bDwMEf*&c${Q!w3Ilwe~ z)aO6q`2v2B1Gz7~D3Ba{ladnKexYw&B9J^rMadZHG1{nXbvdNd&bDd#kz}E3Z~A)a zwW#)%wNJF~6vM=6>*V%##Ju()u+x5&{<&6~x_X}u^S(o+*}cbj*m%l3IwT(@(S+;n zd&ZX5`?Tp^OX2AoeXiCRVe?+;b(`dh%4^AXMHaYh($Kp0Pmu15NcSi0DN?+xJzk2B zY>$-UqmcBMdD3@Yu-q^b=1BqaZR?(iB#f8@DSpcR-pSyjZ~ZAFlXxo*r~CcdGKg}& z)`wz>LW+`$|NUd?=sk7VxmH(KQR>)M>Dp1|Q1|aUQWq`6o*hSGd3}9NUB;bvmQ~c3 zH@N9o(48eb$epwoIT?q69x2&YzYr7-cqJ<#i&7V*-nA$#HGLilJ;c!bAvZ?h6JAo8 zlYthnHO3%7Y0(%1c9N`8-%Ih-vz-<}0t4I0p?!}GzQAS}Gjl@k(?k5@*nOMak=oOL zS6`@Kh!RX=+C%cEvz273@QV_{*qwmP0sqK9Q^((w_XPF563$W3;vWm~ekRsK=@be|44^!}*I?`7Ddu+!q2rc)vR->dJpGyj?RkA6UH z_pPwgw?N5IU#O!&2+UmkrmFGKToT#IpNtOcZ)8YEp}B1`^x)r-r(jc6VuB+(y~e6` zit}#OP8fx%U4;tpMqxNV6h^0Z6xp?;F=M7veB6D^}h|4L>memeRGL#2=I z%qBzLWT&u{cVs88J*u5}dt9{>Z^Npcp#D>}lfKRPw8H{JVRUK{oI!RXfMGIG`>%WO zJ{5Kf2bGiADPGdC$(=9;RXfEsqS}dvbE=)NFRFGm3W49b#rRQWg(;!HJ-dWO_uZ0z zaA#vhO*sz#;b_bD5`HX}?LMS^tMwJzw&V0jS;>x~pf5iuF%bcU4251I^w!NQwt1XWWB5j51?VngT{G9DA(?a9Kb2e%f6 zoQGLB=8y*uIsWK`yM&#&p(OGnoOQ07pQTXwVLM5`o^37JxZR~HRBd&=t3GsZIpe1_+2we*hv2;iKWZ1b;dn72c=rKs zHi!t1x=xPwCG1-M&f~ojKW;eQXK)~Urs`1-ycMt$9`%tNF9UWhUJhO;pSa<8cfmo6 zcSOS_9Jp)oWZ*pvBEr+|ef_r(yirufiR#DM5WLI4 z}oA^gM1je}_ZxC{m6`8X?Df9(KZ8qyqdm@QPJCJ;;xK58@v^ zxhdcgsSez)5*F=T2(^D?oXR7Bk%oA{V!&(!-k=%>uWzLPutvGEZsE3t)$T{`bU40l zE+lhkb3XwkW%vm`z({VG{x^f*YmxL_{0oNK43z? z&>s1rRoIfUMR%@ex7MAF8G)1-*Y<-HsdsjV4?)zCqSTwyAr<5atwupyK17g>7yW() z2{6%u;bnV#yH53Mf!|^M4Uj#Bf1dsKC{e;ebk8ap{K|$^LJ5a$QM^#uHBVKrqdB+QQ-=n8s7BDm1JFp&n zSxy-~Gzp^FU6$l7iU$Iq$%&o;r4TaFCkia zbC*TWyduqtwR?5_v*N^99zNDSUpG7}u76f6;*kvXc3DU^Lkd_1xzax?iDX0U0L=Y& zHn9`r8vNR$7{fFV;&Udc<9cT-jq7`vTmy4&6fCr?fd_I1&U(y&%+ejEwC)MVl-#ZX z3p~wJkn?V5lKoK~rj|^?sc<;5NhU<5B*6Y3y13(k)VP!EkLciW%5a957Oky%{FB^C zt*m$^TLUR*=H&%t`PZB%tcH?^NJa?B zrZRCYR&1t_*c(Voh(G9>J6LcQ^5*}R_6l3p=VxWdPb-L@YJbvT-)NvXCSPRm=w_SG;5{rb0+kT*X$Vg>n;=uMzIwkxTZAi00AlD|2 zMB(+P45L}+*E2C{6NvOLki;+A(!-EFoia;aJeAQ2l85=lrrwIZTUzpWrn}~?7mYjp z{(|^uRPQXLrad0z2Ot z1Fq4X=UXoCMbEi*S6oinvu{llDe`%b`GN`ZKos*L59`z8PZ{!4&KTd*-LO1lrNVf= zxy&XSQ~Z803Jf9Qhnx30FvELUxNhi+9EcxHIj=)uGYM-K$K{mfTo@A#(k~gp#4Y=x zskSS{+2gdeZ&9hp-)ZygcXao`ALXB#9?irX_n$g}KX^~g60)-lnV3<{(q}e*CS~b> zCU5S?Ozk>W=m<)oE66h3$LQ{xh_3K`;zQnyj8vuoH9Ul774Sftx_@d$9|VFn18*69 zE?CV%fzu|g$%560TA%TfD6WUyglkeTVGJTj@k4`9INy*?jHd2)Wc2ay2waQ6Ta}Op zM3I7ZE7-DbtW*?^ARDX|^ghhW9|(NI8&!UKyd6H^`i7UF?_-us{O1{?h8x$;sqULO z9;er)pSM3_+x-f%7!xUJQR`A=Dz-U&02I#DbkEiyHA;iI#Xp@Q7 zA|NE;-A;JnD2CS3=;>D%b;vZsd1WgFY4I!I!WI|Iss)Et1M&+AUI9oK%)7mE9qg-7b~Q zl+e?bEtSgdlFF7yWhvAjYUNM%vs$G$)N`VDaLS#Vd;R_|18=NtuhRSGPPK2Pya20x z*8)~)uFc-avWQw%Y3|g*^8)q%4=a?u(y8*b!cpc#SL<`i5EVL6A)RKa^wjqeq#9pNRQ#)RQ58S2wj*ge`L`?0Qe6JVdNi6hy z(D9OD6_;e+Lwqao!i}~5&=iJ^N{+thzNpCG%vMU!pRscF;%e?pyv?;KbxSlAl-huX z3RX}$weK39Tdu`Zne@!H$!1@4m~Tt8&l*-5JKHxm%2#nhvRcK6<6h&_5xE#kL|>63 zrTj_Yg>fO93lg37O_tqPcmIcY`2|y)bHU=iF#8%|ZC6|BCviS;0r*Aq_LE=OAE$25 z({uKe<-WIiM#T%(xereJi{;#}ZTnu(w=NVuzI^?=f0^{gKmXt0ryeaz=v6m(u*>&~ckN3jSf%kulz$bD9L;GNmbimfTA((&rWo-8d*N@P%>twPhers1a4Ca2VE?C@dr z6Kj{0$i7Q1sGe`qIu?6Fq)nG<-FFxM94vf`v5;Bo{uXCC(3`O~KExGnsoCI%J;T%| za)I96cd;ilrDt>~D%r21Nr8K|J0;bHYjYwV+Xr=T7EC*ahzBZ1?n3w_Rjwvx+7T_buo0htn?+8Fb)@`XMez(C*R4 zLp+}g_FoBopW7c3un23lVg(o-MS@MT3Z>CT5X`(HPx0(G?(?Sh&4NrI$W!6N`7@(8{mRQo4qh|JTJ}n>_PM-{%OxGAKE`u=Y!!iZPx%T>GjdgVM1_zx$f~=YllF z+;*2qnqpZ!V4xNm;V@o+UZuB(`(=wKG09%>cTZxnJq-Wn+YjE55*OI>Zj5|N!rBe}w! zU&|!I()P3-vV#=UbtJv_1d?8pK+=Pn5CwWxM)=rGm5KjfAe+HppT=~#Bzq&&v1EHR z{?E4$AjSpu%_NPHx%A(@AxwJhUp+rNyKg|B>%>*$V(fZkzLBcCd%pdBL$-SX)k`R^ z_gc~MpkI)6_Un4Mb+ken`_g8Mv8QMt=)*v7jn3^(9?+dJgHp8QPG<3l^xx;4??P;k z==z<6ha7_osxplP7f9~;7(Ch!393UfMu&WO&eO;%fSOjwOQ{FHF|M$#PRm0fwI>>V ziCzfpkgh+m3v`GC&TtFZo#kC@T#EE5e&t^K$3k{FQLFm7I@!R=!qimv6v{jpynCF} z#Ay2$I&X~U^xwtqeHqhw{r;Y=o`J9ztcR^V5dxO~Ge*$ug&hv-cTQ=GGbV>qFX%)A z)1?cvQamBw?1^}N2CI?)(Q2Qs_r|KRL+(fY{v#~@aEd)$3~!4K!(`22>kHPl?ue(u z%ou5hzW~?2iiu+EfhgV6VVdFg*E291B$=6f7S3pN;N4_18OU9KAExNPg$cV%EOy^# zGQ$nLKCSolG(*Qh$#DMcG4X@8pF|IjUS09f8!P7^4b4yW$krZYea~QS651(!>l&eS zvwq}3p|nxox>0~--Fy3@^&?vaU$21F0j6~m4P~Fv=VoK!G!hQjfJ6Vij@G*sA2Zf{ z$NJ=EC_W?Up+4qpio6wjS{XjRLZE#$L$79WC5MK~T|^-e??{Ro>0Av7wnBRys68z3 zNIdg_8)wvfJNZm$3gNOfmO1YTIy0P+>CAb1(3z!nBnkr}FmO1+97&9TZ}Vi;(kjv& zc;*Pkpo#2Yw$;FVdj&IG7(Ma@C4%foJgzG+_HPmnnyFcb+lW^CMgIQ((4al6h}@#f zkC%EnJ8E5!r3DR+)bo5tHf9CQbRLuD_D18;nxW@AhZ)EL-Do6xv-gwUXQoL>GkV%U zUr1s?xo3zhJg5oL4UHG08GRNo4VZ``rM~ba?Eo{d))5L;aySr8q#B!);VW=b-AmPe z(4ju#sfEOg5)Zx1N_9K=d#ZaDIVtZf%WmFYu1EVj!F=8{HlMe0qWQd)O1opCSxnc{MVk*L_Yy?Q@S#Z3vp~^D3*52U?wC|J z=7Jf&+3pRg?gE8YzEqee$XD%of-^B@=9S${jtKj-9{pUoAYX<)keEmTm9#SV%jE7A z`Vx^1=;vap>A5a~gR^rTJ9 zIGz#CF;NZ?>A-pWay`ZPR_6z{cQc~N_d?J4NeQPWHNT=eGLVA!```MCv5aS-0An%sC!L?W;wD`b|^bn7i zVOx^uLhZra)@!r+hZn67VU?UQ&EBkTiK%MsFY^dq8HKU5lx*h=ZHTZH035j;X zZen;FvtPSkaz@(+bd8B-U_r?}ISEXI<+%5;v6Rwt7usLxjje5qXV>QFYuNtT8qDJ6 z2+MOQ=y`#y9UV5J3$Y51!7Z+1pZm0{Y;kcjBZGs&J1oR}eZMo-{x@OR8OO^91=%Gz zXMp)$(pYWH0}V&O|7xKpg#XnBmH*XjC+}+A+SPHbZHp}uT4a*#f=72PHeob@m+}-j ztD~*m-1Z9-;>m@+Z^hbyILV{mjrSGd`%W6D3uwxEuFKcs?`g7m^!0`FbdMe0{k@*I z2K$|H$5;G*LB~mXd*iOf$KH$gm^rx7l*6;3kVl+N2a?$f_*KwZE{1d+G zI8V1A&;EhX?@T&uWE0eKdRTVf6(yf#)f!%d}sa>Iyf=UG^4qVO=rz=1=s!d-V2? zZri#s9+mp%x2^txzV)mi8BtTvU_08U@BX6m*+pB^l^O)~TB$*;Z=eRX{aoMrI%xGC zqq@z$JwY-W+L!s>u&q6YN`tW-3i=z1`d^!^R2t*`9%G@;xT)W`Q51*EVu#D3(eR>Y zJaWi^Su~`THw!X0TW_Jw*4W5z+}c_0$bRhsd#gkG)yriA z`jHofm7=obs*ELR$u$wOftZxlRjhQ-3V+Rpl$4ZSwrY`4%v|6L6jaOO4cDX8V#D;Hd>|C4Q^wYd-d)WRwS;q zN|1i_IV`!`h0~Gm#rxja^W$SFf^Z_`jQQTlSYn~$5l`5}$ylXIhAQ(w&gyCU)_?N1 z7U7l}Ipq;==aYl~m8c(iKv+=m@RNhSFrhz8*Zf>0sUZhR>gVInuCcA|)8}pwF#W%B za&SoOE5j&!3ib;qg?>#b!k>@-i{ZcW^yWN4G7BCv%k?gY4F_z%9?QZ`XtBcv@K%%1R4sbqTB6L|8^S z1=vzTTu06sGsu3KmkA_f3<|cO7CSw%3i*T_$A778#@Z*^ro|$!rPaa%u-+yaO;TC% z_9yO-)(_!xTcTQ~#?(n(>F}JY?s3*Qjj^K6_o70k8fCrxvVo})203cRiG9&2;GXr@ zg^%djwvW>2De#x9lS-qRPC$Km;USu60hxuLxnSA}W_y5|8zuD7%q!?_go_J?{CAW67Fmob8=CDV*!DSp2kwK`fvqz3F_uv=)tZ;uJo zxLS`106u26!-W>##>#|GK|L438)aI*#*MxmMTT@7CRuEwW(#Eun+sr1c;R%jSMLi8 z6QfIGWBZ(?8Phyr*0vav$M-gb>+y~HoVM=n_ON!RXxb8(lLyzkbWrHP9m8dKH%J+v zPB$1Ii)@dHGp*?t{-EKN`21tYJL_xWA>9LJ*}|lY)kM2I9VIVuvzUhFEg{{WM`a*) zsvswnMpI>CnkUwkB!h-GEKDlFXg!}(xK-{0<;}uZo-p1D(ka^Mo)F%i(7em4o$(vU zaJF87xXi+ga;a>Ym?xE`NeN4_281bVMF%<)0cp{0nNT?fIMI{`LgJb-N$ci@)*HbK zR<`YyNgm5&7p{o4*xS(qO$P?*Czj93rhBZnF}G;Nt)ML0bKt9PS+-*Q*4>8n6Odwo z@4$LgPRt!(f$spGzBe>$dj}wIq`;T355&F%FGw+e(4Wvngb7~e_`JPa$fFt6!^Xmm zSXDj3Tz>)iA|&M()pDu#Y)2c$IE6C8)hT}2?^^qeN(6m0xp9=`tvV&a5|1?cP{}fA z)K6?U)$L0(^S}nJpmIiP*=;7YtPDAdufzyJB!f_y0=`R z^981x9H!Hforoyc0OgBDGr4RukgMyvw6;`?1MV5~dszT2?EY`r)lqsrYtJO<%sQZT z#kVa%$27&$dwci5I`Obsj)(BvBbgA26!t;K0Z-V4?rzWNZ+B(wTXHv|B-)dPd#%p>hJ}4D`7c#^oZYo${oI%)~48!O1vT zyQSqQ1`kiIN5e^*C9zKg){$%eEjxFQLQ$V9|LZ)LWQgz>!ut(j!v<^L=LbK+cG%Ak zzI*VE=C^giE0Ke*u%Xa%j^_6q(rcf-oA$z6t61N4V*MH8%1Malp>X?4Lf=Oyq<9(m zUw$cJs#G?`S%&{nQdy+@5ufd|$6k}d!{%;|n4721{Wt$bL4a;?(eKa5ky|q5!E5LB zBmau-VT%0Gxy0mwM6U%p$f)b|(XQU6y-o4n-mXaR(JtNa=psbLHV5O}vFQ`(wM=hI zTbF)h5HU{~Hf9dzeNgaPmbc};uEBjP^yXJEx%d0-zAQ`&n?A%gl>}CWe}Fx{!+96t zwlKOkPUy`?LHGCWK1S4^Fhz>E(D9_VrMYYHTE2edpxS)V>=k+7s13OcF zt6%k<{?oM%y}1#u(}t~f;ITAJM-1nz(ajfhgJ&GfWyU#c+$C$wRcoxTETj2nksls% z2xwW})}f&Rfv;@2=k$MEo2Sn$@q4Vd`>ZoD$%Ho9bAO{}^p3ukeck$z@51K}Y1Gl4 z(v@YeFv^zf#D&-^+Gn(f8`f@2K`}81a#maSq`s6>#?dT!CyEVJ@U=PWbo$3PFu5ze z{*{dVR(DGYcia2UAwOhS`|243?bDI>taQukrTg>bEN@CjJ}t1Ou|AWEy)VHA8d#iV zwuj7eOWRa^Ylc5}1*?}v^^7Fd%L(_js1^1el@9uaypf}W0+%%&pBl$l%o!|F%Y{~P!yfE6zpe7)9i`1!P)1e zO-=OQDD+*0u<(yur!m)Q z&`4A&wzL1!JUNrF%OYOdSUSTh6{jNIQgMp3|FTrPs4L5}FIYH3?~A9M>?mMQ8y7g^Hr@Zj zKg5-KBRhZC>4^~v-}?&VRMDy|qBTRGM)`@S87Zw@TMFP$YmmO3s1Mk*ixo(=N!B?Z zMZg6plRcKUUa-cFbpGv^;h7JeyK^x&Y+aB2qX04e$_=3io1L-=^ zDyAzdAn?c9LzI~Dg8qQlnBc`GA~7r>`ud0SXtxy`UqwjDijr8dFU>&f32|8PB3y}F zu);v`IT0Ue1q{!VXxn|&jzb{xrWZB|velC~%YIrX#R&Ft-GURnXivg=WZSanhy`y+ zal$FF@H&oBBx5x$C{f@X*6+Srx`BqhW+W{Fn-O6he#^FRM)b*n^ADU7m%VW1O}QUS zJl~_TiUOutX;XPAEuiqNw9m!Ya~5UdjJ5x5+kv=AZ=OE?;F*Yo7p|Oa$089tGz&s3 z4Kup-d8r+?Z@^g=D^!0h_~i&vw5i<)5k+8kg#rkM4$S!T$rI<|tf$1b7yjqX_QKzM zW&V^G%K#SfF#3sQL|$F?^^mpQz{Qx!+rON1dI!>bs>IzPrM(?5-`fLrSXy zF4zeYJWqv-B!>F%ui+mWP7jI-umt!Z^ zzo5pX%jWC(@<4iR#523!r{%JCTOsBg@3dk29AAE(MU+8U3LSJND$Bgv0^l`TmTfe^bv|o;Idv>`TX>YV3UN2TbIHDB+ z{Y+_Ho})vkUt_+a1EH!hYv{u@cJjuTZ*Jasz_1wJVfqA3)VbOX$`wQ2wYr4~ApBFzIKmBwh24cELt`DE4!51TXJw-N#@(3w_LHbNo|BFlLg{-a5 z^S({HcR(pU%Kzsa!M7fb{bh~)XBs?^NlX@!yr=A8H?}jeoGV zbZSBA6sh<2j+fVo5YLHE+Al&tP=4F?8RJP?%s<+KJf_)|d&BL2&@mCR9;!5BzGRFL z=VAI!4BHnSBg(Csra_(eykWqiA3i;mdvLGMsO~|1DBS+!WS=n%xInePKl$MLEiLnU zQEEKCE7;;-e$o2R>=^mIUEDt7U0W-T- z$aY2L>sFYC{Qh;5uMVy2J9^4={*yoMl;43j)&-o(*_c4QeZA@m#Z{wK(_ZEpgsaA| z(E11nCTkKdNg6FZK9-iE>6z`cOH*rt6F$*>L?R`h%4wd8g#UH@(Dr z6q)t)o-&=$U;l(!AL5@}{eEJfdBEA*GCEJ*Tbj009BsFYhV-R7#ER+ri1ijrKBsV-Z(=JR2i_JE}s%Qr)Fqqh{6Tl$CAW&HTa*FPCO`q6a#mF`Gi@&<^jOLysC9V=+^t#)MN zdeB)z3*&|C+T#wKO5={TS4;dNcFN=qzz2!yFh= z5XY3k)=&H|7#g!icjk8b`&>QGT*^3vyzJ}kGSkZHK4V8$YrDFnz}iw)&dtaCK-ELT z*?WPe9#B<(5L|j=br7tO9Ft8r(kD+TP5hR)mWm;5Lq(H)fD*;Z?Fc3`)?#NBbKVyO zVe7>JVKbkW);Il|ciJ~yMLF1sjdm_*$XFA2Q$PtASkGSU9oUYBIYYHw!vo`yxf`sd zt0GZdsOv>Pf)le9G^|rLH>#v-VuN8qZ4YYv9@5w`fOij3I|cm;3j6{kEf@WMN+U@` zqtnw=z+vS>iB;i+h1k@@b$Yd-gX=Zu-1LTwrPJ4i*Yqo_?M6C>E-rUz>Nje)nN1Fh z3*KRMlpGLUl|>0p64xGA6g51DrtNl(-yItJ*QYHwo|rIgY&>zRv|-5b|3TU)J^!NN zo7VH*;P2|X;9LBih%sJkQr~~7K96brL4q+_HmP3&9WT0Pd+min?d-0?cd_@BB8#fp!N@0&%H=%dJ3dT+rP9heT*vT$cg~? zMONon*GarCr7E*IrTIygC@cv6fG27dDZ`$gp6=^t)s^N)?Z*MQ_3_pz;Ob<@MrE9B zIzv_Xu_v)L7kJ+IE*%Cr5Y6UD=^lYLC@F%vhcGiPb3pM<5HnU}UB{CPxegW0i@Zgu+X%=W=uY3k&iQtb%Y``C-k9fQ7~ z7zK@pq$>VzJFWe ze&bszK_)hyaCh|^tBw2}B)e7nQan+f_vkU7UQQzyUY@9pqIOs^hl>Z>(u>3xAv#lN z@AbU=BPeP1%SKOvO}6-~*156Kg>UM8`xhQM=nEGLaSB`A1A; zY|q%*H?Rbaq+ZzCnmv0{q46vD`bNL#Ir3S5zOl!f)t|7`v(`k8`Q{lFp0Z`?u8tF^ zVhXGOTYEd$$7v{k(MEKk)ITCGzphkcWlUmW1P~*i)oPo`3xM)`F65nDx2PYhYW{w3 zE`{7jHTf^J`~82Qcg(kZNzYclf4b%)SO4%nmY?xE_a2__`u+JDziidsr9NNK_?^?( zDNe=cgilrXKXZR|UQEaNM?6zidoy?w26Vy-_5E)3d0lP-!nyN_$tY@8ut1!o^-; z@|v(NSsD{Dw{b1a$UKe%#|E6frm&}&_7U986Ie$!sam^i!i=f?v^F}bh z{mj$T>?z0W%n%=wGA86{DD~5*K!~H5lJ+`$bLQ{sc6#Q-&v@iOSFC5w9oRl8zH+?# zwvK~GG4Z$pZ8R!_{gD}cpY22=jss(M<-A{0S2S5kNa$BZzNqKPkEJ_} zQJzy8efN7Q?*O?Jrti5W6`U$QqbAx7VNjF9_M4xQ*r1LtRG6j=E2g1-NR z^x$zm<^2hSGIX>OM2C8pc>NVF+M0_l#=ul_N@b!%g8j|2e6>55En*$Ml3vI zv;WcAg;gxnCJcLAatZb=)xI9BX`flV((5y5YA@LDGgq%kI-OU0I!Cs8ExtLn{`oK1 zpA&|Cjc*{URQ?OSA~oP4x5IkNSov7vL(r`M2Hg z;h=Hre2g>go5Kf~vQ9HQin3un z{>)u%&o3){#$a}+rAp}^sEWp8qx@)s+$ntH$zROop}{>9c&=F3Y|BFo>+jxxAob~&*T->*8lJ) zozK1GPZ~8}^e0`$<`T6Rc}@G#Ki;+A`L61Yv79FUosb)?5hAOZis*CNT*!538m0ob z4GZ&FtAQV~3U)Y4&Z!0Nsgiq&27>|cu2=Z|1o7+c2r@EBW1p(p!4niqH->*)SXc#z z9Emd-`)W(0OY}{@8!UMy2gbDi(pV#L#gR47-x&AbKhB7xqzn`X6vi6dGO_BdC0ox6}|~ zw?$OITji4rAWoA$N_Bk5`?`?#2F?3!)!w2$i`8c{^Z?4YU_a<$Ok&4^b1LUo)(=~) zNQd0$aV}kZf-!m{d_9y)|ClzGjj7)rc4teyVu!C5w8xPyN)>j7reQm-d)bUUX*J~t zCI;=-p|Ydbm>WI0@VX#g#|Z*CDo#d;7yC3qP}xzpRc=IBk2A_se!}C-@HvHiq#^<@8%n#+T>eX$EY`pa=$p6tsQ(CmwLXxkB5qDEO5xdTV^ zJ?`ZmcLw4{JkF^eca-;P*EyDfZ1hZ70|k?KVVj3BJFRNtS|xw`B=App zptC*w*1`US`3Ig`+}#K6#1Sx{H1ZkR`9u|G#R|rsf@9`eZ8`rGlcEKvF}41|?=C}$ zjqW%AY?N1q3`wX(6x#x=b7P{YkvxcATN!M~mJt-wFS@1&iwMC%xPdl+B}#8TlF6PD>X+7GwPK*bYJ}_Iz<{7Yb0IyS~QJvz0rJrEi zNE|4OLV+l_j>`%ZmVOiuHp|92Mv#ovVom1ZSGai%)$9B)$gm%{r=x_ zI%Mbj+)i!hMU34=bA>5H-WIm>0^wja++0no;n&LbBbCCul>GH5TY;5h9Ih>_MGbUf z<@jpkmU!AOlonMHnLf0Au~>pMbRDIC??5^4g>KNbm)=_F-%i@!vLag$4y=kyn+j5uk@7QojA(29>aU#7Y6V8Wf6Z7sk$hC@X2wo+)qp*RDadPmJgQ}XM)<2b(Q^p0GwPq;M#oT{yLxn8M3T#GGJxnWVAv_LoNdk#L`iAOB`hf|gFkI3MpQvnV$~oy5i3 zVzaPp$u_ogqV2>33m$J<;%a_v&|?t#afi{5BRg?GvODs~2?w%^&ZMtcg*`wgBTnvL za7bLx{N~^ruN0oM>aeNxl2tGKJ@V}Ta(sBf(RsnP{4XD^SUrpm_if|H@`1G9j>N02 zFZw>6wr~1`wZ&#({Mx@-f6dnddT#Dt{g?tmZ8>!Cy>NPTEgwA{=C#OQKuPk=v$0Y6 zjd1(FsNDn0{}vVjmT!A%P&HcrD=@7hY|_ezM6C8_B+o76*NuH^8k*(~)V&s=N-vvh z6Y&)Y`}E0F(-PUf6YQeU=gtup{OS!j%@qcp9mKa9e30SE$mRze%}-MHgJtabYD<5t zl1kMdwXLka{w+-31bN)>n0XD*ap6SGBE{YigAdCyh1Ua+={#P*Cv zMl{z>24xMSI1}5XADHpqiKb~u6Uy56a#v%)kd?$h9x+YSiux>CYF7#QCig0H9DUtM ztxl_q%YUiXrd68Sv`SN(RvEC*|9kt9Xr()a)~3`cU$4L_RZ!(2{z$9C7AN|~DEsab z){Q<^9PzPK)kU+L4vA9duUG=V$v<#HWJ|Mj6?^kr-0}0W;}d;DiO5sP7@n+K#C%P5 zSb9o+WJNr8sq zD5&$_Z)?U3}dVkl`lSbory{bR^)Fo^k_Y5sLY{sNi{~96gP+V7p zTxj*bU;4&z{mAd}k;L3n_-8()mS92n!31MJp6x%G!0)KW?H3w5_6Vh~-=p9BdEqo+ z^GEI>$`V%VGeUT@GnDd!!s;8E(a$my0q}V_ zoHA$Fc$;|z%Y-g`iCTNktMDoi|ytJtUF>`G>Ts92LUk(D>Sm;^5f49 z6Zmb`xIL(`L+|dl|9>XOJIkx9O75&}*s-Ie z_Rd|^wcF`xvt;$kmz&v>>zeBBXU)H!fJkfX{~zpb1B20bfw zIJQ;qD6J?H=G0|4=F}z5X_yy`4-WWScr(9=Jr)WjjTLqEbwVIw_Ab=aR_v&EsQ3Pq zR=UdS9Epn>=PXKXoF^nxOciwwT!^$#s4K5-s4RBuD8W^7j&fH`P00?yRasfREpg6c z4GwoxeM#LsN2#l#vZPp;Q%u1qbuP!FuF8sH$HsLV94QMIJCu8U>KZEQOBM<_aD6mo zVXDxuWBZP3h$)d=<_X+cc`oMO!o3?eIqIvc9hKF)9HrH@j@puK)wRVCOpS|Wgs`o$ zq6Dd_quYx}Zo-!821ivxT|LV;HFt}Y3x4WxsZ|v&yxQhY1m8fTxP_H>BW*j1>&ji* zON13GH81d~E!k00R$X5~cOz-R#)P;T5typ2FADmi;0XD+xvIid8H@#D+mTT3sD_M% zJkE#eh&%dfDog4i-VG(S2vt#6QjDb5Hf*bJz+Hb17qAhww!~H3By7Z8UL}+X$fn{7 zTmV?H1L4V1?5cN-_pWZJFRKoCe`iN!6O#ua)HT%9RM%3x%$eULhm4%Q2B6|I7(RM!8J>`;;NX+J>Bm_8NqI4LLRUuWg1;+h+D{5>2Vj;Rg@LE zDp6j`U3HG)hMLNXZO9lDhaL5`6(x1y?1~UINO4K2tDzD>ze$+-%DR-)|DDLj1pLNP zE->p%CW}EQs206YRe_ruS)SE2)Uymj_EB-x7CLrc7Ee$Si44`Dq=ICKRPJz5p>RMx z)wQ_du`0uXO5I2pN`0J=1il-_2d&ezJZcjK22uXXcA!k`sGcY~;uqzu3S}G_S&Z`f zXo&+i$JMb+p_1HCUs6=%s;fsqS6f+D5B>+!hI#RRK6W*W+l5_)SN3d!&Ogh zB-D)JiZT>RvZ2XG!@IVm>7K@I5Dg%CE>{)PosGD#Q0qW_O|ZEDNka{iJSLFBiQp<` z-9w-~pe9vmGBovGK(D8%=5@&4suIToa~dC_7Nw5$xq*fw#P{11HV|mBOTa-%@j^in zjFP}_yMP-|tO7}5jlZk5t^`RXITY;x9c%N*r*20D>Jn)rwG)JJRo3iKNLf%MqZl<( zO*VOI;%nGJRi$i4#bYR5ny7>-S0k<=bd^;hsYOa7D3F%XP>0H;v>btMvZ$=Kx}gSQ z;S$k^RDk|iR99PHBb1jQi`*rydI5~Ht_yiyROxC$>TvaLef75L$|A0Akgh;*CB;RW z7KSM>;G(KVReZ*JHr15yG>i#E?lnsKq5XlKa%c|4>|RgsRM}L-Dn~FmYKLDZY^$!` zUV*T6+ld%5RZ3z}RdsO*e1i>U5#97jg$UiSP+d`6R9aDqhQ3aysjjQnG_r{SFizf@Dv zda2(;^N6nWv67<73aaO;m>!u&Jp(CQkbq)m{|nH6G!>}1{_T=o8|a?p>Kz-|6{#2s zY^!amfgW-XA0E^RtAe7@+BwE1Mf(-9)~)-_{YCd}SX)$Z&xTF+-nTLTJKxqg-g95x zJ@?*IkhN~S_dQt!>$Vi-WNpk6zEeYu2U>41T~XTPAQ?L-he(xU8u_Ep(b;f?lwN8A znO@FP%rtWLt`awupx$%+Zy~9Tjtv{uk&=eNNkgsDP=S^-pT&-9sEuDkl&TW3wwKr$ z69cIYc}?zG&46Kn%3>;w3K(ljz2wOWa7ReDh@6KGq&f8##1%W3mb6eE;LM{I7%dG% z;Z9Z+)H*)a;mxkn+me2Y)^XeRx`wJ?mo-+$2=wt|omF7!zSy;+Op$F$oU>?2V-i${ zd6Z&}n(L}3g#ub`$+nuiQd4SE1dLfLcGOf?SKfD5N-EyTXK~t+F+R#W`K10oyuAy2 zR7KW3dQK8Tz{p@|F$!t}5rYH_7!ee;g@{oziVP|$nuH{fND^Wa6ck5{h`~WceDDy* zfG>1#L`B6B6<-W0Dx%|{qJo2pjt_jJADaJKRlB;Yt4{~Nd;j;=k4~-HwQJShyXsWc zIo(YkIYe}TCflv8n!#+Xv}Ku-S%B zJF~brAy~O5j^wROxO^%$hJK0FQ+eWx9V#08snZiiVB`smVs)L@D?Bo`BgA{9pTHcF zKXjVCQv~Uh*I>8ytmi3MJSR?3)9w&`@Sez{u4q`5Q`I)0D~;#1cwiH4Z7YnNQa_y! zr|=x84hs_(|JX78Wb;gckGD=YPY_sOe5}VZ>ZirkZF~4wo)~eSu9#A*9~vp$33!e) znFwbqJh+*f7sj)SD6YOZ3bCsTjvn>me|cMeJ3A%>X@Dx`o;vud!;5*g`u}%sp7{Fc zxC37JNp|%cz+I5@zs3Qaxi>tdIzx>yn*GsOdJipJDJ0G~U=Y;Rh3ST|u$-n-qU&s1eZ>^n_dE{xQ ztXY`$O;b(A%h|nV44!wvsDVRXJLW%sy(BNY%k0$K4!vsG7af<~@aT)@@0?OR=A{q% zzw+ZPUV%S-dSF!6zX$a_}?&K3{{z5zvlR5c{4dR(Ax9xv%jd9Is)pLn+V?QZ#eo-;YTZ_MnSIx!!q|A?q z^S854kT)y&7Q^1EyjJl8CL~rUXQam1>?+bv^L2B^gm%+c^WRdiUtSlqmp<}qTwa44e{Kc5-3SlPA2?{>pm1(gQ&WB8(T5*C36J@vP8f(M2z-k}H#xkf=Hl7` zxShPPvb<>^G{Sr*M7Jy%oIm);{Go$~aYczww{tO(l;(Y7mMJB{e-C4-q|6bErBpRq zc9{{5rBu#ZE2UzE>LnBhL!ROt9XF>^ozYIkuUePrA7=IrQTjPvPcC>!x}2*E@;4Q~ zFkLDBtORq4_kqKoTDr#bbbo$^?xJkBYPcgm$sxx)K_ivUt3uAvm~LS2x*sa}~y*g(DcRJb%2)~Oom1}Ulrx=jSO1S;P4K0fuic&ckY6Yp4X1_g{p8fU z`q_TZe9c#ir8mVp$kFfVl->HUQ=j9MbDeUY|19?@qzb%JyunU=zEgJV3!M6)PT5`G zhx=iP2lqSQ`^wRe_(iheKMlL^TUbtgp;In$%EkUP*@8MN{;&PNgaDAv!Yjoa<9CsI zihXaVzbH=s8$Um;{#*Z6Hb$boDc(4LvnrYLnSKWzEReX<`QDHINGWrh^SvMZOXUB= z&Q#^^9eYPR$2sM5o$>`vd4f}}a>|pP@)W1s=#(#U%9lCiE1dFG zPWc+A{1?AP_OG81zZCBi{}tK)b@?OzD5<|g)!*)4D)qX&$l<%eDZBIQCZ~RZQ+D}o zbLww*%6B;BrB3-yr+l|lzRxK?;FKS7%8xqbC!F$APWf4<{GwA{@02$<<&94HEvLNM zDZlHKw>V|@ytdV;|HvtCcgmkQwyPfiHPPxrrcNi`tB;KcH;U=aVZwMuIMgF+;nKPETZys@&D9JQM(l;w;=94v_tiGV)!(g;x^G6U>bpFw1?V zJylqq+=s~XYVpc~7pJO{=V^OFUVq+rNTU93>xPfzRH@Gg&ho?}3PgF=^e@}@$O_+&U-bC-u&Um(pe_NoN z)p%ujb>6ofRna?7l^eWAMV~ZT-o@Thsi&J+ z-ZbxMIq&Q8bnh&=qICIE?`UbS%a?h@ay{`_kmb$rdf}YIM6wyjR|0L%hhAqpR?>%ju zhqAnzyv;eNK+^Wy>^&jR2S|(mhSyso*ORvAcJDGSOi0?^JG=`;e}BlbaFs6>eO_i+ z-re4BY>1@eeXsY1#8>m(=l!6o)ibXw?|!dJu5Vs8S>E5gKT7#oRsOs8srXl_$`5;! zBz~H2mG>15K{^qyEbnn|hjTq2CGi`p>YwsHllE&d&RO2`-p9`Thd7!T&x^&s(}A(bw^P-CH8@*X51gI9ZSMe0js$PwI7flXnOKk}kjLJuU0W zRLHWtx4nfj9-QV`-ezxy=torfJ#Uf3OZWG_SIC7DN%MW+t&A&w=+(u|&#m5N`C4DM z-{$={?t1#j`+*M|k@S4o?mZy$U+aJ34VL+-%b$8x1GT;`@9<9Tr^_cH%kn<+mdN^~ z>p%A{iYx!u`&R7H^Xm)mRVnN7|I#~{4Uri3Ebl9CviMK4vb?Xohh)A}hvRu)m`Fdj z%<{hV=1V+|f-KAX(Q6g|bi9A@B2u2N>VNZomGM47m3{vp8E+I7|3>lmG*#chA96Tr z%=OU8e^=Ho9lyQ&zS4gLI$2&9zjGJ>iQQ&lHF`(db6RJ42l&TvVV6XIcJ(zS-G7RV zC#9^+Nqigv=gRa+dr0 znKEDIsPbX{XT4a9uOZ`=mmDKd>#<{P5I)EM4tCKURmDN{+Z5vZ*$^*4aSX$ zC;cpMj(^==y8N>$U+3>9^MO+KcR3Fxl2|?rdM2^Fx2$iJvHZC3neu&7ugBvSzrR!e zv*S-Ur+%nY{~vaO^rfO=Q(OEy= za`xB9r2H)U&GH`f&yfB29Q2jtJ>qwl^z#vTd_Pz9FZ)}i+)0&R^Vi7wlCH{|@Ktin zw@9^r+wbQ1`-~I+*PZp1;SUK1mtz0#nva(`aRYK*(*E;W&KOXB19Dz-{tH^p^A_a` zkh4qwMJ*2#Lp~NcIYZ(P-6m$A95Q0obGagBpTh;S&*KHN&vON{pNj;O=MuqT`)}Jhx+-D0WcdcOR&lSv=+$@-VGWipAuIv|k zl>HmE9Nl;!S*y6D5K}iSn7T~-&wrWhw(QRrP8A1go4^wD-d_@aCV=DQrq_qVl<8ZS9l^Y$zR%ywbH zY^QvLob8xs&j9c!eu0wl#RYqT0) zS^t&Iz^rHT-_^O&>7{XkypJV+Ut`7pfyT=I4>eZyZ`GJ%;BV7d@iQ1m7*6&7AdrJy z^8Z92#{j|PI7V=E9RC9WlInN6#;RY-hEQKESMv>+x;c1JPF*Hncvuc`6Oa@q&oxp# zUM#78F)q7teX4$C?96!m8*(%M?*caS{|aEW-lFZfz+rH44*ZISdBiW{4^lo}{tgAb z0%8s<(onpp&vR~s_*MKtD#VNOW58J?xL+6iz9w*p69kEF5L1^tMt+=N+BnLR7Yinz zTIH;u=pa+?ij$LmbN@E{(*)D+*_M2+V7RXLb>Zh;&bA!uzY0d?-6c2; z`MrW^50@m<*E@p4$UhNGzdsYq82@C+`OYfaGTwU$X1os(4Cv(wX3Y8vCg(uGv|)(g z;lRTMM}V39&vj0_&3?@`{(rTc{+n@Eb4KPQ$HSNTtmX`zMhfHQe?g?j!2eQX+T?$% zG5z#E(pb$U%nc?rmw@XqH|UT5l@hBnkN>sCg_N(+xQJNh*jQq;Jr!-o5zCxc*K&WY zudZca`l{w0Fnv7|uMjYOC8xpUA?8@0XUQ)S%y={lrp}Fm8JjxQTkjDILVu&g2h3GUA+xzm7 z3uR9l1_y~;oc~NJp1>SW6;HVq=%@d>Qqg@Kp>bcf0jACBS^#E05s|Z>GX%3AwZ=k+ z{hTXu_M>7Bc{HB9Aw$BE!V48BsQ&mvHBP6T9ZE9mjPg<9tj-cgX$6KR1kCyq1=D85 z!-GH4AMgqRQ_f`i+6y>zv=V83ZrVtyFWJ{r3}4i86|0RJhmn~%*#kH$mNS|%6^HJnh)X&`!M%$YF-@+ z0g|#Am>dJ}3IUUY;UFf5nxDYrI8WsCg~^YoOnufm#EVaokDJlMft78*ST1yI1uNSG zlZ*N}$d#QUXDp1IeiD->Y+<%BI)I+fLobr*ccg-Pd{5B$Kx83c)-(Ad^!lmvfg_Nq z7z$Q)3RZRktLs?WQeW9Aa%HFJhbB4ize>-oGNIEeDC5^(y|5v;Q$7 zXPn9fhmltc&Ov^;;4pGEm(Z5-1(y7F!IVEJn0`DhI1l;jg2TxFC7Al#1k+b8RkS&b ze3xMA@Kat!&iCJlDeq&+`&n{+%E{;MHiS=8|AF z=LM^|1kC=`ToQR$IR659j$rc8XZA}>n+(pkaDjz~T6nl%j(Z!Z?)ui3BC{V<(7Pfg;!d5m4#PZc#VbE3g-1k-)QHf$kz*g z68Q$fyuaQknDKr~@LW7`3w9ku<{r9 zVPM)v9nObtz@b0tdbNfFGv(k#Id%I9CO409l#^TawH5#=j92J1EgK*hnU0Cb)m|*P z%F?N~u+6z2MPWIZk5}6Y6km7?XEU zrRKo%l**a*42}PQECfuxo`T6YR51C}IRrY4+i@Z%_X&c@jcK8H$id_vqwP`ijTN5G`bguNrYOH+c#fYRhWp2~HxOsS%Qqgk{nC;Yj0A{ubY{-$8^eIS@|=m3|fPaSp7F8FkjljknMjKeCyj1}KUGJTzz65~OY=a1)K z8Pk_ER`)OGXiVM^Fzr|VitlQyPXsX%`!m;gm{_j;T;f;o2PqFPe}jVhdC@4{wt(_i zwY)R3(0RHqnng@*HX{xr-z=Ei+XR#QJHh$LcMB$WM|8usO#2F^A6z0S&jeP_PkS0`YPtUp+{m|{6A{UxcH}OtYXfIg9OvO(D@3g z?|l)|Ms@!JOdCgt4sGPLF#2VJY42pgw6{($<93l?+TJ8MjQl#mwEZ^0w0Egs`th`2 z+OE!@u!pv*7)nf3+<=E8_9|`?6WZa+N5f6rPKJ((74-K4R=!^VMWo(%g@DO@h+z6o zJ1A#AYM%mTKPo=J>}Ry-uq~Gr>eF{zq6)MBa>3M@C^(F~S}^UZ5lnt2Gw!s5_$=70 z{1qRSzXO%3o+mskBN>1B{hu((=D8VtAfN9%af+_1Fn0%!lYJ9&! zB@+Ad#rH5Vbm%*I&9z2epGF}m-%AzL@1+7$SM9~X$V%gU^ z0f#DC%g--p%z7qw-2a&pKkmx+b1i={zG1n7?^gm-yGx%1tZh@7vxpIe-$}nqvj9fO!wi%wzzvhXyFE9GM$e?%~#_n2VD@(ID?f!7Ew1zs<>0yqsXGtV;xKi)-OZ)RSF zD3|$}O)O{2FfqxI7jd{izDjTy`9B3S2LBPv80->Ezkd_Vc<@;O`(g|x3Z{);aeN_X3-z%mzY2c#72=^1 zNu5c68D~rzC1*W{nL4zEeG$`^g9X!;Lj^Pb^qD%urwL}eQo*!K?F-Ne1K%g|T;%Hn zBf}@gH4o#wK``UbWZutG_Sa~cl0Tv`eekDiOdZDaUnZWVdXCXPpM#I2Vhf!NG*q#D zRLfOtAs-HT7$W~MEvFCUoC-PZ_Al3R+UoO=g;ao-v6FMc=fZ=;_?W#QLfli^Q%GE< zaS<^ez9JP9bD=^SjhFv~f@;0+%eBrp%2#VS-1I`V8m9|}nR*-{XFT>7Ib%RysLvSC zeqzQz?FGP$!SNywBUkG`pqnxqf5<@%|nBgO4Y?wG+|Lh{`q|AZ6ArDPc)q1Z4 zW~@{UFV%8|XK2j7anJEKYB^(Su1Dg~pS4`Y8JL`mBjv1T^0{Cjb-*ihg@XEeoT+gi z%CFRzf6e>vM$x);h`t!3jFEEgiv1=UFXh-+qJki}Q)&wHm^%f*%Ct9QFCY04W=<&@~F`dq!Y# z94&Ijne&4>nV9!w!8)8T@L0;@9s3N8ZvNHAmnv0(CiBX~40lRF=-#~871bGBg{pA!&?efxh? zP|uB9G*)xtCXK_$%=wcsGUw7fV$6r5K$tJMA27#>@>*auf4+hMiLs-6I^^`noRjGf ziZgUu0-3JC=xFOCsFvqI5VCt*A zUi6O=c?9yK1s4KG1k*ot9)Nx^FppEFuL{94AfF_7Ch%o~^MTbhC4H%D3V1Z+_lnL~ z;QIyBHoo^s{&B!h3LX!H0%m-PIsa*^dCtlBn)me> z7wX&yefm$#>yCaBFN2(Oi1$a`L;QSQ&%Za(@BCRBbd^hB)iLcP|wIa_#FxL~$)bfqQ{DZU^FShNE zw%Y}F0scbp7g_Q-pBo@R8iZE}I1Tww!EjN3h6?gb;E5v7MqVv=2Xe-WZOJ`Fa1L@F z?{yTw+WSQ329du7 z`Fz2ffo~B^Uv3w?1$dd@V&Ij6X`9*;!8saO?TNr+fz_S}Or8y*KMweH!Q+8931&>x zdwkF@1?K;#!8lX^t7kjFRlw;fT3!P@PB3jaPjCzH1%l@SFA`i2{G_G-wBRPlpA|d} z_%loA3&9&8|61@Y;GYDi0sks^2C#a+40g@~E=|>T-V8ib@Iv651k>hQ1up@9(2_qa z_%6sF72FEES}@02J)1&b8-d>v`EuZo1(Sb=;1$6C6}%F7Ul`8VQYTyROyC}ZX8|8= z=^QI~732}Y7Pv()Iqwj>9+=6$N#_uI zzMNY+0f%nX>%bobYc1$}ppnwY+QO8H7uT8ZyUIHMyb|kkk-g4u)$*Rym-~@0F%OSJ7bw-&GvyycJ``p19zi;AXg)RM>;X)>u*4~O26FZO6y&r~-P;0#MxRN5 zL%;*@A`fGGl3?0+rr8o<4FN~v2^@_la5SF4)a@hsA>=BakVoSQ9E~S%7&U<=a)#%70L z#^xu%)c-{=$KqGP^uvRD%H znauoAI+zdpV)0Qr&+B@|&b*JT=Kmr+*VMf{Fw<#xg@D=T8G^}2pD8CFliSyDr!V?L zoiiX03!V&2pM8Fa6)BHc=G#zW=wAk%2(i3hTqJV7UtCQ575*U69_p`woHm6xxscRe z08IO{@S>dd?<<(P$}iDZegTIdKUZ`ZCp^-Ma`M)NJRFzn1k=B}1S8Ymi-8Wu`hJmz zkv|}qes2_NyGYIaj$|k(2&$ z2_Vh~zR}XZS#Sa53j}i<)ck}#uT3U*tlyBBn{|fq@~;H}662!uJIb0b;}xd-Df~fV zEX;dk^q=~j_mQ=0A~j?WeOY7LVLpq+SWv$=^wr$pg@sfh@}nWIBHlo$=gq{6`j0?9 zi&*B~T#+w;{AR%~051{zHE=6256(!-iNO=bq*_5N&zV;eU#E3e5!Y(GmKge{Lw~*C zLBJb{o3zemk=H@KUGR;--wR#}yj$=;fz!~8oY{zNrr-wH$@_it-hG((RWw4%6&>Cy z@P40dKf&0kYvDGn!|@6Mry=hlI0N}Xf-{kyE12UvSuisFejnO~fG-j``I-dxM6T9( z>8n-b`LKoS7yG4M{}voZzC~~j@=pa9ApchIP~>fbha*?_P{KbDT;$9_K1eWQ5D{Di zeRZutCl4~UhD+Nqq7#A6nSu*})x8*W*tS~a#lY&GOWLY?E?_=J_?zfJ#rsZhDe#Yi zD}a0O-U0gbaj@Vj;Nt|>02c~oEctmL>N8ado&h{r@J!%3!Lxw*87ZUxXThT(zfv&$ zx=t|tx<&9<;Dv%Yr%Tl((^?g}1$#=_XPU2q6; zbI-^SNCqvUk@4`q~J5snzy!!EZr6 zQ}AZs>#Vj*EPZvq2A-|ZStj!B!1oK@0lZ2u`{n=b%Q>(G_zl5;-dloS0RFe&^}rtr z-T?fmU_kG4!5Nr8Ukc{BnAbt`e*v8$!9~F53TE5$1@8nd75qIg-{&y%vtIBn$QuRk z2ENA9xz=Fxd!1me(@b1%nKJMq9>8^*_<2g@oX>~5NFlt;x}8n@Ii=Wd@M7CPqAlpX z&=UMXA}2B2)}Ju|rmTy|*-v-DU6J<^%zg$7W5@V;SPy?oAdKfV({?%Je-&t zAW|VQUc{r3e=nGR>=rx@xq2T2IvlTl2m$pO zC-r`Z@bGIPlovoA5zP3h^8nui9t*7I7%<0*$vkJ{c$oKhI38wRbrpO!glaCyzQeIG&-55~e=GhVF}`fe z_l$ChzoJyu=WQA@j@0=HI`q^0KQK%ej~^q5}b?tX~B%sdclm7 znxCyYuAhjUeW^JKIsN-Ww(oCy^Pwj7XYUL?}JwenEh~Uh}q9Uf;n~<2~bqAJlmkfuL{1FGD9x%uN8v#PAEqBPg3|OnAYn<B_Br$&Ekb%veyq8}X#i zW?UI7K}{C0Xk{G&s%ae zS0N8W_L9gsjvEBi_SXf|_ICtxT($^iU+TIB57REZXeY?ts?8C&0yu|xq z6DO~U569S?2h<$98v>+#@d^Q_AwNVg`Pd)jw7I`vat{>q~+`y68hp}JzvXxS~)@C9wNQ{fmix`Ra`+Rd7DUX<& zJW@Vh{$I7cfOsRNa-F`aF>MGf*I2Eqz_hoY$Z7A9f~k9=VA`wp9q5yLg2-w6p9Rx) zbv;5S49srW7j0ZEI0N}w!IZ0c1)ZV5>UlEoaNv(bhkpMmI2U;jxJOR<%4E&}D(0Nj zNc4g8Wbq&3uOk)n50#3J`Bsfp%z4N~3gcz=efCG5$H7Be&HJS6oAPTRS8)cu6qt5X z{u*$Ecq9HG72!qse;_X=mhn>i%l*`l=a#_qL+vlX8Nj{p3IWq6#)6pRGEgvmV(cjA zSd11-pGpLWk=F`l|5pfRU(JHaeYIfv{TIRX`(DBH`vJl9d%a-x|B7J7;61?++2d9dIV(jBf~-KB=(- zj*cC0bnJkmV+S0Dz8X8=Vqi6P!0bzn9Wc4o*a1h!4mb~THFm(!u>+2d9dLB)fTLpv z96?((cEE+eYV3fcV~6?7--VzZoZBY>(`Vv80cQ%H1gypp@{57hI09b-OrNR01eiV( z-whlV{2(xWqx@}P`bPX6aGv13un5yP%KHG*H)8%D(DaS?XkhwAd?Ii}@Hk-lMtKP^ zeIvdYxLEM@z@r5(1|BQ;@4({(uLmA4coT4`;BCMaf`10C65JWVsS(@@xL$BRFcWQ9 z4Q%51Dln@k|H8swb&17o7jT~FWLRramRWPqwl}b`GY_~%^oIb?5IhQauHezYO9Y<_ zyh3mV@EXB&z#9Zl1!kh1=Vr#{2LBIL;|nqVDV-4jW^SAYY~}`a%-pB}?kW0|hb?U8 z2IaXTzZ^Kv(lK*`I%aO%2yEsC<-U zjo)G~t4Xd_TUlEk)mDsTDxWfCa&=`%Ie+iGq+)7qE%*#ovig`!mc}IwFrXcVxcUHx zno8sc+!MXU&!0~;wI&MjKWkmzScYFuZ)|FqGQEU9bDe~vqN%2_q^z!qF|MyEGoeec zMs-+G#h+y_t1T&Sn$}K?lj$aqPO5Aw!7rub_u`vMYMZ9U!fae(FcXv#Xc|GInzJU^ z{LsNJtEsOmiD{W(wfhTHOz2bpJpJ#Wa}*PMs>1J`H&&HRt}Ll-oMhRS(4{u4v3gQT zS&glj+=)cp1X68YqGAwfGTmgPl?|A`C3R)Bm6luW5Ig#Is3z7-ZLBJpGPS9GDn>Y= zLp9@Kfo!U-t%PneMYWpjL8rX3p$V77MJ45BB{kKJanp*kQV&K|WlhZ#s!hd}=3Ei& zYbCgVA7!qrt0-xY(GEzkdIGBoOjAQyU1R-}hNkG6O55t$-Ndq{vKq`McpF#ASk_c3 zo$5MHI4W2xFA2)(6$KWT5=JY){RE8!`*?BJS7Me}3`&U|l-E?2H6&D<36xwTp%*R? zRgEQ6E~&HoF+_G)gEbQfRak!qUA&&@sG@Sh)JY}v4b@oo%AQaVa)Vt%*(LX-DP{V~7##DHE$Pp(`pUmIW$Q*Hy=w z$xfe-Esx+Hh5tV~@8Q zB#?2Wu>)BuL6#GUwz9Z_k4S&EQd}tGpz7SJ6~mKDm+x2CJH} zHfpwAYNRoDd3q^P3uI+OEKams7V^0If!G7e2C}wZ6Nq0WlNzQ>txsx*sdZa7PQ|Ur zglOa72nK63z3A#0f|aXmQhSlm@r_pwHXrv-7gxs5C!SYJ z^d6>cLq|#4R@YZyGIDO%VT^bG_Yg5eRb`D;qzUed5j%oQ3vLC*t1mF#ec3G%{HSll;{d%x zB0_p;Zil@c^@b^Gs@bbVpth~RrIPn7a40%Y8(~dZP4%VNDRAk~VB9~H!Ny=6TfL(o|j6gex=Y1mgWoplXo&>OkRYCrl${MAF_l9rWY9IxH!&x>QW9uc!MWnWD8t;_2P9_@-xtX$5Oc>1N#c;%FCFu)C zo;~#CoFdu@lB?<3(ok7GrJ(|QOFeFE+wo3CA^I2-Pn6r~Ge9@NQw|=UEZ`v#HZ`&( zXegFF)$_8fMZ6|dH`P?udDsA%C0QvLd;KH~_XpETCN`8|?X)pdB% z_P^mz+8}{GIum1-2N@lp7JRVM+qZdK($0XoiV2pLRp9Qdv81Y^p#*1*7-KR;9vR{k zgAJTgkBu9XeScCyKzFdoEtp2p}Q%yzpJnI zTLc`1+HasN;u0ih@G13EYxuYVm2`$#?@X ziSOgpBVu^IA7$pnq7O!Vw9lF(dyq8(G(R|Y2};4sqrQ+CXxvs!ti;=aScMUZ5d1y4OnZ}4UVq1xh9^SugQqPeut!$XWiX?-lM_4^L5S5@F6SWco39l(D zX)L?gbQZ{zsFpxw?oIbV6`-c5IB^5&j5P_>CX76IF^(6P)l4-mB-lm;YY}cIX2F_) zgt1NZ_fxmmW{(?bVmAqPAqv%48*osGJs4`o+ji6wsAKnHCd_7R%usNQY%L?lHL4$w zM&~&sYE2b!l36Y{ws>cng6V8;T>GiRTSBD(u z?uk?6Y-QKN<>WQxHB;)0cL^3puL^WnHKnnMZ^ySYrtPQ)Q2$QK1hoVzh9h>I*n^Ep zl@%@L5jTb-^c$Fs>QP_-WO?XyBS>aI_rS?3`DYR zT7A+$-k*$4@#r(T*!!A%NUMPC|Qqo~qQ(am&lF10@DTZ%cfTJhicGQc?xw8s9>T zX(m}GWS_$&EsR<(Xn6`yH4oq7CW$>265806>LVZO!xea9*%<5(@9Uyr;N+5bJ>%r6 zkirn7Hj@>5PtBBanNf;~mm!|4;6z@BZO&8~qJ-K6N7R(4tSfJr zUXL5Ls>(WycDY9b&~{*X^fHMa*v%&m^`}Atc3|$2c%KR%$5o%SDk+~3prpDr5zvQl zyvqd5;B|_e>cass9pj=2jgFbE7VIlOh`^5U9u&^{$fwt;Jh)>ykl;-aeBYp*D>+Cn z;E6?$T699#2MZ1yJ~Ti0$RSRrbhBN>csjFcsQsdS!sMz^%7jnkCbO_zMMY<3W}r<8 zm3sLvZ)_UGctlGD_IybanInc8Ei+^Gs2KHE1=@{EJA}zqqm%)W2_|e;(G6iDg%!eB zrD|qhFkGnPKeJS!o-LFNcBb9$ZluQs7uTSHgYZqL-X|yK7`)8UsK@jv^oS!YAZ3ED6gm0mo8f!a;hToKJMl8f@U3_FYQQ%SO622r z66FnBkI(!*7>+j^zKE}=P4R-iy zlGr!E;R}P0JmkYy7o&V#9KI&-oq~FkjK7^6zC6o5ey7mbHv$+G(fPL)g)qt{89x61 z3B(bpCqLT>oR9~#d$3-yePNyfgj zp=aBdc8i{;u@B79YQRY4|4eiMMYJ_=2vt^Py+kR}4OW zuafp1VDSxc_%@@S-)}a_*f+@GYXP4b5B6{D`vn7Hk4I5zaQuFNo^9V2@X=4&$1yd0 z?>T(@fARSpQj?5*Z##V7Tk#7++3=lJ5O3cs@EHzr8hi%yh$9ptW#1aRK6;~U_=Y=t zE#Nyuwa|YI-%$=VT_@pU^Q-oBMd?CSzO+rE5@udl`T^Wb>CRY~mo9(p$4aEp)M zZMfo1@5zn_P ziG2@4&*m$&_y$^h*ExKjPm`A#`g7FfJQ;<%lFW;`IdukEO>bR4zc() zIeeqhXc_8FA_vo}4&QF@ajz!dP~_BO{KnniKWH)rp7zU&VAJN2ki$?(mBp3Qd`_&87K z?{UZtUzx*~3%&`ODvocw!}pfO7qR$0!{%=LJ2#1a+o5OMm$oow-w2EE8HaBP_|8<8 z=|9Hbe>i*v7GI&o_YnrkwvWFj5H!B;L(jIa0(=mu_>Hpoo^bg1`v8EWXn$zWW`%;YsYf+u>Vn@r}0lCS=Et?>O+~qTVDEzrQ$oGod%kC?Pj` z$2ofZzxzW0dc&Z{HW8_NVPWh%#C6MzN4CSa5qy_P8)l~8ZVsQfD8_e|#rGQ~uRWiO zJL+*al!otT=-KuS2VV}9IA6wDe48DF||WeEdH#smJ;Eki$0@e1?Oh z2Cs1VW`WPl=kcP)@^ud1Jn&_aNRr`earow0d>261*f+LQeEjZ8V&Cb|W1EQdv&7;n zh0O2`b@-MivF`|nZ@I-c!Qxwm|1`=T-!Smm$~tJTaxt4|5M)P+n$84zhmD{=;6|eCe!bd zgW~yiC(*mCTfANd&Sg-ICd0Qs=B;gCHuQqVtm$3 zNVBYYbv4SY<2>!*@a2IITXHlRzU~g+Jd5udXdAwd4vDv~5PU)7`xY*KJ1(Q47moHC z^W$~s*?ufRzeUjFdT_1P??Vn>J@~E&;9KGFZ3kbe@XfXOuJ09Z-%jwESdiA>IncB1 zD{PIe2iIGC6CA$p!BPEWB6t|d^r~1;}+j1!iVsyl#iQ6Ovz|6eA^tpeDF??HmR)Ftx)k6O<_8sr=y~Ie0QSEI*#x3a6I2!@Zl&LO@^-tdN$v7i|<=# z8@@Ttb+jCOLGy1G^lZMJ;2RDeUgzIid=nkMHQ+l6^(Gnn${fDD`(k`QLfP220Q1Nm zkMF^UA&Mr$Hy?VoeO2INylCGp;oA+qsZlnq$6|%U*95*I$jSE$a>I9&!`FoK zWsrS?9lkY|eY-8b42N$9_@<-YB;#+Y!?zxMnBvO5-;f*ozDMxv`0WCp;UK5Mn;gB} z&^v(&l8oM~&?AnBe3#`1e-npwjQc;Gbt8i7B`j^28NTPBXY-}qAB%IU#dnLtR|>w< z0{G@Re8u1^g&xPPgT*)C@c6i_1fQ{qv{|ss995#p@crc2 zx7yO_hz!!8~9_Uya&OF@=J}hmDFWcf<;qZ+EUvFa^a%11U4&P3T?*NOh zo3pRZ0N>C6zAn(S{mobryDs?|Sk`fTesb(v1-{bM7@@K6TgSdC@NI`0$KxQ2FU>g* zh2U(EeQmhkwe2f@Aols)u*LTQ^iYh>zhdxx7c(y!zjqwIE#O-v_Vu>-oFM|7m z+yK6(p=aAS@9(j7lArly9pksm;j04Qv;e-_9lp)rTLL}Cudl_I>Z}J_!Iu}n_Z#AD z+t>79Y<&6qcgDWW&Uj?z;4@DFd~Z5@Z-LL)cbLVuwO4%n7J@IxzW1PK+gHCbW?!Dg z_mso;0{B`2>|5>dZ3N#ui64LSoqcgURs*0In=goa(D*(AJ+_J9#Z>xG?0zuc;=9G+ zYXV<|ZleB@gJ~WBafAh=Rp2xB4Yv3ez!=-U%}MN=4?UZ&@Zs3|-31okMGl|WSN~p| zwnB3d*EoDD!N+;Z`8UMk6P|uqgWsBMOkh33+1K)P&(cj?~-+YH}7Wm!_SpTkb z_=aO~Ndp)8ja{m>ItN9loa3 zvGsYB#kaguynQ+OF%FyWPUzY80kKBASeSGabGHi|-VRZxkjW ziqZHD2jBQ8Tg=uIpl90`0bd3h(!OGg?_h^-A^7+kza|;`4siI2{-Mu7ylN9c&NLVO(r(6uzu9g4xDGO#uRck?^^RUsl71&ckK7Twm=;?7 zjWc(fFtj~9WF9%BWgTD)H{K$3qTEJIj$dDVpJ`Ue{i*LNe*Rf}O zTy`djOA7SJ9g)7iu>8Hi;@jRMo{!&CfGN>r?E4UUHs3CbuhioEyYqRPo=3!dB&p$> z>*$4{hb23jjNUcSv-?e36PqvPR==0x9E@Ugo<_ijrqN{h-ge?w3cc*8R?NPW9lmMM z!zB|bIa4$!19`ufjvc>dzLXT}CQrFe;x7zZz#@Poqf-fV0Z<4bQ z_5>gOoW2B+_7&-68k=O>|0^kcZtRKn8Vi!K5SjlWbAv$;ahFl$DbHC z_Fd`lZA@a{42N%{W#45M-{}tDTS@FY#o^mx*~jV< zxW?i;)8XSo@1NL#BxB!bhp+eohb&f+^B&jr~$T?nQfqtEv)-_g*s?aO!pzcq@6 z;B*Rw&J=?yW;F|{}`n$m5JJsQv z3%)xH8FIrn%Hf;&vgfT8zC{+_Kx{rJM(xWR5o}*SIiE$K%M^JfX5VcVUxve11->Br zQXRgH;9Cn``pch4rytxuR&eVjWj`#R%!1kEwmTLt(+QMTCl zc7UGk?+%OaZj0{&DA|0|z*ic;_YU-IzHHnunf>Eli*H=-c)rcx8y~>;C+OLHW5G8M zdK};TEWX1XzJgJn$Irx=L=L9I9KP+~ z;+y60g-*ujpAdVKjD1%)e4#h-ybgM_??H>NXn!Yur|EO2%Qq5wcKoJca~lgK@;zkn zb#eH1gYO(ehTPcK$>G}ozG=euh{d;eR=j=VP7i*Lo&i1EzQT86e2-duAMX>-HxGR4 z0_@ugJ)3V0_;3j;e;>E_z8(@!jw6<&MMWvjgnA+u>UYzA*I2_nO7`2+C}3=2Za}p`mn8lJWQN(6jyB_@7w( zHd=hwIeazXOJ@fTA3yVH^W|)h&C^X5UxmZhbT0fbWXO$uB@W+C@R@y(`vdhjzQ;Ly zH-m3c0N*f&FYn{nc)V@#?d#n4l$;Zzl!<#n^a&uRn<- z8NUBQk2oUog%;nt7T@^%c)n8bnKo={_|Ar&&3700mZP5bZL#=HaQIrmw~_`+GJJf_ zZSxg>5*yzSEWYQQbMff&gWvyn$~hNjf9iQ_(I@TOYVj?0_*%jDlQ9mtvF{d#Z!`FI z3*Sc;-xY)7_;!FV$i6WS-_4)J?EA#x`^0 z5_Z`#Ck(I4XN8+)U+U(``Onx}0lke>kYxIunWNhny#gGbBSs0i(Yp+K#HMZq>|2X6 z*O%Rvef=H#n!xAIXO{2o8{h9N=;cCglIgcACMk8t1wE)S;tpyPo0~puG06!&b5j8tcD9 z3JR3g5km$I(WtcZ6(<&t@_o}Ixi5(J4{C4L75r=7PtL{vgAvo!HTZjLTU!+WFTs#9 z@A8z)j5+CZ_E~u7#Qn!*9`kHlTk!+i+S;ycYkQ#M)(r2cRVnKxd-=20&Oda-d5adT zP8n6@Wo9&wOv%h{9_cr?wl$CRnhzb(qosLdD)Q!$Y0XPBuYLSEXx|AAFhF`<%e8&F z@0*s{;hcTYgXe8(onm!y=&F?2XL;dSYctQeW?0I)KY5v}n@9L#MtEaJbU-g7(lT?K zN2HD!kuteA8Cp8d&*(I9|BL1?J#q1ZWu3g+J9NJ=z1ml%Z)*KIo_O6UB%Z&taPg%1 z>7H^ReUvx63LU_U5ngk;2h&HS&TKiMc|^){>E3fA;6To`kDs^fN?fL}9<3I(bgc46 z;pq)}U)+0HMkcy^H&u7Ibl+{BXM#mf4rPZwj!PMJh)3g7Gds;6k%I2#kMLSLHfLnQ zpO%i9=a8v6WAE;}QiSIyo2OtBNFFOHqm8LBtY`K75kAb#Jn@`;&Ky`%PgAH!J*~cw`M=) zb8Sk?j}5s!R43`p8T)i!-%-!GrPJ66rgi!pA1ENBbHP3{=Y$nbW#=tFHs>DDeRWFrYdC6%>C$V#`9S)w9a~7*^5es~2b{`j|0*w? zmJXM;xCUeIOO_tt;x6ea3vadX)DyJA-g}Fp_|ESNG4+xBb<^hBwzii9KZpDlYlA;% zFWn|ra+Z!3TxiMekv8{RZU1KBhXp@o$rSU=ZEYRawzd8COl*Dn<#_B%uwxKjegyYr z$bU6`S?k!bkTV@A`MaXigz^=5T_tkrTxj)ME4abP=Crj+^?*-)i zzgq0{wv>NCzBlx9@ERoTj+H#-m2P>C$XOZnjh2it!qC{=l@ngY?^svtWQ$6 z{pxwY;ni-!I$+lyA=l;*fR{$X31wte!AqHWc?U&Lh9uyyY}mu`qLvR z>8GhR>xR~rjMfb7Iq8Mb{b=0@grh$6u(qyyA3Jf^aYdPFBg!tw?E7q6+Z%0d+c2%U z(La^GHPvhG(0Ts)pC0R%GJC$)^3#Oe?C$9&H@9xM_MXiCXpaT0`-Nkh`yMgBZ^8Vs zZp~#`%bqRL^5&O+%N&NILHg-_=3cW;^U+UBQFB>WtfysT1|OO~=FlOT{iVaUwi7(> zfsR|#XcO`bueNjddk$6`77bGSzylqBO-Idu^aFQh9`Y>K*}MLRiW8Kj9ndth`;}s~ z+WnsEt@pdT9vt9TvWTNichesUkQnb5lB!sRU;cdg#By!p@}r>=ka*`iH%?!Y){yPA6% zySAa1$>^n5&*}x)DYMT9Ja~SF*Z1U%RZN^K)-IYr2PS z`W@JP*g?xXb^rXph5L8^`HGe*7(9RJw8b|*_mY`fXZ7{g9hhRZ@TL(_{m{;m2+;>UH`I+s%7ttPMhu;V~f?{ zG&B2}MJcoQPsyCVE<5E)6?+aWrW%epB^W=4pM1z@LC!s+|n=y6Y zS&;2#rY}3R>xerCo^t<$Q@jOe^SJj7M*A_DzG|+|p5qP171vF5_f)DLvF8rdo?F+I zKFuMZ7w%98PfVN4KfqfI3Z^&2%je(w#p2cT?_9ljy`Bo2?&7S{gbgG#^KsqhZGCf7 z*5$L=vh@|cFi%o&HBTtZg8t0eJVVVtbV&2bX*2KHXXdr)7YE_zh@su7aw5n-48fwc}Elgd$qN7 zKkOOIkK6%R?QU#qTfA^7-m?Bj%DNg&ir8&aW~5OUYgH^Zigq1t0b=W(5^>tEd+#@G z)4iLuP4L3=M&0H;+^ZYHGrx7q;^mn=wGBAiH}tW1A;sdzK^%31hwH{nsGVMK%$F3e z@A8!NdSA`yh2LPRjJnm&ESi0b3BpUp-pu})D-@UZQ>}PrM&L2S;mX*|6PtTw;nri) zQRlWaPa2AG8eAl^GqZhFCMP*Io~v= z`g685r>0<^8k4H;L(F*onvUxo{bBzqO3Pe7XTR=`{q>wTT0ZU7)^-Nw#Q&k~UErgr zvi$Mt?xgde)dWJ55R~fhNQZ={2;rd;z$UyD5Mw|vbl!oyOo9YQXOk8~CE^M_YC6%` zNt#zcnSsb^K-ozcClef*k<1HcbjLXEEIRHEVN@a#^821!r#jV5klD}Y|1ap&w@#gV z?z#7#d+wvE?mchtVifR%q17G>D^~s+SExJ6e`BPVAM4H^tz5<(BI4#{zIhq4@?+!j zM_WcC{in#%HildGuTy%f6oaQnf_}BK+ZF*ucPp~z9R5JDEw5892cIQ&R(V2+A z7U9kxW0~hv8*s7*+z-P2gk(!1C4utythuJh=X$J@W(kAS(g*j8r1(fYeic?_Nle;B zaZjN($)la^UXwHg+7$_~*;8RTwK8vC?*bjn<0gr_u%8*m?Ou6;#D{UGbB4&NVvXq)+0<9{!I@!=%GMNql$bd}Gai>B?KDhZ$Rk8LHlj zY)_OYot*d9&Ur@j8Ohoj^v$sk&VAN#_+P2_VzwmL_Cl4~o|J)s=>r33q&6#;LQQDN z;SXvJM?%_qyLvtf`X3XDKQT9c)<=j_w0`H$UFhgL=4~24(+VrCxg9NG=NQ#@AtP(< zFb3-F_(Q)hODK;K7gAp{a-f5J*J)9vu$mw#GcU=;Jru9~C~OIAWU8>eqh9YjhZT3a z+O}9?Q2jff!l2pRHIZuLNuzm&v zJJHjDq1CzW{q!giB_=ABd#|UlC2_{O-lSm2KV>=_T-!luFvbaeHimZZAKpWHwDokI z>o+OAxS15a^WTk*y{g~t-aitLH<4S^FZ@KXLUPS7zuPC9zrBXWsH!E!yEI6&O2JCV zY5U|>dlEH2El`D&Frx?jttFZIvPX~yarVhu)-+2}Q$v#{tO<@R6b0Y;7RRKuADZ{q zT)jxENpkGChJryy7``ek53RTZF=eI(foM&aTe2 zf!*#1bV;ysy(JZ|LyMZ*)YvEHFw}~T(!pF%j``_pUgvO^b4_g|Tz@S$8~f?evM9gK zyI4!KS49R(SKXyc&PQj&PpW#lT~rCntPa&xuunN-F46FY6j{J!y)tizI^cMS;>i-acJIqY;!qXE00AQwv*b1#V03Vvdjt=cTPu+B40@JiF11mO||ae2?;{Om%QrUnw`fysTkf1A6Y}yCv(6 z!}IDO*!9k}+Fpw}DYW(+Vyf++KgZ^W);1H^gLKqZyPBoi$LP`t$GEznhy0;EamEbi zqps%Ex@vEiL{(N%YqM0PM7oUz=@51Os7X7v+a96xZc^Igq4kH-q}PQ3AdsuMqOSUM zmvp{a*@NVzt-s4<+vv7ET6bcQ1LDDqpyaxMi;`9lGQGq?*M1C2ttb-2*j6YWE9#j<+RIL)ZmY^$5!frm-;c9PU+=huWz& z!TkzX>&-uE{o^#;!t^VX+}?K@mCST$&M1&!ETRnE^F>*7@7n{hon!kg;i@=z0dHz> z9C8hg;DUtFjI|by;C%0eo=)@_LfrP-30s#+EissMwuHk%+S-(s)6J>xcAS1sI_=!( za&BmKJ`(3#pD^8Jd!*LpvTdLWyAczc&$S9-HUGeGIQ05$f{>$n(bT`GA7@ZH~ZOIwby6)#ywQO4?@$TboSO6aTV44 ztXWnfEVVo5Ovd=Qtyg-v+1pG*%(U%B8Zf`yykZ$$Ee)ruXPezkO{lhMq115`W!H(( z@^!A^tl9cGkBX6(HVGc#Memt-YU58%Snq8OkN1X8tU4Td^rSrO)i>sboNREPvDZhB z6hgcA+iJF6bDx<=7QbGy3_H=Y-hC--g7weTvqt;6e_jv!H*|ll!d^rX+Nh2Xsmfd) zP;y^Ob;Kg5-hUu3TwUKHGu%!6ExpvF{OdI|)6NZU=Oe;(9P}8?bI^ZvBo7V~SP$xY z&04QCc~X$`fRhxrZMZu%1STU!Pm_lw(3lw|dn%l6W2i z90&RJ^axjTp=d2!&85N>XvwrT8blg|k4<}5ZB4|5wQf00Ugf%Mk0vTE=cBE*M^+;Z zW;g}wm61xXyXzWmQRLs}ngM^{B&D@<`Fdd?*F+r12+;s{@2f{T9eeuMopXhaZ)kRh zjiV;$kPM{`9jhfLMx_#QBGvkc+Lfh{cS7!&>hArk5f*)DQ~J4nnpO~Z`AC^>=muV z-QitJM0BT2ABn!hyYvK%BB_N;ibUu%IGC~V0G(L2i3q@89zNg>HF!g%#6I+6s_G(l zC(BAN9$@YKkcPfi5DrbBzEs_5otKlan_XHBTDp0u+qGy z%WnOAyert`4mOf)%#oKreW<7Q+)i}DU&chM!5u6S{Tmq>eA%94>AP%Sn>*H6lZc0( zJI5LwE7kFD_kl2u585vO_iBtC?w01KU$);rrjm4=C?zF>y(Wd&(I4Lb?I3$K#?|Ab z+@Bh2#!H9=Y@M@N>VE1rb0$G%XAGW*LR_az^@rr4qo~R|ImjrY7YQftQc!Je4e307 zh52Y=fdvY_&JkKve@FfdMnwh=BkjaP$$1?pivw{10c+rx#GU;#-KH1mi`p6|)x2~? zIal{kOHb9|_F;9N4ou0K_YOExHL1x6+tQ0XtNChRhI7pv_37|Ap081;PkPC=!FpS` za?W$C?t}L~X-Dr%>xfjd8B;$@GCz3*4J-AC^)fDXq#g+oV&GO(pE3yz@FNrRjgIB$ zbZqcC*C789jo0~L+9av->#LV+8@oZbJp!-ea;~4@jGTiI>uU|7D}#>kC!)c|z#WB2 zrcC{lJfA-@|LK}mVXfzbAREaO-3+7ZEuUmfp^B7<+hnYhyb9${nr1cG5S)V53U;iS5yD+s0Pg2Bkw}v)XaNLsfMW6U|NM zPp_h}nqST3qUMe$OY^%|tQa^YcEI)zJSkM^OuVY}Dxt2>VOG0Asm_i5m^CH0QuABx z_a7+06=oLo4`}}X#{Aq0&%l*9YjV)(xP=#YMOtEZd*u2T;xRC<_t@y&iPqS1r%0(; zO2b@Lb97xRSl>N}0h;xS35h{kz4R=*Gf2vf3dUrXHCgSDbbEJz3>y%mc2OXVZPb^+ z97<-&P!Hyja6BV~Ub#`D6eHeIpb;aUX?SS5U}uAg!f?Dz6aloOWD>KaZ52MVwA7ZHfVMZuA^i^L=$Ln%}!%v<3y2nP|{I`$4tryyRYV=@NZ35v@oU z)s}8=n;*~Vrs8VW)5fl!^6jUN7-`s!ZJzYlELR*JDnvGV%9cuQ@5M%sWwe)2Z(|Dr zV$xqcIl3!_ME|iz9nTv1jf?G(+YQ~`KlN~45VfC%0-RA4Hc)ol!uj7KDVHoU?)=F*xu5&V4NT>Af?4hlgxp(MZkvR(LvX5PQ1D)pmPVm4 z3D(=rb%H_glN}i-J4h#c%>P+7#iu>zg$*HZtY4a7>am_B4YRGGhS(oiMz@AZZ=SqA zwqcl(W~XY6^4+`EFMHJH-)Eo9Guw|RplFaYt*IYg!d%bt4wU2G6?*2ums*ChYrW2D z-YCX3_9@mELoCTl+Oja=jOwILR=D4}R_|F|W-<;_wt1Ge1Y5(6^RiMfwShJxNZQso ztS$HmSs?0mxVdHI@`utkb9Z|08Na*?Od zu9&J`Xt#{6pQMhzx(}{*ghKA^{!1KJuxRoyY|?mP#r@$(n0?mHpT^ckYExMU{!I%2 z2B926T;+vLsg@z7cfyzsz*^Ou@#gcVeq@NIrYclGiB4oSREp~lxV zP<4<-2uSiFQ)x>I!ypBvVok*(FEkFI)$QDau~tijCGp_A+bqkP6wKR1)CO7dYfZOb z6cI@z7c!qSy6t#6Vm%>w!*0tR9qdks#uHg3)NQv}&lp@Wk~QCuc%m847-E`~h}qG@ z5`XE6l}=gG`mWu6adO!07fDCR@hr52diMq$jG6A;YnmK-u;IRGO3E;WTuB?Iv@Ow= z!Xu%-m}fW=HthA&P5td}MbyU{o(rp*6oCe5xch)K`_M?}-1vhx<_vQmFw~C-b{{a+ z{~+%6i|+l>?1Wq0`#|e;?=#hp_#5U{-1~9)iF-dTKb#yIXzoK=A>Ltvo^T3f_GDy{ zS`sIXs7u1Y)bZfKTe-}r+7XxW6g3{!lZGcR@jPPp!7v?<$V_T~U76?#=~Vah9&BwiCz@@@)x&KUqI04v5kYBO zpYPh+R`7|cqZc+HXU)Mc z)+_VF8bXyzF1$sO8tiU*uQ6YJWJt}V^<*%`rgVk6;%0e_EhjvO8m1qz9g6f!Z!n-d zr+w2tS4liia?Phg{)g&3;{2NXJ_mn-IL)7MNABP&x_otF4EvwjjRRmqIf<@{6Yn~n zA3$t#6;Dv}z(CWXh$cJ=NF{gN)FAJsc@~2bl&HYm%{6BSrskIvrP2r)oTf1({{evh7o8pLlGeK7B?;R$)O-amAD@iAdYZ3Mz6k z%5sWx@=7WSoD~Hn#Thx36}o%nTT4qz$|`cQGfGPeiYqd5OUjCz73Be3Sq0evlp<$k zMsAriuLzN46y_A?RpbY7

      L>Z7;3JsL0PL&M0zb1>UZ#$SKZ7yhVYLmFJX~lcE&` zSzEB@JL#M6EY2>^cW%jEfHQ43Skg3lf-jH|6(brn9^vr!1p9C#x){;%1>Z zqh&Rtb=>7B8Op!_hLT)aEophe6I-Rb?~zNLW#u{GDtkPqOwD_V4KstRuPn!zjXzl> zW!aK{S(N2GwlxQuW+%y+TPx(^k_tJ$q`0IkCtJ?k&H|<4lH$p}f|rY670$dIIeTl_ zb!Cg`b=ZPV4UHSoX5|z-4za>AWawFtyB&rhqL=31Jya6(f|4kRFdC-vrCb8Fksp~Q zTVa{sX)m|$(k&LwRFq-bS~+JwTL z0x2k4e;o%|qzUD+c9riemosy6ijkY;TZ?kCB_~QOAY@j432aH$X$ASvCXkI&Av+86 zNP|EfhZGZ-9Tg=N&cZ<>W>ZzuBN7fpb$)P=Q&R7KcQsXc{A;^P`;NNG3^%KsDjVl3 zyS?kwySaZ-#W)K~i*Ib|!g4p4kwwC223@KVzsS`eY z8|>*j#gWxhy|JqrCJefxA!~X;F=`4$pGqx6ns5VaR4<_U3b~+Mt|%#y%k$A5Y6hy+ zew~BSNLeK%TMBa6%+M_5lnd?AdS>OL?s0sY+bS=3B1ck#NR+@VIoDZG2*+ffKt2z( z+rJPfc@-I1`8iozP`d^_)sU$pPbuQ16#8YGZ~~~8#gm`NDJ#*Gy#b3)1ge6pHSSs% zUr9=Sl|bHFoKsnvlLcQMaD&@u=^-=`@Ra_cG;>0z2UWj~`$A8j5?rq)Q~zP|%9KSq zqxMU$Pz)Ujxk$8q@J|74pC7m8y{>EXME8f>B@}>+LXjlli;7ERzncYcXeC8O=t%fU zPFb<)ew~i~mvdnoP!Og;MO0c=Qc;psQaEU|>~K-%AR-G@Dldo1ynIVRsecpY$3cy3 z9(9qjvhy?07(3CI$}KA?%E-!r3F~ZDA4;=#&BTYgCl_rkSDWQbwC_-&6a_Vuj;JhK z3$x|o9MlSU0`L_}T1_t~E=41m?W}OZ3grp#*HBk<8PGqWE(5t3bniI1R8;jXmP5XQ*%w9 zSCn@JxdmC&v$U&$w?f+lX%NFK%Jo5p%tCu<`Id}=Y&fZcitQOF_X@5`gB3kHzew#Q zu@;L{SHd>X6Bu+vqWzNR!(B_bJ6B#MtLG)!d7XcnM4#*WL=CMWrRY8x?wFG2>(A*k zK-W{!+2T+fqBo+;Iu7ZxHViBD?JItt* z7T+&ZZX#!QT0VE`)I8MNt(jBMNYWgJ7@p)#Ei8PzXfhhU&1hJs zfJ3IK4mD)PjA=9OnwC6cPJ(W_NrUmXXo$Xr?$ysiNhbW;Wl--g#>ps!iM=I>@}jub z1;({W3ZYxR!vuc)Ve;GQi1-7;-zHt453+I0M7&1q^m;#kjE~RlalKNabz$hZA3vis zTWaR}Sl$HJ_ez)e`lz^`Cq2X}U|A>JUnHgSH-~C^98x!bljsunmr7&#`|;Ps^_|k4 zoc=m-JyrSx&UD;|pAjpTe8BhB>v+k|`l<5AN&m_6E(`v#_^_2iW9@PLj8d#r!dd1L z*Q4l`?=VS`K1{&mx3d#nj|{jU7#<(G>kd44(Opsa+XJr023*?$uEzyjPYAe<54iTX zIFsKBFBJde0RE`~*LaemJ4_N5CD0uv=`P(B$(tQ;JtyFLUcmL;0oV5iT&DzFFABJ( zQXf3H4#P`~L{I ze>NcgpXgj7g>MK5?+wULoq8g^T>abTMAb> z9RBvnfcP&2$h#%r{<(nr69Vr4ARzuz0s5{D$dAbZ*AW5f|F?knvIEMKipM|;g5e-j zBD@SvfTA_9yQ3^5`bL~-4Islk_=6)FKLfi!EW;vrXe~dP@phcYGyXB?cE&%#If?N( z(5EpzhVx9uL8$j+I~4D4aK=e8a9%B7`X!tf6XrZhWx542X`P%X_8rv95vKHwW=uh_ z#FU^@ICdCZ+H9OedZ(h@0pn^B%^4(qhJx?j?+gzedMH zeJ2V_c|dCn6DA&7-;pro!FxJ>S`Uus3qYr}%?Q)+F=HyX3p)D$GL}LAT1UUin970j zU6T{en958zvmZ^##iX2~2U>7*kw{j47@~j4ADf zjB%367*jmYFece_7`RJCay30k7U2Yx1Ig0TF7!+R0f*3Yp^7Q(28tYqjGuur8HXJ| zl2d*g*RT5o*;l9PP=At%hwJYG=Kl@&Nd&ESL&pmI3`+zQYeACCKZ9oj(Nk4=Het|z zhqVbP?S%gho(jfCfvXrl54?-eu%jWTiSRP~!LbiN!*T(o*9e2> zPVgKjObX&?!_Tl%K&hQDc)B6Ki}B~c?-8cXKaStxM?9B6KTr4pqN2XwNAxS8Utl~O zaeYB}75?D3h@WA#fB^W$1#Ta%g{c`gy*Pq zJJahxCtpK4+yR-%jMG3Te?{~Kps!{8DDVcx-v`cS{A1vJ!WpXkLc)_(TtS$JBvpi` zs`OoiA^-OXyPNUffnOlJN#!BmWZ>b;D};II(nOetEk_AM&MnaSIANz6_HCw*0==DZ zrb>T@aF&X@2xqJKeZr6v5B@J0&jJ3DaE{8;$MjP;UuC?M`V#n2*uQ}m#P|-JErfH` zun|mu3Fj!nc`7}c>0jYIhVe+)n9O(@FpZB5`6_=B;Q|#;W1h#sGm~)xa5CY|D$jhT zw}QTa@o#_^Grj_xN_dOPPkS6tT1E$>+!@~syn*rk@SmFqC#w9^mm>a&pwnJrh6I&f z$n+4MN0`c)#wvtK{z}HFxLC!Q z%I87GB=Zr*ZLpU-#uRol;}>u)VoYsgDPs!z5@Sl&LB!_yy4ag|P>i+9pkhHyNkme3J1@oTsBa zG@hA^QEjE!j28eqbv${D$@e_Yn0(uFjL8qZ%2?D_CBk=U*s!D4%Lw*jB%2dF@6R30me0cPP0J|8! z2K)l!+oDSU0xDEI(jB%3w%9!f?XN=o{dv!ctGJX>Dt2(+7?FXfW>KyIgLHJAX zOkoUGX(nR{d7Pr7FJ?^jW(i~JldfS*{v(6&Mc^F9B)^<-A8;k(tH4h)rg&=@FM!Ni z#*2aXFdh%=(eb~`xC!)sW4sTT+Ehvx$^0?ntDqlaETMc)>v*~tQ$O*2#`A&y!Z-@} zqK^L`jH5ySn(-K5+Q(J1lRMF-YC6neOns~S7*|1`m5eKa*Xj5-Fg{B8!*~Pm3p$>9 z#w!rEk#RP7-e#q$ zX>E2&FO4C_pqVJ-5O!b@AVWhA!%81rx)a1-!JRbBpjP1ZFjLDBWbo@&h zF94m^btE~9fgfN@K7{6(iB2|9!Wb$@WsKhe-paTOxRUXEz`Gc~5Bxmi-vYnE_&o5> z7?aFS#vcNoVf-=hpBdYsL!XZSTgG34evL7W+lE13El+M`yaRG*jY*Lf;LSRo62|W! zY#HM&;5Ho(t=CCm+d%)Bj^4?573j2%C-JNWrZqe@9X`-_khe51EqH)G*YRA`FzlqC zaVT&o#$&`!wsb#Z%B!`EBS3$caXw_`GL8bhMaO@XaWv?ijL8oF%y0`O)XPbuTK5%wt^y^3)=^l8-5>3IRk-vk|+7-s|TWlUxLOUBd>`Xghq zjgJ_Yf==uAlAN``U+Q?SFs89lKVy&Wc*v;EsW0tmookknC9`bOF(y5qVY~x$g)!B~dW|1)e#H1m z(7PE^*xxbE2R_fZ5O_2mEKz#ffD;)L{}jg2kU2|7pTqbf=<^v<|1*^_rDYZ49l#lk zNoFSF2+;EwH-TQpI0^I}I{uxEr-5F_cqXu0$Kzp4^C$;(^uIBtdSMu$rqP2uu`qrG zIEHZ(@GQm_;MI&t=e3MK1bu^!p27H2&@&lR-7ICS06(GQuVVZK^n8i29r!TgB;eyZ z{3C8YKMDGB##O-U7^eeg>-aY_egX8y8GC?t>3H0XcY*$IjCTVc z(DA&+xB~Py7*_)ST*vcE#v4HY1LIA=f7bE*7vmkE_cB(1WAQ**vl$!XS3tj0N1w&` zHRS&s#z%oSGCmHxO~?NP<2KNrV*EDnKF03=|ABEAa1Ud$nNJz-1N{pf{qKy=gH98f zq;nGBZHy`GNX9dXg>f?QWF60)jL9bN*3lQ~=$SftKI5avlV^1FXBoc+dOc&Z?ZY~r zBaDBGxQ;R=pZ`-G|1TKN2mQ~C+kwB*@eDAgG#X>nw7&ra4hGn<~Z`EJO^Wv_ppvmj|_>QWNczg@f0$qcq$lE9@9b35$MqLd=^4UuJ*iM=*hat zphwY51UM$*N0`DTFs5*KF{W^oJmR5v=?IML*WVGBuz`Eka9W=H7x*bVNKP>9OeUP6 z^4OV9^8q5?=q3)Ko2=@YgzG3^u!wReOnNTBkMMY$moUZ&Z`!JKl1=5Sg%$ZMt6_7P zPO=Lb<0QSrn9|{8jFZ&Dn9}qrW76k87*qN>7|S^SjxkQspBPh~|0iP#OLa+0%O%D) z%JT^18-*FFd~Fmq4u5dO<42g{qIyD@!p&w(`9{S<^c%&M{2g&oG*Oh{IPCZlrnnLr zQ(Vc6ePslm8^x7-v$)7$afrBpeQ^Q%;sW-?1$?8pb`2F5Z1Mo;6h?bLL9<(WrVQ1k zD2g11$WLI3YchUBCmrT6CK)M=$$nB9<0RhsCVrB=n&}i)*d*u_R@fvk+0s_#!Abfa zV@mt?8B4pBFOY5qy1kt#Y489%CQUF{NcEW0LtCV;Se&j7jDX8RI1FXG~>6 z2kA@)$s&9TeqQ7QrwhYSDJqFL_*p08S-2)Tg%f25OyNY?0b79SFjS~#O+H--`G~6z zaS@;P{*uUNDl{BgK2HGyr9pe=hw_5-oCUhf_#R+N578rl?Sxr>L?J~@!5L4)bGJ)v`s@8GPNf+S*ng2oNp?K05Q#_9{PQrN$W0Lr8kSDf}+=-xEJBHh85WK$Z5PO^os118yb zGM&=CfHCnq7*jk;8B;u>4k9e2g$~0u^(^$SRI$ka87j8o6a`H8g&zPW9i}p!bXdli zbVwjP6Mt|l!7qx8jt|3j6^OW=P_dR*bS3f%dH7=}K(aJ@5P3z;0EfsciVz2-f%2T* z-9iLML8o{`T7W6sLgpdm3j>3A~oax%|B>v#g(nVOL3p(G0N-ENI4^cT?8&oXgWOz!&q%);)9r%+N&jX%Dm~95C z`0`-^5)fu*9HqO8*GzE9(v<;BzSv2adKMzIsCH)POvx*3H9$zV z!KhK|Mc#xpP^9*?=@2X4+)(yS!}uamKY7$XO4nAmxnA&h@%eP=yWvk;$j>g$U3y{W2ZfExVyJAEKdUouNKO3QV8wC(^tD5tuNtU!QwJacR;6zx>xFk&-4> z+|br15WFxetgA3YEH`2G>8#o%m*sbhyb0^jB7JK=456c+z(GbWGXfVN(C9)-{Zazj z4ay=i+wc79d$1;ND|41^E%ljKRz(K2LPe#lsYs7r^k7IfE36TvF>4j{pXDzrp(bt0 z&Dr%F*W0vSRgrqpF8QsXB9^+jVdf9Ps>O&lHOpC?kzL};A&NoO0pE~|b*D65x+6*? z@CKD3tz?l|P=QatrSgh0I%&bQyLy@`%5Qxcjh$|llwvU|tOYQ*`i%arZY`$_d`MnS z=HQEsf@hT!=VoBtjtp9ytsv{V`}h=IU8JORi!=obbmUA~a{ohFn~TiSTVsTh_XW%qc8}uU^?>xQo<^G$E&bA%xo} zD)mQw)WL2i))A<1mR0yI+ey*XdyebZHD6!>&N*7Q`gsbLA;`J@oIJY z%psLT)(FK^(?tV_rCt1ji}VPx%94{+nvqvlvb8jjQJ0r0Cj{NVAlc|L3Q(D}9;h^B zC`ULXr#=-(*y9C)WT+cdj%<@?O7b+r%_zqTRX(Z2#HM*Y6Wt70NOKBYD$Gur zQog;2&iZsvsbd)sbbQoRjL2tD@QfKKQ?&s?XsnJwBd~w!n2Sjf8p~=&P?;p&jnS?# zq!S0GCM3dU^-|2^F%%~n`_e)0{RZ-_P;ZI98sBCB!VCD`uEpv%YxE3*^r3q+?wkvt zmsbTEeXFk>#7DjLB@K^~2tNgmCwX!2+(Mz7yYWCo4zwS)NRps6v! z3-F_31LV<|o#fFRlO~VmQ}puax%P{oX@@57eh~EXJdn2uG?GX2W}3Wq7=T{h1;|^a z31L2*q_@DQm)8e*ABU*&Fn!{a_k#d=$(RVCZ_l+u6aB9N^3FeiX9AdDA^jrp)AYN@ z@=y%o*kQvv8;t3s$)k65_4-BRs`DBoZv^v^z2rh?eR|JB-caS?1fO1>B~P8>B6%Zq z^6m+c_a)@Ha9=w#{pJM7TMK!cz(n#!;YWO=Up5k|*RL`T^D&@nhbAure0u$kL!M@T zl--)V*#Yu)LEb`581vEPi~xC`LY`)SvCK#M{VqV>`;bTRYKNvDJ#W_QC+Dlr&?vpP z_z8=Y=XS$lav9MpgygtYqD*r}xRr(I%qvJq;ylIf9=@*atn!H~D>-BpL@`lpy42M~OGaZFG{St7k$vXh7m)8z? zL+RJdVHV&_$16Jh5^=4`n*?Ecd7;P*nF8=Zd~{3z6X6APf#W>nrQ%HXG8sQj9?gU5 z<=G*x4m9o1rt&>14{LzE9EUtR=-Q#liwv-rw;^vWm`EPA_L_cu zP)@JkhmiNWCXD&$@*e@|jVM%~N0YoenUC~q4yYfyCl1|S()&I7^tM6Xc!Vc;cj@HO zyH0xjnjnwb9_`T5yDdQ8hmfb)-)t~z>HRF&U*1K?8_K_Y3O>Dl(M5Q-5OPSrIXZbi z3y>$n*pK4Ac4+$jM}WLnAg={XByS#mntt@Hjy}EbL!ONL+M&t&L4dr)#e?Nbk0LaA zr2+CTLf(2!81vEPmH>Gk$U_zi{peY}CT~TUzkVxVd_&dWCE%kl3-F^Os6>6PLg`JR zYy8Mw=vxSVdN)BHnrh!cd~{d>Aq7)kb{zW6E9UG?-=eHVjTo27L3dEQ%tZd9vy z7WVYQ#!aEQ(FxwTdqMmdyLgPo`4nwl;my3)x}Nr_eVdBT^I57z zT-yF28WYa+{eXl$fu`!@(RT#eLEjG0k;3OYa2}=I$DUueF}{L$XnmM=j_(A{5x1&g z>AQ`1#z}mpJ5J^$yi|uDV7yjGOK1Fh4*y3!|C!HUEMb3`EgG&H7jn;yp zV-cU}`>~JlYs2;1OpDUupgQ~Vz(51jDO@@7mJa$}l8)_sRE;y3dF6Q7| zrODZ)S(M6iv%iJ~H{($6SLyvC2dTntKL1Q;!#~CK&q(^e^K>C!-qG^rp9uaL`>|Qo zK~EX`Mu{z;&WSz8Q^bZzK~mqSF(WR&Zge~?*+dIb^?Z{O+JqJ%+VLXo{^be{vf4A% zfV?;6$3c?VavPgDTb5$O-nPq1h}S+E+b3c7?^n-sf3V<_jumciRO6mYXVk5yoC5>a zj0$Y$q;66#qBcvGP?vLr`8@+-Nl&#*>=@k3_>_5}b2y^Gw$zqG*e|uS&}fOGJ-Bx? zyARw!dvM#O&OD=XnYL`Yu-Rg&hC5VuYsE&W?n*T#xJ{d(8rv+bqxP)xVS~k->8w^` zOJr3joGv2ARf8plB5G*%9`IuCZ)@21Ee-X_#?GmlAG$ zt%P7#s)@12nh=8!2OBx_g-`ZVWwV^{3jNP8*=T*k%E>OOd-hjNG+x|RrO z$dEW^S_gH7o`?e5gC(w}eFkY? z;Ugg@QbYn=O`q58tbNRqURw>_YMqwzwY}KA(-~<=t?hB`eXaH!kvp8&U@aMYX76pQ zZJs_b00VMHAWa2(l=!qz!;z4-YQ-s(v0@L^B}Qy59~!3gdTo&hW3V%7Tzo8SrIz@5 z&IX@9ccBA&=$WNUMigJ$F;JTShjwXpVc#@c1h!7^tbtYCj-CHpp|nT$?mpRqZVUEY zY!|8{YlB?2;fU{&(cm%~h3xLVKl9yOh?`W5*zS|Ikv(dFmTg;H@uT51(`pw(a9YCR z#5PMI($?}Ac@y&YINli$);9wc=X#qN6|2;a z5;e}4n;b-OhkMEX55oR;NifUN3#3EMtq1NndN{&5DXz6?;3(~TYV*d=S`q46W_B+N z&RiA*0oFF`d3alHOt9N7wz>ni5gfmV#7ayVuWyJxg5g zTysTB@i8{9E#hFqO6+ZX=)pbMo+p;s?wDh1(VIS~0 zwqc&OV@DezaGAE$;I>63Hn^RUExnD6uBC=5CB?N=N_+udsii4>j_s1Cd8fKTUi5Ei zgS_ZpnfnH4gS_aU(*}9bKXrULfZFM2ufjuFQeAn;JH1gk zogJnc-;5~Dcl4lcU!i^FYL?Qby<(4J(9|OBGvCi{OLGd^9V9C z5lPxY!y0FV5<)j#ePhgfYRuhRsJi;{q^3k7%Se}8_LtKt$+GRYTU*ArL|fO7w)mUXIrVKuM~2~)x${wS zw4w$~4!`}PR&g8;_|gi$Y#gD_+r1{imFF>bR!f#tb2YJ|zQZq6)kVMr+In5frK-lr zs#=*0V!7e)v&-|zFGOu$O*=db-`YGdaQIMacv_TUp?yx;acN<~57X943+;DUKfPDk z<37K@5{x{p?S<^x9ylP?8PU}-qBj%Tqf}T!@6JOt`ya_Qet1i7lRaWnZF}O3*=Xj$EMuB+qxu?x-pX0iSI z4}&*`%zbE5?!xg8rOo`N<^#4Sv`Z({&9l4r{@QWOw~uxYTarz6xE+3NPUlgmGs10q zW_L>pd^tS9?yjxvhvn1pv%D*Uj(!kP^-*M1gW-K_6L@}W_lgkOFRR8n`0( zs3!uTswHywVHtZ0wj$K>F!%D%R~1oDu#KfV6`miNqN@?Ked1vICj722tw9>>lDCdj z`xc^(K!5XJxYD`eZDR`HmK|xZ!m;q7mMaHijGb%HRJp^#mNXb0j~XlsYc?7zUGDg? zbthV>v9gUR{6*tZZfLsj zZf4Vmn`x&~*m8fk_4%#3y4U#^Uoy;(Y1#f(4+^1Jf>T7`{8ZsBTH~iJjGyH)hfh?D zx%p!(>Bt#)@Wnyy_~h6_-n?XQ{48=(5?I__*St;NQZFGU(GonPX<(Ws!ctccb*~sL zqotSyQe(5XIhuT2f@J>6h`xX;VN@Di5vt!fcS1cm-VruT7ketL1(mJNNN+SYoXl>G zk&xrJIdc1o{L>{K?eS_gsxkSMt6h1smFlXRc5VhfKr`Tq zpM_W(6?7DKzbLB1ey$GQ)Nprdn7{e^I(?K)s$5px5>xLnI(AEz^qS}Wb*1FP&yS<3 zx=LwxIm~XcN4d-SOs%0~us)v(>JNr#vD*#yHKM z9qHNz%lplbORcu3YG@aHR&8_8nX6gbFG@{qH&8}L)D3#I@RYxcjH3Gue`=p-ZHRH( z6RdM$V1e$Y-HmPTrdJxfU<=-^Y=~AHlo`u(GHdQMTnduVI8k{;L*9{)8R#;ZXz?%V zFl_`dVD$obkdZf$4l?b|mqlyVz0W2B^qawdDac?gStKNP?~507P#ssKf?l;+y7zh- zTatpEV*lY_bUak+o!6n|V+uvyFM5Ayyh5d1Gz~T>`LgFu>t`XJ5YHLw_7G2eT0%%c zN1SN8#3rjihzQ)Lo7;|`Lj z468<5#^>fG-fK^trV`Ua+Zoa4H=6zNYEJ z_1u)gTrR1tfSNZoGpS%Ut9wC%WEs0!m>YK40J+6|@C!JQy={$MN=RSZg_iDpEEi4k zuN^)m)%}jCI@rj6Bk1}TS9~%&VBMKL(Dj3MH8{qos#;KE&0ui&*Wqdn5KV~D{5{FC z)bRwVutqqoBV>`36jh`Wa-pTKty^^fYQNd)+N5eDY#foWmqZQaqevfLsBY4*lBBf8UO$LV(@F#SS%-KZ z@O_Jgs#rqM?HobVD3NG>YgIqny>FVhDLj)oeLzjzf!B2L&(C)`$mckyt&3G$4wD!f z7*7XDryW7A=J9oJK5{^`7r6gOIubiKha5}_983@_Qn_sXo5^dRTrC`qayfU>G?#s{ z)qdyZ8Hf$->48s#3TkRGj9o;rEs|V|Os+-7HMR(|frjq+lPMeTg1vh~Ef(_+&DKUL z3JU+NF8o{<_32ISRO6T@yr~A!|B1k?9kiMQAD-T8&DTnBgkP|vIVd>_i(;eT76(dw zZZ4$+$*>-#@g8cJb+ln~>uI%GQDsI}ZqDD_T8+mGKksIH2AP^XsdN2RrDt9;v80NO zRs9L79Z$ws_ZgIPRXfC3Ymrp-f;P@tWLWleVlt+&kQ;fkS3S+$xy)1;KGg7yRXVgj z0rhA*f6!0?JFt`b2XEYe@HgSv6247+uQP<$k6Fy}f zMgXlCuXcTlX%Tl*e|_6@7`N!hSl`b)g+@ zz~zmqt3KT&p-hg1d=!kXl9=<$Jm#`J<8tnRs6+dbDnun8(HMjT%gf*T07~Hv?5wOfgbtF6sGi31*m%5&`+-1}HEYm6fP6eMe zqGKg)W^4AVCzf7MbT=uDeSu_Kgr~QTO{k{yYO8I;(av^=^&i6yjMZ$#eE(IbhuIRx zPIC7mj~p+GWC`<^D<-(h3R~5FpPo$!w3txpTU+!3@x;D*32KUI67_8 zrGnPjpLh#i$3(2u5a|sKC-2%QdqamceI~m@L%pGx1R zuDzz6qmAb8OG##Uu>wQlS`PT4P@_K>!M3kP?z{I^HnvQs{wx|{le8u%?%_9#oo>nX z^YOL4J6nzB-D+nw^PO=l;Q%C5u13XECwr93>yo`)5td;|mTG*y+XEG-Hw@A#5~%gY z9fzg$J2FGZd3ramOMJ0@hOy?)Y9rpg?@ip(%FwYZz=w^cbdjHJ4GxEV0pVL+t!fAq zc_rB}gwM)vorAfq{4XPSz$~ zP#c?5su#1CMX0fgKAibqRo~LRFQbQa_W2f`AL!ngwpNfAmuJg#{5by__8LY^(eK;9Rg`l(bw zyZ1FYrir3zYHI9LJ@8;Z6vbqI=$d~SFML5wsqmXM52`Z&=o=zMEvwD-SH-+Wwe^E~ zFC6yC*1Y7y3QhW@A`&=oudQ0=!$Cqv8#FI^|ug9rgrhDJ#h@Gro&1p;G{G@6&mYT4B^vrkDqq_dN&m^YD|NAdzI7iGe zB!0~mr?&^M)~){LoS1i7zXL<%VTW3q22S*1Qq%J7!MBW#8B*gz@pl=KPw1{R7-A`# z(7)MFQ&BCeMYz~!;**W$d!%_(hs@=ixBG8%d@#_yBeL#i%4(N=?D`9qAX3YW*7~EM zejb9i(jzX-=Q&2=ff^jcjIQyl-hUtxQLjxRB6_A~wdO%YnL{LudYv_y19dyllw*ur^;TrlBXZ-5^%#=vRsC-wbs)(W#tGRcj`94Zb^k@` zLe(}a$I!+*WP>Zn#B)#y@^V*g2WBg4ZU@zX5e6CaH?rmY&L7QD3w{4;KYf-TpY%)U zsySKAs~!GE>8M*=^-#Mdy0$s(#cv!(2F9dcw$HVAF58V}S<3y9(Y#2qwC%*0BUPIC zQ=>VbX9)Jc2}K8!Dn#S8jVV%+{c=ljQZho+IHdXcbY4lF)SY9Eo#|TO#Q}N=t8Z>dNv1XYTuqq(dYWVy4=%h#N9J^>tCB<>C#@g%`2VyYas@<9! zAO+b%Z4V8@=5@f9_rDYv7EL>8XC6l!R8HiO^~opsqqX4qemBX!Lk*VEcy@sy$nxWe z%W<0~=QTf8+@$gmIbjahc%Ho>4{B$eWS*myV%pY^YML}9euXq>R%*UXBR|snvY#v^ zJ~vuzJG=LP3x2e=s*UfD>3sW|CEByvRggk8$8Arxo-n~9gpo(+<|(}ci3n43*>jj`8C(EF?4_C0NwYjb|*wM)6*@>uoL0UST3;PM3^VPq4z{jt8;`a zbYyOHnbNyl!MMQ^<{TJ!F028rAkx#@7G_-@w9poj-qUi<9Zp8>4L3;dM(%z^MviW3 zh^T*gwAzMh4hv8JzwE=vCT)9|C3^V_Z9%aQtqe>1_FK=n#D<1*@Z#dx?Cd#SM~tNO zDxucCTOJediXiUvp67x+y}NUoQhPk-mZ4FUst!lG!wk}i$fj3ibQeocM0m_^HpC)I z%3Yf67Nt=02Z|DX_p}&e;^Nse+hZSsoEPypC+&kP*7G6kJMxhKHFrpTF~aY3A1L=P zkKU?h@VbiUa%}>v#%mjKDAn&NFZGc`Dsih?9j`V9fd(Zopi+GgaDTXJ#|M-ivTHNE zoM@vD6ykc&YT0)Qe_#_&T!f7rAbYdirrD0_-VZzvV$159-(OKh?N6wgNliA{)QryQ zJb!;+6u2C1*OX>!^nQ$S{)snw{=a3xOA#{``rhIUkj?M9fk%n6wi!>yEsWi@^M#Qv zleF`d+i2#pHFj^cnyXi+IYio;o+gQVQ3V6a(}+3=g52Dut}OHM&#BV(KBcSXB0 zQ|OTp;>SCi65hWQnn3oA-pHEel%6u$1_tI&{Ca$Fchl*bVUpWqfD^P;)kbtTy_i@fF!6}|2(`)^!>tp7A#F{5Jz5%rb$E~xxlAeRx|X;IqH5_i3e5Z9of9`6fE*Ho z9=nWDkv9U}f9qx`?jdPdZsJ4Mda3Le*Af>iw!GwD*$v{|+70H;k8bpC8S(|?@RZT| zB_%A@v!r2^#b^yR#QwlCx;0FC^JG$N!!RYyu003rZZ`IaIx4JH-!Vf5i0RhW)DJI( zNtWduaNx~kha&w*q4rL%pEaON5WiZiZ=`eguX!WK!NqzNIUtHy#NoMwr=(o0ezNF- z%9zS}hy!Iy?hGgXY@t;3ksj-a!qk0_6y3b)1^eUTuloujhoZ~YdvK)n(|*Zh5;@>19A zGbsx@g1qlUwEiLjbrzMgn(9Api?5tg>GJ|C?a~&8U56t%v5N? z(v7%jKF?3#yg|64@J2D>xN+WT`E#@LcjxX6LgU@|Sv_LXlLpLBg(F|B2TjT-yq_m# zPvEonP8DgwykM}TEOd`D*Cz+NM}_P>VOPsz@10tjsWPkeZto*>q?60IP!mSyYF8J$6&d1+q!q@d!O`{5W z;b=Q7vsU919PdZE_jb-lO9Pan`7igG)QsFa9AP1uo~5QnruRSvQ5Z$xRtL?IiUv)cStiei zCkWev%r*Sb!~1)o7L0<0i8&Qj&CVyef4sL)Fu{=pOEug4-8tF|G6rN%o z8T#k&n&NovP%%BB)SAHVZhGOmc^r{AKllEvPG{1$3g0+pj>4;YlkpVB3(GhOJjuEqe-qOt4NkKMq^&jF&>b!%zI(=0 zbtLlW6SDPTseNDjw!?#&G1!jUsDEbt1`?xA89xfaa3-zJV2*$VPOh)N4RInXPFc>1 zx_{W%XQD<#(5&enrLt(zHIH1JfYUGAaB!qhY!_+ z!0XUUkfA0JPZ$N!`m*FseAzPW%^1UTVM;VyiWn;-X5}4MyF8e0bBs{Oe3ZgL8+M{y ziIBcmSM_qrs)h)!NvdzWqiS!;s=5gDOLsO5KU}lKV>C}!`zi>k^+Wvg2~w0xUD1jW zuaCQ$s_Lq}cxHmcSDL7#MtnJ*rm1;Kq%^HUUF^9!|gROc-rLs*0pgP@Lqsre;EIaABF z78mD~P2E;fwqlf7ZH=i+H`))w&dniWYJ1VrCTc`b;%zv zIkBjjqz{rL^P)jAEeR#!&U9w`N!2)R5Du$uO%dVz#g>+pRFq_u6w17o*IfCL3E6We zWN(BrSg2`xPPVLSl_X~ulxI21vI~myG)1w#Rt44oESI*HVu3T=DqZ?G->ST9AjE@BE@+$I)MSq6!L9Nw1*N5QPo!Ek>LgjWniMVG8h95gJz;Guv5=fToGg|U zC33lxTe7t{TYfO73_9MArMCv}@h!gv?5?{@>u)(Lww7VZw8FfSvVw~IqVnsRwAHI* z6jlM&m&=mHl3L%zSz3bCDP>x-%vo_gAJ!H1l{uTlb+Im5y7)R8ugfV{kh1puXrMP69j)HU{*VQ_J3`D*a z=Os`L&nb8ual;HV?pwKP?YfLL_uYTrk_XloDL=UA|1tM2 z@KIG)`|z2WWD>$y6AWX(s54w7NVo(L145fX3_-CHq-m%k3Jip5J;mY1joXDwU2G_@RD{$B_m^&-U1Y6ZylM?BU)CivS$jbuDy&Nk{FWA#aQ$IY18{;@ zg8tb>->B|}z9_d^lvoC<5sh_$Jqiz}h1k89n)6c6iMmcLMt3(f=s`iO7M06DbPrB} zvRdpiTi&V4Uml1wSd_bn9l3{uu+!|XPe&cEyrTru2-Jv5g=LCYq8I8G67i#4vrK{=!Cjo14r<1ZogusBc*6wH#ECTFjKJz%sZD z3my(>vXG+l$c6ACizN+QTyphg`-0R9Ee?NO#ueLBWMq}BT*I2y7I&HDsE)GbCFRiy z??uBe9GDh`;4@kmMF~j{*b}KaPGbEUS)MtVd+?@i@WK@=oOK4uS7I<&4r4eH!|g1` zzAhts&n%y_Nb1_8M5OMmy{?&hOr=|(ObWe~IkJxL>aX7@cckS=HXJgvLr#l#l=RYR zINrA1u5u7zm2zF(wIg>)@9gDfWFU<$;9=C^)^glL=#_A^q4cDXEK(#2KG^TzC#vV6L5(lNVSND(&L&RuzNg!E8vkm=q`sSn51W&eQd|kXb}lCTi8LRy@@1T1)-fYk4&!=k8l9O_O>b(QS0 zNmy(~dsXpDv>6eE**oX!(W>rAP(%;2{o4;MoXyG}Qq=Pdq*6x;j*ZnX;P_ zbR~~j5^KQn=*}dHt0y1x(d05fEw(oRh|=v6c8Ns?;0+ur>Wi()qAIJ3X;e|C&yBXZ zE(^DB$X(s6o36+Gzm!6{H{2LwrZXCamNEOL>@ICLTHD4l1=C!~lFG>FB#L)uP*vBB z9I5ou#h4B_l!S_~W@L*lU#VwQG+zu@ylGdx&CW5BQb!f7TwJzdSh+m_sN&d5R&F*S zO6uB4_me2%xK%&3lT>PNfpip6(gJhP`&S=8&?C|m9eR9BC7#2ylP z+%CHKy0*-I7_tOC3*MpiDl9N|%qVzh4x|;AmzS1J8a;X`9%8InI0~zJKD)%asH|kk zXnJlRiB%nMY({}2z(<^R%K2l*jJ;}1=GckD`TW}vM(O9@pvPG6cX`p`vEcN~2p%im z`Y6UGw7Te*EL-ifN6H&G-0(SJxA*IPft{$KkfFQu`Jvf=WNq`kBOMsrcd6 z6v^^y>Uya4PjPbSn#aUFDA4|ZG+bzH;wqY*r6hp;HYqjpdti?e=KT*O}%Y2-g4@%p+```VKD{?a~mJpC{0!1PBQ`p_?>4vc@t zas8B|JRiXqpbq4J-Vy(G@qI-e#(ygPL0``!kihtB9s2&zk$jH^yVe4|bF<+o3OBoJIoqzv773`ze!&@!K8tdEH^pF^>3$9p!!4 znV&=7mu39b`Q74>|D;2|Hix`4NBjzhKJPl@bB}r*SiZfE>z_OH?{wIEgY<_-2eW@C zSi7YD$kq?NzOSRd)HwA0jzeGWk*)*v$#>}gfTKUb{&|0ha;Zd#WmXIppLFF zHYTqt!^Rw|l3@q(!sWffVDpB7vQ{DI)F zbD4p5PdRr3(=R>kPdoXD(*Y2Yh378Br4V0f(*r_J1APebG@G6-^ba9(JaLXq&m_Lq z##zFHe-yX!h|_HPETQj0+Css<04^516#VOnb8Y@jLcb979mLaZ`fj2B9%-Kt{C8mP zweDg85e^d1u<&50O0(LZ$mN+CvF{2laE;u~x^Lxlbt(9;Ef0z6*uKH$lM??NZdBL2Fa zHi!5|8_yJ;MObdm5j-7uf#8wA%LMO$oN~cW16L5wvgK3>oqkx?6X)A>j+w66Hr^~e zd%@En_!q#9f{y_=3w{xJzu?~kA0)oXmh+6z>DRWEn4J~jDDgLJ{DSZ#zz(kv%i`-b zp$9=fE%<*RhkG8l#3Awr#O(A4=ZNRp7>hhr7n6`ShWJ}H-6!;UpeGXFY|~SSIba|J zgr^ETX@Wh-cZ}fWpyvoq1bwF9?*MaNV;gu4HeWz23#nqEAI7*}D)_g+6@otmRzB^K z_FA;JD$==mD?(U!7Jrl{EXmK_6xyNf!m4a+wxx^USQ*w zh(k6$A^iOAjq5d*YYo!AE4TspjNs$I9|-;p@TY>G1m=X}T4>9RCx)C3&=UoJ1e`3G z_nj$%Zw5{k+yER9ya9L!@giGh8gY@0(}m~f;29(MZ@}XP2T?DX#EWhI$;4OKIEQ$N zjb{q~C9q+kU?22cAozP=Dn37!CaQgA--TY{GZ zpB8*C@VkQd0DmCZ7mL16yv)|&Q=z|yGj7!^*C3l7Lp&0WTtJT}4%l?2Cw&j-iNu%L z^kkuL0iAyBU8y!bRp`q>4-gNu=|hChd!;nu6q}wd^h-b=L(Ih&!g!&7h_Yl7FSqHF zh0gw$MT~U;Lypi7gPupc!lus@dJyMX#G`Eb9HBSjTqrozi!n;@Cpa$rQ@!IWJr z_&V^H6A!UvRtSAB=)A{st+eS?#HBV~FFgMZp0MC|fj0>riM8uy!E-?0DmV<>Ab2It z)SLD4U5MrKIvM3=K$lb)=Cm;6DvaqJ>v9`2p6ZexL$x(bFwHnsFivVe81ke6=LtO> z=eq=F;=DmHPHKM^@{a+&Pw3-u-Ypm>>rufAaDH5H5zZ$CvunRE7$>!sqf9p4e+!-S zhK2q~I;XaNf&s1mf-}*lxRxUi*ABS`&kVt(pwAS{wZJz8bDEoP@Glfx1X+AeMwy(i z!UoU1f|r4QzhKT|+Xa^cKO&fO+K&ZuPW!cB&S|d-UJuN57xUu$_J-h8=oycL^i4Rf z5X`a<7rYsCuA|7a6~}mk=W4+_&~_#XW;^2ZLGsVSF~i`$QSbsZrX_-lfY%A;SY9KT zy4^3B<9ZBaQ6@uz;0n-(30@04S8yWIg#=fDzCtk5mJ41F`U3|2LBZ!>n{9%*_8bg8 z=F3}{D+GsuZxEYR9#REoLC#3QfNH!V&q?r%6FU3K zM8QLVvkiWZQRL@PIbCo7_-2EL&(6qm2K12N4}fnM%s#@gg**&*2|fp0BbY-C#}@K% zU4Oq|4!O;O+1`FG7-Wlk?U26(N1I@-kIor9923bi1~&XmFx%JV7@J7n3^_Ll&H{ar z;5ndwTQKh->I5_2O@dE@{yo9Gx7Z_?_4uk_wtYT}V_rUBSDcO6ei8&z=7oZjK~EOU zd3=Ciw$<+${Plw0LfY*HeUE{g1fnDzLELH~=! zki&f|D5o6wUBMN={}#-3Uo!3ubY24ma}7AfpidLL74$;En}8P?JSBpu=PJQ3A+HL9 z=R1Pm1^v5%PXjj_JU8G>H`E--lJ3a&yMxK;3Y;O`1v4}7n| zf4^X^ySE751iV!+`~D8W4Zz%wjC#I=d=CqL1^Cy3spoOQCqREm@N2;T5WF5Z0naok zCk#A5Fw>?A-URyPf;R&X5=?zY3!a1YlLRyE6v2g{X9>Oq_(s9JcUfTYFA|&zI-kW; zA0O~qgXb>6iJ;dAP6obLa31gugZ~GDw}Rd*nE4(uc%BiQ1NyTD51%_z2ZmP#mxAY% zL4QkdJLqoFxmAHfSi_X!RFryD$@1-}J5j}?3xc#7b6f#(_giv*{j zzdUWwTLlL|kH}oo3eE$4o8Xzie-xYrp1&CU z?+Bg+o_7UTpuW!=Jlt@ZcH4|PN)XIBWq@Gjn<}^k^veZ513XAD`^Z%Wf2QD*tW&`p z6V?jO0{>=%{{g|1p~sH}pF!F~f5v(NXHhI8 z?`1C+O#VTF<3S%P*atj9Fz4%Wf)hbsE0}5T5}XBkjo=*M?-@Mxf-^z?zF_v9M!{8( z^Mt|wW5MIWf56~BZ16vC@V_Xy6*6BId=&T}f;T~ar{K-N7hfE0lLG}G1^pU>{#C(S zQTA-X4Zt~q_d|Yx;2ogP72F7XyWrixD+D(K*9d+B_#VOgfqyJ`2xLAZ80uL6EjSJI zmkj!E1vh~HnqZEH?-@L21kVKhpMqxr$D~Bd9w)dQ^nQXl4i7eXt`J-V`f$O;z?%%7 zdcjYie;qUEe>Ct(!7bo~ev1vi48B6v6O zaDyjZ@Ep)b3oZnnBAEHkH27~6TmgEa!L!uhxlQmg@Ej3L{azHD0{ptce^PKN=zkU* z0REf7^S5z9 z-fqxe6nq-=zZ!JcrM3>cq0hyF0j+_8n}IJC`~>hwgJ+!JS0M8n2K{Ei)H5V_Khl;O zJY|9pf_{hK7T`+3nZS1&{P!DptKgH6|5Jnh--1to{uhJ(uHbh;|3om~lYABLd33wY z5zKccGY$HUf}eptvjw*TR~S6s6}$jx?-R^=X%PGx@GA!Y9|cpNL6=8$NE19BawZDS z1YT$G+%5P6q}?j`9Pp0?p85}XJ8Ex};176|4$x8;Hpf!7KKi&Z0-@6EOd9s|5hFj%Y~ z2p$6ZGlJ8Aj|v8h^=rYO!X~e3I(SZN44%IWP6qwF;1uA?g3)>zBAD;l#vAlWf{Q@^ zx@Pm@7!7F-DW&jc?6ZWUY#{Dxp3#>RewY(2|CpCy>|n+*Cv z!6>fvwBXI)KWfl_Ew}>obAtH{-ZR*iUj^(F%r$4SV6Hg_38wrs!Rx_4)}Ut!-U|8* z!R#aXf_Yz4Xz<@EI1K*f2E9!1CeYUz^ss>+Fz`0Pw}79)g?qEHI3sI?`Mx_|@H`jF zDEQwvCkpn0j@tsoU+2NRCiqPV!BDE`)H5J>4)74ckKmjpnD5`x1zW&l1YeEwc)@(H zk|~(qj7}EJ_ZwM)$3o{E!5@I0C%6P?^dq>wMerWr1%l54 z7YUvTTr8Mrml+t)a+UE{>^aiLU{mjHr{O(-vL_3NpzL|Ojg<|-zX&`SlC5OiA2Ouj zAckqJQGzM&YX<#V!IY6FnEA{R%zRib%3-}JeQ0b1Uh8j=v<{@JdW1fI1rFeFiO#AX zMQ51WO2)kt!z3KU)H6pgz@%yKdCJvamN zBZfC2yIi8Dva{%K+WAWGCu6P8Koby?cbwpeZ9!)`r9Uur_@?mSq`viJTIRn12Qkw! zICY~9mCa4v#D;i$XeDFa%)mT|DHGxpW;%3Pg{kKV!PJf6KgmngZ-$*t*Y69kTR`Nz z3(We^-|3|Zy%BWcWUSQ~l&u6$#5L*Ed9q;YoF|w%&k{_Xl?^5BLZRcN`jnPK(-2e6 zoq{RnF2S@@tzew2O@gW8_XIQTPX)8wM+D|C>5hc~KaG$_qG>7jPsm;7DG;k-X;HX_-csk!gte zKNC!&`##fFKliibL83ntHW!PHl^CGb<5Z&b0Rk zW;xXO10L$zD0Ip>D0n>1t%8~MnBYvDUpMG~797C&ZwCE+!L-u{f@voP{VgBm(w+<~ zGx6g9-RfnrVzKK5Ja2+!-9ZkiuPg=a zd6~vTU^&Tu4H_Z)e&icn;yL(1$iqRN?}KNi;8NgOg86?aWF^n5$hT1NSAlOKF2xVR z0v!6g)*|A$_(3Sf!L-Z3zfACRC_9sp&hMN(z+9g(T!4d^_M=URY2!hH!ETRZLZ2#h z%BIemzd$haxm9pE&Wi*m;=E2U>tVCt0M7daGvB8KvmV+F`b&b-aQ>a(be!K1JO<}? z1kb|xtl;rDPjE%`ZY=${JC13kfQ%V*tQEO-HMP;e3OIKi~fM8Rw$(+s-$W(nnDdnq*Nw+b!>oq=tD zfwG8i#Dp79OhX~CZjy&8Xk8|lyg|X_WpGv4XDx?UY(tdU*3TYK_4vl}lm05`0b&*$ zAq@xVcVi97y3{&QPBJC|%El`@g;~E>8gwL6^dUGij{KCT=3-#VyGH1&mt4U(S>F&$ z`Lq|)vRpR{X8x)TgPsUnDRlC$6-+y+aS}W%UyaZMI5YIL?xkFo_akke8x*TOMsZ+9 z2;k5*VcE1zSUselLfVUglZV^(87P?LRclV6PZ2t8lO>okrU|C(>jh`xtmXwtyF%zJ zmzpC$4*-`7ooSUFK&Q$_6i{AsAaTy#stqv{w0^a3|moF-fx=M)t&%Mg1=RD;<==HzLLm}bo zo@KABkz&|Bb9(W~GQVfpUp7r76WfhLG!x~&q^uX|U&!nbtNhHsGZWnXe6B<%pXqtP zE)kvlDG_FrtxhDW$5zmT8=ucrr8j;vUt6W9pM~XROMB5xd^_|OtNc~XUja{$hE5I} zE-EQ9BD=SvuJMk<;+|tZoxjb83&zit)FZQ5Zqt>krWY+UsD<(G3RJ+yK{A@)QDthx;tK4R6d{M_wrKHtU8OX@@$7e^Woo2GwV+FW%*aH zgm=Ess4vUz=%ZcSODZRzz1DLNtU6QlH~0yhU$nA|)$EZ?!jf`$kBd-gagt4%Y8+8_iSyT>f6qsIh$KRVtl=1eRuLsKm1<44FXs7h*|z9* zYZTn*EFLxe>)#j&2R69YYMVWId1*<6PASWa=w8S6Hl|!x^^j)fgelsgtB4| zGD`lJk?Z8K1yC{DYSt(^+?fvtb8z_ARZUwZyA)=eS!_7%iWChVwaYpF&8Pp=l5a1L zM9>~A^YWENi^V5gw6%2MGTVba4tI&RTlAu+C!;R0_KKjVSZT`iF5V@Dvm!VdcVSR% z(sq@rd}DTrgr7q;JZOXAri`vLBhgD%FOFWQ=3skQLg^h5rf)IbZ0!VSBT?^9s4cVY zcH>meV&^Llily+K24`Q6mi%Q>m^{ifYv5ATUZJR_%%LBGoorDbbXcwQ#%Q*8#p4hJ zm&|wQ=^smm(q-_n*EK6;ZdoAo%wac=C0JFI6+05!ZKGQhEDQ%?re$e+X-KwBqyF2z z;Qk@Xs14-wa;E8OmNVU-=?G>nZ5&hHQuv%#{bYU_oVRx|yJ-0NOs2`zkPIQr!5&xa znGb&dN0pVYhWlHbE0^c2kf9&By@D`rEl-f}JYW?^>W~P2G;W-Gu;iEj-SL^qP!!C2KwDs2_wY=X;zBs9H z3;6gvK?lwEvLoNXT02kX%V&5x-yb>TRY2ZtTA1+h@-c_JV#r$nI_2TfPedNSt1|2D zEyznlybfAFzFQ~Gl8AOgKRgbK$Q$dB=fiW4KS~;&w7iiHd5L()Q-OHu*I)Q(?}w4V z)bBLp@p+F9THb>I#90y%hP=tZl*i|NjHA320H!=Xl-S{}bGG38Z3-b5ylKt6^zhrBtEr^|aO;1q z2QBXr5KR4Es=~V&&{!YnQW1H4>}$$vg*-*Ti9yTb^I22gvg&C4!sHQobK)KHM%(?I zvKX|y8^LGFE3S!-yGRm|H_jn16Go;_NgcF2{$H#qujOuhcZGuGfsyk)<9s+i!(o

      $G9@(?Y}2F|BjP5$~%t3l(!%9rh}$~me&q~Deo0S-c=Guc`NZ_$~y;n zn_ZBeqn}S2@_jdqOzY{PX zd2}Ej!#e=PS-e2FB^;fPIDRmW_In<{lovo{wUQu#d<^t~LY&15gjXOh06ylOje~KN zM_)Tkj%romS z!Dj~YF=X|@`f_IHO28^!bG^%;ZK(NXKtJZM!@H2zDtYMsn~2EK851)DMi|o#+ms38 z$E%pJ)M&QE|<=c`roQ-qx0NJFhgDq{V+ip+iqR6>q%@uy=)b>ii@)z9=Ffavg)`O@V2{W=UM)HtV^0(LdRo4 z_*U%?i?bjeJ5sg;pcr(5M(Yv^eulkS0|$1x@;f`*vrpuoj3sd?_EHTTX!59Rj( z>^Py?ni1UR#TU~Ex}FCiijQX#W48#|8IW%%MMu^DJden~JKs!Iy5s&nPzlfGw% z`o0?Co`i=z*orsqq}M8#mlW#0lr z?W|L~gu2mqJSSGY7ki!+s!PxEMf%7;%X+Xuj1}JlHA0%;iYq~1so51!`yBebGvm_^R)_%9?00wC9ur|5NA-V?e`|_bSUb zz!$%-Ps^$e54-loZ`kU3Bp%r|HJyBXXVb5(4clBdB;coV6)W^70VY)aZ%RVJ197-I z(BxJcpsR&CJ6~s$MAV;S8MV`OJm$nIoAS$;C0E6y`i@<|qBi753X68rLt)$FYdtJ% z|474V$40f(xh15^5YfXIzu_X+K2O&sG9^LR(9FJeIY)X_uQl5JU6$P!B4g!*omQkx ze|YGUoskxO$$qrx$1Ri_EgIDj)2-E3Bq0|Lfvn->b9Zt>-?}X|$Fl0GD_5aXjK(=P zTlM3qzF)8(uph^rkEvs!3U2eD9jo@teKc#kr|o#Q)c2xJ6J{C?Nu8Z`^ZtLMY{j~4 zB|Q}kTZlhddNN7Jvp0NBvCOgR|EW5|v^C6{yK`>7um9XF-HTR| z9m3dqYyyhrth2|x7=L!o#Ryc>-a~D79GmMXTERw-odR{t{Y|^qa!q6H#^3vXq)qsr z)pPZiX~XS3wc&QN4UeC@3T-%4)7Xl3nEzb%a~V)NGP$6FJKER!ek2urp4*tS4FZ*JEVO;pqCHTBAhhy@3fX*E;XqjCnB=v!}QR4NeSCof_YVSu(rj3H8Th z{^`B1hE+LhyUsA-q`G|Hh&B{qSN~J?@U5Z6Pj zZAnMk0y8hb=CFv_=Q(T_*uUD|V7X&g+9{Q0pXWR`3(ifkFkgqTSNZjAXg9k?oa*eH z-4@73+wq)_JsCss`@Dzaj>i^ezaD!!Ls_rjh#MwmqH99bZ7dS)^Bni81ild+*wLKn zk9)(^H7#kT7vspjI5oXsDWlG|@eSK|>o3aIN&KzCD!S*uJ&Ch@ajQeYrnUv?Goh?n z0&=pSorn>#sxI+E%u+oM+{P?*apRpy)yPPO#Y{|Bt7_T;b)m}q%1Bds8EdTjX%96L zDogkWxqJyA;Q|G#9cTsFtZH^!HK9u&uO^?#_B}lvaEsIGzm|-1ag`PdaKDRj3;B-CY}Uq3W=At95t7 zu*%SLt9)^9syPxZH10Ut=nV<}@w$x`q5XJATiMvR_$q65D0MEICtF&{sm{)`b~<-m zK2k05XUo!}t+Z~--0HcGRmJu#=pL^gXd8nOK($FOj&Dd1ajTF|?S)q5la)JbdQQK& zTY6PFN&@>!1r(}glYm(ND{i%Ic*m}_kgKR_xWW8CGcKf>rWehm6iw7?jl|aLh4}~C zO5emPlijC1RJ`hSE&y*xC^+~j)uFeXqqe zJ2Rub*CqI;dxnQ5=9jE$ii-yoG_1F7^32Un3oSe{Cm(#?!ye|D;6Lb5`@DDTdiGd9 zdynmoT?e5RZR$NAQyXKQjfmc&(0z(Yi@pV#*v`|(n3u~ zlCx2U7z*>7;SHDBz}`i^-cy}O;eE3cY%#dqalIY`u6YT~tNd%U ze*d)f!@!1miS_=WvnH;uZ#Wi&({URR#%(}qd~tT&)cPw1%ow|^U(>FbriIDd2Gz7D z*13;8@2n@On;2u&ZuHYGRW>1HtsayZp6<_cH>rsP`7ckX!PesOLww)jQhSE`NLqv6 z7uS)t%^N3GvioD*?!b^cuyf!2A z_Qj5jRii)bF(KPxq0$<*d1}(O)y4SS!?wADk*OIrsan*x2gcj z1-!k-;)_GDS{Lp4Afhe{LQVb0tOLQceO{OYKQWg7R~$4jC+yv7^NLA)v8X9;xix!G zV)3>1Vs6hh$S<2c2kAI8Rv&=j8@Fz(KB86zkf+AyKWP2F2L5Ant<~N>`{Kf!_P%II zDOSSBVE4(C3w`lkk2Pp%Sw}D}GvsaPvc|lF%j*ZoC+WEUNMMX70nfBa> zGUZO>edWggQ;nMaNk?#)PK)b(-gl@L=9Gxeh15CSs@PJwvl3Q36l#N;k&KQ#w}Oro zb=mve=kmkZNCk#1m0bU9T+^{9bc%Lq3AJaOk5jQVgJ%2VW10rtG%@7!Ox!uqRlloZ z`~P_-Sih^GGGqH1-!<*|gaRm~4vU?)>%$aj5v23D-W^Klg!$mDEr=$m*v)RtBg z8iL0zoVQx?kH?+ZVyk^|jI`)=$RDcc%2UmJ?<2O(n#dZ>t3J?JY}Y=Q$s^;i>*|Iu3VeniLT&_J$AIS=J)Y)+X$vvX2`kG4A;``nh-eeZEXUQPqm?ezOSzW&*; zdD9P3B&2|OV~@w2=kx21z5f8sAT+h5SM1EiBfg{O4>We}4=1Khp1A5z=(&8}ML~%k z9)Dp`;Ia0vPyAK%!6-&fJkqmG+qD0bjCFE<7(QEm8t)XId%Clxu_Z5i<6Dz{ zhQVGHz_#VS*ePF8_VnkSSktlxk@%r3J-LvhcR+t%6nTz<#in?Yo! zJ|B~rfdNECcI=%m)b@Og-B_YvoNw@81owHyhK5dbHB`5(+Wt3;^4o9s-HiL<*c-m0 z>f0XU6^rlo<8iOYzQ?wVb^tx8r0?1gd-R=2`N^oyXT+hZ`jQ8KT+=ytKSz zs_>8p?E=ulLTr_9qO@WM2}A2mk*qd>oc785m)-BFDH4Ke@YAj-zi zSIh7nchQ<igi(Qhe90{>_WjqQ&?qcx5GHtm&&)t|?W`A@Z+M zqpZBpilVaO(Cv$LanO^ax<#^d*xBUJ|3IN~XRGX?7NkW-rP#JBv!>Z&StLRarCOVt z)W7Co5YSrc;knn&s{V0GxNPglKcGfs*xz;2B=SE;Jw^4Bs^pH|5+R2Btjky3Ms-D` z+v?n)nw2gf%xxP7^F^f6BUXTpUH`SK%K%}dkX9Nos1X$rCMFY;eh!CBFb0Qw3J-NA zN%6a=s|;%Il5N+gkyN&&pHa|zLd3yxUt|VV^Z-8};-Nz-KmZ573ChBuuK`ui*Nn%D z4|gmM+*a{nmpcJRUmP(w5)n_iCV!UDblm?o-~TUm;hu`Z>Cn?2-27i~1}_em^46g) z)sM%Dvrfw8Je=Lu1#)GdJQl2G1W&j43yoOX{UXOTzgmul?t4^U9*qR@D6dXYk_TRZ z_Q})A6qLiQyxW-ZBcc~7{Yb|(zuJlhkMay*Uh}KMXz(a+5$5$*t-~}N!i_lG%3F)N zR6ibTYV-ogqdZJRNgn0h%e#YEX4&&H*? zUM}U)@!aD^2lDT9T&EfW7(c~$dd%xd4u1MS)PeE0Ij&3OS;siYBmcb-LKMTSQi=no&3Lc@E1Dj_fCg=?(xGwzYzVfldo=(Z-UkjU&Xdd{R~vslPx@A zhy><0&XNBjhdoX^^!ZHk`yK4w4PEU4!^*kK6P` z%fSDia1B<_3J?#mF;A|cHclhH!p7;u!)!c;n2`wMakz#nX!{1a(#DfXm*ItTMY8Bk z`NSxW>ixttS)R~oqe{V?NANELil6#EDwy*23l8AiCYZASCYb8|TQGG`fSs8absr#@ zx?d(Z6F4ZCx~B{F0W)xqD25~)$y8o~-UpB*7c)Xo<&}0sosxkWuXx1fl-Te{4qDLwf=0tiY^8W|ygL$?{$hi+q3UAHl^>Ndvu&}CGvCF+!+e(uX1)gm z|3~?f86kip890(Ja3o*gNO^%HNAd+`zDtCM`K}Pm zeAV~{9_GuS_ibl-UDu3ru|XnG7V*tEQ}8mYgFH{;oF({AIOh;kFhYME+;53t1P)@BooR`wJJ-X+)P0fQh#f$u z?y3(0(+=Me9%OBgQJ@Eazb|x_Z?9m=d_pi)`mtb^^{8O-{8})}{gPmo`;UTI?vDkN zpN~t7o$Kxpx!S2AW(1emx7;p>;5%a=+}XsC7Axe za)_nxz7EOnX8w%ldD@_#O<)?iZSbpN^uqSoW_NQFkf5}Q7 z_E}~BAP5L7GwCakmSxs`mSrY=1n8XZtM#ppHw0hjP@I2|D$?OXvZdHw&ijj|e9JF2S^cnzN9Wc|9g{+T%IFr)37kVL^)icC#_Bo3!@9nOSn7I#(0NZ)L_7&U2*o(` z__>VuI#TWS&wRI`4V2@Wcqr0V5MM$L%c{ab`gNeMC#JFpVH~7$U9^dK9DWcs;~>2l z{96S-0K7x+Q^1YHBk_Z<8wdG+3wpEQR_ODD;EzDxFPQs39~3+ixJB@E;AaGffLn=k z@Plv^2j#yBnSFti{iKS|c3|2@&HKQ#O%@LFAY0q#DsVjT?LznATqZaL=SsneIIHz1 z_>+Ov7y^u}ZC|6n0pOqGp!^{?w+m+4wPTdBCkgr_5u57XUvexCr=NgXgT^Qqcb;nE8GM^{wr| zXBEWdpevuoz|42F&?|tyYVhX>t^$3bVA`ilFzxeW!Rvw9UUgo_1cyO?LGW7Omj$!F zP6^%wd{!{a%e_e`XEQMOvC}fSUmfvQ&@U29JE(ozL2m%2KL_&c0NyIN5%@8|l>cMF zyMYe~rmcQq@EjG~4EnDOo_`rUp9p>eJeS4T`R)hi-iOrTAaJ4J7GV1RApIHO3c;zs zTLiZP?-oow9~XQSc%NYE`Ly84zzpoy3?M5U2fgBnWz6&uXW|DT5r<12@uv`9MXHS9 z%oHJj!^IzjAvh?13S=@`kEQ8CFOa;FDGWi)o50kCOIXsWiyB*isY{N~sY||K_M?S@ zDQcBq7EP@`K@0#tBy^nY`4M#L*ocF9QAc&}2233py3BDIHciK)vreW6 zPR9A`f>|dOf|0e|HozYMeq893vtRHKoSzcRqCGD-9p@JXkHPt`f~m`=f+@$%HUasp zrdYw$=W4;!Ay04sSlwTMe=_hBLZ_Sqf@#;E2&SB03#R@4B)A-yK1G=CTHrn$4}mG? zLcvwQ{RC6a1i@LrTpw%x8wBToev@F@?=HctR_=wV`TtAsOwfO5(4P`K3-sp%&jAji zedx4m9EP5Spyvtw7T|?~7XYsnTm*cd;9_6~y)Q!y@o+`5$1ye*1eRYvuO14V%m#%p z3I{RMars5eHa0;p(_J}gxFz1K4G*^6KOVtr_MX3!>FW0GKS-!qyME;3{6K`)CCio5 zLVg@!=otN~!TEWGaA{YqpUY@_sk1*}SQc8i81DVxeYT{+_DyRsdlp@N2%tWGnIBq+ z5AeEtPeM0%(GMz&FUBI?jVY%4$1vi)*eH{>NmOO|N~PCNfWFB5UoO3JJKH_;FZ^QY zi*o-G0_+MHHM0!gsx2xW1s8+M7I$%%YuC+}kQDLr-n}4Qzoz>lt$X6`#X@3U`Hba@ z1b5}uYMKsH>4n;s(o2TUwqE9F>{@8F1@)GqmkdNl^$}d;3!X1ou$~fqem2HOIsa*9 zy(j(rETcVDfAIAsOV>RiyLI`>`Ls1Yj$OIBOpO=n1GN%(AukV=uPGygREmo2PSw6K zyH}kWkZhrjL1^Wga(v4-e_>_$;vVBmR&he$VlB& z=<-Adc(~^7VL-JVdK;}i+IE$jS=-4e4WPc{>#E3?;q9%A@;#*4kfL8?cFjhYC7PWc zkUlSUFB$jn{pT0u)@zbpve4Q^+w6Z{vfk77l4E=c}gsg=151DSFAE z$8UN^>3P0;9reurWn75EU3br(ug$^wbG=)$p(}6NQWdJ@bDITy-D87?$Kgfu^_S#e zUA@?0L!$w9XVn&v9>?w?9+yqm)?J)TD-{(Z6;`g7;Y(TzVs5rD_0_c~|_y{;TkIHlC&N=2QZ1u~hH_5aSkDh4FIMC*D^u zEWk~LlP^of*gu-@X7CZ~xG}hwS&wVp7vYvi#qpjb!y%9NeSDv#gO-=>karOBTERql zxc!gF<1;H$zh+!$8DNXx{|29_Upelts1N1E2_LV&?~up)*_oj0pk;4%$g48s^#L>a zD38x`P5pR}i=st>mdE!Mrhc0sF9kH}$LiDao&+}KS-3Bq2bvCA-V-30@^%~YE|56t zccY`c3m|WZ7AAbWyv|YHXCROF!qkuN(Y1a<9P-vf9&Mn5*6(tMyu=aqvlz-t!lC7T zi1cQ8Z$Y{oEll`$`9AoVCW{vcYawql&XmXJF6Uc{ zbjstaBrPuuz|?O68YiER=%D2d1|ZIoh)*GJ2r%VcjDvBkj}IO8O`OFGghV`0 z(e?}CnsL6c zBIRMIj>y}M^h~bjnJlEs(ZYm}mp=fXsbAHY==_1M9Fe!yA#Xk8@tb@dw0?IwiGVK63Q8 zgLvVd13t=w=!m>Jv|m%dwHMgWWu5ZYgU{5DzJ51@iSqb-ka29!a~<*yLLR@t)!Z-S7u2YFm0P@c9KB^I2cR z_=mDlzdRgT-a&`F6ikw+;z-c)e(aF9KHIi4<41Wn7Ul5q&Ct8gdey(gF_m`H`6VSFOS@S{QzCbwT84;>iC;}bb+d4mQ=$8_>) zdFw=;=1T(~`-KkLE^EQSG@7pne8@TyG~XD9ysBRK{(^bHl(z$XSrKVb`+W;cC^kIZ2NwP^~<37ZiarktfW)k85EN7gKz+< z_A`3y*f9Ykm=`v-f3;8V@nf%=I6?7$u}|;U>X8WohH`{7>;;S5#kU+OHL$fayx#-u zPd(6_>3F@z8`sBX|l=qaTK<@4+cZW4u*O{}3mYQ=@NQq`Yk~5j-GI zP>wt7sDfW5rDh(>F)02GiOLs-&0ITza*mBL8Ls|HEj%fytSPtq9>X3N4>rjxX+3z;9qJx z6QM})gLOU*1@|UKbUEfT_`M0VYfVauKhH{S$LsvL{f@=JX-*r=iqBKTroNWCe!jSo z@QY+u&;P%E@9XMQr)o>rYbx8F0^)X|2FO94kL0Tm`?~jEv*-5C^}mg&dZ4qj^NsEr z^MByDo{xn3C=Yzr(sOF^>d-~LD^PbGd)rZW*|w{elc>=CN7`m}w9Qog04{Cl9W4_HVf-fP9hkvG>or>rScU6%$|HxGMwhjNHd#PU4?a z;|8UtY#3jxdPB#ak>F2zpYH6FpeNS4xnB|gGrP|t>V4G$W30&|AOUx;k}3{S=r1wW z%-canesJ&PL2kBBw!QQLr=mx~{r1GR$|uMEYH-^7;j=R`mAX(BpM>rir-YpMgsJC< z_4UVI-*BkE>hB$UGIie2EBB4g@Y$yJM7nehw}JP%aWx*R-s7rzEUD_cK-K!B&EdeT zhQxwC-sUH7dwRq_Ke~q73zQZop1HU6`UfA%y!BAq!jQj&E)a2ZPP!Y&6_*Z@8$W;&f7l>w_#-UK4qN=x7K@On!K@9PbY1@IZ*Zeq{eN5(iw@< zTimrjgl9NyW#;{`%KOlkkK0svYaabz;{(`fVB4v>KK|dOT~~Yi319q{&dzPs+(w`- z8w$0zy}GJ06h0M>Z>WZs#Dd}pt@pJyY}qi;o%=`Y`dhwv*zNt3HS50CdY`*$TT+wH zV?m3D15}|T5t~KS{?x-tS`oOL$Z@Z_iEj>IvEz{RNJ*~_? z=fW$tx^tIUQdhrK#(+|=hcf%&*y1)g6NPe`eOswR|U#)H~j~0-IXoF(LbJ#^)!TmXUkCmCl5WB z?QFJF60W$2+h$0kpc_QhNh*W2<8|6&-P4-oElaN*sWrURU}a@(!7XMuvAylN?78{= zl-F_xi_E=WH5jXzXIC3e8(f>BWnO5q+CH7k>~{@@AOC7BO+tQOd`+l-T~bYutz7l1 zy|?%-LmXU*v2Im6!p;S2&$YK*o#sBa$vUyBBJ_u6+}@JT@Tqh0Xo3~N!tC70kkU}= z?ga6C{Ji+O{B@9S3uavu`7Tm=V+Rdv((zq8Tn+AqO8Bt$w_D0u+*|=|yKngAaN#;P+$27!W!-(DJ<9F9-N8kuIz5lXM zPoZBby7KrsB{p~eXVT{PLC&$yKC}7u9ISmr!$Zdoedb@}PEGUnv09!C=kITC)!N%u zn5M1p?b?@M%zkzKro`p`{xfD12M>+0Cw3~Y<5Lp+)952|!$od*m25s0PO#ffT>|Tm zlg^Zc2XAtPUv9|*7mH7l7sdCscH(zrocA8lX>Tr+RpyDYye%9FS+)r%Tdi_$%kh>D z0pS^1;`$@b>ytTV&+~|@775ta;87V%_tF(xty@nw|Bl#-)o^UF&b$`%V-I%PGxBeY zx%sexTMZnUyA5zq$IEv+)cw05A14q`nKjn>9N=~ zMfvSZ@ONlWdg350a3H9 z)NtL!BfXKPA!Umg4~80t`%oROGH_%M1hmb3=ChwVcMW7OKKN7uTvCjo^tApU|r|O`E{Ury9RF)INGFEM(iQ>h&=!kb6vmXo?3Np z32WQY z^$n=c^Z5QG##QyMT2~W{n;G=Q&dvTX)17;zHG7)1@t4;u5*u@~2E{g(HePbc-Bq=% zHSM2q%(bmN%@wusG&l3MO(_jrmD~3_)gF~4$1G{JjTr}HitN=M+n903ZGykabqtf` zNA-Sog($Jmx=SKirp(3d~`D0+{h+w*^V{kPvYPr_ zxMW~#{qU56N|h++f6Uc1!17<`8nJCmIC0G5i5mtck2nOL%G=Xd$Mc!V1ULq+RMSbcf^p@!Xb6#xMU=IKEVM-m!a^N~;8#{fn&tvzfgk4QxWX6S7el_rrcXUo%6hTwf~Z3EB4A2L{7Ko27Bp94FL;|087G zCW``4a{cz`kKqJ4=PN$U!Fo`Xbi9uD;2Daq0&64RuuycYfH!DPZFYK&cj~g2Co1C& zy`kee({BCHGpHv=uk#81(e_%)maFN$b9EPMlVlsRXbZ@*yIN$2Eq9W@AW`3El<$ui zt*hz+H92eQ;qdx&qVL+5r7go-Gl$1;TysmfdEwCtS$z1PjzN=SRpNC~KUPWHVR!8e zv%b7=aIXhSdugh!B6Z1Df$CCSLX9F?9@>jXGQ`#?>0YG(R)8I5yUrbHEtDq|I-P9I z5?4pB>M%e!uRgv{-)+9z9-1^V*x9+W6LV5yL!ZVzR%$FRjwM+5o#(}%pL#8?y;kb8 zJY#W?FfRcP>nD>9|6rt|XXmVix8@9hmz+8Yl8ZYu4ZS&#)H+Jo%f#b z{m542P_fq2w=IA-dx z5pT8?o^6|RXw~tUSF0fdcV+iPyQkE>TBnS}b{RABOF|FV)@7d!_D8?n@U__Yu@O$F z|Cw-herM;baN?PUHCXcGg=%uFSwBd`BaW&cyEbnRY;IoDl;c6Ws@nXo`W!qh%C5=5 zxPB-jgwon;XuCDGtg0Dt88-Qvg;vhVkXH$c zJv-tuyZzx#EkiZxbl;Jjcr+R4*qqHa5cK0A7guFD!>gK;s1fm%HKAn864z_P9`_dK zpZA8P)y#hM%(uezLBB6%M*Q~LhH7ksksGwCwzc{OKJ@gusd=ucdDgiQo+phcUKmO) zft*9ttUX;Gw-RJ8FFE#MGC+45miR5K^rnWAXKq@KV68q*MmfiDagH^c65aYMX+hIM`T>TUn>4{*aK`*d9tCvl zO2r6dM>H)i9j}9F+HC6 z=+E8WEbG7(@LWCUX1{;Hg~OA41GZ&6{=l~C5!<$HsoynpTW|}OJUe~Ex2+-w)$dB* zmQR$8N?8{l-clNF#VX!A%BsP36nMfGr=PH82C{BS+!q_(2`ijWnAq47@dIgZ&lW`V`AQz&j$GwJq_RSRpp!`o0AJ$1&bdI#W-7GjlrX z(TdHgs@l?!fw9$J>|w?7Ud{is8}e#W`~_+5XqHdnZj57M$F8eSfzfN{I=0Y1Vnajq zLqBup{-!f6>C!VN>>FpWyl>yLaX_9tB52+__uMk1zU+F`d)eR(b}RLg&F->O%W8utYr%ZG%` ze+7f5QZ_Vh$hK%juniQ*`A~yBJ^vrpVH0?3fsI8bO7pjIcqZ(b>u0`&F0bbS5M*NCQ z9<>Q)!PCB)!AfXDQhlL?T|qqGt{v9m&V9NwcM#Vz4fz`eJZ|sxvTHkqAnAqbp&)hg zejv|yc7=|)>)R{gT6h zor*fwzTX)wc|~@?=}+3&GIxQWWx7z^_P!Ta`%dS33GnjYtpyolgZVxS&xF>wr$1GA z$>3q*Zw;((o$ax{nfZ;%q;E~dBTD=$sB7V_7%=>-&enYRbANcopMk8ApSL`FqY?R(uzi+_Z4jE;OahxNR=SDXG+3jTlcrxPZnf6^v- zBj;?aEuixy{}*#_10Gd%?GK-sB$E(Foj@2OANB+h5(uB71jIHWkOTqcTTpBml7U3> zMLq;9w8@BJg4RNcB|&d*5)cB_7SLMoqfJmFw%Wg>-WJ<>ud%jjYwrbW6{|S^-*2CF zX3iWE+WWlE`@HXdp2_*0b=F>c?X~w_d!LW2-4zPWFAK|;#>+N!BSk@~P3u2{SL8Qw^Z%%6a}Fs0tAD|3Gn%J>{QVPl3% zS~^0A@-Gpx3ZP{<4MWTQPMFpY;5$XG!Ef@#uJL)cIwuu%;@uyn+nZs&o^}W9hYDjQ z#a;}b)jdjc2k}<0d!)AV+_=JZcr$UGwt9CbjKP`Z*`zwW^?4u(i;2^r&>KO|_UYw2 z{xELBn5k9hlo{#UPuw%_m#<8%?A+Gbbd|IHsu;c}dQPuR&?BwEd1y;N)``b<|P2ZIbG1`ZQ_2Ml`xUac#)h=lmi|vUGSYNUa^t2~M`fM`t zU9QhIE()H$H8`(h%g5ejshNwKdxKrxgw#M+e&E#B##DDgV;7sh9vju{BAA?!(754H zTT5?ySALLdjMeuW@1wdO*3KLap2j;T*LSpW&m6fQuf?#qNosdFG&TFOy6K*IO?%)i z8?@%$j<%gUI!|rbKGWHNoyJ!#+|hY*fc6T$R@kPEj&Nw~MHJLBklU586=#h&An-+0Ya_mKX^VYR4haiEyGxAZ`Jg4)&Od{=%wd`x_L zHdafREq|_U`ItqgWuNjj>|jGJ@Zi@z$sr^ zc1K%tZ+_RE}^B6!mw?gW~o* zt~)|9gdXaR_()e_XmsoXR;9goZ*bNMdArr#YT*%Q%RZdZu*7tf6T26h@CMgyCcG(k z9*ZIGqZSdV+*>bPBV+&8_6jhlyHbvep7sqUKc17aGtA_GuP00Q%uqP5L1mu-i!uGS z`_MmJdW0vHrFryOQ66TJmSvplmTw~Dy9%tE)pIs1HuFa{$2V_w-`aY@<9!q#7ffh< z&f~qpdF&hyHnp7#7vM&bLpLvHS1sB+|x$NOhT`@xS7cXT9@@v!HW zy;mK}9|hdApZ=lY3T%<39*@T0WgEd}XVbxt_ck{VI2sBaY4QA|Wr!gd_S^pz2(DMX zKH^XIUuPj6Yb{F!3vHoBPv1*H(+G9&!F3PY<}UN%zj(wtakFnFRxx;f>zca@>z{cW zP`S1%pw(pPfydLIW%I6Qq-W*i#rZHwPwO|Sv2m?&5!%cfo6OgO*LZ`2rYE`ikrW1% zyqf%jS~tfW&sOgjgU+V3YjEeved^zieP@8$R4f*)?jj!z^|bMe81>vQ z?n0_k#~t6`*5+VnOL1%kfhI@#2tRs*%e*11W%8_>S&QN=o1)V3; z#vMx=t5h=-d;cGp04e9D?lW9o^w}G^mh$2DbfqJ(OlwRnNosWEJvAQv%*Rhp)U6z1 z*BPIltk5fej89L{7~VUzK;nSW`NPNEkaxpxjIr6Kycp|`;!_c#5Stn;UV)|Np@g(l zHCj-XsRPz;>DhQyzg%mK2XEd}H>FQ5acoX%OzpeqG`;eeCwTo&n&UgNQU3BB8cRNt zHkqZ2j4Gx7(bdno=%#uHt;XhjA@O9_DsEA?!nEV^p^3-3mf|C+Fd=b3PipeX)WLx+ zPvhi9$N8>R>e36w%Ovj(vpW>_8fzz-qYV$ZynIl?9PVj8_J?9zKi}o~EOilWCXavT zPM+)NY2yya1_|pf^?J4=l^+>FlJ_5&t32km(C(p}FcZ0h6sm38$2`&UuJjrc%Q`dN zJQr(a+s;iR-XV0K9Q|^=McAPmAG)q>6)*#Og^;egs&ufWvX{M_c6sXjdHLV*zpV(ZHlK>cPF6ECG{o7 zg7ma{*6x!r=F$Q$j>JuKccxaiyEAw`m^rNDAns^y)Jl>9IV0D+cwO-PsZ4LF^Vlg5 zS{Ezv^G`ZAWp1wD>^OhQqvlORV30RC_pLqd<8pSiwpwZ4eH~`0;HSZ~)KEw_9&hDx zIPmcpp0MRQf}eJzK}%%CN2lOZL!JH+&z*V=KSVz;t|9MuPH<5m*Lm~zj{EjZoxXEh z=QC+HwD|5?+ta1jqb_(2XEg0lEFa1^nHg%SYw#85mM%2&ao_kW(A(>Gti=Mt+*HD*dtdD>|xr%foy6 z3kfS0t=ymPxM`q zt-l-JMZ~XkY>qSLse=R24vW;#j^hi(X;YU$|7VJCcc%q%VybeS8Bfp3aa84Kr*eZX z+z!v%2OC1o3%Qbi6!NQ{<1TJ?G!DSkCpiZ3j7jzO<^))*C1Je%^H-Z*YAhLkR;_#5 zQ@n0xdK`CoUb`C0lIaO}nx>wFc=KWQE;xsS&!A*wI}|tKtaq#{mFnNA)L+`36Q^o` z1yqi6=2X;SWRBK~PMO2``j$lGxtKUTX*vfD{Qtq%DU9O@7fRxYR4wFnuGGT3i8}aP zuiW#28>RNM&S4$ZUf1UHF7X)BLh$cpd={r_R)x>Fuo36Vq((Fh+N0-SCCY&8C;5qm zQ%&vE?PB8Q$#|?euIFG4uFFNR(V@@6whZ*#$L+#2@fuL*Z8Qw#o1R)@K~(lb%DA+JUF}8u(h!e9&vWw{k!nsBYWqw zo+HPzkL9=yzg+iFr};*lPtox3jAJGzKH?5?VkSM**__lkVCIZ^)rV|-M9qN8UZ!Wo z(b7-&4$f6VKN`S}-yQKr2W)>4cGv(rIp0wmNlu$uG--F|GbLYF&A$d6csCk zv;2rtV7YAUwpC0jc2}#Z+Kj&&YOycbB|QG}!m7=cHU1(5wy5!!S7ZCLYOQ*GNu^%t ztE%?vg^?W(bz?`sOGK3WHzKx8HM17floYP_*XUYF`MtiMSZyyww&l)KRHx z(I9{EV!hn&FM??NeV36&eN5&8#cY)p-4+p@4D-1B-Okg$zfBp^~maN9z^k0eJzQpr%5v z@)!EKKda6mH$j_|Gdn*bK~LjoOV^f_gRNp+dC7fXZA5ey2^P4Us;UJORIdPeKB12A{!=04T^kD=jPO@a{`Bd zEyFzPtEs4><27e8Oi~40Qxp`giSkKY^%SVBjr$J6iIy}vr7=mXMGf45v8aKC`@gsp ztqV;y>zIJ5wZ(pPDsInNUafXLR@?dFN|Z9_W$1YkrUL9?TTon8Wp1b0*E+(oK#;YY za1|C;RQtYVl-*oa z14Y^)swz<@8Dh)uLPiSK!m5~VZ-(jVmTN%aE?b%%M6F<;+m?fF54H>ERV0JG?9#BJLnMui2ab zS@!V#hvm*q>esJcFim&@vsT!co0q82wb5M%qrF=7nv!y()4*G{Sc_ zT$dEUZJ4VEIaMyf&RSkkUg$R&)yWJkr^=5Q%^by8jT$1YDV*IA>ilYLoLv7V@;Ox`JW4ZCj3&(C za}gdsAE3R5_(4pJLE^;Dp1(%Dn0oMYYIC#{Iqz2I+1f@q&%o<#C!+CBk=NYyO5f?) zX&jld_+h&?S6eaAI6sAhQ|*FeobzvA`&P3Yrb;E>XPn627!^q`LW)5oy!)m8=^#7R zPJh2E3}>aZRhK3=OwoD z^|tde+j)iUe1q-0+IC)RJKtzK-=qz)Jaeb3{7~APj67#tDKqih+QWIC&Oed}k6T;- z&sWPe9(ewX0S4g_*p>U7&k}!VUXQbtS8w@$8Roy&#xKpIg!1|`HvUEMi)P~W6x(^K zv^RNpeXlM5T^1M4>%F$?VlbByFw4Ke zR=<%pdoE2Pr;(^nt?hiSO}_=U{_sO)l0^7(TmCsV{SfOXoXG$0HvW2>ey45ae{8e= z?`-EE*yJCS`HzLNyab!RV{P)kY2)v)@fX|lL#GWVvTn8Y_rKZdmm~e1naJ-J|7xDQ zl8KDO>oaWSHQ4x{wCVq_t$#dZ)8`9Yeb(9f?~^w9BW(KD+U(2jKi-ZJS?B)Bc>cyo0vNI1XHhdf@z!0f?21aVCH>La4C)t3uaw+3to!jUcuDyu;58J zz9g8o{FPwJ{Iy^<>sx|X~K7vlK7VDkT2a2<|+6---l4bFN|-_HdX;pl*UNvAyq z3C;q(MsPl`+Vd1V!+~cAon_r3SO?A$JPJ5Ra2oJJ!83vH510I_u#UOnb1sN&h2`$%1Knwzo-V9f)ar-9o3{q|+YM+vI0E5z{to zCzDQHiCHJ=YSLLxV%9s$LT8;#o_xXVN30L&FX70xGU2Fz`;|oA3u|H-6+f4SKWS)xeJt(*Q`V_>t#+(Dw@-2HZhB1%Hs9z>hrH zpdS%@Bk+JDWP+pwATb5j5YR%ciaO4(wq1> z)+?x;AucuW?};J*De%7|_}9Si5zoXQq_g;u=TD%2O#D?+VK4j~WeTc&>&SBp=KTb; zx1-#kBM_L%n+H1YEy(j4jwyoY;)o%nCChxyX`C2EF%+)C2{@(+cH_82u#V#cf^jf> zIPzuyD<2L_Gq&MJnQW#X3&z3N2NrbdMH`YQ1;;l8<6!u3&^^G)hm#-p5BQn zc24jp9F?yIKXvDPPyXRJCZarICXZm+W0Hk_li*D7%(u`N3#LBH1XG_~g4tvp7XBX! z&I0{sf@cH&MKJ68--4+dZuY{u4Ygoha6VY_EOg#avo7;NzeDgs-~z#{-}fy1j|pB1 zo}UR`0Xzm{fO1v?j}=@5yi_otcBkN{f&GGy1FOAO#h!bG-VFNVf*%8ZT`-{bE5S9u z|0#GAZ~{7=*)CTJ-VgdUf;)gGT6k_0d<68_7CQIWq?}IBmkE9exWd9yD|j2|+XM%J zn=L%w7hDYbA;BEBFIsqB75otBZwlTC{E^_-fVl`W>y;q*4UoTTp|7-H?%z!QH^EaS z_zds^7M=$M{~q**1=j%|6TAZWw1xjSg5LrCw-$cQ710fm7F4-kfahwHj{cJ(I2QOT zg6U%>m^|R0DwzIen&3Ln^DR8L30?*IatqyO!HoZG+Uom)-vj?sfa zvEWwF@3hcY3w{FhLcw*wRTiF2g3p4^L?6zSfFE%+e7l=i)*Hz}e-88%;tKph((xnz zo1l*(miaf0n8rcMz|XNkL1T?E-@sEzuQG5ZakYW7h#~Vy$jm2RW6&20eJAKpU+vG! zD~W>MyFL)-7)RX)CX5q-`oOm{lHwtF?JSUwg4?kkczEv=7 zvsf_Me1dUM>m2eA2VN(19Y;>#q|;{V{sox2sCyP*+H9ZjOv3RQ!L->cf-`aaqhK7g z4+PV^YW{*8+KkEGzS%Ge?P9hs>qDNcAgZ>Oc7zB;{|q)~9UMjYgQVkUwkhl2V4+B? zgW0AT#L}j$gJU`VAgOjoS!F0I3+F8N4q(-$!^k0R3LFcp))K%8z|=Dt80=~<0%9gU zO(y2`S%O)QMS^iqPh82v@_7qQOdE0uWy)bUC1$;A1hd`^f^{6fFPQayN-*pFl3>>R zv|!fzPl9pKJ`~Kp_mSW%9GM&}5Q%j*+l%!iJ_^9PneAn^%X^@!c9HQ#ogDJ0lw~uo z4g<2zX4|oBbKRIlEMsssv9#BGV&ruq?-jtw*WwS-VEl-wBXuBVyTD`$Q(v-@PJPD; zPR4P(VCGZp1s>|Ip0fZ`_j`qh_S`L)W$h81fup)-2S4lgZ$fANo)esjW2a!&^_POP zaO@S#x+2_$(o+ZK9Ann&YQg!S4-`y$Fq!SbIuqXr`>@VtyQnsjwoq-v3L&v>rp;M5 z)8?#?X>-*^khvH#RT}}<0IPAKgAqyjI^8lZfT;`1O$Mee%u7s~PcU`aB6v8C`vv2m z9TcqN_=I5UtLzCP^;I?mroMm1kMf!RiXSoC;;dj*584g%WYAoK0kr{w*+$Cdx}h)i zHf>A2iC;$DncuMye~^?tHyN09AkQDbqZ8AKA}KqA{t@WP&N6>dZ^wO##h8P@!}mu@ z*KZhf>O`4$gH9U~KL(sdOyeQV#*g$9pyvzz0m@n^co*;r;x+h#q{hxjLl^3k49qkR zKjK&%X**)p^#;Mzcc z`~#uWmM1KE)%^~5XnQ8dR^v!JI=*RO>T24bHe!1*(MH7ogSMlM%rUDIe+z$**hb_T zj=&oRxov>%O-yYjJ(3#L5kK|1p>nPr*fu0>hQW7=Hl5KyeVmC=$}DJ1d}vs^WHfJsA> zDLQ3%1ycr-y{rMaU@c44@qU9>wL9w0cYQkZ-eu5HjFOWL`Xs?if!Rise-AMGx;cl= zCT69PR^#W`MkLR*9x!kz4$Qj=d20m!JMb34$AIgIWxfas{THC`7W^S_hu}|uj}ZIu z2kAI|l%JR+&yIkTfL|khJvrogk<965a8CZ;p)KAKd;s_Z!F(U711EFRMpEq#%(hVN z4x9k2+8vlSUWy<2p_;M20;avyJPypH*0;bZz^ps@*$(WQ#5#`O7L0@8_dtIS_`5=< zj*kk)!B~TV=l8&ELVpLxLxOQI<}&cS3H&3W(+0-`Q~z$kIB2g59)%-qNZrzK{EJ{5 zwEq^If#W&BlW_b}Fb>8ueB_-9%==r)$pluww)(Lr*~MYQfup2MP`Xt7lWF%R|7oTKLuTDA0F;zEJ49 zftLu@flCE91M~SZZSolKHw3o=9~BI!JuP@Y@J|GH0DmU<3E(dTrvZCn44FrOrwM)< zc!uEP!1aOwwQYi*2i|Vs;U1{etrPTS!7l+H5qt{xDZ#G+cL{z2n2GNkIVZ;o&IV2p z%;&Cd!R$L8!7G511%C*6DS}sn&g5t?j!Ncs1Cu{_yn%JWyv{@)!ld|t2f%?V9f}OP zDi?I?`-oBCQRT{dOb4quM~@;78hO)*k#{cmClNOq^r=EG1YOMq6Ail36PUUT!7mw@ zx-1k-dvMuDI?K6VFb;;#0i9(w37tB|(O#fu0Q1{AV(OyCBQVp~gigIwJ%z5uATVv< z7ar4TB&cQCHG; zf}TmdgVe}cw+nQ&{+w*I)qA*>3`{-$E?CEr&$UUXJ<|o#J~s;n)Yvb{!!lY1q^8>+@sh+WmK7SWFWnK_WnaaP3ZiDGVfM+!?X{}F#8zmNglp8Oe4Mve~>cpb3CY^;ZL#*%sP_40_Dymo^8;xh#xXANsd_t zo=*(^2JkN=USZIe66YG2B=YP7&nm%uX1`kS+rUM{e*8fy#*h48f?g{4tMQTd$fJM< zf}T7Le~@TvVpP#+Utrp7vCwrKRsR(JBSIgA<5PlZn=ZjP80{kbzp>EYwcrl~yKz)& zOYpNz)Y=l5ZE`_)sN?5?**?nOf+qub3fhwTPXbmx3V158i+%=}Nv*qpGl7*~0;c?% zgokZ)mteL}onW>}lVG;VPXz;NF9}`^d_geVAqL}(#rgq)WJQ>J={2%T$y|3m0mz;9df{z32x z(9a8IfBd^(_JJ65BGx@0*d>_ll_WR|SiN%;p5Ydr(SpIEzGI-A`M@_?^4=_X6X<}d zpW_f-8~h}p4_|i&_U#3odT?C)9atC4y{FTN*WeFQI)2HwD5$>dCT2M#5hJTHE`Zrr zzb4I}_{0#Qeld zFvh8?-R~U&oqC(Tj=DN{(}_e~O&`KCDCZpbm3@HU0?r`)Vf;awgrDPn1;cA94+_mB z{UL)slNfm?fSx6odvMGq7GIh#^iz;OpZGiYgR~Go2aSic6hF#Y1)ddxtASSu-VUth zDLzm~x(2^wVA_MWCPuNwb0=WhlX{X)dn^%5d$22zPJ3(5xWpfep6I@{`L!Ib}Vi<~zE zuK-=$BO@={@Cyr%(`o1*3p&4}VqMrTZWPRNXA1^2`aBmJNNi*F6DGDX@d6Op#%7;a z{UnPgGe_F8Puv0BI$q~v_pz)I)c239&tU05FL!f(&nFU`8>LcbsMQN%^~gOr9J`Tq^{3}P8mlZe@Q zkz(*mo}-{PSTOY(Ef`siZ&SfTz0`UDn0m4On3sBS7!y;kLcts_Rf5UCNwAJ%onY$A zYBMkOZ4*p=e=L~#QYQx;ClYlseU!45%|3iTtL#&x*fpK};7Lvto9r>@$_}7^1@x)p zxznI$65nRvEMoB72Axh z!0LIL=%9QB@G8*X6aLk}7X=pqYxD`=p^ZlfE(O*F)86@l7XqvGp2+{Y(Aj)G!7G57 z*mg{858~5kJGO_}XV?agX8b{78<6J{@URUWoaB-4I!sGmprA2N0aKoOh7U}6*9s5q zmLr(5na#|r<|zv(qp0|O=swevg<#12*F~G^ZQAQe%A2D^F zB$zs@brI;)nQcHG>Rclj2Tk3(fzC3w3Y~ek3ugK4f^ksK`6-9G{6OgBe@d{9Ba^+p z_t@%7oy_NHs*O;u?}A4seJ}nXjlz#|x>NS z<5A;i)l=yPJ?{sgT+{w>z{$%De##|gz9E9Cn`#%(DMQV(z?8Agp_Tc|3M)7F@n7*O ziUz_26xEg@;#Up-L)`DHD(#Ck90M-$kNyl2QnI!$X5&A(E&tnZvQDV-m-;5uAfCa5 zNaO*7J1P*#nu?;$n!#LJQp0dD{|Z0lO0LTl5gkKA#Vz@lit0C?tuP~iR=?brR_HPr zDi|JP!i4!oOpOUD>W{?~m&w_Op$+bEWEE>9wf+q7PqWzS-bY(T%8Lpr(_e}ITM0G= z>VROyN)r;bHs!3xcD0`>2l*-Yy)k z@N#wPBkpB?EhSdyH%FiKvbs?-g3aX%=qpE59sLM9v=)w~6paRd9-bMB{A+606;xIs z>|H^jg-&0+j^WV|u?B6o-fsz4rAcjgykqGDKCk>5FI|K-$)^*x>k)4 zhU;?P9nnC-#Y!}g%bTg+3{{5Lwa-v}@SAFq)i9eS=+$L9O*m!|`>GiT_43;GnZ;VZ zVOc~X@|RXewS}RW1XNjD>RT6mSw(%V#`Iqml}m-rGNuRyZnR%EM|>Zb`VDAi)z<7F z1~bCf6qNcl`=eEmzQQ;(e#YgK(1B5E8a$DXxv|PuSzFn6Kk0|-(h2zzMpN^`ngTAS z%AyJ|FGl)HB)_a`s%!ja7PGYfT`uX8|GP{!cM@L0sUUgG2%I*SP}54uW+kY<%ES}&Ki-`%2I(4S!HZf6+?{iTCG<_ z9SH&FtE?<7DMY9!Mr3BFL&kW!41Z*B^v%s^h-P%Segu+5LV@+eA#P!P(OTH4l416g zV~kRZQY7GKpRT%}CTASV{zlDZvRrCFC{}^klo5MSvXzZfZg_rRyfPGAUQy$pkayd% z@o?LPrXsdp-bc_?Ga#UZUF}c*f1cB-pS4?>^8wc$YK>>ackR=#eUxHE7yaLB7nRS{ z&AMn{U^J7i7A7^mD4W}_!#|Z&7h4*|&R|p;QOOGJToX!5?=54*HH6NL6lzrlAz;JG zRF?W`I8q822@XT8?-Zz(G&_bU~n?kM|h%**95EoHWVzpzqPl_j_dsj4U|fY}QW z>E6m{Z6?Ko>wRi#n#zclU0@obUrjI1Z}X#3ee|D-?wi}JRUslfRuo26(&%nR)#KA=OHpCf=FzoCw0V{SqF2Zqh8IPv4VjtXFN%`7} zf-u^3o@2u>64;h!#Uz0BgKH@C7_U1giZ$U;rOOC;h*Z3^-PMf?=&>k_B0ygC>v&nPg zy#l}AqdY!;HRZi1^6*+jr4<011oL3Z`>9P{ES}->dr!)X7e4AY67NQ+j%k-SAa8gd z`i%e|WoO~XRJzdk=7#c6R9L?YqMs@6BN&6R9L;3v_cxns9g$W-|e_^xV^LPi)0Xp?d!q1e~VUza- z9^bQ=@&b5?VYT1$I7d~&$<%Kv=)_raWpx3*a{{J3z7H|w@&9+M@>0MY)whM^fsZ%~Kc?M2<9kHPOU2KWmu{0c9On-*gCtYl zD4RTfsAKkLzMC@TeFlB3`gI^5-$$9rl=m_Ch_mEE2jtBJrheDsXUcocCa)9nW=I|$ zOnI-^+6BA>9}qt zQ@@YFXRYrl$TRCZ4$NkKLvW;4`^|^Ek4$00$J2j+&nmAO^7#Ld)Nj1-vA(Bm@-i{F z8T;2vrhc#4@;Kp}^7wyX z*7{~a9!wQZrhdN$A90pkIRkm@SCn@Hex|%9Z1VCUZ>Hqo!IXE8Pkx zzip70*@wJQ;IrzNP-1+)M*XH)l;Iqmrx+kLF&0sd=&9=#_gFMDcHj^puYc_cwK%TkY;CBh8ysK^U zo`7>qGldBsPZMqO7M2>{?$CZ;6F%1WZCiW133=V1o5|GgjIBM6K;C;`qP%SUO#S%n zt<`>yUE8;Qr)>J|E{pW%9E&`D6Ks|D66E#Zx|vMr|ELgW$%V)8k&?N7$pg)lx7sEzSw|jIi11MaW7t{covMhe|K9am(`$~$&@z;e8gFDVRv<8{c<~Kro7%Oqvdr#9{)GcOs2fwgU>4Ov6{&Gevw7q z3Y)wOn5_DmFPGTl?Y=iMA1$%SOS8%IV6d$ zZxiIvu4XdpJ05)2`noq7e3W+wex|(7ZR_1_khj7VCVV{QH(XYEDUde`bjn+apDFJd zTl@YV@}}atnaIa<)YiT;A#W$>ly?_?ro4KaJP#)OzWmD;o4nT`uS4YBZISl^u+@HN zAP-$3oJ{?WgF>7oS86sz{1uj#Vg0DHRo?uuMyz?sruc{-#Lp^k#bzV^0qg6NYi!3y z(RZ!#p3mreK4+{otGu)KMfyvjMcyi#yfcu;GR@%Mf(^BVPQ1F-71 zbiC0I?D8H1pH*HnjuYVji<^&6FJ)OQLn zlOOWN;~vgTv;}|9;t!AL)++7J?%U1BGLGi8 z;;ZreX?}=JRL3j(Q4i|CdN7%MUk-}sMmptn4lu5p{?r5d#3@s!>XtO=5^PXz61E#| znmT!k;#r;etvT~^9S*ZZ%Kmz|e3ltohd)S$e@=tnjqn;*@Yk}pZkT3*kO_?AP1wUc zeskPrwdXi@YrmN2y?Q{&B4g9seUJ2FY0Z6e8-2LuQ`-@{7OCxsi=ExKY23hEUB}hw zlh-c+hj*`Q)A^1upn`TwV$YbN?~WN3=+e1uHuiOodp-6Y>|sAPz9b17TQ3W=hU)J3 zG@ZKW{zq|k=HxxkI$dAYh7V~Ag<4x$n+LQG(1!meH(oQg1m3r^*VxRNin?9h6R_Di zb9Fe4(!4vILFc<^<9pIFq6$=doO^H8$`V~8HI`cSN~%cw9V9;K46=52Of6lwyK~(3 z?bC}gTAFekZr7R|ZPFv1?XUjhXee~#=bp|}*(Y;i_x`5m^)HXSVC;{~9g#a_N94G= zC&RlV$Lu(CJoV5O9g7+hTQ;=FUex>k+f*MLh9_v_T_etB3~{{?nmMHVm!aWzG`t=f zK7CJ0tb2&-7oqt>x?i<5RdmDsKRmlB8#}ziYEQ;P6CYabR%4g>o_%gwBpz+#9+->q z>+FcHN0^ZW%{$cONHRHwjWo7OW`FBL*_(XW^n67Z`xi=@HgzfXZ(g69H+??N>KZ(1 zr)I70dr5VTYFGIj$2jgm{yH~(zvup{{J5(8*sA=Ps(k0%q`9&;_`V4!8~QxyR3@Ao z_w9Juui4h;F)U3tVpz(i-%a)G_Z!+&kM5qKdUTqzAyYfnHT+~(N>5iZRKa%9*u%ci zyCX5&!^Xxyfe$wXo#)fWe&!3LjcZ)gI62VeX-sWQ3Qoq(@mH#Rva9{_u>*qHJJv36 zxo_gu-}^@(vw1xZvL|ihHuP->3uWv?pJUmHKF84rc|H3_S@Wn`XY7Rx@_bWqUq*e`L5A;?Ah3*dm#3ZA9jCZcBA8bR|+}fUvQn8d?xj; zYyitv==)ZQuZzFPW*>2OZg#lW74#bI7O(6dOq!cOTSV0twm^y^U22cU+eN&p+=YHm2pL=jsMq(rNoLDr#&Y;JAP0NOzK|PQY zbJxC;`(m-yNN;tc`}}@4}}_c z!J<{8J%NK~8|!y$mmSydyzcy%Bi-CU&gb|i?7j|UjFct>CT2x z+VHnJ+V(u+#N0IeLmV3>Xqy)`{qXa>k8B8qDqB2lq0pWg6-{YFmT%UAuBNo>ywk4_ zT%)DJX$ME0m^{}vuEibKhLB0w?X96hsqL+=97s)ow@gFC;_}E0(n~{r#F4L>NYzUr)V8*>$kW2m^OJn1Yn?`U zKlc3Km3Oe++F4|tm+ZG7T#XUZ=8%WVdsz4{F>*gJC)S>gszAK z>K-@e*Sz?79Xp>T3+CS=#{8QXcPuYlspE>T@n6@GJN-gc^h_lk4%2BxL z9`1zPp<3F8k$G{(0<3+Td1d`Z3c1^=gyliAykX0RZOmV^cy?^v14)51 zj=*g6`|QB%n2g`{QJJjmom*pfY@ZbDZ0>3tKzEiJ3XM36cGwwYOXmBIPj-DXgn1## z)s^EJg*BbQJwP~pTYMON+S@{ZSB@WA`2Gq^&a*h4v(QaB@hBq^Kewf_dgjbfw_qIHm|rmg7u0X3KGg92elY2tU3{FTgL| z$*1~AxF=%T2pZFRITC+M@HPwWVZk@z*d_Q0(R;QW=gDy;j$g;`*9-7(Ot=x+34D)S z)2#Cw%4!DvF}aqH<1bAe?6@Z-7h4)?e& zyoL&edPAYfDoYGTrOJS5IRW=I-sRKX!@@l3%0)q4;;y zE`_eoG`JDpU{{B>wNMFy7`W(mr~59q+d^n^97|1htNX_I z*I5>r7HjTJjYGz}Ec&9fI4q_t<@;12E-f&|6F8G_Ji(NS^QL_h_67r3f(9pzCrHMU0BB){1o;+hm{$t`~ufzC%YE*bnymAozrN$LZRhT zGG_Tavr-3TWVW2!{OLa+wLyGpFI>L(j5{TFJuPbXHT+svMax*YqllZNG*4Qb4qHGJ2)-V>ADxKGVsj% zZ=I8tX-TSU(c7I)?QqgDXH4BM99RhK+^g^G$o7Ros}FlH@2_t0)PXJNKoT1Ue+&1M?z|}byy#BrPSM=nHS010V^W8g>}g&V81of$ZueVznisjJ zc16bH3$YlH?%zdsS?_)G$0xcx*0w+^;kG=|Hpcn!#vz=d)!N*wH05PB4#BEl4MuZ( zyRL|I+)(J8_=1_^Ql;%)r#G>*9SVp+YxX=&@1pFf@)$NSvQdW0)_ktXHyDpPRLe(r zVJtQJ&Hi+b-NE&Q!~H?->Co_EJpO3%d0y>0(S|YJcy8R{S-!!z?YcR-|D8CkR%L;M zA2*-d(dbS*l#ss5>%FCM!=d_H1LMw|O!d5Vbm6xs^%d3#)p_H5G5NA=bgy|cyBat`+p4fi`f>t39pflg&eh_A?r=ECLWjMe8 z#u(Y|b-G3wi#&^&gYj$9Ccu8)wI7{1_uB_f^>zk3=LMU)j-`62%v+96#yefVa|GgI zo8sc=ZFcB&9ZBfNN3f25{YyOXYWS7ITU@*Mp>NE|3U-bQE{=2Eaop*8+tK0jj(s2H zLWMi_UUgh~+Su2*I`xi?>F~~5yFBqr*KR6GCk{`Z+?W(d9W3`yP|^Lcs>DTB0&!P@ zuE4sl!c@WD=5u>joH_a%%tpsT!3`G@I_ewRv|Aq;ImXle^2i;B_w04%Ua$2$zT_Zo z7VAT;Sih$^yT2J4x1;Cr6}*QZP9{3)o=@8OoL={6Qs=A6f4=5<<)_Z> z>X3I{+|Lh>JKXblL02er?D66gy>)-?{Ny&Lt1R?xf_6T^Q5Q;j=YRB9zVGbLa?JbS zecUyD+i^a@334DIMmwH#7E&M7vCMww+0O0HIddBvJ03omd7}O0p+`}(Erwl|AJzhK zsqS<%XLk!`GxwlLLC^BwSArv(_QmeWbmo2oH^VWFc~jP9xW_4DydL+qdJ6LA>(Gh6 z_w3i)&S^s(w>YQwjvni5nC!@X&M{-w8sFd&$DF& zo$jG~W;h$>Xz8cNUHJ5AXT#mv+1;J(2^#J_0{Cp}cv9;RbhLIG9%ZI^#+-2GF5~UC zZ*aPClWX>&Z^wMr+t`LC3Z83E8@l{XOmoA$7wAerYd(jDEg2Rl8R{Mi%Aqbb-+RY; zQU6;K;g2|AJI;-~XV{c`h6WOAn_ADqWPw|2gS}&e)bws@+R;T#@6^VnjREPDruU_1 z$I;e&Paf3l)a+xBbq`X-TTh}~%v{E8n|I)CeaP78a3u~e~8I!pm$Cp+;UUu zpm)c3hJ7|`faZN^;1v&GqHUNKc1aCK@$@;^*1T&+NxN_Gp|F{xAEW$rgQplJif>1Q zbpM|(O;Y!FwT#bGF?7Q|iJH9iWl!qBlc|H;4=OsOU`f$*6z--eVU&ACU5m$ijpjZ> zC)&^%meufZ*su4p@gWJG48ptd;4sDI4+Z1ZT|XX{IC0H;;YVm5HH&(0{gJCA6xOL+ zYdIZd&kxV_8qd_@KkJ1us$DSwV1hdM1-;v$1n;waV#mn_)DO;G=)Dzp(|5l5>GRI+ z+qJU~b#A}O*|0zxcY7WPYqYEaeVAgI0H|)Lrk?SqKTumn{dh^fS`m$<^ z7wF8E-?u9_k!z5^C09_t88VE z)KDnb`(^Oc=J=)o2~GJm&3P>;nCW%|rYDSh{3t#J;i?;kx;t^&BM$eVK&nU0vEIQ$ zdmcaAtLAWYqlCuZ?T^H`QyP2G9o^ULe9_}hJUHC3)H6c=0H(zCCOGkMdNzw-Uck0 zxLE0F{eJhACTufTK0OC2lmajk1k7KbYW7)HrTb=+|8YZy+@D-@JA>y&<~xG#H=gTA zt5*%-J$!W_aljQpcgX@Lro-+B=ofbJ$tmvYAhXP$XT0TT z+tK1qXvuCIu<*N{#zif@?JdLV(dM`nQ-0>auX2x@I-F_vF>BY@7Ch~3_TCz}E7*9N z=k;jM#>pAS8@oiE=3Tfu$XyAiId4VqG#C89rxyl0JB~Ibs>v5$bDFm-&~v(H8h93J z%|`EO*9@YsUS6JC!!(-y2(9cB5zlQSM@L>==Jy4a+50Suj*Zp&$}rWwp7jn!=XKf zJ`3x&tIzuee_YS)QLqU+DV`Wo>n?!Ba>q zwi<#7=tBhChXZF#OLz4H}hP?}(YkxM%^zGA-FQSVaf_z7aa3AWs5oA0 zg9_i+S_T!Usq`VWwC+|{p z+O3p7Ex0{oBlbT!VN<3=K+OvNFDzu2zL~~;JNxcp}ljmLP z>WKHDZC#r8w*xx(Ow~Iy9u{eI1mm01#(Jv1{u(wa8)9(T&Ra7@st( zOSw^fx3FNq@(UN?ObsKnZHFvrGtMM4$89kBwzJ#KZ)Y3aT5xgz(;6IFuqj2`^S#l= zIB4rY#^T9Ox`He}<8$z`CdM$QhiXnjN9+Eg&zFmKyQ%r8?mCVB75~H1S3>_TL;o(H zgy)GVdycP-^y^1;JkY@-#H0B3@IFubXb-;|IedPow(;M;KK!@%%)~WLYlGnUtk%|D zbvr!XGXsp7Gye4}Xu2QWw|(#3VvYAvDOC+zNR>rBx=P!dpr4CeG6ua%+nfZas5(>I z+suivLzkHGAoA8LYtW{Vca#?sjj5~cBXW}gm&ZMIe+rTA8lV_P*Te zFCNAHjz8Xe5EWF3$h;LTar*9wc4dNTVgp2WcH#ob~v_^a$mhQuAk434NdGZ^x zr{SS&I=``NUc^W7qqTX3>p&W#sd+&yvST8PY<;t5BbL}Yw<@spQ+HFRO-=TG4*hGn`&)gm4AF; zMfuv2b+uLgB7NbKd3t#*#8&CI=+_r%h8SIiOUTd>Wu>HiUBA*Y^op{Qni{fDju9nB zFDAh}vQMz*H$+!!CFLrlimsxmQQxH{h3ow_dP%h&sgy=((G(Rm zLN~+ngrhWA%y&unGb4*paNkOYLvHG3_{)f)wM#C}(C@lo#?-s}xp2eXT6qQPP_e$m zuh&%Q)d(JVv##1Q+;}!E3}zcqT1*7>oppxUu85R?e`L;RQ77Nru_g zp?$bOlcra!)tAm+GQpMu!ODs%%JemxYcTrF0c;69lXm^2shiSu#70G=AVkHnWiKqQ zKm~M5h8b)&JGwb+>xE@>FT9q+!RfUF&3i=lgzgbd*AWX#-+8nbR zEs>hfovkhQ7y3)?Mc1;>EbtQlpyKA}Ykei9$OH4%78wnO!4c8L&@|lcW`I2-EN^Y3 zJDU;tF6Cqc7(KYuU%sxU7#+E=q6$Nz2JKX;1_Oc=p}&^YY&IsOx#IDaPnRp`VZ{}- zrA2zVA4TcKh>hnj*Gx`JPtg(jOSO3wf+y+-{D#4_#$UuxNUW75G+nrjB3~rzs*2i5+N}r%GZmp{GTbYMD~5RZf{du}b$~x6uUnJfj7ovMZ;n zgj+3VL_tzU`_}@Sb70oi_$?9NB4G)aY%D>TH_m$DAbnJ!TD6`8Ak@LWb}hm+F?yfB zve;k7aOFHJh@90*_0>FqSwQtyJsi?C(zMkY-2Y{++Pi#M1P7-XNH$Eg$~9aEBRof_ zTAE(6uDpWFt#oZpd12M&O1SAcrX=_-4uxtRejXt{*OmL>w8D|5j4>Au86B=wVI)=@ zrW9k+3RkMHi`M2-aojNKDyoXKb?5{>y{{a+!bM3RCE4|}@D!NZ-4vu+k}m?-7@ah<@e18qVwpf?ZKnQd3-J^_dolra+6$pz7uGqd&o~YcQd) zwwqI4bo<&ljKn`1b1J(;pY*=Er}V~1H#I|PhWn{nB^mN8#xYjsmykJw_8sHj95<2J zsR&z!IJZ@BUWEu}rfcCbGea+`DEG5^M$bkdWnBW%=@O|q+(G)dW^d9y;xJ2adMIxoCnfmD-P2%ov26N{pFKZXc{ywAr`caa-Qv*_tOA{{lN)pOiIRSH~fU zPjHPq4j9qrqXB-y&TrZAIkEb-9k;$td`|4-_wL%9YGYxtRxd2|K`)sj^(m7kAQYUQ zR$Nn4Sv_Oo#C7QOwQCsdn>T`LEwgqaLtc)@GWH(KkQ2b6^M29DSukbNlp7~yPMMy5 z$)k#G;k$AEU+=l7#~(3TjP@}UW15SfQ@cXj0Ogq`f&u8d=ui z;MAsR1H`@`tMhqkpJ{U7H6X6%X_YuKEmP+?+9Y%!rfv8+5&h*Z$&cp_IKNq2D&O+Q zDgGO@8>RkZ)b)w@8%Z%LYJ~NCbmRmmCMp^Y&!hWKjM`B(k|jn(SF)bl%VV#Jq?mAT zF=#Pr7d-3rX^|74n5gJcJipm?{TADK^n0WjE!%cI$96u)cAjTD=O~Dz7;RqU1Sm%B zh!i2ksNH<6=ZhjIihr@~e2MLRsqK8Z_NHY>@PE=Du$?=le=#GkbMJJfe?xy5i19by zI8}dn{c&6V55dP2ulNUPj0I&T@_$$Q8)-ammi}d)FR=`9UN`?A#k~FmVuP58*T1mo zdyC7sT8VN7BD&jY`M(PmGf+#_#>;pj7xUk1(`UO){nm;YxM!r9sL$7J@^za%eqb`=Nd9MS<@s#(_{i2ij45d*=6Bodaf7Y=RW|tufe=p2 zf3vN;-M0MQw(<_!&hHR^M4^t5sN!Qu+hW1CP?5nUIwJ(jS!m;8_hGy0v5( zo9v>*%*PcKF=cbLMNHY$nV9leq{&0k#FVXc$O1r8I*4vc2jD7{t8|dQN7tAv{*fy+ zVwTG_C^6-!z64Bp%Y;sOD+E)XvO^L8lG0(2ft3!ny7P)^JLq!}ShbzlY81{n7OsPy zX~d!@>+Zq+piMl@aMIlQBGrspp-7sn-U<)On*|>Vj}nil4eXBv{As z2ZE{B4+T@Np9-d4e-%vmOi_J<8IkDXlc@~SK>UcQGk=ch_=7~f9UR0+WOd9|&}gqY z1~%=+Gi5i}svfq|ac=G@&mw8V$89zo0eUhEN1A{iG0V>tO#S_Wsf)4?c&N*FgigC1 z5KLX35KLW^4*|ap+$D7Kyds!-{ai3@$V5Gvs0Z;e=uADLd~Y5(B7NpP@R)VK2(06p z**DC(XTk@ujHvzt`3pdwN_rOlAZ6mma=oC>6kH9wkT@TIke1@dHliI?5zoaRq}BK_ z?_=OE68s);vEZR-^isjM09OiD`^*FL#+ONrJ7C&?^&*`%P~#eyZBZa}>QEyXm$W*; zIA{+Drp@;Y#=-FOV5aP+gs$WGu3#Lr4+M|G@h^hYaJ&NcHT6sqoB{e+!IOa1KCqBK z6_|a|ZF7J z5%9AHQ?ET{|lHpnd6AIBhOz!Url@){vZ|M=io$v#Ckfih>V!p zG5#RE zgdced!SkBn9l&oA%cAu6Lf;JiKM*_%6Ute^7yoZ@=L1(&mG1q0z(0t`0wct-Iv6S@ z8Y&s3%^Z}JlqM~QsBuyh6cZCsM{Vo|C&QyTH>7T&S%YLFmX$h9gJ~s><51b1q<_}v zq-JGzytndNIc0HwzqOuq&SG=WnfJc$=Ut!AW`EDKpY^O~{oQ}qdo9S%kSF2~1KOmA zCp`pwxTfsi2pumuPs`)Tw`xujou1I)y!Re9PJ|SZKa2BdD)}}o=NzhLt>FyOIR>2( z!ry_jh5rSdL;jhLn@gUgc|7^&n)5~f5$I1M-=XDG$Q(!zc%9~%qR=TJ7igYOMi~yr z_3x4f6ZxH5#xy{16A>Tuurfu#M`4_l$d7I2egm6&g z7a;CoGEYhf$H~(*e<3=V&^bk(q2*^po(Fjh`Z)8Fk96aNi;xz_6Ux_veZss)8zKA` zaJDelGvKJuQsF1Si^z9sJ4;0V9OUJ~ z`@l2 zBywNPy+r3bl!;HcH~dKv&Vf8lcq#ULuIQPg<7SHdTC~UWAxeYSGQJ7=ZQ^NG^MPZIxuM6jb4+(SJIwee--w02H{99p; zXPvN_eDS$1*@wMXI0gIjg_-VU!l~F_C7g!+RAHu7B*Wp<}<9C)!X)8bgfa!7#uUg0D#J{?nXwwZqw=6RCi4E4zz zL&&tlXQqk~_eJ3t@JqtX?`y)7Ab(GI3iuP@Lhxt8snGvQnD#ji(0&Z~J7Ju1ogaj0 z|2&j0byy}7ggGqC6Q-SC2&aP=3uk~Eg*nXb5gq|PBFwnQginM2Lzv}|h=ZmadJ0z| zFTI2x1`iUZZ+=UElyEw9MhjnmK>uakpcFyy{Q=tEQ;X?3UOXpQ#+UNYk z^o?Wf`-UMuC`|jG3uEV;G;-*3E@Z~#*nC=;{iOrW0j6F$3nw9NtT5BQk3fI7gIN^2R3xso^f0=M0c&KnOc%CrZ#&O|Y zi2FBT_LtMbOjZ@)lvH73I}& znO3|o(@GGog?CdzH zUo2j3@q@yfVP~E27VxiyS?14L`p*l~=iduwL;p45m5?75t^$87{4n?{;mzP5gv${( z?!0hWB?_;E{Bq$caHg=TJ4^pI;Rfi;5#9;DSD0g3K$v-1X~`e7s2sgmaDNFv1@J`4t$4wpE635|e zVfr&xco*|4%&~5nFzezW;XTmVAk4T=3G=>lrzPJlycGI>7G@c~CtQoT9}3rlKNj8q z{#GLhZyTEzEd%(q(&Me_3$nO%~ z2Yy8OO)zHMRpt3Mc#|;4tIfg(!P|uogLetjhrPmV|E~(O55~u9n@!+UVd@VO-UoTE zCBIqtO~|KO@_LJ(6@D8!ZwVg&|Habz#Ny9|4??F!nCG|-_&*8TPZj+6l`x-SJS*G* zyvHzfUK2hAJMRde2LH{{`BL~WY>RU&&J~^lo$ z{GZ^U@Bv&?tQ7tVat8DKzXN%=60vJI372d33G+CEXRh8W{VO!%7RpKJqZ#fg=J6P8 ze4feR#YX1bysF+=@Cd4|uhrZOJL;^4j*ncX6)PK_}0@u)CuJ|Ucd{U%|SO@lDws{f(Gf0k3D z$WyU@Lzr>j6!v5Pp)kwxGhy2KTsRYZ{`M@u9|TpuSa*zpK6w@@)c+$}q&bOlls^N@ zh0Haad}OIpoc5gr7BE60HZtpiO^wVnhYB-I`awC=}$d zOoPn-->H0o)pKmhS>On?Yub$QKY;stALa7yL<*USAf#e5|EFVpc>MT-z&c=B4% z%kybr=6ky^cFrrp%*SqF#@#2Jfjz_7%Jy00opB1#*zPBz4D%2-o4go*5OT0lz6A1I@@Pus90&PG$dM%{;YwZRJYSL-RKEk$U)6@e z%oA-=$A^8sF#Vb-oQeIt!r19|DxlAL35uNc@_;aH{+lrC!m6A+;e7F(V){QG$JPHkz!Smh{~chK-ylmrLzwx#T9{>dy`{tV z)o9ZXIrC}S2J=aN2<6Otn(-t~E9^K^1M};{_@}6jLUSU2-BBE!c0@0kHr2akux8gg_)1% zgc(9?x%=`tgQI2GFKLRuEgCdW^{!wA<^#2y2!!q9>a_T=T z?8APmFzf3jVV1$G!q_=~7G`-g3)7Ceet>lHeyG6J@WMf2N z{>}Rgv_*Zs&!Fn1kQ!1K(={h!mw zt{7MjTz`XUko{oVBIkom*^UJ-?D2~`Cpd%3ib@Iw@vFr_;jhxv7kr^Fl|`pyCceun zC~049cG2u~mVJ z?ML`pxozh=yMDwRst?+W3(&~=rG>R>gyA=5Ky^0f6|p_lUGH3D_Ex?hK1e)d?(r?#1tk+ozd%3!jZ zEh$n`|9CtO$n)o@St*Lj%I1{K3zZU2I=YO|Ce7RfRG(3V>7!;&o6Nb87R+O8Nlwl6 z(pK8mnUaF3MJ16^l8?HlmlVvH*UnjC&b;~NRD>?seqV9v*-qf&X0%5&4}@y7lQCPz zWE!)T1!D37jW9vw}YcqvY#HM1O8QOKbl~UWJLf_m^URYL8x}enI znSFMtT~ud_q~}IL#TA(-rsw^0vDzK$!~V5Os-3nxeI{l{nR$27WKmYlxm5wTZS8he z!D6Ue>>V&R{0VHx$kRgO8 z5Kh_BUITEc**T;`D0RlR#XNuEl!qC7Fz#Xab024lq1xoE5J(&o-4qQP^OK(rM4V}1 zbM^@cHP_S0U!@nNe0ySTy;r zB22t8Q`P;T*#$F@#qcpSPE2YMxy04EdM2jEDVw(dcOopKVqQ_TTlVco;CvID&Z7(y zs)S0#E-lR85|T3;YF54iBx+5*)Jj2@hB;$ccO((CWV8uS9}_vh`iu~|3~M)=Zaup( zX}8ocQo3L&x*TTIDlC?JoCvO|b1w7A*023!gjQ4GMTlndts4!dXfw0Nwe>|CZC7!6 zSy54|1eEVGm5*&rcf5khYQiXV?CEnRPcNG@dops2`_@(_R6F3jQj_n(3~cSHSyiib zEHl&8bS|x|>Y~+`M!32wTWlr`K3&%+FP)@(@n424-P2cak6 zh7tS4v$;1}SB+lfb~Y}WnPFTip=s#5qG|Ky4<05BMMUl2eztRJ8Z>zD(2zlRf!SO5 zVBsGOtIyZpTpIO5a~!7+A6iK8$o>=T$$0dp0-vYYfzK}(ilf@<@wti#MsFJQ$bLDH zGg3ddxgEcwvGEw6eWbYTl|sh(B}_2(E_2yC27AY#M0R5t>HfT?*`J504f@_WlMXyIjU2o_V$dwUE6}pl90)X6t9{w1-DKA$u>m?6Ev= zpdksg!O#F8`}qUm&20UAoA$b5<1v;W|G#4U$M?7*`PWC{__1e5xn4g%qdh#<3)y4+ z+xGZw2%mSFz;qd?WBWG|_HrPjJv6zHy~9wn?eSfIKDRT$*!v5VY=nZv{}*6_vA5P`FJ^SO{apZMV=otl$>^rtbFL6RpEJSO8v{MEUk+@5J(e^5 zyAYePm+G>&2nW(64tK`hF1_{A2VxI?V6I*o?gl6rAnf=8pP#E^ROvdsjlww)ZCNoxyS1 zyF~QpUkl>f_I!xPIx)fEx6rfg?L*^BMO&r4%dqhn?Y)l5wCz>l|8&S&C>VQ1F1;G) zjo?5f!RSqao}KQgvHHDsrrR5vNq30L-rMM8oF~KtV{f3#Uc-3&pAQY5_ENAJdyk4e zWKjnsR%IA_WA71{y^N{&KN|{w_WFt*%Vn0UoU35ZKCc*iO;EPWZx8g4L?{@&KR}P{ zmm|lfh5JW;$aswDu65bl2YXjY9PW%gexGaGJ7d`!AbPaN|Fhcuoo>g!e$cb+B@~AJ z8)(_WYKYt)(!(Ki1 ztT)z+v3H5fUJ2}VWC9YX$G|nfZF?tRFB5vShkyNq>^+BeY5O-nMYlWJU@-Qcf}U+J zWqSC0#DAOc81u{TjBR^0ur~v86O6t4UG^5iUI~=wAO1BGvUf8g*!G-0`hPlZdpAOl zw*7M880;+t)7~}McuchyfNd`m_V(kL3Djfg2O#_T1ECn1IDkFv@qg+(Mtl9DTif%Z zlchp#g0a^ddbT}(vHl+|?Olh>*yFcdwtpG0x6~LDJ^ti7fVRC_*fZ_r$D&97`ofrP zuL1V*X+Q#PFeF3CwwE(gzcWJrvasRmpvQ*tCaE^2W8{mtFCeU z7zR_nF(!Ka$#1V1$Il-K`FDl;+l}~b>^Xe@Cb7EX zw83ppSG_lfg3z-Abr?>eT%vPZ;FVL(-v>ZQLX|Ur8@*p6AI3MzX>S(_kjHs{#(XgU zR}LAL>9az58`hFx85!!xkil0C(~>E%_g^N>uQZK>xytyWiBNmOQa`ZiS+6iXZ1tpj|(pE z5a@SBpy|x=jsrW%`WU&_9l@tcw1-G))yxX6>+^=T5lY_%wYHTlh`?C4MS0v3K6d6C zorkcbHGTSN>))+@S?iDu%Zm2)ZRA=j{f@M>WWn_)6h#Ne``zxwjONC4`cLogiA`J< z*0?0CYc5xtRpndvC;wcv zoJ-;@PIc|mm3XPKcHi2Dv|fihW14{>S%(6ROX`}YZfhKY#RNM$2O7N>zqjMgYgRSw z4|vrIDqgeF&uJeFmHs%6D+e_=)iLK!@7b|BH7V~lr@Bva;;WuOPbab1Q@{1-Yf}fT zDGkP5oiuvDCI}yk%{wh?_tm}yx7C6|SoU=|%#H5IcS4$LUxFN~q#*lT4^}&j!cztH zbjxQG-ka} zreekN(wex{!>YYER0Vyd^>N;bH+qe?+M`E8eg#hkQj><%?z^@g ziVa*~F>$PC$?=A{T>1rb~2a ziKNm+ae>#*EX*9dt#L_Uea4E4<|ZfiyukYO6%{9&^wLC46OhvPv561Lnmx6rVYYIR ztb|ni`Q8^=f(7VK6@ld3K*0^BA=I8hyHX}$=o!7fcW~>Wj?;^;Z!Q=c*!z7$)|O!0 z*9{l1LQjbCS5>Xji@a@;_3E%bRkX9EGOpJ(^@CSq?Z4RC74d}AWZIep$D7?pI&DMrh+WX07#UU@eNBODtT)DKRX+Ij) zcSdkeY^PyXFKyN9LTiq>r0VCrAD{(bYknX5_riTUOc7!sRa;sfMBE2j%k1NdD{&lY zkjps^@&l^~VVK9G$A!ATA-@xtUyKV_@N38J#_`RKxhNay(Rn>OVhLyOh~Mw*Hxes1 zcktBJw&08P@-;p#xwpInnicxN`qeOl7#*ET3@&=@re8sXYdR%$bq&2<(-To95{HT1 z1>Lt5#LwK1g%;N|ZrWNKjKjKi)g7YI{`Gp`Rf~MVlXa;{iLssv)qB)0jW-+_my!5s zl=q@->+|9JruC>*94<~ud@&lo@hgxVkHLIl!x-`I`O5cNf+xB1UlI=099gk^*+WsI zOX)oFQ+Fv`>-4%T*SUW45qu)EK3`>JQdjiy(feA0NA3=etKU|8FRt<7gkEEHZdOan zrd8V~yq|^T=F?Z~;u5e?qwBb+Q{M5^>gXusi5bG$acknMa(rWkM^!%N3?F*+i&3K= zcMxF=)___^*He?Y?(X4k7@C6>3sbu^tP0Lu)}wRfA*W$g-lv&k?_0JbYV^ZS`J=n) z*RQ@ds&bVxAQLNuUcG~uzGD|oV|6i}^4H?4*7?d`jj!G8^FI~0aYt0A70$Merfr6(#2aF_C*M}k|I4R>1M<`F$9nAD>GDXfR`t86PNSSDkVU&!tMd1c>xbo1 zheueg%AXVG-O*eZgEGnd@)_oVr zD~2H#xBfP2^ud-wv%h;D|Dx+FxBZd$*pVZwo|jlYfBTi4QQ zC2I9#YLZ@sPp@n!ZMk@V-mM3ie2-vMbxh3ko?X$@rgn*%J}hc#Ol-}`>i$VsLK3o( z{U4jTKQW_IUEQLm){MsTv${S1us5`>Vl>*rmn|)+Up^C+Uod)1%fRUTf=+5BVCLuc zBhnXCI*IT5ruVE5p3Lo1UECAHeP!HqEW|yXi&&1n$Ej{wGBWkjqrIZzb?jlP5WeS9i$P=~Mzx%6wdD{) zl()8{O3~Y8b<&8fcod)(sAGS9ac>XPxc7|CHu&1;?gmd(o=>Fi=X<>^TU$`BXq4WS z+H&IU#)$r6uo_N3SuAbIygjH3zI$6_{K;CZYw z>^>9o`wKkJbZ*$%w13OaxMdf6e$_c~UWcl+J}%VS6Myn*qVI{W#;R+{J*sNr@^16s zq=fhx-D{DQ2^y8~H;+ibpjn}5h^X&JM6>?FN9tZLQLF5VyAiTAN%Ru4?u zq0?nMma_X0=9L-MxbNvux$B3y@bb}4JAX)fS{+c=3S#PG_@}iy@4dMNnMXEfdc6I) zzsBQT&JsaYo;M<<@{cWP2S)E{No(r#hnBSCdmCGwD)fl|$l1>oSjSGr;UYMRszF{+ zEI0%7YHmzYZm7KH^|%0+25QyCy3|MW?#2XHbyr-HIMykSMS*)e)onceRQi%6{XGZNE z>Rc1Ad+ZZ__yXPj$!jKX9Y%OiKVkT_Sim>01H@QW5Apgr7^rgk{_J5a*}V61XXL0T ze=sXB%HuEpDlp1v7&d$;$DLr7iahqdseOOiJIB*I2P0(OC*RfHw+oAO2gXK~*JM?X z^^_ydSf@TYa7A48#xK?ePsjAH=$3@exP7l;| zS$5IT!20rK7hO92+vLE8=w;pGudY?c%tvGh@9;7?lD~;@Bx~3>r*o9ByWQ zgP$Ld{w_k3uv}=3Xe;z5ItI_q-S-~<$URJJYk1i15?J>nJTk06?n^cdK?zMzMXIhp za9`qY#_fTO**C`KWpu6ovN}0#h+3w%pfBzQ0+&CUw+O>sAoY^O)R@*{~2oj2`Y z(-<6uo07o#>=hNeahcjJu-?C-f){$K4q_Y_E9|s*Yan?%23K<;dE!mX*5tIkH%Z(R6{y{Z`yt)epJ+r@)G(KY1t14B;%aY0wh;~N zfO@HY8uhkfySjzJQt??W$~LZ6aUY{x*w*CatVb8=>@@8EdR$cHET{SpLwI|VnN+uD z>ZXdi*UxO4Ti-bDsZ9klC*0Eo=c>f*PF_UXVU+UiRbIjl6kLSw=pa8}oC|JJ~o9@}>&N^Hz8R$rlC+5=_Nx=y;^1Wk@3~ zy1tJN>ME&e2-Y7>zOa67T|q)!ZOv2b>t1u}3N8o~bgwRmUo$w6+EzaO8~+hoVmxAcY%a>w2&)0CBsL(AnD;V_x$HFY2FHzi&k2>a}@8H>3(BEm4DZ z@q_`Z13f%>2afA{-oR@^RnKV;WXX7~hP6(C7W}R(=gAUFPb)hr-9=mT-u~<8^Euq& ze7YgY#1CM7*_v+~8Uy1zKt-o?A`)*w{!JE{ZrP7ZF9`(qr)oX+_2#hI9s6d+sWxQZg*o`bECRN*XPB& zjb8M_m>BPQpVoN1m*OmO^Am$_Z>WA^{@MfjR$iV9ER@TI4O~lD`K%r$RQ6VDsiq!U zGGhR6G{mcN zNPLPnC9K+Ih>VKrq;J_fh1N6vMMxf6msg*Kb^ZLt9Oj^XU~p4buW=PJ9^nS?>vNWI zg!AsO0#lyHU|eMgUZc21J~4Q#F0NqI(U_RXWyXP}f?3gJmY^!4Lvv$jWW#yry=YjQ zntG_lGh=(lxwv`h>Wpouk4H3hVrq&OWNjFM^uq@R8MZ&w2*cM zIFEVxSfqKw85mIcLy4lm6Pq{upiHWz$~!vSdS7VDviV7m`-n;#XZ)jyA4pHFKUyL8 zdfqN;PA)&HuM(a-PsKz6tKvz6 zPN3-O>Y_}&Y%$kI9~j&Gd@h;1JRW1@xJKr! z5;0Ed4#^aZQ9L1fS8iLLd;oo=va`dbzVn-sw>5fIve1~$WYNc-tO_Noo|58er#oAr zXB*~<66JeO)Y$v3&is)#X-va4FQjDQ4%fA8F|SdI^?I&eWpzT->??{8DRBS9`jaU*j8c z>(M~pI4sXyTvpc@=Z#9^GnAL;GWK{lfNR&e!L5n;>~!V7jiV07(L-KnR65R(2{D0w zWvg0RmTmVeIUSgQ%b0yDu7(zLUSgVwA9%L5I<4RmRgH2_zH%m#w zC??(+6(Iua`!FKF>@%IDnFR;ec$RmGRI*Ndij=GU+-Yq~3(gO>CEpW8E4CArgZsw^v&<>{$ukpBex3i5clI5fU^4D~6Z50d600|!T3b`!Wy({&O_q7#T&J{YTAhZ6Wr*m~M`s1N+BJF?!zAuqPo z-j%HD)jYTVbMiCuKVDl9|MDd(qb@CKShc$@KJo4yEAQz1c$cG1^+VVFzgXg0K6n_^ z`rSeM1<0HA>)bwTEz;1N(PlZ`LE#nhriEWIH7oFi)%hl2c$vrus^*o$@N2y0HBU>~ ze47_qmCrgB(Rz4!LYJm`JJMc^F`}l)M`$ra%ZfP`^2NMmYKkW8P@5x&qaA2-B$QH{ zBZw0&PWezGyqKc(ihFn&MfYl-=TJAVw1-w*gfnfD47olHhh`MXO2R(%W@*Uz2*+;b z7bm`3ZpjU;qR7=`xsIz{^L%+Wl%(}Bi!%}HyWmIZ3(aHY_q z!a>d`tGDKG+KI3lD3-`9ns-;f`M%i&TymC}v7o1^lQ0 zi$|lNeCk6iM}J(4O2lwr3cPfdNKh-%|~>VkP#@H4z#=e+)E8Ck5rIx5SDt~B#5C%KjL%DjBg;!~fMVFmBZ zMXl;Ig3h#(qJlDqD;nDwiM05$RZ@AXZCDLUR<*`g#>HGD*_0nDku5}3;n|{_cwAo= zA6D=yWy^SIq1uq$a5KPL@zWNRurEvT@`Gnpm~F;NOTm|lWu>PNl+P#&`(G7};PD6f!i)s|t`?pM zJKga{|EFEdQSJZtuHTQj(&zlSCeYqhE`Nqfdi!v!JKk7)%XOUVHJQNpbuN3HQ`!U` z-|hPSk?VJFdAaH>lv{Uv0q`HL@{4tq&;6o57wLA#8~KSY{X1Oc^@JSf{7l{PhWsTi z|L=7D4!V9b9TS)z&ZBPvf8%VS!fmQPdOGv0F396tL&OCBo*?yeiSqvv=Vkf*0*-Ml z(05$^Z*%>Qb=BuevCpYxy5ptP%U#Dg|1!f3*t%o(9?qp^0{!9qj|_jp)*Z7qnYD$r zy}?eI%ifi){Bv$26KLPN?pRgh8&~?zi+vyB#>?8b9(k#bsva6epcyjj z5wD^-9vRAbm~u`l$8p{xgFVM_4?l=NV3SD@zxk~MnYJ$xrfr`vZQmqJor%Is=T>1R zQ6Nlvg~Cje!T48VycBY^rW3Pl#ke8DO;t#@7Y?MC@d5}Da(r`chBji>1O`VfcYLd zZL&Q0jVyUQc)svNFt3G-4^_f!Uuw-D@!^jmp9J|wmcCji2s$N@b3SO=DFt82ej;(N zwb(DrG9M+(GS9bk?hu|2`F+Amz}tk&!MwgU_WvZj6!O=EbHGQ0gWyxbE5T=kflg=m zXzX;i_!5g#Egmdfg}B3o9|n)MbaI8+4{jA+2cBu^%n{xI`9k4(@V&y+UoKn=-YdKr zd|0>__@ppUuepQYTfiOBVNAZd3O^5dUt#vSp~8OfaADdUBMfxL3ul7!EuBJ3=T6~l z=*$*o`7aS(1g;dO{c2&LQzOi{j|wv`1IGadWJ&S0Xv;BVHW&miHqT&%dQ6t1jBi*N3bC0va*N5(DMeY72tNugCCl~je33r~`4Y0Ut8%imtEHmz z7IapUFT@{&Dr~er3G#=9%Tczh{si98AgHznhMT(Wfm!xGY}8>L%@&3!y|$plWm?o> zJ**aH75rY9MY>x!1^YLJv2)%PrjLIW&c^;DVeIsL;IL2MPmA1#eKFf4|KPht7d2E!np9|((4W_L62(xYrg{OekT6?fl2(GmB zR|>P99~CYE^LY?$mV&vSin0H)@KVT|goEJMg<0NQmxB7K;J*rw2dncYq!{;KAD!>aKjV%F;=*~}tv2%VV%zWG-%zUtJsL!wh8#xtwbsq<&@3kVQ?^}fF zd!sORdi`|hvpn{TJQMr(g|X9f+ltO-BKKi`LYU=uS{OU$2Vp<g*^^WA@#dXeW;s$RhKMb!%!uIf4J z!K{~SuqBB8kA>;iNMZVQt1$hVBh2z#EbPPneqs9fh%kNJAdH<}+Z1WB?ik!<)dBs6 z{s#`UkH8GZsj?aDj#sDe85bf zk6IGIEFbzxX8Jr8ky$3HJ%gG4Eh1<7sy##Q1J4pUc6vT}$mt7%JMRy`w>EjdUhAs7 zHlzH9%pc;%lq;+>GsgNCf!5OY12M&FbZRs zDsvVBf)AT#3`xcu=p;iY6~CD-=f+xTF>bCPezS6_4hw%GjbyDn2&NcUh&|2Czvk~bKZyFsZjY)6FP^c;G7qJvFQKyWW{)W zLrodZiIeA>If&a#a;x923cq?4nr68D#?WpQQ(vLN48MDG)_xRzLrmU-Yd>w7HxUy| z&MPjMRTP?Gcxq80=Wd*aNs#qq!^Ri1r)dRup;AJ%8KD+r(!(}|qf=9_nnjun_grqa z8_{x(O?2wa`R++|T`#?v2=ra%+dbQ4x@?N(?Z0-WtEI}>C$yz!p?0dLinZNf^U_mD zwm*d|-Nj6koVZ@8s@KHM+7xt=nWoDzO7$uALYmZ4`?EoxHL~&D?#%94Y5$L=wLNQo zBF}Kk!MXixM2r)0(plA%XNAibJg+H-Z>_Trf~6dK^<#WcPIhiT~NOrKeDj&cpXLVC6-a?j=7 zKV+nhuex{e45i*r3^kNcX0(Fp@`Xiu2@|b())sDR-Mq9Hn!Wd2xj09}cB)jjfPXr% zcA~W@q*gNsxB9`pW~SS3b3mKN%ZGEyTF)MAzkhEMQ@v2l!plCX2FBT~V{z!^v2#pM zJWbClZ07GZ_UWmdCyPo-=HSfLc7EZrR;lzd^+I^7sfN#0rR_!xyA=LRp}k3p!@9^{ zgf~P@cK^xQg{O7Z|GU8Dy$V12kzUW;{PqZNemF87YpTHeB|GrGgrNWmZatqmqW>5@ zKAR`|<=8@mhfk3abg+qO3eH{x3mF$>2~r6GG<%h9%1io)Rgf+o-g!$+?2^QK{bLga(? zm`Ccd{J4IhZ7&;%r9*ClvA59W-P~=i9cu`LJidH)!nTxa^f9(Os}Z zd%QO`_SPbAw!PzUn)kyd7<>N)J+fa8_y_CfEVRex9>(4jm%Y=l$LHcE7<)f+*~^DL zmJ99iag(w4E!g%iAB9^3nF+=opDmF6av%tM^AVBu_&Ctm+XJ@keF1xXpV9y~D7_XN@Kp|CYGymEu`j zJ(TEQGB)EM->rb#p>eVXjR{>n6pX!pfgaf}N0RW+X%U$AF2`o<{nTY|7wr8~;&5l| zjd$6rg1x0UPJ4YskNx*z^e@}L5eX<~$W1Wz5}`--%Yg(u_~o-O+Utjn$7t{4*w*&O z!`Kawn_%o6hMsM2yk)OHl#RX4uKccpy)W*v818kX%AgFWbXdMi*z zCQy$X>ymq8FVz>$6T~WA?mvVQ^?1%;DE8_9tE(UQ!(-eA$@$30_xTLzJ#`qWa6Y%^ j936q{I{J{Mj%r)PS;&X+jlXG+?+MZlhC<~Z&!7JThNaJe diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedcrypto.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedcrypto.a index 6dca7f91a0f58ba735fc22f76df365237f840db5..024bf3e58733a20817bcf964d971f7295c165bc6 100644 GIT binary patch literal 909936 zcmeFa2Urx>`}aLdFROxLZ;QRVV8fPx1$#rqE-bJVrK}4mSOFVgL(~XXK%>~PBw|az z7z4&`iZzy~QDed0<@w%Ic4uZ6li&0Iz1QCFFlZ)wLU{#$#$ zV~j%B$2MRT|2OZaA2N#nL%W5oj`_#k>o8;SpY9V27>ly@R25_KZ}!|CjKzO*zk8Ok z;CIW_!x*!Bj*hV`Yd`;xvHVZ=H&+?U|I%*Ny$kan@8N40tN(PL8^>7v@9sOS7_0we zf1SZt{a?0QXXG)qU&NHXj~L9@3VT)&WBYIRO9hOru;1Rt*!~B*o%JxL%)Lev#!kMs zEMe^a+q-rou?i<6{i+8^)#$LXs6fyR~ zzPblvFW>VS#$MPTq%rog-NCv)W3rbEXB?bAvo{^dIQ;+n|EJo(ab*|gU+v!}FpmFb z|Gfd@c=;FOem$RY{D)o1_%o8degdO3w||+-D9hT%+-8*WJ^C1<{M^3MiBbNid!8qw z{7?4dZy4o2?QgRf<^N0fa`B;z$-dNyDM$Mn#0mTMIHsJiA1h(X3H#5whyZO+On9`P zMjP!H78w@9hz-GdtyW@)i!qamj3z0gwJ{U5@qXIKK#2q19Hf<+$we7CL{Z{gVUaOf zeWWIwEjZ4ikJlN?E{Q}gNhH;jwfJcR10;pxtbqa2vT;@v!(7_n05^9J^AYCEQNd=< z7^9cCh}MP&`^9LZjTO@9!!%|aNMskc4x8RgB`LYIm&qdSJhGT+36WV=X;F;0B4jpG zljuk{zYuMVU${2XSZTo+qX{uJ21G@Ln_AJwrbcaKY=o&bLKkLg3&BV)pX!?b!oZJcb#l%3X` zPt$S80yb#}G9$e)%G4+I=RrjG@nE z<%ZN}lSBo^U|5023RflQ$5hGiQ^ZgE~x}jvCw~9XdvyP8)|# zfIT`YSlZ)4L~JC@1xb5^1j0{LP*~(-zo;N1KH=IAQIe#=Vd3F^dQD_dl<~Ss>CBkO z9hF4xQm|_$Ya>x5${Hdq51&GEV)L^1K2?&GHJX_iygfu485E|8^oxn|3yl(8 z2B{isl327e#-vHpvXS78j5VyeEVLLSO&GvNv145}{*4g<(sp4ZxRGuy3qJ?UH}eCqfTGEJet{KyAk-GcA~qzpO$L2INzjJ#k>D zHgKZfRINVB>=?s<Z2k)6J5p>4}@L}50~Er7_5?uoxy76#!Mb3zV|T1 zncjcMqQrMv@+j#&hCEhupJ9kHB}QN%!!tEDWWm>j6ZKN&9ivUdeprGIC5e7a>`M z;#-34abaYLZ%@VX{QQ>OzVh)wS}J}_SX87*57E7qUwBm1#8@4;g4;!TBSy#SbW!>k zaf{#rtBrs%HYOD;XgqyPn8tWD4`gE^q9)Vbzesv=_COt`sZlu?jZwkDlKzZgFMqg$ zktFAvGC~t*f?`pW`OXfcT;@BKjWRo+D8^7}c7c$*==8yU;^jRyznMuGqxTEa2ZYGL zBv_@>La?G0;9naQ7D&B^+oNbK(P*&VWGF_UI4RaJ^tj8UOOW{lkx{f(Rc18R8jB8) zAzD3Vw5bnyV+tqdGMc6*ccxZOV);$M$_w3EmX*NNZrZ9r@&#!!NZJyHHqtg{E%G#e zv<}TSH&#Vsj5q4!kD|C4OCgN$vJ*_vYK(XNlou|M$xs!eNwVlIGK)nL%x%bnJDnE* z5W6u(n9I?otQ>5FEQgteZYq%J@-AB*Q^6)Oi^UrGFwM^;UdK$|?qN@(2=DfrPgolZm+Tg|19;gWid+_8y zbnziS(!m7-N&wCxN>XUk#?b}_h57~JHZ&;8kdn3G_S8=&EdZA`Dnb_vWr;OeU_zdU z>ZrrorqnKJebx(FL(~$iNm2#YVy-FK2y<=EMo_QH+FsG7fw|mx77!L3|Czj80&zE>l$<)C!f0Y* zaqC$2sbwi;e%My~H*TZ}WnM7C#Gv9T#wtUYb(%2aI)M-+dg{lSWCLr0jwYX3qil3> zDdnTkVD-~Q(c(*Rls-aZRC(G!E&)qsQDrzQTUShQ+%H8%8ZVbZCay)xju&N*nIfKx zoOf|{bMZkK5YRj_G)Pa*OHAqrf*of#A`Y zgdXuqXknU!7XC%$#py9=B=-(fCa%L|T~9>?apfaIM@>Kj%rt`Uck%OOuEyj>HinFD zOd=#J??wkEX1XZQI*X)!VbP{Gu3TaXY^*dl$)wL*jIrFn;a009r{P?(na#vf$FOm1 zGD${?;=G!VW3x#wbyOUKN4`(Q*9b0_b84EC7Uj&N3ZsQxtHQIV$PRy{%!87sQ&5Mo0#F<8Ga7E?G$tVj_HX-&%?8Ws|Y zTb{|=i_=9LpOS<}MB%k39zT*XD2b7rii-)0pxG^C6%SP|o}2w;#}ifn zW87UB;YWHqD2x`f4b|nG$rLVC$b6X%c3Fv`JU&xiG!M%v!Kt)1(SEYiN6;dM*_BN; zMzku4V@W}992hQEj4)u-iEfX`Af4v0$ObdKaC`LjuMnECS}H1FpWeHS&&LnD%0tSY_vx7m|aK`sKqjFa9AKa_oJ{H5++*P7ZTx)lYQw7%RI)_5?Q37T?IRR z24JC$%WD#?n@BEA%zUmgVzq&E4^&pBGGaM1olSJZBP-=+(+F$tW{QiU{+U{cNFba~ zJ~srrZen1xo4cPb0FMsMoCmKl;y#mBza?)dQf~Ify^MIBRwic1z} zhMvtxVsIr2&_=tG@GCi!dLTRUxP&s| zh!Tjzn@%vtXf^tvs42#NqlF)O!bopeNKb{g3EbMKWom_<U&&H-85K(p!_o=k}O#**L_NyOUN$IhA6drVAsQ5+2#^9L= z*U8dMWv1muqA0O(!cf(WCo;WDp-jexFg-(9Bo)SZ0`{I?C@L4p4l(k>UW!mT)(dqw zUNEHv9ExKPxl5_xkRNS^V}6twj`?el;W&_cnq>4x20U028Q6Ox%0T!1#UQ8(8T#g>7v<8 z(pZ`e;#gyAuovvu2tz(`J>_x6Tr9oV^B8T^_~BaI_fz4FX5$bLyEZxyTO}^U5u6j@ zJ7u4*y*QPz7~;B!Q;5$}RvM!huGr%I#yCUa%}1M7L40ac$KqJCuEhzAjm+P52rmN} zCzfzKV&DO9;D;11vZ-nL2&|54^#pb-DvQkUD6@#BE1y*~EqRNeC`FFMV_8GrD-fq) z4P~Vel~tThZZ=eaeW``51Do8~SnMHHNS1<3c&&haOOr~>rsJwfuV~6l#$!>v*(_Wa zvGMGsj2`;2Vo(G|Sp<#2K#filNUxC4iDdCqw9m!!*RFtgy3=7>I~L!jiD2EZkJ>Rq z_4uA99w+0iFHJ1&pUj+v_d@3mWb^++B2uNFbz?3TRe|s_la0Hm8LJ>`0xp^W7XoQn zW`5){L~25?>K%c_UVLqUzBOh9z05Zq8WOYFDTAriFt+%&!KoAm8zq-q^d&K(29?-_ zHWV8T>WuvJ7k=Z#p3^MseYGe)2!jkSbF$CYX*B8Z)g`=>juk&eJ)LGG`%MJ zc|Vlqb3Sz1fA&FXKIem{N^~r~Hpr%9Yipd??4fad35UkEKo=SF(VQ}r+L%@-gTbPY z!t0OJf~o8ZA_N?oL`Y$85-laXNi@}- z8{)~k{!t0TbyNApZ8F90|?`Y z`bxCGK$DI0&0pJu5{u3%tBWYc^h(b=GuN}yBC^AWT^2WY^TN+;S`5}<4$%lB)bKZ6 z?BfC|hAf%+I}TYQ^2KA3d>ZlB#2}JItB7*`mIV)Re{zeSfKG8}cTVh)B5s4^Cc4}9{bpS08Wc(KTRo0Q^u5H*EzX|q4LQp%4J-FkW`&gn4dEgQ`Uqqb8jlHvM5@(OwlmI zyHV^i63Zz(M`3OBO#`egVJVFUIj!JuN|jyI!8(V`Ovs`4+DP{pqF7JV#IzcRRhx;@ znAk|YHU!V)KuLOT!KRkku&jlZNxV%Iqm5(Z4eMQ0Dq09)S8b`pk{FPe-mwSEIV}*S z*Rlog(}Tm0gTCEGP&2MbcT1l#Dj?8+t(cmK{ZLoR#>YH}SA^BC#PUzV8sF(L(dc{?HJ4 z;iB2cMt+ms+L=wm#g?6$buRE%TratEb7?r|=3tL;rj&(IKf77 zOf{0cBTNSK6CJNp#Nvxp7#CP6mYm%fLnDTrVv&&8=F-Tgqv5*5F6>C%8sfy6@J6|t z!7&|}DJ{(I?b?e|;joN!?rqISv~zP8JHVm&bZtD$IY9GA)0f$3I^zw60MYY9ag^+( z2Gc0NVDTSS65_du9IR!(Qo*#A|Dk2k-&r;nY~Q{uZ}xWx!1%<AfC;Sy z6K030g)Wo^D=S&Jdq2U3Z%^YNJ;O6txO-5#-!qu-6-|7<4{z>ZAPGjgjbdNsk2baV zMQROa6<&74Il_gM+(R|t9+G{^Bt#h=g~rB&8Pb!k;TEC{$qW{Doz#q3T2G?~yu1~L zGMULCy*rI2;*jDA3pA4!wKrp>n(gf?eO+( zxv}itv4dNCHmSeEte*Y76$%9-Yzk&PV?1J*UhADVrPC%!C|1z-Oks?h1W&H4WuGVtd1e znTjO%5WE}CvB;v)?aGZ_luOSlSm|Oh&z(^g&r>kU``!$r+@iE-S}oJg^J}jK`A038 z^OlN)Yt99yROc-%m}}0rEG-irE6)C*f~DB8-yz4X{o43W_?TY&CcCsWD>Ey@KFgj- zFLJrpL}`IKXQ}XG+|i9521>>oLDe1*3RIs*%_o-5w z{$od-uwp{X>1v{>B@xtWu|U@1Ip*O0KDIl)My<5=x!P@FtdxW7wmt zPh84`QU&5JRex4o@}@$`NA=sL`r;RHwshu>Y@4%xQ!S}qQhg(ORq(WteS3*iw z!7}Gn$r(*D8)bN8w$JFD>76k$(>JN;O}FFK?$)=kQ8DqZO`X%TN--=k0t*@DTxsde z(o$u;k5=O>LtQ7t#o4Cya_ZZ+n-!DSBdfQS&ciFMjZ>#i?v_kJn=B7Y&+clS`lVnx zOD1&>wGQ1i6(je?lq?K`81;lf@mBqUgTLK1VbFxQq@Qj$wi{7z?Sw%HHF3_c%e2a< zmg#~*Hc0kJX`551^u9lkPImat?ujeE$O=;;Vn!3K1X~J8w zVa(2Ohn5cF*^D_aR!7_$*VaJ$pVbW>sZ!&!p$raNr?Q$&b6Sg|1 zty1M!Ixt(E_gFe698zR$Q^BH2&dTkbwo0AbWQ(TABgfKmkEO+VOXilP;+dswfTfL( zrByde>&(Q=-Fi!9x@Eb9OlMuDN^e;n^V;3ALP8sbE?SkgQWZBcZKXPMQf6Voa_7OB zDkj(&L(#ufm9}1$HddXm&iO2ihny3(D)P3{d2=;s6V&NN)sig|5?$+Ml@^wk-rDfN ztF-iKX(@X6ZW9ZesZ7n>VrLKMEgIEaCv|dGvR!WVtYq~O>yeY<5_OxrZftehx-r)Q zrolVegI(-_|E3ibvx7ZI8Io(i#Vh5eYCi9wDJ2)@^%v*OGv+N)7e6g_Gn~02^7)JN z<%#p@jQNt)DXvKxC)IW*_13IhhoZ28t?Gp1UN=rUoj6vc#DVI#llo*K1$5NOnqHl5Cfdism+S$Vhdr1^{&2s%)}3 z-{N?3sYhawGsdz(oR@G+3LsuxqJF6YiMxWtOdDr)2eoJK*uK}!mtzvHDb8L{Un*34zVuLZ>t0?L z=cVsnF1@=lAvrdwyJJ?u%cSlOH{L8QUZz7VWDWszL#^Rz^_3$&cnq-h12iRqgNXmDj_m?||M`IJhy8J?PFJ4EA0@F@tc> z7t<;&m&^OeqNTDZvS6zk9eUg=j|bgWb=r?kDgx(7ufbsDWUo9Pk0;gsGueY^u=1oj z&Q&*g1;x!0&`Bu78zb?+tr@Oy#`eHXxX(~ z#t>s6Pg%4qpRm{~&j8TeNm-i=?L1Ol@2JW#Q`ux?zQw%Rr5By=Y0e4+v_OY}WX8_A zu~XFH#?D@AiG(T6DTQav3>A)KlA&_LczO?Y$8%>F^ZcU$f{P-Z&%i%A;0BmzaOA4D z+&s%uv&g+5S$*R;+p)#y2)H=S9#F4fz#dArqz{YQTz1qDV+lr+B3#o}JBQ%J(5RZXlkJhj-%& z$_OTMGfJH$a?(@XXX)8g-bFydd$n5X;EWo?6=y%J_7`Pepiap?i@_6#`-%*`f2KMs z*Xt}AYiEuF19g_QMXmOKDI|b?@}HpAdBk>le5*WzJGC2k)%SP%`vaH(-OD3qjtH1} zEHDdLU_R?^=g9(dFb7Om9+++fOfMdoLwI0ncwkNfFmLd{Q~{W!rE*}>eQUK2`BwFI zU9VkIWheut&SMxPgs8PTWi3z6w9jVKTj%V$eta-f<#r|In}j(|RYo#7yZ)HhpK0n< zrM|V&F2xOgQd}2Vx3tZ0TeS%du_}L$Ba^jFy=qTRKc;48@PT`|UXZ*N*DR7 z(Ct`>{-{&Hai>KVzCj;qDX9$BN9f+$rahyy#9@kCExQzF3Me|dCfO*{ZAi5yq^Qzu z$}^eHIW`rbLLot6Nl8qyu}inH7vde*ct>OWq$C@wbQ^0S-iD30HO6a_Y?yQ#g%EGS z##_D%HQNO5eXys{WruZ`=y zf1+A?xHj?fo%3AD-!GJwmVTB^fxK4%H$O1q^$WV3hIm@rKOHNszfumu+C9c$+u5- zOZ_U{p2;cnNZpFQ!CgX5VYSq)>3x}+$-()zjuuwiVUa)Nni6Xmz7yUm?a~pODb0|& zSxBAyG~LxH-;1f~nXn}>N8^;^>WpyOs>F1SbH+^yCMTvmO?HL6Nm$q}*EuWMiNR1- zBqS^?q25!c+(dJrQGA!b^sdAtxjLtugU8Im+^1W1=ifY#ebI}l?U{EXvG^%Iv)FSW zke0!oz%?zI+~VRWa=V&y>-}SCl?!%CyVR9A#U-dG^+@vkWlvD=ZiP*h_W46r)>I5| z;Kt`ZuGjVyR$Fz59il6j-D#9xtJ567sME^y;u6#!=R#9-%1q+AR@zXP?liiJtmcIno_RJ3NNqP1u$?oP6{O1BoKqBT1etwmEY zJIR_!w-%t3yAn96Ly$zGlLEX~cy$`d)I^T_-d%0f8LpE1a z#3g2ER#sDVwRP`VVTMJ`DK&!~dvr|nUH%+*E5c-idPLteb!}p$eAoCO$HqR2D)m_i zIs4vX1~}xpvgdThblYL&*rwTB43l&l8X-x&n3_phO`OQJZ>5jPil%nr=0)d&q4ASG z+B6-KYo&a<`2f#eOQ%dlALk@jmlTcCilv>hD8YR^Nr6rp759I_$UbE-LNqoNJY#=#+|C zoMI(zE`yLSBjD7yjEMik=Jq%3k~XSS6LX3frF9GCq|(wO);Dai7POqTVIl2^b#Y?+ zQrHkzPvcU>hsnnMj4h+rR8m%V&q|;nkd6Pa=0L%x^xsYT?;NfJNt%kTrKJ(p9Sbve zr+GX1Px8u|@7&1)qo+zW#ZgzM5iW|N?A)hEER$R-VTk%@N_{k+d^8_@G#}U^`0i7n zWNZod6fvhPlW!tbSBK zw1_!kg-eD7-1xS!a-8D(*GD!2zG^AGN=x^+I^VFu^~8b-*;|o~nz3c88SGJ*vAa=l zTbom*LfFmbM5)JaN|?+T5(=j?tkJc!tX+aO51mDQG(mS$?`zo+!yxupz~xf`K$ zO~qQ)n$ps>wtXh0WGD1-!j&n_)hjEBZ!tSX(bFktFiq|`p~3W;_j=7cz2>c6^G2_E zq1U|BYhLL!ul1S_dd)|@=96Ai$~EL1^9{NCxOLgB*!@{SI@^j)^;|0g*h#K0(p^8K zYw-We9M_LI8vOrikL#yB8vOtIsB7s_&Fdr$5+Djj?#$Fj8*Zc~o~KWAz%A;4Q`R5L zV^I=aVENFoo^Qo>#xB_7>ePD@dcdR5H|{Bf6oA&D4{UidHFPMKp@4q}&ztHUcm0Ug>Yp#>fX}e2H1?z-fY`SMf%ri~pw+g{6qBor6I~E;`jzy(_51OHR z*Gj%aPaEAIu}YqV2;b2zRK<%tLp%x_`6z7^=<7y44mIm}A1>wCqBPfkTw8S$+R9hl zR+tskR@VR6R)haVTfqz8R&9>@Zd9OB6Y`BU;TmcP!(iqJR#96~>XC*Pa%5ZRsOc2I z*u)GFT59hh!BcPK9fHrq%ve%t{41u z(>UX~L4f9Y0fyJj)XW@vz*dx?#3%^p6c$L34ndHq$jek^WvbFOPcqJ>rkGByJ(yg= zbA+6Y>aE$C4xgW)IUCz@i9R>Yb2fT#iR7$E0xN{MoW8Nks--FRLPrZ%sG>r{*oj`3 zynBF6OKUW2vRg)W+K8ml`IzhTvqJ6I&Sq!pDI0D$={1$(4fD!4W)AbSYdbf)80hei z^e_h8oSmVx>`>7feahVjXG|Jx7^HZrYtQ)hC3<2WMp#w3$B&_IuFj2yRrFRcY@kBT z9^NxcJ)YVO;zyFcaM%vpBbFl*Pg#d91)fK5#;vb40?KOq)tzOk0b?moTi6MsESpJL zN~0{XW8nbH7O0jJKe+4^`MZ+~L9={KZZZP+WnaBU~o&_-D6 zwLJduqr0oqyf+`A?-bZAuv=lb!|sG#h20Z-0`{8N+hY%$K4sdoiBUhQ6(P+({l0DT ziKOBg??&}1+3`!xt~DF=1^YiPYt;VB*C*S4edp<^bv zvG%iD)TkLbI?Jc?Z+n~m*?P{vhuvc){QOvM-}@LZC<*5l>jZ!fz#l|DazN?GZl-^w0Uk8PgWHE3M*X#d1PSL-!POZI-8@AAiZ z$16A7J2~{RX)yNah3x@LSKN;OtEfZ7qF)DY3HN>RKs$A(-NCqqt!i!Bcl_S9n7aLr zEJ)RT@l9}V%U9(!?M57!S6F-9%{Lj&VV4#!UtMSZ{nNvnTwj=-Qttb^-9o)GTUN*$ zcBsmb7n=vq^wJKkQFY@Fof?n-s`IvqKi6H`^Xc|?Be(VY({hVN5iR`bpA`_iA=J}Vg*b}L(Z`Nb(4>+gO& z*EXQ;u}z;++qN3IHs|^9EbG*p?i*kI9qTyzVMkB@CtJr)T5oeC(rL&SuBmUox@Ob$ z+85S42i!g4y>!^3ZzdfZXKiKkOO*fM%B9sa-Z%K|$o-Wmp50G|Tv|6J?_RefwkZpe z|EfO5BfjYImF(#by{31oaR1GmI>i`{jD5nq+3w9B^{(Tr+a5kzKk#Gu()ShSdiZwT z`D>l_Eju=LsBkGLbnGVA)nkU8YtX(`C#6Hk?qwtXs<7|zSLbW4Ub-%!;KxCltE!yQ zQ~HI~s#v4Stz`!t3bLBr=~C}T_lh;E)-G>f&hgoTpLVqTHur!_oh?Npo>rf`E7rFE z_*&6u{aF3W!##pK|2XFT%(e@DTRNYZN9fk_!ixP zOy}jj-}Sm5R4@0#!edz_U)J!Q(c)sgHfc}h_Zj%pC69B33s2;H%J{{x{ic_RXTF~L zN0ZC@7dQHH$M+jsbXt3Ra9n!134SM651Z*7@M=+|qiGlO@3rdqdVJCkyI!szm+)QK z*=5tCer>tsOv8$Mi?(NWcB(dG^Sw2Jkykn&ns%yDoPFe|YA+tH+OL>BXjSgr6_MJl zrFUn#9zJ9Dr1HJH2me}qsc%&K(+}3$|I##X`fqL<_v~u+Wqr5fUoTg;%Ly)s8F;wE zholpmZls;fYqR-c<)>B|eZ3xDem(2d;PO?MzG^*rz;BDXKgk<#a_fL$x4*KwzV6&N zfA*h{T(hu6-F$EDkXdWTKd@3PY&Y)R{FvzXj$WYZZ2pLDg8_h{0Kg9bz*hjk&j7$v0AL#c zunYhg4gkCY0G0v(4FP};0Ko46Kmq`;1OVs*0E7Sl834dd0KftOs0aXT0052y0Dl1h zD*%AM0f5T@KuZAN0szny0O$b#OaK7l0Dy@Az%>BiTL7Rc01ylS>;nL*0RTw=fIk4x z69BjY0L%dZY5@St0f3PJKy?6MJ^-*E0H_ZD+yVeb007MZ09ydS5&&2Q0DKJqJOcps z000L8fUy8Ta{wS604MrT_p(0Dxowzykod0s!;^0PX_- z#Q*@!|JeXQZvbFB05A{$cn<*h0swUYfW`no5CGr`0GtB=IspK?0e}hsz^#H(O0N_Ue zpe+C}834En0E7YnfdIe>0Kf?V@B{!<0Kg0Y;0*xa3;;v`0Q~@f=K#P%0N^YD5Doxj z0s!v-fO-JHF#wc0H6r~&;Zrm0DuAj$OQnj0KiND zzzzVo3jkaK08Rq{zW@Ng0RX!I0506qXf8vvjZ0I(1Mmh7zF@)2>`?c0N(=u4*-BM0DubsFb@Do1OUDO09pV5egJ?T z08jz|3jhEw0ALaT@CN{}1^`F{05kxA4giP&0J;GHn*jhV0I(4N7!LqU1OR#h03!ha zO90><01yEHOa=h@0|37R06zl&Jph0W0KjMfpe6uN9sno+0Ac}v5&&Q&0Pq$7@B;wW z002_~fKdRzYyiL&00;vBiU5EV03aR!_yPc!1ON;I0CoTX+W~-106<>=zzqOs0|3kd z0Hy!{I{|a9+2LN;f02TlMV*r510DuDkPyqm_ z0|3zcp9cUu0swRXfF1xS1pqt%fL{TCjsUJ3INOn0O|n%&Hz9I0H7-X;0^#}0|2c705t&M0|5L908{}0 z4gdhX0e~O?U?BkTB>>O@07wG>1_A)*0Dv3-z!3mQ1OWa302TuP-va<^0f2M>;3NRx z4FFUE0P+EV*8spS03ZPXSOx&J1OO@m0GR;53;-Yy05}8y!~p=+0D%1fz$ySB5&*ah z0Gt5;?g0R+0f6=ZfIR>(9RSz^0MrKnmIDC60Kj1Y-~<40767;i0Av6FmjQsm0Kh8% z;5Psu4*(bd09XM4-v9u~06<*;U|Cf;egCPHZg#2#=`Tq^%{~wV54I%$~LjI3~{Qm*+KN0eO z5#;|w$bU=7|H_d6-$VYdfc*aj@_!`ce;>&I#gPB8kpC|r|1%-~8$Apbu>{=bF%*FpX-f&5<%`R@byzYX$V5BdKma z{~pNy){y`6Apb8w{;MJX>qGuqK>k01{7;4a-wgTx9P)o4cegW|05KA^+P!{>MQ6e}MeI0r}qs^8YF1zZc~HEXe<= zkpGh*|GPu}pM?Cs4f($g^1naie<9?*H{}0X$bSXo|2xS4_mKa4A^+1M|L;ToM?n6s zg8c6Q`9BKs|8L0u(~$rBA^&ee{!fMcUjz9+9P+;!i=$ki;(|8kpI&l|9^%2?+y8X_IP06*Kejz zpYwRil+0JtrY$Oc_N?4*6DJ<|BPwe5(jR{u=C4){wooW6PltqT@onCG#$TU4RsZJq z-vb70+jjTilf$l+-dvv=~KH~lO`?OcJX3#fScRUW|b>{X=i1n zT=COSKHl}~YuEnp!+3SIYE3$P^;NcmwRMHot5$te-qzN>LB)#gYbGSDzJBXg*HeH0 z-DqIr#$mJe>^b!yHg;?p!F%-NHwYT6n5d z{(pY>P&a<}?xJtUjCu6SgbCj*`uS(?kng^`r0>|V-}1hF|H$ay|ChXxBk#>UbEfa1 zvu7v%_~c2mL0h-pdG!8$m3iH}|F~+vfZv1Lv>EO^ckc4ko;}apfBV+S%EH3t)2vyE zS%U|c#C7S?qv87X2m9sb{+Tmm$n$XTy1SbN8nE0eF>xY0St-Q72)Q>TG04i0tF`}Db@w6SsM-Jn5u{@Ag% z*B?DP?#P7;k=?g%e{w7!U{lAXOLN^;tk`(r_U#VO;^PT*QH ze#N3i3wQteYtWj31JC!_vgO9b@bG=xeSP0OfAPZh%!3CFPiVEfUQC_3xYy2|_nqwQ zszn_<_-jdATyo!r4Wq`kYNhw6Rja{>O`D!Z@7wp&%Hzj}{Cw|T{p@Skrr(Q+S@T8R zx~^aK>vv6a3l_|)keWL8hEA6@{fjTUP5S1WV<&@yx2E;(ebL6!()#tQSBhHY z%U3+A(QKH|uASe`5hLD)9XN2d>b!YNGYbnxcB);wapQIC4qUo<)8p?qZz?s<$k{C(_YLqKiRr~$-mw&%|*KJO>ZpY7thUO=EdHv8dGc#{=%a&8> zRH)!QEidoq++o8$L>xNwTZ<}HI(-cQ%mDy00f0pSKsf;52mr7f02l@U3Nz#sr%ECBEV0B8#U*Z}~`0Dx!!U?>3a zB>SOEan z0f0gPAQk`!1OU_kKn(z(JOB^@0Q3g{TmXP}06=R1;3fc&0|1-^06GEyBLIMB06-D| z&N1povC05buAZ2-V*0N?}w&=df;0049W0OA3F zTL3_90AMlz&=~;m1po#D0CfO>D*%8401yrU+y(%~0RWKzz!Lyq69AA40Bi&RIsgC* z004IYpgRCC3INy-04xLmf&hT?0Kg3ZU>^YR4gjzP02%@Sy8wX20Kk0!pc(-1D*%uT z07L-*dH|pS0Pqw5_z3_Q0szzp0Hy-~YXAUO0N@$`a1{WU2LQ|k0MY<}ZUDeB0AMQs za1j8o1^^TQKt%vx0|4L$0K5eN&H?~S0f3PJKw|*l007_t08|11_5uKH0DwaPfDQmi z0RT1w0N(-t^#Fi$06+x*^Z@`$0f0CFU@8Ex1ORvg03-kaRRMs@0Dv0+a2x>02LOHm z0P+BUDFA>o0Pr&a@Bsk$4FKo_00aU6(*b}f0KhZ=;28ig5deq+0Dc4j)Bu1200;p9 zngalz0D#{CfNcQ4WB}j<0FVR#6axS=0DyM@z$gHq7XVNK0PFw&egOb-0DxTpz#0Hx zBLJWW015zr{Q$s60ALva&V`Tqz2 zPyqlR0D#>9z!(5v0s!zc0Pr0E&=COW3jp*707e1;X8?e+0KgLfU@HLd9suYL01N;C z+5iA^0f3$Wz*_*o0sxo=01O5Ix&Q#{0f1ZpU0G0p%=>Wi50KfwPcnJU; z1^~VV04@Unt^j}&08k15JO=>I0|2K003`rW2>^Hq0Qdm_D*=EW06K04xFkegyyq0svb8fN%i77XWwx06YKyv;e?V0AMEoUE>!2mq)806_j9hx~s7`TrR5{}tqaDdhiekpF)`{x606_lNwq zfc!rV`R@z){}<%{H<14WApaji{x5<2uM7E~0{QlBY{2vebUkUPm6XgE^cK!nZkpG^L|9?XM$3y;q3;F*G>s#$o~w; z|2)Y5xsd;dApd`a{2v7Q{|NGb9_0Tj$p2u-e`m=5RLKAPkpEVY|DPcLvmpQDApaXe z{`Z6Y&w>0O2l<}>`EL#R|0U$VE9Acp^8YF1e<0-l6v+QwkpJBv|5cFxcOd^iLjHdb z`JV{+Uk&oV5#;|5kpJI7{k;U{9gz8zX9^U2ju@S$p6le|BjIV3nBl1g8ZKd`QHTce>3F&VaWd~kpDX%|F1y) z2SNVFK>oWx{-;C!Dceg3y}ZMApd`b{9ge1 z9|`$?8S-BN`M(?Te+}e+AISfUkpJ5u|DQwtpMm^80r~#|^1m14zZ2wt6y$#iYp*Ms~& z5Ba|Z^4}KnzYXMnOUVB&kpGn-|BE62=R^K)h5R23`TsTKza`}VD9C?%$p0FU|60iZ z-y#3!K>nYF{7-`XZwmQ88uGsmk^;;{(kzO z9g|kKE}h?YarYj_{<#11uxZQPHyy3t^>P0dj@{nM7aU&S9%-Gwx2Mh7 z7Il`K__BgU;jSZ=ib|;yJ1uqg8WeK%!OCZ6PM7Sv8~xSxn0kNhXgBxP+Ya|?#a@r> z^|Z#M+D(5c18vUZ~wcIwzwm-S;uIMzXal%7C z{~@!sRR5-Lxt4dPu3uKX=1JC#&I5Kfdzn}C_n|Jchh}Q3Hn*C2aLR9uZicx84tG_~ zP^r9n4pl`)#b`UJ*uM$cGAvSszaSOP{tXNE&!V+*VAxbGdv@>EvSFK8Rg;F%O*^R= z{PiFPf1Ze;zd5T7a$tmH-Me)cC*$&V_wI(DMK`q%@|O7I6A$xgiPXZ0IOE7+L&e5m z4gP8d&f3Fk!qIatyNqmOxpd~l`+wi){b!wZ4MVCuOK9ck z_ZE(Dv#OM8{b9WQ=ofQR?JhLA5W2YQv`fLicDh)2XzuwP@9s_8ZS|?kQ0*73dwvsj zDtXVzlqDsdzr56Hf6E=JHf{U7x!2`=-=a-DJ7n$M^5v;NPwiM=>&}8kv2{Z>{Jh(9 zcf!J_^EbY@UeM3F-Sly_%0D=EJZk;xXLnB(m5aLebm6wPM@QKgukwlsISou!ZSVS3 zjpn+lwYyGjRVTIfud9=H7u~J!sLs1%#RY!r*KChzF8?_2V#Af5)^*nSJ$%)@$LrjB{*O+o`)ixL8ue3L@Yhb43V+))->UQItG$Yyp+0XaI)$9<_xkI} z!>2r7H?x6FT-A3se((O<>ALPimj+H=`km$Y!K&Qtk(#+p-)3D!9^qZE2K+fb_u(wt z>dCg!Pai+LfA{vy>sK#dJb(7IL>66d>GW6Yj)d-cxO)Bl4G*quN8{L2*?kLE74 zII3;^eR`{7!>Wy+P-R(U$2OiG+n>x{@V;79X-vY7V@;MNJ^by$@{(P1+e{oa^+Sy` z$5wml6!$rwe!aidOh?zDuJgWLS)<<6l+Tr&;(GiKx8^e|S81~I{HATMD<|8Z8Pr97 zzQxgbuP>Jm@+oq9-aH{K{!YM~2j_iSOq?d9^Y8k%Q{@wrzH1)6vt;g!DT#I4wXp51 zvHQJchSLUnm+LQX+m9QxfAik>mYUcNjVd|k3;D|W9AcGiQzcb@DZZT7&y2 z&Ij+yBZ@xURbOA~^<5KrzQQxTbJw^2cYC*Fhx97f zdi726hzxCL`^+)ZGn)QxadcR)Dll9V8KUCiut>}nBEX``;X35~2j-t(ysl?o-7df#}=PH;1%pKu;c*#@23}oYk z|16oxLXiEmWU9)Jt24FicoSX@RWO5?mqL-)OABaYxy4SJ|pK3$I6b!$&Sa%j{RiE{<33@>^MMn z94I>uk{xSh$HB5=d4Gk<;=^Re6J*B|nV$T3q6jDKZTaJh2v=mRnQVT13Gt2j`BI6E zw`X4RC(& z+xVodBJ35J#!LtPd{x=w=FB#pH;pI_(;9QoxKVv-^6|cisK~Toj`Q`q#vXTI0{HR2 zn9bjrsm>qMg`y(!B@@i&r;%Kd>CV*W>(_wI--}r#YoD>Q;|%1ZO=C~_`>|mKKkNy$ zE~55V@WUNR85fZsNqWA$$dM#H-)^kkf&S;dU!dUrKp^`)0|k#)nl&zby=a6`nA}G3 zVJg=Hk-bD@{~7fb(x2nQ!X-n2f?q>g@?KV{@M!Oqr;#}b>ynM=?BA1(+}JZ*|j z+$Wp9GZ$vtp$ivg+kwA4vhBdP58Dp>xY~iFE;O;R?Zr-E^7kztCVvO`F!@`7F-U31 zpB=^*g~=an3ck(R^6+iWmWOY1wmcoVv}}34;KJha?1IUqDrf(O50k%qK1}`&@nQ0} zj>?1d`8o>>}-Ac^Ro5jeNvfRYT`d^bb1O?dTKHXQ$D(~Qke45rr`b5L)e8MJR?P6aT;-% z>rk576w82)T$ti%6MV9Dr-b|_*z4oig}{xi1$GJ>^74#g&-EpngsU$Nd~9reVW%jz ze-Y@6Fx$TfH$s@^gD}q7dFKTKHWhXSKjs@y*c1O@qcRBnqNZ>tS#eFmu7J<(_@v=Q z;ePm}p-*9IOHT?@0&G37E4r~krZ_!#IB%|8+D1z{>K+3}AV!G{~*lZr+5CitXcQMd&@i}`Rhd|u$g zweVR%!KG0n?8=9!EPeSf)oDB*rh0_(VGo33`7o7pDj%kD&f>#e5T3(_dmx;`hpB8! z`EYN9D_C%4pt4ox!=4C#&4;Nxr}!|P_bMNz^WNmcbl$ssxIe;w^Wnh=M_O|Jhanuz zheskD&xh%}FZi%O!teMnwPg)-2(=-F2lC+{gyZ-yl`V}AQ`y$=VJcfTAEvTx;=`c` z*C!^cxUuiShr?m_7KMk1(!}xM7^K_hww!{JRRX{ zd^iE&zxePRgdg(ZWQ1Sx;e`lqx8=&5hHwENrZmU-Fy+0+hpB9~c3gTYTXQ~4WmEHE zDqA}~yd2?9d^iK)?tFL+!UOp5c7(U^;ar4w@!^dK|GNMmGEl_l+gGm`nd$*_!T+5 zCj7H$$e$sB;nzdRoA7fC=6!u8Y1uA?A7S_xE{#cLZAne0qb88qse#Pd1A_zbe1(m| z0vP?Za?`xjKkV-@$Kp49%4%Io#QvU#`O;I9$&yGKg5v)nJNIiL+6eqeh-n$A-hpQ9 zRBv;3zTRw<+0nxOwRvB&J;^OGtEw|2%Y(6p`MbGtG^%^+5CH|m3e!Zg=t#9H-O@r{83n2`CpCU3Q z*zns8hF<{SfBT#-q)9EPKiOZR`Fxj)l9;#<#hGhhQM5@`Iy;5}z(I5IGYx4rp^3YH z<;o-xKh30=5tT{aaRKaaJe&5DHZVX`3zNc$szA?LKi}SbA&m)5+?k{>*Y=V`X6nKD zmqk!LK67Gz+y{KF3dS^GLMtJqNgcRknBJdh4SAX}oS@ME=!8v!-yVt4AT55doBiZ_ z-)AW0=UT#>4S$9x0FTE%o=udfj52fl`Ztb%cSGp{qhs9K8;*R2wK0UfMPZ*|?jpM} zOpG>MuyrwQ%7_UR$M_6$6ZtZR(Uf=yV~Fw@rZ$AV5&jRhLaZl2Y8o~z?)6$grwAJ) zGP?!he+nZxyOC}YZ;+Pk)*PBwo=%9P1VXqG(oxuxjMy&Xo{qFx6m}{P#nCb8alU5P4IVFR$rCKUj?KT{CzL;w-9l)I9C#X2W9?Ri2Ttq zoZxRK0^;)JB96)}Y(n|AAV6VHKEeb38Xz2no%)aBDBnT^#QyfdMr)XeU_#1{#@>dx<#gV@Y2#`O)g&pc;uD+*b{_;frXcT)qbIr$W52Q99aI zARUE0=>VG*)-3$-N#&z;FTo$(=ZXFGfWKFW7dF9Pw9H?S$RC!<4E_RU$Obs=-d>bHy(BYbx`XfQXKW7dA>qTLYQD7b1W45ij_=g0Q&0 zhY>;N6*j@&Z!l2UlaEkhai%xIRKAAT1%G=H7W?}J5%j!9*aUw&VG#QpCi2&qkE8Z$ z1!rP^_W(0<>fj>18MPYA)T`1oXfJ*Ey*NIyPl>5s^ITXUI=n9%FHJ=Lusm!i-#EEH7cTC9vG+FMO%>_i@Hr=Go2EgMQbM8NrWK(mXwvT@ zYEs$)f^N%d1y&!LiiNTuUm``zZW^^DC|asQin4~TN{aHg)DH?QYg@Gx7PPRsqAt6| zT@_r#qT*Hr^ZxERXVTNO1)u+Qz3>0MuIHJn>A7d-p5NSa&&QcFbI#m^L5`PqRv4Zg zcwB!Dg^&D`!tkr+jllg!UB8b4ufOqmDEKIiUCC*d3NKHE z_d{6wdlGoGKg=DM@4K+}HxGEcKBlPf9tW+KuL(E%W)7zCk$0U!+sOl00lYNiLG5oE ze!RT*fL7y`V?)SE6GX*v`O4r|m$#t^`vcGc;nB7O$D?&>!o!8Rzv1SWtk87fc*m7` z<9u2RB2{|fWE_;Q#?vOMKvd*cO1lr?U8#yxkz2$0_{{)3E(HZ;0`vw)G&iA$f_$nZnn(txoH8Y9ie_TG= zqfzta<@WSt;^ce}D0;@Q%-qA^!!0D_h>!g9!t#9ze9a-Q9=t_i`QDb-f4ymQtpWHZ zhUGhYO8@!J2-EXJ;H&1sDH!CvHB8TOQ~T!&gz-HGzW((5tis3R-UHvfuzaZ=Dil5Q zs4N<6RgQSbJqkX}j35o4F7nU9ItV@YQUE#5cObH-uTePR`4L9(m;$hI$cQUed+sSy zSroNedYnwl|G7QU^ix{1SLp3oc>rL_C!uuM!2IJ#xiun3#Q&hhk z8zkGurz>|n&Vm4Sn5eU6mmXL7W^ol!bv`*P2I%}+)``$zildfD+X3L)bcWJn3)YwmugeCwDjzsYxnqX$^gN~DMznfgGL?hfDs$YLC=t2G?mWYt$H8HG>S1WoJs9#uBHg#2M>4WWpip$PY)I3T}G;ZtKUD~Bpj)Vne&gLr9>}BiT_e_AD2AG?1`5ds}3==FZ z!Qkd+V5G?3WV8i?dtQP4A=h40_0twt!&(1cGPSnnPb`d1e}}!WGqAn(IIPx?J+yHa z&-FElv4HdYjGLcmj23nm0vMdNXX<)#<;TSJZeU$RvDR&IV4ia_O8pR;t;SY7p| zBf%g{vQ_&WCvc8ls+ZH8!`CZP)5& zEXB3f>UM`8^s$u?*!7|4KV@{CHgz5+Bi+Z2bR4p}I?f6wO&x!?fNuDswb41$#YAv1 zn>?;|5mvLvmffQe#u7N;_gF0+nEkXSJKavRA$e^|DOmL!JS?YbIAl4HDEFE@yAUhvC1h&tUKz#ph{bDiJ!W+^nOgAZ0&_|p z2l`j1$Jo$q@o1W~YUpH#KgoF2gd|CDC7Bu;EyC3%R{=9Jemks=lacYgVc5tTd|f|U zXQfU}E4bC_&okasicVB8)!~O(P1(|_srb01z<$>MoN@a$*fyi4f80V1d5sZ0%vB0& z<(7g4D;JX8HdmQgyx3BF%;7(7tlna&{=m}ltTjutesAqsZFS8zHJ2J;sH}?V$O1`j({n67$sjCw3NrW*1~2iH9+ss3lXj=G&y52 zYwoOtLNU~TdK&LZ*4z(~6{_~p&3moY&1Z#ECYYrH-LcoY``T)jpjvM22QX+;Z$#I@ zuoFmwsWa5Q6`9>Aw-?-oV7IW~VTax44@ARy71}_xY{2Sci))Wqz1`@7KK^YPdCvd5 z(GYVuX4eSqc!U2?bH{0m;rawmhsS8|_QQ~RxubfOv1`Ff6x_8$tPUE<2K)CGluEqlm3>1pep<)@;i@BM0U>E7S-R^7WD zuaPQY(hzna4$Jn^&9TC$u9_&pJkH!)Z<@Y#dw?W89{p9!7u^d6e=%oj#I(U>5z|kX z{^@kx!7g{ZG3I!}p%2FY!yt_r{`NT0z26eE8Wmpe*os%*Y%Q?D(|*3zbS&C+!4x11 z^Iz#ZjyVE0)Opty%Pd{Nht_@3yAwOQ&I*f7U8R<9+P|AR*q&jnY42VTU3|6G)oAM6 zYqYTDisomxoE36SmRw82tJZ>KM{|;~;N;5APb|$>8qtnjw~3b9ES;ZPI)7~~c*VLq zx;Wry-fk>zT1hs=UT5~jGQ@^g$dZXa*J@|6b{6Y;RcuZ(x?nhXFU1x#oE6ed;B0^q z+3i-JsXn^nd8=!W$>*Rd4LE!@R3}i2!T6b};ZMX^Ke&J)7RZRNiOrv~`e2Cu=d8ZO zYB1?YXRC_lpH3EGDscca!Rk69TfuH_4c!I1lCXwOGXs?|yGpl4SEJ#^>|k}B;<+)q z0~WVNTZ1W$GOu8!>@cN~ty0z_R;a;*NQoswcJhRXZql_DcWb=&M583^PBdJ-yQR?| zJR%4m?!-v<;a2*`tbmw2Cyus%w^(;<5N;IB#~cmEjh>w!9lKeFJ7aVC%2`|QUn$?7 zJ3g>9R2V%Q?l1pJC*O3No6o`&t;ck*osDwhQrxXBSblJ{wsozEgoW0F)`pkl+o+7Y zSo_gmnN4Ste}|>H<1DiJ=okV7*oFJZ(%ioC;M+0~?qLU<&F@-We>2&FLF;j2b|G$k zXM({Wj&w15b4T}o33+R+4Y-B>oo?Y%nXTab9IfEWHFdma5pFhBTh2CMm`uhnDI}RJ z$LTJ9AtH1i-(smHJcjB`h9HqvHXw`7O%Dfbp6mW*u+Wj^Xn@)5jKh&IoQ?M1^{u7DdKN(o zHcZS=Y-tBA9miId@BHWkrg^dBT1zJrqqBQu7sU8UERYADuSpDh=UL%96EZ_i-6u}| z0+(uJx5c>GhhlY{bTphcUT^r~pUlv#38m`jJd2<&K0|{pt`JC=_3tgf$2QwuL>?Wc_xkft8FUTZ&Ygi-@1J~?>)+?Tkhi)e_$oM>!D|%aUM%N+48{+QrmR`nyK)mspA%l>pjz&!Aq(79Hw>sAs({@yG3Zl3t*N-y*zN4Sry@2du91rs5#Y z=d6c}G|79%YB}jZO;}JXr!58FP|I*F7rXvrp~^UK?Sck>XKLPWX@)`McHAi)1s-D; zS`ua-UyB95qdPQi9InSKuJ!CDT3PM3x~k6#$4t0A`)jRT^;Xy8nC*}#m|IvqMwmIX z`>e22)^72hIM#CY@ef<_&;NAngl91(g1+mUZa#MBNzr|a0fHa59=%0}8*Ae&T0qs@ zBDex8>uwqB@}I4{qYg(gYq~HG90l8ik`OYg3&X*Y zDT4V{0}u#rqy{p2#Y@-r) zmTd~jm|HoD=>hy5rxWp!{;li$cuwsgOg_YEABT5pP z#Y$6-KWKh-_QExTJY+NVcvO?4+}2*Weh{--ny?+VdF`8x+lEIb z_+mVpQclLC?s*iGZA_0a$#mxn36FF%852rj<@TTFJmT(NCRM|iD*oU0XS8UNoUv}d zY|2ya3c=v+GwgZYFt)_+!o7x?GBXc%f~cJiyhWpkpq*&vT49FXNW%^oGh=WEle5kwq!J{In!zF|ASJn~AWjm$LO0oeNZlh6cMy|Hy;uhqv8gy|Rkz4!Pm{i-1 z^H$z5%UcK|d=7}>wJp}HPAog)uQJ_Vu4o#c!%z?8wbtasAVNk@JuPl$99exF>e-5C zX-}owIV`EAm<(VqaG)aS(Rr3_y=L80xTn^&6mW~#>*^E(*q?I9eG*fvTM}v{KFO1q zwPH!5OaZ+XWagH%H4>jAN^FiO@i`(f40TJo8i`LaB{s#B_!N^E%x=k0BXNVv5}Tt+ zJ#$nPproxUsnv-3D$4(ElEHJP+2h`T<(_eMEyeqIh3|(EdAm%8kz6!`GxX1Ch_I>qTc{Ptoy~bO-A)E-3CmlG@A&nk$Q@V#VMUzj91Z)t zt3?A$JXbR#f}gY$oT2;R?m}1x)L?O==?obkWPR!j3km@D3OQc%nSs?n()EuzZo>{)%9^>&Isd|NL@(SwVxQ8-TZbcufL?2tm^h*DZ zERHB^A$WN#3+WckXGdhy){t&zI^$+Kht71GXY$@vS&lZsOO)gsGEOd0YrB9(#Kx*m z2xDJVx0AI%bjUNIW;7=zdna;Tqo}r|Z~H~%k}f2rZVlQTXIzeRXpYmIgYF?KRRdLN zm+`K=(y6I0>|8dndn!gO6-7+fD@tfPaYRkTOCjP(f`p4&cg%zbgZk+M(za~cK zZ6AEv`0ok7`)=Gz@9x;JzP$aZAFh4pu|a_Q-RD2>kapS?XMS1miy?nI*8Kb1|M}(v zcV8zxe#6NtYd#%%{KByMH{RR)+qbjl|8(D$$=gnJoL%ruLfX=ZKdgIybydLHRyh6g z7sh^{e)OKvX7}8WK3iG$_4vk-&)&JjrC*-=^rGsRU#G5_GxJ;L*8ep8^~Q?DU&VDk ze|^#`-QK@18}ag<*DC){Kiko|pf+Lc?!@wf?2k_@k1m;X!*BoBV`uz_{&3Z(A7B5g z<*oIVcc1nCdCRJ{+b0(dd(S@N=H|N={c~6QyoJBop5-%q_w-l4OSJGz>RA01|M>dghfU}HX8X;N9mA*X zE8KYcUjfHQ!Na#zW&FuGvwQDl?x|&)JE#2q4(;@`p{vJi`}?^6s`=odQ%CpQ`R&^c zZ#;M1vfTWu&;NVL``^d?RIzl&Md|>1Y zfBbSq^#kwDethc>6TaCgJem1y$2HH~lYFDA>-xW3x$d>kb6(m1#eZg)QZ;oi7318< znbREdv6b^I$@pH3j;-VeNAhDU!?^Gr6LGP_EGacR&9W!8!p%b!ZXQa9S@z{sLc@4* z#$`XeN~ppcemG*E)74B#skyh6uJY7w-+Soz>EH+PKmPT_c{5gQsh@k@XL-ZQ$K*Z} zAMx?$+pm0X!8>Cn{(kijSAVeo*EeKzs48uoEB|-=IcR8^B^0~MC@^|Hf z_J4b(b0ZGdyQ1p-xKnR_zI^uIYmS?w;ETFNm(QHI&b9Ef#51>DIJ*9iX(wKM;OU&n zR~>8odiOn7?7UHb4~B+^-`96YZ+|cT>Cke#+^6MIPub*YfeV^-xzs&`>h2dz8}0b zZqp}!$Q%Cmtwq1z@ab!Z{_EOr-`M)brnz~`zI)`v24{Nyo4S%a0zVZ!Gknke-`=Oc z=g2$X9jP62L+zHo$LS{Q-BuK{`nk4Oi<*|Md1vJ>e7BzQJn;{!v?yg`Y22{HVUN@{ zZ#~o4Rc62P#s{q4PyTROVBsIyAD?aSn)AVF#|J~E>|O5s=hQR*6K~_-`~%g?F#VmM z_n9a^wVJU0DGAZSeE#AK!bKrP@b>cCgw4JD*Rt~l7y{$B3f)S6&ms^HYP}wb`<~Ai z9TrbtDfKu_pY&KiR5?wrufFKLAG{c=avEWT%1804LsSr>5t72<$AtN>V&_UwAie)1 z3K^mI3N6f^CTzi#oc#VzIy*aq{1*H~Ayc4t=E%wMS;8*atKek|X^Q@<5iWxJmR|nr zgb}^`la$o*MI)%+wxaS}8x~Je_c)DU>+yinpnla(!`|}m3DK~V2-JRhA-2b9pbxdv zpuB3QVW++HglKww^+Ne`?Z`YDb^?u>e-d=k<4A{>)5}kaBmYswpNDoy=ba@e?eAeE zjD^;BDt`L5CKe}@#Hau%{SOKjy*nCM6|tk8r{VFhFc6vWRlTcXeuUakr! zKgVJ9qP&Pbi+B`T&67ak)WHWj)RUMYuD zTjcUsh^F`R;V2nl(p@51p{eVQS7^%GN;Lh0OT&-&Y1F0ciM|0>@{42f56+ICNMLZe z_=)2fDNH5$Dw&=^G}7LRYXQ;9FiL*$YW#yET@lYhT&a!m^Vy1(a2Kxgh$dm-7T`zx z8*yDkv@-NARl;Aw^MqK&wcxI_~hsg-EbYnnonUggCZ}>d3zjmjS>FF4DTLI+g&HGG z_M2ZHuHJ`^sDQ8<@iTyWxcUMqbu#b~FqB&l6P0yE*;KC_f76N-&^1# z+O9-cuaM^kc+UW@8ccTlFzko$=v!^Id@liDB;vW_ zc*np*v|Wi9KU$t|kst4Nhw!kE(F?B~iD-R-JC4^9hIa?>ZUvJaKbq$fAC>oO6kaXg z-=J`gf#?u@Jd6)}l57r6Jmh$qW8fp&PJwU@qvd?;pea9!qibv!o(qLEBAh#pHz*A6 zk19M&`9pYLLkH?|R0EHmbGhSqUx1HjyAsh3JZdlGr~E07?Gy-C0X!<7 z9Y31ubNT)PT8(!H@Klc{A-s2#GQ z#qlPE;oS>7)nigfzRWN@zY34)kK@e=s}B$GbR>Y{h>zTDVfFD6@Ti=2{OI|J<7I{6 zRRfRKMY!X5sbP3;0gtyo3z#|HH6YabJA~&|jzO559tVPGI|aghrz&p}{1iv^9SuT_ z*8#l85Y8R(k<)@8+D;yFV|vOv8eWPcysZFJ;}xUxP#kxheg;fL+m(oT;PLhcGK5Fx z&#Lj}0neqRp$o^OGi%j&qg8k`x28D4Ux}X@?_asT4zTv7!6*)JYk2+&Ncz;m%QV>nVesh>?`=gsF4G9C70wIGmvr-k zg2$tNtE?$5$OrOpb_t=&? zm#^U8dm2e16Qo|pb-7ouJ7*SG#&x-H`n$Naz znwap2SE`E<>b0&1o3}Mtz>segTK&Ikt~ItE`0=Pe*m1~s)PMeiKkD5tKT{Pg7I9|lt^i(|Y z;SHS~czs3r-h@85^3y;5eG1+wRnkmAn$qDDC{1gNP)YAI?bCGPCBuWFM=S-F1O|hC zTkWtd`p5{O?qz=!j&FMT_Y?G^y6RqjCjUavFuazDR&_2&RYLL@=u1WdIxc_j(j%)= zSR;9&n6#rv+9yXM=P1e<3Gjgoa-N_!H{!+O9*L7)e#R%7cmEWKa_i|!E?1Ln6Dt_F5wcZee39UgI7lHT25@NO| z)EZ{&uN4itO_Me@cr1p529MF))J+UAUay$2uI9i`6<_R=@DXJUeKOI!*Rngp8E-2#3y%ZRWr@9 z{8+s$M>`vyL6F($th(iTW7Syt(R!ph2JCt<>dK-cD{rW{ofZeiB;3#MzFr!rh5Ai9>6h zGZW+FB3Ybrjbp}Mv|TK-&0dD0RBrZV4o9w=kt>Rm4=H1);TZIpP2bmxt4#|EXE_pl zwbF8(U|(yz-FIDUi-p>a$3{)?std(yjXqOg*(P7C`JB)$9jgpD_eFV@QRJK-Sq9Km zX4c+-n12eN&PJY8DyFATq^p!9OW32Nx|e-;8IH8XT6xiMk;-Dw_pf|l?vTs}g=M&P zPsDqCJ0gpUf}xg;x~UYV70z}TE<2TWYV@hNQ(Dw1eO77oCVEXCn^$c02bT}cn@@>tJUbCzfrF){`$h^)^nT8OvgH;(Gs5jA_nw5zi9^|7kg!s)&6p0+Tq zr+P;2HqB-QX>HLtmHr$ln70dS^r(O}F%zOjbt#?yTcoPh`VwCleyUCY>Qc=^klBR>rq z{*0mo=-qZhRQ?HGH%|CgC$2WF7LUsP9$6^^75gyGXG(h6w_aLRE3S|7iMUMA8Rl%O z{ZuvPDdUW}L<}UMK2RHhnfN!JRHy#_fb=Svw~5e$XTDboj75q<-Y*MeMF^V_#BnH)Yzn`8Kdz^+nwW$5{G}PlXf~Cg;O2by{ zdxA7<Gea^FzzHWWtMj#TibfsV!d z6TejazhVB%+1aNcg+}I25`L}ZN6!SYc#zt!s&c~9Df*)+eJq|fX#ba7CVsJae}QaH za7X=lt|o!R>VspQz?nbqUT-5F+Nt zL{#RQOdbn`U>y!W z+J`2G$G*_MHTn7eD@FI(V^;EIIAe%Y-YesK!_UJ{G*_KSz;FylwE)89RO2w2m0^I@ z7w8aO@iCC8XP*qfAP|?xy$c%&YN3Oc8_y8+1BX0kAjIm z+lrWbk8|2$QB{=b#w|87%=tQg z=zM+>y*G=z_|L=db|FHoAba@2_uVd{KQ#4AmAr?g zfB8yyQ7#1(&e%U3ig76*#?s3O$3Q)lsvnK+Qh+@y{mZoC?qw^nS$Ox{C8d{w>dV>} z^4{f6vZs7Eb{KyaZomAzTlO(H!Xs20rF}&R<*efBx5M{l^dp-y=JbshaO4#Pc{}<@Cqk zBic@Za4yVAXbSO5{3x7$B~$2$#Ljc12PHFXK$ol?@+aV7Uh6&}r-I9>tLtMO*R!)2m$oSv?P+bIyPU4=*U zWR7PG!z26F2UrUEAIGD$VWRCy+Li$TaeRB*-%IV!aKQ5mu46hh?w3fpi@sWEV49}p#n}~Rh_f}Ya_~GwQe{U#q+X);l z9(cU{(JCCrdnODo06(oQamVGO_hE^)D-l)|9=#*Z@%{u_t-p39osx|45xpBfHQrQJ zdF@IZ>2m{qYP>_hyAomCarquafEw>s6<&@KM|k0T{@)ECAB|yZykZqzt_qLFezkn` zesF)|3vJ1(@fNA@@>O`lFd09<9sur@t>0 zJ=l?k+(Rn7o8aeoivdP>G)9oi2HrfGWdA9Se(g%T=TTe0r*_0cZU_3MdM~;f`BEJ9 zBXXSYamWYAkn;ntQ^|wcHOWWwHhL&pwH$U?m2<~0xfh*f&0>fC{){un+i4;PCqIKE z!^Q;Li(W6)&;dNJ|0`yPcAvf>;7CZ?m3=m#vufEirb5FwtEcQG+lGTTOWj(gYq@1aOA(pmfk(lL)`1O)chk(rN z;nw=*+b0ewsBf;;%E(>V4jFw;Za@gIH@$=;)%i*l)S%Qac;IkJCYL;{uFps$-I_;d(+VT7Iq%z`cqNuf<5 zl$^=#k!8LC(6?u26$F~=qs(us%DwR^sS-_z#2__nTqyPuqm0COn8cuRk&>87+1~jt zNPe~@c0A%MDg&{|(OmE5{Zi5E604m$$Ugi|svuT+rN(BkfZ52!FeV?}E>eX_;_Q(Y z-cRyTHc=F?T~tyIrj(ONk=xfM1gdDS|4CVZFnwJs>uXz_SaGgLX~Sdc>ve|VH8%-p zZF`zuNYKS>uh+qANa2M5j$uMbp5Em{++xWv3>9L~`65|0%tStsIn#uMRraZgQ<6{m zBC(-Or@sYk6+do!Q5&-g8zzi1nK)5hgdNEXc9ZCdWc5#tIC3T{mZEk=rzFpg0puYT z#M3(qkSQ~35}@X1XB4ygZe#TwA-A*pLiNp>9kP|19c3Gp!y6r|?MPV@l>mG{nV0%}Hw)_1X(8=}~i(Zss zUNcmD;{VBfwbcBh(fqj3x!vgB>WCBt##?>P7_-+r_@{)A(Rz+Y45%IKL5Fm+^ns_U z?{ZiJ&D&nTyJDTc-dHfFIic-!@3jZSn6`sY;tVBHMa4N`s9o5;)n98w8}mdJdzuph z_0-q*(OA$9y%8HKO6fn;Iu~+n%AGiyT4&YOy{oZTJ^gq4r(Y^fgjuRI(TO1te&|>%8wORn+zky#}wjr z5djVZHmJ4Jh8afe)6NzVQa{#wklr0Y3nq=+8993jhEzmHcxWfR{&w>ojnCwX_Re1& z-IQqlvtWJ-d)i1K54hNfMuxz~rn}CY{_1&{pMS@8q;6YyHG;CL@C!p`1v}!{MY#JefeY-{}7UL%giA08+rq}F}_`~C` z2=Nl3VY_ZUL7LDP=WE>WISwoQ6F|obICDy+Qi@liSrW#tOk^Hp{4v5x#ZS+1v9P$(p`{PDs)3LwoX=^O9cmGn8xKSF57l^m@D;p}4}TZxzbR|@NBvIKW4ezC$h z;h&11=B=^#0(N{azfH(i)&XMWvZh9rU+HO(Kh=5IBs!f=G*Ga0JcwuCG*R;=NO$iI*J5 zXE;h)mKO!UCF7@Fi{Sg!44?ifPE=mOP~)T{j_-$0RcHk^^vyfNQTE9Rip!rz{HiV~ z;<=R^y?ky@vVOOyepbr9n>})}zPr`^NY%sCv%e)LSMO-EZB{NJ+oI~r z!*{(0+OQnBEEn61x@4+>O26E>YHrEO($c%bKj-X632NSf@GiDpFAI684SO}$K)J|! z@dL%m+wVVf4_wZ!XN#LxUq9vVVHzms@D1*ZfQ7RT1SxMuhI3y8xc>wL!7sV%UhI&| z?=4)qf%U^Z5HS0?*IBX%d)(}$h)aVHkYb<=l#cgv(feZ`2zuqcrCC2)?7qwc!InAG ze>SR`xA%(<1EJF^47|~zrOsVZcK_X>0M#b{KR7w+Y*LHd(9k=ri2`CNf;jOUDGoLcN}kjSbaPSKAPij$N5^pN3>mu;CsGQ z4w@?Re4h`)dlGm>N*cOwJbxITQ7`XN5FR}zaJ;*b9)BS{e+duAKyZjIR>JKR2*>w) z36G|c94{pduM2+V(SeeM@Fs-e@jYL{qeldecNb`|hUBAnlKa!&|5DP}aV1B4zO;5t zcr^Xxc;i8<@#uNyK7?_{%TBM25^Yx^XpffT(Us#BBE1^#QTTI|G<4y3Z-7?wb%2k@ zsrmLOY3vjTw-otOyQgwcKj!&v0jP?0H((Kasc^= ziPG5dBS(9$Tt3>{;&}f8t;XvD9<5n$M||Y|fu9=hNflnA5=Zz}q*vn=V{qjdhz`+L zD{|W@5RUe8xqMf^Pie?MC=72N@cPrAE)4G_72cI9JpP?1AIHfqY=7;v0s^SZOMAn- zUGX+Y^4$g|b$K5G-mM7djxfj-gyD6l@WvsY_z3T#Fg$+l0HT=Vc<+bd(Oxds-__vc zcnx8Ae}jCqhQS@jdoc{}I~5+?A2{9>VR+vGk7E!fr!NOVw4DOUVNmAsT?;S8k)P75 z_18Usd|xa1*pY@D-y6OOv<*LwXAK*7jfxzUh8*#cyE<&#rM+P;A3YOuyr?idTL0)z ze{{AIrLp5jZnO%I);>5M?ZKQe9p@A|7HX| z+D;z0Vig{}D?o81Ut5@bbk;+e3jF$|CPXgQuk zg=fdWqQ-j&cyu4Crb+~4Ka-<;$#FhC(gQN& z+To{rE5-A91nH^7x#I4Ov>t=mm)g5dv!$l|+`a3!pc8WP+&vlRo`}MWI9(Y*b_&nf zDwy->LuOZ1ovYGe$gXa3H@whnh~6|pGz{PD!Fw2+vh)?*ZF>5&7bYP(JtlLVnAtRJ znynIc3rv$VWr+su_ZdUhNb}Qv*On?^@5^KHV*mTEqq-)w!)8dg*D+39BV|`+!LaIX z=S>gK)JY{eF-a#_>KvW0VLL@=cAI>a)v$5+q{CHjVPRrtmC09#u!4=DFv;U^J#R#G zlXKRxx+$9La;LA_mA2!i+mgiviCLBNU!9roP)>y4t(@N!Q4%5Mqx(d<{pVc|8C`Xb zS*A{WS&h6NGFe$p)d33&5huO3L+eTORj%EwN2ZewR0oWR$eE(4n<7nLWm((ovw5Qp zQqmOc?R*x5Ax!*Q@oT{kdx%>kw?F8rHICd|y}7wM;HdZk#_<|k9WI#Hd(lWAI2$KT zYB(G|I{wG%r;XK{Ev|7!c|SB7)sAmy*F;Ve$C=zOzvqR~D6b7RN|{}k zLTscZTxrnVtXr&GNCsI-55yJQ+nN`? z-DrRzT(P0a_WD&u!$;emj%hTAW1gN^dLXGSOBnOCt@MCYl_6|=V9<^jpJUV02A^&1 zZV6_j5wD zEFB@`Um;XKXDl}*Cl+mwvDZ1Ox4T`No14Vi7=xk7wttwo&#-p0c);edxgIg185T{A z-t>x8b%kL5KGL8WS#q`4d*bzAW03=!;%E9NnWP^v=c`Xh+ZD*MZ;r_#MFyE~si-cWkfT z-n0Ze+i1?cK)EpnBRWZ-;SVJbhbQ zW2*`3h8A7xU~W~!xUt#eO1AO$5m<>X@h`(kAOD(XlBJx^NEidsHu_z#p}VdUCPUDB zW?Y7G3azAQq81#DE!sOCU50=te8a98IMp4GVVt5=9}zB6%`hN|`3u1?j1nO(QlJlu z4N>M2vdWVGW6)yBVMDS7pS>)Zhp(C}_ujqY-idwA{SWcs*t%YPid_J`Fna1eMQcmu z?0aL_hjnia8zDaV)#I0&Uil!}@cJp^lBCl^4!#lS+wne(M;QH1@S;FK~w{Cj5 zVEPfqo~LYcVm95Bw_s%vpl@HEa&3P0;-9sDAm%wJaUW;4Hf226PBCo=NWlYEcUV8%Q{NpHoK&g|Zx_}4SPK{(jM&gM(c zhxuuaO3sU4EKbOxIiHBR2RTe7Li?c>g{Jw=B!wp4tBF=7OTScT@~%*5;z2)UJjxVC z5NTlwj!MJ#F7=R?Xi7`-l{jVcNplLKDSVbfQ`7?rO_ zq7qGx)*FbX{F4-#@@G0kIOR{zNW??=->A@(=dTo+c$gl*V*%|{!U^+Ug(i6)RA`bb z#xU^Cpgb?UGMUOoB+YLYiwu&KihSRa{J{8TG4=m2;+{Ebfq7S5#-Y3OXxrK zH*%A~6wb%T0gC5*H-L#~I|aghiJ_SIXw8rM6UC7~DGbk!FdF-~<9MUO@VbFF8cc*o z!yCt|1Wn0#IhMks3WC)%!rk3`3`f~I__kMevyNUz2l zFZKVtO=nc7@n!&o>jgtV2ycEEUK;S|9>5)!uOtj_7Vv1iAo&QF%hwH>l5@Shg-Rek z?l|6G5uoOyb+9(hge&JeqR@6FZYlDe3YzkzA(!V%x>Dmkhlpf^amVp!%p}^bL^J`f z95mt4kj(L@OlrJCh@g8NcN~xI{AxTa+I=;`2#;<99FNxX2`>dda<`!|-6WIjKgH3H z_KoO@YGCeJ@YxlbE)+*@TNvLzz(;cd?l|8}1Q1R7A(w@UnJ1I%KgH3H+9Xdy5zp`n zBo7>qqx+6~0FX`q7Cyz17!dr@Tcz@G9L{k&1SzEiv9V^k&!mylFboXb`0Utp2*Er{6Y4Y>M6;J-s%@Q`9Y=bz~eX>xKV^92N9_cxKiO?pTc>BC{#YFdhCKbQl|6 zU|l6ON#?yG;yT++6i&hhB=R?rAHLO6%1q7ThzZJ@%`!4@4N;jjIEpMXQb0MK^uBo~ z9Sw*rHITfRF;U$*wtvb<^`HgpJ|_NP4t)qqepYU2N?%+F^|;jKX1POCo~wS z2xZ&VbPd%N+2UTTH)m+722+U_M<6*~&z~s;B-AGRE?^&t+7>1Fr2Fd|Jk1mwBe!GH zC_oNVh0C=IIdJOQ5OfbI5L+8tKg6pE=~mH`VHnGIA4{Y!`X1UQRWnppHP*^vpX80U zK4x3$u|QaAHRprDUjQ474Ib0lS1cpDT@Mu7aMR4okab*NniA_Fnznb-Lkg!8(9vlsy%Iuc@ctE z|6oVwOKP`pr64`pI<&~fg`N*NdWS!-&UJ-@Cs9{Bql3ZVjnL2U$b&^8<}z9Y_nTi= zyj?MTQXSYTU~jp5w6k?SXU(lR@X!38xR}~He0=nxVbSr3`%isynefTG9sYZayE4SD^d;}U z;V(7re_i_I-2)}>KFjHP#R}ugD!utWM1GbxmEI1 zns-H$#Pzj>hD8;?4S+_BT+&`*%w@?FVYwpXD^k zo|z`)Cklr(tDS2i;U%3*3zo5db*H{4{Xg!O@!l4DWwCeX^1=kW-0llUfU~v5O3aaq zqxMP1kRrf~VXWvnt?dw-rtKk0An_9+NL|Q@m7lAXvVvahQgEe1Os+#ys&1 zFmN*f-PRJEB~~>DE1u7%mAl>!ZEiV+kI%IpjcctRqlQmcR4?EPjgAdg4HC?0nuJ|U zcpxv<7k#E>9yTVy`@N=J!y0qUzYu<$`nMr6AB*q3JA747ho`#=(}G7T(=C^Kx-1jj zgIlmfPf8IDqmC9vKrI~@4hprcEvjsJkKyf}Qj5xcym#p^M$3HyJwiiw+S!%UoMp=l zI>Ru-_jg8RW{7v{4B0nFWuh*1sy-=b?S9t=0XJUPhU+{_ea3a(S(R&Fi}Ee=MpwAe z!FApZ-mQkXX*)4j*cuFO^GT5wq1=h?l%GTcmbp7(WOTK!!Jr=>)9Mc%*I$S^DRrLo zfAY@xS(knCZntomy}-Jm`B%nsKa6=--|@bs=w{)#J~B!u{)_Pp*4_VcbdYd#idgWT zLm{y|dt7_rvZCMqSaYBox9wx+*aE-Di6zLTMzd+XtpQ4`AwR-tbO7N-0|Kt8Q51l ztnJ3*-V><{4HUQuYXy$YuKnDM|GV<2#``|9UMx?!~PxI55jUd5ciez_GghN?|=pE7KCiG)} zz+ZRpJZ^b^7H~ydOb+gdrkkUVCL%tuNz>5eZ~XK5_L!oV1Y8*h;aO^~(94kYT-4 z7q2l$TQE-(eLAEEUsE)sz%^!j(N)1M66K<=8=~1qJdk6LBF7;n2l4D9o_+f27cJ(i zw43&7lYIF2Y1i&3_Y;!KQaq}w@d>HUC%rHtd1Hd6;?E7c{RwEW=G9`mX3wE^!!g|+ z2>QXK5h&LFeV_U%g?ZrxgJIW8M=I#Xk4YsToiO$&;~C~Q7|-I}g%Q@@+c3Mpc!p(t zUMD^Lp?Y-+cWS1@ig#+q4lzxMy-eNiidJb1BkE>KB|}k(<`<;S43h^v?EFNZFB$`P z%A4oWi8R4Ttx%unpgw`27PtR7%KUMfsXbyU)h<2()+#p_bKXxAAHrNgY)?$cufaq% zV+fLIJtn!q%*RQu6Fu#T0o|NEyLDR(+pZIR;`G$%p2gZb4Mn@pmy2!ufL#W$R1rGq|VIm$0K&`rN71v48x+t`zu|pEp?uz$G)!Y0&P4zDS zQZ^3-4+KN>hF}oQ9IbiRo}ukh^LD@Mk!C!8sV0@}T4l1z?n{UD=9ln6t81Gdt$FFO zW&rKe1Im1pP_eKILQvl~=zHn|vKvM*k(96QdZKt$QTa-qkcuC6*E}gzd)yU2tgSaI z^>vu0SVem@C4|~$U}K7gea{HYHTsRWi%_%tIbYEn%*)npde2~P`<6cQ)w0f~JO~vR z7w4bmgCFv%xG;cByuHcyPik*=-rjKkL^9SMSfA&gl!nT|3GB5RhONdO((7DZ=(Twr znKh=AmUzk$y$S`w+~w?`DK(~?79-(ldEoPgaf$0SCGi@s$^2K*qjOdHYue8nbhB)M z=%TAc>Z7GaV}gryZCG@+Esj_pwMAPuTw}gU@C1QOH^qy`qdycEzJ_hIG~LikROw4)G@V$ z&~!8)&DN*Pl#Xf3O-(f1AC5dp$4PrcD>hO+f_s=$6DPT{-JZmhSyEk#5m^ANt|cD- zl~1wx97ANQh+Jbo|BC%WWbAgvx}9-so6y}ZxSc}`QOli)jV&{r&~XGk|9%vk;xsLH zUTzqY;`~L5bJTL@$P{P7a_5K?=kVoDstdPsn7d_$+i3=kDxfFGitcU6Qq}cX$2E>S zQ`b@sG_*Br73zzY$JVth1rzhsnaWP26yA_hI1v-}tDEXt7T8cy4e@<57(Rm;BL?$I zgX?LC6T-j)TGkiD^GsXNgKq>VSl zAWPSSexD9!lIsxFijwG$9r3gv784rj0=}HB$QjjDl4vqF;v;dnjnl3CdI?2pl>!AWu{8xBxGw0K~0KN*Rj%vOi{K$aU`%+f>3)uf+_J0ODxEidZx?HQV#8VEH z$of4``jtKAPrBN^3PKy^7X?`%hiMAmy)5Q&-_Et!QdODYI}+Gh{gD+TZsCStu-5jW z<13vzaini277yA%UGBQa-xTS((H}T+YT5q1mzPy89_)UzJD^K0JT9>_(8nf-fg{Hp zCzoA_Tu@00de&dP#a|!oD}4PLZOxnC`J(F*&9(ZPH@kh&wIh6ywO4)gY;7grWi=v2 zRwYv^eXU>DQjACYU~q8^Abv0uX9*fLA5IfHIn@Lu3hBYOEXI2w+PCwV1Fw5jZ4PFgG531VD|2`@Iru9 zE=SS94*=`iP%}%)zawanB7Yqk_m#OsL1->fz{mEZp=Tp@$B}PRe5~T56YdR*HE7$b zZSEE=UZTP5zOhADNW({Ggs@SsHL$*bG5&DmadzW6CuNHUGd6sbBp#6^!KfP{{BXn-M7IQkBL{8&_sPqee=-WA z?47lh_S#Q`T2oi81q7y~Mf#r%F}rHDJEE(w@cvwL>l4zh@#2o?dYwGeMc#%%)brWx z_p68t)I*hfdoR6Nxb`l7y$Vjv5k3c^I6Q~0uAJ?hwjq1jof3LY_7V2{Z_rNL+1O%5 z#q5a0AXCx$*$Am^n&64_;Jge>X3R~d+Cqhwab|768flcUaiVdy19PT;23V*9ROGhT zr2OlIMzbbBbpl^orr_Do7_TvZtf@0AE1=iw*+L{MuQ^3Ct;JL5Ju<7({I=wYF#EJf zO?sjGiMz#WJ{WPc9^)%pO9?m>B~@U;JkEwkL2%+$!G_@+ZRaa=lL*i)^=7HcER3@y z$;%it0mbOL4vQtpHkpe(isT!>Ga&*EXMKbZ>xT95wYmwEdzNE|rfC_a86n-Q?`#a= zn)3utM3D#gWXhT{#`3wR5M2>d6Vl$sFO)f!e9BAFxgVAC(3GcW#E$`5dI0&AKA>rj zJZjc-x0Ksf?_5oH<$d~7iHP!S_$FR+Qir(q$biPvvLP63a&CHhuy^O`t*cF*op?wN z2JxO$FF%__W-VihJdS`4_n>|HlZhATE`+65U<5W`nI`{G(4+V0*h_-uS>Kd9R7*A$ z-L7?3!#LD9Tf)b*6LYJmeUWTPsoED5cpF38J%T6nej9JEwu?5`Z#%yy2m86wM; zq0P+R>Ta=kHv)`K z-)OFQrE1*;kJBBm=?qYNX`;HUPc$#o8lv_^nTHBZ5gzABoey(S)Nf6k#-nXdJWzQ+ zY%g3DFCLEmPquh?urnAe{+qG2Wh4dZOO6Xo0<>P+luGQ3~nUR<$% z<3DMS4>KfM@yy0VgDnWqo%e+iqZ{McIIJw$Oc9U9YTC67eV<0TUxn=l^~nRzapp1` z?(>OdCNH%JluLQqT%#`ct zHZ;i95LD+aGz^`Mhq^dmU?h!1rB1^`6W-YMXg#_DkFn^arpz=>#Is4o7_$zm?<|z| z;iPeivvGS>)fcwv#z17cuRtNx6Wa1M@)D&|ql@(uuwOU7AOE#PdtNi;7+ z>ms;-$n>*VANgglVoci?LBmjlmW#O2&>erVzNqR4n9~|Yk4wmlJ=uGrX6t6&E-jYu zdNVKQ|JT=y6WGg}>BO**;xx`alYL_Lk?fY)JF~aW-jH26ds((~c40QkY#$lZ5)3+7 zlU$>B1cODHXysW5W%Y<=k*UGlLG6cDvG{Cn#f*aK7Ciq!V~X$LF>lhEYlN+6JW*Ij zyFLQh$Twz%nZhSFNJ#XF1d20#+*J5W}$i zPlG+d+p!Q+^-p@k7pYgHML<$ZYm5CTpZ-wK_+A!PDRa@-vsk%cYC!H3|DE!lu@{yRz^y?BP~BI+mW81nwOH9pO)*$ z%E?X7o}8AMo002qJg z<;a2#(^4Jj*=ac$IeED$nGUEXH`SJ#=15P;M=V5iWaXy|8P*g>PG;U@ux2_^b2D<% zGpLLy5Izr*q-W=4rDx_jveO;b)N~sZnFFn*BEPJxT-1xhk)Dx}ngd1Ha&xjFe{Ra; zw8`oDX(_h+JQOl5%WAddWTxb0rDZu%vnD(8Y?Cw6^E0#Z(lZ=6sN+0aN^a_8Yif2* zmcyEY{PWVYQ}eAkIXSt2&bQ@F&dTh{-lbsx^JGBOkS%lW$A4W@SPf z8Iv_|)em^4(}F^LIrUdqOqV&>)DC6tX%92*N2#-@xI5f?im(K0eEE;$y( zo;)_q632`+GI2~i8jfXLB5HbU+Qw*Gpx(t=#>HAv zEF;IISdvpxlass>jyJ{RtSp$jXvsXXlEo5_T&0XnOGDL8P8c`Fl9ZM_Zsgc8iDTna z$EA%J6Q7ovl7#k|7@ruQ5{t$+62=*uGA1r9EjeNAm@y+zu1RPBV-nIVBga}$Xk#s@ zW0R6bj*Ckhml*4nbb=`+Z!z*LC#@{H5vG`;yhR21Ii~s9Os`y9UVhFzlWm!40Ja*x zbum=V!8R}ROgV*xOA3dY3Uih%FI;TGa*Z6*^`-%qWGtSixtgzFBApEv&FcR$0Q2`S zSCZy-hwf?_7V!6}CJjBL{|DAggwO;&PQKPmh%mZ$TqD63|8XH5o6XrCL&s*aE8WUj zq=ZKnXeXUyZg+swdF?1nZslxHat~9<k4_RRAY?zC z*ACi*pVBT2PKQ;WjhLfJl#WY_oqCm|^E!cm!P368-MR@NAWP zzRG>4%DqJ8E>gLdtK2J8?z>g)dsXiHRPOaE_Xd^wA(gvAI^0F}x)E(fD^;q(A5*#2 z;hRS**+L{u!aMrbgPPc1bJt9W{1?l2M6Bs%BtB9|vW!WR~Bvhb^=yEs1e zgJF_MqO)d}_&b4q_H}&t~qy(r^L=jlva%69Zg4|KvwO8@Zd7`-I`d zoGqagBKE9|m+DpWw5JNuI$UAc!*d*$kA{DklqB8E(<2#TOSt?{CV!)p&fP1SyG)wT z?J)xR3X|@ain*I=Qkaw_?dSM#GQ11Ce>#M64#O(-5}LHmiPD?F-8APsOd2mOR+S&s z6Cyc$inK%(-;cX#y;T@i63tM>k7u#v^;lsz!RJ^I_rQ(Pf1SH0f)A7aB1Nj|OCWdC z>a{RwuJk)E&tm4bN$(X^kp>w8n*~H?x1Sl&wnt1yy;K^8CnnC6bP(R|0B2_Rz*u@!*mcll$T`iyWz{n1<}Baw+T zq%ero3+H7pk@FPJWNrWhA{ot%jAiR&G*+3Xswmb!QvD;I;tk_G#k-#KqFH+Bkb*!E zvi~65!g>9qDo8x( zejDd0FY7o@b~w%XUbxfwXCzNDw9buq!XCwWlHbC4((54SNiQwxILVVEE66gfW!!q)RO4ksT?4^Q2b_=Si;y&XZn5Vjo~iPeX64J9j=W%1}zQ~^_85i*$OnR_`80Ku5XFBwh`Done3|^1?9kM^A5l)%n zq{);S=1&hVPNM7>zEbBbS%AsY!v!=LS2%c*r7nqh3MbOclke1A!y{#${))0@bw(JL z{CPd;knRFGE|pXGRWhH>d6Knp-jgoZnc*n=aBg$L(JaIt5UYoG%KUJ0lTx7RxQHi= zzi^)LS8$%{&wZRHyvI3DctoOIu>P&D?8p4`WS;4kEAxb_$(MOnjwYEOf?GIvk{!W$ zPae(i05SZ2GEaX+x+d`9RG~O^YFlm-);0@dVP>B+nWrih9xd}j75uZDC*6*6o^<;c z=LwI_ZKSw_M{=UvSz0{rEG=H{tSorhQ8lH_c8FM?!25X<+!|{1AW}=zu^8eD$ro)L zmu3QESv%73{yc&Fx!tHuiMBbK_##BRq4_Mc2Vx5-rE(`5e{#PfRC z1$;O)Xb`hAc*-jqJAo%#&BaABWUFG%Q@%HFp7On&^Sy9?o%58=-#Je<_=58$+<)af z`Lp&2eDc3WBd0~SxsLPXe>3MPAM-g+He1DcN*D96nVw`nHa-C++3!{Ep8);<=gEF2 zI8S!{j`LRVe{i16)tl-kaLBH-_a*UUSF(|)C#bek_%Qqd1>ho{!kNr%Wkc@yr;{*a;c zBPoyIsT>D!o^)BsdD7(x1rMjEuCjdbx=rbc`o{7#k0gPOOT7EAe5EjNxzBXSyoqG8 zWj>ntG?}Nk;n&JMYn$LHO;#ttQ<`hJ48=Roc}hQobcPJ&%glMgvv8htp*WA=m$;pK9F!Xx@q zIxLlCnGR-|XJwrs^JHI9rcAeZ*`MhK-lH3Mk8a>Sx`8L%R^bWKgeQpEjrXg}ZY8om)0x*{rt>)2U#T-|*9qu{B!PC0}(_d+G_%DM$(;xgT=%1MW8)O_4 zZlZoh6Azh1kcr_uoyjwlcwSx>?tc&bDcdAp4L+Ik5)3k$_y_O@WW_}?bXHCp=U0JG zC%zPaK$CHi%){`X%6Zxob_VCWBI7fOr$j)rafxSBCh_;-4`?1P&3wj63y25i5X8;r z{7CQx#HYzJ%eens__KEb8mNM(n+^vLZ+Ywro@{32{#16PC&}n>pT~Iv?u1GH;kY|E zPw79zc}k!4w~!&(1Ki()`(e&gS$)p=XxuMyp320CvLyVW;91`V-U6Pz4}wnse_-&j|1OJ*r{tM2h!=H`Q5O*?o4a%Ev$Ob()Pxz6Xp8-CO z^Hgq0oTqXd&G}65DV!(!ZRR}TJj?k7;Q59|UYixsi3ajf9a(vcZG|{X#^FtNysCUC6J-sD50Aw#JxB`H;LOQHk#d=cy`t|!oU;(V^e+@dA9LP1|BUSeo0(7Chh=z?%1M=R@i*R z%3iW~-dq;cNudy*KPI6JSpfGRootH6_5K!+$>ASPwljSah=aJ}8Y}5~-2kguS^jK;S z_GJTai4OSmV7>x?mqZ5u>gO&G;4RSsfcm-119(d?0K)Y47J2U&(ji58AdBXL2f$?t z#fMl2C^kgBB9fQXpWLq$CXvq&>%4FGI%2FK-?l7wN#P>)L}h1>zI|24r%2P^m)*i|Ns|g9dzp=G>gSau#DWNWIiREJZB&9CGI6DF8q~>;&bYZ=iFK;dl7eM6>|>U8VqpgfdNT^o~_Z z1ay)bjU>@U66BJ3ogL6enNkTV(`NZqg?EyisF9aXODWYMA@qNpnGQN!#%vTS(6UjP zmS6*6zH6t)-&1_(dwmR=^NZk%-f)?X?yDBjT|j!GF3Pt_bLTF{BX3?_JoNc5ZAE+o zKK$Twm4^z(V6{5@1mQCZqcAYU2XHrit5K34cRUV8EhoZAMDUM+A>K-!psDx}MBk&{ z#6|j07`a!2QR2~eA^uYkxOTkdD!kbWJo=qW;9VE!jaQGbAOhk35&;sD~ z!kzR(kO!~33eSzO<+ub1ysj!dy8;>9TN=;sxI*AJ_G#c<^?ESK_q-kL(~w=(h_V zN<0_vqTxq)Q9O*|ZN{aGxdVwW|Kv1v!xxg$w>( zRsWo>NSA(7Avv;Bt_tsI1cbp~kifI4@Mb9R@N=vO?-6v?%JQuTfWRP3!9N5!;;rNf z%2eP{Ia3(vN9V*T@m@oKuX<^m1RnjC@+Phk zxP*RvRCpH){r7w60C5-)q1d%3{cW1omtd-unu?8x?pzhj`O|61>PU3{$LyML>?)g;Qy`a5AuOW_9FX{P6F?J6&{_VOXDg*0`IU2 zZ>0k776=Qx!QhqoeXA4w2Jkpm+=nkOUh9#i3c2fT?07esPIB6!U8W=WxsmhQ96PI9-Sjgyp;!p11}mp)tC9W1YVd5?=676#N*IS;B`^q zB`fgq6nKRyyp?!)qkc$`z+0rkn+-hi{Jj&xLcd#7cxAxbEx@=OId4|sRRS*^{*>QE zxCGvHXb;NrP3P}(5Md1s>U%@I+rr?kE-BWZ?DSap)%SdaCfgQ{XM- za)kGa3U40p$X}4at5xBh170+QNWUUnBuDX{RN)l>kIGAsz^hW>MPZO8@RmbZ;L*A8 zO8e28JApx%f?uJ+vjUIwA^lcxIdacY;k9;RKWq)au&szgG+BX1^Y4UyjaqO0&UK>S zYmlQjR$N3g6?k{UE%0hoco%>-oW+p;i2QC*;muRv(f2Na*P!Z$hIaG)UEpQNDfKG= zo@gKUD)2U|@T|b=O$EeB==Z1!?|I;f_E8L3q2C=UyxACxTLl=GBj+p?-Y>x027fBw z`)~=o8&!Bu0FT!D3KHxn72Xrcl5_?_gm*tKfme*YDeK?+;c}Q7Zw-Vfj+F;IfR_YO z|JK7#;AN@sjswqE`OZ<{RVwgG6nN)V`3*v6fGm4R_^p6kuGAoQ;rE>K6sPR$-sjs)9(o`NBAc6J4*Xq zfKW921&RDdLQaV{6?iisMEQLZ7ljetdGxbNJQE6cJ9%&tc)vnUiT5<{RzimGT(|_@ zDV2VQkl7f73lexIRr*EYdP^m|%?_Z8mTmHC|- z<-2@OL5_5=;$n0|dwDzy524>%D!iG%gK0cOazt;a@Omlms6Q8Y=|SH5Jpw#m{n{AF zDfP1eFB&*xza0v^!799`fj0@^f`onpRCqIhC;GMLAuRNJKvf=RfJgOIkic87Dv!0m zBfF4(FW?e*c`Cf1t0d_z0mkLXIZuV>23|V+39lBHzQGC zKoCCmi1twjKY_PZh35j^Ydj9!1YV5_Z#M8U5l;HO%;g{=J*R4Kv#<88-?OUr_L@S! z-3q)1RCsHE*NSjKLcjGYJcG4ezj_FZ{L-2jrTu32_5C~=2_cFD7)AwP7Qm14y9bxR zyGn)kKJaK?1VKW-UMjrfDd?9u9@$&qEka{}x93~R{r#}MR)D~t!syxqKe~&gPUE9} zG~9wjl;0pga#Yue^w-F9{bg4>-e5jH5dH;_Qxahi-GTRAn}eX`4oQR**h)Sm>6}h_%5uYUmNyX6NRI*PL$-Iv#xFJ4@@2{;g*+ zTR%@}ZOuIMgQ@k$SnMS4`oZFEakm~axDO)@e^rvThfMXs$AgZ1>mzb4i(I?U-MZIM z`-Z9Z4gcCBnYFu8YHKr(>^0SX7VF+;avcJ?0gA&MbQDTjM)+^SCP`uDh%Ys3&QNhDK zvHdQ#?|YwYe^l&YJQaHwm#lxuZ_WAuqZILzPCf{Woe>j=>KyT_Rv#GUTyp^1!v@+9 z8uq-8Gs&bVtJG3m_OaokW2d{c9x@&1vSCN$-d7*}bR3#rAnkF=>LdRn*Qh)NnNdHTFc!(7%~?7 zZK#So`C;X$E&dTBal%j3hBb#yhSYvza4RK0`sLIV2{t*bS675NS z)tTLI4Yoh*Uf;bt_FG561@HLyc$X8QllF!l${5;~)X>GW-9=}vPz);5t=fnp?a-hC zr`z-}9owZ3sSlO{t+noQ>Lr5d+|B2zsa?cpjFHcyr5Xf1aFon4gEc2*_gj{Yx}@Ea za=+HP&WH|Vqi#n-eP}~4#dEGtJR8w0i8R>`)e)PtNxKJ{*10ktb`K3H*a4e12T47x z(kIom`%Dc%Qi#=ETRzDdT9q+Nw6BPNX!SUHVqehDLcSwt#=<*EV4_=o<09ZmKJoAGtBOS?B)7(5x-}3KLd`yqiI{WMH<9W@qMvVx1X&^u z5^=sI(qxHLNTm9fm?29{hs1Q>67yt-AT88>tH!Nk69x8A&f2$%$Sy4d+u$yciLwwN$zFee|KnwWTQA$f}l*S9@z( zLQz5}!$tXp`er#S!a+2Weu8hd4@7&|FJmCzx*vm^E!> z%7k4`zmn=^vr}JEK2wKdk^+z0zW2W=U_mT4mv)v&q^T?u>G_*dXC|Y zg@B#@i|ASAb@Jq@6?lRkd?#A6?r%My(QBu*wQV;y7-23tC?|81tKdF2j-m=ii6b2y z{G6K7-P?>Ue(cE0j2-?FxA{AoF3iXC?b-jk&$per_AH3{z-&@2t)eqOV%MD02W<(O zkYat5&R>gsruI=|#Q_r=D;|3n%)$XQY&vsV?DUO=Q}is>bPZRO*a{IO7Ly8#^R4 zG%X@cyDb*R_h+_P6tYuWp8^Nf%gj>4mcUKD-q;z4XA_2Y^0~_x&rbe*eS@DqnVwj^ z=)vKrHdU0BmPE#Q${%M8;1s0_vq2xSeOgrtPO&pPQ%a0D>V}s#4&6KH|9!wk8s;FD zI9o;7C{d%CZtIb1!!c~#2OV{oO(>R#}jpj2~@Q|7SF zEJo*|6yYISX|OL(p<@n%WqF6WU&*vpXKS|_C!gECw92-%USue*yuxg*u!TqcUR7MO zi?X-28VANCyPRDW9YEgDQ2ikN`Ib=oZbxl{JM&J5dsoW-Q9ras%a7cZ({=_nRJTyy zf>TOt#*)BHd#1x?z_D?b8LsKJh*>yqs;6uX4DOoD;V1o&jf;LIpCd}a(=L=a42-U4;~C#i6|wW*j$bIP;jXY=J3qg>%>Xp4yB#At!7N zOPwh=l(y1nUFU#Z>s>hAi!vC{6XT!CX*+}V1-PEGM0}~+)crbFZKkU_#pTMZ-CdH_7vORo&wRH{4UaHowq{htH0_*N?zs^nd-XdS^6G+XpI_|J8$_L!}w>zM19tFC5Dn%i^ElE+q@Yg)~a226D%=r(f6ZnCgMPGg{=p0ok6vg1}KZW)1Z7wR=(-p zq~9N-Et?XH8g5?_yXLounr_sO!?r<9=E%)Br?&Qj`xulwIkU^u&)lcXeK!9fKW1;k zV>akjJZ6JFdVNwA1~DI9s4@4fGxzbB<@C{rt8uhl)E4bG+v-D_gH8q%oU|O-Yskcl z@m^Cy2pcXBy0lYQXO8kjg2G9?`s42wbno>+*1d-2;FEq7@sOeRHB&?IBqvL4@Fg6% zM}0hE?vISB56Xn3PEJCW)Il&y|%!Rq65g!#vr z!`J}eWC;2B({SLJ4K;_(pd6-)Ge=aIdr)P0J0hY`x5Z!YkM@lOTeK(rlY@_Z;f@J0 zJ?Jh8)%V@l?ZbG@M*nMW&|LH{{cKXzq#f*?=m9z)kBwEP!vOyEpEsGqhUrTh0UrnD z@zxHDOo#3m9oQ<5uJ3Jjn8V4GmoX5uqEZM)OhnW7s*JT)8A!=N+AaQo)HVlO4;hY! zeD7EAgQfMP0iR?Jgpfw~ax&x+^_qr=JY5C!VX`P-$Oib7)!9!Na46g7=&?ylGDQmEko_#`a5wQq4AVWeB>Kk`QLOo>^#Z0foqLAeo!a zYr|npOZWM=Xpf1r5MlDjs`_eYd2=xi5*?S+hMwhrU_*QKOaBaP@1#2JX^%-23PR;m zxM-aReFoX9d(__`Ze-+@vz83y#I zhSI-AYSPJW`qmqUnNhoBC))>y_AGyrP%PxIu7$WF9p`3KA;|Do^?c{urydyOi7 zqRQRI^M4~`!=!lW3vS;%%$+2~aymyD-1L7X#X#w7+hia#p^@v?$6veOGA13(ab$v+QIS3?qN~}+l$F-pJx2-Lqzi7 zio9#MKV?_bmn8U}UgQCyZ~0;m=9@Xsi$)T0sf@#Ue!zPC@so{be`TdV{r*n-B@@wa zd4eamz{E5W&pyXWf2JoH1w_3J?PpBHF!|gDatj=#Jn5|&LZR|pLb3nxaJY#l+0Qxe z$s;vL5W^us5W}H@1d$FJDnt;OKzkP%t@3C45{d13I&K%j zFjzW0NW^L52dSA2;1PF%UyO6R); zFu0DQz9CgRv~;??33=G!~Vd@0@t=Nztjv zyv2M&iB808*N09KeMUMZKa2vf?@uvsZr0Jn_mQt-zyK9f3#Z8z}R;5&;5(a0I^^Ld09i6Ld&{N3Tm1 zM*01V3Xi^(6vJPTz{^nK9S5GMFPPTp!K3d95cTv|^x`Zq2vhLgzz}aGPtX~KekQmn zjPxV>EAi-C)nfPy5_sS8arte>Z1YUzGzw~X*S3mx;D!)M}3{f6202TSIQsEs3UV=!J z%aQXD6`o0fNByP1dk(xZA9^U~>-kZrN_RBms5}LU{4P?Zn~Zd$Aw>NK;fi!`R^icH z^zQ{2mm}u{72a$G9(~pkc>hK@Df5wxj~49RpFluDzq61d-b$VzJMb*HlYX(d1m1oX zUOMpTd!itL*QCO$Rp8P0BZ2pk)>}U(@Q`H>3A}$mj(95%X$2l@*Km)(CGhH0cxAxb z!{g9R;O$i5eFr@JXZcOya)ckFDv!zd#^%d@{Z-}Rhwoa#ej^ol{wloLz^g~NAfX=( znw0rXP~cq$VUb@tFG5+q^o`Cez_=Var>NR*XKR}$LQa|PJfth^d;`ZL_Yf5xt!?I? z6Dc{5od>G$3KV!&E=PE?RnHGP-_MtwZ&N)#)&MUW@u{AsD)3@dcx!-1zl#W>JQDR+ z;kgucPD41!k$zRGdLM+rh_8D3h^pQnQRH`=0&lSj&j38CFM@=Ac`Ce5fG6r{I)sIO z_kmZ|11s=`3NS85PCr$B$%kBw54rbLa*sex=)`b%96G~={H@&miz2_1;V1NaR)tpy zy#726-2`^E3QxkIfb37@do!0KcYl;6L_N>n*E-SfYRD<|(<|_%D)4?+>E{MsG{OZ5 z{eDsD*Gqvn9l|6>`c1D@Rbv0u-RTpjC=*+2kj}${?p)b3yNUM3fIAAs2y0 zgCgE9iBt2YKgZ*W{ zN3&OM$+IW@aP?<3ukU00#U3Be=)GR`@~%L>JbN92VSW$MvuKjX)n0C7GP=-RGE$DM z$b;%B5vm`P6ZMMZeAO!|V_pp4r z@M6Bcflmpgx%d$^QXK+l&V8$AuBfoR)aKzlOk$(f;kr;-T+=M+119S+yMA8)rn^n5 zX{t7CuV(xfzf_mIYS+NuqsR9)5ByrY?sknnxkQUaFCr$=!_502DX;vUu9808XBZ~X z?J6lBUlpkjTJw92>%xxenuAj5j=B&-*?-vF|XJA<-bMwAbhe(%G9e(9QLn$yJ|1 zifu4ib{HUIuhL-sBxdJTxE|PCUU5KLSXB}{DL40>7Y5n%LBg}NYFlvq1k8@!UNXs< zTmKbH9f@UORY`MJ2&?Pr_J z(M>kPG4lY-?#wa|%(8`5mb*)gyD-0hT0=_dw~ofqKQ%|`f1O+(^+&_!sa>U^SV8K4 zPiXz;wPOwY0;O=Plvr&Y;+C{lS3$XDg=JMY^1G)R9+{T%f+9=Y;R`rE4Ss9L?+Euh zC;P1?Kex5KV3{TL@Gq@G*D9MyPTjNNYDd{E!D#?@9?{gYnW z+Sh1r)0{aMTh`_(Y#jZ~ij{$@x+0?Psro6`jpLgPnr*a>HDMfzZ3>Y5$pXcKgZ%eS`PQO>iVMv z@46+uwZ5^|R9;qL!AmRrpR9)08RpUN?F&^}@_U&4TDjjj+3#`kv$)I4p0G5%{Y#a8 z`rC%c+&|LRKk`^*Y`uB&$_z&j;^m>x%B*#(}Sh0J@ocRHD#5twNfCH#% zk!>sf_C-JQkU`LXD762{JnSbbq2W|Qr2XSnjT>fFG>$%X0Qy(>OA&db|04#ew^e!v z`j_49mIAG&+H&_^OG8)keWMy4neOu1*DOu%U1-pg-%I3ohWnk9{VK@MQd?g3xTWsB zU#db+y=RELm9(#9+W&FtaEv}+Wp%nOdFk}7P~9l2UQp$#YaG3BFD*cf{9#h=hmW<2 zk{Bu-Ghch+Y?j%QWy6Hr*y%Q7oH;HIIca?NYviFH%R^VMJiJuhe6;KkmBEpM^4eD| z4O-Io6=qrHQP^~$A&~rbliyVCcTV=(LVlTY9-5Gceoa)bC=ZUqqxHd1RL;QW=3}T* zSLy978h3MS!6Dc2&=dMedn2oos=lZ%w`_1=p-X8=rLpXB$Hb~S*V;W*dMu6FqmI?A zN10Vc?oE39i>uD`d+`&|ze@^2U+>gnmhg6qt8zKI&CQh+!IHf}<8uF6;cCN@@}q5S z2V0u(%6rI2of2DS{yF^KgC9CPOg6`=^2WBd9naTScq)D zsHrXZwQPl9^$(};O8bKm3%P60rIfW9&L83k@0rRTH*9t~f+YI`CVQpvNR`P|Whrz0 zDm54ZXfL(cx24$YHQ>uOTegL}wp+G`m%)p5hui$%iB)GMejT!xSggHAJH63QA3zT| zJj?vi`vyrehh-SxhlON>1z^oUpnk%pN{v3kwa!@4=vTVEZg6Zv&$_{J4cF8Sj&De+ z8Jw_ve2vS!V|&y7@VXbLZqb(>Ja*^;*3t&U$h|ila5SHLweoZgqL$Xg4BI}aCT95d zku@>bZlBA(Aj7+`4F^{6?=aO?8A!~j!3sN<(^MIT{8wtLj7@&sj`?-1@zW1VIpx=- z&@VL0FXSh`py__W6@GznegXab{8Ih=OEe|Z>}f_*nn{W`+DkMRr^)Ix+0#>M(+p*g zm}o(R(`ZlC*w>nXUzt)l$X;csvf1x9o^hI_T%-LqO=gbCzRqM{kW!m#D7Z^RY17yr zG8H&Y=TgqyXm7LpzSRDp5$fTIY5$HMm#0(g8%_4(DYa~pdxM#$v`2#{oZD%tzZnba zoyLaZrpEAyZ6O=hU^|556#UG2N8Q`uS&iX%R0OvANp){W?F_`@inwTx-%yWVg2!(( z_lx-1&oRJ=Wkkr?i~eVvq|`Q>%V{aG)eH!OqYUgc$AIw4Vq|#RQVLmGGoZV@v|XM= ziu*NLL*q}Uyz^08&D&{}wguDbi_a|$&`34!g)h)JL+lSB9v~D42L_BQ+{c%n z?$i3M+5d&bxnYnxeHkQyfz?tfZQly3INH3e+MQ(I*!t6yF>B@|Y$yMC>i(v?N&a-_s$FZ;D(N(gfXx39ma zt^;d^2F145T>UxwT0=y-)bGWQuvLK0KVq#>AH>%cMg^5<%x!H>bLnH~S4y8jAA#mt zy0v1Wgn?T9X{;*LwFI6FWJ?LrKC!A6 zuswX5BS5MMU@ejGwJcoM9-hLq4uICQByFRvbQ8virLWY5qW`nhOkg?trmoSj)4$p1 zm75vAcnq0nlUf1>nbGvgklFyVw7_5g$NcN=iD^6#+hB}%SQqhrK#2yU*o=3iZRUE- z@z_?KRBvpK4NY7401X=h$&wYRQboEHxvqABA+lfO3Tz>^&wBi&xLEA^cE19wC8}KD@$ZM`b)q zmRO2@z2qoy)%3?ke;Ube7jd8G6%Q(}N|_LA%`oIm%Uqh`ns3~^4oj9IDm40_^*#I> z+uGJ)FE)Hq#>(8bwmLH{W^$gjC)HwYW(*dvR@zGQRu+RPtrKdr=$uC(SnM#?;l*OF{17!&*cMa-`PBsZ)0+ng1TcX>g+N|K zP*6=!un-7g0-*|lg%v^inxHO1peqC%LEZ3BVjZfU0RPDOFZK{ed zZNWq{4h>g)O_nys*NSRbkGnu-Pii3o2}xgC9fhSBH-WdubqBhmQw)jZOG? zaEQO(*Vq=cf1e6sAXFi+uqIev7u-b%bcH}ga5s#N@o2}_ zf(qN6gPrSQ@X|S-shG=DgfXDvJW}z0MKg4xbNk=Z678kM$EYQuMV{ghPFwKFhJiEY01x)Mu*ETKS!#`ubBR@=Z%fHY1an~3oIxy z0BQj>ik|+v*uw;WJ?-3*l9FYc>t1WDJX>1Tv92_suC!OjJFZmQ=3J@1&hA*_>2q0o zb^HsOPD#gh@BMUIbNP;=!gkN)d!7p0UpsbP-cP4{6_2InUF@mpEVi$8%?!#|??;V% znZvnsbv^5kQ_=lmk1N(sq}q%VG%W5K-eKqS>N1;Emwo;h{hT)HiKdM+Vt)$;H0{3y z1T|Rlp93{x^;6FBd$bX!sp_B(z-!kgG|*uDDn%*i{7>fZS=>DsTSI9{L8cFQwo|Gp&3@Xu?`f4X4URkaz;rkDQJcu@nQ zQI_W}bIgelji&$D`6bV_{CMe;J(YLOh@&6eB<0s_9BHo$3JwV!cun+xp5Z+rBHP;f zwD}-E|A0V!m#*Cm#<1>fy?VFxjk@Y;A7X8Ucl`}Fj;654UcLMDH<|kpPie5Y;E~io z@*})a*Cme>Sd>Oe>KH53=t<#2Vg?Nc8%}&!cY`q$Al(qDcb~{!S6$sViu@>y$YdIm za?{w!lP9DM8#^X-*ns$XrkDXmgGQO8c{$lq&f;t-*Or%`GcQCcz~UCVhe(PzV^YT` z<0wOBOdl2-mn_ic&yP)>@mO9_&}{)3>EFCQCV6!J;OBn4_tOC_<3oR2_EhZ4RSBAx zzJBc7&HsGws}CO!Za8|^jqctbt~p?NNUU2dEnC@#*Z06_9Huxy~sWhfrlqdO5A&<%L}!y=$d1ntNH2h{D?t6uC%`W z%xA9zrmyc75HU6A@P-YyXV1*ensLL7!ReOgZhxz~#yacPi{?iUKRoC5b&nsN{Lj>R z=PI5(IsDCkB>jEXn+cVP$Jc&g*!kIlwO zWG&eB>Ze1@-%kCaPv)(I?s@EByrt#ru5}^z-P!p1so~bYJ@)nWe>E08+;i{?!%AZN9iXp z{|D|?&E40mxcA11J=dKf_X`WAp9?e0KQ!sLXYRUn#m`UvH9BBr&-1Mxj``rdzHzsd zXWv!+y6%ptrfttJw%tGIch@KKZ^$M@jmA~r82a5y*SP=r<^8vf_(uOiO8+14e0Xf{ zXUyMsopSS4ITicX)xY@Ans58QcZ21Vxp%xB+UMENM;`pg_&L{~(A@sPw2b_lHgwsX z`^TZ$VavjXn9l54TlLxGcbgLadYAvASGUI=?dkVn_{>qZPa};{aowJXxTV)m{Vt^) zu6y&9)#cGar?+KZ$eX(3i0hu}lB`WL{&MxBt!?v;8Qzl8pZab2$ECV|eH47-$w$`D zzE9gSu`Ir5{=a|Ta_<|brayjsU~|$t*A+juWK#Fnvxk4ZYU=}kTm0ICgMR&e_q7*a zp0%BV_rvoci4z7d7@d6fX=}{i@7{Z0OkyO58T z+>-Uw@SqoCYL_+bOYE0C@9L35pSAom?V|HN`#?Ge!OO4wib4(e7P==b;|=G=e1_x)GbUAp(}r;~O~E?>Oy zF5R$C9~*ejJG1}()0EyfezNMS>EHgm=#D?~>dwUK-#`4ospZ=z-nP~_HuBdmyB6&@ zdvaEIe#MLHoy4Zl7#zi+R_FJ61<{w}wic_QbVr(SsSJNvLZw+%^r z_U&~y#b3;w`Piu7M-3~Frylxo;6H7BZoJO1`{Va3PjAqE8#45&+9eyEU3;&;Idr>z zmGRzwU(NdbqwAZ){FcqI{PpFSTNg}y{m5If?+)JC?O;J$TwYL?6n*rMJ>QQlE?Ttq zZ$C_Yb9kfXUjx#s8eY2l_xIlTZ0Vqu{OVCYNkFK_$ih5mPredhZqS5>TgaZTSFKDi_G*^&R4bK>@C`5QL>QM+u& znYEw2n{d~n?MMB>M}2CHd*YU#E**Yzb@b`XydAFUtQl9g&NE0)Eie67@X7V}wUib8 zd&?Wsk2k+lyrg^f*IWPg+MwUBeR*ZTS4-c2&bhI$;oS3ygGZmW{(bM59y?dq9p7E^ z&-+K{Q+|B7x4G-hIs57#`u07`+_(FDesKKtnh!E=>XLhCSeR*7)#RqX`o9|6^TV08 z$f#}+z51oqy;2^u?ZVU}_mph<%cE__-b(-NW8FtLJ~CT7F@FBf_nvxuVA6GuO?rL! zss|Q7`0MVAvnm&k+cO}w=6v9-KZHzJkoJj=hIY{@~+RSa0MZf9(+w^TM%bpZl$cGx+cn<#cW)_+U}(Zy$A?H@(^L z^ALO4s()sk`{vm6p?BUbP%^Lo*3jeN($|L+y>RCKdsY(FIA zzqlo{m8Ls-(XK6hTi#v%t@GNoPn^2x{=-F2{A<#X*;|UvP8l|5%X^h2EuT$Y_n0!m zEjao+KgX0slMqacismcBeDbQNBaJ9%w19y|BnBjXJH)wyJO(HIz2f{2%sHD#6QMYD z+yg~9qk`sF&}^=D(qRvdW*(m&vl^^8f13~QTHw}V#|BzwL1e1en0muk)8YxMdh54`T?qq4QmwTjiqnCRW7nW~2wu3~wmyWHLSGuuy zLP0tyQsE+fyo*@pHDi^+ukq}X;zmpj_RPqEJxt)~qWllw_Q_;!i-g~87?m-1oRlRy z+1xY@X4;E6ftf6Pv~&}fm+c)deZuW0yAwQfq-FOA>3%Lxb5OC9wDdm5m(#mJ8pq?y zZkk2YPCB-OfYLp*-2qPLwE}|NLR(o(=QRVI!bz)k(jk9J(s_0emwk0?XNh(R9iO2o zd~|H4zi<(LV!H#J4)sMzIr8t`Y_P4gMUq#jZUZyzrJHw-(5 zT+7`z0w_$nN($xep^C|yr3RjWgSiJtzo_)NLFLA8h>Q+mo^F^li18Y3W_U?n`>`a; zvRGo_y&nsgC)G6E#1vQ4PnIV;X}ZaLIPv{uz8CS)G9N|!0GTIIT5m-(7MIw|#irmN zO#W7#fQ8Ug{$ zz@?!@GoYEcDDKU;&nA8d{(v%ZX-GlPJY1S#jFlD;Pn8Iik4s}E4)2_}G^7A%87>X4 zGxT~(`@IkmH1XlMv$_GE>_>3qPim7Xi6@)Uz>Ihk?rEGSl_qeWFcx#(4|htJ^}qi1kRKGlQ~au@8mq` zzmoH$Cw?Agn6tsJ=X@ska?Vp)k8yq;_{TY40N%xUD)VPJzX1GR&O=4EZ<(VGib)?>S!CQv!G}MV*kYe^SiEWosxHs`DOcBcmQ&9@`{$_EyP{_y#G;S%y|Mm%bAF-YUhD zTnEX^0@A1FKL^+@=^Kz&rmQRCwF?TJX;%MbnwT5`b>K>xDg;$an?$u4cME~Yb^VqJ z<8MltJ0?A4`YnGV`Rv>*d}IG}8hB)Rqbgb!o9IavDkLZ!@k&RW$B|vMEWX`^?8FY| zqepbYe}bMyr;kULhx%ZAaW^05lP4avjObZRJRSp#=((gMdUg=?f{0M`_Xt!;N79ZTZ=Gy{}UweW~uPpz@u>j;n6#Tz@xoTl=d5n3PI0)K?0A)V#Hf{ zz|aBmc#-hv)k5I8RCuF-*TUn_P2fGQ!kewYqt_FGN9SHD_0yxUsGI}|yrZi8J^;LE z2$6nNegf}B6<#mkRSGaJN6sB8yjlewhJYSCJAjq?)dCO0CJzby?gm4=m500!Jjw^@ zNAGPEM(*3eDDmonNAK@~NRH@MFvMHQ0cr(aFWd}Q6X!U&JP2`KTV!c$-%*uy^uAtl~C zg?|0H9O0F!@Mgf%K|q`Y_Wdfn0tFt5#-rah@JjuT18=1O<8tJDit|=-fYtzy&i|wO zat$t#U(!X1Hx-=)ecurz^t%Th%KUx_kOZxaN3XyF&kcs~5X7iYg!*S!+5Zk+55%)z zBIK-c5c^9QCS2lNVu4o*IT!o|ksMJW7~+N8U^KEA79#%_PrB%Q-0%}5qM$jj=t8a+K0IX#As$9fao(noTM0Q|<#ve25pqH3qoN^6(FO2_4hg2>rlk-s3qv+}Z} zPqJWHJrGLcDMc`d1($_ylrJ!7O>c@E{Zq%M20YAvZOE&qiK z&KQistR*^0p*2Wa6tX5RB2nv%z}Y)aLvDTV!u`n<8i+7BWrkwqhDVvcyVO)75Nr=VSYct z^dph4fyvr{fs(T(Vw?ZA3VraVJ{o;*SCz5VX{>Rbb2$xIJ5-~U?4?+SVybKk-44!? zDmfhyRT_N=7GdoRan-mT6T3z3Eqe~@MpBxa_K*55B3TRks9?lF>H&U|^VpiN$%rul zI8DhhE<{>0Dj-;bQKAA*HL}TzS}e3+$C&LQ)nv8Dp@#?|o!c&X%4nx{O&oHYlst6c zfI(3>X)#*g%YMHhqZv~SOZLp#F>>>SQpe!F`azWT!oIT6J^99&PSDGLYNcV#sEpoS z^j#um==2Y`D-9VF^!iCSH6>%awz6V;gEnB8RLhhvbEdHTTaasqRzoWSQZ>lY&MxDk zC1>44XJy6u2JJYrbV75$=x9nVG3(Ej#6|@;>xMWh>2Q_O3i~r|>*{P&4qa2QbSzYI zw^*7cNTE3LGO{XT$EC`;)m2q>rRxXQ`#CGtS9L$d&bZlT#`z%u%p@7-HLK$b(%c!3 zoOf1K)@{?&8`oF$fFbLU8EA=L)xcyjbwy5mf_iL@Cr6 zSrxe>W80-Y>ju^bIPb4~Wqs9vDBZAtMO{ucQp3RckNz#Xlm0h#LnS^LutKQFcga;M7?)(tHyt}!O#r>@R_)Gxj0cM`|QA$g}MH)bLHX_4;tIwqCTq({A2 zSELW#ytNLRG{$VE6@6I8S%<|vRhufms%xY(fwq;i^Fp0VOUET^2ENR7i>7Mn(F?~C zu{NF26p;IJFs5DaQOXWKr6Woo~lXRoiiF*uNBZDKIIJaxt+gnF| z?kr#EEGc&u<8N{Lw9GU&W#s8^^xAPj()dJeKn;#2fx}Ni8Cm2)9l+W_PG3kyg;E=) z*}a}cFeqZIgBhtouN71>t%RLWR${E#pIo=!5T!fT7<8)94>@e1Na&^NB*!%b?3mwo z9F~kU232Y{JFy71CWtN787GCNVU3G3^45&Cmueb=kRa=?l*zG5Mg0_O+h{Dk1N9|T zmqulzOU{annE~h*(xu9}^;LgyHbvB+I+xLO>7IxS0C+9jkLZJJ~*-OxcPg^TgD#t6w%ddydN3=NuDAvlc)a#XUJu6gmut| zTnzj^;3UpOip(-c6`K1v%)Kkjy{gJfidQXlG@^sZo0iwX?hF~r=;ZaR>{%(dJhq}9 z$5wvCAEqR*CXCvET;=`~{pB-d|6JLM{QP(BSi9?Rtz}DL^nO_``!xRSr%fgFm<>pC zpLYhHWG4}aX!JcJruVKE6QajuN%{zcvnlirTNvsE4%dSRR<_{7+@SJVOD8m9hl^^q z7KV*6@;)zY%-8!xJ%DG3ACkywoIF%d&wubEk0$Fdqn;(mnmUfPOAku5jV-jLW!c7z zx~tHZ>M(~b2+Fdho)D=9DrlWDP!h0RS4h=Vi}eaKmoE4``RKsJ zu~_^l_^FfPk&j7E7!d}bJ2DqW_b}&KN3*HqY-H}Z?X;``tBgcZtSlaev!+GXp$RlV zAeK3xllOSzQ%I1s(l+jwHY;Xqr;QyqK7GQ(Nt187c?zaZkGW}-2_MRr7ntNZ*Anv^ zmNNDhQ~v?WM`1;B$Enzuh=p0<*I>r?kfFndUu%hti%%Gln1l)`#>jZpl9cnk@X1D^ z_bm3lteWrEVH*>Rs`mCr3ynfd8ecze# z#`B7gYhTo9w*UHSpVf~?ee+$*rmsS6ckMXwbZY4{>0>JXXsoT8_CK+2nFH@>g8nOW z$V6Pa)0{8yEvFW4E#|l=spFh2bvRzy736CUR~PC=~-cG7hSr!Oh( zM02FZbG#Ms)^?cF#3zjKC>`fK@reSS@FeM|Mt0;gyz6<0eA8i0nUXrrLAp^HjQos| zT)cd!K5C@#(!1Q9$=p*t=NVC5)<{#N;Z#{cvioM~b1pBtCrjtO+!LjAE>CSlgINN* zy}~C+ckpm(3mWMrg7%OO`Y1`qW>U2K=-8|SrF&w#0~`)iR=Fpu-0Jjb#zi~nkY6Ry zxn`RcFU@4L67Ht&Ry2oekgh!jh5tYeoD;ceFJ3|9rgkrg+#&~4!PA^CyDI)rZa;c; zra51{Ixq-|-@^4-z`~7El`6iGr%%7>)0{B+{`G&@dlT@git~T`oSOs!Tr|NLgMi*( zP*A|IFG9TmL^dlRB3hLs5Fp4BLl98V5D_i`G(;?kYd~5Sq2g9?p$)hIiY;z+rA2Ei zTD53xT?*y@`OI?eoXNStw%_OX{XPHZ_ddCqcjkTPGw-}JXU?2+=FB1e89%NGdr#?e zPtR6PwpbTI`7$Bz-JX5lMU$H_?NUcuD8U-1Z>)6gbN zXTIKwXZrJs_xz@85M?RMZ0PClcJYKqo^q0_>=F9Phr%}H!%@)5;6o=+K7Qn>d%fbR zOLEnNJK<+`K1F&Rl)zW(#00(?K1JPmfPk1yuLr}ezQDC`gH$>(_{@%L?v!zZhdDYe|-t8#U z`;x~!OcI+!`y@(!2>yW>xWHsN!^o@pj#B9?XEb@<*aVHkkNPZ!^~&JAXpm@M@X6ps z{{&BeaLAxe7$G6ZGas9TJnJ%4@hqC}evu&%?E8EKI}wkPJjlY~u-*oe4AjI{qazR46Mb zomeopY}!Puv*G$J%Sg{_jp#N2{egG^YMv(pWTxK�{)CQFTnYzg$z&pj0JnY>gg# z)!6bpE%sLC1$RNTOc~eUnSI7?4o{&$?a{yS`LbD4%ceDoVQ6{S@&GBGHD&fh@!`B1 z3TDj3(mzWsE@R_~^229bVP`LB3qHc8z(aGUHBvpT;M+$!(c#Koj5TUv0b;?d$rH;8 zrZxgCI(@Ku13w0<>0aUa1Z`?-o@ni!msk3GZV6Vk>IHiZ%>UNXu|b%Et(UM3RQIU00G{b zOCUk_NFd?I`4Xcww6g$xjmwXH#{avk=3*(lR*X|hCf28`>r$rTlqTp|#cL7IttN5a zKq|*I81tBVT1L6%Z-O5AC=)^BaKa5U#EFB^Qjk8}v>Cf+pQ>HfmYB8@l6>MsLSJ^`Zi$aBq-iC1pe$7L%TZ;*u- z1>Tpz+Erya@&#FO@akzbyO0Xc&!Q;(ce~Ed-uEe$O-TUbFDhfR{%gMH>4R3omBi z@p50=$M--@|BVA)h6Yo5jP`>b^F$c|tpT3yFXtn!@p3G@X~3H&a>#$$zB4Vn0|s6< z18*EMnD!k?;J-_uN9?F9#tCE4)BfW%KV^(}vG6`h;J=O*UY3E!TQ(Z67mPFQ>xh#n zWtudf3nlVVCCD-Gc&kL?g)O|!z{^v47-+nv7GAD_$6It7Z?A<{0=%H(<2eg&0Pu2v z!{dXu(lp*y3vVItWA%7FY5VqoH}PV?beKV-3b9W)I;z=C@f}Us%XrDgadPfAEcn#xePIZ#rkvU21$ed*C$ULYbDY-gH@93N) zc63fMc61(Fk(64Uq<4f)5<5aC89PE3RwRY1lk|?#Nn%IoBx6VE(u$LhH;E_R$w zYQ-I)lTL~62whQ;lu?~@s+MO8`Dt-^bwyHEby90BKV8V%#O3QNlG;`$wbSx5g#667 z{87DR$AN!_?>>PyUORy|K0JXpzCz25Y6|D0`M5$X;*~DeZDrotqN07Ibayn|WWe{! z`e#pH!>zrSRbZ7{EO+`{6~nQ5Ez%}dQ5b16W$K*=hqia}d(^W%^M3jIrK?hgyVJ)l zPoF-FdxUT9#&u`0JQNe#-6pntH#Q2ti)b6wM&TReM&WNC9`t;4>KNwmb_(JY*+rU+-UjVanV@5CKCIya(La6-0}@iM5RRq z)2CG}&BX@sun_A_M+_fvYsseEy0RytThdEVpO^M6&fT9|KYuPh`%tnlQn_sTm#ood z+Rqwwi(!9%UBkB{u`!ja4k7=(qN*+F_$bb~FX6)@Rfkx=L$#5^*MIs+-7j+MdJ;WX zpnpL5-nr$q>Gi1pu21*XArAD~^tw)w@9!CnPgKBH!nf0(KD-*c>K{7tclkw$%G>Ku z($~Z~GClJ2&o{q%2raQ=Zn@B|{67DV+?h@1cT>Ke5Q!C(FUcJkQgM8GVBOO@wjazr z0P7B>V-NkiKQF&Mw|osfgQc%e?>KNzF1Fi;W%xG5r=1QjF0aTfe~0xxFf0;#q(y9e z>Y=yOV=XIJU~yEe-Hunuq{q7K_<&5S*ucu$D+*4DU4nz8AR~57<&uhmQ)4qLZ>uQC zj4i6XwW8p(*s98v6$M$b`*wWEEUjbPDk~}qPLJ)ZyrZI^P3)D*%8G)vv4fj-k!ctE zymDzp!5Oh*mCGv%&J3sS&91x`{kU?=rsnI1JE-@g!;{bt9~~a5+myF{xQkEly!}2q zx_`x~J@#@q@4eVvkXPL8%Ix9kV|QhYO1>WJ?ozM}uBlV_LR2h>Ys&SbdM8>8&;=Z& z#|$dyP!V#fLwbx3i7`54jM1wrLdn%3Jw}Jb7#%Xk=yesL)asBPqeEhh4jE(gBNd@= zbx4oVAu&dWj4^swMJTO0q{rxx7^6d{#K+KAD?%C7Aw5Qi#26hi#^?_!LRr-zJw}Jb z7#%Xk=r1cmXI6*KSRZQpXsF%Z^xXyNa?fS-XYWfKTpQQunF_t3@xdAWr18-iJxDbJ zTn^W7OWBdVx7*tsLh&V-Z7FCeW4IP)=pXv8_qrskbZ#Q|_g@#@yL>g9c5%hJdFGzO zOv~fHZtMry$`SG7Jikv>^O9mV&i<=CQ8O+0t*AD72vOXZiF|OBOT`I#etEIv*(tT%q{C= zZrJ)m-I74hO^_~UXOu?qo0mu}LGJ&T{6FS_yjcq(bLJM#ES@u`c=oJF+3ZN!w4%uH zi^dI&V26kzY}he5Qn)}Q4xT-$thBgrZrSY82sVp|l*}!hQ9P-jjQI-YL<(lih%gmT z7bCN$L<(j}l;PZGV^&dFmm#GEQy?jgj2$`{(#iOt=rTN;nprffEHblTa#3VnaoMzD zSOF6zp)@?CHlYe8l@;GmT(%%mJcr^r#gmIlVIE3qFAVk!ghlPUMlPE>XiyUKE9SM_^KRai3&&hBY}LG+Ll^FNdqkhb7ee?Bku`d7A2THf!&Yb(z<>AN>Op1kR$ z?kjq=9dN^y%U}NOz%46g?C<~Z1N|24JFidVXzcyFK3}r#S1I>Su6^p*`raQO&e}e* z#dG(bvFy6m7yRq;;<*>bTCJ?F+;Y#PSJ%xh|7(YFZ)M$^cjkoRm&U%ZG^$f|G4nj^T*0(wErsme`9_2m&Of%|9*Y8TDYgW zToRsAW-5H{Z5Z<172-2a+?X&Zsev2|p$tmG3auh_4vZq*#d>V6JtFablZ(5LvqTK* zZc(1=obBvTaz1}>vC{KJ#L4UURX+W5R7?g*Vz;+=Qp5G%IdLJlhU>x4w&dqHBMg7@ z-pa+wzP8}Ge)v5l$E`rbo2mOEj?)Hut#CK0PU$ZY@-%0S(tl3GGf>Ak5&v5iiqs=)9zn?G802Y7f5o%jQN<&0ZdW|*dQ|bWcZcGMhc5`E z>!pD~tBTYuM{gxygC#Py0%t+q@)fZrL{8KFX~nZJb62Zo{L5X1OjTG!x42BC@ z%jPW-(q;aDHEmk8v4w4xj$FwjT!BSCdKp@|+nDs?zqydBxX$rKlg8toVQY#F%(*8+drs=ixnK;Z1-{4dDV(+qc!i`^doKn5*q${Z0F3AkHyYlg8t@ z(bQXrIM4T*v>wNC@=+x?f^s>QvK;zXm%A2uO}rXJGzPP3zFMV6nFxyDB%#}lGdYb{ zX5rn7IOiXlG~R3rud{*2dTYEDmY=hfKW)6FmY@3?cwjxeX%=2v#Glh(N{`V=7Typ8 zkLN#aAKw8)RlMWl5aRT`CS6~A3Q^>VD#2*r>2oJf@fz=Mmj4bTALqlGG~O4M|E3vu z#MO9z1#jB-5e^ECyJ1C2zd7*B%WR?$o_aUekR_xz^g}^CXL5FNj|Cs3vuvj zya>`LBc9&luRD0s4m2*;qiAAT{9S{840Tg|4817gnkXZ^Zt0zaLBMPetrx~%NFLP` z6osBW9-s(k3Vzhn<&K6PuV*xAys=0y^?roP1?im(CF*gkAa%y#!^x5r|0(0I1Il2i zsS0`~X<0Amna`KAaPZK#Y&VkDOGbSSvmN5)sxowcX8q6a(@#DwR{u}GBz|c!JDV$k#7MH^evj>JC({54UK$5_hB#wRY7&p3GMKT%(aq z=q1Re%h)OR_OQ^T9sG|y8^UV;3~FA}Jo9p=beHpD2LFefj7njVO?P6W3rI!r*oFlk zJQlj+-xQl1tcNP7tX3E>8|t#ERuVAT;*Wf zqV*4N<+dTLXNbm1(UyOC6~HbwEUNNYxcQ4;ACI>L+MN5J5@Ga%mC$nVnvpowi_1t=KmvmWN$Z#$cC}AGVVQ>arkvQ4{Xj zGwp*3ulC&~e8o~0y{w3M)&BLj}@rO*#H<*)w;r4FmRU!9F1ix|L?1T7ie$1q;Sh>}rdxaI#UEbZi0RhT8}%-_{^% z6Oy)K|CvpEz?1o@;jH!#Z;9_hVz%J_4By*LUKAQ5A4%c6fGrNCpsf#AE-n-w@!ZBe zL)e->huwlbQ2F!txPhH9SRX3wY@Yd$gXc_FG+%f8_>1X0Mk@;DRqVpIjc=&fl~z$O zmz#Xtz)e2pp{uY6?(Y%WT~~^oH$FhozeTHwWd(qGnNS;300n#69a+CC@`&R=wEziC zoXjm0Kbf@7ah8Vh)!8)I(KhS}&JkaAY$EG{LV!!BJ}I7kr8pWi{sgSc=-D$CbnB7Z zEB+`3W06gTlF&7NG;KhmMNx#N2WC_v5)Hs<0kf5&-vLNGPrJxa6EFUcG1 zd%jk_xZ>6&w=G>3TVAMk>awhub;lE z=j7Y--@9q)!_Qv!*PC~5*!KCDPP0<~wfVy*HunCa@OJ}$wc*;8o2Ry_`2L^8?^c(t zIQ{zHH^0A0i%u!O``IsVe&vGR)dzRp(q-O?l{HDf_+!UrZ6!OMmm?$b!t%KWK5~rOiH^esfjVmk;DOS^d9p8yV-2 z`0@7N-$(XOJR0unp>Bw&B7^qvn9mDO&?5Z)C-(8s_mv~Sb1{>uMMx^e&&A!rhd2QO zaenDypO0Vp;@zFwgjDPIbaIrxIRA0QT{WeE;Qz$8k@S6WmP#AeyW}J>Zm$1locq?2 z&cToOsaL7`F^%$hR(zt0pDXm6iEo)umqdMiJ%CGC;I(x68xuv!GcCOKmb^x_FH{8{ zuf<5bc5daQJ6uDriFp4~cwCpvZzFxABj^7el|DbC%LSU&OPWv6ep9 zYLoapf!{(}ZIyqGrT?zbcAW2peispQc@YJosro)OuLtz~ZbIt&@2nGf>he}GdFqnf z2>yWtPPXJtoF+)p_v?9oL+^djUhy8zSu(FESNV@AZU>nz@YTI|fq%A47smiQ3W#>P z9R-VCgR)e=r&)Tx3)Y@IF@`Cg7$u4)21)M&AoN)YMcO~Y9(Fj8X-_A_^}ZQwfAZ9w zX7FbV^S>qHRfJvs&`p1Kz+ z-m_ml!w@*#Ap{8=)t`l(#&Z|lUc5BZ&q8=T=&Jt4Y%VaFB|^S6{(*Av)6YU^qJFMJ zcW5878qC`pA;%b(H#$Il@pF3!R=k5ko$-i9nNG)phTz9^j`hRH^MC-2!jI{TiJzpDV9Mw{ya|4XUff|f^%~qX_cneb}Rl_CLi5zJVX8 z8t^bc=ml(!&Fub zOZAFXh{oU{o=Ex!jskBNg+zu)>nFw)Pv{w?YZN@QV3K-`hP7zq`QN|!$j|AIlTZ@I zV@)^X(#iV{E)rcOn5TF>ZQ^;sB%Z@ai;;nOOg)~vG-DI3e89p~X^+E<4-Wtud9HWJ83m0$w!n4k86_3+pZCf)|b zIoH#q@u*|sO*ZgaDjD(l&b5iR18JOtXwrD!L&?M|0UqZJw2xQklo9V;3vWNt7UHK# z@k2ebOAp2^O&OA~4NHYxkIDgf63oN_|h%Xg6Y_8WNFP}X>}E&F(F z%=x+|jW^x0kKf(V^*sy98gHb9mxK5s4W{%M#TLdQPm~c*Dh^tW*8y>jcMd9R)^`K) z(Jz{`eeIz{KB@$LftLfG{^R(o@s5Hw@wNkx_b@bRyl;?T;$3av@iJB8y$asM3qvqY zgDE{m_bWci2&f!*w1xJaho8pV4Bo`chk*A?G*OSV0YCCl{74INO{DR-}CRbOpi5>9?*f7W=T!H{R4Bb@@h$&wZSDdTT4fEa3;$CIf+ zTJ{d~%xA>&angW^qJ62Z^|&{RwvFlYfj1g`kn**Q>jD zo_ykWkSBCT0U$Xi>gdeztdr@z#e2lnc(_#@Li=oLmU*tb;;Gfgk8f_asl|$CM%IoW z!B>ZnfUkTs3%9Nw=42no_aT@YdGSCcc6zv3CcXsH{G2wYy}TvXJoB)#;_3A-9o^e} zTZ?n<{bDHkV6!f%=3`Xk$5iX$kDt5$I~u8Gj+wkI-WGX`>`&~Jp02fMva0I;$gR0lyDC0%p9AvzI|HejZWv0 zP&<_BZ2Bs*(v5{;S>>_0)pZN;$qBfoa(OH@wgb{pBNy{|EI0x7z;W-nYx(`hkBfR| zCMAVKD3s5q#UroSDGi`DWzOdlx6R*VRyzH#FMKvVF8(==#1!31`ahg?Mc)arP-fqh znk+mF+x}GA_-CA|>byrEtlwUnc5&^1E87om70WvN)Qs|b^TOZP)uvVNI~MN0v0rlM z;b@%B%}_iXi4W|o!>#bjSnA!eSn8&)%m?5ovs{*ouFEQo!tWB{Bl{n0iiu~6sVQxn zUHnu^f#cwbU@QxL3!fiZlsta3Q+{V&+n4GVq|NKu1-?Tn%H3F-HD$vYo4yij1jK`4 zJT<19mnJ!9Z)maZ`0(nXJdhTey=_|AipR2-WGn+U0 z$8q5B>G3Nq4z>_UAwx=Q$-CtLS8ySU?& z)`R-2xpp`-8g$GoI{U?zG<@jr={ggJLp#z=q@0}d0F2A#WQ}@hwPr|2>hF;)QR;=Hf0W(2TgL zv5cYe`&g6yvE@y$vp{wK%VXK)L+ZaBQ+fRDf|~TqubtfIKODc%#qm;u6+4)^ZEN}B z!Q-*+;qaa;_m!mjvici;jgkk3zZ=8yssU8pC!=fNkl0asvgzS5vgmieiZ!_rMQUbsr53^|2PA^k4Xm5`DW|^>=Zcq1R;gO%FG#O|DIei9t~HyyP8&G9Nm*d@DQn z(`oBpKK75w?A>*LaGFQ!>sF(0*6&Sw_4x6(+D;3%t$!(PTeHjo?$Yk;n{`64t=U`m zhK6=^&OWczlr}$#Rfn5ztO*T0m)-xxj-prgtm&S4<-c}(2+2K7%Wvhtwj*tCH5^3e zVEn>Cwl{4@`zB)T!O}L)wq`?5cSK@M_1b$ch<8!d2V`rZs~i)nciv4xL+o{HLgD7C znr9X}vDV@faLbclL{INtzC1GY-QzW(*r3c>r>1q=@9UmQ!;l_su}v=s(xU}FE-BXi z;9G9)Ygk3aQ=T`%&#P{Zgc`Sed0KfSA48nsb2aYM`8?m(aA{cPC!rdCMFyu5{NGp` z2@mVjHw%LDTkB$}%Liesl3aJJuoB-@k>`Kpzxb5Q=&ki5;K@hpj#muFeiPeYN^4WQ zY`|9>Sy3)@Si+!|nHeqnSG0&#;9E;cJ5%ehvA_c+?zw%!`!V((TC9wEB6uN4}^p z`6BJmpCgCq2t}E9*DF# z_|~24S2bJsJ@$XPf z9`2U8BLywm0xjC?KW@<$Pc~@Gx`)}AH5)g34JeO=5$mJR)r*M+26Ztpko`B@Y+Ez- z;jzh?ImxxjnRh0&s95;V{(G^_%E4w<&#eD#x4Qk2x~;jn@1`A2-j2;Ue!-5sIk`oT zZQ=2E9<5E$lV^#&DwGZ6n3Flq>6eUIiCo>NkJo%2r48pJSR==I40A3BZR$AX^!7M> zF~)7?;;AR^&fN5ExW#K?PccN7N3R-BaZQbr?qg?d8ao=ZcIoZS=3}P z7hsAL?$VDqBW&{8uH+8^fVo1GSDJ`g0%qPf1chqSQ?B?j80Pxd!dTx(~BYeJwj<7j6aK-8Q;3QWA@dkGY$^s$E^{qErk|dulEXw`g*T^X|rt zPo=EGZLl+)?c!=-bK1N2pIwaQyH3hZZYOb%%u3220 zUIU)bSO}piuc2TR6=A-Re&k*CP7@Uq;xvv!z%TnTp9H zPMay1A*ARY_>h=G-rafogL!RV#z`E0d2-ErQ=WXAfS;_cRi&eB0h0Q8lc8UT{VqN~ z-oSUp99f>%)SNx;zipvd^BQp~>y(B~i@wS}ts*;9dhZbwT-`D{B~t%lB=gynY;{ex zXW)^+V?ODI zwV>Jf9AG*=2T14p)`QMCysXu@c1JdSzg!A&Mt-s;IoyILb$($_T&d7A5_AC? zYxVTfw~q@P+1-BF|BL37aLa?@DUnGt3a~2jhN4oj%>=ew>(;efq~o-*vXVLd&p&@E z_I;RJ*cA_n&o9zh&gYZLE+wV2r(@TJuF!};)J5i;*gdyBN_hBbV?qA6&- z-fVSK#)XpWOxLO+OcGB};z>#3iG>-*%^rjPll6N>c05ly%Zws^jukhb*zoyNS4*C2 z#r54knVjUUM$>Vwl!#N3c=BP!qfU<|GJYn4kQ0py!6i9)R(z26{_=;Agq%T^e2Bxn z_(*K2kXVT#qT*kY*uBw=4|PhEewENi-#3Wg$$DPd$6H$=@uVQG5cJ)w4NCvFLVrYD z8C;UMml01&!fL)ZRr#%i{*U8Ap+DM+k8yI9{uM%hj3wuar8p(wj`37w58tB-`R*Xo z9ZuC?NYR(y&TxBK^XmVBnu2KOX2rGasq>zKShsrTk#&*A#W*HfjO zJ(2J6e`@9bls7g(Qr^<}Qt2~|_{)?&?;>$M+F&l4WmiD}KbX=b#nmxS@&VFI17e2wPzv zhF>UsK3i*rRZ`Dc`Da@G{hbxxsp8j&{GFZUmj7f$Gz#*lH`b-wzt#{QET_q7$fw->mu9%Qim?q>qeR4^56lPIHJB6%Jh>E=(V3`E1tS^jb865@+y3h zSJ@-{gFZ%iHub?%&gWrzO(=^ePhB&w@Q>=h9FO&07NZqU-7Ngv!T1N_a}{@pV4Vp0 zizJ^zeyHR-lD}B;9J=+|QuYU*TISgIG81+s@<(3=;i~od_h_ z8a!`sg*JixtmusuWK%HYz@X@KMFn#)FEdjmH#E z8#pc!lRWpV(fllf=X>EgeXrt)^Occ46UV*Qfyi+&Rosb?bt69jx~vcRuMi4>7qXcx70>cX?pPU${>g(C#Pt^ZW*}`4b>u(@5_Rk@d2tNVSP;6MlL4Ok z!hZat&1a}|VsunIG5RQ;brEAlCK%1LaLq>qEB@&*P}q5vOc(u=0~<)#(@FBe|CdW% z_?ev)B=p(wK(r$RJZ(N*@wE9I#WSC<6FRhWph{=HVTxxtmnoig6uwer313Y>A}9wx zSJ^{9xN3YBHg}@ykQX^-$5c$Uj5F`aZie&lHc79LEv5^dD`l7fB|91b~5M;Py|2n#Nlb4JnK$#$^34!r zksfq8<7@2~l5WROFr}8KJL0gnqV67y9Q&o;K{e!GhNS9slZCPhn#54c6Lay?9ry=-@j7LWlVSm!3-~u}oesoQ|s| zuq=Ugkd5a0`-wjcSbeI|&<+BgQ9MUiD1nti!*fS`4ZCTQ_l3Wy_+(t5fZwt734&Iu zOD8tE8I@0^vG)+9Vq@Pw1=5(Dix1?ltX<5C%+RMSLTGo3|QYU?ht1<;KJgZ}1Vv1n&lDhgqL|Obm?T=i*zB z!EZT8G^v91LpMfl!c-_2-b7##fEr=`XWRYlpQ&Q(OUJ20eO$dvE z4hNq?f|gY}8lDa4%NB$icQLA3JS*XMCv6w|v<2`~H0g~+rL*TuEWsYM0!rH%Ac|L% zLcAkBksrQnB!2=GQ8Yh$m_Qyche{T{ul*CreO{xnCD%;~sH5lg1{$7;{)}lr_yMZODAz)_5lSsIew^@Ehy2SYE593rR$X=>s44V zr)c7g*|V>kTLM=X&d^{%r8f3nl0@^peZ(#acZ<=$$Qp#qbBOBp6K7%vjT4UNLE6gW zT}REquHciVbrsd=YSp(vNw!>{pc|Qi$&px?P?Ye)v&tbjWzLzVRlTz8j%U15733b- z9~$|}t=UJZrVEPqFY)XI@MKrIwHMPP#eK0So6yb6} zP&NLO$E`>~Jyoa!&i6^Y=VI$|&aX-96+?-9R0+o6x*-QVuWx7%Wz2V}g%?FyU;H#_ zyb%`OeBcd$67hI#t?^#M#fWL&d?iC5NaMW#J@QeR>^u%U+Cw~E-)g*d7T!Y0)TJ*t zsmJhM3$Nb5<29hh`v8n--&V+w)g$VW-UmZI$_Qvb@OWKE``CPx(O$i_U$@)iNDH#> z5ex4l1FxllcQYEtwC^Lxg6vxWJ=4CU2HwdA-enfvXONA;PZKdnKeq5PP+47H+zRvR zdr8P|UtiTP1c=fjKMZ=NeVqYDf6;%uZ$%m7T`fG`17vxcw0)f{yuJqBsZiECE~GsjW6SVleTY=<-cUy(_?y4kry9JEd9yzEN{yfrnH-aG_Rg#!tUtgqAMtiRXW8!rNSVxtI0rf~%f*~Je1hfWt zIMjuG{Si_|ynC&2cO3Ajr%B_jwZ`482HpTDYrN|%ycxg?8pmf?c+UfG7;xx6>TA3% zXiu}gTY<-MPm{KqLyzwwGEY>=!Wg`De;K6o7_YSO z9!I@8sXPpHxl=7YtS|IrrryPt-bc`@3c%w#eWra`hJ8a-xwP+BmS4)yZ#xIz-DBz1 zss621bv}BS_bzZTJcF$VZhRA9#9v z;p0Neh&RB(<2&^eR2~KzuaAW{A9(qYb3CBF#yi!*TL`?)kZaO-X%^nwz~gy{cvs=4 z@xHYDw+VR9XfUP6=x3JyQt^;$6Vi!yHGUc|6!QCTGA3pjkZaQR9fOm}N0neZ@N&Qt z?^^sc-iOdL+hacPrm8#)G~PiA?+xH_Tqa(=(nHn6oXf;J1iT>sJ*V|q78hA8SChtT3ndfpfMMSh zC~LfbfH(0*0gvmeG-m5U)_6gI8H(DKodL9N-ob&tj ziI{Yv{mOgx?)HPjGTiE_B2@XIQnaWuG@W*3^<0 zII&&J)5TKyL|T6Q{~p7%z{EDwX+C7((;r=zwbX___pT5dS9$Wbt=2_0c9;zvAJCmsRuKH2of&>IYN4K1l$HSERzBb58ek zROeT9S@Iv(MZFgVoF7`&;s3ZS*o<;yh5p^+QRm~kVn%yb*@B_;A z?D;=dzyH1;pZHi=SM^`E`G0h*z?b3k!epRtKxmr{%^JUN6!3-izYiSxKMU*602Jzh-{rnHM)x z&qefnj`J-NF4F{IY9a`i6M{JRBVpPmh;tm$#WE20Fvt#9aZJYqaqdXMbXyRwfk`7} z;9%M;h|d&AoCA^0mVx&+R!0@@q{4Gmc%BON^sJSN^BDk1&pq|MPkoKZd+;P)yOD5P zQ4nt53F19)5^m23YNtY6UI^0nV)Qjc7nRO?h@|sn;LS6;sd#r4_E4dmi^=tlOzN%D z`>3$53j3*$_pnG8$Uw|-$qrQUAF1#{6-HHqbzFjUFJjfAz zzwRF2y;pCKr_SI(gFPM1Q%CbcXXqdVakY3?JTO{qH3RyWs420Y+3wQc6 znh7G8nZPXcqA!atfmwVBq7*v|J?>$MQp^OECBUbwnb9aVgqI_4tkD88qP#C6EK&4) zttPs%h$xSHYHWKEJrzSe7R`Vj-i=G-i7)R3) z+jFM6-#Nz?c2zhJtIzI4=;-0)o< zJn-MhE4<@Ku{1-c3Wd>zhUBHnXgSiQwUQ%c+9~o3k;V^tgR0ugGj`Qk@=RZqBhP46 z-Q|q5s)wABR`rxK(yBpnMp`v^n9M&!&Pc1q${A_ZWpYMZHBQb*t2T__Z9=DN(?}7P z6rLoeawU^amf_?y8CIMvGL+nUjtrM{lwoxz8QyuW4A-0|!n9WD!oajsTFEejPn207 z`4(r@S*OZ)PNodIpC-c|Su*U|T83j!m*Hh?WH_#^2uljv@f8`TWYQTjoP4GXD>{p* zZpp1(WVocO46DzV;hniMT+>a2X|1{oN2i^_-KsJF&gdz^s`kBPcvf#2=Jb(a_r5ah z(NBgw`^#|b1v0#BfDFeC6k$o>kHplsWYUE)oE(*5MP9nF|JFe=TryaO)k9=>=S4DH zGgO4B>5-1qPi@scM}(*3L>Las&KBvz+MgxThn>|yq!*Np5>xwv$1f36__W+87zWK30ZrT-Nu0<0Dtk=!rGz6trgs>#8XUS82=D1r{4I|)9F)uqng&3WI~UfnGH9#*`Uw`Yd*e=kd}uRb+?KWCrM|N3fF%k|Z$jt_LW zUV$X*tFKOFT9R|2WYmA|X_BLwMEYM}t!n+jmi|Rfz0dy_S#o&}(23lWi?Hpa`Oo~``?ug zpX-vOKd+P#^*_n^i50)b`J2!G*I4q2R=mKO=<|PpC7)!)i=6L#{x7oRQ>}Qh(@I_V zN&gpH^6RYlOy>*V@i^0x&$i;%J1c$mTyM$eSn;{eTAw|0E%`hvzQF0E#w%(60!x0A z6<_2$quQ6%2>EtpXM5ga=`VIl6h7}ig}6JJK}q5ZP4R>z=Qig}Uwhpa7lKQ2mRa%T z&UNZWmb8DlC0}91S2;gc7p~HtRhIk?E56!!kOwYE9>1$)MEy^4?zG}}IhUv#ZPK2* zEcse1UhAl7o9h3ymi!(oexLKQ@A$pXl0RU@*Eti^@s$oqh&zxPl;k{U#OU9jITtjO zNmBo3mVBcX-|XD&Yp>0g{2?p8&FSuIuWgq6VJrTKbDz)tM=becR{RO4+-Lt2mi$R8 z{**JKg-nv;&r_EC87sci!5))>TH}96?7|RNNpgN2kAO>Zb~(q?@gn`X%aT85#b0m^ z`Re`Mcot zza-}y&5AI|`OX>SoBw=g$^U7^k2xKD=ig(N{J0f&-I2cjpcZB*tt2POH8WuT@BUTQ zHwyyH|J|Rc2OBKbb-K9y*)Sj(Ki_@EC-3G~ss|%d-oq_s$My7kxu5#vecUJu^5p&8 zRy?r1_yz7}pM0RZ&xd!Ro8l`!&;8gZAMCDE4}zpU7r6x|oA?*I+?$0Y<-^_ATAJ~Z z?h#-768Bv7AW7<9>VE2rk8vw~@ypy19C$!d|8lpvdXOaJSGZez@+;lxKKW1FQVxt> z{%hPXeDaBIjj#R%?mS=nOme^V$&1`QKL1a3f9~^Fv3rg$ew}-(&;K*s%YE%L+x^TZ zzux`5&);+0`+feM>;A|WpXW~X`D=lDj?W)AxqE!_MeZ`6{1*3OpFbA6AN%CDy1(|x zZ*%wf{JG2>?29jV7x?_O!kysr=PLIdpZpGYlh2>4-DN)i-RY+K;&-_PK7Xxsd-(iW z>%QcZ-{bz;=g<4xTYUa|z&+C!U*`_<`RhS9)#s0&xto0QjqWs`e6!op=dXv{y*~Li zca2Z}uzRo1e~-9XzW8JASw4R~;STi0pLE;!{QHzU*5}V>+!?<3PIrXQpTBm0>hs?& z_fp^S`kXt%7k|Os?u+knZ}-Lbxx0M+eA#X4^VcixM?U#)-4&{Ra&e5hPBUvfZRQ?O z^^etSaw{x%X$Yr`N zv)zw1xG0Tk$Sd{Cq3k&5HN1;=QbRA1mI^ zieF&G2U_t9t$3alA8f@hvf|uDEl#-qVZ}#U@k^{Y-`b56?r&J}%dGh2R{RPp&Mz>= z3HK|k_%&91q7^T&;*+d+krkh6#fz=@byj?)6`yUzueaiJtoU3jKF^9Tu;Mpa@kLhr z7AwBkir;F*Z?oddtoU*(zQT&Hvf_7G@zqxRPAh(w6<=$`YpwV_R{TCI{(u!>-e2;y~%;GZJK4@GoLmY3rCu!~2h(-Qeto*6!`jpAUA86Ho zLv}m^D^Nc5mN{H?x)J*7 zzM{~--OyL_IgzeTM?zm+=ZN$w!yYw%73u19#aldXwbbEte1@81a;i*T-2!r4HCPG# zH3p{Y!!$7iyr-{DcfuZ{AG$v^@TD z9dBP|Oq6N7G$*ggHT}88s8^xX5dH-3*{P;a0^dAdiln~qCwR|>trAn%FwL+5ye6Lw zYC0x-d!5t}Hh}kR_=Uu5V8bk_FKhts>8mN7=wsLGQqhOE8$K*E(jPI>=Najb8tFG0 z>820W^ibHpNa_gt!F%>Rp1}TcsW0pY@9C>4rm+83sl)&7FAaN^8tG~ZD)g5d={pSl zl}5Unq6+;xjP$1s{c0oKtgo8Riu&Fqbwqu^d-gw@puROyU(^@8r>~~O;uyRqLAk$@ zn4;YKjdH4Mw?U`bHyNP2`#)DPv25^le7E={Gg47kRf! zomRvF@7c3Ef!`jJ`oeGEsn4IQE)9fFeks%VXdwf88yu zN*#g!YpEmJ8oXz-y8ICKD4&aCf49`0&$6k+fVX5oxA-d-hf#h?@ z50E@hf$l)b_ay%#$qyi}Ca^=uM`ijb@_CXUM}CmxF zKlw3|e}nv3$-htjGRc2Lew^e#Bd;coUy~m%(~pwBLh{K7+zFBolfP2(8RV~$d|UEA zk$evMt0mu={56vAN&Z^Nvw7T!lBX-(e95!gZh_=!qFX3=!nu`mE?;hzlQvD$=^%~P!Phiki@-rp>IC*Y<2YQzLY{@@QzC`l- z$zLz|H^`St{(bUuB>xe48VmZ2{9MU@P5uVSA0X%ABmHb@EN662Yyui6h@&e~($qSstl5Z4eiGj212jEmn9bwNZ$wv^lRgxF> z+$nis&rc;U?5UM}1c7_6(#C;ME}`c-8F%zu3@M-A|;et|fTY zJp`|sPw=W~1i#O~dDGxOF!;|6{yT$DQPrpY=?34<;JX>TnkI>I)f7VT>J%(^bqW*w zN+a)m2CpvbgpQiJ3;uOO=VOEar@@DD{vpxkb_UNqKy~_s20z;13k<&0;BPhfH3q-U z;9oTOKN$RH2LGMGH&N$B+NoZ55jIDR^ezTJ(BLmI_-hP)y1~yg_$3Cv+Tiau_=gOB zhrz#K@UI#C#|D4Y;M0@ier|2>9SmN+Z6e!9zBwZKp@z<727k4|&ocN02EWAM?=bj# z41Oc{39KI}f~KH=_gpK*WX?!v{?+E8uip3r@v2SV#Y z4~Bjg+8Ej#dMLCl^l<2r&|{$|LNB;4x_jKc?mqV=_hom#`-=M;_qXl=_f_{b_jUIT z_f7YA?pyBL?mO# zaR2HaaldrGa{uOj?f%{Uhx?8Dt^1w(z57r1sC&%)mwVhT4=oN=gl-Kj3EdW28d?^L zg_egZLn}fnL#sl!hwcbfg;s~ELwAPOgzgIcG~{h?ZEPBkoxQIsTHs0aXB(_!?uczA ziBDnpGfP;03PYxM<*wWgKQ}wGXjYk5hEcls2#DTxTbJ!iEGU{Yaemnx_2G}gqRC}5 z=1iQ7#0FZv1RCs1pt-(;g3{swf6AnSnME^Z*r_P1hoz^#_~FNcO>!rFn5(uy58ll_ z=#wCmGdBWe;#9|egmvc`jnMhgmvc&FzPZb-Eq2^FmDIA$8pZYjv@bh&o~ z1?EqvAw8hSi$*~_KL%<^AkUR$r9}lZgG`CLvVn?#;E1Ri0-yQ_LP)G30N4V?k&pnS zaV-IKVvxid62LeV5||;z#o+1+2+!xiI=XwEKuti2;U6$PaF*m(R1&zh2fZJp;{)mb z13-dwG>C3ud_XLL9SJl9fYo>jKpNK)Kt=;507qQenatR^y0YL1d@b1EspdCsdHxjp5FZ?&VLYApksQH)=%V zTG|gi8n20HkHBIqPt2ZD7<8z_Jz**6@>TIglLE7&_+SOA^aR=CrCSOzd)&*GIG`OY z4FOTGltS!p(Rfod)Uo~1P(#tMfvCaY+_b8eo+&of$cF)pn?5hPNacSIA{mkz!HL`?86Q7s400vfj%!Z zl;~M_Ly4YVHO7MIrC$FCmI`06kpso?`X^NJ z+CC7#8(&U9O?7>p6sRPCF>hTB+RMGC^+_j$OF*>QrUqGFiy zHbm78%4uFhskSJAR5xg_I9_8kXt0W|QvxaR*;>J34?nSr*Py`&qIz&z0;z7$V6j&` z-5#vM6OrhZ4L!?oF@Y#SGQqqug8>^8>$_SFbLvJ`GvWXR-OdR$yn@9fO-|GUaP;Xf zp@MGk6Bi^7;)FOTNQ|Nh6?D^{xS&RHy#Cd&vfk(`MYCp?6?MJ%$Cr1(s6OdBe8k-R z7O{R*;^pyu^EUW#L&I;?`cX<|&sZ?g{?e>*Z8NECzA4rhT!}Tr)fTQJ5@c*B5gF*A z1UUjkB8$ExNsujpSY%~aPLM4?B(jLZD%ckRB9Vp1Zh}$*MA9&JxCD8`@ovdvIr^Bj zgkD=Ekc-UlF3w}Y6$_Hd67?!>dAGd(-*|Pj~>(KY%X7-FTy_HOJEjX0vo}X zKo|QGg#Uag-f-kg6}9%Ic-0Z9T?^;TY4C+)?+eJfqLT_{%$PmN{2;P*$e41krQ(w{ zdd^f4epd&NnXa=2h;;jk<_*e2uLhQ59y>u96Ujx1`Uncj7$g&!^f45aDM%(V>7ytp zQ;$u*}6xbWdcMYbG1!`jQQE&2-yb zQ|2=_NT6@p`)u;=Kzpe)DIisJxzYtCWt`D_%AP?Da|nCl$&=)_%K3~GUm`afSn6Ol z@1@dNG8L0eFEwtMFEwtMnQR$miVVY;+;vV_DLxsGaKTK54Na3Xr??}hdc^w{>#a@uMjIGlz4tc$ z20hchG6RqAsA&7%weYwsxix_lQIGVdg;#FiLFD1Bf{~_u^t;9&j^<;~BOhfVXr+M% zS9o|cEW9$v&SVBf8gHtFS7YF{gf8`<;)JaBSfgYJ1Zg~e z16h#&{$Sy4H}KL8ypI8F;ytcp2n1>SJ_JKPDwCaO4LrWXLmBJ44~&Vo18G72d)~s^ zYv8fJYP_3q0GW7iD;WYo)FUl`9{DIEpf?P>(-7Bq6D_>=A*218G~QJf-XQ~z{?>Q} zSeR_ucSOl-ysM#S+V`1($5#ylg0IymqKOAiQysORa z0T5pM@^v3=6OujtH_&5xl!>4<1|D8N7c%LXJ0Dx%=&ImU|*7jx5L2eW#H9Y4K(oDpmPAi z>wiutcznr(o>||oftQ7R^v{I`o@?Qy0xxL%J8F%8;hu54JOl4ZYrN{1z`jSV@hZo_ z8*Jd+Z{g(vFKGO$weSWQco!LXDc12e40yVaKrPN&$J;pIv47Bi7aMpVTI1iS1oj=Y z#=m?6Z@7WC$QrNs4q}jf^R4k}hJiQIz`M%An+Cj~@$YgAZ@z(diGg@ct?}w!1Me~eZ@7iG zHGzFYEWAwy-sJ{fQ(Qcl{@b6xz7X_G|2=Nt@x3X^*dPCBjeiG#cM8%qY5(!t%qCvF zfp;a8HQuMzc=b^N`~GB&SNjdTpBQ*AT6l*O*tg5Vd)vUf#=skIjaNs3hpZmy`i_B~ zS>KOHw1Wk{F`dveG31Zc*7Fd_b1hlqAUb7 z+Q2JDoMjRJPu6@qA9z9jJ7k@Yt~Tm>oq@OC!kY%Xp!VHk;guP9GY!03t@el|uq_c{x&DuMr|Sa=%@yz33T+mYXFk4=aNweND39z|Z#v%u5sI|p%X-z*Dn zE8?e$9P*#WF1GOY8hCRJya+Ow_C2riX-JLN1`PSA61-vH%|jYxw3qMPnRt5>*!PWP z-ys8Ufr0m^HQpaWzM%fM%^L4NGw^OQ@Tx7m!@xsV^GMfsm4){$@bq}F$iSP53}$^( z5f8Gj5b4B@s*=+1&c1HnTMWF5Exa_uPgi*u5Q8)b4EZP{ptiu%_AN%7GUD&I#?#Ia z1lhO88c%x~c()pOzp(K5MXsRZce8~z%D}tLz$?Vd)29E%C9v-r=&?>w{791xyk&?} z#`<1l;qe{KQ<1KTdZeg@x6r^_4!MUH^4nJiL6HBV&|{t`exx$g4d(GE?TzX*Edqe_qk zJl(!)kwzKg=UI3kK@c?mJKMs`G4N^)yxrFI!neRBHSq3%GWBTRgBIRV z2!gIZ?ziv;7{7ffscAmRfjK2Hs`^uah;NmL#w*#~M#J8F&vFcxe{ieBcEgzb!1h zdIN8pfw#u$FIB+PeFSPAe}~my-Uc3z2i`w;*ua}(;jIB)Q2(1{;eBM_J!0U^v--=X z1oo9${pE;(_n3h<-oo3Oz`ijS-cbYZ2?H;$h5z`dPhj5w=$XeyYTvm3o;2{zvhbb< zUeNe=hJ}}5;5}vFJ!RGR?F9BcZq+wp;5}pD-DBas54@o9@23`CX9I7if%i4?o9B;j z6WI4xl^#W2QeOk_*NE%!c0TbJl!vFYt8x{?@?TY~ht9uy2Ef_lAM@s)4uNYTuO!{P&R6zK4wZzHZ>H zweZ#eFQ|R1Exd0Hyf+QJ(YTH``^)1A>>CL^v%jSEi}$~`47|P;-m?k(*Tcf=XyCnL z;ElxfscGLEzzb^Mq0lq!ivmx#?|TN`c^2N=3G6%D!W(7a9W?OXwD683u3l?2u;f9&*>H(zkPa| zK$8D7UXg{j(7^i>R5hMs;dM-4ANP_n?TZ!oWjWMF2 zoFFI&=!R>8PkY1W=F=KtQ40M1>7#8{#eCEs3^7Dm9?h6h)JW7!?#~ zZSg`4)GAsp!CUc~@B2MxCYcYj`I#yc%Rkw_iAdeh)!TFJEJ1d;9%d z!`tA%D+AuS2vHHKC}<$? zc|bJK80+)R*uYuG+k@{Ieg%f7!uuuUbiCVshCO8wPP}*x zuL+&Ij`u|byyqdO3DtcJE$}Lx>Tyrpx?x)9|)C@_S1Jyc$P-k860`laac!JbrNCJrM!#YX@HUK)ZgYX?Wh`j`n*u z0$vx$>GsP8-YDq9{GP7ieS*#j&bIoO45d3Oj}IWH=w0 z3E*W*{m#_z{EqxCkAOG8k>Bq$ydD}}jHA9h90AXC)R(crcKx`|rYhgd9e96B zcN_3j{p+RSl{@N7RAT4lal50wJfq>IYIyHB@P9X&=le9gi#5C|hkhp`;N9oYuSUZgt>HB|%7ZVvY%hvb6L`i^ z9#3d^muPt3JMiKn;GJ~f)oXY`4euQXo;L#Cn-08v8r~QUZ?mJn;#s|&<@ZiUe|1>H z<9^Jlea!0Cu|8W7@TNmfug~vlc;hv^uO0gJi-7lqL%$XcZ-R#RGWt(A+uEBy0^SRd z)AjpK!{hN9D!<1ac93 z0q=+d&(iRwYIr3MyeSdz);jP8YIs*@c$xUv3};(;%#46H8gk5202e7;!{f0d3}gT7 zLi^Y8awFh<@4y?Y;a#cWRXg-s5CQLg2i_D7k9(9W{qi096-L0j26BuOz(u-R!~400 zcP--U`CSzOZyx-0yagKGH5%S~4*fzA@Qyn4Tdv{F*6_+4<8L?u-bTmx8`ALdG`uB_ z_k*$sc-K1K4{p=&=4f~=4*e=3;Qh;?UxkJ@Ps4l8G5%IYz}w{*e;?NH=4*HlIQsjV z2zZ+v{e7*5w@}0D<-n_rfOnPy?->nG{dQ-2yU8*B)e`?RY=)bL6*yrqu*p5J3Sv)>{|f4@e<+o<79ag0al z5%4Z`j7MP&?{*FEphLev1iXC?{qEH8exu=4B0ijL<&hl$?_T)pYIsjM#-mjc@OC=JqvIOh{Tkj%$M_M7fLG)g zKfciL9@Oy8aNva_;3YZmjB)MbQI&=laP;?O5%4Z{^!FYO?;#D3lU?9!YabO6@V<56 zb=UBItKn5T^ke($tbe)Jf!9aF+p6K^I`pfFfcJApfA81u9?|eDM}J=%0k4OnzaORH z{a(YXcj#9a0q<#te%Tt{b`9?~hko@D@YXx@o37zKrs3V`7(bdK;Qhuie&lL+J2X76 z1Mfftye*^Ta$~3$`X?PP6AI`S+))E0P3;z0ebf1Rzw1zj=fp;uN~t@Tm-yQ$M{jN;WcP@;~n3dybH?@oNeXN zJp$fr2i{=~?*$F7#(`%=z)>GyGDCBga4Cx8TxhJ(Q0UM&*Lb^O=k$-0*DY>hAx7R896R#E%gBZR6H@0mI zfyPB?X~Qjz{HO4?&+wr`MM&C+;Zh_w;a6Fc#+jx{k=VazOCQiin2CUfihDn!8$w$# zIb(RxNO{=hi7T&ct+$M7mx23Ew^8|ff7v!~W!UP`yT_0&V{?*!*woru*3Wx(i^p|# z3owS~8MAyDX3CujxkKwc32VN+Jz;;s%ZCvAP@+*`zWf2WV_l8!J*#{z^ZmI?qI1h~ zbMu0^xw&O`TV)TX6)yDFZuS?p)|Wl#6+Y2rExBczf@Nj7Et{?HJ!{=E+7uaWN`aNT zB&{&VTU)?rxvk!oFRhl==(P!3`*&?YtP{Z&AUtT5{VMIi1OCFz-b0nG2R3^{rB;u9 zFD6ID9B%c*4T_`k%=4VMz|Hkt?x5yd8jmD=9CzRcKhRnVB~W22z|)$4<*jY?Hy^2Q zIpRI=H|xMV(FdAy4;&00IFQ?X1kSXSM_eDfzK=&{i@F+xYrSCdyPDS|*3R%xDexBF zU@_z}qsJ#*T62E$J#FGK4*Z>Bhb9?4wvE_wGZcb8p7`6{_ndCt9(}(nCB?Poo661p z>L{bK+PgE(D0|vl`FpE+jL~Ckk1$H3Am_XvR2gKLR}P=F=A_5HJ$iQ(3azp>x3Vf& zS(#hA%?j=E*FKk)veFfL+FxOAdEtobg;0vakwXCpc-m+y23#>Vd@~)q6-7v3c z*}^5)TZ8=%#GO+I6&5YIcHW%j7ec~9 z&>%bJ?7{xQ!~E%kGy01v>bQNQxuc8|sJZRr#$RxkN#`&;lhC3zO7|||jxjLA3;K<4 z#~PdmO|s?V+V&W`5`IZWyz#CGwdW@#83_iJN_I(4$02&c*}nPY^4W{$End9jhIz9W z%`3oJdt%Q(wFlcA5jv-EH8y)Lz*czB`7zHsq8Y~grPY5f1nnNxfZq@-sN^UYd z$OmLVF7)F!S^RVq{tTo0R$O|zg>bXZDN=as-*vfxaIh{aQgYA3LzjC7j?VPE&>{B) z+!&E#W=a&ErAvafn$uQ#lR`M!nziJcGgEFK);?l=PmM@9+ zBPqEgFggVHlqi$ojKX}-c5@cz&AD*Sg-i0Uy-19GKRGrI9x`mOko@VfF})8G0I9KY zGPQex4U+`_eV9y89BS$@XdCIyN5zw zVmvJid&`@Ccrqhq;Dqh5_f(wYIcwmhkcVW-Rc3X*w`UjIyWLD+ z9*2_H>Ui(Yc#h@O6O1n59-DKTemK@ZA?O^tKl(^4M0ZDDlaMnkF1+3ozj=LVV|{3B z{e~gebeVW-m++KuV`PbRJ?TIV(A#SM|_HDSMJl@!_b!UQ6cCWvDqR}I~ z{_YO}U6X3#hD{*fPUO2>8-@U~NAGLm!fERVKktc7nQMmE+u9n2G+lW8#Bk~QLD3jq zG`lPN4{tDnut7-@43M6b;!dIsw&Lw0+`ZJ7-{9{VorWyM?2c}B8<`E(_Nd*_8L8ll zVOH1f7*RMqPgeLsv%L8)!e*YtH+)ytO)IYqZBJaktJ}^7@3yD6?QQfJjh7nZqK&N; z3GmwRbor&mUegevhc3lnz4fkxB@NzkBoK{JxiQ|Tea62t+vu{b$L1d4oNYf~`;n9v z+$9bE@&+%4IO^XIqWN4FSEZrR`?8x5-$kKfOw)FRX0TS?2=~~ z%`pZHSz(Aew93nu`PiKeQO6n#k@o)BBVCZtpoE-86W*wO+ui$Po1^JdZNRw7CGY@d zCnd`bZRB=WDoU%Lt0FGt4YR19H)W;iarIwc{i3&L4A6GR01JBZ(Rq0*wTGML?J;@4 z%8W@lEhgok(J4Ho zskYBvn1ZdKj=}qTyf>Dcom)?!n?GGr@gC^@K6-RKYS59`wFxp1wi$U*AVJM~U)23x!cyJZou2-s-8V z)53YBso|xiZLwNg8OvZFy4{5ehZ^!;%B)~UaT~N@G*GCX(8Jns*CqcXZar|fyJiM$ z*c*HrsI7060Z>53+N$Ps6OgMTt12VdfCV1U%^IYp=fJFXJ!2C7Lp{SmQQ338iqSx& zU72|u^vS5mpqd`rT?+JfW-)DHr|?(96O&S6RJFDOg*AxHilo}pe^YUWSDD*m7v{}6 zI^keOasR2Asl$p=hXVJJr9gh#j z`jw`xnmS=qT5D^Mf|PrxUS08i*7n{FxyVTa@V2|^PK0+*<%FD_@zo8vbqAY{9*GWD z39po6E>C=wfpKkXl6ial&c}YeJ^HC6b9;Qn(t?b|p$(SjObq!c{bEwCi~@R0H*_<( zI~%4nHUxy709q7X-7uvtZ&lj<*z8o)3V1c5!wS^-(8CJnA=j#@DOXZE(ZT0JZzP_* zX+Cm!u$4c)Q(IflZb_MMLS&rV2v5zKX~ejUQ{&i1|4(c_{HQT&$Aqek;AB@(YOj*i zb4m{mPVHHp%D0a}@Tb00n-fiLi zqJOc+g?=+n)Y;OdLHn6kjOi1jqhl7dUve0Jz^ zBece>+~*DL^VPp-)vsDnbh-P$KCAw~mxnHQ)i(tjFE^WCi$3(ycb9%}f8zTWm*9Iq z**(FsO8Kd#ax=f>gi5^=%e!o@#;a!7UoycEwG=-yT7p?uSU6P15YLRk;)%0gj3HwY zFxcWD_ktZF*aX9}`YyA^Ob(8*maWJ~sC91Nxg#xO`MhQLP_Sy=oE6LYp`jpe;i7qS z6O3ioEi5b~qdW@pmMx>Z9mbAtSyVvaLK|z!v~d!6z%Nfv>Gy|2zx(~aPY=hxcKN7p zKly9-VM~V;thu%MH$}s1{{HVHkNU4YRV)25q?V9QUL5J@C|$N3$OL^;CaT&v6f3{jTqy-!`0iR>HJTzk0Aw);pKqd&c$w z!JFP&G=jflNPH&a3gCMB?1lY5m^Gr`uO3>PbnlA!<6;w1p15vuaO}VDJ#znniT&2B zy>;vZzx(jargOJGx9aA#-~4@Q%d^k@^5Xl;znif9jMc+O{qXB$wf}yz>)dHg-p>bw z%2xj~|Kx{Bz# zweO7EzHR?M(_Y?l^WSg0WBvo1w?3ElzPBtU|Epi*t(khu=oJljetdUq)YwP9`Q?j& zk4{#-{!Z7AS9e=IdF9NzXMMiKmpl4j-qT-R`s{#Ze`vXN?aJa_!v@A)oEP`EK^5MI z;*;O`;^l)MyZb-z@uL@R*&JGzI_09f9(pt8iqUV)yk^)C)00{GhO0FHs~$IVMHc3=A0?YE71{_4}`pZ|8;syipTM)hjGc>Cfzj&4pZoBrVS zuP?lIVDzH2>0a~PtofzC-~Xw6n97}a=#?8shr@65`0d?a+~o7^go)eiZGm6?>a?x@ zUiV1uzV4MzZTT#CasA>EzufOVbK!k|9v1rg$;saeoNev6b}Ht%_b-1xW5^kI*N^<* z)uMun2Hm^1_Rnj-9{$1<|GD>_`0~Pn_(c!??A`K9t~<6l^WFo`t&aMqVY=K=(J`@c z@d;f#iCw#W{0hG-*}7nv6@CDB4EOqyPP^ry?1vw|=G>qEzV*Ar0h24YR3sd~Y4)W1 zrX_#*WKGsDCJpMJ_<--ix8grZ?)BQ-`ll`${lD=kj(bWd>g+q53ggpl@T)>Qxs5Ky z)AGmuHSl(I*j<70-Hh#0oZshMZC~nbPxmSE_`{+`?hdP!iHC*g8o9CCC%^xY*al5w zi1CKh#}e+L#*NZF%4GU|jeI;w0bC|FS}K&^G3@xmjn}06Fv4BUnlEJ z06u1iFIklD_^H=z3^2Zx@_r$oZE(*y62G;Xm+Ef^yeUTai?Y0xd$O#*3*eDtM5Bz`iSl@NY9qQYka#WN`5m8o?vaKgVv>=FZr67E z@kqiSw0CKMjQ_4ok5Y7V4<|)*H%a$$@JZNRC(98&N!CYGq<6Nl)}h~5670_+Jk|Kx zksig(EL(`SGNnnGwkgfYDC%z!>;cI$-WbU<-c-pmUcThnh6MfuFd%_H(dGrF)P>)c zlfhH=3dvKJ->d0Q{%y%qMqo1695&*&dZo)|22 z`V)hs?7%pt#24wx?umS|EQh|5rz~3={TVLeN}XAR$?>>>df_6^a3OOUeWk4~w|SAT zY?~MPy42=HA2iA4MgKa*<^{eO^d&xcVxNzTX8}+jp&NK&6OR7G<~T{7*w;#)*g`is zm@&S|0tX3w^m@|8_Q#YXBN;s7og;b1drb07_e;qWgJiNIfJ9od>lA7EZGT}079dEZ zE4xc!2icVhJFpNy_>;H5B!)$PC~lxWxJ>y+j(+52H#(3!bRag9G-Y?nXeKKQh!0bC zqwF0i&ol$%Wp_H3yzEM|$;)nY5_#FBP9cxD=i)h?yzEM6lD`Bu(ABui06D|R#bpj4 zXaAjqaq-_+fXgHRNZ6c40wwbTPg|ZPdD=nLH~3SG@hQXnvIxnOCgM_YsV8~jiM9!z z`CTOaY2zi5xA0scdD?iLT~i8K^$rlK#KIlVxVc;Rfo5i}LgF97sL~HxSb^nQ_oiT$Ew? zpN=az6*mx@B6;eg^$$v(>2P?a4D}NIHh89arSzw*_?w0@7M_ig zC(f&qr!FLOto>w|nQ8NkPo3A}c}m`?2#ETbV+3pGogD+Hv%ItZFg<05Sn$c`;ReDm zBY38tD0!xzBzdMU>J{W^AJLD2XZpyVh)bJXAbFM<&5rUp4GF*+2{1?f5G_%CRAX`MB90F^5i}HghR}rSTZ+ndESNM6g+XX zAwMj2@D&FI>b^XAkH;N5{dh95(~pM;+kW#F<=GP__}A#!i&rdKzOWDn_2#dhy`p`p zMrUE1tI_F958^DFx2Rw?zi~;4Q|5d)gfOFK@x1FP?acSQRfU*WGjHx}OwfUH9VP6u z9V196dqhHDxHzf%$KvxSZAW<9lotD}#D&){RJrUpeZ>wIri1Qn(_&6BMJIAjBiNq~ zmvxf)_K=PRN!!ov7^o5!8g&vbv=@Q%=UtB(I?Lz%7(gd7w${q*?TNSh)7+i;vpTl> zx8=lPX`vhD>J%-fB`Bq`^rM39$uGtnue|x3!*u=pm+MBzT934eNLU*Br+JWMirpiEnDDF!jYcPNeOm1-@CAA;q}Wg zEvh{YQ6Err;=FV=&cY%Uu8iENh)S|>QQq=`B}I#8%b8Wqeyzg+;t_MzK}w~ol8`;5 z$dwdy1o32Z9L2n3@$BWR3+J_&SST)w*Qr;>9kAdrp~2rWN`0Hsw(M zlXb_X62C+8Y*QlNC>8ec5p?K8%&z?Z<)Nk+v;Kh}cy2Lz*|&zX4P$vsy9Zut1l8kC zUImGFBoSiYIPQ|h0?aALF;p8ffIh%e`tj#G!>GrlV064k;pohM;~aRo!1E(M_2bWGh1b`CR}VaXPf|oVlI6fF z)AZx}l)~HT>ZspIxI44ocK9<+02gT=@cQ6M{kq{&c$*w}Q7A`#H&8@5(rpgB77dTT zRTbVzi-q_#UW8;e8Gv@⩔oMPvL`kjVL;qhCSj>oxxw6h|G_o@TW0-mZb zP_+&3IY<4w4|sgnRHX2BIqF|J@L2b$-x;`+ew7ZqI^Zo=U{a3GdmVTo;7x}=@%TQg z@W#M!dVYB>NoV!%XOLr@04~yBfY%34;_)vR3a^&~FMt4kUsOan(pe6?lfYB$16@)Z z-pAl|{l+3+iwGb|;T?yYd_ejSh0(?$BK6~U3x;`cy@E@}s|6m*T#>@t3lAM{6$-am z;-$(k;w?oz)$wjYXOXVJq#T`#AgANa#1E4D;7|R|#ijI{?!bEnc>Md0BBkHu4!kdb zR}UfL^~I&|_M(31`kh4M=!bAc3a0#il!jpLXw8b#ul{)Y&{7_sEe?^od z-2#SufDTYkR62z>2yTWE?_pfJel@^@3EPNrq>Z?Axmw7*Btq<)l3NES`GD0f>R-==z6r6oy7_W))>9W0zGZEPQj&xOiuR;VJ@4g6lMG{-#y$w0qMUhI^bfo(QbB$rlW|u3qpqUe1su~s?bI%zkD&!<+vZ3KE5fu&mHx?26AkVij-U;81gFY zFy!VcAv_tzi|2*$sb~~mf;3WLOCYDOJ$MxT0pA}cNm(WLFX*Ri!XV=D3>b!I;bMMi z_c_apX3s6kpRd**{M6cmjNx+Wf%VgC4@PmI2eIz5mmZ_#(2GF=^Qk>u8mj`ua(-oX zqlHOn&0^MbY0;XKrJ3#X+@yR;quD046EVfq*EoZ+;7f}{1mI>&1IK5+{VeHy878Xr zer(^_EhSZ<5p_|$A8R_hB_mU;_@kU1Qz$BK!>f$7u9PP*-;HyyuY?Wn%g2-E~a8@z#<6Ph>a-lc#gGc3bG{A1vQ|g`TUX-dH1qq1OJGnQ6_@MvvYlRd;MC z?v2d6=&eZo>P6Syw_1TJqS)GtIhIiUZ*GN?-(-2>Jg22%=3`Xp)NA4(56i?HiD`B* zkK@g7@TwZFt_X9YeaQ>nCtrAD)zp4L$U#SXvD~VgjGa}LuuXG}tsy){brBAj6^?0NQKi9f>V|R{cW1mAdfHd{wAC2zGWPin#k)fvoAs|+wa-|!O~KrKUQB;b=?xw6ajN9u6^ACc8N2?=#tE+4y5Pd zSfASDJ8YIWB-^#%8Lbxlt>S%T615C@tVzQf4*{^!gy+r|te*C&5qNrH*BJ&p(cn-W z9rO3mhCPY&S1XpdPd(StfgzLxGxz_cC z-SZpbJnqJ-5HZngX!hQhRrkIewSp})|FL~J-^4WKr@U^KG{n7JhY*CX_3Wo!b-tXD z(O0e9AB#e+^QHXUOz9(}Y5=y_Bi8KfkD0iyx*-l8yAu#&aY9ZGR;19arkdv%p6;cY zi!p^dZYR_beN5YQ^R}FcwJ$KuK$=PP9hv!;56-_VJwIoNG0L5hpPh*g6MdF#UnG@t zfotH&5p}UgVpl$#FwSN4xH)t%xU!FVB#L#+wL2OU$Jw=YVm?P5#Tu59hYj>)gCBc& z@0Dl*#(eTkd#4*2Xe!B`SW$0t< z)@>i^wwZ^zefk?|VY9QE{TXWZryXi`%YRn0KlFw^@in7nA763o)S4Z=5;Z%vvzqPO z&jkQb^&xl9xX_+CFQvlV>A~&pI(87@RI#!wBX~G1XU`Y;4P0LVOVW;r^0+&k*&|$< z>2V`uTo)rH<^+rbkw;M3g|SB`q>M2Zq~V*5BW}tSpG*?9T@;C17D>mt{&AwSxHwk+ zzog++?xKc8o)`?(L1c`}o1%=O7cJJ8*iufSM`lWwmgMzb^ZDSsUKnWlSEWo7v%jN_ zS)1Tq7(FnqBrmljbzx4n(GzU1>V`!-utKA?^&pmK#H6;ie$2i%TjMz|`aBDxBH z(m&0ZFcobeuO!cc_|ArblRTb8Xn-6?89CQtY*wCc1Z}?yuzsq#VIYtvc_0X}lnYGY zg+0JqmA7CMI$rj<6H*bknDhBrdQ~Zh4TNWJf;^tMBNUm<4(^T$Pld$x*f4WBAv(-V zB8&Nv^U@XBSgT%kSibgH)|lzjW{;hgIo|3wWtuhGnm%ntR)1@x)ybT5hvc~6q${%eLo&g5dFJ<@ z{b}VZ6aLct^J5uP-q>*M<1bwF&hpo9{msE$bEn_*);TYH*r)y*Puc15R(a;&;aOR0 ztsAa;t@`w)iynL?d`alwz^76Uh8{Tj(&OPCsac;^{p!`G@?kSBc;oC}C#64XUY6ed zhWkEy@-L@7IdEnD`|o+ikG<>Js|xS>pg1sX$fhfPx#F*9-ha;a#JyYpzNlC8huw$N z{4&P+;MI%Xdh(5@GH#7}p+2)QZSUFlUN!6FFBA9W-!#uR!~3rXMnC**&uhEaFMsRE z`>u26q#nrldh4EPw_H3SP&A-+(S2_{KW5Umsq2;vU3~wPmwLZ@Z{l|c%C@&$e)Yu< zFFXI8{Y!o~a@E!5!u+k@pTEBP(yyK!|LKUEPdxR}xY%>&+&r;|Ipnj(^i6MF?)%-k zsh|C99R($@~-)*?= zw^Kt^WzT-T{jq*uJ$2UyCqDn{J5@W^9vF9%XT_J_+;Pr5$t!lQ`GdRq?&-(Ah%fkX z$XtKmV4&N3E7y-a8Na622Q97&<9}hxf*JT7q3FM#C*94s8oxbBN%(={!mpPt@`p-a zlWu-(Y$vz)+N!(xYp0z~ofqwl-^2J=;y;UME+e%)GC0ng*2#TJ__=y8@i#l9-*3%wbx z*4rz0R~j1B7Z>NnULf7E!rjIAgG|qMdyLnmnHkct|8(a%-0Nierz0#0I}+@d?yH5nuW`1NUj{vr@O87VOrPKFlQ6G)pd-Ik4ts5a z9BI3VZ%-03nRyVCGS3sN!S9Zp&7~FdQ;??mE@{dSs3I;uwu10kRm_JaFXqTVCx-Jo zkD4dTFjInvxcG)iqL(Rg@EKCfZ>2vzRkY2A9Vq!W9i;vuuAkEO_ZgKJ+S#p`C1eQt-18JB#6PB3pv(TT4fQY5+Lm4$cH&yb~bGzh;*CKh!#xh+L4)M;EJn=|8`-Q~n z#rd#`ly0Joqz*z)-atZ6S$4!#x(x!KoJa|2H}J&Rh>QM=ey`+-@r2}wLF$mMEIW~| z)RRdj%kNwRB~ScGl9%dr#F3r?N9ru}mzct~dfkxu)$2wd;!7n*N}d?kNS;COOP+Y& zOP=K}=J!E>>5r!U!BgiP$~cl9_#hyugMDP16?tJp0Z|V%FIeP@jSnR1 zyaX5dl0%q1amDDsHg8_$5` z88ntWJwe&H%yR`R%1+h8DfFizpy{}X!+4@kV5b6NUXsB_;Ym31wBbdPrwv9(p0>F} z^0dd5k|)MhlBYeck-UXxzT~OKa>@6@^LEJ(#B+z_X%Ep4KnL1mkMyVf-y~1lyeoOy z<|D}m@I060j=0q4Jjss*-(T{y)5VgX1fKmr!FVjYM;@iEZJ6~MS0iHU9$M6%0x+Zn19rUL8UmE5%V!IgKS>W4SCp=t3Ay&IeUJV zEpvUFj4Gs`5bHc?J=s$sPtC2Sr4awoy~9qO5SPDb$(-xtT))|Kopa%wp(^=Prom~( zQ8JF)|5SlErn<3Vh)HWdhO7xFo1c=pEz`NJSMl^?A@7u*y?r3kA1CyoE8s}(# zH*1?oNQpT`s|(Rw=j2D6^!Hy*!Mg!34eZ|)ZN-m@yZ9m@3B!XRj)ml7Y^P&2r#&7p zh~t%0&LiXS!EuAc_aE{BT%<7G(>ShW;-WqbW4u>z>39LS``}Wf@b(jN~&lv51(fbBB&X!_xGy$$bOD68WYBCM~B!-v9q2XZcaO%h3 zLJXsReZc5=74TzviYP~_fsig&3BS(dUUSIRKu-T6q42mCTE}aOfVbU|-vf~AtbA)6 z`Q^)IAILJl$a-6TH#qR#Mi}3L6e;~~b>Q{U@c7D0IqGqR11}kwvf!^s;a%py%LX3b zfvBH8|1RBuHxzjMuB1re4RPSz2fRfPA|8LIEB&1F4YLuC^UiAyR$(xz;#W!k06jss0gv`4 z9$ytHNB31=biCW(racr9j^}> zE#nh!fRv;AYv`iuw+eV{KZ+Fg7ZB3%{2JaM2s4a$VO%;M&sm=dKSc`fW_aj$qk#7v z{HWhWGK_fnxOBYZz~gr}MGB9;xB3_ydBi=wij@ zKHsYn<%TLK>H+1I+%HjX%Et63UZqTP4e zd@&e`bU5E@iPR2%hr~RuO3q;rlN;2`0{Ev?8#@soXFX_t-^RSKNb(3cRX%Q0YwLz; zY}#78Be?5Nm|e1yJGT~uKWxXmom<>tRzcG4_+3qn9;5zX@Xa@|qx;|Pi|O%n!Nv~< z#Vf_2{qQ`@|MIwkkY9)Pi$6n~*SIGB7CV)4TfLNPjg2!3{`tw-E!?4v^S!!(nCsTo z)^4AIydb)NfZL6Xe}|`NFcv&Th`9HG3(Y8wMTeqPfh;ZCE6(m57$804jNwO(61P$A z7Q1C`wyNDOW1DZM+Z}qvtbEiGv&4c8hEc!G%Q-&SCLXiL!e&{8Rapw*sGaU;dzR24 zcZ_kwcg!6d`oTQ#j#azcsy!U6KjOvq@AcX&p#!_D+J}RoZGK{6YS71i&o_^lm4EPx zG%9Nn4t(Qlz9Bg3Wo*rMijJ zdohvVK-e4FXtmV&D&O*A4#1ml9Zo!O#20!$NU(n$@7nx{51Yk>K2`1(fFH3!@87Dz z;W(xO%k01pmAle*AA4O2Q!~hKm{A$_ZrB)(s}K7^w_EjfUQfKIm*;}8**niyp69&> z^NH@@1PLQP5DIPb^sL7|iigk5!%+In?cMH=H9UdZ!cD7B7~KQLTUEIqdkdenDsS>l zMR&E*JFUu?b#%%#-UE}lOJBx8|5)#o>DGa_(RF!Nz!LPKDNcgjku z`IF!Wo2FG8v!+h@#M}J7bzntsVDzjiz!hS%yc>f(qiweKir}nb&-%g@!oTQsPu8rZ zN@xbkiqflAwEWwPJ@%kwS^cKKcji(|Ezc{&0R`}b#$Q+EF7ei{^P%-&f5_0UE$czw z($-d-P*4`O9`V)x&T4+yJc>CL`@HpGtMWD9Cd1gARwi79aJ9B#?=#_QIV$QbG(K+S zZV+<8vTSeQ6RY`dADUqRkPlcb7X*)Dxe+>f7wDm|Awf_dxI9%!5;Ud&|nL z&;Z}e9bgfj+S)pElhv2(f&Rgn4YqF?1diJ5f%Ahit8BJs(#&F8wBL#5-oBYjrNryM zo#~r`^AR>%E$^5!^K91prVrTGAR-qc*QHkF7PBqaE#<*>{%+r@G}{g}<4T_$=45c<+$_KISrnwZtviT|Y~<&A6BeCYXCW7BtsJ;z@9?qt`mJ#Tbv ziaQ+tM%+vB8^h%i7Z)kL8Kat@)W=2)Yo zGPL2LjZX;fmJKCqKJX;$tUTHHhwlzOwx;JN+dkj5>gD+hVitBQ`djO&*wwwZt;&D# zyIoggM^A`ZaQed7HxZUUzgPZ?AwI2Dy^59uS9L2|64?35$&K3vY<@rE8I^Ngzu4Wb zAJI?P>Hk|^st=hv_jr-1HOD>iJwL=q^8A)V#|Hi41JAKRvp?v$>)4jhi!S76 z7hUq%^{K}OopWqa;LxC6hZY54+l@~T2yab)rCsy?P>M;2ym>35o1NHK31@Oim?KWpVpe02+2$+TX6?iv^R%xK zgUs6|1_~V7fqA3NPkS+G^n(;W6ssqj`|vfYl#&6O4L{>}c- z?}CN9gjdzBU3Fb>R7>dDVBssmXVc3sH+kyev+gdmY(^{Iupt~5D)l$t84Ud0EW6)2 zoKiO0KjjWF-Vm`Y?DyXtES%uo)Y>|6LUvRD?#qIOUwDJ9t>1icvRlhZzaMDn+?9J| zdb-(~_IG#D5w`Pj z+~2#=d)_fu%u}t+#X;`_Ci*Xbg}(-chpx;I1C><;y`n73FvWbEzfKeY3~ZNPweVwE zHH#vwORN183prHzC3fRS+J;?z53~I0SOZvEb;09PQC-T!G~>g0J10klFqc`>x3c>z zcsEXtMfI=?p7jZW+pOxzILgH;tNn84(Vxx}5#(owX^I2BRv8>ob zSy7Ey(L1wTHN}Io+~rwDNtT(p=j6tf8w+xhzrl{ZeYiFN^I79c&5{^5rbx!PFr6_5 zTML)OnAkHtCbl%KBqpXbb#P2n?-=Z>k7PL|F;wF7hpmcKW3#U&4Rf{ePKW$f1kpNc zrlOJ6-j@Mak%FiwR3pRWxG>XESf$A(bT3vOPi$=^c zX}GLdS}iMvR?CW(TGtfkO#jlh;Qwu(a}<5fPxm+&!~X|*9P}ZqZ>U87NsoiBg|!&9 zvsqOyv3L~{1Cv175`WK_esVJWKNJYYt1T>*hpIMK1`3}eS4SmYc=WO!= zd)x2PB*XqP(LNhmTVFc3?NQt3?z;*f@!sF%C}jR1eEbgw1CO(S>&{-BSoxOU+ATVy zhRUZa(NBc^2heSZUQ6^@aK9QX{LTx^Z@xpX1NUF=D*T?^)HmM?_wJaJ1JD^+OT4po zOev^b5Yv(qES%xRJL*-lW=2mb@VESe?uvuT`PE%`(fgq4n;$-Q0pKftXl^ht)6AV` z&Ahl@aqc{SbB?#7p=?GaBDeZ;1=u5-uDZ&03aqQHwjBj`6&84}UA!PBx7CmSFLRIg zymwvW9&i1uGW1RLBTGF|FP(VfXvNZrn@`4va3<9fZ@(QDHS|L%fm@yG6~Ic#!w0Xr z#@1OVxx4FesOeDhOsH6!JMxUohchlwa7WVn-Qm6k6wRDG0*8u+g>GLie!0<$Ah>z2OiRlJ>#a z^hGc*$87n^T9Aw)MFwFX!Z4bExpt9;G4q5lheBC!^qa3lT{_tZH3^Z02C^QZi1d2Y zp@7T?o}g4YG%@bx*hYHwC>9iT?2se;u19nllFx z3}IoDLxXsY5JMP4?1nDhIO^E=F@)j00z+7x7^TDzhUn;BIcSOZ7%_wqQVwApnVz=n zA*@LaMz>k;wudlAtO=rf<5*`8VNgR1VPb@e4wb5b5B@(kg#G{H7f00p%kis|*W!iC ztmT(2S!s0=^j~?EVQ=oFp*gGcNW+iDj&_w)9S}>suvDTlv{W1i6Kmj91boZFnhE^W zPr^GO4idmS!47gqdCTK1SW-E+bQ8G~ycK)GrAsrata0Alr9pZeOu575>9>A()ToQ` zHFjVZPu%+C=!0V0Lv-+?!lCsgjZNuQnC*WMuMgpdlDyNxJ4*7B!bd~vD#LM=c$1O3 z)#Zr;8^-lCN~))9C?1S8Yz_D0b5HkZ*mxb*#N$tV;n1xS zEL~iZ=i~YiZ+NP(`K(R4)qTS1F^RT?Gi|F2TPmyTe%rZJLz<54%%hp9rwvX``s%zi zhxrf~K3d+8Etb{oYzS<4T3cCH5Po-Eg2TKx4l}a!;5=_;p0CG@m3RF*oK~?Z^e18c z)Rbv2k4z zyLwMMJq4Qs_QEL+=k>o};6-VJhmJ_Uc=XQ#W3t9gm^kV3sne!kIrHb&{30)Z?)(MU zExx{R*@_!h-?-*ip_^}ASGwW0-)t(s^PY-(?|-1G`r)lLzu*3c+Q5+5hT+KfnIhH{N{vo#uc1^Suu~{OHpYpMCM~liz;-1I||!^n;{cpst{1&xW)Hbj3eB1k?OO^A9KR z4-di6IHtUrk}>H62NV+_bnzd(7(kW}5(Pj)#Ev9fLPW^OKt{DA*;0(k_yI4z$BXas zQAWTUMb1mV02mOS{QMpTKZJ3yKAzykxBLJl7)BT4h}ghE99)#Q{e&F&Q4rk0}bh;m^2226v|076v_tPkH-ddX$BJ@Uq}*iO2yw z!84-Q=HWCf@bC!`5Mkiq2M_q;4x%4;i$O-f<^_hpA|_&x}&}rcc8Mx>MXY#V( zL4qHzVqU_7vQkEb^G134lI*x43%KOz173vkX|-d~&&1`#M-<_w;wcEW{VGb{J*J2`qsxVo;Xp8ErT+J<8G_|15Bjqb`sIg?JNLz+J|rTVhy}N0<;4 z7$Lz@hBzTR%racq<;)dlM2S%R-Hp5}&cdJP=x@OvJjjJchl_+K!@x;dxNV*dle?xd zu82ooU;9*@9^|JL;m?8~Zcc#sBn6@n|umlf( z6G0~b4vEV&GMNeCXBYw7FOE<8AsoCdlPMPfA&f~08S<2aOdP{;i7-CxF#h>kq(y(h z;~}sqL!y7cPFI98J>_S|wRMoPDji_hc$p$DT|y_BhR|K$iVzV-J)jqJZn#8ALK8e) zREQ`D053iG=UDuQ2W067K2F4izlcB#8_Nz8;glz=2oOAFi6LZ(X{T+cLoo)};R2RU z3d=aQ9zss|QwO0JVQt;O2;D^h!-R~jD|z8hOs0)msK!v!hyovlQ4vp8HV_Jh4E-qw zJ_-VqVW0>SHweNLa+GBdZj2*j8I7`xhcJP`w8&CUrYoGpV1RuglARWuwoXik|7|_! zXY0%;GCib28R84QDa=F!rv0$fCU066&h6?uXHeFd%t3vJ%(eRUUB(5@bLY)5INjHI z3>OdLvLlSi9HU1t9cMSGGnPgSsCaJLyxLif-ZSq@ziM7pbz#neh5tPL?4GaR^WiP$ zE&KNI^2wjS@W;$M-W)MExNAxNl9_L0e|l^3ye+evR{iB~w*(iQ@U;5xqt2r#{a@P;MtsfBbl<^#swYZxgw~YxXzb*?~wwyOylRqybf-C)*k0IolDU+>TKQb7}icu zAugAgB`vtsR#_0AyaBiHRq|>SA<6NQ#Lw<}A&xt}L z;F?$!mD<7m3nQb0d$uvPgFDway@NXsJ15w1HeSAw)xkZ-xTb@9t`xQ(?o-Y$y3`SV zxx;;hahWV1&U-VB0;84<9%Q>07!8>7)b5^d+}$DkT4QU6@P)Rpyt|DV4mW4ex0Cyn z`sS=pKW`TX=k74;lWxukY$vzDQf()_PW-%M3x5y`8IVz*4HHPT&LaQ2%jU{Bc@g&Jl+^2!)^IQxR*5+RN)>Z z=01W&Ov(>yTSsoYGmML6eX`v_<4)QCeGNU5u&bI&y1B+L$(UfgDc#wKmt;&fvO9!N zHMmEhBHEK{21xvwmL%(^84z9^+}qZ2)5pxT{p0B`^C|oTw!e^<`4j%Syv&F2ztEPa z7taq;#4{8~Y|_aDlVr+njnHPc?I~oa2#9k?lfg5b(M&&XAkk*iY`za3YJD<4qN=ld z!jfk^4$br@9{WY|v=R3OB%chvujGmSxa2MHdnDfz{JWCx2mVXRv%X+DgTSGBYa~Au z{2h`{2mhetM}e=Ed;t72k{=8HWyxoQKP>r4;NO+}6!4!(emeLcBtH}U`6xH$g(J_+ zlFtQym*nSyuaf)%@Z1N1@{7Q`U|{mJB}ttX1rZ}zu7y6uUmIdgHcAj++UgREU#*MA zG}E@V&0ss?vjIzrh{FN`2^{cDhh(y_K&PZjL6DHgtxbNS?Jx4BO$?8SBe(w$IN*uH zB+bD#4(o&|hhB?33mw!4mpM$Z_Il~zHqW}E)?l-)n5-BeMl&-6E98^UviV=)L7wTB zN}l!kQOSGod|vXb&&`sjxe{1E5tsUkJqW;4-;1Qb1wJTw>iY}Hvu-buJoV*%BE+G- zzmdGmX4_d>#O1jyq+4(){(st5=P@lR4_bqZd=#GRB~M#zlRRzJAbHyA?~YWB^#5A&7M|Zpo@J8A`Xluh zV-|Sg_mKYmz-LOHWp%ma$AZt7d;t6nl4m*GDS4K|1CqZQ{6mt@1<&^eraKq>cF9}d z|0wxI;Quc9DDYxTggou@sq|;r4&~S+^&cU5>YuIoUn+UpAxHAeSC!gIb^b6XG2fSSwkvy!$@^ zJw@;oID2VygvHuSuY-Vy4&Nd4=CM|eh@Av=h{E%pB1Ex+C>_bDKXoRRt!>A1tK?n~ zy0JAFwP{5si{c6PBimCrf}Lg^@)L1oxZ2i2YALKIwzq(p+D|u{mfg-z0dJm<$qHy!#g+5&u5%b)w~JG-vjc~ed?(u^*qd%FnLAfj_u0$y@)xzA;lsp*F3S6q zZ3w9BkL-Kk2tL)~KOT38j_r)BZxCSD1?M&cOxP*b3k&v-Z zN5falh&nmN>_ULDL&V{2v*+Z`k-9iTu+@R4r89YzSAIr~nE0tePMG$b{wPpqVx2+> zgZwmP7sxt*!Ut6N(UiqgMk)|T{2cL7EjrAU6IK%t!$fKkvT%+him*WjUTGv2&ZhS9yxfyehF?dN$L-ir>rH5y*DhIbXfA=;LYNiqx%K}x?Fkkj=G zYj`w|((h*uJie!$WO@O&EHdhoja?v!D82vYi$z(qbFe6he%!(;kNzdZ0dUIpCz4XH@s@i&W(_qK+| zZ#4>UFnArWPKMzjNa69PvyOLM!{hI6g~#@&<2?g6MB7N=QAWr6Lc`-HC588tqrSY0 zF#dK>r0{k^PRHX90RCoR`|W{C;W_sk`3PYHaVb)G&izKZYj|fvSmC`2Ue9lLI0_Y* zl%w+{$p`2F`87P2pTesJuj7T`Q2VVip3?94k`K@mlnp%giOg>*E`@j4QJ*W&`6vv= zQ~aMD^|_*dd;fQ?hWDfc?>^wMzAI9AI~;fqYj}Mjtn~W;jGo`x2>QJXImQXdglaWB z)-Q$kq66;<;K|QHA|~ZXjbO+J=m0&V;el<#TjaoN0bZPlVc!(qdLYj~Uw&(181Z^L@GRhU zR-gI3RL6_DpuN6e$Zo@1i~Q;Ol>x6a`*B|w9nT9qWxpXB-Yf@R1@KZ4u80_<=?=Vp z8XiA8tNf;d(e-;Kf_^1Ag06c%OpT@je3HFW{$0;e7}X9dC_>$4{FIZ?L00CdGDM zzJna)5!Uj{Pnim@s{?O3@KTj>QjX4e2VSLy7nE|$|3>6b&oB48Nhg3LmEU#Jt^w&^ z2fSSHwBHz9O22Czc(uUe-y;<%Jf06nJ|F|SqZ6nBPrNK#3h!%2ejiP+!(=oeNB#>( ze(Qm!%6Ghmci4f)bME-}QAJ9>KRfXD0Z+BJ2^!u(M}9x*(z*TiIr951@N$8}{9dZz zJ?6mcgG})6wThH}+Z=df2e#X9vW9nw18)%qBZWas#gBC0eFQvZzsohevmJPa!0XI@ z-5q!*fv4;@Rl{2Y+w1l3QM~MS)}L}e9_kvvMe?GPx8O(nU4e^X)c5BOyqtL>+6)`OKB%~qn&c+bS^i;DaV)6PVn-i9Dg^E z-nQ(&4G9NsjKT{C9f>C%g8HP|?L#`-p#LQMDfk zDgc02DDxJ82kU_s*W3k*|GWLA{KJL}wn+cM{!*-aAp6@&KjU(#-Ei(Nb#>c0VQq_V z;ExqvV#}$v zM2_0cQ=y2R+S;}gi$Xi~3H&^TJm8RcD?lGINCC@5v?Je~y)6ami z`(pu>GSTS$=4)rSgxxoWOWoR532n+MdkoJriW+Ps5YICZHlcRlak$(0F3$i!3d`R8 zCKeF3+4*;8MK8tjK#UEs)xwwhY-8yaWtoML%rb5)354q_%+h#I zLd@5qUMPDgz4eTs92UF88Bg1JK38gM>)nsLQ#QD1D|!^|^=^HfOFr##JrYf0B%ngs zUN~M*dadcVK50M-rm(e4+uMEPlgIY@DG|Lt_J}z5D2!Wtix6sS5rP_DL zjiqNfTMX1H?!bdh$^f(Bg0_Px^}Ha?T32doYswd<&<4QcM|Z%D1CGft+hgi{O{qs%$Z)Se zt8dQBM)e*Zq*!N)(*rKhXg{y*VyHr{rjTa0T~Fk>p#l#Wio z($TF$eVNZQpJ>0V(1Q|$>3JrYJl(PP^WMzoxgb^SWrSw4t4l_j9f1uJE#RKy?6mwn z>7E|wE|FQcIP&ncg}&-N0Z$LxIX?+_L1Z$u$=4i3f$_e@IPa@_D$o2&PeUyhhfTiU zt@`Oly9Ok(iTSrsW-4B@;$Nr%{1f}Uj1;2qn(5CF$;b9jR9Tm zjA-GK0wbdOnR{PoW!f+$6lWPDqffc=pAUEv;ExodRCca3kxQW`d|lEvwF+%0kMF7Di*X=62R=uBdbtHlX= zEI3C$#5xrERQ0Oh_qFp3J4?E;4u3*%b%O`G(}2_66L0PkEob~t2$u4G>7?qJX@p0s~v7zTEo>d7M9L5-4T9LP5HN5k9 zfFo?r?#tNN2%p`eyGn3FcEgQSK*UKoKL!l47H5o0F|vabiqq599mkn)GJNm9Tf=!P zyAPe#AolEHuOqO~)?#qbB;(RAR3ho)tW&CI%d z{^F_AZ(K5L>C8pL3Z~AvEMxj*Lx&ApdEMocM)-#f&c1Qgs%bfsS1*{gc;(bN^C#Z0 zATc3rSzcOt!Rmr(8J922$(lTC{-VnZuUne4Wc;MdMl78>EN|*%mn|H2<%o;M49Llx zn>{^q;+*kUO0a#^Om6FI_QrQO=6FIsU1ut{b*=#>BiSS6#Gf zMd6M9%T_PRDZF9fiiMe%Pe_}8*~0WCH(W9E${U08v&JMQ{D^@P@%#OMVX28xhxboK z|L@nD;77Gaot-(yc}Ap3xNv5wu|a+#;BR$Thrf96?{oZd)=qBm#b0-y-R=O_*%@?d zF8!|%?&|Ot3(EI37E6TlMEH2=vLC0eRl&zqjodh6Os7-VrtphoJGl*h0c@vJ*PaB8 zdeaX777tU*($nR$+8y9dT?@i5JniI0{3|6Mefhhhk94!7xYl62EDsg#m+o#NJl=SX zKS(4o{`wB#iH7>UND+o#D$6qfJ_&z8m?nSh@LOdPW^(dpv?9u*n`$GvkF>dLyq6sA zg${k*lj%{6@ijQ%#sSWP9>zV%IM?`#BftN4#NQ$1`wIC1Mx|^oEa@byMY>YDXAAcb zF&`GJAf~_8q2DHlyNlNTC|@ZReg@AZtX;wjN*ghJkJOLtBMD!8hiMsP__b1BMxy(5 zM}8i6;7xb9FO=^8L)_cIM^&7Az~}5HyCGRM31JBY>TV1W5R@Qduu!v#5I$@T)h$pd zY=Dp`5fVTW3N=}6vI+VYqJ@CklBhLun_Eax1D0MkC`1sipsi>xEl{iYK@0eWACUL| zpEI*Ld$Oqa-uL(32Tt~xnP>j<%rhTn&Y3wgtZ%6}6{^z`{(Az07T`+78&j?aRK)a1 zx(9zic!d!CZAGT=Mm>eUDW0BX@|WrHhwpGmoJY{vAVK8QkSB(-49L@u^@+S99d>27 zzyXifX9f;Hp*n-mwJ=uD8BQ-4hM}mrxGvug0&y6F7SMtQT zTJpr;+!$pjd$Z(;M^fvbg$`MUpU{B-Adz2o03bImo-IdN_GaWMd%xtRxinqsFK{HL z$cyZvMP4w-Cy7^cvf~i1!K9r<{gJm2CZ7hL>56g!Pi$dZ@Wf+pN*Si}W64u?k>rWJ zQu2|yN&t|^qcjNnq%`nMiv2Y)~)PQg=_cPRQ(wnto6LXgP&)dnwc zXjBkX*V4c<9_uK1;;_icQ)f|*;E6F!`ZK??Oni@Yr9CO9&YvTeS|=~`k#-PeF$RGk zQ5M4u-h&_Yy+#)KT*E(`yew0Ss&6+&l9y#Vn!K#HjHbSI5_!k_V3H_b@YJ1fY2can zYa~zIZ;(87|Gwm@`+Uh$_xmL8!S4piQ{Qcpr(PdQp1QD~V_MYl67;3ynePFT_kh1z z^28~YJo8;8dFK0J$rFEz$Xpi6-PSVF4ze1iB0YqEyjJinQ z^*!Nj)Fm1QL^wTOp6S0SdE&eydD{G6k|!of z_uvmm*^O<5dh0jQSN8dr8$9(^-+(YaZCij}VMFjU!81Lb83i%V>RTjKk;u15{Uy(I zu8=%s*-cQM>4-ibJkw#Z(VsFCBu|;!B+v9`OP=YIbXE|M$d|lFh_)jI7$*%p!!shs zW|b}}nX>{5+ZW6!EV(;SUKtfoz929^mjAr&6AQ&!M7(yMBTw!sT(D^I3M}~J!eF(Q zv1c%2NulV)i~usN?2bZFtCoq@Eu(yy4;sE=YV3pRA z1yWvlFmVAOmx7!97h%Ei#j-jtuxK9gGOs)$qD-a`nAvD4V|Atq7wgO^B%YbM!o25- zY=o8u?phEn5-XveQauVs)QG6GVgZ?@l%_PAQJ_H zm5J0rkpUL;VjR>MRe5Nlo}oRmw-BipmMrT&!!cI!CLxtMR)DB@F_FI+wp${SC)oxU z-o4yZ&*J3?|EGwFlv3$CqqykIt&Y43a z!75RSvwd3qN|!I{>9=^k@VhGNv7>S-BvRY>ZDFVpcnsKi#4l7Kg6pe2;VEu*G6ll|)p*`x)*L@cO1QD#Pz@`@EL9_JmSWtn| zSUf*sDhe%}2g@&>Uvl?7bMOtw#oDORPb@E7RHBx($1+z>sUDd!`iXA>GE2c)TuXnE z_3Qub_2qwb7-M?gH%X^3CO-;4MHr$9`WgO`S3#o<@5o=?Q%M;RvdXD2hAW=m(UZ@k zCuq^7#=V~7RXZ+*@!sEs%Z!%`H^={q6y6u`FymF2@Hhrgc>Lzwj5ke&S@F0Y!;E*o z36IZP3Xk8=nelE#7{};}C@08*x7LKmF|NYFi$KeRxzsnHDa#BPLQh&&q@wNkxI3MQI7OIi+-npmk)p9@$pmPO$Lxz zzat3a7*>(On*cfTc`_gunN<1Z+z3@_BTC@_;uIzr?!&m%@A3qTgD$JqTB%@J_(r zjJE`MD!+putngm8;BjA(dli_JqjR4HuN`=E;ZOaB;8J)k7CgQOkJUaNx8S9t(W?5# zXF!ElYr*6Bs?=W*@!rOowmbpCU0xwqkXn-8!&X}%Q4|yX~EkLyg3M0r1TqX z!Fv>Ve72^3e3zv3+W_O4?U#lCwo63{uK_~j^JKtj;I)7!-nF`U4m86|4R|Yv~VGp_5njWvmHLt(OCgAnr*NtAE*K!F$+* z$NpUDHwX-~r|{;3F^`=nNAiFnpGODix4^5wFZ0XSTnuBq<(`6OJg)cWyE#RaBXQ3G zGhSAjaW5p^4Y(BE7Vu`ghcUSEz)z9FdlDXIytjcj7k@U-$IW zubc2D!H;s(?-kge`pH+g+7#dw!mWs5yxQ@Hzcv~0TgaKqjbWrSxXANfKza&;L)t(Q z!+1@A0xAx}k~ooKA{F)|RGbETSAU|_wMSbc%zKJj98 z8dfgicq6QVIovV82#GsrKNWvoEmbohBY&&5cCWF)x|*>mqr|$JRxWu0j<-%MN5e68 zfR8)nIPZl2h(y25R*@1};NqUewRR3W79MiVNvk0f2^QKy?`)+v^MLb5e@oemECbT2 zuu27TIP){TZivg4IY}Ga_rOACh#6_#x2OQiR^q`d^MS!Z37a3Ne@gs5f!}z(L&nM| z<^qf6pq`Md?EiGy|5P9gE}|nT}-v_&5Y;v-o|Yp39eDkj&tXS{*WC zwi^La4yUj@kbt)bGgIB?;>vB>fx@*E{lZd7g{K#QLnGV!qCJT?2yvc#icZnlG8M$1JcIo(-(FdD|AGr{X1># zy0WkTeVux_X`?nszP=k-)-T==uWFOb#)b`Un>k}!%(J9 zKM;iJ3OkmKNMK^NgN{=o!Tz#3Iy&{E_ET}^jU}A0iqf67Kwh&%UdQSOnmb@sJi_zf zgOEP5akndBM8c$vy=pfhA70iA{Hg7KmZnu0D*x&inCG3Rpk;ts&ZL&P@duiNo1dsJ zXF45+I~F00r}bUb@xerY1y_g(3q9y~>e^w5;Hq5P!lNtt>#lxP_xUzqwJ$_kbjWww zi-vJU92PS_=opb8tt(DycrelNW!L}7@}9{03)-OP`X2Uv-DKC$d7H?tU1D6djgVhyTy6~d(;?>-Ku#V0o{+u zEaeD!hqej7iWuH(x*5P(=4wiO2b%R4p;G-oenvCH74;%g5=43&T3d zUnb@q&EcKOfnVa^ZYl!0mrDJ3A4|m(yV~m$P9eY2q931sNqM-qo~Fi6eNh)Nk;Y89cL@Ip5<7|M>ol?I-&tW)GETPS(_2-2@G zeg*yjgBO@t2G4haYX4M@hsjfRwB#wv=K=aNEi(??I*kMpn6j*CO75{rVlk-wRs|;f z8E?GwC(kxY8Da>0vmIpKkv%O-g7NDJd# zlE}+2gBN+Z(%`9zKHT7msn&WhdubE|F-h{oyGHWF^Glv$^CVA<#gZ4U9o`b2Ld&I_LoJNSuS}=6kqNNgi$zt>TuL?6J5JXU98dxPq z84*iP;1({JPdJe%ry--gnGMrSanytcpAF1`);W>x@W_T?J*J|BO!Ry&Wnx106zi!D z=cB%MwpJwAL#ii`F`2`4*=mkCrcOP@dO{hc@r_VD#d<c#Uf{hfVr%@>xwbU zYz`|~I%nmA^2OR!JyV(&xO>iggjl9LW6w~smPE}$irR#tSXQ~Dduo!Noc%0cuyk2~ z+c9CEHKmQUxy&(zb=TOaDZTC*8|6(T;SpoLU6{xe7_&&D(3l7rR#y2g(;Hv6w1gM&B%{jMSZDekKrWvQpM=^c`O}#~53x zXP$aaXvWmGr&v!YqjG9}!W$PuBBabGFq%}kOSQ{4tPdECYY zjh4UahxY-}vluH`<#-=cq~sn3W0vDsgZB?bO70h6$mhv`RRH5Xo9WY^7wE-a9BXvwk1K526uLczmB`miriP6-Hsje=7Mr zdV)qmd8Wg3IhIrD{uR6#?;PB6=nJkJ?@h_)(GxVzgvVjF!sD8AGoA~MG!eu2qx9ps zAmsC8SU&JZf~S5Q-YUFl7CaB|)O$TfRd|yucoo1?<;EeM!fUnIc?s}n7exw>``?n! zlL6a-mj#~sak!=M)>`mZ0WS~XiWJ@&3*HeEo_VhGEyTzFNW0{`ff!>+K!x`w_><3* z{$H8!I9^ryJ!`>x8SWAphd&B$n+4BHQ|+7@HPW) z1{IQ|^eeXDbplV-zbhcC^!qCqh(_#p4tTNZ-c_T28jOJX1}pwDjMu9ucm67>R|!cE6?P1A=D7{t z&q+*|q~vD7eh`h&1Hd~i(@_0A+W`g`O9Q6Kjc=OU$Qe0u%xE#o@y&ZjY#m@EZ|Ihd zcOGJHBiQlTsvT=X$@us*UFSrHdM8`;`|f!P5!3396wAvH+ruOdWYeh;GlOXPG}B#vvFdr@qKoD-I-$v8se-^bWdJ~BY!hr z7|l1k@#4eQRp*{+vDFl4Ll4dLRR)^F#nl?WM{W+!mD32}8ONMj@Pz?&VV4bIb!D!0 z*MW6iT^o<{&$ffM$KvwWl@!$F?C{n;YOBfBGG2bEx-==N$bHWxZQ;4Cy;k??@TMI0 z;?!v1j!*Po;mQp38LGF1i#rhPJQ6=}kt*ZbcR7w6g0KJmxQ_4)Ojz)JYx&5t#;)voWfU_E6m7F(z!Q+*Z;wd0nY3(>p8Zomp4i?440Q zIN7krEs5?ITtfq6%YIs0b&an%JOMgG`QT>b5OYJQEj$gi3wu#;ZwbtC%)oiI_Oi}(N8?X6oih?tz=pn5T$HbQTMP|*KLl|Kv^S;MoBVXy z#z0*GCewTXF93J|CN49uInx-!#KMvhJGWW-0*jrMbBwN621-!jvJ8cq!?(e9uv>F@ zn)o|G{2hnC-91ErJw!Y@hjVc=eXb0&rx|7VKHsS!VEszHq+oK+jUA)mKrg^uV^)3g z)RRMt3!)OyjPK>GiHvYyI|XkEI+y%FD|ZB0KkKX3xMJ@vM<@j)_tc>0+QPR%Reno< zBnLkJw;V1fN}PU9n1xNzzX?rq0t8WvXt!*6E92nf<1Q9xtZ{4<&EatfZZBi#CTs^V zP6h4PE2}FxHQW}?>IhFb5gsSfJLdzkdkS_Va2&*z1JYi_1^zqF!nG^0(+k|vME}Y& zaJH8TbyxJa!J4Jcn%%0!a_$Wi&jK-4F-FQy6_ELNTX&g`(QS{#Pxt!VFFH_u1?AqG zg5DeJs)OFVIuvH!(@g<(pOe?Y`ZtDiVM&KJD$sj+AQd(DP-VC>2esCV+Qur|n-k%j zdu+9}Hyw;SxlYzu_jGI$k*BHyx355T#c=aLGISU<%+Y>MH5s0TUY2$}NF4X<%>Hwg4aQ-WLaLxD-{ ziQcZRy+<*tTk~ICZC-9n(^4R!O}3ASuX#h5^?%!L(02kCTQSIHC6qGFBC|~To7Mnm z+l_KSx-((yWYmAyra7E|zjrQg4iD%Er;E)pM91o0N%Z<*du>`M&{$Sqw<5haGG&Q3 z@U)1R9Ke1Qw48s_SHdH~aP9n(wdQa~@riKq*|0I+OLc{+{?so+Wh>I-Q8qR2;q3Q` zCsl0|_XU|Zi2D2MZ5?wvI(TzwwaKk0Or5-`u65f4@vuEgUt4p>+&0WmBd@~4sW*2N zV^SMX!o&S877G}5gq!;(xtulUjq>3-f=G~IScMN+c>G`N&VU=7X&@eJ{&ow-t|Y#P zu!*+|!YTgroX?d5NhxBFdJ5q?B=b`f-D%xm;OtSOZo1{*FM{W>$Y)vH*%tS3i(8GL z4R3p7#H-x77Wr}7Gjae-O*ucjK<^e|Zhj)|Ltnasmhd)<`xy#KqWnm{P?ALV%ND$H zi~E?x{g&y44&&csaWA#FQ)GI-hhC|gqsM$J*O4kB-p7{oK9%8|hfLKj)%Yx?i1K?Z z`87F(eQq>8lThAc!N1?4FV`QE`0gnc|E5U5>xJ8`Wm)7OvFOizen}-Fzx}n%!ezWK zNX6H#{Vej&SoGmOl!~Y?-{mQy`!40cFWtY8_DvA!WomqfNiy^utbHlNAAw&gzPvsu z!}-1@6}tksE%=iy>3?F$ug9W4-{p}8<4VP>9_RHGQ9tW^{bUu0UlDG>UnKGQT$+lL zzV^v*%BCV$YJQ$D^uy{DL3}<;#n-6JjxL)ypXGHquSi*)lfEDZtNCiScy*4Nhdf_A zfwFMva=x0aT$km_7Ov*2N0K)^FRJ-xwrYNVOB#nuzg)25dkQs&KNenU4*w>}vuiAn zJau0rdFsAg^3**fdA>7PCwZ!|Uh*FNo|ZiGk%qd#w3v@Ul4m}~NuK%O9_*AE4gQys zXFkMPV(@1^NV?bf6?V=vcC8BYHd6apc*ye)C<~W9Ot8lJTe7@Z z6*!+yqK(Ki{qISh=}(e8)8{>lGAyHd$us>8l4traNZy0rW0Gh3?@6Ajo{@YUeo4BV z1E-u?BOv@`eWskM&%!2D0K^|vF2WAdCc+K_g^1>%3}23dh#ytwM+k4@9I~qno_0`m zn{`FiZQhC1S_8hTR%;Eel|1b>LGsj5tu>(Cek}c|ub7kXW!Sqy`ZFEg$B4;%yd-(% z5_E5_yVEWBI_E=_N3m*{=&97l$P~Pc6P$f zTyOvqcBaB04=#09sIaZ9S6=w5H4)P#&vfpTJY_}RlfZy#aZ#S>|4Q=IzeDm&{|(7A z{r4nK`+O#O4}MAd7~_{|sC5& z&Y(vHh#?9$2=#-1>#TO2}xtv1Mb_Ytc!4J4}nH zO0aZ3noiMTtp7nB7Hf}81*3!vt&GkpYAsUq1{&W|JVrj41<}Wt7dm|%_}4_Z82o<= z+AQ3it)7dqE@~`G5q@i{eRI4R`HL>wZ=KfHM6=|X&FEq#F;+(QSOTUx@TdSb(<%pomB}oe7qv}=IYY*xG_fE|)a2Ps32zxi0lhQwr zo}fp8M|)8}{wloxwBY>~?(ZU8k;2<=!D}($!ITlaR!ezMkKqbT%F)?kDUa>ItAIcC zqrH`W_ge7yZNaAqSETe?X~7!~kozG-JPx519@j{i?dL*(!XT#N`L2U}9z8)@fv4=p zdd)Dpt^1%J&|FyZmJL*dj5-7CiII z=MRO)H7n-)-j4vjYg9xz68HZwuRkt@$9EHEJf0J$Fc1{s8zi4cPml|R zpzOzIHifqWyczFf;K^4Fj26KwmwX;QLFpzuJ})Xfo^NHw<2#{j5ySYSbghOz`8*kx z1-!Z7nO_esg;!v~8wWSvohnjz(=2%R15efGOcUN3L@?_&0WT611~C<11BQGaJwacY z@|y)W!)VV!FlM}b;KizcvmwVgdALXkc@O7_>xUWdJ3y{HXlhE`MK^zi-z!muXx>5ZwHs^!ix*nie4- z8O)ix&&FX*5R-wt>2v)5RT^r|N!9PV*OxF?NY9miU3+{1hOx=osKS0+HozqZ?k{YU z4IOszw{%iH%W~dASoRi`de(pZTDi=6v#9Y#dc&rJC$C?19XJF?#MiutwaW7te zWiI_6v^6Hc?fzVAOm{!61+&LvrDLOIg90I2t#xGfZ?Oe4`;84Wgwr<`Oj%m#t4wJu z*r+#best3bd`DildmYY{3T>W|Fm=?89iBi}*VEoz_Lp*w^1FB}vv?oJp`_OpFdCLw zAs5^0PvA%LE>&oiR1jBiC z$EW;o=An}6l5pj=N*`8>iFG$vEtZ1SVo2@n`V&)cEbQ={#nbUCA zUmu4BUk1p`Ls+(R5r_}#Pq6gQwjgpRB8NoeomfhiJQ4>(74TrF*lRqve+2VDQgwj* zn1DVia7A-?I8=fnh2b6gbuSFpO{+SAymfd9|mCE(|RY&;4Y4v@*Tsb zvC;*JOw>cp#%;A56Oq>5x4T>pR4vFybZr*8LLsgrV_wXJwO8fF#uBWdSiXvNdgQRY ztU5_=mW(7=Z^2T`e z25(lVSF?9e?anwatAAzAP~YT&nSrXeb{F6bD*Nih*0}LlB3jxD%d6tCPD&j4RN}3M zlH8U8YtckJtklErF&j)aTKpZZoLO)ddqa-e>mI9mV>cFIwZ=&(e_=w%;nlPi?LW(C z-{B|(+C=Bp+T9Ct?>1~HR&-(MZOup}Jn794s#jXQ5)Jpfc(wu;dPpT0T^| zf{MUV=Xt7x2#0NL;n5x8tP`j{urE$hI!_xTWE57DjW$;5!9$$X1x2B~(f3h%uA&;Q z7Mx|l*|QMM_B7RBvp3c=m#mvvT^cvrhL)Hap6_F^9^>gf)5PBi)uLjvBEQHM|EH-p zpLmfC5Jy58$MImvXGvM*nMyR#4=M9;{hv;}n2RNZV$pN)y7R2`$WsFr8e?hOgu~(a zB6?)mtGfZYov*SYS2-HVqND?%vihaLLH$bYMd=wMSu|peA$FlLU^Bl8ovEK!7)W0D zT)eldtLDS5xu5Os7}Ot$9fm0FdP-_g{y9WzxHxrCzjdOk3njF~L$>ZX`yZ_J!^+%k zSU%c>m8#p&|Aeua^bpGMIM$Pe=bs2qI2*Orwftk*aa5z@usL3d^blqX8$8<6%#_Lc zZ2K*??C>b8N`qd^zyNW071j|Sr7_vM;<8h)JT3=qoy#x9$zv<90F&$3;3K7eWa|hg zw8pjThQLBSm}a{*6b#;G6Q;#-W@eeKkMU?Iw!Vwhfu7oS`(Vv$vp2KBi;At<-q1j0 zSqV<1dfK}&C+N+p!$S5ef?iKuL18$LsWauwa4yOd6^XT!$9S!_Gl2UmI&@>5AQ)JqNA50bGl%t>SalhIoC7z41oZt5-UV2Oh*^qTSp3YC znWD*K&zg_x51;5jVI;5OIba8!=Q;9$&_sK1^UJ&oZm&N(H4{}9OEQUp`-UMfCbGKM z8QFiQ6dFdY6ODO)s@5j!H;Q|U7-q3O*;wtBS$?GB);hJ>*c}OL?CrQ88M%+TADQ#~ z|2IFTDIxgy$olH$P7RF(6(!g_TDZXaaKy=UtqI=Pi%JT)l3b6v#vjK9O7ieE|N8?} z6jw$h46*&QGTd!ilg49vqA_^GY1R&hlL>Q~k*t4ZdZ$kTK_Gy581D7&Yw|Ni68L=( zL#l-s6d#rrTU@4beQH#U0;GY(o1AY znP7>o*czY-_@|)X2<6lcu+R+WSQs0FGIef&VNI8p~`SqNaS|s=RG6PrUgKUTKhi>`KI;TkZ!{oawFoj zz6YH~)WlCaeTCuCuB06))o8@*=T*KU)nk|AT#B&wMFdBC z0jaFpPb-8#m`miu!4DKDwKa{@i2D zon;3Qa#P1F)#5?(f6;^5HJr_~JzVY*TNgy;o>YH*MTDblnNBr@?!9rk6YQjSaWj z$M@o$qVmvD=juyO8G}ny=ILRQw*wWC0s4C!De zka$UP4t(2%*GV6}-b#vioDwqo6N6rNV?ou%-RKYBnQYrTSo1Xc(6+a3O!jmx-@Vb( zkgsiRORjo8rK&^U`UlU}&gC8X_O*|A)^7czE#J1b(btf#17m7Ms9;6zPeKJtLc53L z`l*~4&mgzMhGYiZ&@JDKn~@VY+&No2U{!hUDL$DI-qjl4Lmb3sbquIT5w}vD1=_Jk zd|T$+Weom};esl2*bVhG#M)nb&77)-cK>GP%&8}jeFS)p6EF&Q9OR1y|FF1_Ue)M> z+~$qRRqe~SZuGR<8m4NSTav4`q*R6U%^^=!%kt)__O)Qve$p`2Ru%FEr|KaaYx>ks zoz3*{tJ(?bwR<~n((AgqV88Z+wa*8)JijBM?ItbbnxqN-7cN9M29M|Fo2K0An|iZ{ z2ZwmB80pCtTcixV-lHuEEM2-_exhcT$?;?xYeYQ7fxG8pw~o6OP~0ju3StXzu*ZVC z=PihqEDDq?B5N@NiAM(=j;+Zu&Uu~c8k9~F7m1%+6ql1fDpQ?WT-jv?ucqB z_J1r5Tr&Ev6SD69=*``;GRJ&b^qU#umrWkI=HFiNlwWWc4Q+VuiaQ2rSEp>dwYGgo z?y+$X|M;`!jkDkSPUGkqzPO+L=I>ABFS+jNV}E(0p|I`cA>UiEapYI&d7EAwGhog; zC2!b{PpVA(VA{Lq7cBp`%NE^xXwS6|ZEBgf^STe$J@@x3xAuPiN?+U)znt;fRfj(K zD&76NADn*V_OG_@pVYQ_#CKNxE~WDQ8;+0tab|m9eV+S^ou3Wg;Q!^D<8L|rkAC;Q zcRFw0_y4qE{zEHj|LFO{E&qJ}^Y%X{UNa|d(c@bl{?5%c(^j?q>(S4CJbsOS>4fi{ z{{KSBUgv&1-t)m5p*!B5zx%=X()rmJZh13%<>L#^XRQP{@}vZLlT!K4*bP4ZqGxvEc@W5f86qM*7@}#7wLWfqj&!={$uUa zuZ>S>d^5h^b=Ri(;`${zmt6M6)OY@UVC6qAbNu@=6AsQgy5*05TXL@O8t*m3Z~N%> z(_dcLci*XNe>FSlv+Gt~_QLxsUzs%S(UdEFFTdXZ#XJ3}zPK@o1Kz*pt9N{T=Fd3x z#QPon-Yd>|=imPj`u#`CuYPEA_P~rYUnb8j_{;i-TmF2q@X3Gm&U*aK6BQ4i`R5N- z&Fr^vLCeu8o^|)H9+COC@BL%WmSH#i{)WScj@`a_<*LAkUp`p%q1N%z2dQ?guP^Sh zwkrqDPPyXPzkdC}WA#_fOuYP-Ri}nu>6mf%FNV2a|KRGkZpv;>avnKfbkA-3(_j4l zsK>9_eE)3)?+yNEDDM2q(_5bUjW6zY_xsCoY%BCgl z5411#Y#+V1W>(X|O2^SvkGyj2pidHpEFOH{B41p|pT2+cCu?81A$8)i5&v+$H}>Sf zf#DYqG_IMkC;6rGZ%)7Eq4K1gZyRvmKSREL1D|^3$lceZzCPxP@Snf8tZ~!MDP4#D z>5Fsz?17vUm)>>ixw+wMAA0B4eg63Kj@88nd%fKLLi(75b*t_epZDwEj=gZ<hstG;~fFF(^#TOPf7?2yXO=jWv@e?Od)ebXPl3R)rpZY4?!F zNBcfG&~#zZzIRgl?)mGG?Z$bKoQM0r_zdiVX>OwDH(;2^Fp*uuM2?B<;&j4p54-rP z!tBPxs)@L#C-(s%VM+rt2(z_6NcT{ka~wlNnEJy#KQm;KE%3BO?JCYSHUqVCF5m$9 zaoNNv0KzH$^xPBlita#g+#~clhvAhX(*L0)+^Ww|txitF+z&|`c53*mjL&@}Y+|Ro zZit>|_Fml`2(ITDzSmg7uN7-K=(!e`Eo$`$jEgid>*F?FC zG#&F;B$ls^6aKy<-A@X4vGxO51wF!D0*wvw3HP1SW&GH2+TokhhcJ577h25!B#ZoH z?JikX9+X2oVv7X^=*8-OCLW_Hz#XaBRUSM$-S=U(AVSK-AL_j-%_Ptt9~@1@O` z<)PyLRJI4@Hn&Ko{|i}vjrf;ngQXi&z0fCFt-!1rVsh9WgVwa~wB_%jRY z+r>VTr)-|&Wfju&Tj2o`I5J^@Gu`m#nhvh{BMBVv5ghQ86>)D9B4Q1QF1sx1uJfh~ zVqMl{*Ty*NJHr&o6T>5UrpYxklp%&s^2A`a)whVeKdJqPSq0Shhg>hGc(9r-Z*f9T zIoudb8Ch?5M30a$u!+P^r@z$A zLtd6k7I|4NqD%<@qNv(Ccc|p4S3vT#)gs9g`(DWp!0%eg6Y6)8r=6dXya&I3lswZX zsd~kH>OT=)#`sL$K19Bz8~&{R{7#HST=I;UDS7HSP4bKBQNbB zY-O%ja$z6!)8{c3FmUPf1#5gyyTIT*^p|yydZ_QHsfV(au$#1%Xs5jq2omK8p1NFz zi)#<53#)}%hj@?VsY|`&iM>(s#1{1pajD}g(w}xaCVATJbIE(~JBl`eJoP0hJ5UdO zq3|;5PqD$X%=8k27dE-m;Dt?OzUa@h%}Ju)08hM;xYYUQH%gv(gi~jsuarFTgbp$K zVWEQ@q6i&mFp$te>M82;BEw(QXQ`(LUb-wV=2>Uw1fm`Fy9N98b(_GTt8wwHZ|cak zbmSB8J4N!;ajE2~KjF`GgiXLR9d;#@XFMiJp6QUH>YlkjlxK~-77+)_J!Nz?@+K2vW?C?OuB2W8VDS3vElRVQU=|3=j zMHzk1;069NgBSU|!Qe%He`N5YydckPit+-V1)gs8Ew_ifd`w}O&P;={ap^^ZHR}0n zgC9x%GJ_vYe!0Qtk_Y}&{8E2C4}U;;xO5*mlYM|}f4jr>i9|E=UF82oMI zZ#MWDrfK*hN9$$}O4Vx65LXbCPg7NYs6GqX@3`PKMM z!j*P8{(xvJ@(K7AeJ}Vp@MEMuZ7=Rw@Tcury(mxrxsqo&(3JFNIWP_K#12Z{gWpEU zvmDwaPnqK;{vF9@qdFt69`CRauB|i@Q zUw%1H98__}>9OL-H)2t0lh-{B@GA z0RJP&(71YHO}B*hCrfk1kZGeaixK$KCB<) zsn4^LXZrgj&-CAtJkviZd8Yr75IISg8{|kO3M|jp$~Y5vpDHb9Y{Jm zJ&-8t>kVF%HF(NXzcla>dGtB=!cU|Hz6QKE$CG)*put13hYq`Pc;qW)epPOKt!aE^ zYT4a@Urk;#Kzu8zBB)&r7S9hX3tS}^qR-(3o!qIPU&F`#6k1H>$z+UO{Y|nxKkdAj zcvQlR7S6k>!Z=~z>k?hMU{R4!@}ghH8>w04#0R%3lZJutnY>|13)ID=%wL~&pDyu# zdlHF}*{|Ih!6YKjBT*S)U0H-_VY9te=6PVn(gpL%BcZBTFDhX9q}fPTe*7O3NvWX_ zW68z@h03xC6fG_<4M2aToE5UCWOjgg-N~EJs_A+DNc71X z8j59JX>@F(h12({SQ;-azh};}6*#6ORv;$dWnheBXAE_X27qI4?w)TFy_gkaOUJa8 z=wZGsu0_~vJ+*Jf(q-l5-7LhX=Ov49mI_uVEG~^QIBKl9B6p)1S)NzCVBTF9uPHLv zvN=Y~PuZhtHXx&RyRarJEA?FwRhb1gF8oIOE$+F=#n*0p(YKcZi$ItR#Ne4ImM&H`E*s;;bUQME}7bWG<7Df_6})*Wuf zGwnJNqk6Lj(w-No-Im}ebuj$7NGyg(rLO9^$3@J_S1~$vrL4FnmL*uGFp>(h8p0GD zqhKmVT_mZTh(G%9oU3v$p#7GVfQK18Mn&ip2G<>Yz>$QZxuAFPmpsSVq|wGt@c52R;r-Tv_XNUX>GzZc?_(1lpH&nd_u???_Z7m@ zaVer4sTy+R^XLGjdyHpM+K=x~6y5?0UK+q-={MJcmk+#r;1G}R5f$D*3*I8&DV-n| z;kg&CIUh^l;Pap&73Ykl+}3)G@?g5jxKz56P>5!{`!AC2l@_@WB{32Wf@3%Yw&m=eI=Ay7glz!_hcrMh(PJ}C>9O(ftM7> z1bv-Zzt@4sdZ$R?VWn*p-Z|ingb?w-M(}R2;Jpnz`Fce_D!hCPUUp_T-W4Xi-=lLd z>o*Pn=Dt_q{X68y=ZRF%#(}5uJII8$!Gg!{uFLvT@!_L~RB ztly((SG0>Fh4&LMHDJi+(E<7jcx&-X zJif1D81brX(Rc$;Z)5eRKZTqb?}4oD{*UjQ6keePZ#3}kN4O%&k!D-)UN_-!PDKmG7&NW1Ku(qyZ>Ym0#ZO6<)gq??d2m?VTdZk$!K%`z`QP`QmkB1dn?! zne`iudf_2}B!%~)CBL@~Hr`#bJn(8Sg4blhyA61(r-~HbqZYgt;LU{)@i>jB^80Jl z53_zR120zjZh{=+?2`=ZRD>hX_2S-z_G*Ptb3e%cBZ->^BrC{Z2#9j5pV$-wzBsu2^h=lZ8BJSIT59a^X>Ut??gXA{zq3tvzeoSX@)%{n zX#;@wpyc_(FkbH`7{4mrry+-`8X?M%9+7xTt{rk75n}vNa`#!}j$A};q($!BMdZ>g za_M;Jh?Oq)hN2Eizg)ggr$XS*aRxnz{D$}9bew^`~u z4Q}Qm85dsoME0ZdfWB!@s?j+)xrWR)pAR`;IT8RF9-T{pBF<1;pfF+z>M@WTg> z4fv*VrfnUT5A1Nwb|vEb$8poPy!Ym%Q@0%W;7HQ0OZRO$?dsp0kCTz=-t=-$8W93GdaMYOC#^c%Zp`6t!v zVzzCbTh09=z;;{3NSf(37@JfWSyE{g8;p{NoX7}1{KiMf!}K-HYkp6zp4M*LLxV>? ziH2;u*bapWMtqHO$WZ3M`D1IET^Yn!Neow#8G>a-PaE{!MVKL*#POy=X}LF;NuOB} zeRg*1qxM9K`hd4PANUj;Y2S&MI6RF97W%h{B)JJlx87aK_<4RIO4epk>5xtuCB)hmviP#~_Jm=0#9Qs{DI4{J zy$}hTkvtpUsE5j34tI8ZsKMWIt|nD;Pl^kr6y|FoZ(aP}OSRL%lt%B`M$bm1yP|!l zE8j?{vH(zyUCvu${?$0 zkaP#kk?jb^Y3|O%jM~~~Y&D~`x}1#dA~QQu4myo3E51mgy;u@ExT}f(i^O&vks3NL zJUi4j(F3zI=4|L=+dD|xdL((x9>zAdT$$+Qejs}<*M78NrNG3NDdOw#w;XF8hdlun zvbi>HXiQmkuIibsE*EXgy;}VH(q+! z`=72&*&6b+I%Qm)fTKT}iCZtcTvNuA=@w zb7creQU7J!VN6s>Q6G>YxiM5K4z`SQv2)nPETWe^i+z;hTvr-CEOj`TN0q$^|-sb#%{EKdTkv12cB-2panb61=F?Q1hI#~1YH}PE$owaZFy{id8*bm1&>4uZ?IqUwTZFy*$uoHT!SuB4Jc6QQ|BC zY%5_@*b^5*E4=6?iZ5V)v*5k~!GODMUsib_Ewo`&Aa(K~-rj6$o#GYpDT94m;?SSsPvPEV;RrU}Z)`ghhjBnKe8 z(7YLcaC5}pj1}0oqpCJ}Vea2b!omjFYsqCB@G?>pw@u`Bn8d7(2}sHxfO-W*D9^Y-4_65Mj_ z+>ODt5AXJm)vKy~Tal+{aNKyns12!~9S+~o>`gXY(S;rUBxAyghqs2p4PN)! z;$)Z0)lcLz*r^@fe1V`(2e&-=bi(P4DX(r!o*K${dEwX(-V6vCZWoD71-)sjc^c~o zSP^;k+s;&ao4qMF?my|u7?-f9ZsVEU>bjh&H9_nMv%|Ock>I8+PaiLT>14~9r}_?@ z-g&Zq`=%F82)&LRKZehk6CaF!%<1kpU$eC<K_jv453+aST^P5pGZ{79WkY3kqSB@(-R>XM zwYRaWv{%DmcS9h>{dq#e;J%Za+(VOGLtK+<$J!=dg;rHFLKBE6au&DIq?pG;{*E8w zBxW=PdFb`w>AbfkJ$+o5!GEHlB#gVExTgfYX;VWuz#VlXfI7ft1iUtH3Pgo#{gmjIvuq020?df}AFENJw@>9EcX=O`aHt77M!^}K)F~8cA-XzmZ-2S1@zB~% z-gCqbOd?C8#EpO(GSTVKIeaLM&uMi2A3pogi!<~os8AL!+sCp?`89``h?7b=ysn}K;??3!u#=hq89T;86t|nC0 zSWvse=4eGt9(pFXY__x1R&hpQVBCwx;J$fUeNzMaq>Z?_;*O1B?yRDW6)PTkBO`Nl z{ECMCFj+7`gV|k!u&GY%cO7yWCgVo&P(rZj(faCg6rU4)7;?Zm--%%o z??l*@Pi~%BXfOAsw(Uc%A$_=$%>fPdV3Mfy{-C~Qg$jW;Hq3I$=FoS#7q=h8L1jZ8 zS7o)kn7dMFb$KfH)C>2vv*ndeE`rm->TF|EM>U zZl4=U_UC`@DC}wzd+C;Y(^{P!-sHpHK0?%=36r%A;U^t}7Tr`$GDS{~w}sE*3Q zI`NLFsDv?%LM;4;$v;wrdw;G*iYt`hviY+$$KLayB>ui|e(!&t$Dm1#!M@G7O^tbDjkU%c*B-NlD!mvm zB_xJ6y4!n==ruE^M6XO4>n-#Sm>wRPgDTD5WzCcL)BIvG{<`9W;pAB@^t`?3#j|Zf zXtu2tBmN^fsQc`S{Dt<`_zLeXXQzH7Mfqjo;bElQ&oX|O^Qi1X+t``4!b8|fjvSKF z`N@$3HxJeLoTc6z#L7vxAD(}j!-PZ(;}M9Dl?W?|Q6~1@IyDnww zc-G@%#Q94Rsm7(TKg5=yaFizc{bGk$_J$6JP&E?rtZ>?;AX623^1=2NM-+zp0#i|v z{=w(h{LlppiFY5X6Q{NraZw*dietXKZi9Y{y-j3;c4gY{;`xQ7%HD9r{)@dxF;MR6 zYD~!3xG^Dgvln|~p0r^L+JYNjz->DKUE*L~_kO+7J2t2MMfjl~hsP`(PlcHhf5#VV z{?y`aPeBhT8ezxh1$cezZTB5a$}Kp`{r^yL%FnI2#t>3I(?1)lyOMH!xS>G9EtiCH z+B%bqy?Bv#!h48vf?9aK)jX7DzXT zmfU4pWX#{j98)2~+3_#%Ih`p-U50eWKj}W0bi`+<+HuNoD@8j#l;}A!`~&GW#yS3u z_k}KY>?$j?>3A=cv!=bpEAkPq)wFcEl3FN>cb3B7P-Eib>`H_l1xOe5;McMq#435z z{c`bINIWC)Hss#vEEM$;L%{@X>S0$R>ZKf~pl(l$U-QGmVZKXeeMkL^V~u}@Rj<`{ zFbUnC@c6S0LZXrIrVfd{*xflQ%Ck{>-Lg811}NY0P*>=N7r!ZD>qFJvPC3r2$4rqO z?r;8W>bE)XqOOZKEj}a}$L9!lfAkfh74DW^p$+(h%1yPsU0v(%ynu%1K*QtUVSWAi znck9=sgnvs+vJ<7Ri8dJcn?br{8NK>%*2MdX#v?KKRdms72;lWqpdCM z621rJYm`hK8^yyjq(dS*Wk`P;bb^=B-4llIlHn&?7^H$jxFPXo*_~=37we|g(I`+MGiiYW)exar}6UU2D zVVmFd&vP|4rqpii3(svD_mp+Ng^idM-=Dnk4oL11eU{M$cD8rOCYcvx7}}WM=~(xs zALBzGghD8`p%98~##YF*(E2a5wtZs%M!K+5`>+gQ3ooYxTn_XJBKPquFj11|lEmhq z*K^zeR+uZJal@v+H*CJJp|O|iN*R8h)h$wgtnUxRJO6YW-WR6ZIyy#6g^tFZGM;l* zW!E-j2_3|r^33EV_xUpT(wgd^jT&O&l>=V&)sC!scB|3{T}$wSYd}EA8pAk$`FYkm zHQH)4FpxBd%JTsG0H>HfTJGn=aIphI~1SH`z(zA!Nb1G<{yUE@Nvznq4Y#y!9sMpByi zsWB#rq%`IekrH5Vvvi2G{O@aRP5%L0r@(dB|En}{?|!~AuQ`CuANDk?XOu^|J6}hg zo}o8)Fwf#0Ue^isJuVoR&l+k zMB+7deivR-cYfjcvMZ|mnKtTxv3>d;-@a!O(52hGtO_sLgQ?fJvoT+QKfr}b=QQZ! zz&>#d&-`73s4r1<16XYxqSE!OtLA#A@@xLZIU*rj8M=rgwnqDg#_Y7J!k>c~nR_Zwa~<&T@4PS+o8m5kDPV^3 za55MSf)eDM6FFqzRGj;t_71j^0oZN5O^BcKA`C|mtU#x^q@A~JG}2&r$(j}<2*+C* z9L=4{?KyC{@6=aQ&PWCr1~c(5sOl3xkKFfQ6Zd^O%+k>@_pofp*ojy*DQGhAG-R^z zTx~W7+opSu)-K+UvXAs%Z*#v6^Rk37+Jnb1-TfzJZ?+wiEe8?Z$g7s*9XO(3``zA`KV- zwuQ!##MlMO^8BCfQT%n)0nd;nXC@yXdnhxI47cW!~P)d{S0sL`PHg!77y#od$ zdGX2pHjH6x;zTFg(6Y*PCHmNEmPZ`QvE@+v@#1X<9Y@ZfsyiX$zTMW0m+3oMX_04S zN^~7HHmym#wnr9S@gs2RQ{y_wJv;Q?%7ReS)QVg^WUotUsSYL9dGWTnS6z-P4V_fe zfP}gLFzS3RTd1inv94F0z0=w1XvbkGK$@NCkN=!1P=S-a^R`fd;rrxg1Zk;m&v~wK zNGP%0`&^?Zgh|rp8v9LMkuf2(Zc^j#Zb_JJoA`Q{E8dmnPyA%!TV1X`m0bj5v9G~|^RD)p)50W4J$er!?e6XO|*CWYbK zrVEZUU9NGa7_+`ajOnY+)p<(vtgfgbnyHnrNppLrJg|2vCSC<#t zaXe)EbGr>1^Et-dpPc<5x1k4k-wS)+HO7y^PjuVwo-;Jy0BQa8dd+8DQ%!aU_#2-> zz<7vuIrqMS=Q9xj;{IWu?0qw;bS?SuPqD#ZXb%qP21Q~RENWUex`JTr%4fN-FcJI7 zsU7O|qA^~Dazpq~7LZkl155b5i;++=yv0byI82HV0Ko8egAMJBcfaVgVz|aMX*jWF zU1|K}YP`?8ac?qf9?s&zI02jVuS}R6nAtSeJ2YqNbT1x0L>L?PdQ=GP$&NZ@XN9Qg ztF4)Y)LZe|r8J>402Tc^v4CN+4>dC&7BAElk5^U0_d;sv(* zt@9J(wZeVL`Rh7f5D)n;=|;d8V!VRKe!kYjc>rHr08c&syy-&bKJ=YV!x(A>Y@ zh6d?e^$Ge3ujqAZ2cgf|B{~V&VX#TMufM?h@9YT}LH>FMbrk6ujdRWN&?qd52|y1H zqxn_}b*=v(qf<0qE&7LLl>{bNSC)+}7>}k2S*XX-gy{M&;=#dAR17`Y&oxvvi6-9u z_-A=a0=wc0UrhEPl4D0TL{Z>hd}ngXEzYq8L(xCyi2R}k^1*xkN{6VI60oLB8(}|C zZgd~CX>OT&SW*Ztu9JBKIO@s|5H7Jl5`c$8Rj4mmiP43j91z?;o&BJAPlFnUJNy@p zi9gmdUreuNzENkyC~s$<$z^C?KJ@%KkgxORrv!g_>3CbCuXbpEbpAPFrcibNqFB(v zCTrPxtF598)^i*+=1=|oQ&f6XdA!q~nB4Yaa(?xiWdZ83BOuxV3|)UIPoog_st5>! z`e$7tG><##3~`|4pT$Qhc2fSGN#!pxTh7kFQI`=|pV(@v#LGek@9#CXY`hKG2^@?+ z8ZX0nVk1-!;N4ppipamxX?AVG>yq{|gasJ36L&_sROFp;GSth^x9o?}iP+n{ojC^f ze%vM6y-ax+pC(!g+5@;d`e*5(f;BDeW#l($p#l!#y>N6_*KfOy0reE?60vCIQY>L( zjfXjACr&KVTw<=?7}vW;xhn(B;Q`P9iIm!A$6@@-2?5O9UfUJ2qsgQ1#$-K5M*e^F z#_fISL0eK5O1`e(C11$7X3=5v3IW-JLgwdqGnABh(BV(LkTgHr=XrK(MPTY1c>RZg zc#=@Tzx=Y1_iqk%epQ#_xqs_pj>68<5B93V3o&=Lea+yu@PJn5LECE7z1#xSXh7cX zD$WTxjC2qrJhOcj0slV|@e~g2cNx#dvlDX*igWxw?-g>aX+JD*k|Y97AR{b0GXZ(C zv)vITajm0Ar1c zDTRB_C50*i?wil<)w$N+fmd=qlcklNC-_J6O)E@{mj)PBMs+^uzOh#mZwm|c zg}pJ8T{RyMug16nVjuZci%uf7yEvs49}KZL|+L9HIyY zR8&+{L~>FT5D?P{1_Tw!0t$$TiV6ytz%<|(025#U83RUwqJRO+m@%L@=74F8h;sMt zu7ajP=Y8+@|Lfjwt=Tijda7#IQ@eJh?&h2>`;%>oB-~EbC8))g*@0czq8J>8_!Y^r zhOWce1z)9x_ch70Uw?+L;p6+JSS$s&4HGNEhQn8(nf3(Zcevr}(QG>YW&*xy&SDwB z?FdGK)=V}0OWqGhFe#79(We_0@rtRf2d&rkLeqGs!=O|D6~yPA!Y0 zvAL76(;y=YLnm`9Q*(1W3sVP2CkM+xjG3dIxs!>dm7R&Dy`}viOCv`Ma|;VI6MG{w zJ3BKob1O$93rk~16GJ30uIJ4Kn$k{Ab9R zSs0l)4jSZWY-(m{;$&fGVQ6eJ$k^1#+|g*N;D09neK!gE&yvA|fn0P(k0VD6!SO+U)5732D`Am3 z)55*{;N?P*`a1Yx6&?0%MmmG(X+pe0aF|dFg{DOY1w?SA8q18B78V&eEi@ov4p(9G zf~Y$-EFda8z%MeuUnd|UVp@d04!pu@W<;2d-!%UK9UGl)hL-MlLJ_=?D%{N22rjUE zBYc9x!lz9OaWOM8hB)S!SeiD;;o_KMY-Ub$08QnW=H(b;X;$0V6m$?7Sy664kQQZZ zW@co?M46geGTgaII(pq^_Ecy%or%9H{O4H2;Od5pj2u(_a&B}#yZk+xZVzkUZ8*fji6`B)S1qaR@>^BK7PWD` zkjQaHctpUA8Nriv{6c)f0(Ia#ry0T1!gP!c4dA67I(k8ok>N9}`}PeCjtrXVYv4C6 zv~K_{(idMH)F(V*+7##z1JKZctUg>xFJnVvGeb*btDaa(6VZmnmP$+Ko8a%%QSdiH zB8L2cgiXQsbjUJ8$d9UUaTURv{2btSM<|x?5iwFt*4%$S4+VbQ#1qLTzvRXG@XdjZ zBFX49MgU2&zmRK8l5FxzLd=IB`SC=u;a5RiqGXd_UZXy?qEX=Kdt(HUBx5UxI|$;= zg7|ReBW{8qY4DL?-&V>-*?%M%7Y2VnhH?u&63itQ(|;tJ>5rjVY$(~}%^qmqL_xl{ zAnq@S2Qgi7vjmZc-{VQJZ~o=t_^%|q$(4E#f8!^?++ngv_ATgX3Fbcgo?c8cXY(I2 zN@RS^g$-N+-j?jcUI}pTEtO#2FtKF3++)knXND2|NVa@E(;a?4hjJ1=67c5bHSl{i z6u1tA_&4S%iLYhj@tD;hlFjT7Z^%O+32(4m0PRG%4Ic?+E{o|ul1+Y@j{3sEH_`3(OyiX=0?F#<@Ei50|!?O7zqPhj$hzi=fI zF-oGSCUF(P{97R?pCpK{5yVpj@r{Cbx*)zy5XV)cQ6!mNjS)bSOs*h)P!P`-#ES&+ z5=H`FoC?w%J`(We(YAPD3DS`rPv^J@`B#!T#gr0#uD@Cd{8J{-Kf~N?(!YwL@+NTw zL3v?)7X*C5`FvTBkH3Cw6iMcKV+4>SbCby>mXq;^Wl;Y*{sY3**PVGq;+TeTD_IX{Jd%{30txC&FQzw%cVXiOOk1*lQGGcQ z@4@C9GtY>BXnq;#0i;ofU9q2_J(6P7^!s*qg&(D-9Pf0hZ_zlZos9}1|$o0cY#xH%gi&x|Ji8OO#aF{Na@ zj%MS&j3mh)$i^o#-^lpv%*LlMA4va3vGG-mE&0JYzQ0`^PWLDjjCW6g{q=(J;6eHm z=-BpV2;x;F&eb2mj3oZeW$T~CtP=2DC-F{f{t{-EfG<%H-$~k&!RoJu1DOGUn7~J! zS;u4&`?>j@#^C$tPGK2p@GgAw!A8O;~^IV9pSIKQ=#ySxeRvXEwfv z$s+n3|9-}fnFp4gs=Rg_rFu;bo(5>{0r)KHAHdEV>SF{8*x#wsaWFBL45EC;PQ6j4X zdkv)X#yU-Bd6siJNTEUI2ksw;8+cZ5I;=jQlZ;pFMta5*YKm5I`q-TsJRj3^mgjd) zhxK6+hmlT{%wd+3j1Sze=-EtoS4T0f6Nr(+n_yxRBU%j!AZ%U49=0x0FKZi_Pq=L1 zyL(U<$2wx_cF`J00AYQo%3=Ihw2s4U-|^Nx5xER!)75$UX&gpgJR69Lh+L+#{A7LT zjyizR9u(1LE@az6_*s22|GGl924Ku*b<#O~G*^U+2MAJ&hz+=3i!w2loG-AI!>n!O zngmV9^MjDD55dSWj9}!zJ66=uhHxsu$T62-tp60jsPlwi>?6LNY`<@ZL=e_y(qF92 zJGgY#X3}=#5@m7eI*9Rt0Yn!*qEr@g{e>Gb2o7rvz*uKrf|0|KVB`)ZSO-GZe$dCZ zEF|e@;~Ij|#%zMo#(aX2=Q_b?3kvl!a?yFmwigF42;1JB9A?{_!(rqS{mEgry}LN9 zgXzRSY`fZW={Te`0Am~3@dFs^)F2&NzaxPMku>sRJSMim=fj z?AS&H5FPl?^MF{LZJ0`QaN>es9U6c!pVf)LRMK`bkJ$0tkxTCl0X^%-fM9HkDZ$v5 zVFY7a_?#>cZm=LM4`9q^c>p)?07f1Zx~{Tib=V{}PXjQP)rAjYEX&q~WFRu|(df*j zp*s*$5gp(VtACKgSRWk&Y`?GJ($PPnwH#*qJ%z(;zmvY!L7k0UI@&|ew$npQ=CVHG zL!6EwVs8$k-$cF~wnTiG!~GHe&S3|{c^n>&csYk%5C?L24B}u8yCX(2kcsdS?P4M0 zjX0mf{)ne@I0$h8heHs1a5xh2G!920w&rj&;v^2E-!-~&7=|N@(XYJ-#{3Zk>p(b~ zU~Hco!D#Png2fOXBpCYvubYwI7H|)O(I5E!FHA>$yf#KW9Pk=~H307=SQ~IP!Onoc z5sdy@D#4XS|FP%e01xViNpk7P6Hjm(z?lT2PAEVF86O2CDMzAj6;{>Dqcu$4;`hd?9YzTM{7=r1hfKL(JAMjOzv0czaM#P_+ zu-Ic7=4s%<55nq@YZxfXh)mdIwvXv}M&HqKhM($Yz ziy>S}FmmHm$Mc4eJDXtSMxpBiYbV*SSvyI)kV|xsRps^$vTm?;?&8u}JM%e=ZKr#p z4q~#Nuxpnwr=tvk24Jkyh+wSKfncnYol~HLe3N+T?7j)<*sf@jt^;8L!B}=Z!Ki~~ zVO?nN1%eyejvFrs+g{Rkw!LJn!15x0R)xEsS;Jwry=VwXv-SpZ>ADcmH5P^~qhZRW zBPU{PJ8m0@v3|B60b@B=l8)GmV6-cnVC3k9^Bwdx09z4^c9jy0c3mJ?2QUh~9>cn6 zzq4&W%4Tz8lHc|eE*YWZNif=sPq8r_ZN?=YG4i2^j&Pwo z1R8kLMughQ_Qggnk?jjIk63#=xOB8ZM6PYvz98dG2h-Ex9}u*SURUcOo`L4Fm7htr(4?dWVd?=z~ zHsIC=0}e|hErOAsZ6lbxAtfgF@?K{kEM;!*+^@uUNljap~+lBG-`E_jJCqwmEV- ztZjg?E_8ObMn0T!sE@X+AQ)|V%uD~oOYbA%^sz0-OYbW&F4_wJ zfM9tIC(bu`8HX4JU5OaWv1N%qTQ&nV@c9tvz@m%x=o5^(uvM_>5O8OGf=+`!w_z%| z4tM4-%fFGsEdMeNBd-V>3c~uF^dswYGL~4M|IX>KK3~mYX$UliaJU`8SkEYev7QM8 zV?6-`V?FHtNXo{MbgUDn5OQLjr37Q0to_6u6-*z>rF9}00#@i)V)fT>X>5DRm_)2G zj7w+731HM^=N(|oN1A=ahIx>I2|0g*bhNV~LpbOMk?m(;6m%Ex~qx9T2aAe?Xk! zgF1nbE(2I&IHr>40D!Trn()DNY-@Ld#SpUVA*5s9d69H%YcRpsMRY`fgK^sW$S07e`13C4Ox5RCP^5R7$35{&gMCK&5qPcYWGgJ2y94-}r z0T|1%>i}RZ2TL=Xj^)M>jO|7Fsm;5%e6}vqM_7iAJ+@!`IUV#DJxiMH7jz7W8hkWx z;Q?XSYQSh)ANXK8>f*AF810-)FxFX1FxEL3*9XwSI;Rqhb)txlav|$0;vd#mDO|b& z1R6dZX0NFLqb_R?VAMsS*W@e@X)nuD!R51k=f`2JTLUoawkNoOXAY;+%${ppI_pm| zHdud>x>$eW#tXvwllYMJC$T{X@~EA!0Ag$n| z0T^v$#|dDxe;`Rm8|?{3ThM(}AGcD(Xjc-!sQ(ASsDFrHY~Kfhv3>Y011zfpSeIbb z@h2GD6iqPNmP|0VuZCc3-)PuVk;f1)3VqgxZJ=`pZKC&OSVxm_OU4ZA=j)IO!umOd z!#WVq{TFSb&+b@1TXQaueRa03syreb;c^Jo`WRty1srpopUe;o_s@dHK<9r$PfMt*cXV&q`g zG{DG#LOI!b@j?cK^#keC4iMJ}XOr1)D4Ti~rzQXIS8Gv;NUI+?f0|g;1v%2|Lt&%^^@}M!_ED4Kp^_?;qOJqGB^T&gAg_gzzV-%_wKg_9Ev! z3&$iK+c-9xYc(Tk=vQ_;2^K{@mrxOz_zNswx1o=`8kJfa>n-Uuw{T{}tN^c&;2E^K zmYDp6O3i2jBf`Cc{r`!lxmGixhQpqJ;Vhv}GZOge(6oqOHHa$s&X{3hIemikk|_Z9J&E!2s^~dV#4e=QcAE5057UavB`QEg<1{c*~kC60&oT-N^odkEckh zV%O_X=tnSypN0++rlDJeX)|W}vT69^q0oSa7B#bz+h>Erf`8TKW=hRyU=a%U366j& ze@WDWS~Dtc-}?t5o)X_XY$<*Mu3Ele5^C!V z#xFXwB|UPUw!v^O7{BmyJ_BkGyL1JFO!mT)u?=7m!^sc^{Y7i|4@-tNE6Dnltc(#s zl#VVa%`zHJ{D!4;W;o8+0GMmI)XZq&AskmezLc(c=W+WYj)h;ii0qB57WD)U_!&XL zlOw%o$!6q@Q;+TbUsTYtW{ZUE-1|@Xc#3fNwqI!Y&jt!NTN)Lp&uL51_l-IbA51 z{6f8%g@OV8i{`eh*%Bd+INqfBHK$OSdKd=+ch$t*Gkb+Jc5}lZY0UabcXESrazwzd z{KZqEwew0eYazYR;OVr~3oWQMqv9?#{(*?6M9o77@Jcn|#XRgQm?>VN)BJzpeW4bg z8Lks}C0iu_XW~YUW(3?;46D~Kt!u8;jEG&@eo4|)qZt9a4*rs$sYVk5oW{bbhSNLv zXFmT`fo9Bf_}~)4jerK;X1Z8w<0Zte4fvUEGg4vGxO=*v45yZwMhoE5hxv`yel(|X z3C4W3uY#ijgzjsa#~-MHez4t5^A8T2ydPf_J~by>$b2 zVt;a3YYdFj*iF5~EPU|ztKvpKFW#61M!~Bx8lQ*%6PlpO{SJrfb)Cd8Um%SNJbGsZ zztfBu|IUkI$^{Mo;xl}d8!hP3Jj|!~GUy?;#YB*8@JB!VyMY!|f`4YfJd7U{@ZsM& z@NWcEDBoTIUoMXivKsh0LIe2iu!TIVhYICu3wnI}jsl-9D4~6_5Mmyd`zEk&IHXy? zhYIEUB(Sd<_zXb_`S3d>l&=;1af5H)B9bTMQwBXOV@onr0iZp|rwAeCdklYMQd|gdWdZ?5hUEU(J$B@%)@cf zL%^pEe3(y#@^umLMcX#=;kcoEcLaQ~4Z zhtY!qzI5A0zK)Pj`QSjzCjN{4iG3>teEB>+9UfnpfG+{~^dO%KZEvuEufn#`zAm6l z?K=;D&;*Kx^)weElmj^_E(1NpwwMU=%(k&VbRmv;*uOafzJtKm(zx0#;QPSi!|z~F zzNs*&`1Vym1d28Y>Y+>qJ;b&cL9uIG*U&$dZ-{`e8u;*U-c%@`gMiNv`1*qq&dXj9 zQob$%zTpy_AB21z1biXDr%U+sd3-+v{&NSuE|iSuVf3rOe@Q$(1EPohQ4jXQ{|)^c z4SckXklcW4K?&1sF%je-@L_puuOWoAy$>M{|2Oc(0$&e^Q=#1W9w9zov0WpdF(^~M zV*jdr9;PKglHszZu;8O*@z71@g z9!6&h_;i4e?yCSB_y#C9^`Gre?6U$rw80iWD3&}v2Z&SqS_}A`fe*g}MFsUxR0Vu4 zJU%DLr+m)=^ZPdn_;etR3gvqQ35ab;MiB7P^~#y#L6^as8k+K@0ACF$g8}6$B-j=c zLAC*32!yyE422N&kk1|BeESk01J_$Bly5XBA+{wMs)OMB&w!C{IE0k1uYfNXGVu2{ zR45<*CX3G(4t$G13Hg455cAN!R{*d$Tt>5k*YUapV}N=nPXQpd#R$j;o_#J5$2{aa z1Axz034CdgP6hQ)P69w|ixH494vqdB1#!$nzU^=k&*zH-LtC03>7d8wD+WF+kL?}9 z<69u$iv~V@$ftrFD02mT=YfyT4>!n1J>(xN;LHAreJ%pNM?Cx7d3*)}K75Y|uD4XE zeLV$yZ+Z5O2W4vCP{Dfe4EW%dq(La3qhLLdb8KwyL>`~6fUget#x<~U^fKLbb z=zN>R<0}x{SB!yn!Pea%)V_m)`-+LcNBh?sv}t>j1bqI$H@bnX(Z1yZz98VkeH_P& zFORQQq3QU`2R^Kq3bpSe=pnWx87Vyb{2`6ncU8c568PX2vq31|MFHP7;L`;yv~Mzm zl<&RZK1B*9M@#dgMsVL#&a*Fw$9GP^CkC?44c0aK@3esL8t~EiF@?w14sJ@pw)gP`)r--C0={tIqyCHF@j1a{;J5b~ z@M*WeX9s%x_9g(IGw7lJB6)n;0zN5q_?>+Vd|Cp&3gE+a6!~WH_-4sBweKMC>9)W( z9rXD2=?-mN@1uBpt^&SF;Je)d-*5q667VH~9@;mT$2S`mJHG#L9nounF9P)V_UR03 zv@e>+H%Y*E7x?g6o(giHcnJ7b0N)}=NBibOhx4u^sC_#He7ksjOF);l*Fv(X|B`^ul9CZUj2eR;ma)YMNIvk<@sa>>%GXN3 zR}OshTj*b90iW{-hN%M{Z0|B2-%D6?`2Fh)o!e6XJ^?+xeGYJuW=Qx}@c2#(_`HEE z3i7ES2TF;6FB161KswsD3PRf6bOB%GPwd+u;4A0Zhkm4dF#^7~z?T8}RH%JX0=_T6 zN7t*>piKEB1^dw&_#pz0D=L)lhjLT@*^X>nPuGAl<+}rV{QgJ>J`+kt^e}ouz~>Hp zx{!|kTSxTJj#P!FeAj@F+637Rcn#=bx-BMxL<1j|N4^vYseQ8qe3ii04hs;W+|vbo z2|T_u(4~Aag7N$T_~a-V(ZeX-H}UOT!}H%pqKEcQ67balUr!_;LhbVq@a^L9Z3bOx z-v|Kw{?LQQw$#7Qpoe8_Nj)cdeCd!z`FaTWOo0#Q5f#)!=>h<;Ek;1@0-r8~*dLh? zVjkKd1%Pj#Kk(^5Iu+DIsTZ^tf7C(8^ESw*e2)bFTLgUgPC_b_4}aT%*p_5C1K%RR zXx|P9DPOUGFCQKzw&cGf0>1OW2UC;f%jWTI5%8S^K0nB(LhVZv@I3-PT~I>%av-Gk zt&nc&KRvj3QKe)=52H8jqM1VqlY(Y{>}r+k3|K1<+3KT|SB?F2IL=M!sAKF%RRj0Py)10Uva6gPJib-}z7*iog?uWsy~+YUQ{bcHxe%0T zd;Q`1jNczefe&uE8iev?!2savodi8>9~G*X33`ZaNyc!fR~In)r3gaI!*YoNz6#*$ z2kBHO-y#8DIFApXMNz&00iU=d_gqNG=Plq{1ALD_3GFN4@i_?i+<_0@JxYbzH&DPA zHM)`S1ds2l;6CpyT-3GXzYl`@yooSKQ4j4q#pA0M@YMldcWNBb!{{9WUl8!=LOSx5 z5k2Hrg-*xjL33Eq)oFQLDS{rh-ImpY-`4?O2w>zp10m)i-$#M}oOQT&7eE#()PHXU z{`&%ai$DYU&Ou1|dIPffrV3w*aI8PUV2SipA@ z_@W>k?Yl(uu)Q7BoBD5JmzMq42K2B^w(vpe@7DMn^D@L~dw-}k<%pZ>$0iO%-wKRVh3ivE}d^dS~ zP`t_bTLB3gkVb{J7p7s8_D%#ox^H3s(e~mv29q1cb2{)%fH)P(hdPLDNyZA`>kk;) zdj~?whu36$zB=I3fixzU)4-<$`zIhPm^Xa)a z^4%wS$mb0oKHryaE%z__fX|lzd{8xO-vg3|e1qV_=acH*@^jV!q>L?uD7$!k4T8>c zg7H$p4C{pDW~3q5caL@QvZ|eFJ6cKYPLaXaj=}?WRKcY(NjOEy+j%K3%{#UcN&}`FaTW zbb&9Dl)-@VbrJ9#_-x634#Sm|6yU@AHY${_pI|?)1ip=+g!YNxL+x`=;jYsq z34v`NZhQ;*20|y{^*mqCk}5$+>wQkzYfSQxPl0Aa8qOX3Y?kLj+K%ByEnnxPf*uyP zg%3)kXXAAao>oHJQ7Pc_{|Vn!0pC#`AD(tX`A*0*ZErO2@tViU6O1yU9b5)2klyA{b_@)Z@RC#=ODiig~MFHOm;M2j5Awqrh zyFhQ(PxOwG=Wujfod-S2fs_=t1t(xT@EQoE0`&Yj$o`9Y_z6_vLYiet2O>#89h4ZT zS8{m$G=Q-f*M|1OB|keqFi!RSpdHkAn2vnmq>gxqqkXFI>1$+Sp~DlyW|&JcH#KE* zj0`PI3@s6QD=csv?j#b?8nNz44fO*x<6z6>ar?9$Ge@FP7xSs)q)_zFq5YkfIsUoi z|35U~ETI++fiwS_q{A6!P2$1`Jrhxw&X0?lJSpJkU|+$+{)NQutFJeI0Ov8g!il?h z-Y%ZSD_bqcSjj3b6rWjIAR%*|Nv^L?N=Q$TOP6Ef;E_QOh_4P*PYi@GRV(pnGCW=$ zhxlgV(!?wvNSuxTl%ei=M0vxqd>E!$hS~W!v&G~g`USg*A%yj z4^+zxRPFEr`Lm@VG6LP zZSR-X?vD&I>|xw6Co-kjDCF+^>|16EGfG>`*O%CzUMJS3I#6J>D6>pkyn(B%6pqQ( z7q{o;(qHoI;??2pkT{rkyJZrR**cvw-1eUlYh#rOam0#pN{EY*ws-QuETqBpF zT<8%MHa;*|xk$X;OjM-gDV}XE@>D83RJ=uX*z4~~ZUx^_JBDb_9TK!>sGEm!jCj4N zC`M_7IM7TqLTPSfqjq80@_cazu`-lUOi?)-9ISFdX}!7Vf^x-r)nWB9%5I52AX}wI zB~&R!F-7);mHS|8$04#cO6yHTH7Yhr<4i?1DlZ;ZtWzB}J5&X$Z!4CqlJ%4iRs14z zd$05498)WqD*4aWqAJ<%@`Fu8-(_##Pui|JY_g}UTjBS!7sVaLDxoSd$|;IdcDgUm zaU7x;s=VG>6sodG8Mrs8ObMduf9gNhzb-W>MeS3f#FBOODWYYmndLg^sWW0zi&vj{7=1Q9 zRdv{z%yMn9A~!lboC5YH^t*67-mSuLn&nz{CP%IbktCgS@@2lzStCr~tD`C@tYaYjl zzu`!ffRPxZ;FhJEAn`0JTdq2-I6pu4Oz{~xvG}RAY?V0AN_L5eiT<8f0Hd?`LUCoA zIYv*dAzA+Hg`52~#qy`6nBpYw^)^ysc_;YW^VhQ%AP~3xlJNF!advrnO!1sHVi~cP zr|jqcB2O8Y)Z#1~QH)G@YH@6;D5=sYMK8MUjNQ#$^0$N6o2!V$Kvz-hU1lXO7DK&a z?bE>WyW*6$BHjVeKrAf z_DGh6XoU38Be6$BxzCKgxI5cD-6sFy&F29sVnuL7b*^{bKzXquGPXy?Z!g}YUo1ZB zIeyL@cW`Q_3o2OyL>FX=|12(2xe2R;OkoZ<RG@C~uomVNsM(Q0JTd zw8RQB(oAl#_iianD66v)Uz{D?a<_Ymit;-0_0)`hKDdO2ui#fdfS~N-t8e zn}Uog){Rb$TCFZAPRp`Vfw>SO7keh1j{ZPhacO!rJDRxVR8~0L81oE9yFG8bl?|CA zN{~pAb5BUyo|2O4lXEL2Kh-rUrZ}ZMb$Zfg=<3wuq~paw&%8Gjr^<nBibZgBRkkyR3rUjS6bR`+4AY&(%sTny=-}MnK8wICLFTtoE?|dPZT3f#(ud` zwqDs*`Lk!U`g7fl(+G^=b@$n`DRyZazqqFDtxT@CUF;oG{4B2eY4LM*3e-q{hRUVB zOP5)RzDw0^c#&Ep4fR@!illPE2I)YsMhdKfTGEU1jLA=)djx9jUHr_b+P?UiPxYhX=a$eRt-ecwyT2>PNM>1yVw5*YvYnH* zac=5vNzN6}LA4l3F6+njmSlMx3(-ZA`9^u*BJ8bfpDfs0lnomUbk^&fmnmOZnAPv6 zCKjelPx~`1?OAf#y%*nW-N3Aw#n0@}H_l>7u||y)bbpQHcPX&#yW}RRJQz5VX&b>D zsr=+TaExS5>I;a#E{PCQeew{ZHFh{DC2bq5asOvqlF^p58&keNi>sXkW`HfOXp8$V zEx`^VcI3yg)w7n^HCW;*up|gA`DMpV**+yLKMuOBXiD#A$-M?ZpZQ^*Jt=-3B$j2Z z=_jg@<@_SMNecT+mh%hr4cH^g`31WMAnPp{zAV&JgD%4e*Jb9S5wgTd*+wZ*<(;#3 z$>(^iH&cU!TarnKrOQer7Uy{20;8QDSGc_}tAR8sh<+_f00%fRaNurk;a zgjKn+Re}GrGx#;Yn6S*sl+Ss-9yT*sSZdi3Auqqy*`+j%MsF@noUPw@zar~O1D#6$DOAE{A@+Be%Ay^1hnHcWO7 zPG@2Dkz(+B@@E@J226dufxYGc%ba`KHP|K({$_1c6f5H8LEBUjULJfa5P^LeX~)ur zt=3ab^%)wR;yT46#c2H3lzp|gQj%})Oo>bCRh&`+`$N(n#i`D?E#$#emC`KI4^&+&yJ>M?tPxSIJ*dm=I*p?KCqU*r+WU#%ry`EYx|CH%qxhq(n0hX8C zPR;hgQR)s0LOUA;pth0igRbo(+v}+HkqZig;VMP;EP!WrLDOM{8C_f=<>pxVQzpt>c(7)Vg z%6Yg*zLkJ83!IKKD~p}Psq7^7A@p$J+%R#0KINb3Gk`u|%1LgWNI`nCM)2qdbGA2K z7l1zdpXrlUS*gaCo31|dw^)2eZdih1s#|bvemBLGfS9EANBb1x5@Z$RaLu3c!FQNYme%3wFHU%<+dCrJU|fRZUOXe z?IaT5l3`=n65mVE0YGKP9csm|u7iOocCo7X`O*UEjQV;RD`ux!M2SO$PZzObLFfMGeb`4QGEDVi zHM{zH+j3Pj(h}P!TO=JL2j*2TRI^P`EiEtKEuG&P9t+2(CoGFAEyus#!qzSU56j(Z z<>EVcjrZxCSt8E#(b-?((0>KoFvq9IE{n@7XW&s3@L}i8m0{DMFfBP=I$mw?;RKbC zAxY)w@g)xI0{~hHl%@Jb3Rurv3Aq1u9n4xlh`CYmqQNRcOu8KX27Q_!VY}9@{m$rb z7vw6%xmAX@#KX=j=D4-17b_IWl`FPCe@1bAq0F!&?Q=Bieq=CA<|v8S#Pk$7!&JCa z!m%SFe_d+Y+rTXnjZ&8!dIJyJZqx!2><* z5+q`E({0U)AuX|U>_XMpNWbbbHT1Vkkwl^q==5G1@7i306)kwZaK20CBwo0L3ZrZHt@_c84r=Mrljp3#R;8L)nXG>J!N8b{kpjJ1S`-4 zcov8}3DU7+(yL3=pqO+5Ru-?;tyconXK_#|K@Dad)F{oXk*ltdf$FmDiWCw=Py}6D zPvi#$B-~fvRPyRx{*NJsx)Faq&r*3ByYX>b>CXP@s`c^T73x1Q2^oW4>Ku>$lw_Ez zoV~J*n)95F8MD96xPC!*YK@wzU)1gL`nA2=${OiiIk@l4R1Nbl_fq*);1d`6x17dM z#6E~=jLVQX8?>PRZ#sH_^IA*({JDQ<8PwqS3t~(=SUuAdJj_*oR$^qM%)v1e7Q0dMoGGc}vmignVz4K{{!JaB)JZ%jw+mh}Hk z=lt^D`+?sZTxrU|jgMj8S9%QSf3e@E+|lQAWjX{LU6L|uY|+aDPyevasWdx1eqCuw zrK45Ghjf#ded1yyXTP`I=J)u?(JzDT^&h;ytTpwc>v4-9+r#HBPBNN0&g5cm&CM#& zLtj2!wP8WKAAi|D9O>H4udeiL!QYEEYh~@OeR7oAgH|BMu(AK?c=&gGaDKsmTk_BU zxpdkG$cR|DUtk(v-t>BPwWfS=uT7T?maVjMJ3W4BE0^EpG$hsS;(ml}?9irdpDz!m zO0PqS$&NT-^oZ zY~Lyi>E*||oL!pZrTii(y2GHko8snoxVX<-p*a8Tp;kt>pGRw?=@oVO@TKS7)vJ%E zZ1$X{-+kTCds^l*dY(EzrR}R%bF*@t_bat?zu(8=L)-|zGQQ1xjO~OwAq;pS9dE*P zR*k1e^Z!lf{P(XP{DslH9Z{TXJm$M^LsDjuad?~nPf zT&>!=J&=F5Dmn3B{@<++q)v#qo%z~!@!|B&X{$S>X|M7r7_b(ui`B8i3T;MA_1>%ZrSqYI(pGW)8|@FS?K=6~fXx@4 zOG)L)tXd3DG8mW1m$%GXb1cEOG$M0Jcz-h=+1&$01umy-yMLIJ8u5C){^S8Yw2Jm> z1vzXOH^kv%%B}V>`Ukz1O_VC`mlidprxm_iPTt=#xnth6BYOsKOw2!Xs9(i)`OnUx z^9!b~>wA3R(j~67|KucY>3}r?zPJn07}7OGn9i#4^l1LS>74)m^~3)*KUlnO`MLqy zf!{}s38{Xu@ACEzrXTWRC1P^B?|DA1Soz(^JDd7Wx|NU{bSnCQuyG2=gZW}}U z_T8}Z`@P61PQfZ#b?>|LuSYn)(0fN3(s@SXG(>Hjk2Frhf73a?{P%tcecWkKlSYhlL?L)+kHaE-WhiGFOQ@HbUITN7|Ir;ZK;b(sMzn|W>?&p0^`yape zouc(cb3)vEk6U^d``oG9AR()`^x|6I^s&2+-2FO#^07Jj*Hpj#UNLxM+cArGI3Lvd zo-L=QT=#98XTZs=-DlsncDA!KuUIkZ%JF{b&U>HS-BZY)|FoWe$HD*o{>B=b`8 zj}Gh9!MT-=o=*4cT|e~;i&(jEQReo zT0hs$aOS7i;|%rdX3CF`IV`)PzRlh9Q!hUFJh7+dqP54PZyw>7@io4fRy5kdy0mN2 z!v{U?73|H6tLy7LO#j@t`R5AuTv@(8SgLQ?m<|)itg7kL%5iq-nGQZ0?VP@>|9iQ7uQ>dfqLY*|2n)N={rgnp_g7EIlH*!ogd zH>q7AVVa!|{G`2HztiUoG^FE`#%V~$1C7)0-*nE8|N7y7n;-smwsv>(&e2>2fCFXE*xYP`+~Jz=4&9=Va^7nCy9SZQ$~g&+p`K zs>(ULrf&9#T_sNo%HH?R(o$P+s61`?nRf;X8P?sh$9vZFIqH}4;;fx%wyNe=o0V1P z)|?vNb(iCG<1TQJwnLuad9$@Y=WE!4l0|hr+kiEdFE4@Qnt>oyYs% zGN>$iv?p%0T&1;2#|u$1W8P->?S1z09={&TDuuYXLqVg$4Mn|(zr;YM@ ze6+dNIz{E_-&3v{g`3Hz_b%-`Gi!Llr3sI;w47JIf4ih+$fX}sbGOU<*=EY!w9t8j z4bv!GU=XTqc&Pr@`O?iKg$Z|>$GDsqb2uamyx{sdh4=rju$Mu zr81w^AN1c4`Q*vg`y0<2f0%XMtJn9%zOnNMJbre=@2}k*!{-dJS-7h8kpuQqGNL!Q zpBvPT(Fl_H?GLqT<1r~&qcRVUGcHhz8I-Z_o9MyQ9pA>Q<(Eo6*6uyM`)|>wj5~e2 zn*C_4bHLa=w>-B@>9YIQ`K=?;wN2k_?eF_#(hm2S(6GtNY_#fCK3~YLx~wzt#ql3n ze_eXvcQ4ZQjOM+A`>Q;Tso&hH;9@d*>8WM2#>sj=?sU5S5u>R+FuNY~N^VIK=keDXZ=>4@Fvk^`2a}*30a(`=v2{spF&_r%z+N z0^|m#`1VQ)4Lp6+aoLCj1+&d28>6+vUmnaIBC*Xu=6A*LzS9>EJNI?fl-uol4$2sK zQR|Aar_z;>c#Fq%L;HVNeQ?>@#f#UyQ!wotIe%V8PT`W-BQqZ_c;oF7d-Iynt}{Pg zDYV-%wePXyn|YSb`}QnO`60bvOY*VrYDP91tvqHvGZdZMp#7`w0pLvj)pr3fzxr!_ zh0T?#wH?2wc5nNmRhYK&aOdbuEs@RER`7NkhS{Py@%Nk>75C$(2ATdL-D~)xhaqQA zYm|1oIw<5O=ARg!(y@HI{nnHrZc$&})C9CY;(vJf7_ZBH#U|%5zjn?!1G)OjCkCCa z-5mGa%CYiBKLzcjc~f2*;@i>Ti#l^6)1DkDEj>74M_@_vQ~$U3E#uqj4?la^!0Hs{ zro{ge&cJK?MBn7!J=?oW8{nkOB(Z~SQ$WuIrd z^1gfP?l=y55IYw0`^W#-ed6(@O5IFftyyo!*AB>kyen_AWzPEVOW687u8R9#o}Byc zsK>#TNve67>jrOlGIrUc*ZYRtiNf-B>uc`SAGq(VTCgzh3A_RWjpxV1BE!HlO`Bge^{b7(UhRX3g&s z4i2#wTUo4LGb45m=I4zFk1kB%!l5M8HWscT@Z z*X^jnpnS~t==NvH>+t>${=VbbVQB13vuB+~^huNcaBiyVTX?$-!Sdtkt0b-(+5A+1k$Pbbq?f_vOc8m;bpO^Us(bICykR?xZK~&e^k%wCZbj z`m^cz#Lfz5O{!S_^Koysy;oJdu<&zO#L)Xy&jPzDjF!~&y`nhldw(o{P9vi>z0EOM z$zBg`=7yx-yIh=m+E4ewZzh)d`!N6Yg%}<2k6kC^*Kf%@?D%=!+0?(U=t#Vj8q{XO zJk0N1H9Oh+#rLZ*R}bAt(o$~6e9$X-Kl+p35cj)2n4hg9`u48K%dujC%x$%Eg*&qB zm~HJ1P3C;4?{OCM|EJ&i2rn;`${Tj&^Pi`?TBplfdvw?|{HuG{^YQvcAR>dunoay_DNeo7uQ zyxYjMA9|C%zYVpJ48F1M`t9AThrHeLb;h90d$TV89cU+eKWgoOj4n2ppY-4Um(KAi zo}BGwta-lV_#SktasQ$01k<{dq9(dYGV%Sv3&yL3_-(SCH-4hL@cvYb3>(Sx-UHY`+# z8@YRzO1-^Z*v`!Kz8NDsCC29r_&Z-^>hCLV1id?O#5Fim?T>(wDl3b+t2`?>_iC!? z37buiJUgmhclc|J-sXMp!iMiYkoU0Ez4)8ypl%!Qo5|W0wLKiB`bzoLksIZg-V9vW zF5#JC&qD>(XSVK1aOybw!u$iOhdWnX+o~z|I^%5if#W?>S6zNDU2@4Y*?Eg-$esB6 zUe*s}l6F6|+;;NJ73*h`r$RlCnN{rRFn7yYla5!;?Mmn|_HDt&YNM*uB|cv_7_YN) zxBNQ3SN=NX{liP5^vmQ@+v?_d=sjOF=80yNrQw}$eTB^EiJP8ZcT)6PsOUY+BBtQX zB;CJl<}3(lv*5AzNN?TGy=p4|N?wpSWcB(igOyVbSjDwUJd~Ed(thJg$0x%Ej_lZJ zaKI#wF6Se>-u=<8M@Q3B6a3z9cc0kW;Pi(Dh3?}QP4n8l!+ieT&kq8nM&!I6H_Q6! zZ}Ypi>C$yeeTU)xWn(1q43+q&g>xwoHJ6>gso`|!(Sw{{FIl(pz?-s^|A>(Rd}?zz;hk2R1{Z9Ss)bB}=F36nEt8f?^L z#^)M#YiIv$iG6Iz$ypOREL^olLifQRw?U+YTqTzb#U^s2%;uW%%%yNl!+UU7LG(NS|e*RPQxju^To_$(6lT zn)%w}*xI9ApKNm5uu7_JDhg`e1eNIOFP#mzi6t z`6Kc_C_VJPo3?+BRS(UP(;xL4;Vs@ewy3RbZQEYsM||lxD8psto2_l4?P{ajyE7iT zC!gnC-F-x4<2S}}THd_O?!(UA0mAU+w8S9ydBej zl!|QbGP4Yinar}y1ipY){GJ74!v%+;!y2g3I++_z!t!;lLmzH{9Y4DYIJ zIg+2VInGM;gWT zUE}Q3xAL%G^mCV6D+)AjS@_*kmB@G6eQ};;{NO&5v!0uDUH$csHQCMwMm`_9%T+F- zZ@b&O)4#?&h+1!*=2uxbr=6Cm(Y(3iJ!ASTT&F&)t$cOf*k$8h{}wj?mD;A@y9aJp z$^{LPlr)*9H`Mb^mh_6hM|@kgdSCV{CI5cE)qSrRmeAgF;YQcsi_>R(%pb4OwVjin z*U{nO4s9;HsVN;&pc9Wy|)_S?{dbH=Zb@@(Jx_R+LR z*IjO(y^J8=W_HyGc^eGu)d1$Tua+AbPFGM*VTHSOxGT`Nv zv{6^aM6Z8eZ4y>9OosoGxwXYJPZ+q1Cp$%rm8eQFnU>y@MDw0_Q= z)^3Z=6}!3JQI70M`-Obb$rP8UPPbS5OKAwMlo=gdEJeslUxQC@bhXW&4I{Nx3ZbsGNZCLgA{Xgf?_nx8Pxv3>8w(x)6ow;s^@$7Ssq z4-F=pWLyo_-gKpUeBt3e?bk@{jZB(2F4x+zs_!2(;gf7^4{u!8!cDMw5>R> zzgKGatzLhX#LcYxe&TR<-QV}_emW%2f7rT^-`4Jy{c+fEWb3DW+U}H7Jyx_!Vc^vI z+UiG<8n?nbOn;v{{YYh-b-i!rw@r#Y^jehMS!aiqv*fgg9gc*q(J_7J5g#~g)o;iC zI(B>Zm#$-b_n9bhubWw)NY@H+zM@s(ZmAv0dLtg#JZkUxO5s}m$(6YSf-aVh9U%_g zp!0`u(v3ZXtD^oKwE5+XJvHl3EZoum-Eoy}-6qR*uN`Lh&A~JNRli;CNiPmbrB(zF zecvVh<#)%Wp4;M#>uO(5=y7D*l-YI@J7jds8TnTAfQx)&D~-)bH=o=o3Llw$Sw_F@ zZw5hiX0A$-CF|u8Dp5*4x=yMgp3E5Vgt-rhp`teFvu62gY zu+>U=rjY|aRJBVV`pEHw-^h^{kKDL=;q}V<183yzx-WA$c0}B*(XBtWy5Fkp`ZaQ2 z5134j@BHIqot0+SL9>+Qox5fDuhs55XjkiTx9+9uX?o?`I4A3#@AJNV%w^-Elgs+O z&Dm7>L1*NNBO#M_b?Y;&o9g}tcK15;e`c6(akN)T;W*LIj!|0{7qz{huIM__&2X5F z?lw&i>0K|cdKk=%7Of~axc!zv&*4inrDsYUka_)Q^p-iv??!eFNQqwbpx$uy^uJ2I z#@ZHL2o6{}@MNj(IAucx@79-foyVo#I=pA!-VPgLUuUXB7W^&wM8%>+HMOJ9?oFPt zq8&eSRaARz(y@FQ;(hMo`1CB}!b=+Wk3Wv=b4a~im4}4q>GCsQJ|1p0VqT5ozCR9R z&bb@;>C)#XJvW|T>Jkup)I-5T`K_*5rqf$-QTO6aK5o8&sz*w72N_t5S@!v&S>5cv z2hKEIcYWxrO;hvxsl3QmSL`x*pl2WLYn#8t7*v&o{kiwxyRy*F=KoBgnIyUx;t^UEGJIux1x6a&- zUq57PtA(-#T(+R^*Z+F^gR(I3-C+i3VBpFQ_RbaeFyOFm^eW`t{v`FZa) z*=}V~Jxos7=dC@nynM>hNzYrYJMiG^>yJ*klTNIWln$NH)6lNn=EJkjE;O2ubnW4lkW@V3c{z>8f6r7jvhIKrXRgkF0} zZf$c(@PnW5&J3QxoHQDi)ZuR6&~(Z(SV z+}+)S2MF%&?(XjH8l2$nPH+tb0)ZeQxP=6l;O-9&`+WDD^W%>3#=UR6#b|oZo>gnE zs;=tYG}TqS4|rq}WX1{2uOU@<$ukEtD7gAUZXa_c&1iqwT14r5>rYY+&3|2Mj2Dq2 z1OFXbF|jsQvfyjuFIP8ZxCr6!;rJr=cX}j^PtQQYOhyuV-FvarzV-QP*PFQHHYJeM z;}h=xMmZF%?fu2l{jt-@l&D@h#(j)XsOfR2qHR7bUDcEK z-)H_5P7OLRB5;V)!viyFZQMJq(QR^6b)nD!5(~%J0x7flSDQUy2+7%c=^w|cAq0j$ zHZZHYct}vO5v~f=IB8e)+O7quSBibx)su$5gRPcR%%xSb(D9X-8D9pUbEEtfjXdwe zTuLUV|3e6CVx#DfI|&=L4!Y^CRA?U)&YS?1Glrk(MTfE`Naw|M8hwi+24YI{L%T z$7Pb1*LN5y@TS4|MWfc)Co|hJ66+O~NmO1`cbuuX-u7F}#p7sVIx%y#E@ZN5A*_5N z=y)H3k8Z?g_3zWTE(@JaIPSfBF?MxXe~2eXGAQmaS3!R@g}kw8!@D$;RGxig6%JS^ zsjs?%1WREbBe8`Rd#$)SSB0)lVDFhXTC#G>Fc_2*4 zsRCtbsQI0ZNvRQU<&=b#$eck>SwN7R2C6!5q*#!A@YuK3@AMfVkag92H!EyKeS#u# zru@yA<@j5s#Jw8ItXDlHUGyzSo9Zkhl=f6>D)?-ZSe@rJ`?sT8gt=On_-q0IQL_~* z@OkPjE*#sh^f&}5Op#z`Y`m#t8Y7w_hWcz5R`XA1^$46s(Pl%B3#;sf%|Z#1>84-y zF%Lb3GEPh7?CHE;`Sr}o!Klu7u~?S0VX&3`aw>Y)c7;Ia${JemlM}VG=k+*+V9{CT z-A9SO&|qo0Zg>p_uMDFvr-9gbF7ouN!iBFeqYDY8uming3)tPm`rpxS>8C>+(X}*J zYpFd#0!0#Ex7$B$=Qp8gjizVSrBvUo`fWX=T2HX0D;vY(M7itIRf18=g?^uw43;$r z97te(3)Fh?)EL72ZeATq5f*&NY(6S({7_RJ8IdFSe`9R!^K*p%8{>1I{V>%t>`^go zFQiF}P%P@`o1=wNdoa4Pv0ADlIeU1mDaX$JSz3Usu4IdXJJs-BidZ|O zW@!i+MrGx@t|CQ#Wg@sU@P^0|2m90W+Of};C($~{sReMrjIjPXfcV_rPxE=*j+{6a z+S=dyx~>(Cz?=6sPCgkp?b>JM9vHN8mGJ3V?p<;sQ>?H+SYxfof{kYtC86?8l5;W#N_K;OFK zE4$_Wp$I1H2!}0n#1Pv%mSZJpfLdJ-T;_YRGz#{GjS@>?h1r1oq*X?X$5xbR_kTF* zWLU}$0Sl{h`FM6=Ue#5#7ALGz&)K(XM1Z=wg=&{m~C0oyWhwuH0uRdW62HwXW| z-P4r2FJ_(?VkZHin3HlC_c6#CKlY|gmFxko;m|Ww8gYt!F@s7p@K=OVHI{LKbf<28 zB6UpgJpZK7LOKKwOZyJbggD3zJMt(4@W5KSZb!6mWiJZ>=jjW#F$qDU(bv5KV=6fU ztN!M&MjnzXV<+?B(`M*JS9=9?|3IrcLNHkQh2mB#9;jSxB^d83iIBrxV5xBPNvhAm z;o|KS;xlx^G9G60&kHcNeb<&qZi~FzKEXVSt|+?0>#%_vWx}F{jb&K#0_$pmBkxsdoP|!kDj_PC1v?tz$dxuW&R&vhxM4oTM9<;Ms*&W4d3j_3l-l zmX}!M2QsZnAS@CIO%NJn(*Ee>?J;TkadBZs>HsR&03WjlGPa;%Dgpj4+u(^LZwUBv zCL72!8~*7#7HytAg&?NehbuSkP|AfYj`O4mnJv2?zJYK9lMvS$666I3JD_;*JQ3bo zr=0emA?t)gaF1J5A6@ps6rH_e-3E^|?RVm6jMz;zhu2*xb2TXIa#^vk+i+Ac|Ndih z`fg*;z0N=87!=QkFw4=`8C_-?Se+f3p}vT*Wo}gg~)}Kzh_$EsdS=gA4|1sle}!g z)apk?kRK;FK~DnN*Kaylu-o%a?EI3nW#wy!V)7-@v!E@0&e7yS{%*5@Vev zIfW{vsS37>DD&k-v&z5awugQL)ibOgp2^vEvFasp`S5Av#_!<$yUO`jZ7{I*Vm_lD zk5HDCj#|l;#KfN&55m=nswWd<_-_63qhTz^VZz##Imfv`@c@(`+g20SnmmV8LSXse zf9RIEGnt5{%Y>(55-p}ue+Z_FeJqeyopjuk=t}29Reu+vxzN^ZhHC2}n7DHG&X@?~ z$1luY{*(C%(+M4+KCpYC7T;zSIoC5=`YnT%EDt!^A4OBT79;qg<`&c3C0O zU?h;djDxRwVP276{qOet=OL~R{wJfK=a25gDmTYM)omyEs)u2%YVEx5u>PmZ0m2{~1=B7PWE^n&8~j1v{9QGm1vHX`$Z*^G@c*ou&7 zaYzphPge3VGpj0dc3t{p3ipS{=)$&P?pH}x#cwAJp%<}AEni0IJqHlw|DMvjO`zdfC*!VVOAokbq@*{TL&8c?p5j-B&?^=v5;^=*{zDLo}81E5> zn||zlQ1E5B6H1a<{NO2ao>h*75l^4mDp@lym2ySVM`_n#+y24mmp{I)W&az^%S)%pgCNAdcwm{>|D zpXu~WQro!#Z{TDX38+@CglIL}@28Vt=V9v2;QZmQK~oyYWirIc)&15cS9?C1pc#E0 zcJ7BC89pc;4988riMp*(?Le|W3__xtirOO9kr3w8AyhR1T5q~h)|yRlS0+Of%wtH~ zzjuw~J2w6bt^VxCBmnS1$4hKcVzVcWo+rP9^(?~L@{OIh#c(?NbvVbkV^ou|v&=zo>+ zC(MRhK-Q_iojJ99J)j=hR`4KxodDssXhH7o^-JxeF6v~{Yaz|(74xRY$u!?FWZsu=du#6wnzRx>WT=b!fe<@{g zk_osdP%qU*Y4E;c`pxhCyte(bQJ!5}d&jRZ69pX_<;y4!Z>GC}wZ|f<)ShWLt353H zT#Q|B=d<-`!|5+s@y+=QeLhocZS9?9s`1sBn8K4KdtQ&_+1gT8fH{(%$(Q21eILP; zbqTSA$-0IePaN8j~bq;s?*4DU^Y5hAvn?jGc^YL%6O;Xk*|!z-%C3)5ZO9Xbn;T1EIrHFm`Y?<&}2$Av%X`m$fVS)yb0Frbe4 zbK8E1(3w2+iyBUL4$jY@x4V<@F{ajor$|BJHgk+*C*0YR4lF-wy$+{aG__J~fnkWkDR7M%!?9L0-1=JOC z3AH*+5ly{nfuW&!!Joy~dt!EO#QERUhPwyhkNcuAgC@D0TR znvvpn@|VKYUqN>5Tf!7|*rtt=&e-fKn%bR4VKTifnI|a)9R=*BpFn<`G>z({2^;5L ztB%!Kwi_ecS%xjL`C6DPKo6^maL~2eO!f1P=2#ZJ6IuVnvMG@3Cx7F*cKZPlwx{TEnqcFe_%&$y$XuVL# z(U~L)E3g1vHO{-W_A;yj6p!>oS9eUOft^u_dQ6QD&V!fm`uv>tmf(KddZ-WM9Wgi~ z7_F^Z_XjHkip-iYPGKq1hHvR+EjenJ@ke-YRF_{t@!(^^9&(#VvcTr8eJF=fp&Wf& z1z<=bh%xUqm7#2esNycUb%HpyAsBlI^Mbv?`ByHt*StoVhz^-)KFWDD6jV$$$j|5_RB?XJofuH7B<_z?xF+Yas1;`wF9gzR(+?w z)ApJ-IDPxXBtJb#fUfZ>z|+e#tpP@w=@b+XZ8(ztcmWtJ!q8Vc_V8l!Wd4M_N^-)J zwoY(%hhF_OO3ge4$N;6#D>XZzxR?afs)BFDKhep#fNw6;o26TQ`k?w@cP@*|K{QVN ziswGq%XPgp$2(r;HGA5>te-Jdy@Q){H%_NF9hg#v6X8ljG&uNuu3SsjIOSSyZxk|a zG~wrfBPgDTse1~Pbi3WUU@*R0wPLx?JWDR0XUDhWx{j9%VIWq$yLT8hLd@L1&YVAS_cQ!5Rrmg9-c_jZ!}Phk=bw&)*@5TqqYII z*K(s@U$=glQeo&T?i+7F&DHH()yJtqkxDJ%ZZE}@0lP8?B`JcJGfVu5Iw?gMz@GXH7-t%i9 zKikUX`-X|Lp_G#Ix|wp3?5(JK8AIQCQ`nbMFdt|fz)arM&v>-0a^xb<|w+av{ z5Z2aHF!XNCPIq~sUjKdlA+0C~(2X1YD#7h(l5fu2!Z#@S=wDT-8mPh_e8kt;6rL!> zB@|V8u>~)Gkds*4-M);IdU9mV*nPMBF=|7GbP80@Ezpux>3&zJZePI^cQ2H-gd@%9 zh%#vlSCCR*=xpqA$om>Q5{L?&^zBrry|X+SAw(Zb77BtL_kPA?KW-SypJ(QZzhB`x!>4!==R+GK-cBx^^oEhz)Zpz zzaj6XqS}z2`}_NXKw+-4SB$iy8qpxXL18K^pq{eXR$R+ov-)?B`kYak=EGQI@v0pPstylvCQ!MUy~-xn%r?xJWcumd0u@*f9AR6Pd}^0O zHOZH6nZ7TyjH>NaC2Y2Bm=F)-t{<-0(#OSoxFGGTI*X_%n=Q8Z2`U$fO-*pUs_H?V zd5E}Auuh~lvg|UmLEWZiDTf<5Yi{8SJ9-N_WaK2kDr;a;e8Dv<0 zxu;MP$WL?3XSUm5YN{d#U%ec}I?@7gG5@xz4l?L{iO;FBYE&XkUnVy3{W237u^kz_ zXB#TTvVT^1yswv?wPgG~FY)shRIb{`95_dOkq+1FJ z{xf(xhC271E-SUefdSyYdx_FgnLX#J&@aZN(jspZ~Y-YudZ>y$+QqD>s5! zA!uj-Q-KP*sKud;V0;tb%p}1fqrHfNUh=ISW8SasWNK)keRjP!YqR5aoGb~aN^2+z z-?jI`Ei95MmRkCkJzKlpWUAFtN%&B9PY@i6-^}HkyYBgVLu$ z8uaOkbLa_D_GBO%&szWvzc2W`{@l}Iat>>pd^YRG_Sp&-xwB+7=D~s<&`qL8{z&s0E)6Y}fsk-LY z@bqx{o$J(M+AMd?)Lv92=KK`AVE6UlVEbwQ=TOa413~Z~V)#-;gZpNkeOZiRO4#A( zkL+5mRkE%LV@y?dotsH|;j%;6JHXx>TuUbyEzL5@X47C|^Lb|_DO|oqWiSUL5N0G0f8U6!{3zw+z`P2 zYxREY*rfVwA57P*dAm3P-(i}KZI6vV>OrpgF!+LJ#Sm3LiRYkW$hQqG3{L3wrfF=M zd{ZZz6JshX%TC7?*Q+#H2Zzk1Eo{d}4DDP%t2w}{`AEV6jTS>CA zZ*OrgqWMb2#$B7~6YrV9nh&qHmu?nXX@rIbp=a|pt-}nt7k4H(=eF3(@4vpU|5o25 zi#aRiTf4f{@m*|d&W$DBZEy0-<+u5q*_H$E*INBE4RX1C9pMH{cJ-QxWft_wqiu9( zG*tY+^O9?XgiCWxUe=m#TiqWDT-6d(JPbcO=kPvP#I7VLy&SX%_0~TsBUJ%E8&z@Ji#EpY#M&A=%<_ zU#Z}K7Dd1#3&W`_yK`PTaJo$zd*-iPzni6m4Vz)@(qLL~tq9H)a4;=(=v_`lYW_7o zZ@4f$yVX6L;8l{a_<+v!eFfktWYS8(PovWK<~jd7f>3-gJd3^xW6jq={T~kHoz;R{ ztUQ5HAC!Whd0aHFu9{?n`^3zYMmvj-L>Q9YiVtQOE}NX|56}EX=7Gr&UYGlVK3h3_ z3x!fVT0Pfow#PpA7T(P>f7{R^l4uPCeFzfa$HvvL!no>LKj{4=;>Sw$@tHr%5HgCU zR3RY`b;q*XmSxjO=e*5R{nX#=vHIfbC()lw#ETT4gmkal( z6QfyVLd&x+kk=F@XSo0k8;!#C%;#ZYqGBxpep_zjHXrDlu7e!c>N?~UlzUxbVD4c{mjI^^$+VPM$lgCWG+gyv^tKl642m#b2vnTBk#TCJh*LUFEgUk^N^ zdr*2Txi+_BWWG?Z*Ax@6={)oQr|&Rt9n2D%hq1blIoFp@k5G9KA)$-DBNue(hbaa#`^tPg6YWt#jBZQOflw2wPmXyNG=q*Oe? zO{~oDf^1Jir}uGPb^7zCq3$+Kax^Jg6H(Nk?ed3e-LRi}%_?4Xay&4rvV@g35`4lA zG^Y~kf`tk$T2`M_AU3XCk9YX)Pm*gFp<<_aa;_hG8^SMD zQHFD_Is`K}hTGUTuah?w|C+g0GxG{ERJP>a%)5^}^w+1O&pVDqIp_>+5!A=s9_XjI zh;3kIZ0@B+XHefOlmTu+@ePZwJ+{o#jJ3+tVDJNB5$PzJw!7vxj^F8>xj78Vv}NJ?Cb_sco9;Q@ z+&>mWL#BfVUu)RCQ^Fvzz=5|IBE0<}M+KqK+cIE;7W&>_V=of1fxZe|DJxqTZ%DC9$HR@!9s-S zwoxC}W*0kY<9;_(_%8CtqSX>b-JqZfIEr-%iqRAUjxSpSu|H=;*Och?=bbORTC8s= z{5)&7-mR-RcC*WUuS;HzYx=zG3M09L&jc$u;NA=oVc&{jUNnh+TD<28MsY115&0T= z7o6cdjrF1)ip)8VPJ!yxR_R(7Ce+s?)K^xQYkWWTnZygTNO|9I=n|95Sc-a}*Jxf% zeQNE=r|^sTodB`dK&OL}e~A9N-}hnaH9_hd9UKQyTHH-_$V`W((tw?$53#y!K6yjx zl)^cOY71r;co{^I)(OALP3aQSQZu1_^|W5y^y=eqCTEX#TjN5lf65IR)n#u~yfm>n zOkF%NG}inE88MWLm)y3&5yXQY2r zy%JC5|LHsEyaoG8LosW`PDB0S?~=SGQc;x+`Q2c@!Ns_o!S=ZYKrO?S>>u=Vxy*M< z7q`&a2@#_XKMi581e_e>y%<}_=*{wzkZBdMB9Ku~JL{U0cr|8Ug+LW%UA|8-oP=ND zxK2bx(hGOMw{l!Kdn;Ov_EHH;l$MI;oIDu}ZXYQbx zVkYe;gLl5FG521Rc=Jr_8rr^pq0M#;N9!mK_;paQm$#VOww!?&hE`QN^Cv@vfk$Lt z$VA1Ja$gTh7d4EGOR(M!0ZODz+AgV_aP_MR_aBlC%N$|1IYe3p;%WV{qhW?j*Mb*q zRh-#7)Hm)GAF|*fi33Uu0>>!O_{o9Oj-d3E7ICeyct>a!gr;AvE(ucMWvgULMTxBlwMldje;#m);7Bvs zDh+8EZ1)WredFR)9eyl^LylNn>r(o~I|dCety@pfi0l^E4yW#*1#^z;G6=tuT-Gx! zCB<($wVk|Jk8>Jk2oAxovJuJ>8I6`yj3HlevUY=iGmKszMjm z>$od&kdWsZ1@D~KHU>vw!;(Pr4&j*T>fImJbalZ}nt0(r7MVV55d~ehZ_7ttv@;+! zvA9Vh?^Kf$tO{Jj*iU$bV3{U=xJe3yPx{C2<|!RpF{=X~)eEC!@p$hF)03O{OyJo2 zW|c1_@eQcR1Z8i%bd-l%F-&zrlV__q2e15UY><`bP*l=H){fU@OQfk!)N?Mr?-5oo zPg-eY%9c9YHH+$sU+i-pI?9$cNgC>jUPv7xHiYmPJB8RP>y!>KR_5#>#f2+SH`eH+ zNu{xb4J&pJt={VrZGWDQPv{RhYX4%R)gX8KOMTlKKEC8W`#t!TU>wVh*2SBuowbW! zQd>Vl<(Pva0%yy&4;pP-h+6)rTzZPzLYxKCUrC_k}UaD1zE zTC`TM_eW1cRKyUIv;Q1~y%Z@2KhIQIr`WAs-;t6Y;+R}umixFtvqewQ+5@+)NV9swJhM?gz5n+PZ z5R?+?d@R7#hbDlmg#1NbP0J^WWlqGee6^3%fTynV8A5aNsvj@&hM6<|{&rZBORjHx zVEO1V24&VVyG#GgPNO(Z5MLF(0GYrbxEQ)S&^-io;?85H!%et}_48x?M(d#CpX|Bw zDYJ?JA-yf^_U~UvEVL+ZXR#;&o%SfUKdyaQytT^PrtIB^)Jx`2UsvEg`a&i1I+2k1 z8S=)byv{k29t;}n(pQbDA-5!J_109p_DgcG;aIkzl0}wULzB^4I6o`6Vl2!IAbl)P z;NNZwtft7PbjG+po-p)ri$jB6lzK!jm4K&p9{4VmrK085+=qpLpV{PNd!&^XdW~ z`~(kG7z7?cJ2YzNF2DT>^ku`oC1Nlq6bV(re(x(IzN6gj&wPwZg;J4YtIA?}Bv)gf z2jj{qg;;rROY&l+GjJewD{TpH4-62R)p)rUV=7mdc_!v_%=V(Mm$tOQo!3T4zpU@0A%~Cene_Y}meI-!rz!A{f3?;E+yT zMpZnxseSQU>=!RNkg`+F`C2~k z`^h^XonX|1yWe^~P;{`BsX}+{O^jV3`Nu_RONRO5!OW;y^WXGs0-Oo1f%Hve5OlRn zOxaq*$mJmmhRl(~XgeQ=o9&eLAh3x_Y;y3~!xJqB^M@j82W*0!zD;|nu%$QKuT+a> zN(;&=;OSQSv$O5cICp!niJVG>-~L?dKY+j9(+k6tU~P2~JUQ@b?+RQ~y|TIqS!kU` z|Ck#!jmL-!ua983`l!7*jcC*xu8fyhs1grMSRo)%M>96P6=}-zXw?PRXzCV4uReSq zFH6f>C6Vr`^Xg3;$5)$_DWcQ8h0p6U3B;!qd&enzH1@=7feaWMXnrQq)uo-UvHdu6 zZnlGnFB!btmA=swEP8F)7v~Kq=yYz%cM;}JZ-3!yVHSl@MP4k4CY8gg@facy9+qR5 zoDvU-B|c4I+U;z_ZkUp&i99#uiwrxVBc5)w35P>SkPE7p6f^tcNp z-`6UOadnJoJ}~VXUKQu~Cpa+S_a*}(O1_cHY8mV1TJVH|+Qw)Low@zS{*b9{`0w`$ z@9#5|5pN15Wu#WgLT zh=%nwb|X}~?4bPXZI3^cSaOrY3#LE5&8Pg6!juw#DuwrL_mg5p4a34X0)B%MhvZaP zdM^>rB)<->v*IP)*YZ*fR5|}NL9;rD1cDx+(W^eX5y1rCk?0XY+8VcgHS8~yl~&M& z{-(%82!D8?poTB@B}Ty&Q89Uq%k~b9KKkQ)q)FK8DZDtIr_mv4USBqqp;~!vXc$_O+3ZiY6n|LYQ8Xp?D5;TOv9Qd zLZcGoE^|)tg~38DG4@J0d;&Rw#ugqjOv=g4)?7+uxq-|SN%{767I#e2CY}n9U{f6X z>fCR)PLD%(*=Kt4l-eVCMo6C)tg-Q`%g3`cQdMt_vcV309dX~Rup{Tc4U?#?Ga-$V zF_%iA=AxMOCrj18IqDk^vX#Lb7_c2l&CP*g#*=ndW05Op_+k+%e^O?bDx?v4G{gJ) zPahb(kZCCRduIW)}$0m%*O*6r&U!**(?c{g{0|Z_JfPoC~)}8S7JTt!oX5umZIZb-*C}5 z`gAyZ<2@#4w*_42?w8oHQ7e*Pfm&P zDp~}ywTsT;->x}cdN_5N!ohW^`Usaj6;;@YrEC6Pdl-~?pw|o^`i1^pjvq-dqOB>BG0<6c0#)mhys-Z9+3z z6~(UT_m~`qh71R9MfD@{&`>YQ$_J{Yq+r0bTV3kq_qwL7)vp~3pyg*fAERX@ex==7 z^|vDzzE-N@LHYiRV-tpl*)QOzLXuQ^`EjrkKXQ~@Ac*#^!B#X?(s+GQ>0N&#j`qk` z{|@VL@g5RhOJ6Q^1tl45Ugcs5TarE#(ZzmS49Ss+4y;x-1{+Jqn>=bMzWwbS?%i0f z#gVLz(E!|omd-rUPxGWGtP4Im^F6ti=bcd{o^tGM(<9Lt{Q0fa$f`_-9pz5`yG?8@ zsBK$)v{wZ4LhcBTc7MP$OVuC}Vr>%A-!StZqJWvG}PJDAY7*g5*LGvmHKoM1>d zW?E;dWf&UxT!YiI5}?vwb-HGq7m|9(@-=DI$4gMu)vD$|gJs)d#_b2ALT&ScdTRVvm=B%`yqwMbZ#@Jgt!ygt-Khit*#h!3g4#a1zf6rC&e&uc(smwt8p z)R5Si*qivrT1tY!Q%_^VvN4qM&yL*`beaWaI9I_B_)9EYWib^X&yN-<;iH{{r_HZN*m1^wveRL1JmAEN56av&ghb(0WjXn<3PPbzQH5dqx? zX)%TqP1bRUv$sP|H3)|j+Ra*2pO{3i6{os4=pVHSBPyyo=7K+qU5qb{VKg3&i-|4j zC9}YP^x|z>TSIXaB;;5FYw_(g?Y@IC4KLl6STmD|n__<7XcP9!xts8l8pi{oUigdAPtAp+Ix>JW#*br zRa5Qv!6J>D@0=y-%svWceWT>0fI_WyHjW=mhY3^PO0EZ_i$7tPA6nhW^uwJnAymZh zK<-A`B((Y3@N5gNuG(0a zN(>R=RG0Sp$=gj_;_yPd(DQsDlShE73y_j?VS^R%D_p)EiAA;h%?HngUGE5<^tos# zQec&6OV2{#eN80T6vAH3f`$Y6$-2J%Ai<23y_tL>fu9up@SnH&(EerV>yvV{1X?S4 z8XS^YZLF3=PP7g9&Z`jI>=k8udb$#aHO%Mk{suU;f3oj}=W*8Y)G+irXWwWN32V|1 zj2#RY`5RAl3G`gxL<$q{CGNtQdWKCtwxGFAet9)SnRD}-2;thLF=k(fWCw2fOm+^t z|AK>iaHvY>#t+wU z?fC4?ICXp$^3UstaPPe#v(|;1 z1-=rjyd$F^WmZ)Preanp9F#0%%m%6**LWxfWBhmtcd$^r!I{jEve_@xzrDUSpoq<; zN0WVWbXkUlieGGOg=y zvoPyeiO$x>mn9m#-}Ef!@TMWUo7z-@O@_NrNQD=!xe14(cB$0AH89&tQ~BZXbym)G z*b-*N5oZgAqsextOh4h1_{V@$ja2OB8?f&T<(XlN2r}#N3~Ex7Nl{H0tEQ-7h#wmT zWqZG^_sv=xR9-w76`WLT*yKFK^dWc=?NC*4Gmr%aAx>W*lVPX!#TTPb*ZJGD*@g7y zngeEznU`nKOF|Dy=M2{+X$gIH82<2tt0h3V%c>$OO;udp)O~@}Md7aBa;u&}>*UmR z8T~vYflkJJCB|7rRX6|9rLkwXq|H9pgd>rW&O-o-&bz$9f~Q$(b+MK3%`96qh3H}A zSlJNREu#18wW17auEDx_XcseQ2)793n_9+J#u474dS^{J1URWE^2k8c#|}G3PF%Bt z{pL)}E=XeC+fONZS8RokqCXQev7L`uDKz$sd(qc&1dvb-VY0J;OEsL^_V8;A1T$Sf zqF(Ac@z>|6!&C>-WOR{!O%`9Vbo(l>z+n%Fvv*BO(G{kA^~dw3Z>~xQme6C|x?bU8 zr!CbP8-uq@YikWC*3U{~a2x9Cu>Q_*z#CIEnZpiN%Cs#gQdPrYE84wdE>{g$!{CVS zfc{E=^|~69c;;y2)L8ikmDZA2*X!z35+)P_3`MEkH)}~;)4>(5<4Z>B?>lgj-l}|6 zvG>H)d?&R)o%kW!e@1$7Q0a>q8x|>1{ZaNmHfan ztZ?xeCkCr6lixXoK(g6DQ{vm)OvO=~O=M+y+0|iwv>Y_fpLB;5$nojq25=hoB%g-X z9K3!}9luYmfk;c+!#ce#x`0Q3d^69+oauR}+JR24i$#FBM<4rkCf+ zmia@3;!0OlA=tZvxKr_JJWG0e|CJ=4^Du(gtE~0(-#MKRBF45X!j1=5y)img(nppQ zU5>c-84p2Qy}bu_T6TILtk`1tR}_PU~NxtK8W*^WIysdQ+G+tUUn%hBqADN zn0nt^B57tZrQSbEcGDs(sc$K%+%3w?J-D|m-g~qxpJ+7m1@bmf_S44{w~=o+A7p@+ z&s&)qoEoj|+`@!xz7;dg{T+u;_Zu=Odk^gsU!FvP3oNCZOC>zbHnW{R1e*`nn5@(F zTi&8hADuDmfL3zRz+*UwR%nyUKgX2y$hMBCjMbZFEi*DUh( ze0hI<-J22F;kR$;6kWrLhH{Mwqi`cLzI~-Yvh(wg---{@b}%!%DPl2vdeu<74Q;8W z)@$z^*lMg)^=$`7?Z;^>HDBc9v2 zG5w2}%kFkj&L4VUK9Ib<(k~lm`Vkm%w3YiU&K1rIQMr0k-r>VwmG8T2UaLmr@~;F3 zUuG;ZTdOFlM3(j>RCM+2B{FB7EQ_KVUvp%b!T%xe9++x2*y!VFrxE&bXek`->PT3k*7^PRWfG8eI&G?9hdG<5WRQ+}5t3z+Q0a_B5SDdBF zvNRlr8^31+2h*z+l+&vOb8ltBj-xv^DX1&<2ooU-`YK?fMzrX(S7Y6F*&5#bAdxj% zdw&5PP4~IK{>ROEeh-8d4eELMp=$Hfv|X7htliMUP4|~G^Td(eQ+V5yDad1u5uTeR zR8_3)U4w-sHCf)>`Nq+svV1G49lq|RD9|H_EP=%9XVu>N$A{}G-Dgn{;wz2HfPY<- zMM)lJy|cYGVjnH*ny`uM?QI^mYLuKEyGpg;Rv#@E-BoY z5?dtWUkdT@CTBz6_YZ@yQ6El$eo#X7v{Vb35YZ>$=?l@Dm+En?#HxA>Ol}Uaw(o=K zeqUVCNyr~L7+Rv4S+9gYCNOckl6;BXs`p8>jDaC73mUInz0Fg3XRKh-C7-uKpUq>j zh6ml3HH6>7N*F1olbfUHO9x5}OhMBSk}T31f%)dK*q-C8AX&=RFXZKJ%Lj{?0sZE+ zHafl^@^iR_aOe8t7YXX77(&*zO{dMD)Uv-k4x?qta&3|sOYjc=u;86|yYn`v306gN zLQE75#zD!>vtKWTV`W>5HE>~)mmyiZi9PofEoy8Z2ggTRZYEMLZEP8KjmC(1XBaAy0YGm($x!HF-i& z1hKqHn~Pnb=j#yCk+Y|;A+orrWq^~DkONA(=AuLZx2qlB9Vf=wC#(+b682bX;!51N z^l_6F4669JSK#yBg0+@aS1K&%`GQfKKQ-F=z0`x19~K93!Gi8^EsQQZ-q`Q43M1n!aqwKGqb$tF7HG&i zX6A{^>M3NIV0^^U6R#_KHsyaBRW=k!G~gp)CW*QmcM)MKsHN#bckWQ(XLw&dkbL1* z{e6E?_B|D`>0=1rmh>qK!jQHwPk*@M!3}n)`$3>y>aO&`O8J?*&qv|hsTFo(af+y7 zzQ-c)z7&*cWRD5DmTtsXJL=cJ=I%OA`@v=!w>(zCZQ9U^wr%aV>xM=@6%ZOP%ZHI> z?rwJ|h^+{>1u?vWVLg^h5v+Nyltg(q8Naj#2_-swtreN{CCFG#m4FA<$5KghXJ4Jo z!DOdOMrxO0X9qrg>$;qt9HI9t7N)tr+TwPX5A>!13e%5KkW1z8t}L3J@H41K2~p;OF-RzyL>Z zg1<(;J&k{R!r%ZCpakNP|Kc6M*Foch1^&WOz~0mT*#w?8Fd!O0{A>2Zzi|wJ2hw|9 z1O^O<1;U^9&nED+fdS!w*2^^eARGadJ})5gWCBkc7!U~@g39we=nEV`0&+q6&*RF$ zfFPjcY5#05I2afK#ruLofZ@MJn>{7?OFtA41?j)={(t~T{{;sCrXc+n90=Hh^oXBa zfB{~B+tdEph@Unvz#GT`>AhedAQ7Y&@RSb>@CC3ydM~^?Knc=&!5#o7Nbd!E0(+qP zM+ctEO9!BXKYe&I;-?J^a032*5BUW<1H7R6e!(t)GN`^^^j(3bf9cx;E+GBqu)zQa zU>c+C-LG|&1tpSC9>DvG{|I)VwhCuo+>CJ(Nf9YEQ zJO9$R1T_DpPX_RV^s%2}0t1WyQIP%%HU>;U`Y+f72>qA7DXdKtbO8m>`TzOk7aYI?SU~zO?NJd>1nIwEC7|`$(UZMkRUita_kxvygclmbs{r-? z>JMtbE=a%O$qzVy1werGh@bL-0a5@NNbdzp15qHo7c2*8f%IOm3}E<_@7ai-HZVXI z@cdVQkOzW6ec_j%@__^JfHO$%r9JQhNg%x!%m>_n^j@$4Fb>jt!Ti8qlYc(Be8KMk@PD;8 z!51;mZ-~EEL;7EbAOMiq|L}1Ci+uV7@f6=b4FY)mPx!42Ea9U7`tEW9U@OR^T zIS2uef!Mz>1pxoA{LY}>|2I$dpY$}qG3b20=(+qSJ>7rOGyDfL{RjX3_SDN^h^Ozz ze;Ne9{!jQ+{{PlD*MIo`mKW3*L8%}B(8cC|F#mt@zxxjs_zxBY<~d&uy|l-8;F9p4 zI00y9`zKBW=0KRF#nnU15i!>Pn-sP12wsq z^y$C@=oaM#X8`z5_e#(9f-?a~>VM)afE3ikU-)d`73Dwq9Do|sC0_Vk0Ga%sd>+6E z>OwDkK7dL3Prd+P19iC{wH4qToC^g7XxjeQ~Z*?1egVNffrl~WPqB;3oZj% zasQdW9N2rl5I@-qUje{9fA}9<3Gg!h6aPQty?J;PMHfEW)iaR+B1T0-L2VQ@CfGd_m#v5b#n{CLLmoQ*QSJg^97jq|b0FX9h4t7U!>U+Zj;`9=Ie=O;O(h(F}) zF7u1{!_F9)U&J4AX3G2`{-|@6%rD~WoCjro5r542Qsx)&$DOduFXB%)-^nF|_>)c- znP0@$J3k)m_y_T)oD7*?#GiILAZ|HoM<^NV* z{*p6F<`?moow&>|;;%T%WquKV)zOa-><9ECPO8{AzWMH}dOU=UgMd z-gBBVs0-x(eW%{YuMeCXyXp21or{h9`pCI8UAKSiEHmLy<`?m8&YLp7i2vn0Df5f?-_Cn7zld*l zHp%=V?ue~2zlaObBJ+#5E54NZMLZ-fk@-bDEN=7k_N9punO|hzMO-ZNi+Cq7Ugj6^ zh?p(&i+E?T5&;~W{AuT zy}sQ=h7sRAM3xcXJw*>AzTL$TBffiy-bQ?Th$D^o?kzsf(d+9e{*qf}YTrI$!%*G6 zulNXWWZ)osFL86W&U=fe<@J;7`-vZo{M%n-81Xwmj5gxuiKv{PbbcSP;xOI+fnu$^ zev=**@Y&h*5HUi4PHla(syo70c!L5+5ek$n}NzaPgU3Ux?=j zA;*{a2r)#CFYzPAWI4XXj}k{_QkRI26a{j8i61R;<@gdmMw}(bm-w+_oE%@`xuRH( zFY!@gf*fDs$BDD$_!1v2GLF>iA0x8ldPMfI;s?3D5FaOYlj}F}&&u_M_$2X}TwjQvB%*SCA)YTT$k6?t zEN08~h3u2XMRI*1K1Gzv^@aFUaj9Hih@T>A zb7TINi#z1{Lj9`{&l>YrJsqY#gq%VG@_Wdc!FZJMnT!`PUd(vRIaRh7(-@xLidxxT z;^&AQ*jxEycdbz;06Z{qXC z0y*Bq&lM}>dPDqQVv!tg;tRwox!w>zPc+E!CVsxSU9LC8FA$f@@g`m`?vd*a@r7cA zalgMvtd;8x*)J4l$n}Q!VliK?H^eUzBjtXP_{HLMx!w@JMC>QmbK(u+D7jxGzC={W z^@jLTu?ztm#4i<3%k_r%GV!5YZ-`$eGUR$r{Bn^c_lv}@5af-%hn(3uh5d2~X6{3bD1<{R-(n z?tkwPVVQ4aZx#m{_rG_FQ)Ir8{Vq|1i2{cQU&6Ut+%EHt_&s8?%s1lqir?h*jre_H zFPU$|?`Qc|>F7rY-XG~l$T>%+kdM`j*DxMuyw*9?$hS3OtdVaIh=`GIYsDc(zC9>T zGxF^rG0(`ihs9k+zC9vZjC^}k{3++32Q3rMICB%i<#=-(C^h_MjA?`d(%E zHjj+*d&sF{d_LpnGX5{d7chRFQ*Oj#i@4N?$7^DeG5=l{Wkx*S5H}g|cvGx5;_;Sf zH{$WO=w{^GJ7ScPZ>^%xn1Anz<^8D19()MrJ+VgakBGl7n&keH_y^*VZXkrigD>HH zC~h>LKZz&P(W>kpi(BRX$b&NBY!#cjpjFvF5qBB+^QmZw==RS<$q1c)E-vnahQ>BZ6a@9UH`TCm)w7%Tj6{ouH9R=e=A-xt`FadZ;bi+U$LK&Z~qfV z8Ts}-%eM>2x%?h->KR|i_#(zHWPCB>7df}ce8X~E9a~H~dBl|AyP3H3`cc#oYvPax{nQz29yAL9OgLoJBHJNY3ySiaHpNXft z2g>!0_^$3LGT(@Ib8BS25#P-{$cS%-J1Rr3Z+Ew!5#K%Bnrj7+^z`V zAilrb&xqdv?sPd{$?m!5%K1vXk9)7Yz7jvseNkRti67)XD6g-?`?{~m>nrht-N)qh zmG~j3%4$uf+Sg&&um7@x$EDBYp#2iVl4b!OuVGN62Z=DeRw?Fus)WOBr9r_+`!ya=pm~3p}54ca!ZUKG=O- zt~bQ9-FCU&5I@2_NRBu0A?_$S-o%Hxak<_QALcHX>kaYY?z3{eA)e!YCf6I{BitTx zyon#_4w2(c{3y4#9B<+y-6Q3A6F=HLP>wh8W87Rh-o%e}Gv#;_&vnPi@g_dX&649y z{5W@l9B<;I-5=z7Lwt<8n_QoWk9A*{>kaX7Zo6D>h#&7hDAya}dG2d+y&*o{4a@bM z_zCWTay=)0qI-&5Z-`HDYvg)Ee4=~1TyKa^ayQHMhWJVDadN#Op6|}caQuV#$!?xp zZ-`HJXUX-3_!M`NTyKa^b<5;>L;MtXs$6e~Pjjo~dPDqFcW)zp1@2JK@ei_}=61;W zLi}{MhY`Os+;@%qo9_N*YUx?z6`HEq5D?_*J;K%k_rzm2ADa!qJbA)2LHeZ?0r~IphCkd(uw z{65C-XM7Fg4=}!#@dp`yi1CLRe}wTz8DGcvV~jt}_!Epj$@qH4pJM!J#y2p&k?~E8 zKg0ND#-C;UImZ9PcnjmtGyVeOFEaiT<1aJ*3gfRbzJ>AE7=NAdHyD4D@wXU%oAGxT zZ)N;l#@}Q7ea1gv{6oe+V*F#qw=(_-YYL#Q4vQ|HAmMjQ_@X2jjmp{s-fKGQN%RzZn0U@$HPmmO(p0 zj$qtnJjA&AYZl}Le%_ba)lYvbdnaa(Fy5K*E{u0&Je~1f8SlpUZj5IzzB}W4Fuo__ z-5JOKRgyeHP7lWSX1pik`!K#QW6ywJ+KAQ0{jH~~hqWUwA*^g&DkMZ%0pTPKu zj89;EBIA=7KZ)^t#?@b`Q|+J3>{A$@%J?aaPh%U`k1{@!@gl~H8ILhOi}BfvmoQ$+_}PrlVZ4m-a>gqduVlQ6arM`ARQ#%$ zy@v5PWqcmvb&Stv{9MNW#rOio&tv?2#xG#Jp7Di@FJk;c#uqbw5#tv#ehK3Z zj4xq)DdU$izKrq97{8qHD;RHN{7S}`GyZSJS1^7R<5x3&4dYFWU(5JP#;;@idd6>H z{6@xaVtf_jH#5GP@mmOa#@8_Z0OM;J ze~|Hq7=M`YM;L#U@pX(p#`xomKf(BujIU?>DaM~>d;{Yf8Q;YCGmLL${8`4IWBfmi zw=n)Z<1aA&BI7SH{xajQF#amzTNrRe~at3D{5{6sXZ!=k zKVDgaK`&HK7jEo z#`*i_LCijw@odJAV0;MULm3~&_;AK^7$3p-k&GY3_(;Z&W?cRD2o=v`nLU^BQH&qQ z_-Mw*Fg}*?af~0&cpl^989#yX6B(bt_(aAhF@6%``HY{;_+-YXFg}&>Qy8Dd_^FH+ zFn${2r!#&AGlku|{FJycM-Cl1Ipy$#@at#f--opT+oW#!DD4W&CW$=P+Kz zcsb)0jPv)wRm^@4d6q=raoSPcVOznZK`?{SC%DN0KL?zh+kd3dT__8mN=_ zT`VDtZp7(mbsYSW3sLJszfVH`5|*A=ektjDBVI<>Lwp(GzKAa;oQe1f!u=695*~zj zG2tPIuOysN$L^H?Z{%pa_ifGSZ;fl zA(mU-M#OTvy8^M?S~nq<+v@8P%PsXP#OJ^_IBtb6A#dfH5zE`Sdl1W8xHX97?b}0$ z<*nj6#PT-rNyPFNaRcHC_y)&j_!9EbLPPK;u!fKgcutO2f7gQwP+4vY&aYv z5zE)3xrpVf(J_eSYtRXZi%6f3_&LH;5zANk1&HNq`ss*qK;W2xSia6LMl4_5mmrRk zrV8;Y!g0hm6UI;qOd>ci^kOyPdc^WaP!=P;jmnoHo=&(C@wtRoApRHOCdB6xz8>)c z!mALUNBCC67ZAo}O6~4SV_QZ@jBUx47~3*dVrz^+^9_j|s0-%~mWKgvl^ApRD~ZzqW7?r612Db~N8BCo9};69@hvo# z_Xdo<5Mv*^N{oHnUt##{D{(rM50E$mFir{IKj0jRdjigtI1}(`688ptw!|Lb#S(7? ze1*iH170a{8(>@-&_DL6Sz??%_*4nYao*z-Bg7qm-;{V8V0?0e<$3UlPhAk>e8MLn zi1XnSmr=x1;S-ly#0BuVP2%bBDWD9?F>ZJ_jd%v&t`cM1@Gce0F>ZJVhPW8Y50^L- zFy854d4Iro*MWEtV7wzhJOnWA<`H8oaVL#<_80ORkYMBE?n_Y(I7 z+y@qPRX$kaK~O$SVmx<@#5sUxOPmQ94{;j#1eZR>9E?beb3I*RoO2lx`)jAfnGiGV z8~V8bF!l}c0?>OBV{EXkSdMvxbtA^{!Tun|^&Z=exG!k%5G$}%u$Cgeif|{u-Os>M zm=~Z!j22%b_YZ#i<=%J#*t+8d2M+&w1Q@l|@P*~5#UrRL-w$4t;DE3>-3xu_;N3oA z^n-WKi2slL%p^b8fP?OU(a&uX2l~<5P)z5(iQ@x*pGF0z-ae1df#P#{k~sIelS0~^vYmdLucLONFCoW$cfj52;2Ru%+W;rp1{m9x2VbZ`e|TGh z82v4f82#ZPZh^#y!;jUig#CKu9PEjj+o;?_d^=%mzmPZgIf$F79P1T#63$0_7vUL* z?)b%Z0Z7Kz6Q;~r5wP8hGRLOy)RMEoR`<6cCpC!C8IHwbXx{z*JdxB&46 z!nh9*xN(33ul-^ZVdUZ&!V$!{p@1U;u|5{hQn`oa&k-Jk_&*CT#~a3f;e$iUHrcnjfX#IF%vgZOpA8xYF}FD;1Qr1Dn8 zxCw$|D}0H!3AZDDhj0htR>J;Ryi3?03*0op;g7}pg#EGjfUrLn9}@P*;v>TTSbR*_ zAB(Mo{jtE!7aaard`cL(_>6D_@#lmy5bI;{1(kbPjvF^P1|gOYp>hznQF$KXuLi4aT#xvFgc}j##t@Ds#O;Ke5&uAV4dNdOZ$SJL;TFU{6K+NP z3*oJZe|J7Iq; z{3{MTN5Z)v@aiMS!X=Dc$X|LKK^&&?48;0a;N}+&55B}Mga;w+L^ua=gm50>&V=(3 zcOg6jaaY16h|>wzA>Ng6J>qVJ8xikDxCwCv;bz3U6JCRO55gM|?@71?ad*P4i1#AA z6>$&3?TFvDk;OKNkBE_Q#?ZVSg-o6ZXeqKf?Z4>`&MqivtMzW8o3@ z$D$A6Djb&s3D+Y&h;ReqzJ!|)A53@^;zJ0pL3}9Tb%=432}cX!euTFmK8)~I#D^1Z zL)@Qm2V%U5!2?o9WD(9lJdkit#DfTDB9_0Hdl2GmD$hlH1mQfyLkJfj9!huyV!TO$ zqYCkG!gYvq2sa=eLAVj|k%U(vK8kQN;*o^cA;z06I5r?YhVT}|#}aNuoJ+V3@hHOW zh>s(T=Zn#VBZ$Wk&Oofsg|SrbVfi@1gAgB2I0tba;XK6S3Fjj|f$$8(ClW3}Jb`c> z;)#Uo5lVbvsf1e*pF(&m;%S825uZx9191W2 z2f}!mAL^BD@CiY{Kghmk@42TuOKg;bJD3|4gfkFV67Go@ zZ`R?+M0^h6L5Qmf=OUKBY&{QgoXQIj*AkwAcrM{8#PbN(A+96bfOtOPM#Se5UWNEy zgqsn=-~Yj59pdu{Z$NxL;Vp>q#uJWK#Px*R5HBR$j(8Da)QJlTM-VS2oPk)M3l~wj zhvgR&9)$Q3!a0Z=2a0GMXTEZEKR}%IRUq?6-@%4mr z5Z^#J7x9gR^AX=fxB&4g!X=1rCR~MhHDPE1+(!_OAikAw24a0IZliJ!%Wo$<2=N_+ za}YNZ&O>}B;e5n*5uSngZo(yq?;%`=_+G;Gi0>oZi1>cOO^DYJZbtk7;WdcY65fFL zLBcJFA0pg}_+i3Z5kEq>9r2@tI}ooU?2pA`g#EF2oUlI@PZ0LU;z`2(Sga@PkHu4j z{jqqOus;?X2>WBPk+44&n+QV_;68$I1o39V8Hn|I^hk7-yqzA_)WsC zh~FZ-74h4I+Y!G*xC3!3VSg;%CG3yIdxZV5c%QI879SAy$Kpf6{#blO*dL3J3HxKQ zm9Re+pAh!P;#0!V1h|hN96|g!;S9w3SbRa{9+rPeco5>R2PPiHI4}{ks{*mwo#6J;kLHsk}R>Z#$-ir8F z!tIEEBiwET#|_)x;@5N8r@L5vUY;n;%sFv43AA5ORpaeu-chzAgM za4(TXI0NxO!aWfWBAkhMFyTRnvkB)SK7w!_;vs|!5Dz6h1Mx7zRfvZZu0xzdxB>A9 z!i|WJB)kgoQG}Zjk0iVfF}{?5V*}!22ya1rEa6tfxrEygk0RWT_&CCNz8Fn7f_Mz! z48;0e7)#|ImX9Mm2=VcRa}ehd&OeTJ@l?XCh)*HB74bB}?TAk$+<~}&a0GMXG{PB(Pbcgl zK7(*3Vtn}nM-JjM3Fjg{i*P>TLc#@zXAmwy93@u~aHpFFwI}n!>b}%<82xlO!B-|5m72!<8=MWx* zxSDV-;u^wvh~tC{5Z4l(fp{+AD#Y^$*CDPW+<b)7Q`12Zbe*AxDD|_!tIC`5uSYFn4^adIC#Ib(3GjuPCcby!o-vEC!IWYT;BNO zPdMh-QOD(u9yWZ$kvSu?j~J3QaM0kx4)1@+p_%;-JgD#f2Y7wc>Cct&g%&%#eFy)0f4uZk_=HSxN5L%b>85^sxlM5}mL zyeHllABYddN8)3#ReT~o6`zUE#TVjB@s(&3UyE|W$v>|WwFxJ%rn?xpTB_cHf#_X@Ysz0zIo{@Y#QUgcix zUgI{o*Sag+>)h+z8{8Y+o7`3I&F*UV7WY>7HurY-4!7C8)4j{R+r7uV*S*iZ-(BNA z;I4BYb02q~aG!M7yHB}KyBpk%?k4vcceDGf`<(k9x5a(leZhUveaU^?{X4WGbXDl;&^4i^(6ynJq3c4|hi(Yn7`i=lN2ob;XXvib-JyFz z_lE8Z-5**LdLXnm^kC?r(8HleLXU>lg&qq%9(p45WN3ZpsnFA*4WW&pO`&H(n?uir zUJktydNs5q^jhfk&>NvQLvMxN4!sj<4ZRzBFZ6!sgV2Yek3t`ZwuU|leH!{K^m*uu z(3hdFLT#b1L*InH4Sg5-IrK~D*U)dFj?nL+KSF^ho22U7yeJUCH#E&h472vm%=ZHUkSe&-V%N-{CfC}@SEYc!f%J) z3Acvd4Zj!uH2hik^Y9npFT-Dj+rnRmzX^XE{x1CA@c+W!hugzHgntbG6#hBO@ElayB?eerM z(i+pQOk1Az@3a+ZSEXH@c1>DS+O=sb)2>UqKJA9I8`Ew|Ta|Wm+AiVJ@+v2*I#w3V zipT2WS+Sz3!t%=E!a0>Q%Sz+tN)y0Xb+jzST0S#Y951UWEUzjptd2#C3ul&AM62gJ z<+1Xjs`+qoWpOkf&8h*f*+Yj_4=$XYESy;#Ev=}ktSrkfg!-Y`gH65fdFZe?M$2V&sfAEoYN701T_PGO9Z#Cjv+P~6FsV;5$(CT7 zlX@(a9Zwb}oyd+SO{kY0Hw&TV*d11wJtVbIcD&Bf6JmCCRRbVbn7GrLu6x77xkZT}{l>h!z(YMrYO-qMDM@S@FW^ z#F+Sj^fMG^17&S8WHf|H3#w@>l4VIXxA?yO>`bb$jK(Ngmh?bFl(e9lM#wCq0b*tT z_?TrhJjpVQG){7ylye4WO%Af4n?Q^23@vKhFz7HAWwDAx=!$Bq=f<*!4jnwAuqs*| zFRYwZ$c#gV-SSeAu< zuDK8t@E4wE!qw&(YF*rjm@OFiq6gb$G6|qEH&=pPES=F&* zG0OY`OYL+@S!J|XwlAmwDI(PddDThQtvO0u#Zt~zRj|{L`uSRuRpeyV#H-`cneaKk z-2Y6uf`QGlJ|r#4#7veY(~1%^X-OugSw@MOEK7Qz#7tU}iD{NmVzM$nG0iec%$bQn z#nCIOtd13ymqo4J4YE+zf-KbJq{Z*Fe|=$Pe)G&SYMxm}Yr)jQ5rwB&TWDI7gJPB^ z!%D3;t;xYjEvEr8%ah)y$EGzoP^slKSOMjJL{iHsDyikF7ums~*@;=T+BjQpc8Wnc zgtb0sD0X62^%-aD^`#ip$maxB7i2|usu{s&1zGW|Z2x*OwNO6`%hky1<*6gDTlFsS zay9ZP<#ObCxf*$1u6mKJ8}-V&;FvD2Ic0T%X0P>NCuGeJKVt@saERcsX@`Lc$OM@Uam%7FHd??ebTLZmw34v`IK@w^1NJ)JTF&$%+?LbX6?kR zT5X)IH#^0kMq+SqeSv0uEG*}#b{b}VG*S#|I1EFwLJq0lO0kK(ye-cc)5y?UY_)(!lPUD=4KvUNkU zSvxVSRvTyQ%}z0>kr*6YU!YkZ3(I+`orYN-jTD0#4#SY_xayf<)_ay>P$QCRQ0c07 z8C|I{Nj<}V)-tv5h#jV@Zq-AimnS=e1olDmW?SGB&(i zg@%`_US#WrWV3c+R;@P9)|;JTNaSO1eSv0uECvUkr`le7PRxl`>t`Fy=7vN*>V{-}fo6Ry1_z&~+G&{e(MU0<;V=xz zhNzwyX1!-A1~nq729>UQ)6tb0lhiY0x(?o9y6RRVM1f}|BBWW30I~8!e6;d_@Mu;e zI;=bq9A2(s!^#t(Vdbh9N9dhTHftwlHK@kfdb3ju%3=17>$8|ueTG@DFU63^|KR!p z&FE0Ib8zr^fo42U-MJX&p&>E+!46f=QqH5-98(KZ42cZT9m*!ad%=J+5;>4^hMXRQ zwB$(UfQpfB)kCD0C(lw5(ye-cc)5y?UY_)(!lPT!n~DxESHVdsm(zontI+Ur)r%u^ zL$X;rF{@S^XY0*QF(`-GJFd@SR`nTXy}lHK8r#9a^#z*Ip=zh)yg)OamzW-UeP~d_ zZ*i!4W|;M!r5IEOq#D!;8PEipH{772Fru(vhi^ENRy{<)XQ>G3Ry{zxT*XH(Pv)Tt zk8ahY!^>50Qp#m)c)6M$yj=AHUPUB3pKR7n%&OJK*?O~649X$Air7(o7PG3)FzfZD z7}Ut;1XdShMR%%|!Dj_o@hmkp^s}&Bjl5o-46*8yZq>WQ%hkxIl*^IlIJ-t*wIK>%xWYIv)=3!gQ^c+MeL|Pi&@oY znDzQn3~FqL1y&biMR%%|!Dj_o@hmm+`dL`6MqV#Z9eLfVcZrv)kxwa?BhSm#$n$d5 z3wRZ=qmi(f)kqj-z1b-SRUf>H*in5Jv#QT9>-D7=)YuLUtS-ok?o=y-&kC~QS!(3< zv#?x^yk4F<^14;;5-(RHpHePIo|mhU=jEyw@G4?QBVjSCkuc19vr`Nz*6>t6sJ=im zI#lhnoEK=u^VDb<=b=Fjhhaz^55uhYEXANkB-J2?B*mb{B*mbjFl2`@(ye-k^zvkf zRD^V^9w1(>;-i-*y{UoMt$K8Lxe887xr_}jSE1qMsu%DoA}D=!Vpgp-&eofqVo)Oi zPxXW93pDFvVL4B=(=h9!kz!E8VHi@!!!YYTOEIVsNj0c+)w_(Y)R?56k$A(gqZl2b zMNkisUY_ibijZ#A1H{W!eDw09H#P9ORgVrYSHVdsm$BjHDm1)Y^#Wc+1chcNX4Pur zY`xhjhD1IF*B5Bk#{%94?5LfFSs#rQgBlLQkUAcQS?^hjL5)bNL8YtSbabW0B=wBM z8;+p9su*Q!kJB*PQK_f(3c|e3Ts}Uepo`{cDp7fRok7h-0 ziRiHML~wYyiVZ7Igoc%?e1umKL7~}+S+&|YTW@xXK{ueI*6T|#sIi6j073Nyn$e+Zr{%mr zGoF{29(sLfP{VI=sCs6Y^`4~|R0gCP)Cw8U1oegkV}bu0Ddm6FOf?P3OpuW>&03^P zL-ITsDbuV)D%Bt(Wg3zWWu#2A7O7N&j8uSuB9&^8vqc&b|C7o8uX^ww=4844|CpG` zJOvtHJ0)r2rwp~9qDfNt1aBWUK9zq{%!5LSs86X);go<8M1jH?q@kbgZXo zM)Nd(>};p$M)NdSXl*B<=^r0m;g^ilZwR7OnqA>scXaY}_!SubF&%#&1fX3cA0j{1 z2mPi9$GH#$Tz8Lh0%D~*A9RRwrGqu_%Sf7_0Ds>Fwg+wadzqumAO5Zm{JTf$Q2wSf ze|aCm`A~-bP_FznOMg)89|h2Vy)Vk&EzIB4&m8A^I0OB`DG7h~jx_tb42%(S?SEJP znn8y+SK8XaUr)g3uQPnA_FcvNtpI=eUj$YD8kxVy=ShEEHGf~q{=$cU#Gx{bt2&gw zPgs9F%^&{l6x88)FEM}h;BUEdCUr>v!~ErdzrIk8{oPIK(BHYNzumh8x38A^e zf7iEa-%RGu1AkGdQyr+o<4oqSUh}sn*pyIaV{3Z(Hr~?f=|qs{oqsex19OQ1%L8S z0^w;1et<_Wd0obvTas%-;s^7Zkq}nZE|DzkM`+!nZFK8`#xm;+BARtG=DA3A0}x~ zzC6SHIbSC8?{Ljucjm7<_{#vhI#mAc#{BgJe|u`6~l|&}6@Tc)3^YyPEmC9{lZv6Hp$?-<8Z? zGx(bU8tm^8@TvT{yO{I$Ay_Pw4|J*UXKAKx9q5ijfjpEB*Am3JvOMw?t*2P;FepPC z#s%jTHXEwF+&3v41FksL}n60e^W= zhV8?@Yk@ZOHz!2?px8gsdj+@e(oUwXuSJJ{E)VNg{zh7KuYg9^O||HLgof(6GK=mH z=#;Ko47z$OkcW!PFQC)ovJB#~40ITmQJ__EIhDmFyr1KE%9+$5oyX$>Ivh)NsCw5z z9q=y^mt2ePG0^C`=@#8b;8@qyS#+PUxU2wOJ)S5J)xHl{TzY<;j0@(CiVObwf4$!B za1rv9GpR$`i^XM#MK>9o>Hel#bf&@fvz4;l!uB-8H>xU z-z4L55@=Oi`muZ&(ud|R_cxx!rP!id1Z~0QsCl%)qFVwQUANhyTf^e=vqg6&i%Z`F zp#tceI#gV4WpNqw9jqsy!+A6f#40ZME2{PO^*tE=wv}=wbx0p$aVfFr@UPbE{_e5p z{sy1AuHB;Z(oEfuLxS6veUz!I16@#D27nIxo(o@ijQlAFVHp$~N^{0ocU3X5(SjF0ZG$x`ppAkuYfEV}6|ek~T=c`SZgL069z$V2s` zj>RwU$K-sAfmX#2e;u~oz8SDt3R-vTS^O4&PSu4~EBpzIU%f@whsAHPrQS>yzf~4p z9*f_Tp!2X{@=)z7X7T#~bV2beWbu3Rr)2!f!KaEJ{`z!1e$!!d=&4Gj4rv*WALvw@ z(5~>yJbo5kI**^F-aT3TZnfx!u=s7Z=uTwu`y6yZ@f*kDHv|4~sM;UkpM6&G+l|Gq z7&gNm21FhzF8j0iEw<BT8mjA7Sah3M{5FFw==!mq#jma-dHuKuPEql@fW>d~(Bw4- zW2oXcnZ+**Hz&C$kcZOU#Ns!`qWgfwZ?Q%98Ti-Zve}~Bh0Wja@Zk3C$>#4E&;`Y> z8=Jq2|4hd3GB`!WuP@w4>FpaM<1WLJh~H~akFLuDUC?#bg3M zZc8sy*J#m&Adhr^%@$oBxbM_;8!Wo1uukZ@R*SB>hpB6~=x*z8>LM^cLGgPA9#-o0 zdKTTUuy4?HITl@ac;2V$@-4b;hnl()i*DcDOkKT2=fb{FueZsf^L90LYb?4*UsKm& z(H+v&)NQrsx*cfhIxM>WolRW^JfsO4w=E+~U8Y6%KhM^Ox+-h?lHdpfewZ;aj5IZJ8b>K=hi{Gm2CZMu;|wHGTYZ|(R~a10lmL1 z7F}ny{et zS}Z!3t$%G6-8ToD^+t{jj$eeWf0-6t`$49^Jd3UyTmMQdx?lU4{u(U0?ri;Qw&)&Z z>tBmS_ZCbBJx|*#x+b>%MRJ4V_sD*xzf6m6K3o6tEV^sh`d4Dny};JL28*t3Z?k>P z7F{p4{?g^)E6iIDSjn`j=_ZP2}sJMK@=Ev%e)4T^3*eEV>DN{j=yU z;On17cLTc~wOMpq*my*a3y$Ca*mz`Gbba{xXVD$Y*FTG{ny-HrT_a!rEV??r{#kTa zcQePg&7wP>uYaS1<99vW1Pdp5f1YX4E#~W=MYp<(>9541TiVCeHCS}b?7p$tqC1|i ze->TLGwW@$=rZ~GHzqiKtAGia6fMFOn*5R-3+$=l~{D=v-PjZq8r85zZQ$Gkgb0m7Tt2T{$-vJ+}|~9 z{VTBOK4a@&gGDFUeq)_QH-zo~+AO-sZ2jwbVsJm)e&)F4S#%zoZ*>-3gw3~Ri|!CM z-&!rYZfw3qCIt7RKbvnk7F~BX-%2dH>@H?pnk>3^a!g%|Mfb}Armn-HTQ}6yWljw4 z@7ujiU4cb+ZMLavu;?CT&kxpFblEV}+|{`Q<2T<;0HoAu7H=(5@TZMNw0cQgI9TXZ>W{^pz#+`egS z{?=P`$ME@U(M@ObH)C3Gy<^z?EwJcjviZBpqKh19#-+`oJA~~!2b~(+zORRw{^~5c zPV9bbgGKkk5vIRLL2$ioZ2y;U(e)Z^`fIZ2M)WjwTP?b>EK`?xT5$W8?q%w#EV}iF zo4R!t-TQl(I_LD@dQao~KZ|Z&hUu@-qAO(kzgCOxyl$pH?~LH~#n}F@#G<<}-SoG{ zqMO6^e;pRx61M-#ogUo2tPy6t4Hn%5c7L?RqT7wlkDg}+*E@jSAI-4n+Oy5}HCuGu z_BD0w7Tu^prY`5K;Pw@={a?LBx18<&S}eLX-OYM43WMwYj9otpEIPsF$102NYj*u; zv*P{_SIQ* zlUVy2ExLt#{#tZ5?PJDegGKi`+yAv%bnQJ%f9)3CL2Uj;ii6`fip^ioqKmWnn`6-} zXZyc=i|$-De@iU7Cbs{px9IBG{B5%6Ze;tvH5T2)ea$$xSai3t{ohuLZW)`u9TweP zZ2y-L3m&&AN1E-+wCK+1W9o7(x*@|&U4cb6neG3oEV{jhnEo0px+8j-x>Xk4EVln! zXVEQ&MMA(T;mVa_i$(V++yAv$bZ@c!pEE0XJRmTU6#Ojy) zIm=Vn`d4Dn^@DA|4J;n>1_RLu;|WZ>tC})HR;> zv*?zw^{>RDi?j8w!J=Ev*1u+p?nt)&wODioZ2fDq=z6jBFH#yDzY%Qx%e3gWvHRaV zi*8@G{*_pC6WRLLVA0KC>tC})cOzT>S}eLJ+4|RJ(S6VEez_rpny-Izg5$S=uYVTZPwaY>XVLA>*FTGH z%wgvG(qPfeP>_>@3H=VD4 z7Tvj>O@GZ6T_3*wS#-zp_0OVn`TAEL96yh*e-_f1v*;%C_0OWa zh_8PZ-7S3mv*_MF+#I(^MR5FnX3sY=ExH&Rk35U+LN*>H7Tq|$AGhd=*?2Ttbl0%) zXtC%XX5-Oj(Y0l<_*DkSZx_D)S#%@%oBr}Fx>MQpsKlaM+RyaYV9_V3Xb1H>838zqPzYeQJFCl~{DE**er<(QSyB{+cbi z8SMFPi$!-n+%yTeZ&LSzZ5G|AVWuu}PH_AR+4J2@i|#ug#+ShOK`+YlHjoI$!@Rx^}ky z)me0{Z2fDt=zeAEU#mse#MZya+~9sZ;+f--W6{lL>tBgQcMV(rnk>50k1*?PvFPg9 z`qyF6-Obj&%z456eV(m<1s2^lw*EC(bo=gQ_G6tzH<7J>Z5G{}JxqT+>w^2yi_Nz@ zi*5v)Z*>-3A2#2bExKdbd~3Dn4rTK#GC#Nt*U97X;Vai_PCWi*5v) zzYP{$8QcH0SaeH!u=dplw{Jb$|K(Y9@3Z}1gGJYk&EFP_u0NZ(1tHo<*0< z=5K>Vw=bK&Ef!r4o4=7o!R_#uEC;vVVJ3FvFO_NGj);0!R@=7?f>#Dy65*b{WVy0+t~H3#iHA{r|BYv zvgb{C7Tp}S|7)=5Ze;tv7K`plw*QM<9NfMm`TozMD`5M-28%A2?f+UVy0h5+FLFt6 z`^Ft?#yQWTD^53c4Hn&mgG^nEMRzva|3w;t+qWB^9~RvJ&#bq>qHAZ@w-$@88=oIb zg4_2RzkXPB-}CE-MRy>d9~K?{zGvYipNB=32Dh(<@Bb{iE7|_9!J^xIm|1U&MfWMc zeq0*dz85l0e|Z*N8^3;7bXyKF{k2$h|Krz>Wx?%xyRYdl&!YRetEp?S=sw`r4~y=P z&ZfV}Wx?&ciS7ULEV}gvnEo0px_Ul8EV>)n{x5QQaQjXOoAu^_4wkyafjNxFY^Ey! z9aNDxlx{z!i-RtbP$l=1A*Nek(S02<+qc-Fo9mJerl)@_16{FJFSZZA7N^mtGPQ$F zKU6=qfG#v)dnMTF(cbts{5%r08GrvN9!j@or{o;Ra`d-hJlPvS5C8ml4jepmsHYu+ zQZSVa8#2VV43(drH>1l1V<(IgLe+@A&q~yfbw;EKw%%}L!ry&>g0VGK)v=nI(pg?n zS+rudH#b&YQ(9T!We>_4oHf|XEQ!afYK|N@aCT|Dq;_UjQDynSm^x)(S=rq30aewN zXUB@-S)lO1G=R=5%pR0IbWl$Ah<<);`nN2Ngq~L*>>0 zt%t)#IWMkG@4D&criI(LZ;dz$9p_#bKKE;kvT+Ix?0Y+AH(dFi#MEg4@r;ZLzUl~!+b0jv+doc3WSIJ>;dw7F>$(#AQ? zdEv>UMrV&Yt|7ZehgiGuxb*&`{C0;?Gc0tkyS~%QX+FCx$AQz=cS%q88$+(1 zbCRUTm(J>q?u4#Tg00+TzxMQ=OR}G9+fI#xekiTcgJBCrzmpq|>roI%?|jLf^BPXh zZt1&dRsE7taQ5JdozLrh?d}DkYom*v`MEi==$ZD0$l8s)U*FjCu|6%M{5CWU9uT=? zFEOCgw5!9d(H^_Hi&kx~e<)+q#@1c{HNAJ4!+DP^@-FuB`IJqJ3 zJhy50OZu)#-(~i4cjo=itlrrBIpNH_f5XMD)7)q6s`_M4wD|s0h~p4BeqCDi{hKfD z<%|&HcVD!r?~*?0dquZzPY+#|HZcM@vWs(GmubVp4aeQy^N8j?FQ?rQTKmGbwytYm z=xFV_KJ?YmVtsl`m-PL=>McGDt-N9N3*EamyxetK(_cMKbVhbulhdo$;^jAsYgVj< zN@i|M_hWzWE*Skz`?W(sde;f*n5$Ui=j?h!Smj@8EYxTE<0r$orQrZ~^2=VvYyltB z&JHOJvZXFoL^YP|tJkZO5*4TfV7xdY3ypFMl4| zKdoRp37f_GU0QYr>A2Tqiu}{i`nq8^hgWYLliq2 zkh5vdqE(BRE}Yroym)(hCz!(PJAo3rD4f+_48gw%)0P} z^vH6sprXf!-?8|6<%U|2-l@mx-=Uw+eVUwS{qF|by`h(JwHTj(>*#rKn)m}2* z*s?vGu1=xUV|({-x;cf+-ym&#(BIz7|5H$=4zy2X=c`L7URw8XdN^;h^EK+Xw^Y_Q z01SIL`#ZmC0`xyhRh zTPCNwtQ&5(eVowCw1aK3(_Iw;7BU@tKk$qf58VF?nHK4Y(HR`r2C=^n{lA?fWW9bn zaAr!3_27mb^;pkBiMzum9s)ZA2X?8uc2go`U;H-9Hk^(c zYzQ3J!53oHP36be%Q*Xe^iWN8t9bf-l<~)QsQC0mEMtNnDkdIc8I!(*eVKw@m;6B1(^Uz8Zz_>sgO zeEuRawsC*RJM@EX#KXuvc+P+a)-4Y5p+7b%C;j-yaq;7W1#tNBk>ldWhtk^dz$W0? z3LbuZz(2+S>lT2qI_y7U440ovy8?g%!`dA%wgt~cjPW@}VvNZ+iLn_~5@WkAkQm$5 zD6t2her|vttp8?Nj`iOwvEO!#4`@6nOP3hy$3w-+pGR`9-OVYFl^0dbSNBi;pA_}~ ztYZ1hSaH0prcmzq3u|I!vkLLr#s0?P4s?l|F}v5&iqf4q^d+j6^5R0`vGST&+|i2R zKCe1nBO4dkgW1t|NvwJ&&6gtGaV%b2wIjc^RmIVGtgt*cDt)Je-^~6ri9%9S5-p=vl8K}DvQQvRaTc5o*S#KEIl`-_f}O& zEoa?hMy*;Y*Gft&W>pr>s;(?AjL(PvVn%BaY(ee27IeD5 zFo;z9aOqe6&S(B+fK7k;ggQLtGk?7`f1Sau{Hed~q2jj;Y=@u&c_@F=pc8sO9s;|v zp;Y0ML4-IL3*i_7^-}9I z`vt}Rq1yK&FvPijspGVPKkOg+!)ved_ZDE?Up)|c$plNXeHaJb-_M#q+}L(u$viTP{L{NXyI{58q($c8dJ{sO~6 z1pV*WcKkX+eyZ4du-F#+3i_sW@R-imD-*u!&=1t%(FQ<&{=5R(hc=8K9!l2;?Srl) z4)m8VW1!}F23Q9U9zI-qow4)h&;S2>w;?x@Rh4CB0sD$Xgm(^(1_=yH;#dc0VuB^d z4#yC`)LJw|(;&ng!~?Ihs8hLxx}e;`aaMT&&}qVN+M#S7lz}D>x@-bS5_z9Z0!8q#^9XcLvs9N-1)nW1=t8UC^ng}rVFPYo)^}CzkT}! z_#goecs}nfoN?v$?Trl?S31th27s50=vsf#C;&^BWJch5KE9N=z}b$sh=#sv!}3+} zOGb2t^BNmgC8Q|x>+ym1t$rTfXObUP4E6VTvvYdag>Xwrk1oA)X25gI`q>#hzQk7; z_jcMEaX#$Q<7H>#_U--y&h_EvTxTOZ{=lc5>%;zYXTX>AmUVL+Mc$Ej^-s%mx%CohSUEb5LS?r1SmSM~~0X8#~z>;7u)wd2mw- zuMK0x-mF+OURxdWN^3m074o8U;pu90W?9Th$d8K_d!-dswQ;X1S{*Hq!TnWD(mKw6 z8tcU?y=YlkWf9!Zd2nM~Sv@}~8SkGAw|Y^psInp+Ev={lhjXK4rN!W~xVRMFd`2sv zk{Yi%hHo=t#mSS$#EPotSHdmSxE2GlnDWhuPcC{j2 z3XQ?j=y|c13HNEOxaDI$Bm#3%9Z|%Bra~5c^o%lwz<(O_>C5r~LtyX@mE`(KzN) zQDt>C3}M-P*@RJ)71A@MhUpQz<3XtBRhL5YK>ugK^LF!qo! zvtt#p>S!EJmfapZI^QxNn4z=a&Jp|QkPN#rvv$_3STzoNyt2}(DTgFRCAB49sVOn( z;33Wqrc8eiQ!J4&*x2Mr{#$c3%W7(?sw%57&yy{I*XtF=RP-l^6ioD|l$v76td{2E zDGoBo)exG>a!QE)UQKOLi3b@Qt15|=L$u1gIkEZBRDa&e^T(^%SY0|7XE1a_CJSh_ zHp*xvW^oiNfmxhv`z*M4R?dSU&72P-1?viCiS%$%6%H0Qvb4g3A6%G?Kl{+%E5evZ zXT!4K&4ZtF@CUgD)){@Kz>r|2r4_X?XX2QDyoUMGpy_F3gRdHAUB`Sgw7tTgp4Bj> zi8-xjYW`SU3no>12ueT$X@!Yd2|rJPAGH<54r%Z^{MZD#lhX%>r>=@tKGN8mL-xs2 zMtS3>sq-OpC9%2zGz(=dr&J`e3`g9HRU{VDXxZ#am~18GszGwtQHF2T=2ce1M2=P* z8i!@iiry zUP-j31OhWqYb`tsommP~11BzZey1avelbtt zQ$yBH`53M6#*Q8X@y5B}pZm}1$8~LB;G*U`;o~EJ_J?Xv6A~jFkHS@ZPlVFM z7-A08YGa*QSy49M!~DP%a_nd?3bQbg3jN4Ke$WW=5yv3@KOb=Pf-5a7D7-h=bhQ!q zN6kh*$&TxR(Ogjv$Cj0q!nUEvODw#pL7Fsv%2cw$zwb$3w^XD4Ur3qJQ-=Q2-l6c63blG_4fGq1*2#$rx7Ilrvf|R&a6QL- zVmn_9FP`}SN=Jr+Bg_X{o3%8R!7nbw4G3&kJ$$&YT?U{Lc&0flQ8>)81-a*3?KVS&EfBb1btvR^Fzyg4y3Tr-WQsHMS{19>%{!STB zg|`y_C+F{U-tM#oMX~C5=`7sV$BaespSEHw-lqCp!>B>flKYlKPlGkF>O*m*npK(5 z(LIe^yb`55+U%;~m=>$1PT)p}F7t`=F;Ub|!5HFQSxs%Mcp#)V-0%3~ig!JDyGA=U z2iKi{unv&y|IUpVojIiv?)&^?qkW@ST+NN3CEaV+%nRs7=`5a)2mEu8_A!p(k^2=kYPv<8jQ)GjC_hObG^ki zJ-Kbc48xgG7OkEQbF`wec6N!@47uUvcO$rykYzDAy0!Oql>fHp=t2W3UO1 zR+YeID%pJhqL|npXL(br;cD-1kKqn2RxQuRASLfEtatHL*-oz$Br{S|4ox}i(WB7m ziK9lVdj{D7+{V-P9}D274|k1tZwxR7`@~|crLbsJ!1k8*{>A@{jk|)Eid-9~?{mS9KVs2?M%oUL16vwvt zw~Vo*wy3NW7r*3sg6&eRhFg2MdBRgk2Dkoj8OBiiQxNWJ&=xhHG2kNw>3=jiPq>3# z!h?la1-7Xs20uDo4SRLiBCBU1xE6uNxCo;je-J#`mzDu#^=0cLy@T;YS0gzZLL!BQb&y-qEAH z(It3`2Ev3W5fq3u<*y3DDC|(;qO3+%PYwz*yk7RIVu_?41t}JXJJe_y^Z}kDQR?mV zG-#iUEaeX54Wt0vF3u{2?)f`>wc^v5!fHNc(s&tN3=p;fQ;yDnrwhrjYMEQ(&93wv zRpK?WsH_sNku)3ft1FA}C;9PmOwW2oYga3{G#5j#=isw3>XTf4RdAR$ zHc^DPSf(p{Isg~^IJO)z5f&=yW}?-w29?0L`!f#Gwix;jItT$g9jdLy4Tpcv0h34$ zLk)!Aga6flcObqAaI#U!7Q`xO2aOL4Vo`W3s1_ahBQ!NNWreVG%qsLxF2o*X_VY&N zj}LAUOarr7=vQ-<=ul?A{=tSqc)(M|tr%0N7AB4E%)hgPVoTT5IO)N~X_{yQ#0nlL zRTROnmEc`ob?NNcun{bVuE}9Uc`|D9L5bc3Y?u)mOH$BHXwsFGjgG=a7_Me?P%69rb)InHT;89et(V$%!>{N~@|Mp9Xqmv01n` zudI-dkW{^DBB`~|Z#h;2Yg2h?#lZ4toi`I7wnVE-jWsYC_=?zUnCbe%VHprP^*p$| z;M~KBB6nU=kWY_V{rgz``GJ=io82EqdJZ&QyBmbFi=bM#dg4UD|LOz51_|7hgNuIB z=_wU+DsX|OB@4DjiPZ7E=1(~>VN$1zmp|krr=+jb)>~X${AceHZ{+`;Ld}M2=xP>gu>5c;hgjrD~tm5qgb7+-EpZE3NAxa{L5ROe|3Z5 zfV-Mxq-AHv;7TX2zvZ=X`vpq~q#p*2u8R65O`bC<=q8vJJAb2rGm}z0s+ug%gbM?% z8Mv$@_e%bK7CaTen=V);lehS=enH;EVD0o5dDzv};8R-ZYjpBLAg_D){(uKqZX-(722)%#b{@YO7(vgEf|t4*zGHx}w&U_!$ZpoMKoH z^v=O{u&AWE5;o*;?MU1w$Y{WWLwI$A5uOh}@kk5EKWa*{ztL*A!vF{V+9_SY-bOx1 z00ZXpfLZujEb*{Vn~0;wj|tilgNI~eX(y1_;Tjt!m<;~^2ZTW5Ww3O1Ev>YP&d~lF zzQg_)1`7K~LeB*W zOdPOy<173<3*|CA#Gi+kUhqwuUu}1c_p54K5Qm|HJ12ODR-?C~zrKI1z&A-)nSXp(2Hzo1YL0~aCcG#nH|~J_U8%p6Kz{h~I7-QqCjVz#X>vv3QVRJrLe8V*SL5?0X5^o z0zty(_Wq4^d2~K*&}yQyVh~GpS%nm-fjfCv=KLY`YKmY7R$W>N1E^jTRm9@(_#YM* z7*V*s$D;6mJ&WOgE>_`0g)YEiRa!I0zbC>y1Kx|xg+|5kKZ}AJ$kZrY>FE7H{)ywI zn`D$c*!B41>yHBXgO@+l3%Ti*y9(F|!RtW(JrbT=4X;sPz@Vq6Rn~fPLGa%k=^G-r zGbvQ*3tO|q>!ieh>7zL_23H*j5&rlyb}s5?baI;jmxDw?XVzAf!Mdc4w!9JYYOC-{ zHBM!;}2K`sHY?m~cYhX4_%HWxx57!VSWOSNuRgiRC+@j^gplNco+ zD8yR?X%ke82rW{4U%b#aQd=)o8xSkCO8%eEoSDtplLWMVe@~zP^StxqWIr?WozHyd zJ9FmDnKNh3t;-x!XHTBY@hdC9khf@VJPpKr8bDz-?l*Czz*B?mf;w_qkFs;}RCP>^Sj?7I9FbeYEGPiE|w(XER)jsO+M zOrDVGo;-QlEt$8Bbx+D1Gd6wJgmDwbxMz*kwI`e~ZEEH%6K17Nn>{NtZQ9IPQ{7X> z`Y-Cbp4yzDNh6?Z#}mSwJ-f{FGs%(epAw&jD->+8QXhk=JZO(G>9ejMlRo+SF*DPD z^yIb7#!Q1YD=uekXP=E3qow6z4xpo_I|lB{PAMB{^&Z^tERE$>)2IegG4J{VGH-q6 z9Vjd(W(|yD`bQKzP_j+-Mw9dA16Kv(w2(62(v|4*3RT%=`qvG#nj`U!{9N3b20R$N zgnSXYCDDP1sggmC#3EdBZ=LTLIZ}15tI_r{=VOWhrOqU|Vl$p%0bPTO&wo|Ufiv(jy&D%%x$Fns zP~d74Dbn#{St*c;r$X|1b9*-)Dt|RsrT2n&%oleQx#CGO`%8UXf-2zM6mDb1Gh9a8 zS(t~x4LZskTrt&@s(b8AoZ1uQd@AoR3l=P0xMGnO7$I(E^2KthcH{LZN@?!&34u=r zjG-!{cKBvaO@=1ZFeZcnMZ6f=@qv)ING|0gHo5o*ix^hU=jt&{gke&fQEcR#vO{{& zfc+O=F-%pWW5vZoaN`D$)VPfLFL>gTqZg6Yt|ppQp>-wQ$QvDn6w@E1ab*^!Z~b`& zrby+@py9NaYIiu&8ui-cNN2nn@$>qosIq*g<<8f3J4=Gb9FbW0i@ zG?+q+rZDWp1zS|4HhKc~;ozzgH-_iJUaFaKG=T{}P5@B_QD)dlsRUDEX&fY4DK7g6 zz@HgtH!b2#AB zhp%!jg(K+|ST|~Xi#BFfdS+_+=}OjgF|{Su*Xbs~=ox1#Zup=& znstDfk`T8P;u(SvVte9Jcaty-jSl69r!ibk1Is@)J$)Ki8;|GOME~vXq^Gs+vUkr20rfm=lY_g`Oq5j2B>V93lwW*CCBYIcW?8Izb z+fzuFx@-q3$uPIm@yeYvJVy05Y&Fd)n`>+Pg*kY!MF-Duf@VxKL0tU(jnR=fR-PKh zR@*lqNryFL{9FN@MVe!zL%rwlf4~1{f&a6>|5@PwEbzZzf&akXkM~+y_5SgDR^bIy zgR=#^)y?-E`6ghi6MI(4{H{YV_k8+=j7|{#P5~*HdaXe}`e&Q`snY+HNZ&=g?`x4S zE%Hb0o5c5k)xJrQ67!vLzPHVA#`E1pwWp9sYeN7W-(}~1O6uK93pb~MV|t5x@to-` zc+Yl7lH4Cjnuci^eigzU#1w?`xy01bCo%KAUt-EUA~Eyj z`=Cl6KvBj_loMGBd@nG|z_Rbaq3resFu551DGp^f?g>S`8U7Ps>P>tfutVb4fD0tf zMBOZtcsTG1iO<8nt0g`H?2)+MiM?ed4niYj8Oh%Z_yLJ;2i_#{cHoC4egl~0rTlqd zzROM=e=YVNkT?~%TH>X^H4;Atyj$YqzP6EDF;!xl$iC@PH)VUJx0A3_4LT-@pr&JiHBk1g9jvD1kC*^Sgt34AC~w{VD3A?@Mhr0CB6b1WmHH!9r&cg zKM&Hh4;PVoP17DE%Bh&?7=w{kRa0W^I z6>yluS0c_XaSAZ|QOXyhy~RrW3~;=}&A<+cZ?NMWleh>tQQ{YX2T1%6VD5oJ&YrO6 z5Q)bEr%3!$;87Ca1MHIcG2lfKe;J2*l=vv{3W?VN-zD*AV2{KoxwcN?>w$d|PXT^F zV)ikcB;Eu3u*6NkC0-4gc&-YfCv*c|P7iR*ytB>n~P zD-ve`*GtUrsJtfe7qOalRO07=k4tK@xur942vm1lp3s6M!QmE(GSamubs^ z<0XCv*da0ZjO!(FHgKZE&jSyT_$)B@e$P&- zz}9Q!*9b@Ph0MzckCynF#MW!&=LlEV%6SNPNSVk%tz(Z32*;n`nTv*wtOY)Xz$A&E z>;bNpcnR#bTjB?SpO<(v_+OLwj{Z1zB;MT* z=ZnN|1AicKXUKdcaT@UF5^n=;mN<4m>vi@ugkO;1lM()%#D7J&OZK;aho0)X7LUAU z$?%21>RPrIda7&FmniQFDHGHO_K~8-O2{GDm>b_2oO@Y8l?0_L2Ao z+DGF1pz|vd?*e{J; zLd+d^u7UeHo^g|TrNbb@abd)MU z1-;;RbX0VIGyonITxM_nqNSKg<>rK99=@F&Z2rZa@i6{J{i6HwyW?XtZ5P6nQ;@$r zLS)1cB_Mx;5ChK8o{{Rr{IE-BYI0_BB)nJ?Ro z%6B0!xfNfpq52paLBc7%9QcfU=Uw`khrQvDY=ILR2djfz9t#Zc1Yb>?uGN07?cQT{@5J zGo5}8Cu(D*cEj8nzb3J%7<&tuzaycikpHnq)39Q#;BcQmhxhq9%v({v;Ra6R}i0zQbN*R2_0f--T7;e8(4+xsl3EzSU(t{5V zwFl2#J~w;rjJfW)$?^8uhKMuR#-Dnf4%bB@(B zlxL^sM5pI;_vQ>u&xtC_8PeBMcqq+28T& zRgS&eXnWTxyWMN=QvZJBd;fiAN|?tNS>bbNsgVOiJ$G7Ms~nyU4$o@$rd1JHs~p(G z3h|y@7Eh^T8Kk_WbdGj^-? zW#l=#4TMb}J1U-WRD8nnG=J%!4v_I#z}$4f(Y#Y=RkFbInFDN9_K-q*P>wzL%oNR& z7r89Yp+Pv!Qc>+lb7t*wR4j6D%8T%FO4jH$rtBobZJWF@Nf#H64_H)aVVWL;PZJEZkLGbzj^YTuQzGO5LJZj#-T zqUz*chbLv_;7K;ma0{x`vnp~Ko^moI)HBRN3*<#+&39xmB-}H^vMDvflN#w7;{es* zN!{vEY4u+pnj{J^$#Q&y<8G@65CxnR+_YYg7qvL4Q}a5l?YVAgpWRg$sx^O;^x4nPjo0G7%=^tJhmJ(Kzvdo^dLV<;jQ$Q zdIzUzIXUS$IWu!|X659}&U-T6ew62B=s}*k-pW;_Ui+10Y1;ZeS^>Tx)7P0lBi}uJ zWADwl&8}%}U?thd?~9ZTzi#E;UGmJB{)oj>;y|sJERPQ>iFCHK;A|N>f1_=C(4NrR z&f1|)+TK@^YA0&pzPPP%yE1An);RHLjnF2mHZnD7c74X5zgxVaEDWEmh*-R<3ZJdm zmIPhm^73B%c#(5Yh!hVxwW$!7nN^Wlx$dl0 zNo$fl_e9jMid?&9Ntg77u*I_zg0;nO9I|VUqe+Lx>c(hvuO@ZP*B@JO~kLK95wVCO`TGoQ3oXJ|; zs=Svz4!@Z3%=vQXrW!Z;bI-1bO`=-sl0S*8ni{mX(M?Km1|FKKdESlioR0KtwH)8- z*mP>;iK(HU_eID7%kcvah@F^ft3VX`x2YkU%H3sCgXPsi=Q?ZYUA5+~lg^NTEFVpxNQZ|0oc`QgsDcQ%ZFF{ohIVVgD~G^ScB zIC9H#os#aWA75wVsWhVareJSE`oufv^puI%jPEewT~pA_F_Lng?#rm|vDL`+Cfd{~yR-nDvuZ9|e6 zXB-PT9r`^7C>f<+FW!(>*Cmi(S!#V*Li*Ygd*>}FQQJGCZ1&EFgYj=;=k1->!*?aM zSvz~}m$eBqw>>tot~Muq!;L}quyGh}$L`u%TH?)_*>~UHpSO-1iQaH^skg-9tz3bh zVsGV2{4DoY-ie=V(NmVpfKK?NR9Hzex;rQ8y(Dsb*CoNLXAJCgs@U5_yQ%9Z%gefI zo~<}p92c^yy5Z(5vNlxnyk)7_?bx)=J!t*b2+H|zrD6{n=kt`i8CJ6r z&Abd(?HWtHKKv+kAh2pYHpLX}eVWG0=~N9Ss@d0=e9HNS?fYO19$=%1f2!G6XOYHD ze?0$8i>q(MYiO>)HugJ$i~XExjShF24Ark0vuZ z|Mz;0f$`xyuUPe{(hTEe59juTNK}HQ#L0_ZEiVjVqP3j1L3~Q*nAbF<=GYeAkgK&R zwofAKP_MWiqJ-aDV(a(6__}g70w$#~p$v!?i@_1^b_u6y^PB10Ovg?w#ay~~>gy5sa=Qy1Jk9pHHG6uw87ydpcg>8`A;*FzxDVO}JEPN` z-E*8#h0e&)&IsC%cQhIA+15DolUKV(Sms8Gc2hS)4{;s~J(c{0o#LNq z_)?q*{ls#C=b2&Xq34S0O@sD5#&mnEUT18{j2!2c>CQN>^QtwKC7b6K=P&m*3@FJi zar>5+B(ti0n@b{nl_eH@Bu&#W%2A)>i;2R}rM6)JGOL+^&Yz!Pi`jpXc?Tb4V=g#j zXi&KSi%GBu#So=`AMnyQf=b)}x4*;O!S0rpglwn$c3Kd=owm2M*xRUi8yzKY+dEaZ zwCvNgLlvIW;Tt=R&W_%?{LSo=;tF5nk(8G!YqKNY-Fzau=gxgq+1Cv0RF>@+oE`6V zI%7`pi)e4dUbaI{M-xe#ON$E|TknBGUvBVb$H5dZNxwP1;Jv;`ZaVy?y*~o>gdWPi z>a@+9eI*2zboM^`;D$%Vt?)zEkO`KA?Cy~9W?!B0mstQ+&hEQ>zA$fglsCJNFBqC_ z*0j>O>Dj&gCCTm;kN9i76%~5PvJ*<&Ugx!F*-m_)&+F`666tmJDPi@HiWJc0UDUV1 z`wtPD!p>`#?-Qtl5>=r@G0XV{ykoW#*|BG`dz{OTX$sXc`b`pH8mYUUfRi>!f8fj=0jZ`*@v^_`;pRRtZ1AQhq+` zK`V;xj6LJ*an31TPmwON8((vDc5Q@fWu}UbG)DAL$L@;jz|`?FM0F z4JCwa&!Ay-gRYeAjOLCL8Es88ztN}!G`1toz)E2IbEqN(R05`2Q3+OmMq>6#wmf_; zz|iun9aI8Zo?^BKG`o3M`oqzD4EFD#!eRVF&M2R-{@NIr{>8)`71y5OQAFQam=i57 zV{Lcc{D)_1g|9Ywojq$C{UsdWuPR(I-WEwR)i{ipp1(WM>tM7qnjOF#p5*L3af&v&yxHibdJ53f>%7L> z7~##nCc)W#QUVOb&r~|%eS@9x8=}J2|LS6;rZHiqr>?T}z^Topr)&0A9m(<)$N9>a zH)i)qv4%W&(U?VIL(gXPw8+%QZ+&@D_vnP=38*W@nGJ`7%k{B_d%;M&fskLYVjxy~ z<28GIUqrDt%%IMi0~?0V90G~MT-!Sr>!OSLj&x|)078>5)wh0#5^oN)lcH!D zK4hfQb=LId>YXopF}&FFY1#S(Me$1(|MKC5N%w}C{UqQVunWg1!vQFq1^?B-xn$1s z8xPJSGo8^XdHxz*G(74shW{)0-Q>Z&FRTms^OJKsz5eXieYUONv2*4XL%w-$(B!0> zN|Q?q<44&ad1O(inb-fmYp)4Uz0iB#;xE45)#Wd@?4SSh5m!BXVz$cDs4MZDGvEF0 z+g~JQ54)%5E!7{7o%i(8@h1m--u>X$BNx_2-E#1Mrrg@^tLu*CJ~iO0c?bJH_3iUN zeRJ9?gPl*l|M0h;&igp(s`103PJH~U8$<8Qi2HEj?yB$J%6|OyXId_Xe><+<`B5=j zk54~#Lv86BMc+)S==%0oQMdFOdi~cMJ+=|oJ^kSMlXF%^H~({MuN{qZiiZ7mU#xXX z-NK2{y|0|`py%xPUk=|t`{0u6vL9IR!Rz<@K4)aFPScK7cNu!ag%7^YYv~)``#@dB zFJJw`olm_xvs>vu-xxdW<(>1NKl|ESMfV?nyK%?Xt+zM#`DytJCre+xa___Mz5ecy zo&E=qGSK#n|Wa1?6{FP-2K~eJIY@B+1Lr)FAl0XS3S|2 z_htNpdmCRk`TKdFp53Ntj(Ar}Rxi)8ih}yIrdisDj_+OXX1(s&T(Pl!XVVMHuK()q zk&F9(^X>26-}A>K7kvK;$3xu{ZezQcz3K6JE$R8Y7O#CIW#+WID?fVGcH)WH9f_~j zzd0kr^T>$rn$L{hc6<7)m}lPqy5f(EZ+U9?bC3Ni`I*yP{Nmf+{c+E4{-%DP-t*oG zv&{cXzs>jF@3LNeqU@{0LoY9{y}0_v<~91>s}DI>t>`tW(D~B3<0l{g(=O-r1FY3e zLmPf^ZQtFMgPiX~*Urj&DE{tWE}pl0-LBxcC&EW8?!0@;O>>$ykH2~Deg95+>Y6?D z#>t5x4^3Qk&)3&f^&3As|FM3{ryV5C3L!)RV7PMb_-^({I#~Ukun` z`DkbLKdVP=I{HCv@yQ47y5qkRSDx5i-NQC{$TNRt`hVAzf86V?(B_No_&&cFvu^L- ze>B|)&yny^+9&S6hJ5?lhJM%Ga^J7wKYQwL@2<UmDKG;QzM!-454HQ?hPf8anm$KkWZ%d+d)TOdr_Lyfx$Q(DU~Uf1=;I z(Rb&LeBguM{<;3mmE~0jd(VD**8_VWOq<)~z)d^$-XD?S^`*T2_p9eWw0~{qSKj=4 zPKoD=J^xO6>iX)P1J52=efQvJ#y8w}wmkK%XRrEjO8Az=-@bnRH~;IIJ#aKl={psZWgxs54=xs z%+^{<|H}IW{3b13Fa{`A@l{ye&;NYCpc5Bmz&UVOG=5d7)!Ev}VqY!ewBZ5qDcT5;`e4z4!P&GM3_g}uUm2hRZ5kF^7@SSRVhMw@X=c6@LoE5QsKelF+DLhP^kpIj-6~04a%5%**!&zQBRTm;(nb#EvSKl=6BQfLYRJnw_v@P#7qq~Y|Ezf{g zN=(^@C8nO&QBNrkuV#_miQtr73FR!Z+n}x%*=697v=)uWV03I=#7s9vVy2rbvA>M6 zdlCHd##r#n^71EIR_;`ZDSMm5l%-Q`Tky!Vto~>=C^*rs@Q?9y7I~Qw^0JE(`6lY| zqFe)XEZQgJg}r53CW$4M=N-##k(VY1G5^8!!eL=Uh9k8FYl`VeZ6P6C5)Mm(fciS{ zemZ6`EF^%VX)OH()Lg_)9j6jstK&3cY0t^TE> zuz%J-s4!oNwJ|{+3R$$sM544MnGz@{xD)l2n~QDG78><1%8D;~WMV_tOzeSn3C=({ zxoTe#sm*CJxos7;ziTyv-nLgR!;23KI#MAZw!OA31ypXbLijn$jwlUr?GYNH+gMl6 z3}(B8F&|eK2V9AdZ86sQUx@Zv6S(VO*#N$a`@H;&LGz$3Dd9mW3N4f7K7Vcj3|?WR_EL z6i}GgEn*h~;btZ1*WgrO>cco*lLwgicwNM0!S56w$B;(8ECU~lqxjsw5cQXX*UDHN z$|*ixbB%lj;A2=Sj!+p#{jSAf2ui50|?EvM-_W;O@e2IwQ zbyzvYw*f-LE*a4bK8__)afIVw9QpWew~=oYB6!cK9OdZpO?(a%OqG|nAByh^Garl_ zCK&X8ijVKe61!yFt>B|RsW>=XS9}%|Un=-GN2HwM`%b2D$%sYZW4)1&<7~zE3~Ud| z*7`+dwWr@s$T5uz2c5^DA7_^o-$oPPEb#qZq|pCSj?QP|djNdB5T1&I_fLwir-^Se zl;gNeImH)i;@fNB>j7cK*8*D^%X=&MI7gtI;`Ng2|oTF2Ya&&)#9I=ZYIG2HsvvrDZib=mF@UdMfr})xL z`pq%$;kLogcfE=4bMWyVS~*~y;`_kB*IUZbPH*F2@l-!v2fp^~cT}cv;g`-15>Sfv!duQDhT+(Q z!^rm<_-;p-a+IU1!9nc8L6>CU>kGf)TZ(pXkA96;%S>RLsL4N~Zx`{6Z zd~Bb}DgCCH_zDbs10k&RD*-m@Hw%1sDKaTX?>dQH^uVnH-wGs51?Kda;#&l4qEo|Ctw$KS{fw*$C%BC*_iu zKa`<+0>s2ht{!sjT`&J(;ycxWT&an#xdXZDO>$u|?dSW7NzT!MT$V{L1#%u1P&!p! z&ixt7Th{>}_scNK9fzDlk$_XdZn8eqn57w=w?k!$U)q)aNhZDs7`Yzd$|=78GRYl> zoJR@aSIMn3$xTNm??ISyO71I}hJ6p+adfu1Iu!pY$Kxs}s?soG2nRF;H!h86qME50}7k`S%{n zIgo?X$FhkSXDRLUaQ+|mp|&RSi;&a7InJvKojuc?@#pa3A(neu5894#_3)I=89`PN z0MD_``ObU`)*Fj}Q;}Z;e;+Djsv7K*!;7)L2`g^>YqmWVEiEc1tnaPDs}$jrnG{kn z^SQE9&*gOR7a@Y@rq1ImT5?NE%n)s$t!Fd%#By9LNdM^K;0EpRxfadHskkroJIrmV zY-w4uJZ4MO&f*c-6E+t*6T#behM!sUZ62S}$sV@hicWKr@s37K@wl6{%`GiklMf=y zaxlcT<&bNqw_->AhN~?0*wU@uik7YJn&K^W){vpv%g!~$=?w)ei&$#UWw3jKu^yVM zjqmQ9aimjK!vH%M)88E~?CEpI_`>W~=%Bw15xIK#5?hYDe^o<4U3TMU-wdS7m>2>t z)-fNmrbIT`;16bWa-)-;wLv1XzdfG5Z8lvLIWXle>zv|a!9MrGSj({>u7rjSSw$09 zxn|eTEsh&DFv#cLFzkMN=r|4fA+4SeTA~64$DUAqefEFgDJLk4dH#8&e*}K{oQmUrL zVy2rc zG1JjmFlM9^oRVK~N&!4x@jut%y#=3TF^W^}>KPaNAoYx^jh?uM&Qe7Y>WOASDu0DYyYRlpUa=|Ct#1d0q6|0f1#)D8s22 z>y0wZZiB>3S1vL2+AcBm`cz^Ee%b9ZZ7;wCiK*8>iK&;G{T;-KCvA|L7*%syOE}4c z8P1NUFnJ-#L|SgV-@z1BfQW&4(UR=>YWmXx*s~J$jmRHmw##y zC0&S59~Bv=3p<=ggs@P;G!uy6j;8XY4VGbM^Ag&?kV3*#Sb4SXa9;06&Q9$?{j(h^ zcNFKrQG_X{pg8Xk7$PHhE*Tw~mT-T?f2J|YsXl@NO71TbyBG);goq^k@-(47lw+I! z0}dl!D*WsRl~a7bLjbW$Mht;R@$uAV9QkJAF!DVPe|!2(MYxeK7oJ`Sqkimu6yFWN zM!wzfkH?`L<>&_CAa>!P^TDI^>jb~zTLUs9-+9DQPC3QL`y3-*9X#tGME%%RGLGe) zXX5JxKd&>&QI2l5iEk8)wh7_nV|S?d_-u>G)xFPc7+@Oc1g4+eCV!RgKZ9H@{K_$o z$5#2P!Vf{t=qN*1kHa|TWjm##esoIi1pp%j_jPk2jPY!fEJp+mamwZv<}8#0-^-18 zQwEP1tdEK>KjsaR7hwGyNyHq6u3f}+80(7tJ}PpH<+u{R-kcc23t`aB=!RJ=BO;er zYeMvK(cPWxVP1EpJ$}1=f@Q~)bF9<%HT+q5lW!`7fTorh8Ji6zdrGLWJq zI~h||GwMqsO5E<27KSA63GroPFgCDrMnV`~&ksHpiXj|)qeE*OGWUcu&d|N-As8i| z()NVZMK)UWpoHMshHLhOGzC#S9V0t0Tv* z50c-wuS6UD1MOBCyv9Nu_1l8C2J5!53GR&jHW-a&72fom*wHyXpj^frOZ=$~!-EF! zZR>bn{M;=sS@6cv%~-uCKk}?vRZ0|I}?6ER2z{4LWznn>RV# z@mez8%a`>M*zUgQ0!~9L`X#-8i1F&`Bf1tH1)Db@e$5>P<^MO_un#TvdEiGbH{ot9 z%N}y5BG=8g7jgdLwXyW}zScRloH|hB0e{){oFeM6OA0!vjr_3OA?k*#meGvOnC+lTq5auptY5Yk71z)t*1l32xZW>T44DmTI@ZbNjc{q_t^BVHneARPD2)Y z8feOYjOTk@BGw*?g0DZ{I_KfmmSabk(9&9}sCRe1(22g1P`j0{ZMA;1ByoDW<0i+f z!j%j9Iz~GDFIFwfF2cts`R9E%Go~eub zUwFdu^tj+#J3Y1BcXo&C%dbAX)%sZKv$oVVLmvC>U8kR1^T;jh^PF#Xzc+GR(a7IE zFtqUv=TCq7=xYx?cEbZJ{`Begi~n=Da&g^Be6Xk6kf-nYeBK8;PaPTA{U=vE{?zU< zhc8t9CgI+RlRI~A+1F+H!)F_w{C!cv=T|j7I`!mlqplm*wBh>~p8GUz$V2ZODF610 z37=$k@77p7_a*H=FjH}(90Rcr_}`ePcu3v|@c!Q_o~X63HAHd7XC*16Rh!n&kQX zL^;OKGs&ChaXvN050UA=L|V>6abG;;$oHI-pA5`-s9&%m;5c6sg(tx2!l(bE{2Ma< z4iSH)m|JEn?-ir)1Zbb+*ZuKg&+69ro*MVSru#FFD9z!2Ce4-w4<9}x=Z?&m>4@=>b2#=CGJX$zW0!JOy`f73!tL!bZDbugkmr~y1z&|+N zXIZEe9Mf771k~q@uGKN`@i_NH$EBQVPRb=Q`6fzCz9|xu?=KQZB9$9xHT;@eCOCm#bE=w;R z3w@*=k`NRfs)w(VnCaF_OdZ4=7G#)??njrGByd7c8Xk_eQ|rJT5>pJ2{UV&@zDb5V@H%u1{_Vr;CMO_Grn6y zB(|G3tmE}h@?ed!TsoX7zshHtc)gUQToWy4#qpu}Yyth7W4Dvm#IB}r+m%$)>;}Et z%3oq>aVu%S?0im95!A%O%RBP&xMR5DRMXY?6l^=8{sqYTa!_fk%%yiMfop3yAf&2^D>;ods;F9p^{+i%*5FF)5?RtB3;2u!A92Mx z>i@l`4t%u1sYbLy@Z&S8m(|uUXj;sS%Deo7iAy#l`IJJJF|R*vwQAdk86qwqwJ>FC z5^28qci_9Kf%NUmsH#MnTGy|yShGx}?x3a&4^=u=UkDj8&=YmQ$mX`Ja6xYV{1y3k zEX_nY@^Kn0oqric^zxdDs`4}!S&DV2!GaE-1O+snOVj9WJQExEFXGbr%d3V5P(>sN-ehKl1UCHXavO_Sed7$3P>G7hLJk-3vDt|A{#!q2sm5=-9v0HQ_MJg)u@p zCHFr3#4Z`$h_Mi_*BpCOAI8!D8yrSHUi)~RQ%>={i~u9wN$^pQd@PRQ>ko1x-z>zn z$H#YjjC@=Z$!jF}I6PK-p(efp#PR-3Im*#lO?*R8IK{^yu;Sx8tVaFB`-_4>|EKt# zgdDL;#@z)z+J^c;RX^W46W=nBPnK!;qxkMI@zojlFbweXsWnxq9lQcQ#bM-IhCri! z=fQ_Rp&uX3Gmicl0LJpx!y|{Jh;8MbY~tfXFU7~PvEnN=)yFCDaZIQj<>>A+)rTE? z9QV+Ed}gKixW>|`AKwYyiFoA{U#^LdYhD!}%cJ;y17PHP7CMS7YGgFrIPby9&U_$2HjPoxe{*$SCLN zK<;YjW0d3fi`wIhz)5P9p^tLZk1iZ?#&Udwa_}5xz43NXmE%vQa_}2Re@47= zijR8)5W8dq*T!Z6lh1*JakR^KP|m2|5Sb29!cmUy8weTs%E71FX#(OEAKRsoF9i|u zwoLFSzCW1wsttU-41AxVd`7Hhj zZ=@XM=s0IU?7~5J9Gy=&$5QmYk8Xa7F?NpV?1$nwf=zNs@2EniR*gqQi zb|XMeS1_57<1b~5`gsg|>^~IWE%N-3xAEE$@J%3rbmZX?ihtA_)gm0{a>${a!s?wE ztBjyriW0&vx#)@kh?U%A$QkQR$#Kn@QSNcb(N@YSIknzF@x9go-(DnS8rpy^8imT$ zq4>`@9uq;NxEZmUg*P}Aw;XcD^$F#$GfXPl0mYTvGz2Q$7*4+F@?2nlMEgbHC|GjG ziXy|J+{>*`7&>_P4_=>;#tS5zKE_JK%)Eu`61>l@zOE+1`|O$xQCE4NUArMFHshS7 zXS4U&B^#omywBdbp)9hXuxE3@xt`4l&pyb1n|e0i1s}QiY%_e+Q9fh}_>2j{W6HEq zZxv(8!Vn>v3E~PayqLPU%%)Y@_^}LZR$PUbUa;M^&4%5m_3eu*TUvH(9cQ1gHGNdc zmWOYe^jy3hPqaXWjX-VDWwtB019yp|%od|u)As+c2KyIQ?^C&@#izo&Pi2)B*Mt?E%NV1@L}Qm?d$=9e*&cQ%JL-** zmhItDHiqwb{Crh)?v6)KVCQ%HmH3yj`nxmP-6x#I#X>@w~V)i**u&C!?W!g2`qOgncQS#M7Nph+yP8T=`7TQo;#QPrqz48?w^bsZ3n1 zl-b8EZ1su~Bsq;*M(PzR7M}rfb{8i0N3Q6uBJE@9_8qeY#y*TavCFFexNWm{u5NXd z*IWHZQ46wS{Y)pjdaF;D7N@5fB;iMW*?Sxd4djisiwYhdi~Y9uz7eTZP+Vwuq77Ad zGRI(B*y>ZF@(+ffJ?YgyBvgrsy<6jE`#!|yl*a9cDbU#LLBnIwEN}vfb2DYeYG+OI zZDAD;c*`255A0mJ(~zr8TXtW>p3s?k0dEHf;3Tp8lNU_KBpLoW9#?a%pea7!MkLdVqTHxRW zpUw!lAhi9ae6)709LO;n3+{+g1N?jf(&}shGZ`EM8tL<(U50CjTPI&->{pEk-=cFv<^;9uIz_H2tBJ1^1M67@GQ@In%G+DPS$C zXT_{x^-e(_hRZ4+Au+v18Qv>IbKnU#83(aUqN#kzZ;_J%Y#|moA;R)mspEqZQ^&m$ zQ^&5T1F?4v@C=EmQh~(Ow@_jS@G6O^?^=ne?=upU|2c_SZmxePKg;1n{Ss5R$I!Nk zS*9l>b^zB%O#WjMQ@#`aQJykgC8o@5iD?f&%@T)yaH3x1DJ7m6V!%h2fkQpJUM?|Z zuMCaFXAtxqd)k@w7q<|ZcP=Q*&r^H%m}kt}5eb;0*5mOa!X1T}BVUu$Z zq$pE-7Pd&_zHq@(SXsQkvSMWs1>|!85sQZj?Su-A10RQ(-g5DmtKHXI)RTrb@1^*Y zwS8El(&)vTpItD2WdSz7G1P44d^{7#H|&VhejWdyr0rC=wCE+C;RIM-$cd2lo=BMZ zWsTsi8$8p15%Bm!e_olIIc4n3neOppGsjGuI&+qL>a5Jsb7zg6X%Lt`d-UW9W6be5 z#eR_c41EMnd%xpcKEG$K9J&+XzQ=!JbP2-o{5LxG1$5j;!Ys$@sd7qA&50D?jvDxA zH^sLT*vMA{KgTJ`DZXk182L_tkJm3J4opY-`F;*;)5iF!Ft8(2w?3e3_>DI0?QK5=f``xK7c?$F)wIAmhXljYIKWXX3+m zQ#FpOlv6Ol#8(YIu4y43hb)TEJm=bo#z{LUr}z>PK9ddy-!Vqj(RCD$M<9AB~|yu`Ap7D7XE;_$*J~yeQt7W znJuWw7OW;RL&QX8Xy8Pq)1Fo``hLS4<`0^q%v)G)U7w&~niAjHP0%<~xiyS4m6(h& z&Q#X%BYpTB;a<#2@jHFynM&ViBr>E3YBRTqPZ*026pj&J#~l-Vzj1C;Ok&1t3_UC+ zF^5<~PPhCE^O$TxA!-g*R2u%Fi!nAK72M``m^;X8O)2;$=94I2dY?ts^%F4V+9%Dr ze!N!jlK08o8)B@7Q#EgJP+4%WnhppN(*dEa(*bx~iH{}WBR$oNO7Fur0L!ZLw>?tU zNqqAWGs)G9g^#JKZ{PJKzG>T<6f+62)^P(c+ki|gm;i*msxaYzIcrQfh)+a%_^n5G zLraVNMxJPuGr})d!l8>h{By`-^^a~_M~^p2bX1cFHb1Tjw+8T%Z@C!V&>02 zE+_j6Z+7$me48xM9$J_kvj!jdNi4w>qw7p{?zx85n46Gqh-J*P<~Lw+Igb-CvFq_N zVYOC%c3Wd@!|D?ab08-s-DBoytKa5CvM>EuD2=v2%TE@Po(T>+J|LM@QVH3T&Gtro z0Ij;9q}U!?vTy6ztskb0_VVLsm=wf|fM**k#TP$)#pMlKx?6nic`3eqo`)m64Ra2L z)tudNrRAXQ<>dn06oxsXV$5lAR%J{$>fl|#$A#hlzFTFf@i+?V- zZuxe64L4FrHg#gkzXSye83gc_p&)D1YrQoH* zo8)9zz&Ub>dH-Q<+lU!_;((6H4Kv6|H_#_T7kmw~$)@ErI1XWE5uay<2db*N!aQFn zwhM8@+q3ziQd09gyER4I?={40b1bd#yk5JcpZ5TKKjl+X`~j(tK3CUv z|NTEmx_d-=yiX$i$AmvpthG(J&1hyeE>SO{|ARi>irNA&J5u=)>CtJ#A?rvJ`4}SKe(AVi0RFiSd9^tJfGdG zdAoHIQ=a3efcZI$!RR<{R=TkzsJS`^v0UiUi3m0(8Z^?qf+Y1(8d3|a2A0bYAOx;N-FHapqW@D?ik|i~huT zbsvR3xwjzzU6^oZ@t+u7l5jlljgEZ*-Eat*={RY zw26;>Ag|%dDZXwdK97NqkB}4}`%;Md%Q0ETnfdlW&Zyr520mUt72hvSeA5xv-aKBZ ziLczi$8J^e9RW7#mkU4bpd97sUdKV~!a-MU;NxXg@l^sF`If=YYn^h6?{Nee`SyaZ z7s4Dkc-d8aD}jxC&G19i?-U>NG4h=>=*Q8a;-meId>7#7m`XXtHy!~-z9#VT8sfmg z_MrIs0~`5x4R#?+ImOop0Y<(H;M;^S2M*(!W|rN^7lwM|m`XXtM;jRVe5llVggJ0< z^u;*VV}GPI@?j_{-`+(eoZ{;PIU`>h<^>B7@4&%JyW$Hq@o_J9jf9?$6GA5!+f0g(D(L|4I?^<8_|kHtmNYs7LY|8ZlDuNqDpkXAh^swq=|_N z@mXUUgKMHWu_(nmWsMF(X?_$rDkYL{6ueb4kh*e-LS{1kaHBs_6A?7{JXZ3~! zH`hfLi+g{&dA;Lhv_bTNEefGmkajfZ+pgcBr{|eV>I@xX28YMk z!tJ4J64peGu$J3&ZTDLb_u-Z*N@4p|wG~Z}h9*0sVoF0{!}ZZv>Q-Cn@`v{023R58 z5PB&+L8N*fVe-bvQhgv!>!i@F*Ys@25W;|^ozS5_UG8@%Dr zF(iZ`qP$o+DrB(UK#zkB0=5q_XCLVQA$qP3f}VYY{CcLC^$ek&P!MN@{!2yax9Goe zR`N%v^@G~|9O~7nRj*+`UaucztRG^l*kFH`G2Yl^;Fc~}v-dn~VXML#TCq_Tsu8|D zHn|ZQTW3$SG<_2*75am%#=a|E^IC&Q!G)`v5+m3VGJLR>h)%HW35__;olSmQ^j@O1 z`}0Gbv!%tq%-G*<5PrASZjISu&2DL_Y-yQ+`M6LlU5r_*)%3YPFQapdFGlv7p_?%j z@QF@YPflIREag_TUHgqyjjkI9z^DMyC|4Q`Vv;l8-7 zal0~VE_y>WJR9HpEh4eU)MBAr5ac02KYlUg9jf;xhPhKTk_!jNW8k8@0qAse49X&h^+dm6*7n*Tmdjrk};r+%4^ zjvRF4qa(L+%cG5CVBL)vuL-px@=^!j)C^!r1&)Res~$8}Du9 z!(CbSw(D4pcaN0ktXZqWdgoRTP}_B^aw1PkwO!Y0e6xz_9VWg6lfReA-^b)nH2M3P z`~yt>K_W{4@juh}o-Liu zpQ(G~e;eN7<9n!ddVH3^>Yq)^(xwE&XR9djYs0KQ-}j}{)92_O`5#Z)O#b;Mf3DVp z6C`lFujI3qrNXDrBSdMT+8;`Tt?^A2Rs|oBTJM{8g$0L|)AAS2BJv zFxO@8llsCd;!92b!zTZ`CjYNZ{x#CSK=4Osw;1{p=KlmUl8*jgC=Y(=f63&3)8sER z`7g-!-+*wg+m4ccijmL!tSiwJKg#59k>{IAze)P@5Di@f{Q8^X z$D8~SCjVqvzdRG8uovHhvc0jVj>6u1$7T80^G9JXz}Y5y=b8N6hd?=&|6|F|d7mh4 zm^MvDvKdEVccxDAd}Xkx51Ick5&skIYT4d<3IAxEfx6T6N!6O9pFd20Le}?5;3(`W zHD2m}t?*CMmP&ixD*V&57%87D{4=#*N`03L|1J2Beo#&rbF2~Y>{04UO7#t2s%zmy zFC4F)mJtF9-7F(@%&VgMjxgr|Eu-{sK1;IPq+uc$&#U}i1!1ZK++dIB@8&{JZeC-C(M7kWx8>;TLr z;lM$DV!_YG1t<8&=~!@%*RkMC)3M;3pku)~QO6GaSSIP1cCg&6V;g?d^G~P5%u}=( zw0Gt?N`^BZW~rWwrb|p+ZZ(82l$iN1H-z6Mu>-#w4B_ne$w}QS4B>kuroJyoOuN#t zZ(D+2VISZ*z`{PjUSMH=;Df-zRuT(a0S`d9u$9Erm7Hu&4g(ha>`>qYzZ^yh{;7Jn z;Fq13;GeFC3w|~tIMEKJ^5UEYCiitXxQ`!Y*{>0k!zD5EOq1AeXUO1BIIbPwIVJQ2 z9s(@%1ZGpA9A$FxEA*6D=m|{qgr2~2fQ21^2Ld~AFzqP(3jRm{IKj`04xHehrDMS_ zhmnFmLk}1HdUvVYp_?8q>;UYy12Fln$HDK{Gau1k0h5nSmf_?R?GTuG(pdm_9t%Bz zhXM;dfyV+1J%OnC#?6(83-wwcjI{^Fb0L(n;_zfGs9f19I0QTDfnDs97lvwBq z?6-r&!VbWGJ4h_-&_iUY+d&T3g&nf=aKWFgW5J)JV_}E+Iu>@gLdX1x#y@g9B&IB{ z2Mj024HDBP>>nAh?|MoLUR)&axG_p-#4IU+H+g+5XT(PpkeAe?A3 zz>F6%KNG>aeWdm@Ps9VRi;3C?!xAb6Y*fWs-FMFUgzT8YUc z(oP0|qu;VzK)vlreS{5*^l)KAc5-lnGr_uqEOA6|41Vxk4sj^$H{luv?&M z@r+s%5a$&YNwuqC-e0|Ow0iNH2t$$=q-`O6k8 z$;Gsy3|_DVuNrnx0I}^KcQaH1=0#R0Mu3d|T3yk~Wqf-RJ6h)EFT_TpMIF%lw-n{Z zsqIh)#LHLq38@DNQtJ zauGHmoxf<%itL<%1^$haVX?O93JUIA!re*>i}I15*@*wrZnwxM;N9nT^bd${Td@Jr zW}QTT5+Kn|21X%M#mb~Aloe|Vk`>!FG}$cKTCqwYv$nKgN4x35y8F<$|+z7W=l@i5+ZWR|exA03D1v zOmYTmVF>0|9M<$>-H=8vhK;h!a#v)<;JPgP7yuGA8jHCZkWN6HnV{^l8q@V92 z$Qk*D82ET^rT7*B8~J9z&wEPcC`ZTr5sh-W202(i4p*HV1LOniJUyg-pjIeL>#d`H2@Iw2qL;S}F;$*0QuIQV)Y zUOA;-fr-z7n?6+^p!V~<4I*Rx*29yi$fO*-MzffG-Qb)Gr!`((eTm-zVT} zK)iBFzr7~D&%yURgviHv1;y7a`S2s$Zh&4A^GEUh)x=i;rBr!&FRJ(!K_C42&)?%n z*Ixb3hY-`aaM0N?8KLTzb9#zzl8Ntg@a2gV`ah-LI1}G2@TvM`{)*2h`9LGwEOY|B zB<7FeyVt~513pz=-p4Dx(>UoN>M!qV@U>UoQ;=gC7Y@2;RDvq61AfIAh zM2ISHANUz($MG@bjC_19I}_o`QI776iSPfT?p@%cD(?32vzP3KWW^-JH3-<<5FjYg z1OWlj?s5s?rU{n_h%Z@40#PnW009eavc<3oSVL4uP+vo|8d7<=cncskL4|zIJ%b9cb%$%8g@TvUrdQyBT z0OV8oErUCS1X8F+`4IrIj}AyP_*8!Rx`ko1@5*kS?Ryjfk@DLgdPcq!Tofw5gA9C^ znD|-{NxuGtmd?R*oQZD{_*8!R+DF+pR`RL*dQgukB#=Tq%8yNaE#Oo6<*Osb7n1D- zw>cqW;bwoKMDcO`WMjR}fgby1B}(u2ru;5~9?MmU(tF2b-yqz4Q=n9YV+aoFG2UJi z-zxC&9h(xx_mqh*+rT#r%8D-&*qD!M@F@;*D(sioM^DId@X;RHHynrJ+5?3@9`3@%^si>x1}4z6asv{Yr`AOOkf`WWYx7v0iE4C>)CK8vrBU6Ntz1 zP@?$003i0sfaeT+H^7f!%>O0GoRRNCX@`s^^oZl2XXN|TkY69d72h|e`}t|`rI0`h z^(bGM?!RXZe4`Pr_-LEaJ{Q_;q;`4)N=Cij(8DDX7M1RcP$Krp5Ib&GEMJ!MI2^ty2EH2*-)LVn@*k;PjewrfzWczZ+UW!XAMM*N>e2a;#6CJ8Dd0=Nnfc{?PVrTA>&%Dg$`RXNIrNP7Wr0t%KRzcYzS~WFXTev3 za3$2E6q@+fflsx+n-Q+~2FdcXideXJpz(Pm=1K8A3XU(y7Kuz@$s8M{DnoO`=m+l{d4Hmne;w9hhD&>_vtzG;!Jv9okMS&N$=Zp z=&d#B*-<}G4U5X}aQsMPIS-a0F6dno*3!cmJ|6w2u|9mzOEKsvzR|MZ_Q|l}y*t`L zKK!W1>xIuMoOn8zYTgup$_Fvq-*?kZzIy>@6RF;s&f%Of%vKo z&`rKPv}y7T#X<-=*OnFS z{M*oe;&K?)_@gKLJedP0R-?1)TP&N6A zyGM`sM|=4G4Kl$~e+kgA}NqLj@e^dP2^S?gy(+5)jF<{##ccp*+ zW>lY$eZ;Xh-}zJBdw)K=rr}2gxlg<}HhJJzTiUM}^LXF;el?>0-fv%+bxT3bE3SLi ze)W0#Yqzeu>!zPJEl7R@fQ~JuyRY# zhA&mr+Su4$fx9Ghtc@KEBpis|`&!Uuud%5Wvut9;ESp*}tH?7i&?9JzuCaBKOKRC- z1WRmqT`VkDbt3v5f6(Ttv0bE;x(lU?4N7rAtZZeAtFgr^odluNL+X6&ITdi9Z&!!a zp3=ajtILD7q#9dK#c`S7=p{L3d8P)Eg0|i@wmwSXa-r}esqlBtmw}#t_Xcg)Gs3G> zl7&j&u&tF}1Ot}^Z7DUjeoCdkP#F+b!TtupK(C-JwZ=A3>0BXnt_ zKlQY)E*|Th9jz;SE`8TttV);Ov}0crzChd8RR6sHOp|3-lV@vF%ii=|`{G*mr@!uv ztGat%h~c5Keg1l}f?ZRndSCjk<~Z!b@bT`WzuEU(E2eGi--V?2$G7bFRJ~l^oWAS1 zxcdF+Tes}1W88=d&&p`}C6b0+5tFXE=RD~i|KjMY=SjEJ8!wVRSDw$7H0?Z3t|xp@ zweEb0Zxe~5yd!2hb<@@wWcyrc9}k?j#7D$e{k&`1DADTuEYYKfkZqCj%j0&*;zm{0 z?`KtRy|MpOo>7%$`&pGukE$H+dCSujFX|cf*s`DXxbU^A3Zx2~LuJqTTVyqd zQ_U(r`r`T0efWIoK60LPtA3&K8X?uAhtHGd+KW0GSA^W2^2Rm&*Le~?`$b3lijefJ z)}t?}_7yJZ{betw*S`{1_DcG2|JHle6?d3LjVo?n-L50@VqEBLdhBQutEs8}APc(% z7uCDfucq&MBCfhAJ#|}Euqm{yy}c<^_5=&NKID0~v85_~-&0i^WE~7`3B~UUd77H* zH>4kHOW*piO75j!X6wlvX$hs*e(-KxRpqAk_N^goYNLro508d+J(ylrm)`XF)~!sV zu6nz_y3SIMKB2CqF&*h2Z{2sG=~wzS|J=|P*%r$7q7|hd-`&x+k(6j*P5Y~lrlXIk zs+i(98e+CWWi3ptCFI!`5?xUG!ji3*Q|hXbIa#I195PV#bC`lY zE>woBg)GSS*3g=7Ti#1QcHC2aBE4znyG^gPx4+v||L%nS^d zI(>KlYnt}%{$0PjKW~5hvHhN=zqFu#{I!Rr9oYJi>LGXkDNY#lNnHzi*S(&T2rlpF zeE0iziK}vJsO8t_d_A~mn;usUd>_-r6^(S+b9>4}&;7}XeFtclA?f`s$J39!=czxD zzIF4vb+oIl`ZXqej19Qu-SlJccy^sgKiyjOi+4ke8!CH`2_Hk2kGE_{FT2}Q9ZEm_ zMbm#(Rk3k}%9>`>i_Lc4J>627UiJ&mu~7QH1{L_&{dpqrlTgc!^!i56$tLts*s2H1 zgVj}UW4e0n{AW6MhN??%-t_K%RYAyb9hc^8s$+5O6~(o?BTFc1QJP!#?+GN+@b_31 zr#}#eBVVC1ly@i|hVKgn1N~SZ$CmSWWo6-3+VXOG%TZ6+#`J@@bv&qA z*8|KuT2~V&`Znf-uBh5jc|~YsjkoXCQ02(b#2Rl3z{Jq(8gD;<*$u5(bGUsB9*&J) zdh;9G>CqwU#M(OR`Vn?lw@myd={f4_>`+``mjUUhW|0lcoPwNCC3C(z!$)+Rm@c4&iN@Qr@4rS!0G z{LoKxmupxFV6Dyl6~04X7+)1^XiGZa6l*{l?Gn$Ser=(3)ZeQs;z|!DRXx6^z6>8z z_i7sTlbrVU_19fg_Hv6@?*PeGIJN4wbeF@A&w;t~4AOO;jM7GJ#7-@AFSO>}^~>Ps zX?b`1gQKVB-G%=-$1383qq9Q^t`S;KUtXv@IC?tw;2M21_uv|x%N?3V&yYlTycwg3 z9lC5{hc3B^7an)U*oC)Kc+2%~xt|wS+QoievBEn>?B~@jG&MNJCA=>d-ra@wMf%Sf z`HghA2+Y4-<@groKRp=s4_74g}7dYhdyd|C1A@lC_5}D1DugYpEIdg+r;C+ z_t741VeaYMFMp&*D-JAMR*)ZqpTC8HqD4giatZva83Xg?|7$5R`)^rbL4ik~bNMge zhK2bBg$ouI-FEw;#n|V)q;%Qx6?d#$wffHgm*oD@W5$ll9G^8|;-tw_ZoDZwXX>=+ zGjea9IcxU0lS%1ZB0{3!unw*NBP5cr;6Gl$h-KnCL{R7pO?AlSU-?Zy@n}57E^@E?4{{8l% zwQHWe_wK2)ug+-tB5>@5Z{K)3Q1hX-_Ma0L9bNFjb+0Y|Rqg95-}(BNf!>22_CNIS z&7XbMaOEG5%y?qLyH|Og&)oU%Sh%*)@S^C#-|FKfl0h!KZY@XmJEZHk_blxWv31(D zly#D2ChFi7x?+?g1SR5uR#t57f38 zeE5zG{gse-{O7mW$7Oo-WcU_Ye#~hCR(CK2i||`yxE}u^?IlKpcyS~^gZmdzKEyk^ z1k7IOBlWA{mw>n056JMp33qSpk23s5;r3{+84{#DSDM_MyH9Drks#k@s&!^ro1MNT zO{Av&4wc_)D&aRM6uf>6uVc$#wMH%9xf1ieqWBgBn0_o1`irpx*kzIYImmkVP5w2&NfMU< z50-cx@Fa;tzy%U-1TL4j8kpavljlC*y%N^~za{a5z@JN84;+g|M*T;D`$^mg?3efn z;Qx?#7x0}DKLxy5;%4Ao5i9ZD9I0W-@8n_p(SK?2BM@oDKc#gzh0k4txEHKwZq5ikP?@FvX z3w3?j5oW>IEF}d8_erLV!$HjOSq2OkUSrxA7iNa9HPR)*gW-acfe?;`(4WGW!^F}V z=1hdYTGu#<7~@Wq-Z<2?>;g_iekjx-W?FqDCTFt5)Eyvk9L|FzW;(+qCdX)rnGVIm z&J!Z?$cPZ~s=egMtJZO5u!V_3g#D64*w4vG5Me(CwwWCd4#s5?EFWT)8H=8K(@=OK zX8QOPRA8o0e){t)@(av#`b&S>k}ffA3`p$3`4w-n_%fwn zQQ=%Z51(_kY$u)YH%F0X-O7)O^clHbr)sNjj?VMhQ20xk2;cN{gmq23Xvy+|(j|dK z_%3GX+~U%u^YK7?jtoUq<$ia@FI2$7GMPJXMd6}?CE*#lWEcL+RxH-8`XL{Kgg>u1 zccG|{Cpv$#pyoZR6k&;0jL#>Q7ltPbciE&Z;#BDHcL3+MK+W>+TCU8nac+C0N;QU? z=I$f+=bM!-gT?6K51WZS^c#Y16m_evteZo&#`u4$Ev@wBN%|2_83uh<*YH zU9XTK@~lq0rYUQ2Fpg1Ag)v;=RTBH?32DY$QC{0=IA{;`)U|Hp8xDWjjRAG=&5_tg zPsob~KHR>;e7`{6jC_-27~@cseU;E7_R$k^%)rM!P1#p!;>$*u@o8Q0EjIDJZ{TCM zulS~#`0`~KPC^vl6cgWR179pO72i-3-$H~%D!+6S-&Y1cK8q^8=YWmnw+3$Z&q|bi zkHEvIw-IiyQo>p3{inn}6^5Gt`+Bwm@~U*X|ACQj7sKcwMe$LI*eCtd!Kd04>qYUM z05kWKxgLFQ8{sFCB%#a#2D(%H1Zubp}5E%2a&IO?;z3 z#@|*-6yH)4UnBTb{qmlz_}(>@-;j$m&7;Vq9-VKQ%I~;=kB=pa?*$Xzbnx9s0x8PA zUz_-%QD}M4VflG*D83=U$V#|hdlY=Ba4S)KSHpwYCj%COZxt~4l5r?LTwa~{UIAYN z{FEp@JVtfmJ89rckzuUI&yf$>$LCSX5=88)L-C(sJf6cpo}n&e6ZH6-UkSq~To>P{ z*M^Ic^`%7FH_@c`A@qus63&Wmn#8Po%5-!>`8pK;smFu+&8RpGXf}3MQiuNBXV^H0 zXD04j%m&MuqBx#`ry+YfA3PYY`U9A(U7a!FT76EA{y*K|(6Ro1*pMM2Watom^=*&m z!u#mCq%mwmY&A}%{%=@M@+y(O{!hH45}$?|Hup6@(sgEG#IUE51I9 z@CBJ6iSxp-2t_vJ<+zA%NF?mwC zah@7&>SR^eJZ;zq+5!8(lAyP@%Ra&Be#7ZnU44Jt_?~uGRrSOcFU)-U>WTMnsN2$P z&3sNTjP4laoJ+GwP2%7)ukyk{PFMxF1O}t!>&jPg@T?thrW|-4&O+YJg1H z8O(G9Goz3StO#aWgTjUlkAYCox$Lv=tNyvaS9AX!*35yLtLo-`*31Fg-uR%yRpU^z zy&Ph;m!o60SLN=YBf7?+ri?knlrcxgl(EWfL5ID@q2`=niEKXw zCayWe#5G69#I?%uJ+0WL?o{ho)JtQ@366lJ#kj3W&GGoy>6^U?$n~+8<53i7B@A@T z(OgB35+K^^QXP%D|{lWyWgn`ID@1I2#;}Jr4UpM^t5b*+x#C z(3;}Q#Iy%g2uyZrHBMzR_L)GIoE;|DIGqhn#~!Espfjp+TZH(#k)_vL(~+mfl2@Zb z0gK8lHrw=uEtRwg#y;=1ginC6^khgcqpUf%=%Hmq#+KYOiZmABW}^@)}p(M{Ln zZvP91!{ci$mEBy{22_zVAl7AeU`6Nj1J08UeFA8N>pFY|sq1P!d>-n!_Ob5u0s9VX z(3|A44s_PMbk;B0b%kH+-(zC#BeA_h>z}qdZjkLe`r_;t{3uLR|MiZ~9E+XbIZ>Qb zVsh`ZY-?|y+M4d-j8w6~;P%~9tnN=@{P;=e$V}l?QZYz#m3nZMG{)5B6h2+h+x2>D z(y7)_h@q3b=?Ilnz7`5pwuUyL1{%w+chrngBgZJJF;N&!t`DsUjtb7*)5Ug*4I6od&tkNO z)-mcyLUAyuy#ctR08TBv6t@-X9@3H-u*wV7AF0T4PPxZr5)%AJRoBY+)d6-vG zeN)C_`$JeKeqhPK0QxM~#!5@s`z@<;Le3HXs-HKsoyE?OFz7R`^}T&J&_mYdi~+sS zdInq;g)+y+24(Bw8ol+8A&odpgDCUmt;$*G&%N)=@c5CBx$MaI0ec&#B#dw#YDMEP z-4EDq&^89DtKD5Q z&K?{mI+SrvUgP6LhcZrdDC0zjGEQ_T<1GKP?kD8MZk}#y@X*=uTP&_bUvf+AO3xNg z?!Zq&mfHBb=tI~PfqPpt`rBB@ydInZG+1^G4Xvr-oM!8I0tj~t|F^)fRxCfi#uX(V zKg4wdbI=MZzrep>AP%;=2G(V`de(6h)VkM3b*uZJ$UCcb;HJv**`ZMMu`F(^igoh0 zAs6q^(mD@ykZ{3XUdjqdpPdHUlU-fz2n;?^*g8iW4K4AaMRmm2T`$3&^?0 z8;8jrf^&9KXm{!+Y(9aULNVx#3$~@AghF2g+tMq)m^5SFAy25aR|vggdH-Kp4?Wu+ zz^CshvsOIM)O`Vj{f$vp6a2LwV9(>qaunXGcv*7J&~9+*Mx*S)Cg1AF&A$}0g1Uy} z=EsFFbt)dbRkP9@GFPx_p(wUQz1XnnhV2BpYvybuObwUV^~_y!tDd#3-F1FD9tfSE z>9uxuOm1WM&c$`9UR(#9pSeP!td7Q_tQI6$4-Fz4CQ&(bzKJoRP3~2eZTLyO8(nj4 zV6oLb(3$1$H8xc4uxZ#snLd><^cnoZj~cvjlbRX=agAS0YTEuqV{60F^zE&aLMYGJ zy1GE>riwl7;L9T4A&UlB%R0#N58r(#O3U)Yc2qrbnCaAp??!Oj_pBltCTE3%=%L>u z82&Ashd!62?d?;X6`!`(ZgLOg&2dU}=Ev|k^f7n+sQ5G7j*r^IJTANAukDX1nKkP% zk7v@&Y5sB3()z9NXmpJ9h_$9X`aB(voUe100x_CL&E=tXcBi=6=EyPPH%SsMeh&`* zKH<9zx_R(7lm`c2hy4hL1qc19L){fC-W_>w-kO8YAOFqara!#%7`!@3+Fkvl`&j>Z z%U$1WJy`MSTWfuPxb?p$j34`kQi{Lg&0bl#hx<*e&3fbF6RWPd#kMu8ar2-ly`TNX zuikq1?a=5Ri$@Kgc*7@0W;>R?e$Qt=R`JZ|`&)Z`J#^&v@6~?yySAfC-&_34Nz0$A zyZHTaEe~CCPtI@VJ#=bk|3CKYe*5HJp67d3?<#n^_Jb#r^LJ!7E?-`=uUq|;*UWsj zAKm`;pD)k9{+qk*D_@#_^pUTZ{_2x{SzrIttf$;#M=iai+s{ij-7u$o^0xZXpDw)m zCp{LYjGVG)^wL9HE}4IN+r$~a=$7y9`MmAhoz=U)P1{%1Z|nG8tJc2tmhaPkZ(hIN zbMd?HFaA-~JMNh`ZU5%wuZ^#bMG~tDPF+08Td?)1qS$#4{$bRMDqVH{`t0UM4qQF4 zw(sZeE4AjRw|{^6qlNu9H_TMw_rE(pJG%6pU-p~+*DLP+V))Wq?%VcQ_v4TL*EcbD z2Yxj-dG>*YW8U;!dv_bh%_7L6SKqoT$+zV%Z@sYdhVjP+^-TQ9l)AZ_#}sbLU9qu; z`<^bv*O|iq>Gs?=o9sV*`nNZJU$8mw(UfP-zLbB8pG`%U8y`6M+;fXA@A1aa=UV=@ z?6%N9)=w+EWdASbZ+NA=aNWX7s~7xsd(}hTuj#L1JNDiA=l@RG_}y>&uW(!-j zlwSD!Z+PK?v^N-Da{TM(1@+MW#)}j32F~2idWTGp?;R|-iVsRR-$h%*)l6+&xWBbg zBJF3rSSsY<%y~g-9#OS$57fBU2xS!x&Lf&2-Fzo$!5h!APVTZIRaySJ0OpLSBZZx!*c#QzSlb;+-%BM``@c}?zQle@3UonmtLGr7a9 zQ~2Au%%d{CF=qM$P4TZVxy|_*r1h2MLq+z*YTi>kFy~cWVG3U<>tE>?nZo(KvJ&zQ zmyZ9yne(u|ljTcqhR>6H91BRmEF}Y-2zQ&(yWHd+B>9rzpMa65pBf0r&u@8^(A^@# zxxXa$4>#_4$?!^3`~x!b5W(L^xGb_-#9RaezeQGuXsfa+$Z3()kVq`6fcHW*my1^o zF|RSI5|e}P-igVPDKR;2mYCNd#Uj%Z*Qk79?SQ}9+nn*$-sa-E<)8vY*eUZO>`d4F zg`F8X=6%{CIXNDp=9Z0>m}%Z2F}c@COzuq*L?TCvhsyKbM$xy(}^9dQW1O)khMOlZ~DHv?Wnu>i3hF`QY_O9i}xxVvd_| zUs3vdfM1e01^7*gY0p`S$nPRyqvho~c9 z>OL?1$w5(^B3+O0($h`Wu}IgeW09_$!zAiXPCpfO$4Y=O&z3;~Y93@*= z%(F!fSW#8YH)6Kc9vrNG#%0pOiRBZ-DCy7Z&nGdd#uE3%KS&l1i|nE&6Z2sfl8wW{ zivuzphlNH#X5wI4*Wo-zVz#3^VmWw{Fa6m+qA11s|2Uy<(y<-qOC)BQvuL;{%$AsC^K*$=HmwqqXAb&N>iB@4keGG#ti-Gzyp#|+dBDGu z*aQ55!T%$P^Wo3Fot)&c*g9}`iCHJT40xc#dGPNRebL3;dt90rp7qsrHjf;F;i|m1 z7py+VR2q|#T77VSQSm~IdWECv%QfG=a<0y#oW;8PTr%` zX-=I~Fp!6Qgy&JotaU6#Dz>iY{4tfQxmd{B;4BvIt|hagxPx=~-0+;TE-OkZV^%C# zSsLKF$dQ(ljHo2$S4E80$+OcmEJgGK(vm7N+XbuV8YjP@u9vP@Zt^OQ;5T>ivISk# zlwY{iQ~}K`4wNo03M`5+pDtYdh}^08g}c+(?1iSrp)wXPy`y6RQ(5Qdp82Lq?K~6M zI;n*7rC%o^npB7|NUWOHjT5F#pF8R1xf90Z4i4wg;Mrv{P+aIgQ0_`oA*2= zijVg=Bi}mk@!mqdZZeE~vygcs-;3~LTqTNcI`oWuuYiyFAYUvFhLLZCiSHHo@m{M$ z@eMKYeQ4lg9u;3-+0OUx9>NJovjx@x5>2TLnJ8<4~gb-Zt^2 zxI5~DKPeR7Q^1U_uJg%gd13i@%!- z2^mJ`5fk4T=&g#NXP(!#5S>MJ1ij_(Gp2hMdU+A_j+@e*iFtQ?XQhN3lvw~qzNeuV zDc!fBOFgzr$~bgB`8pK;8OCF;OjiYMXD4M4>QGKY&p6*H1s4z7pW;_~520N_H7rkn zuNr;~?~jA+B@V~ZBCIcd)zW#lUF{Kaq4`dO(}xe!XVzVKKHb^tkpN_f_@9b7=gK!o|(0 z$e@^@a57qRUxv9Lpf^NAdB8*LG48%o3ysu+P(Y^fU{P+^oBnT>fZChB&21>Kty*K@ zyhBO3RVXg8-#W_3$h}VsO{}zqW>?x-ikeQr~*H4*&l` zxpvAAuLjXKecGiHNHX+IXW2LDU6i=EwDxx6?#QUGa&577^R(DdqPsc96;-pdw$8$O z%Bk5|R+mvz|Fb&(9IQeyYG7UbTH9w)Yo^xbe6-h^nXJ{O%&x2HreVHab!|rOjap;I z<2{!*`s=sHRsTA^{x6=*f48IkU%SOs>)mpL`_ylC9gja0t+jGK&jII&?&xtajbPB~ zkM=r8_4x>Mi7eWvi@<#9H^+4yF0Ap`6}?vOOKK{tU)d5$ban4FgLBIM(2faomtT~; zvz~p$gZcs$#eG{$os!9wd6b>tr_u z6#g@`>DuOQ!X`g$YAZ*~%rDwQ$+bCHfyUKqhco0wI*Vi6xz^_7a@N$VPI$loF`Z#` zLQ%47VWrjO$oxb5LW|>_c34vJcDq(rSJzWqC$4UF(Z_AcJ8Q=unAC8Qw&&=vhWd8Q zT5~;c__~o;J?Yi-iLdlJ@d0i+JJ)twdBcD+D}$?}V;9eJXt%8_J$!6+^gA~9x7xgm zw0Vb))fdLaLV3ad-=%d!)q;P`Sv1ET_5(4!Lc1RKKRe>4a~*f7geeQ&Y6qrr5f}b$_X~R#hVFm><{Y%$lj;2E*T* zO7KV$ekw5f^Eb0aDjEIxtP{zfI+6VO?l+P@f1@gYrlrJ~E`Mh$p}%^@Ha_nYNAjmV zk^E^-B!AkY{EhjAclfsuaU?P7t2`NPSI>dQe6rlnCC2Isd6#;MJg9n&WvM}e)F&Dw?gAF!*0`x^3wv#)A)XR>5?0{(bE_KJvzP- zI*zc;iY3cSS4$;HnuAAVvl(EnN^; zQgmlvd66{WCW8kynw?>fji4D=G-FB8a$yVfJ#=U{&Csr>$g23;MV4+Btza=$MDk-3 zHGWJzE{!e^_f(^EhCNDIRZxnzw>Pf93(!(+ns9iQ=&ohPpc(c!8KZb9auO!a7OpUH z=fD~E_)d|=EX^;_WQ_U5y1MY5VYe%jR+NftO zqUDPUwCUo%j%V1fl41EvI%15)*E85VZ$;6vg$4PdWf_t%D$cO`W%S}@1uOEGE?K=; z%MPOsziu`CEARbsP`<@N^%X_=+6+{eXF|S491iWt(EO#S`z2`A#n_2$$#QM1aC^|= zl?NMfnoM`alA@9o1rze2sTT`c7Cb;5_UWq9rw3!tFG!mgSXMND%+e+JiW_NS|Ig9% z@ECn&^to6nW9(@L7p~GK6|DB?XhxrYG7yU%z+3knw`zI8l6;h$QBgE4B)M$GyxR)q zFZVCfFNSHl(*w7D3FlR0St`zs)=O$h!SZGE1H}cfwRE}IweCjg;~4`V}wJGEaxY6Lv|>ZqoFd#!SmrsS+Dauv>y3Vs3+;$CX9PRxC*? z3@k~@FSw&;^Dhe!_U*O3sDp-{7@s}0^JZKXumzLh{NzL@%I8gI1 zS?v)uyju0H7ChqS552i)`NFBw{Nt9)FI`!1 zBdp$?>evVM{Q7Co2uFz(QHBn?P!w!pCvOiH7o%V&)(b>|MmWkvjDk&AFAxP9+LhgH z);^5*o9i)dP%uA#Ss-mC$|X(YbljM+s+?5Lp@&A?S&=#HtSa+NWvf{kc{3^Nxuvqr zq|97(R+jmsvfZT2{B%~Pk1EF)4Rt`8ahk{B4-i}9h@N%qTU{ks?gA3Kv$;NY}ROt#i`9>|6ROv>7s1xeTaBrx9(Jm zu^j=~dQxFU-KiAuTPnt}Ixp%^WghxM)XCEx%ydn9*aj zv6xKGvtINz;h$EJUvN#@{CV?5=(w@tt`REi@(XNsi&YC0EXx=?Txei2Iw2`kxLbse z7#t1eRTq zCZc3$SyTLDcum4oy;QByDv&0IgXM*X2TNU@GFvF&JUIBX}V6o|03{Ens|op29*!CC*$QHbz!z8GJ0AcGqS6&V#x(%=G9h zD~RK_{4T^O{O)6ztb}Y~&n?Da@R{}HWM8S(^}C9`+E3*LnGGFFr;%;iH^9VyrN;4V z${8G%PPh#{-`!{KwiwvOelX z_Tt&6_7K8-UCsLxb8#MY%e&E-+hp$uf}(tgeD^){3KB9nWu$-Ttn zUTSg|o7^QPcd5y3u5WXFt<-)d%bOA7aBxpuiVp|BqbcmFMD^#a`10!v0`PZ-n-r@E?a|$SZNJQq&NoiGPPT77e1dkT)E_VS zrfB_TdB7>k>q}|RDJ5fr@|*n`{qM2LGCtek(WJ_=6rkh`83PI ziyp#ziCSklUSjGdN-VRWS(qt^;>kf-cj1xw6Fk6S9)K`UMrWR*GOUw5GGA;%{Jw)c zoM%TI=8==I7^dP1dyvPgp(nl_kjj@bE--bIB@Xk*0RuK2wN@;kW*Nx;9r+z8(^hG* z924b@m=wh17d8V&N;h zB3CE-S;-J#KXBN7VCquTw_|3WM9g`lh;jgCxZsig46_X4{|+1O$NjvE4Varq5pjXT zHUNihI2RAftsb1BJ+P1BE}sArrGIaU$xpGclY*#xZI5Id2_V8Y;IM7LVcXJl z9mV5EL+z4B`RE~dfWth%7vf3e1WSl0XJEz^Jkp{YUjk_8ezu(nS&z{m~od%OpbdcW;}`| zM?VXGHg<@xEmg;Yf2xjoSz4y)_{TUU_SLaS3z!@)N`LD9Nn-Me@78h7o-XkxzDv7TGE|YjT@H&aJfvY7B0M|-Pn;(>zHaAMV z06M!QUJCq_#6JUWk@z0qHi>J2Uy-;8__)N+0iTrkCEyPwejE6V#2*8nmH12GZzaaC zs>XeXSypb~IEjA*oG5Vyut(xCz^M{X0Ul()pcFjeejc3jprh)v7?|yrX|b>FE%6#) zkHi~*Qzd5Ko-T1c@DPa`fhpt(_sPJm@Kcnt7!5>Ekck@!~NHi;Jj zACveF;5Q|%0H)A}@VyDR4*sexh!dp_?=`9}9tHMDe_{%G!u>z+MD)XoCkI&Z%m7wA zw*Y%&-1)$%5*GohI$Z`lMEb7<9wqTzz^YE~0nU>Cb-;PvXoph>zjCT;g|dR%Q4;aGCV~GtTQI{%@Q^2LFu` z<2`=(8gT&EO8=g~4@x`$xL)ERz>N~~dygk1o(#N8;#+{9l9=DiJ}2>F;1-Fwp23R} zR{^(4%;tCIhVXAp z;2H3DN&iK_i4yZ2S#ODhz#fS=0jEm*0C2j*4+9U8csKAUiC+XBD{&iemc%E3vnBp3 z@Jxx%0?(27B74U*H~?5(gI593=V+i9ZKkB(cK*AaVHj5%Rth z_dAvMXMk1P_%*P~?_pq%jQb|A%I^ojDvy5wR&C=OV3kJ;ZX{!6+*n|hM>nv_mls&& z>q=miuVKIx)>rs<5HNp0DVw_iE1UTqLD}2~*dybn0xO$`0xO$u09H0n09H2V0xO&6 z0xO$u16DS#1Xebe0V|s~0O!kex#qqq|82m<(tjr~h4~8qE(1OSf0eI~fs>?;1D+m< zgUSXxno4k%>RHnf@(xc zc_Gfl#JKqvD56fPs{HYl0zOqZU#Z}l;2f+AkayNHl)ef;QJrV?l&dCRh5OZ28N-Jo z9euHwu-C9IUe|W@8r;AYrNgsbI^M){yIGIVg-Vp(Z=px*lL23O z^=HF1aMK=!G2V6)pAUXKlqf##H)`ZdO77r8P?+yl6JHs^BH1_7#5c;ohgZL0z9A;Q zjR^DMP@?R++QgS<;A3&C{N98DHkRKj2#aLjMCcjwyUxJJM|8#KHSrxs7=J4$QTFvV z@iiLwIIgAm3W1IG@%=_5`vNkK4`<3N20jdLhWYp^*U0CA<4Q)5qU_6no7gA)&lvbP z2BhqJ3zcK!7DqN8}iHYp&s+~CtGK}C&0(|uu2r)N$3&#WI&mLk3)=#ui3=+3i#MJ zDN%e+n)o(?kH1M-eoSBS{ldieCivtqrl3@Ol_tJN4SZe$AKzVpBHT~LStHl)WE0)~|W5xkZRK0{%*kX@m+7?dkTC$ge##Qh3`~}eRM$TL54rU$DwtG(T;c%-&f#^)c#y1z868J z+TYa%zSF=^4Y!wX!58WJ{iBTI!N`^Ttu^&moE)n1%i%ti z-`OU<;o$QjTnY6kGfaFb20jkyDZW$_->P%i*Vn|CW#Hq`p5ptv>HfA3e0Hf9|e5yUOy(+%@QU1pIc{0K`5zAkqCh+KV4;_E%249A%&1+SxvKtbE6=MDdM+p3%O^;2Q-cwwGx*6rbC~ z$GM1{XQ@Q-#hds-;LCy%`DWlye7k@d9W+8#IrT8<6neyUIE;F0pf^`3;jGfVPhy`8 zJBD;wPfT|v4wY^N$c%jNgO7G8QG8bcP!HJ=G6e0G&%8>M-ar6ipA2{(>GIi$>E42a zVYK58^mj(Sb$G7LhQAWUR{}jF-!429EP@jGZpESaehX~mwSej z)<`~viRl*N zQ0ekF5TmPha36joJO#HB#n&Ak#6B7D1UhFAB9d<*4#j6Rm2(yr7%h`=cv5`dne2N7 z4>zh@Zj*Y<{(iJeqkV1QL)5UStaF}|QSVjg!IZEly)0SID!*@>L+=9<-#h2f`;AHO z59iRk-=z1abLa(4dVe{G9`|52=JzY;tqSM1qntVZZ>+aAG%(gL>unhhRd1Y!X5?Fh zA9oug@J)lBk#7wiB9BYH6$ZZlgp!f(Ecmh_@YO-j$TxjR$Mv?-z?TY4J~TTazTWy6 zrgVxhhBx6K&q^MJo>5d-5*m?l?ZyX@F2h(Z6s313@~hek{mGY&xC|eKgSN-vC=TS~ z{pRiA^&2m=cH_`%hIw?k@Y;>a7?=q8|Lb1J;S$pL3U+y59?q*5^ZY|)I26%^g{2wD z*rrsS@ytVA|9ZKFqlr4B3%5q0r`i)LhO*Mt@2T<;(5Wx2as)onqC*1y*3Xwi9o^&z)_X;n_CfYhl+A*jC+QwxfS7JJ<{a2KJRk|yNWt4t&QK36gBnGr4^bs z^-$6j+mMg0Gb|YjBip;L%PP8?=loayThqw*& zpPQ`}tF%3>91q+%> zLf-U+Ew0lbTHikoX}CTW8qFoO@$TEY<*rY{ysa%s%U#i#y*2lvwzbw!YidbtPG!&4 zSlq7Rr5?H&ng%lt<#sV+YvSOS`VP9p<;?t3`)R-XKb@|H3sS8P?BREZwW6OkC~5s> ztD`>_uN^dVz1y0ZuC=u`w0clh2b`IGHCIxbH!Z5_=UDo$u+GtIrpsQjxjikm&zX>A z{WDg_bsEcLk;)OXCmk`d9gf`DF4qc2s@72j$ZMZ7{d0$}wH6j;A7_HSHz3JZofR(4 zH6yc+Cj17)I?&prIcwPjx}VNK@mARNaIyXFTI;LUv-HKD(W8-sBNqSMldSvJ$A(}v z%6`jrmsM|Qao2r{ZH*5fbZJ{2jOo?%?8q+JeDpj-Fa-yx2`Ft zb{;`kr6ss?d!^Tvd#imy{KO#I)}FRw_5X}J;C$xcOZK!qPuTsLr7?Tj9tLdo{%u(Q zstqkqrytuNr}gq_p>4k1{(Vn=8LO4u;|WgECe7$I_U5{0QseanER{Lt^RRMk8rd7k z!>EQT$WTf+T>xz3X+7cijJ1O7t+yU~As!k`S`>=R zate~>9_h%k{X1?V&n%mGA|;Lf-hIl_XvG4@%?UcATJO^JGTfrKF%^@!AIBP_MLC~E zP4y~> zuiot68tN5V|E!}jDtYJcu)JryyBD_j*6VdjjC)Az!cFMbrZ5F8g6TM3a=Kh@O71Qd z>onUdlC{+(Grc>a7Wz**v{z#gcU8^~=K<`G4kNHDwL@#VId#(ni+i+nveWg*VteuE z`M9AtUbTm);Y)5AxM|{DgR``Wg}r9xTEAbFvBN33pym`xxX?gzm&=-ry_Fk7Ib~HX zwegkRYD>zFw4l5WaA#?p8!b5ZIpbv~(WP-k@L(DG7h99{;v71{#v38_* z3fBx$Y>wAMzhp#chgcTq+NLrXslbJ$SJCr{ehK}sx1lXAlyR`_43uHnq2IS-iLUu+ zTn%lcXUL#&H;$P)D|`C5u~=o_^b0g;ZD%r zk>R?Vzv?^0rs2nqL2Tj+iw+MP-t>%=_FQZse{x44kWDl5@yWSEY~m|ZqdT#~0c3-{ zMzM)E#T`C2F>}`F_H;OaY+dY0(R#s7%0)O5ps_%@=|}4>GdzgX-NWSOIG+-RFEF`5 z85V|rBKi5AD*;dbH=5GpJboqAf7BHJW0RZvbt$1f_li(L_kSw~&UEuVoD#YZnB0$; z;@eI3+-=f-!{p|;niBGFHn~5SZoDQ${x8$6GsQO~C+w}49v++%w9Cb}5JvtrCVs2Q zJ;OjqdpN$LgzgNJyQj$>HfM`$c6{Gtk-v)=*CLxIPnIP7gYb0%{i)`WnB#on{e--H z&{+tb(Krv0I0xt95--G=?+(cGGn{?Ic<)BZ!omIYDA_nHcyB_Pj>B@Xfcl(nHfYEk z92UGQq%doVGQZ3cG4q!!G0nSHV&-*+#LU{$5;NcXB!+p~A0+nS%(h0(u{b+X?!>fr zfW)+y-;U6q<+N7f6yOaKrvkIisWTav?`w!X!2C{!I31Yd{lqLwJI=)9NsyR4(|3UiVAhrt^bmTYFbX$7pp3%fV(lP7I;=w;i91e?DK>gc- zWF7NegIebxUSjgm4*HXiH2Jcs$Ge^uz(?K7Ky;*zFLXNhlQJk4*59mf%??py_1;bK(VCj zXJKcCj)k3a&_a|y-Um~J%|mo7Y#yp(VY9TKeT4eP*F!AZ42EXH>rXH)*P>vWygZ1R zCaH;;=4gqT<|2t1PvjRmO!I!}PyDgOO#ds1JvfIyQ|XwxSzNGKe05TEhiSg1F@O_h zjq^PjhIz6$#44>3Vs;G`lWrLit3RG6V%N}cL~veno|v73)rU4}dM*v(lGWkeD4CG( zxJo3T^k`uxJxsgp3KApGBgd*1PF2(Z9c>9Y#V}TjjS7IsRg1Pfn6c%E6?9Ov! zFQC@NP%Nv9FK;fyWYkhA(Aa|I+?=yu@%+WbG+FFxxdh7zUp4;58EMGM{M*BY1@%JY zdD%kks!lWd6kJF z*4Me_xU

      VdhEZ;b28Bt(=R+D?2B`e3lk;m@g{3lMmM7E*LgMeo_=JAL)zhfeWy! zWaN}^^ zC9|GV)0_;_z1_Q`;axFOOW@=;&$u?&oS+!Jyg{FG3SqT=|3 z3$}re_YU&${-pSh0UP)Fe4NJ<$-bE;J|AwT%0Av#m3_R|8u>89|D&?+&<$ebPS(&p9f;{OzRp z{%q~cmxRX2`ck6!K7gK)FAsbvP-6WuKZ@_Di7y3w^08J>D!!LYeCrH+d@NLaTaZ~} zekX&E&oxREUk#LqeKMfYkYDO6zGWu9h2Zlr0V#@aiHYwF`0}8`{Hkk_<&=R4j1C$h zA^hG+k(ejNHwb{(M^8vL8p$G@$>+hrF!J>RF!DVCKE8`mLOqHbfY?U|!I!kK)@ zI2cAgez(u)gK3OX>RzXig&nVQRjDenUteE{h zh4xXDUU%3B)vz>!uh^!C^EUD-OIu-wPBP_#Rwg@$7ckT0r9Y-7Vf zq1w`MMtjgaNaK*6Ry+Dx&4)v?c58QP4&hq@rypyH&>Crzr5JVOgPUU2oLDo%(cVK| z23)+B+(?Icz!;p%>7J({14-Jd=wO4kzQ<)Xk7`?bbVng=>0!m-#x`6+R&85*J4&G8 z5gT@^JN*4OBNDgAhpeG!?EK}5c8z>|#IT2=54p6$o2?aBX#Fqce^)OQM$O~x*KW5S zxWvnL$)Uk!f@c*4XAAOAaktQC%5f#N(giuJs{N18}`fWY30Ysphz z=c$>l)p{$3AZ$ysWzFAfrdt~09RoF2Y{=@eEw+hDb@jw(IJRrU<4nR{%l3Fs?BKZJ zwOcK&9_e>^`X^Z{Fg_gf`28GO-E&6n#`uwatZWn@Jik5w_PIY_HfaG{%j9RM}cZyF^=Kn^f0>#`f5% zw^yLBuuWd4`Xj&Yt=j0Y4-#Bav+V9uY=yO2ZFJ$ROT4_6f;}|Uadn6p@p43K9z2kz z&2igMDs?x`@{0EN%m}u&RSC1=8=c|tN#?W4vmnWeYH-CKY>j@sHU8A28q3fr>|b+s zK&mzK28=kx@6AZ{I#Q5hG-i+;>QAx^lF2b_oeVaCuOdSWUV4o?+BM6I7JINYesUUu zCF$mxm^N=|tEh1s_FLqLC_+Vo&0e8*$fKeDGhgQD`TEUkkbLkxdu2vr!a+6en-;S< z*)h=DoI!n#!WvmH_Mc=uv|o>X12jNT^^?`+_}1o(T`OC3g3e|%W}plXundgDgs5W| zM~pFBq@y!JHK}?H*PX1<_TOShOY}L$zJ`5axWaAdZ`jwUeh2*!`XYx$4Ym=#)ckEY z#yP<-Z;!>+$!)>o-KxqP+R$J1-Uv%Y7QE=M$5>?8p0;rN7ZVQLAF^^=+uL6k^@vxk z9Zq?jxSPV&Q_)M4JoA#Ym5J;^$_nF9R%N+y{`U6qmqY=tzdt!-%T2PEu$PzjhaT=v z;#b>3PS>R?lP0)gD&n=tr-iM1l1N@Qj?H&VB0IPBiPp?_+Cw(?S*N$Xy(3EqLVYx} z#_txBDn#8h_Grr(e}6PgM!K06+ODf%0Cn)UHTCUtLL!w=bah+YmIo~^SIthXx>j5o zJ-ctyw8wi!Z^LEM)9UbQNOBe0_e#t~N=C<%>DB7Iupm_9Zr1k3BfaMM?LFMLMGdqe zjk3Fh#YvXMPWB^@#p&rDh{0Ljs&W&)YRd?D*WZ_=+o!x6zHG~Y&uiFfvb)mGY~;mz z=!JILl#~qb^*wvLtQF6mgU_A>FI? z&m7k83r4u_v=uJ6 zI#d$kd@XmQ6}@85eweLgvxZVvm5A=pHYanA=#= zoYCez?mr!WHV2e6H{_Ies5bwWq*zxBZa%JVsri2xG_kn$NgWiN1Z+wF{ZhJ{xpfV@qugnPLRC+^!%J@*pxvEj*p|zv`Dns4r zjFPt%*U%=^M3xh^>HcF}oqxopqVfqPt8-=rMtge=_FgvC+q2Z0gbK7Sj)h?d9PX;_ zh4UsZ+!S)~mbRqU-Pp~2rvpu1!(4||C9krr&3bJ_>xA8*ZLo1SY;1*%ujw{oyWY0I z@$%C--&r$bv;*BL`kz}Fd)byqWs)9<$?V1F2R?I%x?2Bi6s&f*wNQC(7M~j$OAw@& zce8(cx%(4a^QKU&Y#NO@Y#L5B4QFExn#QVL+h5x*+P^4wPJuZa5b5OJqJ=KSzTdHI ze5wq2y;$8dt)YeZSNmFHD=ONHipxO7b-jQ@<%xe?;;;Ij#~05es7Le@JFFowc{9uE zPP8`L+%H>dH@NF8ZL$5=I1A^vL(zpviLx1W6W4~9&m7MteIm}hmf0S3F68H|7HY;n z+3|#*=Y{36jqtf1ZayQ4ho_`IXNs2Gf&CWqJ=v3ttx4j4!?cdm_|2*$(wq(z#&g#> z8T@h5Azk;e;M6R+CA_~WTn@5@_2uAB z*sXq9>mD|3m?{29llumfd$h?t&g9NAxjR>~O^o1msMxfr9S$HHz5@FK*Osu>=_ZWkY+RyTN2%2=4H|M{kC!IYY{==F}*6DS;H~a}8t)_lrot+o&zlt=r?#EGB-Arz>InD3g7U zsz96>UTP}e4W{tVP3|gFc?~ti|C6cwdz->%n)nWy+%^+GzcE)rd%dRo@mnv7ULL91 zCfT0oNBzSlK7J!jnT#U=Ga?2Fmp+c1fENh?Q+iwnmGU8u1dI^eA>;F%XTtx(+}prM zRh{|ccV_ZN7%+)3MnpRU5d#8E05K@G6F`gz7ATEir7*ln5F`W;aIq#+3KMF(kXlJn z?Ix*}h-C$;HMp`R)MBJ+#o85Z-4(an+84XxTD4To|NA}nc_wFWCg8sOKK(zRxpSX$ z&U3!!IWPC#bI*CsxtRTbS@KtA+!LKap7hR<_F4p-JSXC85w|Np*_oE)p6a|H`71Yg z*EyR6Z-{YEcTPzDcxTFUW;*jd<@*(n8)6B&7fy%Mrb0>WWXv3~q{~yjU@%Scbn;N! z3085w=rurih8GLZa9$ri0)Qeod_&2(JO1phPPZwCLG@C(8JM)*14PYJ&Se7Eq+!BcOoUzWSt ziiF6^V~qN#tp&?b?XQ?m9}5%2GE$oj=8bz~l31o{+e3V{?J;c<*I*X>*mUU6vgPwY zWyT6mna>GNeZL?)%V(wVO#eRNDbprA({C5P5a&+esmsrW58?c8!ZWYG6P|f}U-$^l z*(^8c$^3EuXYwKNmk7_emkZBgxk~sF@Y956nQ{LPjk`>E#;q2f>E0ncbtb7jTRQlB z7Ko6q)Me=9lWv8nQx+bG`S&qV5V5o#sh{pQ&tSDVVVUaw@fGCh0a}Pdzt^#xymV1m z{=Td52dc*5V?}`0;qYB;Sa%O#d4O-G|7TtQTJjN>-$I@@4-lUL`MjBd%>4v>8u-g_ z(4ToF9Qh#5Q-o)}XITE97oKHc?m3WW8StLZxNHN|hkOXad@HgZ93*o8r8^YJ({0HHw^Phy@g0sWAh7K%hV|N6ebuwD~CxRa*d<6WJ z!ZY7D3cnEiD&d!a=bRNWsZX8othajMS#K@Ev#$7jr2Izkj|?Jd6tdwXGD^b8*DSX zbTPIB#y-u}>lfJ}jN_Vir3i30UzUJsNG{!2&D}-`Kxfsegj02}Qc9hS*Vj!$5hVd6 ziH~BNbQG8yIwutM23o1Q+QJ?RTNYQ>z&w!VXNiJfc5$r5se0{NDPVVx>mK7mO%kYX z4OjxbjI@$uG-i*o$e0y7*%aif`TewF}m*ULdKN z)>gBW?Ux10t!%3ntzWlvtqI^R(jM>B3R93tSn>O?WW3c_m!_2U>MvJZvqE5JSn5PAy$FwHGE6WYT7_9TDoN2%C)$%nR!|#CcLChl0A*wlI6*sluU}cbnz1P z@|c+3x?pkiwgpSD8F}h_pe^@(t71ELuSL6wvO*SBt)mU6=7wcX?;2P+u3nY!rk*(T z!Znx0ZD=3dA>9=5C)pw$O>4>0MeDKkcZ!N~LsSi>$L5CJ5teWpb=#ln!Q|5HA)eB% z6oHgkYnznzvNi2hx{P9NAMI^t9`n;a8*WOu#GblqH&m@#ynHmacUZa9t_e>p%`S4{ z2}xb~)cp*5P@~{I65ia&jTYB9jghHc-)*T+Sudz*C7%eg4@ocJnXGkhO}4>h17e<~ z0hyL+tbxvC$g0JT@{(sOcmL--tMAhA3MvL~7Uo95`)Ch>H%p6GS8tN1<(X1RC1#*f z1?bh49M)Sg_aU7~Hl=FP74V2^3W|vWGl}(<{vTQWI?h|@90sI6$J6ie61ZH(2kAz) z)6f^ekjD^;A@(C}(!Sy!{JrJaA68Pi14!4#i$FlbD62g8#U&r1Cuj%y!0cDf#X)}_ zbno)uO@Ut+hZ5yT4IaGvEIj5-@yg(^^;<4s#2_i&Sjdr&&=b^d;ju5Qc;|ZXRw7Kg z)r^+F8|cA%)WXASUjok$U|YW}2xEFmOqcWrRIV*|H~fa15cf~zegir35eYktbg3W9 znXicqV>v(LsoxIq$H|c5Jq0-%?}U{Pyv`-?zURSv3SpyMs3g1=58khVR|E;_$JaNe zMg8stW9Ro>_;H>?iE^a7Jmr#uNY!qT`B%9+Jmr#wcP+kSGF`l0CDN_*;MD?;^C3!# z$2EH7BN9*synT=*9$&v0#(cbsmn}OVI}i_|2~xb@g0bbep0_X|<>Jv3t4!&&l)aIL$ni*3(u44_lyVc0pOiL zIQ1JMa@6lJkA6h}=6tA<;_dU`ZN~dI$A*YkgoAR#E5SY6uHTUo4?%_$?=r}dkGS5> z6b$}o`3-}g;-!1=N`RND{2UM7Obf5r!W-nhKLd~B9ZIU-d7k!iGw=!_#QcuHq57Rd zdD;1$1H9=9CUSKC5ps5Z*8xwj-;pB6{13%p_mw-11{;ZF2I23P{r+%M8yGT{P%RTj5jGKzq?|2Just4~S;N6aJC8kR%_uxf< zr}bNgaMka5Fn0M($HP=Hh@<>7V8}=4391I3ULRM&%`m!u0LI3f2|T8!L^;wwf*~KF z1GL$~>yhR?lmmrs_T;_Z7QG$MFA<&raWE`4qxd$(Z!b+8H zu}3Z+a;efC>Pff4N_VQ2?$dZa+T}MLc=#nq^ZT$zZZ3q%6H;zI=zI`zj1!>)v=HeQ z;mrJAhePvQ?RoCs2fS4Io#&Bz0CGcsqon%Hft;Q07AwEgA*|{C%yU2O0-jIA*}k%!}ZVl;604=I`HiG3Wo7mDCwe_ z4gC>vsqRBx^rZVJ($)LM=MhuW-31`xGK};g@Rqo&`PX!(NPTF~LYZ4pH|0nNA!o0< z`8CpoDyIAxu5y3IeNFQ~f8v!$8n{G_e#{qM2=M~kvrXgK*4>O5Q&tu-boO;O{5B1V z_jy_>oUhvb*tLr^HhztHO|Xk?>!h*l>*?4laU+(5Bs}30&xIje1&nOHo>w%UA3OSS zaKf%KA9k6dO@6}c+%l*`%E{@}8N=P!v5&EVBI2eU@=wL5#dF)u9%KPyCx7W6|BzRI z>>BPeemP#t4jfy4OFe3GSs;MEpqy6_CY zNqD`dXk5B|xNne5Tq!E1lP~vUhUvVikx>x(%Qb9p7zko|YR7}Fkl{@f9iicrNcCzA zXDx6S_E+5&t}LN|i}HeKq>b6EPauofqhHWH?#O&dsXzD|?ThrySark=&#m5ZrIAVoGAc z%GJ>&iCb^4fljuQPeLE!!mzJieyb;F-SqXkiGU$5mxSDpds5IQyD^0v9#;ucIod0b zk4Q)((q!KYuc}5LhB4k84_*X*yeB9r-se1c`+!#jA>#27qIlm2579(ETEM63+w6uv z<3w@5%44B@8D+ipTZ7HeMR* z4HC>R`y`6@8}PP%Z^E7Go$aK=iQr7ivG8~cQatt(ZM-x%QkCBni4(z@#J!_5zxLQ$ z5yEV|ARN3mDluKsr*M#u;2@2&@a(a-sfbU!5+em01UQxm&lAIVaL+BCmAHo7CUrgm z#_lWe`XI5KNh-(vx$sL+BLi^o#A}AS^ErcSdP7aLI?-7=TVJWPbNM39df6h6QV4=7p~-ose6cHzu4nJDfWy zoKuHB7kB%7C~ddER+U%D5~uX%0w;3c49m{IE?Vu668*la+RyyeH|cB*c>@3~-8 z=_al#!Rm$u7x3h8InGFRubo6h@ zqi-<(*Eq(cVl>UVd^r9)WZ#!RNj$m5e-cq6qtB>M8bMxZKdJcNWZT^h?BocY{e3Up z`HXZ7`E2)_9+$>ue=gH$mP~WpfJ?A#>b<@zJFy2U#}m1yuT9*8*Cy_{nDnZJt+j7P>%x~*QdQF`K3u^?>&f%Jo3YwpGf_LjQlW9c(L;fsUP-5{fQk| zT(JOVYxylB;nK^CZEamIw-|g|Zp~M@ntT_iT3d?VOk=*hva~<*@NcsvY<4<((y#_-rK1a8E zC}2jpZFj`ESIXCwkMsnB3t)G~uS)s3;gdY!lbwepoP9*U8GY^%3Bcn0j}q>-rzt&w z-~zCc=9n$Xy}qt-9r7P=rh44hICh_f#3od$?TT$ zU;xW>hSZO`rFqh6!aF?j)h5LKV|+UWx-a*Hb52Q#;e5|jqWeZqc%jGrSC4+LdEBg5 zCE|Tk9XQi{i3jhHC;T&>@L`hQ63FFZH=`p`{;vCrPFhmlhh*d{X^=-kZo1 zhj%3M`fi#Omz@X@-)p(%fW$j8dCK!1q-zntChIRvlkHCJ{W%}2_WnbKPo&F%d=Rs$ z_VRT5=J4Ou)%OLLXB@SE=R9|k{kt?k=FNAbE6+gJj<0; zm@khWGtLM;AwL&^AS1&}fOxOsx5BBHsTc4G`FWI({b+}|JpX+h2nCt^4tII}C*}8x zuD{9eNS8PH1)spb+4VR2+xh*p>u>T4J|T}hUWy>2KPwQ#Y~){USa&TEc*+lq|RBrQ``QyD7P z0{BF}zU2Cwe93K@VXR-0(K+Dq)Wb(XkgY$j5glLV7>rNGk=Yb{%p53$!$(0-5f0r0 zzL>n+d`6PL2!9~efoG!w2WUV>2VRIEqXWS}Mh8|9D1;+vt>Gy8y6aGVB`$B$8td|! z7R#wuT5=-}A?$yG$;-bNCOd_o|7-o(#!Xu6M1o9NUFGtoeAtLUrjE*8K7^C5ZDLXS zu66y3$xn0nw2XeibMnqByzt`CkV}d$8(lhXeA$%~KRfA~it7{O=rob7zIE~1QeEg` z4@oBm@XcbDq&S|S-YYy@P+k9^s6EN`THl}|9LdI@el?8wVfSopyUe)uLIrC^fkAjL z)Ri}89YE43f1d(o(tx32(9A(N&rC$>P!rKL)bBfLU*U;VrF_iTUy5W?1Sg_0zfy=2 zU8giOv&o@73kDdTBFv7SB3Lqvsw+ogd7f8tU;|bTo>RTdd zO^$n0Nr7>u_@31|askLf9V?r-LD`;~aFQqWP4aMCn0RTfDdpZ_+4N*lkDD$RJji+; zcX^AJfE8fFSl*sHYOfHxO07UITB_~fEofIwSp<}H4fYO66kaNEW=z)-t-Kwd2UxPC z2E~zhPPrxLE?8tSVL@9>&lc-$sF_3V9muQ1!s&S;B?a`k89X&hl3Z*qkDghcUh}e} zrO9D~_0rL$?(_ST{MVuLBi%eBJ~q#BTG$~H^2vE7&gAv=ah&+;iG3;3{Wc|)yBI>`BNFf^(q%u3`Cy-nVa!LC2X7txq+15gmE$?!!J};%yRO8;Yi9zl z9}3CV?@@#?9VOL|^S8EswDD5?D6jgxjd2?r?=Zq5IFuBRYhY|VzRwmxi2AYnuXy~{ zmyJh9D*d>Qz{V>Bp6bW)R=oES-^Sy7u5_m%<;wB=4*YGrnU;QN+6g?`_1Jh*;7Fz4 zw>)_3EdAKGR{g&0!J7%UbjPWdk>h!j2k&l6KaN)@9>1*w(Zuz3x5Og`iE^Z!p7PrV zJm!P-!E#i*4IaE5z>`-rNcG^=c<`RI@OYgl-u+-~{T_gW?OjRrYXn0+A^}}i`SCrG zVbu34U~Iha!y&JPCMM-bUj{=yLI>z|3-4mM8AiOfJlDswedzb5=lb}-!V6h=FM04@ z0v^XPlvKZ;dGK;@QD}P}0%6tf$&BRu{;?1J9*3Nr-(m}|$imz0!Fv~YAyrP~=xp=g zMJ&8wBFFOkndd&qaW{^wDQSLh^vH!E7giyhRqjjB2fsvno&q_hqoi{4AVfYQ0dt`r z<(A>#*c-#>F8AQg1YQXKN{TnpgSP~DMGzw1NF0h6@zifM@DziX%JZ9hxFic<|N%Plk_7JjDxn@b0njc;8n%evb`VNt9oEANt)O{t=T3p5+!E(^tGP9=z|v zovJ;L^5A{n!ebvm@h$;l>&G>6sqP0M$T3a?2dM*idVP$CTk-mN@SX);s`~-gX4!Zz zSa@X?-X>3d&`v6qe(OB-@ur1$rG@t;58k`LOI3dJJb3K9XnrSJcwfhLX_sG6;z7g^ z^GJ$A&dzTk@bvm%e}Z9j-|oSq-Bl|6)_CxWEWC(?cbDfnFYW{HdmcGnSE>3@R zoi3jf3{z76phxZm-V=f>~tBx{)m#|y#Ws!Zw~N^ z;I|CNbO|HgGdOHK?(??|eoBh>6g!(1{@3{-XbtI9{1%;RUh21kZ~e7 zNQbR*o(VU@h&Kg{jrRcDA^0m%j`UeDp}oT6Qp9Yu-}1dP>>NtlVA^;uB_LT6u7Q-NnCiTwi3x|}Q8 zjc>)C<+4qBu>ZkU?si_kX7dO2(O743{jBnx#^cgZy?ThBt8PhM+1A)UJO?s39pWYZ)*szIuKqNOuMeL@^+`- zS|?01#aGrmvvYXeg#9p1Y^{&hnWZ^bXBQ0hb(}lok$c)(6#deq==`?M>LaawARgkE zFWT$k*%SNi!dEY@aze54hVLH67eVTGhQ3lh_!)BL@j;CvwqN(P5wX^F+v{Ro&h=fv z8Fj`MmC-A+{c(RRx}YKarRI3OKh|2iz3zznr3k;lFL<>dlG;9^;GKSzWBy#zSMI(aF{QgY5th7})7cRRj-oL4`U-vuVFTD|75DPE7KfURA@PdZug|X6f zTOaFoTTi0RB{inL9pmfL7e#X?Mb906G8R5ie>@i6U%x*V-WQAJ#9Hogzwgn1QA=$( zmdkZMm+^WU+uDRvSBx*19+(}?yK(Hm4P*Py4xd}Op8Ncp&k4lBxs}CE<+a@?Q|$U* z-^!{pH8QfWEtzrN*LP^Z z-mI7J^X(llVgHVA=e+za-`5AUu%*p%oTj>E7hDu;g@R+coQnO`MT_?aU@Pi>J>3aS zIXq%)<)a@53+p=@ch=VDRP2vMbBBasYkh7(hcDKOlxw=2(2~VmvpyQkibc;w z-s@-4S&qM0G%wbMSV(qnW;_aLB%OXFd~Tedfv9|SkO^(;a^mH5pDt9lDW(HmP8X_# zAJM9uc7D9B1ZA+Mpxu`cqC&RN>3mc{k^r)73;fx3ybk1o%c_{O_^!QGQ&75-B6bvxGp3%^n-@J3t zGfu%%1Ft)^DywW~!BoE~Dii=}Bb;BmWHFN2n~Bm7xTTMhuAK65{NzpX`jhefSfjYT zp{<{D;hwhZ9DG`3M{`d9`0l3PmUZIu8Te{ML69O#cz!!&$u zrM!Q(%EfU@qo67YZuwSAq@cz*Bag- zc-O*@YZG7enPBtBXZMjFr+Joh%u$Kqwd%l`?r{>n5q(asRs4=8{FffL-9Kmi(N_NG zzSSeY+mn8_NB(V3_%}Un%W3pI;K6^}H1)>ybFFnU6Xo89n74;&X7*pY`??;hFSd;i>OQ;i>PRgy*>Hhr(0eG?W{0 zsP6^BQ{Pd-vp>i6Pn4m)3x$t>H~UV*pJN%fi9hqf{cibZ&+;Q_ zIWs>#8nu9!AGIH1e4h+rn7ZJAImpz-`7Y1A`RD-(;m|$pO&!U=0rRYTM4LKdBoOng z7@*jcuCX8kWO-ojI}wYySL#PTZ+fNNHyYRa`*qzGwEDsAik}gw%@mkEWiW zdtjWoAAU->gbeZiNFJ}dhIqfS373kYHHhn#(=ZAszY=ofBlHBlfQy~iIB&<)hhcPk z$K-i$A3A`QfqkepBseZ%3+j!5y z&Ax_`;uXQe#@mQz+^^wBJU;Fi#{BZT6gD2`jP0_f9BCMYY`mNCoK*d2U#oZ-9=swH zF8eALx#>i_VT(s3*GuC#ZyVSF5xUy8$sOL?rb(6i7o#V5<4>vvvo$4Y9C_l%jqJBgY_#(17V&V;|{;*5{_ z4}@!>N##-JrgB-DzUu~~@vCD~?&t+yf1=E}%uO7eX?OFIfV`D@3GuxVS z4un73ispNt`<_*BrNgft#=;X~(c*^i747?XH_d4Xmo*p1TAq@@l~_xQ`<^}naSm~1 zZRK`)G5vxz9T7sTOAF`sNT(TTU_$gJC-%s9 zwlzO*WG1N0k#&7Ic#1wMgM8;*p!Lnj+yk7$(vFpFPJhp#PN^H-~TDr z0)O*ry4l63eBwXb!k=>aJF`cnceHlxEO`3e`1!TpDsOAq*wU2K5G@a5JJImCVb}S$ zKHFXU&GNy=;N2F!eAgiV)UIv}e^vgS(^$9bN&nHOx|dy;Klm>gsA{iE41B@=pSz*F zo5+#yp93}GrSd>hw%y_0&n-|@^e zEeKk@;hPt&npKsH!A@vEDK2q7QTk@NEG2h6P0G;2UD9gy2Rh!^*@VT>800GLb8J*D zO!uNsx=LNg_*UPh)~Z?a%I`!|zPvuVC_Jt`6FMNd`Pn$v@5i4Rz)6D_GQ%bJ^LAE5 zug)l#oCke^74>1t)eXnTIXlX`X1(sm3)ZOY*_|beI;$&VIR`pN?#=89o7mzx<{U5_ znu*sLZwkIMU_vP_7reO#kc4=5SW zr6Wxfr?R1+_z5y_DraXUgU-&JyR+aY7)vZ^K>YLrShR%`On|cqQ{93gC`JaOR zqdshJ0-fMBJ+mD7OGjHZ!xlVAWu~Z?vw4jVa|0=qI}6Q}KmXS7FN(5~F|qRQ?p1zl z1<-2lgK5tEKv`fyYpio*{Z6!+)_PxjR##Sh&6`>Ax(~8~Hz9UM`H3jJ9Gp zQVbl@oi-|?;2i>eoekmY^kFwf@SNs(O1wPQ6~b`ztn1_W>}WLBRa_s9uYqGtybk|$ z*N=^tQlj+24O@TN9X!9_Ux5^=x8k@!Q>~b4c*VvEqq@ttb|3&!B^3Q+%#?Q^3 z;>DxeIa2~j+Vpmyi{|LTcR?9OFnt&Hb9fZtV1I$c3)%E3*m2MUEZ-^hxIlt%a@N8` zn&-38{|mX#mrtKV+`i7#X>HW`WD1@w0}>uw*mcgmpBlL4zaDz5=#hna8J~XriU;ke zzhCK_@${(GcRzRWDuFybKIq=*@4Q{jK0c}P^oreIsOWe9vsb+Q_P9%4|FP@) z-}wIRX?Z84g$HK+>BQ-*b{X#T>8PE%9s7IQ>c1B$Sr{Eh&OP(vG?ex2;d; zKHqso@D3x64?FRU!$nX5p4W#D);@niIQ#PIE2_zNkTpx$feFG_@w;aYl|0?>Dlc+hr=VmY6hN%ti;|d$Nup5<|xydC%7Mj;4J|^E2a>GX5B%j5NDq^3vo+ zl4pXTaX5S-{DI1F_`-%Y%agY`~-mdD=<&+_<=@H4?b zAUw;4gpSAShuc6xV))r27*`?zRL`2#wR#dOEPT+JjDn>f0pMp!V}{r;fb+G zc!{1EABX9Q`Q9f^hJ2&kv(as|%M;fp217=-64&48#z_Q_X@_B#H|=nY%kxgn_3PvmdQ(qP_dFsncj(iAbRuy^5enEKZyHt4Uvq5<3^CRJ@ z`_sZx-<*Nj|BGpW%Q3)z>yl+-7A#*CU3`|=fWBnSGAnyPn1V~!j`;*|$xh0F_cTWQ_a&Y??y8)PubJzv^L@0GtO>(>k9}n zm$7u!;#EE00830F;Gy_jaC|HPvAmCRElgPo!o8Bs^DFxziA$O5Y#6O2p`zVaQ z{917}2SjUH#`S<6`Sh6~!0>(mnevyVD;;<=4qfC@L}GRg?w`Uq;o>|ATHx% zNIc$8Ew}{#_wb~DMC7*MA;5e7P#n~UVRWwtW8;;dp19%niBObDz z(2wgcY`k~jRt$(G_&MSqp(hCsajjpz*)k5@<2-mDzip6 z5CB37CUSH(dGHE>HwXShaj-k2`qg>xA_%Bu0SKvnn>~0dfwvGc#AE+Y@qQ29F2BQQ zoNUudiuWJzARm!{XMxuao_OpRDIWVRHXiMx`QD(Uct_x2Aw@lShatDngt&i9mq&NN#Z|memOBoiqKbFiBbS4V z=dcRlta6uwAzvb4FFnDB61oujvZ5rC`019Eqm^AFz%C3#ncDGRqh#hY98oM zJldBqoUgjfE2gbD zV0>-f6?2@Q$Q)yxv&tV#pO-ri`-|pJ98ibX)C^^A9?96(j z)9jR+f${pp#0R2bOdOHuXCnPXBE>hrR2i>DZ@1?{0-=Yp3x3L}roHaGNu~e8co zPsP(3^PASxV^*Wkl?xVb8}#X5c1C}90&ny0Fk`l?`0C9a9X^^UK=lM4A<6& zDl0M!-c;;O&O!oH|+9HJ>E@s zwu2p75yRMiW8SI3rx>E*ri_9YKirDf5;LJ-Jl*+;S}DKUo^N0TGdEqb>AX$pN8Cb! zQT}V`ERq#0v+W};db`a8xOV2-jed{3xUG4Bcynjif@UAeE^S$1K|CEv4x8(*Jn?b- zyvq2;M{!Fnu218vfYzYnNZPeWd(S&JAL;R{-QUCaMDBwVEX+N}{mYgY##$b5C;wlx3tTIGiDi&m{~@*O`Oh~^y-f*w+xzaDkdU` zhB5(MtTWP>9Sp4L?k@PIqNdV@u8~dAhR(==XGR{Jb)akT!MX#_ z3_iH#K-ai~tp}bNcW~!{uKa_Y2cF44xc{de2T%U=;KAe9&%OS-RoMn*2uz;+uV*?P zrj1a0RPljKOlUWRKeestmRR`8hHz+G)0a@xd(&Vh>xad0di(K?ljQD5Yv13|N$%A^ z`_7J5a#se>%Ie59``c%AM9H1@nd#H|aC`Y7f1GoA59PL(3X5H=3$w3(FkVpE_};4Q zQGrAOWI7u&YNErhKvN7mGXhuS`HzO2ts$o-JbdeLm?0F$x<16Uvl-1dZH9mA`LO2I z(nW=!bSDm&WhSuFof+Ac?*@j$gnoEKc*OSMUculh%&Hoxdwi%mh%MWQ>FE(@6hWEg zE|``!)$btiiag&8f7z);osqVq-QsSTl7;#tr3mK zv92TIweI1V-}dGeiKO%9G9&xwOUwdudeAEtoN=%fVwI;)OgMEUJp4eITKu#fTGsER z!rKG3f}S*jGf>5de5EfDwXG}P*q0;SvQtxU&~#1qys@t~v18#8m3P1xU^p!wMwFdu zY(cB4Srx<&>s zL{8~bx#D%ZNT5a6IMvmd*LSkqvfl>2TUDX5Q(Fgg^VX5#nNo{q&t3nC{keJk5%-+8 z&V1jgJ$&Zyly@kkG2Yxq3m(X*FW(d$z9tqfte@4^S%k8IwiD{6eWm}#Sf*3(W?I2- zvVw!)Ew}fwH3jdS3+G;cN8NLL1Y!Ghm^jcUfPKN!u-SKpS)8*f+en#cmG7l-`|?p) zXx^PAu1Q1@uANRi5wK*k?k#*nsJ;|n;qLCz?(W^+^>4j|7sj?`|ItNcMrCgs zKFXrq-DPWLq3s7y18dAVlVe_&-s_)wqce|l)q4Zf?nLy>SpW_C3s&S0FWno6uYn7( zGM!*v)ZB|R@Hj>F8l=kY1Lx&dh2w$7bDK`qAIAzE=!OVi_Xqt@Wa}tgY)3~rJG;Ag z4VpA6d*hnQ>~n$zklD+p&LNXs_mN)NHZY#qc)p^TA`SX)X{MdgUjNijyV*eTR%ZRa zDQuO9<8;ER#1u!I#j$&+f9s*{co@k~9f2D!(ma+K9O3GP6p^;17|ZNx?bykjXG*Sd zn;w%9^l!buX+H^nsjcPVxw!?~14(5u0#A}d*=`w3b8FHnz2ee>?I<);cE#oBhn(!# z+0_a}=vUATrA(r5Bw7zD8CjeAD=TBDYCL-fo~Zk1pvhQccvSYTyurxNk<%#@Z##YT z58bAGP9%fib}Jxv_Cu1RvNtsNk5+cKuc@5$9&w~GI!>Y)!m?!2dr+}`&D4J}*PL7s zwbrv;uaU&_9@nKl?_tk&CmO);S;NbRmre*z`vE#TM>-294nRA79UJ(r@WrEz;qBKM zZ)0S`iz3nQTeGZijT<941D66K-1Ko{v?JX7wfb;V?m^$Rh2?JWi!CiCyu;U+OFOMW z!z-WotARdf1Z4mF%HR9iI?09nzJo%u&PizW^zhl&9{^^W=G`Koe2co_U(*<^tq)bs%|sa*V5stgjINy> zvrI~_`QP+?kn3tVIXxr8Y47Zq)y3=D_!X=*b)A8px+#JB8w>qwy1TE=+}a5{vO-`k z4Lw?KHR@JhJE|H(&%ZPPr>tW-pf7@UJd^# z7m^!G&0}FzcIDJ_C)AloQEUCq#Qiy#aU-6qBk|nI7|FHdTPNccVlXVXP*OSj%`+%C z5YN@u0>8`sXds@JtN4t(u^>`;bO1h>QWrcQX_yp{;Dx;Z&n-3SBf$sz$I~0n!}?{D zoY8Lso}ELS_S~ak2bx#Teb-7%o(r!9B%K@Y^=CZOT{$(A>EM;QqpdRp{4PEWS7m3M z@3gme)WO5_JmzN?T$9ecv&eC4Ta~`;TT>>~xlua8&(Rx^f@o(_eo?%xV*N8Px_G^r z@PgaTHO2Bv$c=(MEy|zwukXk`%-oysjT(RLHxEB}LFmOS=asaHS=%o1FI!c3{Zjy= zSu-#SelN|K@9bf=<+#7Ts4<^QrLT}x$B8crS?yzd)R~aWD=6(qr-S9zMmyN-w!Qje zykU3wI&zPF?Z(3NR@{Hgd!Koc#5KeamVrO<;T!a`NRzI)_PQHF_y9?0=IrY#%jaAZ zy8fDZCd4uS*W57W454o9YbKu|a-V^2+`dyy9U>{-FnRX8nRBk0a;AjOB4g$J3zMc_ zH@UBjrwSC^Qw6cWW_ki(SNQzZKA)rZg#-R3-#FnOTS}?cg+?&uNxBt>AEW8d%K+R( z7;N*K(Q6ZI{(9SCarC{1dVd2GdA5jlS=^h1G~7r0i<~jyUTNGHIRBXx&e7iJ9hAALPkj zzDGV?!vBnTv|Bsu!LRegU+T$Erzf1>6jY*qOT|q)sXQlaf^K=jYV6jKR9@wurn`elhtF{y-yf_}pY%TbUuo+qFL%>hi=_d$>~JsmnFOQ67QdUz{4$t4<8dB}JasVkQs9X( zTl^_c@=+NO-AT4(Vk5}>&~|VIbToA*^ChP4#Lg^485SCdaB34qFQ3?iv5eFvjQRAj z06`OR_*iM62o4_=2Tj4Dc2pJQ2>_ao!zYv4Gs%yquR9;q)%{$`wugvZHzrATegqT){-ZxcR(^Yg+}$G3#1j-y$Rz@&~_gwF#1UEzb^Ifq6W z>hgy0EaTq_UkLucgl7>2*rp)Qyz={AKZAwjRT*~v_ zL7wt_Zjhe>{vP3r!S51&BzW4MYr0PfPn=%}&pLTac-GYgepjCUpB0||(}ZV!zaacN z@aDRJ4kh5Z*DBK*2mTwvGw%n4F9ZLW@DsuRO8DvE-x8kqq@?HIaMv$Le>MdNna*RvXW{&Y z@N7Tt3D2ZI7CwYCR!td9)(gMMtov-|3s1dBedbsCBqon?tuYO~)qD+m^rvIk!B{=^@cYY>ll&~FBrGQY-%xcB6#E?+{KJeR)&Cw{|= z>68o4bfUuJ%wc*bKs>2EOA5R{*2s$LBX;|1pP8H=iJi`H!FF*dHQO7@4DboHjx zCZ`LGRnmgB>lan8Uj&2JJ}pms392smaQf24i)oR)Kp-^4d?O`Vvv#RBz>3n7q{o<8 z((4J=Z=WbSKwRA^qMkiT_C!n#3|&`NEv8-Y*|Ka&YBE*^+&sG*%v9IhE;|PG2&UWt z$TIac7XB*EdcCEldI3z%S60DbU;PuN|TX-B43e7 zq(r}!s7t%GAh#4lGSQmosmU$$&%jYpG2otw|^ zlr30)n|z~d=@NX4My0i}K!Z;fA$21`>yTv5lt@DH-if7(rbW}E*xIFwOV6gfN2WJO z&9cR1<4Q};hGUCaipzouS)+ks(`)*c8Z@j#^U!qwOBb`9nng3#0t_}D`SOuMCt5E2 zVftQm+gVm-B;x@5TCkCDW=$FYa?a#(($wO5aC6Jb-7QQWiQTKZTzX9@mB*07G7b z_*}P%&s9q#@l$m z2HvyqBOZpe5_sHq+s0$Q*k@8wyfKio@%EvQPy`|3VfZ6~r~8|0xpV-J^Cn7)=iT4@ zCE!&+hQP>%Wii9cDtBDj~pUrF%}!=HRa0tVyV=WX!BW4}}J_IU8(aC06mzoWs}`aRHxe#0SW>-Q+|iV&Z8e3xPv@v_0#c#rm>UpnL%CxU}? z!qRUz+=}-k3XXU(#BVO{&GZl=YtoZ)W*$kKF;=m}WzE0J{S?4fbmw&$(@;?j+k*SO zy&i?nK@#&zQn^Q=ACgWG@oFUvZTBbwtVc25W&FhJQN~{(%TYpS-%Bqd4=ne(EXMn` ztDS9+H9qRV(hG|xGM#0E&Nr()a%r&Rz=LLIg)loyciiw17m7W~b7>iVSl-mZCOQDK zaoRqKQA#4eWX4Ca=Tl8|s6oZHUob*(?N4IIJ`PUURhG6lb1Kc%4jfw^Yq{HO_Vz|+ z+B+>@h17GIfUO*ag$`|x+;c_Q1tpD#kA#OlJt60C`{9TD2NbC-Jd|lCC7aR#o2Os~ zwk<24{m4B9OLAfH6m^%hNDl7J&WT5n$Zsz2AHACUxknda$NoDY0~;mC(8hg6_PzPo zz^yPi5egm(7|Y^&w+A1}ofn1>EN9Z4hkWJ~{M51$6IY!R_c!M86A{=E4Po)Rc-H2F zI~sF>&AXe19_Y+D(wV;#@v>g;hrP=x&&vv?f0RBo)0v+(^&)3}#?dqw4i#c745_;! zA7$M8lk^j_3Pz=Mm8f^(Mubpbv)Tax-}A#`V(?JF7|7n+ z?7QQud*)`OJFCudH9%I{eZYWC(0pv7chTD?W_^^A@mr3mDWQ#^z>gTqZnOl{%d5@_ zm}#Q^#X6~{4(zt2@l&0R{VVq0D<}$~F3QVM4w_H3uwInA?7-O*s{-Ung(mxHl0_;7RoQQ7w{ zDuhpPx@pI5ZLY|ADC~u9&pOaqh`It8^L}NNV z+QtXHGv7rSlTRd%3*aSuUV{*6D8YNT|M?;2S^q zIlFhnJ8r>Di?hKt`lkL6)@(G5;{qx!RT;(sH&9<|5YQfjgZ3L6e^c}Y=cl2*!%=q~ zm>-KHXse3)ea9E;%&N!zEVS+Limuk~ZbrfvHT-V{K4LrWF)~lwzCMj{!@kl!Q`<&+ zp6_?HGR@@9?1Ehht!PKtqt%#@f|LETDI7k28 zzR2BdJL69})jBSMeWTXv5DVd@ae0MBE3XhltBnJB?xgx7amuLWUJycBkcR=NPV?7$|1`dJ^$_jwjs{$J z6eqvf{ip=@Q?seJT^)PnJrw8_f2i}S;8V)KJoC$UXY$n19kY>{D_=6ZoY^BWic5YFEap4dBu$H}=z zcG>!OqTXubI1qe3|3H`HAkTQ{Eg7EiSibaU zyre;VcWS{50$|d{oj^X*M6oL=Q@rkXE_7Z+Cp<8hktC)5oRv)qus)NKh=bXNl;9}@ zdgGdDT+WFlWzkKOlX!NBnK^QUFtxF|rfS`COq4EJdfU3HWmWj}OCPc+r(QYh;zBLz zHCd@zCNdyX#l2@K&o1emp6tolCqQEXP)w82`5m4Yp=@L>Pv-ut;=$%t_Ux<1_htx% z;F%LXyJX)P`UGfZS~iiWPKCNEWP5Rl{wx;`1wiVBm zU}EmijBZR0Q-z^mHpa<_s;PG8dN%0=_;C&x>k3xued}UEQmY1#H2?T@?uB3Qe zuS7l~0Si$H72t`-zNO+#@Zf!bfSV)^Pl`9rgVzqcl?W%EJ@@yI9=tiYc*+PQqi*IJ zIa|NEXmol%;3xybsGoOlyE(v%!e2@C^X_dIxA4LcR=ka1sNWa?cno-dR4|+w#-kj6 zJX0r9Yi8=Xs{xW4>6EP!{l7q>l7DVtMNG zQzx%VLOta2?*I64<4nMqk})E3_PMJMp)1LKh7_ayx!R2{=e{lREbqiakN@lX$r}^j z^`DSchw0=jSs)ER!{MAfb@Vs*mcdFbbZDDutZuG^v+ekLjkRSuS0#n>uGB-l*VM`j zponlRE-djGlVf3gZz8d2@LK>UjLWs1;8>Lm5tw(pJV=d|a6UitaFy9}_G}~XN;pq+ zlYD5$Bv!GG`Oxi?c5D2ZVIlQ5Wnjm}bwgq_j)!Oz{XQwfeA31To}(X;T)cYKD!gR4 z&e4e;oAw1=3%t?E9b*k#w=`O_Wc3Dg$34B)(JNQpzG^{q$&#A2RkzsvNX0k3ztpd5 zR#56xY18X=?p({U)G&HA8WZ5&;z`ibRZI<(6v%yg6NN-g7c5(U8@iUp(l04clVq^! zlA;sJO8JDe0c}%m113fd?m^q6z0yNjo_R=fNU}qroVE*&7kTA0%$7SBLiCT&6Z8Sx zd=9X0LVXxUH^+5tJU#>MD^Rij0)HDX4f#+!yWbi2;7yl!I2lsBufS#F(Y{IXczH04 z?rI#iely{g%K@A#$MdbiN9X{t@1l5izw>7Zv+)+fEtf2~9=v11N9YME1|G|fhu!b| zF5EWWa=7g~l;)RXHg`uy^f(CXIq?1rbI|a8}@HcqEyKBF+tWrJWM{6L?EVpYt z?ychH7%`vGB%d@&wgsOw9Nz!*c}g7eCdfR^dcJ0S=7*O)vGg9E7#-1ozMfaT44G3u zUV4co5?a5mYUTgtiSY>Xtk)`7XF3|>kH`qIeUfM7UX}N>Ytx?XitF&cd^w7vAf?5drgKdFlr6-h;vxbG> zwy%GdABp)Osodk>?d$(ZxED$|%b&V4&Fa-FH`_sQ>F8!YO0QY_X@1FaB)7{;D&WAXlrXk400!~A~SKE|}ozxnzR=z2>EfA>P z(i*k>i2UENsJ{no^ z-f7UzCe}J$>&;MmnhEuyN_wDyWi=ICX-dUDA`}x1lPIqd*;9Iyf1phs& z_hweLzCYf#H*3#Fdo$mO=Dhq_@=a|6ofilCYG2E3*&BLspx=2d_nmgy?gbyRY^=m({-i#Hp6Ou@fiX3Fo}f9Xrt)dM)^NOo|hw#18 z_b-PcA7$P+*7s4?E3;N*p6Gn~YTv4?xkzN@{I-gdFNSj>GumGBm$in*wp}@8&jUB@ znUT3`qHjjl>E`0P4?07SwC!nnq6wRLo&xXzsB~4V<9Ju=z9(Z({CLmJ?fY9EiS7Ab z^XV1$bmT5Cf8vMDw}$SGHUGn*%%<}9CqRSyGk1R$xq}8*LW6_YXs)>Riiyyv<7CCD zeN);DVq3@YeFxf}_`#lsry=#HFGuRr_EhXI>x}%M?TJ07_cS-R*R?zdMcPaE9Be%G zLQ|~$IQGzMc{bL*v!yMz=jP^bwV!PHZfws(k@sS!Pe1Xa8JP!5-@ghlS2Ovmk^C+u ze_ePl(UJJ67k-LFCxvsMLdQ-f{^*{EkL`Ib^Tr9Nf@95dPgZo!d;lq)ZbBBB^p#ER zVJL9iltaf(B){*&SjU=u2VzfrcF&Jrcp$dt`!jzSd*X@aZ_m$c3O_!j)pfk$)ZwSvDt3-R1x#)$TT?Q|6#p?~x2yAoXWNeLd16n;$$dXW z0W>$?)HG_q3lGMcZ`%CKj&J46Y%4!8YtNzPhwsmP{7NM7TxMDH<*T4~^OKF`&A)^% zn{P+y6VD*uObphFKSFWbnH4On{c6q~jc+`k(|>H`=bw-Jnz{~lJk$P4<3sVJYd(tY z4`Rb|gXa~z>909DZu_>`6%O1NHa0BF4W6z&cDQ+WkS4!}Xl%!8G~-Y@u3)-?{;sWG zeDePEr;&C42lt+?-xNllc|HlviG$-=y+3~B;w70f@BQ`m!mNEL*GDdbSWAytd{kLVlkNhux#y8)8`m2q( zJDPLa!z~Zz;Ca#R+takYJ~laMVx41R4Xnj?XD1J^3s9duxL^5dI@6|aoyGguA=+^A zS(Rxvv^4iNxrG|OgXX#-CL>xs_u;c~*asE+&ZY(P09C&;)^b-p_dUdic(HXslpHrO ztS=u7JH)6lmaM03^KjpFxdj`XR#TPf&b}?VjXSqL6tAn@5^G$u{a`#=yQQToYfNYH zYk~MIXm=O_<=YSL4Pb{we7t*vzug87kHPS9VO^;c{{TH%AEIJdIwbaC!Q zZ*P95;Blsa-Y)(jd(qqYsIGJ&Li|Qh=#upz`J`^B7$5l>Zhu(!tN-%P8*lu=svkUu3lV0=3)!I^e)Z(|+{cBjwlq`NF{sk?;NC3qRlfUt{B2)82dR?Q18T-x;~A zw%`57ZhkUUz5Xx?ZU~OMaI|M!)LAlX{Lv$qeeIE;@6v~^DPPw7g837LsM7RtX~zHy>uq&bZux+P1VYk zRkw@`MQ>XYTDN>@Xf4bDmTwBJTYdY|wb@gumV|EERI}8C-cq${(aNQvs@sg*hUlWD zS7w*5Tp3zbwQB9A(1xWDBfz57HLGu7?2*~!g1Kt-s->Zt=(^==L#x-XLyi|M9sRd4 zYHYJQoT=WS?9%RS!^lyG9-@sR$9PCzLWk9#G-|^>yFH3ScfKnu|AE9CvFpKau4W&c=IhRR#e1GtvrBzCPLdHE5|2-6NLOl*}y=@%XQhTWPUV=r=Zb^?) z?2CU(#M$BHJ7k%p&t)zg=Y3ehd7}KE#m)UMIPPn~nebEMu^n>U8}1HqUt#16u)Dbn z@L3Z+$Z4?vh);VhCAuexV=vBm@{L-x>Ek<(zSmMr{aKdzeBl6@a^<8Kh+`uv69%s~ zfPAke&-W9)qmgGkj#-muJd)b+QBKFIIquCp&`4L}AkXkc7XM}8aWbTP_1HMW5TbT@ zeD6=P%adkiIQNr*h~DO)7`5S)vJr!G{N_IgZ{$&hE7#3au&sTO(S zFg|&PUnV@$H01_=rZZOjnWw9T$I0Dq2Qne>-@`#1>e7E;P`@!Lqar)s61`kTj;>qs+Q!%{mq7Wg8|B zRG8DaQU)Utx4LHa;-&aP{3`d8j)^bx@dJCkCq2%PMfs%TSu&|oNwX)OZ#E`|hf-MS z^r|uWR^wTcO_EAoh}IxipG7D#R^6ael4|lNQM^6jeS%U%oX>Gum0HG}kA1s1Pe zSC(-6cbE5LfRxXf9{S=y$N2;NlyHkQWbPN>&Ng;-H)I&cmg6<5r2IB`kdJ5pZV0?5 z@LHul45Ry295!AV+=;;(@QSxg_z2FVpoPcVx8i*od9(22N{ZLdgI8qX@&2fIe*|yqw-9c*O@r&v@3+E7=m{zT9`BdtUWc>d zJp=6b@aOYBN+D4lvKY3 z9=s4LU)uq@BZ@Zxyp1;!7sW^g6FEA^2_K;YG!uARaAv#WGhOl6FR=0E0*`${CDjkN zCle;oy@uOz=}YeU-@TR*17do^?QK#?4}h%bI_N@!+0oJS%<7n~Fsm)&RyH z>z|7P<>gTmE}FkIU`+vBIljJsT>`OK-ra=5(vueLxF#*Qy3Gcso% z>o3f6wP72ghSU768)No$_-GmilP=g%oZ}9xc>V6OzQ0#X{%L%J2S@im;lMYpy78@q zZhnsh-wZV04Wta*=6hNAMuYk03}no=G&*s{(R~QVKSSk%9WaQpyn9L}RSBmG+VIdFIH!x_sm&9{NzR}1-C_}%p#9RC2G$3H@b{_u0) zzUzMQI2^cZ@5329@*b*P*wAtp<`;tfun@X7w6G55UB#b4FXsf7fgCy5XULTfl0 ziIrZ17Kxf311dzNO-4;7s68a2nMCbLQavP|(nxA0Xw$=>hS-)Kp|+xxThUg*URtq= zsI_x{zqQwd$rkSEIp;q2JkS66uVl}D*Y~^L^{#iV^{$UynZWOAh4IL>X0k82u2*4P zc?`o?%MxK^Ia_?+S7p0WjC@Un8TqOiz0JgjUk8)rA6YI&RwmL}uF`3KjfaOpo#q9~ zrF_0{Re&5nn2~o&c;JZ^A87Rb7JM%75|KNwQK5g6iWHJ*`z|tL&&a!x?!KV>J-2*b zA`_rM_X+aXR$hRVZkzI6?!b-s{MFutCsA9|kmD~}eBZ>UyTStlthT4(;ekCZzHh@z z;Xfcz_3;CSxdS&yOj>+SrrCZ=?m(^l)>4b_@1?`F<&UX?xqA8Cw3hbD+<`h3Cq)J+ zX?{4KJ8-+{2KI=W;qpfwH1pxdT3Xt(atCfAsvE}T=g1wngRXa;LGvja^#3P+>_Oa1 zdLH`OsgSF9I9YYTO@o_8fr-Hi+Uxx`kQHsGC4XA`p+D+Zb<95pH!5Y8h_0SlUEQ7D zs*fFL6CHsHgy{%eGUYvn?Vlpu(xjV{aP;@n-v z)eL;*@Koy~{3oKK9qgbq*5hK{jEF%zEPuk30QfgNrFhElC=-X9R$^M_)|hlMuCw(9 zL^QS&$F-jE#^UjP+0GcQ7k@bYrKi$&ry^5efDg0v;tl~bjBzQC{3il0W|W63dizB8 zV^4NJQ`-H6_T&>m{l@JV|3c3eSta6Mdal0X$tS$VyPtLzbZQ`Aa~fMC4)62AgA`HW zW^p=0rk{f{8^Q6rtLwhbbm_Vyg<<&tv(Mabqyiho^`LKG*tlH`kv2#Q7Z$X)hWX{f zM2S^dE#V?-(jt0(OR)}Yq-cz;Z^?A7AE+(I+{Ue^&AN{W$~#!bugBI1!>0|#B>v_V zEyhZy)LDQ&Epo%!ybQgl^@d1RdpFm$I|3fvhD%)_8=9eb8Mp&-Kw{aF_0zF3Bx8y? zVaDW!SvqmkCh@;AM=S9Cuf9Q=Vu)NWR9cf9*YUL#v; z$)CkM0*ho$vqmP$jAfd*TR}Qr4B8==sv=wY1hXwpmQm8fy>Jh<{{THDap;In-u|#3 zjqpV~5SC;z5QH)Oq>}z^`itHh^E(3^X)Jex1$RCJ+b# zHfCvco{h#M>YH1{3N(=4T%4Nk&vzK-sSKr<^Fz!vIEtrQ#hjFjKBG_Tvl&0tMsszy z@na3N8Rm^VL%9)OvmMQ_As3hRuua;+VeEbY1oF zyJ<*pS65C)ARTqp4HsCmoN(XO(IOi|=HUAMKN+VtAb*X?SJbsNr7 zxK<5;ehni|{B9_Bi1Bs38Fl@+`n^6&+w8f1a#WERqv&(TV}^Z>amWrl2{X4z-2qkW zG@c@xEE!5$GjMyepA6*65PEh!3c#zd!UG$Ot8A_52-6=@!hcYH@KMr8@}F@MOPV9t zUFoXhAW5!q_f>+AU_k)#-MY%iLxtUO$&GhN{o$FA>zK|@B?t&k>DkN1q@>~)r$J!EG()U=s;2qhL z9L8&+n0F=N!W%k#u0`RT9BPGilQ7_+;&goH-chu29oMC?O@LAW_sO{NUCtGDrp+6D zaHq~Z!TJVG=QMjk%+)sIl<2zxpJ9|VH#~oZG^l#)v&b~GQOL5YQ-29hVtZ}bjXv{s z*L(5Eq&Z8y_&ts$AY`eZN?|-TxREmeF|`@@_!r&wN^F1sc=QR9P;(q z%)CGqUn@G(L?Q4_=Cvee31ZzHa^gh8k=|G^=e|mgkFdnuP~T9~;24Z8(5JK9w*9U# z*{E$gf)#hVQd;(%Fms*qUUg+fX*ffyI)RSESS8vgp&$8W`y?%#p@BJiAP7*k(O5Y? z=arft3RkA*P7=A5-lbm}+F8K%y*nLjW*7Yhql+W49k$si!?qVSI2hYRBpn05NP*EO zA{u^-^`dH-$P10U9*<1xk3|bQcSd^}TfMD4D8pc^Xm5<)r3G^MB(UwnRY#(eA}9I+ zTf635p(=WvDAN$@r*tHK{P>|+*lAf5?!^lw9`Re&97YtvM9Na##UoSV`cWY7|TR$ zhwCNex?$w|@dl({JMzTodW1N?N?V(i*1MN?RUroWrgvZ?D%CbNRQWb4ZfxAaN<{rf zZ0HNt3~V&kIdtdRK+0JB&8})2Brg)f=vvC$^VjV4>h8Tgm%$Aj%~~`ewu(BB;nE_u zs>r9CUC0`&Oup79jT}#E7m{(*kC}JWZa5sL`$;s2>&>x)l2H-c+CZU+6Ph0z5yVL| z#4~o&0c+i{*)fs|A?Qkjb%X981_Jl{u|%gta(PGzwmY|Mib z7OD2n{DwWd(~V1|aA#@dm%HIS+k;Y~F2=fNJ*6c}8zZ%uD9Xr=Bw|}n0;4ECRTSAJ zA(hP@(ErdlJZo*L14t&81)h5Z{XTB6Tdp58$HQae58YAc81VwJ8+BJiTN2GR7THW$ zX41}>>r!eUOjjPSGmVsqKU7W@pSM`Ok^-0I(E90@GF#`B{h9sC< z@pWM=W%Nv2#e< zPq)!@xG9prIwLEH%EzZqW%*DKx&!{3!4|6>F6`47xUtSDt5tSx1(e2U5O&_@=E6&M zZn|r=%XQMyZo$iSwumbioD7+2Hv$N|{yDGiq(G4EiakukwKnj!9%!}qj*wNPkf_5g zjE3to#5oF1H_3pY;30cbGer83VasfvlVJ_mE?efnK4qJ;z5B1|1H)y`q;`gQYRj!6 zZIYj$;`%HGeRLhaSFS}|=yg!6=5xgQ5%1n!vx|~r$QhHIdmp1Djm6`GW=pdlCZDi_ z(1x^2M@V?n0h3c&SS5Xg@P>lRrEtD15)7B4%8XlWk!;LRTZ+GY=;6_O8N+?tOdvdP zdyDVcsx=zO=W2F{guhGqSH1ahB4HL0_3KL9cSjmfzXnz^=k>`nu#_KRA#)&ipSO>b zyE8r~ck``s_n#?u-IT2udPC+C1b;Pi*24LU94ecnv*0OMfg!o&uF(f=X83FVr{R@VZ1K(Jyp48;5M+b?ndqvPTgKu<}j|)jCmRw zZH5+cZrR@W{GM6dUX41CRFO4CNu6lhU5=KAfL)!Z#W+PCTpP$t6!x$=8LOK6iSDYp z`xAT%9EHO$^bEydIU>Xpg~3?G0ZjEQj8@qEtBRfNHb=*{i>>`z3#T+_boSK_DT3L< zO=ISmx41Doru1rdiq&oi zx*B6HgHTYc@Kp2|zoUq4tKF#wFqUd+t;c7?n_9{IeWgQ{*ca=>+?EYuwr2#&9Z!yaA*=Ly)=7XAh~sN=*EvbBW>J0dyjLdes4@} zu~#nNaD=t&mR-)31GhC##MPwHtU-+GE}qSqS+tTL;;v}I+`J8C=#gbO>^fR-s?<#G zL13>NsEL&W4Gj+6wWc&1{5H?fiX4&3`F(Ttjq#gYCy+%3H$J5C{@F8ej_Ed6(;5m; zC(g}|VLSUG<85tWn%Q5QXd53&d6~FubJ)&rg4a}3R-{KT(<+Pwm!Bicz2AA*b=>Si zs!OZhL?;rA)Nd+i>8NBkvchJ3go=~Y2W~6SjRcLmWoqUiKmNtZsB3ZpL-uW%eP?6;9cQNSzq&cRp?yXdPywPAg< z21KcP&A!7H$!eK9`~A@5^)*@8{#=u}sd9Zypdl0vWwxe=Ls_lbo0vt&J9(irMI@IE zSM9X6DN>MVrIH=`N=GXXyN^3R zGrOQOw$g;mOdj1*FGoW?ki}qL*w9p4UtP1=u`(1W3uR)ACvi0Or%?To3Xi%g3Ti7i zH5o662wHYaMjAR=Nvhk*KZ?h2bTf4@HkJHnlT@7TS=v^$(jE3w|A;X_?m$CFbgl9C zw$W`vcQ?c$rL8;H71Z|Bh9W!BfMc=&??43{tvOZS>=6+^`rK3XM{8P&3;vxLsIu7} zwB2?L4AxaHZ39i#Ro?H~vOQYb_#&IRqz9W4X?8spt9}N#7AK>hfyGBcNi0qdrplMR9yk+=vkiP5vfQnE-W$i{brTQ9bh0_m zM3Kekn=C%>y!S&HYicHK3azj4H-NDxk+G={;|Sx7jLqaXpHnvxm+HQIhAs%>{o3^6 zg8Y!~Dv%w{qps5(j?v{n{=<&_&J`YD@uO36?WrT{b9*F{qgjyy)fs5sjab*&A zNR#rn<3eNGqrSBi4_6szC|@aSx$Xc1nh*L!IOJ;&rT2#90@K5@2M5HHKQb4a(qiV4 z6IYQ|^;dS5;;!Zp+ERL?Qlg8NgAjY3HDeZV{lJX*@cCy5ZH_+GN)cNTI|3}RqOG2# z6a0TB>o|}7PsqBlwTOR@&NTu`N#xP^j5l&18Ut_adw53g02W=S@7|S_w)3=(dwC~_ z3=-p7>?YJ)YGToi`tO;&KS;#snmR7re~7sM_uHBz;D4^IB@Qo;UrWf9XEzuR^@c)& zq2S(7u0G*lP5Qwa@2e+Xm8)E)5-Q*}mS98zhI;i#MbC>(wQak1_Q$FZ491r3?cw+y z{e?LUk_%}o>|p+IK?;tS#`j;f+Jh!8#ZBVp)BgJ8S0Tk z-_`CUuO~Ru?ynqblU{pc3&>YHhhk`!SWW4#Z=NEGj;yw?uy3~4){kT>QMAzM$`rjJ zpIZ2-WQz}nyhW9TH5f)1;hIU2Sh&U?X$se5w3=gc3S5jS42~%#o1(+9wC1>D)q&4A zs6b9o*|-?{!`#l{| z8?LHPEZHX4)7h&Cdo0J-5i97(S*qy3=_=yQ>gLq?a}|_6u7aYdngSuH{;9!Or4qV> zm8=>YB)9PdM-rfa&we=xawmCp$*QSG)zE8itSG5!-qreR%5y}~0kdj~>uYP8GgakO z*OwcpoOD$=%UC&)6Vdwi8e@IUBvuRRCWCe3W8Gx57I5-}x|zhfF%orCiK&jPnVM!B zC%5(GxQ4oBX=Tv?r2Y9i>8n?DQl#pnW*%!~UexA#W~@f2pG7J1$JW$Md!Dod&MSmm zO}u55c~!-+ttAZm;`)R|&b|2wl8se;6W7~Pu+gjqiwYB}wN5Tr$i)h$?DLE#pgwPG z35Ls3MlQsXcuGuupJ0cn05NXBEMlRvJR99pdw|1n%zMiQ8g%>i&Z~6iLg!|eu`g-L zvCw0@C1)~rsIAzCM?%$w(SV$S&5EXX+K>qLbTq!`g&IUpTamIW$A;t}HnFfn;hE`L zkphx#wufygIGG4_N?8i@82F9`^tyc^kO_$b=Ok~qN!G{NLI*peGE8L9WJdlNADf4; zujC)+CS1FB;6X3?8NMz6ve`h}`)%z5V(SB5ln`Ra7`1KB{IbNSNd6YGPyC_To2JLm zk7mj~6~hDesWZ1{rpM41WTqX6$6v{mYn+{nF%(6DdfKi`CsOU+9fU%yDjUO+rg(hI zy?Sd)v0u*=ffCW$)86wA2D>aJ7G~hxl6}aS2}IDVni;>@E8h4+P)|D%kAL*tr?+SJ z?#ukAS27>@=nI`A$HouBsB>|dYnQc9O^|qfc0JIDEjg(U<040GNS_2=ltU#5nDnU4 zc+Jiw&Duf?dhz`l$L3U!_{zx_K({~Q!FNn>_!N}@)pmIr^!*!~srA1NDVy%lVPNSK z(?u*(MWMV)p$e=l#mL0%>{P|b3X^M|v$0SBzNG$7PrX0Y$burL)y8l2IKy)01eWM5 zM8dt@e+8Gdm!%{`mI$8aYY8R#Y2}Q55X&q&xqT=j7f0MPw}!n{DH+vJJ$07W7OV_; zK@+JtzzW@F-DIIiX=6ATUXn6WDrP%ZyBe_R#2+(1#i5x06R}DQJ5!>ilxt_d9x7^ z2l~TE4Jr3c;qcu9XpH5@|K7%pauXa6D(mkAcpf^PmUd5J&$s%|NdxOw2 z+c+1*cTD71NU`fx*jRu7QgJw@LPn#58`g|L(+9fMr+&xk?H`9p-WvzhfaPaEf&4t=y)BGs}jOFuN?6x%y} zI4!O>Ad`e_D+g~vv+umOP)}R_bK=K=Tf~5PG(N=owypeN{Ln+A&G5lKKiYqhutThy zT5+tXFL@vOavO>zd3m#EWYm;r(ml8HW9{59cl(RM4m&ylK0;2@PeAbR8|@9YpWg2T+)KpyH2i&abN*H zKx_`hu>687CHa;BM|_1Wd5^{zk_tdy@tOO$3;U_mnxu($UMdqI7YqXhn=8bohAf9& z9~T%G*^1MTg&^w9)k$MM7gra0Aj^s3u>DlQ(a_lX-k7EN7y;T)QI=a>)&V-)D8irX*(=+E{QRQ^a$Yt#ohNa!u4h zlY~8Zm{v*3mc?d8da6?-?Iq1wSl0Cz$xqKW6VkJNyTGtp`Wv2E?YbWMLlOk>JMfPyE)N|HJ z?3)rZIXz!-nxwNmSNgTt4p6o#_uW;MPzYluj>JLEu_HZ^l&eFBXHae}as%0*tb$ zt?vME2kow;2)*By+yw4-UWo?aHg`@qRFlm^K8fH{-isVib78rUwW1Q8ua$ksEEo2W zedKCL#(9J@xq<$067!6fo850lrk;X<*?8t@?K#ZvRO*Lx$GWDLr(Jc9y!z&s;`scZ z9K)`dXc)F*r5wS^ZwRjN7^@o=DL588w)0qzu^BwIW5VVMa6j%j zw$u2d9V=5k4Y9-Sz5{AbeLmUdO{#J>wKW`R2t`hC>g<*Jufz7^K;kndi&esbcwYUc zwslR-JK~~I$^`D2{+kTekk;3DA;2BIp&5Ha)7ONi9Slt!4CU#LvYM>2n#{7AKn2xU z+|I-?O75}Pt22h+FTwecr#lMFdh4* z6LM5B8{1VK!|uMeqF6b!5#UgUTeXq<>BHJ5cM+^|sti#s)uW^oI z;3!oh(1J`}S!0ydOj?6hetGq&kq?3TT;n^D`nv32dS z>(@z8`(eJHKZ6HPtpK6a$@K!0ra&KG-LZG-l{2HN{dtO}Q6aj5`{ zOQFaC=x>im{@pRQzxY(WEZvyC`~NxrLcR9?^Y4Ef|58Z(x9}PB#au^@p>6xkDPLmr zeg+;yJG)1=Gqf?;*5qkvFH+H11k-4jp$+13dZqm3I1&4G*dB2(gfq;Ua^FkUI!D;% z*FVPSxN6AWyEm}6Ckh_yPnS|?V@3vKDii@a#~ElGYp`X>&50|tiE!Crt|QiYjEAVf zll>s38WBu2unjd}#?jOE_B<*1nym|)TmUyNmJ?Hd$z_cn5*vSrzuT_DFK&rLE>*`q zSwN)1qkqv~?HKAoXDIE{mu60n7~#=B-MPDCXkv4=lrXA9YlcE{XO?l7)>3>$zsBuX zoLM42%s-`NL>=9H~_Y1F7DwN{vyJi6LIjOc>=XC z7^CC&G=?TFl6@71>`vRC|5(4FWBx0cE3JL(z}mnsOiowRT?`nOAbV_@2Kl8n#;?1} zPbBz(H46MT+w$Co&9>Gzp?6=vEVJ5<++a2rdmZNfcVDC7{-vcoVg&&$#Tk_ z*qSQm0g~x3v@xgJ&E_l{o2}{YmWl=@t`RZHiX>ywZ&cFnT}=0lR=NB6=ownIA`3_X z!jU+7nw}X0Ua9+VV`SQ>?|=}mJfc0C2EwlmJd0}x<@P!w^-~hf++$;wfJDQhctu%p zAqA4DG6Ct5mEaaUiSij}aiuDvseX{O06Rowak{$uAze1E&AQrn%%PtTTRUXUYg(Ug zCzp52rw7i(CQ^iO8EgXFobJ*^U*VGZ`6W;6=`UOx2&vjO2`ky0e701o%>7_bx2Q`! z3!AeoptP(vvj)iENrXQ``D7WJL_-KWt=%}7QQ1&hgZl*rHnbKDyT^7`zu^+bCvK#h zk12~{#9>>Wb~N3La@cMBPpvwg8`Grj!o}lkmBz3$l1|;lu>H96RHy;phBs26KJcTC z`n`JxHojP3bU8sKG@)ucnh@Je#o9orS$CVE;XrBn3yfvZgpH&@Wj*ZRSax7zYeBOY za$v+IqJ_N!4gCdGnOd}LNwHqixu>&idSEy_(13B6%^1}-r=7L07?x`HG|8*uH6#56 zc?Hl70n=8gTJvLeTu}b!D8fpjBW$iGwH0}S>03JR^3#MEl!|WYiTGR zuX7sEqe2aYx~VkcG*-#Rii}RnupOK-VAEzjIyX0Z5v<(sY+?Ww365jMB=UU@Bt1((Pm&TO ztgZz8$dTz5BGwqUr50CK)PsCiCdg+jgr%wNZj*MTV-;CwuaOb2+M=&CE9oX^J7AZG>CKEy;(2j-UD zp?Ru$mKZZX#02~J zhStB~4HDXGJfjUA1T>=hau2pJ&q{+RF{Sxn?~{;LE_t|3%2_nmO(K%p zYUi8`WRd)0_7zdM&l^fb!Ie*Ou9~=wD?bYl8oa{`qD(Wke>CAR_I8Mr1bxQb0L%?J z@lAU-_FQ0T9~;{ul2}sLvORM~U5YVeGhR+QFLT`UCbj^?E;D|RQdr|Jt1%+eT==38 z2)qubp+A$wh)gq;0$F5p(Or_J>sCoT&%cF)c)#n@0^_|g->-o;tEr@yCv=e}&M zVJ8G_YZKY*p4JoL7rxe7AATV_T;mPDkO>_Eh}7CfSz7aEP5Qbc#j%D;^m{kG+KYy6{$fKwD0hFX2|J*bmZ7~Vld>DS{Ha742@nfw74E;Cr|9)iYJ_UgL=*m z*I>wJS_jV!htiR0O*#)b8$zJ%}yS_|!KXTS@pj4|XtZ4A^ksw(7Qz4&6HX z4TMQxR#kO!Tmox99GCfRAB@Yq`OjwZP*}TVrPg^|FUIql8rNLQbDVoX3dl9y-;A?xNa-|B#!H< zq@3a$+EuHqeLklr9-rlYAF~y7KeqjDXh4--Y)s=A(Imm{Wol=vb7!X;=Z+zwDa9R_naJ~BIMQ_rUzu=V zq67^<6!eo9<3PA~wiWjb#^!K20pnGY3r%We@xe*jXzbM^cii9j!_wUc+H*()ur$&I zQMQAPU*~q#l74SxJbq=@RPG3B^%|#~x?@du{Q5_2&9Ul?Mw$C$=BM_&(4DAEChT4P5k zqfHQKuCIup`s*`o<(H#s|x0H$rd0}q*0S?$6w z`As>`!kR2{)18n3vrz)Y9H8Ae))=aDic42~buQA(M{ct3^aG(Lq zHrw7(JmvkLO%2D2T2DanjAYY>dPeJ|{%IH(FFg{*T`t==;OOfaqAI#-jV%(xH3)7V zEzjdM2zhNBU~OP&>_hdddYB5EW?#(6dJgpp5KB;Ptr+mux<0`ew0y5QDS`}QSgGnh zp4e%BS`u*{9gCamM-23tsWq7L9>;HZms>P4NJ6;C4P+>X7r`h7K3zt^sj!^q-B(nQ@%*ZsvX zYIByoICr&sHjbJBOLTv&s~wof6dzw;cYVxz%}l40d9UC3=aCQ08a-X^vq7jA<5!q? zA--f1=!vdWdLkUt0I88N?rYNNk2*h$Q$&*f&1y$R@?k%+3V8u}kq1)kylfJWyf@4; zuQ>}oHi0p{aNfow-M*yz+3ITVqSlC`;K_m z15a1j%HzU#%nqLF@LyE^7lEyGpNjS#ts`S%dyh^2+B-6ABOi*Yrv#L^#_!}g8^7#w z{I-!lu?Onv;2djF$5XbE8KQ^U!tQ8lcPi8wqH(*ow)D;J_#3Z~Pa21V;T{dl(_ARR zy>ruJ8SMPXWnH%N*C4yHjQb*)i1&Fzxl5ugsZi&J$>aFTeZ@x*C0pBmqxm%LE>%yu) zR(RiMZ$!LL580ZpCw)Xp$=0oHruy#H0B9{a7^ureZwwiTi#a;bUg0^G{%VMY{t|NE zVIS62Z(UV5ZOsc`>m@?zH*~lqFO-1=|;AA=eJSt$B-R-}hNx zIy`z`$X*(Hdbh2)g-0$#>gg%bZ-U6Gu@ztZaNQ-MSIkbCo@pCt5XL`in{`t#Gq3&^ zjGyw9HPoWC>UphK)c$JZc9H}dIeVgh-p?Ajb&NVF-r8cDYb}QkRr#5A&QL`nO7A($kRg04Ht>Ny*>xXRRSBe)4Of)E17kZ4pcUGih86C5<(s&%TjLQ}y zzrrjtd3v%H zKgRVycO)HbG;%(;=W8qzYOZdAypZ8h)RvytcsGkCYYXgwR89_Y(_k`h^s{Z@Lo;By z$wVys3Lu8-j4sh~FA+24-XeTNM$-R=jcb-@xl6>%jXT^!1#ohR8(QX!?m^DD?1vrq zY^8BY2V51_utqQX9*1Q?h50EU3Aaf+fSLM2PfNzB z*>>FK1u<%#2R=Ra zivCz_KsG?X7V1y$*UX#$$fH2LKi%+X`C4%ZxhW~wEVp&_N;!fMWBLj6{B{sYD!sv& z&fp9@0NJq8JmWa-Zb&bA)4U7{Gn_%(>UfCMQu_n~=dzBX`EWt|mUk?+Jop>fR1`U4 zHCs9mV;RR9D>!y{)SrFfr#zfng!pdXgYUaoMK)OW1Yu&Q4gkC!NZb4To#DfI{L{n{%f z$U@FkXM0xFRM}FB3nCAqUX4|@70$i_+!j!L#i?ya?+!md6{p!W6kP>1-gmEXmY*XS zrZd!1eEDFOR+uGaqJ1}eEcCZ4?L+A$>fj?))g94q-EnW@d8PTKSaL?^vD(phx6vhr zwwcMUs%hBPaJRAeBEoIYZ=%R#)U3*w~Gs%s1E> zG~jxl+L1ru7CuCh+KK*qmexSkpZ{QAK{SLr&){zEpWBhv5!LV5GV&X4%UtakITD{Y zH52)^WGqLRmIr2a-&M*HY&dsxS@|#JrOFu>)BgcqcT;ILo2rgg2zX!IJeDlmGp~Js zLeupE=AZaMGP$GPk-Y>|dRLYIYy6Hajp0%ZLh^#HAA?!R2SGfncN+39>z8s22E0VX z)m}1_l8O6r6yGKJ^CHoXXdwK{Q;l7v-4P9A?30^P+vJ#)XYVA7jtvCNw86vZFx3=D z_KIfCGVh(38&6=J*p8dSl5qh{{OYj^hIO?HZWV5YqUTe{x9}3drEISeP<(?B?cE$W z!KdAgl{}+Zw9aUq9A2Vbx?R5)Wk6||OlBe(d0)~J>rMdRT!Z{vqTPi(ax1&zYxCWg z^?BFcj^>LG+Vy#>uEO#KZY&b|d2?X%u;WD1n>~m#M|v0?Bq@mpzCkjVVVUBt!S97eK5l(!i)cJjDR5BHFKJ$fG0oRaJQzISg9^$*t} zgzWty_EukehP~JBXp|rB?X^3_6PV2eJ9DGwwXc~J&1hfakJ{VUWXSm5hBXZ<8_M)R zxJ(b1Wi@kOK6MvzK)|X3Qsa$@+uFQI+}8hPWRK8hRoiqq#fLBh$KjHqzV*EBIc)m( zwbx*Y@O%MPSl^(rg>Q5-C=v7;y^Yo!OUyi-nDfiI|9BMS*_)JBoVU@}238;P4aP)F zowt*iRPDlm);wjpU7nfT-uacGs1#E0?_Y0R1^?0LP^3l>k4;*nqczNL``!lD zr@qvhe;M7Uj8wU*NmJV5{*aFq!XgA4OALWIU>DPIOUWDB4CGsOZ2xR zF77Oqn*dx~b9vgvd=lqa`r6U{)!vGVUdjUVN>H5Y;W^0$Y>|UMyAk?HHSn1#3n*Ff z*gGDN!G8yj!6ZEP{>^xd<71rukej-2=Ll{}1@bO(nR)(m9Ixr_W*(!3QSl{wh9C61 z!}f)|jSY8GdW>3ryfKgIDeHGE&f5N@UQw_c_&5_G`eRz?=cF z6W#B5vD8>@uPCUljM&!(cK1HV`+bHqUUXq1cI79Lj7^w1c0?aB^<@%a8!ojaLme?m za3&gHFT|R?IT)BN_&JzG4$pxrZY>>kMSPW50*R*L_R>?%NF~ls4MHf8Z;&VUEJy1* ziUMdTlF3Xoc41bFbF*%<9S&huj_~m63)RSW(N_vat(vSwd`MT%gM?6FZ)XbtU*W9t zbAO>m6S|V_&$jP2=cm!7kZpQa$NcQ}l&p>iCauj#YflMORg3nNObGkPswG&Lf&{Es zC2Je$L~PRo6RS39Q7l=uWMZ2Qv}O^Xp4kz|)cfQ(5Zz2?S9?2d?(}TWbm>beXg0Om zJYA8rJjf`?<5_Eqa*Vei6f(1i2Fo%dW%?{V^{~z*>nS@@u{$U`is4h(7NBSe}_L4 zEQ>KWbk&n<@DcE+BQgX1^7IT)vL(YY%LBdV@+_9a6Ly1n1N{Z88p<81`Nz$9A#}}p zUqOO<*Vh(QhtlrBFiv-EAF7Q^UWtR!1s%~_^V3<++>Xb(#xQWNqZ)fw6noZrB#*5M z$q^nVP(S4A5vHf+L^OgkWF@`(D8(^ z#dr_EWa*fWEzo+he;s;r5O z`#s`{0=&|0+m|)v;CAuSL9bD#Be-jhVAx*o0r)~YJd3zI`LcKGHm_0P+S>i$J}lkN z6T2SGW;%Pl!J$%p^GnZq^(i8|L=5+k205CZHfPU=3qAu)jK4UmD#W9>1Y+I3XIAT} z&E|Pz+%}qu1a>{La#z<^S+;H7dBAv2-1TqqT~o^TJ$fy%c#P$L=9!bvt_H3mtz^%h zHhl^c{kfw@i0*&ECYo|T3puhgKC&mSXU-WY#pad9e0*?;@dv%ZzEb_pJx_S`9DYON z`#nf!-@~?YoRIP$C*8Aeim&|V{0_&iEC;sUpv`l842$->%=>ly(^oE@mXme_BdNpP zhbDAS5IH|{jmBrCjf})|F2(-t1!?8a$CszMo|CEMIP^58lHL7mdihVtk^e<=R^B)7 zw>ZuJ-`;cAe~9NB(Nb`J0P=YWmcMoiZUFioN3Koie)H2>vhqo*F5b{be$UFHHOo(a ze=dpNb8OAC#FI~XTe6dHpmOfYn$l&u|}`2P3Bdml)R-MQNSiMzV) zcPX3WC<^cI`viz0by!f8X^a;tAU7kJP^X}_{f^Q@&b^+P!>5wHY z53{8K{g&*>@>hP;;_k#pEjSZQ*>ksdAFj%|m9nRCo44_M6vZuF^IJOS0e}@p?_1Dl zZeltmXk4G-(h~6UlRx%0KIbiY-D@m#ZGCuy=;XM)u{b!g20ECXyzgnruFge0;JF99 zVB77TMKRpA^+PXQwzoU^n?1RAyFj}#UeoqHoW+o48|&i7KDvMDHD=phdh$b8P%KPo zULlOD#V#y1?Bi7c#wuUOv$l~XqIn6<=3hvXJiHir;<6IJul?ra@PZ>~9urF5c%w}} z_q{)Qji1d2BHvK%edzxBq?nPpCi_(ji= zc$``4DoZpKIV;KO{&_l3c%CmS5wg%KvoO5_*NCK0t=V z55DVX-Vf6z_3!A$dr)BzM=L~chNR!9DchyGA!`cHabk;HZ8~nYaV?UKSvG&HLYbp|m$|Mgh8h^ZOj+8{QxE4%Vj0BW6LsPs(7f6OM^X`*e5C z@*2$fe#55gfs?zldyrOYNq2Xf zo{b(Iw;myMR|Jb@7!4szM}~I4o9kO;92z#h6+|Hh77Y;a(`YuaEeu4mpg+ar+C2!le4kjH`I}f*O8Suhav$(k|j#TQqHaxHZOW zwxn?D^`))8F~tc|LpjY6tf>W-3uE~1T7qnx6GVLYbW~hAumhAPVNduc-1)v;<&k** zSJU_Ufn82;PDxHszQy7VH?PN+tZUZ>uf3_}o7V?#`^NeWwg2$VVBwq#3N9!J=B>Ns zmYX-szwpBAYj0V1>zWJj+3pL!k%)33zehbA-@?A(8`s`)0YU`fHQS8&KMLm*erZlo zVR3$PaU?wa#nVm>G42==1f^a4R{7)8te|Ph>2WdaiRV zprw3;BIYvvCxD@BqR_OcU%UK5>}e;vC^~HcWETr8_7aPIk;T5$VqY$v^6dqkXIgN7NwV-w$zaN@@-T)ypA^eo zD8tXO(8C&kYa%K6wu@~Rd(>io#A5FjKUVbm34CngpDq56S?pH-K8yeNE%qnHYg0|9 zkMXjJr!D?ZiGNZe;a{cyA1waX@Iw~=AB&&mnoiqg{Jj?cJr=vw|9Ol5sKx$si~S{w z{bh^&kj4JGxY2JqIq=fNmo4@Ah9&&l7W=yvyOlo2E&lIY?4MffvRfK+vkRwInr&KV zO8!g3?`dNfsTRA{pHk_xfjrf66+itQoNZ#V#eb5;ZuQT!_)oFeLl*lqi#^|BpKY-h zXltjN_)^l@aD&gB38sC6w9mJM|B}T%*J3ZS*sbvwXpi!v+c0MOWtQ+I7Q5Adk@l>T zAN2@n6U!{&ms;#r|K%3{%QTNF|AW8@^4#Koxy5evUuE&X+G4-PV!zH}UuUu3WU=3D zvEO2`->&_W8V__y{4cT@s!J@A_C`ziZ&~bC|GTsT#G^S6k4?O23EyI|->ZE^^;c$l z{yR&1{zvU==gZ{8?`3)qTH-%ov0ME+EdHI^{YrkWL54Q*PZs}2wXYEom<4z+o3g!_ zBCVoD+KVjsS>yLu()*spzFoV_Wu`~6+r$ow|G!x5R{sHu{|_~XD$gY{y>pX|pIYp3i`{PF2e-wZW;^IJ>-#=Qk91q!Ow(R2?HRVoivP{}^V>?5|2L)o zBujedSnTN*dxpjCx7e-e85aL6i~S20d(dLfwb-Xx?AGyTp2h!si+z^Geu2eq9lsS? z{4cWD=UVL6_B-F=zrbR*jxVh8sl*b#)M78Q*e|iz7g_9!ZLj2+{NcsRhb51J$;tLq z@v33kdl1uy`PdJYe7r}7_lccKelrx)c$YsgGw|ReoT501gX#64@~7PPi7au^nAXFL z|5c0qMvMIt6`$ixpZJ2faSi}w=yg=VS$O04j<`#;2RhUL_va82;>&n^V!GI<>~y35 zC6@9mRuucH41d1JSM*4Pe@DsJgnhm8r@Zxv3xxMP`rvcDczj~6c!(1Nm@+)r(kZ5? z@|pCUFFsQFlgvI~d54psO+);uE%xtP>^oF`4c^BY(teP$#&TxEaUV*kiO&!eimlVo~ViPseWB+^Sr7-$iZ|JMc7 zvSWtjy+_$|0sBD3kJNaVf#^S1jjz^9|FvSyZ2Fjn{`JZp2J90zh}X!NFco-w;+vvV z+3Cjcag|=et||GLu-7Vn-VO(!xJ_Jc@$XP})Bkp{>;lFV;x#-z@h$N+Wv3hS>r(b= z=^qwz(&%Fv`qwGD*G7BN{F}0O0QQORiesw0J<{GQ`jj138U8gzuQ#Rt6XJga=_ACwczl>u zpA6C_#D{o%;s@fZieLUo+6P4-2mq!Lk5BwU^alaJyp6{vo)JD3p8cIq{6x%6Qc)4# zca(esDDlZt{$~0=6;&K)K66t?Ze2{9!H^YA<9#r^IO!&kp@yfXTKNk0nvwtE=6h0)Y z4_`Unpwdr~_P+|R!pF47#SVp!8D7(7j|*?tUQ+m&;T_t@IDU3(8#oFIVB)0sF+c+N%ox zg#Q;*do%g{Jni?E_H#ZFgNfkri5c3Xihgus`oB~5!?M0+YMzPoF%A7Im3^D^zfgNX z@gGOhKJi8EG7EnuRHml?m$hL_dKZkNPr3G63w?K5==-LsPhv!T#5j5M7400=A2=mG zE491lFpy~&KBVfOWb%otw4W*eWzzn2Et3_c48vci>{|gt{%coS`seQ|`(Ek4R%=r9 zXA+FRSJ}^(_}rkqtLUHbpP5I97aKACZ)&}G(@>w{6YDjH!jEoDZ>QpiUciw5+CS0* z#^kR}TCHgn9A^6jJ`AAnzXkI=pSV-|OS&0=FMM}NTklg5@M8LZQ2j4mY0tIz?^g6p z_-Co~682;b3*&FG#CKW3r>OEK;$Jm~kZBnI-$EvAm-yeKy{-74!$hBG)$X&I{sC#f zU%OlJ!`G#~P4lSn&{w4WVeL~jzPv!%AJ^Vc@voKke(eyVtL)S)`NVE*ORgE&ly@=hJ19rOFui(<{cGo$zBl3J6EA2>6M^w&_-QIV z&UAfZzc!bG3dXGeUunNq>9N>8@v8O*3;oOH$l$^(?_tfRqSY$; zGnh}jr8N}*fFT?E#M|1WasEfO>lA%W|37GdH_rb!_sB|P`oE{eXPWjPUOw@@_Dj{i zYoz^S?QS(5x>wpi)V5jLf0i0genS6~fE$W;f|qw4n$k%%TSsd^g@?ZMsMBE>!SicwemG zKD-wx`1^RTQ1Fv@->G2c-=biW=6(eS@qS3b3-IQ6hk2FY{kVde_P;22Dc*Y(%yJx5 z@Q?BSje_^!{W}FekN0r}kK%n&!9T}4uHeh@rhH+(s{p4f_-epe3cdz#P{G#$o~7XX z08@L*xLW~Vtl({c7b!Rj_%a1g1zfG*Jiu!dJPYuR3Z4VFO~Ho%cPN-;>Q?Yk!2Jro z889_q#NkfBKT>cb;GZa12TUy$!*~JjS1{|}0p6ke>wqUH_zl3>3cdw!NWq%`QyanX zF9D{ef$+G`OtCQTX zQ84kmF3Fwslt|~MB>3he_?9GiQxbe<65N;s-<`qdn055yB=&pFc3u@et0zdzONOcweMo2j24)%qS%a*6}V^uov%D3ijj8 zu?N!(;7y|)G2fi(`Bndu?9M#2x01rBKJ*I=519VUPkRGDFw8Fzek$SL(-oIY;nCif zpu}H$$AlT)pJu`wcMxWpEHh!2YlecEk1RXfS(b&$on^U1!Hid-;2_=`70moME0}pc zpkU(IsbJDr_BBX<4&Z*}&OB+fW9FMA@Dmwj67IxXV}-*IZ|x5fl!v7J6HJ(0HerU9 z{U%_BrO}R?Z<)>?O_){UpJ>7*3Z_4e_MZ8c;Zc7sD`d7}A2U18<*#Nh{_@clygV1(@_<-gL*m zIA6gG%QDcNW&g5*gLqdenDJ;dW&*?f5^bFMX@91xnO~wFnVffHi4S1>n`2r4QvsJI#a*Ic z#$BOc#{GK*2l1BtjJU-2Cgo0iHz}B9rAf3kNgpMXiJ$hV^fu+HYIn>dQC|}P``P$l z^6?O68WK;yEbmpyo$0MpFmaZ3hcHYpIbX&}&{pC=#)M%U?WhFJI#Tr*r2GFe-KA_% zdY4={`2jO+Nl(B`dy#Ty+7dUolMdG__aNS#3TB?NtsxBYlw)$htd~5^On;1qif*zj zN(M5%Uj>kI2{8R>U@|Ae9VZq3HdC`Pry{I~pI8(t2BXK@rh9LCt69RX$;@5aOM#6`+Uz{F)DvZp(7xlqBxg*!Ot z&UDr$xx6PMP zc&0~_kXMqnZ<%f~UyqrW%va?l^Hn@Ad0?s;9_%RmfSJYx3T7HND41#7qF|;$GcMme z(@p04feAC5pPeTR(3LRLpRZtsrO_ssc+xLH!%2YsGw7@E0Ze}yP30xSA2HozzN+l9 zysSVNS>AI@Sn`#kgXF7ZI*`~fbMW{9Gwp>6X4+RNm}yIzAPm!%Z2>UTzDI>&+7Bt1 zVI*z}Pl=ntQ{u)+Im6;fv>l0?qM?-e>^xy4O#l-&IpzV(v?V*t_=by!pN^S#Y*a|#!XIL7IiYge{W@k%K z{%Bt`VJBXGHV9=B`O3VK<=D^60J2WiHawO=`-SN)X-Fk0jHIFJ2W7jPV}@b&e!#?& z*%M|ycUT948!aRGtK1+CJyTrOdRf1@EOaS zobSa52qVj@+85&_#z>O3MKXvez{?Mq`QD&l<|}ys?o6XyxibxhON^x@Z56M|ymHO* z%DfcKCEqIkl;aHw7?^2z{D7HWv4Y3S3wNd`c@Hqt+o8fRJ({!9Jh|*=liP|W0i@$! zAd@rk0Ze=rD|h1a4+_RhUiQK846{|a6Hh5m;7&YWQ0~Mt2al#?a**&;lRgGu|3du0 zoQH=n(~aVi@AHOun~n=#9fpeM_akfoC5ir*%|-Cu$qm_>L96NlvrX4=;%m^id3nEC8hF!Oms!OZ7v z1v4L+S91N%FzZ+LvzH(MOcowLV5T2bFw>WH4R_*mp>iiar3z-gD-_JQQdT28<6f=Y z8Gem|na(W=X53~46X&RciSMw2gLu=NwSJeF{>(d3ziEK|BqU4_4`Jr}cS*3s6Yj*V zLAf&xnnaz-G*y2m>y#507~-86lgm0)^z_h=9T!X<9>UC5_6vZS*Ieb!w69Vy)Bd)C znclq$WLO{O_r1HEIX$qgz1*2;2_>b3TAo~0SrSN7AcrGT&7^AeT{;N3(Z;S za5kR2)QlIz%MX}%N}g1(1~xsxUl1rwL=CBcIVCSDvGGEL$o z*UeIy1k-oLZJ$l~g<^PHa^LL#4Wl8R5>uZjfVI)lyKLnZ18R}iub)^};7%x9ymVJSOS$5g>;m)#u zQ@OLea^44b=Ceb&v%Ei4Fw6UE1qbndSHUcA8sU}rftielF!P{5T*o=R$;=62&*GWO9`LA4~*nnc9<}d zCV-jm96Wx&%ty*nz)S;Oh;(NfQm(?C^pQLOnDn_-g&|GuRxoL@MZu)WRs{#~en`Pn z@qR?Xd3g6KcoyD$3MO8%T_CTE0RL9GlLj9vm^4Tw%@L*qu&fKf#F=IsJ+C(1r27#Q zX8E;iOgM$GI=aPjCTPfVYRS5w56tj$@$#=WX;P|S(t%Y=cbXgU5N1AM1v8&P1v8&v z1v4L-#C{ct+gHpwmHhC(iF+S7tEzH+{G6F#_&4MLM?%Fs1EY@0p8*lk&<;vCddbib zsmPhb%)m^}FvBn?kkv3E%qSKje{4s?b9C(E z%yKcjT|D!x5X^jzN9Lu;IFDE11LDT1_LBK)3U+W0rY^wUUGo3_zUyv-w~pDq%d0_I=oF`j#XZK=l_=x0dfBSRe+uUuSX_G3Wxfcyy|E2s-Ic^1RVxB9S3m%!f}FGrn`0^ zJ_YRNLtygVf`j_xbJs^;`gxU{;tHAA^d@0 z`uQh<>1VzwpbhlL7{T<%a>4Wm>!5z4eL6;HpY~PSr+t<7#c#w1g!aW79gHQ3<$6T> z)St9Z{Ym@O=Vt*Y7U2WJcw+jNz9Xhxn7$pRT}uViu1yB-HuxFAv^T~&f`|6<5ezZy za{JJLY1d4NXZiOEW}S8kP6FrSNO1Co48%c9J5Lf!JKcChJnf{!KL!HGJRFGz2mjyw zyd>aBBKW8M%!Ma}^-KVVeg+Qx3{3l-pMgU^3wC}M?EDNI`WZO%GjQl<;Ly*&EZ_MV zIP^1c67iI{{5iApTXPWS;<>nh^uv*8aWL?w%#*ZRed7A9%){l3zaeM~j)8b(fM*a_ z1-L(Oq7@$ycijZ0f1Iy?$vqthb?7U%{sCq=H71@WQit4af|+-n-~>W9uR@2u`m)5+ z51R!i5#BGD<^N1@DMGjAL0F|Q^1tC_4!RfoQr=sz)1vpjiY_>l|el1(|Ln+P(Qo2kojRU%?#G%gSz?ivluda*plvtH*4rv0vth$o-xW5DEd z;}Mu;QnV~`X<1B5e2S^^Y#Es86rInVzFY@cwze0`*14MT2|5qr><4B(H&+8Q{Zbs% zVLr#RFz|!pkul}`BW-;K^|8=kx~nfR(^C?UAb2*5c$QTs@#LmN+3(7#3(9q6Nx7~q zq+Hh)vUVa@;xmpes24EHx>Dkq&hAbfa&Hz)?uP}FdzWBxQ*zq&$rHD26nWlqbip;{ zvjHwckN~Eg9fE1+M!~f6*Me#18-i)){}D_(`@4a_}~ZxEPp{Rj%!aVuLI9J;rbLK1=LzZ7S_+{gx!ZwDnNn z#43D1K7fOmw%s9^b^W?vmicYLwDYHe>BCn9v&=sUW|@BzoJ7bxS}ya%n*#fto${`e zdV0_3u3zneJ%bUS0H!_8W?;%GI2fNqc!prw>Bb%6S&r+sz$|C3=+G8YFfZ+N{(Kn# z;_NvZ;3NW_pG%3K3*yU&M+NqeC4OIk%Za5flZk(U4@e3}d@WIM&5Jh&`V~0WzBG&Y zEo#VqzgvU4)1Cw{>&|kCY41$I2!eN@h-bYXlz7(NwHM-P%O513e18#4ow+cDoKt~o z1k)$?2u=dKbqI9mgMoR0K5aR}VD6765B=fx5#SW@$^g$G{#1Zzcl?$B z)9(1E13a7fm-v9p!J*@59`R=ao%zHC0j?r`4Ihvi9J+UlWhFWoEAPdCS@#=pFn$2S zR>4IGxlCa^`_+Ad*IEl( zeAl#C`%!>hSOCiBrJ*8zy4b)&1QEa0T$^B%Xe~PjD&lLxRhI|64Hq{jOm8 z`(*Yv@X+6v38udr1=HqDf~$ZZ6U@B7H28JFHHfFgKZ^=M5FJb0?x6dK|0KX{n=Bnp z%#Z;%62MGP;)t)u2gKcH-5JEQZ4$uLWw$0~o3hTtY|{yX*`{m{#xtK=TLM#3I2g}5 zx;Y0p2~5$si+SRFpa`K}{AUgZwiO2PEH{2v5I-0};`0F>E|_&WO)zbqDwsCAa-mO~ z**45en_C65{5HWX|8BuagkKlT^7jcYL-?Y>fX;`HBBUMkC(~&MG4s(5;wKOm3#L9r z=L(niS3#W1dryE}Uc0{H%?-q@8-baRHYI?W?=r#6=lt0P07>G|vREIzHZiZZ#aLol z50n$LB9O^Abl#wE<1a8a7#n(Bn}u_|uFWQv>)JeGxt7f*K8g=W4Gz7Q4FpbX4C-={ zVAjRe5%Cn3OPvHl<|SqwKPi}gb!&LUj|9F|;^~8X1y4ihp6x(q1~7*Tc`6WcOA|56 zanEpotAP1^0F0;4-1QDP1HBsN%Z?&q4fF!Sulo1k+Ei3Z|djHBmUv&{W)dfXD+SY@7QwXn>qh4>qw_Np{|6I40uu*0+2&&er+}{!OrNY3%(Au% zrfqu#&j)@h0?04B#NI1<1thZ6tSAav!*no7%JiYx1nfeyJ6Ukb46lfcY( zro=P-GQs3vyHcMVj(->c#MMhU;kH2Gl8hJsu)KH`J|NCN;s=(YesKPI z%c%s0rU2T@oaxCZHcD>-zIn( zFw2e~!v}=r#eeQ#&?g@Zuv<$2(+_Sf0XzWM&D+4_7=t4LOh23>n0|2c58~+u`inX& zhZ0{8Lm;mIKkT6U$Xah(oks#4mYo2mJ(R3>&0H)%sH5|$4)%ZnGw&5R62R1@ zWbyFD9mMf$G+lO{G&PIcLwpUU49o}`Z4~M zz=ol~iN}KYQw7t8GX>Lz^97TmRxsP;vx3P-iFXH_%&%j?)mNScSsPrryIi(lTmv)T zMK}_`%y*q&=5w5!Bp@tX#~{mAKd?{ebtn#=I~zv=m}QL<%(5;N z%yKFOvz!|Qvz*0(SY3x@-$=%;}BXNSx?19*hs3Sjph zR&-_J_PisQ z?dk62h0{G(6i)X&Ho#TT;WyQ?TVSi#g`6mh{|3!ky@7~=&hy3olm4L~Aqv(+TCc)(A_vVn3zAD2J zKZFkm{X)#L`r$}Cix0?qa1a+DbZbc90l-O#FG6^hV7BS|1t$v*AUs+=_bbhl>U z4scNjSFgPS{s(S{LD)Z%^#98p{BN_ z{-$&*e$mV6RHvKM)vlCWT8qGx(aN^ArM9u@rdnrgO}aH*xv-_Fv9b}7Em3CorLFci zHrH3)jB3|bE~sCe28~TZaxu^jk#hdP!jxbdA=Qrd+vtr-m85W^Y>7+Puv5u!zEsr<;qk ze(?!&`l=yi?egZPmRyFJMC}qBFSXUpmGzBbKAW^~VNG4Gv=(GF*}Os6E5&vqlW0q8 zPTyEt$+3d;hI$Ms)4E{|`%BTjb4NcWIR<^dJ7ca$3Ub{HBC@gJg zYOTB(zr9%5+=RMDO(6f1{LzJTHuz@?jLgF(Tei5Rc2WIOT*fNhM80e>u0@rN%TRPy z$E&Vyu0sO5NBvFGr$h6i60LKi(*4X~&kX4!7_yYe;9HV&rbI7MWy^aa`k|#^>C6?) z*Gt6?UN>-piQc!ncapWTcWP);W-f6vc%QRPpwY`Bn=#~dMcR~J_Vi|xW==1_1;ejk zM4DxcNDfW$+Q`ydifA>*Vyhf1Co0{lL#V=%a;4e)OY0Xcj?V3;*j%=_?A2PY6k8{g zXxUujSU-d{=#^sGOrm9T>!?V!UMZH%Bw9AEt|H0&1k2^8_1S7mThr`cn%@>~8&K4; zy`4)z$v7qE(&=SXrosC#sh3i=LD9+99ACrMSB6dP;_8+a&AG;0cB-ZBJ9|y`)!emr zZmzzxt;rEIVegGdv*u*NtyYFKDQB_w3n3wBoBbNIu_34H_8IP|W5~mxmQsphgf@KRAV&#_G%v_q<=)C(+ z*VNFka7oCxrOOt$IR4srBUZwGE48F==Ayqcy$HTE3f4urbi!(QSM}rZ^{K8EVmrHg z3y&=_eaJQ_;4^@pQvVXDf2X$}T-OX_l^=lzP`D=fV!^|?L$@;{pvRXN)j<1~|PA{&kX{rnsQ4v;E zN2G_Dy`B-YAV=|{$Qqu2dPp65qq#PcD=IzAoTL6ZsE)545_{{z%oA_UmCKqV{CB(@ z+H=?ga?pjP=Sa7Gy_bsR&%Q0mGC3@x4;@=hq?#?uO+j+g5M5GE4O>oxk}XBdko9tO zIeqBZk|Nb?SSjbQtLD2- znTA5^*xbSM^U8F%rgV#~rL{JLt?P;A2@AOiD_X3)f;DaH3fxHYss2)~au+tWxT~~0 z#LZY}3;bvE=e+m)XNj`jNV^A4&e&=^wl~hSrsh-%oxwI=h*!F9kq@6cU(lsuT(k>L zJeOJ8pGYQNT(aEaZecS2hm@M47d7 zZkk*=A&HdJSi5v7$5w8pJ{3bcSKjf-qSZo{97_-`?|2&^^8}kQhbEUcC#ad0mynJ( z`=KeDwD)}hV}m&+VtsRhS;CrTy~xSQ8l|PPC%u4|M71p#Uhc6L-Wk?3HTsiYNRgFn zJ8-l{XsNWnnek0_R%kW)sWJy ziEx#v$1b2g%<4leq~b*+Sa{ z7uxC@{ekVWRoB&GyFgGx@SG&`;))YQE+spOur@M;126g|XI$u}t5}-bt3! zrdrb4>YBc3Sn(4qVJ6Me1y)9BHjswuN|5j(yh2FYOGvY+tTC`Y8$z^ z)GYLZn?c;vH8d?+);poLxjsm+y~B+_naBNBib%69la*{aIaTDK?44v8vrl!GUw0DxFw5gWR&92dey^}1VO|^t<@MykXDVDBRV%S&0K8ZJk5tB()vNa?~XlPoj zxjaUbVhzciO`jK4Vl*nJ%^8&*mMNW6?hzyE5vdSncfBol=7{7ltBf_?>^D@(OCG*| zkFeo5s?n6eYWzePjixq~$>!KK-rVFG74>#5Esf`kT$fEFWP)`MV6qazRU$4E!9vm> ztFE8>scOgxW)GMBZmAmKcvpz0MegvL!^R=0HZFO)ZHF{>I

      |VU)EvXJ$^$N zU3xdD#du`I!U@}b5Uyx+;ew@0$1iGVT7a2`@882VsjaTAT;w)#xIdQx2?`C?deuu? zCr$~^B6bnEuJ87J=Xh>C{(|7oj85qD+4F<%>`>+JzJ%}novdg0TPA_`^$&2NoEsGv z!@p&s{5$^0ig~P_rZHXdGteVWF%r^sXYlv1SK{v<^Ks5J{teh;9v}bSj(-oPqI}=* z__i88{=KB~ef_=J_Ekul&$k(R*1jEv53UILIz7HwNQ<&>wa53A;Tvf9zJV{Iu>PBm zwAXQ{Xnh}mp0)2F`1m()^xt5FTHnukd=((y3>_8a>-6}Jf$wSPk#C6MdtUgIg5SIN znv#hgPY-!~Tk%JDyM^y0(PR5Qcy4xmUxY!WBoI;iKJDqfjfC4&38CsOhaPcC(&pn2 z@f(0y5B}XX(^&4yXe8_BHgpo@KyrwWLeKIY1RwL0kAI7(d{26OtHH;=WmHk_Z+d($ z8a}uz6A1s7SVj4UdVI6Mw+%|G@d_(L16h}m{b_A zqI}@ha4#+~x6=8@{uUu6)zLZ|$1}zNr3pA@rCh zg@ZB&eA@rYaISnM9^V}Bec0s)KGeQZ9$$mu!_W@->SZ26GdS4_K6H&xl&{8{hgO5H z99s0>ScGcd6&~L%@SPvB1$sQa%;Vc-_{JN)-7w7h?=|qvh~Rq+dbA-WX|IB>6qxqW zPPK2X$2S&@F@yz(P><5?@eTMQ+6{W-n}l@b>pv#jzG=7!vAtB3FAsXeDM={4C)2)@ z5vP2wj?U(*0p9}2!$A3d2|deK2EOG;r+rgIkNtTRt}E7m2f>#>yo&O@7kZYj8+`n` zaq@9KVjB7KJiepgyAAOw%E#}>wtPno-^EZ?zCXa3*1noSL7LC^Tj*K7kzJYjfOab1 z_dLEj@Ug$EP>-_L<100M9Pi3^=Y(wgHi9o|{B}Uk+E)&~k>H{KQiiYA)xNFhSJr>Wz{mcsqI_S4p0%$EeA>PPwmNdo^^a$MJR< zCQs|Xhp~u^>VKC&&)T;UeDpKxJKOM`>hbLYUsQiN+2ecI@Lg;8p2T9o+V?8>Mj>5A z>-$aUS^J&_pSJHDC~JMYJU)Ig%N8XQJ)Yj}@$m16+Qazm)>~W3O=<7$szu^ zH{RxekNL?rPxN@c+vD2?zLOEJqTG*pd{u_;V^G%m7J}dUZ!h>tl}z+_8iyY9q<8{p z0ACeC+BYAe^8Ep1mhV;Ytzm=+^(enZoaH+NzSW2)-wgkySwXbemwtdC;0+T5Fs-b7?J81ao4Bv-5zEbeD zBVC0YlnRfp0AIeU_I(oRYTxr`XWO?8d~7Eb-XG;JZ@E zM31MBdVDp8Z?Wjnj=D3m?c>d7)cjWsJ!@YF_;mhjHheQYz5(F780jkHpnSmN>o$BX zNZ0ySVQ|>-F#~*~97FJ-d>{A5+ivjbeAR0BKIrjPf$#nZzLdvT^p(tfaFgNt+!53v;qsO-md|Ka?hHv`#Z2Jy@FNt&&_1`q;S^M4v zpI*;zfilzBU(WRSUI*XLl}z+_n)LW)d^L0Z{fy|5?=Fw;AOag84?VuE;5#6B z7%1Pf9$!ay=K0#^M33!p-6`4jHH^q`AUWil4Lxh$Tiu!Zt`|M>UEuLGgD=W|t1x_D zG<>&s*Q28MM%#C@cRgBd___?=Cp^9+_;y9uH_zkSYxuro_zs+v-M%m8ux}sqZ2P`z z`0h1)_j!D;f$yFO`?@{8sarDbfvGiYk7MU$+t-GRYE=9F0(#cIR>RkA_`c`yZ3G{x z5{mYhy&m5V!v`4J_n3D*pNf79%21T=8{YN&b;GyS@O|Fnxwi&+1J-#yVy+VUTw7&fQPRq9&d{xllczX~b(>R`g zpUk$e2=its;#HLIwPZHm$gP?6)x%I$zGt9^qQm*L9DIMqxr*{Voy_Jd2OsN6`@Vrt z`DS|eTU^IS^}p%f{nioi>HM<8@SW@NO#>e;t)ZxWXL@}6EeGY>Y51Nm&93iJ@FhdG zpdLIu1U+)6cmkOXz6yk_FXs=Yu|0NqeD8wq9mK0pkFp(l#3`OYy1-Y3kbK`l$TaeG zC$sH)`}FAc{WA0{-`n8hI3nL}gvz(l;~Vw9SnM}QSD_wdSu&fi7=uFF_erEH-$1WD z3eJdr{#@X-$8PYIgNOD#W%z#QU5^srTZeQNweL6H_2@P5Y5Q`#t9|=NXZx=kd}xwT zly498h*OeMdVhv*FXEK%YaZWI;Dc%?%J&tIuL??4&|-b}BUHY*$!z;-a9)aZ73I4o znQh-*@M-%#4Q1uK0D5-(cHsODq^l@jc`}>t2>2SHMEedPRK7FL$>vLxM33K7p~pNa z9F!U8EZQCiajtxY9$y*wzUp!WA8KFR<7+c~&lV$9D_(v^`!heE&5h+rFYP!TTVnIH66HUqjE@w;Oy_h-ZCYM98!v90xtVso+~d z2Z$)&cRjw5xTvj%4*7n9Q2DMuDce5Iuc%rm%6BdFh*OfX4SZF==4LYpH?+|J|o*0{5ZU>w~ zdsLKf7xXM&=_8rvAisyQ^4;U{Z3N#}luYz^y20bCFns?ldbDFKI=S`BWYml60~NLJ zkAt)IYM@uDN(fc&b?6bNB&`AERshp4Zz5zG%YDw{>i{3Wk6%Uke&F%#0-w(JZ$Vl4 zuJ-(L_sPm%h`+09Zm<7FlN+#v<^m%W5%z<9iIJ(W#o1a7PLO92^ zM-B7_M3j57r`G^IxG)s;UorHEQ<5_F8=33xyNFZ&HG2N*%2DnhufKHX(Bu0`TaRry z^x8bV9ng!a$EToY>oLRBBaVW!9%p;?IGUr}XT5&#Y7V_UxR15k8ii(<4*!9-)$JI*1mhe$Mva-+Sdj>Yv0r0Q~wP$eAOP`F7Q38WC)e- z29K|3N9MUGe=kApJLSx5``X4w&j$(US^KKM$9k|mPBwghEY0TY0N)29?0X%0mT$S? zd#~ZE^~TXb@G+l?;wtD_zV+Z^d(uAsR0Gr8xyN@1d}k{eLgky`@!f0qPBVO$d+qTS z_%IcRqI{Qn?XeAfx^CxhP^f)pd3*yV1kZJqQ29zczE=(38HVp<^beed&wcI%UsV4q zh90?7Qc&{IO#dq}d~ajCTE1Q2dqwgvQ2YJ_JpjG$B<+~t<8O#Cjs4{p_^|aYpBRiI$>#Kke*!(rSB!^I z4Txv|JICLJrDqkM9=nC7?$>&X;Om#e1^tt2sYcwz6&kc}g5kS;NVa`5E{I+a-3C2t-@#p(b=XA1x7g!r z1>e6RT}ADy_xMuZ%&ec!H+-K!KVbGkA((t&bpLz5r#Az7oS#*++$mnadJW}jKb>OA zJ=?3tI`An6ITerg>M;@z5z#fApQjqWcfEeK9(+sHIK%f>uV0lKzKadtU%h@%Fg3c} z-t_uGIrx@~ebWrzFFd}<;EQUvpLl%Rz_(5KE;W1`J-)Xt%J_`cR{wq8#(ycp zSMTw?4ZbM<)p&gK4c}#k?@VtU(Qt9bCTm~PTSwFxKK_;%>%sQU_xPH@cQT1Yw7&oF z)^)9hZ>HhfIV!u~cYrUdKR*IJa;K!6HtsEzH#VT``!ZI9B9#hvkl*`FiBXxF7R<(ucCba0X@rC@kC~S=e33}?#)--mqb4w zf7e^ry$illv2Tvy`?IhRJSJBLHh*0&XW zBgMXXhVLKVedB!ajf=4F9q3uUb%u|>P0cj+m;GLQtOH+h1m7O7J+^`mQLcUG8@{a` z-@V|wDuVB;9^Z?G?*_y7adcjshW+m~@I|dV=R(icx8U2E_N_8}@AvrL1>gDz`=)q& zW#B_sb@g3f_`WbH+rD+U2^bZ@w;p=dz8di9{8D51Zua=Lfp32VUyH~0F!*%5Ei`;j zpmX3f^j||N7E4C(@&3x%$Cp~lS7-RX;_o+-#J*mF2mPi__lfXc@;CF?faT{pI7jm%=m3Je5*aa2JmfB z=OLs`l+Sv6lfl=3c((6NhOZNGI1T+*{K4q!QMIR62EEe}r=sOP;Emr3=*?CogsR7V zPsAxn>xO+C=d^F7vF|e;Ul;gVl?3_KjQDXYCXQ_@f`$Tz7~eO3h(mxI`;9m6$3xthEVxl!gB$fhW+Z$ z)fo<&qI^f7N1S3Lgui=Dzp~xd8onJK-*e!5ugej9DBnXKU()b(8opb>Z|!>xd{O=2 zGtjg4jRl{!+Z~4QV;?3+Q;9fwR|%S-<^iSIyH{iq3^TtikvwZVSeLrvb zuJ`!Hg6{@34x!q2t;bgfKAku2GJJ2HlWpHR@Qsb&`)}x3`(6Z}UKj2*e1|-~-QfFm z1mE{PzT&4d^Trnp-$%|3?1Q_VbYl{VT9;f6J!@Y#_|(383}1Xic71n&uQFda$3TxbCGoFyeA>SE z8NQ#QqSn62;EU>iFF?=QH^=bZZ}_%*d==oUR^t$ogYuxqw;FufpC2%MSHN-BzK6lb zeyO5-mqE|kw-uY)hDeZLJo zYu~%ZzU_wZ9*^%`@I}pk8$7id}CTjlX> z1Rvi&sHp#L@%RpcZ4SZ48-w%29 zeHVN>Uwzl`jq~_k1YZN}R#E?zd3<9JW%ez7&+wHYBTmElIrZ^O8<11^K$qpe9pEcM z9Q(`n4IieBEWR1wV_p^IW0}M$NqEZeJ!AMrdF@dLzS)w8f%3iAYmbBA)BElp7`}H( zvhCXqK8_z1<$DWy*1l1PGw+iR8@`j?m(ADwiC8SDWC)dS5cDix(Z6Tr=N}rr7jUzN z)380(gAY?oD9U#jdX}#gd{xk5dpvLW#tq2kdkuWbK~lwK(6fB2!Kdx}Bf~eu<9i)^ zSo(ybd;>hb^@i`qhVL*k*!mV=vPafXl?_oMI$oKFZa8`l>1SN{_D`d}jw)+^6!*@c8Ns-){`xNnSnX z<*3KUvF=2+aQrspsK;FB*?P2^a(`>eE%*4EbJXKJkFU+}{m$@R7PaaHub`uQH;Q{bx*zCRnjX9s25cQ5#gp{JtueGhupzJlj6 z>w~`Y2?;($Gvf+Ej@D1&kZC^3Sk`a7G(6jc{fNvV~=)b=izSp6I z({Oy0gYR<@eE$hO%hwIQ2I2d=;VbsW$6oM7-M5KJ9-)4Bs=uvh6FbiJo7chMu*r;76JM zcaq_|&*Lit-?|9Z#dX{e+__W>hyWTj?KR7&_ zZ#DSp97FJ-d@1NzzBj<9#r z)p>l|z&9CswC^m#H|&h;_Sn@JJ+BRcp0)4j&ob>%X83;jzHGkNz;|^-fBrf2EZBwT z>`M`Rbspct;9D(x>^Cfn<9Dw&U+o4T<5kpu-}dIK@|QCAWm62_W{>Y_@U2xcgvxiX z$2SLj(~!>kPBnbjB7>d(W-W=n?tch++x+f zeA5hHZ6dG_)1{O3;8PApD4uzGpogqZHs;X#Iob`bi78(f^rG71-%rZs%cXbfx!HPK z!8b!}V4(J0CF5M}dkuP{BJ>iIv-t{IGCsF_g`$VczmplzD;CUvZOZfULjzpSNXQ)M z)dbLeQjf=3X9b}q?S`He>QJ6I2fmxtgHaZ1jI)F2&M zoL^|)gh^A*PZ}xjg@c$WlP9~B3ojCotQz#$56+qyk86qKz9B51W%8bY0#`xG@O~qs z8|zoxFP1mEUo4IzLZ*}yta!Qp`Sz0AJD0SVbaw7*FX`xfw54Qid&!#4&Fv+(b>7up zvbuBCf_<}#3ifaAT7}mkg?kE)4T!Dk=>f_+oc~fkoQ)ea_pDFAY%dwwS<+rItaE64$?(p2`@Y$CY(sH-`oEO_`@+BHtvNY1Iz9Z& z^sxO-zw?is)7wjmJ0r6dora8u`~N=w?}Z2Y#}+2ILKw%dxgY+rd7z7}O< z-CaFB_lz7z+;t2|oq6rUV~AVdQS9O_yQ78q`y>C6`0f(m!hvirU+>gjdXMx!%(jL4 zmhCGJ9P4qJ)}EYK_#ZtPUB|6`0NQh({4>gLzcz1n+n=Ys10&im>t8fz=JP$QZjSyp zWqPb5&sF0z_c?^0UGKeP3rZ}^j|E{o2vJ0PUg3uBe>m#GqP)=ax%t)8Q{n|Hp07u* zUeoz#rZ=~j+{(_~&OX1YGu=|swqRey@%wkzUGtWdp>O}b|J3xseRYqv$3MJ$^V-MJ z!&j`C7;Afc@8eIfx33u=d-Bg4N``I5S0rr8Ta%1!?&-PzlyUAeZ|0e?YtutVr;FeD zW9Q4A6FdIMo?gtJK9oJZ!u9l-127_nwx^3f`p0u#J||Ks7W;cX9D}yNCr00b0$9_w zc5i3lmVFg)BAq4?;|flHW8v;GL9yqUl6HRo4dj36J-^Ri^LkIFe@phz%V;YQK9aX5 z|8T)eg&>~$ARDCUl=U6S_R9*{Kb^aK>phv(a88l^fqkE2!jnv&xXAU1lU<*yKh$F;*2> z0zcAj*Xd5kcH5uNRGYKO`nKiGy#8CZ-}KiD zYj*F0QJj+|I-^c?^UuFL5qA}K9VV~>ldnb=9zKa?M!gpO`GGYi(^_ zdhvt_i|SkJmMs{MU+0=ot63&A;FsFQ;b+4>iJx{J4~-;}#sxVmCzVgSpnU42i*Uv7 zEyabIxPsUp-IS&=`B)Lml?4`VQ?L%e&ApNQSbuZI^@E>2*h|M^%t(ILn*-*T3%%&% z$4)caOvlZRk^HPTkxW0^r1Jbc_wHLGxlSq4g&Z)?|HV6>;GN%S7C+SIWsdRz9K-O- z5qo(8xg^f>ez8f$pVa>>;#GKVPF?x;mqss z3e(@w6NEe;=9TveIS=YL)cwWKpAy^a<^R2R{&VkqzS!5`@?-Ju z`TJ@)FLUW7v75d6Jmj5!!8`x6oL}bhpBbz5{I$V5|EzcZ6FJB2JnDN+Y?;&-r_Ntn zyz|d{=f9EjWiJ0XW{bsT7?3(H_Tly@7H0!Mcs~{&>Y%%~hz|>JlJUa>TuRJLka8Re z@zceE$=xiN_enPi<~`Caf?3=Hf_V?~ieQ$Xk9Hy_ix?_634DQImQUgSJc_efhA+9| zjDRF@sLix9ehNMyT+7FCA3>RhBQ703MN9$+%TBN&kTE!jc{)}w>orL*>orv{>vgGM z#?2JWJ~T@(Ipzpv`Bj2b2p0-w9Ty8`-d4fPdy8P!sY5X9^ku=ceVbsqVuxT>?McB& zgtR-3Zcm}zaok^0m_IJl9lJbWbK&pWr57}{sD}QyT%St4ep%7|03Lovuw_N_afwt- zOEC3HFKeyC@2m$jn$FrqCa{iK3F9-rx~iGOIx1_Rle3ng8dkrJwToLr9~&$2)99Ia zT9*|;tAdEyMzm8Df&2BlrD2L|zSeY0YbMGyUqlpsQ!@Bj@}+$?D1TitTQ6sYt*SbW zzp02{<*RLJX=>@S9BE2+zGcm#nX{xQ<>-zijc{VLQOe;@6uN#HWnI`WB+>hAc=d#7 zb@`=nO<|*XQEar{zelba!V@^l6kx+79ml6jl3+Cob~m&GlpdSysC3Me`{9la!$|u_-u5CVkeLK zrBo#e+a{x^NygQIiIwSe=7&o&Ug7V4hIvBAWPS}a+AyWmUlcu#dq_uHgWt=nWbYo| z`$scFGwPe`YFqe=tIKMa;^%9d8ab?aNjXs&jdh*eUbrkz;X-u{;#9C)axxvC#F`|R z%peh;yarMp$KmUhxs>2T^>*TvI2A<4UdLKz4lpnEw1;WDPTq~f^3BIN?;}-|?{kQ- zd?_qamLraQTze_shd^%m?#0Orq^l@j1@tW6Ztzt>iF{m#DBt-W-!bt04CyM$H{RnL ziORhSCGv4eseFrpt$k17{>iNo5KmFQdci41LipVsr3lH#^_lX`0=9fFf{)J~RFv-u zL=dMWA&E6q1u*#lL%um6vwR8EE2@1z3?<7~2NG>x-ny!Nc%f&`|iDE9x>CWW;a`y1=arJnNL27lT5wjp7Rl8GKq+n~ohDV{)P89wfX zRz5tp&*IyP1g5Ddjzf<)B?&taJ z(|G<73>I78LrCD-Rz>-)hMwhX246Xp=s(_uE8jSe?=>VeD4FQ-w9Mn{2A}p9-r6eP z2fg~vK|b28LOn{#tM6Oj<2a&yyd_q?(>=Z_@J01!-6xbnUP=)>|e@vz~kGB^UGY0;DdUUeI8#G_|$)AB3=3Xz4iP}(kT1< zz4g0{eZ19Gz6Swpe<{EPqLBuPsD1YV5T_*mRbwCT51Gbxe90Rht>BBY?}#@(rsBG# z{yWd`J?ZhS2OpoKsi=M5^!Vz)r~VrUWwnogf6w}|EJ{CI3~B=CKAFa&R?5|+dR{b) zP>1pl=-GGZy#7+yuPCZ_F6>5E4W$8mZBhnY>Fi_H36rKyNg6rcJ9IqL7yaYEL$8nv z(PU>u8J@qzV|cH78%{rq13f7g?~z>xTzmr zuB;!;H$Lk(B-=WRH*8;df7h9-u*H8{8D5*5U3LZV+F_poUOQ~D!+8hNv7)Y-qxf27 z?Xb}^Zy-2(+f;Wt+0>ShiKc=%p= z?XbK9SH+6TX7-B}EiWvH6;&L_ixqXOiN}hj&O}e&-PsTMH}~{hxa|}Y4Il45$GOkE z!fBv8P!zj=INwXJ9iDgK!r1PDSp(LdHlnEFtly0&EClrdu+GC9qN3$9K|OWh?+SKy z?|q_R#E4jDVbOr1)1JpW{lPyS7C$`Tc})Mq;(G?%fA^rh4<(CE+woxW+(83T_}LGh zx*7gCcLMPJ!)^e+f7m>Subp`s-^iZ*;3e+#a`zeF3)duqdJcB=WIfhyNVWgyD0I3z zivO~F@?F>x)Y08B;J_gFR(DuG=H77nmLDB0y7B(^pM;;GI5ib}X!EQu(~y-;XL$V1 zf#U{*Z&T5>>DVKASC$mzofF@`Z-9H>PrtjDlp{{Xd$?`!5huqU=y!0adv||~?{_sj z`bE+EV3v6sn@J41j_X$rYX9R&Ge6qUm)iKML#*JI;xJG;dtLYlp{+@|_L!C3^}F_j`$NSN9AW@$L7hUSt2cPo9dCu9CH< zHRb5)7uMT8w%o@p6Al@GwBoi&cC4`e@j8$&Vtzff_Ueu zwsk{ybR=UB4sF{M@80C>Te5Rs(f;netYhKK{9r$bJK0lkxZjbX@WI?q4qk#+V8aF= zdhM_RcHqkc4SHzq?E`Ugq@?XmH;{K0@55kOvAL(``(G|BI_+Q_ucn^cJ$?PRi;G6Z zPD{m}+I%p6|HydJ;GMJj-QRWba~;#M{b9t&{GwB0BU7=?&6o_%K4<97!!8B5XV_GJ zZb%#$%zYsD3_Az?^qyg396p_WdBY&u^sfa)2eC>c99B>?fTQ(D`>cW@Cc;9~li1H( zb7tQ9n^ZSHwdWPA-FR~Nq8IryEZ7mj9xMHgbD|OStHb&3UH1BI#gF#%{A*n@hu6you5gtZnYZTsv5wJ2`HlG_>S7%uN4>MYuK1!=7xf=e zI^+&);po_jYOY9MRI+L4h~53R>>u^OHMc+5wr20A3)-%z-cxi*5nkmFWQjYk>ge2g z)uGhQdq32FQP;RjieA~5gm1Pj*?rC7Lbr=4sKDHngO;Z|`gg7RQU~6L59r+arRxso zPc7*hx@huMS57SIk35~%K(%xFGjT_|Q}KWG!rzi#ZViox>fofA7tIVgUwEEIVwh-4s*W|LVRLBNqga_0d1|-Bc6^y0cAguf0$Nu_3N14{6Km4_I}+v zs=7B%@9wVJ@nEuh`^5E67T@yj-UrLq-?O)SQ}OyQC)a&V^>(k2jMCOTRPHf6LD^~**$$+;U)c- z53MViH}T*#BaX(l>?;lG_n|>^6Mw_mo9KDi(1zV}mta%drwd&RBXPz%9jl54KR!Hu z`(th2-wVYT_Kga2w*IwaRo9Z+J3IRo6|DKWEEKf1nJ`oDczngg`jSuQx0j5@-l7up zgaswZ%l0LT@}0U4I1%g9Q~l{8rGP7rKo*hLTfBupI7ps!sSEv z$4B0oUpH~Y*!Y%x306q90>1gT_V~yPPmbSyLE8b;BJn0V7*erUr?J1=l!6Yn^PT0> zQPo6z<*sI@#9k=VP{;I@9d7%_OIpj7Jv}`MQ{m+`kKJyQtvIx(g#oAwm=exZ8H)Qdj?B0u6{Y7$8 zif|a-+&6YyCYG5y6}LQLT^7-HUIvd+XThp$hG69~%% zGo9_kcs>i5CU`8us{~gd{D@%Y`>0^v8&wLPim+BNIhG6NZPaH3^WJu~;3UEgf>Q{) z1kXVD9l^5@?h`y8;r9j4MtE589E3j-JP+Zkf~yd|4}N65XhWIcslb;Ct^uAQxDJ@# zr%HX=KU;7q@La+4Po>}n;99}7`9{I?$r8cM!2FIla?+n|f|J0wJ96>#$>#;P0(S{s z4*WI2^gq87hde1@e%}Of6)+`U9E1hLGJPa~`Mi?CvWb~aiQ|5n(hrC37vZ_?QE)uN z7!&lZI6D-C#pwPO+8yVBhOj+!{|X*$yZsZ4=d&#Cr63>g@ref@{D9yhgd%}GQ+*nZrfK`FiCOGyuf) zVJbkJ-+*ZguZrAzp{|aXQbX*N{_lAB02e|E-Am-`EOF7!&bX8{22tE^L79Mqm}Oli znEt#Mh zc5RNkZ=nzM6)7Q#fvH% zn`(NQ71YV8)MmZ95AsL6ypQmul;yw2kKW0YQ@N=o-I^Xhe%8{P>szbq#MGc@e;wM)X6G*5@YG$gzFG1 zyxveg2H@-65+u1#)w>RWI3;NhV>0J_em)M`!!(|k16aNth~xd83iT-G0T8En0^#qj z6z2tetPa!2_iF&lw;DQnEk?4_V|dKtJ1FliX&*1s%D2bkTL(Vgx2RB$vfJZ3X85?I zQojEKI{BQYM!N+n{ zl<#xUvwXY2R|+NCXZIc~_W0I;kIyeul&{|7I|9DtP$Hk*doa-BJBkU3>suA&EAaSc zqmz_FiF~{rpdRb{s@J}6fbR*!t0>+0n$6@)7f-i|U73F&y z5yUA;cpZE?e$SRP^8FNt<$D)=j8jp*7Z73jCgVQ73URdW97!YJERb2g7cn@Jh*wd* zE1+cgHiA#>I}gfCBi~sbAHRp@drBsHJT39~jvD*Mi5~gz?#|hV?%?DpOy0adQBnJv zrCjzo$`R<*1kimV+41}kM8qo7aNlZ0)5fAd+dT@rPE+VVit3Gl0csoL$=57pU`RQ? zFr0Ay#EE8$Lh`tK6sArV_2chR;PVMeutq4u{cjL41@Gzxk6Op)`1}iYyb}3ecqk6L z+Gw0e)N^tAM}_!GIl&OXb5cxT5bh15pu4+gUhYKx1|YmG3bv-3wItZ>#ntw}>wTgFl5d7PKrpoGudTgtYSok_SPvB!Cbfk(-dnB50 ztI4PRjUkWYtqW5Tdg!X5DCXa45T`T+sQcD(Mu`D`3a*ZQ&# zPB{Pke`-(B#EBP83I^=)$7{D3pyPE2O6OP|(3vmq$FZix`^{k+x_j1Mbg~=2`X|$W z?~jqpx4WVVz0uoS|96JAzOR70(60X9Ko^AHC&&IX4Bn;hRp{e7IXMgAF!X5l2?{P5 zIOiwYMLL#yrl$?(#{GB>znYeM{JnSO%`NHXW`v6{(ibeNZ)mMw%n@%N4Mk|zE^o$P z2vs&OThLHnZS?K5;1v*&h4+y${#m*E!x|RTO9_8D(^}iIINcB%-{*wVXT3OsEm*d2 zA*#8Qj|$A}lWpWu{82z9{urmVzWV=RLW1wdVNlpPsS4+IpR$fAJ|84L-kkKa2tD=< z6`eyW5n=gKIM+1lD*l+@6eA%O$V5IK)Zsxq0f*(Afphjb73Dh@5yUA;m}B@@H{~Oj z!g%sE zOM3PkH`Ojfj=v^3zg+Z>KgaFjO%6ooxbtWojY#46A&%)dPEe+#xzVHz8>4!9TDGsa zv)}i>JhHvJr>(ts)+zUN@r!(d{g8L|yMNP=5x2%ab@%$ar{6Pj_<`BjyNIvH8L@l# z>{Zj}R{!I0!pEG7u+1gVt9<_Y!sd+P}#M-x~ZohTI_J8B%tFl6Tkx|R`rP#|hZQwnpj)z&$ z8HZhrS8mw6_nzUGpY^9p*PIh;-~8DN%f_^K?_E25VterZ8C#>CG0)9Cii zZEJ^*YTtq^BMQ%eCQgU6ZyC6Dc>fJsitoAmlb3MsnA?_t4RwEWyX zYYRHCb?Bb1^Clgrb9LF1e{iDPyCmt{tAg)k;zkbaqHNi|65BMl6_T{jDvr1??iA?? zW7D_+^rNo!EvhX!pc36O@|JHvvt{}AU8Tn|Ye zG-20-mhaZ#^buY(M|>%N|97ii`0l8edwPmaqL1?TFg_>>n_D)--S;UWx{#ZzOcKB5 zg*3=;I1k?kRq*#r>Zb>dSoCfY_k})!?S9BacLm1v&_@w{9lpY~KCWJ3pUZe@Mt=J+ z_nl2$#hdv(L2irhw&LAv7Hp~19YNc8j?y%AE{Z5C%1u+!@vJgVi5CsPQUjarU{XMf zT3z37!M+04TE2q?orms1Ut5&7WnaP0XRG#MdL5$rbNgej5B2x-lgfO05F_wtFX&3l z94uV$eOVc^9>wMzdxc--dIqqwK=3YGTqKWm>S6qXyRH}G;%f6{4Zrp6ySB}x~snu&YgJlYw5;n}L4`=;*SSC07C z(r+(uPMJD=#M(jgt^su#)P>mDRgO=5yZJee!L=2s9KfgRl5|J=_81Dngfn&e+e=zwB3>1@Qv7d^pKvOJB!dqI8WVC4F1kX z!QHv}nY*4T>F8yyE1T{2=fF(&eM5z4(RtU*z2dE_9)r!;63K{}huuK;ypFNevOhDP zR>t@5uXmqyx&A56f_7-ot4r$l)^n4l?p+@~;fgU!Oy^?>`<4|{z$b*>u zdE1r*t%8#`T92R4kvmmbBspJ20hf4lhQ zo}T~w^11BQ3ra3+DY;})$+V(^%hKm#FXhgW@%HXRx37BTU<_`61H^gtLoX^>G4ZnW zq$|_yCFgG&uyfzY!2WRVAj){8-yY5*ECrbWN+yXPOD3gJE=Ekr z`E)Bj3(?F_d>Qj}9&D-@%8k@@6JNqt{IN0m$3|QQ<^#X&=_u$*e`*sh_G?eMZ}j&1 znZNG&UwOi@A$UaL+Oqe3kX=D@J*{^+LDO^JpOxPG{N%xtDE&|N_1$XhD+bTwW^u^# zLtc7=cYdC!0`aNrD9nTIFg)d0t(g%rf2XA1>e5e+J?G`; z_sgnKpMPhi!tnb#dm98( zpU;)ZLw!E)AZ9&=3uZk|6PyGt7fjn{3a0HJ7tH!K31&TR7989sp)P!R1z~x*$By=C zeVsq~0U3cq_x6n!%=(gx@wESgg30$`!Q^8fq7JF3m$gqz+QOA9_i?UVewhx$wWI8p za_z_uND_zc@p5fJV<4_AfO*O$4I7Qd4idKzF?ML zA(-Vm-y$!I`?$oj{06~Egl;TAhvie$w=6GS;-Xxd?q#Ik;&dcrERHxE98!)WE+mtQ z&tz;YHWi1~aT+lVgQRe1eOuD zJ|Q@T@CSnFH@;(IS@h2@1=ByT38p{a5KOc4IIf|e1U^|X?U^8$zPUs&{Xx<1cw>Fk zhpdl&#~bZXKd{O5`?~ndotXJ(6EX9-b_ZZSN>qDMFJ9)7gE_~J{j-C3)+c^WfLVWS zFP5e4l_aJjggUx!)r}EM0JQB|iD#L7FHarX_G!WN;oX8s^^jolxpsj*%iJgNNrcR! z^>TKy(hz6o*Z?OH#K#4gZJ<76wbjp5jdO5A*dFl-4!XHCE)6u5@iK2rBbNHYEVuua zIo$k)mkz9NiNv$MbS3x5vc7Jt0n_$Ii6_-^!L;4&m4^=N`+&qJ5pEaEdORh-O)l?&<@r&}@`JR6(q zqZ2auTJYs9QQ4y6YpZMUv>eax>lbFqAl0JU#g)x?vTwJMGQPU5w)#dsulJtq>wYiy z@Ev;c06wFoPxOzgn6)WP>FOKZdxGQB^-_$aL+xr?((vx_3A0qyczVLQGm}5EoL;XX za%^bRYDVb0cN@0cpj)6|_&D<=U_nDJtzWblUvt*#lFUn3&9CJ&G@*;gOP6MRKiF~1 z>aDKtT9lX$fl1Bj`j+f3En|Pp`W7=7S{L~>W-g&R-B69KsMRgz`^{VeUn{}VbYteL z%(C{+T0`oWy3L&S)srS?IiRJMUt5fq#&}QDwD?4P;N?)(jPt``%z|ih3%)+9sWFVE zpBk4%yoAc^nN`xj)Xea#tV=Jg>(j_+-H47!Mb}kMh|<^WMaaIGUWBj8;_J6cHdh~J zMk!~#(huvOYh!NKc3Io;vJ%+wvLakJ@?tR0wKOeju4D%f+X#KIp{d%w+(RJ|ukqB- z+Ujbd33_Bmlu7ufzar~vSkrR-u5uXHJbrhJ3N9T^`28@%T#Hb6?XkjZAf*Fjz8*q&3z6Qkc*@24k&GGm)BJ*A-k&o3;KCa2EeQ)E0 z*I*UpI~Vc9DM^?!Bv>nu4@hB_agYTzC)p`d~F`zM(}YB zq@sME^7zVNR27tHAD4Z~H_zjH3VgRBT}Amm;_-EWPy4goquPcHPz~ERh4UFohEVxF z1wfqAG%O&MkM{sfbK?WR@~y@>pCzeKk1_{kP_s||e$olfOpK0Xdo^8wbDh3Z! zLs35d{jTNHJ)q>{;{xTI=kdJ-K0e!0QNE9OeB1-7{e}0p$~O+c+BX&xQmK-O9#6}l z$2=*XKz4wy0U_<ePeJijrRH9KQ$kG|ChZtfsdj{-^XV%xd?;K1c=CGPlz1KG2slC z22=z@7g$6<5hf5M$Pp40h_HrH$s}GOiX;);5U&sgA|4wPSrb%@F}M*gjN--{P!L(x zMLhC*p6aSePiF#rclY=4|Ns2HZ_?9mRlW7pTSr${*V|P+k_t#!keQFOCx*)tKpA4U4Fz+h3BZJHd_`2K$EtziHKx+ahrGMq6+5W&UxD zZXb!*E3EA>nS>J~d?ImAm9RqZq7h^QjLg77L>ay$YI;u_l7mHO zceP_*b)=oP*dzQ{34(5=CUBQKg^3zI(=9&h%*Z97#nqA04pZHU<`?M4Uk$(0cUxi} zqIq0cfb|_kf|dyEg7=2FAJkx|irE_O-QSeCX-ulmn(Nc-DOtm3-muydnV6fq!QL4g zfW#DpZh%!Qzi3q(Pg7IOyH?#*-iBviQBCAFTVuE-rh_$RmId2K#hkF%yJ8oL2zX9k zBsTXb-jN5LkgwBd)T}0K?P=8(B!vQ}RW=g8cAEACC_!ST;%$h$aSjIBNA9k+yaT&a zILiJAs{`iJl`wZl+G)4i6{Y)JhvL-V$ABSG$PB|I{#txthxd7ZIxN6Vq5vZT)J1uD ztFEEUVWhF1Cq&fW>BMGM;#)>d$VXapUV?E$tNBHyn>vK79{~eurz^`t#wCar z$^EGG_gF&q46+PIWAwVt&vp&0?z6Q zj!&j*y+)7vVgF07-|=?8p&Pe;Hgrsf`GbD0d*G3`;~u``r?msVm^aUU%l;qN?F`xe znkVDkzjuHC{a=$kafAMO!JP1=^>@unzIODH&i{Dfy7o8Te%+fx^8a8@ZT$M~m7hPE z-SCg^52khdVaArB+rAm%ex~*h<43H{csc4>?{jfKd)|rMdezRFFMfV$QNv&6et2SG zw?B-1?9<^_pV&VA$T#!SD$j2l@l?&xs3ob7hWzr`-hX}mUDe>wy}bty@N7u?ZS$eK z?r6I2577gU9$$CItG|uxGHKbi^pP+8@^b&(TG;FN{cy+Hm^*gv`Nzbb)jPjG<-2)o zf~WTln^e9-6!ZU70bKC6Pd*)T{mA6=ZP&j%_{66_Z4OEBJiqMC559ggBIBcOJvaR8 zUq@%&Q+BF){YPE5|JJ_EUG4KypKot};N{C!Uw-1(%cp++;nnZXKmK|5<^Q~@>4xpz zr#CN_M&=KvPe%-a{;dX}`y1i03_Wjq!Ula9m{mrNTc;Nd{U9_W@zW>OY z3%~4k@q#`5hpBS^-wOCWD&W!XKP+7~_0^cGPyD>vedx=teAm7B%-T6)Klt;KPAljA zt=qM>#L%pNUjM|O;_EV&52;!I{qylTM;3Lr_Iq^Uz^xH;qc*H_zqaI!RX;7?W=Uw% zr{J+cZ{3~Ix!X&lmnT|AU3AUcTYtJYsxHdAVei{-uKnA6Z@w_=cHiSSU;RSKloMmT zpY6%9{OQKzIg9?c0sNj<;P2f4+I1ato-WcdKD^krV$nCZ-w?|L+CxzZby&vlqbMPAn=Ny3I1_M@vmY_p!6$Kbo?A{;xYPef!PHk6gC!_HR>; zyi<2$+k0N!_2X5J@7KQ=KlZVweSNOIe!z+~5A;latM9p8tGav`(kH<;eBX|+FQ-kO z_{QD0c)h*HRaFdmbtxPS*S~TvQ6;n#K#u zC%a9&bim`+b^qm_#)_Oj9DMPv*}tWgJ-PJLeLp|_^H(|UQ>Xsgb@uX-KMh#X{bcoT z>wkN)^4G82H{ITD(>vWJ{Hx^h(UGxVg>OCKxyIW4q6hD||KvR%+;jI|Uf(lzlD`As z<8mer|ARc9-vx!r^S^WY9hNEnV3>#q_72}f8Gak`^MB)ej$Kr_p)9QdE8aQxeV%`> zIu^AxV0N0}oh%>A@@8FF#q3>k!Q0?&kGU3-9$&s}qI)5JXUp9xedN;`@HIu^cd@)G z!}a*a*_tyM{=oj_Y!WWr9jI6EZiL}oT{^G_yKVa(JI@6$eT-e z>+eOy>U<~4^w4?Mwlz-YHS(N11kuadQ?Oz_-O9v4m@f6dhsU(kdw5KSJaxH3@(jO0 z^2A#v`QA8-cOW1y%0v2hz*)Q(0)OiGs`RIhpGjWBnWXmdV$-q8cdA4=aPk-=%0cE` zl!MII0EF>fG}15}=}!!jRl^U6a;ls~x_yMVp01n>73s=%R+u+c z=A!)Lba_$!Qa4ey`~mTGHub*OAjvbG1j$q9iIQhJvn0=SQYFuHypm@+Bvq%3!*`fS zLVr!L|F!nRwADLI>=D#EOd>BxkZI1A{>;lt$y2Y#B+tA&Cwby=o}M_&%lDGka3-nu zP({5E1SIlB5D>l8dyvFZd+agH8pU5(r?4}TL|n|#lSEur2uQ@09ZH`zZQGseY~S&` z^Sk&>v#q{H!+?MnW%T{kT6vdZ!2-U_a5nFz1ea`KN*7`Qubc$m0f{dMv?d!IG{~zZ zt?rv8kb^`ZazGKL-;%_Iwasg9PghO>mjBbdAs|u@6jrA8=C?^&>@%Q5{3RoH&`L{L zlFWCR__mM#lXJmdMG}byk8;}mtxlVq(kbYhDvTNA4H3}*^_NCYzfxI&GeW>?4fH_e zaoaHCOAO3m|CZnM>Yt|PPr;ooL;dG3Try`ezREo~0rmGkjCbX~8E^8O!S3Nh|DE*y zy?B%742>T=_}@wI--|bSP69SA_;=F#_u@^SGsr#c-%3x$OJ3|zmEX#yZ>McTO!_~B zh}S#$v-q`PER26Y-HrRhn_+&Ze@w}Ji19DRO$;5}EFw7GuSopHxLK~R9wdI1TssJn zPn2Pi?RC2}hac33VZ5JyiNlCD7jBM66)8Nv?`*_d0lYimM?7YSVZ;l=n9PVb84h`C zMW`+(7|0p%P6BTf0*J@qhQfOv@r`)%;o$R^BFd5K;cvtnj6@Y)8-y#oa_~mHMmRM1 zDN=YGPZ;r1fj1X^)KA%^ncw?y81eWF%<;G)g_i>lBVN4$ubm7dUNR0NUal-BcneZ^ zbKx@Lx$!ay<5RzLWf5CIF z^dF_)-4HVBHy(J?AVU36)qcDMCcH-A@p(m&!t$kH>XP)DJL%K4xR5 zha|;bWtKxiDvY9ve^>e|yiefHRDlLL?%zmnC3geH=LRu9&-dGma=IDPJ#3akqf=o?&OI3FCC*Co5 zFkHjI{4$9Fg9i@L-;6oC_hW{|4^Ge}&%BSv4ZOfWgT=4@e$1~;O}`3fkRQC;kk7pm za<+PRthC?#)X1)Uv7@jkzfDmaOYv^UI=pJAGfhq7u#)#9>w3I_p!;JbHyHR^CDVw{ zu0&>s1biebNSey)bb2Y7R?fG>KLon_LSn{anKwQk!#vz!&(0d&g&E+dy^12S{GIyY zRT8nK!MKimA0hJ&@tQ?`$hbJf#OI9+LiR4mqrnaF@BkES9D)3{Gs%bq!rKU6yaUAK z>|OAECL$>}BZ?4g)$o*fFM{s{jYDr9qGW>Xw$MuUb??)apC}uYL}9)?XVZvS<~v(2 zlj2t$JB423&apJ}Z7tJfLB{UDeh)GL*~dFjdIazx%{+AXg=E|G_g+q`<(YM*gkN7@ zG1?)jag3oF_4bCE(A(P{=p-r@ALa^Zf&BKGcu@t}g@R}G!V%K`<{Mo{{+_N(87}n1 z<{QN|zvh-Yeyr&7EOrfuN-QheVDDO0>4``Z11k73s8fvx8#O6C!+XhxU>|wjNOcrYI;=4g95jxK{JUVLnWg)%smJzSDU7-#AxhU!0Q2Qzo_flTl?9t`vUtz46g#loxJC0INUfAaVR%fLCVeW z-(v#-?jfrvnC(G@@oW<#?q;8s`w6sZ4ixgdvow=Uyt!?3<7Q@{Gk;e|-VkJ*mirO# z&EaOE?Z8O11sI8Q`$n=^Tt+AId!gTU!2s5;`mT_2_cD|p!-t#PAtv|rj0l>6gLCgi zbVy=+K0hg<+xW~u_m?UVXS$y^x%vGPMGW7g95~ZG%oKjVDg2bl&F3gZjQ^5!e*``n zBZuuA2uNahmdX99$^C)Jz1ieWmF}B?#r+RHGK?vSUuJUiyf6c;HQBXdP<&Hl;;&E^prgNJNoy;Su^kgpAX<5fiEv*fiLH? z1-`tb1wO$*0$*O*0-qE5APtAIy~L5%@B`|N!|D>OzBW8o=iT&|86Ql(hwk4FC$%=8 z#Z8|2UMP9u^^<&GoCirh0cSqnQhpT9qHMu4f5ILDUIU+mgEG{S?VdbkZjn68;7^jL zdg~?6ygn#-md)b^e!JvZPL+~p{%R!8{E@8T`X1BF5BckGX4>T0_lWWb&pe6pmppMP zgL}JP{@}NO7v&G0ZAQaEnT0qDd}+rJ_!q(xB=CFcyuk0J^8&xO&Wrk$4=5-azuks+ z4`sK}Bu~7)l4m+sNS@eJBv0(wl9$zOvEtUnybC?SUj<(13I0;>LQn7`zzaPkFZ2Y@ zCMxulyeJ3o%$kOS_~ZpX8x%<3U##;2pNfM7J{uHB;P=;gfj>a!1-@*bqD`@9zgBFZ2iRFCWPZd}-Gb`0)T#m;?q1OlATk%7l#*Brpf-yoQsN9TX@Ihjpl6 z^=n_2n-gCA77>YEfci$!ILR~p>m?8M^t~M*Pc?3p{!E__aO#^zKFMo1^V*<4(=U`f zbu5;AZ=6Zo6W~6aMc%>R1zzMG{3h^Bn=(6a7G*1WQ4ZkK;V;TT@}eBTuYtdYgK^1| ztg<{sT2u@q(sJv(NNbqRi?j#~5@p375bLr7cw!KaJTWelJTaz8o){LnS9b8FzFdks z$M^}PU{_ z)(vvXiX;=l7Px6EnpbQyDU+8>tfg4_trY{LC={6YT6}^?DNK_^3!&CZ zR|1(g5S0iYjsn`r&T7+6{@quD3?AxL+&iDzYmQt-%ujwmIvdB!nEHaaqEV7oq@n*^9 zB9p?WEu_WEmY%tY3_`8tYo3rXwS+)V<|@!fW~zl}yh*M(OD#m%YUHY;8F zy?~DXILvaqA1UHJgT(O&`9vI~P>hep<4k|*!!X`Q#Qg|omF{HlGjJ$Uczkp);!Oe` z??J?4b`;(p!Bf8w9HbH)ae~u-6y7y(8u2iL?6>=^BN?^%hb^2>Gbaqw59@SZW@ zWddX|gowxCs=~Vr3`G6)VFz%q`n?2ljFX6i^d0b2{i2Ea@mwan-oU$A#L$0;LF#J4 z8;s1U`sJ{Ma?I~SiKp^QyJH;u6;X~f4-EN4IzT=|R{3oYH^Ydx2#wL0-*Vt-@K>bp zk|AfrJAuebKh9byyemz3`+*m%J&!fvjYlQS1rF=uJOf^?!~={VH{5ZO=Sk_ucWjON zl>krWmyg;?zeoTX^UHlK`Ub({_q2_89Oo*$E(W}>0A|F?1m1H&@ERdx#LEQUoseUG zIo?$I&6fJ9{0>GyTo632^Jkny8OCp%Dg8L>r|>lBW7Ka30y@YzJW-CscchJYslXcr zf9mJLq40i@`l^2mr1{840t^ttnkz~$sjJM9s!Ax=SktEfoDGCFy7)o zr#GJhk{HH=?HZLB+NFtg{>R5#m_1B@7rIzThnb5v=L&C(cX4BYb`sg~& zv6#n*U9|SVAHTDsra#ef{Ve8PrPFh&N7(3YrNtyCYf`xVRMv>WUEhRtsjR%Hylqii zOW!u@?SW+mCDu=X)){-o;yVVg)ODSJVnqdPIxp1T22bSn^NR|cSrsAc$8w&jNE$_x ziZWM^9k?a)x)=KmcMhzM{JbdBTja}Gcf3XvJ2b_<^|T~G&nu#)x?&TY(=W8bL=|%( z7JiF$^!m>E_Q+8w@W?6M8D+_>bnl#K>Eg@U_?@>pa#qRYJyoM_*0VdpYj0Crw5YIr zcXec8-EO<3sLs9nDodAwO&br>hE*LYB*nUQdl(|l@{TCE;VnJ#SkY+Y;{VxEPlu!n|+ zv!P;B2mC%&a87ZJhJuh1%1{VATnoMRGW3VVBw>qhVP>BYCbv2;^%X`Ns?yDT9{QPX z2S{Q}32FS(FEOPj=^q7C*gWu=aoC@bQ_{GAYq%L5nr9*x%>EVKF6Nq3~}#vUAw zN%no!_A$a%AIf&$F?<3e;j(4#1CMJ%*_rM1&~Godyr2+1*@3vwOgJwLQ9#=wd{#Z$ zS0YOoGCONr@Ue%L$Lm&6IM^ZsifCvx%Rb*SDe}tlHsaL;QRF+TMgBvCy|`c0^s!d@ zKv&&@Y!B(xIYjJqZ<)lG41jFHRf!B;7s~H1cwKqf_^`r;>@i+fZgzZ9wPufCPmHYT zpNt@O_^uG{<1aRXz@8h$xJ)&@F1j5n_l%F9F=pYEn&mN{H2Xudyk99rBe2-E1U_lM z%na`r5q_*G5lW~->7(44@Gu^53d+T=5642feup(?9FHqHvz<4>@>i=a9g4e9NDI3y zpD>!~e{R?1h`5=!M(h%Kw`-4dLt5BnIRb2^v$5MYOY?cMkC>xXejJZnVHgq6jp3%B z=)TBMUUW~Aq4RL2-FB)hACASN@dPKGLW=S?n(&tx1Q=d!3O7FUFno?FeeUa~h~ev% z182IonB3n?oCJoSBB z@*2)xNo@LKx9^$k7evrHd zp2RkA9A}mt`8RQ9J{8Y=lBe#}L-EWr`A>0Xp2l{7KY-B(6agJV=x?4XPkf&Muu7AK=Mq2Wr`D9g=6BUX{Ft^GV4wUEYJJ1Jfm`vZAh57B+}!tNgM!I4?x% zi-SC6FOxiFNvgjUII=wmoLD`ac~EIF52_FB4!(n&m!MAMiIFII%Fd8H@fJv)c$Ot{ zeWO^~=Qn~G?T{_ZElWJ}&S_Lm4!WvHuMtAEW78nPUs- z)0_HQh$^dyRKXZOXaR^#k&RNpj8`Hb+>%=t^cSx&oXKAxRtrc$H_@T=)z?r1ERqVarBqOhWUJz5XBjnAg0dV2XrnTul96>AAlrK71c;rs zcBCYeG1^sC^2S!FKm#nCN-)*DW3?ag3PI|Fhuv`@m*LW-pdG+!*+1G z9M9cNcykSSP}PrDXu^9BVZ6U6Qu=K);VlMU352L0@9!$V>r8lk881YkHS4#=gvWQc zSO&yvXTW<=;wcE)f-;-oM7ng+CTJ|b87RC=iO1Wi((eoK@bxk>WW9HsbAv zQmQ_Twz*2k8S$P6Ua69(k~2*QNLrri-S-<97fyR zLBu!W(LG6l;jHk!fWHxs;~KVo;xRuAqki9@B8+&nRVfSv`}xlyXT)0wJXL;1+gz0i zF9DHy5=fH5t~BATFyI+&b65itpx;~o3|3$`D?FbTsyyw9akHdS05s$W8BVGwQ3;HWkc=wz1dk~E{4no9p;ZS%toA90o z-c<@r%F(&Ngja6B>mlW+$0oD`qkgULH`8q3p8OCF}#8W|o+1VP1 zGNfV9&uBa3eT&5Wl9b$aP(bNMf8uf7F~e2A!KecU4|D5Q!?Uv;4s{PX>pi$Xk#kad zyYG$qP})(WR>*3J;`dc?Z!oGKAdJ1a?O`)F%v?8f`ApBuDKp2+jGyV6>D(#4K`M+p z*ns$h=$+MZoU5j>hi-&(&e`vVNr78w``zc3FSmCdgL&~#%hu?m9qBO_wJXQo)^K7a z-c9!Mb@t9%t#Dl(74vx8^5~l7`-DkC#a|y)vtb`TyUO|YU9{;T&2epN*6pkAp!>-! zyTc=WW3pp?&TMQ3ozlG*;b@p{?2D&B`H03a8V_rxJd1SsMO=IhyT*fHJ!FIxA#gAR+iYWP*xInG z!=^x%5rsF4fJU%>;rJRhzFut)o0>FpYSIj!HG7~6LslO8#Unt&87thfBrN$+$ugZ9pLdvplvW z8UT>PH^^gGM~fA3oANb#@9crJ42kt-2u(|xnU*wz8Wii|t3%{ByA5~>SDmqsxWtR^ z*?#bX^jRXlcgx(IeOUd7wQQfEsJV#kS1LNav&}cqj*ruiwhs%(vPhUz<3yf|Tg1Q; zLB@!=i1r~c>pP?5QmkpQGuK;nE@|f2-HwbqlOio$vb;$%7v=Aaow2DB%lsCuKi6{8 z3u3)rJ4?>!@cQRf58aDo&bNoHSz`I&!(5?{xX5 z{cZ!B-)gKYT<}1D-@xhlA>P;-BlCf|Y2<<&FG6>=3E4S5dS@H!&hgH?HkQ2c4oX0Q z893)`+_}B1qG0Ft9e)`<4EFDwtf}KI@bAL#oTs3+wC})gR?Y6D89g8CuwdRLs)A_J z-I2knS3dHxk$Gb2F;6pM9{Lqn+h|~0|Bohn)VSkpd8WLfoyh#e3AoQt3L#X%#&-k6 z2Zm!Z*x-P|G{x#wz})^EOnx|;%FyfJQnBoWdj}4Zygw%3eyfP?8%*vW zP44duL-Hd1T~q}0F%GUdJl}+8w4Jg%!X&_7g?vY`cM4cR48KhB zoM+}Ylu2q%l&UCumzd*}14fP~)x0J#)c1E8tmcwCk>?MHtwzl~_a)B8vJKSp4jsw&om#CJk!}Nd8Q-ubbb?7DinU@5~6Xz1iGtC~hP`{ZX_!65` z&&}NBZw0qvT%0m5WyKl3>ls{LO;#q)TOMb6KsB0q$P#Sb{bU-!cfz^;oBU{R4+|m(Z5CB zg*JY}LVtWSk)P{KhMgfjSeYsKz|~u3C4)+_xaGo+`S?UFj7cINYyh`lh-TdM&>Wtc zjBus80uO4A5s<+ol#2dJ4<;16I*bV^7^RFKP8X6E92Kh4(Ay-wS-EunoE0mVwaALt zy0kg?3?(&Zaq`kLmDU+$Jn88xm!-`Ya!OsMYuMZJ>^8CtYCdVDo|T#I7JMSPMIjgq ziA$%HR;myUg=7p4SZkzY13WX5)0U-VB+tS2ochY7)0A(jEElwW-FBvTD*A)OoRs+{ zfBn&d{z}`HpCM(F?B8++Pjr!IMeWd;+YFMgprh@^4qg(51cKJ%mwdSH444b07yD|` zK8!caa+m8t;#bM-g&g@r8FnXb2qoa-a8MtHvCl6v;jMxn$I6Nn-qR+$z8D`IgAnnU z9ffzd36HZ>yq_picc&`DE&l-x9e)qtGe4-5KgiOu_PdpB#6y7i3 zjd(?9Ou_W~myDB$Giep@lzv7#N&~`-c>Ja)pKTN={oaR%QNJqSO@klxUW5YlZZ1(z28DSqaB5HW5l}$c#Nxv>5_1H1?ZQ6i%YdxD4ZU{xTTiq51_S;-Xc34Luk}de0;`t`)g; zh+xE<1UXclpA_CaDaW!P{Q+|GbyoaRj>jvAtl}`>Imj7Fh5Ze3#`*o1kvXOtCxw+< zN5ofoWf1Kx_3&UgUx`9CMY|Xg0;eAX#sSPmZ zFck`z$=Fb380KH?op%{rCl!Rp!L?LXC6?^cdi{1O=VuLYa zrXH`HW9Oe^C1HB}`Wz>x>0ZJY7_m9s!mz3OEAiZkOibe9b@i~l5eFiUM2N{*G`fCK z)2CtsGK(JHzA7`vv9eQ08YU(q=qu(6jjzd{G|hTL|JBx2)tEVV7Drq536p}<@am}P z(?Uv|I)<(pX7{rrAXn~0dRRRZevt3~UmXQ0k$-jW7b?;WR))>xmSUYXKZWopr>ug= z-6HLAR*TNS3c*?7wNYzMt}KZ?mgUTPVeoZ-nUwls6=G})-5Y_xjK@=7ufkS^DBreN zGK4b%SXdOH0B1^5r|U6Ta_|y68*Y<)h|jt@(qBB*#J~z?-NK?E%7u{rWg^pKt>xA& zO-=A)Aso?@Dv>p>&VF1!YI|JLHXI=Vm$pAxF+&5Yk0I@J}OnBN@$euisP{(_R_qWt!@1@iRT(EXm0<*@Ng$+kWV`vE_Vc_if5 zFl_x;g8)1C^@H3=*Yt}*%yI|pM`(_jo?|Ilj-?r4Cuq&X~@eQ-^x`?^6$mjUB}j6x1}$X<5M~sEGo@5yt&elDyqfXcBWX&!z!auK-di69}-ovd>qQGt8d0R1FC8IBHOTyQEQs8 zEDAYY-;Na%YDvwh^49!z()q96A*m-X+dszVA`ELBY3z+SLTskinZ_fbI}#C`I*az* z^f&a`iOpqz`insQafsL|Vf_!w2+bLQ=&)FK`IpUHm*QEye5$Lf*VQF^Lz=5|lI#3| zu1;w9)%&X5dYcjLdbleke!`fUQ%b7GK%Y>HZ^KjNQEcDckw0{s04-UURoJhj`dQg_ z_b)%_5gn$Ufqqe|rYsyYeRpU{HKK2g=ocRD5M>Qj*s9{ot93yoK0P|5q}u1nes=Yi z)lT2D%@@Uf*TMLc%l8~?V!N)^byQ~*kD(llZJ0Y{Mxdi(+f3s^NYPitoWf?Rbl5~c zWiawsjs57^lWnQhC9wrt^=xT}APKQ!f|F)5zxE&Hl_ z`^$D`SjiSW&&bbHo2~|*wXtW(mI)gs`1^qawu7FNQ}o6mn#H&_da*b6E%_bFw*YgS z=!wOBfwwuU!d7S8_O_rX`f+y z6U?q;Y}|%w7T#xL2kI^HS0F}6i|=9?-+bcuNe)zGqAmBXyuk8=#N+rnM9dINVVrDY zcGT#;u-PHPds$vJn<$^EGbuh4tu z1_$j#n>m1$MEnm;@zdriJz zlE2tgKis>6bPz{0O6v+!INu{vMEuRtT@OB5?gXIhOH@_8$IoXSW$$7HenSo;B<>GKMrKf{Sbp6L&eJoOqbd8#p9 z@=Rii#FlU?L!)Ll2!7bwLjh=V>|+48&)8 z^32cbq#-WT8v|5MnNK7W)vjK;X<8f^46X@uaWPi^Ks;R>pV}YJ@+Lq zb#{}NItxAJD0eXY)i=|wl04I&D|za?K=RaivE*6Kt0Yey*&h;z$>m9&dKF8aGA~G; zG8K~7aITj;b#IhBbw4P1>MqLRA}}CP4s47d(Ke_si1Sea9I11)9tipsxMxyYTcLU zH!!EiG!vyi^KzZ!soQMHGw<^x&pa-XJoB|i@*2(?Bv1c0B+vZ5BYBqDhm!A&^JkK0 zb`D9NbwoW>nNSba=ZLzKwo_4eR0gEsQ0o$~WhaXU99ONn6OY)QzaTy2_ab^EN{gjPel(Q^bQO?G`VxWks z-^&K+JoBu|R+O{sA9zx0*r>N!!!}y-Okb2OE;yF$wbGwy&XPRKLG&AtpS8Z)ZrCwOL>bqtzxkgo~0 zy4K5(Aruh|`UdN}Q60#ov-s1~)v`b1_X(R(0*W5q$?0>Jd6HA-Brg@##bDNH8umQt ztCzrjord%SC4*H$5MiULdJ|DF#t?%(^OMh3pFqho=%a*QuG;s8Ez;#5zUmSvEg;4rC1y zsx7u6q!JG>tGD=qCDDb1p=(rt;>tDTj-RX{P{E~|8CX<$dX|ABq|3yiUCxJM{T z!9&?U;HStcnG7)GF?1C)Sf161_g&ItfSKiZZ&ak@_$@W^i85df#ssUt_s2nf7{+_1 z%Y-){eox|1r0}@Mi4pGv@NywUJZ4AX?FDbt&khIgsfrX{4Lpo^cS4y_@FQM?45NNe z;V|OG!NGgGB8A8Cy%Dbpk;lW2cpTR-jCg;-VZ_UXgZFbq3U4($jChe43n@Hg-H$f| zyb*6R9QP_PDMu&A??$}Iz*`JI>Ic@3_Xor`;`I%|xCh~ilztN-WW;+JAZ!Q3!%)YM z7i+>x1l|}0CgtetX2Sapc&a}59L}^@eyhPi)Zb3;1fH?2D*aY~A)knY)cc&~_J>Qr zk2lSP$2~-ki5U8i!sB{hBVG~ko`(qY%ONPksNV%>j7I(V{<8*uMGCJoHLjhG+cuZVJ_-%QuB;p{Q1fJ55Q!NVb zBgh%?@_~0y#L$0~e(#y^=A+T6`gIxbHk;}<6CEbYL6O4SWUAjzFsid3Vt#wzQ2M2t z@a_TL2n8nP=v->Ta|169{=~Zwhr;7GZjAY@0UobQMM}T>AV)q?222Blw&!)FZEM8)u6MT4}V3}oySqM7oHXMjZ~a|R$rek1BS#8(F}B^_Z@}|9xSEL{LREjsf^y9 zd*eO>kKbX@jw%}#hOn*3Z$PL4_vzn^7nGt!Oz&Xh^OITIQ^-g z-nIq}H8d^ljBP7^n3O+r+p6K90HoU1P^6AkX_vz8*>hj_e4@PuX2 zQ!^J$$Y``#lJ@lO_0Tczhhg?Mh-Qeix2~=ZDkUPW2e==Ed9j}HV3<7;>r{6>Vc8bB zHnMcj{>3q)!=`Vtu8myKuS4kv2iLBRoc>qK{%*Mk9BU)9x>?uSi)(xTrSN@wSj;z} zzMB^Gj`XeU8ENa{%U-!ot`nV}WAoh8YQK=p^ktf8xH)L@ewe9GIeY11(y<3o8VM$8tjui_o8dNg#sr>%F)jcEK z(0_G-c>CeWPTlQM&o;q?y<+zhmePm!r!43fx_{<}ojyRu-zYr7bVOoU8K@^l9V26s zLduiY9Ljyzfow16(Lf7yROUz75+k%3$ZIOm7BCe7UzQkfh<4kk7 z*MV(5J7Lix?D+Jf(YnR^7(+dlm}0RxC`(3^OU&mm;G<}|30;X;V)bP#=oE%JLO~-* zA*OO5^Wnj+rG9m$H&_v;v%ZEoro^I0Z)yr2ow`Nzoh0(ID+1u)^3bO6a@MYhy%9^q zD_R*d#wW+j4;g<;%wS8Grk|3=cN|#M+^d1OHd!zTJO=Uv+-=V+WVdx~!Yzq&!d?w{X z#n=K@tAT9IOQVIaO{|D%7O=s3c!_i-;T#h1^u%X3X$+Jywie-Xa@HSCt3xyKyNyQT z{+~v&`FA4FeQmHB&64@yxFj0AX}aueF~op7(!%eGD`G!;kqo~Wd^AR9++&bbj3XL7 z@p9>A$wcGn=3$9HM7X~T8$3$B+%ZCz=_m^nwtkY4-^Eo0Kqq&7RlQ_PK#;9zw zaOux4(U`q{N4f`z@QW?~kofebzRH$+s|X*U+j3-@lu>qECadg`Mt|O4lpPmU?zh8H zAKKp3{ZZi<;;SMtOo1>n#C0b<#7;17u9LY_DxEoKrVY!!SM z2Jx9mt*0Al;2Ea!BIe)aeNFhw*D{38N*T&a9Yk7EhQmdL!z7hmp|9i_K2Y+EM+(4U zCO`s5VzQXjo_Rea&$w*C^rtLI?GI|qyC@$vD3B9}vL%EXCwe)w;^ZHfax7jp?`BRh z&q-gr3~R`ia{IJpY33>Svx?!LAX}E2ywtD?&F_zo<6!2$d9vI%Wn~WYM@qdV?WWcu znZx{%Zdsa^d{as~)?Z=b6|=8cG6Z%BKDV^WG(pLnomQHdXH|GXfP)sYSah@!Ul8*b zyBVGn#aL`FrUA`D#xiR~PK~colb9NW)e1Eua;rlA66S<>if1ub1gX{& z4Cpjs0!qzCss@Ig5An^k*6lqkQ7PkBVrQqN7vOJF|; zGD+J%DLuXaO^cT$c^1z>L3qT~e|A6IFN^)0qL0vl95HyPTSx*J^0EsLm@8pi)wfMS zT(g`CGsR*EUWEIY5pS*x!%2|BONN{g z@1y~bc~f}fOnCDV#&Limg*V287YY!iANy&A=Q81~LYV5uiK+0qn(!RJ>x6LTm$x5< z*M!U(^P7ns%No5eLa<(2w<}@XYJah;JOhD*eps z&x#Cq9SnHX7ZCpIgY)CT^kd$P`jrDuwHJx57&|;qg5}rm09_FE!zvFyPT1q43Uyaz_0w zZ$&@u6V5n^Dk1b&s{Hr_pzyu~Z^Ro9JUJ{9F)2s-I}RhB-GHabFyg<1_(nW_TMD9n zQh4W@%4II(I?moyF^U(>)#leqta-j?(eg+OB z-aWvh{X>yT_ZD~<@kSZ&ddV>2)!;DV)wH7Dt0ug;20V^ynHKSO;4tF72fRV>Q>64O zg@;kUI}Ld32Nm8<#5dwaqJDy1m)js`#47=w>UaAY@HUw69KhrAlp>`c%hiZiWxyK% zVWr_149o3FFtmtj19kou{h?-a1~pbW_hf8(6ve(1+A zbqy=I_aFyIKM6dU2A?meAN%P6L;h#`^9}KT3hc~tj^F33nu z&*)kFUIrOs)t1BkM?*YSe?0Tx{e+~Kq0aMHwJ%hEK>MOxu=d5eR@h)I`TQ}E3e(_c zY+uxmr1Vg7SHaKNzKEycU^xAo+t={_*_`(OllGF773ugu@#6oeWmznI@6g<~u7;l? zRd+n|P<8tMwYGHybUT~2C7!=lq%7_~um7^7MFY-kFBvxEtnDR}JJsS$Umfcie|f26v=nMPvSdNmd^A;mhT$d>%INJFd@@$8@k> zd`Di*Z+QilP0{CG&*Fmeqcmx42E#1DDvR zc01PdAD3dCX;%9o40zyTdm1+X-0dx@%6hv#q_$)tn_L>Sbl^(w3xGjRaJLbpax4F%inLg&&Cg-LO zA$wvidBx|6732?gJGRxiD7m=$8q@{WE=M$mSTdd)TWuGsr$a39NGlY^3ansm#I$$R zLm^?>f+~pn{T_-6Em~id?Yd|YK3)jbu!LIwNaaIQL-;vEt_$A9Reld;SQmLqSCzY{ zzrMEG=Ug30JB-2hqp|?|&AlP^2eJD^zAD4_WT!oC@62`z+h6J(Rb6Hj zi*@9yth*wx6qm{&XR)W?Ywt^SBdG2y3)Jl$R5>U)be(m$Cnm&pn-{9EG>7-dykkuE zm}5R?*3eGb*sOQrbH&x2c2{>8)oz`Id%;t^cp zDW8J0_l7SVb0B~jzVM8K$-S&j@XH8?yk1jxmp;h#Ebw~w`0XS@>f}7hBYm8 zdc$S;Jv8Gtd5FS(h%ebGgWo+tQRXLBdz{1gRu+)CN zR#LU++a}gw26h---DKI3-junW?pvF_Xl z5an)b%6w%tj#W6|_wwSV%u2|;yr{|YN)^Hzaqz~GiK7iWXvwp)CU_MNLGZ7_5lwQt z-DA$PoHyq8c##3hj5gd5TiV7919r%^Tqi1x5qho=ZZI|od5)@@$p%}|SJKJnx)8BS z!5H4D*#XYhBD|}3XOTh+afHB@WF(tKGddC99Nya$-p6tR^*|biBN{O}vED#EanM%w zz6|FWG};njsgUJGB<}zDk#s*Q+~@jjU2ux$hboCj6G$}vBpic9_-Yxh+}#cJ!O|OI za?h3W+YlBFTVfkixO%2gcE8ioK7&z4!-V z$*WexXFK)ooZ^`V`O9%;9P)i}W*o&cZN)PU@*2)en>;b;R{n94Cl2db#id*E%olm; z$T5)ePcZPDf1p3}ohW(ckGj(TBAmxdo@Fpe@+_Oll4m-k0Gpv4dz}M+wPuiWYyq}P zdVr9OutN$5e$<*%)|0Z=i8AC%jvzY@wf0JsAqxl84~Mc(UM6{Bq)DC_>m^T&O_C=D zDIi^$mPog=9^M}(wO6P|^2A>)dCHR1+C!ngG>r=!76wS@FT0VxaC1EuiDPE9w(DBS zGal!m=+Ahh0DOtV;#T(0>5^yqYT1zCg?453NuD8 zTPAjk3wX)+fO1xe5^6C|wJbQW0s%_VD6xK%L~;7MN^FV~}Sy-SdG$UM`umHvPjdTig;S1V}L$PZiVM2|B4)glEPcAN?|Iuh=)^4|MV4UD?CX!uU;a~!Aff0 zoSU!(W-6-}QCrDL^1K#eLBDaP6mBUmDzIg+|NB;IAw{!H@|MH{V2TICOnR8g6;eVk!*Z#3ZzhMVJCMG7z1gjZw0GukY#GvQ5wn`1Ub3U8_j?>*pgjKy-M zywY!w32!dk+Z33Tqmz68GfpBMAO{T53Xj7lh4%?~V>_U2gyo<}>GvT#jCkB5G!A~$ zkL^L>JqO;1$F*7a!B3IG+YS#SUaA3)!zP8tKE{am4Di&riC40z3eXS7*nA>4?!5RrmiM_$Mo@lF6wT}PS>W4Ygm z!-&TD$MqsAPxRjpyhNFX(dL$hcgU8^k00um z6W3>Y&p&?PaCd@O7;t8rTZfC8vMRskJu@+PX>WT&9VU##8`=J;Dfq|aS#Ef19l8*{ zs;vUxFQvts?ZW%mXZv2gb=pA3Z=Y1;XFt97duxv?Zh{;zvy%`%dn&oH{Nb0KvSaab zcyxA1Ke2)1*LN3Bj(g|o8~$-g>XJjZF3BiZ?VYvd+mDuh@^Y8^ule*?V24D#AK znZnHV8+o|Rcx|2XZ09SX&O)e*Unu(>uV;wY)-})8O^I|DA{Y2Yyq=*~ zM~?M4y*8AJOG(8FsU8NYXs>6O*A|y&yHLsW6f(UGG7hgN!E5WCXX~S6E)p^q8)V|V zp5b0w-#lACCDUKX3^2&_@OnmgZSFiaLKNo=x)fTXS4{$esI$)>z;!%wOKrlu?jdati>93bc}&OAEGo za@TL1`;s&BdQE%5UB74J+yl<4(VF(E`_P!Gx3#J_-KBr8-J4NY_2FHqb+Xk2>p*YTBpn`T{L?vwP8dg^vInas^KK438gCQ1+7B_t}X36}vJj%ie!t za;3ArQrmXUR%dBt8KQsdtiMLn-g8%dy>V`xv$0OozH>Jo(i*>YdtHvwgu`EC9Bmx* zy8EcpeN>xuwEj~qcj(5s1x|N?rVV$yE48w}x=;QvYez+CMrqNrUpY#hWu;neMg7x= z-lMjr^ci?p)4QrvE3B=0a^u`joJHF-t-;+09D%A`;&zYJ+@svsjIi*}BMPAY$ScZ3 z5)+5lzpIr!v~g~wGxuRld&!MFmpupQ3ntc7yo~(3nVehctg6%wSJuDfUii-84@4<_ zl$Dv!{sE1}B1%d7*p0HTdeyzp z6YZk#JhPOFevJXt;QZz6}Uy^z?PL$53L@P1_Rp3K^7 zi+s*1pH_OXas9@*Z#y$5Y1*A`_nwV&-*r~))v7*qXroZ94)+1A^vQ;XEf{7Ts2_G$ z>H#Nw3J+wCc9bDrr8DzxEpwMco8g{()X`X}eeUW}_-I8zX+iFDue%GJWd&MoLE=je z=vfPO&|*-RLYlm%AGjLk$3>956-#&xTjMC6~N`-bJqK`5&I|4 zc2q%uI%noRTIODdHr}0xjMpKJxDiKd-!84I`s#_v;yS3P%l*zV`KXrW>QeES!(r-Dm{qFit z9cW+sT*LNx&M$nVmc_2}KH{UqM;wz`FtH=_QbAJ}rK0EkZD%en)f?RYiz64QC{`<%Hxt-|L<4SeCueN@Xm=+Gv(6R&n89@WOW z;wzpX>*OFvdW#Dm7=fmHN{Gob<4iyKqgYL%BS}u|+aI(jH0D?o0dpZ{WSzG|+ zY-_v#UeX?M=Z@4ekzZ($ujSqW!7e%X*Ro})>k#R_<*rK5WZ#V|@Ll&**N}$yr+T^{ zK7evPd~J~|SEhT!kcXr0!(SIZin{-toe0`{ZGm>g-8ej;B#yg!$Q02+#Fby+)7~_v zc-(b6Ax?6N%hb!66MryeqFq`!sY4s1d(_FEIn+~(Jean7UPZ4Dwm}1VI zB7^AJL~;!>xw1Vh`>MCJs^{EE=*?bi;H43m+{eu~iQEJ3u`aFQJy8ZuIW9gsz|<_Zf$F$XyRC z(YZAqaTIOWN_XVs{Ls{N%9n`-jpoD_n|a8gCAfJHs&f|AY3^qnjip-Y6BVVWN{cG5 zC=+e9p`xtB0qy*ExyC~R?#Tv9q5mm$*5d}(Q2(?8mE_Mr<3UP&?&?;$y_SONHi28- zHV5vg{uYZ4PzZJ|-CkIDsvx(Rb>4b5&>xp>&&feHAn0=ziEM0jpb7aKc;k0EqN{Yf z$O*3Z)8^!Hk&}JzYp2giCz%s8aB;(HB_~O)*wQCOPM+eB<8(RcDs%EU8*uA6DSb+0 z<1crmo-P~MzPNO|$jN&zB%UrOX|9f?Pl-Bti&d--LxR=GR99T-6Cx*DzH*!{Cu3b* zN*@<>f+3tgC(Q$>s#5o&(u&d|bRc>Tz`A8OgE3mA`*WA;aAiYf*~eFuiEFgBvaG=^ zyFFYB2i&s`)b6c9zSJP*V|NjHsZuAJYtaEjKkx8?!bkjLJX`^vxXU0QZcb$s=yv!( z&b^sH5Pc%LsgDfmQJ@p9$8AMWKolL6-EYv40_Pt-P_e5Ftt7aH8Pu@h+M?DpM4tx@ z{kQ9u8g>;LqT2|rVUp{DMbr>U1lMrlfzhE*Fjx`d&T%hBY+8e_)|ZL#is-%yYpPI+ z>sgAKIa=m62y|{JEiBA^jN=?M+rwLnHoFf*eYCs`{X?Y_x2s~$MMVYfovwt6g2M&5 zxS5IDK~6!Qr*G~fZVrFyoEVS3v~H)Te^~)~`yR6jaf8+}9hk#-#1eeBGArTgTTQ^w|7SW&j!eefM|zu3w#2nwsV zAQz={$ce73`KFFe^C<2u&WyUl&3E;jx+3&`NTAYr4EO5-H;Ul6EBchrP!0|Gx%Z*T zIRctQ#r}Ha;fNDM5dWh|6}tJOxSzyLtUO#nsi&)*b35h#n&Y_}5-Sq%J;5>$bOP#y1 z&OL$+>kSSmF#xYPc`VyK(B&HOFzP;^9fBCB9Lsj#_RMkOQD@m-wW_xqkZpJ)htnWA zbyeyKrIdqAZH@cb2OH-$IqUzfrT*$Tb`*ox4y8K|m*$ifVb~z9`-;-4Qw}XdU8RS# z)JGk;f7U8qEPNQ(Ke`&xSQ-k7UUFzZxvOqvji%OV$9{33*pIuqaafRJyie!;?9gs= z7a?7gQG=Gc%~7;NJNza3=+YvLkwl`krDeeqJ?`pW`?tc)NEd~mkJJl_esXB5-TuKr z>dTI@SG0zAMWV>89E$`^bgZkhOc%H6)1_Pcx=2(Fgpt``i5|z5uV)th-|5mF=!!Y~ zg~;z2(mn3#baweY?&>O&R?pdoD|0_~Xg|A)P$8wx)Kcx(DF@n7lB>(%uNywiIZ%&w zCWl02zdE$F=K963PbU2;`>85Cp%&B!%k@;(`5ejQ*12r9Ig4m%;!G*d`>0i z%Fqf>zv9ZN#e=iE@moz^JU?m29>sMSSNpaoXO&_@0f)ASw4y!CLshL-wcXwDLFqO$ z6xBVSD&?sAuzGU-SgZdlfX+L06dhCZbCaIj&xRrQpWTHI)E1y2VU#Hw64Uz0kk$@# z7p~GB4ZIle7$+|1!y>s;hU8vxSG;hz5@}(GX~N>?bs2Aw!}Sm zv7_;8TmvzOzZUJ|OJ1jVt}d)hz0Kk8?90$GE_Tmtax{Lg9sa8DQDg}{zUY)24mB1! zayOx0i!1zd12c=RUQ7(s{&WnP{kxbLKzD@RP4ocAa1q|@p1agh{{hm~8Zb?S{Gxuv z_@(rd)U}RAwCwh>F9FTOCDDX{C=>uqxCjwN~W!6%HFv!v3dh zW4cpa=QX@9(%pYcrao>uO}ZBx{$6AmPsbw575*%D=JP4C>>nVAEWaWq$W{kWI?2^h zW*Ot9GiKQ(v+Te1$SjL-ugG<|9N8LkUE!`rA9ui+dO$n2R@CxRN9wH_zAloHUW@x) zRR%|kxFr?Vm923!-x$9YH6v;n_Z69I3{L_oI?2_w@F7%mcIJZ|#82hT*~v zcj;rbtY7uaP$8x+#b^OtX6la{=dN@DPP^Tmx>l=NiOVh~t$w9D z<5rPeI{Q13J0zF;A_qZbFKODtoNP`l0B&3%CeF}Ya9a>Vw^Lg&pecOt6#dW|#8rdF z^^lrQ`^la90drTsQqw+kV`R{H0MF*#8a@!Wa&=3s{rK3g&7Fhxw3{QrQWPehYem7K zzY`Bz8MReA;C+7ScF}d=3Kn;GTt?_0esf~XQS7-;JJsBHa1TsfqcyHXqCI3Dn~M}h z?jLvaM)9_WBK;i05&e!;!(kBakqrg8e}nfWwQo1DNL8b+sAJZ?abgmCpQn#@z>VpU zDz<=84WA-+cV||}sWJ}Td&Nf(mOr<4nDj8l8Rlml{-DXYObj*s99HA zP;g29jk{fa3ODa|T?E%P`AZ86i(MC&78Kl=-@n+^_oe=Ym@Ud)>MeROXI*iPWoOYs zv`!ek0=KfV;9c#QX_3B=iTMQ~S;Ir^ZN|Y4dj6FZqWyhMQHRZoZKGX!{6D=fuo{ zb!a*H&I0SGpYY|kQQ4akLh_1MWxiR3?V@1cfI%;UJ1E)j5u7j9dzl5JX!JIpuMds(FLZY#W_gm)X?RPSYW;eD>~K1X=B^CfvN za|rMD!aG`cJ9X2dv^n}qIhY-h_CG~Kt=8EgY0x|5hCLW7ZHw3yvX|=`z-N0%-xP1nlN-Mo0o z(q*a3)6!Sma_h=ft26#hZ~_vOutX*}@tFiuVM0uc$uUJH%5+;zZp_%rF27>jmE$K& zylT?b*Zg7fl&OE5cJ1`*X3U(`y6*1yfrADQ89FRsco0~BShLiB#Hl2#U~D+}YBS&W zNx*Rlj>$MSJMVhp^+Uf*^Yo6~^rwUW9KZ9zd*j=F@<_i6Z@%PE!}h_qeSPASJ7$f$ z{kQveM*gdDc7Ddgp%d@R-&2qQy%nr}~e!{*}U!|3=d$vc(oKvoubB6w_YcI#< zl)hc2SAO#C^^f#UelGRim!pgRm@sj(-S=f!(c)g8oG5Ha`u5_o&)Y7I$DVNOkBrEA zV!3F zaxIK}=|#r31?i8!ocbpTyD*~Hgpl#B6WE$2&>ir{U< zE?Rs~lBD6V;?2T&((M!P*z{tMpKJkdcoNSXZhSM5;eGsZ$=IOZ4ucQhm&%uJzRSaJ zoOLt2?8ER=(#?{H#+#N>JrRrHeE*Q7$8Tr(LU+owI1UT<>LIPg#lU^%7E1YC_(kK* zuJ>j5E5hB?a{vEf?``0tD$cg?bF%p&te8Mt5JJ0w2vGrd^BqOIn`A=*34{24d9Q2E z%;xOL26+1P_v`z-|MyPLo_l8Qx#phlIdjg;$n@birQC#l9yG9aaQLWQJy?8#Xfl88QdgkPg$0D$}oMVNuKHBmOL@I zW}Gq%bC%?txRX@b5OI{%Tf~tC7{oBtx*dk0%XK>pL;oUvKq6lJSP~@Ssy!vYJJP)lBX_&R_j|POJ3p7o?)g+d+H_P3w!FjLfSL@Z%W>Y z`=gSlE~D%t0?T0d?R=<32!ZeUDpuFj*H&-{Hq7_?AtluklMu@r2Ia*$CZV@ivj`2{ zJx+bRKPZUR8>_foo7xI(c!{A)6|gR+X4MMpST+dPxN7B6jI)M`^m#oP%NGWrn0Q!t zvPvX+L!&m-MXUs|F4q{U=Ag$~q}{ORn}iUvsucP}lEzhtS8ZSwNMn6fbM4Ai4Hb9R ztXj#_NzR*_YZ|%l-7x7js8Wzv(8`TL8SKBf;=)K~sbPRjXO|3LEToV%iA1h7R1fA> zh%Hjo%95q4n^RK|bpr!g?ZzUK^QG2>k_ol+;)r|Kv9D6J8VzKJ$wGCPqK$(Px(Y#Q z@~&=d4@uv^ML%Xa87~WF+0=p?#9J519)mrA*ElDbfX`V((fk*J#2+ z_Z`67Z^5fJVVLpuS@71I@Hi?B$Hny9WWi%Pg-X9x3!dME$1#h-dkwrfzUyITAEJnI zq~~y%<+j1h{$G)jdj=NdJ<{QUBx5}W%K`f%x-lNt0L+Zn4LgVih;pQ>AVl6n1L!3P z(LeE+FLa|>x8VH_b{u0WQh1-i!i@Jj;MK#9c#OBgtFWZ=%~(UrI-^M8Ew-d{!4*ay zPdxVL3hz1#UN!KThKdwkh6S$@cu5c<9{YTScia-+_kqWBP^9py5${GB-xLWj28nT%T@N`vD=MNJ zX_mxOZCSrl)9@c4>g2=~C*>5x+pydVdqoOQtxHsL{=~sDMp-3SA$jI0sULFH1}lCk z$LoIl@UCduB*htb9)2)ooo0pmc}2^=JFI_g{$f`W&)29+uQ!DpM^A21*h6!FSG z__VVx7JlKgoo@s%TMPxRU0lBAvtYrRk30LuLC{YrL&S%zaj2fcO8>C4&lxOo*~h^m z5$|{QB?pVV^+B-6ug`Y&xs(Vr{Ph`&``*xCs*0^UD5|5Kr@3Ug5NK`!HUgm1T14Giqx z4mBc??NDL=LBZSOH-vXq#bxf+H`t)c{$62wUpOr8v+YQX+uyo(zjF_bdu#{77jeTUG3a@JUsp5sCd?Au&Cs z;4H9r0DD~(P#*+p`^&rL`(MW^TaVwhBQdsRofBac+e#BhcfRP_pD6t8Kim0Y*8Vty zf4%fY&w&WRUmw#kFfe6oSY*297=6hi9iEa8uI=@Apz5?G#yLLL{jH8J9f`Gk`+-Qj zt6`-mUpxX92Ur#NU*@mcIlrYnw*TcGf2`e6>5p|3P`qnfr$lPnbdFPDF6vq$fV?0S9kczsXwfynN&n(Ho*G+np_&V{6AHh`QU|dm{YR#JA%<7FFs_k;hM9muNyq9AUVFJ7E1NxZOdS zYzVWDRPjheDI1SMx%GB0{6?W_Kl9F+(xb8VNCS&;b-Z)#Km=W``VYgB0W7;JtZHCj zdZa45z;(PA-q}})a*Kl3*|%K$7Kq<*;x}3RI>j#w=hjZaE)>5d;@2a7v&63pzXrOw zjJ9}8<+B5E$v!xHb!YFizTV`Smmm&^eK@zqVomdR>^!)oJrPai!)FZ<`*h(h_o(Xc z=sswVShRgn>!PMbRg2~?^7^aV-TtQbM1O00oPT?}$g9Yc5vL>0aZ|7ICq6YG+Ybi8 zmB;+O`=H}Gy}zULXe^QlqWIlBKCFEAN6G{9jfq))>xXbN*ux+A58g2@49&>&2$hbE zooG8+wG-h-Y&nVXZHZ&r6WbC;x5uGiw!5)-s@==R_N#iKzBT7S_$eC-W`t-{fWLoq zf$n%wG!@)94Q{(_j$@*+K#>z>Y=hSAc3h1nVqAY5ZD#A;iRE9_B5hiCqT}z7jYWHf z$?n;MjmKc355uAFD(z+DQB?3|aby+ym}lK5MxKm7!-1YF%66rW-fTX$3rai?p3N#5 zp`u&|%xHo1a*_=@Ptz4j@IwXb7$=u{#c-183IfhY&h;r#op!*wH3M0r$?Tn&d_CZyIb_Xk*^HEk5E(u zkohr;_K{us$zb8~tIh?<{qTb~3^}Bj85CtMNG|g~?IYhq3=lXG1A&)c#efFG{UQ2w zoNENRFf>JB=fVah-#H7(pjbIKFWBkcy>pj)Q>W^}RGmX#gg$`r1pxb`@sa2Q>J+)wMn8{ghx%LxL`U|Tj*je5Ulz(OI;&4L$Bp`-KD5d( zVZS((IDAJax~sMNrgKsmlP>G@y0}G&4Pjf$?O{MhYsc>a9EZa?k5VbHF<_|_*u{G1 zQ7Q%Y2@O?Ku;t@*f1=0l+{ur990gh;`(G+~zlL29MTaUn+e1g4hK{?#x)RZk9y-eQ ztNgIu6(>w=)6m&=>A*g8RCKoEP0enoYJ#+E2rI>K0cBLw5;5$G8ou zksC{JI8urAxpB*atJY4B35-`BN(o~Hf}`l&xCNjtwpSGLV#mTegLW)b`M|g#E*rv@ zkKKBcfIxLaIzH~;R*?R&JN9XtpACz2q8adt1|eK~Z2W4YO^7hc#q3B&Zba!ZQvA zH`=JW`Gr+&iScYp$FzIds-kI)Yj0w!>fV}T=ooJ3h(e`GItrC4=_pjHq@z%=q@$dp zAe3x&c4%68SA@T*d|^Zt3e@*G%Cq%X(f!(R)hPGR7v{l6*)7ar-A#_)0&iS@BFv}= zk>My?ey?LE1L^jnrH(WgFZ8$ek$rpDvMdGGxXWh@xNQhSe%QxlW{s;Ia|vo(D;rPb zlH*P-XW7J*WeNOn1#*)nCCK|kBduVk#)#^ywB*2Mq1Lek%K(u%AV7FxBw?SRY|3K> z?2&c&m}KkY$myJ8$tlOiy>X0v1U_pCKWRHB`oqJYy>iU;#<8sTj(J4AKxt&_y=;8& z_(C&ALuHl!rqv#DeGMroVx7aG7BFuu{trjNKVG z4AmJsF;qvEBy!)`B{;neX-?hy$I>}c^hpgd<&n0n%R0r`ZWxJ2YwJILyeoYDQPjqT zWBZQ9zHzKTI>wx&b3=^dL)25|3{3dlGG*eKRlmcF?Gw2p4;>hn?qHW ztvV}n%X7iwJ!K#2-tzpQY(|xM;+ULfmAI(IsyXGIcfZozDmc=@ZtzUL}FLa$oB05ro1LeS%tUHH>}bp*HtZVGQ|8+?1MyM z4);^$=tQlq3ix953$y(wFtCg3xc2R2>&nJ_4Sr1WiGQB>5m~gf_-(q5#|pt{Q+~D_-@VdX#~chM|Eu>l7;!gqRroG z@q4rQ%@e;f#c#9tEfc>*;&+<(O~Y^7lPwz}Zt4nK_3I<{=*}yTU$h^3QMgiszgoG0PKAMv8~l zx5N8wU19$D>%8r5JO?TFlac4xaM_Uw38=>+0pjs19$u{NQmA$a{V#NOtd4ANDxAM4 zvCh4&YDpq`;@I}M&PfvuNR(TIu_wmyiLI+@@1kv2-}87@djIInGhJ8WqeMKG;)rGM zk;v&IitUi|dzTd8XTtKX`Dh)&kkyXYL|eKgAJd{u+@|GvOgwcaPlTTSCdbb{U(~cA z?9Oti(Vf`u7IpK!nDT|^iqVSun_9N^-1*>^cI;_xAKzK1?TPBIa{Nvk$t4JQV2IX^ z*!G02|G1^ywdFRycej7SLcjh-@-$r;FTd zQe)>MyCO8Co#?kV#5gi-OYpS7ouAdN(fl-*CDrkPzN$B&NX!th=Yek{PcXIu3^SWJ zbZUs9q3*H`o%KYMax2)HJ`xdQ18w5 zqJWhT^M0{#Ll|Nr1I6~Tk1D^m)Nxct+1`mq{e(k!h6~f4dfs&?2j`cL+%;iR`Toy$ z=oJ%o?eJE#r1lUw_2Y$lM?butrYrfsFA-p(x;e3&|%-Oau zt-N0wdC!!~M%)tZxb<_Cz55~@{doKj8@UnMg`e}swdG(c-0_Gup%aNCKB30F%Porn zzJG;r%M)_i#xz%qaY);wgel|V%g5Q6?qV|WWW?#nb5W6z8mds@x;VePUAJEX0K@h4 zCFj`Z43?SmmKBC&9tR|jKzIi+IW{irXqwhFy6rmyTej@@?xjegqb}{))@+QR7rE=a z`{?uoW1x7@RBXH$3U=Ip!P z=&csYcF*sxLe;=XoL^J+7TiTMFM0C>%MQu$>HVZ>8MgFxYal zdOY<+_=VL~I)Zzpm*atMH)c36#*GPUK!00(XdfR~QSm!_lZyBhcq9@z)7?6Kj^E}DqD~SEtPm)-l0#l zUxoc?w(YINI{R%M-W|OOSO0Wp)hj>!+&=2as6C?^BHpuW8%CY^$aSW%^2}N9nKPA* zcRSY)-0`G-m z^*8rRpU1BMsPV7ZB&X-p@z|bUI(vQ@(eqMePp`M9r}Cxa&b=ahEPQSGhPx4KL>4-` ztNMQaL7ls&c4_53u?Hd=pKxvaX3vhFp4+=C7CUR~O1v+!1qyPD*HQ$IZN4Mom?vh8H(<5?v6P|k-$&PfX{95cD+d3~+z;q>U+s#Sm#-ly{ zsx2EU3wl^T`A!4+ zleLA9C+7O!s_mGRfIf1{<>ShqwYASTCM8YHz@{iX)rzh<5nXj0I`s241}GM2Q~bT_ zKiTDOPlP-g4`^m?SVZWw@VVrUz%s$Q@vnTrTvHG5vl4qQce^b9N2IUPM zJyvj_)%M4h_ebp7zHWYYQ(!YEt}BccWp<9KQg(i z75z0v0!RYKt)fl7YT}vY2d~|MyzQEg);jE@?fMa?ZL)JG1 zK@6jXG5zAX*<=zd!a0F8A|+d$RRaTSdmYJ|qh3c3Qy#6qDxM4@#E=tD!x?1C#ZU`!TonIW1s9C-Nf4!?K)473ilqUTMH%x6XPOhKk0N22j53`iSn)7^`5$ zBSPyQjcI`h&GC@lKYChVZX*B90Vc2xADdpsG)4ZY0X(Pz$9R2meS~AN28Hua(;7&| z_{JU?`DarML)8zAEwDvkQ+pNOh7@}7P)Xeo3hwwVj%h-9f8f$XJjug&mjl~bW5V*Y zF>x`fplSBkw)%JMy&KbK=zPC(|L%<(nWSi&e=r7}Z{`mo(4lRbp%K^~exI#nP0x0G z2GYIxhv6GWY)aO4>Df3a#6GSqUtc)CG+(H&aF8GHhUeoIS=e8&^rsXIcvMC5*dGt4#TwBn^WLk z2=~$g-M$E=bk5oXQK%I*ICdu<-gNE58zK%wZoYgRLPS_=^?aK)p$l=x1eO~X#oP+Po>3+sm`V&_pqRH|bh?+;9z5BIjjf!3*Sx3Ex^K zIq#97k61Uq4xL{M2QFxU?U8+=2^Q`5fe6<|CrS{D>-gA0Z-E#FZIr{H>$LrDW}hgH zVs_^6B_p41>rFT;&jCUWet2A1zFT`Xaev%)v2M+=6t6$8A8~4ghJlFVwHUv5kL_^` zv6696i(!dT`LYpe?(Ls15ON8l;>mKcuug-gp; zyo5Y6p|9bRp8x3aqd}Y!9k~#F&gMP8ZQGZyrS*+|(QvsxmZADS6V``>H7Bc~j6LF} z@dr@HkE*&9$TMq3!EDqgJft#8^o?Y?DXLCiBHp@-#~HhL0>L!8a4r8~cwmNmLrnQ^ z@a`v^uR`vvLXi}2q8`V`5qSNMLMx0v)M;evA&hueCZNR_eZ$~vIUavdccP@rE# z+lFG|Sc_>LV{QNF zkAsn@X8W1FJzit1 zjl zL(%|GE79dUIjBIIq3)^#IBkq8<@sHvyvB2{e@y%6t(};*Rhe`LJ~faNx5&kZM_^|B z&ajzwc){?H3f!}Oad%*`KqA=xl}gx6E9Loc`t(^#0Y4!w|Nm@@Ic%5&%ik72qA z@2N@-y-;G9?!ZS33lF`p&@erW`Tl}KFBBLil#ss4LoZYsrr%&fe)*vnmJ5^Pha%nB z!n0_!O-^WAlF&AJV%w65_NYz9Cl;od2D72cL9oO>*OZ~#R`nW>>(IAt@2g_Pu<;r} zwATqEdj|%P1*mAoJKM{Y(4k&Cs+p#pw4b)0V>g0KnTnZ4yYOO2PaQ3!+xoT6etgYi zNBfD6*Nawkwl@3D^32#^@ytsH#qnj2ot?B0eEgDN!N=``g7}bVP;l(XV8O95gMye= z7!=$bEgU*UD`Y5tQxu!`Qmq61azr34T17J8aWq)I{AV_biuknc?b*`0q+dHYFp#hr z^0HA=9uA^Ew!hb#%(RLUCEl?(%sw{Y9U2>fC=Z5-g~zcY!U$sB{B^o=7IDS)qO>W!UwWakvLrG~d9*7*?QAOErNtpYd z@F9AK@|e?(KCu>fFk9?jPACE>qHo}q&wkGc8^HJiOTk&i>``~@4m;X8aP&vUpbhN| zR--o|9+(rz)h49k#KNQjz6r}t$xg{k&q_;Ab!DXHWw}!G@-py~?#s-~%*)Km%JSv8 z^U`zjQ`0lEGThm&d~ZsAN~$j>*Oir)<@I^<^1Rt8x!#Oidd^8r$xX|1yRvh9uKd)D zybP}|)1B(d$1V?lhk-$D5O#>dnf|a;N4ah}^XNELTQG zUJ9UG`I)(?S>7zS*O%(fPD{ylXQsJQ^YhcP(=u{g-mKI-{P|qzK3{rfZbp83etL#0 zBR?lSFD)lGBR4M<=&mf6+nesoPRq&3%*=6Rrn@pzQd7OIoZQSDZ*EpTB9ob|R2LFBCEb^i2CXwPa=mGpDLJ`mX|PLmyHfJA za?-rnd8s-1UZiTaJ2fi)~SdR8jp%6UIo%8mp`Z}!Wsav_?T4!LjyVwXY%sq=El|6UUSW| zy5{9;mdwD~v}Vpurpi|w6$JMBVglDip z12~)ZMT>c|#XQwwzS?5G#$x7b#6hwR(Jyn*5u8oC&SL(O#q6_~XIsp3E#^{-xm;Tv zXISx@{4niii~C}W+3Nlk&B2fIK~XyWbJfit*|a5t25>ff;U3Np{XtC0u%IvA>0T?` z)Q@cl-mS_>+-+hN=b)8MoY-bI-#%ynXVdPqnD5e#N&RmV`fs$jw`reTYFOQmTUgK+ z|HQM(V<2xLo3_PdqWssjFUa&x65%~yao=GvTiqYBxbL=@zhyD+wU|3C=Ep4NCoJag zS$d9t%AC>xk1G1y>bj^HGME~EE@%;sO zeCw-?li}SZ%vWmbEO-w^7`|CDM&p!|9Txp}S@b((iT@vDcs~{CcZF6W&Cd%ww`rw^ zk)C%;{a+OB+1fTsd>2UbXyJanc39>wj3Pf4%kYzhyH`8TNQ0>MXzY5hR=OMJJncrQ zKVe2=)%!it%${a6PUt*r3I7^P{yd9#k!o>`#;KNZvcK^NbBPuq!-rAmmq^7y58@h) z6T7xq()(dcc>R|2{kg1f#31yw7V~~f{yb&zzt0k0x5fN`OwVTI!)R@x_KpS5X^GDb zGQX5QV`9h|MA6?`!vCYCeDqlKXE{_v{}0Rbju+*pQoG!eK4&cEF00v6K8{=BJJRC* zRZIN-Q-;r$bTn4T&6Y!uTw!huoGVJ5>Gcum{ym{@v-XlDzH2S|eJtg_FXY#1^JIFL z2>kWh64~BN73LN#Le@v_%`;l_Yc(>x4fDO)A1&#*#1fx8i}`u!{}q9^O?%AZf0WEW zpK#x)*)93|ge>ovXofzIXsp*Ht_K{g?bF7>p0pR&Xst_YkY+>Q?}~NKbpNeze@ct9 zq}NX^<}w+7p2IX+ds^$T=u0e}nFFF~dY)j7wXci>h)JMJoOts2w3Yi)%rf`{-1Gv2 zcakqO_$2bP4L+It9D`>uQG2Fv{V92df3@V9tsKqKo>|KNhCFpyB6%n7%Oy|juS%Xe za=bx#C+Vdze3s* zpQOw5p;@0NtTZMi_fjDdnmqm9BKd${8J6%{0!I+jLg9#fnJ=ux+C!a*1fo9r0>O&7 z>9P%F)rsd12#+&?Jz4OyBY1{0M)C~DEqSJAx#St<1CnPr`z25P4@#ctNmAho{mTqH zq5q8rFZ3@rc%hrD>uh4;!4p&LR|1|GS4w+g+#q>kut+I+uz|8ixOh|jQ)OG|a}yHXW1CpJly4WW-rE0Mpl9*J@;+jUV^@xySZ;)(}P ze`%5rndZzuP!g{AF@n`9B~P5&Bu^ZYUTxfIj+aVOPOmlWMf-M{!4obXJl#opnQ<2~ z4uco=vaX3Z%JxdcvEGnjy68+iknlU!;6>R0PkdU%{I>`s{Wn4tOWIrqL7eWvu;w8gkQtFMu+Nhf{ zUqs!MWlz)#Hi{t1$Af2Blp)V>L>mR3;an^28O}|Tr@uPM)89(TJ8@qpc}97&i4<{50~ioV&>1ZrG=hm+6p2ewJZBll&b9 z?;*d|;Pc2cLZAX%`kjIm7w6l@YGvxF?i~&@>J9{CJso{FYv^kj4K{IvA-mFVzau^p4eZPJhA^x z^28Rp$#zNT)(T6I(5>3wg+6TtFZB7E!BZ7I$>5#jn+zVwpv8Z|;CUm@a41Ti;p9o4 z;fQhqd+NDG+B3{&CC@N_BYB1?$^hh@;7O`o75Ym(g$_>PEcO762Tyl+)5udFl75eI zr&-~MxNkD-MZU;15$RBE*o$;v0{{}~;5T?DZhE`HCy{4_K*_lDt%5c7o@1tgh#wE0 z;ZK!3!@pkg#3+zFG3HA?8ux{gCx%Ev;7~`=MuDe}cS#xQ_`KwuxYNJ>HT-}?e9d`x zg<&uJf~PE#BOW|uACx?G=B01M4@h9%Yw(ndM?*`yt0Yg^8zhgL;di*Q_f<+5>7yqZ zyh#5#vv{E%llbFUtTMZFlFF5|-R^lkV7F+6>{U_}{F`irt8^{0G10|iaP zMV@%Gi4UIcqOAi@yst`o>c3U;)L*oFkfF}sk@gHn==KdTAY$n|1S{TR#9wLHWx|R) zW#>rVkb?XSgNvg*GZ`c>hs)DyLx%dPagNBxEW=*JJ;~sml#%I1nRq4uNYo4P49A0u z_SAikq}or0&5s31 zBEH`=coAO)4ifQ|aU_ zHta>b(hOe2%bbt0o{G5aG-O0Mxz^w>$1NT_G1+{Or>xK)Jh7KZdt%=ydB#ihL6Bj* zgbp06frJiw1#9SkoxzXCEgn4Gosy?Ns!n_AK+S4O@w?N%;c{GUqC*G64)CPm+EIr$b0YuD#N8S;Xw;= z(J%LHyP5p`wAHjqT&fN-IVe*DndOpi0AEjD*6~L2ZTJB-f@+=oG zNPa!|Jh+jjLBz7#|f4w*@bRhLa86 zW!NNm+tStUird}k7Y`lU$B+OT4LR`@)Oi#RAvOeR>GGPTw^d+^=iBjh*Lko)$qfg# zX30finZ<@c8RewWEE6h=Lx>H5YOGqdx~AfSP$9&IKpDZEKXz7`As|LT=LZ>-Q5%-C z@+@1m@{Zx^Le1L7m8+U7R#hp9P{}n!Xozxk4Hp43L}&<%EG}!7h@y4jauqBn;85Kv z449=Wu@QS*vXYAb}y?jodzu_aK2G-es9vx@y>?0uTq2kU10N*QPZU^lf&iuBl$L)UXb4s0B@pu^rtp?FS6~p-u=4hriu#&b=uy+Kx+Yki`XGyH97`ci%~0`S zOfqB69$Kn1zZ|{Q`5YrF<@aRf=me51QM!wrAVuaRW*&Wgbpba2uKap z*lM1?Acv3~7BDdAx=7ei@9*45+qld2WfD;omhv=3pm)KuVu@^D#gMMKr<+pHNDY&}FtOLkYRUCXNb#wh{_SxosTXe3W{E5IWR#>I@MaWyuY6(hTW)e~^C>7Zr(au!y18vue zl`D9_ipgCm5>iBk#mr%gV-Cuczh-M8y0SV*ly+6sL+#ic2KlW<(J&o0BT^L2VB;Dz zjLWN5FSq1Skds+g@z{r>QR-GKGbe)*VWOiEsR*1*Gi)UYk{VK)MCw;pRMjICuI*qX zu^ePsAUgty+FWI^H2McxTMoiOb0&|#si+$~9tW)+16$3Laa1grszDYPb%qY2&Sa~v z8UFm7p&~{LX zl(j0TW|sgIk^+N0*5!&dD^^$42B(r}L_}tx=d4(jVwDl6@|dxLEL3)&y@IYaCTM9k zRWt>{6cDn8o6>!#^N^IKnzCGqrpa7>&5cE%zrdglEtn-I&L^pqVEK`WW({P`iY4`R zE2=|)2D=#AuVcGyk!>(6Rah(Qi~`L2l64h0>PWemStzt@DVm9u)paXwuUJ_(0Ay!C3=Knb)e_v-HHf=BN@+$BU1nq>l%TVfj0vZU z_`Me2`Cw`@K#BA4ZUT0SFcl}LE*x`O;5gSw;@qN{;4J8i0JF+*PEwJQ8xJ}19_dhz zcN?5*`!O!+LpM9F&oQrN#;b%~pHd3E!uterX1q6n*9CXtMMyc~&AKEQFA4r=uSntL zK+cSJFJ2OigAnneaM6wardse^z>}|B;X0__Bn#d?;3dJGcznmA@Qy=Sb9`?eM!#c_ zGwauH(vR;C6yEnNcsyT{bEAqVN7`?}J7v-jst522FAdi3CEz&;AW7lnLC&mSc$P6= z%=p47fOn+@kKgcc4UZy)mt?_P2)ud-5ibrG<(MCz!LK>}o`OR>>=h}zk03c@8=3U7r4ZyWG_0e3}8zd8%vHsJC70`Vr|Qg}x!?Mo#ZB&LHRh1YFqU)}`X zI0zB%i?|ftH!XPe!25;*lX5gZWWoCkcuBA)ULr1q_nIZXp8?MacSTCSUt8kq#Jj~x z2oY~GE`|531up@O57$^JQg}~W@LGUZ4CMuHwirBi%%~Ccy0)p z@$Beax}+c8h(VeLhP;OckPCP!fAI-M0Pl87eR~>sq4KxMQr{|pr}7tFQvk2bg4YAQ z7pZ_GrQbXY-da<9QI!LDvr#_G@%2MFg+WNg`ygkI?<2rtJeYpSngHGm3*NmDG7YZ+ zcvo8Rx=eU@of*KJj}IEm`t1cCs$77SenpTo>-V$??@K1U85X=Q;3Wsp3=A5twBYps zPvwW#gm)B$&8*)`!|1ol67H+R$Q2v9im%V4-&Gd8H-U$t zMSv9E6&AcVO?dotf^zVx-EF~pAC?>+DpGh)Arj_zd=|Ce;oVNjb(N8bW5gwZIG2ZrC7a##;`&B=~2!pKHQ< z!%{E(!1KUe5iv+7E%owV;33KauLO6>QNMAhG-mz!fyZzaDZDX|Bkz$8{lHW0B*$$E z?^6sK&3JzS-hvYNK$w;miX@T45r^=$SS-A z7QA}kJ*mK?9F21=cprNP@otuK%-^qLykSni1PsEHV6RB&*A6-I9_diz9mM+z?38}h z7CaB|_$`bgg;!z0+Y7vU2r>OCaVfmNqkNe4D?{a_-ij37hma%hkq-8p!FF;9>=fP~ zEO?c`n=JkCrtp4m!Ak;O65Od@wUnbCm*B^&-$vj~gS{e!7Y#Y`9_dg3ytUwoSBr~o z#QVh3t~~`jexs>K;k|EZCwqXm5kkaUj!WUaW66(hJQRg$U*59hM_%q=`rT^6d(MK_ z54>-|U6Io784KRcz*FsMJ%p8hUNqX~^jq!-oxd|7M?W4J(7h)8R+#WOPB-H<0}rAB zQu>Xx;O&D@5~P@ZjkuJ4_gnC~ffp)&ziz?n2VSMbTV=wlv*5i6Jg#L|r1Yz{;3ek` z=5MnJ?{5~o2QWBrDljQW<2x3-?*dP?_qR(qmcJeg-qXP2+IdAvzvnD?Zv(FqLQFrF zYswKXAA=-wek>m!I)A;8qaP10QUL}J2wLFXiMzr}wBR)ZkNuS*%8?Q*c$L6Qf<5(H zk4xb#f|6$aegZs&0kHsI207Y$XbIW~JjRcBci~caNfx|*;7x_QB8B}$3*I&pUJHa3 z-j6JJXMmTaz@!|F&sy*v0bUvGsb3o|g}2>;7e4{t=!M8%j+g1jgNt+qc=fmwZzC>+ z_Zb*-`n8~QL(&I`a-@&IkoV94x;cL^{Wif&Hw3A@491M-2Oggj6j6?J91M964WQ+~ zQ{}}EGu?=HGoHiDct06NzndUu#%nR@x5b2)ZoxY~jD9W)-n}OM?ls|k-+~uCF?9R# zJqzAG;Hmuhx(N^G>;}a*4S27>T@m9*YPI0S&KhiAw!vMc-({BZM)Vg#k6&Uf@)SjM|$iJInwy&}qy z-nEQ(TM7r;7xw=O@Bg#lH3RQ{fnfY7ykA-Heg(Wrh)}=1xD?*^!83Z1xJc2HLbos9 zgB$&LaFNnx54JCzFe|(*;LUikz~elLBBkFwurT9!fTzmKKIz8v<2T=CyaM2%NeGa_ z8v!9R-a_EbgcRfZ7%sXI?|tGK@1X%yV8VL}W`;$)IT68lX-UR98aN43`eCE$ApI(Vw-XU# z{vN`m@UF7p^#G51?I==sS6J{qE<(ORj(AVwQg{zp+UMsn*iab6RQz^J`y4%Quzoya z!rN%U>j55y905{zcU$n{O?cfVyf2S7(l13Kyav2|wg8;SE9U=fDW{U+uB(l`T$Chb zNUx)CkY`yUJq)>OgB8DYY$k+T4j&VGnI}JMiFchn zFyh(QPetKy(?8iK90*_cvfzJ;o0`yQ#eoZqsOQI430Mc%P>7Q{zo{>?W~_J zk54_++3PX(HJ;R4fb%Azv{te2I?k!WHupRbyS!8{JlNS=V2^k6yg%&yZiB5O44dD3 znlv6t07v{zJcGNj%QAl3J6aCMLhG&PuEcSKw10Lx0tDQW&-`co(f(-rIvnrP-a2cX zUhq1?Y8H-izukUQ#d^yfKZ?D4DO7|xI#LZkN4t8kwuI=sX z#ZkcBt*@RHC$J!x_dbC6brEBn3xmV7t8hxn%tD-xk)NgQteUXP-?58UJKbB_jc~;Q ze~8(nzi;Zt0c4)O-hv}Bubw>}DNZ5-WZ#+o*Ng4RFT?GK{ZyFN|GML6Q8eI82C45~ zhv>2DbU=^V@gu;WMOsaXSqgvlgd;H`G0P{tD_~B<_zxODqu+rA;)v58&l)!Gy*(k% z-_f!$Hu>e9+xuVNoE?^bl3EH)%HPps40q~0_v6?=^8EaVQ9=N5AhQ3gJPK~pjsa7_ zIuDz{vjmWPFXE`!DwGGFa3IfUJ-{8_9~=LlEKh>_GY;D2>64C6&l%zIbd@RN!y+eZ zOM0UdsQ}Wdvsc5fT^xOZ0~a<#BNdROt0Lflbl?fkFt*{qh3LLsQ3j3EZ^}z?41=&@ zVi-v=3CGaG5^+0W9Fhs2Z)knO2FDFBd>&RDE%)n2$Sj@fCk2lB2#Pu4x(-J#8fQ1a zt0R-AJU~-yEymsXaRNq7M4xf?vT>LTY<%I4XQUYPvKe9@gi(wU7CPJ#gCm{~>!`Ts zdceNJ4gYamm;s8X1D=OSdFmTD*eSFwV57OI+mMfS|`AUy$lJ^A5lA7^Mer zjMC%x;|!&33u7Ib5%zI7HOkSAQ!RL^iae+c$J}f})g7l2hv!cx4h&3n=vUzw*}*e- zVfV-JVVkZ)2*P(1v@DMq;r0ntI0}cy5F65wF3moni)Ti{>(Ob9 zZRC^r!uK)1y$HI=<6z2nW;N830d&qm(!v zMFAlc$~y}(HO8?v;WQgZJHqCV(7^)r3`?)5@$lq0tX1J$7Kb?c=rXNacf1=8l^vbo zj@5)mNkDfZz%x*IrRJ>90CynKDS^&~bps`|mdBE8c3c7-Hanu0{Kt=2TbK;0)Upil z&?iDg(ko90SvLN6M^6rf*&?DwUJ^HE?8Gl#apl$5q+fS^?ySOj3l>$?EW53t>F%$! zZ+-CLJ&!(q;QK%Laqo-A{{4Ub;jKUa?d;$GC0l`OwWe`asJ*~dz2|-C-rpn5&Tzlf zVwQsuY0JI6cbOzO7P`wcV4|7pT@}&HZ(bD9+^Y<@)4bNCKh60T`DzQ^WQ+Wz7V`lM z{$m!rTP5GzQoWwp@kYSvzXE?YRCsI(F^CL0PkTjR+Oucm~2BNMiFKDIGhq~&Q;|Ju# zrP7KJ@v@9D@5wW*W=o!7E|xrHTO`jg@0UEo{I=v7<_{&$Fpo;!i91P^8HSmI0Nu;NI=AHvH?J0YcC5iNr=^)aF zf*_G5GCiFztMVrDF_IF-w|3ljmR{Vr$P+tX^2A;!d1BW~p7QG@PkE6(@Jsner9I`p zD|yE8kmOl5j+pqLN}l?1PDknUuH=dNspN^n$79M6N7QlfPViHtJ;T*z@VoTkJ{Auw zIXnN_(GX%ozSSSHUNqFV=O!Wb%{srlx2_tb9oNX1mj{X!9&*XxFpCU^T|GGLl9pk8 zgj#QS!DWC{QLOVDM!!HZ$_0MIuZIXNIb52Hl_9IGiw;aHwg#ig)r0Dj{uxCTSpKqN zb@L3B7hFFOBs)VwD*=%S%j;^fa73Fi%vvnURM*`eyqHO5GTa6iJHXDmj*5P{ZpA96 z7Dt6%Swvr4Btf4wx7VzIfy?KX)dYnVyj%rd)Ortdr^W`ZUb!4jDY%*xvozg4YZ?jvo~%yrUMp_kq^~A>yG+2;lKO z0{#Q>_zAF*U{<8?!Yz3G-ji)I@i?4Q`td!28Sic2y$U-;3h&pjAn%b5PDD=OvCCC> z>%g1wdXN~Rot6F+9@D{$$M?-MVMqPg6)8OSzh=B&0k0i)iWFWcEX;WQz$=3t@i?qi zcpU&U<5j}J33o*b?-2-@@e%-{@Hhlkcz0UxTHwI(x*~kDCV1+{;gZ4| zgYrS|xCz<^j~urvQqUP-$TL2q*C1DIu;Q0)ycSD5<#dA_lPEJ~NWXxbd7hs2oJ9Rd zN^TpyqPUL&U8jahlYIt||VRrB;IS#rYOdEt5b zBpHV^gu|zbF#+v_Mc^kx4_nn6i}{5EQKzCgoh9x#!SYX-vY@><3|5?J$s^lcj4^EE2g-kMN=S#eaoDw^hF z-aN5tU|>R;V-?R_#LP~lmfcZz5Kw+j#9tp%J|?C%>6*3wT=(Z+b~aQL!|OQ8E`rm6nLk*oy|3?o1K%dsJ_;zj*`QkwY61s z^)=NoTGf)J|471X^jMAm8vNJde;NLlM?fdWx?_T}e15@2KY5K~4#f;W9`e4*AW&4Q&i&p< zvv6^~Da_(tCtQsm`rl|VXG$}1Ip0K5^9^hV)iWZSD>e5c(nikx5L3`r9LkuZ0?&SuZ8YuKk7SXT{fdY$D+@@(7d+LY9OqpazEkql zYqI2N$FL|vUEGqVF4sz)QOl7$(~#wo@{IRR$ur)+lRVRvT?l1}JyP=2m*@Y`p798e z9R6vR{oRm#nyinYRw3(Co^UrF^MZG9F+9pGTd>_7Hds+lQNoE0XvLB>wZ<+Ya>XvX_7X$;J8P@GN3|_6YHKO37g!Af?kkwhUb3 zI0@Mopxr2Ve%L8eEbqKnE=kO9GqD_zmO{uX$FihI$$bSv5!HQpo#p^Hfj;2r0C@}126j6q>6&HCW z_dFPeqe$tu4;E&*e#n{AMd8hra-vNDACAIPt-z!kWe-bUIW0FAGLzfy!JEg`J5j)> zE7O^z!o2~EiUaM5$M+v}ABl_cVEcvIkdmG;II_ObxH`?1o??u;FFdYpW<|C_ zOGaYYhA{iMo4Ug%J$diMGfRvyHs9f4h=Mews%*Zh{T)Dx|i3z&QCqU#bB9lOhONG)>8x6NzzqEx3%ZO}`wlN3QMN6s_4EjyJ+O z#Ip%J!eVW2J_@DV|2j{!7iq&p5+i#2iU%vc(X~ec{=TTSy+=PZUXn9UCs0D=>Esa` zCZ$EZI%!kRzB`U|-uV5i4m|(nk-gvl=nwUK9%p8)$=d3eKlS$Gw;aBu<6OI5^3+k^ z%};-@_43lvD?~ftT$g|2PW$#(pL@FZorkNo%sKO=oQ0Pc9Qy0rKOI;`|A*H)e*6vn zm+yGJp5Nc{y-AawvQ<6$(AYa4c{+BW>OJkU14;MYTJ=g~R`**yQ|`ClP?`Pc%r_TR z4zM=moph!^ub;(?l^l{(wfOALej zb^$OwJ-&;b(q$Y&^_4<1%T_;6G2kSVI-l0aS- z1t)o_KoWUbB$CM!1VsIH8DAH9IpM}Wn9p3Sf4s=gz@1|j@|+X&ke9_Mk30hh72u)_ ziH~aP9V}H*?>|KxkQj_Bb)Y@tI!p45Q<>zc?;^=F9yd##{+3FfQD~4n!#ON@s`O*Y zJ8}P5@{DUF$_v9~{8*OAQ}{1Pf9?V_N9#X>w}QvG2bGwG!E1|9OCX*^C2 zea@t(!6!|%W0#@up#3oK>tq^T=ovH+c8Et%hHrTY4SL(Af-r9wCwDP3oG$ty6(J4( zm})rwV-Kp_2Zi0Nq5)LQW>b5NA})w`UKe^!ErwsK9P5*!aLE)vj=V>jTL8>@#Ab;4 z(2eavss)erl>LYzg*U^3_q+)Y)ir?E4&JQaBht-^w^7=Aq{GL+qdwFx3YXHa2D}+> zFU+#p24~3eUMYDG?xb*lC_M9XD(Cjhcu&JzL=TcweEA$p-XrZ}f%hhO>c^%>>Blh4 zcr>W-2%Ll*?c*-a_D zr@))>SoT7tAIC;!yfY>|$}7BO03#k?1lrl!s!v5 z@k2LWTuaS6#0A|0IqIy4Zlp|$oC}IGT@*1Mqz`e?5Bn?9OgK~+M`G9Sh59s_S%?C`m@O(fm=L5pS zFdxviw<$0oplKl|1X_kn2<%l80&v1RJUow|Z$jYc%W6U(-!dT}<~c%42#9%r!3hC; zF3LBqp(X@|%m7`%);?9HDIrEasQ@U(V?qB`x?=O8XZ}VM`#S}f2 zJMFDIUYPK%_Q=iC3ZIxU_rRgC2k!0p=D%z{Kvc?q;D@h8`6^W2>I_ret-=!TMCry? zqw>~Zm>O0HOS~hc8()>mTa#gGS|u!-R;{KRZq4$x<{wb;zv+eTX(KMqTl`#G^CjP- zU)lPDz1P?6K3Wnrby~`IM*aTfrQ^3&F3uhJ^68dMQCD~T>Gz3#e*SFYLHvgr>`eKh*BW5>qdc-Qo2YhU>Dr`ww= z`I&1F?HM(0L{oM1&!bm-ZLT|JcEaiSZ#|;DS5Ufc)h}LbEV}B;QQhDFUDjWI^6vK@ zKKbh1*SFsjc&+yt5?_6I+xbtn=&U3Fa)mR+HN!o_?Mz_VtWXTqIyV#I)xJe6#Jme7hM9K} zo`-wEADH{Fyx*ttgYzqc^DYD%v>$%ng>wI$c^CS>z`TnHBJ{iqoGyCa1+v4>yBLoD zoOzdJsJQ=%d6&2God3_9ci}gZ3eP<6Vx2d51ofD0up-4<=M5@>r{)dR90ko!;X*SI zn2*{EUN+m{2C=R42K6Sqf5yDaTHw8j@GfTFh2s=OD!wXC9_es1lsW_6I`7gBJ9B)8 zn|Ij=IbwTok%~~RRQj3cU99s~!_B)?0>g~A(1fSv1Bf4L-lYfjid5A9JM$?Vrzujb zbw1@)C`)}5QFoGczUNIi^avN@N8wrLUG||6S6k#LYn^vNcN0Vk&pPjd4@)m<-i3I> z%)6ux&bm0|H_gL;-<+PBVK`pI_syb!Ar@-hC5jgRg69B^dlZTHuW~Jy>e;L-aDrFI zU}g#_H00wi1$Ytnbja{oPEj`)pEBUC@|JgAD(j7O8x&M!k9C}K90QRk7phFf!d_uh zZYO_Cq}-gaGtcEwKa$cz$?;oF^IRVBoVe&td+Nt9o0s#fB%G5Z3)Y3c?MY8l5*Plq zCtND?Kf6qsQs}=?u&zZ~Tg%mK*eO!^#yc;SpZ}+os~qTdQRS+xVX#o46;h>!4U)kd zziKVU|Nq*mW|>0&c%kC^B5RqN1v^FmQ_9qrpzy_%DLD-l=mIZPrra5>G@}E&a9dR* z6H>KRVtr3Uqz!Y&i30fX?@}EnpEp!lq8#&Sx}{lWp0#MBTgF(f$<$rcu?QPe&usIg7^*1 zXh`iACS|sZavN{Tbe#_jAofdYZwh7!zk??+9P+APr98D9A}*PssB;sS;B;R4ns~yef6W^?4lASmk7P3w*^V zSmd%`W*CZ;+*nwU_eh6r0O#`q%Pj4A(fk1}bGROuL*bo)y%~?|O~=8Gc&e-tkI%Vg zyaFkMn;>G4eum48_p}L*;Vb>NgE!;d409;`?zP|@H{s#YB!E|I!K;RuaZsf6tAd4D zzc)>IjHlAi3w!(r-lN|RUVcIb&TykUr&4)$;UaCt#jq98jTgW3;$6|-6eI7-?Q$^Y zu``&q~R<*#75%cmx1a{m-bN z7#eQ;MIVEG_TF=RB)Xw{`IU3jDeR^-9z9VjK0#c*^^T5#0WZ3!h$B&_!nw`XoK0Pk z4bhI*&K>=9Ak?mLgW&&<`+q55NrB=VUmk`o6cpcwU~b zA~z>D*qomeY%VJeGS9QPFDwh-m3Z^=3g^zMD4CPHAX9l#mhZn4IjSTl8U^NiUqj4vr|gl6~4KQOrBH80wHyf@~TZLQY9YjdDtmlS8F*Z!9hMrKG33v#qHiT+-6Ag6!uOE-0&*S5j73 zj6};@;H}8>mHA4G3u#}NtIhE(s_-q$E%45r<*O)JFel(Q$RV%bJdS`ppK~d~92S_4 zDo=-mIIN=);su@_sa58in};%Jw#=PZTvF;=uz*Fg zv~*r+#e%X@gUP$GxOkB^cV0!HO8e%PmCh?cot{&{Fi=%17Tj1;GOx4@R=Eq@73J=9 z#ih8l63FD1E-ERTSCLy(2+w94DpNYwTU1dxcb2vQ+aOnz`4*sMSWpC9UcS;Yv>^)? zcxRyrptWdda_7yR>&q=GoHw_kFmD*^3dYH6U_rhNL7^g+7J7>c7klYd`18#bx>b}F z_~up=dvgs-nMANy0R32hOMM2?9G|bGqQnQwT&PxwU6Eq7NEH^sEmg*#FsHDnuxycN`OL0Cf#B+O7jADYr)Un$aEm9O)P3*3-ijHobAgl68N5+hkfE_vsc6;_n`P;eFrS7BM; zD=L~-QI3qrH`y8`qk@G9K5krKB=mfeVwtSwA;WwU&u=%D&82ozEFD!H0>!Cbej64G!}X<->U7A?oSz?YFmrf}BW z8;il@BB-LGLX=|7i{e9@Tw!0}MZ1&YqJ>~f<`pfX!RV;KpghrBR$7r)nllS*o-gM{ z<4z^=3J4=Av$(OMz&N|aJBOOEkHD`{+sKKEnXAnbp%=`_%ZFtF!;t7j#Y7bi=A4_r z73Ybcbo|aMB#&;bXkP9da=zj~^vSE(qfWz7wHAUMbo$@L-A!l|XB@}z6;nu1Y``2u zti&dW#fb5xtxAN&jhNsTZ4yHcQk588Y7h?*11c(}C?%B~qRk-%D;9DH_=2rD6czLk zY(yy*Y!R_wQHw$fHsm1U_xJ4YSvRZTMeu>i^Vw%+|1&#zW@evf=OxvsP~kx7oFg>_ z@mLR81B;eahsp9b`$R)MGpVJkg~_$gU^COPKV-UiAPc?%1nAe}0DThx{MS>gYORyt zb?esF#~0bE5yzzKt;U9Ci>irY^+;vw1r?0KP(@PIxa__$SHKn;c9yZAv7w-#fl4+Z zKwL-Jh)f>~-b*)5!Sh1@%fDQUw)W(3F9dystD-?ODV*8;>I>cL_k%4-EO<3K{2nm3 z;PtnDog&xuTS^o9YScg?sl7SL4MVm4G>v{^Rl6zn=ctVt`+W3!q^!57y)G+8g{>G` z7L_Z8QjDqh$ZE%h`QndpoUi&t!+a@EVl}Na{aSLh$K_`7&`*HdaJkEM>R_e)4f#C# zIC+)*6M41$Gr8JqimCRx`Wobi`DZ@kqW#~J%W)?>S^^SpQ2N!($#;7)rx-e>Q{2klG+Dv zKf>4Sg?QLrgGcNy@hv-pZ`%j(9s37-*S?7F+j@r81N$L=9gJ|ACYCJzQ%)#&z~6PTONx{e=3A+IKYB({PKeXZ>xoXXDNGCs^B$ z-n$5A?9Xw#y%O)TYjKC2#+`OE-e+&b2kmXR%if8P+8wyt-iv$eBe>W84)@vL<9@pz zpR`Zm)Aj%!u+QT``w~8DU&j~hn|R39z1e=X|G`)6r}&!vKOVMU;1Ro|nEG#*;oJ5c ze8*mZ@7hc7eR~CdV5jgSJB^>%8}O+86@F%ajmPah__^JM6YNv;KRt$v>^@v1|{A9v4&iyyJ~qfj-u=_kvz_~ z4yPDmit%*qV1B$J0>yY#k6b+UO>6n61|fCxSKp^%it$P*$d8vKUMCBor@XoU`%}hgx|lxGO2|ub+-l15`@i*nQ_}J&#p$l% TypNYyM!X)6*E-c_)MtGOiC)s> literal 907990 zcmeFa2V4|a`}aLdFRKD#Z(#2(*svvF!QN1@3kxhoDa!&1R>TI_5H*4ou%WTXD7Hk5 zF<{hKQq)96jYf?Hdw1X8HDz~Zb|JZ+|NVKM=kvbrB;%gB&N*nU!-b2-aO%v$AFqUH(Cgl2mXTJu2|FA2n`ZE9Hy~6=U@!!}- zG-njTuD-=6{%_xZoXRNvckC}dF^d0Sx2Uj-`Cs0fr7#x%vj#mz0!QfPS|Ts zW$gZwy-Q8T?w|G{yBIt99{h~4``@)^`!RO^v}5ktncHutFn0gL-M)n%BiZ}>oQb_Ojif+6l&FuXl@aC~I$&$2gR=cU!_Z{Qvv^ ztJ=UZWhV2l_S}7p<3H`+3}PIG{rjnmu_-#C@2Anb?M zGZlpWc-^QVO-OuXT!2~=7Z4F05zmMXp*oF5Vn~cPlZuQcDdRNplQc;In&@DO1Ku2> zk($Xx8978z;#?8Y@fuyUI+86o&Z0}w8p|$;L@r4r)s(daXo7{z(sWnO) zVQLJDh>wfcMMTR^7_U=L*689iD0*xH#+4=@CbXQ)0nrJOvcefMN}E-vq9NLxUv;Fc zIMh-wnmG-54~SMrX+i=*)bVO*8D)_HkrCp-L`5-|A|NhY9T^!jMdm9aI;6}KP0>Zf zYfSr+Gn@1#XV$5w1Oz37hH6Bko{Gf9nsgRtHf?9l9upBFEiPw9o5i4L;ZXq*A)4s; zh|mc0XEPmJTz-?$#hFdV7iULJ!_X1t1{9YdAwJZroM&$_RUgx?4&lGDv0) z8Nzg;QAvilaJ1MYL(h{bI7XW!F~m(#YbAzATw){!nq6oWi4AE?Y>{zBY}2WbM~pAF zKoL`oZ9s;ogh*6O>RYE#n+y_4s}2b&9Dwwa@&-p~O>A7R%Q}-z#15k*PtoGEsPW>CD;W=b#Rgr=tcpNr#S+r_&^&6JU>v36=JESg;XK$P^G75g8evQ%8ry7_U=g zH)D#3MrX%Jvzwnk!8AdGBd1E5n>CslsJuN)6CDzvjt+>A2?&o7T^y(|Y?1`j8)L+z zs@%z9a7|Fh#YKb}FXD!r!4zpS`Ph8yAd?L|V?>a2M6waw5HpvBAADx=aHCH)(x{Cv zJWSh&oqWb?yrCKxH>QcBB8^vCL&~U_=y-0r%UHtJfR8oxMf9P_0G($*LUf!u)J#>% z8ZTU$ig2A|BdU^HXoqn>pf9IgqT6fjkziwOvpj&n8| zV~MMeM#^0_GE^56Wj>lFj!qL75t2ZvD?UM*Ssbg=L~3x+k(8L?u_r_($Zk!jd&H3@ z7Zq`&`SYSvP0l4B7UTs})g+yKtWi2Mvz#^KvS5;*9o{BZ(oXFBGBf$OGw|^y^G}GS zDQMPh*(WqtWh#id<{>+g3yLO66HxXD6pCX=Yqm`08*vIz%j`%KyaubIW1=I1aeK(7 zr@BsN* z1LZ6;!b~fLtAoSUo+?>W307(22v&J38tk%`6YTN^5$tT;jg2Ch%POTdCNjxfIa#}z zlCpNQW#wYbm6nYWx>ek-Y~e()vSPC_@?JLPDYGw)Nz8YeG2Tq8L}GwDJjI4A6qIBojb6 zlfub6%-|{@!g$H!ec>7|y1(L$Lhp$tCFesv3^}X3(>N<9^(0f0i{J!_xd_RUA72)> zQ-#jgBpMZrIG&%vP)8>5AsQ-Pd_+vNNhic5XtgoAc#Wu<5OeL#{2yM zP|7H;jZtX30Ctc{3V>G70u`b1f^qhk&``;+i4O>mQX5xbsZb=1%TztaNE6A!>dwe` zxmJaRyowYoYM_gwbz$wK;5d(f$sX+?$oXkutO`HmP&$*Vk|@gjxDKXV<_9+$Wp?gR zjN$a`vNd_p>Oup=i_UC*Gdzmd1%&8=!eopVtWrVWc^Q)04fYCsN%H}Ni@|O%VxOO(C9F3Oivf?YlTV8@G z8nuxnlou|M$LVRYrtaV83F^p@FyOag4vu+$}~#JE@Yr*)KSJu0okL}lQh(0ay#`j z7BNK^V566WpvVYOQyaXP+Hpez_TYJz=sHV&q=O3vlmL$~5M}H^SWO#86C4sww=@AE zF@}_^4a-9TT4@2ev@ucI1c+=rDF7y}zm z(4=zmatUPTRt&?eRYw?ggb*cq z=FFL718bs|CYf2IY;osNZ+P*AKpS9iD!t%QVU12r<7frl zJgP8S*o9}TDNdFSYeP&zkUT=XI7z3*F|G8Mbp|e4(gN%?(99{xE(|TYCo;*zN1C%s zY-|(C%gwd9+{!lq7UroDBwnzLk2_C^$^1O$Ix8|pw2&eQcBncv!DWo+me|SV#IPN1RYa;0xwMJ)jg!dK9 zM{wz4j48vg7$>PH88A1+ZOxjbOHpLvt0rnWqt#F)GRbc7$Yg#^kz&j)GO=F7WFmu^ z22sa_qc&JrB2d!Jzo8uAlBl4_7(BBnBY_sGgWyKH(I z60L!-&`k;mO2Qjv2IrJg5<^MFStTjU7y*${F?f%UyKRupG)au4_*_gx6fsQ5DxQ#B zJjb}Q<4MPZ@3=AH&kh$P;X@+mk$|Y|R6v<%rmCASv%xMaF~m$c<&C2Ut7X>4|hN@i?c*#f&H zE;v5XP+CN=)5^5*ShHyhvSyQJw*wVtHs+e>9BrI7bMy&Wcb zR>s1IUXi8LT3t-ACeAqF$!1ayoCOz1(W5b>5|tEZFnKc-$>Rei(KBCBc?F~F;wqRW z(@8K+(TU#H5{wDaX3eI>z-xf)NL9yUi7+mlrk|uqh4{qws!nu~lHOVfv53HHF<>R( zBOy*LT45KG1Z#BkHeoQ!niwqHM2ILVBm!~Sw>GgNWn9>iMH<>wu+wJ{)&#k{CehkS z>+!ffD=SkOvBJ|3GiSr-EvFD7a0r!>4|l=NF0^|FXoK*)*35bE8ZYj2 zX`Nm2hAtQ)9cX0W?ro&+lagIB%E-XqBgs-ul6jmY%SiENAK#(LrL+|c^eh3jGR}EK z$d;2}DQ9iR5Nqf-gGKUK3Rb$do4u#uoF+7ICS}BlKDyJFfS`jVyJly1)-*vTv3pmL@n7(>Wi0`Fs~)aSrgVk zWky;7l$iJ~l^Xd$%r45P>4Ax%SjOQkF#*Ft5Wk+>g+baC!EqF;iSsNwhb+dFf>e2S zlNfGa%|~#h3cz$UJrQ+|I0B*$ z_b!HX()kRrN9%Sp1u?lOp={oY5{TBIwSqZbqt=DQOfhy@qWDe`P7`qDSgW+%1glId7*fkL zfx#{l1_rzM5v9Rs9GNs1Irat6eWjs7xVxYzcFr4&nqazI(HdM#C`B`r1kYYr5l?p` z@w$XyTGHk&(BKSrUrWi@AwU;p?wbX4`w|x!6VJM!1v&PTj%8k4R-lN`qoR0T&2w-N zN9Z(BF<2U<2>Ol%Mi{-r2%|2Ebvy;CmW?%>3RisG8nS0&Q&6u`cG4vgL3nZ!$C~*& z1pbWd7nx*s@u6{cQo&798>87w#@eulLgm>5_TF9{MC(P=XzU?(5i=a}1Hf?1cf8@4 zzk4zq2Xjw^jQ+@gheIL*dy_&L=%(Iyb~<7iZ7czq_zR=dC@Pg9o2X=>d@`%Jc*az0 z;n;IWK@>yhVc0}O#z#b(M6d?FNaoT?qm0?vrZsWO&H-u(KATA@k)8FWj!TM)(qQZa z8?M2WU1S!n)?{W!hb}=IAHjZ=1Y<8sofr_KTh6RQ`* zamHLMP-OL|#*ftC2Am3KOllkgV%J6oVync3ID&H`d|R>n+KW>eiy^M3IEDBuWu-BC z;fgKJZ;Ue(-h8xa6~w1Dbu5lG>sp+^*vPz|7hZfaPAooxA3?mDrIy4Bw?;=WBP*w_2g~aLPW-2NB zo(g+bHl?AGGP|*sY%n(};THUI2`(v;_e zpS^Jj_%bM)j%^L&Y+(;EB>6!j92(mSy<*HqW7kk>V_KmM28*F}SPM5|jb7NXW;~>> zfij{68&;7?x|*GZTye!?h&2niF^LecV-g_+tx2>LwjqMMwDrd zc@7Eb`Cg>^UQX#^I~ykOi@<;B4NgHz19UaqvPZhji|C?c`VTKr4|#+Kns6E8eP?pr_(bm82GzS_GN70B`5Ct`DSWjCX>0&l3bz8xRKrP$=bqr zt7*=+>7yz$C!lijmu4FA=KM(RGG!%@%|YZbwQ}_HZ$rqwFe*PEvlNGV3W?(hwwS zK|`9KTXH>VF0)Zynu{f3O4O#As<3C_nnNsi=v_5>M+>q9ucXA`)=2hf0arvyBjUO| zyXb--k22-GJcZ>!JV0siTsrj zYp&R33^&nC5LZ$>1x)PR*f%ko40>@2dVuy%!0tqP3&B1=z>^D^nHo|PrH$tv zS{R-!keR-k%)ZbkIATwb5N&ERJU5|~h~_9l#gW9|<|GcUZ~(cS2#L{hZ@033F^lju z5;$OwvR3c4a>`NM5*T<9A2RrQu@D#fY2>AQ4ws?%Z4&&bhf5 zhBr#xKCIW4b?WmT4**i0I} zwXswlYUB~sNII=ykbE73Qkb7fc%hnak&#m$%@Rn1sQT$(Xsu9>mMnM+EV2v4u0@#LN! z9+}IAUoAweI0irXiT7J04K|wFcug-LToXwuNJuISLw*1n?6?H*Nx0!v)?YR0(5@Yu zz_Sx(6&nh4nAK~5uR@_5l%+OZ!^87&{%!G}>gp2)2}n_+fZl-MzK zO1X5fSIuMgAwsVgM^Jj(pxo+1Dg80qvoh&!bU9-6Q=1rxNC#pC0rHMW{Q=Fzw)7diG$Es58OW`PaiZdA!6WBP0 zJ<6HIrA(fpK-~Qry5cv9w%VDhq-H_IAHr?4lT}HbN?)tq_RTDI>VNHrby;;vBQ5Hb zW)?LR6@X!CpZV_<;GUrX5BUNF6_;|MzByq|6DI}PFn+}^Mp*}HRN7HKIU}6LjPZ{m+D+nQN1$=SJ55 z+P@ugEut*^3YAJ*nh+Sf))=&QOj1=YYu>7y%K9Iz z##@HFPfSd-&FJmauU~g7W>3$YK2};UpNzInojZG4GRNEIcv*V)P-#^!1=D#lsd}ok z=&q?4xg}F_Fbv{V69*?*^$!g_uzTX*iHRvclsL8@S%2Nc!3Z^V&a%t4%Br62ib6I_ z^-61(SE%GBwsgLy$(9IbXWL;+C3|-zQ_WD!=JAb&*$|rR6?Li;I@bElb5SOWPnz8$U~{?v~cs zv$OZ=ER~s-6_T@^wb^bu%ZixSo|cu8+bXniZW*iG5=UjMQf0?x7bdT89+K_GggRp= z2I}21Hn?SsQzfr=J`dv&=j82*J=^KL`Ra^`s?4J5sTRqz-RtM*3-$V28$bBy^-uMB z^zhxL7B*9vTKUD!Ue4RpZu6W}sX3{3`89GD=B6tdyqCX-+r4<+D*3wyoY9#T%0#hoOh2gZ;`6_X|adl%$<-gP@Hd%IG@&- zFIAQ1o}zYg+u@|zo|ErT6mfjJD*2R8$r-29CySIga69FsI+IhRO!Y}VquLYdQxfVl zF$AnQqtZsR2QloykjX1cfY%uqp5s(Q&an=DVjZLoO+K}f{GG+&R8{`yZ9YYPlV&IF z&3AX3>ZGC(9i9aA3^DqiqDnUUo}w!7*b};v&Kt!sDmJOmP2;2r%?YW%!dLR z^PN%6aL^j_MXKD23^m!I+9R%`c8O0(s#E&XRJ-JKG`FEcMyc}E0HEV`Wz($%7N=76 zUbBmwF_yh%yUlkx&UUfAyn|G`M4g)$D{Jbs3+N&)Ck+nO7SXWKigQYbg)@f496lcn z3CVDh3<+cDkJ+!Y%ITx(`xJwTJ7X8)px9z({kFfp7-txZkflPJ)lX+zVNxh>@~<&UL2KHes7 zJhW0b6IB@^C;qC@xo&fL7n71ttF%%F4^~*673W{b;(`Ktw zi9W(HDS#wZsp_R0NZbu1X4*QdI;y<;B=oy>u>zBPO>zE`>Pn%?`=ytndyk6RL?2y` z3Yk5W$*Bn`JsfkAU#9eMC`t86>0y7Ohush|+6I!*Ce2S^W2@6~!rnE@Zk0Y-_3`xHt_t+^+0)ah-@rarI4Bv!9`s-jhWM_en87&chiR3O z&*gn&(MnkqeSEtL9eT=V4-dNSs*LZQ+z6bbe1?FPlYRE^cs!#DoXH-u$Dkd-S*<%1`er(PbLpzUB)j#3pn5}HOs=#9Y9Q|eId+PH70WHvBAephVN_L4l z+}PRcERitHIj!)#nW4gwOfpnTjHmZfb-HkV3C}+oAh;;f`3(G{18#tc21mYX+s*Sl zHH$otr>aU$u^n5Cj)04E>;d%(2JESodyYCC-e2IjCtMZrG|?IPZUUN10LX&w$!j1o z0#kj?qjAVW$jnw{tHBJxM973`s0y&+k|>hXRB1kGv(L}rG8Ood8xIgq$iusF2W12k zxf!j>5jp9l>bvZGI`1MV`MpXdb?}o4#1&^hstOckU#LpUJ&(Z?jr)o$U0}8UB>%84JZ2B|GH_3CIs*Ymvc3+?0o2mNTs%nU{ z(k{)}9rtv0X^K?m^e-~)ne@$Q3y9J5t(pCpTB)H0_wwCI@Lsbmv0(fsR;2UcrlLrJ z^L0O2s{6qy=#-Pc)dycsrfP^%Y3Z)l!<%!8jWW}QlxlLCTc%A#CfhmBrV^AVWG5_X z>J%HhOdES4-hqvGG{z52v9Zduu@>TO*mzrGyibY^lWC(6;w{*COJlqTTWA}u&^0X= zTc)qdL*2gK=g8!Ismkli*6hK)LM2m7Sm#nm)6d9Is(kyVO&<+P`n?k?Fk^W2@cUD)UDbf}PV@!oTK z_6fB!0y*1e=c!!~$jF+Vsji%*&PY`yFKVAPG$YlC!Laj5PF_~J2Cc4w08VvhyEL!R zJAFIXt9gZP>D&2^y>+6{E#IRc_L>q4ApT=sDD5&4n~gCb%3v47%(D{f`dHO2! z%<22L&Xr=CmRwVv{`=w}=Je%SXI`(nEvaJjyGn<}4nif<$!*3ORrM+Zy!)ihsk8^Oa217Zx52Q&z5=Y|51< z%@tuS)lJYz&0>|+)71RT?#xteSFzL3l){F!Qqw#z&eGgz08&7qblB#TVy(=y7N(*# zI~A=(Q?W3`+Ah;tn2OfyRJ0aN#l0!kR+-kqRJ3NNqP1u$=B8LPnbyKov}UKGwP-3X z%a1)~ebzeF9m5|<*V*c9nBDc?0Y%<-_VqG|(6s&?zTnvLIE-T>Fq^y|#v-S=* z?NTVrn01LQ)>T%pHY`dVvo4;Uv!YkY6=v_v@O27|^~qV_+}SI|-L-0U#R+$( zk*jQ1 z5yjz*XD!)Cg#0(!9AAYcGT=?;?jlqsWn*dj>=Q-IF)I+%0&e`btuDgemSXGTlF9s`2m3Jok@zYW(|ZpZlkMYW(~9guDKP z`gMvL2@nM%cV_CNjV0-`FVZJE;1+ejS?iA#vA~BeuzcuP-{0k(u?uho?GuY0@GA6A zXZv83u@5rcooi*M<~ELSoqteoIB@daulLHGzmAqW`9`)N++zH3cpW+$!_f!-WZEh7 z>?%Mw(z2diMFz`yc9jgvdf87i?dLI`BN2~E;KhlZ9sbXMj>YvXLE)pVA0S9z-t+#-788NOrD!RT023izNIs&lXGKkS^*{V}W5SVZ`baiuC=<{9Eu*w{~L zqd;Fb_H(FJ-}k7VV~f&U|8Z^AU1%$Raa&~B_}zpkU}0bANF>& zV@F_`dZ10})8ye!)QSa6!O*ZOkVE-C@Yh}Kj5YWm_4DHxUN_UT^X!%T>?1r?Ctj1+Y1RC*aVKE1W)tqt@hbl3khu41h%3CrMUd= zvsVZSERZ16-ZD8`u_xOtC)+Jk{Uqx`dYb9v+K0&{tjXtXQf<%8b|`;_=51=nB`R;4 z=WX)h63JPS0#*ofIdfCj)yvZCg^m`kP(_7?u@kpGb?-o%R@P|PRFACOjFBm03ZS(Y zO?oz2eHvo_pt(y6N?8RnI7%pB!s*A8xWG0?Xk>A?oLIVVeL+0n&#Pni`v#xO|n zgw&q#???2+JdCocdXFDN-QArV4|nlZFl?Ywt)9L!^(yv(H+G zF9V*(Y{iYFH3G`&{MDUhssUqZPg~jvqb!$6TSlX7cBjIDmMu{&Cw_3*DGK(c7J_C4 z>ik@8eqwm-Y2uvvw0QyBZh%eEO|BjM8(HKP4mY&sveemJZ8xUDH?HRR*B6X6COMHy z(BTpdTfiq`7+n4HFRbp26VN3`($vU|WKf$n*DN2|3eCBE4v@(wM|oN**-1!~;~u6W zlPg?VFa^=DwR$!VvG6^Gs||bQ7q0E(8rlf!rk1BZe)M#An*Zh_Ie5f?an@E`S?XQcW*E^xg*!SVMJ&(02gZ5oa{acM`;vXy@({Z-U4 zYVj|Fwnh5Cc%YfO%kFSuqt>;z>_2tyT713!#}=k*Kl?hgkL9b1>h>cK%`dF8{^px3 z=ZGsyR;;PJ;QqN0O>Zp9O{?(j-R|K&*{v$=8GfYd&=*^W%=FO=t66Q+cb%I|_@c{~ zlYXqXuGiBY??!#u|F-3FH`TilJ10lIN zeeamQjSkle>-C^w*7#4yZ+_P%!D9A+QkTWPt2R!$^!AkH(ty9JWUgKLZPe7iSNe^< z`tvt)T8)Z#ztp!RqS=z-qMivS(k8xGl9ZS|>a$5r4#i&k=H}o7rKvls6}#;SopG-7 z{@@$^s^6*Uk+N!N+rXeFrt%TbK8IM2>a(P0vlQ z{!Vb5^RSb5;FIkWVmH_vi*_3NnS1)%FRs~iyY`v&u7P)t`7Rs2`0Ln{wUvtkKJFD=H25=*p>BD_T1}!%rR&a+dLNJo%L<{|FKW?yuy6Hhf@k~pKtM1)yQqyL)p$N`n>CXKcs&CheaoINh-2q4=!o^`Oa@Qwd}m^&moDK6($Cp zSu=d5Z_um7l}}_`F1Xja)9VQ--|c?6VSMs85$BgrkNKt5wx1fgd{wj~yNgrx8C&nI z4UYc3%aLhk8zg}n zogGrK+Ok(|CJ+2|agQf^2A#xGjGbK9CcKBz8k zf3x&tzQRhMPWg&hJLOl`FYo_zZHRwi#?t4 z01^R!NdUk#0N?-sPz?YG1pxK~0M!A26aXL)0O$n(lmGy80f5>7zzP6h6aY{I09XJ3 z90ULw006fDfRO+|a{#~=0I&oARs#T=0f1)!z&-%rFaR(P0B8XKWC8%C06;DPa25dg z1pufA0Hgx|>i~cp0KgLfNB{sj0RY;eFM0f4Uo0BZms1_00l z01W|vRRF*l0ALCLa0~!Q1pvGNfZqXt-T=UT0H7EEp!q)s0O$h%>;M1;0RZm-0Dl0W zE&$L300;p9+yQ_K06=E|U@rhr2>`eV0IUZ91_J{?805AancnJV}0{~110JZ@D zUjYDJ0D!FkKr{d_4FIqQ0A2t93IHG<0MGycGXVfQ0N^eFa0LK32LSvG0Q?F7>;?cl z000#La2x>W2movW0QLX?RRDl~0KjVipdtX!1^`$L01N~Gh64aM0D#*7KrH~E005W; z09XM4;{kv;0H8GhFa`kd0|43r0F?oNMF7B50AL9KkOlxe1_0Uv0FMBGt^mMj0N`@~ zAPE5Y765nv0E`6yTmgXj0KjYj;4=WAB>)fr0O$Y!B>=Dx0Pq0-VgZ2b0Ki%RAOiqU z0{~h8ARYkd4ghQg05kx=CIDap05Ayv=mh|b0st%lfOh~u6aX+802lxO{00F02mtg1 z05$>uV*r3!06;|m;5Yz~005K%0IL9iw*Wu@0I(JSm|Q>06GHz{Qv+D0H7@ZFbe>f0s!m+0CE6;763pv0Pqn2hy(!M z005T&01E(MDFE;#0MHZwH~|1m0|4v*fCT`+W&mI!0FVLz)CK_d0|3tefLj2-3jp97 z03Zke_yhn90{}(<05<`EzX5=U0KgLfU;_Z)1OTK105$-CH2`o709XtFj0XUI1^}u6 z0Pg{S`v5=>0AM`;&>a9+2mp))03HJX4gf$U0H7`aK=Xe-0PqL^&;kHD06-4_cmV*v z005l;fGYsN764#40MHr$2m=8A0sy`M0G0s&-va=+Km4OV08kSEI1B(Z2LMU{fNB6h z1pwd&03aU#*aiU9003+OfNKCiAOO%90C))ibO8Wn0szebfKvd#2LRwH0PqI@Fb@Ez z4*)m=01W|vZUBHM0FVm+v;hEA0DvC=a2o)q3IH4e0Qvv`AppQ40N`@~pd|p10RRjF z04@Lkc>sVT05BT>xDEg;0RX-Q0M-EjnE=2U0KgXjs0;uU006H6fZYHW80CfO>ivWN>0MHu%Py+x;0KgRh=n4Qd0RV~tfI9%dUI5?*01yWN zoC5$l0sv0|2}MfbRf+MgTxx0AM8mpa1~A0s#I5015$s zxd6Zc0AL&dFcJWO{2vPWKNIr5Cggu-$p0>o|MejMcR>F4hx~Vg{ND-rp9=Z^67qjA zi0q{@;Q8Uj_Le1o^)g^8X0r z|0l@*w~+r@$p58~|0^K>{UHCpg#6b*{@;fD4~6{S2l?Ly@_#<$|0T$O736;d$bSpS z|3{Gj>5%_hA^)F4{ttru*FgT;K>lBV{67i#-wyIW5Axp{@_!TLza!+oH{|~W$p2%I z|DQqre*yV_4f1~=E6D#q$p0FU|Gz^1r$PRQLH_T7{I`Yt{|oXz3GzP| z@_#zy{~MbBkpK3O|DKTlbs_&FA^$%@{#Szh?*{qb0rKAg@;@B%e+}e+L&$$6taA^+z={$GUr-v#;q z1LS`l$p1ee|0_WLPl5bz0r|fT^4}Tqzc=K6KIDH6YrLjDhj{C@@cp8@&b8uC8{@_z&5e+1-z4CMb$kpD%H z|4xwq_aOg&hx|Va`5z7W{}A$j4&?t`$p7t-|L&0gPayvfL;m-J{C@!X-wg8K1MI^|`M(bGUjh054)Xs!H4)XspnXU6&$?z&GhMWA5WQ*{c75@#rkK@D*QTW(y{9? zF?*MN|NZblm1>BELScC>ENq*9ixxBf`t+&B*T4N1H1NwW?>?M7dG*rMr+d{)Nm-Xx zTDqAK~=qa(~e(! zk?UY>U8&9L)n8Y%wY6{P;?kj3a`KuRw{CSi`}g0C2Q_IDF>BwxvkwvyHn`Z^*QzsT z&iYX;TgJDmS+jMATD4mJ5gom6|Clk4$L8d`-{j}_YI2t@0}uZCt9r&)U!C)7)@<6f z+qXZP(56jn<+*cLZ5cM~<)I4~!fEanK6=#B+s!TT_J^y_y$Yrue?_lz2KZ{ANo^*eI@{G{)nJZV07`}RAJ-oLLpzekVn zR}UQcTWH(1Bb?{WTan(Y*H8D~zIC#)u(0_wYu4yB!@y!t$S`O+%*=+PTf4jd@lef4TWcX#(-Hzz06 z9lgHh$LG&0etYp^)agw8c>-FnNM<-0URn^h4&d%R|pZt4C zNtX~$PyhJNod>x(IMmJT+xK^+jg3Q}h7BVN#*O=P!-*5)k6pSH-DAg&Cntk~wscyy zEZ<}0%1xL4{Ilb;q@;zv{PmaT!lI%c(H%REz8V#EP_cONqP@TT60&yCpo@LCZ7aDP z8M%LlzyG`EFJ9RG^x#3G(;Ch07gMJ$>Ah>$eJ4A+>M@58|5BQmnA)#VqnL56TkE`P z*KRm+%a*5c`}hB_>eQ*BKi<37Aotp}>G$H}*M3&7p8FU5`(INZJN8F~g$w6bN>86x zqSaRIFMVAw5^~QxUu2`|P z)tWU2y4I~*zsiCInZ@_-yDd0(uJ85{BlJU>Hci}o&dq&epO%(fvqFVx zns2|o`rF;R9&@{QKXpDlydcHL=euUv*?Y#cYBi;9rAp4z_U!pFfB5hZQAdva+OlfZ z&YJ;%xd1>m0I(PUr~m*Q0|52{0K)-*Apn3S0I&@Jm;nIP004pjfV%*|Y5<@Y0I&`K z@CE=D00310fWHBNVgSGq0C)%hgaH5_0e}Ypz_$RvYXIO20AMTtZ~_3R4FK!{044$e zV*mgj0KftO7z_Z60{~tC0PO$(I{;ug01yWN3KNza;<=2msUr0Ez&BM*zS#0Dvz5a0LM9 z4**;T0DcAl?g0S(0DwsVKyv`#4ggRU0QepN_zeIU0RXH30Db}hoB#kD0AMx%PznI_ z1ON^L0Ji~v=K#Pb0N^+PkPZOs1OSc#0DS-eD*)gI08j`3Bme-x0DuYrs0jd61OTD{ zfB^u2D*(_Q0B8dM+ynsf0Dv<9KqmlTBmnRX07wAcU?u?YB>*r705}Z*Gy?!G0RUYAfFuCm764EO0GJE_bO8YT0f0dOKwSXf zcL2Zv0Eh$t{saKV0|3zgz!Lyq3jmN00BiyPIsyO-0RT?`pa%dj8UQ#504xFkLI8k^ z06+-4h0KfwPI0XO{007?s0DAy{DFA>o0PrIK@Bsk$6#(cA z00aX7(*b}f0KhZ=;28ig2>^%z0KNwRQ~-bi00;vBS^xl_0D#{BfG+`n$pFA<03Zbb zC0RX)KfVTjE1pqJ$02l%Q zbOiu5008*_z)%2SBLLtH04xOnG68^f0Du<&@Dczx3IH4c0ImW6?f`%j0H6l|o&x|E z0f4grfD!mM*tuS09XtF`~mQ03ZSYxB>ty0RUD20BZn%x&Xie0N_3Va1H<% z0RS`w0B!&PivWOJ03Zzjr~m+b3jo{&0J;MJ;Q)XS0FVs;v;qJs0RVddfZ+hZ5dfen z008-a3iAIA`2KoOE^8X3s|31k7C6NE`A^&|K|G$F#4}kpd1^M3q@_!iQ|DTZmYass< zApdVd{&$1?9{~9u3Hd)0^8Y2|{~XBwaLE6mkpCAT|KCFX--7)A67oL?^1nIcza8ZN zO2~g-$p3Ya|0>A;j*$NjkpFEU|0_cNH-!AJ1^Isi^8YO4{~*Z!S&;t^Apcz;|LZ{h zkAnPf2l?Lt^8XLW|NW5vV`SOkpEeb|9c?+=Ry7-f&Bj-@_#Vo|0Br% z`H=ssA^$@m|D7TK(;@%wL;hPq{(pk}&w>0;g#2#=`QIP%KM(SMJmh~eqKA{9g^4|&aKL+x@6!O0x1RLj7gdMNUf+6eTtEByZ||qy?v%2ojebG9B|Uncyng@3;nP-l zZaLAQ+v5Q%9lO8#ZjfE;+|Z_18t$7sHm`5g!V8UbZ(fDW56`Ol^QLiU#%m5_Mr!*E z`S|G2)d^L6M{ZrbZf?fqFPTM0FFCyabCh+#SG{b`x2(JL^yif<3U?o~R8&r%)One+ z&)~2>9;|xy)49_9cjLa;5nunWo$cq{dfV|{?SvcAy`R>Mt<&uLw3vfI6}MOarq&1l z&-$ObnB=zl_v4=u&yIOf?^=G_RNEgs_PRKYZj$^kAaLlcZ8g5`SE1FNsT-CTuYHnJ z(q-VT<}ddY{e7hCoMGAOYAvj09-i`R!qcP!acG%W6hHahNg z@$UKKUnO3vc6d<2fokEWc0QRtt&i2s*-P&>OQ^B&-lCBnR+ZDOKTNP6^I~qg-KD0N z!k2WLb|v(e&X)_1%)7Yr-Mwjhtv+=frunQ*udidyrtUkFwzRa%=T}-EY_-#^ZM(j2 z?sa|NuV_oJjyYd#`~2+fvpYA`zO%4#LcOq!KkoJ3o4n}hf=w@O9Pe-4e){;@6(5{D z6|>>>v%6=DD#ToSy6DSxCq~;Bul9)#I|ocw>)`%H%@*2fb-GP$T{peXFKbfw7TvA% zsP4Oy#m56Stlc(ea8CDKOAn9gZ?FGj=GwF|JLw;}c4@k|$kVxN zu*V(mX*ZlIH>`4}e`fAy=kps+z4bO>skXC) z&$PRd9i143g{76Xjjf%%gQK!S#Y*z_n36VRan)r@Enjx^yZZg0%Z*lfTi0D1@bFcS zp0D%k2R=HZ8lY+VYV;3@p_`qq6#lwvg1kLGoLIPcK=7RD_V=nWg-%wA#j968IR0vM z%!sv719y+!{48pNo88FMk)N&I;n)Alj^gI>_89#4A7S1X9Xl5-op`zV;600DzwDhe z|6cT?=j&>ZJ-q6qouaX8ov`QA?hRWyX5nAnf6o0Mw+F+h=wixm3MTTv@5hIC8GW_S z6-U?(l`k4)F605x{`K`yV=jwS5 zTNXTd**BIGhPdVLh*r;Q_BQ7aW7*cj;;6AE$(|U^Tq(HnU3zm+~;pz zRkQxowDQVMaXtTsTZ@@hsy5wqam$yltEAfhG`Oq$d`sf?yuMm7#IMNdd5h$Xq&q=x z9$fTmIcb`ZF0k9*PE}6Fe$yguSLwVNQ)bs|-_o{=+U~bjSxy`6U2nYj(|-KmgIm8! zYNbxt*toKDfsn7P&!JYiHdWJgSCT6DJYI73QtIEW>wfUPIv#Xj@4DZ5d2ecQJu0!oFRRBr*!A3LSfhQmZNzzoMMQ^1YTVerb?g=u z7bcD~8o+jTBQmt5t(;?~R~-G=Yg|OA zTX3X0I?Rp#5h6EFRcnvd9&Sy;E^78D|OmucGSi{C>vSOYZz6VHFOZ+F^EE!wzA!2D(8#hY^ z-y{@mmP}>l3h$pfSHTR#myh@ac*#@23=*ZL^Hq@@SCbvrV4UrE6J8EgFoT%~LXp_x zAqCV=VA9|z)7!Gtr5(9g7aW2fJ{nrlHvc;Ohkf*H@mOXAf`q$EC&X~qvhu6#j^ zFoL<`U}hYjKZEr*kr~eC=Z+(oVSIii8y~`!6G0}BJ=QRL`23u|Nz8e^|G4;2=78il z47rS(CC0OOvosmcgT>Jp-$P`__*R5yvt;DsQ)pc-ktH)+l$z$t2-&fGyvfJcC|UZ^ zvg0wb%!iD*q8N}zOk?g|sU>y1S zC9}u9nG{+3^pqWEAsuaMd&=LR4J-IzPv~_OwZDQN?nuhGiu_2@^X)~BB@4W&6rK1AuO^Woe0q)n(h>yw|(;<~UtY4BiUeRkx+tWPg4%=+Xn zB{VLDcB_D}D}RZv!H4NQG|S0O=TY-vI!_26rt{Fuqcn6LnpG60^E~FmbROCie3@DQ zl#$;AJ6kUvOKcivE(D!?!tG9=^@l@^s?TvgP@V z3yaIM8z$Fkoc(J)O#TY^F!?*ehsoc1Di6|=zY0_ygbn54(ae^I$2O&NMWd3fDj&uN zyD4~dv*`mlTT^_v*5tzee3;@Vi|mbPydn+R+4}P5V(ZKMq%yhI!avy9K1G<)Qx}q* z@)1ucO!;V2@P6te?8*yK54j9n3Rb(g((5Hp4b)L*&x%0!ZdNQ4Zu$6i9bUq z?2CV}4actFmLa-}>*&tLO!tgm2pOF-%6Jpb1SM+9s zOgx1(TsV=!NWT=H(<$7SvnNxy9~YiWVHyVWnfo?vO#7Ah2e7( zKC>uH6~(p|yTXqRGC33;%Y`YOf|qmo6y|SDc2JlqjcpHh1vM15{n*Jr@t}ah)JWKl zVi)*X31L?^{DZ9pb_(0!vmGC{!Y6eJ*_HUDrlGJCKB*`acEu+Zm%{j;8Oetm;**L+ z_NMrxVo|syK8yKqb$njp!?p2QNx`L2A?(hFsVx2YFx6=SAEtVQ^II_r)-eJp?IRoM2e3;Ul;=`2p z9v`N%+1hdGscbFyFqKWkhpBAs`S1#aJM-ZzgnRJewFnR7!#fb(#)tC}-pz+MA^aU5 z&O!K`$o?}Q&WHUaAKrs-6KE)Ee=28BK1}5t!iNhGuJ7KkLDMG9n|Zcv-3q_Eu89iP zCNZsbG4$8IThnj;;}3Sn2PEQ$qv_8Lm_!7}>&!>Qga)w@1{Y+&9~x^NPrroUTBnIr zv%%KF&)!o)KO8iZ#mY!nu~=*PZI^HTq?f1f>p{u)IYtxJj6zrtv~^weasB$9@p z_=&Phgmqk?I|6#!mG%XXoq9MwuNg>~FzSk@*Un8!hrQCN<&`pltu>gi9mq zG^!N)w@UE~`w8@y>Deh1r8QrD`codQ>6u;Y-h)Q8!tdq>Phwir+9m#2atQvQKp2BR zz7QQBYWTwhhTp-Ts?o*ZujlZEG^qvk8~bM;%I{iH5)&7qICBjtiZ;ngXGfO<5H#n? zX-KmPP2Bw}S0;)0=_JL8s7&&X3u6DCylFpaf`df0Fe#j<3iKSc{PyMxX-sJ1&LoAo zwwEL_QxDF+EQ0D$&WZVPA5>lyjA=0UTMH>o>cAz#G%lw#FKjggMR-eknq5chGU z$6~Nkc_@yKNsEj9kuJg#hG7%@ImrB}ME)Qf4gPG9LF{h;A162z{3#Hius0vkRpbw{ z(%|m_3M=+E1aY*kDr|zkJ4h$?*GJ?JGSA@eA)JZ*h4685e}5s7*xzuGKP+Pz{GE~c z3rAc%!5N>94u6pO3l#aQz^9}B_(4|RR6Y(L>?YLrgsi@iB7c>TlG2gCtulX$V5^N? z*aUxhGJlC8f3(~t`1=9@ar@;Xj?N=&g1==5P}rM~mFCGE0zx}Y$ zny9c*I@)3ops+U`V9STU;rJwfRj^YW`8$FD`4e2&pwqB;jcRER6cj?faOyz5YUGPV1#$tazBZ8jG2%F$<7Yt&5 zIU;{e_&936)^H~FcMmW#SH5OQB=&btsXYI%9oA{mbiS?E1B=#c}OQNUn2Yo{o6|9FGA+e4gMMdE|NiTw3IYN7osaQzYYZ*m#s`zRYPn?(M4iTu&}tk~aN_)9jF z&RAbs)1@+a|3B=#4R}*U+BbeqlBQ`JBq=3)6f`LX%9kenuHs`-+EN63N>|Ir>Pu6x zv@9SkBE>Chn$?ovx|XVt;#XRCrA2ux^@A3c-3C`E2ny`FR(IJgtRLVi76q*c=Ks6r zoM}%(D?ZQvdar%2>wO2BbI;5@zq#jo=FFVAWxr+x-b}c0`5ptU#M5A~ZkG2}fkMNGk<$L)oX@sRlnc|bJha}2`Q5Q0}W2;T=Gc=dzuRU$%VyvM-T zP6Ek>%SZb%O1@3#1nis%PtLbW&KGpc%p3zBhLB!Ed}Ln|67NaywfA!M;Vln|w?1p& zcr9pKO8HKLkE#|oTs{jNlzc{XJ_GU14#CR;AGKF*kiE>HI`_lN17D%!#eR9b9U=9v zc@Vz;3gI*442(zn+{$#U8ia37NIoA0U(EpW-3~A%Ug6Av`5Hs`y1_S4{yiu2aX)je zw7<)vrnu;DiJZ^e{UPuv4e^k<4}9u5LFztTWcT4c2(5d`feh!{sqJe+)=dDN|hO|u7i^cLtPg2=HcY}YzQpJUF_3IOHdbX!S}aM_)s_Dd>C|$?hhAh)k1@s-_Eb5+xc6d(3f8z zUbnMWt!Ys6+x>Bnl>8O9`v-nl&0XEGTJ_Kd^))SO{XX>&y|(mR5!B~6jYZCA*I^?r zO9vjVG{=4BxYZo01OiiQ4;tz$8(vlASa7V=P^*SF)4rsRChbV-VSU<>&biewwd&#A z-^Bb!^!np+?&9+fw|Zo)dKBjw&3IxJJVv(~n)=3ahHDwabqa>)@;|y(J?wbP=R-?711bivZ{M8MZ#&5+StB129k-B$7a3Rx$0#zkn`9(wE#uAPm6^m0hCi zr)G1u)$Y0=EHSz^n>|BH&J_Z#1X}5ew1TUG>0z!!Sm<3WTp9{?e=it8Z7^2^Tx+eQ ztkvcld)#6;3Poh^8$S3G^cdAhNQd|71r+nq!{(Z!7yLUU4P_{C|4Zf?-hq=?@p^BuB(WiSix&14=RTkW??st02-2R8W&gq?`ZR?L- z$Cw_k%^jG!sKU3Y<_SZ4opEc4r+!iT?B_}IcV|_XN@#c^i_vAEJ~TSilPVCtBgp%2XhuQ{aWaz{8x15KB4FaKs>b(f012Kt5;+9o+X z<9zW@kkwn+QJ!0$K{ZAGYzhVs9Yk$F8IXpA4uca8`=#oE5=O?AVTr#1H62x}-D7tB z%X~)k3~P;XJz_;$+5I{-3RXOaj!2=J51S8Kq*k+g7kq_1giN*FE1|d^F++dZudS|D zV*pE+Jt!In+ErhI{Z*YDQPD)7M?KY*)RBiW7xh8I>4yvpDht5%`#F~<|-8nSC|Vs9sU!BnrF;4@0pK2XH6HaUt7D^SzSww?ZpPD zH|<($C|qmKwUua~9K6H=?S2c4d3hJ|ip|g?xxle54C>RN$a_`LToL2i06nWz0lmX7 zhqVDXaZ0v|{-(#(5zaX43w!du#eRPkt?S>i_phl|g z2hnL$YedsQx6_ymRbeQ5Dcwb+1?x zG?3o%ugyrKptpCg+9Zs&3uo)QJ~4MO&Mt{_rC4*8rRZbxsl1qn`9V9FcU4o1z6Mj}I42lT7VR#@QRTH1ec}%)6g4FVN+^Z`~WwW;xn@L0DnzE;fJJaXxpbJ=I#<(Nhvp zIK}E}F?Q`Sm|1m2^|PBV2w6sRmbv*=YhHq*Japt%(R_!w>mzg5 zPpx^cSlc2B8y)T24TY_1pgFt!bpu8oSE|_j3TZ6yXIbsc*Uo%huZr!-1{aj=?jhg2 z<_kiK5uD9Xyt>`$Gd4vW{jJrt+vsypkv2MfHWVjN3&HrYvHADJ*fcbcA?8VluZis+ zvGQPu{@+-AmKreWD9_dwEIpebLgnBfs&$oRMEZ5zT!Xj^dKsZXoMr|JWpGt)wXRmp zmBB$%Ir(#Ca0kt9wWbzR8hKv9RKa0NBWZPPg0E1E36bneir}OP5e?FHX7|34-jgjV zq0OS7(iUj(2agHD`#aIoy|BnZtqxg=uHU-W7t7w`#VDkYs?p# z(M=|xn-t=V<`XoEUk>XX$Dc9RmDSW-sEIeXAGfYMS$m+z7tv8w^R%`3pyANlkfUaS zqxlZQq5^cOt~-qFcbIGJ7f5e!E+Roawr88?1%r7XQZ0cZoUYHLS;C5;)H@y&+y7`j zXlu`PImtZz7L#vpxqBD5%?$35-r>blUi z-P}~=`qXGWYw-6tDvqrR8oItPo6lOogLZhr+I-n?vFFR7!qId`GgM8d9??SCH0po% zSLUPE3vepgbYrTle>!MB+PS7;=LhexoEMMYVD4gKboH$1h8W+Ac~Zyo1&Lwrx*(i4 zA~M9(bMo|cc+?=eXAE0?NY>HQj^?w5oAsamlPPC4B2`DbF2L#2kKrI-`cX%b^+t6N zrPyKf|IK<7o%83^IiDWdSl0Eawf$|Y9kY_p44|&sSz|w8K&CdHJay>O>1!yPs{A{w z%^yhh%g^NY)U()7Tu7+DzuYIx{>C+I)I-Zc0IK#j!PU5?;kKbJ|AmIzt^u0+wjrc={I;m0(7tg*+t2f?COw{ys-ej=rV3JVwO8Av780FC1{Viyf~wX43Xybf zy6YP^RwXj0ov7^^VTT&3RH4s{H02fSo<~dLBddFe+8W)dhZ7OB~(={jeU$`YZKFDs{totL|Ljod-pG4v6Bl ztx&JCl%Dff8y~2Ua~hw&ghOOrYOPK*O3GwU!0n77&5px8^;k!Hs@%>Iae+bhuo`T+3HpawJJWrQ!!1yDz!ZQ^O_NvTcxR0 z@%f>O%@0+4en>fx^AKz;{RV)}JC2wwBeOa6DOhidg;GL0uPBo`G^HKTz1> z-#$GYomaT@b|LC`AP?EUL)%t%B>Z#LWl~FtT1E`KmT6F#DBh7`$+_5KsTx&SCZuLp zKOQ6(qHn3L3F@JjRRYji5G_>ITjZT=R!Gu0WhU>WusOk&6UM4^hE~>#f z`f=*RY|8f5TMMMd=A27|%3w92JWzP&Pp4~l;Oz%XV!ksTI(XNKdZt6b!O9^{E+&fGR-NNXwCoa7qtaJe2)X?*ScoJLz4B+};Pu?an!;wzObyUM;og`8!Kb^Nkv?hSkHHgF!qM`I9UxugFM$; zjTS{^>_n{V<*Y5bvi_oQDKAuV+3Gc!&X`Q+@Jy#E6U{@)R5h|n%|ys_#`k4vhzP2^ z>Yj5<1S%_pkTZ9*x+D-=OlfDuD`jo^PSaPa{jAFb`Me4mWIL>0maR$qUuC_1qgq~+dSvt4{waf-ahoK;a}4pJU{8B zcXn)gw4&q5Z*O?}i0%PT`klX=oG|mRtp^_eP4rKK8?LdXS{CGrzfQX^@z9x_yI$14 z_s4?F3E{rN_g`-_+CMY@YOnv`Lz-FR&i!ZJb;JJF+5YVOf4=eadu~!a_8+Im*M2no z#N`o9fB5s(U%Z*I^!xjtnX&EU(F-MC#wM={dw%1)>#7^A`{&KR_JxUGryO4yZ*njG z;Nvw7UrcQo^W0tcx+2T7o?2cL_0y#Fi}Js6)_>Fdms=`Vd>+&F+neKF>GA%(Z1l^! zU#t4R{r*O4NnPxQHcLfb#$QjCM-)x}k6-++U!U_Ietz=U?_U3l`HzoQ-E+bF)-!AO z&!15+;?MTcbKCD;{?A<cq%#|M=q2`>hxMX8YN(9iwLLowxbyhmDR8f=BMC zPW`}m^x&8me)rkxnxDV3@Ui-D zr+v9ocp~k&qt`#ZGT|0i_sxGAzwxzCGG96H={IwXN$Q4|3UN1N{w#-dHRTd>0=^rg zt10>Ako;=O5H5VrL|p8`N(#+xtn3Rdb8}ajo4eA5l~?l0t|7d*$8rE(*;VEZy#Vow z8`O+(Nm+Lkul3Yz-*foH+2DI4zx&IJOXjS8rfKm_A7_uKn2`1K$gsbDvVHt-O5UDu zuBropa}$eCe+Br^Ebz7&E`)_Po(w53P^ca_af)QGc&5cy`lA zuO0rc8@~EO{U5e0&MrIu$jMF4l$ zZrYx01ySpMv;WnC)>Z4@UUQxA_H&-c|6x@vPuyG_Gr}_Bk-GN!b1mJa_VKs;-0D5` z{56fsp6_^Up}l+2duJW*4V$^A-1*PkbN`N$IJoaXaS&#pJMumjrB$gB?><#Rgs_w! zdV#wrBnsYscAK!ZpZx}QzW_sE{8phyj_)}*VxiV=$$RA;e2N3C;JorqzR>V^cc?Jx zeqVf1c$31H?4v{Mii=XpNw8JhnTdg%}}90Z8G$ zm9gmDXf#gh7s+_Tn0<_Jw;Vo+;hBXrx&GHO|9D}$jOSwZ1Ytyod|!sd_Y3fm`6&*2 zMY9`EQ0{WIBxsR7DuKb-2tmZwDj8}8VjLr-dSsF47;>lc*f1mUCz|mClYl=_ZaPzm zma7S!FN=}oqi+F;ra0$AMxrUsU&}NFuajxYryVj)asFPWDb5!Wj>6KnYOl()8T3J! zjtAX_JR}~HD;W_IO>&VD&G>;~X^)d=mUcN^B!_5`-0Aza7`e+JR-!3fl1x*$ESaWo zewilun`D~gznvPC&G>=& zF=?p*UyR(HJt@-^ZmUcaKJ}r*L-?5_GiXZ7T$!e{{9UFgEo4NwNmKY3?22&1>i}h6 z41vf-l)D5bvt0M6Ea`qSGUM>a?<%`TrpbMk!kz3K$4u_jm|zy*kJDu5Jh9|X4NNv% zW+sE&1(Wa(qJgBh-Vp|cM>gkt%b6?3(qA)ldv!)_#^(!crGVe?s`|r?l0kaAJNz22Zpjc zCWeu0)FWC0D`gqc20TezqKS>Nm1xS>WSORXrEi$X-HfM0ruBH|>oGEJCUWO^0oZ8A+bJu*!=(HLL|llbj29S=HB zrb!;th~XpYhUzP>D#CeFb_;@SF)oPcea+gfeMH1|)eDJ2ndD12codQ_ z%3FQ7Ph!Z0K3CpwL!3W!-%hW8=!H9dQPAx)?Eah(u@V>Gjq6Va@d>$(hoebJVPOWA zRlY4`@SAi9DU^v_qv0f<;(HfY+#7lekJ5+krlN~=e(>=B|K$E07JKJMZ zB$vtHSHVzheN2?rK`w*oV`P`K44ym*jWLCMr6J`>U$rQ|_da%03eP2$)7)`@Tg3WA zknWHAp}djP#O~Ju-#~YK8)rmcWhHPuy^_J_OGPyc#gs@rQ1|7w-gwQ_A-e0LH+d8;;irCZg@KM?$B|b{;7f8HPzP};EIR?CY=@TJ**pp;) zaN;4u!*qg=XgfK=yc93RV+T#~ksm#yL-1Tkqyg^SaJ(TQc&!RNO!<59zCa!*(@_IF zTIX`Z@je9~(RSJ6kHDk)LUxLu{763fE?9{-5}7toxji2u-+2WdP4zimbqHQE@Mzu5 z4e^nw3c-sX-&by!KJ?;sgI3D70GYut2#3@El4(0R!c+i{(r3pX&Gor_e*&$^uumPw3{ z!l#AcJ*~i_^5b}mLdwGfJRJeZhWNp>{47uHx+nvKdv3_wC3Y@KLM@8TYz@}^qz_v zj&~azlz2}}#D_d832&R`^CiNY%!hb^u}>n|F9o4LYFqT=>3so>(F{8`;~{nGLEAbimweAVcD2Euz&mXFJ1!n?vHA@Ne)d@JK|uLtCJirh{- zWFk;t%I|TxPo!68$X=G8&ebbztDNPl`8T;&`*t!t zF*%uiWNE(oH{PGgg(uAw6QD&!k`CuzeX5%0+ubkwUl<+N5`pjU#O7Ap<`>1-rY4m; z0vkF0$J;lwg@GXl-G^?PZfy5H|AY8|C~A*>`mX8s2ZF)&J^t1xf0Qs`beB6q^lGLw z<(P!mZ~YT2I7HeIp~9Cfu8rn~2({m1_G)G~RbL~#zUWnWFBcP#WFm!E$4cP}`zDuPOXSD0uZnNj}JUCSDZ*KOO^|8$!gQ>NL7^1vhF?M6^!S5?S-K)YUGEwv?2EOlW3-gA@dg{cex@~oz z?0=7!1f}(*LDEV|?#pK@0WNGw2-?qny0z*dZ2=6Px*t$AZUA#}V z(d$*EjSOped298zL49OSk6f1Zyq?^G$XZ^0b~~Id`pa!B(qa0 zajXUkwu_~Qv=A!M?#T z-*?l#fSKxz$3|6f^5wz}2A{F9Y>O}2bW!L~byhVx_lA4Q$aB$mECM7xEqza;m~#f7 z7su0m?*Hovnj1$8BXGF9^1VmeBtO>lQSZlqI(aWE9w@j3zPbaXH1)MAxp@< zfX*qmXRTn`F07A40j!Uj7CyFHZv0;%RGr3Wd12I<2Axo0EM9hUYx?XzQZBG=K#MR1 z?_Kh!yz#yms+MUZry$4zu`Y~wX203Twe}*o#`}g#TtmxW-m3j5sDBGdX{3|$`tY2S zylkAXt+T8%t`m<-?Y^(0VjtZ3jBzjf9#yTa6CVxtiFi!Y=@)IQ`-u8txgF30d1fjS z8{<$OD2>K^{7j{+Q-0S#`KmH)6Oj*|rCwFzL{!hl`S{sEM`#M4Dr(uGnjrHYT<^dZXm^#}OS-aGACkfFV! zXy{igkS9y?nSH1*LgpXN?8AEB=}7k2-gy?h**q!_b1O0wb2M(Jt&{CPWA<^vU*z~& zn0+GC!vRvD^+_~NV$hwN+!#R6C(mT4WJ#acFXZr)Q=~s^MF@Y7>`!4R{3$tpDZZP8 z9yxuKlcY~d`Mx=Y=k6?B zSnqSg_kt-;`t5hq3nmyQ&p3&ut!}>GjiqewemD7w3G^$U6HvU2;qfvYN(4+i{$fZF znBU@$=-zbELK_CJOoSMEDJ2^&rxJ(BOqB$Nr3-W~4pj~q#zUDT8;--=X}!zcsWHM( z)gs+iWTJcZ6RcQOy14uv=aR)mr7NA~q#xwUy&)`Sm~Mi_E1fIuSt6;aSY8UHBCAWB z%a`A~cCa_}R}V+K1plol|GQBQ3cmE7`>;31Bj=Z5NK*#}cYB;YyDFdqv#;o|S7>{7_DkAPSy=L5l9Z zclp&o6g-1~l-`HU6=*(QymHO*tHTY%Jut9y`HzF_;|txD{DDG3qq$nj`&b5+uZSn* zYCxfk1H&O1R|8@!{Zy3<*4C-`QGKrl*vB%kOsnrHTZ2>K_bk4*_-asBvR(;!U%8Vs zO5cP1*B^yDAU|*5SEyy-9)oI0p|;Z-vw~~DuA@IA$G)3-%ew`|%ON>mSYms7j^4oc z7Gsw`Bw_h7!T zL7pp-BcDc9%QW|r-jVeN>m5TI5P-rc`S|!s+?;*}Ohnts5k?;=&8uz)P4bW*O=H|4 zcy;90>$^3jxy<4pzu*535$ z>&-jeo{ z?;!;q%`rLNSTOU!ww#rmq}N7g8P%$@wk^>y;1J^!3AgRe?uS zT8{Tghybl$4*MXVi)r8=k2Oh^DOin)%f_F)gUW)>6SqL7jV`)vz z4ad7D1W$)XOYN1?I}U$bz9S%%`A2u_aty-cG@auh+D?uzbncqt(Xxj8$nFQB#47> z12-IRIrxaS%O2?pyeV+wc(c&?EAeQblVea&PG^CSXgfK=WGV3IZ4voVdP#4m5|4D% z$jeFi_TgO{f|sYjqyC)ZtpTCL`xWd1wGS@0og#s`6L`FR*kI>)b3^c+fIW?ckba1d zOfCqb?PP(uPl1;NJNZ$1n?urjSPlm-W{8i>iy`U#l_I?<@aK4shTt8A$5e(O{ct=_ z2%b-YN9o~s@1y=I^Y0Qo2Fkxb%k9Q4$MqXUdg<*Q$D{8llz1A*F;M$>H3aW>3OqW; z&GACd6}8IglEq+rM2DU$`m-Xv^bU;U9YVcV%J)0qDc?2{ADK77N3@+RFkK3~TVUsS z*I=Ti#JdE%f$}c`d`i5}6zO#+@IFR(C7uT1sK4cg%Xd=F2fOT{L1p9hc?R6Le7^^+ z#EX~Zkb^NkqTBGNly401sQyxanl1a0eG~qacnQE84>xYOe7}N&5-&l4H&gZ_ywGzU zbRL^y5GJRo4^!eLEAVLiB0s{TGeJuEZU^2#{R_*|l0)zoDDeIhI9$FJ5RT-dxiy(55pIb@vS0F}KYrei zdwmN&r6C?N-=JM8&l@a3yyQpqfDGp&ojqtGz2*||407A&^A}nd(9&*gIdtvH_sU=G zyg^zTzf}I}=M9cVOVKB@M*`+CB3;IezaZ^Xx&05$Odsk~S-tHak5p;n1pUbU*TXe9 zGkv5-W%aecFli08Ayt{VIG&(S$n;lfC(>U0%=CE4JEK7M_Na)k`y925H9gbs&KZL} zT42!zpa~GX1EUWvh|Ur5TG0Tie^hX|GRnL<<1ZjW{)cT}@5#NV6v#JCt;> zu+LU`am!=_eX^G(2>pOKQ+*xnT0m)^~H^xiW{$=|$P z>?cGi3GpxqK^a2{>&+Zsn>MT2CMRt`o?yWjg)Mu4JB1V8t=P|IiOQe?nNG>xz9F_z z8zmJ~1Cle!LS8IKWL^VvSO{MIg#8}}!6e5Vk`FgX`LHcUti0Hl8Ka__nsoY6xOAye zXWiZYLaZ)ody@`UeIgehIQnT^&d_rq4q=5#KLQ!8*ZH)_@)t(uBOWcPSnOJRu4QJz zX`dDc8R#~_MqA}~+g{W}t<~boUE)k2P80)SYmqHd9*7<-%LA&E+I*G+l%svQN%HI% zL>|g;_|sVx$ds0z0jQ-JNrk)|!&tT3oZ4HCtTJun4%s;()|44N^gzNkXP64`lVyzLs1@V>kAQfzkd@N&u&A(i>j#C z^p&Ul-D zYjTTaI7^^71AyCsBg5DkfQ2}`F*Rx)4sV3v+=O0bN(-MgLO&Ym3lo|qnjX+nVx=Ql zxyD&DO|J^vbG~V^)}!?sSrXj1m=D`TC&J2yALRRX{|$;ykf}Q{ zW^;4(GYj;VuFqU~{{fBeeMZf`%v9P(_1-_Q0?w*_vsijZNpB_kjQR?HOP?pG|H+vI zC4gF>RaBq3@_T>fDuCj12rr2ee-|Fnm~l;z^N;2?(Rd>xZ&@-X%8ff^{t3)KLbzFx z-{dcQ_wv)bAu?|KMMHCsRkmNx>_de|f;sc#=U|fXyUC%lw(lKC<^cBE4^l z7Gj0-a)gq7T<>=@^O*lc;aQqQ!qEJf&Ln(-`5PI@euHqnpMR3@t{mS(;E5J)60Vo| zmoj^ruu-;4^4=oQS#fSC{S6`caa)L;);eU~#~+k6C=k9 zQV_`jhWJF92(I55205;5a*rSm$qagiLCyzdyi877Y``!%LHEXMk=$9lLnNAh zMWy>SgSgX+XW57Z3^N~p{mw89AP=q2_!$P4&qjqj1MoBX<+(kRA9Sz$2^6bj7bi(H zE8ocyP08kEM>PMIe~L^KPL52I|9XY{uVk9={4z~E|0UDpzFR?eDCmC27TAJ^pIe}< z^;I~&K-*KwUA2BYT2hEBH|>9rsc&;m3a;GP@3&FU_SdfD;hX=1?Y2rGuseG%7H}mi z7MCu$XXSmR#ijRzeo8xlls^#a%6&R1qH^cj#YJn1i+>Efg7+#%7bI+UGGV|CQHB2? z`|1*h;?%(p;7DA9rBFI_Fqp4&&frIG_De$b?dAV~Onpp)#T>em{{vv5tb;*H2XaEW ze*k#k0E5Bbd-r`f3LqWO_@SL*DVql19t@a$0gM=6?0=bd?SoDF| z2ZLU7Uvc`67W+!(!C*_BDL)!j$=m-#$6)AmR)hB+sHuxrmp*V$uY=+=!(id>EnRZ; zG9o4(iQ=pSs~y*0sd{a&4srE;_m=6aJU1c;KCPl5 zn`rJOy$2%>$?!4rc`$|Y(OAX}=c^9kn+}F9&V(oDs{$Xn`umUe0G~wZOe=pu$A$Y5R=a$3JgX1j-!J{(| z9FL}M#7A;W4#A^&Kdm9S;dt(l@`y(`9cRLm^Q{LT(RSI7&K}U5jM72#cph(I2p*kn zpt(Oc9Pg(gcyv~P$9EOJ~VUq=WY?PU&>e{Y1~@iPE~ zH%@^^cOHSYw?Fs{cskg*;pwIO_>}U|8310d#)FysNInAyCEj`9(Hfl_;v*9Uf@nKg zU}(>twvz>h z_Sh*r;Z4CG`H}taNS`vjOXP6yVutw0(B8BXuS9`24gMVO&yoX>PNWQ%xc>D|i`kbM_`%MU*0eBA$fcIPoUWWqjCIwzqNd7%BhMiQYq%3_mpu$93@d0VUkCoU ze8)rZsN;HH4nq%)cO(SQ4!q^?C%hRlAC>nj_#^o!E;8=}Z;3>*U-F~BT)Eu1*UdCZ zQyAhQ6ODM4d(Jf9B}4I&;e2m`50Jga4!m|b4nFQvJ{37v-;X8tOW_JVsN4nASRCmaU3(7EM=|TJ)N)Q-`frElqxKf0BSbB>JE| z?&ZIX?VjENeJ(v-$0TvRDx)eL3UAw-w?3S&Qx)mNIGtc_aCAYp@JylIZS+;uK=ReFPFjIX~*6g*rl6TyCM}k;lNv~S^YJTiP znPGyrYH4d&QJ9#6=B{=7FS#BvxEdS_j9vIL9dSKmw6d6L8qLf_oc`w>8jrRwQikm5G$cjML;X7W_{Sg_KNw!&z*ztPZT-|!z z1EgN2_~6LcZT=TlN9|r4tAAi0J`9gtTYOlv|GVJ&$hD^Bt6pe-;LR4je5JtalMVV0 zwmlWqq8BGTF@7|+VYfMKWampD(4m<)>9oO zz`r12C{6~rw$qowUDyP>@fy7@HY;}R(p^zGCxUw2&ARF&VZBx#WlD~+Kkm>k^Vhju z-gf;usDuUi^SYYH9a}w#FaO17GcAnBbu?Nw>{jicARLJ>jfiLy^_nsFPCtGmVuj{r z&9_Fp2zMX)dc!TFH{qm$&R*l9jY514?-OG0fMUi^F7F>M_>+tiw`yXua6JL)MX6m3adFOZD|C>}L6PW3;+%sOrxWIg*q54ec&;wz^I+^@?PtNnIjWlu z&(&6+2|gNib5yRQS|#K{ab&Al^Q-ooqr94F>apEOJnj>qy8B~Hs*^s*HRY3LoGvYt z|7cqLF6hf;T1t)ugLAHtGO*xA4LDi?nmd102F`GNSFRpB)SbUZ8j-$&4+s~b=I9Z` z^r@g9L4n|>73gDMeYmNJw6NrS7c`qQSu;1|Lymiw;5!}jefO-s@5U?c`S0b!HFf>? zWIX_pLVWJZf(=EB_WohS`wf2_FC;*!>4D+Lr5* zgOBc8o-WKdbNiN;^JX7&?0(X=C~C{C*(GZV06o7v@rIm?6{QuKcRL-6Zoh9?MRNY? zjJt2mnp3nYduDoRT1npQ)obt0S+aU%>fHHjXWf=J<+ime)+Rf$^Hvqyde8lLWZ$1Z zuc)kGZo$2Cman}TBh0^Ho3KLcs|Ej)Jwm#>hm0M6B1SDb|4n8g{zQDotTbvtv7rDD zb-z)L>_*|IiU8ENe=ggtz@_hc8$$dO<@j98KSFpa#Q**fJIyo5c=1Pja5PWhdo38& zdiS5qGEHM8y%(WIJD+ zvhfX#-dBD1EtZ+kNi4p*#97X+cKz?(^m%tL4Em78_dA!b;rDs=dnwr$)xAqNL+A_d zfp`W2VV%`gKzezk%Oz!K>ILzMBwgHjr8|Q3&W?oZulO)a3IJ!@^|XHZv4-9UQvKp) z8S0!LZrpH^p7clUii|Xel4$xxRbu8t{D$($O^o?-zJI_*w4J%)2f)NfYkQK1{K)6xBreOOv+hJH4}?x1_7aGdIZsx{6Os{(X~5nMaM;oKM}#l$Axh>1Pd#brdV2&031 z$gct7p*SfnI?tAtUgC@1^2+?m4wu)zBVxknA-=ecb*&LmTiqR(OmBT}UA7uR&{;*q zc2}h7Ni~G{PVCyxM4;n<1B$RPt~6R7zF$RiaCYqurGQ;Kqew92V^~`BYR@oJy1L6} z+^bt3F(KCA8TWt(kvHn19;rQW$@IYY9<>*#-qkAI(}gHkM4C)$?NFR-TM=ejpvIkE z$aUn3o*h~vN%w~fzPJaPnmz60EZB z1%uZi&7SCHk8#5*<}p34UmC2BJL-c$oHJ~U+q%^k(YvZiFvv&Vq_WZvpZS`m@=#8+ zV7v{fgB&IcX`d;NUVfR=Y`nUnZ!uC z>48f*bgG!0E@kqV64bspy$T2Xpmwz8Z~oImj=yETtP+OWyH;)TuQe2WBE$xZ-#Ht5 zc<+!6PoF^Oi&OfKi}vY=jfM>y*Y|==eHnl9^?+G0m1#o7nN^T zj@r_y%E=b=5q0%-o6y**8jzGvhfFG)dc0}gM7$W#ZCt|Z=K9D9uc)eRbgp)7t7?Cm zps#RkG3a%Zj2lLY`jM+1cWi941%tU|J2YKt)a1B;xnO*hK6Zzu&DrZPJhCy~6GK&o zPLuAX>g|bNsPj4NG^Q=XqBb}9gZdZs%TI(oaOTTvgj4Sv^{+JSN)J%J?_9%?@4=Ap?7De>K=J||U@Ik>l!HTlh5sed(IIzOQwEfG<9&b1(ZAWl{xPO1J^0(D* zUb(bJJ*yaIdQamS=i1;$58=}lGzoYj<0b}kpoThL9lHyt>`tu}kp-{QrDk&P1M7Zu z$2h8wQ6Iwj1hrhfc7Ftx%2FRCH|65qrmTfK^sAx@#FgsSNllnlQS=$^fZ(-JK8X6U z?^}32821GfQ7T#juh~~VQ%|zGj+(Bn+y_P6RkNI>WqO@{g#P?p;c3a@T{?Znitw}y zafPn0EeTq?-?d2yv%6fIZt|@188&(sRBd=I+*gJ!$BmY$^X~M{^VaK4rJFpe3A&$G zIMFz?7IZzP)-ZjNkGNk$9FpRxn)U$);tb$^Kfh?rBsaat}#ak`e!k+97%FvPZe<}~c4Jzvo z`6<%TS4VH$IOZE)baS0?L))lTjRyHeuIpjP*4Ey<*{xl*+JFJ=^*5}Z=nb#O`r>MQ z{@R0=x?V8){e|1xTBF(`V2$!@NIhrjz)V9inCodmM4={5)vfZhBj{%T-pGy!VT4`y zTYd9ha~ln&?aiBJ*ToihL?1}~XK#CCX)!$oJmldKnq5gZ6~g^dRpUs#>KT=3x9Cf# z*-FB+MijgykQCbsCI_EUVeoqql?-oth%X&7K+N%ERpk{jsQZrc$wU+@TYlLry0gI(zz>Pj3F}zQdQ^`~64LqG*Kt z@5r%tP&xLJ9D5^cUNoCNRd3m&PSB0*-qoh{s9om5vE8leMjbvz*&M5`e5<)l5^9~; zF>d$a4t;0BZix2Y^wCJtfxRF3iQlyBvR=RIrDK&}qIEg89g|CRNFBytaHn)s<@W zj7Kkjqt6$C{yy=IOHsuI+Mre=G+7+1f7f>M=JM5A~-r3 zT8ii+aT2L@*xEhSmCJaRLq`2rRu1yV9Na^Z5b%_!^QzrGO^wH0`R#_L;mQC7+tsCj z-mhnKc{Te02L9_KH_sPoaAhBI6fDAIY{Qm!^(O6k8gezPS;=3z6&4m&pOteEaaCSc z!YkzAbx9gmsV-f9X2{GPtTz4Fkri{t^%}jlG*G%zA2X}IbW>^7tg^IPV`3nIVpaD} zPloOd-&H%TJTQiw!Q4J7q@kEK!cV{@cL@Th$nSCiZ0z(;Rk4S_LbsB_^M zb`$VRvq(i%_-~P^Rbryk$Tl(D9fI3AQ9mrvIU&(GULRiWv@osoEggar`5V@S%SUgF zDR+)5cg7_;E#*#gx%0Y2=e6a|vE|M&iO$$^=jd|hs6^*TcOcj89HCElJ57mBRuMI9 z9$wkAEkU*4j@NL8N#|Ic4GbIg5qlhw1ufAHfeLUk%PC{&NkoGPJTX&R8v@HQfx#pn zY?%hw^d`*fm^FWBgJrDSGKN|r8WWAVZp+wpx+2V7S;#_(@3_8nQ;X%g28$VNV8X&{ ztHFsYi$O?m zg`@y}^TjAc>-weNr^6k`I_|#@DT?eo<_RE1OqGf*$Y4xfGi_!D|eTT`~uIUiic?{AX6XazTVmbRQWWTw%4p*SQ zX>7M^ot5(=K9<49zoXoiET&UmGMuV z*DI&RijBuQ9jD7KYmtA*tLOYR&-j}neDhwvUQ@g8yf31`GNLZBc3+P#qHeTLTQ~WG z=jy5eFXyObYTF$wy!-Mj6UJ00`08DC81#EeB5Ez8OCuV0x;FYf zI`1f{bUG*`suDU~R(s0-1$#^2cBv5cx@`%Yy%w;RRJp2=F6LPwvF zQe2*s685Q+u($R`^<@_ihp6;p_eS!Fiv9sfa&7<*!xx8+#+KpTfW_yezd>MuwQEGl|^H_{Z0OsLzncCWAw*@!P8N~7<Ix#h$2@zhW^ZJ*AoyQx?@(`*W~z zh;r6#>ve8twA(qUB~apEUA;!A-1qTlRnFalXS@e^xb8@+J zQob`G-#M||IU(O^%6ASgcgEy9N98+5mODo@1WKmsdB5nk3~Nki9SJmd!*knOwfd#4 zCv(Da!@(D=C%3g~^z$*doYOHGx{4*I2I56(x;HI&&quxt=Ur$uwW(%D4aX37iT(`SXbc<-frt;nq&il~(xES56t+@oYfPuZWMhRCm76HRJoO?_k zTx*pAE-LG;@PZG&Lsecda;nZ-Rc?uXl5Kixnjy4)P z<3f;+gROzsJw9i%x1C-!Z>(>$_#4el7SFu4z^+lMoWBP>POmK;S<6x14@kI~#|Opr z*f3GD75FYmp^m6KEmD|h{orBBe1SSk&c2{0V9E{GtIKfhear$m-Xmcr)Loe5qLpDZ z9wap$OE+HgTk_CRHOjfr;W(j@!j)?V4;O&6fr9jJ!NIFfi^b4U&lZ-RV-s}4k)e$z zSy}2;>5iPp;LTy$h#(clNYlvgS)q7v5e1!LO1NCv<93b)7F(|Y=m;(CFzs`Hm($G# zK#XBMF{k4@hjm~h!!u!_jq7TlDo)IDH;*%6^j5NG*lFS$Kg;2@VRyp;oelwZkBNen zjRC-2XpDLY>vtV$Prg6s#PUvuT5Uw`=N&Szr3o};Y!u!~irqj;4!Zh{uy}t@TbNfE zti@(IuolBAOg~~>RcTqNbKSg#fZ2gICa-laU^*Vt>OeeL291ZsjNT3%Sd$Izc$y-I zG>Nk;lZ@-C*3DxtpVu8*hqWCTTLM;$4>SgUszU~N9hM;a2|7x5B(imrX|~W<-vzxS z3(Z2ps)&2H$Ojn|k#^BeSim=5U#C>v^JlG8iK^^pZ>VrO(mJl>X3xqTjXnO>@d zzH_{y@MQrF+@aYfF!BImVkzlY8E&{z>;xPa*b-cHj@VyxRa28%DW z1h;ck5tf6_5m*TpIftXicRPm_(Nx3ic3wvy7<}lJulJ<)SZM%nylJ)X^p;_pC{V#< zl_!G*`Ol~?GdFHvDzxLl{Y1`i&u2)_BoOO;GYP`lt#5)|!mFXQ$BF)3Ge2B&h0_%W`a~UTW9?J-1>|9u%u_>c! zVOfSV1FDD`0t?1O1%fpAp!nBEI)cH1G&HR_%#}G6q@i@}N;_(8a!X*rzJMKdU+S&C zK}L`1<1uZ~m}-T3jF90NWo|~pUEmbxTr7~;uburSv)=^vJBIxl@SFEbgJ}UfM~f*D z&e5X3f@Yn1gs0*}%wtd@*a!eTT=XMyKEe>howviG`k!>{7Jln6purI;~c<|3FYbta?8` zXDkOo_RK+~dOBi!#vz9(7mR1&&Fy;(BLKI=nOHyiC z_9IW&U=fanMJa-vDP#&iZHiM}3B3C=$xX`39Gt%IgD;4@SQQLDQc{IJ%?8R#@8-Os zdw)+WW^u_(1Pn_{Pr3JBB9{d2GV>%#wcf;va)l8?3`?CqHRWEYH~_W zmMv>WN_uK`YKAR6*^!g%NU~*TrR1a}WoIO1rsN=Kjw9KYnr=-`P0MuHY*rgSlt@m_ z$xh2iNz6`6v85#?rKP1?XJlHlGSjWusWyirJ8edKR@RKv87VVT9geK*%%o)er8^RH zlC4=O*{MQiVs=_~PF7NyH7zAGBgdMQlarC2F(Yk8iZumtS(B2p5*6z(3Oii7Un2{}5t*NOFTSmGqJ#~gHeTL1NnV6H3ot2T9l9-s5 zlIX}tPqJpFW@Ok>vs02%W~Ap>lhabL07yq3CMP*kGLkb>GqbZ2(;Uc}tR!1jvLhui z2fh%|k)D$xq*@alnQ7TGz?$Yr%1X^lNu@Llw&qBF494V=(Ntwt9TUKTU zwrxggN={mOc1o%v6J?xjOUz1|VNJ@&Om|ol5r1|{MpBM7Gcz*_&^fm389AwGX*LvL zPP#Q21u?_sNV2BPaO9xWGjnW7*7P*wM(T`ITUK@oYK9e6!T~jqX^s?IwqQ2T&6~x} z+MCDO%n2*jEMJVz_9tC=@LotvNk!F5N=mgN%_)hHG%*pml$@5FW<@z>I5Luj)Kpti zPGYJp6~&d5m6M#Fo}DoxD>;3}3|ms-j5LSUF(V^sMjBE~skUY$W+!J;y-7<#eMWg_ zWM`*Xv#hBpX*1H&a+1=LvoowoGqO-|XQU=4_7gVIobdlK_a)#_6)2Hg3dh67B>)u;SUg34h*g-=_r^1BM z8AFDor4AXIGCV6SJr%{CJ~}HUO=Q;ap`!+I54tf!QPWeih7X2mnW(6l85x7Kh7U>` zl9e_%YiP!xQK)yRDPvMoGE#<*$w*1h$V?v=5b+>)a{jX78S@t8F_%(O1|d}$qqDM5 zwbKWW8I>|DD}BuH(W8cr9+WvIYsjcUS(zEb&_0I_8agN=6^(B=GG}zgsI;uC^ueP? zjT(Y-9fk%lYH(J{@X;wKw9zSywI}QvC`};(A8ueZhB*I3I5yr2SH_{t`D^$%kq z#fo1C&Rf$d*xqJpZ!J7I0qo_p!-(wZFQ2c<55=(dTD1n1;| zk44AxzRZ8lSC7TXWv68Pa0>mukpY$A;@)}ha{@o8FRoauWa0VlB$iJsR%72I!>0&$ z4`Y^ev!=#kSLrXMeQYVQhTE8czD^PC8!p{3;A4$mM!rmcoN%9OI7TI$nFQoljy zPdDDM$lsIsNl?beHS45WT(MZuq}KhK_U0Rx$^0|j^9=4QPhw9Ui(N)4Wd08p`MbpM zSjw|P+H2~sGG3MXH;M48*(vym_IxDWYhYKb;WMt1`9&ql_ey(}n`_1uQNC5Cmun?r zjcVg@OMSdcx-WoktZ|p&vf!VR@=Jxh)`*pOOJP^6ai1~RQos6G^7j&%UQ8i@K5He~ zv|N10qOpw-ULq}ATSwxWG4hlP9WJ~BF{^Cy7RG244%4Y{n0&S7j%|=UG5SlM7>tts z#K@F9F+^M!fdPrQWV|9S8Lx;-+E4s|cnJVv*{Zd50w4aw;N4NJo8vka^2C@Uc^TZW zdEo(~+osziZD8AsLqaJRYw={6&z1i8G1uS0pXnee9D(T-UWUjkS-xk%OYKwHnY>mH zRM<=CuK>Z@=mDZ?z@C-5zg9nNtVEzT>GBG1kw>=iCNJ{&Y?Bx393`e3UN%-%kjQ7* zzc6dKZwvENx3gCtM=4U%WsHA;h~@P2(36iC#6-Vh|&t~MFrAFq62vtC9)Y!>=mP5os2 z#DQmAvn9{8kZjYkCx+;|;7^Rz(w}ybRGk<7m1=bK zpC!Zs%SK~C!k&DS7j=M{0ZPUd2cGe!NuIi-0Q_@IKi!{Rac<4Oz5Mi=IwBur+ZSz3 zwj*Xi95VwXY><3C-1MhyuSuS^eI|M0CD}|Jf1b#)W|)AqXTSp_Y>?$8Z14(iv%SlD zDBAlqra!Y))hjo776>Q_mu-|_MINgDc>w*-HvLn`%QOxqFYk|iz{mA8byzLP)7~=4 zGmQ^Pp7x5gLx=YMDE&p#W7^?Qd%4b^JmbGX@(f!od4_#N^2C2m^0e`&w;2^*Wp1Ol1 zPhBxS;f+F40H!QErr9>nRA8EIUXy2jsrD|)SJnYhzOo$M)Vapgrzy4~lV>_@{Y{?v zYa3|t%sU%z0w7VovfR_*R^`s|cN_~Gvk z+y5;68P7?{)82DgF3@3`vLx>Yf2HK9BgzpvOw*UrpK03eFvBuU+hHJa$S*|aLZ0a( z*%p|;>_+4InLPh1f5sh0KuNY@lVO^9XaNbs3nPv<98e4{@|2TQ843L{rXTY~l{NE4 zwMXWQP4;P`Ol8^829^Kxk7GhWLvWENc8=tUE&5pa6OYNGjtjpI<}G+)bd@~ID_!!8 zhZJy+W+8)!6_+YlvDYSfe;Oy5{vwU?-b!5C64PJU%#IMm>K+H4y6KXqE=lEyz$r2P z1Wu93i+sy4d8SA8S0dl0oBoVTwLv}KSe4`0_(02Wk!L)Ol4m>zB+qz$l04%{Vg5j$ zcylDrIOj>8agsQuV)+aECkQX|J_Y|OIEDS-*$#yLg{F?MAO4HsFYE_@1?sY}pT>gR zxK#cmk%!Ja=p;*i3HSlzC*mI{1s8Qz!GEyiw}4NVJfA;Dl4rvOd2vy{2mG@nza0En z@=Ng##3WJYR`@d-@;`u|B6;?m)5s6QKhQO}R2j`AFUvHKJUu{ja1p0J!WKz>IQU}n z@?Nu8`p#o*(ZAW$YQ^6(b>3y^1?O_lyEQ#L31Gw($o1>Oa|T>8i1ca!89|9z5Y z{BKHrF@E2Zyc@qCNuFi(AIT@-H9ky_=(`ThpfWqITYll!2c4-v)m>~p5-=4 z@-x9_OFj?$qmpMDcT0W_c)3S&z+NZZ?%CX+dsgB6oD%GjAFyk^+Qp?EwKh;C`8j!N z)BX05+G@1{%3Z+y`rEZdh}EwCZTF0)xwA_aEIkc^DQ3LwWy_-cqJkOR%H=dDR-HEK z;ODOPj})Mtff{W9a_1GF0U%JL4FJCmp5B5$jkW*_@=O5hMmn?}pS3jfHeqw}ba60% zK#ev4iwE01 zf7+^{YqSBMtpI|h$uA5Zx%`wlW6^?w(^(LphQ$h$=U;o;@TS6Zg;+I?;-Z|z1q({%%~+9NvOpX#l0R?Wg6q@eovm8I@GOdYRASg*S_YHaNJL0Y(B9c8v|5t|GeU^lL?APz zy{KoYY-*EuIR)u7wMl8{amo=yK=H$Lc5fy5ZO(krBsz%5Gt~M36s@nr0O2%dQL4~# zbBc-gU&0;F=otIf{re)a1iYIZ|=i*5)ZL> z-1bwg7w-@|_??)?VG^H1$%jcd9`yn!M7qufm{kv-dHkgGxUamf$LG%ozn1y@P3Nu9 zV;C5^2hlh^$1MpON#7Y_M;92B4o?$oV`B?FK15DQ& z0KH)K)D1m7-lVkFdfG*cH`0PP7w&V0H`aoe1-uvq zCiUp-V8L6X;q{VwOvg27^tyf1+Oh9S=;`)VYIuAJyF%70e*aPSeHa;--rIo3`E806-Vx}L_e#M@;H?2qy#BZp zo&#a^{Np(r>{k>iyx*XtW`tf#K%3~(* z+zL$U(fOpMJVG!)m>ukC2k3{Dj ztbgukx$i#@Jl-#9-*64@D@%RO0vPjGk+ScYr9Qu_;qeoLvTwBIKC=vX%m+mZ&kH^B zUMcticuC-C--Wmop2vc>26$s+82%`{L<1OzV(@x>*$+JY`AOj|fDd`E zl#B(Q%D)ULW4b2c((&E|Sg`z?Aj5d^OPZ$i^Jg;2OzvIAD7{pQhT1$OCuBDfCPT>_<@O}VZJb@%ByxA7KlN#O?&{cS) zV08POs26J$nAD?l6zaLIcN_HTgXryplCC#W_Df1t*~jm4ublpXP`$LytqiyG`t0HEBop!cpHE>P=ql5sr24$!OPR|7HW8_E%oIY z;00?RD=qb<7156yvEq3w zcs~HIUg9m)@WL&4BZ0^DEQ%Csx8U8CZWxE5MEf|0L)o_)Y17+peP>f<#pC-2hVe?l zVhkcx{ktB13U8JL?_uBtE8poByiyHsm4>&^lHPZL7p(p6v7~nc@REST^!{1HyVrtu z40ty|u88R%-DAOP(C}76uF`w4r9Ky<@+l1BD89EvZ!z>1Q$do_b6e{Dn_9lCfiCr! z{(m_F%k3EOSf3RsynjNEyjKd200acsnh4K1{&e4<+LH za4Ebj%ebi?FH;l-F%^HYW!y9c4-=|hRcLqvEqD(DuNQ$NDZFG0-b@W|19X*r*@y&H z(Eon-U_16rf*!+oagmBNyj$Q_co$pn-UMDB5yJeZ>>FXhTc+VvYIs*8fNtMO;Gs(T zN#RWeL*6STYk;SoQ>x%c8KN|@!031(3BljPU2MU-OT)WO!>hHVcO>xKkSk)mq&qF? zeH?gG;LrMU2QFpbO%}XsfX8)MiWFX{1up`XekPQNSB*>I-5M5{-un`R=ie>RV;C)Gb zegCxJ{Q$g6{b;5hoo`t1p3(4XAy;^jmh$kP6})^yEah<&cr$@R`|32j&oK_x>)%Y^ zab27umEMn`N8T$1-V0mt?t`DQ?;?Qdc!%A=-`@|1l8#pkJkCF*eGh1OXIbzjdJKc> z@Dve))XjnyftL%MPftAdtIEFq7&pM%e|}SZ62^oI1pbuqnh!tzs;HJFo8=2HK`Mwk zf0*wyNOwUm&t%1ah4-E8C;g(ne$KB)rVpOi^mCbNy+SO~L5_GNj&GH1!UK2>GLCf0 zak+4vpW+T6-D&dX|Dl5i3%%5oAw$yzcjj}M8qgPz28;j6#+9aZr9(4}JF0BX=#7}N z`gy|or$%(D+?e5h*|jGk{^W0C(4Ha&s@+hj8~<+yPCmM~w&BK@vSxSmp!i-6Y_(d} zd~{n?b>#Nw_+7u4K=*Eg6-cyAE`S|LwPfl{3Sz<$?XIoY31xehijfmh`LSLyzk(j&H}1Mb>~-CHBZKLos| z8Xwm-bQN*cJFrEL*u?zFq`2|7MnCS1XpSu1;2vKSy*vAY7Ljmg*W$S;$d~OAMxt!IaTA{x&-{u&hX_wwLa5H9KneyBeNx@3Q0g zqDDvQZdc`mCbPxh^cmi2u%Eo_GPf z%-yWxf3!Qp6MZXR<_4OjuehFm^APG=qSrXErSe~{cMcuvaCE=>Vf=c=Km^tkXRi&A0__p;YV|0oOULQTmEuGyZDcdiEEoG9%Md-9AILLMd2+) z;XU~Oy70{NCTK14=ID(vcSl^Ao_crax+ex4ygde|v%HGaSyrw)5?cG2tKpREm+ww= zGCF#XAKlpWwJUpm$oiUuBX3oIcz0<0aBR$2 zU)dN_abM{RO=6GZJ>f`NV6M@IMKM=C6<-V;o|Pqb0la!m@z|#6;n*N;=@b1lvwXqL zy2T;P+Vo-k3-;*SoDodLfruj!wOUosZVXpx`36{p)atx1-1Jj^3X=pk>&u4(_eB z+TjWD58C4wp>5)*1^2By%flJf7-@ui8=5w`}joIs_Zy|6zAV zI(yt4+32WP-yHJF;kWGvqSjq#I}mv!>Zx?>-~Y}AoDPvSzGw8*_|e9TKjM^Qf1kqg z^f#7|h?8)0BpS+>u4a41yPtpcnf>PIw=S~X9QjrBOBdR{iu~LMsGiYT@ma=NKM-v| zBM>$mbCf>YbU5VTt4%M{ii=>y%~5Y%0EAZu((rLN+pUyk|WW}Ybf z<%Scn(1`VGd@3}2rbd#f(GwaygKG>nHPWDw7F;9C)X0QJW^j!urp9DwOb)J*XKKuX z#;o8Pi%pFZXp{ug@MS*l?zzv6sx#s1%Ey}GKSxLJJS#AhIxv%*(>pMeoMtBZ(7|Ql zq?b!i;V{0GnkHutXY^rv1&TJI=0Ma_-E9Y=Q9>x==HCC9dcF1vPp$Id|~BVniu+<uDJK}ifp7Gmo z=ehP24$-!uRU@!7va~#S74`hIyd9Q6D8AkI^{he2j_Qf51q&RK)~rt%a`Kr^U8}!hWDkTFWa2cP_z@@Td7yoLjG5V}*BCoh)%|tdt`O%Oe4(hS{f6u`43sDQ zOl~Z1HroPn}iOv*$Q*!g>DZY{zl&|4HYp}9#2({3;0`i z5Uj8@hO7KBjAIPgD;)d6#yXR0HkQ`p)~q(VdyNOSRC!!mC-EGooS5nm=cTnZGG%V-io4Pg=HcVEBRXX*+!1R)6sF4q#U0bgnTG>$hOH(5OS6 z*kc<{nMX|2PpV$HsjDseLEjtAJHXr=Svs|;_6au*ZevR|qP*B3y!s7nOMSd5rZU-` zu-~_OU7|g^f7q_ntr=JCaE7kp(KH-8A!%2}#bY1ytDDPeTT0(y+phD(?i72T&z+jE zbm^^cwn-x`+UJSUO>)`~*r)BN&uC0t6~#1Uum9eEKmO6idtsx)yS}O1esk0%y!(mU z=G4m~cn3bwa&ri~S=7awaiT)}V@7p^yRUn^54ZI}EoKLUzQDJ)P~S0|E&D+Dkx&$y zHsBq)ntNww6sBS?^%!3&_sn*g{f(nl@qb`nwsJgQDQdefoA%HQC5QhFmKnlf;Kja1 zXWpkRPSYkH-+r`G+kM*HtwL}P@iwB>%OO_o>F$B84xw*8#VJpRSWT&1#KQ{&jU0wo zb5TCp;vR2tU+$j=*$0wXJfYqsvn*SD50sB97PHLo3c*hzK3V>CLVmXK zf{g#q!rjw&R)$|A+Nl{AW_nVMX6e2icE;k3 z#TU>cvE;aqmioT%zHko}=Q2}HqP=S@`E{<0Psw*!YZrYz^{KKL@Ri>u{%7Oc8JxoJD18~J+_ZYrABC)2&;w@P(Szf(_ z`!ZvhbSDY-B!ll=)qYF;$V+=;$ZKh{$)-auTX*~eF)O(L5Q*`VS3zv@y#}*``w1yh zVTHd;3uS6eHth=7TZj_@K_XtaV9hn+vMazVf3fEf<$sVo(?n93^TEgAosc5s&pEE# z`$v)TXY%6k?vKP4sCc@S{mdq{e~<9j?Zo>l675j=!0d=)gdj|B6FhBxL-Kx``@;hy z(#uQ*2^`tg&@9_|!rRRMPA1Rqpxlp#;oOpExKzo@ zF?nG_lF17jdYC-hh>ekeSR`?*IG{ne$P;6zP{$vyjEh+rhi_(zY|@{15w-VE zdkYD~5`f&I6~=kN7F779YS}Q?NSqc5>kRVe=N0D6pRstsj5!Oq5V&37Ai8bVV5lVu z=7Lu1s#GlM<6?v*SgSju2vG$O9~F&$!+(Kuy`)W^H5erJ*7$iiPGjEkpeE;&&|IY()uJ=-FyJ&4ygJ*2OlFfF}0#PHEAc|H{ft zQJQ9#kbj0nh;3ArIW*C~MlxV=Upwn(1rnDj7OI7R?Pf=SR`87Vua-MQ&9~?U2U82| z&VUuD795Ie?9JXIZN`%MTpxX=KBV0c!6Wdm)jNZ+7QNtL=9al;XPJS(xr;Fm*k zH3SZPLNv!mRP_YW<2Xo>;)$c<@jGQ7rG#IlM;-EBT%=kIb~yIob0YnD(Y+Fh(D7zU z8GZyQygym=@*pLaBBjT*MC83v@URvyvxhRqy8@RU?=w<{A3+Ll5?s1o6WlpM!~Cc8 zCcvr3+o;9Mp}&gPhG!HVkNb>qe5gp_odl!fJr6uS0x`|BU*WwCM#mcf2cO*(QIGT{ z81h~^K<{dJd@P`hxPvVD%9+}4Ugrl@IJECm;J!YSH?*_I=R2Nj+dh0@li?P+0Y1d`?zM1<*tZ& zq>~o=MgmXOzeLCt-VsZBy}+vz2xNw6ZL;7U10LV?C{p%SS@70qcs-%4@Sd=wcaE&LR=fsFdMh=&Bn_|9f>#8* zH404X(YfA&cbA6ON9wU0A4B2l<$Jsx`?xnH)8xfPs@L$6;a2JWiv{lo;H?%R%zxA) zaX)b#?{VO%`ohOpg*V?)|CT{8LLiv`6dw0M1f;(mJr04AQB(0;qe0$FPtblX9eia$ z8S{nbQRsM$5R8JqB84~3f_GTMJ0HplZ<8e*?5~6MyZbD9>A>f^Kt(FvkKv))cM#>R zzui@Ov%u(j2JnNm-|5g}7_W@zBcvkaU*O_SX2lAlr=>VM!Z+$Mn%Ymb1dEv*2anX8ttfid1^bOD*276e+yUV90x=paFQai}ulvGTQs2#XjzjUIl+e3QzSDUMcue!^?!9!sFa> z-M)I@1*`WHP)@quNA0BJ66opaNX9r;rDL=fZ?XmN1n~F{T9HaeFAH9thIfgE_W*d^ zz6fO200k!X=uEeycQEu=Zi-aAJz$HDHvxJ|MqR~sfgX7;Jwdgw52~Wv_^y{Sy1%o; zI}x6};IByGeFZ%ok81)H-epi$cnd7{Eryc9Ag1EyTI_4o@GjTzMqBWf0WXO_k`$iT zg7>_JHwn7bqrETSV*arYAl(JeJd+jwDdY7#0`S*Q9sHbNl>Rn9yIbHD5$&1bV@yfZhg!*|$K zn6$BS-@4mzzBoS=n-l8dR~Wv|~hoTE~46Q+i2O78$Uf{4i)@jV>#!r{h*lcPLQk*B@K|Hr_j1_C+L z%hNEaVde8s7js=!g$%^Z#`;M|Ux)$T9!^t4n4JO-{Jik&9>4lL<(bZqaUN%U*k_j1 zAkV71tZa_&8&V&;Y4e5koi}YxuaDcbdC>9l7#uoX?{TYZ<6`yQ<6PS`lYb`l5?2zP`Z)LZ8`w&ra69P)g+ zy|Ifg4z(u1J|-14<*9D=G3Og%W-H+0`$gCDP-3vFqF^|dEg}b^;yaZ+KA0U}H%%XiqpAxf_7&Cmg^VeU6|EqZh zeP3L4?7EuHqD(MVAq3?@NY1uTE`E~W(i4@{0gVwR!bRCMO~ z5x5C!snUMlTVsvR#!VLeSEQTIWIT85kP3`n zhX2;$<{2}JD7RVc>tl%@4Or0I_#bN|7<_J1#PB~$w;BIAMujE(Kcu@Sba{?h2aEk2 zcPJv>6e;JuGuAlQ2(ifdeo+ziU$Uf!<9yO(xOnav$;JT*h;>HIO`zLG01%U4!}AoW z2QJQ8pdW2k^A}Pz9&F&A^>RSZx?z(|f?n#oH^-N@uJ{K^#HHpwxXH`84@u-PMkiqi z`? zUiE^%nxipT^3>%s5B*j9P~YD9E+}BWh8rFrf$uSSfiJ(kGd(sI0*F!CSO_4IpNt$N z@{O3rY z+OkXXwB;qqyYc(F;5N%cGXRw;8xhD)po^p~p zS3~H_IUS5fov{%QUd>MtrV5z$*;k%hJOR= zwx3PJcfAF9ONy2(!mI-9N3Gi+zT?RcmTjfM)y zHTpHITNMXlmgwBKj;cpLZ3+wlP zM;4hQ%l!=d#kNsZS=MGF*)|@^Ika7H|NZ}R2Lr+IB+;TV~RFz&a7+r4-q~d-nv|7{4`NIt3mHyAeK8`V% zUOt^sMtjGC(eXCGF9Vk%>XAl)A@8LF^e*s{@Jl@0{{4940jA>}gpA`0MGBAS$>?}Y z#7rm=k57w~(LSEfsNV;W~fNF!iZI{GRE1#jup2gUtYE{$Al`#|SdZHyPj2P3!Rfw3)A#xgt!w zx|T0j+w(V3#Cua`^}6_|g0=m{8q_eGT8qk;wMQe2o1?OmZOxs{Zy;PMhxeqLZ7Z8w zmx~K1#3OOK2ghmq%9rop4|kC^i*>X|q8dY+O&>($e?2@j$2b;xxQlNp*8>-d6>a`d zr#iH10?+iPnf?0t!_z=uI0sM~zQ;^gVQTSBwdJ1jKsbIkIHfJ6Q`ywk)>To>u&Fh^ z;&)Pn@m$y2Y7)cw2K7mI6(pOhf3XtReErQ&3xTh|TjRnyzs|>f{Jycw{Jyb09HH=` z;6?k1QOB-0+_~8y-|?fk8C#II_5#24o6&#E4%i;tj~3uktxBOVOF%<71Ggkwc91T0If6!?Yrx z{)^gug6?yq+#~e67^f`uUn2E;33+#82YwYX{7urqt~(Z|1#8iX`-M}hFVw$Y+Q)au zv4+Q(Z;@w9w<+&!#K;>I@2Rnvx#W`hY1-S@c+C<%Rq8`s#Q&Zpz56Zs#q%dg<8Z}d z7w{Vc@KcS4EO;MV@`v+&NEhIWHHI6H$oK{bH%kroYk6N|)B*4PWpx++8m@YGPbl^7 zo?|HW?w-##T*F8?$Li!s{cw?2<1O`0pJMecTZBb~{;*npsQ2tbpMzMCuubMMTO;40 zQ%v=Taw8O{791*@1w!{@%w1{`ZoaGHaVUVwt;6@ zK2Pv{v_Bu{0pfF}dhblPS_j84>b*9@*jRWVj(gO*Y(4|3^^yV~LWUb6{TYs>O&x|K zsr8H^US_$ANYGhm1`{-Z>r=OZn)(A@lps9>7ub977y1^l9F(#HI;M+ zD|eyK1`87Lf+wE2A|c?-ka%y4w>rU>;PKs&(2(op+JAL)<~QE$y;3?|Nc|m_u;ah9 z>Q24J(_c%szw{)ScANOyLIr;xig$d0Z?n%FZ=imgm;=QoT)T0%`=0#FW}G2tyHO(h z#M^k}P%Fgg*CDDLKSR)VqikIo_&butlOEd~0x9a073TEuopBMNN|nBjuuW;|!ZVa* zz~_q7H6p3lCa(7U)ylmy#DC_m6>Pym>$G1i&JfM~{L`K6r!tjVZ4!vL>|B|r{M&pI zIYZ39=i>*HsOz;`M_Rvfn6aL&z*=>c>Hhv!#KlAT+DQ1`Ul+9bcp>Vv8GcrK;e!eM z%iB)h$)EY72lLAM;X@eJ8noT)`#m2%0Dt5v<#(q~$eBNOFd@`xQwIMxUqLtr zS{p7J&tuGVjXwV3eHz4}D=#%f*58{^F7D^}od__io|5T$Ua<0=2R$8+ zYjRZm)4zdmEtPKHG&uOaK#{U9%Yw&eQHAG$va;_oOMTe@Jld^D;f=M_mjS>_f)dM@ z<)`qtW=OZMx*hv^Tks}oc)c||o-L>2ajmAZ32J`c4n6vN=?Pj4JXQbBgPIC z2jTFD5avIH{R;ebyiyI1?OowTKo5WZ`^*n;;BnDU3eRD|+W@>2XfglvZy-nD*6}#^ z@-jb~884lOaq0Fwqu~vdGNyk8!s~cb;8r$4?B|zAe=j{jUux;)n?jY|ObgyLxIH3- z`A=bAXu&(7;qeh&;g!NT-M*Cw7cBp-hZ4hh&1j4e+=NvA4bt$gu;6U~-Z&YCKgzy8 zSnvjGczmy+?AvR(pC1MulHwb&6nK1prbyvgznQJn@c7O{ z*>^t}J^vD6M=<+pp~o;@8PRPT9^+SdWfr_7;0=&r_(MI?Dlp`|bbub#@OZzbjP=ir zi}tasNE~nFnXLFv8Lt@#z+Xj=Lr*6qTL3-%n;yr1q)hY2k1+-PC$iR0#Pi}Jj=KM{ zp5^Au%P%S_%sDUjyalu7p6@=>H@(!s>GGrAnZM~(v*Cb(eA9DA@7of$y6rcm_&Q@J z1pESWRQpn9;ux);N~8zAf9gl3CkS zv!ld##P_ShjW2dIoMVH^oZYH-lyAJGCczo8^5?qR zliRk`y<${s+ZpAm+?}%X(ryX90^g?qN^NNw*=cTdU1Z44$k5W=F}1th`y#`zhWJoq zc8#vGb0=J~!?5>GkU+`1B{l)iMevT=t z-Qdp{krN`lWzEK1Ulmp>Mc7KW#Z+!{?~Je;yJN~C9Hq@R*jD?HyS6cdhOKv}Y;!@U zw8mCj<1Q_CSJiIVys_$KV{T1(&{B_p{nH`M*(eZ0SS4B5| z&@kGyC)|khVnb+e|0cuktu5Y|vNUCRC;F}00*{#~8;cjEq`iI;pON6Vl70uJ-wD%i z1^t@58;cjGWWN5x@{sRdcO`uN>(q6(-*!!hgEeJa@X052t7r2o&W?4pE!A7Ta~cnx z6I0q^JANXyvZc0U@5s-WE(>4YDPjNkuiv`o=&m;s$JH#X-qE=Fsa^IL&o`<(=hp14 z`8LgyoR;JI(9`$BoS5%C{k}sQCpBhlzJB~{08D-<(fLD3m=V7&wE6>V^lo(Z8h_o= z_(t)oO@`CkxVOQ*v9c-!AD-ZU&lY$c7al!dI9X$-->vjJD*aBFes|I@rD9fU?Y7G5)P|bc z=CGGh)e>5k{`KEIJ^lN_`T?;1JI}!HSVHHqglPSpHG9`zRke5IhcCl^?7I+ONc(Sd zai`%IVSnZIO-8ua-LSD~cgn7g^!?iwc+70t*zioszSmCfa?^r$DoPJNzZ=&=&Vfx)oznNwl_8|>D_px3v4P~#7 zbVkBZGXa~M51~q()gx<7`Uk~o^<1NglLKXiCayWKd6V{c2#wukGY4D?xz zu_rn={4J&7#FAf*;82RvQ?`cUA1jx-R($;-KAU_UbNp*}!-b!We{UFYuXH)z+ex_*PVUQ$=vv~BCYm*RFlI`M92#Vd#QpTxNek;vrk z>t8NwKJirbu{s2;s7oHWwQpVWd0U6qC7-`_Tv>8T`Bf0`c4~0VB+QiePwZ9h>^7`1 zL=??csTlH9h1g1K(9gT;Fy7u4b11}tDu81ca6>_Yci;#aoO-g&-B9DAn$K40bJzOZ z)v-u_wY?^0Ur47zAsy>NoP9Gs4Czo35bsDL$sv(dA>nBuVLd}aGDAYkZRL|n zvtry?ZevhPX}K-M=l1&CrDHQ1vRsw7xf^`0QeRAIrmb|18~D{3)qP8AQm|M0O)ze0S+ucj=srh5}ddbt*`Ut@JPMVxRj&#)*qdTT*^rSb9qg%)=eC^h@3@ zk7bnJ>@Gc=(Qw3tJLfKsjOl3`?r=>$cjF&Qcc=JbcCFsGH!i+DYW+&5Jvu!DpH%;} z^M$xsd*g7c2tOKP?0g|{dpK@atHvW*YYkkZ#|#qYIZ9lAW6O`|@e zc$=#d=i_X1*In*xcrv9yU^X0Ea`cG%(B%t$E|k{(Sa*3x5v0Sxa(8Lvk5!jP31?*BI%TXw?wi_LbDbwj*SO-x z8a*F<2gk-ZLgUxOU@fr+4X!*U5&P(ST3URbiaXG+RNRj~0?oDJ!KzCQ4AdHrVGn(7 zFdpvX@eF96;mtOTLo%N~UhKu!yR#NF|RF^5|B1PFYw;RamH!hY5Ljt9(*fm{AobS|ai7 zLhfjlX9%mqU^P!VxY<#$31h^HCw4}o|4XSGCsOwL&b_Yfq0KP?shRSFKO-?;>_Avw z51KwR(jMk9=7c(boqfTo_%*m=uqiU>?u(n~2E1_q?((I5^YdaY6gB@oGiAsc!b%7xZL;coaJippF0{a?6 zoF|`p#_XZS+2T8g&GNXMv7%@*Yg^u)lzoAt-m^S)SH>RuD(8XF!;?fo9tdyDSeANt z(#_6_+mSU1+mI>V&8`Q#hb2@;`!=N=iyrj!&FJr|kOp5$*%%{XeN!U_BS^q=zxZss zA~Zwfed_<`&(It!e;+IE8Vkj9OgK(tI4*|p1Dv>pgd5Jds@hUi#&4Mu3(>Eazd>#b z|8X&V`Cj_%AooGx>b@ImGRCEPvt5OgW-iRAogK4zZCQ>h9!GFRtm_iGx20t*_6;_S zE#e#soLqoP<@>gDSc7lj+~kIJG1WO0h09ihso1H^INaNO}Qxy?X7ZJ)Q4=RKSg>X%wuqq;=E+SGX zL)X4+H|AVy$KbaQ83GfTK8XG|n8=K> zreY^j(V9`S&y)`ZXUfU^wh84!UTa3>i5#k}SiP?q6|JFSbxE_aCluYw4&+qXmdc9N zDBA7e&ENVyfJgQS2Tmzl<8p>%SHG9MF@Bb9&ZLBbEm*3GjUU2|>Ws0eeG1N7o7+Nf z)72+zW{We{w=v#lKo5lg7{qBl;e$WxIO-m&bq8nS$OzO;sGthBw46S3YIdAHZ)#Sb zK5J?go<3*HrZnm0)Wndc>8`gu2SwwFud}opUq;1~upj0kDL$O*ac%YLs+_s?3+r+U z8*_H%%-NZfSC^Atl~YibGaC)-r3N;tNfoXd*=2qp*s`3<8<>XX(=2Yd(>~{xxznyq_u$u$fop^b$ zJ7ynV9_*LT_jNgQTHjAlAxtQQYYK&Rkr6v1BNalFP>9wP=GH|zcSd$l3LT+P71;@6 zW8B*DwxBBK+J3&Z$$03TEleyBCL%LnVjfNWU(pPk(7FBZX^Ev3s}HdyqD6ivTVz@@ zo6Vlk10kn4!P?&_@f2Y;%3th!m|Ke4u`brWc6kdLrroxsrDY+;{Ncu7PoL>-3>5i$ zcEXY7)Ufd_XpYO+=O?GW*aQE<5?atU*$Bg&T@jagZ`oT`TWa1%w$N`i|B3re4!KDe zh7AlaUgQGQ95#xsp*zIQ1poc*JS8JzR?dv3H8IuSR@AhuEBjDaTC3xq&Q#l`pQ*lH z)3(O*by;h5{3Du9dE0g$cz0TP`i`S2XVvL@o~oQ1+IC%mcc(vVx25JC;;!jiUAm@r zT157`5H|9~WxjelzU+&n_=}c1p_?_ka8M1&OYY&;8}SIRnpX$oB1f z?32BxY#@%b{J$nAoRHXTy++S2f9SwBzrFi(^>tIy#0L`n?Y3dFJ0c>ZqWhei)Vph3 zm-vL1mL4rZC?qs2+}WXHCs#~t=az2WTh2*5>+B$EEyTO9l%;-va|Kz^?z{Zh}?d*z)21q9a>fR%v+gWFylSn_x zNN)G2jLSw(m@qD5;OJ4A1A7n3b0_y+)OUp2$ji?)^5^Fo1v!O9`B*SjjEQ9YjWV<_ zqcTV7VRXrq$pcf<(iPh5*{SJM?kHRoab;Nc*w3FGl|Hhl-$UR0`Mur;E{XnW@x7^! z*9^8j_SqdL{_yc@pT2cxxRpkC=<;HtP zEQt(t{OWor>Fkw1OyBU{*O!bM!u(@CFu#~T@!_wJ8$WdS@eYqPJmF|geW>oc*JsD~ z{brf>h5O%sB7E$+PGRvABVJ#>{_5OmxwEERG^O9zl!vZm8q6ctgyh zTf6pqWMIXWXFDFg>z=0;JUsf*TPCG6Cyu%InvY^W{&jEn9#NCOLDf_ra6~mVik|#e z)07LYdS~q0oV;N(j@qt2cj=!mzO?Jw<8(hVXYz?y*X;e{f4cv=sY}1V=Z2)PWnF(c z`qrp_zIIO96&rJ}+xV>GPZQns56{oJsqfFV@0#EI+z6V4tGH~ymyey>^zlbGT{+}) z=OY=tzPa|+(cSO&eAV&tKb)0cwP$VPqkmcX#W}BCl=AM3KfMs$H9{t_z*_)YjBDx`w?R&}nba{=@25Uygoc?mxOsFB|jzKhLd58=v{F#Cz@< z@k;OOJ1m@W&WX1!x_jl!UC%zVK7R0J&z0Q%&@E4|c+CFz_PU1;Z|>S-$o`*da;`p> zlH*(P5syE#<=j4}B?<}}t*1hLNJeu6Fc;B9(J=62f9zNiKl#jDc`Tm-}?%E%E zjdi^-sp;oKwNtlb{4%QZ^XJz;IkNxWmgf82PrakUMYl z6nyg9SD#+++n-;!Z`h6r8|UAAonzp8cl25H;x&K&?(*&zzq|ab$zOaw?@zxL?mV9A zeDn1UA1>K?>6L3@MkoCEQO8BwzCChPTv64OgUgElJ+5@(ga282>)IRpz4XV=zW$5t z!t{*z>)yU~=65Cg9@@Ml?8@4WKRxks-G)Pz{|SHa+*@{zdvDY=Z@qNUkAIncPPh4w zp8w%Z9j-WjSN`YsK61~Or30_6??3c`7uH@j=v2Y9J4Qs_?pk&@bN@GeKF;ZJ@dag1 z{_D-^W9#i-L=8BrVZqJ5j@{S&A$qHGdCZ@CetOjh?_Ag%8?tyx$_wkXjZ|^Vcd!VRu z-krI3H;sSl{_+_+y8iIY-^aW@>`#~6_RGmXZu;%&heu9u4EerSz|L|l@dU4h8 z8{gfwa%pyG!hKx^pPhJOvODgxJx4y;a2>Ys`@g#U ztg5w-t~}?WcmEXq!0>-efBWi5Me8^J+OW9)@ip(iI{3PITi*zY8}VLD+Fe(C_uK2w ztw=gHvv6DOmRVEIKAPt;?p;#xN#v1rHy)^5^q;%`Hu-S#i>nuO&i(AczdqCV=kp(5 z7WV1FHy`rdT(axL!$bRx{MP&T-J`l}Us_uB<+&f<3Ze`a6SpzTFliH#BUCnp|URlezu zx3?U6e(X>Ga=df#ZP(Z@9W?v$XD1v z*#0+kiBEpy&;t+s)WsM1`sE`7rG|0KqK2Q|>6kaU+4X(@(#qu@&pPq>p~(ZTyad8Y`qbS-8)`|5oB!!)KIz(6eD}-&L3&CP=u` zjR^tn;l{-QZthOiN^SQb)Mt=#J}hVawbFlQ?cxL(ya~TH%#g`Pez?K&vSCI_Z<#+c zg*(N+M_r|Gr-^;nz>2vT^zu z4ZCx{DYOm4jPD|2j0|tOIRmDZ+OEAE&?*Gy2-uaJZe^{h)^@EXt!gEQSP`YW^%;T0 z;|!@*a>yAe%EuvAaw!+}hqgMvwOtFEZjp0FQY$$EcAsbX3tENX+Mbzd&994$VKP4% z(1pt*-Lc@g*7R3d9!fq+&KF`$jKwZ3T5u8m7Ab!K^_pu*-YhHWyNIbSPaZKTXz zPHj?qA2P7gr)f6XBpKG$lTumNJDGeOer&Q=@{E&vXOd@}^O0xd87Ijmt2Mm*`{4=uWpx&9D^;k9eQdan zk>tTep5Zt*PpxkpBYB1+1>}#casprGX9wu0^AXuYktb%Q&B zUTrh|Syqp;twD#TJ|%hTyeoMo=Y7rp3&}H{?L`3c}3kUZ^t zSn{;ki51fxlDo#o%it&oaMX@^irNmOM-}_DY`VdS3F=z`rDU+V%j1D$ln{ zp8kK6Jni(j4Rt1H$%4F`#h6?wXPM4eoWF=iXO_&kHh(!*SOt~N$~}!VKX;apS`ZPY z5F3DUVOX$*TYl|D`9%f72&rXVUl&v{sFg@VvA&gP+tp%zEU`0a@b!FwI`aI{cJc)= z<}NnG;fRa;c~>|;FMnBnt9vn)Yc48Yut<327v%(Qaq5pQw`6&-D2OxVgRa{Qe_Upnql9t`i|4efz=D+utUU9$foaeP0fZ%*h4cMWm(5DW@TPw| z;gEer`SWFZ#R@{dg$4PAix%grO*d7YXe&PL0#$6*I)CwhZ5e563?=#P9Yq*SCt&@f zUjaL`qE*e{TjDcRwl~#e-v`*L85~enrdemiYgJUK3%(#zNoSY=PzTOrsiwGS zamnHwo~5{ap7@p3ZOjz}F{|Dc<1V=@W5%el8I!M&z^6@E!7RLE|9uwZDqUH}7cEX5 z>W>yC4AvckbVr)sk-KQ|pjH=>lX{*UJ)#r-9dsW$ecZDA)C1!SwMPp*ajO-?dog+3 z1_bfGq!aHQq;62M>M0rJith|1@?Ls^Mkbl}`AqP%hce#xf5N5X@jl7tA4Ll9J9y}L zV>LWJwkW(20N3$&Uso8!RQwR=k@wOQG$pCkJ}j&7<8`;-O@vGvw)*k-45Q=C)bRL> zLmAV1lLapier{Zfs7ETb;1vOn;|b;;$7>4DdcNfv$oTxHNa1lGBl2D;Xi752hQ#AD z17)=D8GB&<4M2t9y;~L;<1t#_A+-AXR(C{z>^y8HRSg(H#z~fj; z5#uFY4~D##4$zyxWB$`VKDSXu_tju@yhh;h`CSq9NK?U(_tF763cPOkC7!;Pw2uXE z4xTxK+2^s~ozUz*G6>ftxbo@tuH<$Mdxm z2E=}z`%39}d76E_q#p5j{-KUH1)gODlBBS2vfveKcqkgbef8jVyu-j-rof~go%c%K zO9yBr@a7;O>&v;gRC;NPjyDmV1>f%|QueKaho0V#05aHa;_(q!;WdFF9z=qA#GCa% zI)#kG51h@_c?L zO@`halNJ9d<8>Aiz+aV)r=d3!Zbg)l`dZS_1C>hePpL=uNiaHIKj>8wK$5~6ZH*Ut zDM|^yO7Bez-skP;u_*O;d!VxjhPTQR?*!Y(izv1rVJgPCN$5ymUJb{3}lWylZ~k|g;+;~ zwWPHxS6kMSn%d@n=&Z6k6ESOPyJHVGL7f-1GA$m5lNA&+b}xC!&9LF{7QbSt&cLX6 zy!1ZqJd0tlvno~|n!B6&VSyQ+W~ueRNINgiJVSYb^&f!>d(kI>iVo#&0XF~i{@arBHVwBmJ)Ybl0>%*?C%bgKr zv%2r>*~1z2V1murqjp=&(VCc@wI{H~r|RVsJMBj0ot(#6XI~usG+0dAj~`+CwaOV) zHqMBy!SalRZ9DCYpBnK^{8(exAsxfgQ~LBCm>6+oda|=y=}oTe2s>cxHLfYIOnRC0B z^*h_ymsoR|Y^^}BW`Oa8PONsV9Fe`NgR?_?p2NAJsoItOnbSGG0l&NKRXuxLvWth- zH3(}eeHnFj18cm>GLbDdE(gf8tqn1@cUap8Xo;8l5MbRddsr{yZQIK+W&7Oa9_NYj z)Wk3d`}?X>k--&JrS~^^SLC8rh3|_r4n-MF2U7N79Y#&Uw&>m25B*lvGjT;t)vUyd zb$uE`%YawY`NO@OStfuTKzd!>a>TQiN>uTbiQFXHtkt~>t zZ);#?3cLLU?XQVk18rQj4w zXOeP_ap9;}59>O72{qB%vbX*A^x8g+5oNu) zSM^FZ*|3WeV+20*f%jmGcn|dxt;N`jm;U^hr;?i)nl#0cpCb#Yi$NS zwUC}N$Kv=#OoOeq!2+@7r0Hqbg9(w*H3_~t$KnUmKlN>y>nqU>}3V*^6zOW!>v+FUmUiY-sw;)fX9}z7MydNAn+?SRPaNl6&V% zu0+S7y+{Vv93C(e5WmwXJNN7qz|B5;43?AZ4XL(m_F;i+U4&T1gC#IiQDz0vS=noT z!)n3AXtQbQ(TSSIeoVAwG^V%1oaL-zBeJK#vqyFW+C=yGY3OQD)>F#ti{sOg9aa0z z*&ZP}3)xeA=L}DDvX8az2|r^0iakX3)%N(uM8E4mgW$r*l38aD;E|kEf^&QLTAV}h zXqCU(W9?#@r)!lbzRuHSrzdVXD&p3KH90&&(w9@7>RVXu@vX+@*Bi@i&I<(20mqRL zxgWD1MQc2gMV>BCJ%T0X<1+R*w%aFr;xav*XL({vJTW~zY_bR?$j})>ibzid$VO<@f!bW$u}inLyk3{k{Ls=l^>?nap#Z=Q-c= zoMq0OnK}2I;+&B#k>T=){JnD3?eR^;UaHZW9(zT;T1UP>H6X9invA_E`*S{J-o`)0 z&JiNle?R$W^3|F5rgPAM^ai}vKl+Hk#!paLiWNB- zBhm&J3@t4fQdlr};I*X%`4u@Wr>7O7Uk8V6S1WP`ugs~)8L~2?B4;RW1vxEp(?o7I zVMUELuN^yv?jHU;xpZ$-Ub5Gv4}5V`-Dt>aK3~aS3XT6svo)#X>Pot7Opm~;)SbKn zkY+{Q=!$|N;|c~N(eU(Ga7gMkY!fLG>QaE7AbNZZC9F@V{tyACg@q0zgt z4cp3JLg0rZtHjz*g$%H zKck9UP_jrHgk;JHrIzcS}c$K{!G#PqwLEeJ;(zPU?M)c0nW_O_mH=8_aN z=j$Z(5LE=Th|@7?46gqA^|qdGUXsK)Rl^nD0*E8^=0I@M&iNvw=VY<0d~?w9q%k4g9+Ibxt6u(zHmNQl_Q`slT1@ebm#cWjz<&p1ixDG#MvlY*Hn-!0f z6GQ#bh8Pzpo^p~eErpo_dFDw%?eGRi-t$@cBYab3D17TK?MKkQx#X`@JZ)zxp0*@c zec0;;UeBQu^8WlU)AP+qRNbY>`?=DFZBWk_!>ho+xpIS*oatVwcw$_wcw&%z{;-2n zr1y0eej2wZZ7<3}l^csA^E4T8f#SV#W2XudIDAj5NVh$K(?JSFd9q?bBEKCaFY?O_ zf#{;1gC_dxu0kyO8a-z%Mw>2DPH5kpJ75xn(cDhbhL@;rV@%%7m2y^zo-4o<62m&X)6nxCODCHdcRL)0CNht)9c|2PrEkom4QtZ2Bb3 zx8Xc4%Sm6JLu~7To*-U;nSf%!1nA6i3sBed;&|CH_5O5CO}$i=a?0$PGmB>F;;NT; zL(}w-J-NSk(M+_$(CS5LmvJth*=FqO@C@oX0Ax;4ySi+8gBXUDhb?B-!NqB_<;Ee` z7L?4#6hKQao=wHY#p!kSY_@ zLD;qpY*F*V&Fev*II3-Vyoq~OAcp_PI#%9#@APrp* zprNi8RVIe*6dI_%qz#Ik)9ga##c^(-n99i+y}*+b*NU$V5Mm$r04Yq-x&svW$y|sA z%_Bs^O*_KT>idaZFX{{b$tiP7Qu!R1q?0h8V77Y3q!hO?LC+{&t9U;(iDLy)c|^uB z?X-@1&0h~Y@^K15Ww_~cT)}%M{h^NGsTLmZ-F%MFr12(Mc;yBjvgqOEgJ+(!f4tAb z)FX|@afIpLO)$!XjQ;U?Li=|ncoXkRggNffr13a5Hu0V@@c3w=@v`BpiMIthj=eN# zyi;Ij;vEJa$6WLej~O1Gy|=-`(6z;(N#lJ3#>7j>NaCFYW9nER&s+8Js*>X*NaH=KpV7$2m12&8$43_Gh@XbWZQ>n4AgF$$uru)%8+d%Y(RhEh z%I{m?#i7?kJJLbenRp4{>Gr}$A&ob|YJdGzJOQHY$X{Z$ziPw3Hp-6q)$>&J^>!}s zju1eR_OGXfx6Qz72V3pmZZKx~bwxR$>3gK{c7Y)uSDG5&<$-7Ya_R_m^lvK|6YpH$ z@m-E4+L1V~n0%Z8&>`Tlk04$S4(f=Pg8Z3y9gwe}`aK3C6R!h0HC-QP8h9VU&cy2q zydvl|5rg!Bg?Fxj*AaT{UlsCa;;jQ7{nn)MZiAia-=)Co03+tNGY*Y+orPBoyc;x_ zvSV<*g}2baK^DRr7O zp9drIaith);Prz{iIVncoP&BPa5w}ijPwWx(|41h{)@A2o8<68@!3fJyH0s zTa(7y1p)cEQf$LTNuP;#J`Rny2K^JGN0i+Tyz@2h9~ycx+Bx~2%5E3z)N3;#p^ir% zWvB7Jg&o_0CXM%zm2L|R(t`TkUs`r;Ejx|(TgxujveV@<%JQ!_?9Bd3o`<&FbhxFQ2rR~%=w>b zc%FePq8(7LF>ZuV*BRx+8-qflp0Ckaery+0rWfF^XP%w}dc66c{rdIj8xwT=`JY2M zkOTD=|8wykSbB$fNuwJVaK6XR#s?c=5@KAOOABLi3KR6)Q>1zs<|}OH!~}@TielIF z>{hsF*3?)pY+G0W8)#SdT#D|dJvp(^aHJyYR7Uk`%u%r#bJSRkd2mHEr825lbB>DD zoTJ8S&f_YgX_ZmE8gx{w1|2n4gD$LyrdLMwYSK}$nsn4yO}exq+M+UwMcKt_)6te( z4LW*Cay96RifCqK^i-|S68h7U`pSxEc4f4c*0&b=Hc9=aifG%)XgjSxUFgq9>UVgv zZ%{rXcO9oRUO!H0d~lr7_yRRIx-kkL)yG+2F)wxWB}<*GDa|U{$4Ym_(;J=p{fdD( zGuClg?-do8#g@pMaXY4&LER=%Q5b78?dsbOyqM!m?p4eB%>VTp7f#HWaoI?B#!#*f zzO@HiN+KVLBzCn)tlWhq!Ufi5wM6)@o(JS+|m4>7s)f{_>8FlS3%b=l+b2Qua$KQF(uH1E~C+J*D6<-?rCu~jQpe$E_i zrT@%Pj|A5C*E!rDON?E$<{;v~RCMbD8Q2i#te3Ir$gKyNzk};zhvt6rarJ-XRre-( zoj|+$LHV-0K@kgI}qQxX^AA}PpBT(xRhMZu|wnX7KB zD9B1IS#?82!D)##t8S_&$WGi{^EsomN^Dl157vf@OTVsdU@>2HAbNR1; z|Hck3=vWbPDkHj&j)*=wV)W5#Dnc_UWJfmvks;!B&<;yFomacj-F}J*LMWSHf zp~Tqo<<)!A&`&I{o}Ma2)Si{Yq#MS}hTSu}wyBjgRF9kC)Cs(vc zkBmR`-EvIfRDta8+8tT^Mb?UAuvv~p^YNM}1%nC9@S9$Mzn*z9zF&@YoUdp3#d2rQ zFPk&Jtc$r=>xmXih@BfEm!mUk<2d*&_W#lUN(to8S`@?f&NGYW%`2WgD^@l;RyMsT zHuC&ShsCfuL=hJ2m>MfwB!oj|&nhb|E}UOByEHZp$DH|vCB;(;${4R;UaX*`Bt|K| zD8^<_ixte0C?mPX#;l^UZkWwZ&zNV#V{Qo>x4zs1)uYrS`&M&p~+9zI*JF`BSDR6PSnmOevX< zL}r&3l=$V+Q!GKkGMLwuxmkcs2F1CwxD3T094;y;!b&i+XBAID@-t`72P1MnPdZ;v zCbCpkJdNTIX-qQE8S644MY4^MN6Bm!Ye8ids9S)vXv;TsAGltZBb!zs;w$H8jb@7hB z7U6pSfAlYuz%T!PWXYG`pYw-{`;~0^amBnj`IE1@_u`8$-+9xquI)xGy6o^-cdT3e zMroH*_k8(Azi-}{lX~(!zxdtoC!V`^{J|bC|Mb@#Pl^vd*!jl8hrb^+>hVLL>>GM= z?AM2W-(>&N%`cvE&ft^BEgCa;=l2Wd?cbW3IsDNsZQsvtJ3Xc7va{}gKJ|%fFZ}6> z-)#BGzUIqDetJvkzTXu-nA&OW%hLvr+B37;w-R>-yPw~&?~jkIDp@<= zz}w#xPy0CcFMTfi(dLpXSKNJlpEvK>@t3pH=I-4#W#xbme!A-PlfQc_xA~Trd#>)& z_S|bHu6*S`2R*R5-8*2>OK10s{g8O?_D`2>{7veHsq3FSx~cC+hq50Y)$F+q zr?0rC)sOyhS@Hby5-o44UG>0SQ(oIRyZp0`m%g37A^(gC#V?P0q2|0_&i*3n$+|b3 z!rwe|wA%~M99-L~_tDLFF8|wKs($O+s_@92Nw zJCQG6d+@p!+r7SFcFt2*EI+4T-k%m9eg0^9N&7Ey{x{}Ye{Q@0`1j{pt4VpP$wl#% zGE3oeUBig)tq{L);>CnP(RzAJPBJKpmEelhJunWr>zwKQUWNI-$;I3GS<3#eNY8aT zIWUpww_2kWUWf|+auKa#Vo-(|)7rcIb zrSWG_&O{Ws1P1lTk%@P1np}QJ1_92S--lO@PA0)YVhuR()RQzm-}$-igh;&C(sNx| zi+UYKeuvTPF!CK3dHUH)@hqeNK$%faJd(={frLLX!OHf!tBe`nRn1=b!w;h% z(SE@*3v3H6KhS|P$i&6^{n zp-x~Pn>KA|GMi;1C-R7*z#Jbv^(@#;&dBm6u!Wbkv=WeNS-5$4>x$Wx$?0uIs$%^( zOjgs&zIoF-^$TS=DN|L4PSsZ0)7gCU(T+FAtD&aV@RTlHm_DoE!ZT)S=}gqCVqv4R z*1&8mto_B6#$+k}lk=E(S5sSD)VYShRf^F#lh<8pZyiCMc|DW#Iv1v$)={td z0RYo|0Ohrq7r;J`eF&4Mj^TE&Gt*_i&i+M{#^ZWpCf=(C9&ZmC?{(zY#Jg1KY&`zH z#l+ih;NerGhxdquHvu};g$qdS-!=>HLj#X}uJ(`lH~lL?n0>A$jmLYVX}1_*-tRSO zJNDz`<4SP^>9Q|nIxJtE?j4A0;#DD_F&I_zl}a9`5ER2rLf0EdavHD9!rOo_#~+$B z-fRo6tAWRSYrNG~IcKZ#wDFc(<=o%E1MA^UxA58`T&Ka59fMOWyrBjj?|<4q{+HK0FL=h*h6k~v=@14BGYrHQ3X5t+}JdTGoX}rI}hr`vG_yFKW_wdmu3Js(?2FGPXZn#~SZG@Fw2# zxX8>tM&sS9;>2+#9R%J6oQbFB3bH-^42OyLE%0g~)1>j(CdtQ@VlggWjTeKAI^yZ| z{d$5Y)u3`YA4L<>;&B!J@vN)rBiO|e)N)L|Ec5A5oz$O=~md8q;-8@ zXMSJK#>K<3WxbKKT?+DRxa|-xPo<&TGxL8=p8@i7vHE}9@5_DhR#wpQzb`+=3mYWc zUoOV1+B+$i--yK*Wd0U>(^51;{Jg$;->OaN&D!3CH_`}Nt7afhR!eTxXhaisA<=Xi zV*P`L)~cv;($yLn{Eh!rO|vd@O6!~#Gx> ze_D3)iuS!PsH!aNy<$L<^t9zJc4FR!MH{j!+xNjoqQXA1pzujo?|E*Q&r*D~?cb~_ zJ?oCX*H6ptm!69>ftmi@tqWUZEr?8X$JM2#H%tG4d0<`yVB54gduk!snL5FRZ2Z8K ziuQd6!i~Nw2Ds^1ilpBRdt) z<}*TPrRsryco|3)iz$p>bu_){i(eg+Ekd=60_GuWLgP-kY16WM!~5m8KjYShdO3HKP3(7MmqcW$(qOt3-vIAB^$;V14W3dv-iLHo%wWAj0ENO(s5}p43 zgxC7liLzpruAx{e(%p1zsl9+ zD+>Nj*)nTbhgMt1S|3Ln73Q2;fe+kRW2B-k+n1R(0!J?IAtKAQy3#7Ek8Mv|^#ne| z@2bmQ^{V_9f9umN@LimHet($tiAb`MD7*F#J>Xkk#H`c*4!*COvLrHAexkx2fz1x4 zqV5l^T3RSJ^xV#+h*-P#BQJv8x9a|6KY}GMm`57zY?}3;gYQn4H{E#b*ozswW-AI7 zRMg?K-?bHWEh-A;bM=mExq8O}G#w_vg*zgu&$W9aZb^ylcbV z_uR{2y1z$7ateS%iN@v9jVh;^PkEO`Bha9CXF^p;_~$V8QQM zu>~SpVNtBOtos|S*Yuux^W@)Ozx<(RF8SDVr_(*CjagU2`b{cGXx2L0x~ zpWd|f>XsGX|GoI#%F@-X=l-GTJ&l@mN&Vfge*Lq(Kk8d~VCT=fEm(b1RrEjpl-s1u zgzq2i@ZtBro4@X|8_QRZ=<)V5=Y92uBR7w_?(RQd`+Cvx-@Z7iAglHJ%_d&lIIofFKCU9nd&)s32gp5*67ghnPb3n zF|t~((k>O@UQRU!L?DhgU992ps4v{pxlw4bMyb&Ec3P?O;&{jvZ`qUqPX9OdNz(7h znJRtQ)f97G8Txzed$BOa&gF%}9KfZs}w=oKvrfcwZ_!&QorQHDBIQ`Wg{#<^0;h-=M;{ zH^aW2ldbH}5#bz%bG1n`ad00btSjdc(;H{uy{oj}G#%uzfsNcy+`!k(E>q{~P6!v+R2 z{po_RUK4}$O`f*X4Sv4j8Shquzu&L{>(xcQwCEIw+1B471}L7kR~tO9dD<{7lFQ73 z_?scF%c04o(iQl*P=aDO^qLz# zQ9Sh|SADAx_C2JGxVqg6e~j-dx?cDQroVacxzAPYip`yvj1nW?3jaVIaOiIybW4A~ zVYYQy<&j6+zBse*aQQ+5)E|f2Q?TNr4 zgXM}RHvOQSWpKCRSq57a&ocNA#j^~aQT(|$zo7Uy&TlE6W$-7(kHGn`;#me?D4u1| zJfmfcQ!>N9n9RXY(ECUe{QG$ECf&5F_i|j09=+Gz`jdsX?~n0K;a~Wuqmn+6&pLso z0WbZ9UBJQz!LR=VtQ%UgAX#3={n#Urg#Fh%`FhPi0qG zEemg(fyex4yidTGcq3Fi8}HAsW1P5B95V9D=M{}tXW@+o9>@2ZXh-56(d6R{fW9*D zFx>O-_Mvf`{v{A#IcU;&ufWd4qfrMKvHbWZf;z@~(85~>Jl2UOjd#C=$KT;`Oh&v` zI5ggE5x;+<5f1Y2X2=;Qj)PQU_{TA;#+zl~O+c7qPEFdsVhit9;Bo9p|2THnc+IW+ z9#rvcyrx!uYk|jn5RcEY8t;9}zYh`S^R_1K-+PvSuNrtcFxGfeE&ur3%Q3npjW@~i zkNfH9{GJJ8jTg7@Iv~76gDE=(e`MjM;iA=e9hDvP-x=)#e_lU+AL6AUtV#RV9!BKj zO3@#9+2C1z?0>a?KY%y!xWDO4$TVrZZy+%7xZjV)<0GiXdkwsa*A|LPHJGwv@Kwdf z830WO9(|#IXXDU#Tfv)nbD-e+5KXir-G_sG90zGCo`W=AH-xEU`EhS|;;F|!X9mJ+ z5Y|K;k7??RW+Uhu*u@mj6KzOU04A^PPD6*ybTnzZ2Q9lZL+sWfqKS77>`FD5(lN+3 zWZG>EvCB~T)&8A=o1fX9wSQy4kY}4Coe8_Ck`@1{<1rCHJZoCPo2fxs_gmPR-+w3L zrU4g4{nA|9aorQ`8|7R_KwmR$5oW#7U%3pR{&jKe`1{NB8ql-%34Z^*vLg}z$uUtb z+Q0Tr%KM7n2v_1;SaAgPv!zMaS?=m5*B(2zwaJ!dtDhdVe*6XeSr7#2O}92lZ&f+M z$vK9t9T*#N@o^;4I=x92Huq@Sxy@;>JdkLbb;w!$)TWnz*wb`-v(6j-It*>FNw+lf z6Di{Hw^3Q&@S|mJc2=qT%80Q@yXVfv2UGdAX7#e%lnc|w@A^l#Mmiqitl@W>T&A|e zedVd`&1y<(nyt92Nlp8Hccs*{9Ns2v^;5Y`$B+9*w`||z+6OpV5 z(W(jQXJgx&@gtq8+~MmxO>951Wv5e5uF9@_>1g`E%>z=pjzr~jZIW1cXCjfd3*+I?-d zd?CK;iw~6JUq)oCJm2ZQrla58ygqeiDl0jWoxc8#>{F*r?_JY=%NNKNKZBwKXEt5_ z%`rshxB9)!4m1;@@xT5d(LO6JGBb5rc3t|98a2Y?fUE_7-?S?i5s{0=uv+xNu#bvt9O2f86>5(o~r~%x*MMDnAtH>kv`>4vER-7qNRPiit#_xiSnmUQJ z(eK<*b$X(GdfVMqZaRMKyhAvE#K%8?CInxGeQ^x7@+&aY*pO^D<#+q*UDQ3k4@VcW zm1kX^nV$YqqyATCJ?AD)W6_-1X?pgw?4JGBjU3sCMU+^O$i~M^*bW;e6Kmwk^Umh{ z(En-5QGRA^be>byc=Yd|Sf4$zk<3NP-sWN&!1DegAN`!m?`>LDIez3xdFwvFwn7zq z{sGMNmE2D!kC*+e2{gRwG^eKhv^J4pU7hiFHA_^M-&VV&XV#rfhhyiVvz%2GoAz*T zmYvO)r0->|B`PmStgOTyCucZ=P%iLw#I9W(Uf-3wGv&n;Xva@)G$>u=VmicoQ$B5e zH1)-1uvXIk6PHeOU*FZ?11guNYM2QV=T3Ab)CapV@l#rSr=8)x=;;??K7`EP_<`7l ze0!8-FWkN3vB?(JDb0h^W9kdl)4E@5YFbp zC2V*SJ(Pb`e9~X__e7(CiIt7;JNwFkmnCw_ht_^OcGa;x1yvbYUpaZte=vTriw0SR z*(+$++tXis|5&1Ddiw5ccW<<|toFKRke6ojOVtX4O8Y`1} z_p3ys>yXrzg5~=}Ut?Z(fxK$FY)`VyRz=ZMr&ML{c>1}JD zZZZDvZcW*n^9Jw-tUINPl_HCaivN;NiV3?vS3?zLchB4NXNGNy)k-rP*y? zRF|i>-kEkFZEy2CzbI|)eA;xy9qy-T2S1H1NqhTrcS)0npNKt~LOud*?KgSN)*m=| zT9bYBX+w+h6)o<_=6oj>PnzoE;TsC(*SW1OsBE@A>DNozFO<+gXi#M8UX?7Tij=HN zQ<~kdsuEi{Rf}>;Pj7Re+2&sEf%M(2-JR+C9*kv8z=RrEQYoUOWHD8JY8F%Sh9mC( z{T@rdU{n0LS}_v`HR$!H@O4cj2Q}0`nw1hof18qZTclYcy%lC6MF#G9J>A*cr1RbG z-bn2$u>+AO+PVj#NN#INvtB#X$G>s3KF)L}tG6>CMf@Jy>aQ`shy6NJ``F!*JFRuA zEv=@_$lCI4db8It8w@v-W}ilnvVpO2S2f{%r}?zUzTEOHbmFGe=(}TxEfTe`9b8xX zy2E-M^1e61scMhA$dc4<*ja^lh^B4RhS!Xl>o_ldf2;sQB5`Zzz9el}bgaEE<%40qQ*Dwlb!C_)+S#V#|z;Z!gCGBt zIPdP>{bVZpq;}4`_jFpFKkb^*cT%@}QM~rMr612-RInZs!Kw<@_o$k?KBsEw`iv?@ zZiBvk?@0%uxb>wCI|-Zope*;|zJko)*23uDt^IiEdPHC3i-?=t&XdHnt2Ep*(MPAE z2Tm3JVAIj>?Y^s1%>^5e9eZNkU#30rC!&13cD+hc$4vXQQKQdU9>b3K%0smst4y{; zs#-5TRQ_ZOta$Q8&S@1nS*ko9JUM=Uj2+f>sbhiF#+f)4=iP&fYIoK?ng2xptKMBv zyT7*6%88wdBg@-6HTh3A-}1#fYhPNrXzs@aAN%$QLv1ogxUFy$a8=WiLo04Sy-_Ca zZ!5Wj*q#;aDcQGh-z_mikx_DY_ zN=X4`OI=%3Dt?ZRrJ1lrd@Of*S=pR<1J60&TdJ-W>)ojn7; z&h8G27*yS4%t<}-diKfd-*bTa;A}WB4)1C;1-hKR`ys+fR)~ zJ>NDa=|txBV66{9m*al~Z!KG?@EIaJP%72`sCb){6xILzW~ZbQT-5h=m|?zMNYe55 z+Ub)t2FJa3Op1zM%q1oD_ue@-sRS2we(YfECx|r@LD;1Fd-KGdY0ADx*vCzC;0<;j zQ03KC=m%T+Ay#;(vr5_X8+t^1IZv8IongrUIPSIcib|jFRU_gpX3`{RubocHK3~|6 zN*aTU*4x|XBIiQo58rD?e6xsXKgNo0zMZ0ef~CLG3QxAe=35fRXQ?JBidh|5c&DbR z1(>Ir=#YH3QOXMg)E@`uNj<4v=yez2CeEL&_y_q?1SIt*IamTl5Z`-p9@8S@g$mOf ztHK#Vf2vbwTyoUEZM;BaI79iz_aQCucA4+IN$269)kLet)Lw<9UJC-x;XFG-7(|tnkGOPnOp>=de{iDN6sK zz#H#icRN87MffMqYRjL^R(QGr zZs`;f+Hv#5NxZ*vdr6+f=E|3BxK8lhN#%?0OZ7Z8{w7M#Q|oN-gwS%Zj>Z%?M*g&% zBE3Hht6R@0W1pbsl!5hd*v0sMKdx>QEJ{5uOxUaLSKtq#ME!2=QjXXb@8GMPnL4pb1o9`h5z7* zU7+N|C{sMsxl{4P+pc(G2ply85WbCs5F~u#1q2elsoMfgxknRae1EL>YvNs&JTaI( z^28XSc={>uF9ZV;_!miDuE4nrLXapcg)hpAg#i+6zN_S8IAtonlj4af(t?~AY_haT$61sEc-F~O zB`5avil;BPD4zEBD4zBtcep$YpIO)-+PPx|E8Ao@$>-pd37)p1O@gN_vr0MrrF-Ss{^LWc?Oe;ueD~C>1kETJ-37n=S3+?{}d?+CFVHlDQ!v95YIxaLxI&k zSCdW*xW07|a7pnzouLpfg@sof$=QXz`J7sRHMaH%RD|q|735NbYkUOKK(_IgHZXkVZWLMm0MH8Sf? z#|VW??nZ`O7S9UZ=*uo$pS396t5KWR6_w7$v}LUNC!n;S0ji`!RN_~7lep7Z1Mx#l zMAF=6Dny@5hej5@P--W`^j_xXTr(vkZ+?yEl3$$kggKryJGhukxj%;Vou$MrwHhen zdM2JjVGwwki0#Lw;{Btpe-TADBz2dWGQDWZH4SYBC)mY+!P<%(~A&w=123Dn*}- zS{f+WL`&(kils&DgMC0jg`B*!%NEVid*Ow6W!dU!X2f{LD5& zGwngLekqmyb`RR(k4tX-OPTH7LylWd(* z-bn`DB2SIv99( z<>KLui1_`}>yZ(Ir2XSsnx=nw1|Evi!|P(!XhOO+#gy z<;UM12i0#Bb|&5k;OY9{yG)JuF(R9I{SoL5y(Zd`K7^f#H`%~z1--_z_Zuq#9!x#b zc)P6nSO}vIuwwo4(OTnew(7SWc;|U&(vHDR7TyNn>Fbw|^BV6mtNdz#r{4zN@Q%dRmX_IO@X zrd>Mh_zp^wj>EP=KCTooG$ytqrrQArbqvqKVdC-k0Bs@Dr16R&F!8zqPnR=aeQ3N3 z!JBwxzKUwg8XmYSMV8!j61gDRS}tR^#z@ukpUa&B?@j6?ps}rb**{ z1v?XOD)4wOWPW?$(0D&q{%MH!a5L?o!IT|?11$gE10Jz>^ueL==7TZ)>x;-7-}X1e^IWA$Vhh>+J}kv74U-Y)A_J7^YJ0@^z|{uz-w>erJ#Qex?i@l@O}WEzEATrkuI0N zTlwX9p)K^9Xh-^+mEW##PUG=Dr}5sl@JfL9pg@rSG~VkL-j%>x2ottHwttOx6oqG& zUpDSfLFM-?j2I`5gY+iwI^aya2{<&~0Shk|c!`z^e0fv5A!PfZ%{Iq;@` z%YX+{k7!5w4G!{g9Hd+fHZ|Ur2y475@Fv~{;C;;qiZtGB2%C5lfTzbB{3NCEI8Hb5 z*5RQjsD4j_k%_m>@Ncq#_c?eI?_uC^UWF#@-(d($y!U`N88X&Kq0*(}TojT0B5u!u zo`=wY6Btz7fObSV%mvXd=(_wF?96n}#dEwa=OVy@K-pa*VveG-uAIGdw zW7$g1$Caj>qi^UwZFICTdRkLo;3Vo+W~_7@u=?-DFg-A_O*!3%F1_`RjoC{bu8-KQ zX;!Js3j$vLl%4P%a((vZ#A}@Fe*I4cjxHplAae9i^n7Jy`f_|9H|3pxk6B-M?)lwh zKF<~+^-C_JezgB6hg(k|4GpZ%UOAmu8r6&c%``;1-twtNK9IhlGm4)X1Yyqo@!R2v z*cj>jb9J~e^WV&S`V}IF_3Myj-+)e*ONv;j*DJCAKa|%s4U|^{x__;_ymn!>3em?% zJpRtZD}B`_MgLP>{%^L6|I7Yv{O|GCDvxA)w8{y;XG!YRvdP_=Ry_33ic0>bNpwK! zH!rZ8_SMPB;!clrZtdB~B3FGrwrc+O`}`A4>(IZP7W*ys-RY-`Oxahy)X5CnI%b#p z)}u!ut|-&M+Z${IHZ1g66e-6dE{<{>CUFcx;y91`S{x>6J;zhj%YR7=t;ge@81IxT zm6q!>hCV`H8=}W!ksL3HM3T=EIzArHgpcJR@iDv<`q~gZ$7o_K8-hO^dgiel2T7-^ z&m$nCz7_{b%k_CAWYp{O(QN98z3^oK>I_53D6eJu`>t*0IJI(=K;2`biMIS!Jo?+h9BwKzz& zJ{L0T!|=O6#WqlmgJj1)3o`0!agc2N*^p5mhR<&*ERS*=Ch79Qv{#|8HI?AC{uHIx z_}WbC`HaJ=DOU+f{PsISFAvh{qIO1&G-_lKVCuN((S%k_BxWDT{?fl42S|0C$xzRGcsG_F4L-9ba`bCA-9 z;r|$Vwy$y=B)k6jO_BOq93)#Ghm3lSZ|n1+YN&k_`#fLi zYjGyo_`@J;sC~wuXZwodFiH3XL3pMV5eXXekuk|_L**@bqNLsGXXF^7O zIS!JR>vKoQsISFA(sF$s4H?HMX8jmJ@oPffv9uq z0%0*W!I|SM(g=BSMyj(YJMbcpI168J=D3E$@e7IL6cWcHB<+7E8T8hO%vIqo>dgB; ziT8OD@8=}mw@JJ|lk~er-fu~~uabEGBp4HEAUq&#`Ts{WGLuanq+lh{v_*dLSF?~>TRlGu-u*k6*^FOt~*k=W0X*q@Qu zZ;{wPk>cWi@|(_J6=wfI8Y)lXw=ZOesc=l4+pBX2b>?+R;`K-3bw(O3Pu{O^d3}(0 z9gxPzlf!mRV*4erotl(?{w3Xd^z7g5{2_xK!4K%^@jd(W^?2G089csQOVJm_CtwtxK%`}`fJx@IL(wl5?_yAwY?s_>hP(~5!FZ}z8=kLy&lc#a4Tnpx+sVg5i3JW9sk$g z^QxUQLk;kyy&mn#IQ7@Y$#KT3fiNv2j!_u`UylxT{Ep7IYG5tPUymBKzO!W1|0rgn zJ)-hUq=;{38vWO!ejUG?GuW5kZWf*%jcfZJPDfvU_2^vdds*@OIPHA-)uVN7uSe@T zJiw__`Q`IP#2dY9y&k>m@F3?kbR{ISkYeg5dD0!Pg$yc(e{O}BI{Ci(U25rX zu);Sw@A>-Y8!i0`E4vl_jhZSD$RQl?7y`{g)3g7Kq>Z{+oE&aV#c%yTN&wit&|D_fFm2-iwet%`@H(TMY z&aNg>B=3(~E&YR5c)N2{)mH{I5wUVi(j@9Ulnj82I*&L9)%7UtAF=e0TH(i?4|!pM zTH*H{?ms|cHAloMCL$>QMa6Du zX86y}W?%XIIjIB}bw0AfA3KA5<@2$n|1T^2sdJGUKS+N*we+7^;m@7`fsf8cg|Yn&uP#^obN3C->vXbr-{%0sHHzP2u2hOX1tvTy9JRxhUc{?>IKatAUapcoFP5DUe~P6)#cj!s6coeZI;UFt zQ{An;_?)Gjq^NV6`;yPUR+he%o9fFySC~o?o;Tc&eDT{^`gZO{Ro*c~bDc9R{TXgS zbBQPQIhH=hb$$9XE&Z7;7PA&4BAxXwA2{v3C%FTKazrs_k8wC`cr z_i!KZ;q|igz1$hT_-4kq{oKF$;t#O&1KcWKd*RAsNy1vEZb#J~ z<@NW3yTEt-4YKS9x!?Nm&a?FAxx0PWPrjwkcklPL&moq6h}+qx=dZt$gy$>w2H*8F z+|mzsFY{f0BQ5<%_pmSiC`&)e{e$oNxX{vH=-%UN{})^Oi`^gl^kXgkSodmQ`{Sx` zNs3~XxQ|r%%ldfI?d)qmms$3gxx0OMms|SF-4(w0-1RL_`0%*OL6V|a^1SK|*=~WaJ6f^7`s(9ZH_g|6 zes08}Z?N&zwou^yDa@(F4vPFNq=5)FZPWO z?zZgjcK@czSK7bgmiX-Nwe0V8JNU|Tulumiexqf-(Y@KH|D~n>rCaB_K7M8Cf8{oA zA@dW%$#phc`pxc#zW7@$y&e7!OaG7+e#8ntYK0%S!cSP?C#~?)R(Pise%1=tS>flb z@C#OWw-tWL3cq57_qw}tWO?#Gi?+KJ?%Uq4zsu5_R{-N5R?mx!#qeD*a*`PCubzJ> zVfb}2iWt5_JwH;!@FFX0-m$5F%1W;|2B9MAx9I@R3{SQ2dRqEFS>Y{~{rQ&uD=Yk@ zW&f2`URPM*Vyk>>-6SCWZ4>i{U$(-hS@!Q)=^wDt8)}6ww$eAR5T+ls(%WH$Q?2x0 zw$gvZN-x_Azh%|mG7G;BK4_vp%PsuomjBmU_+w%^wyghSR@i)EA^sN@em~3pFIIS$ z>VFYcw66(d6cO({SBIoN#cKbCTEzc((p-e!weZ_m`a7)f#g_jIRRUEJ&NX|`Jwv6> zePlD7?LzCWl16+r$~DS0x$5>SWb?!~lp0BF7R=6ft-HwHQGcASv&4#_YUr_6+ z+q1A&;|3wW)$m8%zl2=fp7{#Pt&}!QK2zP3dFvvtUU50D>YRlAIs;R^Q=yA`9cN*q zZqEV}=KjLKi9xBzRkv=Dmov2#ewsd489sNCHo|A{p3mwQZ~Dwv^qF0x zJ&TXLXMd-}WcBE^n`!AwR}Bk9zRsam&NJj1!5+>AiDRZK@}fFOQC8qRdo^?r>GqMB z{O?Qm9wWc~rH#lhcn?PnDe9&BBWW+v1@GBcOHAS0kEIR&yK1N* zn&m&ykZ&>kztWJaj$Qaa$&f!_luw}{f6$N@8S-rg{&YhwyAr$;MmxO5kelVBhFhY1 zW=R`SKH$Clsv%gt@|i2`MfrgD?9K8iGtxE7XMrJq*zo^4L;i>%Ut-9281iyMu7-jl zzc(0iGry0?xFWyHrH#lhc+Y<|gshj}mC|117rbZxYr~(LjC9q|Q}}a>A+Is)D-F3C znhN{d4Y}$6Q-=Rl(nk0X-t$KdY3uoam$VoDgZJ#8G5op5NLLMog+Ch&`ELyS`=p$= z#7ywSdYr~s>q8ef5woT zb^W4DOT>Lv+O#ANcn@DaUexnvm$VoDfTy0H1>HpwlS2~sI>~D}&q4C+5P63Xd0vS8 z+z|PQ5c%aH@@XOR`62S9A@VgL^7SF|UxmmY36byA^6UNO{8EVgEiGT{w|_rG{%MH( zJ1t-0$Ki8etAbNSDS+A{-LLq zTR7YcP2gKN!?fJOxkSrX_|v^o%M*V2EG=K@moEyDFAI_15+c7VM9y`LMZQ$J2s-YI zqDzo{CT|=dK7PBe2v*wfm3#-v|5Nf^$-gG~-sInq{JG?LqX7-Y;l3?c@tZ669m!ux z`R^rvCHVuApGy9Zk}o0uzT`Q?cmE{$#pM4i`DNq}N&Y7CpGbZkdEUH08*sRv3D&uf z{O6M2M*b_wKSusx_HSJvZ)5OrAGH5R-8m zOP&yJ6UnFG9T~&z1c1e zNPaZ=BFSG${%XlzNuC20&{Xm>C0{~*j^xY8mr8yy`7+5bBY&;rZz8`?@+rV_(RY&g ztl{zj1(c4%Z6a9lp3$WMl!?PPCxs6Ipbj|nK2o{lIZy|6#o@LQtoTi;%NJ!Egw zoQg{Tkcit^@*?h8l8@o!c9XnFOYy>Z+|l20dpzT`#TM@T+K`6$T?{EH+n@W)DC;9n~F7)~x9B0$1k@xngL|DPE4iWl}_ z{$C~S({OSpOJ4XtMe@RbKCpmdINV}#%AXR+3;fxV7yg$@K8BOahZ>OZU-1q4ztFH( ze1ra9FYSf@Ka+e6CwHmjMY_u*FK|{!Uii66@+mmEYa}mlZk2qD^4laYaDE|qfwNxn z0%wEd8^pQSz}eI=PFtv5KCFRaINUAdR2eE>`0${V3m^VN@-duTKG1=L&x#lJk4d?( ze?syxoZP1*FYNiy2NL$Rf|b|EbCOSK-1MXtr)0Hidq(??xo3Cp(YxQkLGdBOMvlIC z++`E4_-Vn^t7pudGw<3(i+^6>-smRqy8mXpqF9Gl*>}2kyVdS5-TU3G?l$)!cZd79 zTjM_M{syl_p2zEiJ?_iytL|^zeeUb-o9^%2{qDQ&d+s0HgYF0Jhwex2$L?YGukI1| zOZRK{8}~c+@9t5zJW>%^7FixiL{>#^irgHzHBuQ_7x_hGedMml-I40ZrpSGf`y*Q- z4@9;{9*R5?c{K8PZL9N8QB&&X?$HzIFE-j2K*IS@G* z`5^LP0pP)U^m`xdbN?EB_Qo_gjV$ac}%Gfgvn~xDq)`8xK%)hl+ z114fS8>5C4jNG@(w@FrmMgqp4OaMfvfr!pJG;$IUKiooQK=&67f_UW^XeEKXqAV*dDwrAMO0p>HnFt8> zh^iv6;aLzuxP<^<4H#EK2uQ3ISmK{gshS21=>4e=wyLI7Bm7Xs3-l>jm-Fa#vrLIN07 z9EK2XA|UL#3xPR~nSk;qE>*0K%PkE4d<^%eTQP+y}*;q^6ocwJw^;t7_r&^TNR(DJ$nS9{eKZo*VqAPwM$ zt3CX16H)1?umRC9s~No7&ByD$@@S%sRQB3QKzR79{knUQb={BRRp5%R4Ab{7u90y<2aUg=q9R^2%YOmUZwO&;Rs*~B{ z6&Prui;rX1`bDoZAFgG?3D$~?Va!_}RaYp7dG)p0qY$mG&|q~k$EeU?6P>3JE%8}f z!DOP<9ZY{DCnXqEL#mi=OgDnv{$FU?@UhSd74R{fZ| zlGTVfz(Ch?sD+oX7^KO8dH{~T{e>Fn3O{~A;vx>kK|-Pz4K>hJd;EkN#PQl!{mgp3 zuT;&NT~^e6_(hj>L$5yN8mD_n$+c(zQ>T{BE56$MFyO_JJIz~i(brEaEhfO+Mo6>}wTQ~b84@i(C8CH6 zCAcgCR3Zwm#*kD3RMIgvp^!M@3bu4I9eovAN?qjMb!6#9WRx!MOu-oo(#aI{OX!e@ zUX%0m_IEqcq_mJ_&g$|BeF3%spMX((0#<@gz#{euMEUt7UcvaJBG*2NmmMMPUN~=F zckTL=;yKfcN+->mKWEPD(z2qd$*ZfNq-6G#1}-X7@70w5x-(5gxvPuEl8mIxQjku%r!TRfSl%^e zDrH*cMP_PsnRtyUutdE}DJW{7Ql@HNXhBiErkPAtH%)z2CBJKUjgu80AZCmpF-t5! z?&UZ@C$a>&{>)(}Exv!~PZyrTau=_~J(c0EDK^~oi4Av6x$Um0^SK+O(68ZrK6&qy zJtDW^lO}C_(xhXi z*mBHN8IDoheO_5|X_EhQDn6y+$%(^!crZFlwl6zTNn-a}5?IidfZ z+H?K2Bt16Haee`rCRZ_Ya3-&&{dxN~Xgkh>B9-IEJGPzHQLp*yVMjhrA?O**RZGYD zbws8=)G=IW;q`~?R2-T#-c=Uf9s@5G#v1Qi%vCh~8>4hK-j}d5{d?2E<8PZZ-n$ka zr}4GYV9Jicw=BGa1|C!%-Wp`u^pEAP^GF=cCtzp#ci6x~QFwSI7G4>2XAnq{#=F|W z`_{la3AVI@i4(EvW1Z6BBuL{OZR+T1zw_oXS z5=1-FBG{3SGXUys;GKrB#+zi}y$2or*QD`&V&TONJeIe{D@gPEcSPxIyena6`ZwCZ z<1}84H`v1a3c4Ww23dF$47_#*-i4SKY?fad0*LC7&hH4=nf^@$UN)@Qzp(zaf4wcd z7SJ<2O&aeU3vaQ3mjh#s_gQPdf1JJ^cSjPGzV6nrKJ55e)e_1E76|e_ar! zj(7vC_PiK)8Ut#N?`^f`Lxz86D?8$4S$O5Z3u=EE7T#9|9;c9N|JtIk0O6J2x)A?P zgPoaQZdjzt?;Hc~JKRi6ys8lYzJi^Jmu}$key{z@wAwR&6A@Iu&8_yF4Lp5)^fK_i z!Np+u_ZR{}*T)wSn*QY(czq1Kn$~{2H$(h;6m}-w2m`O5fw#fJ<8L>Z4^6}%-C^NP zHt=w(^U7~e#P8o%z|$DS(fo6;GyPi#JYBzFJ-n?J-nYODx_S#cdCWA#lXuq@Y=WWmtX%7|JuRMEWcUv{*k)Ft|h&c-QX);ORPr*yB@RXZm*pc)EUvD?5fiL3|UBzr6|a z@6RfoIO33gFz`kqto?h!st^87C#ZgRSoM*H->2y7ca(v5kA=tI`UKVQdJ8XR;9Y3o zU50Wt^SdF$zcH{g%dfwIcd>yt$im}w5LABsExa)X-dF=K6_sN8_YClY>X(&i`ZpbT zx_&P)@IJ7{yR{+y9e|yQS7zW{X5cNc#=HAN{99;^cgqbt{v?QL(chm~c<%u(X#9Mc zg?E#IH_^a59fN(d{JstGuNCaf{8kxwR~UHTTJ`Y*@PfwAUt0BXpMiIkfmecuIn%$k z>N7!{TX&<`5iRyt~T&qwD7JB@vqLpJ8a+; z8+f@WeAB-b7u5e%TX=B;Z?1v&7UG-b$KTWIGJ~1N?^E(Pg`f$*)BWE( zgtdQtqq2%2NyEkKw$`pe(*n|S*} z{QJi8Z?S>5$iS<$`uigx{ylB=_Xz{pJ3+k_gMWs zH|C{3e1C9@fp>$2cTXG*KkTu@T2A;lu+-BgtVd3%p zNjncMncv@9czFii?FQaTtH0k9;@>i>zaL@X-C^L(vGDc*FQ|XM#=@Iy;H@|CMxlQ) z`_n_f!=Fc*AEx@nxY8^Hp03}!Afp|_XIprOp$PJ?lZCg;z`NVPyV=4^QP&kr1Zn?P zT6nh_c=y6m`!~zNvyV!H^#tw z(!jd_ot9aCx?R9Tkk0S-h_Wa*Ka2augt*PY2fX$#%qUw zr+uP>n%`-S*UAmNXAQhxT6l+n7j*sJW8vLo;MEy;>#X*irp6WYjimj%#cI!02HtbZ zj^#Pe!b=BU(DggZ!n@DFd%?h4VD(qA5dTW8{_0@^Z?}Or-oon;;@?;c?->K{B?E8D z|6%X#fh!F*31E`=uH-HEVx{H8-pada;)j~oDpg}?a0foAW2phyU z#HWByNu(uG&=9SpAT>!*qe2B+>mxN#+oDAcKBA)ez29?ZlF6{E?f3WnygvVYPjc@) zGv~~E&YYP$bNAl4b9;4ce?x&6>HPgU^ytd~Hc}Jt)b-1&2vbJ?jWh59z>9SLjxz9? zHN1Tq-gn0J#>^=8ePvv49M|w()9?-(cyoal>HIxt;CTY=(H#EF~MtdobV&4Fxy#zG8H#I!3f%k9} z``iZJ1P$+P4X+mGzuy1V054Me+a~)RzzCWKM)~hu#HjXHX5iHU?<^;Y*sHp^$H2=4 zo@&nrHM}`UpxgIW6#H_ZM{K|dS^-Ac_da4MWB5t~uNin4D%yy8q>*6A2N(c_1MT)5 zLYOk*J&N;4x9>z0`!+yN$E(or{;uJL47^yhvqA;J0{-zjsM>M<-HN4TTj`od;VqXAyx_wr#y?+0#;q@`_CIBx| z{hnpuxq+wJ-^UtWKAf-D@7yT%&4He7UtbOHQw?u|fmZ;$NcDTAfj3;kJEq~KqHwx> zrBUqjLQl7EiiY>OhW9lt26Vh~;6`?!v-Zr{Ti-gg>aGxYFpp&Jmi zKZHMuS+RHP*Q|-A`!~2zi*8)78s%^x4Nox(fy&4{u zs#Nw}W3)dvjEiL7c%%J&py6@3ONBSoz~gs9BDKFk2Hpt`k4t7MylYdP`am@cN(Y`# z@;s>WUJX6+0Y-wlj%@cIm)%r&1JT$JWU~=8Aqw6A=;?Ur8XlMKRCrGt_T@*xd(yCP zl!nLUKNVha*N*nBi-NZjdb)i#Xn0&gRN-aA`FeS`M!~xQdOF@>4Ufx^D!jvneS4$e z9W?A)r{QraQ-wDaja;|yXcW9b(9`YPq~UQnRE5_`_J1x}zr2p}NuCGlk>ZU0?>P;R zOR6foO2fYND0mMW_Web}db)jEH9Rf@tndySc==KA4jOoSG(0XPtni8r zyme9VRvLKkX?O!Pypj0vhhSTOzcmWp2du&~Od!A`R~*-26hY&41}p z@Mc3#$D5+zU992#)39$s6ud)*efb*RFb%KN9Dk$W-EEA&t2DezHM|AJ^})I*csCi> z2M=p_BQ(4g!@jLi@cwPs_l$;jxrX<=IsQh$+i8rydo{eEhWDt^-ye;Fx54P|KhW^5 z(C~U0cy3&z``ExF#meKE2Hpt`Z?uMYyE*N2g^9-X!GtJy zV~y*BbPbP7iYvSi4Ey;0hEJA}2UXtp4f{rEcwClT;r-PZkJd%OJ7A1QH)wbhHM|Fm z@p5Yvy!FO-xmd%yM#CFo;O&iqmto+o)9^AiyctG+e>4i-^+tccNyEEV!|P@Ar*4dk zk?P}2qd$F4!<(w%J#W~T9tCfwVc%agyz4Z)I}H0KM8UhwuS^>8r~#hJW7v( zcahtU84Zu0>{9Ky!mw{|6ugHFyuBJ;k%l+Zuk>uZ;0yl!kY=hUYQx)-qt91GYq`J8s1|XUbTU@Hwxb42Hpe>uTsNXZQvb^f>&hV z+Dd`{C7d)5A)fu8Qa6&l{JHM~{>FFgw0w+7yQ8s26N?>z%= zLKM6=4ZN)y-V+)gKTn1Kw({l!uiVvMU{zjqjTexjJ;3AKf6m|dt%i3do?9hC2O>eS zI1eT;14#;RO>ZaPfhrz)Pb(qfn1tJ%#`Q}b&I7+p!-Gol3*-9b;fa=&4>|373LEwC z)6}}iz&jEJ&u`!*UX6Qf5^uYPca4G94bR0Q**D(68wEV-(Y~iOymKyt_5LG6RqAMMlEA$H3d8+4sDLx6Qzt8wIc0!23eO zYtZoGjrLL=1*9?-S#CZCVt(4~^@!p_%RN`Be?ChfyElD0rtE z^)Xk&+o$2(iaJ8Dt&DZR%SBibW!yGNKdbm2=!bQp4(S=_#Y|{j05-&MIr8lRA^Rbc z(z^itvo;J^#H&Ewl&{5({iz4rg~NvUbnss)MSo9KSNn)Q2I{YAYp55V^=9V+1RQ^Z)h#8 z4TbIXt*slwp?;_``Y&~geNW7s)9ia(#fet&NUQsx?!D0{?h_7&{JJ51Qg_&w-1UfS zTf*+dD^Ig`C)Flfwc{+bo(;)cvNrzEed=}3zROzt&uK`SJw0<=_QaSGuIiZLw6jZs z#c6#@ii%oWn-i@YJB9m{WK_pEp(hshZs=QNS=(F?)y25oiXYI)J#Ect2@?`ii>=j3 zR&hlr%jGIb%WQ4k7PC9HDZ4q&8qg{0b!%HpUFN<75lXGHssJW(>DiLr9b9#=X(51v zt*zmrr9)>SrX<_lt;7qx-7(>8hyYT20>Rn_e{(EDRo{gdrZ(Bd4gT_A^}^kWb51|m zC*h(sJ5C8_uHCUMrpfDAGVpl!rO2ah6M(kGI8dK`g$xl8x%B=joY9o_N*%(&^xj`? zi&+-jod5%!@E0gpf|D@k^Y(;eUU6C)+>iRIJCzbTYh|abH)C5?d2x!C`>S2ux1hOI z$8_I#q)bf-E>$;csE-kNcciP-Fc6TS-8mvqDebQAM zx`*phb`1S!Ktg*xBQJNt#bvSE5?03{*KCn%yp^@ls!Kr;;;qz6;H{o5u%JAq`-ad4 z4?2Qsf1RuQu8LPZr4Rd(H*9c)?)FevA-V>b6jRryDW$qM>R6Z*f238k(Y|pjnnL$g zY%Jb*uRD3gw*!)!65mRy|G0kt34g^M{(?_D^$R>RKk+qx8dvj)Z~t@k1-m@^U-Q)O z^3}W+SN{iJ#ozq<_j-KkzT&16WiOvV^Zv_s=%&zBIX=6`Reox9w+GL3jp<{RCsxOl z;(V$My1UoB<0)MqEdAK?VQh6bbfxdauXwd)XGOT*&TvzoozJZ}aXfKZa?70hf;;^6 z*ZC*qd0M{qw0z}jX^pF2=`UFBX<6!N{+I8=*!}POO27BjxB8bQ&rK}Is-HQ>Uq8g} zpXw>N)l;yILEd7&Z_=lzWW>R*PHG6NtYC-u86HKotgZc zyL0mK5uIl~UZ47%{c+Mq{V-5Xc5%2G>9XHE&%QC15$Kyf$?I~c;;9UT4xeH*Z}EVs zx&~d=OZPUG2UDN0>g(#!nyYQL=8SoX?!m%XTjuy~osAWj7u@0-=)VA~6#DwjUA(wp(IppNIA`ACxl3~RQOgTwt0Wh4 zk>&vfg$r()J!|m=(C|Stz)3k{pnu>+{-Fbh^*^aI(vh7IBRQ%aJ|G+}YxL{-lSnrQix_yp(ee zehU6_C^Cxi1HkX$4G{c8v0WykR-~e)eplh(jQb|_!Tme z7`|NvaAY`Wq`ysuxsF+im1^;~z9Q;(H}G$f;atd4FcbW4!~S<tWj!dtZWLjk z^^6Qxif~%T>qEo^Wcm5|@DzNFm-cj(dG?V!O}`7v_+H)3bbXVj3?e2$#Gv*X7SZWy`_7%bQ<+B&hpyHBw zw=ABK-~QF#`MLOP#5{y&&&L|V4n&7EA}@TFB9CIV=qysrou55x2D;{x5;2!q3kqi= z7c6;gAX12Uq0<45A4_TbK(APkS>-irvG_pBkip_Rk64Ad5UcOcTRgikJ6|`HA4%z; zV}dN2ciZe4ISUr#&zQZ?unJi?KAkZyk5ZL2iiz?qDTu5-zo1=Fm3h{JTaadHHj;?1 z@^&zSrCyYsHyiHhsAU!>l41uW8VoQ|nF1^uL*$%WqSzyaKWR}1y&tzpshU;^i{@u9 z!WR-uQJcY$#iDu~k@2kstv2$|Ru|2U8a1obYF1UHtqKp~0W?Y1CEEnJd4fAf9 zBlXP^{dkfNA9y&aFru9E^4cAqJ7do5#WPrlDAvjLi50JB+?t)g1ZolNIY~(?yYWp4 zv`yx?czMBW-HKWH3vL0n>HIeDB9X4{EVF-dQ-yDMf=Bn9kfQ0~yhVqyc;5WkST5UK zquS}m{*(PibaHaY66(3=%(tk{5i#ig1aWvFFT2sGYe;kcfvLyqD@6+WZj7tCUM>`P zU8G3qyySVc;&0(#^FQm_j7js?$rSss-yugUP=Rt~QH z80lS9j_9ph=ixy9!6*@iLDx;_;m~9nS}WxCViYL_N|>=#dXF0Qw8?SRcgWQQ?g+ z@cKcJ3%Mfdk%k(0oCB=zcv-3N4!}6wKCb-}$-cc%VwwOpQY;Fm@OYjmJU;i+@$Q3w z*YS#|NBWI{*F(c&dr)}1*3|J%K)~MtiWJ_Hh|u-8#z>`7!cpm6Y_w-KMAnlcr8m%M z&x4^vJ=RBWY}8{o!NB9%2yEku6rRh#3m|b{C=riGg~!WwCg(XznuKfFT!$5V%D6Sl zcA!Lj=TawS!ffQL-`nT7Kw`cmrB?+50NF;wtB`rHJmI|sAW5M|9Uk}N7Phvg=ESBBiVeF`kHolp z;$Fx$*Y22oyt|k6tt;#bCzdt+@a(Yo^l{q~9xOl0eP;Sq(1A4ddb=ve(<9jlxq0Jn zTLSOiRkpT{`My=p5BHyNk2SS-=hV;L$fw#}*xQqOrMrC1+_|YqaiuTTU-{hljccl! zJiyw`TbrqQ_B{!Y#8)MHY7_bJp=vDd9Vc(ddijUL4OD`O3H#y?CP4MZPFcTB2(NJ` zZCDdpT^|}%zjo00)yd(R;l`4TXZwxnpXN?+Czg1TsKgF?*WO!}WUbv?+sP_@$X_-d zsB0eh2$wy=HP;TWSu0G$@-U8j!fVEdOV$j) zvkASd%EvJS;b<3_TFEqNX#;dF`an|PY zPKa8&tL!T4McWe6*Ky};%jO3T6gTuOYv{TyzBb8fOtfmA^YbP=?#$v=;g%n;+GXmC zF~tpC%Nhp5ka(=d@_Le0zt7(YZ*LK5yRz>70Sb@A03y+9Oi~ceef%w=Hh7;M9*IB5 ziksLe>lq6LsJ0n}h$@sdVRypZjOKXWNZ*}+W7u1ACo&`}ZcoQs&LbV=I&nms$!Un~ zk(>$qc-+knyOzy8+(2w(7r!szAklGaz0t01h|NZ93>*d|+-$eD#UghnR7DIVckYSG za{%rB9^TbU?dK{_Onuuf?B_{cYP((i*Hpda=@E~%x|>;|PI!o1zslGlwtY`L@=qNZ zpL%M1>ObOAcf?KiF1N>Jl%(Z2jg^+t?)crj$3DMPR(wpAknE0W%5Y--X*)4>-ljAs z=0&)RO}&mSa(*W#0CqrpM|(o5OqJqX9(YP>>?x^#?czQUX`z0wQ|f@E>3o25&eN{= zzE-izJtC>h)j71m%Lh@eF4hKbmFtwy78?(b5QE1muEa7|l9G24^5k}TMzJfl%oV5P z@j{-^E>A0VS-8inwl?5VZ$;=(YpeV0AlvEpam}%!zRyHuloU;0I4pa4=JJeic1c=z zVM$x6)>fv%r4ZAg!J&oxGj)1!SWz1^9$iwYp3oPyq&nc$e3b&7yo9^F)#zyZv2yYJK>H9ONsx7!)t=|8kH92AW`>#KMTRQi>L*Fm3+ zjSi~WvCXAGe`6QX7fud;wcPP|3Rv0N3KX^=o>nAvKK(b%XGo>JEn!~v^h4tg3@hrN zIWp~{!nDD_eS*&kpE#EKZI^#`b&VNjg|nAutX)&$b;r~62JW`IPvfDIyCCc}47I62_*XRUoPn9af;ui#}BZUw19bOudfQ!7`+W-N=0G`Z*}& zfmS{wOXDMx)Hya(#>80R%&civyvsT{jpOwH#OD}Kr*9uuIV?EQRhZVRIPI*G0|V1~ zRHgBX<%uF>|HS&#ok{;Z-L?80%N>Wvl7-x5)2Er~V@om^O5?79JMVP6`_$BDgolIs z;)G|9#DCT>w0eDAWz+Vz7Rm>?;mkEDiK%6F@l(HCQ#LwWRG#r*x7ct|-q2yyX<7H# zFLG2Hihle+*y~h@%ayvAr~)y3VC|r*@~(UE-hQ_937wPLwN)v|M)w~ywjm8x|01^w z{bsgkvn30I&M~_P#mVe3wj_vF(<4zUsJFk3hs`e3SzY|$hQ8I=O_^^6QDfrzMhwPH z8R0aTowe2u7p0E1s=d&?DzES*Pxsz=0~@E=t6dfZ(^wwXJTG;4t%LFNoM#g9R*mja zx7xyE^fk#<$@jUF$GG z@Cx6eB{`7#`kbA6iO*U*dl4S4Et@@S$znd7%gdgZKRdURwdm$~1qEbOL;>y_GTaX1 zr1$w~fWU<{zDbkENZ|8-aawA>Ctv@~Z@)e*ob=i?!@v9FuiY+MI4Ez$UCqBL98&$a zuMckZ-*h-{?>ET}XMHd~^U|9e{&4t$z+(@5IN}%HMfaY5-jf5?UUyc^)`uV6v0&@y zr+%5~Z|X7T@f$wy{^PrbGtTTZ`O~i+>pS}WYaTj%+xfxU|CxU=evy{3PHysietxKQ`9E@wfAsp~^qX%Vwf1K{ z?#;aF+{^xX#Up=tr|N-{uFnoTr|N;LSMFVN=@Y*joqk~D`(w6k+4ql(SN7cbx7+TW z^XP`n&u9G0QyQQ1)z7n6WUd;qq~X4gA4rHD^~ATocqwr7c;y@KclmhvDa$7=o%X== z&o_E!j`+9dv{x4X;rvBUw%oOHX;H6>(i1MtPJDAfx##huuJ3>G%7Kq#`ak;d)(bXn z2(3<=bm9GvzY~A$hZ?t6*L?i=qK-mCf2ZS(Ivv>~l@%44^@G4H1IxcrPM9=p%zIVHc{ z_o+PCD%|r>=T@?50gO_W9XwTTgU8e`3YP@=ix?pE2R#$z8vEwtDo>Ck*J{`BCo$ z?>fD020~aDW*zIxw^~Z#Klqh@@%B79{_m(n&{x|2!Nd=2)1Wxj!xnS!j z&*VoWPmJ#*PYjasgUDCni+pAGL|)B<5c4}wC)A~w@sx|S(q>j+*CgyfyuVDIa-l;9 zfCTMvADDskBr^w6i z#0x*L0zo2Q*wCdD_CknrUfcisY$(rsU~^^Ci#n4VFChNv3a?BJL#LW(ZZsw=@={d`lk+ z-%4Nk5LW&XzLoww1MyvX;)4(+c>0Rn8RO}zp^~TlLCG^84$st~T~|q-d0r=Z`ij44 zsN=)2QS!w3ljLa&$sXk#DYHj9Jk!(WH8`GBb{YbrefAZCb;{0;0Tik1Y(LCT`5^&( z*K@D~VaO3Y^Y1Kq=AR;Y<}cb6^ywebkAY|YD4s}5pPVOo=Fee+_{?*qRa;S8}@?`GvlP# zfo3cxZ{g-o2TjJ|cGO968N&w3xY_yH&SWP(*_||9QjgmE1;gb$)= zD1ZEzoWA)nIsIhH)s!+>V`BDagsFj2EL+Fq;i3qIZX-J5Lt2+0pK?rHkjza4Obl*b!9>vz)20oG6Q# zud1cvR_#@=$GX6nwD}V)s>4LiA9I6J>@Xd(pb)c|^JEc3y^HpMs$&Nt%2H6Mlx+%~�Vi=PfjkZ5&llU!dk}cANp)ev%p$-potM?b1HjKqJ$WS(*F{3& z>^RnvMgh#!0J&z@&PG`g%Zcs3D{^4WgMr^GVsPC?gng%6y6yIUO(UshZ6Dl zyH(+(A)wp02{PuRNa6K>9{GS2a4i{L6A+Kr8Vc__FgjihWX;$VDZH=1kPk?~3e7(L zWT%XFTm?qQD@6dRZA3lN7%=1m41nsO#OqDkho8i4cxM}Un}ElANQxAm&%isP*~e=r z>e0ShS4aEaLYVQ26y7$(lMhHiUtDnY1yB1n)$qI; z9>4jn;|)c-;I*G3h4(p>$Ooh#A9ySW?K>5lvXA$-bi4rY=x0R=?@tEaGT^E90=5nB zd87UDK0L246)C)(M*AxT2-`mGI~|*{ufo9NJ7kL$nABtNAp`F%;7vh1@%Xzz;a!0f zTrV#LXbNql?7IwlTxMMRJfNWp$oLbJq6lQK7s z3(-z>ylLnxhRQTND7<{=>3B7$goh!geSM@J@unDfrNHAe9YqT78Ut?ve$>=MiFjvY zqaN{IMElU~<2L~MAzqQfYk;0^pBt5$4<+KAi%sGE#=!dmcyB2%smEZYfwv5Js}N7T z{@4`W6JR>nht4sQeVd@iGy!a+6Tn-BBk_1UOW~CmcwYc-4djZbM_L7je1HMaVw{u; zZveuSxv_1+rrWmyKQ<{-r1-lLq3ea9$Ma2*(p!xP@&PG0ihP+5%fWtzGKOd4{2(6h zfspE>sivMS!$yh~F{tOH zbZp~(NTs#XmHLdUO3c~Dd~Ci^z^R0op)O`aCx|e_!;@h@0&UA{I3TUaGtCeV-RI%FnuFTUF=%TdQ`e%1RZUiHWrgDzfsBaZ$#9eK8v^N00EI&U)A+GK%!AOt9Nu`|Pj@H$$h_|% zhpb_kYu?qJFkGzvgZB+ywrNZw=D53$mtzp2;Z7o_+4bChuGJ+K2HnNflnb*rL5p@@DzJkSl5& z?X5bvo3qp5k)<{wYhUp7Xj_ZOov_-n5Q)~0=G1W#JI*I}XGW_xarjz|eiCT>knEUc zIXO=?;iOnv=ZZhiDhStKSLb^1Tx(Le{>nPn>a*d8oQ6bqOk-t;m}t3lL+`7rdSAmA zDGd)-dzCx=SVDsJL zwB8p#es5JnA|iHoLW=pFva;}22E%H)b(RHpkDQNb#EG>qL!9qzQ?A=egLgjAAGj0J z-GriLBXh19m~-{eoUB3C@R(saV@IO%LjOVc3XH7tT=kapEPEA90_^8}D!wZ?e#*dVmltU2VHR$mHx`ni+Qf?8XD&(;$j zSzfrNe{6ViYQH2@k(LJv9q&%v6UX+IiS`vlfiuukU`B2l^h&&i6|Lc5hh|nFo7w9P z-KsO|GWN;2|6}6AX`$R%wGG|yPD{Kv`S2>zO@p#N_^z;_pOYtjgB)Ls36Ja^E*XjV zx%TR0ywCGBRp9poS#&7fYRfphG$oRy=6#8_hsfc{?8>;%6;4d?noN70bZmnkcSgz% zZsd6Kf0Kq(#uPT>yW=sO1%>_b&9PSDOFou2p@b8>QLK`M#o4`Ad_FL{7Yy%TnL1g_ zOpddruSa-ZTzX=0c3N@TysWWS53s$e8uGW}?SaG_2JK+{mZG(rZ27k*FW7?j=KL3*B9LXVNqc6p!L`OV##06c;u{YonPGixBOns zA9Wj4{fl_thkv^8-Dlt4G3>6`7wShgX1v(*q3fp~|3&A$Ik(UDPWAlz(Gi=z>v2=J z`o-@a{FkfGthD{ZzS+EI@~TV61q#ov$$$9WKVC86yR_Ad2G4(F(#yR+c&PJ<{iWMl zuDRjTO^eQbf8T=NT(ay2dtT1w@6TORb=6mYxboAB?>x5S=$M2)v+f+<-5&H=denByX5X(@5O8{d+A@{PwJYFT>5$ctKQi+bHl$scz){9x4oAy{Kvmv9lhl9 zzy4EWy*_Mlm0SM{YhO*pwYH-Fe*W+&)(!Z5M)Kk!-i0gt zjq+mtS;Vh`;f0FHm(Uj*K;VyJE=xl79FM6H~Cx~#e^`!Kl6Lwo~$S`Z3^GUCe?Zc6Gv7VLq zLxtQc<|Kg?#QZPQ+CRfHjqqxj|7nn=;491fWcUUVKHKUk^}E216x;zkTjtM}oPrsS z=|=e~rM(b~@~lEda|CPQc4WjkredxP@}!((%bScMEpJGIaI3Iw zE~%J10-Gr3y%5eTZA&W|krwymNQ|;24sLOY`JjyFy=*m4G+pv-I1%jUJq+8A9f*Fm zouZ0+7Ph<@$ooXfe%vl-%a^=bBa5bxr;WoT&wTHcJoDKhdFImtex*L|jjYr7ddV}- z1CnPxqz?X^bh0Jyj8kD&08&!JTb~8Pu(q&r=28Q-b-PV;(Sm=9qf@l z6!vfj686aY626u841la_XQ3kAgCI}8-7Vvp{2|E`;~B}f*`wE^EW5~8+Q}@t@*x-~ z9UFP#PmsJcucJR@q`;9j3;QLeuwVL|b*9>kXdALzy@@Z494dKYOqV=GGbK-qt&(S+ zuSuSE{#}dzR`Se;WXrBq)P>iH6Y;uF^wj$OIPr*IEuOePv2fB8DF2KLPwA$hq2^oFenCFS3K(> ziSr0N<#N`YKB+?8`fQ)1hK2DK7cRhxfX?(3HSy#}6y*wnV&FNShQeC;jGymWfH+muZ4}&kf>Qv9cSIB!eQo=sv}O`I%#<}=Uz4^Pr{O0V2@CW zv?`m_EX=+ocftIhsuQIZ-6&4%!`wv7rkY)dRq6Dm(B^e#u9Bm3OPh|Wq@PfWoVA|q z$&e@2`$_8NT(h5;9F~JwQ8&wZZ!>bud10nhWq;C?ut<}?R1N?5%r8Sr<-ijo`T~5i zsx<}WbCtf$_l{0vU$aqR3FX{*v-oN@r=iZ{ntijPtW&5Om}nS3*}!zIXxY!s{V5o> zLA~jnR6eI6&sd5zo@Zc5$DhJ8)fFE74R>(j@$6e>Y0r?_X4O$+R^jpjoUXHSPFl`T zbtnJjbhKM>(ZK#)(bE|C?&pPsBn%INI2MwRcY?;-jLvvK5yvZ2&n?sNz;T20FKpxk z*hu`&B*(Rp*k})BO!q1_9WQ`zUu=pL-iwIP@%8|Zdc;uR^ps|~z-;PD!W^`Xy2<6Jh~FM|=_{Ub#RZ;*jk z54?OR5s$yem3`|CKaWK^oN{fX@XWb)=^p2Ljd-VHQ+V?YJl^BtHKrnkHy3*315z+o z!{hIAg~xYJ_42CU%`%zLBfkuKI^HJW(f_oMmx>DSdIPT;!t{qC>XD{`As=7>RHNbH zvc3(Ea}{;_{74kZfA2$2$9qmIFWWz5w71T{8wCOH*D0bN>1hM+xQ3Soxx(86Mz=2( zoe%R-r0|{xLp~q{gVBilf**;k4>rn}?r|_Wo(Fh0AYKvmNRNUcA7B79O~Yeck8 z4!Dk&k8lsfD^hr;AYR8?0X%hnoC{@zcLa=%7e+eXUs9y-{tkwGKnnH)Zzgz_mp_#$ zqkTPG9r4OB;3y1;+xXL=r{nqM?>FL|FZGD`4Q$cvdl+~;e-tU~FQBC34cG8^Z-O%7 zg|X>)&j4>4;uI;oI}xGdjRoEb#L>PBrHptv*mOKMI&t1#Q>5_tn^VUdg-(j|h=`XV zWyDLzrsF-A*nZCpB7wo9s>1*SAkK|eF2zuiTz2nfE6hV*cW$YCBc-m=`vvMvm4PDSRmeQfMws=1F44lv zWop`!nDpcqduQkH&R)%Z${0Fqs1x(kYnbkp7Y2io59dBDkR`f zKs>(HR0{zfLvoQfDRA^Fqv=C%vVP+F*4DLEnAB0TJ-GAt{B{*r3e5|D)Q*Yoq$S~5 zs5@nM($1zvw^e^2_|7}8cedVqIKKO?yt_XdkfaQQ^+U2T7s~AlLVq>RUp#KMZ*-0S zHJ2Q1jNki9RAIZc+*eTo<=EPoxX>t1Z_RH10ep^amj@FD_Ty7+cl%oEycO?y z@T~uxci-x~|DZSYuOPwxeWXkCC*J*k^MyWDVJv!vvWEV3my#oJSP4rV;YTW5;e-#r zA(d$v^w&gzo2BzG_Od11SEwzn+X^C0H)+{=j&R#G4oTJP>r zkG1^X>XVJ3^tpRZc_hJd2Wkq|FF$5=3s~<~&ivR@fG=6y?#)DZwbV1Y(wcr~(v6<| z6S-2{umk>4o=H=D`$vh;c7y^`efYH0{>trgG*2PyK2y&OWSB82Y8p_n3EKYioh{($^E-`rr7PU$GBi z?!;bCeb`s=ns+@uo03r~LInu5wqors5o$Rk+AJ(S;+wfv=mks1dII>~*8^Uhh5T5YKcnH%PdV72ud;`NMvYXpxdc!a{1`-06vtK`(OG*9;pcMlp6bI$MGtLJb%!5&-h>9l$Qzj7rAeP$7R zMKM!M%O9%z!HO@wU6KZjNn$SEne}VyHjn& z@x~`ly#CaR9-nOaeCM)P=FE+scS_-#t;-UY_u8^7=cN-nuN@mVE`IK5^Ag^HEN4!y zoR>m8`j+)7To7D#O5uV)?W@P{-g5qie+_$1m0Y(kVYll??4w8if0m`{b-Q+t2ZdU3 z#GTaRBa9?}-1z$80YCrHeR#l(4}0u9yz%qG3ok3Y#rN5Tmw$Fk+Tj6b9nKHDKA_j@ z`9b*h?p^1HHxGTa-E!TYAF*AIFI)k95U3Rc&K8hU!_oJc&pR%=|H9&!*fMnam_^I6 zB3_IY3Hn&U^HYo!Xl+!(Sb=jj>?^}cp%`SgcuTkVYB9*{@-||SdC$f`!B1`01)F#A z>w6z&A~m!^8|;b=zM2ibQZZU=$Nak>zN;Bp>nEF0Q|GA%)JA`4#g{c({MJq{*7Jri zR29UR__kZt@6(_Sc{898T`i)K(o2w?-q79t(DQLEVQ)vgp5)))5B(-suv0`;?%Y|IT!WZD z1PfjjG3#G>rO927nAP{=%x1EpwQIwPp%Q=deZj!r?9xYkZ>5%w@K3r|j5kEYmr?x> z1PjJ_*0;8fA2&8OfbiA9f-gM5*4A&oIDSgYalapEL%A~aB}0eC_%HV#Kd0q$|D>lp zb=zyUVEk-(Hi%CdHdXF?4%Te(x4;?%*Q?;O_cK@|gZ^iNfj`Jrxx820N#1;D{h?Ny05)>X5p!n%x_-?NfK6<=bK zGxD~a`rE|%t78jbZPf*jWTLs0HZ4Jmc`LhiVr&R=dqsQ0MM?-Cn#?5 zRZXT{h8$8Q;Ydu_Sog>4o;c z&E;MeTIEUQJorELYszd%SK}5$1O;yvMcn0WL28J6tcKF|OT#_1JmQcm&;C zLU5L27rYD|cGJt6jRLc(VW@t=*3KRi0&_0h47qvL8vyQ+%@j*clC zZ55BUNA5X(_tLxbvby5Cj;Vb)Paca0Czja7@iCYR8Slch#ds`lTO4m=-R}5=l8oZ` z_>#1N@v*(*v7kG$<|ZTTn(OU$>**8NLUn$Y4cU1V{q10jdszAqis5FbOOCLI-Xt|9Ve}> zF3OtnrQ^Z>(>~`A`kbHcaWIDe5A-!wVpj$FiLie^x((55 zi9QSAKLra;c!2rs3G_M$|MmWY@7Ya#`@IP7jz4}rIwRi#&-Cq+@+#)Ww`2tirh0IV zdj0fiag*}=Ek9?t{D2C6bw4ijKCJxqhmTzV_{ty34F;y!GiUpzUD~f`=4^j+mZ!X- zbZP|>xB6!auqW1Ef4vhFSl8d+1oG}L$n)GZe{THDRzLc`k$XJneBc`Mbn9mop>M06 zSm=&@`Pkcs$`_8`a6Bp0>Th1)>9^fS3;i%k;8vx11h6vltpnHJ=-4cb+}-5}%ruNV z118pFd8!*KI+)nBURfnf9D3~fYc(UM9lB{Y%tRmEAANMq0uSuyo#s)_x_+{gt5dog z-#Vlj0Y4=R6a4VgwZc!s94~b=;QAYyjyX9-^-<_o(ns+-Tg!{e-nKVj9qG3YG_5Z$ zI&a+ZSikU5`Sw!!D74z&k{5)3;iH>wg6&~{%PkBGejW2>5E`smW}V%&h3gS zMFHU-!Z4YDxhY@6n08FKL!rz)^zB!oEgkQRmW0H@0@;pGMS45xP(f|JX>UV=Bl|}4 zO!+YZh_)r#Px+yn=D{@4f}A02^{!U``k?1=(LX-nuj8qS)0u+^hOn^Bp+Q_mh#`y; z=R_A*9CbYTF@)i|0z+7x7^TDzhUDm7IcSON7%_wqQVwApnbZ*0qz0pPK14f17!y_p z(Y!Kvy(hd9Q4v}wK1q^bVP$^2#)Hq2;HQ2Ht^u)_J+2A1lRLy+ zHh00|irkX*2@$eQJ1nadt}hP-t~UII#j(GSarXZ1K^6F+Hr}s!3~$ z2I7UThDi-#UHbUgljF9CG48E ze$GIzGNiU)?7rmiF|1b)cmx2uk1s?dPt98LeP(NG)*dWmAKFn<)iAbcA+#WOLhg0V zcpYMko%%Uneh>xjo_9{3XZ6$g0t1iRTeJF{{UScafX4xJhx6@*A^_k61Mqz&IlSDH z%VP#yoi^{#^z50L!PLKZbaJ=QYTV6vuv;8_yc%;m@rW-Rx+{vOi;A((VKwN zCfb_-l|&rw1av5eJ9g;8X+`eDug*#T5i5)$j!Ck9M7d+*DNZ{T)lim}f~%T=*(sB= zPwhTxMAD6kOYbWw%TB>rf%;eFa<3B~jL16EHMA0Kse7JkFX!Z)`Qq)OExBG?j&Ebc z$MIdD<7`jyHg0$*y*4|=$&T}zwp50|wEYCpyNDmNat#X@<#@Ck!+ z`k$A6VaCA07Z1I3#ASgiMvoace!?}Glc!ua?PoXsJUb_M&fJ^l-%_w>$*s$8TX9F| z&bwBZtX=o3^=0=xSpLu>k5*P~+FbqHZBN!b{kvy>zw^208yfe#)b#4UKkfhX8-IQK zo%h~v{`)`v`Qb-LKRx!@7hfO$?)x8XNk2&H1?mE71|0+0z3|t??jjGi-Hg9u_Az;| z?H`;!d9Zsm_iFBPtjjSRdg0Ke*AKmZ=z>2S1k?OO^AE@Hhl60~99!;e$=HlR0Hz5E zL;PbD1!Q?3Q2``WoJ1ldRD_NcGO3fu(PC1j4|s4tUfh?DwE~`4avsJ7z<_Y%?e|#3 zLBKudV+WI5w;*6Ql@uo zWE$kh9EIJ8XIi0yJ@ajo!4Be6-`SWSbzvW(e2Ddl!~q<^Goi=f5wv{Z5fdOFWZ)5p z2*hI#VjOrMMOMJ!1%|*PCUg)FnUhBHh-MlmKj=DXsV^`@e&ne`UFIijpltyJh|eR# zAlMG{*N(+F8=HxbBqC0wQ#iIr3tS&?pi;yzj?BaI@d!K|Ln2=B7KnTZ zdlL3O>=E{bJdETYdB{8zVe?QN0*@nguz`0p+jS66U8IG?A;C#3q!+r5jJo6mmcSP& zsLTAUHXNBBbs3L8A2{gI7U+UP+=(J!FViwCF?^DTOehMBkYK4poRA~)SuV>L>q@j@ zg%r=-$h#7Kcs$2=AL7A-TsY~lk#M98oYY0w;dx?0Cen&@
        hMLcmx)X|QxLtsg4 z;zKHMg)a0(9!|dP_DQ=OI~AtL!?B%tGaqS(!lF&Yvmvti91@#tjbtH2oMi=^xI`Wq z2RV30XC!zeqz>XOp+lZ}&`G2mn~?G7$oTkL4%o$#TP{(PumndJ4I&Bz;AI3K$KoFm&}AI>M3ENp zA^|ZREJr5f)F-SE2%fsc5W2*4@^DAz%oc>nZ~h0=!tmRAnYQnV;dM@yAV(& zbR1jBi+Ex(Z?pzAhT2vv_*jgJII^*UP$^^>Pd)IlP@oQlLL_!jL?ra6OA&TVBXpUJ zx=aU|z+hfvsVDOlL1IwgY)Itfg`i^-^Wnc^2jd)@nMCG?e5gZwVKW4 z{`}GcmqgCfD`tIqniJ!mlyOH<4b8&8P=YpIC z)7~EY>0MoCZ=BJz>@RPYy*=gZZ|nQK4~O(W#af^H)eAY_@nKiy?<1eGllo4*Gl} zsGaye??QRL1Q2aoKNH`lriK%~fovO{{QVow$Z99P-+KjHC#V3MOU&{TL9yfezB>>OfF`hL$l*qPBGSu_5ipTYo-y-Ho`eZc$N`1{XN@|=NaKSMtH6fHvM&zb-An$D)MUT zm~5{p;Q2mwiy@yS&qvPJ=KI$Jq}MHHi<9SMVC72{zc58&T z$2yThhlYSSC$%eh%9+geV+RuFY=*=4#X-H3%$um>sUMa+({X5KJn`5slBbWjMjrXD z;Lnykv7eT_5Bwg<_W=Ka&&IM<lo)%8p#{uh#Gz9o`R#Br`I%4tGVDO?Ce-(5 zh((@t$Fh)TT4Ir>k9o?G_uB_J=`aG*2ANczXAN?lAj5l*A2`!7yLHK`@sKB^7-KZCiz(K zVoZcS{qw1eXWb6w*d*=0Sn{-gtQLQj7UTzTP07wdCi&KKZ)lIQ!HECb`4!8332{lViP_&C_r>D>PP z&Oa~G3(R;^gP$pyF>CH@yns%wAiHqhVsoJe^?veCsCRh5TIq_{yZ;l=lN3*ab6$;( z@^Urv>!2W#BX$s@`H3eZVFXc!B>eVKlq8Ob+R>c)Q{QKDtnK&>C%G1c?raT4Em{%b zC4Yix>sOd>;TvMpt%H6dt(0Q{3HTA^UC{mkDY3i-+|>T1pUGp}`3d0FvJ>Wl2q!Nc zK`Yq+ou;^ScJ|GN^L4+Nijme=Q2G&;NpOm=AU9Vw_Zf?`bMm>~fFoe$!WI?X_Msw$ zNn?Lx-2+2>vd4cs?I0c7Osp>u&~Z5x-8kn=5UU78ZZK_Ug{Bjs;Y3n1EfPA;m%?xt zGpbFdn%RzK<;;?{m=Y{?pjl~VuN=bLs8KUNS;>THFX@j0MN*3hB^>h8P@0-qY&ygN zFeP+IJG7a-Tp$9;f5acoA`4CGzg&F- z*9P&tH`h+r%4&?6sUB&Yxv&~6-W z!A5&1V|cHD$Lk~Q=Xo36O9tKw4KGf^yB^?BZ7atFDZ@dKvTrK%bo;^@9^IqtyUf7j zb=s*8R0q6a2Ht%d9&arvyuP@8((TKYG6hLJQZML{4=@0#(C~2Eqzx~@z~eP#B>#y= zWRL~0k+y1hoe@^{Jz$h~g_JQ3N!hpFC~uvH$J;atZ@GaNf-I8%78`hbG(4|{w+6iK zzx$*N2SLidVuZ*CL@Zvg)bNK+x8wg&Uhr~4AnMLc+}DHzR>XW^*44H?d1cc<8KE=3a=J=Iv#%j z@HYd`-|pBbDUx0JafH~ZW>-sC@Z`_f!E914S@m$CiNJ6S@Hn}KzgoY1dRnA`$U#E4V%Jy%V^K#=zJ6g(<%PXMtd&r-`@ZA z(eR!%@E!&p+q)u#x81ll$v3)7LmkhjTfG2MU ziImhMHG&}@U;y--h6lC{FW<@TvPuce=cpdL3@P3XsMGEgDMCf=cG(6tgRCoi8`k0Uqxqb&2^%2&}%UhWWuZw{< z1$b%7IH|{Al7UyD;RU50%YQe@rDPdauLIsp@bupm*pz)Y8F)3o zU*;0#BW9<21YjMtP4WNA}-dqr4vgZzgb9-m5gcrwqKlC#0Y@Qwpd`7cw$TLIte?QbhC zb|dwtT#tvg2C$Jl=;VEfqyMhOMj7q>nSs{>7l(X)tw^z12A=-{+}lPwB_1D%D7*@Z zrs9Fl|2H=GdRzw-8x1sl56uo%>>VO9) z2Lyt%Q{}zU(0e$Fo{jTW$9s>Jri=os@Xj#xcu^WbFT>P3GqT<|Q;!#=5%4;jdg5j` zbR{YK&NlUUQ5pengsFE{WWA}T9xqBG;AKla{%#<>=X0J7i2!y?!VMo95=R^a^-Xim z4;gHO{=Mw4l-}?tdeta6ah2YbD0+_>c==KEere#XilX-iWQzZ`bK+s><*Gv9NEtWI zY2dMqdbe?cQL=ZTr>`$H1s6-`O2m0YMWy!*B2`%h0PqTA*#d}QJMdu3ojd=(TVKjQ zBx8t=^waB0`PimF&b^g>)-}?)ARh<3f=j?7a zVY6rw!x9MSZj2CaO1NXOW|2#{DM4I;YGDI}M2V09LMYS_E!m{{FGMSWYMaChf!Dl+ zcnersHY!FCUqP*Cr3KnrywCz##S7&3{mz-$oIP38_x=Aq|M&kSXU{V;&wS^ZXD;V5 zb7p+)k(F2!TIVzHgJOLYZn@*s0+VeA8pNJ-;H&l0*1^~UN(OBaT4G5MiLWU=fzf0O z*~=f=izJ`yH>f5-Z%xn!wCu8%-=Dl;m3PN|dsk+4hjItw5!EwU%Xsgs<6!F{xX-jAW9$TUHwYdiXQdsig_wd1B#D-7yj4Q$CfVdXKHwa(q zi;a{b_+-joZ*LzFG~$Ro=crm>i*vRv%mGte=Q_}^%?D;%c4=#7Q#`rk0W(D~cEz&O zT3hUc;#VaP8K)1%iUs4eYljcGxzV>Lt}UB^`}NxFnj5fgiNE3oZObhKe%53glz_!x zh~)W5tN3mC)>WZAu-deq?i`(V=Qq%)w52d#`Bd~q3P3+y& z=(H;HJ)T}1Y8y>>Jl)0|DtmgF|yQ5G`Xl|8Qt?AIDz$^_q{i|y%98iQQ2 zJo@8H)-8HR6Edf3w*B|vM}*Nfe8^)TTUp8MywO2?MS7hJAB%1smR$NGb1JL!AeS)y z?CdgsL)Z%`$Y66V{Fc6$HugpC00v2ZyNEE)wPL$J#~x;Ank(>GN?FMudqe9?cRH#* z><+(Yk{ep*xzi2D-;!EeX972f4Es_45T2R@H>CHt4%!T%&n{_b9dn{Jw>j)ZYTNv6 zB}duTAv?2cYwJ90L+CQ1E^w1q(e6uJ<;SjL*$_SG3gx|;Alhk5P((!<$U@-pE^O#y zUxb3p2(#g-c0e2SR}Rth>~SESFWd|@-xAs<>pP= zILg2NB=(h);rqU550$J;8#W^>)&pY?C$P}2o!H%wap~u|TXaQtJ3kcS;u`Tm2g|I@#?JZYpHxsTfJzJ`?yn|16GR!v2Sy^ zQzq#AWE|y&U?YzCQiVR!{R4P6VG*&Tj#JD?V7KP(1v_I=Gj%B*L>fDO;-nkB<8r;z z{WJX2#?Kr-<7VNniQn-zj*AtBPeyX5c`=J4SiBH>CU_Sw2`;#{)3$mp1LI;TbahRe zG%?q|Wa3!=d3*vhvcqa zwQ5FST3O-j;+1*x7frsqu&XP3SulH4L0Q3!(Ki(Z#!s8QXz@);?<@%{nK<>vktGX; z2lH;cv1s_MBd@t(Kw#{G+?iu1&!0GFa#`8*;bVuE%wIipNLSbB;;ECTtXQx(uwp@A zaNeprhnL(kIXHdJHLF%ET|M~5vL%6~cNeWF8hg{E>_s;gjaqW|&9iP@?O!zhhOVw} zF;G{$8~9)Nj78gtds{{S_rGJo1G|Z0?OVq=Or#tf*bh~!mhT_<9>5kgn!>R^KKONz zU5qA}-Mu>;;9~7#r{?M3gK%5aXb9!6(uyTQ9}zxLx{OojeeUq$);(O2(%o61z zx+2P>mx>VGMrS_I3zlo;y!1z0*{8d7J zfVNqNv!qk-ozrybo-5o##avskf*7A`)+?fWqs9G&Mc+E9a2C={!FN%|Eb=c&`RTw) z!P{hxB`6~P9a3NV(fzgs|7i=}OpE(!>1KUP!H!dHmhh(u3@X5pg151pYp96nk#sM9 zKpb00HR+>g2yfJD_?zPCnI?ak9#4EfL?VvfN3aGa^2BhKK`MBLvp$hmq@!FIE^xr( z)trF?p08c_{*E%4I8$%(eEpOvdAxEKq*D+ia4s=;p+6G^2_3*QT*$~S0o}RyMu9SY zB+qb?+Fwk_bKUr2(Ak$vc>v)YHwCwXFABY9$Qtc^019WQy} zk<@%@p+lzOCv+eHNaT@?9^}EH_M~GEMxL_wNnV;r)203bM`DV+$ZlEW1@Bl$;#HsQ zEW~RyX-@W!*qTmdCD%9Jh4|xK2kpk01|nW24O#x z3Z7~4(53z&FS1Noy;8g32ZUGef~PF6O7y2}r?{+mAdz=zTY*EPf}pyV3ZC&;FUb>! zMNXbNi*f`{jH%L}`JH3pJEbe_NjX*Dh^6M;3w@*=L|KeLAV`$OK!f+iBtOdV z&mu3&l%ncekiq0-T^&YVmM^2JZ>L1w@qU>k@(!N5Ux9<)xG?V{B~RUX1*1Q8zghB3 zXSU>-j}pl}nw^vt5p6OGb{tOp=9e9=tqtTz`a*O1d{vyeH zab72R+O|saEUy~LGyQEQ|J{Ax#^;(Q=^+WB9SCnibv;s>Pc#&$!!^&9AG z=&iG&fvC6ozJ&2<+dQ0w4Z+U_&-8R=6ohUx@|_c9_>B?MNtZm+q2BbTeR%yK&vb@L zp6Rftl+1X^M{EdrV*gnBGkuayL6FFoyk3ZQBn5;%;0=A$blc*kMRQkT()_}?`9*gH zOUojAbuplHVQ@h#|M?xeA&SY8c%?m8?h2N_aPg9rm`un?$7)7y=U~Q?LeaA=0c4sr z9)+SbCR&G#@};`-ilri&Dg^M}t6cW$OoV^}1q2l133!_C;*(e}l zbe8H=IHE>Gr4ojtXZy7J z6|Y#_*>A}L;dgb^hY_9Nmj@SVOH0w<3!+k4Rd&`*a{&YqtTbU$i}GOg?Br2&*WGiAmn?{w zib4xlp@iUfk;Z9s5G(Q*7pb}OvFy}Ys#9)^4&u9j%u+BDC+J^fQv82+()#mGC*M3hopfiWJ^g@G#@OWy0gNU*YjPdNbZs8D_=f91kO6j4r)1@99R9`9`x-cK!f^JJL7F!7x0ZPxFc36IZO3U96jZvnz$>BqVJW;_Rk zRC(}TPT^evW19239AT7GL^)DV$eHnyfXDl;8*wmwg?9mr8Lu2+IXDz4yf49!&yfLH z0LcVTJU$mOjC$N4^}{2DpuPBIx{4@A`k_U?sldyHKk@hos_-TO$gJNHgz?^0k-{4X zIr2F&;2~3f`3S7=`dILeA&l>06e&EP1@9>n9v+nS75>8 z9JQMeu1MK0Xu-?GLxU<`KGG;W%~BrxMuyK9iWJ`0@F$-m0~SLl6Fl|v;ZS%-A&37+ zKlwf!kHf8qa-<{hC!a$HXan#D<4n9OaVWfhSoAB0+lz2T3hxB`&3Jo(r}BFhgcaUv z7Q8yR?@?eP4*j_m~B*5O}Ko^)umBTJW-fNBtG4 z{8m`-mIF`qFMQ-v`f<*-xjd!=FIIoWxwedxBNMvcgvaN2g;#9B;~uRHSETeSwBS7s zyi5que%IhocoQvn_X96h`xtA%Yct_xoA5F%c#i{bF2WTl{jRX!eFD6h5Tbs3{#N>J zg7M7u<2re4mx>f#4TQ+&$bcMNq#MB#Z#WKxx7>o4g8;s}SETT`Mu{2kB=Al{hPBtNuM_=?{*elUMa+v77N~K6CV3>rQcOx%=X(0 zJoCMi!t;V5pM!&xkcxeIab|w6!@)4tTiV}@_ZjfMhQA`pk+_b58Lu38d*M&K>v1T& z?cmLLr*U)Rg`XmY_XIr5csaPJ&4VBD{4$LC@x7H9FA0TF06#?v?>=~#@#=u5@_T~} zBi;fWX1rCvi&eg?<7T`x+{dc&9dE+RwcwQltPlJY5rd?3$Pq5|%_h8w@S_~{djA)8P!r$Zz?Mj=43MPcu4sNZ7p&b2d185jegoG35+-s%U7jTh=#s<(>s`#8t(y>XLM%)i8>JZKhCK;|0wo@RR} zqabb2fd)WJ;D!>+BjVV*=~eIIh?{2M1sz) z$mro26<2E04&+neW+G-FohBz{5n*1;c6+li1xU?m3{=}f$&*i(|9kIYV|u7lOuvNa zS6V2!RAiuFy*eRQWy9Mz@89_o(mz@ATY_dd=1u%H9|?V-K}X{Yk*LU%k} zkm?eJfxvyTh`>S$Ri@#aJGM5zxJJ2ADCV@FKdo2a-d>P4S{TrdTbe5UKuyGi`GdM3 zGA0-~Pl<$k%BtyX(~sIuInEnXMoqZ13G$pN@;q8U(9jCwU`haI^@a4owR_zOgAyig z?ozo0`SG!y;HR?ZS(@0ao3aJZz&sy+3YrF~>5r)CthfUW6?N}dmolAJs(ToEZqxTr z%LiP6Rh%a#Z1sS1>+t@F;x60J$jvc&>h2!p_xiVBelhfF)FIzyFX+!XlbA03fOAlS zw6mB``GCv$b^HIuB%eXJwkzs9$A>*(2iZ0A)rjvdcva{id(_he!*L-tkv-~ekKuBV zLdw`RuSuHWnHG1J#XV50IY>{wr$|8z^ZgpTSo2&0y6=%$;(cU_=G3;}tcc+arV9hz za!5sp&^;CR8j9#nmv|f#O3_?m9Y%AwLpNM}kCUQZqU}_HI5U2m#XZtwa)vLH`pf{I zf)^weP1`>MkMG1&CT9?(DGOB*z zRzvW_;QbN(8P5A-@@y&NBu~6N$*UHk696PIm11zKHSdIOe0c#9x=Edht7B}CM0M3X zmn$UCc>N{McsY`1ylIlBJ|tZ>N0And1QKaUCA-3{)ECkf-cq$y2sK@;C|7GmNvqPd9jh$;3f?52)5-6}kbCvcsf5W%(>X z8Kz~%p0}YX(zIrJFq&1{%Phoiooi%WTMA-DH9W_vshID%1S9cgNo9tP zJaO`WtdU4rf6+U9+W=y0sm`U`d9*U7ww=W~LmAcgJC!nvQOg+Pn&?iy7Y)OO3AYpx zI*sebI9{wIse7iGaFfSnS`e>=W@0~2dJgwORykg$6e+p8!IhJ20; z;93s6CJ)6ye;&M++ziHyHx7QhA5cU&(v4uq=gj~4Yc9=DU{a3Gi59%&z*FVH{3yI8OL;5?9_^t>>Bn_& z&HC*CUM7U7AM>N|Hdydh0dJfFlX7(a+=BO(36Hn!3hzC{$A6@~{SFS=LlNajZ^NH_ z4jrI#COpZBjw9ZI9C080di(Mb^@yZ%QWFVV!?9*Z;I4`Ct{E` zfgztm2Ph4AnK-jNc+bu->XC?RfLXs;z(duF5amet@;VA{4DcAAcv(0U-ao*Y@#X=K zc2T78PJkhwBLi|x`t^q&!-&uCcg%Q?054Ym?1zvUZ!z#xc?>k+Wmxc@0bV)66%m8P zx!Y#EM&RYbpZUES2g9h}MjX_SZHF`r0SgRP{4$Kk8#d#tf@%q1BFd1CLC!oL!Rs`M z>5`P(7?cM@BSbvLWjLR?3D0(l+lFO9(}2WxjYnh;&K@>Q3`l(Uc!ZdEfHaJIge>%f zVmzXv^@}yTHiVM!ooJfQ!3p*5wEXFgu?0lKMk5xt@a+6EqF!&ZhinyX25vUKBcF9e zL$KSVofR3~JdKxU1XIWQMppPnV7uB1-*D_qTj3jq4V#T`w&Spk@Ua99u^#>^eNz2c zUuwonQ~3rqPJD*C=G@js+k_&m-|^XbWhE7LPtE7yDW4D@YlHlk0oUUJ^gf%Y;&8|N{J(fPWY0~J3?VYWZ5MubcU~6Q(W6| z=zy5^u5LTBV6X5ocQbsco-JQChYQzXtRt>4c+h!-Uuy??c5M#d#zd2kIz*a*ulP2( zap&!>W?#3qyec21cDs;4c;nl6<3rspaJPnU+v5^ndIxqVz!JiZ(Uib@Se{}zf{sHN zYbJc;M7{*35&5II)^OphozN{#eC8f_&p}@39q38EL+6mcCA)2%=h{=a1dQ4kF}}v{ zw`qKoLbUM**?XV9&b9Bec55xcxI{%p_n(CD`n-I_e5li8$3Ry+bGO=#kT*6ZZ))jU zzH6@tqPNRd+A8XSUA&lo_#=)5AeLRkf0{!VHLh^HNMo%8>`lBE~yHJ@~Zry zU{!Xgq{l%Es z^80cb5@?N808-ukf}=}*vc7z%zacyhI>Wo7?k!Wb#U|uI)^7~vI62aiAKwf?jybf| zAK3|U_+>aN!qcy90fLgU#hrdLSpW@TMVu}SB?cOh2HMc*Gsxy~Wcg4ijI19*){i6W zXR6TVl8n5^x0JMPJQ{bh{+y9Yv|7|wWWu}#$B1>XYf6nTxxtsTtz>hsDi4Edeqf_& zA}#C!4rq=KqFiE_RhTbg+ve}tpZN8%lA?7DVGfAG91Y>6s-`Uv^=+2;or>R%UMI+2 zCypJ?Imhfgv0lZjbxmvm2zhw5UKE_E3yiD;wm9J97j4>k%)upJ8p2Z%+_Db%7z%_7&0Pe2q`TwGHkNUOxH+8F z8lH6`JXP5ITpqBo?oF|4{XwiaAk9@63{;neOXRVAoc z+v-sYn|Dsy2*ZyJkAe}M+K^zk8NpOk+CydGvTRgXUxhD~wY3`u!#VKSWNWEE=s3Ai zR#(pq9Z;$&jDnp|Q*kSBdQ?eic&0lpzwYOZ6pvMOX!JWOD}t%mro1&g3W=i=VPku^ z`D=JJhiA5i$HC*_$@cz}4G%;;$dN|KlzwS=jgbT9=zAttY|jk^C$_kJ7%DxAQQh_L zw>SGz5vegxM4MzE6u15z!>0c)+YI_j;C3`Ap_FM*oMqC}G!H;~#wZ8$fwQr`Myk3d zCcr{>tY`>lwuX&`GDJt}SuNJ9=)cdVVabe*)m1CgE<>g)@p_*Y@lu1R!?avr%QwO! z!Eo*VnzcrZot_A%o((66`p60-lntEyDztHBS{!h(EQZ^*?;qw1LP!1}9Jp4%v^Jx} z*^kJ@C`?^@q~=A%6H7HUw65V0wZ`@fkM07hq55fni|rEfmIrY$N$C(4Vo5by1|b%e!Cs_#3a7Au!*-3!YO__kLSu8R4MZRhwLT32(NzpY4b) z3uH4 zIWEcZ=s44RL(0Es$*;*N@;lb_tV4OP1^+&azMP9l`WOetuO~~uYlYjRWm@EaWznDO z2$T4X&hhCw;WFk)r{Ig%9v1m$E&6bsOGVUofJOg1RUpm`|An+~f=Dkzdq~O~`u5Sj zmf?>=mgCJQWjN=lb3EH)!JlMF|DTrpdM*0%9U+O&;VBs98zNlB5A~a4aZj?i=UDI; zOMJ?uU?;IxWH_->@b$PFuO|%sFgHaIpF2~uABtyBHQvo^9o{k^TU>rIDKzt5W-;s|Z&lg1?z6Vg>>2hdajp?&| z)R_Kw$+K&`S@P6ITzdJ~;n?Jo8Z? zdFJCW$ul3PCC_|(DS76Dr2C9BtBsyv@YGw`S=jta!=LYJQ)T_?CwV$KN0|PMH%{`5 zN7B9c0bPYdjos6&#=AvYvg|}!eHd!g1--Aq(?+ViXd|5&2hm146#;p1===d?;?VmG zR@g|D7pnrt`bo5r8u$O9?~iB2|H6^kQayAi&WTF+R6uiHAjNu3*?#39g?T)D#_!dRZ5=ei}ntA>fb8;nf^PH zXZjyXp7!}d@?M-tIwymGn1-51LAO4Nzs5Kn*I7}d>XonwJ1r2?R%<_qyk8@{jrJw; z$o!|2uc3#YBUoW~-EZ)se8(ERz>$?i;DBd3>?XLMF7>C$$TJ>Et--)cu3Gm+ z__N}J1ZIlC_q*tbdQ^ZIg|)1C&@uMhX*Nof2M5>NEEa6ucjfh)}VM45UM9S_d?^7{;29|3W!R}&=rP@=t?8v!}Lx| z1q2s#_T!Qtj2nBRP9!s2J|IS_X73IQEnBz{E1|3?xOgQobf(>d%U6_Izw%cJ8ErSV zY>av>I;ro6X%STk7B4{4DOiH}K&ZoFE|RHWl#rp7(OE^!O)_L-SFwwV$H)h>Ao>{d z#HViq|CR_Bga2-ZXqG&)8C}dI#!Sgh zQ^HgS9u>f58s*W^f`s=)&1njaUE88inT&P$ijHfym^UUzNIR_ zqT{$x>dl)INx0n=lmv#nd>vqU6J^}nQ1G|5&T_o>Qp9^8QUZX?c)9S)VSpqhXNMg5 z9O*v__j`|kzX1pRdGP+}&v-U5SRU zd=5Q9{8nD&m-U)qbX(U(S%3ifxP#CRJnPyhYQ0A4XP#R%-ICur;PH7u5z{4cOnDJ_X7pwl=4mrlj!9kj5!s`RK!uyK_@2!jI_nrlBu?dg%R(Q`_ z@QwhlI~9;bIa0F)Z#qW~!GKZd^9l)bL)Q|n8!mG33cr8_FF;9HBPgEk#_0qp1kp zY4?Tm?^ufE8Y8p&zH@Hh=)uEAeb2dlds**W zo|ON#W1a~UMVjukku7m~xSdVXhU9xWgwKfwp08|^3_bR6p4{!Oz;L~y9*RR?kMm%> z@bh#tX1l<#UVO7TC=SyC;xH|M=^5CgoI~<`+*!uQugs4DaY*O*n0H-sELv{<7rSyv=$|-5Xm@;4AW~y&K!xH-zeD zB}^GIww1fXZ1e50znXoN-^F9P#Yfl@C9Nut(J<8t^BO*@K7lQu>}?T={aPr9DHip{ zmQ?1saKc8%wb^-4U?XmoLfGF+C^RIPR8>-SrXrkEb$s&8vkw)mD+-tGEc0W+n3#Wq z31i8aFb12AsXoDSJUeA$Z)19Iw_Nbyfvowm`K5)4mLt*@rNJ=OQ4v1bM3Z zY$GDKA#zAW-i--mNrSN!RUWsZiZ#!JYf6a9g&$Q1M4rO>kl>((@ThfSdPjbk({Gy8 zIurPk|EcQ3tkNf@lrkWG4}&oM>EU=7!c*v&e6z4ZP2DqFHrBkVZT8R3o}FClN1@cG zMHR}qgu?=R4{Hnn)?-HGpj*@W2Qi%`5!2B|Rn$FGy$3WIAGNGPC_U&F}3<9ycW&HXjkxYkUJkT^f9YDt9}4 zYyxHeetDCEvrEd~+na}duk34GO^)lZW=C-sOtp%`oGG!%R8ckz(qxC)n3N{sVHOoLO)dW`~@WBOfh)XK!#62 zX-rto#ZgpJcBTvsH5XFo;od&+@^s9N6ZNKWqg*^DP@`k2DJHrd#spyIH!|tfQ-l0Q z=1xx+d6NmFtb?JF>SYyId5i4@Y3YMmIK~cun2Bo4P5mZxrh0yUFlo{AaVV$tpR~{W zVsGnJJ|uQnik@QAgI!C%gy?$AP6gaX(cy&>8si{ab)3BrX8vJb?oLc3t;dwro#=(a zm{xiSz0h&Y0Sqrc5gvCIGhI24QsR9kJCAkfJZ#R_BmIQg#^fLyGgK1y4n5p8m0VQHL%Y&jLvPQP0*8Iv)@W@JKYq^&ia(B!}dUP54^ z9&$_%RaCL9p;(Mro@{)KMO8)PyGR|d>S}h6@aYY{J~h6pLS0nb>sL~?t_ZtRZOh*5 zukdA6)sOY{t?*@51@kct6nUYkGr~C~V7W~f+6aEv+8M;DkhY`FQ;u`>hW#4cuywd1 zJgjObj2y1gIh7Q17)$oV=WaZR3B2dl8Gndk#dqLit=m%8js<5&}DeF#<#vQ zRmmA%HO{8^RsNIlh1thGN5z?XI6N3AYFc2k1D#|T>!-vUu@GllI27;0GA<(q*VMId z9o@hD;l1g*pC6r(Ub{KIAy;dOZwp6cp+$|R5Zs(13v6JZd8&5Gyhj@5x7Z(cZnPP( zx5aIJCJynP9&JWA7k-#EEVlDQ&x)C(M`btMozv7YfqlNeA&jl;xObT7h)`V?MX;3r zQ8pFU2jYP>>VvtUO+4x(g6@cZ3sKvN|#m!EhEgE|%8~foCt!V72 zYq%BI!T9rR8W5UbufXjaE`XomvYmn2dcwFq;+kOyjEKzgjgPFqQw$ZO=8ML_zF04};j8&43#+|a`T4ZED>RM#V^8e@T2*0c1v4_MYd^8kP zl8T05!Ufik*HSaIdU#`PDk#*^+P(TkX`eaJw?~wN3@T6T1P5;tG7_F!{CCPo^1m+m+6clYXmh zX1}^dDvK$`va~5z_XPYr{UdQpto6ZT)9XcLaC?mN1Q^1@mZ4yxOO|dGZxnyDQPecAbZ8qltiK3FKIU-aCc{{&qgbM!tAP;}c5$KsO92R*pk+SDtU(Q{?ah^81Nt$;@UUJRZ;&$_4D{ZrKG)mSDx4*(#ekCJ$GR?d|QOqNk6@| zCq_JQ(+7_&t_q*0Hm`j1Ui66{OtLxqXx>^s+V_slN#3>#xbxfiY!OC~xJcABFOkhW7Rybu*O{_cO?C|CNTe zvwT9|=J4DdufVElkU?nR4qn+s$U#>#eDQiZSzJr8A!zH1v^|iFJAZMnpvoIIVtC^zJH71pB zPc9GXbs=wg1$e4%@XP zYZL>9PG^!OQ!U@)~hWIE?c&6 zflIT>WP7uWIU?S|;9U!_w#S_dDQ*=T0g4>AiYieuXcXKYzi( zf<=Wzcig$S_^u^OOG=k5Uvc-!Rb{JxvS#g1?^*X<;o;U7UwV1pD{ZgtKk(YY*Z=E{ zLx+L_jbL8Fk{`CIQKmX;p-|^Ic>CS)s>=zC1_85BEgz`D7p8fgmH(JL1{gtY$ zveaPZ(LM!DTi3mCPx57@SM{t)%D-a%v@=;x<^FZu`MbV!#%F*2(Bpnb?>F|`KEB}9 z-@p6%+JETJp1eBYy}R%{PX{K-CKIWQ_!#G!z*vQO1ma`=k&^!zN3zfdFV%9G;F^8y~}Hd&GI{b z`s809&s{ol+p#~rQdpa7~pq2{>xc!UVZ4}Z_+%!z3KF?Zu#b!{S%w(23@}9 zx5;H6U4MM^k1|?<59fHk+Wp1AO@Uv&d)>6tfA4Y6ho^Jq-}v^X1rM&Q{Jr;g)BgFw zmo0yE4V~*){Mhz~E+4;s>YAp1J@UnmuKT%u$+#b${=cDQmvcY5&inB@q1*npVDAHQ z#S5}7OnWzL^4w`np!Q zdjH~CkN3f8%Rj#1@6$fZJpb_E#d`NYT-NieKWy0c=5@)n@5c2QIXua)_TT?y>AC!&zM%tWetOI4uP?lE@2TOxzCH1ak*hC#>7&)J zPaN||@&Ny9Z}oinjzEgvF~ZgBqoLn?;P19z*0IMwYVGl1VfF|A`Mc25pRTy(!Md#8 z>1V!9nwR&dhaYPE{@rfCyx^4PzA^YNqASI>4`F>TGM zfdibg?)pW4&s!f~^WF_v4TeJh|KIwPd z;`!)@Gwa?y(){|WJ4d~F??|oR6My>K_(vZ7qy9`n!{iSp+*bW++^&!9&%RmI>#|>; zyS~?3-b)uh^42G#Gt!>;_2C=dZ1c94PTsP#<^Gl>-e-pGTR*4%V43sinqR#>{HlK^ z^j*^D-o<`L(c3qk{PBj@uTPn&2v3&%Zlk+JmKu<7f7| z_n#qukKS8fKXTX5l($A)8UEuBm)CCDJ-PkRKmCsQpWdH+;*vX0JwGoz{J{@?)9v>^ zYh7D-u*+*LFQtu0*tq7l>vDec)aVNrPF_=5^X8JSS01}%B)!rE&9`E(b|*7-4i9_Ojv1T_g8^F;*|lz3UpXd%p$$#fZr5Iv z?tVJQI{KQV8NY{?A(L!Gh%IUd1BUn3%B21Q5q_m5zR%*ehF_(P#26&$5|RGRhC}|w z+LyOV4#?aK85>rp|GSLO^(kzT)fo(c&inRWW5Lh1xQANY!^NBqdTzjBi<(8k{ExQC zn`fCY{5ngxU;C1V2Vv?8>_1QYQre%AHhe*`UE0$t!h>2(lsjMJ`YWW{aoDip$n{a- z^R>QF?giR*S$_O>OUDX;4@9{OG@S!*AeOI=UH&eY?k9x1P`k;_P)+mV(6u6HY>;2L z?~pFz#C?n3l|F>gHS-r*w8un?{3Pv8S$=&GVvAbgh4ND@^3yEtn=I};?M~#Av;>Du zyH)V&$1c7oQZC}((%}GS?<7B4yH?uE$j@Sn{EsYdmP!ZNqjoeP{=AMraCR+dapzmy z^DXWL7WYDnyTIaJWN{Z-+(j0*wLGomw^)qXsz@CBw0?7VM%te;3?D4p>m2ahhkCuN z|0;Zm#r>$o{l0V?@w;eu%JNY0D`b06ZgY!d`oEC%cNX{*j6(O3ZVdUtouqMY66p#Y zDHzqAF4HR$?(W(-nch>vovwvtd^kn^UXtx)zX-oV<2p);nEnupe!sEU=dUt8<52#u z7JQG?PlZ2W3BT8Zw^-s$hkpuIK<2(hiijV!;C*OuTlbZ|(PHoO7Wr+m{W1;Wd&x+m z`~R_oUuv<(o6=s(Aj^HRP1zB6%@S*Z2)|ydwBWsOvB!9e{k;-!3FNr1HQtd$i28kD zu@3|FsfGxHblK&wTIe?#{>*}!kI8vITVKzrX<> z!2wTM5qD;Xye_*e>aO#m3u0Z?<)xEx)OUu-k|%~&@=TL+XDCAqzvPL*Y^!e(d3{pr z5wi-Y?+<&Lc(9r-FL6RodArevGP2(Aib|g0#gdQM#~gPU0zpE5c?}c#fM;CNMazZC zf|xh`Ho+P;k@%d0q)XkrJl9%No%9H>git>9fraM6L)N8)vX{);=PwaJ)?}c-X zk!5-z4wF`D@8%;_TE7oGkEe z$x~m>ZzaxP@FZmi2YG1+VJmaJVgm&snx?ZNfP~!^7`(96LWB3>q}m1bP~TBg4`nN1 zH)$);PA@|sNR%UZ>cVSTDtPKLPx7?YD#=rq`z258UrC?ZRo>^9Tzr%w7(gBNy_{Uk5{+~=Ca zxa3(rJtWU`e3EB6VyES!{ZrZDfrNd)GoHAP zfM@s^9F$?YB>g7iEbxD5@B)9i!HfJ}Z}1|&w;DY4(;*L4MW0AM6FlAOTW&A;AK?eY zFrAqOW#P~Z1Z&iDcDkU!IP?<1iaCe+3WFa-f8bBSnfmKF_yOhMP~QxXBR>Q`pj;g4 z8{nzr+0a4Lap)8T&BUShK%YgP7X;94IP{5v)#i~W7-#_wos9`ph(n(wSZy)+yA6IR z`I`-%=A+Kc!YawH#W@j2>J|6_(N^RWaL$mt1LqNvr|o|rdD@=Ui}LiJCwZ0wO-X;& zXQn}(*cFoZ;#@2FOq`n~PnqK;{sYNp;rxx{2jbj~?OI~?lswBy^xM*ZzDee%k{cxkT~_ICqmg(6P)dvVrSCxOZIMP5qjiS@T|q>d7- zas2|%a26;1sRK!;u|cA&uQhm4*5D~m{Zhe4C z10!EC^AkwpYfa-TQ_JcG{A%)|0peRx6+x|Puw+4SdGKmEA$=|f=;XTo{2D&?r_f?3 zPbOpR0br8t{AuUK#G?{kylDQ_tBf5QzAe#Z3l|p%B`^AAypft!PJD2yGHDnHpUE4R zv_M@<%KSNP$8HnhOP0o{?n@&ZmRu~kZ`q7QRX1)} z(viG*@0!m0kwovbp`lpj7e~i7S~z{Lj-~Ok(!1v_Ux{r?Vg+LGT?WS3hQ?6WXaLv- z=dJ}N(TiCzwscHei5}+r;#!2w)>G?dEL&b`Ud=*$dS0{`d#hlE!jj@BgQLcpD{=># zk>&Y?3+LZ?@tPuoEsJBs{FFVaW&<*6wF_&qvQpm}QI%O>C9t&xIzXSgt|CUQKr`FNi446pf`PxYbb9 z);P?k@G#j>X|wvyrN-66lJdpEg~}@M&hLn93KticsO(&gEqRuAY{z3+9cFHRa9KxS ztW`B)^d4-BOYY)YATa{j7LCB~)fPKMzfW82kp8Z=*dci_TvJ=5a7Q&(cN1zjW-L!?qyLk1lqc9z1qtXP~a z`4?)h8Wy`!t{NK45-d{~NrhPrVG52>Fsp`KB&qC(KQzw1Ive-3-9Z9%F7xWMOlIOiPX_#?}{PLcf)ECcnRyp2S|kYk)29Hb*Aym+`3-qRMm zMuf%E?>{Yg-?#z^LmYUM6@5@qbR(E7Q9}-n}u*i z3U8hTZ@SlbS46z7I22xQ3*K_zDGXvNo@?SFC{kZm!NKQ3MN00BrQB-0MtLyZBpfQ; zi6}%f9^aiP3}PyNfJJTtNJgL`(VZ0A8&6GS*VQ zzw>tBbu-~{-5Ya0eg}tqoQG6LKGH0BZ+Sb~2Vb`;{r-i@XvX8W?}!>9mEVsbXU^|A zZ-;(-=2v(xS@3dz_f!O}L%%;*@REETcpOtuc-*(gtluZV%Zh>b9OM`$M}}nqZytD- zM{gVoZ=(f|H`9W58hG+Gi-1&kH(BrooA9nQ;q6A}VAd}e0Or0|;XMmEvwrh{r}BH1 z3Gdeyyfui#IcAC!-ewEl5#TjKi23b{gL1Urd@yGHxYiEsqDbNW7!3Iw8BmT)-Ups| z{ctdhc%#6W@s0qGb0!o~jx-bu`5Zbxj!a`N81V+sje~gQwrIR8)Z1A7=}#bM#(M~O zxrk3ZzIRf1`4+q!;N6RGMU*4mZozxsgvYTdh4(%#sOJ2#{lzNZcOb_&IXFm}DAWx& zQ$Jqs72Y2#c$_E0Ie3aFN7`+{dj@!_eEB+3;c+b{vwmFD!b<>23h!l0esAkzyu+k^ zc*PgNtGD3I1Ku(PCgtelT3E!+p#!u7c=K>39^bbr{eFY`Vb*n=e%rvC^;?5>pQON~9G#C#K8Fra9qOe5b-ABPB83zUO6q;bGg`b~pd<@X!( z8|L!3A9(CH6j6@!1?0%*&;cqm>30*{3h!zQ-Y_VKsudxH*Uy4i3%q%dVtM4@Pn(Vz zfVTwUij;oWTJY8YFB3x4kHgFn{Ve%Cc`^Mg`K>eQH`|0a$%6M8@cJNJk-vFL!zpVcXZ#ViUmd6kSPRj(|1Cr;7VLZ+x z7-yC4PROCEMu;+`28pNS_Cn4pLX00JS8b6yb`iOe7CAml#KOD6BImt`T!U=CO1~V) zsr^2vq0;YX7P)FXY{ioM5`8h_D7?4uaAI!13XgkknB~@ZH0=o{C`rjpwBY&haN<=$ zI4ikXl2_^aA?J@F_okEstf2cK$Ff(X_+c`?N-lH}IgX7}hrtrye#k9QU^p|3M}fTV ztDw`6GZSS(YqGi2DGSVRFxLcd6`|&^Y8k zMqp0+pe|}1h)8&sh7?<6PuGElmLXV5BGDwGaMs$~HczD?_;@huX08Cj?%-(EGGpAOV=6R!^fAI_vJTDJ`DcX!7GscSeU!CHMxF3vwK2z)wSK8h({V zm`8#&ti<|UNa~mq!Aat`m-x*Rzx>j_p*2VRP8Gki2J+igD5Z9*GTRPmVI_>#HAogI z@!MynTT%CrJl937--Yx&8Tz-XXn^CFvZdHsFRf2ncPMHk(9qfo@C~h5>%=#=6&bxf z*o-gZa!;1c9gj@ijzyPxS8s*hrLSbB--3|J;h!{Q^ftts>x})~EIBdKYBmtvg-yHYX4>TNjnp`zhN^5?R#*Tav4cQj49E!1ePNWdvFZKx(r4;B1 z40k#)RujXWXojE-=xL+<3Db9r*g93%NUjfN(q~RYpWPk$s5OzIKH}}j2R;Qy+IJu( zwowy1cWxI+av=~TD08FMa}sN0?Tr3Toyy?*Wp~=dmbf6M7mU!Vd};x>M_s6{Esmn( z&{^p)-tODs%w)gCTZ!r zkoP8I6}4j5ge$nZ)xO@^196)Z9*EyG>Q0C^*;|q~>j%3a5*8$RF0NJ&wYr_2thmtG zK;yafDVk@ZBb1z$#Z zVOmvo`ZFRkyOIya8_QOFl}LNBBzAFSlfYN579Ejl+AciT&o;pev(#p9>So(_mA2zZ z(t#Hl+gNsGf{$y0?7Kp{b<=8riDgs77v%3b4?Jen=a9|4c~fojnsepP?r^(lW3JZ{ z*zYis)L7>OAK76^muHn7mOS^_zC@&0(5=5fMDV_NtsuAO>B{6CA#anj@|Ve>6JaZGEWYy zqF^le6iJJXR+Tl{OcVS2=dQXu9<6lBKQYFwKn%0AGQ?7m93>Q;eo`!wYW06M{l-& zKHLHS-luEEX%%hfD$=xyabg{Uak|Ky$u^#Vkr~4tr<~_`jbXM#d{aeHaZFy{i&Z^U zxoMrb?-OxE*yy>jrU%=dHa6G|M&im$aC@#5I)+;7(X>ak7o91q51kznOvZ-Oo>4Zp zTmt;2$-t4@B4QFRvm!k2+D6I@UG(7D&>2rw7bO5>p;2IekpOHEYXcfyTMFIjKp)~u zM$6_-uZuF!nIz(>1IPXX)em6v(_gDEuj_W0R{ zCY2Ng%htKMS{jz?stJ0gC9HK7+h+Juuo_x*U*yTo`yD&4T=-2Nhjl#4?@L-V>Munb zOR?{_%$3{L>oq`&E9n>q%-X+^5i=&%oGoc@&+uJ_onH^3M=0Fs*^gzk*8iC6E6qB- z{%=|+JTFu+D8W-0=eE1kst&PS!}A_&)q3QF4r!tK2A`)cl+^4?+0j_h>bq?FZSyu) zY({GI5=0@tP-4$o`wrJ|>a6FYeadM2k2?fc-aO)yUJHyRk7I*ZMJOR7M}6y`;CXTcJmHtd%ww6y?e|46GE9IVXX54 zQ$JvTG%nCHVg0|`L;lkttQ)$aHfdIN1GXji-8%ZY#Glpd&vd&R>I=8mH|*CoyJ}v| zoU%RrwO49CRhk%TU}dt8uyW;P`E6-=xI2y?m5sIH;q4g8PQ*qT-NCh#4irp$_-s==Hjzbrops!~ zOv~UoRN^`5L{b&`y$u6~k}C2qU+-acOLb3v)KR%xe>5IHYh8(3tMAadO_OFC*1R77Do;K%1luS3_LWYI}Ju7kh)?ERh4h=ylFJq;_l)z-H zv}QDWR#B(8ym_{ytaT0Xc~l6{RkK8!1ltrJ_$X0?=C|Q;%i8=Tej4_%8Mx!ncTii@ zr8%Oe-?HeJr%LPELmQXQN`h%?cWw!tNYIcIlw7kf8H@IDm7=n+XM5M{&_x;Q%sP$& zaK|g8)uJm}xoFd=COelu@}<;llo zbi#p4OucAyDA9_n-sq<)Q~FMGRn)cDZY-}#a`)J4D|x8(w2mcNputShuP)=EW;!kw_9XS;2!Yr<3Q&XLIc z6*Y8nAomZphju2eLY}G)xzo^_yAvvc-EPOyd?@|HZK!9dO?DP=Vu-6Y1zabf$7+_n zG82}jv>oATA)W99~tmA|fE>yR~p`QJpJMnNV+7^u=dVJU-@DZDZ z;g6)@GwYD^dECC4?=`>k-ss!zsj<%FqqfkiKHQ*Wxk6uhj&vE+Wp;LvUY0!Cm+#A* zVXWK9+w22R;HTkbKDna5uvdhW&{e?umXW_aiw83 zg}yz`HvLF4WZ{>ATkM<@;Ux5FO>ujiN98)K&7%3k1GyaJ5)bG|06mCPJFs%(CTtg< z14AG%a+CQTH)oOiVZ<>W75MmyhVAy?_MHoXd8+MezHSn}cf`3b0X)jYeh|0)=PyB| z^={si!HYL?#jZd=tl7mr*onI}AuL0l6HdDnuFi0{SOvC==po(9e8W zNAjet$UiA>>`S=83qlv}bMM)&m-$9#m%hxKzIb}f(eX4TxGj3`(^6;Lx`AuVZZXzd z?R^@px6!xCk9zDl>Ok{F>Dta8c)roc=ThZ!;%lr59uGIK7lT}D?Sa;>4!qsyYe5%d z)QHwE^YDt**Wy2zI4bWbdujlco;xtq5K=xfz8I~$6G!>cmqWwtT|?Q;ZE1x*Jn&N%t9M%r9=?5!}oi zQy~_jE71Bc@Y!w2N8N^W>p$r}n0Ul*sM>nUa4SVyKauF!GW=udPL}aM61v!ra6N3| ze;CTfbCFNv0}D+ww!0G>DU0`d!r)M2!ehLo2|esp(58{rqXJ*?+F(Nlz8@icY`eSsfTY%1+*Z-4lX3utss_C4@;xcdBTUs3XuiFu-3 z@@>wV&$sq@ktGIxYoA@Sv9N4fP_~qYFzWzv1+zNZe5etkhK$9s-Mmd`iWm1{DANqR zA)E%!5Z}gRCHL)VgHG^5Cy81~7`|(TpKM)_s_4tbd++scZLzI?1Ix3cn-Ch_@oAB- zFn)$uJFtm80~2DGA(EaE5A9b%`)q-a8>%?%;hsz#OGC$tCg+)PVf|%H94`-H0(>Ud zGsj(9n_RiMJ3M!4Tzl2?9u_NBd{6SmdlI>h@>xa~*jc{5TV!6K2XrvM_pq+tKEjW3 zK_L{{PzZ%KW65AD{_s~?^D9%C5xTINdH-}_3m;#Z<8~hPmbs5(fr*ktcf^hXFAml* z43QG6Yx;KIRQuPOx(l0XySN9)@bj!}k@|zW6je{eJMlCd?h(>#t+)vnYZ!CIdfIi6 zYfV;VO{UO6{FG*NUwW@Uy>K1%#CY=yoa!sud;0v7CMF}9ibOJwf4}bu!bj%j$B*lQ_nfQ6yTyyGF~!5v_RwrYpNnG zIPccn&V4q%32hL1Py-aG`$%QVJa=tn&C`8ew(aYS-fhi5qrr(j8xcSF#+~Sct>R&A z8${U;o17w_0K*v(`oywlCqQU7M?7zu$b#6?Nm zY}AXr8;qB&anHTv-e=dwluaD%a=*K&R;=mDcNQ!g871;=39nsq+wt19?JMWkNE3U6 zsPtl;N7Q4DPw3=1XREbus_nlkd$x~d-%z~_TB97edNc0+#JEiL&A6$-rVUQd9IYjL zP$Cu>uEQ`*^?WqWc=!aiUnt71sJmah34&@cSUzs;U_DkiV@!jbuf6@0!*g{UD%ar` zvl_xlA`b3}A$raSfk$0|A}oh%0JZQ|F)-OC+;}2A&4fCmd^PyG7B?d~qlFRTVZeQk-{&7n;-3%lZ82siip#mH1M5JYDissFKT z`9JX+u@1fKU=%>F${<%qhk4oaO17fz5%IE*$+Jo1hganZYvRSmljs2XxQ-Vj;hExT z*W`tT+!5eT&lVBwXaR^9*jvtrr&CfiAWRkk6yFJ7)u9>>uW zu_cT-!in%q#A&jHr1&2lDs7ZwLwFS~O_BI2#QiH=z@UW377OugIF0E`Ku@c-=G>yJ zc;r)DITS_&y&*gkX}|zR_9Kb0e~|_GKV9ec+v>rH<66;~NykSY$_OUGu5L$FcoN@E zPO=B_<1DLhi!b%{>XqojXWKhbc?#C=H>sK818 zd0U9j0Pua{3xYJRYsr4Twr|MQ;(NZ<8^R#l^R+#utV|yl+BmWHx6=}Cw@rAf-5uvn z4Y>Y2;k|ZuH#{2$LZ7XF$J#JWhQz&M3F@-(L?#~6D7GjTM5Dr` zNKvGSibfQ$UDOyf7C?=FCL$3P8;GD63nGXuCidP7wpb7qzH?@0U|G;4&-=Z9e9!0T zvcH)*^P4kg&dkp4y>}<2s^~?vtQRzol^FB^N{pCOkzk7JQK$zBD^!zA7k6rg9}$9q zjUN;GGMxU5EvgpX>zj9T;1h~LAZh=U(4Buo9+#Rbl9+HPYwNO#2aLXA22aYnFU$ z+CZyL&VxsQ-Jzq1)m3U-0xxIi62@F>Z2b6Bkvi;s;d`W+`-;Oy$-VCh13s>li))4_^rmSI^2S zz&OABl~UF2h#9Ubiw*cU>JR!P(}Wj)lZxQ6R82)H1@OR%RkY|yHTbrdGu(Tqz~f)? zNm1T=ypMuOK>{x2dAS1bOYq(sW0mi+)T1Tj)*nZJXXV>0b+~O-y+&d!-hx%&mK(&O zFsP^fMqxFgxLJnt;S&7i(T**p~(h?;ZWfDKJ?vRV8MOf}&4FchiV<4`mn zRE2J@DQ0WH2|tqr&wQX>epHrDSNIxVRFe~}`KL7CVVBMLxlkQy2gM$@54IW@G0Vfz z+4``4Cpno&K||33(vm`M7N`>|^D7teG# z;}2>A1Ir3#d{dB5Fo1QqYLeCBPAy={H&qy5LE!|XT~*}HMa$tnK&4FMnkpF-@EII( zYC=_n(Lx^-bBHMICkH>3(+6Q-;!M4PromQ@5zumXIgD3qxaT-sKq}ySnqM4T&zl@!!%$_tdJU<_-vP$8p~ zUyzTJD4a_(;OQUM$0?j)5e`yH1nr_gPF93HiOt44 zPvc1AVCPx#^uku41ynRaB~&d7+h00bXOd@k7(_7EVa|q6dT>SLscr;Ub-ywd9W(4- zj}x$YTj?BV8}>}ig2iC)B%O9;nx2MLIt!wm6HLPu@#a=b(u3rKvF-wV-~m*l8(A($ zjW7O~U=Y3_eo1^}@k3aFn$B{DwMS{kU4^aSsiR7$<~0om4=@wR+sUF06q~V*%OKi0^7v~V zMUdP$;8l@?^MIRA7=N&L2DLT$JPj;83AS~xB`X7T_%5)X6wNy@&#|QyxqtefUe}R_ ze;fn#@T&u|oC1INud4&1A*>HZ@aqGdeoLp3>nV&}bgka-s2%+dr!{mmPhUx3V>MZ` zSbzOpbWH&ZBh0B;AJl6%spQ|RLuRV;YYs3mS$3%7LZqWwsoy#B@D#3|uw;OwckmFA zEKI-wNWug9coi-;e8L5;Zjl=0_{9r+T`lU-@#oLU` zfzB|d9IO=1i;X1?&Ruk}bnvM;j3dt_a35YBdqlr?negRl8=Eh)zD zC&O2NNjm->0KP^|um<236eB?s?k4=D??9s%1siipOor_~@cpMsgdBWT9)A-_cys}` z;gkep9t)QLEm(2=8xC&P-TPbj?`LIi*}uD^ZTIfZ_O`BW{aqdUadvLb-TT`(I6B)n zxH!1*wO^>S|}}0zJ^*p`TkndmDRaOE*U=YZqI`?lvynU7#y%yMqS*XW_qhlc@h3INbbZ zxXH*dbQ>MmBF8UmD!fBvYLrP>xVIm?KqsoR3BEPNguJoGWB}VSM^Feh%xR!dSX59z zBwwnw%+Ro@QGsEh0gBB0HPFYnrA3q+PQE5t|YI{TU|{oZB!6 z@y#c*=k#>W-EQo8r}E{-qal~2KR#J+o&9N%ue!1Kz+BFI{p$Qp!JmtY(5TO(gy);A>rO~F7O*13=VKexOW7z zKmWY<2Q5qssFGhfvC{C{67qIRVceuP0!Wqo3amCswa%~QFdu%%CJ3rEzkJ~nRqOn^ z80E1QwE>>W*G2%Ta!#VSt0?X+iVxvN;>8d`3LGlr&734k{;0y6MxCj>FOmF%wV8la z>&cH2<>N1jYJ)0yE2%K{^7NmfK;KDL^_x+LtKTM zEy|A;#l`t^xOcedfq>mAfsO438;~e>1Wqd4Vc3A4kGqigUtA*1$KO?}aQFF4`d5{k zD~iX8;^Ou#5alblxzv8xjbKtq-#T#>NU9C04)&^BBmwQ;JzpA)Pb>g3Dg#oE@;`;JM`Qq`Z6y+Zl#gB^OMckj% zA9_NL3Rfh`FBZj1MDdfN_$g8Rj3|Ci6hAMD|0RlF;6zRX=I^EU?grS9bKz!)+T%szT}Xa^Zj&f~p2!|nBK-^m9)$I= z5mHY0265{|G+K=yW!O$5F zLwI{o7>#!)@o}7z`lknp`*N@wC<&${K9Mt`@xCNJ2{t?y=7(^vY5(Gt-;i6*Inf_c zO;TWNdJNcojqYdRinNPG>qo9fSx?-UN-v4-JWI1IU8I9)nF;JZ)^VfTj< zG~bWp|Hf^k`EN)(vu3ZRZX~{)vk;A+^ThF_zpNMK?-a$KiN;fa zDBnXA2Q_Q<4#1`v3G|gjVlG|VMerEioxRVW$kX;CE$%~vQJj+5oW3!n1^zK?*h>IZ#}~vy_)1 z@O4X6b}yIWI$O_!EzjPLjxD913iopf(g^IbuVo5b;o& zjvSs8vo4jafCLDnE~*cyi`GkYqvH*y86&_b+lpe8#US~aKNA}Y#-n64pHBJ+322b4 zctm6^kr}r-%Ajt?Y>VrYDfj^VBP<|p$ulMaC+Xyh`6Pb;? zJgO^6EaLOn^pZ-zt&L}%JxMCV`mbfPnDJJI1eFoQ#qL?Eu0I3v7p zLePN&G1l3QV&rh67`a0!Hi0wIALOwu^JzNjxQb%bF@s{%F_&WG`IBPQ1p~7)a?=SqrA;EcSIE${~d@of}lKBBJwig4NGf7z!l0@>1 z0ApD*I1po5Qdd_15Qsjed>S^@2rvthT|6T4yLpWDvHm4KOy>>Kr>l4w(x*Znru}Gw zW$8SC`mp_O%n_%-9|+h+$sPj9lPbvs9@}ENH;)|<@8xkX#B{E6MZAwsAA*?9`NI+W z^Xa1yPvWr`Vn-g2M@)Us2XPLcj>Xu189|7r^666$;~xm&a7cO*NS@(He&R9di}pMw zehXL)qQq|jV_y(o1#AM?9S$SF*ruTrqmIE8%ixTzi85&WJc^Cre4Jvm{auQ&KVMO7 z0_Qgrqx}LUJdYD#T)!fxE8w*hV_lai9s>9!#aI{K51>5iYeF&FcpJrNV|)(~%AgJl z1-LyJ0Mn7*kz#Ye{uE=oVkpKwSxYhUlvC^v*ct{W@=O6dh~gl?V=2Zy!FTwej27TE z6h{Frq1XrTZHlq1HVg)o$M)`{7~9nw)-0HA26!CBy#NPMjJj>47~AqY#hn3fr`Qs( z927wwTfop1P9hwGFkxdFav9;|4S~ogcnn23i4Bj@cFb?lUd;EfZ`hoPe!#{Bs8F*{ zO*@K_dmzQg9ZfNECs2&sIE-=s8sx@l8ZmNXVDkXcGnr2#deU|gJ?Xqb^jyWu5IyNw zBYM)YhHYopH50^i-hi&)jBvt(pa%zHtka5OtkacZtaBvA$Tv}t9!fFlGKXRlI4dZ| zvZTGhk21M59rZ1vxTfv1AOQktFKs(%FD}p^koL-XOxpW1k4bw&cwDc&{(QO_oFvp% z;GUe3EuW5@h_UT3^%IQs51<&!c?d90mne^VWl)S97C4q6-3YKF#i-X|iczmJicJ7x zU~4L@oAoa`sW2?6V1{fP3o{|*MM4>9r)p9GBg-Dx`Vkv@WS)S37sVC2If z+0UP)a5Cz}WBkkXB>K>64e1L7FGKX9eMI_V6rWD|g8G{Y@@(YO(WY!|Y>s#~pWYcU zDhR<64oL=qWNfqRh&Ch{_2$!22gKOkP6FJIV$@eoG0KKfjQTF581>yuG4hb{2%M;U zE=@-p7Eo*g=lc{R=QD~)o3MYOEY_<=u`S@v6eE8xim~196l1$RDaLk(3*=`|jQU{t z&-O(cWI`Z)ktx%MsrOjJjccn2zlt;~g*t2RJYt+vP$r%3yb5I&u>o&=?Sq zOLCAver#^#G11{y9vi~R$eAzq4aLZ5K{1>-dy0{d)CKaWgC9*tJ`9pW{29x$d0rK; z5h@FzDIAC~pR^G$>We|5Bqx4th7LjlyB8zvQu2v})0M|~dtd~(hG#XOPTIbi$Ed4> zwwJX1H$I(=gM2nSZFv7@CfJGblz~7E_G6 zoE4rcXolL`dF zxs=DmKGbf+KJ;2f?6aJgA@*6pV|6$g;RFnU*dH*~GY$?+$9nuI#(Ky#2-2~h=`ZqZr$ZK|K(@OG=Y;5V63wR#aO2~#VFgCVyx4ZVyx4j zVyrWeVyrWgViP!%aRmIBj>}4{3wbcGJq@vL2^t;(X)j$HVBPFqlC-y!i161Yx~_v} zaz?nQgkS;(V&o$}0~q;iX*%+uTcZr}O{N&zGL>R1yIFvDQ;a;h6eAA?$w~f9^r!j| zo%8v0qBCt5*1_gC(nouF8PZ3%fQ4WJ2kUFnuF;rE*I;E4#X&HPBG?VVC!4LL)%Mus2`HP^C6=AIv+5~ zlItVj8lGrgrk*~h_;g}V>KnwKv@T*#YC~)r8^35H)<-6YX}_2u4uU@r%;8{ro1&d1 zv|lU{{|tX15dD35O!@^d>PY+qFzW9DhY?`Z(T!r%#h+r7pG`69h15)*j1ee{@_T4H zw(kwa*ghHd9mtpf{)S?dA=d>+$2O7mHejslM=FEudq6R^Zo{wQ0*w`U< zrftVM*qll1Onrvf`7|=nIiLEB3B=j;7jQC!w7H^5sZffU#UBIE(;eU2`eMx)La^sf+4Q z>Y4(X5U>neACh%@7)d7kP#FP6*$_Aoqb!k+g0&b7OyZM(rvWyBJY0v&2i%$B9|1d1 zyaBK)#ajRmr#KrhOp&B)A>bg2O92BNN&gdYEX6kfFQfPo;3SH1FCPr30|wGY!06XZ zXBeLRbpg_Gh>?B-d=#(|9Aq5@XAFotfX^}>d`8Q7G617}QRWd~#)F?VGoHzSi9B`) z1cK-Bc#x__pT0lD)ZK#)cFZGNdIrx9@D7chO*3mZp=&sw?wuFzJry^Co$~p@4dvGq z_79uxJ0$=&zxzzp4GNIr!c74i*p>NndxNq~6+gREbDa#q4x07rBO5o;J)QrlI-x9M z!aW;>>7S{L-|^5dESzl#&ANv1!1uqs>j~Af(LWH7Y{rP1@d<3J>Y6EdtsJ% zM|+lslLA_PS`fIh-}I=nG#k5xrOt zDP{?D?rA~6lcKy?$$I3qLyvU-7b<92vOz*J_Wli@KoGVg_6rUF@{p<(U^ZthMcebk z4rN#>X}^3@06K_2T!G}DNPxg+CMQciH6mKt+ay!r`FLOM%0vm zx=E9Qr%a(s^E#sZYW;KOgYol)meuBxMzMhjzrBl+7{RyeSb1&D8eKh7ScaP2y(D_&W={c(GHL4OEq;+JK?QzwOaPl^l+ z^`0sZWwH%T0ACQVry+Wgz`?)J+=e9^B1Dh-*PLQu)^2nJ;oYY9l-h2taT5Oi60<&I zIo>HJMFud5hU_H}VzmoO)N3JIXb5B)Vr@XI9u>dT_y;0^5K|8gKuQS{f~U^#4h{2f z$P_4#{Rg8*AR^XUEF~m|wS%B!orbVtwRL}vxK^Sb0e^Xh8Lg%P4UyEBsz*eoyDyT| zm8eHR=Eg4))Rm}1fJ0k6{BXzzvu+W$>K_Z#qer^h^}?5#KPOv{RID?91NVj5;By6V zp2IfPF7)b9k%}>&bV6`+fY>e#<<-*`Tp7xLK|3nI92iOYQ8Xn??q74Y@RLuO66Ply zFGO=(D8X0?h>Y@vCpe;7J}*(zwAu%T4Hs`Hzou}Vr$-Ic-B5l_Vfs9<;c5k$(1@4v#wu2Aw=;LW3-yR-#AHomyXn;q^B;>)vX2kf}C%ie1>lWK#2Mcm_%KGur+~Z`SbzqU z!*CtsgnX$2K3&LXd=o@`n`s_$U|@V+BED?`zD87z^oNKq1M={*9u^p%g@`X#z-Iu$ zOusC>y6r87yoUTG1LUxb6C4KFk@tuJ@{7j1lrr#V9-&Fx04kxBx z4-wx-$ivS%Szvtl{c&NxHG>GtLs^DLgB)TfOoZ@SU>9r;=AoS(M0~A)5A#`Id^RFJ z{K5^EN4uckFutcEK3m9d$j%Q$d@|r;cE-nA2 zCJ|rkXY~6;#Meu}XCmO6C*o58UsuRyf!S}ih;NjDuN?@p_FjWQ02DRzX)Z(<2XZoe z5#$g%VIqVnz{mQ-4C0uF@dF~heBf)yul9-fq6K{Ty#>ZM2R=9y>WA+z!Os#|KsgLE zArY|?Mj$KzK1(>GznH_B@r@JlJ%oH8$Y+7^jTZ6k0lr=!gnSloW_&gxK6e$~4r0Ep zBEA>EXGZxt3-}s|_(lOA%CW%o(-!d=Io0x^KQR5OL0|Y^)4$Qc$2gFa;Ytuf?1YIB z9Gq(V*An84?~aIX4)Arv0yHo_d{>N+&(*1x&l+SI-$4=I=FjN2U&J?Dz=vx9#yV{UM+6JpwG$FADff zAdLmacNY>6JJF1%0N8xx4rz?<5MUwSD&Q-pW$?uK@+fw~LRVX!1Mjq!DZIQ*{}Z`&XPfA7HpV6f{(GIs z_Zf@>IQOH#t9=3qFrkB8xC>I!|Pi|07Aa=z?TB)ET9~Q zb^s7NVFbcO;F|(x)NcfwF%S9hcY8vxI* z3`<3P!-0?avnS*;{U(X{HbcB2{p2FPAc1~f0=~W?zHJc4`IZHyUk?#qlt906Ak6gp zUNj%vg>nt)=P8;GmI?UA3;66rd{2STlqpB$Fls5{+brOlNae79bKrhK*uVO)E`v*V zOW$mRtWU-2Vth)UAT!9wl@~|V5w6R7~c($L+nIz)Ld)VFOwjR@u`Z|lS<%gsDG>U z>hhTbAGQPA8zkVn3UWgIih<9R>VPM#7sCY+pDpmQ@eu;~OuuiT5+NVnk3muSa1HN65&H}TaxrnbBkl{Rvd^6z8`eQK|3zBNC9~XhojFC|}jK+f; zmT|%egeky>{fd0(4~)-O#P<>SE@J^2P!7Wc5#L4NON4afn+<2iH(m6c<|2%Hb0naF z@r8??(*zBy)o%{SGQRO5K70s)Yk3wJ-xv|!dEi?BLa5(dI5WN#Ms@9X6XNIxEHJ)h zkdD}iW_S&%?cZ2PV|-B}z6yx{Ov~Vj@r8-_QU!eR0=^xh_AY~mB#cAImnmxRL*PSy z!}cx^@U0N>B?4btB%*-7Vs?sS(HP5d)2!3+X;LQlnYOc&l=WsHo;KT950&8!fh%X=bMu8COw;ax_y{RI;iqGh`PQ<4_v{pYHcZ@Ga#HSC9O=HSY zIgGOVY$uFBZ~{IU!bHE7aAth?E+sTSEHg;h1AN%;EU@-A5?zlJz=w9m_O606<9n)G zmrn^oHjIqQVe|pWVHqckKu85XGdLsP8aOk)OwslHHSl2`3k?4%x}F~eK5Pf_CBd2T zEf(=r0ACA6M&&RXFXB5R;7g%$$R8u}XMA^#7820F^othx^Ht!3s)>H<;mq`#DB^1c zeBUxMDu>arBEHuGzF(*u>Zb<8!v1v!J`+f1f$3K*;*)(>>o2Jw%=Eh}(k}@3@V##= zFh2YZ0AeSaF$(w=0LK1Ehcn|-iuhuoGvJb56ByqC5#L4NWA@uD;M*wTO9Vc@8aBRO zjHZbAUI3pZq@#Yn!I|l|1^_mXjgQyBX995+n0_k&AaFvIHP`Jw-e4x zztJMTRltYu1!RHo4HxmrJZkxHJ;wO7b?e%%bDM_krw(#h#)($+0{F0fsNWtqGrpIQ zi0UwZaR9y!v<#k@eosM8$oCQW%pf26_E9c>!NEq@#WZsT{V~1=hDh`z4t)Y`@+hhdMaHf#D4B`M??Z zlyGMHwHNW_n{ebk-XKB(Yi}D7pCv2~n0|*rlJT7s@x_`p?0?5ad>O!J20WNllh!_PZMf}Bu46R+C&;HrSHyNE9d_;4Qt7MOlkBEBTx zTL40+-*q@M{T}Jp)z7O_!~KiTQH1)n8e8jsHwAn}B0hiMYiNEc6!AF;_-+gM7K{8P z^)vd#i~Pl3z;{=`=P%;h27Hc?&jPj)gSUuJA>g|Y`OJPzME>#+_#mk!Fg|^ezib1( zULb}2@et08?``9{{qYg_JZji@IgGvpIV|IZ5eN?je2*c{_(qBJ8*b6Ce#1oinT@NR zpPvf&>_vS3z?X;$(7@VjE#eyme5}3CK$htzZBn;8P z%-UgY+3-3n6Xb;Lh=L1`JCs8^zlSqx$0HG+(`WeZium#cd>;gS_&F7b*0k3P_yo_zIFqx0cCfy{bmY^gI>$jA_0xx=o0XNli6B_k!+c72 zTU(N2W$9>VO`wnVJhvhJB@$L6);+PNexQbTM)7&J7=fqN(byrPkeMV(5JX+B)Rz}z ze}(@83&du_p5299j0*09iMwRuPOq9bwKzvjou6gJYjail-{aD%t5cIxlccFqE)E{i z1vZfd#RnS6jC}(eui&`kwF!%ZXRfHOPPR|z7~B-V%E0E3zB16zH_*U0P#sxX$+gW*3-DUx=6v>qlhj4#fxJ2FhSu*`vtWs|9CWQs4ChVM-L``=BY;ldH4Hu=BBZ@~?bop_0D zzg6ob)DmEqf9E9C)%~5AC8FzV3chPEOGvJD?Ejf9;saaz1~y9%Y})z-c=Z1ZIyZ*x zdJ;5EtE*eT=!JwhR_Yl6Z1GPNU0`!32Tkv$gel(KzklB}gn z1|_5wx|#E4>1OGGP?l_GmHyyslMhx*h&g? zC&)mH3A%ZEmGkrmKl`NXne$23TBcW~7o+=0>fWftHYluz=h#MNx&v$^WqLz(L5rb! zB}dN$>JP4t(evC#q(h0cL!*%PUO!p54Qv#uYi}(H)$6SbRrJ;i@jEkym)`p+^Y@a> zki7I_eN+h)(vH^4Bg%jl1-eX!#Z@&rXcHZV{YxFRi4I|3)*&xHA};@RRtM{5`uhED0uTiXpzH(tn% z^>uXd@pTR!@yfS}wQu8DD;*=@TKCG=(Aw9)+E@S4E5~z}4m+mr+~vH>*GRd`d4GK3 zO6TO;vGL9cyCPuNX>#el#_5NL0FY_L`?gU?;(c3N`!-AWh3SdcCw6Bw89)4<@K5TE zgQRHp+?1oaS~6W(^DOCp`SG5TEby@by(FJ>Gk4@ROMRkDP4y{|Zs`NIPu*damzk?@ zD9+m*Bi$co-xF*%%OE^cSs;y$n~4%TGnKjKc_AQ=p2N#0nP1F{ERc4zhm`#ikSLG_ zI}^`( zECZDpUQogAVV17)kX7dI6>%?~DO0PI@0)??%B4ZhTlz}M(HM_2 z!|y8}SH3qdm)0azW>{rDt(-f{AxruI<_Fyu)mAam<9)!gvkz1r$oxImG_T}@I~cSV zGw7g_6JEl2kG%asTY5@1U=1lL>8Y^B(>ET-nc^jd_tKNl?E){Y@rhe7H@4Cd`Gk8% z^F0omEsj*2SKN)4H?9m)yiPc~WZ%whN`={y%Q7ul^K$7Wt1Z1H<86dhbXSR&8$9yJlG1-NV_dmx;5>14@s!jeo2-TdMit-K<%)p;pLMZW!JX9xl!Tz|s3%P1}p9-Y!S6t`|q_0f%Z&oWUPbxzmhe~Jm2FeWQ z)E&wS$%~W9ynQzhD9fb|XDia8SHNsuu2tbtnR)Yx^5!9{y!_$_%_&?@g#f%Js)1L#7nyviPB8S>QIiOTKDT-&^mO3wmx#R9Du95XRm zW92V=4Zxl-2(-B7PC*7Hlj1TbO^{vy7u0&O!>S@;T=k2$%24!?P%WR+%GoC~x8*(d zdI@$&J(iepD|MSP*EMhU<9E;`tC`rOPtu^mE%so$7rz=nExn+Yn>(z4{I;p#@Mm$e zpGBL7KU2m?y>5-cyzo=XN}e;@@>rq|(2b&WwIQ;ekX}Y}egC3wBj7aP-7`53KVANt?c|{Drru3Nrt;DgZ_2LF<8~!$~@=fNB zPuTKLT9uiXGxHv26z0B!ff(0gwsMSe_#cTGQJJ3}??7&Yca*y~&;1fA3Dp{5s^8Ak zaNLNHfC*CbIGB^fv(^kXpD=p`#&wiGG9ss zPGvRBO!nA9%hT#UQjDnEouU&-}z`a(L8gdC{2#U~k(q)%#?IC+<8W6J~J ze-m(^fzDx8L#2_XjlnuYwVX~WONz#wj5IZvJ+fqas5DaEcnn%ic^ZVEzM)!!MwA>2 znezDl&_<8c%FwmSw0xdhm7K~PKh_8)E*xPXoVl&|Wy$PWW@S?7-!d(jO-g3_WGOR` zpRmo6&crSXKMiwJU~ljdpBw7oF~s!_o9dTTzITN}aD^m=GGX9B(kMYvr4JbI^a=kg z={w{hGbuC#JhDKUm!EkBU1Q(n(i2g1MmclZ3bHq7r7SN|WGYssRwpX-jos;#cGN_s z(pgq_O5@<(x79kF$?#$vqwT5bqiC0;RZ*Ps+{L`fMMwFmTqW!&SkYuXR9A2>ovC)3L(FBV>Klw|3o<|~t$&3To#b(TR+ zy5`zEZCOhVRc_}_pBzUunNEM$HsV9l#bkNP>=EY1vsV`vrkuR!eCDe1VfM{(<)db@ zMzS`cdSlbZI7&hrZO{YDZfKOUE+jciFSjrUY|$tap)-N0$;ymuoLC#(OjgDwOA>Rf zlFakAezw+!$#E&Oy$WZ)Ns=d?RywU$CY#IjWUWJW$AB~GZP3Na^hjm8xpMHPEIp_J zT6#_IObx$74S(C(RyD#_RVP&>uSgl^;5_c<-0YOnfgUCPxp6yZD09oa&;*=RxE9t3nyKq(k7alzS>-${Hsim>XD(N{SnIB1v8noa7Pm zKB=&BYf?mFiZa;?)?+O<=)mf9gKig{nKqIxx)#q;eks=(0QVcZkCV%FqOH8*#(>vC zq)g|b{6Tj~nQjR}4_vD9un^`~gvAkXZG^=c>-CJFoGsG4$}N3At6^nQVM^bW_9M&< zEdr8Ogq%o|L#9W4cq#%uOq-f>yxvPj!oX0MiMtP#RTeKpl08 zqX#nrcF)OODfYwleIvTRp#ZdG;bUuO_}T-5n`LPqQ{A(!jenFHz<>% zae!^mgIj|Qje6_B>a2I89+@dAFs4?x^P>s}n1dCJHn!d=)ElHvL1zN!ckM zD*clpLQaIk2vgt)+n_rDTtzQb7pG{w5Ufu(Hv-47US{&lIs>dY>7Og`fC>UajwWR% zLIp`k54IH1!>~nim>=rWXSjR(a|LNoL14%+oFOuher7#-@Fb+KJ2@2RQtHMsZ4Khc zS*mM$No3l2`7jz~Ex<=Ucx8j?7n0Hvp)Yb}GVBXfUKXl{wviFr=*BY9Pt1{h7+JiG&o=h@a+v{~s`<^oGUPCgIE=n!0SzeM3 z&ODy-Ql>3ybxmu7cDXc3x8?iyx*KF$+QJR{q~;ofueJPT-}d{CDoMrQ>B+@iH0ezc zzut|ly+H%i-5J)toxc^WeWN?ZcQj=e8sFott(x58@HtABW`TN{#x-@gwhYxyKkhD5 z8B%iritnhuGOao>Nq=RaeydrqPKjL*7awTAm(rxA+65Z0J2Fytc6GIE3fw!A%T*Wc zdUIE7kmeEeOuJcsLFH^mS50JZPpmySVYU`6geXj>VecJtdbF$_u zPNcq0N8X(pHgv7+70A_L!I2a+~H3m%@T zbF(xCPikqSFkEc&IzBaVN!;OL4sLX_RN(GKlk*%WjW_)!UTzw1Y8EdyNiUS8%iHZL zbnUeaO2((gE{RJo=60pt1l@t&bG8Oa1B#mR>QH{4!eGk4#NyQWLRY*y(ovu;q%tVY zN)%|5`cz!x->@tsCXaqSAM@h1#KI0_hCv^bNW2UO>;=n!4XovcvS#seeOV{CN3t$7 zvX(c2yDOPyXJQjou!$A1NvwaW(?X?_!Y{%3W-;+1)dG#)TA1hjts-7-G-i+NM>S$6 z1&k7h*Xe~r4i`GXb9m5M9c-j|xNwNjW*W1ghZ0Pk6g(*~q!$`(HNct+G!-?KDzLf? z1M&zv-qaw;IRz_Im@eL1KyS#8p0zMuAI znc3uW1AV{f%f;2JziqB*Wqxi?_KC?x-7Bsq3#*WTy)~%q#Terl#OXqLUgE2a&?Z9s z{|Ec9HVXX;F{baS9^Jm5qfW=Xi-#`c>~tOOY3=;x_uXo;h1%+SOk0mP_$$`hww=LY z&p!%P2klR6Y(4MLp2-C=y&T)Q+`{CzKVAI?XpT#r-mmQbjdnvmw12l(;b&ja+hY89 zw@%j@_j!?fGu^mut>~-xc|Qg*7W(t&WcZTx%L?Vc%KY!OkI6Zy%oja@Fg~#-FNA>@Ve2({&n0?zvDukg&1wZzIP?Y7{?$^7s~SzUuA?g5#q1*`RW@& ze-PrYzQND2!ujYwW1O7&4xfC!t=sdLww-$`ZcMY&Je1wDKsmzrho9#@^>A$Nc}x0o z`HF-+xqmm=o&0^|<@9Gx3-_g(rmSq6(rUSUf1lNGkIPLexOdoU?%en5TtXHW?sm7i zo>86Nv9NWO`Pc`~XHFcPme+geWS<@86{dUpsyoK{uXowAy8WcmKEISbQd7&(SiZ0b zIEGI;yK%;S-I!+ zKm2rN!20H+7XIeGr|G8*Ed#xeA2v@2IJ&9B%*#F8ot?X%SvK+9p`NMkJMLfIo+q4t zv7Rsa=vP1f-|K&0>i7RL@5~%IwQXzn#wO+_9sX?pw&&EyALnmK)SlEQf9tcfD`P%v zy|mZzZ`Z+t9!(j4wL{_P*bfh?XFFR?fBS5VW#^C6rQ>4uX)dd7cJ<`sQ@7rY?_|7S z^`SWz4hYNmTAxZO80p&MaQlKgw>nkD~olD2eE#1HU+|sqdYTb^HYCV3` z^71Z?-DVy>(OPcQqJPEOPe(5wv8$LnYKy1)+IYP-iSK@s@7*-paan{&zc1P0tN(xX zf8ljqh}jq!`Bc-YF*jgwM2psmowoe3t-V3cyylm)4flACDwjrdYjVT+{_weB6B?O^ zI&6w>vwv9!^Hc4v9nVmEa=yp#L2Y4mTpoLxxwbS(MXb)rl*sRUG%s`P27FpI`M9U4J`wRr6L%PPaL(FN{a+bzI7L z+w3?$;P$S?&ole~)!p`HhldaK3uIL#^RC<(_HyonO#>8@`xfTJ_4qBl+U<1E3;$NF zn~dz$!C5ul#UO6QOw<1T^~^i1ct1>i{Vjj5r&XPFa(qYpd3yEoC)wjSAAWB#z4gH* z0Rd`{RIC*}^^eS(yklRF(_6k#+cssYaogRWX)lf;;WINK7LG4rx)3uve~IU-3_nhV zb`#>S_W5cbp+5-m|90Q_+r5XEr%$H&!lL*t-Kyiv@5gSsZ;@8E-6g1K9k*_1OoWzA zc*%Odzx2+X*uDEl%TmpcCv3LgKi_xh(MMNuH(bjsS@m(|&~1ee_8))s?Utqn^Y#{} zEIskEt9DwCZ!*SBDDRT*m-M*A*)~Jp_r-=2F4jW6vD-&nrz=a3=myIPx$^S{*fV!_?*aVxbh_Gr|mELvmKi;QmH zmYm)0*Kx_k!6n~MboU-K@cPwV261f_-yh>rTm0~=8TU^5>QlSu(_0TcRz9`%^PJ#t zJtmmjx;}o*;=R`{Ptc0{BfIqg{cZD_%NIE}@33`<^Y}ia!~em4IB(;72QY}SaQ^?C z3}3Q-S)u$_nXmQ{`hyUE^^LE-@n647y7relK4Z@wJ-niz-Gwfi1^c2bPTRaVc(z;- zF*u`q?ui!5E#BVHdpM-gF}rt5jy%2Ih6_C0+WIH`4+pw5{rhg!#m1xE^us&%8PP}n zQf%#NW z9anYII()d?eZ!^;J+mD5^i)sD$PC^Udg<)YK~vYXX*$W;v1m-p{gtWR54*kReD^#b z+yAQ1rJu}pK62i?ct%3w^Lo1~jXkew`<~0T-StvqSNZ5;1NLe*Y5KO?sw3A%b^G+& z`DI&A4eh#raQ~CLMi=kuvE8aXAz$AmJC&B z+x=p*eoj+a#jV)`RW`e7{G=1!En?x|()Y_lF1PH|FRkyXrsu3D=$@MrZ-4LOpkA+6 z?pd;W;led9wQaja&HW)QGjGw%Vd?kgJ@*+Nd*Qs*wi8uPwOeeQ-0k3s3poz%+1nQ; zRjJS0xZ>a^1FPOfjmJ)ZXelXO*Xm2(L&f>=OW#Gs{G0D{&-6a`M`fE&$sL+kHJ;i^ zZ;1Px^rn*Dn;OI0`#5f+@%W!I%NuzeI@ZtjXLXAqckfIoDKa|z%^&@yT)_Mz%C1<-j9>e_P?$O_E|6XN=(c7gJ zuUAfX$r~DB_dwP;Y2B}Fw`2Z}R)cSR|H>mrJt})#Q6oM1Lo=!Gj*nN|`rV2hjrqOe ztFn&VJAKg%ejh*M#kk5ox%al^OmfIv`)LuWf9xN!US}ume3?IX&yR`vIq7Q#th+yY z$=zq!1FuA5dFQp|*Q&ui%9-N}ZrU^_ufTrLXHC12 zw;mn5**HJV_^G5t3U^}mk!ioW-FiK-5X)z*{_B#p<+o>Mx=7XK7IWjLEl5{a_y@dK z?UJ|~^R*vzT{t>+&a6g-+oJdE_%QX4Bj(FzHEZi-+yC@H%=h!on9_fKzskz3KO5}R z91}IuVuNbJ+zY*aSmt{g^IbbP9(%HK!7m>B-SfvB-#zD}wu4#M9_HWVYxm2={ITEs zUid7$*R8*=xV0V>JKgSK+o4@j)L)lQ)_(zSi{m)E)wixTS#;!wr&l|k^-MF;9jo)# z%l$)>3uRweR2j*xzgQEPN#)ceujzU!^;A1w=?rJE*q5Q{kFxK+uYL9X4dQK zjwP7?fBK!>@ZvnRoWbYb{a)0*N2;{P*w!0{y!UE<@`g(J51ke_s_f+y{K`pZQ_`s& z8SW~&tqgtF?U2ro&Ggz*WOy)q)r>oLV`82!s=i}??aHF1S{>(Hc)McMkZ*>iRGClw z^di(=HTbVJe_qa7Iq=2C_tX0QvSZ8HzXP2$Z$z)|lh&^H+55eIy=`(RWWor$3x~Fk zOFy{gb%n~2%_aj!J>DIErR$Z)Drcv+@_n)J^)ExNIwtsq9vyR0bwa!Fd0j??owz(~ zgMa0os?A3)SlI7ZW{xdd+Slt+xmR+)J4H-~WrN9^6?W&ivn@Ba>>I3=68U1Q!R{(Oqsw#j{+R#vVa4KiA43xl z&g(n-+Y60PTfgeED%9muR>~c3mjesRKd$aHEiJH*${ov5cFVP|1*%?1TPyEbA$w)h z%WJf4`%TFcjJhIUh*Nz*OwXIRL zi}Td2>8ah)hP6$I&+PMeZllRRE&D6z!RZD+2MlZUV?l>T5BHZooosug_lCO@ z+UWo3dV7@lFWE1r4$0b`bLX&^@`G)^Z`R+i({wIqzHh4jQ@y7L{whBGyzl%LiibL# z_U^xVV$*g-|28wr=I++tXL{!RCS$E+w+aSm=aw1ZHkVgU+iCh)9PCCBKiAu)@z)-9Nv$! z$X%niYe->q=i^$*&CPPgnm<}F>b~(c2g@trowd{FjNkC+&;B~z^L2a%+sEubG12Vr z-m~USX*Ta(t6@H7?<~qM-d-^;Vc^QOTe|)jvfDAPal+n|+#g-m|LAsqaNl8V+71Yq zIJVu%Nbi?Fx9Hf$_SpA+uYUC!-=u5N>v?%z;}(Q@XZ_ZF?$vj<0@a3QJ{vQm#~h z?!I9eKTmkvBU$B7o!)oa{J~k>mu+`wrbLs(d{1|2}hl_{X)eT{ZNZ46S_EF(CN+N$JzOt~ch! z?X>)+h0BLUF0qA2XMEp!{_<54?|4W1@aJvQUR(*$|Nhj`bz%C$4GheN4Vfix+9NW* zD$=Xp|LyNA_g~3%j=s{?zUkjjax~uU%kQ1v`Siu|kq<^p|6$YbM>;ROw;|g3?TiK6 zMtMFQvAZ;*AoSJt&HEBsUY0aE)oRY$;X{TzNxVPw`1#pq2XpJ-9l*{rwG|+sA%rn{;~HirB>&Q@t#;wrH)g{usEi(=Q8N-%9R#nUs;=YztShy>~72-*QW0d-!(sb-KINJ%4~dRdnzoi zHrjX~H}khYwSD6DA2W8%?Dp5IX*Zty{X^7=-QTYc-KO@WNwGKgcJFW#^Rtp2FU&)S zS;ci*<=(&B#eIHr9u2>=Y`@VZd%x@YD!Ki$PW|8zKcLH`Est#4uYCXWstott!yXOV z=AjkYt;OZ6)c0|>qSy9F@w=Eet3^{=s~={Mn-J4w{u;x<&80VUMlTuj?7OLRpBiik zzPkJJMXjKLs;V|&=7T0&*`mJe@1Y--uguPPs_WnLyN{pF3|6$9Fn_&A@TrJtZ*s>O zwQtei&pUrexNEbr=jDe7Uh|(jcj(G=>p9XhegEnldUIHSZ1$)=#+4ri?U^-hnc9Sw z-(Jp7iSpRy`Oe!TNT=v#>-@&wZBxy8bL{>(MP6y8o_Tw(z{+R8#16iA^hT4rFZI0c zcOH9KbzO&!$;RKd)5-h$ry~~YK018tI=^?-FTGl7jVbF=IM8A5YL}%p32h%sGFvyk zF#JHDC+AW|oEtS~?W>zMQ_C+c9)4_`-CSd*Ci8P`zTN!0>Warzg##R)tB*aCc*sn5 zhQUa!9c{Z^D;VyceJ{4vg3-}NPu^ad*ypz$Z;z`zFt{C1;=H=&_W2j@4{fK>rE=ak z7MbS#*Uq}q#B)KZ($n*bp4N#s=YP5Hd#1&l#(!$YWR1LOZJMe)<`8GvUhmw2RvzkS z+Qe^-*m9)fp`y&3{iOkJH}>~$+W(D1-(A@gN?Iv8P4Rnl!96$s<%Q&Bht-oq?@x>m zy*KyIALNxWk}LcC42rxQUl+xUCT{o<12Su2l? znR0o>!@#CWr|4x1=5BnQd3pTYU2Cqm^ojIO4ea>dxoN*U4>KlRJK1lpvASya!KdAS za!$OLB%8dUom&3*MSiooh3GB0-YKxJO74nzQ6G)`Q*B;P9^T3|VsWmbuUpG+7pfoo ze~5d>;L5(JjWg-kwrx9|q+{E*ZQJbFwr$(CZQGiEzmxatR87rH&H4J&{?)VAxo6*f z_uXeLK?M{Zs;^mWhkaUOrrdcm?990x^|q!etOVd{#~4kO8cv~2x_EqIMVzQN*GxMT zEwL2D5mQCt9G0)+0eTWY$eC@t++oK z>~WwNGxc?psigTjd%b>6AD{hAq{PwHmB(Vuh7w7Z(utK|UrqEfD91DyrQq;gofVLO zEWY1%4jhqJZE@`GYV6uq(37avS}1M1gGfaoVjC@R@Jb{7oeON_Xvb zt+~7qDN)gA{@Nm8p>dR(fo_4~XsZM+f+d&Q zS*jA*bS)RiI(MkLOzsaT;=1jIBOx&cCw-IPdl%I5zxZ9D8gteNoH}DBen*&d{wWlq zRp7_?@ph#_)?Q%l!l#Loi(4jh179x-;fREs6|;P_-f1gSG7CzLAx&%g!SW`ntKf8b zr_*=N5n_=IvPT#%gIUrHlx5{PK4TVI!jZ-Ka&7u`K@5(P3n~!@)6DG1^RS7TBYq&% zZy+Nx)xI=8c@?$&$Dz4m8??z+%5PNxHc2_rcH{I#CR*q`9*@q+`ENWd8uLX;%e zFcF(hpaMl@bt{J)Ri}kpG?sXR=59oBma%gn{P#^+=E?)UOnAqKaaE`6_Ku2(Fz3{2HdX<@4zJNtvHE{5hnfUDImb&9p>N&-XZPUox-G`1ejfj|= zYQMCGMn+#An~+{?;9G|A2k0>%GLS&76JJcZ6U~h<7@`P`oJ4t&o^_2fB zVA|eCEI`Yq82&uP^5Js-$B8*pYV>k3ac+zl{a0bHGt<(jZgZ#~jqY)$K9onZzN%gz0SC7Iq+WiSYAXXX_^n93EP0nKh3>wAb z`~-Zmf>MSIVbg(qTFHf6=r?eMpMTXws6ADG(eTznwXHElnoJQ1qy{R8*bCxmP*(M> z7RZJg{8!Az$;<&@fI%V#XB!h>#SEl2Oti#S|JplTN!H^!oa+mVNR-GRwh0DUk&8He zIE{q8Kk)rKTg;ep$I3KZb9^9PAt)E7+5jswQ4(qfR4%SMN-S@rVaLf?0U}f&WGtq@ z<&QQ&!+(1q!G;sDy)M0I%H#cB8nuRw*^RLTwb;0qy9n1p)xA3mU3DGyMtHRnkuFoX z{EgqEWv#2hsY*sfzC+S1P*x%|$%)0V9s*Md4qayi!^&n^N9X(@Sz`dh^$cGwDtQ{HiB?F_E;+96#FZVZnt90W-NKveB7%P(K~U z3NM)hinq~IyMi|y@5sU#8-~NRx;Aiz1C^L}MY1MJT|X}D@f<-o_|j$t!4gj?X_uAN z9s3_}ONL@GSb{|1e)}?njnSq*mWIXpT;&U*=7KA_Jte;W&Z>wi zTw%igG67TLEi=?4N&dQS)~WI+q5^DD8ToX-gHygkX%(6 z7MjKP|Hiv9|Mn67-*`XfABV1%=A4Y~WGzKPkYrs`#{?;e+?CdenbAxI&cW4vUmfOsQ3?y}xX$at_&+fKpP1k#4abC+&ZOIZTsqimJ5n={qM#3=4(J@uv-mDiuF--> zwhVw3a)nWJl5w>oP*U~r9N-NTbfMQ6o+w18$UTmPOliP$8R zp*DDZYlY4%c=PPT2FB@#*umQ_E6=4h=K0rBfjAl3PB~{qemE@flQaNdjKv4m zcxx{0jMPK~J4+WuOB?Eh^9ffTd4z z$1PYtakUnq{4K|W4{-!1!^|b9eEbCwV=Wt#rWKs_wVeByhjQYzzd`U`;L+L*_ARt6 z=K`h4{7XL_95Hw*&HTdYN!aSg&ym`LE0=DqI1gK(`NmzE7jIe`3hNFP%>{dgEH^Hj zf3w?7++75^KiZBzuCKqu@>{!_MYszeZ}ICwi@5(ZuhtI-H*zH1KI{3lW$M%g5<@L8 zGndcYUZPB*YV_9w0( zZhBXEbUwKx9PAydfZ2EtAgD(=OW+hsp2ZIa4bF2}f4cXt7iW$j(zOiM$M{*vW9vCD zKZv1upjTB<;=HTVA3s=b(0?rw?*|^>HA8?nrcEnvo_oOx9{w<%{0cJ~uxD)uJxely z(%LR@(kC*Kt6iF6eCK>Aspy{xDJHVd_fYQrAnEeGC6n4So5CgN=To+UiVw zbg6joHQd3#_V^NZW!qRo9Y9E$rqId`=~#>r>F6CQ+^`0DvR2rI6QlWD3vK@n;krk3 zEZn>kJNU!lWbNn_Mfhu9-k$pmmDRm%O1_&H{qeEn_k{s@cx=X@J&E|(H4l9ISOVjx zHsF?$e=iYd)Xz}q)F>kryRcU$_rtM=;B))0&>d4d1A1G|owawohLlY8Xk@NvY6ht3 z)(S-q@NQ!!Ku3#SVqBE{JR5(x1Xggqx+zd_8(?bH*>@$vg;uR>JtD(7P*x!=8WBf!k2!GhZq*rwTk z`~Z;FweH34H@b}~27+@#&1sdm&>0G)N`@q%;;koyQ9L@0XTb7j%hUyTj^OY9#3N=%J~(m%I{;2 zVrU-G9z6Wy+3~XFv7!B z^WfG2CnS^UjhRUU%yIG7N41f#q{P0{Gb+-T4x2=Q&juPApVYaKYa@(;A;|0G_+K?o~fc&2(T$=|kvd!uQ1k?++fXXUi z={P(LFQW~JZ&wr{1IB~y*cn&VHCYjdA3sD}yia@$zY~X|c6Li|ShS87+B_z(I2mWu zX&pt7`=z{YB0y38!j3i0ohQqBF?{gHORguo2|i}zSXl&JJAI zJY{vvVX?H8dZ(Btb~(fpxJD7;!M=IqihSZk))gNn7RY(sl-R|6N4ZW5alR3TUoB$W zq_Jyu;*deXUATVjhcgkS)`$i7P`yewOTDuKd|mOd+*XtCJvs?4r(EQ0!W4;S@TEMn zYFGBuk1R4+%wR9+`;@0rtc6hT@j|!DR?Z ztbR~+Q2yHVe42Va$z|@>fY8}6=U(yQ?|YDIY3W_2tMXEvUBHqen*YgjYvMM*3c*&w zvj|sz9iW01E}8&Q=a}7{Z5y1-2A^Wr5(lZR0wX#CqcB)9r^*iCQk=}xHi<8(hD{m} zh{UXj){h?&KzsTaG&y|7cRnM{2AV75$;mRliFUAsDR4-G)4Xr)5&|E0jdVYFi!eb* zpCBEtEl&(hBT~KP3VjOk+Zn(Aoi`W(ctg%hRh6sdpuUw^tz!U7&E>d-*20a)e zqO?&!Zh5kz(V}lMB=i$1#XjIhhoV231etY`(0us2o?#Y#;(DjxKmw176?t-dr7MM; zUMdf9&&McNsyu-L98|{0%);36|9v(O6=`HKd=KXzV!1*~bjOh?X3MZu?S56WW^3>h zm$Njb?C0N}b9p#VXM>e6p$nQ;>4&SJ>E1-mB&{+vsIm1q)4%Eox~spsU9wvxM`<>C zru}dSEU6~gf;aXI?H7OiP}A3{;b*3hyFh2Y;BUmV)#f}L^JHY@HIn4jC{EHcovrfM z_}1jJXMbfz@qUw8ab^~Uaz@x7H*s9y{i&5PVEEx!EoXhtv6ujj$)ITMpC|;!Jrk$o zjU$+X(vs{Z4CW{8_*=If3y{>H8#RbIptC5dX>{lZOZGOW-zDa?=dl=d|8VTp^lKz= z8&+VHrfSUE4B)NJg4db7ObypS$CLzFsoE?T2Dm4)%nJSp9&|Gt@n(C=ygBW^C&PmG zbYhFvkj~8g@$Jqk@NW(Q5DpBXk_q}NKTt;Bc-u>E(rPAxP1iTC$~iAh4+33M zy9^ys2{|W45J91=KIo`d+;j*u;p^xRM;*41QDZw}kt~UgI+TSzm$$*}`+O(?d{jxd zvP=~@lw#tQ76hQvDoU_TxulwzDg;L)TirNF}mL6XVNW;9zyddk&3d_?C;o-GO!ZcXQw6Avy9nIDEWK3u%}R@kU^DC!Sb-`I48%b>7O2oF*5 z)vAMrHpCcr>Hj-F%hy*I!pdmx!nusySq(mA$DsdZGPOL}`H1k1!SIPm((tt~-Sb+Q zq3kuOw;%7OlUba{K~{zIb#pgLsRxswyZ`Y+83Ly>od*aGJvw5|5>jZA!1G@bYhv8H z){b8+w!Jzjq-r^`z`pW9FUr>Z(UGx66?x-@Tgb%h0OOA2N5#keIzRbgaVUw-f;C7Q z!EzbyWq;jR;hHXSU%nsM)JYqyJjIOvn5NQR^h+$k2z8>s8y=onDOHy;NPLw(p9GGc zjNKZt`|%UH@JWJ@YJFA{0LcBWTqxbgx#8HiJbe<~dApep2DInVbxNxmX#8P^@5<%| zRb;q-S79_VN~cE}e+UCT)H0s&?(odL{UT+=TG@Z}2x*ojO z>~KIwt5?Nlg_(Wc{P{EZu)f5g)7C@e#0p)1#5)s#s<7#YvlsZen5OKb>DgXjgJ>=F zf&-rGpP}#Qk)=uqf`h{1mKHj#3F7*mP+>vm2H{|Gv6ADva&qy`|9A}5>?i86y8pvD zQ7FCCi(3vN6%bhl{X#g)aa zt|g)AJzieybVq#s-}#5IEYDXfdU8aR!_6?)gsYi*SnS)UqFl*Oktg7WyQ48APMn=T zy!`1HO6DpnuCS|Z6C>&F#)7u%W3w*&P?B)rC(q5GVil?0FNn?~fO2O~^2Y*U##DIe zl=<6miC|Qg)>*{;4ehab`Sv>2isT*{ZnQu`-$iSA0e0tG(P(V`<9qZ!ajhi$Asxk8 zt%67<$Di!I=S>`K)J@0TaMWnk@XD!+ykVNU5)9vb2gWglE`TTw?xCO;AOS3HE4l`I#U{_E@c?;^0Q3aC|5x~ee= z6!8qu4AX#@+N9U5IZ`WTbtY!a&fMhpdoQ3xG7U+H{Z7q+(9;UYb*^U9bipkF4jw3V z1p(d}qF zmg~!fGq=iI|JF(^o6+vBif+CC#8v&B1wlx76lIA_j)bL;NI2nR0#ws;57N^Q_f8_p z^8jV7kiuF&pK$J{NLVn@OZeFKQMzp!Ol21b+kdBeB6s@3`M>+VzKshvOps_vsXo{? zPJKO~B1rI4H3nrUEmKSrohYlM#ySFW(Rdrms&~!Z!suGt@xx|hQbDQ>jlKDna$Y^GdKLmpJ(lgV?K_44WkB|PbV&QMIOu-KS)P=x$ z9jd}CYMjJ#N#KSDC#6b>#kBJQ>CxIjwf#j@N>R#*ikU0fi`0M}4P-%i{3R3`*C#o~ z>0s9M&6myVI;dK6s_Jv9+R+eqV=ayCXnmnWzw~o9qI!xwd_y7&>n|L>-E=*VRVS5v zNTdTb6gO*e(ZHCB;f$8Y`>mW@oP0*V(pYtArty-PF1U-HAYb}r@TvjM!VaZ<=lcIP zr~f!Dtfwqj4)jw(*SN-$<5zlL?z?D zF`pv1i-o71nyBMG=>eOrUr#pP)>&Uup`}qq3+}&2BOv&)=LNgCZef z`#l!DLdQOvs2P;U?mc9lhlZ^C(`QtnOEq)3O`{e5w{G~qssZrtk^R4_1Mp8zwIn3u z4Xbjei`xxRW~ojOtp;ZyI|IJFQTY6y^J~2`*-`ffiu4@oaC(ZQvnh`R&sdE(Pu|}k zYtjG4!;?C698l;hvn8TM^ru%$)ULa1Zz2Jw{Q4mLpDCll=vJNW+O0AbkgXz3L(b^U z38_@P@++Ou-^Tdgcq#20-u|LJT;?>JX#`T^AUB7SX(~ikw$^$`)qncD8-Nlpa||Y= zB6gn;G!{`XMtRAH!^V~Ud;HWt{l#ggf6nKP z<)>!0xMbo$#tVoHX}*4z0l4uSwvg~pC^j(t8@~$89}@t@prc4zH8QL-XIt7)$#=}i z=@*_XAMj7dL~`$}O3?j`OHXXDHm$=$5$lrsGDdMcVmtWyr$41%8IEFgx~%CimqIm@ z$j2bnvcG4#UUD2`z5UbQ>zf7RECBqI{RMf@F;&e`UV09$db))S-}v^UZDfjv1>{4-%?piiwL{W49v1M^Y1kbW zisXMf!upc=pg=*c9+Rw|ZSLt53W~K3AavwgP;Of0Kizuhc~5*YU5{Bxy=Bj;NS5(W z6WTttjS+5v+P~6S04_3~Vw2YATp*)(%~C1DCX$~i_=)ZKoI7_8asTwa>v#G$M9dm@ zN#X{LQAs%WP3^!$DbmaRw^z=8x_LgW`$n-ssb{udU>(dCgI*Yx3v`&>#oM>f|J*z=LFh4K zKRSt&93(%eD#T;f{HOmvt)XyywTx>L%;-quP+PhDYx^&ESF0B6i8eA|Kgd$^BJl^(w8zF|KSw72+J8%sVv$&9;S#+k zqH|Tv-tPmY#lG&*u2wZ-BymbZA;hgVnQP@P@a|sYGRO|rFM1`0;Nk|HZgf8rGX73* zkbr_sm3diwgYttI+Zj(gt3I#--9QJ4wV>!Z0k@(Yq`5eouKzX9`Ujgj7OzW zu$3vyhW=H}oP`(|`f9cG7vLbNqEBOwevY7>?wh_-yMioan$}SA+b&n+dra6?Kx1Z? z;(`Z|nKA_c4qTB#(~+Ld){h;gaIYkp_(BCG)CTKQowIZbdAqf`8{!tP=A86C0J6Gm zhrAseS}D&hcOu3LBi-R-+ycT$Bn=m}an{|`j_fQN1LbY(E_0N;O1;8K+xS<1O=-xsS6{~f* zJ$729dABGXx!)2K=S-mlpz>zPxkGB#tvz3-qA7If=Y={81P`74{L*4t)u2G zT|P$h|Afu0n{SZR4D%`eLa-=8&|jdz@M5mV_hBpRTo5|xI~_bzXZ%g#?N)vK=Rnb} zi$!{-CSfzWv2W7}Ozae!4qR-=r3on1rUk{MU>^Iv@Z1fM*VkqU6SZDXus0yh-*0u7Q@e@`W zUYJGfPN@-9Y)Vo(sF$`nB1d?_*eYdm99xHT}(*jk>sKolCk%2x$7`HvDUp8IIQU&;6 zV+?jfMX~324e2G~$1b~NrJ(cN3G~;I$J=9XkK`|-6T6I`Jbo_-lXnt07^83#YPI2n z5g-=IECko|7Z8+TD1qX_V3u5xo9LVm6OVOwGSQQe84sO_Y+*j(wepJ5w&q{JUpcwS|~gMVn#`E7qy?Ll@*4H>hIPDNyEcVm% zbI$kafsMG;%$ z&w#z{yrghPl%3*PAu2DkE^}h_o2OQO+9CIW<1T> zufdz)n%w1@Q8;%rxJH97&p1g?QWcWLLipym8U$L`TUQ){7!q_=@}sJ{C;g-Pj#i7pG+3_h}|s?@cX9_lM&9$r7qt^hLOuk3NeFWm@3wx1C|bxSX#DSdUy* zkr=XvW;kje(6@9ie=d|#Rrrc2Vg&pcB>T|?Wwo5gH*W?t(twW8I0(W%loDdi^Bjd) z?l}3u>E`F0#rQ+!ePYgXp z`W9ni2Lf-}1})X=rQdf{PAs5eias;{{(9kyW_VM7VyZaZf7%g0o(q(o%p*izK=iyM zXogdOM*{&Rrk0+?&0hY~n_YgxmI$PcI2C|JiLPffeWF>IXWJ6&%$e|n(~Gk1Y) zhI`|3;JH8XBIq%&^L){;J##&Mk6gCTo|og!ah9~3(Uf((+J4=NKBZnZ=z&VKx3Y)4 z9idHw(6Tc3P;(SVP-x-g$fmv5&*%T^ni%mb;fj1q7C3vqZwWtXB!B>w_L*)RnqoprWiZcYSSsVg^;n2#tSEuY3JYigTeaZ3u7Mc49y%^Yw9xtHZ3#E~k zJx@bYOwfMt;RK!p!`|(Ldof6eBd28qu9YJ37Zh-YQR>#%{|*!0lK#>lY&XI5yCNG= z+;gv5qn>e0iz%~?n9xDxt+@1J3#mwXsr8kN1m^Ecp{}GiW9ea}1)vj*yy-zz1zVof z&DE%W_W%OXc5@g(n_`#H))>)+h1ARR)CVWINwM=mBV7)df8)Bb1@os6(S#6aHbQ|d zE#`TQghiG5zYJoDq#K!qo% zphUa7*ckALv^b?|$DUWeT1__8qSt<|2-~FXJXM}tz=}*70TM<&lfaxA2lY|@O-cNNC+XyTy10K z5t>_#bU>dc(%1_(*RvUp&2{%0SufcZVKr?roLgeeC3Bk~o;(6%1L*IFj#$dENJuJD z+|!vE<;q@KKjX7KL%+pF;*fMvg5w!GYh=8!I=!8E>A_aH*F_`i#%~U0T-zz6pl=ih zA(;zW-4FEiK$Ctl#lwSw_xy!(GSJ zZ!iY8y0JBdpS%#7;xB?&!!mw4&m4Vj+ZYf9o1q{b&>^2Vf5&$orVc0$a5?Y}aU~_U z5Sj@dkHX6(Ts@YGVjqy&{L27V`Wro4%;)=<7`t@;^w8$bcO=5HS!SmW(`kbUhCg=& zHZKwH@GoIx7l5u&kUJMnV@(d+Bebo$+{2b(yNk?~#|7iEA%5*+^tPEn0#kL;_hmFv z0L`{=<_o9(46bU06C;+cYw`^fkdbXD*Zv@}oDMj69-5r#1@}kR_%Gdh>(o8{O5kI$ zYVCbR_sgOzbO?qMkOaYvmY@XWX0|?ACzQ3NA-KBISe}zszeM;il>F-Vu29kAy!NfZ$_*nuHn`q5lgd0!>{wSNFlbIbYb0`qPVdVytC;VtOGNl>5Ly43tDI#M}*WKq<~Xh;u&PuRtRI3>haL$ zNuG4HU}XGe?*0Iz;!L`73|OrC2@SW{7S#vc)?2Q8y9+QB~8?Wvb)Dmj3`t2*dn7;+CwJajnWrr_f(PBdBKi32y zV8!Jt#sJKkL&K6s&^G=SY|L?O(fXy@*d>HqdHpv=ijuKHG}TEHk|~;X#4>RK@BVzP z??5sZ|DNRhHu0Ro2A|oF2IUaR+c2WCxB~{=n=R|@#2^2e#@$7JoFZ@C{m7;;XGm7F z<4C3xH+%79kh_^)2uKNjy(ofE8m-E86h~l8nni3uBrpp9K9TOMqXE5sL9{CD(TF=N z_>KyH)=Ac&@<@|<$7`F02aIPb8@&l6?d4|ijUUH~&k_e{6qbrk0A0SY!C)7(8FF>t z6IEAHz-wz;LcC_YMmjQ~cQ0sL=H{$1-S!$@xsOBZo_duU2Ag(*PBFx{#(ua_Hb2m% zdA7Q=AwuhI#rzQ%FU$-9><3?Cuc_ zEJCin<6a5l(SE?Jtn%SxGnI+W;pM22RmkpN*}tD@3b1eaVv^!}M1gOB4PRn@vpf%; zLiRh?FfBYbTmW!7Q@Zxl%@Zp?VAkrBWSlIr(s*M!s%N1}oz@^ewN|&uMP?ktP<*N1 zzjH}166q3s5yi2_&${Kxs%X}xp|R`bS;ZEDQ+x3^=Xo?S9ps*=MoNoO5T$)m_>60S zVsU!-Ctv!hCir5#CL$*ID65<=mC*;w%gsUaeT?Aopf9*UK*pXfMJIpBA);~_l$_TK zcx={r0;t9Ctsgwb&cLEmst0(|?Xu;<+|n7i5%j#-;F(Ncq%aG$KfI=gJ(_));21`? zu5)y+)DKsNN5+5OlfQ91y}kAak-CS5NiDjqAZ(pWV+$9UuQ@W8;C9YGB42$~VMylN z2^hU3*juu^#gMG*wKE4MP&SKPgJ=xMClZAHeSzX(Nxp&6~w%VCpJK zr;yNO!7g8t?MF`%pKD`n`avgQ=qCFOxWIa;!twj~{x;~0WvM4ezAcP%f)HEym!*46 zE|!_Tl1fXsC3+A{=x3AcskF}tSe%CDtOP>ZN)m~(qg=*ChLTTH_&6uLxh@kJ;Hj9} z(NH1nT^pl;;0q{Jp&*$LA-!V-+=L90-e+xhvRENDPPn0|2i%0qOFPG_bYR9)QpdE_ zUM|fmRpLO53IiaB_5^NwcS?che%O9a-6TiapEzb+_pp>k`6zsDPT*+uihR;0F^CK} zHGAVZc1nG}vB431ZSs7-Vtj^z+cU2ap=jz<2pfZQItS-9Owg{aJPHU}Ck}cVe!lcx zb+rCS2GytpDeiLJh3`*XIDx86{l9nj_*iAle3=>r4>7;@?VerjJB=Wq0LR!UEm36* z)zqi*V;a&rp2^si3~)HD(b*cxQVE5^sGB__i@1wH;VR$5S1diwL};^&xM1o zguRh~`Leho1ZW)}pV~tIf>D42k)EZ8or9kUG@^l-e6Bj!pi`U^M5PEgri4x)uYk7~ z?GL2fnWOh_W(~8)<^bIR>$_KzfE)n)@?4$3p~L!rc{*cjQESndaXxu^;<|MGzSUsnW%KAQd}Gi zP@~1MR_45O(L&|bE)P^@x#K%RN^~dX-F%=8J|9NDf)in8hxG`Iliu6+rc8`bV)J{r z96M~1nAe~3quxp=NzCA2UH;EN1BS-Lh)=skh)53smzfv4imbdOI+sGBs1-rKq0st( z6^huzY&%*DGmWL0-CGX1IQQjA7ROl>`}#yi`=l@CRdYvb!0^^#e=4wy2*<(j| zk()G2>*7R28c%KuIlL0xb$hA3&sigLGh*v;KjjO~D!&V~o%IEvTCp-vY?NheDib}= zHB!i^dYYo~t*s$-v$dTU3q2;x^(;-Q0o?&ZHO=TyUlm5rwy)wq#r?iTPGHhA!$|y| zr#qjJlX=yZD#MBClJgv`Xfs6i!WeU@=CPrG)@YV$wrsiSw^c|eO&el&l-I(xO}$fr zl7kgm97i(}n~k=BUGW$i7UOYijq7#JT0mOh9b8ae6P~>ht+i0AB-fXDB$Z1NE1{`7 zl6bPgFZd2zP@w46D?`((h_F)I^(hn&zfs#LeMYA>;g?s=E~V@Y_hkL^H@G?=ZZ2W6 zETaN&>_w95Q{FGL4Yh}GPrQ#b_f!IC>HWv4Af1XbfA|0uvl!=lg+Kp)*HAh;wTQII z3>9dX2~H|jo@L7{f4eGvge}_Vz0R^)Vr1ICR7O_8j4~^@l;V7|bFwfVbjC*RYMk6v zA3tWrk;k@(azD?HSggUz=XD2Y-Uf5b4FK^#W*$DQO6M z-W=33n(ma-OQ8+E+SWz?La%ZQU5C`) z8n~fl740hleZo)E8&fC^*VDqn>)HtnP<8HHt^4~3c6_+3`+&_}9Y$RrU`8RuC!+ht zqR|WVe;X`=cO1HKyOmkLV6{UA%VD`%Uv+$mB`I&WPzV&`0;9}J!bKc6_-p@bKurJH zn+~lZZ8@<$xL>-sWTFPIDW}Mr!}e}n<7)7?@cO@H`mM0>o_^Ig{K4Mox8@@)Vc4O6 z7&JwRe$~3sau(cJ2&Ik3)JA%?(LyEJWj{FFw8`m1oaXX3U&c5o8wm(vrGr7ta4J}^ z%5g$1fJ9+8dg-ueXf#>@x-zs3SG!Adw6-M2)Ywv?DXP zpm+Y}`$QC?^)5FQJ9@3%ulT-#(J##S*7u#{1BI+mH#@C4MTho-K^3VaL}I(d7ZFv0}z&*RR(jNF3fznhVq<_951 zNweN|@t|KF8zL_?2~Ht4AEZ{$2cB3thDR$j-^>bfEFu%IJ?vOjJv)V`nsG9;&z6!T zibT#2b#8S~wo+}32|5pfTaJ35#O7~+0S-XclkP$DF~83oz!}R@nIM{&t*<}y;Q1L6 zm~S7LrpaS6;J02wLp;t$ja$~<*0_t%a&Gkf6&RI(=n5IdF%UA~QR~T0onk;}46tKF zT>yiyhL_RgER%8lR^q&bf{(OFNC3fo-)|i*R25#Q{SF5S{^E+H2MT@|nB9f(oldY;l;aE2(y0=Y;j!OAa` zJ-^iq0&5{~)E+xmE+KWWX*o{zjfx@@(Z2|@Rgl%J);TuxoE5d&WE--^(Nekcf>3#s z)|+xRiSMnq;4&>UN010zhfS4?0=~m~?7hlKB4+Czm;`mwvjuVpk}_4(w$M&+71TPY zNkc=3hZBeSA%3@8+p%F9UtKn(qjm!0YrS_T=DaZHe+zBJrK3CCGLopC8}uUYXYs-z z>Vaiu06Z&WytjqCqCgvKdE@nx*NDJ8CXJC@Nf1$mc{iGlplS7&q5T5C!p}T2EJl`H z@Y0#iS$umb9@;>Tbnb-2L{HhMF);Ymyr`i*Bv-pEfx@AurOCLPWs5Z>XSjkMAfIlP zSD>Vf!CY|mL0_umyN|*e(GEI-g9cNHiobL-ac`h7N2b0Z+zC^eL_mk2iy|j}#7DgGl+Mb0)71FcMhs~Z7gJi zyj3RepZ!}vVI}(QB{=j^`63>mO)NuNSs_kig7!PK?_4>9Hj1Mb$kgL zSTP9LUA^>1YMM*jn2~haVSc84`5*W8UVW%rYbTqtMCGAddbeb$FtW7v&V0GPGkSto z2{WI$`8;_43FRSO+l>$-`6*^w&yY`_n6nv)5bLP@4>6Y!O_B z&CqofRh?%RQv$;x;RdVp|HhM`7nbk6khfkGWJvl=O6Fo(V&ckiV*1y$dGk)SiQA8> zo^*gZvapr-(BUfWSLv#`k?y_z{^>hd;L&ekqwL*i=$c(%|IBlwZtfh>JV$U+XUB3V ziW7Qk9Ux{;_9-d**WX+P9iEy~=)Nt)LVmXpKrNt#&lk6(weVJUh_sc6L)N(F{l16u zkXtJjz?w-R8dd9DJ%fKAUwhNS+PyE$>?5iekq}-{!DQbgr%zsF2~M{zyth5+P6Ftm zj9?3)QY%K=EGdiC)L}fbz$=+!>o#JhOfL81b)lE>=+H2HGI?KI-4&4t6Hl%gR9I+2 z6~3xHMUY{qCfrW4BL~(|H(jj59g=&%k_mpl=#&gK&iMu29A}S5J3*MkDpVfH*d`BG zc>Q_hGH-w{9l^O8Trxv#sUWEk+&C9i)Y7pLO<%S*D+q6ZVNElJx*+ZvT4>Te?B{Hw z;NQvo^yCqMZ&T{{&8|ga{08Cxgk^?MV2qgL@k>&$amy-YcClpdQLyFjQzVEf3YC3_ z*x|ON;PQ6#d6X}RVQ5+Nfh|r3a{Fm|tC5!R-_Xa~-mpAWdWEBR8vlmkgYPy5xAHzA zi05VqSIHRosy@LDG*^+~1vCK+$1EZg!`}{hsbtO|j;uQK$h8a=VCA3bK!c0JT{Sp& z&<+l%#~vZ`%%6K{B;3QS0SX(0p3??OhzK=3%u-}=73iob{Cb(R-$;;NcVMR2q9x z&S%W^OmhTM`ul&MKqIL725RTt9&>wu%qb8bORtrh{wv#+uE^L0D$w}(ytIlR*0q3j zLYfFa)e!1-R76(6*w#6mUsRRh(UofuF)78poz(8-Qj7pP0n6ZrfACQ0p>unEpxE^g z4kWVOpa9@g6K-0RgIeogqXFAb$+$0I==A=cgRT@VZOx+Sn~Z`xewR^5HQRn~TZvS; zl2kCLy|$?|TQ$`S(VFwH!t?uWvk=cd6Ap63ODY&cY#fJ9 z^^5GwDR`ThioTYR5$lV%kL=miX8H3V$93YYN0wNSjY`Hx^{CI5O<=K@h0C`E(@Fvn zz~iWh4W)A?eXPuHdMaZ-Lf2gZdQAeTI7)y}r5b>W@rKZJV>LCkOCXg8&yMe*@pF?k za}Qr~mKF~*NkG&&T&yAl8dIqxe?i5`vnY^b6scWz^{v!)D`0c9FxJ$gDLcsO zS&`M>)S@W=a6x#Th-V|v(}S29`O+sC%u;165%fzQ(alUba8^)$9jV#%al!#INtgLmE9CU>28t9TN z@V$hvHx39ObyWq*=z7M8ZtwQsf$VZMYr!S045<|T;qU$Y^}{xtD=)hcT~0NG>R#Uu zsUJw?M_7S={Dec?1Uqa6IdtqkGu+L*bR1mn?!Uw3s(8iRS@E+sOJ`h$U2zQ8aukNW z*gTAt5@zKDVM`k|*jadcMn>Uo9NYx-;6;SYeC_S|Z4pw{)X#cF0)^WU2sEt^OKy$!KB8*!$0j(sN1cdV?-XqhA(8HdZF&SHc3c1~6 zGJXYF!a1~X>lEcLn?;u2S7?x3U<|aJUaP~0v|YkH+@r9aTGab$C-9&BqQ1$9z~rX~ z6<8AUi@TkP8I6rMFCsi$g4pOcLrCk3gv>9ppGnu(H~m~M`SVmF#( zpuaUmg4Z-QiKACZBuWS5#*dhVDepOw+0rksFA%NAhC_`Paxv({LzPud(E{x_CBshh zc=;k20?un6xuOV!*33wf&Yy0h}paX$dK)Nt&&_sg;sso=!Q=A>qHvO5pg zU{fZTF#YVLT~>Hopw*uS^8X<2J;0+XzVP9hyBmoR6)<8{)J0JvQbP-h8k&M2BF$JK zBnt_onF7HY5H(;!M2(6+0ULHy)F>9fhKe0EcI?fpcMT=>Da(X?SN{&C9utDc=(IC{dqho_%Y zGIqq*-=EZ{vgqr(M;-UgL0^B}=DM%`xT9<5jI~=YYxVH`_Z0ux_w)bV`|g%*d+&aE z@M+;8x!D&TbN1n%96hS&H%s@9cuTG;RHdq=!K`kAi}eDR#^ z_&(b7;e~eeJ6x~Yo4&see}qf@Xz#G<%BpyEb;;CNVQE46wAjpeRdq>4c`T=A_g>w5 z#j=ZQYAUM_@6lsgNlkI>lc=*mesJ#+f@ z%*`2~e!R|fLw&C^e>@6URQ$BfHb&sDgY`OsYIcSW2BNokJ|Lb4-=wGra-%k{46fDs ziBKJg9^wJ5k12gwaG=%`FAp~8pJ~oh_KSu2f2xQ#h*ur|^TpNbC)9+fhk7X%h%+E| zSn}XYig{uq{*fIhdGIC0g`$(gFA^nsycdBz5W9(sb^G|U@KT&FE{E?}h}VnDbo<2T zh@npVb45qpKH1L^kLmV^pDRAr?GZmuoTS@}K^s!c66yyM0TZtilbra>78$y|Jcy$d zXNe!2c-Dxex;?tSR@|@KBR*5a)lWDt!`VE~X9wp*Sr~T<-scxV2 zMIz9D#Dm(8i$bUUsp3ti{R73py8SF@Q;JEVn{J=@WO0ygpLl`T=CnUWtkUh1{WQ_R zY5#OF%W3}%@wJZUP}Sba;s|XgK2g+Zf5az<^dm7ELe#)lAodqm>i(b`DJ~U1pb-k` z^Tk)X|HMxct8{;9eVig@GNmP)2pm;>LNBjtJj?>;z zT20>~>M!6Wt0F=-uB#$q=cEx(M6_Xi7shvE9Bxcji9mep5)pgY6#VbWxcSW)R2_l& zW0#27*QRj&{)~4Lzv=klvXbJ=po>=g1m6SEpXm=|{2=j>bA1&=Jy{~+kR$;V5r>NB z9DOy@t6!&^xF#aHB`|^r+~4d1cT1asUH!OyqAnu(CNP3X%6RnT)~blmlOe(NM20{R*|!}t-npgaU+F7_S?k;dPxyqAs*IKj`$s7qdv_Nzf-i*Q4g^XJzNC0SJgMgw@dw2RdVUdKC3e&Ei}*vLo1S099~P7K{38B{I8VD87-;#)bCf4J@2TBaSr1)H1;>@ov#2xw;Pxddx2l^IB z{44Qi2e=SQ48Ek;EV?=K>uWL6nP1i1q#+>*aB#(09cd$Iz ziQge|s1v_z`L(lt50$N)_;ryl>hlMU=PHUTHQSv#xzYsrKex7c(pC=dS{e|p<(>~AwEf7p!XNzljV$TJAMUnz7xMG@=Pawh4Km~enoPY6Ti5;TJJC9f2us! ziQhDNgWg}rUJU;ilihxaJj03KblJ&?-wb)Q6F>7CH_1mtoJK(Z8xf~7eg@-{7@y2| z0pnA|>w3SzZ35oM${+Q9L%du*p!XZ%74kK`-w>~q5uI=1XUa}G-^8orc%5(J)v`+G zn|O`9Rqr>%Yvt2=zac(T{-*aE;wFVGO9ndM#Lt#7op0jj z$aI}=;^)ePb-sz8CwJBPCVsx`s`E{}UcROG8{%{1FEI)+@wxJ0z26YOKyK9g4e@#M zTD{*8zfeA;_Z#9D$<2DdA%3yk2>}%14RU}!FA|?GPtyAh@da{$-fxIsB3J1BhWMrI zepW=z^}i7jXM8H-(-<#iyoB-T;!!={VqlTtGWm|4Z^SQ`*X#L4{0iBm=Ns{b@>_j> zBYvgaSST_L~e1O&u)~v>iI_Y|Hht;!EY@dcF}~ zCf`Ezp2pDXs&`x`DJcpoK?(DRM>5At6<--!PxJL>(7_!fDB zo^Ql|l4W|n5&u~()$@(`FY-w}--vIOKk4~K{8zb~-rtD-CI{>JM*Md-k3fFIlSR8}Yy8cs<{U|0ApPd?Ws^Jf)M}-ZojM=Ns8Yu(#gd zh|3^1X6u9CFFoJL9trl+`y26S@PVFh#M6R5_p-0wDd>g=J>WXR=E~Tx3(Y-(Adj1LN}b`i1!cf zZ7WnEo*P`F_Z#8^f>nCIA%1wUMDI7mj|d*q`wj7d!E(Ld5I-_lqxT!)M+GbNenb4| z;5ohD5YG!{=>3NHpkRJXs6u>jFiM{vhz|*->-~oK(4d>%&xsEUM(Xne@neGXaH2rT zgD)wL4VLKrhWPN{RlVO39}#@7_Z#BJ1u?y!6CW8IrOyws4| z>GeYVgkY0iFT}?L>-Bmeeq!*YUN6MQ2CwM#LVR5Con9}*#|KyH^+J3?aGzc;#3u$- zdcPrlQm|037vlNBIKAHxKRGy4?>EFx32xE*4e?Whb-^TdujIUt)4#w|f{4U1t zX8az;?`8Zx##b_aKjRND{vhM47=MWIhZ%o_@g~L}W&AP5S2O-N<4-XDB;!vpzJ~F& zjIU$-X~v&n{8`4IWBhr>*E9YC<1aG)65|^ff0^-D7=M-V*BF1D@i!QMlkts=zs305 zjK9NpGvn_v{vPA+GyVbNA2R+C;~z7=iSbVu|CI6182_B{FBt!l@vj))%=p)gf5Z5< zjDN@Y_l*C*_>YWlVf-h?e`fp_#jQ_#-pN#*-_}`5G!}!09Z(|&e zXjX~9k4IP(?wcvr^F{~clcb!T?-7aNSdC$slrJcse# zjQ3%@FXR0f@6WjT3rMCv1DO4A#*bipAmc|eeiY+JGoHuzAjZxA&0zXBgxQBOK8*2W z7(bTr;f#-9{5Zx(GCqp&;~5{#_z8@UVf;kK$1*;S@$rmLV0qd^Y1}F@84V=P-UQL<5x3&4dd4`-pKfM zj9<_A4U8{g{6@zA$M{W*FJ*igA5Q?->7{ z@gErfk?}2z|HSyujQ_&;R>ps2{5QsbXS{{+KN$a$@xK`VoAG}b|CjM?jKlw;Y880? zXFOm$!g!SNG{$#gycOg4e>Eoy{Qtm=w`RNz;~9+a!uYO?@5Xpr#?AljPkoAr_RPLJ zM@5J~4j33B&XT}d=-2CjE`h|6ywJ;KAQ0p7$3vrHB8K1!TM8;2IJfHEC89#;bQyD*v@zWVUgYij>PiDM;@hOZKGG4@ZobjoQPh-58 z@e;=Iw@@TYM9g5Ee;!=M?B$GCFkZ>{nT+$_$50(ymzL~LTY&bAKyG_Lo*s4eE7|p3 zb|QN-=-R{Y%dmGCyxxug@(WtI{?;;ohbPSf^(D-HjWt5F_hR-5jL&6ybT8-ApzvS0 zfN(nE)6gnJ27Jkx3aa1ZBQGIM7S_)r+!67mgky;HFD~kg_(H1BMqC5`KT*P|X4@9h|d>&#w-G?I9Q++sMy{twd)=O#(V!fQkD?R)JB_F<|zK!GXq`rku zMyzk&MTqsSyBP8A6tq&r`iM}8SRW5?NKzj~>k#W>=sAe>5wsq$K7P(atdF`4i1jh| zQpEa*yAW{|`~zh%d`bOi)reR>RxLrSAE}li){j%SAl8p=D-i3)w!0DQN4AxSE8rg} ztKduOR|QRo^=pF15$jh3YY^+#1J5AVuOikX)~_KpAl9!SUPFulgR&96LwFP7a|wTrcoyN!i0cS{hj=#OEr|OP-ikPfa0}vIg#Sid4F6z(D!GjE7)9KN zH0g+Y6V5=~k8oSW`s2k+#Mn5LEX4X_%Z`YrQhf}u{&=!8V*Sx&He&27l&*;NN8&vZ z>yOj1EAm;=`GQyJ)-$J+u@wtSH5uZi46!C1rm59$ET!Z)=!k8*~HepPyJdZGLL*{h7i^fs- z-bv$h_}*1xY=5A}*#0n$vHj5+WBcPZ#@tTU82eJ9G4`cKwM5PtrIG@KlY_ z&*d7&0AH_hXTW!8{2E|T0scqhF@PfxYHK+7-(6$OE&lF5?86wqhiE(= za5s&y{{uA62RvBg(*Pf@G4{Ve;E)wl@o-x?PK-llOW;2=t4uLPW?@p!74S@rGXc-h zxF_I+8e`0_)3^`d7c`Cm#v)Ipy%4Gu#{8#ijO!*tW1QD*HCFqL#ucE?(s&JEY!7{| z27OFp?0aX8ajoMRP=oQqF(Af068nuf4>VZh71%5MU7dh&Kv3`qn|Zo|VlvKKz+?dp zE)*zAug`}AfoD!q)$0EUMV!!U|7yIp{{qtE5h@cf>hWzDV$@pw@u^~dC0?mxuKR{LmW!xf#bKI~i2dMOCSbH=Ym99jrZM^(tTE;g zhN1N64~x8reB!?n7a$Z!rO3pa8x-_~m{g#-*rP8~a?%4%=o>uxN=pwIRrn>ZB0aWi z@@~guPpHqVhJT=_@dCyx`oS00<8{L|#_N<%9Yf_)`&T{}Q(G7pc{O1b=W7V>kA7<5 zA1FQG3o%-TXpH`*XpH_AYmENzScdvUoOK`YdS{H+Qd_D&jf4-uYiGefP*huh(NYRu zSdZ=EQ3)|#r^dCM=D+Iy&4goMGwY%&;#;Ub7xArx#~{9q@M(x|CtQPg1>t(ccMxtw zd?(>s5Z^`kam05MUXS=5!kZA^OZYp)_YuZ3hg?Y*@0ap^!gz0!4-m$CvwV;+-iPEW z!g!C7cr%1jiTGi{=OBKB@M6SGgqI?IlyDQ`#|S@z7&j{@A0U35@MgqM5Ek%FK1nzO zG2VEgbVj^}Fuo0xYYD4dtRt*)@igHWT;t^88LC&gc$Tor1>Ve|s9ZcxSmk0p;d-#i z7YM6dyhvE(;w8c=7aItxT;QPq$|m@duMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnCt6bpW z0*cDTTZC0E-X^Sa@eW~?i)O+q7w-~Qxp%I2&-ItOjzY& z6JeE$PYA1Ad`ej5;xocA=(m%LMJ;tRqm7he)qx%i5(%Ee~F_2}no!YUWv5LUVP zmaxjjcZ5|gz9+m1ul<3r%Ega_RW7y=R=N0zu*${HgjFtnA*^z-m9WaiuY^@Dej}`M zfd@b+Di_?xiG1s)i&z&H6XVU>$*gjFuo9R%*_sF8R# z(R)-tSmgo_8&G2K<>Vqt^(q%>gjFtfBCK-Jim=Ls{>8ra=x1lDSGj0SSmmM(VU>#v z!YUWL5Z;8>?n+qYVmHDn7i|fvT(l#sa?zf!$^{;lp{QJB5>~m`gRsg)2f`{BdlFW; z$RezAu@_;Li@gb}T(`x92Vh!Iw~=tOup=H&pw;}IW7 zxD;_`!gYubBD@gs!GxC}#)kkXxE;%E!fOy8N*I^A>_QlqmOP9wP9xcsFs4o70|XT8 zqU=r>&9VpKp@@4D9)q|S;bO!&gliD@CXBzcTlOK`h`2A|m5B8(NPZk~f2!YzIG6Ay z#P|>cr3LZfgriZwM-c9acp%|y#77d&LwpqBQHYNwT!c7}a3$hFgw?(@n6O$4LkP#9 zZD%cD0HCO~FpRKT3&#*vYvEYJYAp;WTo2dC5roxR(7&wt7OWph^=d7QBCOT|KBz(2 z1YdGAVYL=cAgtB`CIO0C3nvm*Yhf&5wHC$^R%>BAVYL<}5LRnpB4M=_P9m(4eoSgi$o z$bzEQLM36f7S1HB)?mVYL=8U{KUrxQy^7;PP_9YAswr zSgnPHgwAiVYL=+B&^oL{|KwKa1&v*7M2oLYhf8-m5b$sRW5EO9D{y1xwwVuRW5EN zta5Q1VU>&939DSJAY6}r?jWpkaVKGwi@OM`T-;4q<>DT~oABCu39DS(M_AEoYDi^B=t6V%pSmokj!YUV!5LUTpBCK-pC}EY0#|W!jtR}2-feQ$DgjFuq5>~lbM_A?JX~Hq^>*V4Ys#m#qmaxjjbA(kco+qqw zv7T@}`gwt{%EgO>RW4p4ta7n|u*${Dgg4=}uMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnC zt6bp514ZTHEy5}nZxdFzc!#jcMKfWQi+2gDT)anE<>Gz9DiE8KG0-`=_?+rhF1{eFa`7c$m5Z+kt6Xd*T#tUfCaiMt z4PljwZwaehd`DR2;(NlI@Y){;t6cm@Smk01VU>%Y2&-KDOjzaO7s4tRTM4UN{7P8m z;y1!77rzr$xxkwP6qSoV2&-KDNm%9LFTyGpe-l=@_=m8{#lM7AF18U?xlnIC%yUFk zwWV@_FJ+;qTto=RfIGRsn-vt53w&`4Mde~A!YUW72&-J^58UfPCwHcLm5bJdZ^8OD zgjFsw2&-J|LU3=2Vs?q4un-M z_9U!wkwsYL0$)f&QMuTgu*$_ggjFu^1`b8#Vqd~47yA)bx!9ku%0-N@S{I!N({lu2 zdX6Amis$^!gy}hg@ItIVm@qv@5T@q{!fQ~2FV3ORa|GefvHmc^^c+Dr9j1%yMmUDJ zJK?T~dk`LqxF_K;hA#VYL><6IN>hKRkh=*1|->YAu{ZSgi&8Pz8!w3nvp+ zYvB~aYAxW0El|{2IE}Dc3#SuSYXLumfuh!e{)1I&Elj3*wH68p({lu2dX6Bh)&eFF z3Oz>A@VS0`rOwSR7)mkVaOwSR7)moTAn4TjDtF=%@SgnO}!fGv45LRmeClM62 z7S1HB)LH?6~iKS$plh&mJB2 zY}bDG%w2ZfZRgf)GLAUEUe1wo$(8bc`G9;-u96SQ zhvg%(Nj@qcldI+9@(KB*d`hm7Yvnrmw0s7B$Yz6lS-v7)m9NRyMz6BDcz4%uiPfmjssvmj#yxR|E@#D}zPBRl(xm z>foB-+MqGGF1S9pAy^XJ82m4|DOegT3zi2r2e$;b2Db&b2P=X*f;)q|g1duzf_sDe zf|bD|K~wN(@K~@qcszI_crth@SQD%b)&)-o&jil~&jrs1>w_197lW6A4Z+L7E5WP5 zYr*Tm8^N2w#^9~s?cklDIe0gCFL*!rAowu&DEK(o6nqkV8hjRf9()me8GIFN4!#b) z3BC=!3%(D22!0H<1V05o2fqYcgI|N+f`5Z;L49OSWNzew$h^pfk&7Z1M;apYBMTyz zL@te77P&lfMPy;*%E+R~RguM!t0UJ$u8lNCu8UkBxgoM7a%1Gy$Ze6^BP$|zMDC2- z6}dZdPvqXneUX)s`y&rT9*nGtJQR62@<^m9@@V9-$m+=BktZTgMxKhSiL8yRi##29 zCbA*&a^#iBtC80tuSed9ycyXTc`NdE?h1dGzM! zEzw(}w?%J{u87_dy)$}O^zP_A(R-u!MOQ}ek3JB6FuE%GQ1s#GBhjYlqtVBrtD}!c zpNKvgeJZ*px;DBl`gHV}=(Ex1qR&UyM_-7(7=0mS-$lQV{t*2!x+VHk^yla=(XG*6 zqrXLekG4eri2fPO? zU7mJD+QPIe(-x&&m9{wT>a=Upu1#x9yDshev>Vcvq}`bIzqFgumZr5zkETs8KT~wC zikB92uZh>ybdMKSPAaP?nlz(gN@+>WS=t0JUR6+~m6&m3rXG%A^xL@T3X#df;v) z^c;u7Ds%dzR_cM*iLxp2qMFj`NoAEKlcrTw%o1w$2>d&wW%2TwgdLhhdu`>UlJXL$ zj+a%(lUBUClvflK6-_FbQk`&tqUz$3sWp?T5}_@ut(qCn>D#y0fJv2ZWuHE|R+WmI znvh9ZGD4KGqy^O!`ea>F%`M8env6*`)=^55bx9ADk)#FHln}R$^1(NC>y>f%~c2cL5)Re}{-PlsVStSNMS*3!a0-mf(27m&dw4j>8 znygEzxkdR_0Z*#2jsl*nOM0MyCoQO^fV*`Ra8{=R?$%Mj%bh^c)GQU<%PVT)-H#nT zp<8uLLE#KXQ&wAwE5)h9X^wT>@sIUR0tSEIcbZNmPWg)RctVequA?kQl?b;%6Vj7nOPGb&k^RMU(~T9Px$t)m&0tV?>J8I`moXOvqQwjKI_jQVMvjel~wR5%I?G%G? z2zSA-RP4ZP+HX`ILH{d0uZa&+E+?b8JJhTRSkDUOQLY z-A*wWhrPDnp2uw3bIf*oDF&1Ie%sBwZAEvcmv((>P;4t+Wirp}P3Gr;bbTk$HBd0uZaZ`UWinK9W`dq}+AWIm-{XP(!a%=3CP#vI#_?A8v6q&(97A&8W@L`p9$AXPWF*yKrmH<Y>a8l}ZY*&hlB=rhCU30cOU2Ur!BD+30AQK_mY6pndoA}uENpB`Rw$+XfuQ$O-sn@aL z^(HjDJ~0a0knGkD%!yvxS3BM2hQxfd4axRG&2}z&g6q&(97D1rW@L`p z9$AXPWF*yKrmNj`bY*gqdWD{@y|z1DZL1Ta(5n&=vaC*kSbZWsR((i#EUOb8R-XtC zuQ#z_^@-51dNYdN_TZD<+JV_5)w$a4c8b9`%-Mc>97!vb8yuDB}IyC+4 z6@Fc)8Lu->F3xpmNTfg9p&41qb@chf_(>^-#0;<<>Mp=1bs<+I=0M67dU^D;CP#7( zm>AhsJ4AMU@+uP{+iC}h*PHm*^+|6gJhm0RndtC(6P%QKy*zlm2@S6|qv&lLlHJ;Y z+4S1E+U|CW!8pv>etRCXY0oj+?WGt@ZhM8d7iva_rk|ecLd|$xVtLr@p~0lzS7SwcYI$gK-ESMQpDvJ`{KNUA}nB*kEIl43AX=(F7z*;YG5c71X{CPKE=4iK+5 z@v-ZZ-b~_cs~sI)Z-SFjuVcgOO=x(%83lY45jK5xU^cyWuC}|KVlbJ2xB6l2g_`YL zc&;=3bj)@(QVb>?jv+N4j@cerios+g)nKNpJ!Euca*}#Q;uDVT#i+LxK|4fteR4o1 zLblZo5U)4!vFnrGOyX^;9UWe8f|F9OW5erBXn4ID1$-0{7MdNHO|PA+?QW+S67w;< zy->5A3-~l(d;N6Gb~aKBCLN9;H6M=I9$AXPWF*yKrmNj`bY*gqdPU+Bj z?ZBMqwS6^qFVSsoFtLWW`rAu|W43eQ7*hM`m{pwgj~b>J64N!jBW7eN*O`%}7)(Y| z4Q9I9En(kGPExN(e8REa7+Dc?LS)s4M98u_0b=!u_*nHxZ;9|&R`iyL4y#WDhu53f zu=+%3SiPB#@KHoqXm(&Wy>_m)yPaY%4&kGS?X~AIoAw;D-Cl|zu{^@t3pJxd(@*$d zVSD{_%y^yItWpe#^oKh%BTKn1F#+uBR7>io($xnU$sX!1m`^xdLt+kuxT?aPv}fp8 zO^j@-9U{9vIiXDeZL1w1UT@-K*C)N1@Yq)LW}?IE&GJa8*UN*~o6zujGYa@9A{onM zw{~DQy>_m)yPaY%4&kGS?X~AIoAw;D-Cl~p3_9Ln%qmE z1HMa=CVoj@|0TxcUILN!U6M4pm%wcGU6M4pmq2KImn2Q@B`W^Di)) zz;*b0TTC(j4gj6)ZzcH40ulP#8NM5TyD@(oz@PoMevH4?%-?#;UmMHcWVqhWM=mrL z*1uEPcsE)8cCq{&!~Erezl*?bis|1V=C8%_w;PDfc()$m_HRA-!@Qef{QU?z#Ch7# z7XBE9iC;UYGyXnc{x;%xA;zW{fA27V+2F4;h%g_!!*}EFROask2yR&aCNh7ctp4p` z`5VIgZ3chOn@(vRd=p18e??aR_O$%1W&T#SrM{yNEXMWY%wGfe!*Sqv_tHA#cQAje zz~7#bOH+)$TbRGamcM;KY~r_#&*u)5H}3CGHlLS*zn&n%{_Sh|`-=Jd9Q@($G&05X z?^EXQHSjkaMCcEH@4M;Wi_Bj>1UGDbJj?uL!Qb>T^RJWTZzc0L8T@6M&S@ReyO_V8 zmcIkF4)bvp^H<~P-{s8TaLeC8mcQA|-#MQC)i8gPEq{kt{!U~57JB-367yGQ`8(9| zH<s#{LN(k9tVFD z6W&ON^i1Y&1NbxZxrgO1oB7LxNrm&u6w|*0nZLimAA~^l5AXM;e{Gq+uHbBEyaDK9 z{Iy~Jak_D`v+_mVe#vzugQb&Sn9!_8E;?U#vg7aw!h)v?VLrYlv-evL2{wEo~>EP4Mzje0Q!;#cF*ozLQT zi$`}6^u&(KMvv}77C($r*f<8V`1Ju^Zw3i%8Q34{5$C}dmJL!S?yGZwqYd}Ji7bAr z;P9FU^`;nq8(93ddUSg+U7w@F{i)v#42{6_SEa_IdkL&|{8o8%`0mEmZT09bB^L9FH?zX>dkM3-EuVw4 z64cgJdUV^mxVi?9Zr}EK;d z#GMDZ9^E-?|I7F2irD^F=h4k&`(L9+H=XT&O&(nX+y9z9y2?)Ocw0QW%hO$5)^XwS z>&5oJT#xPqSTy$f&G+cqv;D8mqr>-yw!cP??w1@_*W}T)WBXsTM>mx1e=Q!}6t@3m zjSP?9)olOE_2?dC`(M6C_hlD%ymcO3l+=g}R<_dk!WnD2ic-3^Di`DpU!9%cDx_UOLLcKx+@bglXRcYJvK zem>asm+R5B<@=vU*V5VbSLe}n$Z&Oy9^JnOxVk2fu48Lg*X+?n`Tpn89l-a$(c$r1 zo9nil>(PC@zpKml=$7|&b#)%y8hF{~?0+8J1$_VW=$7r}`fK*+Ho}LGcDpSe-On9d zUDgTV@jIxStIPH1hVcE*qnpY1KaXy4JGb3NkM1A7|A7v+oJ29_zkS&GZ?i}D5!?T= z#)SL(o9%zYJ-Qz3{8#7E9nbc^6&_uEcQ-E09^L=g{+E7Y_&8o?`(Lg{_aoc?iaojm z4t4w2=+Wi1b#?1Kx@>m-Yw_rg+12%zJvMy2-P!ps-=iDF_P+*?4nNPb*IScEH!W;nBUv_P=J2u7&M?>Epx4u{y_%U#>^@ zF5CZ#J-UpZuD?c)t_wT=t@r3oXZv4^M|XCn+iv!R@bTWu_P>0OZbLiQUxPu*7`8svdvv?A_0i(d^g{@dcwHL>$w?&R?Pz0J;l^&Z`m?EJUhqx*oJ|JoLWw>x)$JFoIR zx}`B!x74F6?C0t>dvtU5b#*n2 z7J76av-?}KNB0lAzs078_wNgKe=GLrB5b{_^ypUPx^Zst=$_l()#XhK@85iO{%i2) zZtv*&d(ESp&dz^X#o_HX?B)8K?9r`e_m34G-Mj4mvBjgyVCy5dB)orJ*z-}nM|V0q z|E>4v&SvMow$sDgEzEY~lJC*YVe4b5M^|#N>ur?Zwtdc3F7;`m^;>>CwHw&wrqUqg0|q zHTsI3|6cRx?quh`%^ux)cK#FP;qCs#&VN}R-Ck_{_VnmRvGqILqnpmw?_`he#;)!> zsPpJnv-96VkM4&x{w9^F{B|22Aa7qb1Y$)mfO?SIW4-P>&cYw_r|wspsmRTUn;57_>f>(TwWtLrb{ zqx+QYe{~+6VEbRAN4NPvx7{X>ZYQ??HG6bFbaMT*cyt+T|I4ZlkKZb`|K)mgZ@{9l z_wjs>?rOIG)p>Levi+~oqnp{=ZMVszTg>*qW{>Xqp02+ZkM0Y$|7F#L$1jWRf4LrA zKeqqndvqmi|Eu%pE^hCRqtTFZFW$<$82q zv-f}b9$iPi|9NzW^Zn1GE93j0M|a8Y?l_t~x+nSm=h1z@_rICp@q32ve;(bZeE;+4 zUgZ0qN4Gh{9dDyY_Zr{-Jh~rRyZ)Lzy0`iM=h1CVcl~9}3Xk6neE;+49_9O=M|Vy? zx7|9A?s~red32}ucKtPZbZ7JZ&!fAS?|&ZMhCSVOv+Ba*x2>D2%k}8?-NV)8dvs&? z{^!w^^Zn1G`n-~T+iwtWBd=(_X$&!g+W z_dk!W58wYhx{iGR^XLxe``_8&@p~`VomaUYT?>1EmG9B5?(6!i^XT4X@2?s?x+OWT zzb23FvAtYfvq$$mJ0G-obZz+lcTRZxj^g{DM|WDL+rNB|?ust1uFj*or=6>7^yv2J z@9LUB2e*JkG0(rf+4*m?NB0}s|FX^v_m{bk+wO3W?pU_})p>Mrw*Rg0=o;Dn*X+?f z%=W+Z^TNmRHQWDkJ-Sxx{8#MJ9nSW@MvpF^?SJb%x;(c3wRm)Au>CLl{P6J}!}h;? zkFJRAe+?epD8B!Bbko`Xx7ni`%l5yl`tWg7vi)zkN7sIUJ5TF8x}Gstx5A_Qh3$XM z9$mYAU4Q9w!pE_Z?SHu*-Op_QEB5FPV&}g`k8TLt|JHkSGui&v;?XT;`(O6l@bNy+ z_P>0O?hCg6HF$Jav(LAhJh}&WbMvv;qq~89zLj-B_&6SA?}vtabj#TL@j8$0sWxu^ zR(N!`AK>bmJ-TPv`=RuC;p3Rj&j%h|!~Sl&#U9;Awmup?x{{8rzx5tnSGGP{Ji6o9 z`pCX8e7xtf^Fh8xcS8rae+?epD_vb(lSlU*yMJu<==NvpBkQ8@aU99k$8eACAhtg0 zJh~xleXQ{44m;Q#Z?i`?f~}AAi^Ip!tF!Ab*P}aut&d`lu0LBJjUL?uwm#N-bbqq* zRf|WL#nwl5L-=^#XYbeYJ-R>G`KrOAD`fp^0$rX+mZ*kv_H*Oh;?WId{mY#n?r#d~ zU!6yHH9P+`d2|o5^IwZc_a!_3RLRyrJY<| z?q%WqdotbC)p>Mz_wA zlb!!^uL$qoVs`$k^XQ)M=C<49(S5&MNQvR!{o9^D(e zxw;mQ?lE?M%e^wZf6cqN{^~rsHSGS@n0F|8lPi?_UEu|J8YPBXitwGmGA z509>#uMdxIB3~cZhWD?AuMdxIFTOrJy8e89cyxdEar2hj7~a1uzCJvydxnN{YRp^Z0v-u^8QD zJ0)X`_2_Tm2(r%yJ^ZJBzjVC3rmCWHcK5>W6;r17h{bxwl7%q++pkX_W$4?tCxO`H z*5?l!b&QmzMf80}qJ3<$Zdd%*{N0Ca`2F5VZNEVxqs^ni++|}HEMK>5@tkejHl>T@ z>)Or{0>Hjo=t?0#*AN_>zCW6jCL?|Bl<{+yjbE_*fn^J+>YSGO0bT*xxd)8zIN;(t zq6gf!Zr?2(M=Wfdd;Ov*B`1$9$sb%YF{fn0J`HenhEgki$C2RTp5W!khf!#@TkB-Q zrUUT3-zQ>J*2R7Iu38&p?1K8}6KOBE0)1KQi8G_4(vE?&M8^&qk~3&nJRc+U;?FcQdI8kXP z-WHkrbW3CUih?_@yDmNF>CAnGHk>#&d;Gb_dUIQZO7-Nm~!8m zivqEt(*sNEQ^sM1(+e@q>BlyuRo(Z@F&)JKIiekmYQfz3oig?)*tRVra#`B(>GuSi zb`s~do_K5&27g;t?-iY1PP;Mkz>9xxZu7v4EzND7hx})r>L@>qTz}*8 z7c<*5yxeAD<3Alnih(WH=I*o4yhY38wTthEcBZV&fS^N;cESL++II_7WV9KTficIb zv1;1gllBA>XtvcqXh{QNzEc*l=G@kB@x-tGM4uVxGjY}Je~fB_j$0|WFYojrPM!|O z!4=PayiJXx?V@F;UB4)!^&LAedI7pSF@GEA!N&^u#7^tmf%>Aiwt3^`GxQtOYWdnR z8LdX`G-%s4n0Y&Gii+iH+iG;;wrw58ie<3g(nM83XIP1gmM*;h$|*011-HS9e4-Vq zpVO;ObsV}e@y^KHPIa)v4$bK}a%JP(1*Wv92V)s$}9?A=as- zR#3NY?U+%!z&LQcU0{MOTrg+(dW;=ZWbE1D0p0#Gs7O=sSA9LQl~F#hc8u!w#4dkd z)@sq(F$=C+v@?!j!JQAZ77K5PEjmu@(=fI9^L=_xz2L=+^hIDnMTY@@VD*p2jc%}2 zhvk1jQ_p=$v4pkN^)4{o6L}d||A;i)7-F$uqsNauVa&;~ns{~1;W06_prkZj)LK*) zR9EA7cz_&MU0D^ct}dAxD=aN2pB9@Luc|JoD39gz?B1(;uUK|*O-*I>;XQgxE2$~2 zozlIqqO3>UT+*YobY@w%%BqU#@xq$!pooE~8(ldmr)N&zp1C;#;NhK>)69(v>Z9T( zXEH?amx@~@qW*GDvI4dmF+krRYN0w1?UP185$7)rAm{c>ajT?D?oijmL!eb6&QJQ| z_1q4J2&+UyOnj#Mvj@}%0uFOliKxE_k*tWM*t5mzq*?X;cE;hcK$RH$+aCTh(K6j0 zRt)xzS24d|Wj^iQ|&L&s} z!WUxHo~$wYn4vLVhecwipkTK$twWpC{ZZ{||EHq{mME5+;0v+os_~=rI##NmI8Z36 zpE@QOV-rJoWD-)33u9=;g~Kyrk0IV4{(;gNzRY;>vP?aYI*rkOiN@F$c!W?I?8~hh z<0bcKjD2}TW9-WYjj=DEYK(os-zAQ1#QSvJV^rhSaaQBS3Mgv4 zI?igmF;%VFkb4qV;|2eF0nLUl2^gE}sxdZ)Dapj-Ls9bzF!lwn#d?gxFpaTaBQ?fu zsJMX!`_-W9v0r#Z#%p8n{T7X}{W~?r_8-<5``%h6^?PWH?PD>qg5$Nw#6<&TS5X!( zE3BL?y5k>((|-p}{e8HyDef!?UGl-L@E?!n0uMx~tT~kn1Q@y=5rxnx`$E$WQ3`Z0iklM(cqpbqn5v6K zcf1`>Dkv&~JNPtFSp|(uO-L(C3u>lTRFzFSD_&Jma#q|9oN1PN&xXj1EDO#hq2Zfa z6*rCfGOr}ev2~dfz@pl+ve}cWD{89>xm(jyR}$JO2$Jg~R5i7>ypTo1^wPAYB${*w zadk~qO~DlSKD!LR8#zs9@KphGsQ^`QxT2N$-~OEnHw=9%Qx|*!o6usb0=58Ea34af zZ%fYKDMSJ8O<3l`7uVsnrWoBks6d>j4VS|HiTf4qN7y{taE~j2FWcWh;4%0z#rP|N z3ftc;mOtFDjK2%uK5zRw4QyfkI}dcWzsD_qxYZkfh0I?O*t)=%DX7D82J^Sk^0zbC zjlUM=Zz0$)CZ-sF$HO4(aXbzJV?(XM!$E{N4=bU32kl~9(I%e?8ean!%=Tm*`IE@cUsbE>TEEPpHTKq2BoG!2E3nTP=K>u81jlT~8+y07x=vyRMlKwCb zcugLBVZon`GXC&*X8bLI>urBEKtP%(rhnH$z3uND5Sev^-;KZ7%-=b{@j1m5;}6@h z{Vlfq;StvOI|>#lNE7=(HpD&KIMX_$13+i{yBqw~K|RI~&l|?ye$3w(@P~8F6x3na zi}}OUTW}LphKL8l~C4$KQmuC14kS3$C$r0 zU5lmEr0lgY5ZNN^N|B}Sl$A|fdtjR*mwLoRev|JZ2?`8QqVs}_XGgMrksYG zvQ>=jGXVCx+fC3vv|;?P7+pE^4~CK`=+EpqW}V~y(W6)IzR9<>|KZ)Oeuo?T5ASZx z^J*W}i)?tK0KNPF;k`%qL=-T8@ZLk8#S_P8cFJ?lbLPZRSy5UVa?-GT?+6|V0!T}u zGyyt3!IHVd9OBoG&JuW^MV*;j80WCLg?UDuDUAl`@5UAbZqF_39~RROqZz2amSwvJcGf6V&+yBv|bN4t@j8D8$fV>rDYjGZ|d-WAqQYun+=0ACum+LSIn zY~A5yv3A=w^%C)k=yQQsE7Y6e$P>{I@s%+cF77Z9{>AIwjw&5gpWeDdtsJvz&BLc2 ze#*^j)%8$&#Dxob*AHETqNMYLKXeXC?2mT7@0KAW#ta`eHr6dRzBnF(hfsK>7%z%V zjTh9^R>fl_)iGEdv4WZK2D4yFXqH1QUorGib~+EXhAtNQXQ*` z7z@bolWQ&(HvoX>7be4G+2weTrdaGKjio+RO0;GcXYULCKs})=nuc zDU3lpYat{w+EAai(A5noC@rjo=T{wN)75H-eZ0n%Vz35{8x3!+RYLW&!3W=h8k|ps z6;)M`!qVBg3xjA@XwNh?T#q=M7=(IORS8TU82?mwhwe(o#cOIXIM^}BUTtYDEs-Olg*25k)WQ->vI79JS62~Y=hC`WBJ9TQj3e#RwQ4y;ygGr1^>Pt<9rNl`G zFKxE7WV*(1iX~-l{^vbRNyC<>GaHoZ81Fu&%+U98wLGgJ zr-?Of&(tx)a4#5L5kpW68kkl%F)QHB5`L>KFA}7|f8hlMy3@-C(^FSTJ0EHM-68wf zaf4zbCYtLZbj9(yZnO$@D-+5SvkWsHiVPYyAN*>09WsqkagZTeF;phc-TG&wdXt3+% zAn>2Mjee2?w*zCjq7e=&EiHj#Lt!kj@umi8^oVie$qu)ZkSI+k_f1m_Z&67#9+cn+ z1=+!h#Qd;sEdR$_B~4BkXGLudp1DG9P%ywD<9g*lT>ryF)XHP@G0!>U={08u##(pP zg?PhAHa2GPF#FE0JlXq}>D2#)DKlhT-~T!~6iz5NyQkGb)p4|rP29Mx!9mK3N~Xd6 z9On}|`C@qS!v8A+=?{)@KG5E5O;a8Gq7poSz;QKJgFBKLi0VCF>z{)K<+E#WuZ&gH zz^5>9+k}k@Z^SSo)lC19jYG@cW2wL*ok{D^YCSG+2 z?o?AN5;}UO(VJJIc6*0ila7h;DjEbHgy=S(xZaL41y$2vjh0u`PAj&$p%2{rX#`Iax-Jfvmv_TY2CK!maibt*gJSA9 z28ZB+%3`=pCA+U~iiz`a_t^Liwj}`FHho?q-HU=1nb7GOzQ`j`h;do1D|01=7i{N|`8+O7m ziFlZn3M*<$i&VH18xc%5Sn}|SAyz#bULb&@!kBvLq%Ve3_t??Ls>b2DVrEGZtQC;s z634!&N5*(kTUc6xn_qH2!G4)u!=pVsJmIAzgGYb34P&U)5`^a(v=zAT81R*X_CJK2 zC)~j(;l)C{9Q#xqhlju_IIF`E*}MzEy$CeUO&Im~Lt@D;4;nRQG|q{dio%N0>g0J2 zI#U3*jzn)`1x3(8O-Xg!OtkS}tC-~;+Ho7Kig$w#O>tMjW0{`d@M8cp-g0=ok;ou~ zcgUdFkYap917Sjx2nxiS=C29DARLgnm%$4mnnU*FpfJOy%(2RNVp0!+DOLkds0F1k zhW~yU^iM~Y<_^pom;&&)IJE?Zr%w20$ETdaZa!}G2pwGv5cUD599;o#7m{JMW^Q$C zT7_~{f%nM5(h9ss(rOq}RZ)mP<%hRpde<|=x?91mxd?(i1K*8NDD?J27k7a(3N4w~ z==iL0=%=E5d`aO9c=0?sJI6W1S4*Tb$*44F`C047qAdb5D>t}4O%I))Gq|78WU zRY#%uX%Gm=dKJ7!fR(8pY+%DvLxzv}sT-qVhpViB#^F?p%LgBHWATD2c$`oNif|P@ z;iSmCPhaF^ctKUsEWD8w6c)l^M86j>FKD1?cqxe|8TCfMUg|rzuzE&GWhGqKBUT!p ziif+3a{Ug%v}-b97L(d(uo;-#WhLc3$_naYQ}AiMpsK`KM9CzU$EU$mvEMH02+P#%IP$ z^*(BRz#R<2gfBN{sU3S3+{tJh_$m#4ng`wh(QL&i&^U_B#nzGCED6}h#;N^rxY`~e z9dIm8Mp_Sc==f3N^v)bBtA(`zQw4627&O{e?Yq3bW>DBu6wPq8>~Lk!G%he*)>p#L zf>R&Ybn<4a4(jk&iKlj08_8!xxQoENiNk_Xy968ys_`|S_BABAljw~TUtm+a_zq0V z)P9{f^3=e3hLu}uoS;?TzVJu4U=o7405eYBlXowAg_dj{wivuY>o-%S6%{k8_1inV zzv=zoY}r;{+`Tw4wMxqAHjZP!vkh(B_DY4#yd(~Ha!6z%tm+nBQf^)hLEMqRy$)Wi z!W~(yc6yvq*P45nnXcW`yN&;cy>|hRqDa?(duDQHkR*f}ue$W_5rH;f7s6c^%!fU+AfNvEV z^1pBOS2I1G3Ezg6|sTVGwey1KfnS~nOq>sV^`>}Wi5moHhy8zBki zYty<*URtbLC_3#T^as|=VLUOrc*%_z(Jc)ff^oQqnJ3KsvxHaT^*FNwIWJR!`7Kz2 zAu0$||0oo=ILe(U0@$AW&gFBJz-*J{L>xYLM7SXp7=q(P^HLHRB86OeaWbfv%~8-O z=D8*FmYY3oAT#Cw4*xO0LPar;rlK)zV8-CH-hXnievaun;m8ZzfnSaMps6i4dn}y> z8};zKDVGe-8-L00$$3BeURjc{)9B2%yxFxTjFCeLu9vM%CRw=8c?WByUC0_e4^nlT zcOH7dDfUohxev6MsYaWs)~Ikpz{{uy-jqdOFbj-pcJt&-KiScpCa%%z;dWXE=e+h}(4(e|8F15* zxwzTJ<)skswdy;#+>w)UYLAuMH;zV1=PaDJtk?(*P?x?E_4GDuxEZ9zhPioTLnk7v zzB-{We3P%rge6zw3WQ6n3cnf8ZUd7vXp(r?D9;-4%w+j&KCCvBAMT+U#752=3&d9q zSYN_q!dz5Gs<|J!8iU#l~18kvi<(NTz+Id8`Y!MIxt zq!}7x1cwgj?u1X9-RjU-Y#nAklMFtPRAzIaK)a!&AHD_)WLWOxk=a>hNm^!&0~AI; zLDvNu%o5y4<9dm1Usa?rY%E@Y=0hx8UP7Ch=jLKQlhseYRGv{z+9Y*n&SzmkigV65 z1QJ89&G{_V{pf-ZF^+YExmrAUHy@e>6G7B)rwm7S=CBG6aINW>`NaI$yyd)0LXt=s zLrje1@oW|u!T@`DDW^6)C8eeCFO^yNv$3e5XHm&bC92CsJ~+$Mhb4yRu5fZ7fzyu< zMbAbf#!wk|M2qllv$Z%|Z8F1iCyX3FKHRxy3DI@l^86bF?>qi%n^CRMvFCQ8(in?F<*k$ou*AGXtGTI z$&(uCA7DMtzCtV%uthY>BV8wQF{W&aaBAO()e6c!btP5ZIADIXPZY5}IB zS%;`;jp72FQ-yQTnJXo>C%#!{Q%17r)6PGR<#HOD|B-olSM%j2^(sVQdQkhS*%DMq z0s0F(bvGN5o^_r$K6lEftMhm!w47Z)aZA&-sD(CJ+vICt2*h_F*kJX_5M%Uk)w}9u zr|#WaobQat^s?3#Xh>H+T0_={g{g1 zR;?{^$N~u-^gan(b41Lw5D9{@v`g)3L4SrbOz%IS;=14g;kr5QpTKa618aOJjPKw- z2;)1jrst7#bFGEmmw<8UUk-l{F%==*@T31@@W-Fw;G#-M41Rha2Cj!9X1Z#9JpjWm z7JpK4Ee&;8HiHB+&C4wQqXnnn$n`DM=UTRW!5$oM5Zn#Ng@VcXbHTLHFPQ1xEtonF z2xhumd!p?DRC%02iAmm|XP#3_o3N+)ILX)BmTyw43-YV2|L} zfJ+6>MBOYBd@1lU!KY>29pfGVE))Mtut@Mu!ApUeN9x=Me2?IFf!7OmcfopN!P&sf zFZE{wbKM;A-N03Xp9ZcLd>pt&a2ztSOYjxIwSsR1en#*f;CjLCu7>fl;7ft`3LX#q zn&2CO8wIZi{z7msoTeuQpG29Q7JLNwTfsYkzZd*G;&Sm2^D-I72*C?+;HO9kHmyh!j!;AMhifmaCr zE81R};6JoQTN3;|uwQUC7FpgSxEOf7;75S(7yKr0rQnmmYCSD%>wrbMRpLJp_^9BY zM;OL?f(HXP3GM*=k>Ed|&-zsGbHHB+egOES;DNxW1-AkIR`5rt3oagG`80wvLh#># zV+40Xm|O55VD_WbUxN0QBKQg5RKX{KJ%R_g(FY1%3e5GmjQcEbAHn|wR%;~T-xcMV zCH^CU2MN9wc&OlC0OtsP2$=1RoNaObE))DZHZ-|a@EyQqf{|O}PQjM|`vp$`<~~B? zVZX9o@NVGy1vdd#3XVtlRSC`kf3@H^;2OctqC?vycs_8g;J(1m2>xeBocn@b0e)HV zR^YvYZvlQya6jOKf=^>%_F=($fsYDa1AI*IINE?~TO)9U;IDyW1gFNM{Rkcl94~kYFt4|aTM3*h_z%Dy z!Q79go8SWAbivO6_Yr&wI74t27TIPAo(nuk@D|{qf{y~{2u{QT>hXfF0iGiGe&A_> zyCA>Z!;5z20xuI>47@_{8ej@_-tQK?4thPo>)_wJ2d{%g@JBY4etM7Kb?{#Jqj@O* zYvGSegTimZAAbs$!5>K|{114h3vTR*G7&t~YpzeFJxOWidQIXx;6F%ou7Lkg!B4|K zNAP3dA0gNWo5u+L5BQH4Tm%1!f|HQ$6v4lP|1`lv;Xh08V&Gc^x4|H%Oz;TcI|X+G zzDMvMV9))6{{~zw_`M5**V7+>pArA3!2g=y_b)Q{Sz>;>03Q|q9N_l^uLS-`@bkc5 z2#)O*yoRm;J}v$OfWH;|67cteX8`9o%(|F^^3>O?yMd>O{~v+%b?P(NsjoZNBfrZ; zXDRTlg70UU2!4xYBKRM`_X{43yz6Vn4Zzjn?_>E0-p29~d>VGXEVvWu=rzGPz>R|2 zp&=a;F)Y-{kR^};C^^&>!Stc9!33@%qcBULH+c@Vmw-zsoqbTiRVL@6mDfh znO4+f!h5kP?KTyi@3BYdl=@%?_vC`d?Vn-=@Ssmw-G*8zGuLPKZAVe z0#q3Ja`3bAmBJl^pBBw`89c0fA6e{+mN4?A;%DVs1~*RifM`D2VdXmsKKAkS$1pcw z-(?`P@>L?N4}MxSUpADid@-43KTAFgy#jpPr^L$l8p0maWTHoBXB%HJ_zuFKd>CE@ z_#P6z{_vyBhkGac1`(#k-)C}kihojX^lg@grt|R;!matp0&xrqnCZq#7|VGce&p4B z>-(DHV|Xdie1&jX`GyWQ$3Eo4B|nf4)*<=WMkqy>gx|m6Iw(<3OC$8GqQlsqTla6^ zc|>8l6s>n3fX)N`$=4*|Y=^X+`JOj>fo1oG^Vq*3YhYH!dG6m3(GLkg%yT&17%A3e zb5G}e*p(T36gZo#yEvQrf&a}4eUQD%DBa)V<2F6Mj`3CPUDLriYQEv-=EK!7dE}o;3-I3FCr%#$*Fn#g#%v5(> zL;Q!>OqcPFw=v@-C;1mw7SvCw$;~SqkXP70udsbyVPaKd?%U1HhY!YAeY(8qpy%-C z@nv5olDg8|ytXkHp|xh{UsdQ!j;5D9dtdU@6%JdkLf4z2pQ+GIj;2kX zy>EK<6<$KMFc@7_oFFT%4=64+Sd)6QG94SomRW+{lRqPw%9(5ur^&duZ z&f)J@t-q@FpAmq2-&*x%5{|Vmt}0tt`$E*Bvy=LESprD^%fZd1zn{OR0{f6R#LwTk4I2z^ z&VVgl=FWZYlVb1gC{gVj<=Z-K?U7WsZdIx^TK5h|d1MzDV;!v3VLn$o_xF42<8vOW z^>?a_J+g1i;g@PZ?XsfHe?77z!QC$P)tZFwUaV_l)K1AQz?RIHL>ldLntH7&@h)&5 zYI{6l)|K<842!dtS;wz@jf#)xTq@Kgto`shoXwTpT;$9%Gmo!{H!l) zKfS;}v%NF7?B0x;&Q<=5{g?@f-g5z>)b3byczNxo9jm@1f#>m6_0d&77p|N~YwP1` z!BH1K>!sTIHpWYe<8G6qP4lgB+b?vEI@-LbK6fi_TVIM_)VO@_pFGnXM@G8W*XP1x zJv?wCjEtyyBfjilLfJQtz0IDJjm!6qY}eG7TXitLX~ptI2R-{n##F70FS|LRY?A{o zWGt#&UNJHnXGayzj^gFBHhC&W8i)VWbNJ-fUyZ!r@Uh$@BimNJug;e*9f#ld9R76q zha=n6KJTe*`uf9>QML8Cbt5CIEN!E#X8E>}uD!cGRkdH&jf|_R$=x(Iw*Kpi zk0F|HPS{+vmR6PW38>*sCBu$ZpxOaY(E?cD2LU9UJ8| z+?{S2uxP~I&Hi!NhJMQS!4dA*Q5ctW+Kg@Jr%rb~_e|!DCGMz6hOsVc?Z$1f#@eUR z5UL)}*fy5iTGxNho(|13(&+zc{IJ(f`V&SEI+}c^!|y<6foAH`E!5v-K${Wy)o1k1 z_JLE;$lhvTSMjHIY~8V8$EwlKMU?K`?=r?lCs!M#2d;TKHsh|nqw8I4yS}u%agFYF z?w=gLV9ij+@pctyliz(|<4ZAXhQ{R||6!EVIMHs+%cqZDkl*$P_fJZrk6-Y{rOUdt}0laxecm#xC|xT3dnY>9P|QvuJbt_D)eV zD%k|&O@jKvB^%n16>}x#vgX=`ZgcyIp z=s`~;--({_=87jOw;{o|*6usvHo6=?GTx{<6#pNoQJWjv_}{qf($XJij$|hq zrM%ffyUbPH=-M;BOA6WF7u>& z<8QYP-dOMAwc_y9gu^2ed>7?;(BiZv#}cL{y6mS}7Ew5#VvLD*dK$gQ9DBFm%Hc^* zNUm>_Q<)3ivQ6b-~9D86dohX1PDi8z*dg30E8ZXAIx$8?`MzU8+Fte3j% z2IG)xx3j-DCC%HZ!rR5??Y#1-@~xXDZQ9Ulm9HVAd~ta$DmBx;q1@}=TAtv4s@$Qz zgRm$1&4S|*CnA5~Hd)C-6zT5h0lc5dXP=H|453j^O>@Kx2W zUFB;ue2t#+58P3?&COd4qpqr~zxuR^uORhM+`6c|f~1m$7YYVHRlc~&pYUS(jt$!i z65d?3ub}JLt+z!L7I@MMI{T_lsxK?-i8_Q2G^8TiKJSIe$BeDb%@`x@aqjbaa1}w3 zEGcMz%L;#Vtv>-ns^F4X*ng`UlyuvwZyaV;`EBHzN zRPJTA&D(ybe^5;Sf*$^8SVW?7UqKgNLH9s@3c97n_zEuaRaKe!D@ZHP^?5Hsd-rxj z@8s={PS@L`oRzfG?~f6dcPviBSi4d=8)K06PXDK{#muAn8pxi=eFfel1&JRPbo?Q@ zDayznGCr>${`%MT>)rr%|*}ou}-b2O?E9jtk zecqo)xqa*0+T7gVn*-;}JeD z3-`9j{293@J)burw9L}Zqr?J?PS&b-m^blw#D`ufgwHS2xv%qfL1>{jnPqceNFev_ zI&TMf<$2@tH{)wDrggTQ=OO1|v&5VmMj>(@Wj3hrIfsH~cB_0xnfbmxE`MtOKnTC- zg74@=9PxHk^_QVT_CzmkZhqlZ|AKgQNztrFpV#wT`YavZ$E`AXq|q3Efv@V}wX42r zG>~1^=jRvuyghp~I`{8F`}b~f4Qp)jdArm#dIE6+F%Cr>`=BY-$bT^%QAVd^MO6hV zF)Y0_qyycdUg7m_OmVKh&k_S>z#vu3AEJ@9^WwJLY2?3)JG)wSW}0nr7%C(Jc6viA z1YR$CdcCc!wADu%>cbgG%hnPNBhV6^t+zzYY}SXg!~E}30{*HsB}!e~(oy@@pW5e* zM$$7~(;+ARO#F8=z09)p}wcVocLep;u|_2l(&7~C|6EeKtS{a*E#cZmwOE|*p7)D0JlGv^a$jin?LMH$b5Zvqyp_4M*AS0^ z#fpZks}6qI2JbD0iLrDMwxHMX;tca;S-b&o4ms2OS;gu(OH&uj|Kn>zjA`jnBAzZRXk~sYBflJWw1v`I6sV&~5Bv&vt)m{)w-5 zw*AXBFV6n?;LcATnfl*J^M7L;Yh4jf`|$hUes_CDLG~}YUQ_+a$Qh3>9DTIU7wz|a zJ!D>8;x&8zbHa7K|K9UZ(PMr7K4Z_tkA3&dwQpYia)0lmf4cv>&t`m**m-nz;*n2& zby@UX`CUF3w`<$?ZxuZJ`V-A(+I%;v_vxX@n+{JrG@x$n8%w{rvg(4j|DJeFw}F>@ zy{^nPxaZ^do<2HldD6-M+SF}(k3SE2Fkoy!Nw^W80tUSMyc%IN#haQ}3;9eD>(?W_)&Pvu*>PR1@V4 zGLN&mna8q4=CP{OJnkK19-F3^N85H-FQ| z$9KPbC?sMoHo{k(rjs+%(RzSP@(Ie*5kJ9kEQd8EzY`Ek28UOug9!{{rf z-}SG=r>zA8FB_j8b>Fy~fARH&+j@_lTJliu#aAEN|Lvu7KmO;>OP5`=w5-JV=-1uq zE{Y#>{_9OoByF8?qTAC8 zyZ4_^|N7k7{l0qX>8tM;o!;)XiHolJ;k{n}xq0-3%lFU8J$m%rx8MA1NT)~dy?gW( zRVNF-Vf-Vv`-@Zm+->NXjN}==eD9ylT|e7;>@UxZ{@cQDp07-wyKv;HPu3?snRWb~ z4^Lh??V(qJ>93iz4M;hd&f*~`_kpxYwwQF_xT6C z{*Rx`zVF3b;$D99ABE**9d`dK@oDR;H}ySrV8w0ypBUY6*{RAAZ#~)hg9&Xm&j0T9 zOTPJ!hhE&$bmm##?+0g9pL}5azU<51xMD@&uHhFHJ^s+?j_qR*jznXmN zo9kChp7X2To-ga_dO!JoQKzbDk6(S`vKvmf+xzPCWnYaL+4qsZo_hUQpZB-rmT&Z2 z@NK^lPuzY5>Um>A=Jp*9`F7-Bl(9309Vw~gy ze~1V9bKq`diMY#fbl}b=LELQY4!r4)TW%$Ll{?FLAtZdTalMYO_=Xt&5PdU#wlO9o z{HI2rkobd)--m=>VN`{L4>Z<!E*PJA7zDvS2Ej70AewOx5eZE(xg>K$+ zYN7ibX@B&idmI5|AL8*lrk3a``~mU!Cv+0=X3j22?~lseLA@``_!RPWk#K&yCJ|qF zyi(G;TDiT(uf;tJx`{@2<6Rsn<@hBUy^KX76!}flRLgKg#$h>SrqK z=&KGY?@5;U4tbY`P0EoG)Nz>6%=IGuO@DGbq46_H!zm$lN_lebB?;>vD0A`Cc)4K4y35xA`pqJi`Yj@s`Yk4w`Yk1v`dvf} z&XqVW6U_5wh2WcUbm5nTj+^D}7L0?zY|uXjM`o3n;i_)|X4x+l|0Eo55}bnLD#0xK zdj)%N+#;BKFAHWFaH@p-tcU*)+y}?@Y}@e90PZR{3ph>iAmBcNSr3_lbASg49sxX7 zFzbP9xX3vk_;JB3=Qjj1F9!s(%pXPHOnvG!2xgsd-3k4f-*zZO;#t7G1Q!8k3ugU% zA-EKHU__8}l3;R95zKU-#~4nh`=#Jz@b7|?hyE*oGX=ArlT+GvPE9iK`Z+)DtKT`F zU4pNvEWxLImtm_3dEq?djcmM985(N;G^+^u+~>@?EK z>+$3XRnu?YTVA=R(gN&|WaF@Tw@6-nWZ0w$R}9u~5L*({Wvy~({T6XJ4*6KIjwAKM zE!$^ux2lTmfXRksTkS!+>c2)nU{%ct_Tzd#?p?(}DaRcJV?wL-{ugtIq^ z!om?+f?KpIGckOQ`7DJI)InlrS;~O3SbdUvCO0+#pZOKxlAG`y>7qF+!UQc^)@l&8 zJ8CryjQsLi2&G#(Bm;v9NH?nyJR zxg&sS55ss3<~7gCHwb>XBm_kBacpSitF-VjJDM*S*viLiV`_lS)T5KvSSw#O_~!$gJ+44IL#)T`t%We5xZ{fpjLV&NEjjsrN zoEy=i?Yq#%R|7tMet0c>58C*i!O0!3$wZIN4K}`yz^Bh&RCU0<#Wudzz&DEoBHF%E z8(&iQARl0W?`>daPoE#%aNi%Ueh*5V92_YlK%(oHx0psqR+h?n_eaL!tlLi(@TMI;q>O)^eWNGm%&eqrv5uTh}rj0 zQZP^{GNJm+_BM zCbo<$#?XE4jj|dt!xIz}oBy-r+vxqXGP6yMbAQL0`D7G)6mOatjY&?nYP~(TVz9(1q zOmAE9sWP^>Ft63Bt^e1Ww$U^X4p@xfHwjw=yTts$$6OLa3Jd=J@%OhNzqK2#U|#(fh2% zFIrk)&Q>jGZB8R-nN>I78+L}H#fBLRie{><9n7>qWc0Joy@XL|ImH!7b|%!-ESusA zJKGgrS5^M`{Tq)q%r>co_k#bloR=E%$e%Pt>2Gx`vmMek9Y4FCrMav2O1&xg(LV=2 z$}V(b96Rz{q&*CydjNh`zCmzPM~mj}2M;SB_hQm~Jgqd}6TntJZHJw2hmDW(=bDdw zujcdF_@=?l{zHql?>2Z??c;t=nh$+-fUgsbv)Z>z!t8uWP_puIZz#=Yojc(5%F4F_ zZuVzdw0(bthn0`}NNGOn+`$o>efJ}tbZv@K^BuC;$9r7OXPrCPVdHxkEbL#kXufJ2 z9~%jVO{y(e=MGlc_zpsc>1xq@1vb57P+&iF z@lXsLv*6aE`Pg=-r}J10N0C;NFowqq)F`e zVz_R9OtbigqPf;hE6zDqyHo~ko^y}YDw%mmminKL^3&ES5A`qm17l^viKyd|h2Ebm z@pjGgrhX;+M(lAN;!?;7arqHWjJ4Ea!b5Q--Vz7aY$}gq30TS)t#r0ExW~6yg)CyF zWMI{6Srx`#B3LuItpQtQjAvA6CC}zMI4rtED#s&FL@A!j<3>5S_9;2b=O#cRB|5we1l~Z${?U!7mVGo#G4M@UXudMhJVB8L9y8rYA_l@x9uF1aJ9gSh~ZE=WeMue59 zK*g~;+Fb1VZy2FspB+cAHp7ikgQ2``Ndp(paAVTzBy2Q}>fImD0 zwJ`j&IP!7in6;-4#F60-+VnZksDwaAC)vGv#UvY{8?swEXK{%*UKi>~x zkQy5Ulb?N%e$S|doiYwroV@r!RNgrNhp^w*Ht-tckXsF2_Z?CQ9%5dYAl>kDaKH{p z$Il_RB7KP2`9j!j>vxgJPfWX1IRG%P^TeNavEHb|>3cyok`%R2J-uXWJrG00yEAU7g2?uU|bXu)G?$yTI9@xUWwI{Ap zOpEXU`YhI> z;vD=aS#W4R>%G8agjxAG_6%p=Rq(g+6~WOBezcF>55ss)4#3aKw+rsk_-UaYr5}F8 zIrvfhaA^DVSd4rtL1yJU4L|B>(R|CGWaX=e<4!2iKI^@}3>#lJxOtt?qWPxU_=cj; z)j@>^6DSwsU^5NaFCoF#a~l5eFsvpl228Q1;?y9rLoC zQfMDV>pcr#rQkhW4*VF-Hp%?P`;$M_*xbn2khKTy8cj^}RSjU?C9a~~{ zyXzCyJmlCNvwm~@noSXJdiSGYrk8u);*JsJ1(}BN=A^yl@#VR>&CT@5+#TiT4jz5u z^3!6lw^rn#=q49k!=mdNX6}w^oMbxlqA*H4X6%ltPiS z9E$d5nry>dR<=SXU8d?bY{=DI>BTlK+Z;2omrw4@vbFITx~_h&+3nocaG@UbwN?t* z*xycVPlu5@(#oIVD!@?J)f8nMihFAbG9??+rMGPBSDk=ti#t3aZ5cy5Wc7(7h(Bv5x%q}klwN) zd4MB1LTS{%GP&;=cXM4sgfdi7Er`n>g>964h3&T~?>*$VYzL?9*2nCE&~jTFxsv;d zpp38=M%-Kd&9ZSR?)(>BC^QzUa^@AL3@hviq&J?lH*z0HtocIIW@esQzrSUjnVZHx4s+I9~%xC^8jBQ zbqR|zc?CAL>d+%4#+TNa~#Rpa$ko)1eG|F zd!HHAmB(d~Z~4k|k#F<9C%D&C!fvN|*YkPAZf9{W>rS=n{Lit;&Ymc9hpFDKJy8py zXDyq}Lh^G*9_)v8%YfUW@=yPlS(cHiF!DFU=Jwc|ps>9=&eFC*+uez_Ah3j@Uo!iL zWS?n1g6q&xuz3UGXzwVf|34wwA2{5-%{sUocVn~MQRtv@(F%F0Pr`Nz1^pJ|hWJD7 z&eEhFdX&UKtwHU_f_QsexOZkruXEwXd1Yque5bqP>d8F!OhvU}qE#_@XN0@s{_#e6 zLNBkojG7&R-tQJ?lK4;FsjmC+2xB_e@!`d`>UV5KmygiA4oV z@zpnOX<=6#RZzOr)WywL)tiq`JN4nm)$jjw&(+`j^xhaz`%YQfY0=*JTdK>ucY5GwSME2u{^F|n7k~SRiEJo>w(Xe7fcO7SgLmmcY56S89&Vj=;21viL9@$93z7l3)GCOemkW35 zZingS7|nr^b+!bP$%&EVO%gsxg=ZP%;-0A71C0sdR`=V8T^JJ1yXv60)QH^b)+1HZ z&t>Qlu6A>z9~77EX^2a$VzP#7>rFow@9M=K`fv=&`*RBK+c~fE2g|^f;VCx#36>i* zhR?9++vjmUvxR3#{4Z5{u?F`v)(wn*-J~pMB{4-XTqyZmw0KP~YLfKM3#J95f2T zxQ;Xh%{ilsOw4;c&OK4MJc*cmIfBVIPB8f<2qxcO1aq#3;^=N3l|5pcvPaTY_DH^z zJ>5)w7B}aBD4d!irjr!J~&2h-%}aNw^3D?&qVg`6 z2{uOuJs=+Z^g2owC3*O6UpjGL{Dbtt&mj*j*=8Kl{bmu<12PCd#$|TcR*5ghF^5}6i-(}s0|#{gFdrVZ?y z8JFeonqb=STfwX!ibL8G>qDPMF5n~@2I1*M%#UWb!(x1TCt@Xd~|j&gKf^|vqZT{ zEc8twOEE6f)x-ri)*97R!AzT<;67)8Yqhf^$r72vXB^AsEWsML|GB3QmW+WP-?l%e zwaO4G+SZ(*1ke3o;;aoxo>G`P_E(jHrP}ggh6)Rbt%@=jMT&3sjriDoD1CSxU6sgF zaBbnTm5X%jR%*)fP^ESAm69a^Gg2#zXp=J+EtykPGMl?M&O|;+a2hO}eGWs+{Mxdr z)3j$<)LOM*PODFXLK@H6Y0Nf06CYnH#!|j>Gurh7Mu&a(%{=*k+3Ld$K8|}>etc%7`ATejpMq}(!nJ6= zA{*aO3m@~N`F;an&F}pv_i**g{f8JQM-nOppRQjHxisIyHa>nIllS{ts7KidK%7Gd zq{hO>VLZcFo}B@#_VL}iaOW@gJ+SI|TG9In?6KU{j!mJfc1@?(T+(R}X%5a&q1AUqhI1x!8CR z=n>~gKrQ%mKiLC*3}Za5U$*jHhXAj{;X(7gYU67JUpIua{L)2_e0Sq#I>oFf5WfbSz<^7Y1#VdN{q&&qcg0h~9|LOlxS42W~^qZ~%(Qwcrt^}&x}8)k>+N=3TECSI*jW*t?wsPqMT8r zsvS^W>s<{`Z5#c`H&M<7_D8Ibc>GEi+_-G1<)z$ny^}jID?96a-%qIL1rm~_{-@)7 zau|3vnY`3-tH11yS|cXMvwlOx2z(vmTYTtbK>n-v&T6zrEJVDp@zSvWe=N@@Ya&)SHO;Ysg_Qp{En)}CI`E;uJ9I>3wkA1GB3Redm zCmAf;TpjTZI(&l$bmha`(e9*m5!WO;)GrHm!CV>)LF8`1H2wqU{eJ!KbI(o$xPz z#rGc;v>$s49|&2wYSUBiGz@E)h-b@NXW@zD?g%_Zjpox%R%itF_eUj6h|AAvyRBhj zsv959@uGYpo1FCgs7>ALcp5y>JreJ6D4*BxoO<-w)aoFrqba~ zuHByi4Kwg`G~gar<0;b_5pAla=mufkyAbWas<}_>o|t{r4<2aPchGq8;6Arebuid99gQN|6J0(D$-Bp_ zdC<{k%rnu3oV z)xMDsq(%wAc(ggye5zyZA^5aL^)XfNd+^nicxjB$TFrk7K3%5zKfu>A_dkz9K|6Ct zT$+Lw!ETQyFLi}#NT!Fek(_y z-K(+FN_CD_s>4~T;@$i;>_i&q^&-}BWq>=Seih19E2(RytN$})fccXe;1Y->nTAJ&9Ny0>TN`%3GuNMu!6*}vlj0Azlc z9*6g& z#K_wcU5%@bt59=IL?V3d6gTf5xSqFzjc3~e|bsvr}XClQ$(*x;C)3B zBZ+8!4t4pAjKX^u{Vaz0aL98^&MoNYdc053&+Iss)z9EO#9i;dLIuh!@L?plX?R}fQ&_tnHK z1B!zWAtCTK^m_=Cf%U$!3k5U0OLS*^o!Q)7G0Z~%bxSexra4PW=IVVG?K9|MR6?e# z&2TJCxN!;Q%$FCImdu_R+_f=0TWi{3i18hzA3+>Oo16xhbE`Gd1%+URoamfuc3s>R++011(&Ro85Y012W=Chx(K9Do>FBw0}Gr5*}s1`nNqisl#R;YF3 zOO?;OISWxMYW>Ty<;o&?j-W#EFv8{=`rwRY)*LW_kSqpEB=qr{ZRf>6xrJR$qn~WF zSO*h`*7D(yj$;W3}i+t7JM4bz~crq1%rD5R#8 zp7IIz1jNQKHE3O}Z$2U!F>}Jm$&+(OkDNLD>Z>MC$-QdI%wf}~jGT;zH(Fuh)M4Yt z4!4Kn6h1E*hkgWq0r?(%<;xZibWuuvz<*+NCrZrweR1HxK7;Zxlk&CkaVCvjseS5jH1-` zeGNS;ABSx^zdUL_+GFMWRKgUQ1^-TPjs&2R*3G#$KjE-Z;g#_5ZoNsY0=PU<2wkx@1aCKj!!h7ea`p` zGh5kz-OK0As=6Z(tLQ75mJ7q!N+l>7R|>rtb9!tK8|TL-_OzRSs%!b zlEoO1YD^D?Q69GGEp0__7$Pu^9{VhZUXfxj|1pfei;)PATHfJ6*djWN-%PO1$$pD` z&~}y!MeF6kKC9jDkx$ZKJ7FBQYg}k8GqN7fx#ncE23>mIYsQ*bIS{k`rQ=zMY2A;R z3uS!jk1ODsjHW2e7S5gjQ}>+dd7SVZc;(aX5twv}GUkr!HFntDnEr$wW>}+)O3XE? z>CH~o=}iP!CO1hA0e?-Nd+xl>mtrzC>rx-)IE!8G(YZ)58q+-yM$ND*U)>W8aJO}i z(>j^yU-QfxKYlXPOg``*U97dr0{(W8of`ogOTS5OO!w#YD0W6|#e{2*G0v!88>P?t z9^JJj**WTAeCPgO zqL9}`Er`PeC6-gLu{}Q`$m7>B-U8;Mrn&ys1Sblbl z`^pz`eN~kzm6}zD%$0~*cTZGfE~bQ`_*kU&wQZP>XY6I1ouP%&ys`R2}!(&zOg{du=zudA>j zUQG=vLve~J(^=P?9YpT`7(E^H*zu|ENrr(Z3z77DFv>l)upx#~A|}LQ9VB(3gavL9 zrp8TJs>DTAC}tJoCYOKMXw0B@#Plf@U8Z*wiq>rAW(m|MAYTYSqV{1?2Eb)zkn?`3 zM8!5d_wn6v$G>NStS9<*EiLEAEP+rupS?UZ7mr*M`LI|cO7!W+ zaEnv9f6oBORQ$LG#6Dkjy9zbmQ|FqHr)=r{(?Ur8t+sIP$E$_m-)IMpbn7)e^rrhE z8{Z2ycZ`iskKZ1Kf1Ipfw3siGX;5DG_5765p$CNHGR~uk({RWO zMOJ;jYoX`V`Uwu`Tlpm}$6R`Tjbjcy|3wqE{T$Qjxi*f&^jw>VSjG?Ch~?dPjtlj? zTOVRZf@I*Q=apDqdR}P|u}taq2If2z1$%-4$^X@EpOk zozME|PcvQ->;Xd zb9iC*Jmef#7+vxOXSdAxzTl+Ozc$miR8Lc#b)GL&>wk2X&zg~cGr*smtwr$zG(w(;F*;p4SZ^F@Iis)2lr zmoPh@1A12b)?4^^-PU}6Mt^VRn~1P*b7=2F&&tR5#dLnr^#=G309*NH!Oi|!3ppsS z<7efo0U!Hm4}R?bwS8NGt$f9BPsLA*=6e_(R=&L!K3>W--*R9p-(I-G*|$jIFjI4}RA7p|6$m1L{h+@4UwJpzV~)ZF(HEhSSSH z1jflwv7iIJBEdW`j6eIn@YXdMT93y|kcf2-Z5H|~=F!7I2)QT&VV~8WVx$`n4~FYG zW{!6j6opKoopTN?b3k^6`C{X__ZsE5I4EXcnQjz|b(phi<8zm+863Nzxp}?6id(vK z_Y2OI#gwO&CziuuMm_6)=qIN|`JKtfB5M*CV@H(vE`LfJKbg}vU`p6u<&UXSJGDeb za(|H3F8;@tiit7&Rd@e2iI|9}Nh`qA@prg;^u@%UtWUtSQcW8C-EXP+xN}*9z2sXn z6gIANdSP3mk$j&~8IwHLsBvMsrt8Vd&TTfi=WiTxdTVoY)uyV-*s55gzI{y!%!(3Z z7#O|OkNv}c&n2P_-@SsG<|z>f2^o>@V)Ntfakm1J86F`RjUpM zd~b1qYg7bP`7)`*cbYKyw4=@yt9QfMk+v=xTe3i3&8IOQ?l_|Pj%zE~GQBNjVAl)O z&x%M?POr$yPG+r)-5RVFRVSm|Moo&lOB5Ol4*Sttrl<{N(5TFCOtsQSmCJsI>50sQ z>?mYUUEJqmUvUKN>lC5w8)Uan8HPebQ#ad?*o6rO<>p-F`IvJ)wv3@I|8!|vvVXiS z=VOV%?=-YhVx0Fj&#Rb7ea?>#J?Hnw8Sbtq4R=>G616=Q-ik#5?MG8nyN$VI8?yb% zd$)F;yTXuma-QLHs+qT#imK-I>G5oV^zUz^Cz`#PX*vA7{HR20`8Z#H@Z9E19*ya8 zqkwb!=%JE#Mxx+NI4%H@TJnpoKtNm&&IrQqoZvBIZssmh3c8&=H#@!j<^?+y@Pz!M zzw!&@6H3ziv{FymAJEq1LN~hT6!(g>7r)ZXW&IP@KSOdh;)_tN74ES|?{s zWAq+tXd~tFinI=Um1F*H*c)s(=78`|nl)R!ocB_7Uh65iPiE;RQC)cxeg`8%#a>;Js##PB5 zMxZ<@BZ||KM@8ht#MU)%M<`ejZR8JOU#R-F{I$**&naUHR3P@Eny-vQ@lbF-23pQ7-RH#%UMN&7jjaVRY1My&_?Crf;5o5cJ4$%ULb$9tINj%^L* z4tAK%X3YFV`hY8t>*TL6n@t~t2b+)Ik-Xvzw#7<6BkJZxa3FC0Kp)i>Nf>pKCp_%u zc_i&?!ia%J-q?vFCydC<&M+pA$<5@y{{6GmVPG~70|qJAz|8)1Y5N@j@j0do!(}5$ zFvmq2W0+*5ioY613C3{A$SA`D0uTU=m2W@?kZ>Ag3|I`R!=YxsOA1v zG8h%Dmit|$+v0P^H7Kr-yA<+s7C9)czzE;;<9<|G(l9*mau@|cWgwT@;UnnfQoE8^ z-MK-B(jRGakF~ic*xY$Gw>|wr<2V~OgeA{s6$_Qi++Q{kEql79Nw9XaZ0-d%_b+Vj zF*f(xJXu7@*Pkbo2;JR8{|4Yhykv8;O@E@zeUHukYnywH&3%QqixhvnaolF#BVr2= zwC8r4`+1xDO`E&I=H4PVV0+=8i1yC+Q?-zv-*nVMce*WnsLkDM(_b&{If%=5kvmF# zl9PP=2Dlcw``W^DZSDx0`vHkR1#uIxU))XX_(aGz!REfl=B~22XWQJT*@;5fQWNpC zVXCFSBL5JZn{xnK7+z*`kF~jvNd0n7KN08aPb5F=c@nXo+$_m2?}rnyzunb1QW!1K z$Tps^l|SdYDC`LnjLCs_@lE$sgKNSmru!NrEyO+D(0eJH;ny0RV+-nEZwwD{&osW2 z@>&a}MC@Rso3m-}P@_r3Hvh3aj!1hr3Y=(MVf=^W_afyUZe$DJb;>>3NEZD}<-XGB zAmz7Mxv$0m5ddPQH%VbfnmVYJ3n9<$BrPW4=x*w;934GO%se}KnwYja(oLL1+{?u5 zhaA%FvbT3|G7G{vD84_>aQf?a=}AY-bovTr`U3=$d$3@pe}!PCKVGoDsyGml@s$1e z$9T$qV5Xz&7p&|DR%s%Pafy}vz)S}R!$AUw;-LaW@$@sX;;xVJe`Tj& zWhZdH=HbLEMDegNAu4W`iB;TzCRTB?O|0trQWJY{a4;cAH~buZ6vXusX-oU`2&U~B zf|=%Jf|-sg2k6tEEthd=%e8{(KUc5^N49zD(EnD!v~jh?e}iD!`)iB;F2S_-8Nn<+ z3fE;^gQF^E;8I|wL4P)H>S?UX3jVq9Q)MMsl@+iL{)&euBt-EHF|p!d0YDTF8wEu1 zTyA2;^HUS6b|pq~{*(L5k-LXr>Qa^dR8!>%K<Wgz)VM#18^X}@XUh0vJ;rauIvQv2CVWc7ze|Fe}Vi8 zR(1l@RK+9YiiZh86whcAE1oeXR{0%kV#PDg#45juCRX_cCb!Bja3H_Hf&2mo@(av# zRDOX2`E75>FK{5gz=8Y!{LP|MD=M56mfV=pwgOZVwG0DiB($AVYo_*9ScOIo@7VpZlc zK2i19#q?MC1ty<5*MP~V@&!!3>+wqhCf^H!sdGRuxs^R)LnQrKI1n^Vg&D4N#5QHK z*spAsxXQM!j4Atw0yADW{E~nfFIzCt%YA^sLzs;MROJuVcJf-%{6zH7g#JNs?F}W zhu>MU5uzje-z{InHHveJW)_vq!}gj>TPdHwMw60j<1Vkv5gs(lv}4b^!J84GpIx8RI^ZQXef?*q~YqMRd&Qo?QVGz-L!5+vi!5U}J49I9QCPj%{gX z_$I8^X@-4c4y76r-l9N4gY6ZjnokHpYi&%FbZtsi*nHW>Y+g`gk+t;AwEG1MN0h@C z2TRUejftjGvT$DO-BU}=($bq2aL>#oSP0y*zxr?Oxrz!1SrHqi{6fN8R!~TA*a`~K z2$O)SMNzUd68Q^^x*z;hAaE3zn{_ z8n$p37A%+(*l5|Z-r1f_OHi2dwS>0Jqzbg+S<(fwxLaZ^Y}Ks*|*_sw-)$)MhAOSZeXIXlN+}(n0|Qu$gzOGZQI=Y@(}K z0tH|W+s^BMZ_FKWjI3oM#`hKQ)8Y`|!I3yh+*xwe2aYKzzk-5YPlqvF<4w>b&Y>sd zWIJ;lJP(-mFpT5Tl{P-!J8=xEMe{AQ@qKUM<9&$cD+adOHxX`3*#t!Mox%K|Rc{tF zJOQm>KK=tVe7z~_e0W%*QTkCZHY~w3K*bVq;(doW#<14oCVJa=ahqv^VeNG|x z0!O*kQa+lmBlN8HHG*#nG-w~oSKF6jvyXfGhvRE+vo95MTw{dq0t?^wwtDLZz9NKc z(e`~~tG6QXY5QPmz`jexKAm5GEB5ub*;jAj!*o!9?A-_Wu0@!O|+5w1n&cdCuA6nxJ>iF~{V*L)8M9}Y_H0SH$g>ur1< z+>q+><9VX_xIc~6zM59}WelbN6;N#v0R=(H3H%H>|pz}M*#`m(t zKITW;$ND56Xq5CpClD^bci8yiQ3*P~yv^5q3vkkt56w%-m{$1seyKITMc~u<^&qC^ zn`q?~J=zN28}O$M zIrvegfKTVQ2i)4eCvAKu;pTjW7V1%U+V~!}*vIop^L-(FI=>?j5UzedvGJX>@NwQ! z^F0+4n%`Ni@a=*gnGvnTlclqaNi!8{a+P)Ai90;hOJ& z@ag=%hk$VTeci^_WZ}!O@TJ(=-?!jnf1yR&Hv=h)!3xu^b7>vG8TXk9y?$7{JQc2Yfm3*P{8F z0ElxWU_AKt0<%BmSb<^Wv+rkK3cj`Q*P{9C`AJ0efjmA&&wf%pn zdl&esigRsz?Mrq-*lH4Di~_n70t8GjK|nxkcOV21vzI)WzAZ9&8!)a>3p2q!*rA=K0Z$odu6~eEx#NFQ+#KDb-p_AWy&}_DZY;+ z_Rtt&n^p5=AE!{B2%D^Yxr&?ENBfEe8DRr}*`mg4(N_G_qCAs>KmvBW$n zzB877Z4&rYKlweW$8vfJ@pb#ABVM@cXtB)4U?u`7g5HfL6#vP=e1v`_^+B-!zTyF6hxtW#98%@ZDkIYti`l`d!(_ zHKTOC)-L$2wD7&E@y*cqxJHrAceo3_7cAv>MC0SIfwJ#!7QW+M@O@$7`-8@Jx5js~ zCBGkZ!8gp3-_si3OpPxMnbq@q4tySjD`7q;2hiYky%@B|aQE{z=rN9$ksx0nUDfVq z!>!7NHjs~f3MCDE1tt{#8OCF?%&!Wnfu1hZp+uuU)xWPAkKgggifGRaS9*gHA4MGy z^39TY>jPif$KPFe1rhRr)uq-b8j&${m`BK^zpu)W1;^(H{^}Yet;76jclW#2t2y6+ zj}JJny4Ju4IdYD<3V^@V7W=si?|Y{Xj``;w_S989`{t*%K4a%X2YgkN5w~hI(O~{d z#>8-ZttCIeS^m^LzsrB=_0zvE^`!je*ZbPGUvdAJ0}ren*CQvR$@WOj*T?HBO1A$s zd)?0OcXa&ncXw4K$JWeyXmQ=wKOVE<>7=OVC(Q19?N{Dkcw6)C{6W9w*I)ej?wA|i znG&CEU-jXZLmj{0I)6~EB-}1?W8J`}D z=KUw+3 zryWP{Uj5+re$=$+)Q4&Rj2~lra!YK~?Ug^8^4FoCkKDKSt=|pY_}evqW-Sa`Wy8|< zSodBnU2hjl*E<4B*JJ&meNnrQRyv%ujtHgX5=xO$sl+qe*Q3%ARqN=c6rzPfca0_f zWYoJ^l@52U<1(dmxlp=7Q;NY-MwO13T1TwXi4!_Kq|V2l_k9T$TWWuWr_6U1mJf0y z);g|M9M=ero|0pRXRnQnpRXWmY9qCGCkWjfn zs!Z^V_VuoGWYjt`mBL`5aAS~TOQrAHO2?2|$55p*OsL!xRM}YRyROnPyw)*7sf-jV zHwRUGl|E0UV^po<7NznXq4M2;N~JI9mZ$-FT$3uf`lnoT3=b*3`$g)_bZCR&36wc`T-(KBJ^<&x@OXx)aOc)z>`#g10_)N4@7z zeZ|WeJ9fuZ?9FK2wx@Y#N5`J#hF@i!YqsrZ_H1r$-JP*xPfY9HjJJ|vsyFQMGu&UX zC#%74+u`>#`)l@O>}ZLp*_-k4&O^W6^Ku)eB<$URr1!?Q?)6l^(a@5yu!y&0P~ z?Wt$nunEt|Z2mcthFxKkuKvkI(mnp!p*Js*Zdp>SNV=;$pI_X({UW)Z@Lu)mizU8A zB#!b9o9Wbzn`@EnuF^j4yJ(4zh^>C0bJ{4;n!PO1LkEy;k@6d3cgW&KRW|HpRc?Mn zrTfx@rLvw;l@)tgmCaA79PfJD(;O@68THt@m-SeDw0aFvh0Xqom$O=BH3w21zv|Gd z7fbhvi>3SIMbfSQvC30Acr0=#LdQG*j zKtb=Vcq60Xa7@MFjNw_EA5vG`>nv(qaeL}_9F!MhaZ>ZshniVU%?Wn?lSFe+GFtpVl%S)}LVO_?N_KeL> zsN`Pzd9InAh}3!}N>Ac`{M{LwwX zI<%LJdv|n7?Z=(cYDZxp*V8jMKcaG7pH<_xX}NwYDYki=%J_3bTkB()@vW_O8R!XD z+V{MKo=|j1FR&cZ6E^QgN4cXuBQ^HW{>_ikl=>QEPF5*0hYVCd08`M%`74k$zYW>m z?7#m)>+ds;9QV|m%xK_0xR6Hb1U<$esTgBMkbaz7@UeZqF$MuL^d)d$V?kt8%ly z^_S>;J-BF_pHU5b57WgJjda;_dn!cF{mIEa`)HSz^xoFv8ApEaX*ij&`Oy>gw5z`6 zC=))y2HbigHh60M8K*yM{`cx?HZFff z^RxzkEF19Y)~bw(AA64YGxjv9z^5OXB?3S3w{FX5X!4wDMjzE&zXh)`>ua_!U9)z6 zmci|M>N8q4p4h7@2pO)ov4ZMZT)Rba?F?oKMJ-Bm^WI&)WE%c^R>kS}gyG1SzXIj$ zkA>lT{FT1GtdHZ&TJw{rEQB{VAm6gGa4T(nBct_@r(%7^e%v}9Q?2W#%sX0FGbs8r z<@pCzud5p9A6c8!XS2U*r2p31q!fT#{dd+T^#!=Iv2FZa@*7b7dwYHxIW@{}zqPL3 zzIFswbj-nT->XM`nd^@!x;mmRu4jFHoDZ)T>+F-dRjg=T_PleY!xd-L?oX_@Rd2;N zlaZ%fe5&4NZ{e0lrP;0b-B=R);<4Voj*gWM@o}fi82pNN^sB99uY1Q0J(FK<;DhFs zj)X6;P(pERb!B6FB9{5&8loX~Wf{fxQGcsh6H~T7vHF=^4Hdg?HF`FW`e9y2$J(1O zt9YYTeW#Aii)z|4+^#Hq!pZGIkY?nm2xHWGY_vglv3=HqKd&4;W!8qQ%F&Z&J&6B# zN7lqvj?VSRxkq5nsagJ2m7}L}x1`Z`aJQt<`P^V<^fXC?N1HK**h|SF_ENHoy_9Tt z)EVOx-jTxFCA=fJ^HP-X?k>Eeg?Bgq3Btd;jfPR5*{fT9620&>ZB+YUr*FYXk5TGdvZN5} zA4MBQzLNPw-@5p|ZARbhIo~ejg2E+Bd~*vu=4`@mfg2VU6c)`bF1csk`~}#zdvV#4 z@}>7KTfXAH|4Z_$(POg5=8PLZ;nsEo zzEb~w$+CXF8e4ANsJFhiq6+5DOB$SW6q`#WFl z2gb^OOqhRY?t3>MEq}J|t!3|i`Ey^dv?sD2f8vg_Uo>9-r-Rd;n{Z-KQsj&G{VP^E z<(RONOMiEb7q^-?#O(Q?ha+S)EtV+;x;5$i9W_fkD4oBPPBtd9av-HRY?z5ZQo8v% z$%gkx97CbpgnZb<*Kekq|2uy--9H#8!c#5o0mdfHhwsGDUkQoDe|~p-T&71)hHsMP z$DGC)-Q-&>hMM7A^NC`{zsz{ebc*i_xQ7t;nW21ucXHfAsJGOwfgktuQEQlfBHXQ16)|hQQQ|bEpDg~YkQ+zXaEQ-RM)JRO+ta_N5;aDRzs0q00u09+(-G4O*D z&j)@=;!@yOBrXSjU*hG!HgJ>we&9rjD}V<}yc&3-#D3sHiPrrUjW}P@p<4UB)$NALSoffsO!s#Ftsjk3NZJ_rHsX)_R8hBjlv95*RmcL z!-8T@TKWkd*i9LXBVJ;bcRbzj?oe`9g2;eBt+ze5h3JNdy0|QCI<=`tkxkG_Dd3Bzx?(`*bjYX$0Or1 z36=?YSWYbBc=`0m6EV}rR6>E7KKbd-v&b(n)9EMuX-kI0w9zNA2j?G4Oj{n6nCV~E zJ+RvrCzghvV~TGp3g;Kis96mE$a|J31-&bS~%ET4$&4lY(;5HnP!MJGu z2|p$3aYytM@I*H(WQaVg6R&B?N*s)%>!~n?E4*A{FFhemn8V0xI~@n@p`NF+hsa`x)HCUg>`h>9Vh9J0P!0Hv(ij-wuY+LyF>~lFsMB zO+~dU){Ejh39R!y4+noEC{cXJ;i2=Tkq-@&_VIqD`1qW!^VOjec+DtLd|caA=Npc> zb-dS+k3Rzx-&Y{h`5M4iqsXKlou5HT=gS3O3jE1OUd2~y;mbgwgtKphg|A$*kB=~l zuiU~n9DJW3TnY6ki!6NWHT!taR(vNc<(G1qVR%R&Me)6DDZd@yQ|(2ctNe9rF-!CnEr@%K0;VeH74rL$vJ7gu$uRRRDRJfHWz8l~{?3DptRKjv#@+IR?d}!t& zd@qBq5q?S(A0DGZ_*yi+6dA_${VDQ6`}hn>`2iyKF`@X+Fdi@CAJ0%1vI=_qZLfr3 zl))Cg7F>+1FD1&pTP=FWpjWDta8`U%BxYSvve5|@m{9zu9*>!lPX#sUot4yK*uO(h zpPQ3``xdjoa;A`r@*+I7>=}X&9t>Cg0ZcY-$Q(M zFwZSo5*LNp2t_vOQIYljl zi~6T2CUF+?!}6PL?x?ko+HMouSYhny&4`nXxdyunb#z#k&xJjTVbVl}XccVB=0(UG=p&_Szg^)F+L`WBPYgK_Xv_?T3d{-Ua%i{!f-FIcrYe^d4HL5WMz)4 zGA9D5z>3Nod!?{p-P0fxbZ+OJ57#`9)w88v4|~o4!(DyH9(zuIV|Q$&%U$bIv$tGg z_LeI+d#h?^r7Nn|rKW(n#1t@Ba0*z}mP(hi)}`io`*rMnb@%R$owaU9RhAo#r&k2xSNTTyt1?$4T|CKJS7f8hwaew)?~15eRk5B^ zA&lnO3NeiV6#|nZjoL_Ma-=XhGH7ybWMpHcYgeRme`G|}mN4;mB1>^x@%ly!;UX^ zjdL|LWi^hAU}EDOOl+K;iH)tR}inO$Ai~8#v=DQx7jO` z;@!^CS=UX7tbOf#5?-^n*w=i==+`4J-{HpQkuTU?H_N6y{_@;cvfgU*pyqFJopmjU z{5ldPnIFyZ!^v$PH>Z}0tri=zqAD9YDyn1Boe9IcZNX1L*8+#Dx42IF8}20;yiU5^ z)~(+Q_M8-KKKNE!)cb8|XfLEY;q+%#ZS*Hqt@7ug5}HsMVmKI=q^KBNP!0a2xTYE^ zzQkqKfPv*4TVoCu7>?>C*I9S_t0H00nmCT1rbo9&x+6qu6~@hAP-EM5?yIt3ZsaK^ zV~VqT-L?ogd!Iu#p#ytPMx1q-nY`~G$fSD``~-=+`z|w&n`7#2O&c59vyS4jI2_Y( zdg-ado+Bq>Do(~?LLVlFv<~!m9&XJz7~|g1dbahp$m5YEu_xa7{LS+xyRYoNXVGkz z@zLI>S<5_SS=ZtEnsw6iR#sHcy+!N(v=ixFzU}h!wvVo}ZR@_$x#<@;Rcwg)C=uu4 z*!(*`ANaJm3K!VZyQAPrA`cww5dCMM!cBnnr3d7>?E@me8WNF-+twoXjSd@@yKZzi zb~)_(9T9IiobNj#KX>6ut9P6kZYgCT4t@}my@*}Uuic&nt zF=uyi#j?thtXZpfRJNZRRaKu^m9!vgLquJs(al@hxN85wQ-<5?*|E{>9G3=rvF3Ke zvl)$CaJ%;4`TMJ%seh+3!l;c<*K~xqrX#d#IwG<$!nG^Hxj!PJ$`|IEUi?4pQ+Bl_ zvgM_|-!=-_YRW^VZi&wSQzZ7%+*v!;Svgj83S%RAosJcq!dTHMj1`^2SkWnrwf*fL{*y3Nfw>V!;jVg*$mdS2%ETU}S#)d} z6;-u!K+=p=e&3ybf7FrXv1oVxwhhRbE;(e^-iz5CiX?YBjqM42PE3!+!r^K<$f zh-6qx=9~7Dk*Bj{NPfTM+amp|cAx`Hs$SvWS@l_!4Qb!$A09=b?&#V-Z}TGU_V-RY zs#ur#xAubbPJeq;Wm3%AUUt_4(DI(vaVLpanyCwlGVPnE{KI@$7X87N$Y)`Fv&wsSCJ)`RA z#A(U)G8Xems%H$ylBLzrai2d`lvaXS zTKin%kG|b6=pi4h%K(XXdWiZI+b_&vcHnE@8oj==>IUNNHVZme#(A zvu-g-CI6FdD6Ia8_ME;X!@df3lkT1L=sZWIQX$@i|7snom0F+7bpZr3FzrA9XB>+@;C^+rp?@BZW3r;7SL+BjW>KXRhKacI%IKkqyBF9SDxHhj_dAKvox<;S1; z_phQi_@14aeCNL6F~>YNZD{9MRv4N8=GzY@dN=*~?N_#cXWWsrtK)xoTm8&O#}sYM zU%I|W!cRICUnoV^nXUQ9nw>v-;WxMcv+z;hN4LFr{ymr?e_uPL=*qo6p0n=os-o4!SJlk@&DQG2FTb&$isIUH--rK|vi|Ge^jjMF zccW*g!clsG^S|IF2-04xy?FTc=j8M-{>qCJ@>`s_@9;x1J-!RD;VN#DZoYrDiL05~ zrf?r(UBc}Up#KTzyrNVmzKX5fKE$ldsF!&mALg~abG_JE~=nO>lEh&YZ;`Sl2Y_0M4>DJagJ z_ipH82~V-O`&!)A^f_`K6i3KgT)vYU5DWxzh?QM~UJmh9zV1#l`pEjGFZ*IO=O`AK zbD9QP!ta*#uk=eS;ry0Y3HgRg#|)e~2TILRqBq024hMxThxCf#N?PPF|Rp_O{OKTNk)PoT44UwWfC)7 zT&H}o4-t0Cya+opOn+e~9(XCdFWV$1$0XD|u55|Pd9TFeUM(@XH%g3?@w&uJrxayR z9;UNaVnE|35;N`&O(zDKp+0R9_H$4WBJ7uT3j3v_1 z=j2dE;2>r?w@OT1QReVxlw#@c!MR3a+Hy={+VX+KET6Lyi}aZ<@KDDiG1Iz1V%jo9 zVy1Pw#C$FKgv1`;*CZw<)39aWAB0>sStg=<`U!85o~lRst9dLFB_>BQIq~#H4pIKV z)D?SZ1Jh=TDnpU3M|hd(CYxBKn`C0fQFDYuz36j?y$j{<&5Vh`{(iDv=x zS%5k$SFR^T%yQ*8DlvIZY51(fQ{n%24R?#W?25~KTp1sjRn>X6j2zR5A@3b!S?xe9N*~xt-Jke%2w(U?D># zq>zO>WQ6ll6UC1f@J6XO;wgnf!GPU(n%l2uQI zQ6+$(MC_#}q&3d$|Jm;{d4{3uGX4{X&d0tu7KakWcM2Xl-(igpk4OPNKH}+oli)^{ z1ETnNPt^I2gO9fH;PWlRXdmy#I$r_Ye1=z|_;~Nq`Jym6g!c^cb(3M_`z|uC^R>c{ zag`{(k2)ZkdKdn3?tul7QS})>AyY|AJ@at`HD3@=27wW!TmzF?-as#&sC!M zu7#e?R{=iW!)V_XI2515!gm2-{EebS@%U>-eaW$04$M&H3UV@%(p9cYHicIR! zxy!=mjW?fT$Oq~G-y;^jN#NseBqdCjQe)wJ7<{epCm)vL3-JBL!so#S1=WBkKJFDq z?3E#0Z;)I(Sbq#-{r(~KJrB(2>N@8>@$(g#)T48| z#9lfet>DW>MB2x>;)?Glz&c+!`1qSqiL$R69>iW5;6x@XBp-iWD!vBUp3!WCtUzPe zuMeh0S!dB(1wEA(!}2-cB;}n4Lz2>62-mTqW47?di;Ke zyo!%x;rP~B^xR$O6tbtu1vo<3)2H9B3kKgF-~_?;9~1L6f=1^gJ^4+q;z430%5Sl@ckqS^P{;1P1E zIYXH@-86W((7g1VA^#9005MOgST|W&XZmBV&Psdo_O}w2*)h5@yFDJmB6-+$?7+G9 zDF0P!AB$}1e=5RA*aM&VCf9}9N|0vxU14q7Ao4ffR+m^b;fj`2WDrCBVz=UiYcL-GP>Y80fX6oOb)0aY;U8%R zp@1yovZCDF_JqIMd>tH0LYcKEXa%;}Xeye0AThrh#U=KTMiJ@Udkp`rRSy51RZf;- zC_nTz*fG9WdoU5q2-|h=LQD6xKaJdV@O(@6n|gNNbuh81+vDBy?*#c)XXU{&sEr6~ zZHV-~wYp^u!>)dDz569!UNpG>DzuUIR2Z4#Gz5+(wh;r=JN${^a`x@E6H!h@iBV`9 zNYfQz>=dO{_x*&cZH;flxBqls^xDVH!Io=GTg=qIT^q;-JHC~2{{L!z*a}6TaHiA6 zm#Fm#=h-KiU4v-UMn{Lfdo9Xom9fD7=#=jM_=J{dcSP;>x_aA2tdEdayS<`5v$o;i z>a*^`N(rL|)W@!LoQ=4Da$Vj>yX`s2MqSFC^;lRRbH-}wGV^aYnlhicy1Xf?VQWmy zFJl}2?0NKWPPDt5Ho5DPHhm}I{a^1m9(y3lXyY8VeUT?G$F+>1^t2Tp?T#GP`=b$& zc>gl$GBCgY>*J;l7k_wqV9#ZH5}S(}mbLoh-Iw>A#>r8C?7$?jYcEUQ-oR`0F>?`x z(mt(bXTWE6B{l#a6y2Zwe>i{K2EzLDo)Au-zhA=n^BGO~Q%8xOE`O^ip}%@g(Vv-U zPdI=2h4WXxr^u`G&>p3)mjm_G^CWRN(e+iHthO_ro=@7{mFRXUK0U6wH|u(ePuElV z(ft%wXW9@g4blDZ=qE(?!{d<llt z%>$c4Pjhw;qv@MJZDC2dum$=aI*jj4GX}01zvi!(*}B<`!Ub4GB@0^^@x#oq>2!Ix zqY<6coDs^Z!m<+I{M(n}HBgx`ML0YQP1h1VXqq!d#wcBcoCJt-g)2ZD8aT}v8xm>E zqJlz0#+XBFstfOFPNy{3rjvCiX4Zbo( zmX;V36bSfCbEYYp!i9xpqQvu-qRxs+ko$1~KhNTT=iGp2P;r{mEosV2%I6mvQ^kK1 zPje2EVFe3=F|sieA3IPjEm=}rSRh)KmV~Z2&6y>mmo6z>TCiy0iUme)00sTJ)%L4; z=<~D!n~myAOA3r>s4mZh0)sdZdNo4}7NPDJqE(k-MYsTBwoF8qL)WX8@C3AeGg|M}(TWb1rV_I*Iw1vtt zD0k8Pk~t-Kcdn}kJg;}zA|fIkqEhCSrlU&kEiB7gT3&2SoixRBN8xM_E-`p{=*RLz zYPjkR8PCr25O2=>5(I|C8za2Bh$lKR#=|u=rDX0xZg$3t%A*{TUtD3(6J0}Y*`jik z8cmgh|*-e`My)jdARjS0g2~Jz(2Ypr9EGt>E zbYXgtZ(({t;k_ku3XMBT(x*(j9rZT9#J6xxp(m%LaDIU&tE|xHK^-kyR5s6(nv-?= z03&PR3Xdr96{@$hIl0d99VO+(lc!{jT{x#~MXAUaTpsKJR?L;A0=f|fwqi=pyomOc z@mZMx^~rtR9WVe%1(ruPUfidDO0l2bEixRc-oAzCBD#RVHO4kRB^!-&dFUm z8&@?t7xNx~4r}Zf&pbGi@yNYiWRFd2xPNi=kDrbLK3FA!Csp~HZ#PjNWxQ8rtoF`NBq>7qsRbFn!p;sxBM zQz>>22IQJa1r$xEQoKx4L;>oIrjuJIL%HhDts*xRzxu|KTL7&6Qq5)mcS7=K&V z7+xPR)y%a$N(IuyK(M?B@X%%N7EpklK?SqnQz2R@(AawX?d z7+Urwp{}R@?o&3Xvo-A7c8A)gQZ>(fm}7TtB#HmY;(s6U|2pyCBmM`9TK^rHB&l?J z`-akoxOBaX{jS&bR6Xc^$_Cv}{muT~olD4pjb_YrfXsF91qX51E326Bj1w}M`r3%pr6&*5yt z3j$pn#tpg?@o&VstELynS8ayR5`L30MV4=a2*=x1O&nrIUC_f}eAjqM))&X$Y{r~m zAdmxZM7T#BWjqc%MGCC`ImE6@%0+!^`C0RC&7al2DM2zIN2m5-Z4c8e`gdB~-?zB$ zvbgopKc>f-f*+6S)_E26z(LWLADpKaQ8L1J`iODjyTL! zSL;!Fg*)9ii8F=QOB{B&`as(674D(N4I%c9FusuXn)#{M#+CzgioM%U`{AiZ7JqGll`Vm4y5zlr&<>?R$}VLORV}>TR(U}6i*&( z>BPf8h~NPZ@BjpO`kOioqdj-Zun>D>zFEhdYfN3v^-%Mg0S#L!|4VyhUW7g1{1wU( z(|`i&|8X7$*8(I@vcv&2qfnsC9L+B>|co2~*q~2M{ z5Me(sb%p)F)TMOA6VJ&z5K#`mj4ODgKf`SD7NBhCiwC1lHY89}#sv=8035KPkEx@0 z?hePpLV^ezfCD_hm*R=XJZp-`3ozpf9_i08TL%A|VYU=pA83%B@*;1sA}(;i2H=1V znV~$-hvVVI9*E!p4)6ezhi=-y%U0Mh1^}Yk60xX9ImeuLj(A||E|QoW4@t~;6mkZx zJK$ruKosZ4z${|wd0m`1=$_+JIgVxmr8;NcSA04(nL@E->}Uiwc5&XpL;0+{pV zp>rSbEa|@vxLD#xfagoR4S2c4zXYz3xE*-4#HWC3B>oJzPGZ{pn8dWXN#ef(?~u3y z_<4!1z_s5h@pZuM5~l(mmUtxaafv4ZpOSbQ@COpl1wJS73gGh+W3dn8g2WF4N8!H0 zGJG01M&j+j@e;QIdnEoXaH_;7fyMrFh)YZ%PoVDt{v7_QPT3&XPN>8Frsy0;k;X8;e8csMYHJb``&I1m0REn<<@08>|`^?mqzWL)A@i3@>MS_^?yTEwHM zGZ6nE**KW)a`=zea4zxn_y?JegF2Paxl6+Z#A)~knU8}y>!DMs;pN2X_y?)LK^^Yd zyIRBRiTR-g_UHdOyUG!3T+7VlfXsrcT4{T!0{4uA52vj%YZ%7|KEU9C4LZC)x}SMhe-c=U{M#~ z-vXR1{htLMFYyb&qAsAb4_MX3>%gimjsh1*{da*?UHl1H)x}w0Q5WF(61YO@{{win z#8G@mkeCofB+7x00V?n85@V!4n};d~R-Y<|!N49IEW>P^aT0hE&ZFJhf->Kp|=C;g8BpO={H@?VhnBVYpu_0QpqaSVa~hBMc? zqyN`9tA6_`JKC7^=eMSb5_^F?5@!RaNSq6-`ty8X)t}!5%rYhaEMS%?G1p)nCGk&y zy%PTvc)Y}%!^v`|KIgBB_XWVafu~CUSAg%5m~%O2Nz8Ah3M4)WTrBZ>z@-wO0WO!g z19-W_{0{SeiF*LAmiQ`Qzr=%p*GudLrqIs7?;YT2@OMl9`M~iK{|LC3#FfAvi8lhL zO8isc42hor9wPBh;87CuyN+y$+kwYRd=fZU;=ce-m-syJT@qjB3|@o%fz>s5J#eYi z84FBdz5>6$fakzp<*OVxM(Wf8CrbQNV3kMy-u6iUL%=GJzXeW{{@mwW<@a;o;nM#f zz$(A7cz*LrfBvRd`Q@JIlcfK5fmPmb16Fy@2UdA62A(DLmjV|{{BOXj93BOxFzzj>4_Q^GT<>1xcMPyc#?1w$kSFl$4crSIz2fN$tavhj70(D@kBplQtjaA9 zSe4bCz^ZK&0;{qr1J0Ile+aC~Y7MX|pND`|`8)=!%I6ti3T+NN=L7!={>tV*0;{^d z0PK7`h@x46fybG1%hU&VVbdnz>=iQ$=V*%7Ma5O3;dH~2ej_%iq`n&L z^qE|zuLzYHn1F=2M{{Ok76~UDT)d#dDu*>%emm!ze<{jNiduCv@hbo7q4OQu?<%Mc#c83OpO`&w&oF$oqXJTCR z8yFr|SxYZ$c-UkY6nul^LX@;*lz+&_pi36Y&q2ei#ILRm)$hy{vzIP@X@t|&Y*;>Y zaK=nud3l-66*j9vX-V;-vhtZ?!rjG_4X>>wjBb-3RnJ^1W`A8IvrrThzdC7m)r`7~ z5H?$~#V;thL>FV#3ri*&>P$?Tz}5<3KY&(s7)CWLB^n9mBV2+lR7)#n6@X+f@+t42 zNrTYO4$8b~IMOk{lMZ+d>+Ch8lh<&50UYSdnMaksqOwH`X8M*aUeLUNVe)k66m@ zu=K}Ch~lfUlwTCy&!#|w<%dVM0N-2--*JSE!l6X*&9?BRX?z^>Q1;CP*7M8Xm$X}n z;=2vqWA{FL+2~k`1r1xVYK6BG*F$7zdaQPf&+LM z^mM*D@G(Bi4?_?Ez8)4n{(hCO+MyNXyWGO}l*Y$l31#0zG#=f)`EZ0QzZ~f4_U+K} ztAA@e(89;xzxw5`^3FZVbiQL6A4ltzeYfM{)9q`5LviT&od7+Z@4S{@mXG4Q-op1B z_~g(4=>pvSEPPH3HmUjmb%2k1VC_a+ue9wc=i*O~>qx=Jh&X=O`@fEz{ zI|i)teF463?e8}hzVYBw?T>w);(OM@cL99iuHUCEe6uwBIIO4mes9Td8m_Bw<@XNs z^!%>Y_-@qrUa;^D2cH+=O2|RkVc~1i_=X}}+1C#Ms)6T-QQD`_?$_>{&WJu6<@i`uU*8#`)sre zK65Bhe2Xmk9RfbyyVzbP;!u1qgNV@;AIGS36`9ndlk1f+j+YKdR3Gy_D*0~1q4;Wn zb-qMASDb^N5@p{8c<6lP;9D>4`<@JAyO;zkaFAoRx z$afFyAs@%lC{5tY?rviKXBdy)SkgU%hrXv6AVsCiciqHZ>3;#~wxaBr?o=EMW4b&T zU6peU9{Se9twiy`yb!*Zar5IdIr%tCPw|aMz3Y6vFejw~;Yt+W80ZmuWx&G&gXJ6S?O_(f^Oe4UFe;$=xysl?_G=DFS^j<+yy<| z-CgL#S@eF@g`N`yqVu&wFWm1VemSp~a}6Fc#-lt~Z$2EVoVQ!@!8LQ1BU}mfD9zB* z`Hq9{dH9oW4i3fl0os~w-~HfYx=Iw^AEBr7txpTuR|sXrmjp~cbq{(KdaUZye?^<E^bfSD z!Uci$#I|y&Hg(gm!9%`jo0^5|hoail0Hi()`+r4MC0E5&VJR7eRs7l92dLuH;C?_N zlJ5RXFs$Ni5DPv0J0`;`G(8o@bHy3NLA+sYM#BEfOY&A^4e(VaB~~q7j8!)xuxD5# zw){xKwp|HB;B>{0f;PZ#qd)hX1 zs~(9_?tXRloL1vt(l*9#&um`bh`nj-?yDY;oO_M!arb}LB)t@Hxu1PJQo3^e zt#ym5y7ioryS}wo$xiHjlzP?f#W?pW%A$>Lx=uNbmc{Lv3DvG!u*=TtL+!4g8~)7P z;#PO`{?iOycjb6}Rg`hm(Q=J~)F zqi0_atX{DxbpqD3>2?1$`z_8>4kP~>XX9&${>%n{Ym#An*kV7h+}PD-?#+ah>XPzD z_D+5+HEsHV>kVOL!c7q^ZGPYG#2Hb&&-EH`i*r+|n}lgt;K%{XU1&EpHw^M;-eUJ4 z(;ely$~c{u@Rw+J@lC1roEwayCH4cE zMq1+9hwM3njkM`&d)N=$VzgsZ84t3)<_4qjwH~I)9UU;)HOXRfbX@XlebN$PN93B5 z9qz>T%$CKew(19Jql}_@SI_D2-qexa9b0?Eu6@y-Gm5MH^qRlYu`LqDCG6=goTg)> z=17mozsK!fUS;!Vu5=veZ*;B@Q9}Ku3@n;6;W(}BwGNZZ1WN0^#udoHzKD~TpUy(@ zx}0VxHlpG#Z|CWUx_;3>I}kO^b)H(E781mwI6BtN6fy+7oWIt zSNpFBFMn}S^se?N09%s&I;>yyy4Dvmj_i#wdU_527VpliJ-_(8yHW8IPvt~o;|FBh##x`!y1EU(-oW0foV#6O^NKwYh==?jd#aXXiZBFz0fyX!- zJmmg+C+%k)Uvoj8mC>C@;F}(4S%^zZewYtDvfPlaJ6yVMYr5`m=~_rGm2Mj{loH4< zz&;1^>pII?LH5?#kGv8K4JIuLMP@lg?C^zMckE}KUvoD_X4%4HO&WcDlikTz}+~$~&1=w8KvT=`p$D>)B{XP9_UvgDNByWGG_qiFd2|cmJ zomrQ+MJEjDUc3>F`Zh9ebMA8;Uwj%nMKK%E31y-)bgoG@RxF;Lv@N1I3r4>gjkwG6 zwngs4{(#WKRpK(5??~M^!Im)EJ}J`uUM%<(b|-0N|Z6wbJ)31(x7&q6#_LH_%$3ASEQ?U}C+N7uleJDZY_aC&6UmFP?3 zd%3fO5BIuDF%xf=(mhMKO6Y#n;{HUYw*c|t442qnLf7ZqQzeYg^<|aNeZ=DCoKPhU z=X_%&bl+_Wf6C&1(qf;}l0M(vDIwn;i<@H)N*MmBboT>}Gp-3)W0~O^y(sSn>A`ut zamKY`ey+}UzlGm!aZl3-$$yU}Jk#Pvl?R0SY`!+x%*6XH`P)a>Dw`uuHre#p;%xAs znnz-eeWVi0%LT6sgwAN3he(`<^KglaapwCN^86dlUgE3q4>BGH_o<-d;!t~cOeL1h zeLC?K_y@TQhmDOHG7E=Iz88!Ijz`{^KaMpL(>%VHAZA{hBxcrjNX&e{ATi7{PDt#< z`7aV@w$B-8Fv)$vl7$hUr0=w_exw0{6~pd z-d{@0dT^pWk%#&NBqmR$=08H>0{DMVV%mA9#I%#5_A}wThj{*j^ua;w6fWpoX9Buy zc)v@D!eR5^AB6R4OA=6AU$$fu$J1X9^1Fc5x1yq*V6q1JXb1ht$1)-&-$aRHaL$*Q zd=wiEgmkhe#q<~U^ffW#+t@KcI@v=-h_DAZU=MJ>9$=~odjJCV00->pFK9a3!^}Y# zU+oVg?7_QbN+)~dt&5jgJTUFS>r8=Z568pkPrlnFCf^+r2ken$F3N|EAHsLk@ld88 zxrmk6(o7`uWnV-c)h7s>C6BN<-PGqbtlE#TnFR@9Q-}v9-&Bdo_d|)vS0l0DF*(ygDd_=<^OU(4Ykl2HBn7wIA3m1q<-zE22 zroHI_obRVkn`0Pe4&o52mxYPhIaJIUWJKRZBX$lALUIf|wJCKfSGGFi(zR4<8e3Stv{bZ+1*J4u>@{PV_O7WHAaVmBA%V10#nu)efy zVmg(D7G|Aq%Tf>Ff(;>VQKun3SQ@f$*pQip3&qNx$|&iJX3zCNmG2zie2jzyoV48B zriqO;;7$9(c#EXre-wY-SJzCgTBgz>OJ`p}67)uX2VovA>a^T98|M`Z#5p+a zl?75ddtO12b*^hjK*$7F_8#9z&f@-$zksCRett7MYANV)h1`Vy#Jq1)*x%`*qFf0j ztDbx`6zWRvJ&Rs8LfKa;QF?!X9-)iBasxv_nL*TLgV94LdCZUnbq?<9(?kV zP%tXKS||~Fg)hb?wfs_F@h!3N6@ZVw$CW6)g%-Y3;F|>{=2u;dY}bj1!04b6azB2* zq)5z@;_CrG?4>8fi$*dZXYzS)FpPY50G+P^e0<-egnE>(9ie>Bfp0nd$(M{n@uf+= z!SJJOkHUKz6N>+&=JAOnOS1rqb5^pa3-nmNW+=;@-u#z0RW17?3up?wsk z_a*WH)qp$)zFF{NIHur;eDL}#4NfWWP%b$JJVZ?_xb(b&Y+kSs^Inr`j793^7_b@v z7JE|QJ+9xLP;4~C`I}DRJ@vX(+%ghKjSnDB_e%GOwIjN1?C7ZRH>6^akh_Rfv~_e; zv|@}&?1hr>fUVA+Kf>mJ2vN7jCESDG@b0KJ2H&2iBZgs6pZ3T&NOZiBgjWFP7I$>` zH<__c7%S{0BWDbpaLtHlrXj)+2Wf1uV;_~{hCeF7Z}^8}%#kmlbzbh|fbp)cBUjp! zIy&;pjf@9935nqMM<)0?^84EUW`ivv;@!~+h5z(Np11kOCq&truEIc!Qw}_l6VYYn z!RL>y67lRx>FdZq(q^8JuE^KR=Gk~1c5E>?xRZ(9S(2`7Op4FXH*(i{@>`sKXF{

        zS3Hnam$!EJKv6E~j^5|;pLO|H!9ctU^0j2PCmqi^9eX}c8aQ$80W9J+*N-t1RIoqF zef6fqTins-d!Fu&TrC#)LZqzYVw?a22sXd3F3N4+U{Ba>G`ai(f@xxOQl#1BTJtG# ztLjpe`4*JNfK} zV)w@SRV9l{lIm8~$JTAEx0$6bGZd&8>=9C#6jz%R+n5xyb#c9~D$k!)mFdr`O7i=v zV*O^;wso#DVYjR=)|uf5baBF|{tbK2*oStsKk2&nldi2z>eZOk8)M+ne#cQ%-S9|O z;GepGob_(rLEnV7t&3-@s^3_$W%o{0BO6D;!04j6lUXNiaHZxY4D9B2B=}wasG{X_ z{5||pb&G3#G4&Yr?WoxtvjvYSyFIwJwneqCI=r~0dp%NHB?eg5^f1yd zLrY#<>5D;5KSM6x^B+Zy-$RZ+tBS2miZNTMqooaVds})4O^oX{bW~KwfV-y21A7Ae z>e^A)6u(U!KRI8B*HWA4TQ=D1qQILl!k*x?H#rja*iKg`{MgnKUG)9Lx^6{RC$#ivO628x>T=N` z2pgWc`m{K!{2e#yq7tf%rbN-EwSL1)1Nl5}_*?L=DGrlTIDJI+J%Yt-6@m+HaVfE| z5;0L@A+~QVDe&a-g_c$R1?zSG5zkFZ!i_DdFrGV)4e?GLl+NpK@`)`dj*ur(^65`7 zbbErzK#q_n2)fl>(^SLQr$t}gwN)6lLGCek*IEw9hQBVFuSEp(Nvo1Iw=^KU-oP-u!d@6(zK%!QyVWxc_2t zGpvVkwEY$YQ)QO=kHcxhO@O3GhFD)_oH|e z7VAplB)$Pt>rLiJf9g}z*pblZKM2E=Kl88N9}68Bk!@M6JvmEaUg@P0Q|%dv$#G0# zmWOU9ABokNLx#i*pC@s^P7gdF$vEO!co1QyM?mp=z{Wrb)3EgsQ1m9Y6ce*2vGp~v zhnN=}gu%A{0*cjq)%usBE^txPo@^ZSXCCKE%zTwe%rq+{W|gg#m}yo^?7{g3iD~<< zB@UDi_-V@^`ZFO2dnaPrApBYR5aAC@e^D>|p$`%M!1TWv2gf3q7Hv{%aIzmDrVho1 z-)j^$uaGeZRtSW8woC!dGM7J)Xrg+5-!~(3@QsNnVc*!!n~5z@N{YJLt{p2?sBpfL z47{krCJr-kEWxRC$r7n!F2NFf52xPh1xPf7PA@T4LYhwKOVD}zlzpKV9EKvGp(R~v znre-0CC9r^ZdHOez<7UM=9@oAqX>kB&0AoYAWY0an0jHaeVwl*AYN9pK(UI28j1+R zW>K?dLAr@Zj4sA==9$R{$2?5EzzP;i zu))oo;z4*#Kfh2fE>;wVDzGrcMNFWD7g^{8&Dx@2&4by2&BSJF9KWIsT~}+Dx>izA zmEVZ63r#Db7@z5~d_zWWf)&n2CCU%Wrtr;Dm{F1cyI~IF1Ke=rBapbcd>1zqhs(Ur z@V|O&*6-H%+pM)NG_ukghhhe((9 zW#i!E4#Sv_e@7hVl3??3jB<(MCo<6w3nB)e5mJW#`_2n^nAp_F;S7> ztoYssAoj|zb}b+JI0qk{b-r0}C=Nzdm~C9=JEPgh`ePXFW82pG3gF-~s1n6T9i8vI z#;1>StcRY?w;GOc?U~QuIv;l6474jgmn-|`S@<3U-+#bQiL$Q<9y%Y_L>v#lY#gdA znBO^;`sG|j`YTaeNmBL?%;=9ShR|>uqD3LE2hvMVB zGo9}|_!I{@6&?aTVlO=*4{P?Nz|An)cddnw>pBdFzY@iFwS})i<72;|_NI#j)6EB#{62> zVaP@R-%Ti?9%U91)zh7hfG9Ia{8xJ8EPAsL5U%`2LyvL1l4CXOW4q7B!QX}qqka7> ze02y2m+oa2y$0xoOPBo>X+0ycCU39leGVTj-T%29 zY7~PE=0A>y2A#>kVADoS zGgaB(0IA4E{$MdyBC--{doVvD7r{(@JGto0aswZXAgm7)Y5#H2*-ABc7f{qE$8WQ2 zC3!QlCS=}bpPiK2*f!m5Pn)z#eh-%HyV89P#^>NZ6=h&7c`3hCgvTiNDudtpB0!9A zZgoBLQY;<(z&A;J6wESOku=yBU)k2H($}N0ZBnKn+86OA$DQ7ce!cPf(LR1BSLwSN zQ7iM(S|4m3*#Z;ZYMTlVC?Q6|K-(z{U0x=V3a~dOU0LEQ;b`?fXL}}wg7eOEWH;gO z#!g(uVl+|Mm(FkLgi(lLa^{yA3AdWxpQ#py`bU_U3UFi~zU73Q-(kDwZHsy-&bF=F z+BkfG-H_^0`fNL*SXq8Py!u}dq2k{ieaA~&TBi3o;e#<<*GcDT`5hVdxjMJ(1rCav z^9slzt|Oc=&O0M%Lgt9r!AWtGlVV3F#VE?H&SyZ$I3-!gGUqI?43Ed2PCB27Oq*kT zf=jk{+7vq@srcyhHbwHx!&k4!T)_epv0cYw&pJeriCF-&mjo1__os7{0P7>wsdKVTM+ z6W^ekU#p@4b#$z)qx%6c9+@NLfVUS~82s=;-LU&iJKy?a>x`58D#ent2|2{5RWM83A5<5IftLuHaDPx;9O4aA z(5LhK1pSvC-&bB~aE~iW3=X@Pc_*CWANLC_km39dVi#Wo>f!vw78D15soX3dM)^!` z5BcT7^!TPCC=R@7_=7Bh@4(w0@}`mco}e-izjfuhq?DmJI)95RA4G))_4^sSq&*x< zw1>R0V>o|V2gQM3#wC(J7T$L8OIZ(33p#)t_@&C1`KKL>u5 zw8}=#Iga+guM`z-K0%u<@((lC$R@ydGIqFiao`v36S98z+s_{IiO#c*# z$&;$#G!3&%7?<|)&Y<|27lqkF6Eojli5Z?PG0SGW#G`TMbwz!ajmV>{FHyF#?3ph$ zCyP_C)SN8ZL(DQ5DzOJ=-bLuoJo23wG4n?oh{?yEmzd?jUXqw)MzNs{Fdbo!#G=fB zC%|8nIWW^97xe|7#I%KJ)8B)$D05(P(yjby6EVwJl)1!oD}UyZn6`^DmpY=%B^G54 z%)EM~KI1VCG3lfKS-XoA?dO#a5=^2{h9rdq^7T-PvX2b+C_bD&m}R`yf$IOAx3>?9EC4%*3yUf z2*{@i)|d+k-T`N}^rtK-A?`ZEF9oLzCJq{bgFNMF3-ZJvCB$8C_=&i@X@gjn8Q>{D zTJrI9H^2iVY{En&>9TG!j$UGTGEN2oKtpkmkL$2ecni0xlLFIc_zQi&$K_F>{0I{G z;Cbx}`D+Y$)~yWiart`50^H#|dFD!Y=lM-wq+dVh@ zGZuU~ zKt3FLE;-pZm}2lEt?33Y(wb@TDlOWtUs`OqKt3G*6U@Pg*AJ5oIp}{||DnJXX$6Qb z@Aa%uAYq?d3|^E`k-__L(r+_(nqI%%;IqjuHux1OgHwlkuO9WqtZT=OpK#-(sd+ce zzBzwR;k*T3Ub0dxe4%DgauTH2J55dAxQ7qtTz#ci&}3O+nlZ?C{brq91&oSXbm$Jk2Od|GYZcd zDkHL%a7O7sSv0DsH8df6)M<;P1!`F zBWJ?*$syqcPwJcCVbn0`WzLmx=V8^86XXq3nCHePq-_pJye9gEn9I%-XilBp|E>A= zhIVp-eZr;JKP0aAK;pE}XU)^^HyK~4ZCKJ+IEiM%M;hgQ>+cw$VwI!*fxK$s_h|D? zFCl=MC3wg+ed3d72ADS<-$YVr31RUyi80|^-nK2x`sb0gTqmCeE6jaa%+H&)l)F;8 z5c?m_l`lYtkIyZNPU1Q7u0hI$KAdFl$C*5aQ3S~@v2+>zZ8|;$o>k5lm+F)I2y*N< z2V~eTbY}Tzz;vh&!{~m)f_EqU7T{1sInpT$UIcin;7>e0rzpHJ$Q$*u;UG2PSVTsW z!uulR$OokVS>T-mPdxVX6<(D^Kgwj|P^9p_X3_67#tKw^X>Nsgw*`;uqAXQlQjX3g z7QEj8uLAzmkI$zH?}rjk<#!A4XhTIxzo#sC_uzT#QwR}{&man~6}-88Uw~sE`+ZNw z3E)gxiiZovC7yY%{2sW?cpM|X1V2Sezg_SkA5Z~!Ajv>P;vwsC{m!C-Cg7nmDGWwc z{I4Nr#>>Dnrz#IV2QiH9*DQFMz(ZAtlfvU3ux31;36GDn3h%2Hylmi^hGv8u!6(5E z=6uY(Ou7>xXHItl665n3?ZUH4cen-bPT%8_1!zgfR+CjCYsT;Xw@Uo+lgaLdPBfurz#Y{B~`@Ww!b`f*4=;bmFy_-=b3 z{YG2xo;K;{GvT=`cxU0Bif~0rKaS^<56FNXlYUw7Q~DjWl!p%i1L^mKr9A#<(r=6j z?_mob*BqKGb>NBVk~qhoe1Hy+!`o-Sv2^309;+<*U4;OJf#5j*6-$1zfyekPk8CMN zcfJL04ZwKaDpJ_9EO=8)c-KLga>TRl$y#%qFmApJVv&o~NiiwTd{9mAMk?xk$TYlRzC zAx@MdHGm->paT>!;Z1^@VZ_^wo0u8zI06RJuL5#rye1PK`v3}Wg9Wb#0lXd+QI53Q zg4b!nn}%?O*I;QU&mv$T{rncWbCC0kl#CyhZmBIXzkKIKJ1A0e8z4tMAOl{9ew4c( z2Z#F@M)x8Mo)36F_$yL){C2^N_ZINRK!|v3e-$3rqA-_7K-M!Wo)dD66Hoyd6ju7N zy;OMrWx3ww0*~ddh;pRgTdp^c2`_+fh1Ue-%=&RpMTJ2e#eWAv6hF^${q6;xs(&2%r5xSUEqL!-M!!iGyvIy<>{lwhd6w(^ZuUzRsr*i{$mPI2LjP>)#`gyOsiyl-y4tM?N6^kDJP4Is6#Lbl(P;8Si=E zv7RbYcw9fBIk;~{;2|30I z;2>=?;jMw2VJwdj7&G2p;K4L;q8#ZSFysStfWB$MTL(A8h<8@z*9M-{3Ox2l6e+x4 zTk`t^@E(E?%VPr$g;yw_yVX7DH1KXzU^r8E9{fg(XO%AZvK=Vh2Q2AkUwK+~a{~MQW~}a;q@bBlEX!&mdji z2bnHO$<0SP%Et63-XfU>?a2J5;t&I@lj5JgU2zT3DY>72AITRuPyu4UlusX5LA$DV z=`H!LeHKBYj5mk+Oz8 zwfpv9no5#3JJ~x_Z=DmprXaL3+*GxrbC4fqGrpBOxVRxy5c+CCXhlKjo|f3Au4daF zeglPQ5gWGH%e1*>X_543R^5?rWQCiz)a?oPXt(uv7DB4sb|fEi!DL&+77l&2-oK(T zQfmu0@2cC=)uSQpc3UR}yfe98D*SoO^@W6JHdn)$5O>~Hr>yg8C&mpi2 zfx;HIjsYNI8QDBxoW0HTEw^I){BjxfQ&9`PX_PxVLbBMBP?(vN~ z5T(GM=6&Xi%MKg*)^f?$-N{R1d1t)8^NDz<;wcf7024O&G+`a`*^&1VmXEl#dpt?u z&@j}Q+A=yr_zC0d#1_OV?$O$@x-5{f@t?cPKP*xPKKT0)BDAGP6C3sgldo28VX2ND ztp}x%LDA*IBh5K5!#;1T9v7lQW})O^Fn)pna%~p4kgno(#Fj!oA|FlLkRN&f*=(=j z)$YazNhu7tE;VIcu=yWG-FBE zl*m&JzhhxwLEf~;K5vii85B8L*N%;Ak2chGbfn-^KVRD$%}(8u5Q*x0a6&87uQ|No% z$ufQU(t8=Sb+@YC8Hg zq%k;jY1C};e31j1fJ4oB%OTGfG9dO#bOM9&aOkqX!f_y7K2!$C%LmaS@>CSG0Eb#n z(Fb15wheK|`AnEkh(0+-b>w$= zieD&s>T8`^x4LA@hPCB#tDE?n_deg1+-ZvMt>a;#t@q^`dr;knr5)8ekm{|rjF~V; zP3$4WIcteKFiBA?Iyd09Ocun%H5CCVmtX9gVWA=zj}x3WR&sx6Tgm3juX?z8Ywn~3 zIm;S{3Q=k*_f%58+?ELWyzDMZaYJnj{m&LRR0+xC`|r$T@rm0$VHHA!B1&Pv5S2ai z+zV!oZeyN~W#WRc+m>P#s%EjMlw<)=KzWJv{1|P3HT_sCKNmfS`i-g_ryR7Q--e$e zTo!`Z7Lk|DvwZe5!uZSUl5_{+TICiQLE=}*-3~eO0U5Rm7jr9kHqX?DVZ5fNTJRo% zpZWVWg_mQ&OTshdwxsa>6}%bm z8Q`&>ph)4p4i7V41aq}jegPfF`!aaq<=`NVhr!nvtoUUZkJ0$yS<%C)V5El%y92)_2!X^gY|G~->||J#}%gLeEz*j7RdXtQ6AZtm#%By zecc!ns5;p=yPHJjBqHs-aoyy`Kg9G z>-~9+Md79w6@AhUAq`B3F4w|`zFX7ynvj{HWV&Kg@Ni_Ldfi`JVpGCR$HjA()PKIQ zVvUGoj34yb%u0&Ai>}NDcl5qJWh4QDh!O^(f?}kf5G5)Cr@;G-5*58VGEOR zDBq9AO#hUzMK;&J^hR#2_fM_4+E(~#FVrxe*t+~vJN(ly&?68HzZQSaDgWem{gcl7 z3&Q^V+L*{nxJRo!Yz$IBtaDG#K3E^aCM`~a!LD)`r3GV5`LFk2({$t%cE=MYtkv-wyPFn9YO*LQv#n$aT%RlNJT<5BOHiQ8_EvF^%N_HXxcz^7JI;yb$41eIs(B1f>@?3oA$?h>WN}FvcKCoI4C4+cr*qHd%Y|tS zPehc1U*b~0x-^lK(O3hPU4bcbjlDqnZ-1gLCtWet^R#BYvY9I%?M6MES{o|%Pif_L z^+;|-GS0OeZxCY<4tUA&pJn@sLbF}oIq7~>|Dswy<@Ss(Yj=0%_bh(LhSgFgCNGKQ z6vws%!>Jvy3GMD4zlbe8CtU>wpiVK?Ffo~e=LgToMO}x5uq}j&-Qt-C%Wvt3aSUzg zz7x*cG~h&Qdtk#&~ zLNnJ@7gc{WSa*6fpKnpYZF37J`LgdQ%Fi7?)3^2Bk}X@-u1Us?=5O$rz9``y7$4RX zRm+~xiA*TzKDNo?wmuWT zA>;BydG4jAi0*$h-7M*T*%H3Q63+gFBFdY@1^!oL;Ch@n#!zSypgg)qaiY5`?lSbN zv!wT^wC8I0b4*~1C47(t|0@>vcP;XtNcT9T%RNqpSi;pF9#o6^sWnlQ`*92Y)fRV_ z1Q*#Yvwt;PYe$rAv? z=RGwJAo{+Tr%B>-xOy(0MV^U(0yxxj@m%s={D6vZsOREE?EDlaeRYZzPYC_669KahbmNq!7?juTNn8$9QUkY~Od zB%cHRN0O%vUXna*@F&UB2Do5F+yK}wNS-zbNWKXCV#zN6{}sv89wc3k2~a;ZCcylw zF#+aZjRi6P`e^)sSe$$wCw&nId19z>17h4F{fV($^28{XJnc_X_-siyXGxJxV35$w zCs<=V#BcCIw=9Dfx?N-NEE`o%M17;dLBnuxFBcNCL7qAgf;`jtlH}w1!=LFqEd7~I ztK^wZDa!&fOozm40j<7qja)0d#B*B)!9jf9ATRQc0fg0C`abWI&#f2;;75O-@%bJe z1B?xHC#~F28e09Cdv07_w%qlWIye&v1JH*M;- zAB2)rI#>ov%m8uJ%_VEZNRm_q*w`#$pe-Tdu{o52?>O(Rr^y3NhakSAAdhB5&=h%AC)G}J&19?Gok|F2C07GE@&OsP z0PW3j@LXen$uo@Y8~2ko<3-@dK8qrSx50wvK_ixgh{Q9G?<|4ajK{U0*hVT+cnjfS z){lEq@m@we^Y{+$C1yMa^k5%Nk-{4T4>R5(;1$7-cx-PO#{8axK4!d4GG7Q1r11U# zIWt}qc#Kaxc5f8k&n$RbfX63!-R;&flRJ~4DonRR(Q?e&3Jhzd{nJCDZIzvLp~rw z)&P(7fOzafD!jh~Z^jD%&;0bD@G51T0M4XcCOqEL72ZLaUp4>g4&YrYVi-S6i^m`3 zImhtUIL~*Dzu^=l9b#k=!dEhC*twhfZ-@Ykq`DY zw%ofVRK9g>e5CJ+YiCcz>e)WhmDkRGA=gOWXk)T*-6`!1|Hc>Om><^6HhlX3VqMi0 zHjk?$tt*x>YcK{E@X*YaO2rV|Pcf~<8C~31(G_!?iY4vAYa%{U$HyiRr_WEscu~fP z?7*}bu3y{AC7KcAShDwLoHx{N3~dB$pGMNwWqvW@h-NgD)necw(~$FI){I!@@l+2p z2FP~(Cze!Qm%Tbsu2u(P_?1hZ$~L4yKeNk77-u@0AUzF!!V9@nO8-e;Kwet1vhAsVZlsoqT3jkP-UgbbeI;# zxJqr9mo#fI20}51!2XWYC>L7U6+PS-nJ%piAo~MG;FTiSGlLMtP-0b zW7FPTY-Q|^?869FvoV6@c-#G+`=VRSZh=zX5uC*&U~63ofUkT^Zv(Ct`vEufgKKwS z?uXmJ6VoVy*ZoyN!63q>!3&?n+4-MDT+=gcWte9r^UwTpZFio;{YbTZ@a9j0zZjup5D$4{rHsvuCVQO7n0JPE*~xIvl-hhDgn`uh zo+%Bv^*w=xPAqIr~UiN6&&I%^fckE?0e81~Pr_h;8Mg#5HQ zrkU8Z;CyH6na=mgwK-Z3cgDyiJ6iX3Hj~?EZ!PQGL+%w@>*CH3x$CeOIC4|#Z_Phu zi*PXUU|MUgWFu)$MQzpBXt#YYGBgNbs;UvuMx+I$Vo3i}5@E4nVkF2YyzuwSiydVjC+LrnC%31|9;OUw!JS+W~OZ-n&4=O|8ThSwTal< zJRF-~yx{TSDvfD0(CM=GoEKfSY(xCLz38qy^*vkl7>3j|+Nw8^nV4KN!q#14+#*B0 zy?LR(RLupHos!imWhAKa@1vEE1;RB%l} zGmdm;CVQ?kbW2F}{GfiRvg>2>%s9|#E1ZU;tEXzMClOPY-Uk2DH19@df?=*h>vb$y zm^FBv-E0iemMXwJN4pKJY3s?;izS|6<~p>1!pzyZ=+d3!dq6`|ZzFVPJ4X}6>zZMK zieFjt?-_Es?BWoS|7hC8V=>9`5)euSH^A47F@VZY5 z|D%`2?fLoTpmz^~;Kbw|^|tO?dRs%mcmG0kS)uV6kgCdfyY}v1kcZY#_v_~ComW(q zsjp$W!VDJIc$JKRzO&KILy|Lc=l`fB=IM&1q8BY}8r-Ny@}s$RmBO3XmuNZAMJ#^v zrxWpNIkFgg1%z;a`4n$v5tH{Rh&b>vFnCLPM@;j0a#@|<_Ppo0=)o-t{x7B)qDtuf-K)Ny>KSw(s&8DYq+H+cU78!0+VQBZyQvql zg&&#A{Bq?T?{l)u5BIg(DEHlHJ;pB{pFci#hMxtW)D_E|H8>x-IMAumBcZ6jZietS zUNS>P+@7-D4X_sMFu_(k`fdkgq+xGj*_~$>Org`Xyrdjc*J9 zTU+a|KlI({nMDT1sivl5_68j=QT@P($-(8Hio}nIP`Ud=@B%6-c~JwSy7wrrS{Ra7 zEj02^&s?X_nvdCM4+7f4NUw3>a*3J zG_F&x*k>x;g~{GAwy0j1p`nlO@8K;I$?i_}esmr>2^|)?t9yE*dSp=a>INfSs7^4) zINSgnya5pe${DW@Eoc%@fk(_ej%pbliNCLPNbD zI%>->5h64`w=$oFvY;!r2$v6RhO6OCTSXZ@aj5qXtwXUOC~(S{Yr>KdRhi<#;^_1> z8dsH{*9X29X^90e38G8g<-H>~48ci6X*CVIJN)U*82)?Auu1S0*Li=&yZ)gi%_TbK zoOt*RQcvjgVk9FjkDB_ah&=k->BBuSL!pM|+I=N^(3_Bt(JI#2kmw&7vC>}-X6apG zRtg@QT&MHj6V=z~BC2OxWjCJLH#ED2-vIUbyVB;U&)!FzyV3f|>wEs3lsm&18)$XJ zy*%7{s-0sJ74=k-Fh=7AIT3J%LP#A^iXOoq~3z7gLD^bz+Ix+wLB;i2Dntx3A?6z*%a+mSEQG2tGqJtEyZh1+ig%3nK1^&gb> zxek6d4Ns^hvL~#d!Tf$vv&-}r2>GcdX@*&YtiE zI^9-%CtKvL`c2oyy81*?!G0?3LtnbTWeIPygzvP34>nZ^#{VUOKx1HU&Xy{_rp0~AqA%A~P(=A(S;D`l0&!-zDLLW3$)eB8mh`T& zxPNPrUt+OOzD1uOTjGzl$hTVX{>h^M1e3zlpWh)UqI-d?uk@q4#DdRvtBQoYCB2_m z+>coBKedE^Q|iOLwbQk$HLeGyi1_0y?&&HJXNKQk(eG6Y{vR#*=RAK!jQ@$nzV#No zn=S5NN`1eMb2?V0|FT6tV(Vj!6qvO7eva=-^=l1(rmK%NcrjmToWYCvO4$bQ!%5Ad zBb@qvj=^gF-30Qo3E;Fk&LbnypFGnKNS^6`Me-h;izQE8N+nNS>LgEH8YQ2BbBD?Q zCCU46eqZv`%L$t>UE-%mo^i$ZVeqG3YOb6#k*3Qgi~8vl0ExUvyN`yOYdJ74G!uEs z@;xtkrX}WWNf|if_7|8F=_9Yz8w{R0={FiY-@RsVq5z1+L!M~~TY)FWz0#j)bxWRh zJ1KeMosm4_lJp$oOt&tZUB*{+L+F6!ek1H8>VSN4E$V=5mVK0;f*(*e4qZ0SG?PA! zzQ#8+y1Xdz;MVyAnuSB3Ay`od^qB@fm;N^yd=YsHf)?P=XA4%Wcd65;pgVEsHw#vL zf2#)!o|jDq-gOg?@9oJi#hLS2$lrsrC@=7&LLBs`J=RK|Nta7Lfb)6DQ?JRaKai(h z_eq{*Q73uYl56TvhGp?H$em=N^H1J~GxM*{!4HT!(VxXfoyf1inL3f*i8FN~zaMAnME+@2odpY`9rarUYt$3jF0mfy1OTnVq2`&cAurp&4dhu_K$~#r z%mio)4mF>58+rLXYX$jv_yO5*WN_jOh@Zidr_Fe&lMmp`YE7PMd|C1fa9%BW=A%^d z%tx){lW_i~bWehkjXB)<#iF3Gcwy(IaiIRA^} zX*14)r_RKGSMsZHwzF=-pY|IpdD?HB56Mj;{00r6X&AjS#DEo1`hofN}gp{DtXF?>kBx{JNqF_mu34M z$>)IQe0cg#0sp+@SAjn*d18Jj`8@EPFHiYd;C-kZ#pb(nQI#zRi`q z2j@kSr!K{kr!Icl84NKtNS2H(%wBZjVPhFmqJZ;r2dCGqxdFmyuBjEVJr!(&oGfVQ+m;Gk? z({9rxPkYXlJoB+k^2A>$`6=MV{YzrPd3k$Md62N7Y#W8$WZURNm}(n^4W(_VhiV(C zpXw7*C)Iw6do*t>AU?ZhfTun4CC{W6NuIF6o{*s~yQDvD7?wQsdPMTfZ=2+OIG-}{ zzm+`oy(oF=#W|$Zf%@i2p81$(@~3_Y*XH%`08u}EiC_&|U4woE;!!_+lHo7xc89?W z``l^p!X|QZo)2Cb5M(;DBu_isBYB*R`vPQ`=Ka#2`F%+8w2!!7K!)izOMf_xH4?xu z??00MKAhi>JoWmuF6qy7R!JTwqwfcQ=5M?7Xa06dp81PNo_21KJn^5DJn_3EPyF9Wp7!{?Ce21J}3NVfe)DEmq^|R|D}?rxzvq@?i|U}hVf4dxbei6&G^b- zrP!vTxa7W2dEaLzrCUla>%V$4zfVd0OvSVd6;`AWpQ`jNT7m5%`1Jy0wiovWsTCCl z4z+xUvQo@`UAc98@qie86Z9`5DBxsD*jZyhkbc1m)s#6S11do5ud)GKj;u@o99Z}M zIae@9*vMX=$iNUtWmCy&vHh2^W`(k0KO~c+3Zt@e|FH7V4$Fck%;Ng;Ei3V{%BB*0 z>eD|`+$;W_3P0gda;z`-mIgc546t5`0ls-VgH79dZCP7t@whk9P0)lG^pIP~B&56v z-}5AXCZZ}_s614<)$%n*UxhP=sv5F=>sr=SbC9w!A|`~Y%rhg#MYMh0y2OpV%tb4< zcgtJ3{XV&g*4i~(m!-dQ@w)Jt5tP1G>HjA9K;i>K=YAe-%|iWQwys@m7BJbhFBfr{ zxOMN9%it&v^|8^~)vU6jB{F@*#X3@4vW?pbsR*oprQ0{f-SHX>Iqa`ja^Dp`_lnB{ zI}XBhSmWtuT0kZ)d*9~!cCIboYzkM|9Z*E+8V?j7iuG$lQJ?w(6riloGE5;UGhNnO zt#D%?Uiq6e14`?$Gu%ciy4`j*L&+HR}dlHkWZuZ(Sq5<*yZ#%(HLGo%Cu zWzckrjRX4ytS@K7liR{)bu^iEY{(S`)7)tHow! zecx~N`w~r=^?%{xGTh!Vt4;JFc&jIQ&^P-r{1l-JB505eeF$(a>1JQWOzbz1PT;W0 zu|K6q$@Rd4d_V>~guZkIcn&GDPs1?wKc2#2##;k7-|;9?crEZS<9!OeXW&OXrwk+B z&)_iQMc`onP?5spddOzHr_uRi|B84t55tJpVZn<6ZxQ?zDZF+IUJvltKP28D914%m zjb{DM!ohSEDLg)Fk`KrL$7rKpOg#3h72b#7&3GEh@vMx)lfrvn@&S5+rU36woQXFW zhr*kT!ZG7<409F26)C(MAV)qR10ult4S3>VC?$?({l2US@%WBdkz%dimu*7-n$LU0 zOT$4qmIt4q%=+y@VX^OWSoHT z#Tb(bZkg~7oyM9N)%`oC!1ICQk1U$YY zS426|7r>AY&;e=!p1OWfb>ev6u;8si<;)W?j30$pZNa;9OrL%*WgKs#1uqIbzOz@P z@YY)JUIpH12+@9i9F${z55V^3{HifW1PM}j^^hYUFub)VuI(8 zB89icf;S2e(aL^+j^q8sg7+92zk$k^`=XfjdmVVIfW!QbGvW1E@LmTV=SV10`u)^` zmjjT;AVfS44N#8uJAt@n`~3nJ_gwfZQg}TOA|H?eubS|#ho8cG(t?+nZj5QlXhM#B zvjuNMwlP*m{U+j2csniaeG?iB>a9rWx82g-KY~oE_T@$hE4<|vydMH@p!Vf13*HZb zHwHM=kI(K3?}9DSey4#q(EaTL$T3a;2kCX-F(1U6j6>o5y9Mto@D?Ck5#>m4TJYWi zUJm?;$KhRt_axdomaiOM)23u#T#z1;$nsb%(}a&^!TNymwJTVxtz;LCi_o?Gq}dwG8D?`x+`pFGJY=*r*MdSDZh zab0HP9g3lyb*`%+)%QCsB)(m7yyMo^jo2iI1JH@Kb?jze+|pbI{`KHkxKM~U7Mb6^s_QwqBv?5%T@ zx?RIKPZ5b;HzF}n&h4FXATQbD!PjtQm}H%)_4xbd7Gkb2l!F@zb*E`alamg`r?ac- z?%26ucXB*ZLDdlD8z9uZ(rA)ZrSW_3Qx%@+PKlmL|9A`&}rwj4m-}6^K|lur!%7Nl%ycELNiL8FS(H z2QNkP>mG`xHAXg8APma6#b-06$@`!D6dtoYC?KI%<6n1Hw{38}*V|_Z)W22->PS~i zejO2fQ#-Bqq#-}DnEI@ErMldQYH+acZd(>DJO~yp3&9@lcU;=o5w=3VW|~$EzlF&g z_AQB}vUoWU+2a;fz0{o#4=j0q!i`U+9hhnDEx_j^6r-8BZNn&!_*Q|_UMD8+@3QSI zH|FEg3Wi@8lafb?dMB*A>*J@gZQaYYo#D3Z(dUFhyaxEO)?$7FmkMp$3ya-Tv0(9sh71yMQkC;qU@z6 za>BPsLTKjMM4_yY_$gFsyGwowC4_$e+eD#Le~Fjid!AB$RwcxC{yITyRrrpb6|UvI z{Higb6_eM%87(}<`?W~b*8Gl`Xb;tF@}Nuaf{$^Xy-jPEqV1%}F;R1kdE;Zv4?^++ zn}!S~)#i4@($T~~9v^GTx}IeV$2?ehQV++{eUalkdzyQD4-1*MZSUDHvgMSQ^Np5! zE}^a0_q5oAQk#)dTABDp69$thy=%wC(9V4@){RJFDwyVD$L0m}xNeM*Y+RQ#p$jxk z(8A9POUyAJa5i;v-~4mSbZQx5n!jzCxo(O&(8TtH__y?*yKag;VCdgsZO6pt>;7vy zvR_VOKaX>_&BV1H%{0(l>|WV{!XpFXr-zNA?ARvhiKV*?# zDrHlU4(BGDk`wqo8O{^qFSW!UYl^_|$E2I@ak-YG-ID$Yi+&$KP7&k(ALYQA?%zv1 zJ`-?l#zU6yJc~ZxvAA!y=*PJ^q0Tq;eg$y2Xq zCC@bf)x^_ {jHOWubwNzI=imRc8)H8Mk%$<30NPED;RDdc54Dr_S2B5WdUC2S%u zM`06L)rC!{42UvneZpyyCpNETwLalW$rJnUCC_+INS@e7B~NUUj`22<&{JMg7|Idr z5YnG=@ihs-U$%T@9z|Yc9z|YczC>OI6H(4T@CjDqN!5)p$y4`k$a!nbA9<+{<8o|`B+3^*Oo!E!{!9l$5Q3-d z1j#d3mu8KAgoh0)J7p)GL?1mrLT|AMXu~Nf5@|2Gd(T6#?(A49SG| z{pvm3XG^Kqp#}h6UJi&6PoYmh!BSfzvY018y!cxtzMxuLv1N1lKwc|Xo4myfMgwNR zm-T%2mGIKt6alXuHYu4Vktz=yZ-d`*A_*TupE$;UkJT8-HzX9GTUs+Pv zv7Z=B@_Epdn2N7nlJZR+&`WlzU0C|(PwaoAg4KnXkV7e~4(dZZ)xMhXmcpO?T}3Kg#v>n)0jq#l0iOQs1}eO7gE!-?frD+jB8B%Y zc$o1{1CQ-G@!T?u`fbNy#@htP0{AIXcw69M#ye-iV;6;C#QQeloAG!b=RHJ`!s9$? zGhPxR-w7e=2k1B+^)ci90uJ`?6)C*+7QA~*c)Tww{WzE1jQ2X+1KIC=_?z{68hFZn zsA6%vUs>=tZ(iPtg^EhQUs&*ZOnAKQEB($uIkSGOOj87s@uTqGvgG$2;O&J7?T1$p zaXh|LG~-PH9-n6vDLj@F`G5@A0;9bOo_OpoD*a9)z8P-i;DifahJ?$Fg&8%Mq@I+rl0xG35{oB=muJCy26(d&PCRxe6<&u0?{(mfLAWA?*KWZ(2RwCs@G(Q-eanLP z7vQZ?U{a3GS_|G>RN_tWr+$7M3hy>Bw4ZtpwbX6AFNK#NhVkHhU!G|*k_Q)&Ib9`} zCd=25!uuif#RgBxk?x0_`8^cdaT4_-DY-e&4_S#5@%Bm^sOu;dq3Xt`UPKvdxEgPo z4Bq&iHf4(NoRl+3id^|U)ThvuWL%fo7-=!In&RbZI8Stwbkuhe ziiga0Tg+DVaN%;#KnB(F)BrzJt7gQAWoiW4I{v1QDQX3Me9TLU<1UJOHTB;K# zw=qoY=&HbNYeVI0Ht#_9+R_V6Tqb{j&bOG6XZWk0pGw*kG;pd=Y2|7$HP4vXH!zI4 z8aV@X0PzH91I^OcR{A6at_f`m#f?NwSFYQB-)b2%Ay8?^V5Q3qkVJ=jTc{Z4%2J;H z8?*y;Nj3u_RypcQjj4VqmS-NaIwai78Bx`XObA)!RG3+AD1_)ApeN{KxOx9&--P-w zjP6S~%y@Zlo3B8H{R#Zdcn;)4;hFoL5ewb|84o8x3hzO<%y_9LJYF6QBmNc~X8jhy zEt`CBh8)lLN#k9nhhIXFm<;8-I#d8Q0$1rBrnfNQ(sU!==$CHDXr`YRH6@ME~DFD#22bMqz{y#aHdz|1H1 z4|1pEO8G1I5AKwOqWT9zkUH+?-nDwzuGKrVs@j}zfi`mT$hjl4Qtk?V{Sxl<2oKw| zdYfL=kXAL`r}_eu3bdR^ez-uVM}kbPuij?U8q!*9_Nq30Z==tM1sM@%d$_=!Q}sc( z!1lT06VcIPb5^yb0j|a7(%RBGZ0@Rm(wlzZ+dI?8x3AP;Nr9uFKwA_+67EGz!nKGh zIs^2v2SlO)rS#vR+oAMz}Nn-s>9Sc8PTp zC^AC0-QqiPy5|UYlJ-M7KsVxGzvQ#;<`tXqt;%QKqSYO0<@RkQn+CW|S$YTCx8Ylu z(5900_u)&J?HG*Aon~kdzc+HA<_aQP`k_plaz&JWBK=V&V-J{w+k1aqAoBTX5kys+ z$5=jG?32{R54U1@=5eL_F53dDoP3Rg5TiZg`9U0JxjW$==zg%uBFFm%>y;waj&jd) zGhPJ*Sl<*Wxj(|gEcY1PtcQw}+{^GV%XPxd`l(3CJqZu9+^2A}-YQaZ*7lpr3loD<)& zS3bOn2HfBi+wW;P(~Jkb&#{k3kt|r%evg;hq3v7n4a~3*>)nbLTC~aDdU|t?iF~~4 z?d`qlQyfrJ5Zi4u{C3f{qm{*bX|&sR)o$1N_VxB+t@T=4*zTyeJ9!77luJmtW$PZ7 zN)OwUTI_?+N>|nSTI|VerR^z3D-9n4WrgjY7W-f&GDL`6l^`-HY)`GXr>V5kMOs7S zY1I~l?HTpTFA3W->+M&o@DU<>WM6o3*gmS>K3au;L4<#?FTA{^%ja>A zS^&EpbHi>eT~kJJy-%>^#c7F?d|*HCU)z;z}`e&wNJ``u% zAaH&pT%6WD3{yCteI~H+r-5hkJ)>1&c|NXsA$3<$)kCRu>w>#%SY#6MIJM7{gh-x| zLJkw)QsA{}?(q+w`R5Z3@2gr@aoWZoF^n1-59rg*Xv@-~llF%58_KZOMniNS|9w|Hn+P=nm?MRwi3q37+i^F!=N z?e%~6!RM7X8&5p$e);`3W+Am1p%d<>X6q-CS`VLozo|WZ`pkKM>g&DX)6KrO!*8x^ zo7(up`XP?4Al)(HUQIhS#9j5ae*ADWuN_0puJNMzB9mZCGK{HcM3EpOZMnthX7X3lMU zVtLy__kmgZ!lVn0*?T^Y`3|+TH5_f=wiy8KfJ!%oJ5TmBKmC08=ug}3X+7L@DBSk_ z#tR!C=}g;@fArbLdwu)EjsI}W-H`v$3~2DU`>C6eJ7_Qy8XU=OcV{5i78KWh8Ie5C%;RHQz?t>|!GEbyb2qiq-38XH^pG(8DLT65cuMBjhC zA>4Yh%b(ixYPfY@Q%kt*p2kO8&oq56+;%YVVfey@qd!^bK9c*3yLdUM-PUwX#CglB?`=yyi zSxgpXf$U#Q>N#2T{_z)DiuO%H0nBO1E6bTA%>N3q+Y@{J)s|P&&Ls-ftJT}cU z%zM^W-aVzRW=W9-_sD4dx-`#)s#lITKIP#Y>Gh`LQqkS^R8x8WmZnut&reNx z?)cAA1F!lj3U@wMaet*=v~EMNevY=cVte@<``#@dl+Us4t;jE*qwjXUGy_;wb*bmR zlZqyLTmi%Dmvz^dRqfF zJDKAVv91!ahE$=yJ!i1lfa>0Z_DaVD_XX9QONb4l-*IZZSGmO+xT0;7O{m~Ib=Xge z$q`8j^f^w`VqAya;o<7Wwfn+N57h1VXU?noq5^-xn!(xh1S+jg;)(Qydm*BxoM_vF6g;_f)! z;d-kd+45ur!l@oxFzK%@7xsgNBRegacOg4%^toN>Yck7JdvB33JgC2k7p67jAwjYP> z*iU)@N2_aeENAhw?yl>48O&nd6mvTgJF^3awI zC98dfo6EPC`j)KSim|=b8+^C&8(e_=zenTl+!5O9D=shDgy)F~zR-PZeA_mx^=-wt z;D$=yw$1mi-I_eNWQ}iqW%*hWy1t~ec+*;6$$dg@N2qx1%;fw{n|!4urCTd~JJv#s z0L7cjH?L>x3CZ~qvvhOmT3>l++lH;a&D*yj$Hi-J_*;x}Yg&t`!#U76x7pnN=Xr9} zsE;_0lVfzGui`<)mN4qZXBYD*9Nig)u>7^hM>Gr%JKmlim0E>EG9Je>Y3B32EM;+wS@sy>$JLI}h=@{jISmNI-!bfOLCII4( zvA7FldhJ5~3&N#KvvX`MVVqz3)0P=1Ka#MkdETLv@gq#lU%XZFd_Eb4^y$xdeCI%( zV`QX+d604dkmD0-Z|0ejCr+`6|2vZm*!Y}I%Bgo2V=2Q#K{wz?n0F|37V?=w#K@O? zn52HXoHr@vw4rNCVl=g8CoM;wNn9uSc)sM*j=&#{K#;H-3j`$aW!0ybng>aIeH0~( zu{@oX21GA4x6(%*_>>(Z`7E5XB~M+bF6RX@O(sL0X)>#7ej(K&PaMW4&+zLd&oqVI z;Lmg>OMm8Rw&Zcr{z39SoWC!5>XI_Vqt^4e{07tVreoUZ`7*Ce1`v$D9_m}qLcJJK z&%?%?vnxOv^U~Iq8q2*HGjDhkf1M7y1hLN=jhF<8CS6yn5}{t!kkW zks#mFtQ2#?tRrHdkwv*(^c9p)QV9!kSoVXCkF*UiJ*uB&FpOl5;kiF~y+Flt};WkD&TQW$7lQBJ~&mkiP~6j;4=TVC9Omu9&)=cnB`O$!xdj6`2amhXb{*Y@LHul zl%xAz9A>;cxZ{I2;1%9F$p>&Ic}#fbcV(QHY{n~stioVC#a{x06x&b|60 z@YqLFr1Z1Sz4D>(RXt#LMB&Wk9{D8_m;FD$F@mM6s}o6rp2Q}o*^zM7jgl~^F$fazeqfF zZEu4d{^P`S>AqdcDZE|q^u?w6@QzvJ9)sMa0pwP|k2ej^ zaQ_5u9>CGyuEO!a^El(sAXCKy>1c32a0o{Sjvv7fhxQDPAA^UV26yk%I3I=^hX%hY z$XCIy_q#aS;rEYlNm=N`q70n`0G>C@e)xmvXFp{{Y+E5e5! z9*0lHm%(`u(F?z-g}cf}jjuUkD{SDruf36`NKzBFuVZ36jWnurWEzF{sWeJt8r2)5 zPvJVvRST@K6H17+$c&YBs1iHn8G4VCP~9t4#Cs&uE%uv&-i1rFLcue8*Gl>7yOn&N zVA2mVx9Q*OzE=u#-ysFCr>T*D*9ztH@4c>KDOP>E^ej~AR=?3Jb!R-#?AKg_ljUI)3?sK5=HQ4lrh<3-+QK&9}Z zLkxPdH+<-LP5J|c*&^@h+|M3x*l{-N(7l8!5&G7ouMmpt$~ttv^jI(QesAG^nN8Ot z2D7YtpY*Bzdy${?*{(EYlW!P7Q?m}0N*Hc>R#QJF>(C~qwl%?bNY+t`-UtG@!l45}HL6mCha`L@eDMe{6y5GKERPT>gSD8`YF zqX0)1i^T5JwBBpb?->Ig2OrKI@YCU^^9F&=8S?Wm*1_0`wxVYIwe_d}_eQH zA^cB_{rQlwzfKX^cDn4^x<3!{R8&2PA?Iy^YHoNa62{Z16Ye zFb5V?fo!`|sy5F}_@pBu}M!iZeJ6_@7efLlgdL@z6@Ex8O zuW0{9aFbVT-HpaL;;qL;d&Jf~5sSQ3>OK2At51o{i>wFVb!^a=h&^H3xeg3Ljpbk5 z@3}A1r<9v@d)Hy*7h=K#2FF_?$_a#4-SBSJ;qA3yXKQGTEmnoB*l!k9z;JmR9dVS> zWaC;eK)l7+FO&GkY`d|{l1SEjKi-m6pXuE|ESVTy-nhEo>aBcm{MI;<$JPCBy@vTN zJ%BT>g#hY&5+02P;TVd;hQp47f5xj9KBC*TD#)3-ov0g3%h=Qr^@66Zuon-fZ&h_F zD&v8ullIu!6kmY zGqr3?DD1pjx_fkQ+ouyf#+3tGvh7gqh^Wh{aQkpb!gU)?*Pz4RXe#r2b(V?uk~j3p zOcr`N#69-bXK^-e@9|b+{`Ujj$HktU;u4-`UZ6^)#l2N^RAXmHYz&sjVOhP+D-~r` zjIt7#8}?gCj1F$~~23oz*@24RQN>4q2~T_d!NP-r?;sb`3>d<85U=5|wpH z zLQ%G*vZai#AtTZcC@qZhG}z=$-Qy~uO+-wKJu3Evhl}!wqy~FL{WjV*^mh$Ii5gEo zY@S=zS<`bM(NMdSVJLYgSU>zATVXsgd@)fA%+;0GpxGa77}m3~jSr1qJTG^=)B6OI zzqNCa>}NrPj#y?_EQ9voMUM^V>ujfMyzki`cGqX>4f$uI^|4gmWX|`9yt(8ZrXu8h z(~d%)&c;VnZcmDA{{e%Ip}mhgKKyusXkr@Dj&WP$gEiRvIoTaeYdCN^(*3*M@NnH5 zwMFx5t{#u8r0~67WAA9Re#Rss=<>=Zks5CV<+;83x4n3$emC!RHAkFKzwiv(H1Td+ zs6FDN$hcZ3^Fc#;kA8$ze4G`b!e92{?!G%Ixc-CgU-d?FyWdQ((x+N)ui0*w5Q;Wv zMw-XD%#oM1f$z?t5byt3aL%nSwCANMTkS^fH5LYLL$x|ur}9IU-jB7`EU{BEl}Nr+ zt!dZyc0r*?Ln|0eV)F=pB5gbhZkR!HB8G|Jf!HB&cnHkb0in@;OyGL z{GPiyV{oRu?1vN8-1~?Y$wg;0lJ6}V67eGoku-0%=G{3sGWB3An%{6Z+FVteTH6ej zI%0t?WqGETlI2g0ricA$t(kipb8yc>mpZ!V!%tG9VediofwmX&Np5F%77T{S8HRlk zv&CKPPmNT2TkR0)9;xL;mqu`9%Jt3AvEAsLQIGjL%zXwqO-v##0 z7LWNVeV$QgcVodv#{$nOajl5P4kdgF#eZ)^zcqTT*WvIa)yEtycCBNO*7SoMOhU!C z4Gk%CgHK#SM-;7w_cWHgb1abaJCP_9m+dADhGb2l?35b{#O;kdPz*M%3L7RBo2d(H zB-}6i9>U^rWgbj%?>YrlhMYHYqb!OXoi}o{K03}j7AvwbM^00Y?m~{%1)r2T3T9%K znMrF}4)-=gagk;|$~ck?d-B?|doyv1V)+}FvNubIU*{!O8~Px7cH?v*7H zJuB1&!}|Z8af|aFup#|OJg>zCj*^6&#(N^DCW_ykT>V#hXJOtsti%gSTpKFyGT#UX zeybhV&_kkItmJSF-Or@O!;HLk`s>a7_c8sYXK=H< z-{ml_&SUns*@EHb{gh*#6Kk9nIJ{GIPg0Fnk2veTSM|d237mfnk%-OXYZh*s4^T=4Ug?1-LZ0)XKk-q-GL|2N|a%e~O zAeO&qJ?<5fP^Mo&tRF5@Hqr`dkyvf6C$kny=|*yEMSI)-iqy2vsDo%*mMxx_zrtSN z9~JhG_Sh%o-!?tdTmu&fZG`=Bg%-O?ay$G(vtnapUmt41o}skjP-<7~Hp)6hj~cRJ zdsx4%<~elS?nfT${X==fh~{#6*m1ooDkuUJNweeC!)?D;*x^ zlKk5+v2gk@JG$ zGdY*}mkBey8_QU5mB>}RzRI>VzvjTTUN;t(%&5mrF-gN6chNH6$aNzlDLaBsUEFvP^6tr%6#@4P zbjL6D5|=QZm4Jv0RksLO_{>V8y)Sa0vbq|=K# zVt1;xd}4Boe^{y08`d6oMeGnGBKbgcW=kwb^uv#_(ZJ^kp^VzHaA;`H zqn%&(uC`Skj^x)iFU?)HZ<#;R3=17*9nOJL-5k8CB&f@yU0&?;; z>rrPUe~Eus<5PQk;#HiwGWGQs!tX}QTKyvW`y5-javeM2GU`~d-~WHPdl&Gks%vd{ zt(_}jgF9inNg(JB0*0%AC_$kO2muwVSdD1)Kmq}x34{;?yfs9d?4X_kQb|zSB-#?J zmWx(`mzJPHyl@Us+oDHL!Cut1o~pGftu+7pjycxO+ABNg>GOTh|3CkPmHEy&#~gFa zG4GeP_EA(YtetdYWMng|SHD`VUfHa34T;bD4+Jc49ow?zd4E?Gvef@{W==9Fqnk|99u%`m46aCzpIrvI*j%;5f$l|W>2D}+DeCp~sr8yY<$JO;qLS5m&i(i(*vVJ;b zmVtNf)WTa&P)zJDL7-x6f&uT90;!`kIcm%<-W%jq{3q&zhLyxF2R>J~Sc@wNo;(bIkh6 zIhGvOI1?>zTj%@|-|6kv)}#A7x;Kv8#Lr)mv&ZvHAabOk9c6Lwp>tbyVDm1p3qN%_ zp!Y6pZ4XEy-ZHx}+Q~rY*bYY+w|^KmvgIdEoGn9Q=)N>l$dlByp7MgSz^w%smRCMO zm$@*<-k&q{XwHz`Im7&E+k3Mq-W_;n#~SILleu}&chHCL7rn9k<+Xb^T-v;S*Y)kY z+spPhn~BQXIydDO=oJZra|U9a4vkhf2Aa`!vwU@p#pBy&nN5NO8E5D2y1Hn<)kRrt zH60r<3}ao3TKEyh)f15o^+)QbMo!d^i+og{gJoNNdQDEcnI)in-fRB6U2CJxeMYBU z*S~Hw=6F(u2+J*UPp7$#kr3D7MfPf26CwjX{XBuI281IXr_xeSpcl8Uy3}O-t9okb zK~K6F8VPJ}_`jne>A$F<`{QcJ=w>)y&lY3cx#9-S9ghIVj=M*mi1rXr1+iXv4BqSD z4*{$y{Jc+%FV&ybn1hYq!r^^3?y%NxV&&L8Lgo-z=KybO>|2{GbBL@UomqW1KCWb_ zL&>>V08D7d@c_n{=+a_y;_4&Zv6MZl%?)`i?Sbt)?$GtJKVee)q+OH7AKTnfS30iL ztQFeQbyxRJ{DMPyQsFAAfV0>&b8{f0EIv{(yT^i_eFE!6a;dKX3;N_KDXmA~39ryP zymPO#n9X5kjSa>@A2#Hy=h`K;1$%^Mnc>W-obiwS2ggI`jrxRcO;ZbH_>cz-!<#dE zGw+#6>@XU>#;MQU0jvR8P0<)Rx^b@b7ipO9AMlw8)NygXS@XEFb&&ZV;KixFKl=p6 z1^>I5c6rLtpIC=~5%|cmJ{x2oN}2y!I8&h6#v`t?WKJ~`zaHy?CFuEp@W0UayX)NSLUZ6dVCb}==o)0Th{*~e9kX#)+>z6wF_DI!(Z+&8-r%rxZ!S-UcebTwhI!RDceVffM7=ymld51luQ~jO#M8G2Ioa zaLvqAv;Ct4+}Clst^ZXyqRb^8Y}qk#+0y&N{grHHjB(@cpO|yQM9KX0{6raZ!#FSc zXXiauKHQynGWI1}0X%kfBJU(v{ea^b-D}|nOEWiE_P3y3h1zV?dTBIJ8}~gDH#U7C zJ3NWW7s(#tJ!ZoTyQ^{<674dt4ufqoI;Qz%QkE3qR2Yu{D^3W+I`X@ogMVWcUzNE!wL#DTtow~RUdoy}^im?>*1%b1c=*4;}EDZAzdDQkQOKJ7$?oTIsKBh9XM%sEl` zf7k9WoNB+FP?M8e-;QmqqO+05>ibPozWw^<(p|gT?{KEwH}!$oqtl9W&Musm+`mj6|B>t}FoQl79D^_=y7b^9bO=ajmw*ZBV{ImL=?+k2b+mp+jq$Del` z_^5LaR-!v@t^G^q8_Q3w9gg1;DnquONZMNz&A|A-=Wh6X?Gq`-mgg0Hkd$m&@3faq zIb-++UO|~wlpbluy7m4u8g|`u#_IOZvJxV@E{fEDG*ufxSazXD0~#Z z#KT=mJ-p*SPCD|wu^(r~O?z3A?VX*clHT@h+uCpa+^PP%j{iPj_09kA_=bZI`9eQQ zI{1+E)_bM5#$B!F%@TWNJNoHCQxW&zpo@tIUa)Pe?LP*7+p;pZrWPbY0O&|g6_(6F z50N}N5&g`|&8!!AC4ckJ`_Gz+y1qW96K`zZ{PlM`9%#F}6c;C!%qcA@joBf^Powg; zt+;tWEl4hL>#e_iMM~kLCkx)CrmIEQykjG#^V|ErVdmj0SPwEV%rU zQ%QAa_l6VQBW4b@S^T?b$9(P^7Z(L9i~2>@ViFeFfRcR;7-&RVTn73 zOWdhk;*P`q2v@xQxZ(|RPlkJcZzsIB3({eK`5o&}O6Xx6OG3uhBk*gYP7d2=Oz5Sziq*jJ%0<4Foc>oewca=yBY zRSws-*x8;fbK}B}gqoC~|0G7#!psD;#Pqs;{ZNl_F68F~8SAo7*Se%?z3%V_A0Xi3vv&unI*p#M}o) z8FpGd^f^uuM%S*P4$Pf`*;zI%2mSe(oJzs5YKc*m;b zO!*s-)p|oFh~!R;5ZV5NtDZ_K-f^o;EqT%?)8O*7!VspG=H&4ZOAzOdi+Jv6%2eiF zPMOldOKH+?{iNVe(5sBq2@-J)&JJs3PIpX2rmpGJ18^Z zJ&7V`jv#L6gDYCtn3d@${y25ZR5VmU%8VOFFP{8#^*bn}MUTFPyx|s3dK7zMWWSsbef01#IQMzu#LHl6Bjc}*oLxF|(nPYBdHc+u5u^thM5m3YB}jTv))dCU6)Q{B zi`$ou8Y2^Dwow%9gXKr|)ld9i$wOH#H8sBnSx%*VkSu-98OT?v$dqMd3T4Uq!zELe zqo>G32vnHqi_Dyvmrbc=MvGB9ozUs^M7ipXT;}3rS0SNIy`6L@@%eNt)7E4+TEJhF$IZovnD~V@=^7Pqxk|+;TGc zudGIHgF5sGB4(8Y(!J5rWgr~?o~L~^ucD! z`4k%hZpmFxPHBw3-B!s>l>!}FWdZ#59fsbOuozzY0hqBE67Y}orWSrN;QLX zLk%f4O-<`sjK`g6T#r9mQ=D7l`=PV{^}~WQt=8f>;Ec=mmB*9eIG%+2_j321&Kf#f z=-f?b3!VEzX}-3jbnb`qK%(jS(r}?^RB!mAKfrQqcgs$!A#rnyOEt+8FPROlmrZ$T zq{z7OZ-DgwHhquPp|VMl%3Akj*tE*-B6?WCK0=EiotjDneo z_xHli1Ih@u+>mBy&6I|r&A97VlreMfknu(77@3C--m!eOY+kYwu1Oj-5T|5^5;2pL zg3R9@4n3BX-?*=FXjhpaCW@tC8KxL4mWP_NAKup(xb&mY$%Nvj&iM_2-5saqzZ&@T zxncX8^vuiZoxgA22LGVLuLVM1SnWItYijGAJPU&__16r%@A~3q-I8D z#q@ol2}3Yr#_N?0&6MxoE&L+ujLd-u<^FYRd)wNM{)vEbp|!NS33`?H@&z$e{|bNpG66Sv_reZ0PQ729b-8|U1k)0Py4 ze1A(`Ztm0jYAdXkmjVcnjv5DUMtciAHDLI-rU+MV2*ajY{gIlNR%5dNQl3n-P#V?M z8|rsW!kv=R_L?N@f@k7W=S{7@dq^5B^Yqh(GJ2#T&6vggZH- zQ|2B=d= zuR96n(e~NMD?RI{BB?vmu#}mYiEWqC!s|Xewz8vyQH*GXGx2-8?)ZO;NqO-nF)6S5 ztKr@@=TJh#us+bynOjs{xu9Wfb^X4E6X@0&=B(R`JmxLOo*Fw`=(HlTuVzM|V(`A( z&Y!e=cu`^T`?=%Tdz98@bmq>%CQIpeMrFM5eEJ#~smejr%?Mc%1X%Fff+_YV30y^nb>_aH#; z@Lj_bc}aa1ZwJo8*P;{sXI_OV#(U@?i3bJ4`3{q2tSqecC1 zzrXs)sk@6p8?&{~E8ejND!@rk!RtH_s@NVlVOj5P8IJeZP(MShDgItpH+5dO)pwxW z;%k0`d}fEVeG+mSy8L0UT4cvMXq7)`UVAhOTa(PtNSW z#g>iT!aoL!bIz-2pTE0fw!=~GSc9r?M87pTx7R{hl82j^2eh`wh9G+n2JZO0v54I| z??#WU9|xBBjGcVJ4&Snyiae$qN{TE;6zKlboaa;UqCu-w)7xqohe}*?IpjAv0@WNQ z_V+|5eF@p!0g6x7t=->&d)X3>Mn0u*?%$nw@}|r4X$-myKh$oRp}d(cJVR*%r=+aT zNzTTC^OdY-6_EoD^%bsIG3H=B_PIdirymi%r-%fj@E_5of zbaPGnjWtD?_4daHhafUyqKn7dh>{1iwT(Ib>l(+vTXItP2VZM@WJEpnW^!4}m3v}s z5)vrI&JZ$zNe`NollRr_J-m^^&ZK3>gR652c6UxmDR`=rC(i{>b8gDH4jw{&L4or_ z%wIa|(RKB5<}w%RI&K!4KITb~r}_a*Uzl!P7T0e$scq(XwJmEvU1Ki8^}0ECld7L& z`=}epzfYL%u5i3HNnX;#lHIJFDadD-wF6{$a}lEsu6?ekSowf5Exd(WcJBzYT1B;nd;Az^8j}Z$@5w$+Tr4 zF35x)ONQJ{jZL%g7I0bU#V_8-d716&{q*X)!o~bq@%_#7F`dRT4zlCL#N({WczYp& z@sIg|yLDXQDlVy+W$y8vCw)^6al?5St~)-vGwsvdGiy_=>`9xyZ~OZ<%}lR*VB@I7 zO9z`11)=e0-I-Q5=`WF->ghEHoQ;3zU4HGJrxm<2h}7i##XUcjcaHgy4$quk^w#~4 zPjr|BJ-Uor-_bH(YrTy(^ltLWT(r8*Y(H>bTD>Yz^F-&myHNo?ozwbtNL_vigUw|NU za>JVg;o21<*#ka&a-s62fXa7+6}fg8zG6^rMSi*N{>x_-l*zOUmlv;*H2V8$aUIg+ zoJ63eHm)Za@13Mt7&qf)%_87 z7>2x?tSioVKZhB<0BNK1_a8E6Hib3AFd63Dk~(}MVM?#(*&kvW`tcAf!DeJ_Ov0O< zJdnlGvN61I#sF5-kgwpo*2aUU@*4v!FAbcP^EBSny^q(&&`NghZNJHAO&?Fcq>T|5ASt zsj$XQ4ltjEA6s~hNMy#6$?prb_(;PJ39s(vY)!=OD|$D)8=KkGk}*C&Uq(FJkS_ zlo;qMK~|pD%8eX}Ew4A+ne3e2`s7PNxIc;my^ZbDYufX7;hyC8Mzy9j^opd`ek1BJI6#cx$7jo#$WA_oY&LS<`S> zwFaxe$!IWI>|-ahWq^y_o*J|0A)90_l;6sM#WCM34asTrvE>`;$4H-u^i+P6pW zjib6fy~pEhH^mw+`g_xpj_a2=6XAc#6K7 zgH}U{rQ9hj&Qd{Ky)jVJUeU}w_NmuTott{;xM_N?`3Y*@+>k8EZxC$Xt&zDd#?56> zzs}}+(sd7C_6A-{Ma1p)-f_Y+RG5rm4HIsSU!Hbrhf2R-YI26PWNJaW)i!SP5RSLlib@{LdQ{hV%T9dvYtnlBrbNeOa{6zKy$)APOE*(p$xn4+&48EJhniL%zq zY%f!e>KbxyzqjDmoe-h8BXHn70+r>4g5P)Ees6URze%P_n^Y|ylB3yt7Q^Q{MsjTKzW?+`8vPpMh?T?r*&j85>5)98Dmm76Hxb<&n+PuFkHnY1x0#ZbpS)adD`)SY97C3rn0s;|RmiP3v-#FY1VwDo=J+ zV#etV$X&VULZ!U?{=43!zbS#X)p zKfu2jiON8_y(RQ_o@-%af-q>S zy1OVdAgAGYRV(xe?zHM1Lu{3JDjry#GToKNkI6$3?^2v`GMV)-vwvxNxvMS~`g+0p zRPvH^*2dOA4OBkjc8tNHl_{nx`(Y2*{_B!^VYbSDB9=E#ppxwl^3|to3{KT(myx70b|rI;WnDHAg4Qyqa#OOm`_#i&*mHG z(axZF$0~f^A<{dNF|M<7V#EAdb3#w0MV5z_q}AI?SRLn}J|*KN=_IT06?`WHJ{|G} zr$5?&PRPx6S4iO&D?1lGKz1euoEqC-)A51n3UH{nIdAsvmX0~10lX*Q^}Q-A1Jc|0 zdmOFl%aLn*uVX6z6yZDzDk$(XMky4%;V@4JWT(W>8^9{q@vEb>f47oEz=QPY3Df57&cjT4i9#m4C9uk_4C z*T?AZYN!og=Zn!_Jl)v|I9*R!lU|dYit%_+?v0Vq2JXepi4-o%yE3w9QQl>^B7`qs z;L{5fgL5R*{b>pBrSERGr^)pq9{9)`k2j_5ZoZ0CT!(g1uR7D_1Ojt@$4|;L?)x0( z{XUMhyi1bMwHE2D$K9D~%i5PfHH4V9&!Tn+JT& z-wR*)+<9o=RfJ{ky> z`$3LRn3A?7a0H=v6MPh9+4*_^FM)+FOjFygDD(f!GoL@`32#Uo#^jPERsX-e@9zIqov+5y825Kk z=VxL^c$dX@d>`TZWG&{S!+X~a7*1Vn;l~14-vY0kC}_1&}O_QS7*%|!`(Ij6}aI*j#4 zTFepFzy9)9zODC&B>I@t%Pnd99tj-Wk~k&tK#jEr!VVm^7IVdi*wP?=-9YYa)(w<* z$nSAJp2w|_)P45^4mS7-R&s7xy(v)r2v?tVTP~_=oCp9XKL5uLES8Z^J{s3Qb~Xl3 zmv=rFsD2@k|5hM0C3*crEAWec*z2vH6h2Ul?TlS~A9&`T#_7$da}NYiZMQY%wd3l? zlL7c_+nB_^1N*mZv(TGP9Mpn3GkKYo0J|LhO{ClLCX zZx?Ft^SpTCXJ@eUsI=3&j-#EP#di9$<`Xy{9u)NV#(ahh2fFHQ)9ZoIP1fOkf5YzQ zzSjc>2c6fBqTf0LfA_s8Nxl^?Nd_Nk>hPQGvVBOhgIC^PW0KkV)_*iZNG9pmB+*p- zY%1AJucbo-oF?V}GY~r4-goZ`E0W%XYbEvJ!+GI?G^=o_efaf2;q&-~y@L-8wC-i# z`n)js?3wIKzN^!pc;JrCgU{OjgwfcglD5Wnks$5CLjRu*7xql7Fdo+!Koq%BbYnj4Xbs{O!6UL@<`OD1H;jW z4%_qaz$RP_yX!bk7S7^~;``L#@jnJW!jaTjk75^Xx&@vP$=oe_Y;Shjo{Qd{-K$+M z9W~)ys8^B`tx;(QeAeW&THDIL3<{r}wlxiMAwArLTZ@hEXZ)Y<$s3xT>WuzgzS2JU@5pD6bSuD{x! ziBA?pG8W|xjioCNz3Fq&Rr+VuXGHf|D1}d1m`OM@51>k&NCEeq(TG=uwq` zGr8@9L+iMQt2eAJ9q-R`amIm%d}Fe6MM>qYC6x=xN=uejaS&r6IJOO(f`>LYQ362} zUUqnFes);w0Q~s70el?8-+u_>8H*<$kK+au$_#N!_1ap!p4Lp|={9`|T# zG=GEx=4#}`XZ@K)88r#`C2AiF7^V+Gd@;XFO?h0(0!@N-fzUdC60AuM6gxqFwX4f3 z0UP4K)hs*-Z=W^O`j!4T{IA4)c^5HIf;GeAp6PL4>T!GHUtyJMdPgO{AA9mU#}ofr zkNbL$`zDXO$m1^YxJy0ma*unt$Gy_}J{ttg&+z!H+XXv+@Ld_Jf)hL4WF@Ut>Sdh6FPi4=#%N=ISl6I&s6xWfHo@zth9- z+aCAb9(SGn^TCE8M;6RJJ>mCy+~4)Mz4Q-w!Z&-|4|&{P{r%Z*-xrX0xaUb`@Kjv}2>2bg1asRi+?d5mE{zFW9zxU94-GA_e|Iy?2 z&fosW6aJyc?VbO8;tBW8CqDOt|J~#M!sGs@$L(!DK2P~2dfeUS*PifHkK0=x(mdh4 zeNPNC<;!U=e;awG{*LgwpyY2OAJq=%F$wQu&C>GW%qRoDLYd@rP;dwEH1Q7%yQK{5 zPVhI`9K)c?HJs5htp5BMVAL?^#~$~|GfeQkurjQH);3L_zN9~E43RN(zo(el%COG1 zE_R*eGW@5?&&YR*T@o=blGo z4Bfx-xMz6EC&!~N-w-FZ;kV4IUsnqt|I5_v`?pobXVX$g)o0$*>->`e=Ki7#aBG>=#Be)EMUPW0j9SbiaHyk!2ml zlVRa|RZ4H_$B(UIPyFE&RE_A%BhR;$-@Ty8u%5IAD!q|skG04{pYCzzY5Z!5|EyK0 z;YOaHTRZw_;;@*0QeWdf0xQFM!8)dH`Z9cswy#$u{8j5Q4h%4C1{rwatTV>_3#&H^ z9wr4(hV@IULDyf#{VRMFP=e(T`47|fL=U=uqv5B3GpskP+eR?N7=}Nk{OCjX-!%L_ z;0)`y)u8<7onigX`i-Z4-_{EOY8d}IO)p8>`+L@LPyLzVNv}xLn}fI+)}O79m7huP zL+c9FN0NkpZ2dMS|9`cX#<)MR9@O+XEM!=Jvwo!fjr&vU$}|MP824vZS`7W?R^J%< zlhzMa9z&1cW6Lt}O?y0L{l(K>|5L+BMSZ-^h-&B_uIo_~KgphvV*o78-Ouiuy=(u5EjGFQu)}7GpuyGO6iw~`%K$E5X%MfE2|6_IE0i0o7Vej{pN7^Vu8Q_w`Cn_Vf!-WL z{_W~s1)O1BZx?BO_=UJ{vcIduroPRyOVw@qule>%D*rz*kI1kV*l(sQ0W9(#pz_m~ z?%(l`8p3Iw`PgAk_(2{2KM?-6*x5SX%|l#_m-Zl?UvXNTVXd+U>U`$k#J$#@LB*>f z>-Tj&GaWd?`i|YK^6nLPy**aljpDxF#_isyVSGEsI8A!rv;UeH4VL_cV&-Fw_N=a8 z3IBzM{vvivFh@`h8CJ9Xh({kIJ@u(d-D43a!}_7U-y`2Mp7;aQeVx#6x9h_IFzgmH ztRLIEwf>s=`4fBEXbF~`{0wWSeL>i`4gD_rC^HUY=%2FZg~h4-p0<~0e`dn>+HJ#4 zIMtS6J!=ow_Hcu^_uJ!iJzFX6pV`0F{*|$)@4Hk#EfRjfeq8CD@H&-esf52`57P9F z`#?;(12%G%~~6zsn$ZiD@W;^$y_fg>Oibnx+ zmx=ykfuB`80hqf-^v?t4&JVF4_*aTEfq$bo8~AM09nu7Vhbj&N=PUjMxIppez}G8| z0MAo=AMnkJ_W@TZei3+$;%k6w6wd{|SMgiGn-m`h-m16)_(zJXfOjcw1>U3habWi4 zlz%etA;tN?G&b7#G58@^@H@b%iXR82UPwcK=AZZ)VCLWPr@n|w;7@%y{$a)Y;XlOX zpR1T--6)qo%ZYL6Kf&dn=kjMB9RB$(|LHFOSuX$CikZi&Tr|`*`Ou%bc6i?C@}KYW zU+D5*;_@$ZVU~x(hvnhm)h>L83s<}FJuVz^;rkR*x9eU0n-o)54KDwO6<-PZCYS%C zidhz|E}F*`lg~~Ue#(X06tfOI=knj@@_$h=?>96|&!NvHK4|C)I*E~1~ujbA?f-8x|-gUP}Z1g0L&R!lt%RZLwm4bo62mnml6 zuTmU_eZ6ApYMx^1YPn+O>u$x2Tdz0_d!u6Jw?Q%UD>_8F%&phr_%(R|X%(OZb zGc8sx%A61TxMG&k9~DzKl*8#m!o=D}IJFI;VNoa41u^Xm#fh+)9{s5k>7#&Ym^S?> z+X%&^mHq_&QN00&;ZI}hI*5E7d6>5SHbb@FJ8UqrWbx`34Ru7!cwbY@cvmT=%uL(< z4gSDLevb>3w4Jmlb4=c`E+$XOJ1}`l-hpW(@4yT{2Tu@~dKj*l;>macf2NtQ{$beP zRLnG`o`8n@Xqbu%zMCVRl==knxxC3z#yWr~Z^@s$%k!bU{OYCF)Na z#<6wXBv%DJG8^#gt{IV#;_#G4;$ULY|cCL&cPf#(vk>OwWGLV9DeA1~b0R1_2}aQk{!# zxqyQS;|T(j$0dr%;~K@3ZN6gWWtC#`UZ`Bx{wG5dCjFlc&Lw8Y2{Q_hGcGV2K~+dtG4nD`F=dgq2^z|BrTSAADHr%tmRr=H zvV2D|*)}Q;!){T`vTIdLx%McgTr^I*lXB6vPdRL@SCqrvK}yrEocbv``M~&#PF^sW za@hZ4aG3b8!IZ1&S%lb&4s=HpPs0LNR5rY!jEVoUJ$v ze7?)SP%&jJS4_FMm&bG|7xz<%!@xB5hsLHH!EhIL=n9zOH1?;)cGF`Rwt^&t5qkWI(tl?Bh5i+T zDMw6NLyW)l55T0Iizf(7TB(QXFL6&A`V`U(HCSW@W?T$2;!j#Pz35P7NFWV6Q5cyM z0yA!ZJoIP0n-oWN^#wd&Nax7UIuSgVzBr4)L(Fg*`=7=puVAjh{A-UkI0;se0|<=p zbhnF_jK9dd%U~&Yy|O0l!e>i>vv1h zTK$>MeTtcmv*Lj9U>I`sHZ^FI9{NHIdc_}p{H`;V~$RFx)mTUBi%Xkd*?4G{lra`Ve5sz-mN)@}c^ODf1Ut1MZmgf|QVbj=?jV)!AXR!ERWw4YH17Vo9Gwv`AJ7Dt5G@QIM z4X3=q#E0<*=1e@niv(KJ6jSEeikZ&Mim9vH6f@1o6f?~uikT+6Z}McCpDPZ-78%^- z!p&3|$>S7(re6YPT2hyQnU?f9z?5wio*;0vT!1Nqv=Ly&y+&ym_a?=pU!a(LRw`!P zh+@j$pqTRRQXGa&V^1}<^rc@jSp2Utm}xuhh-t@^3ooz0Fb!MtE;>0Z-f~tR%r{u_ z3mnZaFy)_shcry*QpHTCOfmEFZN*Gyy<(;#@|yaf;AGJTqux=jW!OwZ=wD9jLIZmz>5;|Wd| zDDjDz7UdwOY=afkFIRCGcAnxPuvt{3r);nUQ?{!VQ?~hvDGNBWJg~aMA}O@?R#<$PXNqADHqN;Rynh$5zFZd8cBg^K%yl zwCrd2SI?dwu{nDNjBh(F`WSP6gPJJg>%XdFJGpR0|ZyAFg& zqjg{i@hBrtF7arCM-d;!ADFZ81lizVhTsRz+5Fy+M1B{Y-`%}g+LQmB}^ zk~Rx^%5|6ehheuWrd+Qord)3-rd%}kc`kj9b?H;(XBxq4gw*tJz?4nO8kn-tIQbP_ zvB1^X6c8o}PmqGcFpkrX@`zQ3lZmGo8S;t0X7F_4uNypzSoJCObFS$}C%``lOe1;& zj>-wlG+BhCp^R%3Q|B^H!9NHr^$<7{c$3mlw_6m4VK*tJZhxdW7xv?dsoUL($HJC& z2cDGiJ@wCnEo)o&GvB?CJ<663EbClg=5?g{6Vt@#^9JK5{!@*9m}h&M!KuWmTjtr( zA!Q1F3x8np@enf}k`zqZm5RxO#yO)G{ya2>k-q&#fu?Q)Gn~dri}8auiI@CwWD`DG zrZT3ZA<|FUCL5(1d!{R2N-ynbo*}pxRuDLv?xo%7L!_B+=*KH2z4WEA zb#es=VHhVy55?jw?I#FKJxKosOny?nz|@1}9hiDxbtFCYz~U#S9wLgV2Wgw|4+C#f zf9gTnCj6;~CiSNteyo^!Xj4piUsFsy$ejwrr5-pXWxAy4Deqx~+4`Cl({{!krtRo~ zat9aS56oG3h^dDQ6_fWhim3-ADKyl>62;WRQpMzVt77WmL&ag(T)LA#Wsy4}z?6k) zIDIVBaQcBT@f=fjrC&3Dq7%cfZY_Q}@+bq*|@;H|G8k0wsv3;$<(}}rR2s4XV_d0q32RY$| zk+uw+2#lq*_%ltJ&%mE)vfCv+{TYpzysH$G_uYyq*9OJZ$!5jWNt0sgM8*;D2?IZ_ z{-a>OtC)HEK=BaRe^s0dTk0_4GOsdr08=(jk0@Ihn8Q3V)4D+MWMH`q1pho>c5S4| z2d0V9f2r|fe5XGQ6SKpBp-hhcDU+jT=E2eP0N~)w_yZHhLrguBo|w8FqnNsyp_qB$ z6x^Y~bVo3C3vmTgu2qV|ud^7jW0-hw|c zVLZf?f0$y*$u#KCyyPn;Kan5)5-Q_S!( z#jwQK3tfCPzrsg(UIeP(azi^`G1G)9#h_%ios)vRsIRYKf@oGd^|QA9L#h)_98={0vv=;%wr$L%p+x`KaI2(;4rYv z-+;-3Q##Txzm1BihsP8%{nr%-VZWuAG}5ObZXWO@5QTh1KZ>b?{fe1yzR5`%=KHTM zob5CI)WKNAlYu8I&Ig{WnEd6gAox%QxxWWY{=ZQg>hGV5nb!1#F8(hlrfk%geG-3Q z((nX1;KO9#A!ay@b56%N&OMeeaVatZBjxyAfu_ znZfzQf5IP_>3HmN<3Eddsll^}kKqr@Re0=uL}qT|+@F~Xw{vECBeB-Q`NSXK56nV5 z&e``8;=}Yc?bJD2tbp68x0E@!niRTb0j7S6@X$XM_RWe}ml&7+0oYB7S$|~Ag?}cn ztkHm}S2knPhhhIt@etS)m;TgoFQ|Z+^+f6(@K|6jSLiks%)_qmFx`)?>FpKmD+13#hoD&RK7*8u;g;<>;<);;jN5qO;9 z`M|Rkljkjp7XsHPCZ7isv#g$S`L`=Bga0AL)O{F_eJB3FoPj5Jn<=kM#VjwGXTqQ5 zMO~AI<#nE7me&P}8Bh8R(9lf9Lwd?QQ*jtJjZhSO)Yb?|)NF`OyW4KhvpGOdcB*hhaA;W?sLqI2ZP#ibuhwvF|pv zj2(9wEb`xDF!{#x1KPgG*U3BiI(Gue*KWffn6Y@Ab~=IhY5Hn=f6Cxlu$*y$`E|yH zYlwelXyy{@STmnk#{$u3wb7f5alq84%%gy5C|j`FlzV|<>h?;-)UAvQ)ux@UR{uQM zGDg5ZA9yz&@|h0%GsVo)DaAL!K9_B(+SEsGbrDa7|0Kovz_R{@KQX&J(p&|6mtyAo z5yjLEzkom*>gKnK$@7$A#_h{?2O7qe_6y8%o2dR_;Ms~P^IeKbbH9t`r!N0jT>f%b zyjuGuwmV?TFi|meQm!}*{5{2#?MI4PhB6*ioA&pv`m?@#p?EBCIMMK*4}7uWFfa}4 zD*Ih{3;qN)%bWiH0o$*bGyxYDdM>bFgkI~9Lr;I9KTKq3g5NP%>KHJ2Wa6Pec}!7E z9+xX74@pZuBf_v?E&jmd;&Jdu#iSJ(RJI`8_PzK6!?c_>6(&X=X@=l&>OXlpV_6b# zkevaH$P7&WsiEy=&Si! zZ?NPGI1$cKc!I!8e}-c6zD99A?4^pCuPVjN*IkM!<0i#S|Hq1%kCzlvZ@*U@hW#hS zLtuZQm^^ueOnE4m?12D}1(v=YI2V}P$D|?8>lITstVZZyOq^Z)}J#z3>Eq8BcVpc(D4D2jwOWdC)lgB`r=Q zVI-{@gC(tMS6ZBOz@*~|0yCcUEx?Q?brLwrpNfZ(`uu>w{Ohzk@n@l_iShrQ@e~=f z{;+K9`;0sy!-Ixq0IVP|xN zika3$ikZjhikVKOVy080nCaZ-@&~l+XZcrUUT<_FGCybhMGq=7({Rd5@}lJ;Wx>f5 zjO;l8Q|1wPg23b_^Il-`o2CBbccWtRqxnB3&%=hF$O9ae2RJGZa8w@Ps64=whjE;8 zkvg!|@H_`r5SZaK_9Mm?z5UQ&(c31YPtn_tjK5oN{oob+zVVlK1Wca0)StBfrI@^b ztC+ky6_YoOQ!XOIbH-0(&@vSnw5&x2t@Bb3A2f1ilaJPa$#09{BYg`nWgCYl2+VXQ zC}ujBC}uj}aN(O2lV0W$h|BcRWe6XpPnD4;)2HEDfP6&%z%4hMG_O1pdHCz521iS+Ih@GLEn#GET0LvZ= z{HdGO>OTtje#O)Wzo^H!R{_iW$iUYCKd$~PlS7L0fn`mnX`NL6x$x(g$;gL1&rnRB z_%R#tpAYV>!`ZcqkqQf0hURM*_1vh%W#RE4~Pr zx}ZPlsSAgGlw$H^nbDt^W#iDZY#e%)4KevsM^0Tm1335-{DG124%iPo5D)z+J7pkd zUPmZqUdfaGLD-ioCjA`6q$yI&xXTqY-|H2V9z#)-{|^*1?k>gT-=UcFM--FiuN9O2 zeZ{2zT(RhtWeqvQ@JmyCBXE}Dxxi8nLBqUWq5iqRGPi_3^*vAh#{!oqo&YR!PS8-_ zcd9>iBlA!A=L5@o@xY{SQ<~|(KT|vl_<-Wsz`s^}4e&dP$^Uc3WX@?cjFHX^+L?FlJEp~;txz; zJj98xWljQ|3LI8{KkQ+O1F$bv9E3epaVG4`6lcS}MKNjCDkhDLS>R89G-FAZ{(BXN zVgFq55ZJFOWyb#EB+&F%Hhz9&Xt}r(I5X!+gCinMW3gb{8^R`|9r*&1ADsS ziOB0L#hJjfUHB@+)WJ0_JXdjF_}{3wAMkv|gMb$*9t^xhG3m<`lfFVR`B%B{Y8U+- zF8XT4Ejdb16I=}Q>2{vDhR!jSC1pips!CQ@jj32sG;d+aig_zas^;BNvSwaI zQDte>8l@;JttzQ3D(i`;ytrgxRoM!O&$#5_#E&v(z`~Ns(p!tFN|!AangvA_MGGXA zo~RasQx{dNw3Q|0%Wf?ZVHXxv70p{zxvYF%IXo-liG4b1NB;7P(s`?p?UH%LrAv#z z#vM>uQnWDYUsArH!bv46`;wv+OXlI18A=y9L2kXdLq*w8MM)*nE2^k~T}1XVk)wRO z2f6un4~<4FFIo`G(jCtg7)P81%PQ7TwcaY?@pm)y1VyDlt*WYA=H}*()jc#C(NklV zt*ok8DU~x$t^6|Do|u*{{mMMMNaN_MWOc=|O1E&)1iOW}bMFd_!?d(K%G9Zeq$*iZ zF|UW9N(8%tJng$%h+7m_U>s2@if$>H$JPk4vQjkKc$MRHMDCMI;E+!KLY;+|-tS!X3FTDovv*|G(<%&V#_TDk&50e-25 zLeE=KwybL2s?w?@^D34hBTo0?PT*gOA3yPbCBe9H;*`gN(uyVMwOPcaw|46!;{>|1 z_*EiDYgd$g91bx=RDu;pRHFFiyMiDD#{9w0~@hPIpcgbfuF?U>7U>xD4 za=A+@%CuXEo2e@>4pW(h#bw$p#Ld(d7>6mRXmNRZ1KcdT!s2jrm;H*WBDROqRx+iD zExb5PgupFDcbYiTbd_;WvUH<}l_Y+!TMjQp94WMomn>aSxu&A04k9+xoq{KNoCKth zV;MxNT%0gB^O)dxtXHflFE6R8#GIg~1bU)~Nv1ndoWwMz3rkL?sMt_jz z(Gbr>Y*lH6S=e&E6lZXa7aq+>*F=6^>C&oYMx5@QqJ;~)`K?%4EPi7aEJLe7 z1drM)i&n`jwPWPfH#r?b4;CU7FxhadG9c zmDCTsJ^7V(yv!ZsPS_pl*0xEYq#SeK7>$=z&6C3DmW+&?PbPXg zpwxEMgXjukg|sBffht*gTUS$Y*v9C(sBG~vZ0am2pND;x^3p1Y$emXygdXTBmvMVZ z_P%-`ljIx~QDRialFG`J6;-9hWhJsmC@)$)Z&`(tbX2}CBXrC7WwbpoWrq`+de2N_ zXrsA~P1xZTr|P)}eX?4*vfO04n}SYHN!C44#7VYmj6Z#%r=ug=_~CI9l);8ezp|30 zi>sD&E7cyt-FokVBwB`^R1Oy9$c44jXfggULujv4S!+&`kXB=T!aYwUk8IA-iODZ_b zE;U(m=bvPZz~x?2cNJ4z}! z5#&?|$4m>CmAhMqo3tB+(+ixID4N^oDN9T$4iDxsK1Gy)7L9ZekT_1~5T7E-Ko8wm z-A}`$XR0WpsGwiM>U4BbX5Eegzk+aG2bf;sDBJFh`ZRg|QsNl4uHzcBmiZFSUq6Iv<&X&%0&eqBtu264Gcd6P(HvV7icC6&uW zfT*-)4WPSZB^9M*%NDPMfSz#E=SPF%$Rlk~J6Erga-`pQC4yE6KzqalPexktW-Tx zxK$d5D2_y`%as+}c=XnWc!BODV#DKbm--T)clRJSXLo2EzS7;t=i5EV&DR|ohcByP ze74;}++4c_Mr&}i!QgsWoQ^6cIF39fylmN0C$fjJE5t2N&(WNXjd_*J${e2Vn4a)x zay_&};Sxt~Z8o|F^H!_4p>8QW1aT6O%H0F|IALz)F~Lqhyax{UK(>ZT7lMm9#MHgAvQl2i?B_D4)(EbS3KJr)P;o=u zNqY#KtS*q723~F+In7qu5_D=x=w{qAEi++?Z44q}K2=pz40}yE?KnA%Gc7W&H%JmV zjkd-VuUIi=aoMtBY=H2f)-#5eELfoD{>v8eWDC-o3b0^B)wm0zt}(M$;4_TcOGNpgiYUJ?Lb3d2A@lEo#xah3pMlQJuLAr&0Ui1A z8x@XxUsw4Y7Gn|cp2JM(=)A}y-@-f1cgV=Ex6)C6uc3V1<&gEQ%ka>>2fFXXq3Z)W#>v;P>}vCV8Rg@p_Dc=%O;-??O@#^HU7hu@~^E`F?E4!>z0eh-6Rs>4j_=$zu=*HqnA zU-*p*hhKjWzem9jMHDrTd>I~oZPi`;Q1nrLA3~XK{T&0pu~BY@j?O=Uj=b~ffH_=k z=vW?n|J{-AH4nd3RQ7urL5(BdK@UH^__-c5lyA7wQN9~I z{2m8CewV;8j(pd8_$A_H&JRIEej{N!@|}d@-1>V9o$YjonbOhu3FsInpAMK$z;6g_ z^5gd>9DW@he&ICpJq5<0Asx*N9)6kkpx#3e@;eXV4!`|5vGR>Y=RHI?m_H7`=RrrD zuVG@XRFxHBNqS0G(UD#M&?@e_6Zu#!P2ModvGo_>Rm!M;ud^%vh0Kdtw zDc=m(4!<@Jzem9juYgC5Bj1xAetD6u{LXaoJLKuF=AvI`y?2bmufx+{HGp3kh$!Es zupRlDJ^Uiz_bZ2)($V>_hhJiS*Z6z6(y@G}g1=jT^U-)mk%1aVK7M8kLekjVQapZg4!*8F9-#0<+KE#GV4Hw1hr z-?c7&dp-Pa1i!ga>ALd%l!xDk;OErm>s)435AxjsI=6f`y7=AX;q? z1ulO1!(-)Z>p{MYLFbn5IQTj3qr}B;h=<>c;5P>0jv)`4vpxL&?8@(Aggg0NKPpzf zPrwgdLex0??ggD&zQBE5^{>>$ugb$O5smHUC^y4{&Sf5cx!~vM?-m!ocRl@PjB(FKYUT>M!79rUa;a6U(h{^9PvIQ3_J}>$qNS&_#U8Y_Vyn&ndDg6V?{}}v4*2_@ z^XUtddDmL+`mT3f=DKFjIK0UH$>aGQiuW1@5jOS2`PD)2qz{M{eIM+!e@nrOAf5i* zY3&%^;qVTD7uJ4HI=q#NcbDQ_Js{P;O0cmZC1RyVNAOSmVVCuemr=L7ZG06+28L0uM|dXzk9G2UXH_?0$zi_tQ~{C!#k{a zIJHdhs!)jT-^1XAwcquyqYrT`l)SGc+mGdoe{qL*6g=*4MQBGkA9mE^3_zlacQ3+B zV>@lceq8%E2{(^~f#ih#AnY`6BzVlv_CwVZystXEDd3$+kQHGsb9iGE@9VG?|6c8z z>R&B**t8NNyr08P`!@l+aj>F)>#!EylMe4u@P3(~1$GQR?(iDHll{R1igyf+r`vB4 z27Orn{s~6fzoX#E_VJM7{inlQ4x?Fg$cohWHHVjlMibr!*h+o7L{t4c45LzkSvv;v zqN)D%QoN1Uj{W_I&!_V8dU)PDh!+w64#SRm+$IbIZ!>iE$0Jyae_4Z4c}Kw$2D6IZ zHZYZU5Ih-w-&DLKutU=%_NT|d!={=L;r-U(9Z|e*!&>~i&lxY>PY-Xu)y{bN5Ih+# zn-p)J!y5%&XF6;}{JYuVja!>MetZYE;@=*pKgQv>SSm1U$KZ2Le>?@AjF<0PJGSS; z4sQ;4uM=QJ{CmjZ?E_Ex_i@;Ye~&x;5x2)hm)Gp{$0BUB(!X02ufgGs0Wa+OZKcDj zRlM&j-kq`3@iG&alVQ!J7jk`u9Vu z#lIr#+YMes@cUP1IrV*2wcoRf7jbw4z^g^N2z{dDI=my`Ek!)r?>VfczLz`oeG)ujkR$py zr@qs05R&%Wt$0Hm-gfZNgb5MeK!-O+@qVg!pL9v>k5|FNkWPs3K7t+fxJ_9Ko?LIW zAdYGD_g4<@D0r{gJX{Iymkw_;c+-&1_IttFkyoFS>L2%qVaMOQVW<7edoa0u{7msK zb9k-b4MDny_&3(!MHTO57)yQooto<3C*X0vDq7-I}BbvK~{vf(BZWz z-haTBcI5xf;T?-6eL`}=zxN&98;ZyACA|F(??dpy{A+c1hZOG@ikICjwf*=3mRzKZ zNPX8Ar`qMEvHMR{+DB##FCzu88)kK`g!dZksK*%zIST(qVa@)16KkpOGY)SIc%L$Z z72)l4cx4YI@5jCcTj4c0`};9{!jG5Lj@?Yy{YDD4JO*dNPS@i_lq=^E2dy1k^NyaC z+Ad@IhTli}J?u1Z&Nq_V(XSQn-yGf~@a{vph_uVk9NwegNjo2cv9!zA^Hcph1fDR+ z6nzcssK*%zIRGB($9{VkYvIjzc!$A*D+v+aEe`Ln;vH7JD^N(vxGD|WMS#M)1a{Qp zHsP46?|&nXY4mrX!{c>nHVd#KyfTM302e1XRW$WIg0=9bpmN&3aX9F+91-Dt33k-u zHsN{jN};p;{)n~khB>@R;7zo7xDwuAhj&Qvjw;?CI;Hxz89ZTV-eK4=KF&x;R%5b% z|I9EJ)~nUwJqaFMNrkcO;G7 zT2w~&+cDUM9e}9{d=n7eVmtC-+kbf3Jh!EeF!`1ahn!Z zJbu%jY25GL;`GNc@Q^hj!n@Jwj{)FG`|+Z(?rz_QrCBc1C@o(GHx;SF`JFI&Nr^SaL~-sui+DR?W9 zF2Zst-5g%lBRIE1Jog7N#jC<~8MDj&Fe^Ds?>!)}RIrW`AFnoS+tyA9v;7R-On-J0;%N*W=;Bh>ONPQPMJboK& zrS-4B;{C*_@Ag6A{ypo|w-G$??`*|uc6bND3-j-r4(|=+-$2FN)+4olj}H#o!maNU zuw&ihHet%QlKa2Gig&-m`vknO<6FJMo2hseiZ``as(-~8RO7`ttffD$g`M_qK6sOm z&hau-@h)iX!!AMKJ2uA@lDC&?}dtYox@uR-kBl(O?G%w6z?L% zyA^{2!9@Q)2_7zm5+e1jhMo3rK6s_D;&{GT@vd-qd%#~#C(eJ9z!@~j-k%P@!cD0sgJ;SF|p1HhXD zJ8o|`DE}G|hhSp7%pVcHzn|gQ)x)kg;zXofp2v2nd7EK3PK>Y?yJujh>)QzbmLi@0 zRVn}0IlN=w{WCKO6yALfui!D9+k!*h48^+e$H03pr2W=9 zyhY#hyzSty{ccgbu02!zdoUi1Q*lxH;}qCw|4KI}+i$Mo{f~3Lu?xJZ0>fH(e{{|_ z%E6QI%x`GYj@!rYaWF$L(SF@4!_PO~g`M{AQSi`3roIal@23uL9C+`-PDK3svBTR3 z-dY&3{T3=-aY?Fw14bw7NT%>kg`M{A`Yp-!Tda70bheLj@Je`E&D#!M1a@q{yA|&lhj$-%V?ua49p3Zcm0I3C ziq}|}>ffv24G7^q06Xp9A@Igo-fG30mfp) zD198>i{MHB-m7>y4(}j%8v}&-D?H!feF&Z$-|knur~9O~-_lFM&rf&2PPgBjA0&?- zUst^Q99}(m*M#`D+TpDPPwKl)@s3AR{W}bv)R9=x{{lPh-&5ep_Gc}{)zfmaG6ZXX*I??^1QzGdJo78usT`z`EreUE`B z{ku`|=nI00{Xr9W!XQ?3?5;9M@lzM-^|2;@urh<*fy;YY1=4;8eTEU?*kKT=d6a zr_0@kaygFJZ~PuP(-^+p;cW)*OvH-_Z?VHWpm;w}yio&F{d*NWoYEvjc!Q&^{))P zuzF0zMTD-$DA=40d>VJCoz!S;gDgKh?k4;Kk^e z74fyKSE}88utO0E5xc&y)AcAuxwPZ>dtQ}$io<&hyqW|p*)E+N-T?4$NH;uwvz%qI zf1{mK{p)^Z_;%hCcG|y1;K_bykK*MxyfW~v4e`%+c#kRGUd3DN>~~j!7Y*UfclNt) zfHw+uY`+&3Z-T>n47}zL-enH2;D^cUGJfY>+V88*_Azckc>gYQwvXlDNq@8|UX{a} z2Hve9{$20zUR1n)Q@mnl+`pQ}zf+xYA9*V2-#*3r$noz;8vj0U{F|hB|E_p3Xa6^4 zV)%7HFWBkv_b7O>e|}Z*vK-zt@P>u7U)z9G-e&M*dwX5+ith@EXBeiga#ozf!ypoc-1IFNOE-d(Qr<;OS(498|nr4sRED z=*onMe?N41Ws3J}#oJSs+J1+@!>&Cc!rS7EgMvxn3;4QOxxFUm6>F_>O^*Ewv?;SPTrpt zZyIhkBbexqgWyd=SVVZ&!A|pzfJcAG<8RNH#_(W=H|iSvZbzI&y710&cpri{40hyw zpm;-^`zi(3hwo1ZI`>t|o=^72hl8yN3>*6QH^rN6{gWy_ zcth~KfXkcV_*c3c&-sEw-f_hnU6I-!-M*4UmfOo$* zhqctV*x?-lZza;{-zSQ9CH4mhCdSJf;IZFDgm)?Iw0|>yn!GRYPsJ;Dc!$7SEikNw zcecZ;2X7S8>7R#%cJ$*ZDB8c-xap0o2@&2lDAeON=aoKZ6{?htLPcnDbfx_7}*XU?`4QEjq=CAsdi7N zvHO!9FW4O!c^-D$?~1V80xTa}J1O@l?BZgCwfJ`&#`HlL1E!_k_huTG5Bdgcs7BUK zvx;3wJ)XqHZsz#5d5ErM(uY3{o-a1z0AaEFD*O}QXh+`m9zi;?82?z0!9#{rM3t1c z(}S4d!-koZ5$6sW8JJAVzw4s$V|`yrB>O9g@_|m=fE#84Wq4mz($>qyotg|>4fwnw zXfMNKS_>Lqb9bxF1D&+Q(f$yhIMtZl?^MVw@ip+?cLP4 z!t=J~?9Mur=dEaKgO;&B^X+Ve2Ify5eae&_$2XO&8~M)c6$f5h?_d4!>dh^yf1KTC z+if{Ry#3j?-`5-~-r;%AoW5j7TiY|Ip9g(^muF7TSXJhIP}TLSs-n88!u3@J8!PH! zg$=Q~SW!b^U94+^U)M6>-pwd(ckbJn@8x`&v8tQbr>g4*RYiM^eZ%_=m36U#hR|%0 zp2)aA_r1(db6(2zZhZEFy;WW7s@jwHcX>PKy^Nq*raH41OdjIb`B$%5-HP7{kg!`ZM(hX@A>O6q#i2R)YkTRkLpeMnRbssM$f?S_TfcCMqO8LU0d7Q`U3pj z&=|jWI%2oxAp0&K+A7mcuGQ&|)z+N-S#Pt*u`G4j*i(qyn6crZihFD550lJV`W@l> z^Cy@2D7@~fj0v@W9rZChs2iOd$s3r5W=S*VhF5y^8T7MzPxH5n@%glSo8f6rrWdUJ zV2vW`GIG{8{nLPRA{mL+MjNK#OY08zvzEP9jgh>nVMlTV*TwGUfUe^>U(rxi6RVxx zGVa7891sU{o(#RpHe>v*(#-Il@;B@_zi+^|2!M z(Z-BbQEwBwY@qp@F}9y~RaIf1s)CQ-Z+NGnqW*o3?gEbPLXPfnW^|+RKd36Kt17tW z{r>Ot4>iJ1nKFaEz+Y@})3e}B?dm-ZIn6EO(1>g_8!<4e_puvy^$m*cuS(ka@-g(~ z+o!yjx$0!@<@d*KRgd&flbt z%iyry=4323c7Hu17sYrUtBNc^JJN46=uXOaJ)ZlC&ne@%9o#g%9n0z3rpmj-w_D6$ z(>lRce)hf1A7D>`%{#-pczE|96!`yk_IvECRXN_pPj|wwG<&Sx$AbE0*?l$YY8tMj z2>Y;lzadw)u8!(j<$aKm+q~_zk4DVg)dHt5?b5x%ICVPp#><}dO@+;X3B14#S0Z!v zpGvnf5%KgheFH-}8Z`Fgd_R)ECA%&ox6yCtv4n9CKaDL6aoAHUe zL9mD-X<(3Z>X7mw=ai2ea<0AvPK?X~bz+m{z2BBdfRc%Sd>13-RV*3iZN(;N{$!^7 zx`_6jl8MkVJ=_pfl4;)ln~cazxl2rY++b3YY2GHAjL7sppA10DOqoq$7$-7HGVwN0 z-rp7Bxk*G$qM$Q;nG+uDgl|zNJhbPbjq*h-MP3(k{m1YHD5nUA#UZLaY0vp~5r$RJ zl+XD*5vJo&l!P$6*-0OiNDch|v*T}$+Uqd?X-@bpC;!JzxX3B*1{)6QSLp4s?SWHE z)VG^=svRGtCfvi@rX>`ZotUHqn$5Or~F9%PTYKF>i@epYJ>2hn(Mp1=EePKq)L zi*E;hoH_vz`dZA2Ko~`x!9G@Jy*MryPg`yq)LE|)Rv(Eqw^hc|_9Ckf!1{8lv;3>A z9>*HD8;pG^*0Ze6yti1Lc^6upb-L5)tkZg{v)vxGI-BA#tFsD&N8EZ zz+@fGI0T>Z6xoirxfQceD=G2z@MPNjjKILO`I&)EuFsB!&=0AvY5#l^ZH{Qg&{;>* z{?J*RX>;ggRA8YE+2>oGJTt}+&+?hyKMQ{#%%4)0J!~?6F?8B;Q=v{<FWC(H<@f_JKG^+|@qrBh zF+L0lbaa(h+$GStqD~)}jXHhc(5KFP1FTNoc&oF_DOP8h#)n~0AjXGt0^Rs9JkX5~ z);HP|pAy7#w?&;kaQsoH4;&WM$uNBfo%yb`@hsEyBjU+Ue2rzs>?-`n*EyE)!`k>3 zNFwE?8FSsJ8ObQ~9W?!A6Zz%|KRseThf+0tUdnT%)K zr$o@JAY#^B^ivqXd`D(sBE@vyqNrgXpR`uI?n-?4QLL0((yI6b@>G2IJTa)~Ou97sZniP= zrSFtn$$gCd+M5)~JWdpgX#Y(($&jdTib>k~y6mJQDc=J#&CXAfNin9;8PU8#0s7noRI}TD;B2EOSN=7R2m%1d`!)1_&zdZg? zp26bUm6?>_kJ#-*ka|3b_735EW)gHB=IIa9c#M1ii{@RAFs~s+g!eT>Xx=cKpe#ik zc|7kD-sOO6-lGVNLAr?W#=%bWo&;|ijL73Ti13CwyhGr`XXLLc(o2Mu6W&GEIiz^Pw}r2 z3Bn*#bRTxq~@W*YrF==k?25=s#-LOaTvj(<}WkLT>d`w})5-F|zJ!1G!W z;avec>T#Pe6TEWhY(HLt3vZyqJBWliHV;?AD|2`cf+ypJm$kyX$f@r*^&c)SH!YI!lmJL=STIl^J>_j|(YJIiURGwIS2kk8eBM$7~#M!u&hnY##$~+>-V?Tk(GE@K%DyduSr! z-;W&L_25bS4TQ1ycN-dy?Z>hx{5I6gKsA4v#$}c*SCVevK|={`DEwWgo-^n1m%?#M z5xcWcPDT)A{!Rn0)|P>$H2yK`;30N0JQ~Oe=gfx;4<^r}C!RCUi9M z^SJjQco!D*yyv$S?8$1&g3f=O*X8_f;hrq72uoL_T^P^u#$fSlvpm>(ap;v;GWKM) z^#!36?SUl+OI8#>#z8RWbwB4p*X}YCyN_h=XlvVEU%(0zgVTgAVP`H@Fo>cQV#Z|MHH-p8=NMlL1htQ-KZeJRt6+>VK=$a!^5 zwW}Y@7~Qm|q?@-T8#&B$a$+XYv`gf3h*z_YDm7?3X~RTYGkQM%)S};Nv%DzY=XL6y zpg*Lq+Tx~<*az%4{Pl)!@~R7`cl9vCjRJEI<$3-6Ycd9AU)9x*WEvl;W4m+qXTQx^ z#NGKN&z&N6b8{#E_;dssW2<{) zeZpV+a1=2ORdrc;>$5sZdcH~ToJ^lsmzA|XD_hcYOnPoIy|OOLTc71idWK2QOr}?K zoPT{*W^-1?&Ma?lmfx_V_P)aH^-=GM!rF~~(?;Xpf}Jgqy-j;q$DFa5!Ltq~usdsi z_JKmQ!Q`7eFThk!Q68dK7iFzNw_X@nu!SbC>4d<6Snd6sqFlSPpalbG*`~I(mmkTA z^lbGp6kgp`x%Rn&NH4Ev+6)0@y?ez^i zZy!2;-=3=*r@rF9+rsVf@|>+%yDIl*FP-={hj-xruByq`91HRJ7^tDkyhq(6V?p2k>N#pIbEzx0PTv#(Wc zO?7w`3N0ClY4Y`td3ZK~?b*nOGjOtTZ}UzwO}?KGCP4kF{n; zGD@ER=gUu-r#OzcF$@x!xs~midoz3_FoAc*=wk=6KJi%P4 zl4QjEWfQCMyiysTS2~jqf}GJ%SQG0vJytrpr8Lrc{62WLHS5_ba?Rc_EAf!k<@qIt zGmzZ4uC^g?p}4N4)I2=`>-wsJd8;4HADe;AcS(KK>SCV{f$XXrm~%ny(!$xXDHW{~ zOAey;r9s^<&!1fU4}?Bwi6Vl9T!06x?#waWkHj$_*RP0lex|Fx=7+T}?}6d#W?Z2p zBrf`>ensPgH4P2fk*rm}GVPRF;~$GUFFpM23j>iq5_iu^T0YF|Qiia%&6V7>7$$;iU@*x#_p{e1g7R0N=UiQa zfc@M4Sp+woXJbkEzj!v`LHH%YbG~bB{W!nMX9qH^|GZ8t!rg^sj{RNgM3VXQ1co)k zhj3mg!thg0{;#C)3(b6sw!g^+O0nkLezn6>I8)wEn|{6VzlZl5$G-_q{xTb$YWTgq zeNOtbw){ROJ?7o73S@n9Z1_!+-p~884gbP~`Z%p44*wnoZ36D%9Ctg;vMP zJZ-{wUcdCS@hpeeAu{(}VRg322&?lt^8%|6zl&-`8h5GHdEN9?t4FbJuzDQpuUmZ#*4wQ<9_y#A&hnqPIjr2*k-Kb zG_14Hj?`yDr||os6w`*PkK~yIwyDe`vrYXXTBptfvJNswOrLyv4T9T+UNONC-XEY& z9YCzjJ1}WNx*39QxB%XP-WA^^wr|`$pQ2g3jOmQ6B@Hzl)>JvGJDG*>debJQz!OP zt25tftCPLa>SX^^#lNEB`MWoAXkTD;+8h7bDG-(+z8RnGb0EfN4hjf$&Y@FcSY*z< zztzb&*Xp#LWOeck|MO5FXnHemPTjN{{?HfRE0p^MJ88H`2d*+*NQ?P=N;HpG6}#*=Z6)mi2@tWK0^XDBR_^1tCHtHJxk zlzv#Kv)<=1&GLy@x)#kGe?Iv(#lFLko1x3nqr#3%96PzqM zb&^@iPL7F$d!{_)llDa#x_xrG+2^2MDHF!&DwJX*C5fY|M6nBf6;UYv4)BRBk#?Qj9wA#M+6EwlPy?dy@@3b$->%nbo)6GrBJBH8G!J3#`g%4$KxK; z$m4GpwSU_Y5C)PHI^1-9?xkskJlOYG=;bX?-hqPMe%Tokl_6&BbCQ@ z6YzL0BEE7?Rr@y+ym2sMeR*sb|28_jD8j6pi0~eCcu#^?3_J30SWED}?C`n+APh1^ zpWyKJ*kdDkJlCQf+tdAydM_k|wV(SP^?i!R>lopE1v;yj7^g_!@mYj+lxwh1k7J=6 z0FTFa`lshkd0wS?qmZc-aU#MSh6v3&rg%IrWg6?d1%q4jrXhjliU{v9*lAwgDM7jP zkL@G8l@4zy5_kQiv-T-fuosXx>urqKFd_-f=`|UK~8xe*4-q^4`Rvd5z#P zPDFUGBSQ1)!JCFS`p5HHrja)uFwL8fommv|BEq{EMw)j-`FAFag?EO-TMHhqr$vMp zb9m)A&P;<5{o{3v@a9_{#}Z`*Hr|jX` zySb+1T6<^wn!05*L$0#7vKJ6f5DB= z%caB6LML+{)HJ32!~32UDnI*EA8Q!?yS3#$k@q3L;Ml9684tW}rBq_!eaa_HDA+gf zH&GOyCm;}xp_F?YcEDlNGWVRAPVwznHugL@fG|op)Qjy{G50*6)Ano|Z?k*8&C6Q~ zJkK*?uSe~p)`_d7;0a)LCdw0WToO#hW$M(K^X67n--;94nyR_87U8#e&gI?7*d{JF zZu$(+6WJ!9__d(LRxMgoQ$2n0B3#F%o-fnMa5LwcW>Dw_N9x&r)tou=W~7|l&#A^U z*dZtPw%Jc+RfWN2yVaPl#Q0dC2Ars7EWiSX0wclx!UnLCu6`dn^JqI68?+X?qgIbI z67nH3@tlOWGU*TPcLEOC3c?!?UGt_O%yLA8cQGO~ zkLQA=h@*cv+$4B?p=;huge$R#2#>d`G;f^Z>2vW-u+zNFHlNGmHHqfU0gv^dfBIZ} zDZ-lfB*LXwM8v;^h|s*HipM<))5zy>iM(_oah}oIC8Z94m(m9WgvOo}Tzv**d}$oj6v$2k&sq zGQViXI(Zyh;o*f6>tlt@v4SlVH&!-OG{ovFG0#4+!C!&f*}RBeq*QlyatrGrD996 z#88NRu)tIZ^o+vDf=HJFNxv5g&gp#Z4+{TXF>B}M*?MV&9(46kjq zKC4ZY*Vq+KG&i+vIPdfId66C)GaB&Lg3I{QhIY-6grofWj2pWbD!XWJ(4LW=&t|x73QF=f@QIE|dSuR>=u`Ug0-rkRF)GlG;bSj>=2*7uZi=mjY0~thZNcobZIP)*A~&9g zI#9H?W!lb`>ziAqtZ$iwm#)0q)b{2V&TozE>TE~xx{WKgEO@r+m5HxZ)>q*@77MTq zt-xln?j-8*zqxIoO}d))?s=~shG_B0KlUQs8!{sKtN0RuWokSAf6RmNa%!TG_FZb) z95%^Eh4==BkkQ9}gk52RW#5{^2S?1~MA+)BP2#ZEUA_*ab3w^WNZ@1~$cc zrYVw5ApEXqp-dR=e1W!!Iwc=pv3?W?Y(HO%5jc}DvNlCY8&x4|Wo;sXO$ejKTejeM z(Yq~6UvF8ow`Km$mO0HWv)8xGtZA86*VOjW$jjl#)xRAJmrtl!j7S-%5gu?1uCHH^h~oUwR(L89P9JO8W7O^m_r9Hh;AyQBSOAKK2# zU_1ol{N(L1#?Ws9ZVyfN?f;5RNwTc)fzN$j2KIS3_UIMt@R;EQ`)Lkm?EAUBOsH!y zyGi7FwhiX zi5&$WF5HZL-Yu*68Yc{cNJcYgiD$r)+YigccxBs!wB7&7KCGACgx)i++DWq$W8Vei z;j`rl#ze4VP}{O>4zgbe-qZl7;j|?Ub5pHBy2ySF9Rs;+>!hlY|xkFq!9iEcYAP+W1ll%^R>U< zV{fe3wr&5;o#6h9O~$n>X9|*%X`UF-VSP2rYv10Sx&gx z3D0%H3!Ly`C%nuF-|2*L#88rHo(xGwWTt$fk^bMGOoW!1@`XBvA9B(+I^l0R;Z08X zyH0qE6W;2CcR1l6IpJrW@NOsE;)H+ZgkN#O`PWYEj_$?>=wiABG3IEQU&KnvK z-ghZNi{{wpm9kAZ3qP)4Y9PD^aHvP155cMkxvp^1@3HA;n)J@zNGJWLcJk>WlYXif zb<%IP>3m+N2zShvsvAfw|4JL?J)a`n?frxGA3<~f_9r$Rr1$iG&x%=L{uga{DD)!E z9H|?|O#c;Mo&n*UQW1Vt`2ZWj3e)G?FsoUFcXHkA@Gr7qZplTsgL}K>5yAXd*>I45 zu-76tiER3#HXNi6^(yWDlGQHq&hd`f_6fqny@#Fl>uPW0^fC75dcU#HnIUM(m*-3e zoAe93Iw$`Q8bZ#%QiQv0PdVueEI&xU$m2IFD7+6@=S`zxh4ue}4POVn z$h*w@_fC=;`1hm@2jk;PudPdJ`kOY)`JN*0OI{b=Y_~%G?|2gp5~N@4y{~R;G5u8= z?hU=jyUx4a>HlkNnD-uwFthnnxmkuV^MA{RgYhxLyU6LkekuKTlh@DEuamw4aj(zt4uF(2Kk~ zylu|-F0orlJ%^&8kwqd$a4k;QqKo)n2sBnv=KmPu$NAUu&cc$I=Y#H#W^8b5;&ay`{+K}H z(BS*fMEtRVX5!Ux${!cRa}1`uPwdhlo?Rf%Q8UILui|b0nD{G#_;RfHe3pnmAJAUySiP@r#0ZR<)Re&We9qpqTdI0nm!SG*C=DH*72Z?SW$AdBC&c zFAo%UPjS>nV|&`mrKP*(ifKr#OGkyzN*srbGser2GWa=9b6;;#x66W>o_!KqjA zXQ=o!D*j9re_x=RaaGnnJ_}L)*MfLQF{jwC^c&tZebo!85GhA zbYc49>N$(>M9PWV_oi95&Z?6*iK#{9+8(HJL3PnRWK5$c)p#IHg+ za6Z*sw{U7oySFTcG_vWFd5ag#Uo5{J>7Zb3tc%t09dCZdvijDOFDzaqWWr%GB9a3ujL~$zt1Q(Pg(!?bw0OQgS=nbnUpX`leeyQ=Qxl zx<(zPowP@06rE%PD_iY{ite~c)4q)~WMfjcx-1plaanV#W}NJ}Nt)`ClCd2Zq{o$c z^XG|=h3&KGg4?Hd>_BoDoMiEC23@$D)^X8xdrtjX+KG1zVy_DhMWx$}%qS2_;9>`* zrdaDTQxZC^Y1P7IcwsD_lAIy0-8^wOhvZ2qJsmP#t!)z}ezlkK^S+Qx$g$UDJ4q*~ zJKjT?cx~^=wYK=E%QUSm2`4Bq*)*vcI_l;2c~VMmpUfspp2^|Yj`;23!a4JB@Rlch zJNA-K`BvS8my?<|37@cG9P@O&Y+f$halv{I!85yC7tftKZ+_UbyUxjQx{SJ^(%E$E zQgXlXnH&nwrrim*=-3%E()et1_)C&QHkEccv+7eje&{OS>Gp^md6I zm!7&G4gCRZNc}@|X)i(zI`+ggTiB0wJKBi3t4YnHy-15pw=t#e=RRX=*j|$6D*T_)b&RO|w!!CPP?4@(u(AV9mDebPAlgWeJ-))$ah;$vN_C4~$@)MnOw9lfOwtZ^Hy=gbJlPx^e zTo;_0(s7}Qv3;_|x*2rAZd%7hn_+&k#cE?+q>k^nII{;i+2XXZE>6dHT%6igPJH&< z-ZAl>hAPvPA1rlv5Ff?5w|=S>bEAed!0hZwKv^@GfUjCk=NOGuHrD0o_>PNHJ!XoXgP*;fxJyEFX$L|LI`$;d&7Z-KkUZLpkmQbi zuzQ@)*JY$X19RS*LBlXmx=q0hj*~4?8|$j-_>SvnHvN+=P8;jubbQCfaVVZ_Y06d? zrlLD8E7;8D%)9j@hOn~LWvS?n%d#Wf9{f*wlS#EtHzdr!O*QRcx07m}j%j|^*>Rmr zui`u`^urt>O?QG0P+eayk?F7t2-=^oNEuk}v_(%okuqkR<(S&8L^?FPq zx_0W3hQypKKPIN_MuDOpl}OmViTQPHHwJc677G^rb=XmlGZJzf^ZOC3k76O0X$(K< z@WvrdO{pe$k2}09OfUhO9g z9_Mj|_cSKYb^CFuH_X2suw#523#Cl)_RXMy5 zZJNuw-r>a+kB^WDZ-m1;j!I_E)H*|;z3RDe&lR#Q_}di9d_Ek`HF|3l;GXv@c2%fF#m3M zc*_-!yAP@FbJ$pbNbEP3r}6J;*lGXj6_1a=2=9J}R|}qc^ugG{+^ctZ4=NrXkrCc& z*iUHxo=W52KGXmIJ_qnkB``he>Y+0rTsgQ#=q&X)Bf#J zync#zuERSB9{XQ}49YNv_oCvRiFEOAl+z!_)A%>S>5o?xkB{vLFXHe%0q+tzWJUbT zb$ACA?`+r#?-Hj!_|5@g5Gnc?r$3G;9v}4)UWvmS4_;XN6*{~R6_1Ys3GV?YsA6LK zn4QMIufdLa;#iDyPaco>sF3hxI6S@+AQS%+?>}swIM$R=igy9R;vbLS zn)gW>|Gs1M#IdG~Q@k%CEWEp*YaUMq)uVX{|M-ZZZof&2SE+a$znaJQZ8M*U=rgR} zahotr@h(K1_&3tw4M^kPP=_~1@h(!l9dJ(jHwnBv>jPKf-xTQD?)o%#=ODATn+ZE% zXkIz&7$0XOWU2Cx`!}g?p2OpF(bt(A!5?8~I=q#NcbVdS2Pc=>zZcW^_bu3I|JEwr z<%)Nk!)pbP?JFYwEpT{`D&CbamiqoXPA;{71xOGEnWDb}JL+*pLN+VjM1+~f?d=hV z$LF%uBbf=_HyqwmiuWbOJBWuRwSQy4V_71izX?0)ahtG5@xF{WrqRDG4sRS1!u;cV z{WNc%;$5wHFJs(m|M(t4<`WTpFYGk$fZ|;PW2Tw*b9l>pqaL>j#}w}d#4(Njl{&m8B=og;xDwvy9o{F3H`Usa_YfX-*8aT+ zfG{*~E$kQ{XCx#K2UX@jilqt*(-^LHc>ESx*!kZ~hgYn4GZc^S$J72DL6~KUh<=)l zkK2T(;>|)F?dae8*j_d7C=y_r5aAt#9rd_P8K8JKAx?PHaB-t~dG@@~W=r^b9qcr3 zq~cX8-Z>600$!MZw^5cKX#?@Pqv#l@=&%b-kk^w?=Te2dmcR8 zN=u0N_ZukG<2L1a#p5|2)9By#o%4+YY5e=1bH354cqyLC1sc+QbWnmDoKaXO$7mL()=BcUecRY=MQ(?zEaV(Sq z#k(J2;SF_opQQ0`ki+Yxcwbk%35eI@xy)YI(+7&w_cGXN|H>3^owZ~A`#QV<;Dzm9 zKIia;Dc%E$_wRse|Hh~B?-kf-|Kf`Gkm7yY;Y~>6-@^`Xyy9(8yjH|(|M*^EX)~B5 z^cP^K{hOkA8x`*nhqow=f8TI;GZpU<#T()rj~-0p-$3VhG+*()sd#w~uMxabq>D)1 zGacS?#rrmlX@@5EKEQrlx8L(={Cf{}y8Y@EZ8 z9J==J7n3_IqD+l20l_anp!ueZaCfEVUp zcZXN1c+V(ale0e^zVCiKM}WSk1F2J5huKL&iQj0!opxy(eJbI zaYjNmE8c#Dg*VON4L~@|zv~>{Q;PQ=iZ`TlYJKZ%KKeir{|3U2dYqAvJ&N}l!s1_! z!(+X|_Rqe<+oyQHP`nqN>-{&<`1e!idjEjp{ZjEBad-#7>yLC1sqZ%&-eJXi6UI{C zIPTNv@sefhHliuab{l{h?pAE=MOtQ~`e4(}7i`!8$9= zzdSsL!u&_EysdcmIJ|Q3qDU8!_N#Sxe7}P5egk7^zZ=kay8R}k@lWQ}Iy{+y3?3W+uju-OQ))kEJv7wRQT(4bUu!#weZ#=c+Fa8}5tbL&J&dd#s z`D3&3(&5^B3MP*WUbH%4MdjqbeERCr!dD8Pja^bv?MF&>Ha!XQR=(&I-?JXZ&xCK~ z3x*?ktGoJh^YCTuwFdrp4}V}DOKmo99L?R&9J}*NZplLVCPx)+tK{It#FIbBs*g1m zZfG1**Hph|kpb?`ZLKhGz6>m0H{U+V+MNqVP7Zv-7f$+YyB+Rs&Vv2!ENzXKri)Xu z?tQG@za-DRRX%9IHneA@)1GLvWrfxL?3PIGve?cdzq!bJw_!a6i7w{$AFn$?vJ-vogQ`B*GWzZVf&wGcdRJF_x9Nn>9v!Kz$uwt4SJ333pdE zJ!$n)gTeUg6CJa4G=L%@5Y~br@GA-SOptlJB*Z+}_rw z#f(>eq^AYDd^6m0c4xdzx8~-TjKxRFIRX*FU$a&4jjq#8KR3Zu(Pnp;N2Fn%)dZTWKiy<=tVg_Xxj z3+q>$xhs1?TidEGUfm{qhN$-5g2~6Tn`1@5H0(f^Zo>PzcQp8~|J(ANEu;3flq3E~ zm3d+Jo%tgxOFrs6Wg^g3Xq_B`&haLn=JmG(Gzd{<+#;hH-E6wLZ5|53b~Unc>4Mo+ ztNT-*Qn8`?S!P=+7@No8!iXMNZ|L5&t{EAk>wn zG$;qv-LeBV8#i6E?wVNRrj3P-J2v{Sw_5+1JI}oSy%RpTH2I^y1m2rY%t6eQiId;_ z;L;zWmC&nVOpW}6+0@nlCGD;`2>ABFe) z*TuRu#IA}JqXX7S&z7PryG?N)fYCcJyV_rdSNogp?OuUC$V4AR@Hgn*m4%J5)f=yF zZs|U;t?f=YgeqlwfgN_q8CjP;19KCJJcxNWWAi%nlNra8i!xBd&Fj|u>fM&^AGAae zzsqkeM4GW(g>$@Zw*b8W_PM6mTo1WTU(1>mZu=XDb{iXULHoL%%<*n`RmR&{`!ny) zScl!lLj`y{_$F-M8^5@|JH8*_H9gD2T+?#}@3gi3{*kjd;%j18Tot=~bZmSiXL?m- z)0Tpr-Tk^vS!-6j+nT7oX~1QLm&C5Am|hjHi&fU=b*_)RGB9WLxu>F>H5>bMGP|t$ zrrCL@r5#)50E;oYc5@V)ivjM=X{|gk(X`2w*yNoVJ7aO!M|uVAQi=A+V$=5Vcg8B2 z5J791sFKl{ODn+Lnr%i33o%XK9E;mFjm4`FgY7C-$tK3%9P~O2QB||QA6bZTo4vH+ z?c7hf^8&WyQWW;mAKL0O@Aw7|_^W$7-e+6&OTTN|gQh>k=J#=8fTa^pgshJ4@z_0k zupGj|_&r#PDCOnlm8YF{TIIju17dLHw>YO1Y5z`XoUkj&^m0{*�%KFlL&sStd;~ z&DSG!__SmITBi9rVlpZ-WmcZ)eUpjC{!Axa=Dnf(FF@)xbppz8AKWt#VR*M=-&a+U z>3lX+gyC}~fHlJ_o$yy2-b5$dVEH}R-+1c%HJg72*8C<~)RtFe!kxS;o$~+W)MupQ z?;a=orV~~;E&vU|qZ2oz_-IYEIgG90Th17yM5+C>QC}miD z+;5}|z~U1IDaYdDzBPr{G(MhTrLY?EK1|$>N_;bqmu8H|ttfMkfI6?SZ?N%n<7TU~ zh-Fr%{ase4{ry&FJs!0>*^gO0iuH3=r|%rsEQ`MX$?Bz8bHB%U)*}~fMxFJb_;z=| z@_ZHqp?^|e`X}{ewdFmZgRIW3CX4a(|01iCccs) zuD!-J{n$H*XOwSmJV&X2K8QDcVaJ{63+N1z!)M*N?q_xK&aygr!>mqUzGU?%*0Ze6 z_!_Iz$6Bki9&4;ln+;Z{4Mp14)XTQ5sh1r~re1a|(Wcmr>poT|zs&07n>L3H>owfQ zGv8RNlYNEN$u{k5$3OG?G5moTf9y75{IP9o{9)k`)6Uk=NoMpGOPoEI)2_mOswwEdO$=v-~Qnv;3Q^9>w}LtCwP3XZ0x7rv1UEJw@7_e)u$o zunm27K4btE-`2OB`WcM1+qFHkjYQaICdeo(zP%9{r*7M140YRgtc$dd>APG+K$y1} zI(_-F)$_2fwmN-TVfA5HoACpC=KH>lk7NCm)mi3`tdZ$8>r=z0V-U?}J^iyybg&O048nGiex$q7k5THjA88}+4IW{2 z`eybC*r~A0sWzTve%0zM^BY!Y+y21nz5`xW>D8HU9lVpMM=^`U`2in<-caq712sGi4Xg(y56%5y_8 ztF!KBTAi+%Z5H;d#{wJAdYEGw;#rTCHlFoZYxOABPg}hd>*uY`Ivun+eK+G49Qyu& zji>MbuzDQpB924YunkVLI@_SPCqHqWHDmtN`Sb8<54>2l8ZX_PUVUp-&9X%D-1*hv z3CVmld}~ffwy^kFGiKtat-&vj6J-!JWA>~Ww@k&WIq^eO`x9jI^Ivh3KYyiN@^vK6 z50y`77>Y~2fa?S}Whf=l9lQm_yhv2X1?_l(dg#}uoS^6wQ(cg0;1iV7?qw_|C@jRD z4X65w9cX^1Jrh5#W|I0vw0I}IHD?}%hJD{EK1D3H@`LCTo6D=v#FA}}8qcq)uEASn zs*`?koTfxzq|LT5!H1HQ2qes?nuC`S&6-g&D~T{U`2H~S(d31RD&rT|ram<_^J)^2 zbfkLW)Z1s(%sXKN)XbXCuNdFDsA^I5yjxGu0j9~E9Ljau_z6Gg8GWv)x)q;%PDIna zxr^s`9lUTypg~_HH%s$^&<>ppw+-385<`XWA~+#3@s5jh4T_FWzVQxwgP9#MLyhP0 zC+>p=jbFH=deMy8gBDdypEGNaZiuj4DX(ft7|*F%bmP35xn>0D*RrI1bXpJBlmrgf zln68UoEYpC7uVc23#0hPdBLyrZ>qtlo0-zfH`UBrJbx-jO(GhD+xgTr{1`OD8?jYjF@?3Z2JJ`olCH z*C#r>If&zZ6A|H!cX)YSf_rP^@iInuJT7bh>Ji|%fr#*UET18)c7M1=QEL}=cF;PD)ZJh+549LOaSwu+zK)iWft=@b*E`yaMbj#u!5Ihjx^gp-_)A02zZpw-#&q*B1-Z z=wCAw&6`9XBdpMl@=Ykz;|xIF0FU(`uOAksk@q1KW=C@yY0L|*&1}%vQ9mE;pzZd- zj{5--ap8LaQD@&%-h$oCKsA4v#^v|6oh9i4?(~!h?<|ZD{ai^Cjz>&mJt$)L3GAc} zjE{rIZJp_|zv8$ZJoKFM&+=T!h>BtMIg}GWS8~0*ZVirwWw?jud!M$oeM*1A1oM}T zd}3hDmbz_ABKJOielJe0J>1mTsi~9sLbd0u3Y50CvAJH!TmCA{K;g^Ph{q(O`GoaY z-ztarWJp8Cz`T>2;Oxk+Fke;NUC=Y&dwoU;pI*U7tXYSGMTRHU{c zXp`m_3U-?Q8+(eE)H{3TF(5P~9*Mx*Vqk>oXNwVZJTxHj@V!2xAyYjO66#_ivLjz< zl<>E{8RHP$SgE=(7;or_V7%e^vOsZ1VDPQ#ptJG!WGC8x|NDfS9d0WLKk+z8bL*#T zpD6g-k9+RGjCOu}`}TE_UVEM^DEYn_Vr!a~=8etbLkhjl-OxQNl81hdbZ=T(cu982 zQ{I4{=#H(y(;`cr%5L6v8%Ab5XSE-e+K*j_U9TO)L0#S2hi!l6yTo9l?)akovg}Cy z$u>c<0hBh}&%6c?f?b|Dq@^H|y?4_DP(5VoVwEt=5nQG1F`IZRFyVD6j z?}X+1tjt6E2b}a-HvB`RaW1{TEq{gy_ciB(zV#WWc8U3Do=f`NnLx;ud-#l!d-%Mr zmbnrRGtTo;aO!MyVxv|kufNq<&Pc11U1@c)FSR<^6d(Rxj5S%*zks#z6Z$#Oji1mb zK{tL{-S`QeTb%LJ>fGOva|YH?r5irZy(xxoH)X@O^N)tliyw&L69zGSyJ;JK$b4}r z?EEPHK+3TAF{7IEUcXPEmowg0d>HkBZ`k>j3x+AOv@+rZ2{A)fB7vhl3zgH~tTJf?IrCk1=9({nbS z^=q{{>qqf(f@c<3AL>_Q&9bR;-(%VzI_qTG-|FPj2FLcG{h@DyZrUF@$4nFpZDwO_ z_?Ww)7=FJ%H~cdK-SE#0bi*$Tbkn~aybx3=F`vl$9GpWWJ8E_E23VctTx4~!Ct98C z8?0`-+w*bgV%?3O&@Y2-{Dl5R=*Caz=Rr4qTHW{wokP_4X?4>M&{?%87V@bZzC8>Y z{@I9x7(N|`7(NFS#PA0Ny5SEFbi=pf)3izFAl_{I&=YL}o$UTt_{~$6ImGH@pKo=t z$5@@^Utx8YL-7F_iM8<`I^8h-L$8F+GH5diYvaGwjsMUS`vI#P|Dh+^$Lfa9NJ*tTHf7NxO;9qg~5sqjarnZPI`Eq8&B#iwNnhPBXQOZ=c_f6vTVmVvFsQp z%63fq*b3J&*)i65P|ECDM?Dh$DFN{{v00>=wVRYQjS>15_jaTdt8`6fjU=;eGAEWz z=0w>hYad(TS|*#!8h6-8A+L-V-;zzFjMCL>hOv>Xwpyu?tW|1^tyH_n3db&4rFN#= z<)lo5n&F18oF(QXZ6PT}h{I6RR>>kvH0wSiczZfWK*(e$ce*Dh({b{UsZ5XHSW&|h z3M;-^Q_rzsdziJM;8?)GAS|vOk4GXrW>9!OLOqU!l7;i5aac2+{xFTl5pz7kTFRXO zeF_#4;qlTz^Tvb6V-R_)j_|$&o&IHDp=`!dYP8^w@UB2m^Kb{*%x{n*8kF8nBr$OAgzpF1BGK|WqyytS4GjFEDLORdh8 z_;;_v+YFx6mzUb&AAhT$>&y4T4hZ38!j5_3HjU@G!t04R;r$LU&8r3Phc*va;@=?{ zX&Pc9bcOe_0rG;-8+MjKUx7-xL6f1BCf2yq-?` z%?EE3Ea+bh3+*CU_#R@-n}dWIh!+vwM~;6_Dqde03$MTBVP)i1B*d-GmGEkyvs`-` z?-gLDH0`)v0j|&vmmm+pIBft2@c=BXS%67zSfWbpY z4E=2LgeU*|^CxYG4Wk3N!W#td+V0xZ=4I?bukFF*8An~J1oLf6{dI5`zu@I>?+Sv+ zi9>nbOPw(Hhbbj9Z4=C}^{(4gyQX<(Q*AIM(Y!YrD4Zk2J;q4qz0G{Kdn+dqF#DL8 zHbgm`X~^JjG2hO9kG~~1^B7_NwV^3xZV7Ftn>E#WgnSN?5E)+OV;*sech$Bfs}_6J zoR6zr6;$CmH5s_KtG}}=JzM?ADOYW~{lV%oPUYDR*(E%Gy%ZhZu6?vpb)5gNpKh9V+ zn)jKS?0nMnrrKqrhit07`ssn^77l62d$*~UKVe<*L91zYc#7X*XTp2o_BNBN8Q!wdXr9SG`)4G3U^afK z-86gEp0;J9fnJR!%0Uy2U$tTQf4%e^hS9%XKFhclZ;|KzjK(}nftS3Jxe332-BN%t z^UTBDnp+FdM&{?tX7U?NgO@4LVq>uBp3>aP?a^AuL?L+C7RrJ)Or(`e$L~$eH2Wpl z!IZDNE$TT`@y%W1H|u7WQ+6KbVCS*Z%n`yl{094FF9_MGQOp+h>Wn%d5q_HO>4yB5 zD)b(v;#~Z2clPK==D8K?U;30k1m9Tjw`XIhrPnFm)U+Kc>G&=3(=| zM*dQi+Z|?R8~yQj*X)g=)bWwmTOyTa9zKiXzFW>E%!JK07+{mXoW-5l&ML<3&pec4 zj51p*kQbhrV809jZOyIs;WaqFGgZPVb75-?F_G+D6~U}10vwTvCK}$tc5n2?=Uu$3 z6Morjn|o)Ase1-~o6VizYu7}34(++I^O(tx{gdxG zs4u{-3_r={_Mg$*;*Ga$s0vGzih1`HS$vN`U2J^=UJ$UZp|UQvwxMErOEi+py)&wt zvzvP|Zf|%M0)Kb@9=Cn`^1KyQZn16+Y<BSI!j;}r=SU8xVvgEhR55~8CY{J_bS^yJU=hORhp^`3Uh^DUqCD#BI9uWkFEVZuGVzuPb|T2kgc^Jr(8>bb+)t2MY5e&+jzF~{Z?l? zKVo&Z-*&6h-+#Ay6zjuQFU2|^W0^j)EeBbhZG4T@nfGp`e?#ftwt6{ip0YaI{%8Lm zdH(_*Rdw|b<7Z}aBMdqdU_dVQOhj&i&g34vJek}Cy!?P_1gnos1SJR<0?4KCG)$FD zg0?XhNm6Y?>Lo;xkXjoOsYz6bH1t8LEkIY+fm3+WcEsPnlX@zgdJ?DXltbav znfUv7QfK1N;3>)s@YjIr(*G}bQcp!s-4s1_CQkm;LE+Rv(NhOSFUpVPpCSDzf3^vq zX~J)m_+Oy+91~7kkSF8LH{o|E8ax-8@I@wki3wk(aPTiQ;j1P7F8tS-@Qo7x2>t}h zKoE71h6e~cb5Ru_?CdshVP{zvhB0i2;m>zX;t_b#{=^w?qQn{RDv2`*E)9}~d3&A2 znI=J&p$?gNLfuD4N;`3IkwI zN}RfgwhlPsF&h2JJ4xc?JwxK;C+an5DEm#)A5LQrG7ze;LHbjt8i`Y<-4drxuS#6U z^R&d7F8dtHz;p@9R+LrgNE2{Ah;Rpf#2HRd?W&-c`A%6a@gi8{hvG?DRa^HB;3MP^ zf@u>cj|_>EcD}^P?;eR$cWwFN<#!iiC#Kl^7g{+muQ{Hxw8G16%>;w(@-xwduQ$qz zhK)^p16K%T(A|vvf3cv)X!4R<^NQX1nENB2fWAP2Ev8xvst?*-;VA0}b{wtNJD*CxpgRV86m;CFk zd75%ZtqBg0M&*D?MrO|d+Vf|{05YXuI7^Wil9I`oS4EJVRASQ%%J1*8)5twnfO7}5Wng$es3X+{fPo4-?lJ*h2U2QBFe{p zTj{$wjNdfIvnp==@@)*`HyTW61M(YY;`fr|r&w^Er?{V;NS98o_nGZ?2aH!N`LX*{ z^8Fq-yhG)s0sI)IK;azQn)$s4p;UgD*WFq`XXf`J_zjjHFNN{@(8N!z7m)vH#5eQn zgq!0M1xmiZO1U#+z-Qn$0r+(M%N->ZZCxKOGBiIMilW^@!lE6Z=H#sdEMNkyAEn z_Naon`M%)=-U4?4j#qAM8^I}LuFGJ4|N7X*w&7;?kVfO^TooSEG}k@`1R&oRyEo1? zG`eH%5zK&N?pczgMg}dV@j+*)wP^PStV3?E%nVp!?iqbez%s;`{2n)Dd*zh@r#K2W z=(y)}e9$ZC#snbNP&bq10t=N5d&vwPLRvwEe%DL!m#2<%u= zcJI7s5nZfSS;vho*%qVU!3z<$5VGfinFQX*T;!9lkJsbi!$x+);8{#(-Wl?ZN zQcHf4`+!G^-&lXyUg@1UJn5cQ3j~9}j)i4M-fhJ8t`DFE_jR4+gn!-`Tfl0kHLtO! z?jME|RyX8Mz}dh^(i8*ho}n17sa!Ha)Z8&xn=7ys#V^=mF|hmv?`CdzFh52cTN21$ zu(Yx4`Ludyhuekp=9(6lMJvCJy>|CJ=A~jd9DPb4e*V>!V7&e6#bp5yG!C&g z&b+vBh^2AnMHNG|ikZVm0V(F=S+=e5g@)#;#us+~JU!*zqOy{CGc|aRWpLTEkWH>| z!0+~s_Wb!1e=_2pyRTDu#D&h?8<_XXXCJM+JXY#O2lblodi*T)WC7ap*FJk}?x{Xh zK~Y9jW}>V}eI^KI%r`4+$K|^2NO1zJYXi$0crZn=qZ5(8^HVH?;n&xInu}FJtr70s z_`waHk67b(-;26ZGG#byQ8MK+)|=5+3&YJAe{$pck|~$cG5S=+?uzY|lW?Hy_>+Pr zPI$k&KSJC1#`e*_-dMW55^Gow$du!EZybM;`_BFi%Qae-YSf|sVCyyP+Xy$~XBA(S z38(nOy?UJYBrL?wI$$)#u|G${{c!Gj4o8puaPHnb^JtI!R0Gn6tHi&H_Xj3mI8+Jj${RN-zfFV0nT$?e<=C?Qn(|vWip&`NPkgS`ZtHAcOuOF z&oK8TVeZB-e%}uZHzhC9-$y|J@8B1Q^{^vh@pp&CkCY5r1^q~IUL{Zg)F(^goZI9% zt^{>9Dow?G00fS+EQ|o)SWL~y(M!$Y>BKQsAWXndtdz^R%=eu$hgayoZ?QPr3}^2xE4aI0wK!>S;8dlWTH;LD;Pi@O z@!d-WfpIz?J{T`ryvSh4gyjtA;4<95W_95jMKag~nP5DCYH&scE4~IFGtuB|zG{+P zh$D%@XW5k*#58;VNnUqh=5fWU)dS8#6KsSup^4%vagdn5$iI9s=8abkW;4Zp;69sh zn+-}8o>7BNh6|ZgbTfrYB2*9tBO2VCgRxP#=4-;O zXsk@b2kjBGeT&(ENl;^vEpQW$lKx5ZsU9jy1^V!Cy2*+NPeu0#=!j>?Fdcp2Ex_4q zQyzw~?JNxAcL)4_iJt<+@4hg8tHEy_h{%uqjpE1it<3UGhJ)?00>v*kjNd2V=K&G< z0S)m}-(4%aq=6sD)e02931R%kp>t9E%=61xh;NpU=i&_}-*xaO?+lsHjo>!{IORiE z6Ozvz#;+3Y92tiXB_GdsHuEbq$;U3AVa$&g@dIh79Q42;hb8ds=eJwp8T16yfZt3! zDIdo~iXYyk2Jrg={N90|0wv$W@G#5wA^0tXANe_D80Gr{KeK$?H!+xe|B!Jq@FdJc zCMfyL^UGZbGxPfl{8|}7f|BoTxXtpFgP$tT9A7Yu^3A}{%#ZWmgXJ&B$!30k0KWuF4;Wt%@J_{h0ajT(-gN$8ToLbo}ORA^0dz z>9&H1c!mr}L%PZ?mV?%fOQB!(jj14gu7+Bl%4Qx&@D1h@t1V`aot13VZiU0 zkO@>+2I$Q5l)V3vVYD+r(cOvoN;dlUz?}gPhI4F4_RPntlDzWVGGn&VW16%yaN}=E zQj!QsOY)`|BwsyG$vfN$N#gHhyst><3Wdkue<;)-fO$)Ngl^22Y}R;RUP;v$`>=O> z@8Afdm{0rqQvId&XRXOYXc?b4z{r+7}-7 z(WTCkF|qd8{T7}%mOD`Dra*8_&lTZC{+U$Tg<`dUj*0o_f2k*!`BIa`CC*wE8=G|hgbDDL;hsmYU zplfm>ZR{|J`jFp9W9uc2+_kU*3%e=o*k>OT*HMaj zSn+K?rgi@oR+-M1hp%vzr5})o1-|8xhp_i$p4*v;478>9XCRbE1_g#L5E~r@#g^vzppOWhW`u}|FBxgM7YB8wul!m`#t$Csy_|CnqoJe_sa7j%;i^B!p& ziayRF!PLfZ4ME7RvQ9lkN$35Y1L}}fi$-~mhGERzP`{B(81B%ctx&{~gu27iS1@-y zwmgh3T^VqXD&1VUJ1X zL!xK5-wC{A+r+vZvmTu#YdY?uwBgFgxhC~+lBO`EY(2Q1Hvti0ly#DsFbdjLVO7yK zuzj+qwA6F_$+{guf9azz)#h0%XSsu$ab4x3{cX%q?}xs#wknKJWL7zctz!J^=lxx(qKYT)wtK@=%N+3KcS#E9{utv% z1$6&bIq;-Ae9hu>)A&=+hs6)S3+<7x^f<0p!1yao_NCh&=3Xx8$Ab^|oGh1-Yw_fo zM<9&;mN56rlKyr{{vpHvF6iBw zCoDYtyucC}-XrKQ$6wfNn0N?T)Orlx8P$4>uq*!nM&PH`V>tJ$)?@firPg335GNsE zGJa}ZWEyd~F5)517fJx%E7blJ4yx4p4P{X4H{$zh$WA}E^ruLP5~m%nl{k~WLE@D0 z0f|$_??_z7vqs{S7j3;ri}H3#obvWaobrAoamxFd$scIw8+&G-vIAvR-`i7GwWo&i zsXaAL;A&q_yu``l3W-xMF{h7mM}9M5obD_3n0#TLQdf1?U(*cv%rL}lDLj% zK;lfNT;ilBsJ#qKPuW)JDA%rpj!X!^V$D4@1RX!(5Cg5Ofs= zW5GNKL8Qxx8i24Hl?DjAae@h;<7b&jOs-8%GVsZGD0@yLE@k!*mokfTF5fIt;IHnm zyGi0qKVRaMd5Od+^9qU6ZW|;{8NV-aCh-G_Pr&mjiIe8%5+}{e64&uOB5}%oOyZQi zSK^eNaV%5t2cY9;nM%w!H-_gQ5-2NiJ~=N%oH7f2fz!s6iT?Pn3EhEEm+PfJ+ zKhyk{^w;qu{LA^pN(RvJvrs9(Wcw=`6bIR`6}Io z9b|bXU(1#F10Y`ul?Ei?r^;{|aWV!V`Ox|$b>^BS?L&ICmMQWS{vrDSC+%WM!}OO* zoN0!H67t#$%c+P4hsZ96Goqwe} zj8Lfqsj)h{YO!gZe9$xox#R7;J8n#p%X{2#MOJ7PE|j7v%-AxfWMX{$R?*U{R;g`R z<{RbuQwXt@kruDI>wf=Y-1)acEME?`-poZuKd!UFigZ!I-C>k!O<2it9%2>DRE^T0 z5;TV(RLQdl_r|R+R38MKV`7s$11Y~k9z|?U)sRPpTp7Na5Bm?e^sfIFyn!3&1}w)b z{-Hw7OV1W9?!ViPhTtZh^BJ7sgI!a1;Q~8Y3?&LV;-^Xp_hStx42Bs7cvIE@xcr?E2}<=D`ODsNIVe6|A^d z8+d4@q7u8-#O5j*VU@U)Zt?Qv_dn3T_KqxP*y{C#i_Mu!BT+(>v-=kt73=iX6CxmWNK}2>cXSB(fL? zaXH)-;{!#*C;L0XBE0*A)3I+>py=)b9q|kq@CEw(a^O?(Ly!n#Uzr@nZyEeJU!g$p z<654X-@}OfB8bS3>M)G_eu|%2zK7vpU#dXydjTG1ei?W{xdwjZ7cIlc?-BgW{GNh? zeYyh0F9;7azm4EG6Mp13M23;yBK*w!IFma8ehL)7yWnBw_Zs*ugdh3Alp%eu18(NW zZwzYTr$F)Jw}xhZ6D~5&%p*Ur4)Nn2I5WQv@I#Raf#P=wh|K)zz>nh*^5ZazVbu3i z{LK7#M_m^D6exb5z{AY%DEO)T;1EvndjyD?pN?{oq?k!MI)k7y^Wz@yb?~Qr95yO` z>I_I#?r#A<&L1ft9pUaUeh-76Dt~;3Qv8xo7|rs{M8E{W!T3Wu!d0LnoW`O7I5#qYH+elx-E?~0kEqw|$8eskiCxhKl!mUNWwzfgWb8fqsq&{(9wtw71Q z9&~2;#-Y$D`7Q&olJAx5yH0-N#@TXbhBfy zZzGcBHxj!3)!#Ei||vR_%NS|E2vb6e5x=VZgbh9 zd;}$jqRWM!xonZ2jvvG6Px*|pmEtwNqcQ$|RoO~PNk}p%zq)KS#Uc@aDqB|}b?hkm z53HdNZL|-uk8Z;XX3T-BExU&7if@&Zzh$)AnlEvVA>#GN z!s2viXJ=1e-**uIQ}F*?WB~jx!FMNl^Reu@b_>2zxKwkc;aape`})THv%RJ-uzS^} z*yFKdPq-#oTrJk2EvF7m&L2Ob`{KN3zT6V4ogUxX=WxBEo!+!**t3^*Z;Fljdmpav zd(O81vp(1LwyL#IV^?%fjCM9U_??L{`q*IUci>h0{np~|x*z2=gn>tKjYY83`nk;> z6J>=I1@<9TwyJ?wBvM~2uo^ZA$=rXhAx}a@BGY37yH}S~V3*dq@h7P#^TDuXN$vP& z;;y$3*#otAuWo-@tA6h2)ZfNkTJgr@168N6$~rAr957_5csi!KvU14win!XNk--fU zV_cAW!%oPDEoz7?q+GWJvoX61I!O=>s$-8p;c87KmzUV{I%cGA+pN-xyf94ujk~X&Q^ZZO4i~5#j=E#JaK2MUv z^_V5?^06mAic5XTmR_{n_V>>mTcWhF^*iTbZ`|0@vxW}kog*p|KVx9zhn2y{ml z9hkg*`);QHZ)l&@y;@ZMtJkHYv~S5qGy;8`CDij7rn3#)qKNhu16LE+uyV+DnBd3H zI^b=D?XydSsXw-J!Z|D754O-(iH4tTz|Md2o2reJ@=gLt95lRAHlCw}J4Snq4W|UQ zn}3vU_FHing^iT%XNB8=kKGJnwtaDU8%U7uF~U7YcA2P z0yuu+Ix6Qf3A9U`ri;0By0e6Pg7$*sPe01{faK3{ZyaXX`97uAC4q+atx;{YerNV) z|Dfi9k%ggkC^qS89qN4af~V||;z=*@r4lFaO(uU-EkVQK)WZ^|-UPLtE98;=3HwyF zPmJSWwNFgY$f6`D3Ms{z+5-PF%*$Pn(FMo^D>Wge$_5TZTOBUYd1ykSJOD8k`Bxi)z|{WL1^2Je zE<7L?qxUPB>VVjV*a=p!YBi?J&zVvzzc^JQi zG7Jv^ik}|FugS!Zx+#8^Fn)^=#(q+P;>SHH#4}{TYbJhd>lMHEKxfu>Bf=Q2K=J!+ z7{9~d$8@PLn{majIgH$|_v*nj2{bxl8=3m z;@1ltq@nWi8t`ZFQ=s_$5gx=dWWZ?fn+cryGJVCbFigH>a1Ulbe!FGnx6mXX$03T} z4PpFN!)?67fk@KvnH$D$or&KFNk=;-;|J1^zIAX6CZ9*f$-t9P4t}aUbHu0QgZBV_ z4dCZz1PP=gFio?*Paxt1_|bmM7sYQH2uVx61dfw9PE(-xJsei<`K=o5ra;jh45Q12 zo8vkKiY^}>=5%?d3iVZ>=pKWInQjs22D9JyK*u;4_z_y6kSc#15i^YZH{fUHw+#H$ zcpE{2j?Xm`&!7Wv)WlDRTk-1vZszy=dE|Rl#>v2waMHvt9&W{NH*hn*7r`%!5hRd~ zP>&z+4EzW&XrGn76W~_-mLtBI-)Xo9v)>Zn7xb0+n}s@~86j|KG}14rKc}Ws7eVYgQL5yYlWU@6TU))mN^uB;bPDuR9N3BinM- zcE!PBm^%#YUNNa|cwqPaC2^Oy;;n(*8%iq1#P9wdj{VwQP!fk3+~p+|I2)^+6Q~t9 zRO^&6H|mP8-0;0bk+#`#^9a+>>9xfiS*bIfh{wc__We*5t| zAkOd#)KrxP#-*2}k8=0*VeYwH-uVOz7>a+Dvq59d^+*PM1pV`Yqd^{9B-8F3=uv|w96LRd2l*Q%`dX8Ce9%7tub(p zZ`iNUpJPzI6A&lu42d({|B(1NJhLS}0#AYk4U$?%S2+0+pM@v+5}$@A`6`_870xt> z>v%E^;^axU@}D4a^5Hm5#id)})P*?pV7*rUX(s#{iBqQxi8CJcBK=f6XG)xYH%grL zPq@_-%!m-!iyaM-?c#GI*Hj z(7b87BEnPAJtXlA8OHY=J8;f5v(+FS-S^;U=Jz7pH{+*3@$pr0eL`ab*ru`ddgx%~a7t+jI|ym`|df4#17`9}{d-%zzaaQlvr-&yhA%VWQP^Vx6i zG-R{}Y+8lQQe5RMF4Ze=hi;X#)@CcNx0F}w@G1Qu;J+$hi>R@7NaRGm7z&4@6cDbUNC}<{`XdD55TEI5B!Ztu(<_>~tRP z)C=58I~!isdw#QR;R)yA6T1Gs=Wvx?{)A`gTh&j3Iq0gK@JaX1sA|~j34So+X!E`e zEe&r!J*UNaxJBP}(N1T5O9P^R>^yw4uD|7J{nNIEoz9+4UH`<>^O4^3u_xem)Tj0S ze#42L#MeD1oSqZ8dcKYF8>kW@@TiD_(|Dmq$^+4x_pMv$Jvpbq!hCXjBE^l$Rw&=Yrhkxl= z@@DUEgq7Y|TrR9s-PsBaKam=Gpkbo3=l6Oj!GPOcT`3YwV`f07`t-w(=`@S5lK!p- zwr+jZbHp82zw01XeEsP;LYLn9@@h}Jdw6eW^%D@d{cXL<*;=JHztIY5-*Y0X^>;i2 zQk+2*1MUgUO*2{`dBWRzixc*neKl09d1>21VL827s(89>_J0cvU;9}`zlH&KeD6`H z_;B&TTWf;O)}UVhVb7Lr3xDM-zERg7^mz7fTli~d>mj}MeTRMx%-Eocb?v~E zXZPXMhYGu$@Tu-DzShxzcrDK2t$Oi3hd$pk=Y*rDML*`gtoldIRrOWnKYiU(0gEov#1ha~OEHv!Po*{IWy8(=%s*V@`{H%Iz%s zesi!sSiE;}dC=Jq)Mq#KeC%LJ7maN34@J724%n^TeO0?(pABOoX{aoW+4Y9!2}e&A zgu1lr{pu$Xa+KMGVqNx856t|&F!KUWD8Cw@^$nhk8yy+lNIj|S`=|V)yC?vvL(q9R zsLwb$=T1i}1n6`YKdcuYa_BQX8Bn|vX-t@L;^439J6r$w^c+zSnmfxsam+cP7rDna z|Gc*ax_`vN1|yYy+yj08)7g-t>$fP~uhl)jaOl7G9DdJnxCN2iWhDc2uWp+2EmP9J zbm&Jthu?Rgd>wJ89`RpN{p3NKUFkmKos1_Pb7+|O8HQC*)P+?H-GAjQM^(MU6RI5L zNF5dOTIN;0J2Brss%(o8pqV9w#!s8`U5Cu5eR{*M9s0LKrgwupZT6q?{jRR}QAR%a zqodo|!!pu(+)?~J7{*imqdPB}=O15I3QIorx+mx?59-Z94|3r5&hj7WmPc0uGPztT$Ph8-eVw4IprT& z{bNx9npoCY0ru)oddjcXi=i*1sMO293&OEw-#^HbrRpKl{iUZhO_yyqYT&Ou^W4c@ zZ_o38qqiG&?Y*@|+Lh@ZH|cP~)BC6DA0h9Lu@OOeKUk$7_w=L>u*50%WimyS5K;4+ zgZdlcDV}m)()GLMeJHEHe%&LQu-+Dyv#a&;-%!oN@92jg^Ax$`tGD;Ew0+EW)<_Yy zADCjHY$CZXnOwtu+P?Lddh1U;`Do2v>SEOxnB2SlokV%JC)2HWy(Mh$``10f z1_!&D)yMT>WKz)S3F^fsz-v_RpF{;jHB$uwX82@)rHb5__WoHI>p6;EgQlRW{CS7| zk>@aYiN>wxxTEF;y?%FD*{6MdXM)8j&?rtUvBe)b^fV9qpiXB^r|x;)(NnM2Kiyn^ zroN^nr$Lm}uI7e12c!%2ay=gjcF%N?3hht5^DsKNuEWnckVzp0dOjr8G57fT7Y>q8 zbrb0Fb~(_ahDt0NKtVXB{)Ou5Ggala%=7cBf%drmg|afJ0m7iOMyRpVfg%(t;60xh z9NqOV2u)DmFQ~~=LX#tJ>lfB!wA2IzTy%Kn(Inp;U;m8I7_G%~%1t_sH>W|=(St1w zT^`x&p)PcLZtp&Ls1C(ggt7KkOY_Xb~o>9Kq(nq!VQ$L>(-j{Nr*NN z5{A0#b0r)nBt)|@xPZ=+!l;1!M_(e-x-(7s%)B1O+auR)Ii|25Q=k$&<=Hgr3-0*_u!#72Lv6EvE80%nF zIjr=N6HQrvr;bMR1o{@|hR)vpUcIcd2CW|wXmOrIe_iE)2~N4=&IC<%=&CIL9*Ue} zK#^!ZdKfw!cVY+T572 zP%Xm?$e#GyJL{jXF|}t<;S;LRUw2@O6P~5aZgfJTXDs`u=0~2xVBYOKiGfR}r>E01 zg9YmVhm;tAH=jOP>Pc|BXZ#R(U&#hR3{*~*I?z3HoOr_7@C&{5mk!W&9Vp{8NLgpA zdPAw_AXDGyIr*Dy3;Udhf2S9ob(}nb!Rv_n-M#f?^)(nah>pT z7dGnB3wJqccI&-=KpS0OgE5jw^k99%V2Pe`f8*ePS3iMtVFY8OURCqCLtpO+4Gs!l zb~L=Acl}x<3T5S3WY9!2-D70B=&CQ2?!nhZqG})vWd}?26l%VqEZV;drJLY(_5NPy z`xWV)a*zIc`kr!+lS!-h?B160cOCjaJvGRXdS_w1e)5b1ewFQ1E8bA64iBdFJohCW$&{59tM0Y8uCPq+e=!SsdS5JS!CV;*brvCRPBe{Q?hTK2)R6lmG3Iz$HOj(ea*5{_QcB8p) z*YECPWx#8ksL;J4xihBZUhy>lthWVeVTfr`ZD3jn?(s4?^a>Y9Zk$X`jgbaR?v#6E z^D83757!i%QVbb$J!&XypjZD$C^*oVZ|Jf^U#c&B9@7ZlsDEB4s2ZmY2lbtvn&*{* zAL~8!=ol`oe{KWKpvJ08>-CpC4b7^J$JqXd?1iegEu~4(9f&recQ4-&|LH_)ftCSH zNa45j)_d4KEL^59Jb)H^^uYt@Rytcz7RA83>ywjTI`kG#!>`oDM6=%TJlfs(dJG;> z#4z?2t-c23-srE-oJ8yTJ2BO>!6T=s-q%kacj(JK3zs>1 z{)9T<>iv@_AAevy#d~#iOX0U2p~k)e4dXJ;!ahgOU-aHTR{sbpp~V-Ca@R*a)sFJ* zXxAoG|G10FqNx`X0|!4p31xpLCI-+Pp>-22z)4iX`#cL*I1c{?>FQmWCW5}mUon2E zf3I+pqX(t?gcFl(hfV3?eX92_1Dc5D-kzO~nrHR;r<$1+YLt3V==%zX4X|+NE!&*# zJol)sw?(=~*AyG$rVFHdY42Zz%6K~#DmRBz9>e!js2my~2$f$E6J+ZLPa4OLN|iBQ z`bw4EQsq$BBUKjTUZHi99NC(+ZuT5T8`teD?AA|i61lv>QTTw4Q$07VI*5L+bpuC> z=#r{C8#X%nJI0Si&WKz_zaq89@MJ(n=ex&MKaPwpE&c%qIp|@H;lY!bB4??VQ#zOt z!TiAYbPSft9%^o4k!)#L`%qzvv#>?4|Mtm$=%IA^0@|$?a;U3gUVx36X}GZ4Q~#5L z%wP4+&@84d#b^OdX5rtrEnMpaJN-MJ!cBVXT2wpNhBeJUM{;Y}wj#OeZ}wn6?I*-L3j!L6};mQ9y-HHs0v5(dz?x*&Jv0D#{ns>*AK7tYMz;0*mx8bqx@;d)$6 zr+w}z{0+4`yjItL>%qvNryK9)u3545Bk8uje5^oBzl?DvEQUHd1&0t zj^bB3OnMB%5u?ZI;4lb%WLH)Bf5ZE_gTLycNmZe5?xbpec489yh<}RS?ZI?ND@(vN zUGGD?t;Nl9s*FSTiPD(ZHtL^zbY-YYH~Oc4xaa6~&HE0vH2NoX+%OACs_H*0udH=X+k0g-W{XN!1ZsXzwz;-LYphv<(uvhD z^M+KemH9Q-Eipms?8+)@NqU5RNG{e}FS+J#b8yGxC6SeJW2>s-{F>&fwB9(Rczx^I z7b7;=qT;lQ_Hk8~vYj~LJGv)|t75yXO+5CzFuQd_VuACex5oSX`Zn3b4$mkp;nj@H z*IJ7XWL%&8N#1HLDpK2IbA5)*p-Y@)f!dC7*nt=UHfGTvSI}A+XP=>s$tbScj8aqS ztg>A5Id;8XQ@TCPT2ZsE_>ETV3&q+77W1OD#x~9Vu)u=xfh-LparxgWvaH2H zUm(j8ObBE}2=8d&9VNUYgPDP>7~wrsc*hFwA;EcpEW7Z&Sa@F~yoUwz16dB?JzRLl z32$e=!B;w`+{==9dk?P2K_e#Oa1x#M~uC7|DXHpajv&W9A$xF z@I)HpPfoUsKdI~UX3fdDDSJ9UVOza;)oT5+%NNbiHQp+;825L_YWMi@{UC4h{@(_a z`u|<<=imLm%W(N(oGW$jVtrA;y|B#x0&hsTXz@MwE-6@g-?HT^?k`+fv}*O52iC4z z&#&ylMF|v$At?ub(+<_6;}Qbo2k2Gk4xM zZ@D$^w)qQgKfmlAZ$e^Ha!P6%&&UafP*^|J{|Hn3EkJDeU4-8l{P>Lr_btr9?+NEa zPrv@r7q|E)$87(v5C1l^@$yH!L*ILH`sMds_fgjiN#Fj{XYYOY_T2A$`Mt)NfArj0 zx#5Qqv%golzoF#Q+lPK}XH@B5W*s^6$D*dqdoHWH>x_HBT`B(J*R{yH<@k(}r&oH`H(olo z^oMJ%%(?B_8`3{}_ty#6JQsN7?u7gPSqvHfNAPdh^L+)4E#chn4^4rfIrsZRxq(*3 zKldzh^UfK@58u;0M*BN69FT$ExqHaDqop6X$6MVOS_5y3HbvVcAMnN1Kp_->Hp~IAzlDQ)zKukJ?+_0|x4>;WhYxi#YkbjStF*lh0BxAWl9X zA_3x52j?;foT9#s#OTj&Ls!AB#C6~Vi`0d(sxwa~09Sj_b0p621tuJ5=K&Nm?X5AL{;6ow%$r)J>h|OL}!br`Q{hUYvG_m;R)kByrkdn#5@b zuf)mYT8T5w>m{z^Nl>y0U6@e-rlHOYU>X)O2k@cJVP_haOX+KT$7hjMSm>n-ZzF#% zHsqZEFUF-jlO?X>$$^R5pHCAIrz||Pi#TN=YvPpUGKnib^kYA%Q7h9r{l1u2qYd-E$X*T4A5mUXZf?)8EjSy64i% zt2s%bHcX#~=-ln<=Mv(p+am4{KR+u)ajv!nE3jXC1@>6?t6f-h|J@i*ok!^lMlil< z?q@~g;e%nEJGyxJ-OCI6zkw8HWe5-QJZDq-xnlOSya%>B?{S@jkcEph_yL=RMbPV> z(1E0d%lxbFxxZ-nT^kk`-Op1tO-DSOYyUNc+-QFud-aPnfJ}TceJ(4U)v)5LIhm=> z!$_RGIq;;3b5oN<;U*HfwtP{4ZVj^CO?}yZ_o~&22~geOfeiIt>Aj$}zRFCfrC$$H z(IK%pR)h&uP4n*h@1SH9)daw;5d>=o?G1I9qhAX^G;u-V=T!RLO?bVg| zF?rI_y&OL?zcjcxCQzXGErAE|3>h%f#1CC*h#&7*G4s1ohRJ9l`91-incpoYe&}LD z{Qf(P-yDR=Zb7gl4+8f^oB1s?@k2Kq;w*mUn zPJ`KRa~QvMCVm{7FkR+H7k*~@ZG@YBhyo>F3p~tp<#4mlSD@%#f(P*o8Svl)HFDv-xr@>Ew;>SHvW_}qc^bf+1^2N(AmcQZnnfcuUetg$Zp!i(`4>P~lO#CLu zF!H-q>YE@L*kFvQ66b?y@%JtK;SoRUtl zI10}i_$yHS)H$t+Zk@Y74@s-&?vgn3l+XmaMFuMVl8!%~Nyevwaq$W>o+>N`37Yqx z%tZeNkwt!xQqlbfJe6$pCqEq?3|IA>?U6Wp+t?;6w!nVX{*#21^mOC0*00`w^49-h z%KiIKo|4iPzk+?30L)>px2){zb3LYQt;N=oXf1Dp&GnR4+dgey1YOlu*VAyNVNw;Y zW{c|?xOCh{30IfaWO0qP)V7a+%T>l1-!gGNAdVKiyKieP+&wYc&bZt&A}yxJbW=8q zdjT`uBLeQ>rS5<`uGATDJ4?OzxW3efsa)5$Ewe0JGj~Pw*tERcBR69XniI-9<7Qf1 zuM5#4F(HkxYMbkT5H7mIC)`$hbd%S01w_(2ob;J(X>#X%o7aLhxn2JR?FdZcV{&A6 zzpxZb$R&_L{-k^W+t_XXzP_E0!bDNpov|>_&OHLRkJuDZ>vyJBTQ=EXrk!oV_mK#A zJYuVGJ9lob*{MHC=aaTw5es&tjW z6ih~m9`HLhMa28#AoWh4pqL&z^HcDy0PppFaNP#3rEgZv4Ss;-zl@-#!tE$tuOp3{ za7ATY?d#b)-6G!3PitSFv(stdAIy9Gj$M%gzcv;#*%L=uqmngO+^_`}M4G&3U0ZNR z-h3;v#C6&d-0Z5eAS0JNipwmmSW3a{`RzmCv5PbNJ4Xinm2-^`A zd?GYLduGfk`%pj9i`;8L=DTJ`xw0bX9hhbxipUJUMPLZ2kC=BLE#!Tz@}6O0{#>= zZlA5gk63v#B2=a8m@C})G1w##NTTB1Q~+&>MCh-lF2+-R#B_ova-Y^ie!mrhp~)dYfkIRxUuM`C=OTh7W>6np&aL)&Yf7j*!|SCkahp8HU?VFUZ<)U?s} z3?ByWn_*X0F;tMud#5JcJB2HO;1M4`MLwsB=j1rGPWKC=Z(#W&fOff6TqG>&Jh;2Y zAknQ4_`o?D#rmb*lk<=rQA{ZkT?5kUJu525OH+Sic(O9yJJss%>zf{>lF`D`VZ9_d ziQO_4<6c(!tj3v24oRh6{hoCXPQ@B-~h=#Vy=|h6xB; z?mxTbA1qF)To07^t6jw}_m`2B&0+-cQ;(5X;-cu@s|r>IY921zoZq3X6#7NuVB%u2 z&X2NP+qPQ#T_XNwi@&UowQYBZzjMUjY2q(yW=EW18ftN8Y~HOCwiXHQ_-eq9{O1C{ zVV~D?%fMus2yE<-)#Du5w&e;jcuz<5pNyd-aZGu z`(nlNHua4=*1j6nREB78%l7f+V$@cI-s)iL$74+>8GC4-gbwQcw}^-rn0PE1ws{Rm4_nx z{SHMd?w3cjw~sj1j!Gahax*O1&9(^It+B$hv29w=3%OmlYjZUXM?iPPDK^Nrrj#9TgEGEvy@H?X^SQ{-)R)}puf*<(t!SvEyZj}A3+sx}q3^w$~X zhi@HbZC-AxZR6d`kcl=(2*giz&5U5OnXEezsJ`sFpxVqN5 zjhrCZHcYsTu>A>Ix~PSLQvcRKsn31@iIiG=;*R^$xwu~2J#?+>`q*IH(5AGNyKIM| zj&3$gc=-_eL8^YQzeTsVO<3Y*`=s*V^{8v3{E!Ce&-6h=QMlJc7C4cN5W}cz8z(RE z&UBZItjPPBP4S3QJRY)wW7Ikya#j}j#TFxH$pk^j)fg?Rvv0m7WTfel!nWqNYcSi= z#;`B=xQ0jJZfgGmZ-H<9N__aoVU)Wzeky{%9LLK4!&bSn{Mqs=%C@H^cf^%kip<&qWK!pC0g3DT)gmZ=85f7{4<@k6C_^@ zovXjxkc>o{ycp)PS$`xpZ^_vvf6!9AwROW|Wu+AzU)smi&eA$ox?a|X@_W%HH^`d& z8&4OPc*^FwIa!$hwVMqhL zhG<|%{$t^H?{@9C;JSj!Rrv6zF;;80Y7H-Y8Z&Wx{Lreg@p(JHtgzfQwyMH+S8-x1 zIVYZ;Z;AR<-<=WrJNrZ*YA$~mtMBOR+c@*KCcaa&YzxM1Z?fj%m10Q6^_uIkXnwRb z#cQ8ZalK`Mdrq)*z3+-i6Vqk{I=-l=SyVOG?%EV_Q_TFi=(hRY6>bKwYIz;n(1#|D z9CBxjYw4FLZI48{I;?m%ANnAqi#Qu}1~Rn{x9bUQY%Po zUx(yak$H-7Ng#g8#L*-2M%!q2(L;7e9*;U39TlY&c-OnvJA>X*i+vav7@^09ogG+a z1}!U0!#qZ?3_&`3@Ul7Dnwy~2#RZ=0D=Vvb{$iTuN^S4TS#w!Ccly^m15X9ZHV0$y zcJtJOWt-Q<1fD{NyCf!5U0r1{_Q}O%<(2-Xl_lx_wR7dMwuMr-j=5qil-C@wer}*` z;n;OcRxZ5_RcVW-(qEQ-EPkqwrEXu;p-9xm2)x=@;m23uL(zx`kEs?UbEHiNKh{|k z5WIjaM@P1>@hOgD(8!{1xsfj(`=XE!O)IAl9e?ul%9F1+?W2pI)7#th3d_PHcI{ZC zcKCgMZ#uSfXy4dd^LBsP-nOv*`3`@3=a)Z!BEmj2*RC~mwib7;I?}eVt7YuF_MyjW ziq8%$8m1NY=_d;p_N;ZBT&owZ^%bx6H2-{T_t4I~abGsqqi_~)#jYn^-mx&BIh_Oex-uo-^wvPSs7Fk}+^*O~K(;amvVwW{A zb&4DBfs-SajA8a{VfLgY2cGhjZJrr(tc^8U3{I!V=Eb8m7VapRF5bXCMFV-p#dFOojWVSl3fuRJKhVa?$)fj}Q4` zcIg$tlEl6El=S3-&iQ*v5?{C?_+&)MPa`wF+scMtw1JU(y@zbmhd|cg=B?}icCIXC z7qHVeYi_zfBe7NgZfn^?Bp;DEOB*`BZpXgJDQ$;gGjux)m*qUL2>2qRK$ zdbDE)8W7b)$byD;CfK&|^M5(7Lgf_iP$9gZ=OI+)Ia_sqU*Ebm*JRDL%z{=XFUE3I zye~u^XA_S%qZDmA-a4D&>|-z%L`H3l+KKo4FX;gnI;Cxql-+3jqGwu!)t2KG%wn{O z>h;OxinuniDGo(oR|Fz9#o-k(lH*I^6b{$pmX5e-V;N5jTt4Un=Q<1I$bBF0uTkB7 z#=DF$KXq*+#;1NPdGykoaYRRFkJ|sofql1Gcl0kf%4cP%-&GMY%ZIOV*={3&n_^d@ zZ2sWl#mHa$n(~vEbwJJ-xcY)hJI*@CbKX+cPc1242fwPS@ z)UUv~%eI_DqFK-`hjY8My-sxn% z|5Zcz!_-(=Y|!^CLMCft*!y6B-Z?CXlZ z>*#RbJKAz6;@(P&-GyYX*uMRmyOvHihM_MX3>4069l8j1+GTyieF$Un5B*@r7ZO`{ z)DpMn@sqf9NE?z-T>faSWn6i+qrx|?;1!O#F(i0=m1Kd><&CNu59x$@g862JuTB*{Dtr~ zUhj9I1A-{_$lJ#3hBb40`{p~NJ`$BDlt<=_k+@NZ=8CV_MMZ_3Zi_CkzaafN{N>>=@*7HK#SVBo+G zQ;f|vVMIX(cwyL!am94LEh>4@R-$OQ)@gY;#vD-~ek$j^>_d**(0Ct@*~mJl`cCkW z!#Wk;tnPq$nsB}amgUxUXan713dO4Jbh@go_A$`dikE3vrK&{hNU^thVf+tx*`*dhVVtcxza~8ju_S>Agald=7fbPvnvxd zHtJKM3zFExS1RuPm^5Y&1lr$=b4AhSo9Y+dU&8Hzk!ws|rKrGosbxE8ywe=#lo-w8 z<{X>JAm9-kUK+Qx7E^kmjKgw{oYX_U9TfEUrjSy zlcHYt8)z3y_gHWqw&={3|9%}fLAxZy4r9(Yva5_ZP`x^=g%=g zzohZiC5G#_7QXj~0{<*#1eDYDbJ54LS!am}Ts9?;KP7P4)Ik1Jd-N8y$_5=>^Teb{ zEgA;20i0B*#S`g>zhd5^UCg(&i#ay2fVY(-LNY-l=0e)VbVs|Gj%(*M-2h{n?5fbg z%AgAS|HU)KZ!2muUJ+rGK+St%LeH2U7xio0(6+ulWHl<+)s`vIy-0$ z!e@sKBz)H1Pl&0ie!@{h2NI5o?I#>zCM>};nxX7wp(ljDEgIsv=4m@Lj&TMC=XFJd zc^tHnROl0^c}+~z?!nc3C15ApR25+lK5wy~YMVw|MT?r{y4`9Y6^agt4H;Af!^INn zs)#g_Snpqtf^7&a_yu<0E$>K&c8rs?&zEgJg+?B7a|Yki?#>r}nB5hkv85Mbt}@Ba zK5G95eP5raeNf;_h(k4e8nDT+@ai0aW|h5F+`h|7kk{*F7^!dXN&!caW{e~)Hke^H~W;4HW)|M_bGPa zWcKK_)z6?BvYc#N^bp6mPmG*O!o+keHL1&r>>rY9w&dsCA9$#8w zHvZ*!l5=vBQ?pWXlXH_(JSn-E$=OMnSt(iBiQw)@^LTy9Iq6B6nW?Fnp44PdYC>Y7 z&y$&zn(50*%Y`zj=~@=#^yFlw=4NFlq$MXLBxZq&&zI>-&dl~fse~+#H_MmpP0#Tq zr6u{&Qt?boO-)Hm&4D72Gb=N}<4Mj+&Ps*pac}Ic=2Jw1wlDsKti4ZN3Jbm6Ak0&cJG2NG%p6p3O z-X>&cr>FSRVGLh#c6v6lD=piXl8B5>@a1X=No1LpoRpG=JkHI|PV^*tVBm!0oRlO; zosyE}OG-`1%t}gvU!vEOkeim7%b8^zMJXtA;NxA9iK(n)v4KQDh2O+5mS*f|$$>dE+@S<3x zBw@o-mJb=2fRdA%mYL>FP0UQsO-qB_(^3)>5|TWrzFco^PB!GuNyyB}Oi4uqZ*p#8 z4$6)fcNc)KHyP&k=A?ZtMjz`y8`C*uZ|C{|u6ZsJopbkIlfGUIKN)&2bxXH;0AK3v=g%xo;11|7VyxUpp>8Hoa5G&#!#@!G_bW|G|$00gvHl z)ryIRz!ti3)9|usOG9BqY}gg@+AzcG8-oApu<)WVcX;>%Vc{FX-2WBkE)H`C!rXWf zGl5MjGr1`5_rly2VeZGZ$+G_Nn^tS+hEaperd5a0KN05sQJDM314<~r6Fe=;BMIq# zDuS3MEY1CJOjiNJx8Yku0>7WoijTF-{@J1X7$el!km#ybeui)-X^({I_nDMe#dn0ccS(J>iTG)l?<1uFl=sFk zen-Oe@rTi`33FG-{N%pRIPDs(CoKIp!pdKhq^AT-e^yw2m}?-z?~&z)BiA_G+VG<= zd2bA}=O4n-iwFyUCM^BZFnxxEg}cM_X_xY_=EY&x^CeM009p9OX}4(iN%vM!zUOOG z!sIz1!*3JxcWB>``pgmTh1y%NBViJLarol+DJj3;g4d813tViMu-y-o)-2Z?FK%|=?P-9Prl!4`!A5IYX?Y1RT zpkhCSg#`wH?EsoZmH|H0{#*>_1kQ9Z+7md_87^@aQ?JCyJ5SB{ozlsNgYEYhFxk|eIGjm2z}Tm%9p;5UNAfQ9%GC!hNy zE`ziIab=!z1UN#L(OV_XxVKCELUDyXW%*(;908nheG+HfLX$sG%`%&R4c*jOj&UqE z3U8xaNo6_u9B|LH%t!LI%r)rE_7vrT9RWbdChLaK5jfKk`)7fZ#}xc{FEx2wCvoz) zLE@w*SiWgIMY>W3k?t*qzetzH1BiMd>kyM40i1lq{%+vp!BH*!$zzVh$>T1G51OtV zDvETajv_5NgcoT6XWWtG1Dt71kT~P9+R#75-)ztM2m}cJvd#*zg&wqsh>6nUwTg-@AV=v1 zi%LC6r6pdF)8eUGPxWurN{e@G(ch!i(&m5PwZCs>&7PSg$ND^;^FQZ%X3u`tTHkut zw=R3_wb$NzZERjCp910q_=C*Are)_H>~8>o82hEaGWIt*{>FY*4#e2s>|kU6C}jnCbYjWdbvudcn*KucGMBG_MxSH18M8G!F=7ntu}P!=B<5JB|Hf zr?G*Z5CmP1Cli?A#vWkWL-8(l_H-)`ZSwMyFA06Bn4e8?a>pQ};W9X)`x36Nebib_Y{0^Hj(048hbr zPcU{)T)XYDQ9z76(ymPTGb0e1r8fJBrEF7yGg+~a05)Q#WzH|aw9E9Lz~uh1=#cvf z!9MIS=5YZXmf>>2OnR+grf>2qcAETlz!PF@7JE$IzvB3tb1pFBO~;lA%y?CTscSe_ z06+|9r-N~bdNO^E-&umGYtGm3SMiQ>5WCmRF%CAIcG*h1HFmNQK}>tjbujbkl`=Qw zEO|6-b*!U9)l6V=n>Gead#@LNa_40PI<*lhAH$FIq|v_1M~ zve7|s*c;5euvqC&zWJ8_5)0oTn0b6!ut|sYg}6*-m|*%F+obK8dif`KLcWA8^Q#8( z*#UzYK1DF&l?kS86nmVk=Mj^(l!M8mwA+}rDs9+Do-4`bymOv8(ZOhT9%80dESNT2 zESR>La)1ug+$jD`^I5@6liv*_59?^5U>~sQE8x$1r|5aal+R+vFP;7^4mSCcbBD=S ztK)C-CFc&Nq34Ssz?o+{Iy^*)$<3lCCb#JyfXU4!LVt3bb1N{puNHrDZxqZj;pY7o z{vhPaoMfPx%_a`(taAKKzRqwk^`q)bjzNLrdoip=l~g+KG?-Qf5$dA-(Sl3uyy@)IL)4D?Asd^&I` z@pSw_%CYIWxSE&^5K@cHyWBuCK4DzGbI&^Uu5|nt5X*7eNDQ4O=qwi82HZ-_Ku9|_ zZ(xxa*<6hIpOhzgGOW!GArm)Jqrf)%b&?V#{P{*?}KJ4!ooQ?epf^)D>M*UG|BCzRKf${TX zia+b^G{MNGXNq9f)%k);fGY%-0tW@Nei{X{e)#=Nrd11krC>kswSrkr-x17m+9r4& z@NU86;d&e7VSTzq}8lVw7TNTG|Fc6QdMEBe`F>(3Dgk7R6OG zbo|J)6WXv0Yr?H^FM1az+|r7%D5f!nVkyH5l38ss+|VukzR39ygryqqFtbc?X~z)v zyW$@#b?d~CIJMqKB}6I2M0aYtkLXbfG0~;XHLP$~pk3OQlI<-It~7-h+YV@KYFydi zc*k1_&#Awrj?l9DruL9L+0sW2P$Th`V{+qYN=Jd7YM|VSV#FliDE3bqPcMed%9lLA zGq6I4R!%@0$x^g>f+mjwP81_10Y|Za+Gss(AUthiamNr=Pz*O3`gNc?vi(pxA!$hL z&#`184%~LEcZhhox@@LRYF5b%do+TqMH_WY7Ob#%1rkjK;}$h_;%p9so7y^>EV~=| zeS5B^sp-<{@Nv;zzoNb^IxLbSEJ7ZR)drrX&Xw(9kA}{Wtbv*M0Mau(d#Sz~P8>~B zA~Y6ToM0`K#2PV0szl+F{s8TYryoP^G^KtREhViEHZ0VeSvE9=l$FX5Te-QV6^onJ zFKt}bCS~eGThttCtM9nfUCv?erOP^-a%WdwcqZCI!=+J_Z0xWj%CBu@Ypmb0#u&f) z##lcdC{cWkp{P|(jlnoT+E?O`SzO<-*kyE7kezokX2qJEElU^Kd1o7FU(tldjFE0@ z%hJY3xZO-*RFoQR85B_+%*v(Vbyedm-iq{aG=!p6G%01JRZ&`Ts}~1WeJgU)+Im@A z2!*)e(bAkr2(z}3Ts*JtxbtnevMU$$&z%0 zt_oFaor*GDrJVy=NLICwCzILc70cQ}ovYh*{aBNjDT_8F)27~9?skY$nFV3h!9y+D z1MPA}lk&vm#R}6jl!_T~f@5N_I;3HQ+Lkp&u`?Pr)18HT6`ZRhYMM}AnrZ~|)3Wq3 zrV=Sl_~9gE{Opc-HG2$qtvH@ax2(l!OWZG99m0CK8e+jnQ*1XyfEuzw8|qtImo?aj zrcy9J?JIF`YN%#3jskRZp@!qUvwk7=tJ}<8mgLPXXGrdJq!P78uXFJ`fd2!-_*`N{ zUiN!DAHh!r(*i~cp+wAUYYL_Zq9jFJcLBKdIRB!edba@(`z7EICQ&#Ca}PG!!!X9X z0>I|;!;kX}D%7K_0wDI&0XYJ`Z0yN52phx5w-Iv&Hs22M$Ib}#DAz*I<{K*9M8 zd`}7&cgpu=7hk)T-;*r9OAx`%?=HCG*>@5A$?eBRxz)1oWVji|c;^Awe2>C?FZ@-g zN0|;l?56|rBg;O{<1>tWuK?J5jW~GX+4p~3e9u_+aXwc0Xpha;4nCPWhL)qp{lB{S z-UOf4FYoCo->-1+*?dRA$1oMezknXGUjjzpJ_z%{_JUiuVZMi4d>?}E1c}3)^4;&^ z%eMH&SbUe^;Ir);jD|fp4&QR<+4kjGd}A%X8W&#%_;TX#Rl4|QfKS`=IE$|p2eWNo zVFLSZcctr3ptlE|m(5oSJrq?~wET`i$=0ieUS?P;QqCVk$u5^#$SADV2KkI(z!7w*>%fv*{E6)l$y zF1}-yeayGo_X7GCo38+coS|f*M>nO>v-D&w-4beYG11BI6n$LEx+@itbFebjn40W#N#_iD$4gd z^oacuP=foOT7L9XzOSQSw9D@p@|7)dxKqA)(jWUJ>{0NkeKSQ5Q9V;!d_MF`y%L8z z<;!*PWfVllB_*OqzCEt|`p_=uucCYpx$?UPeA-XWf-?0OZ;Oj>BKXECnds4Zmy7RK z@MXiF^~-)n`I23H)!>_ma22)h@90m7{SvSTd|DqDz)$)9?CN*dfRFEpsVLvuF21~} z&OKGySB_2j9&y#j`Y*-rUv|6dV>kG;{3s)-dg73R(oaoVcjf?LP_;3iD@~aj- z)(6jfcKa*Hh+n_QLC-F~W0rk9KWKj6aoOhwUopZ}wESLo*_VkZM>2A(s>gA(oIJ!R!P3H`gB-_77-y{jl+2K0#i z65t1)w!d${Px+3z?ArmpYKg<0^1b7-Zyxxv5l;ISh#u|uWpcEApMXy}5FEw_phtf{ zJt1qr$N1!1h>c-%Z*lP*1K$Mrt0?zfF1{{{uMx`1cLe7jyZo|o5#v)b(WCSC&|@4w z9gthWr|qv9ZsmK@#a9A8zQd_PJ<5I;-%H?I0DtCpF*fD9%f+`n(+Pu$5#_th#W$lc zQhrOIseGL-z8&C;SANS}e5Dp&tHn3P)t^2CzKM=$QTFA!`qNtQk%#$RicRfHb@3eo z-|r2R^QZasy7=~k??$MQuN|B6{nRyXf9WKr-8*cNvV0hNjN_MpYCP|w?|3@6f8KeK)xHHiA#{+iCG##kU!J zd?!vt?K{uKcPsd47x~s;Q@%f?N82|77v(;Lt0>=F&?ELsK>9fm`*>Zgd@s283c+`a z#Nkf)u*_r>-vaP0KsfDNi%t0+0%rEmT^czAJ{($MQNH`(L+qE3{oq3qhHoAA%6A>G z&G$U`aH0Q0wtU82>417pZVQj@$p!-`6hyI z7yMMzzTd*b=9`FvZ2|nq*Ck=JkMnLe-%H?&cYK6g_H6{8=9gv0w8-ao@x2Sa>F`%k z`_6IkZ3mwo9~+^pe2u`ieL17z*KbJT__3!vZ`t?Ha4R3n)aJ_r-z$tDqV^TTP3#x{ zcP+jfC5-tEy85e((M~*xW;lo|T>VwbxsmpFGs4xrX)Zp#8^Q5|irSa&;>)o3ZiTY) zjRdgs+X+6FuZr@W1VHSUfYIRFgotb}w_#%#^ZS?NXg)sJ&N)yO<@*qNHs9{^(5|3I zzD?Ma?<>Qi`Hp?X33Ky}gr3d!gg;V#cUpYMyZAgl=XrHE-(VNtGZx=wi|-BLn=Aw) zeOQ|Sc~fE8a{GQQ#% z`q}ee>HkK`q`$LT-FGz;?_03 zuB$iwI4m4>$Kjnr9(nfFGO0nW-n&&FB4j9a_)JO6^N2eC+a&kSR_Sw)u!p8z>{xO=%1ciSiFBf5*a zpWQU~+EehoA+!Et_wX6>%#xqob5}jEbI_h=O)j(UOy)<7wp^bvqYNviZaCXB>Zgy; zxhem;ZlrTs&y1Z(W_4UH9(?d{my<%)V}G6XZ&;ap#$!FD`-Z-F_`OuKL^;g<;AqaX z6<8y3#=aycfnTK2F%)b0&UK7??oSVbbWoV9?y>iF4$65}^qWTxfpLdXP~(R-NK8|b zb-{NW=g_XL4$;iF;eovG8+!1t<8#_uqe{ANTDv}D(^WaoUOPQ$*2}a}nCss5NLH~r z@Sdd9Cwp`1Q#YY`u=r9B9+oxYXWh~pZc~W>*44a%ZS6^XqNX10fU94cuf?GCqygVM z^8d0O8T1xDki?G$WPSR#g+1wGnAWRFXbW5@17FvmdtcfWgOOpB-ikp8z^661#wncZ zu=r;BV?Cy=IZF-K1+gTj@nXIu*Z6FWvpU_=LnRY+fABo!EEtG(VYHwi>!%^*L@OLl zO9;%cAHH$b=?m@P$txCF@~PgH2rZ5}yB=L^YE+ z=ko~obVp>3~;nl^E~OJcJNbChJFn>7w(&>v*{@pWCZAfO{(0N`bm5*>tG8HZy4UJSdnFfq738cOScUuyc22R7r zioT0{q`oePTii7@t$N2XhqjptdK9#&ZF5wuOvwrkF=?WN%{PaT?8E6!6UGNDoO-Ui z4M#`{451Pa8z?n%d0HI(9lE!TB@@WV7ybc>&R1dTD znvMk2S$p~J@qsL}X8lS0c;GuJFga^mN>&HyVFFGW#)N5Tyi6`)R2B-|G143xXrayg zoYJ*f$HRtev(gs+=4U)wSPa@~*#@}qH>vn>DzonLqLD8hc)2$zc~IJM#}7a8es*j<7;pI`Tf6o z0v&kvs-vT&+1JoozjP7Ta_itiag+0M@p)xm&f?C__KveBO#$*R$P%u* zc8BHWc!$qPsL*}BS6$9{=t@_3PbAokm&RK5GyY_kezl9w>(YPErN7g~f3qvR&gDMn za=#|&&4EAH&H6vC@Dn8b38ceyv(`y^-Nt>q=Qaud1@=msF!S_R!OYXCC`-m=p2iDio_Noh{v0o# z&2+FaPn4)KmvS~`E@jJ|mKE*R@;7BJWkOrMm>;6hRxKaK)pdnoxKA+Cc~~&hp=jG6ueJwczto+vUu-k>OWiT6y7mxxiOIooBqqoCmVcGy zf2m+{e@igADN*)FTQ&CZ4`OVPwr$FgBoI@EVslIx;vNl!$4sW&ubCs5x)%v1RfAwA zXY7PN{Vx}Prhk)Q>aZUpCv|=-m^vQ{rp__J)cF$IlGrd#F!N#FnTJ2~(JcP7?Fqq* zOVRQnuhtjC^xb|_K2i>*e5eR9Wg_M2gIn8}smD}m;C)bRx=vHRU~=P>XZ*=MPcXS# z1v7~?f~jxH2b|QuNBpV(Bf-q$gM!&+_F4Gf1k>K%2`2wLg30-*VDj+Nl{S-SxL_Z! zIey{KbUnFz?ljSZmf^?y`+jLAj#|vqtT8Xj#CvYjQqspc`D|*ucPRL{xcv?V_4K_8 z`+3!cO^uzc9eh|e@hcYQ!R$Wl`7AGGz?@dTKas$eaFNN26OLLu8{%swDqr(FbBClF zk1qPH41M%9w>*T0wwHEv=4!b|7Z~2)$Q5c;Fa^H2r5TUBdvg1DC!nzf4;H)L3HV3e z6VP`8q91g(t%`m$8x_&lv(0wIMGcMo7&xAz?+h(&YHi2hGPfb}@Up2=K1Uq=JTZ@= z0m&4ci|`9e2F47$7ovhg)Cl+7aEKZykiG7BJX2nRl3UMjLYzOVeFg!)y3BdKaSBj`z^4|hiMA4h7G)pDBpj;MeH}eSZl=Mb~tMQ$nQ~v`92Gnb`{9-95VA+%kG=jZK>}r zT5->t@a)c?>!D%YSB)<1UXJv;>*<<{`Q|b8y}hFfvR3dL6PP_o^-SN|@&KsJH{8x0 zT6f~m=Ilx9w))JsOYp&~w61*E+lJ}kJmZV+Up$?LX(OmMq#f6s^^teOC%rQ^tzEzF zCVbWL5u~+t{g#86j>&VBPQ;`OVy0imui|!b)*LY(Pd>PO|N3?K5aJ^yXd8k!?_4)B zDeDC9R^0M@0IsgB6@$kYo_^rD-ccpv3z7~z)0>{0n(QeYL+eEco2`NUrlMznfboXrjAbE*l~?#`*i7ithv@)-_qLDIMh?Wu;H^5JeI6m*wBby6MoJ3 zEy8axel7Sd!S7Q1TJdYcZz+Du@N36!`DaT_V&U*G*OGj1;QM!+H*I$6RZI4sH*Wc= z>c?6)Kl9?<>o=WOGWwk7mhQd(f~|jamsZvW`Z?|k)lJ168f z6<{TyFJRV)>kO(4WX|YAQT`$JUYw0@5x3JP9&fG>=*9Dn*R1L%3fLu^vykm(tcWC= zvx@B=7WKRt`gdgOpZLkEgDvGj9aU z^CbId`tv+eNG#_SlV2Vz5R+eEnnyj(i!gnkVA?fSF#VVob!bbzVA`T{D$LqU@n;#b zT~eR<-Xxg$en~LPm8THuko!2nwD)Ae%tuOU;ww*{?_w5{a9_)~l`z%Y#`ooQJa59C zm)oOXWOpLUtL#`}rma2l0w5D+2O3(qve~>yt#1Z~13FgXW$6T0JBC@`PmX#GS1+@S zh9=;CIoAZb-e7eo`D!Ty93dlTfW;xf2bKV^0-@+;d~Q zq_DniVLPHUK*_DgwxptZ-+&UaUjp{P!G4g_skDb-Z0~bie5LT4jZH=QX1Vx2wD|1n zms~`&?Yj|frmLcSr^AETF9CTV*$qtlaJYu;qm4G-A-L^+RQWWHAK{cE79V>?>XB=; ze%~$^<*O7u z(xwi}rh_6o2)uHJ+OMq63V6ixR$0L=sa$;W#f3_lJV^TGZL zN5kZ)(;_45{>Ie>c~b}c97!h=f;eqI@pB~8#w1;lls@93Jt?RCc;l%@7dm5XemxOG zJlubmd+UENqil1p&-r*`-D75yjqxl;*=I&Z*)qnSR)hxtNMXKJhz~J3=6r7d(|VFB zlG9TcWe!3j8!+(3czf%%?Vj|L;5JrgU7Yd#p85IPdi)53jjygBK5@v}?)}|Y?OH$l z=B@a6@qTB7{s0H@bAuSfgQE!de7V1=Y&q^Cw!A;8IqPN)+xOHz%{#L#&#pcU#(gPf zu#8)tS;y^oe^pQO8DsIK+PO~;>MBA?6&QZ|aaVNEtLDyb-H_u-vOe^te##;Hbuwhf z^DWnzA-msEO2uH`zmAsx9J1d87LY$YXz}~IHVogil|y#t>HxMKXJ;n_m3s?w+@AufJ~2(er1{JEio&KUKc5a}ne3U6u9o8@#`IyQs+j%Gd8dZS1b( z`g?9W`J0<}XY|&8;5lh$_P3YRKbKm#=e7OgZ%IFI!Ss7(9GTzPJ7&>G@4ol^DZfkY zdHSiPm)w#0*PE}}`qUrRzi{57_t)N8y8U+Fu#~pxhn^Zf@tK(`o12?f_{_Wh_2z?L zdZFT6&5UdO|K@UrT^h$gyq5VQu18L?I>dookN9CGWto?K>G6(3{&~GYf64-EUW`sJ zigIUqekyLBXS|-Q@I7muPrT*}2>>Fo*C#Tt4Tp2|8^q~7!F82*C_XjSw-s7%8Twd?oOd<#`5qSNQYLz$n54z%?=yK<|+jVJx73^DddlQH)2q61>=aZERP;&qToA7S28jEZxwQcmcj=`T&eM=S

        6&Z`I^Aj$9d=>`1XJxx|l3snhbvy*|$&+@pkKV170;6d6G}$xn=j^?i#m1)7{AZ zcFvc~oepErA;Kan;-PmsyH9i;eq@er9X*>j0IyH%i{1O zAieZX>-%I#FJuJYe8^|kt=Rv`z*~>L54j^NGTEGX-kg6+fy-d>uA+6DSu~BZHr$FhucVuR=|JgW~t@F+*k>tdI&d^o~*H)c#NE0uC;YZ;x zvBB-AO*IGPH19ioYG>HH-MRR9o2Ir_Yd0xpBrVmemiS-nYa4QwBjd?k;qcGPZo6~T zsph2D3uisEN1nJf90p`fhq=*{RazQQEf&AU9JEM17SpD2-dB@4f9#Ullf0U#O>=c> zE}uYvuWdZgu`tC=b>=;m9#|m z-$wu2i^*Pd`gcn$MKeo1IR&08HjUl?OE$rlpkyExB_VZkW>3;XCPi3O7_`98wP(L?!qzUcPakR ziLMc35x-7({{_z%@Pl3`!JwN1)_!QlGkRKf%g@ZsvnA4yHcCx!dbK2fLXvbi$@`28 zxlor~J??H9XC9m`weKjZQr}4SZC%vr+aSlwDT{}E{c?rx5MuA^f}FnE`PK*Gx5o$i zsa$xrBpkI59n!iWxRPKh{+@HbZM*eAT+N4H4b|EwNK1C8zjCUzNfld5Yn@9!Qu`}> z=b?(Xpo;TQ#YetO#MPIiW+wSe&+KKY2#0$&oQ?a+3dEBM%4-tBY}s`qB7=*W)y(Ak z0!~VZs-xDER1{7oG-C=W9G))oQbf_Ga;&JPXM)Jr$jiv;_}_yfkMhHd{Oyloi{PV= zuBmgaT8nL8E`C14RggCWd!Ag`4I4MEe{{~xH`lM(*zlN#PLkdHpzv}tZ8x8e^J5P^ zxN74JaJb+!UH7@7Ag|!oyuyN_941K2Kbp4`#wvXzax=5CNCrpPSR{0U490?;I1Bju zMm)`Ir%IH;VyrA+ZMn)FgEoV)u-l%a78Wd0|0Vj$`YFHV@6^sDWAf7!<4)&s$u!}Y zjGaf{HB|akzZV-k(0dktZ)E(Vq$gwCzZdhq9DKr%fBFs~nalVkV<*hLG5p3c8S&Gd zWx~+=<6J)7f0}eTM&3X0_e}66vz;PnS9m)@W0Mr_PHn4c6#l{7j9&^5r-akwPR7LR z?+l_z02mj3;vNX{mcp3{j%a!v$7u=^OY_X0`Z**Q@eouNr_t2v-)4e6%~_XmdkT~E zNBk~4$%weXDk49HVd5PLG|^Iu9sgjK;YT#_HgKAF89&cT6t;=}!BB2ZAx9W;CYt=B z3^JOWp5ipcTuyMBpe}Km;=;mGK)?{6X*?r!9TEeK4ZjrhU&!R*M>K_tt{tNZ zV+p4z+*dgr2^ahXb(-6g41eIX3(voDn)FG=G(mqd9df-<7%8MY7!r|aa*ysmU9-Lc zhfQ(r>EQ>(F>JPhleT1TT(jz7ob;%F@H;D_uHq!kNDSmN7P|JajSVZr>6L4_i$f{o zKGNw}v0c^>sNsyO5b0W6{NU;}w(Ig(>WB2MeJo)Zn+Qql$<+_|;WR8x_05PmK{aF8 zAt2%N>Ju}b2iYktilR6&{Alg9kI-;=*nZz@Y_BzF%g8otgRX(6@ew+d`S-Dg@m&jy zZ4&quSR#f*smX#f-2mnTpUq zV(9y0yb5OQyHOyE4HhO2QiCVayowt(_dqPH%;I?xzgRxuX5<^HrlDcMqqF$r5J00gviAfk*d%81WXvjp`s_gsim3gy>@Ku-Sk| z^|iqJ5@1HWd*If@{m?_;(Oo1)Ji33I>Q0I;Rlx%9h8VmPaGQ*uFaj?v2Cox%#7B74 z>4@#R1 zJHn%;UEs0y9q$N^nf1Wi$Z2{AJZc+^c=s6alDHem@o(^Nl<$4Ki1r805xi5dH{vw` zPoxL6!9u=6F?f<$??Vw586n?GF?emjqr5=zr9O$kTL=GOjl}l~-Y4T-7=cIMcqh7; zJG^g*uh0d>w=xDV1BHkBXu=3Q`i8v`&w)%Y(l-sv9a5{W^`Kr zFXm3B(H)n>!)8c0r$#UAlqPT*F^wJ7N zHuHIah}0t!vud%#tvce--<*g2!weE& za@?Rz@@4u=-0exY9WZ}o(by;(gY=7>Y0=-PZ0hmC{s-XlhS)8O+YxR#jI#J%L6T7JO8DgNx7sO5(i+OuZM-yPlrmvL$Fr~i|iGU|pdB_B(qn48-r|iIOT(U#;Im~pB_*4z&_Ok!EiTCe0YjTzPT5BTr6mVfAIUSU>YJlwr% zXEtKQO0F)KK6goKmQ$q(#Zq>cF<85bg+^tLkZ%;&ZL&FYetR#ldiW{#`QOi`Y; zDEC+hgQgDGu~Z;M>u8$8w`0@Rr5h@1EAzDtn10&|W$f^o&O@_FNQai^O%GT}XCr%7 z?ltNDp~k3B+;K*>n*zMrH7U#VV2Q!B`#FeTRXJj%+`xL&Y7h}Po$UCKlkQHfuio*Vn1txJ`hAs(gAZ( z=21&!{z>aQrmx~2a3D7F8E?H)w&sV!axw%$z$?8wT$)q4C|$9Hl6o_T^3Rx%DQ(iC zThhzw%FYf82Ju%d@pAXhRH_B^JnwfqeM>nPxx1bIy?GrpM~6Z}Rgz%}TDVUh!5y*} zlt`r|mSRlfmY9pZpQ$A#plM5bFuA;#Wh#Qw`Kn7ScQL-ZM&he^m*mivAR+bXMS~2n zNd-Lc7VMooCj^C{F2UQJP%TKiRPA=k9VH;Gs1fGuk>x7THmN4T%9xQa}=>HTP2_vD<%wS{AFqNrs;_Rfw`@}hoB)9jgf9$9EC7AhFe z?cmwUTcb>>3mL*qa3$V(;2q}5F{Zh(A)DRxdA^16ghSzQ zE%awcGnS^@VPzKVEl+uaRXMz(VJ(mdY+XW4Gn#2GR zpQ+a8Qelkvu zLsz2&bweCVM)eeDKa$+WUevvlTlc^P_Uhie);)M4B;UQkUoFRzMCg2}b&pQUGfQtL zx%F^i$7+1^8V0O-O6_huuP20^t;HY#kqS<6>dDhs=L8y3sIe|3bQ#Z0 zmoq63`lmQGdoVRVxO8055nneUJGkf5{oOrNk`E`S4u_ohO2E23u^eNS)Js~DS~&{x zFiA9fb+%g>7q|K2&Hu68wkVK$OS(Jc*dAXqHJl!lbM;6l`#)D2DdYJ&cO8wp>&?y~ z`K)8g@{~Wvz4?coFPNL>NdI~9$~XT!>h&M}<=ry_6D4KWsLtQF4Ll&Fzxs;*H*;F$ zc>fX!63VG+<>=s=ahko{A_cQ2kyT<3v+7L^zG&H(ZXUcz>UGd_l2o1TQl59n4*91$ z&<0FEG!KQtCv9is-`(PrMisZ6+tK+Kr}9IoW$v0q+M*No&%-ra!avVmp4%&rhpen{ zAen;=in9OD{w@i=hitFkQgHA@=Nb8AeCH@>ASl^w(!h&Svqc)%BiYT;z-|epWMHqf z{yo>}Wv1d2u7PFJqWz2RZN3yn@vIy(@sh5ROe#~bStd1Bz*1!2|EK3j^_df8i0Vb^ z@}X@I1)ld;SQFFe$!+ww8a>k*JyRP!?nX~$qbI2rpNM`+YOJnk^xRaAT;jQDQ#E^= z6m+Ncv)qjO-c!`*DQxu2ZY+H{=+5isYqX7?xs9GVjh1Kt^h)ia_t@vi3I)eZWB4atB(#IbliL2Go}=ODY}0#A}|SJ_h(WMRU-(qE(sdQEVtzfvvg5$^@nO+1|G z%!;t9J*lOh@dX}5P85PNo~5TN2Z}Bb8^#XCb~!eIfw9G$33dNXQhq6g{-!)BX>q8H zlvI=*HOr|wq`Fiq7$#oQ&@Nkd1`0xx5EL|ZG-2RH)<2FrOKbTU%3PVGH=TPwI3I1e zCSD5t4IVHSq@=28`~s+Qn!f_qXY0|Rcx*9mzO4LIQpeg`Znddn;}-T>sM&%)q#XL0 zW+fr4#rd&>XXh&M_@AwGf2C&UC>37~eoFHMMIPYcDK~kaa{3y%t}-IJ3Jz>! zat!ZA!isbPf6Covd4l{VEGRY;EV9ElwQ@pHLcpwan~%l^a%+6y?p!-^q#2oW16KK` zqT_VHUQ-hWt9j5wEexvfZZjXa0khO|V}a)eh;RmV#oKy)fdaQ99PS7N;@d4mXf!I~ zGQiEh$2(GgR__b%(K-T^@%}yAI%C!^x+TH|PC*6f7j$JK(+rE_b~AJcZ5EkG zi|L>vP3WfPDyjINt@I+q9Ayb=bL5c^c+4wJ`|+iN;Wl@8`pWEM^${SPAW1XGVYM^82yJ?E&N?4Wz9@-C$Z zWgZ$)tDdR)M23hPDV)a-I?~I4#Wv5euy7GFsItUby=VQhKq%g`XCw4=hv^}$*P-LV zd08MQ{vj>Lfss7oK*JJd*&VNZAw8s35+fh3h&dUS7g7p5WA&t_bn&~#$*IaFb0Dp4 zSBd;ZXS>sX{A;;m=bUj};c#brXK(xqjsuR)Lr zx5PZST&im_H{Ta!xNDxHBKAIEFGTrNDPhX1TWe!2 z>wKVpg#mXdW>f97$C2hlhcZ#Cp(Q+xncH5|P!fAndT6fFPLsKI)@$YU1gQx5o*^>- z;3h;5I$#(AnoEFbVcXBFQq2+Cr)OccBzl9>6IkbmF)}pZ6nJLxcG1P3nN&UEMGuEw zCKY(x;=RB#iLCT@E{oeeA7!n@Z;CYFBh;y!S6N^JFKfg3{HT&ieF?JU{bbcMpMZpo zae8#VvW&d*=~2}^|49wq`3mTVflwI2Aa0HB`N|W--!eXl(5N@3&%6>v(U{NTT9QWT%!5X_u1}vM8-)*}mv*zyrZ&YWxXxnK4VIz8ij`PPG%HQyPpAI$Pai`V4j}EvD9;Sfu~x>*DlmlNZQ9rh2+jon|Nt6(>?rdH=|)~khF{F zdt_&mM_oV6{vz22q);}}0jYP*Rt`8?X~4|ZOA;_|v@_L-#KTw{UDebCkm!~%eS#$C z0CjdLtYQ`%#bLWS;0VS$YTh-4QujWTs>aKSn!l6Ufy))&+ClX!W@ej5OTA|Zqcbee zQF2W^iBjULZLd0CnG@F^4)?v{Wbi zf`T3%z8`^hQ=mtj@|;)ZBnV8jBnY(kj560uA->u6p7VEeQpxpf=b2GiM@M;IH685D zNBBK&e#t~A#A=t6*vmvqB@uqy8A`}HG77tky;?p5Qis0e9Zr_-p+ER=)bvVPa-w!Q z+bTQC(Vf9?Q8W4Xx;r#ARl+7`e{z$YurJNw^{s+TYH|}nXCp)EYLqVhGbi}NH7fc} zeM;y#x;`{LLCs25940k8g$*gi_;l&7+h3n`aECf3)5A0}I-7z6cwp!}0@ z43uaR10V{Ek7BC7);^#?Or#D31|NdaBFdj>6RMtP`QBS58tNGlCWTLXm{IR2jgs=B zBrm{DR)}qXPLjX(^Ls}h!h8x%RiQy}NcWe`zIBS0td>ct*{qhCG&ki-zPT7Xm6Nb# zm+e=!EGo-;`q8|hJ}sG*fX7*pFxy?y@+B?vmTConNZ;Kv;5?o`P2PaP}sgxim>RV`|E7woAwJv81MSj6wt;e)_xinJjJ((7M>`OX}xkH

        #vklhkG2>n) z%`F1}#u9A(?|}6I`6Q+MN!ycUh;U6|oa#<*-RU{LqJCb3mwA8%3mc=4bhXSpcVmxx zf-={1r##?J7kT0&=GD_%pHSTyv2j``#l~r&g~w?j+xWfEv}j>^bIZIq6?H#UR+jtt z6R(-evr#an;oUw(l1KT?n-INu2|JIN2d796w+B1JotvC~vl%0*q5LOao6tN_dh&(M zPqrQD3%b*X^7qYsJlD5hd${R|dEb5~pR}dACqlBSaQH50JMP$(rU<*HcFd^ zFC%40HbuVt@NO1H^S_}$aKp-=UV`GN1hMjik|ENPRWwwVsN4vHe9GRUHjy!%V4)|< z*cP+$LGrSDGEvBXnq2&R-{ng4;Cqs4m4YuybmC(CX{+hj{3h829;ntyvj~}44K+?xlqvBdP~m3=c`Waz(0rl zfOcK9<(TAGfBECfh33JZNNX}x>rx5rv2_`5`mOi3HMmNTEms~Nqy92f-)k=4D}9(h zf0Vw|4*4-4!czM~+0Z4?Y*igASu|&@EX$gn5Lss@g7Fm4f;*Ho@e+m%h!2Xp=7Dzp6=#Lw!t+DMvqSI}xlC!@z2=Y7)z4bq{9P)R@9tNl)BvrmtgIOsxa z6;_A3u*qYM_bl8r&jI1>Pe|%7zW_0~Q97RVVP^34Cx1*+{D<>T+UJithv|GAz93)`a6 z?W#0s`40u!p6>f&wz+wkl)Gl-(|y5ssVCm#{Xr7-kGhi}?wQO}cQ_Y@%=T(Y`5ZGC zTiFZ-sWVr3axAusSXn;4qYl2$Wd5-C|V6P|`JYkpUDm z&XCAH3our{-3Bqdt*CRUpq@JH?5R(GxNhb1eXn$z%co1q#lN!o2bR7Ql!p=qveJ** znM8xV;bJ6Qp}83wUNF9<>>_%KR&!gg3rKUzlpmYH^-AHx^GB~kZb9rg)Das&S+z{O zt6Ax-W!PC@0qf5zih;(VD6Luatiz&*(gMx#3>;19j74P&$C=C9k)<*zUp-Xjk29aO zT+APA8(yXj1^1&Q!^<^D)EiwW)CE?}tX#CPZi_`r&N#d?H6QU|eSn&W%xnu#UFul4 ztBz51sca_z^$%+H(_vMZ*nRP)P9!{3-d&A$)J3G8qWuk%Wb zn?s=wx|5pBJpP0(5E&(Chc1@bvFWKUHBohsR~pa`rYa6=BnoW30AbiA*_QEgemJZp zFHDtTVZkmIC5{@6EjDoD8c!Bs#!9=JXmNG84)jSieBUHSHeIslfBFWOFwY5jw@SK5 zxE41YE@A1wmgx{4ZP%!2j@Qh7N4z|tE^R`eJy97%TVvEaM$gVF*VD}YGBx?CS_om1?3c8$+BPAno-b&)I zbqgF{9j*(jv@VVtrI*46+JIn5--gLJ~uMA|zcF z8S~fIGqlD=MyyvuF6@L*o*3!~3dGurZf{#o>K;246R<3-5#6h>f~uZ7cV%XFXAv_E-08Y;B3m z1n==O>ketjRKOmv)!Z9a_neA&dY>pAi_(B{wc541wFM)z8VzDEiMX}i7oxNWL&yfC zL&oJ3T>?=g`OqoS=1rrZ(8X8$7m@2zzAD+8Ay(mOoSZb0U9c^C$C3=PC{T zscxei7~K3lfj`ALAFQ{b+U;)18D%I#%}zFu#7cj(Ts0@cZY;(L+69a-5do$a)V z2lL7zJ4frzE}ZAX;7@fIVLWPZxBo57s)@R^iGfmDp>Ch#caIGfDILQw{~R{@`A>Qi z^;`2F!+}aA{wvktj6k#eTYfIQ&hqnZQ?S7Oxqm^Ny1=e3u=zW`_Ajui3oP;yb%9xK zP#2iwLUn=k%&O1@IbD`7^rvnJhmYrDRV}E|w42S<~$qEQTV~`1e}(`Qy)aboh^dv%O^J%-awo z@pk^9qj$jZUi#w);uB!FUUdK+=aaOIQH%tfZ?@ix?ouRDg!v;>R^;*dyt!3sc ztvYs8Resf|s$7g+L`)XdVbC{}((Zt~Nv_;*vEH<0f=j!@sw8i!m@ylmfO3nkfSg|&Qe_kj0d zDSa=?3Y%=3sy3O}>g-$5KFn8aZIzv^rn;#)3k9FIX}^yt_pEL}2{hIXhMMN@lGvBI z#jK654TozSR_%kDUJI6U9nP8}3mW*kwCMqd`$bDu(M?)vOM&Z-yDPgYxwM9MgrvEH=A4m)FNdjSI!SKAO9hn;YGpB3HMS50j{aCzTx zsmDJ3U7`A6$(svUmk&b{D~2R=Kwa4*g+9>JrTI))%}P=0$GYqBKUu9$(mud6CQCEr zj!)Hu_$h%=ayyoxnorUU7P>O{Kc`IFP^|S`K4Z2IVWZbr?Ss?V(|WT5asGJ6P}T9S zcG^^$8Q9UD6zFO<4GiUN4TssDbeyUm_gD2;abQDByV-siVUHcK77tXsSADD`u;H%u zzMb>TL9cZ38J75AqD8@%l_ zUbY9rL5I}iFzG|r0f$*Sk#yQ&@&4J=_iNX|*IX!27fa5aaH7=GDE3tvzoJa{?RRzG z7d-yuf)Cbb1s%>F2MRKcxCb1`EX=XSFs~8fm;uM=(+>H9 zV^pv{`+pK*PH-rtcf-CPnC!YRRpuLY0)*X34oc@nC*q(YR8T0kjqzs{m)ulY4$W_w>e~0mYMU>Z?H)Bb&Tq@hDuJ_v|8j{ zr9%p(EGnzH<7>=QYgV=XHZ|)uW$1XutH@!jh@l6)uqSJ5UrEg`+m-O(c;1(In+^(bGtyov;pXJ$dg&eg9mSt$=zDKqy#?B( zpI3!>ExXbx9YVRXNghugwocJ2Vo0xPLHF3&a2WLfEUA0Pwnd?fSc1J*g=UHi)p$X- z^BksX+_YJb{@bO{$0#58N4C)oRG|x~cFBSEB1JvZUL->w8IW{#;Ho{chzEUJIlYpWS?CuP|o5URs2%ma>+*3`l_Vud}l4rxtQEo6#v4O*l% zB@wPK$m3SMulW-{^}W{Que081_LRkMu{4%B(wcmY`ab{GDH-Pm_lZO&P7e zsjC(Ce_TP?DC~~ORPXU*IMmg7(1E)8X7$C3>gpK<_avxYCiR{;wR5m_cMn!p*6N|v zjlVhA??PHOc9FK%B&|z0NqG!mmE3r`|3>)+*dDMRwKpU&`0?j)j@gy;@6Ys0!pi5x`u*6RD;b?CNew^~?kh);vR*L66(-$!z{r z7+a5h*23DloBGIU^&~kVxY}K?I+ML+;JTXWs%_ulvY_tWbFNp0V6^QTEQ?|g}| zw?1Jjv9$u^olKf9p>+d6$L0jsD}Ea-5eJdzNOD>rW_!Hd*+^eG4vWFqA%o1?=*el+ zH^-1oF0;V~#i>E}MB37XBmI#rO+8oVSA-)|3(odB;&UML>bQaUBU*WzeXr(gn)I`Eb3Ybi>A=39LjS}_fhH(H*e`C%58Kij$a zV+9AEa>mtck~D`udy;b8q^3!jGS5BSg$_h~r{2&*1x#fjRZ}@7S`m+2}o^d01 zBu_Ks!NwXUkD1GJI>UZ45#EmY*m4O7htlfVb!*k@k0B-FGdpi-wJBE3Pz z4IbEL#p`cuYZj)op3wJezlG(s@zUjA*)|~kCQ3&9j%(p#?hN=iX*UetG93T)==2L8 zud=Qc zmC(QZD$J`}wXH6#FTldBz)Yru;gcWdIN2n2TcKDS!ezz0L2R>&F<~DD3V#^_B zdg{__YPM2?mEAFFcBay6^`q=9wdQJ&zCKOP4dH!zf>LC$|2LYxbz@lQn9N<&FUJ08 z{cKVwDZMqL2z3Z{ySH_;6)aVJNncSXrpMfTJgjB5JU3TMQkvorZUEaY+OP{{i85>* zdW-oZ)>hib@Tm#3ukq5AL-3nY9GQ5~*Q>{D83P?q1tKOnaMFY2o2Emo$2BiElTQGh zq+SXFnj4W9+CHEIOnU}g&7bL6rp$N{T+cFB{og}}m$~_gf&Qt1Cg(5losye5-rf9p z>j?OdaJwh?bC$`3Ox9Ep=@Lm&KD8ET>(sb-c|WFZcd+pe{^KlE`(tDQJ+bY4?GNG& zk;5D1v8O{HFCKlNc6<-Ub8{06@y98&d;peWCV#Kyt7_fo=}%oOA1|Sh?AU{Ek*fEG zmc2X;pPM>qrI6juWg%Ls0bN2o4OP7*=*pqH2d9f#;N#Od(|U7;%mcFHO6ljd1GVGb zwMtIrK<4=4Nkg^AO%GieI8LK2Bm`=b5A23{BiLe&nChqI0;%zhyr504oA8~U{?vi~ z<%o7XmJO7fdDRdZ$Ff<#%<*ci!uQF)#RlYv2I9@9oVBNs-WM{*+Y?CsheC@JA+fGj zhI7EI(J@Uqt~o{W@6|dU><@>b)Q;PGt@GmjwMsj-ZVYwYdjK5`CLRR;omp0@Fhk7z zlOpK2vkk6RNw+gtPz6<#kHJ8UjCy=&Z$r;+>Ng!AvUyje(z-@{Kf^6@9loDxpo7*WR>18F`ST*j zxk=!mA2yEDS2A@!v(Dr2$C|g+ncbP+Rx=;)^*3fN$I+kay0L244Xt|@)2Hzcf8;w4 zWub4`veTMLJ-W(6l-@L_ac6>JWkV7hYp=R@)XkZyS`+0Qbg1R{ovCTE*32pkQD^Dt zV6iWh@YS^Ppq0-tKaik2I67#J2QE;RBcr>kmTt}ILJm^TU^$2mz&B$P>D(naNTI|BYm@P5ylQ+H4`0DcqOagl$h3N;ms6$!tO4~;Nxi$q5!chdc-fB+ z-r6?xsfsDn7G_i`lM@ba=&oJ5!`I)OBOTum9Godyd?VB8Qk5hPGYKDU;|J+OqcYxstCRz4ZAG9kxR0*gJIz zRBFvWkG+;p?!Dt@sIJY@nJ#sDwK8Ou6Xi67c_6;&t=Gq!4kVt(wTvGP9r|Fr`BFzx zaQfZQSi9-MZ(Q?eF0OI#9!kHsimf7o!ALuces0l6G&q`d00-uoHWW845(wRH#Ww`? z90o1)u)!xFQ5l}sQt*+_>KFU&8gjBvQyz%x{b)WNfkq}ZlLm!O%Ks96!PZnVw4uB; z+_vY!vi8pQzED@Yz2`;CD?6>N?e=ZPbqH1rn*TM-;0fCtI^WxWmNF1Z^Ybxn2V`R# z%WTcR3l~D99c&!||91wyAumEAqxV1`B2e~4qCALpV-cGch4s#>@u=~d9@qTK@RA+M z^OulWHqe(A(YwYf!yA-QP!8xtdE+nB69x}Qs(OqCrrhnQTR>xdYO=925+}FU(7;UJ z;EAdcJgjO!=N#@-($4DpdibD9xYK7WV%@0^Vl>qg4R4TQnRw^()!!EH#D;cA=I(S`M4- z`Ly?)ZR+gQzar3#C4v(54$1p{+J(z#le)X09$R(h(0=b`3~B6J>~*VV%ui7FzR~)! zX1>yUF%&$ud|-FM>3(V%kN`;PTd6t|c?cU1^h}ANqJkyL8L&Zj?=pfB9Jy-LmKA$DfbM{i-4ck`=eC(ldQ8S8JFaHpJtI- zAbFn`ky=0jvv5@MG)_e5*Teg$5v*@9xv1Jx`fy{OjI_*%+ zk|gzZN#Cb+A-x-iz=>+B4b1hH@J z=QMfBXzW{CSTwoV*H>T2r-b5I;Dj7_Xt%euFW6nUU-QMww(0cY*pW?ZY~G+fvHtA5 z&0p-CdZRykMlkzktsuSka6wzgKzg^FCMTYZf2AYom5i}FLy@f?G|)ep_{y&TYWt#i z+5}YVJG1{I(h-j8Smc_V-MA-9h;3nP>g&M=@=rX-X&b0VF7g)iidq8wVtazz-BMI9r%9>BlCR6Z_lKyil?IzX%c;d-ntsZJ)S3iK zaPMvVyMqZ*4K~KJ9Wclzqp8kU+NI#0&HKAU2{kxPlRZ)SVtgn;**~7!w+G^DFxdk8 z53N_?>2OJO{|pPiVLU(%*ip?tkdR)Ew!@4q8YE;{v3&{G;Lzut2S4knv~~tcda`Eu7eQgOf|d4+ zHU9e9d|Sj}l+}juq-lLi3X30YNx5$P8uBrfRyqFvbw35=tR0wqtZm0xwYgVB1#+I$ z!$u3x_tixJd88>Bx`7I@ttBD-KJ@9Wm=|7Ja^3U1r0}Ksi3Ul!|Hf$kBkGZuce490 zo-e)6MCUlj{(g~nefnO`C+HpXAlvELjBP!_9k2iVE|!Y%JN*uxzYB+dZ*YUN^tR#s zB$wd;w`<398-5K2o@OEE)^K=*pb3Z@tXbY^Rwp|f9p<{(R?XVz;Jd(BpA+h2xfTps zg$k!VEw?_bm!|fv;NBl%vO?*`W`S^9y)$6NG9KnCrZiP5f3)P(;_y55myWX5cZ5AN zR^H3iteEG^u2tS~U^mwjsrShh_HmN-slU_fZ@}zEzv#CxL7GxT+2-kp$$We;rh5Z6 zL2cDPZG&PX&Sf94eicV$E`{=qJcN1KfGaq8>dp?ge{yEVL;Kn%_$S|pEs^r8uXK!Q z?LLHg<`^U(056*D~v4?Yil0V*zk6ELgz~WdJ&gAAJIXb>ai>|j|>-OA9S(x=g!JmBN zobDdfZi!=i5@=yFm|&LPNYWSMdh-u1b6);GW;B?~3T9(N>Ky5vlA7(v2rAA?U=@3E zUFuxXe4VHCWD9EA`)YQoQlSL0?@Ke=@1roL9u5^EZsDAD`%oRThGnRVSx=`e ziCNhRTXA(wNlS9vU>=?|1&N7g5nJpsZay83sq?H?NYj{j&`Y{LFF@5O6gBTA_E`uT zfPn{?O;xOpL>TO8n7Sgl;Ys^+aXj)=onkIu7X||3U}=N{G0>cG*IPlNHw-0*6dn)Dep@2xHI)b_Icx)e-Y+o_{AxrG)vMxPOApH?FRas zfsXo;q|YPvCRQhrn>?vL-OlY6^5;)DhBt_L+AgWG_D-|1%B-#4 zfpe1hEWy%zWysWcEY*<4NS1g>J(e*@lk;o}5T%``0bBxB^>{_&@v=h4k~nqp{2F{( zEjo@tf{^Z5^-=RV4kabjWv3b3p(LhbUd^~C&u3|d(=0W~reXC8!$Gppk@G-PJUYpK zoI%$DR%8njVRK{74X1N5h8)_bOLr7)U9(|LW?(BeDeP!BeLS=pfrM(0#{HRknClXh z@|f`l>LBVWYGs)8T~bw8vNNz$?K}~vZOzfM3VBnOVYx1l+}`Ee5$vA~K=RPVcHptP z0?XQw?8)-7jVj3Ov@U&h1l6RY<@@H^aQIA_W*u-q&I??w-h6_8(kK%UG10<2;JWik zsWta;SD|;C1SHJL$*Hm#A-v$&r7Y)EEqaWw`-rO z*=hK+36AU3;23-*J#$P*cM!@Z>$KixlQb{290epqjRnSl^hFmIH|^7pv(uCt`RG3? zgUAh{%-d*+IE{eUm@sRECzjfLeD-McJcs?m@U%07AB3k3VW-=)i{<}EFCEKWJP*e_ z9^v*FpBeJw1_(t9+$0<&OwjFwE@<`7R_$?OfgP)iaAPj?4HDIzQte4mJ!1_R3?R}8 zd3=QM+YNSm476l0FL8VHUC_~QM0LVuN0@#}kO$1@!Dw#TUYBZHQy^#i+*rO}X3{?P zPo3s(n5N4Zx}ZPLe7xr4cP<3X+B=G79-5CYEe3InXP>iXzbW)#&q*g`kuQw(m5xrI zl&nj|Vy&& zNh{WmQ$&0VFNvDdR?*-CLh!C?_)jG{al7{?&{ zv5xC_)qSHMdGn5a?HTNFaeZ2WTser3U>Mq1Gqn}D@=HSZs33#=lK6lO=~zDgW_OQ! z>b@V`(h-83^6OwdNeQ6LiB7umXvw+rsDI7M4v?DvG^}r*WWNrh3u2D9Jw-ewYn4F;pB<Htz)Ypq^K>_EylCk8Yy)8TneS6yWc7Vmv!nW zt@&M@m+cB>wTWXSHzfKLtY2uf!f#zHXM)Q-d=3?hFK{|)8#3uGSV|k7&-6vMNDyo& zgZxG^QZ~>X*awhADbu@hDA#{Qo)MB+2S1@bKJ5JaPw}Z?XE0S!rkedjGq4aY-;W)R ziSK#OI)69UhONx|#wO+-52i^k$k@7v{Xx^BXR*&3b&5G6Zx=r&3H^S;-M;)=IQ*sH zLz0?r;^{~A{dvqA$@Vq27@fzlB`hciy9}DYL%R$vH<-)UN;&zJRkRsUtjOb&JT;9t zLhZ(i{KrXH#=zF7!sIncMg0%oB0snTa}t7@fwm011w{sHo!utPx_1rjz?VxmV0E5Wr2-299;)4!mKA)_depkFeT#pu z)RJQ!bkQc7j=;~0reP^+XX+IHUVIwBRX!e9JeBy5e}2?@kZ&wloEQj|U~q`{n$InP zs@a(4EtK-GR!)nrqyyXML# z=qCF2K$y|~-H>3ne>WufA+{y^_u%z;{~o-4*Zzq<*vd{C>aTlHG2|;u+E4^D**EOY zsEbYR#gh7~FQBis5Ss{HZ0-5gmu){_hj|y{pg>Y5Hg7=G#WwFV;yn0bOW#v{flOaK zl1Dw07;sEWz?PwQ90$(M*E`n7d!j^}f;f`l~gkvEBG=(go}_{yOQ@|K;s#;N+UlxbNNFe27JC2SISdhD~i^ z6B`!6MpgxjB!VD1nas@Yj?C_io!MlUXoILwDkVtKiuj76MSY|`+R*rFX;rmVO*Ke; zv|3ePX;JV0f6jAe&YZck(f9ZM-oxGVKhJs2|2*e8pZCtq%%6jee+riWY2+b)e{;%F zk7E^mw&t(PZfkk*$uWg>8Ecv4!}qYP(TMW*DP;Z*{iyI^%vaw398VB2Q@(%uA4V|x z&LK}fv(?IB%l?gn;p%ZCALVlN*@zu~YTqxMrz*h5;j6Nk7C2lN&bH^;KH}7peUJV; zk9pVPtr<&a$tCKX)m^o0Xm3L!{IJuum}Ns7)Vn-*Go=b&tF`aXo`Ps^Z{3P@`0kI@ z`0kH~wqJ63u;fB^Jxs>?YZo1K_9YkW+p=Sye_8FWE0^E24u`3W@Z$AYe22qUmt1^c z%iGV48Rw_AUo&jSv#YUZTs#$apE^-}422uCTkuW6N8sP<&pGPqt=A5_i%;^ayd7Vz zIp)FxTi#f+)3J-@Ogwp)&+thlN}Y#$yY0V$TOskKcD=breNUe^xCCnNb3J^H2MruO zhOONG{M2Fm+7uL4`|vmZ^?Bnb80%k=*IDpG#q<<@m&fvv`L_ocYqi4$hVUOloF*TA zcaJy=%Tn_qjJ0#Va#Tx3k3@A|hMj85#6c7PP-j^0H1Fsk^QR5nmESTZQ)ybwArHt* znr6+UY1T}dR*ip8an4O3gHP~)i=U}uKCQmdQxl5IJk8a?{!sx+M#}uSch!=U>#NSc zsrsU;MxS3j!hFq0?RWIsi}+w^?Qk6L@OkGD^bLkC_KzXBty=uAWkYE#{-OHNQzAp| z!M@?~Rp;7E**JBec*uhaKbwMz`2Y@n;*k_DukpKx)fbZCQ@y`xA-+^uB<2-GZ9CR~ z4Zgr%)K0AfruqXn^6tNP%$Ls}Gw$NECXH!W{g~Wn8TX$tV#oW39X)Yi3HfG1ShO5^QFTN3Z>R0ZNasFl`@a;}9Rr2I3 zK1TB1$69o$dq1)?U;9vL;;6zpPX5;iDybFs{NPVDFQ0VTHY>-R@?-o1?B|!g_VihJ z%l?YTTJEaFL(Y4T@pk?GuHV^u*~!B{fBD&G&cf?u_g6jnr_XDvhCZ(Q;zrZGYaf5i zo1(r$w(9TIpV=S0>icH(QX_O4Lv`4%+Xnm_9`*>z<>M^bcnjls*TBTo)Kh1kTebQz zzCaCEcYS>Fj$YTB&iS4nUn5^VPJVO*lxuksRLjQ65234BSe>Kr?y;oUFuc2rZ!s{` zSYT#e9K$;k$3AAC@rOM#=ChiMw}(15!)42Ae|AvpAb;h=eRdx5n3_*eUj1a#l&$|% z^VZC+sh@F{Q=|5fU+V`i!&=5XSBulA3_W%GfiZJ1 z30Pct3(_}gBrRHRRKv+N^1x=<#M_78K9i@Km|4Fur;e+_^W&lFjRUk&o;5wE|7l^@ z_N4Rpp3!)`y1m~?xnyq+zl9j@ipA3V<$B}JPb7|)Uw`7yB^o?FH;~)U$kVC$y|Lbb z{R+P^;teyeSUQymX1AXhOq{TPpnujY z*O$sCC*XGgAznCf!X&S+XF*Q}erlj(oM*&3-rr<<$IU(|$Y(M^I0&MLThBiE zAOk0R(~TV>#1DLC)5$#idt$N|rBbJ2YJP2?xmhWRO&|2S2lhpSVkK;H%#bguB(RvY`)D%ueI)q2gBv)$o}g&80e{ zu`~v3S1cDK`m*U%936w<(39^?C37RxPXtMkM6x5+mqyVqQYN3yO`P<9Q&~yDFI;7J z3P19ydMMkMSKWio;^4K1nEG`*V}6uBj)=jZOwnU#Q%{UTAb>YAz4$fQ?t=r&;eK-H z=@+Vk+!M=-=B$NARwNjR(bn065zvzftB&?!bai7yquUY~oePrzekU@gx`5-hFQ1Hd z$8vcLYgtt3;Y_wKjV_Dkdoh18p}RTb?Bd1)iLUNwJeH2*=Mdw)$-LJ#{kVgJV}pW+ zlJP`Wi303QXL>r5Tq6{FcPgK!le>~wvmiXHFPY2JTJ>{?K|I-;Pj#pPL>qDoQrVCk zE>X6oh4s1=>+MW723!yitO+^iT%|c^9??jz)}^V(%1cEp$ymGC!7}|CEVAH-4@;)~WUl?Rt~r z%}Dlgd7YMA+Nm!6fOz^a0bOVo%fwypuDzs58^|9Vu5>2HaqCL=4YaVlQJt@p39zc3S zO2pFH9<8d1q8SOyNNF}Rt@`#I>JJ$*tlIYkRCzc#nhj_?hY^cK4)=)}&|mC5B*V=x$^Hm}z|x#=J+8HjRO@i?&T^`+s+XHmLT5**tZB>Ul_>FC9>G!sv6Hg~&y*Q9@k?HJ7 zosEfUb&}T|>&MTv#yYz(NTPcC@OT>Q%VAm4Yi{8<5$){F^kp%i%viDpqlbfbG}oKY zdR?e5KR+4Ed+2ht#iJXd>DU0q1%BT=pNVJEQFAOqmZD20loMq|R|h>;v3w4toDy&2q=ixBeqYgpQ zuI^aeE83RD*)AXD5){KqVSa----X|ErlOjI2{cac(Po=9KR&E)4|w9h#)3o0*~w@+ z#T9azI&V+sp2|ZhJfN}qI}1DSz%1$Y&O#NI&Q}7qfa>A5*|5Y`jN*SIcsWrdG?W0XSJUi zZJRoKDo--Ajz22E5L$>OBBAa@)GdnKxeO$+2AY%a1Rj`!6HjdC>QJ2WJRS4Qw||hq zfq4r`lSE1FL)t1PJxoetKxpJP+d0T~hAq^)DVnnJ(9R?@JZQD3* zG+0p4%K78v)SWYTaHWR|9=fp!#24iHy1oCmx7RpZ#wT=n#r>bF1@GMwLBm+wQI5w! zO2gujp!5t^I75|+rA0g*s2_1ww*>}8e(}K*l^E~jAtiLn%Fzh z!y|xHPd1ZD&zL-M64K1szooe(N2i%HY4QQ01GK;{ZRJd2X{9}>89GE04>H_9ko8ZR zJbB_lUVn3Qi@BRE93u2WTR3jeAv_cn1RRT=(GGC>!LeH%n~EB^fx>MNPc|hbv2OEh z9>5|VuQ4~U;EAk3RskHE(f!H9xWa0IXBT!UbwE>_+5noS<~nc9y3|?BtT0ZQY;OnG z)>0zVF5x1tx=%>xO>00|Vzol_vPran_ku9rT4c+%N^?q^#t|LlyU_Kj=(Jh0S)BLK zdcnrQu@8?&I#Hj!!SJ*xUBPO?mCQ*msy6mG?)=rkCyKipPt|5yXgw9dI?$0(9>cKb zD$&6ctfw`s%swmAOxA8Zb}5v$6{cmf1AN4Ur#U^C4_wEJr|+Z9g8@FII>9^!V1maD z>)A>wi)RYz-a9yy2SFT@6Pa%P=tt?!$J3w%MA-N-gZml-Ja8!B)WQP9mLs@uf|K8S zFFo59g&+-4g-_LaR_(0zj!}BL!L0%wUggob3)!2fBQOWCEf<=0dCaP5z) z1{c59kY9Df-@E2NHMJi9BBew1&>`M`QC)RSHB8{&>Y+o24;fxF+{ZE62aV)F>JP0R zGGw?vq`C&V$l)jc49{%$^6D{Nk2kM>a{f1$Y#9CPaaG3;zohfoeAU)Jx%H4QUAO1V zV}=iWtGVV+?_Ra@kDfbt+OAFej_CeZG;-hxuTJjnp85EZn=ZV6;ry?D?a2??k9hmm z1OL8Y>(A#t@WIdr|Nf7b1)rRD@eQ~9;D-9`7azOF8%H;E%zS6l>4!eh8|k$;Th_ z$jX}c^6B9}A2nw2q~%}z%7g=cdC2SEThuse+iz4~x6cKu-x;?0^824SOYR*oh4!Y{-#eco(%)jjL!rr4+{%6R@9eTfY+9h{>ze~6J^UwEPhd#i?u#@`r z?%h0%6|5SdM zk}vVuchySn`Rq&nhBstBzmj1nE|m2-E~;?Vc^lO@VZZML%yGl9Rp+h4rN`G!z`Fr& zg=;E4?BqXH;Fz1LevKPIg8AAAGiGQXgZXFtw2Q%fm6G|22=f(8=BwRk1B3bcPu9&~ z{Syf-z+c+Rc9>w=Zqg>EpNu{9CH+8unU6%-HqIsbf&OA!jD3KGVA@s?SirQ?5-I4; z&+SEl?X%~p@rzsje@fFCY%Cjw#en00?Pbz#qff6@*9@T_0$fY13s8kXVwP2YIx@#+ zsJT=}5KrS#1Xn{IwJotK-H>Oi=t}Pqjs9BWHD41MwpgW zV`N@Thal{MtI9i?!>bUgoe@!u5xGx`&OQK9l~?a=B0$jT2Az<<)%b<`@zS1UV6O81 z?eNz-`g=QRmyfG@F;si_AjJyRSlPcLMe>m29Ta=2z+VS=zurd|;CQd{rdXxv&x4(` zn}3+MsDyu8hyMugVadl(ME%=2`CsvF6o2XZXLy?q)K%(qyHo!$PTI{s-pQZgq-Q(n zIZk@6lb+|K6L!jWM{ha*$o%DfD`VfB{ z4MRxas`92f`G-4cH-DOwf0UDU_m^Xx{1g0c@y~G7?|a)Cw+>O zKHX37CINxd*!SwHUY5hx$w*guG5;gkA|opQOH~(@=trt{k+ja=q3UYrG0?s$uhV}? zrA#{EzsYbJB4qop90}PP)@cr<`=R zlRnEy_c`eSCw;DyUgD&eI%%E)ilN%O)JZS*|ICE}A&blRMmzpl;pne)(%1Vl4p7Ct z08y3aS6wOlt4@FBe?D2~b68b*Kk$!`e4YNj!?(&wyW{U>Cx4A^TFjNa3imI%HvPBS zbNTOd%KyMg-|eLDb<+1a=?9$jLr(f9PI{gHtG%>shbw#6Ir)z}X}nu%g=+8TPWqQl z`UNNbJ170Jlm4@le%(pG>7@VWq~CSY?>p%ao%F{}+C86s;=dv5??04(hB*ECnN$9A zC+$1>_;o-lRC_MpFel#~KU+Kb?)la|kGkj2?Va*c?| zq}~0`JukZRe|M++9!@%N(tA4Ty_|HtlO9`j&;;E?tG0^EIM0H-^JwSl4Bd$6; zUE59`R&ZOb!;_Yy_hGJn4p-+jdo%ff0%0|-IJKFAv-1a1>`-YjpUqz_W*6TJzJ{mVyCTL+eZf2>LA_V3OI5)zm{ zo*T0Srmq(MbAao-lfAzfqp$?%~A!X#XE-f7;Rl4iHnd0+LOC`r%vekSJymSKHM zopi0(cRE&G0uSutftPp!0V9y*7{35b7I%|7kZndJl#--*Y(d101$NgBJX(~ z>=5YoI&YbGk*o-s?_%#>sZXab@kYw|fzzhWyUaUc97`K}F86-Zq|^LM|72u;Z3C|J zuJ#%^aS*b#ZS4=vzc}H7WnHW{jf^k=N%yFxJs|}_7neUzK6U+Infc0!&T=!>iyQ4pWBK5 z=BoUkdG|c0*XS~DrWoaGgDj7~n!1NQ+z7v4!ykB_-?5VN}`DVvDQsw`~+gJRj z`}?=vrQ&~`{+)M(tXF!x{2o7(uK9HOC2uQP-*oy9-UOLnRIBqgcz4M9JWr)JdT&bq zaM;&*Z+O3y@~tZUw)d9!N7w&1?@Adzn*SZ|^OE%6z2B9L*ME4^nn8r1%fIX8==ehV zpI)1+Z+iUv%llO3gVz7RJ8uVD|3mMO6Ycaz-cMwF=>6?uFHXY{Xm*{q+55MQCr-mU z@84dFtW&S4n4Rz?_^Q3=u z{l5RI_~$^SKg54m`nOM|xAHHS^ngll<0obQPgUuWez%MtBo+TOF6;;*poU~e4SQvr!%oV=Zf$O}9{@$|w^{ez`|8yBI>s0z6 z|LgSt2+MHQd58LkSF5D@L%#Q&_RVnSbC;7p-^p*aCOr9qJxckn5r030dh5L7{F`L_ zQH%N$gzs_SI`1Uk-=8_2_aCJ{)8ASA%V}Kao$B8fFjohb-;IAH5Z)r=l_I7yGM-KP z_c9-nu)EGX!~cQQKOYKp-U5G<(_c|p9~xAC#y?Zq$EeQh_2&ct2vo!V>t8PWot|%t z{CxuE!Y{b$ymS1=_hZWQ4#S20*gsDE)1uPn`+GGpSAR~5{nEc;f=(ZUsLs2@?~wA0 z>b!6HpGm$>U*T^f>l;h4{hx~cCjE-+SMNZ8{m_5Z8L#iMkOabaWxViC4f~zHgZPhk zYIWZC{C5MRt?PSM)>}$h{>#uaf$1fUCZ+Qa7d}dvKYF~**Z#fL|IyYu&A-gQQ~Ybv z*E#tYIqm(8oS%5-S?AsBpCj#^2ZB0pt$&F4!|)wHmI(Vf)}cD@5r36q@BYqw*evtw z0;T`7f0LAdRE^*DeiH|d1ls?Y4A(uJhjWSIPPNRF!_#Ps)1mxk^9p?;z_x zlBzu3+fiW~RsW0r`OfcQp-$~yt{xkX8I{kZ!)4xxl z9uvsN?lgDFG|hip=W-b!?nTTY=F6jSmZAJ|#GLB>AMpo)+Ysfnn@1*p1O6ZcxG0~E zn4A%5FU=%ooooUz^SK=ov(71kS?A$`S?6hjSaldzm(N zHd77(Wk(1`RHDN@K0=2f9E^*Y`V9U?6_w~KAHJ&P%5Se}to-)6#>#J-G**85i^i&7 zhHA{R5n$HE=}k=Tg9J1GXu;$@MKHO$1ylc0!Su-r!K{q@Wmcw|C?G)QzA0g zw--#^KrnR~{I_(h%D$~J>+{7As_h%J9Np|iw$hl#3}SL}OCctQ@-r|wz9MpRoFSNP zXYjYvv8tB_B5Z>zg8h#&PHSQY#ShH77>vzK`)id*m5Go5p&l3U7WKs#r4L-t|Ba&2 zoYwm8|4qx4AFOr9$XVY1nWe*qBXCMbfD8OPE3rzOvdRxqR{0-u@GYp(L^GFFUqJ5r z#rgXz@|CaT+{f)80?fL`3MTh7!5m{V1S8UOQ}pMHociYqrY)BVX8p?r(=GXama-o8Yh4hLb&+6Xzz zF_4p=N-6%AwM_9pp|RqJ4nG;<^oYoWQZ@s#+&Gc5+yub|{(1-y6#t$YtNxXBT-glF zd5 zh~Pp$egXl4s`pckRlSxCk-fECjW=NG*5jg_x(vSXFdgCMAfZIwV5GXgm{RqkUtYkX zt?HG&GyQb~{TtBf`@vEvIiT5sXOBS?JdQUnz3(+$9*po2C(S$fshq&EKe?9zQi&PT!fap~jDlPx{E0vCaDY2Xxthc!(~`Hsg&;mBBXq zpDC!??Egn&GnSa5eH@c**xP8IKTMaUFZ|&ew-G;&KM2!tnXxyAct1*U&x?yZW56?y zSmuJ78F1Prp^a~=>sl#w0R!lD!7lBZQ@%H z#I3+H1k=Zh1hefI2&TXJsTuWW09RFM+z!l7!ziB(yq{o}ohFz*yF@VST`rhq8MvNY z1sVH*_-nw!Ele)Tvyjv8Mu)y8J_&OA*U0H#g9E{*Lx=vQyc3xIC5{0%3hoAGFk?*F zBWs|tN7g`PgN%P=18-^&lnpYElntAdSl?@~QxGr|y$CS5cM?qQX2Im1DVXi%2%X>->S>05O9vuga*lJnnf>7@*n$d>^p#t;`G6t`WK|s$KRR->B&HJ&v?1 zAU}M_Fa%d*qJnxo2WFkjrkr&$o0xT~a}+S^oGWtH*&NegBhzbQCC%<#XoOW8I_ zm)jdr1emrp3Z`xQ38rlfJ{MO6RhEl^1T!|aMLKeT7Ak*oaYbNxp9e4mN-$kWhXH0RBI71>uJRm0cJfj1+$)01hbyg1hXFHPw2BA20zfY z?E)NWp+pCNijIdOitq+Yf?4xb8>QdX8SfCSp!yV;`A6c40Mlm0bEwu)V;-1t22~~sVA}ar!G$r| z1_8ouxFSa=sQ&nvOl+&N0eF94WrJWfCIu^h0yjcOjY*NKF)4E8XORccBR@Io1+y%J zKhamQs`n@bbw6?-AdJNo0cJjf{}nxcl|C^0MA<1=*(q4r3CwA$>=e1OQ{>7{kq5$0 zPGzU)DE?z0L?Dh(0YQyDVA`@fF3OpIf?(FK`T}y+9~XImI3<|%oGUm$e1TxfuMr#| z{;puke<+yk_=#Zp^H+ic#A>fcz0`kI2DVYA@ z8&QS_NzXr8`=&-P=hJY(uOL=q2|8<0PK_nOYAgv>V+ok`tFa{VKzP0hIsL`D$ip@p zOq&dDvT(D7TP!?9F#Eq%@U4j31mB4mZY^-OTX=?rXIprVh38s$p5RLnCj|E*?h?#n zOjwt1S7=f^Ua> zjU~U+!gpKvJ`1n4@FNypCz$h(ZKIv{BYs-&!-$_1%;y`=3#Pwc6g&xX2ESQ@8sfnCf{DTBEX{%t7jb|=dplt*25*9nDv}4cqC#5-gB`o z<&(FxOxgLi##ntRb%Cc(=;}Ipbp0beeyE0Mia|9b_j6fRQy3u{sE?qd*h;<+&n`Nlluh0OeFnzK; znnzCRb0`~}5=>6M6-+sO#Wz%mDQ^?ZvS$dU4;lP~j#V2sYCH^4B&IRBh?&pwzW9N> zehd{Nkjtzs0r9K&gV2D>e@#JsPyM>aO_cKxfzV96NkR3m-Xd{b*A$3|>4%J9)^odH z+V!d605Kl}QJ-}xUja7)t1}NU>ueMq*2$%o`V2=3X8Vp2%=VomnEpRcFze;Iz_PT5 zZ|)M)KSv7=fHzoppK7f``Q?J^fmz0ngA76WHleZdEnh4^VBO~4mcHOzV_@CHpFk}j zmU%~BzeAT*{^uk^pfCJREm!{U(pdSQg9xF8Iy}%Jz)UZaR8a2)z_j;3k<;EI1k+wj z%YuGPFl}ETn6~!_rVq~&%y#4j2Z+BRn6_Ujm~FaIFm1n0Fx&J~!Ljql&7^%*e>dHfU}WUp1ab&lrM&S2ymnme-LN`G40=4FlB0Ogq(KmD014x z+c4_WE;Yx2X;+`fY1f5<1H>x?BhvR%(5FwX6*=uy_g0Y8-aAE(NZ)5c-UNKF$k`6s z>dQZ$p{;BegYp~jH_=AgXWFj(CjJR1hYtNiJIq|B9Xg7Qz7#`_?O08>|;2Y|^p zRpi4Fw+Uw3j}japo-LU6s&Rs{)K}vKn7&ox1ems`aj`DizF2SrVg}R3;eua6zq7nq zLsZ){dJLFx^39<#PGk(I_M+|YqU;H;i`b7Cb>cUY*aR!J_6HL1p%$}m!_@S1mHfD9ZR2$FInDv=wHLAV6TF&}> z-qa!lxct1v^rQKFq>1=V{6QdpB(0!+ehW-L93yhtqRw)VQ&;sJFm1U=bZCnjpODj* zwIZi2zZ4uGeo-*n`$xgF>kYw;h~E}W8yU==OPh>;wgQfHGnen#Xv};Dcbq(paZbC< zI8lD^N1nCN zpNq74-)0_ht+t_y7&?8>$qIh03P08-_zqy&AK_wyfT62!9^s%(!0fwOxJmP?R|-btT_-q!_0m5Wl5n#5J^%4(9e28GS`!K;H5zi1zKHMrOefl6Sm_ATvHt=u^-zD+@ z@vjBbH=6|0Hy-;D`t;3Cg6R+SSu^BKz%xZo8!r@0-(1N4f=(;&j|9^lGJ81h&nr;cT1nZ9puaakFivuh};9T!n2Q|1ZJMwwd*x z^+s~|gP_hoz%{_?`~%E<_51;tcClXS)90*U>eEy7=b?&Nlcw03y(C{{jWI&p*+)h4No$JcW3J z#;wE$XnWd-`9KIADBL1Tc{I3O#6xH1GRSm(+8@5fdgQ*UjVb*ak!{oi}*aj^oKepKu*5vMb3VF zSTOsMUB$BW4Vy$v-@Gok74Zl(k8=8Eq+t4Hg5Y-GqXpA9rwFER&JaxBFtERNM1$!I zU&g>Tz>y{RgP``-B|0BN#fzLzsrYlL#{66IEL7$xeQM?=ePQOBnqS{wDVayWteP${YB2X`~OhNU>|DDEYju*MulK);~RqrJl??s(&S~|~bto(41 zu4@E!F4giKEIdIlbs5aND?@=Jmno4RSAxfh+|^h7-_rVDq7E>1ngr{dBEQnVTuYTb zf+_L2s3Rzy5 zhc7Ety=E@=Rf2Vx^_lJQzpdrX#3=hF%5t6)Z-YVJCU{@qcENLjX-DKrJ#UT`93V~z zCU>`BMEd**{U+c=B4?e81=C*jYz;aL{I(MEw*d2V5n|e0x(I`jvZ zU1It}J#zyl|HUE)RNpp1oqFKwEcy2Yw?clSVEW)@!Q|m{e3oT+KrsFBW5KlH5y75~XB`|C@B=`*z^L(Y7)W&%fmn?;8{J6P~̉Y5VMWsq|fFGM&v~W zHz1xbn7&l&2K3pc8%55x{!wrq@mqos>GwII-w*r`k+a?J37&#@XO0c%FpL)547`V6 z_SK$(sn3rajsAgxTOmJKF#E7oFx%HIxE(kq7|`RRXYwoo?i9QfSly#R-UO`XCh!bk zHNSuv)cgXT4SbuF<+$MIWaOls{5+U=F7U&G=K;SY7|{Ep-~{k1g1dlU6-@j8A((z< zFk@*rvD}N*63Yj&90%sTlnAlxSsVu(Zwvu0;yMhZdSY378%4e!re73iRm>6T}y$kwx6JM?6YeoJz zQKt#<-f#hNGw?XUY{xXgQ-Gs_S?_$ot-wjaZNU6UhCI`O)t(4UecrlI{toch1+)H3 z1XG7cF6wLq=5c{|6Y!OS*%q}|LjD%;Dv`GX|3EN#?h!l#_&&k2fgco1o}UYz1N@xe zxxmj0rceGRcpk8tv#2)#tUi|nW`7Q?(srhS8w4){o*?*AVE#L9wuQEJ30@AoK=2CS z)q=CYk6Zdr2+l*!XP4yZ2mYs}^S91o9TaOM%a@bmj?u1oF6G@^lEMJp+Q-M_(7b4)`L$>w&Kp%(j0=@YBF|S#q9t zY5(((|48t&zz+y!UC#-A5tzZ8Z6NmiRg~!O{)k+s*NyFvCN{x;Oe1x_#txEDBELZk z73WPF4@cx*i@}RfOZ>Qkh36Q5!Sq)v%Qd-$a@kYbh_BcB z?ZnXe1vqC5ejRuY@prY(Tw)FY1oA{~)a{)ncr@aK;0DAO31&Sj1hXC22&QkZ70miq z3#QI3f?E;OT-HT@a9Jm&j#>|aM*^$$5I6$-Ptl=oJ{L^=Dqojv0v;l`8CZQ@kFso& zdj0@B1$al%VY}2B26FNoD)Je?>O2EEeWun}VERlwqX2FM=11VPnLOVVOrCEE4uI9# z2p#sJI?n(z+%7uw=MM#whwllIb1sz-d^nH&P$QW85B){?9f(;U@#BaY%ve%75Z2&k zU+Ku$pij-`hU0-FH)}tudo*B%<8e{WI%f(dAALbN`54@~_I2uFKT)R@a<2kIT@Hoyl!a79HH|N z*niY{7dmPT57Y91@)z(2fj%{#3CI9D*BK6^v{2r%7Bopr!x31(lZ^ETw`ftOfiFA&@c z`8Nc&0jqrk`qP2g<>X{wmlNL&{IuY9;JvGgI^zV-gS=620{A$=Y~y^vUBEqp)4+Mb zdEjpg2J}`4UJQJV;3dG<3SJ6)yQP1p;2DtrP%zu|py1iSKM_p-sPi-0bsz8xB3}#q zieNzRRlyCwn*=uk|66bqm8y$=s202i;;k+Dwu0}3e0#yPEwFU<5_1`GS`NCk2lN9uT|&_)5Wm9^YeNzpn)Tj^OKoZ?SaN z2wnyG9fEHLzF#nHX5buW7>t$Gsi}+H+Ul&Xp&lkJ`@r8ovKc=Z4AihyBBE9ZGUJtC+ zJz)09UvW{t5%Fh&5y1&s-UL`Jn0+-=FzXsCn0 zv%pUYX1%`_oB*z=()@YgF@pPn_ZJN49Uz!}b&%jCz(-m-(*-Yu{8+)ufEhU67>45_ z9*zCCme@Xr*T5)*2<4j;)aMO$4nly7Wv8I5I_KO$spgCT*8pR9d&I0~TfwYHy#opP zNZ>IdXFZbyk3xL3U_|OHNS@KaCx|>i%;2_VZdhA3D%FyvlDW{8Gpp ziMf~{a9o-*Ml&(W@{GZ8Nz5}wtKfT3R<-?32oO};f$0+*y}Sr8eZn>q*CIYZFnw~E zVCJUMV78Chls6)NKrq|)2f=LLp9Qmh z>OPl+5dMjaWv3v1UvMj82DdMs2DcW8dvXYRk+M4$Ix(}@#WXNJhfqci3RJ{owQ;GKZg*uDz_1SGu(F#A#U zFEC}Qe}QX(cNQJ?BW<8Q!{NAy*{4ScrVmaL93WmQnC-qza06meuq@mCv|#F}{(_wN zQ;}1@3e7Y6b%G(*-+cjn_Vp-{(|^5|4qsx=2$p0mnef1wp=QF{xA@{1Z&Fn)4cO0HR zymWnIADFSnJ}_qh+T^bWF#>%`9o}1+@zxC<`p)d>t;BQy0&O+pmbRMr*=V27&P1Sn zJ|8wC%)>?g^TA14ha2*~mxz%_`~cmt+PjW^(0VD=w%7}R+HcqH(_xF}~^ z)p-DzZKa)*v#nI1hcGqZU8yMN?g=wK&;jrVERdoTVVR>hoVCp z9~8{Cz96_2v07(@^EHvTA^wYCa=s^+oc|U)9kCBr(gp@@SHvyATuO*p_Dh0Uc2~h1 ztBr!`kD~<709Kz_78a75mSO z&yj*xK*)YF`!9W6@*OgpAwXb%uq;3SY9MAq5!gP!yI_FXFat-$;Uft=023~W1t@!|IzAF>YW@Us`TjrhmV35fZDA%gMY zA0cl=+RQIC{y7j3M&OD7)1TW2W}PDi)1PX+g${jkp2!jD{T*`ZUTVoN7fiohA(-~6 z^%nZH_Xd%(FIEc<5W@w^9z@=c1k=wC3r3{JEqJB_KPB=e#J?0wAO2l1B7Me#KK-xG zc);|{N4VJbR>W%U1#SaoaQ$z;)Acv_lWjKRS@~alPFwxA$ROi6ru#zq@LoOkvdD`7 zQ@2kr?N@Uaa@w!vEHJs(iVh;}2guo9KeOa&tU?|@_Ke8ckIxFOMf@wlv|XLGpwE8U zAad5F<}&0An{m-j_M?Yp5OWMLm^QKw<16J8jKiTAROB`OVIP~bgc@V)ScDyLMS$6s zv4Y9R`Y5N(`wAxa1i|D!N-%9cM=WO!B(HggMEQ25wm+bJt;Y4ldm|vTPrN|5F{)zQ~U?=HC+eBbMCm3yc#6)fd2TgM>V0JhN^7!`g>seQ}wV z2h@=>3ERW5_g|1G|NjvJgeF{+{{eEgllU3nDT24%Ue+e*qv;~w3-WeiPF93%aYeY9 zBkYEYnEe$9rf>HW%r@;U7***$g+AM))+k`M=~&TWf1N5gK%5fH`UeEFuEm1c7hf05 zcAqbp?Or9A?NVn!!UYP`2QLV2Mf{53HpH(Arau_W*^+k9hYV~d@ni56 z+xdUncWjS2>#_~xd>))^gZuv2+mNfilYUWq>pCbR(7%y&x?gq@%zoKLFzr=+w@%xu z)Fuk($O4$mpaoEjc2k(C!NYCdt>R!YTe21 zctKk+k}00aEJ!7z@vdZiK{V0V-3>lNRVlw{lclk!7X}Q%P?8_gpnMd+ubt{Z^<|my zOizc&HC~9PvR%nuI3m9wIpAe;v1lTh%lBpmqD)(EQzpjJaUqD(%jsliEN-+)T3bOe z+$7awv7S7;ESruE6nildP4#qSq8+`N?r1!Z-zhG-%rro|4h>6mMYFNqn5}3``Xahz zrgbLs(Rg2PZ?Y#J?aucVyVGVXQ!1l@XLWJrRBC|k)L1&(6D?|mSs$ucRww+BOGdu{ zoug>COxM&E>q+FgVhfVd?p&v3TUnJ_J(uc4wYFmAMwIK8k!thG6~jm?=~g05_F|qy zdt%*5t675(JNmY(I?{c)u4tw&pY1~rmsO~yUD1*GRCf}(l@!&gwFRAcvNw;pa#l1R zi>6b#l3~U9Abpoir!!RR!;F@ZXBs%TR#_8zleuJ1BHA?wqwSDz^)goFn0#-nCzs9i z<_oi)wq;peM=T#pV?3d?C7JYPI;nJ0JsfaUu$BfA#IlM4i&&K23Tb|sMwxw_+}R{X ziN&ClSV26UjP;gf+x`vLD654FL{~1FS%ht<+)~@E;hJTH%B^33u2j!dlt|9+>x^c5 zQ&{%m1;-Vd-Iq6KYbM_UtwBO>0L%DTN~Or-lO7b#;` z?ZkM>X3!>koY;KkB*3AY$F5@(O`Eo$8_#riW1|R})HGD@$e4<`zI1UY_fKv*h%Sb+ zGaV@m=tQz37OIfyNfnF9j;&9Qa}r%8 zCCm7?z^bwhS2B)0-YQT=#-7FwWT}K%TCSytII4<+FodI`LT?6hA~qo;-&o$wgN)UO zRP9KoI=k{w<+pCSHncfWbvT+IOLWKLSnH{X11QF5$%?3y^x=u447pnv8MacGk4mOP zp(-?^i*`uqaD#Dx!DLG&qTR6^j?y?<#(OPuIUwRZ9y)T>xnUXhf<&SUElc3kyD-U9 zYi^KHYHL}YqgJt8Svy5sp+;Gb6Ft!`tQV*?+>vT^FDg|&!D8gf3NTm;Wb_s_!+Qb8 z^NIUMlRdHdSXgj^>cLLhlU!7|R|AD7qo`VZlf6YB zGg~%^iut;Ds;5|bf;HE&I$Jyu?d;9;Wh*ww7sKYTa3A>Hj;*8shn&B1}^DQRf5Z8sO zlvGx(7*rm4sQbP;ua=LM;=ejQN5EY+fY%3vg-cW=u~vU7onn? zx?;I5m{OrKJ!yGnP4>sJ7j@#cD}(#-!otK!gGDKy%pvM670azxKBKZKu37qlhaLmG zr^EervUiXb(@gL15@k-y=J5DKFU1%ndJ7nYeGql=wY{7SqFrW)Iv{3pd3A>;tIr^Y zgsR(hbG7Gf8GTipQaLm=mQJ0G?G7`PM&KqX1_xBqGVT;DQ$z7AsBYa!V6uu&X!^3! zfU?HIxI$)yT?qMx5!<+3pp30}3R=_~%MMChrfTYl3u9Muy|WI}Y+ZlRyfVGr&}c4qRaSRNZ!#R0_IxKP!w=Bsm& zt6esXlo1tc=Wx(ZOM9?l$>Nph%cfIt+fq~g7gR4Zf?kt3H%Nb$Yn2gkf!H!piB=hh z@m}|U$}5twHzBf7wXSNzDQkzmk2p&4PHQ5#3e`$`I&5Anok8QnKHO)X#1=K zbu@)X!TbaWG$E6lrk30oRhqN1PT&wZNUvB*_WEX<(}!&!T4X6RUrm}~e%J^rs)U!u zZ2}H7*azc-Rm7GTZb|vLWw3@-R4%iCo3ZkDb}+sYt)5IiIpL_|PZ|%S;|mH$6#LN) zK9Q}|F*FU6Cf5UvFmKuUW!5TJvZ(1UoNhbtur1eROVnd45m#8!QH~#7sh0CLZID3{ zqG}F+xkagbylX<9&s|DBLoO?0?6sWK5#>{`g56dQKYj}t`>OH1Jz-fK$b2l>$&W;{ z=oNfaQeftU)Q2yAO2V89PO*BK-U;uYGNrOk((45K5jTY$Nqne^MIJtm;>of({8chR z>v8^T7Y@=dA*x&Km+~^{^uq2awjmtR!W@fpcVV1_Yp7mH%rCmz?#TIl9iBQ#byR9F zoCPf&L-LF@W!c7!JOR>=3uEa%(}XhHs9@~|gZM05GnBBn zn}2cY!OCoLM=!6Y%r1B#r9bN{J^~x0wS%aaQ5TOssUCbdz)#N9c4wS!ddhSRdu&T( z2C0Ngp?YdIi1|f&SG$b3cuPB&y|$KV2j;1Mw@g~DYdnQTmeVIckS(rgdd%Xk$h;9$k_%5( z&WWcpJ;rBc78jNZRM;g?3=-cASk&j3RX>dhl zMa#L#?R|gMVK~O|hAf0}OM0?oO=vGUK~*kgMhZ2Yl~$@RYqi>!IWo;B?uBVsc>F4p z2Y0D_AjU%+9HY+=+;nj#(jCM3E?SyZbR~ymA(NkRNa3P}dLC_xTN>7<9{R1MFdc1z z+N{f!%Gz64(+25WOQ)>7@|PLz@fgkk)vhkAEsmmbo*aauczdk0b=W#|1IntDrvb6Pd>4;fmF~a_`KBt_s#rXWI|;f- zl{fkHo_f(wKQpbwTRcPHaVp+5>rG`6;=@o=)$0?ogmoLuFb~nNP~~vi)E2o48f64r zoApa{1)VU9LexU3)O&4PWGdAvBhniIS;9;y=7v8?RHouZX}t_vhYqzm4>HETP{A@| zS;|`R)$<9x7j2=cK?{XelZnm49rDw&0~L6br4YxSMZrBs!{F+@IKzk}~#^VcoT1#ljO2RBz{FHCbr(BfOEA zO(*loQVq4k$&OXjsIXJ%GrxXn2A;}`cc@~S=k#g+3(&cWWlU;@mM)G-+!gf33s#mD zpcRZ>AJ=jHishbw}80;cev$HZ%zze&Y56@j$nV!z-3k4nBRuzZ)84 zc?i=Bc|sMYRysE1Xv2=fKT4T2`2eRD9he>uVmq%ii*yR z%ut)kGWDJk&*dl5AB9wN==3Ue;r=Z~%Z!)`E-We*+FL#YVQx{cjL>yqQMEuB;+dkB zO*p8c>%wvh%Z0^ERm`3+T>VSm#Y=GBPmE4-hTRt~r27VwYvKg{E8#B|j+(50tIKGw z{21S%#(x|s!I${DD*QW5;GvS{zooPT|E(uO(}Z$8lgE66cX0GrCI6kL2}W-u^oUy} zW5##%zaQoItWwU4|DH5DzO-KcTh)48CQy&zH0TkxGJ!A`eDe^Kk8Lx2tqxy5@@~Rq zg5f*F;d=yp%b`R*{+n0B_pZao@402Z35M^l4qyAV#rE>wkQ=^d9lm<-@p~{#Fnmur zd~?7z3QDw(elvWxIDF{}_N{XGvX*`Lr^yAr^BlfB_>M8gi5`=S9lphuef+n<#=awf zK~Wfg>yQYLHo>%)-&;W3Dj6%l$Facn)*&{0y93*N8<7a>-<_pQD`JMXz?Vi$z6fH& z_rRA+`IaJ|{x!kacMtSz`(|IK$0_-CgtFng!r@zve25Cc@LlHc^;>-GXTx^_zUaYj z?<3%2z6pl!80ZnVO2+lz3FCsr7Wf&R0-5tJX!8aZG?VR_Wd9zx}~SbUApHGD(yg&VegBavY^NNKPSJ>pgh5uUdAuvHcKHjFOii=faB zs)YVy_2@plOHY`%@)<2r zk7oeZ#r~O&FEX+H*NzM{tq`ckFb#UdtxO<{{BCi5=J+yvV;sINWUN*t^dG}F+Tlxp zuOBLGFQ!<5?+T~AwL`-FcbU`P4d65WJJ{mucK9OT<6dEcv9HVF`@rIx0%gn*-Ei*F(}C)m26N@u-~SbWD@e7z3e>9?x?o7`$3PxhO*)7!1oH;?M)2R^|*X7=-Kw&48D3O(Y`qrU#r8%?*`|7V1lvl z5Qpz+i|;fj8~b*4_-+QD;UK5M5r^*`@R{*9*W&vSo0;9-HQ?iU-2}t;Pv{Z1O2%f3 z@2ik8kNl4~_B~R;z6TxqYE~8Pn+G1lx60vLSHZsP9KMkj-+YU&`b(wleGz;d?!5;I-LRuhVNB}@A*~wyGO~_0bRp4dqgSU610o; znPB)%fF5zHWXxTyzhjepU62{R1023h;JX1jCK$en4qy9CMf=XQ`1*v;P%K5K^Soq& z;mbOFFWp?cKTkv1*moGdug&(~ec-D%WTMC9LC|BFRwfX-ZYiE$dXP4J+c|tMf$tZp zg#JT4h7k_mBjD?Yoc_xqHheRk`Em0$;r6vV^P~CJ;{9r`#n<5QJq^BVkZ*#qZ!d>$ zmBp8bvaxS$eX0NE;aoA&kcl3X0rXg=l?jB}+luFxg-9E||Lj%Dmj&OUs)YVSJ%$gV zXY)<5_~=K&*NpFvv-|gM@EH#B7`z|!Y`!%3&~>Um&bIirbNKE9AG)#-4BrTcuixTZ zZ1GjQ{Q*9R3c>JQk8_gUj^``r-2f$9@1+WQkH|d2cBR6`3VQ$Ey_D}Q=;3Hq2*$n( z0PK1Cb=px2y)eF49Q#H=4@*oTn0oU;X}$Fo^nQ-RfZdKJ z=wXT!g5f(4^VHUBgr303 z;(D;c;yc*k8x6iT5=k(8lO4Vp7T?v-r5@XR2+G^-orm-=;bLU?);M}yNGpGduF;#B(4)LnIObaIz$3mwJKo2_V)HElAEs6z818>S&*tm0 z_;AZy;M>FDTT!9CyEuG#@NwL89N@@U;Nt^j+rCxcn^~|<>oNHW)?M4aOTkwUIr(lx z%sl#i2r9ApJ^)|X{CI4)Qax@S!%^M@@-f`(=naQn*!;Z#dbWLcTkXY>qF~=MPJ09J znYvh?!RsCWJq9pL?Iaau5|R)K(D@_RqVHKLC9*1u< zI%}!$-DmNQcleg!J|k?NH#mH&z{hsbz6UJ6tsTDW!52rq32X<$P={|l_@+QkzO{%= zd&fEZs)zfpuzst?Lms=|YN2Q9Vtoex*Lm*aeZM$A=tooUi_o+AMuP7+5=k(8zjF9$ zExt#gYxpLMeQ2Hv^T5|2n33UYf*x@zg$Sd-*N>Qf`6*(<_nSRS?OO)E;VdA*@cj~c zHs5maaUCMxV~7pkYKLz*_~sfi(PQ$v4&NG!?`NXN`8Eubf&N1^D!fyny;ab&?OSKH z_X(6V_MPX9g9rvG=Z6W@V_58*uUhUX_U}{3H+*v)zBcf!qrnmk-zg4X8~C1v9{u+W zbPeC_!e`oBgT?P9LneAm-t6$zVv$;gLgf2}=+S?VIP2*K@P+m7gV3W5t+*Ig{IJ-+ z&mnE>yVBv?1ilkg3H`^k_gfC%ofhA(EWT}FFWrUhL4{_N3$t%4=-KwIxA=aIlE%Kj zfXwEb0=^@Kn~||^Bb02u4Hn;TEWWWAi`@F4pX$8G0+m-6AfZjGC_I>W? z-CRMh8uwRrz4ukn8;kYR)>{uf;|tp_0rYIYd;q_29C2K|Z29Hi*e`6pr@;po6oTRY z0D3kbf7HeBZLs)O?_J9G68NyR7lPsYF7#}^TJV|m{uPVwYYyKB;G0)qE4F>W;hPRV z>ao2W5wkAZ`wxe2HpT_zCK&tPcKFtSuO3R|dkwMSd&c3L2fna%e7(c>ti`v<;(OIO zCoTiu2xFY+G5LfuURG3S$2#cI)>alm_$TT${q`o(rXANhe5=6M$^sIo$8eRy_o>y6 zw~=r7UUT-}jo=Gg4=%&HV~@YLpcgie{_W^(uAuik46ylz;}9EG@1f15dLt|7b>nbh z^Np&YcL?ORUVyam8U1GPPL5tZ(qZSTIw{}E!U(}V#eVx2(#Fppp|D+V3(AGH_naL{ z^;#?F{dQuh-t-E3Ya2`TWi9 z$>Dpkf_?Wn{ks8r7`laE_%3(!-hm#vybz4ud2p(2-)87xNEU+8yU!W-BXJ(YQKt}$ zUjLq@eD!i}G>S$q2R-6e$!N63!RL@MkMnt^!`A@5Fh93Dd@U9qe=p1Mz2wZdHt>aw z)89bPwyzC*W*z6x@EX4R9lkl>J5buhhJG-*jkjU)ajx`-a0e5}grd-+2z-$a{TM50XRFGiwCPR<7Rpjkf zJ4Rad9z3bE-VNZZmokhBe9*J`=77)mnZFmyJdXR}4j&I2NfJpgeAN!$D)6PD!+wic ze5)M3F7O!+QW|`n!&m#GV!!QZ@nsyoH282NECj=Mro%VN;^Xh&QjhJOGPKlxi@_H* zFVoI^TMj*zH^J1~>CCr!t6u&Vsj2s9hwpmuwHh+ShOf=xYXV0#yYV;p}uabJ~$7%bQ+BYf)UtbP`o^4+n z$go5xzI`mdJsiFOd@#8XjD5Q}d~+?naTeb<9KJU2wG`Nj{yWd%%Y$zo^w?hh4yS4F znGWA#@U5yY5*quG4&RI5`={`YxA;zsl=^RUz23JBqv1Oqdc>`gvHpJit|u_<+t1<~ z@9@n5-|JF_k>P7__~t!;=M2av-$aXVw{fNRO&J@0Uoi@Lwtc~a#dUIji|^BhQoaQE z`e~R1W8cTnv-!HfXWBd2;+y51CpUmEtbdP#p3PUYw)oufK#Ol5hcANrrFF(Q#Kyio z9lmAYqaOWtkj1yKzO=nBg0C@z?=0xq_D%nBar_-(@tx@KdHdiwO$gud4&NH^Ef@O^ zwfKS|rS>fYA6#Duw25I?=-KwQJXCy7;c$!ZGbkZh*w60RAH^lbZ@9x1MWM_GI^hp!EMdxY@Kb@--Rd`DY+-x^bDUjlrKL-;O+o^9Ve z@Vx{*j^|@7zB3)Zjo^DKZ2fciTJX?$GkC~%oW-}CYt_z-#M2w;i0p! z?*xnQMTd_+LiwK%`+nu{4PS?T6Z>Xbd}E#Q^6A9z^(An|%gD!y>&uB2-&PJ^GwgWW zG#0UGZ;ivZ0(>x0`R^o)ZzLYdAX%7i^rzu~xPZ5Yp54E*Q7QLt_Qxp}-`}??<@*$T zbtIBtxZi@F%{R~DJJsU*B`UG)8;N~!t|3Eg_@05D&6ftB=?}hl#yr}4o5Pm|Uy>C_ zFnp^WzWmSh`I_xL!{Yn3v);dm#U*V1KI^Xc>x=U@YVqCT@NEF!$;LRu#=cb!-ztkQ zX7T+BW!OAScNLl^7da>}eD?y|dM(fkYsXzurWG;6TGUIw(k}_C-pe4f`C2Q~n|1Ws zD%86GdbG6_7sGn1-cGCDTb%jP4!)7Pi27^VyULj#&x5ZC8f-_(;yd5rniwVCiLv~Hi6Ihx!dB~-{D&iK5R*aVA?yu;hSRdWh}lJHVY&R z+S_8so%{S$g&`^>=*+U=Nb)!S>;J1Z!ycjN*3H)l;lOgm;d?^QKH&*V|p;NzfY z*E`#)x6i8g%MM>N_`;sojdl3uS$vBuzP~ztnO(uYzc_wLTYLi+-{TJ79Pq(ag<#tI zsKeK9@ttGw{dm7pKlfL#Z-t|`7-%FN#->~>D#yP~cuLXQz{#yz?+rCdN`<7XJCpvts;5$Z} zr2ZQFj(7NmKUwtOB^KWqPJ1r}pWz^(!E>DUHiFNrYnNJl;~c)_;De|T3}3y&*8)B> zUicH|)Fb}~PJ7o?ufEX@XK#hQ4oZJJsnFK|}HjEf1NZ-P! z&E=yt8Eyf=0<|_+Qxj^_pkg7lEn01f^?i%hz9o1eDq+57?X&jGo~_y7L;m&tj~ zI%_|B?Y-Atd!I9B&XM&!4L!mse4rA1MZh#Zo>BPr8u-RwaD2jfXe0R=4SeUocb55n zr11R@*1*{HkB_L?`uQ7iQIdS!&{OSe`E6hwTc_}~8u)U+cZmw%B>7qld~-Vk_un@t zd^U8lYTue$`aiD?gPv+%=SfX-AS1QkE`{%-0l|D9g6~Tzz+m5p&{O%&zmD&T!9{#O zQTYCAcrf3&TQ%*nB*RwLw+4DDU&txkGr{&XDtvhczV{HEKanH~pVPqC_7<)mK#%P6 zDtv=*-h^F$|8~yrKfYWKJ=MNXx&q^EkHYuS#9+SD;KLN)8Ua3Zxu|cm!Z*mk_Zj%mRQ@FSt~c-{DtreOzAv!;QSFOb z5U`0zC0`G(r&74284BMah3~Y1F9v-5+4qKlFGb;dLE+mK9c!<3q8Uq zBt%*YzGiI6UydkzWd^<-;QO2!fRp4~Z{Yh3d=%%2@0h~(2J=BIk~^*cb$f?_uj&th zb@q!2UwLS7ee1x7OP2m5?JI_!THhlI-%AQ#nt|^S_#W`H1=??(f$tpn=0cC^+oJF- z92;z(?RNe5Ns?09mjXT2z7c;6Tt|Od;TvJ#s{~(+Y)p_!z99y_)8M0VOZHKmAw3!| z9ixNob1&+@KiZ+E+ERQr;<1J`X|SNPT%_+A9xDrp?H(mwjWT;ruxt?(T+@V$9Y|Mnd+@WuX*rnR9^;`^h*_mqKe zMh1SLhvPCy`>G9mXTe8)M|@`$zT)KI_IvZ*{;%s5Ku>MI#`EwKw(nhq?-m1J;z}s> zW8X{zU(rW_c<`RWSB=FAWw&w#6XDEQviXy&?@o+;Rj&Yg3;bHT?X?>rU2NtT;!;2ZIefS-0Ne77NkYTq;WVNRE1*h;=R0EAQcnC+9m_eXzI z_y!vI&Vi5a7m-QwU1#7c0-pnVSZyNX}-j8~49@*Q4+~j`K_G`un2{e3FAWCEf@<)xNXfvoYVN3g1ctUnTf(>D8Yk-(3d2 z4;4OIr;;A=kHPhI)xJjX(RxiL$u|mms(ly0w+l+tA9UU-`63K_?}5)v1#pslAqKwf zm}J_ZLwt0eDfzY;&Qo%n`Y|KllZNw@r9FZ6`&!}4GVm3E&mqaMmG-SQ@U2w%`V_v~ zah(ji{{D4?PjV2g#Hr9DoI*mR9EH!P@QpI?Z3mx2H2q21_frGk+>3#AU8urG*JknOZ@*8n z0&PU3lJ6lXsrDs*8t}g`g^#}5Q~4%l>%X&-21>qV2EMn!C*xm)!uMmISEn<N zjAYZxqVjeo>KIu?n!8ccDjCy8mb)E#YCRf13(UVZrQA{j-;rzZ{mh^@=8^u-Q(iEX zd-?Ogb<7)-a&rd;*JB3w!j*bZT`8@(Ay{uN^yHjF$7MVG@AbiYsnAoJ&#(7=17F59 z_y!vE)?9<{VH85PN;}G+Cj?|1lB`E<J%Necb3;fqsiK)MFF$`m1mEb-{ct=&AFO zwC5>9JO2cFp|ViLzPk(>g@DasM7*9*M}MNj&RkJkqKRnhTHmvq0PcA+HozI$`P=Sfa{ zZNv5B?_giH%amz1Pjx6s-O;iBf98xCLhGj4Q>W^Z2O__}aA}&!Bugaj`~BrpnJa7P zzr4>V5$m>qu6_jnf8_J|@qY+rI|vC-q4k{TiSiTrFV4ue4Bl~!(r#b zwOKEkJJxGcx3qZ@Qtzv;Z84`6Xtr?Ie6uaqHQ(fF^ttA1u7uR#Zr6MZwyyaht|r^I zUz~vUZg7AB()--oM%xF6*g{uDqXbRsYFwujk?^9qIzw}8X|t``I@{cFmu72mrJ7cx zYAaGhQA%ovEzy-~S&?d9A5RSKFi&_y-p~glZ{0+NuUD1SZPihtC8^*TZAXojN&}0nmf!D zZbN`rui4UTLJhR!`-=C&pNq}zFUk{# zi$bif@Mzo69qy=%SX6-kYw)Ta&iPHVWvBY6ZcB4M0Xau=KA9bsC)9)Jp zophWg4^F>U@c$@y!#rJK5avpel(rblvhlqAgUq+h=ldPwPHY<@IWIP&@f{SUNxZ$x z$8O{OMZ6`Q=lR%AmHbB({0qjvRAiJ-d&cJrZS(oAyc&pGU)_f9v|-Ckd`v0$T@tot zd_+>>+kBSI;q719o=36&BtA7Pr+lSKx#f%>ma-b3?{SHLpxf~j@1Nkw>J4m9Gu92k zIRNjQpc{h^<(z=+EY6$CTd7am`xV(ez&X7C8|E61`OTPYiY!{UI`ei?(RA71;IQCIT>bWO^5xJvK;g@Em<+8HR5XnlQ} zb_JhrOb9XR@!331=VCjLaTc}(j7j$y#W=6<3Y(5vF6-U|z9}We`az?LkF84au9*A?rEw71o#YNZ9bc#7+?-B$y z*m*ciOarTijJzQB5Z0={OSEY>m=NbWt~0q3qSDiCmg&wlwsGw~-x;5;8$ZFLoUPV# zp_(fs($jhArSaypBbxhCR${E(zShX-BA>mFbAk&ihgmrcO_oX-jI?G%Ahltmy%nw6QqS-Z4SUg}OaL z-e-lzBrE2Fu`sl2&-2JS4{Z|GN{wN&qg-LMm{_|e>r?5TpQeSFl(MFY<&i}z7!pU3 z|D0J{8)^IOa0tK(XLM?R&55!^bD}M+=PcTyAv8zAqUv9fz1CLxU;Rsc3O<9|dALF_ zHqPf8c>xtKNQVVMZA&d{jkF!udfc4$U6XC77Mr5gG&nwOu8cyHL+-^&giWEDiG`sp)jm)h~FTeZ#lIa3^Ekzjg*CU z{7mz!BiwTf8q~8!Np)+pXqSh{QgnHspJh&0s9y8xOPXHu`X=wb*v9%O`#VXSlLXZ_D{+SHjFCovx;`ZJUpEYF)d}qgBWUBJC%}pfu?})!R{2+=#;3SaZks07rSk zwQ-Bg*6*3>!aNZX`Ss?GjV9X?>qgT!Xgm_AjHpSd;tR8TZVg=jr(dU^JJr=iXhq1itgow|3^;<~yBoZ-X5@gwagBf9piP{m^5Zj0So zZ%$ilwmnk4#*BUtW=)FJOQxnz`@UEwN95O;t1n>5*YPiZucZAK9>yJqJT%N!^`M1k z9Jc5qZu->@dvkkW#I=U@g}5m)%pQV%bs-GCQyXitS-lBSsr$aO_+Zvztrq2druF!I z9iOUW&|0aj>b4CQmLfn1uW^mLs{QmuGJ0qAd9frsYZ=En}te+6&f9xBVXimeqNkWvjb4?tSD7vh0u7Q5lle8xFB+PUz3aQ!~ zUA0XtOBaPgH??z(XqeVWci8#n-WE9h`c7my9P&QfJ^c=UFY~w$10Pc@7n)Xx2Sk11+I?kP3{C5 zFZXKhS;On&p_)pLYs)g!p^#ry&1uxK4asG$&`FiAXmdvh4# zGa#t#+g^Z!CMLO@Yj$EaQ`hA4)xK;_dx}Wqm=+AsMYN|=B0a7`h%l98JG5EY$pKc0 zO+q2i7L(*)rq<{`xXaimg1cGk*m{NA;!oX5TfCtiiyMfp@-!Z5Xts?&@p}Jzrs&q` z)0k*ea;T11{jT3J!xRt4HEZLV&D9%BVqo4|XYTl4lP%p!|2lps+w!DdBHFUUN1hjO z$SJ57X1E2exHUMT%%8Q`?aEJvn`EUcvFksNTejh%9ZwC=E0Z-(Y5(e3K3k_JVZzq> z93FTd)z+<2XU+dKN{XuI#fFJ8QKH^$V!o{YDBwJz)!{sA%sqIFlRjyZtTl9H56zkh zQK&sUs&kAUmTvqz!qP#_wz&F$W_x4(^RRjU@$3BEg7LD*{BpW0B;;5~Xw@6hRc|_~ zwnravJC6E%M|z{a+J?ww{TRy}Ouw!WQ_W^qh`HuLSBRx%r|p*G-6wn41nS!_kLm_s z6_Xy)JmkO`j5+xEfp%Mm7<%q@EP$?_f#K6~0nyUkdj=eZL)<+XiJG;y&;55N#=}aJ z7w4s4X~zYjoQ$9q`xFZ#vNK@3fzOFY4XbZ+R11Y429(0|$u(zS6WVc_&*$!*;Jz4c!4eV9SYtXI)^g@lXz_LLhy2qb zqW$~Ur1(EgKMNbg;%H^h`J=r}1v|ZsJ}kg6mO5@S*%n#xk7IE)mQHfq7X5whPuN}Bqkk8oIulO^Je`T zU?@&rzP2UfG^F}VtWM$+lh&s;`B2lwx`;+xQ47Zul;)sSmGnVT!8kGRh+2#Ilva2J z7Q552sKV+dtwOUcsxJ43EbCMg&XOK*JH~A^SHGgI$e)NXiFl!(TzpHI48(>$Ye6># zI!-TSb5qQLWRe9=^QAW-zIKke`Zm4Tu05;K&el1at+S=a(>czYFoCAfn=}uWd*jX4 zY1;7~OnIwJ+eYhGy7qhyeR5nnA%w?<9Se`xj9r?p4&3g(bRf1a>{vwjv2?RLqIc+} zm(3m1wEZpSw5giQY_4*fJZ1|53}TAM98y&ujR@i~hwkWgAV{8R_xVn?ckR6%CBR^@ zZ1U`DZfH)LzN&j-C`xIyoC>WuijrLBcwyDr@UFcv-BiDpGo9^y7U4k?W4HcXT&1Sa z(Y1F7?tK%z-L>Zf$(;5lI_WJmc^Z8?JW*JXcFZJinMvWo)3~LfSFYg%H|lB2u};6@ zbw*=+%JXCD>#n_KNl7ib%9}9Lvp6IlE6X2&$zGr>cDutfHqwGNail$bPID|)($e*; zFQV1AUA*XAgSn=@r>dq+j5OO!n61ai&D0RB)|xY@vb$&732_qrb$p}GQ6E){6Z`8; z@|gpQynkFPk~Q9H4SsvGS} zi1#Fn+E#PROkB;)vYPV~&DH-!mZQ#l9s@<%VLdc=?J3jS2>qMncDD)cW`r7(dltU-5_8Ng|UBv)<*_xtC$9;~jh@5#?<>bfD+p z0Sw*6C&if_pX4D6NYvd^e&wk8NA&5xIL^19yEUp|*PQxW>ggQj z7R~3044O3fKt$i(oPqiCC&rn%uYJE{E5^zT7elUCy-`SRirclWxLNn_)k zYh6tXwr%!yYONuiN8L@Rg)3CUtm_FiX$NS*k1d$}JJ$7jd4V?xtKhs`Zc_i~8)B5{3XynYQx zZ;-=bi9MK3y>a*IExWpUtvRV+)=TEJGrqL>`eK(fMXaH&o;wlsLc_5yh~WkoB>$=E z7V*OZmq3RE1$6yHE3}m^(cl<`bo)V?lri*KMgiZQwNhEJ-WrLM1G6^$8keyGXMue* zo2(iFI$;>RqiZhv^iJ4Rz5TK+5(h=uGrj4d@y^vWjC(PR>%#3d7{+J2&!6cq19%cg z61FeWnup?>AzLIou%*S_e4?r7_4X5QYA2k_UCy<~oNMBptHw`5AJiykPv?HncGTy4 zx%a7$PT(>ZDrbG4;wM&Ne+(J}cYTdE^u*m)RYNCz2rjP0)~e&tRZoeNzQti93S9ZK zo~qFo@wP8L>6&bFbx97|nS+(F*m3LE2qdSh4tJETX6x)Ex@PojledYkoMb#=)_0dK z7JCC|@5v@lV1fjYp@&*igq~AYd!$W{;p%Y|-JbQHOrT}T%gL*~$0Emh zBNM7#k3RAWtwPD{Gx4&ldmP1{eyy9JUiaYjhRDed5ht#*g+#hKzeeMD z8v76ztT$e6iOq+GZc2d7O z`$a^3dwkrQgjdWRd75K;+t!=S)j8V9qqDIF8--IGvj|D%KuFr@^W7SOsN`xY5Lek; zO+_NikU8Siy}=|b6W35OUKgkIbj6jf{4S*{!Fd=YNp38pj>WBBj!ZN?+1J_KM?IZa za0uTFr2PoeX<=y*L3Zv?PmW-+w;|`c2~q`#L@cAo`^C2ND8y- zckXD8f^7$yYA7U9*F+spw?FTnt86#5V`bv(+RIn7EGygl=&F}kg2bN~-L>~FQBJF+ z)7fVhrhtM@F6+$hb~~0r2^qa6_oceT=BEAi_PXTe_WkuYcsr@kR&!@NwZZFYqICd~ z73Xc~I9cj!Kbc(DRG$dVR@&>U_b7P7=$cd2fCZ9|WkW^Rq_yj|3<)$+brq^!2G&utT&!k)l6U7Y`V zP1oLyQlTTp=Lt7?!?mPdESajdMf>}3YF(83D0d>-(9I+j^tiJ(m(E*m^G|F3THbu1>^F3|mK;)6zA4-L)@5)?>-fH)F*;TbsM` zQsSZ!8)0(VXl-ILl&!b2^4_nc-)`2lYKNBhs<}E2D?rkjA$7V{oguiTVe6>Jz)U(x zQs=nT5rx7V=p=noWZ_Z!^swrWztrdBy`73_h&cl(H?`USN;zoZ29&qM#?<>p%Y%A- zFy-IUPCoN?klbISJzh(D>q~d{wtHI6RQsV%&Z9A4a;{>zcN`bNYieT;CS!8mwnFlaZo&RMyYF#KlS@$Hn#qh@nJ- z7^4T6VNtHQ)#D1x9cftG+~;*J2Mvy+-SOY+T#+$BtNy{|i*akaa5Qc;0+GwPimZ#G z^MF+~Sb<~hgl`o-5HtBHYc&wzyY?+b-Gy9y z%|>I>`dg0GdyiC~(Svx`zLai`XV!y#u7r6RE5$bx1MDPr{3NkoZ8QwE9)hz4_mFtUnTcc-*MS~mL^O1)V{}2NOi*%no0-Q6HV@; zd9fdg3|;%ma47AvZcW#|b=d3Zy`p|W`u`)IxmnvdkY*jaGF%*anAWC+%V*C!FzrB` zdtObnTRJ0Mfz!V;G53+T%^qmDAw@S*@XZr^^hN9Ndoc%wfN_2*V#l7WFO0gpE;0o^Mze;v%EmZOoX^F&aBa7r8+%|I z?j?X-c`-xWX58aM=hgTEvW_kzY^}FY9xnGMQ~=dgFW|DoapYzFbTHqW5p;y_ThN|D znNB}KhlG|}G+YOmb(ij2-rrKOfqIFxBAKAqOI#@Mz7(W$ zqOl~%HnzXDBUT%*<>9)F;n}Wud=(ehP*=W4^PIKXhIz5wXKJ8pMy=LUkVW+J<@xCMwM5r7=`slChRoQ8Vw;g7wV$2R6WyX8&*3(zb~L`|LU|zjaPQ=8cWr| zXzh4((Q z{4D)GkFI^STvn)zpyYuG8e5COW2ojG0m_COvi+|;#iuPXdE>PPjNhkJRk$`D^JZWfnJ0yPpL zZa>}Ei6i3TEq!$&FpRZ7s$Zw?+J76$mC`uj_d)Ug@+BXVrqTUaC=a*)R(YeK4~_#C zNAtYRV%>Bgq|Rasw~yB{=9qDU)!@ay9S5UqN&9b!@-~Ma^x}J@`Vd=Ty`@^%Gbx;6 zKky8^KeTY76)74%t6+ns>KlQuzM*g;U-02DmANwcrfP7Hcay z9RAx|Oot-|{Om+yU)wLEYKNPC5K%QD3X|19&pvI|fx%?_(=W{)fVf^eDAcphQu}oL z$P1pm+N|-{d-g!qf($*K?oIFr=O_x9WPPO&9qRYuEk=MMv}+%}w}@S^w&{YyV)|D3KKux-Xdw z_g_j|<^7&lZj%yh)w|Si&!IR1+r^gd>2;D_+n(5|X2_C0TEH$F2o~sL7 z`#QHh?!$$l?5BJCTEuxLtHkgI4d`&vWQgtcv8h96;q_Vs4%PCS^mhBii)C4=uMlRnO#(v zTT(eWTO-lK<%N~GndP}9x%s7)h0e;t(vr;Fjg`u=iVbCDrR9~mIhkdpg(a1ld8OsW z&dLgdR(4^IK~n78n3-4Z%r8b^nMJuJ`IQ9*jogy#@<+-lGb;;nOEQa{*~Y^gD|1V7 zP;RlYu!`J@3No~^FnfJ&rN~y`EXk=TaIVjt9j$lm z9Q3UtacsqS$E5E_sNMPnMfU=!mS+4Hy!RNe)MG zVaXiFeN#7%-MDrl+Y;D^@5vo4m_B<$Ihv*tonMSmHMVGj;dnWQTxl^{r82j|aEL06 z099754^-+TExWL+00wVBym1tk?SWCJ zaTb-8D492utS>2jSdqXZ-~?!v4UWXZe2h7artv|;HV1>`q1?>%xsOz6MY;LTY#K01 z%VEr7WUr@DSelpT@DEWfNGnsgpFi4Td|*03mP7=_4duDx`=u6M>cr&nF#PEo>B#G8 z+$8E2jt_*Ren)y?2}TMPpH5R#h6n>I^e7->g`=>-QCV8*s3^chEFDyiekH(2QFdwR z`odgxGt7s%6~cN<+t~#edt9CjTNQq(^hhOQo^bQ1Me>C^+P*Lgw-Jq!u&?92-h< zHMIPx3dT_^ zCSAlQ!=xLeEu+^}ldV{HQMiNw;3yJR60xYH)Dd*B5CN^UxEL##Am({Xm))t@7`!_N zz5xT_8q`H)<)xLS*`-ARr{#c)F$W4PLrd~=sn09c7nTK2Q9&9s$>!7AEIX$l6O*wM zi@3b<(&EhQT)42}vuZBs@6yHlJLV|fP@zxDS(x8pL>W4&KN~SvHWcMJN^&tO5DB1H zqREk7SW<>bGRIlzgcmx-B3{E>v1Gu)h?Wc#Vz92{>Q*2cIV%wwG*OdWETAetSyA8* zPG##ekqZ-eU^w(^lkQMdFIreEoWCI5k?kyVW)+VdW#4==Vw36_4uo4Ia zA~AnC<|15cI6B9%%%N{@m)ljrbrNf?t1H#Ng;b-34uoT>o_{^3Hh{8HQhc#L4Y3+g znvQe&y$xqRXf;QFS?`i3KaRVk4>;x(t7+@Br~5n?Aq<88d{8bk^-`W zX99%yvf>IYFSEQPUsHRVdZ6-=vRqnYh#2d)0TF{UlY4WqijxMyiSX`gDv zg#{{*3{#BIL|-tUY$Fs;QBA4x)n)r#v?TXo%sb+on@9fZx7r1nIgYvuV z5d08GRj_ClZM#XAEWpN$Ct7S_gw1~snYO#Nt*2Ks4{oA#Ry#InYK3^+h zlkODzOSGwMf?mHnwU_y~)Gl#+x%L;f=T@;lL>tA=%Xn4n-=f{b?Xykn&(i*cEu~a^ z%-T)bJA8bh*q@>$vb}nFN!nkS50BGi(#L7J&-IxPh6$^^8yEfEZTg-KJ|Ja zS%Th-O8Sce2Z1cw62tx-hJEtdK(YiqiHq_t4;%!tXm=U*?=kG(YuI09*uPI3pbX(C z91Z31NQ$)2?oGS;^K$t3TKMrmEmZrCRUGmkU#ARt%Kwnz_;(G*e`DAmX(<00<#+YO zw@Z0e1MUBi#}gSq`-cpC>hJRD_$NF*rM}g`FMo?JkH2C#{bKl;2_KzXC&kuc18^^F;Z(m5@&Sa}4>>#r{Oc|7t?0G#P<_Je~dEp$CC#C z8D_{o%~0Nl275j>+7nom-GJ{aU{f$3RprUfL`pQ~l!kcs9Hc^^hz z2jfSu9mANO&7R2kIcz5~J_Gqw#z(Q8!8inQfP9DS`8~FC33FSeu>2ynWQvK~D4pdt zaME+a(q?gPx@; z<^Rjr0r?k-{4!(e2WoezAIX^dVW1+9Wt<54aK*@ObnCaml(1J8y>oN!SUU zR@h8+C;fpK%MQZn_=hwGAJZZM^|3|P^CT;~&!7 z_>j&L=)A``8~7YyUUr>l`FhAdA)JAKNT1{$r>3d^GOghvC@vn>ffiuuq%I9t~rLpVpriG*`?Je6>&ru_qLOEJiFn=YTra*GY`=Ve?A z&ZUfhM}5KgIOGM4{{&pd_!96&#tG2hL^x09uOfVtj@^X$l;;`3d^*%fI91cWi@bXn z)4H&kaK4`R5aHQ6K0=sJjb0>tt1f?ya4O~;8$fF=+GD-{(S_!-8)uaGZe91;y*V*Cc=4-np{>ld(mHsTz@ zxE90b0V5d4V7q{EEVhdo)A2hPgHodqPkF~+o5$FJEe%(aCt~|O#we10Ln7p{W_>Ou z9g3Y>Sx%gX7&{<;jWNa1PZ$%=zZg%&_9EjM*nZBKczleLvArJkq_QY)G~>B+oN)^9 z5XK9D6BPYPjHA%!QzeED&7s6ebKM<`iJ#_5S=N1w(bd}hjBUV9#$@Mu#?_H;ybJh!#>77gZB6=(z!Mo0{}jf1fTuHV2F_P>)-hfKzGBAdzz;K~ zcHYgH+W7!uYUg+qBJHHuM>rjFY9qo+fs+_70A9-&8!ekL#mjQW6pw2dQ|#Q&m}1PI z8IwJsi0Q;n_6%T5_RMBX>o|I+m$YpGV|s@kt>;Ki@oza}>X$4z8H!HRw?;};>Pd7bjM04Feh26zhN?Z7h`Q#;IN90fm_%Qyx&O=9Sj zF{bvU^#t)#dp^mSc%EWR>+z=j_b?{TXBj7Br;ahLr(R%8b$^>N)%{(@RCoM-N${sYe=N?g zs4Q9o-pM!zI>n4*P;ND2sB1Nh7hq>Q<8+`M7{3SH$M_uZ z4LI*2oezNrGCmKS$oNIz*^EB{PGd~`^vrC^djWVU6(SqAIEqGGN&^pAI@eR3%pU$e~j@O$iK&!=9g;56#svq= zfclFuty^ADbdEAUjl7+VslP5TrvCbZG4+=f*M_A15sWoz2Pp?0D>3ww7}NRIJ&OE3 z#);6spYbNxR?L{zXg^o|;#+V~*18-vW6k;{xEp zj7euWV>(y9kuh=3VEhT>a~NL$Udfp9-p`oMgYy)55#!IGzmYM;r7FhnLB3Vd-^TcE z@ce)=o$u0lGPOVDZDJe+Ih`}he)%QiBG~*Z#$~{7F{b!)j`0X!6V9b6ZzJr#o-ru3 zXvPlcjAYyi`9#Kvkk3-|=P;fM`K^p+054Q@(ity>d4L1 z+`*W}`(&vPo|%kyK%UQ-@~&gN5xAJ~Cg3BC-vn+~^j~8<5u9%-^501e{w~JkZ|9{P zJpW)k2J#Dxk3jx4;}poRvj==Witz%-2Qf|u9 z_A-7E_*KRZ;CC5Q`@GNiGsyp2k)LOL8S;NHrZL{jco(o4UnI+T70x&uq~jTrZPOU1 zpnn%KUI6@E#$?02jME`6W4si2ALC`fKVwXO{vqQw@PERXc>cwB7i_-BxDohs#(RKG z7`S9J#e@*X&5#ddOgyoSPovy%jLBDTQgmiA?nU0Yj9-DyJVobr#w)>tciD(?*8mqW zegODs#yP-y7?TYL8Pi<+5@WLASBwiF|Ba&mhNACNFwY z_W=J?(fK*!7RXO3@;4c`q5Xfy_%+~98FvC-H#}fZ6yrA`AH?`H@Epcxfm0a22fTst zIpFUzCjY^&>qQ+~Am66Qf57+x%J2i(;8qZt0hf*@#u5YQW={u%Y@QAtt z)4ds@?(=mWT!z$QZq)HO#*~ljCpqPt!kF?=`j7b?BAaNR7+~U`j1OVrpT^kF|0o1V z(tg6y{&oP>eyXy(H$e0k>evmP(U8Z)Q%=1-2@_u$K7@(yUdAM+TM9@{91k$2a*7yJ zIhBmbM<`L-Qj&ItAifJbxow4=Yjhn4HZfy#EZP~E@{MOX<-3_N<)g30NuRs)sLv zm@4i{COM@$@F7gx%NSE$(axMVm*vD=#26dx8OBtPM#k7^`xsN54lpLpR~S?MUS;gS z_VT-ecwc5M}?L&FweNdD~`d%F6O~gN>1bhfnSrZsjzFCYZ zAKk`5I@c=e=r@!FH`QW@7>SA`Ol2i8rm{pIK~80*u>4wO{q-BlqFW7OCgLB`SbPXm zS)yEEDogk+unk!FE%3F<3XSZi4dHuqe=OyZ?J511?#CDdc?<;%BveUYDr*vBvSBu3 z;+V&n{3o3;HrkzxiF-L?$}4;l{FGPtBry5X2G+qwdyFyFU3^as9m-4l(q^*BM2bkF zE;OMaiSdX!Qj+zeciB-H(wC@?GzMow9uFKd75|V#djb=83O*z!?)w=NcMfCX&Sy;A z6^zM7VL$RZfVU{}?To1|PctUYdd6heF2=+u#vOQw^C-&`v88<(4~dH~y^m0|3CBZR zI?`gM>$+$@fw2*DpOhn;kQ2v3#>64w3G!0iDVa9u+y2UZP?ozu*P%S7$8{|GVn1|5 zU)-b1scvNRPa$_O{sr(D#`JDPs;BHPToTq|X5b$ZM`FPvvAVrgB98LT4iIdX^LagN$Ratz=B~s9{XD{DiRsTS_K!SR~4C?4ws<9N8!D zs}yZT!3l}VApNsY5N*Z%cpV*^NgBAOhYw-mraBO&x{DYHOx!oIoVZgMlYSawDrXU6 zDo2b>cjF6?pB5vWM3D3blBq5)x zWBPB}tYcA@OUJ||+fB3;+9Ux$v=z6BXsai5{aDhcN+3}kC@B@GIy$fU{Um`s)~zjkIstf`3S| zUW7%xP{<2(trz>!H$+{sNrT75lR8eshU(Y_{i%#!1fD^d+lQK1w!;F(PeI259Fu~7 zNMsLTY7?@7Fxh2iO!;uCD&)i+$2c8Z5&u(kj+HE@y!SIEJ||F)V@qEdc+Uzo8(ho7|oN!nD z9;6gK4rs->#o2g)y!^SUv!Y}go*$5#n_1$-16?xdr~8>jg%y>Vc<2*7ltY_biKi|2 z_5Huc7Y~P;T%KFx6bh3AKm84UsEMLigeTOLJB$7uRVq{H;b-j?x%j2@RnMi;i&iPW zMb$_te}LZ4)3>h4{jGWYh3LP6md~k>PujYg_?z_nWO~iMo$QR0q+U=;kd$SFhD*Q?dlfQ%@00q$jrYF4}Lz{wV3)nnjFVS^!gBkop40>h+J={RMmIYVo(W6N4j0qaccw&sdJbC~@w(?*B zY2;PU4Uh+NabF_JBw-A+}+kl5oh$qxZT{7kNp8A%FCr?yl z!X5mjQTFW8lDtej;YYYnVfIzW@$3x!aYkk9waIvtPwwQ~@4ROcd@Vb`qlT^Gvce$# z;v58FrU-hFkdi4+JUq#tO*tYSR-%LgwQAzYLF+T=p(B}iKwqX>5?PI64ZZvy=cdPI zWa0^$=-Yh1dDLof1%Iv7V`BA2hE+NP8PxjV*(!b_7)+|-sbs2YdH@qo1oG=rq2f88 zc=So8(y6Mys~mx$iKn39u`rmO^Z@Y+IRGkO6=d`~5}8Pk(#-&b zQ)mb2#l^S>02zrd6dyW9d{028@|^=0U00Av@_i3VD&I;}VhogsFAN{aN5At?`RKdg z1(J;QXm^!?Zxi_FngQ|AH6_VM*LYRF8E6c;rXdsQQF;g;!YTMrIs`ttW9Cj=_rdGI{|8S&AzLON!{=TC3|mG2Yq6-g4-!$#|Zp30Yw3#N&< zI7EE7WaQ^NXy9839eVzSOpn|3l`p0=(7%HfzJmrnH~8rL0hy$IdkuUG z6h7R7v2>r)pwzR?=1LkgIp$QUy6ZmkHR+`%98JK?hkaI zNU`Jk_vej<{&*XFbWM=@VROz06#;RBn%C&zCbWYWG_2EI4Jm&$o)Bl)Hq_zr{|-H1(3@`dXy;6s(jnQC)+Ox$0grs7^m8|;~Mt8 z0VS2MQ?YN7!uPy^Zx8qul0lrLeftc2y^4KPpeyZr3s|-9lWW*_lJlfsOKC<$p#5mJ zmwfwxRX+NnB$YC7lJ+%WpKuDxbHFFt?&2HkL2rxajJbICg}Gg82LUm)b}j-UW5|y-J^@48; zl&HS*@R5AKHt=l%-wTqA^=S832EI*L&@@9%eDm>|-Pl;}5|gi~k- zY0Sfc{#}TD$ya9JTMEAZ+K+xys`70FUlDl7zS|YP?1!bx8~84RPmbRuI4C(q?AVjq+@0=&6ZxDD8qj zTbBB;>eH%dpUy)mk$se;-UQfZ)Q8!b(?)P-KxMZUQ5kNp;uGI(L2Y)KYAC~imV~2S@!8!gXOy+ zPgCVMRXrOhlYWELU#esMBT7E`KC4$*_G|SRlhAL(WQyhEaZ;}a<;wS8NhNH_no`oi zd+z8rT{2ZExSBEjo{LgGwhzeTc(3J3#`CdF#wUXJ>33?W=zB`bu_ZsHM8D&c>7Zis zP6gL8-lfRsw{($c0cfP$hK;Q3SIqjWi z?Bi_(Z@mgX>Aet1|M6@G-fDQynOEX%KHm$h|B{k#4VS0qM7?>xl(%KPeUP{1yd{10 z*{rnxg*=u*d+;UR4?%gg@|b)#q^_dPQEXYN;K%0a3Qw`@1KvKy+Zou#;&TC?&savk zOBRX7@&Cd5;#p3zT*Mbj>v+4Kx4KmS|2WDFWBGNwwPQOHpLpIU&F?clrpP3Zd_L?S zaqRDW{JcT$V`X1Hua?Z3-oO1ZWsy&KVZv_JR{!KJx#pW&!Y7X88P_M&&_GiXmMgz zsQO`}JG_zJK?rxjd-Lek$hN`a)yP@Sm=(?^z0NHM;#_f0(z~@|#OuFtDNVc|S-i5+ zqOBT&7XZ?Wv_tF#WqOG|UpE&wqQI3u%at(Gw#bvNwOn$Cc@u}>{eYf?na`i>dMD+B z_GKP#OvBELC+XeZeUVPwt~f=rM(XcAJ|lUonl0SrjOhrWcWD-++s3xzkpg_MHT0ZC zb6F#82k`Rpjux}cuEnNk)lHs#H{wOC8HrlQ&&=*i^iIOwM{FUR$u2S3O^VEj*Q~?1 zB-}Q*)P#f8J8Ay2?l9S`SYKd#ym%>U#(1qd z)oiP;O*W_H(hEy5W<}due`E%A2VUqo&M$)%R*<>F@ZQBZpKsi7bH_9j%Jb~~V}sj; z_a)XXnJ4p;?x_%H`|FI|RA)39lQ7fe9N4x0lWtKlU9IzWK|9?!$Q3tmNiyD?ZN^Ik zVhT;RnO*yPyK#D?E1!sq?z5oB>%v^)2UAOJHG_3}+`z}?r#heTCQLo*^S%7~2MH-% z3AcI25Ak?y4LgsCo)V3h_G+M;&}RRly+FUfIMfTT!%SLE@7<-BMjj43KJS$1uEvkI zZLQg9TUqnqW}mNSx$P`o-foLUO>F5kJ+9p^)O3^lj1zAZO|EHo?S8rD=scef&II$E zg9@A62^j@wt%(`oro&+^54xAbdnQHVCG%FZ#U17ek8s6BdE*A|A8K+x7@sg4zEeYr zJ*Ps?cAr0kcgI?_i)M6ZOFJY-|4D7@!uvwwqHAN#*0;bs(i2YaiFDxtQ*$(4ds|iG z*ooVhH}B|;vdx@E6*_@-6dhx6#SKF77tJP@*(^%x+Wnhu?heaz9Hef>3$gL$_v+70 zWcuT-gkdNkqh>i?vYRn}c~Xn52o-Locei5;H-iJrc~pOI=k9j}8CWm~@<+S!#}+hM zU-iLP-05gBctA~ekdGb{p0RRB9GF7U^>;)TTZZ2(ydc#XGrhkdjS9&j9h&7Fgyxw& z1O>Rl&3VZoWPGG2ZlE^;j=%r7xw@HtYd9=LJJ57&-;GBOM%jmrKi23wg13vi6TJyD zmxj9*TRn?IU2)N_#UY@vx8P;MH{=Zs^(2b-#)gUa#;!Zwb71FV+tBl_p_(mpg>#_Y zJvFJ`7U^{kjKgh}KHv1+mQC*-IO=Wu>cAPiHrDHm_U_XTw0rlW-<6C>q17OsHv6y~jDw8yD5k;96v=a?f)u(vqHW#b_BDd#&|a zUDHNM|wYKd-3qd{YI&;T`kf6HiL$qT7RnK0B7Xxo< zaJ$1ZHqyXM9BJU$M=uZ829jnp&;aMw&y!Af6OC@`4=u9pCkjZ3 zVY^{(%^BKjr+-K3Uz5Ai-n$?l!~HswYYdHs#>A)xYTA;f&q6)JO&Hx(E;7xPrad0I zHloTSZA&v98#5>=4=*@3yL-?$@y?j>reXP3!ghr}d=9vF}W`2#5Z;q+R;7@XPAc8Wtsfs&%<1WP_(0SL)$^eiG-Qn zr6EV&iK==(x~krE8gKhOyP<1o7`^tl@pJD|E4}=8Y3Pxx@73?>wv$G{_KqclRx!QuJMS=aU%*bPj%df*?$zK5!+Y$;Q%W! zje8;@vf>8j*PGLBHreJ^&oJ3KJqe?>9X|$FMXsXXHZ1imnK>w5r$JFaoj~53Os4FQB*jBC#$@8yT4J@jB)t|Jtc~ zvxYvjx~b+gH@0?TJ@q)uqs1CUy<-Ve5e~3Q8|OCX6^yX0gbcIUf)Gza^6&%R{A6#! zObWKNkn?n2@iu;qSZptxg*LKyX07Bbzq^wRTNw`*YOV2>auv zwvVIw2CR)}^F{srIdj^xri+73N%v&@>xwtll;qAh*k}Er2}JyAZ+%S%|Fde<3;jdd zonWsUup(hXYQiYQ@Kq*T8u+{RM0Ar6v|9T@gww-N_e$)C$XM6KO}6JcD5m{HUnpP( zs;x8GI`VHecce>&VQ5p~^w!_0YfB*tj^jL;z>I#U5@oKpB0Mh|Lf3fuUGX$;Zd@7V zNtkFq8Ba@(iPlc}p6xzSEj_Bn;gs@%KbQqvUI^uSu-U0Eghmu>bmEM_y|b#iO$@S` zws$Zax)Nrh(hY8`z;-+<2IXEJl-~46PkKb~AjD{syrTLeFI)`K#N5)g=SE=}rbt(a zh6R^3%fI&O_>(?fLa?s$hKFh|NALJQ4nzdh@=Me*sySiYFtc^1$-DQxg9qv&FJVlr zHV=QUK9bG`#AM229^|NV+Em1zCsN#PuK89EUSRKz5>s3|0u<{}uOmv*^bq&Nh(b^P zES&c2K!*I}tVLS-kV#f2T8jqtt&v!$i70UO2^R?E+N{;w7lJSW%~eAT^L@NcHxcu( z<;thFH(a_>)tZV3m8+$v~AO|Qgmz^k7csh=n8r@NdB{UsAL?vJx?EcjHgDXO*YfoIq zB^}Ck;`ZF9&w=Q)v_}810()wL;DC1Zj4QTZ*Ih~-A8X%ocG=SoL@mt!X?0u;Ua#n0 zSski(TG#IV)x%6Uw^$OkG~Kntx@Np*N$Ao?JWE2Be&ktVSp#HV`lV-y3DYZuk$ue# z%@eJg#WheXrbyHzt0I%XxR_u@h16)4mhIX?2J@-Vb$jSy**r39~WGeaW4S^+WTJ13f56c$w{l zCnoaVW!f(_TUy$Gqq(A! zhoD4M*{U7r89rK+>F$9`^;=}Xzx()XY5WlPB@9SUM2LO%eQz||tP_{Q2C@1Sm0B>) zeW^3q`&z<*o@1R+dNa|1n)V-9Y}2O&VneI>l%^^`x11`h4|gc8HaZCrztzNAGZp6=a&peW^K7S|hny z&51|hYJp1)E#0Tg@wiSvvcu-Wp8LkR66O_0(kLBa(qr!aq1{wpDA;1p_PFk#aOk-s zv^fE7dPkW3_4%HJ)C={rI&|F;?gDm4yY7f^HN|fG#fgN}=Wji1$%3cDd7ErP^7>7} zb)dQJ3Dl`WqgDI5^ZLmHt_X};E{Y2!Z(rAp`XMUq>ul(BhxN9cZ|>T|jo24ye{P|_ z(Gc}`O&&+{6|$~wb|oYuB5ykhimG?o^z6s}FLCbzA60ek{qLE{jWBA0aSVbwfgk|_ z1VjiF+Js983KkGCQ51$;NHCC)1W6RzWW+Fu*g{G*ply?I5m9=C(i*IsLny>(rLX3A zTI`Wltf!?HPnBa870mnlt@W&#Jws5>`M>}7U7t+$cR%}C&$?gsnmucqDLwMMd1lbN zS}T+O5pjxnz;d6wvtwVZS$Q}+N~!kj_yl>8^X%tp5E=9@hvM6Jo!q3?tV$K*g{YD?6oy(ssz*lii=n4y2R?o}ne)rI=3J+Lhil_C z&aMZoM`O~lN``f%QHx~s-JnhIMh-dLygRUc&p5PPjzlhNVbqX2e&+1@XNUiIDtgw9 z2b^6$cc{tI@?%3K4&T=X^esZ*e;zF<|Edgg=)0IARA|~ZRuhU#Gcu6uA@iy&vNhCT&#;+ zjU`OJ9uj@{S_rv%L3)MI)P8i#wePdaupDH#^)#-+keZ$0KrJqBg3lslbXLGKj9iw7OV#~+agqQbm`9pk(m}j>8l2%UU=<;R^E_eox zKsPz1)PFK-MdpBIfg{arGq(@N7VdYcW!y(({<8aV6^4#)drDHnW2*BB^+{uq_-OmA zrSfa0tdN$NJr~&Fh&sO3zQSY|>tae$)3)Xns!rzP{^tO0`@28O2w(x?!s8t)5M?!Y zbib@tjnJI-g{>KV@id?Lcp+xFnlxgjKS+gZ7Kz@u!o;y_?Ps2w5-`U@d@yGif<>x0 zEX4XAralMIRq-G_9Xd=@Wu0M0vq$4SH(c&HcUkFa)epQb?PHa5ble4}9+vzmiA@dj z&m2KD^tUH9)gSHFxpgY~Zl{`xqJmVujPDuzz748JGUMA>-9BRxEyM#sPm5OV7%?5x zBH7l6qTX{_PXr?6C~D827y5UtZ)yz0d2$zGrRSCW6S0BVhFc@BB#lH)KA|2 zWSYAinP=*BrC?zn^I2RUnp1aPcZ0j1Q1w^WmZ>HF90#uFaD{nLz@Ot%YbMU4PU~n+ zl)o*t>G`{MOVm;A_Mm=F8Ofm;^BAT;X+S8`2O}>hq^sWz!x~aq&xG~w>A6s2Pqs9~za3r4VGrib+`y$*tz{Tr_6{6kI0l)Rl~q!!g?A zweKUJRqeK|>2wu*=FZ!Am2-JY;t1_Bz@cty`H@bfH?EG%bd@cZC`2*8VBoN>EsI_4$;V<0 zj@&vps^_w#jem2yZGfCU**?AJ4Or3R)nwqXmBm27= zIC80??HbIE*FJYNN(Z8Y-59Fc^qnTXIotHirF(nF7R)S9w#1%0bmnQ??H=7Z0e)c~ z^UCjfO#r8HcTjpkQu`2NX8Ns|t)GR5;rwARj5>>#q@E%8g-;rf4Yg48-}!q4TI<^vd)Akr7M1SYfLqZ1Pva|?L$6~A)cx60 zKX>MAu(sb0&pCbz?RJ}E&^g^^cm4yO_xO~*K@ShdHfn1-TV*p9vG=_PSB~>b!S+x z@DS5|vC_+8z2%1&(4Uk##&@SmKI~Hp7hEba{0`IO!7wn~^U9T;i33z#_v}0dot#fU zGuex_(A9Fj)`wNmDcjonIWeJb?&q=&CAL1}#k9Pwx3_h2!j!EWw-xX4`9~%MN-$ih zFQ|{o*PfnA`C>)2tDIS!TsF6E*v{-V?X{lqM$#HSyAW0bxDNA?q)w-`JrpsPO2ccP zsfDn5&!M_@3~w(SSdqCmz_sdJR7wnY?J4!P5f38VzCeZ{<7r3JC#r-^*MPwRQJ_jn zz3Nd*0Q}1Fhyfk2|j8 z^`^&A6pNeiwglJn+nil*TB8D!GXEU#HK%3YF!1JpFA(RC>tCFfrOR~Jr?A_QWF2Wh zUzXVPGHqXf^BH$cz52@JaP%qM59yjUBqLbxXs5rmU@8rFu3i7j!dE6SC#}E-i#u*o zDm}X$s2eDBHLkcvrEh{Yl*kN6&(5DCyc)DOeJz-1j&xmbeBQJHD+34O9Cg1;Y+d55 z+m-m-UT;S|+Tqiu_ilT9fHUSftL3!Hno+sB4NArw>Xb!c&p+PdY^!m9;55Fpoa}7C zg8)%Zc7IVWd-s=?a7%OG^xgfqur>-Rs)xj`F18*L-%g+0_@hh-=j&k+zvbY_U)Bfv zoW%p0?wlDoJwI^7J#gFp#?y=A&gDGWJ2>y-v`OxkkM}%SjD_&&mb+u)kDTc4Z}=By z*9tDNqQ30feX&_Ive8z0+Q)nDP0xgnu36U95+3Jr!nW~xXG5N>&+Zx*;ThL4ig0lY z6TqH2cXHzg4Rb8dzeL?|y))((Yz=x;9F{SU>r;VaB-hx)aY zU|w|Sg9E-Kf815Y$*WM*w*>rnJ|ybVs5u{?-FNi!Jb=aU0eK&^rzAAT^I?tlc!%{$ z;^rr1QGZ*)<4;_}ktUS>Ay&i63%K7}+^?TI`Ig5zVg}v5s^8*Yeug;_zw%EQHFMI0 z_J(9uEZ!?zu?A0ne(-2Cg4zfP;qxs?yP8vQk=yn?VKE7dFeCSh83BJ_m#4LI@YfV?Gb#9=VaQ5t8j`L6jMpWt^ z#v@uSA2*I*jY>({mRm0ajJjpl&j6?rZcjb^jk1uA(IjJ|EuI2i^ zzh~F=G0XJgf6wk1Xmz!J9@y_W_k)H9KmQ6(xBZ`0nV4;jpB{XQIl{I)*9o1#5Ko8m z=#c4yHf`K`mEUD;eDVq|T^<;;qh9iw6(4oF^*$yj$|_EZhMFf+uLk$Dej8%cL9Bvv zB*nlYoT9!rOZG3%<`-}XAI~VOClc|@v5F1sN5o2o&#Cm~da#L@rS_vghQN_?(9+x_O|K*69AeT`S{j`u`I!`{e1ejG+H zhv!{aAhELh^HDb@w<=$Pmq5yj z%vaMKc+woN9gXSwU7u-Z9-&Mgbb3B?!2F<=+1v2-r68(_-=^L%?)8K7(szAoaQWb+tao_q}~t~cbz}Mxa)zl zjbo}w6J}n63j9N`xSO)QrE-qdd@{y;O*@Xe9ozRHEIg{HYS2yDXcKKeVq};bxB=x# za&2O*qo=La*rW7Y4t? zRkvq3mMT@>+V&^p-2&zv9{h;5Jn!~HSClN@xwQQq7g5B~TqAL+hiV5N=!`nyI>lUm zFy1rV84LtLZM?dG{~y0s3iLdDH~hV~=4|(*m$RpLMztSHIPg-!IK;^ne2#0+*~+$q zcv691?9`(^MIBaIuHx2yr3s#K#!NVBc`jli)<4I^n3M9XK)Z!A`gdNS|4Zkc$)7Jf zesS(z!Z&^!GV!#k!@Mv_r*xEfOm^Zmz;(JD>2cfhwF)0?l3c|0?^`Rdq> zhthO;?BLWDS&oO1QCW4n+mU8uDeO+_p}<5g+*RiJ)I!$W$!_*!5}r%+)NpK8S3UQu za=+3uB8mAz4{T4n>b3_m;}*}r#qnv^w)+x1dp$Zs+y58prwY0B1J5t6o|BlL;*N4p zMBVVWziE4J>ok_3@bDJ;-Zp>xUmCL!VBNjhZtMu~7!H&y4Hx zV7ioWL#{LD1}38=WqY6`F5qfTyV0LE!H*>_JaW^?DGQV7u{`JSfaR5W{YDjU!Ozk5 z$k(BFTyyuR$8Z(1v69bqNIP5zX`gZv&T>K(IiJ?Dwu=Co0s zfsW?1k)A_Vb6T1w-}0x8Se*M8vGPr5b#3WY8H|ViCdZv~$raw7!amcVn^^Key_60H zwOQ)sZH!-0HLRl&V|cF;Uf`o0Ih7an z@e}LuYNKowDj&KZbO)BTqpZ>e`Pom8dpaeM-Iy3yVCtrNIJcfrQH>~nKtwabn1mGK z3q<$T6&&U9s4%|;QgM6gZbU=*MdaKa{ux}2o?-cCL|4v;a*t@9;quRLx=R|PVAI~V zCS7K0OXxGF+0Mt?cqEwfB-f~p=MU=d7hgvm!Iv&^4h&R>u-=^*yhq)FXUu96?tf(C zL3|m}Y1Yb2>{8U2JVYKYIl-2J)wZSb_>EdKF{*gTHsHEH(C9+C&vvg@IgVgY+r~b$ zQhRzvNBrKY4!NK+Y7A~pyV5hq(cyY-=Mnedr_!gGh{s%QwWIP~ z<7h|adjXv0xfB0KEFKwJ!U~O>Ds4Uet@i$oQNMiIRrf;TYd`mT207|}&c&zwczW^v zgd;nTtlJyPm{3|$ICgUtE-mS>^HePExE41#F!4j>U$^ZFgpX`F>{c1(+3P&#;xHS` zl29DnqmH&#p)XK1TG`Zj7&bfkwykVAH`!o2-(?tib3eF9&g&l0IcHZj|gzu@Q) zJj2ktF#Fnt*@NBvw)v*UzMSnTbMUK}P3RW8t(G{?h^Y3~SNA?0!=aE*;-}zjqu0GVj z1nYsOx+k*dZ%b%*S&whOu5L&6{H6p@5XjtMMi$!==o6AB%ut6Q+B94L)z8MnD^+2$?Tn>R1Ra}imamtoGHrA`4E>NLZg zR;beob6WRLIsvA1J$%BrzNRoL6fS2nh)vS93r((016%g0~` zEr=^d%T`c!9$i&iHP*<>N|#sqDr?7vc9qiGU5+WRG*{oz2S~;Z&lR`wGLX8jVZ%!?uiLl)rGZ6_w@H zE1#l+gDjwx_X6)C^lfM#_oJo*4hf} zfN9&t(H@5Pz8llM!4mrN_+v}DHHhe1Z(30e_8!AtYd9HU6<7LJsI368T^cswn+AoT z2x(hUT|!ZitQlpch+1wDc0~&+`l?IIS9`G&q&KuDoIR@PCKpTn!Yjmr;i{{?u z9XDotLtN`bTngKB^rEZWdeB$Bwi5dWmaQnSL=Uj4>S86cKc5$cRf;V^3%qL6 zz%SCQD91j--s1AgRle$r^{_*9u*{`OTomezIWsSk$qvij>XM?>-c`PWixp~6-wRPA zSNX7CY^ArV2pd#ZU!-Qr9Z9*jkIUQ++vaEO>U&q0ud_*zF66py1IR$++v*h~*yf5# z??c$AhD&G7o4+W3>B3pJ&YJzrMRT$j&H3i7OXu90^G$C^E$pKAwi&lA_7<+CDKzNS zMJvjyOI3xl%8FL_3TnfJ>E7ko)A3#^qq&7zFRa_Vs(mU$3Gt#|tfH4RWDClCM4zTr z^HaOQqq=^fIaW?IVQ-p_A-aI21=wM8X~A*}vA0+5DsSm(FE_F-UyYcrtwtEDix6`b zu-R5?=OL;GEAO`X=)c!A`MMnx~c&fXEFhlCfGBiPlWxk0C?>tWfdRqPE0 z)mA4KaW0gO5;A0USfkKcNfCN}W?`X)QJvWursg#@0@r8g?g!T`sr$M^MnLzkHKNL* zl`5;J*y|hy74cD8r82~~maPynn;Zi|DR0K#NimE$9mt9Z*EM8lN{+nB$ zmctvm1oYEd-!fTWgpLhmrZT^}vX&VfUIT_^OsLUgxlPWht_oyIaKz~QDl43-ml1uN zbxC#9`q6k@0^^I_F)yuGwYF64^y+1s(8C7?l+ub4%)4-@$QDIJBB=e9t7n+4%Az%E zk@Hnyfyp!s7ExefSFqJ|VJT+>cBvOr!BVu(u=s}JZi_F{t)>ZN{LC+Ixjg#>eH90fiehOD$T)pd-$7HZ0Qcx z90`V9gxO-);>{%Y9k#tPL2o3@PJ>0td31Qg4f7w_s_hrOX?%GHGIfNt3O5aA<{PRg zeMLwnC2|RG&$y4hCd`_$U8Kku?~Uug7JvDaHs>#!>@U5=bT@itGUP{>-#mNt%LY9fdz*)z_BDm$O^7F_ql z_JP6lB;iHgmxj8tQcWehY6>Qop;lE=jyfZTFj~*NHB{7n84AY3UjOxaMP#+oU5Z-D zfUmFx1bdAO79y*)eGhiq(tuq*xI#dEWp$|@$(Hgp9&4AEVX}1zufd>LU(mM}pepg! zN7s{Eyus_X*L-M$ra06EyU&Xv!MA;s7IMy49eSsf((3CqAR+J4LCLFILUNtLu&XB4 z$nY=ERVG#Cs$`9760`F|buMh8cDvlg&A;sy-0w>&qA4OJ}^18H0sQFIP0R&!yut#^02YIezj8+m|33_nI|uoJQeycyb9R>A36cK_)Bh^bE!8KhXgLQQ?>n^J57h2OTG2cem*L60&=Oh z$%aHO^~Oc}`MA)D(!Vj{{HBQWNfGBP#gKEUoqp}-(?Ta8SJ=+!JkO4}J|p6MR>V1L zVaU0xT&tgLe==^3$bD9gA6_3Dk-kr2c||*3pB-_1zHQ$+ zUcWLz|8DWi1Fz4Dh%fiYHICQ0XPFOaJ*1 z`Oz6+uPh>cEfM~&h=`wC`VYpL_P-SopWzYuFGb|%e@2|Y6`}u)i1Vi-^6Sxv^VcHI zPekPRu!!{KMZ|YWM0$rsT;CIsU!I8gpNhEtY=ph5Bk~`QwFMpXuPGwFuSBHGjLi1SGi@pnYT|A$f^esTlbd%X36lpl*_0D6HT z5%pzTg#YG<_*O@x_e4beuZYO6k_i8sBK&WN2#?LhA)5~~jt=Rfnb(d9_y@G%i7Ig)wz z?~`Ok7VbHGXy;kQKi5V%HoIrLk|H*5V?k;g;+9QhV4?-2Rx@Own~ z&){QZRtmUo@;uG2iB2B+x;MzfwfrrS{|NTq6>f_|-jZ+CI`518O4$F9{7o%CPoA$i z3T=hu)rGp}79InAwjs(NNkBf6Cuse2k^dR;4Dtdk&lLG9kY@>h1kM%S1D-E@KN|HS z@-?4*!7s4RW5ApCspNep_^+kq>9c zcWOD`Z9>0;AwMt7J)-dgCChP_)`=r8(d;J6L??+1zc;~eGMO*WhVzP?`)j9?muh)B zd70)3qVoWBrV4Wp?3uzPkmm_=KkQ|~_kk;fe*=Av5e}cWsoqzSfxN*uu|afx2j)1y zcsfvrHw$N>zHKEh*M3_>eh=h3g}JBmv%=fKFA8&y=Oe=E!~Sc+)7W0f1={{e zGCNVYx5!1B-z6h%eDT%$!raUHobdO+=Y_k$9Ehm@3OG*qS+JX2tZgQV`~>8Kh0lV$ z!Xpq?s_B4?+26=_HIe}cFIa73g2A!$Ge*|X<4`w-%OSOJ3d4%TqImA@jN+2%W-?B3V#b`Io(Y{y6Mow6eHWzJMk#TaE*Dnmh*b5Z~~4T z=Bb0Jlf|Kz%^JI#*Mol|%(>yu zh3g<^JEuO~uY}p(pS8*VA)Ele9A~MY1dfItITe1#3bUT`eV>%Go*xm;1^+^LD>x4M zLLHWaUl?NRVPW2Dv&~Y6^WxpYsnB^%m|^`|m|^`zm~-b3h37&ZjW$m^baBGxpwnM? z5#))&=vu9THvPfEgCW0O*b5#d%=l#6^k*7|{n^4%;03~Lcgu|qxJa1ec!}_O$X5%W zfxKEc8S-tyKd<0>X32%bD%BFLla1!#ZRyYA%FC2h=z^2c8B*u9H%UU=S z+#@^}`fm#Ztv?7)h0Y&^v%vqb>3k;Kf_zwr`wH5pyIr^t`gy`7;AO&PVE%T+=szgD z2mb4Xc|Z4*F!Sw~!pyhVh10?B3eN@qLl|hC6Xsmnf%_bWm4|Sz5~fbF@Dj-RJ0$8X z179aR6FPjin2G0T;q}nT5UvB?Xw&C=o~XYG@=9TbwN`jDD-yI0>jU2d zMt#7d!@KY~LJI@Hy&VFIqd0m)sJ1-2e)hqlr$empO!ts54 zt`hzboGi>a%QWHh;90`7lPlZ-`7OdPf)@*KhEA#QR&cE_{jL}O8~EG8XTaYVZUsLf z+>QL-B@8j%rK02fD&)@yzXs+SCDZZ-_+{af;9m>V@0-GJLH?HT+u(PM4(jlK2uFd> z2*-i@;|7NIb75zMup9Dm!U^CB!b#xi!pY!S!h^x3!i-P3uov=Q+vINwZ$=&XoiNuQ z{wll`{JAjKV*6vwm~o@KT$uL+iNdYmB;lFR87#a9JVy9k*?N-yoka z{63g#*$kI9*V^!}reik~jg`Wdg*>q}!k3jy2Fx&M( zo6ZZuT<3UQm~9~n_vb9pCP;xoFhCFX`e4#0{eFfGvDqJ zE`!`BTmh~SPD8oW+w?aGr$fF;crf?}Hl0>sFXTIfQ^C&)=YbE~^p6Pdf&67*hWlHa z&MDzVkpI!9^RZ3mQ{g)3IPnFQ$-`*jw;_)cei!T!W>~{*`XhxaARjH90nWAQ+$y{i zWtT6!2fWOtQ!IQC@=D3%>~NH(00r2-q!r3_MAA0&LC{W;|yLXF{H5liwx$ zEaZj4?0eVRbZUf`K>mR6GVmsw&Ub}3K)zj=ef~2xogWKVL%v_Q2K=^7=Z{7QW%mzZ z_J>Zai<`C+E&MLhHNYmnN;nHPuMuY7GE6uZJi(?vNq8>gvxK*T7YjcJF0knr3m=5M zRJa3tzfI>s;X=skgiFAU!i+$}wKJ8u9@)`BlOvQNGE-Z-FNXw}S7n>HCDAg}hMsIdHX2XPxki$iw@EkANQ( zW*dA&m}T?>VVJR6h07q{Av_=aj7{gq!aJeAUw8xfW1G&W!kNgc3&K;u$=*<&Tqn#t zNwdkv2)_aOe49L9_*Ka3Z1M)-w;}(&Fu%7sY18?ga4zKk5I$&O9-b14&*j1$kS7Yi z2p(h8nIOCfc4ioTgnO&-Yv64*{T~T4ZjK?LuwsSNU?*9a-#6vibnX#81Ha|Me*-rO zzYG4pP5%ku4A|K#JOTVmo6hUP36Q@noCN;JrgL8S9PIZSs^fefoG6Sev91>8cW7zC z{0?orO()YZAC=cJ37RLS8DI3SMK=Stpzf`Bve<;3sW5?ZWRPp8JJA1Rt^K zbP01k{@;Y%;Bz*e&xNxfcc<#KA3;0^2?MR`gpYw!guB5bY&v6w`5oX4n|zKizn5EJ zldrS!gTnmIuuga;>_2JKX&0Ugo&Cbgz%K|Fg5AS({7b;IZTyrlOj`SdH$dlkoBXhF z8RWkce#2o||0!Gn`6t5FVCM}wtT-2*uM+0`Gg+8nT_;=v{WP0=l<=$286*4}`0F;E znZg11yCBoh-~aVAxl7_#KE>cnTQBsN`?r$a@2Z%kL7?g{Oiu zge!2IAk6P}GKH@OPZj3(Dp|t!A}U&0(SSGWoHi*tpa2G1AH!n*h(8|MlC0Xj>B zyTHqYuf+XUq3|lmON42s%*H^=v5x;GKbasnm7m~S@x6-5&q-RIfP;B1LggWJRzn9< z11pIc49C18vwX$~)8031@>#;Pkt@t_m`3_#I7}BAe>x5~0^oRVo}n^vpj?$B;=|`m zyws66t8y%-2EMDpCkc5&Hw+&#ty#_?@o zriG5rQP43w@)qP9!!z+z`7H6LACu1`!AXn^98Hj^%j_Tr^A=2hvqjE0+#!sEdbXAN z41XCu#xL-qxG@heiksvimWr(;)LA-)L8i^Ch3RjoFylE&m~o?v%!e-u3(>V46O^}L z`Thp^<`p~q-Y=EBK@&itaz1aO-0J>Ycm*YFPxmn~BdSsfiU zl!l(=UI%@2?^e3gI@e3!KD+!r?1T#mqnE3FT2ZqWBdoz&(NwkxOEVnLajq+Gjd^!n9K;%<5(}uJby-*Hh(P4w5z^X!a5{!=HZLNO!vPC)27Np=ra$0E%GcJuW{&b zXM*`#bH;(`TPw_b`hl<)%=KuK#-9kMLjE)1H1Hu|hTAF3a<|4*7M1zNRAVEWF`+Fb zWV?*8ohr0q8MfT2^p$;y?y90y1r?#qEke5_sDSzoQ}#SC8yp})qIYqSmsAZVL+^5Q ziCuJ-_HFyC`UwW2H{J*ZqIR6Ax`g#FRgN&Lb_T*0jM$**3oS%!gj>Dq{(nClMQ%r)dY%WSm0Z|w6HuZ*K`MFw&XLqOuyPg zDe?l0aEr8{37oT9EibLcHh@7XbDUzkOx2mtK9@_^qS-G+eF%D@f~rq?2kWKSX0PC0 zYYetNDjGBU*4sy;O5xnZ(B76;Rg?zhw6dy@TO#Ql;?#CyeRwKXo5|VBJ~D!8zqCFw z+O~rt`cdre8VoxuPE{*{a$08h&y7r%BF7N9uxrdJyH)D;p@z0LZoJA@-88V*C@Otb z3A-6(|Et)I)X@eQF`aAH7;ciZ6q^EKlg999>L}?{*ss}>jg8iVNs|^B*fi}Z62FRqC>&Zf@X@n_#(>ftNF2O z*=wR61Hxjen~i;IFuP|x8|mw+v={CMA7(GI3UDG2rl4Ab-bh*PoEml!yJE7+V-qp- zX;s`asm-1l`UuDf&Y~!kDN2(EV*n#0lwa|`*m?>RK(caROPJ|(B*nOXwdSJRzQHDJk z!-G=UEt8YJHFWhT#*C(_B*L?<8y8(d4r9AHd(N`3q$24&4ej>#CHF2NMUz31d*T_n z8cOY(<(Uf%TyUSenoc}3!Ys6G%gbh zU;{2UXSg31EXR=?Bj>!&wmaTO({1m6u^#V@jWc@RhaNdgF08*puT{;(Ipf1?yw|=r z!XEFTxz1#qu~!^nuNC%qpHF*Sw=?$me1bh40bH{sSLs1y6(gZ`y%xw?Xh@t1*9Sdv zmdM{ixcpre!;QnoggZIHUIxy&H;{40-h>EyORzS==h|owW`p(~6MIfE@NT+Z4~ew5 zCBoijtgrC-Cfak`>>Z5Amqnv>{3GqXC*k6t+!E+)UwC~MH3JHp;3*yH-KakN1f8(}Z$p-_5J{e$-Y5@D|!_R^IF{m&-8!8Z1(tjdwcw*VzB5deosTm9>3IwL-8AKv)345 zZ$9j0;kt3OLAN2o-XhpD@#FUl)N|w0j*mTln_-W7#u++5~%w6xA&pV9{VF+qrJc4pWR*w>}5i3oUzB>>)P!lKN9Ls z`51$-cRa#gE9`MDVVtpdB*I<|?7a%5x%f=O$Jk@tvBxhHnUMvVamLcT|<9|ZQ9=}3l9(9Z}_Wlg8+uQnR zXuO;OWnQDbUjpp*o`XH^F>D<5=(+&pES|u*zk@amJ%&9CA6}z97bbi3j%KUeI(%{W zgslVQHGV$4EL?BEH$!7KJv!y{Bk7+x_R%FnuTZ1Rf>!D|N)T5h@cI2Ad zTMn$_Ip^baCJ&9?am0^tFizQ%zJzIGdK2&&J8p8O*XA-VVlA0CVS>6c{>Jf>#w%JD z|Ls|Ga~uv6BIAFL${Q2r{CS!ts6!f_-4b2AhxUl>B))BZSG_Ya6xC=oEjA|lJWi~S ztM%otnX_PWwtr`CQ+-~Xf9K4m`b-?Mn(Axf+B?1OsH5%A)#GP`e7#>A9t&*!WJQNF zC)=7Ew+_c|@VmY{I-D`n_%_@+KVL}rcuV!ZD?-){q`;XIhMcucTM#RbFKM- z?B@1UB0AMnKfT-f+Rpu`E@k7?tAd}Hxi6|?4PJHVvQ}=W%(XlltwDP_d?#WdxWD0< z5`U|Nu(`vFsOk47;^o9oS()Ry60A17z;%#?3kTX9*}c8p*(Vpg9fgx1z@vvoDJoIO%G~-Ld=ee){#V z>ldKX$LM(T>Quacbxz7Y=k%0>+U#1#*<)ELy}eH-9(GNOSrvUE=2X;suD6}m;!hp5 zFurXSGzg1Z{aC~91J3eF)&jQq2wb^(bZsRz2Z0(wSU+IFv2Vv%i>Eki*WhKZzQDM~1&u-Fp5tlmF*Y?52qom}%?^ab^X%V44LkuzyG|HUu1BVCk*mVRkB(GgpU_T%5- zZK_92amUP!UBKFcm`0=4zpbQl+TNLgmV}xVZEq=8G`IF{UYM|LLGexTgJT;mv&P}& zp?6sRqvtmV65O9W-Z5wkf{)AEym^cJn$~Rzo~NxXc;{`PwI(jdX${WY_jp;<6rF>=-2(!OOJRY zm}VA#FBWG9+MOx}Xk)(K-cziSxb%l;UTSmT1<-4>cOa5Oqv|1;YG+i~oLs75Ag@k$r!v8vDh*1D#Ki~aT-uW@XqSvBi+A3UYJPggxwrUSYKJvb9~+xB+K4c{r^>F$$05?e!371}gI8w%SPJ?A zX9}!?DSZ7lJ5Q&rE(SZ(t^M)5DL&R?dJGC)xCBgeIP$Y6FPP>WGBhDDy)v$!|D_8b zp?kcj$G{_%fz~|fF|H2w7(*)f`CQ2wq9d_i>1HL6!%=f%+M!)w-W z>Es*RGoUkFO)#Jq)tCsydcL8ZZ%fWya4PCdwlcc-s59S}k2h?uVf-@TX`ku`0`%Y> z)w5%=hysjpT8bKF_QfDd(dfFp>S(4RU)VlW)+X|Q9cI&gJHBf>+Z|i!yRN-++2Box zuSz-x_k{`Q5$hTg`povoQR(W|b&1Fy(+y@~cv|D{^fvlx7t{u;&g+;?eTP}1dOnpI zo*@o*JVZD_+HwY3De5imJ1xKO8rbtM;80a}lXpDkBc00*bb5O_YamyH+2WOs_LS>N z*OYS5=bY$N?3wHfEIBhEtbyTJlq1x17>{zw=V`Xg$Z+lZMs;7D((F3b`{jAscUE3f zIGGjWLGJyjOwDpw93@~cSl&2c!L*dh+Jk>ZKO2Byjc+2ow-^**FiHC;c;Pxtno)&87~3y@94o@|*$bXGKO z$*<3km_cmcf;RHzfzAxHcGi70YsSmMwYeIE({P1VyT7*0-?#tG7x`DEqb#uQ*C9eE z7xhAU&l^s>Nu14S1MDiP>RK??&yDq|Y8itnQi19jV~viw_WisC2RbX>!Hkmar`uPu z<`gG;^WqmDJdgPgW`gP!_B}hkcbXw!CKzqai*5L;ngL&;sAPV8(N#TX)H9)^JzGuga zh!yiR=0a3Mlyx>XP7;4i%lE8-!ED@q_rn|G{jDuc%R}Zin1cRSqpSO1^-RyIxQ+$Le0yE{5M`C~yIy$C`F*eQLG>uy>o`tD zLHF+XJ!?E`8DW<9XN+)f?*-mU&5Q2p>Gj9QZs(pFVwjuuRghpq>ORC_4^EH{jSxFpI#Pv1q@X|z|{^EAPx zKhfcw=NzA!5STF}uAlp|9^dfJ-d?{e)m@5e<>`p_@1EN9kU!aK@BTCM{)L2(9`PP% z?Zu@2KdhoKB*Boj0!dKI6s4It~PsF~*s*UP!gLG!Qqv#9uDC$B?&Mla#BnNAg=4u6c9e?7L4+QFFWKZ`EcXJ#)ES=UUROIB=Kw{$-Rn5_UcE?kJy{zgbu-J1TWjN1S={;T2_3eJqe0 z8F$pe&eX0<%N^(U4a3CMms**ckT)AMK#V85=0G=v7O^7ZZ{6Bde*kH2-K^b!dqx<=f_dWA8Q=k}iuX+VCz-28j$m>ZN-o2))rWXmTNmO}^ zyW_c+u@kRp3HJ$C*#hJvuXsl;N&5OSKirN%heK5wKy3ljR z)t-8rJBF&wy8|5ywvTGwy=VI^?yq&PITib!Q`M|MeS6w%fqH-1LaMoMIT5Wd<<=vH zXH!z&Ng3wvO!fPQs>Pf=<(}zd)VJaaate(k z>O>4G5ei+D&K~#n>}p}u)irfxi1L2+cvjD@Cz0kpuFUV*)oS;H8TzhvB{&fi;EdjV z&4IRM$YUUe##C2eMt58w_CQ=*PiJa9>s@e+ka2MLad_vISltNba{y=vu%BppXbzTP zQ(4GrPT`K}+Su2O#rb7@@5IyA@*xTO9%%Pl2oGHZ2D4}@kb|44qn&Qv>u}h0&`rVPDwAIms_i*Cx$ z(A9W`deyW0V?;`YujcZ|)!m;$qSpPQt>D6_q%$<`+eU;-jrTT{|2ZORcFz-2oYS2C zp$Tj7)n{HHcY0jEl-^$NPOn?#PxQfEaM#eahds8DA&CGXv)x3At4Ry zs%`zn-MAgi@I34aIMH3eb|AMKy#{Z2kq%Bh(P76J<6fjA6eD=dIm3=4=a0P$mtTcb z9g;gH1_Iv=yz4u(W*l2u#c5R?uqIJ54s&u|tj~A!?5)Fj- zdU|Juy5Gm0PR%%Eg;69~0w&QSL{0!_mJzF79Y&R8MF8JDtp3 zSnyoq*dO}d2Li5c1ss@9J(S((a(6f4M$0^MiFd)ST~$$CTD}?&sTLQP7I^V|Z&3{& zRxPT;BZj5-6?jXkymGO?>#GQHk-;jPN|jBe${SQE!u!iB=zDVUY;_PDPi9HB%Ldcb2cRtk!#*dV98aU1@cRcX+7ShJS%p zsF;U`<%f=sE^rec1S=K6vOO~EEnQt)uJU47p?VW^arxTSg`#1*xYl;jq|7|F8}@6N zkPt;`>{PAAPa(B6zHM5EVa$Xofo>?a2k#?)!lBc}M|Dy6iVD}3A-AjXMEcSq=HR8X zK>rxXDT_15&htKOHH3#FxxT=7*@;Qj4Bc1OWSqHn|xAtceZ%R1Q=RlcQ_ zzIEzZXx|Dv!>@i$M`>XZ9)K>dcNOS@wmZp1_%)huUsvoF{ zmd+jdp>N2BeukY{qI=3vE%JsgUBXxCeV6itE2s+goawuc&QsOOBoNuHGY8{Eu+W3K zfH;Q#gf6Uuu=$W$8q84JrJym%GRe{}(2xPfrXi30BRW$g`C-vjxu)MAuglZsRcEPp z&f-gZ#5LsHmt})Wx|fe4*&aty&sKXOUoY(oh&;J+y|1aJ%|6jJ% zy}sTv?{esr#^B&kJFMt){&!ii*4uJ=H;zuVdy5Ega9OqmICXwm=%PBmBI2A+eutb( z?e<_l=abDL=Tc7++s}uFPCzc~+*BaxyAtVeUi6;yQ4#v1BhJT0ob$=dkaMXgA?@dU z@-XCF*4M2nW*po%@o@&9B2yy7Z@LEg@3Jt{v^ke`v+a!OF;Agsu}fJEskkmGp9P_d zAQyH5sg?5N1=d&FsX8Aj@io`iMU%9n{v8qLgKY+Qo$vWEj_2GT(>R_xBm8?K&aW5$ zIk3z3wm&4_NHXOE@D{nRi~f5!Pqc2u7q!N^PS53{{~M*BX#G@H1P&{ES6P3O>)fAX z0G_-*F7Z30&abr=$@y7zo}%{E0jhma24ELG?(Jk8({ocq`p1ZU>hSu%N9f-k&nsAH zRPh;MJ*rRDf9n4r;{4i(^zl7hbl*|_$63cBuJb)e#?jv8k>zPF;>hc{crKFe+sfWe z!5a2k$Ohn-0^gGO4^ih+t;ZtDi+e&DM|%Yk`SDD|^&du@AC&OlMZOO}4?9Q7>o{x; zz^;+MmH7V{`8oi<5P4AYk6|)AI)@kk;F9q%?|5Xt>`0+h_TXUx;L`AM3{|N2<4M(= zLHRJv6UaAc#^bKR_Y6-Z(*Rr+K8_J2Z8J&YO*>>(qnX0Y!g<1c2KF{#jujh(8TUqE z#{H+lUL4h4GO)?0{z~LbJIjb+F-kGWcXB%TDq+TDm@w1C-_lTrX__R=G))oC0@FF9 zOcKFKOo%uKjl)so-~-NZjBApV5#vYZb)}O6fMc2+*DF+I=8$fd>30m*a#ePcx3p>U z)=RdB#mt1`Gwn%Wp5_QMoMplc|6yU~RkJX|d|a4eZWm^lox)xm=^S4CgH!RmPP2-q zKn_$!Ayc_@22v~Cjig0~4X-9Hp&y4!@A?w<%}ftfZ_XK2^dJ(d5G=bSwxNq^uK4(18u%!e5w zXFN-UX|F;!m=Dlr9)9I;WoqN49dIyQa4=jj!z~gWhPz6b;T{nFZ-q-`I4?d);9$7m zV7TC5dcnc;f*I~##V=03dU`K|GMpEmByccXa4=jj!z~sahPzsr;eJb);nI&OU!FTy z3E}9Ud>4-N@0fspaH;q>*y!QX@S#ovj_G9lrh_g6AIhJ>k>0}g4`XKrHx(c1yntht z@W10YlPqoRYH-r!I*kmA%=l7=%=q3c%=pd|W_*_jGrh}&5uDyr4Sv1g`$f()Jt9n- zTZ9?rR$->EO&AC3pMTmru!w~OdQ`8rv6`qnFkkyvv9o3q0`0m(K)>M z2gfve4+1v(dtkl0)@uz;XM*A#_c6`W;-a%oesY^Hm z$6pIGO{_Q6XPSN|%ryO3*oz~7M@5}19QjiYGX1LYTKqC?CZCxG$5{M>Q+dwF!|}j+ zOMhOn)Op66@*5y$yiJ`~Wx;=N8TdHHDAer&`W4VuWx>e6O~r?HZiYNdnEOu7Bum@L z6*>1rn@g7V!Z;@lz&|)np~y_rbYYek{Zfu3>ph0S^tV#vOlyTOqM`SYgN_^gkjSai zD9m(!SD5K$d!~IR`Is=%-6KrDCxw~TPlc(k#yI$;eiG6~JJeTu$bp$fYU~4Nf=AkP zGK8}rzfsr=o-WLMx<{CK$@?#3UyYTp$-JR+a4?5s-Z{RmP`ANvXl7opjOdt;ik+}W zmioZUjuiZZ^Wx*k!aq3X7xk}#KJ$zG2gHTxH+?MANqHyaE->E*M>h~3GUGK$I1b0D z!i?8!8>{{h`m{G+v;=w zyx_}`2F96wRhfdB2dYfLEMM+vZ*)|7iOwvM)4nPT8i!+=nLo3Uhm42GbJ{X(ma5cY zJ5_lu^IoQt^40LmyfE#Q>7;xVZLs{1d4}<=C@*wZat$l3S@*NqSD zzXO}Ek!6f{gPeBBnF~HBOq;I?Q>RC`1pIHpW#Io1t^l94>GL=8OiMN7p9$0E zb*LYd(`Kr04S2XP%k&$<>%nTDY0+OK@(qxe3NHiSFI))TFB||L6J}Vi2yX(P5N3Sd zwCVg__*uwVj~P$ud?@@HnD2$8{0%VQK|`(s^Zi@oMc`E7&ET7a8HcY4Zv}r{nD!Ui zbojnP+G&COZeiwgx$u+Vb;7OS-wE#o|Ccbs`b2mS__8Q%lkzKtp97B_yfu9qm{htYUgAWPM1a}F~2lKsJ4C__!o5IXnI`$!S5G#&F zI^xI^DAnV-=^K-A?zmBj_1GbOPAcUQ~GEQZY$KxN|OnhkPdDzJ%%NR6Q8hDAwbHK}l z3&4fK-v*ZmKLIWy-++H`75Fd?KSkQB$+IYxF*jRt9S+oCTi-xtWZ~lQN#f)ePK{Y$ zL|N}U4(9cd_)v#oGJnW!9C;f|W|>SAPQvk4VU|gyFoM=&7WBQ~T_UHQXM|I6{IPHv zj=vI4$MJPxmeqU0j7zUD?L<3td{}OA!i`g}0UYNW`iqxyfyStj#EUJYI)ydL~5 zo1G29b&ziqrk%%yYrxOj^bZTqhy34!7lFs2u9&z@63&BM^~s3O5^$x+mx0-?s9y;F zfp7_!&cTGkMd4%Cds%NBEJQfwk(sX!1DkgZjS;3l)z4g`>l>Rib?7fG9Z&b@UBYcU z17G~e0=`!7`?;9#E&cu*9*t`FLp_lXgz&s{mD-Sz4@21E7 z_2ub{gRwn2^WP2Z(q6wf$WZ$-k7a$u)Lrb6jj_6XDf1eSu$EU=saCEYBP%UXyYQ~9 zqJk8Py2`zI!=+}o&WnpqbtBqnMAuRNzlnPr_^7IDZT!qkG6`YO35Fp+&>27oCLqzs zm)Ir*Lin%-)EN9I3?z_9fRF?U7H`9d$po>56eXdy4M8waX_Zois=W!-h^^de>TS{5 z`+~K%*w(&4Tg58oeV%>Ro;hbv z+G~9Is@Q04J2Y5RQ&qkMJyExtK6Hg|{cInBex8ypPNB;a9hPB{yq94R7H|<^Y4y>z zs|??oW>={I^}SuJAYX*GuQJM*WNk>%?A#3Mb(k*i z-3qvMu(n$IzR0LI8@jSAE>)pgJ`bJH_q{gwr98|*fA0;_D!UnPO9Q-^RBJ$b9J`Cy zfVLXjjxl>JHpmyT&SD~%k;zAW7H#se*olUuwALJz2OX5(#@j6zTZ*a0i>6_5FaBo! z^EyNCsjS>Z0T_Bw4QPet+HCy1YJ9f7v}`;qD_4}p97SL*+jOt#wNH<~A^VGSidjO8 zzv2JFB(o8hWWN8v5?i^E)A3x=U*BQ9F3<-+j7Lu8vc=aP*Y0#aEcoqoGt4OUtLc(K zN1P*ZqsE%gK1I04V}*+2y8n*}vHbX4ldpvmI(WvrptJI82fx=4PJVdYj_|u5%&qcu z;6}>?vIt%aIxD{#Jp57~@)h}TZ@&bRTav+(N&V$zZSZ*W=V^Ws^J z&rsTFe%%PL%C`mlQV~Y^Sbdt`Gr(4Uso=-`X6-b;rx0M}_k@Mt0Ewe~wEb%3R||fl zG&7-7x3==W0DgSlq#-;f^W#h+vte;96dYa#pHh%tb(fYvSe1zW%NMM!k zHgx#j?X?{a&{6=9g3s3>#G(Ud3X5~j)-=Bhp{4i8U_}z*0 zOs?md0;HRPd+jv8+d*gLSAz|~O&}sabma)Y>umhCfFHk)*G}^rXXAGs{LX-g{LpkF z{7#{NS>P8+`x@OxR((9`@bplnutm3YC> zj(Ey9L+Hrw4Gb7o{bgd33?p1S&F?kPS^1?xX=S3nd=N8^{PdX@AXn}X`0=}Z?KD68 znHP0mHg!e$3UFzD_uAwu!6b<)jyTP))Fxj?uK8Yy{N~`&{BmvlYQXQ72se|Cx6^F= z&RF=(v+$cJ;}EJvxu1dG2ZHHQw{*iWJ`rR1QSRw9tT&K{c8ufoiTIk|Dokn?vIxIZ z7>`M>>1sg7exaS#%MKge)1b@IMDR7;onS_O6C~~o=t?YfjN`Qj{gS?Rw~f-s^mW{E z&{=I{`=^`FC#(-TP3M7px(o~_ztlHFB`*#r5aMuf#`KYa15{$h02GB>()&EcErTuQtLPN*&}YFw%a3 z*W78(V-2j#J-va?ctnq$=XIW*gmDQGi#s1s_(*xTK-lBW|dCl>R!_Q5t48V?2i}&d*9SuiHVD-HzICSTq zhyB~SX-g^}?+9IHWVAmy<&F`-ly`%J4+eeR!PIlXAyvUao1aq#&AMqy4JOszHI47M zjs~w#D%tSyn0=X}2j;>~dr?z@XGA9(^K!`6<ba(YgneNE{86jzwfMz3gt?cY} zz1nj$aP`5!=#4DrxPIXM9p|_ta2+$&>7EO_Fhd%eh6?)!PBGn!PUx&HFyvrhcz%-6 z6dV}Z9oLxG{I|v-VOI!7c4pH!Jru}_^G)w(Qa*O>&tccH5fhqIcT7zRCpPVNHXL!* zmx#`v{3(R$P3ObUgwiMaYGHvK>@YI_M#}c&Y9w$c8L$_%4Sz*zF7Jn)xHDX?>}?6{ zD=B7)pS&NmN+i|A$0c-afmO5AjPvJ$!!n&Cf`PGmEO->3=7dG9OnAH5Y^NAmi4W}w5QfG&vbrwo6mZc_!0)s*@ z!P6}EQ1?8qvO<++eiA?_@_P2=9bB5(iKg;omrBb%=^TE>7m91YqAfUljbWUm#ox56 zVInWV7!e!+b4P8#tM>&$fzgf0p}>fkvGsuK9J)iCvG58^Aej#%i~4JNJQ*8x6LIH{ z?HLQpxN{p|kGLst1)7EX$I!$TO@X0X!yRpb!A(idwj@^_de>e4x<`}I!P){Ttz*4o zVA*j$@{iWv>q_1uXU{>8&~GBYeGdiFTITO;hJu@d$&DN*LP4+ZKgWaugRcoUcFqll zf`dGXXgw{v`13|%ZsVH9Q!sHj(i=*=`otT}r*@<|PV53dwAz3d_9ctXXH+qRL6zZ- z=Cch`obDeQM*}J0PMqHXIClr4nu1qA_@)FWhX#Csr-z1)gn-Uzx zzT~>i{;gqu2h6$-Q))T#%mW?>&tdO1DB@0tI5ac7F8zAXv32SBzFD5pJDgobhB<-l z9dJt8ph|l%aK+KUP&4(C%&vt-Cevg#H|%icXBwG@8wNYw1xDAchUWx>t}{kI=j_VU zyh{4yb#!!BzLCi^UE_^ulffo`qE1D-sj3&)B^W)>>7FFx=HBs|3buoD>#x^|`Ax8y zn7&o~gIBt*Ar;2ty@filss~gQ>H!U;C5RT&vc{MGX8u*0A$wo1(iBZk>l&n~ruRv; z#Fy{kD1c5xn{IwKY4l0a_BTAVbB)216O)^k4+oA(ch-L!U=RdC>+P!S@$|#NEWtrM zcLRNK5M(}|h&7aq#mDm(e}?9GArXen*Qn@WW`|V^lD&_42C5uB;GBbT3S8?JcBr5S zoG&_$v$tbl?Us>n@8hS?YlneS8fdc@O+H*)^p=b2Ox5%ua{<`Bw=@58QNo@-LihQG zo+JL6KlL*i*Zx*N=`*BlUi0*;9nhu9@Lg?N@hN1e#4!!EH+<$vd>}D@6sD>0=8flM znmWAZSg206C zzoog~E_~wO;(fB^3aIJuwu1$uIx*DkJ&6=uuuVJ!z1`DqYlC-L>N*c}FHG46{|FM* zu#hkW6UPf_|2EYX3XE#r*w`<2?Bz2@_ufySUr8}yS!#mtLsg|MNE~&zV58!Pg+(e) z9l_`_XluH+E1d;oejn)k4z{kWZ`Q>=0-p8XlRDd*4Vte0pK)E)i9JW{_G&C^uOI4r z5FE5%O>g(#6&gHWt#q2Je)TMri}LWKpU`Lyj=ogWaNZj#PDQ8zp5=0@B~$)bLzyy{ zX9gx!k!G6^)Bj9v&bw~aqTFd{B8p6{{yZ5+J7KafZllUu4U6aE!Z_+@^DnwP4bLDI z{(;#miWay|IF1F(>4jD_F@}zC9&;R~eRl|`0tPxD{(^$5)4m@GOt6$ul|!BaYQKQ4 z?7C}->dxeYW;oV8uLNkd{*G`MSLWcwk5X@OJh;$Ru(Pq>mN@3Fx~0SFp2}4 zU(Q(D-RV`OQjH51FYm)(y}6;Vwj=b)XIL+6ZT4<$&TX2>=^3+f9ZnvZsm_>E#y_KN z)u~M1VuZ$H@`?WE6FsgeSyNC=pzu7Tbc~~@ShdGY1;3~*>=rF^n$6KXe+d#4Imkqh zD2E-M-{L#&AoygU&Y7dM9c9|`E?s{sUG9(cqvwluUFtJHK=315+^=l+)ct=&_5Ogh zzh|MXB%E{^p)ua3MCY<8am@)${gT>RdpM@PpX3?RRN(Ub_GqWK8&+%;t?FS1FAHZC zBf@o&QxmNw5^SvIo%TuZeBKQQ(b*W=$J+KGaOOf&u}7d zrQn70RWDFY!1JGqkB|UA-x{TR_JXH zd~+NbEjeLt&VFyh(3FfL2>MR{qJMrC8tlkeSCsx~*9@aMt6^+P(-W>8si{qS@H?<+ zuWLv1?{J0|`q0j>XKcfi*Nbz{$D8BU6C0>HHx%0*f3US~qp|{8^iSM91O06=?|nOE zk@ZCQ6ze0*12l@SE_&z__o<$?!3LCmAqi!{S!9}Ut75AN!|_e6ukAbxI^j0;Qz&No zo(*%t3lr_BC(TEFKCxS+=Hr**0P;Do>VH15`w8{hzey6nreQN@?e6LxlT=xNTgPMPn021*V&$0AL>T6 zA~ePAXo@al;l|l(_65-t*Ptmzimvvp4!AEQDA8y8_=MJbtHN0NfRfbQO7RWE5p!jO znGKsUvU$_YX8!ElUbn~0$;dRMJ$tYv7t6lRQp-M&bxzO{O_BJi;zK6XlAeav_1}p4 zHs>VYM|eo=lnD^^kAs8MI`IuP4CX32HH&VGogCB%>hdKzY6of!!lM3Kx5w~|3F`e{ z*uhP}h!DsBeL&xl+n6*zJ`fMRl+RyiR|n=_a|m!^@s9`EffsLjCi7)aAFj80V7XZ> z7m|F}npWe@a_aDydiwjnUQbtES{}1`#;i|twJ3d#!5X*B8`aJ|Nxpm|4G)4w+Ow+l zESz6%*OECl z__5%PQ?W3^xIAEh$zh=QSBjqtf4bnA;_JK;^gZ4=%oTn!#m~`sX=3;|Tk8R5IH3u< z{BI?MQv3OE5GbZGY^S#;7W~nZ5!Ca#YO83Hm}28+|IvV!!@N$k|^+JtH>%oD8(0R8S(ad&yfYYlf zDb6^`jK_G&1%mnTs&#;~;T8ma(aHT(R#%-X7=E4O{iT&DMy^!X9a$+FR)AJ1e zGP%FCJ*hPb&Cwlatc>q+;^kz$!$`|V>-4yH_4Ksv^DmjP9;dX70`~Xh|@o z9EBLfM|vMmVD&0cDC60)yMDOa^1pAS3>q9{#_GCj2Q?Kes z1LuYK;%#`%uq5a!cUZ&EZ$zkP?$OT7?#^`N2A!xyQukE_e=Ocr_KYPTrLF+}W_h^b z$4>V;;;$_i`aW}h{yp-{7XYskt+m7H!*SC0-1N!4b(P2Z&sdOAa{LE|| zZ+b4k=c9%%b1PKq+suWB))WN4y{R$xOqgdT7KXiNn%82*8=7Ghe$R`2tGXXLw(j(A zZC~3q!-b|;xAh-QGn`xx&%pG1BrDQ}4{%I%8Hd+|GKS;Ky+SnH_O;lhYnl;P*zT>{ zpIjGqv|=SqMhRR}laX67ia(bzTGnCf%~jOhiA z=>^95;F)koM)87R3ff*iYtvk6^E5f9;)I6_bM8*SWUW@gY9%^7m@?a3=|i_Dz4?fB zc$cbNY2roiI?!(0u$vw?dT3lz>Y)BDO~r%Kej8~3ST9%xjQ>e!dq+jqd{2e>=YVt8 z^-lLFW7x5L4B%kGT$HOZYx-_iXtxvH1l#+` zE1luoJ0_DboP^gcHzgf#s>AahNSZac-vL)RxnXc^7y7!ZIrV^RN47hh*z9PSQkt9%ttieW&I;jcs#%`QGBfCQCP{Ffm8K4NKWq^>n zGf%eV!>6zt-t~9cAKE>UoN@RSJ6QdP80ytJ+@ji;mu1jLc@}mz5*rgHZ0hg~!Pr|g zx!?Nag@IW=S~FkC*f<~T8goM~J`6UwqIE5tAT-KcEn{CVuk7@abuf+w0aKZXO z(y{ylSUUdBqmC}|B{+-Tc7y}IVq;9|r204`oaH<33?*=_j=s>GwIeld>rPYyH)YG_KS{ zu|A#wFE~+g`D+ZeFDxJ=GJsR&j!e zwYllZMFnb8VfS07%szOz+K;jfY>!0;!xqpya5d(o6#<9)FFzn+8ze~U~o_cPX^`q1!F5}sWH)ej)DeDX{&Be~W9=u!c zL$S|B^yuTIG3?!>*r{U5z%neDX?9+_*U3uj4&V&*a865DV|yS~p|3#k`Y? z*6Ar|#F>osjodnGOva4lz!*Flo%6KoK!O?q0;iL)tO`4DP>+OgP(Vml-3b4%>-#S& zdiGOHz#|IA)Ss03p|!65*FBk^#jTbvyFaxs0-LS#vUCkZFN*YNTKE`MZNiGWBd z{fykpxtILTVq$JwRWNx;(5pt~s^CC9G`FQen6+Valq_zt0#yCc6r=eCF7OBlphzk5{rQ zJ2rJRUFK}NOubKi-e31^zE6F9ws+R#+mCE}|I}NZuf8$iXa|PEa4}{v=KTmh2k^Zs zZ;#q;h{zRbcxdx&fqZ?gW82l3jR9o?!Ty#%IE(=7i@S z+weEv?IQ}FDSjio&6hYL)L9TZc7G$*?8y&@8?!vz$7tNaMoV0<}o1+|+?3 z-V|s4cH=~6_!M5k)^9g5o_iVvO;BHEBsdH;ZJ7m~yL|^<({91}ZpU`DZt2ME#}~K{ z8)M%Xc8z~aM|YC(8+6u2W3-*Jex5a^+>fZ97>nvdVch3$UkDDGy{(#*8#k*H!?VfE+$u*C8 zZCj*udQ*ROXlyucbn0bArvsh=Z>4yOPvLzJ+VzLsfs`gkM^izq=d$+^jAMhJEx5Yb z-MoGRCbAGthnHrSvjyK;LXrN;r)Oz{L# zaAB*8?HShHw)d2*%W!x-yV*2y29E=7cXl*&Aad?#WVo?|I*dPc-?(U{XeaCS9_xzr z!3W$618R+&)tE4Q8=iXR&WFUiigg)}$6s)%HtQMD-TEp+SropdZp?+?zPN$hFdgCx zC*zRJo}PWlFS3I0+`87w^2GB@X#|AbP3c4Mq)~)X&mjmwFTzq??0@pzQt?#M8;|T@1*qK8*wWfpL&dDApSnZl21c>gMuD*HX zs;?jzPHEa5wbC;XVV%Jh#PqH^) z2Dkndd8q^-ujR9pDGfd~H>K&M3TGfK+DHQS-9uxqz$Z>^V^i?p=|b@#abm+zhbQ$6 z*OIf>K<#&_G+$F`F5rZF(1hJ>>DTzKafH${8n%0opXkz;^_=4_F#HCWo5g4ASpe|x9$@uCOah)W49S`T%uqTMD4=Q%w;ZoOAqbv z^gXi;ckeQn%M8L3jLS&R8h*xwIrCFIo&Bv^{U`3?xzgGS^}J~f1I9VuDA&5j;?ffH z2e3e!>pdUuz@hbs>-Bs@Jd&bJ4L-|3ex9KXDbB7h8T+!PqXT3)|OL$h}VwREJ zt>{k!4tCysw6i!8@U{ovG8_#I4t1tB;?vP{oh2&jMe_}xZ?inN?c%po)FHX-!aCz> ze!#&Lp6fgD{a2uSR|hE0b*7>hVfUGzrOuu|+tIzN6Tu8P7C6tUTKAYc&2u=n>kE|e zSfcwM%=2)rrIg2#+tj-@h=J(DLl(zB6q}+||>Am5uv0KDgi!uxq~InHeV>>hT6*svM$hS zaq!;HM&N-6C)n0)?+Bj@Paf9(BtA5|!6;7-<&9YKvytI*$0qwKoClA2(E%{so;%>I zoxFa{ddE3@mUUyN-a88?Ba{1=wa;G;xknp|O}R(n4NLf=aC!hAdYXGx`P?zU^F4RD z@*Uxi+PU+Gr1&Tubojzdq*QzFh*GQijQUxJ^O(SS<74gfcVti5x~b#Y^y}~Gch|D+ z&NS39U!AJ)(l=DTywK_KjkCE4d%%qfZlA9X)LXN88F!uWVp$#4d_wI#7-WTYJN9a_ zF2rNzHSZ&=FT@umeHunmY*e%-Y&hLG|4e;H)3ML|`@F5~xox*_Nrm+dH{ot^s4a`R z_qd^FQ{mhTOy`%46CUbl4m9>t1lc-HofqrkL$tipEzVsST7hJVRh~2R(DXbz0ZQ+f~A zjD%p^D;ckboUqfKX;kIKPvfZ59B9fjDwQf)a??)ZIRe8sco_-Ycu@O;zJkPuZ++MN zenh<;R+F{)wt(wEQ9hfHtO({lxQ+YRI2HZr!?_3Z-1}dy+tMMQnB;K_1v@9~R(T20 z@gmPPVM|9dzEzzz6?K9diD^LT0ZhNxglI6=>tMeF-&nlWV`|*~oTY z$6lUej|D%rQB=e2ZaWA4t%1}|EJsk{N!d##Z0~rs{BG4$mZ0HpM?+bXr^Z~am(kur zdGQ?E^5XC?MxHyv=TI$df!%EvPDOc{?PY|e2R!1gSF77`mL1J|Wqx3lL(Z7@)zdk- zT6Jr#iHD#0|Kre1^VqrZOAYf(GxOF@J4mHd{a06~UtKcRVn(F0YW336>gq-MM7mO# z8L>p0N7j`w6sH%~RISJFnzcCh?;@JgRZFYZSJsr4z$8sg>8ffRFIa67ttQr7KEn{6_hz`+^naC8qrTt4oakS(U9UuU$Ax{N)vZItljulj@GS5Z5&VKUYs@1E;;XGA;o}w)vslTFh z8Be*a^7GWvD!*vHeARLuP}d7<$X1P5oRA6QQhs$jY56MDpha&gRczhezAAD6BlS#W z`d2UWL(cIrw(m?6EalaUBIG7&qPX+`N$v|0&Pq39+PvTOb0sB7k0QMx?1biJSEYM>OQ(Uqk&WvgRz zi0T3+!m4lvX<4uey#aQ5{N>fEeN^CZ#wgWzL!Eev6JD#J_^$+4^7vk@O{;Ysvy#nz zyb5GWk7nA4HvP-h`I}J&QKLVSd~KyVZ@6TUqO7(sp@d3UOa5P3?O$6RgxMa6VY4M& zP#*v~{-O#;v{_~=Z=Ns9bfvX87I@Y2Qvb@;I5pIgkzG!5(Zq`su|-mwTBD^kwGphS zTxDT>u?|UKVOL$gd=;$2p{{}z%U4(7h~1S|(JoGp1SC}~()~ycgHa{^u`&HBSW>d6 zta?#dNfk}e;XvA@D{%U=ffJu;;Vp7+FL!LwR1O#EZK|KA1eaEp;Rx2MV1>~O!6hSk zaISSgT8YMtb8`J0XizCD(c6MGtE*UBdITSD+^RZ=zwp+%eRUDEm1sNELyoGE@y1t5 zm#?lVN6Aa{U^LZ#7kk$|29m7|!aP)L-^)~Gv|7R{FS+UJS~FM~_(BETbah3oWh60M zbW~~sdHUH?O3ZFyPJ767tby9G#;Ey_5g24^R{N_;mzMH0Y(K|}@y5)&83oto=g%mJ zvcXiK_}sn)=SjuKLb*;Jb5{%L1HS4KOj$NwDvaT*_8^&yzNzGHHt^IfP zvSp10$1qh_jv`w^cm#EDZA}^ViM5l;evukGMHWt>x)JLU9a9$mN_5jDGo?06 zo%^*VHO|S)g5?#ZFmi*!>gaSe#lTu5#+0f4*qBJuWX!TfTum)nx+G@g;f%gW9h%;| z!CxrHJWJP{KGkv#P2OD2p%8sX-nN=;dewS=!GZcB(x{EM_EGnz2(g*eSHp5${ZdtVo)zY%nSc}-kpK3pbV2lkMfTN?SxnMPuFH*_- zSm5-PCbr|Lf!Hccv?p@yz?s{xa*4Ug6kSFZ7cweF$1L5DBBSB0Tq&c|np0>r7Yt0) zdd#R|8QSF3bWr$pX66LXF%N?khCHj3nSKm_F#}UHCmW&J8hT}_MnG%7HP@1n^So)? z(5#2r+LAJ5hFMSPwoF8tSe?g+w5ldrFx{zjSJxt1Y9Z2$t))hPslqDzVu`f@!pQR9 zY_RGechhzub%lu`LSQy~5~x;>W$O|(uyb|J(Z>`i@+=fBN;QXxOT_k?B*M`8@MP(+ z>ha2C+6P77kr=M6X@d7*JmTzui9sKW&Q+_G$gn0z$AYeW)mV&at4hkbwlOl?j`;Wl zd}3rJ!`ebkB2)e8YThU*Eg7q(0n8OxdPL?DOLwfq*sB^1`Ak*gxj(X0^GB9yY~Zq# zh<5+jw7T_vUh>E@faMug%Gak{P)%gQwHDZ%-fmTvFJqeydUv&IHRY?!MuQ=A*|PGb z7{}(~v3lu!{+lcf4IQ`Fhv!Q)V>MY;*6{Ipr8);*Y&=IFZ>Rc8Rs%+h@=7Wqm z%_6v5t@cYYIY(722`*isr#KAbm!@C6YFYVmETZuUg|1M;bhL8XOCoUgn-gm_3VL6u ze@Q7ubv|W|S5MbfrI>F^{dVd6D`6fsGPuahjK;GFqlccTSn5u zM}y0%bC;EhOxCrA%+9^6LX19@9OAGKHYSs&-vz! z{JJiZKUtkE&FJNd-#s>ZOJyR)1&g0f(brhqJB>9qdKeS4IF~wgFdE=e7BsE*!=pDq zF4T|Jx%kzB#krIP$!LH}om6SP9}~R+av78|>Rif#qV;}U^ajYKEEqkm?srI$dMsIIlx7y-wx82`iySMYZ%Xn4V^ZlT78bRZi zG%yDDEH0-}YNSh-OIPxg8(ZPiZO7$QC&#K=^@IPEMQ?yy>h#KJkPG~+&SfmM-h#f= zcE8+qUv9f!VY^>xyI*a)xA&iFTYQayZ@waqL)&(#4+ir7BN^ZHy|slh{wf&{b^Por zh)l<*IWoR|6M7to@$3T||7&dgzbXBn9GL#QmLZS#kJ#t~GM;IAsV?5C^e@@?-6!>} z<8QLv=Uawc=GSgZ|F%t@|80xE!SWv|rnjh9$@6HeXyf;qE&dr> z{0Lilif#9^Z2Fs%taCT@wZe9P%qH)7>Ay@xd7t2qIKsvH20rgQZ2WGu$@`}5{!ttK zOE!56ZThOV$#GR0v5#Pm7b6w|PhHzkEI7TaIFiXcM6W>id!o(%SAbcKv8L=Nf za22>5vfQX42F(umwBhQ&SzL5=xERi`u;39GusGzT$h_ne90#AGFgy|dSiv6nEE2=1 z#%l$qz|R$&3ZG>p4fA4AHJ`5v-T*%+xDGyN9?~$~dchU&DW^{Ru;5Dg-w@2QZWmk( zf2Uy9)qcU*@Lv*4UH(ci%f)pk`7eh5mSF1me+j+~{vQRC{!fB8!T&%oW&DTWE$}}P zTn66({gQtnFg}k~cn0tQ!7T4pg8jhb1v9TK!J~k)1*Zc~5}XMBbd5j-81|T@KXe{9$5D}oP3E{4}MEH z%foQ$hUL-pEDtgD#QM|WtUqFwk7dx|ECVrhkYfp_el-nsLCiMA@({lSpY@?>SjWU{ zJ8VNb{B8?gEST-I#1dX6nDtp<39l5)x~&m>H!z(Zui}W2`Sl1_dIk;yD?Q72rTV6f zfvP_OGaYr60?c&R3T8Sw@}$%JpVIt=r{XV5M^%rYAC5Mff;3D!5m?n7J1d+Ymtzr; zY3rUew}M91(P9;>Y}e}ZO;sI%<{W5L9RdFWI0vM9ES*7&@b4pB)ltyoGf%>kT~bF& z%y5tz4q3jcIzqrq(5N~B{wnZd(!f4AT?sDo$DcOLaT2%4H)2|sYJ<0Ac?2!B)XXDH(dVm4s7 zcW{wr2xv|UejYNsM_h&ndXNZyZ70~}(@SlLs6YEDjv^mlYccUE& z{wHWWg1>}tuiz@+6v1}^rwZN;oJPFD%-1jBlakQ>i7U+T2@;-*aE_C@e@&Kf_OEGz z*}rm#W!~r5K{?-oUm*A>{6fK*(A#Z-SEH>K3r+yWkYS|A`eu+|s8fxB3{M13mv9e! zE>jrphku`7c*aHxZV>E+zgch!{Oy8M;j_KzeA@(%g8!6Y=J`XxY4D#H4A1Bk%yOI) zoC$v_?#Xik@Ew8yje7*o04}wJS6cAbELhDc;6t5llJFd)-61#|Se?%b8oC!Gd@}Iw z1s4GG{2X0IpJ3LHUogu!QZUPyYoVVdnC*qn`Q$SSn0raY>A+tV%yzU=FxVK?g4w3- z6P$za$1F5F>xO*hA^dxS3xN*`MsqS=vCtpaG~lVua79|y zMKJpl#}uUpU^f~*G5c1LV6Zpt7F-EjA-D$k-vrkIKPtEuc&FeEz{4?KkY^Zpu3$i8 zzTjiP3kAOhyu(7nF`8+c5zakN;>UrHTWEeI_%OnMEBFQAzgcKL7W@*zlQ>R+51m)= zo4~1pPXJG_&`cEk1j6$Kw*zyG(|m%0w;;S+@K)fB7McdZPa*u9f}aN7Blsln5et2% z;P(*zsU>_^LNwozf=`2HqTs&(&$ZCZ7kmcc+{e~3*IV!w!J9y{-4gyi3x2_Zj|%=f z=wB9`1AI#GdEoPcKLzfe7|oYwk5Pt02p?hzze?~s2p?k!A1AmK;oKM3^4}=nLsK@+bv%bh z%Xy7pFT!b3M~CMKjzf5XCHyObJ0K4o=QTQHrSMA3j~-%K2c}5)lL${Emi68!3I8#| z(}`E&2W|o`^862kXA>7QRMzCHOgs&qW3`EMh-aI4263f{3y9a4cpkCL#T1wPH-kT# zfRQrHq`|Giaqzi4z;KqyE0|>(DHxvl+zJ}TkCpHg_}2?gg+Ea+%RN&tJhc`je?RbC zT*TDJt%9kKC4%9p9aPd}0+&fR^~5C$!>OnH1y6>*MKJaBgy0n&k+mUUWTDFAV=16t3C>3kv7QrR$Ws z&~-{(=sIQjb)B;O4k`>T8<(zM)i%I?KJvw|YNT9A3bQVW=r*GA)#FmPyqM!u`MxN;u2ZESP25Czxe=Rxr!-vS7;chG2MV zjm>;nzrT@imX+mkRN)7X<Z!!I}mKJ~?L z>ik;4EK{yvKYTt$l7?lf70h&x31(g`f~oVz1+(1W6U=fyFPM7n5S#=5KLk?;rvy_6 zE{B=#C}57=l!1Bm7hDK@nP8|_jm4yy2TZ5yj%kRmg8r$Cm_8--#qv99@B_#EbiJe# zS2EPpm97_-jXbC6I%VU9W7!za=a(G8VPKYr;a>&48YemU!KrZ)n02S>5t#C_o>G7* zFL@F(EGU@rZV;RXzfCYaV~=1z{QZJiCN*Ax56kqLglED(Ef}6TUV&x;@LwgIWj!yL z^*99Op*)mJ?Sld50ADBJDZpyK3*mI?IR$tI@J&KPeW<#CPUu)R>gR{h57Rr=GSqCB zj{8i^a+2maX#B+M%y3m-2>&(0SvFn2ESsa&q+xlOw*TeQAJ?1VEDytHA)MtQt_RK` z<|F_|x%KlY%Je9{8%Rk(RoAPQp{+9~Dgfy&~8TzgsZVo)A0={wJ1jwHFGW z)ZZZ19WdpZBA98vESS1nD44qZy5Jn(trq&n1XE{imhe4-ixJ)~nEE>;croyEf~m`w z1yhD!2)+&YSAu5%^V<~ z!4u%qIlgZCESsaw#4H3zeS#-IUgDLaSvZ*p| zRHSAZrCiK|X<05^MwUyJWt>S*o+-dAOMk%(!?32pnUCrVpkY2#0qI#5W<$(;?iS2^ z=LWLGbOslLhnr^fY2B46Xo|BTGSZ3}=Ia zE5zm4q@eju0X)|u?P7)lw*r?5{t<8m@oN0Q)!-t{YY49s{3qb8f=A(bshM~we&AYh zk)H3CpA!6K;6uda_<=i&ORqOxAVxghOSqW!Bk+G+@H<}FD@OQ}z$Ybq9q@a^QrD*? zoOS&d!K`aPa0)v&oNBAUalopr0w)5iwhGL;MmCBb?2S7Fr@+5YFg){}Am~$pH%K_^ zeWPGM{6_@CQ@WxI?*M;G!cW5gwqSV1cLl!*f0y7B@b?LZXYQ$j&uhRxlgLaaN#7$Fp5cVPNHYpJUT``v_bVArH%4$K@HK)b0IPM8(5Q70 za5lo#x(IkOaGual16F&v2%iDGSi%c{)t)WFbAZ1u;q!ohEVvLDb|511yegRW_L|^g z;9m;%1OLH7e_HU}2>-L-#lVKsju z5xfE6HG=Da*9rCmZxOr+c)MUgV~5}l;GKeB0&Ww04ESlmVc_=!0~&u6yao7Ag0}+m zT>|TLJMguF(}D8@Hv_A^T+loYyi&qjfqx_z(0Eqx6Tn9-G_MM7NBC=kp921a;HQC4 z3qAz=q2R;7L*q=@UI3H9fc`Z0a@Ct;d3g)|lG{I|u{enk< z`6$7pr!JT;=`#hBKY~;^akhnivW0${VDirqO#XBn-{@3XfcdUdl?9mZB~@8C@W7?u z((7s^KPO2zB|qp-;bGa2d-8l4m~y6EXO{Ir!SIYm!G8E#1T&w<1hd>~{6SheHRcHZ zA@0eO@*WgSd4DXJeEwZ9b$?VaW$zXY&-k4M|6VZ5@!x{UN9p7t063+SdK0TUMH%VH zm*wSNveJp@O6>z=D-xxX6kzhZnrVQ^@9Tn@*ABtt{T;z6@LL6wH=Vt{rX`4MOU!sJ zoAsSF-*sAL^OKLPfkzQHm}%3AZ^JwTo)d_}X82?YUxRS94w-0%Q@#{nmTRzJma9-O z%f&}K(l8&@1|+STkARtHlh9B`HO?bE6WE9L%CwY4JqJnJFH1P(;=4N1K&7g05Ytsl zIQ4O#V9L8*F!Op)FzdZuupgMtu4ik%;Jap)O|SRJSL@SHEP7Kq6x~uj^5i#@N}ucm zaH?-2{0PExa8H^yfv*Qn0U_mlPcY^DhhRT^?vIm(I?NEvJe7W!3EWHxXZ{6(Df$KBAy4Xmi(o*5-|z4JQ+rthuZ zQzh*M)E(=IeEtN?JW{5b^R9x)$$;Sgjv@)R_m9UeCE-3&)$ z1?U$G-T+)iyc9ohmAFVV2jMk>_X5`n{sZs^!LI=i0#2ERA2?NCz^s=maWNbu_)6Zy ze)tCj!!v#)nDzUt;B@#e35I9<(t_W%;6GTfS{oxT>ie$}PJN#hoC5z7!K~}g1gF7Q z-^d{?b^J2>4)6rvlY+B>9c=#yr&E0jn7U7raPl7|m}KfZ0e~D}^_>9l4B&@^hT&@6 zi0}enwN?aX9sWRQ3W1*$d>il?!DYao2rdTpxT3NR6wErj#}Zy;eRIf z-mm#BH`|%+%Pfy$3x42Iap^uaiWodMf}S!FuLfqDb8wP}W1DkGKg}iv&C8&fESTp6 zLPW#y4gA36;3AC+;WLO?5V!(d3?GVcwkP88z-&*%Jo65o;rJ$g;MAHVM?v$w3^2>> z$CUz%qMP$9um_k+2ZpoU^985CUo4pA4hg27!-DM+H+)YD~y6*E8=(IBEVS7@qO5;B5HnTiF~_e^;_!1JkKzKPfBy1cDI=CQ(^W$Q>q8o*a_&u~S)}QVdl$+tMBzgW?f&e((wud8}WzcOhhnS584qe|! znXaI@t_G&w*v=T92!E_#%APIQ1E13>X;R>?7R+> zn05WUU_bny31<0T70mqAJO!RC-#H1V%%2LT%&JX-hBB))Dllap$2tY3K2+NS&H-k6 z$9DX{F})sJm`3ZLtzVSDYvdK%I%m-is(2~0Gb)N zj~QofRwU*)bBl=!NyC8wt{4~P*?_c*1@8qe6Z}))O5$?-z+H|jg_*$3#6`?=BQwQY9wA8_2!K7Dphj7;WPbJ(B|9=S{1z)WbK$8xv>Ij%=y{s4D zOyDa7PXJcWUkIoE_)QyWsK1*9Gp!mQ5Y9TiRl;+Civ%OeXb@ZgtiE+b;5^_H7Cyff zd^f_?H~^Z(z#mC?3GhD!Q^!81DNhBk+7kmkb)&v@1TF+#AT*TocEPAJqgXKOkWRNT z)&cP^PFn|+A%lzLZ!l@K`~@KJGp)#8#^2&OEka>bMSSufZR|C@p-;}e46 z8BYq%hQD7hWj`R8va9g{`Q`whm+%?%9cEtC?NGs)z#|1y&n%B!pXX2*mPhN8Wgv}z zfQ-+gAJygyO&%;y3NUqYm0y!sV8N74)hWWsW4MHq2lk6rmabe{xxN1SmcF?6LQlSu>QY(68WmE8oW4+2eWtTzX4+NklltNUeNKX2 z*+&fPSmv9BEeRSq@*>;iwGJikDqUbBf9*Sd6( zO!mDJ_sLdUx3U`P-&_Pr#sTBtHr8?jhvjWT)k8YLBCu~T_*LaP-^Q%qaIOeQea zrmQe2`-NYi`}9TMEAxnczX0P{+Fr_|>{Ts_m`1%+nR+o~+*eJB7Wz!lYq_jrtv1wk z=?r>H5mUxeSW{aD^I{b+J&Hj;GJTYkE?K)AW_n?{a?w&tI0y9QG^7Z_T&TMhr4}oE z#(0=KTM2_p5iZf;Uzu-S4ST=kv9V%T=;8>|>YKKq)~8)0T^OspuswLG5gg`>Y=)pe zXO`$QLDgznX1i$4>V;m58CA#^w~cH~YgS0au37b^${8{G#$KRpW?#Cw^qRz)zga6V zrBv>r=(iR#k=q*YqoxJ+Ug z`dU;GTwfY1g0wSb8;iC<#W-n) z=*VaTil&!2wz{TNC(*h6YpJ9;|7(eC165=NsZ5ibE3rPi*CmK;Y?qaaQdUH&iv`b|#SDR;zcH|gR zSgPyID6~}sAz>G=+Ksl7tcGpBl~l2^iAbx`)>sh-M#^D9c2TghvZ8z`Y~0b7K25bM zqn3TsN84)e)U@WRtzGuPkR)Q-un!99r7KF7K~I%56RO6km|~EN*Z{s*TBKSH!?#gk zX)4%C#)&U7meLC13S&Gh`<9NM^_APlVTfCb``(^?dNF~lt&NHiO?KqV+hPLM~rt~%80O*p!S9dQ@HjOqvd>1 zP-bN#d~F13WPk-))!Skzqq@;rH=8wx#Y}#LX_VB|O`n9zs!B^^Qt8#sMG)t5&aE1dS}hF&4VC%-5b^9+ndTE;$G#HHykH6?#8>zKwCq1L5Z z3ahZIm&O#*Yze0E?wCVoFxV}Jadw^5UJ>RI6QZL<)s>}7E!KO@WeJYO8ILtA?Bv5= zzf$?Ks2V@dH2FMU8PT^qGW0USTgTAxS=m#dR(a5>9Ai@3K(;AdGK$ zx$!R!TdB&;0wBhxg34u!uRZQV(s`0DrrT;psb5W(06O9viMt!`re+|6THI3}#&Hkx zt$wlmUP2gc{%NQAy$L!izgF&z;#~>(ao<$)n=bMpO1ayFMs5`y@l7`Qp1^)=naG!b zc+Kxayd1OYj`5q|4z{AwYPKC6&2YWb>c{7x*yx6f!iUugu0TJBW8C z5QO~L{58K@piHZLeh8nVIGI11-yF~p>$r*~=JyliHwc&JH^#zQn!KL|qipFi__c-{`=CF2J zzK=j><=0wb7=F-^-!NR7-vwKJ97AQz)69g9x94s3(NSuCD^GrWkD>YfhmBv#K>RPW z7x`Yb@w$M@k@`QAih;=3R1G`}MVu*!F`+to(|>kFrp{vA7sV zem}AC+W>yAAzVAs(f!!Q?=<+mhj8-Cz@_R0wgA(xLH`wHN z11`-k#m4V$3_hc^P(laKxZK9?%qoocE|cFR3%_dNr@PoD3>GuUK%8d1%Es^MDzjZt zzA3o0eA&puS|7*2uebKX|M@UY4lcS4)lvQ3h7TbXI* z;HTSPuF$bPe+A{R%6AC-_zqt?E#GWgc{A6VcKcY~JX~5ne*13acLx0UJ->FEAHSm^ z&XI_x!S6j_@|%fE^ZS;qJ~jnUa6-r1=WYB>g5M#8Q@)#V zY56_?Gb=w%E}Iaq9qH&!gNQhXH*nk6N9W&LaIg9C+e$0HP2e|OGZ8wb=YKV<{2s@L zIIly`lyAP!vHksQKrFvwV|!l@{SuV#?OBZ=F48{x538m?tjB` zfXH{dg9CBH?uw0s+F{CIQ%zwy$JbaWeR{EmSi zdGQM3()_vrtnzIDKZqD{nqMaXagM~~JQVG}OA*F6mY4QGt^A$>zh@;4J<`!_2O!Sj z4cvC{>wr)BN^voc{H}_R}zGm>lkQH%S zzE^GhD#4HQD&<>)OUw7p6(&DagL0kVch^9C-#2gM#Gb^K7PF$Cxjnxp5#ICzN_LF=9-6o@7{3=e??(T<9x); zH;-ArLmjhT=5*g~ln2Vr>69ye1k{-2yEpNH{_UfIk;3=3Bb3xH-))#@lJ9QP{1E4f z@0!6g-;>`RJ*<25&`@VuW3bV2!1-dr@wjjn2#W4?hu3Ug*Pa~u`329%FD5ih@uv;O z(db*lt>MJhL?i7t^=>0`Fpja9HrO3!q}|cwG}0zF42|;)&c}>1cxC@~=SDo{L5$7L zu=CyYjPCSnqS?458{Zt`o+S4O19>g0dL;l!4WoPaFHf=9VHSINcE#fD9T^P`Q%W*h zn(`c;_yu{!gvUDCUj64YJv~qV+}m+1_h??+&fjz&|Lo}(%`@S73Ves00v}&@AaWwS zYxBOtx%>LJ2O5)Ff-MeF%e%-73OnGu;6i@m;)kD!t)>6DyNT9w*n>SizByWk%UIxq zlc=hJ(4NQHo*=p#swu9}6vIZC0;sw!~KPM+x^IUrR$H7qg*v9#dS)opEW1ulPoYm;?3{dG_M5976ijw+;b2l%$+3lH# zKGXd~G7{_fc*IZG)X{Y8vt1ZI_IX>|bKCNax|ZbD7XQ}fT(qx7@auje)tW}Ni_D$i zfz+W9-q4Bu&520Rl6WAYE73R~JiR7t6KJ^3kOKLp8sn0NpP^9sKettx6K$e4(u;j} zI@`yX`FNaAEB80Xg%Z{`qJ?fa$42nSKZ%GrhY~~ zdiB&NzwPi0X>Cak;87+!t`GLo;jH3%shfNc`(li<;AIX;Pnh?*|s(859PV; z+I@6)+!{2>1apADdjNE3W;5CwPH)=nYM7GxwcVcnM|Zm-G%GdD*v`zKY=rrWT@W48 zHl65yxL@n{{rmdeIkIWb>pN@DC-}ae)U@Z#oyDO+Mkwe-FH>W4Tb@}Rs?6cDV-7pJ zsttd*qiK+_qGiWnXMUwjH*K>(c)%U*LC3x{EnYk5@SE=pf^8!iu(ys?${sG7iLrMbv2bThY)Juez2wlDFLy&C!#%c|q76 zuJx27r}Q^!&-&gU(A;^)bI$w%qp+dlLrkFg#=?zenRX3V2~YM@n%Fz7WzEj!?jc6g z@%KNR;;b(<(%#zf9cTSgBkg_o?lnf!4?bxL?)=XDo}R)M@2;Mn9Y1lp?>3s!2NkV1 z!tSQ@k-pi3LPLxIM)+g@m9d^Z4wcuE+tk|A5@>3Dr6rlSS%vN1!}E{#59hK9Uiqv$ z)hK$~flLbrA6*w6}fD{+8~A#`kNhg30S;b+BvMDRYiNQ}z7dA1rwY!s(9Q%VHUEb=+Y+w1FGAQ7TqTyc zdo5V#oQ90Q-?7C#Blkzd=YJEGd#I=9n}YwU!z7B{tvU=f`eoqj_5IGCo{u#adcOO# zx^GzS3k7>EX}&69%Pe#%eN%J}`7IVl+RYSv2EIOLY@USGi0=Xa^@6L!e+Ygft~kVD zZZ>w{8tZ%tPf&1p-lF>*--Sn#8Xq{g0r_@l+ohCc<@uW!a9 z79O%z0?(89&nx?oc8iZKX&GyRRhmA%_k*~6FFm58)vLc@(el< z53nTYTM!)77EIX}2n7Z;CWit(J-_amD_uE3t%Md19)5;nkU9PojhI|EI7=-ia3*Au zr>4Hpp<}HPX@~OXL?Xr|6&=jB#(EBQO?P-)*9B9q3tr(F-HG+rlW$@?JKNJUpIN== zJ{gZCU14`89~#s>2ftlCJw+q(rU$OboZN88nQu521d|s8QbO?~=7yVI`mcs5&itv4 zl}X)u<}U~&cYSPNWe4-wJw2y-dMI+jNtY2CFMVt{(RU)fY;ZuS!3i~_-B!QXSTM%x$>{9q zc>|`qq8WM~KH532+Z@J4g$Jh|3=H(7JvYr+|G$h8fh$5zqsi&0+m~E-ufMLIi;-=Z zU<$mUUwk%eva_q0Bfcs}*MG8Br6yu(<>-}AuUdPlT6xp`XA5P~yJ;H{rzem}YQbx& zMTN_PH%e2~JtU^KQu2ReplDi`xk`pO%&Zp`ZTf^0fAkD#y4i6ZN*JCr+37xHGzGoU zLbfE=wfNhdPGf)aL8q(k7YF`oUDyFdw4V2$TbX9A z9fHZG%qU2l(H%$*jZ1@`u;8oTU`|4eR^^N{0(gD?U8@QXdSXhny{nBS`aj*h3wTu3 z)jxb@CYf9qHNiMU!1fGs2@)_MLPWF)Vu*kWh=_{9kOUG8BqX7L;@f1zFp0Em(Ml_+eZ^ZPRI9f7zCvw91@rxW`>Z{4a+08Z{{QFszUSLdPR{SF zv-a9+uYEn|>{%OyrQ(d0+Tr8#9;zFk0G22E=baHTmGvGZ?j+~g_f-#A;&_v!mqWYmRQX z*W*jAIqExm)ALEb#0Lkv*8OcSdg1v`X1c2{b-moWYxCAdcElr+YWD06`u82&hZi^5 zc#pPoE{X-_L`lS8V(2z}X`!GRX*zaZi(3|bWGC*7jt$4{jZdKdEVK|F9tXO;d9HBl zyhHBL&gS|(wYx^mNsj@;v$5(m%aouWkLVY-GM$x5*vZ&%C*n?V51D^3^y0hdJ*)pD z^W~jqB2TJ&kGSfB$uA$=*LeMAWC9PHqvmMox{px2`#RP17Pu~u zR9oXq+!gQNIj&~quBz#wQ6HgG8rk~so>@QHU*E~W=mFP^e|_;=w|BSev!Cp*i*=)0 zYl`(4PbF{qnTfYIuWe02--r&ZZM*BsqoG)%F1Fh!@LFz?@2-QoF7iDNMx`VFU4>5) z=zfMq8=1<52gB3iwDbTT`F6hE5lDLL&i14G!~181>ksY?BtxCHKe+xq+Fku;S12~7 zE;g3qO|4nkoQ&@G(XB~M2fpD$S_NNuipfbwU4D*Ch!* zTO5gis?2tQZqjXB)H$g-^XP`h+|`SX%DeYB1(LQ*a#t@jiVjXe?a7_?m^}rI)mdC59m+t44mGGt}kld6uaNZ3@C~c5G zo^vUft}c)a>lO_P6%F(a1Zh|6v+NK24`uOU&$BTHc-a(4Uc78jcu#2Az)<3vx`tzT zCJs$svur)p^|_#Kb1SrMOK=SdCXY%R0qS&@*_*D-jSYoKOYt&jifeJuU(|h^AmipERL$W z&8Y(S{_LAMfiwM=pEV_zTo*_=G9qcvms1i9|J-x>-H8_N4MxV{>JyR3-uiEvUL1%% z&bJPA6|(0&WQ1Y^zL98d-u>v*>W}))%)qOH%;fOMx(8zLHp7c|Ll1arrj1*g?i;0Y zbRhO!_4f3J(Q^XH_tj?l+!F`7E^%LUbohC0?=#=D9kP<^*g2=u(YK(UwEe;8*l`3V z*c~?oW{NRF?qU9qhAP{1?D$yS0M+*}c&*gf?cEg9Hq=0$y}AC1`h=}%9fAJO1Q^3LQYlee9v)hgz>%!WVWM>0kd(M*1rTw6#ZVw>x6HoR5d6qrXvQ z)3I|Q^1C|@RCJ^>ZwX-9bGNazb4sK?M%f<;CLxPT?=O!cW2ml%fjL7w=RT_QMA!M% zFr?9PRQ2XZ0!hb@PVcJkyy4|9o^j{o7@uw2zhQ#gJJlF<^|WW))pr^p-QM{^~v?5=AsI&dxOOLy& z|Iig~JRTq3YR-J`DU%g?(OSk&|zSPi^VL4}7g#;Ztt-6hV@k)4zsr$kC}g zDj(bGhO=WE(d+;CB>uPEb#ioK&W#cEI`w=`Pu-XgHSx=-h$!Bv#C!Ngv~7h&?bz{! zqFU7$iQ3y?&ShP`8>>VopS$gLiPLajn=fL2L_aDv_WqY<*j9~3O>=cL{Jae>*jZK` z4UHCW+me&vJtr|fT2I?n|7Vpss#3Uh!#!^Ac)R?Z3C7y0%nw874)(_nZ$1}g#45Kf z8DC}U+D{JlqJFKZ+VX_kTh20W?CNUR+EAZ>&(h0d+g2Di%(0co#nfqM8WdSuwL4Bt zl)|mk({7I)@f){ys9|o|A8y=w5FKHgiN4Cft5H0a8funcJ(6y1-87%&jTZ><#+8Z9 zRqfNE&$BV_`lwT)HGX#NY(NTYkiyAW%d$Clq2`9;(-Zh+w#DOYBi=feq*b3cMhdm9 z#)2I?*LSM&T~k&4;5V3)o@YI+FV4jy;F-?_QhaYi2d00XQGNJ?_k$BwRaMX6)B*;Q z`akgGs8G$ya8)?IzA&8N&oyRjy{`UW^^MJ&A53-CZ{BpbiP3IrlK*YkaCu6NaF}!kh%h2#jzE#Nd zTlHb*Z^SZUm&?1-z16W&S$00=eX(n@7oTJXqwh0(-pzamU@qpU8)~emJ-3_P^w5hh z8hDZO{H=JGvpASi6o|gdK{?%Z$oDIpcE>#HKHxom5Jtl2Jj7#r4#Hh%%yH+wW8NkG zD{Rj?%~c^-4*j;fZGf@(vb9PP-^D>x*@$fq;AOAmmfg^sDBwEJ8dR3hWteqzZTcw5 zHv|0#b%;|FlkkVWgt}Z;00V~GP*u13@e=_owW!J*kPR*miVAO2p4jaLz~j*3Z+Twz zSfyJupsndd_+Y60r0=W^zq#qgP|d*&6NBM{l^gcgxjjwpm`Y5!Z!;^m@FQz;Yr_>u z(=w+_kV5>I2(i8Y}96%3wJ!oH6+bdpK?MA5yxX-&*mzXQ~!{d#;z{3 zqBiuEXB-Rqzm%^KDh^w{iZ$fdb>PV<;eg1zyixs$p1{1*_VG8;e~gOCop;2Al-ju% zMp6pG&D<1Dbas2&&NkA<0|^z72QC2(~o7(9AjT_27%`wCb%V)r;T% zAN<3*j5Ymdv!B3>a(N;;f>@(y_C?vd#_kG)v$4ivwyqX<6Jm|i?vu34Mg7%>czjFx zvAZrU3Ew0zm-*OLe;m(lO(O^TC%Nhp)`a83YbtA!)QovVs>^4^(Pra!sD7}kdhMXk zcw7h{s~eJJO~bi(LVfcv%q)Cc`hkvWoo(M(y5F#_?B8kheWZE2d+~@Q)P>sWa6J3^ zFu&t&I4^bHA?tl_$AiV4(PKFE3?@=Nej>lW= z_Q7?CtL@1=(N^gFkGQS2@Zcug_nyvusIZ(0vH1G1ZiW1Rp#*vNMy}}Hjv{Cdtup2 z-OkC|>g&!nR(5p_{`;0ma~csfA*-Qbvu_YTw*KAIlr|rVL3#hJ?mc|=!&qezZkO3f zLn|}^2`h=1$?7=D^~IGH&c}%FPjEH;>g$KLHgX!3)CgCA`yLq`*UL%|IL))Z+nn<2 z4U)lHsGHmq$NvZ`etc(d*tdFA-qP{6FT(O4d{8e~mKQPfS}?^KglL{rnb$V<;y)nloboai%~I9*gc%3J|{{dN>h#1;`czGo7v zIzDmyg_8Htk=J`%M8kC`+cHPpF)j5vtBN#K*yaNLuziiI zKCWqG+O9y|$dOxNZA zC#8qK*2RTgmU*{dqh$nG?qL_+HP>HJmypoN_F-<=I-)(fB~Yc(QN7C)_7JFC+n02T zUaE(P$h)Z%oz7cbQZSVe)6=*@=}}IVT!J3$Cs1A!8rgO+x0r)vFRP5Odk&VpT$r3u zv48Dm)p}5W8#f@yD%IRs>n7qkdYFM%*;T9YzUN#cgl34x95h4QV-99}D>ogN@@m{@ z2^bmJ?fx=YlMEq)|GM~BUuUa#fj(6}*`Z(GS~IrkEaSloh8c-jX65GkDs<=mLat?v zQ;TcDV>b-U#^R#p+4aFK^%IxX)~^J|sB5QXzT{0rZ{?}}N~Q>nwXhv)Je5|(x>Clw zwtiT87Qz^ZUNBsjYBUG8Y#U`6ym2qIEDT_+6BSJVdZiWL>H;v;#x-8L*3U*|{Eq#Z z8q+GzRcj#ddoE}HEcL$>OFMn3TUrXE_5Sx}<^8Ppd$2TiS5n7_q$4{g|NY%#=NJ$E za?#*-AAHvBHTek%c6#l#%~%fOPo)i^^~pqQ5NbS%yy*Hk>aj;(*iTciFXJdI`TYxc zoOQp=i&EUBm&bfaDH1XLu7K1>>D+K*!{7~}UwvI$^Jq9}Grl6?OToKc0oA>6Z3Dx5 z&b1V_I{7~Cxw0y)br0Y@DZH@~*Q%Qkye*6sdhsXYrd{A}OEYQ$YsZcZ`Z8-~BPm~Q zO*Sj!NUjI1pUpS)!;KkvOF- zy$5pXXz^cR$D_;FmY=Wb#YKzDf@N#ZkNUT;ym*X(KZ{$6O3m&*N6m=8qjF1N6DqKXQ#P>$vD z!YnQ-uP_`6h^M5Yg7V%|a6}*DjBkl9H;Ps$k2|LFo0 z3e1WUvm8DhFE&+KMhefNg~jY3N{NY}-lI;^bXqHpt~g<#}TYjflS|tF}%;bv4t5m5($>U#g*T31GR+1&#Kx z)6GNPWVFn3GmZa78oBf~I;WtbZ0($am8%NS)UHu}?-bq8PUcJ-(bV3FA~$=;h_GC_ zs<@)4w79^`oinH0)DetpSHP`WL0$!_0&bW^E6iSvImSTN%UMf`R=~xaNynOG?v}-G z^_gjumIoK+BWGnLYguFL<_VUSJKP6ama;l5!+w#jTP3vb(HPB=CFb0j*Nkz*fET>{ zlI7;&wH4^7bYEk0sFXG=WBi(tCcNtgmlwd-wIh07VF}u;X^Sw4#fCU0N}Xm{9LzV1 z3zi1+)}pO1M<)q$m8^jID+){UyGe^SjBfQq8Nh1Y^kQc$DOt55zt0Z3FVl7Joo#|5 zt+zayeh(oLCKb^(1SvmnuPVTC2Diu27C1xU&)gww@>6^7=t)f5wM z>y*vQ;3U(8(?T?+#Rd6v@Wou&d>%&3e~KdN>1jEl^U|`CRi&(!`7oGP1TtkLKyyVC zkKB+J6}gWge^r@j$r!dO-K;1qD2iSi?0~JC^a_hEuNZSx{P7u$87G5u#nL)kn}7c$8|SnMF%ilyC|-k}a^LEZ;1L!$i#9Fr|y~nR&q#ERw|q z=Bjcq!z_j7^57bCNm+0y-9)21Q>`PSgmL)_52mMb*R)< ziCIlG;;TGjqr9k3LySb$SQjx-Z#V6gLHQd*V@1AWx45}3E`rz5BGp%|G8{BC zgS>)*{Bm<527K3zv+uDcAw=omcuntbN9VlEt)G48^Q%yAcujHV@MO62VV zf75WZ+q*K4;V~ZL56%&;z~MIf8CStS0>fAwZtOk90pw90gQ6r4>w_(Ll*gVZ z!Gro>4<6-#Cra_qvys#vQt^`{;~Ds~(Sg_ccVeXR`X>(lA4+|xM}6pz_BfM_63Bnh z*5r8I3_gZf#eb$TN7_GWy#JxpCw-k^YvR2Bo`YZi{z~(2cIe+}YvPPQ&`VD2JqbDe z;grjiE`rJS$Lgb0NB%B!q*v^a|BmDOuOgpmFg^S4|9H(k;dS8kAV+=&oT2Yp@#oln zBSrqp9O<2O==X3mx=R0V@=ljz#?NusBh?`fZH zzhC+veO>3U$23R$EXVaKhdrh`;{U^;&tcmT!1Q-I%6FMVKKEkRf&96S_{Svu&(C6g z8EQQ5;J-#k#+mV39P$$!?ZNIdjQo|3{QTN+eZX4S@O>b^`cWtIwN`sIQt zbB|yX=fi@Trxf&8l*71cPds4e?*~Fp2d=X5Y!J+R*9vC78C)pCcW|aG;@{(}>@Qf^ zANV!UnK$wftFi!o23VB^a4WDX3*a_j69@UEOsac~sd!pOe6am}`HF7!+z7Co7FS2q43u$iS$Fv1WV z#7v(vA7b9(T$PwA-5{8HtrSe1R|}>tw+f~%8wHyr+ z4$y}Ziw#v;$si!8@&#s^xj0gQsY8)qroTZj)BlBFroUY<(|=Gf)88kUJiilc;{2Ro z>cZg4vCd4JdNMF=;=RyW2lxPEWzc#bBSpfgatTUC>PoxpZE&=Lny?-xc7sCV`rfpO|4?1l#Q|Q#EOfYS($_qTS*-wQ|Irj)= z89ipBw+J?IenIe1oIe-LxL*mTUD;NtTRP6?!0uX4wpC)aDreK$GL)M0iQ2;F0k6q9Q^Zv9~C2E^s|8c%oi_S2f)|1QieQ%AJ2w6g1?PkQ zm0+gJiokSP*L;F$+Zw^-`KjPy;5xx9BL-K%I+IVgHJ{)!Fz8T^Zu1;w3W0Tn{BI$m zDR?pXSr1%S;vWL_AkUqkX9?a1%yJ_ARbYzK{m&wyzXf_e@m2VTz`VJxR?uokSr%s5 zP|i2tuOyye(ZfPN1M}RC#M19=BA#sV+)s?WvmCb*L(W9-HxtjoKZHkc=zYr{CkD?f z@H``UHSi0>@(B5w&_9jC9^HaRLAQ5^ufacr!#F5sGs^IN!G8n(MDX9ie?st9VEmj= z@$;F)M?4od5xDobi-Rpfs_=CAP%gxDQixy@UuWSo;rTsy(uvs+5XK9A5$J52uInv& z7BL4#gk0gd4?Ntrociwuo=beA#WSCHfrS?l-(=x@;+rj8OpLhaU{X;^ywIYr5&CtY zuNPbcyisro@I8Xtfg1$B58NzxJMas{i!7P13Vl81BCit%E&4k`{}=cV6EC*t9}(wS z_%q=dh&+ByoNv)j2t5<@c=QR(3;oj2*Df)i<5C4*h;&WCHvmr-Tmn2*FxMaD5*JwV zXA&>5F!x%g%uV3W7yK9CLgI5Ro(iE40DX<%#2Cw8EaN5tR|@?q;Pu2yt+-)gHY|jV z!gB+7HVIx0e2?I5z#PLUa}RI>ai$e_JMnoIZWf;NW6^d5&jeCOb-Uox(WYJ%JOubP;$@bc*NJbj@FC%O1#;dI{1xzF!Ksk>iQs#H zKO<&Gh44A?I13*a9`$UA_DTI`fFHjgG+Y@LPrT5Vf$k$7W6_g{(=D7LJQ?6gB`&t; z+zW*=C&Qj5ahgRRN<7@cX~MG;`lk!#vu%dpewBklcowjjPrEC@8f)>;3S;cyvgr_9GY9lU8{LOzr#ka6PyluqmBNQV5n*A7tA{Q zyx?`fZGxFDpZS><)jlGabvXrcNv9n8fhNwtSv_w8j|WzB4`9k+zek=-ocSJ?nEl-4 zg0pa5DVR37Q!wR+1^bZhU4oN-nDGV#NJGFw5$w;6*qa z%o~JIhcg5Z27Rz#6L^$h>NZC3P|(K;W?sh&-Uyy7!7RJ01ylYa!IYCHI39S3<_9hk zOdGBh%sl>1FsnD)m(Jr6!5N@`Ab33RKLxY9_{PTXLjD=|IOuFs#3z8+j))ED++Q%q zkbq$7KTa_9zff=?c-R&gw;1?h!PNh9!5nku31-~u1y_K+KrqLmg@S3r3LF1w!Rx@I z=5e2a}|h2T{1 zuN2I*Dg>Lr|0S4dRS9NVKNifiHfap|-z_*E_?LoN7LVHSA;E`1|BK-Ffjb4WPU3f# zR+&QQp@JWW%<~0vo-$tWOyJ7|Q=gfFH-f&&M!!$+BcN{;JQMtT1V0Ko){v`o9|!(W za4~p}3#R;U1n&pWK+HL`%}v3y;kkl2K4%CX3i<_tX~TJfDf4>4?AI3vHh~ukrk=M5 zrXBuUa5{M26#N3{9|_I?{hxv<|KEZ$LH|k82Dbn8-e%Q_z^oi7ScUaa0B9|3TEB7Qt;=9`$NIB;X1)=3qKOv4E~LR zhk|~u;7y=63ufG33BCvP7QywvPYX^1&pU#dE`4WG=XXF4_$+)Fc!c2hf%$Bv^L4Rc z12QkO(YYRgJoCYSmF9u`*@Btw5*t7LE|R|ma@God1~_cvxl8aS$k{CT9^iWf&xFhd z!K_Qog6qNa8^Oh(|64HYsvFPzO!sl{EEBvRc)4Kq1Gfuq2j+Vgo%gWdL!jR!m~+x? zf)4{fB$(};d(!B*t%6?zy-o1zz@ON7{#WoLp!dUj5FPh)!5=~YWWk>R4;K6xF!x2& z{M;Lccqr_dC792Y*VuUG2~Gq3W*eRR*)VP?Wd2Yv>*`N!JogIbGv&jA+ku}J%)aQi zf?4jrx6%J#qrWGZ&ut$Fu7sRpf?1#cCHPUuJg)gc|5|V}=&^VhQ~3owUNF<;H*IZ` zfr9S`|2cvifQJdD4M*GfFVOtZCrdE%b(vtw=N?*=UkIL{VCr0K!zF?%Kra)_cD+il z2^_NV|Ja7>ZTJ_08MjgJRHVDt#`7D&??cb01hY?j)yDHj!JmNMA^0=k_XTf)d`_a7 zFV4L^g6{_o2xcBf2!0hh+$?x5=t~4|0`RXeW*?Y20U0WZIUne zb;!9*F!NO<_z>tnx6vOE{0`_(+30^1d=KJw+UV~KZUFs5!P|jP?{DeZ41AX0M}W^0 zOdUoGeiS%E@Z-Q22;K;Mxs5+p@av$@5PS%@z{XQ3xCQiE1V00OpWyw#TLr%W{E*;w z;1kejj)O-n;9vm@N1(>^5C6`|Y6M_dzeR@mJXJ?Sel7&s~Dq zw{H?mea=p?(&F>+B*A>oG)pk;IZv2()zjJ&w(Eh{2B1?ZTtrX zvuz$0%=cKI3TA)UW#f;<$7$Mx{DTEkw-Gj+DVX(ny5OOZGgmNWuCVb}2k!#=@$Z-FLjxJ<+NGce4dFrOt;1(VKp?lSS719rg4aN!^6Lk08w5cA+NEqc0O zz8}gEO#bnL`TihNa2R;9V7{x%5={Q7Hk@n2GX+;7-B~vJT)}lX&lk-1f(ry^L7zo} zDL>za3vIaAhD!zCjJOqo*~hFA%)NTo*>I)c1E8uvn^+xQy1ZU#hDR?r@{}4=>M+Il$OuM+s@ehGIxhfR2`kz%6W`0~hw6IBxa$%q?h`C=M z^RLSq(^w;g#zyetAZ8h{3KBET3j{Mw>PkBE!m38hG%puy;ygnz)4WPB(_A4q9%rh~ zxXdGi){|)y^BXkzi20p`e7bI{yh|NZ`32ADIH~8d_Je8bZ_O&dSA&4S@^EDlNq>vD zmm;pp?C_6w$+*{sRlR~tWYJn<1I)ZO z3J>%8uwdH%SAv=EX9VM9t+7Ge4B!`q&bWURJRWC;Q`wg9t{A5`+p>)HcRg+AO7JV& z!ftm1tF}DavYWCYFavc;0Vc1iKfp{UOXxTmIf7}2D+JRHGX;~MpS>xEcHk#xVupMi z#MEo4VDhuuBHhGU)iGe&jp0;wP~ZE=BmF1i=zdJ+eLwPRlAeHn2-*&BfS!(P7YPW= zyNe1VunhFN&@5uu&4o-(C1zzo$i+eW2+)~#-8N?loof%6?UeH^J6|XmC#wyDP90Uf z1*RP+ll&&ms;&Z4mm;BO;`}4QI2m^ej=?!B80r{z38qX{harbq`?=6@vie5Qnf={D zPs909!L;Qwf@!DM1ZUvfDHtc?L&39f{$Ig!asEc|WSslCtbEaa>iZzlWiW-#e56X!VE5Hcx;zs(`e1Rf-qW%ND4Ch#c1 zfGTL4Gd{7spXYaZW&cyO!3SV0=F_#tlE<`_9MGAzixXo6Ou38{bUe(9Y8Svmfmu|f zQ^s|IaZ>BBNvFI;IEbmsa>0~+n_!%bD#6Uhdcjb^T8}4jHw&G1R_z6J1~r!erfqlP z&}ls?*u?oU!7LZGt`ht#(*r_hnX2#Upr-+AdjeWE6x%Xw+K20=C`tST)nDT6;@Vh*PKE7k{rgRDKu= zgJlIaE&8gMz47)c)aLl))T-JTyO{@Gl@=~Rp%%kF`0;+X=D)O{VqwJDgXIb$udJxF zqW7jq?x@SDg>?FmhacZ-?w(ogI|6<&PfrTnl(Cwga->kQuxLe5uXo`=W>rN2+!6Hg zyKtTL{DQ@+mZI4ft*8JqRCE}(Fj#KSi~M%|6g8)>U#OqDP);37>7+Gw_U@K%C~+#I zehl9|sqY@IC+D|1B!c~|AK8Di^rjdl8qE zSLl%qO}@_owba39R~=On?E^k1R+OtYv=H8H7E+jat+zs#1d!h2^DoQ=KZ3R8)9p&{1?x@Snx% zbL@%g*Da|&TF;UqcoTwKmxcBQ)Xl&$Eh#QS4`j73dsd_E&|cbh7f*fKxz7l8Ls+Sc z?}%=CDF-gS-EcIsZjq$6C_hwi{-WGUvFTbZ(m;!Vx0-G-;KpNNVY#Y&Xq)gGly?g{ z({3y!aJjKu*|4{}lB9ISaPL%Hlm}-V@X?`aKk9vVY2EpwrP(_-8-{k&(uY8@h(n@2 zIIJWKZ^>T*Ta?1Z8QK~8l-|o(dKHdVbZgYTn~hcn2b;Z2sSr%c*mg1pON_7Vmtdc~ z9`~7Iq^RiN1c}4*P{EjKS6w?Aaq^<#?Bf}_jc&a>N z%jW6JZg;zZqIH25RGqlP{NKiHzi-(=_v5z5j&Ax{T+#<&?1+VEL>7nvYbw?@Nn8qM_XmEcx?Ccl&_#} z>{cNum#mz=m952pREP)263mm9$KM>-T^+Q%ZD6v?`wYU0!9@L%acFrrJLD~byjUh6LCd?|A#VYU z%=dbfcP0)kZw-ve=(^q);s))igO*ngKH@C7aUAkk4=C>}99rI7hr9~hkk8#Jrj~cL zLtfH!>pd{#4Y0`@7vEjKM%l~MgK%hh$uOMVevhCrR^q-6TAmMl#94A9bq3zgA|mCTgG0-E2l4Il z(h-lofppOD4e;6JrO(9oB-B;P`#ugWZy*|1^(IX@)6|my|WHl-ZAhIXUUC2MbUmE4K&`PyjLCajziuh z5{D-(?eBhbJv>wnN@5n>>8ti^$vNsDJlE-ppR)-3vaueua?N3_jKa zj`v!>Vu!qsAkRgGC20MYI^-qYV*Q?)^6+UUBJUn_{`UNSf=ZIEg$W-oe+oXkev68u z;}JetMC6q?M;ZkP8s)4)AD}pkoP&{>H6{mo4nyr&aU6Ak=A#2EmF%1 zfQdLuZrooIoeyP$#(T8iQ5<%8&5)N(f&?w^6I|QnEx^QX7Wint%j6#AEpe2`C+GyS zK-WRb3p&c>o*kZ$4)>F`&RmPh9=SJ>p;=aAP7d2i#s4m!VF$7k1XBjkMsChCWwGm>BaUfW(C>qlE_IGpkt z!DpAZt|F@6l{R_h4ted6$M5MnX#My*KfAn-AW!RewN2g=m<%%dI1%vYF<5Vau}}xz z<8dh}1J9_|Dl9~!h!e~c?=cjJy#Cguu>^dkV4fJCSTa*do$E!Qz#*H6mQ5Gfs=<=C4E|*S` zvTu&0&otj*g+myx{->e-MR^s;@oz$QWPddOL~Gx<^mjY0{dcS#()Orr)S`RosIBlE zQf!wsw!Oc6+(;4of^*+8>^(Qfl0Wktksl|ULxn~J1{ZCqPYsRueqFq=rw~J%SE!bDF;QBvaa;U%`Gw*aauH#yjzznA_vM z=NS{nuj1ZC1GYT5eAL}r#+Pq;eSee3c+TUhd?vZ!X|wX-XG~5x5vmp|v(6yWPojhu#RYugyDl7q` zA#P9fZ*coY1<6?l&fVC>mTZGM8t<060Ln=kDJPLzfrWGT#wR@2nmO~dBdz1B7{QVf z=UULORcs0hEsD)zgWuCzN;a|tji?rm?JbO?tnXKHgzEO)q6x zX7KY!d#=_r*SGTpK4?Y|RH%n8p-wd^`X=-1*w>7i95u`(Ve1qP2df63K?X4l7 z+G)(EcN#lxLQv_|N!-D##i)xvW69aEb!q;2*Bf=i0{)j>p|cHtp{u#^$SaFSZ7mHa zO-s!gwF|_bC(b)A`@OQDf6a}Zk;5M+&T7uSDIR5j3;!@<-ZB?(ePeA6l-Mxg zzEE>4U~`hMV0ogoqg`Vlsz&%&C@pnL!>iMqAf_{yo zudXtFN99g)Z|j;+V@7RN zN4qie^iX4ZZPl@M_6zN^q43E>|4;P>U=us>s$h)lBiJ~``&3srh@Pb}6qpeT=0?i? zVrZZQLd4db>*S zh|+s^Y)jR}iVe6XRi@0ovH_RfZA&uI@D6pWt#`;E~K! zb+pc8wzw7F?TPaS#O@88=^Ov#<0G(-cgW{zYUrv%Gudj=$TcxiMc#ld5W{U$>wVQ5 z4?r?2IH{=MmaROhf?IpYHN6cEb(@WSZ!oFu+@!4sceOTzldvOZozH_ks_T5*UTxDF zGyKn{v{e6e*7KXVlexNvnt%sl#|8V(nCySa^YR|wz`c$2;MvuP8*>8v!~be3O!e2s zSe)1_8{^gLmPJy>|7EE-F3`XF&s`yKALk~csbH(!xZ!Sh+YeD zSQL19?7r-W!lMdvkB;ojsNTO}yt{3hG2@!+o^V&^8nddgRjP9vyw^r1jlec|*b>&` z+`jR(+$7)A9Zl@NVAS2rhN^0DXD9>tQ3%1a)+UDnk!_}%X8V4Nd)N$*tmj>r)|q=0 zIb8afyY20+@K|h0on07c!)m^MKkjGSox16I6|E`IAF9r2*b~PyRV{Zc-@Ty(BXx>qz;+=M!%ngdge_a90a zp6YHJfto%up|0@k;RCj%{|ptadbF;CUsqqPqsDr#BSgR5)XzIzQ%C1a(=elYYFDtU zYw4Ex3%HB2Wp;LGR{L!l=#4Yf{mgXcp~rm_x`B=YV5Hl<)u(qs8}!|YUCJssPj#g~ z94Su@Vj_5Wr`0w*C*!=ky7f+0PZf{;%*Q_MzMlP*#bN!&UX50-@xY~!I2Nk7In6+S zHMpZSm8x0uhI+(o0y{k$t zaoz}5OHh$8QDd`%NzwwD$zt8BJH@o@lWhgSc_mB8dKN)7WmJkG8a`m)l8G6iri2Xx zF9nsQao0UYR(rqF?jTxWl+?Hqqvd^okH z)87)e>)_Vb@MV|~hZ?8WRy~K=(rKZ_tlBD>b+Af9V7_7TdOsCU-1}D zH()qY&&n;Gu$=#?GZqgpFn6xpDf8wl6N?%bHD`ktx34(pA8O2d$_1gEIcJ2Eo%?iQcny zK6(O=nx=-`^)2D%BZ0G;S2hJxni}dKYHWJNXbPSg3ihuHCT|^!(Yz)Q3Y=Mk@eX33 zTl2w|&I2*;dX5KG@iz@%3j)O4GbPS99DQHM1Dz;;G-~ew4~nVdfg?y2Ocq6rk%hBI zZ3zu<%{%mwl=DBqq6#(ru56jNs;cVw(W!IkQI|P;PnmzMg|4Ysp>~=A(Jn*TG z9~xlz>%VGg4b5;>q7$1z?dk%oSoS>v`pE#e)=KnF;bpMSIbm?`*_GxI;#iSwjq3wonBv`ux9L*EsN^2 zw+7bEUhBHy_?OAPsVtuDbHQ)*5izQSc)Mf!JWx?YAms*7NZ42$*D)>0$`JmCWG=mZ zfhya>Uh8?$8`&(J&l@N~(7Qh_N~^t1NylyW+=s@tXAho1`BqlE|Nb^3_cH$SeT>y3 z?1OBTA1IBiPuZD0y=C#v^~(;0-ACf%d$-wrh@%v+Y?h)5BBrBN^+;Jp2>DkkK08(E{8L7&_4E~S+kb%A#_(q!`3w>}g<+@EXs++Msx88N|^G9}j- zoEus?amvz6yuc&hvmDJwC(bJ)`;^?_qrH}-9e$=tF@2;OP2Y(obV46UE6ha(&e9v>8S8Q{m6dY-UDnG=X|z! zc+#lHLX8ErJFCzTn8VPH!rJP!@jiEN*-`mW{h&L+gYPa@z^_+zo6dqCns00Wh=e(I zQSudmJWOZS~g%oPfrCf(b5IyzM5kyF3WpSm{lJxh}BiVYW?mEF}f zWp*5G#1}6$*=Srj9%D*!oIfUh^)@#y!`bzLP1o+ft$x$p*;{@S8^i-mnlWY0BSo&d z;Yp#Q>&CUF&UnD*9n4n{s!Ffj3{+D!Wwvj(J2d1v$lkEeweEOmHfBnTYHw9~JWCV# zC%N}@8^ZAJOO?sa37tsA$LE{s(~Rc0j@A^2Yze6C*Zs8;OO1&T6NxnivB1~tI;ksC zcy@hqO+xjF-b~5&GRZ^5^!9fy+fc8njOzopyCG~hA77Vq-dvOIbB`Q5GC7>Brw%)B zQtkayKI6t3;Xq||l0VafnhyJJt8Y$N^pLqLVbtBex3)|g)QBQa$ZCkb>%x;jIDSzW zk3Fa%unEM+*Nnw}@=@{F`(0$Ge;q)%Byi5u3*Wj3-`<85V1%-}^+xgkclV^W))30C z5yo)KQmj-gTU&}n&pm!!Vqf8itwFhp+O%z%8(F8Sca1*9w$Jtjl9meJ{nr+eZ6Wib z3sd#BlTjV8qPQ@+b80WFJyp<)Lv76ZXM4S+*{gJJTB%l9+BXj+XHQ~poH`%9MbP&m zy6Cm3+TKxxdfbVm)#FYir5<+>Cu&al(L;0xQQM04=-#2u4RF7OU9Vt|Y&8mHdL$W9 zJrB2*7RWBzrdqZdQNEXZbNK5K^O|dBMz#*+PRiWF*k1Bnof}EgS|@M)xNC0NsuftU zUyyIpDEhmVZZfR(&yn8%tC|@z60y__LS7s_kt6?YEa$Kq3UMOqOTBiDGmSO!4 z7ln%ML05#*Tcn-yhXxU9bm4lBY^(j+ZDxqHK($C48sEA~?>(+JS>+Dz_AKj#=cZO- z&4n2kq3cEAsJ-0t@q;J(Ud*Kh*frReq@f7NhGU~*gL`V*`Fh)D+@^?SdRw_!o5ETf zI%At|tsZQ|0#Ft@RdlrxG~#hj;#EazLAXtLWOL()+^ChY!aZ+QF`JH6Mhp2XTV?4U zU6YN$Ov4W5OGeA?!uca7NeQdiW}2?vx`c4Q*K~9-{V}k+;)89$Iygw>>Q}LhgxaMlWXz-}jclK+pGKq$sd#qj-y$R$|tFfXa54`Do3e+j2nnRy{lHM!0*B^W8KJ2(Z%#r^lhrFj9 z`8k{I8sS#R>5tX(&pGUI#Bt3v(hRF0w?9_1|Boa86CBsKN&K4;r$1JguXO11Q-{7D zxqp+gU%)ue*4}B44UYT{7khqB=`+l@Tdto}>5asPRR9T$U+cJj&ru%vBL6n<_J>EM ziQyMq@%pYIPAeaGj*W6hp~2;VWi66 zCB`2e>D?moOzJUHu;Gudx&82ju1@Q=Lwc14A&qK5PH)SOK5xQ3H_@4M3&Q7}%%790M#V5ZX`nCUzqnCa{mO#L4f%ry54#!2m^%5)hH z;vnYb>w+os4Z)Q8SHYC|H^G$2pz9Um6LZO;%Dd!O<^6k#)v9Brg_&nvUSwt5a}bxe zT><<<7>dKiN`#Px!*#BLJ^iO4?jyK0o;<*1P-ZIeFpEEzc({dU5rd~4JoAZJF%cHv za4`{tML5Va6m2Y@SlURT(0>4WDe;;3hfsmTg*DdH zIAeLO;%Avsf5v6`{8%tf#@&KhR$B#|I6o$MD9*nXoQ`v=V476<0fWrRz*CVot><*X z>p`Cg69HXBbaq+v5lWTg&B7d=%qG#jSc@)a3Og13N8kI zUT`UJKaVAc_3nFu0S)?4ru;R)BLuUo)xJoevpzDg9x}w>Am$hzPt3wa@ZoUT+bnn< z0gd&8{6WYft8Tw0aXS7X48`FZt)SIrv9_Fnw_P&LWm&rT4}oPvnHk^*3NUS%B$&1wBG`xXRf2J{#uxBYcF;y&Dwr~s38uZN zGv%k^yjn1Ae}`b4j2gkz@fpD;&MymQnH(0JhVwrKvrJ-Gw}&wAh+1+!i(6AWnW@hWm| z6FTkoUxI13IvanzVAebSE`{eUNHk(E)?VWX3w^P<97c+>!`oy@8BP}#rBZZ9>L5-on z)J2Vl`u5k@bu?73ZK}mT8$_>U*zXoGky(;5UJPfrD|W`)>r3e+YCU zo#8ye%+tk!nWw7+Gf#Oo{vyH5AA|PS&HQLTji?T4pLgC@{Sq?B`!rb!F!M_@5i`FG z&N6x#>5#9tGNN5vCjKGN7L3a|8*QZLY^ofGki)Wtp0m*wx_qgFYce^kIf0(1W#L-S z(^wX+H2g!Dg+o7^uw3-B$$VmYHd#OneK`xGK3WTj!7~;0s#tIda4E6O z@hXIV2k7gF?ejM(j<6mF@_UK6)bWVWr{esfV4RFk1ylDE zf=!%Nzm2%*zx8b)j7B;C3;IxEsjJKn=`rY!SgyMLvRp|IfX;Gt zW#b>hWE{FJWD$dB5Oh;@I}ro~RkwkuyQRpj+4P}_~g&RIhpktn08{IeHe5(Uf5eXW+@hB3-V{f=FGn?J5`P{KANOc z0R*0OS*UVkMi5jvLeAB?Tv#9os$B4ox~OsiX1Sb)BL$e{a*<%1j2{SQ8BGyPy{;2X zy-EesR<{Z^ajq6j9k&RkjynY7WcjN{y407!X)F4Hp?=-!Jo3eMPn}#-8B1&hy7sT4 zeW6n)7b_Zqi9nxRIHJ@s^-XyE8`~fPdQ5wSJ^*c@tdSix3IQ9eoSRO z8-l+PnEIu#Vj_T~F!OSjVCtgkDtO4N>Zi8qU zCeA+*jFTF>sSovi)JA_oa2n401T!rLrwtzgP1z6`+9P??^_g*WKdfxUgb+*|l=C+D zNlH1x(plvZnBj69q?3NGR50bJwhVsS^LC+A z-@64`TU{sD-4vSeTJLFVyJZDA^3;D`l58;0&C%3m%X28DEo8T;*Ulu$S=RXO?$#_#R z^?FY*&HH!3vvB@GFlC+)oP~3jV9HEzS@{Aq&JaxdaX%{Nmo{c_vGYKP!9m+z4M5xJ zIzZd$cQUjE>3QHWiDkYqROoz;RDD-62nal-;2+4=I}>2arX5MAY*qh(p^{~PVCJ_} zcqqF{Fyqz_SJ>%+cH={_Syd;xRaL*J`(EZ^^1q2AZ4*jH$1PFlRQ zFXz^F2bEZO(rrmbpX;K=IK5Iw)~%@Zg3k4Wr>q6`g@)f|K|3#M7}j=0^tIYS*1Djbh|%s#t?h%i%^seFzfH|PBkDAu9Gl+aq6()+V#g{&9f3-H2WQ1} z9jljH_TdhgET?uDOwA$|vRv`n)nN5fu1!n(cF{|9m*=Zms94oHyi-;M%VfIha%G!x z@~T$+Ib6-!m9eVDDI;rkd;j5d8w_{5NHAI*o%gM!X%2={=BIZT#2j?`_6XiMVVme|qWMN8Ouw+prry-`7r8U3%+(Rr2=Xzj7wEPWa14?;mc5J|venhMtf5PRi%yqxuk&sGeR@ove< z$LAj%G~Yz<5ogJbtl`#kHDBXUAKs%HXFBBZxpM*z9ke{Y-?z)V$0m>O;k3Mq@L*`y zFN}Mp7AAbW91lLbypL@1_-v`=#XICR;~t+Gbs!&u$02X>2L&@f{KGu|Ah0 zBX)U%QCNIGql1>W0(^FP`!lR>f|NG^hn6?hA&+Z(xzkN$m=v@qf0<#O=Z^&33SdXGqXd=IAOWjf@&19|-RqJ!4&0*AcukcTWQ`|L%5QwwnMn2>fA|mzsJ`OGK1z@|p*CCJVfpyUGeg}eG-m4ej z{gKqafZSvGo|D*J-gs2bsalxu@iG;Bc6py)XuYqae&-4w<$Z|G!LHvL$m9BB9khN& zz-O1&j7~BIe3Ul~2k%i{twX>1{+69_O9d_OPKSQaOpMk)bPW-C^BnTpA@50%#gmpd z+aWItmA)DGr{fqYeAMqoM6l<#5{)qpbRD$3c>u&&a^oY&TLVmaqj2yZ<&6fg%WH-QG;?D`c#-g@v*9;$Xk z-me|<+9B^Hk;Rji_mD&0Cy=)v_bCrmJ0kBbM}M^monvq1`)Bak^?T&v===axF(Pk= zLtYEy?ZkZ@w0;c^c`S_k!9@K~G!c1o9qnxq-v7_n!i0~PS3BC<{gBrTI^{vth`jy| zc`cB~_4PVv{Z4bpn|eufJOYf!b7L}NFW>hu81z=YCn4Bwzwo6|`|({j@3H>93SgI) zlxi5SfUX1i7+wM(&f*2aJCLXCmyK)Qqr5rzM|tRORd@^XZpPTC1Ml(3lX{OXRE12_ zFz^=%doHU<$DlDc^q399x<)&SLy=)c#jACL8-H* sCj~UJ&g5YzMBeQFeAmFZ)PePYLGulPU9@hbQ(lIYC915-2glj}2Q^a&2LJ#7 literal 430242 zcmeFa4SZD9nLmDK@*YM_FpkQLP7pB2TN2)aZ<|1fK@fS9g4G>|%!EV}5+;cRtKBeF zn9#b#l$M0PEJV~`#R7F}Y|C!KS{hr~Ro305yLFfJ=WlDfwF|D>+E&f~`#twLGxy$^ zA+)=nPyheV-vcN2d(QKm=RD^*FZY}?=iXa*b0Az(cWdr!pWPK(f+n{9_4yXgFD^4# z?#nd{SAk(%KkLH&)?XS%GJnUn4I`Pqr^_%d#((W!4dZX-C-<*EZ5YY?M>iP8|A)Nm zSGO9;ygTc5<75A^4KAh)q&?JS(5GjQwfnCxGSdHtJ|oL(WE}ohg3r8pmhlJr#*Lw1 zYeS1a7~0sj$=?!c^|#iALoIbp4MD?BYYx|MZuK{|Y)Tp*4z(tY-`G~0G`_L9K52ZY zra5VRO*pCiT7Re}SQkst*xcd|hXTP+*k8Z7KAyr7UmFgElJVDuLh%w?_%~S!W{Iw8 zYHUoNK{!;?5U6jA<mH-&o(;5ZY`jW}HJ6$KO)F$>02dKhSVtrO4*wu~^05))Hz# zE3;*lKyPk&z{apO41@Y>8tPFW{<=^@Lz9hM)711peX<5&#;a~v-xz9YbF=}IoKTY@ z4$0c$y+>7&nLufiOaZjY8oT1GqM(0MxT&q#-`eCyrP|Vov67Nn1874DDVoDgtxYve z4gLqw%<7vq+ZZ_VG>2>bt=pQDBxOB^+MAog7?i+ZOUcq{Guc&CW%9SeeD?TYs3yFv zxz%qSk(7;S1B@CqO<{WrSL0$h)Z7r*=1(+KXmfIL7(7Fp?Sg7Utu=M%{mqW*tZk^@ zREM&K1Dji{g9){2YYxJkezX98a}x$$7|&J_wGC}8btI<{n$Skf7MY}&>^5dJjSW>$ zNw%zDu-Xv&HpT(V*hwvs?m@p410!N{L#Wj>66B zrZk%tl-z)_hgw^P2tAG2F@X-e)GnrHkd!gW=l*Cbi)g=sM<-^ z_N3OOJZAmcgp=Yo>rYj_jo4aW^MF#%G7n*gk$8-|7(tSyfXa^hgd|C{nGjUXCli%0 zBGfc(u0;c~*9C3ljAJ!7ZQYzSzBz;moHGG#!|MK#kfkOtm%65w)`VGxW~gauc2vB1 z`>_>_dSQ48sd3Ob>9G?V1CG1Cot&VDIfIS~w`J>~*@qUBD0NZW5ZGiVH#OsKSN{;Z zCT?XdZT7imAQ<%5wfO6TVcxYb#DckfN*1%doNY8ABC$=fbC`F8 zlr?TDMYVB{cHHiD)_TCP563pDts+zdMz>RU-9(BiET<%iBsIhbHn-MeB<7?c1;@rf zurW}B*|+nS&-RO(eqd8L(CBXt)I8uE@W z%iP<>K*5sS7O%=;No4Okii&Ay$sDz;2(`=YjrL2zS;IRprnI&74N1(a#xrmv$v?pR zX1#r4#o+=yvt@I9DQr%eRCH2dEF_ZDBoimJ;AVdvCX9CFg_g8skd~@p)CD-B4`Ar= zJC``ha?VJ}#~H18opnwN(9-4#Gd7Ue>}Th(RHThd<}4WDnp*;P3hzk4I`k;^tBsC2 zP@2W4HLdN*(l+`VF=I)x9EFWD}l~I%3*v#x5 z%|}HB8k#Wylckqk8trK#CzhBS3CZRwN;FN8lBoJeIJAW=l=};bvh}*DwJx+7I~I<0 zHS0>6Q+D`$(uyOCxum@? z5Bd%&F7eL8^lZD3A*&(u`fUwOj-`QSLqnE@Zz?WxBI+E`nLgQ_M%PSBz_CTA2??6S zZ{}#}_N|*3$!1)P#kc{bZnber!tJRQ{mP%9TEg544N-9>=*kv~kuG88Ch@^gZ2-+F zvB4ruLM9v*)uv*zefP-{pRgxqZskdPthY~18o4+YksOL`He-aD%w)3>%@w5@jQ!k= za;#h|WLq*e0h8U7jBRV#G;;_bBko9kGlzPNAZCIjd6CsB=You;JT5U(vWf1Tv9xhl zA)x@VCT1>eYr^%-_Tj)>@XI|cVbcY>?DY?ZIBl|5I!B9m`&|Yl^16r7h&RkH}^P3RYiRU*lZl$}U9;YP`%_!+~aOad>tY&j(Q%^OqwSWnzztkq2QKf1J9ah5rTNpP)vn4m-mWcl2 z+_N^dNmW@=l_5+z!fGErp*l?tH8a3SVbjGFos?v%DK%o*?xuKqvxu8gw#5^MJk@Ya z8L?$nLWfkdIrbiN(>qljEoMm*@=*6#)1sJ(V1qS`wrDFXOEkw{_dt*{5$uNsvAEnA zvfuwqoj!gYac;>I@x zUVt^w+}yxkrS|I8)awGwoI^BX`vLpf~<{w<^Cb2vwdt~A;fysLE z+G%cTHbo`xwPuFwWGxs3gKgMZ#f=j?o61^A@{|cv+)B;`j1&P|+-=Y;&Uc~wxgk#O z-^WIh#99Xz$|9~vs`hRwZuZamASO-qt@wG+-&Bj$0jyGot?!@=NA^B%O=#A`@0-f{ z>sR7%V9Lh`iFG}lgLfNC4*%=?<72Crg|_}t133<#sGdvO2VEXGIepZj{4q| z^!Eg7@-oMsQKJ|y@T0@@{!fx$jElXcr){zEC`CayQ6*Grrfvl z&*sD=Yq9D&a+xit0`rH{w;gyhbHkRUfrZ<>i>^SOMMY(qWkUpE4CcJvawE(KL(7G>WcghxyUoykpte zhB9FB_6*b~8{3_|gIB34eyI@3!;+mP8!Fypvm#z~*lpJH`uuk?KFm^90^8w?{=zpi zqb1<_;jc}WGZpV-C~}JI&H6u(zO7_}#B(=iM=GX9DyGc9b+V^yBSbyjy`|%&SY9^$GgDWcqb8FF=MU%AZ`p8u>F^y{ z-pB;lwrqkoeF7}oKVDgOL7zLb0S&kuo#J&*c2}>_vkLvBr-I$%K-ZHaJtahijLYvj zFw!%~;L*;&JK5uZ899jICp=^v&Vsco&TRSF_UM6F1sqQs8a{I#Lqm=c9xMk-$xz|a zC(x(z!BQPSmbXVE*~ZlF4Db5%s>_V%>$gXnqXXT8yX$HqPebr(2u2@2l^H#X6!$;I zQ7ksfDA_c!k~6-2eC5fXkLYBc%o(?_Rb(8`JjJ0Yvj5fUCw3h~+dj^=GyiF1 z(d4_{-o9?`+bO#f?kQ8Rzh>%{m#q7#JFqej9n^Iibjwqi2S?j0q?}ljxeoSi%`I>4iiR)WiruphyZp<~1w#9edlpvsi zW0x~;HR?C3U*CKym-%FSkUUdb44e~fYY6&qrovZ;HA`r7uCZisW%Z4|Rr=a2;330U z(t;%ie#5Wz;eaF*mrY_{Y4NO*StY)ry4Kd_mK$f!-c;XO*S2vMmQS-oI?3#Yh6fvG zV(xl>sHSxmID8<@G*kLZi%aJfmz6G@meA>b=8i|D8|P#9RK}*^-;aczjOHUCma2uA8NuFYh)PPEak~VT&{#$6g|gy$U*Ox z9F{8jCB}Uc=7s44!oSHy`T0f-u5^=B_-bR=3>x?2I@Y+txJ>AbX8PX{h-277R`elD z1nGYwygx$xSYx8`ywGn!{8*zqQ2EZo^(w(P z;mS1Bhx+;iSK~Skz918S;ELgina>=-%;yt=nNOWyX8oXG=7YyMR9fagESPytfUPOh z2fR!$dFZsQbh(xzE}>k)%>1bTYFvp6q?=3dbaXex{?d<;zNdQ~82< zJuuVg`qKHTdS*O`ZMaT^FJK}#JZ_>eb+}nDNo;rIp}a2(ro7{VS+p$L1U#v1vK2g( zrS(y|;ZFzRly1`9ncl^UfK&A@?LpQ1)n>d87wW$g*U5sZSCQcDxXvKH0)OC&;rZ+j z-CTI4-H$6rl!6@mfnz)|%f3)B^<69&NsMa2)R*-~eu`y3CZ@g~+5wpQP893|UL%}c&qY37(*P{!Lb5Yr(dGq0j(FIu_p=h61ywHz=;b*(r_{kki9Q0|1S-5wHX5F^p zu9?^&#aZxCY{bVlM%N(Dm8vN6+{UP)9M5;)H$b&DFshn(N@Y~p>ZI{3PAvR5BZtH3 zI!!92)zR_M#qxmpgDsoYp}pGFnyRg?*t0el66@gH*wQk~+~J8osv{dF#w;AzZw+k3 zbz7slhMTy}&S=cB*ds2=op*D76n7rnZ}Th>=-SGu{tG0xEj0!SNnKPQ1o{T#F^!c^ z)5xgtv*05xXC&NrF%GeRbDUxJq%j%O$jb+nL z>-PZ)Vb$*q88fLLZ-ZLDe+8elyvsr398EhdkMkg_ykA)40mkHg9@r{x0AY@Y+G%;a z5Mh;<4x>y)9QEUThcw!+0p2R_HH4SKYp3OHLWEUb5#$vkj`A)M8s)8b*pG7!=Bu5S zx5iN)>mlzxFi{?7)8wPPc@BBykjFWyc3NJsLta1RwS$TBc;C?S&H!7>+lO?#?`fyy z{XHUx%Y{%3qj4TVd6&a$d4CCPmG@o9yB~4dX?aHwVU^clk;hxRmUlOVS>+X>vGZQ6 zotAeOn5^>pAg>xs)Q{5-EpLHCUOD7(POqJoSL%>=4)WH5iSjsA(em)vuT8%o2<&s( zX?YxBh|7ggiOTE)raaD7v^?69>ge&{D;eNs8l{YcBj2kgRDVgM=Q@B__C>mG3_d{xMlxAFM$Wn}7BGed)Z?*i-JK?ccx8fg8@8 zR~Dh2n%ZHn#gjE-xw(sybvD~rx^dy^nOU*DnFP9>=KTWhD&9Wh;rFZZjmYyKox~p4 zYVVM{F5-RAUH)Lr`taR-kd2*I%6>d!(+lqA9Rr<_haT$;Z+amo^8ANYY1o14jKG(6 zPFgy4p?jwKEdlv}oeXFCT-n-rXkr(?Xb$oeX!An`);f|hx1wAWv?dwVRUSTZE zxG|cU3k6Q*8lEvn`Um>P9(i_P!MDeF|J(KLo}Tnua(B240>!)QGo7WLoX2x|7BL&| z&yD?G7>GRoLDla@BG3P>>bLm&!O8bWU?=2{g0&k_XytKFJooUsF_S1e&JP&gIn+FD zz1#ae*V|*Gld2cht@hTsx+C6#oW1>5b{rb;T=v!MlNrXtzs{Uycn@ZUpa1R2smAX2 z2hRO+z>{-0=TOPBpT7MW&n2D-$30uWo&D1nbG@$`JMxX=m;7|Wd#5g0_iCDF!oYX( z)-6lx-}uZ;vtM!T`xfgdbExEJg}>nrWVB@0)6x80e~H+kLe^bmTi83t9d&i4Wo8*3 zl(Mrl{QPfrV5>i8Z`p+1-2*>e=%uwg!=9`O%eNZ_w$4~FnJ$BzBdT)$2s=)O@pau< zVBKVUPRi)=Cr!;7;xTFJE^Q6xn;lZ3*te<$bA0BW(Cv~R?E3Yp{OSft3e=+E@Lchdbc{8-uJa$#Je<8Wfzqp`;8!45nwPG;b) zhu8Zx47)gJz;XQ3JRB#re6G2<7ehzA^?uFEg30Sxq<>SA-nx`0(&$$!0 zQpsRWeDq4zfT`GU-YeN6z>*El7N{r2N7X0B=v=hf7BNsrJtTf%3#c=hqvmMgN>x7f z;QZ)<)Z_KB$Ma{^BrH`}l^5gs(LOCr%P2iTsGIn#i@BkjS z&>uWX8V1KJG`X1T2f95Liq{)WMsFSeENroM&oP92x?R!6$=Vg`n0(rGYamxm^C4_) zSJaPA>!JA;A}rA52|A}>aYOTJl-1(&)A9QqOPI7{%)?Tc&uV( zt|Wr2cDHA&cc&|Wa}qmu?iq794d*!0&t@9l`;GP&*X{ji;<;@ZTpGqR(dbJ!hX#o{ z$Sd;Skbkc`n&G*+$K}1s?a3+}8EMRp?l2{1LbBWN{&U*+tT1 zbCqZ8&10ya8~Qzx>)n*S&gMep=GhD?R^-~bue`s|GggazJlDHEZJKMS5WIc)o%zSJ!8kK_ z-9}?Zc9HA0{%iUR!P=g$WNO(H&lTY)P~phP#B)n`ZpT_OiwCNZX*9ocZ?v%UnVFe( z<0RI>x_xe(6LIYvm-p4|=u6%+#xvdj9sPFaODH}rZsY`UeJ=BAvo-3+d(73>wZ$;J zKQQ`x&t@5YT_)enV_>Q*90dW7C%fY_YdR;z^-%Td-Q)@w28>euB1)7A%~9M(($~H9 zku;k>!p#qDK(ztF+|Lt%a&SFX{sguYmX3yc|(o|YMllLQY6eToWCRAX$ibvo~zF4^njI9(tE zJNH6~NvCsBNjTPoUXL@Zf;jgUq#G`Dx6v)6`0tEi~il0tol3w z*JZ?%&5cQ7%Ko%q%HAcI>U~Kt`3D6vAKH#-eYpNeFta`@n0nFaJqJ}5(O;EC7DviH zGG23^o4=8hccEbN(&^u}l^jV+8h?|fV^r+-X<*wK2rIudbE;AROnKIggxGz_j}!WM zE&(ro!w=o+CvN@wby61lPvWr|Y2t6=@zm;>&skck{_WgJzmSCZujHwv#CdF64e@N^ zJ1MD!D4rDQ`8%rZ9eFq$(1>5uFE|;u?4raqQO5Q^6bd)t*_D(=w{vN;;ng6m>SaUr z44RWq^)ZzyKKA(?d}Rn*?8j|!_)m30osQ4<1LRg$~^#Y)$a|2--p*u%lirr<^2ZnR(XApHyKQn$M&V={j)>f8H9P?*G|j(2Zy{@E%FM$ ztmS>#A#Z{^dHeg4L*6;a)9sHlC@rtuA#XC|P1ec@AA>CpdD&?G zJl%Gr3z|^B=_NZAkaz z92glnIx;eh;eKS~#H)EY+W+C0M?8&}{M74N{r$YUtVc4|O&vLD7(csgSm!pl5Y|B@wO?F53GshU0(h+=-p^t=d8X5WQm4nfg7a96c_&SsDX`bH+&(ghRY0Qe- z53Ez#g>(FL_zd{IR}JG3{Il>g2GAGa{{nV9%q#q4_#*fR46H41Er4g!`39~}!taFt zEc_$zE%006Up8=Wg})a#0KW!)Df}JqOW>!&&xZe+VHnTx3V$8^_3)bv!^pw)a`-vG z&*Rz)zXN_3{KN2J_y^(t%78rhdw}nQUkzUkzZ||2{yCKCF#OjI!*~YaGWc%-&&L(^ zHJ-rr%kX>QzYgCBzXg61{Idquh`26*KL$Jx*WI}8#`R0^`{192Z-8%xuZ16h|Ed9x z>n*s>gD(ZX0sb=hS@2WgGvE)ve+nM|jYr`h2iOMR3Eu|qhp&NO1-}gbPWW5kd5`-F zt~cX48@>d18vLd3GvTMer^D}ue+d5DhGA5|e-5}EJ__Fo|EKU9;a9@n4!;8aX87k} zufv96ya@kA_%9%?2fhiu9{xGQFun!92fhp8Zurgcb?{$D+Czq6JO%s>Tpx%3Jn$Fc z55YeGAA;{Qa1I&Q=W+cU{GS8wf$xLAA3g}537-dl6a0rL0$&zla`*Q*SVLbn_>0`x~URo-;l7I{CYgRL+I=` zba$lVDHS;OAv2t=!t76G*sa2}jTz2RVYW>(oUOuar)D@)g;@_~I7@|d2F!4V+mxRx z;VcPXr|Ib?eY%7%mGETEpJCExNH|Zzhb3Gj{NIR&-7Md85}qpb=i^~T4@RkTAzTx-1FLHiJe67ER=zC*dp!bIhbG z5`K=4bO@{Ram=HeDs+x-bOJWbQnO*+SAx=ST|!+;7JSs5n1RKj@@=GaVEApE=+(0PT< z@tba<(0RY0yH@Dw11bppa+Q9($IxX-nD+&`3>-M7{dupTyHvtc2N(i>hDo0_pn|Ax zGt7GiU4iho4X7aWGwD$YPZWBmgs&BPpUIB=%<=D#g!3}Y@bePR5c)SHoF(+nX}a6w ze_Ycg%zF-9k(NK8f()znaZtijh29qrD?0B#bOl2H;(!XGd}e-sF5!tn|Gb2+75cL# zJIZH{-(Qz-UWOSyCgBXBe^bI)Lg(CqF2il|KVb$@e`ffZ0W+dV%a4bZ{!dGIs?eW} zhZUW37PAx&tucUv@Fx{o;=Kb!lg!3}YFy|a}8A9j$gf2_yd(0s0XYzkh!dVjT9xx*cBt7Re zbY4l{HK2m%UuOC*NcdWzuaa=Nj0c>H(Jheh$^jKLZk6$ab1Axc5^fq$L8Dyc)k}DR zgf~n0R>{9k!t*5jfP~AXy>T8zw?M-852zsWH`{Aa!t*3tBjIuxFYc7^0ts)F@U1ew ztcayI$E!dry?KAVBbMF_bN)?ttK2`A52zr@Z_>9&c!AV+bBu1bmwP2#F7tt>mH9(;EWJtRe3`CX#+zjWDhT_S;}hq*bhpa*bo+n`LO+wfM#ANCzgr^V1rlB@ z;albYSSjIo5^jv8H~Z73Sb8(u5KC`{Yb88S`kUc!ZJQt1jQ0y0YnQJnnK@@>#ga8M zOXtm>dE4SUX0EBOm{T^_N+~HV(-bf{DT~cCDJW%>XQ3^wuE77&;+ZS&T)v@XPVqbo zeI_3rUovy`nu?j9Sh}`)=0)%##YJ&nyxf&*mR)r27st!IFOHKXzc^0QQkK%Q23b#w z7cHhmSxI6}2NSD#R3?igsk`LD5?e-cK1-(3wo>!i+hA%ww7XGCiH2F0nnjiILNbIQ zm5jv|cPv@Hd})Q%>?w^EW4;(m#F#I}yfJ1Dd<+0|KqSe^wNis^HJ6em4ZYd6+Dv^!uG>VOANt~Ec5v7I` zQ^i__jiho*mPQEDB4TM`wPH~-p%^hHi@K?qERyVHN+u=+2W2>FKT&0B`xXVkc*EsGP`T$;&!$Cn|Koa>Wd3F?DjqVw|I99OF!4dV4uyoRpbN zPq6C=X383H@L1G~*MWm4Rbi8`C94Mqn)gcf{cc- zG%+(;)Pz!YWnxSgbrZ@OW1^%~29Gf%u{v*dF}+gMTmsL<%5l_SQaO%VOyIGYNZBWW z!D5~ZFi7nrPaUh(1hQ0Ma=}8h%zk2)jG5e`J`_!q6JxX#L)WrRn;0V{I%+yOW0G1z zS58*nj(SSMl|;KFT$aMBk|trX2uj9cE9HgNim_TmYRmB^9;=HKtvZ1xiMm0X zTxgsUd1iQu!FMUpnfftT)T2}jS@m;I*~Iyzn)&Kyov4m}-s)1pOh;D6GhKmT53bac z@zi~yVA59$CO@5)p8>3&lTxy>aL!C|#CepSSDTS&hOu{~ULx4ZugW4#P07zO(~coO zF!@zkfSvjzqn6edxiF0{PpyH_%oYDaT zlsypU89dhKWWhJ%I#=*ITq^~Kaa}983)i4vo_T5&{0m$k73@XZ*dv(j;1>jU z0lzGm&-T3`co_IC!I`M<_XN)Z#!vZ5=XJmZfISJd{FRDfL{=dpUI7v1s4IoA$SGwTY_7G-xItK7(Z1j{Re>A zmTCY00G=$^i$*n9a0PIs;0EBef_DQ41-}5?D);gd z3w{Xr4Z(YX-xB;S;P(Xo8!(O%D4ny>m-y@>^`8YiS@2rmxq=@7t`z(<@LItqfrEno z9k^9+CK~0Vf~NxS5xf}qpy2y}Ul6uoDTY`P)|L+N|1jbPkl~)}wpD|^=p9h{S_*=kp1-}VgDL5VD#ah9|z(K+H z0JjQ`0zWGF1>ik`-vB-+_&wkk1Q%eed0FsW;5P)X0)9*IX5jY(?*ztC3#D@}FyFIH z{l5b|S@1ss&lUVT;7Y+hj9+U7F98k;z8|<%@Sg)eD)<=i9>MX$(hTsjrZwYP(eoychfpHW_>HGpP?=95-P2kCbGjVg8D|j|=rQr3z>>K3&G;mPx zLEu)w-v@qF@Xvww2)+V0#Djv%fnN|D1b$g?6!;Cn&jG(B_%-171fK`S(J!UL*s;)G z@J+yz1qXrW3Vs~8Qt-Ec*9!h8;Gp35fm;P%jj}x|_(tG8g8je;1wRV>g5X2IFAM%# z;5P*SC-7T>^9rE9;1XaQjZ*rr2Il>i_G|~9Eck1{?9YsU8MspL&wtQ)x(xyI`DW^Q z4tTQQt1!u#EBF@RO2Hd}*9zVV92EQnD;mW3p#ulknQLvE+?! zX|#sb)5s|vqmF+LOnnqozIV=#!pV2ZFYt))=xGz5KDMN3!_&R$^X~~yN{_Cq`pPeg zhA)*ko|Cp()nW+qbGEh=3Ci&ks@5d@PM-OB;0xq&!9?a;vS%%C*;Uv6+hneCJQcoqdzZr02D2NZViS5)o;pOYW+nV)b?4uf+ z-yHru3ZdAol@nG?iXHBfyegtr^2u90k1 zNX|WK4JS*co~(~|RD6gp;jK=y;xB-oJ8Le~`h(sFk0rb9+53HSF*in>c31`|$16Ri z70Q9l<}lq;ZY%ye`7nIPoaPH7hPYfP=WZ~cr=?s>eH9JUHe&_6Ro-%hKLM|umbVlU zR(ZbZxc4BA@>m?wDDO?qt8vxkI0%eebwrAkh4OH#jmbLz<*fP*ftF0auYk#_U$;fx7>m5HL*8qk!PGIQ^=ov- z3P41xev1)EWy@+Mg1VagSgHv(+cFNgs3 z&`#suB7(SF2y-Eic4m1oO^V4o32c?ey$aH`)A9xpVU<^Ik;knh(kLIt)@|}SQs~D` zV5_|47J1yY)bjow>G3~SACDqXh_H6#qx)OLTji~{$m7EJmvA58>H*;g>7K= z{1TtljrJ~yg{AW0Uf<~Nl9=m525_cs@%R0kvG}{k{(iz({O2w4e2-xYmz0u{JB5%x zB>Hn^&hrahjc(8NgCirSpWHP(GE#y^6lT9x^=RnWp!@kmhhE*b#fO)c{XqjNy%D3|;X`)#IL5rk}{oshyBM>76ppyU*yIGTt-h#c{3~ zp57@v&n8c=_J$G101>bJIOzs?eFo7mkd4Yf9*q^Dk{b^u(e`CaD2d~;;i_x?5Vjepx)wiqVw3XJVOzw4#x2YUngOSjBO2hXYW&S7vZ3S70+ z<+*7P^>|=-cx0r4Hh8x%|17>b`m1Q!`0n1qv3tLr@0m`HCw~GCrPai9eOvC{*E1No zeNyySLuIRfaNV(?yu%q$ij4m1tLfEcO7Ocwc_RC_DrHXzs{QsQ(acD8PVH6qcAtND z+7a)a?nv*;yEa6wFd~7gI;o6dobL6g1nT3#ps>K%XNJ26Z+nSfL@w_cI50A@e|_HG zdG4w+BaupDe5LmvjOh7eMMn;&pUOCUiE(!&z7HF?GCFu$zkA2ujg&_RepTeII)!i5 zMl+*z>$8{UPp`z=N_qlI3%#M-W!-pN<yv{$XJY}5~)rDPw{6&GWQnovC z&s3o?3>BeP)1$AWwBEaoMTKKeUSS+IzYcxqK(s)WV~{3o9Hu?{D?ZFX_lORH6Y8A& zx~Q|`5WhJ5SYAi80!8TfVtz-bPhl56{(Jy|&ZE;Sy9)D{b*|6(YWBK$zm85_cg8Ii zePmebLKX4km$b}1Ba!{Eh|7}=nbRwyg&mI$bO&~K=k4yUxHr8zzY96_cLOE;LhAWvhq<{?&POOV9zD4NMT-Ni4l3`T;KU!&-Ua_ ze{AOq?vq7^l*019bDQ$LnJ6`N`l)M>)p+Fvhzh&xi?bPfJu_UYs$)M)hl``M8~)UDYynffWuHL7M&^yrqZ!m%A22Bb&NT=rO`woH{5#BE;B zc!f`mQC9MvaLee{hrD)-!x*OIpueiYcw-vK==)FhgM4zVq2)Z1JE<_=`^<}y`0%j$ zZZU@HET+Tvbs~iY9p4*3zl^RwR_Mh5Ws1{d`*DaYO(}E@kG;sdp0ZH2|k_w~UM| znEP(t7xR5q9baLO?^>L7({ml)&O6dyacpt=Cx6`WxEgI1 zyE}f7zx!)y3|O4qu`mBfkBKunzN$x|#c9VT-SXup&AjS)yE{ySM<(TUJ#%hfv^yJ} zrzhL;4Wn4OtaBYH*Zl4LhE7J*9VwdSt-Hh=a`rzytUe~MUdN2Vc)<(q9kUD+=T~*^ zsu_66^MvfkVhm)RC6UF(!omkyrd22bec9f-(|TOX))!*30#mq+#@wxQ|E&4Zf$?A3 zTefxMZARpKAM|IB-+CBd3&((V|JG%X^<~_fz3#>j`wNfk92m;)^hAb!`vhKh)R(uv zucCKZdPg*We^d>=%QB)MeqaumUCZ2{>=sJegj}>E*Z|{okV%D*PWbv3!&L1?EZh6EVxgNuav8d?Eb(KamYf;g4p3Ds;^%*c9`pN$DV!o_S z-ict0=#~Yz+tnGxxZA;mwTAbN{78Y}&CZ*aUthTJ=mRyLdKks$5AORJ0f@}d>c-uqB`bjv1aztFhPyjL$Uz!|A>@s3z!AT!hU zALb&u^SqiU@D@83MmU_M^!sYY^d8j1S2LnV_tixTT+=Jp)%{mdVfE44`tj!AabQB6 zyO1wwE5vb^bDpPGSGp!u8j)9idtAN3%xo2v>BoNf!R{}sZdA#3AT6XaqvNx>O;o16 zH2jil*?V#iEgCk*CU%ta9RuAZojKc~9tSv7rM2JSjoVKAd!V6tbG#6a zY(>-fZ=IXMO>NCB7Je!gBl{G&hy|TytUyHuZzDf5_Z9i3wEGa-WHR{z5287!pTvwc z`lnQrWEGDcfvaL)I+|!)^GEse3f>=wJr(Veo#lMYWm1pg;x_mLwi*7p3SXk$1IL)3 zBHpcbjZHfLCZ65ou6*1je!q>o;&GRzzH({}b5}a<(&YPUIwlRL1Q+YgFhp{%Wl;1b z55xSvk9G|I9|u3rerZSgYYu*kI3@2{2me}&J(>Q5gZ?E4{YMsobBQ^IKjqM8m4m<4q2J{WeV%fJk4pMxY`XERD$mzx$NUN$`Av7o zPj`fwmftw1BZ-*5O=S~HVJMgJcwLw}7pl*iato62g^1_=t3G$?lX#v#SbY<|a0tMB(9VzqENL$W${_p@-3D5W*#8(SG2)vRQ=Q!xr!n@>$gZ0F+ zM|ux2(*6$oLBZF-ZgqnB4&Mf1Ze+qW!@H#Gv=YlX)pp`B_yhMaylb3-MhCGRbAFUq zHlw4&$oD1W`#Hh?2Y5HJoHgA;jKPSm8=m}!aQ%wlS8?4>d@cUK9fWuJ@CU9B-c_ie zdN-wOl8KKn{yG!CKn$6Uxb_oIHsil5@sHy=AoyKehXnr^SDK>$wxQ!lL7a|jp5Sa; z=Lkj?>b;bjze3^%a9t|+WnBMEFfPVpf+>$vU7Z%Ml~S11$KTQzUjWR$N=)-s2`&Qu zq~ICApBD^hd{M9u_^X0h{1*im1M@c<%A5=QuHZ6Yjsses9Kkmu-Xpjic#4H*x?tMR zZ;1~Hu0;H9OZ=AvS0kR^BVk_4f%y$v;`@Me(3go<0$(b4E%4=n*8{H;3~1aV_#WV+ zmiQM12N91~X2!~uEw~Qx8w581hXpqScMEO>{s+PBz`59ar*01emkRCxzEAL@z@N47 zJZ<55M=)57{}LPp&dM}pehzrLVDiinyc?MBm1e%r0pBC|2yml?zeVs1i2sz}J;3}< zGSkv^3GN2&7Tgc~tcB-@;O`>-n}Q2~|HZ;HEch#k=h;QdC(lQM_XA&#j->OQBlsZV z?-kq!Ovipo2Qw?&09o0@G7gjMnu5m1v8&731&WYPCdWu(37&Xo|KhLPtGg~s0^Ia4VZdzNM(FXPXOw< zPU0zhgJ82qD%Uw)Lqs71oKH zTX857X8@BYG>nt8?68GdsaqO!0bin=IfhghzFE+{I-U^POL<#s}mMQxlU z#JM?377hjKWZ7%s(1*O@<*_sAPwZGVO0~cbhBmh0EF+Ffw)(^PaIiIvwNlKrvtR8j zP?eSh&Qhs}3v-$|#g?A2Q>cmg;$&=~0bjfETLq>%!DkvX38%J|ReloYL^77iT-)=M zESC4S(x%uDvC80CzE~mg4WO0>62AJQ*{wCu*s{r%Q%h?g+`!qDbsPW)`2jX{5HhaWW3ZOz7@&MvlLZ^6&41v%r1gP%C?sLRRLs?1W; zY<5u)Q!-liMob=upq3E6KqYM&&AquHgu~XhtgI6B8A+;Owh?Ta%|gxM*e$Nx8r4;w z&u(cgng55LTl^c`0B~!Fxk{`d&he%o4nwGNyf+ZzHmw}TSF6)W`fwj}^1W(d)O=5Z zkGNcDXR#*ZcUE{$p+2PX9>nLntnwJ(x>GwXZ<|Bj2e@hRj2-1+dKZ)TFw$G)HKSlY zEll_r+zKYEesvI3jd;pq_FBKY9rAWV9`{YO)B5onCRTYzAm~0YQC<$bmiKF5u*U3M z38D{S?X*0uldSUcus+oKae1ia{Rr49F9>-**TRI4!8Zh#GXS?9^6tZx`f*C4G~mWH?EXtJ+~M^*eY)iv zIMUc&h5?wo6rS!=h+M%2C5|-uzZX6Apr{W+h{bny%XgyZs8|_@t zocVL+n+Y!BToD^4oY~il44-I+-~afd0e|bed8l&{e*Y>}ABsWz!bR~<#>jVT6yJnp zI)#O9O2_v=wj0L=jTs&s3rRE9-I(UN9n27ZJl8W}JAPwlM(cjyQatgn(Tg-=5C+wg zt3Kw+^GufCDxuGTkrD5^8Q$+@MAHCw&RyHFXW(0}tmrNsf9O!@?!JnnBO^zi&D%ZH zHt?*kx7s-JQeMY*@;iE5{JF8e?O1ghenZ^7|G#^y-TbYx+SQ-7?6aNf2#fnv+MDU` zWPE7;m}{0w|E}mbZ#Dk_$`DO2gaY%f?s#lq!Yg~r^6yPs>OwJZ$%Xo$c*pT~p5+y= zYZ}huq#Nsg{t-~-sVw3fJ~}qYLotWbz+LTHcf*H$>4=%|D&i0mO^*ys=uB6iw6UJ) zf`MV%$Y6S>YYSer-J9-hORs&o5D}+`CY*?UB3DX*Z>v81>y3lynVGm&Wf{w!L_lS6 zoQ3rM7SR)aNG(*E@w;|(5jebk?yfWgHtS7u8PD?IMsJ$C&ZI#(-BWr)h|c>7%wn@E&j>Up_1);>-NZNnt_4b;?mUU5|2nj@8dJZbPe$Mps&LE z5BH_5F4;F#AG0uUxM-9xmvP)z)e?BW8H>BlpIh`N{}GoYz=dJ`O;fIA$Kp$*+z--@ z^h+H4U)MxjNq6-FNvG5Mz>1$Y2sqZL-uvafLd)SjpgjaZ+gJ7m3O|R3H9BDSRhu$}4z3Y8r z)_np0z~L6EFl7`9ru^xGDepGHl=n%&l&A6)oq5sw$w~*=+hKfxjQQLeCT6-tf=OQ` znCa|mYV}y5?TIk+r$|5N;H~wIp{BN0W0qd(S(e1s`L-l6Kc|}d0U`Apr}?O&PTeSv zE?UBMje#1h5&6|rXRKPM=qD4^0#rm7VUMW6CspM$swo}@ zG;>qGQ;(jTusOcSYRO%dnonuA)EUWFRu}z!RZ}sw`W#&`lg+7!`J=nl{`H${n?`@8 zP8z~!-&!>_w0&$96<|pf+nf-Aw2q@JmKs;ocsR+Ti_QLG9N(cJLz7}J$HM77%XqAZ zLe&?+G1|H+2p*=f^09Afr?DRq#N|TRjR5;9f4ZSQq%m9pZ{jUa(I(&#^hKfG%9CitvQ(|Q4{>rIYBbj+7d^Zf$pts>4M z!1*QVx_{74vlsrJ-$X5$BMZ*a*PC@ys8M{qIU}Z>8UMfa7wf{viC=nN*|~6R;m8Qi zb>d5((d_+d9fs4lr$;_d@0}6t^R#h& z(S*oBCY-sxKV9j8Vsu2*hhAgp zL08|y?RqkO=fcazboV~#er92o*&eJPs|BB@`oeNNb&2$rP)&2m!qNvyaEMQ#u!%}b z=Sm!qj+-}M$IY8Bad`2hpn0VwKpUI!`bu>*DI1&Tm6RgfUOI1H$wH%j?%Xn?wl-K7 zDlOJ%PVs_LGj4A2!uckeUov;DiOQgzao37vcYb1p5pD_K#St|vCHyfA`Pd`)4on*d zayCLWK_p_?lwLYvJX)#AXeN(GtI{xrj zx1>v|kTqX_<((@WsZDh)LTs5!X)Y>rlx}I&hGfZ2t^JFauB?Uy)~sBzI2l*f(iKbB zR4=Kt(M0=EBnVeh302GQT2t*`bXQf?lGST$vSG_gd?9Mt68|SwSFF5irH!~^$tV14 zmaJLB?Zb+LGjzoKd_>%nZ0NsXpOf_c%BsykON z@s~n{(c1Q6r)*X5q`Jm9FJ9(oR*YBYohZI7SAN{hKgT~xou=gSt2U$u0{^;-<#*Y8 z5%N}iJ02MTS^=Ex6V{LR({ zJQr8~u1B7);L6{Wh`VrA=U#yM8!3NdWBjLa<(VAfR$P68n{Z|67+;5Lk>LAqogsKV zuKbOSJS%Z!-o#b7mI>zX+w_bt#kE{8OoAsXbWQ6k~$I7W-KQ$?XBt^ znB`{K7*G3^3#QFzBgV5H=vcppaaCoJLk+4d_;bP)Z^P=DPT}uEyebQL_zb8j3vdM3 zCp=BSsw{}F2UcYP4gk*(o;!e5SrESvSd|5s&s3?h0AC8M$^!grq$`)SXK__!LHyqV zS4;d~;ksP#_mQ>`nCI5YaaHXTI31YzGM?pDZ4#LItM&%WI=l~_Jj{QKVCwatU|ft( z31@Cu={yDBt4)yxHVA^JnV3wmt@C;nPCYUyRQZVh^Cz!gk&M4D|>oLKs z2Rc`#Stgc~nCY?wGau^5c;>@$5-Ys~Q?{yK#8bAaUtsD&$2RjC@>cRMG2V3;qyzx!{Q?;7Y;#X4YE4_W-XK z909&Z@Hc?(6a25hLBTw)Qzw|uA~y)G0d5xjY2a4DJfA{Go&OcsgDdfGf%61kf%c?% zih+@x;#mr;>mmpYb`}3;z`8EJ224kp$ANX)w}ExqaTv>V+7-Y$?dO1XJ^lb#*JCad zI=>!~{7fUxSK^f}emt?{IBciS2l9|z0+a0^CSSwf9Io}Z;?4UPl9Y>k#TAk~64ND=_2QG#0+=ng zHq|sW_+_HaEPp=<=A*FuREVmVqyiEQ&yP>=kx^S2lRf8{lrf3Hlkz2Go2;}KXpI+O zPY|8N3>T1`l-qHD*M3r$m1REvi0419Y!W3Wjv|8i`h`+ImNAIDSeG~eGMg1B4=Z(*YN0q}HqW=|T&r9<#mc~OLS zz-y=F9Ylmx-dTAzjPf|lYIzh!dAPkOmxn;LU|zJm-w7^fB;1e38^#%2DG$S8Odj9a zV%2Xw0=$=Kr{ygMpH;sXa5H=hOq9pt_N1}AlN|CmhkOz7+G%+c9rC)d>^cV~${Pc( zG%J1vj*C96ChUexmPg+}{*59zJ)_NUNq0P$9NS6Sq7MXvSh zameGdtv=AT)B5dk$SbzUV;Qx)?Z8(3hLA3q{T`My<+##STjbF`TArGdAguc(-&>W; zexHyu<+#$_XOV}l7n8?#L|FBEJB5DZz(*a*;py5f^3YXc^4>#wtGsh5^y9lPtnzkS z@#wn)6%An`Ds}bjUl4O5=P>J1x)ekT)0dZUz(OO@=2Q z+x@UZ-g}UTAtvUuydOK{HA5c9XUdxjujO%!1FM>M<6`8Yvjqvnkw#xF^`YZi*(oiK zJap^9XFY?=`wSiPrPF+$1D~!l##3H1h@|U&&ar@ZN4$7oR?V!YjrY&?jrz>%{5d!W z=%X9`407`s=4`GrxFUHarkxqjv$2z|^j>AY<$C$O!{+-m-5>JF%-%^}5Q~phoMI^9 zNmrHjDo>Vo$OTSt)ZTEpdN1caw+zSMGyCwblfAN*xpz38?KCyA{O!S6)-U56@P53X zbr^31-h%g!?hirsDn71zD(h^9u{58rQ$M}GmO1j-+EZCdb-cGWJIC9P*IKLROx?%R zPVueSkK}q^OqZA8w#CYt1qyD&SnuQXES^#&r}_TU{hx4;gr3|SMa(4U)Uoj(GN zsMtcAEBH@!9Bfh}SlI>wHcNP|T(6Mp`@Gq~y(U*YJNse!9q#V*-kcoIm0QQ9d&;WN z)M6V0a-tPXkuP?nTH)m^) z`^a|(1`T82cX@rezy9|4L#qy1b%ty_bS($pe^Xd{b^1+TfRL`q<9c(lj^$*Y$Voq) zlkt$TTuP$y;H-J$E^;I+m80n(uafNy!WTW`i5a?XUz5gr5fR&ULlV_5ReTTN|z1RF;J|Aa@7%_7^Cdoqj406{Xme5lRDj+eb!9 z3-i^}>L=1CMACi?!p^UZJ#;>@|6g}~v-jnRV1VJ(L+|%*?K@w4jQRwCL5} z@2;4c{&-f^HO81-p365D=I@+ydvyN$!6NUuuKc}!lC!I8e9zuLai832ObX171g`1K zj}*?9o_PAHQ^R;Qdx7C;|8?07o@gWxr<8+Ib*YR~PxD(6hcobUd#JJF^^te~?)~2c zqia7K?OglWoinrAmu~&*3E{wOss7VXt%5Bydm(GObGZ5Q1D!!n=Ei_;W8m72foqPv zGP!rKeY<)eL1eJ~{%BWr`u)B5{KxKn#a-3u<7;bo{4`RSf4Zn3vj4lgwwDeWk^TL< zwjUefKKkLbh38MDzr%qwQaB5*wMT(&E5tjrpV|aP1Jw0+7G8Xxh9(WmMlV+^r=MyX z#v@^a?Z0{5q=Om_b}v4ah7W4=xXOli{nzQIwy2UG&w9jj%5Bnb+toRAW#8QX%AcsL zN&_>CKRfU&j5Q;&|Giz?BhV}`y(@4-Per6~I^JzwIHR*LQaF=_hF+2V-MgOIJ~Gn( z`kC{p@8UBhZh3M3Q=f%CpdHRoud)Z)+2zjs=E#o6MxvI7&32n?*>9#~Gu!MlLFA8? zco|0FiRY%?;NEe!vF&xwO&BjuKlNipJC$WtdUSqw5Z@%|48C1;da79^lPpz&GPqB1 zaEMjMveQrf=dgL3&cIF6-O0~BoG6^td$Jtj4-Fr8pUpBJ&&6vJ9?9OJ+u2h+nW2%Q z!J%N^aR2L|Ka#ud*LaadJ1o;TjPwk%{w3i3ts4!#e?A+M>LD=B^?ThX=Z&a)!|A7S zTNnGXsc@nY4TcNzyBDYm?|yyPZ#>Ih8Xg=OdFANor`5Z}Ga6N`FEAU-)7K1-j7%DA zKb(QDLmWjVsRr}wim#I9$N_x)h|>%Pzb z#9QQ=6u4%ZeA?jY+n{e|$w=?X$%lrS0opLKh_1Z>9W5I4y*===V7$#;V>Yg*Z`caf z{^3*ZH?uxe#mx0?)B+!aPOz6Wu!-lk4fh2jXjuEkMu(q`j){gL{d{fFW#eBwnXdc# z=Q7hrpntS%*Us_%5ZxJo4#m6jI=46P%6lYxe6;fkw9W%Y&z9ZYEt7sUasXQoM|U2( zsr!lD(Sgnbc)!W(b;D(W!|whA7zz&!-mqi9XY}IzBw0~@UL!i#u`93p^?ltvuaBP; z4el)chm)8kAW`4z?N4Z)?fd)kp!XrZ2)}t>UNqP56XY zIp5LQ59KohldLOG>(k`)ty5IF7 z+O7Go4{Z8!TOiZ^RmY3*-3PWl5R9}1muP|JVeKy*w)XvQ0L}B%)<=~w)9ei5)K)Ky zX!qyYI(POymmFA$cYWkFecWRoyXWZ0vU#qGh2@u9TV_k^-?gjdA9JTgkXn_$vdx~#c=X-YBmNC|j)}EBJ|GM1TS1-PIkB+`a``Cj#I3=yl zx3yV~6Pxv+8~Ln{6TN9^!DnY7$M$YNYHe+Xp?K}idsg46ep~1E?gKuN^rH9YTemuy zr_ktSamtCqHMRSaATDd_H;q&s+4ZASSXx|dnDZx;e@oo}?dc!y8_~KQs}0X6m&f7q zjO=0=3akD-sn3}o`|!5N6F%=@A0Igo}R$GT7&_Hy#UMFuApNvKBos2?YH zJ&(B099xOGMf7p&m(6+!o(Syh+>W;y*=?`-@Y)?{pWM|CMP2J$WaWv9V`%B#v^2T+ z5^TnJbKfW)Na|@ zvh8e--VAqfB7iq;sT#dAuzgFrwPgWDHGCWPu(f4^QS;6!Ep!fPY~FgC-#r<^XzKt9 ztMjwN%nww8;Pd?>Dh~AgqNn>aRe0`GXRR!Wk-qI-k4o!El*#;KD3jd_jX*!L_K)x$ zTL!IAK7960w2=?**(JV4#&>kU8)@-JYQe~eu1ITdWYo#X$oC>+&O}CM9VmMCn=|>^ zuz$SwJ?*_`zdm`5cJkSCy;p0!&wkalRO@>7-@&W2;In7_S8D!ezw|Ca3&tcFQ)O@e z+18bqb+23QjQw4}Dcw2Bd1TWA3mA(%w$44l|9*V^|s z-c+W>>%b*#-6JLKKka*1CQiG5*q1r*KeS-`{2bV|yG_}JxnGQ4hesgmuR6KAUBu_C z%4EH{!^7UsU~VK!F%hHQ+KL|4;y*hYtqVi#{WEiW*H0W?%X#g6_a6{X^zwm%Q@+Tp zzv#cD=-A4m(JBwSFY!el@wKY$8CLe_j?khKfW4*e5-+~6d|&j ze?MPs)AWmkZTp2AE<$vFSNJ9lUsT;E$Hj4O<=Wd4BPfV)E$)_Yn|#4rhIjnsT?g$0^# zk7GlEH$BClJ{q$I&%nUVzB%2)^=@d-J<#sU#@m(DI|)ahNuTKWd!jde{J*lSEtg4G zvnSZHOgoc4es1$zi)xc6^bL!cCF>Cfl;>nw`_h?h?H>MHZlAPV?a#I6@N@?MrSV@v z)50FStjL4<2$2&1waO*9?|V9LyTD z@I42OpqMe;qZ~fY&KO6ZaY4l)K|f;%*|{|d=fh6ZxgEe z>>HJOxGk`VC1^|2w6f%bzVxyzzRgix#`<~1g{rWbbgY-swI$6192WzjKIvfWCtR_jmnm$$D4$_`b~pX)H$d&zNzCT(wUgA9Oz%uy$q4ICNw|S4Jl0 z*@wos{JRo&_|EM7`pha#k89@$#I>JGrGOPLeuJM)|K9WHh5n2gr?CtARdI_&+jM5^ z=`$HK&Qv_9Pe^wmU^4zHVnIVrcZw@pww66 zg7iI0O<}GU_LyXhYLlGbV#v|&d>{Nh;~ael_MlZtPpCcS^^#bh*Ksz^>zeC0J4|oM zXu8sp@tB<6l5++I{I0B^Yi5`0(pFEarQ^cKN(0 z^*iE3fen@2(+8utyNZ}@%euMN*W)dkdq+fJ#aBM7-xh0+u_te7x7;1$cV%w#J?35gAKZ?*u+yNHeSgP5`!UK6Z1nge zY+RL1FS0%phzQ1N-Jc!WG4bVgulrD2U?es`miOnpG2^2&6}?1vQw%y6=&w43jgXf3 zbuqUkTPjZB;sMxlb=>{$kM>5`0-v=7+>Vuz{Uf>~g09&}CoTp?_=~b|(OWb}wcSHI z_5~{r<)>mKMLce$PW=w-y`Pxvf!juK}DwH?MdRfyKe%Ea8lIUf=90f66 z*X$Jqwrr8dW{VunZFX+KursdN_I|G?UgqN`)L^BG4IxA2<<9Q)YVP>*X0Iu6e)pj( z_abqD5gR<+5j!4eo975z;%L{T@Q{Oedu_!*6ru|2DErf^;|gDkL@uBt3$OiPFwIIB zNK8GlXK!L4!Cx@E%l)Kb0Rx%~(U5ejRNEt?qx7-VWb--ha88SqhVXl%-;qlDJ2_YF zEzytKmT|Z(IbU_7CscoAMC*0&axmj?uqe@6dD!ck7tDCNE8|F4(Y!9#{9w`iuF9vq zl}Akd1J*v>9!%AI_e{h>_E?$v7*KRF;YNjC_wskvh zHD+0N4h&p3@1kW__T2wIM<3_B4Y2L*zG1zWViG73mIn zepa1eUQHW#ykL^QVz6nRNIO3h`RB%U-K+Y4!7%+KSzMlt6CN+FRoo_oJKJKJJL3*( zQF@lC-Oo@d!Hb#~tIcz~tULlQ=Wa`m@~eA)e%$+O@9B)`ii@=;?T=lYV%cw7jz^Nz z+f{qhXLc>+y+Pca<79fNHJCoHD}8=%`i!onk-??f<8L&cTpIKEt6!X48qK${E{)>c zeQ5;e?n|x8i)Gm__&U<2g9#l^JE7B?J_}*OZ&!MvV}5)v{nEYLd($&JUg<#{`{OGw z?(9v^dhu9q`s|L!diEX&rqAe&(@w@&n%+t1Iqp0eXVu22@>B7szSCPiCzyUo zuVt3^SaMgt+_kDWR#cv~tcCBX^{3Cmk{BzLrmaq{ik4Ws=`;Q5m!cSMzCI9x+mmIZ zXSmYm8fKt+YMNd>)91xFC-?lJ4vz_>VVARR;JPmEis6T`7{VN^bO4x%_-(i|Z)x?k zFR#q0OvA0w1Rn--`+QHRU(??qdnSG6^`7goRAmBX{-vg6-t@UQV17Lp!O@+GvNFu+ z?fAPruIpE$F#_Ce?~m!V$G#JZ+fF#8IKv%bDWeJgGx`If56jPz?|?Yq!&@6 zE5#d#D-PCGJmq&k;jifS2b*^I>I&3cj&l~qZB={NURPRbWm~}Rb&bP~sMIBG0gIhu z6vkDfk3t-(UyR4d#Qao~o)`}aK}2gQx0Nmahe>&eO#$nfj7-i*=N!YjV`s)GeXq)h zJl@o!izyg>#FS)VLpo8}*JM*oC~hIv++EW zob&geG3Q;9z;_GJUV*J-^njC&p<=1JlEWSlqa#rS-TEbQSl-G^JIvmJ-6NRdCIYv;f~ z$6obj=z>T**T5gC=g-qe@g2VIt`tlLyLgu&7WbXuO-vZn5 zQsxBJ(jB=MnA&IGG|Y58dO@-j)iUY~W68opAA=p2T*DG#OzN=ZXt_~*LZ}a`(=7WK zoa~KuTp6hwh~m?;snr29y!kfVb(@VG@@72cSQYh<%{RBuH&8h@dW3oHk$Ryjg_dYm z1CxD9iV*j6?q!mv>1|VA%#J->RQc49z6;gmymNF+toP_2uHr0E-MheT0{t!XxQ152 zzGIhlOH!0q4c+*?MEmHrpINgDdSF7+W)3dchikgmc-eWbMGx~?nIkZKDgq z9(MT9BT*P+%Cd&4seVE1X`f-NWQ;y4n)6?k^O)KA&zaJw;Ak40YS2w)jD20dmF z^-q7X1-|Zuiq6_$VMVt^qne;bdRc3oU9NPy%|7u;p zY&y$_E%p4-(~unJca8DJVo|Ts;By9JRT^TAG{j08{IM};cD+c$1@=5|nrrzquBX4}-B)@(9lqy5oIHNGXTiVD4L@{f-kt{+IQ|}i zwC=y)h2&TE4|nYQ8p#~!}C!Ur_kfSN73ba<=y3&S3w$_F;!6TaFJq>2hN&(Ocxkg>82> zYh$vpMS?4L$NF6vO|4GU0KIlim+w@vj@1kQgAX6`kab^Tf_}>Xe$jbY+;)?HUVl=~ zUl;dJ;&Lw32j=^Sc)TJmxmdz46Zd9ujWy{;IjygBYFG?&oeh69pq}!zfD|+l*fFdT%gloV$Lhe<-E=$_Zp06OYSrnJ;PH5GcwcB zEAroodoA2cg)`ue5iS$EMi}Xm=PR=%->wn)m2y6Nr+I&BJ-R;bK6+hK?a_`6yjc_) zw5#h+t^7mT(E>~Okyrvg>dW&2^*SM`mpof0<3|1a4m)A3jleCac zxTe-TeO9gTu$EioLLY_yxkZzq>_}GoH0;N3ii75Lo!00HTwiS&xfQ2dMs9BDu(Dr@ z<+S+((mdYpn#h~yztv{C;vEYw*>CMi8`+zdbTTdRy|e@*-$zyen49Lvf5pO4uh>5F>L{df zSs>o=qSd}+n=jrTi=7_iAs*0%;r{VYs3O_%xgLzZzM$DJm!;&D<@Is^*06O zDr}|Gq$3K#T zdWBnwX_#T3-Ojn##%;f1ZjHg5`t+`xBl~u|gx7w(aCqKz4r|K`7Fc60gPZIoyUuP$ zf{_L+;+cx$Q4COvPC{$E+N=jHyMubs>dOzSn)i+@oUFCjtV= ztrlH2-$;F(Wvscl{_;j?Ykf}dBF#Vkkt^H%#gDK8Bv_1E{l=+}_|Ry66w2U zR6`X=`UBOXW_ApqQQ;;cc4Qruu|*mC9c8g-U_msnBUY?_b2EOmBIB3ge!YnWTkg%) zrGs@T=t}XrMq`U-yQb~%p@#HzbGL&xk&r&sx>gkNPOIJ*U{l6ir^zXlk4qAF$vcq$4W2EcqnlP|hDkOVPetoZ1Rx#b5HgmJ;Z&Nn4}iE#8Uy3p*EjCqA+rBh22O zGifRRnrF>Ft@%CZO4Hdy-9{4~%#UcRr7JC^EIFkM-HL1cmZx(=iy0{c+&D#Egrz0= zl>z3}cyvag1;@ZZiwh4?L3$=_j5jTXb&?${TAzw9M+F$E;TtoKTP)rwNkx_tZu`Rc z3@x=_i-TpX5?+=ZqjE~mCx6=5Epyj~qLIF8IbP$G=1}+T%0^$0B)5&U_U#=AB-;Oo zhw%CeEcPRG^DSQYrH*bbup*_seFYw@iT<8$W5{x4TlD9MIfxlN7SIUx&<@@uJZ@`A z)BAX9{?7)YXIXktL{c+QvS09tB=fq_YLqNOKruzXF%Yo&V;wiy3M;=b-D6N)@p3#A z^XdSaR%eoZDasc~y*m>A9P<)PYagW=y-Bk_<9DUJ^kQ#O>Y*`~O}?$I-l8#H%Z9CY zd5gwQ@p+3bLQO!Yh4I0gmg-L%LxpkPw6PdFP|vpoxUU>^jm0xh`d3%D7{Aiea^*Ls zxcXcJ2xW`I5ngV%&%|C+4>_1NHt2Ehwa8OXdbNg`?AE@9f5gSF{#f&8X(%@)=x_$> z#1tu5YhTNN{q~2j`!{BX4~x!}eZc}P^GLkUy5|9F^Z|{ls4;u6B^Y=5NW!qaZS#Mh zvZLiOt+kmQ|CJr+OWhaj%~4|$SII%Fl4VsrtfSJI)f^bnzT9uKVYThG;j0Xz@G~?% ze1(Vm+1pk*SzJ>03)UZvM0sHxUVek`U|7s0gS<2aO8OKb`Y`&f@RXvq0^yBlE{tB(T ztMr$4?nA?_VCjCx&6Zxs(#Aj+67(1Tv=rPvE`3CA0dwsshsH!6k7Y;p%t=(c<5KNf zckB-qjq#(=7NvDrHXM1T3zhHbuA*^WMHh9YjqNIOb;Vima3*paE62jEm^;|Yl2`b6 zW6yn6YQ>iJeDpB(kK3{?M;Gk14KGW+)Sluo(y0bu8LME|O>y=qL(-%gSK;>`<6XbO zKG=StN-`6I9>?g72K%>`+s}m!kES}%_lI+-8{3kdzFhyVh_*oT8CRO#qzC=8oqq6* z*EJ<2;4hluPaC-=9*+}X$hMvKCE$A^ zE&Xh5Mt`Aq0;os7HMhY~*Wl6$Cq`5p^Bus**LUeTea{>n$Mk7v;Y2NZI(JHp zFryP$Lk+u(uWX=+wtS>NHE7g*7>snaaBxfIUW5t|5>r@8sOJ#SJd;|b##EI&Pr4`gwKHOiB+mQc$TtTztJIoC|bh5HQI zmVtpDgMAnqh3^)3mvIg2w;cv!{dK>vhA>YVj0n{pp*LOKDoJ1t=r?#AiP%D;`1-cw z%hcStk6Z4pN#m@2nb_1Ghr3$jS^BOYiYylIAy!J(<8 zsl9z{vUilUC4aBb_TQlb73*O)?v&{_b+0hh$!5t@b^SZ#roNC#)iw;?){y(1 zG$rib!;lzQhq#|MW$Im&v)Sl3#^o7CUXL{WWMPzvhnqNF81-X4zT9Pv^;sR=Ha@P@ zug|R!@Evi{7ip$vtCq8!s%NW=?V?5uvO)BN>_PSY5{H%aeH5&>}!ZPfcZi=7w%ru?PF|pP{ z3_+OPIVvvXheO$TlwHhLb{!s5aTL{b`?aq3L;$v5v~HOtH9zyZgUGcFbeb3QRP@k+`s|&k9Z(;-`-&P zxM2B35blqn@CYSigXO8^$(Bt&xuMltJ_flzB;K*7Wv>?-sJz>8BmKRF#m^Bu!omUD zJ|E)a!_*-E(o4NXV=>6LA-Fq_Y{lFXg$Ms$S0*R0xaA*@XW{0*;dhO;&$B;me;ZZs zP7H@LA-J=B(^mU@`|5XWCyQqIi&EZt<7Cn7lSP+4jaez5UwcW-M2jvu0vFTK)P0<~ zvTmsGosI&{<#M3|k~>Ve2W0x;h&bUSasMTC;S+IH7*orVhnv|j%K!PipA;*lg->qg8tUzT)`?l!M(J-X%$}zv(k`2o^?$h@cZ~2z%d?x%!Lyq=FFR#n_QA3Vr zzk3ZvTK*_$``DDmIJur==oxXt{aj=RME~dF-YfDu#k~V=k+6D}9L>Y=0`Ac1JB3F3 z^r+Sqx}TQL5*aco7xYhhg!hrae1ZOLlRsE5J}erH#@ z({T&#EW4T}6gyU`d%h9JS;7$E0eo+{3mO$3misXMW=^`x;Y;zRJ16_{*O}J^eFw2+ z*V>H8Ti4sIsT*3Cr&i#rKD#1Y(V+(xY^vS z9*w>!uJA9T&|~2SSK;-R!1A_0y!l!wuLW}20&{(f18HpmYfFU|NWhL`^m_CpSOPir z#&Ak7K?~wOW*qMBS+SZmjk$dnYk~B#xg#)n$e4NmVXbpc%8|o!+9q40%QeJ?NemVq z>EpcRPT#1&j5c>H?)r+2?5S*=RZQXRB8%&HBe!AoeWRi$N~DD^MPgCi-HZi={Yv&V zFLk9)-t)kmpe^3<*T`UcPT>u>^Ek{gIkNCeF8%n_1NTuP>{+d$qP{7vd}LnXNJk64 z1Z_-qSqs!d{i@TPlsq9nOEa}wxoA)6?cnzbRmK*+G@Qkp@=^XzxOY)L6)6i1T2jk~ zw7+PzGslgWQqFo+KY>mH;Ze3WBs*o?Pv^c4XUmu;1{Q^aW}Yci)6@Vl{}`&a%-dH zTSi~bV#E#Ef=hkPNcWI@f&r=ht)mcsi+Y;UXm`!b5t;uF?UUpwcw>BL)AyVD2A-q; z!;|j#jS(Bx@_cBoJ2CZ{7pAP~c1@apLsx9P{%w)*F0Rb}O0PR_?a`VoYk7Eo`GSmG0efa*I$~#2*(m4(Tti zHp_5rW!U+ou=Ck+K1$r-;@&8(S}TMK8NW!Q+C~)1$k7&$ZmfWJB~;BDIwc8vR*zq$ zz*Ay_s>V}ds*dD;9-5_3i`#TIy>rsyuKB9YWAU7kkTG;UfTv$!0Os(Ri4M-;RoH5l z7M+Y|WAXT$qmw&{$~HWSa**FJG|D~SuHoyj<#Sx+S&m+`Vm!K}e|Hen zvD;}6OMd8NS+{3!vK*tEq_;WlWDZW2#Sqk2N6;GVU5VK}*2ernh#=fx?<`#q?9Ik$ z*Uq)fHAbkd3Rjl?U?yo z%4L}*2i+M&nP>s2^&`;J7>BUDfbRhaqh6Lz?yS#t?yx- zQ@{8@GdS2?zZ~07Y1ppz_RRIn>At!$$3ENcZk>Va`goauJ|VY*I}Dr7wpuX$&FD{i zBjMACbJ4yW_|HCwF%fm%x7_P~1c3xRZQUuu%F3c&bK~(MbGdVQgK4X&KB4bq5XKx1 zX~u1qC*tis$6MCNJ9{#p%~^aTW82f2^X9$Oi-$(-7x52x-TY zJ&WhzOBY8Yu}AJ$Iq*_fFMeTVeD#$!E?Yad^Ykmub1{yx zZ+frN?86ox>Brao9A8@SdkjZ@w(Vy*JN)==f<2XY_ut<6>ONR>+rbB#K6w>9%;IR}3{a?_b$$G}nB@z|5Yv^@`9lJfMhR|=)k4Kg31#n^w?SJ6x|FO)>{9k@GTfZxMGu!l;vT`f9>=7#rmLpGF**uYMwY zO5FFweM8(r@q;-eHsLVIelyzZb~rXfWA)NHBNrQut}9wS8S8!PXS%a}>+9U(?YSPK zPeHxvTz`}+a@L}`+vn!YwPdY75xQ3s!E0wdt;><~3;J)%$}rt8#!nkWX?Q|1)Okw3 zBX#QfG;d^tKax)~HdQ*k*k0_#_Eq8xy=osmRgB%qb)EUPhS@Xtc68ZSLFPn z-pk4l-Qj)V+1Bkt?w{bU(X< zWxn_`ky`8ajOL64AHvepg#^d+d!U`QJ`GJ?HBZ$yvQZ)mRmn28XIRcWw?MypqwiZp ztXhr)?~j?h`HXGBSNCs7Ydeza+}h*qKi^JtmiZqIOpE+-`x1Ffc8h+apAdW zw%CZEdlU)^H{N0@JnuvoOIanx zeqoL-#S$HlERB?W#9qL0j$+71wJ)G{6B6Y%kIdPSL6K;MzMab|dc1w_dl#j6`#$t8 zO7caKby-+lfro>srHe!8JkRasQ$soOX`^m~PP z;WK_WxpG};owK3FIkCjKu3pnmOE=V3)|HlMmtF2O|FU#(MQQOZYwAjiYwAig-EkH* zmX(#(sUJbC_0-ju%H=f`rJfSV&E88&i|aPlHmrdcZNX*V9Wr7qtyZcG9j`ZbHq?2l z>&t5D);aOB$hTIOl$Ow9QBvU*c}kpO5q?FwvAChJuJpT=OA%J7;eVd9rm>;6vB6pE z*;rNMDbZG_1Um5>*$t)D4bF+THzKwgXO*X}ymYE_oo7Sky2f=BYYUg;X}Kx`2IE4| zM#wNzY{Jhg>;7@6rm?(2!^>k3B^1_qibI*Su4GLG&ev?%ut8f==xnUVb$2DKsH^r= zWekc`cC4#xfd355Q&LjdP+0>FXNjl5qx+%}Ig4`gw4$)2;)g1$N~@ih(fp~-%Ie~( z#*#|B>n77#v=Kj%?yM<8HXy|6@{m=+B0*>{+$>W@}mQPWse;;b&k zPmE&=ptiQOT5GIlf{hy1P=V}VAzYoaFdfBF+TfYSeAEgca29*2iW{pu%wK1jr?Lud z0yWq0%i4*`D)m}b*8i~{nj3)>hMQ^3a4vA7*;Q2*S2nDvymbvri5D`Qnn{gX$Y|3= zsVCaXoW-i>zqQzmNLg%Qp`kjvot3vDL=_wBcky8GQ=BtkncF!<+2%xK8QMC$Bgs=< z>QuP~lkvhMqaMo@1mP^HL2Y8SU*~Bkt_WEbs^3G*m^e{4K~kJ{nKLuwqqspe3g){x zqml1rr3e{y7!66wMf-15W}ya~J013MMU^#fp{v4gx-b-QQ@2(PM<{VqD?X_xEQ+{VQW)f+=ggN-G4S^O=fP6kMcIf-}! zRcUp}w}{XQS5?&@LX~b!4<1QG=U9y*n^+<(s|cN6O?A~q)v#_WMb?NHeF!M4YOJr2 zPLjniYIb@_w8CkZ5&i`bC-nf+|P;Uqyha|x;(=%w^ml?DPIS>Sd#{e#>ffx#75`k&WVi~regb+(eSpq$_8V!3?B}|jYgW3`uVXL zgH>pNn&+&qyuDQK-pxZ*9^Q$4zW2d_?YsOn)}on|u2DmOed9Vc(2IGhJ1tR?@WgzV zwV{OQqk-~kj4A9*QE@mD>sRNYVU+WI8yv1MS{d(SyUcmx#Kw6O8*f5qWg5H*mVdtK~JS?Mp9JT+_&*)p?s5B5tem)GBkz(P7k;uJfSKtIOBOoL~)_Ji80_ z1=_U@l~q-+NLr8QRtyZDqN-AKMb6^Jx;jQ2Qa0C6)o|A6X=IV>xg=R}enn!LVgRd? zuH`%hl|SsOWi&TsRYiSBjv9X}>U)W)@TE2);?l}nQLoDy)pY5+2sj(4XXjB}T(Y`!xs11!cp4h(k%^e-Vail`Yh_JiJ$hjk zsRYAnVm87k%!LcDHF9LC6J>1-OnOldxhnHmXk^aZFqqK`VMuxDLN&R&7K1o*z8+KS z!FmGAq=HDHVA_uwaGu9$uy9=|YlpU^yqY8Hc`9fb%=Z}=UxI1%x?1FRQ6*lvvJnGu zNolBtda6q6Fk#RO+LWwv6bnY_u*=Ngc}7>DRn|K_n4&dc8azbL=|&%cp)Nz$D6XnO zW}}=d%MiI9lYRxu47A)*#8s(R1{KU;el?=pWv-J`%Xym8%HvcKy_y;*hD5BHL{*r7 zR$YdsBQXM5uqF+|lu!p*tcu5}PrjY?h~ zHKTHKE_=SZkp>Kvm6(6A&8lAZHq$DN<~q3ssjMzi&63@rrW&LgTg`ng^5Huz<5E>$ zbYkMpMaevr5m%p1%xo}w@f6>pqQR=L7-b0s)k?#>sL7u0uigoxVe|R@^tVK%{DrdE zNcVX`=plbw#26rrdZJG@#dy@!qEcp@*p0sCTcSrLRkQGijogLcS zgzQ%OJVW19Q6K7_YHR8-u{P$F+F&qT>V&3$Q?aONP}BH|8n$fC7@fscm7J7SvaK@} z)iu@A^p;0r3*+KjZ$7L;=VgOY*`;q|%2a(0)!>i>aSgWDAq{|S2d{BLhhZcsRjcLSJSV$w z&f!9RDCVXNM6KS8AY@)*mi=GM0W&vD+z>tmWOvLt+K|)_%`XmznA{n0B4a%zu(tsv zT{4)*7i*F%HKXycEh0}<=QVFI5lj*E^jQ?DjJ6Q(Rl^usXN1l^5c68>kg;#7E3K{a zY(zAA*hbCarV}@@pjBEDs?8k3)qJEBGd$P}146x))TAZVeA_UapyAtT8u_(+eOhN! zMfQB(Hl3S@-bf<9SSxF+s@kZbL*^n0bPX59p>D$H10i7-2Ez=W&S_4yca|$5eTyIL zWEEFkjGmj-Gvm8LM)hW@k#A~68nQ&iq;g1&oMK>N)g?8zu`y0#HP(~OlK9^Qqwgiqv&kbWqF7=S7-!$ImXiUq zbVG3|`w~_KOrx+LHH{kr&Z`z_Ed3@(3kT1GFmqpTZPVP)10c)E{*&DJzfts zE7#Sk1=%|8W7OAru%^IZQdU>0hC;*2uuQ;@bgU@#)YoHriJ38SM6Er(Er--DnyTYP zl@04WwHg1fVF^=fHAgYR<{c6t^ zb;VeG7`scxLT*TCMp`GvTATMwk%X(UaaM-3417K#m@6JjUJ!tnDct$A#t)c4EAp3 zIz#dQ$6cI}(JBFY+@bzDlo=Xk!}XQi!qJOgc~ZrXHi{h$cDQOkm^%Y#eW+PAw^TwK zV=?z#e;SQO}w_1*4ojauB>C2N6zC9JuRbYo!4^FKZ)fmEU+d|A4$~LZ$ zy<3S8D+d)MrybaiR%5?f-(zE6Ni^L8U40(r4ZM-S-HZoQ zx0({?LN(_vpkbO52WNX+(5f6I7=0NwcDPZlqEwk-n1Xqc*rIkvHJme}WCx15Z0ytx zO@i)!h*!ys|BY{zTSI4=szi;rSaprNBdGI(iyBi~=UqM{r??xbcZJ5y2)Eo~!xjU! zSV|-=**6@j`)yNZ=qnqYx0lw{Op~79==1e04g@-w)SAXR_G?&{;6569aE_{>oeb2& zP)*LOxz>qM7qt^nVCZ1QGQ$0qtxt9_#%0|KBh7}gKFL7mjq)ksLVR%H88VNn%4z3! z=GTQi0>lE(T%ASa^AFLVGUB9b~8|X-g>L#!`s&652 z!ewm04{8tIC1ESTEo5~ps>k*p@}~^_4|e53>!+ES7tgqOhSOcq&`?`HZ~F9dOyL`g zE=Fncj=%0@dR5h}>!x8Rfop+_q2c6%0lLpMGc#vinwd3oZiXJukpEfo96p7S_!^`6 zVuTi9KE)Z|!Z>(DX!r@3X#IQ+UXo~4Z$va-H$7Aaam0DoM`%}y%7qsCA3Nw->Eor5 zrXxb*n>+`Pi1YNvsrOD&qY59ZHgQlH6rqg|I}g8}9(H|7*m-8y`7G_%QM%|BI96?* z_Gg=Z{sVP>xqc%5@w`sh`Mj`mzDaZNh|t3QXAfQkMQC|p=LOpR^6Z`)SFGA&+WROM z9*gm@s$5a0>R*I<Vz{PpEsk@~p{@mjTG+E?>OWcD*C) ze0SLSzOZxV(%=!H{c`XG6rmjmJ3kn9-W_&+B<%c|u=DWz{!Q5RV`1mdhMhmBJtF1D z3#{trr2S0;Cu&hzp7cjk)p@LTt>iCGmHtYp561a?x!wqWiP}i*mN5N?qXTkL@b|Mr)hH@^3LHYfaxxR`~@vkLOhSzOOBk{7Z%`QM+CnEAh`#=c~0V=n2R3D!ps9Z=`OyHjhI^lw(@_h=V~ zmFMrm>T|Bde^8a@{hA}JJ$)wSf#6j8I3)FPva;`CjL`Z~4ku9yYOzwjlrk%x4m)2i z=a(q`Uugd!?R%m+@6`Bi1RnI8sO{BChLqp0@BqEKtlkfvs6C-gl5<`EDeY@HH^QK6 zVP(g`q9${!Vln{1b!eJj^ z4u?g+xVFP(x-8$rKOC&n7Re8`N9sHR*GXQ6e>f)KV_B|HbCaQS2<}w!3SFKl^54N_ zbxNXdCFp=#9rHyRYWGCDb;Uu`sJIZNSy)Yb& zGX%Z?q=aExc3MzfV)e00^BZPIGCyE;V=)L7IwnrVU(lFbL5X7Z9wJuQvEvZ zv#^rjV7SzO9XcvMr7Vm*{2S!7i8||1Ve*830cLQP@8cg121lLeAYUy!30xw)7vWS1 zUk+{%{wLZW+eVVKTiQUbg*!!ia1z{3 z;bge|!YtD_h2dy#3$KOyXJMx4Jz+cCzY4R?6j}z;a=ow<^3}o1q3;yF z63l$G&=U^kBXvBGPbHh{Ff#`S(_>*J!ol=dZcwPvKBM1Y8W_%RU?kIE^f}B&%C|z! zyd$@PnRgZr{5Tj5<+~wg8IWHEuO(9vM+rU_Uc^y>4|URDa~1g}O7(hg;oyg(0Urx1 zIF1eYSk{v8J_&p*9)(&H8R2|}xHglEbh%IDOCY~X_%+0}O?WiQ=U(At=mdnF;0MXY z_=lqdABLX+`D4NsbgGXF{~KXGDZB?92R7bQ7B391`dDMr``cM29geTmXBfG{sc;dc zlH1`ji>br#ZV^s``x{|6+VjFpw`#x8=b_pxn0fFaK89_d3Ma#Luq}vwsxZ@+E}RX{ z6J876AUpxQO&F-%FT4%hE<6?dr0~7q*M*tiQ&0wsm-&6UFi^`A?f@?qE&wkV-VMH0 zxD))4iGM8&v6?e7e3siEP4ahzosbVhnNf#n;hLE222T{G{d0vg!QT@GYPSfpJU0ku zf$tVx0REY9Huzy-ptf5$56pVQcniQUnsiPGFNORs!pp$l2(JVWi`4xBwFKc+;0eOC z;ZhS{W71zKyc#-dgx7-E&S_5x_z_{C_H*G1aHlYB{=G@(FTz!j;|G>iIJMxl!VO@b z@CNWv;R)bRgg1c)gn?QV#xdH{1hxq?-gM#3;CaH#la<0uI}f&B9xzSu-{2y+(EQL& zmcBP$be6K7lBF+olGoxN4%%w;X>KyYzYqGXD@LEpx?*8L;FyKa|J3(pQwQO^jd1eF zENC1|C*{9`ob`arw#Cb2jth*2{3_}-%hKp$*NU8dY>6<(jtXIp7c3|GT@S7m{yD;7 zIZ@8>ljTH?fShGRX8+kF%)QLbWJZF+hYxk?Aiql(U*-+;l7P1}ge+a`-X`wtG zyhY@UlWTj*li@xfd@tOe3&YVK6=wRL5PlHuE5fO8KNEJsbt26Sa{_pVFi@K#>;_*Y zOuuTr1brv?fJy(DiT`fm5y*FjKNb4pg)_lRglB;Zg|omF!VAE)!a%*hML5~u|1iln z3$s4HF3h+-G3lHUZh)No7PMyrI7@gF_-f%M@O{FY!JWcD?U%x=Uk8Nqz<)LAL`CZ1 zQ(yIsi0dx!6q9_0@KVU<3NvrBO*;9)Y!gi;d5iEW$R8434Sw9Db5M9KhqW+JBoEsQLuDyvF_^9yZ#@EC?J)_)vZq zhf;R$ee3A^EbEj$&jnnQ{`+*6|8Cdj7=F9k0U25Py& zcY&`I_JMCO>8usbhP+-l54^>sbGI<<>@dlHAzT3YFNGI?pEBt@Elk^95N7_oX43hi z@G{8XH_87h%zE^>@M^G)eIU}#yj6WNm~}+0B_)5B4ZZ!>!91 zhH4AY;jtDU>N5-;MqDaav7K0MR;r;j_y{yo)lLyVk2rjiz>JI8O=fuX zOJ;aXGnukU!n8d@nDvTBxIG)f?4cj(1R!UaS=~Dd?m^NnOL%&Ry>Z8E4cb>?d za32?@y+?%MXh((JaC?NO!aXhwM|)K`8}9FgnWndd3*i2jFdXdz;RSF%7G{`V3&Y{7 zoRrP9-O4r#o0(^JVYV+GmUX&|Y}Aslw`UyTWtV|U!u&Gotx-jLd&HR^nrf zYpco7`4enJ0hw1~E>2u-3-zj8rXtVK~h0}%O;m#C>n!axd$Obov z9FD#x40$S8&BMV?un!-G$-MceF!RI1a)F#jiLe`7E=*f)7pA`28x;NDhB4KlJS^3^8%eI$*+#xv zXH+3AiG_>9jSrc+%y%+%d04WQqpn%l5OFBK@<!302bKZjItBd_;g`S_WSI}JjH%;8 zyqm}}{%#ie4#@8keiR%K&IWf1CxcZRcR_$dwQ(@>I~kuOFjVxu6wLfsC2}}=9}YQ+ zSlLN^C-`Q3$Q^K5UC2Cc#fQ8b?nYtS(jp8;YZZPB?yrR>!0i{_2KR(89PKsXd*Qw= z%(SX|5QytRu$qsF4IhgR>&qv?NpL?GX1X=@70`DBUBXkr>i&X+^PtExA%8@87Fdn@ z&|#Sz7dcSlvmFex3H*EE&EU68I;!u2&H~6!i98$pFX24!SHcD0bHYo(!>oGvtWz1n zE5Y9v25PH>tH3u3mw?xqbktnJrLSGoTmnp;ABs)|_$MZPpKvYYcM3Ov?-AYr-Y%R4 z4hjP`?)frLR)IT(SA)AuI!_7vAXoh=^zQ=murP2Oarh*SSE$cDCg{xnY$H5u_>iqo zwv(A@IFj(8dffI4Xi zpJ^k{gAVhNd)zc2+nU?nKr@#LINg6b5RS3NHg^2{S*gHR-5% z0{mt}uI35gJg}N?gA2fFUJd4Phxp9`Hwm*Ge8O(<&rIQ~`-AYC3b|^(U?+H|=rE5T zH|akiJQebT!Yu#8!YqFtmaBA^`EJ}dSN$go3Wu5lgL$0?%bEwvhRpGTWn1!aXg2Q@od!_Wa!Mq-0NN8YryZ5We)I($e%*^ zp9}v0VSa5e^f@+JmcYefBO}a>(1{m*1e_||3!Wf+8Rk`P@^am8rpT{@e1UK|n9pu9 z%pZZ53GW535`G@c^)Gea1Xl?!KqtnzI_2L$zKQ%FdR%OqmLKVSFL{&B4~qUl)SunL zXTgsNyHSq3kIyh426vOM)BW~{{LxX!XR=$DzbbP6-u@fH-@}CPZE~Kj^S;Qxg8Z~_ zGs5{=_&8X@xMRuJ^&`oPb+(aVk3AV5;o)FD(?|K2@S7^^fZQ#7E$rc*Ds?UgFA%;T z>CF>fi#%LPZqnmgDe@0dj$HfGuNV5HCXPk_tzWrTl7m_>X<7(wZKcL4S)?}(gr?L*l0=;cM87-oqL4Y zcKN&-{j%*oZqk23_!Gzv3bP&e2)~ao-x8+HnUQ)pjO!BN)!^B}YrzXmI_f?w;w^!k z&vMZQ)`uUNbiBeo$bTYy7x+GtPCz&S`2)faf*%v^03Q?{wT{U z9y~HyXWEb~?1Vf;cmnt$Vb=4jgf~Hct#A|g2f_@;Bb<%;ULwr?yGnR9^luj~fc$_k z{XQwY7V<;F?8{#>>Hn9o8{wQ0rr$4wr$T;KI1~JD;U4Hj#pvms1v$T?z6k(QcmN5G&-ZL=#UM2htzngT<2rq^F3*lwpowmWab_<_{e2?(g;2z=4i1$5{{$GSwLgyplRp8GJ9h3z( zq-cL6c!n_h<~hO~^A`w1Tf0Iy9&&!qh<=m6OHDf86HbPFg)rv`YfL&t!mlAr?&mU` zH^7^O-v<9k_+7A9nDzES;rGG66lU6I#p&SywK>9P!CZeb{I9`zh7R&!neb`IxsIjI z=iox&9`MbEK6sr;zt*JRXwv_QN#7?NiMZ|*wt;_c(&-d_1@cFQUj;vJ(&-mo3;D~! zCE(u+vkiV?(*L_~1LXWJ6w|c|nwDsZN7EjY`h&+nwsZ!-K|F3ft4 zx0x%s6I>#EFZ|vr46(LRH~{%3;RnI|UY23c7U3+^ldZy>Gx|+B_X$sh{2`OPL-=vT zwM&?`Ju2)3KPAk0#8F}PSG~ee(ViFPzEQt0=bz}=8RVY` zuLS=~_;aLvlzlMmV}##@e5~;M;EBQ?fhU{vrwOxtWeT%>@v!_*cO%JH>I@adZv*1V zOLaN(h&o?G?iOA>T%TW3o(o!W$4y6WNP@ zIB=>Z%}}V_E==3+5N3UA5~jUB7G^rO3p?TdT$p}4g|py3D$H~|A)F2O@4`)R|1C_v z-w5ZywIJVV8`B*tOdY$h4b1O|QwK@ZMwxWR2rq?vtT6M;DNOs_!b#xy!VLd%;i=#p z;Y{!n;aOnz9Ukzs4HvFo!0K(Y-xmpW=SymfOe$~1F zawp_IlixdqCqRCWup1mS>HJ)HE##fTCE!PeX`9-ELiiQnBPPE`g{vU%5v~P4Yx4WD za0BE#EKSPMpCOs4GxNy8Kya|kjCR4e$q%9uvJAr8MHl2w%4_fs2h&D<-s@-C82cV9 z56VwKAJcFxi3>`){D2w%cwxprN!SiILzuQOOzP9$<-)B0Il`>}#llXwb;1m@QJ7`H zvSc{4m)!xGVQ&?t{@ucvaJLCF9XyQup&t1|q>Hv1`J?iUk>H?x)QP~NoAw!bLOUoQ z4>__+OOn9jgqbG@R>>I;!=w)5xmcL8D}>=_xx&n!MZ%1~K$!6t3d7OA&xJ6Z;MMpr zeA>k$JdIbt&hygPtm_(Syzx8ISP!|IVK(Xdh(?9)hdf*OO)%|byw8GFo?Hq64wWb1 zP@aH8c><ZQ{kps25sZB>9lzP98DE3B%FvAwq}c_ydvCc8{alW+PP4e{_=(CZ>cctq@EGJ3KQX5ae>#2 z@Kyd-L4bp{8qf8qvY4;LdRc7Mc`9`f&IAOKNnWPQSr?6a+*#yiUCw-_{u=1hHcN#r zUnz1I)`hEu{m|iM>K_6(2)};O;5_6UxQX&R@ehX&AL_ft4St6r7kn?}P56f+fRC}4 z{vde;rLt!Zzpo*#$8gSY9zys}3LgbOBRmf}&k3_Xc~v+L@+fc;6OAJgA2RcPq%g}U zS=bIYMHpW7J^}hkU{#J_>V98zSPpB1op9F+Pk_5kH~_a(nCa^krVY;vzXG>kn6{r3 zMs)gpXFwI0YaZG^3(R$ek(L_a4Uns6V4$-JtmX!yuf})qQpg=v-ER|EeU}Y#+H7=`2s5qfITnO-FIe5@l`z$JF2Eg-H;evm@ZF{`w+Xu;|C#Vq zaJ%pV@NSd-9%1I$ev?kONk=_1gLr$OqrO`Qehz$0bTYwzFzLT3ybAKSg;#?=5MB#b z&j}+O=9SvR1hZ__9wzuPuoZm-^Qr)xDop)x!X;q!eLd(@fZZnjOq2d4!r9Pazr!%| zz}Y7Kr6zs#{XXa{gU$+(uLRecbn1m4hx}IIC&6CfwcxELef51ngt-~=Z6f!9)pr9S zXCCe}>8tMsLf#Fz`fecj8Sp;Qp*|1e{tNSk?V5)jA96j~bv$_~rARkE7EY{iu&Yg) zr%=B~0A?6#MQ(#zEX?rAgc)A7FvH_v#7jTqx1pqLFvlx>Y^vz6KXHOr6a6Zh-!pwu4 zgyHCA0UbA3l?8YzxDp@w&4k-33`gBRrFFD>W|>5=U!?+$XyF2|TDL;ZvQq0-uoJA- zr=qXcr{J}aJH;={jb+1fp+e$ZDGDp-w9WZgQCy!pnL+{ z8--~j56gDlRcZI@Oq-0c9?d~ZVuU!l_hdKBa9^Eg~5fFx>eyK$ zGj8LV4I|%9K+gE6V@JYOzO94+M*%*R{{{uUjLd&HR^dbW`;e~{9*@dXAd6L(SJVyI*)^^MNV6OC=5sc4gz$#!ObG4 zjhlrTFR#%yn6Lld0+`3!_)s2z`)A^-yrOS{3hWEV6~q{k2p4q{4TKiZXM*? zzz>o597xKJbr)v%u;(N$4*Ct7jv@+2ChH2dMo< zn6~u_Gm7Vhmx5msrk!sHuLQp(yz2jO_wI2~UFZJrp8Eh>GoX%KG#SPVs9*$*0%{6K z5Y)60m8eNdX5<<{kV}MA-vc`dY-n;0PSQG%qzA?%qOGk`ThYY#08I!cvB%h+6O+dN zqNnG?rtLY#CdQ<(^M0ST_nO%ZX!8Dk?_clwFzmJ0de(P6>shyF-S&c=>AeW}AnZ)< zh5cdJ+4m@5FNS@xL6KWI>@!t+GwcHH4cb=IBrL2gsdO!@$7KTxwI5(*w|^Ajd$9Nt zvPy$ngGy>$l{Y8ThNlm>s-L$ms;X}gSPX#=#op{MdZ#Q!yY)2D@a8 z<#H{xGVFHh@yVHpit~w^Xz8+oB6oFlWl_n_K)HoG75b{0fD02FyXJ7rx5ib*$E8i_ z2h>ZGgoRwZJYGTzAqnP?mI&WwFD|+z%vg$vQIrcX>Glb9Up2Tkl|G(6R#MtXCnOIg zKq1668|-81)MnAw{Kp83DkHn#772CLG}I`KDcZ2W&EI3l*@xM2b0Em7t28v@y9+8; zh@9O*_qBxTZFO3@pol0Jl(gRJZqTuE`i5b~6$pxlUEWi~E?^0yotHpr2`8xW+NPD& z1eJ!^V3*>c{Z!qdQlQ_#y=7AEy%~Qt27q;dcCnZr)438j=r~Fggeq}>nd(43GJP> zHwPY1HI7HFchcPyHwV&Ean7}QMxnVot{|(&Ej(34bm0V=Gg85;svj-6S*Eg<=N55m z{TcgI+7yw6-cL9-0XL`PtP(}A0R@NS#Y2~70r>87#MS z;S;VfyhWnFL9lUAsS1aB$wm>~?Qx43CZg8LCBW^?@@;|(635D4i#7o<_tv&KXaH{( zoqBH}DZ#f$m6nP}z=H4>Rn^wOjFV%aOJJSEEh3wca2(uN)%+H4A%vV`l(SH7S$oT_ zibIdL9fJb8>?{QNRy2%9BEaym)`bi}Ys0ReR{A^ARBMYT!21T|NNsf3CCfK&BflodxG0pN#Q&=(ZW<(zDBRhLo8H)c zbx?#BZW9*P)z{X$+;}!sv1e^HT_(41TV4GUBwl#|4ek-5`L=Ipvatw(X}X|!9dpdI zFrgYui84b=lw`*=J2Nydsx?OSHY_FWY1Ln#K)9%l~KGCKjcT@eiMS1 z3AbeYxZ!xe4#8Wb!Gl)-Z#fd6O$W{0PQ>3*&}sSGsKKLkSI!@u3(?}y9BvYR+;IM; zgy1!5@MsN;<2`%ZSiC;?WpXf;j$Z!>bXxwN2VN)KNq)2!i{sUV;9Z8_oA`0V`P&|X zmxRTIDOGR7nmde7xtE`cvSq!kIKbuA$T)T znCKoEZa9D8A$ZR>EBhvhziIe!yg!DI*HW59libmbXxwBp1_>G%HMRAj`$l1 z!CL`Gx~GL3&fic7-sLB;=7owz{Lz{)=PxUyyqt{+uE7!}$6FCnUY=-I z3&A@NJlf;U4ac*E;B^9THi!t1)BFCe>-&(xib^t_`U%UqIdF6~BL|VMFz-xp% z;VrUPB08C-BjUUkwUPVYd z^kKZ>4lianUU5h}bp3}x`Q?C;<#2InIgu zK{}H_*qQi|$pjvn7?$2VJUM?mL-5uCZ#D%`4d<^i1aGqjkJ=fIHxiQG8sOPDm`X>l zLm}y{0p23GQ+}+&kK=WP;57s9+wkXx^Y?5BUXKQk=sDh{u(9$x3p|cNnB4wq2;FZ% zhoTiQobEX2$eyYCoJG7;jwl`L@gqNa|090da{nptj=+r@j`s&RXz@M(-dAuVybY=! z;hn@!i}&Iz>?PL2Q8gUz7kJm=o%cfT1RddRQvC>T1@tg2Uin-l9K4v}cy!)Yi`V&F zFunJKlKcqI7J^p^JSuJPZ#@%|6! z$eyWs^l9RK5Nw`bZ`MW9|$;BLkmk6chb&5bW z98VX5_u%s=FQ6m5hwn;h4m|2#xZ(WG z3c;JL!7Bza=kGIEw0KMAONeFVfDkLs2d?=0|Eb1;>T zUVk2fcV2@><%{E849Sn^`O5xG!XU%>qqFzlETZlw!>8^l|_Q7$(@!kz7 zr?ZnFH}K32r#lx?POl&xec+koyc0j3j$@`I1Ja#xZ-fz(0y&oc%b<34+8*)g_-@k#5?3t=Z`A?O7a>U;* z{5XI6L-1y-RQ%LnjE?L-3c)*eB-oxdY4EB;@EpLK!ogHJdVM4WZ%~8xJ(Uh5LS2ab zmH?0RQf_#9cZA6AZQxach|;?UKc3$F5WGs@p(q3l$IA)9OFJqEgP2ir7wH6i1Q z=uG8|Z77~Igl;qFzRQX5PhA$X0zqq|qQ;ru-ng17P2puYAa4PFZDTKT<*L?m%Am5yG?ZH)Z>?_mAt zQT?dApgA3bcNTbMaN~yaXN7|nZ!_>Hog_b>>PL8algHwv#@gqONbB5sM0Bh2fE?_9-Y_Kro#ceRQPkl)3GW9uTjGvy1D?KBLr_F@F3EF;dq~fl)qxo zO(d5;hm^lg#QQMNNG@nv1M!{>!Se!-@{1cD?^_{wSAaJNBElQMkLakpEQduamz=eV zAH101c=Sy_vS%vJ!jZvX`8x?W@*_M4ELyxg;2nfJH$+D!4i>U!(hJP1gF!qrT>-p@ z!^Yx$3cQUJKs6k%8ZOl_7W^ z458gn#~-i;@QR=;6MwwS&A$)lN$%iiiXZtGsC4KKnbFrM80ss-ApT zT}Yu_nk9%4!#zDMbOioGt1$Bli2m8{CtCQOGD-SQF{b&wL8-^z{IqRdd#5aQ6v)%; zdBSKS`h8LC_4|LBv*O-KXImrRNL#Y@C2=OOfK>RHzScb_JG&Fd!aW9Eb5~?@yTfD9 z3tf>ugQ5A5uCv<#mv)mFo*d4ir8tFu^7}I(8*acui{F3P1i(Gvh|0d&Bu^Jlw58v> z7ff0+JDc~4F`cr_K5CE?JiS6&`jTvSLaKYN+dXHk&*k@@vV3S33P0BQhSw?944oLU z6Oj53EkfZVf*8kaS{5kor7ePQNDwVaBBDn?tFTUPeq8EsOU}7IXM(uylo@Uhg%_3> z@CwKNAt6arobJ-g_O&nLi@S}9ZeWl+PMOaT#zWyr5tJMXn`~la^0R%Jdpm^5!++VT^w^qp&uA%{H9Ib9YdZ)#hM4p1dw!^o-i%clLS1q|vB$bDwMEf*&c${Q!w3Ilwe~ z)aO6q`2v2B1Gz7~D3Ba{ladnKexYw&B9J^rMadZHG1{nXbvdNd&bDd#kz}E3Z~A)a zwW#)%wNJF~6vM=6>*V%##Ju()u+x5&{<&6~x_X}u^S(o+*}cbj*m%l3IwT(@(S+;n zd&ZX5`?Tp^OX2AoeXiCRVe?+;b(`dh%4^AXMHaYh($Kp0Pmu15NcSi0DN?+xJzk2B zY>$-UqmcBMdD3@Yu-q^b=1BqaZR?(iB#f8@DSpcR-pSyjZ~ZAFlXxo*r~CcdGKg}& z)`wz>LW+`$|NUd?=sk7VxmH(KQR>)M>Dp1|Q1|aUQWq`6o*hSGd3}9NUB;bvmQ~c3 zH@N9o(48eb$epwoIT?q69x2&YzYr7-cqJ<#i&7V*-nA$#HGLilJ;c!bAvZ?h6JAo8 zlYthnHO3%7Y0(%1c9N`8-%Ih-vz-<}0t4I0p?!}GzQAS}Gjl@k(?k5@*nOMak=oOL zS6`@Kh!RX=+C%cEvz273@QV_{*qwmP0sqK9Q^((w_XPF563$W3;vWm~ekRsK=@be|44^!}*I?`7Ddu+!q2rc)vR->dJpGyj?RkA6UH z_pPwgw?N5IU#O!&2+UmkrmFGKToT#IpNtOcZ)8YEp}B1`^x)r-r(jc6VuB+(y~e6` zit}#OP8fx%U4;tpMqxNV6h^0Z6xp?;F=M7veB6D^}h|4L>memeRGL#2=I z%qBzLWT&u{cVs88J*u5}dt9{>Z^Npcp#D>}lfKRPw8H{JVRUK{oI!RXfMGIG`>%WO zJ{5Kf2bGiADPGdC$(=9;RXfEsqS}dvbE=)NFRFGm3W49b#rRQWg(;!HJ-dWO_uZ0z zaA#vhO*sz#;b_bD5`HX}?LMS^tMwJzw&V0jS;>x~pf5iuF%bcU4251I^w!NQwt1XWWB5j51?VngT{G9DA(?a9Kb2e%f6 zoQGLB=8y*uIsWK`yM&#&p(OGnoOQ07pQTXwVLM5`o^37JxZR~HRBd&=t3GsZIpe1_+2we*hv2;iKWZ1b;dn72c=rKs zHi!t1x=xPwCG1-M&f~ojKW;eQXK)~Urs`1-ycMt$9`%tNF9UWhUJhO;pSa<8cfmo6 zcSOS_9Jp)oWZ*pvBEr+|ef_r(yirufiR#DM5WLI4 z}oA^gM1je}_ZxC{m6`8X?Df9(KZ8qyqdm@QPJCJ;;xK58@v^ zxhdcgsSez)5*F=T2(^D?oXR7Bk%oA{V!&(!-k=%>uWzLPutvGEZsE3t)$T{`bU40l zE+lhkb3XwkW%vm`z({VG{x^f*YmxL_{0oNK43z? z&>s1rRoIfUMR%@ex7MAF8G)1-*Y<-HsdsjV4?)zCqSTwyAr<5atwupyK17g>7yW() z2{6%u;bnV#yH53Mf!|^M4Uj#Bf1dsKC{e;ebk8ap{K|$^LJ5a$QM^#uHBVKrqdB+QQ-=n8s7BDm1JFp&n zSxy-~Gzp^FU6$l7iU$Iq$%&o;r4TaFCkia zbC*TWyduqtwR?5_v*N^99zNDSUpG7}u76f6;*kvXc3DU^Lkd_1xzax?iDX0U0L=Y& zHn9`r8vNR$7{fFV;&Udc<9cT-jq7`vTmy4&6fCr?fd_I1&U(y&%+ejEwC)MVl-#ZX z3p~wJkn?V5lKoK~rj|^?sc<;5NhU<5B*6Y3y13(k)VP!EkLciW%5a957Oky%{FB^C zt*m$^TLUR*=H&%t`PZB%tcH?^NJa?B zrZRCYR&1t_*c(Voh(G9>J6LcQ^5*}R_6l3p=VxWdPb-L@YJbvT-)NvXCSPRm=w_SG;5{rb0+kT*X$Vg>n;=uMzIwkxTZAi00AlD|2 zMB(+P45L}+*E2C{6NvOLki;+A(!-EFoia;aJeAQ2l85=lrrwIZTUzpWrn}~?7mYjp z{(|^uRPQXLrad0z2Ot z1Fq4X=UXoCMbEi*S6oinvu{llDe`%b`GN`ZKos*L59`z8PZ{!4&KTd*-LO1lrNVf= zxy&XSQ~Z803Jf9Qhnx30FvELUxNhi+9EcxHIj=)uGYM-K$K{mfTo@A#(k~gp#4Y=x zskSS{+2gdeZ&9hp-)ZygcXao`ALXB#9?irX_n$g}KX^~g60)-lnV3<{(q}e*CS~b> zCU5S?Ozk>W=m<)oE66h3$LQ{xh_3K`;zQnyj8vuoH9Ul774Sftx_@d$9|VFn18*69 zE?CV%fzu|g$%560TA%TfD6WUyglkeTVGJTj@k4`9INy*?jHd2)Wc2ay2waQ6Ta}Op zM3I7ZE7-DbtW*?^ARDX|^ghhW9|(NI8&!UKyd6H^`i7UF?_-us{O1{?h8x$;sqULO z9;er)pSM3_+x-f%7!xUJQR`A=Dz-U&02I#DbkEiyHA;iI#Xp@Q7 zA|NE;-A;JnD2CS3=;>D%b;vZsd1WgFY4I!I!WI|Iss)Et1M&+AUI9oK%)7mE9qg-7b~Q zl+e?bEtSgdlFF7yWhvAjYUNM%vs$G$)N`VDaLS#Vd;R_|18=NtuhRSGPPK2Pya20x z*8)~)uFc-avWQw%Y3|g*^8)q%4=a?u(y8*b!cpc#SL<`i5EVL6A)RKa^wjqeq#9pNRQ#)RQ58S2wj*ge`L`?0Qe6JVdNi6hy z(D9OD6_;e+Lwqao!i}~5&=iJ^N{+thzNpCG%vMU!pRscF;%e?pyv?;KbxSlAl-huX z3RX}$weK39Tdu`Zne@!H$!1@4m~Tt8&l*-5JKHxm%2#nhvRcK6<6h&_5xE#kL|>63 zrTj_Yg>fO93lg37O_tqPcmIcY`2|y)bHU=iF#8%|ZC6|BCviS;0r*Aq_LE=OAE$25 z({uKe<-WIiM#T%(xereJi{;#}ZTnu(w=NVuzI^?=f0^{gKmXt0ryeaz=v6m(u*>&~ckN3jSf%kulz$bD9L;GNmbimfTA((&rWo-8d*N@P%>twPhers1a4Ca2VE?C@dr z6Kj{0$i7Q1sGe`qIu?6Fq)nG<-FFxM94vf`v5;Bo{uXCC(3`O~KExGnsoCI%J;T%| za)I96cd;ilrDt>~D%r21Nr8K|J0;bHYjYwV+Xr=T7EC*ahzBZ1?n3w_Rjwvx+7T_buo0htn?+8Fb)@`XMez(C*R4 zLp+}g_FoBopW7c3un23lVg(o-MS@MT3Z>CT5X`(HPx0(G?(?Sh&4NrI$W!6N`7@(8{mRQo4qh|JTJ}n>_PM-{%OxGAKE`u=Y!!iZPx%T>GjdgVM1_zx$f~=YllF z+;*2qnqpZ!V4xNm;V@o+UZuB(`(=wKG09%>cTZxnJq-Wn+YjE55*OI>Zj5|N!rBe}w! zU&|!I()P3-vV#=UbtJv_1d?8pK+=Pn5CwWxM)=rGm5KjfAe+HppT=~#Bzq&&v1EHR z{?E4$AjSpu%_NPHx%A(@AxwJhUp+rNyKg|B>%>*$V(fZkzLBcCd%pdBL$-SX)k`R^ z_gc~MpkI)6_Un4Mb+ken`_g8Mv8QMt=)*v7jn3^(9?+dJgHp8QPG<3l^xx;4??P;k z==z<6ha7_osxplP7f9~;7(Ch!393UfMu&WO&eO;%fSOjwOQ{FHF|M$#PRm0fwI>>V ziCzfpkgh+m3v`GC&TtFZo#kC@T#EE5e&t^K$3k{FQLFm7I@!R=!qimv6v{jpynCF} z#Ay2$I&X~U^xwtqeHqhw{r;Y=o`J9ztcR^V5dxO~Ge*$ug&hv-cTQ=GGbV>qFX%)A z)1?cvQamBw?1^}N2CI?)(Q2Qs_r|KRL+(fY{v#~@aEd)$3~!4K!(`22>kHPl?ue(u z%ou5hzW~?2iiu+EfhgV6VVdFg*E291B$=6f7S3pN;N4_18OU9KAExNPg$cV%EOy^# zGQ$nLKCSolG(*Qh$#DMcG4X@8pF|IjUS09f8!P7^4b4yW$krZYea~QS651(!>l&eS zvwq}3p|nxox>0~--Fy3@^&?vaU$21F0j6~m4P~Fv=VoK!G!hQjfJ6Vij@G*sA2Zf{ z$NJ=EC_W?Up+4qpio6wjS{XjRLZE#$L$79WC5MK~T|^-e??{Ro>0Av7wnBRys68z3 zNIdg_8)wvfJNZm$3gNOfmO1YTIy0P+>CAb1(3z!nBnkr}FmO1+97&9TZ}Vi;(kjv& zc;*Pkpo#2Yw$;FVdj&IG7(Ma@C4%foJgzG+_HPmnnyFcb+lW^CMgIQ((4al6h}@#f zkC%EnJ8E5!r3DR+)bo5tHf9CQbRLuD_D18;nxW@AhZ)EL-Do6xv-gwUXQoL>GkV%U zUr1s?xo3zhJg5oL4UHG08GRNo4VZ``rM~ba?Eo{d))5L;aySr8q#B!);VW=b-AmPe z(4ju#sfEOg5)Zx1N_9K=d#ZaDIVtZf%WmFYu1EVj!F=8{HlMe0qWQd)O1opCSxnc{MVk*L_Yy?Q@S#Z3vp~^D3*52U?wC|J z=7Jf&+3pRg?gE8YzEqee$XD%of-^B@=9S${jtKj-9{pUoAYX<)keEmTm9#SV%jE7A z`Vx^1=;vap>A5a~gR^rTJ9 zIGz#CF;NZ?>A-pWay`ZPR_6z{cQc~N_d?J4NeQPWHNT=eGLVA!```MCv5aS-0An%sC!L?W;wD`b|^bn7i zVOx^uLhZra)@!r+hZn67VU?UQ&EBkTiK%MsFY^dq8HKU5lx*h=ZHTZH035j;X zZen;FvtPSkaz@(+bd8B-U_r?}ISEXI<+%5;v6Rwt7usLxjje5qXV>QFYuNtT8qDJ6 z2+MOQ=y`#y9UV5J3$Y51!7Z+1pZm0{Y;kcjBZGs&J1oR}eZMo-{x@OR8OO^91=%Gz zXMp)$(pYWH0}V&O|7xKpg#XnBmH*XjC+}+A+SPHbZHp}uT4a*#f=72PHeob@m+}-j ztD~*m-1Z9-;>m@+Z^hbyILV{mjrSGd`%W6D3uwxEuFKcs?`g7m^!0`FbdMe0{k@*I z2K$|H$5;G*LB~mXd*iOf$KH$gm^rx7l*6;3kVl+N2a?$f_*KwZE{1d+G zI8V1A&;EhX?@T&uWE0eKdRTVf6(yf#)f!%d}sa>Iyf=UG^4qVO=rz=1=s!d-V2? zZri#s9+mp%x2^txzV)mi8BtTvU_08U@BX6m*+pB^l^O)~TB$*;Z=eRX{aoMrI%xGC zqq@z$JwY-W+L!s>u&q6YN`tW-3i=z1`d^!^R2t*`9%G@;xT)W`Q51*EVu#D3(eR>Y zJaWi^Su~`THw!X0TW_Jw*4W5z+}c_0$bRhsd#gkG)yriA z`jHofm7=obs*ELR$u$wOftZxlRjhQ-3V+Rpl$4ZSwrY`4%v|6L6jaOO4cDX8V#D;Hd>|C4Q^wYd-d)WRwS;q zN|1i_IV`!`h0~Gm#rxja^W$SFf^Z_`jQQTlSYn~$5l`5}$ylXIhAQ(w&gyCU)_?N1 z7U7l}Ipq;==aYl~m8c(iKv+=m@RNhSFrhz8*Zf>0sUZhR>gVInuCcA|)8}pwF#W%B za&SoOE5j&!3ib;qg?>#b!k>@-i{ZcW^yWN4G7BCv%k?gY4F_z%9?QZ`XtBcv@K%%1R4sbqTB6L|8^S z1=vzTTu06sGsu3KmkA_f3<|cO7CSw%3i*T_$A778#@Z*^ro|$!rPaa%u-+yaO;TC% z_9yO-)(_!xTcTQ~#?(n(>F}JY?s3*Qjj^K6_o70k8fCrxvVo})203cRiG9&2;GXr@ zg^%djwvW>2De#x9lS-qRPC$Km;USu60hxuLxnSA}W_y5|8zuD7%q!?_go_J?{CAW67Fmob8=CDV*!DSp2kwK`fvqz3F_uv=)tZ;uJo zxLS`106u26!-W>##>#|GK|L438)aI*#*MxmMTT@7CRuEwW(#Eun+sr1c;R%jSMLi8 z6QfIGWBZ(?8Phyr*0vav$M-gb>+y~HoVM=n_ON!RXxb8(lLyzkbWrHP9m8dKH%J+v zPB$1Ii)@dHGp*?t{-EKN`21tYJL_xWA>9LJ*}|lY)kM2I9VIVuvzUhFEg{{WM`a*) zsvswnMpI>CnkUwkB!h-GEKDlFXg!}(xK-{0<;}uZo-p1D(ka^Mo)F%i(7em4o$(vU zaJF87xXi+ga;a>Ym?xE`NeN4_281bVMF%<)0cp{0nNT?fIMI{`LgJb-N$ci@)*HbK zR<`YyNgm5&7p{o4*xS(qO$P?*Czj93rhBZnF}G;Nt)ML0bKt9PS+-*Q*4>8n6Odwo z@4$LgPRt!(f$spGzBe>$dj}wIq`;T355&F%FGw+e(4Wvngb7~e_`JPa$fFt6!^Xmm zSXDj3Tz>)iA|&M()pDu#Y)2c$IE6C8)hT}2?^^qeN(6m0xp9=`tvV&a5|1?cP{}fA z)K6?U)$L0(^S}nJpmIiP*=;7YtPDAdufzyJB!f_y0=`R z^981x9H!Hforoyc0OgBDGr4RukgMyvw6;`?1MV5~dszT2?EY`r)lqsrYtJO<%sQZT z#kVa%$27&$dwci5I`Obsj)(BvBbgA26!t;K0Z-V4?rzWNZ+B(wTXHv|B-)dPd#%p>hJ}4D`7c#^oZYo${oI%)~48!O1vT zyQSqQ1`kiIN5e^*C9zKg){$%eEjxFQLQ$V9|LZ)LWQgz>!ut(j!v<^L=LbK+cG%Ak zzI*VE=C^giE0Ke*u%Xa%j^_6q(rcf-oA$z6t61N4V*MH8%1Malp>X?4Lf=Oyq<9(m zUw$cJs#G?`S%&{nQdy+@5ufd|$6k}d!{%;|n4721{Wt$bL4a;?(eKa5ky|q5!E5LB zBmau-VT%0Gxy0mwM6U%p$f)b|(XQU6y-o4n-mXaR(JtNa=psbLHV5O}vFQ`(wM=hI zTbF)h5HU{~Hf9dzeNgaPmbc};uEBjP^yXJEx%d0-zAQ`&n?A%gl>}CWe}Fx{!+96t zwlKOkPUy`?LHGCWK1S4^Fhz>E(D9_VrMYYHTE2edpxS)V>=k+7s13OcF zt6%k<{?oM%y}1#u(}t~f;ITAJM-1nz(ajfhgJ&GfWyU#c+$C$wRcoxTETj2nksls% z2xwW})}f&Rfv;@2=k$MEo2Sn$@q4Vd`>ZoD$%Ho9bAO{}^p3ukeck$z@51K}Y1Gl4 z(v@YeFv^zf#D&-^+Gn(f8`f@2K`}81a#maSq`s6>#?dT!CyEVJ@U=PWbo$3PFu5ze z{*{dVR(DGYcia2UAwOhS`|243?bDI>taQukrTg>bEN@CjJ}t1Ou|AWEy)VHA8d#iV zwuj7eOWRa^Ylc5}1*?}v^^7Fd%L(_js1^1el@9uaypf}W0+%%&pBl$l%o!|F%Y{~P!yfE6zpe7)9i`1!P)1e zO-=OQDD+*0u<(yur!m)Q z&`4A&wzL1!JUNrF%OYOdSUSTh6{jNIQgMp3|FTrPs4L5}FIYH3?~A9M>?mMQ8y7g^Hr@Zj zKg5-KBRhZC>4^~v-}?&VRMDy|qBTRGM)`@S87Zw@TMFP$YmmO3s1Mk*ixo(=N!B?Z zMZg6plRcKUUa-cFbpGv^;h7JeyK^x&Y+aB2qX04e$_=3io1L-=^ zDyAzdAn?c9LzI~Dg8qQlnBc`GA~7r>`ud0SXtxy`UqwjDijr8dFU>&f32|8PB3y}F zu);v`IT0Ue1q{!VXxn|&jzb{xrWZB|velC~%YIrX#R&Ft-GURnXivg=WZSanhy`y+ zal$FF@H&oBBx5x$C{f@X*6+Srx`BqhW+W{Fn-O6he#^FRM)b*n^ADU7m%VW1O}QUS zJl~_TiUOutX;XPAEuiqNw9m!Ya~5UdjJ5x5+kv=AZ=OE?;F*Yo7p|Oa$089tGz&s3 z4Kup-d8r+?Z@^g=D^!0h_~i&vw5i<)5k+8kg#rkM4$S!T$rI<|tf$1b7yjqX_QKzM zW&V^G%K#SfF#3sQL|$F?^^mpQz{Qx!+rON1dI!>bs>IzPrM(?5-`fLrSXy zF4zeYJWqv-B!>F%ui+mWP7jI-umt!Z^ zzo5pX%jWC(@<4iR#523!r{%JCTOsBg@3dk29AAE(MU+8U3LSJND$Bgv0^l`TmTfe^bv|o;Idv>`TX>YV3UN2TbIHDB+ z{Y+_Ho})vkUt_+a1EH!hYv{u@cJjuTZ*Jasz_1wJVfqA3)VbOX$`wQ2wYr4~ApBFzIKmBwh24cELt`DE4!51TXJw-N#@(3w_LHbNo|BFlLg{-a5 z^S({HcR(pU%Kzsa!M7fb{bh~)XBs?^NlX@!yr=A8H?}jeoGV zbZSBA6sh<2j+fVo5YLHE+Al&tP=4F?8RJP?%s<+KJf_)|d&BL2&@mCR9;!5BzGRFL z=VAI!4BHnSBg(Csra_(eykWqiA3i;mdvLGMsO~|1DBS+!WS=n%xInePKl$MLEiLnU zQEEKCE7;;-e$o2R>=^mIUEDt7U0W-T- z$aY2L>sFYC{Qh;5uMVy2J9^4={*yoMl;43j)&-o(*_c4QeZA@m#Z{wK(_ZEpgsaA| z(E11nCTkKdNg6FZK9-iE>6z`cOH*rt6F$*>L?R`h%4wd8g#UH@(Dr z6q)t)o-&=$U;l(!AL5@}{eEJfdBEA*GCEJ*Tbj009BsFYhV-R7#ER+ri1ijrKBsV-Z(=JR2i_JE}s%Qr)Fqqh{6Tl$CAW&HTa*FPCO`q6a#mF`Gi@&<^jOLysC9V=+^t#)MN zdeB)z3*&|C+T#wKO5={TS4;dNcFN=qzz2!yFh= z5XY3k)=&H|7#g!icjk8b`&>QGT*^3vyzJ}kGSkZHK4V8$YrDFnz}iw)&dtaCK-ELT z*?WPe9#B<(5L|j=br7tO9Ft8r(kD+TP5hR)mWm;5Lq(H)fD*;Z?Fc3`)?#NBbKVyO zVe7>JVKbkW);Il|ciJ~yMLF1sjdm_*$XFA2Q$PtASkGSU9oUYBIYYHw!vo`yxf`sd zt0GZdsOv>Pf)le9G^|rLH>#v-VuN8qZ4YYv9@5w`fOij3I|cm;3j6{kEf@WMN+U@` zqtnw=z+vS>iB;i+h1k@@b$Yd-gX=Zu-1LTwrPJ4i*Yqo_?M6C>E-rUz>Nje)nN1Fh z3*KRMlpGLUl|>0p64xGA6g51DrtNl(-yItJ*QYHwo|rIgY&>zRv|-5b|3TU)J^!NN zo7VH*;P2|X;9LBih%sJkQr~~7K96brL4q+_HmP3&9WT0Pd+min?d-0?cd_@BB8#fp!N@0&%H=%dJ3dT+rP9heT*vT$cg~? zMONon*GarCr7E*IrTIygC@cv6fG27dDZ`$gp6=^t)s^N)?Z*MQ_3_pz;Ob<@MrE9B zIzv_Xu_v)L7kJ+IE*%Cr5Y6UD=^lYLC@F%vhcGiPb3pM<5HnU}UB{CPxegW0i@Zgu+X%=W=uY3k&iQtb%Y``C-k9fQ7~ z7zK@pq$>VzJFWe ze&bszK_)hyaCh|^tBw2}B)e7nQan+f_vkU7UQQzyUY@9pqIOs^hl>Z>(u>3xAv#lN z@AbU=BPeP1%SKOvO}6-~*156Kg>UM8`xhQM=nEGLaSB`A1A; zY|q%*H?Rbaq+ZzCnmv0{q46vD`bNL#Ir3S5zOl!f)t|7`v(`k8`Q{lFp0Z`?u8tF^ zVhXGOTYEd$$7v{k(MEKk)ITCGzphkcWlUmW1P~*i)oPo`3xM)`F65nDx2PYhYW{w3 zE`{7jHTf^J`~82Qcg(kZNzYclf4b%)SO4%nmY?xE_a2__`u+JDziidsr9NNK_?^?( zDNe=cgilrXKXZR|UQEaNM?6zidoy?w26Vy-_5E)3d0lP-!nyN_$tY@8ut1!o^-; z@|v(NSsD{Dw{b1a$UKe%#|E6frm&}&_7U986Ie$!sam^i!i=f?v^F}bh z{mj$T>?z0W%n%=wGA86{DD~5*K!~H5lJ+`$bLQ{sc6#Q-&v@iOSFC5w9oRl8zH+?# zwvK~GG4Z$pZ8R!_{gD}cpY22=jss(M<-A{0S2S5kNa$BZzNqKPkEJ_} zQJzy8efN7Q?*O?Jrti5W6`U$QqbAx7VNjF9_M4xQ*r1LtRG6j=E2g1-NR z^x$zm<^2hSGIX>OM2C8pc>NVF+M0_l#=ul_N@b!%g8j|2e6>55En*$Ml3vI zv;WcAg;gxnCJcLAatZb=)xI9BX`flV((5y5YA@LDGgq%kI-OU0I!Cs8ExtLn{`oK1 zpA&|Cjc*{URQ?OSA~oP4x5IkNSov7vL(r`M2Hg z;h=Hre2g>go5Kf~vQ9HQin3un z{>)u%&o3){#$a}+rAp}^sEWp8qx@)s+$ntH$zROop}{>9c&=F3Y|BFo>+jxxAob~&*T->*8lJ) zozK1GPZ~8}^e0`$<`T6Rc}@G#Ki;+A`L61Yv79FUosb)?5hAOZis*CNT*!538m0ob z4GZ&FtAQV~3U)Y4&Z!0Nsgiq&27>|cu2=Z|1o7+c2r@EBW1p(p!4niqH->*)SXc#z z9Emd-`)W(0OY}{@8!UMy2gbDi(pV#L#gR47-x&AbKhB7xqzn`X6vi6dGO_BdC0ox6}|~ zw?$OITji4rAWoA$N_Bk5`?`?#2F?3!)!w2$i`8c{^Z?4YU_a<$Ok&4^b1LUo)(=~) zNQd0$aV}kZf-!m{d_9y)|ClzGjj7)rc4teyVu!C5w8xPyN)>j7reQm-d)bUUX*J~t zCI;=-p|Ydbm>WI0@VX#g#|Z*CDo#d;7yC3qP}xzpRc=IBk2A_se!}C-@HvHiq#^<@8%n#+T>eX$EY`pa=$p6tsQ(CmwLXxkB5qDEO5xdTV^ zJ?`ZmcLw4{JkF^eca-;P*EyDfZ1hZ70|k?KVVj3BJFRNtS|xw`B=App zptC*w*1`US`3Ig`+}#K6#1Sx{H1ZkR`9u|G#R|rsf@9`eZ8`rGlcEKvF}41|?=C}$ zjqW%AY?N1q3`wX(6x#x=b7P{YkvxcATN!M~mJt-wFS@1&iwMC%xPdl+B}#8TlF6PD>X+7GwPK*bYJ}_Iz<{7Yb0IyS~QJvz0rJrEi zNE|4OLV+l_j>`%ZmVOiuHp|92Mv#ovVom1ZSGai%)$9B)$gm%{r=x_ zI%Mbj+)i!hMU34=bA>5H-WIm>0^wja++0no;n&LbBbCCul>GH5TY;5h9Ih>_MGbUf z<@jpkmU!AOlonMHnLf0Au~>pMbRDIC??5^4g>KNbm)=_F-%i@!vLag$4y=kyn+j5uk@7QojA(29>aU#7Y6V8Wf6Z7sk$hC@X2wo+)qp*RDadPmJgQ}XM)<2b(Q^p0GwPq;M#oT{yLxn8M3T#GGJxnWVAv_LoNdk#L`iAOB`hf|gFkI3MpQvnV$~oy5i3 zVzaPp$u_ogqV2>33m$J<;%a_v&|?t#afi{5BRg?GvODs~2?w%^&ZMtcg*`wgBTnvL za7bLx{N~^ruN0oM>aeNxl2tGKJ@V}Ta(sBf(RsnP{4XD^SUrpm_if|H@`1G9j>N02 zFZw>6wr~1`wZ&#({Mx@-f6dnddT#Dt{g?tmZ8>!Cy>NPTEgwA{=C#OQKuPk=v$0Y6 zjd1(FsNDn0{}vVjmT!A%P&HcrD=@7hY|_ezM6C8_B+o76*NuH^8k*(~)V&s=N-vvh z6Y&)Y`}E0F(-PUf6YQeU=gtup{OS!j%@qcp9mKa9e30SE$mRze%}-MHgJtabYD<5t zl1kMdwXLka{w+-31bN)>n0XD*ap6SGBE{YigAdCyh1Ua+={#P*Cv zMl{z>24xMSI1}5XADHpqiKb~u6Uy56a#v%)kd?$h9x+YSiux>CYF7#QCig0H9DUtM ztxl_q%YUiXrd68Sv`SN(RvEC*|9kt9Xr()a)~3`cU$4L_RZ!(2{z$9C7AN|~DEsab z){Q<^9PzPK)kU+L4vA9duUG=V$v<#HWJ|Mj6?^kr-0}0W;}d;DiO5sP7@n+K#C%P5 zSb9o+WJNr8sq zD5&$_Z)?U3}dVkl`lSbory{bR^)Fo^k_Y5sLY{sNi{~96gP+V7p zTxj*bU;4&z{mAd}k;L3n_-8()mS92n!31MJp6x%G!0)KW?H3w5_6Vh~-=p9BdEqo+ z^GEI>$`V%VGeUT@GnDd!!s;8E(a$my0q}V_ zoHA$Fc$;|z%Y-g`iCTNktMDoi|ytJtUF>`G>Ts92LUk(D>Sm;^5f49 z6Zmb`xIL(`L+|dl|9>XOJIkx9O75&}*s-Ie z_Rd|^wcF`xvt;$kmz&v>>zeBBXU)H!fJkfX{~zpb1B20bfw zIJQ;qD6J?H=G0|4=F}z5X_yy`4-WWScr(9=Jr)WjjTLqEbwVIw_Ab=aR_v&EsQ3Pq zR=UdS9Epn>=PXKXoF^nxOciwwT!^$#s4K5-s4RBuD8W^7j&fH`P00?yRasfREpg6c z4GwoxeM#LsN2#l#vZPp;Q%u1qbuP!FuF8sH$HsLV94QMIJCu8U>KZEQOBM<_aD6mo zVXDxuWBZP3h$)d=<_X+cc`oMO!o3?eIqIvc9hKF)9HrH@j@puK)wRVCOpS|Wgs`o$ zq6Dd_quYx}Zo-!821ivxT|LV;HFt}Y3x4WxsZ|v&yxQhY1m8fTxP_H>BW*j1>&ji* zON13GH81d~E!k00R$X5~cOz-R#)P;T5typ2FADmi;0XD+xvIid8H@#D+mTT3sD_M% zJkE#eh&%dfDog4i-VG(S2vt#6QjDb5Hf*bJz+Hb17qAhww!~H3By7Z8UL}+X$fn{7 zTmV?H1L4V1?5cN-_pWZJFRKoCe`iN!6O#ua)HT%9RM%3x%$eULhm4%Q2B6|I7(RM!8J>`;;NX+J>Bm_8NqI4LLRUuWg1;+h+D{5>2Vj;Rg@LE zDp6j`U3HG)hMLNXZO9lDhaL5`6(x1y?1~UINO4K2tDzD>ze$+-%DR-)|DDLj1pLNP zE->p%CW}EQs206YRe_ruS)SE2)Uymj_EB-x7CLrc7Ee$Si44`Dq=ICKRPJz5p>RMx z)wQ_du`0uXO5I2pN`0J=1il-_2d&ezJZcjK22uXXcA!k`sGcY~;uqzu3S}G_S&Z`f zXo&+i$JMb+p_1HCUs6=%s;fsqS6f+D5B>+!hI#RRK6W*W+l5_)SN3d!&Ogh zB-D)JiZT>RvZ2XG!@IVm>7K@I5Dg%CE>{)PosGD#Q0qW_O|ZEDNka{iJSLFBiQp<` z-9w-~pe9vmGBovGK(D8%=5@&4suIToa~dC_7Nw5$xq*fw#P{11HV|mBOTa-%@j^in zjFP}_yMP-|tO7}5jlZk5t^`RXITY;x9c%N*r*20D>Jn)rwG)JJRo3iKNLf%MqZl<( zO*VOI;%nGJRi$i4#bYR5ny7>-S0k<=bd^;hsYOa7D3F%XP>0H;v>btMvZ$=Kx}gSQ z;S$k^RDk|iR99PHBb1jQi`*rydI5~Ht_yiyROxC$>TvaLef75L$|A0Akgh;*CB;RW z7KSM>;G(KVReZ*JHr15yG>i#E?lnsKq5XlKa%c|4>|RgsRM}L-Dn~FmYKLDZY^$!` zUV*T6+ld%5RZ3z}RdsO*e1i>U5#97jg$UiSP+d`6R9aDqhQ3aysjjQnG_r{SFizf@Dv zda2(;^N6nWv67<73aaO;m>!u&Jp(CQkbq)m{|nH6G!>}1{_T=o8|a?p>Kz-|6{#2s zY^!amfgW-XA0E^RtAe7@+BwE1Mf(-9)~)-_{YCd}SX)$Z&xTF+-nTLTJKxqg-g95x zJ@?*IkhN~S_dQt!>$Vi-WNpk6zEeYu2U>41T~XTPAQ?L-he(xU8u_Ep(b;f?lwN8A znO@FP%rtWLt`awupx$%+Zy~9Tjtv{uk&=eNNkgsDP=S^-pT&-9sEuDkl&TW3wwKr$ z69cIYc}?zG&46Kn%3>;w3K(ljz2wOWa7ReDh@6KGq&f8##1%W3mb6eE;LM{I7%dG% z;Z9Z+)H*)a;mxkn+me2Y)^XeRx`wJ?mo-+$2=wt|omF7!zSy;+Op$F$oU>?2V-i${ zd6Z&}n(L}3g#ub`$+nuiQd4SE1dLfLcGOf?SKfD5N-EyTXK~t+F+R#W`K10oyuAy2 zR7KW3dQK8Tz{p@|F$!t}5rYH_7!ee;g@{oziVP|$nuH{fND^Wa6ck5{h`~WceDDy* zfG>1#L`B6B6<-W0Dx%|{qJo2pjt_jJADaJKRlB;Yt4{~Nd;j;=k4~-HwQJShyXsWc zIo(YkIYe}TCflv8n!#+Xv}Ku-S%B zJF~brAy~O5j^wROxO^%$hJK0FQ+eWx9V#08snZiiVB`smVs)L@D?Bo`BgA{9pTHcF zKXjVCQv~Uh*I>8ytmi3MJSR?3)9w&`@Sez{u4q`5Q`I)0D~;#1cwiH4Z7YnNQa_y! zr|=x84hs_(|JX78Wb;gckGD=YPY_sOe5}VZ>ZirkZF~4wo)~eSu9#A*9~vp$33!e) znFwbqJh+*f7sj)SD6YOZ3bCsTjvn>me|cMeJ3A%>X@Dx`o;vud!;5*g`u}%sp7{Fc zxC37JNp|%cz+I5@zs3Qaxi>tdIzx>yn*GsOdJipJDJ0G~U=Y;Rh3ST|u$-n-qU&s1eZ>^n_dE{xQ ztXY`$O;b(A%h|nV44!wvsDVRXJLW%sy(BNY%k0$K4!vsG7af<~@aT)@@0?OR=A{q% zzw+ZPUV%S-dSF!6zX$a_}?&K3{{z5zvlR5c{4dR(Ax9xv%jd9Is)pLn+V?QZ#eo-;YTZ_MnSIx!!q|A?q z^S854kT)y&7Q^1EyjJl8CL~rUXQam1>?+bv^L2B^gm%+c^WRdiUtSlqmp<}qTwa44e{Kc5-3SlPA2?{>pm1(gQ&WB8(T5*C36J@vP8f(M2z-k}H#xkf=Hl7` zxShPPvb<>^G{Sr*M7Jy%oIm);{Go$~aYczww{tO(l;(Y7mMJB{e-C4-q|6bErBpRq zc9{{5rBu#ZE2UzE>LnBhL!ROt9XF>^ozYIkuUePrA7=IrQTjPvPcC>!x}2*E@;4Q~ zFkLDBtORq4_kqKoTDr#bbbo$^?xJkBYPcgm$sxx)K_ivUt3uAvm~LS2x*sa}~y*g(DcRJb%2)~Oom1}Ulrx=jSO1S;P4K0fuic&ckY6Yp4X1_g{p8fU z`q_TZe9c#ir8mVp$kFfVl->HUQ=j9MbDeUY|19?@qzb%JyunU=zEgJV3!M6)PT5`G zhx=iP2lqSQ`^wRe_(iheKMlL^TUbtgp;In$%EkUP*@8MN{;&PNgaDAv!Yjoa<9CsI zihXaVzbH=s8$Um;{#*Z6Hb$boDc(4LvnrYLnSKWzEReX<`QDHINGWrh^SvMZOXUB= z&Q#^^9eYPR$2sM5o$>`vd4f}}a>|pP@)W1s=#(#U%9lCiE1dFG zPWc+A{1?AP_OG81zZCBi{}tK)b@?OzD5<|g)!*)4D)qX&$l<%eDZBIQCZ~RZQ+D}o zbLww*%6B;BrB3-yr+l|lzRxK?;FKS7%8xqbC!F$APWf4<{GwA{@02$<<&94HEvLNM zDZlHKw>V|@ytdV;|HvtCcgmkQwyPfiHPPxrrcNi`tB;KcH;U=aVZwMuIMgF+;nKPETZys@&D9JQM(l;w;=94v_tiGV)!(g;x^G6U>bpFw1?V zJylqq+=s~XYVpc~7pJO{=V^OFUVq+rNTU93>xPfzRH@Gg&ho?}3PgF=^e@}@$O_+&U-bC-u&Um(pe_NoN z)p%ujb>6ofRna?7l^eWAMV~ZT-o@Thsi&J+ z-ZbxMIq&Q8bnh&=qICIE?`UbS%a?h@ay{`_kmb$rdf}YIM6wyjR|0L%hhAqpR?>%ju zhqAnzyv;eNK+^Wy>^&jR2S|(mhSyso*ORvAcJDGSOi0?^JG=`;e}BlbaFs6>eO_i+ z-re4BY>1@eeXsY1#8>m(=l!6o)ibXw?|!dJu5Vs8S>E5gKT7#oRsOs8srXl_$`5;! zBz~H2mG>15K{^qyEbnn|hjTq2CGi`p>YwsHllE&d&RO2`-p9`Thd7!T&x^&s(}A(bw^P-CH8@*X51gI9ZSMe0js$PwI7flXnOKk}kjLJuU0W zRLHWtx4nfj9-QV`-ezxy=torfJ#Uf3OZWG_SIC7DN%MW+t&A&w=+(u|&#m5N`C4DM z-{$={?t1#j`+*M|k@S4o?mZy$U+aJ34VL+-%b$8x1GT;`@9<9Tr^_cH%kn<+mdN^~ z>p%A{iYx!u`&R7H^Xm)mRVnN7|I#~{4Uri3Ebl9CviMK4vb?Xohh)A}hvRu)m`Fdj z%<{hV=1V+|f-KAX(Q6g|bi9A@B2u2N>VNZomGM47m3{vp8E+I7|3>lmG*#chA96Tr z%=OU8e^=Ho9lyQ&zS4gLI$2&9zjGJ>iQQ&lHF`(db6RJ42l&TvVV6XIcJ(zS-G7RV zC#9^+Nqigv=gRa+dr0 znKEDIsPbX{XT4a9uOZ`=mmDKd>#<{P5I)EM4tCKURmDN{+Z5vZ*$^*4aSX$ zC;cpMj(^==y8N>$U+3>9^MO+KcR3Fxl2|?rdM2^Fx2$iJvHZC3neu&7ugBvSzrR!e zv*S-Ur+%nY{~vaO^rfO=Q(OEy= za`xB9r2H)U&GH`f&yfB29Q2jtJ>qwl^z#vTd_Pz9FZ)}i+)0&R^Vi7wlCH{|@Ktin zw@9^r+wbQ1`-~I+*PZp1;SUK1mtz0#nva(`aRYK*(*E;W&KOXB19Dz-{tH^p^A_a` zkh4qwMJ*2#Lp~NcIYZ(P-6m$A95Q0obGagBpTh;S&*KHN&vON{pNj;O=MuqT`)}Jhx+-D0WcdcOR&lSv=+$@-VGWipAuIv|k zl>HmE9Nl;!S*y6D5K}iSn7T~-&wrWhw(QRrP8A1go4^wD-d_@aCV=DQrq_qVl<8ZS9l^Y$zR%ywbH zY^QvLob8xs&j9c!eu0wl#RYqT0) zS^t&Iz^rHT-_^O&>7{XkypJV+Ut`7pfyT=I4>eZyZ`GJ%;BV7d@iQ1m7*6&7AdrJy z^8Z92#{j|PI7V=E9RC9WlInN6#;RY-hEQKESMv>+x;c1JPF*Hncvuc`6Oa@q&oxp# zUM#78F)q7teX4$C?96!m8*(%M?*caS{|aEW-lFZfz+rH44*ZISdBiW{4^lo}{tgAb z0%8s<(onpp&vR~s_*MKtD#VNOW58J?xL+6iz9w*p69kEF5L1^tMt+=N+BnLR7Yinz zTIH;u=pa+?ij$LmbN@E{(*)D+*_M2+V7RXLb>Zh;&bA!uzY0d?-6c2; z`MrW^50@m<*E@p4$UhNGzdsYq82@C+`OYfaGTwU$X1os(4Cv(wX3Y8vCg(uGv|)(g z;lRTMM}V39&vj0_&3?@`{(rTc{+n@Eb4KPQ$HSNTtmX`zMhfHQe?g?j!2eQX+T?$% zG5z#E(pb$U%nc?rmw@XqH|UT5l@hBnkN>sCg_N(+xQJNh*jQq;Jr!-o5zCxc*K&WY zudZca`l{w0Fnv7|uMjYOC8xpUA?8@0XUQ)S%y={lrp}Fm8JjxQTkjDILVu&g2h3GUA+xzm7 z3uR9l1_y~;oc~NJp1>SW6;HVq=%@d>Qqg@Kp>bcf0jACBS^#E05s|Z>GX%3AwZ=k+ z{hTXu_M>7Bc{HB9Aw$BE!V48BsQ&mvHBP6T9ZE9mjPg<9tj-cgX$6KR1kCyq1=D85 z!-GH4AMgqRQ_f`i+6y>zv=V83ZrVtyFWJ{r3}4i86|0RJhmn~%*#kH$mNS|%6^HJnh)X&`!M%$YF-@+ z0g|#Am>dJ}3IUUY;UFf5nxDYrI8WsCg~^YoOnufm#EVaokDJlMft78*ST1yI1uNSG zlZ*N}$d#QUXDp1IeiD->Y+<%BI)I+fLobr*ccg-Pd{5B$Kx83c)-(Ad^!lmvfg_Nq z7z$Q)3RZRktLs?WQeW9Aa%HFJhbB4ize>-oGNIEeDC5^(y|5v;Q$7 zXPn9fhmltc&Ov^;;4pGEm(Z5-1(y7F!IVEJn0`DhI1l;jg2TxFC7Al#1k+b8RkS&b ze3xMA@Kat!&iCJlDeq&+`&n{+%E{;MHiS=8|AF z=LM^|1kC=`ToQR$IR659j$rc8XZA}>n+(pkaDjz~T6nl%j(Z!Z?)ui3BC{V<(7Pfg;!d5m4#PZc#VbE3g-1k-)QHf$kz*g z68Q$fyuaQknDKr~@LW7`3w9ku<{r9 zVPM)v9nObtz@b0tdbNfFGv(k#Id%I9CO409l#^TawH5#=j92J1EgK*hnU0Cb)m|*P z%F?N~u+6z2MPWIZk5}6Y6km7?XEU zrRKo%l**a*42}PQECfuxo`T6YR51C}IRrY4+i@Z%_X&c@jcK8H$id_vqwP`ijTN5G`bguNrYOH+c#fYRhWp2~HxOsS%Qqgk{nC;Yj0A{ubY{-$8^eIS@|=m3|fPaSp7F8FkjljknMjKeCyj1}KUGJTzz65~OY=a1)K z8Pk_ER`)OGXiVM^Fzr|VitlQyPXsX%`!m;gm{_j;T;f;o2PqFPe}jVhdC@4{wt(_i zwY)R3(0RHqnng@*HX{xr-z=Ei+XR#QJHh$LcMB$WM|8usO#2F^A6z0S&jeP_PkS0`YPtUp+{m|{6A{UxcH}OtYXfIg9OvO(D@3g z?|l)|Ms@!JOdCgt4sGPLF#2VJY42pgw6{($<93l?+TJ8MjQl#mwEZ^0w0Egs`th`2 z+OE!@u!pv*7)nf3+<=E8_9|`?6WZa+N5f6rPKJ((74-K4R=!^VMWo(%g@DO@h+z6o zJ1A#AYM%mTKPo=J>}Ry-uq~Gr>eF{zq6)MBa>3M@C^(F~S}^UZ5lnt2Gw!s5_$=70 z{1qRSzXO%3o+mskBN>1B{hu((=D8VtAfN9%af+_1Fn0%!lYJ9&! zB@+Ad#rH5Vbm%*I&9z2epGF}m-%AzL@1+7$SM9~X$V%gU^ z0f#DC%g--p%z7qw-2a&pKkmx+b1i={zG1n7?^gm-yGx%1tZh@7vxpIe-$}nqvj9fO!wi%wzzvhXyFE9GM$e?%~#_n2VD@(ID?f!7Ew1zs<>0yqsXGtV;xKi)-OZ)RSF zD3|$}O)O{2FfqxI7jd{izDjTy`9B3S2LBPv80->Ezkd_Vc<@;O`(g|x3Z{);aeN_X3-z%mzY2c#72=^1 zNu5c68D~rzC1*W{nL4zEeG$`^g9X!;Lj^Pb^qD%urwL}eQo*!K?F-Ne1K%g|T;%Hn zBf}@gH4o#wK``UbWZutG_Sa~cl0Tv`eekDiOdZDaUnZWVdXCXPpM#I2Vhf!NG*q#D zRLfOtAs-HT7$W~MEvFCUoC-PZ_Al3R+UoO=g;ao-v6FMc=fZ=;_?W#QLfli^Q%GE< zaS<^ez9JP9bD=^SjhFv~f@;0+%eBrp%2#VS-1I`V8m9|}nR*-{XFT>7Ib%RysLvSC zeqzQz?FGP$!SNywBUkG`pqnxqf5<@%|nBgO4Y?wG+|Lh{`q|AZ6ArDPc)q1Z4 zW~@{UFV%8|XK2j7anJEKYB^(Su1Dg~pS4`Y8JL`mBjv1T^0{Cjb-*ihg@XEeoT+gi z%CFRzf6e>vM$x);h`t!3jFEEgiv1=UFXh-+qJki}Q)&wHm^%f*%Ct9QFCY04W=<&@~F`dq!Y# z94&Ijne&4>nV9!w!8)8T@L0;@9s3N8ZvNHAmnv0(CiBX~40lRF=-#~871bGBg{pA!&?efxh? zP|uB9G*)xtCXK_$%=wcsGUw7fV$6r5K$tJMA27#>@>*auf4+hMiLs-6I^^`noRjGf ziZgUu0-3JC=xFOCsFvqI5VCt*A zUi6O=c?9yK1s4KG1k*ot9)Nx^FppEFuL{94AfF_7Ch%o~^MTbhC4H%D3V1Z+_lnL~ z;QIyBHoo^s{&B!h3LX!H0%m-PIsa*^dCtlBn)me> z7wX&yefm$#>yCaBFN2(Oi1$a`L;QSQ&%Za(@BCRBbd^hB)iLcP|wIa_#FxL~$)bfqQ{DZU^FShNE zw%Y}F0scbp7g_Q-pBo@R8iZE}I1Tww!EjN3h6?gb;E5v7MqVv=2Xe-WZOJ`Fa1L@F z?{yTw+WSQ329du7 z`Fz2ffo~B^Uv3w?1$dd@V&Ij6X`9*;!8saO?TNr+fz_S}Or8y*KMweH!Q+8931&>x zdwkF@1?K;#!8lX^t7kjFRlw;fT3!P@PB3jaPjCzH1%l@SFA`i2{G_G-wBRPlpA|d} z_%loA3&9&8|61@Y;GYDi0sks^2C#a+40g@~E=|>T-V8ib@Iv651k>hQ1up@9(2_qa z_%6sF72FEES}@02J)1&b8-d>v`EuZo1(Sb=;1$6C6}%F7Ul`8VQYTyROyC}ZX8|8= z=^QI~732}Y7Pv()Iqwj>9+=6$N#_uI zzMNY+0f%nX>%bobYc1$}ppnwY+QO8H7uT8ZyUIHMyb|kkk-g4u)$*Rym-~@0F%OSJ7bw-&GvyycJ``p19zi;AXg)RM>;X)>u*4~O26FZO6y&r~-P;0#MxRN5 zL%;*@A`fGGl3?0+rr8o<4FN~v2^@_la5SF4)a@hsA>=BakVoSQ9E~S%7&U<=a)#%70L z#^xu%)c-{=$KqGP^uvRD%H znauoAI+zdpV)0Qr&+B@|&b*JT=Kmr+*VMf{Fw<#xg@D=T8G^}2pD8CFliSyDr!V?L zoiiX03!V&2pM8Fa6)BHc=G#zW=wAk%2(i3hTqJV7UtCQ575*U69_p`woHm6xxscRe z08IO{@S>dd?<<(P$}iDZegTIdKUZ`ZCp^-Ma`M)NJRFzn1k=B}1S8Ymi-8Wu`hJmz zkv|}qes2_NyGYIaj$|k(2&$ z2_Vh~zR}XZS#Sa53j}i<)ck}#uT3U*tlyBBn{|fq@~;H}662!uJIb0b;}xd-Df~fV zEX;dk^q=~j_mQ=0A~j?WeOY7LVLpq+SWv$=^wr$pg@sfh@}nWIBHlo$=gq{6`j0?9 zi&*B~T#+w;{AR%~051{zHE=6256(!-iNO=bq*_5N&zV;eU#E3e5!Y(GmKge{Lw~*C zLBJb{o3zemk=H@KUGR;--wR#}yj$=;fz!~8oY{zNrr-wH$@_it-hG((RWw4%6&>Cy z@P40dKf&0kYvDGn!|@6Mry=hlI0N}Xf-{kyE12UvSuisFejnO~fG-j``I-dxM6T9( z>8n-b`LKoS7yG4M{}voZzC~~j@=pa9ApchIP~>fbha*?_P{KbDT;$9_K1eWQ5D{Di zeRZutCl4~UhD+Nqq7#A6nSu*})x8*W*tS~a#lY&GOWLY?E?_=J_?zfJ#rsZhDe#Yi zD}a0O-U0gbaj@Vj;Nt|>02c~oEctmL>N8ado&h{r@J!%3!Lxw*87ZUxXThT(zfv&$ zx=t|tx<&9<;Dv%Yr%Tl((^?g}1$#=_XPU2q6; zbI-^SNCqvUk@4`q~J5snzy!!EZr6 zQ}AZs>#Vj*EPZvq2A-|ZStj!B!1oK@0lZ2u`{n=b%Q>(G_zl5;-dloS0RFe&^}rtr z-T?fmU_kG4!5Nr8Ukc{BnAbt`e*v8$!9~F53TE5$1@8nd75qIg-{&y%vtIBn$QuRk z2ENA9xz=Fxd!1me(@b1%nKJMq9>8^*_<2g@oX>~5NFlt;x}8n@Ii=Wd@M7CPqAlpX z&=UMXA}2B2)}Ju|rmTy|*-v-DU6J<^%zg$7W5@V;SPy?oAdKfV({?%Je-&t zAW|VQUc{r3e=nGR>=rx@xq2T2IvlTl2m$pO zC-r`Z@bGIPlovoA5zP3h^8nui9t*7I7%<0*$vkJ{c$oKhI38wRbrpO!glaCyzQeIG&-55~e=GhVF}`fe z_l$ChzoJyu=WQA@j@0=HI`q^0KQK%ej~^q5}b?tX~B%sdclm7 znxCyYuAhjUeW^JKIsN-Ww(oCy^Pwj7XYUL?}JwenEh~Uh}q9Uf;n~<2~bqAJlmkfuL{1FGD9x%uN8v#PAEqBPg3|OnAYn<B_Br$&Ekb%veyq8}X#i zW?UI7K}{C0Xk{G&s%ae zS0N8W_L9gsjvEBi_SXf|_ICtxT($^iU+TIB57REZXeY?ts?8C&0yu|xq z6DO~U569S?2h<$98v>+#@d^Q_AwNVg`Pd)jw7I`vat{>q~+`y68hp}JzvXxS~)@C9wNQ{fmix`Ra`+Rd7DUX<& zJW@Vh{$I7cfOsRNa-F`aF>MGf*I2Eqz_hoY$Z7A9f~k9=VA`wp9q5yLg2-w6p9Rx) zbv;5S49srW7j0ZEI0N}w!IZ0c1)ZV5>UlEoaNv(bhkpMmI2U;jxJOR<%4E&}D(0Nj zNc4g8Wbq&3uOk)n50#3J`Bsfp%z4N~3gcz=efCG5$H7Be&HJS6oAPTRS8)cu6qt5X z{u*$Ecq9HG72!qse;_X=mhn>i%l*`l=a#_qL+vlX8Nj{p3IWq6#)6pRGEgvmV(cjA zSd11-pGpLWk=F`l|5pfRU(JHaeYIfv{TIRX`(DBH`vJl9d%a-x|B7J7;61?++2d9dIV(jBf~-KB=(- zj*cC0bnJkmV+S0Dz8X8=Vqi6P!0bzn9Wc4o*a1h!4mb~THFm(!u>+2d9dLB)fTLpv z96?((cEE+eYV3fcV~6?7--VzZoZBY>(`Vv80cQ%H1gypp@{57hI09b-OrNR01eiV( z-whlV{2(xWqx@}P`bPX6aGv13un5yP%KHG*H)8%D(DaS?XkhwAd?Ii}@Hk-lMtKP^ zeIvdYxLEM@z@r5(1|BQ;@4({(uLmA4coT4`;BCMaf`10C65JWVsS(@@xL$BRFcWQ9 z4Q%51Dln@k|H8swb&17o7jT~FWLRramRWPqwl}b`GY_~%^oIb?5IhQauHezYO9Y<_ zyh3mV@EXB&z#9Zl1!kh1=Vr#{2LBIL;|nqVDV-4jW^SAYY~}`a%-pB}?kW0|hb?U8 z2IaXTzZ^Kv(lK*`I%aO%2yEsC<-U zjo)G~t4Xd_TUlEk)mDsTDxWfCa&=`%Ie+iGq+)7qE%*#ovig`!mc}IwFrXcVxcUHx zno8sc+!MXU&!0~;wI&MjKWkmzScYFuZ)|FqGQEU9bDe~vqN%2_q^z!qF|MyEGoeec zMs-+G#h+y_t1T&Sn$}K?lj$aqPO5Aw!7rub_u`vMYMZ9U!fae(FcXv#Xc|GInzJU^ z{LsNJtEsOmiD{W(wfhTHOz2bpJpJ#Wa}*PMs>1J`H&&HRt}Ll-oMhRS(4{u4v3gQT zS&glj+=)cp1X68YqGAwfGTmgPl?|A`C3R)Bm6luW5Ig#Is3z7-ZLBJpGPS9GDn>Y= zLp9@Kfo!U-t%PneMYWpjL8rX3p$V77MJ45BB{kKJanp*kQV&K|WlhZ#s!hd}=3Ei& zYbCgVA7!qrt0-xY(GEzkdIGBoOjAQyU1R-}hNkG6O55t$-Ndq{vKq`McpF#ASk_c3 zo$5MHI4W2xFA2)(6$KWT5=JY){RE8!`*?BJS7Me}3`&U|l-E?2H6&D<36xwTp%*R? zRgEQ6E~&HoF+_G)gEbQfRak!qUA&&@sG@Sh)JY}v4b@oo%AQaVa)Vt%*(LX-DP{V~7##DHE$Pp(`pUmIW$Q*Hy=w z$xfe-Esx+Hh5tV~@8Q zB#?2Wu>)BuL6#GUwz9Z_k4S&EQd}tGpz7SJ6~mKDm+x2CJH} zHfpwAYNRoDd3q^P3uI+OEKams7V^0If!G7e2C}wZ6Nq0WlNzQ>txsx*sdZa7PQ|Ur zglOa72nK63z3A#0f|aXmQhSlm@r_pwHXrv-7gxs5C!SYJ z^d6>cLq|#4R@YZyGIDO%VT^bG_Yg5eRb`D;qzUed5j%oQ3vLC*t1mF#ec3G%{HSll;{d%x zB0_p;Zil@c^@b^Gs@bbVpth~RrIPn7a40%Y8(~dZP4%VNDRAk~VB9~H!Ny=6TfL(o|j6gex=Y1mgWoplXo&>OkRYCrl${MAF_l9rWY9IxH!&x>QW9uc!MWnWD8t;_2P9_@-xtX$5Oc>1N#c;%FCFu)C zo;~#CoFdu@lB?<3(ok7GrJ(|QOFeFE+wo3CA^I2-Pn6r~Ge9@NQw|=UEZ`v#HZ`&( zXegFF)$_8fMZ6|dH`P?udDsA%C0QvLd;KH~_XpETCN`8|?X)pdB% z_P^mz+8}{GIum1-2N@lp7JRVM+qZdK($0XoiV2pLRp9Qdv81Y^p#*1*7-KR;9vR{k zgAJTgkBu9XeScCyKzFdoEtp2p}Q%yzpJnI zTLc`1+HasN;u0ih@G13EYxuYVm2`$#?@X ziSOgpBVu^IA7$pnq7O!Vw9lF(dyq8(G(R|Y2};4sqrQ+CXxvs!ti;=aScMUZ5d1y4OnZ}4UVq1xh9^SugQqPeut!$XWiX?-lM_4^L5S5@F6SWco39l(D zX)L?gbQZ{zsFpxw?oIbV6`-c5IB^5&j5P_>CX76IF^(6P)l4-mB-lm;YY}cIX2F_) zgt1NZ_fxmmW{(?bVmAqPAqv%48*osGJs4`o+ji6wsAKnHCd_7R%usNQY%L?lHL4$w zM&~&sYE2b!l36Y{ws>cng6V8;T>GiRTSBD(u z?uk?6Y-QKN<>WQxHB;)0cL^3puL^WnHKnnMZ^ySYrtPQ)Q2$QK1hoVzh9h>I*n^Ep zl@%@L5jTb-^c$Fs>QP_-WO?XyBS>aI_rS?3`DYR zT7A+$-k*$4@#r(T*!!A%NUMPC|Qqo~qQ(am&lF10@DTZ%cfTJhicGQc?xw8s9>T zX(m}GWS_$&EsR<(Xn6`yH4oq7CW$>265806>LVZO!xea9*%<5(@9Uyr;N+5bJ>%r6 zkirn7Hj@>5PtBBanNf;~mm!|4;6z@BZO&8~qJ-K6N7R(4tSfJr zUXL5Ls>(WycDY9b&~{*X^fHMa*v%&m^`}Atc3|$2c%KR%$5o%SDk+~3prpDr5zvQl zyvqd5;B|_e>cass9pj=2jgFbE7VIlOh`^5U9u&^{$fwt;Jh)>ykl;-aeBYp*D>+Cn z;E6?$T699#2MZ1yJ~Ti0$RSRrbhBN>csjFcsQsdS!sMz^%7jnkCbO_zMMY<3W}r<8 zm3sLvZ)_UGctlGD_IybanInc8Ei+^Gs2KHE1=@{EJA}zqqm%)W2_|e;(G6iDg%!eB zrD|qhFkGnPKeJS!o-LFNcBb9$ZluQs7uTSHgYZqL-X|yK7`)8UsK@jv^oS!YAZ3ED6gm0mo8f!a;hToKJMl8f@U3_FYQQ%SO622r z66FnBkI(!*7>+j^zKE}=P4R-iy zlGr!E;R}P0JmkYy7o&V#9KI&-oq~FkjK7^6zC6o5ey7mbHv$+G(fPL)g)qt{89x61 z3B(bpCqLT>oR9~#d$3-yePNyfgj zp=aBdc8i{;u@B79YQRY4|4eiMMYJ_=2vt^Py+kR}4OW zuafp1VDSxc_%@@S-)}a_*f+@GYXP4b5B6{D`vn7Hk4I5zaQuFNo^9V2@X=4&$1yd0 z?>T(@fARSpQj?5*Z##V7Tk#7++3=lJ5O3cs@EHzr8hi%yh$9ptW#1aRK6;~U_=Y=t zE#Nyuwa|YI-%$=VT_@pU^Q-oBMd?CSzO+rE5@udl`T^Wb>CRY~mo9(p$4aEp)M zZMfo1@5zn_P ziG2@4&*m$&_y$^h*ExKjPm`A#`g7FfJQ;<%lFW;`IdukEO>bR4zc() zIeeqhXc_8FA_vo}4&QF@ajz!dP~_BO{KnniKWH)rp7zU&VAJN2ki$?(mBp3Qd`_&87K z?{UZtUzx*~3%&`ODvocw!}pfO7qR$0!{%=LJ2#1a+o5OMm$oow-w2EE8HaBP_|8<8 z=|9Hbe>i*v7GI&o_YnrkwvWFj5H!B;L(jIa0(=mu_>Hpoo^bg1`v8EWXn$zWW`%;YsYf+u>Vn@r}0lCS=Et?>O+~qTVDEzrQ$oGod%kC?Pj` z$2ofZzxzW0dc&Z{HW8_NVPWh%#C6MzN4CSa5qy_P8)l~8ZVsQfD8_e|#rGQ~uRWiO zJL+*al!otT=-KuS2VV}9IA6wDe48DF||WeEdH#smJ;Eki$0@e1?Oh z2Cs1VW`WPl=kcP)@^ud1Jn&_aNRr`earow0d>261*f+LQeEjZ8V&Cb|W1EQdv&7;n zh0O2`b@-MivF`|nZ@I-c!Qxwm|1`=T-!Smm$~tJTaxt4|5M)P+n$84zhmD{=;6|eCe!bd zgW~yiC(*mCTfANd&Sg-ICd0Qs=B;gCHuQqVtm$3 zNVBYYbv4SY<2>!*@a2IITXHlRzU~g+Jd5udXdAwd4vDv~5PU)7`xY*KJ1(Q47moHC z^W$~s*?ufRzeUjFdT_1P??Vn>J@~E&;9KGFZ3kbe@XfXOuJ09Z-%jwESdiA>IncB1 zD{PIe2iIGC6CA$p!BPEWB6t|d^r~1;}+j1!iVsyl#iQ6Ovz|6eA^tpeDF??HmR)Ftx)k6O<_8sr=y~Ie0QSEI*#x3a6I2!@Zl&LO@^-tdN$v7i|<=# z8@@Ttb+jCOLGy1G^lZMJ;2RDeUgzIid=nkMHQ+l6^(Gnn${fDD`(k`QLfP220Q1Nm zkMF^UA&Mr$Hy?VoeO2INylCGp;oA+qsZlnq$6|%U*95*I$jSE$a>I9&!`FoK zWsrS?9lkY|eY-8b42N$9_@<-YB;#+Y!?zxMnBvO5-;f*ozDMxv`0WCp;UK5Mn;gB} z&^v(&l8oM~&?AnBe3#`1e-npwjQc;Gbt8i7B`j^28NTPBXY-}qAB%IU#dnLtR|>w< z0{G@Re8u1^g&xPPgT*)C@c6i_1fQ{qv{|ss995#p@crc2 zx7yO_hz!!8~9_Uya&OF@=J}hmDFWcf<;qZ+EUvFa^a%11U4&P3T?*NOh zo3pRZ0N>C6zAn(S{mobryDs?|Sk`fTesb(v1-{bM7@@K6TgSdC@NI`0$KxQ2FU>g* zh2U(EeQmhkwe2f@Aols)u*LTQ^iYh>zhdxx7c(y!zjqwIE#O-v_Vu>-oFM|7m z+yK6(p=aAS@9(j7lArly9pksm;j04Qv;e-_9lp)rTLL}Cudl_I>Z}J_!Iu}n_Z#AD z+t>79Y<&6qcgDWW&Uj?z;4@DFd~Z5@Z-LL)cbLVuwO4%n7J@IxzW1PK+gHCbW?!Dg z_mso;0{B`2>|5>dZ3N#ui64LSoqcgURs*0In=goa(D*(AJ+_J9#Z>xG?0zuc;=9G+ zYXV<|ZleB@gJ~WBafAh=Rp2xB4Yv3ez!=-U%}MN=4?UZ&@Zs3|-31okMGl|WSN~p| zwnB3d*EoDD!N+;Z`8UMk6P|uqgWsBMOkh33+1K)P&(cj?~-+YH}7Wm!_SpTkb z_=aO~Ndp)8ja{m>ItN9loa3 zvGsYB#kaguynQ+OF%FyWPUzY80kKBASeSGabGHi|-VRZxkjW ziqZHD2jBQ8Tg=uIpl90`0bd3h(!OGg?_h^-A^7+kza|;`4siI2{-Mu7ylN9c&NLVO(r(6uzu9g4xDGO#uRck?^^RUsl71&ckK7Twm=;?7 zjWc(fFtj~9WF9%BWgTD)H{K$3qTEJIj$dDVpJ`Ue{i*LNe*Rf}O zTy`djOA7SJ9g)7iu>8Hi;@jRMo{!&CfGN>r?E4UUHs3CbuhioEyYqRPo=3!dB&p$> z>*$4{hb23jjNUcSv-?e36PqvPR==0x9E@Ugo<_ijrqN{h-ge?w3cc*8R?NPW9lmMM z!zB|bIa4$!19`ufjvc>dzLXT}CQrFe;x7zZz#@Poqf-fV0Z<4bQ z_5>gOoW2B+_7&-68k=O>|0^kcZtRKn8Vi!K5SjlWbAv$;ahFl$DbHC z_Fd`lZA@a{42N%{W#45M-{}tDTS@FY#o^mx*~jV< zxW?i;)8XSo@1NL#BxB!bhp+eohb&f+^B&jr~$T?nQfqtEv)-_g*s?aO!pzcq@6 z;B*Rw&J=?yW;F|{}`n$m5JJsQv z3%)xH8FIrn%Hf;&vgfT8zC{+_Kx{rJM(xWR5o}*SIiE$K%M^JfX5VcVUxve11->Br zQXRgH;9Cn``pch4rytxuR&eVjWj`#R%!1kEwmTLt(+QMTCl zc7UGk?+%OaZj0{&DA|0|z*ic;_YU-IzHHnunf>Eli*H=-c)rcx8y~>;C+OLHW5G8M zdK};TEWX1XzJgJn$Irx=L=L9I9KP+~ z;+y60g-*ujpAdVKjD1%)e4#h-ybgM_??H>NXn!Yur|EO2%Qq5wcKoJca~lgK@;zkn zb#eH1gYO(ehTPcK$>G}ozG=euh{d;eR=j=VP7i*Lo&i1EzQT86e2-duAMX>-HxGR4 z0_@ugJ)3V0_;3j;e;>E_z8(@!jw6<&MMWvjgnA+u>UYzA*I2_nO7`2+C}3=2Za}p`mn8lJWQN(6jyB_@7w( zHd=hwIeazXOJ@fTA3yVH^W|)h&C^X5UxmZhbT0fbWXO$uB@W+C@R@y(`vdhjzQ;Ly zH-m3c0N*f&FYn{nc)V@#?d#n4l$;Zzl!<#n^a&uRn<- z8NUBQk2oUog%;nt7T@^%c)n8bnKo={_|Ar&&3700mZP5bZL#=HaQIrmw~_`+GJJf_ zZSxg>5*yzSEWYQQbMff&gWvyn$~hNjf9iQ_(I@TOYVj?0_*%jDlQ9mtvF{d#Z!`FI z3*Sc;-xY)7_;!FV$i6WS-_4)J?EA#x`^0 z5_Z`#Ck(I4XN8+)U+U(``Onx}0lke>kYxIunWNhny#gGbBSs0i(Yp+K#HMZq>|2X6 z*O%Rvef=H#n!xAIXO{2o8{h9N=;cCglIgcACMk8t1wE)S;tpyPo0~puG06!&b5j8tcD9 z3JR3g5km$I(WtcZ6(<&t@_o}Ixi5(J4{C4L75r=7PtL{vgAvo!HTZjLTU!+WFTs#9 z@A8z)j5+CZ_E~u7#Qn!*9`kHlTk!+i+S;ycYkQ#M)(r2cRVnKxd-=20&Oda-d5adT zP8n6@Wo9&wOv%h{9_cr?wl$CRnhzb(qosLdD)Q!$Y0XPBuYLSEXx|AAFhF`<%e8&F z@0*s{;hcTYgXe8(onm!y=&F?2XL;dSYctQeW?0I)KY5v}n@9L#MtEaJbU-g7(lT?K zN2HD!kuteA8Cp8d&*(I9|BL1?J#q1ZWu3g+J9NJ=z1ml%Z)*KIo_O6UB%Z&taPg%1 z>7H^ReUvx63LU_U5ngk;2h&HS&TKiMc|^){>E3fA;6To`kDs^fN?fL}9<3I(bgc46 z;pq)}U)+0HMkcy^H&u7Ibl+{BXM#mf4rPZwj!PMJh)3g7Gds;6k%I2#kMLSLHfLnQ zpO%i9=a8v6WAE;}QiSIyo2OtBNFFOHqm8LBtY`K75kAb#Jn@`;&Ky`%PgAH!J*~cw`M=) zb8Sk?j}5s!R43`p8T)i!-%-!GrPJ66rgi!pA1ENBbHP3{=Y$nbW#=tFHs>DDeRWFrYdC6%>C$V#`9S)w9a~7*^5es~2b{`j|0*w? zmJXM;xCUeIOO_tt;x6ea3vadX)DyJA-g}Fp_|ESNG4+xBb<^hBwzii9KZpDlYlA;% zFWn|ra+Z!3TxiMekv8{RZU1KBhXp@o$rSU=ZEYRawzd8COl*Dn<#_B%uwxKjegyYr z$bU6`S?k!bkTV@A`MaXigz^=5T_tkrTxj)ME4abP=Crj+^?*-)i zzgq0{wv>NCzBlx9@ERoTj+H#-m2P>C$XOZnjh2it!qC{=l@ngY?^svtWQ$6 z{pxwY;ni-!I$+lyA=l;*fR{$X31wte!AqHWc?U&Lh9uyyY}mu`qLvR z>8GhR>xR~rjMfb7Iq8Mb{b=0@grh$6u(qyyA3Jf^aYdPFBg!tw?E7q6+Z%0d+c2%U z(La^GHPvhG(0Ts)pC0R%GJC$)^3#Oe?C$9&H@9xM_MXiCXpaT0`-Nkh`yMgBZ^8Vs zZp~#`%bqRL^5&O+%N&NILHg-_=3cW;^U+UBQFB>WtfysT1|OO~=FlOT{iVaUwi7(> zfsR|#XcO`bueNjddk$6`77bGSzylqBO-Idu^aFQh9`Y>K*}MLRiW8Kj9ndth`;}s~ z+WnsEt@pdT9vt9TvWTNichesUkQnb5lB!sRU;cdg#By!p@}r>=ka*`iH%?!Y){yPA6% zySAa1$>^n5&*}x)DYMT9Ja~SF*Z1U%RZN^K)-IYr2PS z`W@JP*g?xXb^rXph5L8^`HGe*7(9RJw8b|*_mY`fXZ7{g9hhRZ@TL(_{m{;m2+;>UH`I+s%7ttPMhu;V~f?{ zG&B2}MJcoQPsyCVE<5E)6?+aWrW%epB^W=4pM1z@LC!s+|n=y6Y zS&;2#rY}3R>xerCo^t<$Q@jOe^SJj7M*A_DzG|+|p5qP171vF5_f)DLvF8rdo?F+I zKFuMZ7w%98PfVN4KfqfI3Z^&2%je(w#p2cT?_9ljy`Bo2?&7S{gbgG#^KsqhZGCf7 z*5$L=vh@|cFi%o&HBTtZg8t0eJVVVtbV&2bX*2KHXXdr)7YE_zh@su7aw5n-48fwc}Elgd$qN7 zKkOOIkK6%R?QU#qTfA^7-m?Bj%DNg&ir8&aW~5OUYgH^Zigq1t0b=W(5^>tEd+#@G z)4iLuP4L3=M&0H;+^ZYHGrx7q;^mn=wGBAiH}tW1A;sdzK^%31hwH{nsGVMK%$F3e z@A8!NdSA`yh2LPRjJnm&ESi0b3BpUp-pu})D-@UZQ>}PrM&L2S;mX*|6PtTw;nri) zQRlWaPa2AG8eAl^GqZhFCMP*Io~v= z`g685r>0<^8k4H;L(F*onvUxo{bBzqO3Pe7XTR=`{q>wTT0ZU7)^-Nw#Q&k~UErgr zvi$Mt?xgde)dWJ55R~fhNQZ={2;rd;z$UyD5Mw|vbl!oyOo9YQXOk8~CE^M_YC6%` zNt#zcnSsb^K-ozcClef*k<1HcbjLXEEIRHEVN@a#^821!r#jV5klD}Y|1ap&w@#gV z?z#7#d+wvE?mchtVifR%q17G>D^~s+SExJ6e`BPVAM4H^tz5<(BI4#{zIhq4@?+!j zM_WcC{in#%HildGuTy%f6oaQnf_}BK+ZF*ucPp~z9R5JDEw5892cIQ&R(V2+A z7U9kxW0~hv8*s7*+z-P2gk(!1C4utythuJh=X$J@W(kAS(g*j8r1(fYeic?_Nle;B zaZjN($)la^UXwHg+7$_~*;8RTwK8vC?*bjn<0gr_u%8*m?Ou6;#D{UGbB4&NVvXq)+0<9{!I@!=%GMNql$bd}Gai>B?KDhZ$Rk8LHlj zY)_OYot*d9&Ur@j8Ohoj^v$sk&VAN#_+P2_VzwmL_Cl4~o|J)s=>r33q&6#;LQQDN z;SXvJM?%_qyLvtf`X3XDKQT9c)<=j_w0`H$UFhgL=4~24(+VrCxg9NG=NQ#@AtP(< zFb3-F_(Q)hODK;K7gAp{a-f5J*J)9vu$mw#GcU=;Jru9~C~OIAWU8>eqh9YjhZT3a z+O}9?Q2jff!l2pRHIZuLNuzm&v zJJHjDq1CzW{q!giB_=ABd#|UlC2_{O-lSm2KV>=_T-!luFvbaeHimZZAKpWHwDokI z>o+OAxS15a^WTk*y{g~t-aitLH<4S^FZ@KXLUPS7zuPC9zrBXWsH!E!yEI6&O2JCV zY5U|>dlEH2El`D&Frx?jttFZIvPX~yarVhu)-+2}Q$v#{tO<@R6b0Y;7RRKuADZ{q zT)jxENpkGChJryy7``ek53RTZF=eI(foM&aTe2 zf!*#1bV;ysy(JZ|LyMZ*)YvEHFw}~T(!pF%j``_pUgvO^b4_g|Tz@S$8~f?evM9gK zyI4!KS49R(SKXyc&PQj&PpW#lT~rCntPa&xuunN-F46FY6j{J!y)tizI^cMS;>i-acJIqY;!qXE00AQwv*b1#V03Vvdjt=cTPu+B40@JiF11mO||ae2?;{Om%QrUnw`fysTkf1A6Y}yCv(6 z!}IDO*!9k}+Fpw}DYW(+Vyf++KgZ^W);1H^gLKqZyPBoi$LP`t$GEznhy0;EamEbi zqps%Ex@vEiL{(N%YqM0PM7oUz=@51Os7X7v+a96xZc^Igq4kH-q}PQ3AdsuMqOSUM zmvp{a*@NVzt-s4<+vv7ET6bcQ1LDDqpyaxMi;`9lGQGq?*M1C2ttb-2*j6YWE9#j<+RIL)ZmY^$5!frm-;c9PU+=huWz& z!TkzX>&-uE{o^#;!t^VX+}?K@mCST$&M1&!ETRnE^F>*7@7n{hon!kg;i@=z0dHz> z9C8hg;DUtFjI|by;C%0eo=)@_LfrP-30s#+EissMwuHk%+S-(s)6J>xcAS1sI_=!( za&BmKJ`(3#pD^8Jd!*LpvTdLWyAczc&$S9-HUGeGIQ05$f{>$n(bT`GA7@ZH~ZOIwby6)#ywQO4?@$TboSO6aTV44 ztXWnfEVVo5Ovd=Qtyg-v+1pG*%(U%B8Zf`yykZ$$Ee)ruXPezkO{lhMq115`W!H(( z@^!A^tl9cGkBX6(HVGc#Memt-YU58%Snq8OkN1X8tU4Td^rSrO)i>sboNREPvDZhB z6hgcA+iJF6bDx<=7QbGy3_H=Y-hC--g7weTvqt;6e_jv!H*|ll!d^rX+Nh2Xsmfd) zP;y^Ob;Kg5-hUu3TwUKHGu%!6ExpvF{OdI|)6NZU=Oe;(9P}8?bI^ZvBo7V~SP$xY z&04QCc~X$`fRhxrZMZu%1STU!Pm_lw(3lw|dn%l6W2i z90&RJ^axjTp=d2!&85N>XvwrT8blg|k4<}5ZB4|5wQf00Ugf%Mk0vTE=cBE*M^+;Z zW;g}wm61xXyXzWmQRLs}ngM^{B&D@<`Fdd?*F+r12+;s{@2f{T9eeuMopXhaZ)kRh zjiV;$kPM{`9jhfLMx_#QBGvkc+Lfh{cS7!&>hArk5f*)DQ~J4nnpO~Z`AC^>=muV z-QitJM0BT2ABn!hyYvK%BB_N;ibUu%IGC~V0G(L2i3q@89zNg>HF!g%#6I+6s_G(l zC(BAN9$@YKkcPfi5DrbBzEs_5otKlan_XHBTDp0u+qGy z%WnOAyert`4mOf)%#oKreW<7Q+)i}DU&chM!5u6S{Tmq>eA%94>AP%Sn>*H6lZc0( zJI5LwE7kFD_kl2u585vO_iBtC?w01KU$);rrjm4=C?zF>y(Wd&(I4Lb?I3$K#?|Ab z+@Bh2#!H9=Y@M@N>VE1rb0$G%XAGW*LR_az^@rr4qo~R|ImjrY7YQftQc!Je4e307 zh52Y=fdvY_&JkKve@FfdMnwh=BkjaP$$1?pivw{10c+rx#GU;#-KH1mi`p6|)x2~? zIal{kOHb9|_F;9N4ou0K_YOExHL1x6+tQ0XtNChRhI7pv_37|Ap081;PkPC=!FpS` za?W$C?t}L~X-Dr%>xfjd8B;$@GCz3*4J-AC^)fDXq#g+oV&GO(pE3yz@FNrRjgIB$ zbZqcC*C789jo0~L+9av->#LV+8@oZbJp!-ea;~4@jGTiI>uU|7D}#>kC!)c|z#WB2 zrcC{lJfA-@|LK}mVXfzbAREaO-3+7ZEuUmfp^B7<+hnYhyb9${nr1cG5S)V53U;iS5yD+s0Pg2Bkw}v)XaNLsfMW6U|NM zPp_h}nqST3qUMe$OY^%|tQa^YcEI)zJSkM^OuVY}Dxt2>VOG0Asm_i5m^CH0QuABx z_a7+06=oLo4`}}X#{Aq0&%l*9YjV)(xP=#YMOtEZd*u2T;xRC<_t@y&iPqS1r%0(; zO2b@Lb97xRSl>N}0h;xS35h{kz4R=*Gf2vf3dUrXHCgSDbbEJz3>y%mc2OXVZPb^+ z97<-&P!Hyja6BV~Ub#`D6eHeIpb;aUX?SS5U}uAg!f?Dz6aloOWD>KaZ52MVwA7ZHfVMZuA^i^L=$Ln%}!%v<3y2nP|{I`$4tryyRYV=@NZ35v@oU z)s}8=n;*~Vrs8VW)5fl!^6jUN7-`s!ZJzYlELR*JDnvGV%9cuQ@5M%sWwe)2Z(|Dr zV$xqcIl3!_ME|iz9nTv1jf?G(+YQ~`KlN~45VfC%0-RA4Hc)ol!uj7KDVHoU?)=F*xu5&V4NT>Af?4hlgxp(MZkvR(LvX5PQ1D)pmPVm4 z3D(=rb%H_glN}i-J4h#c%>P+7#iu>zg$*HZtY4a7>am_B4YRGGhS(oiMz@AZZ=SqA zwqcl(W~XY6^4+`EFMHJH-)Eo9Guw|RplFaYt*IYg!d%bt4wU2G6?*2ums*ChYrW2D z-YCX3_9@mELoCTl+Oja=jOwILR=D4}R_|F|W-<;_wt1Ge1Y5(6^RiMfwShJxNZQso ztS$HmSs?0mxVdHI@`utkb9Z|08Na*?Od zu9&J`Xt#{6pQMhzx(}{*ghKA^{!1KJuxRoyY|?mP#r@$(n0?mHpT^ckYExMU{!I%2 z2B926T;+vLsg@z7cfyzsz*^Ou@#gcVeq@NIrYclGiB4oSREp~lxV zP<4<-2uSiFQ)x>I!ypBvVok*(FEkFI)$QDau~tijCGp_A+bqkP6wKR1)CO7dYfZOb z6cI@z7c!qSy6t#6Vm%>w!*0tR9qdks#uHg3)NQv}&lp@Wk~QCuc%m847-E`~h}qG@ z5`XE6l}=gG`mWu6adO!07fDCR@hr52diMq$jG6A;YnmK-u;IRGO3E;WTuB?Iv@Ow= z!Xu%-m}fW=HthA&P5td}MbyU{o(rp*6oCe5xch)K`_M?}-1vhx<_vQmFw~C-b{{a+ z{~+%6i|+l>?1Wq0`#|e;?=#hp_#5U{-1~9)iF-dTKb#yIXzoK=A>Ltvo^T3f_GDy{ zS`sIXs7u1Y)bZfKTe-}r+7XxW6g3{!lZGcR@jPPp!7v?<$V_T~U76?#=~Vah9&BwiCz@@@)x&KUqI04v5kYBO zpYPh+R`7|cqZc+HXU)Mc z)+_VF8bXyzF1$sO8tiU*uQ6YJWJt}V^<*%`rgVk6;%0e_EhjvO8m1qz9g6f!Z!n-d zr+w2tS4liia?Phg{)g&3;{2NXJ_mn-IL)7MNABP&x_otF4EvwjjRRmqIf<@{6Yn~n zA3$t#6;Dv}z(CWXh$cJ=NF{gN)FAJsc@~2bl&HYm%{6BSrskIvrP2r)oTf1({{evh7o8pLlGeK7B?;R$)O-amAD@iAdYZ3Mz6k z%5sWx@=7WSoD~Hn#Thx36}o%nTT4qz$|`cQGfGPeiYqd5OUjCz73Be3Sq0evlp<$k zMsAriuLzN46y_A?RpbY7

        L>Z7;3JsL0PL&M0zb1>UZ#$SKZ7yhVYLmFJX~lcE&` zSzEB@JL#M6EY2>^cW%jEfHQ43Skg3lf-jH|6(brn9^vr!1p9C#x){;%1>Z zqh&Rtb=>7B8Op!_hLT)aEophe6I-Rb?~zNLW#u{GDtkPqOwD_V4KstRuPn!zjXzl> zW!aK{S(N2GwlxQuW+%y+TPx(^k_tJ$q`0IkCtJ?k&H|<4lH$p}f|rY670$dIIeTl_ zb!Cg`b=ZPV4UHSoX5|z-4za>AWawFtyB&rhqL=31Jya6(f|4kRFdC-vrCb8Fksp~Q zTVa{sX)m|$(k&LwRFq-bS~+JwTL z0x2k4e;o%|qzUD+c9riemosy6ijkY;TZ?kCB_~QOAY@j432aH$X$ASvCXkI&Av+86 zNP|EfhZGZ-9Tg=N&cZ<>W>ZzuBN7fpb$)P=Q&R7KcQsXc{A;^P`;NNG3^%KsDjVl3 zyS?kwySaZ-#W)K~i*Ib|!g4p4kwwC223@KVzsS`eY z8|>*j#gWxhy|JqrCJefxA!~X;F=`4$pGqx6ns5VaR4<_U3b~+Mt|%#y%k$A5Y6hy+ zew~BSNLeK%TMBa6%+M_5lnd?AdS>OL?s0sY+bS=3B1ck#NR+@VIoDZG2*+ffKt2z( z+rJPfc@-I1`8iozP`d^_)sU$pPbuQ16#8YGZ~~~8#gm`NDJ#*Gy#b3)1ge6pHSSs% zUr9=Sl|bHFoKsnvlLcQMaD&@u=^-=`@Ra_cG;>0z2UWj~`$A8j5?rq)Q~zP|%9KSq zqxMU$Pz)Ujxk$8q@J|74pC7m8y{>EXME8f>B@}>+LXjlli;7ERzncYcXeC8O=t%fU zPFb<)ew~i~mvdnoP!Og;MO0c=Qc;psQaEU|>~K-%AR-G@Dldo1ynIVRsecpY$3cy3 z9(9qjvhy?07(3CI$}KA?%E-!r3F~ZDA4;=#&BTYgCl_rkSDWQbwC_-&6a_Vuj;JhK z3$x|o9MlSU0`L_}T1_t~E=41m?W}OZ3grp#*HBk<8PGqWE(5t3bniI1R8;jXmP5XQ*%w9 zSCn@JxdmC&v$U&$w?f+lX%NFK%Jo5p%tCu<`Id}=Y&fZcitQOF_X@5`gB3kHzew#Q zu@;L{SHd>X6Bu+vqWzNR!(B_bJ6B#MtLG)!d7XcnM4#*WL=CMWrRY8x?wFG2>(A*k zK-W{!+2T+fqBo+;Iu7ZxHViBD?JItt* z7T+&ZZX#!QT0VE`)I8MNt(jBMNYWgJ7@p)#Ei8PzXfhhU&1hJs zfJ3IK4mD)PjA=9OnwC6cPJ(W_NrUmXXo$Xr?$ysiNhbW;Wl--g#>ps!iM=I>@}jub z1;({W3ZYxR!vuc)Ve;GQi1-7;-zHt453+I0M7&1q^m;#kjE~RlalKNabz$hZA3vis zTWaR}Sl$HJ_ez)e`lz^`Cq2X}U|A>JUnHgSH-~C^98x!bljsunmr7&#`|;Ps^_|k4 zoc=m-JyrSx&UD;|pAjpTe8BhB>v+k|`l<5AN&m_6E(`v#_^_2iW9@PLj8d#r!dd1L z*Q4l`?=VS`K1{&mx3d#nj|{jU7#<(G>kd44(Opsa+XJr023*?$uEzyjPYAe<54iTX zIFsKBFBJde0RE`~*LaemJ4_N5CD0uv=`P(B$(tQ;JtyFLUcmL;0oV5iT&DzFFABJ( zQXf3H4#P`~L{I ze>NcgpXgj7g>MK5?+wULoq8g^T>abTMAb> z9RBvnfcP&2$h#%r{<(nr69Vr4ARzuz0s5{D$dAbZ*AW5f|F?knvIEMKipM|;g5e-j zBD@SvfTA_9yQ3^5`bL~-4Islk_=6)FKLfi!EW;vrXe~dP@phcYGyXB?cE&%#If?N( z(5EpzhVx9uL8$j+I~4D4aK=e8a9%B7`X!tf6XrZhWx542X`P%X_8rv95vKHwW=uh_ z#FU^@ICdCZ+H9OedZ(h@0pn^B%^4(qhJx?j?+gzedMH zeJ2V_c|dCn6DA&7-;pro!FxJ>S`Uus3qYr}%?Q)+F=HyX3p)D$GL}LAT1UUin970j zU6T{en958zvmZ^##iX2~2U>7*kw{j47@~j4ADf zjB%367*jmYFece_7`RJCay30k7U2Yx1Ig0TF7!+R0f*3Yp^7Q(28tYqjGuur8HXJ| zl2d*g*RT5o*;l9PP=At%hwJYG=Kl@&Nd&ESL&pmI3`+zQYeACCKZ9oj(Nk4=Het|z zhqVbP?S%gho(jfCfvXrl54?-eu%jWTiSRP~!LbiN!*T(o*9e2> zPVgKjObX&?!_Tl%K&hQDc)B6Ki}B~c?-8cXKaStxM?9B6KTr4pqN2XwNAxS8Utl~O zaeYB}75?D3h@WA#fB^W$1#Ta%g{c`gy*Pq zJJahxCtpK4+yR-%jMG3Te?{~Kps!{8DDVcx-v`cS{A1vJ!WpXkLc)_(TtS$JBvpi` zs`OoiA^-OXyPNUffnOlJN#!BmWZ>b;D};II(nOetEk_AM&MnaSIANz6_HCw*0==DZ zrb>T@aF&X@2xqJKeZr6v5B@J0&jJ3DaE{8;$MjP;UuC?M`V#n2*uQ}m#P|-JErfH` zun|mu3Fj!nc`7}c>0jYIhVe+)n9O(@FpZB5`6_=B;Q|#;W1h#sGm~)xa5CY|D$jhT zw}QTa@o#_^Grj_xN_dOPPkS6tT1E$>+!@~syn*rk@SmFqC#w9^mm>a&pwnJrh6I&f z$n+4MN0`c)#wvtK{z}HFxLC!Q z%I87GB=Zr*ZLpU-#uRol;}>u)VoYsgDPs!z5@Sl&LB!_yy4ag|P>i+9pkhHyNkme3J1@oTsBa zG@hA^QEjE!j28eqbv${D$@e_Yn0(uFjL8qZ%2?D_CBk=U*s!D4%Lw*jB%2dF@6R30me0cPP0J|8! z2K)l!+oDSU0xDEI(jB%3w%9!f?XN=o{dv!ctGJX>Dt2(+7?FXfW>KyIgLHJAX zOkoUGX(nR{d7Pr7FJ?^jW(i~JldfS*{v(6&Mc^F9B)^<-A8;k(tH4h)rg&=@FM!Ni z#*2aXFdh%=(eb~`xC!)sW4sTT+Ehvx$^0?ntDqlaETMc)>v*~tQ$O*2#`A&y!Z-@} zqK^L`jH5ySn(-K5+Q(J1lRMF-YC6neOns~S7*|1`m5eKa*Xj5-Fg{B8!*~Pm3p$>9 z#w!rEk#RP7-e#q$ zX>E2&FO4C_pqVJ-5O!b@AVWhA!%81rx)a1-!JRbBpjP1ZFjLDBWbo@&h zF94m^btE~9fgfN@K7{6(iB2|9!Wb$@WsKhe-paTOxRUXEz`Gc~5Bxmi-vYnE_&o5> z7?aFS#vcNoVf-=hpBdYsL!XZSTgG34evL7W+lE13El+M`yaRG*jY*Lf;LSRo62|W! zY#HM&;5Ho(t=CCm+d%)Bj^4?573j2%C-JNWrZqe@9X`-_khe51EqH)G*YRA`FzlqC zaVT&o#$&`!wsb#Z%B!`EBS3$caXw_`GL8bhMaO@XaWv?ijL8oF%y0`O)XPbuTK5%wt^y^3)=^l8-5>3IRk-vk|+7-s|TWlUxLOUBd>`Xghq zjgJ_Yf==uAlAN``U+Q?SFs89lKVy&Wc*v;EsW0tmookknC9`bOF(y5qVY~x$g)!B~dW|1)e#H1m z(7PE^*xxbE2R_fZ5O_2mEKz#ffD;)L{}jg2kU2|7pTqbf=<^v<|1*^_rDYZ49l#lk zNoFSF2+;EwH-TQpI0^I}I{uxEr-5F_cqXu0$Kzp4^C$;(^uIBtdSMu$rqP2uu`qrG zIEHZ(@GQm_;MI&t=e3MK1bu^!p27H2&@&lR-7ICS06(GQuVVZK^n8i29r!TgB;eyZ z{3C8YKMDGB##O-U7^eeg>-aY_egX8y8GC?t>3H0XcY*$IjCTVc z(DA&+xB~Py7*_)ST*vcE#v4HY1LIA=f7bE*7vmkE_cB(1WAQ**vl$!XS3tj0N1w&` zHRS&s#z%oSGCmHxO~?NP<2KNrV*EDnKF03=|ABEAa1Ud$nNJz-1N{pf{qKy=gH98f zq;nGBZHy`GNX9dXg>f?QWF60)jL9bN*3lQ~=$SftKI5avlV^1FXBoc+dOc&Z?ZY~r zBaDBGxQ;R=pZ`-G|1TKN2mQ~C+kwB*@eDAgG#X>nw7&ra4hGn<~Z`EJO^Wv_ppvmj|_>QWNczg@f0$qcq$lE9@9b35$MqLd=^4UuJ*iM=*hat zphwY51UM$*N0`DTFs5*KF{W^oJmR5v=?IML*WVGBuz`Eka9W=H7x*bVNKP>9OeUP6 z^4OV9^8q5?=q3)Ko2=@YgzG3^u!wReOnNTBkMMY$moUZ&Z`!JKl1=5Sg%$ZMt6_7P zPO=Lb<0QSrn9|{8jFZ&Dn9}qrW76k87*qN>7|S^SjxkQspBPh~|0iP#OLa+0%O%D) z%JT^18-*FFd~Fmq4u5dO<42g{qIyD@!p&w(`9{S<^c%&M{2g&oG*Oh{IPCZlrnnLr zQ(Vc6ePslm8^x7-v$)7$afrBpeQ^Q%;sW-?1$?8pb`2F5Z1Mo;6h?bLL9<(WrVQ1k zD2g11$WLI3YchUBCmrT6CK)M=$$nB9<0RhsCVrB=n&}i)*d*u_R@fvk+0s_#!Abfa zV@mt?8B4pBFOY5qy1kt#Y489%CQUF{NcEW0LtCV;Se&j7jDX8RI1FXG~>6 z2kA@)$s&9TeqQ7QrwhYSDJqFL_*p08S-2)Tg%f25OyNY?0b79SFjS~#O+H--`G~6z zaS@;P{*uUNDl{BgK2HGyr9pe=hw_5-oCUhf_#R+N578rl?Sxr>L?J~@!5L4)bGJ)v`s@8GPNf+S*ng2oNp?K05Q#_9{PQrN$W0Lr8kSDf}+=-xEJBHh85WK$Z5PO^os118yb zGM&=CfHCnq7*jk;8B;u>4k9e2g$~0u^(^$SRI$ka87j8o6a`H8g&zPW9i}p!bXdli zbVwjP6Mt|l!7qx8jt|3j6^OW=P_dR*bS3f%dH7=}K(aJ@5P3z;0EfsciVz2-f%2T* z-9iLML8o{`T7W6sLgpdm3j>3A~oax%|B>v#g(nVOL3p(G0N-ENI4^cT?8&oXgWOz!&q%);)9r%+N&jX%Dm~95C z`0`-^5)fu*9HqO8*GzE9(v<;BzSv2adKMzIsCH)POvx*3H9$zV z!KhK|Mc#xpP^9*?=@2X4+)(yS!}uamKY7$XO4nAmxnA&h@%eP=yWvk;$j>g$U3y{W2ZfExVyJAEKdUouNKO3QV8wC(^tD5tuNtU!QwJacR;6zx>xFk&-4> z+|br15WFxetgA3YEH`2G>8#o%m*sbhyb0^jB7JK=456c+z(GbWGXfVN(C9)-{Zazj z4ay=i+wc79d$1;ND|41^E%ljKRz(K2LPe#lsYs7r^k7IfE36TvF>4j{pXDzrp(bt0 z&Dr%F*W0vSRgrqpF8QsXB9^+jVdf9Ps>O&lHOpC?kzL};A&NoO0pE~|b*D65x+6*? z@CKD3tz?l|P=QatrSgh0I%&bQyLy@`%5Qxcjh$|llwvU|tOYQ*`i%arZY`$_d`MnS z=HQEsf@hT!=VoBtjtp9ytsv{V`}h=IU8JORi!=obbmUA~a{ohFn~TiSTVsTh_XW%qc8}uU^?>xQo<^G$E&bA%xo} zD)mQw)WL2i))A<1mR0yI+ey*XdyebZHD6!>&N*7Q`gsbLA;`J@oIJY z%psLT)(FK^(?tV_rCt1ji}VPx%94{+nvqvlvb8jjQJ0r0Cj{NVAlc|L3Q(D}9;h^B zC`ULXr#=-(*y9C)WT+cdj%<@?O7b+r%_zqTRX(Z2#HM*Y6Wt70NOKBYD$Gur zQog;2&iZsvsbd)sbbQoRjL2tD@QfKKQ?&s?XsnJwBd~w!n2Sjf8p~=&P?;p&jnS?# zq!S0GCM3dU^-|2^F%%~n`_e)0{RZ-_P;ZI98sBCB!VCD`uEpv%YxE3*^r3q+?wkvt zmsbTEeXFk>#7DjLB@K^~2tNgmCwX!2+(Mz7yYWCo4zwS)NRps6v! z3-F_31LV<|o#fFRlO~VmQ}puax%P{oX@@57eh~EXJdn2uG?GX2W}3Wq7=T{h1;|^a z31L2*q_@DQm)8e*ABU*&Fn!{a_k#d=$(RVCZ_l+u6aB9N^3FeiX9AdDA^jrp)AYN@ z@=y%o*kQvv8;t3s$)k65_4-BRs`DBoZv^v^z2rh?eR|JB-caS?1fO1>B~P8>B6%Zq z^6m+c_a)@Ha9=w#{pJM7TMK!cz(n#!;YWO=Up5k|*RL`T^D&@nhbAure0u$kL!M@T zl--)V*#Yu)LEb`581vEPi~xC`LY`)SvCK#M{VqV>`;bTRYKNvDJ#W_QC+Dlr&?vpP z_z8=Y=XS$lav9MpgygtYqD*r}xRr(I%qvJq;ylIf9=@*atn!H~D>-BpL@`lpy42M~OGaZFG{St7k$vXh7m)8z? zL+RJdVHV&_$16Jh5^=4`n*?Ecd7;P*nF8=Zd~{3z6X6APf#W>nrQ%HXG8sQj9?gU5 z<=G*x4m9o1rt&>14{LzE9EUtR=-Q#liwv-rw;^vWm`EPA_L_cu zP)@JkhmiNWCXD&$@*e@|jVM%~N0YoenUC~q4yYfyCl1|S()&I7^tM6Xc!Vc;cj@HO zyH0xjnjnwb9_`T5yDdQ8hmfb)-)t~z>HRF&U*1K?8_K_Y3O>Dl(M5Q-5OPSrIXZbi z3y>$n*pK4Ac4+$jM}WLnAg={XByS#mntt@Hjy}EbL!ONL+M&t&L4dr)#e?Nbk0LaA zr2+CTLf(2!81vEPmH>Gk$U_zi{peY}CT~TUzkVxVd_&dWCE%kl3-F^Os6>6PLg`JR zYy8Mw=vxSVdN)BHnrh!cd~{d>Aq7)kb{zW6E9UG?-=eHVjTo27L3dEQ%tZd9vy z7WVYQ#!aEQ(FxwTdqMmdyLgPo`4nwl;my3)x}Nr_eVdBT^I57z zT-yF28WYa+{eXl$fu`!@(RT#eLEjG0k;3OYa2}=I$DUueF}{L$XnmM=j_(A{5x1&g z>AQ`1#z}mpJ5J^$yi|uDV7yjGOK1Fh4*y3!|C!HUEMb3`EgG&H7jn;yp zV-cU}`>~JlYs2;1OpDUupgQ~Vz(51jDO@@7mJa$}l8)_sRE;y3dF6Q7| zrODZ)S(M6iv%iJ~H{($6SLyvC2dTntKL1Q;!#~CK&q(^e^K>C!-qG^rp9uaL`>|Qo zK~EX`Mu{z;&WSz8Q^bZzK~mqSF(WR&Zge~?*+dIb^?Z{O+JqJ%+VLXo{^be{vf4A% zfV?;6$3c?VavPgDTb5$O-nPq1h}S+E+b3c7?^n-sf3V<_jumciRO6mYXVk5yoC5>a zj0$Y$q;66#qBcvGP?vLr`8@+-Nl&#*>=@k3_>_5}b2y^Gw$zqG*e|uS&}fOGJ-Bx? zyARw!dvM#O&OD=XnYL`Yu-Rg&hC5VuYsE&W?n*T#xJ{d(8rv+bqxP)xVS~k->8w^` zOJr3joGv2ARf8plB5G*%9`IuCZ)@21Ee-X_#?GmlAG$ zt%P7#s)@12nh=8!2OBx_g-`ZVWwV^{3jNP8*=T*k%E>OOd-hjNG+x|RrO z$dEW^S_gH7o`?e5gC(w}eFkY? z;Ugg@QbYn=O`q58tbNRqURw>_YMqwzwY}KA(-~<=t?hB`eXaH!kvp8&U@aMYX76pQ zZJs_b00VMHAWa2(l=!qz!;z4-YQ-s(v0@L^B}Qy59~!3gdTo&hW3V%7Tzo8SrIz@5 z&IX@9ccBA&=$WNUMigJ$F;JTShjwXpVc#@c1h!7^tbtYCj-CHpp|nT$?mpRqZVUEY zY!|8{YlB?2;fU{&(cm%~h3xLVKl9yOh?`W5*zS|Ikv(dFmTg;H@uT51(`pw(a9YCR z#5PMI($?}Ac@y&YINli$);9wc=X#qN6|2;a z5;e}4n;b-OhkMEX55oR;NifUN3#3EMtq1NndN{&5DXz6?;3(~TYV*d=S`q46W_B+N z&RiA*0oFF`d3alHOt9N7wz>ni5gfmV#7ayVuWyJxg5g zTysTB@i8{9E#hFqO6+ZX=)pbMo+p;s?wDh1(VIS~0 zwqc&OV@DezaGAE$;I>63Hn^RUExnD6uBC=5CB?N=N_+udsii4>j_s1Cd8fKTUi5Ei zgS_ZpnfnH4gS_aU(*}9bKXrULfZFM2ufjuFQeAn;JH1gk zogJnc-;5~Dcl4lcU!i^FYL?Qby<(4J(9|OBGvCi{OLGd^9V9C z5lPxY!y0FV5<)j#ePhgfYRuhRsJi;{q^3k7%Se}8_LtKt$+GRYTU*ArL|fO7w)mUXIrVKuM~2~)x${wS zw4w$~4!`}PR&g8;_|gi$Y#gD_+r1{imFF>bR!f#tb2YJ|zQZq6)kVMr+In5frK-lr zs#=*0V!7e)v&-|zFGOu$O*=db-`YGdaQIMacv_TUp?yx;acN<~57X943+;DUKfPDk z<37K@5{x{p?S<^x9ylP?8PU}-qBj%Tqf}T!@6JOt`ya_Qet1i7lRaWnZF}O3*=Xj$EMuB+qxu?x-pX0iSI z4}&*`%zbE5?!xg8rOo`N<^#4Sv`Z({&9l4r{@QWOw~uxYTarz6xE+3NPUlgmGs10q zW_L>pd^tS9?yjxvhvn1pv%D*Uj(!kP^-*M1gW-K_6L@}W_lgkOFRR8n`0( zs3!uTswHywVHtZ0wj$K>F!%D%R~1oDu#KfV6`miNqN@?Ked1vICj722tw9>>lDCdj z`xc^(K!5XJxYD`eZDR`HmK|xZ!m;q7mMaHijGb%HRJp^#mNXb0j~XlsYc?7zUGDg? zbthV>v9gUR{6*tZZfLsj zZf4Vmn`x&~*m8fk_4%#3y4U#^Uoy;(Y1#f(4+^1Jf>T7`{8ZsBTH~iJjGyH)hfh?D zx%p!(>Bt#)@Wnyy_~h6_-n?XQ{48=(5?I__*St;NQZFGU(GonPX<(Ws!ctccb*~sL zqotSyQe(5XIhuT2f@J>6h`xX;VN@Di5vt!fcS1cm-VruT7ketL1(mJNNN+SYoXl>G zk&xrJIdc1o{L>{K?eS_gsxkSMt6h1smFlXRc5VhfKr`Tq zpM_W(6?7DKzbLB1ey$GQ)Nprdn7{e^I(?K)s$5px5>xLnI(AEz^qS}Wb*1FP&yS<3 zx=LwxIm~XcN4d-SOs%0~us)v(>JNr#vD*#yHKM z9qHNz%lplbORcu3YG@aHR&8_8nX6gbFG@{qH&8}L)D3#I@RYxcjH3Gue`=p-ZHRH( z6RdM$V1e$Y-HmPTrdJxfU<=-^Y=~AHlo`u(GHdQMTnduVI8k{;L*9{)8R#;ZXz?%V zFl_`dVD$obkdZf$4l?b|mqlyVz0W2B^qawdDac?gStKNP?~507P#ssKf?l;+y7zh- zTatpEV*lY_bUak+o!6n|V+uvyFM5Ayyh5d1Gz~T>`LgFu>t`XJ5YHLw_7G2eT0%%c zN1SN8#3rjihzQ)Lo7;|`Lj z468<5#^>fG-fK^trV`Ua+Zoa4H=6zNYEJ z_1u)gTrR1tfSNZoGpS%Ut9wC%WEs0!m>YK40J+6|@C!JQy={$MN=RSZg_iDpEEi4k zuN^)m)%}jCI@rj6Bk1}TS9~%&VBMKL(Dj3MH8{qos#;KE&0ui&*Wqdn5KV~D{5{FC z)bRwVutqqoBV>`36jh`Wa-pTKty^^fYQNd)+N5eDY#foWmqZQaqevfLsBY4*lBBf8UO$LV(@F#SS%-KZ z@O_Jgs#rqM?HobVD3NG>YgIqny>FVhDLj)oeLzjzf!B2L&(C)`$mckyt&3G$4wD!f z7*7XDryW7A=J9oJK5{^`7r6gOIubiKha5}_983@_Qn_sXo5^dRTrC`qayfU>G?#s{ z)qdyZ8Hf$->48s#3TkRGj9o;rEs|V|Os+-7HMR(|frjq+lPMeTg1vh~Ef(_+&DKUL z3JU+NF8o{<_32ISRO6T@yr~A!|B1k?9kiMQAD-T8&DTnBgkP|vIVd>_i(;eT76(dw zZZ4$+$*>-#@g8cJb+ln~>uI%GQDsI}ZqDD_T8+mGKksIH2AP^XsdN2RrDt9;v80NO zRs9L79Z$ws_ZgIPRXfC3Ymrp-f;P@tWLWleVlt+&kQ;fkS3S+$xy)1;KGg7yRXVgj z0rhA*f6!0?JFt`b2XEYe@HgSv6247+uQP<$k6Fy}f zMgXlCuXcTlX%Tl*e|_6@7`N!hSl`b)g+@ zz~zmqt3KT&p-hg1d=!kXl9=<$Jm#`J<8tnRs6+dbDnun8(HMjT%gf*T07~Hv?5wOfgbtF6sGi31*m%5&`+-1}HEYm6fP6eMe zqGKg)W^4AVCzf7MbT=uDeSu_Kgr~QTO{k{yYO8I;(av^=^&i6yjMZ$#eE(IbhuIRx zPIC7mj~p+GWC`<^D<-(h3R~5FpPo$!w3txpTU+!3@x;D*32KUI67_8 zrGnPjpLh#i$3(2u5a|sKC-2%QdqamceI~m@L%pGx1R zuDzz6qmAb8OG##Uu>wQlS`PT4P@_K>!M3kP?z{I^HnvQs{wx|{le8u%?%_9#oo>nX z^YOL4J6nzB-D+nw^PO=l;Q%C5u13XECwr93>yo`)5td;|mTG*y+XEG-Hw@A#5~%gY z9fzg$J2FGZd3ramOMJ0@hOy?)Y9rpg?@ip(%FwYZz=w^cbdjHJ4GxEV0pVL+t!fAq zc_rB}gwM)vorAfq{4XPSz$~ zP#c?5su#1CMX0fgKAibqRo~LRFQbQa_W2f`AL!ngwpNfAmuJg#{5by__8LY^(eK;9Rg`l(bw zyZ1FYrir3zYHI9LJ@8;Z6vbqI=$d~SFML5wsqmXM52`Z&=o=zMEvwD-SH-+Wwe^E~ zFC6yC*1Y7y3QhW@A`&=oudQ0=!$Cqv8#FI^|ug9rgrhDJ#h@Gro&1p;G{G@6&mYT4B^vrkDqq_dN&m^YD|NAdzI7iGe zB!0~mr?&^M)~){LoS1i7zXL<%VTW3q22S*1Qq%J7!MBW#8B*gz@pl=KPw1{R7-A`# z(7)MFQ&BCeMYz~!;**W$d!%_(hs@=ixBG8%d@#_yBeL#i%4(N=?D`9qAX3YW*7~EM zejb9i(jzX-=Q&2=ff^jcjIQyl-hUtxQLjxRB6_A~wdO%YnL{LudYv_y19dyllw*ur^;TrlBXZ-5^%#=vRsC-wbs)(W#tGRcj`94Zb^k@` zLe(}a$I!+*WP>Zn#B)#y@^V*g2WBg4ZU@zX5e6CaH?rmY&L7QD3w{4;KYf-TpY%)U zsySKAs~!GE>8M*=^-#Mdy0$s(#cv!(2F9dcw$HVAF58V}S<3y9(Y#2qwC%*0BUPIC zQ=>VbX9)Jc2}K8!Dn#S8jVV%+{c=ljQZho+IHdXcbY4lF)SY9Eo#|TO#Q}N=t8Z>dNv1XYTuqq(dYWVy4=%h#N9J^>tCB<>C#@g%`2VyYas@<9! zAO+b%Z4V8@=5@f9_rDYv7EL>8XC6l!R8HiO^~opsqqX4qemBX!Lk*VEcy@sy$nxWe z%W<0~=QTf8+@$gmIbjahc%Ho>4{B$eWS*myV%pY^YML}9euXq>R%*UXBR|snvY#v^ zJ~vuzJG=LP3x2e=s*UfD>3sW|CEByvRggk8$8Arxo-n~9gpo(+<|(}ci3n43*>jj`8C(EF?4_C0NwYjb|*wM)6*@>uoL0UST3;PM3^VPq4z{jt8;`a zbYyOHnbNyl!MMQ^<{TJ!F028rAkx#@7G_-@w9poj-qUi<9Zp8>4L3;dM(%z^MviW3 zh^T*gwAzMh4hv8JzwE=vCT)9|C3^V_Z9%aQtqe>1_FK=n#D<1*@Z#dx?Cd#SM~tNO zDxucCTOJediXiUvp67x+y}NUoQhPk-mZ4FUst!lG!wk}i$fj3ibQeocM0m_^HpC)I z%3Yf67Nt=02Z|DX_p}&e;^Nse+hZSsoEPypC+&kP*7G6kJMxhKHFrpTF~aY3A1L=P zkKU?h@VbiUa%}>v#%mjKDAn&NFZGc`Dsih?9j`V9fd(Zopi+GgaDTXJ#|M-ivTHNE zoM@vD6ykc&YT0)Qe_#_&T!f7rAbYdirrD0_-VZzvV$159-(OKh?N6wgNliA{)QryQ zJb!;+6u2C1*OX>!^nQ$S{)snw{=a3xOA#{``rhIUkj?M9fk%n6wi!>yEsWi@^M#Qv zleF`d+i2#pHFj^cnyXi+IYio;o+gQVQ3V6a(}+3=g52Dut}OHM&#BV(KBcSXB0 zQ|OTp;>SCi65hWQnn3oA-pHEel%6u$1_tI&{Ca$Fchl*bVUpWqfD^P;)kbtTy_i@fF!6}|2(`)^!>tp7A#F{5Jz5%rb$E~xxlAeRx|X;IqH5_i3e5Z9of9`6fE*Ho z9=nWDkv9U}f9qx`?jdPdZsJ4Mda3Le*Af>iw!GwD*$v{|+70H;k8bpC8S(|?@RZT| zB_%A@v!r2^#b^yR#QwlCx;0FC^JG$N!!RYyu003rZZ`IaIx4JH-!Vf5i0RhW)DJI( zNtWduaNx~kha&w*q4rL%pEaON5WiZiZ=`eguX!WK!NqzNIUtHy#NoMwr=(o0ezNF- z%9zS}hy!Iy?hGgXY@t;3ksj-a!qk0_6y3b)1^eUTuloujhoZ~YdvK)n(|*Zh5;@>19A zGbsx@g1qlUwEiLjbrzMgn(9Api?5tg>GJ|C?a~&8U56t%v5N? z(v7%jKF?3#yg|64@J2D>xN+WT`E#@LcjxX6LgU@|Sv_LXlLpLBg(F|B2TjT-yq_m# zPvEonP8DgwykM}TEOd`D*Cz+NM}_P>VOPsz@10tjsWPkeZto*>q?60IP!mSyYF8J$6&d1+q!q@d!O`{5W z;b=Q7vsU919PdZE_jb-lO9Pan`7igG)QsFa9AP1uo~5QnruRSvQ5Z$xRtL?IiUv)cStiei zCkWev%r*Sb!~1)o7L0<0i8&Qj&CVyef4sL)Fu{=pOEug4-8tF|G6rN%o z8T#k&n&NovP%%BB)SAHVZhGOmc^r{AKllEvPG{1$3g0+pj>4;YlkpVB3(GhOJjuEqe-qOt4NkKMq^&jF&>b!%zI(=0 zbtLlW6SDPTseNDjw!?#&G1!jUsDEbt1`?xA89xfaa3-zJV2*$VPOh)N4RInXPFc>1 zx_{W%XQD<#(5&enrLt(zHIH1JfYUGAaB!qhY!_+ z!0XUUkfA0JPZ$N!`m*FseAzPW%^1UTVM;VyiWn;-X5}4MyF8e0bBs{Oe3ZgL8+M{y ziIBcmSM_qrs)h)!NvdzWqiS!;s=5gDOLsO5KU}lKV>C}!`zi>k^+Wvg2~w0xUD1jW zuaCQ$s_Lq}cxHmcSDL7#MtnJ*rm1;Kq%^HUUF^9!|gROc-rLs*0pgP@Lqsre;EIaABF z78mD~P2E;fwqlf7ZH=i+H`))w&dniWYJ1VrCTc`b;%zv zIkBjjqz{rL^P)jAEeR#!&U9w`N!2)R5Du$uO%dVz#g>+pRFq_u6w17o*IfCL3E6We zWN(BrSg2`xPPVLSl_X~ulxI21vI~myG)1w#Rt44oESI*HVu3T=DqZ?G->ST9AjE@BE@+$I)MSq6!L9Nw1*N5QPo!Ek>LgjWniMVG8h95gJz;Guv5=fToGg|U zC33lxTe7t{TYfO73_9MArMCv}@h!gv?5?{@>u)(Lww7VZw8FfSvVw~IqVnsRwAHI* z6jlM&m&=mHl3L%zSz3bCDP>x-%vo_gAJ!H1l{uTlb+Im5y7)R8ugfV{kh1puXrMP69j)HU{*VQ_J3`D*a z=Os`L&nb8ual;HV?pwKP?YfLL_uYTrk_XloDL=UA|1tM2 z@KIG)`|z2WWD>$y6AWX(s54w7NVo(L145fX3_-CHq-m%k3Jip5J;mY1joXDwU2G_@RD{$B_m^&-U1Y6ZylM?BU)CivS$jbuDy&Nk{FWA#aQ$IY18{;@ zg8tb>->B|}z9_d^lvoC<5sh_$Jqiz}h1k89n)6c6iMmcLMt3(f=s`iO7M06DbPrB} zvRdpiTi&V4Uml1wSd_bn9l3{uu+!|XPe&cEyrTru2-Jv5g=LCYq8I8G67i#4vrK{=!Cjo14r<1ZogusBc*6wH#ECTFjKJz%sZD z3my(>vXG+l$c6ACizN+QTyphg`-0R9Ee?NO#ueLBWMq}BT*I2y7I&HDsE)GbCFRiy z??uBe9GDh`;4@kmMF~j{*b}KaPGbEUS)MtVd+?@i@WK@=oOK4uS7I<&4r4eH!|g1` zzAhts&n%y_Nb1_8M5OMmy{?&hOr=|(ObWe~IkJxL>aX7@cckS=HXJgvLr#l#l=RYR zINrA1u5u7zm2zF(wIg>)@9gDfWFU<$;9=C^)^glL=#_A^q4cDXEK(#2KG^TzC#vV6L5(lNVSND(&L&RuzNg!E8vkm=q`sSn51W&eQd|kXb}lCTi8LRy@@1T1)-fYk4&!=k8l9O_O>b(QS0 zNmy(~dsXpDv>6eE**oX!(W>rAP(%;2{o4;MoXyG}Qq=Pdq*6x;j*ZnX;P_ zbR~~j5^KQn=*}dHt0y1x(d05fEw(oRh|=v6c8Ns?;0+ur>Wi()qAIJ3X;e|C&yBXZ zE(^DB$X(s6o36+Gzm!6{H{2LwrZXCamNEOL>@ICLTHD4l1=C!~lFG>FB#L)uP*vBB z9I5ou#h4B_l!S_~W@L*lU#VwQG+zu@ylGdx&CW5BQb!f7TwJzdSh+m_sN&d5R&F*S zO6uB4_me2%xK%&3lT>PNfpip6(gJhP`&S=8&?C|m9eR9BC7#2ylP z+%CHKy0*-I7_tOC3*MpiDl9N|%qVzh4x|;AmzS1J8a;X`9%8InI0~zJKD)%asH|kk zXnJlRiB%nMY({}2z(<^R%K2l*jJ;}1=GckD`TW}vM(O9@pvPG6cX`p`vEcN~2p%im z`Y6UGw7Te*EL-ifN6H&G-0(SJxA*IPft{$KkfFQu`Jvf=WNq`kBOMsrcd6 z6v^^y>Uya4PjPbSn#aUFDA4|ZG+bzH;wqY*r6hp;HYqjpdti?e=KT*O}%Y2-g4@%p+```VKD{?a~mJpC{0!1PBQ`p_?>4vc@t zas8B|JRiXqpbq4J-Vy(G@qI-e#(ygPL0``!kihtB9s2&zk$jH^yVe4|bF<+o3OBoJIoqzv773`ze!&@!K8tdEH^pF^>3$9p!!4 znV&=7mu39b`Q74>|D;2|Hix`4NBjzhKJPl@bB}r*SiZfE>z_OH?{wIEgY<_-2eW@C zSi7YD$kq?NzOSRd)HwA0jzeGWk*)*v$#>}gfTKUb{&|0ha;Zd#WmXIppLFF zHYTqt!^Rw|l3@q(!sWffVDpB7vQ{DI)F zbD4p5PdRr3(=R>kPdoXD(*Y2Yh378Br4V0f(*r_J1APebG@G6-^ba9(JaLXq&m_Lq z##zFHe-yX!h|_HPETQj0+Css<04^516#VOnb8Y@jLcb979mLaZ`fj2B9%-Kt{C8mP zweDg85e^d1u<&50O0(LZ$mN+CvF{2laE;u~x^Lxlbt(9;Ef0z6*uKH$lM??NZdBL2Fa zHi!5|8_yJ;MObdm5j-7uf#8wA%LMO$oN~cW16L5wvgK3>oqkx?6X)A>j+w66Hr^~e zd%@En_!q#9f{y_=3w{xJzu?~kA0)oXmh+6z>DRWEn4J~jDDgLJ{DSZ#zz(kv%i`-b zp$9=fE%<*RhkG8l#3Awr#O(A4=ZNRp7>hhr7n6`ShWJ}H-6!;UpeGXFY|~SSIba|J zgr^ETX@Wh-cZ}fWpyvoq1bwF9?*MaNV;gu4HeWz23#nqEAI7*}D)_g+6@otmRzB^K z_FA;JD$==mD?(U!7Jrl{EXmK_6xyNf!m4a+wxx^USQ*w zh(k6$A^iOAjq5d*YYo!AE4TspjNs$I9|-;p@TY>G1m=X}T4>9RCx)C3&=UoJ1e`3G z_nj$%Zw5{k+yER9ya9L!@giGh8gY@0(}m~f;29(MZ@}XP2T?DX#EWhI$;4OKIEQ$N zjb{q~C9q+kU?22cAozP=Dn37!CaQgA--TY{GZ zpB8*C@VkQd0DmCZ7mL16yv)|&Q=z|yGj7!^*C3l7Lp&0WTtJT}4%l?2Cw&j-iNu%L z^kkuL0iAyBU8y!bRp`q>4-gNu=|hChd!;nu6q}wd^h-b=L(Ih&!g!&7h_Yl7FSqHF zh0gw$MT~U;Lypi7gPupc!lus@dJyMX#G`Eb9HBSjTqrozi!n;@Cpa$rQ@!IWJr z_&V^H6A!UvRtSAB=)A{st+eS?#HBV~FFgMZp0MC|fj0>riM8uy!E-?0DmV<>Ab2It z)SLD4U5MrKIvM3=K$lb)=Cm;6DvaqJ>v9`2p6ZexL$x(bFwHnsFivVe81ke6=LtO> z=eq=F;=DmHPHKM^@{a+&Pw3-u-Ypm>>rufAaDH5H5zZ$CvunRE7$>!sqf9p4e+!-S zhK2q~I;XaNf&s1mf-}*lxRxUi*ABS`&kVt(pwAS{wZJz8bDEoP@Glfx1X+AeMwy(i z!UoU1f|r4QzhKT|+Xa^cKO&fO+K&ZuPW!cB&S|d-UJuN57xUu$_J-h8=oycL^i4Rf z5X`a<7rYsCuA|7a6~}mk=W4+_&~_#XW;^2ZLGsVSF~i`$QSbsZrX_-lfY%A;SY9KT zy4^3B<9ZBaQ6@uz;0n-(30@04S8yWIg#=fDzCtk5mJ41F`U3|2LBZ!>n{9%*_8bg8 z=F3}{D+GsuZxEYR9#REoLC#3QfNH!V&q?r%6FU3K zM8QLVvkiWZQRL@PIbCo7_-2EL&(6qm2K12N4}fnM%s#@gg**&*2|fp0BbY-C#}@K% zU4Oq|4!O;O+1`FG7-Wlk?U26(N1I@-kIor9923bi1~&XmFx%JV7@J7n3^_Ll&H{ar z;5ndwTQKh->I5_2O@dE@{yo9Gx7Z_?_4uk_wtYT}V_rUBSDcO6ei8&z=7oZjK~EOU zd3=Ciw$<+${Plw0LfY*HeUE{g1fnDzLELH~=! zki&f|D5o6wUBMN={}#-3Uo!3ubY24ma}7AfpidLL74$;En}8P?JSBpu=PJQ3A+HL9 z=R1Pm1^v5%PXjj_JU8G>H`E--lJ3a&yMxK;3Y;O`1v4}7n| zf4^X^ySE751iV!+`~D8W4Zz%wjC#I=d=CqL1^Cy3spoOQCqREm@N2;T5WF5Z0naok zCk#A5Fw>?A-URyPf;R&X5=?zY3!a1YlLRyE6v2g{X9>Oq_(s9JcUfTYFA|&zI-kW; zA0O~qgXb>6iJ;dAP6obLa31gugZ~GDw}Rd*nE4(uc%BiQ1NyTD51%_z2ZmP#mxAY% zL4QkdJLqoFxmAHfSi_X!RFryD$@1-}J5j}?3xc#7b6f#(_giv*{j zzdUWwTLlL|kH}oo3eE$4o8Xzie-xYrp1&CU z?+Bg+o_7UTpuW!=Jlt@ZcH4|PN)XIBWq@Gjn<}^k^veZ513XAD`^Z%Wf2QD*tW&`p z6V?jO0{>=%{{g|1p~sH}pF!F~f5v(NXHhI8 z?`1C+O#VTF<3S%P*atj9Fz4%Wf)hbsE0}5T5}XBkjo=*M?-@Mxf-^z?zF_v9M!{8( z^Mt|wW5MIWf56~BZ16vC@V_Xy6*6BId=&T}f;T~ar{K-N7hfE0lLG}G1^pU>{#C(S zQTA-X4Zt~q_d|Yx;2ogP72F7XyWrixD+D(K*9d+B_#VOgfqyJ`2xLAZ80uL6EjSJI zmkj!E1vh~HnqZEH?-@L21kVKhpMqxr$D~Bd9w)dQ^nQXl4i7eXt`J-V`f$O;z?%%7 zdcjYie;qUEe>Ct(!7bo~ev1vi48B6v6O zaDyjZ@Ep)b3oZnnBAEHkH27~6TmgEa!L!uhxlQmg@Ej3L{azHD0{ptce^PKN=zkU* z0REf7^S5z9 z-fqxe6nq-=zZ!JcrM3>cq0hyF0j+_8n}IJC`~>hwgJ+!JS0M8n2K{Ei)H5V_Khl;O zJY|9pf_{hK7T`+3nZS1&{P!DptKgH6|5Jnh--1to{uhJ(uHbh;|3om~lYABLd33wY z5zKccGY$HUf}eptvjw*TR~S6s6}$jx?-R^=X%PGx@GA!Y9|cpNL6=8$NE19BawZDS z1YT$G+%5P6q}?j`9Pp0?p85}XJ8Ex};176|4$x8;Hpf!7KKi&Z0-@6EOd9s|5hFj%Y~ z2p$6ZGlJ8Aj|v8h^=rYO!X~e3I(SZN44%IWP6qwF;1uA?g3)>zBAD;l#vAlWf{Q@^ zx@Pm@7!7F-DW&jc?6ZWUY#{Dxp3#>RewY(2|CpCy>|n+*Cv z!6>fvwBXI)KWfl_Ew}>obAtH{-ZR*iUj^(F%r$4SV6Hg_38wrs!Rx_4)}Ut!-U|8* z!R#aXf_Yz4Xz<@EI1K*f2E9!1CeYUz^ss>+Fz`0Pw}79)g?qEHI3sI?`Mx_|@H`jF zDEQwvCkpn0j@tsoU+2NRCiqPV!BDE`)H5J>4)74ckKmjpnD5`x1zW&l1YeEwc)@(H zk|~(qj7}EJ_ZwM)$3o{E!5@I0C%6P?^dq>wMerWr1%l54 z7YUvTTr8Mrml+t)a+UE{>^aiLU{mjHr{O(-vL_3NpzL|Ojg<|-zX&`SlC5OiA2Ouj zAckqJQGzM&YX<#V!IY6FnEA{R%zRib%3-}JeQ0b1Uh8j=v<{@JdW1fI1rFeFiO#AX zMQ51WO2)kt!z3KU)H6pgz@%yKdCJvamN zBZfC2yIi8Dva{%K+WAWGCu6P8Koby?cbwpeZ9!)`r9Uur_@?mSq`viJTIRn12Qkw! zICY~9mCa4v#D;i$XeDFa%)mT|DHGxpW;%3Pg{kKV!PJf6KgmngZ-$*t*Y69kTR`Nz z3(We^-|3|Zy%BWcWUSQ~l&u6$#5L*Ed9q;YoF|w%&k{_Xl?^5BLZRcN`jnPK(-2e6 zoq{RnF2S@@tzew2O@gW8_XIQTPX)8wM+D|C>5hc~KaG$_qG>7jPsm;7DG;k-X;HX_-csk!gte zKNC!&`##fFKliibL83ntHW!PHl^CGb<5Z&b0Rk zW;xXO10L$zD0Ip>D0n>1t%8~MnBYvDUpMG~797C&ZwCE+!L-u{f@voP{VgBm(w+<~ zGx6g9-RfnrVzKK5Ja2+!-9ZkiuPg=a zd6~vTU^&Tu4H_Z)e&icn;yL(1$iqRN?}KNi;8NgOg86?aWF^n5$hT1NSAlOKF2xVR z0v!6g)*|A$_(3Sf!L-Z3zfACRC_9sp&hMN(z+9g(T!4d^_M=URY2!hH!ETRZLZ2#h z%BIemzd$haxm9pE&Wi*m;=E2U>tVCt0M7daGvB8KvmV+F`b&b-aQ>a(be!K1JO<}? z1kb|xtl;rDPjE%`ZY=${JC13kfQ%V*tQEO-HMP;e3OIKi~fM8Rw$(+s-$W(nnDdnq*Nw+b!>oq=tD zfwG8i#Dp79OhX~CZjy&8Xk8|lyg|X_WpGv4XDx?UY(tdU*3TYK_4vl}lm05`0b&*$ zAq@xVcVi97y3{&QPBJC|%El`@g;~E>8gwL6^dUGij{KCT=3-#VyGH1&mt4U(S>F&$ z`Lq|)vRpR{X8x)TgPsUnDRlC$6-+y+aS}W%UyaZMI5YIL?xkFo_akke8x*TOMsZ+9 z2;k5*VcE1zSUselLfVUglZV^(87P?LRclV6PZ2t8lO>okrU|C(>jh`xtmXwtyF%zJ zmzpC$4*-`7ooSUFK&Q$_6i{AsAaTy#stqv{w0^a3|moF-fx=M)t&%Mg1=RD;<==HzLLm}bo zo@KABkz&|Bb9(W~GQVfpUp7r76WfhLG!x~&q^uX|U&!nbtNhHsGZWnXe6B<%pXqtP zE)kvlDG_FrtxhDW$5zmT8=ucrr8j;vUt6W9pM~XROMB5xd^_|OtNc~XUja{$hE5I} zE-EQ9BD=SvuJMk<;+|tZoxjb83&zit)FZQ5Zqt>krWY+UsD<(G3RJ+yK{A@)QDthx;tK4R6d{M_wrKHtU8OX@@$7e^Woo2GwV+FW%*aH zgm=Ess4vUz=%ZcSODZRzz1DLNtU6QlH~0yhU$nA|)$EZ?!jf`$kBd-gagt4%Y8+8_iSyT>f6qsIh$KRVtl=1eRuLsKm1<44FXs7h*|z9* zYZTn*EFLxe>)#j&2R69YYMVWId1*<6PASWa=w8S6Hl|!x^^j)fgelsgtB4| zGD`lJk?Z8K1yC{DYSt(^+?fvtb8z_ARZUwZyA)=eS!_7%iWChVwaYpF&8Pp=l5a1L zM9>~A^YWENi^V5gw6%2MGTVba4tI&RTlAu+C!;R0_KKjVSZT`iF5V@Dvm!VdcVSR% z(sq@rd}DTrgr7q;JZOXAri`vLBhgD%FOFWQ=3skQLg^h5rf)IbZ0!VSBT?^9s4cVY zcH>meV&^Llily+K24`Q6mi%Q>m^{ifYv5ATUZJR_%%LBGoorDbbXcwQ#%Q*8#p4hJ zm&|wQ=^smm(q-_n*EK6;ZdoAo%wac=C0JFI6+05!ZKGQhEDQ%?re$e+X-KwBqyF2z z;Qk@Xs14-wa;E8OmNVU-=?G>nZ5&hHQuv%#{bYU_oVRx|yJ-0NOs2`zkPIQr!5&xa znGb&dN0pVYhWlHbE0^c2kf9&By@D`rEl-f}JYW?^>W~P2G;W-Gu;iEj-SL^qP!!C2KwDs2_wY=X;zBs9H z3;6gvK?lwEvLoNXT02kX%V&5x-yb>TRY2ZtTA1+h@-c_JV#r$nI_2TfPedNSt1|2D zEyznlybfAFzFQ~Gl8AOgKRgbK$Q$dB=fiW4KS~;&w7iiHd5L()Q-OHu*I)Q(?}w4V z)bBLp@p+F9THb>I#90y%hP=tZl*i|NjHA320H!=Xl-S{}bGG38Z3-b5ylKt6^zhrBtEr^|aO;1q z2QBXr5KR4Es=~V&&{!YnQW1H4>}$$vg*-*Ti9yTb^I22gvg&C4!sHQobK)KHM%(?I zvKX|y8^LGFE3S!-yGRm|H_jn16Go;_NgcF2{$H#qujOuhcZGuGfsyk)<9s+i!(o

        $G9@(?Y}2F|BjP5$~%t3l(!%9rh}$~me&q~Deo0S-c=Guc`NZ_$~y;n zn_ZBeqn}S2@_jdqOzY{PX zd2}Ej!#e=PS-e2FB^;fPIDRmW_In<{lovo{wUQu#d<^t~LY&15gjXOh06ylOje~KN zM_)Tkj%romS z!Dj~YF=X|@`f_IHO28^!bG^%;ZK(NXKtJZM!@H2zDtYMsn~2EK851)DMi|o#+ms38 z$E%pJ)M&QE|<=c`roQ-qx0NJFhgDq{V+ip+iqR6>q%@uy=)b>ii@)z9=Ffavg)`O@V2{W=UM)HtV^0(LdRo4 z_*U%?i?bjeJ5sg;pcr(5M(Yv^eulkS0|$1x@;f`*vrpuoj3sd?_EHTTX!59Rj( z>^Py?ni1UR#TU~Ex}FCiijQX#W48#|8IW%%MMu^DJden~JKs!Iy5s&nPzlfGw% z`o0?Co`i=z*orsqq}M8#mlW#0lr z?W|L~gu2mqJSSGY7ki!+s!PxEMf%7;%X+Xuj1}JlHA0%;iYq~1so51!`yBebGvm_^R)_%9?00wC9ur|5NA-V?e`|_bSUb zz!$%-Ps^$e54-loZ`kU3Bp%r|HJyBXXVb5(4clBdB;coV6)W^70VY)aZ%RVJ197-I z(BxJcpsR&CJ6~s$MAV;S8MV`OJm$nIoAS$;C0E6y`i@<|qBi753X68rLt)$FYdtJ% z|474V$40f(xh15^5YfXIzu_X+K2O&sG9^LR(9FJeIY)X_uQl5JU6$P!B4g!*omQkx ze|YGUoskxO$$qrx$1Ri_EgIDj)2-E3Bq0|Lfvn->b9Zt>-?}X|$Fl0GD_5aXjK(=P zTlM3qzF)8(uph^rkEvs!3U2eD9jo@teKc#kr|o#Q)c2xJ6J{C?Nu8Z`^ZtLMY{j~4 zB|Q}kTZlhddNN7Jvp0NBvCOgR|EW5|v^C6{yK`>7um9XF-HTR| z9m3dqYyyhrth2|x7=L!o#Ryc>-a~D79GmMXTERw-odR{t{Y|^qa!q6H#^3vXq)qsr z)pPZiX~XS3wc&QN4UeC@3T-%4)7Xl3nEzb%a~V)NGP$6FJKER!ek2urp4*tS4FZ*JEVO;pqCHTBAhhy@3fX*E;XqjCnB=v!}QR4NeSCof_YVSu(rj3H8Th z{^`B1hE+LhyUsA-q`G|Hh&B{qSN~J?@U5Z6Pj zZAnMk0y8hb=CFv_=Q(T_*uUD|V7X&g+9{Q0pXWR`3(ifkFkgqTSNZjAXg9k?oa*eH z-4@73+wq)_JsCss`@Dzaj>i^ezaD!!Ls_rjh#MwmqH99bZ7dS)^Bni81ild+*wLKn zk9)(^H7#kT7vspjI5oXsDWlG|@eSK|>o3aIN&KzCD!S*uJ&Ch@ajQeYrnUv?Goh?n z0&=pSorn>#sxI+E%u+oM+{P?*apRpy)yPPO#Y{|Bt7_T;b)m}q%1Bds8EdTjX%96L zDogkWxqJyA;Q|G#9cTsFtZH^!HK9u&uO^?#_B}lvaEsIGzm|-1ag`PdaKDRj3;B-CY}Uq3W=At95t7 zu*%SLt9)^9syPxZH10Ut=nV<}@w$x`q5XJATiMvR_$q65D0MEICtF&{sm{)`b~<-m zK2k05XUo!}t+Z~--0HcGRmJu#=pL^gXd8nOK($FOj&Dd1ajTF|?S)q5la)JbdQQK& zTY6PFN&@>!1r(}glYm(ND{i%Ic*m}_kgKR_xWW8CGcKf>rWehm6iw7?jl|aLh4}~C zO5emPlijC1RJ`hSE&y*xC^+~j)uFeXqqe zJ2Rub*CqI;dxnQ5=9jE$ii-yoG_1F7^32Un3oSe{Cm(#?!ye|D;6Lb5`@DDTdiGd9 zdynmoT?e5RZR$NAQyXKQjfmc&(0z(Yi@pV#*v`|(n3u~ zlCx2U7z*>7;SHDBz}`i^-cy}O;eE3cY%#dqalIY`u6YT~tNd%U ze*d)f!@!1miS_=WvnH;uZ#Wi&({URR#%(}qd~tT&)cPw1%ow|^U(>FbriIDd2Gz7D z*13;8@2n@On;2u&ZuHYGRW>1HtsayZp6<_cH>rsP`7ckX!PesOLww)jQhSE`NLqv6 z7uS)t%^N3GvioD*?!b^cuyf!2A z_Qj5jRii)bF(KPxq0$<*d1}(O)y4SS!?wADk*OIrsan*x2gcj z1-!k-;)_GDS{Lp4Afhe{LQVb0tOLQceO{OYKQWg7R~$4jC+yv7^NLA)v8X9;xix!G zV)3>1Vs6hh$S<2c2kAI8Rv&=j8@Fz(KB86zkf+AyKWP2F2L5Ant<~N>`{Kf!_P%II zDOSSBVE4(C3w`lkk2Pp%Sw}D}GvsaPvc|lF%j*ZoC+WEUNMMX70nfBa> zGUZO>edWggQ;nMaNk?#)PK)b(-gl@L=9Gxeh15CSs@PJwvl3Q36l#N;k&KQ#w}Oro zb=mve=kmkZNCk#1m0bU9T+^{9bc%Lq3AJaOk5jQVgJ%2VW10rtG%@7!Ox!uqRlloZ z`~P_-Sih^GGGqH1-!<*|gaRm~4vU?)>%$aj5v23D-W^Klg!$mDEr=$m*v)RtBg z8iL0zoVQx?kH?+ZVyk^|jI`)=$RDcc%2UmJ?<2O(n#dZ>t3J?JY}Y=Q$s^;i>*|Iu3VeniLT&_J$AIS=J)Y)+X$vvX2`kG4A;``nh-eeZEXUQPqm?ezOSzW&*; zdD9P3B&2|OV~@w2=kx21z5f8sAT+h5SM1EiBfg{O4>We}4=1Khp1A5z=(&8}ML~%k z9)Dp`;Ia0vPyAK%!6-&fJkqmG+qD0bjCFE<7(QEm8t)XId%Clxu_Z5i<6Dz{ zhQVGHz_#VS*ePF8_VnkSSktlxk@%r3J-LvhcR+t%6nTz<#in?Yo! zJ|B~rfdNECcI=%m)b@Og-B_YvoNw@81owHyhK5dbHB`5(+Wt3;^4o9s-HiL<*c-m0 z>f0XU6^rlo<8iOYzQ?wVb^tx8r0?1gd-R=2`N^oyXT+hZ`jQ8KT+=ytKSz zs_>8p?E=ulLTr_9qO@WM2}A2mk*qd>oc785m)-BFDH4Ke@YAj-zi zSIh7nchQ<igi(Qhe90{>_WjqQ&?qcx5GHtm&&)t|?W`A@Z+M zqpZBpilVaO(Cv$LanO^ax<#^d*xBUJ|3IN~XRGX?7NkW-rP#JBv!>Z&StLRarCOVt z)W7Co5YSrc;knn&s{V0GxNPglKcGfs*xz;2B=SE;Jw^4Bs^pH|5+R2Btjky3Ms-D` z+v?n)nw2gf%xxP7^F^f6BUXTpUH`SK%K%}dkX9Nos1X$rCMFY;eh!CBFb0Qw3J-NA zN%6a=s|;%Il5N+gkyN&&pHa|zLd3yxUt|VV^Z-8};-Nz-KmZ573ChBuuK`ui*Nn%D z4|gmM+*a{nmpcJRUmP(w5)n_iCV!UDblm?o-~TUm;hu`Z>Cn?2-27i~1}_em^46g) z)sM%Dvrfw8Je=Lu1#)GdJQl2G1W&j43yoOX{UXOTzgmul?t4^U9*qR@D6dXYk_TRZ z_Q})A6qLiQyxW-ZBcc~7{Yb|(zuJlhkMay*Uh}KMXz(a+5$5$*t-~}N!i_lG%3F)N zR6ibTYV-ogqdZJRNgn0h%e#YEX4&&H*? zUM}U)@!aD^2lDT9T&EfW7(c~$dd%xd4u1MS)PeE0Ij&3OS;siYBmcb-LKMTSQi=no&3Lc@E1Dj_fCg=?(xGwzYzVfldo=(Z-UkjU&Xdd{R~vslPx@A zhy><0&XNBjhdoX^^!ZHk`yK4w4PEU4!^*kK6P` z%fSDia1B<_3J?#mF;A|cHclhH!p7;u!)!c;n2`wMakz#nX!{1a(#DfXm*ItTMY8Bk z`NSxW>ixttS)R~oqe{V?NANELil6#EDwy*23l8AiCYZASCYb8|TQGG`fSs8absr#@ zx?d(Z6F4ZCx~B{F0W)xqD25~)$y8o~-UpB*7c)Xo<&}0sosxkWuXx1fl-Te{4qDLwf=0tiY^8W|ygL$?{$hi+q3UAHl^>Ndvu&}CGvCF+!+e(uX1)gm z|3~?f86kip890(Ja3o*gNO^%HNAd+`zDtCM`K}Pm zeAV~{9_GuS_ibl-UDu3ru|XnG7V*tEQ}8mYgFH{;oF({AIOh;kFhYME+;53t1P)@BooR`wJJ-X+)P0fQh#f$u z?y3(0(+=Me9%OBgQJ@Eazb|x_Z?9m=d_pi)`mtb^^{8O-{8})}{gPmo`;UTI?vDkN zpN~t7o$Kxpx!S2AW(1emx7;p>;5%a=+}XsC7Axe za)_nxz7EOnX8w%ldD@_#O<)?iZSbpN^uqSoW_NQFkf5}Q7 z_E}~BAP5L7GwCakmSxs`mSrY=1n8XZtM#ppHw0hjP@I2|D$?OXvZdHw&ijj|e9JF2S^cnzN9Wc|9g{+T%IFr)37kVL^)icC#_Bo3!@9nOSn7I#(0NZ)L_7&U2*o(` z__>VuI#TWS&wRI`4V2@Wcqr0V5MM$L%c{ab`gNeMC#JFpVH~7$U9^dK9DWcs;~>2l z{96S-0K7x+Q^1YHBk_Z<8wdG+3wpEQR_ODD;EzDxFPQs39~3+ixJB@E;AaGffLn=k z@Plv^2j#yBnSFti{iKS|c3|2@&HKQ#O%@LFAY0q#DsVjT?LznATqZaL=SsneIIHz1 z_>+Ov7y^u}ZC|6n0pOqGp!^{?w+m+4wPTdBCkgr_5u57XUvexCr=NgXgT^Qqcb;nE8GM^{wr| zXBEWdpevuoz|42F&?|tyYVhX>t^$3bVA`ilFzxeW!Rvw9UUgo_1cyO?LGW7Omj$!F zP6^%wd{!{a%e_e`XEQMOvC}fSUmfvQ&@U29JE(ozL2m%2KL_&c0NyIN5%@8|l>cMF zyMYe~rmcQq@EjG~4EnDOo_`rUp9p>eJeS4T`R)hi-iOrTAaJ4J7GV1RApIHO3c;zs zTLiZP?-oow9~XQSc%NYE`Ly84zzpoy3?M5U2fgBnWz6&uXW|DT5r<12@uv`9MXHS9 z%oHJj!^IzjAvh?13S=@`kEQ8CFOa;FDGWi)o50kCOIXsWiyB*isY{N~sY||K_M?S@ zDQcBq7EP@`K@0#tBy^nY`4M#L*ocF9QAc&}2233py3BDIHciK)vreW6 zPR9A`f>|dOf|0e|HozYMeq893vtRHKoSzcRqCGD-9p@JXkHPt`f~m`=f+@$%HUasp zrdYw$=W4;!Ay04sSlwTMe=_hBLZ_Sqf@#;E2&SB03#R@4B)A-yK1G=CTHrn$4}mG? zLcvwQ{RC6a1i@LrTpw%x8wBToev@F@?=HctR_=wV`TtAsOwfO5(4P`K3-sp%&jAji zedx4m9EP5Spyvtw7T|?~7XYsnTm*cd;9_6~y)Q!y@o+`5$1ye*1eRYvuO14V%m#%p z3I{RMars5eHa0;p(_J}gxFz1K4G*^6KOVtr_MX3!>FW0GKS-!qyME;3{6K`)CCio5 zLVg@!=otN~!TEWGaA{YqpUY@_sk1*}SQc8i81DVxeYT{+_DyRsdlp@N2%tWGnIBq+ z5AeEtPeM0%(GMz&FUBI?jVY%4$1vi)*eH{>NmOO|N~PCNfWFB5UoO3JJKH_;FZ^QY zi*o-G0_+MHHM0!gsx2xW1s8+M7I$%%YuC+}kQDLr-n}4Qzoz>lt$X6`#X@3U`Hba@ z1b5}uYMKsH>4n;s(o2TUwqE9F>{@8F1@)GqmkdNl^$}d;3!X1ou$~fqem2HOIsa*9 zy(j(rETcVDfAIAsOV>RiyLI`>`Ls1Yj$OIBOpO=n1GN%(AukV=uPGygREmo2PSw6K zyH}kWkZhrjL1^Wga(v4-e_>_$;vVBmR&he$VlB& z=<-Adc(~^7VL-JVdK;}i+IE$jS=-4e4WPc{>#E3?;q9%A@;#*4kfL8?cFjhYC7PWc zkUlSUFB$jn{pT0u)@zbpve4Q^+w6Z{vfk77l4E=c}gsg=151DSFAE z$8UN^>3P0;9reurWn75EU3br(ug$^wbG=)$p(}6NQWdJ@bDITy-D87?$Kgfu^_S#e zUA@?0L!$w9XVn&v9>?w?9+yqm)?J)TD-{(Z6;`g7;Y(TzVs5rD_0_c~|_y{;TkIHlC&N=2QZ1u~hH_5aSkDh4FIMC*D^u zEWk~LlP^of*gu-@X7CZ~xG}hwS&wVp7vYvi#qpjb!y%9NeSDv#gO-=>karOBTERql zxc!gF<1;H$zh+!$8DNXx{|29_Upelts1N1E2_LV&?~up)*_oj0pk;4%$g48s^#L>a zD38x`P5pR}i=st>mdE!Mrhc0sF9kH}$LiDao&+}KS-3Bq2bvCA-V-30@^%~YE|56t zccY`c3m|WZ7AAbWyv|YHXCROF!qkuN(Y1a<9P-vf9&Mn5*6(tMyu=aqvlz-t!lC7T zi1cQ8Z$Y{oEll`$`9AoVCW{vcYawql&XmXJF6Uc{ zbjstaBrPuuz|?O68YiER=%D2d1|ZIoh)*GJ2r%VcjDvBkj}IO8O`OFGghV`0 z(e?}CnsL6c zBIRMIj>y}M^h~bjnJlEs(ZYm}mp=fXsbAHY==_1M9Fe!yA#Xk8@tb@dw0?IwiGVK63Q8 zgLvVd13t=w=!m>Jv|m%dwHMgWWu5ZYgU{5DzJ51@iSqb-ka29!a~<*yLLR@t)!Z-S7u2YFm0P@c9KB^I2cR z_=mDlzdRgT-a&`F6ikw+;z-c)e(aF9KHIi4<41Wn7Ul5q&Ct8gdey(gF_m`H`6VSFOS@S{QzCbwT84;>iC;}bb+d4mQ=$8_>) zdFw=;=1T(~`-KkLE^EQSG@7pne8@TyG~XD9ysBRK{(^bHl(z$XSrKVb`+W;cC^kIZ2NwP^~<37ZiarktfW)k85EN7gKz+< z_A`3y*f9Ykm=`v-f3;8V@nf%=I6?7$u}|;U>X8WohH`{7>;;S5#kU+OHL$fayx#-u zPd(6_>3F@z8`sBX|l=qaTK<@4+cZW4u*O{}3mYQ=@NQq`Yk~5j-GI zP>wt7sDfW5rDh(>F)02GiOLs-&0ITza*mBL8Ls|HEj%fytSPtq9>X3N4>rjxX+3z;9qJx z6QM})gLOU*1@|UKbUEfT_`M0VYfVauKhH{S$LsvL{f@=JX-*r=iqBKTroNWCe!jSo z@QY+u&;P%E@9XMQr)o>rYbx8F0^)X|2FO94kL0Tm`?~jEv*-5C^}mg&dZ4qj^NsEr z^MByDo{xn3C=Yzr(sOF^>d-~LD^PbGd)rZW*|w{elc>=CN7`m}w9Qog04{Cl9W4_HVf-fP9hkvG>or>rScU6%$|HxGMwhjNHd#PU4?a z;|8UtY#3jxdPB#ak>F2zpYH6FpeNS4xnB|gGrP|t>V4G$W30&|AOUx;k}3{S=r1wW z%-canesJ&PL2kBBw!QQLr=mx~{r1GR$|uMEYH-^7;j=R`mAX(BpM>rir-YpMgsJC< z_4UVI-*BkE>hB$UGIie2EBB4g@Y$yJM7nehw}JP%aWx*R-s7rzEUD_cK-K!B&EdeT zhQxwC-sUH7dwRq_Ke~q73zQZop1HU6`UfA%y!BAq!jQj&E)a2ZPP!Y&6_*Z@8$W;&f7l>w_#-UK4qN=x7K@On!K@9PbY1@IZ*Zeq{eN5(iw@< zTimrjgl9NyW#;{`%KOlkkK0svYaabz;{(`fVB4v>KK|dOT~~Yi319q{&dzPs+(w`- z8w$0zy}GJ06h0M>Z>WZs#Dd}pt@pJyY}qi;o%=`Y`dhwv*zNt3HS50CdY`*$TT+wH zV?m3D15}|T5t~KS{?x-tS`oOL$Z@Z_iEj>IvEz{RNJ*~_? z=fW$tx^tIUQdhrK#(+|=hcf%&*y1)g6NPe`eOswR|U#)H~j~0-IXoF(LbJ#^)!TmXUkCmCl5WB z?QFJF60W$2+h$0kpc_QhNh*W2<8|6&-P4-oElaN*sWrURU}a@(!7XMuvAylN?78{= zl-F_xi_E=WH5jXzXIC3e8(f>BWnO5q+CH7k>~{@@AOC7BO+tQOd`+l-T~bYutz7l1 zy|?%-LmXU*v2Im6!p;S2&$YK*o#sBa$vUyBBJ_u6+}@JT@Tqh0Xo3~N!tC70kkU}= z?ga6C{Ji+O{B@9S3uavu`7Tm=V+Rdv((zq8Tn+AqO8Bt$w_D0u+*|=|yKngAaN#;P+$27!W!-(DJ<9F9-N8kuIz5lXM zPoZBby7KrsB{p~eXVT{PLC&$yKC}7u9ISmr!$Zdoedb@}PEGUnv09!C=kITC)!N%u zn5M1p?b?@M%zkzKro`p`{xfD12M>+0Cw3~Y<5Lp+)952|!$od*m25s0PO#ffT>|Tm zlg^Zc2XAtPUv9|*7mH7l7sdCscH(zrocA8lX>Tr+RpyDYye%9FS+)r%Tdi_$%kh>D z0pS^1;`$@b>ytTV&+~|@775ta;87V%_tF(xty@nw|Bl#-)o^UF&b$`%V-I%PGxBeY zx%sexTMZnUyA5zq$IEv+)cw05A14q`nKjn>9N=~ zMfvSZ@ONlWdg350a3H9 z)NtL!BfXKPA!Umg4~80t`%oROGH_%M1hmb3=ChwVcMW7OKKN7uTvCjo^tApU|r|O`E{Ury9RF)INGFEM(iQ>h&=!kb6vmXo?3Np z32WQY z^$n=c^Z5QG##QyMT2~W{n;G=Q&dvTX)17;zHG7)1@t4;u5*u@~2E{g(HePbc-Bq=% zHSM2q%(bmN%@wusG&l3MO(_jrmD~3_)gF~4$1G{JjTr}HitN=M+n903ZGykabqtf` zNA-Sog($Jmx=SKirp(3d~`D0+{h+w*^V{kPvYPr_ zxMW~#{qU56N|h++f6Uc1!17<`8nJCmIC0G5i5mtck2nOL%G=Xd$Mc!V1ULq+RMSbcf^p@!Xb6#xMU=IKEVM-m!a^N~;8#{fn&tvzfgk4QxWX6S7el_rrcXUo%6hTwf~Z3EB4A2L{7Ko27Bp94FL;|087G zCW``4a{cz`kKqJ4=PN$U!Fo`Xbi9uD;2Daq0&64RuuycYfH!DPZFYK&cj~g2Co1C& zy`kee({BCHGpHv=uk#81(e_%)maFN$b9EPMlVlsRXbZ@*yIN$2Eq9W@AW`3El<$ui zt*hz+H92eQ;qdx&qVL+5r7go-Gl$1;TysmfdEwCtS$z1PjzN=SRpNC~KUPWHVR!8e zv%b7=aIXhSdugh!B6Z1Df$CCSLX9F?9@>jXGQ`#?>0YG(R)8I5yUrbHEtDq|I-P9I z5?4pB>M%e!uRgv{-)+9z9-1^V*x9+W6LV5yL!ZVzR%$FRjwM+5o#(}%pL#8?y;kb8 zJY#W?FfRcP>nD>9|6rt|XXmVix8@9hmz+8Yl8ZYu4ZS&#)H+Jo%f#b z{m542P_fq2w=IA-dx z5pT8?o^6|RXw~tUSF0fdcV+iPyQkE>TBnS}b{RABOF|FV)@7d!_D8?n@U__Yu@O$F z|Cw-herM;baN?PUHCXcGg=%uFSwBd`BaW&cyEbnRY;IoDl;c6Ws@nXo`W!qh%C5=5 zxPB-jgwon;XuCDGtg0Dt88-Qvg;vhVkXH$c zJv-tuyZzx#EkiZxbl;Jjcr+R4*qqHa5cK0A7guFD!>gK;s1fm%HKAn864z_P9`_dK zpZA8P)y#hM%(uezLBB6%M*Q~LhH7ksksGwCwzc{OKJ@gusd=ucdDgiQo+phcUKmO) zft*9ttUX;Gw-RJ8FFE#MGC+45miR5K^rnWAXKq@KV68q*MmfiDagH^c65aYMX+hIM`T>TUn>4{*aK`*d9tCvl zO2r6dM>H)i9j}9F+HC6 z=+E8WEbG7(@LWCUX1{;Hg~OA41GZ&6{=l~C5!<$HsoynpTW|}OJUe~Ex2+-w)$dB* zmQR$8N?8{l-clNF#VX!A%BsP36nMfGr=PH82C{BS+!q_(2`ijWnAq47@dIgZ&lW`V`AQz&j$GwJq_RSRpp!`o0AJ$1&bdI#W-7GjlrX z(TdHgs@l?!fw9$J>|w?7Ud{is8}e#W`~_+5XqHdnZj57M$F8eSfzfN{I=0Y1Vnajq zLqBup{-!f6>C!VN>>FpWyl>yLaX_9tB52+__uMk1zU+F`d)eR(b}RLg&F->O%W8utYr%ZG%` ze+7f5QZ_Vh$hK%juniQ*`A~yBJ^vrpVH0?3fsI8bO7pjIcqZ(b>u0`&F0bbS5M*NCQ z9<>Q)!PCB)!AfXDQhlL?T|qqGt{v9m&V9NwcM#Vz4fz`eJZ|sxvTHkqAnAqbp&)hg zejv|yc7=|)>)R{gT6h zor*fwzTX)wc|~@?=}+3&GIxQWWx7z^_P!Ta`%dS33GnjYtpyolgZVxS&xF>wr$1GA z$>3q*Zw;((o$ax{nfZ;%q;E~dBTD=$sB7V_7%=>-&enYRbANcopMk8ApSL`FqY?R(uzi+_Z4jE;OahxNR=SDXG+3jTlcrxPZnf6^v- zBj;?aEuixy{}*#_10Gd%?GK-sB$E(Foj@2OANB+h5(uB71jIHWkOTqcTTpBml7U3> zMLq;9w8@BJg4RNcB|&d*5)cB_7SLMoqfJmFw%Wg>-WJ<>ud%jjYwrbW6{|S^-*2CF zX3iWE+WWlE`@HXdp2_*0b=F>c?X~w_d!LW2-4zPWFAK|;#>+N!BSk@~P3u2{SL8Qw^Z%%6a}Fs0tAD|3Gn%J>{QVPl3% zS~^0A@-Gpx3ZP{<4MWTQPMFpY;5$XG!Ef@#uJL)cIwuu%;@uyn+nZs&o^}W9hYDjQ z#a;}b)jdjc2k}<0d!)AV+_=JZcr$UGwt9CbjKP`Z*`zwW^?4u(i;2^r&>KO|_UYw2 z{xELBn5k9hlo{#UPuw%_m#<8%?A+Gbbd|IHsu;c}dQPuR&?BwEd1y;N)``b<|P2ZIbG1`ZQ_2Ml`xUac#)h=lmi|vUGSYNUa^t2~M`fM`t zU9QhIE()H$H8`(h%g5ejshNwKdxKrxgw#M+e&E#B##DDgV;7sh9vju{BAA?!(754H zTT5?ySALLdjMeuW@1wdO*3KLap2j;T*LSpW&m6fQuf?#qNosdFG&TFOy6K*IO?%)i z8?@%$j<%gUI!|rbKGWHNoyJ!#+|hY*fc6T$R@kPEj&Nw~MHJLBklU586=#h&An-+0Ya_mKX^VYR4haiEyGxAZ`Jg4)&Od{=%wd`x_L zHdafREq|_U`ItqgWuNjj>|jGJ@Zi@z$sr^ zc1K%tZ+_RE}^B6!mw?gW~o* zt~)|9gdXaR_()e_XmsoXR;9goZ*bNMdArr#YT*%Q%RZdZu*7tf6T26h@CMgyCcG(k z9*ZIGqZSdV+*>bPBV+&8_6jhlyHbvep7sqUKc17aGtA_GuP00Q%uqP5L1mu-i!uGS z`_MmJdW0vHrFryOQ66TJmSvplmTw~Dy9%tE)pIs1HuFa{$2V_w-`aY@<9!q#7ffh< z&f~qpdF&hyHnp7#7vM&bLpLvHS1sB+|x$NOhT`@xS7cXT9@@v!HW zy;mK}9|hdApZ=lY3T%<39*@T0WgEd}XVbxt_ck{VI2sBaY4QA|Wr!gd_S^pz2(DMX zKH^XIUuPj6Yb{F!3vHoBPv1*H(+G9&!F3PY<}UN%zj(wtakFnFRxx;f>zca@>z{cW zP`S1%pw(pPfydLIW%I6Qq-W*i#rZHwPwO|Sv2m?&5!%cfo6OgO*LZ`2rYE`ikrW1% zyqf%jS~tfW&sOgjgU+V3YjEeved^zieP@8$R4f*)?jj!z^|bMe81>vQ z?n0_k#~t6`*5+VnOL1%kfhI@#2tRs*%e*11W%8_>S&QN=o1)V3; z#vMx=t5h=-d;cGp04e9D?lW9o^w}G^mh$2DbfqJ(OlwRnNosWEJvAQv%*Rhp)U6z1 z*BPIltk5fej89L{7~VUzK;nSW`NPNEkaxpxjIr6Kycp|`;!_c#5Stn;UV)|Np@g(l zHCj-XsRPz;>DhQyzg%mK2XEd}H>FQ5acoX%OzpeqG`;eeCwTo&n&UgNQU3BB8cRNt zHkqZ2j4Gx7(bdno=%#uHt;XhjA@O9_DsEA?!nEV^p^3-3mf|C+Fd=b3PipeX)WLx+ zPvhi9$N8>R>e36w%Ovj(vpW>_8fzz-qYV$ZynIl?9PVj8_J?9zKi}o~EOilWCXavT zPM+)NY2yya1_|pf^?J4=l^+>FlJ_5&t32km(C(p}FcZ0h6sm38$2`&UuJjrc%Q`dN zJQr(a+s;iR-XV0K9Q|^=McAPmAG)q>6)*#Og^;egs&ufWvX{M_c6sXjdHLV*zpV(ZHlK>cPF6ECG{o7 zg7ma{*6x!r=F$Q$j>JuKccxaiyEAw`m^rNDAns^y)Jl>9IV0D+cwO-PsZ4LF^Vlg5 zS{Ezv^G`ZAWp1wD>^OhQqvlORV30RC_pLqd<8pSiwpwZ4eH~`0;HSZ~)KEw_9&hDx zIPmcpp0MRQf}eJzK}%%CN2lOZL!JH+&z*V=KSVz;t|9MuPH<5m*Lm~zj{EjZoxXEh z=QC+HwD|5?+ta1jqb_(2XEg0lEFa1^nHg%SYw#85mM%2&ao_kW(A(>Gti=Mt+*HD*dtdD>|xr%foy6 z3kfS0t=ymPxM`q zt-l-JMZ~XkY>qSLse=R24vW;#j^hi(X;YU$|7VJCcc%q%VybeS8Bfp3aa84Kr*eZX z+z!v%2OC1o3%Qbi6!NQ{<1TJ?G!DSkCpiZ3j7jzO<^))*C1Je%^H-Z*YAhLkR;_#5 zQ@n0xdK`CoUb`C0lIaO}nx>wFc=KWQE;xsS&!A*wI}|tKtaq#{mFnNA)L+`36Q^o` z1yqi6=2X;SWRBK~PMO2``j$lGxtKUTX*vfD{Qtq%DU9O@7fRxYR4wFnuGGT3i8}aP zuiW#28>RNM&S4$ZUf1UHF7X)BLh$cpd={r_R)x>Fuo36Vq((Fh+N0-SCCY&8C;5qm zQ%&vE?PB8Q$#|?euIFG4uFFNR(V@@6whZ*#$L+#2@fuL*Z8Qw#o1R)@K~(lb%DA+JUF}8u(h!e9&vWw{k!nsBYWqw zo+HPzkL9=yzg+iFr};*lPtox3jAJGzKH?5?VkSM**__lkVCIZ^)rV|-M9qN8UZ!Wo z(b7-&4$f6VKN`S}-yQKr2W)>4cGv(rIp0wmNlu$uG--F|GbLYF&A$d6csCk zv;2rtV7YAUwpC0jc2}#Z+Kj&&YOycbB|QG}!m7=cHU1(5wy5!!S7ZCLYOQ*GNu^%t ztE%?vg^?W(bz?`sOGK3WHzKx8HM17floYP_*XUYF`MtiMSZyyww&l)KRHx z(I9{EV!hn&FM??NeV36&eN5&8#cY)p-4+p@4D-1B-Okg$zfBp^~maN9z^k0eJzQpr%5v z@)!EKKda6mH$j_|Gdn*bK~LjoOV^f_gRNp+dC7fXZA5ey2^P4Us;UJORIdPeKB12A{!=04T^kD=jPO@a{`Bd zEyFzPtEs4><27e8Oi~40Qxp`giSkKY^%SVBjr$J6iIy}vr7=mXMGf45v8aKC`@gsp ztqV;y>zIJ5wZ(pPDsInNUafXLR@?dFN|Z9_W$1YkrUL9?TTon8Wp1b0*E+(oK#;YY za1|C;RQtYVl-*oa z14Y^)swz<@8Dh)uLPiSK!m5~VZ-(jVmTN%aE?b%%M6F<;+m?fF54H>ERV0JG?9#BJLnMui2ab zS@!V#hvm*q>esJcFim&@vsT!co0q82wb5M%qrF=7nv!y()4*G{Sc_ zT$dEUZJ4VEIaMyf&RSkkUg$R&)yWJkr^=5Q%^by8jT$1YDV*IA>ilYLoLv7V@;Ox`JW4ZCj3&(C za}gdsAE3R5_(4pJLE^;Dp1(%Dn0oMYYIC#{Iqz2I+1f@q&%o<#C!+CBk=NYyO5f?) zX&jld_+h&?S6eaAI6sAhQ|*FeobzvA`&P3Yrb;E>XPn627!^q`LW)5oy!)m8=^#7R zPJh2E3}>aZRhK3=OwoD z^|tde+j)iUe1q-0+IC)RJKtzK-=qz)Jaeb3{7~APj67#tDKqih+QWIC&Oed}k6T;- z&sWPe9(ewX0S4g_*p>U7&k}!VUXQbtS8w@$8Roy&#xKpIg!1|`HvUEMi)P~W6x(^K zv^RNpeXlM5T^1M4>%F$?VlbByFw4Ke zR=<%pdoE2Pr;(^nt?hiSO}_=U{_sO)l0^7(TmCsV{SfOXoXG$0HvW2>ey45ae{8e= z?`-EE*yJCS`HzLNyab!RV{P)kY2)v)@fX|lL#GWVvTn8Y_rKZdmm~e1naJ-J|7xDQ zl8KDO>oaWSHQ4x{wCVq_t$#dZ)8`9Yeb(9f?~^w9BW(KD+U(2jKi-ZJS?B)Bc>cyo0vNI1XHhdf@z!0f?21aVCH>La4C)t3uaw+3to!jUcuDyu;58J zz9g8o{FPwJ{Iy^<>sx|X~K7vlK7VDkT2a2<|+6---l4bFN|-_HdX;pl*UNvAyq z3C;q(MsPl`+Vd1V!+~cAon_r3SO?A$JPJ5Ra2oJJ!83vH510I_u#UOnb1sN&h2`$%1Knwzo-V9f)ar-9o3{q|+YM+vI0E5z{to zCzDQHiCHJ=YSLLxV%9s$LT8;#o_xXVN30L&FX70xGU2Fz`;|oA3u|H-6+f4SKWS)xeJt(*Q`V_>t#+(Dw@-2HZhB1%Hs9z>hrH zpdS%@Bk+JDWP+pwATb5j5YR%ciaO4(wq1> z)+?x;AucuW?};J*De%7|_}9Si5zoXQq_g;u=TD%2O#D?+VK4j~WeTc&>&SBp=KTb; zx1-#kBM_L%n+H1YEy(j4jwyoY;)o%nCChxyX`C2EF%+)C2{@(+cH_82u#V#cf^jf> zIPzuyD<2L_Gq&MJnQW#X3&z3N2NrbdMH`YQ1;;l8<6!u3&^^G)hm#-p5BQn zc24jp9F?yIKXvDPPyXRJCZarICXZm+W0Hk_li*D7%(u`N3#LBH1XG_~g4tvp7XBX! z&I0{sf@cH&MKJ68--4+dZuY{u4Ygoha6VY_EOg#avo7;NzeDgs-~z#{-}fy1j|pB1 zo}UR`0Xzm{fO1v?j}=@5yi_otcBkN{f&GGy1FOAO#h!bG-VFNVf*%8ZT`-{bE5S9u z|0#GAZ~{7=*)CTJ-VgdUf;)gGT6k_0d<68_7CQIWq?}IBmkE9exWd9yD|j2|+XM%J zn=L%w7hDYbA;BEBFIsqB75otBZwlTC{E^_-fVl`W>y;q*4UoTTp|7-H?%z!QH^EaS z_zds^7M=$M{~q**1=j%|6TAZWw1xjSg5LrCw-$cQ710fm7F4-kfahwHj{cJ(I2QOT zg6U%>m^|R0DwzIen&3Ln^DR8L30?*IatqyO!HoZG+Uom)-vj?sfa zvEWwF@3hcY3w{FhLcw*wRTiF2g3p4^L?6zSfFE%+e7l=i)*Hz}e-88%;tKph((xnz zo1l*(miaf0n8rcMz|XNkL1T?E-@sEzuQG5ZakYW7h#~Vy$jm2RW6&20eJAKpU+vG! zD~W>MyFL)-7)RX)CX5q-`oOm{lHwtF?JSUwg4?kkczEv=7 zvsf_Me1dUM>m2eA2VN(19Y;>#q|;{V{sox2sCyP*+H9ZjOv3RQ!L->cf-`aaqhK7g z4+PV^YW{*8+KkEGzS%Ge?P9hs>qDNcAgZ>Oc7zB;{|q)~9UMjYgQVkUwkhl2V4+B? zgW0AT#L}j$gJU`VAgOjoS!F0I3+F8N4q(-$!^k0R3LFcp))K%8z|=Dt80=~<0%9gU zO(y2`S%O)QMS^iqPh82v@_7qQOdE0uWy)bUC1$;A1hd`^f^{6fFPQayN-*pFl3>>R zv|!fzPl9pKJ`~Kp_mSW%9GM&}5Q%j*+l%!iJ_^9PneAn^%X^@!c9HQ#ogDJ0lw~uo z4g<2zX4|oBbKRIlEMsssv9#BGV&ruq?-jtw*WwS-VEl-wBXuBVyTD`$Q(v-@PJPD; zPR4P(VCGZp1s>|Ip0fZ`_j`qh_S`L)W$h81fup)-2S4lgZ$fANo)esjW2a!&^_POP zaO@S#x+2_$(o+ZK9Ann&YQg!S4-`y$Fq!SbIuqXr`>@VtyQnsjwoq-v3L&v>rp;M5 z)8?#?X>-*^khvH#RT}}<0IPAKgAqyjI^8lZfT;`1O$Mee%u7s~PcU`aB6v8C`vv2m z9TcqN_=I5UtLzCP^;I?mroMm1kMf!RiXSoC;;dj*584g%WYAoK0kr{w*+$Cdx}h)i zHf>A2iC;$DncuMye~^?tHyN09AkQDbqZ8AKA}KqA{t@WP&N6>dZ^wO##h8P@!}mu@ z*KZhf>O`4$gH9U~KL(sdOyeQV#*g$9pyvzz0m@n^co*;r;x+h#q{hxjLl^3k49qkR zKjK&%X**)p^#;Mzcc z`~#uWmM1KE)%^~5XnQ8dR^v!JI=*RO>T24bHe!1*(MH7ogSMlM%rUDIe+z$**hb_T zj=&oRxov>%O-yYjJ(3#L5kK|1p>nPr*fu0>hQW7=Hl5KyeVmC=$}DJ1d}vs^WHfJsA> zDLQ3%1ycr-y{rMaU@c44@qU9>wL9w0cYQkZ-eu5HjFOWL`Xs?if!Rise-AMGx;cl= zCT69PR^#W`MkLR*9x!kz4$Qj=d20m!JMb34$AIgIWxfas{THC`7W^S_hu}|uj}ZIu z2kAI|l%JR+&yIkTfL|khJvrogk<965a8CZ;p)KAKd;s_Z!F(U711EFRMpEq#%(hVN z4x9k2+8vlSUWy<2p_;M20;avyJPypH*0;bZz^ps@*$(WQ#5#`O7L0@8_dtIS_`5=< zj*kk)!B~TV=l8&ELVpLxLxOQI<}&cS3H&3W(+0-`Q~z$kIB2g59)%-qNZrzK{EJ{5 zwEq^If#W&BlW_b}Fb>8ueB_-9%==r)$pluww)(Lr*~MYQfup2MP`Xt7lWF%R|7oTKLuTDA0F;zEJ49 zftLu@flCE91M~SZZSolKHw3o=9~BI!JuP@Y@J|GH0DmU<3E(dTrvZCn44FrOrwM)< zc!uEP!1aOwwQYi*2i|Vs;U1{etrPTS!7l+H5qt{xDZ#G+cL{z2n2GNkIVZ;o&IV2p z%;&Cd!R$L8!7G511%C*6DS}sn&g5t?j!Ncs1Cu{_yn%JWyv{@)!ld|t2f%?V9f}OP zDi?I?`-oBCQRT{dOb4quM~@;78hO)*k#{cmClNOq^r=EG1YOMq6Ail36PUUT!7mw@ zx-1k-dvMuDI?K6VFb;;#0i9(w37tB|(O#fu0Q1{AV(OyCBQVp~gigIwJ%z5uATVv< z7ar4TB&cQCHG; zf}TmdgVe}cw+nQ&{+w*I)qA*>3`{-$E?CEr&$UUXJ<|o#J~s;n)Yvb{!!lY1q^8>+@sh+WmK7SWFWnK_WnaaP3ZiDGVfM+!?X{}F#8zmNglp8Oe4Mve~>cpb3CY^;ZL#*%sP_40_Dymo^8;xh#xXANsd_t zo=*(^2JkN=USZIe66YG2B=YP7&nm%uX1`kS+rUM{e*8fy#*h48f?g{4tMQTd$fJM< zf}T7Le~@TvVpP#+Utrp7vCwrKRsR(JBSIgA<5PlZn=ZjP80{kbzp>EYwcrl~yKz)& zOYpNz)Y=l5ZE`_)sN?5?**?nOf+qub3fhwTPXbmx3V158i+%=}Nv*qpGl7*~0;c?% zgokZ)mteL}onW>}lVG;VPXz;NF9}`^d_geVAqL}(#rgq)WJQ>J={2%T$y|3m0mz;9df{z32x z(9a8IfBd^(_JJ65BGx@0*d>_ll_WR|SiN%;p5Ydr(SpIEzGI-A`M@_?^4=_X6X<}d zpW_f-8~h}p4_|i&_U#3odT?C)9atC4y{FTN*WeFQI)2HwD5$>dCT2M#5hJTHE`Zrr zzb4I}_{0#Qeld zFvh8?-R~U&oqC(Tj=DN{(}_e~O&`KCDCZpbm3@HU0?r`)Vf;awgrDPn1;cA94+_mB z{UL)slNfm?fSx6odvMGq7GIh#^iz;OpZGiYgR~Go2aSic6hF#Y1)ddxtASSu-VUth zDLzm~x(2^wVA_MWCPuNwb0=WhlX{X)dn^%5d$22zPJ3(5xWpfep6I@{`L!Ib}Vi<~zE zuK-=$BO@={@Cyr%(`o1*3p&4}VqMrTZWPRNXA1^2`aBmJNNi*F6DGDX@d6Op#%7;a z{UnPgGe_F8Puv0BI$q~v_pz)I)c239&tU05FL!f(&nFU`8>LcbsMQN%^~gOr9J`Tq^{3}P8mlZe@Q zkz(*mo}-{PSTOY(Ef`siZ&SfTz0`UDn0m4On3sBS7!y;kLcts_Rf5UCNwAJ%onY$A zYBMkOZ4*p=e=L~#QYQx;ClYlseU!45%|3iTtL#&x*fpK};7Lvto9r>@$_}7^1@x)p zxznI$65nRvEMoB72Axh z!0LIL=%9QB@G8*X6aLk}7X=pqYxD`=p^ZlfE(O*F)86@l7XqvGp2+{Y(Aj)G!7G57 z*mg{858~5kJGO_}XV?agX8b{78<6J{@URUWoaB-4I!sGmprA2N0aKoOh7U}6*9s5q zmLr(5na#|r<|zv(qp0|O=swevg<#12*F~G^ZQAQe%A2D^F zB$zs@brI;)nQcHG>Rclj2Tk3(fzC3w3Y~ek3ugK4f^ksK`6-9G{6OgBe@d{9Ba^+p z_t@%7oy_NHs*O;u?}A4seJ}nXjlz#|x>NS z<5A;i)l=yPJ?{sgT+{w>z{$%De##|gz9E9Cn`#%(DMQV(z?8Agp_Tc|3M)7F@n7*O ziUz_26xEg@;#Up-L)`DHD(#Ck90M-$kNyl2QnI!$X5&A(E&tnZvQDV-m-;5uAfCa5 zNaO*7J1P*#nu?;$n!#LJQp0dD{|Z0lO0LTl5gkKA#Vz@lit0C?tuP~iR=?brR_HPr zDi|JP!i4!oOpOUD>W{?~m&w_Op$+bEWEE>9wf+q7PqWzS-bY(T%8Lpr(_e}ITM0G= z>VROyN)r;bHs!3xcD0`>2l*-Yy)k z@N#wPBkpB?EhSdyH%FiKvbs?-g3aX%=qpE59sLM9v=)w~6paRd9-bMB{A+606;xIs z>|H^jg-&0+j^WV|u?B6o-fsz4rAcjgykqGDKCk>5FI|K-$)^*x>k)4 zhU;?P9nnC-#Y!}g%bTg+3{{5Lwa-v}@SAFq)i9eS=+$L9O*m!|`>GiT_43;GnZ;VZ zVOc~X@|RXewS}RW1XNjD>RT6mSw(%V#`Iqml}m-rGNuRyZnR%EM|>Zb`VDAi)z<7F z1~bCf6qNcl`=eEmzQQ;(e#YgK(1B5E8a$DXxv|PuSzFn6Kk0|-(h2zzMpN^`ngTAS z%AyJ|FGl)HB)_a`s%!ja7PGYfT`uX8|GP{!cM@L0sUUgG2%I*SP}54uW+kY<%ES}&Ki-`%2I(4S!HZf6+?{iTCG<_ z9SH&FtE?<7DMY9!Mr3BFL&kW!41Z*B^v%s^h-P%Segu+5LV@+eA#P!P(OTH4l416g zV~kRZQY7GKpRT%}CTASV{zlDZvRrCFC{}^klo5MSvXzZfZg_rRyfPGAUQy$pkayd% z@o?LPrXsdp-bc_?Ga#UZUF}c*f1cB-pS4?>^8wc$YK>>ackR=#eUxHE7yaLB7nRS{ z&AMn{U^J7i7A7^mD4W}_!#|Z&7h4*|&R|p;QOOGJToX!5?=54*HH6NL6lzrlAz;JG zRF?W`I8q822@XT8?-Zz(G&_bU~n?kM|h%**95EoHWVzpzqPl_j_dsj4U|fY}QW z>E6m{Z6?Ko>wRi#n#zclU0@obUrjI1Z}X#3ee|D-?wi}JRUslfRuo26(&%nR)#KA=OHpCf=FzoCw0V{SqF2Zqh8IPv4VjtXFN%`7} zf-u^3o@2u>64;h!#Uz0BgKH@C7_U1giZ$U;rOOC;h*Z3^-PMf?=&>k_B0ygC>v&nPg zy#l}AqdY!;HRZi1^6*+jr4<011oL3Z`>9P{ES}->dr!)X7e4AY67NQ+j%k-SAa8gd z`i%e|WoO~XRJzdk=7#c6R9L?YqMs@6BN&6R9L;3v_cxns9g$W-|e_^xV^LPi)0Xp?d!q1e~VUza- z9^bQ=@&b5?VYT1$I7d~&$<%Kv=)_raWpx3*a{{J3z7H|w@&9+M@>0MY)whM^fsZ%~Kc?M2<9kHPOU2KWmu{0c9On-*gCtYl zD4RTfsAKkLzMC@TeFlB3`gI^5-$$9rl=m_Ch_mEE2jtBJrheDsXUcocCa)9nW=I|$ zOnI-^+6BA>9}qt zQ@@YFXRYrl$TRCZ4$NkKLvW;4`^|^Ek4$00$J2j+&nmAO^7#Ld)Nj1-vA(Bm@-i{F z8T;2vrhc#4@;Kp}^7wyX z*7{~a9!wQZrhdN$A90pkIRkm@SCn@Hex|%9Z1VCUZ>Hqo!IXE8Pkx zzip70*@wJQ;IrzNP-1+)M*XH)l;Iqmrx+kLF&0sd=&9=#_gFMDcHj^puYc_cwK%TkY;CBh8ysK^U zo`7>qGldBsPZMqO7M2>{?$CZ;6F%1WZCiW133=V1o5|GgjIBM6K;C;`qP%SUO#S%n zt<`>yUE8;Qr)>J|E{pW%9E&`D6Ks|D66E#Zx|vMr|ELgW$%V)8k&?N7$pg)lx7sEzSw|jIi11MaW7t{covMhe|K9am(`$~$&@z;e8gFDVRv<8{c<~Kro7%Oqvdr#9{)GcOs2fwgU>4Ov6{&Gevw7q z3Y)wOn5_DmFPGTl?Y=iMA1$%SOS8%IV6d$ zZxiIvu4XdpJ05)2`noq7e3W+wex|(7ZR_1_khj7VCVV{QH(XYEDUde`bjn+apDFJd zTl@YV@}}atnaIa<)YiT;A#W$>ly?_?ro4KaJP#)OzWmD;o4nT`uS4YBZISl^u+@HN zAP-$3oJ{?WgF>7oS86sz{1uj#Vg0DHRo?uuMyz?sruc{-#Lp^k#bzV^0qg6NYi!3y z(RZ!#p3mreK4+{otGu)KMfyvjMcyi#yfcu;GR@%Mf(^BVPQ1F-71 zbiC0I?D8H1pH*HnjuYVji<^&6FJ)OQLn zlOOWN;~vgTv;}|9;t!AL)++7J?%U1BGLGi8 z;;ZreX?}=JRL3j(Q4i|CdN7%MUk-}sMmptn4lu5p{?r5d#3@s!>XtO=5^PXz61E#| znmT!k;#r;etvT~^9S*ZZ%Kmz|e3ltohd)S$e@=tnjqn;*@Yk}pZkT3*kO_?AP1wUc zeskPrwdXi@YrmN2y?Q{&B4g9seUJ2FY0Z6e8-2LuQ`-@{7OCxsi=ExKY23hEUB}hw zlh-c+hj*`Q)A^1upn`TwV$YbN?~WN3=+e1uHuiOodp-6Y>|sAPz9b17TQ3W=hU)J3 zG@ZKW{zq|k=HxxkI$dAYh7V~Ag<4x$n+LQG(1!meH(oQg1m3r^*VxRNin?9h6R_Di zb9Fe4(!4vILFc<^<9pIFq6$=doO^H8$`V~8HI`cSN~%cw9V9;K46=52Of6lwyK~(3 z?bC}gTAFekZr7R|ZPFv1?XUjhXee~#=bp|}*(Y;i_x`5m^)HXSVC;{~9g#a_N94G= zC&RlV$Lu(CJoV5O9g7+hTQ;=FUex>k+f*MLh9_v_T_etB3~{{?nmMHVm!aWzG`t=f zK7CJ0tb2&-7oqt>x?i<5RdmDsKRmlB8#}ziYEQ;P6CYabR%4g>o_%gwBpz+#9+->q z>+FcHN0^ZW%{$cONHRHwjWo7OW`FBL*_(XW^n67Z`xi=@HgzfXZ(g69H+??N>KZ(1 zr)I70dr5VTYFGIj$2jgm{yH~(zvup{{J5(8*sA=Ps(k0%q`9&;_`V4!8~QxyR3@Ao z_w9Juui4h;F)U3tVpz(i-%a)G_Z!+&kM5qKdUTqzAyYfnHT+~(N>5iZRKa%9*u%ci zyCX5&!^Xxyfe$wXo#)fWe&!3LjcZ)gI62VeX-sWQ3Qoq(@mH#Rva9{_u>*qHJJv36 zxo_gu-}^@(vw1xZvL|ihHuP->3uWv?pJUmHKF84rc|H3_S@Wn`XY7Rx@_bWqUq*e`L5A;?Ah3*dm#3ZA9jCZcBA8bR|+}fUvQn8d?xj; zYyitv==)ZQuZzFPW*>2OZg#lW74#bI7O(6dOq!cOTSV0twm^y^U22cU+eN&p+=YHm2pL=jsMq(rNoLDr#&Y;JAP0NOzK|PQY zbJxC;`(m-yNN;tc`}}@4}}_c z!J<{8J%NK~8|!y$mmSydyzcy%Bi-CU&gb|i?7j|UjFct>CT2x z+VHnJ+V(u+#N0IeLmV3>Xqy)`{qXa>k8B8qDqB2lq0pWg6-{YFmT%UAuBNo>ywk4_ zT%)DJX$ME0m^{}vuEibKhLB0w?X96hsqL+=97s)ow@gFC;_}E0(n~{r#F4L>NYzUr)V8*>$kW2m^OJn1Yn?`U zKlc3Km3Oe++F4|tm+ZG7T#XUZ=8%WVdsz4{F>*gJC)S>gszAK z>K-@e*Sz?79Xp>T3+CS=#{8QXcPuYlspE>T@n6@GJN-gc^h_lk4%2BxL z9`1zPp<3F8k$G{(0<3+Td1d`Z3c1^=gyliAykX0RZOmV^cy?^v14)51 zj=*g6`|QB%n2g`{QJJjmom*pfY@ZbDZ0>3tKzEiJ3XM36cGwwYOXmBIPj-DXgn1## z)s^EJg*BbQJwP~pTYMON+S@{ZSB@WA`2Gq^&a*h4v(QaB@hBq^Kewf_dgjbfw_qIHm|rmg7u0X3KGg92elY2tU3{FTgL| z$*1~AxF=%T2pZFRITC+M@HPwWVZk@z*d_Q0(R;QW=gDy;j$g;`*9-7(Ot=x+34D)S z)2#Cw%4!DvF}aqH<1bAe?6@Z-7h4)?e& zyoL&edPAYfDoYGTrOJS5IRW=I-sRKX!@@l3%0)q4;;y zE`_eoG`JDpU{{B>wNMFy7`W(mr~59q+d^n^97|1htNX_I z*I5>r7HjTJjYGz}Ec&9fI4q_t<@;12E-f&|6F8G_Ji(NS^QL_h_67r3f(9pzCrHMU0BB){1o;+hm{$t`~ufzC%YE*bnymAozrN$LZRhT zGG_Tavr-3TWVW2!{OLa+wLyGpFI>L(j5{TFJuPbXHT+svMax*YqllZNG*4Qb4qHGJ2)-V>ADxKGVsj% zZ=I8tX-TSU(c7I)?QqgDXH4BM99RhK+^g^G$o7Ros}FlH@2_t0)PXJNKoT1Ue+&1M?z|}byy#BrPSM=nHS010V^W8g>}g&V81of$ZueVznisjJ zc16bH3$YlH?%zdsS?_)G$0xcx*0w+^;kG=|Hpcn!#vz=d)!N*wH05PB4#BEl4MuZ( zyRL|I+)(J8_=1_^Ql;%)r#G>*9SVp+YxX=&@1pFf@)$NSvQdW0)_ktXHyDpPRLe(r zVJtQJ&Hi+b-NE&Q!~H?->Co_EJpO3%d0y>0(S|YJcy8R{S-!!z?YcR-|D8CkR%L;M zA2*-d(dbS*l#ss5>%FCM!=d_H1LMw|O!d5Vbm6xs^%d3#)p_H5G5NA=bgy|cyBat`+p4fi`f>t39pflg&eh_A?r=ECLWjMe8 z#u(Y|b-G3wi#&^&gYj$9Ccu8)wI7{1_uB_f^>zk3=LMU)j-`62%v+96#yefVa|GgI zo8sc=ZFcB&9ZBfNN3f25{YyOXYWS7ITU@*Mp>NE|3U-bQE{=2Eaop*8+tK0jj(s2H zLWMi_UUgh~+Su2*I`xi?>F~~5yFBqr*KR6GCk{`Z+?W(d9W3`yP|^Lcs>DTB0&!P@ zuE4sl!c@WD=5u>joH_a%%tpsT!3`G@I_ewRv|Aq;ImXle^2i;B_w04%Ua$2$zT_Zo z7VAT;Sih$^yT2J4x1;Cr6}*QZP9{3)o=@8OoL={6Qs=A6f4=5<<)_Z> z>X3I{+|Lh>JKXblL02er?D66gy>)-?{Ny&Lt1R?xf_6T^Q5Q;j=YRB9zVGbLa?JbS zecUyD+i^a@334DIMmwH#7E&M7vCMww+0O0HIddBvJ03omd7}O0p+`}(Erwl|AJzhK zsqS<%XLk!`GxwlLLC^BwSArv(_QmeWbmo2oH^VWFc~jP9xW_4DydL+qdJ6LA>(Gh6 z_w3i)&S^s(w>YQwjvni5nC!@X&M{-w8sFd&$DF& zo$jG~W;h$>Xz8cNUHJ5AXT#mv+1;J(2^#J_0{Cp}cv9;RbhLIG9%ZI^#+-2GF5~UC zZ*aPClWX>&Z^wMr+t`LC3Z83E8@l{XOmoA$7wAerYd(jDEg2Rl8R{Mi%Aqbb-+RY; zQU6;K;g2|AJI;-~XV{c`h6WOAn_ADqWPw|2gS}&e)bws@+R;T#@6^VnjREPDruU_1 z$I;e&Paf3l)a+xBbq`X-TTh}~%v{E8n|I)CeaP78a3u~e~8I!pm$Cp+;UUu zpm)c3hJ7|`faZN^;1v&GqHUNKc1aCK@$@;^*1T&+NxN_Gp|F{xAEW$rgQplJif>1Q zbpM|(O;Y!FwT#bGF?7Q|iJH9iWl!qBlc|H;4=OsOU`f$*6z--eVU&ACU5m$ijpjZ> zC)&^%meufZ*su4p@gWJG48ptd;4sDI4+Z1ZT|XX{IC0H;;YVm5HH&(0{gJCA6xOL+ zYdIZd&kxV_8qd_@KkJ1us$DSwV1hdM1-;v$1n;waV#mn_)DO;G=)Dzp(|5l5>GRI+ z+qJU~b#A}O*|0zxcY7WPYqYEaeVAgI0H|)Lrk?SqKTumn{dh^fS`m$<^ z7wF8E-?u9_k!z5^C09_t88VE z)KDnb`(^Oc=J=)o2~GJm&3P>;nCW%|rYDSh{3t#J;i?;kx;t^&BM$eVK&nU0vEIQ$ zdmcaAtLAWYqlCuZ?T^H`QyP2G9o^ULe9_}hJUHC3)H6c=0H(zCCOGkMdNzw-Uck0 zxLE0F{eJhACTufTK0OC2lmajk1k7KbYW7)HrTb=+|8YZy+@D-@JA>y&<~xG#H=gTA zt5*%-J$!W_aljQpcgX@Lro-+B=ofbJ$tmvYAhXP$XT0TT z+tK1qXvuCIu<*N{#zif@?JdLV(dM`nQ-0>auX2x@I-F_vF>BY@7Ch~3_TCz}E7*9N z=k;jM#>pAS8@oiE=3Tfu$XyAiId4VqG#C89rxyl0JB~Ibs>v5$bDFm-&~v(H8h93J z%|`EO*9@YsUS6JC!!(-y2(9cB5zlQSM@L>==Jy4a+50Suj*Zp&$}rWwp7jn!=XKf zJ`3x&tIzuee_YS)QLqU+DV`Wo>n?!Ba>q zwi<#7=tBhChXZF#OLz4H}hP?}(YkxM%^zGA-FQSVaf_z7aa3AWs5oA0 zg9_i+S_T!Usq`VWwC+|{p z+O3p7Ex0{oBlbT!VN<3=K+OvNFDzu2zL~~;JNxcp}ljmLP z>WKHDZC#r8w*xx(Ow~Iy9u{eI1mm01#(Jv1{u(wa8)9(T&Ra7@st( zOSw^fx3FNq@(UN?ObsKnZHFvrGtMM4$89kBwzJ#KZ)Y3aT5xgz(;6IFuqj2`^S#l= zIB4rY#^T9Ox`He}<8$z`CdM$QhiXnjN9+Eg&zFmKyQ%r8?mCVB75~H1S3>_TL;o(H zgy)GVdycP-^y^1;JkY@-#H0B3@IFubXb-;|IedPow(;M;KK!@%%)~WLYlGnUtk%|D zbvr!XGXsp7Gye4}Xu2QWw|(#3VvYAvDOC+zNR>rBx=P!dpr4CeG6ua%+nfZas5(>I z+suivLzkHGAoA8LYtW{Vca#?sjj5~cBXW}gm&ZMIe+rTA8lV_P*Te zFCNAHjz8Xe5EWF3$h;LTar*9wc4dNTVgp2WcH#ob~v_^a$mhQuAk434NdGZ^x zr{SS&I=``NUc^W7qqTX3>p&W#sd+&yvST8PY<;t5BbL}Yw<@spQ+HFRO-=TG4*hGn`&)gm4AF; zMfuv2b+uLgB7NbKd3t#*#8&CI=+_r%h8SIiOUTd>Wu>HiUBA*Y^op{Qni{fDju9nB zFDAh}vQMz*H$+!!CFLrlimsxmQQxH{h3ow_dP%h&sgy=((G(Rm zLN~+ngrhWA%y&unGb4*paNkOYLvHG3_{)f)wM#C}(C@lo#?-s}xp2eXT6qQPP_e$m zuh&%Q)d(JVv##1Q+;}!E3}zcqT1*7>oppxUu85R?e`L;RQ77Nru_g zp?$bOlcra!)tAm+GQpMu!ODs%%JemxYcTrF0c;69lXm^2shiSu#70G=AVkHnWiKqQ zKm~M5h8b)&JGwb+>xE@>FT9q+!RfUF&3i=lgzgbd*AWX#-+8nbR zEs>hfovkhQ7y3)?Mc1;>EbtQlpyKA}Ykei9$OH4%78wnO!4c8L&@|lcW`I2-EN^Y3 zJDU;tF6Cqc7(KYuU%sxU7#+E=q6$Nz2JKX;1_Oc=p}&^YY&IsOx#IDaPnRp`VZ{}- zrA2zVA4TcKh>hnj*Gx`JPtg(jOSO3wf+y+-{D#4_#$UuxNUW75G+nrjB3~rzs*2i5+N}r%GZmp{GTbYMD~5RZf{du}b$~x6uUnJfj7ovMZ;n zgj+3VL_tzU`_}@Sb70oi_$?9NB4G)aY%D>TH_m$DAbnJ!TD6`8Ak@LWb}hm+F?yfB zve;k7aOFHJh@90*_0>FqSwQtyJsi?C(zMkY-2Y{++Pi#M1P7-XNH$Eg$~9aEBRof_ zTAE(6uDpWFt#oZpd12M&O1SAcrX=_-4uxtRejXt{*OmL>w8D|5j4>Au86B=wVI)=@ zrW9k+3RkMHi`M2-aojNKDyoXKb?5{>y{{a+!bM3RCE4|}@D!NZ-4vu+k}m?-7@ah<@e18qVwpf?ZKnQd3-J^_dolra+6$pz7uGqd&o~YcQd) zwwqI4bo<&ljKn`1b1J(;pY*=Er}V~1H#I|PhWn{nB^mN8#xYjsmykJw_8sHj95<2J zsR&z!IJZ@BUWEu}rfcCbGea+`DEG5^M$bkdWnBW%=@O|q+(G)dW^d9y;xJ2adMIxoCnfmD-P2%ov26N{pFKZXc{ywAr`caa-Qv*_tOA{{lN)pOiIRSH~fU zPjHPq4j9qrqXB-y&TrZAIkEb-9k;$td`|4-_wL%9YGYxtRxd2|K`)sj^(m7kAQYUQ zR$Nn4Sv_Oo#C7QOwQCsdn>T`LEwgqaLtc)@GWH(KkQ2b6^M29DSukbNlp7~yPMMy5 z$)k#G;k$AEU+=l7#~(3TjP@}UW15SfQ@cXj0Ogq`f&u8d=ui z;MAsR1H`@`tMhqkpJ{U7H6X6%X_YuKEmP+?+9Y%!rfv8+5&h*Z$&cp_IKNq2D&O+Q zDgGO@8>RkZ)b)w@8%Z%LYJ~NCbmRmmCMp^Y&!hWKjM`B(k|jn(SF)bl%VV#Jq?mAT zF=#Pr7d-3rX^|74n5gJcJipm?{TADK^n0WjE!%cI$96u)cAjTD=O~Dz7;RqU1Sm%B zh!i2ksNH<6=ZhjIihr@~e2MLRsqK8Z_NHY>@PE=Du$?=le=#GkbMJJfe?xy5i19by zI8}dn{c&6V55dP2ulNUPj0I&T@_$$Q8)-ammi}d)FR=`9UN`?A#k~FmVuP58*T1mo zdyC7sT8VN7BD&jY`M(PmGf+#_#>;pj7xUk1(`UO){nm;YxM!r9sL$7J@^za%eqb`=Nd9MS<@s#(_{i2ij45d*=6Bodaf7Y=RW|tufe=p2 zf3vN;-M0MQw(<_!&hHR^M4^t5sN!Qu+hW1CP?5nUIwJ(jS!m;8_hGy0v5( zo9v>*%*PcKF=cbLMNHY$nV9leq{&0k#FVXc$O1r8I*4vc2jD7{t8|dQN7tAv{*fy+ zVwTG_C^6-!z64Bp%Y;sOD+E)XvO^L8lG0(2ft3!ny7P)^JLq!}ShbzlY81{n7OsPy zX~d!@>+Zq+piMl@aMIlQBGrspp-7sn-U<)On*|>Vj}nil4eXBv{As z2ZE{B4+T@Np9-d4e-%vmOi_J<8IkDXlc@~SK>UcQGk=ch_=7~f9UR0+WOd9|&}gqY z1~%=+Gi5i}svfq|ac=G@&mw8V$89zo0eUhEN1A{iG0V>tO#S_Wsf)4?c&N*FgigC1 z5KLX35KLW^4*|ap+$D7Kyds!-{ai3@$V5Gvs0Z;e=uADLd~Y5(B7NpP@R)VK2(06p z**DC(XTk@ujHvzt`3pdwN_rOlAZ6mma=oC>6kH9wkT@TIke1@dHliI?5zoaRq}BK_ z?_=OE68s);vEZR-^isjM09OiD`^*FL#+ONrJ7C&?^&*`%P~#eyZBZa}>QEyXm$W*; zIA{+Drp@;Y#=-FOV5aP+gs$WGu3#Lr4+M|G@h^hYaJ&NcHT6sqoB{e+!IOa1KCqBK z6_|a|ZF7J z5%9AHQ?ET{|lHpnd6AIBhOz!Url@){vZ|M=io$v#Ckfih>V!p zG5#RE zgdced!SkBn9l&oA%cAu6Lf;JiKM*_%6Ute^7yoZ@=L1(&mG1q0z(0t`0wct-Iv6S@ z8Y&s3%^Z}JlqM~QsBuyh6cZCsM{Vo|C&QyTH>7T&S%YLFmX$h9gJ~s><51b1q<_}v zq-JGzytndNIc0HwzqOuq&SG=WnfJc$=Ut!AW`EDKpY^O~{oQ}qdo9S%kSF2~1KOmA zCp`pwxTfsi2pumuPs`)Tw`xujou1I)y!Re9PJ|SZKa2BdD)}}o=NzhLt>FyOIR>2( z!ry_jh5rSdL;jhLn@gUgc|7^&n)5~f5$I1M-=XDG$Q(!zc%9~%qR=TJ7igYOMi~yr z_3x4f6ZxH5#xy{16A>Tuurfu#M`4_l$d7I2egm6&g z7a;CoGEYhf$H~(*e<3=V&^bk(q2*^po(Fjh`Z)8Fk96aNi;xz_6Ux_veZss)8zKA` zaJDelGvKJuQsF1Si^z9sJ4;0V9OUJ~ z`@l2 zBywNPy+r3bl!;HcH~dKv&Vf8lcq#ULuIQPg<7SHdTC~UWAxeYSGQJ7=ZQ^NG^MPZIxuM6jb4+(SJIwee--w02H{99p; zXPvN_eDS$1*@wMXI0gIjg_-VU!l~F_C7g!+RAHu7B*Wp<}<9C)!X)8bgfa!7#uUg0D#J{?nXwwZqw=6RCi4E4zz zL&&tlXQqk~_eJ3t@JqtX?`y)7Ab(GI3iuP@Lhxt8snGvQnD#ji(0&Z~J7Ju1ogaj0 z|2&j0byy}7ggGqC6Q-SC2&aP=3uk~Eg*nXb5gq|PBFwnQginM2Lzv}|h=ZmadJ0z| zFTI2x1`iUZZ+=UElyEw9MhjnmK>uakpcFyy{Q=tEQ;X?3UOXpQ#+UNYk z^o?Wf`-UMuC`|jG3uEV;G;-*3E@Z~#*nC=;{iOrW0j6F$3nw9NtT5BQk3fI7gIN^2R3xso^f0=M0c&KnOc%CrZ#&O|Y zi2FBT_LtMbOjZ@)lvH73I}& znO3|o(@GGog?CdzH zUo2j3@q@yfVP~E27VxiyS?14L`p*l~=iduwL;p45m5?75t^$87{4n?{;mzP5gv${( z?!0hWB?_;E{Bq$caHg=TJ4^pI;Rfi;5#9;DSD0g3K$v-1X~`e7s2sgmaDNFv1@J`4t$4wpE635|e zVfr&xco*|4%&~5nFzezW;XTmVAk4T=3G=>lrzPJlycGI>7G@c~CtQoT9}3rlKNj8q z{#GLhZyTEzEd%(q(&Me_3$nO%~ z2Yy8OO)zHMRpt3Mc#|;4tIfg(!P|uogLetjhrPmV|E~(O55~u9n@!+UVd@VO-UoTE zCBIqtO~|KO@_LJ(6@D8!ZwVg&|Habz#Ny9|4??F!nCG|-_&*8TPZj+6l`x-SJS*G* zyvHzfUK2hAJMRde2LH{{`BL~WY>RU&&J~^lo$ z{GZ^U@Bv&?tQ7tVat8DKzXN%=60vJI372d33G+CEXRh8W{VO!%7RpKJqZ#fg=J6P8 ze4feR#YX1bysF+=@Cd4|uhrZOJL;^4j*ncX6)PK_}0@u)CuJ|Ucd{U%|SO@lDws{f(Gf0k3D z$WyU@Lzr>j6!v5Pp)kwxGhy2KTsRYZ{`M@u9|TpuSa*zpK6w@@)c+$}q&bOlls^N@ zh0Haad}OIpoc5gr7BE60HZtpiO^wVnhYB-I`awC=}$d zOoPn-->H0o)pKmhS>On?Yub$QKY;stALa7yL<*USAf#e5|EFVpc>MT-z&c=B4% z%kybr=6ky^cFrrp%*SqF#@#2Jfjz_7%Jy00opB1#*zPBz4D%2-o4go*5OT0lz6A1I@@Pus90&PG$dM%{;YwZRJYSL-RKEk$U)6@e z%oA-=$A^8sF#Vb-oQeIt!r19|DxlAL35uNc@_;aH{+lrC!m6A+;e7F(V){QG$JPHkz!Smh{~chK-ylmrLzwx#T9{>dy`{tV z)o9ZXIrC}S2J=aN2<6Otn(-t~E9^K^1M};{_@}6jLUSU2-BBE!c0@0kHr2akux8gg_)1% zgc(9?x%=`tgQI2GFKLRuEgCdW^{!wA<^#2y2!!q9>a_T=T z?8APmFzf3jVV1$G!q_=~7G`-g3)7Ceet>lHeyG6J@WMf2N z{>}Rgv_*Zs&!Fn1kQ!1K(={h!mw zt{7MjTz`XUko{oVBIkom*^UJ-?D2~`Cpd%3ib@Iw@vFr_;jhxv7kr^Fl|`pyCceun zC~049cG2u~mVJ z?ML`pxozh=yMDwRst?+W3(&~=rG>R>gyA=5Ky^0f6|p_lUGH3D_Ex?hK1e)d?(r?#1tk+ozd%3!jZ zEh$n`|9CtO$n)o@St*Lj%I1{K3zZU2I=YO|Ce7RfRG(3V>7!;&o6Nb87R+O8Nlwl6 z(pK8mnUaF3MJ16^l8?HlmlVvH*UnjC&b;~NRD>?seqV9v*-qf&X0%5&4}@y7lQCPz zWE!)T1!D37jW9vw}YcqvY#HM1O8QOKbl~UWJLf_m^URYL8x}enI znSFMtT~ud_q~}IL#TA(-rsw^0vDzK$!~V5Os-3nxeI{l{nR$27WKmYlxm5wTZS8he z!D6Ue>>V&R{0VHx$kRgO8 z5Kh_BUITEc**T;`D0RlR#XNuEl!qC7Fz#Xab024lq1xoE5J(&o-4qQP^OK(rM4V}1 zbM^@cHP_S0U!@nNe0ySTy;r zB22t8Q`P;T*#$F@#qcpSPE2YMxy04EdM2jEDVw(dcOopKVqQ_TTlVco;CvID&Z7(y zs)S0#E-lR85|T3;YF54iBx+5*)Jj2@hB;$ccO((CWV8uS9}_vh`iu~|3~M)=Zaup( zX}8ocQo3L&x*TTIDlC?JoCvO|b1w7A*023!gjQ4GMTlndts4!dXfw0Nwe>|CZC7!6 zSy54|1eEVGm5*&rcf5khYQiXV?CEnRPcNG@dops2`_@(_R6F3jQj_n(3~cSHSyiib zEHl&8bS|x|>Y~+`M!32wTWlr`K3&%+FP)@(@n424-P2cak6 zh7tS4v$;1}SB+lfb~Y}WnPFTip=s#5qG|Ky4<05BMMUl2eztRJ8Z>zD(2zlRf!SO5 zVBsGOtIyZpTpIO5a~!7+A6iK8$o>=T$$0dp0-vYYfzK}(ilf@<@wti#MsFJQ$bLDH zGg3ddxgEcwvGEw6eWbYTl|sh(B}_2(E_2yC27AY#M0R5t>HfT?*`J504f@_WlMXyIjU2o_V$dwUE6}pl90)X6t9{w1-DKA$u>m?6Ev= zpdksg!O#F8`}qUm&20UAoA$b5<1v;W|G#4U$M?7*`PWC{__1e5xn4g%qdh#<3)y4+ z+xGZw2%mSFz;qd?WBWG|_HrPjJv6zHy~9wn?eSfIKDRT$*!v5VY=nZv{}*6_vA5P`FJ^SO{apZMV=otl$>^rtbFL6RpEJSO8v{MEUk+@5J(e^5 zyAYePm+G>&2nW(64tK`hF1_{A2VxI?V6I*o?gl6rAnf=8pP#E^ROvdsjlww)ZCNoxyS1 zyF~QpUkl>f_I!xPIx)fEx6rfg?L*^BMO&r4%dqhn?Y)l5wCz>l|8&S&C>VQ1F1;G) zjo?5f!RSqao}KQgvHHDsrrR5vNq30L-rMM8oF~KtV{f3#Uc-3&pAQY5_ENAJdyk4e zWKjnsR%IA_WA71{y^N{&KN|{w_WFt*%Vn0UoU35ZKCc*iO;EPWZx8g4L?{@&KR}P{ zmm|lfh5JW;$aswDu65bl2YXjY9PW%gexGaGJ7d`!AbPaN|Fhcuoo>g!e$cb+B@~AJ z8)(_WYKYt)(!(Ki1 ztT)z+v3H5fUJ2}VWC9YX$G|nfZF?tRFB5vShkyNq>^+BeY5O-nMYlWJU@-Qcf}U+J zWqSC0#DAOc81u{TjBR^0ur~v86O6t4UG^5iUI~=wAO1BGvUf8g*!G-0`hPlZdpAOl zw*7M880;+t)7~}McuchyfNd`m_V(kL3Djfg2O#_T1ECn1IDkFv@qg+(Mtl9DTif%Z zlchp#g0a^ddbT}(vHl+|?Olh>*yFcdwtpG0x6~LDJ^ti7fVRC_*fZ_r$D&97`ofrP zuL1V*X+Q#PFeF3CwwE(gzcWJrvasRmpvQ*tCaE^2W8{mtFCeU z7zR_nF(!Ka$#1V1$Il-K`FDl;+l}~b>^Xe@Cb7EX zw83ppSG_lfg3z-Abr?>eT%vPZ;FVL(-v>ZQLX|Ur8@*p6AI3MzX>S(_kjHs{#(XgU zR}LAL>9az58`hFx85!!xkil0C(~>E%_g^N>uQZK>xytyWiBNmOQa`ZiS+6iXZ1tpj|(pE z5a@SBpy|x=jsrW%`WU&_9l@tcw1-G))yxX6>+^=T5lY_%wYHTlh`?C4MS0v3K6d6C zorkcbHGTSN>))+@S?iDu%Zm2)ZRA=j{f@M>WWn_)6h#Ne``zxwjONC4`cLogiA`J< z*0?0CYc5xtRpndvC;wcv zoJ-;@PIc|mm3XPKcHi2Dv|fihW14{>S%(6ROX`}YZfhKY#RNM$2O7N>zqjMgYgRSw z4|vrIDqgeF&uJeFmHs%6D+e_=)iLK!@7b|BH7V~lr@Bva;;WuOPbab1Q@{1-Yf}fT zDGkP5oiuvDCI}yk%{wh?_tm}yx7C6|SoU=|%#H5IcS4$LUxFN~q#*lT4^}&j!cztH zbjxQG-ka} zreekN(wex{!>YYER0Vyd^>N;bH+qe?+M`E8eg#hkQj><%?z^@g ziVa*~F>$PC$?=A{T>1rb~2a ziKNm+ae>#*EX*9dt#L_Uea4E4<|ZfiyukYO6%{9&^wLC46OhvPv561Lnmx6rVYYIR ztb|ni`Q8^=f(7VK6@ld3K*0^BA=I8hyHX}$=o!7fcW~>Wj?;^;Z!Q=c*!z7$)|O!0 z*9{l1LQjbCS5>Xji@a@;_3E%bRkX9EGOpJ(^@CSq?Z4RC74d}AWZIep$D7?pI&DMrh+WX07#UU@eNBODtT)DKRX+Ij) zcSdkeY^PyXFKyN9LTiq>r0VCrAD{(bYknX5_riTUOc7!sRa;sfMBE2j%k1NdD{&lY zkjps^@&l^~VVK9G$A!ATA-@xtUyKV_@N38J#_`RKxhNay(Rn>OVhLyOh~Mw*Hxes1 zcktBJw&08P@-;p#xwpInnicxN`qeOl7#*ET3@&=@re8sXYdR%$bq&2<(-To95{HT1 z1>Lt5#LwK1g%;N|ZrWNKjKjKi)g7YI{`Gp`Rf~MVlXa;{iLssv)qB)0jW-+_my!5s zl=q@->+|9JruC>*94<~ud@&lo@hgxVkHLIl!x-`I`O5cNf+xB1UlI=099gk^*+WsI zOX)oFQ+Fv`>-4%T*SUW45qu)EK3`>JQdjiy(feA0NA3=etKU|8FRt<7gkEEHZdOan zrd8V~yq|^T=F?Z~;u5e?qwBb+Q{M5^>gXusi5bG$acknMa(rWkM^!%N3?F*+i&3K= zcMxF=)___^*He?Y?(X4k7@C6>3sbu^tP0Lu)}wRfA*W$g-lv&k?_0JbYV^ZS`J=n) z*RQ@ds&bVxAQLNuUcG~uzGD|oV|6i}^4H?4*7?d`jj!G8^FI~0aYt0A70$Merfr6(#2aF_C*M}k|I4R>1M<`F$9nAD>GDXfR`t86PNSSDkVU&!tMd1c>xbo1 zheueg%AXVG-O*eZgEGnd@)_oVr zD~2H#xBfP2^ud-wv%h;D|Dx+FxBZd$*pVZwo|jlYfBTi4QQ zC2I9#YLZ@sPp@n!ZMk@V-mM3ie2-vMbxh3ko?X$@rgn*%J}hc#Ol-}`>i$VsLK3o( z{U4jTKQW_IUEQLm){MsTv${S1us5`>Vl>*rmn|)+Up^C+Uod)1%fRUTf=+5BVCLuc zBhnXCI*IT5ruVE5p3Lo1UECAHeP!HqEW|yXi&&1n$Ej{wGBWkjqrIZzb?jlP5WeS9i$P=~Mzx%6wdD{) zl()8{O3~Y8b<&8fcod)(sAGS9ac>XPxc7|CHu&1;?gmd(o=>Fi=X<>^TU$`BXq4WS z+H&IU#)$r6uo_N3SuAbIygjH3zI$6_{K;CZYw z>^>9o`wKkJbZ*$%w13OaxMdf6e$_c~UWcl+J}%VS6Myn*qVI{W#;R+{J*sNr@^16s zq=fhx-D{DQ2^y8~H;+ibpjn}5h^X&JM6>?FN9tZLQLF5VyAiTAN%Ru4?u zq0?nMma_X0=9L-MxbNvux$B3y@bb}4JAX)fS{+c=3S#PG_@}iy@4dMNnMXEfdc6I) zzsBQT&JsaYo;M<<@{cWP2S)E{No(r#hnBSCdmCGwD)fl|$l1>oSjSGr;UYMRszF{+ zEI0%7YHmzYZm7KH^|%0+25QyCy3|MW?#2XHbyr-HIMykSMS*)e)onceRQi%6{XGZNE z>Rc1Ad+ZZ__yXPj$!jKX9Y%OiKVkT_Sim>01H@QW5Apgr7^rgk{_J5a*}V61XXL0T ze=sXB%HuEpDlp1v7&d$;$DLr7iahqdseOOiJIB*I2P0(OC*RfHw+oAO2gXK~*JM?X z^^_ydSf@TYa7A48#xK?ePsjAH=$3@exP7l;| zS$5IT!20rK7hO92+vLE8=w;pGudY?c%tvGh@9;7?lD~;@Bx~3>r*o9ByWQ zgP$Ld{w_k3uv}=3Xe;z5ItI_q-S-~<$URJJYk1i15?J>nJTk06?n^cdK?zMzMXIhp za9`qY#_fTO**C`KWpu6ovN}0#h+3w%pfBzQ0+&CUw+O>sAoY^O)R@*{~2oj2`Y z(-<6uo07o#>=hNeahcjJu-?C-f){$K4q_Y_E9|s*Yan?%23K<;dE!mX*5tIkH%Z(R6{y{Z`yt)epJ+r@)G(KY1t14B;%aY0wh;~N zfO@HY8uhkfySjzJQt??W$~LZ6aUY{x*w*CatVb8=>@@8EdR$cHET{SpLwI|VnN+uD z>ZXdi*UxO4Ti-bDsZ9klC*0Eo=c>f*PF_UXVU+UiRbIjl6kLSw=pa8}oC|JJ~o9@}>&N^Hz8R$rlC+5=_Nx=y;^1Wk@3~ zy1tJN>ME&e2-Y7>zOa67T|q)!ZOv2b>t1u}3N8o~bgwRmUo$w6+EzaO8~+hoVmxAcY%a>w2&)0CBsL(AnD;V_x$HFY2FHzi&k2>a}@8H>3(BEm4DZ z@q_`Z13f%>2afA{-oR@^RnKV;WXX7~hP6(C7W}R(=gAUFPb)hr-9=mT-u~<8^Euq& ze7YgY#1CM7*_v+~8Uy1zKt-o?A`)*w{!JE{ZrP7ZF9`(qr)oX+_2#hI9s6d+sWxQZg*o`bECRN*XPB& zjb8M_m>BPQpVoN1m*OmO^Am$_Z>WA^{@MfjR$iV9ER@TI4O~lD`K%r$RQ6VDsiq!U zGGhR6G{mcN zNPLPnC9K+Ih>VKrq;J_fh1N6vMMxf6msg*Kb^ZLt9Oj^XU~p4buW=PJ9^nS?>vNWI zg!AsO0#lyHU|eMgUZc21J~4Q#F0NqI(U_RXWyXP}f?3gJmY^!4Lvv$jWW#yry=YjQ zntG_lGh=(lxwv`h>Wpouk4H3hVrq&OWNjFM^uq@R8MZ&w2*cM zIFEVxSfqKw85mIcLy4lm6Pq{upiHWz$~!vSdS7VDviV7m`-n;#XZ)jyA4pHFKUyL8 zdfqN;PA)&HuM(a-PsKz6tKvz6 zPN3-O>Y_}&Y%$kI9~j&Gd@h;1JRW1@xJKr! z5;0Ed4#^aZQ9L1fS8iLLd;oo=va`dbzVn-sw>5fIve1~$WYNc-tO_Noo|58er#oAr zXB*~<66JeO)Y$v3&is)#X-va4FQjDQ4%fA8F|SdI^?I&eWpzT->??{8DRBS9`jaU*j8c z>(M~pI4sXyTvpc@=Z#9^GnAL;GWK{lfNR&e!L5n;>~!V7jiV07(L-KnR65R(2{D0w zWvg0RmTmVeIUSgQ%b0yDu7(zLUSgVwA9%L5I<4RmRgH2_zH%m#w zC??(+6(Iua`!FKF>@%IDnFR;ec$RmGRI*Ndij=GU+-Yq~3(gO>CEpW8E4CArgZsw^v&<>{$ukpBex3i5clI5fU^4D~6Z50d600|!T3b`!Wy({&O_q7#T&J{YTAhZ6Wr*m~M`s1N+BJF?!zAuqPo z-j%HD)jYTVbMiCuKVDl9|MDd(qb@CKShc$@KJo4yEAQz1c$cG1^+VVFzgXg0K6n_^ z`rSeM1<0HA>)bwTEz;1N(PlZ`LE#nhriEWIH7oFi)%hl2c$vrus^*o$@N2y0HBU>~ ze47_qmCrgB(Rz4!LYJm`JJMc^F`}l)M`$ra%ZfP`^2NMmYKkW8P@5x&qaA2-B$QH{ zBZw0&PWezGyqKc(ihFn&MfYl-=TJAVw1-w*gfnfD47olHhh`MXO2R(%W@*Uz2*+;b z7bm`3ZpjU;qR7=`xsIz{^L%+Wl%(}Bi!%}HyWmIZ3(aHY_q z!a>d`tGDKG+KI3lD3-`9ns-;f`M%i&TymC}v7o1^lQ0 zi$|lNeCk6iM}J(4O2lwr3cPfdNKh-%|~>VkP#@H4z#=e+)E8Ck5rIx5SDt~B#5C%KjL%DjBg;!~fMVFmBZ zMXl;Ig3h#(qJlDqD;nDwiM05$RZ@AXZCDLUR<*`g#>HGD*_0nDku5}3;n|{_cwAo= zA6D=yWy^SIq1uq$a5KPL@zWNRurEvT@`Gnpm~F;NOTm|lWu>PNl+P#&`(G7};PD6f!i)s|t`?pM zJKga{|EFEdQSJZtuHTQj(&zlSCeYqhE`Nqfdi!v!JKk7)%XOUVHJQNpbuN3HQ`!U` z-|hPSk?VJFdAaH>lv{Uv0q`HL@{4tq&;6o57wLA#8~KSY{X1Oc^@JSf{7l{PhWsTi z|L=7D4!V9b9TS)z&ZBPvf8%VS!fmQPdOGv0F396tL&OCBo*?yeiSqvv=Vkf*0*-Ml z(05$^Z*%>Qb=BuevCpYxy5ptP%U#Dg|1!f3*t%o(9?qp^0{!9qj|_jp)*Z7qnYD$r zy}?eI%ifi){Bv$26KLPN?pRgh8&~?zi+vyB#>?8b9(k#bsva6epcyjj z5wD^-9vRAbm~u`l$8p{xgFVM_4?l=NV3SD@zxk~MnYJ$xrfr`vZQmqJor%Is=T>1R zQ6Nlvg~Cje!T48VycBY^rW3Pl#ke8DO;t#@7Y?MC@d5}Da(r`chBji>1O`VfcYLd zZL&Q0jVyUQc)svNFt3G-4^_f!Uuw-D@!^jmp9J|wmcCji2s$N@b3SO=DFt82ej;(N zwb(DrG9M+(GS9bk?hu|2`F+Amz}tk&!MwgU_WvZj6!O=EbHGQ0gWyxbE5T=kflg=m zXzX;i_!5g#Egmdfg}B3o9|n)MbaI8+4{jA+2cBu^%n{xI`9k4(@V&y+UoKn=-YdKr zd|0>__@ppUuepQYTfiOBVNAZd3O^5dUt#vSp~8OfaADdUBMfxL3ul7!EuBJ3=T6~l z=*$*o`7aS(1g;dO{c2&LQzOi{j|wv`1IGadWJ&S0Xv;BVHW&miHqT&%dQ6t1jBi*N3bC0va*N5(DMeY72tNugCCl~je33r~`4Y0Ut8%imtEHmz z7IapUFT@{&Dr~er3G#=9%Tczh{si98AgHznhMT(Wfm!xGY}8>L%@&3!y|$plWm?o> zJ**aH75rY9MY>x!1^YLJv2)%PrjLIW&c^;DVeIsL;IL2MPmA1#eKFf4|KPht7d2E!np9|((4W_L62(xYrg{OekT6?fl2(GmB zR|>P99~CYE^LY?$mV&vSin0H)@KVT|goEJMg<0NQmxB7K;J*rw2dncYq!{;KAD!>aKjV%F;=*~}tv2%VV%zWG-%zUtJsL!wh8#xtwbsq<&@3kVQ?^}fF zd!sORdi`|hvpn{TJQMr(g|X9f+ltO-BKKi`LYU=uS{OU$2Vp<g*^^WA@#dXeW;s$RhKMb!%!uIf4J z!K{~SuqBB8kA>;iNMZVQt1$hVBh2z#EbPPneqs9fh%kNJAdH<}+Z1WB?ik!<)dBs6 z{s#`UkH8GZsj?aDj#sDe85bf zk6IGIEFbzxX8Jr8ky$3HJ%gG4Eh1<7sy##Q1J4pUc6vT}$mt7%JMRy`w>EjdUhAs7 zHlzH9%pc;%lq;+>GsgNCf!5OY12M&FbZRs zDsvVBf)AT#3`xcu=p;iY6~CD-=f+xTF>bCPezS6_4hw%GjbyDn2&NcUh&|2Czvk~bKZyFsZjY)6FP^c;G7qJvFQKyWW{)W zLrodZiIeA>If&a#a;x923cq?4nr68D#?WpQQ(vLN48MDG)_xRzLrmU-Yd>w7HxUy| z&MPjMRTP?Gcxq80=Wd*aNs#qq!^Ri1r)dRup;AJ%8KD+r(!(}|qf=9_nnjun_grqa z8_{x(O?2wa`R++|T`#?v2=ra%+dbQ4x@?N(?Z0-WtEI}>C$yz!p?0dLinZNf^U_mD zwm*d|-Nj6koVZ@8s@KHM+7xt=nWoDzO7$uALYmZ4`?EoxHL~&D?#%94Y5$L=wLNQo zBF}Kk!MXixM2r)0(plA%XNAibJg+H-Z>_Trf~6dK^<#WcPIhiT~NOrKeDj&cpXLVC6-a?j=7 zKV+nhuex{e45i*r3^kNcX0(Fp@`Xiu2@|b())sDR-Mq9Hn!Wd2xj09}cB)jjfPXr% zcA~W@q*gNsxB9`pW~SS3b3mKN%ZGEyTF)MAzkhEMQ@v2l!plCX2FBT~V{z!^v2#pM zJWbClZ07GZ_UWmdCyPo-=HSfLc7EZrR;lzd^+I^7sfN#0rR_!xyA=LRp}k3p!@9^{ zgf~P@cK^xQg{O7Z|GU8Dy$V12kzUW;{PqZNemF87YpTHeB|GrGgrNWmZatqmqW>5@ zKAR`|<=8@mhfk3abg+qO3eH{x3mF$>2~r6GG<%h9%1io)Rgf+o-g!$+?2^QK{bLga(? zm`Ccd{J4IhZ7&;%r9*ClvA59W-P~=i9cu`LJidH)!nTxa^f9(Os}Z zd%QO`_SPbAw!PzUn)kyd7<>N)J+fa8_y_CfEVRex9>(4jm%Y=l$LHcE7<)f+*~^DL zmJ99iag(w4E!g%iAB9^3nF+=opDmF6av%tM^AVBu_&Ctm+XJ@keF1xXpV9y~D7_XN@Kp|CYGymEu`j zJ(TEQGB)EM->rb#p>eVXjR{>n6pX!pfgaf}N0RW+X%U$AF2`o<{nTY|7wr8~;&5l| zjd$6rg1x0UPJ4YskNx*z^e@}L5eX<~$W1Wz5}`--%Yg(u_~o-O+Utjn$7t{4*w*&O z!`Kawn_%o6hMsM2yk)OHl#RX4uKccpy)W*v818kX%AgFWbXdMi*z zCQy$X>ymq8FVz>$6T~WA?mvVQ^?1%;DE8_9tE(UQ!(-eA$@$30_xTLzJ#`qWa6Y%^ j936q{I{J{Mj%r)PS;&X+jlXG+?+MZlhC<~Z&!7JThNaJe diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedcrypto.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedcrypto.a index 6dca7f91a0f58ba735fc22f76df365237f840db5..024bf3e58733a20817bcf964d971f7295c165bc6 100644 GIT binary patch literal 909936 zcmeFa2Urx>`}aLdFROxLZ;QRVV8fPx1$#rqE-bJVrK}4mSOFVgL(~XXK%>~PBw|az z7z4&`iZzy~QDed0<@w%Ic4uZ6li&0Iz1QCFFlZ)wLU{#$#$ zV~j%B$2MRT|2OZaA2N#nL%W5oj`_#k>o8;SpY9V27>ly@R25_KZ}!|CjKzO*zk8Ok z;CIW_!x*!Bj*hV`Yd`;xvHVZ=H&+?U|I%*Ny$kan@8N40tN(PL8^>7v@9sOS7_0we zf1SZt{a?0QXXG)qU&NHXj~L9@3VT)&WBYIRO9hOru;1Rt*!~B*o%JxL%)Lev#!kMs zEMe^a+q-rou?i<6{i+8^)#$LXs6fyR~ zzPblvFW>VS#$MPTq%rog-NCv)W3rbEXB?bAvo{^dIQ;+n|EJo(ab*|gU+v!}FpmFb z|Gfd@c=;FOem$RY{D)o1_%o8degdO3w||+-D9hT%+-8*WJ^C1<{M^3MiBbNid!8qw z{7?4dZy4o2?QgRf<^N0fa`B;z$-dNyDM$Mn#0mTMIHsJiA1h(X3H#5whyZO+On9`P zMjP!H78w@9hz-GdtyW@)i!qamj3z0gwJ{U5@qXIKK#2q19Hf<+$we7CL{Z{gVUaOf zeWWIwEjZ4ikJlN?E{Q}gNhH;jwfJcR10;pxtbqa2vT;@v!(7_n05^9J^AYCEQNd=< z7^9cCh}MP&`^9LZjTO@9!!%|aNMskc4x8RgB`LYIm&qdSJhGT+36WV=X;F;0B4jpG zljuk{zYuMVU${2XSZTo+qX{uJ21G@Ln_AJwrbcaKY=o&bLKkLg3&BV)pX!?b!oZJcb#l%3X` zPt$S80yb#}G9$e)%G4+I=RrjG@nE z<%ZN}lSBo^U|5023RflQ$5hGiQ^ZgE~x}jvCw~9XdvyP8)|# zfIT`YSlZ)4L~JC@1xb5^1j0{LP*~(-zo;N1KH=IAQIe#=Vd3F^dQD_dl<~Ss>CBkO z9hF4xQm|_$Ya>x5${Hdq51&GEV)L^1K2?&GHJX_iygfu485E|8^oxn|3yl(8 z2B{isl327e#-vHpvXS78j5VyeEVLLSO&GvNv145}{*4g<(sp4ZxRGuy3qJ?UH}eCqfTGEJet{KyAk-GcA~qzpO$L2INzjJ#k>D zHgKZfRINVB>=?s<Z2k)6J5p>4}@L}50~Er7_5?uoxy76#!Mb3zV|T1 zncjcMqQrMv@+j#&hCEhupJ9kHB}QN%!!tEDWWm>j6ZKN&9ivUdeprGIC5e7a>`M z;#-34abaYLZ%@VX{QQ>OzVh)wS}J}_SX87*57E7qUwBm1#8@4;g4;!TBSy#SbW!>k zaf{#rtBrs%HYOD;XgqyPn8tWD4`gE^q9)Vbzesv=_COt`sZlu?jZwkDlKzZgFMqg$ zktFAvGC~t*f?`pW`OXfcT;@BKjWRo+D8^7}c7c$*==8yU;^jRyznMuGqxTEa2ZYGL zBv_@>La?G0;9naQ7D&B^+oNbK(P*&VWGF_UI4RaJ^tj8UOOW{lkx{f(Rc18R8jB8) zAzD3Vw5bnyV+tqdGMc6*ccxZOV);$M$_w3EmX*NNZrZ9r@&#!!NZJyHHqtg{E%G#e zv<}TSH&#Vsj5q4!kD|C4OCgN$vJ*_vYK(XNlou|M$xs!eNwVlIGK)nL%x%bnJDnE* z5W6u(n9I?otQ>5FEQgteZYq%J@-AB*Q^6)Oi^UrGFwM^;UdK$|?qN@(2=DfrPgolZm+Tg|19;gWid+_8y zbnziS(!m7-N&wCxN>XUk#?b}_h57~JHZ&;8kdn3G_S8=&EdZA`Dnb_vWr;OeU_zdU z>ZrrorqnKJebx(FL(~$iNm2#YVy-FK2y<=EMo_QH+FsG7fw|mx77!L3|Czj80&zE>l$<)C!f0Y* zaqC$2sbwi;e%My~H*TZ}WnM7C#Gv9T#wtUYb(%2aI)M-+dg{lSWCLr0jwYX3qil3> zDdnTkVD-~Q(c(*Rls-aZRC(G!E&)qsQDrzQTUShQ+%H8%8ZVbZCay)xju&N*nIfKx zoOf|{bMZkK5YRj_G)Pa*OHAqrf*of#A`Y zgdXuqXknU!7XC%$#py9=B=-(fCa%L|T~9>?apfaIM@>Kj%rt`Uck%OOuEyj>HinFD zOd=#J??wkEX1XZQI*X)!VbP{Gu3TaXY^*dl$)wL*jIrFn;a009r{P?(na#vf$FOm1 zGD${?;=G!VW3x#wbyOUKN4`(Q*9b0_b84EC7Uj&N3ZsQxtHQIV$PRy{%!87sQ&5Mo0#F<8Ga7E?G$tVj_HX-&%?8Ws|Y zTb{|=i_=9LpOS<}MB%k39zT*XD2b7rii-)0pxG^C6%SP|o}2w;#}ifn zW87UB;YWHqD2x`f4b|nG$rLVC$b6X%c3Fv`JU&xiG!M%v!Kt)1(SEYiN6;dM*_BN; zMzku4V@W}992hQEj4)u-iEfX`Af4v0$ObdKaC`LjuMnECS}H1FpWeHS&&LnD%0tSY_vx7m|aK`sKqjFa9AKa_oJ{H5++*P7ZTx)lYQw7%RI)_5?Q37T?IRR z24JC$%WD#?n@BEA%zUmgVzq&E4^&pBGGaM1olSJZBP-=+(+F$tW{QiU{+U{cNFba~ zJ~srrZen1xo4cPb0FMsMoCmKl;y#mBza?)dQf~Ify^MIBRwic1z} zhMvtxVsIr2&_=tG@GCi!dLTRUxP&s| zh!Tjzn@%vtXf^tvs42#NqlF)O!bopeNKb{g3EbMKWom_<U&&H-85K(p!_o=k}O#**L_NyOUN$IhA6drVAsQ5+2#^9L= z*U8dMWv1muqA0O(!cf(WCo;WDp-jexFg-(9Bo)SZ0`{I?C@L4p4l(k>UW!mT)(dqw zUNEHv9ExKPxl5_xkRNS^V}6twj`?el;W&_cnq>4x20U028Q6Ox%0T!1#UQ8(8T#g>7v<8 z(pZ`e;#gyAuovvu2tz(`J>_x6Tr9oV^B8T^_~BaI_fz4FX5$bLyEZxyTO}^U5u6j@ zJ7u4*y*QPz7~;B!Q;5$}RvM!huGr%I#yCUa%}1M7L40ac$KqJCuEhzAjm+P52rmN} zCzfzKV&DO9;D;11vZ-nL2&|54^#pb-DvQkUD6@#BE1y*~EqRNeC`FFMV_8GrD-fq) z4P~Vel~tThZZ=eaeW``51Do8~SnMHHNS1<3c&&haOOr~>rsJwfuV~6l#$!>v*(_Wa zvGMGsj2`;2Vo(G|Sp<#2K#filNUxC4iDdCqw9m!!*RFtgy3=7>I~L!jiD2EZkJ>Rq z_4uA99w+0iFHJ1&pUj+v_d@3mWb^++B2uNFbz?3TRe|s_la0Hm8LJ>`0xp^W7XoQn zW`5){L~25?>K%c_UVLqUzBOh9z05Zq8WOYFDTAriFt+%&!KoAm8zq-q^d&K(29?-_ zHWV8T>WuvJ7k=Z#p3^MseYGe)2!jkSbF$CYX*B8Z)g`=>juk&eJ)LGG`%MJ zc|Vlqb3Sz1fA&FXKIem{N^~r~Hpr%9Yipd??4fad35UkEKo=SF(VQ}r+L%@-gTbPY z!t0OJf~o8ZA_N?oL`Y$85-laXNi@}- z8{)~k{!t0TbyNApZ8F90|?`Y z`bxCGK$DI0&0pJu5{u3%tBWYc^h(b=GuN}yBC^AWT^2WY^TN+;S`5}<4$%lB)bKZ6 z?BfC|hAf%+I}TYQ^2KA3d>ZlB#2}JItB7*`mIV)Re{zeSfKG8}cTVh)B5s4^Cc4}9{bpS08Wc(KTRo0Q^u5H*EzX|q4LQp%4J-FkW`&gn4dEgQ`Uqqb8jlHvM5@(OwlmI zyHV^i63Zz(M`3OBO#`egVJVFUIj!JuN|jyI!8(V`Ovs`4+DP{pqF7JV#IzcRRhx;@ znAk|YHU!V)KuLOT!KRkku&jlZNxV%Iqm5(Z4eMQ0Dq09)S8b`pk{FPe-mwSEIV}*S z*Rlog(}Tm0gTCEGP&2MbcT1l#Dj?8+t(cmK{ZLoR#>YH}SA^BC#PUzV8sF(L(dc{?HJ4 z;iB2cMt+ms+L=wm#g?6$buRE%TratEb7?r|=3tL;rj&(IKf77 zOf{0cBTNSK6CJNp#Nvxp7#CP6mYm%fLnDTrVv&&8=F-Tgqv5*5F6>C%8sfy6@J6|t z!7&|}DJ{(I?b?e|;joN!?rqISv~zP8JHVm&bZtD$IY9GA)0f$3I^zw60MYY9ag^+( z2Gc0NVDTSS65_du9IR!(Qo*#A|Dk2k-&r;nY~Q{uZ}xWx!1%<AfC;Sy z6K030g)Wo^D=S&Jdq2U3Z%^YNJ;O6txO-5#-!qu-6-|7<4{z>ZAPGjgjbdNsk2baV zMQROa6<&74Il_gM+(R|t9+G{^Bt#h=g~rB&8Pb!k;TEC{$qW{Doz#q3T2G?~yu1~L zGMULCy*rI2;*jDA3pA4!wKrp>n(gf?eO+( zxv}itv4dNCHmSeEte*Y76$%9-Yzk&PV?1J*UhADVrPC%!C|1z-Oks?h1W&H4WuGVtd1e znTjO%5WE}CvB;v)?aGZ_luOSlSm|Oh&z(^g&r>kU``!$r+@iE-S}oJg^J}jK`A038 z^OlN)Yt99yROc-%m}}0rEG-irE6)C*f~DB8-yz4X{o43W_?TY&CcCsWD>Ey@KFgj- zFLJrpL}`IKXQ}XG+|i9521>>oLDe1*3RIs*%_o-5w z{$od-uwp{X>1v{>B@xtWu|U@1Ip*O0KDIl)My<5=x!P@FtdxW7wmt zPh84`QU&5JRex4o@}@$`NA=sL`r;RHwshu>Y@4%xQ!S}qQhg(ORq(WteS3*iw z!7}Gn$r(*D8)bN8w$JFD>76k$(>JN;O}FFK?$)=kQ8DqZO`X%TN--=k0t*@DTxsde z(o$u;k5=O>LtQ7t#o4Cya_ZZ+n-!DSBdfQS&ciFMjZ>#i?v_kJn=B7Y&+clS`lVnx zOD1&>wGQ1i6(je?lq?K`81;lf@mBqUgTLK1VbFxQq@Qj$wi{7z?Sw%HHF3_c%e2a< zmg#~*Hc0kJX`551^u9lkPImat?ujeE$O=;;Vn!3K1X~J8w zVa(2Ohn5cF*^D_aR!7_$*VaJ$pVbW>sZ!&!p$raNr?Q$&b6Sg|1 zty1M!Ixt(E_gFe698zR$Q^BH2&dTkbwo0AbWQ(TABgfKmkEO+VOXilP;+dswfTfL( zrByde>&(Q=-Fi!9x@Eb9OlMuDN^e;n^V;3ALP8sbE?SkgQWZBcZKXPMQf6Voa_7OB zDkj(&L(#ufm9}1$HddXm&iO2ihny3(D)P3{d2=;s6V&NN)sig|5?$+Ml@^wk-rDfN ztF-iKX(@X6ZW9ZesZ7n>VrLKMEgIEaCv|dGvR!WVtYq~O>yeY<5_OxrZftehx-r)Q zrolVegI(-_|E3ibvx7ZI8Io(i#Vh5eYCi9wDJ2)@^%v*OGv+N)7e6g_Gn~02^7)JN z<%#p@jQNt)DXvKxC)IW*_13IhhoZ28t?Gp1UN=rUoj6vc#DVI#llo*K1$5NOnqHl5Cfdism+S$Vhdr1^{&2s%)}3 z-{N?3sYhawGsdz(oR@G+3LsuxqJF6YiMxWtOdDr)2eoJK*uK}!mtzvHDb8L{Un*34zVuLZ>t0?L z=cVsnF1@=lAvrdwyJJ?u%cSlOH{L8QUZz7VWDWszL#^Rz^_3$&cnq-h12iRqgNXmDj_m?||M`IJhy8J?PFJ4EA0@F@tc> z7t<;&m&^OeqNTDZvS6zk9eUg=j|bgWb=r?kDgx(7ufbsDWUo9Pk0;gsGueY^u=1oj z&Q&*g1;x!0&`Bu78zb?+tr@Oy#`eHXxX(~ z#t>s6Pg%4qpRm{~&j8TeNm-i=?L1Ol@2JW#Q`ux?zQw%Rr5By=Y0e4+v_OY}WX8_A zu~XFH#?D@AiG(T6DTQav3>A)KlA&_LczO?Y$8%>F^ZcU$f{P-Z&%i%A;0BmzaOA4D z+&s%uv&g+5S$*R;+p)#y2)H=S9#F4fz#dArqz{YQTz1qDV+lr+B3#o}JBQ%J(5RZXlkJhj-%& z$_OTMGfJH$a?(@XXX)8g-bFydd$n5X;EWo?6=y%J_7`Pepiap?i@_6#`-%*`f2KMs z*Xt}AYiEuF19g_QMXmOKDI|b?@}HpAdBk>le5*WzJGC2k)%SP%`vaH(-OD3qjtH1} zEHDdLU_R?^=g9(dFb7Om9+++fOfMdoLwI0ncwkNfFmLd{Q~{W!rE*}>eQUK2`BwFI zU9VkIWheut&SMxPgs8PTWi3z6w9jVKTj%V$eta-f<#r|In}j(|RYo#7yZ)HhpK0n< zrM|V&F2xOgQd}2Vx3tZ0TeS%du_}L$Ba^jFy=qTRKc;48@PT`|UXZ*N*DR7 z(Ct`>{-{&Hai>KVzCj;qDX9$BN9f+$rahyy#9@kCExQzF3Me|dCfO*{ZAi5yq^Qzu z$}^eHIW`rbLLot6Nl8qyu}inH7vde*ct>OWq$C@wbQ^0S-iD30HO6a_Y?yQ#g%EGS z##_D%HQNO5eXys{WruZ`=y zf1+A?xHj?fo%3AD-!GJwmVTB^fxK4%H$O1q^$WV3hIm@rKOHNszfumu+C9c$+u5- zOZ_U{p2;cnNZpFQ!CgX5VYSq)>3x}+$-()zjuuwiVUa)Nni6Xmz7yUm?a~pODb0|& zSxBAyG~LxH-;1f~nXn}>N8^;^>WpyOs>F1SbH+^yCMTvmO?HL6Nm$q}*EuWMiNR1- zBqS^?q25!c+(dJrQGA!b^sdAtxjLtugU8Im+^1W1=ifY#ebI}l?U{EXvG^%Iv)FSW zke0!oz%?zI+~VRWa=V&y>-}SCl?!%CyVR9A#U-dG^+@vkWlvD=ZiP*h_W46r)>I5| z;Kt`ZuGjVyR$Fz59il6j-D#9xtJ567sME^y;u6#!=R#9-%1q+AR@zXP?liiJtmcIno_RJ3NNqP1u$?oP6{O1BoKqBT1etwmEY zJIR_!w-%t3yAn96Ly$zGlLEX~cy$`d)I^T_-d%0f8LpE1a z#3g2ER#sDVwRP`VVTMJ`DK&!~dvr|nUH%+*E5c-idPLteb!}p$eAoCO$HqR2D)m_i zIs4vX1~}xpvgdThblYL&*rwTB43l&l8X-x&n3_phO`OQJZ>5jPil%nr=0)d&q4ASG z+B6-KYo&a<`2f#eOQ%dlALk@jmlTcCilv>hD8YR^Nr6rp759I_$UbE-LNqoNJY#=#+|C zoMI(zE`yLSBjD7yjEMik=Jq%3k~XSS6LX3frF9GCq|(wO);Dai7POqTVIl2^b#Y?+ zQrHkzPvcU>hsnnMj4h+rR8m%V&q|;nkd6Pa=0L%x^xsYT?;NfJNt%kTrKJ(p9Sbve zr+GX1Px8u|@7&1)qo+zW#ZgzM5iW|N?A)hEER$R-VTk%@N_{k+d^8_@G#}U^`0i7n zWNZod6fvhPlW!tbSBK zw1_!kg-eD7-1xS!a-8D(*GD!2zG^AGN=x^+I^VFu^~8b-*;|o~nz3c88SGJ*vAa=l zTbom*LfFmbM5)JaN|?+T5(=j?tkJc!tX+aO51mDQG(mS$?`zo+!yxupz~xf`K$ zO~qQ)n$ps>wtXh0WGD1-!j&n_)hjEBZ!tSX(bFktFiq|`p~3W;_j=7cz2>c6^G2_E zq1U|BYhLL!ul1S_dd)|@=96Ai$~EL1^9{NCxOLgB*!@{SI@^j)^;|0g*h#K0(p^8K zYw-We9M_LI8vOrikL#yB8vOtIsB7s_&Fdr$5+Djj?#$Fj8*Zc~o~KWAz%A;4Q`R5L zV^I=aVENFoo^Qo>#xB_7>ePD@dcdR5H|{Bf6oA&D4{UidHFPMKp@4q}&ztHUcm0Ug>Yp#>fX}e2H1?z-fY`SMf%ri~pw+g{6qBor6I~E;`jzy(_51OHR z*Gj%aPaEAIu}YqV2;b2zRK<%tLp%x_`6z7^=<7y44mIm}A1>wCqBPfkTw8S$+R9hl zR+tskR@VR6R)haVTfqz8R&9>@Zd9OB6Y`BU;TmcP!(iqJR#96~>XC*Pa%5ZRsOc2I z*u)GFT59hh!BcPK9fHrq%ve%t{41u z(>UX~L4f9Y0fyJj)XW@vz*dx?#3%^p6c$L34ndHq$jek^WvbFOPcqJ>rkGByJ(yg= zbA+6Y>aE$C4xgW)IUCz@i9R>Yb2fT#iR7$E0xN{MoW8Nks--FRLPrZ%sG>r{*oj`3 zynBF6OKUW2vRg)W+K8ml`IzhTvqJ6I&Sq!pDI0D$={1$(4fD!4W)AbSYdbf)80hei z^e_h8oSmVx>`>7feahVjXG|Jx7^HZrYtQ)hC3<2WMp#w3$B&_IuFj2yRrFRcY@kBT z9^NxcJ)YVO;zyFcaM%vpBbFl*Pg#d91)fK5#;vb40?KOq)tzOk0b?moTi6MsESpJL zN~0{XW8nbH7O0jJKe+4^`MZ+~L9={KZZZP+WnaBU~o&_-D6 zwLJduqr0oqyf+`A?-bZAuv=lb!|sG#h20Z-0`{8N+hY%$K4sdoiBUhQ6(P+({l0DT ziKOBg??&}1+3`!xt~DF=1^YiPYt;VB*C*S4edp<^bv zvG%iD)TkLbI?Jc?Z+n~m*?P{vhuvc){QOvM-}@LZC<*5l>jZ!fz#l|DazN?GZl-^w0Uk8PgWHE3M*X#d1PSL-!POZI-8@AAiZ z$16A7J2~{RX)yNah3x@LSKN;OtEfZ7qF)DY3HN>RKs$A(-NCqqt!i!Bcl_S9n7aLr zEJ)RT@l9}V%U9(!?M57!S6F-9%{Lj&VV4#!UtMSZ{nNvnTwj=-Qttb^-9o)GTUN*$ zcBsmb7n=vq^wJKkQFY@Fof?n-s`IvqKi6H`^Xc|?Be(VY({hVN5iR`bpA`_iA=J}Vg*b}L(Z`Nb(4>+gO& z*EXQ;u}z;++qN3IHs|^9EbG*p?i*kI9qTyzVMkB@CtJr)T5oeC(rL&SuBmUox@Ob$ z+85S42i!g4y>!^3ZzdfZXKiKkOO*fM%B9sa-Z%K|$o-Wmp50G|Tv|6J?_RefwkZpe z|EfO5BfjYImF(#by{31oaR1GmI>i`{jD5nq+3w9B^{(Tr+a5kzKk#Gu()ShSdiZwT z`D>l_Eju=LsBkGLbnGVA)nkU8YtX(`C#6Hk?qwtXs<7|zSLbW4Ub-%!;KxCltE!yQ zQ~HI~s#v4Stz`!t3bLBr=~C}T_lh;E)-G>f&hgoTpLVqTHur!_oh?Npo>rf`E7rFE z_*&6u{aF3W!##pK|2XFT%(e@DTRNYZN9fk_!ixP zOy}jj-}Sm5R4@0#!edz_U)J!Q(c)sgHfc}h_Zj%pC69B33s2;H%J{{x{ic_RXTF~L zN0ZC@7dQHH$M+jsbXt3Ra9n!134SM651Z*7@M=+|qiGlO@3rdqdVJCkyI!szm+)QK z*=5tCer>tsOv8$Mi?(NWcB(dG^Sw2Jkykn&ns%yDoPFe|YA+tH+OL>BXjSgr6_MJl zrFUn#9zJ9Dr1HJH2me}qsc%&K(+}3$|I##X`fqL<_v~u+Wqr5fUoTg;%Ly)s8F;wE zholpmZls;fYqR-c<)>B|eZ3xDem(2d;PO?MzG^*rz;BDXKgk<#a_fL$x4*KwzV6&N zfA*h{T(hu6-F$EDkXdWTKd@3PY&Y)R{FvzXj$WYZZ2pLDg8_h{0Kg9bz*hjk&j7$v0AL#c zunYhg4gkCY0G0v(4FP};0Ko46Kmq`;1OVs*0E7Sl834dd0KftOs0aXT0052y0Dl1h zD*%AM0f5T@KuZAN0szny0O$b#OaK7l0Dy@Az%>BiTL7Rc01ylS>;nL*0RTw=fIk4x z69BjY0L%dZY5@St0f3PJKy?6MJ^-*E0H_ZD+yVeb007MZ09ydS5&&2Q0DKJqJOcps z000L8fUy8Ta{wS604MrT_p(0Dxowzykod0s!;^0PX_- z#Q*@!|JeXQZvbFB05A{$cn<*h0swUYfW`no5CGr`0GtB=IspK?0e}hsz^#H(O0N_Ue zpe+C}834En0E7YnfdIe>0Kf?V@B{!<0Kg0Y;0*xa3;;v`0Q~@f=K#P%0N^YD5Doxj z0s!v-fO-JHF#wc0H6r~&;Zrm0DuAj$OQnj0KiND zzzzVo3jkaK08Rq{zW@Ng0RX!I0506qXf8vvjZ0I(1Mmh7zF@)2>`?c0N(=u4*-BM0DubsFb@Do1OUDO09pV5egJ?T z08jz|3jhEw0ALaT@CN{}1^`F{05kxA4giP&0J;GHn*jhV0I(4N7!LqU1OR#h03!ha zO90><01yEHOa=h@0|37R06zl&Jph0W0KjMfpe6uN9sno+0Ac}v5&&Q&0Pq$7@B;wW z002_~fKdRzYyiL&00;vBiU5EV03aR!_yPc!1ON;I0CoTX+W~-106<>=zzqOs0|3kd z0Hy!{I{|a9+2LN;f02TlMV*r510DuDkPyqm_ z0|3zcp9cUu0swRXfF1xS1pqt%fL{TCjsUJ3INOn0O|n%&Hz9I0H7-X;0^#}0|2c705t&M0|5L908{}0 z4gdhX0e~O?U?BkTB>>O@07wG>1_A)*0Dv3-z!3mQ1OWa302TuP-va<^0f2M>;3NRx z4FFUE0P+EV*8spS03ZPXSOx&J1OO@m0GR;53;-Yy05}8y!~p=+0D%1fz$ySB5&*ah z0Gt5;?g0R+0f6=ZfIR>(9RSz^0MrKnmIDC60Kj1Y-~<40767;i0Av6FmjQsm0Kh8% z;5Psu4*(bd09XM4-v9u~06<*;U|Cf;egCPHZg#2#=`Tq^%{~wV54I%$~LjI3~{Qm*+KN0eO z5#;|w$bU=7|H_d6-$VYdfc*aj@_!`ce;>&I#gPB8kpC|r|1%-~8$Apbu>{=bF%*FpX-f&5<%`R@byzYX$V5BdKma z{~pNy){y`6Apb8w{;MJX>qGuqK>k01{7;4a-wgTx9P)o4cegW|05KA^+P!{>MQ6e}MeI0r}qs^8YF1zZc~HEXe<= zkpGh*|GPu}pM?Cs4f($g^1naie<9?*H{}0X$bSXo|2xS4_mKa4A^+1M|L;ToM?n6s zg8c6Q`9BKs|8L0u(~$rBA^&ee{!fMcUjz9+9P+;!i=$ki;(|8kpI&l|9^%2?+y8X_IP06*Kejz zpYwRil+0JtrY$Oc_N?4*6DJ<|BPwe5(jR{u=C4){wooW6PltqT@onCG#$TU4RsZJq z-vb70+jjTilf$l+-dvv=~KH~lO`?OcJX3#fScRUW|b>{X=i1n zT=COSKHl}~YuEnp!+3SIYE3$P^;NcmwRMHot5$te-qzN>LB)#gYbGSDzJBXg*HeH0 z-DqIr#$mJe>^b!yHg;?p!F%-NHwYT6n5d z{(pY>P&a<}?xJtUjCu6SgbCj*`uS(?kng^`r0>|V-}1hF|H$ay|ChXxBk#>UbEfa1 zvu7v%_~c2mL0h-pdG!8$m3iH}|F~+vfZv1Lv>EO^ckc4ko;}apfBV+S%EH3t)2vyE zS%U|c#C7S?qv87X2m9sb{+Tmm$n$XTy1SbN8nE0eF>xY0St-Q72)Q>TG04i0tF`}Db@w6SsM-Jn5u{@Ag% z*B?DP?#P7;k=?g%e{w7!U{lAXOLN^;tk`(r_U#VO;^PT*QH ze#N3i3wQteYtWj31JC!_vgO9b@bG=xeSP0OfAPZh%!3CFPiVEfUQC_3xYy2|_nqwQ zszn_<_-jdATyo!r4Wq`kYNhw6Rja{>O`D!Z@7wp&%Hzj}{Cw|T{p@Skrr(Q+S@T8R zx~^aK>vv6a3l_|)keWL8hEA6@{fjTUP5S1WV<&@yx2E;(ebL6!()#tQSBhHY z%U3+A(QKH|uASe`5hLD)9XN2d>b!YNGYbnxcB);wapQIC4qUo<)8p?qZz?s<$k{C(_YLqKiRr~$-mw&%|*KJO>ZpY7thUO=EdHv8dGc#{=%a&8> zRH)!QEidoq++o8$L>xNwTZ<}HI(-cQ%mDy00f0pSKsf;52mr7f02l@U3Nz#sr%ECBEV0B8#U*Z}~`0Dx!!U?>3a zB>SOEan z0f0gPAQk`!1OU_kKn(z(JOB^@0Q3g{TmXP}06=R1;3fc&0|1-^06GEyBLIMB06-D| z&N1povC05buAZ2-V*0N?}w&=df;0049W0OA3F zTL3_90AMlz&=~;m1po#D0CfO>D*%8401yrU+y(%~0RWKzz!Lyq69AA40Bi&RIsgC* z004IYpgRCC3INy-04xLmf&hT?0Kg3ZU>^YR4gjzP02%@Sy8wX20Kk0!pc(-1D*%uT z07L-*dH|pS0Pqw5_z3_Q0szzp0Hy-~YXAUO0N@$`a1{WU2LQ|k0MY<}ZUDeB0AMQs za1j8o1^^TQKt%vx0|4L$0K5eN&H?~S0f3PJKw|*l007_t08|11_5uKH0DwaPfDQmi z0RT1w0N(-t^#Fi$06+x*^Z@`$0f0CFU@8Ex1ORvg03-kaRRMs@0Dv0+a2x>02LOHm z0P+BUDFA>o0Pr&a@Bsk$4FKo_00aU6(*b}f0KhZ=;28ig5deq+0Dc4j)Bu1200;p9 zngalz0D#{CfNcQ4WB}j<0FVR#6axS=0DyM@z$gHq7XVNK0PFw&egOb-0DxTpz#0Hx zBLJWW015zr{Q$s60ALva&V`Tqz2 zPyqlR0D#>9z!(5v0s!zc0Pr0E&=COW3jp*707e1;X8?e+0KgLfU@HLd9suYL01N;C z+5iA^0f3$Wz*_*o0sxo=01O5Ix&Q#{0f1ZpU0G0p%=>Wi50KfwPcnJU; z1^~VV04@Unt^j}&08k15JO=>I0|2K003`rW2>^Hq0Qdm_D*=EW06K04xFkegyyq0svb8fN%i77XWwx06YKyv;e?V0AMEoUE>!2mq)806_j9hx~s7`TrR5{}tqaDdhiekpF)`{x606_lNwq zfc!rV`R@z){}<%{H<14WApaji{x5<2uM7E~0{QlBY{2vebUkUPm6XgE^cK!nZkpG^L|9?XM$3y;q3;F*G>s#$o~w; z|2)Y5xsd;dApd`a{2v7Q{|NGb9_0Tj$p2u-e`m=5RLKAPkpEVY|DPcLvmpQDApaXe z{`Z6Y&w>0O2l<}>`EL#R|0U$VE9Acp^8YF1e<0-l6v+QwkpJBv|5cFxcOd^iLjHdb z`JV{+Uk&oV5#;|5kpJI7{k;U{9gz8zX9^U2ju@S$p6le|BjIV3nBl1g8ZKd`QHTce>3F&VaWd~kpDX%|F1y) z2SNVFK>oWx{-;C!Dceg3y}ZMApd`b{9ge1 z9|`$?8S-BN`M(?Te+}e+AISfUkpJ5u|DQwtpMm^80r~#|^1m14zZ2wt6y$#iYp*Ms~& z5Ba|Z^4}KnzYXMnOUVB&kpGn-|BE62=R^K)h5R23`TsTKza`}VD9C?%$p0FU|60iZ z-y#3!K>nYF{7-`XZwmQ88uGsmk^;;{(kzO z9g|kKE}h?YarYj_{<#11uxZQPHyy3t^>P0dj@{nM7aU&S9%-Gwx2Mh7 z7Il`K__BgU;jSZ=ib|;yJ1uqg8WeK%!OCZ6PM7Sv8~xSxn0kNhXgBxP+Ya|?#a@r> z^|Z#M+D(5c18vUZ~wcIwzwm-S;uIMzXal%7C z{~@!sRR5-Lxt4dPu3uKX=1JC#&I5Kfdzn}C_n|Jchh}Q3Hn*C2aLR9uZicx84tG_~ zP^r9n4pl`)#b`UJ*uM$cGAvSszaSOP{tXNE&!V+*VAxbGdv@>EvSFK8Rg;F%O*^R= z{PiFPf1Ze;zd5T7a$tmH-Me)cC*$&V_wI(DMK`q%@|O7I6A$xgiPXZ0IOE7+L&e5m z4gP8d&f3Fk!qIatyNqmOxpd~l`+wi){b!wZ4MVCuOK9ck z_ZE(Dv#OM8{b9WQ=ofQR?JhLA5W2YQv`fLicDh)2XzuwP@9s_8ZS|?kQ0*73dwvsj zDtXVzlqDsdzr56Hf6E=JHf{U7x!2`=-=a-DJ7n$M^5v;NPwiM=>&}8kv2{Z>{Jh(9 zcf!J_^EbY@UeM3F-Sly_%0D=EJZk;xXLnB(m5aLebm6wPM@QKgukwlsISou!ZSVS3 zjpn+lwYyGjRVTIfud9=H7u~J!sLs1%#RY!r*KChzF8?_2V#Af5)^*nSJ$%)@$LrjB{*O+o`)ixL8ue3L@Yhb43V+))->UQItG$Yyp+0XaI)$9<_xkI} z!>2r7H?x6FT-A3se((O<>ALPimj+H=`km$Y!K&Qtk(#+p-)3D!9^qZE2K+fb_u(wt z>dCg!Pai+LfA{vy>sK#dJb(7IL>66d>GW6Yj)d-cxO)Bl4G*quN8{L2*?kLE74 zII3;^eR`{7!>Wy+P-R(U$2OiG+n>x{@V;79X-vY7V@;MNJ^by$@{(P1+e{oa^+Sy` z$5wml6!$rwe!aidOh?zDuJgWLS)<<6l+Tr&;(GiKx8^e|S81~I{HATMD<|8Z8Pr97 zzQxgbuP>Jm@+oq9-aH{K{!YM~2j_iSOq?d9^Y8k%Q{@wrzH1)6vt;g!DT#I4wXp51 zvHQJchSLUnm+LQX+m9QxfAik>mYUcNjVd|k3;D|W9AcGiQzcb@DZZT7&y2 z&Ij+yBZ@xURbOA~^<5KrzQQxTbJw^2cYC*Fhx97f zdi726hzxCL`^+)ZGn)QxadcR)Dll9V8KUCiut>}nBEX``;X35~2j-t(ysl?o-7df#}=PH;1%pKu;c*#@23}oYk z|16oxLXiEmWU9)Jt24FicoSX@RWO5?mqL-)OABaYxy4SJ|pK3$I6b!$&Sa%j{RiE{<33@>^MMn z94I>uk{xSh$HB5=d4Gk<;=^Re6J*B|nV$T3q6jDKZTaJh2v=mRnQVT13Gt2j`BI6E zw`X4RC(& z+xVodBJ35J#!LtPd{x=w=FB#pH;pI_(;9QoxKVv-^6|cisK~Toj`Q`q#vXTI0{HR2 zn9bjrsm>qMg`y(!B@@i&r;%Kd>CV*W>(_wI--}r#YoD>Q;|%1ZO=C~_`>|mKKkNy$ zE~55V@WUNR85fZsNqWA$$dM#H-)^kkf&S;dU!dUrKp^`)0|k#)nl&zby=a6`nA}G3 zVJg=Hk-bD@{~7fb(x2nQ!X-n2f?q>g@?KV{@M!Oqr;#}b>ynM=?BA1(+}JZ*|j z+$Wp9GZ$vtp$ivg+kwA4vhBdP58Dp>xY~iFE;O;R?Zr-E^7kztCVvO`F!@`7F-U31 zpB=^*g~=an3ck(R^6+iWmWOY1wmcoVv}}34;KJha?1IUqDrf(O50k%qK1}`&@nQ0} zj>?1d`8o>>}-Ac^Ro5jeNvfRYT`d^bb1O?dTKHXQ$D(~Qke45rr`b5L)e8MJR?P6aT;-% z>rk576w82)T$ti%6MV9Dr-b|_*z4oig}{xi1$GJ>^74#g&-EpngsU$Nd~9reVW%jz ze-Y@6Fx$TfH$s@^gD}q7dFKTKHWhXSKjs@y*c1O@qcRBnqNZ>tS#eFmu7J<(_@v=Q z;ePm}p-*9IOHT?@0&G37E4r~krZ_!#IB%|8+D1z{>K+3}AV!G{~*lZr+5CitXcQMd&@i}`Rhd|u$g zweVR%!KG0n?8=9!EPeSf)oDB*rh0_(VGo33`7o7pDj%kD&f>#e5T3(_dmx;`hpB8! z`EYN9D_C%4pt4ox!=4C#&4;Nxr}!|P_bMNz^WNmcbl$ssxIe;w^Wnh=M_O|Jhanuz zheskD&xh%}FZi%O!teMnwPg)-2(=-F2lC+{gyZ-yl`V}AQ`y$=VJcfTAEvTx;=`c` z*C!^cxUuiShr?m_7KMk1(!}xM7^K_hww!{JRRX{ zd^iE&zxePRgdg(ZWQ1Sx;e`lqx8=&5hHwENrZmU-Fy+0+hpB9~c3gTYTXQ~4WmEHE zDqA}~yd2?9d^iK)?tFL+!UOp5c7(U^;ar4w@!^dK|GNMmGEl_l+gGm`nd$*_!T+5 zCj7H$$e$sB;nzdRoA7fC=6!u8Y1uA?A7S_xE{#cLZAne0qb88qse#Pd1A_zbe1(m| z0vP?Za?`xjKkV-@$Kp49%4%Io#QvU#`O;I9$&yGKg5v)nJNIiL+6eqeh-n$A-hpQ9 zRBv;3zTRw<+0nxOwRvB&J;^OGtEw|2%Y(6p`MbGtG^%^+5CH|m3e!Zg=t#9H-O@r{83n2`CpCU3Q z*zns8hF<{SfBT#-q)9EPKiOZR`Fxj)l9;#<#hGhhQM5@`Iy;5}z(I5IGYx4rp^3YH z<;o-xKh30=5tT{aaRKaaJe&5DHZVX`3zNc$szA?LKi}SbA&m)5+?k{>*Y=V`X6nKD zmqk!LK67Gz+y{KF3dS^GLMtJqNgcRknBJdh4SAX}oS@ME=!8v!-yVt4AT55doBiZ_ z-)AW0=UT#>4S$9x0FTE%o=udfj52fl`Ztb%cSGp{qhs9K8;*R2wK0UfMPZ*|?jpM} zOpG>MuyrwQ%7_UR$M_6$6ZtZR(Uf=yV~Fw@rZ$AV5&jRhLaZl2Y8o~z?)6$grwAJ) zGP?!he+nZxyOC}YZ;+Pk)*PBwo=%9P1VXqG(oxuxjMy&Xo{qFx6m}{P#nCb8alU5P4IVFR$rCKUj?KT{CzL;w-9l)I9C#X2W9?Ri2Ttq zoZxRK0^;)JB96)}Y(n|AAV6VHKEeb38Xz2no%)aBDBnT^#QyfdMr)XeU_#1{#@>dx<#gV@Y2#`O)g&pc;uD+*b{_;frXcT)qbIr$W52Q99aI zARUE0=>VG*)-3$-N#&z;FTo$(=ZXFGfWKFW7dF9Pw9H?S$RC!<4E_RU$Obs=-d>bHy(BYbx`XfQXKW7dA>qTLYQD7b1W45ij_=g0Q&0 zhY>;N6*j@&Z!l2UlaEkhai%xIRKAAT1%G=H7W?}J5%j!9*aUw&VG#QpCi2&qkE8Z$ z1!rP^_W(0<>fj>18MPYA)T`1oXfJ*Ey*NIyPl>5s^ITXUI=n9%FHJ=Lusm!i-#EEH7cTC9vG+FMO%>_i@Hr=Go2EgMQbM8NrWK(mXwvT@ zYEs$)f^N%d1y&!LiiNTuUm``zZW^^DC|asQin4~TN{aHg)DH?QYg@Gx7PPRsqAt6| zT@_r#qT*Hr^ZxERXVTNO1)u+Qz3>0MuIHJn>A7d-p5NSa&&QcFbI#m^L5`PqRv4Zg zcwB!Dg^&D`!tkr+jllg!UB8b4ufOqmDEKIiUCC*d3NKHE z_d{6wdlGoGKg=DM@4K+}HxGEcKBlPf9tW+KuL(E%W)7zCk$0U!+sOl00lYNiLG5oE ze!RT*fL7y`V?)SE6GX*v`O4r|m$#t^`vcGc;nB7O$D?&>!o!8Rzv1SWtk87fc*m7` z<9u2RB2{|fWE_;Q#?vOMKvd*cO1lr?U8#yxkz2$0_{{)3E(HZ;0`vw)G&iA$f_$nZnn(txoH8Y9ie_TG= zqfzta<@WSt;^ce}D0;@Q%-qA^!!0D_h>!g9!t#9ze9a-Q9=t_i`QDb-f4ymQtpWHZ zhUGhYO8@!J2-EXJ;H&1sDH!CvHB8TOQ~T!&gz-HGzW((5tis3R-UHvfuzaZ=Dil5Q zs4N<6RgQSbJqkX}j35o4F7nU9ItV@YQUE#5cObH-uTePR`4L9(m;$hI$cQUed+sSy zSroNedYnwl|G7QU^ix{1SLp3oc>rL_C!uuM!2IJ#xiun3#Q&hhk z8zkGurz>|n&Vm4Sn5eU6mmXL7W^ol!bv`*P2I%}+)``$zildfD+X3L)bcWJn3)YwmugeCwDjzsYxnqX$^gN~DMznfgGL?hfDs$YLC=t2G?mWYt$H8HG>S1WoJs9#uBHg#2M>4WWpip$PY)I3T}G;ZtKUD~Bpj)Vne&gLr9>}BiT_e_AD2AG?1`5ds}3==FZ z!Qkd+V5G?3WV8i?dtQP4A=h40_0twt!&(1cGPSnnPb`d1e}}!WGqAn(IIPx?J+yHa z&-FElv4HdYjGLcmj23nm0vMdNXX<)#<;TSJZeU$RvDR&IV4ia_O8pR;t;SY7p| zBf%g{vQ_&WCvc8ls+ZH8!`CZP)5& zEXB3f>UM`8^s$u?*!7|4KV@{CHgz5+Bi+Z2bR4p}I?f6wO&x!?fNuDswb41$#YAv1 zn>?;|5mvLvmffQe#u7N;_gF0+nEkXSJKavRA$e^|DOmL!JS?YbIAl4HDEFE@yAUhvC1h&tUKz#ph{bDiJ!W+^nOgAZ0&_|p z2l`j1$Jo$q@o1W~YUpH#KgoF2gd|CDC7Bu;EyC3%R{=9Jemks=lacYgVc5tTd|f|U zXQfU}E4bC_&okasicVB8)!~O(P1(|_srb01z<$>MoN@a$*fyi4f80V1d5sZ0%vB0& z<(7g4D;JX8HdmQgyx3BF%;7(7tlna&{=m}ltTjutesAqsZFS8zHJ2J;sH}?V$O1`j({n67$sjCw3NrW*1~2iH9+ss3lXj=G&y52 zYwoOtLNU~TdK&LZ*4z(~6{_~p&3moY&1Z#ECYYrH-LcoY``T)jpjvM22QX+;Z$#I@ zuoFmwsWa5Q6`9>Aw-?-oV7IW~VTax44@ARy71}_xY{2Sci))Wqz1`@7KK^YPdCvd5 z(GYVuX4eSqc!U2?bH{0m;rawmhsS8|_QQ~RxubfOv1`Ff6x_8$tPUE<2K)CGluEqlm3>1pep<)@;i@BM0U>E7S-R^7WD zuaPQY(hzna4$Jn^&9TC$u9_&pJkH!)Z<@Y#dw?W89{p9!7u^d6e=%oj#I(U>5z|kX z{^@kx!7g{ZG3I!}p%2FY!yt_r{`NT0z26eE8Wmpe*os%*Y%Q?D(|*3zbS&C+!4x11 z^Iz#ZjyVE0)Opty%Pd{Nht_@3yAwOQ&I*f7U8R<9+P|AR*q&jnY42VTU3|6G)oAM6 zYqYTDisomxoE36SmRw82tJZ>KM{|;~;N;5APb|$>8qtnjw~3b9ES;ZPI)7~~c*VLq zx;Wry-fk>zT1hs=UT5~jGQ@^g$dZXa*J@|6b{6Y;RcuZ(x?nhXFU1x#oE6ed;B0^q z+3i-JsXn^nd8=!W$>*Rd4LE!@R3}i2!T6b};ZMX^Ke&J)7RZRNiOrv~`e2Cu=d8ZO zYB1?YXRC_lpH3EGDscca!Rk69TfuH_4c!I1lCXwOGXs?|yGpl4SEJ#^>|k}B;<+)q z0~WVNTZ1W$GOu8!>@cN~ty0z_R;a;*NQoswcJhRXZql_DcWb=&M583^PBdJ-yQR?| zJR%4m?!-v<;a2*`tbmw2Cyus%w^(;<5N;IB#~cmEjh>w!9lKeFJ7aVC%2`|QUn$?7 zJ3g>9R2V%Q?l1pJC*O3No6o`&t;ck*osDwhQrxXBSblJ{wsozEgoW0F)`pkl+o+7Y zSo_gmnN4Ste}|>H<1DiJ=okV7*oFJZ(%ioC;M+0~?qLU<&F@-We>2&FLF;j2b|G$k zXM({Wj&w15b4T}o33+R+4Y-B>oo?Y%nXTab9IfEWHFdma5pFhBTh2CMm`uhnDI}RJ z$LTJ9AtH1i-(smHJcjB`h9HqvHXw`7O%Dfbp6mW*u+Wj^Xn@)5jKh&IoQ?M1^{u7DdKN(o zHcZS=Y-tBA9miId@BHWkrg^dBT1zJrqqBQu7sU8UERYADuSpDh=UL%96EZ_i-6u}| z0+(uJx5c>GhhlY{bTphcUT^r~pUlv#38m`jJd2<&K0|{pt`JC=_3tgf$2QwuL>?Wc_xkft8FUTZ&Ygi-@1J~?>)+?Tkhi)e_$oM>!D|%aUM%N+48{+QrmR`nyK)mspA%l>pjz&!Aq(79Hw>sAs({@yG3Zl3t*N-y*zN4Sry@2du91rs5#Y z=d6c}G|79%YB}jZO;}JXr!58FP|I*F7rXvrp~^UK?Sck>XKLPWX@)`McHAi)1s-D; zS`ua-UyB95qdPQi9InSKuJ!CDT3PM3x~k6#$4t0A`)jRT^;Xy8nC*}#m|IvqMwmIX z`>e22)^72hIM#CY@ef<_&;NAngl91(g1+mUZa#MBNzr|a0fHa59=%0}8*Ae&T0qs@ zBDex8>uwqB@}I4{qYg(gYq~HG90l8ik`OYg3&X*Y zDT4V{0}u#rqy{p2#Y@-r) zmTd~jm|HoD=>hy5rxWp!{;li$cuwsgOg_YEABT5pP z#Y$6-KWKh-_QExTJY+NVcvO?4+}2*Weh{--ny?+VdF`8x+lEIb z_+mVpQclLC?s*iGZA_0a$#mxn36FF%852rj<@TTFJmT(NCRM|iD*oU0XS8UNoUv}d zY|2ya3c=v+GwgZYFt)_+!o7x?GBXc%f~cJiyhWpkpq*&vT49FXNW%^oGh=WEle5kwq!J{In!zF|ASJn~AWjm$LO0oeNZlh6cMy|Hy;uhqv8gy|Rkz4!Pm{i-1 z^H$z5%UcK|d=7}>wJp}HPAog)uQJ_Vu4o#c!%z?8wbtasAVNk@JuPl$99exF>e-5C zX-}owIV`EAm<(VqaG)aS(Rr3_y=L80xTn^&6mW~#>*^E(*q?I9eG*fvTM}v{KFO1q zwPH!5OaZ+XWagH%H4>jAN^FiO@i`(f40TJo8i`LaB{s#B_!N^E%x=k0BXNVv5}Tt+ zJ#$nPproxUsnv-3D$4(ElEHJP+2h`T<(_eMEyeqIh3|(EdAm%8kz6!`GxX1Ch_I>qTc{Ptoy~bO-A)E-3CmlG@A&nk$Q@V#VMUzj91Z)t zt3?A$JXbR#f}gY$oT2;R?m}1x)L?O==?obkWPR!j3km@D3OQc%nSs?n()EuzZo>{)%9^>&Isd|NL@(SwVxQ8-TZbcufL?2tm^h*DZ zERHB^A$WN#3+WckXGdhy){t&zI^$+Kht71GXY$@vS&lZsOO)gsGEOd0YrB9(#Kx*m z2xDJVx0AI%bjUNIW;7=zdna;Tqo}r|Z~H~%k}f2rZVlQTXIzeRXpYmIgYF?KRRdLN zm+`K=(y6I0>|8dndn!gO6-7+fD@tfPaYRkTOCjP(f`p4&cg%zbgZk+M(za~cK zZ6AEv`0ok7`)=Gz@9x;JzP$aZAFh4pu|a_Q-RD2>kapS?XMS1miy?nI*8Kb1|M}(v zcV8zxe#6NtYd#%%{KByMH{RR)+qbjl|8(D$$=gnJoL%ruLfX=ZKdgIybydLHRyh6g z7sh^{e)OKvX7}8WK3iG$_4vk-&)&JjrC*-=^rGsRU#G5_GxJ;L*8ep8^~Q?DU&VDk ze|^#`-QK@18}ag<*DC){Kiko|pf+Lc?!@wf?2k_@k1m;X!*BoBV`uz_{&3Z(A7B5g z<*oIVcc1nCdCRJ{+b0(dd(S@N=H|N={c~6QyoJBop5-%q_w-l4OSJGz>RA01|M>dghfU}HX8X;N9mA*X zE8KYcUjfHQ!Na#zW&FuGvwQDl?x|&)JE#2q4(;@`p{vJi`}?^6s`=odQ%CpQ`R&^c zZ#;M1vfTWu&;NVL``^d?RIzl&Md|>1Y zfBbSq^#kwDethc>6TaCgJem1y$2HH~lYFDA>-xW3x$d>kb6(m1#eZg)QZ;oi7318< znbREdv6b^I$@pH3j;-VeNAhDU!?^Gr6LGP_EGacR&9W!8!p%b!ZXQa9S@z{sLc@4* z#$`XeN~ppcemG*E)74B#skyh6uJY7w-+Soz>EH+PKmPT_c{5gQsh@k@XL-ZQ$K*Z} zAMx?$+pm0X!8>Cn{(kijSAVeo*EeKzs48uoEB|-=IcR8^B^0~MC@^|Hf z_J4b(b0ZGdyQ1p-xKnR_zI^uIYmS?w;ETFNm(QHI&b9Ef#51>DIJ*9iX(wKM;OU&n zR~>8odiOn7?7UHb4~B+^-`96YZ+|cT>Cke#+^6MIPub*YfeV^-xzs&`>h2dz8}0b zZqp}!$Q%Cmtwq1z@ab!Z{_EOr-`M)brnz~`zI)`v24{Nyo4S%a0zVZ!Gknke-`=Oc z=g2$X9jP62L+zHo$LS{Q-BuK{`nk4Oi<*|Md1vJ>e7BzQJn;{!v?yg`Y22{HVUN@{ zZ#~o4Rc62P#s{q4PyTROVBsIyAD?aSn)AVF#|J~E>|O5s=hQR*6K~_-`~%g?F#VmM z_n9a^wVJU0DGAZSeE#AK!bKrP@b>cCgw4JD*Rt~l7y{$B3f)S6&ms^HYP}wb`<~Ai z9TrbtDfKu_pY&KiR5?wrufFKLAG{c=avEWT%1804LsSr>5t72<$AtN>V&_UwAie)1 z3K^mI3N6f^CTzi#oc#VzIy*aq{1*H~Ayc4t=E%wMS;8*atKek|X^Q@<5iWxJmR|nr zgb}^`la$o*MI)%+wxaS}8x~Je_c)DU>+yinpnla(!`|}m3DK~V2-JRhA-2b9pbxdv zpuB3QVW++HglKww^+Ne`?Z`YDb^?u>e-d=k<4A{>)5}kaBmYswpNDoy=ba@e?eAeE zjD^;BDt`L5CKe}@#Hau%{SOKjy*nCM6|tk8r{VFhFc6vWRlTcXeuUakr! zKgVJ9qP&Pbi+B`T&67ak)WHWj)RUMYuD zTjcUsh^F`R;V2nl(p@51p{eVQS7^%GN;Lh0OT&-&Y1F0ciM|0>@{42f56+ICNMLZe z_=)2fDNH5$Dw&=^G}7LRYXQ;9FiL*$YW#yET@lYhT&a!m^Vy1(a2Kxgh$dm-7T`zx z8*yDkv@-NARl;Aw^MqK&wcxI_~hsg-EbYnnonUggCZ}>d3zjmjS>FF4DTLI+g&HGG z_M2ZHuHJ`^sDQ8<@iTyWxcUMqbu#b~FqB&l6P0yE*;KC_f76N-&^1# z+O9-cuaM^kc+UW@8ccTlFzko$=v!^Id@liDB;vW_ zc*np*v|Wi9KU$t|kst4Nhw!kE(F?B~iD-R-JC4^9hIa?>ZUvJaKbq$fAC>oO6kaXg z-=J`gf#?u@Jd6)}l57r6Jmh$qW8fp&PJwU@qvd?;pea9!qibv!o(qLEBAh#pHz*A6 zk19M&`9pYLLkH?|R0EHmbGhSqUx1HjyAsh3JZdlGr~E07?Gy-C0X!<7 z9Y31ubNT)PT8(!H@Klc{A-s2#GQ z#qlPE;oS>7)nigfzRWN@zY34)kK@e=s}B$GbR>Y{h>zTDVfFD6@Ti=2{OI|J<7I{6 zRRfRKMY!X5sbP3;0gtyo3z#|HH6YabJA~&|jzO559tVPGI|aghrz&p}{1iv^9SuT_ z*8#l85Y8R(k<)@8+D;yFV|vOv8eWPcysZFJ;}xUxP#kxheg;fL+m(oT;PLhcGK5Fx z&#Lj}0neqRp$o^OGi%j&qg8k`x28D4Ux}X@?_asT4zTv7!6*)JYk2+&Ncz;m%QV>nVesh>?`=gsF4G9C70wIGmvr-k zg2$tNtE?$5$OrOpb_t=&? zm#^U8dm2e16Qo|pb-7ouJ7*SG#&x-H`n$Naz znwap2SE`E<>b0&1o3}Mtz>segTK&Ikt~ItE`0=Pe*m1~s)PMeiKkD5tKT{Pg7I9|lt^i(|Y z;SHS~czs3r-h@85^3y;5eG1+wRnkmAn$qDDC{1gNP)YAI?bCGPCBuWFM=S-F1O|hC zTkWtd`p5{O?qz=!j&FMT_Y?G^y6RqjCjUavFuazDR&_2&RYLL@=u1WdIxc_j(j%)= zSR;9&n6#rv+9yXM=P1e<3Gjgoa-N_!H{!+O9*L7)e#R%7cmEWKa_i|!E?1Ln6Dt_F5wcZee39UgI7lHT25@NO| z)EZ{&uN4itO_Me@cr1p529MF))J+UAUay$2uI9i`6<_R=@DXJUeKOI!*Rngp8E-2#3y%ZRWr@9 z{8+s$M>`vyL6F($th(iTW7Syt(R!ph2JCt<>dK-cD{rW{ofZeiB;3#MzFr!rh5Ai9>6h zGZW+FB3Ybrjbp}Mv|TK-&0dD0RBrZV4o9w=kt>Rm4=H1);TZIpP2bmxt4#|EXE_pl zwbF8(U|(yz-FIDUi-p>a$3{)?std(yjXqOg*(P7C`JB)$9jgpD_eFV@QRJK-Sq9Km zX4c+-n12eN&PJY8DyFATq^p!9OW32Nx|e-;8IH8XT6xiMk;-Dw_pf|l?vTs}g=M&P zPsDqCJ0gpUf}xg;x~UYV70z}TE<2TWYV@hNQ(Dw1eO77oCVEXCn^$c02bT}cn@@>tJUbCzfrF){`$h^)^nT8OvgH;(Gs5jA_nw5zi9^|7kg!s)&6p0+Tq zr+P;2HqB-QX>HLtmHr$ln70dS^r(O}F%zOjbt#?yTcoPh`VwCleyUCY>Qc=^klBR>rq z{*0mo=-qZhRQ?HGH%|CgC$2WF7LUsP9$6^^75gyGXG(h6w_aLRE3S|7iMUMA8Rl%O z{ZuvPDdUW}L<}UMK2RHhnfN!JRHy#_fb=Svw~5e$XTDboj75q<-Y*MeMF^V_#BnH)Yzn`8Kdz^+nwW$5{G}PlXf~Cg;O2by{ zdxA7<Gea^FzzHWWtMj#TibfsV!d z6TejazhVB%+1aNcg+}I25`L}ZN6!SYc#zt!s&c~9Df*)+eJq|fX#ba7CVsJae}QaH za7X=lt|o!R>VspQz?nbqUT-5F+Nt zL{#RQOdbn`U>y!W z+J`2G$G*_MHTn7eD@FI(V^;EIIAe%Y-YesK!_UJ{G*_KSz;FylwE)89RO2w2m0^I@ z7w8aO@iCC8XP*qfAP|?xy$c%&YN3Oc8_y8+1BX0kAjIm z+lrWbk8|2$QB{=b#w|87%=tQg z=zM+>y*G=z_|L=db|FHoAba@2_uVd{KQ#4AmAr?g zfB8yyQ7#1(&e%U3ig76*#?s3O$3Q)lsvnK+Qh+@y{mZoC?qw^nS$Ox{C8d{w>dV>} z^4{f6vZs7Eb{KyaZomAzTlO(H!Xs20rF}&R<*efBx5M{l^dp-y=JbshaO4#Pc{}<@Cqk zBic@Za4yVAXbSO5{3x7$B~$2$#Ljc12PHFXK$ol?@+aV7Uh6&}r-I9>tLtMO*R!)2m$oSv?P+bIyPU4=*U zWR7PG!z26F2UrUEAIGD$VWRCy+Li$TaeRB*-%IV!aKQ5mu46hh?w3fpi@sWEV49}p#n}~Rh_f}Ya_~GwQe{U#q+X);l z9(cU{(JCCrdnODo06(oQamVGO_hE^)D-l)|9=#*Z@%{u_t-p39osx|45xpBfHQrQJ zdF@IZ>2m{qYP>_hyAomCarquafEw>s6<&@KM|k0T{@)ECAB|yZykZqzt_qLFezkn` zesF)|3vJ1(@fNA@@>O`lFd09<9sur@t>0 zJ=l?k+(Rn7o8aeoivdP>G)9oi2HrfGWdA9Se(g%T=TTe0r*_0cZU_3MdM~;f`BEJ9 zBXXSYamWYAkn;ntQ^|wcHOWWwHhL&pwH$U?m2<~0xfh*f&0>fC{){un+i4;PCqIKE z!^Q;Li(W6)&;dNJ|0`yPcAvf>;7CZ?m3=m#vufEirb5FwtEcQG+lGTTOWj(gYq@1aOA(pmfk(lL)`1O)chk(rN z;nw=*+b0ewsBf;;%E(>V4jFw;Za@gIH@$=;)%i*l)S%Qac;IkJCYL;{uFps$-I_;d(+VT7Iq%z`cqNuf<5 zl$^=#k!8LC(6?u26$F~=qs(us%DwR^sS-_z#2__nTqyPuqm0COn8cuRk&>87+1~jt zNPe~@c0A%MDg&{|(OmE5{Zi5E604m$$Ugi|svuT+rN(BkfZ52!FeV?}E>eX_;_Q(Y z-cRyTHc=F?T~tyIrj(ONk=xfM1gdDS|4CVZFnwJs>uXz_SaGgLX~Sdc>ve|VH8%-p zZF`zuNYKS>uh+qANa2M5j$uMbp5Em{++xWv3>9L~`65|0%tStsIn#uMRraZgQ<6{m zBC(-Or@sYk6+do!Q5&-g8zzi1nK)5hgdNEXc9ZCdWc5#tIC3T{mZEk=rzFpg0puYT z#M3(qkSQ~35}@X1XB4ygZe#TwA-A*pLiNp>9kP|19c3Gp!y6r|?MPV@l>mG{nV0%}Hw)_1X(8=}~i(Zss zUNcmD;{VBfwbcBh(fqj3x!vgB>WCBt##?>P7_-+r_@{)A(Rz+Y45%IKL5Fm+^ns_U z?{ZiJ&D&nTyJDTc-dHfFIic-!@3jZSn6`sY;tVBHMa4N`s9o5;)n98w8}mdJdzuph z_0-q*(OA$9y%8HKO6fn;Iu~+n%AGiyT4&YOy{oZTJ^gq4r(Y^fgjuRI(TO1te&|>%8wORn+zky#}wjr z5djVZHmJ4Jh8afe)6NzVQa{#wklr0Y3nq=+8993jhEzmHcxWfR{&w>ojnCwX_Re1& z-IQqlvtWJ-d)i1K54hNfMuxz~rn}CY{_1&{pMS@8q;6YyHG;CL@C!p`1v}!{MY#JefeY-{}7UL%giA08+rq}F}_`~C` z2=Nl3VY_ZUL7LDP=WE>WISwoQ6F|obICDy+Qi@liSrW#tOk^Hp{4v5x#ZS+1v9P$(p`{PDs)3LwoX=^O9cmGn8xKSF57l^m@D;p}4}TZxzbR|@NBvIKW4ezC$h z;h&11=B=^#0(N{azfH(i)&XMWvZh9rU+HO(Kh=5IBs!f=G*Ga0JcwuCG*R;=NO$iI*J5 zXE;h)mKO!UCF7@Fi{Sg!44?ifPE=mOP~)T{j_-$0RcHk^^vyfNQTE9Rip!rz{HiV~ z;<=R^y?ky@vVOOyepbr9n>})}zPr`^NY%sCv%e)LSMO-EZB{NJ+oI~r z!*{(0+OQnBEEn61x@4+>O26E>YHrEO($c%bKj-X632NSf@GiDpFAI684SO}$K)J|! z@dL%m+wVVf4_wZ!XN#LxUq9vVVHzms@D1*ZfQ7RT1SxMuhI3y8xc>wL!7sV%UhI&| z?=4)qf%U^Z5HS0?*IBX%d)(}$h)aVHkYb<=l#cgv(feZ`2zuqcrCC2)?7qwc!InAG ze>SR`xA%(<1EJF^47|~zrOsVZcK_X>0M#b{KR7w+Y*LHd(9k=ri2`CNf;jOUDGoLcN}kjSbaPSKAPij$N5^pN3>mu;CsGQ z4w@?Re4h`)dlGm>N*cOwJbxITQ7`XN5FR}zaJ;*b9)BS{e+duAKyZjIR>JKR2*>w) z36G|c94{pduM2+V(SeeM@Fs-e@jYL{qeldecNb`|hUBAnlKa!&|5DP}aV1B4zO;5t zcr^Xxc;i8<@#uNyK7?_{%TBM25^Yx^XpffT(Us#BBE1^#QTTI|G<4y3Z-7?wb%2k@ zsrmLOY3vjTw-otOyQgwcKj!&v0jP?0H((Kasc^= ziPG5dBS(9$Tt3>{;&}f8t;XvD9<5n$M||Y|fu9=hNflnA5=Zz}q*vn=V{qjdhz`+L zD{|W@5RUe8xqMf^Pie?MC=72N@cPrAE)4G_72cI9JpP?1AIHfqY=7;v0s^SZOMAn- zUGX+Y^4$g|b$K5G-mM7djxfj-gyD6l@WvsY_z3T#Fg$+l0HT=Vc<+bd(Oxds-__vc zcnx8Ae}jCqhQS@jdoc{}I~5+?A2{9>VR+vGk7E!fr!NOVw4DOUVNmAsT?;S8k)P75 z_18Usd|xa1*pY@D-y6OOv<*LwXAK*7jfxzUh8*#cyE<&#rM+P;A3YOuyr?idTL0)z ze{{AIrLp5jZnO%I);>5M?ZKQe9p@A|7HX| z+D;z0Vig{}D?o81Ut5@bbk;+e3jF$|CPXgQuk zg=fdWqQ-j&cyu4Crb+~4Ka-<;$#FhC(gQN& z+To{rE5-A91nH^7x#I4Ov>t=mm)g5dv!$l|+`a3!pc8WP+&vlRo`}MWI9(Y*b_&nf zDwy->LuOZ1ovYGe$gXa3H@whnh~6|pGz{PD!Fw2+vh)?*ZF>5&7bYP(JtlLVnAtRJ znynIc3rv$VWr+su_ZdUhNb}Qv*On?^@5^KHV*mTEqq-)w!)8dg*D+39BV|`+!LaIX z=S>gK)JY{eF-a#_>KvW0VLL@=cAI>a)v$5+q{CHjVPRrtmC09#u!4=DFv;U^J#R#G zlXKRxx+$9La;LA_mA2!i+mgiviCLBNU!9roP)>y4t(@N!Q4%5Mqx(d<{pVc|8C`Xb zS*A{WS&h6NGFe$p)d33&5huO3L+eTORj%EwN2ZewR0oWR$eE(4n<7nLWm((ovw5Qp zQqmOc?R*x5Ax!*Q@oT{kdx%>kw?F8rHICd|y}7wM;HdZk#_<|k9WI#Hd(lWAI2$KT zYB(G|I{wG%r;XK{Ev|7!c|SB7)sAmy*F;Ve$C=zOzvqR~D6b7RN|{}k zLTscZTxrnVtXr&GNCsI-55yJQ+nN`? z-DrRzT(P0a_WD&u!$;emj%hTAW1gN^dLXGSOBnOCt@MCYl_6|=V9<^jpJUV02A^&1 zZV6_j5wD zEFB@`Um;XKXDl}*Cl+mwvDZ1Ox4T`No14Vi7=xk7wttwo&#-p0c);edxgIg185T{A z-t>x8b%kL5KGL8WS#q`4d*bzAW03=!;%E9NnWP^v=c`Xh+ZD*MZ;r_#MFyE~si-cWkfT z-n0Ze+i1?cK)EpnBRWZ-;SVJbhbQ zW2*`3h8A7xU~W~!xUt#eO1AO$5m<>X@h`(kAOD(XlBJx^NEidsHu_z#p}VdUCPUDB zW?Y7G3azAQq81#DE!sOCU50=te8a98IMp4GVVt5=9}zB6%`hN|`3u1?j1nO(QlJlu z4N>M2vdWVGW6)yBVMDS7pS>)Zhp(C}_ujqY-idwA{SWcs*t%YPid_J`Fna1eMQcmu z?0aL_hjnia8zDaV)#I0&Uil!}@cJp^lBCl^4!#lS+wne(M;QH1@S;FK~w{Cj5 zVEPfqo~LYcVm95Bw_s%vpl@HEa&3P0;-9sDAm%wJaUW;4Hf226PBCo=NWlYEcUV8%Q{NpHoK&g|Zx_}4SPK{(jM&gM(c zhxuuaO3sU4EKbOxIiHBR2RTe7Li?c>g{Jw=B!wp4tBF=7OTScT@~%*5;z2)UJjxVC z5NTlwj!MJ#F7=R?Xi7`-l{jVcNplLKDSVbfQ`7?rO_ zq7qGx)*FbX{F4-#@@G0kIOR{zNW??=->A@(=dTo+c$gl*V*%|{!U^+Ug(i6)RA`bb z#xU^Cpgb?UGMUOoB+YLYiwu&KihSRa{J{8TG4=m2;+{Ebfq7S5#-Y3OXxrK zH*%A~6wb%T0gC5*H-L#~I|aghiJ_SIXw8rM6UC7~DGbk!FdF-~<9MUO@VbFF8cc*o z!yCt|1Wn0#IhMks3WC)%!rk3`3`f~I__kMevyNUz2l zFZKVtO=nc7@n!&o>jgtV2ycEEUK;S|9>5)!uOtj_7Vv1iAo&QF%hwH>l5@Shg-Rek z?l|6G5uoOyb+9(hge&JeqR@6FZYlDe3YzkzA(!V%x>Dmkhlpf^amVp!%p}^bL^J`f z95mt4kj(L@OlrJCh@g8NcN~xI{AxTa+I=;`2#;<99FNxX2`>dda<`!|-6WIjKgH3H z_KoO@YGCeJ@YxlbE)+*@TNvLzz(;cd?l|8}1Q1R7A(w@UnJ1I%KgH3H+9Xdy5zp`n zBo7>qqx+6~0FX`q7Cyz17!dr@Tcz@G9L{k&1SzEiv9V^k&!mylFboXb`0Utp2*Er{6Y4Y>M6;J-s%@Q`9Y=bz~eX>xKV^92N9_cxKiO?pTc>BC{#YFdhCKbQl|6 zU|l6ON#?yG;yT++6i&hhB=R?rAHLO6%1q7ThzZJ@%`!4@4N;jjIEpMXQb0MK^uBo~ z9Sw*rHITfRF;U$*wtvb<^`HgpJ|_NP4t)qqepYU2N?%+F^|;jKX1POCo~wS z2xZ&VbPd%N+2UTTH)m+722+U_M<6*~&z~s;B-AGRE?^&t+7>1Fr2Fd|Jk1mwBe!GH zC_oNVh0C=IIdJOQ5OfbI5L+8tKg6pE=~mH`VHnGIA4{Y!`X1UQRWnppHP*^vpX80U zK4x3$u|QaAHRprDUjQ474Ib0lS1cpDT@Mu7aMR4okab*NniA_Fnznb-Lkg!8(9vlsy%Iuc@ctE z|6oVwOKP`pr64`pI<&~fg`N*NdWS!-&UJ-@Cs9{Bql3ZVjnL2U$b&^8<}z9Y_nTi= zyj?MTQXSYTU~jp5w6k?SXU(lR@X!38xR}~He0=nxVbSr3`%isynefTG9sYZayE4SD^d;}U z;V(7re_i_I-2)}>KFjHP#R}ugD!utWM1GbxmEI1 zns-H$#Pzj>hD8;?4S+_BT+&`*%w@?FVYwpXD^k zo|z`)Cklr(tDS2i;U%3*3zo5db*H{4{Xg!O@!l4DWwCeX^1=kW-0llUfU~v5O3aaq zqxMP1kRrf~VXWvnt?dw-rtKk0An_9+NL|Q@m7lAXvVvahQgEe1Os+#ys&1 zFmN*f-PRJEB~~>DE1u7%mAl>!ZEiV+kI%IpjcctRqlQmcR4?EPjgAdg4HC?0nuJ|U zcpxv<7k#E>9yTVy`@N=J!y0qUzYu<$`nMr6AB*q3JA747ho`#=(}G7T(=C^Kx-1jj zgIlmfPf8IDqmC9vKrI~@4hprcEvjsJkKyf}Qj5xcym#p^M$3HyJwiiw+S!%UoMp=l zI>Ru-_jg8RW{7v{4B0nFWuh*1sy-=b?S9t=0XJUPhU+{_ea3a(S(R&Fi}Ee=MpwAe z!FApZ-mQkXX*)4j*cuFO^GT5wq1=h?l%GTcmbp7(WOTK!!Jr=>)9Mc%*I$S^DRrLo zfAY@xS(knCZntomy}-Jm`B%nsKa6=--|@bs=w{)#J~B!u{)_Pp*4_VcbdYd#idgWT zLm{y|dt7_rvZCMqSaYBox9wx+*aE-Di6zLTMzd+XtpQ4`AwR-tbO7N-0|Kt8Q51l ztnJ3*-V><{4HUQuYXy$YuKnDM|GV<2#``|9UMx?!~PxI55jUd5ciez_GghN?|=pE7KCiG)} zz+ZRpJZ^b^7H~ydOb+gdrkkUVCL%tuNz>5eZ~XK5_L!oV1Y8*h;aO^~(94kYT-4 z7q2l$TQE-(eLAEEUsE)sz%^!j(N)1M66K<=8=~1qJdk6LBF7;n2l4D9o_+f27cJ(i zw43&7lYIF2Y1i&3_Y;!KQaq}w@d>HUC%rHtd1Hd6;?E7c{RwEW=G9`mX3wE^!!g|+ z2>QXK5h&LFeV_U%g?ZrxgJIW8M=I#Xk4YsToiO$&;~C~Q7|-I}g%Q@@+c3Mpc!p(t zUMD^Lp?Y-+cWS1@ig#+q4lzxMy-eNiidJb1BkE>KB|}k(<`<;S43h^v?EFNZFB$`P z%A4oWi8R4Ttx%unpgw`27PtR7%KUMfsXbyU)h<2()+#p_bKXxAAHrNgY)?$cufaq% zV+fLIJtn!q%*RQu6Fu#T0o|NEyLDR(+pZIR;`G$%p2gZb4Mn@pmy2!ufL#W$R1rGq|VIm$0K&`rN71v48x+t`zu|pEp?uz$G)!Y0&P4zDS zQZ^3-4+KN>hF}oQ9IbiRo}ukh^LD@Mk!C!8sV0@}T4l1z?n{UD=9ln6t81Gdt$FFO zW&rKe1Im1pP_eKILQvl~=zHn|vKvM*k(96QdZKt$QTa-qkcuC6*E}gzd)yU2tgSaI z^>vu0SVem@C4|~$U}K7gea{HYHTsRWi%_%tIbYEn%*)npde2~P`<6cQ)w0f~JO~vR z7w4bmgCFv%xG;cByuHcyPik*=-rjKkL^9SMSfA&gl!nT|3GB5RhONdO((7DZ=(Twr znKh=AmUzk$y$S`w+~w?`DK(~?79-(ldEoPgaf$0SCGi@s$^2K*qjOdHYue8nbhB)M z=%TAc>Z7GaV}gryZCG@+Esj_pwMAPuTw}gU@C1QOH^qy`qdycEzJ_hIG~LikROw4)G@V$ z&~!8)&DN*Pl#Xf3O-(f1AC5dp$4PrcD>hO+f_s=$6DPT{-JZmhSyEk#5m^ANt|cD- zl~1wx97ANQh+Jbo|BC%WWbAgvx}9-so6y}ZxSc}`QOli)jV&{r&~XGk|9%vk;xsLH zUTzqY;`~L5bJTL@$P{P7a_5K?=kVoDstdPsn7d_$+i3=kDxfFGitcU6Qq}cX$2E>S zQ`b@sG_*Br73zzY$JVth1rzhsnaWP26yA_hI1v-}tDEXt7T8cy4e@<57(Rm;BL?$I zgX?LC6T-j)TGkiD^GsXNgKq>VSl zAWPSSexD9!lIsxFijwG$9r3gv784rj0=}HB$QjjDl4vqF;v;dnjnl3CdI?2pl>!AWu{8xBxGw0K~0KN*Rj%vOi{K$aU`%+f>3)uf+_J0ODxEidZx?HQV#8VEH z$of4``jtKAPrBN^3PKy^7X?`%hiMAmy)5Q&-_Et!QdODYI}+Gh{gD+TZsCStu-5jW z<13vzaini277yA%UGBQa-xTS((H}T+YT5q1mzPy89_)UzJD^K0JT9>_(8nf-fg{Hp zCzoA_Tu@00de&dP#a|!oD}4PLZOxnC`J(F*&9(ZPH@kh&wIh6ywO4)gY;7grWi=v2 zRwYv^eXU>DQjACYU~q8^Abv0uX9*fLA5IfHIn@Lu3hBYOEXI2w+PCwV1Fw5jZ4PFgG531VD|2`@Iru9 zE=SS94*=`iP%}%)zawanB7Yqk_m#OsL1->fz{mEZp=Tp@$B}PRe5~T56YdR*HE7$b zZSEE=UZTP5zOhADNW({Ggs@SsHL$*bG5&DmadzW6CuNHUGd6sbBp#6^!KfP{{BXn-M7IQkBL{8&_sPqee=-WA z?47lh_S#Q`T2oi81q7y~Mf#r%F}rHDJEE(w@cvwL>l4zh@#2o?dYwGeMc#%%)brWx z_p68t)I*hfdoR6Nxb`l7y$Vjv5k3c^I6Q~0uAJ?hwjq1jof3LY_7V2{Z_rNL+1O%5 z#q5a0AXCx$*$Am^n&64_;Jge>X3R~d+Cqhwab|768flcUaiVdy19PT;23V*9ROGhT zr2OlIMzbbBbpl^orr_Do7_TvZtf@0AE1=iw*+L{MuQ^3Ct;JL5Ju<7({I=wYF#EJf zO?sjGiMz#WJ{WPc9^)%pO9?m>B~@U;JkEwkL2%+$!G_@+ZRaa=lL*i)^=7HcER3@y z$;%it0mbOL4vQtpHkpe(isT!>Ga&*EXMKbZ>xT95wYmwEdzNE|rfC_a86n-Q?`#a= zn)3utM3D#gWXhT{#`3wR5M2>d6Vl$sFO)f!e9BAFxgVAC(3GcW#E$`5dI0&AKA>rj zJZjc-x0Ksf?_5oH<$d~7iHP!S_$FR+Qir(q$biPvvLP63a&CHhuy^O`t*cF*op?wN z2JxO$FF%__W-VihJdS`4_n>|HlZhATE`+65U<5W`nI`{G(4+V0*h_-uS>Kd9R7*A$ z-L7?3!#LD9Tf)b*6LYJmeUWTPsoED5cpF38J%T6nej9JEwu?5`Z#%yy2m86wM; zq0P+R>Ta=kHv)`K z-)OFQrE1*;kJBBm=?qYNX`;HUPc$#o8lv_^nTHBZ5gzABoey(S)Nf6k#-nXdJWzQ+ zY%g3DFCLEmPquh?urnAe{+qG2Wh4dZOO6Xo0<>P+luGQ3~nUR<$% z<3DMS4>KfM@yy0VgDnWqo%e+iqZ{McIIJw$Oc9U9YTC67eV<0TUxn=l^~nRzapp1` z?(>OdCNH%JluLQqT%#`ct zHZ;i95LD+aGz^`Mhq^dmU?h!1rB1^`6W-YMXg#_DkFn^arpz=>#Is4o7_$zm?<|z| z;iPeivvGS>)fcwv#z17cuRtNx6Wa1M@)D&|ql@(uuwOU7AOE#PdtNi;7+ z>ms;-$n>*VANgglVoci?LBmjlmW#O2&>erVzNqR4n9~|Yk4wmlJ=uGrX6t6&E-jYu zdNVKQ|JT=y6WGg}>BO**;xx`alYL_Lk?fY)JF~aW-jH26ds((~c40QkY#$lZ5)3+7 zlU$>B1cODHXysW5W%Y<=k*UGlLG6cDvG{Cn#f*aK7Ciq!V~X$LF>lhEYlN+6JW*Ij zyFLQh$Twz%nZhSFNJ#XF1d20#+*J5W}$i zPlG+d+p!Q+^-p@k7pYgHML<$ZYm5CTpZ-wK_+A!PDRa@-vsk%cYC!H3|DE!lu@{yRz^y?BP~BI+mW81nwOH9pO)*$ z%E?X7o}8AMo002qJg z<;a2#(^4Jj*=ac$IeED$nGUEXH`SJ#=15P;M=V5iWaXy|8P*g>PG;U@ux2_^b2D<% zGpLLy5Izr*q-W=4rDx_jveO;b)N~sZnFFn*BEPJxT-1xhk)Dx}ngd1Ha&xjFe{Ra; zw8`oDX(_h+JQOl5%WAddWTxb0rDZu%vnD(8Y?Cw6^E0#Z(lZ=6sN+0aN^a_8Yif2* zmcyEY{PWVYQ}eAkIXSt2&bQ@F&dTh{-lbsx^JGBOkS%lW$A4W@SPf z8Iv_|)em^4(}F^LIrUdqOqV&>)DC6tX%92*N2#-@xI5f?im(K0eEE;$y( zo;)_q632`+GI2~i8jfXLB5HbU+Qw*Gpx(t=#>HAv zEF;IISdvpxlass>jyJ{RtSp$jXvsXXlEo5_T&0XnOGDL8P8c`Fl9ZM_Zsgc8iDTna z$EA%J6Q7ovl7#k|7@ruQ5{t$+62=*uGA1r9EjeNAm@y+zu1RPBV-nIVBga}$Xk#s@ zW0R6bj*Ckhml*4nbb=`+Z!z*LC#@{H5vG`;yhR21Ii~s9Os`y9UVhFzlWm!40Ja*x zbum=V!8R}ROgV*xOA3dY3Uih%FI;TGa*Z6*^`-%qWGtSixtgzFBApEv&FcR$0Q2`S zSCZy-hwf?_7V!6}CJjBL{|DAggwO;&PQKPmh%mZ$TqD63|8XH5o6XrCL&s*aE8WUj zq=ZKnXeXUyZg+swdF?1nZslxHat~9<k4_RRAY?zC z*ACi*pVBT2PKQ;WjhLfJl#WY_oqCm|^E!cm!P368-MR@NAWP zzRG>4%DqJ8E>gLdtK2J8?z>g)dsXiHRPOaE_Xd^wA(gvAI^0F}x)E(fD^;q(A5*#2 z;hRS**+L{u!aMrbgPPc1bJt9W{1?l2M6Bs%BtB9|vW!WR~Bvhb^=yEs1e zgJF_MqO)d}_&b4q_H}&t~qy(r^L=jlva%69Zg4|KvwO8@Zd7`-I`d zoGqagBKE9|m+DpWw5JNuI$UAc!*d*$kA{DklqB8E(<2#TOSt?{CV!)p&fP1SyG)wT z?J)xR3X|@ain*I=Qkaw_?dSM#GQ11Ce>#M64#O(-5}LHmiPD?F-8APsOd2mOR+S&s z6Cyc$inK%(-;cX#y;T@i63tM>k7u#v^;lsz!RJ^I_rQ(Pf1SH0f)A7aB1Nj|OCWdC z>a{RwuJk)E&tm4bN$(X^kp>w8n*~H?x1Sl&wnt1yy;K^8CnnC6bP(R|0B2_Rz*u@!*mcll$T`iyWz{n1<}Baw+T zq%ero3+H7pk@FPJWNrWhA{ot%jAiR&G*+3Xswmb!QvD;I;tk_G#k-#KqFH+Bkb*!E zvi~65!g>9qDo8x( zejDd0FY7o@b~w%XUbxfwXCzNDw9buq!XCwWlHbC4((54SNiQwxILVVEE66gfW!!q)RO4ksT?4^Q2b_=Si;y&XZn5Vjo~iPeX64J9j=W%1}zQ~^_85i*$OnR_`80Ku5XFBwh`Done3|^1?9kM^A5l)%n zq{);S=1&hVPNM7>zEbBbS%AsY!v!=LS2%c*r7nqh3MbOclke1A!y{#${))0@bw(JL z{CPd;knRFGE|pXGRWhH>d6Knp-jgoZnc*n=aBg$L(JaIt5UYoG%KUJ0lTx7RxQHi= zzi^)LS8$%{&wZRHyvI3DctoOIu>P&D?8p4`WS;4kEAxb_$(MOnjwYEOf?GIvk{!W$ zPae(i05SZ2GEaX+x+d`9RG~O^YFlm-);0@dVP>B+nWrih9xd}j75uZDC*6*6o^<;c z=LwI_ZKSw_M{=UvSz0{rEG=H{tSorhQ8lH_c8FM?!25X<+!|{1AW}=zu^8eD$ro)L zmu3QESv%73{yc&Fx!tHuiMBbK_##BRq4_Mc2Vx5-rE(`5e{#PfRC z1$;O)Xb`hAc*-jqJAo%#&BaABWUFG%Q@%HFp7On&^Sy9?o%58=-#Je<_=58$+<)af z`Lp&2eDc3WBd0~SxsLPXe>3MPAM-g+He1DcN*D96nVw`nHa-C++3!{Ep8);<=gEF2 zI8S!{j`LRVe{i16)tl-kaLBH-_a*UUSF(|)C#bek_%Qqd1>ho{!kNr%Wkc@yr;{*a;c zBPoyIsT>D!o^)BsdD7(x1rMjEuCjdbx=rbc`o{7#k0gPOOT7EAe5EjNxzBXSyoqG8 zWj>ntG?}Nk;n&JMYn$LHO;#ttQ<`hJ48=Roc}hQobcPJ&%glMgvv8htp*WA=m$;pK9F!Xx@q zIxLlCnGR-|XJwrs^JHI9rcAeZ*`MhK-lH3Mk8a>Sx`8L%R^bWKgeQpEjrXg}ZY8om)0x*{rt>)2U#T-|*9qu{B!PC0}(_d+G_%DM$(;xgT=%1MW8)O_4 zZlZoh6Azh1kcr_uoyjwlcwSx>?tc&bDcdAp4L+Ik5)3k$_y_O@WW_}?bXHCp=U0JG zC%zPaK$CHi%){`X%6Zxob_VCWBI7fOr$j)rafxSBCh_;-4`?1P&3wj63y25i5X8;r z{7CQx#HYzJ%eens__KEb8mNM(n+^vLZ+Ywro@{32{#16PC&}n>pT~Iv?u1GH;kY|E zPw79zc}k!4w~!&(1Ki()`(e&gS$)p=XxuMyp320CvLyVW;91`V-U6Pz4}wnse_-&j|1OJ*r{tM2h!=H`Q5O*?o4a%Ev$Ob()Pxz6Xp8-CO z^Hgq0oTqXd&G}65DV!(!ZRR}TJj?k7;Q59|UYixsi3ajf9a(vcZG|{X#^FtNysCUC6J-sD50Aw#JxB`H;LOQHk#d=cy`t|!oU;(V^e+@dA9LP1|BUSeo0(7Chh=z?%1M=R@i*R z%3iW~-dq;cNudy*KPI6JSpfGRootH6_5K!+$>ASPwljSah=aJ}8Y}5~-2kguS^jK;S z_GJTai4OSmV7>x?mqZ5u>gO&G;4RSsfcm-119(d?0K)Y47J2U&(ji58AdBXL2f$?t z#fMl2C^kgBB9fQXpWLq$CXvq&>%4FGI%2FK-?l7wN#P>)L}h1>zI|24r%2P^m)*i|Ns|g9dzp=G>gSau#DWNWIiREJZB&9CGI6DF8q~>;&bYZ=iFK;dl7eM6>|>U8VqpgfdNT^o~_Z z1ay)bjU>@U66BJ3ogL6enNkTV(`NZqg?EyisF9aXODWYMA@qNpnGQN!#%vTS(6UjP zmS6*6zH6t)-&1_(dwmR=^NZk%-f)?X?yDBjT|j!GF3Pt_bLTF{BX3?_JoNc5ZAE+o zKK$Twm4^z(V6{5@1mQCZqcAYU2XHrit5K34cRUV8EhoZAMDUM+A>K-!psDx}MBk&{ z#6|j07`a!2QR2~eA^uYkxOTkdD!kbWJo=qW;9VE!jaQGbAOhk35&;sD~ z!kzR(kO!~33eSzO<+ub1ysj!dy8;>9TN=;sxI*AJ_G#c<^?ESK_q-kL(~w=(h_V zN<0_vqTxq)Q9O*|ZN{aGxdVwW|Kv1v!xxg$w>( zRsWo>NSA(7Avv;Bt_tsI1cbp~kifI4@Mb9R@N=vO?-6v?%JQuTfWRP3!9N5!;;rNf z%2eP{Ia3(vN9V*T@m@oKuX<^m1RnjC@+Phk zxP*RvRCpH){r7w60C5-)q1d%3{cW1omtd-unu?8x?pzhj`O|61>PU3{$LyML>?)g;Qy`a5AuOW_9FX{P6F?J6&{_VOXDg*0`IU2 zZ>0k776=Qx!QhqoeXA4w2Jkpm+=nkOUh9#i3c2fT?07esPIB6!U8W=WxsmhQ96PI9-Sjgyp;!p11}mp)tC9W1YVd5?=676#N*IS;B`^q zB`fgq6nKRyyp?!)qkc$`z+0rkn+-hi{Jj&xLcd#7cxAxbEx@=OId4|sRRS*^{*>QE zxCGvHXb;NrP3P}(5Md1s>U%@I+rr?kE-BWZ?DSap)%SdaCfgQ{XM- za)kGa3U40p$X}4at5xBh170+QNWUUnBuDX{RN)l>kIGAsz^hW>MPZO8@RmbZ;L*A8 zO8e28JApx%f?uJ+vjUIwA^lcxIdacY;k9;RKWq)au&szgG+BX1^Y4UyjaqO0&UK>S zYmlQjR$N3g6?k{UE%0hoco%>-oW+p;i2QC*;muRv(f2Na*P!Z$hIaG)UEpQNDfKG= zo@gKUD)2U|@T|b=O$EeB==Z1!?|I;f_E8L3q2C=UyxACxTLl=GBj+p?-Y>x027fBw z`)~=o8&!Bu0FT!D3KHxn72Xrcl5_?_gm*tKfme*YDeK?+;c}Q7Zw-Vfj+F;IfR_YO z|JK7#;AN@sjswqE`OZ<{RVwgG6nN)V`3*v6fGm4R_^p6kuGAoQ;rE>K6sPR$-sjs)9(o`NBAc6J4*Xq zfKW921&RDdLQaV{6?iisMEQLZ7ljetdGxbNJQE6cJ9%&tc)vnUiT5<{RzimGT(|_@ zDV2VQkl7f73lexIRr*EYdP^m|%?_Z8mTmHC|- z<-2@OL5_5=;$n0|dwDzy524>%D!iG%gK0cOazt;a@Omlms6Q8Y=|SH5Jpw#m{n{AF zDfP1eFB&*xza0v^!799`fj0@^f`onpRCqIhC;GMLAuRNJKvf=RfJgOIkic87Dv!0m zBfF4(FW?e*c`Cf1t0d_z0mkLXIZuV>23|V+39lBHzQGC zKoCCmi1twjKY_PZh35j^Ydj9!1YV5_Z#M8U5l;HO%;g{=J*R4Kv#<88-?OUr_L@S! z-3q)1RCsHE*NSjKLcjGYJcG4ezj_FZ{L-2jrTu32_5C~=2_cFD7)AwP7Qm14y9bxR zyGn)kKJaK?1VKW-UMjrfDd?9u9@$&qEka{}x93~R{r#}MR)D~t!syxqKe~&gPUE9} zG~9wjl;0pga#Yue^w-F9{bg4>-e5jH5dH;_Qxahi-GTRAn}eX`4oQR**h)Sm>6}h_%5uYUmNyX6NRI*PL$-Iv#xFJ4@@2{;g*+ zTR%@}ZOuIMgQ@k$SnMS4`oZFEakm~axDO)@e^rvThfMXs$AgZ1>mzb4i(I?U-MZIM z`-Z9Z4gcCBnYFu8YHKr(>^0SX7VF+;avcJ?0gA&MbQDTjM)+^SCP`uDh%Ys3&QNhDK zvHdQ#?|YwYe^l&YJQaHwm#lxuZ_WAuqZILzPCf{Woe>j=>KyT_Rv#GUTyp^1!v@+9 z8uq-8Gs&bVtJG3m_OaokW2d{c9x@&1vSCN$-d7*}bR3#rAnkF=>LdRn*Qh)NnNdHTFc!(7%~?7 zZK#So`C;X$E&dTBal%j3hBb#yhSYvza4RK0`sLIV2{t*bS675NS z)tTLI4Yoh*Uf;bt_FG561@HLyc$X8QllF!l${5;~)X>GW-9=}vPz);5t=fnp?a-hC zr`z-}9owZ3sSlO{t+noQ>Lr5d+|B2zsa?cpjFHcyr5Xf1aFon4gEc2*_gj{Yx}@Ea za=+HP&WH|Vqi#n-eP}~4#dEGtJR8w0i8R>`)e)PtNxKJ{*10ktb`K3H*a4e12T47x z(kIom`%Dc%Qi#=ETRzDdT9q+Nw6BPNX!SUHVqehDLcSwt#=<*EV4_=o<09ZmKJoAGtBOS?B)7(5x-}3KLd`yqiI{WMH<9W@qMvVx1X&^u z5^=sI(qxHLNTm9fm?29{hs1Q>67yt-AT88>tH!Nk69x8A&f2$%$Sy4d+u$yciLwwN$zFee|KnwWTQA$f}l*S9@z( zLQz5}!$tXp`er#S!a+2Weu8hd4@7&|FJmCzx*vm^E!> z%7k4`zmn=^vr}JEK2wKdk^+z0zW2W=U_mT4mv)v&q^T?u>G_*dXC|Y zg@B#@i|ASAb@Jq@6?lRkd?#A6?r%My(QBu*wQV;y7-23tC?|81tKdF2j-m=ii6b2y z{G6K7-P?>Ue(cE0j2-?FxA{AoF3iXC?b-jk&$per_AH3{z-&@2t)eqOV%MD02W<(O zkYat5&R>gsruI=|#Q_r=D;|3n%)$XQY&vsV?DUO=Q}is>bPZRO*a{IO7Ly8#^R4 zG%X@cyDb*R_h+_P6tYuWp8^Nf%gj>4mcUKD-q;z4XA_2Y^0~_x&rbe*eS@DqnVwj^ z=)vKrHdU0BmPE#Q${%M8;1s0_vq2xSeOgrtPO&pPQ%a0D>V}s#4&6KH|9!wk8s;FD zI9o;7C{d%CZtIb1!!c~#2OV{oO(>R#}jpj2~@Q|7SF zEJo*|6yYISX|OL(p<@n%WqF6WU&*vpXKS|_C!gECw92-%USue*yuxg*u!TqcUR7MO zi?X-28VANCyPRDW9YEgDQ2ikN`Ib=oZbxl{JM&J5dsoW-Q9ras%a7cZ({=_nRJTyy zf>TOt#*)BHd#1x?z_D?b8LsKJh*>yqs;6uX4DOoD;V1o&jf;LIpCd}a(=L=a42-U4;~C#i6|wW*j$bIP;jXY=J3qg>%>Xp4yB#At!7N zOPwh=l(y1nUFU#Z>s>hAi!vC{6XT!CX*+}V1-PEGM0}~+)crbFZKkU_#pTMZ-CdH_7vORo&wRH{4UaHowq{htH0_*N?zs^nd-XdS^6G+XpI_|J8$_L!}w>zM19tFC5Dn%i^ElE+q@Yg)~a226D%=r(f6ZnCgMPGg{=p0ok6vg1}KZW)1Z7wR=(-p zq~9N-Et?XH8g5?_yXLounr_sO!?r<9=E%)Br?&Qj`xulwIkU^u&)lcXeK!9fKW1;k zV>akjJZ6JFdVNwA1~DI9s4@4fGxzbB<@C{rt8uhl)E4bG+v-D_gH8q%oU|O-Yskcl z@m^Cy2pcXBy0lYQXO8kjg2G9?`s42wbno>+*1d-2;FEq7@sOeRHB&?IBqvL4@Fg6% zM}0hE?vISB56Xn3PEJCW)Il&y|%!Rq65g!#vr z!`J}eWC;2B({SLJ4K;_(pd6-)Ge=aIdr)P0J0hY`x5Z!YkM@lOTeK(rlY@_Z;f@J0 zJ?Jh8)%V@l?ZbG@M*nMW&|LH{{cKXzq#f*?=m9z)kBwEP!vOyEpEsGqhUrTh0UrnD z@zxHDOo#3m9oQ<5uJ3Jjn8V4GmoX5uqEZM)OhnW7s*JT)8A!=N+AaQo)HVlO4;hY! zeD7EAgQfMP0iR?Jgpfw~ax&x+^_qr=JY5C!VX`P-$Oib7)!9!Na46g7=&?ylGDQmEko_#`a5wQq4AVWeB>Kk`QLOo>^#Z0foqLAeo!a zYr|npOZWM=Xpf1r5MlDjs`_eYd2=xi5*?S+hMwhrU_*QKOaBaP@1#2JX^%-23PR;m zxM-aReFoX9d(__`Ze-+@vz83y#I zhSI-AYSPJW`qmqUnNhoBC))>y_AGyrP%PxIu7$WF9p`3KA;|Do^?c{urydyOi7 zqRQRI^M4~`!=!lW3vS;%%$+2~aymyD-1L7X#X#w7+hia#p^@v?$6veOGA13(ab$v+QIS3?qN~}+l$F-pJx2-Lqzi7 zio9#MKV?_bmn8U}UgQCyZ~0;m=9@Xsi$)T0sf@#Ue!zPC@so{be`TdV{r*n-B@@wa zd4eamz{E5W&pyXWf2JoH1w_3J?PpBHF!|gDatj=#Jn5|&LZR|pLb3nxaJY#l+0Qxe z$s;vL5W^us5W}H@1d$FJDnt;OKzkP%t@3C45{d13I&K%j zFjzW0NW^L52dSA2;1PF%UyO6R); zFu0DQz9CgRv~;??33=G!~Vd@0@t=Nztjv zyv2M&iB808*N09KeMUMZKa2vf?@uvsZr0Jn_mQt-zyK9f3#Z8z}R;5&;5(a0I^^Ld09i6Ld&{N3Tm1 zM*01V3Xi^(6vJPTz{^nK9S5GMFPPTp!K3d95cTv|^x`Zq2vhLgzz}aGPtX~KekQmn zjPxV>EAi-C)nfPy5_sS8arte>Z1YUzGzw~X*S3mx;D!)M}3{f6202TSIQsEs3UV=!J z%aQXD6`o0fNByP1dk(xZA9^U~>-kZrN_RBms5}LU{4P?Zn~Zd$Aw>NK;fi!`R^icH z^zQ{2mm}u{72a$G9(~pkc>hK@Df5wxj~49RpFluDzq61d-b$VzJMb*HlYX(d1m1oX zUOMpTd!itL*QCO$Rp8P0BZ2pk)>}U(@Q`H>3A}$mj(95%X$2l@*Km)(CGhH0cxAxb z!{g9R;O$i5eFr@JXZcOya)ckFDv!zd#^%d@{Z-}Rhwoa#ej^ol{wloLz^g~NAfX=( znw0rXP~cq$VUb@tFG5+q^o`Cez_=Var>NR*XKR}$LQa|PJfth^d;`ZL_Yf5xt!?I? z6Dc{5od>G$3KV!&E=PE?RnHGP-_MtwZ&N)#)&MUW@u{AsD)3@dcx!-1zl#W>JQDR+ z;kgucPD41!k$zRGdLM+rh_8D3h^pQnQRH`=0&lSj&j38CFM@=Ac`Ce5fG6r{I)sIO z_kmZ|11s=`3NS85PCr$B$%kBw54rbLa*sex=)`b%96G~={H@&miz2_1;V1NaR)tpy zy#726-2`^E3QxkIfb37@do!0KcYl;6L_N>n*E-SfYRD<|(<|_%D)4?+>E{MsG{OZ5 z{eDsD*Gqvn9l|6>`c1D@Rbv0u-RTpjC=*+2kj}${?p)b3yNUM3fIAAs2y0 zgCgE9iBt2YKgZ*W{ zN3&OM$+IW@aP?<3ukU00#U3Be=)GR`@~%L>JbN92VSW$MvuKjX)n0C7GP=-RGE$DM z$b;%B5vm`P6ZMMZeAO!|V_pp4r z@M6Bcflmpgx%d$^QXK+l&V8$AuBfoR)aKzlOk$(f;kr;-T+=M+119S+yMA8)rn^n5 zX{t7CuV(xfzf_mIYS+NuqsR9)5ByrY?sknnxkQUaFCr$=!_502DX;vUu9808XBZ~X z?J6lBUlpkjTJw92>%xxenuAj5j=B&-*?-vF|XJA<-bMwAbhe(%G9e(9QLn$yJ|1 zifu4ib{HUIuhL-sBxdJTxE|PCUU5KLSXB}{DL40>7Y5n%LBg}NYFlvq1k8@!UNXs< zTmKbH9f@UORY`MJ2&?Pr_J z(M>kPG4lY-?#wa|%(8`5mb*)gyD-0hT0=_dw~ofqKQ%|`f1O+(^+&_!sa>U^SV8K4 zPiXz;wPOwY0;O=Plvr&Y;+C{lS3$XDg=JMY^1G)R9+{T%f+9=Y;R`rE4Ss9L?+Euh zC;P1?Kex5KV3{TL@Gq@G*D9MyPTjNNYDd{E!D#?@9?{gYnW z+Sh1r)0{aMTh`_(Y#jZ~ij{$@x+0?Psro6`jpLgPnr*a>HDMfzZ3>Y5$pXcKgZ%eS`PQO>iVMv z@46+uwZ5^|R9;qL!AmRrpR9)08RpUN?F&^}@_U&4TDjjj+3#`kv$)I4p0G5%{Y#a8 z`rC%c+&|LRKk`^*Y`uB&$_z&j;^m>x%B*#(}Sh0J@ocRHD#5twNfCH#% zk!>sf_C-JQkU`LXD762{JnSbbq2W|Qr2XSnjT>fFG>$%X0Qy(>OA&db|04#ew^e!v z`j_49mIAG&+H&_^OG8)keWMy4neOu1*DOu%U1-pg-%I3ohWnk9{VK@MQd?g3xTWsB zU#db+y=RELm9(#9+W&FtaEv}+Wp%nOdFk}7P~9l2UQp$#YaG3BFD*cf{9#h=hmW<2 zk{Bu-Ghch+Y?j%QWy6Hr*y%Q7oH;HIIca?NYviFH%R^VMJiJuhe6;KkmBEpM^4eD| z4O-Io6=qrHQP^~$A&~rbliyVCcTV=(LVlTY9-5Gceoa)bC=ZUqqxHd1RL;QW=3}T* zSLy978h3MS!6Dc2&=dMedn2oos=lZ%w`_1=p-X8=rLpXB$Hb~S*V;W*dMu6FqmI?A zN10Vc?oE39i>uD`d+`&|ze@^2U+>gnmhg6qt8zKI&CQh+!IHf}<8uF6;cCN@@}q5S z2V0u(%6rI2of2DS{yF^KgC9CPOg6`=^2WBd9naTScq)D zsHrXZwQPl9^$(};O8bKm3%P60rIfW9&L83k@0rRTH*9t~f+YI`CVQpvNR`P|Whrz0 zDm54ZXfL(cx24$YHQ>uOTegL}wp+G`m%)p5hui$%iB)GMejT!xSggHAJH63QA3zT| zJj?vi`vyrehh-SxhlON>1z^oUpnk%pN{v3kwa!@4=vTVEZg6Zv&$_{J4cF8Sj&De+ z8Jw_ve2vS!V|&y7@VXbLZqb(>Ja*^;*3t&U$h|ila5SHLweoZgqL$Xg4BI}aCT95d zku@>bZlBA(Aj7+`4F^{6?=aO?8A!~j!3sN<(^MIT{8wtLj7@&sj`?-1@zW1VIpx=- z&@VL0FXSh`py__W6@GznegXab{8Ih=OEe|Z>}f_*nn{W`+DkMRr^)Ix+0#>M(+p*g zm}o(R(`ZlC*w>nXUzt)l$X;csvf1x9o^hI_T%-LqO=gbCzRqM{kW!m#D7Z^RY17yr zG8H&Y=TgqyXm7LpzSRDp5$fTIY5$HMm#0(g8%_4(DYa~pdxM#$v`2#{oZD%tzZnba zoyLaZrpEAyZ6O=hU^|556#UG2N8Q`uS&iX%R0OvANp){W?F_`@inwTx-%yWVg2!(( z_lx-1&oRJ=Wkkr?i~eVvq|`Q>%V{aG)eH!OqYUgc$AIw4Vq|#RQVLmGGoZV@v|XM= ziu*NLL*q}Uyz^08&D&{}wguDbi_a|$&`34!g)h)JL+lSB9v~D42L_BQ+{c%n z?$i3M+5d&bxnYnxeHkQyfz?tfZQly3INH3e+MQ(I*!t6yF>B@|Y$yMC>i(v?N&a-_s$FZ;D(N(gfXx39ma zt^;d^2F145T>UxwT0=y-)bGWQuvLK0KVq#>AH>%cMg^5<%x!H>bLnH~S4y8jAA#mt zy0v1Wgn?T9X{;*LwFI6FWJ?LrKC!A6 zuswX5BS5MMU@ejGwJcoM9-hLq4uICQByFRvbQ8virLWY5qW`nhOkg?trmoSj)4$p1 zm75vAcnq0nlUf1>nbGvgklFyVw7_5g$NcN=iD^6#+hB}%SQqhrK#2yU*o=3iZRUE- z@z_?KRBvpK4NY7401X=h$&wYRQboEHxvqABA+lfO3Tz>^&wBi&xLEA^cE19wC8}KD@$ZM`b)q zmRO2@z2qoy)%3?ke;Ube7jd8G6%Q(}N|_LA%`oIm%Uqh`ns3~^4oj9IDm40_^*#I> z+uGJ)FE)Hq#>(8bwmLH{W^$gjC)HwYW(*dvR@zGQRu+RPtrKdr=$uC(SnM#?;l*OF{17!&*cMa-`PBsZ)0+ng1TcX>g+N|K zP*6=!un-7g0-*|lg%v^inxHO1peqC%LEZ3BVjZfU0RPDOFZK{ed zZNWq{4h>g)O_nys*NSRbkGnu-Pii3o2}xgC9fhSBH-WdubqBhmQw)jZOG? zaEQO(*Vq=cf1e6sAXFi+uqIev7u-b%bcH}ga5s#N@o2}_ zf(qN6gPrSQ@X|S-shG=DgfXDvJW}z0MKg4xbNk=Z678kM$EYQuMV{ghPFwKFhJiEY01x)Mu*ETKS!#`ubBR@=Z%fHY1an~3oIxy z0BQj>ik|+v*uw;WJ?-3*l9FYc>t1WDJX>1Tv92_suC!OjJFZmQ=3J@1&hA*_>2q0o zb^HsOPD#gh@BMUIbNP;=!gkN)d!7p0UpsbP-cP4{6_2InUF@mpEVi$8%?!#|??;V% znZvnsbv^5kQ_=lmk1N(sq}q%VG%W5K-eKqS>N1;Emwo;h{hT)HiKdM+Vt)$;H0{3y z1T|Rlp93{x^;6FBd$bX!sp_B(z-!kgG|*uDDn%*i{7>fZS=>DsTSI9{L8cFQwo|Gp&3@Xu?`f4X4URkaz;rkDQJcu@nQ zQI_W}bIgelji&$D`6bV_{CMe;J(YLOh@&6eB<0s_9BHo$3JwV!cun+xp5Z+rBHP;f zwD}-E|A0V!m#*Cm#<1>fy?VFxjk@Y;A7X8Ucl`}Fj;654UcLMDH<|kpPie5Y;E~io z@*})a*Cme>Sd>Oe>KH53=t<#2Vg?Nc8%}&!cY`q$Al(qDcb~{!S6$sViu@>y$YdIm za?{w!lP9DM8#^X-*ns$XrkDXmgGQO8c{$lq&f;t-*Or%`GcQCcz~UCVhe(PzV^YT` z<0wOBOdl2-mn_ic&yP)>@mO9_&}{)3>EFCQCV6!J;OBn4_tOC_<3oR2_EhZ4RSBAx zzJBc7&HsGws}CO!Za8|^jqctbt~p?NNUU2dEnC@#*Z06_9Huxy~sWhfrlqdO5A&<%L}!y=$d1ntNH2h{D?t6uC%`W z%xA9zrmyc75HU6A@P-YyXV1*ensLL7!ReOgZhxz~#yacPi{?iUKRoC5b&nsN{Lj>R z=PI5(IsDCkB>jEXn+cVP$Jc&g*!kIlwO zWG&eB>Ze1@-%kCaPv)(I?s@EByrt#ru5}^z-P!p1so~bYJ@)nWe>E08+;i{?!%AZN9iXp z{|D|?&E40mxcA11J=dKf_X`WAp9?e0KQ!sLXYRUn#m`UvH9BBr&-1Mxj``rdzHzsd zXWv!+y6%ptrfttJw%tGIch@KKZ^$M@jmA~r82a5y*SP=r<^8vf_(uOiO8+14e0Xf{ zXUyMsopSS4ITicX)xY@Ans58QcZ21Vxp%xB+UMENM;`pg_&L{~(A@sPw2b_lHgwsX z`^TZ$VavjXn9l54TlLxGcbgLadYAvASGUI=?dkVn_{>qZPa};{aowJXxTV)m{Vt^) zu6y&9)#cGar?+KZ$eX(3i0hu}lB`WL{&MxBt!?v;8Qzl8pZab2$ECV|eH47-$w$`D zzE9gSu`Ir5{=a|Ta_<|brayjsU~|$t*A+juWK#Fnvxk4ZYU=}kTm0ICgMR&e_q7*a zp0%BV_rvoci4z7d7@d6fX=}{i@7{Z0OkyO58T z+>-Uw@SqoCYL_+bOYE0C@9L35pSAom?V|HN`#?Ge!OO4wib4(e7P==b;|=G=e1_x)GbUAp(}r;~O~E?>Oy zF5R$C9~*ejJG1}()0EyfezNMS>EHgm=#D?~>dwUK-#`4ospZ=z-nP~_HuBdmyB6&@ zdvaEIe#MLHoy4Zl7#zi+R_FJ61<{w}wic_QbVr(SsSJNvLZw+%^r z_U&~y#b3;w`Piu7M-3~Frylxo;6H7BZoJO1`{Va3PjAqE8#45&+9eyEU3;&;Idr>z zmGRzwU(NdbqwAZ){FcqI{PpFSTNg}y{m5If?+)JC?O;J$TwYL?6n*rMJ>QQlE?Ttq zZ$C_Yb9kfXUjx#s8eY2l_xIlTZ0Vqu{OVCYNkFK_$ih5mPredhZqS5>TgaZTSFKDi_G*^&R4bK>@C`5QL>QM+u& znYEw2n{d~n?MMB>M}2CHd*YU#E**Yzb@b`XydAFUtQl9g&NE0)Eie67@X7V}wUib8 zd&?Wsk2k+lyrg^f*IWPg+MwUBeR*ZTS4-c2&bhI$;oS3ygGZmW{(bM59y?dq9p7E^ z&-+K{Q+|B7x4G-hIs57#`u07`+_(FDesKKtnh!E=>XLhCSeR*7)#RqX`o9|6^TV08 z$f#}+z51oqy;2^u?ZVU}_mph<%cE__-b(-NW8FtLJ~CT7F@FBf_nvxuVA6GuO?rL! zss|Q7`0MVAvnm&k+cO}w=6v9-KZHzJkoJj=hIY{@~+RSa0MZf9(+w^TM%bpZl$cGx+cn<#cW)_+U}(Zy$A?H@(^L z^ALO4s()sk`{vm6p?BUbP%^Lo*3jeN($|L+y>RCKdsY(FIA zzqlo{m8Ls-(XK6hTi#v%t@GNoPn^2x{=-F2{A<#X*;|UvP8l|5%X^h2EuT$Y_n0!m zEjao+KgX0slMqacismcBeDbQNBaJ9%w19y|BnBjXJH)wyJO(HIz2f{2%sHD#6QMYD z+yg~9qk`sF&}^=D(qRvdW*(m&vl^^8f13~QTHw}V#|BzwL1e1en0muk)8YxMdh54`T?qq4QmwTjiqnCRW7nW~2wu3~wmyWHLSGuuy zLP0tyQsE+fyo*@pHDi^+ukq}X;zmpj_RPqEJxt)~qWllw_Q_;!i-g~87?m-1oRlRy z+1xY@X4;E6ftf6Pv~&}fm+c)deZuW0yAwQfq-FOA>3%Lxb5OC9wDdm5m(#mJ8pq?y zZkk2YPCB-OfYLp*-2qPLwE}|NLR(o(=QRVI!bz)k(jk9J(s_0emwk0?XNh(R9iO2o zd~|H4zi<(LV!H#J4)sMzIr8t`Y_P4gMUq#jZUZyzrJHw-(5 zT+7`z0w_$nN($xep^C|yr3RjWgSiJtzo_)NLFLA8h>Q+mo^F^li18Y3W_U?n`>`a; zvRGo_y&nsgC)G6E#1vQ4PnIV;X}ZaLIPv{uz8CS)G9N|!0GTIIT5m-(7MIw|#irmN zO#W7#fQ8Ug{$ zz@?!@GoYEcDDKU;&nA8d{(v%ZX-GlPJY1S#jFlD;Pn8Iik4s}E4)2_}G^7A%87>X4 zGxT~(`@IkmH1XlMv$_GE>_>3qPim7Xi6@)Uz>Ihk?rEGSl_qeWFcx#(4|htJ^}qi1kRKGlQ~au@8mq` zzmoH$Cw?Agn6tsJ=X@ska?Vp)k8yq;_{TY40N%xUD)VPJzX1GR&O=4EZ<(VGib)?>S!CQv!G}MV*kYe^SiEWosxHs`DOcBcmQ&9@`{$_EyP{_y#G;S%y|Mm%bAF-YUhD zTnEX^0@A1FKL^+@=^Kz&rmQRCwF?TJX;%MbnwT5`b>K>xDg;$an?$u4cME~Yb^VqJ z<8MltJ0?A4`YnGV`Rv>*d}IG}8hB)Rqbgb!o9IavDkLZ!@k&RW$B|vMEWX`^?8FY| zqepbYe}bMyr;kULhx%ZAaW^05lP4avjObZRJRSp#=((gMdUg=?f{0M`_Xt!;N79ZTZ=Gy{}UweW~uPpz@u>j;n6#Tz@xoTl=d5n3PI0)K?0A)V#Hf{ zz|aBmc#-hv)k5I8RCuF-*TUn_P2fGQ!kewYqt_FGN9SHD_0yxUsGI}|yrZi8J^;LE z2$6nNegf}B6<#mkRSGaJN6sB8yjlewhJYSCJAjq?)dCO0CJzby?gm4=m500!Jjw^@ zNAGPEM(*3eDDmonNAK@~NRH@MFvMHQ0cr(aFWd}Q6X!U&JP2`KTV!c$-%*uy^uAtl~C zg?|0H9O0F!@Mgf%K|q`Y_Wdfn0tFt5#-rah@JjuT18=1O<8tJDit|=-fYtzy&i|wO zat$t#U(!X1Hx-=)ecurz^t%Th%KUx_kOZxaN3XyF&kcs~5X7iYg!*S!+5Zk+55%)z zBIK-c5c^9QCS2lNVu4o*IT!o|ksMJW7~+N8U^KEA79#%_PrB%Q-0%}5qM$jj=t8a+K0IX#As$9fao(noTM0Q|<#ve25pqH3qoN^6(FO2_4hg2>rlk-s3qv+}Z} zPqJWHJrGLcDMc`d1($_ylrJ!7O>c@E{Zq%M20YAvZOE&qiK z&KQistR*^0p*2Wa6tX5RB2nv%z}Y)aLvDTV!u`n<8i+7BWrkwqhDVvcyVO)75Nr=VSYct z^dph4fyvr{fs(T(Vw?ZA3VraVJ{o;*SCz5VX{>Rbb2$xIJ5-~U?4?+SVybKk-44!? zDmfhyRT_N=7GdoRan-mT6T3z3Eqe~@MpBxa_K*55B3TRks9?lF>H&U|^VpiN$%rul zI8DhhE<{>0Dj-;bQKAA*HL}TzS}e3+$C&LQ)nv8Dp@#?|o!c&X%4nx{O&oHYlst6c zfI(3>X)#*g%YMHhqZv~SOZLp#F>>>SQpe!F`azWT!oIT6J^99&PSDGLYNcV#sEpoS z^j#um==2Y`D-9VF^!iCSH6>%awz6V;gEnB8RLhhvbEdHTTaasqRzoWSQZ>lY&MxDk zC1>44XJy6u2JJYrbV75$=x9nVG3(Ej#6|@;>xMWh>2Q_O3i~r|>*{P&4qa2QbSzYI zw^*7cNTE3LGO{XT$EC`;)m2q>rRxXQ`#CGtS9L$d&bZlT#`z%u%p@7-HLK$b(%c!3 zoOf1K)@{?&8`oF$fFbLU8EA=L)xcyjbwy5mf_iL@Cr6 zSrxe>W80-Y>ju^bIPb4~Wqs9vDBZAtMO{ucQp3RckNz#Xlm0h#LnS^LutKQFcga;M7?)(tHyt}!O#r>@R_)Gxj0cM`|QA$g}MH)bLHX_4;tIwqCTq({A2 zSELW#ytNLRG{$VE6@6I8S%<|vRhufms%xY(fwq;i^Fp0VOUET^2ENR7i>7Mn(F?~C zu{NF26p;IJFs5DaQOXWKr6Woo~lXRoiiF*uNBZDKIIJaxt+gnF| z?kr#EEGc&u<8N{Lw9GU&W#s8^^xAPj()dJeKn;#2fx}Ni8Cm2)9l+W_PG3kyg;E=) z*}a}cFeqZIgBhtouN71>t%RLWR${E#pIo=!5T!fT7<8)94>@e1Na&^NB*!%b?3mwo z9F~kU232Y{JFy71CWtN787GCNVU3G3^45&Cmueb=kRa=?l*zG5Mg0_O+h{Dk1N9|T zmqulzOU{annE~h*(xu9}^;LgyHbvB+I+xLO>7IxS0C+9jkLZJJ~*-OxcPg^TgD#t6w%ddydN3=NuDAvlc)a#XUJu6gmut| zTnzj^;3UpOip(-c6`K1v%)Kkjy{gJfidQXlG@^sZo0iwX?hF~r=;ZaR>{%(dJhq}9 z$5wvCAEqR*CXCvET;=`~{pB-d|6JLM{QP(BSi9?Rtz}DL^nO_``!xRSr%fgFm<>pC zpLYhHWG4}aX!JcJruVKE6QajuN%{zcvnlirTNvsE4%dSRR<_{7+@SJVOD8m9hl^^q z7KV*6@;)zY%-8!xJ%DG3ACkywoIF%d&wubEk0$Fdqn;(mnmUfPOAku5jV-jLW!c7z zx~tHZ>M(~b2+Fdho)D=9DrlWDP!h0RS4h=Vi}eaKmoE4``RKsJ zu~_^l_^FfPk&j7E7!d}bJ2DqW_b}&KN3*HqY-H}Z?X;``tBgcZtSlaev!+GXp$RlV zAeK3xllOSzQ%I1s(l+jwHY;Xqr;QyqK7GQ(Nt187c?zaZkGW}-2_MRr7ntNZ*Anv^ zmNNDhQ~v?WM`1;B$Enzuh=p0<*I>r?kfFndUu%hti%%Gln1l)`#>jZpl9cnk@X1D^ z_bm3lteWrEVH*>Rs`mCr3ynfd8ecze# z#`B7gYhTo9w*UHSpVf~?ee+$*rmsS6ckMXwbZY4{>0>JXXsoT8_CK+2nFH@>g8nOW z$V6Pa)0{8yEvFW4E#|l=spFh2bvRzy736CUR~PC=~-cG7hSr!Oh( zM02FZbG#Ms)^?cF#3zjKC>`fK@reSS@FeM|Mt0;gyz6<0eA8i0nUXrrLAp^HjQos| zT)cd!K5C@#(!1Q9$=p*t=NVC5)<{#N;Z#{cvioM~b1pBtCrjtO+!LjAE>CSlgINN* zy}~C+ckpm(3mWMrg7%OO`Y1`qW>U2K=-8|SrF&w#0~`)iR=Fpu-0Jjb#zi~nkY6Ry zxn`RcFU@4L67Ht&Ry2oekgh!jh5tYeoD;ceFJ3|9rgkrg+#&~4!PA^CyDI)rZa;c; zra51{Ixq-|-@^4-z`~7El`6iGr%%7>)0{B+{`G&@dlT@git~T`oSOs!Tr|NLgMi*( zP*A|IFG9TmL^dlRB3hLs5Fp4BLl98V5D_i`G(;?kYd~5Sq2g9?p$)hIiY;z+rA2Ei zTD53xT?*y@`OI?eoXNStw%_OX{XPHZ_ddCqcjkTPGw-}JXU?2+=FB1e89%NGdr#?e zPtR6PwpbTI`7$Bz-JX5lMU$H_?NUcuD8U-1Z>)6gbN zXTIKwXZrJs_xz@85M?RMZ0PClcJYKqo^q0_>=F9Phr%}H!%@)5;6o=+K7Qn>d%fbR zOLEnNJK<+`K1F&Rl)zW(#00(?K1JPmfPk1yuLr}ezQDC`gH$>(_{@%L?v!zZhdDYe|-t8#U z`;x~!OcI+!`y@(!2>yW>xWHsN!^o@pj#B9?XEb@<*aVHkkNPZ!^~&JAXpm@M@X6ps z{{&BeaLAxe7$G6ZGas9TJnJ%4@hqC}evu&%?E8EKI}wkPJjlY~u-*oe4AjI{qazR46Mb zomeopY}!Puv*G$J%Sg{_jp#N2{egG^YMv(pWTxK�{)CQFTnYzg$z&pj0JnY>gg# z)!6bpE%sLC1$RNTOc~eUnSI7?4o{&$?a{yS`LbD4%ceDoVQ6{S@&GBGHD&fh@!`B1 z3TDj3(mzWsE@R_~^229bVP`LB3qHc8z(aGUHBvpT;M+$!(c#Koj5TUv0b;?d$rH;8 zrZxgCI(@Ku13w0<>0aUa1Z`?-o@ni!msk3GZV6Vk>IHiZ%>UNXu|b%Et(UM3RQIU00G{b zOCUk_NFd?I`4Xcww6g$xjmwXH#{avk=3*(lR*X|hCf28`>r$rTlqTp|#cL7IttN5a zKq|*I81tBVT1L6%Z-O5AC=)^BaKa5U#EFB^Qjk8}v>Cf+pQ>HfmYB8@l6>MsLSJ^`Zi$aBq-iC1pe$7L%TZ;*u- z1>Tpz+Erya@&#FO@akzbyO0Xc&!Q;(ce~Ed-uEe$O-TUbFDhfR{%gMH>4R3omBi z@p50=$M--@|BVA)h6Yo5jP`>b^F$c|tpT3yFXtn!@p3G@X~3H&a>#$$zB4Vn0|s6< z18*EMnD!k?;J-_uN9?F9#tCE4)BfW%KV^(}vG6`h;J=O*UY3E!TQ(Z67mPFQ>xh#n zWtudf3nlVVCCD-Gc&kL?g)O|!z{^v47-+nv7GAD_$6It7Z?A<{0=%H(<2eg&0Pu2v z!{dXu(lp*y3vVItWA%7FY5VqoH}PV?beKV-3b9W)I;z=C@f}Us%XrDgadPfAEcn#xePIZ#rkvU21$ed*C$ULYbDY-gH@93N) zc63fMc61(Fk(64Uq<4f)5<5aC89PE3RwRY1lk|?#Nn%IoBx6VE(u$LhH;E_R$w zYQ-I)lTL~62whQ;lu?~@s+MO8`Dt-^bwyHEby90BKV8V%#O3QNlG;`$wbSx5g#667 z{87DR$AN!_?>>PyUORy|K0JXpzCz25Y6|D0`M5$X;*~DeZDrotqN07Ibayn|WWe{! z`e#pH!>zrSRbZ7{EO+`{6~nQ5Ez%}dQ5b16W$K*=hqia}d(^W%^M3jIrK?hgyVJ)l zPoF-FdxUT9#&u`0JQNe#-6pntH#Q2ti)b6wM&TReM&WNC9`t;4>KNwmb_(JY*+rU+-UjVanV@5CKCIya(La6-0}@iM5RRq z)2CG}&BX@sun_A_M+_fvYsseEy0RytThdEVpO^M6&fT9|KYuPh`%tnlQn_sTm#ood z+Rqwwi(!9%UBkB{u`!ja4k7=(qN*+F_$bb~FX6)@Rfkx=L$#5^*MIs+-7j+MdJ;WX zpnpL5-nr$q>Gi1pu21*XArAD~^tw)w@9!CnPgKBH!nf0(KD-*c>K{7tclkw$%G>Ku z($~Z~GClJ2&o{q%2raQ=Zn@B|{67DV+?h@1cT>Ke5Q!C(FUcJkQgM8GVBOO@wjazr z0P7B>V-NkiKQF&Mw|osfgQc%e?>KNzF1Fi;W%xG5r=1QjF0aTfe~0xxFf0;#q(y9e z>Y=yOV=XIJU~yEe-Hunuq{q7K_<&5S*ucu$D+*4DU4nz8AR~57<&uhmQ)4qLZ>uQC zj4i6XwW8p(*s98v6$M$b`*wWEEUjbPDk~}qPLJ)ZyrZI^P3)D*%8G)vv4fj-k!ctE zymDzp!5Oh*mCGv%&J3sS&91x`{kU?=rsnI1JE-@g!;{bt9~~a5+myF{xQkEly!}2q zx_`x~J@#@q@4eVvkXPL8%Ix9kV|QhYO1>WJ?ozM}uBlV_LR2h>Ys&SbdM8>8&;=Z& z#|$dyP!V#fLwbx3i7`54jM1wrLdn%3Jw}Jb7#%Xk=yesL)asBPqeEhh4jE(gBNd@= zbx4oVAu&dWj4^swMJTO0q{rxx7^6d{#K+KAD?%C7Aw5Qi#26hi#^?_!LRr-zJw}Jb z7#%Xk=r1cmXI6*KSRZQpXsF%Z^xXyNa?fS-XYWfKTpQQunF_t3@xdAWr18-iJxDbJ zTn^W7OWBdVx7*tsLh&V-Z7FCeW4IP)=pXv8_qrskbZ#Q|_g@#@yL>g9c5%hJdFGzO zOv~fHZtMry$`SG7Jikv>^O9mV&i<=CQ8O+0t*AD72vOXZiF|OBOT`I#etEIv*(tT%q{C= zZrJ)m-I74hO^_~UXOu?qo0mu}LGJ&T{6FS_yjcq(bLJM#ES@u`c=oJF+3ZN!w4%uH zi^dI&V26kzY}he5Qn)}Q4xT-$thBgrZrSY82sVp|l*}!hQ9P-jjQI-YL<(lih%gmT z7bCN$L<(j}l;PZGV^&dFmm#GEQy?jgj2$`{(#iOt=rTN;nprffEHblTa#3VnaoMzD zSOF6zp)@?CHlYe8l@;GmT(%%mJcr^r#gmIlVIE3qFAVk!ghlPUMlPE>XiyUKE9SM_^KRai3&&hBY}LG+Ll^FNdqkhb7ee?Bku`d7A2THf!&Yb(z<>AN>Op1kR$ z?kjq=9dN^y%U}NOz%46g?C<~Z1N|24JFidVXzcyFK3}r#S1I>Su6^p*`raQO&e}e* z#dG(bvFy6m7yRq;;<*>bTCJ?F+;Y#PSJ%xh|7(YFZ)M$^cjkoRm&U%ZG^$f|G4nj^T*0(wErsme`9_2m&Of%|9*Y8TDYgW zToRsAW-5H{Z5Z<172-2a+?X&Zsev2|p$tmG3auh_4vZq*#d>V6JtFablZ(5LvqTK* zZc(1=obBvTaz1}>vC{KJ#L4UURX+W5R7?g*Vz;+=Qp5G%IdLJlhU>x4w&dqHBMg7@ z-pa+wzP8}Ge)v5l$E`rbo2mOEj?)Hut#CK0PU$ZY@-%0S(tl3GGf>Ak5&v5iiqs=)9zn?G802Y7f5o%jQN<&0ZdW|*dQ|bWcZcGMhc5`E z>!pD~tBTYuM{gxygC#Py0%t+q@)fZrL{8KFX~nZJb62Zo{L5X1OjTG!x42BC@ z%jPW-(q;aDHEmk8v4w4xj$FwjT!BSCdKp@|+nDs?zqydBxX$rKlg8toVQY#F%(*8+drs=ixnK;Z1-{4dDV(+qc!i`^doKn5*q${Z0F3AkHyYlg8t@ z(bQXrIM4T*v>wNC@=+x?f^s>QvK;zXm%A2uO}rXJGzPP3zFMV6nFxyDB%#}lGdYb{ zX5rn7IOiXlG~R3rud{*2dTYEDmY=hfKW)6FmY@3?cwjxeX%=2v#Glh(N{`V=7Typ8 zkLN#aAKw8)RlMWl5aRT`CS6~A3Q^>VD#2*r>2oJf@fz=Mmj4bTALqlGG~O4M|E3vu z#MO9z1#jB-5e^ECyJ1C2zd7*B%WR?$o_aUekR_xz^g}^CXL5FNj|Cs3vuvj zya>`LBc9&luRD0s4m2*;qiAAT{9S{840Tg|4817gnkXZ^Zt0zaLBMPetrx~%NFLP` z6osBW9-s(k3Vzhn<&K6PuV*xAys=0y^?roP1?im(CF*gkAa%y#!^x5r|0(0I1Il2i zsS0`~X<0Amna`KAaPZK#Y&VkDOGbSSvmN5)sxowcX8q6a(@#DwR{u}GBz|c!JDV$k#7MH^evj>JC({54UK$5_hB#wRY7&p3GMKT%(aq z=q1Re%h)OR_OQ^T9sG|y8^UV;3~FA}Jo9p=beHpD2LFefj7njVO?P6W3rI!r*oFlk zJQlj+-xQl1tcNP7tX3E>8|t#ERuVAT;*Wf zqV*4N<+dTLXNbm1(UyOC6~HbwEUNNYxcQ4;ACI>L+MN5J5@Ga%mC$nVnvpowi_1t=KmvmWN$Z#$cC}AGVVQ>arkvQ4{Xj zGwp*3ulC&~e8o~0y{w3M)&BLj}@rO*#H<*)w;r4FmRU!9F1ix|L?1T7ie$1q;Sh>}rdxaI#UEbZi0RhT8}%-_{^% z6Oy)K|CvpEz?1o@;jH!#Z;9_hVz%J_4By*LUKAQ5A4%c6fGrNCpsf#AE-n-w@!ZBe zL)e->huwlbQ2F!txPhH9SRX3wY@Yd$gXc_FG+%f8_>1X0Mk@;DRqVpIjc=&fl~z$O zmz#Xtz)e2pp{uY6?(Y%WT~~^oH$FhozeTHwWd(qGnNS;300n#69a+CC@`&R=wEziC zoXjm0Kbf@7ah8Vh)!8)I(KhS}&JkaAY$EG{LV!!BJ}I7kr8pWi{sgSc=-D$CbnB7Z zEB+`3W06gTlF&7NG;KhmMNx#N2WC_v5)Hs<0kf5&-vLNGPrJxa6EFUcG1 zd%jk_xZ>6&w=G>3TVAMk>awhub;lE z=j7Y--@9q)!_Qv!*PC~5*!KCDPP0<~wfVy*HunCa@OJ}$wc*;8o2Ry_`2L^8?^c(t zIQ{zHH^0A0i%u!O``IsVe&vGR)dzRp(q-O?l{HDf_+!UrZ6!OMmm?$b!t%KWK5~rOiH^esfjVmk;DOS^d9p8yV-2 z`0@7N-$(XOJR0unp>Bw&B7^qvn9mDO&?5Z)C-(8s_mv~Sb1{>uMMx^e&&A!rhd2QO zaenDypO0Vp;@zFwgjDPIbaIrxIRA0QT{WeE;Qz$8k@S6WmP#AeyW}J>Zm$1locq?2 z&cToOsaL7`F^%$hR(zt0pDXm6iEo)umqdMiJ%CGC;I(x68xuv!GcCOKmb^x_FH{8{ zuf<5bc5daQJ6uDriFp4~cwCpvZzFxABj^7el|DbC%LSU&OPWv6ep9 zYLoapf!{(}ZIyqGrT?zbcAW2peispQc@YJosro)OuLtz~ZbIt&@2nGf>he}GdFqnf z2>yWtPPXJtoF+)p_v?9oL+^djUhy8zSu(FESNV@AZU>nz@YTI|fq%A47smiQ3W#>P z9R-VCgR)e=r&)Tx3)Y@IF@`Cg7$u4)21)M&AoN)YMcO~Y9(Fj8X-_A_^}ZQwfAZ9w zX7FbV^S>qHRfJvs&`p1Kz+ z-m_ml!w@*#Ap{8=)t`l(#&Z|lUc5BZ&q8=T=&Jt4Y%VaFB|^S6{(*Av)6YU^qJFMJ zcW5878qC`pA;%b(H#$Il@pF3!R=k5ko$-i9nNG)phTz9^j`hRH^MC-2!jI{TiJzpDV9Mw{ya|4XUff|f^%~qX_cneb}Rl_CLi5zJVX8 z8t^bc=ml(!&Fub zOZAFXh{oU{o=Ex!jskBNg+zu)>nFw)Pv{w?YZN@QV3K-`hP7zq`QN|!$j|AIlTZ@I zV@)^X(#iV{E)rcOn5TF>ZQ^;sB%Z@ai;;nOOg)~vG-DI3e89p~X^+E<4-Wtud9HWJ83m0$w!n4k86_3+pZCf)|b zIoH#q@u*|sO*ZgaDjD(l&b5iR18JOtXwrD!L&?M|0UqZJw2xQklo9V;3vWNt7UHK# z@k2ebOAp2^O&OA~4NHYxkIDgf63oN_|h%Xg6Y_8WNFP}X>}E&F(F z%=x+|jW^x0kKf(V^*sy98gHb9mxK5s4W{%M#TLdQPm~c*Dh^tW*8y>jcMd9R)^`K) z(Jz{`eeIz{KB@$LftLfG{^R(o@s5Hw@wNkx_b@bRyl;?T;$3av@iJB8y$asM3qvqY zgDE{m_bWci2&f!*w1xJaho8pV4Bo`chk*A?G*OSV0YCCl{74INO{DR-}CRbOpi5>9?*f7W=T!H{R4Bb@@h$&wZSDdTT4fEa3;$CIf+ zTJ{d~%xA>&angW^qJ62Z^|&{RwvFlYfj1g`kn**Q>jD zo_ykWkSBCT0U$Xi>gdeztdr@z#e2lnc(_#@Li=oLmU*tb;;Gfgk8f_asl|$CM%IoW z!B>ZnfUkTs3%9Nw=42no_aT@YdGSCcc6zv3CcXsH{G2wYy}TvXJoB)#;_3A-9o^e} zTZ?n<{bDHkV6!f%=3`Xk$5iX$kDt5$I~u8Gj+wkI-WGX`>`&~Jp02fMva0I;$gR0lyDC0%p9AvzI|HejZWv0 zP&<_BZ2Bs*(v5{;S>>_0)pZN;$qBfoa(OH@wgb{pBNy{|EI0x7z;W-nYx(`hkBfR| zCMAVKD3s5q#UroSDGi`DWzOdlx6R*VRyzH#FMKvVF8(==#1!31`ahg?Mc)arP-fqh znk+mF+x}GA_-CA|>byrEtlwUnc5&^1E87om70WvN)Qs|b^TOZP)uvVNI~MN0v0rlM z;b@%B%}_iXi4W|o!>#bjSnA!eSn8&)%m?5ovs{*ouFEQo!tWB{Bl{n0iiu~6sVQxn zUHnu^f#cwbU@QxL3!fiZlsta3Q+{V&+n4GVq|NKu1-?Tn%H3F-HD$vYo4yij1jK`4 zJT<19mnJ!9Z)maZ`0(nXJdhTey=_|AipR2-WGn+U0 z$8q5B>G3Nq4z>_UAwx=Q$-CtLS8ySU?& z)`R-2xpp`-8g$GoI{U?zG<@jr={ggJLp#z=q@0}d0F2A#WQ}@hwPr|2>hF;)QR;=Hf0W(2TgL zv5cYe`&g6yvE@y$vp{wK%VXK)L+ZaBQ+fRDf|~TqubtfIKODc%#qm;u6+4)^ZEN}B z!Q-*+;qaa;_m!mjvici;jgkk3zZ=8yssU8pC!=fNkl0asvgzS5vgmieiZ!_rMQUbsr53^|2PA^k4Xm5`DW|^>=Zcq1R;gO%FG#O|DIei9t~HyyP8&G9Nm*d@DQn z(`oBpKK75w?A>*LaGFQ!>sF(0*6&Sw_4x6(+D;3%t$!(PTeHjo?$Yk;n{`64t=U`m zhK6=^&OWczlr}$#Rfn5ztO*T0m)-xxj-prgtm&S4<-c}(2+2K7%Wvhtwj*tCH5^3e zVEn>Cwl{4@`zB)T!O}L)wq`?5cSK@M_1b$ch<8!d2V`rZs~i)nciv4xL+o{HLgD7C znr9X}vDV@faLbclL{INtzC1GY-QzW(*r3c>r>1q=@9UmQ!;l_su}v=s(xU}FE-BXi z;9G9)Ygk3aQ=T`%&#P{Zgc`Sed0KfSA48nsb2aYM`8?m(aA{cPC!rdCMFyu5{NGp` z2@mVjHw%LDTkB$}%Liesl3aJJuoB-@k>`Kpzxb5Q=&ki5;K@hpj#muFeiPeYN^4WQ zY`|9>Sy3)@Si+!|nHeqnSG0&#;9E;cJ5%ehvA_c+?zw%!`!V((TC9wEB6uN4}^p z`6BJmpCgCq2t}E9*DF# z_|~24S2bJsJ@$XPf z9`2U8BLywm0xjC?KW@<$Pc~@Gx`)}AH5)g34JeO=5$mJR)r*M+26Ztpko`B@Y+Ez- z;jzh?ImxxjnRh0&s95;V{(G^_%E4w<&#eD#x4Qk2x~;jn@1`A2-j2;Ue!-5sIk`oT zZQ=2E9<5E$lV^#&DwGZ6n3Flq>6eUIiCo>NkJo%2r48pJSR==I40A3BZR$AX^!7M> zF~)7?;;AR^&fN5ExW#K?PccN7N3R-BaZQbr?qg?d8ao=ZcIoZS=3}P z7hsAL?$VDqBW&{8uH+8^fVo1GSDJ`g0%qPf1chqSQ?B?j80Pxd!dTx(~BYeJwj<7j6aK-8Q;3QWA@dkGY$^s$E^{qErk|dulEXw`g*T^X|rt zPo=EGZLl+)?c!=-bK1N2pIwaQyH3hZZYOb%%u3220 zUIU)bSO}piuc2TR6=A-Re&k*CP7@Uq;xvv!z%TnTp9H zPMay1A*ARY_>h=G-rafogL!RV#z`E0d2-ErQ=WXAfS;_cRi&eB0h0Q8lc8UT{VqN~ z-oSUp99f>%)SNx;zipvd^BQp~>y(B~i@wS}ts*;9dhZbwT-`D{B~t%lB=gynY;{ex zXW)^+V?ODI zwV>Jf9AG*=2T14p)`QMCysXu@c1JdSzg!A&Mt-s;IoyILb$($_T&d7A5_AC? zYxVTfw~q@P+1-BF|BL37aLa?@DUnGt3a~2jhN4oj%>=ew>(;efq~o-*vXVLd&p&@E z_I;RJ*cA_n&o9zh&gYZLE+wV2r(@TJuF!};)J5i;*gdyBN_hBbV?qA6&- z-fVSK#)XpWOxLO+OcGB};z>#3iG>-*%^rjPll6N>c05ly%Zws^jukhb*zoyNS4*C2 z#r54knVjUUM$>Vwl!#N3c=BP!qfU<|GJYn4kQ0py!6i9)R(z26{_=;Agq%T^e2Bxn z_(*K2kXVT#qT*kY*uBw=4|PhEewENi-#3Wg$$DPd$6H$=@uVQG5cJ)w4NCvFLVrYD z8C;UMml01&!fL)ZRr#%i{*U8Ap+DM+k8yI9{uM%hj3wuar8p(wj`37w58tB-`R*Xo z9ZuC?NYR(y&TxBK^XmVBnu2KOX2rGasq>zKShsrTk#&*A#W*HfjO zJ(2J6e`@9bls7g(Qr^<}Qt2~|_{)?&?;>$M+F&l4WmiD}KbX=b#nmxS@&VFI17e2wPzv zhF>UsK3i*rRZ`Dc`Da@G{hbxxsp8j&{GFZUmj7f$Gz#*lH`b-wzt#{QET_q7$fw->mu9%Qim?q>qeR4^56lPIHJB6%Jh>E=(V3`E1tS^jb865@+y3h zSJ@-{gFZ%iHub?%&gWrzO(=^ePhB&w@Q>=h9FO&07NZqU-7Ngv!T1N_a}{@pV4Vp0 zizJ^zeyHR-lD}B;9J=+|QuYU*TISgIG81+s@<(3=;i~od_h_ z8a!`sg*JixtmusuWK%HYz@X@KMFn#)FEdjmH#E z8#pc!lRWpV(fllf=X>EgeXrt)^Occ46UV*Qfyi+&Rosb?bt69jx~vcRuMi4>7qXcx70>cX?pPU${>g(C#Pt^ZW*}`4b>u(@5_Rk@d2tNVSP;6MlL4Ok z!hZat&1a}|VsunIG5RQ;brEAlCK%1LaLq>qEB@&*P}q5vOc(u=0~<)#(@FBe|CdW% z_?ev)B=p(wK(r$RJZ(N*@wE9I#WSC<6FRhWph{=HVTxxtmnoig6uwer313Y>A}9wx zSJ^{9xN3YBHg}@ykQX^-$5c$Uj5F`aZie&lHc79LEv5^dD`l7fB|91b~5M;Py|2n#Nlb4JnK$#$^34!r zksfq8<7@2~l5WROFr}8KJL0gnqV67y9Q&o;K{e!GhNS9slZCPhn#54c6Lay?9ry=-@j7LWlVSm!3-~u}oesoQ|s| zuq=Ugkd5a0`-wjcSbeI|&<+BgQ9MUiD1nti!*fS`4ZCTQ_l3Wy_+(t5fZwt734&Iu zOD8tE8I@0^vG)+9Vq@Pw1=5(Dix1?ltX<5C%+RMSLTGo3|QYU?ht1<;KJgZ}1Vv1n&lDhgqL|Obm?T=i*zB z!EZT8G^v91LpMfl!c-_2-b7##fEr=`XWRYlpQ&Q(OUJ20eO$dvE z4hNq?f|gY}8lDa4%NB$icQLA3JS*XMCv6w|v<2`~H0g~+rL*TuEWsYM0!rH%Ac|L% zLcAkBksrQnB!2=GQ8Yh$m_Qyche{T{ul*CreO{xnCD%;~sH5lg1{$7;{)}lr_yMZODAz)_5lSsIew^@Ehy2SYE593rR$X=>s44V zr)c7g*|V>kTLM=X&d^{%r8f3nl0@^peZ(#acZ<=$$Qp#qbBOBp6K7%vjT4UNLE6gW zT}REquHciVbrsd=YSp(vNw!>{pc|Qi$&px?P?Ye)v&tbjWzLzVRlTz8j%U15733b- z9~$|}t=UJZrVEPqFY)XI@MKrIwHMPP#eK0So6yb6} zP&NLO$E`>~Jyoa!&i6^Y=VI$|&aX-96+?-9R0+o6x*-QVuWx7%Wz2V}g%?FyU;H#_ zyb%`OeBcd$67hI#t?^#M#fWL&d?iC5NaMW#J@QeR>^u%U+Cw~E-)g*d7T!Y0)TJ*t zsmJhM3$Nb5<29hh`v8n--&V+w)g$VW-UmZI$_Qvb@OWKE``CPx(O$i_U$@)iNDH#> z5ex4l1FxllcQYEtwC^Lxg6vxWJ=4CU2HwdA-enfvXONA;PZKdnKeq5PP+47H+zRvR zdr8P|UtiTP1c=fjKMZ=NeVqYDf6;%uZ$%m7T`fG`17vxcw0)f{yuJqBsZiECE~GsjW6SVleTY=<-cUy(_?y4kry9JEd9yzEN{yfrnH-aG_Rg#!tUtgqAMtiRXW8!rNSVxtI0rf~%f*~Je1hfWt zIMjuG{Si_|ynC&2cO3Ajr%B_jwZ`482HpTDYrN|%ycxg?8pmf?c+UfG7;xx6>TA3% zXiu}gTY<-MPm{KqLyzwwGEY>=!Wg`De;K6o7_YSO z9!I@8sXPpHxl=7YtS|IrrryPt-bc`@3c%w#eWra`hJ8a-xwP+BmS4)yZ#xIz-DBz1 zss621bv}BS_bzZTJcF$VZhRA9#9v z;p0Neh&RB(<2&^eR2~KzuaAW{A9(qYb3CBF#yi!*TL`?)kZaO-X%^nwz~gy{cvs=4 z@xHYDw+VR9XfUP6=x3JyQt^;$6Vi!yHGUc|6!QCTGA3pjkZaQR9fOm}N0neZ@N&Qt z?^^sc-iOdL+hacPrm8#)G~PiA?+xH_Tqa(=(nHn6oXf;J1iT>sJ*V|q78hA8SChtT3ndfpfMMSh zC~LfbfH(0*0gvmeG-m5U)_6gI8H(DKodL9N-ob&tj ziI{Yv{mOgx?)HPjGTiE_B2@XIQnaWuG@W*3^<0 zII&&J)5TKyL|T6Q{~p7%z{EDwX+C7((;r=zwbX___pT5dS9$Wbt=2_0c9;zvAJCmsRuKH2of&>IYN4K1l$HSERzBb58ek zROeT9S@Iv(MZFgVoF7`&;s3ZS*o<;yh5p^+QRm~kVn%yb*@B_;A z?D;=dzyH1;pZHi=SM^`E`G0h*z?b3k!epRtKxmr{%^JUN6!3-izYiSxKMU*602Jzh-{rnHM)x z&qefnj`J-NF4F{IY9a`i6M{JRBVpPmh;tm$#WE20Fvt#9aZJYqaqdXMbXyRwfk`7} z;9%M;h|d&AoCA^0mVx&+R!0@@q{4Gmc%BON^sJSN^BDk1&pq|MPkoKZd+;P)yOD5P zQ4nt53F19)5^m23YNtY6UI^0nV)Qjc7nRO?h@|sn;LS6;sd#r4_E4dmi^=tlOzN%D z`>3$53j3*$_pnG8$Uw|-$qrQUAF1#{6-HHqbzFjUFJjfAz zzwRF2y;pCKr_SI(gFPM1Q%CbcXXqdVakY3?JTO{qH3RyWs420Y+3wQc6 znh7G8nZPXcqA!atfmwVBq7*v|J?>$MQp^OECBUbwnb9aVgqI_4tkD88qP#C6EK&4) zttPs%h$xSHYHWKEJrzSe7R`Vj-i=G-i7)R3) z+jFM6-#Nz?c2zhJtIzI4=;-0)o< zJn-MhE4<@Ku{1-c3Wd>zhUBHnXgSiQwUQ%c+9~o3k;V^tgR0ugGj`Qk@=RZqBhP46 z-Q|q5s)wABR`rxK(yBpnMp`v^n9M&!&Pc1q${A_ZWpYMZHBQb*t2T__Z9=DN(?}7P z6rLoeawU^amf_?y8CIMvGL+nUjtrM{lwoxz8QyuW4A-0|!n9WD!oajsTFEejPn207 z`4(r@S*OZ)PNodIpC-c|Su*U|T83j!m*Hh?WH_#^2uljv@f8`TWYQTjoP4GXD>{p* zZpp1(WVocO46DzV;hniMT+>a2X|1{oN2i^_-KsJF&gdz^s`kBPcvf#2=Jb(a_r5ah z(NBgw`^#|b1v0#BfDFeC6k$o>kHplsWYUE)oE(*5MP9nF|JFe=TryaO)k9=>=S4DH zGgO4B>5-1qPi@scM}(*3L>Las&KBvz+MgxThn>|yq!*Np5>xwv$1f36__W+87zWK30ZrT-Nu0<0Dtk=!rGz6trgs>#8XUS82=D1r{4I|)9F)uqng&3WI~UfnGH9#*`Uw`Yd*e=kd}uRb+?KWCrM|N3fF%k|Z$jt_LW zUV$X*tFKOFT9R|2WYmA|X_BLwMEYM}t!n+jmi|Rfz0dy_S#o&}(23lWi?Hpa`Oo~``?ug zpX-vOKd+P#^*_n^i50)b`J2!G*I4q2R=mKO=<|PpC7)!)i=6L#{x7oRQ>}Qh(@I_V zN&gpH^6RYlOy>*V@i^0x&$i;%J1c$mTyM$eSn;{eTAw|0E%`hvzQF0E#w%(60!x0A z6<_2$quQ6%2>EtpXM5ga=`VIl6h7}ig}6JJK}q5ZP4R>z=Qig}Uwhpa7lKQ2mRa%T z&UNZWmb8DlC0}91S2;gc7p~HtRhIk?E56!!kOwYE9>1$)MEy^4?zG}}IhUv#ZPK2* zEcse1UhAl7o9h3ymi!(oexLKQ@A$pXl0RU@*Eti^@s$oqh&zxPl;k{U#OU9jITtjO zNmBo3mVBcX-|XD&Yp>0g{2?p8&FSuIuWgq6VJrTKbDz)tM=becR{RO4+-Lt2mi$R8 z{**JKg-nv;&r_EC87sci!5))>TH}96?7|RNNpgN2kAO>Zb~(q?@gn`X%aT85#b0m^ z`Re`Mcot zza-}y&5AI|`OX>SoBw=g$^U7^k2xKD=ig(N{J0f&-I2cjpcZB*tt2POH8WuT@BUTQ zHwyyH|J|Rc2OBKbb-K9y*)Sj(Ki_@EC-3G~ss|%d-oq_s$My7kxu5#vecUJu^5p&8 zRy?r1_yz7}pM0RZ&xd!Ro8l`!&;8gZAMCDE4}zpU7r6x|oA?*I+?$0Y<-^_ATAJ~Z z?h#-768Bv7AW7<9>VE2rk8vw~@ypy19C$!d|8lpvdXOaJSGZez@+;lxKKW1FQVxt> z{%hPXeDaBIjj#R%?mS=nOme^V$&1`QKL1a3f9~^Fv3rg$ew}-(&;K*s%YE%L+x^TZ zzux`5&);+0`+feM>;A|WpXW~X`D=lDj?W)AxqE!_MeZ`6{1*3OpFbA6AN%CDy1(|x zZ*%wf{JG2>?29jV7x?_O!kysr=PLIdpZpGYlh2>4-DN)i-RY+K;&-_PK7Xxsd-(iW z>%QcZ-{bz;=g<4xTYUa|z&+C!U*`_<`RhS9)#s0&xto0QjqWs`e6!op=dXv{y*~Li zca2Z}uzRo1e~-9XzW8JASw4R~;STi0pLE;!{QHzU*5}V>+!?<3PIrXQpTBm0>hs?& z_fp^S`kXt%7k|Os?u+knZ}-Lbxx0M+eA#X4^VcixM?U#)-4&{Ra&e5hPBUvfZRQ?O z^^etSaw{x%X$Yr`N zv)zw1xG0Tk$Sd{Cq3k&5HN1;=QbRA1mI^ zieF&G2U_t9t$3alA8f@hvf|uDEl#-qVZ}#U@k^{Y-`b56?r&J}%dGh2R{RPp&Mz>= z3HK|k_%&91q7^T&;*+d+krkh6#fz=@byj?)6`yUzueaiJtoU3jKF^9Tu;Mpa@kLhr z7AwBkir;F*Z?oddtoU*(zQT&Hvf_7G@zqxRPAh(w6<=$`YpwV_R{TCI{(u!>-e2;y~%;GZJK4@GoLmY3rCu!~2h(-Qeto*6!`jpAUA86Ho zLv}m^D^Nc5mN{H?x)J*7 zzM{~--OyL_IgzeTM?zm+=ZN$w!yYw%73u19#aldXwbbEte1@81a;i*T-2!r4HCPG# zH3p{Y!!$7iyr-{DcfuZ{AG$v^@TD z9dBP|Oq6N7G$*ggHT}88s8^xX5dH-3*{P;a0^dAdiln~qCwR|>trAn%FwL+5ye6Lw zYC0x-d!5t}Hh}kR_=Uu5V8bk_FKhts>8mN7=wsLGQqhOE8$K*E(jPI>=Najb8tFG0 z>820W^ibHpNa_gt!F%>Rp1}TcsW0pY@9C>4rm+83sl)&7FAaN^8tG~ZD)g5d={pSl zl}5Unq6+;xjP$1s{c0oKtgo8Riu&Fqbwqu^d-gw@puROyU(^@8r>~~O;uyRqLAk$@ zn4;YKjdH4Mw?U`bHyNP2`#)DPv25^le7E={Gg47kRf! zomRvF@7c3Ef!`jJ`oeGEsn4IQE)9fFeks%VXdwf88yu zN*#g!YpEmJ8oXz-y8ICKD4&aCf49`0&$6k+fVX5oxA-d-hf#h?@ z50E@hf$l)b_ay%#$qyi}Ca^=uM`ijb@_CXUM}CmxF zKlw3|e}nv3$-htjGRc2Lew^e#Bd;coUy~m%(~pwBLh{K7+zFBolfP2(8RV~$d|UEA zk$evMt0mu={56vAN&Z^Nvw7T!lBX-(e95!gZh_=!qFX3=!nu`mE?;hzlQvD$=^%~P!Phiki@-rp>IC*Y<2YQzLY{@@QzC`l- z$zLz|H^`St{(bUuB>xe48VmZ2{9MU@P5uVSA0X%ABmHb@EN662Yyui6h@&e~($qSstl5Z4eiGj212jEmn9bwNZ$wv^lRgxF> z+$nis&rc;U?5UM}1c7_6(#C;ME}`c-8F%zu3@M-A|;et|fTY zJp`|sPw=W~1i#O~dDGxOF!;|6{yT$DQPrpY=?34<;JX>TnkI>I)f7VT>J%(^bqW*w zN+a)m2CpvbgpQiJ3;uOO=VOEar@@DD{vpxkb_UNqKy~_s20z;13k<&0;BPhfH3q-U z;9oTOKN$RH2LGMGH&N$B+NoZ55jIDR^ezTJ(BLmI_-hP)y1~yg_$3Cv+Tiau_=gOB zhrz#K@UI#C#|D4Y;M0@ier|2>9SmN+Z6e!9zBwZKp@z<727k4|&ocN02EWAM?=bj# z41Oc{39KI}f~KH=_gpK*WX?!v{?+E8uip3r@v2SV#Y z4~Bjg+8Ej#dMLCl^l<2r&|{$|LNB;4x_jKc?mqV=_hom#`-=M;_qXl=_f_{b_jUIT z_f7YA?pyBL?mO# zaR2HaaldrGa{uOj?f%{Uhx?8Dt^1w(z57r1sC&%)mwVhT4=oN=gl-Kj3EdW28d?^L zg_egZLn}fnL#sl!hwcbfg;s~ELwAPOgzgIcG~{h?ZEPBkoxQIsTHs0aXB(_!?uczA ziBDnpGfP;03PYxM<*wWgKQ}wGXjYk5hEcls2#DTxTbJ!iEGU{Yaemnx_2G}gqRC}5 z=1iQ7#0FZv1RCs1pt-(;g3{swf6AnSnME^Z*r_P1hoz^#_~FNcO>!rFn5(uy58ll_ z=#wCmGdBWe;#9|egmvc`jnMhgmvc&FzPZb-Eq2^FmDIA$8pZYjv@bh&o~ z1?EqvAw8hSi$*~_KL%<^AkUR$r9}lZgG`CLvVn?#;E1Ri0-yQ_LP)G30N4V?k&pnS zaV-IKVvxid62LeV5||;z#o+1+2+!xiI=XwEKuti2;U6$PaF*m(R1&zh2fZJp;{)mb z13-dwG>C3ud_XLL9SJl9fYo>jKpNK)Kt=;507qQenatR^y0YL1d@b1EspdCsdHxjp5FZ?&VLYApksQH)=%V zTG|gi8n20HkHBIqPt2ZD7<8z_Jz**6@>TIglLE7&_+SOA^aR=CrCSOzd)&*GIG`OY z4FOTGltS!p(Rfod)Uo~1P(#tMfvCaY+_b8eo+&of$cF)pn?5hPNacSIA{mkz!HL`?86Q7s400vfj%!Z zl;~M_Ly4YVHO7MIrC$FCmI`06kpso?`X^NJ z+CC7#8(&U9O?7>p6sRPCF>hTB+RMGC^+_j$OF*>QrUqGFiy zHbm78%4uFhskSJAR5xg_I9_8kXt0W|QvxaR*;>J34?nSr*Py`&qIz&z0;z7$V6j&` z-5#vM6OrhZ4L!?oF@Y#SGQqqug8>^8>$_SFbLvJ`GvWXR-OdR$yn@9fO-|GUaP;Xf zp@MGk6Bi^7;)FOTNQ|Nh6?D^{xS&RHy#Cd&vfk(`MYCp?6?MJ%$Cr1(s6OdBe8k-R z7O{R*;^pyu^EUW#L&I;?`cX<|&sZ?g{?e>*Z8NECzA4rhT!}Tr)fTQJ5@c*B5gF*A z1UUjkB8$ExNsujpSY%~aPLM4?B(jLZD%ckRB9Vp1Zh}$*MA9&JxCD8`@ovdvIr^Bj zgkD=Ekc-UlF3w}Y6$_Hd67?!>dAGd(-*|Pj~>(KY%X7-FTy_HOJEjX0vo}X zKo|QGg#Uag-f-kg6}9%Ic-0Z9T?^;TY4C+)?+eJfqLT_{%$PmN{2;P*$e41krQ(w{ zdd^f4epd&NnXa=2h;;jk<_*e2uLhQ59y>u96Ujx1`Uncj7$g&!^f45aDM%(V>7ytp zQ;$u*}6xbWdcMYbG1!`jQQE&2-yb zQ|2=_NT6@p`)u;=Kzpe)DIisJxzYtCWt`D_%AP?Da|nCl$&=)_%K3~GUm`afSn6Ol z@1@dNG8L0eFEwtMFEwtMnQR$miVVY;+;vV_DLxsGaKTK54Na3Xr??}hdc^w{>#a@uMjIGlz4tc$ z20hchG6RqAsA&7%weYwsxix_lQIGVdg;#FiLFD1Bf{~_u^t;9&j^<;~BOhfVXr+M% zS9o|cEW9$v&SVBf8gHtFS7YF{gf8`<;)JaBSfgYJ1Zg~e z16h#&{$Sy4H}KL8ypI8F;ytcp2n1>SJ_JKPDwCaO4LrWXLmBJ44~&Vo18G72d)~s^ zYv8fJYP_3q0GW7iD;WYo)FUl`9{DIEpf?P>(-7Bq6D_>=A*218G~QJf-XQ~z{?>Q} zSeR_ucSOl-ysM#S+V`1($5#ylg0IymqKOAiQysORa z0T5pM@^v3=6OujtH_&5xl!>4<1|D8N7c%LXJ0Dx%=&ImU|*7jx5L2eW#H9Y4K(oDpmPAi z>wiutcznr(o>||oftQ7R^v{I`o@?Qy0xxL%J8F%8;hu54JOl4ZYrN{1z`jSV@hZo_ z8*Jd+Z{g(vFKGO$weSWQco!LXDc12e40yVaKrPN&$J;pIv47Bi7aMpVTI1iS1oj=Y z#=m?6Z@7WC$QrNs4q}jf^R4k}hJiQIz`M%An+Cj~@$YgAZ@z(diGg@ct?}w!1Me~eZ@7iG zHGzFYEWAwy-sJ{fQ(Qcl{@b6xz7X_G|2=Nt@x3X^*dPCBjeiG#cM8%qY5(!t%qCvF zfp;a8HQuMzc=b^N`~GB&SNjdTpBQ*AT6l*O*tg5Vd)vUf#=skIjaNs3hpZmy`i_B~ zS>KOHw1Wk{F`dveG31Zc*7Fd_b1hlqAUb7 z+Q2JDoMjRJPu6@qA9z9jJ7k@Yt~Tm>oq@OC!kY%Xp!VHk;guP9GY!03t@el|uq_c{x&DuMr|Sa=%@yz33T+mYXFk4=aNweND39z|Z#v%u5sI|p%X-z*Dn zE8?e$9P*#WF1GOY8hCRJya+Ow_C2riX-JLN1`PSA61-vH%|jYxw3qMPnRt5>*!PWP z-ys8Ufr0m^HQpaWzM%fM%^L4NGw^OQ@Tx7m!@xsV^GMfsm4){$@bq}F$iSP53}$^( z5f8Gj5b4B@s*=+1&c1HnTMWF5Exa_uPgi*u5Q8)b4EZP{ptiu%_AN%7GUD&I#?#Ia z1lhO88c%x~c()pOzp(K5MXsRZce8~z%D}tLz$?Vd)29E%C9v-r=&?>w{791xyk&?} z#`<1l;qe{KQ<1KTdZeg@x6r^_4!MUH^4nJiL6HBV&|{t`exx$g4d(GE?TzX*Edqe_qk zJl(!)kwzKg=UI3kK@c?mJKMs`G4N^)yxrFI!neRBHSq3%GWBTRgBIRV z2!gIZ?ziv;7{7ffscAmRfjK2Hs`^uah;NmL#w*#~M#J8F&vFcxe{ieBcEgzb!1h zdIN8pfw#u$FIB+PeFSPAe}~my-Uc3z2i`w;*ua}(;jIB)Q2(1{;eBM_J!0U^v--=X z1oo9${pE;(_n3h<-oo3Oz`ijS-cbYZ2?H;$h5z`dPhj5w=$XeyYTvm3o;2{zvhbb< zUeNe=hJ}}5;5}vFJ!RGR?F9BcZq+wp;5}pD-DBas54@o9@23`CX9I7if%i4?o9B;j z6WI4xl^#W2QeOk_*NE%!c0TbJl!vFYt8x{?@?TY~ht9uy2Ef_lAM@s)4uNYTuO!{P&R6zK4wZzHZ>H zweZ#eFQ|R1Exd0Hyf+QJ(YTH``^)1A>>CL^v%jSEi}$~`47|P;-m?k(*Tcf=XyCnL z;ElxfscGLEzzb^Mq0lq!ivmx#?|TN`c^2N=3G6%D!W(7a9W?OXwD683u3l?2u;f9&*>H(zkPa| zK$8D7UXg{j(7^i>R5hMs;dM-4ANP_n?TZ!oWjWMF2 zoFFI&=!R>8PkY1W=F=KtQ40M1>7#8{#eCEs3^7Dm9?h6h)JW7!?#~ zZSg`4)GAsp!CUc~@B2MxCYcYj`I#yc%Rkw_iAdeh)!TFJEJ1d;9%d z!`tA%D+AuS2vHHKC}<$? zc|bJK80+)R*uYuG+k@{Ieg%f7!uuuUbiCVshCO8wPP}*x zuL+&Ij`u|byyqdO3DtcJE$}Lx>Tyrpx?x)9|)C@_S1Jyc$P-k860`laac!JbrNCJrM!#YX@HUK)ZgYX?Wh`j`n*u z0$vx$>GsP8-YDq9{GP7ieS*#j&bIoO45d3Oj}IWH=w0 z3E*W*{m#_z{EqxCkAOG8k>Bq$ydD}}jHA9h90AXC)R(crcKx`|rYhgd9e96B zcN_3j{p+RSl{@N7RAT4lal50wJfq>IYIyHB@P9X&=le9gi#5C|hkhp`;N9oYuSUZgt>HB|%7ZVvY%hvb6L`i^ z9#3d^muPt3JMiKn;GJ~f)oXY`4euQXo;L#Cn-08v8r~QUZ?mJn;#s|&<@ZiUe|1>H z<9^Jlea!0Cu|8W7@TNmfug~vlc;hv^uO0gJi-7lqL%$XcZ-R#RGWt(A+uEBy0^SRd z)AjpK!{hN9D!<1ac93 z0q=+d&(iRwYIr3MyeSdz);jP8YIs*@c$xUv3};(;%#46H8gk5202e7;!{f0d3}gT7 zLi^Y8awFh<@4y?Y;a#cWRXg-s5CQLg2i_D7k9(9W{qi096-L0j26BuOz(u-R!~400 zcP--U`CSzOZyx-0yagKGH5%S~4*fzA@Qyn4Tdv{F*6_+4<8L?u-bTmx8`ALdG`uB_ z_k*$sc-K1K4{p=&=4f~=4*e=3;Qh;?UxkJ@Ps4l8G5%IYz}w{*e;?NH=4*HlIQsjV z2zZ+v{e7*5w@}0D<-n_rfOnPy?->nG{dQ-2yU8*B)e`?RY=)bL6*yrqu*p5J3Sv)>{|f4@e<+o<79ag0al z5%4Z`j7MP&?{*FEphLev1iXC?{qEH8exu=4B0ijL<&hl$?_T)pYIsjM#-mjc@OC=JqvIOh{Tkj%$M_M7fLG)g zKfciL9@Oy8aNva_;3YZmjB)MbQI&=laP;?O5%4Z{^!FYO?;#D3lU?9!YabO6@V<56 zb=UBItKn5T^ke($tbe)Jf!9aF+p6K^I`pfFfcJApfA81u9?|eDM}J=%0k4OnzaORH z{a(YXcj#9a0q<#te%Tt{b`9?~hko@D@YXx@o37zKrs3V`7(bdK;Qhuie&lL+J2X76 z1Mfftye*^Ta$~3$`X?PP6AI`S+))E0P3;z0ebf1Rzw1zj=fp;uN~t@Tm-yQ$M{jN;WcP@;~n3dybH?@oNeXN zJp$fr2i{=~?*$F7#(`%=z)>GyGDCBga4Cx8TxhJ(Q0UM&*Lb^O=k$-0*DY>hAx7R896R#E%gBZR6H@0mI zfyPB?X~Qjz{HO4?&+wr`MM&C+;Zh_w;a6Fc#+jx{k=VazOCQiin2CUfihDn!8$w$# zIb(RxNO{=hi7T&ct+$M7mx23Ew^8|ff7v!~W!UP`yT_0&V{?*!*woru*3Wx(i^p|# z3owS~8MAyDX3CujxkKwc32VN+Jz;;s%ZCvAP@+*`zWf2WV_l8!J*#{z^ZmI?qI1h~ zbMu0^xw&O`TV)TX6)yDFZuS?p)|Wl#6+Y2rExBczf@Nj7Et{?HJ!{=E+7uaWN`aNT zB&{&VTU)?rxvk!oFRhl==(P!3`*&?YtP{Z&AUtT5{VMIi1OCFz-b0nG2R3^{rB;u9 zFD6ID9B%c*4T_`k%=4VMz|Hkt?x5yd8jmD=9CzRcKhRnVB~W22z|)$4<*jY?Hy^2Q zIpRI=H|xMV(FdAy4;&00IFQ?X1kSXSM_eDfzK=&{i@F+xYrSCdyPDS|*3R%xDexBF zU@_z}qsJ#*T62E$J#FGK4*Z>Bhb9?4wvE_wGZcb8p7`6{_ndCt9(}(nCB?Poo661p z>L{bK+PgE(D0|vl`FpE+jL~Ckk1$H3Am_XvR2gKLR}P=F=A_5HJ$iQ(3azp>x3Vf& zS(#hA%?j=E*FKk)veFfL+FxOAdEtobg;0vakwXCpc-m+y23#>Vd@~)q6-7v3c z*}^5)TZ8=%#GO+I6&5YIcHW%j7ec~9 z&>%bJ?7{xQ!~E%kGy01v>bQNQxuc8|sJZRr#$RxkN#`&;lhC3zO7|||jxjLA3;K<4 z#~PdmO|s?V+V&W`5`IZWyz#CGwdW@#83_iJN_I(4$02&c*}nPY^4W{$End9jhIz9W z%`3oJdt%Q(wFlcA5jv-EH8y)Lz*czB`7zHsq8Y~grPY5f1nnNxfZq@-sN^UYd z$OmLVF7)F!S^RVq{tTo0R$O|zg>bXZDN=as-*vfxaIh{aQgYA3LzjC7j?VPE&>{B) z+!&E#W=a&ErAvafn$uQ#lR`M!nziJcGgEFK);?l=PmM@9+ zBPqEgFggVHlqi$ojKX}-c5@cz&AD*Sg-i0Uy-19GKRGrI9x`mOko@VfF})8G0I9KY zGPQex4U+`_eV9y89BS$@XdCIyN5zw zVmvJid&`@Ccrqhq;Dqh5_f(wYIcwmhkcVW-Rc3X*w`UjIyWLD+ z9*2_H>Ui(Yc#h@O6O1n59-DKTemK@ZA?O^tKl(^4M0ZDDlaMnkF1+3ozj=LVV|{3B z{e~gebeVW-m++KuV`PbRJ?TIV(A#SM|_HDSMJl@!_b!UQ6cCWvDqR}I~ z{_YO}U6X3#hD{*fPUO2>8-@U~NAGLm!fERVKktc7nQMmE+u9n2G+lW8#Bk~QLD3jq zG`lPN4{tDnut7-@43M6b;!dIsw&Lw0+`ZJ7-{9{VorWyM?2c}B8<`E(_Nd*_8L8ll zVOH1f7*RMqPgeLsv%L8)!e*YtH+)ytO)IYqZBJaktJ}^7@3yD6?QQfJjh7nZqK&N; z3GmwRbor&mUegevhc3lnz4fkxB@NzkBoK{JxiQ|Tea62t+vu{b$L1d4oNYf~`;n9v z+$9bE@&+%4IO^XIqWN4FSEZrR`?8x5-$kKfOw)FRX0TS?2=~~ z%`pZHSz(Aew93nu`PiKeQO6n#k@o)BBVCZtpoE-86W*wO+ui$Po1^JdZNRw7CGY@d zCnd`bZRB=WDoU%Lt0FGt4YR19H)W;iarIwc{i3&L4A6GR01JBZ(Rq0*wTGML?J;@4 z%8W@lEhgok(J4Ho zskYBvn1ZdKj=}qTyf>Dcom)?!n?GGr@gC^@K6-RKYS59`wFxp1wi$U*AVJM~U)23x!cyJZou2-s-8V z)53YBso|xiZLwNg8OvZFy4{5ehZ^!;%B)~UaT~N@G*GCX(8Jns*CqcXZar|fyJiM$ z*c*HrsI7060Z>53+N$Ps6OgMTt12VdfCV1U%^IYp=fJFXJ!2C7Lp{SmQQ338iqSx& zU72|u^vS5mpqd`rT?+JfW-)DHr|?(96O&S6RJFDOg*AxHilo}pe^YUWSDD*m7v{}6 zI^keOasR2Asl$p=hXVJJr9gh#j z`jw`xnmS=qT5D^Mf|PrxUS08i*7n{FxyVTa@V2|^PK0+*<%FD_@zo8vbqAY{9*GWD z39po6E>C=wfpKkXl6ial&c}YeJ^HC6b9;Qn(t?b|p$(SjObq!c{bEwCi~@R0H*_<( zI~%4nHUxy709q7X-7uvtZ&lj<*z8o)3V1c5!wS^-(8CJnA=j#@DOXZE(ZT0JZzP_* zX+Cm!u$4c)Q(IflZb_MMLS&rV2v5zKX~ejUQ{&i1|4(c_{HQT&$Aqek;AB@(YOj*i zb4m{mPVHHp%D0a}@Tb00n-fiLi zqJOc+g?=+n)Y;OdLHn6kjOi1jqhl7dUve0Jz^ zBece>+~*DL^VPp-)vsDnbh-P$KCAw~mxnHQ)i(tjFE^WCi$3(ycb9%}f8zTWm*9Iq z**(FsO8Kd#ax=f>gi5^=%e!o@#;a!7UoycEwG=-yT7p?uSU6P15YLRk;)%0gj3HwY zFxcWD_ktZF*aX9}`YyA^Ob(8*maWJ~sC91Nxg#xO`MhQLP_Sy=oE6LYp`jpe;i7qS z6O3ioEi5b~qdW@pmMx>Z9mbAtSyVvaLK|z!v~d!6z%Nfv>Gy|2zx(~aPY=hxcKN7p zKly9-VM~V;thu%MH$}s1{{HVHkNU4YRV)25q?V9QUL5J@C|$N3$OL^;CaT&v6f3{jTqy-!`0iR>HJTzk0Aw);pKqd&c$w z!JFP&G=jflNPH&a3gCMB?1lY5m^Gr`uO3>PbnlA!<6;w1p15vuaO}VDJ#znniT&2B zy>;vZzx(jargOJGx9aA#-~4@Q%d^k@^5Xl;znif9jMc+O{qXB$wf}yz>)dHg-p>bw z%2xj~|Kx{Bz# zweO7EzHR?M(_Y?l^WSg0WBvo1w?3ElzPBtU|Epi*t(khu=oJljetdUq)YwP9`Q?j& zk4{#-{!Z7AS9e=IdF9NzXMMiKmpl4j-qT-R`s{#Ze`vXN?aJa_!v@A)oEP`EK^5MI z;*;O`;^l)MyZb-z@uL@R*&JGzI_09f9(pt8iqUV)yk^)C)00{GhO0FHs~$IVMHc3=A0?YE71{_4}`pZ|8;syipTM)hjGc>Cfzj&4pZoBrVS zuP?lIVDzH2>0a~PtofzC-~Xw6n97}a=#?8shr@65`0d?a+~o7^go)eiZGm6?>a?x@ zUiV1uzV4MzZTT#CasA>EzufOVbK!k|9v1rg$;saeoNev6b}Ht%_b-1xW5^kI*N^<* z)uMun2Hm^1_Rnj-9{$1<|GD>_`0~Pn_(c!??A`K9t~<6l^WFo`t&aMqVY=K=(J`@c z@d;f#iCw#W{0hG-*}7nv6@CDB4EOqyPP^ry?1vw|=G>qEzV*Ar0h24YR3sd~Y4)W1 zrX_#*WKGsDCJpMJ_<--ix8grZ?)BQ-`ll`${lD=kj(bWd>g+q53ggpl@T)>Qxs5Ky z)AGmuHSl(I*j<70-Hh#0oZshMZC~nbPxmSE_`{+`?hdP!iHC*g8o9CCC%^xY*al5w zi1CKh#}e+L#*NZF%4GU|jeI;w0bC|FS}K&^G3@xmjn}06Fv4BUnlEJ z06u1iFIklD_^H=z3^2Zx@_r$oZE(*y62G;Xm+Ef^yeUTai?Y0xd$O#*3*eDtM5Bz`iSl@NY9qQYka#WN`5m8o?vaKgVv>=FZr67E z@kqiSw0CKMjQ_4ok5Y7V4<|)*H%a$$@JZNRC(98&N!CYGq<6Nl)}h~5670_+Jk|Kx zksig(EL(`SGNnnGwkgfYDC%z!>;cI$-WbU<-c-pmUcThnh6MfuFd%_H(dGrF)P>)c zlfhH=3dvKJ->d0Q{%y%qMqo1695&*&dZo)|22 z`V)hs?7%pt#24wx?umS|EQh|5rz~3={TVLeN}XAR$?>>>df_6^a3OOUeWk4~w|SAT zY?~MPy42=HA2iA4MgKa*<^{eO^d&xcVxNzTX8}+jp&NK&6OR7G<~T{7*w;#)*g`is zm@&S|0tX3w^m@|8_Q#YXBN;s7og;b1drb07_e;qWgJiNIfJ9od>lA7EZGT}079dEZ zE4xc!2icVhJFpNy_>;H5B!)$PC~lxWxJ>y+j(+52H#(3!bRag9G-Y?nXeKKQh!0bC zqwF0i&ol$%Wp_H3yzEM|$;)nY5_#FBP9cxD=i)h?yzEM6lD`Bu(ABui06D|R#bpj4 zXaAjqaq-_+fXgHRNZ6c40wwbTPg|ZPdD=nLH~3SG@hQXnvIxnOCgM_YsV8~jiM9!z z`CTOaY2zi5xA0scdD?iLT~i8K^$rlK#KIlVxVc;Rfo5i}LgF97sL~HxSb^nQ_oiT$Ew? zpN=az6*mx@B6;eg^$$v(>2P?a4D}NIHh89arSzw*_?w0@7M_ig zC(f&qr!FLOto>w|nQ8NkPo3A}c}m`?2#ETbV+3pGogD+Hv%ItZFg<05Sn$c`;ReDm zBY38tD0!xzBzdMU>J{W^AJLD2XZpyVh)bJXAbFM<&5rUp4GF*+2{1?f5G_%CRAX`MB90F^5i}HghR}rSTZ+ndESNM6g+XX zAwMj2@D&FI>b^XAkH;N5{dh95(~pM;+kW#F<=GP__}A#!i&rdKzOWDn_2#dhy`p`p zMrUE1tI_F958^DFx2Rw?zi~;4Q|5d)gfOFK@x1FP?acSQRfU*WGjHx}OwfUH9VP6u z9V196dqhHDxHzf%$KvxSZAW<9lotD}#D&){RJrUpeZ>wIri1Qn(_&6BMJIAjBiNq~ zmvxf)_K=PRN!!ov7^o5!8g&vbv=@Q%=UtB(I?Lz%7(gd7w${q*?TNSh)7+i;vpTl> zx8=lPX`vhD>J%-fB`Bq`^rM39$uGtnue|x3!*u=pm+MBzT934eNLU*Br+JWMirpiEnDDF!jYcPNeOm1-@CAA;q}Wg zEvh{YQ6Err;=FV=&cY%Uu8iENh)S|>QQq=`B}I#8%b8Wqeyzg+;t_MzK}w~ol8`;5 z$dwdy1o32Z9L2n3@$BWR3+J_&SST)w*Qr;>9kAdrp~2rWN`0Hsw(M zlXb_X62C+8Y*QlNC>8ec5p?K8%&z?Z<)Nk+v;Kh}cy2Lz*|&zX4P$vsy9Zut1l8kC zUImGFBoSiYIPQ|h0?aALF;p8ffIh%e`tj#G!>GrlV064k;pohM;~aRo!1E(M_2bWGh1b`CR}VaXPf|oVlI6fF z)AZx}l)~HT>ZspIxI44ocK9<+02gT=@cQ6M{kq{&c$*w}Q7A`#H&8@5(rpgB77dTT zRTbVzi-q_#UW8;e8Gv@⩔oMPvL`kjVL;qhCSj>oxxw6h|G_o@TW0-mZb zP_+&3IY<4w4|sgnRHX2BIqF|J@L2b$-x;`+ew7ZqI^Zo=U{a3GdmVTo;7x}=@%TQg z@W#M!dVYB>NoV!%XOLr@04~yBfY%34;_)vR3a^&~FMt4kUsOan(pe6?lfYB$16@)Z z-pAl|{l+3+iwGb|;T?yYd_ejSh0(?$BK6~U3x;`cy@E@}s|6m*T#>@t3lAM{6$-am z;-$(k;w?oz)$wjYXOXVJq#T`#AgANa#1E4D;7|R|#ijI{?!bEnc>Md0BBkHu4!kdb zR}UfL^~I&|_M(31`kh4M=!bAc3a0#il!jpLXw8b#ul{)Y&{7_sEe?^od z-2#SufDTYkR62z>2yTWE?_pfJel@^@3EPNrq>Z?Axmw7*Btq<)l3NES`GD0f>R-==z6r6oy7_W))>9W0zGZEPQj&xOiuR;VJ@4g6lMG{-#y$w0qMUhI^bfo(QbB$rlW|u3qpqUe1su~s?bI%zkD&!<+vZ3KE5fu&mHx?26AkVij-U;81gFY zFy!VcAv_tzi|2*$sb~~mf;3WLOCYDOJ$MxT0pA}cNm(WLFX*Ri!XV=D3>b!I;bMMi z_c_apX3s6kpRd**{M6cmjNx+Wf%VgC4@PmI2eIz5mmZ_#(2GF=^Qk>u8mj`ua(-oX zqlHOn&0^MbY0;XKrJ3#X+@yR;quD046EVfq*EoZ+;7f}{1mI>&1IK5+{VeHy878Xr zer(^_EhSZ<5p_|$A8R_hB_mU;_@kU1Qz$BK!>f$7u9PP*-;HyyuY?Wn%g2-E~a8@z#<6Ph>a-lc#gGc3bG{A1vQ|g`TUX-dH1qq1OJGnQ6_@MvvYlRd;MC z?v2d6=&eZo>P6Syw_1TJqS)GtIhIiUZ*GN?-(-2>Jg22%=3`Xp)NA4(56i?HiD`B* zkK@g7@TwZFt_X9YeaQ>nCtrAD)zp4L$U#SXvD~VgjGa}LuuXG}tsy){brBAj6^?0NQKi9f>V|R{cW1mAdfHd{wAC2zGWPin#k)fvoAs|+wa-|!O~KrKUQB;b=?xw6ajN9u6^ACc8N2?=#tE+4y5Pd zSfASDJ8YIWB-^#%8Lbxlt>S%T615C@tVzQf4*{^!gy+r|te*C&5qNrH*BJ&p(cn-W z9rO3mhCPY&S1XpdPd(StfgzLxGxz_cC z-SZpbJnqJ-5HZngX!hQhRrkIewSp})|FL~J-^4WKr@U^KG{n7JhY*CX_3Wo!b-tXD z(O0e9AB#e+^QHXUOz9(}Y5=y_Bi8KfkD0iyx*-l8yAu#&aY9ZGR;19arkdv%p6;cY zi!p^dZYR_beN5YQ^R}FcwJ$KuK$=PP9hv!;56-_VJwIoNG0L5hpPh*g6MdF#UnG@t zfotH&5p}UgVpl$#FwSN4xH)t%xU!FVB#L#+wL2OU$Jw=YVm?P5#Tu59hYj>)gCBc& z@0Dl*#(eTkd#4*2Xe!B`SW$0t< z)@>i^wwZ^zefk?|VY9QE{TXWZryXi`%YRn0KlFw^@in7nA763o)S4Z=5;Z%vvzqPO z&jkQb^&xl9xX_+CFQvlV>A~&pI(87@RI#!wBX~G1XU`Y;4P0LVOVW;r^0+&k*&|$< z>2V`uTo)rH<^+rbkw;M3g|SB`q>M2Zq~V*5BW}tSpG*?9T@;C17D>mt{&AwSxHwk+ zzog++?xKc8o)`?(L1c`}o1%=O7cJJ8*iufSM`lWwmgMzb^ZDSsUKnWlSEWo7v%jN_ zS)1Tq7(FnqBrmljbzx4n(GzU1>V`!-utKA?^&pmK#H6;ie$2i%TjMz|`aBDxBH z(m&0ZFcobeuO!cc_|ArblRTb8Xn-6?89CQtY*wCc1Z}?yuzsq#VIYtvc_0X}lnYGY zg+0JqmA7CMI$rj<6H*bknDhBrdQ~Zh4TNWJf;^tMBNUm<4(^T$Pld$x*f4WBAv(-V zB8&Nv^U@XBSgT%kSibgH)|lzjW{;hgIo|3wWtuhGnm%ntR)1@x)ybT5hvc~6q${%eLo&g5dFJ<@ z{b}VZ6aLct^J5uP-q>*M<1bwF&hpo9{msE$bEn_*);TYH*r)y*Puc15R(a;&;aOR0 ztsAa;t@`w)iynL?d`alwz^76Uh8{Tj(&OPCsac;^{p!`G@?kSBc;oC}C#64XUY6ed zhWkEy@-L@7IdEnD`|o+ikG<>Js|xS>pg1sX$fhfPx#F*9-ha;a#JyYpzNlC8huw$N z{4&P+;MI%Xdh(5@GH#7}p+2)QZSUFlUN!6FFBA9W-!#uR!~3rXMnC**&uhEaFMsRE z`>u26q#nrldh4EPw_H3SP&A-+(S2_{KW5Umsq2;vU3~wPmwLZ@Z{l|c%C@&$e)Yu< zFFXI8{Y!o~a@E!5!u+k@pTEBP(yyK!|LKUEPdxR}xY%>&+&r;|Ipnj(^i6MF?)%-k zsh|C99R($@~-)*?= zw^Kt^WzT-T{jq*uJ$2UyCqDn{J5@W^9vF9%XT_J_+;Pr5$t!lQ`GdRq?&-(Ah%fkX z$XtKmV4&N3E7y-a8Na622Q97&<9}hxf*JT7q3FM#C*94s8oxbBN%(={!mpPt@`p-a zlWu-(Y$vz)+N!(xYp0z~ofqwl-^2J=;y;UME+e%)GC0ng*2#TJ__=y8@i#l9-*3%wbx z*4rz0R~j1B7Z>NnULf7E!rjIAgG|qMdyLnmnHkct|8(a%-0Nierz0#0I}+@d?yH5nuW`1NUj{vr@O87VOrPKFlQ6G)pd-Ik4ts5a z9BI3VZ%-03nRyVCGS3sN!S9Zp&7~FdQ;??mE@{dSs3I;uwu10kRm_JaFXqTVCx-Jo zkD4dTFjInvxcG)iqL(Rg@EKCfZ>2vzRkY2A9Vq!W9i;vuuAkEO_ZgKJ+S#p`C1eQt-18JB#6PB3pv(TT4fQY5+Lm4$cH&yb~bGzh;*CKh!#xh+L4)M;EJn=|8`-Q~n z#rd#`ly0Joqz*z)-atZ6S$4!#x(x!KoJa|2H}J&Rh>QM=ey`+-@r2}wLF$mMEIW~| z)RRdj%kNwRB~ScGl9%dr#F3r?N9ru}mzct~dfkxu)$2wd;!7n*N}d?kNS;COOP+Y& zOP=K}=J!E>>5r!U!BgiP$~cl9_#hyugMDP16?tJp0Z|V%FIeP@jSnR1 zyaX5dl0%q1amDDsHg8_$5` z88ntWJwe&H%yR`R%1+h8DfFizpy{}X!+4@kV5b6NUXsB_;Ym31wBbdPrwv9(p0>F} z^0dd5k|)MhlBYeck-UXxzT~OKa>@6@^LEJ(#B+z_X%Ep4KnL1mkMyVf-y~1lyeoOy z<|D}m@I060j=0q4Jjss*-(T{y)5VgX1fKmr!FVjYM;@iEZJ6~MS0iHU9$M6%0x+Zn19rUL8UmE5%V!IgKS>W4SCp=t3Ay&IeUJV zEpvUFj4Gs`5bHc?J=s$sPtC2Sr4awoy~9qO5SPDb$(-xtT))|Kopa%wp(^=Prom~( zQ8JF)|5SlErn<3Vh)HWdhO7xFo1c=pEz`NJSMl^?A@7u*y?r3kA1CyoE8s}(# zH*1?oNQpT`s|(Rw=j2D6^!Hy*!Mg!34eZ|)ZN-m@yZ9m@3B!XRj)ml7Y^P&2r#&7p zh~t%0&LiXS!EuAc_aE{BT%<7G(>ShW;-WqbW4u>z>39LS``}Wf@b(jN~&lv51(fbBB&X!_xGy$$bOD68WYBCM~B!-v9q2XZcaO%h3 zLJXsReZc5=74TzviYP~_fsig&3BS(dUUSIRKu-T6q42mCTE}aOfVbU|-vf~AtbA)6 z`Q^)IAILJl$a-6TH#qR#Mi}3L6e;~~b>Q{U@c7D0IqGqR11}kwvf!^s;a%py%LX3b zfvBH8|1RBuHxzjMuB1re4RPSz2fRfPA|8LIEB&1F4YLuC^UiAyR$(xz;#W!k06jss0gv`4 z9$ytHNB31=biCW(racr9j^}> zE#nh!fRv;AYv`iuw+eV{KZ+Fg7ZB3%{2JaM2s4a$VO%;M&sm=dKSc`fW_aj$qk#7v z{HWhWGK_fnxOBYZz~gr}MGB9;xB3_ydBi=wij@ zKHsYn<%TLK>H+1I+%HjX%Et63UZqTP4e zd@&e`bU5E@iPR2%hr~RuO3q;rlN;2`0{Ev?8#@soXFX_t-^RSKNb(3cRX%Q0YwLz; zY}#78Be?5Nm|e1yJGT~uKWxXmom<>tRzcG4_+3qn9;5zX@Xa@|qx;|Pi|O%n!Nv~< z#Vf_2{qQ`@|MIwkkY9)Pi$6n~*SIGB7CV)4TfLNPjg2!3{`tw-E!?4v^S!!(nCsTo z)^4AIydb)NfZL6Xe}|`NFcv&Th`9HG3(Y8wMTeqPfh;ZCE6(m57$804jNwO(61P$A z7Q1C`wyNDOW1DZM+Z}qvtbEiGv&4c8hEc!G%Q-&SCLXiL!e&{8Rapw*sGaU;dzR24 zcZ_kwcg!6d`oTQ#j#azcsy!U6KjOvq@AcX&p#!_D+J}RoZGK{6YS71i&o_^lm4EPx zG%9Nn4t(Qlz9Bg3Wo*rMijJ zdohvVK-e4FXtmV&D&O*A4#1ml9Zo!O#20!$NU(n$@7nx{51Yk>K2`1(fFH3!@87Dz z;W(xO%k01pmAle*AA4O2Q!~hKm{A$_ZrB)(s}K7^w_EjfUQfKIm*;}8**niyp69&> z^NH@@1PLQP5DIPb^sL7|iigk5!%+In?cMH=H9UdZ!cD7B7~KQLTUEIqdkdenDsS>l zMR&E*JFUu?b#%%#-UE}lOJBx8|5)#o>DGa_(RF!Nz!LPKDNcgjku z`IF!Wo2FG8v!+h@#M}J7bzntsVDzjiz!hS%yc>f(qiweKir}nb&-%g@!oTQsPu8rZ zN@xbkiqflAwEWwPJ@%kwS^cKKcji(|Ezc{&0R`}b#$Q+EF7ei{^P%-&f5_0UE$czw z($-d-P*4`O9`V)x&T4+yJc>CL`@HpGtMWD9Cd1gARwi79aJ9B#?=#_QIV$QbG(K+S zZV+<8vTSeQ6RY`dADUqRkPlcb7X*)Dxe+>f7wDm|Awf_dxI9%!5;Ud&|nL z&;Z}e9bgfj+S)pElhv2(f&Rgn4YqF?1diJ5f%Ahit8BJs(#&F8wBL#5-oBYjrNryM zo#~r`^AR>%E$^5!^K91prVrTGAR-qc*QHkF7PBqaE#<*>{%+r@G}{g}<4T_$=45c<+$_KISrnwZtviT|Y~<&A6BeCYXCW7BtsJ;z@9?qt`mJ#Tbv ziaQ+tM%+vB8^h%i7Z)kL8Kat@)W=2)Yo zGPL2LjZX;fmJKCqKJX;$tUTHHhwlzOwx;JN+dkj5>gD+hVitBQ`djO&*wwwZt;&D# zyIoggM^A`ZaQed7HxZUUzgPZ?AwI2Dy^59uS9L2|64?35$&K3vY<@rE8I^Ngzu4Wb zAJI?P>Hk|^st=hv_jr-1HOD>iJwL=q^8A)V#|Hi41JAKRvp?v$>)4jhi!S76 z7hUq%^{K}OopWqa;LxC6hZY54+l@~T2yab)rCsy?P>M;2ym>35o1NHK31@Oim?KWpVpe02+2$+TX6?iv^R%xK zgUs6|1_~V7fqA3NPkS+G^n(;W6ssqj`|vfYl#&6O4L{>}c- z?}CN9gjdzBU3Fb>R7>dDVBssmXVc3sH+kyev+gdmY(^{Iupt~5D)l$t84Ud0EW6)2 zoKiO0KjjWF-Vm`Y?DyXtES%uo)Y>|6LUvRD?#qIOUwDJ9t>1icvRlhZzaMDn+?9J| zdb-(~_IG#D5w`Pj z+~2#=d)_fu%u}t+#X;`_Ci*Xbg}(-chpx;I1C><;y`n73FvWbEzfKeY3~ZNPweVwE zHH#vwORN183prHzC3fRS+J;?z53~I0SOZvEb;09PQC-T!G~>g0J10klFqc`>x3c>z zcsEXtMfI=?p7jZW+pOxzILgH;tNn84(Vxx}5#(owX^I2BRv8>ob zSy7Ey(L1wTHN}Io+~rwDNtT(p=j6tf8w+xhzrl{ZeYiFN^I79c&5{^5rbx!PFr6_5 zTML)OnAkHtCbl%KBqpXbb#P2n?-=Z>k7PL|F;wF7hpmcKW3#U&4Rf{ePKW$f1kpNc zrlOJ6-j@Mak%FiwR3pRWxG>XESf$A(bT3vOPi$=^c zX}GLdS}iMvR?CW(TGtfkO#jlh;Qwu(a}<5fPxm+&!~X|*9P}ZqZ>U87NsoiBg|!&9 zvsqOyv3L~{1Cv175`WK_esVJWKNJYYt1T>*hpIMK1`3}eS4SmYc=WO!= zd)x2PB*XqP(LNhmTVFc3?NQt3?z;*f@!sF%C}jR1eEbgw1CO(S>&{-BSoxOU+ATVy zhRUZa(NBc^2heSZUQ6^@aK9QX{LTx^Z@xpX1NUF=D*T?^)HmM?_wJaJ1JD^+OT4po zOev^b5Yv(qES%xRJL*-lW=2mb@VESe?uvuT`PE%`(fgq4n;$-Q0pKftXl^ht)6AV` z&Ahl@aqc{SbB?#7p=?GaBDeZ;1=u5-uDZ&03aqQHwjBj`6&84}UA!PBx7CmSFLRIg zymwvW9&i1uGW1RLBTGF|FP(VfXvNZrn@`4va3<9fZ@(QDHS|L%fm@yG6~Ic#!w0Xr z#@1OVxx4FesOeDhOsH6!JMxUohchlwa7WVn-Qm6k6wRDG0*8u+g>GLie!0<$Ah>z2OiRlJ>#a z^hGc*$87n^T9Aw)MFwFX!Z4bExpt9;G4q5lheBC!^qa3lT{_tZH3^Z02C^QZi1d2Y zp@7T?o}g4YG%@bx*hYHwC>9iT?2se;u19nllFx z3}IoDLxXsY5JMP4?1nDhIO^E=F@)j00z+7x7^TDzhUn;BIcSOZ7%_wqQVwApnVz=n zA*@LaMz>k;wudlAtO=rf<5*`8VNgR1VPb@e4wb5b5B@(kg#G{H7f00p%kis|*W!iC ztmT(2S!s0=^j~?EVQ=oFp*gGcNW+iDj&_w)9S}>suvDTlv{W1i6Kmj91boZFnhE^W zPr^GO4idmS!47gqdCTK1SW-E+bQ8G~ycK)GrAsrata0Alr9pZeOu575>9>A()ToQ` zHFjVZPu%+C=!0V0Lv-+?!lCsgjZNuQnC*WMuMgpdlDyNxJ4*7B!bd~vD#LM=c$1O3 z)#Zr;8^-lCN~))9C?1S8Yz_D0b5HkZ*mxb*#N$tV;n1xS zEL~iZ=i~YiZ+NP(`K(R4)qTS1F^RT?Gi|F2TPmyTe%rZJLz<54%%hp9rwvX``s%zi zhxrf~K3d+8Etb{oYzS<4T3cCH5Po-Eg2TKx4l}a!;5=_;p0CG@m3RF*oK~?Z^e18c z)Rbv2k4z zyLwMMJq4Qs_QEL+=k>o};6-VJhmJ_Uc=XQ#W3t9gm^kV3sne!kIrHb&{30)Z?)(MU zExx{R*@_!h-?-*ip_^}ASGwW0-)t(s^PY-(?|-1G`r)lLzu*3c+Q5+5hT+KfnIhH{N{vo#uc1^Suu~{OHpYpMCM~liz;-1I||!^n;{cpst{1&xW)Hbj3eB1k?OO^A9KR z4-di6IHtUrk}>H62NV+_bnzd(7(kW}5(Pj)#Ev9fLPW^OKt{DA*;0(k_yI4z$BXas zQAWTUMb1mV02mOS{QMpTKZJ3yKAzykxBLJl7)BT4h}ghE99)#Q{e&F&Q4rk0}bh;m^2226v|076v_tPkH-ddX$BJ@Uq}*iO2yw z!84-Q=HWCf@bC!`5Mkiq2M_q;4x%4;i$O-f<^_hpA|_&x}&}rcc8Mx>MXY#V( zL4qHzVqU_7vQkEb^G134lI*x43%KOz173vkX|-d~&&1`#M-<_w;wcEW{VGb{J*J2`qsxVo;Xp8ErT+J<8G_|15Bjqb`sIg?JNLz+J|rTVhy}N0<;4 z7$Lz@hBzTR%racq<;)dlM2S%R-Hp5}&cdJP=x@OvJjjJchl_+K!@x;dxNV*dle?xd zu82ooU;9*@9^|JL;m?8~Zcc#sBn6@n|umlf( z6G0~b4vEV&GMNeCXBYw7FOE<8AsoCdlPMPfA&f~08S<2aOdP{;i7-CxF#h>kq(y(h z;~}sqL!y7cPFI98J>_S|wRMoPDji_hc$p$DT|y_BhR|K$iVzV-J)jqJZn#8ALK8e) zREQ`D053iG=UDuQ2W067K2F4izlcB#8_Nz8;glz=2oOAFi6LZ(X{T+cLoo)};R2RU z3d=aQ9zss|QwO0JVQt;O2;D^h!-R~jD|z8hOs0)msK!v!hyovlQ4vp8HV_Jh4E-qw zJ_-VqVW0>SHweNLa+GBdZj2*j8I7`xhcJP`w8&CUrYoGpV1RuglARWuwoXik|7|_! zXY0%;GCib28R84QDa=F!rv0$fCU066&h6?uXHeFd%t3vJ%(eRUUB(5@bLY)5INjHI z3>OdLvLlSi9HU1t9cMSGGnPgSsCaJLyxLif-ZSq@ziM7pbz#neh5tPL?4GaR^WiP$ zE&KNI^2wjS@W;$M-W)MExNAxNl9_L0e|l^3ye+evR{iB~w*(iQ@U;5xqt2r#{a@P;MtsfBbl<^#swYZxgw~YxXzb*?~wwyOylRqybf-C)*k0IolDU+>TKQb7}icu zAugAgB`vtsR#_0AyaBiHRq|>SA<6NQ#Lw<}A&xt}L z;F?$!mD<7m3nQb0d$uvPgFDway@NXsJ15w1HeSAw)xkZ-xTb@9t`xQ(?o-Y$y3`SV zxx;;hahWV1&U-VB0;84<9%Q>07!8>7)b5^d+}$DkT4QU6@P)Rpyt|DV4mW4ex0Cyn z`sS=pKW`TX=k74;lWxukY$vzDQf()_PW-%M3x5y`8IVz*4HHPT&LaQ2%jU{Bc@g&Jl+^2!)^IQxR*5+RN)>Z z=01W&Ov(>yTSsoYGmML6eX`v_<4)QCeGNU5u&bI&y1B+L$(UfgDc#wKmt;&fvO9!N zHMmEhBHEK{21xvwmL%(^84z9^+}qZ2)5pxT{p0B`^C|oTw!e^<`4j%Syv&F2ztEPa z7taq;#4{8~Y|_aDlVr+njnHPc?I~oa2#9k?lfg5b(M&&XAkk*iY`za3YJD<4qN=ld z!jfk^4$br@9{WY|v=R3OB%chvujGmSxa2MHdnDfz{JWCx2mVXRv%X+DgTSGBYa~Au z{2h`{2mhetM}e=Ed;t72k{=8HWyxoQKP>r4;NO+}6!4!(emeLcBtH}U`6xH$g(J_+ zlFtQym*nSyuaf)%@Z1N1@{7Q`U|{mJB}ttX1rZ}zu7y6uUmIdgHcAj++UgREU#*MA zG}E@V&0ss?vjIzrh{FN`2^{cDhh(y_K&PZjL6DHgtxbNS?Jx4BO$?8SBe(w$IN*uH zB+bD#4(o&|hhB?33mw!4mpM$Z_Il~zHqW}E)?l-)n5-BeMl&-6E98^UviV=)L7wTB zN}l!kQOSGod|vXb&&`sjxe{1E5tsUkJqW;4-;1Qb1wJTw>iY}Hvu-buJoV*%BE+G- zzmdGmX4_d>#O1jyq+4(){(st5=P@lR4_bqZd=#GRB~M#zlRRzJAbHyA?~YWB^#5A&7M|Zpo@J8A`Xluh zV-|Sg_mKYmz-LOHWp%ma$AZt7d;t6nl4m*GDS4K|1CqZQ{6mt@1<&^eraKq>cF9}d z|0wxI;Quc9DDYxTggou@sq|;r4&~S+^&cU5>YuIoUn+UpAxHAeSC!gIb^b6XG2fSSwkvy!$@^ zJw@;oID2VygvHuSuY-Vy4&Nd4=CM|eh@Av=h{E%pB1Ex+C>_bDKXoRRt!>A1tK?n~ zy0JAFwP{5si{c6PBimCrf}Lg^@)L1oxZ2i2YALKIwzq(p+D|u{mfg-z0dJm<$qHy!#g+5&u5%b)w~JG-vjc~ed?(u^*qd%FnLAfj_u0$y@)xzA;lsp*F3S6q zZ3w9BkL-Kk2tL)~KOT38j_r)BZxCSD1?M&cOxP*b3k&v-Z zN5falh&nmN>_ULDL&V{2v*+Z`k-9iTu+@R4r89YzSAIr~nE0tePMG$b{wPpqVx2+> zgZwmP7sxt*!Ut6N(UiqgMk)|T{2cL7EjrAU6IK%t!$fKkvT%+him*WjUTGv2&ZhS9yxfyehF?dN$L-ir>rH5y*DhIbXfA=;LYNiqx%K}x?Fkkj=G zYj`w|((h*uJie!$WO@O&EHdhoja?v!D82vYi$z(qbFe6he%!(;kNzdZ0dUIpCz4XH@s@i&W(_qK+| zZ#4>UFnArWPKMzjNa69PvyOLM!{hI6g~#@&<2?g6MB7N=QAWr6Lc`-HC588tqrSY0 zF#dK>r0{k^PRHX90RCoR`|W{C;W_sk`3PYHaVb)G&izKZYj|fvSmC`2Ue9lLI0_Y* zl%w+{$p`2F`87P2pTesJuj7T`Q2VVip3?94k`K@mlnp%giOg>*E`@j4QJ*W&`6vv= zQ~aMD^|_*dd;fQ?hWDfc?>^wMzAI9AI~;fqYj}Mjtn~W;jGo`x2>QJXImQXdglaWB z)-Q$kq66;<;K|QHA|~ZXjbO+J=m0&V;el<#TjaoN0bZPlVc!(qdLYj~Uw&(181Z^L@GRhU zR-gI3RL6_DpuN6e$Zo@1i~Q;Ol>x6a`*B|w9nT9qWxpXB-Yf@R1@KZ4u80_<=?=Vp z8XiA8tNf;d(e-;Kf_^1Ag06c%OpT@je3HFW{$0;e7}X9dC_>$4{FIZ?L00CdGDM zzJna)5!Uj{Pnim@s{?O3@KTj>QjX4e2VSLy7nE|$|3>6b&oB48Nhg3LmEU#Jt^w&^ z2fSSHwBHz9O22Czc(uUe-y;<%Jf06nJ|F|SqZ6nBPrNK#3h!%2ejiP+!(=oeNB#>( ze(Qm!%6Ghmci4f)bME-}QAJ9>KRfXD0Z+BJ2^!u(M}9x*(z*TiIr951@N$8}{9dZz zJ?6mcgG})6wThH}+Z=df2e#X9vW9nw18)%qBZWas#gBC0eFQvZzsohevmJPa!0XI@ z-5q!*fv4;@Rl{2Y+w1l3QM~MS)}L}e9_kvvMe?GPx8O(nU4e^X)c5BOyqtL>+6)`OKB%~qn&c+bS^i;DaV)6PVn-i9Dg^E z-nQ(&4G9NsjKT{C9f>C%g8HP|?L#`-p#LQMDfk zDgc02DDxJ82kU_s*W3k*|GWLA{KJL}wn+cM{!*-aAp6@&KjU(#-Ei(Nb#>c0VQq_V z;ExqvV#}$v zM2_0cQ=y2R+S;}gi$Xi~3H&^TJm8RcD?lGINCC@5v?Je~y)6ami z`(pu>GSTS$=4)rSgxxoWOWoR532n+MdkoJriW+Ps5YICZHlcRlak$(0F3$i!3d`R8 zCKeF3+4*;8MK8tjK#UEs)xwwhY-8yaWtoML%rb5)354q_%+h#I zLd@5qUMPDgz4eTs92UF88Bg1JK38gM>)nsLQ#QD1D|!^|^=^HfOFr##JrYf0B%ngs zUN~M*dadcVK50M-rm(e4+uMEPlgIY@DG|Lt_J}z5D2!Wtix6sS5rP_DL zjiqNfTMX1H?!bdh$^f(Bg0_Px^}Ha?T32doYswd<&<4QcM|Z%D1CGft+hgi{O{qs%$Z)Se zt8dQBM)e*Zq*!N)(*rKhXg{y*VyHr{rjTa0T~Fk>p#l#Wio z($TF$eVNZQpJ>0V(1Q|$>3JrYJl(PP^WMzoxgb^SWrSw4t4l_j9f1uJE#RKy?6mwn z>7E|wE|FQcIP&ncg}&-N0Z$LxIX?+_L1Z$u$=4i3f$_e@IPa@_D$o2&PeUyhhfTiU zt@`Oly9Ok(iTSrsW-4B@;$Nr%{1f}Uj1;2qn(5CF$;b9jR9Tm zjA-GK0wbdOnR{PoW!f+$6lWPDqffc=pAUEv;ExodRCca3kxQW`d|lEvwF+%0kMF7Di*X=62R=uBdbtHlX= zEI3C$#5xrERQ0Oh_qFp3J4?E;4u3*%b%O`G(}2_66L0PkEob~t2$u4G>7?qJX@p0s~v7zTEo>d7M9L5-4T9LP5HN5k9 zfFo?r?#tNN2%p`eyGn3FcEgQSK*UKoKL!l47H5o0F|vabiqq599mkn)GJNm9Tf=!P zyAPe#AolEHuOqO~)?#qbB;(RAR3ho)tW&CI%d z{^F_AZ(K5L>C8pL3Z~AvEMxj*Lx&ApdEMocM)-#f&c1Qgs%bfsS1*{gc;(bN^C#Z0 zATc3rSzcOt!Rmr(8J922$(lTC{-VnZuUne4Wc;MdMl78>EN|*%mn|H2<%o;M49Llx zn>{^q;+*kUO0a#^Om6FI_QrQO=6FIsU1ut{b*=#>BiSS6#Gf zMd6M9%T_PRDZF9fiiMe%Pe_}8*~0WCH(W9E${U08v&JMQ{D^@P@%#OMVX28xhxboK z|L@nD;77Gaot-(yc}Ap3xNv5wu|a+#;BR$Thrf96?{oZd)=qBm#b0-y-R=O_*%@?d zF8!|%?&|Ot3(EI37E6TlMEH2=vLC0eRl&zqjodh6Os7-VrtphoJGl*h0c@vJ*PaB8 zdeaX777tU*($nR$+8y9dT?@i5JniI0{3|6Mefhhhk94!7xYl62EDsg#m+o#NJl=SX zKS(4o{`wB#iH7>UND+o#D$6qfJ_&z8m?nSh@LOdPW^(dpv?9u*n`$GvkF>dLyq6sA zg${k*lj%{6@ijQ%#sSWP9>zV%IM?`#BftN4#NQ$1`wIC1Mx|^oEa@byMY>YDXAAcb zF&`GJAf~_8q2DHlyNlNTC|@ZReg@AZtX;wjN*ghJkJOLtBMD!8hiMsP__b1BMxy(5 zM}8i6;7xb9FO=^8L)_cIM^&7Az~}5HyCGRM31JBY>TV1W5R@Qduu!v#5I$@T)h$pd zY=Dp`5fVTW3N=}6vI+VYqJ@CklBhLun_Eax1D0MkC`1sipsi>xEl{iYK@0eWACUL| zpEI*Ld$Oqa-uL(32Tt~xnP>j<%rhTn&Y3wgtZ%6}6{^z`{(Az07T`+78&j?aRK)a1 zx(9zic!d!CZAGT=Mm>eUDW0BX@|WrHhwpGmoJY{vAVK8QkSB(-49L@u^@+S99d>27 zzyXifX9f;Hp*n-mwJ=uD8BQ-4hM}mrxGvug0&y6F7SMtQT zTJpr;+!$pjd$Z(;M^fvbg$`MUpU{B-Adz2o03bImo-IdN_GaWMd%xtRxinqsFK{HL z$cyZvMP4w-Cy7^cvf~i1!K9r<{gJm2CZ7hL>56g!Pi$dZ@Wf+pN*Si}W64u?k>rWJ zQu2|yN&t|^qcjNnq%`nMiv2Y)~)PQg=_cPRQ(wnto6LXgP&)dnwc zXjBkX*V4c<9_uK1;;_icQ)f|*;E6F!`ZK??Oni@Yr9CO9&YvTeS|=~`k#-PeF$RGk zQ5M4u-h&_Yy+#)KT*E(`yew0Ss&6+&l9y#Vn!K#HjHbSI5_!k_V3H_b@YJ1fY2can zYa~zIZ;(87|Gwm@`+Uh$_xmL8!S4piQ{Qcpr(PdQp1QD~V_MYl67;3ynePFT_kh1z z^28~YJo8;8dFK0J$rFEz$Xpi6-PSVF4ze1iB0YqEyjJinQ z^*!Nj)Fm1QL^wTOp6S0SdE&eydD{G6k|!of z_uvmm*^O<5dh0jQSN8dr8$9(^-+(YaZCij}VMFjU!81Lb83i%V>RTjKk;u15{Uy(I zu8=%s*-cQM>4-ibJkw#Z(VsFCBu|;!B+v9`OP=YIbXE|M$d|lFh_)jI7$*%p!!shs zW|b}}nX>{5+ZW6!EV(;SUKtfoz929^mjAr&6AQ&!M7(yMBTw!sT(D^I3M}~J!eF(Q zv1c%2NulV)i~usN?2bZFtCoq@Eu(yy4;sE=YV3pRA z1yWvlFmVAOmx7!97h%Ei#j-jtuxK9gGOs)$qD-a`nAvD4V|Atq7wgO^B%YbM!o25- zY=o8u?phEn5-XveQauVs)QG6GVgZ?@l%_PAQJ_H zm5J0rkpUL;VjR>MRe5Nlo}oRmw-BipmMrT&!!cI!CLxtMR)DB@F_FI+wp${SC)oxU z-o4yZ&*J3?|EGwFlv3$CqqykIt&Y43a z!75RSvwd3qN|!I{>9=^k@VhGNv7>S-BvRY>ZDFVpcnsKi#4l7Kg6pe2;VEu*G6ll|)p*`x)*L@cO1QD#Pz@`@EL9_JmSWtn| zSUf*sDhe%}2g@&>Uvl?7bMOtw#oDORPb@E7RHBx($1+z>sUDd!`iXA>GE2c)TuXnE z_3Qub_2qwb7-M?gH%X^3CO-;4MHr$9`WgO`S3#o<@5o=?Q%M;RvdXD2hAW=m(UZ@k zCuq^7#=V~7RXZ+*@!sEs%Z!%`H^={q6y6u`FymF2@Hhrgc>Lzwj5ke&S@F0Y!;E*o z36IZP3Xk8=nelE#7{};}C@08*x7LKmF|NYFi$KeRxzsnHDa#BPLQh&&q@wNkxI3MQI7OIi+-npmk)p9@$pmPO$Lxz zzat3a7*>(On*cfTc`_gunN<1Z+z3@_BTC@_;uIzr?!&m%@A3qTgD$JqTB%@J_(r zjJE`MD!+putngm8;BjA(dli_JqjR4HuN`=E;ZOaB;8J)k7CgQOkJUaNx8S9t(W?5# zXF!ElYr*6Bs?=W*@!rOowmbpCU0xwqkXn-8!&X}%Q4|yX~EkLyg3M0r1TqX z!Fv>Ve72^3e3zv3+W_O4?U#lCwo63{uK_~j^JKtj;I)7!-nF`U4m86|4R|Yv~VGp_5njWvmHLt(OCgAnr*NtAE*K!F$+* z$NpUDHwX-~r|{;3F^`=nNAiFnpGODix4^5wFZ0XSTnuBq<(`6OJg)cWyE#RaBXQ3G zGhSAjaW5p^4Y(BE7Vu`ghcUSEz)z9FdlDXIytjcj7k@U-$IW zubc2D!H;s(?-kge`pH+g+7#dw!mWs5yxQ@Hzcv~0TgaKqjbWrSxXANfKza&;L)t(Q z!+1@A0xAx}k~ooKA{F)|RGbETSAU|_wMSbc%zKJj98 z8dfgicq6QVIovV82#GsrKNWvoEmbohBY&&5cCWF)x|*>mqr|$JRxWu0j<-%MN5e68 zfR8)nIPZl2h(y25R*@1};NqUewRR3W79MiVNvk0f2^QKy?`)+v^MLb5e@oemECbT2 zuu27TIP){TZivg4IY}Ga_rOACh#6_#x2OQiR^q`d^MS!Z37a3Ne@gs5f!}z(L&nM| z<^qf6pq`Md?EiGy|5P9gE}|nT}-v_&5Y;v-o|Yp39eDkj&tXS{*WC zwi^La4yUj@kbt)bGgIB?;>vB>fx@*E{lZd7g{K#QLnGV!qCJT?2yvc#icZnlG8M$1JcIo(-(FdD|AGr{X1># zy0WkTeVux_X`?nszP=k-)-T==uWFOb#)b`Un>k}!%(J9 zKM;iJ3OkmKNMK^NgN{=o!Tz#3Iy&{E_ET}^jU}A0iqf67Kwh&%UdQSOnmb@sJi_zf zgOEP5akndBM8c$vy=pfhA70iA{Hg7KmZnu0D*x&inCG3Rpk;ts&ZL&P@duiNo1dsJ zXF45+I~F00r}bUb@xerY1y_g(3q9y~>e^w5;Hq5P!lNtt>#lxP_xUzqwJ$_kbjWww zi-vJU92PS_=opb8tt(DycrelNW!L}7@}9{03)-OP`X2Uv-DKC$d7H?tU1D6djgVhyTy6~d(;?>-Ku#V0o{+u zEaeD!hqej7iWuH(x*5P(=4wiO2b%R4p;G-oenvCH74;%g5=43&T3d zUnb@q&EcKOfnVa^ZYl!0mrDJ3A4|m(yV~m$P9eY2q931sNqM-qo~Fi6eNh)Nk;Y89cL@Ip5<7|M>ol?I-&tW)GETPS(_2-2@G zeg*yjgBO@t2G4haYX4M@hsjfRwB#wv=K=aNEi(??I*kMpn6j*CO75{rVlk-wRs|;f z8E?GwC(kxY8Da>0vmIpKkv%O-g7NDJd# zlE}+2gBN+Z(%`9zKHT7msn&WhdubE|F-h{oyGHWF^Glv$^CVA<#gZ4U9o`b2Ld&I_LoJNSuS}=6kqNNgi$zt>TuL?6J5JXU98dxPq z84*iP;1({JPdJe%ry--gnGMrSanytcpAF1`);W>x@W_T?J*J|BO!Ry&Wnx106zi!D z=cB%MwpJwAL#ii`F`2`4*=mkCrcOP@dO{hc@r_VD#d<c#Uf{hfVr%@>xwbU zYz`|~I%nmA^2OR!JyV(&xO>iggjl9LW6w~smPE}$irR#tSXQ~Dduo!Noc%0cuyk2~ z+c9CEHKmQUxy&(zb=TOaDZTC*8|6(T;SpoLU6{xe7_&&D(3l7rR#y2g(;Hv6w1gM&B%{jMSZDekKrWvQpM=^c`O}#~53x zXP$aaXvWmGr&v!YqjG9}!W$PuBBabGFq%}kOSQ{4tPdECYY zjh4UahxY-}vluH`<#-=cq~sn3W0vDsgZB?bO70h6$mhv`RRH5Xo9WY^7wE-a9BXvwk1K526uLczmB`miriP6-Hsje=7Mr zdV)qmd8Wg3IhIrD{uR6#?;PB6=nJkJ?@h_)(GxVzgvVjF!sD8AGoA~MG!eu2qx9ps zAmsC8SU&JZf~S5Q-YUFl7CaB|)O$TfRd|yucoo1?<;EeM!fUnIc?s}n7exw>``?n! zlL6a-mj#~sak!=M)>`mZ0WS~XiWJ@&3*HeEo_VhGEyTzFNW0{`ff!>+K!x`w_><3* z{$H8!I9^ryJ!`>x8SWAphd&B$n+4BHQ|+7@HPW) z1{IQ|^eeXDbplV-zbhcC^!qCqh(_#p4tTNZ-c_T28jOJX1}pwDjMu9ucm67>R|!cE6?P1A=D7{t z&q+*|q~vD7eh`h&1Hd~i(@_0A+W`g`O9Q6Kjc=OU$Qe0u%xE#o@y&ZjY#m@EZ|Ihd zcOGJHBiQlTsvT=X$@us*UFSrHdM8`;`|f!P5!3396wAvH+ruOdWYeh;GlOXPG}B#vvFdr@qKoD-I-$v8se-^bWdJ~BY!hr z7|l1k@#4eQRp*{+vDFl4Ll4dLRR)^F#nl?WM{W+!mD32}8ONMj@Pz?&VV4bIb!D!0 z*MW6iT^o<{&$ffM$KvwWl@!$F?C{n;YOBfBGG2bEx-==N$bHWxZQ;4Cy;k??@TMI0 z;?!v1j!*Po;mQp38LGF1i#rhPJQ6=}kt*ZbcR7w6g0KJmxQ_4)Ojz)JYx&5t#;)voWfU_E6m7F(z!Q+*Z;wd0nY3(>p8Zomp4i?440Q zIN7krEs5?ITtfq6%YIs0b&an%JOMgG`QT>b5OYJQEj$gi3wu#;ZwbtC%)oiI_Oi}(N8?X6oih?tz=pn5T$HbQTMP|*KLl|Kv^S;MoBVXy z#z0*GCewTXF93J|CN49uInx-!#KMvhJGWW-0*jrMbBwN621-!jvJ8cq!?(e9uv>F@ zn)o|G{2hnC-91ErJw!Y@hjVc=eXb0&rx|7VKHsS!VEszHq+oK+jUA)mKrg^uV^)3g z)RRMt3!)OyjPK>GiHvYyI|XkEI+y%FD|ZB0KkKX3xMJ@vM<@j)_tc>0+QPR%Reno< zBnLkJw;V1fN}PU9n1xNzzX?rq0t8WvXt!*6E92nf<1Q9xtZ{4<&EatfZZBi#CTs^V zP6h4PE2}FxHQW}?>IhFb5gsSfJLdzkdkS_Va2&*z1JYi_1^zqF!nG^0(+k|vME}Y& zaJH8TbyxJa!J4Jcn%%0!a_$Wi&jK-4F-FQy6_ELNTX&g`(QS{#Pxt!VFFH_u1?AqG zg5DeJs)OFVIuvH!(@g<(pOe?Y`ZtDiVM&KJD$sj+AQd(DP-VC>2esCV+Qur|n-k%j zdu+9}Hyw;SxlYzu_jGI$k*BHyx355T#c=aLGISU<%+Y>MH5s0TUY2$}NF4X<%>Hwg4aQ-WLaLxD-{ ziQcZRy+<*tTk~ICZC-9n(^4R!O}3ASuX#h5^?%!L(02kCTQSIHC6qGFBC|~To7Mnm z+l_KSx-((yWYmAyra7E|zjrQg4iD%Er;E)pM91o0N%Z<*du>`M&{$Sqw<5haGG&Q3 z@U)1R9Ke1Qw48s_SHdH~aP9n(wdQa~@riKq*|0I+OLc{+{?so+Wh>I-Q8qR2;q3Q` zCsl0|_XU|Zi2D2MZ5?wvI(TzwwaKk0Or5-`u65f4@vuEgUt4p>+&0WmBd@~4sW*2N zV^SMX!o&S877G}5gq!;(xtulUjq>3-f=G~IScMN+c>G`N&VU=7X&@eJ{&ow-t|Y#P zu!*+|!YTgroX?d5NhxBFdJ5q?B=b`f-D%xm;OtSOZo1{*FM{W>$Y)vH*%tS3i(8GL z4R3p7#H-x77Wr}7Gjae-O*ucjK<^e|Zhj)|Ltnasmhd)<`xy#KqWnm{P?ALV%ND$H zi~E?x{g&y44&&csaWA#FQ)GI-hhC|gqsM$J*O4kB-p7{oK9%8|hfLKj)%Yx?i1K?Z z`87F(eQq>8lThAc!N1?4FV`QE`0gnc|E5U5>xJ8`Wm)7OvFOizen}-Fzx}n%!ezWK zNX6H#{Vej&SoGmOl!~Y?-{mQy`!40cFWtY8_DvA!WomqfNiy^utbHlNAAw&gzPvsu z!}-1@6}tksE%=iy>3?F$ug9W4-{p}8<4VP>9_RHGQ9tW^{bUu0UlDG>UnKGQT$+lL zzV^v*%BCV$YJQ$D^uy{DL3}<;#n-6JjxL)ypXGHquSi*)lfEDZtNCiScy*4Nhdf_A zfwFMva=x0aT$km_7Ov*2N0K)^FRJ-xwrYNVOB#nuzg)25dkQs&KNenU4*w>}vuiAn zJau0rdFsAg^3**fdA>7PCwZ!|Uh*FNo|ZiGk%qd#w3v@Ul4m}~NuK%O9_*AE4gQys zXFkMPV(@1^NV?bf6?V=vcC8BYHd6apc*ye)C<~W9Ot8lJTe7@Z z6*!+yqK(Ki{qISh=}(e8)8{>lGAyHd$us>8l4traNZy0rW0Gh3?@6Ajo{@YUeo4BV z1E-u?BOv@`eWskM&%!2D0K^|vF2WAdCc+K_g^1>%3}23dh#ytwM+k4@9I~qno_0`m zn{`FiZQhC1S_8hTR%;Eel|1b>LGsj5tu>(Cek}c|ub7kXW!Sqy`ZFEg$B4;%yd-(% z5_E5_yVEWBI_E=_N3m*{=&97l$P~Pc6P$f zTyOvqcBaB04=#09sIaZ9S6=w5H4)P#&vfpTJY_}RlfZy#aZ#S>|4Q=IzeDm&{|(7A z{r4nK`+O#O4}MAd7~_{|sC5& z&Y(vHh#?9$2=#-1>#TO2}xtv1Mb_Ytc!4J4}nH zO0aZ3noiMTtp7nB7Hf}81*3!vt&GkpYAsUq1{&W|JVrj41<}Wt7dm|%_}4_Z82o<= z+AQ3it)7dqE@~`G5q@i{eRI4R`HL>wZ=KfHM6=|X&FEq#F;+(QSOTUx@TdSb(<%pomB}oe7qv}=IYY*xG_fE|)a2Ps32zxi0lhQwr zo}fp8M|)8}{wloxwBY>~?(ZU8k;2<=!D}($!ITlaR!ezMkKqbT%F)?kDUa>ItAIcC zqrH`W_ge7yZNaAqSETe?X~7!~kozG-JPx519@j{i?dL*(!XT#N`L2U}9z8)@fv4=p zdd)Dpt^1%J&|FyZmJL*dj5-7CiII z=MRO)H7n-)-j4vjYg9xz68HZwuRkt@$9EHEJf0J$Fc1{s8zi4cPml|R zpzOzIHifqWyczFf;K^4Fj26KwmwX;QLFpzuJ})Xfo^NHw<2#{j5ySYSbghOz`8*kx z1-!Z7nO_esg;!v~8wWSvohnjz(=2%R15efGOcUN3L@?_&0WT611~C<11BQGaJwacY z@|y)W!)VV!FlM}b;KizcvmwVgdALXkc@O7_>xUWdJ3y{HXlhE`MK^zi-z!muXx>5ZwHs^!ix*nie4- z8O)ix&&FX*5R-wt>2v)5RT^r|N!9PV*OxF?NY9miU3+{1hOx=osKS0+HozqZ?k{YU z4IOszw{%iH%W~dASoRi`de(pZTDi=6v#9Y#dc&rJC$C?19XJF?#MiutwaW7te zWiI_6v^6Hc?fzVAOm{!61+&LvrDLOIg90I2t#xGfZ?Oe4`;84Wgwr<`Oj%m#t4wJu z*r+#best3bd`DildmYY{3T>W|Fm=?89iBi}*VEoz_Lp*w^1FB}vv?oJp`_OpFdCLw zAs5^0PvA%LE>&oiR1jBiC z$EW;o=An}6l5pj=N*`8>iFG$vEtZ1SVo2@n`V&)cEbQ={#nbUCA zUmu4BUk1p`Ls+(R5r_}#Pq6gQwjgpRB8NoeomfhiJQ4>(74TrF*lRqve+2VDQgwj* zn1DVia7A-?I8=fnh2b6gbuSFpO{+SAymfd9|mCE(|RY&;4Y4v@*Tsb zvC;*JOw>cp#%;A56Oq>5x4T>pR4vFybZr*8LLsgrV_wXJwO8fF#uBWdSiXvNdgQRY ztU5_=mW(7=Z^2T`e z25(lVSF?9e?anwatAAzAP~YT&nSrXeb{F6bD*Nih*0}LlB3jxD%d6tCPD&j4RN}3M zlH8U8YtckJtklErF&j)aTKpZZoLO)ddqa-e>mI9mV>cFIwZ=&(e_=w%;nlPi?LW(C z-{B|(+C=Bp+T9Ct?>1~HR&-(MZOup}Jn794s#jXQ5)Jpfc(wu;dPpT0T^| zf{MUV=Xt7x2#0NL;n5x8tP`j{urE$hI!_xTWE57DjW$;5!9$$X1x2B~(f3h%uA&;Q z7Mx|l*|QMM_B7RBvp3c=m#mvvT^cvrhL)Hap6_F^9^>gf)5PBi)uLjvBEQHM|EH-p zpLmfC5Jy58$MImvXGvM*nMyR#4=M9;{hv;}n2RNZV$pN)y7R2`$WsFr8e?hOgu~(a zB6?)mtGfZYov*SYS2-HVqND?%vihaLLH$bYMd=wMSu|peA$FlLU^Bl8ovEK!7)W0D zT)eldtLDS5xu5Os7}Ot$9fm0FdP-_g{y9WzxHxrCzjdOk3njF~L$>ZX`yZ_J!^+%k zSU%c>m8#p&|Aeua^bpGMIM$Pe=bs2qI2*Orwftk*aa5z@usL3d^blqX8$8<6%#_Lc zZ2K*??C>b8N`qd^zyNW071j|Sr7_vM;<8h)JT3=qoy#x9$zv<90F&$3;3K7eWa|hg zw8pjThQLBSm}a{*6b#;G6Q;#-W@eeKkMU?Iw!Vwhfu7oS`(Vv$vp2KBi;At<-q1j0 zSqV<1dfK}&C+N+p!$S5ef?iKuL18$LsWauwa4yOd6^XT!$9S!_Gl2UmI&@>5AQ)JqNA50bGl%t>SalhIoC7z41oZt5-UV2Oh*^qTSp3YC znWD*K&zg_x51;5jVI;5OIba8!=Q;9$&_sK1^UJ&oZm&N(H4{}9OEQUp`-UMfCbGKM z8QFiQ6dFdY6ODO)s@5j!H;Q|U7-q3O*;wtBS$?GB);hJ>*c}OL?CrQ88M%+TADQ#~ z|2IFTDIxgy$olH$P7RF(6(!g_TDZXaaKy=UtqI=Pi%JT)l3b6v#vjK9O7ieE|N8?} z6jw$h46*&QGTd!ilg49vqA_^GY1R&hlL>Q~k*t4ZdZ$kTK_Gy581D7&Yw|Ni68L=( zL#l-s6d#rrTU@4beQH#U0;GY(o1AY znP7>o*czY-_@|)X2<6lcu+R+WSQs0FGIef&VNI8p~`SqNaS|s=RG6PrUgKUTKhi>`KI;TkZ!{oawFoj zz6YH~)WlCaeTCuCuB06))o8@*=T*KU)nk|AT#B&wMFdBC z0jaFpPb-8#m`miu!4DKDwKa{@i2D zon;3Qa#P1F)#5?(f6;^5HJr_~JzVY*TNgy;o>YH*MTDblnNBr@?!9rk6YQjSaWj z$M@o$qVmvD=juyO8G}ny=ILRQw*wWC0s4C!De zka$UP4t(2%*GV6}-b#vioDwqo6N6rNV?ou%-RKYBnQYrTSo1Xc(6+a3O!jmx-@Vb( zkgsiRORjo8rK&^U`UlU}&gC8X_O*|A)^7czE#J1b(btf#17m7Ms9;6zPeKJtLc53L z`l*~4&mgzMhGYiZ&@JDKn~@VY+&No2U{!hUDL$DI-qjl4Lmb3sbquIT5w}vD1=_Jk zd|T$+Weom};esl2*bVhG#M)nb&77)-cK>GP%&8}jeFS)p6EF&Q9OR1y|FF1_Ue)M> z+~$qRRqe~SZuGR<8m4NSTav4`q*R6U%^^=!%kt)__O)Qve$p`2Ru%FEr|KaaYx>ks zoz3*{tJ(?bwR<~n((AgqV88Z+wa*8)JijBM?ItbbnxqN-7cN9M29M|Fo2K0An|iZ{ z2ZwmB80pCtTcixV-lHuEEM2-_exhcT$?;?xYeYQ7fxG8pw~o6OP~0ju3StXzu*ZVC z=PihqEDDq?B5N@NiAM(=j;+Zu&Uu~c8k9~F7m1%+6ql1fDpQ?WT-jv?ucqB z_J1r5Tr&Ev6SD69=*``;GRJ&b^qU#umrWkI=HFiNlwWWc4Q+VuiaQ2rSEp>dwYGgo z?y+$X|M;`!jkDkSPUGkqzPO+L=I>ABFS+jNV}E(0p|I`cA>UiEapYI&d7EAwGhog; zC2!b{PpVA(VA{Lq7cBp`%NE^xXwS6|ZEBgf^STe$J@@x3xAuPiN?+U)znt;fRfj(K zD&76NADn*V_OG_@pVYQ_#CKNxE~WDQ8;+0tab|m9eV+S^ou3Wg;Q!^D<8L|rkAC;Q zcRFw0_y4qE{zEHj|LFO{E&qJ}^Y%X{UNa|d(c@bl{?5%c(^j?q>(S4CJbsOS>4fi{ z{{KSBUgv&1-t)m5p*!B5zx%=X()rmJZh13%<>L#^XRQP{@}vZLlT!K4*bP4ZqGxvEc@W5f86qM*7@}#7wLWfqj&!={$uUa zuZ>S>d^5h^b=Ri(;`${zmt6M6)OY@UVC6qAbNu@=6AsQgy5*05TXL@O8t*m3Z~N%> z(_dcLci*XNe>FSlv+Gt~_QLxsUzs%S(UdEFFTdXZ#XJ3}zPK@o1Kz*pt9N{T=Fd3x z#QPon-Yd>|=imPj`u#`CuYPEA_P~rYUnb8j_{;i-TmF2q@X3Gm&U*aK6BQ4i`R5N- z&Fr^vLCeu8o^|)H9+COC@BL%WmSH#i{)WScj@`a_<*LAkUp`p%q1N%z2dQ?guP^Sh zwkrqDPPyXPzkdC}WA#_fOuYP-Ri}nu>6mf%FNV2a|KRGkZpv;>avnKfbkA-3(_j4l zsK>9_eE)3)?+yNEDDM2q(_5bUjW6zY_xsCoY%BCgl z5411#Y#+V1W>(X|O2^SvkGyj2pidHpEFOH{B41p|pT2+cCu?81A$8)i5&v+$H}>Sf zf#DYqG_IMkC;6rGZ%)7Eq4K1gZyRvmKSREL1D|^3$lceZzCPxP@Snf8tZ~!MDP4#D z>5Fsz?17vUm)>>ixw+wMAA0B4eg63Kj@88nd%fKLLi(75b*t_epZDwEj=gZ<hstG;~fFF(^#TOPf7?2yXO=jWv@e?Od)ebXPl3R)rpZY4?!F zNBcfG&~#zZzIRgl?)mGG?Z$bKoQM0r_zdiVX>OwDH(;2^Fp*uuM2?B<;&j4p54-rP z!tBPxs)@L#C-(s%VM+rt2(z_6NcT{ka~wlNnEJy#KQm;KE%3BO?JCYSHUqVCF5m$9 zaoNNv0KzH$^xPBlita#g+#~clhvAhX(*L0)+^Ww|txitF+z&|`c53*mjL&@}Y+|Ro zZit>|_Fml`2(ITDzSmg7uN7-K=(!e`Eo$`$jEgid>*F?FC zG#&F;B$ls^6aKy<-A@X4vGxO51wF!D0*wvw3HP1SW&GH2+TokhhcJ577h25!B#ZoH z?JikX9+X2oVv7X^=*8-OCLW_Hz#XaBRUSM$-S=U(AVSK-AL_j-%_Ptt9~@1@O` z<)PyLRJI4@Hn&Ko{|i}vjrf;ngQXi&z0fCFt-!1rVsh9WgVwa~wB_%jRY z+r>VTr)-|&Wfju&Tj2o`I5J^@Gu`m#nhvh{BMBVv5ghQ86>)D9B4Q1QF1sx1uJfh~ zVqMl{*Ty*NJHr&o6T>5UrpYxklp%&s^2A`a)whVeKdJqPSq0Shhg>hGc(9r-Z*f9T zIoudb8Ch?5M30a$u!+P^r@z$A zLtd6k7I|4NqD%<@qNv(Ccc|p4S3vT#)gs9g`(DWp!0%eg6Y6)8r=6dXya&I3lswZX zsd~kH>OT=)#`sL$K19Bz8~&{R{7#HST=I;UDS7HSP4bKBQNbB zY-O%ja$z6!)8{c3FmUPf1#5gyyTIT*^p|yydZ_QHsfV(au$#1%Xs5jq2omK8p1NFz zi)#<53#)}%hj@?VsY|`&iM>(s#1{1pajD}g(w}xaCVATJbIE(~JBl`eJoP0hJ5UdO zq3|;5PqD$X%=8k27dE-m;Dt?OzUa@h%}Ju)08hM;xYYUQH%gv(gi~jsuarFTgbp$K zVWEQ@q6i&mFp$te>M82;BEw(QXQ`(LUb-wV=2>Uw1fm`Fy9N98b(_GTt8wwHZ|cak zbmSB8J4N!;ajE2~KjF`GgiXLR9d;#@XFMiJp6QUH>YlkjlxK~-77+)_J!Nz?@+K2vW?C?OuB2W8VDS3vElRVQU=|3=j zMHzk1;069NgBSU|!Qe%He`N5YydckPit+-V1)gs8Ew_ifd`w}O&P;={ap^^ZHR}0n zgC9x%GJ_vYe!0Qtk_Y}&{8E2C4}U;;xO5*mlYM|}f4jr>i9|E=UF82oMI zZ#MWDrfK*hN9$$}O4Vx65LXbCPg7NYs6GqX@3`PKMM z!j*P8{(xvJ@(K7AeJ}Vp@MEMuZ7=Rw@Tcury(mxrxsqo&(3JFNIWP_K#12Z{gWpEU zvmDwaPnqK;{vF9@qdFt69`CRauB|i@Q zUw%1H98__}>9OL-H)2t0lh-{B@GA z0RJP&(71YHO}B*hCrfk1kZGeaixK$KCB<) zsn4^LXZrgj&-CAtJkviZd8Yr75IISg8{|kO3M|jp$~Y5vpDHb9Y{Jm zJ&-8t>kVF%HF(NXzcla>dGtB=!cU|Hz6QKE$CG)*put13hYq`Pc;qW)epPOKt!aE^ zYT4a@Urk;#Kzu8zBB)&r7S9hX3tS}^qR-(3o!qIPU&F`#6k1H>$z+UO{Y|nxKkdAj zcvQlR7S6k>!Z=~z>k?hMU{R4!@}ghH8>w04#0R%3lZJutnY>|13)ID=%wL~&pDyu# zdlHF}*{|Ih!6YKjBT*S)U0H-_VY9te=6PVn(gpL%BcZBTFDhX9q}fPTe*7O3NvWX_ zW68z@h03xC6fG_<4M2aToE5UCWOjgg-N~EJs_A+DNc71X z8j59JX>@F(h12({SQ;-azh};}6*#6ORv;$dWnheBXAE_X27qI4?w)TFy_gkaOUJa8 z=wZGsu0_~vJ+*Jf(q-l5-7LhX=Ov49mI_uVEG~^QIBKl9B6p)1S)NzCVBTF9uPHLv zvN=Y~PuZhtHXx&RyRarJEA?FwRhb1gF8oIOE$+F=#n*0p(YKcZi$ItR#Ne4ImM&H`E*s;;bUQME}7bWG<7Df_6})*Wuf zGwnJNqk6Lj(w-No-Im}ebuj$7NGyg(rLO9^$3@J_S1~$vrL4FnmL*uGFp>(h8p0GD zqhKmVT_mZTh(G%9oU3v$p#7GVfQK18Mn&ip2G<>Yz>$QZxuAFPmpsSVq|wGt@c52R;r-Tv_XNUX>GzZc?_(1lpH&nd_u???_Z7m@ zaVer4sTy+R^XLGjdyHpM+K=x~6y5?0UK+q-={MJcmk+#r;1G}R5f$D*3*I8&DV-n| z;kg&CIUh^l;Pap&73Ykl+}3)G@?g5jxKz56P>5!{`!AC2l@_@WB{32Wf@3%Yw&m=eI=Ay7glz!_hcrMh(PJ}C>9O(ftM7> z1bv-Zzt@4sdZ$R?VWn*p-Z|ingb?w-M(}R2;Jpnz`Fce_D!hCPUUp_T-W4Xi-=lLd z>o*Pn=Dt_q{X68y=ZRF%#(}5uJII8$!Gg!{uFLvT@!_L~RB ztly((SG0>Fh4&LMHDJi+(E<7jcx&-X zJif1D81brX(Rc$;Z)5eRKZTqb?}4oD{*UjQ6keePZ#3}kN4O%&k!D-)UN_-!PDKmG7&NW1Ku(qyZ>Ym0#ZO6<)gq??d2m?VTdZk$!K%`z`QP`QmkB1dn?! zne`iudf_2}B!%~)CBL@~Hr`#bJn(8Sg4blhyA61(r-~HbqZYgt;LU{)@i>jB^80Jl z53_zR120zjZh{=+?2`=ZRD>hX_2S-z_G*Ptb3e%cBZ->^BrC{Z2#9j5pV$-wzBsu2^h=lZ8BJSIT59a^X>Ut??gXA{zq3tvzeoSX@)%{n zX#;@wpyc_(FkbH`7{4mrry+-`8X?M%9+7xTt{rk75n}vNa`#!}j$A};q($!BMdZ>g za_M;Jh?Oq)hN2Eizg)ggr$XS*aRxnz{D$}9bew^`~u z4Q}Qm85dsoME0ZdfWB!@s?j+)xrWR)pAR`;IT8RF9-T{pBF<1;pfF+z>M@WTg> z4fv*VrfnUT5A1Nwb|vEb$8poPy!Ym%Q@0%W;7HQ0OZRO$?dsp0kCTz=-t=-$8W93GdaMYOC#^c%Zp`6t!v zVzzCbTh09=z;;{3NSf(37@JfWSyE{g8;p{NoX7}1{KiMf!}K-HYkp6zp4M*LLxV>? ziH2;u*bapWMtqHO$WZ3M`D1IET^Yn!Neow#8G>a-PaE{!MVKL*#POy=X}LF;NuOB} zeRg*1qxM9K`hd4PANUj;Y2S&MI6RF97W%h{B)JJlx87aK_<4RIO4epk>5xtuCB)hmviP#~_Jm=0#9Qs{DI4{J zy$}hTkvtpUsE5j34tI8ZsKMWIt|nD;Pl^kr6y|FoZ(aP}OSRL%lt%B`M$bm1yP|!l zE8j?{vH(zyUCvu${?$0 zkaP#kk?jb^Y3|O%jM~~~Y&D~`x}1#dA~QQu4myo3E51mgy;u@ExT}f(i^O&vks3NL zJUi4j(F3zI=4|L=+dD|xdL((x9>zAdT$$+Qejs}<*M78NrNG3NDdOw#w;XF8hdlun zvbi>HXiQmkuIibsE*EXgy;}VH(q+! z`=72&*&6b+I%Qm)fTKT}iCZtcTvNuA=@w zb7creQU7J!VN6s>Q6G>YxiM5K4z`SQv2)nPETWe^i+z;hTvr-CEOj`TN0q$^|-sb#%{EKdTkv12cB-2panb61=F?Q1hI#~1YH}PE$owaZFy{id8*bm1&>4uZ?IqUwTZFy*$uoHT!SuB4Jc6QQ|BC zY%5_@*b^5*E4=6?iZ5V)v*5k~!GODMUsib_Ewo`&Aa(K~-rj6$o#GYpDT94m;?SSsPvPEV;RrU}Z)`ghhjBnKe8 z(7YLcaC5}pj1}0oqpCJ}Vea2b!omjFYsqCB@G?>pw@u`Bn8d7(2}sHxfO-W*D9^Y-4_65Mj_ z+>ODt5AXJm)vKy~Tal+{aNKyns12!~9S+~o>`gXY(S;rUBxAyghqs2p4PN)! z;$)Z0)lcLz*r^@fe1V`(2e&-=bi(P4DX(r!o*K${dEwX(-V6vCZWoD71-)sjc^c~o zSP^;k+s;&ao4qMF?my|u7?-f9ZsVEU>bjh&H9_nMv%|Ock>I8+PaiLT>14~9r}_?@ z-g&Zq`=%F82)&LRKZehk6CaF!%<1kpU$eC<K_jv453+aST^P5pGZ{79WkY3kqSB@(-R>XM zwYRaWv{%DmcS9h>{dq#e;J%Za+(VOGLtK+<$J!=dg;rHFLKBE6au&DIq?pG;{*E8w zBxW=PdFb`w>AbfkJ$+o5!GEHlB#gVExTgfYX;VWuz#VlXfI7ft1iUtH3Pgo#{gmjIvuq020?df}AFENJw@>9EcX=O`aHt77M!^}K)F~8cA-XzmZ-2S1@zB~% z-gCqbOd?C8#EpO(GSTVKIeaLM&uMi2A3pogi!<~os8AL!+sCp?`89``h?7b=ysn}K;??3!u#=hq89T;86t|nC0 zSWvse=4eGt9(pFXY__x1R&hpQVBCwx;J$fUeNzMaq>Z?_;*O1B?yRDW6)PTkBO`Nl z{ECMCFj+7`gV|k!u&GY%cO7yWCgVo&P(rZj(faCg6rU4)7;?Zm--%%o z??l*@Pi~%BXfOAsw(Uc%A$_=$%>fPdV3Mfy{-C~Qg$jW;Hq3I$=FoS#7q=h8L1jZ8 zS7o)kn7dMFb$KfH)C>2vv*ndeE`rm->TF|EM>U zZl4=U_UC`@DC}wzd+C;Y(^{P!-sHpHK0?%=36r%A;U^t}7Tr`$GDS{~w}sE*3Q zI`NLFsDv?%LM;4;$v;wrdw;G*iYt`hviY+$$KLayB>ui|e(!&t$Dm1#!M@G7O^tbDjkU%c*B-NlD!mvm zB_xJ6y4!n==ruE^M6XO4>n-#Sm>wRPgDTD5WzCcL)BIvG{<`9W;pAB@^t`?3#j|Zf zXtu2tBmN^fsQc`S{Dt<`_zLeXXQzH7Mfqjo;bElQ&oX|O^Qi1X+t``4!b8|fjvSKF z`N@$3HxJeLoTc6z#L7vxAD(}j!-PZ(;}M9Dl?W?|Q6~1@IyDnww zc-G@%#Q94Rsm7(TKg5=yaFizc{bGk$_J$6JP&E?rtZ>?;AX623^1=2NM-+zp0#i|v z{=w(h{LlppiFY5X6Q{NraZw*dietXKZi9Y{y-j3;c4gY{;`xQ7%HD9r{)@dxF;MR6 zYD~!3xG^Dgvln|~p0r^L+JYNjz->DKUE*L~_kO+7J2t2MMfjl~hsP`(PlcHhf5#VV z{?y`aPeBhT8ezxh1$cezZTB5a$}Kp`{r^yL%FnI2#t>3I(?1)lyOMH!xS>G9EtiCH z+B%bqy?Bv#!h48vf?9aK)jX7DzXT zmfU4pWX#{j98)2~+3_#%Ih`p-U50eWKj}W0bi`+<+HuNoD@8j#l;}A!`~&GW#yS3u z_k}KY>?$j?>3A=cv!=bpEAkPq)wFcEl3FN>cb3B7P-Eib>`H_l1xOe5;McMq#435z z{c`bINIWC)Hss#vEEM$;L%{@X>S0$R>ZKf~pl(l$U-QGmVZKXeeMkL^V~u}@Rj<`{ zFbUnC@c6S0LZXrIrVfd{*xflQ%Ck{>-Lg811}NY0P*>=N7r!ZD>qFJvPC3r2$4rqO z?r;8W>bE)XqOOZKEj}a}$L9!lfAkfh74DW^p$+(h%1yPsU0v(%ynu%1K*QtUVSWAi znck9=sgnvs+vJ<7Ri8dJcn?br{8NK>%*2MdX#v?KKRdms72;lWqpdCM z621rJYm`hK8^yyjq(dS*Wk`P;bb^=B-4llIlHn&?7^H$jxFPXo*_~=37we|g(I`+MGiiYW)exar}6UU2D zVVmFd&vP|4rqpii3(svD_mp+Ng^idM-=Dnk4oL11eU{M$cD8rOCYcvx7}}WM=~(xs zALBzGghD8`p%98~##YF*(E2a5wtZs%M!K+5`>+gQ3ooYxTn_XJBKPquFj11|lEmhq z*K^zeR+uZJal@v+H*CJJp|O|iN*R8h)h$wgtnUxRJO6YW-WR6ZIyy#6g^tFZGM;l* zW!E-j2_3|r^33EV_xUpT(wgd^jT&O&l>=V&)sC!scB|3{T}$wSYd}EA8pAk$`FYkm zHQH)4FpxBd%JTsG0H>HfTJGn=aIphI~1SH`z(zA!Nb1G<{yUE@Nvznq4Y#y!9sMpByi zsWB#rq%`IekrH5Vvvi2G{O@aRP5%L0r@(dB|En}{?|!~AuQ`CuANDk?XOu^|J6}hg zo}o8)Fwf#0Ue^isJuVoR&l+k zMB+7deivR-cYfjcvMZ|mnKtTxv3>d;-@a!O(52hGtO_sLgQ?fJvoT+QKfr}b=QQZ! zz&>#d&-`73s4r1<16XYxqSE!OtLA#A@@xLZIU*rj8M=rgwnqDg#_Y7J!k>c~nR_Zwa~<&T@4PS+o8m5kDPV^3 za55MSf)eDM6FFqzRGj;t_71j^0oZN5O^BcKA`C|mtU#x^q@A~JG}2&r$(j}<2*+C* z9L=4{?KyC{@6=aQ&PWCr1~c(5sOl3xkKFfQ6Zd^O%+k>@_pofp*ojy*DQGhAG-R^z zTx~W7+opSu)-K+UvXAs%Z*#v6^Rk37+Jnb1-TfzJZ?+wiEe8?Z$g7s*9XO(3``zA`KV- zwuQ!##MlMO^8BCfQT%n)0nd;nXC@yXdnhxI47cW!~P)d{S0sL`PHg!77y#od$ zdGX2pHjH6x;zTFg(6Y*PCHmNEmPZ`QvE@+v@#1X<9Y@ZfsyiX$zTMW0m+3oMX_04S zN^~7HHmym#wnr9S@gs2RQ{y_wJv;Q?%7ReS)QVg^WUotUsSYL9dGWTnS6z-P4V_fe zfP}gLFzS3RTd1inv94F0z0=w1XvbkGK$@NCkN=!1P=S-a^R`fd;rrxg1Zk;m&v~wK zNGP%0`&^?Zgh|rp8v9LMkuf2(Zc^j#Zb_JJoA`Q{E8dmnPyA%!TV1X`m0bj5v9G~|^RD)p)50W4J$er!?e6XO|*CWYbK zrVEZUU9NGa7_+`ajOnY+)p<(vtgfgbnyHnrNppLrJg|2vCSC<#t zaXe)EbGr>1^Et-dpPc<5x1k4k-wS)+HO7y^PjuVwo-;Jy0BQa8dd+8DQ%!aU_#2-> zz<7vuIrqMS=Q9xj;{IWu?0qw;bS?SuPqD#ZXb%qP21Q~RENWUex`JTr%4fN-FcJI7 zsU7O|qA^~Dazpq~7LZkl155b5i;++=yv0byI82HV0Ko8egAMJBcfaVgVz|aMX*jWF zU1|K}YP`?8ac?qf9?s&zI02jVuS}R6nAtSeJ2YqNbT1x0L>L?PdQ=GP$&NZ@XN9Qg ztF4)Y)LZe|r8J>402Tc^v4CN+4>dC&7BAElk5^U0_d;sv(* zt@9J(wZeVL`Rh7f5D)n;=|;d8V!VRKe!kYjc>rHr08c&syy-&bKJ=YV!x(A>Y@ zh6d?e^$Ge3ujqAZ2cgf|B{~V&VX#TMufM?h@9YT}LH>FMbrk6ujdRWN&?qd52|y1H zqxn_}b*=v(qf<0qE&7LLl>{bNSC)+}7>}k2S*XX-gy{M&;=#dAR17`Y&oxvvi6-9u z_-A=a0=wc0UrhEPl4D0TL{Z>hd}ngXEzYq8L(xCyi2R}k^1*xkN{6VI60oLB8(}|C zZgd~CX>OT&SW*Ztu9JBKIO@s|5H7Jl5`c$8Rj4mmiP43j91z?;o&BJAPlFnUJNy@p zi9gmdUreuNzENkyC~s$<$z^C?KJ@%KkgxORrv!g_>3CbCuXbpEbpAPFrcibNqFB(v zCTrPxtF598)^i*+=1=|oQ&f6XdA!q~nB4Yaa(?xiWdZ83BOuxV3|)UIPoog_st5>! z`e$7tG><##3~`|4pT$Qhc2fSGN#!pxTh7kFQI`=|pV(@v#LGek@9#CXY`hKG2^@?+ z8ZX0nVk1-!;N4ppipamxX?AVG>yq{|gasJ36L&_sROFp;GSth^x9o?}iP+n{ojC^f ze%vM6y-ax+pC(!g+5@;d`e*5(f;BDeW#l($p#l!#y>N6_*KfOy0reE?60vCIQY>L( zjfXjACr&KVTw<=?7}vW;xhn(B;Q`P9iIm!A$6@@-2?5O9UfUJ2qsgQ1#$-K5M*e^F z#_fISL0eK5O1`e(C11$7X3=5v3IW-JLgwdqGnABh(BV(LkTgHr=XrK(MPTY1c>RZg zc#=@Tzx=Y1_iqk%epQ#_xqs_pj>68<5B93V3o&=Lea+yu@PJn5LECE7z1#xSXh7cX zD$WTxjC2qrJhOcj0slV|@e~g2cNx#dvlDX*igWxw?-g>aX+JD*k|Y97AR{b0GXZ(C zv)vITajm0Ar1c zDTRB_C50*i?wil<)w$N+fmd=qlcklNC-_J6O)E@{mj)PBMs+^uzOh#mZwm|c zg}pJ8T{RyMug16nVjuZci%uf7yEvs49}KZL|+L9HIyY zR8&+{L~>FT5D?P{1_Tw!0t$$TiV6ytz%<|(025#U83RUwqJRO+m@%L@=74F8h;sMt zu7ajP=Y8+@|Lfjwt=Tijda7#IQ@eJh?&h2>`;%>oB-~EbC8))g*@0czq8J>8_!Y^r zhOWce1z)9x_ch70Uw?+L;p6+JSS$s&4HGNEhQn8(nf3(Zcevr}(QG>YW&*xy&SDwB z?FdGK)=V}0OWqGhFe#79(We_0@rtRf2d&rkLeqGs!=O|D6~yPA!Y0 zvAL76(;y=YLnm`9Q*(1W3sVP2CkM+xjG3dIxs!>dm7R&Dy`}viOCv`Ma|;VI6MG{w zJ3BKob1O$93rk~16GJ30uIJ4Kn$k{Ab9R zSs0l)4jSZWY-(m{;$&fGVQ6eJ$k^1#+|g*N;D09neK!gE&yvA|fn0P(k0VD6!SO+U)5732D`Am3 z)55*{;N?P*`a1Yx6&?0%MmmG(X+pe0aF|dFg{DOY1w?SA8q18B78V&eEi@ov4p(9G zf~Y$-EFda8z%MeuUnd|UVp@d04!pu@W<;2d-!%UK9UGl)hL-MlLJ_=?D%{N22rjUE zBYc9x!lz9OaWOM8hB)S!SeiD;;o_KMY-Ub$08QnW=H(b;X;$0V6m$?7Sy664kQQZZ zW@co?M46geGTgaII(pq^_Ecy%or%9H{O4H2;Od5pj2u(_a&B}#yZk+xZVzkUZ8*fji6`B)S1qaR@>^BK7PWD` zkjQaHctpUA8Nriv{6c)f0(Ia#ry0T1!gP!c4dA67I(k8ok>N9}`}PeCjtrXVYv4C6 zv~K_{(idMH)F(V*+7##z1JKZctUg>xFJnVvGeb*btDaa(6VZmnmP$+Ko8a%%QSdiH zB8L2cgiXQsbjUJ8$d9UUaTURv{2btSM<|x?5iwFt*4%$S4+VbQ#1qLTzvRXG@XdjZ zBFX49MgU2&zmRK8l5FxzLd=IB`SC=u;a5RiqGXd_UZXy?qEX=Kdt(HUBx5UxI|$;= zg7|ReBW{8qY4DL?-&V>-*?%M%7Y2VnhH?u&63itQ(|;tJ>5rjVY$(~}%^qmqL_xl{ zAnq@S2Qgi7vjmZc-{VQJZ~o=t_^%|q$(4E#f8!^?++ngv_ATgX3Fbcgo?c8cXY(I2 zN@RS^g$-N+-j?jcUI}pTEtO#2FtKF3++)knXND2|NVa@E(;a?4hjJ1=67c5bHSl{i z6u1tA_&4S%iLYhj@tD;hlFjT7Z^%O+32(4m0PRG%4Ic?+E{o|ul1+Y@j{3sEH_`3(OyiX=0?F#<@Ei50|!?O7zqPhj$hzi=fI zF-oGSCUF(P{97R?pCpK{5yVpj@r{Cbx*)zy5XV)cQ6!mNjS)bSOs*h)P!P`-#ES&+ z5=H`FoC?w%J`(We(YAPD3DS`rPv^J@`B#!T#gr0#uD@Cd{8J{-Kf~N?(!YwL@+NTw zL3v?)7X*C5`FvTBkH3Cw6iMcKV+4>SbCby>mXq;^Wl;Y*{sY3**PVGq;+TeTD_IX{Jd%{30txC&FQzw%cVXiOOk1*lQGGcQ z@4@C9GtY>BXnq;#0i;ofU9q2_J(6P7^!s*qg&(D-9Pf0hZ_zlZos9}1|$o0cY#xH%gi&x|Ji8OO#aF{Na@ zj%MS&j3mh)$i^o#-^lpv%*LlMA4va3vGG-mE&0JYzQ0`^PWLDjjCW6g{q=(J;6eHm z=-BpV2;x;F&eb2mj3oZeW$T~CtP=2DC-F{f{t{-EfG<%H-$~k&!RoJu1DOGUn7~J! zS;u4&`?>j@#^C$tPGK2p@GgAw!A8O;~^IV9pSIKQ=#ySxeRvXEwfv z$s+n3|9-}fnFp4gs=Rg_rFu;bo(5>{0r)KHAHdEV>SF{8*x#wsaWFBL45EC;PQ6j4X zdkv)X#yU-Bd6siJNTEUI2ksw;8+cZ5I;=jQlZ;pFMta5*YKm5I`q-TsJRj3^mgjd) zhxK6+hmlT{%wd+3j1Sze=-EtoS4T0f6Nr(+n_yxRBU%j!AZ%U49=0x0FKZi_Pq=L1 zyL(U<$2wx_cF`J00AYQo%3=Ihw2s4U-|^Nx5xER!)75$UX&gpgJR69Lh+L+#{A7LT zjyizR9u(1LE@az6_*s22|GGl924Ku*b<#O~G*^U+2MAJ&hz+=3i!w2loG-AI!>n!O zngmV9^MjDD55dSWj9}!zJ66=uhHxsu$T62-tp60jsPlwi>?6LNY`<@ZL=e_y(qF92 zJGgY#X3}=#5@m7eI*9Rt0Yn!*qEr@g{e>Gb2o7rvz*uKrf|0|KVB`)ZSO-GZe$dCZ zEF|e@;~Ij|#%zMo#(aX2=Q_b?3kvl!a?yFmwigF42;1JB9A?{_!(rqS{mEgry}LN9 zgXzRSY`fZW={Te`0Am~3@dFs^)F2&NzaxPMku>sRJSMim=fj z?AS&H5FPl?^MF{LZJ0`QaN>es9U6c!pVf)LRMK`bkJ$0tkxTCl0X^%-fM9HkDZ$v5 zVFY7a_?#>cZm=LM4`9q^c>p)?07f1Zx~{Tib=V{}PXjQP)rAjYEX&q~WFRu|(df*j zp*s*$5gp(VtACKgSRWk&Y`?GJ($PPnwH#*qJ%z(;zmvY!L7k0UI@&|ew$npQ=CVHG zL!6EwVs8$k-$cF~wnTiG!~GHe&S3|{c^n>&csYk%5C?L24B}u8yCX(2kcsdS?P4M0 zjX0mf{)ne@I0$h8heHs1a5xh2G!920w&rj&;v^2E-!-~&7=|N@(XYJ-#{3Zk>p(b~ zU~Hco!D#Png2fOXBpCYvubYwI7H|)O(I5E!FHA>$yf#KW9Pk=~H307=SQ~IP!Onoc z5sdy@D#4XS|FP%e01xViNpk7P6Hjm(z?lT2PAEVF86O2CDMzAj6;{>Dqcu$4;`hd?9YzTM{7=r1hfKL(JAMjOzv0czaM#P_+ zu-Ic7=4s%<55nq@YZxfXh)mdIwvXv}M&HqKhM($Yz ziy>S}FmmHm$Mc4eJDXtSMxpBiYbV*SSvyI)kV|xsRps^$vTm?;?&8u}JM%e=ZKr#p z4q~#Nuxpnwr=tvk24Jkyh+wSKfncnYol~HLe3N+T?7j)<*sf@jt^;8L!B}=Z!Ki~~ zVO?nN1%eyejvFrs+g{Rkw!LJn!15x0R)xEsS;Jwry=VwXv-SpZ>ADcmH5P^~qhZRW zBPU{PJ8m0@v3|B60b@B=l8)GmV6-cnVC3k9^Bwdx09z4^c9jy0c3mJ?2QUh~9>cn6 zzq4&W%4Tz8lHc|eE*YWZNif=sPq8r_ZN?=YG4i2^j&Pwo z1R8kLMughQ_Qggnk?jjIk63#=xOB8ZM6PYvz98dG2h-Ex9}u*SURUcOo`L4Fm7htr(4?dWVd?=z~ zHsIC=0}e|hErOAsZ6lbxAtfgF@?K{kEM;!*+^@uUNljap~+lBG-`E_jJCqwmEV- ztZjg?E_8ObMn0T!sE@X+AQ)|V%uD~oOYbA%^sz0-OYbW&F4_wJ zfM9tIC(bu`8HX4JU5OaWv1N%qTQ&nV@c9tvz@m%x=o5^(uvM_>5O8OGf=+`!w_z%| z4tM4-%fFGsEdMeNBd-V>3c~uF^dswYGL~4M|IX>KK3~mYX$UliaJU`8SkEYev7QM8 zV?6-`V?FHtNXo{MbgUDn5OQLjr37Q0to_6u6-*z>rF9}00#@i)V)fT>X>5DRm_)2G zj7w+731HM^=N(|oN1A=ahIx>I2|0g*bhNV~LpbOMk?m(;6m%Ex~qx9T2aAe?Xk! zgF1nbE(2I&IHr>40D!Trn()DNY-@Ld#SpUVA*5s9d69H%YcRpsMRY`fgK^sW$S07e`13C4Ox5RCP^5R7$35{&gMCK&5qPcYWGgJ2y94-}r z0T|1%>i}RZ2TL=Xj^)M>jO|7Fsm;5%e6}vqM_7iAJ+@!`IUV#DJxiMH7jz7W8hkWx z;Q?XSYQSh)ANXK8>f*AF810-)FxFX1FxEL3*9XwSI;Rqhb)txlav|$0;vd#mDO|b& z1R6dZX0NFLqb_R?VAMsS*W@e@X)nuD!R51k=f`2JTLUoawkNoOXAY;+%${ppI_pm| zHdud>x>$eW#tXvwllYMJC$T{X@~EA!0Ag$n| z0T^v$#|dDxe;`Rm8|?{3ThM(}AGcD(Xjc-!sQ(ASsDFrHY~Kfhv3>Y011zfpSeIbb z@h2GD6iqPNmP|0VuZCc3-)PuVk;f1)3VqgxZJ=`pZKC&OSVxm_OU4ZA=j)IO!umOd z!#WVq{TFSb&+b@1TXQaueRa03syreb;c^Jo`WRty1srpopUe;o_s@dHK<9r$PfMt*cXV&q`g zG{DG#LOI!b@j?cK^#keC4iMJ}XOr1)D4Ti~rzQXIS8Gv;NUI+?f0|g;1v%2|Lt&%^^@}M!_ED4Kp^_?;qOJqGB^T&gAg_gzzV-%_wKg_9Ev! z3&$iK+c-9xYc(Tk=vQ_;2^K{@mrxOz_zNswx1o=`8kJfa>n-Uuw{T{}tN^c&;2E^K zmYDp6O3i2jBf`Cc{r`!lxmGixhQpqJ;Vhv}GZOge(6oqOHHa$s&X{3hIemikk|_Z9J&E!2s^~dV#4e=QcAE5057UavB`QEg<1{c*~kC60&oT-N^odkEckh zV%O_X=tnSypN0++rlDJeX)|W}vT69^q0oSa7B#bz+h>Erf`8TKW=hRyU=a%U366j& ze@WDWS~Dtc-}?t5o)X_XY$<*Mu3Ele5^C!V z#xFXwB|UPUw!v^O7{BmyJ_BkGyL1JFO!mT)u?=7m!^sc^{Y7i|4@-tNE6Dnltc(#s zl#VVa%`zHJ{D!4;W;o8+0GMmI)XZq&AskmezLc(c=W+WYj)h;ii0qB57WD)U_!&XL zlOw%o$!6q@Q;+TbUsTYtW{ZUE-1|@Xc#3fNwqI!Y&jt!NTN)Lp&uL51_l-IbA51 z{6f8%g@OV8i{`eh*%Bd+INqfBHK$OSdKd=+ch$t*Gkb+Jc5}lZY0UabcXESrazwzd z{KZqEwew0eYazYR;OVr~3oWQMqv9?#{(*?6M9o77@Jcn|#XRgQm?>VN)BJzpeW4bg z8Lks}C0iu_XW~YUW(3?;46D~Kt!u8;jEG&@eo4|)qZt9a4*rs$sYVk5oW{bbhSNLv zXFmT`fo9Bf_}~)4jerK;X1Z8w<0Zte4fvUEGg4vGxO=*v45yZwMhoE5hxv`yel(|X z3C4W3uY#ijgzjsa#~-MHez4t5^A8T2ydPf_J~by>$b2 zVt;a3YYdFj*iF5~EPU|ztKvpKFW#61M!~Bx8lQ*%6PlpO{SJrfb)Cd8Um%SNJbGsZ zztfBu|IUkI$^{Mo;xl}d8!hP3Jj|!~GUy?;#YB*8@JB!VyMY!|f`4YfJd7U{@ZsM& z@NWcEDBoTIUoMXivKsh0LIe2iu!TIVhYICu3wnI}jsl-9D4~6_5Mmyd`zEk&IHXy? zhYIEUB(Sd<_zXb_`S3d>l&=;1af5H)B9bTMQwBXOV@onr0iZp|rwAeCdklYMQd|gdWdZ?5hUEU(J$B@%)@cf zL%^pEe3(y#@^umLMcX#=;kcoEcLaQ~4Z zhtY!qzI5A0zK)Pj`QSjzCjN{4iG3>teEB>+9UfnpfG+{~^dO%KZEvuEufn#`zAm6l z?K=;D&;*Kx^)weElmj^_E(1NpwwMU=%(k&VbRmv;*uOafzJtKm(zx0#;QPSi!|z~F zzNs*&`1Vym1d28Y>Y+>qJ;b&cL9uIG*U&$dZ-{`e8u;*U-c%@`gMiNv`1*qq&dXj9 zQob$%zTpy_AB21z1biXDr%U+sd3-+v{&NSuE|iSuVf3rOe@Q$(1EPohQ4jXQ{|)^c z4SckXklcW4K?&1sF%je-@L_puuOWoAy$>M{|2Oc(0$&e^Q=#1W9w9zov0WpdF(^~M zV*jdr9;PKglHszZu;8O*@z71@g z9!6&h_;i4e?yCSB_y#C9^`Gre?6U$rw80iWD3&}v2Z&SqS_}A`fe*g}MFsUxR0Vu4 zJU%DLr+m)=^ZPdn_;etR3gvqQ35ab;MiB7P^~#y#L6^as8k+K@0ACF$g8}6$B-j=c zLAC*32!yyE422N&kk1|BeESk01J_$Bly5XBA+{wMs)OMB&w!C{IE0k1uYfNXGVu2{ zR45<*CX3G(4t$G13Hg455cAN!R{*d$Tt>5k*YUapV}N=nPXQpd#R$j;o_#J5$2{aa z1Axz034CdgP6hQ)P69w|ixH494vqdB1#!$nzU^=k&*zH-LtC03>7d8wD+WF+kL?}9 z<69u$iv~V@$ftrFD02mT=YfyT4>!n1J>(xN;LHAreJ%pNM?Cx7d3*)}K75Y|uD4XE zeLV$yZ+Z5O2W4vCP{Dfe4EW%dq(La3qhLLdb8KwyL>`~6fUget#x<~U^fKLbb z=zN>R<0}x{SB!yn!Pea%)V_m)`-+LcNBh?sv}t>j1bqI$H@bnX(Z1yZz98VkeH_P& zFORQQq3QU`2R^Kq3bpSe=pnWx87Vyb{2`6ncU8c568PX2vq31|MFHP7;L`;yv~Mzm zl<&RZK1B*9M@#dgMsVL#&a*Fw$9GP^CkC?44c0aK@3esL8t~EiF@?w14sJ@pw)gP`)r--C0={tIqyCHF@j1a{;J5b~ z@M*WeX9s%x_9g(IGw7lJB6)n;0zN5q_?>+Vd|Cp&3gE+a6!~WH_-4sBweKMC>9)W( z9rXD2=?-mN@1uBpt^&SF;Je)d-*5q667VH~9@;mT$2S`mJHG#L9nounF9P)V_UR03 zv@e>+H%Y*E7x?g6o(giHcnJ7b0N)}=NBibOhx4u^sC_#He7ksjOF);l*Fv(X|B`^ul9CZUj2eR;ma)YMNIvk<@sa>>%GXN3 zR}OshTj*b90iW{-hN%M{Z0|B2-%D6?`2Fh)o!e6XJ^?+xeGYJuW=Qx}@c2#(_`HEE z3i7ES2TF;6FB161KswsD3PRf6bOB%GPwd+u;4A0Zhkm4dF#^7~z?T8}RH%JX0=_T6 zN7t*>piKEB1^dw&_#pz0D=L)lhjLT@*^X>nPuGAl<+}rV{QgJ>J`+kt^e}ouz~>Hp zx{!|kTSxTJj#P!FeAj@F+637Rcn#=bx-BMxL<1j|N4^vYseQ8qe3ii04hs;W+|vbo z2|T_u(4~Aag7N$T_~a-V(ZeX-H}UOT!}H%pqKEcQ67balUr!_;LhbVq@a^L9Z3bOx z-v|Kw{?LQQw$#7Qpoe8_Nj)cdeCd!z`FaTWOo0#Q5f#)!=>h<;Ek;1@0-r8~*dLh? zVjkKd1%Pj#Kk(^5Iu+DIsTZ^tf7C(8^ESw*e2)bFTLgUgPC_b_4}aT%*p_5C1K%RR zXx|P9DPOUGFCQKzw&cGf0>1OW2UC;f%jWTI5%8S^K0nB(LhVZv@I3-PT~I>%av-Gk zt&nc&KRvj3QKe)=52H8jqM1VqlY(Y{>}r+k3|K1<+3KT|SB?F2IL=M!sAKF%RRj0Py)10Uva6gPJib-}z7*iog?uWsy~+YUQ{bcHxe%0T zd;Q`1jNczefe&uE8iev?!2savodi8>9~G*X33`ZaNyc!fR~In)r3gaI!*YoNz6#*$ z2kBHO-y#8DIFApXMNz&00iU=d_gqNG=Plq{1ALD_3GFN4@i_?i+<_0@JxYbzH&DPA zHM)`S1ds2l;6CpyT-3GXzYl`@yooSKQ4j4q#pA0M@YMldcWNBb!{{9WUl8!=LOSx5 z5k2Hrg-*xjL33Eq)oFQLDS{rh-ImpY-`4?O2w>zp10m)i-$#M}oOQT&7eE#()PHXU z{`&%ai$DYU&Ou1|dIPffrV3w*aI8PUV2SipA@ z_@W>k?Yl(uu)Q7BoBD5JmzMq42K2B^w(vpe@7DMn^D@L~dw-}k<%pZ>$0iO%-wKRVh3ivE}d^dS~ zP`t_bTLB3gkVb{J7p7s8_D%#ox^H3s(e~mv29q1cb2{)%fH)P(hdPLDNyZA`>kk;) zdj~?whu36$zB=I3fixzU)4-<$`zIhPm^Xa)a z^4%wS$mb0oKHryaE%z__fX|lzd{8xO-vg3|e1qV_=acH*@^jV!q>L?uD7$!k4T8>c zg7H$p4C{pDW~3q5caL@QvZ|eFJ6cKYPLaXaj=}?WRKcY(NjOEy+j%K3%{#UcN&}`FaTW zbb&9Dl)-@VbrJ9#_-x634#Sm|6yU@AHY${_pI|?)1ip=+g!YNxL+x`=;jYsq z34v`NZhQ;*20|y{^*mqCk}5$+>wQkzYfSQxPl0Aa8qOX3Y?kLj+K%ByEnnxPf*uyP zg%3)kXXAAao>oHJQ7Pc_{|Vn!0pC#`AD(tX`A*0*ZErO2@tViU6O1yU9b5)2klyA{b_@)Z@RC#=ODiig~MFHOm;M2j5Awqrh zyFhQ(PxOwG=Wujfod-S2fs_=t1t(xT@EQoE0`&Yj$o`9Y_z6_vLYiet2O>#89h4ZT zS8{m$G=Q-f*M|1OB|keqFi!RSpdHkAn2vnmq>gxqqkXFI>1$+Sp~DlyW|&JcH#KE* zj0`PI3@s6QD=csv?j#b?8nNz44fO*x<6z6>ar?9$Ge@FP7xSs)q)_zFq5YkfIsUoi z|35U~ETI++fiwS_q{A6!P2$1`Jrhxw&X0?lJSpJkU|+$+{)NQutFJeI0Ov8g!il?h z-Y%ZSD_bqcSjj3b6rWjIAR%*|Nv^L?N=Q$TOP6Ef;E_QOh_4P*PYi@GRV(pnGCW=$ zhxlgV(!?wvNSuxTl%ei=M0vxqd>E!$hS~W!v&G~g`USg*A%yj z4^+zxRPFEr`Lm@VG6LP zZSR-X?vD&I>|xw6Co-kjDCF+^>|16EGfG>`*O%CzUMJS3I#6J>D6>pkyn(B%6pqQ( z7q{o;(qHoI;??2pkT{rkyJZrR**cvw-1eUlYh#rOam0#pN{EY*ws-QuETqBpF zT<8%MHa;*|xk$X;OjM-gDV}XE@>D83RJ=uX*z4~~ZUx^_JBDb_9TK!>sGEm!jCj4N zC`M_7IM7TqLTPSfqjq80@_cazu`-lUOi?)-9ISFdX}!7Vf^x-r)nWB9%5I52AX}wI zB~&R!F-7);mHS|8$04#cO6yHTH7Yhr<4i?1DlZ;ZtWzB}J5&X$Z!4CqlJ%4iRs14z zd$05498)WqD*4aWqAJ<%@`Fu8-(_##Pui|JY_g}UTjBS!7sVaLDxoSd$|;IdcDgUm zaU7x;s=VG>6sodG8Mrs8ObMduf9gNhzb-W>MeS3f#FBOODWYYmndLg^sWW0zi&vj{7=1Q9 zRdv{z%yMn9A~!lboC5YH^t*67-mSuLn&nz{CP%IbktCgS@@2lzStCr~tD`C@tYaYjl zzu`!ffRPxZ;FhJEAn`0JTdq2-I6pu4Oz{~xvG}RAY?V0AN_L5eiT<8f0Hd?`LUCoA zIYv*dAzA+Hg`52~#qy`6nBpYw^)^ysc_;YW^VhQ%AP~3xlJNF!advrnO!1sHVi~cP zr|jqcB2O8Y)Z#1~QH)G@YH@6;D5=sYMK8MUjNQ#$^0$N6o2!V$Kvz-hU1lXO7DK&a z?bE>WyW*6$BHjVeKrAf z_DGh6XoU38Be6$BxzCKgxI5cD-6sFy&F29sVnuL7b*^{bKzXquGPXy?Z!g}YUo1ZB zIeyL@cW`Q_3o2OyL>FX=|12(2xe2R;OkoZ<RG@C~uomVNsM(Q0JTd zw8RQB(oAl#_iianD66v)Uz{D?a<_Ymit;-0_0)`hKDdO2ui#fdfS~N-t8e zn}Uog){Rb$TCFZAPRp`Vfw>SO7keh1j{ZPhacO!rJDRxVR8~0L81oE9yFG8bl?|CA zN{~pAb5BUyo|2O4lXEL2Kh-rUrZ}ZMb$Zfg=<3wuq~paw&%8Gjr^<nBibZgBRkkyR3rUjS6bR`+4AY&(%sTny=-}MnK8wICLFTtoE?|dPZT3f#(ud` zwqDs*`Lk!U`g7fl(+G^=b@$n`DRyZazqqFDtxT@CUF;oG{4B2eY4LM*3e-q{hRUVB zOP5)RzDw0^c#&Ep4fR@!illPE2I)YsMhdKfTGEU1jLA=)djx9jUHr_b+P?UiPxYhX=a$eRt-ecwyT2>PNM>1yVw5*YvYnH* zac=5vNzN6}LA4l3F6+njmSlMx3(-ZA`9^u*BJ8bfpDfs0lnomUbk^&fmnmOZnAPv6 zCKjelPx~`1?OAf#y%*nW-N3Aw#n0@}H_l>7u||y)bbpQHcPX&#yW}RRJQz5VX&b>D zsr=+TaExS5>I;a#E{PCQeew{ZHFh{DC2bq5asOvqlF^p58&keNi>sXkW`HfOXp8$V zEx`^VcI3yg)w7n^HCW;*up|gA`DMpV**+yLKMuOBXiD#A$-M?ZpZQ^*Jt=-3B$j2Z z=_jg@<@_SMNecT+mh%hr4cH^g`31WMAnPp{zAV&JgD%4e*Jb9S5wgTd*+wZ*<(;#3 z$>(^iH&cU!TarnKrOQer7Uy{20;8QDSGc_}tAR8sh<+_f00%fRaNurk;a zgjKn+Re}GrGx#;Yn6S*sl+Ss-9yT*sSZdi3Auqqy*`+j%MsF@noUPw@zar~O1D#6$DOAE{A@+Be%Ay^1hnHcWO7 zPG@2Dkz(+B@@E@J226dufxYGc%ba`KHP|K({$_1c6f5H8LEBUjULJfa5P^LeX~)ur zt=3ab^%)wR;yT46#c2H3lzp|gQj%})Oo>bCRh&`+`$N(n#i`D?E#$#emC`KI4^&+&yJ>M?tPxSIJ*dm=I*p?KCqU*r+WU#%ry`EYx|CH%qxhq(n0hX8C zPR;hgQR)s0LOUA;pth0igRbo(+v}+HkqZig;VMP;EP!WrLDOM{8C_f=<>pxVQzpt>c(7)Vg z%6Yg*zLkJ83!IKKD~p}Psq7^7A@p$J+%R#0KINb3Gk`u|%1LgWNI`nCM)2qdbGA2K z7l1zdpXrlUS*gaCo31|dw^)2eZdih1s#|bvemBLGfS9EANBb1x5@Z$RaLu3c!FQNYme%3wFHU%<+dCrJU|fRZUOXe z?IaT5l3`=n65mVE0YGKP9csm|u7iOocCo7X`O*UEjQV;RD`ux!M2SO$PZzObLFfMGeb`4QGEDVi zHM{zH+j3Pj(h}P!TO=JL2j*2TRI^P`EiEtKEuG&P9t+2(CoGFAEyus#!qzSU56j(Z z<>EVcjrZxCSt8E#(b-?((0>KoFvq9IE{n@7XW&s3@L}i8m0{DMFfBP=I$mw?;RKbC zAxY)w@g)xI0{~hHl%@Jb3Rurv3Aq1u9n4xlh`CYmqQNRcOu8KX27Q_!VY}9@{m$rb z7vw6%xmAX@#KX=j=D4-17b_IWl`FPCe@1bAq0F!&?Q=Bieq=CA<|v8S#Pk$7!&JCa z!m%SFe_d+Y+rTXnjZ&8!dIJyJZqx!2><* z5+q`E({0U)AuX|U>_XMpNWbbbHT1Vkkwl^q==5G1@7i306)kwZaK20CBwo0L3ZrZHt@_c84r=Mrljp3#R;8L)nXG>J!N8b{kpjJ1S`-4 zcov8}3DU7+(yL3=pqO+5Ru-?;tyconXK_#|K@Dad)F{oXk*ltdf$FmDiWCw=Py}6D zPvi#$B-~fvRPyRx{*NJsx)Faq&r*3ByYX>b>CXP@s`c^T73x1Q2^oW4>Ku>$lw_Ez zoV~J*n)95F8MD96xPC!*YK@wzU)1gL`nA2=${OiiIk@l4R1Nbl_fq*);1d`6x17dM z#6E~=jLVQX8?>PRZ#sH_^IA*({JDQ<8PwqS3t~(=SUuAdJj_*oR$^qM%)v1e7Q0dMoGGc}vmignVz4K{{!JaB)JZ%jw+mh}Hk z=lt^D`+?sZTxrU|jgMj8S9%QSf3e@E+|lQAWjX{LU6L|uY|+aDPyevasWdx1eqCuw zrK45Ghjf#ded1yyXTP`I=J)u?(JzDT^&h;ytTpwc>v4-9+r#HBPBNN0&g5cm&CM#& zLtj2!wP8WKAAi|D9O>H4udeiL!QYEEYh~@OeR7oAgH|BMu(AK?c=&gGaDKsmTk_BU zxpdkG$cR|DUtk(v-t>BPwWfS=uT7T?maVjMJ3W4BE0^EpG$hsS;(ml}?9irdpDz!m zO0PqS$&NT-^oZ zY~Lyi>E*||oL!pZrTii(y2GHko8snoxVX<-p*a8Tp;kt>pGRw?=@oVO@TKS7)vJ%E zZ1$X{-+kTCds^l*dY(EzrR}R%bF*@t_bat?zu(8=L)-|zGQQ1xjO~OwAq;pS9dE*P zR*k1e^Z!lf{P(XP{DslH9Z{TXJm$M^LsDjuad?~nPf zT&>!=J&=F5Dmn3B{@<++q)v#qo%z~!@!|B&X{$S>X|M7r7_b(ui`B8i3T;MA_1>%ZrSqYI(pGW)8|@FS?K=6~fXx@4 zOG)L)tXd3DG8mW1m$%GXb1cEOG$M0Jcz-h=+1&$01umy-yMLIJ8u5C){^S8Yw2Jm> z1vzXOH^kv%%B}V>`Ukz1O_VC`mlidprxm_iPTt=#xnth6BYOsKOw2!Xs9(i)`OnUx z^9!b~>wA3R(j~67|KucY>3}r?zPJn07}7OGn9i#4^l1LS>74)m^~3)*KUlnO`MLqy zf!{}s38{Xu@ACEzrXTWRC1P^B?|DA1Soz(^JDd7Wx|NU{bSnCQuyG2=gZW}}U z_T8}Z`@P61PQfZ#b?>|LuSYn)(0fN3(s@SXG(>Hjk2Frhf73a?{P%tcecWkKlSYhlL?L)+kHaE-WhiGFOQ@HbUITN7|Ir;ZK;b(sMzn|W>?&p0^`yape zouc(cb3)vEk6U^d``oG9AR()`^x|6I^s&2+-2FO#^07Jj*Hpj#UNLxM+cArGI3Lvd zo-L=QT=#98XTZs=-DlsncDA!KuUIkZ%JF{b&U>HS-BZY)|FoWe$HD*o{>B=b`8 zj}Gh9!MT-=o=*4cT|e~;i&(jEQReo zT0hs$aOS7i;|%rdX3CF`IV`)PzRlh9Q!hUFJh7+dqP54PZyw>7@io4fRy5kdy0mN2 z!v{U?73|H6tLy7LO#j@t`R5AuTv@(8SgLQ?m<|)itg7kL%5iq-nGQZ0?VP@>|9iQ7uQ>dfqLY*|2n)N={rgnp_g7EIlH*!ogd zH>q7AVVa!|{G`2HztiUoG^FE`#%V~$1C7)0-*nE8|N7y7n;-smwsv>(&e2>2fCFXE*xYP`+~Jz=4&9=Va^7nCy9SZQ$~g&+p`K zs>(ULrf&9#T_sNo%HH?R(o$P+s61`?nRf;X8P?sh$9vZFIqH}4;;fx%wyNe=o0V1P z)|?vNb(iCG<1TQJwnLuad9$@Y=WE!4l0|hr+kiEdFE4@Qnt>oyYs% zGN>$iv?p%0T&1;2#|u$1W8P->?S1z09={&TDuuYXLqVg$4Mn|(zr;YM@ ze6+dNIz{E_-&3v{g`3Hz_b%-`Gi!Llr3sI;w47JIf4ih+$fX}sbGOU<*=EY!w9t8j z4bv!GU=XTqc&Pr@`O?iKg$Z|>$GDsqb2uamyx{sdh4=rju$Mu zr81w^AN1c4`Q*vg`y0<2f0%XMtJn9%zOnNMJbre=@2}k*!{-dJS-7h8kpuQqGNL!Q zpBvPT(Fl_H?GLqT<1r~&qcRVUGcHhz8I-Z_o9MyQ9pA>Q<(Eo6*6uyM`)|>wj5~e2 zn*C_4bHLa=w>-B@>9YIQ`K=?;wN2k_?eF_#(hm2S(6GtNY_#fCK3~YLx~wzt#ql3n ze_eXvcQ4ZQjOM+A`>Q;Tso&hH;9@d*>8WM2#>sj=?sU5S5u>R+FuNY~N^VIK=keDXZ=>4@Fvk^`2a}*30a(`=v2{spF&_r%z+N z0^|m#`1VQ)4Lp6+aoLCj1+&d28>6+vUmnaIBC*Xu=6A*LzS9>EJNI?fl-uol4$2sK zQR|Aar_z;>c#Fq%L;HVNeQ?>@#f#UyQ!wotIe%V8PT`W-BQqZ_c;oF7d-Iynt}{Pg zDYV-%wePXyn|YSb`}QnO`60bvOY*VrYDP91tvqHvGZdZMp#7`w0pLvj)pr3fzxr!_ zh0T?#wH?2wc5nNmRhYK&aOdbuEs@RER`7NkhS{Py@%Nk>75C$(2ATdL-D~)xhaqQA zYm|1oIw<5O=ARg!(y@HI{nnHrZc$&})C9CY;(vJf7_ZBH#U|%5zjn?!1G)OjCkCCa z-5mGa%CYiBKLzcjc~f2*;@i>Ti#l^6)1DkDEj>74M_@_vQ~$U3E#uqj4?la^!0Hs{ zro{ge&cJK?MBn7!J=?oW8{nkOB(Z~SQ$WuIrd z^1gfP?l=y55IYw0`^W#-ed6(@O5IFftyyo!*AB>kyen_AWzPEVOW687u8R9#o}Byc zsK>#TNve67>jrOlGIrUc*ZYRtiNf-B>uc`SAGq(VTCgzh3A_RWjpxV1BE!HlO`Bge^{b7(UhRX3g&s z4i2#wTUo4LGb45m=I4zFk1kB%!l5M8HWscT@Z z*X^jnpnS~t==NvH>+t>${=VbbVQB13vuB+~^huNcaBiyVTX?$-!Sdtkt0b-(+5A+1k$Pbbq?f_vOc8m;bpO^Us(bICykR?xZK~&e^k%wCZbj z`m^cz#Lfz5O{!S_^Koysy;oJdu<&zO#L)Xy&jPzDjF!~&y`nhldw(o{P9vi>z0EOM z$zBg`=7yx-yIh=m+E4ewZzh)d`!N6Yg%}<2k6kC^*Kf%@?D%=!+0?(U=t#Vj8q{XO zJk0N1H9Oh+#rLZ*R}bAt(o$~6e9$X-Kl+p35cj)2n4hg9`u48K%dujC%x$%Eg*&qB zm~HJ1P3C;4?{OCM|EJ&i2rn;`${Tj&^Pi`?TBplfdvw?|{HuG{^YQvcAR>dunoay_DNeo7uQ zyxYjMA9|C%zYVpJ48F1M`t9AThrHeLb;h90d$TV89cU+eKWgoOj4n2ppY-4Um(KAi zo}BGwta-lV_#SktasQ$01k<{dq9(dYGV%Sv3&yL3_-(SCH-4hL@cvYb3>(Sx-UHY`+# z8@YRzO1-^Z*v`!Kz8NDsCC29r_&Z-^>hCLV1id?O#5Fim?T>(wDl3b+t2`?>_iC!? z37buiJUgmhclc|J-sXMp!iMiYkoU0Ez4)8ypl%!Qo5|W0wLKiB`bzoLksIZg-V9vW zF5#JC&qD>(XSVK1aOybw!u$iOhdWnX+o~z|I^%5if#W?>S6zNDU2@4Y*?Eg-$esB6 zUe*s}l6F6|+;;NJ73*h`r$RlCnN{rRFn7yYla5!;?Mmn|_HDt&YNM*uB|cv_7_YN) zxBNQ3SN=NX{liP5^vmQ@+v?_d=sjOF=80yNrQw}$eTB^EiJP8ZcT)6PsOUY+BBtQX zB;CJl<}3(lv*5AzNN?TGy=p4|N?wpSWcB(igOyVbSjDwUJd~Ed(thJg$0x%Ej_lZJ zaKI#wF6Se>-u=<8M@Q3B6a3z9cc0kW;Pi(Dh3?}QP4n8l!+ieT&kq8nM&!I6H_Q6! zZ}Ypi>C$yeeTU)xWn(1q43+q&g>xwoHJ6>gso`|!(Sw{{FIl(pz?-s^|A>(Rd}?zz;hk2R1{Z9Ss)bB}=F36nEt8f?^L z#^)M#YiIv$iG6Iz$ypOREL^olLifQRw?U+YTqTzb#U^s2%;uW%%%yNl!+UU7LG(NS|e*RPQxju^To_$(6lT zn)%w}*xI9ApKNm5uu7_JDhg`e1eNIOFP#mzi6t z`6Kc_C_VJPo3?+BRS(UP(;xL4;Vs@ewy3RbZQEYsM||lxD8psto2_l4?P{ajyE7iT zC!gnC-F-x4<2S}}THd_O?!(UA0mAU+w8S9ydBej zl!|QbGP4Yinar}y1ipY){GJ74!v%+;!y2g3I++_z!t!;lLmzH{9Y4DYIJ zIg+2VInGM;gWT zUE}Q3xAL%G^mCV6D+)AjS@_*kmB@G6eQ};;{NO&5v!0uDUH$csHQCMwMm`_9%T+F- zZ@b&O)4#?&h+1!*=2uxbr=6Cm(Y(3iJ!ASTT&F&)t$cOf*k$8h{}wj?mD;A@y9aJp z$^{LPlr)*9H`Mb^mh_6hM|@kgdSCV{CI5cE)qSrRmeAgF;YQcsi_>R(%pb4OwVjin z*U{nO4s9;HsVN;&pc9Wy|)_S?{dbH=Zb@@(Jx_R+LR z*IjO(y^J8=W_HyGc^eGu)d1$Tua+AbPFGM*VTHSOxGT`Nv zv{6^aM6Z8eZ4y>9OosoGxwXYJPZ+q1Cp$%rm8eQFnU>y@MDw0_Q= z)^3Z=6}!3JQI70M`-Obb$rP8UPPbS5OKAwMlo=gdEJeslUxQC@bhXW&4I{Nx3ZbsGNZCLgA{Xgf?_nx8Pxv3>8w(x)6ow;s^@$7Ssq z4-F=pWLyo_-gKpUeBt3e?bk@{jZB(2F4x+zs_!2(;gf7^4{u!8!cDMw5>R> zzgKGatzLhX#LcYxe&TR<-QV}_emW%2f7rT^-`4Jy{c+fEWb3DW+U}H7Jyx_!Vc^vI z+UiG<8n?nbOn;v{{YYh-b-i!rw@r#Y^jehMS!aiqv*fgg9gc*q(J_7J5g#~g)o;iC zI(B>Zm#$-b_n9bhubWw)NY@H+zM@s(ZmAv0dLtg#JZkUxO5s}m$(6YSf-aVh9U%_g zp!0`u(v3ZXtD^oKwE5+XJvHl3EZoum-Eoy}-6qR*uN`Lh&A~JNRli;CNiPmbrB(zF zecvVh<#)%Wp4;M#>uO(5=y7D*l-YI@J7jds8TnTAfQx)&D~-)bH=o=o3Llw$Sw_F@ zZw5hiX0A$-CF|u8Dp5*4x=yMgp3E5Vgt-rhp`teFvu62gY zu+>U=rjY|aRJBVV`pEHw-^h^{kKDL=;q}V<183yzx-WA$c0}B*(XBtWy5Fkp`ZaQ2 z5134j@BHIqot0+SL9>+Qox5fDuhs55XjkiTx9+9uX?o?`I4A3#@AJNV%w^-Elgs+O z&Dm7>L1*NNBO#M_b?Y;&o9g}tcK15;e`c6(akN)T;W*LIj!|0{7qz{huIM__&2X5F z?lw&i>0K|cdKk=%7Of~axc!zv&*4inrDsYUka_)Q^p-iv??!eFNQqwbpx$uy^uJ2I z#@ZHL2o6{}@MNj(IAucx@79-foyVo#I=pA!-VPgLUuUXB7W^&wM8%>+HMOJ9?oFPt zq8&eSRaARz(y@FQ;(hMo`1CB}!b=+Wk3Wv=b4a~im4}4q>GCsQJ|1p0VqT5ozCR9R z&bb@;>C)#XJvW|T>Jkup)I-5T`K_*5rqf$-QTO6aK5o8&sz*w72N_t5S@!v&S>5cv z2hKEIcYWxrO;hvxsl3QmSL`x*pl2WLYn#8t7*v&o{kiwxyRy*F=KoBgnIyUx;t^UEGJIux1x6a&- zUq57PtA(-#T(+R^*Z+F^gR(I3-C+i3VBpFQ_RbaeFyOFm^eW`t{v`FZa) z*=}V~Jxos7=dC@nynM>hNzYrYJMiG^>yJ*klTNIWln$NH)6lNn=EJkjE;O2ubnW4lkW@V3c{z>8f6r7jvhIKrXRgkF0} zZf$c(@PnW5&J3QxoHQDi)ZuR6&~(Z(SV z+}+)S2MF%&?(XjH8l2$nPH+tb0)ZeQxP=6l;O-9&`+WDD^W%>3#=UR6#b|oZo>gnE zs;=tYG}TqS4|rq}WX1{2uOU@<$ukEtD7gAUZXa_c&1iqwT14r5>rYY+&3|2Mj2Dq2 z1OFXbF|jsQvfyjuFIP8ZxCr6!;rJr=cX}j^PtQQYOhyuV-FvarzV-QP*PFQHHYJeM z;}h=xMmZF%?fu2l{jt-@l&D@h#(j)XsOfR2qHR7bUDcEK z-)H_5P7OLRB5;V)!viyFZQMJq(QR^6b)nD!5(~%J0x7flSDQUy2+7%c=^w|cAq0j$ zHZZHYct}vO5v~f=IB8e)+O7quSBibx)su$5gRPcR%%xSb(D9X-8D9pUbEEtfjXdwe zTuLUV|3e6CVx#DfI|&=L4!Y^CRA?U)&YS?1Glrk(MTfE`Naw|M8hwi+24YI{L%T z$7Pb1*LN5y@TS4|MWfc)Co|hJ66+O~NmO1`cbuuX-u7F}#p7sVIx%y#E@ZN5A*_5N z=y)H3k8Z?g_3zWTE(@JaIPSfBF?MxXe~2eXGAQmaS3!R@g}kw8!@D$;RGxig6%JS^ zsjs?%1WREbBe8`Rd#$)SSB0)lVDFhXTC#G>Fc_2*4 zsRCtbsQI0ZNvRQU<&=b#$eck>SwN7R2C6!5q*#!A@YuK3@AMfVkag92H!EyKeS#u# zru@yA<@j5s#Jw8ItXDlHUGyzSo9Zkhl=f6>D)?-ZSe@rJ`?sT8gt=On_-q0IQL_~* z@OkPjE*#sh^f&}5Op#z`Y`m#t8Y7w_hWcz5R`XA1^$46s(Pl%B3#;sf%|Z#1>84-y zF%Lb3GEPh7?CHE;`Sr}o!Klu7u~?S0VX&3`aw>Y)c7;Ia${JemlM}VG=k+*+V9{CT z-A9SO&|qo0Zg>p_uMDFvr-9gbF7ouN!iBFeqYDY8uming3)tPm`rpxS>8C>+(X}*J zYpFd#0!0#Ex7$B$=Qp8gjizVSrBvUo`fWX=T2HX0D;vY(M7itIRf18=g?^uw43;$r z97te(3)Fh?)EL72ZeATq5f*&NY(6S({7_RJ8IdFSe`9R!^K*p%8{>1I{V>%t>`^go zFQiF}P%P@`o1=wNdoa4Pv0ADlIeU1mDaX$JSz3Usu4IdXJJs-BidZ|O zW@!i+MrGx@t|CQ#Wg@sU@P^0|2m90W+Of};C($~{sReMrjIjPXfcV_rPxE=*j+{6a z+S=dyx~>(Cz?=6sPCgkp?b>JM9vHN8mGJ3V?p<;sQ>?H+SYxfof{kYtC86?8l5;W#N_K;OFK zE4$_Wp$I1H2!}0n#1Pv%mSZJpfLdJ-T;_YRGz#{GjS@>?h1r1oq*X?X$5xbR_kTF* zWLU}$0Sl{h`FM6=Ue#5#7ALGz&)K(XM1Z=wg=&{m~C0oyWhwuH0uRdW62HwXW| z-P4r2FJ_(?VkZHin3HlC_c6#CKlY|gmFxko;m|Ww8gYt!F@s7p@K=OVHI{LKbf<28 zB6UpgJpZK7LOKKwOZyJbggD3zJMt(4@W5KSZb!6mWiJZ>=jjW#F$qDU(bv5KV=6fU ztN!M&MjnzXV<+?B(`M*JS9=9?|3IrcLNHkQh2mB#9;jSxB^d83iIBrxV5xBPNvhAm z;o|KS;xlx^G9G60&kHcNeb<&qZi~FzKEXVSt|+?0>#%_vWx}F{jb&K#0_$pmBkxsdoP|!kDj_PC1v?tz$dxuW&R&vhxM4oTM9<;Ms*&W4d3j_3l-l zmX}!M2QsZnAS@CIO%NJn(*Ee>?J;TkadBZs>HsR&03WjlGPa;%Dgpj4+u(^LZwUBv zCL72!8~*7#7HytAg&?NehbuSkP|AfYj`O4mnJv2?zJYK9lMvS$666I3JD_;*JQ3bo zr=0emA?t)gaF1J5A6@ps6rH_e-3E^|?RVm6jMz;zhu2*xb2TXIa#^vk+i+Ac|Ndih z`fg*;z0N=87!=QkFw4=`8C_-?Se+f3p}vT*Wo}gg~)}Kzh_$EsdS=gA4|1sle}!g z)apk?kRK;FK~DnN*Kaylu-o%a?EI3nW#wy!V)7-@v!E@0&e7yS{%*5@Vev zIfW{vsS37>DD&k-v&z5awugQL)ibOgp2^vEvFasp`S5Av#_!<$yUO`jZ7{I*Vm_lD zk5HDCj#|l;#KfN&55m=nswWd<_-_63qhTz^VZz##Imfv`@c@(`+g20SnmmV8LSXse zf9RIEGnt5{%Y>(55-p}ue+Z_FeJqeyopjuk=t}29Reu+vxzN^ZhHC2}n7DHG&X@?~ z$1luY{*(C%(+M4+KCpYC7T;zSIoC5=`YnT%EDt!^A4OBT79;qg<`&c3C0O zU?h;djDxRwVP276{qOet=OL~R{wJfK=a25gDmTYM)omyEs)u2%YVEx5u>PmZ0m2{~1=B7PWE^n&8~j1v{9QGm1vHX`$Z*^G@c*ou&7 zaYzphPge3VGpj0dc3t{p3ipS{=)$&P?pH}x#cwAJp%<}AEni0IJqHlw|DMvjO`zdfC*!VVOAokbq@*{TL&8c?p5j-B&?^=v5;^=*{zDLo}81E5> zn||zlQ1E5B6H1a<{NO2ao>h*75l^4mDp@lym2ySVM`_n#+y24mmp{I)W&az^%S)%pgCNAdcwm{>|D zpXu~WQro!#Z{TDX38+@CglIL}@28Vt=V9v2;QZmQK~oyYWirIc)&15cS9?C1pc#E0 zcJ7BC89pc;4988riMp*(?Le|W3__xtirOO9kr3w8AyhR1T5q~h)|yRlS0+Of%wtH~ zzjuw~J2w6bt^VxCBmnS1$4hKcVzVcWo+rP9^(?~L@{OIh#c(?NbvVbkV^ou|v&=zo>+ zC(MRhK-Q_iojJ99J)j=hR`4KxodDssXhH7o^-JxeF6v~{Yaz|(74xRY$u!?FWZsu=du#6wnzRx>WT=b!fe<@{g zk_osdP%qU*Y4E;c`pxhCyte(bQJ!5}d&jRZ69pX_<;y4!Z>GC}wZ|f<)ShWLt353H zT#Q|B=d<-`!|5+s@y+=QeLhocZS9?9s`1sBn8K4KdtQ&_+1gT8fH{(%$(Q21eILP; zbqTSA$-0IePaN8j~bq;s?*4DU^Y5hAvn?jGc^YL%6O;Xk*|!z-%C3)5ZO9Xbn;T1EIrHFm`Y?<&}2$Av%X`m$fVS)yb0Frbe4 zbK8E1(3w2+iyBUL4$jY@x4V<@F{ajor$|BJHgk+*C*0YR4lF-wy$+{aG__J~fnkWkDR7M%!?9L0-1=JOC z3AH*+5ly{nfuW&!!Joy~dt!EO#QERUhPwyhkNcuAgC@D0TR znvvpn@|VKYUqN>5Tf!7|*rtt=&e-fKn%bR4VKTifnI|a)9R=*BpFn<`G>z({2^;5L ztB%!Kwi_ecS%xjL`C6DPKo6^maL~2eO!f1P=2#ZJ6IuVnvMG@3Cx7F*cKZPlwx{TEnqcFe_%&$y$XuVL# z(U~L)E3g1vHO{-W_A;yj6p!>oS9eUOft^u_dQ6QD&V!fm`uv>tmf(KddZ-WM9Wgi~ z7_F^Z_XjHkip-iYPGKq1hHvR+EjenJ@ke-YRF_{t@!(^^9&(#VvcTr8eJF=fp&Wf& z1z<=bh%xUqm7#2esNycUb%HpyAsBlI^Mbv?`ByHt*StoVhz^-)KFWDD6jV$$$j|5_RB?XJofuH7B<_z?xF+Yas1;`wF9gzR(+?w z)ApJ-IDPxXBtJb#fUfZ>z|+e#tpP@w=@b+XZ8(ztcmWtJ!q8Vc_V8l!Wd4M_N^-)J zwoY(%hhF_OO3ge4$N;6#D>XZzxR?afs)BFDKhep#fNw6;o26TQ`k?w@cP@*|K{QVN ziswGq%XPgp$2(r;HGA5>te-Jdy@Q){H%_NF9hg#v6X8ljG&uNuu3SsjIOSSyZxk|a zG~wrfBPgDTse1~Pbi3WUU@*R0wPLx?JWDR0XUDhWx{j9%VIWq$yLT8hLd@L1&YVAS_cQ!5Rrmg9-c_jZ!}Phk=bw&)*@5TqqYII z*K(s@U$=glQeo&T?i+7F&DHH()yJtqkxDJ%ZZE}@0lP8?B`JcJGfVu5Iw?gMz@GXH7-t%i9 zKikUX`-X|Lp_G#Ix|wp3?5(JK8AIQCQ`nbMFdt|fz)arM&v>-0a^xb<|w+av{ z5Z2aHF!XNCPIq~sUjKdlA+0C~(2X1YD#7h(l5fu2!Z#@S=wDT-8mPh_e8kt;6rL!> zB@|V8u>~)Gkds*4-M);IdU9mV*nPMBF=|7GbP80@Ezpux>3&zJZePI^cQ2H-gd@%9 zh%#vlSCCR*=xpqA$om>Q5{L?&^zBrry|X+SAw(Zb77BtL_kPA?KW-SypJ(QZzhB`x!>4!==R+GK-cBx^^oEhz)Zpz zzaj6XqS}z2`}_NXKw+-4SB$iy8qpxXL18K^pq{eXR$R+ov-)?B`kYak=EGQI@v0pPstylvCQ!MUy~-xn%r?xJWcumd0u@*f9AR6Pd}^0O zHOZH6nZ7TyjH>NaC2Y2Bm=F)-t{<-0(#OSoxFGGTI*X_%n=Q8Z2`U$fO-*pUs_H?V zd5E}Auuh~lvg|UmLEWZiDTf<5Yi{8SJ9-N_WaK2kDr;a;e8Dv<0 zxu;MP$WL?3XSUm5YN{d#U%ec}I?@7gG5@xz4l?L{iO;FBYE&XkUnVy3{W237u^kz_ zXB#TTvVT^1yswv?wPgG~FY)shRIb{`95_dOkq+1FJ z{xf(xhC271E-SUefdSyYdx_FgnLX#J&@aZN(jspZ~Y-YudZ>y$+QqD>s5! zA!uj-Q-KP*sKud;V0;tb%p}1fqrHfNUh=ISW8SasWNK)keRjP!YqR5aoGb~aN^2+z z-?jI`Ei95MmRkCkJzKlpWUAFtN%&B9PY@i6-^}HkyYBgVLu$ z8uaOkbLa_D_GBO%&szWvzc2W`{@l}Iat>>pd^YRG_Sp&-xwB+7=D~s<&`qL8{z&s0E)6Y}fsk-LY z@bqx{o$J(M+AMd?)Lv92=KK`AVE6UlVEbwQ=TOa413~Z~V)#-;gZpNkeOZiRO4#A( zkL+5mRkE%LV@y?dotsH|;j%;6JHXx>TuUbyEzL5@X47C|^Lb|_DO|oqWiSUL5N0G0f8U6!{3zw+z`P2 zYxREY*rfVwA57P*dAm3P-(i}KZI6vV>OrpgF!+LJ#Sm3LiRYkW$hQqG3{L3wrfF=M zd{ZZz6JshX%TC7?*Q+#H2Zzk1Eo{d}4DDP%t2w}{`AEV6jTS>CA zZ*OrgqWMb2#$B7~6YrV9nh&qHmu?nXX@rIbp=a|pt-}nt7k4H(=eF3(@4vpU|5o25 zi#aRiTf4f{@m*|d&W$DBZEy0-<+u5q*_H$E*INBE4RX1C9pMH{cJ-QxWft_wqiu9( zG*tY+^O9?XgiCWxUe=m#TiqWDT-6d(JPbcO=kPvP#I7VLy&SX%_0~TsBUJ%E8&z@Ji#EpY#M&A=%<_ zU#Z}K7Dd1#3&W`_yK`PTaJo$zd*-iPzni6m4Vz)@(qLL~tq9H)a4;=(=v_`lYW_7o zZ@4f$yVX6L;8l{a_<+v!eFfktWYS8(PovWK<~jd7f>3-gJd3^xW6jq={T~kHoz;R{ ztUQ5HAC!Whd0aHFu9{?n`^3zYMmvj-L>Q9YiVtQOE}NX|56}EX=7Gr&UYGlVK3h3_ z3x!fVT0Pfow#PpA7T(P>f7{R^l4uPCeFzfa$HvvL!no>LKj{4=;>Sw$@tHr%5HgCU zR3RY`b;q*XmSxjO=e*5R{nX#=vHIfbC()lw#ETT4gmkal( z6QfyVLd&x+kk=F@XSo0k8;!#C%;#ZYqGBxpep_zjHXrDlu7e!c>N?~UlzUxbVD4c{mjI^^$+VPM$lgCWG+gyv^tKl642m#b2vnTBk#TCJh*LUFEgUk^N^ zdr*2Txi+_BWWG?Z*Ax@6={)oQr|&Rt9n2D%hq1blIoFp@k5G9KA)$-DBNue(hbaa#`^tPg6YWt#jBZQOflw2wPmXyNG=q*Oe? zO{~oDf^1Jir}uGPb^7zCq3$+Kax^Jg6H(Nk?ed3e-LRi}%_?4Xay&4rvV@g35`4lA zG^Y~kf`tk$T2`M_AU3XCk9YX)Pm*gFp<<_aa;_hG8^SMD zQHFD_Is`K}hTGUTuah?w|C+g0GxG{ERJP>a%)5^}^w+1O&pVDqIp_>+5!A=s9_XjI zh;3kIZ0@B+XHefOlmTu+@ePZwJ+{o#jJ3+tVDJNB5$PzJw!7vxj^F8>xj78Vv}NJ?Cb_sco9;Q@ z+&>mWL#BfVUu)RCQ^Fvzz=5|IBE0<}M+KqK+cIE;7W&>_V=of1fxZe|DJxqTZ%DC9$HR@!9s-S zwoxC}W*0kY<9;_(_%8CtqSX>b-JqZfIEr-%iqRAUjxSpSu|H=;*Och?=bbORTC8s= z{5)&7-mR-RcC*WUuS;HzYx=zG3M09L&jc$u;NA=oVc&{jUNnh+TD<28MsY115&0T= z7o6cdjrF1)ip)8VPJ!yxR_R(7Ce+s?)K^xQYkWWTnZygTNO|9I=n|95Sc-a}*Jxf% zeQNE=r|^sTodB`dK&OL}e~A9N-}hnaH9_hd9UKQyTHH-_$V`W((tw?$53#y!K6yjx zl)^cOY71r;co{^I)(OALP3aQSQZu1_^|W5y^y=eqCTEX#TjN5lf65IR)n#u~yfm>n zOkF%NG}inE88MWLm)y3&5yXQY2r zy%JC5|LHsEyaoG8LosW`PDB0S?~=SGQc;x+`Q2c@!Ns_o!S=ZYKrO?S>>u=Vxy*M< z7q`&a2@#_XKMi581e_e>y%<}_=*{wzkZBdMB9Ku~JL{U0cr|8Ug+LW%UA|8-oP=ND zxK2bx(hGOMw{l!Kdn;Ov_EHH;l$MI;oIDu}ZXYQbx zVkYe;gLl5FG521Rc=Jr_8rr^pq0M#;N9!mK_;paQm$#VOww!?&hE`QN^Cv@vfk$Lt z$VA1Ja$gTh7d4EGOR(M!0ZODz+AgV_aP_MR_aBlC%N$|1IYe3p;%WV{qhW?j*Mb*q zRh-#7)Hm)GAF|*fi33Uu0>>!O_{o9Oj-d3E7ICeyct>a!gr;AvE(ucMWvgULMTxBlwMldje;#m);7Bvs zDh+8EZ1)WredFR)9eyl^LylNn>r(o~I|dCety@pfi0l^E4yW#*1#^z;G6=tuT-Gx! zCB<($wVk|Jk8>Jk2oAxovJuJ>8I6`yj3HlevUY=iGmKszMjm z>$od&kdWsZ1@D~KHU>vw!;(Pr4&j*T>fImJbalZ}nt0(r7MVV55d~ehZ_7ttv@;+! zvA9Vh?^Kf$tO{Jj*iU$bV3{U=xJe3yPx{C2<|!RpF{=X~)eEC!@p$hF)03O{OyJo2 zW|c1_@eQcR1Z8i%bd-l%F-&zrlV__q2e15UY><`bP*l=H){fU@OQfk!)N?Mr?-5oo zPg-eY%9c9YHH+$sU+i-pI?9$cNgC>jUPv7xHiYmPJB8RP>y!>KR_5#>#f2+SH`eH+ zNu{xb4J&pJt={VrZGWDQPv{RhYX4%R)gX8KOMTlKKEC8W`#t!TU>wVh*2SBuowbW! zQd>Vl<(Pva0%yy&4;pP-h+6)rTzZPzLYxKCUrC_k}UaD1zE zTC`TM_eW1cRKyUIv;Q1~y%Z@2KhIQIr`WAs-;t6Y;+R}umixFtvqewQ+5@+)NV9swJhM?gz5n+PZ z5R?+?d@R7#hbDlmg#1NbP0J^WWlqGee6^3%fTynV8A5aNsvj@&hM6<|{&rZBORjHx zVEO1V24&VVyG#GgPNO(Z5MLF(0GYrbxEQ)S&^-io;?85H!%et}_48x?M(d#CpX|Bw zDYJ?JA-yf^_U~UvEVL+ZXR#;&o%SfUKdyaQytT^PrtIB^)Jx`2UsvEg`a&i1I+2k1 z8S=)byv{k29t;}n(pQbDA-5!J_109p_DgcG;aIkzl0}wULzB^4I6o`6Vl2!IAbl)P z;NNZwtft7PbjG+po-p)ri$jB6lzK!jm4K&p9{4VmrK085+=qpLpV{PNd!&^XdW~ z`~(kG7z7?cJ2YzNF2DT>^ku`oC1Nlq6bV(re(x(IzN6gj&wPwZg;J4YtIA?}Bv)gf z2jj{qg;;rROY&l+GjJewD{TpH4-62R)p)rUV=7mdc_!v_%=V(Mm$tOQo!3T4zpU@0A%~Cene_Y}meI-!rz!A{f3?;E+yT zMpZnxseSQU>=!RNkg`+F`C2~k z`^h^XonX|1yWe^~P;{`BsX}+{O^jV3`Nu_RONRO5!OW;y^WXGs0-Oo1f%Hve5OlRn zOxaq*$mJmmhRl(~XgeQ=o9&eLAh3x_Y;y3~!xJqB^M@j82W*0!zD;|nu%$QKuT+a> zN(;&=;OSQSv$O5cICp!niJVG>-~L?dKY+j9(+k6tU~P2~JUQ@b?+RQ~y|TIqS!kU` z|Ck#!jmL-!ua983`l!7*jcC*xu8fyhs1grMSRo)%M>96P6=}-zXw?PRXzCV4uReSq zFH6f>C6Vr`^Xg3;$5)$_DWcQ8h0p6U3B;!qd&enzH1@=7feaWMXnrQq)uo-UvHdu6 zZnlGnFB!btmA=swEP8F)7v~Kq=yYz%cM;}JZ-3!yVHSl@MP4k4CY8gg@facy9+qR5 zoDvU-B|c4I+U;z_ZkUp&i99#uiwrxVBc5)w35P>SkPE7p6f^tcNp z-`6UOadnJoJ}~VXUKQu~Cpa+S_a*}(O1_cHY8mV1TJVH|+Qw)Low@zS{*b9{`0w`$ z@9#5|5pN15Wu#WgLT zh=%nwb|X}~?4bPXZI3^cSaOrY3#LE5&8Pg6!juw#DuwrL_mg5p4a34X0)B%MhvZaP zdM^>rB)<->v*IP)*YZ*fR5|}NL9;rD1cDx+(W^eX5y1rCk?0XY+8VcgHS8~yl~&M& z{-(%82!D8?poTB@B}Ty&Q89Uq%k~b9KKkQ)q)FK8DZDtIr_mv4USBqqp;~!vXc$_O+3ZiY6n|LYQ8Xp?D5;TOv9Qd zLZcGoE^|)tg~38DG4@J0d;&Rw#ugqjOv=g4)?7+uxq-|SN%{767I#e2CY}n9U{f6X z>fCR)PLD%(*=Kt4l-eVCMo6C)tg-Q`%g3`cQdMt_vcV309dX~Rup{Tc4U?#?Ga-$V zF_%iA=AxMOCrj18IqDk^vX#Lb7_c2l&CP*g#*=ndW05Op_+k+%e^O?bDx?v4G{gJ) zPahb(kZCCRduIW)}$0m%*O*6r&U!**(?c{g{0|Z_JfPoC~)}8S7JTt!oX5umZIZb-*C}5 z`gAyZ<2@#4w*_42?w8oHQ7e*Pfm&P zDp~}ywTsT;->x}cdN_5N!ohW^`Usaj6;;@YrEC6Pdl-~?pw|o^`i1^pjvq-dqOB>BG0<6c0#)mhys-Z9+3z z6~(UT_m~`qh71R9MfD@{&`>YQ$_J{Yq+r0bTV3kq_qwL7)vp~3pyg*fAERX@ex==7 z^|vDzzE-N@LHYiRV-tpl*)QOzLXuQ^`EjrkKXQ~@Ac*#^!B#X?(s+GQ>0N&#j`qk` z{|@VL@g5RhOJ6Q^1tl45Ugcs5TarE#(ZzmS49Ss+4y;x-1{+Jqn>=bMzWwbS?%i0f z#gVLz(E!|omd-rUPxGWGtP4Im^F6ti=bcd{o^tGM(<9Lt{Q0fa$f`_-9pz5`yG?8@ zsBK$)v{wZ4LhcBTc7MP$OVuC}Vr>%A-!StZqJWvG}PJDAY7*g5*LGvmHKoM1>d zW?E;dWf&UxT!YiI5}?vwb-HGq7m|9(@-=DI$4gMu)vD$|gJs)d#_b2ALT&ScdTRVvm=B%`yqwMbZ#@Jgt!ygt-Khit*#h!3g4#a1zf6rC&e&uc(smwt8p z)R5Si*qivrT1tY!Q%_^VvN4qM&yL*`beaWaI9I_B_)9EYWib^X&yN-<;iH{{r_HZN*m1^wveRL1JmAEN56av&ghb(0WjXn<3PPbzQH5dqx? zX)%TqP1bRUv$sP|H3)|j+Ra*2pO{3i6{os4=pVHSBPyyo=7K+qU5qb{VKg3&i-|4j zC9}YP^x|z>TSIXaB;;5FYw_(g?Y@IC4KLl6STmD|n__<7XcP9!xts8l8pi{oUigdAPtAp+Ix>JW#*br zRa5Qv!6J>D@0=y-%svWceWT>0fI_WyHjW=mhY3^PO0EZ_i$7tPA6nhW^uwJnAymZh zK<-A`B((Y3@N5gNuG(0a zN(>R=RG0Sp$=gj_;_yPd(DQsDlShE73y_j?VS^R%D_p)EiAA;h%?HngUGE5<^tos# zQec&6OV2{#eN80T6vAH3f`$Y6$-2J%Ai<23y_tL>fu9up@SnH&(EerV>yvV{1X?S4 z8XS^YZLF3=PP7g9&Z`jI>=k8udb$#aHO%Mk{suU;f3oj}=W*8Y)G+irXWwWN32V|1 zj2#RY`5RAl3G`gxL<$q{CGNtQdWKCtwxGFAet9)SnRD}-2;thLF=k(fWCw2fOm+^t z|AK>iaHvY>#t+wU z?fC4?ICXp$^3UstaPPe#v(|;1 z1-=rjyd$F^WmZ)Preanp9F#0%%m%6**LWxfWBhmtcd$^r!I{jEve_@xzrDUSpoq<; zN0WVWbXkUlieGGOg=y zvoPyeiO$x>mn9m#-}Ef!@TMWUo7z-@O@_NrNQD=!xe14(cB$0AH89&tQ~BZXbym)G z*b-*N5oZgAqsextOh4h1_{V@$ja2OB8?f&T<(XlN2r}#N3~Ex7Nl{H0tEQ-7h#wmT zWqZG^_sv=xR9-w76`WLT*yKFK^dWc=?NC*4Gmr%aAx>W*lVPX!#TTPb*ZJGD*@g7y zngeEznU`nKOF|Dy=M2{+X$gIH82<2tt0h3V%c>$OO;udp)O~@}Md7aBa;u&}>*UmR z8T~vYflkJJCB|7rRX6|9rLkwXq|H9pgd>rW&O-o-&bz$9f~Q$(b+MK3%`96qh3H}A zSlJNREu#18wW17auEDx_XcseQ2)793n_9+J#u474dS^{J1URWE^2k8c#|}G3PF%Bt z{pL)}E=XeC+fONZS8RokqCXQev7L`uDKz$sd(qc&1dvb-VY0J;OEsL^_V8;A1T$Sf zqF(Ac@z>|6!&C>-WOR{!O%`9Vbo(l>z+n%Fvv*BO(G{kA^~dw3Z>~xQme6C|x?bU8 zr!CbP8-uq@YikWC*3U{~a2x9Cu>Q_*z#CIEnZpiN%Cs#gQdPrYE84wdE>{g$!{CVS zfc{E=^|~69c;;y2)L8ikmDZA2*X!z35+)P_3`MEkH)}~;)4>(5<4Z>B?>lgj-l}|6 zvG>H)d?&R)o%kW!e@1$7Q0a>q8x|>1{ZaNmHfan ztZ?xeCkCr6lixXoK(g6DQ{vm)OvO=~O=M+y+0|iwv>Y_fpLB;5$nojq25=hoB%g-X z9K3!}9luYmfk;c+!#ce#x`0Q3d^69+oauR}+JR24i$#FBM<4rkCf+ zmia@3;!0OlA=tZvxKr_JJWG0e|CJ=4^Du(gtE~0(-#MKRBF45X!j1=5y)img(nppQ zU5>c-84p2Qy}bu_T6TILtk`1tR}_PU~NxtK8W*^WIysdQ+G+tUUn%hBqADN zn0nt^B57tZrQSbEcGDs(sc$K%+%3w?J-D|m-g~qxpJ+7m1@bmf_S44{w~=o+A7p@+ z&s&)qoEoj|+`@!xz7;dg{T+u;_Zu=Odk^gsU!FvP3oNCZOC>zbHnW{R1e*`nn5@(F zTi&8hADuDmfL3zRz+*UwR%nyUKgX2y$hMBCjMbZFEi*DUh( ze0hI<-J22F;kR$;6kWrLhH{Mwqi`cLzI~-Yvh(wg---{@b}%!%DPl2vdeu<74Q;8W z)@$z^*lMg)^=$`7?Z;^>HDBc9v2 zG5w2}%kFkj&L4VUK9Ib<(k~lm`Vkm%w3YiU&K1rIQMr0k-r>VwmG8T2UaLmr@~;F3 zUuG;ZTdOFlM3(j>RCM+2B{FB7EQ_KVUvp%b!T%xe9++x2*y!VFrxE&bXek`->PT3k*7^PRWfG8eI&G?9hdG<5WRQ+}5t3z+Q0a_B5SDdBF zvNRlr8^31+2h*z+l+&vOb8ltBj-xv^DX1&<2ooU-`YK?fMzrX(S7Y6F*&5#bAdxj% zdw&5PP4~IK{>ROEeh-8d4eELMp=$Hfv|X7htliMUP4|~G^Td(eQ+V5yDad1u5uTeR zR8_3)U4w-sHCf)>`Nq+svV1G49lq|RD9|H_EP=%9XVu>N$A{}G-Dgn{;wz2HfPY<- zMM)lJy|cYGVjnH*ny`uM?QI^mYLuKEyGpg;Rv#@E-BoY z5?dtWUkdT@CTBz6_YZ@yQ6El$eo#X7v{Vb35YZ>$=?l@Dm+En?#HxA>Ol}Uaw(o=K zeqUVCNyr~L7+Rv4S+9gYCNOckl6;BXs`p8>jDaC73mUInz0Fg3XRKh-C7-uKpUq>j zh6ml3HH6>7N*F1olbfUHO9x5}OhMBSk}T31f%)dK*q-C8AX&=RFXZKJ%Lj{?0sZE+ zHafl^@^iR_aOe8t7YXX77(&*zO{dMD)Uv-k4x?qta&3|sOYjc=u;86|yYn`v306gN zLQE75#zD!>vtKWTV`W>5HE>~)mmyiZi9PofEoy8Z2ggTRZYEMLZEP8KjmC(1XBaAy0YGm($x!HF-i& z1hKqHn~Pnb=j#yCk+Y|;A+orrWq^~DkONA(=AuLZx2qlB9Vf=wC#(+b682bX;!51N z^l_6F4669JSK#yBg0+@aS1K&%`GQfKKQ-F=z0`x19~K93!Gi8^EsQQZ-q`Q43M1n!aqwKGqb$tF7HG&i zX6A{^>M3NIV0^^U6R#_KHsyaBRW=k!G~gp)CW*QmcM)MKsHN#bckWQ(XLw&dkbL1* z{e6E?_B|D`>0=1rmh>qK!jQHwPk*@M!3}n)`$3>y>aO&`O8J?*&qv|hsTFo(af+y7 zzQ-c)z7&*cWRD5DmTtsXJL=cJ=I%OA`@v=!w>(zCZQ9U^wr%aV>xM=@6%ZOP%ZHI> z?rwJ|h^+{>1u?vWVLg^h5v+Nyltg(q8Naj#2_-swtreN{CCFG#m4FA<$5KghXJ4Jo z!DOdOMrxO0X9qrg>$;qt9HI9t7N)tr+TwPX5A>!13e%5KkW1z8t}L3J@H41K2~p;OF-RzyL>Z zg1<(;J&k{R!r%ZCpakNP|Kc6M*Foch1^&WOz~0mT*#w?8Fd!O0{A>2Zzi|wJ2hw|9 z1O^O<1;U^9&nED+fdS!w*2^^eARGadJ})5gWCBkc7!U~@g39we=nEV`0&+q6&*RF$ zfFPjcY5#05I2afK#ruLofZ@MJn>{7?OFtA41?j)={(t~T{{;sCrXc+n90=Hh^oXBa zfB{~B+tdEph@Unvz#GT`>AhedAQ7Y&@RSb>@CC3ydM~^?Knc=&!5#o7Nbd!E0(+qP zM+ctEO9!BXKYe&I;-?J^a032*5BUW<1H7R6e!(t)GN`^^^j(3bf9cx;E+GBqu)zQa zU>c+C-LG|&1tpSC9>DvG{|I)VwhCuo+>CJ(Nf9YEQ zJO9$R1T_DpPX_RV^s%2}0t1WyQIP%%HU>;U`Y+f72>qA7DXdKtbO8m>`TzOk7aYI?SU~zO?NJd>1nIwEC7|`$(UZMkRUita_kxvygclmbs{r-? z>JMtbE=a%O$qzVy1werGh@bL-0a5@NNbdzp15qHo7c2*8f%IOm3}E<_@7ai-HZVXI z@cdVQkOzW6ec_j%@__^JfHO$%r9JQhNg%x!%m>_n^j@$4Fb>jt!Ti8qlYc(Be8KMk@PD;8 z!51;mZ-~EEL;7EbAOMiq|L}1Ci+uV7@f6=b4FY)mPx!42Ea9U7`tEW9U@OR^T zIS2uef!Mz>1pxoA{LY}>|2I$dpY$}qG3b20=(+qSJ>7rOGyDfL{RjX3_SDN^h^Ozz ze;Ne9{!jQ+{{PlD*MIo`mKW3*L8%}B(8cC|F#mt@zxxjs_zxBY<~d&uy|l-8;F9p4 zI00y9`zKBW=0KRF#nnU15i!>Pn-sP12wsq z^y$C@=oaM#X8`z5_e#(9f-?a~>VM)afE3ikU-)d`73Dwq9Do|sC0_Vk0Ga%sd>+6E z>OwDkK7dL3Prd+P19iC{wH4qToC^g7XxjeQ~Z*?1egVNffrl~WPqB;3oZj% zasQdW9N2rl5I@-qUje{9fA}9<3Gg!h6aPQty?J;PMHfEW)iaR+B1T0-L2VQ@CfGd_m#v5b#n{CLLmoQ*QSJg^97jq|b0FX9h4t7U!>U+Zj;`9=Ie=O;O(h(F}) zF7u1{!_F9)U&J4AX3G2`{-|@6%rD~WoCjro5r542Qsx)&$DOduFXB%)-^nF|_>)c- znP0@$J3k)m_y_T)oD7*?#GiILAZ|HoM<^NV* z{*p6F<`?moow&>|;;%T%WquKV)zOa-><9ECPO8{AzWMH}dOU=UgMd z-gBBVs0-x(eW%{YuMeCXyXp21or{h9`pCI8UAKSiEHmLy<`?m8&YLp7i2vn0Df5f?-_Cn7zld*l zHp%=V?ue~2zlaObBJ+#5E54NZMLZ-fk@-bDEN=7k_N9punO|hzMO-ZNi+Cq7Ugj6^ zh?p(&i+E?T5&;~W{AuT zy}sQ=h7sRAM3xcXJw*>AzTL$TBffiy-bQ?Th$D^o?kzsf(d+9e{*qf}YTrI$!%*G6 zulNXWWZ)osFL86W&U=fe<@J;7`-vZo{M%n-81Xwmj5gxuiKv{PbbcSP;xOI+fnu$^ zev=**@Y&h*5HUi4PHla(syo70c!L5+5ek$n}NzaPgU3Ux?=j zA;*{a2r)#CFYzPAWI4XXj}k{_QkRI26a{j8i61R;<@gdmMw}(bm-w+_oE%@`xuRH( zFY!@gf*fDs$BDD$_!1v2GLF>iA0x8ldPMfI;s?3D5FaOYlj}F}&&u_M_$2X}TwjQvB%*SCA)YTT$k6?t zEN08~h3u2XMRI*1K1Gzv^@aFUaj9Hih@T>A zb7TINi#z1{Lj9`{&l>YrJsqY#gq%VG@_Wdc!FZJMnT!`PUd(vRIaRh7(-@xLidxxT z;^&AQ*jxEycdbz;06Z{qXC z0y*Bq&lM}>dPDqQVv!tg;tRwox!w>zPc+E!CVsxSU9LC8FA$f@@g`m`?vd*a@r7cA zalgMvtd;8x*)J4l$n}Q!VliK?H^eUzBjtXP_{HLMx!w@JMC>QmbK(u+D7jxGzC={W z^@jLTu?ztm#4i<3%k_r%GV!5YZ-`$eGUR$r{Bn^c_lv}@5af-%hn(3uh5d2~X6{3bD1<{R-(n z?tkwPVVQ4aZx#m{_rG_FQ)Ir8{Vq|1i2{cQU&6Ut+%EHt_&s8?%s1lqir?h*jre_H zFPU$|?`Qc|>F7rY-XG~l$T>%+kdM`j*DxMuyw*9?$hS3OtdVaIh=`GIYsDc(zC9>T zGxF^rG0(`ihs9k+zC9vZjC^}k{3++32Q3rMICB%i<#=-(C^h_MjA?`d(%E zHjj+*d&sF{d_LpnGX5{d7chRFQ*Oj#i@4N?$7^DeG5=l{Wkx*S5H}g|cvGx5;_;Sf zH{$WO=w{^GJ7ScPZ>^%xn1Anz<^8D19()MrJ+VgakBGl7n&keH_y^*VZXkrigD>HH zC~h>LKZz&P(W>kpi(BRX$b&NBY!#cjpjFvF5qBB+^QmZw==RS<$q1c)E-vnahQ>BZ6a@9UH`TCm)w7%Tj6{ouH9R=e=A-xt`FadZ;bi+U$LK&Z~qfV z8Ts}-%eM>2x%?h->KR|i_#(zHWPCB>7df}ce8X~E9a~H~dBl|AyP3H3`cc#oYvPax{nQz29yAL9OgLoJBHJNY3ySiaHpNXft z2g>!0_^$3LGT(@Ib8BS25#P-{$cS%-J1Rr3Z+Ew!5#K%Bnrj7+^z`V zAilrb&xqdv?sPd{$?m!5%K1vXk9)7Yz7jvseNkRti67)XD6g-?`?{~m>nrht-N)qh zmG~j3%4$uf+Sg&&um7@x$EDBYp#2iVl4b!OuVGN62Z=DeRw?Fus)WOBr9r_+`!ya=pm~3p}54ca!ZUKG=O- zt~bQ9-FCU&5I@2_NRBu0A?_$S-o%Hxak<_QALcHX>kaYY?z3{eA)e!YCf6I{BitTx zyon#_4w2(c{3y4#9B<+y-6Q3A6F=HLP>wh8W87Rh-o%e}Gv#;_&vnPi@g_dX&649y z{5W@l9B<;I-5=z7Lwt<8n_QoWk9A*{>kaX7Zo6D>h#&7hDAya}dG2d+y&*o{4a@bM z_zCWTay=)0qI-&5Z-`HDYvg)Ee4=~1TyKa^ayQHMhWJVDadN#Op6|}caQuV#$!?xp zZ-`HJXUX-3_!M`NTyKa^b<5;>L;MtXs$6e~Pjjo~dPDqFcW)zp1@2JK@ei_}=61;W zLi}{MhY`Os+;@%qo9_N*YUx?z6`HEq5D?_*J;K%k_rzm2ADa!qJbA)2LHeZ?0r~IphCkd(uw z{65C-XM7Fg4=}!#@dp`yi1CLRe}wTz8DGcvV~jt}_!Epj$@qH4pJM!J#y2p&k?~E8 zKg0ND#-C;UImZ9PcnjmtGyVeOFEaiT<1aJ*3gfRbzJ>AE7=NAdHyD4D@wXU%oAGxT zZ)N;l#@}Q7ea1gv{6oe+V*F#qw=(_-YYL#Q4vQ|HAmMjQ_@X2jjmp{s-fKGQN%RzZn0U@$HPmmO(p0 zj$qtnJjA&AYZl}Le%_ba)lYvbdnaa(Fy5K*E{u0&Je~1f8SlpUZj5IzzB}W4Fuo__ z-5JOKRgyeHP7lWSX1pik`!K#QW6ywJ+KAQ0{jH~~hqWUwA*^g&DkMZ%0pTPKu zj89;EBIA=7KZ)^t#?@b`Q|+J3>{A$@%J?aaPh%U`k1{@!@gl~H8ILhOi}BfvmoQ$+_}PrlVZ4m-a>gqduVlQ6arM`ARQ#%$ zy@v5PWqcmvb&Stv{9MNW#rOio&tv?2#xG#Jp7Di@FJk;c#uqbw5#tv#ehK3Z zj4xq)DdU$izKrq97{8qHD;RHN{7S}`GyZSJS1^7R<5x3&4dYFWU(5JP#;;@idd6>H z{6@xaVtf_jH#5GP@mmOa#@8_Z0OM;J ze~|Hq7=M`YM;L#U@pX(p#`xomKf(BujIU?>DaM~>d;{Yf8Q;YCGmLL${8`4IWBfmi zw=n)Z<1aA&BI7SH{xajQF#amzTNrRe~at3D{5{6sXZ!=k zKVDgaK`&HK7jEo z#`*i_LCijw@odJAV0;MULm3~&_;AK^7$3p-k&GY3_(;Z&W?cRD2o=v`nLU^BQH&qQ z_-Mw*Fg}*?af~0&cpl^989#yX6B(bt_(aAhF@6%``HY{;_+-YXFg}&>Qy8Dd_^FH+ zFn${2r!#&AGlku|{FJycM-Cl1Ipy$#@at#f--opT+oW#!DD4W&CW$=P+Kz zcsb)0jPv)wRm^@4d6q=raoSPcVOznZK`?{SC%DN0KL?zh+kd3dT__8mN=_ zT`VDtZp7(mbsYSW3sLJszfVH`5|*A=ektjDBVI<>Lwp(GzKAa;oQe1f!u=695*~zj zG2tPIuOysN$L^H?Z{%pa_ifGSZ;fl zA(mU-M#OTvy8^M?S~nq<+v@8P%PsXP#OJ^_IBtb6A#dfH5zE`Sdl1W8xHX97?b}0$ z<*nj6#PT-rNyPFNaRcHC_y)&j_!9EbLPPK;u!fKgcutO2f7gQwP+4vY&aYv z5zE)3xrpVf(J_eSYtRXZi%6f3_&LH;5zANk1&HNq`ss*qK;W2xSia6LMl4_5mmrRk zrV8;Y!g0hm6UI;qOd>ci^kOyPdc^WaP!=P;jmnoHo=&(C@wtRoApRHOCdB6xz8>)c z!mALUNBCC67ZAo}O6~4SV_QZ@jBUx47~3*dVrz^+^9_j|s0-%~mWKgvl^ApRD~ZzqW7?r612Db~N8BCo9};69@hvo# z_Xdo<5Mv*^N{oHnUt##{D{(rM50E$mFir{IKj0jRdjigtI1}(`688ptw!|Lb#S(7? ze1*iH170a{8(>@-&_DL6Sz??%_*4nYao*z-Bg7qm-;{V8V0?0e<$3UlPhAk>e8MLn zi1XnSmr=x1;S-ly#0BuVP2%bBDWD9?F>ZJ_jd%v&t`cM1@Gce0F>ZJVhPW8Y50^L- zFy854d4Iro*MWEtV7wzhJOnWA<`H8oaVL#<_80ORkYMBE?n_Y(I7 z+y@qPRX$kaK~O$SVmx<@#5sUxOPmQ94{;j#1eZR>9E?beb3I*RoO2lx`)jAfnGiGV z8~V8bF!l}c0?>OBV{EXkSdMvxbtA^{!Tun|^&Z=exG!k%5G$}%u$Cgeif|{u-Os>M zm=~Z!j22%b_YZ#i<=%J#*t+8d2M+&w1Q@l|@P*~5#UrRL-w$4t;DE3>-3xu_;N3oA z^n-WKi2slL%p^b8fP?OU(a&uX2l~<5P)z5(iQ@x*pGF0z-ae1df#P#{k~sIelS0~^vYmdLucLONFCoW$cfj52;2Ru%+W;rp1{m9x2VbZ`e|TGh z82v4f82#ZPZh^#y!;jUig#CKu9PEjj+o;?_d^=%mzmPZgIf$F79P1T#63$0_7vUL* z?)b%Z0Z7Kz6Q;~r5wP8hGRLOy)RMEoR`<6cCpC!C8IHwbXx{z*JdxB&46 z!nh9*xN(33ul-^ZVdUZ&!V$!{p@1U;u|5{hQn`oa&k-Jk_&*CT#~a3f;e$iUHrcnjfX#IF%vgZOpA8xYF}FD;1Qr1Dn8 zxCw$|D}0H!3AZDDhj0htR>J;Ryi3?03*0op;g7}pg#EGjfUrLn9}@P*;v>TTSbR*_ zAB(Mo{jtE!7aaard`cL(_>6D_@#lmy5bI;{1(kbPjvF^P1|gOYp>hznQF$KXuLi4aT#xvFgc}j##t@Ds#O;Ke5&uAV4dNdOZ$SJL;TFU{6K+NP z3*oJZe|J7Iq; z{3{MTN5Z)v@aiMS!X=Dc$X|LKK^&&?48;0a;N}+&55B}Mga;w+L^ua=gm50>&V=(3 zcOg6jaaY16h|>wzA>Ng6J>qVJ8xikDxCwCv;bz3U6JCRO55gM|?@71?ad*P4i1#AA z6>$&3?TFvDk;OKNkBE_Q#?ZVSg-o6ZXeqKf?Z4>`&MqivtMzW8o3@ z$D$A6Djb&s3D+Y&h;ReqzJ!|)A53@^;zJ0pL3}9Tb%=432}cX!euTFmK8)~I#D^1Z zL)@Qm2V%U5!2?o9WD(9lJdkit#DfTDB9_0Hdl2GmD$hlH1mQfyLkJfj9!huyV!TO$ zqYCkG!gYvq2sa=eLAVj|k%U(vK8kQN;*o^cA;z06I5r?YhVT}|#}aNuoJ+V3@hHOW zh>s(T=Zn#VBZ$Wk&Oofsg|SrbVfi@1gAgB2I0tba;XK6S3Fjj|f$$8(ClW3}Jb`c> z;)#Uo5lVbvsf1e*pF(&m;%S825uZx9191W2 z2f}!mAL^BD@CiY{Kghmk@42TuOKg;bJD3|4gfkFV67Go@ zZ`R?+M0^h6L5Qmf=OUKBY&{QgoXQIj*AkwAcrM{8#PbN(A+96bfOtOPM#Se5UWNEy zgqsn=-~Yj59pdu{Z$NxL;Vp>q#uJWK#Px*R5HBR$j(8Da)QJlTM-VS2oPk)M3l~wj zhvgR&9)$Q3!a0Z=2a0GMXTEZEKR}%IRUq?6-@%4mr z5Z^#J7x9gR^AX=fxB&4g!X=1rCR~MhHDPE1+(!_OAikAw24a0IZliJ!%Wo$<2=N_+ za}YNZ&O>}B;e5n*5uSngZo(yq?;%`=_+G;Gi0>oZi1>cOO^DYJZbtk7;WdcY65fFL zLBcJFA0pg}_+i3Z5kEq>9r2@tI}ooU?2pA`g#EF2oUlI@PZ0LU;z`2(Sga@PkHu4j z{jqqOus;?X2>WBPk+44&n+QV_;68$I1o39V8Hn|I^hk7-yqzA_)WsC zh~FZ-74h4I+Y!G*xC3!3VSg;%CG3yIdxZV5c%QI879SAy$Kpf6{#blO*dL3J3HxKQ zm9Re+pAh!P;#0!V1h|hN96|g!;S9w3SbRa{9+rPeco5>R2PPiHI4}{ks{*mwo#6J;kLHsk}R>Z#$-ir8F z!tIEEBiwET#|_)x;@5N8r@L5vUY;n;%sFv43AA5ORpaeu-chzAgM za4(TXI0NxO!aWfWBAkhMFyTRnvkB)SK7w!_;vs|!5Dz6h1Mx7zRfvZZu0xzdxB>A9 z!i|WJB)kgoQG}Zjk0iVfF}{?5V*}!22ya1rEa6tfxrEygk0RWT_&CCNz8Fn7f_Mz! z48;0e7)#|ImX9Mm2=VcRa}ehd&OeTJ@l?XCh)*HB74bB}?TAk$+<~}&a0GMXG{PB(Pbcgl zK7(*3Vtn}nM-JjM3Fjg{i*P>TLc#@zXAmwy93@u~aHpFFwI}n!>b}%<82xlO!B-|5m72!<8=MWx* zxSDV-;u^wvh~tC{5Z4l(fp{+AD#Y^$*CDPW+<b)7Q`12Zbe*AxDD|_!tIC`5uSYFn4^adIC#Ib(3GjuPCcby!o-vEC!IWYT;BNO zPdMh-QOD(u9yWZ$kvSu?j~J3QaM0kx4)1@+p_%;-JgD#f2Y7wc>Cct&g%&%#eFy)0f4uZk_=HSxN5L%b>85^sxlM5}mL zyeHllABYddN8)3#ReT~o6`zUE#TVjB@s(&3UyE|W$v>|WwFxJ%rn?xpTB_cHf#_X@Ysz0zIo{@Y#QUgcix zUgI{o*Sag+>)h+z8{8Y+o7`3I&F*UV7WY>7HurY-4!7C8)4j{R+r7uV*S*iZ-(BNA z;I4BYb02q~aG!M7yHB}KyBpk%?k4vcceDGf`<(k9x5a(leZhUveaU^?{X4WGbXDl;&^4i^(6ynJq3c4|hi(Yn7`i=lN2ob;XXvib-JyFz z_lE8Z-5**LdLXnm^kC?r(8HleLXU>lg&qq%9(p45WN3ZpsnFA*4WW&pO`&H(n?uir zUJktydNs5q^jhfk&>NvQLvMxN4!sj<4ZRzBFZ6!sgV2Yek3t`ZwuU|leH!{K^m*uu z(3hdFLT#b1L*InH4Sg5-IrK~D*U)dFj?nL+KSF^ho22U7yeJUCH#E&h472vm%=ZHUkSe&-V%N-{CfC}@SEYc!f%J) z3Acvd4Zj!uH2hik^Y9npFT-Dj+rnRmzX^XE{x1CA@c+W!hugzHgntbG6#hBO@ElayB?eerM z(i+pQOk1Az@3a+ZSEXH@c1>DS+O=sb)2>UqKJA9I8`Ew|Ta|Wm+AiVJ@+v2*I#w3V zipT2WS+Sz3!t%=E!a0>Q%Sz+tN)y0Xb+jzST0S#Y951UWEUzjptd2#C3ul&AM62gJ z<+1Xjs`+qoWpOkf&8h*f*+Yj_4=$XYESy;#Ev=}ktSrkfg!-Y`gH65fdFZe?M$2V&sfAEoYN701T_PGO9Z#Cjv+P~6FsV;5$(CT7 zlX@(a9Zwb}oyd+SO{kY0Hw&TV*d11wJtVbIcD&Bf6JmCCRRbVbn7GrLu6x77xkZT}{l>h!z(YMrYO-qMDM@S@FW^ z#F+Sj^fMG^17&S8WHf|H3#w@>l4VIXxA?yO>`bb$jK(Ngmh?bFl(e9lM#wCq0b*tT z_?TrhJjpVQG){7ylye4WO%Af4n?Q^23@vKhFz7HAWwDAx=!$Bq=f<*!4jnwAuqs*| zFRYwZ$c#gV-SSeAu< zuDK8t@E4wE!qw&(YF*rjm@OFiq6gb$G6|qEH&=pPES=F&* zG0OY`OYL+@S!J|XwlAmwDI(PddDThQtvO0u#Zt~zRj|{L`uSRuRpeyV#H-`cneaKk z-2Y6uf`QGlJ|r#4#7veY(~1%^X-OugSw@MOEK7Qz#7tU}iD{NmVzM$nG0iec%$bQn z#nCIOtd13ymqo4J4YE+zf-KbJq{Z*Fe|=$Pe)G&SYMxm}Yr)jQ5rwB&TWDI7gJPB^ z!%D3;t;xYjEvEr8%ah)y$EGzoP^slKSOMjJL{iHsDyikF7ums~*@;=T+BjQpc8Wnc zgtb0sD0X62^%-aD^`#ip$maxB7i2|usu{s&1zGW|Z2x*OwNO6`%hky1<*6gDTlFsS zay9ZP<#ObCxf*$1u6mKJ8}-V&;FvD2Ic0T%X0P>NCuGeJKVt@saERcsX@`Lc$OM@Uam%7FHd??ebTLZmw34v`IK@w^1NJ)JTF&$%+?LbX6?kR zT5X)IH#^0kMq+SqeSv0uEG*}#b{b}VG*S#|I1EFwLJq0lO0kK(ye-cc)5y?UY_)(!lPUD=4KvUNkU zSvxVSRvTyQ%}z0>kr*6YU!YkZ3(I+`orYN-jTD0#4#SY_xayf<)_ay>P$QCRQ0c07 z8C|I{Nj<}V)-tv5h#jV@Zq-AimnS=e1olDmW?SGB&(i zg@%`_US#WrWV3c+R;@P9)|;JTNaSO1eSv0uECvUkr`le7PRxl`>t`Fy=7vN*>V{-}fo6Ry1_z&~+G&{e(MU0<;V=xz zhNzwyX1!-A1~nq729>UQ)6tb0lhiY0x(?o9y6RRVM1f}|BBWW30I~8!e6;d_@Mu;e zI;=bq9A2(s!^#t(Vdbh9N9dhTHftwlHK@kfdb3ju%3=17>$8|ueTG@DFU63^|KR!p z&FE0Ib8zr^fo42U-MJX&p&>E+!46f=QqH5-98(KZ42cZT9m*!ad%=J+5;>4^hMXRQ zwB$(UfQpfB)kCD0C(lw5(ye-cc)5y?UY_)(!lPT!n~DxESHVdsm(zontI+Ur)r%u^ zL$X;rF{@S^XY0*QF(`-GJFd@SR`nTXy}lHK8r#9a^#z*Ip=zh)yg)OamzW-UeP~d_ zZ*i!4W|;M!r5IEOq#D!;8PEipH{772Fru(vhi^ENRy{<)XQ>G3Ry{zxT*XH(Pv)Tt zk8ahY!^>50Qp#m)c)6M$yj=AHUPUB3pKR7n%&OJK*?O~649X$Air7(o7PG3)FzfZD z7}Ut;1XdShMR%%|!Dj_o@hmkp^s}&Bjl5o-46*8yZq>WQ%hkxIl*^IlIJ-t*wIK>%xWYIv)=3!gQ^c+MeL|Pi&@oY znDzQn3~FqL1y&biMR%%|!Dj_o@hmm+`dL`6MqV#Z9eLfVcZrv)kxwa?BhSm#$n$d5 z3wRZ=qmi(f)kqj-z1b-SRUf>H*in5Jv#QT9>-D7=)YuLUtS-ok?o=y-&kC~QS!(3< zv#?x^yk4F<^14;;5-(RHpHePIo|mhU=jEyw@G4?QBVjSCkuc19vr`Nz*6>t6sJ=im zI#lhnoEK=u^VDb<=b=Fjhhaz^55uhYEXANkB-J2?B*mb{B*mbjFl2`@(ye-k^zvkf zRD^V^9w1(>;-i-*y{UoMt$K8Lxe887xr_}jSE1qMsu%DoA}D=!Vpgp-&eofqVo)Oi zPxXW93pDFvVL4B=(=h9!kz!E8VHi@!!!YYTOEIVsNj0c+)w_(Y)R?56k$A(gqZl2b zMNkisUY_ibijZ#A1H{W!eDw09H#P9ORgVrYSHVdsm$BjHDm1)Y^#Wc+1chcNX4Pur zY`xhjhD1IF*B5Bk#{%94?5LfFSs#rQgBlLQkUAcQS?^hjL5)bNL8YtSbabW0B=wBM z8;+p9su*Q!kJB*PQK_f(3c|e3Ts}Uepo`{cDp7fRok7h-0 ziRiHML~wYyiVZ7Igoc%?e1umKL7~}+S+&|YTW@xXK{ueI*6T|#sIi6j073Nyn$e+Zr{%mr zGoF{29(sLfP{VI=sCs6Y^`4~|R0gCP)Cw8U1oegkV}bu0Ddm6FOf?P3OpuW>&03^P zL-ITsDbuV)D%Bt(Wg3zWWu#2A7O7N&j8uSuB9&^8vqc&b|C7o8uX^ww=4844|CpG` zJOvtHJ0)r2rwp~9qDfNt1aBWUK9zq{%!5LSs86X);go<8M1jH?q@kbgZXo zM)Nd(>};p$M)NdSXl*B<=^r0m;g^ilZwR7OnqA>scXaY}_!SubF&%#&1fX3cA0j{1 z2mPi9$GH#$Tz8Lh0%D~*A9RRwrGqu_%Sf7_0Ds>Fwg+wadzqumAO5Zm{JTf$Q2wSf ze|aCm`A~-bP_FznOMg)89|h2Vy)Vk&EzIB4&m8A^I0OB`DG7h~jx_tb42%(S?SEJP znn8y+SK8XaUr)g3uQPnA_FcvNtpI=eUj$YD8kxVy=ShEEHGf~q{=$cU#Gx{bt2&gw zPgs9F%^&{l6x88)FEM}h;BUEdCUr>v!~ErdzrIk8{oPIK(BHYNzumh8x38A^e zf7iEa-%RGu1AkGdQyr+o<4oqSUh}sn*pyIaV{3Z(Hr~?f=|qs{oqsex19OQ1%L8S z0^w;1et<_Wd0obvTas%-;s^7Zkq}nZE|DzkM`+!nZFK8`#xm;+BARtG=DA3A0}x~ zzC6SHIbSC8?{Ljucjm7<_{#vhI#mAc#{BgJe|u`6~l|&}6@Tc)3^YyPEmC9{lZv6Hp$?-<8Z? zGx(bU8tm^8@TvT{yO{I$Ay_Pw4|J*UXKAKx9q5ijfjpEB*Am3JvOMw?t*2P;FepPC z#s%jTHXEwF+&3v41FksL}n60e^W= zhV8?@Yk@ZOHz!2?px8gsdj+@e(oUwXuSJJ{E)VNg{zh7KuYg9^O||HLgof(6GK=mH z=#;Ko47z$OkcW!PFQC)ovJB#~40ITmQJ__EIhDmFyr1KE%9+$5oyX$>Ivh)NsCw5z z9q=y^mt2ePG0^C`=@#8b;8@qyS#+PUxU2wOJ)S5J)xHl{TzY<;j0@(CiVObwf4$!B za1rv9GpR$`i^XM#MK>9o>Hel#bf&@fvz4;l!uB-8H>xU z-z4L55@=Oi`muZ&(ud|R_cxx!rP!id1Z~0QsCl%)qFVwQUANhyTf^e=vqg6&i%Z`F zp#tceI#gV4WpNqw9jqsy!+A6f#40ZME2{PO^*tE=wv}=wbx0p$aVfFr@UPbE{_e5p z{sy1AuHB;Z(oEfuLxS6veUz!I16@#D27nIxo(o@ijQlAFVHp$~N^{0ocU3X5(SjF0ZG$x`ppAkuYfEV}6|ek~T=c`SZgL069z$V2s` zj>RwU$K-sAfmX#2e;u~oz8SDt3R-vTS^O4&PSu4~EBpzIU%f@whsAHPrQS>yzf~4p z9*f_Tp!2X{@=)z7X7T#~bV2beWbu3Rr)2!f!KaEJ{`z!1e$!!d=&4Gj4rv*WALvw@ z(5~>yJbo5kI**^F-aT3TZnfx!u=s7Z=uTwu`y6yZ@f*kDHv|4~sM;UkpM6&G+l|Gq z7&gNm21FhzF8j0iEw<BT8mjA7Sah3M{5FFw==!mq#jma-dHuKuPEql@fW>d~(Bw4- zW2oXcnZ+**Hz&C$kcZOU#Ns!`qWgfwZ?Q%98Ti-Zve}~Bh0Wja@Zk3C$>#4E&;`Y> z8=Jq2|4hd3GB`!WuP@w4>FpaM<1WLJh~H~akFLuDUC?#bg3M zZc8sy*J#m&Adhr^%@$oBxbM_;8!Wo1uukZ@R*SB>hpB6~=x*z8>LM^cLGgPA9#-o0 zdKTTUuy4?HITl@ac;2V$@-4b;hnl()i*DcDOkKT2=fb{FueZsf^L90LYb?4*UsKm& z(H+v&)NQrsx*cfhIxM>WolRW^JfsO4w=E+~U8Y6%KhM^Ox+-h?lHdpfewZ;aj5IZJ8b>K=hi{Gm2CZMu;|wHGTYZ|(R~a10lmL1 z7F}ny{et zS}Z!3t$%G6-8ToD^+t{jj$eeWf0-6t`$49^Jd3UyTmMQdx?lU4{u(U0?ri;Qw&)&Z z>tBmS_ZCbBJx|*#x+b>%MRJ4V_sD*xzf6m6K3o6tEV^sh`d4Dny};JL28*t3Z?k>P z7F{p4{?g^)E6iIDSjn`j=_ZP2}sJMK@=Ev%e)4T^3*eEV>DN{j=yU z;On17cLTc~wOMpq*my*a3y$Ca*mz`Gbba{xXVD$Y*FTG{ny-HrT_a!rEV??r{#kTa zcQePg&7wP>uYaS1<99vW1Pdp5f1YX4E#~W=MYp<(>9541TiVCeHCS}b?7p$tqC1|i ze->TLGwW@$=rZ~GHzqiKtAGia6fMFOn*5R-3+$=l~{D=v-PjZq8r85zZQ$Gkgb0m7Tt2T{$-vJ+}|~9 z{VTBOK4a@&gGDFUeq)_QH-zo~+AO-sZ2jwbVsJm)e&)F4S#%zoZ*>-3gw3~Ri|!CM z-&!rYZfw3qCIt7RKbvnk7F~BX-%2dH>@H?pnk>3^a!g%|Mfb}Armn-HTQ}6yWljw4 z@7ujiU4cb+ZMLavu;?CT&kxpFblEV}+|{`Q<2T<;0HoAu7H=(5@TZMNw0cQgI9TXZ>W{^pz#+`egS z{?=P`$ME@U(M@ObH)C3Gy<^z?EwJcjviZBpqKh19#-+`oJA~~!2b~(+zORRw{^~5c zPV9bbgGKkk5vIRLL2$ioZ2y;U(e)Z^`fIZ2M)WjwTP?b>EK`?xT5$W8?q%w#EV}iF zo4R!t-TQl(I_LD@dQao~KZ|Z&hUu@-qAO(kzgCOxyl$pH?~LH~#n}F@#G<<}-SoG{ zqMO6^e;pRx61M-#ogUo2tPy6t4Hn%5c7L?RqT7wlkDg}+*E@jSAI-4n+Oy5}HCuGu z_BD0w7Tu^prY`5K;Pw@={a?LBx18<&S}eLX-OYM43WMwYj9otpEIPsF$102NYj*u; zv*P{_SIQ* zlUVy2ExLt#{#tZ5?PJDegGKi`+yAv%bnQJ%f9)3CL2Uj;ii6`fip^ioqKmWnn`6-} zXZyc=i|$-De@iU7Cbs{px9IBG{B5%6Ze;tvH5T2)ea$$xSai3t{ohuLZW)`u9TweP zZ2y-L3m&&AN1E-+wCK+1W9o7(x*@|&U4cb6neG3oEV{jhnEo0px+8j-x>Xk4EVln! zXVEQ&MMA(T;mVa_i$(V++yAv$bZ@c!pEE0XJRmTU6#Ojy) zIm=Vn`d4Dn^@DA|4J;n>1_RLu;|WZ>tC})HR;> zv*?zw^{>RDi?j8w!J=Ev*1u+p?nt)&wODioZ2fDq=z6jBFH#yDzY%Qx%e3gWvHRaV zi*8@G{*_pC6WRLLVA0KC>tC})cOzT>S}eLJ+4|RJ(S6VEez_rpny-Izg5$S=uYVTZPwaY>XVLA>*FTGH z%wgvG(qPfeP>_>@3H=VD4 z7Tvj>O@GZ6T_3*wS#-zp_0OVn`TAEL96yh*e-_f1v*;%C_0OWa zh_8PZ-7S3mv*_MF+#I(^MR5FnX3sY=ExH&Rk35U+LN*>H7Tq|$AGhd=*?2Ttbl0%) zXtC%XX5-Oj(Y0l<_*DkSZx_D)S#%@%oBr}Fx>MQpsKlaM+RyaYV9_V3Xb1H>838zqPzYeQJFCl~{DE**er<(QSyB{+cbi z8SMFPi$!-n+%yTeZ&LSzZ5G|AVWuu}PH_AR+4J2@i|#ug#+ShOK`+YlHjoI$!@Rx^}ky z)me0{Z2fDt=zeAEU#mse#MZya+~9sZ;+f--W6{lL>tBgQcMV(rnk>50k1*?PvFPg9 z`qyF6-Obj&%z456eV(m<1s2^lw*EC(bo=gQ_G6tzH<7J>Z5G{}JxqT+>w^2yi_Nz@ zi*5v)Z*>-3A2#2bExKdbd~3Dn4rTK#GC#Nt*U97X;Vai_PCWi*5v) zzYP{$8QcH0SaeH!u=dplw{Jb$|K(Y9@3Z}1gGJYk&EFP_u0NZ(1tHo<*0< z=5K>Vw=bK&Ef!r4o4=7o!R_#uEC;vVVJ3FvFO_NGj);0!R@=7?f>#Dy65*b{WVy0+t~H3#iHA{r|BYv zvgb{C7Tp}S|7)=5Ze;tv7K`plw*QM<9NfMm`TozMD`5M-28%A2?f+UVy0h5+FLFt6 z`^Ft?#yQWTD^53c4Hn&mgG^nEMRzva|3w;t+qWB^9~RvJ&#bq>qHAZ@w-$@88=oIb zg4_2RzkXPB-}CE-MRy>d9~K?{zGvYipNB=32Dh(<@Bb{iE7|_9!J^xIm|1U&MfWMc zeq0*dz85l0e|Z*N8^3;7bXyKF{k2$h|Krz>Wx?%xyRYdl&!YRetEp?S=sw`r4~y=P z&ZfV}Wx?&ciS7ULEV}gvnEo0px_Ul8EV>)n{x5QQaQjXOoAu^_4wkyafjNxFY^Ey! z9aNDxlx{z!i-RtbP$l=1A*Nek(S02<+qc-Fo9mJerl)@_16{FJFSZZA7N^mtGPQ$F zKU6=qfG#v)dnMTF(cbts{5%r08GrvN9!j@or{o;Ra`d-hJlPvS5C8ml4jepmsHYu+ zQZSVa8#2VV43(drH>1l1V<(IgLe+@A&q~yfbw;EKw%%}L!ry&>g0VGK)v=nI(pg?n zS+rudH#b&YQ(9T!We>_4oHf|XEQ!afYK|N@aCT|Dq;_UjQDynSm^x)(S=rq30aewN zXUB@-S)lO1G=R=5%pR0IbWl$Ah<<);`nN2Ngq~L*>>0 zt%t)#IWMkG@4D&criI(LZ;dz$9p_#bKKE;kvT+Ix?0Y+AH(dFi#MEg4@r;ZLzUl~!+b0jv+doc3WSIJ>;dw7F>$(#AQ? zdEv>UMrV&Yt|7ZehgiGuxb*&`{C0;?Gc0tkyS~%QX+FCx$AQz=cS%q88$+(1 zbCRUTm(J>q?u4#Tg00+TzxMQ=OR}G9+fI#xekiTcgJBCrzmpq|>roI%?|jLf^BPXh zZt1&dRsE7taQ5JdozLrh?d}DkYom*v`MEi==$ZD0$l8s)U*FjCu|6%M{5CWU9uT=? zFEOCgw5!9d(H^_Hi&kx~e<)+q#@1c{HNAJ4!+DP^@-FuB`IJqJ3 zJhy50OZu)#-(~i4cjo=itlrrBIpNH_f5XMD)7)q6s`_M4wD|s0h~p4BeqCDi{hKfD z<%|&HcVD!r?~*?0dquZzPY+#|HZcM@vWs(GmubVp4aeQy^N8j?FQ?rQTKmGbwytYm z=xFV_KJ?YmVtsl`m-PL=>McGDt-N9N3*EamyxetK(_cMKbVhbulhdo$;^jAsYgVj< zN@i|M_hWzWE*Skz`?W(sde;f*n5$Ui=j?h!Smj@8EYxTE<0r$orQrZ~^2=VvYyltB z&JHOJvZXFoL^YP|tJkZO5*4TfV7xdY3ypFMl4| zKdoRp37f_GU0QYr>A2Tqiu}{i`nq8^hgWYLliq2 zkh5vdqE(BRE}Yroym)(hCz!(PJAo3rD4f+_48gw%)0P} z^vH6sprXf!-?8|6<%U|2-l@mx-=Uw+eVUwS{qF|by`h(JwHTj(>*#rKn)m}2* z*s?vGu1=xUV|({-x;cf+-ym&#(BIz7|5H$=4zy2X=c`L7URw8XdN^;h^EK+Xw^Y_Q z01SIL`#ZmC0`xyhRh zTPCNwtQ&5(eVowCw1aK3(_Iw;7BU@tKk$qf58VF?nHK4Y(HR`r2C=^n{lA?fWW9bn zaAr!3_27mb^;pkBiMzum9s)ZA2X?8uc2go`U;H-9Hk^(c zYzQ3J!53oHP36be%Q*Xe^iWN8t9bf-l<~)QsQC0mEMtNnDkdIc8I!(*eVKw@m;6B1(^Uz8Zz_>sgO zeEuRawsC*RJM@EX#KXuvc+P+a)-4Y5p+7b%C;j-yaq;7W1#tNBk>ldWhtk^dz$W0? z3LbuZz(2+S>lT2qI_y7U440ovy8?g%!`dA%wgt~cjPW@}VvNZ+iLn_~5@WkAkQm$5 zD6t2her|vttp8?Nj`iOwvEO!#4`@6nOP3hy$3w-+pGR`9-OVYFl^0dbSNBi;pA_}~ ztYZ1hSaH0prcmzq3u|I!vkLLr#s0?P4s?l|F}v5&iqf4q^d+j6^5R0`vGST&+|i2R zKCe1nBO4dkgW1t|NvwJ&&6gtGaV%b2wIjc^RmIVGtgt*cDt)Je-^~6ri9%9S5-p=vl8K}DvQQvRaTc5o*S#KEIl`-_f}O& zEoa?hMy*;Y*Gft&W>pr>s;(?AjL(PvVn%BaY(ee27IeD5 zFo;z9aOqe6&S(B+fK7k;ggQLtGk?7`f1Sau{Hed~q2jj;Y=@u&c_@F=pc8sO9s;|v zp;Y0ML4-IL3*i_7^-}9I z`vt}Rq1yK&FvPijspGVPKkOg+!)ved_ZDE?Up)|c$plNXeHaJb-_M#q+}L(u$viTP{L{NXyI{58q($c8dJ{sO~6 z1pV*WcKkX+eyZ4du-F#+3i_sW@R-imD-*u!&=1t%(FQ<&{=5R(hc=8K9!l2;?Srl) z4)m8VW1!}F23Q9U9zI-qow4)h&;S2>w;?x@Rh4CB0sD$Xgm(^(1_=yH;#dc0VuB^d z4#yC`)LJw|(;&ng!~?Ihs8hLxx}e;`aaMT&&}qVN+M#S7lz}D>x@-bS5_z9Z0!8q#^9XcLvs9N-1)nW1=t8UC^ng}rVFPYo)^}CzkT}! z_#goecs}nfoN?v$?Trl?S31th27s50=vsf#C;&^BWJch5KE9N=z}b$sh=#sv!}3+} zOGb2t^BNmgC8Q|x>+ym1t$rTfXObUP4E6VTvvYdag>Xwrk1oA)X25gI`q>#hzQk7; z_jcMEaX#$Q<7H>#_U--y&h_EvTxTOZ{=lc5>%;zYXTX>AmUVL+Mc$Ej^-s%mx%CohSUEb5LS?r1SmSM~~0X8#~z>;7u)wd2mw- zuMK0x-mF+OURxdWN^3m074o8U;pu90W?9Th$d8K_d!-dswQ;X1S{*Hq!TnWD(mKw6 z8tcU?y=YlkWf9!Zd2nM~Sv@}~8SkGAw|Y^psInp+Ev={lhjXK4rN!W~xVRMFd`2sv zk{Yi%hHo=t#mSS$#EPotSHdmSxE2GlnDWhuPcC{j2 z3XQ?j=y|c13HNEOxaDI$Bm#3%9Z|%Bra~5c^o%lwz<(O_>C5r~LtyX@mE`(KzN) zQDt>C3}M-P*@RJ)71A@MhUpQz<3XtBRhL5YK>ugK^LF!qo! zvtt#p>S!EJmfapZI^QxNn4z=a&Jp|QkPN#rvv$_3STzoNyt2}(DTgFRCAB49sVOn( z;33Wqrc8eiQ!J4&*x2Mr{#$c3%W7(?sw%57&yy{I*XtF=RP-l^6ioD|l$v76td{2E zDGoBo)exG>a!QE)UQKOLi3b@Qt15|=L$u1gIkEZBRDa&e^T(^%SY0|7XE1a_CJSh_ zHp*xvW^oiNfmxhv`z*M4R?dSU&72P-1?viCiS%$%6%H0Qvb4g3A6%G?Kl{+%E5evZ zXT!4K&4ZtF@CUgD)){@Kz>r|2r4_X?XX2QDyoUMGpy_F3gRdHAUB`Sgw7tTgp4Bj> zi8-xjYW`SU3no>12ueT$X@!Yd2|rJPAGH<54r%Z^{MZD#lhX%>r>=@tKGN8mL-xs2 zMtS3>sq-OpC9%2zGz(=dr&J`e3`g9HRU{VDXxZ#am~18GszGwtQHF2T=2ce1M2=P* z8i!@iiry zUP-j31OhWqYb`tsommP~11BzZey1avelbtt zQ$yBH`53M6#*Q8X@y5B}pZm}1$8~LB;G*U`;o~EJ_J?Xv6A~jFkHS@ZPlVFM z7-A08YGa*QSy49M!~DP%a_nd?3bQbg3jN4Ke$WW=5yv3@KOb=Pf-5a7D7-h=bhQ!q zN6kh*$&TxR(Ogjv$Cj0q!nUEvODw#pL7Fsv%2cw$zwb$3w^XD4Ur3qJQ-=Q2-l6c63blG_4fGq1*2#$rx7Ilrvf|R&a6QL- zVmn_9FP`}SN=Jr+Bg_X{o3%8R!7nbw4G3&kJ$$&YT?U{Lc&0flQ8>)81-a*3?KVS&EfBb1btvR^Fzyg4y3Tr-WQsHMS{19>%{!STB zg|`y_C+F{U-tM#oMX~C5=`7sV$BaespSEHw-lqCp!>B>flKYlKPlGkF>O*m*npK(5 z(LIe^yb`55+U%;~m=>$1PT)p}F7t`=F;Ub|!5HFQSxs%Mcp#)V-0%3~ig!JDyGA=U z2iKi{unv&y|IUpVojIiv?)&^?qkW@ST+NN3CEaV+%nRs7=`5a)2mEu8_A!p(k^2=kYPv<8jQ)GjC_hObG^ki zJ-Kbc48xgG7OkEQbF`wec6N!@47uUvcO$rykYzDAy0!Oql>fHp=t2W3UO1 zR+YeID%pJhqL|npXL(br;cD-1kKqn2RxQuRASLfEtatHL*-oz$Br{S|4ox}i(WB7m ziK9lVdj{D7+{V-P9}D274|k1tZwxR7`@~|crLbsJ!1k8*{>A@{jk|)Eid-9~?{mS9KVs2?M%oUL16vwvt zw~Vo*wy3NW7r*3sg6&eRhFg2MdBRgk2Dkoj8OBiiQxNWJ&=xhHG2kNw>3=jiPq>3# z!h?la1-7Xs20uDo4SRLiBCBU1xE6uNxCo;je-J#`mzDu#^=0cLy@T;YS0gzZLL!BQb&y-qEAH z(It3`2Ev3W5fq3u<*y3DDC|(;qO3+%PYwz*yk7RIVu_?41t}JXJJe_y^Z}kDQR?mV zG-#iUEaeX54Wt0vF3u{2?)f`>wc^v5!fHNc(s&tN3=p;fQ;yDnrwhrjYMEQ(&93wv zRpK?WsH_sNku)3ft1FA}C;9PmOwW2oYga3{G#5j#=isw3>XTf4RdAR$ zHc^DPSf(p{Isg~^IJO)z5f&=yW}?-w29?0L`!f#Gwix;jItT$g9jdLy4Tpcv0h34$ zLk)!Aga6flcObqAaI#U!7Q`xO2aOL4Vo`W3s1_ahBQ!NNWreVG%qsLxF2o*X_VY&N zj}LAUOarr7=vQ-<=ul?A{=tSqc)(M|tr%0N7AB4E%)hgPVoTT5IO)N~X_{yQ#0nlL zRTROnmEc`ob?NNcun{bVuE}9Uc`|D9L5bc3Y?u)mOH$BHXwsFGjgG=a7_Me?P%69rb)InHT;89et(V$%!>{N~@|Mp9Xqmv01n` zudI-dkW{^DBB`~|Z#h;2Yg2h?#lZ4toi`I7wnVE-jWsYC_=?zUnCbe%VHprP^*p$| z;M~KBB6nU=kWY_V{rgz``GJ=io82EqdJZ&QyBmbFi=bM#dg4UD|LOz51_|7hgNuIB z=_wU+DsX|OB@4DjiPZ7E=1(~>VN$1zmp|krr=+jb)>~X${AceHZ{+`;Ld}M2=xP>gu>5c;hgjrD~tm5qgb7+-EpZE3NAxa{L5ROe|3Z5 zfV-Mxq-AHv;7TX2zvZ=X`vpq~q#p*2u8R65O`bC<=q8vJJAb2rGm}z0s+ug%gbM?% z8Mv$@_e%bK7CaTen=V);lehS=enH;EVD0o5dDzv};8R-ZYjpBLAg_D){(uKqZX-(722)%#b{@YO7(vgEf|t4*zGHx}w&U_!$ZpoMKoH z^v=O{u&AWE5;o*;?MU1w$Y{WWLwI$A5uOh}@kk5EKWa*{ztL*A!vF{V+9_SY-bOx1 z00ZXpfLZujEb*{Vn~0;wj|tilgNI~eX(y1_;Tjt!m<;~^2ZTW5Ww3O1Ev>YP&d~lF zzQg_)1`7K~LeB*W zOdPOy<173<3*|CA#Gi+kUhqwuUu}1c_p54K5Qm|HJ12ODR-?C~zrKI1z&A-)nSXp(2Hzo1YL0~aCcG#nH|~J_U8%p6Kz{h~I7-QqCjVz#X>vv3QVRJrLe8V*SL5?0X5^o z0zty(_Wq4^d2~K*&}yQyVh~GpS%nm-fjfCv=KLY`YKmY7R$W>N1E^jTRm9@(_#YM* z7*V*s$D;6mJ&WOgE>_`0g)YEiRa!I0zbC>y1Kx|xg+|5kKZ}AJ$kZrY>FE7H{)ywI zn`D$c*!B41>yHBXgO@+l3%Ti*y9(F|!RtW(JrbT=4X;sPz@Vq6Rn~fPLGa%k=^G-r zGbvQ*3tO|q>!ieh>7zL_23H*j5&rlyb}s5?baI;jmxDw?XVzAf!Mdc4w!9JYYOC-{ zHBM!;}2K`sHY?m~cYhX4_%HWxx57!VSWOSNuRgiRC+@j^gplNco+ zD8yR?X%ke82rW{4U%b#aQd=)o8xSkCO8%eEoSDtplLWMVe@~zP^StxqWIr?WozHyd zJ9FmDnKNh3t;-x!XHTBY@hdC9khf@VJPpKr8bDz-?l*Czz*B?mf;w_qkFs;}RCP>^Sj?7I9FbeYEGPiE|w(XER)jsO+M zOrDVGo;-QlEt$8Bbx+D1Gd6wJgmDwbxMz*kwI`e~ZEEH%6K17Nn>{NtZQ9IPQ{7X> z`Y-Cbp4yzDNh6?Z#}mSwJ-f{FGs%(epAw&jD->+8QXhk=JZO(G>9ejMlRo+SF*DPD z^yIb7#!Q1YD=uekXP=E3qow6z4xpo_I|lB{PAMB{^&Z^tERE$>)2IegG4J{VGH-q6 z9Vjd(W(|yD`bQKzP_j+-Mw9dA16Kv(w2(62(v|4*3RT%=`qvG#nj`U!{9N3b20R$N zgnSXYCDDP1sggmC#3EdBZ=LTLIZ}15tI_r{=VOWhrOqU|Vl$p%0bPTO&wo|Ufiv(jy&D%%x$Fns zP~d74Dbn#{St*c;r$X|1b9*-)Dt|RsrT2n&%oleQx#CGO`%8UXf-2zM6mDb1Gh9a8 zS(t~x4LZskTrt&@s(b8AoZ1uQd@AoR3l=P0xMGnO7$I(E^2KthcH{LZN@?!&34u=r zjG-!{cKBvaO@=1ZFeZcnMZ6f=@qv)ING|0gHo5o*ix^hU=jt&{gke&fQEcR#vO{{& zfc+O=F-%pWW5vZoaN`D$)VPfLFL>gTqZg6Yt|ppQp>-wQ$QvDn6w@E1ab*^!Z~b`& zrby+@py9NaYIiu&8ui-cNN2nn@$>qosIq*g<<8f3J4=Gb9FbW0i@ zG?+q+rZDWp1zS|4HhKc~;ozzgH-_iJUaFaKG=T{}P5@B_QD)dlsRUDEX&fY4DK7g6 zz@HgtH!b2#AB zhp%!jg(K+|ST|~Xi#BFfdS+_+=}OjgF|{Su*Xbs~=ox1#Zup=& znstDfk`T8P;u(SvVte9Jcaty-jSl69r!ibk1Is@)J$)Ki8;|GOME~vXq^Gs+vUkr20rfm=lY_g`Oq5j2B>V93lwW*CCBYIcW?8Izb z+fzuFx@-q3$uPIm@yeYvJVy05Y&Fd)n`>+Pg*kY!MF-Duf@VxKL0tU(jnR=fR-PKh zR@*lqNryFL{9FN@MVe!zL%rwlf4~1{f&a6>|5@PwEbzZzf&akXkM~+y_5SgDR^bIy zgR=#^)y?-E`6ghi6MI(4{H{YV_k8+=j7|{#P5~*HdaXe}`e&Q`snY+HNZ&=g?`x4S zE%Hb0o5c5k)xJrQ67!vLzPHVA#`E1pwWp9sYeN7W-(}~1O6uK93pb~MV|t5x@to-` zc+Yl7lH4Cjnuci^eigzU#1w?`xy01bCo%KAUt-EUA~Eyj z`=Cl6KvBj_loMGBd@nG|z_Rbaq3resFu551DGp^f?g>S`8U7Ps>P>tfutVb4fD0tf zMBOZtcsTG1iO<8nt0g`H?2)+MiM?ed4niYj8Oh%Z_yLJ;2i_#{cHoC4egl~0rTlqd zzROM=e=YVNkT?~%TH>X^H4;Atyj$YqzP6EDF;!xl$iC@PH)VUJx0A3_4LT-@pr&JiHBk1g9jvD1kC*^Sgt34AC~w{VD3A?@Mhr0CB6b1WmHH!9r&cg zKM&Hh4;PVoP17DE%Bh&?7=w{kRa0W^I z6>yluS0c_XaSAZ|QOXyhy~RrW3~;=}&A<+cZ?NMWleh>tQQ{YX2T1%6VD5oJ&YrO6 z5Q)bEr%3!$;87Ca1MHIcG2lfKe;J2*l=vv{3W?VN-zD*AV2{KoxwcN?>w$d|PXT^F zV)ikcB;Eu3u*6NkC0-4gc&-YfCv*c|P7iR*ytB>n~P zD-ve`*GtUrsJtfe7qOalRO07=k4tK@xur942vm1lp3s6M!QmE(GSamubs^ z<0XCv*da0ZjO!(FHgKZE&jSyT_$)B@e$P&- zz}9Q!*9b@Ph0MzckCynF#MW!&=LlEV%6SNPNSVk%tz(Z32*;n`nTv*wtOY)Xz$A&E z>;bNpcnR#bTjB?SpO<(v_+OLwj{Z1zB;MT* z=ZnN|1AicKXUKdcaT@UF5^n=;mN<4m>vi@ugkO;1lM()%#D7J&OZK;aho0)X7LUAU z$?%21>RPrIda7&FmniQFDHGHO_K~8-O2{GDm>b_2oO@Y8l?0_L2Ao z+DGF1pz|vd?*e{J; zLd+d^u7UeHo^g|TrNbb@abd)MU z1-;;RbX0VIGyonITxM_nqNSKg<>rK99=@F&Z2rZa@i6{J{i6HwyW?XtZ5P6nQ;@$r zLS)1cB_Mx;5ChK8o{{Rr{IE-BYI0_BB)nJ?Ro z%6B0!xfNfpq52paLBc7%9QcfU=Uw`khrQvDY=ILR2djfz9t#Zc1Yb>?uGN07?cQT{@5J zGo5}8Cu(D*cEj8nzb3J%7<&tuzaycikpHnq)39Q#;BcQmhxhq9%v({v;Ra6R}i0zQbN*R2_0f--T7;e8(4+xsl3EzSU(t{5V zwFl2#J~w;rjJfW)$?^8uhKMuR#-Dnf4%bB@(B zlxL^sM5pI;_vQ>u&xtC_8PeBMcqq+28T& zRgS&eXnWTxyWMN=QvZJBd;fiAN|?tNS>bbNsgVOiJ$G7Ms~nyU4$o@$rd1JHs~p(G z3h|y@7Eh^T8Kk_WbdGj^-? zW#l=#4TMb}J1U-WRD8nnG=J%!4v_I#z}$4f(Y#Y=RkFbInFDN9_K-q*P>wzL%oNR& z7r89Yp+Pv!Qc>+lb7t*wR4j6D%8T%FO4jH$rtBobZJWF@Nf#H64_H)aVVWL;PZJEZkLGbzj^YTuQzGO5LJZj#-T zqUz*chbLv_;7K;ma0{x`vnp~Ko^moI)HBRN3*<#+&39xmB-}H^vMDvflN#w7;{es* zN!{vEY4u+pnj{J^$#Q&y<8G@65CxnR+_YYg7qvL4Q}a5l?YVAgpWRg$sx^O;^x4nPjo0G7%=^tJhmJ(Kzvdo^dLV<;jQ$Q zdIzUzIXUS$IWu!|X659}&U-T6ew62B=s}*k-pW;_Ui+10Y1;ZeS^>Tx)7P0lBi}uJ zWADwl&8}%}U?thd?~9ZTzi#E;UGmJB{)oj>;y|sJERPQ>iFCHK;A|N>f1_=C(4NrR z&f1|)+TK@^YA0&pzPPP%yE1An);RHLjnF2mHZnD7c74X5zgxVaEDWEmh*-R<3ZJdm zmIPhm^73B%c#(5Yh!hVxwW$!7nN^Wlx$dl0 zNo$fl_e9jMid?&9Ntg77u*I_zg0;nO9I|VUqe+Lx>c(hvuO@ZP*B@JO~kLK95wVCO`TGoQ3oXJ|; zs=Svz4!@Z3%=vQXrW!Z;bI-1bO`=-sl0S*8ni{mX(M?Km1|FKKdESlioR0KtwH)8- z*mP>;iK(HU_eID7%kcvah@F^ft3VX`x2YkU%H3sCgXPsi=Q?ZYUA5+~lg^NTEFVpxNQZ|0oc`QgsDcQ%ZFF{ohIVVgD~G^ScB zIC9H#os#aWA75wVsWhVareJSE`oufv^puI%jPEewT~pA_F_Lng?#rm|vDL`+Cfd{~yR-nDvuZ9|e6 zXB-PT9r`^7C>f<+FW!(>*Cmi(S!#V*Li*Ygd*>}FQQJGCZ1&EFgYj=;=k1->!*?aM zSvz~}m$eBqw>>tot~Muq!;L}quyGh}$L`u%TH?)_*>~UHpSO-1iQaH^skg-9tz3bh zVsGV2{4DoY-ie=V(NmVpfKK?NR9Hzex;rQ8y(Dsb*CoNLXAJCgs@U5_yQ%9Z%gefI zo~<}p92c^yy5Z(5vNlxnyk)7_?bx)=J!t*b2+H|zrD6{n=kt`i8CJ6r z&Abd(?HWtHKKv+kAh2pYHpLX}eVWG0=~N9Ss@d0=e9HNS?fYO19$=%1f2!G6XOYHD ze?0$8i>q(MYiO>)HugJ$i~XExjShF24Ark0vuZ z|Mz;0f$`xyuUPe{(hTEe59juTNK}HQ#L0_ZEiVjVqP3j1L3~Q*nAbF<=GYeAkgK&R zwofAKP_MWiqJ-aDV(a(6__}g70w$#~p$v!?i@_1^b_u6y^PB10Ovg?w#ay~~>gy5sa=Qy1Jk9pHHG6uw87ydpcg>8`A;*FzxDVO}JEPN` z-E*8#h0e&)&IsC%cQhIA+15DolUKV(Sms8Gc2hS)4{;s~J(c{0o#LNq z_)?q*{ls#C=b2&Xq34S0O@sD5#&mnEUT18{j2!2c>CQN>^QtwKC7b6K=P&m*3@FJi zar>5+B(ti0n@b{nl_eH@Bu&#W%2A)>i;2R}rM6)JGOL+^&Yz!Pi`jpXc?Tb4V=g#j zXi&KSi%GBu#So=`AMnyQf=b)}x4*;O!S0rpglwn$c3Kd=owm2M*xRUi8yzKY+dEaZ zwCvNgLlvIW;Tt=R&W_%?{LSo=;tF5nk(8G!YqKNY-Fzau=gxgq+1Cv0RF>@+oE`6V zI%7`pi)e4dUbaI{M-xe#ON$E|TknBGUvBVb$H5dZNxwP1;Jv;`ZaVy?y*~o>gdWPi z>a@+9eI*2zboM^`;D$%Vt?)zEkO`KA?Cy~9W?!B0mstQ+&hEQ>zA$fglsCJNFBqC_ z*0j>O>Dj&gCCTm;kN9i76%~5PvJ*<&Ugx!F*-m_)&+F`666tmJDPi@HiWJc0UDUV1 z`wtPD!p>`#?-Qtl5>=r@G0XV{ykoW#*|BG`dz{OTX$sXc`b`pH8mYUUfRi>!f8fj=0jZ`*@v^_`;pRRtZ1AQhq+` zK`V;xj6LJ*an31TPmwON8((vDc5Q@fWu}UbG)DAL$L@;jz|`?FM0F z4JCwa&!Ay-gRYeAjOLCL8Es88ztN}!G`1toz)E2IbEqN(R05`2Q3+OmMq>6#wmf_; zz|iun9aI8Zo?^BKG`o3M`oqzD4EFD#!eRVF&M2R-{@NIr{>8)`71y5OQAFQam=i57 zV{Lcc{D)_1g|9Ywojq$C{UsdWuPR(I-WEwR)i{ipp1(WM>tM7qnjOF#p5*L3af&v&yxHibdJ53f>%7L> z7~##nCc)W#QUVOb&r~|%eS@9x8=}J2|LS6;rZHiqr>?T}z^Topr)&0A9m(<)$N9>a zH)i)qv4%W&(U?VIL(gXPw8+%QZ+&@D_vnP=38*W@nGJ`7%k{B_d%;M&fskLYVjxy~ z<28GIUqrDt%%IMi0~?0V90G~MT-!Sr>!OSLj&x|)078>5)wh0#5^oN)lcH!D zK4hfQb=LId>YXopF}&FFY1#S(Me$1(|MKC5N%w}C{UqQVunWg1!vQFq1^?B-xn$1s z8xPJSGo8^XdHxz*G(74shW{)0-Q>Z&FRTms^OJKsz5eXieYUONv2*4XL%w-$(B!0> zN|Q?q<44&ad1O(inb-fmYp)4Uz0iB#;xE45)#Wd@?4SSh5m!BXVz$cDs4MZDGvEF0 z+g~JQ54)%5E!7{7o%i(8@h1m--u>X$BNx_2-E#1Mrrg@^tLu*CJ~iO0c?bJH_3iUN zeRJ9?gPl*l|M0h;&igp(s`103PJH~U8$<8Qi2HEj?yB$J%6|OyXId_Xe><+<`B5=j zk54~#Lv86BMc+)S==%0oQMdFOdi~cMJ+=|oJ^kSMlXF%^H~({MuN{qZiiZ7mU#xXX z-NK2{y|0|`py%xPUk=|t`{0u6vL9IR!Rz<@K4)aFPScK7cNu!ag%7^YYv~)``#@dB zFJJw`olm_xvs>vu-xxdW<(>1NKl|ESMfV?nyK%?Xt+zM#`DytJCre+xa___Mz5ecy zo&E=qGSK#n|Wa1?6{FP-2K~eJIY@B+1Lr)FAl0XS3S|2 z_htNpdmCRk`TKdFp53Ntj(Ar}Rxi)8ih}yIrdisDj_+OXX1(s&T(Pl!XVVMHuK()q zk&F9(^X>26-}A>K7kvK;$3xu{ZezQcz3K6JE$R8Y7O#CIW#+WID?fVGcH)WH9f_~j zzd0kr^T>$rn$L{hc6<7)m}lPqy5f(EZ+U9?bC3Ni`I*yP{Nmf+{c+E4{-%DP-t*oG zv&{cXzs>jF@3LNeqU@{0LoY9{y}0_v<~91>s}DI>t>`tW(D~B3<0l{g(=O-r1FY3e zLmPf^ZQtFMgPiX~*Urj&DE{tWE}pl0-LBxcC&EW8?!0@;O>>$ykH2~Deg95+>Y6?D z#>t5x4^3Qk&)3&f^&3As|FM3{ryV5C3L!)RV7PMb_-^({I#~Ukun` z`DkbLKdVP=I{HCv@yQ47y5qkRSDx5i-NQC{$TNRt`hVAzf86V?(B_No_&&cFvu^L- ze>B|)&yny^+9&S6hJ5?lhJM%Ga^J7wKYQwL@2<UmDKG;QzM!-454HQ?hPf8anm$KkWZ%d+d)TOdr_Lyfx$Q(DU~Uf1=;I z(Rb&LeBguM{<;3mmE~0jd(VD**8_VWOq<)~z)d^$-XD?S^`*T2_p9eWw0~{qSKj=4 zPKoD=J^xO6>iX)P1J52=efQvJ#y8w}wmkK%XRrEjO8Az=-@bnRH~;IIJ#aKl={psZWgxs54=xs z%+^{<|H}IW{3b13Fa{`A@l{ye&;NYCpc5Bmz&UVOG=5d7)!Ev}VqY!ewBZ5qDcT5;`e4z4!P&GM3_g}uUm2hRZ5kF^7@SSRVhMw@X=c6@LoE5QsKelF+DLhP^kpIj-6~04a%5%**!&zQBRTm;(nb#EvSKl=6BQfLYRJnw_v@P#7qq~Y|Ezf{g zN=(^@C8nO&QBNrkuV#_miQtr73FR!Z+n}x%*=697v=)uWV03I=#7s9vVy2rbvA>M6 zdlCHd##r#n^71EIR_;`ZDSMm5l%-Q`Tky!Vto~>=C^*rs@Q?9y7I~Qw^0JE(`6lY| zqFe)XEZQgJg}r53CW$4M=N-##k(VY1G5^8!!eL=Uh9k8FYl`VeZ6P6C5)Mm(fciS{ zemZ6`EF^%VX)OH()Lg_)9j6jstK&3cY0t^TE> zuz%J-s4!oNwJ|{+3R$$sM544MnGz@{xD)l2n~QDG78><1%8D;~WMV_tOzeSn3C=({ zxoTe#sm*CJxos7;ziTyv-nLgR!;23KI#MAZw!OA31ypXbLijn$jwlUr?GYNH+gMl6 z3}(B8F&|eK2V9AdZ86sQUx@Zv6S(VO*#N$a`@H;&LGz$3Dd9mW3N4f7K7Vcj3|?WR_EL z6i}GgEn*h~;btZ1*WgrO>cco*lLwgicwNM0!S56w$B;(8ECU~lqxjsw5cQXX*UDHN z$|*ixbB%lj;A2=Sj!+p#{jSAf2ui50|?EvM-_W;O@e2IwQ zbyzvYw*f-LE*a4bK8__)afIVw9QpWew~=oYB6!cK9OdZpO?(a%OqG|nAByh^Garl_ zCK&X8ijVKe61!yFt>B|RsW>=XS9}%|Un=-GN2HwM`%b2D$%sYZW4)1&<7~zE3~Ud| z*7`+dwWr@s$T5uz2c5^DA7_^o-$oPPEb#qZq|pCSj?QP|djNdB5T1&I_fLwir-^Se zl;gNeImH)i;@fNB>j7cK*8*D^%X=&MI7gtI;`Ng2|oTF2Ya&&)#9I=ZYIG2HsvvrDZib=mF@UdMfr})xL z`pq%$;kLogcfE=4bMWyVS~*~y;`_kB*IUZbPH*F2@l-!v2fp^~cT}cv;g`-15>Sfv!duQDhT+(Q z!^rm<_-;p-a+IU1!9nc8L6>CU>kGf)TZ(pXkA96;%S>RLsL4N~Zx`{6Z zd~Bb}DgCCH_zDbs10k&RD*-m@Hw%1sDKaTX?>dQH^uVnH-wGs51?Kda;#&l4qEo|Ctw$KS{fw*$C%BC*_iu zKa`<+0>s2ht{!sjT`&J(;ycxWT&an#xdXZDO>$u|?dSW7NzT!MT$V{L1#%u1P&!p! z&ixt7Th{>}_scNK9fzDlk$_XdZn8eqn57w=w?k!$U)q)aNhZDs7`Yzd$|=78GRYl> zoJR@aSIMn3$xTNm??ISyO71I}hJ6p+adfu1Iu!pY$Kxs}s?soG2nRF;H!h86qME50}7k`S%{n zIgo?X$FhkSXDRLUaQ+|mp|&RSi;&a7InJvKojuc?@#pa3A(neu5894#_3)I=89`PN z0MD_``ObU`)*Fj}Q;}Z;e;+Djsv7K*!;7)L2`g^>YqmWVEiEc1tnaPDs}$jrnG{kn z^SQE9&*gOR7a@Y@rq1ImT5?NE%n)s$t!Fd%#By9LNdM^K;0EpRxfadHskkroJIrmV zY-w4uJZ4MO&f*c-6E+t*6T#behM!sUZ62S}$sV@hicWKr@s37K@wl6{%`GiklMf=y zaxlcT<&bNqw_->AhN~?0*wU@uik7YJn&K^W){vpv%g!~$=?w)ei&$#UWw3jKu^yVM zjqmQ9aimjK!vH%M)88E~?CEpI_`>W~=%Bw15xIK#5?hYDe^o<4U3TMU-wdS7m>2>t z)-fNmrbIT`;16bWa-)-;wLv1XzdfG5Z8lvLIWXle>zv|a!9MrGSj({>u7rjSSw$09 zxn|eTEsh&DFv#cLFzkMN=r|4fA+4SeTA~64$DUAqefEFgDJLk4dH#8&e*}K{oQmUrL zVy2rc zG1JjmFlM9^oRVK~N&!4x@jut%y#=3TF^W^}>KPaNAoYx^jh?uM&Qe7Y>WOASDu0DYyYRlpUa=|Ct#1d0q6|0f1#)D8s22 z>y0wZZiB>3S1vL2+AcBm`cz^Ee%b9ZZ7;wCiK*8>iK&;G{T;-KCvA|L7*%syOE}4c z8P1NUFnJ-#L|SgV-@z1BfQW&4(UR=>YWmXx*s~J$jmRHmw##y zC0&S59~Bv=3p<=ggs@P;G!uy6j;8XY4VGbM^Ag&?kV3*#Sb4SXa9;06&Q9$?{j(h^ zcNFKrQG_X{pg8Xk7$PHhE*Tw~mT-T?f2J|YsXl@NO71TbyBG);goq^k@-(47lw+I! z0}dl!D*WsRl~a7bLjbW$Mht;R@$uAV9QkJAF!DVPe|!2(MYxeK7oJ`Sqkimu6yFWN zM!wzfkH?`L<>&_CAa>!P^TDI^>jb~zTLUs9-+9DQPC3QL`y3-*9X#tGME%%RGLGe) zXX5JxKd&>&QI2l5iEk8)wh7_nV|S?d_-u>G)xFPc7+@Oc1g4+eCV!RgKZ9H@{K_$o z$5#2P!Vf{t=qN*1kHa|TWjm##esoIi1pp%j_jPk2jPY!fEJp+mamwZv<}8#0-^-18 zQwEP1tdEK>KjsaR7hwGyNyHq6u3f}+80(7tJ}PpH<+u{R-kcc23t`aB=!RJ=BO;er zYeMvK(cPWxVP1EpJ$}1=f@Q~)bF9<%HT+q5lW!`7fTorh8Ji6zdrGLWJq zI~h||GwMqsO5E<27KSA63GroPFgCDrMnV`~&ksHpiXj|)qeE*OGWUcu&d|N-As8i| z()NVZMK)UWpoHMshHLhOGzC#S9V0t0Tv* z50c-wuS6UD1MOBCyv9Nu_1l8C2J5!53GR&jHW-a&72fom*wHyXpj^frOZ=$~!-EF! zZR>bn{M;=sS@6cv%~-uCKk}?vRZ0|I}?6ER2z{4LWznn>RV# z@mez8%a`>M*zUgQ0!~9L`X#-8i1F&`Bf1tH1)Db@e$5>P<^MO_un#TvdEiGbH{ot9 z%N}y5BG=8g7jgdLwXyW}zScRloH|hB0e{){oFeM6OA0!vjr_3OA?k*#meGvOnC+lTq5auptY5Yk71z)t*1l32xZW>T44DmTI@ZbNjc{q_t^BVHneARPD2)Y z8feOYjOTk@BGw*?g0DZ{I_KfmmSabk(9&9}sCRe1(22g1P`j0{ZMA;1ByoDW<0i+f z!j%j9Iz~GDFIFwfF2cts`R9E%Go~eub zUwFdu^tj+#J3Y1BcXo&C%dbAX)%sZKv$oVVLmvC>U8kR1^T;jh^PF#Xzc+GR(a7IE zFtqUv=TCq7=xYx?cEbZJ{`Begi~n=Da&g^Be6Xk6kf-nYeBK8;PaPTA{U=vE{?zU< zhc8t9CgI+RlRI~A+1F+H!)F_w{C!cv=T|j7I`!mlqplm*wBh>~p8GUz$V2ZODF610 z37=$k@77p7_a*H=FjH}(90Rcr_}`ePcu3v|@c!Q_o~X63HAHd7XC*16Rh!n&kQX zL^;OKGs&ChaXvN050UA=L|V>6abG;;$oHI-pA5`-s9&%m;5c6sg(tx2!l(bE{2Ma< z4iSH)m|JEn?-ir)1Zbb+*ZuKg&+69ro*MVSru#FFD9z!2Ce4-w4<9}x=Z?&m>4@=>b2#=CGJX$zW0!JOy`f73!tL!bZDbugkmr~y1z&|+N zXIZEe9Mf771k~q@uGKN`@i_NH$EBQVPRb=Q`6fzCz9|xu?=KQZB9$9xHT;@eCOCm#bE=w;R z3w@*=k`NRfs)w(VnCaF_OdZ4=7G#)??njrGByd7c8Xk_eQ|rJT5>pJ2{UV&@zDb5V@H%u1{_Vr;CMO_Grn6y zB(|G3tmE}h@?ed!TsoX7zshHtc)gUQToWy4#qpu}Yyth7W4Dvm#IB}r+m%$)>;}Et z%3oq>aVu%S?0im95!A%O%RBP&xMR5DRMXY?6l^=8{sqYTa!_fk%%yiMfop3yAf&2^D>;ods;F9p^{+i%*5FF)5?RtB3;2u!A92Mx z>i@l`4t%u1sYbLy@Z&S8m(|uUXj;sS%Deo7iAy#l`IJJJF|R*vwQAdk86qwqwJ>FC z5^28qci_9Kf%NUmsH#MnTGy|yShGx}?x3a&4^=u=UkDj8&=YmQ$mX`Ja6xYV{1y3k zEX_nY@^Kn0oqric^zxdDs`4}!S&DV2!GaE-1O+snOVj9WJQExEFXGbr%d3V5P(>sN-ehKl1UCHXavO_Sed7$3P>G7hLJk-3vDt|A{#!q2sm5=-9v0HQ_MJg)u@p zCHFr3#4Z`$h_Mi_*BpCOAI8!D8yrSHUi)~RQ%>={i~u9wN$^pQd@PRQ>ko1x-z>zn z$H#YjjC@=Z$!jF}I6PK-p(efp#PR-3Im*#lO?*R8IK{^yu;Sx8tVaFB`-_4>|EKt# zgdDL;#@z)z+J^c;RX^W46W=nBPnK!;qxkMI@zojlFbweXsWnxq9lQcQ#bM-IhCri! z=fQ_Rp&uX3Gmicl0LJpx!y|{Jh;8MbY~tfXFU7~PvEnN=)yFCDaZIQj<>>A+)rTE? z9QV+Ed}gKixW>|`AKwYyiFoA{U#^LdYhD!}%cJ;y17PHP7CMS7YGgFrIPby9&U_$2HjPoxe{*$SCLN zK<;YjW0d3fi`wIhz)5P9p^tLZk1iZ?#&Udwa_}5xz43NXmE%vQa_}2Re@47= zijR8)5W8dq*T!Z6lh1*JakR^KP|m2|5Sb29!cmUy8weTs%E71FX#(OEAKRsoF9i|u zwoLFSzCW1wsttU-41AxVd`7Hhj zZ=@XM=s0IU?7~5J9Gy=&$5QmYk8Xa7F?NpV?1$nwf=zNs@2EniR*gqQi zb|XMeS1_57<1b~5`gsg|>^~IWE%N-3xAEE$@J%3rbmZX?ihtA_)gm0{a>${a!s?wE ztBjyriW0&vx#)@kh?U%A$QkQR$#Kn@QSNcb(N@YSIknzF@x9go-(DnS8rpy^8imT$ zq4>`@9uq;NxEZmUg*P}Aw;XcD^$F#$GfXPl0mYTvGz2Q$7*4+F@?2nlMEgbHC|GjG ziXy|J+{>*`7&>_P4_=>;#tS5zKE_JK%)Eu`61>l@zOE+1`|O$xQCE4NUArMFHshS7 zXS4U&B^#omywBdbp)9hXuxE3@xt`4l&pyb1n|e0i1s}QiY%_e+Q9fh}_>2j{W6HEq zZxv(8!Vn>v3E~PayqLPU%%)Y@_^}LZR$PUbUa;M^&4%5m_3eu*TUvH(9cQ1gHGNdc zmWOYe^jy3hPqaXWjX-VDWwtB019yp|%od|u)As+c2KyIQ?^C&@#izo&Pi2)B*Mt?E%NV1@L}Qm?d$=9e*&cQ%JL-** zmhItDHiqwb{Crh)?v6)KVCQ%HmH3yj`nxmP-6x#I#X>@w~V)i**u&C!?W!g2`qOgncQS#M7Nph+yP8T=`7TQo;#QPrqz48?w^bsZ3n1 zl-b8EZ1su~Bsq;*M(PzR7M}rfb{8i0N3Q6uBJE@9_8qeY#y*TavCFFexNWm{u5NXd z*IWHZQ46wS{Y)pjdaF;D7N@5fB;iMW*?Sxd4djisiwYhdi~Y9uz7eTZP+Vwuq77Ad zGRI(B*y>ZF@(+ffJ?YgyBvgrsy<6jE`#!|yl*a9cDbU#LLBnIwEN}vfb2DYeYG+OI zZDAD;c*`255A0mJ(~zr8TXtW>p3s?k0dEHf;3Tp8lNU_KBpLoW9#?a%pea7!MkLdVqTHxRW zpUw!lAhi9ae6)709LO;n3+{+g1N?jf(&}shGZ`EM8tL<(U50CjTPI&->{pEk-=cFv<^;9uIz_H2tBJ1^1M67@GQ@In%G+DPS$C zXT_{x^-e(_hRZ4+Au+v18Qv>IbKnU#83(aUqN#kzZ;_J%Y#|moA;R)mspEqZQ^&m$ zQ^&5T1F?4v@C=EmQh~(Ow@_jS@G6O^?^=ne?=upU|2c_SZmxePKg;1n{Ss5R$I!Nk zS*9l>b^zB%O#WjMQ@#`aQJykgC8o@5iD?f&%@T)yaH3x1DJ7m6V!%h2fkQpJUM?|Z zuMCaFXAtxqd)k@w7q<|ZcP=Q*&r^H%m}kt}5eb;0*5mOa!X1T}BVUu$Z zq$pE-7Pd&_zHq@(SXsQkvSMWs1>|!85sQZj?Su-A10RQ(-g5DmtKHXI)RTrb@1^*Y zwS8El(&)vTpItD2WdSz7G1P44d^{7#H|&VhejWdyr0rC=wCE+C;RIM-$cd2lo=BMZ zWsTsi8$8p15%Bm!e_olIIc4n3neOppGsjGuI&+qL>a5Jsb7zg6X%Lt`d-UW9W6be5 z#eR_c41EMnd%xpcKEG$K9J&+XzQ=!JbP2-o{5LxG1$5j;!Ys$@sd7qA&50D?jvDxA zH^sLT*vMA{KgTJ`DZXk182L_tkJm3J4opY-`F;*;)5iF!Ft8(2w?3e3_>DI0?QK5=f``xK7c?$F)wIAmhXljYIKWXX3+m zQ#FpOlv6Ol#8(YIu4y43hb)TEJm=bo#z{LUr}z>PK9ddy-!Vqj(RCD$M<9AB~|yu`Ap7D7XE;_$*J~yeQt7W znJuWw7OW;RL&QX8Xy8Pq)1Fo``hLS4<`0^q%v)G)U7w&~niAjHP0%<~xiyS4m6(h& z&Q#X%BYpTB;a<#2@jHFynM&ViBr>E3YBRTqPZ*026pj&J#~l-Vzj1C;Ok&1t3_UC+ zF^5<~PPhCE^O$TxA!-g*R2u%Fi!nAK72M``m^;X8O)2;$=94I2dY?ts^%F4V+9%Dr ze!N!jlK08o8)B@7Q#EgJP+4%WnhppN(*dEa(*bx~iH{}WBR$oNO7Fur0L!ZLw>?tU zNqqAWGs)G9g^#JKZ{PJKzG>T<6f+62)^P(c+ki|gm;i*msxaYzIcrQfh)+a%_^n5G zLraVNMxJPuGr})d!l8>h{By`-^^a~_M~^p2bX1cFHb1Tjw+8T%Z@C!V&>02 zE+_j6Z+7$me48xM9$J_kvj!jdNi4w>qw7p{?zx85n46Gqh-J*P<~Lw+Igb-CvFq_N zVYOC%c3Wd@!|D?ab08-s-DBoytKa5CvM>EuD2=v2%TE@Po(T>+J|LM@QVH3T&Gtro z0Ij;9q}U!?vTy6ztskb0_VVLsm=wf|fM**k#TP$)#pMlKx?6nic`3eqo`)m64Ra2L z)tudNrRAXQ<>dn06oxsXV$5lAR%J{$>fl|#$A#hlzFTFf@i+?V- zZuxe64L4FrHg#gkzXSye83gc_p&)D1YrQoH* zo8)9zz&Ub>dH-Q<+lU!_;((6H4Kv6|H_#_T7kmw~$)@ErI1XWE5uay<2db*N!aQFn zwhM8@+q3ziQd09gyER4I?={40b1bd#yk5JcpZ5TKKjl+X`~j(tK3CUv z|NTEmx_d-=yiX$i$AmvpthG(J&1hyeE>SO{|ARi>irNA&J5u=)>CtJ#A?rvJ`4}SKe(AVi0RFiSd9^tJfGdG zdAoHIQ=a3efcZI$!RR<{R=TkzsJS`^v0UiUi3m0(8Z^?qf+Y1(8d3|a2A0bYAOx;N-FHapqW@D?ik|i~huT zbsvR3xwjzzU6^oZ@t+u7l5jlljgEZ*-Eat*={RY zw26;>Ag|%dDZXwdK97NqkB}4}`%;Md%Q0ETnfdlW&Zyr520mUt72hvSeA5xv-aKBZ ziLczi$8J^e9RW7#mkU4bpd97sUdKV~!a-MU;NxXg@l^sF`If=YYn^h6?{Nee`SyaZ z7s4Dkc-d8aD}jxC&G19i?-U>NG4h=>=*Q8a;-meId>7#7m`XXtHy!~-z9#VT8sfmg z_MrIs0~`5x4R#?+ImOop0Y<(H;M;^S2M*(!W|rN^7lwM|m`XXtM;jRVe5llVggJ0< z^u;*VV}GPI@?j_{-`+(eoZ{;PIU`>h<^>B7@4&%JyW$Hq@o_J9jf9?$6GA5!+f0g(D(L|4I?^<8_|kHtmNYs7LY|8ZlDuNqDpkXAh^swq=|_N z@mXUUgKMHWu_(nmWsMF(X?_$rDkYL{6ueb4kh*e-LS{1kaHBs_6A?7{JXZ3~! zH`hfLi+g{&dA;Lhv_bTNEefGmkajfZ+pgcBr{|eV>I@xX28YMk z!tJ4J64peGu$J3&ZTDLb_u-Z*N@4p|wG~Z}h9*0sVoF0{!}ZZv>Q-Cn@`v{023R58 z5PB&+L8N*fVe-bvQhgv!>!i@F*Ys@25W;|^ozS5_UG8@%Dr zF(iZ`qP$o+DrB(UK#zkB0=5q_XCLVQA$qP3f}VYY{CcLC^$ek&P!MN@{!2yax9Goe zR`N%v^@G~|9O~7nRj*+`UaucztRG^l*kFH`G2Yl^;Fc~}v-dn~VXML#TCq_Tsu8|D zHn|ZQTW3$SG<_2*75am%#=a|E^IC&Q!G)`v5+m3VGJLR>h)%HW35__;olSmQ^j@O1 z`}0Gbv!%tq%-G*<5PrASZjISu&2DL_Y-yQ+`M6LlU5r_*)%3YPFQapdFGlv7p_?%j z@QF@YPflIREag_TUHgqyjjkI9z^DMyC|4Q`Vv;l8-7 zal0~VE_y>WJR9HpEh4eU)MBAr5ac02KYlUg9jf;xhPhKTk_!jNW8k8@0qAse49X&h^+dm6*7n*Tmdjrk};r+%4^ zjvRF4qa(L+%cG5CVBL)vuL-px@=^!j)C^!r1&)Res~$8}Du9 z!(CbSw(D4pcaN0ktXZqWdgoRTP}_B^aw1PkwO!Y0e6xz_9VWg6lfReA-^b)nH2M3P z`~yt>K_W{4@juh}o-Liu zpQ(G~e;eN7<9n!ddVH3^>Yq)^(xwE&XR9djYs0KQ-}j}{)92_O`5#Z)O#b;Mf3DVp z6C`lFujI3qrNXDrBSdMT+8;`Tt?^A2Rs|oBTJM{8g$0L|)AAS2BJv zFxO@8llsCd;!92b!zTZ`CjYNZ{x#CSK=4Osw;1{p=KlmUl8*jgC=Y(=f63&3)8sER z`7g-!-+*wg+m4ccijmL!tSiwJKg#59k>{IAze)P@5Di@f{Q8^X z$D8~SCjVqvzdRG8uovHhvc0jVj>6u1$7T80^G9JXz}Y5y=b8N6hd?=&|6|F|d7mh4 zm^MvDvKdEVccxDAd}Xkx51Ick5&skIYT4d<3IAxEfx6T6N!6O9pFd20Le}?5;3(`W zHD2m}t?*CMmP&ixD*V&57%87D{4=#*N`03L|1J2Beo#&rbF2~Y>{04UO7#t2s%zmy zFC4F)mJtF9-7F(@%&VgMjxgr|Eu-{sK1;IPq+uc$&#U}i1!1ZK++dIB@8&{JZeC-C(M7kWx8>;TLr z;lM$DV!_YG1t<8&=~!@%*RkMC)3M;3pku)~QO6GaSSIP1cCg&6V;g?d^G~P5%u}=( zw0Gt?N`^BZW~rWwrb|p+ZZ(82l$iN1H-z6Mu>-#w4B_ne$w}QS4B>kuroJyoOuN#t zZ(D+2VISZ*z`{PjUSMH=;Df-zRuT(a0S`d9u$9Erm7Hu&4g(ha>`>qYzZ^yh{;7Jn z;Fq13;GeFC3w|~tIMEKJ^5UEYCiitXxQ`!Y*{>0k!zD5EOq1AeXUO1BIIbPwIVJQ2 z9s(@%1ZGpA9A$FxEA*6D=m|{qgr2~2fQ21^2Ld~AFzqP(3jRm{IKj`04xHehrDMS_ zhmnFmLk}1HdUvVYp_?8q>;UYy12Fln$HDK{Gau1k0h5nSmf_?R?GTuG(pdm_9t%Bz zhXM;dfyV+1J%OnC#?6(83-wwcjI{^Fb0L(n;_zfGs9f19I0QTDfnDs97lvwBq z?6-r&!VbWGJ4h_-&_iUY+d&T3g&nf=aKWFgW5J)JV_}E+Iu>@gLdX1x#y@g9B&IB{ z2Mj024HDBP>>nAh?|MoLUR)&axG_p-#4IU+H+g+5XT(PpkeAe?A3 zz>F6%KNG>aeWdm@Ps9VRi;3C?!xAb6Y*fWs-FMFUgzT8YUc z(oP0|qu;VzK)vlreS{5*^l)KAc5-lnGr_uqEOA6|41Vxk4sj^$H{luv?&M z@r+s%5a$&YNwuqC-e0|Ow0iNH2t$$=q-`O6k8 z$;Gsy3|_DVuNrnx0I}^KcQaH1=0#R0Mu3d|T3yk~Wqf-RJ6h)EFT_TpMIF%lw-n{Z zsqIh)#LHLq38@DNQtJ zauGHmoxf<%itL<%1^$haVX?O93JUIA!re*>i}I15*@*wrZnwxM;N9nT^bd${Td@Jr zW}QTT5+Kn|21X%M#mb~Aloe|Vk`>!FG}$cKTCqwYv$nKgN4x35y8F<$|+z7W=l@i5+ZWR|exA03D1v zOmYTmVF>0|9M<$>-H=8vhK;h!a#v)<;JPgP7yuGA8jHCZkWN6HnV{^l8q@V92 z$Qk*D82ET^rT7*B8~J9z&wEPcC`ZTr5sh-W202(i4p*HV1LOniJUyg-pjIeL>#d`H2@Iw2qL;S}F;$*0QuIQV)Y zUOA;-fr-z7n?6+^p!V~<4I*Rx*29yi$fO*-MzffG-Qb)Gr!`((eTm-zVT} zK)iBFzr7~D&%yURgviHv1;y7a`S2s$Zh&4A^GEUh)x=i;rBr!&FRJ(!K_C42&)?%n z*Ixb3hY-`aaM0N?8KLTzb9#zzl8Ntg@a2gV`ah-LI1}G2@TvM`{)*2h`9LGwEOY|B zB<7FeyVt~513pz=-p4Dx(>UoN>M!qV@U>UoQ;=gC7Y@2;RDvq61AfIAh zM2ISHANUz($MG@bjC_19I}_o`QI776iSPfT?p@%cD(?32vzP3KWW^-JH3-<<5FjYg z1OWlj?s5s?rU{n_h%Z@40#PnW009eavc<3oSVL4uP+vo|8d7<=cncskL4|zIJ%b9cb%$%8g@TvUrdQyBT z0OV8oErUCS1X8F+`4IrIj}AyP_*8!Rx`ko1@5*kS?Ryjfk@DLgdPcq!Tofw5gA9C^ znD|-{NxuGtmd?R*oQZD{_*8!R+DF+pR`RL*dQgukB#=Tq%8yNaE#Oo6<*Osb7n1D- zw>cqW;bwoKMDcO`WMjR}fgby1B}(u2ru;5~9?MmU(tF2b-yqz4Q=n9YV+aoFG2UJi z-zxC&9h(xx_mqh*+rT#r%8D-&*qD!M@F@;*D(sioM^DId@X;RHHynrJ+5?3@9`3@%^si>x1}4z6asv{Yr`AOOkf`WWYx7v0iE4C>)CK8vrBU6Ntz1 zP@?$003i0sfaeT+H^7f!%>O0GoRRNCX@`s^^oZl2XXN|TkY69d72h|e`}t|`rI0`h z^(bGM?!RXZe4`Pr_-LEaJ{Q_;q;`4)N=Cij(8DDX7M1RcP$Krp5Ib&GEMJ!MI2^ty2EH2*-)LVn@*k;PjewrfzWczZ+UW!XAMM*N>e2a;#6CJ8Dd0=Nnfc{?PVrTA>&%Dg$`RXNIrNP7Wr0t%KRzcYzS~WFXTev3 za3$2E6q@+fflsx+n-Q+~2FdcXideXJpz(Pm=1K8A3XU(y7Kuz@$s8M{DnoO`=m+l{d4Hmne;w9hhD&>_vtzG;!Jv9okMS&N$=Zp z=&d#B*-<}G4U5X}aQsMPIS-a0F6dno*3!cmJ|6w2u|9mzOEKsvzR|MZ_Q|l}y*t`L zKK!W1>xIuMoOn8zYTgup$_Fvq-*?kZzIy>@6RF;s&f%Of%vKo z&`rKPv}y7T#X<-=*OnFS z{M*oe;&K?)_@gKLJedP0R-?1)TP&N6A zyGM`sM|=4G4Kl$~e+kgA}NqLj@e^dP2^S?gy(+5)jF<{##ccp*+ zW>lY$eZ;Xh-}zJBdw)K=rr}2gxlg<}HhJJzTiUM}^LXF;el?>0-fv%+bxT3bE3SLi ze)W0#Yqzeu>!zPJEl7R@fQ~JuyRY# zhA&mr+Su4$fx9Ghtc@KEBpis|`&!Uuud%5Wvut9;ESp*}tH?7i&?9JzuCaBKOKRC- z1WRmqT`VkDbt3v5f6(Ttv0bE;x(lU?4N7rAtZZeAtFgr^odluNL+X6&ITdi9Z&!!a zp3=ajtILD7q#9dK#c`S7=p{L3d8P)Eg0|i@wmwSXa-r}esqlBtmw}#t_Xcg)Gs3G> zl7&j&u&tF}1Ot}^Z7DUjeoCdkP#F+b!TtupK(C-JwZ=A3>0BXnt_ zKlQY)E*|Th9jz;SE`8TttV);Ov}0crzChd8RR6sHOp|3-lV@vF%ii=|`{G*mr@!uv ztGat%h~c5Keg1l}f?ZRndSCjk<~Z!b@bT`WzuEU(E2eGi--V?2$G7bFRJ~l^oWAS1 zxcdF+Tes}1W88=d&&p`}C6b0+5tFXE=RD~i|KjMY=SjEJ8!wVRSDw$7H0?Z3t|xp@ zweEb0Zxe~5yd!2hb<@@wWcyrc9}k?j#7D$e{k&`1DADTuEYYKfkZqCj%j0&*;zm{0 z?`KtRy|MpOo>7%$`&pGukE$H+dCSujFX|cf*s`DXxbU^A3Zx2~LuJqTTVyqd zQ_U(r`r`T0efWIoK60LPtA3&K8X?uAhtHGd+KW0GSA^W2^2Rm&*Le~?`$b3lijefJ z)}t?}_7yJZ{betw*S`{1_DcG2|JHle6?d3LjVo?n-L50@VqEBLdhBQutEs8}APc(% z7uCDfucq&MBCfhAJ#|}Euqm{yy}c<^_5=&NKID0~v85_~-&0i^WE~7`3B~UUd77H* zH>4kHOW*piO75j!X6wlvX$hs*e(-KxRpqAk_N^goYNLro508d+J(ylrm)`XF)~!sV zu6nz_y3SIMKB2CqF&*h2Z{2sG=~wzS|J=|P*%r$7q7|hd-`&x+k(6j*P5Y~lrlXIk zs+i(98e+CWWi3ptCFI!`5?xUG!ji3*Q|hXbIa#I195PV#bC`lY zE>woBg)GSS*3g=7Ti#1QcHC2aBE4znyG^gPx4+v||L%nS^d zI(>KlYnt}%{$0PjKW~5hvHhN=zqFu#{I!Rr9oYJi>LGXkDNY#lNnHzi*S(&T2rlpF zeE0iziK}vJsO8t_d_A~mn;usUd>_-r6^(S+b9>4}&;7}XeFtclA?f`s$J39!=czxD zzIF4vb+oIl`ZXqej19Qu-SlJccy^sgKiyjOi+4ke8!CH`2_Hk2kGE_{FT2}Q9ZEm_ zMbm#(Rk3k}%9>`>i_Lc4J>627UiJ&mu~7QH1{L_&{dpqrlTgc!^!i56$tLts*s2H1 zgVj}UW4e0n{AW6MhN??%-t_K%RYAyb9hc^8s$+5O6~(o?BTFc1QJP!#?+GN+@b_31 zr#}#eBVVC1ly@i|hVKgn1N~SZ$CmSWWo6-3+VXOG%TZ6+#`J@@bv&qA z*8|KuT2~V&`Znf-uBh5jc|~YsjkoXCQ02(b#2Rl3z{Jq(8gD;<*$u5(bGUsB9*&J) zdh;9G>CqwU#M(OR`Vn?lw@myd={f4_>`+``mjUUhW|0lcoPwNCC3C(z!$)+Rm@c4&iN@Qr@4rS!0G z{LoKxmupxFV6Dyl6~04X7+)1^XiGZa6l*{l?Gn$Ser=(3)ZeQs;z|!DRXx6^z6>8z z_i7sTlbrVU_19fg_Hv6@?*PeGIJN4wbeF@A&w;t~4AOO;jM7GJ#7-@AFSO>}^~>Ps zX?b`1gQKVB-G%=-$1383qq9Q^t`S;KUtXv@IC?tw;2M21_uv|x%N?3V&yYlTycwg3 z9lC5{hc3B^7an)U*oC)Kc+2%~xt|wS+QoievBEn>?B~@jG&MNJCA=>d-ra@wMf%Sf z`HghA2+Y4-<@groKRp=s4_74g}7dYhdyd|C1A@lC_5}D1DugYpEIdg+r;C+ z_t741VeaYMFMp&*D-JAMR*)ZqpTC8HqD4giatZva83Xg?|7$5R`)^rbL4ik~bNMge zhK2bBg$ouI-FEw;#n|V)q;%Qx6?d#$wffHgm*oD@W5$ll9G^8|;-tw_ZoDZwXX>=+ zGjea9IcxU0lS%1ZB0{3!unw*NBP5cr;6Gl$h-KnCL{R7pO?AlSU-?Zy@n}57E^@E?4{{8l% zwQHWe_wK2)ug+-tB5>@5Z{K)3Q1hX-_Ma0L9bNFjb+0Y|Rqg95-}(BNf!>22_CNIS z&7XbMaOEG5%y?qLyH|Og&)oU%Sh%*)@S^C#-|FKfl0h!KZY@XmJEZHk_blxWv31(D zly#D2ChFi7x?+?g1SR5uR#t57f38 zeE5zG{gse-{O7mW$7Oo-WcU_Ye#~hCR(CK2i||`yxE}u^?IlKpcyS~^gZmdzKEyk^ z1k7IOBlWA{mw>n056JMp33qSpk23s5;r3{+84{#DSDM_MyH9Drks#k@s&!^ro1MNT zO{Av&4wc_)D&aRM6uf>6uVc$#wMH%9xf1ieqWBgBn0_o1`irpx*kzIYImmkVP5w2&NfMU< z50-cx@Fa;tzy%U-1TL4j8kpavljlC*y%N^~za{a5z@JN84;+g|M*T;D`$^mg?3efn z;Qx?#7x0}DKLxy5;%4Ao5i9ZD9I0W-@8n_p(SK?2BM@oDKc#gzh0k4txEHKwZq5ikP?@FvX z3w3?j5oW>IEF}d8_erLV!$HjOSq2OkUSrxA7iNa9HPR)*gW-acfe?;`(4WGW!^F}V z=1hdYTGu#<7~@Wq-Z<2?>;g_iekjx-W?FqDCTFt5)Eyvk9L|FzW;(+qCdX)rnGVIm z&J!Z?$cPZ~s=egMtJZO5u!V_3g#D64*w4vG5Me(CwwWCd4#s5?EFWT)8H=8K(@=OK zX8QOPRA8o0e){t)@(av#`b&S>k}ffA3`p$3`4w-n_%fwn zQQ=%Z51(_kY$u)YH%F0X-O7)O^clHbr)sNjj?VMhQ20xk2;cN{gmq23Xvy+|(j|dK z_%3GX+~U%u^YK7?jtoUq<$ia@FI2$7GMPJXMd6}?CE*#lWEcL+RxH-8`XL{Kgg>u1 zccG|{Cpv$#pyoZR6k&;0jL#>Q7ltPbciE&Z;#BDHcL3+MK+W>+TCU8nac+C0N;QU? z=I$f+=bM!-gT?6K51WZS^c#Y16m_evteZo&#`u4$Ev@wBN%|2_83uh<*YH zU9XTK@~lq0rYUQ2Fpg1Ag)v;=RTBH?32DY$QC{0=IA{;`)U|Hp8xDWjjRAG=&5_tg zPsob~KHR>;e7`{6jC_-27~@cseU;E7_R$k^%)rM!P1#p!;>$*u@o8Q0EjIDJZ{TCM zulS~#`0`~KPC^vl6cgWR179pO72i-3-$H~%D!+6S-&Y1cK8q^8=YWmnw+3$Z&q|bi zkHEvIw-IiyQo>p3{inn}6^5Gt`+Bwm@~U*X|ACQj7sKcwMe$LI*eCtd!Kd04>qYUM z05kWKxgLFQ8{sFCB%#a#2D(%H1Zubp}5E%2a&IO?;z3 z#@|*-6yH)4UnBTb{qmlz_}(>@-;j$m&7;Vq9-VKQ%I~;=kB=pa?*$Xzbnx9s0x8PA zUz_-%QD}M4VflG*D83=U$V#|hdlY=Ba4S)KSHpwYCj%COZxt~4l5r?LTwa~{UIAYN z{FEp@JVtfmJ89rckzuUI&yf$>$LCSX5=88)L-C(sJf6cpo}n&e6ZH6-UkSq~To>P{ z*M^Ic^`%7FH_@c`A@qus63&Wmn#8Po%5-!>`8pK;smFu+&8RpGXf}3MQiuNBXV^H0 zXD04j%m&MuqBx#`ry+YfA3PYY`U9A(U7a!FT76EA{y*K|(6Ro1*pMM2Watom^=*&m z!u#mCq%mwmY&A}%{%=@M@+y(O{!hH45}$?|Hup6@(sgEG#IUE51I9 z@CBJ6iSxp-2t_vJ<+zA%NF?mwC zah@7&>SR^eJZ;zq+5!8(lAyP@%Ra&Be#7ZnU44Jt_?~uGRrSOcFU)-U>WTMnsN2$P z&3sNTjP4laoJ+GwP2%7)ukyk{PFMxF1O}t!>&jPg@T?thrW|-4&O+YJg1H z8O(G9Goz3StO#aWgTjUlkAYCox$Lv=tNyvaS9AX!*35yLtLo-`*31Fg-uR%yRpU^z zy&Ph;m!o60SLN=YBf7?+ri?knlrcxgl(EWfL5ID@q2`=niEKXw zCayWe#5G69#I?%uJ+0WL?o{ho)JtQ@366lJ#kj3W&GGoy>6^U?$n~+8<53i7B@A@T z(OgB35+K^^QXP%D|{lWyWgn`ID@1I2#;}Jr4UpM^t5b*+x#C z(3;}Q#Iy%g2uyZrHBMzR_L)GIoE;|DIGqhn#~!Espfjp+TZH(#k)_vL(~+mfl2@Zb z0gK8lHrw=uEtRwg#y;=1ginC6^khgcqpUf%=%Hmq#+KYOiZmABW}^@)}p(M{Ln zZvP91!{ci$mEBy{22_zVAl7AeU`6Nj1J08UeFA8N>pFY|sq1P!d>-n!_Ob5u0s9VX z(3|A44s_PMbk;B0b%kH+-(zC#BeA_h>z}qdZjkLe`r_;t{3uLR|MiZ~9E+XbIZ>Qb zVsh`ZY-?|y+M4d-j8w6~;P%~9tnN=@{P;=e$V}l?QZYz#m3nZMG{)5B6h2+h+x2>D z(y7)_h@q3b=?Ilnz7`5pwuUyL1{%w+chrngBgZJJF;N&!t`DsUjtb7*)5Ug*4I6od&tkNO z)-mcyLUAyuy#ctR08TBv6t@-X9@3H-u*wV7AF0T4PPxZr5)%AJRoBY+)d6-vG zeN)C_`$JeKeqhPK0QxM~#!5@s`z@<;Le3HXs-HKsoyE?OFz7R`^}T&J&_mYdi~+sS zdInq;g)+y+24(Bw8ol+8A&odpgDCUmt;$*G&%N)=@c5CBx$MaI0ec&#B#dw#YDMEP z-4EDq&^89DtKD5Q z&K?{mI+SrvUgP6LhcZrdDC0zjGEQ_T<1GKP?kD8MZk}#y@X*=uTP&_bUvf+AO3xNg z?!Zq&mfHBb=tI~PfqPpt`rBB@ydInZG+1^G4Xvr-oM!8I0tj~t|F^)fRxCfi#uX(V zKg4wdbI=MZzrep>AP%;=2G(V`de(6h)VkM3b*uZJ$UCcb;HJv**`ZMMu`F(^igoh0 zAs6q^(mD@ykZ{3XUdjqdpPdHUlU-fz2n;?^*g8iW4K4AaMRmm2T`$3&^?0 z8;8jrf^&9KXm{!+Y(9aULNVx#3$~@AghF2g+tMq)m^5SFAy25aR|vggdH-Kp4?Wu+ zz^CshvsOIM)O`Vj{f$vp6a2LwV9(>qaunXGcv*7J&~9+*Mx*S)Cg1AF&A$}0g1Uy} z=EsFFbt)dbRkP9@GFPx_p(wUQz1XnnhV2BpYvybuObwUV^~_y!tDd#3-F1FD9tfSE z>9uxuOm1WM&c$`9UR(#9pSeP!td7Q_tQI6$4-Fz4CQ&(bzKJoRP3~2eZTLyO8(nj4 zV6oLb(3$1$H8xc4uxZ#snLd><^cnoZj~cvjlbRX=agAS0YTEuqV{60F^zE&aLMYGJ zy1GE>riwl7;L9T4A&UlB%R0#N58r(#O3U)Yc2qrbnCaAp??!Oj_pBltCTE3%=%L>u z82&Ashd!62?d?;X6`!`(ZgLOg&2dU}=Ev|k^f7n+sQ5G7j*r^IJTANAukDX1nKkP% zk7v@&Y5sB3()z9NXmpJ9h_$9X`aB(voUe100x_CL&E=tXcBi=6=EyPPH%SsMeh&`* zKH<9zx_R(7lm`c2hy4hL1qc19L){fC-W_>w-kO8YAOFqara!#%7`!@3+Fkvl`&j>Z z%U$1WJy`MSTWfuPxb?p$j34`kQi{Lg&0bl#hx<*e&3fbF6RWPd#kMu8ar2-ly`TNX zuikq1?a=5Ri$@Kgc*7@0W;>R?e$Qt=R`JZ|`&)Z`J#^&v@6~?yySAfC-&_34Nz0$A zyZHTaEe~CCPtI@VJ#=bk|3CKYe*5HJp67d3?<#n^_Jb#r^LJ!7E?-`=uUq|;*UWsj zAKm`;pD)k9{+qk*D_@#_^pUTZ{_2x{SzrIttf$;#M=iai+s{ij-7u$o^0xZXpDw)m zCp{LYjGVG)^wL9HE}4IN+r$~a=$7y9`MmAhoz=U)P1{%1Z|nG8tJc2tmhaPkZ(hIN zbMd?HFaA-~JMNh`ZU5%wuZ^#bMG~tDPF+08Td?)1qS$#4{$bRMDqVH{`t0UM4qQF4 zw(sZeE4AjRw|{^6qlNu9H_TMw_rE(pJG%6pU-p~+*DLP+V))Wq?%VcQ_v4TL*EcbD z2Yxj-dG>*YW8U;!dv_bh%_7L6SKqoT$+zV%Z@sYdhVjP+^-TQ9l)AZ_#}sbLU9qu; z`<^bv*O|iq>Gs?=o9sV*`nNZJU$8mw(UfP-zLbB8pG`%U8y`6M+;fXA@A1aa=UV=@ z?6%N9)=w+EWdASbZ+NA=aNWX7s~7xsd(}hTuj#L1JNDiA=l@RG_}y>&uW(!-j zlwSD!Z+PK?v^N-Da{TM(1@+MW#)}j32F~2idWTGp?;R|-iVsRR-$h%*)l6+&xWBbg zBJF3rSSsY<%y~g-9#OS$57fBU2xS!x&Lf&2-Fzo$!5h!APVTZIRaySJ0OpLSBZZx!*c#QzSlb;+-%BM``@c}?zQle@3UonmtLGr7a9 zQ~2Au%%d{CF=qM$P4TZVxy|_*r1h2MLq+z*YTi>kFy~cWVG3U<>tE>?nZo(KvJ&zQ zmyZ9yne(u|ljTcqhR>6H91BRmEF}Y-2zQ&(yWHd+B>9rzpMa65pBf0r&u@8^(A^@# zxxXa$4>#_4$?!^3`~x!b5W(L^xGb_-#9RaezeQGuXsfa+$Z3()kVq`6fcHW*my1^o zF|RSI5|e}P-igVPDKR;2mYCNd#Uj%Z*Qk79?SQ}9+nn*$-sa-E<)8vY*eUZO>`d4F zg`F8X=6%{CIXNDp=9Z0>m}%Z2F}c@COzuq*L?TCvhsyKbM$xy(}^9dQW1O)khMOlZ~DHv?Wnu>i3hF`QY_O9i}xxVvd_| zUs3vdfM1e01^7*gY0p`S$nPRyqvho~c9 z>OL?1$w5(^B3+O0($h`Wu}IgeW09_$!zAiXPCpfO$4Y=O&z3;~Y93@*= z%(F!fSW#8YH)6Kc9vrNG#%0pOiRBZ-DCy7Z&nGdd#uE3%KS&l1i|nE&6Z2sfl8wW{ zivuzphlNH#X5wI4*Wo-zVz#3^VmWw{Fa6m+qA11s|2Uy<(y<-qOC)BQvuL;{%$AsC^K*$=HmwqqXAb&N>iB@4keGG#ti-Gzyp#|+dBDGu z*aQ55!T%$P^Wo3Fot)&c*g9}`iCHJT40xc#dGPNRebL3;dt90rp7qsrHjf;F;i|m1 z7py+VR2q|#T77VSQSm~IdWECv%QfG=a<0y#oW;8PTr%` zX-=I~Fp!6Qgy&JotaU6#Dz>iY{4tfQxmd{B;4BvIt|hagxPx=~-0+;TE-OkZV^%C# zSsLKF$dQ(ljHo2$S4E80$+OcmEJgGK(vm7N+XbuV8YjP@u9vP@Zt^OQ;5T>ivISk# zlwY{iQ~}K`4wNo03M`5+pDtYdh}^08g}c+(?1iSrp)wXPy`y6RQ(5Qdp82Lq?K~6M zI;n*7rC%o^npB7|NUWOHjT5F#pF8R1xf90Z4i4wg;Mrv{P+aIgQ0_`oA*2= zijVg=Bi}mk@!mqdZZeE~vygcs-;3~LTqTNcI`oWuuYiyFAYUvFhLLZCiSHHo@m{M$ z@eMKYeQ4lg9u;3-+0OUx9>NJovjx@x5>2TLnJ8<4~gb-Zt^2 zxI5~DKPeR7Q^1U_uJg%gd13i@%!- z2^mJ`5fk4T=&g#NXP(!#5S>MJ1ij_(Gp2hMdU+A_j+@e*iFtQ?XQhN3lvw~qzNeuV zDc!fBOFgzr$~bgB`8pK;8OCF;OjiYMXD4M4>QGKY&p6*H1s4z7pW;_~520N_H7rkn zuNr;~?~jA+B@V~ZBCIcd)zW#lUF{Kaq4`dO(}xe!XVzVKKHb^tkpN_f_@9b7=gK!o|(0 z$e@^@a57qRUxv9Lpf^NAdB8*LG48%o3ysu+P(Y^fU{P+^oBnT>fZChB&21>Kty*K@ zyhBO3RVXg8-#W_3$h}VsO{}zqW>?x-ikeQr~*H4*&l` zxpvAAuLjXKecGiHNHX+IXW2LDU6i=EwDxx6?#QUGa&577^R(DdqPsc96;-pdw$8$O z%Bk5|R+mvz|Fb&(9IQeyYG7UbTH9w)Yo^xbe6-h^nXJ{O%&x2HreVHab!|rOjap;I z<2{!*`s=sHRsTA^{x6=*f48IkU%SOs>)mpL`_ylC9gja0t+jGK&jII&?&xtajbPB~ zkM=r8_4x>Mi7eWvi@<#9H^+4yF0Ap`6}?vOOKK{tU)d5$ban4FgLBIM(2faomtT~; zvz~p$gZcs$#eG{$os!9wd6b>tr_u z6#g@`>DuOQ!X`g$YAZ*~%rDwQ$+bCHfyUKqhco0wI*Vi6xz^_7a@N$VPI$loF`Z#` zLQ%47VWrjO$oxb5LW|>_c34vJcDq(rSJzWqC$4UF(Z_AcJ8Q=unAC8Qw&&=vhWd8Q zT5~;c__~o;J?Yi-iLdlJ@d0i+JJ)twdBcD+D}$?}V;9eJXt%8_J$!6+^gA~9x7xgm zw0Vb))fdLaLV3ad-=%d!)q;P`Sv1ET_5(4!Lc1RKKRe>4a~*f7geeQ&Y6qrr5f}b$_X~R#hVFm><{Y%$lj;2E*T* zO7KV$ekw5f^Eb0aDjEIxtP{zfI+6VO?l+P@f1@gYrlrJ~E`Mh$p}%^@Ha_nYNAjmV zk^E^-B!AkY{EhjAclfsuaU?P7t2`NPSI>dQe6rlnCC2Isd6#;MJg9n&WvM}e)F&Dw?gAF!*0`x^3wv#)A)XR>5?0{(bE_KJvzP- zI*zc;iY3cSS4$;HnuAAVvl(EnN^; zQgmlvd66{WCW8kynw?>fji4D=G-FB8a$yVfJ#=U{&Csr>$g23;MV4+Btza=$MDk-3 zHGWJzE{!e^_f(^EhCNDIRZxnzw>Pf93(!(+ns9iQ=&ohPpc(c!8KZb9auO!a7OpUH z=fD~E_)d|=EX^;_WQ_U5y1MY5VYe%jR+NftO zqUDPUwCUo%j%V1fl41EvI%15)*E85VZ$;6vg$4PdWf_t%D$cO`W%S}@1uOEGE?K=; z%MPOsziu`CEARbsP`<@N^%X_=+6+{eXF|S491iWt(EO#S`z2`A#n_2$$#QM1aC^|= zl?NMfnoM`alA@9o1rze2sTT`c7Cb;5_UWq9rw3!tFG!mgSXMND%+e+JiW_NS|Ig9% z@ECn&^to6nW9(@L7p~GK6|DB?XhxrYG7yU%z+3knw`zI8l6;h$QBgE4B)M$GyxR)q zFZVCfFNSHl(*w7D3FlR0St`zs)=O$h!SZGE1H}cfwRE}IweCjg;~4`V}wJGEaxY6Lv|>ZqoFd#!SmrsS+Dauv>y3Vs3+;$CX9PRxC*? z3@k~@FSw&;^Dhe!_U*O3sDp-{7@s}0^JZKXumzLh{NzL@%I8gI1 zS?v)uyju0H7ChqS552i)`NFBw{Nt9)FI`!1 zBdp$?>evVM{Q7Co2uFz(QHBn?P!w!pCvOiH7o%V&)(b>|MmWkvjDk&AFAxP9+LhgH z);^5*o9i)dP%uA#Ss-mC$|X(YbljM+s+?5Lp@&A?S&=#HtSa+NWvf{kc{3^Nxuvqr zq|97(R+jmsvfZT2{B%~Pk1EF)4Rt`8ahk{B4-i}9h@N%qTU{ks?gA3Kv$;NY}ROt#i`9>|6ROv>7s1xeTaBrx9(Jm zu^j=~dQxFU-KiAuTPnt}Ixp%^WghxM)XCEx%ydn9*aj zv6xKGvtINz;h$EJUvN#@{CV?5=(w@tt`REi@(XNsi&YC0EXx=?Txei2Iw2`kxLbse z7#t1eRTq zCZc3$SyTLDcum4oy;QByDv&0IgXM*X2TNU@GFvF&JUIBX}V6o|03{Ens|op29*!CC*$QHbz!z8GJ0AcGqS6&V#x(%=G9h zD~RK_{4T^O{O)6ztb}Y~&n?Da@R{}HWM8S(^}C9`+E3*LnGGFFr;%;iH^9VyrN;4V z${8G%PPh#{-`!{KwiwvOelX z_Tt&6_7K8-UCsLxb8#MY%e&E-+hp$uf}(tgeD^){3KB9nWu$-Ttn zUTSg|o7^QPcd5y3u5WXFt<-)d%bOA7aBxpuiVp|BqbcmFMD^#a`10!v0`PZ-n-r@E?a|$SZNJQq&NoiGPPT77e1dkT)E_VS zrfB_TdB7>k>q}|RDJ5fr@|*n`{qM2LGCtek(WJ_=6rkh`83PI ziyp#ziCSklUSjGdN-VRWS(qt^;>kf-cj1xw6Fk6S9)K`UMrWR*GOUw5GGA;%{Jw)c zoM%TI=8==I7^dP1dyvPgp(nl_kjj@bE--bIB@Xk*0RuK2wN@;kW*Nx;9r+z8(^hG* z924b@m=wh17d8V&N;h zB3CE-S;-J#KXBN7VCquTw_|3WM9g`lh;jgCxZsig46_X4{|+1O$NjvE4Varq5pjXT zHUNihI2RAftsb1BJ+P1BE}sArrGIaU$xpGclY*#xZI5Id2_V8Y;IM7LVcXJl z9mV5EL+z4B`RE~dfWth%7vf3e1WSl0XJEz^Jkp{YUjk_8ezu(nS&z{m~od%OpbdcW;}`| zM?VXGHg<@xEmg;Yf2xjoSz4y)_{TUU_SLaS3z!@)N`LD9Nn-Me@78h7o-XkxzDv7TGE|YjT@H&aJfvY7B0M|-Pn;(>zHaAMV z06M!QUJCq_#6JUWk@z0qHi>J2Uy-;8__)N+0iTrkCEyPwejE6V#2*8nmH12GZzaaC zs>XeXSypb~IEjA*oG5Vyut(xCz^M{X0Ul()pcFjeejc3jprh)v7?|yrX|b>FE%6#) zkHi~*Qzd5Ko-T1c@DPa`fhpt(_sPJm@Kcnt7!5>Ekck@!~NHi;Jj zACveF;5Q|%0H)A}@VyDR4*sexh!dp_?=`9}9tHMDe_{%G!u>z+MD)XoCkI&Z%m7wA zw*Y%&-1)$%5*GohI$Z`lMEb7<9wqTzz^YE~0nU>Cb-;PvXoph>zjCT;g|dR%Q4;aGCV~GtTQI{%@Q^2LFu` z<2`=(8gT&EO8=g~4@x`$xL)ERz>N~~dygk1o(#N8;#+{9l9=DiJ}2>F;1-Fwp23R} zR{^(4%;tCIhVXAp z;2H3DN&iK_i4yZ2S#ODhz#fS=0jEm*0C2j*4+9U8csKAUiC+XBD{&iemc%E3vnBp3 z@Jxx%0?(27B74U*H~?5(gI593=V+i9ZKkB(cK*AaVHj5%Rth z_dAvMXMk1P_%*P~?_pq%jQb|A%I^ojDvy5wR&C=OV3kJ;ZX{!6+*n|hM>nv_mls&& z>q=miuVKIx)>rs<5HNp0DVw_iE1UTqLD}2~*dybn0xO$`0xO$u09H0n09H2V0xO&6 z0xO$u16DS#1Xebe0V|s~0O!kex#qqq|82m<(tjr~h4~8qE(1OSf0eI~fs>?;1D+m< zgUSXxno4k%>RHnf@(xc zc_Gfl#JKqvD56fPs{HYl0zOqZU#Z}l;2f+AkayNHl)ef;QJrV?l&dCRh5OZ28N-Jo z9euHwu-C9IUe|W@8r;AYrNgsbI^M){yIGIVg-Vp(Z=px*lL23O z^=HF1aMK=!G2V6)pAUXKlqf##H)`ZdO77r8P?+yl6JHs^BH1_7#5c;ohgZL0z9A;Q zjR^DMP@?R++QgS<;A3&C{N98DHkRKj2#aLjMCcjwyUxJJM|8#KHSrxs7=J4$QTFvV z@iiLwIIgAm3W1IG@%=_5`vNkK4`<3N20jdLhWYp^*U0CA<4Q)5qU_6no7gA)&lvbP z2BhqJ3zcK!7DqN8}iHYp&s+~CtGK}C&0(|uu2r)N$3&#WI&mLk3)=#ui3=+3i#MJ zDN%e+n)o(?kH1M-eoSBS{ldieCivtqrl3@Ol_tJN4SZe$AKzVpBHT~LStHl)WE0)~|W5xkZRK0{%*kX@m+7?dkTC$ge##Qh3`~}eRM$TL54rU$DwtG(T;c%-&f#^)c#y1z868J z+TYa%zSF=^4Y!wX!58WJ{iBTI!N`^Ttu^&moE)n1%i%ti z-`OU<;o$QjTnY6kGfaFb20jkyDZW$_->P%i*Vn|CW#Hq`p5ptv>HfA3e0Hf9|e5yUOy(+%@QU1pIc{0K`5zAkqCh+KV4;_E%249A%&1+SxvKtbE6=MDdM+p3%O^;2Q-cwwGx*6rbC~ z$GM1{XQ@Q-#hds-;LCy%`DWlye7k@d9W+8#IrT8<6neyUIE;F0pf^`3;jGfVPhy`8 zJBD;wPfT|v4wY^N$c%jNgO7G8QG8bcP!HJ=G6e0G&%8>M-ar6ipA2{(>GIi$>E42a zVYK58^mj(Sb$G7LhQAWUR{}jF-!429EP@jGZpESaehX~mwSej z)<`~viRl*N zQ0ekF5TmPha36joJO#HB#n&Ak#6B7D1UhFAB9d<*4#j6Rm2(yr7%h`=cv5`dne2N7 z4>zh@Zj*Y<{(iJeqkV1QL)5UStaF}|QSVjg!IZEly)0SID!*@>L+=9<-#h2f`;AHO z59iRk-=z1abLa(4dVe{G9`|52=JzY;tqSM1qntVZZ>+aAG%(gL>unhhRd1Y!X5?Fh zA9oug@J)lBk#7wiB9BYH6$ZZlgp!f(Ecmh_@YO-j$TxjR$Mv?-z?TY4J~TTazTWy6 zrgVxhhBx6K&q^MJo>5d-5*m?l?ZyX@F2h(Z6s313@~hek{mGY&xC|eKgSN-vC=TS~ z{pRiA^&2m=cH_`%hIw?k@Y;>a7?=q8|Lb1J;S$pL3U+y59?q*5^ZY|)I26%^g{2wD z*rrsS@ytVA|9ZKFqlr4B3%5q0r`i)LhO*Mt@2T<;(5Wx2as)onqC*1y*3Xwi9o^&z)_X;n_CfYhl+A*jC+QwxfS7JJ<{a2KJRk|yNWt4t&QK36gBnGr4^bs z^-$6j+mMg0Gb|YjBip;L%PP8?=loayThqw*& zpPQ`}tF%3>91q+%> zLf-U+Ew0lbTHikoX}CTW8qFoO@$TEY<*rY{ysa%s%U#i#y*2lvwzbw!YidbtPG!&4 zSlq7Rr5?H&ng%lt<#sV+YvSOS`VP9p<;?t3`)R-XKb@|H3sS8P?BREZwW6OkC~5s> ztD`>_uN^dVz1y0ZuC=u`w0clh2b`IGHCIxbH!Z5_=UDo$u+GtIrpsQjxjikm&zX>A z{WDg_bsEcLk;)OXCmk`d9gf`DF4qc2s@72j$ZMZ7{d0$}wH6j;A7_HSHz3JZofR(4 zH6yc+Cj17)I?&prIcwPjx}VNK@mARNaIyXFTI;LUv-HKD(W8-sBNqSMldSvJ$A(}v z%6`jrmsM|Qao2r{ZH*5fbZJ{2jOo?%?8q+JeDpj-Fa-yx2`Ft zb{;`kr6ss?d!^Tvd#imy{KO#I)}FRw_5X}J;C$xcOZK!qPuTsLr7?Tj9tLdo{%u(Q zstqkqrytuNr}gq_p>4k1{(Vn=8LO4u;|WgECe7$I_U5{0QseanER{Lt^RRMk8rd7k z!>EQT$WTf+T>xz3X+7cijJ1O7t+yU~As!k`S`>=R zate~>9_h%k{X1?V&n%mGA|;Lf-hIl_XvG4@%?UcATJO^JGTfrKF%^@!AIBP_MLC~E zP4y~> zuiot68tN5V|E!}jDtYJcu)JryyBD_j*6VdjjC)Az!cFMbrZ5F8g6TM3a=Kh@O71Qd z>onUdlC{+(Grc>a7Wz**v{z#gcU8^~=K<`G4kNHDwL@#VId#(ni+i+nveWg*VteuE z`M9AtUbTm);Y)5AxM|{DgR``Wg}r9xTEAbFvBN33pym`xxX?gzm&=-ry_Fk7Ib~HX zwegkRYD>zFw4l5WaA#?p8!b5ZIpbv~(WP-k@L(DG7h99{;v71{#v38_* z3fBx$Y>wAMzhp#chgcTq+NLrXslbJ$SJCr{ehK}sx1lXAlyR`_43uHnq2IS-iLUu+ zTn%lcXUL#&H;$P)D|`C5u~=o_^b0g;ZD%r zk>R?Vzv?^0rs2nqL2Tj+iw+MP-t>%=_FQZse{x44kWDl5@yWSEY~m|ZqdT#~0c3-{ zMzM)E#T`C2F>}`F_H;OaY+dY0(R#s7%0)O5ps_%@=|}4>GdzgX-NWSOIG+-RFEF`5 z85V|rBKi5AD*;dbH=5GpJboqAf7BHJW0RZvbt$1f_li(L_kSw~&UEuVoD#YZnB0$; z;@eI3+-=f-!{p|;niBGFHn~5SZoDQ${x8$6GsQO~C+w}49v++%w9Cb}5JvtrCVs2Q zJ;OjqdpN$LgzgNJyQj$>HfM`$c6{Gtk-v)=*CLxIPnIP7gYb0%{i)`WnB#on{e--H z&{+tb(Krv0I0xt95--G=?+(cGGn{?Ic<)BZ!omIYDA_nHcyB_Pj>B@Xfcl(nHfYEk z92UGQq%doVGQZ3cG4q!!G0nSHV&-*+#LU{$5;NcXB!+p~A0+nS%(h0(u{b+X?!>fr zfW)+y-;U6q<+N7f6yOaKrvkIisWTav?`w!X!2C{!I31Yd{lqLwJI=)9NsyR4(|3UiVAhrt^bmTYFbX$7pp3%fV(lP7I;=w;i91e?DK>gc- zWF7NegIebxUSjgm4*HXiH2Jcs$Ge^uz(?K7Ky;*zFLXNhlQJk4*59mf%??py_1;bK(VCj zXJKcCj)k3a&_a|y-Um~J%|mo7Y#yp(VY9TKeT4eP*F!AZ42EXH>rXH)*P>vWygZ1R zCaH;;=4gqT<|2t1PvjRmO!I!}PyDgOO#ds1JvfIyQ|XwxSzNGKe05TEhiSg1F@O_h zjq^PjhIz6$#44>3Vs;G`lWrLit3RG6V%N}cL~veno|v73)rU4}dM*v(lGWkeD4CG( zxJo3T^k`uxJxsgp3KApGBgd*1PF2(Z9c>9Y#V}TjjS7IsRg1Pfn6c%E6?9Ov! zFQC@NP%Nv9FK;fyWYkhA(Aa|I+?=yu@%+WbG+FFxxdh7zUp4;58EMGM{M*BY1@%JY zdD%kks!lWd6kJF z*4Me_xU

        VdhEZ;b28Bt(=R+D?2B`e3lk;m@g{3lMmM7E*LgMeo_=JAL)zhfeWy! zWaN}^^ zC9|GV)0_;_z1_Q`;axFOOW@=;&$u?&oS+!Jyg{FG3SqT=|3 z3$}re_YU&${-pSh0UP)Fe4NJ<$-bE;J|AwT%0Av#m3_R|8u>89|D&?+&<$ebPS(&p9f;{OzRp z{%q~cmxRX2`ck6!K7gK)FAsbvP-6WuKZ@_Di7y3w^08J>D!!LYeCrH+d@NLaTaZ~} zekX&E&oxREUk#LqeKMfYkYDO6zGWu9h2Zlr0V#@aiHYwF`0}8`{Hkk_<&=R4j1C$h zA^hG+k(ejNHwb{(M^8vL8p$G@$>+hrF!J>RF!DVCKE8`mLOqHbfY?U|!I!kK)@ zI2cAgez(u)gK3OX>RzXig&nVQRjDenUteE{h zh4xXDUU%3B)vz>!uh^!C^EUD-OIu-wPBP_#Rwg@$7ckT0r9Y-7Vf zq1w`MMtjgaNaK*6Ry+Dx&4)v?c58QP4&hq@rypyH&>Crzr5JVOgPUU2oLDo%(cVK| z23)+B+(?Icz!;p%>7J({14-Jd=wO4kzQ<)Xk7`?bbVng=>0!m-#x`6+R&85*J4&G8 z5gT@^JN*4OBNDgAhpeG!?EK}5c8z>|#IT2=54p6$o2?aBX#Fqce^)OQM$O~x*KW5S zxWvnL$)Uk!f@c*4XAAOAaktQC%5f#N(giuJs{N18}`fWY30Ysphz z=c$>l)p{$3AZ$ysWzFAfrdt~09RoF2Y{=@eEw+hDb@jw(IJRrU<4nR{%l3Fs?BKZJ zwOcK&9_e>^`X^Z{Fg_gf`28GO-E&6n#`uwatZWn@Jik5w_PIY_HfaG{%j9RM}cZyF^=Kn^f0>#`f5% zw^yLBuuWd4`Xj&Yt=j0Y4-#Bav+V9uY=yO2ZFJ$ROT4_6f;}|Uadn6p@p43K9z2kz z&2igMDs?x`@{0EN%m}u&RSC1=8=c|tN#?W4vmnWeYH-CKY>j@sHU8A28q3fr>|b+s zK&mzK28=kx@6AZ{I#Q5hG-i+;>QAx^lF2b_oeVaCuOdSWUV4o?+BM6I7JINYesUUu zCF$mxm^N=|tEh1s_FLqLC_+Vo&0e8*$fKeDGhgQD`TEUkkbLkxdu2vr!a+6en-;S< z*)h=DoI!n#!WvmH_Mc=uv|o>X12jNT^^?`+_}1o(T`OC3g3e|%W}plXundgDgs5W| zM~pFBq@y!JHK}?H*PX1<_TOShOY}L$zJ`5axWaAdZ`jwUeh2*!`XYx$4Ym=#)ckEY z#yP<-Z;!>+$!)>o-KxqP+R$J1-Uv%Y7QE=M$5>?8p0;rN7ZVQLAF^^=+uL6k^@vxk z9Zq?jxSPV&Q_)M4JoA#Ym5J;^$_nF9R%N+y{`U6qmqY=tzdt!-%T2PEu$PzjhaT=v z;#b>3PS>R?lP0)gD&n=tr-iM1l1N@Qj?H&VB0IPBiPp?_+Cw(?S*N$Xy(3EqLVYx} z#_txBDn#8h_Grr(e}6PgM!K06+ODf%0Cn)UHTCUtLL!w=bah+YmIo~^SIthXx>j5o zJ-ctyw8wi!Z^LEM)9UbQNOBe0_e#t~N=C<%>DB7Iupm_9Zr1k3BfaMM?LFMLMGdqe zjk3Fh#YvXMPWB^@#p&rDh{0Ljs&W&)YRd?D*WZ_=+o!x6zHG~Y&uiFfvb)mGY~;mz z=!JILl#~qb^*wvLtQF6mgU_A>FI? z&m7k83r4u_v=uJ6 zI#d$kd@XmQ6}@85eweLgvxZVvm5A=pHYanA=#= zoYCez?mr!WHV2e6H{_Ies5bwWq*zxBZa%JVsri2xG_kn$NgWiN1Z+wF{ZhJ{xpfV@qugnPLRC+^!%J@*pxvEj*p|zv`Dns4r zjFPt%*U%=^M3xh^>HcF}oqxopqVfqPt8-=rMtge=_FgvC+q2Z0gbK7Sj)h?d9PX;_ zh4UsZ+!S)~mbRqU-Pp~2rvpu1!(4||C9krr&3bJ_>xA8*ZLo1SY;1*%ujw{oyWY0I z@$%C--&r$bv;*BL`kz}Fd)byqWs)9<$?V1F2R?I%x?2Bi6s&f*wNQC(7M~j$OAw@& zce8(cx%(4a^QKU&Y#NO@Y#L5B4QFExn#QVL+h5x*+P^4wPJuZa5b5OJqJ=KSzTdHI ze5wq2y;$8dt)YeZSNmFHD=ONHipxO7b-jQ@<%xe?;;;Ij#~05es7Le@JFFowc{9uE zPP8`L+%H>dH@NF8ZL$5=I1A^vL(zpviLx1W6W4~9&m7MteIm}hmf0S3F68H|7HY;n z+3|#*=Y{36jqtf1ZayQ4ho_`IXNs2Gf&CWqJ=v3ttx4j4!?cdm_|2*$(wq(z#&g#> z8T@h5Azk;e;M6R+CA_~WTn@5@_2uAB z*sXq9>mD|3m?{29llumfd$h?t&g9NAxjR>~O^o1msMxfr9S$HHz5@FK*Osu>=_ZWkY+RyTN2%2=4H|M{kC!IYY{==F}*6DS;H~a}8t)_lrot+o&zlt=r?#EGB-Arz>InD3g7U zsz96>UTP}e4W{tVP3|gFc?~ti|C6cwdz->%n)nWy+%^+GzcE)rd%dRo@mnv7ULL91 zCfT0oNBzSlK7J!jnT#U=Ga?2Fmp+c1fENh?Q+iwnmGU8u1dI^eA>;F%XTtx(+}prM zRh{|ccV_ZN7%+)3MnpRU5d#8E05K@G6F`gz7ATEir7*ln5F`W;aIq#+3KMF(kXlJn z?Ix*}h-C$;HMp`R)MBJ+#o85Z-4(an+84XxTD4To|NA}nc_wFWCg8sOKK(zRxpSX$ z&U3!!IWPC#bI*CsxtRTbS@KtA+!LKap7hR<_F4p-JSXC85w|Np*_oE)p6a|H`71Yg z*EyR6Z-{YEcTPzDcxTFUW;*jd<@*(n8)6B&7fy%Mrb0>WWXv3~q{~yjU@%Scbn;N! z3085w=rurih8GLZa9$ri0)Qeod_&2(JO1phPPZwCLG@C(8JM)*14PYJ&Se7Eq+!BcOoUzWSt ziiF6^V~qN#tp&?b?XQ?m9}5%2GE$oj=8bz~l31o{+e3V{?J;c<*I*X>*mUU6vgPwY zWyT6mna>GNeZL?)%V(wVO#eRNDbprA({C5P5a&+esmsrW58?c8!ZWYG6P|f}U-$^l z*(^8c$^3EuXYwKNmk7_emkZBgxk~sF@Y956nQ{LPjk`>E#;q2f>E0ncbtb7jTRQlB z7Ko6q)Me=9lWv8nQx+bG`S&qV5V5o#sh{pQ&tSDVVVUaw@fGCh0a}Pdzt^#xymV1m z{=Td52dc*5V?}`0;qYB;Sa%O#d4O-G|7TtQTJjN>-$I@@4-lUL`MjBd%>4v>8u-g_ z(4ToF9Qh#5Q-o)}XITE97oKHc?m3WW8StLZxNHN|hkOXad@HgZ93*o8r8^YJ({0HHw^Phy@g0sWAh7K%hV|N6ebuwD~CxRa*d<6WJ z!ZY7D3cnEiD&d!a=bRNWsZX8othajMS#K@Ev#$7jr2Izkj|?Jd6tdwXGD^b8*DSX zbTPIB#y-u}>lfJ}jN_Vir3i30UzUJsNG{!2&D}-`Kxfsegj02}Qc9hS*Vj!$5hVd6 ziH~BNbQG8yIwutM23o1Q+QJ?RTNYQ>z&w!VXNiJfc5$r5se0{NDPVVx>mK7mO%kYX z4OjxbjI@$uG-i*o$e0y7*%aif`TewF}m*ULdKN z)>gBW?Ux10t!%3ntzWlvtqI^R(jM>B3R93tSn>O?WW3c_m!_2U>MvJZvqE5JSn5PAy$FwHGE6WYT7_9TDoN2%C)$%nR!|#CcLChl0A*wlI6*sluU}cbnz1P z@|c+3x?pkiwgpSD8F}h_pe^@(t71ELuSL6wvO*SBt)mU6=7wcX?;2P+u3nY!rk*(T z!Znx0ZD=3dA>9=5C)pw$O>4>0MeDKkcZ!N~LsSi>$L5CJ5teWpb=#ln!Q|5HA)eB% z6oHgkYnznzvNi2hx{P9NAMI^t9`n;a8*WOu#GblqH&m@#ynHmacUZa9t_e>p%`S4{ z2}xb~)cp*5P@~{I65ia&jTYB9jghHc-)*T+Sudz*C7%eg4@ocJnXGkhO}4>h17e<~ z0hyL+tbxvC$g0JT@{(sOcmL--tMAhA3MvL~7Uo95`)Ch>H%p6GS8tN1<(X1RC1#*f z1?bh49M)Sg_aU7~Hl=FP74V2^3W|vWGl}(<{vTQWI?h|@90sI6$J6ie61ZH(2kAz) z)6f^ekjD^;A@(C}(!Sy!{JrJaA68Pi14!4#i$FlbD62g8#U&r1Cuj%y!0cDf#X)}_ zbno)uO@Ut+hZ5yT4IaGvEIj5-@yg(^^;<4s#2_i&Sjdr&&=b^d;ju5Qc;|ZXRw7Kg z)r^+F8|cA%)WXASUjok$U|YW}2xEFmOqcWrRIV*|H~fa15cf~zegir35eYktbg3W9 znXicqV>v(LsoxIq$H|c5Jq0-%?}U{Pyv`-?zURSv3SpyMs3g1=58khVR|E;_$JaNe zMg8stW9Ro>_;H>?iE^a7Jmr#uNY!qT`B%9+Jmr#wcP+kSGF`l0CDN_*;MD?;^C3!# z$2EH7BN9*synT=*9$&v0#(cbsmn}OVI}i_|2~xb@g0bbep0_X|<>Jv3t4!&&l)aIL$ni*3(u44_lyVc0pOiL zIQ1JMa@6lJkA6h}=6tA<;_dU`ZN~dI$A*YkgoAR#E5SY6uHTUo4?%_$?=r}dkGS5> z6b$}o`3-}g;-!1=N`RND{2UM7Obf5r!W-nhKLd~B9ZIU-d7k!iGw=!_#QcuHq57Rd zdD;1$1H9=9CUSKC5ps5Z*8xwj-;pB6{13%p_mw-11{;ZF2I23P{r+%M8yGT{P%RTj5jGKzq?|2Just4~S;N6aJC8kR%_uxf< zr}bNgaMka5Fn0M($HP=Hh@<>7V8}=4391I3ULRM&%`m!u0LI3f2|T8!L^;wwf*~KF z1GL$~>yhR?lmmrs_T;_Z7QG$MFA<&raWE`4qxd$(Z!b+8H zu}3Z+a;efC>Pff4N_VQ2?$dZa+T}MLc=#nq^ZT$zZZ3q%6H;zI=zI`zj1!>)v=HeQ z;mrJAhePvQ?RoCs2fS4Io#&Bz0CGcsqon%Hft;Q07AwEgA*|{C%yU2O0-jIA*}k%!}ZVl;604=I`HiG3Wo7mDCwe_ z4gC>vsqRBx^rZVJ($)LM=MhuW-31`xGK};g@Rqo&`PX!(NPTF~LYZ4pH|0nNA!o0< z`8CpoDyIAxu5y3IeNFQ~f8v!$8n{G_e#{qM2=M~kvrXgK*4>O5Q&tu-boO;O{5B1V z_jy_>oUhvb*tLr^HhztHO|Xk?>!h*l>*?4laU+(5Bs}30&xIje1&nOHo>w%UA3OSS zaKf%KA9k6dO@6}c+%l*`%E{@}8N=P!v5&EVBI2eU@=wL5#dF)u9%KPyCx7W6|BzRI z>>BPeemP#t4jfy4OFe3GSs;MEpqy6_CY zNqD`dXk5B|xNne5Tq!E1lP~vUhUvVikx>x(%Qb9p7zko|YR7}Fkl{@f9iicrNcCzA zXDx6S_E+5&t}LN|i}HeKq>b6EPauofqhHWH?#O&dsXzD|?ThrySark=&#m5ZrIAVoGAc z%GJ>&iCb^4fljuQPeLE!!mzJieyb;F-SqXkiGU$5mxSDpds5IQyD^0v9#;ucIod0b zk4Q)((q!KYuc}5LhB4k84_*X*yeB9r-se1c`+!#jA>#27qIlm2579(ETEM63+w6uv z<3w@5%44B@8D+ipTZ7HeMR* z4HC>R`y`6@8}PP%Z^E7Go$aK=iQr7ivG8~cQatt(ZM-x%QkCBni4(z@#J!_5zxLQ$ z5yEV|ARN3mDluKsr*M#u;2@2&@a(a-sfbU!5+em01UQxm&lAIVaL+BCmAHo7CUrgm z#_lWe`XI5KNh-(vx$sL+BLi^o#A}AS^ErcSdP7aLI?-7=TVJWPbNM39df6h6QV4=7p~-ose6cHzu4nJDfWy zoKuHB7kB%7C~ddER+U%D5~uX%0w;3c49m{IE?Vu668*la+RyyeH|cB*c>@3~-8 z=_al#!Rm$u7x3h8InGFRubo6h@ zqi-<(*Eq(cVl>UVd^r9)WZ#!RNj$m5e-cq6qtB>M8bMxZKdJcNWZT^h?BocY{e3Up z`HXZ7`E2)_9+$>ue=gH$mP~WpfJ?A#>b<@zJFy2U#}m1yuT9*8*Cy_{nDnZJt+j7P>%x~*QdQF`K3u^?>&f%Jo3YwpGf_LjQlW9c(L;fsUP-5{fQk| zT(JOVYxylB;nK^CZEamIw-|g|Zp~M@ntT_iT3d?VOk=*hva~<*@NcsvY<4<((y#_-rK1a8E zC}2jpZFj`ESIXCwkMsnB3t)G~uS)s3;gdY!lbwepoP9*U8GY^%3Bcn0j}q>-rzt&w z-~zCc=9n$Xy}qt-9r7P=rh44hICh_f#3od$?TT$ zU;xW>hSZO`rFqh6!aF?j)h5LKV|+UWx-a*Hb52Q#;e5|jqWeZqc%jGrSC4+LdEBg5 zCE|Tk9XQi{i3jhHC;T&>@L`hQ63FFZH=`p`{;vCrPFhmlhh*d{X^=-kZo1 zhj%3M`fi#Omz@X@-)p(%fW$j8dCK!1q-zntChIRvlkHCJ{W%}2_WnbKPo&F%d=Rs$ z_VRT5=J4Ou)%OLLXB@SE=R9|k{kt?k=FNAbE6+gJj<0; zm@khWGtLM;AwL&^AS1&}fOxOsx5BBHsTc4G`FWI({b+}|JpX+h2nCt^4tII}C*}8x zuD{9eNS8PH1)spb+4VR2+xh*p>u>T4J|T}hUWy>2KPwQ#Y~){USa&TEc*+lq|RBrQ``QyD7P z0{BF}zU2Cwe93K@VXR-0(K+Dq)Wb(XkgY$j5glLV7>rNGk=Yb{%p53$!$(0-5f0r0 zzL>n+d`6PL2!9~efoG!w2WUV>2VRIEqXWS}Mh8|9D1;+vt>Gy8y6aGVB`$B$8td|! z7R#wuT5=-}A?$yG$;-bNCOd_o|7-o(#!Xu6M1o9NUFGtoeAtLUrjE*8K7^C5ZDLXS zu66y3$xn0nw2XeibMnqByzt`CkV}d$8(lhXeA$%~KRfA~it7{O=rob7zIE~1QeEg` z4@oBm@XcbDq&S|S-YYy@P+k9^s6EN`THl}|9LdI@el?8wVfSopyUe)uLIrC^fkAjL z)Ri}89YE43f1d(o(tx32(9A(N&rC$>P!rKL)bBfLU*U;VrF_iTUy5W?1Sg_0zfy=2 zU8giOv&o@73kDdTBFv7SB3Lqvsw+ogd7f8tU;|bTo>RTdd zO^$n0Nr7>u_@31|askLf9V?r-LD`;~aFQqWP4aMCn0RTfDdpZ_+4N*lkDD$RJji+; zcX^AJfE8fFSl*sHYOfHxO07UITB_~fEofIwSp<}H4fYO66kaNEW=z)-t-Kwd2UxPC z2E~zhPPrxLE?8tSVL@9>&lc-$sF_3V9muQ1!s&S;B?a`k89X&hl3Z*qkDghcUh}e} zrO9D~_0rL$?(_ST{MVuLBi%eBJ~q#BTG$~H^2vE7&gAv=ah&+;iG3;3{Wc|)yBI>`BNFf^(q%u3`Cy-nVa!LC2X7txq+15gmE$?!!J};%yRO8;Yi9zl z9}3CV?@@#?9VOL|^S8EswDD5?D6jgxjd2?r?=Zq5IFuBRYhY|VzRwmxi2AYnuXy~{ zmyJh9D*d>Qz{V>Bp6bW)R=oES-^Sy7u5_m%<;wB=4*YGrnU;QN+6g?`_1Jh*;7Fz4 zw>)_3EdAKGR{g&0!J7%UbjPWdk>h!j2k&l6KaN)@9>1*w(Zuz3x5Og`iE^Z!p7PrV zJm!P-!E#i*4IaE5z>`-rNcG^=c<`RI@OYgl-u+-~{T_gW?OjRrYXn0+A^}}i`SCrG zVbu34U~Iha!y&JPCMM-bUj{=yLI>z|3-4mM8AiOfJlDswedzb5=lb}-!V6h=FM04@ z0v^XPlvKZ;dGK;@QD}P}0%6tf$&BRu{;?1J9*3Nr-(m}|$imz0!Fv~YAyrP~=xp=g zMJ&8wBFFOkndd&qaW{^wDQSLh^vH!E7giyhRqjjB2fsvno&q_hqoi{4AVfYQ0dt`r z<(A>#*c-#>F8AQg1YQXKN{TnpgSP~DMGzw1NF0h6@zifM@DziX%JZ9hxFic<|N%Plk_7JjDxn@b0njc;8n%evb`VNt9oEANt)O{t=T3p5+!E(^tGP9=z|v zovJ;L^5A{n!ebvm@h$;l>&G>6sqP0M$T3a?2dM*idVP$CTk-mN@SX);s`~-gX4!Zz zSa@X?-X>3d&`v6qe(OB-@ur1$rG@t;58k`LOI3dJJb3K9XnrSJcwfhLX_sG6;z7g^ z^GJ$A&dzTk@bvm%e}Z9j-|oSq-Bl|6)_CxWEWC(?cbDfnFYW{HdmcGnSE>3@R zoi3jf3{z76phxZm-V=f>~tBx{)m#|y#Ws!Zw~N^ z;I|CNbO|HgGdOHK?(??|eoBh>6g!(1{@3{-XbtI9{1%;RUh21kZ~e7 zNQbR*o(VU@h&Kg{jrRcDA^0m%j`UeDp}oT6Qp9Yu-}1dP>>NtlVA^;uB_LT6u7Q-NnCiTwi3x|}Q8 zjc>)C<+4qBu>ZkU?si_kX7dO2(O743{jBnx#^cgZy?ThBt8PhM+1A)UJO?s39pWYZ)*szIuKqNOuMeL@^+`- zS|?01#aGrmvvYXeg#9p1Y^{&hnWZ^bXBQ0hb(}lok$c)(6#deq==`?M>LaawARgkE zFWT$k*%SNi!dEY@aze54hVLH67eVTGhQ3lh_!)BL@j;CvwqN(P5wX^F+v{Ro&h=fv z8Fj`MmC-A+{c(RRx}YKarRI3OKh|2iz3zznr3k;lFL<>dlG;9^;GKSzWBy#zSMI(aF{QgY5th7})7cRRj-oL4`U-vuVFTD|75DPE7KfURA@PdZug|X6f zTOaFoTTi0RB{inL9pmfL7e#X?Mb906G8R5ie>@i6U%x*V-WQAJ#9Hogzwgn1QA=$( zmdkZMm+^WU+uDRvSBx*19+(}?yK(Hm4P*Py4xd}Op8Ncp&k4lBxs}CE<+a@?Q|$U* z-^!{pH8QfWEtzrN*LP^Z z-mI7J^X(llVgHVA=e+za-`5AUu%*p%oTj>E7hDu;g@R+coQnO`MT_?aU@Pi>J>3aS zIXq%)<)a@53+p=@ch=VDRP2vMbBBasYkh7(hcDKOlxw=2(2~VmvpyQkibc;w z-s@-4S&qM0G%wbMSV(qnW;_aLB%OXFd~Tedfv9|SkO^(;a^mH5pDt9lDW(HmP8X_# zAJM9uc7D9B1ZA+Mpxu`cqC&RN>3mc{k^r)73;fx3ybk1o%c_{O_^!QGQ&75-B6bvxGp3%^n-@J3t zGfu%%1Ft)^DywW~!BoE~Dii=}Bb;BmWHFN2n~Bm7xTTMhuAK65{NzpX`jhefSfjYT zp{<{D;hwhZ9DG`3M{`d9`0l3PmUZIu8Te{ML69O#cz!!&$u zrM!Q(%EfU@qo67YZuwSAq@cz*Bag- zc-O*@YZG7enPBtBXZMjFr+Joh%u$Kqwd%l`?r{>n5q(asRs4=8{FffL-9Kmi(N_NG zzSSeY+mn8_NB(V3_%}Un%W3pI;K6^}H1)>ybFFnU6Xo89n74;&X7*pY`??;hFSd;i>OQ;i>PRgy*>Hhr(0eG?W{0 zsP6^BQ{Pd-vp>i6Pn4m)3x$t>H~UV*pJN%fi9hqf{cibZ&+;Q_ zIWs>#8nu9!AGIH1e4h+rn7ZJAImpz-`7Y1A`RD-(;m|$pO&!U=0rRYTM4LKdBoOng z7@*jcuCX8kWO-ojI}wYySL#PTZ+fNNHyYRa`*qzGwEDsAik}gw%@mkEWiW zdtjWoAAU->gbeZiNFJ}dhIqfS373kYHHhn#(=ZAszY=ofBlHBlfQy~iIB&<)hhcPk z$K-i$A3A`QfqkepBseZ%3+j!5y z&Ax_`;uXQe#@mQz+^^wBJU;Fi#{BZT6gD2`jP0_f9BCMYY`mNCoK*d2U#oZ-9=swH zF8eALx#>i_VT(s3*GuC#ZyVSF5xUy8$sOL?rb(6i7o#V5<4>vvvo$4Y9C_l%jqJBgY_#(17V&V;|{;*5{_ z4}@!>N##-JrgB-DzUu~~@vCD~?&t+yf1=E}%uO7eX?OFIfV`D@3GuxVS z4un73ispNt`<_*BrNgft#=;X~(c*^i747?XH_d4Xmo*p1TAq@@l~_xQ`<^}naSm~1 zZRK`)G5vxz9T7sTOAF`sNT(TTU_$gJC-%s9 zwlzO*WG1N0k#&7Ic#1wMgM8;*p!Lnj+yk7$(vFpFPJhp#PN^H-~TDr z0)O*ry4l63eBwXb!k=>aJF`cnceHlxEO`3e`1!TpDsOAq*wU2K5G@a5JJImCVb}S$ zKHFXU&GNy=;N2F!eAgiV)UIv}e^vgS(^$9bN&nHOx|dy;Klm>gsA{iE41B@=pSz*F zo5+#yp93}GrSd>hw%y_0&n-|@^e zEeKk@;hPt&npKsH!A@vEDK2q7QTk@NEG2h6P0G;2UD9gy2Rh!^*@VT>800GLb8J*D zO!uNsx=LNg_*UPh)~Z?a%I`!|zPvuVC_Jt`6FMNd`Pn$v@5i4Rz)6D_GQ%bJ^LAE5 zug)l#oCke^74>1t)eXnTIXlX`X1(sm3)ZOY*_|beI;$&VIR`pN?#=89o7mzx<{U5_ znu*sLZwkIMU_vP_7reO#kc4=5SW zr6Wxfr?R1+_z5y_DraXUgU-&JyR+aY7)vZ^K>YLrShR%`On|cqQ{93gC`JaOR zqdshJ0-fMBJ+mD7OGjHZ!xlVAWu~Z?vw4jVa|0=qI}6Q}KmXS7FN(5~F|qRQ?p1zl z1<-2lgK5tEKv`fyYpio*{Z6!+)_PxjR##Sh&6`>Ax(~8~Hz9UM`H3jJ9Gp zQVbl@oi-|?;2i>eoekmY^kFwf@SNs(O1wPQ6~b`ztn1_W>}WLBRa_s9uYqGtybk|$ z*N=^tQlj+24O@TN9X!9_Ux5^=x8k@!Q>~b4c*VvEqq@ttb|3&!B^3Q+%#?Q^3 z;>DxeIa2~j+Vpmyi{|LTcR?9OFnt&Hb9fZtV1I$c3)%E3*m2MUEZ-^hxIlt%a@N8` zn&-38{|mX#mrtKV+`i7#X>HW`WD1@w0}>uw*mcgmpBlL4zaDz5=#hna8J~XriU;ke zzhCK_@${(GcRzRWDuFybKIq=*@4Q{jK0c}P^oreIsOWe9vsb+Q_P9%4|FP@) z-}wIRX?Z84g$HK+>BQ-*b{X#T>8PE%9s7IQ>c1B$Sr{Eh&OP(vG?ex2;d; zKHqso@D3x64?FRU!$nX5p4W#D);@niIQ#PIE2_zNkTpx$feFG_@w;aYl|0?>Dlc+hr=VmY6hN%ti;|d$Nup5<|xydC%7Mj;4J|^E2a>GX5B%j5NDq^3vo+ zl4pXTaX5S-{DI1F_`-%Y%agY`~-mdD=<&+_<=@H4?b zAUw;4gpSAShuc6xV))r27*`?zRL`2#wR#dOEPT+JjDn>f0pMp!V}{r;fb+G zc!{1EABX9Q`Q9f^hJ2&kv(as|%M;fp217=-64&48#z_Q_X@_B#H|=nY%kxgn_3PvmdQ(qP_dFsncj(iAbRuy^5enEKZyHt4Uvq5<3^CRJ@ z`_sZx-<*Nj|BGpW%Q3)z>yl+-7A#*CU3`|=fWBnSGAnyPn1V~!j`;*|$xh0F_cTWQ_a&Y??y8)PubJzv^L@0GtO>(>k9}n zm$7u!;#EE00830F;Gy_jaC|HPvAmCRElgPo!o8Bs^DFxziA$O5Y#6O2p`zVaQ z{917}2SjUH#`S<6`Sh6~!0>(mnevyVD;;<=4qfC@L}GRg?w`Uq;o>|ATHx% zNIc$8Ew}{#_wb~DMC7*MA;5e7P#n~UVRWwtW8;;dp19%niBObDz z(2wgcY`k~jRt$(G_&MSqp(hCsajjpz*)k5@<2-mDzip6 z5CB37CUSH(dGHE>HwXShaj-k2`qg>xA_%Bu0SKvnn>~0dfwvGc#AE+Y@qQ29F2BQQ zoNUudiuWJzARm!{XMxuao_OpRDIWVRHXiMx`QD(Uct_x2Aw@lShatDngt&i9mq&NN#Z|memOBoiqKbFiBbS4V z=dcRlta6uwAzvb4FFnDB61oujvZ5rC`019Eqm^AFz%C3#ncDGRqh#hY98oM zJldBqoUgjfE2gbD zV0>-f6?2@Q$Q)yxv&tV#pO-ri`-|pJ98ibX)C^^A9?96(j z)9jR+f${pp#0R2bOdOHuXCnPXBE>hrR2i>DZ@1?{0-=Yp3x3L}roHaGNu~e8co zPsP(3^PASxV^*Wkl?xVb8}#X5c1C}90&ny0Fk`l?`0C9a9X^^UK=lM4A<6& zDl0M!-c;;O&O!oH|+9HJ>E@s zwu2p75yRMiW8SI3rx>E*ri_9YKirDf5;LJ-Jl*+;S}DKUo^N0TGdEqb>AX$pN8Cb! zQT}V`ERq#0v+W};db`a8xOV2-jed{3xUG4Bcynjif@UAeE^S$1K|CEv4x8(*Jn?b- zyvq2;M{!Fnu218vfYzYnNZPeWd(S&JAL;R{-QUCaMDBwVEX+N}{mYgY##$b5C;wlx3tTIGiDi&m{~@*O`Oh~^y-f*w+xzaDkdU` zhB5(MtTWP>9Sp4L?k@PIqNdV@u8~dAhR(==XGR{Jb)akT!MX#_ z3_iH#K-ai~tp}bNcW~!{uKa_Y2cF44xc{de2T%U=;KAe9&%OS-RoMn*2uz;+uV*?P zrj1a0RPljKOlUWRKeestmRR`8hHz+G)0a@xd(&Vh>xad0di(K?ljQD5Yv13|N$%A^ z`_7J5a#se>%Ie59``c%AM9H1@nd#H|aC`Y7f1GoA59PL(3X5H=3$w3(FkVpE_};4Q zQGrAOWI7u&YNErhKvN7mGXhuS`HzO2ts$o-JbdeLm?0F$x<16Uvl-1dZH9mA`LO2I z(nW=!bSDm&WhSuFof+Ac?*@j$gnoEKc*OSMUculh%&Hoxdwi%mh%MWQ>FE(@6hWEg zE|``!)$btiiag&8f7z);osqVq-QsSTl7;#tr3mK zv92TIweI1V-}dGeiKO%9G9&xwOUwdudeAEtoN=%fVwI;)OgMEUJp4eITKu#fTGsER z!rKG3f}S*jGf>5de5EfDwXG}P*q0;SvQtxU&~#1qys@t~v18#8m3P1xU^p!wMwFdu zY(cB4Srx<&>s zL{8~bx#D%ZNT5a6IMvmd*LSkqvfl>2TUDX5Q(Fgg^VX5#nNo{q&t3nC{keJk5%-+8 z&V1jgJ$&Zyly@kkG2Yxq3m(X*FW(d$z9tqfte@4^S%k8IwiD{6eWm}#Sf*3(W?I2- zvVw!)Ew}fwH3jdS3+G;cN8NLL1Y!Ghm^jcUfPKN!u-SKpS)8*f+en#cmG7l-`|?p) zXx^PAu1Q1@uANRi5wK*k?k#*nsJ;|n;qLCz?(W^+^>4j|7sj?`|ItNcMrCgs zKFXrq-DPWLq3s7y18dAVlVe_&-s_)wqce|l)q4Zf?nLy>SpW_C3s&S0FWno6uYn7( zGM!*v)ZB|R@Hj>F8l=kY1Lx&dh2w$7bDK`qAIAzE=!OVi_Xqt@Wa}tgY)3~rJG;Ag z4VpA6d*hnQ>~n$zklD+p&LNXs_mN)NHZY#qc)p^TA`SX)X{MdgUjNijyV*eTR%ZRa zDQuO9<8;ER#1u!I#j$&+f9s*{co@k~9f2D!(ma+K9O3GP6p^;17|ZNx?bykjXG*Sd zn;w%9^l!buX+H^nsjcPVxw!?~14(5u0#A}d*=`w3b8FHnz2ee>?I<);cE#oBhn(!# z+0_a}=vUATrA(r5Bw7zD8CjeAD=TBDYCL-fo~Zk1pvhQccvSYTyurxNk<%#@Z##YT z58bAGP9%fib}Jxv_Cu1RvNtsNk5+cKuc@5$9&w~GI!>Y)!m?!2dr+}`&D4J}*PL7s zwbrv;uaU&_9@nKl?_tk&CmO);S;NbRmre*z`vE#TM>-294nRA79UJ(r@WrEz;qBKM zZ)0S`iz3nQTeGZijT<941D66K-1Ko{v?JX7wfb;V?m^$Rh2?JWi!CiCyu;U+OFOMW z!z-WotARdf1Z4mF%HR9iI?09nzJo%u&PizW^zhl&9{^^W=G`Koe2co_U(*<^tq)bs%|sa*V5stgjINy> zvrI~_`QP+?kn3tVIXxr8Y47Zq)y3=D_!X=*b)A8px+#JB8w>qwy1TE=+}a5{vO-`k z4Lw?KHR@JhJE|H(&%ZPPr>tW-pf7@UJd^# z7m^!G&0}FzcIDJ_C)AloQEUCq#Qiy#aU-6qBk|nI7|FHdTPNccVlXVXP*OSj%`+%C z5YN@u0>8`sXds@JtN4t(u^>`;bO1h>QWrcQX_yp{;Dx;Z&n-3SBf$sz$I~0n!}?{D zoY8Lso}ELS_S~ak2bx#Teb-7%o(r!9B%K@Y^=CZOT{$(A>EM;QqpdRp{4PEWS7m3M z@3gme)WO5_JmzN?T$9ecv&eC4Ta~`;TT>>~xlua8&(Rx^f@o(_eo?%xV*N8Px_G^r z@PgaTHO2Bv$c=(MEy|zwukXk`%-oysjT(RLHxEB}LFmOS=asaHS=%o1FI!c3{Zjy= zSu-#SelN|K@9bf=<+#7Ts4<^QrLT}x$B8crS?yzd)R~aWD=6(qr-S9zMmyN-w!Qje zykU3wI&zPF?Z(3NR@{Hgd!Koc#5KeamVrO<;T!a`NRzI)_PQHF_y9?0=IrY#%jaAZ zy8fDZCd4uS*W57W454o9YbKu|a-V^2+`dyy9U>{-FnRX8nRBk0a;AjOB4g$J3zMc_ zH@UBjrwSC^Qw6cWW_ki(SNQzZKA)rZg#-R3-#FnOTS}?cg+?&uNxBt>AEW8d%K+R( z7;N*K(Q6ZI{(9SCarC{1dVd2GdA5jlS=^h1G~7r0i<~jyUTNGHIRBXx&e7iJ9hAALPkj zzDGV?!vBnTv|Bsu!LRegU+T$Erzf1>6jY*qOT|q)sXQlaf^K=jYV6jKR9@wurn`elhtF{y-yf_}pY%TbUuo+qFL%>hi=_d$>~JsmnFOQ67QdUz{4$t4<8dB}JasVkQs9X( zTl^_c@=+NO-AT4(Vk5}>&~|VIbToA*^ChP4#Lg^485SCdaB34qFQ3?iv5eFvjQRAj z06`OR_*iM62o4_=2Tj4Dc2pJQ2>_ao!zYv4Gs%yquR9;q)%{$`wugvZHzrATegqT){-ZxcR(^Yg+}$G3#1j-y$Rz@&~_gwF#1UEzb^Ifq6W z>hgy0EaTq_UkLucgl7>2*rp)Qyz={AKZAwjRT*~v_ zL7wt_Zjhe>{vP3r!S51&BzW4MYr0PfPn=%}&pLTac-GYgepjCUpB0||(}ZV!zaacN z@aDRJ4kh5Z*DBK*2mTwvGw%n4F9ZLW@DsuRO8DvE-x8kqq@?HIaMv$Le>MdNna*RvXW{&Y z@N7Tt3D2ZI7CwYCR!td9)(gMMtov-|3s1dBedbsCBqon?tuYO~)qD+m^rvIk!B{=^@cYY>ll&~FBrGQY-%xcB6#E?+{KJeR)&Cw{|= z>68o4bfUuJ%wc*bKs>2EOA5R{*2s$LBX;|1pP8H=iJi`H!FF*dHQO7@4DboHjx zCZ`LGRnmgB>lan8Uj&2JJ}pms392smaQf24i)oR)Kp-^4d?O`Vvv#RBz>3n7q{o<8 z((4J=Z=WbSKwRA^qMkiT_C!n#3|&`NEv8-Y*|Ka&YBE*^+&sG*%v9IhE;|PG2&UWt z$TIac7XB*EdcCEldI3z%S60DbU;PuN|TX-B43e7 zq(r}!s7t%GAh#4lGSQmosmU$$&%jYpG2otw|^ zlr30)n|z~d=@NX4My0i}K!Z;fA$21`>yTv5lt@DH-if7(rbW}E*xIFwOV6gfN2WJO z&9cR1<4Q};hGUCaipzouS)+ks(`)*c8Z@j#^U!qwOBb`9nng3#0t_}D`SOuMCt5E2 zVftQm+gVm-B;x@5TCkCDW=$FYa?a#(($wO5aC6Jb-7QQWiQTKZTzX9@mB*07G7b z_*}P%&s9q#@l$m z2HvyqBOZpe5_sHq+s0$Q*k@8wyfKio@%EvQPy`|3VfZ6~r~8|0xpV-J^Cn7)=iT4@ zCE!&+hQP>%Wii9cDtBDj~pUrF%}!=HRa0tVyV=WX!BW4}}J_IU8(aC06mzoWs}`aRHxe#0SW>-Q+|iV&Z8e3xPv@v_0#c#rm>UpnL%CxU}? z!qRUz+=}-k3XXU(#BVO{&GZl=YtoZ)W*$kKF;=m}WzE0J{S?4fbmw&$(@;?j+k*SO zy&i?nK@#&zQn^Q=ACgWG@oFUvZTBbwtVc25W&FhJQN~{(%TYpS-%Bqd4=ne(EXMn` ztDS9+H9qRV(hG|xGM#0E&Nr()a%r&Rz=LLIg)loyciiw17m7W~b7>iVSl-mZCOQDK zaoRqKQA#4eWX4Ca=Tl8|s6oZHUob*(?N4IIJ`PUURhG6lb1Kc%4jfw^Yq{HO_Vz|+ z+B+>@h17GIfUO*ag$`|x+;c_Q1tpD#kA#OlJt60C`{9TD2NbC-Jd|lCC7aR#o2Os~ zwk<24{m4B9OLAfH6m^%hNDl7J&WT5n$Zsz2AHACUxknda$NoDY0~;mC(8hg6_PzPo zz^yPi5egm(7|Y^&w+A1}ofn1>EN9Z4hkWJ~{M51$6IY!R_c!M86A{=E4Po)Rc-H2F zI~sF>&AXe19_Y+D(wV;#@v>g;hrP=x&&vv?f0RBo)0v+(^&)3}#?dqw4i#c745_;! zA7$M8lk^j_3Pz=Mm8f^(Mubpbv)Tax-}A#`V(?JF7|7n+ z?7QQud*)`OJFCudH9%I{eZYWC(0pv7chTD?W_^^A@mr3mDWQ#^z>gTqZnOl{%d5@_ zm}#Q^#X6~{4(zt2@l&0R{VVq0D<}$~F3QVM4w_H3uwInA?7-O*s{-Ung(mxHl0_;7RoQQ7w{ zDuhpPx@pI5ZLY|ADC~u9&pOaqh`It8^L}NNV z+QtXHGv7rSlTRd%3*aSuUV{*6D8YNT|M?;2S^q zIlFhnJ8r>Di?hKt`lkL6)@(G5;{qx!RT;(sH&9<|5YQfjgZ3L6e^c}Y=cl2*!%=q~ zm>-KHXse3)ea9E;%&N!zEVS+Limuk~ZbrfvHT-V{K4LrWF)~lwzCMj{!@kl!Q`<&+ zp6_?HGR@@9?1Ehht!PKtqt%#@f|LETDI7k28 zzR2BdJL69})jBSMeWTXv5DVd@ae0MBE3XhltBnJB?xgx7amuLWUJycBkcR=NPV?7$|1`dJ^$_jwjs{$J z6eqvf{ip=@Q?seJT^)PnJrw8_f2i}S;8V)KJoC$UXY$n19kY>{D_=6ZoY^BWic5YFEap4dBu$H}=z zcG>!OqTXubI1qe3|3H`HAkTQ{Eg7EiSibaU zyre;VcWS{50$|d{oj^X*M6oL=Q@rkXE_7Z+Cp<8hktC)5oRv)qus)NKh=bXNl;9}@ zdgGdDT+WFlWzkKOlX!NBnK^QUFtxF|rfS`COq4EJdfU3HWmWj}OCPc+r(QYh;zBLz zHCd@zCNdyX#l2@K&o1emp6tolCqQEXP)w82`5m4Yp=@L>Pv-ut;=$%t_Ux<1_htx% z;F%LXyJX)P`UGfZS~iiWPKCNEWP5Rl{wx;`1wiVBm zU}EmijBZR0Q-z^mHpa<_s;PG8dN%0=_;C&x>k3xued}UEQmY1#H2?T@?uB3Qe zuS7l~0Si$H72t`-zNO+#@Zf!bfSV)^Pl`9rgVzqcl?W%EJ@@yI9=tiYc*+PQqi*IJ zIa|NEXmol%;3xybsGoOlyE(v%!e2@C^X_dIxA4LcR=ka1sNWa?cno-dR4|+w#-kj6 zJX0r9Yi8=Xs{xW4>6EP!{l7q>l7DVtMNG zQzx%VLOta2?*I64<4nMqk})E3_PMJMp)1LKh7_ayx!R2{=e{lREbqiakN@lX$r}^j z^`DSchw0=jSs)ER!{MAfb@Vs*mcdFbbZDDutZuG^v+ekLjkRSuS0#n>uGB-l*VM`j zponlRE-djGlVf3gZz8d2@LK>UjLWs1;8>Lm5tw(pJV=d|a6UitaFy9}_G}~XN;pq+ zlYD5$Bv!GG`Oxi?c5D2ZVIlQ5Wnjm}bwgq_j)!Oz{XQwfeA31To}(X;T)cYKD!gR4 z&e4e;oAw1=3%t?E9b*k#w=`O_Wc3Dg$34B)(JNQpzG^{q$&#A2RkzsvNX0k3ztpd5 zR#56xY18X=?p({U)G&HA8WZ5&;z`ibRZI<(6v%yg6NN-g7c5(U8@iUp(l04clVq^! zlA;sJO8JDe0c}%m113fd?m^q6z0yNjo_R=fNU}qroVE*&7kTA0%$7SBLiCT&6Z8Sx zd=9X0LVXxUH^+5tJU#>MD^Rij0)HDX4f#+!yWbi2;7yl!I2lsBufS#F(Y{IXczH04 z?rI#iely{g%K@A#$MdbiN9X{t@1l5izw>7Zv+)+fEtf2~9=v11N9YME1|G|fhu!b| zF5EWWa=7g~l;)RXHg`uy^f(CXIq?1rbI|a8}@HcqEyKBF+tWrJWM{6L?EVpYt z?ychH7%`vGB%d@&wgsOw9Nz!*c}g7eCdfR^dcJ0S=7*O)vGg9E7#-1ozMfaT44G3u zUV4co5?a5mYUTgtiSY>Xtk)`7XF3|>kH`qIeUfM7UX}N>Ytx?XitF&cd^w7vAf?5drgKdFlr6-h;vxbG> zwy%GdABp)Osodk>?d$(ZxED$|%b&V4&Fa-FH`_sQ>F8!YO0QY_X@1FaB)7{;D&WAXlrXk400!~A~SKE|}ozxnzR=z2>EfA>P z(i*k>i2UENsJ{no^ z-f7UzCe}J$>&;MmnhEuyN_wDyWi=ICX-dUDA`}x1lPIqd*;9Iyf1phs& z_hweLzCYf#H*3#Fdo$mO=Dhq_@=a|6ofilCYG2E3*&BLspx=2d_nmgy?gbyRY^=m({-i#Hp6Ou@fiX3Fo}f9Xrt)dM)^NOo|hw#18 z_b-PcA7$P+*7s4?E3;N*p6Gn~YTv4?xkzN@{I-gdFNSj>GumGBm$in*wp}@8&jUB@ znUT3`qHjjl>E`0P4?07SwC!nnq6wRLo&xXzsB~4V<9Ju=z9(Z({CLmJ?fY9EiS7Ab z^XV1$bmT5Cf8vMDw}$SGHUGn*%%<}9CqRSyGk1R$xq}8*LW6_YXs)>Riiyyv<7CCD zeN);DVq3@YeFxf}_`#lsry=#HFGuRr_EhXI>x}%M?TJ07_cS-R*R?zdMcPaE9Be%G zLQ|~$IQGzMc{bL*v!yMz=jP^bwV!PHZfws(k@sS!Pe1Xa8JP!5-@ghlS2Ovmk^C+u ze_ePl(UJJ67k-LFCxvsMLdQ-f{^*{EkL`Ib^Tr9Nf@95dPgZo!d;lq)ZbBBB^p#ER zVJL9iltaf(B){*&SjU=u2VzfrcF&Jrcp$dt`!jzSd*X@aZ_m$c3O_!j)pfk$)ZwSvDt3-R1x#)$TT?Q|6#p?~x2yAoXWNeLd16n;$$dXW z0W>$?)HG_q3lGMcZ`%CKj&J46Y%4!8YtNzPhwsmP{7NM7TxMDH<*T4~^OKF`&A)^% zn{P+y6VD*uObphFKSFWbnH4On{c6q~jc+`k(|>H`=bw-Jnz{~lJk$P4<3sVJYd(tY z4`Rb|gXa~z>909DZu_>`6%O1NHa0BF4W6z&cDQ+WkS4!}Xl%!8G~-Y@u3)-?{;sWG zeDePEr;&C42lt+?-xNllc|HlviG$-=y+3~B;w70f@BQ`m!mNEL*GDdbSWAytd{kLVlkNhux#y8)8`m2q( zJDPLa!z~Zz;Ca#R+takYJ~laMVx41R4Xnj?XD1J^3s9duxL^5dI@6|aoyGguA=+^A zS(Rxvv^4iNxrG|OgXX#-CL>xs_u;c~*asE+&ZY(P09C&;)^b-p_dUdic(HXslpHrO ztS=u7JH)6lmaM03^KjpFxdj`XR#TPf&b}?VjXSqL6tAn@5^G$u{a`#=yQQToYfNYH zYk~MIXm=O_<=YSL4Pb{we7t*vzug87kHPS9VO^;c{{TH%AEIJdIwbaC!Q zZ*P95;Blsa-Y)(jd(qqYsIGJ&Li|Qh=#upz`J`^B7$5l>Zhu(!tN-%P8*lu=svkUu3lV0=3)!I^e)Z(|+{cBjwlq`NF{sk?;NC3qRlfUt{B2)82dR?Q18T-x;~A zw%`57ZhkUUz5Xx?ZU~OMaI|M!)LAlX{Lv$qeeIE;@6v~^DPPw7g837LsM7RtX~zHy>uq&bZux+P1VYk zRkw@`MQ>XYTDN>@Xf4bDmTwBJTYdY|wb@gumV|EERI}8C-cq${(aNQvs@sg*hUlWD zS7w*5Tp3zbwQB9A(1xWDBfz57HLGu7?2*~!g1Kt-s->Zt=(^==L#x-XLyi|M9sRd4 zYHYJQoT=WS?9%RS!^lyG9-@sR$9PCzLWk9#G-|^>yFH3ScfKnu|AE9CvFpKau4W&c=IhRR#e1GtvrBzCPLdHE5|2-6NLOl*}y=@%XQhTWPUV=r=Zb^?) z?2CU(#M$BHJ7k%p&t)zg=Y3ehd7}KE#m)UMIPPn~nebEMu^n>U8}1HqUt#16u)Dbn z@L3Z+$Z4?vh);VhCAuexV=vBm@{L-x>Ek<(zSmMr{aKdzeBl6@a^<8Kh+`uv69%s~ zfPAke&-W9)qmgGkj#-muJd)b+QBKFIIquCp&`4L}AkXkc7XM}8aWbTP_1HMW5TbT@ zeD6=P%adkiIQNr*h~DO)7`5S)vJr!G{N_IgZ{$&hE7#3au&sTO(S zFg|&PUnV@$H01_=rZZOjnWw9T$I0Dq2Qne>-@`#1>e7E;P`@!Lqar)s61`kTj;>qs+Q!%{mq7Wg8|B zRG8DaQU)Utx4LHa;-&aP{3`d8j)^bx@dJCkCq2%PMfs%TSu&|oNwX)OZ#E`|hf-MS z^r|uWR^wTcO_EAoh}IxipG7D#R^6ael4|lNQM^6jeS%U%oX>Gum0HG}kA1s1Pe zSC(-6cbE5LfRxXf9{S=y$N2;NlyHkQWbPN>&Ng;-H)I&cmg6<5r2IB`kdJ5pZV0?5 z@LHul45Ry295!AV+=;;(@QSxg_z2FVpoPcVx8i*od9(22N{ZLdgI8qX@&2fIe*|yqw-9c*O@r&v@3+E7=m{zT9`BdtUWc>d zJp=6b@aOYBN+D4lvKY3 z9=s4LU)uq@BZ@Zxyp1;!7sW^g6FEA^2_K;YG!uARaAv#WGhOl6FR=0E0*`${CDjkN zCle;oy@uOz=}YeU-@TR*17do^?QK#?4}h%bI_N@!+0oJS%<7n~Fsm)&RyH z>z|7P<>gTmE}FkIU`+vBIljJsT>`OK-ra=5(vueLxF#*Qy3Gcso% z>o3f6wP72ghSU768)No$_-GmilP=g%oZ}9xc>V6OzQ0#X{%L%J2S@im;lMYpy78@q zZhnsh-wZV04Wta*=6hNAMuYk03}no=G&*s{(R~QVKSSk%9WaQpyn9L}RSBmG+VIdFIH!x_sm&9{NzR}1-C_}%p#9RC2G$3H@b{_u0) zzUzMQI2^cZ@5329@*b*P*wAtp<`;tfun@X7w6G55UB#b4FXsf7fgCy5XULTfl0 ziIrZ17Kxf311dzNO-4;7s68a2nMCbLQavP|(nxA0Xw$=>hS-)Kp|+xxThUg*URtq= zsI_x{zqQwd$rkSEIp;q2JkS66uVl}D*Y~^L^{#iV^{$UynZWOAh4IL>X0k82u2*4P zc?`o?%MxK^Ia_?+S7p0WjC@Un8TqOiz0JgjUk8)rA6YI&RwmL}uF`3KjfaOpo#q9~ zrF_0{Re&5nn2~o&c;JZ^A87Rb7JM%75|KNwQK5g6iWHJ*`z|tL&&a!x?!KV>J-2*b zA`_rM_X+aXR$hRVZkzI6?!b-s{MFutCsA9|kmD~}eBZ>UyTStlthT4(;ekCZzHh@z z;Xfcz_3;CSxdS&yOj>+SrrCZ=?m(^l)>4b_@1?`F<&UX?xqA8Cw3hbD+<`h3Cq)J+ zX?{4KJ8-+{2KI=W;qpfwH1pxdT3Xt(atCfAsvE}T=g1wngRXa;LGvja^#3P+>_Oa1 zdLH`OsgSF9I9YYTO@o_8fr-Hi+Uxx`kQHsGC4XA`p+D+Zb<95pH!5Y8h_0SlUEQ7D zs*fFL6CHsHgy{%eGUYvn?Vlpu(xjV{aP;@n-v z)eL;*@Koy~{3oKK9qgbq*5hK{jEF%zEPuk30QfgNrFhElC=-X9R$^M_)|hlMuCw(9 zL^QS&$F-jE#^UjP+0GcQ7k@bYrKi$&ry^5efDg0v;tl~bjBzQC{3il0W|W63dizB8 zV^4NJQ`-H6_T&>m{l@JV|3c3eSta6Mdal0X$tS$VyPtLzbZQ`Aa~fMC4)62AgA`HW zW^p=0rk{f{8^Q6rtLwhbbm_Vyg<<&tv(Mabqyiho^`LKG*tlH`kv2#Q7Z$X)hWX{f zM2S^dE#V?-(jt0(OR)}Yq-cz;Z^?A7AE+(I+{Ue^&AN{W$~#!bugBI1!>0|#B>v_V zEyhZy)LDQ&Epo%!ybQgl^@d1RdpFm$I|3fvhD%)_8=9eb8Mp&-Kw{aF_0zF3Bx8y? zVaDW!SvqmkCh@;AM=S9Cuf9Q=Vu)NWR9cf9*YUL#v; z$)CkM0*ho$vqmP$jAfd*TR}Qr4B8==sv=wY1hXwpmQm8fy>Jh<{{THDap;In-u|#3 zjqpV~5SC;z5QH)Oq>}z^`itHh^E(3^X)Jex1$RCJ+b# zHfCvco{h#M>YH1{3N(=4T%4Nk&vzK-sSKr<^Fz!vIEtrQ#hjFjKBG_Tvl&0tMsszy z@na3N8Rm^VL%9)OvmMQ_As3hRuua;+VeEbY1oF zyJ<*pS65C)ARTqp4HsCmoN(XO(IOi|=HUAMKN+VtAb*X?SJbsNr7 zxK<5;ehni|{B9_Bi1Bs38Fl@+`n^6&+w8f1a#WERqv&(TV}^Z>amWrl2{X4z-2qkW zG@c@xEE!5$GjMyepA6*65PEh!3c#zd!UG$Ot8A_52-6=@!hcYH@KMr8@}F@MOPV9t zUFoXhAW5!q_f>+AU_k)#-MY%iLxtUO$&GhN{o$FA>zK|@B?t&k>DkN1q@>~)r$J!EG()U=s;2qhL z9L8&+n0F=N!W%k#u0`RT9BPGilQ7_+;&goH-chu29oMC?O@LAW_sO{NUCtGDrp+6D zaHq~Z!TJVG=QMjk%+)sIl<2zxpJ9|VH#~oZG^l#)v&b~GQOL5YQ-29hVtZ}bjXv{s z*L(5Eq&Z8y_&ts$AY`eZN?|-TxREmeF|`@@_!r&wN^F1sc=QR9P;(q z%)CGqUn@G(L?Q4_=Cvee31ZzHa^gh8k=|G^=e|mgkFdnuP~T9~;24Z8(5JK9w*9U# z*{E$gf)#hVQd;(%Fms*qUUg+fX*ffyI)RSESS8vgp&$8W`y?%#p@BJiAP7*k(O5Y? z=arft3RkA*P7=A5-lbm}+F8K%y*nLjW*7Yhql+W49k$si!?qVSI2hYRBpn05NP*EO zA{u^-^`dH-$P10U9*<1xk3|bQcSd^}TfMD4D8pc^Xm5<)r3G^MB(UwnRY#(eA}9I+ zTf635p(=WvDAN$@r*tHK{P>|+*lAf5?!^lw9`Re&97YtvM9Na##UoSV`cWY7|TR$ zhwCNex?$w|@dl({JMzTodW1N?N?V(i*1MN?RUroWrgvZ?D%CbNRQWb4ZfxAaN<{rf zZ0HNt3~V&kIdtdRK+0JB&8})2Brg)f=vvC$^VjV4>h8Tgm%$Aj%~~`ewu(BB;nE_u zs>r9CUC0`&Oup79jT}#E7m{(*kC}JWZa5sL`$;s2>&>x)l2H-c+CZU+6Ph0z5yVL| z#4~o&0c+i{*)fs|A?Qkjb%X981_Jl{u|%gta(PGzwmY|Mib z7OD2n{DwWd(~V1|aA#@dm%HIS+k;Y~F2=fNJ*6c}8zZ%uD9Xr=Bw|}n0;4ECRTSAJ zA(hP@(ErdlJZo*L14t&81)h5Z{XTB6Tdp58$HQae58YAc81VwJ8+BJiTN2GR7THW$ zX41}>>r!eUOjjPSGmVsqKU7W@pSM`Ok^-0I(E90@GF#`B{h9sC< z@pWM=W%Nv2#e< zPq)!@xG9prIwLEH%EzZqW%*DKx&!{3!4|6>F6`47xUtSDt5tSx1(e2U5O&_@=E6&M zZn|r=%XQMyZo$iSwumbioD7+2Hv$N|{yDGiq(G4EiakukwKnj!9%!}qj*wNPkf_5g zjE3to#5oF1H_3pY;30cbGer83VasfvlVJ_mE?efnK4qJ;z5B1|1H)y`q;`gQYRj!6 zZIYj$;`%HGeRLhaSFS}|=yg!6=5xgQ5%1n!vx|~r$QhHIdmp1Djm6`GW=pdlCZDi_ z(1x^2M@V?n0h3c&SS5Xg@P>lRrEtD15)7B4%8XlWk!;LRTZ+GY=;6_O8N+?tOdvdP zdyDVcsx=zO=W2F{guhGqSH1ahB4HL0_3KL9cSjmfzXnz^=k>`nu#_KRA#)&ipSO>b zyE8r~ck``s_n#?u-IT2udPC+C1b;Pi*24LU94ecnv*0OMfg!o&uF(f=X83FVr{R@VZ1K(Jyp48;5M+b?ndqvPTgKu<}j|)jCmRw zZH5+cZrR@W{GM6dUX41CRFO4CNu6lhU5=KAfL)!Z#W+PCTpP$t6!x$=8LOK6iSDYp z`xAT%9EHO$^bEydIU>Xpg~3?G0ZjEQj8@qEtBRfNHb=*{i>>`z3#T+_boSK_DT3L< zO=ISmx41Doru1rdiq&oi zx*B6HgHTYc@Kp2|zoUq4tKF#wFqUd+t;c7?n_9{IeWgQ{*ca=>+?EYuwr2#&9Z!yaA*=Ly)=7XAh~sN=*EvbBW>J0dyjLdes4@} zu~#nNaD=t&mR-)31GhC##MPwHtU-+GE}qSqS+tTL;;v}I+`J8C=#gbO>^fR-s?<#G zL13>NsEL&W4Gj+6wWc&1{5H?fiX4&3`F(Ttjq#gYCy+%3H$J5C{@F8ej_Ed6(;5m; zC(g}|VLSUG<85tWn%Q5QXd53&d6~FubJ)&rg4a}3R-{KT(<+Pwm!Bicz2AA*b=>Si zs!OZhL?;rA)Nd+i>8NBkvchJ3go=~Y2W~6SjRcLmWoqUiKmNtZsB3ZpL-uW%eP?6;9cQNSzq&cRp?yXdPywPAg< z21KcP&A!7H$!eK9`~A@5^)*@8{#=u}sd9Zypdl0vWwxe=Ls_lbo0vt&J9(irMI@IE zSM9X6DN>MVrIH=`N=GXXyN^3R zGrOQOw$g;mOdj1*FGoW?ki}qL*w9p4UtP1=u`(1W3uR)ACvi0Or%?To3Xi%g3Ti7i zH5o662wHYaMjAR=Nvhk*KZ?h2bTf4@HkJHnlT@7TS=v^$(jE3w|A;X_?m$CFbgl9C zw$W`vcQ?c$rL8;H71Z|Bh9W!BfMc=&??43{tvOZS>=6+^`rK3XM{8P&3;vxLsIu7} zwB2?L4AxaHZ39i#Ro?H~vOQYb_#&IRqz9W4X?8spt9}N#7AK>hfyGBcNi0qdrplMR9yk+=vkiP5vfQnE-W$i{brTQ9bh0_m zM3Kekn=C%>y!S&HYicHK3azj4H-NDxk+G={;|Sx7jLqaXpHnvxm+HQIhAs%>{o3^6 zg8Y!~Dv%w{qps5(j?v{n{=<&_&J`YD@uO36?WrT{b9*F{qgjyy)fs5sjab*&A zNR#rn<3eNGqrSBi4_6szC|@aSx$Xc1nh*L!IOJ;&rT2#90@K5@2M5HHKQb4a(qiV4 z6IYQ|^;dS5;;!Zp+ERL?Qlg8NgAjY3HDeZV{lJX*@cCy5ZH_+GN)cNTI|3}RqOG2# z6a0TB>o|}7PsqBlwTOR@&NTu`N#xP^j5l&18Ut_adw53g02W=S@7|S_w)3=(dwC~_ z3=-p7>?YJ)YGToi`tO;&KS;#snmR7re~7sM_uHBz;D4^IB@Qo;UrWf9XEzuR^@c)& zq2S(7u0G*lP5Qwa@2e+Xm8)E)5-Q*}mS98zhI;i#MbC>(wQak1_Q$FZ491r3?cw+y z{e?LUk_%}o>|p+IK?;tS#`j;f+Jh!8#ZBVp)BgJ8S0Tk z-_`CUuO~Ru?ynqblU{pc3&>YHhhk`!SWW4#Z=NEGj;yw?uy3~4){kT>QMAzM$`rjJ zpIZ2-WQz}nyhW9TH5f)1;hIU2Sh&U?X$se5w3=gc3S5jS42~%#o1(+9wC1>D)q&4A zs6b9o*|-?{!`#l{| z8?LHPEZHX4)7h&Cdo0J-5i97(S*qy3=_=yQ>gLq?a}|_6u7aYdngSuH{;9!Or4qV> zm8=>YB)9PdM-rfa&we=xawmCp$*QSG)zE8itSG5!-qreR%5y}~0kdj~>uYP8GgakO z*OwcpoOD$=%UC&)6Vdwi8e@IUBvuRRCWCe3W8Gx57I5-}x|zhfF%orCiK&jPnVM!B zC%5(GxQ4oBX=Tv?r2Y9i>8n?DQl#pnW*%!~UexA#W~@f2pG7J1$JW$Md!Dod&MSmm zO}u55c~!-+ttAZm;`)R|&b|2wl8se;6W7~Pu+gjqiwYB}wN5Tr$i)h$?DLE#pgwPG z35Ls3MlQsXcuGuupJ0cn05NXBEMlRvJR99pdw|1n%zMiQ8g%>i&Z~6iLg!|eu`g-L zvCw0@C1)~rsIAzCM?%$w(SV$S&5EXX+K>qLbTq!`g&IUpTamIW$A;t}HnFfn;hE`L zkphx#wufygIGG4_N?8i@82F9`^tyc^kO_$b=Ok~qN!G{NLI*peGE8L9WJdlNADf4; zujC)+CS1FB;6X3?8NMz6ve`h}`)%z5V(SB5ln`Ra7`1KB{IbNSNd6YGPyC_To2JLm zk7mj~6~hDesWZ1{rpM41WTqX6$6v{mYn+{nF%(6DdfKi`CsOU+9fU%yDjUO+rg(hI zy?Sd)v0u*=ffCW$)86wA2D>aJ7G~hxl6}aS2}IDVni;>@E8h4+P)|D%kAL*tr?+SJ z?#ukAS27>@=nI`A$HouBsB>|dYnQc9O^|qfc0JIDEjg(U<040GNS_2=ltU#5nDnU4 zc+Jiw&Duf?dhz`l$L3U!_{zx_K({~Q!FNn>_!N}@)pmIr^!*!~srA1NDVy%lVPNSK z(?u*(MWMV)p$e=l#mL0%>{P|b3X^M|v$0SBzNG$7PrX0Y$burL)y8l2IKy)01eWM5 zM8dt@e+8Gdm!%{`mI$8aYY8R#Y2}Q55X&q&xqT=j7f0MPw}!n{DH+vJJ$07W7OV_; zK@+JtzzW@F-DIIiX=6ATUXn6WDrP%ZyBe_R#2+(1#i5x06R}DQJ5!>ilxt_d9x7^ z2l~TE4Jr3c;qcu9XpH5@|K7%pauXa6D(mkAcpf^PmUd5J&$s%|NdxOw2 z+c+1*cTD71NU`fx*jRu7QgJw@LPn#58`g|L(+9fMr+&xk?H`9p-WvzhfaPaEf&4t=y)BGs}jOFuN?6x%y} zI4!O>Ad`e_D+g~vv+umOP)}R_bK=K=Tf~5PG(N=owypeN{Ln+A&G5lKKiYqhutThy zT5+tXFL@vOavO>zd3m#EWYm;r(ml8HW9{59cl(RM4m&ylK0;2@PeAbR8|@9YpWg2T+)KpyH2i&abN*H zKx_`hu>687CHa;BM|_1Wd5^{zk_tdy@tOO$3;U_mnxu($UMdqI7YqXhn=8bohAf9& z9~T%G*^1MTg&^w9)k$MM7gra0Aj^s3u>DlQ(a_lX-k7EN7y;T)QI=a>)&V-)D8irX*(=+E{QRQ^a$Yt#ohNa!u4h zlY~8Zm{v*3mc?d8da6?-?Iq1wSl0Cz$xqKW6VkJNyTGtp`Wv2E?YbWMLlOk>JMfPyE)N|HJ z?3)rZIXz!-nxwNmSNgTt4p6o#_uW;MPzYluj>JLEu_HZ^l&eFBXHae}as%0*tb$ zt?vME2kow;2)*By+yw4-UWo?aHg`@qRFlm^K8fH{-isVib78rUwW1Q8ua$ksEEo2W zedKCL#(9J@xq<$067!6fo850lrk;X<*?8t@?K#ZvRO*Lx$GWDLr(Jc9y!z&s;`scZ z9K)`dXc)F*r5wS^ZwRjN7^@o=DL588w)0qzu^BwIW5VVMa6j%j zw$u2d9V=5k4Y9-Sz5{AbeLmUdO{#J>wKW`R2t`hC>g<*Jufz7^K;kndi&esbcwYUc zwslR-JK~~I$^`D2{+kTekk;3DA;2BIp&5Ha)7ONi9Slt!4CU#LvYM>2n#{7AKn2xU z+|I-?O75}Pt22h+FTwecr#lMFdh4* z6LM5B8{1VK!|uMeqF6b!5#UgUTeXq<>BHJ5cM+^|sti#s)uW^oI z;3!oh(1J`}S!0ydOj?6hetGq&kq?3TT;n^D`nv32dS z>(@z8`(eJHKZ6HPtpK6a$@K!0ra&KG-LZG-l{2HN{dtO}Q6aj5`{ zOQFaC=x>im{@pRQzxY(WEZvyC`~NxrLcR9?^Y4Ef|58Z(x9}PB#au^@p>6xkDPLmr zeg+;yJG)1=Gqf?;*5qkvFH+H11k-4jp$+13dZqm3I1&4G*dB2(gfq;Ua^FkUI!D;% z*FVPSxN6AWyEm}6Ckh_yPnS|?V@3vKDii@a#~ElGYp`X>&50|tiE!Crt|QiYjEAVf zll>s38WBu2unjd}#?jOE_B<*1nym|)TmUyNmJ?Hd$z_cn5*vSrzuT_DFK&rLE>*`q zSwN)1qkqv~?HKAoXDIE{mu60n7~#=B-MPDCXkv4=lrXA9YlcE{XO?l7)>3>$zsBuX zoLM42%s-`NL>=9H~_Y1F7DwN{vyJi6LIjOc>=XC z7^CC&G=?TFl6@71>`vRC|5(4FWBx0cE3JL(z}mnsOiowRT?`nOAbV_@2Kl8n#;?1} zPbBz(H46MT+w$Co&9>Gzp?6=vEVJ5<++a2rdmZNfcVDC7{-vcoVg&&$#Tk_ z*qSQm0g~x3v@xgJ&E_l{o2}{YmWl=@t`RZHiX>ywZ&cFnT}=0lR=NB6=ownIA`3_X z!jU+7nw}X0Ua9+VV`SQ>?|=}mJfc0C2EwlmJd0}x<@P!w^-~hf++$;wfJDQhctu%p zAqA4DG6Ct5mEaaUiSij}aiuDvseX{O06Rowak{$uAze1E&AQrn%%PtTTRUXUYg(Ug zCzp52rw7i(CQ^iO8EgXFobJ*^U*VGZ`6W;6=`UOx2&vjO2`ky0e701o%>7_bx2Q`! z3!AeoptP(vvj)iENrXQ``D7WJL_-KWt=%}7QQ1&hgZl*rHnbKDyT^7`zu^+bCvK#h zk12~{#9>>Wb~N3La@cMBPpvwg8`Grj!o}lkmBz3$l1|;lu>H96RHy;phBs26KJcTC z`n`JxHojP3bU8sKG@)ucnh@Je#o9orS$CVE;XrBn3yfvZgpH&@Wj*ZRSax7zYeBOY za$v+IqJ_N!4gCdGnOd}LNwHqixu>&idSEy_(13B6%^1}-r=7L07?x`HG|8*uH6#56 zc?Hl70n=8gTJvLeTu}b!D8fpjBW$iGwH0}S>03JR^3#MEl!|WYiTGR zuX7sEqe2aYx~VkcG*-#Rii}RnupOK-VAEzjIyX0Z5v<(sY+?Ww365jMB=UU@Bt1((Pm&TO ztgZz8$dTz5BGwqUr50CK)PsCiCdg+jgr%wNZj*MTV-;CwuaOb2+M=&CE9oX^J7AZG>CKEy;(2j-UD zp?Ru$mKZZX#02~J zhStB~4HDXGJfjUA1T>=hau2pJ&q{+RF{Sxn?~{;LE_t|3%2_nmO(K%p zYUi8`WRd)0_7zdM&l^fb!Ie*Ou9~=wD?bYl8oa{`qD(Wke>CAR_I8Mr1bxQb0L%?J z@lAU-_FQ0T9~;{ul2}sLvORM~U5YVeGhR+QFLT`UCbj^?E;D|RQdr|Jt1%+eT==38 z2)qubp+A$wh)gq;0$F5p(Or_J>sCoT&%cF)c)#n@0^_|g->-o;tEr@yCv=e}&M zVJ8G_YZKY*p4JoL7rxe7AATV_T;mPDkO>_Eh}7CfSz7aEP5Qbc#j%D;^m{kG+KYy6{$fKwD0hFX2|J*bmZ7~Vld>DS{Ha742@nfw74E;Cr|9)iYJ_UgL=*m z*I>wJS_jV!htiR0O*#)b8$zJ%}yS_|!KXTS@pj4|XtZ4A^ksw(7Qz4&6HX z4TMQxR#kO!Tmox99GCfRAB@Yq`OjwZP*}TVrPg^|FUIql8rNLQbDVoX3dl9y-;A?xNa-|B#!H< zq@3a$+EuHqeLklr9-rlYAF~y7KeqjDXh4--Y)s=A(Imm{Wol=vb7!X;=Z+zwDa9R_naJ~BIMQ_rUzu=V zq67^<6!eo9<3PA~wiWjb#^!K20pnGY3r%We@xe*jXzbM^cii9j!_wUc+H*()ur$&I zQMQAPU*~q#l74SxJbq=@RPG3B^%|#~x?@du{Q5_2&9Ul?Mw$C$=BM_&(4DAEChT4P5k zqfHQKuCIup`s*`o<(H#s|x0H$rd0}q*0S?$6w z`As>`!kR2{)18n3vrz)Y9H8Ae))=aDic42~buQA(M{ct3^aG(Lq zHrw7(JmvkLO%2D2T2DanjAYY>dPeJ|{%IH(FFg{*T`t==;OOfaqAI#-jV%(xH3)7V zEzjdM2zhNBU~OP&>_hdddYB5EW?#(6dJgpp5KB;Ptr+mux<0`ew0y5QDS`}QSgGnh zp4e%BS`u*{9gCamM-23tsWq7L9>;HZms>P4NJ6;C4P+>X7r`h7K3zt^sj!^q-B(nQ@%*ZsvX zYIByoICr&sHjbJBOLTv&s~wof6dzw;cYVxz%}l40d9UC3=aCQ08a-X^vq7jA<5!q? zA--f1=!vdWdLkUt0I88N?rYNNk2*h$Q$&*f&1y$R@?k%+3V8u}kq1)kylfJWyf@4; zuQ>}oHi0p{aNfow-M*yz+3ITVqSlC`;K_m z15a1j%HzU#%nqLF@LyE^7lEyGpNjS#ts`S%dyh^2+B-6ABOi*Yrv#L^#_!}g8^7#w z{I-!lu?Onv;2djF$5XbE8KQ^U!tQ8lcPi8wqH(*ow)D;J_#3Z~Pa21V;T{dl(_ARR zy>ruJ8SMPXWnH%N*C4yHjQb*)i1&Fzxl5ugsZi&J$>aFTeZ@x*C0pBmqxm%LE>%yu) zR(RiMZ$!LL580ZpCw)Xp$=0oHruy#H0B9{a7^ureZwwiTi#a;bUg0^G{%VMY{t|NE zVIS62Z(UV5ZOsc`>m@?zH*~lqFO-1=|;AA=eJSt$B-R-}hNx zIy`z`$X*(Hdbh2)g-0$#>gg%bZ-U6Gu@ztZaNQ-MSIkbCo@pCt5XL`in{`t#Gq3&^ zjGyw9HPoWC>UphK)c$JZc9H}dIeVgh-p?Ajb&NVF-r8cDYb}QkRr#5A&QL`nO7A($kRg04Ht>Ny*>xXRRSBe)4Of)E17kZ4pcUGih86C5<(s&%TjLQ}y zzrrjtd3v%H zKgRVycO)HbG;%(;=W8qzYOZdAypZ8h)RvytcsGkCYYXgwR89_Y(_k`h^s{Z@Lo;By z$wVys3Lu8-j4sh~FA+24-XeTNM$-R=jcb-@xl6>%jXT^!1#ohR8(QX!?m^DD?1vrq zY^8BY2V51_utqQX9*1Q?h50EU3Aaf+fSLM2PfNzB z*>>FK1u<%#2R=Ra zivCz_KsG?X7V1y$*UX#$$fH2LKi%+X`C4%ZxhW~wEVp&_N;!fMWBLj6{B{sYD!sv& z&fp9@0NJq8JmWa-Zb&bA)4U7{Gn_%(>UfCMQu_n~=dzBX`EWt|mUk?+Jop>fR1`U4 zHCs9mV;RR9D>!y{)SrFfr#zfng!pdXgYUaoMK)OW1Yu&Q4gkC!NZb4To#DfI{L{n{%f z$U@FkXM0xFRM}FB3nCAqUX4|@70$i_+!j!L#i?ya?+!md6{p!W6kP>1-gmEXmY*XS zrZd!1eEDFOR+uGaqJ1}eEcCZ4?L+A$>fj?))g94q-EnW@d8PTKSaL?^vD(phx6vhr zwwcMUs%hBPaJRAeBEoIYZ=%R#)U3*w~Gs%s1E> zG~jxl+L1ru7CuCh+KK*qmexSkpZ{QAK{SLr&){zEpWBhv5!LV5GV&X4%UtakITD{Y zH52)^WGqLRmIr2a-&M*HY&dsxS@|#JrOFu>)BgcqcT;ILo2rgg2zX!IJeDlmGp~Js zLeupE=AZaMGP$GPk-Y>|dRLYIYy6Hajp0%ZLh^#HAA?!R2SGfncN+39>z8s22E0VX z)m}1_l8O6r6yGKJ^CHoXXdwK{Q;l7v-4P9A?30^P+vJ#)XYVA7jtvCNw86vZFx3=D z_KIfCGVh(38&6=J*p8dSl5qh{{OYj^hIO?HZWV5YqUTe{x9}3drEISeP<(?B?cE$W z!KdAgl{}+Zw9aUq9A2Vbx?R5)Wk6||OlBe(d0)~J>rMdRT!Z{vqTPi(ax1&zYxCWg z^?BFcj^>LG+Vy#>uEO#KZY&b|d2?X%u;WD1n>~m#M|v0?Bq@mpzCkjVVVUBt!S97eK5l(!i)cJjDR5BHFKJ$fG0oRaJQzISg9^$*t} zgzWty_EukehP~JBXp|rB?X^3_6PV2eJ9DGwwXc~J&1hfakJ{VUWXSm5hBXZ<8_M)R zxJ(b1Wi@kOK6MvzK)|X3Qsa$@+uFQI+}8hPWRK8hRoiqq#fLBh$KjHqzV*EBIc)m( zwbx*Y@O%MPSl^(rg>Q5-C=v7;y^Yo!OUyi-nDfiI|9BMS*_)JBoVU@}238;P4aP)F zowt*iRPDlm);wjpU7nfT-uacGs1#E0?_Y0R1^?0LP^3l>k4;*nqczNL``!lD zr@qvhe;M7Uj8wU*NmJV5{*aFq!XgA4OALWIU>DPIOUWDB4CGsOZ2xR zF77Oqn*dx~b9vgvd=lqa`r6U{)!vGVUdjUVN>H5Y;W^0$Y>|UMyAk?HHSn1#3n*Ff z*gGDN!G8yj!6ZEP{>^xd<71rukej-2=Ll{}1@bO(nR)(m9Ixr_W*(!3QSl{wh9C61 z!}f)|jSY8GdW>3ryfKgIDeHGE&f5N@UQw_c_&5_G`eRz?=cF z6W#B5vD8>@uPCUljM&!(cK1HV`+bHqUUXq1cI79Lj7^w1c0?aB^<@%a8!ojaLme?m za3&gHFT|R?IT)BN_&JzG4$pxrZY>>kMSPW50*R*L_R>?%NF~ls4MHf8Z;&VUEJy1* ziUMdTlF3Xoc41bFbF*%<9S&huj_~m63)RSW(N_vat(vSwd`MT%gM?6FZ)XbtU*W9t zbAO>m6S|V_&$jP2=cm!7kZpQa$NcQ}l&p>iCauj#YflMORg3nNObGkPswG&Lf&{Es zC2Je$L~PRo6RS39Q7l=uWMZ2Qv}O^Xp4kz|)cfQ(5Zz2?S9?2d?(}TWbm>beXg0Om zJYA8rJjf`?<5_Eqa*Vei6f(1i2Fo%dW%?{V^{~z*>nS@@u{$U`is4h(7NBSe}_L4 zEQ>KWbk&n<@DcE+BQgX1^7IT)vL(YY%LBdV@+_9a6Ly1n1N{Z88p<81`Nz$9A#}}p zUqOO<*Vh(QhtlrBFiv-EAF7Q^UWtR!1s%~_^V3<++>Xb(#xQWNqZ)fw6noZrB#*5M z$q^nVP(S4A5vHf+L^OgkWF@`(D8(^ z#dr_EWa*fWEzo+he;s;r5O z`#s`{0=&|0+m|)v;CAuSL9bD#Be-jhVAx*o0r)~YJd3zI`LcKGHm_0P+S>i$J}lkN z6T2SGW;%Pl!J$%p^GnZq^(i8|L=5+k205CZHfPU=3qAu)jK4UmD#W9>1Y+I3XIAT} z&E|Pz+%}qu1a>{La#z<^S+;H7dBAv2-1TqqT~o^TJ$fy%c#P$L=9!bvt_H3mtz^%h zHhl^c{kfw@i0*&ECYo|T3puhgKC&mSXU-WY#pad9e0*?;@dv%ZzEb_pJx_S`9DYON z`#nf!-@~?YoRIP$C*8Aeim&|V{0_&iEC;sUpv`l842$->%=>ly(^oE@mXme_BdNpP zhbDAS5IH|{jmBrCjf})|F2(-t1!?8a$CszMo|CEMIP^58lHL7mdihVtk^e<=R^B)7 zw>ZuJ-`;cAe~9NB(Nb`J0P=YWmcMoiZUFioN3Koie)H2>vhqo*F5b{be$UFHHOo(a ze=dpNb8OAC#FI~XTe6dHpmOfYn$l&u|}`2P3Bdml)R-MQNSiMzV) zcPX3WC<^cI`viz0by!f8X^a;tAU7kJP^X}_{f^Q@&b^+P!>5wHY z53{8K{g&*>@>hP;;_k#pEjSZQ*>ksdAFj%|m9nRCo44_M6vZuF^IJOS0e}@p?_1Dl zZeltmXk4G-(h~6UlRx%0KIbiY-D@m#ZGCuy=;XM)u{b!g20ECXyzgnruFge0;JF99 zVB77TMKRpA^+PXQwzoU^n?1RAyFj}#UeoqHoW+o48|&i7KDvMDHD=phdh$b8P%KPo zULlOD#V#y1?Bi7c#wuUOv$l~XqIn6<=3hvXJiHir;<6IJul?ra@PZ>~9urF5c%w}} z_q{)Qji1d2BHvK%edzxBq?nPpCi_(ji= zc$``4DoZpKIV;KO{&_l3c%CmS5wg%KvoO5_*NCK0t=V z55DVX-Vf6z_3!A$dr)BzM=L~chNR!9DchyGA!`cHabk;HZ8~nYaV?UKSvG&HLYbp|m$|Mgh8h^ZOj+8{QxE4%Vj0BW6LsPs(7f6OM^X`*e5C z@*2$fe#55gfs?zldyrOYNq2Xf zo{b(Iw;myMR|Jb@7!4szM}~I4o9kO;92z#h6+|Hh77Y;a(`YuaEeu4mpg+ar+C2!le4kjH`I}f*O8Suhav$(k|j#TQqHaxHZOW zwxn?D^`))8F~tc|LpjY6tf>W-3uE~1T7qnx6GVLYbW~hAumhAPVNduc-1)v;<&k** zSJU_Ufn82;PDxHszQy7VH?PN+tZUZ>uf3_}o7V?#`^NeWwg2$VVBwq#3N9!J=B>Ns zmYX-szwpBAYj0V1>zWJj+3pL!k%)33zehbA-@?A(8`s`)0YU`fHQS8&KMLm*erZlo zVR3$PaU?wa#nVm>G42==1f^a4R{7)8te|Ph>2WdaiRV zprw3;BIYvvCxD@BqR_OcU%UK5>}e;vC^~HcWETr8_7aPIk;T5$VqY$v^6dqkXIgN7NwV-w$zaN@@-T)ypA^eo zD8tXO(8C&kYa%K6wu@~Rd(>io#A5FjKUVbm34CngpDq56S?pH-K8yeNE%qnHYg0|9 zkMXjJr!D?ZiGNZe;a{cyA1waX@Iw~=AB&&mnoiqg{Jj?cJr=vw|9Ol5sKx$si~S{w z{bh^&kj4JGxY2JqIq=fNmo4@Ah9&&l7W=yvyOlo2E&lIY?4MffvRfK+vkRwInr&KV zO8!g3?`dNfsTRA{pHk_xfjrf66+itQoNZ#V#eb5;ZuQT!_)oFeLl*lqi#^|BpKY-h zXltjN_)^l@aD&gB38sC6w9mJM|B}T%*J3ZS*sbvwXpi!v+c0MOWtQ+I7Q5Adk@l>T zAN2@n6U!{&ms;#r|K%3{%QTNF|AW8@^4#Koxy5evUuE&X+G4-PV!zH}UuUu3WU=3D zvEO2`->&_W8V__y{4cT@s!J@A_C`ziZ&~bC|GTsT#G^S6k4?O23EyI|->ZE^^;c$l z{yR&1{zvU==gZ{8?`3)qTH-%ov0ME+EdHI^{YrkWL54Q*PZs}2wXYEom<4z+o3g!_ zBCVoD+KVjsS>yLu()*spzFoV_Wu`~6+r$ow|G!x5R{sHu{|_~XD$gY{y>pX|pIYp3i`{PF2e-wZW;^IJ>-#=Qk91q!Ow(R2?HRVoivP{}^V>?5|2L)o zBujedSnTN*dxpjCx7e-e85aL6i~S20d(dLfwb-Xx?AGyTp2h!si+z^Geu2eq9lsS? z{4cWD=UVL6_B-F=zrbR*jxVh8sl*b#)M78Q*e|iz7g_9!ZLj2+{NcsRhb51J$;tLq z@v33kdl1uy`PdJYe7r}7_lccKelrx)c$YsgGw|ReoT501gX#64@~7PPi7au^nAXFL z|5c0qMvMIt6`$ixpZJ2faSi}w=yg=VS$O04j<`#;2RhUL_va82;>&n^V!GI<>~y35 zC6@9mRuucH41d1JSM*4Pe@DsJgnhm8r@Zxv3xxMP`rvcDczj~6c!(1Nm@+)r(kZ5? z@|pCUFFsQFlgvI~d54psO+);uE%xtP>^oF`4c^BY(teP$#&TxEaUV*kiO&!eimlVo~ViPseWB+^Sr7-$iZ|JMc7 zvSWtjy+_$|0sBD3kJNaVf#^S1jjz^9|FvSyZ2Fjn{`JZp2J90zh}X!NFco-w;+vvV z+3Cjcag|=et||GLu-7Vn-VO(!xJ_Jc@$XP})Bkp{>;lFV;x#-z@h$N+Wv3hS>r(b= z=^qwz(&%Fv`qwGD*G7BN{F}0O0QQORiesw0J<{GQ`jj138U8gzuQ#Rt6XJga=_ACwczl>u zpA6C_#D{o%;s@fZieLUo+6P4-2mq!Lk5BwU^alaJyp6{vo)JD3p8cIq{6x%6Qc)4# zca(esDDlZt{$~0=6;&K)K66t?Ze2{9!H^YA<9#r^IO!&kp@yfXTKNk0nvwtE=6h0)Y z4_`Unpwdr~_P+|R!pF47#SVp!8D7(7j|*?tUQ+m&;T_t@IDU3(8#oFIVB)0sF+c+N%ox zg#Q;*do%g{Jni?E_H#ZFgNfkri5c3Xihgus`oB~5!?M0+YMzPoF%A7Im3^D^zfgNX z@gGOhKJi8EG7EnuRHml?m$hL_dKZkNPr3G63w?K5==-LsPhv!T#5j5M7400=A2=mG zE491lFpy~&KBVfOWb%otw4W*eWzzn2Et3_c48vci>{|gt{%coS`seQ|`(Ek4R%=r9 zXA+FRSJ}^(_}rkqtLUHbpP5I97aKACZ)&}G(@>w{6YDjH!jEoDZ>QpiUciw5+CS0* z#^kR}TCHgn9A^6jJ`AAnzXkI=pSV-|OS&0=FMM}NTklg5@M8LZQ2j4mY0tIz?^g6p z_-Co~682;b3*&FG#CKW3r>OEK;$Jm~kZBnI-$EvAm-yeKy{-74!$hBG)$X&I{sC#f zU%OlJ!`G#~P4lSn&{w4WVeL~jzPv!%AJ^Vc@voKke(eyVtL)S)`NVE*ORgE&ly@=hJ19rOFui(<{cGo$zBl3J6EA2>6M^w&_-QIV z&UAfZzc!bG3dXGeUunNq>9N>8@v8O*3;oOH$l$^(?_tfRqSY$; zGnh}jr8N}*fFT?E#M|1WasEfO>lA%W|37GdH_rb!_sB|P`oE{eXPWjPUOw@@_Dj{i zYoz^S?QS(5x>wpi)V5jLf0i0genS6~fE$W;f|qw4n$k%%TSsd^g@?ZMsMBE>!SicwemG zKD-wx`1^RTQ1Fv@->G2c-=biW=6(eS@qS3b3-IQ6hk2FY{kVde_P;22Dc*Y(%yJx5 z@Q?BSje_^!{W}FekN0r}kK%n&!9T}4uHeh@rhH+(s{p4f_-epe3cdz#P{G#$o~7XX z08@L*xLW~Vtl({c7b!Rj_%a1g1zfG*Jiu!dJPYuR3Z4VFO~Ho%cPN-;>Q?Yk!2Jro z889_q#NkfBKT>cb;GZa12TUy$!*~JjS1{|}0p6ke>wqUH_zl3>3cdw!NWq%`QyanX zF9D{ef$+G`OtCQTX zQ84kmF3Fwslt|~MB>3he_?9GiQxbe<65N;s-<`qdn055yB=&pFc3u@et0zdzONOcweMo2j24)%qS%a*6}V^uov%D3ijj8 zu?N!(;7y|)G2fi(`Bndu?9M#2x01rBKJ*I=519VUPkRGDFw8Fzek$SL(-oIY;nCif zpu}H$$AlT)pJu`wcMxWpEHh!2YlecEk1RXfS(b&$on^U1!Hid-;2_=`70moME0}pc zpkU(IsbJDr_BBX<4&Z*}&OB+fW9FMA@Dmwj67IxXV}-*IZ|x5fl!v7J6HJ(0HerU9 z{U%_BrO}R?Z<)>?O_){UpJ>7*3Z_4e_MZ8c;Zc7sD`d7}A2U18<*#Nh{_@clygV1(@_<-gL*m zIA6gG%QDcNW&g5*gLqdenDJ;dW&*?f5^bFMX@91xnO~wFnVffHi4S1>n`2r4QvsJI#a*Ic z#$BOc#{GK*2l1BtjJU-2Cgo0iHz}B9rAf3kNgpMXiJ$hV^fu+HYIn>dQC|}P``P$l z^6?O68WK;yEbmpyo$0MpFmaZ3hcHYpIbX&}&{pC=#)M%U?WhFJI#Tr*r2GFe-KA_% zdY4={`2jO+Nl(B`dy#Ty+7dUolMdG__aNS#3TB?NtsxBYlw)$htd~5^On;1qif*zj zN(M5%Uj>kI2{8R>U@|Ae9VZq3HdC`Pry{I~pI8(t2BXK@rh9LCt69RX$;@5aOM#6`+Uz{F)DvZp(7xlqBxg*!Ot z&UDr$xx6PMP zc&0~_kXMqnZ<%f~UyqrW%va?l^Hn@Ad0?s;9_%RmfSJYx3T7HND41#7qF|;$GcMme z(@p04feAC5pPeTR(3LRLpRZtsrO_ssc+xLH!%2YsGw7@E0Ze}yP30xSA2HozzN+l9 zysSVNS>AI@Sn`#kgXF7ZI*`~fbMW{9Gwp>6X4+RNm}yIzAPm!%Z2>UTzDI>&+7Bt1 zVI*z}Pl=ntQ{u)+Im6;fv>l0?qM?-e>^xy4O#l-&IpzV(v?V*t_=by!pN^S#Y*a|#!XIL7IiYge{W@k%K z{%Bt`VJBXGHV9=B`O3VK<=D^60J2WiHawO=`-SN)X-Fk0jHIFJ2W7jPV}@b&e!#?& z*%M|ycUT948!aRGtK1+CJyTrOdRf1@EOaS zobSa52qVj@+85&_#z>O3MKXvez{?Mq`QD&l<|}ys?o6XyxibxhON^x@Z56M|ymHO* z%DfcKCEqIkl;aHw7?^2z{D7HWv4Y3S3wNd`c@Hqt+o8fRJ({!9Jh|*=liP|W0i@$! zAd@rk0Ze=rD|h1a4+_RhUiQK846{|a6Hh5m;7&YWQ0~Mt2al#?a**&;lRgGu|3du0 zoQH=n(~aVi@AHOun~n=#9fpeM_akfoC5ir*%|-Cu$qm_>L96NlvrX4=;%m^id3nEC8hF!Oms!OZ7v z1v4L+S91N%FzZ+LvzH(MOcowLV5T2bFw>WH4R_*mp>iiar3z-gD-_JQQdT28<6f=Y z8Gem|na(W=X53~46X&RciSMw2gLu=NwSJeF{>(d3ziEK|BqU4_4`Jr}cS*3s6Yj*V zLAf&xnnaz-G*y2m>y#507~-86lgm0)^z_h=9T!X<9>UC5_6vZS*Ieb!w69Vy)Bd)C znclq$WLO{O_r1HEIX$qgz1*2;2_>b3TAo~0SrSN7AcrGT&7^AeT{;N3(Z;S za5kR2)QlIz%MX}%N}g1(1~xsxUl1rwL=CBcIVCSDvGGEL$o z*UeIy1k-oLZJ$l~g<^PHa^LL#4Wl8R5>uZjfVI)lyKLnZ18R}iub)^};7%x9ymVJSOS$5g>;m)#u zQ@OLea^44b=Ceb&v%Ei4Fw6UE1qbndSHUcA8sU}rftielF!P{5T*o=R$;=62&*GWO9`LA4~*nnc9<}d zCV-jm96Wx&%ty*nz)S;Oh;(NfQm(?C^pQLOnDn_-g&|GuRxoL@MZu)WRs{#~en`Pn z@qR?Xd3g6KcoyD$3MO8%T_CTE0RL9GlLj9vm^4Tw%@L*qu&fKf#F=IsJ+C(1r27#Q zX8E;iOgM$GI=aPjCTPfVYRS5w56tj$@$#=WX;P|S(t%Y=cbXgU5N1AM1v8&P1v8&v z1v4L-#C{ct+gHpwmHhC(iF+S7tEzH+{G6F#_&4MLM?%Fs1EY@0p8*lk&<;vCddbib zsmPhb%)m^}FvBn?kkv3E%qSKje{4s?b9C(E z%yKcjT|D!x5X^jzN9Lu;IFDE11LDT1_LBK)3U+W0rY^wUUGo3_zUyv-w~pDq%d0_I=oF`j#XZK=l_=x0dfBSRe+uUuSX_G3Wxfcyy|E2s-Ic^1RVxB9S3m%!f}FGrn`0^ zJ_YRNLtygVf`j_xbJs^;`gxU{;tHAA^d@0 z`uQh<>1VzwpbhlL7{T<%a>4Wm>!5z4eL6;HpY~PSr+t<7#c#w1g!aW79gHQ3<$6T> z)St9Z{Ym@O=Vt*Y7U2WJcw+jNz9Xhxn7$pRT}uViu1yB-HuxFAv^T~&f`|6<5ezZy za{JJLY1d4NXZiOEW}S8kP6FrSNO1Co48%c9J5Lf!JKcChJnf{!KL!HGJRFGz2mjyw zyd>aBBKW8M%!Ma}^-KVVeg+Qx3{3l-pMgU^3wC}M?EDNI`WZO%GjQl<;Ly*&EZ_MV zIP^1c67iI{{5iApTXPWS;<>nh^uv*8aWL?w%#*ZRed7A9%){l3zaeM~j)8b(fM*a_ z1-L(Oq7@$ycijZ0f1Iy?$vqthb?7U%{sCq=H71@WQit4af|+-n-~>W9uR@2u`m)5+ z51R!i5#BGD<^N1@DMGjAL0F|Q^1tC_4!RfoQr=sz)1vpjiY_>l|el1(|Ln+P(Qo2kojRU%?#G%gSz?ivluda*plvtH*4rv0vth$o-xW5DEd z;}Mu;QnV~`X<1B5e2S^^Y#Es86rInVzFY@cwze0`*14MT2|5qr><4B(H&+8Q{Zbs% zVLr#RFz|!pkul}`BW-;K^|8=kx~nfR(^C?UAb2*5c$QTs@#LmN+3(7#3(9q6Nx7~q zq+Hh)vUVa@;xmpes24EHx>Dkq&hAbfa&Hz)?uP}FdzWBxQ*zq&$rHD26nWlqbip;{ zvjHwckN~Eg9fE1+M!~f6*Me#18-i)){}D_(`@4a_}~ZxEPp{Rj%!aVuLI9J;rbLK1=LzZ7S_+{gx!ZwDnNn z#43D1K7fOmw%s9^b^W?vmicYLwDYHe>BCn9v&=sUW|@BzoJ7bxS}ya%n*#fto${`e zdV0_3u3zneJ%bUS0H!_8W?;%GI2fNqc!prw>Bb%6S&r+sz$|C3=+G8YFfZ+N{(Kn# z;_NvZ;3NW_pG%3K3*yU&M+NqeC4OIk%Za5flZk(U4@e3}d@WIM&5Jh&`V~0WzBG&Y zEo#VqzgvU4)1Cw{>&|kCY41$I2!eN@h-bYXlz7(NwHM-P%O513e18#4ow+cDoKt~o z1k)$?2u=dKbqI9mgMoR0K5aR}VD6765B=fx5#SW@$^g$G{#1Zzcl?$B z)9(1E13a7fm-v9p!J*@59`R=ao%zHC0j?r`4Ihvi9J+UlWhFWoEAPdCS@#=pFn$2S zR>4IGxlCa^`_+Ad*IEl( zeAl#C`%!>hSOCiBrJ*8zy4b)&1QEa0T$^B%Xe~PjD&lLxRhI|64Hq{jOm8 z`(*Yv@X+6v38udr1=HqDf~$ZZ6U@B7H28JFHHfFgKZ^=M5FJb0?x6dK|0KX{n=Bnp z%#Z;%62MGP;)t)u2gKcH-5JEQZ4$uLWw$0~o3hTtY|{yX*`{m{#xtK=TLM#3I2g}5 zx;Y0p2~5$si+SRFpa`K}{AUgZwiO2PEH{2v5I-0};`0F>E|_&WO)zbqDwsCAa-mO~ z**45en_C65{5HWX|8BuagkKlT^7jcYL-?Y>fX;`HBBUMkC(~&MG4s(5;wKOm3#L9r z=L(niS3#W1dryE}Uc0{H%?-q@8-baRHYI?W?=r#6=lt0P07>G|vREIzHZiZZ#aLol z50n$LB9O^Abl#wE<1a8a7#n(Bn}u_|uFWQv>)JeGxt7f*K8g=W4Gz7Q4FpbX4C-={ zVAjRe5%Cn3OPvHl<|SqwKPi}gb!&LUj|9F|;^~8X1y4ihp6x(q1~7*Tc`6WcOA|56 zanEpotAP1^0F0;4-1QDP1HBsN%Z?&q4fF!Sulo1k+Ei3Z|djHBmUv&{W)dfXD+SY@7QwXn>qh4>qw_Np{|6I40uu*0+2&&er+}{!OrNY3%(Au% zrfqu#&j)@h0?04B#NI1<1thZ6tSAav!*no7%JiYx1nfeyJ6Ukb46lfcY( zro=P-GQs3vyHcMVj(->c#MMhU;kH2Gl8hJsu)KH`J|NCN;s=(YesKPI z%c%s0rU2T@oaxCZHcD>-zIn( zFw2e~!v}=r#eeQ#&?g@Zuv<$2(+_Sf0XzWM&D+4_7=t4LOh23>n0|2c58~+u`inX& zhZ0{8Lm;mIKkT6U$Xah(oks#4mYo2mJ(R3>&0H)%sH5|$4)%ZnGw&5R62R1@ zWbyFD9mMf$G+lO{G&PIcLwpUU49o}`Z4~M zz=ol~iN}KYQw7t8GX>Lz^97TmRxsP;vx3P-iFXH_%&%j?)mNScSsPrryIi(lTmv)T zMK}_`%y*q&=5w5!Bp@tX#~{mAKd?{ebtn#=I~zv=m}QL<%(5;N z%yKFOvz!|Qvz*0(SY3x@-$=%;}BXNSx?19*hs3Sjph zR&-_J_PisQ z?dk62h0{G(6i)X&Ho#TT;WyQ?TVSi#g`6mh{|3!ky@7~=&hy3olm4L~Aqv(+TCc)(A_vVn3zAD2J zKZFkm{X)#L`r$}Cix0?qa1a+DbZbc90l-O#FG6^hV7BS|1t$v*AUs+=_bbhl>U z4scNjSFgPS{s(S{LD)Z%^#98p{BN_ z{-$&*e$mV6RHvKM)vlCWT8qGx(aN^ArM9u@rdnrgO}aH*xv-_Fv9b}7Em3CorLFci zHrH3)jB3|bE~sCe28~TZaxu^jk#hdP!jxbdA=Qrd+vtr-m85W^Y>7+Puv5u!zEsr<;qk ze(?!&`l=yi?egZPmRyFJMC}qBFSXUpmGzBbKAW^~VNG4Gv=(GF*}Os6E5&vqlW0q8 zPTyEt$+3d;hI$Ms)4E{|`%BTjb4NcWIR<^dJ7ca$3Ub{HBC@gJg zYOTB(zr9%5+=RMDO(6f1{LzJTHuz@?jLgF(Tei5Rc2WIOT*fNhM80e>u0@rN%TRPy z$E&Vyu0sO5NBvFGr$h6i60LKi(*4X~&kX4!7_yYe;9HV&rbI7MWy^aa`k|#^>C6?) z*Gt6?UN>-piQc!ncapWTcWP);W-f6vc%QRPpwY`Bn=#~dMcR~J_Vi|xW==1_1;ejk zM4DxcNDfW$+Q`ydifA>*Vyhf1Co0{lL#V=%a;4e)OY0Xcj?V3;*j%=_?A2PY6k8{g zXxUujSU-d{=#^sGOrm9T>!?V!UMZH%Bw9AEt|H0&1k2^8_1S7mThr`cn%@>~8&K4; zy`4)z$v7qE(&=SXrosC#sh3i=LD9+99ACrMSB6dP;_8+a&AG;0cB-ZBJ9|y`)!emr zZmzzxt;rEIVegGdv*u*NtyYFKDQB_w3n3wBoBbNIu_34H_8IP|W5~mxmQsphgf@KRAV&#_G%v_q<=)C(+ z*VNFka7oCxrOOt$IR4srBUZwGE48F==Ayqcy$HTE3f4urbi!(QSM}rZ^{K8EVmrHg z3y&=_eaJQ_;4^@pQvVXDf2X$}T-OX_l^=lzP`D=fV!^|?L$@;{pvRXN)j<1~|PA{&kX{rnsQ4v;E zN2G_Dy`B-YAV=|{$Qqu2dPp65qq#PcD=IzAoTL6ZsE)545_{{z%oA_UmCKqV{CB(@ z+H=?ga?pjP=Sa7Gy_bsR&%Q0mGC3@x4;@=hq?#?uO+j+g5M5GE4O>oxk}XBdko9tO zIeqBZk|Nb?SSjbQtLD2- znTA5^*xbSM^U8F%rgV#~rL{JLt?P;A2@AOiD_X3)f;DaH3fxHYss2)~au+tWxT~~0 z#LZY}3;bvE=e+m)XNj`jNV^A4&e&=^wl~hSrsh-%oxwI=h*!F9kq@6cU(lsuT(k>L zJeOJ8pGYQNT(aEaZecS2hm@M47d7 zZkk*=A&HdJSi5v7$5w8pJ{3bcSKjf-qSZo{97_-`?|2&^^8}kQhbEUcC#ad0mynJ( z`=KeDwD)}hV}m&+VtsRhS;CrTy~xSQ8l|PPC%u4|M71p#Uhc6L-Wk?3HTsiYNRgFn zJ8-l{XsNWnnek0_R%kW)sWJy ziEx#v$1b2g%<4leq~b*+Sa{ z7uxC@{ekVWRoB&GyFgGx@SG&`;))YQE+spOur@M;126g|XI$u}t5}-bt3! zrdrb4>YBc3Sn(4qVJ6Me1y)9BHjswuN|5j(yh2FYOGvY+tTC`Y8$z^ z)GYLZn?c;vH8d?+);poLxjsm+y~B+_naBNBib%69la*{aIaTDK?44v8vrl!GUw0DxFw5gWR&92dey^}1VO|^t<@MykXDVDBRV%S&0K8ZJk5tB()vNa?~XlPoj zxjaUbVhzciO`jK4Vl*nJ%^8&*mMNW6?hzyE5vdSncfBol=7{7ltBf_?>^D@(OCG*| zkFeo5s?n6eYWzePjixq~$>!KK-rVFG74>#5Esf`kT$fEFWP)`MV6qazRU$4E!9vm> ztFE8>scOgxW)GMBZmAmKcvpz0MegvL!^R=0HZFO)ZHF{>I

        |VU)EvXJ$^$N zU3xdD#du`I!U@}b5Uyx+;ew@0$1iGVT7a2`@882VsjaTAT;w)#xIdQx2?`C?deuu? zCr$~^B6bnEuJ87J=Xh>C{(|7oj85qD+4F<%>`>+JzJ%}novdg0TPA_`^$&2NoEsGv z!@p&s{5$^0ig~P_rZHXdGteVWF%r^sXYlv1SK{v<^Ks5J{teh;9v}bSj(-oPqI}=* z__i88{=KB~ef_=J_Ekul&$k(R*1jEv53UILIz7HwNQ<&>wa53A;Tvf9zJV{Iu>PBm zwAXQ{Xnh}mp0)2F`1m()^xt5FTHnukd=((y3>_8a>-6}Jf$wSPk#C6MdtUgIg5SIN znv#hgPY-!~Tk%JDyM^y0(PR5Qcy4xmUxY!WBoI;iKJDqfjfC4&38CsOhaPcC(&pn2 z@f(0y5B}XX(^&4yXe8_BHgpo@KyrwWLeKIY1RwL0kAI7(d{26OtHH;=WmHk_Z+d($ z8a}uz6A1s7SVj4UdVI6Mw+%|G@d_(L16h}m{b_A zqI}@ha4#+~x6=8@{uUu6)zLZ|$1}zNr3pA@rCh zg@ZB&eA@rYaISnM9^V}Bec0s)KGeQZ9$$mu!_W@->SZ26GdS4_K6H&xl&{8{hgO5H z99s0>ScGcd6&~L%@SPvB1$sQa%;Vc-_{JN)-7w7h?=|qvh~Rq+dbA-WX|IB>6qxqW zPPK2X$2S&@F@yz(P><5?@eTMQ+6{W-n}l@b>pv#jzG=7!vAtB3FAsXeDM={4C)2)@ z5vP2wj?U(*0p9}2!$A3d2|deK2EOG;r+rgIkNtTRt}E7m2f>#>yo&O@7kZYj8+`n` zaq@9KVjB7KJiepgyAAOw%E#}>wtPno-^EZ?zCXa3*1noSL7LC^Tj*K7kzJYjfOab1 z_dLEj@Ug$EP>-_L<100M9Pi3^=Y(wgHi9o|{B}Uk+E)&~k>H{KQiiYA)xNFhSJr>Wz{mcsqI_S4p0%$EeA>PPwmNdo^^a$MJR< zCQs|Xhp~u^>VKC&&)T;UeDpKxJKOM`>hbLYUsQiN+2ecI@Lg;8p2T9o+V?8>Mj>5A z>-$aUS^J&_pSJHDC~JMYJU)Ig%N8XQJ)Yj}@$m16+Qazm)>~W3O=<7$szu^ zH{RxekNL?rPxN@c+vD2?zLOEJqTG*pd{u_;V^G%m7J}dUZ!h>tl}z+_8iyY9q<8{p z0ACeC+BYAe^8Ep1mhV;Ytzm=+^(enZoaH+NzSW2)-wgkySwXbemwtdC;0+T5Fs-b7?J81ao4Bv-5zEbeD zBVC0YlnRfp0AIeU_I(oRYTxr`XWO?8d~7Eb-XG;JZ@E zM31MBdVDp8Z?Wjnj=D3m?c>d7)cjWsJ!@YF_;mhjHheQYz5(F780jkHpnSmN>o$BX zNZ0ySVQ|>-F#~*~97FJ-d>{A5+ivjbeAR0BKIrjPf$#nZzLdvT^p(tfaFgNt+!53v;qsO-md|Ka?hHv`#Z2Jy@FNt&&_1`q;S^M4v zpI*;zfilzBU(WRSUI*XLl}z+_n)LW)d^L0Z{fy|5?=Fw;AOag84?VuE;5#6B z7%1Pf9$!ay=K0#^M33!p-6`4jHH^q`AUWil4Lxh$Tiu!Zt`|M>UEuLGgD=W|t1x_D zG<>&s*Q28MM%#C@cRgBd___?=Cp^9+_;y9uH_zkSYxuro_zs+v-M%m8ux}sqZ2P`z z`0h1)_j!D;f$yFO`?@{8sarDbfvGiYk7MU$+t-GRYE=9F0(#cIR>RkA_`c`yZ3G{x z5{mYhy&m5V!v`4J_n3D*pNf79%21T=8{YN&b;GyS@O|Fnxwi&+1J-#yVy+VUTw7&fQPRq9&d{xllczX~b(>R`g zpUk$e2=its;#HLIwPZHm$gP?6)x%I$zGt9^qQm*L9DIMqxr*{Voy_Jd2OsN6`@Vrt z`DS|eTU^IS^}p%f{nioi>HM<8@SW@NO#>e;t)ZxWXL@}6EeGY>Y51Nm&93iJ@FhdG zpdLIu1U+)6cmkOXz6yk_FXs=Yu|0NqeD8wq9mK0pkFp(l#3`OYy1-Y3kbK`l$TaeG zC$sH)`}FAc{WA0{-`n8hI3nL}gvz(l;~Vw9SnM}QSD_wdSu&fi7=uFF_erEH-$1WD z3eJdr{#@X-$8PYIgNOD#W%z#QU5^srTZeQNweL6H_2@P5Y5Q`#t9|=NXZx=kd}xwT zly498h*OeMdVhv*FXEK%YaZWI;Dc%?%J&tIuL??4&|-b}BUHY*$!z;-a9)aZ73I4o znQh-*@M-%#4Q1uK0D5-(cHsODq^l@jc`}>t2>2SHMEedPRK7FL$>vLxM33K7p~pNa z9F!U8EZQCiajtxY9$y*wzUp!WA8KFR<7+c~&lV$9D_(v^`!heE&5h+rFYP!TTVnIH66HUqjE@w;Oy_h-ZCYM98!v90xtVso+~d z2Z$)&cRjw5xTvj%4*7n9Q2DMuDce5Iuc%rm%6BdFh*OfX4SZF==4LYpH?+|J|o*0{5ZU>w~ zdsLKf7xXM&=_8rvAisyQ^4;U{Z3N#}luYz^y20bCFns?ldbDFKI=S`BWYml60~NLJ zkAt)IYM@uDN(fc&b?6bNB&`AERshp4Zz5zG%YDw{>i{3Wk6%Uke&F%#0-w(JZ$Vl4 zuJ-(L_sPm%h`+09Zm<7FlN+#v<^m%W5%z<9iIJ(W#o1a7PLO92^ zM-B7_M3j57r`G^IxG)s;UorHEQ<5_F8=33xyNFZ&HG2N*%2DnhufKHX(Bu0`TaRry z^x8bV9ng!a$EToY>oLRBBaVW!9%p;?IGUr}XT5&#Y7V_UxR15k8ii(<4*!9-)$JI*1mhe$Mva-+Sdj>Yv0r0Q~wP$eAOP`F7Q38WC)e- z29K|3N9MUGe=kApJLSx5``X4w&j$(US^KKM$9k|mPBwghEY0TY0N)29?0X%0mT$S? zd#~ZE^~TXb@G+l?;wtD_zV+Z^d(uAsR0Gr8xyN@1d}k{eLgky`@!f0qPBVO$d+qTS z_%IcRqI{Qn?XeAfx^CxhP^f)pd3*yV1kZJqQ29zczE=(38HVp<^beed&wcI%UsV4q zh90?7Qc&{IO#dq}d~ajCTE1Q2dqwgvQ2YJ_JpjG$B<+~t<8O#Cjs4{p_^|aYpBRiI$>#Kke*!(rSB!^I z4Txv|JICLJrDqkM9=nC7?$>&X;Om#e1^tt2sYcwz6&kc}g5kS;NVa`5E{I+a-3C2t-@#p(b=XA1x7g!r z1>e6RT}ADy_xMuZ%&ec!H+-K!KVbGkA((t&bpLz5r#Az7oS#*++$mnadJW}jKb>OA zJ=?3tI`An6ITerg>M;@z5z#fApQjqWcfEeK9(+sHIK%f>uV0lKzKadtU%h@%Fg3c} z-t_uGIrx@~ebWrzFFd}<;EQUvpLl%Rz_(5KE;W1`J-)Xt%J_`cR{wq8#(ycp zSMTw?4ZbM<)p&gK4c}#k?@VtU(Qt9bCTm~PTSwFxKK_;%>%sQU_xPH@cQT1Yw7&oF z)^)9hZ>HhfIV!u~cYrUdKR*IJa;K!6HtsEzH#VT``!ZI9B9#hvkl*`FiBXxF7R<(ucCba0X@rC@kC~S=e33}?#)--mqb4w zf7e^ry$illv2Tvy`?IhRJSJBLHh*0&XW zBgMXXhVLKVedB!ajf=4F9q3uUb%u|>P0cj+m;GLQtOH+h1m7O7J+^`mQLcUG8@{a` z-@V|wDuVB;9^Z?G?*_y7adcjshW+m~@I|dV=R(icx8U2E_N_8}@AvrL1>gDz`=)q& zW#B_sb@g3f_`WbH+rD+U2^bZ@w;p=dz8di9{8D51Zua=Lfp32VUyH~0F!*%5Ei`;j zpmX3f^j||N7E4C(@&3x%$Cp~lS7-RX;_o+-#J*mF2mPi__lfXc@;CF?faT{pI7jm%=m3Je5*aa2JmfB z=OLs`l+Sv6lfl=3c((6NhOZNGI1T+*{K4q!QMIR62EEe}r=sOP;Emr3=*?CogsR7V zPsAxn>xO+C=d^F7vF|e;Ul;gVl?3_KjQDXYCXQ_@f`$Tz7~eO3h(mxI`;9m6$3xthEVxl!gB$fhW+Z$ z)fo<&qI^f7N1S3Lgui=Dzp~xd8onJK-*e!5ugej9DBnXKU()b(8opb>Z|!>xd{O=2 zGtjg4jRl{!+Z~4QV;?3+Q;9fwR|%S-<^iSIyH{iq3^TtikvwZVSeLrvb zuJ`!Hg6{@34x!q2t;bgfKAku2GJJ2HlWpHR@Qsb&`)}x3`(6Z}UKj2*e1|-~-QfFm z1mE{PzT&4d^Trnp-$%|3?1Q_VbYl{VT9;f6J!@Y#_|(383}1Xic71n&uQFda$3TxbCGoFyeA>SE z8NQ#QqSn62;EU>iFF?=QH^=bZZ}_%*d==oUR^t$ogYuxqw;FufpC2%MSHN-BzK6lb zeyO5-mqE|kw-uY)hDeZLJo zYu~%ZzU_wZ9*^%`@I}pk8$7id}CTjlX> z1Rvi&sHp#L@%RpcZ4SZ48-w%29 zeHVN>Uwzl`jq~_k1YZN}R#E?zd3<9JW%ez7&+wHYBTmElIrZ^O8<11^K$qpe9pEcM z9Q(`n4IieBEWR1wV_p^IW0}M$NqEZeJ!AMrdF@dLzS)w8f%3iAYmbBA)BElp7`}H( zvhCXqK8_z1<$DWy*1l1PGw+iR8@`j?m(ADwiC8SDWC)dS5cDix(Z6Tr=N}rr7jUzN z)380(gAY?oD9U#jdX}#gd{xk5dpvLW#tq2kdkuWbK~lwK(6fB2!Kdx}Bf~eu<9i)^ zSo(ybd;>hb^@i`qhVL*k*!mV=vPafXl?_oMI$oKFZa8`l>1SN{_D`d}jw)+^6!*@c8Ns-){`xNnSnX z<*3KUvF=2+aQrspsK;FB*?P2^a(`>eE%*4EbJXKJkFU+}{m$@R7PaaHub`uQH;Q{bx*zCRnjX9s25cQ5#gp{JtueGhupzJlj6 z>w~`Y2?;($Gvf+Ej@D1&kZC^3Sk`a7G(6jc{fNvV~=)b=izSp6I z({Oy0gYR<@eE$hO%hwIQ2I2d=;VbsW$6oM7-M5KJ9-)4Bs=uvh6FbiJo7chMu*r;76JM zcaq_|&*Lit-?|9Z#dX{e+__W>hyWTj?KR7&_ zZ#DSp97FJ-d@1NzzBj<9#r z)p>l|z&9CswC^m#H|&h;_Sn@JJ+BRcp0)4j&ob>%X83;jzHGkNz;|^-fBrf2EZBwT z>`M`Rbspct;9D(x>^Cfn<9Dw&U+o4T<5kpu-}dIK@|QCAWm62_W{>Y_@U2xcgvxiX z$2SLj(~!>kPBnbjB7>d(W-W=n?tch++x+f zeA5hHZ6dG_)1{O3;8PApD4uzGpogqZHs;X#Iob`bi78(f^rG71-%rZs%cXbfx!HPK z!8b!}V4(J0CF5M}dkuP{BJ>iIv-t{IGCsF_g`$VczmplzD;CUvZOZfULjzpSNXQ)M z)dbLeQjf=3X9b}q?S`He>QJ6I2fmxtgHaZ1jI)F2&M zoL^|)gh^A*PZ}xjg@c$WlP9~B3ojCotQz#$56+qyk86qKz9B51W%8bY0#`xG@O~qs z8|zoxFP1mEUo4IzLZ*}yta!Qp`Sz0AJD0SVbaw7*FX`xfw54Qid&!#4&Fv+(b>7up zvbuBCf_<}#3ifaAT7}mkg?kE)4T!Dk=>f_+oc~fkoQ)ea_pDFAY%dwwS<+rItaE64$?(p2`@Y$CY(sH-`oEO_`@+BHtvNY1Iz9Z& z^sxO-zw?is)7wjmJ0r6dora8u`~N=w?}Z2Y#}+2ILKw%dxgY+rd7z7}O< z-CaFB_lz7z+;t2|oq6rUV~AVdQS9O_yQ78q`y>C6`0f(m!hvirU+>gjdXMx!%(jL4 zmhCGJ9P4qJ)}EYK_#ZtPUB|6`0NQh({4>gLzcz1n+n=Ys10&im>t8fz=JP$QZjSyp zWqPb5&sF0z_c?^0UGKeP3rZ}^j|E{o2vJ0PUg3uBe>m#GqP)=ax%t)8Q{n|Hp07u* zUeoz#rZ=~j+{(_~&OX1YGu=|swqRey@%wkzUGtWdp>O}b|J3xseRYqv$3MJ$^V-MJ z!&j`C7;Afc@8eIfx33u=d-Bg4N``I5S0rr8Ta%1!?&-PzlyUAeZ|0e?YtutVr;FeD zW9Q4A6FdIMo?gtJK9oJZ!u9l-127_nwx^3f`p0u#J||Ks7W;cX9D}yNCr00b0$9_w zc5i3lmVFg)BAq4?;|flHW8v;GL9yqUl6HRo4dj36J-^Ri^LkIFe@phz%V;YQK9aX5 z|8T)eg&>~$ARDCUl=U6S_R9*{Kb^aK>phv(a88l^fqkE2!jnv&xXAU1lU<*yKh$F;*2> z0zcAj*Xd5kcH5uNRGYKO`nKiGy#8CZ-}KiD zYj*F0QJj+|I-^c?^UuFL5qA}K9VV~>ldnb=9zKa?M!gpO`GGYi(^_ zdhvt_i|SkJmMs{MU+0=ot63&A;FsFQ;b+4>iJx{J4~-;}#sxVmCzVgSpnU42i*Uv7 zEyabIxPsUp-IS&=`B)Lml?4`VQ?L%e&ApNQSbuZI^@E>2*h|M^%t(ILn*-*T3%%&% z$4)caOvlZRk^HPTkxW0^r1Jbc_wHLGxlSq4g&Z)?|HV6>;GN%S7C+SIWsdRz9K-O- z5qo(8xg^f>ez8f$pVa>>;#GKVPF?x;mqss z3e(@w6NEe;=9TveIS=YL)cwWKpAy^a<^R2R{&VkqzS!5`@?-Ju z`TJ@)FLUW7v75d6Jmj5!!8`x6oL}bhpBbz5{I$V5|EzcZ6FJB2JnDN+Y?;&-r_Ntn zyz|d{=f9EjWiJ0XW{bsT7?3(H_Tly@7H0!Mcs~{&>Y%%~hz|>JlJUa>TuRJLka8Re z@zceE$=xiN_enPi<~`Caf?3=Hf_V?~ieQ$Xk9Hy_ix?_634DQImQUgSJc_efhA+9| zjDRF@sLix9ehNMyT+7FCA3>RhBQ703MN9$+%TBN&kTE!jc{)}w>orL*>orv{>vgGM z#?2JWJ~T@(Ipzpv`Bj2b2p0-w9Ty8`-d4fPdy8P!sY5X9^ku=ceVbsqVuxT>?McB& zgtR-3Zcm}zaok^0m_IJl9lJbWbK&pWr57}{sD}QyT%St4ep%7|03Lovuw_N_afwt- zOEC3HFKeyC@2m$jn$FrqCa{iK3F9-rx~iGOIx1_Rle3ng8dkrJwToLr9~&$2)99Ia zT9*|;tAdEyMzm8Df&2BlrD2L|zSeY0YbMGyUqlpsQ!@Bj@}+$?D1TitTQ6sYt*SbW zzp02{<*RLJX=>@S9BE2+zGcm#nX{xQ<>-zijc{VLQOe;@6uN#HWnI`WB+>hAc=d#7 zb@`=nO<|*XQEar{zelba!V@^l6kx+79ml6jl3+Cob~m&GlpdSysC3Me`{9la!$|u_-u5CVkeLK zrBo#e+a{x^NygQIiIwSe=7&o&Ug7V4hIvBAWPS}a+AyWmUlcu#dq_uHgWt=nWbYo| z`$scFGwPe`YFqe=tIKMa;^%9d8ab?aNjXs&jdh*eUbrkz;X-u{;#9C)axxvC#F`|R z%peh;yarMp$KmUhxs>2T^>*TvI2A<4UdLKz4lpnEw1;WDPTq~f^3BIN?;}-|?{kQ- zd?_qamLraQTze_shd^%m?#0Orq^l@j1@tW6Ztzt>iF{m#DBt-W-!bt04CyM$H{RnL ziORhSCGv4eseFrpt$k17{>iNo5KmFQdci41LipVsr3lH#^_lX`0=9fFf{)J~RFv-u zL=dMWA&E6q1u*#lL%um6vwR8EE2@1z3?<7~2NG>x-ny!Nc%f&`|iDE9x>CWW;a`y1=arJnNL27lT5wjp7Rl8GKq+n~ohDV{)P89wfX zRz5tp&*IyP1g5Ddjzf<)B?&taJ z(|G<73>I78LrCD-Rz>-)hMwhX246Xp=s(_uE8jSe?=>VeD4FQ-w9Mn{2A}p9-r6eP z2fg~vK|b28LOn{#tM6Oj<2a&yyd_q?(>=Z_@J01!-6xbnUP=)>|e@vz~kGB^UGY0;DdUUeI8#G_|$)AB3=3Xz4iP}(kT1< zz4g0{eZ19Gz6Swpe<{EPqLBuPsD1YV5T_*mRbwCT51Gbxe90Rht>BBY?}#@(rsBG# z{yWd`J?ZhS2OpoKsi=M5^!Vz)r~VrUWwnogf6w}|EJ{CI3~B=CKAFa&R?5|+dR{b) zP>1pl=-GGZy#7+yuPCZ_F6>5E4W$8mZBhnY>Fi_H36rKyNg6rcJ9IqL7yaYEL$8nv z(PU>u8J@qzV|cH78%{rq13f7g?~z>xTzmr zuB;!;H$Lk(B-=WRH*8;df7h9-u*H8{8D5*5U3LZV+F_poUOQ~D!+8hNv7)Y-qxf27 z?Xb}^Zy-2(+f;Wt+0>ShiKc=%p= z?XbK9SH+6TX7-B}EiWvH6;&L_ixqXOiN}hj&O}e&-PsTMH}~{hxa|}Y4Il45$GOkE z!fBv8P!zj=INwXJ9iDgK!r1PDSp(LdHlnEFtly0&EClrdu+GC9qN3$9K|OWh?+SKy z?|q_R#E4jDVbOr1)1JpW{lPyS7C$`Tc})Mq;(G?%fA^rh4<(CE+woxW+(83T_}LGh zx*7gCcLMPJ!)^e+f7m>Subp`s-^iZ*;3e+#a`zeF3)duqdJcB=WIfhyNVWgyD0I3z zivO~F@?F>x)Y08B;J_gFR(DuG=H77nmLDB0y7B(^pM;;GI5ib}X!EQu(~y-;XL$V1 zf#U{*Z&T5>>DVKASC$mzofF@`Z-9H>PrtjDlp{{Xd$?`!5huqU=y!0adv||~?{_sj z`bE+EV3v6sn@J41j_X$rYX9R&Ge6qUm)iKML#*JI;xJG;dtLYlp{+@|_L!C3^}F_j`$NSN9AW@$L7hUSt2cPo9dCu9CH< zHRb5)7uMT8w%o@p6Al@GwBoi&cC4`e@j8$&Vtzff_Ueu zwsk{ybR=UB4sF{M@80C>Te5Rs(f;netYhKK{9r$bJK0lkxZjbX@WI?q4qk#+V8aF= zdhM_RcHqkc4SHzq?E`Ugq@?XmH;{K0@55kOvAL(``(G|BI_+Q_ucn^cJ$?PRi;G6Z zPD{m}+I%p6|HydJ;GMJj-QRWba~;#M{b9t&{GwB0BU7=?&6o_%K4<97!!8B5XV_GJ zZb%#$%zYsD3_Az?^qyg396p_WdBY&u^sfa)2eC>c99B>?fTQ(D`>cW@Cc;9~li1H( zb7tQ9n^ZSHwdWPA-FR~Nq8IryEZ7mj9xMHgbD|OStHb&3UH1BI#gF#%{A*n@hu6you5gtZnYZTsv5wJ2`HlG_>S7%uN4>MYuK1!=7xf=e zI^+&);po_jYOY9MRI+L4h~53R>>u^OHMc+5wr20A3)-%z-cxi*5nkmFWQjYk>ge2g z)uGhQdq32FQP;RjieA~5gm1Pj*?rC7Lbr=4sKDHngO;Z|`gg7RQU~6L59r+arRxso zPc7*hx@huMS57SIk35~%K(%xFGjT_|Q}KWG!rzi#ZViox>fofA7tIVgUwEEIVwh-4s*W|LVRLBNqga_0d1|-Bc6^y0cAguf0$Nu_3N14{6Km4_I}+v zs=7B%@9wVJ@nEuh`^5E67T@yj-UrLq-?O)SQ}OyQC)a&V^>(k2jMCOTRPHf6LD^~**$$+;U)c- z53MViH}T*#BaX(l>?;lG_n|>^6Mw_mo9KDi(1zV}mta%drwd&RBXPz%9jl54KR!Hu z`(th2-wVYT_Kga2w*IwaRo9Z+J3IRo6|DKWEEKf1nJ`oDczngg`jSuQx0j5@-l7up zgaswZ%l0LT@}0U4I1%g9Q~l{8rGP7rKo*hLTfBupI7ps!sSEv z$4B0oUpH~Y*!Y%x306q90>1gT_V~yPPmbSyLE8b;BJn0V7*erUr?J1=l!6Yn^PT0> zQPo6z<*sI@#9k=VP{;I@9d7%_OIpj7Jv}`MQ{m+`kKJyQtvIx(g#oAwm=exZ8H)Qdj?B0u6{Y7$8 zif|a-+&6YyCYG5y6}LQLT^7-HUIvd+XThp$hG69~%% zGo9_kcs>i5CU`8us{~gd{D@%Y`>0^v8&wLPim+BNIhG6NZPaH3^WJu~;3UEgf>Q{) z1kXVD9l^5@?h`y8;r9j4MtE589E3j-JP+Zkf~yd|4}N65XhWIcslb;Ct^uAQxDJ@# zr%HX=KU;7q@La+4Po>}n;99}7`9{I?$r8cM!2FIla?+n|f|J0wJ96>#$>#;P0(S{s z4*WI2^gq87hde1@e%}Of6)+`U9E1hLGJPa~`Mi?CvWb~aiQ|5n(hrC37vZ_?QE)uN z7!&lZI6D-C#pwPO+8yVBhOj+!{|X*$yZsZ4=d&#Cr63>g@ref@{D9yhgd%}GQ+*nZrfK`FiCOGyuf) zVJbkJ-+*ZguZrAzp{|aXQbX*N{_lAB02e|E-Am-`EOF7!&bX8{22tE^L79Mqm}Oli znEt#Mh zc5RNkZ=nzM6)7Q#fvH% zn`(NQ71YV8)MmZ95AsL6ypQmul;yw2kKW0YQ@N=o-I^Xhe%8{P>szbq#MGc@e;wM)X6G*5@YG$gzFG1 zyxveg2H@-65+u1#)w>RWI3;NhV>0J_em)M`!!(|k16aNth~xd83iT-G0T8En0^#qj z6z2tetPa!2_iF&lw;DQnEk?4_V|dKtJ1FliX&*1s%D2bkTL(Vgx2RB$vfJZ3X85?I zQojEKI{BQYM!N+n{ zl<#xUvwXY2R|+NCXZIc~_W0I;kIyeul&{|7I|9DtP$Hk*doa-BJBkU3>suA&EAaSc zqmz_FiF~{rpdRb{s@J}6fbR*!t0>+0n$6@)7f-i|U73F&y z5yUA;cpZE?e$SRP^8FNt<$D)=j8jp*7Z73jCgVQ73URdW97!YJERb2g7cn@Jh*wd* zE1+cgHiA#>I}gfCBi~sbAHRp@drBsHJT39~jvD*Mi5~gz?#|hV?%?DpOy0adQBnJv zrCjzo$`R<*1kimV+41}kM8qo7aNlZ0)5fAd+dT@rPE+VVit3Gl0csoL$=57pU`RQ? zFr0Ay#EE8$Lh`tK6sArV_2chR;PVMeutq4u{cjL41@Gzxk6Op)`1}iYyb}3ecqk6L z+Gw0e)N^tAM}_!GIl&OXb5cxT5bh15pu4+gUhYKx1|YmG3bv-3wItZ>#ntw}>wTgFl5d7PKrpoGudTgtYSok_SPvB!Cbfk(-dnB50 ztI4PRjUkWYtqW5Tdg!X5DCXa45T`T+sQcD(Mu`D`3a*ZQ&# zPB{Pke`-(B#EBP83I^=)$7{D3pyPE2O6OP|(3vmq$FZix`^{k+x_j1Mbg~=2`X|$W z?~jqpx4WVVz0uoS|96JAzOR70(60X9Ko^AHC&&IX4Bn;hRp{e7IXMgAF!X5l2?{P5 zIOiwYMLL#yrl$?(#{GB>znYeM{JnSO%`NHXW`v6{(ibeNZ)mMw%n@%N4Mk|zE^o$P z2vs&OThLHnZS?K5;1v*&h4+y${#m*E!x|RTO9_8D(^}iIINcB%-{*wVXT3OsEm*d2 zA*#8Qj|$A}lWpWu{82z9{urmVzWV=RLW1wdVNlpPsS4+IpR$fAJ|84L-kkKa2tD=< z6`eyW5n=gKIM+1lD*l+@6eA%O$V5IK)Zsxq0f*(Afphjb73Dh@5yUA;m}B@@H{~Oj z!g%sE zOM3PkH`Ojfj=v^3zg+Z>KgaFjO%6ooxbtWojY#46A&%)dPEe+#xzVHz8>4!9TDGsa zv)}i>JhHvJr>(ts)+zUN@r!(d{g8L|yMNP=5x2%ab@%$ar{6Pj_<`BjyNIvH8L@l# z>{Zj}R{!I0!pEG7u+1gVt9<_Y!sd+P}#M-x~ZohTI_J8B%tFl6Tkx|R`rP#|hZQwnpj)z&$ z8HZhrS8mw6_nzUGpY^9p*PIh;-~8DN%f_^K?_E25VterZ8C#>CG0)9Cii zZEJ^*YTtq^BMQ%eCQgU6ZyC6Dc>fJsitoAmlb3MsnA?_t4RwEWyX zYYRHCb?Bb1^Clgrb9LF1e{iDPyCmt{tAg)k;zkbaqHNi|65BMl6_T{jDvr1??iA?? zW7D_+^rNo!EvhX!pc36O@|JHvvt{}AU8Tn|Ye zG-20-mhaZ#^buY(M|>%N|97ii`0l8edwPmaqL1?TFg_>>n_D)--S;UWx{#ZzOcKB5 zg*3=;I1k?kRq*#r>Zb>dSoCfY_k})!?S9BacLm1v&_@w{9lpY~KCWJ3pUZe@Mt=J+ z_nl2$#hdv(L2irhw&LAv7Hp~19YNc8j?y%AE{Z5C%1u+!@vJgVi5CsPQUjarU{XMf zT3z37!M+04TE2q?orms1Ut5&7WnaP0XRG#MdL5$rbNgej5B2x-lgfO05F_wtFX&3l z94uV$eOVc^9>wMzdxc--dIqqwK=3YGTqKWm>S6qXyRH}G;%f6{4Zrp6ySB}x~snu&YgJlYw5;n}L4`=;*SSC07C z(r+(uPMJD=#M(jgt^su#)P>mDRgO=5yZJee!L=2s9KfgRl5|J=_81Dngfn&e+e=zwB3>1@Qv7d^pKvOJB!dqI8WVC4F1kX z!QHv}nY*4T>F8yyE1T{2=fF(&eM5z4(RtU*z2dE_9)r!;63K{}huuK;ypFNevOhDP zR>t@5uXmqyx&A56f_7-ot4r$l)^n4l?p+@~;fgU!Oy^?>`<4|{z$b*>u zdE1r*t%8#`T92R4kvmmbBspJ20hf4lhQ zo}T~w^11BQ3ra3+DY;})$+V(^%hKm#FXhgW@%HXRx37BTU<_`61H^gtLoX^>G4ZnW zq$|_yCFgG&uyfzY!2WRVAj){8-yY5*ECrbWN+yXPOD3gJE=Ekr z`E)Bj3(?F_d>Qj}9&D-@%8k@@6JNqt{IN0m$3|QQ<^#X&=_u$*e`*sh_G?eMZ}j&1 znZNG&UwOi@A$UaL+Oqe3kX=D@J*{^+LDO^JpOxPG{N%xtDE&|N_1$XhD+bTwW^u^# zLtc7=cYdC!0`aNrD9nTIFg)d0t(g%rf2XA1>e5e+J?G`; z_sgnKpMPhi!tnb#dm98( zpU;)ZLw!E)AZ9&=3uZk|6PyGt7fjn{3a0HJ7tH!K31&TR7989sp)P!R1z~x*$By=C zeVsq~0U3cq_x6n!%=(gx@wESgg30$`!Q^8fq7JF3m$gqz+QOA9_i?UVewhx$wWI8p za_z_uND_zc@p5fJV<4_AfO*O$4I7Qd4idKzF?ML zA(-Vm-y$!I`?$oj{06~Egl;TAhvie$w=6GS;-Xxd?q#Ik;&dcrERHxE98!)WE+mtQ z&tz;YHWi1~aT+lVgQRe1eOuD zJ|Q@T@CSnFH@;(IS@h2@1=ByT38p{a5KOc4IIf|e1U^|X?U^8$zPUs&{Xx<1cw>Fk zhpdl&#~bZXKd{O5`?~ndotXJ(6EX9-b_ZZSN>qDMFJ9)7gE_~J{j-C3)+c^WfLVWS zFP5e4l_aJjggUx!)r}EM0JQB|iD#L7FHarX_G!WN;oX8s^^jolxpsj*%iJgNNrcR! z^>TKy(hz6o*Z?OH#K#4gZJ<76wbjp5jdO5A*dFl-4!XHCE)6u5@iK2rBbNHYEVuua zIo$k)mkz9NiNv$MbS3x5vc7Jt0n_$Ii6_-^!L;4&m4^=N`+&qJ5pEaEdORh-O)l?&<@r&}@`JR6(q zqZ2auTJYs9QQ4y6YpZMUv>eax>lbFqAl0JU#g)x?vTwJMGQPU5w)#dsulJtq>wYiy z@Ev;c06wFoPxOzgn6)WP>FOKZdxGQB^-_$aL+xr?((vx_3A0qyczVLQGm}5EoL;XX za%^bRYDVb0cN@0cpj)6|_&D<=U_nDJtzWblUvt*#lFUn3&9CJ&G@*;gOP6MRKiF~1 z>aDKtT9lX$fl1Bj`j+f3En|Pp`W7=7S{L~>W-g&R-B69KsMRgz`^{VeUn{}VbYteL z%(C{+T0`oWy3L&S)srS?IiRJMUt5fq#&}QDwD?4P;N?)(jPt``%z|ih3%)+9sWFVE zpBk4%yoAc^nN`xj)Xea#tV=Jg>(j_+-H47!Mb}kMh|<^WMaaIGUWBj8;_J6cHdh~J zMk!~#(huvOYh!NKc3Io;vJ%+wvLakJ@?tR0wKOeju4D%f+X#KIp{d%w+(RJ|ukqB- z+Ujbd33_Bmlu7ufzar~vSkrR-u5uXHJbrhJ3N9T^`28@%T#Hb6?XkjZAf*Fjz8*q&3z6Qkc*@24k&GGm)BJ*A-k&o3;KCa2EeQ)E0 z*I*UpI~Vc9DM^?!Bv>nu4@hB_agYTzC)p`d~F`zM(}YB zq@sME^7zVNR27tHAD4Z~H_zjH3VgRBT}Amm;_-EWPy4goquPcHPz~ERh4UFohEVxF z1wfqAG%O&MkM{sfbK?WR@~y@>pCzeKk1_{kP_s||e$olfOpK0Xdo^8wbDh3Z! zLs35d{jTNHJ)q>{;{xTI=kdJ-K0e!0QNE9OeB1-7{e}0p$~O+c+BX&xQmK-O9#6}l z$2=*XKz4wy0U_<ePeJijrRH9KQ$kG|ChZtfsdj{-^XV%xd?;K1c=CGPlz1KG2slC z22=z@7g$6<5hf5M$Pp40h_HrH$s}GOiX;);5U&sgA|4wPSrb%@F}M*gjN--{P!L(x zMLhC*p6aSePiF#rclY=4|Ns2HZ_?9mRlW7pTSr${*V|P+k_t#!keQFOCx*)tKpA4U4Fz+h3BZJHd_`2K$EtziHKx+ahrGMq6+5W&UxD zZXb!*E3EA>nS>J~d?ImAm9RqZq7h^QjLg77L>ay$YI;u_l7mHO zceP_*b)=oP*dzQ{34(5=CUBQKg^3zI(=9&h%*Z97#nqA04pZHU<`?M4Uk$(0cUxi} zqIq0cfb|_kf|dyEg7=2FAJkx|irE_O-QSeCX-ulmn(Nc-DOtm3-muydnV6fq!QL4g zfW#DpZh%!Qzi3q(Pg7IOyH?#*-iBviQBCAFTVuE-rh_$RmId2K#hkF%yJ8oL2zX9k zBsTXb-jN5LkgwBd)T}0K?P=8(B!vQ}RW=g8cAEACC_!ST;%$h$aSjIBNA9k+yaT&a zILiJAs{`iJl`wZl+G)4i6{Y)JhvL-V$ABSG$PB|I{#txthxd7ZIxN6Vq5vZT)J1uD ztFEEUVWhF1Cq&fW>BMGM;#)>d$VXapUV?E$tNBHyn>vK79{~eurz^`t#wCar z$^EGG_gF&q46+PIWAwVt&vp&0?z6Q zj!&j*y+)7vVgF07-|=?8p&Pe;Hgrsf`GbD0d*G3`;~u``r?msVm^aUU%l;qN?F`xe znkVDkzjuHC{a=$kafAMO!JP1=^>@unzIODH&i{Dfy7o8Te%+fx^8a8@ZT$M~m7hPE z-SCg^52khdVaArB+rAm%ex~*h<43H{csc4>?{jfKd)|rMdezRFFMfV$QNv&6et2SG zw?B-1?9<^_pV&VA$T#!SD$j2l@l?&xs3ob7hWzr`-hX}mUDe>wy}bty@N7u?ZS$eK z?r6I2577gU9$$CItG|uxGHKbi^pP+8@^b&(TG;FN{cy+Hm^*gv`Nzbb)jPjG<-2)o zf~WTln^e9-6!ZU70bKC6Pd*)T{mA6=ZP&j%_{66_Z4OEBJiqMC559ggBIBcOJvaR8 zUq@%&Q+BF){YPE5|JJ_EUG4KypKot};N{C!Uw-1(%cp++;nnZXKmK|5<^Q~@>4xpz zr#CN_M&=KvPe%-a{;dX}`y1i03_Wjq!Ula9m{mrNTc;Nd{U9_W@zW>OY z3%~4k@q#`5hpBS^-wOCWD&W!XKP+7~_0^cGPyD>vedx=teAm7B%-T6)Klt;KPAljA zt=qM>#L%pNUjM|O;_EV&52;!I{qylTM;3Lr_Iq^Uz^xH;qc*H_zqaI!RX;7?W=Uw% zr{J+cZ{3~Ix!X&lmnT|AU3AUcTYtJYsxHdAVei{-uKnA6Z@w_=cHiSSU;RSKloMmT zpY6%9{OQKzIg9?c0sNj<;P2f4+I1ato-WcdKD^krV$nCZ-w?|L+CxzZby&vlqbMPAn=Ny3I1_M@vmY_p!6$Kbo?A{;xYPef!PHk6gC!_HR>; zyi<2$+k0N!_2X5J@7KQ=KlZVweSNOIe!z+~5A;latM9p8tGav`(kH<;eBX|+FQ-kO z_{QD0c)h*HRaFdmbtxPS*S~TvQ6;n#K#u zC%a9&bim`+b^qm_#)_Oj9DMPv*}tWgJ-PJLeLp|_^H(|UQ>Xsgb@uX-KMh#X{bcoT z>wkN)^4G82H{ITD(>vWJ{Hx^h(UGxVg>OCKxyIW4q6hD||KvR%+;jI|Uf(lzlD`As z<8mer|ARc9-vx!r^S^WY9hNEnV3>#q_72}f8Gak`^MB)ej$Kr_p)9QdE8aQxeV%`> zIu^AxV0N0}oh%>A@@8FF#q3>k!Q0?&kGU3-9$&s}qI)5JXUp9xedN;`@HIu^cd@)G z!}a*a*_tyM{=oj_Y!WWr9jI6EZiL}oT{^G_yKVa(JI@6$eT-e z>+eOy>U<~4^w4?Mwlz-YHS(N11kuadQ?Oz_-O9v4m@f6dhsU(kdw5KSJaxH3@(jO0 z^2A#v`QA8-cOW1y%0v2hz*)Q(0)OiGs`RIhpGjWBnWXmdV$-q8cdA4=aPk-=%0cE` zl!MII0EF>fG}15}=}!!jRl^U6a;ls~x_yMVp01n>73s=%R+u+c z=A!)Lba_$!Qa4ey`~mTGHub*OAjvbG1j$q9iIQhJvn0=SQYFuHypm@+Bvq%3!*`fS zLVr!L|F!nRwADLI>=D#EOd>BxkZI1A{>;lt$y2Y#B+tA&Cwby=o}M_&%lDGka3-nu zP({5E1SIlB5D>l8dyvFZd+agH8pU5(r?4}TL|n|#lSEur2uQ@09ZH`zZQGseY~S&` z^Sk&>v#q{H!+?MnW%T{kT6vdZ!2-U_a5nFz1ea`KN*7`Qubc$m0f{dMv?d!IG{~zZ zt?rv8kb^`ZazGKL-;%_Iwasg9PghO>mjBbdAs|u@6jrA8=C?^&>@%Q5{3RoH&`L{L zlFWCR__mM#lXJmdMG}byk8;}mtxlVq(kbYhDvTNA4H3}*^_NCYzfxI&GeW>?4fH_e zaoaHCOAO3m|CZnM>Yt|PPr;ooL;dG3Try`ezREo~0rmGkjCbX~8E^8O!S3Nh|DE*y zy?B%742>T=_}@wI--|bSP69SA_;=F#_u@^SGsr#c-%3x$OJ3|zmEX#yZ>McTO!_~B zh}S#$v-q`PER26Y-HrRhn_+&Ze@w}Ji19DRO$;5}EFw7GuSopHxLK~R9wdI1TssJn zPn2Pi?RC2}hac33VZ5JyiNlCD7jBM66)8Nv?`*_d0lYimM?7YSVZ;l=n9PVb84h`C zMW`+(7|0p%P6BTf0*J@qhQfOv@r`)%;o$R^BFd5K;cvtnj6@Y)8-y#oa_~mHMmRM1 zDN=YGPZ;r1fj1X^)KA%^ncw?y81eWF%<;G)g_i>lBVN4$ubm7dUNR0NUal-BcneZ^ zbKx@Lx$!ay<5RzLWf5CIF z^dF_)-4HVBHy(J?AVU36)qcDMCcH-A@p(m&!t$kH>XP)DJL%K4xR5 zha|;bWtKxiDvY9ve^>e|yiefHRDlLL?%zmnC3geH=LRu9&-dGma=IDPJ#3akqf=o?&OI3FCC*Co5 zFkHjI{4$9Fg9i@L-;6oC_hW{|4^Ge}&%BSv4ZOfWgT=4@e$1~;O}`3fkRQC;kk7pm za<+PRthC?#)X1)Uv7@jkzfDmaOYv^UI=pJAGfhq7u#)#9>w3I_p!;JbHyHR^CDVw{ zu0&>s1biebNSey)bb2Y7R?fG>KLon_LSn{anKwQk!#vz!&(0d&g&E+dy^12S{GIyY zRT8nK!MKimA0hJ&@tQ?`$hbJf#OI9+LiR4mqrnaF@BkES9D)3{Gs%bq!rKU6yaUAK z>|OAECL$>}BZ?4g)$o*fFM{s{jYDr9qGW>Xw$MuUb??)apC}uYL}9)?XVZvS<~v(2 zlj2t$JB423&apJ}Z7tJfLB{UDeh)GL*~dFjdIazx%{+AXg=E|G_g+q`<(YM*gkN7@ zG1?)jag3oF_4bCE(A(P{=p-r@ALa^Zf&BKGcu@t}g@R}G!V%K`<{Mo{{+_N(87}n1 z<{QN|zvh-Yeyr&7EOrfuN-QheVDDO0>4``Z11k73s8fvx8#O6C!+XhxU>|wjNOcrYI;=4g95jxK{JUVLnWg)%smJzSDU7-#AxhU!0Q2Qzo_flTl?9t`vUtz46g#loxJC0INUfAaVR%fLCVeW z-(v#-?jfrvnC(G@@oW<#?q;8s`w6sZ4ixgdvow=Uyt!?3<7Q@{Gk;e|-VkJ*mirO# z&EaOE?Z8O11sI8Q`$n=^Tt+AId!gTU!2s5;`mT_2_cD|p!-t#PAtv|rj0l>6gLCgi zbVy=+K0hg<+xW~u_m?UVXS$y^x%vGPMGW7g95~ZG%oKjVDg2bl&F3gZjQ^5!e*``n zBZuuA2uNahmdX99$^C)Jz1ieWmF}B?#r+RHGK?vSUuJUiyf6c;HQBXdP<&Hl;;&E^prgNJNoy;Su^kgpAX<5fiEv*fiLH? z1-`tb1wO$*0$*O*0-qE5APtAIy~L5%@B`|N!|D>OzBW8o=iT&|86Ql(hwk4FC$%=8 z#Z8|2UMP9u^^<&GoCirh0cSqnQhpT9qHMu4f5ILDUIU+mgEG{S?VdbkZjn68;7^jL zdg~?6ygn#-md)b^e!JvZPL+~p{%R!8{E@8T`X1BF5BckGX4>T0_lWWb&pe6pmppMP zgL}JP{@}NO7v&G0ZAQaEnT0qDd}+rJ_!q(xB=CFcyuk0J^8&xO&Wrk$4=5-azuks+ z4`sK}Bu~7)l4m+sNS@eJBv0(wl9$zOvEtUnybC?SUj<(13I0;>LQn7`zzaPkFZ2Y@ zCMxulyeJ3o%$kOS_~ZpX8x%<3U##;2pNfM7J{uHB;P=;gfj>a!1-@*bqD`@9zgBFZ2iRFCWPZd}-Gb`0)T#m;?q1OlATk%7l#*Brpf-yoQsN9TX@Ihjpl6 z^=n_2n-gCA77>YEfci$!ILR~p>m?8M^t~M*Pc?3p{!E__aO#^zKFMo1^V*<4(=U`f zbu5;AZ=6Zo6W~6aMc%>R1zzMG{3h^Bn=(6a7G*1WQ4ZkK;V;TT@}eBTuYtdYgK^1| ztg<{sT2u@q(sJv(NNbqRi?j#~5@p375bLr7cw!KaJTWelJTaz8o){LnS9b8FzFdks z$M^}PU{_ z)(vvXiX;=l7Px6EnpbQyDU+8>tfg4_trY{LC={6YT6}^?DNK_^3!&CZ zR|1(g5S0iYjsn`r&T7+6{@quD3?AxL+&iDzYmQt-%ujwmIvdB!nEHaaqEV7oq@n*^9 zB9p?WEu_WEmY%tY3_`8tYo3rXwS+)V<|@!fW~zl}yh*M(OD#m%YUHY;8F zy?~DXILvaqA1UHJgT(O&`9vI~P>hep<4k|*!!X`Q#Qg|omF{HlGjJ$Uczkp);!Oe` z??J?4b`;(p!Bf8w9HbH)ae~u-6y7y(8u2iL?6>=^BN?^%hb^2>Gbaqw59@SZW@ zWddX|gowxCs=~Vr3`G6)VFz%q`n?2ljFX6i^d0b2{i2Ea@mwan-oU$A#L$0;LF#J4 z8;s1U`sJ{Ma?I~SiKp^QyJH;u6;X~f4-EN4IzT=|R{3oYH^Ydx2#wL0-*Vt-@K>bp zk|AfrJAuebKh9byyemz3`+*m%J&!fvjYlQS1rF=uJOf^?!~={VH{5ZO=Sk_ucWjON zl>krWmyg;?zeoTX^UHlK`Ub({_q2_89Oo*$E(W}>0A|F?1m1H&@ERdx#LEQUoseUG zIo?$I&6fJ9{0>GyTo632^Jkny8OCp%Dg8L>r|>lBW7Ka30y@YzJW-CscchJYslXcr zf9mJLq40i@`l^2mr1{840t^ttnkz~$sjJM9s!Ax=SktEfoDGCFy7)o zr#GJhk{HH=?HZLB+NFtg{>R5#m_1B@7rIzThnb5v=L&C(cX4BYb`sg~& zv6#n*U9|SVAHTDsra#ef{Ve8PrPFh&N7(3YrNtyCYf`xVRMv>WUEhRtsjR%Hylqii zOW!u@?SW+mCDu=X)){-o;yVVg)ODSJVnqdPIxp1T22bSn^NR|cSrsAc$8w&jNE$_x ziZWM^9k?a)x)=KmcMhzM{JbdBTja}Gcf3XvJ2b_<^|T~G&nu#)x?&TY(=W8bL=|%( z7JiF$^!m>E_Q+8w@W?6M8D+_>bnl#K>Eg@U_?@>pa#qRYJyoM_*0VdpYj0Crw5YIr zcXec8-EO<3sLs9nDodAwO&br>hE*LYB*nUQdl(|l@{TCE;VnJ#SkY+Y;{VxEPlu!n|+ zv!P;B2mC%&a87ZJhJuh1%1{VATnoMRGW3VVBw>qhVP>BYCbv2;^%X`Ns?yDT9{QPX z2S{Q}32FS(FEOPj=^q7C*gWu=aoC@bQ_{GAYq%L5nr9*x%>EVKF6Nq3~}#vUAw zN%no!_A$a%AIf&$F?<3e;j(4#1CMJ%*_rM1&~Godyr2+1*@3vwOgJwLQ9#=wd{#Z$ zS0YOoGCONr@Ue%L$Lm&6IM^ZsifCvx%Rb*SDe}tlHsaL;QRF+TMgBvCy|`c0^s!d@ zKv&&@Y!B(xIYjJqZ<)lG41jFHRf!B;7s~H1cwKqf_^`r;>@i+fZgzZ9wPufCPmHYT zpNt@O_^uG{<1aRXz@8h$xJ)&@F1j5n_l%F9F=pYEn&mN{H2Xudyk99rBe2-E1U_lM z%na`r5q_*G5lW~->7(44@Gu^53d+T=5642feup(?9FHqHvz<4>@>i=a9g4e9NDI3y zpD>!~e{R?1h`5=!M(h%Kw`-4dLt5BnIRb2^v$5MYOY?cMkC>xXejJZnVHgq6jp3%B z=)TBMUUW~Aq4RL2-FB)hACASN@dPKGLW=S?n(&tx1Q=d!3O7FUFno?FeeUa~h~ev% z182IonB3n?oCJoSBB z@*2)xNo@LKx9^$k7evrHd zp2RkA9A}mt`8RQ9J{8Y=lBe#}L-EWr`A>0Xp2l{7KY-B(6agJV=x?4XPkf&Muu7AK=Mq2Wr`D9g=6BUX{Ft^GV4wUEYJJ1Jfm`vZAh57B+}!tNgM!I4?x% zi-SC6FOxiFNvgjUII=wmoLD`ac~EIF52_FB4!(n&m!MAMiIFII%Fd8H@fJv)c$Ot{ zeWO^~=Qn~G?T{_ZElWJ}&S_Lm4!WvHuMtAEW78nPUs- z)0_HQh$^dyRKXZOXaR^#k&RNpj8`Hb+>%=t^cSx&oXKAxRtrc$H_@T=)z?r1ERqVarBqOhWUJz5XBjnAg0dV2XrnTul96>AAlrK71c;rs zcBCYeG1^sC^2S!FKm#nCN-)*DW3?ag3PI|Fhuv`@m*LW-pdG+!*+1G z9M9cNcykSSP}PrDXu^9BVZ6U6Qu=K);VlMU352L0@9!$V>r8lk881YkHS4#=gvWQc zSO&yvXTW<=;wcE)f-;-oM7ng+CTJ|b87RC=iO1Wi((eoK@bxk>WW9HsbAv zQmQ_Twz*2k8S$P6Ua69(k~2*QNLrri-S-<97fyR zLBu!W(LG6l;jHk!fWHxs;~KVo;xRuAqki9@B8+&nRVfSv`}xlyXT)0wJXL;1+gz0i zF9DHy5=fH5t~BATFyI+&b65itpx;~o3|3$`D?FbTsyyw9akHdS05s$W8BVGwQ3;HWkc=wz1dk~E{4no9p;ZS%toA90o z-c<@r%F(&Ngja6B>mlW+$0oD`qkgULH`8q3p8OCF}#8W|o+1VP1 zGNfV9&uBa3eT&5Wl9b$aP(bNMf8uf7F~e2A!KecU4|D5Q!?Uv;4s{PX>pi$Xk#kad zyYG$qP})(WR>*3J;`dc?Z!oGKAdJ1a?O`)F%v?8f`ApBuDKp2+jGyV6>D(#4K`M+p z*ns$h=$+MZoU5j>hi-&(&e`vVNr78w``zc3FSmCdgL&~#%hu?m9qBO_wJXQo)^K7a z-c9!Mb@t9%t#Dl(74vx8^5~l7`-DkC#a|y)vtb`TyUO|YU9{;T&2epN*6pkAp!>-! zyTc=WW3pp?&TMQ3ozlG*;b@p{?2D&B`H03a8V_rxJd1SsMO=IhyT*fHJ!FIxA#gAR+iYWP*xInG z!=^x%5rsF4fJU%>;rJRhzFut)o0>FpYSIj!HG7~6LslO8#Unt&87thfBrN$+$ugZ9pLdvplvW z8UT>PH^^gGM~fA3oANb#@9crJ42kt-2u(|xnU*wz8Wii|t3%{ByA5~>SDmqsxWtR^ z*?#bX^jRXlcgx(IeOUd7wQQfEsJV#kS1LNav&}cqj*ruiwhs%(vPhUz<3yf|Tg1Q; zLB@!=i1r~c>pP?5QmkpQGuK;nE@|f2-HwbqlOio$vb;$%7v=Aaow2DB%lsCuKi6{8 z3u3)rJ4?>!@cQRf58aDo&bNoHSz`I&!(5?{xX5 z{cZ!B-)gKYT<}1D-@xhlA>P;-BlCf|Y2<<&FG6>=3E4S5dS@H!&hgH?HkQ2c4oX0Q z893)`+_}B1qG0Ft9e)`<4EFDwtf}KI@bAL#oTs3+wC})gR?Y6D89g8CuwdRLs)A_J z-I2knS3dHxk$Gb2F;6pM9{Lqn+h|~0|Bohn)VSkpd8WLfoyh#e3AoQt3L#X%#&-k6 z2Zm!Z*x-P|G{x#wz})^EOnx|;%FyfJQnBoWdj}4Zygw%3eyfP?8%*vW zP44duL-Hd1T~q}0F%GUdJl}+8w4Jg%!X&_7g?vY`cM4cR48KhB zoM+}Ylu2q%l&UCumzd*}14fP~)x0J#)c1E8tmcwCk>?MHtwzl~_a)B8vJKSp4jsw&om#CJk!}Nd8Q-ubbb?7DinU@5~6Xz1iGtC~hP`{ZX_!65` z&&}NBZw0qvT%0m5WyKl3>ls{LO;#q)TOMb6KsB0q$P#Sb{bU-!cfz^;oBU{R4+|m(Z5CB zg*JY}LVtWSk)P{KhMgfjSeYsKz|~u3C4)+_xaGo+`S?UFj7cINYyh`lh-TdM&>Wtc zjBus80uO4A5s<+ol#2dJ4<;16I*bV^7^RFKP8X6E92Kh4(Ay-wS-EunoE0mVwaALt zy0kg?3?(&Zaq`kLmDU+$Jn88xm!-`Ya!OsMYuMZJ>^8CtYCdVDo|T#I7JMSPMIjgq ziA$%HR;myUg=7p4SZkzY13WX5)0U-VB+tS2ochY7)0A(jEElwW-FBvTD*A)OoRs+{ zfBn&d{z}`HpCM(F?B8++Pjr!IMeWd;+YFMgprh@^4qg(51cKJ%mwdSH444b07yD|` zK8!caa+m8t;#bM-g&g@r8FnXb2qoa-a8MtHvCl6v;jMxn$I6Nn-qR+$z8D`IgAnnU z9ffzd36HZ>yq_picc&`DE&l-x9e)qtGe4-5KgiOu_PdpB#6y7i3 zjd(?9Ou_W~myDB$Giep@lzv7#N&~`-c>Ja)pKTN={oaR%QNJqSO@klxUW5YlZZ1(z28DSqaB5HW5l}$c#Nxv>5_1H1?ZQ6i%YdxD4ZU{xTTiq51_S;-Xc34Luk}de0;`t`)g; zh+xE<1UXclpA_CaDaW!P{Q+|GbyoaRj>jvAtl}`>Imj7Fh5Ze3#`*o1kvXOtCxw+< zN5ofoWf1Kx_3&UgUx`9CMY|Xg0;eAX#sSPmZ zFck`z$=Fb380KH?op%{rCl!Rp!L?LXC6?^cdi{1O=VuLYa zrXH`HW9Oe^C1HB}`Wz>x>0ZJY7_m9s!mz3OEAiZkOibe9b@i~l5eFiUM2N{*G`fCK z)2CtsGK(JHzA7`vv9eQ08YU(q=qu(6jjzd{G|hTL|JBx2)tEVV7Drq536p}<@am}P z(?Uv|I)<(pX7{rrAXn~0dRRRZevt3~UmXQ0k$-jW7b?;WR))>xmSUYXKZWopr>ug= z-6HLAR*TNS3c*?7wNYzMt}KZ?mgUTPVeoZ-nUwls6=G})-5Y_xjK@=7ufkS^DBreN zGK4b%SXdOH0B1^5r|U6Ta_|y68*Y<)h|jt@(qBB*#J~z?-NK?E%7u{rWg^pKt>xA& zO-=A)Aso?@Dv>p>&VF1!YI|JLHXI=Vm$pAxF+&5Yk0I@J}OnBN@$euisP{(_R_qWt!@1@iRT(EXm0<*@Ng$+kWV`vE_Vc_if5 zFl_x;g8)1C^@H3=*Yt}*%yI|pM`(_jo?|Ilj-?r4Cuq&X~@eQ-^x`?^6$mjUB}j6x1}$X<5M~sEGo@5yt&elDyqfXcBWX&!z!auK-di69}-ovd>qQGt8d0R1FC8IBHOTyQEQs8 zEDAYY-;Na%YDvwh^49!z()q96A*m-X+dszVA`ELBY3z+SLTskinZ_fbI}#C`I*az* z^f&a`iOpqz`insQafsL|Vf_!w2+bLQ=&)FK`IpUHm*QEye5$Lf*VQF^Lz=5|lI#3| zu1;w9)%&X5dYcjLdbleke!`fUQ%b7GK%Y>HZ^KjNQEcDckw0{s04-UURoJhj`dQg_ z_b)%_5gn$Ufqqe|rYsyYeRpU{HKK2g=ocRD5M>Qj*s9{ot93yoK0P|5q}u1nes=Yi z)lT2D%@@Uf*TMLc%l8~?V!N)^byQ~*kD(llZJ0Y{Mxdi(+f3s^NYPitoWf?Rbl5~c zWiawsjs57^lWnQhC9wrt^=xT}APKQ!f|F)5zxE&Hl_ z`^$D`SjiSW&&bbHo2~|*wXtW(mI)gs`1^qawu7FNQ}o6mn#H&_da*b6E%_bFw*YgS z=!wOBfwwuU!d7S8_O_rX`f+y z6U?q;Y}|%w7T#xL2kI^HS0F}6i|=9?-+bcuNe)zGqAmBXyuk8=#N+rnM9dINVVrDY zcGT#;u-PHPds$vJn<$^EGbuh4tu z1_$j#n>m1$MEnm;@zdriJz zlE2tgKis>6bPz{0O6v+!INu{vMEuRtT@OB5?gXIhOH@_8$IoXSW$$7HenSo;B<>GKMrKf{Sbp6L&eJoOqbd8#p9 z@=Rii#FlU?L!)Ll2!7bwLjh=V>|+48&)8 z^32cbq#-WT8v|5MnNK7W)vjK;X<8f^46X@uaWPi^Ks;R>pV}YJ@+Lq zb#{}NItxAJD0eXY)i=|wl04I&D|za?K=RaivE*6Kt0Yey*&h;z$>m9&dKF8aGA~G; zG8K~7aITj;b#IhBbw4P1>MqLRA}}CP4s47d(Ke_si1Sea9I11)9tipsxMxyYTcLU zH!!EiG!vyi^KzZ!soQMHGw<^x&pa-XJoB|i@*2(?Bv1c0B+vZ5BYBqDhm!A&^JkK0 zb`D9NbwoW>nNSba=ZLzKwo_4eR0gEsQ0o$~WhaXU99ONn6OY)QzaTy2_ab^EN{gjPel(Q^bQO?G`VxWks z-^&K+JoBu|R+O{sA9zx0*r>N!!!}y-Okb2OE;yF$wbGwy&XPRKLG&AtpS8Z)ZrCwOL>bqtzxkgo~0 zy4K5(Aruh|`UdN}Q60#ov-s1~)v`b1_X(R(0*W5q$?0>Jd6HA-Brg@##bDNH8umQt ztCzrjord%SC4*H$5MiULdJ|DF#t?%(^OMh3pFqho=%a*QuG;s8Ez;#5zUmSvEg;4rC1y zsx7u6q!JG>tGD=qCDDb1p=(rt;>tDTj-RX{P{E~|8CX<$dX|ABq|3yiUCxJM{T z!9&?U;HStcnG7)GF?1C)Sf161_g&ItfSKiZZ&ak@_$@W^i85df#ssUt_s2nf7{+_1 z%Y-){eox|1r0}@Mi4pGv@NywUJZ4AX?FDbt&khIgsfrX{4Lpo^cS4y_@FQM?45NNe z;V|OG!NGgGB8A8Cy%Dbpk;lW2cpTR-jCg;-VZ_UXgZFbq3U4($jChe43n@Hg-H$f| zyb*6R9QP_PDMu&A??$}Iz*`JI>Ic@3_Xor`;`I%|xCh~ilztN-WW;+JAZ!Q3!%)YM z7i+>x1l|}0CgtetX2Sapc&a}59L}^@eyhPi)Zb3;1fH?2D*aY~A)knY)cc&~_J>Qr zk2lSP$2~-ki5U8i!sB{hBVG~ko`(qY%ONPksNV%>j7I(V{<8*uMGCJoHLjhG+cuZVJ_-%QuB;p{Q1fJ55Q!NVb zBgh%?@_~0y#L$0~e(#y^=A+T6`gIxbHk;}<6CEbYL6O4SWUAjzFsid3Vt#wzQ2M2t z@a_TL2n8nP=v->Ta|169{=~Zwhr;7GZjAY@0UobQMM}T>AV)q?222Blw&!)FZEM8)u6MT4}V3}oySqM7oHXMjZ~a|R$rek1BS#8(F}B^_Z@}|9xSEL{LREjsf^y9 zd*eO>kKbX@jw%}#hOn*3Z$PL4_vzn^7nGt!Oz&Xh^OITIQ^-g z-nIq}H8d^ljBP7^n3O+r+p6K90HoU1P^6AkX_vz8*>hj_e4@PuX2 zQ!^J$$Y``#lJ@lO_0Tczhhg?Mh-Qeix2~=ZDkUPW2e==Ed9j}HV3<7;>r{6>Vc8bB zHnMcj{>3q)!=`Vtu8myKuS4kv2iLBRoc>qK{%*Mk9BU)9x>?uSi)(xTrSN@wSj;z} zzMB^Gj`XeU8ENa{%U-!ot`nV}WAoh8YQK=p^ktf8xH)L@ewe9GIeY11(y<3o8VM$8tjui_o8dNg#sr>%F)jcEK z(0_G-c>CeWPTlQM&o;q?y<+zhmePm!r!43fx_{<}ojyRu-zYr7bVOoU8K@^l9V26s zLduiY9Ljyzfow16(Lf7yROUz75+k%3$ZIOm7BCe7UzQkfh<4kk7 z*MV(5J7Lix?D+Jf(YnR^7(+dlm}0RxC`(3^OU&mm;G<}|30;X;V)bP#=oE%JLO~-* zA*OO5^Wnj+rG9m$H&_v;v%ZEoro^I0Z)yr2ow`Nzoh0(ID+1u)^3bO6a@MYhy%9^q zD_R*d#wW+j4;g<;%wS8Grk|3=cN|#M+^d1OHd!zTJO=Uv+-=V+WVdx~!Yzq&!d?w{X z#n=K@tAT9IOQVIaO{|D%7O=s3c!_i-;T#h1^u%X3X$+Jywie-Xa@HSCt3xyKyNyQT z{+~v&`FA4FeQmHB&64@yxFj0AX}aueF~op7(!%eGD`G!;kqo~Wd^AR9++&bbj3XL7 z@p9>A$wcGn=3$9HM7X~T8$3$B+%ZCz=_m^nwtkY4-^Eo0Kqq&7RlQ_PK#;9zw zaOux4(U`q{N4f`z@QW?~kofebzRH$+s|X*U+j3-@lu>qECadg`Mt|O4lpPmU?zh8H zAKKp3{ZZi<;;SMtOo1>n#C0b<#7;17u9LY_DxEoKrVY!!SM z2Jx9mt*0Al;2Ea!BIe)aeNFhw*D{38N*T&a9Yk7EhQmdL!z7hmp|9i_K2Y+EM+(4U zCO`s5VzQXjo_Rea&$w*C^rtLI?GI|qyC@$vD3B9}vL%EXCwe)w;^ZHfax7jp?`BRh z&q-gr3~R`ia{IJpY33>Svx?!LAX}E2ywtD?&F_zo<6!2$d9vI%Wn~WYM@qdV?WWcu znZx{%Zdsa^d{as~)?Z=b6|=8cG6Z%BKDV^WG(pLnomQHdXH|GXfP)sYSah@!Ul8*b zyBVGn#aL`FrUA`D#xiR~PK~colb9NW)e1Eua;rlA66S<>if1ub1gX{& z4Cpjs0!qzCss@Ig5An^k*6lqkQ7PkBVrQqN7vOJF|; zGD+J%DLuXaO^cT$c^1z>L3qT~e|A6IFN^)0qL0vl95HyPTSx*J^0EsLm@8pi)wfMS zT(g`CGsR*EUWEIY5pS*x!%2|BONN{g z@1y~bc~f}fOnCDV#&Limg*V287YY!iANy&A=Q81~LYV5uiK+0qn(!RJ>x6LTm$x5< z*M!U(^P7ns%No5eLa<(2w<}@XYJah;JOhD*eps z&x#Cq9SnHX7ZCpIgY)CT^kd$P`jrDuwHJx57&|;qg5}rm09_FE!zvFyPT1q43Uyaz_0w zZ$&@u6V5n^Dk1b&s{Hr_pzyu~Z^Ro9JUJ{9F)2s-I}RhB-GHabFyg<1_(nW_TMD9n zQh4W@%4II(I?moyF^U(>)#leqta-j?(eg+OB z-aWvh{X>yT_ZD~<@kSZ&ddV>2)!;DV)wH7Dt0ug;20V^ynHKSO;4tF72fRV>Q>64O zg@;kUI}Ld32Nm8<#5dwaqJDy1m)js`#47=w>UaAY@HUw69KhrAlp>`c%hiZiWxyK% zVWr_149o3FFtmtj19kou{h?-a1~pbW_hf8(6ve(1+A zbqy=I_aFyIKM6dU2A?meAN%P6L;h#`^9}KT3hc~tj^F33nu z&*)kFUIrOs)t1BkM?*YSe?0Tx{e+~Kq0aMHwJ%hEK>MOxu=d5eR@h)I`TQ}E3e(_c zY+uxmr1Vg7SHaKNzKEycU^xAo+t={_*_`(OllGF773ugu@#6oeWmznI@6g<~u7;l? zRd+n|P<8tMwYGHybUT~2C7!=lq%7_~um7^7MFY-kFBvxEtnDR}JJsS$Umfcie|f26v=nMPvSdNmd^A;mhT$d>%INJFd@@$8@k> zd`Di*Z+QilP0{CG&*Fmeqcmx42E#1DDvR zc01PdAD3dCX;%9o40zyTdm1+X-0dx@%6hv#q_$)tn_L>Sbl^(w3xGjRaJLbpax4F%inLg&&Cg-LO zA$wvidBx|6732?gJGRxiD7m=$8q@{WE=M$mSTdd)TWuGsr$a39NGlY^3ansm#I$$R zLm^?>f+~pn{T_-6Em~id?Yd|YK3)jbu!LIwNaaIQL-;vEt_$A9Reld;SQmLqSCzY{ zzrMEG=Ug30JB-2hqp|?|&AlP^2eJD^zAD4_WT!oC@62`z+h6J(Rb6Hj zi*@9yth*wx6qm{&XR)W?Ywt^SBdG2y3)Jl$R5>U)be(m$Cnm&pn-{9EG>7-dykkuE zm}5R?*3eGb*sOQrbH&x2c2{>8)oz`Id%;t^cp zDW8J0_l7SVb0B~jzVM8K$-S&j@XH8?yk1jxmp;h#Ebw~w`0XS@>f}7hBYm8 zdc$S;Jv8Gtd5FS(h%ebGgWo+tQRXLBdz{1gRu+)CN zR#LU++a}gw26h---DKI3-junW?pvF_Xl z5an)b%6w%tj#W6|_wwSV%u2|;yr{|YN)^Hzaqz~GiK7iWXvwp)CU_MNLGZ7_5lwQt z-DA$PoHyq8c##3hj5gd5TiV7919r%^Tqi1x5qho=ZZI|od5)@@$p%}|SJKJnx)8BS z!5H4D*#XYhBD|}3XOTh+afHB@WF(tKGddC99Nya$-p6tR^*|biBN{O}vED#EanM%w zz6|FWG};njsgUJGB<}zDk#s*Q+~@jjU2ux$hboCj6G$}vBpic9_-Yxh+}#cJ!O|OI za?h3W+YlBFTVfkixO%2gcE8ioK7&z4!-V z$*WexXFK)ooZ^`V`O9%;9P)i}W*o&cZN)PU@*2)en>;b;R{n94Cl2db#id*E%olm; z$T5)ePcZPDf1p3}ohW(ckGj(TBAmxdo@Fpe@+_Oll4m-k0Gpv4dz}M+wPuiWYyq}P zdVr9OutN$5e$<*%)|0Z=i8AC%jvzY@wf0JsAqxl84~Mc(UM6{Bq)DC_>m^T&O_C=D zDIi^$mPog=9^M}(wO6P|^2A>)dCHR1+C!ngG>r=!76wS@FT0VxaC1EuiDPE9w(DBS zGal!m=+Ahh0DOtV;#T(0>5^yqYT1zCg?453NuD8 zTPAjk3wX)+fO1xe5^6C|wJbQW0s%_VD6xK%L~;7MN^FV~}Sy-SdG$UM`umHvPjdTig;S1V}L$PZiVM2|B4)glEPcAN?|Iuh=)^4|MV4UD?CX!uU;a~!Aff0 zoSU!(W-6-}QCrDL^1K#eLBDaP6mBUmDzIg+|NB;IAw{!H@|MH{V2TICOnR8g6;eVk!*Z#3ZzhMVJCMG7z1gjZw0GukY#GvQ5wn`1Ub3U8_j?>*pgjKy-M zywY!w32!dk+Z33Tqmz68GfpBMAO{T53Xj7lh4%?~V>_U2gyo<}>GvT#jCkB5G!A~$ zkL^L>JqO;1$F*7a!B3IG+YS#SUaA3)!zP8tKE{am4Di&riC40z3eXS7*nA>4?!5RrmiM_$Mo@lF6wT}PS>W4Ygm z!-&TD$MqsAPxRjpyhNFX(dL$hcgU8^k00um z6W3>Y&p&?PaCd@O7;t8rTZfC8vMRskJu@+PX>WT&9VU##8`=J;Dfq|aS#Ef19l8*{ zs;vUxFQvts?ZW%mXZv2gb=pA3Z=Y1;XFt97duxv?Zh{;zvy%`%dn&oH{Nb0KvSaab zcyxA1Ke2)1*LN3Bj(g|o8~$-g>XJjZF3BiZ?VYvd+mDuh@^Y8^ule*?V24D#AK znZnHV8+o|Rcx|2XZ09SX&O)e*Unu(>uV;wY)-})8O^I|DA{Y2Yyq=*~ zM~?M4y*8AJOG(8FsU8NYXs>6O*A|y&yHLsW6f(UGG7hgN!E5WCXX~S6E)p^q8)V|V zp5b0w-#lACCDUKX3^2&_@OnmgZSFiaLKNo=x)fTXS4{$esI$)>z;!%wOKrlu?jdati>93bc}&OAEGo za@TL1`;s&BdQE%5UB74J+yl<4(VF(E`_P!Gx3#J_-KBr8-J4NY_2FHqb+Xk2>p*YTBpn`T{L?vwP8dg^vInas^KK438gCQ1+7B_t}X36}vJj%ie!t za;3ArQrmXUR%dBt8KQsdtiMLn-g8%dy>V`xv$0OozH>Jo(i*>YdtHvwgu`EC9Bmx* zy8EcpeN>xuwEj~qcj(5s1x|N?rVV$yE48w}x=;QvYez+CMrqNrUpY#hWu;neMg7x= z-lMjr^ci?p)4QrvE3B=0a^u`joJHF-t-;+09D%A`;&zYJ+@svsjIi*}BMPAY$ScZ3 z5)+5lzpIr!v~g~wGxuRld&!MFmpupQ3ntc7yo~(3nVehctg6%wSJuDfUii-84@4<_ zl$Dv!{sE1}B1%d7*p0HTdeyzp z6YZk#JhPOFevJXt;QZz6}Uy^z?PL$53L@P1_Rp3K^7 zi+s*1pH_OXas9@*Z#y$5Y1*A`_nwV&-*r~))v7*qXroZ94)+1A^vQ;XEf{7Ts2_G$ z>H#Nw3J+wCc9bDrr8DzxEpwMco8g{()X`X}eeUW}_-I8zX+iFDue%GJWd&MoLE=je z=vfPO&|*-RLYlm%AGjLk$3>956-#&xTjMC6~N`-bJqK`5&I|4 zc2q%uI%noRTIODdHr}0xjMpKJxDiKd-!84I`s#_v;yS3P%l*zV`KXrW>QeES!(r-Dm{qFit z9cW+sT*LNx&M$nVmc_2}KH{UqM;wz`FtH=_QbAJ}rK0EkZD%en)f?RYiz64QC{`<%Hxt-|L<4SeCueN@Xm=+Gv(6R&n89@WOW z;wzpX>*OFvdW#Dm7=fmHN{Gob<4iyKqgYL%BS}u|+aI(jH0D?o0dpZ{WSzG|+ zY-_v#UeX?M=Z@4ekzZ($ujSqW!7e%X*Ro})>k#R_<*rK5WZ#V|@Ll&**N}$yr+T^{ zK7evPd~J~|SEhT!kcXr0!(SIZin{-toe0`{ZGm>g-8ej;B#yg!$Q02+#Fby+)7~_v zc-(b6Ax?6N%hb!66MryeqFq`!sY4s1d(_FEIn+~(Jean7UPZ4Dwm}1VI zB7^AJL~;!>xw1Vh`>MCJs^{EE=*?bi;H43m+{eu~iQEJ3u`aFQJy8ZuIW9gsz|<_Zf$F$XyRC z(YZAqaTIOWN_XVs{Ls{N%9n`-jpoD_n|a8gCAfJHs&f|AY3^qnjip-Y6BVVWN{cG5 zC=+e9p`xtB0qy*ExyC~R?#Tv9q5mm$*5d}(Q2(?8mE_Mr<3UP&?&?;$y_SONHi28- zHV5vg{uYZ4PzZJ|-CkIDsvx(Rb>4b5&>xp>&&feHAn0=ziEM0jpb7aKc;k0EqN{Yf z$O*3Z)8^!Hk&}JzYp2giCz%s8aB;(HB_~O)*wQCOPM+eB<8(RcDs%EU8*uA6DSb+0 z<1crmo-P~MzPNO|$jN&zB%UrOX|9f?Pl-Bti&d--LxR=GR99T-6Cx*DzH*!{Cu3b* zN*@<>f+3tgC(Q$>s#5o&(u&d|bRc>Tz`A8OgE3mA`*WA;aAiYf*~eFuiEFgBvaG=^ zyFFYB2i&s`)b6c9zSJP*V|NjHsZuAJYtaEjKkx8?!bkjLJX`^vxXU0QZcb$s=yv!( z&b^sH5Pc%LsgDfmQJ@p9$8AMWKolL6-EYv40_Pt-P_e5Ftt7aH8Pu@h+M?DpM4tx@ z{kQ9u8g>;LqT2|rVUp{DMbr>U1lMrlfzhE*Fjx`d&T%hBY+8e_)|ZL#is-%yYpPI+ z>sgAKIa=m62y|{JEiBA^jN=?M+rwLnHoFf*eYCs`{X?Y_x2s~$MMVYfovwt6g2M&5 zxS5IDK~6!Qr*G~fZVrFyoEVS3v~H)Te^~)~`yR6jaf8+}9hk#-#1eeBGArTgTTQ^w|7SW&j!eefM|zu3w#2nwsV zAQz={$ce73`KFFe^C<2u&WyUl&3E;jx+3&`NTAYr4EO5-H;Ul6EBchrP!0|Gx%Z*T zIRctQ#r}Ha;fNDM5dWh|6}tJOxSzyLtUO#nsi&)*b35h#n&Y_}5-Sq%J;5>$bOP#y1 z&OL$+>kSSmF#xYPc`VyK(B&HOFzP;^9fBCB9Lsj#_RMkOQD@m-wW_xqkZpJ)htnWA zbyeyKrIdqAZH@cb2OH-$IqUzfrT*$Tb`*ox4y8K|m*$ifVb~z9`-;-4Qw}XdU8RS# z)JGk;f7U8qEPNQ(Ke`&xSQ-k7UUFzZxvOqvji%OV$9{33*pIuqaafRJyie!;?9gs= z7a?7gQG=Gc%~7;NJNza3=+YvLkwl`krDeeqJ?`pW`?tc)NEd~mkJJl_esXB5-TuKr z>dTI@SG0zAMWV>89E$`^bgZkhOc%H6)1_Pcx=2(Fgpt``i5|z5uV)th-|5mF=!!Y~ zg~;z2(mn3#baweY?&>O&R?pdoD|0_~Xg|A)P$8wx)Kcx(DF@n7lB>(%uNywiIZ%&w zCWl02zdE$F=K963PbU2;`>85Cp%&B!%k@;(`5ejQ*12r9Ig4m%;!G*d`>0i z%Fqf>zv9ZN#e=iE@moz^JU?m29>sMSSNpaoXO&_@0f)ASw4y!CLshL-wcXwDLFqO$ z6xBVSD&?sAuzGU-SgZdlfX+L06dhCZbCaIj&xRrQpWTHI)E1y2VU#Hw64Uz0kk$@# z7p~GB4ZIle7$+|1!y>s;hU8vxSG;hz5@}(GX~N>?bs2Aw!}Sm zv7_;8TmvzOzZUJ|OJ1jVt}d)hz0Kk8?90$GE_Tmtax{Lg9sa8DQDg}{zUY)24mB1! zayOx0i!1zd12c=RUQ7(s{&WnP{kxbLKzD@RP4ocAa1q|@p1agh{{hm~8Zb?S{Gxuv z_@(rd)U}RAwCwh>F9FTOCDDX{C=>uqxCjwN~W!6%HFv!v3dh zW4cpa=QX@9(%pYcrao>uO}ZBx{$6AmPsbw575*%D=JP4C>>nVAEWaWq$W{kWI?2^h zW*Ot9GiKQ(v+Te1$SjL-ugG<|9N8LkUE!`rA9ui+dO$n2R@CxRN9wH_zAloHUW@x) zRR%|kxFr?Vm923!-x$9YH6v;n_Z69I3{L_oI?2_w@F7%mcIJZ|#82hT*~v zcj;rbtY7uaP$8x+#b^OtX6la{=dN@DPP^Tmx>l=NiOVh~t$w9D z<5rPeI{Q13J0zF;A_qZbFKODtoNP`l0B&3%CeF}Ya9a>Vw^Lg&pecOt6#dW|#8rdF z^^lrQ`^la90drTsQqw+kV`R{H0MF*#8a@!Wa&=3s{rK3g&7Fhxw3{QrQWPehYem7K zzY`Bz8MReA;C+7ScF}d=3Kn;GTt?_0esf~XQS7-;JJsBHa1TsfqcyHXqCI3Dn~M}h z?jLvaM)9_WBK;i05&e!;!(kBakqrg8e}nfWwQo1DNL8b+sAJZ?abgmCpQn#@z>VpU zDz<=84WA-+cV||}sWJ}Td&Nf(mOr<4nDj8l8Rlml{-DXYObj*s99HA zP;g29jk{fa3ODa|T?E%P`AZ86i(MC&78Kl=-@n+^_oe=Ym@Ud)>MeROXI*iPWoOYs zv`!ek0=KfV;9c#QX_3B=iTMQ~S;Ir^ZN|Y4dj6FZqWyhMQHRZoZKGX!{6D=fuo{ zb!a*H&I0SGpYY|kQQ4akLh_1MWxiR3?V@1cfI%;UJ1E)j5u7j9dzl5JX!JIpuMds(FLZY#W_gm)X?RPSYW;eD>~K1X=B^CfvN za|rMD!aG`cJ9X2dv^n}qIhY-h_CG~Kt=8EgY0x|5hCLW7ZHw3yvX|=`z-N0%-xP1nlN-Mo0o z(q*a3)6!Sma_h=ft26#hZ~_vOutX*}@tFiuVM0uc$uUJH%5+;zZp_%rF27>jmE$K& zylT?b*Zg7fl&OE5cJ1`*X3U(`y6*1yfrADQ89FRsco0~BShLiB#Hl2#U~D+}YBS&W zNx*Rlj>$MSJMVhp^+Uf*^Yo6~^rwUW9KZ9zd*j=F@<_i6Z@%PE!}h_qeSPASJ7$f$ z{kQveM*gdDc7Ddgp%d@R-&2qQy%nr}~e!{*}U!|3=d$vc(oKvoubB6w_YcI#< zl)hc2SAO#C^^f#UelGRim!pgRm@sj(-S=f!(c)g8oG5Ha`u5_o&)Y7I$DVNOkBrEA zV!3F zaxIK}=|#r31?i8!ocbpTyD*~Hgpl#B6WE$2&>ir{U< zE?Rs~lBD6V;?2T&((M!P*z{tMpKJkdcoNSXZhSM5;eGsZ$=IOZ4ucQhm&%uJzRSaJ zoOLt2?8ER=(#?{H#+#N>JrRrHeE*Q7$8Tr(LU+owI1UT<>LIPg#lU^%7E1YC_(kK* zuJ>j5E5hB?a{vEf?``0tD$cg?bF%p&te8Mt5JJ0w2vGrd^BqOIn`A=*34{24d9Q2E z%;xOL26+1P_v`z-|MyPLo_l8Qx#phlIdjg;$n@birQC#l9yG9aaQLWQJy?8#Xfl88QdgkPg$0D$}oMVNuKHBmOL@I zW}Gq%bC%?txRX@b5OI{%Tf~tC7{oBtx*dk0%XK>pL;oUvKq6lJSP~@Ssy!vYJJP)lBX_&R_j|POJ3p7o?)g+d+H_P3w!FjLfSL@Z%W>Y z`=gSlE~D%t0?T0d?R=<32!ZeUDpuFj*H&-{Hq7_?AtluklMu@r2Ia*$CZV@ivj`2{ zJx+bRKPZUR8>_foo7xI(c!{A)6|gR+X4MMpST+dPxN7B6jI)M`^m#oP%NGWrn0Q!t zvPvX+L!&m-MXUs|F4q{U=Ag$~q}{ORn}iUvsucP}lEzhtS8ZSwNMn6fbM4Ai4Hb9R ztXj#_NzR*_YZ|%l-7x7js8Wzv(8`TL8SKBf;=)K~sbPRjXO|3LEToV%iA1h7R1fA> zh%Hjo%95q4n^RK|bpr!g?ZzUK^QG2>k_ol+;)r|Kv9D6J8VzKJ$wGCPqK$(Px(Y#Q z@~&=d4@uv^ML%Xa87~WF+0=p?#9J519)mrA*ElDbfX`V((fk*J#2+ z_Z`67Z^5fJVVLpuS@71I@Hi?B$Hny9WWi%Pg-X9x3!dME$1#h-dkwrfzUyITAEJnI zq~~y%<+j1h{$G)jdj=NdJ<{QUBx5}W%K`f%x-lNt0L+Zn4LgVih;pQ>AVl6n1L!3P z(LeE+FLa|>x8VH_b{u0WQh1-i!i@Jj;MK#9c#OBgtFWZ=%~(UrI-^M8Ew-d{!4*ay zPdxVL3hz1#UN!KThKdwkh6S$@cu5c<9{YTScia-+_kqWBP^9py5${GB-xLWj28nT%T@N`vD=MNJ zX_mxOZCSrl)9@c4>g2=~C*>5x+pydVdqoOQtxHsL{=~sDMp-3SA$jI0sULFH1}lCk z$LoIl@UCduB*htb9)2)ooo0pmc}2^=JFI_g{$f`W&)29+uQ!DpM^A21*h6!FSG z__VVx7JlKgoo@s%TMPxRU0lBAvtYrRk30LuLC{YrL&S%zaj2fcO8>C4&lxOo*~h^m z5$|{QB?pVV^+B-6ug`Y&xs(Vr{Ph`&``*xCs*0^UD5|5Kr@3Ug5NK`!HUgm1T14Giqx z4mBc??NDL=LBZSOH-vXq#bxf+H`t)c{$62wUpOr8v+YQX+uyo(zjF_bdu#{77jeTUG3a@JUsp5sCd?Au&Cs z;4H9r0DD~(P#*+p`^&rL`(MW^TaVwhBQdsRofBac+e#BhcfRP_pD6t8Kim0Y*8Vty zf4%fY&w&WRUmw#kFfe6oSY*297=6hi9iEa8uI=@Apz5?G#yLLL{jH8J9f`Gk`+-Qj zt6`-mUpxX92Ur#NU*@mcIlrYnw*TcGf2`e6>5p|3P`qnfr$lPnbdFPDF6vq$fV?0S9kczsXwfynN&n(Ho*G+np_&V{6AHh`QU|dm{YR#JA%<7FFs_k;hM9muNyq9AUVFJ7E1NxZOdS zYzVWDRPjheDI1SMx%GB0{6?W_Kl9F+(xb8VNCS&;b-Z)#Km=W``VYgB0W7;JtZHCj zdZa45z;(PA-q}})a*Kl3*|%K$7Kq<*;x}3RI>j#w=hjZaE)>5d;@2a7v&63pzXrOw zjJ9}8<+B5E$v!xHb!YFizTV`Smmm&^eK@zqVomdR>^!)oJrPai!)FZ<`*h(h_o(Xc z=sswVShRgn>!PMbRg2~?^7^aV-TtQbM1O00oPT?}$g9Yc5vL>0aZ|7ICq6YG+Ybi8 zmB;+O`=H}Gy}zULXe^QlqWIlBKCFEAN6G{9jfq))>xXbN*ux+A58g2@49&>&2$hbE zooG8+wG-h-Y&nVXZHZ&r6WbC;x5uGiw!5)-s@==R_N#iKzBT7S_$eC-W`t-{fWLoq zf$n%wG!@)94Q{(_j$@*+K#>z>Y=hSAc3h1nVqAY5ZD#A;iRE9_B5hiCqT}z7jYWHf z$?n;MjmKc355uAFD(z+DQB?3|aby+ym}lK5MxKm7!-1YF%66rW-fTX$3rai?p3N#5 zp`u&|%xHo1a*_=@Ptz4j@IwXb7$=u{#c-183IfhY&h;r#op!*wH3M0r$?Tn&d_CZyIb_Xk*^HEk5E(u zkohr;_K{us$zb8~tIh?<{qTb~3^}Bj85CtMNG|g~?IYhq3=lXG1A&)c#efFG{UQ2w zoNENRFf>JB=fVah-#H7(pjbIKFWBkcy>pj)Q>W^}RGmX#gg$`r1pxb`@sa2Q>J+)wMn8{ghx%LxL`U|Tj*je5Ulz(OI;&4L$Bp`-KD5d( zVZS((IDAJax~sMNrgKsmlP>G@y0}G&4Pjf$?O{MhYsc>a9EZa?k5VbHF<_|_*u{G1 zQ7Q%Y2@O?Ku;t@*f1=0l+{ur990gh;`(G+~zlL29MTaUn+e1g4hK{?#x)RZk9y-eQ ztNgIu6(>w=)6m&=>A*g8RCKoEP0enoYJ#+E2rI>K0cBLw5;5$G8ou zksC{JI8urAxpB*atJY4B35-`BN(o~Hf}`l&xCNjtwpSGLV#mTegLW)b`M|g#E*rv@ zkKKBcfIxLaIzH~;R*?R&JN9XtpACz2q8adt1|eK~Z2W4YO^7hc#q3B&Zba!ZQvA zH`=JW`Gr+&iScYp$FzIds-kI)Yj0w!>fV}T=ooJ3h(e`GItrC4=_pjHq@z%=q@$dp zAe3x&c4%68SA@T*d|^Zt3e@*G%Cq%X(f!(R)hPGR7v{l6*)7ar-A#_)0&iS@BFv}= zk>My?ey?LE1L^jnrH(WgFZ8$ek$rpDvMdGGxXWh@xNQhSe%QxlW{s;Ia|vo(D;rPb zlH*P-XW7J*WeNOn1#*)nCCK|kBduVk#)#^ywB*2Mq1Lek%K(u%AV7FxBw?SRY|3K> z?2&c&m}KkY$myJ8$tlOiy>X0v1U_pCKWRHB`oqJYy>iU;#<8sTj(J4AKxt&_y=;8& z_(C&ALuHl!rqv#DeGMroVx7aG7BFuu{trjNKVG z4AmJsF;qvEBy!)`B{;neX-?hy$I>}c^hpgd<&n0n%R0r`ZWxJ2YwJILyeoYDQPjqT zWBZQ9zHzKTI>wx&b3=^dL)25|3{3dlGG*eKRlmcF?Gw2p4;>hn?qHW ztvV}n%X7iwJ!K#2-tzpQY(|xM;+ULfmAI(IsyXGIcfZozDmc=@ZtzUL}FLa$oB05ro1LeS%tUHH>}bp*HtZVGQ|8+?1MyM z4);^$=tQlq3ix953$y(wFtCg3xc2R2>&nJ_4Sr1WiGQB>5m~gf_-(q5#|pt{Q+~D_-@VdX#~chM|Eu>l7;!gqRroG z@q4rQ%@e;f#c#9tEfc>*;&+<(O~Y^7lPwz}Zt4nK_3I<{=*}yTU$h^3QMgiszgoG0PKAMv8~l zx5N8wU19$D>%8r5JO?TFlac4xaM_Uw38=>+0pjs19$u{NQmA$a{V#NOtd4ANDxAM4 zvCh4&YDpq`;@I}M&PfvuNR(TIu_wmyiLI+@@1kv2-}87@djIInGhJ8WqeMKG;)rGM zk;v&IitUi|dzTd8XTtKX`Dh)&kkyXYL|eKgAJd{u+@|GvOgwcaPlTTSCdbb{U(~cA z?9Oti(Vf`u7IpK!nDT|^iqVSun_9N^-1*>^cI;_xAKzK1?TPBIa{Nvk$t4JQV2IX^ z*!G02|G1^ywdFRycej7SLcjh-@-$r;FTd zQe)>MyCO8Co#?kV#5gi-OYpS7ouAdN(fl-*CDrkPzN$B&NX!th=Yek{PcXIu3^SWJ zbZUs9q3*H`o%KYMax2)HJ`xdQ18w5 zqJWhT^M0{#Ll|Nr1I6~Tk1D^m)Nxct+1`mq{e(k!h6~f4dfs&?2j`cL+%;iR`Toy$ z=oJ%o?eJE#r1lUw_2Y$lM?butrYrfsFA-p(x;e3&|%-Oau zt-N0wdC!!~M%)tZxb<_Cz55~@{doKj8@UnMg`e}swdG(c-0_Gup%aNCKB30F%Porn zzJG;r%M)_i#xz%qaY);wgel|V%g5Q6?qV|WWW?#nb5W6z8mds@x;VePUAJEX0K@h4 zCFj`Z43?SmmKBC&9tR|jKzIi+IW{irXqwhFy6rmyTej@@?xjegqb}{))@+QR7rE=a z`{?uoW1x7@RBXH$3U=Ip!P z=&csYcF*sxLe;=XoL^J+7TiTMFM0C>%MQu$>HVZ>8MgFxYal zdOY<+_=VL~I)Zzpm*atMH)c36#*GPUK!00(XdfR~QSm!_lZyBhcq9@z)7?6Kj^E}DqD~SEtPm)-l0#l zUxoc?w(YINI{R%M-W|OOSO0Wp)hj>!+&=2as6C?^BHpuW8%CY^$aSW%^2}N9nKPA* zcRSY)-0`G-m z^*8rRpU1BMsPV7ZB&X-p@z|bUI(vQ@(eqMePp`M9r}Cxa&b=ahEPQSGhPx4KL>4-` ztNMQaL7ls&c4_53u?Hd=pKxvaX3vhFp4+=C7CUR~O1v+!1qyPD*HQ$IZN4Mom?vh8H(<5?v6P|k-$&PfX{95cD+d3~+z;q>U+s#Sm#-ly{ zsx2EU3wl^T`A!4+ zleLA9C+7O!s_mGRfIf1{<>ShqwYASTCM8YHz@{iX)rzh<5nXj0I`s241}GM2Q~bT_ zKiTDOPlP-g4`^m?SVZWw@VVrUz%s$Q@vnTrTvHG5vl4qQce^b9N2IUPM zJyvj_)%M4h_ebp7zHWYYQ(!YEt}BccWp<9KQg(i z75z0v0!RYKt)fl7YT}vY2d~|MyzQEg);jE@?fMa?ZL)JG1 zK@6jXG5zAX*<=zd!a0F8A|+d$RRaTSdmYJ|qh3c3Qy#6qDxM4@#E=tD!x?1C#ZU`!TonIW1s9C-Nf4!?K)473ilqUTMH%x6XPOhKk0N22j53`iSn)7^`5$ zBSPyQjcI`h&GC@lKYChVZX*B90Vc2xADdpsG)4ZY0X(Pz$9R2meS~AN28Hua(;7&| z_{JU?`DarML)8zAEwDvkQ+pNOh7@}7P)Xeo3hwwVj%h-9f8f$XJjug&mjl~bW5V*Y zF>x`fplSBkw)%JMy&KbK=zPC(|L%<(nWSi&e=r7}Z{`mo(4lRbp%K^~exI#nP0x0G z2GYIxhv6GWY)aO4>Df3a#6GSqUtc)CG+(H&aF8GHhUeoIS=e8&^rsXIcvMC5*dGt4#TwBn^WLk z2=~$g-M$E=bk5oXQK%I*ICdu<-gNE58zK%wZoYgRLPS_=^?aK)p$l=x1eO~X#oP+Po>3+sm`V&_pqRH|bh?+;9z5BIjjf!3*Sx3Ex^K zIq#97k61Uq4xL{M2QFxU?U8+=2^Q`5fe6<|CrS{D>-gA0Z-E#FZIr{H>$LrDW}hgH zVs_^6B_p41>rFT;&jCUWet2A1zFT`Xaev%)v2M+=6t6$8A8~4ghJlFVwHUv5kL_^` zv6696i(!dT`LYpe?(Ls15ON8l;>mKcuug-gp; zyo5Y6p|9bRp8x3aqd}Y!9k~#F&gMP8ZQGZyrS*+|(QvsxmZADS6V``>H7Bc~j6LF} z@dr@HkE*&9$TMq3!EDqgJft#8^o?Y?DXLCiBHp@-#~HhL0>L!8a4r8~cwmNmLrnQ^ z@a`v^uR`vvLXi}2q8`V`5qSNMLMx0v)M;evA&hueCZNR_eZ$~vIUavdccP@rE# z+lFG|Sc_>LV{QNF zkAsn@X8W1FJzit1 zjl zL(%|GE79dUIjBIIq3)^#IBkq8<@sHvyvB2{e@y%6t(};*Rhe`LJ~faNx5&kZM_^|B z&ajzwc){?H3f!}Oad%*`KqA=xl}gx6E9Loc`t(^#0Y4!w|Nm@@Ic%5&%ik72qA z@2N@-y-;G9?!ZS33lF`p&@erW`Tl}KFBBLil#ss4LoZYsrr%&fe)*vnmJ5^Pha%nB z!n0_!O-^WAlF&AJV%w65_NYz9Cl;od2D72cL9oO>*OZ~#R`nW>>(IAt@2g_Pu<;r} zwATqEdj|%P1*mAoJKM{Y(4k&Cs+p#pw4b)0V>g0KnTnZ4yYOO2PaQ3!+xoT6etgYi zNBfD6*Nawkwl@3D^32#^@ytsH#qnj2ot?B0eEgDN!N=``g7}bVP;l(XV8O95gMye= z7!=$bEgU*UD`Y5tQxu!`Qmq61azr34T17J8aWq)I{AV_biuknc?b*`0q+dHYFp#hr z^0HA=9uA^Ew!hb#%(RLUCEl?(%sw{Y9U2>fC=Z5-g~zcY!U$sB{B^o=7IDS)qO>W!UwWakvLrG~d9*7*?QAOErNtpYd z@F9AK@|e?(KCu>fFk9?jPACE>qHo}q&wkGc8^HJiOTk&i>``~@4m;X8aP&vUpbhN| zR--o|9+(rz)h49k#KNQjz6r}t$xg{k&q_;Ab!DXHWw}!G@-py~?#s-~%*)Km%JSv8 z^U`zjQ`0lEGThm&d~ZsAN~$j>*Oir)<@I^<^1Rt8x!#Oidd^8r$xX|1yRvh9uKd)D zybP}|)1B(d$1V?lhk-$D5O#>dnf|a;N4ah}^XNELTQG zUJ9UG`I)(?S>7zS*O%(fPD{ylXQsJQ^YhcP(=u{g-mKI-{P|qzK3{rfZbp83etL#0 zBR?lSFD)lGBR4M<=&mf6+nesoPRq&3%*=6Rrn@pzQd7OIoZQSDZ*EpTB9ob|R2LFBCEb^i2CXwPa=mGpDLJ`mX|PLmyHfJA za?-rnd8s-1UZiTaJ2fi)~SdR8jp%6UIo%8mp`Z}!Wsav_?T4!LjyVwXY%sq=El|6UUSW| zy5{9;mdwD~v}Vpurpi|w6$JMBVglDip z12~)ZMT>c|#XQwwzS?5G#$x7b#6hwR(Jyn*5u8oC&SL(O#q6_~XIsp3E#^{-xm;Tv zXISx@{4niii~C}W+3Nlk&B2fIK~XyWbJfit*|a5t25>ff;U3Np{XtC0u%IvA>0T?` z)Q@cl-mS_>+-+hN=b)8MoY-bI-#%ynXVdPqnD5e#N&RmV`fs$jw`reTYFOQmTUgK+ z|HQM(V<2xLo3_PdqWssjFUa&x65%~yao=GvTiqYBxbL=@zhyD+wU|3C=Ep4NCoJag zS$d9t%AC>xk1G1y>bj^HGME~EE@%;sO zeCw-?li}SZ%vWmbEO-w^7`|CDM&p!|9Txp}S@b((iT@vDcs~{CcZF6W&Cd%ww`rw^ zk)C%;{a+OB+1fTsd>2UbXyJanc39>wj3Pf4%kYzhyH`8TNQ0>MXzY5hR=OMJJncrQ zKVe2=)%!it%${a6PUt*r3I7^P{yd9#k!o>`#;KNZvcK^NbBPuq!-rAmmq^7y58@h) z6T7xq()(dcc>R|2{kg1f#31yw7V~~f{yb&zzt0k0x5fN`OwVTI!)R@x_KpS5X^GDb zGQX5QV`9h|MA6?`!vCYCeDqlKXE{_v{}0Rbju+*pQoG!eK4&cEF00v6K8{=BJJRC* zRZIN-Q-;r$bTn4T&6Y!uTw!huoGVJ5>Gcum{ym{@v-XlDzH2S|eJtg_FXY#1^JIFL z2>kWh64~BN73LN#Le@v_%`;l_Yc(>x4fDO)A1&#*#1fx8i}`u!{}q9^O?%AZf0WEW zpK#x)*)93|ge>ovXofzIXsp*Ht_K{g?bF7>p0pR&Xst_YkY+>Q?}~NKbpNeze@ct9 zq}NX^<}w+7p2IX+ds^$T=u0e}nFFF~dY)j7wXci>h)JMJoOts2w3Yi)%rf`{-1Gv2 zcakqO_$2bP4L+It9D`>uQG2Fv{V92df3@V9tsKqKo>|KNhCFpyB6%n7%Oy|juS%Xe za=bx#C+Vdze3s* zpQOw5p;@0NtTZMi_fjDdnmqm9BKd${8J6%{0!I+jLg9#fnJ=ux+C!a*1fo9r0>O&7 z>9P%F)rsd12#+&?Jz4OyBY1{0M)C~DEqSJAx#St<1CnPr`z25P4@#ctNmAho{mTqH zq5q8rFZ3@rc%hrD>uh4;!4p&LR|1|GS4w+g+#q>kut+I+uz|8ixOh|jQ)OG|a}yHXW1CpJly4WW-rE0Mpl9*J@;+jUV^@xySZ;)(}P ze`%5rndZzuP!g{AF@n`9B~P5&Bu^ZYUTxfIj+aVOPOmlWMf-M{!4obXJl#opnQ<2~ z4uco=vaX3Z%JxdcvEGnjy68+iknlU!;6>R0PkdU%{I>`s{Wn4tOWIrqL7eWvu;w8gkQtFMu+Nhf{ zUqs!MWlz)#Hi{t1$Af2Blp)V>L>mR3;an^28O}|Tr@uPM)89(TJ8@qpc}97&i4<{50~ioV&>1ZrG=hm+6p2ewJZBll&b9 z?;*d|;Pc2cLZAX%`kjIm7w6l@YGvxF?i~&@>J9{CJso{FYv^kj4K{IvA-mFVzau^p4eZPJhA^x z^28Rp$#zNT)(T6I(5>3wg+6TtFZB7E!BZ7I$>5#jn+zVwpv8Z|;CUm@a41Ti;p9o4 z;fQhqd+NDG+B3{&CC@N_BYB1?$^hh@;7O`o75Ym(g$_>PEcO762Tyl+)5udFl75eI zr&-~MxNkD-MZU;15$RBE*o$;v0{{}~;5T?DZhE`HCy{4_K*_lDt%5c7o@1tgh#wE0 z;ZK!3!@pkg#3+zFG3HA?8ux{gCx%Ev;7~`=MuDe}cS#xQ_`KwuxYNJ>HT-}?e9d`x zg<&uJf~PE#BOW|uACx?G=B01M4@h9%Yw(ndM?*`yt0Yg^8zhgL;di*Q_f<+5>7yqZ zyh#5#vv{E%llbFUtTMZFlFF5|-R^lkV7F+6>{U_}{F`irt8^{0G10|iaP zMV@%Gi4UIcqOAi@yst`o>c3U;)L*oFkfF}sk@gHn==KdTAY$n|1S{TR#9wLHWx|R) zW#>rVkb?XSgNvg*GZ`c>hs)DyLx%dPagNBxEW=*JJ;~sml#%I1nRq4uNYo4P49A0u z_SAikq}or0&5s31 zBEH`=coAO)4ifQ|aU_ zHta>b(hOe2%bbt0o{G5aG-O0Mxz^w>$1NT_G1+{Or>xK)Jh7KZdt%=ydB#ihL6Bj* zgbp06frJiw1#9SkoxzXCEgn4Gosy?Ns!n_AK+S4O@w?N%;c{GUqC*G64)CPm+EIr$b0YuD#N8S;Xw;= z(J%LHyP5p`wAHjqT&fN-IVe*DndOpi0AEjD*6~L2ZTJB-f@+=oG zNPa!|Jh+jjLBz7#|f4w*@bRhLa86 zW!NNm+tStUird}k7Y`lU$B+OT4LR`@)Oi#RAvOeR>GGPTw^d+^=iBjh*Lko)$qfg# zX30finZ<@c8RewWEE6h=Lx>H5YOGqdx~AfSP$9&IKpDZEKXz7`As|LT=LZ>-Q5%-C z@+@1m@{Zx^Le1L7m8+U7R#hp9P{}n!Xozxk4Hp43L}&<%EG}!7h@y4jauqBn;85Kv z449=Wu@QS*vXYAb}y?jodzu_aK2G-es9vx@y>?0uTq2kU10N*QPZU^lf&iuBl$L)UXb4s0B@pu^rtp?FS6~p-u=4hriu#&b=uy+Kx+Yki`XGyH97`ci%~0`S zOfqB69$Kn1zZ|{Q`5YrF<@aRf=me51QM!wrAVuaRW*&Wgbpba2uKap z*lM1?Acv3~7BDdAx=7ei@9*45+qld2WfD;omhv=3pm)KuVu@^D#gMMKr<+pHNDY&}FtOLkYRUCXNb#wh{_SxosTXe3W{E5IWR#>I@MaWyuY6(hTW)e~^C>7Zr(au!y18vue zl`D9_ipgCm5>iBk#mr%gV-Cuczh-M8y0SV*ly+6sL+#ic2KlW<(J&o0BT^L2VB;Dz zjLWN5FSq1Skds+g@z{r>QR-GKGbe)*VWOiEsR*1*Gi)UYk{VK)MCw;pRMjICuI*qX zu^ePsAUgty+FWI^H2McxTMoiOb0&|#si+$~9tW)+16$3Laa1grszDYPb%qY2&Sa~v z8UFm7p&~{LX zl(j0TW|sgIk^+N0*5!&dD^^$42B(r}L_}tx=d4(jVwDl6@|dxLEL3)&y@IYaCTM9k zRWt>{6cDn8o6>!#^N^IKnzCGqrpa7>&5cE%zrdglEtn-I&L^pqVEK`WW({P`iY4`R zE2=|)2D=#AuVcGyk!>(6Rah(Qi~`L2l64h0>PWemStzt@DVm9u)paXwuUJ_(0Ay!C3=Knb)e_v-HHf=BN@+$BU1nq>l%TVfj0vZU z_`Me2`Cw`@K#BA4ZUT0SFcl}LE*x`O;5gSw;@qN{;4J8i0JF+*PEwJQ8xJ}19_dhz zcN?5*`!O!+LpM9F&oQrN#;b%~pHd3E!uterX1q6n*9CXtMMyc~&AKEQFA4r=uSntL zK+cSJFJ2OigAnneaM6wardse^z>}|B;X0__Bn#d?;3dJGcznmA@Qy=Sb9`?eM!#c_ zGwauH(vR;C6yEnNcsyT{bEAqVN7`?}J7v-jst522FAdi3CEz&;AW7lnLC&mSc$P6= z%=p47fOn+@kKgcc4UZy)mt?_P2)ud-5ibrG<(MCz!LK>}o`OR>>=h}zk03c@8=3U7r4ZyWG_0e3}8zd8%vHsJC70`Vr|Qg}x!?Mo#ZB&LHRh1YFqU)}`X zI0zB%i?|ftH!XPe!25;*lX5gZWWoCkcuBA)ULr1q_nIZXp8?MacSTCSUt8kq#Jj~x z2oY~GE`|531up@O57$^JQg}~W@LGUZ4CMuHwirBi%%~Ccy0)p z@$Beax}+c8h(VeLhP;OckPCP!fAI-M0Pl87eR~>sq4KxMQr{|pr}7tFQvk2bg4YAQ z7pZ_GrQbXY-da<9QI!LDvr#_G@%2MFg+WNg`ygkI?<2rtJeYpSngHGm3*NmDG7YZ+ zcvo8Rx=eU@of*KJj}IEm`t1cCs$77SenpTo>-V$??@K1U85X=Q;3Wsp3=A5twBYps zPvwW#gm)B$&8*)`!|1ol67H+R$Q2v9im%V4-&Gd8H-U$t zMSv9E6&AcVO?dotf^zVx-EF~pAC?>+DpGh)Arj_zd=|Ce;oVNjb(N8bW5gwZIG2ZrC7a##;`&B=~2!pKHQ< z!%{E(!1KUe5iv+7E%owV;33KauLO6>QNMAhG-mz!fyZzaDZDX|Bkz$8{lHW0B*$$E z?^6sK&3JzS-hvYNK$w;miX@T45r^=$SS-A z7QA}kJ*mK?9F21=cprNP@otuK%-^qLykSni1PsEHV6RB&*A6-I9_diz9mM+z?38}h z7CaB|_$`bgg;!z0+Y7vU2r>OCaVfmNqkNe4D?{a_-ij37hma%hkq-8p!FF;9>=fP~ zEO?c`n=JkCrtp4m!Ak;O65Od@wUnbCm*B^&-$vj~gS{e!7Y#Y`9_dg3ytUwoSBr~o z#QVh3t~~`jexs>K;k|EZCwqXm5kkaUj!WUaW66(hJQRg$U*59hM_%q=`rT^6d(MK_ z54>-|U6Io784KRcz*FsMJ%p8hUNqX~^jq!-oxd|7M?W4J(7h)8R+#WOPB-H<0}rAB zQu>Xx;O&D@5~P@ZjkuJ4_gnC~ffp)&ziz?n2VSMbTV=wlv*5i6Jg#L|r1Yz{;3ek` z=5MnJ?{5~o2QWBrDljQW<2x3-?*dP?_qR(qmcJeg-qXP2+IdAvzvnD?Zv(FqLQFrF zYswKXAA=-wek>m!I)A;8qaP10QUL}J2wLFXiMzr}wBR)ZkNuS*%8?Q*c$L6Qf<5(H zk4xb#f|6$aegZs&0kHsI207Y$XbIW~JjRcBci~caNfx|*;7x_QB8B}$3*I&pUJHa3 z-j6JJXMmTaz@!|F&sy*v0bUvGsb3o|g}2>;7e4{t=!M8%j+g1jgNt+qc=fmwZzC>+ z_Zb*-`n8~QL(&I`a-@&IkoV94x;cL^{Wif&Hw3A@491M-2Oggj6j6?J91M964WQ+~ zQ{}}EGu?=HGoHiDct06NzndUu#%nR@x5b2)ZoxY~jD9W)-n}OM?ls|k-+~uCF?9R# zJqzAG;Hmuhx(N^G>;}a*4S27>T@m9*YPI0S&KhiAw!vMc-({BZM)Vg#k6&Uf@)SjM|$iJInwy&}qy z-nEQ(TM7r;7xw=O@Bg#lH3RQ{fnfY7ykA-Heg(Wrh)}=1xD?*^!83Z1xJc2HLbos9 zgB$&LaFNnx54JCzFe|(*;LUikz~elLBBkFwurT9!fTzmKKIz8v<2T=CyaM2%NeGa_ z8v!9R-a_EbgcRfZ7%sXI?|tGK@1X%yV8VL}W`;$)IT68lX-UR98aN43`eCE$ApI(Vw-XU# z{vN`m@UF7p^#G51?I==sS6J{qE<(ORj(AVwQg{zp+UMsn*iab6RQz^J`y4%Quzoya z!rN%U>j55y905{zcU$n{O?cfVyf2S7(l13Kyav2|wg8;SE9U=fDW{U+uB(l`T$Chb zNUx)CkY`yUJq)>OgB8DYY$k+T4j&VGnI}JMiFchn zFyh(QPetKy(?8iK90*_cvfzJ;o0`yQ#eoZqsOQI430Mc%P>7Q{zo{>?W~_J zk54_++3PX(HJ;R4fb%Azv{te2I?k!WHupRbyS!8{JlNS=V2^k6yg%&yZiB5O44dD3 znlv6t07v{zJcGNj%QAl3J6aCMLhG&PuEcSKw10Lx0tDQW&-`co(f(-rIvnrP-a2cX zUhq1?Y8H-izukUQ#d^yfKZ?D4DO7|xI#LZkN4t8kwuI=sX z#ZkcBt*@RHC$J!x_dbC6brEBn3xmV7t8hxn%tD-xk)NgQteUXP-?58UJKbB_jc~;Q ze~8(nzi;Zt0c4)O-hv}Bubw>}DNZ5-WZ#+o*Ng4RFT?GK{ZyFN|GML6Q8eI82C45~ zhv>2DbU=^V@gu;WMOsaXSqgvlgd;H`G0P{tD_~B<_zxODqu+rA;)v58&l)!Gy*(k% z-_f!$Hu>e9+xuVNoE?^bl3EH)%HPps40q~0_v6?=^8EaVQ9=N5AhQ3gJPK~pjsa7_ zIuDz{vjmWPFXE`!DwGGFa3IfUJ-{8_9~=LlEKh>_GY;D2>64C6&l%zIbd@RN!y+eZ zOM0UdsQ}Wdvsc5fT^xOZ0~a<#BNdROt0Lflbl?fkFt*{qh3LLsQ3j3EZ^}z?41=&@ zVi-v=3CGaG5^+0W9Fhs2Z)knO2FDFBd>&RDE%)n2$Sj@fCk2lB2#Pu4x(-J#8fQ1a zt0R-AJU~-yEymsXaRNq7M4xf?vT>LTY<%I4XQUYPvKe9@gi(wU7CPJ#gCm{~>!`Ts zdceNJ4gYamm;s8X1D=OSdFmTD*eSFwV57OI+mMfS|`AUy$lJ^A5lA7^Mer zjMC%x;|!&33u7Ib5%zI7HOkSAQ!RL^iae+c$J}f})g7l2hv!cx4h&3n=vUzw*}*e- zVfV-JVVkZ)2*P(1v@DMq;r0ntI0}cy5F65wF3moni)Ti{>(Ob9 zZRC^r!uK)1y$HI=<6z2nW;N830d&qm(!v zMFAlc$~y}(HO8?v;WQgZJHqCV(7^)r3`?)5@$lq0tX1J$7Kb?c=rXNacf1=8l^vbo zj@5)mNkDfZz%x*IrRJ>90CynKDS^&~bps`|mdBE8c3c7-Hanu0{Kt=2TbK;0)Upil z&?iDg(ko90SvLN6M^6rf*&?DwUJ^HE?8Gl#apl$5q+fS^?ySOj3l>$?EW53t>F%$! zZ+-CLJ&!(q;QK%Laqo-A{{4Ub;jKUa?d;$GC0l`OwWe`asJ*~dz2|-C-rpn5&Tzlf zVwQsuY0JI6cbOzO7P`wcV4|7pT@}&HZ(bD9+^Y<@)4bNCKh60T`DzQ^WQ+Wz7V`lM z{$m!rTP5GzQoWwp@kYSvzXE?YRCsI(F^CL0PkTjR+Oucm~2BNMiFKDIGhq~&Q;|Ju# zrP7KJ@v@9D@5wW*W=o!7E|xrHTO`jg@0UEo{I=v7<_{&$Fpo;!i91P^8HSmI0Nu;NI=AHvH?J0YcC5iNr=^)aF zf*_G5GCiFztMVrDF_IF-w|3ljmR{Vr$P+tX^2A;!d1BW~p7QG@PkE6(@Jsner9I`p zD|yE8kmOl5j+pqLN}l?1PDknUuH=dNspN^n$79M6N7QlfPViHtJ;T*z@VoTkJ{Auw zIXnN_(GX%ozSSSHUNqFV=O!Wb%{srlx2_tb9oNX1mj{X!9&*XxFpCU^T|GGLl9pk8 zgj#QS!DWC{QLOVDM!!HZ$_0MIuZIXNIb52Hl_9IGiw;aHwg#ig)r0Dj{uxCTSpKqN zb@L3B7hFFOBs)VwD*=%S%j;^fa73Fi%vvnURM*`eyqHO5GTa6iJHXDmj*5P{ZpA96 z7Dt6%Swvr4Btf4wx7VzIfy?KX)dYnVyj%rd)Ortdr^W`ZUb!4jDY%*xvozg4YZ?jvo~%yrUMp_kq^~A>yG+2;lKO z0{#Q>_zAF*U{<8?!Yz3G-ji)I@i?4Q`td!28Sic2y$U-;3h&pjAn%b5PDD=OvCCC> z>%g1wdXN~Rot6F+9@D{$$M?-MVMqPg6)8OSzh=B&0k0i)iWFWcEX;WQz$=3t@i?qi zcpU&U<5j}J33o*b?-2-@@e%-{@Hhlkcz0UxTHwI(x*~kDCV1+{;gZ4| zgYrS|xCz<^j~urvQqUP-$TL2q*C1DIu;Q0)ycSD5<#dA_lPEJ~NWXxbd7hs2oJ9Rd zN^TpyqPUL&U8jahlYIt||VRrB;IS#rYOdEt5b zBpHV^gu|zbF#+v_Mc^kx4_nn6i}{5EQKzCgoh9x#!SYX-vY@><3|5?J$s^lcj4^EE2g-kMN=S#eaoDw^hF z-aN5tU|>R;V-?R_#LP~lmfcZz5Kw+j#9tp%J|?C%>6*3wT=(Z+b~aQL!|OQ8E`rm6nLk*oy|3?o1K%dsJ_;zj*`QkwY61s z^)=NoTGf)J|471X^jMAm8vNJde;NLlM?fdWx?_T}e15@2KY5K~4#f;W9`e4*AW&4Q&i&p< zvv6^~Da_(tCtQsm`rl|VXG$}1Ip0K5^9^hV)iWZSD>e5c(nikx5L3`r9LkuZ0?&SuZ8YuKk7SXT{fdY$D+@@(7d+LY9OqpazEkql zYqI2N$FL|vUEGqVF4sz)QOl7$(~#wo@{IRR$ur)+lRVRvT?l1}JyP=2m*@Y`p798e z9R6vR{oRm#nyinYRw3(Co^UrF^MZG9F+9pGTd>_7Hds+lQNoE0XvLB>wZ<+Ya>XvX_7X$;J8P@GN3|_6YHKO37g!Af?kkwhUb3 zI0@Mopxr2Ve%L8eEbqKnE=kO9GqD_zmO{uX$FihI$$bSv5!HQpo#p^Hfj;2r0C@}126j6q>6&HCW z_dFPeqe$tu4;E&*e#n{AMd8hra-vNDACAIPt-z!kWe-bUIW0FAGLzfy!JEg`J5j)> zE7O^z!o2~EiUaM5$M+v}ABl_cVEcvIkdmG;II_ObxH`?1o??u;FFdYpW<|C_ zOGaYYhA{iMo4Ug%J$diMGfRvyHs9f4h=Mews%*Zh{T)Dx|i3z&QCqU#bB9lOhONG)>8x6NzzqEx3%ZO}`wlN3QMN6s_4EjyJ+O z#Ip%J!eVW2J_@DV|2j{!7iq&p5+i#2iU%vc(X~ec{=TTSy+=PZUXn9UCs0D=>Esa` zCZ$EZI%!kRzB`U|-uV5i4m|(nk-gvl=nwUK9%p8)$=d3eKlS$Gw;aBu<6OI5^3+k^ z%};-@_43lvD?~ftT$g|2PW$#(pL@FZorkNo%sKO=oQ0Pc9Qy0rKOI;`|A*H)e*6vn zm+yGJp5Nc{y-AawvQ<6$(AYa4c{+BW>OJkU14;MYTJ=g~R`**yQ|`ClP?`Pc%r_TR z4zM=moph!^ub;(?l^l{(wfOALej zb^$OwJ-&;b(q$Y&^_4<1%T_;6G2kSVI-l0aS- z1t)o_KoWUbB$CM!1VsIH8DAH9IpM}Wn9p3Sf4s=gz@1|j@|+X&ke9_Mk30hh72u)_ ziH~aP9V}H*?>|KxkQj_Bb)Y@tI!p45Q<>zc?;^=F9yd##{+3FfQD~4n!#ON@s`O*Y zJ8}P5@{DUF$_v9~{8*OAQ}{1Pf9?V_N9#X>w}QvG2bGwG!E1|9OCX*^C2 zea@t(!6!|%W0#@up#3oK>tq^T=ovH+c8Et%hHrTY4SL(Af-r9wCwDP3oG$ty6(J4( zm})rwV-Kp_2Zi0Nq5)LQW>b5NA})w`UKe^!ErwsK9P5*!aLE)vj=V>jTL8>@#Ab;4 z(2eavss)erl>LYzg*U^3_q+)Y)ir?E4&JQaBht-^w^7=Aq{GL+qdwFx3YXHa2D}+> zFU+#p24~3eUMYDG?xb*lC_M9XD(Cjhcu&JzL=TcweEA$p-XrZ}f%hhO>c^%>>Blh4 zcr>W-2%Ll*?c*-a_D zr@))>SoT7tAIC;!yfY>|$}7BO03#k?1lrl!s!v5 z@k2LWTuaS6#0A|0IqIy4Zlp|$oC}IGT@*1Mqz`e?5Bn?9OgK~+M`G9Sh59s_S%?C`m@O(fm=L5pS zFdxviw<$0oplKl|1X_kn2<%l80&v1RJUow|Z$jYc%W6U(-!dT}<~c%42#9%r!3hC; zF3LBqp(X@|%m7`%);?9HDIrEasQ@U(V?qB`x?=O8XZ}VM`#S}f2 zJMFDIUYPK%_Q=iC3ZIxU_rRgC2k!0p=D%z{Kvc?q;D@h8`6^W2>I_ret-=!TMCry? zqw>~Zm>O0HOS~hc8()>mTa#gGS|u!-R;{KRZq4$x<{wb;zv+eTX(KMqTl`#G^CjP- zU)lPDz1P?6K3Wnrby~`IM*aTfrQ^3&F3uhJ^68dMQCD~T>Gz3#e*SFYLHvgr>`eKh*BW5>qdc-Qo2YhU>Dr`ww= z`I&1F?HM(0L{oM1&!bm-ZLT|JcEaiSZ#|;DS5Ufc)h}LbEV}B;QQhDFUDjWI^6vK@ zKKbh1*SFsjc&+yt5?_6I+xbtn=&U3Fa)mR+HN!o_?Mz_VtWXTqIyV#I)xJe6#Jme7hM9K} zo`-wEADH{Fyx*ttgYzqc^DYD%v>$%ng>wI$c^CS>z`TnHBJ{iqoGyCa1+v4>yBLoD zoOzdJsJQ=%d6&2God3_9ci}gZ3eP<6Vx2d51ofD0up-4<=M5@>r{)dR90ko!;X*SI zn2*{EUN+m{2C=R42K6Sqf5yDaTHw8j@GfTFh2s=OD!wXC9_es1lsW_6I`7gBJ9B)8 zn|Ij=IbwTok%~~RRQj3cU99s~!_B)?0>g~A(1fSv1Bf4L-lYfjid5A9JM$?Vrzujb zbw1@)C`)}5QFoGczUNIi^avN@N8wrLUG||6S6k#LYn^vNcN0Vk&pPjd4@)m<-i3I> z%)6ux&bm0|H_gL;-<+PBVK`pI_syb!Ar@-hC5jgRg69B^dlZTHuW~Jy>e;L-aDrFI zU}g#_H00wi1$Ytnbja{oPEj`)pEBUC@|JgAD(j7O8x&M!k9C}K90QRk7phFf!d_uh zZYO_Cq}-gaGtcEwKa$cz$?;oF^IRVBoVe&td+Nt9o0s#fB%G5Z3)Y3c?MY8l5*Plq zCtND?Kf6qsQs}=?u&zZ~Tg%mK*eO!^#yc;SpZ}+os~qTdQRS+xVX#o46;h>!4U)kd zziKVU|Nq*mW|>0&c%kC^B5RqN1v^FmQ_9qrpzy_%DLD-l=mIZPrra5>G@}E&a9dR* z6H>KRVtr3Uqz!Y&i30fX?@}EnpEp!lq8#&Sx}{lWp0#MBTgF(f$<$rcu?QPe&usIg7^*1 zXh`iACS|sZavN{Tbe#_jAofdYZwh7!zk??+9P+APr98D9A}*PssB;sS;B;R4ns~yef6W^?4lASmk7P3w*^V zSmd%`W*CZ;+*nwU_eh6r0O#`q%Pj4A(fk1}bGROuL*bo)y%~?|O~=8Gc&e-tkI%Vg zyaFkMn;>G4eum48_p}L*;Vb>NgE!;d409;`?zP|@H{s#YB!E|I!K;RuaZsf6tAd4D zzc)>IjHlAi3w!(r-lN|RUVcIb&TykUr&4)$;UaCt#jq98jTgW3;$6|-6eI7-?Q$^Y zu``&q~R<*#75%cmx1a{m-bN z7#eQ;MIVEG_TF=RB)Xw{`IU3jDeR^-9z9VjK0#c*^^T5#0WZ3!h$B&_!nw`XoK0Pk z4bhI*&K>=9Ak?mLgW&&<`+q55NrB=VUmk`o6cpcwU~b zA~z>D*qomeY%VJeGS9QPFDwh-m3Z^=3g^zMD4CPHAX9l#mhZn4IjSTl8U^NiUqj4vr|gl6~4KQOrBH80wHyf@~TZLQY9YjdDtmlS8F*Z!9hMrKG33v#qHiT+-6Ag6!uOE-0&*S5j73 zj6};@;H}8>mHA4G3u#}NtIhE(s_-q$E%45r<*O)JFel(Q$RV%bJdS`ppK~d~92S_4 zDo=-mIIN=);su@_sa58in};%Jw#=PZTvF;=uz*Fg zv~*r+#e%X@gUP$GxOkB^cV0!HO8e%PmCh?cot{&{Fi=%17Tj1;GOx4@R=Eq@73J=9 z#ih8l63FD1E-ERTSCLy(2+w94DpNYwTU1dxcb2vQ+aOnz`4*sMSWpC9UcS;Yv>^)? zcxRyrptWdda_7yR>&q=GoHw_kFmD*^3dYH6U_rhNL7^g+7J7>c7klYd`18#bx>b}F z_~up=dvgs-nMANy0R32hOMM2?9G|bGqQnQwT&PxwU6Eq7NEH^sEmg*#FsHDnuxycN`OL0Cf#B+O7jADYr)Un$aEm9O)P3*3-ijHobAgl68N5+hkfE_vsc6;_n`P;eFrS7BM; zD=L~-QI3qrH`y8`qk@G9K5krKB=mfeVwtSwA;WwU&u=%D&82ozEFD!H0>!Cbej64G!}X<->U7A?oSz?YFmrf}BW z8;il@BB-LGLX=|7i{e9@Tw!0}MZ1&YqJ>~f<`pfX!RV;KpghrBR$7r)nllS*o-gM{ z<4z^=3J4=Av$(OMz&N|aJBOOEkHD`{+sKKEnXAnbp%=`_%ZFtF!;t7j#Y7bi=A4_r z73Ybcbo|aMB#&;bXkP9da=zj~^vSE(qfWz7wHAUMbo$@L-A!l|XB@}z6;nu1Y``2u zti&dW#fb5xtxAN&jhNsTZ4yHcQk588Y7h?*11c(}C?%B~qRk-%D;9DH_=2rD6czLk zY(yy*Y!R_wQHw$fHsm1U_xJ4YSvRZTMeu>i^Vw%+|1&#zW@evf=OxvsP~kx7oFg>_ z@mLR81B;eahsp9b`$R)MGpVJkg~_$gU^COPKV-UiAPc?%1nAe}0DThx{MS>gYORyt zb?esF#~0bE5yzzKt;U9Ci>irY^+;vw1r?0KP(@PIxa__$SHKn;c9yZAv7w-#fl4+Z zKwL-Jh)f>~-b*)5!Sh1@%fDQUw)W(3F9dystD-?ODV*8;>I>cL_k%4-EO<3K{2nm3 z;PtnDog&xuTS^o9YScg?sl7SL4MVm4G>v{^Rl6zn=ctVt`+W3!q^!57y)G+8g{>G` z7L_Z8QjDqh$ZE%h`QndpoUi&t!+a@EVl}Na{aSLh$K_`7&`*HdaJkEM>R_e)4f#C# zIC+)*6M41$Gr8JqimCRx`Wobi`DZ@kqW#~J%W)?>S^^SpQ2N!($#;7)rx-e>Q{2klG+Dv zKf>4Sg?QLrgGcNy@hv-pZ`%j(9s37-*S?7F+j@r81N$L=9gJ|ACYCJzQ%)#&z~6PTONx{e=3A+IKYB({PKeXZ>xoXXDNGCs^B$ z-n$5A?9Xw#y%O)TYjKC2#+`OE-e+&b2kmXR%if8P+8wyt-iv$eBe>W84)@vL<9@pz zpR`Zm)Aj%!u+QT``w~8DU&j~hn|R39z1e=X|G`)6r}&!vKOVMU;1Ro|nEG#*;oJ5c ze8*mZ@7hc7eR~CdV5jgSJB^>%8}O+86@F%ajmPah__^JM6YNv;KRt$v>^@v1|{A9v4&iyyJ~qfj-u=_kvz_~ z4yPDmit%*qV1B$J0>yY#k6b+UO>6n61|fCxSKp^%it$P*$d8vKUMCBor@XoU`%}hgx|lxGO2|ub+-l15`@i*nQ_}J&#p$l% TypNYyM!X)6*E-c_)MtGOiC)s> literal 907990 zcmeFa2V4|a`}aLdFRKD#Z(#2(*svvF!QN1@3kxhoDa!&1R>TI_5H*4ou%WTXD7Hk5 zF<{hKQq)96jYf?Hdw1X8HDz~Zb|JZ+|NVKM=kvbrB;%gB&N*nU!-b2-aO%v$AFqUH(Cgl2mXTJu2|FA2n`ZE9Hy~6=U@!!}- zG-njTuD-=6{%_xZoXRNvckC}dF^d0Sx2Uj-`Cs0fr7#x%vj#mz0!QfPS|Ts zW$gZwy-Q8T?w|G{yBIt99{h~4``@)^`!RO^v}5ktncHutFn0gL-M)n%BiZ}>oQb_Ojif+6l&FuXl@aC~I$&$2gR=cU!_Z{Qvv^ ztJ=UZWhV2l_S}7p<3H`+3}PIG{rjnmu_-#C@2Anb?M zGZlpWc-^QVO-OuXT!2~=7Z4F05zmMXp*oF5Vn~cPlZuQcDdRNplQc;In&@DO1Ku2> zk($Xx8978z;#?8Y@fuyUI+86o&Z0}w8p|$;L@r4r)s(daXo7{z(sWnO) zVQLJDh>wfcMMTR^7_U=L*689iD0*xH#+4=@CbXQ)0nrJOvcefMN}E-vq9NLxUv;Fc zIMh-wnmG-54~SMrX+i=*)bVO*8D)_HkrCp-L`5-|A|NhY9T^!jMdm9aI;6}KP0>Zf zYfSr+Gn@1#XV$5w1Oz37hH6Bko{Gf9nsgRtHf?9l9upBFEiPw9o5i4L;ZXq*A)4s; zh|mc0XEPmJTz-?$#hFdV7iULJ!_X1t1{9YdAwJZroM&$_RUgx?4&lGDv0) z8Nzg;QAvilaJ1MYL(h{bI7XW!F~m(#YbAzATw){!nq6oWi4AE?Y>{zBY}2WbM~pAF zKoL`oZ9s;ogh*6O>RYE#n+y_4s}2b&9Dwwa@&-p~O>A7R%Q}-z#15k*PtoGEsPW>CD;W=b#Rgr=tcpNr#S+r_&^&6JU>v36=JESg;XK$P^G75g8evQ%8ry7_U=g zH)D#3MrX%Jvzwnk!8AdGBd1E5n>CslsJuN)6CDzvjt+>A2?&o7T^y(|Y?1`j8)L+z zs@%z9a7|Fh#YKb}FXD!r!4zpS`Ph8yAd?L|V?>a2M6waw5HpvBAADx=aHCH)(x{Cv zJWSh&oqWb?yrCKxH>QcBB8^vCL&~U_=y-0r%UHtJfR8oxMf9P_0G($*LUf!u)J#>% z8ZTU$ig2A|BdU^HXoqn>pf9IgqT6fjkziwOvpj&n8| zV~MMeM#^0_GE^56Wj>lFj!qL75t2ZvD?UM*Ssbg=L~3x+k(8L?u_r_($Zk!jd&H3@ z7Zq`&`SYSvP0l4B7UTs})g+yKtWi2Mvz#^KvS5;*9o{BZ(oXFBGBf$OGw|^y^G}GS zDQMPh*(WqtWh#id<{>+g3yLO66HxXD6pCX=Yqm`08*vIz%j`%KyaubIW1=I1aeK(7 zr@BsN* z1LZ6;!b~fLtAoSUo+?>W307(22v&J38tk%`6YTN^5$tT;jg2Ch%POTdCNjxfIa#}z zlCpNQW#wYbm6nYWx>ek-Y~e()vSPC_@?JLPDYGw)Nz8YeG2Tq8L}GwDJjI4A6qIBojb6 zlfub6%-|{@!g$H!ec>7|y1(L$Lhp$tCFesv3^}X3(>N<9^(0f0i{J!_xd_RUA72)> zQ-#jgBpMZrIG&%vP)8>5AsQ-Pd_+vNNhic5XtgoAc#Wu<5OeL#{2yM zP|7H;jZtX30Ctc{3V>G70u`b1f^qhk&``;+i4O>mQX5xbsZb=1%TztaNE6A!>dwe` zxmJaRyowYoYM_gwbz$wK;5d(f$sX+?$oXkutO`HmP&$*Vk|@gjxDKXV<_9+$Wp?gR zjN$a`vNd_p>Oup=i_UC*Gdzmd1%&8=!eopVtWrVWc^Q)04fYCsN%H}Ni@|O%VxOO(C9F3Oivf?YlTV8@G z8nuxnlou|M$LVRYrtaV83F^p@FyOag4vu+$}~#JE@Yr*)KSJu0okL}lQh(0ay#`j z7BNK^V566WpvVYOQyaXP+Hpez_TYJz=sHV&q=O3vlmL$~5M}H^SWO#86C4sww=@AE zF@}_^4a-9TT4@2ev@ucI1c+=rDF7y}zm z(4=zmatUPTRt&?eRYw?ggb*cq z=FFL718bs|CYf2IY;osNZ+P*AKpS9iD!t%QVU12r<7frl zJgP8S*o9}TDNdFSYeP&zkUT=XI7z3*F|G8Mbp|e4(gN%?(99{xE(|TYCo;*zN1C%s zY-|(C%gwd9+{!lq7UroDBwnzLk2_C^$^1O$Ix8|pw2&eQcBncv!DWo+me|SV#IPN1RYa;0xwMJ)jg!dK9 zM{wz4j48vg7$>PH88A1+ZOxjbOHpLvt0rnWqt#F)GRbc7$Yg#^kz&j)GO=F7WFmu^ z22sa_qc&JrB2d!Jzo8uAlBl4_7(BBnBY_sGgWyKH(I z60L!-&`k;mO2Qjv2IrJg5<^MFStTjU7y*${F?f%UyKRupG)au4_*_gx6fsQ5DxQ#B zJjb}Q<4MPZ@3=AH&kh$P;X@+mk$|Y|R6v<%rmCASv%xMaF~m$c<&C2Ut7X>4|hN@i?c*#f&H zE;v5XP+CN=)5^5*ShHyhvSyQJw*wVtHs+e>9BrI7bMy&Wcb zR>s1IUXi8LT3t-ACeAqF$!1ayoCOz1(W5b>5|tEZFnKc-$>Rei(KBCBc?F~F;wqRW z(@8K+(TU#H5{wDaX3eI>z-xf)NL9yUi7+mlrk|uqh4{qws!nu~lHOVfv53HHF<>R( zBOy*LT45KG1Z#BkHeoQ!niwqHM2ILVBm!~Sw>GgNWn9>iMH<>wu+wJ{)&#k{CehkS z>+!ffD=SkOvBJ|3GiSr-EvFD7a0r!>4|l=NF0^|FXoK*)*35bE8ZYj2 zX`Nm2hAtQ)9cX0W?ro&+lagIB%E-XqBgs-ul6jmY%SiENAK#(LrL+|c^eh3jGR}EK z$d;2}DQ9iR5Nqf-gGKUK3Rb$do4u#uoF+7ICS}BlKDyJFfS`jVyJly1)-*vTv3pmL@n7(>Wi0`Fs~)aSrgVk zWky;7l$iJ~l^Xd$%r45P>4Ax%SjOQkF#*Ft5Wk+>g+baC!EqF;iSsNwhb+dFf>e2S zlNfGa%|~#h3cz$UJrQ+|I0B*$ z_b!HX()kRrN9%Sp1u?lOp={oY5{TBIwSqZbqt=DQOfhy@qWDe`P7`qDSgW+%1glId7*fkL zfx#{l1_rzM5v9Rs9GNs1Irat6eWjs7xVxYzcFr4&nqazI(HdM#C`B`r1kYYr5l?p` z@w$XyTGHk&(BKSrUrWi@AwU;p?wbX4`w|x!6VJM!1v&PTj%8k4R-lN`qoR0T&2w-N zN9Z(BF<2U<2>Ol%Mi{-r2%|2Ebvy;CmW?%>3RisG8nS0&Q&6u`cG4vgL3nZ!$C~*& z1pbWd7nx*s@u6{cQo&798>87w#@eulLgm>5_TF9{MC(P=XzU?(5i=a}1Hf?1cf8@4 zzk4zq2Xjw^jQ+@gheIL*dy_&L=%(Iyb~<7iZ7czq_zR=dC@Pg9o2X=>d@`%Jc*az0 z;n;IWK@>yhVc0}O#z#b(M6d?FNaoT?qm0?vrZsWO&H-u(KATA@k)8FWj!TM)(qQZa z8?M2WU1S!n)?{W!hb}=IAHjZ=1Y<8sofr_KTh6RQ`* zamHLMP-OL|#*ftC2Am3KOllkgV%J6oVync3ID&H`d|R>n+KW>eiy^M3IEDBuWu-BC z;fgKJZ;Ue(-h8xa6~w1Dbu5lG>sp+^*vPz|7hZfaPAooxA3?mDrIy4Bw?;=WBP*w_2g~aLPW-2NB zo(g+bHl?AGGP|*sY%n(};THUI2`(v;_e zpS^Jj_%bM)j%^L&Y+(;EB>6!j92(mSy<*HqW7kk>V_KmM28*F}SPM5|jb7NXW;~>> zfij{68&;7?x|*GZTye!?h&2niF^LecV-g_+tx2>LwjqMMwDrd zc@7Eb`Cg>^UQX#^I~ykOi@<;B4NgHz19UaqvPZhji|C?c`VTKr4|#+Kns6E8eP?pr_(bm82GzS_GN70B`5Ct`DSWjCX>0&l3bz8xRKrP$=bqr zt7*=+>7yz$C!lijmu4FA=KM(RGG!%@%|YZbwQ}_HZ$rqwFe*PEvlNGV3W?(hwwS zK|`9KTXH>VF0)Zynu{f3O4O#As<3C_nnNsi=v_5>M+>q9ucXA`)=2hf0arvyBjUO| zyXb--k22-GJcZ>!JV0siTsrj zYp&R33^&nC5LZ$>1x)PR*f%ko40>@2dVuy%!0tqP3&B1=z>^D^nHo|PrH$tv zS{R-!keR-k%)ZbkIATwb5N&ERJU5|~h~_9l#gW9|<|GcUZ~(cS2#L{hZ@033F^lju z5;$OwvR3c4a>`NM5*T<9A2RrQu@D#fY2>AQ4ws?%Z4&&bhf5 zhBr#xKCIW4b?WmT4**i0I} zwXswlYUB~sNII=ykbE73Qkb7fc%hnak&#m$%@Rn1sQT$(Xsu9>mMnM+EV2v4u0@#LN! z9+}IAUoAweI0irXiT7J04K|wFcug-LToXwuNJuISLw*1n?6?H*Nx0!v)?YR0(5@Yu zz_Sx(6&nh4nAK~5uR@_5l%+OZ!^87&{%!G}>gp2)2}n_+fZl-MzK zO1X5fSIuMgAwsVgM^Jj(pxo+1Dg80qvoh&!bU9-6Q=1rxNC#pC0rHMW{Q=Fzw)7diG$Es58OW`PaiZdA!6WBP0 zJ<6HIrA(fpK-~Qry5cv9w%VDhq-H_IAHr?4lT}HbN?)tq_RTDI>VNHrby;;vBQ5Hb zW)?LR6@X!CpZV_<;GUrX5BUNF6_;|MzByq|6DI}PFn+}^Mp*}HRN7HKIU}6LjPZ{m+D+nQN1$=SJ55 z+P@ugEut*^3YAJ*nh+Sf))=&QOj1=YYu>7y%K9Iz z##@HFPfSd-&FJmauU~g7W>3$YK2};UpNzInojZG4GRNEIcv*V)P-#^!1=D#lsd}ok z=&q?4xg}F_Fbv{V69*?*^$!g_uzTX*iHRvclsL8@S%2Nc!3Z^V&a%t4%Br62ib6I_ z^-61(SE%GBwsgLy$(9IbXWL;+C3|-zQ_WD!=JAb&*$|rR6?Li;I@bElb5SOWPnz8$U~{?v~cs zv$OZ=ER~s-6_T@^wb^bu%ZixSo|cu8+bXniZW*iG5=UjMQf0?x7bdT89+K_GggRp= z2I}21Hn?SsQzfr=J`dv&=j82*J=^KL`Ra^`s?4J5sTRqz-RtM*3-$V28$bBy^-uMB z^zhxL7B*9vTKUD!Ue4RpZu6W}sX3{3`89GD=B6tdyqCX-+r4<+D*3wyoY9#T%0#hoOh2gZ;`6_X|adl%$<-gP@Hd%IG@&- zFIAQ1o}zYg+u@|zo|ErT6mfjJD*2R8$r-29CySIga69FsI+IhRO!Y}VquLYdQxfVl zF$AnQqtZsR2QloykjX1cfY%uqp5s(Q&an=DVjZLoO+K}f{GG+&R8{`yZ9YYPlV&IF z&3AX3>ZGC(9i9aA3^DqiqDnUUo}w!7*b};v&Kt!sDmJOmP2;2r%?YW%!dLR z^PN%6aL^j_MXKD23^m!I+9R%`c8O0(s#E&XRJ-JKG`FEcMyc}E0HEV`Wz($%7N=76 zUbBmwF_yh%yUlkx&UUfAyn|G`M4g)$D{Jbs3+N&)Ck+nO7SXWKigQYbg)@f496lcn z3CVDh3<+cDkJ+!Y%ITx(`xJwTJ7X8)px9z({kFfp7-txZkflPJ)lX+zVNxh>@~<&UL2KHes7 zJhW0b6IB@^C;qC@xo&fL7n71ttF%%F4^~*673W{b;(`Ktw zi9W(HDS#wZsp_R0NZbu1X4*QdI;y<;B=oy>u>zBPO>zE`>Pn%?`=ytndyk6RL?2y` z3Yk5W$*Bn`JsfkAU#9eMC`t86>0y7Ohush|+6I!*Ce2S^W2@6~!rnE@Zk0Y-_3`xHt_t+^+0)ah-@rarI4Bv!9`s-jhWM_en87&chiR3O z&*gn&(MnkqeSEtL9eT=V4-dNSs*LZQ+z6bbe1?FPlYRE^cs!#DoXH-u$Dkd-S*<%1`er(PbLpzUB)j#3pn5}HOs=#9Y9Q|eId+PH70WHvBAephVN_L4l z+}PRcERitHIj!)#nW4gwOfpnTjHmZfb-HkV3C}+oAh;;f`3(G{18#tc21mYX+s*Sl zHH$otr>aU$u^n5Cj)04E>;d%(2JESodyYCC-e2IjCtMZrG|?IPZUUN10LX&w$!j1o z0#kj?qjAVW$jnw{tHBJxM973`s0y&+k|>hXRB1kGv(L}rG8Ood8xIgq$iusF2W12k zxf!j>5jp9l>bvZGI`1MV`MpXdb?}o4#1&^hstOckU#LpUJ&(Z?jr)o$U0}8UB>%84JZ2B|GH_3CIs*Ymvc3+?0o2mNTs%nU{ z(k{)}9rtv0X^K?m^e-~)ne@$Q3y9J5t(pCpTB)H0_wwCI@Lsbmv0(fsR;2UcrlLrJ z^L0O2s{6qy=#-Pc)dycsrfP^%Y3Z)l!<%!8jWW}QlxlLCTc%A#CfhmBrV^AVWG5_X z>J%HhOdES4-hqvGG{z52v9Zduu@>TO*mzrGyibY^lWC(6;w{*COJlqTTWA}u&^0X= zTc)qdL*2gK=g8!Ismkli*6hK)LM2m7Sm#nm)6d9Is(kyVO&<+P`n?k?Fk^W2@cUD)UDbf}PV@!oTK z_6fB!0y*1e=c!!~$jF+Vsji%*&PY`yFKVAPG$YlC!Laj5PF_~J2Cc4w08VvhyEL!R zJAFIXt9gZP>D&2^y>+6{E#IRc_L>q4ApT=sDD5&4n~gCb%3v47%(D{f`dHO2! z%<22L&Xr=CmRwVv{`=w}=Je%SXI`(nEvaJjyGn<}4nif<$!*3ORrM+Zy!)ihsk8^Oa217Zx52Q&z5=Y|51< z%@tuS)lJYz&0>|+)71RT?#xteSFzL3l){F!Qqw#z&eGgz08&7qblB#TVy(=y7N(*# zI~A=(Q?W3`+Ah;tn2OfyRJ0aN#l0!kR+-kqRJ3NNqP1u$=B8LPnbyKov}UKGwP-3X z%a1)~ebzeF9m5|<*V*c9nBDc?0Y%<-_VqG|(6s&?zTnvLIE-T>Fq^y|#v-S=* z?NTVrn01LQ)>T%pHY`dVvo4;Uv!YkY6=v_v@O27|^~qV_+}SI|-L-0U#R+$( zk*jQ1 z5yjz*XD!)Cg#0(!9AAYcGT=?;?jlqsWn*dj>=Q-IF)I+%0&e`btuDgemSXGTlF9s`2m3Jok@zYW(|ZpZlkMYW(~9guDKP z`gMvL2@nM%cV_CNjV0-`FVZJE;1+ejS?iA#vA~BeuzcuP-{0k(u?uho?GuY0@GA6A zXZv83u@5rcooi*M<~ELSoqteoIB@daulLHGzmAqW`9`)N++zH3cpW+$!_f!-WZEh7 z>?%Mw(z2diMFz`yc9jgvdf87i?dLI`BN2~E;KhlZ9sbXMj>YvXLE)pVA0S9z-t+#-788NOrD!RT023izNIs&lXGKkS^*{V}W5SVZ`baiuC=<{9Eu*w{~L zqd;Fb_H(FJ-}k7VV~f&U|8Z^AU1%$Raa&~B_}zpkU}0bANF>& zV@F_`dZ10})8ye!)QSa6!O*ZOkVE-C@Yh}Kj5YWm_4DHxUN_UT^X!%T>?1r?Ctj1+Y1RC*aVKE1W)tqt@hbl3khu41h%3CrMUd= zvsVZSERZ16-ZD8`u_xOtC)+Jk{Uqx`dYb9v+K0&{tjXtXQf<%8b|`;_=51=nB`R;4 z=WX)h63JPS0#*ofIdfCj)yvZCg^m`kP(_7?u@kpGb?-o%R@P|PRFACOjFBm03ZS(Y zO?oz2eHvo_pt(y6N?8RnI7%pB!s*A8xWG0?Xk>A?oLIVVeL+0n&#Pni`v#xO|n zgw&q#???2+JdCocdXFDN-QArV4|nlZFl?Ywt)9L!^(yv(H+G zF9V*(Y{iYFH3G`&{MDUhssUqZPg~jvqb!$6TSlX7cBjIDmMu{&Cw_3*DGK(c7J_C4 z>ik@8eqwm-Y2uvvw0QyBZh%eEO|BjM8(HKP4mY&sveemJZ8xUDH?HRR*B6X6COMHy z(BTpdTfiq`7+n4HFRbp26VN3`($vU|WKf$n*DN2|3eCBE4v@(wM|oN**-1!~;~u6W zlPg?VFa^=DwR$!VvG6^Gs||bQ7q0E(8rlf!rk1BZe)M#An*Zh_Ie5f?an@E`S?XQcW*E^xg*!SVMJ&(02gZ5oa{acM`;vXy@({Z-U4 zYVj|Fwnh5Cc%YfO%kFSuqt>;z>_2tyT713!#}=k*Kl?hgkL9b1>h>cK%`dF8{^px3 z=ZGsyR;;PJ;QqN0O>Zp9O{?(j-R|K&*{v$=8GfYd&=*^W%=FO=t66Q+cb%I|_@c{~ zlYXqXuGiBY??!#u|F-3FH`TilJ10lIN zeeamQjSkle>-C^w*7#4yZ+_P%!D9A+QkTWPt2R!$^!AkH(ty9JWUgKLZPe7iSNe^< z`tvt)T8)Z#ztp!RqS=z-qMivS(k8xGl9ZS|>a$5r4#i&k=H}o7rKvls6}#;SopG-7 z{@@$^s^6*Uk+N!N+rXeFrt%TbK8IM2>a(P0vlQ z{!Vb5^RSb5;FIkWVmH_vi*_3NnS1)%FRs~iyY`v&u7P)t`7Rs2`0Ln{wUvtkKJFD=H25=*p>BD_T1}!%rR&a+dLNJo%L<{|FKW?yuy6Hhf@k~pKtM1)yQqyL)p$N`n>CXKcs&CheaoINh-2q4=!o^`Oa@Qwd}m^&moDK6($Cp zSu=d5Z_um7l}}_`F1Xja)9VQ--|c?6VSMs85$BgrkNKt5wx1fgd{wj~yNgrx8C&nI z4UYc3%aLhk8zg}n zogGrK+Ok(|CJ+2|agQf^2A#xGjGbK9CcKBz8k zf3x&tzQRhMPWg&hJLOl`FYo_zZHRwi#?t4 z01^R!NdUk#0N?-sPz?YG1pxK~0M!A26aXL)0O$n(lmGy80f5>7zzP6h6aY{I09XJ3 z90ULw006fDfRO+|a{#~=0I&oARs#T=0f1)!z&-%rFaR(P0B8XKWC8%C06;DPa25dg z1pufA0Hgx|>i~cp0KgLfNB{sj0RY;eFM0f4Uo0BZms1_00l z01W|vRRF*l0ALCLa0~!Q1pvGNfZqXt-T=UT0H7EEp!q)s0O$h%>;M1;0RZm-0Dl0W zE&$L300;p9+yQ_K06=E|U@rhr2>`eV0IUZ91_J{?805AancnJV}0{~110JZ@D zUjYDJ0D!FkKr{d_4FIqQ0A2t93IHG<0MGycGXVfQ0N^eFa0LK32LSvG0Q?F7>;?cl z000#La2x>W2movW0QLX?RRDl~0KjVipdtX!1^`$L01N~Gh64aM0D#*7KrH~E005W; z09XM4;{kv;0H8GhFa`kd0|43r0F?oNMF7B50AL9KkOlxe1_0Uv0FMBGt^mMj0N`@~ zAPE5Y765nv0E`6yTmgXj0KjYj;4=WAB>)fr0O$Y!B>=Dx0Pq0-VgZ2b0Ki%RAOiqU z0{~h8ARYkd4ghQg05kx=CIDap05Ayv=mh|b0st%lfOh~u6aX+802lxO{00F02mtg1 z05$>uV*r3!06;|m;5Yz~005K%0IL9iw*Wu@0I(JSm|Q>06GHz{Qv+D0H7@ZFbe>f0s!m+0CE6;763pv0Pqn2hy(!M z005T&01E(MDFE;#0MHZwH~|1m0|4v*fCT`+W&mI!0FVLz)CK_d0|3tefLj2-3jp97 z03Zke_yhn90{}(<05<`EzX5=U0KgLfU;_Z)1OTK105$-CH2`o709XtFj0XUI1^}u6 z0Pg{S`v5=>0AM`;&>a9+2mp))03HJX4gf$U0H7`aK=Xe-0PqL^&;kHD06-4_cmV*v z005l;fGYsN764#40MHr$2m=8A0sy`M0G0s&-va=+Km4OV08kSEI1B(Z2LMU{fNB6h z1pwd&03aU#*aiU9003+OfNKCiAOO%90C))ibO8Wn0szebfKvd#2LRwH0PqI@Fb@Ez z4*)m=01W|vZUBHM0FVm+v;hEA0DvC=a2o)q3IH4e0Qvv`AppQ40N`@~pd|p10RRjF z04@Lkc>sVT05BT>xDEg;0RX-Q0M-EjnE=2U0KgXjs0;uU006H6fZYHW80CfO>ivWN>0MHu%Py+x;0KgRh=n4Qd0RV~tfI9%dUI5?*01yWN zoC5$l0sv0|2}MfbRf+MgTxx0AM8mpa1~A0s#I5015$s zxd6Zc0AL&dFcJWO{2vPWKNIr5Cggu-$p0>o|MejMcR>F4hx~Vg{ND-rp9=Z^67qjA zi0q{@;Q8Uj_Le1o^)g^8X0r z|0l@*w~+r@$p58~|0^K>{UHCpg#6b*{@;fD4~6{S2l?Ly@_#<$|0T$O736;d$bSpS z|3{Gj>5%_hA^)F4{ttru*FgT;K>lBV{67i#-wyIW5Axp{@_!TLza!+oH{|~W$p2%I z|DQqre*yV_4f1~=E6D#q$p0FU|Gz^1r$PRQLH_T7{I`Yt{|oXz3GzP| z@_#zy{~MbBkpK3O|DKTlbs_&FA^$%@{#Szh?*{qb0rKAg@;@B%e+}e+L&$$6taA^+z={$GUr-v#;q z1LS`l$p1ee|0_WLPl5bz0r|fT^4}Tqzc=K6KIDH6YrLjDhj{C@@cp8@&b8uC8{@_z&5e+1-z4CMb$kpD%H z|4xwq_aOg&hx|Va`5z7W{}A$j4&?t`$p7t-|L&0gPayvfL;m-J{C@!X-wg8K1MI^|`M(bGUjh054)Xs!H4)XspnXU6&$?z&GhMWA5WQ*{c75@#rkK@D*QTW(y{9? zF?*MN|NZblm1>BELScC>ENq*9ixxBf`t+&B*T4N1H1NwW?>?M7dG*rMr+d{)Nm-Xx zTDqAK~=qa(~e(! zk?UY>U8&9L)n8Y%wY6{P;?kj3a`KuRw{CSi`}g0C2Q_IDF>BwxvkwvyHn`Z^*QzsT z&iYX;TgJDmS+jMATD4mJ5gom6|Clk4$L8d`-{j}_YI2t@0}uZCt9r&)U!C)7)@<6f z+qXZP(56jn<+*cLZ5cM~<)I4~!fEanK6=#B+s!TT_J^y_y$Yrue?_lz2KZ{ANo^*eI@{G{)nJZV07`}RAJ-oLLpzekVn zR}UQcTWH(1Bb?{WTan(Y*H8D~zIC#)u(0_wYu4yB!@y!t$S`O+%*=+PTf4jd@lef4TWcX#(-Hzz06 z9lgHh$LG&0etYp^)agw8c>-FnNM<-0URn^h4&d%R|pZt4C zNtX~$PyhJNod>x(IMmJT+xK^+jg3Q}h7BVN#*O=P!-*5)k6pSH-DAg&Cntk~wscyy zEZ<}0%1xL4{Ilb;q@;zv{PmaT!lI%c(H%REz8V#EP_cONqP@TT60&yCpo@LCZ7aDP z8M%LlzyG`EFJ9RG^x#3G(;Ch07gMJ$>Ah>$eJ4A+>M@58|5BQmnA)#VqnL56TkE`P z*KRm+%a*5c`}hB_>eQ*BKi<37Aotp}>G$H}*M3&7p8FU5`(INZJN8F~g$w6bN>86x zqSaRIFMVAw5^~QxUu2`|P z)tWU2y4I~*zsiCInZ@_-yDd0(uJ85{BlJU>Hci}o&dq&epO%(fvqFVx zns2|o`rF;R9&@{QKXpDlydcHL=euUv*?Y#cYBi;9rAp4z_U!pFfB5hZQAdva+OlfZ z&YJ;%xd1>m0I(PUr~m*Q0|52{0K)-*Apn3S0I&@Jm;nIP004pjfV%*|Y5<@Y0I&`K z@CE=D00310fWHBNVgSGq0C)%hgaH5_0e}Ypz_$RvYXIO20AMTtZ~_3R4FK!{044$e zV*mgj0KftO7z_Z60{~tC0PO$(I{;ug01yWN3KNza;<=2msUr0Ez&BM*zS#0Dvz5a0LM9 z4**;T0DcAl?g0S(0DwsVKyv`#4ggRU0QepN_zeIU0RXH30Db}hoB#kD0AMx%PznI_ z1ON^L0Ji~v=K#Pb0N^+PkPZOs1OSc#0DS-eD*)gI08j`3Bme-x0DuYrs0jd61OTD{ zfB^u2D*(_Q0B8dM+ynsf0Dv<9KqmlTBmnRX07wAcU?u?YB>*r705}Z*Gy?!G0RUYAfFuCm764EO0GJE_bO8YT0f0dOKwSXf zcL2Zv0Eh$t{saKV0|3zgz!Lyq3jmN00BiyPIsyO-0RT?`pa%dj8UQ#504xFkLI8k^ z06+-4h0KfwPI0XO{007?s0DAy{DFA>o0PrIK@Bsk$6#(cA z00aX7(*b}f0KhZ=;28ig2>^%z0KNwRQ~-bi00;vBS^xl_0D#{BfG+`n$pFA<03Zbb zC0RX)KfVTjE1pqJ$02l%Q zbOiu5008*_z)%2SBLLtH04xOnG68^f0Du<&@Dczx3IH4c0ImW6?f`%j0H6l|o&x|E z0f4grfD!mM*tuS09XtF`~mQ03ZSYxB>ty0RUD20BZn%x&Xie0N_3Va1H<% z0RS`w0B!&PivWOJ03Zzjr~m+b3jo{&0J;MJ;Q)XS0FVs;v;qJs0RVddfZ+hZ5dfen z008-a3iAIA`2KoOE^8X3s|31k7C6NE`A^&|K|G$F#4}kpd1^M3q@_!iQ|DTZmYass< zApdVd{&$1?9{~9u3Hd)0^8Y2|{~XBwaLE6mkpCAT|KCFX--7)A67oL?^1nIcza8ZN zO2~g-$p3Ya|0>A;j*$NjkpFEU|0_cNH-!AJ1^Isi^8YO4{~*Z!S&;t^Apcz;|LZ{h zkAnPf2l?Lt^8XLW|NW5vV`SOkpEeb|9c?+=Ry7-f&Bj-@_#Vo|0Br% z`H=ssA^$@m|D7TK(;@%wL;hPq{(pk}&w>0;g#2#=`QIP%KM(SMJmh~eqKA{9g^4|&aKL+x@6!O0x1RLj7gdMNUf+6eTtEByZ||qy?v%2ojebG9B|Uncyng@3;nP-l zZaLAQ+v5Q%9lO8#ZjfE;+|Z_18t$7sHm`5g!V8UbZ(fDW56`Ol^QLiU#%m5_Mr!*E z`S|G2)d^L6M{ZrbZf?fqFPTM0FFCyabCh+#SG{b`x2(JL^yif<3U?o~R8&r%)One+ z&)~2>9;|xy)49_9cjLa;5nunWo$cq{dfV|{?SvcAy`R>Mt<&uLw3vfI6}MOarq&1l z&-$ObnB=zl_v4=u&yIOf?^=G_RNEgs_PRKYZj$^kAaLlcZ8g5`SE1FNsT-CTuYHnJ z(q-VT<}ddY{e7hCoMGAOYAvj09-i`R!qcP!acG%W6hHahNg z@$UKKUnO3vc6d<2fokEWc0QRtt&i2s*-P&>OQ^B&-lCBnR+ZDOKTNP6^I~qg-KD0N z!k2WLb|v(e&X)_1%)7Yr-Mwjhtv+=frunQ*udidyrtUkFwzRa%=T}-EY_-#^ZM(j2 z?sa|NuV_oJjyYd#`~2+fvpYA`zO%4#LcOq!KkoJ3o4n}hf=w@O9Pe-4e){;@6(5{D z6|>>>v%6=DD#ToSy6DSxCq~;Bul9)#I|ocw>)`%H%@*2fb-GP$T{peXFKbfw7TvA% zsP4Oy#m56Stlc(ea8CDKOAn9gZ?FGj=GwF|JLw;}c4@k|$kVxN zu*V(mX*ZlIH>`4}e`fAy=kps+z4bO>skXC) z&$PRd9i143g{76Xjjf%%gQK!S#Y*z_n36VRan)r@Enjx^yZZg0%Z*lfTi0D1@bFcS zp0D%k2R=HZ8lY+VYV;3@p_`qq6#lwvg1kLGoLIPcK=7RD_V=nWg-%wA#j968IR0vM z%!sv719y+!{48pNo88FMk)N&I;n)Alj^gI>_89#4A7S1X9Xl5-op`zV;600DzwDhe z|6cT?=j&>ZJ-q6qouaX8ov`QA?hRWyX5nAnf6o0Mw+F+h=wixm3MTTv@5hIC8GW_S z6-U?(l`k4)F605x{`K`yV=jwS5 zTNXTd**BIGhPdVLh*r;Q_BQ7aW7*cj;;6AE$(|U^Tq(HnU3zm+~;pz zRkQxowDQVMaXtTsTZ@@hsy5wqam$yltEAfhG`Oq$d`sf?yuMm7#IMNdd5h$Xq&q=x z9$fTmIcb`ZF0k9*PE}6Fe$yguSLwVNQ)bs|-_o{=+U~bjSxy`6U2nYj(|-KmgIm8! zYNbxt*toKDfsn7P&!JYiHdWJgSCT6DJYI73QtIEW>wfUPIv#Xj@4DZ5d2ecQJu0!oFRRBr*!A3LSfhQmZNzzoMMQ^1YTVerb?g=u z7bcD~8o+jTBQmt5t(;?~R~-G=Yg|OA zTX3X0I?Rp#5h6EFRcnvd9&Sy;E^78D|OmucGSi{C>vSOYZz6VHFOZ+F^EE!wzA!2D(8#hY^ z-y{@mmP}>l3h$pfSHTR#myh@ac*#@23=*ZL^Hq@@SCbvrV4UrE6J8EgFoT%~LXp_x zAqCV=VA9|z)7!Gtr5(9g7aW2fJ{nrlHvc;Ohkf*H@mOXAf`q$EC&X~qvhu6#j^ zFoL<`U}hYjKZEr*kr~eC=Z+(oVSIii8y~`!6G0}BJ=QRL`23u|Nz8e^|G4;2=78il z47rS(CC0OOvosmcgT>Jp-$P`__*R5yvt;DsQ)pc-ktH)+l$z$t2-&fGyvfJcC|UZ^ zvg0wb%!iD*q8N}zOk?g|sU>y1S zC9}u9nG{+3^pqWEAsuaMd&=LR4J-IzPv~_OwZDQN?nuhGiu_2@^X)~BB@4W&6rK1AuO^Woe0q)n(h>yw|(;<~UtY4BiUeRkx+tWPg4%=+Xn zB{VLDcB_D}D}RZv!H4NQG|S0O=TY-vI!_26rt{Fuqcn6LnpG60^E~FmbROCie3@DQ zl#$;AJ6kUvOKcivE(D!?!tG9=^@l@^s?TvgP@V z3yaIM8z$Fkoc(J)O#TY^F!?*ehsoc1Di6|=zY0_ygbn54(ae^I$2O&NMWd3fDj&uN zyD4~dv*`mlTT^_v*5tzee3;@Vi|mbPydn+R+4}P5V(ZKMq%yhI!avy9K1G<)Qx}q* z@)1ucO!;V2@P6te?8*yK54j9n3Rb(g((5Hp4b)L*&x%0!ZdNQ4Zu$6i9bUq z?2CV}4actFmLa-}>*&tLO!tgm2pOF-%6Jpb1SM+9s zOgx1(TsV=!NWT=H(<$7SvnNxy9~YiWVHyVWnfo?vO#7Ah2e7( zKC>uH6~(p|yTXqRGC33;%Y`YOf|qmo6y|SDc2JlqjcpHh1vM15{n*Jr@t}ah)JWKl zVi)*X31L?^{DZ9pb_(0!vmGC{!Y6eJ*_HUDrlGJCKB*`acEu+Zm%{j;8Oetm;**L+ z_NMrxVo|syK8yKqb$njp!?p2QNx`L2A?(hFsVx2YFx6=SAEtVQ^II_r)-eJp?IRoM2e3;Ul;=`2p z9v`N%+1hdGscbFyFqKWkhpBAs`S1#aJM-ZzgnRJewFnR7!#fb(#)tC}-pz+MA^aU5 z&O!K`$o?}Q&WHUaAKrs-6KE)Ee=28BK1}5t!iNhGuJ7KkLDMG9n|Zcv-3q_Eu89iP zCNZsbG4$8IThnj;;}3Sn2PEQ$qv_8Lm_!7}>&!>Qga)w@1{Y+&9~x^NPrroUTBnIr zv%%KF&)!o)KO8iZ#mY!nu~=*PZI^HTq?f1f>p{u)IYtxJj6zrtv~^weasB$9@p z_=&Phgmqk?I|6#!mG%XXoq9MwuNg>~FzSk@*Un8!hrQCN<&`pltu>gi9mq zG^!N)w@UE~`w8@y>Deh1r8QrD`codQ>6u;Y-h)Q8!tdq>Phwir+9m#2atQvQKp2BR zz7QQBYWTwhhTp-Ts?o*ZujlZEG^qvk8~bM;%I{iH5)&7qICBjtiZ;ngXGfO<5H#n? zX-KmPP2Bw}S0;)0=_JL8s7&&X3u6DCylFpaf`df0Fe#j<3iKSc{PyMxX-sJ1&LoAo zwwEL_QxDF+EQ0D$&WZVPA5>lyjA=0UTMH>o>cAz#G%lw#FKjggMR-eknq5chGU z$6~Nkc_@yKNsEj9kuJg#hG7%@ImrB}ME)Qf4gPG9LF{h;A162z{3#Hius0vkRpbw{ z(%|m_3M=+E1aY*kDr|zkJ4h$?*GJ?JGSA@eA)JZ*h4685e}5s7*xzuGKP+Pz{GE~c z3rAc%!5N>94u6pO3l#aQz^9}B_(4|RR6Y(L>?YLrgsi@iB7c>TlG2gCtulX$V5^N? z*aUxhGJlC8f3(~t`1=9@ar@;Xj?N=&g1==5P}rM~mFCGE0zx}Y$ zny9c*I@)3ops+U`V9STU;rJwfRj^YW`8$FD`4e2&pwqB;jcRER6cj?faOyz5YUGPV1#$tazBZ8jG2%F$<7Yt&5 zIU;{e_&936)^H~FcMmW#SH5OQB=&btsXYI%9oA{mbiS?E1B=#c}OQNUn2Yo{o6|9FGA+e4gMMdE|NiTw3IYN7osaQzYYZ*m#s`zRYPn?(M4iTu&}tk~aN_)9jF z&RAbs)1@+a|3B=#4R}*U+BbeqlBQ`JBq=3)6f`LX%9kenuHs`-+EN63N>|Ir>Pu6x zv@9SkBE>Chn$?ovx|XVt;#XRCrA2ux^@A3c-3C`E2ny`FR(IJgtRLVi76q*c=Ks6r zoM}%(D?ZQvdar%2>wO2BbI;5@zq#jo=FFVAWxr+x-b}c0`5ptU#M5A~ZkG2}fkMNGk<$L)oX@sRlnc|bJha}2`Q5Q0}W2;T=Gc=dzuRU$%VyvM-T zP6Ek>%SZb%O1@3#1nis%PtLbW&KGpc%p3zBhLB!Ed}Ln|67NaywfA!M;Vln|w?1p& zcr9pKO8HKLkE#|oTs{jNlzc{XJ_GU14#CR;AGKF*kiE>HI`_lN17D%!#eR9b9U=9v zc@Vz;3gI*442(zn+{$#U8ia37NIoA0U(EpW-3~A%Ug6Av`5Hs`y1_S4{yiu2aX)je zw7<)vrnu;DiJZ^e{UPuv4e^k<4}9u5LFztTWcT4c2(5d`feh!{sqJe+)=dDN|hO|u7i^cLtPg2=HcY}YzQpJUF_3IOHdbX!S}aM_)s_Dd>C|$?hhAh)k1@s-_Eb5+xc6d(3f8z zUbnMWt!Ys6+x>Bnl>8O9`v-nl&0XEGTJ_Kd^))SO{XX>&y|(mR5!B~6jYZCA*I^?r zO9vjVG{=4BxYZo01OiiQ4;tz$8(vlASa7V=P^*SF)4rsRChbV-VSU<>&biewwd&#A z-^Bb!^!np+?&9+fw|Zo)dKBjw&3IxJJVv(~n)=3ahHDwabqa>)@;|y(J?wbP=R-?711bivZ{M8MZ#&5+StB129k-B$7a3Rx$0#zkn`9(wE#uAPm6^m0hCi zr)G1u)$Y0=EHSz^n>|BH&J_Z#1X}5ew1TUG>0z!!Sm<3WTp9{?e=it8Z7^2^Tx+eQ ztkvcld)#6;3Poh^8$S3G^cdAhNQd|71r+nq!{(Z!7yLUU4P_{C|4Zf?-hq=?@p^BuB(WiSix&14=RTkW??st02-2R8W&gq?`ZR?L- z$Cw_k%^jG!sKU3Y<_SZ4opEc4r+!iT?B_}IcV|_XN@#c^i_vAEJ~TSilPVCtBgp%2XhuQ{aWaz{8x15KB4FaKs>b(f012Kt5;+9o+X z<9zW@kkwn+QJ!0$K{ZAGYzhVs9Yk$F8IXpA4uca8`=#oE5=O?AVTr#1H62x}-D7tB z%X~)k3~P;XJz_;$+5I{-3RXOaj!2=J51S8Kq*k+g7kq_1giN*FE1|d^F++dZudS|D zV*pE+Jt!In+ErhI{Z*YDQPD)7M?KY*)RBiW7xh8I>4yvpDht5%`#F~<|-8nSC|Vs9sU!BnrF;4@0pK2XH6HaUt7D^SzSww?ZpPD zH|<($C|qmKwUua~9K6H=?S2c4d3hJ|ip|g?xxle54C>RN$a_`LToL2i06nWz0lmX7 zhqVDXaZ0v|{-(#(5zaX43w!du#eRPkt?S>i_phl|g z2hnL$YedsQx6_ymRbeQ5Dcwb+1?x zG?3o%ugyrKptpCg+9Zs&3uo)QJ~4MO&Mt{_rC4*8rRZbxsl1qn`9V9FcU4o1z6Mj}I42lT7VR#@QRTH1ec}%)6g4FVN+^Z`~WwW;xn@L0DnzE;fJJaXxpbJ=I#<(Nhvp zIK}E}F?Q`Sm|1m2^|PBV2w6sRmbv*=YhHq*Japt%(R_!w>mzg5 zPpx^cSlc2B8y)T24TY_1pgFt!bpu8oSE|_j3TZ6yXIbsc*Uo%huZr!-1{aj=?jhg2 z<_kiK5uD9Xyt>`$Gd4vW{jJrt+vsypkv2MfHWVjN3&HrYvHADJ*fcbcA?8VluZis+ zvGQPu{@+-AmKreWD9_dwEIpebLgnBfs&$oRMEZ5zT!Xj^dKsZXoMr|JWpGt)wXRmp zmBB$%Ir(#Ca0kt9wWbzR8hKv9RKa0NBWZPPg0E1E36bneir}OP5e?FHX7|34-jgjV zq0OS7(iUj(2agHD`#aIoy|BnZtqxg=uHU-W7t7w`#VDkYs?p# z(M=|xn-t=V<`XoEUk>XX$Dc9RmDSW-sEIeXAGfYMS$m+z7tv8w^R%`3pyANlkfUaS zqxlZQq5^cOt~-qFcbIGJ7f5e!E+Roawr88?1%r7XQZ0cZoUYHLS;C5;)H@y&+y7`j zXlu`PImtZz7L#vpxqBD5%?$35-r>blUi z-P}~=`qXGWYw-6tDvqrR8oItPo6lOogLZhr+I-n?vFFR7!qId`GgM8d9??SCH0po% zSLUPE3vepgbYrTle>!MB+PS7;=LhexoEMMYVD4gKboH$1h8W+Ac~Zyo1&Lwrx*(i4 zA~M9(bMo|cc+?=eXAE0?NY>HQj^?w5oAsamlPPC4B2`DbF2L#2kKrI-`cX%b^+t6N zrPyKf|IK<7o%83^IiDWdSl0Eawf$|Y9kY_p44|&sSz|w8K&CdHJay>O>1!yPs{A{w z%^yhh%g^NY)U()7Tu7+DzuYIx{>C+I)I-Zc0IK#j!PU5?;kKbJ|AmIzt^u0+wjrc={I;m0(7tg*+t2f?COw{ys-ej=rV3JVwO8Av780FC1{Viyf~wX43Xybf zy6YP^RwXj0ov7^^VTT&3RH4s{H02fSo<~dLBddFe+8W)dhZ7OB~(={jeU$`YZKFDs{totL|Ljod-pG4v6Bl ztx&JCl%Dff8y~2Ua~hw&ghOOrYOPK*O3GwU!0n77&5px8^;k!Hs@%>Iae+bhuo`T+3HpawJJWrQ!!1yDz!ZQ^O_NvTcxR0 z@%f>O%@0+4en>fx^AKz;{RV)}JC2wwBeOa6DOhidg;GL0uPBo`G^HKTz1> z-#$GYomaT@b|LC`AP?EUL)%t%B>Z#LWl~FtT1E`KmT6F#DBh7`$+_5KsTx&SCZuLp zKOQ6(qHn3L3F@JjRRYji5G_>ITjZT=R!Gu0WhU>WusOk&6UM4^hE~>#f z`f=*RY|8f5TMMMd=A27|%3w92JWzP&Pp4~l;Oz%XV!ksTI(XNKdZt6b!O9^{E+&fGR-NNXwCoa7qtaJe2)X?*ScoJLz4B+};Pu?an!;wzObyUM;og`8!Kb^Nkv?hSkHHgF!qM`I9UxugFM$; zjTS{^>_n{V<*Y5bvi_oQDKAuV+3Gc!&X`Q+@Jy#E6U{@)R5h|n%|ys_#`k4vhzP2^ z>Yj5<1S%_pkTZ9*x+D-=OlfDuD`jo^PSaPa{jAFb`Me4mWIL>0maR$qUuC_1qgq~+dSvt4{waf-ahoK;a}4pJU{8B zcXn)gw4&q5Z*O?}i0%PT`klX=oG|mRtp^_eP4rKK8?LdXS{CGrzfQX^@z9x_yI$14 z_s4?F3E{rN_g`-_+CMY@YOnv`Lz-FR&i!ZJb;JJF+5YVOf4=eadu~!a_8+Im*M2no z#N`o9fB5s(U%Z*I^!xjtnX&EU(F-MC#wM={dw%1)>#7^A`{&KR_JxUGryO4yZ*njG z;Nvw7UrcQo^W0tcx+2T7o?2cL_0y#Fi}Js6)_>Fdms=`Vd>+&F+neKF>GA%(Z1l^! zU#t4R{r*O4NnPxQHcLfb#$QjCM-)x}k6-++U!U_Ietz=U?_U3l`HzoQ-E+bF)-!AO z&!15+;?MTcbKCD;{?A<cq%#|M=q2`>hxMX8YN(9iwLLowxbyhmDR8f=BMC zPW`}m^x&8me)rkxnxDV3@Ui-D zr+v9ocp~k&qt`#ZGT|0i_sxGAzwxzCGG96H={IwXN$Q4|3UN1N{w#-dHRTd>0=^rg zt10>Ako;=O5H5VrL|p8`N(#+xtn3Rdb8}ajo4eA5l~?l0t|7d*$8rE(*;VEZy#Vow z8`O+(Nm+Lkul3Yz-*foH+2DI4zx&IJOXjS8rfKm_A7_uKn2`1K$gsbDvVHt-O5UDu zuBropa}$eCe+Br^Ebz7&E`)_Po(w53P^ca_af)QGc&5cy`lA zuO0rc8@~EO{U5e0&MrIu$jMF4l$ zZrYx01ySpMv;WnC)>Z4@UUQxA_H&-c|6x@vPuyG_Gr}_Bk-GN!b1mJa_VKs;-0D5` z{56fsp6_^Up}l+2duJW*4V$^A-1*PkbN`N$IJoaXaS&#pJMumjrB$gB?><#Rgs_w! zdV#wrBnsYscAK!ZpZx}QzW_sE{8phyj_)}*VxiV=$$RA;e2N3C;JorqzR>V^cc?Jx zeqVf1c$31H?4v{Mii=XpNw8JhnTdg%}}90Z8G$ zm9gmDXf#gh7s+_Tn0<_Jw;Vo+;hBXrx&GHO|9D}$jOSwZ1Ytyod|!sd_Y3fm`6&*2 zMY9`EQ0{WIBxsR7DuKb-2tmZwDj8}8VjLr-dSsF47;>lc*f1mUCz|mClYl=_ZaPzm zma7S!FN=}oqi+F;ra0$AMxrUsU&}NFuajxYryVj)asFPWDb5!Wj>6KnYOl()8T3J! zjtAX_JR}~HD;W_IO>&VD&G>;~X^)d=mUcN^B!_5`-0Aza7`e+JR-!3fl1x*$ESaWo zewilun`D~gznvPC&G>=& zF=?p*UyR(HJt@-^ZmUcaKJ}r*L-?5_GiXZ7T$!e{{9UFgEo4NwNmKY3?22&1>i}h6 z41vf-l)D5bvt0M6Ea`qSGUM>a?<%`TrpbMk!kz3K$4u_jm|zy*kJDu5Jh9|X4NNv% zW+sE&1(Wa(qJgBh-Vp|cM>gkt%b6?3(qA)ldv!)_#^(!crGVe?s`|r?l0kaAJNz22Zpjc zCWeu0)FWC0D`gqc20TezqKS>Nm1xS>WSORXrEi$X-HfM0ruBH|>oGEJCUWO^0oZ8A+bJu*!=(HLL|llbj29S=HB zrb!;th~XpYhUzP>D#CeFb_;@SF)oPcea+gfeMH1|)eDJ2ndD12codQ_ z%3FQ7Ph!Z0K3CpwL!3W!-%hW8=!H9dQPAx)?Eah(u@V>Gjq6Va@d>$(hoebJVPOWA zRlY4`@SAi9DU^v_qv0f<;(HfY+#7lekJ5+krlN~=e(>=B|K$E07JKJMZ zB$vtHSHVzheN2?rK`w*oV`P`K44ym*jWLCMr6J`>U$rQ|_da%03eP2$)7)`@Tg3WA zknWHAp}djP#O~Ju-#~YK8)rmcWhHPuy^_J_OGPyc#gs@rQ1|7w-gwQ_A-e0LH+d8;;irCZg@KM?$B|b{;7f8HPzP};EIR?CY=@TJ**pp;) zaN;4u!*qg=XgfK=yc93RV+T#~ksm#yL-1Tkqyg^SaJ(TQc&!RNO!<59zCa!*(@_IF zTIX`Z@je9~(RSJ6kHDk)LUxLu{763fE?9{-5}7toxji2u-+2WdP4zimbqHQE@Mzu5 z4e^nw3c-sX-&by!KJ?;sgI3D70GYut2#3@El4(0R!c+i{(r3pX&Gor_e*&$^uumPw3{ z!l#AcJ*~i_^5b}mLdwGfJRJeZhWNp>{47uHx+nvKdv3_wC3Y@KLM@8TYz@}^qz_v zj&~azlz2}}#D_d832&R`^CiNY%!hb^u}>n|F9o4LYFqT=>3so>(F{8`;~{nGLEAbimweAVcD2Euz&mXFJ1!n?vHA@Ne)d@JK|uLtCJirh{- zWFk;t%I|TxPo!68$X=G8&ebbztDNPl`8T;&`*t!t zF*%uiWNE(oH{PGgg(uAw6QD&!k`CuzeX5%0+ubkwUl<+N5`pjU#O7Ap<`>1-rY4m; z0vkF0$J;lwg@GXl-G^?PZfy5H|AY8|C~A*>`mX8s2ZF)&J^t1xf0Qs`beB6q^lGLw z<(P!mZ~YT2I7HeIp~9Cfu8rn~2({m1_G)G~RbL~#zUWnWFBcP#WFm!E$4cP}`zDuPOXSD0uZnNj}JUCSDZ*KOO^|8$!gQ>NL7^1vhF?M6^!S5?S-K)YUGEwv?2EOlW3-gA@dg{cex@~oz z?0=7!1f}(*LDEV|?#pK@0WNGw2-?qny0z*dZ2=6Px*t$AZUA#}V z(d$*EjSOped298zL49OSk6f1Zyq?^G$XZ^0b~~Id`pa!B(qa0 zajXUkwu_~Qv=A!M?#T z-*?l#fSKxz$3|6f^5wz}2A{F9Y>O}2bW!L~byhVx_lA4Q$aB$mECM7xEqza;m~#f7 z7su0m?*Hovnj1$8BXGF9^1VmeBtO>lQSZlqI(aWE9w@j3zPbaXH1)MAxp@< zfX*qmXRTn`F07A40j!Uj7CyFHZv0;%RGr3Wd12I<2Axo0EM9hUYx?XzQZBG=K#MR1 z?_Kh!yz#yms+MUZry$4zu`Y~wX203Twe}*o#`}g#TtmxW-m3j5sDBGdX{3|$`tY2S zylkAXt+T8%t`m<-?Y^(0VjtZ3jBzjf9#yTa6CVxtiFi!Y=@)IQ`-u8txgF30d1fjS z8{<$OD2>K^{7j{+Q-0S#`KmH)6Oj*|rCwFzL{!hl`S{sEM`#M4Dr(uGnjrHYT<^dZXm^#}OS-aGACkfFV! zXy{igkS9y?nSH1*LgpXN?8AEB=}7k2-gy?h**q!_b1O0wb2M(Jt&{CPWA<^vU*z~& zn0+GC!vRvD^+_~NV$hwN+!#R6C(mT4WJ#acFXZr)Q=~s^MF@Y7>`!4R{3$tpDZZP8 z9yxuKlcY~d`Mx=Y=k6?B zSnqSg_kt-;`t5hq3nmyQ&p3&ut!}>GjiqewemD7w3G^$U6HvU2;qfvYN(4+i{$fZF znBU@$=-zbELK_CJOoSMEDJ2^&rxJ(BOqB$Nr3-W~4pj~q#zUDT8;--=X}!zcsWHM( z)gs+iWTJcZ6RcQOy14uv=aR)mr7NA~q#xwUy&)`Sm~Mi_E1fIuSt6;aSY8UHBCAWB z%a`A~cCa_}R}V+K1plol|GQBQ3cmE7`>;31Bj=Z5NK*#}cYB;YyDFdqv#;o|S7>{7_DkAPSy=L5l9Z zclp&o6g-1~l-`HU6=*(QymHO*tHTY%Jut9y`HzF_;|txD{DDG3qq$nj`&b5+uZSn* zYCxfk1H&O1R|8@!{Zy3<*4C-`QGKrl*vB%kOsnrHTZ2>K_bk4*_-asBvR(;!U%8Vs zO5cP1*B^yDAU|*5SEyy-9)oI0p|;Z-vw~~DuA@IA$G)3-%ew`|%ON>mSYms7j^4oc z7Gsw`Bw_h7!T zL7pp-BcDc9%QW|r-jVeN>m5TI5P-rc`S|!s+?;*}Ohnts5k?;=&8uz)P4bW*O=H|4 zcy;90>$^3jxy<4pzu*535$ z>&-jeo{ z?;!;q%`rLNSTOU!ww#rmq}N7g8P%$@wk^>y;1J^!3AgRe?uS zT8{Tghybl$4*MXVi)r8=k2Oh^DOin)%f_F)gUW)>6SqL7jV`)vz z4ad7D1W$)XOYN1?I}U$bz9S%%`A2u_aty-cG@auh+D?uzbncqt(Xxj8$nFQB#47> z12-IRIrxaS%O2?pyeV+wc(c&?EAeQblVea&PG^CSXgfK=WGV3IZ4voVdP#4m5|4D% z$jeFi_TgO{f|sYjqyC)ZtpTCL`xWd1wGS@0og#s`6L`FR*kI>)b3^c+fIW?ckba1d zOfCqb?PP(uPl1;NJNZ$1n?urjSPlm-W{8i>iy`U#l_I?<@aK4shTt8A$5e(O{ct=_ z2%b-YN9o~s@1y=I^Y0Qo2Fkxb%k9Q4$MqXUdg<*Q$D{8llz1A*F;M$>H3aW>3OqW; z&GACd6}8IglEq+rM2DU$`m-Xv^bU;U9YVcV%J)0qDc?2{ADK77N3@+RFkK3~TVUsS z*I=Ti#JdE%f$}c`d`i5}6zO#+@IFR(C7uT1sK4cg%Xd=F2fOT{L1p9hc?R6Le7^^+ z#EX~Zkb^NkqTBGNly401sQyxanl1a0eG~qacnQE84>xYOe7}N&5-&l4H&gZ_ywGzU zbRL^y5GJRo4^!eLEAVLiB0s{TGeJuEZU^2#{R_*|l0)zoDDeIhI9$FJ5RT-dxiy(55pIb@vS0F}KYrei zdwmN&r6C?N-=JM8&l@a3yyQpqfDGp&ojqtGz2*||407A&^A}nd(9&*gIdtvH_sU=G zyg^zTzf}I}=M9cVOVKB@M*`+CB3;IezaZ^Xx&05$Odsk~S-tHak5p;n1pUbU*TXe9 zGkv5-W%aecFli08Ayt{VIG&(S$n;lfC(>U0%=CE4JEK7M_Na)k`y925H9gbs&KZL} zT42!zpa~GX1EUWvh|Ur5TG0Tie^hX|GRnL<<1ZjW{)cT}@5#NV6v#JCt;> zu+LU`am!=_eX^G(2>pOKQ+*xnT0m)^~H^xiW{$=|$P z>?cGi3GpxqK^a2{>&+Zsn>MT2CMRt`o?yWjg)Mu4JB1V8t=P|IiOQe?nNG>xz9F_z z8zmJ~1Cle!LS8IKWL^VvSO{MIg#8}}!6e5Vk`FgX`LHcUti0Hl8Ka__nsoY6xOAye zXWiZYLaZ)ody@`UeIgehIQnT^&d_rq4q=5#KLQ!8*ZH)_@)t(uBOWcPSnOJRu4QJz zX`dDc8R#~_MqA}~+g{W}t<~boUE)k2P80)SYmqHd9*7<-%LA&E+I*G+l%svQN%HI% zL>|g;_|sVx$ds0z0jQ-JNrk)|!&tT3oZ4HCtTJun4%s;()|44N^gzNkXP64`lVyzLs1@V>kAQfzkd@N&u&A(i>j#C z^p&Ul-D zYjTTaI7^^71AyCsBg5DkfQ2}`F*Rx)4sV3v+=O0bN(-MgLO&Ym3lo|qnjX+nVx=Ql zxyD&DO|J^vbG~V^)}!?sSrXj1m=D`TC&J2yALRRX{|$;ykf}Q{ zW^;4(GYj;VuFqU~{{fBeeMZf`%v9P(_1-_Q0?w*_vsijZNpB_kjQR?HOP?pG|H+vI zC4gF>RaBq3@_T>fDuCj12rr2ee-|Fnm~l;z^N;2?(Rd>xZ&@-X%8ff^{t3)KLbzFx z-{dcQ_wv)bAu?|KMMHCsRkmNx>_de|f;sc#=U|fXyUC%lw(lKC<^cBE4^l z7Gj0-a)gq7T<>=@^O*lc;aQqQ!qEJf&Ln(-`5PI@euHqnpMR3@t{mS(;E5J)60Vo| zmoj^ruu-;4^4=oQS#fSC{S6`caa)L;);eU~#~+k6C=k9 zQV_`jhWJF92(I55205;5a*rSm$qagiLCyzdyi877Y``!%LHEXMk=$9lLnNAh zMWy>SgSgX+XW57Z3^N~p{mw89AP=q2_!$P4&qjqj1MoBX<+(kRA9Sz$2^6bj7bi(H zE8ocyP08kEM>PMIe~L^KPL52I|9XY{uVk9={4z~E|0UDpzFR?eDCmC27TAJ^pIe}< z^;I~&K-*KwUA2BYT2hEBH|>9rsc&;m3a;GP@3&FU_SdfD;hX=1?Y2rGuseG%7H}mi z7MCu$XXSmR#ijRzeo8xlls^#a%6&R1qH^cj#YJn1i+>Efg7+#%7bI+UGGV|CQHB2? z`|1*h;?%(p;7DA9rBFI_Fqp4&&frIG_De$b?dAV~Onpp)#T>em{{vv5tb;*H2XaEW ze*k#k0E5Bbd-r`f3LqWO_@SL*DVql19t@a$0gM=6?0=bd?SoDF| z2ZLU7Uvc`67W+!(!C*_BDL)!j$=m-#$6)AmR)hB+sHuxrmp*V$uY=+=!(id>EnRZ; zG9o4(iQ=pSs~y*0sd{a&4srE;_m=6aJU1c;KCPl5 zn`rJOy$2%>$?!4rc`$|Y(OAX}=c^9kn+}F9&V(oDs{$Xn`umUe0G~wZOe=pu$A$Y5R=a$3JgX1j-!J{(| z9FL}M#7A;W4#A^&Kdm9S;dt(l@`y(`9cRLm^Q{LT(RSI7&K}U5jM72#cph(I2p*kn zpt(Oc9Pg(gcyv~P$9EOJ~VUq=WY?PU&>e{Y1~@iPE~ zH%@^^cOHSYw?Fs{cskg*;pwIO_>}U|8310d#)FysNInAyCEj`9(Hfl_;v*9Uf@nKg zU}(>twvz>h z_Sh*r;Z4CG`H}taNS`vjOXP6yVutw0(B8BXuS9`24gMVO&yoX>PNWQ%xc>D|i`kbM_`%MU*0eBA$fcIPoUWWqjCIwzqNd7%BhMiQYq%3_mpu$93@d0VUkCoU ze8)rZsN;HH4nq%)cO(SQ4!q^?C%hRlAC>nj_#^o!E;8=}Z;3>*U-F~BT)Eu1*UdCZ zQyAhQ6ODM4d(Jf9B}4I&;e2m`50Jga4!m|b4nFQvJ{37v-;X8tOW_JVsN4nASRCmaU3(7EM=|TJ)N)Q-`frElqxKf0BSbB>JE| z?&ZIX?VjENeJ(v-$0TvRDx)eL3UAw-w?3S&Qx)mNIGtc_aCAYp@JylIZS+;uK=ReFPFjIX~*6g*rl6TyCM}k;lNv~S^YJTiP znPGyrYH4d&QJ9#6=B{=7FS#BvxEdS_j9vIL9dSKmw6d6L8qLf_oc`w>8jrRwQikm5G$cjML;X7W_{Sg_KNw!&z*ztPZT-|!z z1EgN2_~6LcZT=TlN9|r4tAAi0J`9gtTYOlv|GVJ&$hD^Bt6pe-;LR4je5JtalMVV0 zwmlWqq8BGTF@7|+VYfMKWampD(4m<)>9oO zz`r12C{6~rw$qowUDyP>@fy7@HY;}R(p^zGCxUw2&ARF&VZBx#WlD~+Kkm>k^Vhju z-gf;usDuUi^SYYH9a}w#FaO17GcAnBbu?Nw>{jicARLJ>jfiLy^_nsFPCtGmVuj{r z&9_Fp2zMX)dc!TFH{qm$&R*l9jY514?-OG0fMUi^F7F>M_>+tiw`yXua6JL)MX6m3adFOZD|C>}L6PW3;+%sOrxWIg*q54ec&;wz^I+^@?PtNnIjWlu z&(&6+2|gNib5yRQS|#K{ab&Al^Q-ooqr94F>apEOJnj>qy8B~Hs*^s*HRY3LoGvYt z|7cqLF6hf;T1t)ugLAHtGO*xA4LDi?nmd102F`GNSFRpB)SbUZ8j-$&4+s~b=I9Z` z^r@g9L4n|>73gDMeYmNJw6NrS7c`qQSu;1|Lymiw;5!}jefO-s@5U?c`S0b!HFf>? zWIX_pLVWJZf(=EB_WohS`wf2_FC;*!>4D+Lr5* zgOBc8o-WKdbNiN;^JX7&?0(X=C~C{C*(GZV06o7v@rIm?6{QuKcRL-6Zoh9?MRNY? zjJt2mnp3nYduDoRT1npQ)obt0S+aU%>fHHjXWf=J<+ime)+Rf$^Hvqyde8lLWZ$1Z zuc)kGZo$2Cman}TBh0^Ho3KLcs|Ej)Jwm#>hm0M6B1SDb|4n8g{zQDotTbvtv7rDD zb-z)L>_*|IiU8ENe=ggtz@_hc8$$dO<@j98KSFpa#Q**fJIyo5c=1Pja5PWhdo38& zdiS5qGEHM8y%(WIJD+ zvhfX#-dBD1EtZ+kNi4p*#97X+cKz?(^m%tL4Em78_dA!b;rDs=dnwr$)xAqNL+A_d zfp`W2VV%`gKzezk%Oz!K>ILzMBwgHjr8|Q3&W?oZulO)a3IJ!@^|XHZv4-9UQvKp) z8S0!LZrpH^p7clUii|Xel4$xxRbu8t{D$($O^o?-zJI_*w4J%)2f)NfYkQK1{K)6xBreOOv+hJH4}?x1_7aGdIZsx{6Os{(X~5nMaM;oKM}#l$Axh>1Pd#brdV2&031 z$gct7p*SfnI?tAtUgC@1^2+?m4wu)zBVxknA-=ecb*&LmTiqR(OmBT}UA7uR&{;*q zc2}h7Ni~G{PVCyxM4;n<1B$RPt~6R7zF$RiaCYqurGQ;Kqew92V^~`BYR@oJy1L6} z+^bt3F(KCA8TWt(kvHn19;rQW$@IYY9<>*#-qkAI(}gHkM4C)$?NFR-TM=ejpvIkE z$aUn3o*h~vN%w~fzPJaPnmz60EZB z1%uZi&7SCHk8#5*<}p34UmC2BJL-c$oHJ~U+q%^k(YvZiFvv&Vq_WZvpZS`m@=#8+ zV7v{fgB&IcX`d;NUVfR=Y`nUnZ!uC z>48f*bgG!0E@kqV64bspy$T2Xpmwz8Z~oImj=yETtP+OWyH;)TuQe2WBE$xZ-#Ht5 zc<+!6PoF^Oi&OfKi}vY=jfM>y*Y|==eHnl9^?+G0m1#o7nN^T zj@r_y%E=b=5q0%-o6y**8jzGvhfFG)dc0}gM7$W#ZCt|Z=K9D9uc)eRbgp)7t7?Cm zps#RkG3a%Zj2lLY`jM+1cWi941%tU|J2YKt)a1B;xnO*hK6Zzu&DrZPJhCy~6GK&o zPLuAX>g|bNsPj4NG^Q=XqBb}9gZdZs%TI(oaOTTvgj4Sv^{+JSN)J%J?_9%?@4=Ap?7De>K=J||U@Ik>l!HTlh5sed(IIzOQwEfG<9&b1(ZAWl{xPO1J^0(D* zUb(bJJ*yaIdQamS=i1;$58=}lGzoYj<0b}kpoThL9lHyt>`tu}kp-{QrDk&P1M7Zu z$2h8wQ6Iwj1hrhfc7Ftx%2FRCH|65qrmTfK^sAx@#FgsSNllnlQS=$^fZ(-JK8X6U z?^}32821GfQ7T#juh~~VQ%|zGj+(Bn+y_P6RkNI>WqO@{g#P?p;c3a@T{?Znitw}y zafPn0EeTq?-?d2yv%6fIZt|@188&(sRBd=I+*gJ!$BmY$^X~M{^VaK4rJFpe3A&$G zIMFz?7IZzP)-ZjNkGNk$9FpRxn)U$);tb$^Kfh?rBsaat}#ak`e!k+97%FvPZe<}~c4Jzvo z`6<%TS4VH$IOZE)baS0?L))lTjRyHeuIpjP*4Ey<*{xl*+JFJ=^*5}Z=nb#O`r>MQ z{@R0=x?V8){e|1xTBF(`V2$!@NIhrjz)V9inCodmM4={5)vfZhBj{%T-pGy!VT4`y zTYd9ha~ln&?aiBJ*ToihL?1}~XK#CCX)!$oJmldKnq5gZ6~g^dRpUs#>KT=3x9Cf# z*-FB+MijgykQCbsCI_EUVeoqql?-oth%X&7K+N%ERpk{jsQZrc$wU+@TYlLry0gI(zz>Pj3F}zQdQ^`~64LqG*Kt z@5r%tP&xLJ9D5^cUNoCNRd3m&PSB0*-qoh{s9om5vE8leMjbvz*&M5`e5<)l5^9~; zF>d$a4t;0BZix2Y^wCJtfxRF3iQlyBvR=RIrDK&}qIEg89g|CRNFBytaHn)s<@W zj7Kkjqt6$C{yy=IOHsuI+Mre=G+7+1f7f>M=JM5A~-r3 zT8ii+aT2L@*xEhSmCJaRLq`2rRu1yV9Na^Z5b%_!^QzrGO^wH0`R#_L;mQC7+tsCj z-mhnKc{Te02L9_KH_sPoaAhBI6fDAIY{Qm!^(O6k8gezPS;=3z6&4m&pOteEaaCSc z!YkzAbx9gmsV-f9X2{GPtTz4Fkri{t^%}jlG*G%zA2X}IbW>^7tg^IPV`3nIVpaD} zPloOd-&H%TJTQiw!Q4J7q@kEK!cV{@cL@Th$nSCiZ0z(;Rk4S_LbsB_^M zb`$VRvq(i%_-~P^Rbryk$Tl(D9fI3AQ9mrvIU&(GULRiWv@osoEggar`5V@S%SUgF zDR+)5cg7_;E#*#gx%0Y2=e6a|vE|M&iO$$^=jd|hs6^*TcOcj89HCElJ57mBRuMI9 z9$wkAEkU*4j@NL8N#|Ic4GbIg5qlhw1ufAHfeLUk%PC{&NkoGPJTX&R8v@HQfx#pn zY?%hw^d`*fm^FWBgJrDSGKN|r8WWAVZp+wpx+2V7S;#_(@3_8nQ;X%g28$VNV8X&{ ztHFsYi$O?m zg`@y}^TjAc>-weNr^6k`I_|#@DT?eo<_RE1OqGf*$Y4xfGi_!D|eTT`~uIUiic?{AX6XazTVmbRQWWTw%4p*SQ zX>7M^ot5(=K9<49zoXoiET&UmGMuV z*DI&RijBuQ9jD7KYmtA*tLOYR&-j}neDhwvUQ@g8yf31`GNLZBc3+P#qHeTLTQ~WG z=jy5eFXyObYTF$wy!-Mj6UJ00`08DC81#EeB5Ez8OCuV0x;FYf zI`1f{bUG*`suDU~R(s0-1$#^2cBv5cx@`%Yy%w;RRJp2=F6LPwvF zQe2*s685Q+u($R`^<@_ihp6;p_eS!Fiv9sfa&7<*!xx8+#+KpTfW_yezd>MuwQEGl|^H_{Z0OsLzncCWAw*@!P8N~7<Ix#h$2@zhW^ZJ*AoyQx?@(`*W~z zh;r6#>ve8twA(qUB~apEUA;!A-1qTlRnFalXS@e^xb8@+J zQob`G-#M||IU(O^%6ASgcgEy9N98+5mODo@1WKmsdB5nk3~Nki9SJmd!*knOwfd#4 zCv(Da!@(D=C%3g~^z$*doYOHGx{4*I2I56(x;HI&&quxt=Ur$uwW(%D4aX37iT(`SXbc<-frt;nq&il~(xES56t+@oYfPuZWMhRCm76HRJoO?_k zTx*pAE-LG;@PZG&Lsecda;nZ-Rc?uXl5Kixnjy4)P z<3f;+gROzsJw9i%x1C-!Z>(>$_#4el7SFu4z^+lMoWBP>POmK;S<6x14@kI~#|Opr z*f3GD75FYmp^m6KEmD|h{orBBe1SSk&c2{0V9E{GtIKfhear$m-Xmcr)Loe5qLpDZ z9wap$OE+HgTk_CRHOjfr;W(j@!j)?V4;O&6fr9jJ!NIFfi^b4U&lZ-RV-s}4k)e$z zSy}2;>5iPp;LTy$h#(clNYlvgS)q7v5e1!LO1NCv<93b)7F(|Y=m;(CFzs`Hm($G# zK#XBMF{k4@hjm~h!!u!_jq7TlDo)IDH;*%6^j5NG*lFS$Kg;2@VRyp;oelwZkBNen zjRC-2XpDLY>vtV$Prg6s#PUvuT5Uw`=N&Szr3o};Y!u!~irqj;4!Zh{uy}t@TbNfE zti@(IuolBAOg~~>RcTqNbKSg#fZ2gICa-laU^*Vt>OeeL291ZsjNT3%Sd$Izc$y-I zG>Nk;lZ@-C*3DxtpVu8*hqWCTTLM;$4>SgUszU~N9hM;a2|7x5B(imrX|~W<-vzxS z3(Z2ps)&2H$Ojn|k#^BeSim=5U#C>v^JlG8iK^^pZ>VrO(mJl>X3xqTjXnO>@d zzH_{y@MQrF+@aYfF!BImVkzlY8E&{z>;xPa*b-cHj@VyxRa28%DW z1h;ck5tf6_5m*TpIftXicRPm_(Nx3ic3wvy7<}lJulJ<)SZM%nylJ)X^p;_pC{V#< zl_!G*`Ol~?GdFHvDzxLl{Y1`i&u2)_BoOO;GYP`lt#5)|!mFXQ$BF)3Ge2B&h0_%W`a~UTW9?J-1>|9u%u_>c! zVOfSV1FDD`0t?1O1%fpAp!nBEI)cH1G&HR_%#}G6q@i@}N;_(8a!X*rzJMKdU+S&C zK}L`1<1uZ~m}-T3jF90NWo|~pUEmbxTr7~;uburSv)=^vJBIxl@SFEbgJ}UfM~f*D z&e5X3f@Yn1gs0*}%wtd@*a!eTT=XMyKEe>howviG`k!>{7Jln6purI;~c<|3FYbta?8` zXDkOo_RK+~dOBi!#vz9(7mR1&&Fy;(BLKI=nOHyiC z_9IW&U=fanMJa-vDP#&iZHiM}3B3C=$xX`39Gt%IgD;4@SQQLDQc{IJ%?8R#@8-Os zdw)+WW^u_(1Pn_{Pr3JBB9{d2GV>%#wcf;va)l8?3`?CqHRWEYH~_W zmMv>WN_uK`YKAR6*^!g%NU~*TrR1a}WoIO1rsN=Kjw9KYnr=-`P0MuHY*rgSlt@m_ z$xh2iNz6`6v85#?rKP1?XJlHlGSjWusWyirJ8edKR@RKv87VVT9geK*%%o)er8^RH zlC4=O*{MQiVs=_~PF7NyH7zAGBgdMQlarC2F(Yk8iZumtS(B2p5*6z(3Oii7Un2{}5t*NOFTSmGqJ#~gHeTL1NnV6H3ot2T9l9-s5 zlIX}tPqJpFW@Ok>vs02%W~Ap>lhabL07yq3CMP*kGLkb>GqbZ2(;Uc}tR!1jvLhui z2fh%|k)D$xq*@alnQ7TGz?$Yr%1X^lNu@Llw&qBF494V=(Ntwt9TUKTU zwrxggN={mOc1o%v6J?xjOUz1|VNJ@&Om|ol5r1|{MpBM7Gcz*_&^fm389AwGX*LvL zPP#Q21u?_sNV2BPaO9xWGjnW7*7P*wM(T`ITUK@oYK9e6!T~jqX^s?IwqQ2T&6~x} z+MCDO%n2*jEMJVz_9tC=@LotvNk!F5N=mgN%_)hHG%*pml$@5FW<@z>I5Luj)Kpti zPGYJp6~&d5m6M#Fo}DoxD>;3}3|ms-j5LSUF(V^sMjBE~skUY$W+!J;y-7<#eMWg_ zWM`*Xv#hBpX*1H&a+1=LvoowoGqO-|XQU=4_7gVIobdlK_a)#_6)2Hg3dh67B>)u;SUg34h*g-=_r^1BM z8AFDor4AXIGCV6SJr%{CJ~}HUO=Q;ap`!+I54tf!QPWeih7X2mnW(6l85x7Kh7U>` zl9e_%YiP!xQK)yRDPvMoGE#<*$w*1h$V?v=5b+>)a{jX78S@t8F_%(O1|d}$qqDM5 zwbKWW8I>|DD}BuH(W8cr9+WvIYsjcUS(zEb&_0I_8agN=6^(B=GG}zgsI;uC^ueP? zjT(Y-9fk%lYH(J{@X;wKw9zSywI}QvC`};(A8ueZhB*I3I5yr2SH_{t`D^$%kq z#fo1C&Rf$d*xqJpZ!J7I0qo_p!-(wZFQ2c<55=(dTD1n1;| zk44AxzRZ8lSC7TXWv68Pa0>mukpY$A;@)}ha{@o8FRoauWa0VlB$iJsR%72I!>0&$ z4`Y^ev!=#kSLrXMeQYVQhTE8czD^PC8!p{3;A4$mM!rmcoN%9OI7TI$nFQoljy zPdDDM$lsIsNl?beHS45WT(MZuq}KhK_U0Rx$^0|j^9=4QPhw9Ui(N)4Wd08p`MbpM zSjw|P+H2~sGG3MXH;M48*(vym_IxDWYhYKb;WMt1`9&ql_ey(}n`_1uQNC5Cmun?r zjcVg@OMSdcx-WoktZ|p&vf!VR@=Jxh)`*pOOJP^6ai1~RQos6G^7j&%UQ8i@K5He~ zv|N10qOpw-ULq}ATSwxWG4hlP9WJ~BF{^Cy7RG244%4Y{n0&S7j%|=UG5SlM7>tts z#K@F9F+^M!fdPrQWV|9S8Lx;-+E4s|cnJVv*{Zd50w4aw;N4NJo8vka^2C@Uc^TZW zdEo(~+osziZD8AsLqaJRYw={6&z1i8G1uS0pXnee9D(T-UWUjkS-xk%OYKwHnY>mH zRM<=CuK>Z@=mDZ?z@C-5zg9nNtVEzT>GBG1kw>=iCNJ{&Y?Bx393`e3UN%-%kjQ7* zzc6dKZwvENx3gCtM=4U%WsHA;h~@P2(36iC#6-Vh|&t~MFrAFq62vtC9)Y!>=mP5os2 z#DQmAvn9{8kZjYkCx+;|;7^Rz(w}ybRGk<7m1=bK zpC!Zs%SK~C!k&DS7j=M{0ZPUd2cGe!NuIi-0Q_@IKi!{Rac<4Oz5Mi=IwBur+ZSz3 zwj*Xi95VwXY><3C-1MhyuSuS^eI|M0CD}|Jf1b#)W|)AqXTSp_Y>?$8Z14(iv%SlD zDBAlqra!Y))hjo776>Q_mu-|_MINgDc>w*-HvLn`%QOxqFYk|iz{mA8byzLP)7~=4 zGmQ^Pp7x5gLx=YMDE&p#W7^?Qd%4b^JmbGX@(f!od4_#N^2C2m^0e`&w;2^*Wp1Ol1 zPhBxS;f+F40H!QErr9>nRA8EIUXy2jsrD|)SJnYhzOo$M)Vapgrzy4~lV>_@{Y{?v zYa3|t%sU%z0w7VovfR_*R^`s|cN_~Gvk z+y5;68P7?{)82DgF3@3`vLx>Yf2HK9BgzpvOw*UrpK03eFvBuU+hHJa$S*|aLZ0a( z*%p|;>_+4InLPh1f5sh0KuNY@lVO^9XaNbs3nPv<98e4{@|2TQ843L{rXTY~l{NE4 zwMXWQP4;P`Ol8^829^Kxk7GhWLvWENc8=tUE&5pa6OYNGjtjpI<}G+)bd@~ID_!!8 zhZJy+W+8)!6_+YlvDYSfe;Oy5{vwU?-b!5C64PJU%#IMm>K+H4y6KXqE=lEyz$r2P z1Wu93i+sy4d8SA8S0dl0oBoVTwLv}KSe4`0_(02Wk!L)Ol4m>zB+qz$l04%{Vg5j$ zcylDrIOj>8agsQuV)+aECkQX|J_Y|OIEDS-*$#yLg{F?MAO4HsFYE_@1?sY}pT>gR zxK#cmk%!Ja=p;*i3HSlzC*mI{1s8Qz!GEyiw}4NVJfA;Dl4rvOd2vy{2mG@nza0En z@=Ng##3WJYR`@d-@;`u|B6;?m)5s6QKhQO}R2j`AFUvHKJUu{ja1p0J!WKz>IQU}n z@?Nu8`p#o*(ZAW$YQ^6(b>3y^1?O_lyEQ#L31Gw($o1>Oa|T>8i1ca!89|9z5Y z{BKHrF@E2Zyc@qCNuFi(AIT@-H9ky_=(`ThpfWqITYll!2c4-v)m>~p5-=4 z@-x9_OFj?$qmpMDcT0W_c)3S&z+NZZ?%CX+dsgB6oD%GjAFyk^+Qp?EwKh;C`8j!N z)BX05+G@1{%3Z+y`rEZdh}EwCZTF0)xwA_aEIkc^DQ3LwWy_-cqJkOR%H=dDR-HEK z;ODOPj})Mtff{W9a_1GF0U%JL4FJCmp5B5$jkW*_@=O5hMmn?}pS3jfHeqw}ba60% zK#ev4iwE01 zf7+^{YqSBMtpI|h$uA5Zx%`wlW6^?w(^(LphQ$h$=U;o;@TS6Zg;+I?;-Z|z1q({%%~+9NvOpX#l0R?Wg6q@eovm8I@GOdYRASg*S_YHaNJL0Y(B9c8v|5t|GeU^lL?APz zy{KoYY-*EuIR)u7wMl8{amo=yK=H$Lc5fy5ZO(krBsz%5Gt~M36s@nr0O2%dQL4~# zbBc-gU&0;F=otIf{re)a1iYIZ|=i*5)ZL> z-1bwg7w-@|_??)?VG^H1$%jcd9`yn!M7qufm{kv-dHkgGxUamf$LG%ozn1y@P3Nu9 zV;C5^2hlh^$1MpON#7Y_M;92B4o?$oV`B?FK15DQ& z0KH)K)D1m7-lVkFdfG*cH`0PP7w&V0H`aoe1-uvq zCiUp-V8L6X;q{VwOvg27^tyf1+Oh9S=;`)VYIuAJyF%70e*aPSeHa;--rIo3`E806-Vx}L_e#M@;H?2qy#BZp zo&#a^{Np(r>{k>iyx*XtW`tf#K%3~(* z+zL$U(fOpMJVG!)m>ukC2k3{Dj ztbgukx$i#@Jl-#9-*64@D@%RO0vPjGk+ScYr9Qu_;qeoLvTwBIKC=vX%m+mZ&kH^B zUMcticuC-C--Wmop2vc>26$s+82%`{L<1OzV(@x>*$+JY`AOj|fDd`E zl#B(Q%D)ULW4b2c((&E|Sg`z?Aj5d^OPZ$i^Jg;2OzvIAD7{pQhT1$OCuBDfCPT>_<@O}VZJb@%ByxA7KlN#O?&{cS) zV08POs26J$nAD?l6zaLIcN_HTgXryplCC#W_Df1t*~jm4ublpXP`$LytqiyG`t0HEBop!cpHE>P=ql5sr24$!OPR|7HW8_E%oIY z;00?RD=qb<7156yvEq3w zcs~HIUg9m)@WL&4BZ0^DEQ%Csx8U8CZWxE5MEf|0L)o_)Y17+peP>f<#pC-2hVe?l zVhkcx{ktB13U8JL?_uBtE8poByiyHsm4>&^lHPZL7p(p6v7~nc@REST^!{1HyVrtu z40ty|u88R%-DAOP(C}76uF`w4r9Ky<@+l1BD89EvZ!z>1Q$do_b6e{Dn_9lCfiCr! z{(m_F%k3EOSf3RsynjNEyjKd200acsnh4K1{&e4<+LH za4Ebj%ebi?FH;l-F%^HYW!y9c4-=|hRcLqvEqD(DuNQ$NDZFG0-b@W|19X*r*@y&H z(Eon-U_16rf*!+oagmBNyj$Q_co$pn-UMDB5yJeZ>>FXhTc+VvYIs*8fNtMO;Gs(T zN#RWeL*6STYk;SoQ>x%c8KN|@!031(3BljPU2MU-OT)WO!>hHVcO>xKkSk)mq&qF? zeH?gG;LrMU2QFpbO%}XsfX8)MiWFX{1up`XekPQNSB*>I-5M5{-un`R=ie>RV;C)Gb zegCxJ{Q$g6{b;5hoo`t1p3(4XAy;^jmh$kP6})^yEah<&cr$@R`|32j&oK_x>)%Y^ zab27umEMn`N8T$1-V0mt?t`DQ?;?Qdc!%A=-`@|1l8#pkJkCF*eGh1OXIbzjdJKc> z@Dve))XjnyftL%MPftAdtIEFq7&pM%e|}SZ62^oI1pbuqnh!tzs;HJFo8=2HK`Mwk zf0*wyNOwUm&t%1ah4-E8C;g(ne$KB)rVpOi^mCbNy+SO~L5_GNj&GH1!UK2>GLCf0 zak+4vpW+T6-D&dX|Dl5i3%%5oAw$yzcjj}M8qgPz28;j6#+9aZr9(4}JF0BX=#7}N z`gy|or$%(D+?e5h*|jGk{^W0C(4Ha&s@+hj8~<+yPCmM~w&BK@vSxSmp!i-6Y_(d} zd~{n?b>#Nw_+7u4K=*Eg6-cyAE`S|LwPfl{3Sz<$?XIoY31xehijfmh`LSLyzk(j&H}1Mb>~-CHBZKLos| z8Xwm-bQN*cJFrEL*u?zFq`2|7MnCS1XpSu1;2vKSy*vAY7Ljmg*W$S;$d~OAMxt!IaTA{x&-{u&hX_wwLa5H9KneyBeNx@3Q0g zqDDvQZdc`mCbPxh^cmi2u%Eo_GPf z%-yWxf3!Qp6MZXR<_4OjuehFm^APG=qSrXErSe~{cMcuvaCE=>Vf=c=Km^tkXRi&A0__p;YV|0oOULQTmEuGyZDcdiEEoG9%Md-9AILLMd2+) z;XU~Oy70{NCTK14=ID(vcSl^Ao_crax+ex4ygde|v%HGaSyrw)5?cG2tKpREm+ww= zGCF#XAKlpWwJUpm$oiUuBX3oIcz0<0aBR$2 zU)dN_abM{RO=6GZJ>f`NV6M@IMKM=C6<-V;o|Pqb0la!m@z|#6;n*N;=@b1lvwXqL zy2T;P+Vo-k3-;*SoDodLfruj!wOUosZVXpx`36{p)atx1-1Jj^3X=pk>&u4(_eB z+TjWD58C4wp>5)*1^2By%flJf7-@ui8=5w`}joIs_Zy|6zAV zI(yt4+32WP-yHJF;kWGvqSjq#I}mv!>Zx?>-~Y}AoDPvSzGw8*_|e9TKjM^Qf1kqg z^f#7|h?8)0BpS+>u4a41yPtpcnf>PIw=S~X9QjrBOBdR{iu~LMsGiYT@ma=NKM-v| zBM>$mbCf>YbU5VTt4%M{ii=>y%~5Y%0EAZu((rLN+pUyk|WW}Ybf z<%Scn(1`VGd@3}2rbd#f(GwaygKG>nHPWDw7F;9C)X0QJW^j!urp9DwOb)J*XKKuX z#;o8Pi%pFZXp{ug@MS*l?zzv6sx#s1%Ey}GKSxLJJS#AhIxv%*(>pMeoMtBZ(7|Ql zq?b!i;V{0GnkHutXY^rv1&TJI=0Ma_-E9Y=Q9>x==HCC9dcF1vPp$Id|~BVniu+<uDJK}ifp7Gmo z=ehP24$-!uRU@!7va~#S74`hIyd9Q6D8AkI^{he2j_Qf51q&RK)~rt%a`Kr^U8}!hWDkTFWa2cP_z@@Td7yoLjG5V}*BCoh)%|tdt`O%Oe4(hS{f6u`43sDQ zOl~Z1HroPn}iOv*$Q*!g>DZY{zl&|4HYp}9#2({3;0`i z5Uj8@hO7KBjAIPgD;)d6#yXR0HkQ`p)~q(VdyNOSRC!!mC-EGooS5nm=cTnZGG%V-io4Pg=HcVEBRXX*+!1R)6sF4q#U0bgnTG>$hOH(5OS6 z*kc<{nMX|2PpV$HsjDseLEjtAJHXr=Svs|;_6au*ZevR|qP*B3y!s7nOMSd5rZU-` zu-~_OU7|g^f7q_ntr=JCaE7kp(KH-8A!%2}#bY1ytDDPeTT0(y+phD(?i72T&z+jE zbm^^cwn-x`+UJSUO>)`~*r)BN&uC0t6~#1Uum9eEKmO6idtsx)yS}O1esk0%y!(mU z=G4m~cn3bwa&ri~S=7awaiT)}V@7p^yRUn^54ZI}EoKLUzQDJ)P~S0|E&D+Dkx&$y zHsBq)ntNww6sBS?^%!3&_sn*g{f(nl@qb`nwsJgQDQdefoA%HQC5QhFmKnlf;Kja1 zXWpkRPSYkH-+r`G+kM*HtwL}P@iwB>%OO_o>F$B84xw*8#VJpRSWT&1#KQ{&jU0wo zb5TCp;vR2tU+$j=*$0wXJfYqsvn*SD50sB97PHLo3c*hzK3V>CLVmXK zf{g#q!rjw&R)$|A+Nl{AW_nVMX6e2icE;k3 z#TU>cvE;aqmioT%zHko}=Q2}HqP=S@`E{<0Psw*!YZrYz^{KKL@Ri>u{%7Oc8JxoJD18~J+_ZYrABC)2&;w@P(Szf(_ z`!ZvhbSDY-B!ll=)qYF;$V+=;$ZKh{$)-auTX*~eF)O(L5Q*`VS3zv@y#}*``w1yh zVTHd;3uS6eHth=7TZj_@K_XtaV9hn+vMazVf3fEf<$sVo(?n93^TEgAosc5s&pEE# z`$v)TXY%6k?vKP4sCc@S{mdq{e~<9j?Zo>l675j=!0d=)gdj|B6FhBxL-Kx``@;hy z(#uQ*2^`tg&@9_|!rRRMPA1Rqpxlp#;oOpExKzo@ zF?nG_lF17jdYC-hh>ekeSR`?*IG{ne$P;6zP{$vyjEh+rhi_(zY|@{15w-VE zdkYD~5`f&I6~=kN7F779YS}Q?NSqc5>kRVe=N0D6pRstsj5!Oq5V&37Ai8bVV5lVu z=7Lu1s#GlM<6?v*SgSju2vG$O9~F&$!+(Kuy`)W^H5erJ*7$iiPGjEkpeE;&&|IY()uJ=-FyJ&4ygJ*2OlFfF}0#PHEAc|H{ft zQJQ9#kbj0nh;3ArIW*C~MlxV=Upwn(1rnDj7OI7R?Pf=SR`87Vua-MQ&9~?U2U82| z&VUuD795Ie?9JXIZN`%MTpxX=KBV0c!6Wdm)jNZ+7QNtL=9al;XPJS(xr;Fm*k zH3SZPLNv!mRP_YW<2Xo>;)$c<@jGQ7rG#IlM;-EBT%=kIb~yIob0YnD(Y+Fh(D7zU z8GZyQygym=@*pLaBBjT*MC83v@URvyvxhRqy8@RU?=w<{A3+Ll5?s1o6WlpM!~Cc8 zCcvr3+o;9Mp}&gPhG!HVkNb>qe5gp_odl!fJr6uS0x`|BU*WwCM#mcf2cO*(QIGT{ z81h~^K<{dJd@P`hxPvVD%9+}4Ugrl@IJECm;J!YSH?*_I=R2Nj+dh0@li?P+0Y1d`?zM1<*tZ& zq>~o=MgmXOzeLCt-VsZBy}+vz2xNw6ZL;7U10LV?C{p%SS@70qcs-%4@Sd=wcaE&LR=fsFdMh=&Bn_|9f>#8* zH404X(YfA&cbA6ON9wU0A4B2l<$Jsx`?xnH)8xfPs@L$6;a2JWiv{lo;H?%R%zxA) zaX)b#?{VO%`ohOpg*V?)|CT{8LLiv`6dw0M1f;(mJr04AQB(0;qe0$FPtblX9eia$ z8S{nbQRsM$5R8JqB84~3f_GTMJ0HplZ<8e*?5~6MyZbD9>A>f^Kt(FvkKv))cM#>R zzui@Ov%u(j2JnNm-|5g}7_W@zBcvkaU*O_SX2lAlr=>VM!Z+$Mn%Ymb1dEv*2anX8ttfid1^bOD*276e+yUV90x=paFQai}ulvGTQs2#XjzjUIl+e3QzSDUMcue!^?!9!sFa> z-M)I@1*`WHP)@quNA0BJ66opaNX9r;rDL=fZ?XmN1n~F{T9HaeFAH9thIfgE_W*d^ zz6fO200k!X=uEeycQEu=Zi-aAJz$HDHvxJ|MqR~sfgX7;Jwdgw52~Wv_^y{Sy1%o; zI}x6};IByGeFZ%ok81)H-epi$cnd7{Eryc9Ag1EyTI_4o@GjTzMqBWf0WXO_k`$iT zg7>_JHwn7bqrETSV*arYAl(JeJd+jwDdY7#0`S*Q9sHbNl>Rn9yIbHD5$&1bV@yfZhg!*|$K zn6$BS-@4mzzBoS=n-l8dR~Wv|~hoTE~46Q+i2O78$Uf{4i)@jV>#!r{h*lcPLQk*B@K|Hr_j1_C+L z%hNEaVde8s7js=!g$%^Z#`;M|Ux)$T9!^t4n4JO-{Jik&9>4lL<(bZqaUN%U*k_j1 zAkV71tZa_&8&V&;Y4e5koi}YxuaDcbdC>9l7#uoX?{TYZ<6`yQ<6PS`lYb`l5?2zP`Z)LZ8`w&ra69P)g+ zy|Ifg4z(u1J|-14<*9D=G3Og%W-H+0`$gCDP-3vFqF^|dEg}b^;yaZ+KA0U}H%%XiqpAxf_7&Cmg^VeU6|EqZh zeP3L4?7EuHqD(MVAq3?@NY1uTE`E~W(i4@{0gVwR!bRCMO~ z5x5C!snUMlTVsvR#!VLeSEQTIWIT85kP3`n zhX2;$<{2}JD7RVc>tl%@4Or0I_#bN|7<_J1#PB~$w;BIAMujE(Kcu@Sba{?h2aEk2 zcPJv>6e;JuGuAlQ2(ifdeo+ziU$Uf!<9yO(xOnav$;JT*h;>HIO`zLG01%U4!}AoW z2QJQ8pdW2k^A}Pz9&F&A^>RSZx?z(|f?n#oH^-N@uJ{K^#HHpwxXH`84@u-PMkiqi z`? zUiE^%nxipT^3>%s5B*j9P~YD9E+}BWh8rFrf$uSSfiJ(kGd(sI0*F!CSO_4IpNt$N z@{O3rY z+OkXXwB;qqyYc(F;5N%cGXRw;8xhD)po^p~p zS3~H_IUS5fov{%QUd>MtrV5z$*;k%hJOR= zwx3PJcfAF9ONy2(!mI-9N3Gi+zT?RcmTjfM)y zHTpHITNMXlmgwBKj;cpLZ3+wlP zM;4hQ%l!=d#kNsZS=MGF*)|@^Ika7H|NZ}R2Lr+IB+;TV~RFz&a7+r4-q~d-nv|7{4`NIt3mHyAeK8`V% zUOt^sMtjGC(eXCGF9Vk%>XAl)A@8LF^e*s{@Jl@0{{4940jA>}gpA`0MGBAS$>?}Y z#7rm=k57w~(LSEfsNV;W~fNF!iZI{GRE1#jup2gUtYE{$Al`#|SdZHyPj2P3!Rfw3)A#xgt!w zx|T0j+w(V3#Cua`^}6_|g0=m{8q_eGT8qk;wMQe2o1?OmZOxs{Zy;PMhxeqLZ7Z8w zmx~K1#3OOK2ghmq%9rop4|kC^i*>X|q8dY+O&>($e?2@j$2b;xxQlNp*8>-d6>a`d zr#iH10?+iPnf?0t!_z=uI0sM~zQ;^gVQTSBwdJ1jKsbIkIHfJ6Q`ywk)>To>u&Fh^ z;&)Pn@m$y2Y7)cw2K7mI6(pOhf3XtReErQ&3xTh|TjRnyzs|>f{Jycw{Jyb09HH=` z;6?k1QOB-0+_~8y-|?fk8C#II_5#24o6&#E4%i;tj~3uktxBOVOF%<71Ggkwc91T0If6!?Yrx z{)^gug6?yq+#~e67^f`uUn2E;33+#82YwYX{7urqt~(Z|1#8iX`-M}hFVw$Y+Q)au zv4+Q(Z;@w9w<+&!#K;>I@2Rnvx#W`hY1-S@c+C<%Rq8`s#Q&Zpz56Zs#q%dg<8Z}d z7w{Vc@KcS4EO;MV@`v+&NEhIWHHI6H$oK{bH%kroYk6N|)B*4PWpx++8m@YGPbl^7 zo?|HW?w-##T*F8?$Li!s{cw?2<1O`0pJMecTZBb~{;*npsQ2tbpMzMCuubMMTO;40 zQ%v=Taw8O{791*@1w!{@%w1{`ZoaGHaVUVwt;6@ zK2Pv{v_Bu{0pfF}dhblPS_j84>b*9@*jRWVj(gO*Y(4|3^^yV~LWUb6{TYs>O&x|K zsr8H^US_$ANYGhm1`{-Z>r=OZn)(A@lps9>7ub977y1^l9F(#HI;M+ zD|eyK1`87Lf+wE2A|c?-ka%y4w>rU>;PKs&(2(op+JAL)<~QE$y;3?|Nc|m_u;ah9 z>Q24J(_c%szw{)ScANOyLIr;xig$d0Z?n%FZ=imgm;=QoT)T0%`=0#FW}G2tyHO(h z#M^k}P%Fgg*CDDLKSR)VqikIo_&butlOEd~0x9a073TEuopBMNN|nBjuuW;|!ZVa* zz~_q7H6p3lCa(7U)ylmy#DC_m6>Pym>$G1i&JfM~{L`K6r!tjVZ4!vL>|B|r{M&pI zIYZ39=i>*HsOz;`M_Rvfn6aL&z*=>c>Hhv!#KlAT+DQ1`Ul+9bcp>Vv8GcrK;e!eM z%iB)h$)EY72lLAM;X@eJ8noT)`#m2%0Dt5v<#(q~$eBNOFd@`xQwIMxUqLtr zS{p7J&tuGVjXwV3eHz4}D=#%f*58{^F7D^}od__io|5T$Ua<0=2R$8+ zYjRZm)4zdmEtPKHG&uOaK#{U9%Yw&eQHAG$va;_oOMTe@Jld^D;f=M_mjS>_f)dM@ z<)`qtW=OZMx*hv^Tks}oc)c||o-L>2ajmAZ32J`c4n6vN=?Pj4JXQbBgPIC z2jTFD5avIH{R;ebyiyI1?OowTKo5WZ`^*n;;BnDU3eRD|+W@>2XfglvZy-nD*6}#^ z@-jb~884lOaq0Fwqu~vdGNyk8!s~cb;8r$4?B|zAe=j{jUux;)n?jY|ObgyLxIH3- z`A=bAXu&(7;qeh&;g!NT-M*Cw7cBp-hZ4hh&1j4e+=NvA4bt$gu;6U~-Z&YCKgzy8 zSnvjGczmy+?AvR(pC1MulHwb&6nK1prbyvgznQJn@c7O{ z*>^t}J^vD6M=<+pp~o;@8PRPT9^+SdWfr_7;0=&r_(MI?Dlp`|bbub#@OZzbjP=ir zi}tasNE~nFnXLFv8Lt@#z+Xj=Lr*6qTL3-%n;yr1q)hY2k1+-PC$iR0#Pi}Jj=KM{ zp5^Au%P%S_%sDUjyalu7p6@=>H@(!s>GGrAnZM~(v*Cb(eA9DA@7of$y6rcm_&Q@J z1pESWRQpn9;ux);N~8zAf9gl3CkS zv!ld##P_ShjW2dIoMVH^oZYH-lyAJGCczo8^5?qR zliRk`y<${s+ZpAm+?}%X(ryX90^g?qN^NNw*=cTdU1Z44$k5W=F}1th`y#`zhWJoq zc8#vGb0=J~!?5>GkU+`1B{l)iMevT=t z-Qdp{krN`lWzEK1Ulmp>Mc7KW#Z+!{?~Je;yJN~C9Hq@R*jD?HyS6cdhOKv}Y;!@U zw8mCj<1Q_CSJiIVys_$KV{T1(&{B_p{nH`M*(eZ0SS4B5| z&@kGyC)|khVnb+e|0cuktu5Y|vNUCRC;F}00*{#~8;cjEq`iI;pON6Vl70uJ-wD%i z1^t@58;cjGWWN5x@{sRdcO`uN>(q6(-*!!hgEeJa@X052t7r2o&W?4pE!A7Ta~cnx z6I0q^JANXyvZc0U@5s-WE(>4YDPjNkuiv`o=&m;s$JH#X-qE=Fsa^IL&o`<(=hp14 z`8LgyoR;JI(9`$BoS5%C{k}sQCpBhlzJB~{08D-<(fLD3m=V7&wE6>V^lo(Z8h_o= z_(t)oO@`CkxVOQ*v9c-!AD-ZU&lY$c7al!dI9X$-->vjJD*aBFes|I@rD9fU?Y7G5)P|bc z=CGGh)e>5k{`KEIJ^lN_`T?;1JI}!HSVHHqglPSpHG9`zRke5IhcCl^?7I+ONc(Sd zai`%IVSnZIO-8ua-LSD~cgn7g^!?iwc+70t*zioszSmCfa?^r$DoPJNzZ=&=&Vfx)oznNwl_8|>D_px3v4P~#7 zbVkBZGXa~M51~q()gx<7`Uk~o^<1NglLKXiCayWKd6V{c2#wukGY4D?xz zu_rn={4J&7#FAf*;82RvQ?`cUA1jx-R($;-KAU_UbNp*}!-b!We{UFYuXH)z+ex_*PVUQ$=vv~BCYm*RFlI`M92#Vd#QpTxNek;vrk z>t8NwKJirbu{s2;s7oHWwQpVWd0U6qC7-`_Tv>8T`Bf0`c4~0VB+QiePwZ9h>^7`1 zL=??csTlH9h1g1K(9gT;Fy7u4b11}tDu81ca6>_Yci;#aoO-g&-B9DAn$K40bJzOZ z)v-u_wY?^0Ur47zAsy>NoP9Gs4Czo35bsDL$sv(dA>nBuVLd}aGDAYkZRL|n zvtry?ZevhPX}K-M=l1&CrDHQ1vRsw7xf^`0QeRAIrmb|18~D{3)qP8AQm|M0O)ze0S+ucj=srh5}ddbt*`Ut@JPMVxRj&#)*qdTT*^rSb9qg%)=eC^h@3@ zk7bnJ>@Gc=(Qw3tJLfKsjOl3`?r=>$cjF&Qcc=JbcCFsGH!i+DYW+&5Jvu!DpH%;} z^M$xsd*g7c2tOKP?0g|{dpK@atHvW*YYkkZ#|#qYIZ9lAW6O`|@e zc$=#d=i_X1*In*xcrv9yU^X0Ea`cG%(B%t$E|k{(Sa*3x5v0Sxa(8Lvk5!jP31?*BI%TXw?wi_LbDbwj*SO-x z8a*F<2gk-ZLgUxOU@fr+4X!*U5&P(ST3URbiaXG+RNRj~0?oDJ!KzCQ4AdHrVGn(7 zFdpvX@eF96;mtOTLo%N~UhKu!yR#NF|RF^5|B1PFYw;RamH!hY5Ljt9(*fm{AobS|ai7 zLhfjlX9%mqU^P!VxY<#$31h^HCw4}o|4XSGCsOwL&b_Yfq0KP?shRSFKO-?;>_Avw z51KwR(jMk9=7c(boqfTo_%*m=uqiU>?u(n~2E1_q?((I5^YdaY6gB@oGiAsc!b%7xZL;coaJippF0{a?6 zoF|`p#_XZS+2T8g&GNXMv7%@*Yg^u)lzoAt-m^S)SH>RuD(8XF!;?fo9tdyDSeANt z(#_6_+mSU1+mI>V&8`Q#hb2@;`!=N=iyrj!&FJr|kOp5$*%%{XeN!U_BS^q=zxZss zA~Zwfed_<`&(It!e;+IE8Vkj9OgK(tI4*|p1Dv>pgd5Jds@hUi#&4Mu3(>Eazd>#b z|8X&V`Cj_%AooGx>b@ImGRCEPvt5OgW-iRAogK4zZCQ>h9!GFRtm_iGx20t*_6;_S zE#e#soLqoP<@>gDSc7lj+~kIJG1WO0h09ihso1H^INaNO}Qxy?X7ZJ)Q4=RKSg>X%wuqq;=E+SGX zL)X4+H|AVy$KbaQ83GfTK8XG|n8=K> zreY^j(V9`S&y)`ZXUfU^wh84!UTa3>i5#k}SiP?q6|JFSbxE_aCluYw4&+qXmdc9N zDBA7e&ENVyfJgQS2Tmzl<8p>%SHG9MF@Bb9&ZLBbEm*3GjUU2|>Ws0eeG1N7o7+Nf z)72+zW{We{w=v#lKo5lg7{qBl;e$WxIO-m&bq8nS$OzO;sGthBw46S3YIdAHZ)#Sb zK5J?go<3*HrZnm0)Wndc>8`gu2SwwFud}opUq;1~upj0kDL$O*ac%YLs+_s?3+r+U z8*_H%%-NZfSC^Atl~YibGaC)-r3N;tNfoXd*=2qp*s`3<8<>XX(=2Yd(>~{xxznyq_u$u$fop^b$ zJ7ynV9_*LT_jNgQTHjAlAxtQQYYK&Rkr6v1BNalFP>9wP=GH|zcSd$l3LT+P71;@6 zW8B*DwxBBK+J3&Z$$03TEleyBCL%LnVjfNWU(pPk(7FBZX^Ev3s}HdyqD6ivTVz@@ zo6Vlk10kn4!P?&_@f2Y;%3th!m|Ke4u`brWc6kdLrroxsrDY+;{Ncu7PoL>-3>5i$ zcEXY7)Ufd_XpYO+=O?GW*aQE<5?atU*$Bg&T@jagZ`oT`TWa1%w$N`i|B3re4!KDe zh7AlaUgQGQ95#xsp*zIQ1poc*JS8JzR?dv3H8IuSR@AhuEBjDaTC3xq&Q#l`pQ*lH z)3(O*by;h5{3Du9dE0g$cz0TP`i`S2XVvL@o~oQ1+IC%mcc(vVx25JC;;!jiUAm@r zT157`5H|9~WxjelzU+&n_=}c1p_?_ka8M1&OYY&;8}SIRnpX$oB1f z?32BxY#@%b{J$nAoRHXTy++S2f9SwBzrFi(^>tIy#0L`n?Y3dFJ0c>ZqWhei)Vph3 zm-vL1mL4rZC?qs2+}WXHCs#~t=az2WTh2*5>+B$EEyTO9l%;-va|Kz^?z{Zh}?d*z)21q9a>fR%v+gWFylSn_x zNN)G2jLSw(m@qD5;OJ4A1A7n3b0_y+)OUp2$ji?)^5^Fo1v!O9`B*SjjEQ9YjWV<_ zqcTV7VRXrq$pcf<(iPh5*{SJM?kHRoab;Nc*w3FGl|Hhl-$UR0`Mur;E{XnW@x7^! z*9^8j_SqdL{_yc@pT2cxxRpkC=<;HtP zEQt(t{OWor>Fkw1OyBU{*O!bM!u(@CFu#~T@!_wJ8$WdS@eYqPJmF|geW>oc*JsD~ z{brf>h5O%sB7E$+PGRvABVJ#>{_5OmxwEERG^O9zl!vZm8q6ctgyh zTf6pqWMIXWXFDFg>z=0;JUsf*TPCG6Cyu%InvY^W{&jEn9#NCOLDf_ra6~mVik|#e z)07LYdS~q0oV;N(j@qt2cj=!mzO?Jw<8(hVXYz?y*X;e{f4cv=sY}1V=Z2)PWnF(c z`qrp_zIIO96&rJ}+xV>GPZQns56{oJsqfFV@0#EI+z6V4tGH~ymyey>^zlbGT{+}) z=OY=tzPa|+(cSO&eAV&tKb)0cwP$VPqkmcX#W}BCl=AM3KfMs$H9{t_z*_)YjBDx`w?R&}nba{=@25Uygoc?mxOsFB|jzKhLd58=v{F#Cz@< z@k;OOJ1m@W&WX1!x_jl!UC%zVK7R0J&z0Q%&@E4|c+CFz_PU1;Z|>S-$o`*da;`p> zlH*(P5syE#<=j4}B?<}}t*1hLNJeu6Fc;B9(J=62f9zNiKl#jDc`Tm-}?%E%E zjdi^-sp;oKwNtlb{4%QZ^XJz;IkNxWmgf82PrakUMYl z6nyg9SD#+++n-;!Z`h6r8|UAAonzp8cl25H;x&K&?(*&zzq|ab$zOaw?@zxL?mV9A zeDn1UA1>K?>6L3@MkoCEQO8BwzCChPTv64OgUgElJ+5@(ga282>)IRpz4XV=zW$5t z!t{*z>)yU~=65Cg9@@Ml?8@4WKRxks-G)Pz{|SHa+*@{zdvDY=Z@qNUkAIncPPh4w zp8w%Z9j-WjSN`YsK61~Or30_6??3c`7uH@j=v2Y9J4Qs_?pk&@bN@GeKF;ZJ@dag1 z{_D-^W9#i-L=8BrVZqJ5j@{S&A$qHGdCZ@CetOjh?_Ag%8?tyx$_wkXjZ|^Vcd!VRu z-krI3H;sSl{_+_+y8iIY-^aW@>`#~6_RGmXZu;%&heu9u4EerSz|L|l@dU4h8 z8{gfwa%pyG!hKx^pPhJOvODgxJx4y;a2>Ys`@g#U ztg5w-t~}?WcmEXq!0>-efBWi5Me8^J+OW9)@ip(iI{3PITi*zY8}VLD+Fe(C_uK2w ztw=gHvv6DOmRVEIKAPt;?p;#xN#v1rHy)^5^q;%`Hu-S#i>nuO&i(AczdqCV=kp(5 z7WV1FHy`rdT(axL!$bRx{MP&T-J`l}Us_uB<+&f<3Ze`a6SpzTFliH#BUCnp|URlezu zx3?U6e(X>Ga=df#ZP(Z@9W?v$XD1v z*#0+kiBEpy&;t+s)WsM1`sE`7rG|0KqK2Q|>6kaU+4X(@(#qu@&pPq>p~(ZTyad8Y`qbS-8)`|5oB!!)KIz(6eD}-&L3&CP=u` zjR^tn;l{-QZthOiN^SQb)Mt=#J}hVawbFlQ?cxL(ya~TH%#g`Pez?K&vSCI_Z<#+c zg*(N+M_r|Gr-^;nz>2vT^zu z4ZCx{DYOm4jPD|2j0|tOIRmDZ+OEAE&?*Gy2-uaJZe^{h)^@EXt!gEQSP`YW^%;T0 z;|!@*a>yAe%EuvAaw!+}hqgMvwOtFEZjp0FQY$$EcAsbX3tENX+Mbzd&994$VKP4% z(1pt*-Lc@g*7R3d9!fq+&KF`$jKwZ3T5u8m7Ab!K^_pu*-YhHWyNIbSPaZKTXz zPHj?qA2P7gr)f6XBpKG$lTumNJDGeOer&Q=@{E&vXOd@}^O0xd87Ijmt2Mm*`{4=uWpx&9D^;k9eQdan zk>tTep5Zt*PpxkpBYB1+1>}#casprGX9wu0^AXuYktb%Q&B zUTrh|Syqp;twD#TJ|%hTyeoMo=Y7rp3&}H{?L`3c}3kUZ^t zSn{;ki51fxlDo#o%it&oaMX@^irNmOM-}_DY`VdS3F=z`rDU+V%j1D$ln{ zp8kK6Jni(j4Rt1H$%4F`#h6?wXPM4eoWF=iXO_&kHh(!*SOt~N$~}!VKX;apS`ZPY z5F3DUVOX$*TYl|D`9%f72&rXVUl&v{sFg@VvA&gP+tp%zEU`0a@b!FwI`aI{cJc)= z<}NnG;fRa;c~>|;FMnBnt9vn)Yc48Yut<327v%(Qaq5pQw`6&-D2OxVgRa{Qe_Upnql9t`i|4efz=D+utUU9$foaeP0fZ%*h4cMWm(5DW@TPw| z;gEer`SWFZ#R@{dg$4PAix%grO*d7YXe&PL0#$6*I)CwhZ5e563?=#P9Yq*SCt&@f zUjaL`qE*e{TjDcRwl~#e-v`*L85~enrdemiYgJUK3%(#zNoSY=PzTOrsiwGS zamnHwo~5{ap7@p3ZOjz}F{|Dc<1V=@W5%el8I!M&z^6@E!7RLE|9uwZDqUH}7cEX5 z>W>yC4AvckbVr)sk-KQ|pjH=>lX{*UJ)#r-9dsW$ecZDA)C1!SwMPp*ajO-?dog+3 z1_bfGq!aHQq;62M>M0rJith|1@?Ls^Mkbl}`AqP%hce#xf5N5X@jl7tA4Ll9J9y}L zV>LWJwkW(20N3$&Uso8!RQwR=k@wOQG$pCkJ}j&7<8`;-O@vGvw)*k-45Q=C)bRL> zLmAV1lLapier{Zfs7ETb;1vOn;|b;;$7>4DdcNfv$oTxHNa1lGBl2D;Xi752hQ#AD z17)=D8GB&<4M2t9y;~L;<1t#_A+-AXR(C{z>^y8HRSg(H#z~fj; z5#uFY4~D##4$zyxWB$`VKDSXu_tju@yhh;h`CSq9NK?U(_tF763cPOkC7!;Pw2uXE z4xTxK+2^s~ozUz*G6>ftxbo@tuH<$Mdxm z2E=}z`%39}d76E_q#p5j{-KUH1)gODlBBS2vfveKcqkgbef8jVyu-j-rof~go%c%K zO9yBr@a7;O>&v;gRC;NPjyDmV1>f%|QueKaho0V#05aHa;_(q!;WdFF9z=qA#GCa% zI)#kG51h@_c?L zO@`halNJ9d<8>Aiz+aV)r=d3!Zbg)l`dZS_1C>hePpL=uNiaHIKj>8wK$5~6ZH*Ut zDM|^yO7Bez-skP;u_*O;d!VxjhPTQR?*!Y(izv1rVJgPCN$5ymUJb{3}lWylZ~k|g;+;~ zwWPHxS6kMSn%d@n=&Z6k6ESOPyJHVGL7f-1GA$m5lNA&+b}xC!&9LF{7QbSt&cLX6 zy!1ZqJd0tlvno~|n!B6&VSyQ+W~ueRNINgiJVSYb^&f!>d(kI>iVo#&0XF~i{@arBHVwBmJ)Ybl0>%*?C%bgKr zv%2r>*~1z2V1murqjp=&(VCc@wI{H~r|RVsJMBj0ot(#6XI~usG+0dAj~`+CwaOV) zHqMBy!SalRZ9DCYpBnK^{8(exAsxfgQ~LBCm>6+oda|=y=}oTe2s>cxHLfYIOnRC0B z^*h_ymsoR|Y^^}BW`Oa8PONsV9Fe`NgR?_?p2NAJsoItOnbSGG0l&NKRXuxLvWth- zH3(}eeHnFj18cm>GLbDdE(gf8tqn1@cUap8Xo;8l5MbRddsr{yZQIK+W&7Oa9_NYj z)Wk3d`}?X>k--&JrS~^^SLC8rh3|_r4n-MF2U7N79Y#&Uw&>m25B*lvGjT;t)vUyd zb$uE`%YawY`NO@OStfuTKzd!>a>TQiN>uTbiQFXHtkt~>t zZ);#?3cLLU?XQVk18rQj4w zXOeP_ap9;}59>O72{qB%vbX*A^x8g+5oNu) zSM^FZ*|3WeV+20*f%jmGcn|dxt;N`jm;U^hr;?i)nl#0cpCb#Yi$NS zwUC}N$Kv=#OoOeq!2+@7r0Hqbg9(w*H3_~t$KnUmKlN>y>nqU>}3V*^6zOW!>v+FUmUiY-sw;)fX9}z7MydNAn+?SRPaNl6&V% zu0+S7y+{Vv93C(e5WmwXJNN7qz|B5;43?AZ4XL(m_F;i+U4&T1gC#IiQDz0vS=noT z!)n3AXtQbQ(TSSIeoVAwG^V%1oaL-zBeJK#vqyFW+C=yGY3OQD)>F#ti{sOg9aa0z z*&ZP}3)xeA=L}DDvX8az2|r^0iakX3)%N(uM8E4mgW$r*l38aD;E|kEf^&QLTAV}h zXqCU(W9?#@r)!lbzRuHSrzdVXD&p3KH90&&(w9@7>RVXu@vX+@*Bi@i&I<(20mqRL zxgWD1MQc2gMV>BCJ%T0X<1+R*w%aFr;xav*XL({vJTW~zY_bR?$j})>ibzid$VO<@f!bW$u}inLyk3{k{Ls=l^>?nap#Z=Q-c= zoMq0OnK}2I;+&B#k>T=){JnD3?eR^;UaHZW9(zT;T1UP>H6X9invA_E`*S{J-o`)0 z&JiNle?R$W^3|F5rgPAM^ai}vKl+Hk#!paLiWNB- zBhm&J3@t4fQdlr};I*X%`4u@Wr>7O7Uk8V6S1WP`ugs~)8L~2?B4;RW1vxEp(?o7I zVMUELuN^yv?jHU;xpZ$-Ub5Gv4}5V`-Dt>aK3~aS3XT6svo)#X>Pot7Opm~;)SbKn zkY+{Q=!$|N;|c~N(eU(Ga7gMkY!fLG>QaE7AbNZZC9F@V{tyACg@q0zgt z4cp3JLg0rZtHjz*g$%H zKck9UP_jrHgk;JHrIzcS}c$K{!G#PqwLEeJ;(zPU?M)c0nW_O_mH=8_aN z=j$Z(5LE=Th|@7?46gqA^|qdGUXsK)Rl^nD0*E8^=0I@M&iNvw=VY<0d~?w9q%k4g9+Ibxt6u(zHmNQl_Q`slT1@ebm#cWjz<&p1ixDG#MvlY*Hn-!0f z6GQ#bh8Pzpo^p~eErpo_dFDw%?eGRi-t$@cBYab3D17TK?MKkQx#X`@JZ)zxp0*@c zec0;;UeBQu^8WlU)AP+qRNbY>`?=DFZBWk_!>ho+xpIS*oatVwcw$_wcw&%z{;-2n zr1y0eej2wZZ7<3}l^csA^E4T8f#SV#W2XudIDAj5NVh$K(?JSFd9q?bBEKCaFY?O_ zf#{;1gC_dxu0kyO8a-z%Mw>2DPH5kpJ75xn(cDhbhL@;rV@%%7m2y^zo-4o<62m&X)6nxCODCHdcRL)0CNht)9c|2PrEkom4QtZ2Bb3 zx8Xc4%Sm6JLu~7To*-U;nSf%!1nA6i3sBed;&|CH_5O5CO}$i=a?0$PGmB>F;;NT; zL(}w-J-NSk(M+_$(CS5LmvJth*=FqO@C@oX0Ax;4ySi+8gBXUDhb?B-!NqB_<;Ee` z7L?4#6hKQao=wHY#p!kSY_@ zLD;qpY*F*V&Fev*II3-Vyoq~OAcp_PI#%9#@APrp* zprNi8RVIe*6dI_%qz#Ik)9ga##c^(-n99i+y}*+b*NU$V5Mm$r04Yq-x&svW$y|sA z%_Bs^O*_KT>idaZFX{{b$tiP7Qu!R1q?0h8V77Y3q!hO?LC+{&t9U;(iDLy)c|^uB z?X-@1&0h~Y@^K15Ww_~cT)}%M{h^NGsTLmZ-F%MFr12(Mc;yBjvgqOEgJ+(!f4tAb z)FX|@afIpLO)$!XjQ;U?Li=|ncoXkRggNffr13a5Hu0V@@c3w=@v`BpiMIthj=eN# zyi;Ij;vEJa$6WLej~O1Gy|=-`(6z;(N#lJ3#>7j>NaCFYW9nER&s+8Js*>X*NaH=KpV7$2m12&8$43_Gh@XbWZQ>n4AgF$$uru)%8+d%Y(RhEh z%I{m?#i7?kJJLbenRp4{>Gr}$A&ob|YJdGzJOQHY$X{Z$ziPw3Hp-6q)$>&J^>!}s zju1eR_OGXfx6Qz72V3pmZZKx~bwxR$>3gK{c7Y)uSDG5&<$-7Ya_R_m^lvK|6YpH$ z@m-E4+L1V~n0%Z8&>`Tlk04$S4(f=Pg8Z3y9gwe}`aK3C6R!h0HC-QP8h9VU&cy2q zydvl|5rg!Bg?Fxj*AaT{UlsCa;;jQ7{nn)MZiAia-=)Co03+tNGY*Y+orPBoyc;x_ zvSV<*g}2baK^DRr7O zp9drIaith);Prz{iIVncoP&BPa5w}ijPwWx(|41h{)@A2o8<68@!3fJyH0s zTa(7y1p)cEQf$LTNuP;#J`Rny2K^JGN0i+Tyz@2h9~ycx+Bx~2%5E3z)N3;#p^ir% zWvB7Jg&o_0CXM%zm2L|R(t`TkUs`r;Ejx|(TgxujveV@<%JQ!_?9Bd3o`<&FbhxFQ2rR~%=w>b zc%FePq8(7LF>ZuV*BRx+8-qflp0Ckaery+0rWfF^XP%w}dc66c{rdIj8xwT=`JY2M zkOTD=|8wykSbB$fNuwJVaK6XR#s?c=5@KAOOABLi3KR6)Q>1zs<|}OH!~}@TielIF z>{hsF*3?)pY+G0W8)#SdT#D|dJvp(^aHJyYR7Uk`%u%r#bJSRkd2mHEr825lbB>DD zoTJ8S&f_YgX_ZmE8gx{w1|2n4gD$LyrdLMwYSK}$nsn4yO}exq+M+UwMcKt_)6te( z4LW*Cay96RifCqK^i-|S68h7U`pSxEc4f4c*0&b=Hc9=aifG%)XgjSxUFgq9>UVgv zZ%{rXcO9oRUO!H0d~lr7_yRRIx-kkL)yG+2F)wxWB}<*GDa|U{$4Ym_(;J=p{fdD( zGuClg?-do8#g@pMaXY4&LER=%Q5b78?dsbOyqM!m?p4eB%>VTp7f#HWaoI?B#!#*f zzO@HiN+KVLBzCn)tlWhq!Ufi5wM6)@o(JS+|m4>7s)f{_>8FlS3%b=l+b2Qua$KQF(uH1E~C+J*D6<-?rCu~jQpe$E_i zrT@%Pj|A5C*E!rDON?E$<{;v~RCMbD8Q2i#te3Ir$gKyNzk};zhvt6rarJ-XRre-( zoj|+$LHV-0K@kgI}qQxX^AA}PpBT(xRhMZu|wnX7KB zD9B1IS#?82!D)##t8S_&$WGi{^EsomN^Dl157vf@OTVsdU@>2HAbNR1; z|Hck3=vWbPDkHj&j)*=wV)W5#Dnc_UWJfmvks;!B&<;yFomacj-F}J*LMWSHf zp~Tqo<<)!A&`&I{o}Ma2)Si{Yq#MS}hTSu}wyBjgRF9kC)Cs(vc zkBmR`-EvIfRDta8+8tT^Mb?UAuvv~p^YNM}1%nC9@S9$Mzn*z9zF&@YoUdp3#d2rQ zFPk&Jtc$r=>xmXih@BfEm!mUk<2d*&_W#lUN(to8S`@?f&NGYW%`2WgD^@l;RyMsT zHuC&ShsCfuL=hJ2m>MfwB!oj|&nhb|E}UOByEHZp$DH|vCB;(;${4R;UaX*`Bt|K| zD8^<_ixte0C?mPX#;l^UZkWwZ&zNV#V{Qo>x4zs1)uYrS`&M&p~+9zI*JF`BSDR6PSnmOevX< zL}r&3l=$V+Q!GKkGMLwuxmkcs2F1CwxD3T094;y;!b&i+XBAID@-t`72P1MnPdZ;v zCbCpkJdNTIX-qQE8S644MY4^MN6Bm!Ye8ids9S)vXv;TsAGltZBb!zs;w$H8jb@7hB z7U6pSfAlYuz%T!PWXYG`pYw-{`;~0^amBnj`IE1@_u`8$-+9xquI)xGy6o^-cdT3e zMroH*_k8(Azi-}{lX~(!zxdtoC!V`^{J|bC|Mb@#Pl^vd*!jl8hrb^+>hVLL>>GM= z?AM2W-(>&N%`cvE&ft^BEgCa;=l2Wd?cbW3IsDNsZQsvtJ3Xc7va{}gKJ|%fFZ}6> z-)#BGzUIqDetJvkzTXu-nA&OW%hLvr+B37;w-R>-yPw~&?~jkIDp@<= zz}w#xPy0CcFMTfi(dLpXSKNJlpEvK>@t3pH=I-4#W#xbme!A-PlfQc_xA~Trd#>)& z_S|bHu6*S`2R*R5-8*2>OK10s{g8O?_D`2>{7veHsq3FSx~cC+hq50Y)$F+q zr?0rC)sOyhS@Hby5-o44UG>0SQ(oIRyZp0`m%g37A^(gC#V?P0q2|0_&i*3n$+|b3 z!rwe|wA%~M99-L~_tDLFF8|wKs($O+s_@92Nw zJCQG6d+@p!+r7SFcFt2*EI+4T-k%m9eg0^9N&7Ey{x{}Ye{Q@0`1j{pt4VpP$wl#% zGE3oeUBig)tq{L);>CnP(RzAJPBJKpmEelhJunWr>zwKQUWNI-$;I3GS<3#eNY8aT zIWUpww_2kWUWf|+auKa#Vo-(|)7rcIb zrSWG_&O{Ws1P1lTk%@P1np}QJ1_92S--lO@PA0)YVhuR()RQzm-}$-igh;&C(sNx| zi+UYKeuvTPF!CK3dHUH)@hqeNK$%faJd(={frLLX!OHf!tBe`nRn1=b!w;h% z(SE@*3v3H6KhS|P$i&6^{n zp-x~Pn>KA|GMi;1C-R7*z#Jbv^(@#;&dBm6u!Wbkv=WeNS-5$4>x$Wx$?0uIs$%^( zOjgs&zIoF-^$TS=DN|L4PSsZ0)7gCU(T+FAtD&aV@RTlHm_DoE!ZT)S=}gqCVqv4R z*1&8mto_B6#$+k}lk=E(S5sSD)VYShRf^F#lh<8pZyiCMc|DW#Iv1v$)={td z0RYo|0Ohrq7r;J`eF&4Mj^TE&Gt*_i&i+M{#^ZWpCf=(C9&ZmC?{(zY#Jg1KY&`zH z#l+ih;NerGhxdquHvu};g$qdS-!=>HLj#X}uJ(`lH~lL?n0>A$jmLYVX}1_*-tRSO zJNDz`<4SP^>9Q|nIxJtE?j4A0;#DD_F&I_zl}a9`5ER2rLf0EdavHD9!rOo_#~+$B z-fRo6tAWRSYrNG~IcKZ#wDFc(<=o%E1MA^UxA58`T&Ka59fMOWyrBjj?|<4q{+HK0FL=h*h6k~v=@14BGYrHQ3X5t+}JdTGoX}rI}hr`vG_yFKW_wdmu3Js(?2FGPXZn#~SZG@Fw2# zxX8>tM&sS9;>2+#9R%J6oQbFB3bH-^42OyLE%0g~)1>j(CdtQ@VlggWjTeKAI^yZ| z{d$5Y)u3`YA4L<>;&B!J@vN)rBiO|e)N)L|Ec5A5oz$O=~md8q;-8@ zXMSJK#>K<3WxbKKT?+DRxa|-xPo<&TGxL8=p8@i7vHE}9@5_DhR#wpQzb`+=3mYWc zUoOV1+B+$i--yK*Wd0U>(^51;{Jg$;->OaN&D!3CH_`}Nt7afhR!eTxXhaisA<=Xi zV*P`L)~cv;($yLn{Eh!rO|vd@O6!~#Gx> ze_D3)iuS!PsH!aNy<$L<^t9zJc4FR!MH{j!+xNjoqQXA1pzujo?|E*Q&r*D~?cb~_ zJ?oCX*H6ptm!69>ftmi@tqWUZEr?8X$JM2#H%tG4d0<`yVB54gduk!snL5FRZ2Z8K ziuQd6!i~Nw2Ds^1ilpBRdt) z<}*TPrRsryco|3)iz$p>bu_){i(eg+Ekd=60_GuWLgP-kY16WM!~5m8KjYShdO3HKP3(7MmqcW$(qOt3-vIAB^$;V14W3dv-iLHo%wWAj0ENO(s5}p43 zgxC7liLzpruAx{e(%p1zsl9+ zD+>Nj*)nTbhgMt1S|3Ln73Q2;fe+kRW2B-k+n1R(0!J?IAtKAQy3#7Ek8Mv|^#ne| z@2bmQ^{V_9f9umN@LimHet($tiAb`MD7*F#J>Xkk#H`c*4!*COvLrHAexkx2fz1x4 zqV5l^T3RSJ^xV#+h*-P#BQJv8x9a|6KY}GMm`57zY?}3;gYQn4H{E#b*ozswW-AI7 zRMg?K-?bHWEh-A;bM=mExq8O}G#w_vg*zgu&$W9aZb^ylcbV z_uR{2y1z$7ateS%iN@v9jVh;^PkEO`Bha9CXF^p;_~$V8QQM zu>~SpVNtBOtos|S*Yuux^W@)Ozx<(RF8SDVr_(*CjagU2`b{cGXx2L0x~ zpWd|f>XsGX|GoI#%F@-X=l-GTJ&l@mN&Vfge*Lq(Kk8d~VCT=fEm(b1RrEjpl-s1u zgzq2i@ZtBro4@X|8_QRZ=<)V5=Y92uBR7w_?(RQd`+Cvx-@Z7iAglHJ%_d&lIIofFKCU9nd&)s32gp5*67ghnPb3n zF|t~((k>O@UQRU!L?DhgU992ps4v{pxlw4bMyb&Ec3P?O;&{jvZ`qUqPX9OdNz(7h znJRtQ)f97G8Txzed$BOa&gF%}9KfZs}w=oKvrfcwZ_!&QorQHDBIQ`Wg{#<^0;h-=M;{ zH^aW2ldbH}5#bz%bG1n`ad00btSjdc(;H{uy{oj}G#%uzfsNcy+`!k(E>q{~P6!v+R2 z{po_RUK4}$O`f*X4Sv4j8Shquzu&L{>(xcQwCEIw+1B471}L7kR~tO9dD<{7lFQ73 z_?scF%c04o(iQl*P=aDO^qLz# zQ9Sh|SADAx_C2JGxVqg6e~j-dx?cDQroVacxzAPYip`yvj1nW?3jaVIaOiIybW4A~ zVYYQy<&j6+zBse*aQQ+5)E|f2Q?TNr4 zgXM}RHvOQSWpKCRSq57a&ocNA#j^~aQT(|$zo7Uy&TlE6W$-7(kHGn`;#me?D4u1| zJfmfcQ!>N9n9RXY(ECUe{QG$ECf&5F_i|j09=+Gz`jdsX?~n0K;a~Wuqmn+6&pLso z0WbZ9UBJQz!LR=VtQ%UgAX#3={n#Urg#Fh%`FhPi0qG zEemg(fyex4yidTGcq3Fi8}HAsW1P5B95V9D=M{}tXW@+o9>@2ZXh-56(d6R{fW9*D zFx>O-_Mvf`{v{A#IcU;&ufWd4qfrMKvHbWZf;z@~(85~>Jl2UOjd#C=$KT;`Oh&v` zI5ggE5x;+<5f1Y2X2=;Qj)PQU_{TA;#+zl~O+c7qPEFdsVhit9;Bo9p|2THnc+IW+ z9#rvcyrx!uYk|jn5RcEY8t;9}zYh`S^R_1K-+PvSuNrtcFxGfeE&ur3%Q3npjW@~i zkNfH9{GJJ8jTg7@Iv~76gDE=(e`MjM;iA=e9hDvP-x=)#e_lU+AL6AUtV#RV9!BKj zO3@#9+2C1z?0>a?KY%y!xWDO4$TVrZZy+%7xZjV)<0GiXdkwsa*A|LPHJGwv@Kwdf z830WO9(|#IXXDU#Tfv)nbD-e+5KXir-G_sG90zGCo`W=AH-xEU`EhS|;;F|!X9mJ+ z5Y|K;k7??RW+Uhu*u@mj6KzOU04A^PPD6*ybTnzZ2Q9lZL+sWfqKS77>`FD5(lN+3 zWZG>EvCB~T)&8A=o1fX9wSQy4kY}4Coe8_Ck`@1{<1rCHJZoCPo2fxs_gmPR-+w3L zrU4g4{nA|9aorQ`8|7R_KwmR$5oW#7U%3pR{&jKe`1{NB8ql-%34Z^*vLg}z$uUtb z+Q0Tr%KM7n2v_1;SaAgPv!zMaS?=m5*B(2zwaJ!dtDhdVe*6XeSr7#2O}92lZ&f+M z$vK9t9T*#N@o^;4I=x92Huq@Sxy@;>JdkLbb;w!$)TWnz*wb`-v(6j-It*>FNw+lf z6Di{Hw^3Q&@S|mJc2=qT%80Q@yXVfv2UGdAX7#e%lnc|w@A^l#Mmiqitl@W>T&A|e zedVd`&1y<(nyt92Nlp8Hccs*{9Ns2v^;5Y`$B+9*w`||z+6OpV5 z(W(jQXJgx&@gtq8+~MmxO>951Wv5e5uF9@_>1g`E%>z=pjzr~jZIW1cXCjfd3*+I?-d zd?CK;iw~6JUq)oCJm2ZQrla58ygqeiDl0jWoxc8#>{F*r?_JY=%NNKNKZBwKXEt5_ z%`rshxB9)!4m1;@@xT5d(LO6JGBb5rc3t|98a2Y?fUE_7-?S?i5s{0=uv+xNu#bvt9O2f86>5(o~r~%x*MMDnAtH>kv`>4vER-7qNRPiit#_xiSnmUQJ z(eK<*b$X(GdfVMqZaRMKyhAvE#K%8?CInxGeQ^x7@+&aY*pO^D<#+q*UDQ3k4@VcW zm1kX^nV$YqqyATCJ?AD)W6_-1X?pgw?4JGBjU3sCMU+^O$i~M^*bW;e6Kmwk^Umh{ z(En-5QGRA^be>byc=Yd|Sf4$zk<3NP-sWN&!1DegAN`!m?`>LDIez3xdFwvFwn7zq z{sGMNmE2D!kC*+e2{gRwG^eKhv^J4pU7hiFHA_^M-&VV&XV#rfhhyiVvz%2GoAz*T zmYvO)r0->|B`PmStgOTyCucZ=P%iLw#I9W(Uf-3wGv&n;Xva@)G$>u=VmicoQ$B5e zH1)-1uvXIk6PHeOU*FZ?11guNYM2QV=T3Ab)CapV@l#rSr=8)x=;;??K7`EP_<`7l ze0!8-FWkN3vB?(JDb0h^W9kdl)4E@5YFbp zC2V*SJ(Pb`e9~X__e7(CiIt7;JNwFkmnCw_ht_^OcGa;x1yvbYUpaZte=vTriw0SR z*(+$++tXis|5&1Ddiw5ccW<<|toFKRke6ojOVtX4O8Y`1} z_p3ys>yXrzg5~=}Ut?Z(fxK$FY)`VyRz=ZMr&ML{c>1}JD zZZZDvZcW*n^9Jw-tUINPl_HCaivN;NiV3?vS3?zLchB4NXNGNy)k-rP*y? zRF|i>-kEkFZEy2CzbI|)eA;xy9qy-T2S1H1NqhTrcS)0npNKt~LOud*?KgSN)*m=| zT9bYBX+w+h6)o<_=6oj>PnzoE;TsC(*SW1OsBE@A>DNozFO<+gXi#M8UX?7Tij=HN zQ<~kdsuEi{Rf}>;Pj7Re+2&sEf%M(2-JR+C9*kv8z=RrEQYoUOWHD8JY8F%Sh9mC( z{T@rdU{n0LS}_v`HR$!H@O4cj2Q}0`nw1hof18qZTclYcy%lC6MF#G9J>A*cr1RbG z-bn2$u>+AO+PVj#NN#INvtB#X$G>s3KF)L}tG6>CMf@Jy>aQ`shy6NJ``F!*JFRuA zEv=@_$lCI4db8It8w@v-W}ilnvVpO2S2f{%r}?zUzTEOHbmFGe=(}TxEfTe`9b8xX zy2E-M^1e61scMhA$dc4<*ja^lh^B4RhS!Xl>o_ldf2;sQB5`Zzz9el}bgaEE<%40qQ*Dwlb!C_)+S#V#|z;Z!gCGBt zIPdP>{bVZpq;}4`_jFpFKkb^*cT%@}QM~rMr612-RInZs!Kw<@_o$k?KBsEw`iv?@ zZiBvk?@0%uxb>wCI|-Zope*;|zJko)*23uDt^IiEdPHC3i-?=t&XdHnt2Ep*(MPAE z2Tm3JVAIj>?Y^s1%>^5e9eZNkU#30rC!&13cD+hc$4vXQQKQdU9>b3K%0smst4y{; zs#-5TRQ_ZOta$Q8&S@1nS*ko9JUM=Uj2+f>sbhiF#+f)4=iP&fYIoK?ng2xptKMBv zyT7*6%88wdBg@-6HTh3A-}1#fYhPNrXzs@aAN%$QLv1ogxUFy$a8=WiLo04Sy-_Ca zZ!5Wj*q#;aDcQGh-z_mikx_DY_ zN=X4`OI=%3Dt?ZRrJ1lrd@Of*S=pR<1J60&TdJ-W>)ojn7; z&h8G27*yS4%t<}-diKfd-*bTa;A}WB4)1C;1-hKR`ys+fR)~ zJ>NDa=|txBV66{9m*al~Z!KG?@EIaJP%72`sCb){6xILzW~ZbQT-5h=m|?zMNYe55 z+Ub)t2FJa3Op1zM%q1oD_ue@-sRS2we(YfECx|r@LD;1Fd-KGdY0ADx*vCzC;0<;j zQ03KC=m%T+Ay#;(vr5_X8+t^1IZv8IongrUIPSIcib|jFRU_gpX3`{RubocHK3~|6 zN*aTU*4x|XBIiQo58rD?e6xsXKgNo0zMZ0ef~CLG3QxAe=35fRXQ?JBidh|5c&DbR z1(>Ir=#YH3QOXMg)E@`uNj<4v=yez2CeEL&_y_q?1SIt*IamTl5Z`-p9@8S@g$mOf ztHK#Vf2vbwTyoUEZM;BaI79iz_aQCucA4+IN$269)kLet)Lw<9UJC-x;XFG-7(|tnkGOPnOp>=de{iDN6sK zz#H#icRN87MffMqYRjL^R(QGr zZs`;f+Hv#5NxZ*vdr6+f=E|3BxK8lhN#%?0OZ7Z8{w7M#Q|oN-gwS%Zj>Z%?M*g&% zBE3Hht6R@0W1pbsl!5hd*v0sMKdx>QEJ{5uOxUaLSKtq#ME!2=QjXXb@8GMPnL4pb1o9`h5z7* zU7+N|C{sMsxl{4P+pc(G2ply85WbCs5F~u#1q2elsoMfgxknRae1EL>YvNs&JTaI( z^28XSc={>uF9ZV;_!miDuE4nrLXapcg)hpAg#i+6zN_S8IAtonlj4af(t?~AY_haT$61sEc-F~O zB`5avil;BPD4zEBD4zBtcep$YpIO)-+PPx|E8Ao@$>-pd37)p1O@gN_vr0MrrF-Ss{^LWc?Oe;ueD~C>1kETJ-37n=S3+?{}d?+CFVHlDQ!v95YIxaLxI&k zSCdW*xW07|a7pnzouLpfg@sof$=QXz`J7sRHMaH%RD|q|735NbYkUOKK(_IgHZXkVZWLMm0MH8Sf? z#|VW??nZ`O7S9UZ=*uo$pS396t5KWR6_w7$v}LUNC!n;S0ji`!RN_~7lep7Z1Mx#l zMAF=6Dny@5hej5@P--W`^j_xXTr(vkZ+?yEl3$$kggKryJGhukxj%;Vou$MrwHhen zdM2JjVGwwki0#Lw;{Btpe-TADBz2dWGQDWZH4SYBC)mY+!P<%(~A&w=123Dn*}- zS{f+WL`&(kils&DgMC0jg`B*!%NEVid*Ow6W!dU!X2f{LD5& zGwngLekqmyb`RR(k4tX-OPTH7LylWd(* z-bn`DB2SIv99( z<>KLui1_`}>yZ(Ir2XSsnx=nw1|Evi!|P(!XhOO+#gy z<;UM12i0#Bb|&5k;OY9{yG)JuF(R9I{SoL5y(Zd`K7^f#H`%~z1--_z_Zuq#9!x#b zc)P6nSO}vIuwwo4(OTnew(7SWc;|U&(vHDR7TyNn>Fbw|^BV6mtNdz#r{4zN@Q%dRmX_IO@X zrd>Mh_zp^wj>EP=KCTooG$ytqrrQArbqvqKVdC-k0Bs@Dr16R&F!8zqPnR=aeQ3N3 z!JBwxzKUwg8XmYSMV8!j61gDRS}tR^#z@ukpUa&B?@j6?ps}rb**{ z1v?XOD)4wOWPW?$(0D&q{%MH!a5L?o!IT|?11$gE10Jz>^ueL==7TZ)>x;-7-}X1e^IWA$Vhh>+J}kv74U-Y)A_J7^YJ0@^z|{uz-w>erJ#Qex?i@l@O}WEzEATrkuI0N zTlwX9p)K^9Xh-^+mEW##PUG=Dr}5sl@JfL9pg@rSG~VkL-j%>x2ottHwttOx6oqG& zUpDSfLFM-?j2I`5gY+iwI^aya2{<&~0Shk|c!`z^e0fv5A!PfZ%{Iq;@` z%YX+{k7!5w4G!{g9Hd+fHZ|Ur2y475@Fv~{;C;;qiZtGB2%C5lfTzbB{3NCEI8Hb5 z*5RQjsD4j_k%_m>@Ncq#_c?eI?_uC^UWF#@-(d($y!U`N88X&Kq0*(}TojT0B5u!u zo`=wY6Btz7fObSV%mvXd=(_wF?96n}#dEwa=OVy@K-pa*VveG-uAIGdw zW7$g1$Caj>qi^UwZFICTdRkLo;3Vo+W~_7@u=?-DFg-A_O*!3%F1_`RjoC{bu8-KQ zX;!Js3j$vLl%4P%a((vZ#A}@Fe*I4cjxHplAae9i^n7Jy`f_|9H|3pxk6B-M?)lwh zKF<~+^-C_JezgB6hg(k|4GpZ%UOAmu8r6&c%``;1-twtNK9IhlGm4)X1Yyqo@!R2v z*cj>jb9J~e^WV&S`V}IF_3Myj-+)e*ONv;j*DJCAKa|%s4U|^{x__;_ymn!>3em?% zJpRtZD}B`_MgLP>{%^L6|I7Yv{O|GCDvxA)w8{y;XG!YRvdP_=Ry_33ic0>bNpwK! zH!rZ8_SMPB;!clrZtdB~B3FGrwrc+O`}`A4>(IZP7W*ys-RY-`Oxahy)X5CnI%b#p z)}u!ut|-&M+Z${IHZ1g66e-6dE{<{>CUFcx;y91`S{x>6J;zhj%YR7=t;ge@81IxT zm6q!>hCV`H8=}W!ksL3HM3T=EIzArHgpcJR@iDv<`q~gZ$7o_K8-hO^dgiel2T7-^ z&m$nCz7_{b%k_CAWYp{O(QN98z3^oK>I_53D6eJu`>t*0IJI(=K;2`biMIS!Jo?+h9BwKzz& zJ{L0T!|=O6#WqlmgJj1)3o`0!agc2N*^p5mhR<&*ERS*=Ch79Qv{#|8HI?AC{uHIx z_}WbC`HaJ=DOU+f{PsISFAvh{qIO1&G-_lKVCuN((S%k_BxWDT{?fl42S|0C$xzRGcsG_F4L-9ba`bCA-9 z;r|$Vwy$y=B)k6jO_BOq93)#Ghm3lSZ|n1+YN&k_`#fLi zYjGyo_`@J;sC~wuXZwodFiH3XL3pMV5eXXekuk|_L**@bqNLsGXXF^7O zIS!JR>vKoQsISFA(sF$s4H?HMX8jmJ@oPffv9uq z0%0*W!I|SM(g=BSMyj(YJMbcpI168J=D3E$@e7IL6cWcHB<+7E8T8hO%vIqo>dgB; ziT8OD@8=}mw@JJ|lk~er-fu~~uabEGBp4HEAUq&#`Ts{WGLuanq+lh{v_*dLSF?~>TRlGu-u*k6*^FOt~*k=W0X*q@Qu zZ;{wPk>cWi@|(_J6=wfI8Y)lXw=ZOesc=l4+pBX2b>?+R;`K-3bw(O3Pu{O^d3}(0 z9gxPzlf!mRV*4erotl(?{w3Xd^z7g5{2_xK!4K%^@jd(W^?2G089csQOVJm_CtwtxK%`}`fJx@IL(wl5?_yAwY?s_>hP(~5!FZ}z8=kLy&lc#a4Tnpx+sVg5i3JW9sk$g z^QxUQLk;kyy&mn#IQ7@Y$#KT3fiNv2j!_u`UylxT{Ep7IYG5tPUymBKzO!W1|0rgn zJ)-hUq=;{38vWO!ejUG?GuW5kZWf*%jcfZJPDfvU_2^vdds*@OIPHA-)uVN7uSe@T zJiw__`Q`IP#2dY9y&k>m@F3?kbR{ISkYeg5dD0!Pg$yc(e{O}BI{Ci(U25rX zu);Sw@A>-Y8!i0`E4vl_jhZSD$RQl?7y`{g)3g7Kq>Z{+oE&aV#c%yTN&wit&|D_fFm2-iwet%`@H(TMY z&aNg>B=3(~E&YR5c)N2{)mH{I5wUVi(j@9Ulnj82I*&L9)%7UtAF=e0TH(i?4|!pM zTH*H{?ms|cHAloMCL$>QMa6Du zX86y}W?%XIIjIB}bw0AfA3KA5<@2$n|1T^2sdJGUKS+N*we+7^;m@7`fsf8cg|Yn&uP#^obN3C->vXbr-{%0sHHzP2u2hOX1tvTy9JRxhUc{?>IKatAUapcoFP5DUe~P6)#cj!s6coeZI;UFt zQ{An;_?)Gjq^NV6`;yPUR+he%o9fFySC~o?o;Tc&eDT{^`gZO{Ro*c~bDc9R{TXgS zbBQPQIhH=hb$$9XE&Z7;7PA&4BAxXwA2{v3C%FTKazrs_k8wC`cr z_i!KZ;q|igz1$hT_-4kq{oKF$;t#O&1KcWKd*RAsNy1vEZb#J~ z<@NW3yTEt-4YKS9x!?Nm&a?FAxx0PWPrjwkcklPL&moq6h}+qx=dZt$gy$>w2H*8F z+|mzsFY{f0BQ5<%_pmSiC`&)e{e$oNxX{vH=-%UN{})^Oi`^gl^kXgkSodmQ`{Sx` zNs3~XxQ|r%%ldfI?d)qmms$3gxx0OMms|SF-4(w0-1RL_`0%*OL6V|a^1SK|*=~WaJ6f^7`s(9ZH_g|6 zes08}Z?N&zwou^yDa@(F4vPFNq=5)FZPWO z?zZgjcK@czSK7bgmiX-Nwe0V8JNU|Tulumiexqf-(Y@KH|D~n>rCaB_K7M8Cf8{oA zA@dW%$#phc`pxc#zW7@$y&e7!OaG7+e#8ntYK0%S!cSP?C#~?)R(Pise%1=tS>flb z@C#OWw-tWL3cq57_qw}tWO?#Gi?+KJ?%Uq4zsu5_R{-N5R?mx!#qeD*a*`PCubzJ> zVfb}2iWt5_JwH;!@FFX0-m$5F%1W;|2B9MAx9I@R3{SQ2dRqEFS>Y{~{rQ&uD=Yk@ zW&f2`URPM*Vyk>>-6SCWZ4>i{U$(-hS@!Q)=^wDt8)}6ww$eAR5T+ls(%WH$Q?2x0 zw$gvZN-x_Azh%|mG7G;BK4_vp%PsuomjBmU_+w%^wyghSR@i)EA^sN@em~3pFIIS$ z>VFYcw66(d6cO({SBIoN#cKbCTEzc((p-e!weZ_m`a7)f#g_jIRRUEJ&NX|`Jwv6> zePlD7?LzCWl16+r$~DS0x$5>SWb?!~lp0BF7R=6ft-HwHQGcASv&4#_YUr_6+ z+q1A&;|3wW)$m8%zl2=fp7{#Pt&}!QK2zP3dFvvtUU50D>YRlAIs;R^Q=yA`9cN*q zZqEV}=KjLKi9xBzRkv=Dmov2#ewsd489sNCHo|A{p3mwQZ~Dwv^qF0x zJ&TXLXMd-}WcBE^n`!AwR}Bk9zRsam&NJj1!5+>AiDRZK@}fFOQC8qRdo^?r>GqMB z{O?Qm9wWc~rH#lhcn?PnDe9&BBWW+v1@GBcOHAS0kEIR&yK1N* zn&m&ykZ&>kztWJaj$Qaa$&f!_luw}{f6$N@8S-rg{&YhwyAr$;MmxO5kelVBhFhY1 zW=R`SKH$Clsv%gt@|i2`MfrgD?9K8iGtxE7XMrJq*zo^4L;i>%Ut-9281iyMu7-jl zzc(0iGry0?xFWyHrH#lhc+Y<|gshj}mC|117rbZxYr~(LjC9q|Q}}a>A+Is)D-F3C znhN{d4Y}$6Q-=Rl(nk0X-t$KdY3uoam$VoDgZJ#8G5op5NLLMog+Ch&`ELyS`=p$= z#7ywSdYr~s>q8ef5woT zb^W4DOT>Lv+O#ANcn@DaUexnvm$VoDfTy0H1>HpwlS2~sI>~D}&q4C+5P63Xd0vS8 z+z|PQ5c%aH@@XOR`62S9A@VgL^7SF|UxmmY36byA^6UNO{8EVgEiGT{w|_rG{%MH( zJ1t-0$Ki8etAbNSDS+A{-LLq zTR7YcP2gKN!?fJOxkSrX_|v^o%M*V2EG=K@moEyDFAI_15+c7VM9y`LMZQ$J2s-YI zqDzo{CT|=dK7PBe2v*wfm3#-v|5Nf^$-gG~-sInq{JG?LqX7-Y;l3?c@tZ669m!ux z`R^rvCHVuApGy9Zk}o0uzT`Q?cmE{$#pM4i`DNq}N&Y7CpGbZkdEUH08*sRv3D&uf z{O6M2M*b_wKSusx_HSJvZ)5OrAGH5R-8m zOP&yJ6UnFG9T~&z1c1e zNPaZ=BFSG${%XlzNuC20&{Xm>C0{~*j^xY8mr8yy`7+5bBY&;rZz8`?@+rV_(RY&g ztl{zj1(c4%Z6a9lp3$WMl!?PPCxs6Ipbj|nK2o{lIZy|6#o@LQtoTi;%NJ!Egw zoQg{Tkcit^@*?h8l8@o!c9XnFOYy>Z+|l20dpzT`#TM@T+K`6$T?{EH+n@W)DC;9n~F7)~x9B0$1k@xngL|DPE4iWl}_ z{$C~S({OSpOJ4XtMe@RbKCpmdINV}#%AXR+3;fxV7yg$@K8BOahZ>OZU-1q4ztFH( ze1ra9FYSf@Ka+e6CwHmjMY_u*FK|{!Uii66@+mmEYa}mlZk2qD^4laYaDE|qfwNxn z0%wEd8^pQSz}eI=PFtv5KCFRaINUAdR2eE>`0${V3m^VN@-duTKG1=L&x#lJk4d?( ze?syxoZP1*FYNiy2NL$Rf|b|EbCOSK-1MXtr)0Hidq(??xo3Cp(YxQkLGdBOMvlIC z++`E4_-Vn^t7pudGw<3(i+^6>-smRqy8mXpqF9Gl*>}2kyVdS5-TU3G?l$)!cZd79 zTjM_M{syl_p2zEiJ?_iytL|^zeeUb-o9^%2{qDQ&d+s0HgYF0Jhwex2$L?YGukI1| zOZRK{8}~c+@9t5zJW>%^7FixiL{>#^irgHzHBuQ_7x_hGedMml-I40ZrpSGf`y*Q- z4@9;{9*R5?c{K8PZL9N8QB&&X?$HzIFE-j2K*IS@G* z`5^LP0pP)U^m`xdbN?EB_Qo_gjV$ac}%Gfgvn~xDq)`8xK%)hl+ z114fS8>5C4jNG@(w@FrmMgqp4OaMfvfr!pJG;$IUKiooQK=&67f_UW^XeEKXqAV*dDwrAMO0p>HnFt8> zh^iv6;aLzuxP<^<4H#EK2uQ3ISmK{gshS21=>4e=wyLI7Bm7Xs3-l>jm-Fa#vrLIN07 z9EK2XA|UL#3xPR~nSk;qE>*0K%PkE4d<^%eTQP+y}*;q^6ocwJw^;t7_r&^TNR(DJ$nS9{eKZo*VqAPwM$ zt3CX16H)1?umRC9s~No7&ByD$@@S%sRQB3QKzR79{knUQb={BRRp5%R4Ab{7u90y<2aUg=q9R^2%YOmUZwO&;Rs*~B{ z6&Prui;rX1`bDoZAFgG?3D$~?Va!_}RaYp7dG)p0qY$mG&|q~k$EeU?6P>3JE%8}f z!DOP<9ZY{DCnXqEL#mi=OgDnv{$FU?@UhSd74R{fZ| zlGTVfz(Ch?sD+oX7^KO8dH{~T{e>Fn3O{~A;vx>kK|-Pz4K>hJd;EkN#PQl!{mgp3 zuT;&NT~^e6_(hj>L$5yN8mD_n$+c(zQ>T{BE56$MFyO_JJIz~i(brEaEhfO+Mo6>}wTQ~b84@i(C8CH6 zCAcgCR3Zwm#*kD3RMIgvp^!M@3bu4I9eovAN?qjMb!6#9WRx!MOu-oo(#aI{OX!e@ zUX%0m_IEqcq_mJ_&g$|BeF3%spMX((0#<@gz#{euMEUt7UcvaJBG*2NmmMMPUN~=F zckTL=;yKfcN+->mKWEPD(z2qd$*ZfNq-6G#1}-X7@70w5x-(5gxvPuEl8mIxQjku%r!TRfSl%^e zDrH*cMP_PsnRtyUutdE}DJW{7Ql@HNXhBiErkPAtH%)z2CBJKUjgu80AZCmpF-t5! z?&UZ@C$a>&{>)(}Exv!~PZyrTau=_~J(c0EDK^~oi4Av6x$Um0^SK+O(68ZrK6&qy zJtDW^lO}C_(xhXi z*mBHN8IDoheO_5|X_EhQDn6y+$%(^!crZFlwl6zTNn-a}5?IidfZ z+H?K2Bt16Haee`rCRZ_Ya3-&&{dxN~Xgkh>B9-IEJGPzHQLp*yVMjhrA?O**RZGYD zbws8=)G=IW;q`~?R2-T#-c=Uf9s@5G#v1Qi%vCh~8>4hK-j}d5{d?2E<8PZZ-n$ka zr}4GYV9Jicw=BGa1|C!%-Wp`u^pEAP^GF=cCtzp#ci6x~QFwSI7G4>2XAnq{#=F|W z`_{la3AVI@i4(EvW1Z6BBuL{OZR+T1zw_oXS z5=1-FBG{3SGXUys;GKrB#+zi}y$2or*QD`&V&TONJeIe{D@gPEcSPxIyena6`ZwCZ z<1}84H`v1a3c4Ww23dF$47_#*-i4SKY?fad0*LC7&hH4=nf^@$UN)@Qzp(zaf4wcd z7SJ<2O&aeU3vaQ3mjh#s_gQPdf1JJ^cSjPGzV6nrKJ55e)e_1E76|e_ar! zj(7vC_PiK)8Ut#N?`^f`Lxz86D?8$4S$O5Z3u=EE7T#9|9;c9N|JtIk0O6J2x)A?P zgPoaQZdjzt?;Hc~JKRi6ys8lYzJi^Jmu}$key{z@wAwR&6A@Iu&8_yF4Lp5)^fK_i z!Np+u_ZR{}*T)wSn*QY(czq1Kn$~{2H$(h;6m}-w2m`O5fw#fJ<8L>Z4^6}%-C^NP zHt=w(^U7~e#P8o%z|$DS(fo6;GyPi#JYBzFJ-n?J-nYODx_S#cdCWA#lXuq@Y=WWmtX%7|JuRMEWcUv{*k)Ft|h&c-QX);ORPr*yB@RXZm*pc)EUvD?5fiL3|UBzr6|a z@6RfoIO33gFz`kqto?h!st^87C#ZgRSoM*H->2y7ca(v5kA=tI`UKVQdJ8XR;9Y3o zU50Wt^SdF$zcH{g%dfwIcd>yt$im}w5LABsExa)X-dF=K6_sN8_YClY>X(&i`ZpbT zx_&P)@IJ7{yR{+y9e|yQS7zW{X5cNc#=HAN{99;^cgqbt{v?QL(chm~c<%u(X#9Mc zg?E#IH_^a59fN(d{JstGuNCaf{8kxwR~UHTTJ`Y*@PfwAUt0BXpMiIkfmecuIn%$k z>N7!{TX&<`5iRyt~T&qwD7JB@vqLpJ8a+; z8+f@WeAB-b7u5e%TX=B;Z?1v&7UG-b$KTWIGJ~1N?^E(Pg`f$*)BWE( zgtdQtqq2%2NyEkKw$`pe(*n|S*} z{QJi8Z?S>5$iS<$`uigx{ylB=_Xz{pJ3+k_gMWs zH|C{3e1C9@fp>$2cTXG*KkTu@T2A;lu+-BgtVd3%p zNjncMncv@9czFii?FQaTtH0k9;@>i>zaL@X-C^L(vGDc*FQ|XM#=@Iy;H@|CMxlQ) z`_n_f!=Fc*AEx@nxY8^Hp03}!Afp|_XIprOp$PJ?lZCg;z`NVPyV=4^QP&kr1Zn?P zT6nh_c=y6m`!~zNvyV!H^#tw z(!jd_ot9aCx?R9Tkk0S-h_Wa*Ka2augt*PY2fX$#%qUw zr+uP>n%`-S*UAmNXAQhxT6l+n7j*sJW8vLo;MEy;>#X*irp6WYjimj%#cI!02HtbZ zj^#Pe!b=BU(DggZ!n@DFd%?h4VD(qA5dTW8{_0@^Z?}Or-oon;;@?;c?->K{B?E8D z|6%X#fh!F*31E`=uH-HEVx{H8-pada;)j~oDpg}?a0foAW2phyU z#HWByNu(uG&=9SpAT>!*qe2B+>mxN#+oDAcKBA)ez29?ZlF6{E?f3WnygvVYPjc@) zGv~~E&YYP$bNAl4b9;4ce?x&6>HPgU^ytd~Hc}Jt)b-1&2vbJ?jWh59z>9SLjxz9? zHN1Tq-gn0J#>^=8ePvv49M|w()9?-(cyoal>HIxt;CTY=(H#EF~MtdobV&4Fxy#zG8H#I!3f%k9} z``iZJ1P$+P4X+mGzuy1V054Me+a~)RzzCWKM)~hu#HjXHX5iHU?<^;Y*sHp^$H2=4 zo@&nrHM}`UpxgIW6#H_ZM{K|dS^-Ac_da4MWB5t~uNin4D%yy8q>*6A2N(c_1MT)5 zLYOk*J&N;4x9>z0`!+yN$E(or{;uJL47^yhvqA;J0{-zjsM>M<-HN4TTj`od;VqXAyx_wr#y?+0#;q@`_CIBx| z{hnpuxq+wJ-^UtWKAf-D@7yT%&4He7UtbOHQw?u|fmZ;$NcDTAfj3;kJEq~KqHwx> zrBUqjLQl7EiiY>OhW9lt26Vh~;6`?!v-Zr{Ti-gg>aGxYFpp&Jmi zKZHMuS+RHP*Q|-A`!~2zi*8)78s%^x4Nox(fy&4{u zs#Nw}W3)dvjEiL7c%%J&py6@3ONBSoz~gs9BDKFk2Hpt`k4t7MylYdP`am@cN(Y`# z@;s>WUJX6+0Y-wlj%@cIm)%r&1JT$JWU~=8Aqw6A=;?Ur8XlMKRCrGt_T@*xd(yCP zl!nLUKNVha*N*nBi-NZjdb)i#Xn0&gRN-aA`FeS`M!~xQdOF@>4Ufx^D!jvneS4$e z9W?A)r{QraQ-wDaja;|yXcW9b(9`YPq~UQnRE5_`_J1x}zr2p}NuCGlk>ZU0?>P;R zOR6foO2fYND0mMW_Web}db)jEH9Rf@tndySc==KA4jOoSG(0XPtni8r zyme9VRvLKkX?O!Pypj0vhhSTOzcmWp2du&~Od!A`R~*-26hY&41}p z@Mc3#$D5+zU992#)39$s6ud)*efb*RFb%KN9Dk$W-EEA&t2DezHM|AJ^})I*csCi> z2M=p_BQ(4g!@jLi@cwPs_l$;jxrX<=IsQh$+i8rydo{eEhWDt^-ye;Fx54P|KhW^5 z(C~U0cy3&z``ExF#meKE2Hpt`Z?uMYyE*N2g^9-X!GtJy zV~y*BbPbP7iYvSi4Ey;0hEJA}2UXtp4f{rEcwClT;r-PZkJd%OJ7A1QH)wbhHM|Fm z@p5Yvy!FO-xmd%yM#CFo;O&iqmto+o)9^AiyctG+e>4i-^+tccNyEEV!|P@Ar*4dk zk?P}2qd$F4!<(w%J#W~T9tCfwVc%agyz4Z)I}H0KM8UhwuS^>8r~#hJW7v( zcahtU84Zu0>{9Ky!mw{|6ugHFyuBJ;k%l+Zuk>uZ;0yl!kY=hUYQx)-qt91GYq`J8s1|XUbTU@Hwxb42Hpe>uTsNXZQvb^f>&hV z+Dd`{C7d)5A)fu8Qa6&l{JHM~{>FFgw0w+7yQ8s26N?>z%= zLKM6=4ZN)y-V+)gKTn1Kw({l!uiVvMU{zjqjTexjJ;3AKf6m|dt%i3do?9hC2O>eS zI1eT;14#;RO>ZaPfhrz)Pb(qfn1tJ%#`Q}b&I7+p!-Gol3*-9b;fa=&4>|373LEwC z)6}}iz&jEJ&u`!*UX6Qf5^uYPca4G94bR0Q**D(68wEV-(Y~iOymKyt_5LG6RqAMMlEA$H3d8+4sDLx6Qzt8wIc0!23eO zYtZoGjrLL=1*9?-S#CZCVt(4~^@!p_%RN`Be?ChfyElD0rtE z^)Xk&+o$2(iaJ8Dt&DZR%SBibW!yGNKdbm2=!bQp4(S=_#Y|{j05-&MIr8lRA^Rbc z(z^itvo;J^#H&Ewl&{5({iz4rg~NvUbnss)MSo9KSNn)Q2I{YAYp55V^=9V+1RQ^Z)h#8 z4TbIXt*slwp?;_``Y&~geNW7s)9ia(#fet&NUQsx?!D0{?h_7&{JJ51Qg_&w-1UfS zTf*+dD^Ig`C)Flfwc{+bo(;)cvNrzEed=}3zROzt&uK`SJw0<=_QaSGuIiZLw6jZs z#c6#@ii%oWn-i@YJB9m{WK_pEp(hshZs=QNS=(F?)y25oiXYI)J#Ect2@?`ii>=j3 zR&hlr%jGIb%WQ4k7PC9HDZ4q&8qg{0b!%HpUFN<75lXGHssJW(>DiLr9b9#=X(51v zt*zmrr9)>SrX<_lt;7qx-7(>8hyYT20>Rn_e{(EDRo{gdrZ(Bd4gT_A^}^kWb51|m zC*h(sJ5C8_uHCUMrpfDAGVpl!rO2ah6M(kGI8dK`g$xl8x%B=joY9o_N*%(&^xj`? zi&+-jod5%!@E0gpf|D@k^Y(;eUU6C)+>iRIJCzbTYh|abH)C5?d2x!C`>S2ux1hOI z$8_I#q)bf-E>$;csE-kNcciP-Fc6TS-8mvqDebQAM zx`*phb`1S!Ktg*xBQJNt#bvSE5?03{*KCn%yp^@ls!Kr;;;qz6;H{o5u%JAq`-ad4 z4?2Qsf1RuQu8LPZr4Rd(H*9c)?)FevA-V>b6jRryDW$qM>R6Z*f238k(Y|pjnnL$g zY%Jb*uRD3gw*!)!65mRy|G0kt34g^M{(?_D^$R>RKk+qx8dvj)Z~t@k1-m@^U-Q)O z^3}W+SN{iJ#ozq<_j-KkzT&16WiOvV^Zv_s=%&zBIX=6`Reox9w+GL3jp<{RCsxOl z;(V$My1UoB<0)MqEdAK?VQh6bbfxdauXwd)XGOT*&TvzoozJZ}aXfKZa?70hf;;^6 z*ZC*qd0M{qw0z}jX^pF2=`UFBX<6!N{+I8=*!}POO27BjxB8bQ&rK}Is-HQ>Uq8g} zpXw>N)l;yILEd7&Z_=lzWW>R*PHG6NtYC-u86HKotgZc zyL0mK5uIl~UZ47%{c+Mq{V-5Xc5%2G>9XHE&%QC15$Kyf$?I~c;;9UT4xeH*Z}EVs zx&~d=OZPUG2UDN0>g(#!nyYQL=8SoX?!m%XTjuy~osAWj7u@0-=)VA~6#DwjUA(wp(IppNIA`ACxl3~RQOgTwt0Wh4 zk>&vfg$r()J!|m=(C|Stz)3k{pnu>+{-Fbh^*^aI(vh7IBRQ%aJ|G+}YxL{-lSnrQix_yp(ee zehU6_C^Cxi1HkX$4G{c8v0WykR-~e)eplh(jQb|_!Tme z7`|NvaAY`Wq`ysuxsF+im1^;~z9Q;(H}G$f;atd4FcbW4!~S<tWj!dtZWLjk z^^6Qxif~%T>qEo^Wcm5|@DzNFm-cj(dG?V!O}`7v_+H)3bbXVj3?e2$#Gv*X7SZWy`_7%bQ<+B&hpyHBw zw=ABK-~QF#`MLOP#5{y&&&L|V4n&7EA}@TFB9CIV=qysrou55x2D;{x5;2!q3kqi= z7c6;gAX12Uq0<45A4_TbK(APkS>-irvG_pBkip_Rk64Ad5UcOcTRgikJ6|`HA4%z; zV}dN2ciZe4ISUr#&zQZ?unJi?KAkZyk5ZL2iiz?qDTu5-zo1=Fm3h{JTaadHHj;?1 z@^&zSrCyYsHyiHhsAU!>l41uW8VoQ|nF1^uL*$%WqSzyaKWR}1y&tzpshU;^i{@u9 z!WR-uQJcY$#iDu~k@2kstv2$|Ru|2U8a1obYF1UHtqKp~0W?Y1CEEnJd4fAf9 zBlXP^{dkfNA9y&aFru9E^4cAqJ7do5#WPrlDAvjLi50JB+?t)g1ZolNIY~(?yYWp4 zv`yx?czMBW-HKWH3vL0n>HIeDB9X4{EVF-dQ-yDMf=Bn9kfQ0~yhVqyc;5WkST5UK zquS}m{*(PibaHaY66(3=%(tk{5i#ig1aWvFFT2sGYe;kcfvLyqD@6+WZj7tCUM>`P zU8G3qyySVc;&0(#^FQm_j7js?$rSss-yugUP=Rt~QH z80lS9j_9ph=ixy9!6*@iLDx;_;m~9nS}WxCViYL_N|>=#dXF0Qw8?SRcgWQQ?g+ z@cKcJ3%Mfdk%k(0oCB=zcv-3N4!}6wKCb-}$-cc%VwwOpQY;Fm@OYjmJU;i+@$Q3w z*YS#|NBWI{*F(c&dr)}1*3|J%K)~MtiWJ_Hh|u-8#z>`7!cpm6Y_w-KMAnlcr8m%M z&x4^vJ=RBWY}8{o!NB9%2yEku6rRh#3m|b{C=riGg~!WwCg(XznuKfFT!$5V%D6Sl zcA!Lj=TawS!ffQL-`nT7Kw`cmrB?+50NF;wtB`rHJmI|sAW5M|9Uk}N7Phvg=ESBBiVeF`kHolp z;$Fx$*Y22oyt|k6tt;#bCzdt+@a(Yo^l{q~9xOl0eP;Sq(1A4ddb=ve(<9jlxq0Jn zTLSOiRkpT{`My=p5BHyNk2SS-=hV;L$fw#}*xQqOrMrC1+_|YqaiuTTU-{hljccl! zJiyw`TbrqQ_B{!Y#8)MHY7_bJp=vDd9Vc(ddijUL4OD`O3H#y?CP4MZPFcTB2(NJ` zZCDdpT^|}%zjo00)yd(R;l`4TXZwxnpXN?+Czg1TsKgF?*WO!}WUbv?+sP_@$X_-d zsB0eh2$wy=HP;TWSu0G$@-U8j!fVEdOV$j) zvkASd%EvJS;b<3_TFEqNX#;dF`an|PY zPKa8&tL!T4McWe6*Ky};%jO3T6gTuOYv{TyzBb8fOtfmA^YbP=?#$v=;g%n;+GXmC zF~tpC%Nhp5ka(=d@_Le0zt7(YZ*LK5yRz>70Sb@A03y+9Oi~ceef%w=Hh7;M9*IB5 ziksLe>lq6LsJ0n}h$@sdVRypZjOKXWNZ*}+W7u1ACo&`}ZcoQs&LbV=I&nms$!Un~ zk(>$qc-+knyOzy8+(2w(7r!szAklGaz0t01h|NZ93>*d|+-$eD#UghnR7DIVckYSG za{%rB9^TbU?dK{_Onuuf?B_{cYP((i*Hpda=@E~%x|>;|PI!o1zslGlwtY`L@=qNZ zpL%M1>ObOAcf?KiF1N>Jl%(Z2jg^+t?)crj$3DMPR(wpAknE0W%5Y--X*)4>-ljAs z=0&)RO}&mSa(*W#0CqrpM|(o5OqJqX9(YP>>?x^#?czQUX`z0wQ|f@E>3o25&eN{= zzE-izJtC>h)j71m%Lh@eF4hKbmFtwy78?(b5QE1muEa7|l9G24^5k}TMzJfl%oV5P z@j{-^E>A0VS-8inwl?5VZ$;=(YpeV0AlvEpam}%!zRyHuloU;0I4pa4=JJeic1c=z zVM$x6)>fv%r4ZAg!J&oxGj)1!SWz1^9$iwYp3oPyq&nc$e3b&7yo9^F)#zyZv2yYJK>H9ONsx7!)t=|8kH92AW`>#KMTRQi>L*Fm3+ zjSi~WvCXAGe`6QX7fud;wcPP|3Rv0N3KX^=o>nAvKK(b%XGo>JEn!~v^h4tg3@hrN zIWp~{!nDD_eS*&kpE#EKZI^#`b&VNjg|nAutX)&$b;r~62JW`IPvfDIyCCc}47I62_*XRUoPn9af;ui#}BZUw19bOudfQ!7`+W-N=0G`Z*}& zfmS{wOXDMx)Hya(#>80R%&civyvsT{jpOwH#OD}Kr*9uuIV?EQRhZVRIPI*G0|V1~ zRHgBX<%uF>|HS&#ok{;Z-L?80%N>Wvl7-x5)2Er~V@om^O5?79JMVP6`_$BDgolIs z;)G|9#DCT>w0eDAWz+Vz7Rm>?;mkEDiK%6F@l(HCQ#LwWRG#r*x7ct|-q2yyX<7H# zFLG2Hihle+*y~h@%ayvAr~)y3VC|r*@~(UE-hQ_937wPLwN)v|M)w~ywjm8x|01^w z{bsgkvn30I&M~_P#mVe3wj_vF(<4zUsJFk3hs`e3SzY|$hQ8I=O_^^6QDfrzMhwPH z8R0aTowe2u7p0E1s=d&?DzES*Pxsz=0~@E=t6dfZ(^wwXJTG;4t%LFNoM#g9R*mja zx7xyE^fk#<$@jUF$GG z@Cx6eB{`7#`kbA6iO*U*dl4S4Et@@S$znd7%gdgZKRdURwdm$~1qEbOL;>y_GTaX1 zr1$w~fWU<{zDbkENZ|8-aawA>Ctv@~Z@)e*ob=i?!@v9FuiY+MI4Ez$UCqBL98&$a zuMckZ-*h-{?>ET}XMHd~^U|9e{&4t$z+(@5IN}%HMfaY5-jf5?UUyc^)`uV6v0&@y zr+%5~Z|X7T@f$wy{^PrbGtTTZ`O~i+>pS}WYaTj%+xfxU|CxU=evy{3PHysietxKQ`9E@wfAsp~^qX%Vwf1K{ z?#;aF+{^xX#Up=tr|N-{uFnoTr|N;LSMFVN=@Y*joqk~D`(w6k+4ql(SN7cbx7+TW z^XP`n&u9G0QyQQ1)z7n6WUd;qq~X4gA4rHD^~ATocqwr7c;y@KclmhvDa$7=o%X== z&o_E!j`+9dv{x4X;rvBUw%oOHX;H6>(i1MtPJDAfx##huuJ3>G%7Kq#`ak;d)(bXn z2(3<=bm9GvzY~A$hZ?t6*L?i=qK-mCf2ZS(Ivv>~l@%44^@G4H1IxcrPM9=p%zIVHc{ z_o+PCD%|r>=T@?50gO_W9XwTTgU8e`3YP@=ix?pE2R#$z8vEwtDo>Ck*J{`BCo$ z?>fD020~aDW*zIxw^~Z#Klqh@@%B79{_m(n&{x|2!Nd=2)1Wxj!xnS!j z&*VoWPmJ#*PYjasgUDCni+pAGL|)B<5c4}wC)A~w@sx|S(q>j+*CgyfyuVDIa-l;9 zfCTMvADDskBr^w6i z#0x*L0zo2Q*wCdD_CknrUfcisY$(rsU~^^Ci#n4VFChNv3a?BJL#LW(ZZsw=@={d`lk+ z-%4Nk5LW&XzLoww1MyvX;)4(+c>0Rn8RO}zp^~TlLCG^84$st~T~|q-d0r=Z`ij44 zsN=)2QS!w3ljLa&$sXk#DYHj9Jk!(WH8`GBb{YbrefAZCb;{0;0Tik1Y(LCT`5^&( z*K@D~VaO3Y^Y1Kq=AR;Y<}cb6^ywebkAY|YD4s}5pPVOo=Fee+_{?*qRa;S8}@?`GvlP# zfo3cxZ{g-o2TjJ|cGO968N&w3xY_yH&SWP(*_||9QjgmE1;gb$)= zD1ZEzoWA)nIsIhH)s!+>V`BDagsFj2EL+Fq;i3qIZX-J5Lt2+0pK?rHkjza4Obl*b!9>vz)20oG6Q# zud1cvR_#@=$GX6nwD}V)s>4LiA9I6J>@Xd(pb)c|^JEc3y^HpMs$&Nt%2H6Mlx+%~�Vi=PfjkZ5&llU!dk}cANp)ev%p$-potM?b1HjKqJ$WS(*F{3& z>^RnvMgh#!0J&z@&PG`g%Zcs3D{^4WgMr^GVsPC?gng%6y6yIUO(UshZ6Dl zyH(+(A)wp02{PuRNa6K>9{GS2a4i{L6A+Kr8Vc__FgjihWX;$VDZH=1kPk?~3e7(L zWT%XFTm?qQD@6dRZA3lN7%=1m41nsO#OqDkho8i4cxM}Un}ElANQxAm&%isP*~e=r z>e0ShS4aEaLYVQ26y7$(lMhHiUtDnY1yB1n)$qI; z9>4jn;|)c-;I*G3h4(p>$Ooh#A9ySW?K>5lvXA$-bi4rY=x0R=?@tEaGT^E90=5nB zd87UDK0L246)C)(M*AxT2-`mGI~|*{ufo9NJ7kL$nABtNAp`F%;7vh1@%Xzz;a!0f zTrV#LXbNql?7IwlTxMMRJfNWp$oLbJq6lQK7s z3(-z>ylLnxhRQTND7<{=>3B7$goh!geSM@J@unDfrNHAe9YqT78Ut?ve$>=MiFjvY zqaN{IMElU~<2L~MAzqQfYk;0^pBt5$4<+KAi%sGE#=!dmcyB2%smEZYfwv5Js}N7T z{@4`W6JR>nht4sQeVd@iGy!a+6Tn-BBk_1UOW~CmcwYc-4djZbM_L7je1HMaVw{u; zZveuSxv_1+rrWmyKQ<{-r1-lLq3ea9$Ma2*(p!xP@&PG0ihP+5%fWtzGKOd4{2(6h zfspE>sivMS!$yh~F{tOH zbZp~(NTs#XmHLdUO3c~Dd~Ci^z^R0op)O`aCx|e_!;@h@0&UA{I3TUaGtCeV-RI%FnuFTUF=%TdQ`e%1RZUiHWrgDzfsBaZ$#9eK8v^N00EI&U)A+GK%!AOt9Nu`|Pj@H$$h_|% zhpb_kYu?qJFkGzvgZB+ywrNZw=D53$mtzp2;Z7o_+4bChuGJ+K2HnNflnb*rL5p@@DzJkSl5& z?X5bvo3qp5k)<{wYhUp7Xj_ZOov_-n5Q)~0=G1W#JI*I}XGW_xarjz|eiCT>knEUc zIXO=?;iOnv=ZZhiDhStKSLb^1Tx(Le{>nPn>a*d8oQ6bqOk-t;m}t3lL+`7rdSAmA zDGd)-dzCx=SVDsJL zwB8p#es5JnA|iHoLW=pFva;}22E%H)b(RHpkDQNb#EG>qL!9qzQ?A=egLgjAAGj0J z-GriLBXh19m~-{eoUB3C@R(saV@IO%LjOVc3XH7tT=kapEPEA90_^8}D!wZ?e#*dVmltU2VHR$mHx`ni+Qf?8XD&(;$j zSzfrNe{6ViYQH2@k(LJv9q&%v6UX+IiS`vlfiuukU`B2l^h&&i6|Lc5hh|nFo7w9P z-KsO|GWN;2|6}6AX`$R%wGG|yPD{Kv`S2>zO@p#N_^z;_pOYtjgB)Ls36Ja^E*XjV zx%TR0ywCGBRp9poS#&7fYRfphG$oRy=6#8_hsfc{?8>;%6;4d?noN70bZmnkcSgz% zZsd6Kf0Kq(#uPT>yW=sO1%>_b&9PSDOFou2p@b8>QLK`M#o4`Ad_FL{7Yy%TnL1g_ zOpddruSa-ZTzX=0c3N@TysWWS53s$e8uGW}?SaG_2JK+{mZG(rZ27k*FW7?j=KL3*B9LXVNqc6p!L`OV##06c;u{YonPGixBOns zA9Wj4{fl_thkv^8-Dlt4G3>6`7wShgX1v(*q3fp~|3&A$Ik(UDPWAlz(Gi=z>v2=J z`o-@a{FkfGthD{ZzS+EI@~TV61q#ov$$$9WKVC86yR_Ad2G4(F(#yR+c&PJ<{iWMl zuDRjTO^eQbf8T=NT(ay2dtT1w@6TORb=6mYxboAB?>x5S=$M2)v+f+<-5&H=denByX5X(@5O8{d+A@{PwJYFT>5$ctKQi+bHl$scz){9x4oAy{Kvmv9lhl9 zzy4EWy*_Mlm0SM{YhO*pwYH-Fe*W+&)(!Z5M)Kk!-i0gt zjq+mtS;Vh`;f0FHm(Uj*K;VyJE=xl79FM6H~Cx~#e^`!Kl6Lwo~$S`Z3^GUCe?Zc6Gv7VLq zLxtQc<|Kg?#QZPQ+CRfHjqqxj|7nn=;491fWcUUVKHKUk^}E216x;zkTjtM}oPrsS z=|=e~rM(b~@~lEda|CPQc4WjkredxP@}!((%bScMEpJGIaI3Iw zE~%J10-Gr3y%5eTZA&W|krwymNQ|;24sLOY`JjyFy=*m4G+pv-I1%jUJq+8A9f*Fm zouZ0+7Ph<@$ooXfe%vl-%a^=bBa5bxr;WoT&wTHcJoDKhdFImtex*L|jjYr7ddV}- z1CnPxqz?X^bh0Jyj8kD&08&!JTb~8Pu(q&r=28Q-b-PV;(Sm=9qf@l z6!vfj686aY626u841la_XQ3kAgCI}8-7Vvp{2|E`;~B}f*`wE^EW5~8+Q}@t@*x-~ z9UFP#PmsJcucJR@q`;9j3;QLeuwVL|b*9>kXdALzy@@Z494dKYOqV=GGbK-qt&(S+ zuSuSE{#}dzR`Se;WXrBq)P>iH6Y;uF^wj$OIPr*IEuOePv2fB8DF2KLPwA$hq2^oFenCFS3K(> ziSr0N<#N`YKB+?8`fQ)1hK2DK7cRhxfX?(3HSy#}6y*wnV&FNShQeC;jGymWfH+muZ4}&kf>Qv9cSIB!eQo=sv}O`I%#<}=Uz4^Pr{O0V2@CW zv?`m_EX=+ocftIhsuQIZ-6&4%!`wv7rkY)dRq6Dm(B^e#u9Bm3OPh|Wq@PfWoVA|q z$&e@2`$_8NT(h5;9F~JwQ8&wZZ!>bud10nhWq;C?ut<}?R1N?5%r8Sr<-ijo`T~5i zsx<}WbCtf$_l{0vU$aqR3FX{*v-oN@r=iZ{ntijPtW&5Om}nS3*}!zIXxY!s{V5o> zLA~jnR6eI6&sd5zo@Zc5$DhJ8)fFE74R>(j@$6e>Y0r?_X4O$+R^jpjoUXHSPFl`T zbtnJjbhKM>(ZK#)(bE|C?&pPsBn%INI2MwRcY?;-jLvvK5yvZ2&n?sNz;T20FKpxk z*hu`&B*(Rp*k})BO!q1_9WQ`zUu=pL-iwIP@%8|Zdc;uR^ps|~z-;PD!W^`Xy2<6Jh~FM|=_{Ub#RZ;*jk z54?OR5s$yem3`|CKaWK^oN{fX@XWb)=^p2Ljd-VHQ+V?YJl^BtHKrnkHy3*315z+o z!{hIAg~xYJ_42CU%`%zLBfkuKI^HJW(f_oMmx>DSdIPT;!t{qC>XD{`As=7>RHNbH zvc3(Ea}{;_{74kZfA2$2$9qmIFWWz5w71T{8wCOH*D0bN>1hM+xQ3Soxx(86Mz=2( zoe%R-r0|{xLp~q{gVBilf**;k4>rn}?r|_Wo(Fh0AYKvmNRNUcA7B79O~Yeck8 z4!Dk&k8lsfD^hr;AYR8?0X%hnoC{@zcLa=%7e+eXUs9y-{tkwGKnnH)Zzgz_mp_#$ zqkTPG9r4OB;3y1;+xXL=r{nqM?>FL|FZGD`4Q$cvdl+~;e-tU~FQBC34cG8^Z-O%7 zg|X>)&j4>4;uI;oI}xGdjRoEb#L>PBrHptv*mOKMI&t1#Q>5_tn^VUdg-(j|h=`XV zWyDLzrsF-A*nZCpB7wo9s>1*SAkK|eF2zuiTz2nfE6hV*cW$YCBc-m=`vvMvm4PDSRmeQfMws=1F44lv zWop`!nDpcqduQkH&R)%Z${0Fqs1x(kYnbkp7Y2io59dBDkR`f zKs>(HR0{zfLvoQfDRA^Fqv=C%vVP+F*4DLEnAB0TJ-GAt{B{*r3e5|D)Q*Yoq$S~5 zs5@nM($1zvw^e^2_|7}8cedVqIKKO?yt_XdkfaQQ^+U2T7s~AlLVq>RUp#KMZ*-0S zHJ2Q1jNki9RAIZc+*eTo<=EPoxX>t1Z_RH10ep^amj@FD_Ty7+cl%oEycO?y z@T~uxci-x~|DZSYuOPwxeWXkCC*J*k^MyWDVJv!vvWEV3my#oJSP4rV;YTW5;e-#r zA(d$v^w&gzo2BzG_Od11SEwzn+X^C0H)+{=j&R#G4oTJP>r zkG1^X>XVJ3^tpRZc_hJd2Wkq|FF$5=3s~<~&ivR@fG=6y?#)DZwbV1Y(wcr~(v6<| z6S-2{umk>4o=H=D`$vh;c7y^`efYH0{>trgG*2PyK2y&OWSB82Y8p_n3EKYioh{($^E-`rr7PU$GBi z?!;bCeb`s=ns+@uo03r~LInu5wqors5o$Rk+AJ(S;+wfv=mks1dII>~*8^Uhh5T5YKcnH%PdV72ud;`NMvYXpxdc!a{1`-06vtK`(OG*9;pcMlp6bI$MGtLJb%!5&-h>9l$Qzj7rAeP$7R zMKM!M%O9%z!HO@wU6KZjNn$SEne}VyHjn& z@x~`ly#CaR9-nOaeCM)P=FE+scS_-#t;-UY_u8^7=cN-nuN@mVE`IK5^Ag^HEN4!y zoR>m8`j+)7To7D#O5uV)?W@P{-g5qie+_$1m0Y(kVYll??4w8if0m`{b-Q+t2ZdU3 z#GTaRBa9?}-1z$80YCrHeR#l(4}0u9yz%qG3ok3Y#rN5Tmw$Fk+Tj6b9nKHDKA_j@ z`9b*h?p^1HHxGTa-E!TYAF*AIFI)k95U3Rc&K8hU!_oJc&pR%=|H9&!*fMnam_^I6 zB3_IY3Hn&U^HYo!Xl+!(Sb=jj>?^}cp%`SgcuTkVYB9*{@-||SdC$f`!B1`01)F#A z>w6z&A~m!^8|;b=zM2ibQZZU=$Nak>zN;Bp>nEF0Q|GA%)JA`4#g{c({MJq{*7Jri zR29UR__kZt@6(_Sc{898T`i)K(o2w?-q79t(DQLEVQ)vgp5)))5B(-suv0`;?%Y|IT!WZD z1PfjjG3#G>rO927nAP{=%x1EpwQIwPp%Q=deZj!r?9xYkZ>5%w@K3r|j5kEYmr?x> z1PjJ_*0;8fA2&8OfbiA9f-gM5*4A&oIDSgYalapEL%A~aB}0eC_%HV#Kd0q$|D>lp zb=zyUVEk-(Hi%CdHdXF?4%Te(x4;?%*Q?;O_cK@|gZ^iNfj`Jrxx820N#1;D{h?Ny05)>X5p!n%x_-?NfK6<=bK zGxD~a`rE|%t78jbZPf*jWTLs0HZ4Jmc`LhiVr&R=dqsQ0MM?-Cn#?5 zRZXT{h8$8Q;Ydu_Sog>4o;c z&E;MeTIEUQJorELYszd%SK}5$1O;yvMcn0WL28J6tcKF|OT#_1JmQcm&;C zLU5L27rYD|cGJt6jRLc(VW@t=*3KRi0&_0h47qvL8vyQ+%@j*clC zZ55BUNA5X(_tLxbvby5Cj;Vb)Paca0Czja7@iCYR8Slch#ds`lTO4m=-R}5=l8oZ` z_>#1N@v*(*v7kG$<|ZTTn(OU$>**8NLUn$Y4cU1V{q10jdszAqis5FbOOCLI-Xt|9Ve}> zF3OtnrQ^Z>(>~`A`kbHcaWIDe5A-!wVpj$FiLie^x((55 zi9QSAKLra;c!2rs3G_M$|MmWY@7Ya#`@IP7jz4}rIwRi#&-Cq+@+#)Ww`2tirh0IV zdj0fiag*}=Ek9?t{D2C6bw4ijKCJxqhmTzV_{ty34F;y!GiUpzUD~f`=4^j+mZ!X- zbZP|>xB6!auqW1Ef4vhFSl8d+1oG}L$n)GZe{THDRzLc`k$XJneBc`Mbn9mop>M06 zSm=&@`Pkcs$`_8`a6Bp0>Th1)>9^fS3;i%k;8vx11h6vltpnHJ=-4cb+}-5}%ruNV z118pFd8!*KI+)nBURfnf9D3~fYc(UM9lB{Y%tRmEAANMq0uSuyo#s)_x_+{gt5dog z-#Vlj0Y4=R6a4VgwZc!s94~b=;QAYyjyX9-^-<_o(ns+-Tg!{e-nKVj9qG3YG_5Z$ zI&a+ZSikU5`Sw!!D74z&k{5)3;iH>wg6&~{%PkBGejW2>5E`smW}V%&h3gS zMFHU-!Z4YDxhY@6n08FKL!rz)^zB!oEgkQRmW0H@0@;pGMS45xP(f|JX>UV=Bl|}4 zO!+YZh_)r#Px+yn=D{@4f}A02^{!U``k?1=(LX-nuj8qS)0u+^hOn^Bp+Q_mh#`y; z=R_A*9CbYTF@)i|0z+7x7^TDzhUDm7IcSON7%_wqQVwApnbZ*0qz0pPK14f17!y_p z(Y!Kvy(hd9Q4v}wK1q^bVP$^2#)Hq2;HQ2Ht^u)_J+2A1lRLy+ zHh00|irkX*2@$eQJ1nadt}hP-t~UII#j(GSarXZ1K^6F+Hr}s!3~$ z2I7UThDi-#UHbUgljF9CG48E ze$GIzGNiU)?7rmiF|1b)cmx2uk1s?dPt98LeP(NG)*dWmAKFn<)iAbcA+#WOLhg0V zcpYMko%%Uneh>xjo_9{3XZ6$g0t1iRTeJF{{UScafX4xJhx6@*A^_k61Mqz&IlSDH z%VP#yoi^{#^z50L!PLKZbaJ=QYTV6vuv;8_yc%;m@rW-Rx+{vOi;A((VKwN zCfb_-l|&rw1av5eJ9g;8X+`eDug*#T5i5)$j!Ck9M7d+*DNZ{T)lim}f~%T=*(sB= zPwhTxMAD6kOYbWw%TB>rf%;eFa<3B~jL16EHMA0Kse7JkFX!Z)`Qq)OExBG?j&Ebc z$MIdD<7`jyHg0$*y*4|=$&T}zwp50|wEYCpyNDmNat#X@<#@Ck!+ z`k$A6VaCA07Z1I3#ASgiMvoace!?}Glc!ua?PoXsJUb_M&fJ^l-%_w>$*s$8TX9F| z&bwBZtX=o3^=0=xSpLu>k5*P~+FbqHZBN!b{kvy>zw^208yfe#)b#4UKkfhX8-IQK zo%h~v{`)`v`Qb-LKRx!@7hfO$?)x8XNk2&H1?mE71|0+0z3|t??jjGi-Hg9u_Az;| z?H`;!d9Zsm_iFBPtjjSRdg0Ke*AKmZ=z>2S1k?OO^AE@Hhl60~99!;e$=HlR0Hz5E zL;PbD1!Q?3Q2``WoJ1ldRD_NcGO3fu(PC1j4|s4tUfh?DwE~`4avsJ7z<_Y%?e|#3 zLBKudV+WI5w;*6Ql@uo zWE$kh9EIJ8XIi0yJ@ajo!4Be6-`SWSbzvW(e2Ddl!~q<^Goi=f5wv{Z5fdOFWZ)5p z2*hI#VjOrMMOMJ!1%|*PCUg)FnUhBHh-MlmKj=DXsV^`@e&ne`UFIijpltyJh|eR# zAlMG{*N(+F8=HxbBqC0wQ#iIr3tS&?pi;yzj?BaI@d!K|Ln2=B7KnTZ zdlL3O>=E{bJdETYdB{8zVe?QN0*@nguz`0p+jS66U8IG?A;C#3q!+r5jJo6mmcSP& zsLTAUHXNBBbs3L8A2{gI7U+UP+=(J!FViwCF?^DTOehMBkYK4poRA~)SuV>L>q@j@ zg%r=-$h#7Kcs$2=AL7A-TsY~lk#M98oYY0w;dx?0Cen&@
          hMLcmx)X|QxLtsg4 z;zKHMg)a0(9!|dP_DQ=OI~AtL!?B%tGaqS(!lF&Yvmvti91@#tjbtH2oMi=^xI`Wq z2RV30XC!zeqz>XOp+lZ}&`G2mn~?G7$oTkL4%o$#TP{(PumndJ4I&Bz;AI3K$KoFm&}AI>M3ENp zA^|ZREJr5f)F-SE2%fsc5W2*4@^DAz%oc>nZ~h0=!tmRAnYQnV;dM@yAV(& zbR1jBi+Ex(Z?pzAhT2vv_*jgJII^*UP$^^>Pd)IlP@oQlLL_!jL?ra6OA&TVBXpUJ zx=aU|z+hfvsVDOlL1IwgY)Itfg`i^-^Wnc^2jd)@nMCG?e5gZwVKW4 z{`}GcmqgCfD`tIqniJ!mlyOH<4b8&8P=YpIC z)7~EY>0MoCZ=BJz>@RPYy*=gZZ|nQK4~O(W#af^H)eAY_@nKiy?<1eGllo4*Gl} zsGaye??QRL1Q2aoKNH`lriK%~fovO{{QVow$Z99P-+KjHC#V3MOU&{TL9yfezB>>OfF`hL$l*qPBGSu_5ipTYo-y-Ho`eZc$N`1{XN@|=NaKSMtH6fHvM&zb-An$D)MUT zm~5{p;Q2mwiy@yS&qvPJ=KI$Jq}MHHi<9SMVC72{zc58&T z$2yThhlYSSC$%eh%9+geV+RuFY=*=4#X-H3%$um>sUMa+({X5KJn`5slBbWjMjrXD z;Lnykv7eT_5Bwg<_W=Ka&&IM<lo)%8p#{uh#Gz9o`R#Br`I%4tGVDO?Ce-(5 zh((@t$Fh)TT4Ir>k9o?G_uB_J=`aG*2ANczXAN?lAj5l*A2`!7yLHK`@sKB^7-KZCiz(K zVoZcS{qw1eXWb6w*d*=0Sn{-gtQLQj7UTzTP07wdCi&KKZ)lIQ!HECb`4!8332{lViP_&C_r>D>PP z&Oa~G3(R;^gP$pyF>CH@yns%wAiHqhVsoJe^?veCsCRh5TIq_{yZ;l=lN3*ab6$;( z@^Urv>!2W#BX$s@`H3eZVFXc!B>eVKlq8Ob+R>c)Q{QKDtnK&>C%G1c?raT4Em{%b zC4Yix>sOd>;TvMpt%H6dt(0Q{3HTA^UC{mkDY3i-+|>T1pUGp}`3d0FvJ>Wl2q!Nc zK`Yq+ou;^ScJ|GN^L4+Nijme=Q2G&;NpOm=AU9Vw_Zf?`bMm>~fFoe$!WI?X_Msw$ zNn?Lx-2+2>vd4cs?I0c7Osp>u&~Z5x-8kn=5UU78ZZK_Ug{Bjs;Y3n1EfPA;m%?xt zGpbFdn%RzK<;;?{m=Y{?pjl~VuN=bLs8KUNS;>THFX@j0MN*3hB^>h8P@0-qY&ygN zFeP+IJG7a-Tp$9;f5acoA`4CGzg&F- z*9P&tH`h+r%4&?6sUB&Yxv&~6-W z!A5&1V|cHD$Lk~Q=Xo36O9tKw4KGf^yB^?BZ7atFDZ@dKvTrK%bo;^@9^IqtyUf7j zb=s*8R0q6a2Ht%d9&arvyuP@8((TKYG6hLJQZML{4=@0#(C~2Eqzx~@z~eP#B>#y= zWRL~0k+y1hoe@^{Jz$h~g_JQ3N!hpFC~uvH$J;atZ@GaNf-I8%78`hbG(4|{w+6iK zzx$*N2SLidVuZ*CL@Zvg)bNK+x8wg&Uhr~4AnMLc+}DHzR>XW^*44H?d1cc<8KE=3a=J=Iv#%j z@HYd`-|pBbDUx0JafH~ZW>-sC@Z`_f!E914S@m$CiNJ6S@Hn}KzgoY1dRnA`$U#E4V%Jy%V^K#=zJ6g(<%PXMtd&r-`@ZA z(eR!%@E!&p+q)u#x81ll$v3)7LmkhjTfG2MU ziImhMHG&}@U;y--h6lC{FW<@TvPuce=cpdL3@P3XsMGEgDMCf=cG(6tgRCoi8`k0Uqxqb&2^%2&}%UhWWuZw{< z1$b%7IH|{Al7UyD;RU50%YQe@rDPdauLIsp@bupm*pz)Y8F)3o zU*;0#BW9<21YjMtP4WNA}-dqr4vgZzgb9-m5gcrwqKlC#0Y@Qwpd`7cw$TLIte?QbhC zb|dwtT#tvg2C$Jl=;VEfqyMhOMj7q>nSs{>7l(X)tw^z12A=-{+}lPwB_1D%D7*@Z zrs9Fl|2H=GdRzw-8x1sl56uo%>>VO9) z2Lyt%Q{}zU(0e$Fo{jTW$9s>Jri=os@Xj#xcu^WbFT>P3GqT<|Q;!#=5%4;jdg5j` zbR{YK&NlUUQ5pengsFE{WWA}T9xqBG;AKla{%#<>=X0J7i2!y?!VMo95=R^a^-Xim z4;gHO{=Mw4l-}?tdeta6ah2YbD0+_>c==KEere#XilX-iWQzZ`bK+s><*Gv9NEtWI zY2dMqdbe?cQL=ZTr>`$H1s6-`O2m0YMWy!*B2`%h0PqTA*#d}QJMdu3ojd=(TVKjQ zBx8t=^waB0`PimF&b^g>)-}?)ARh<3f=j?7a zVY6rw!x9MSZj2CaO1NXOW|2#{DM4I;YGDI}M2V09LMYS_E!m{{FGMSWYMaChf!Dl+ zcnersHY!FCUqP*Cr3KnrywCz##S7&3{mz-$oIP38_x=Aq|M&kSXU{V;&wS^ZXD;V5 zb7p+)k(F2!TIVzHgJOLYZn@*s0+VeA8pNJ-;H&l0*1^~UN(OBaT4G5MiLWU=fzf0O z*~=f=izJ`yH>f5-Z%xn!wCu8%-=Dl;m3PN|dsk+4hjItw5!EwU%Xsgs<6!F{xX-jAW9$TUHwYdiXQdsig_wd1B#D-7yj4Q$CfVdXKHwa(q zi;a{b_+-joZ*LzFG~$Ro=crm>i*vRv%mGte=Q_}^%?D;%c4=#7Q#`rk0W(D~cEz&O zT3hUc;#VaP8K)1%iUs4eYljcGxzV>Lt}UB^`}NxFnj5fgiNE3oZObhKe%53glz_!x zh~)W5tN3mC)>WZAu-deq?i`(V=Qq%)w52d#`Bd~q3P3+y& z=(H;HJ)T}1Y8y>>Jl)0|DtmgF|yQ5G`Xl|8Qt?AIDz$^_q{i|y%98iQQ2 zJo@8H)-8HR6Edf3w*B|vM}*Nfe8^)TTUp8MywO2?MS7hJAB%1smR$NGb1JL!AeS)y z?CdgsL)Z%`$Y66V{Fc6$HugpC00v2ZyNEE)wPL$J#~x;Ank(>GN?FMudqe9?cRH#* z><+(Yk{ep*xzi2D-;!EeX972f4Es_45T2R@H>CHt4%!T%&n{_b9dn{Jw>j)ZYTNv6 zB}duTAv?2cYwJ90L+CQ1E^w1q(e6uJ<;SjL*$_SG3gx|;Alhk5P((!<$U@-pE^O#y zUxb3p2(#g-c0e2SR}Rth>~SESFWd|@-xAs<>pP= zILg2NB=(h);rqU550$J;8#W^>)&pY?C$P}2o!H%wap~u|TXaQtJ3kcS;u`Tm2g|I@#?JZYpHxsTfJzJ`?yn|16GR!v2Sy^ zQzq#AWE|y&U?YzCQiVR!{R4P6VG*&Tj#JD?V7KP(1v_I=Gj%B*L>fDO;-nkB<8r;z z{WJX2#?Kr-<7VNniQn-zj*AtBPeyX5c`=J4SiBH>CU_Sw2`;#{)3$mp1LI;TbahRe zG%?q|Wa3!=d3*vhvcqa zwQ5FST3O-j;+1*x7frsqu&XP3SulH4L0Q3!(Ki(Z#!s8QXz@);?<@%{nK<>vktGX; z2lH;cv1s_MBd@t(Kw#{G+?iu1&!0GFa#`8*;bVuE%wIipNLSbB;;ECTtXQx(uwp@A zaNeprhnL(kIXHdJHLF%ET|M~5vL%6~cNeWF8hg{E>_s;gjaqW|&9iP@?O!zhhOVw} zF;G{$8~9)Nj78gtds{{S_rGJo1G|Z0?OVq=Or#tf*bh~!mhT_<9>5kgn!>R^KKONz zU5qA}-Mu>;;9~7#r{?M3gK%5aXb9!6(uyTQ9}zxLx{OojeeUq$);(O2(%o61z zx+2P>mx>VGMrS_I3zlo;y!1z0*{8d7J zfVNqNv!qk-ozrybo-5o##avskf*7A`)+?fWqs9G&Mc+E9a2C={!FN%|Eb=c&`RTw) z!P{hxB`6~P9a3NV(fzgs|7i=}OpE(!>1KUP!H!dHmhh(u3@X5pg151pYp96nk#sM9 zKpb00HR+>g2yfJD_?zPCnI?ak9#4EfL?VvfN3aGa^2BhKK`MBLvp$hmq@!FIE^xr( z)trF?p08c_{*E%4I8$%(eEpOvdAxEKq*D+ia4s=;p+6G^2_3*QT*$~S0o}RyMu9SY zB+qb?+Fwk_bKUr2(Ak$vc>v)YHwCwXFABY9$Qtc^019WQy} zk<@%@p+lzOCv+eHNaT@?9^}EH_M~GEMxL_wNnV;r)203bM`DV+$ZlEW1@Bl$;#HsQ zEW~RyX-@W!*qTmdCD%9Jh4|xK2kpk01|nW24O#x z3Z7~4(53z&FS1Noy;8g32ZUGef~PF6O7y2}r?{+mAdz=zTY*EPf}pyV3ZC&;FUb>! zMNXbNi*f`{jH%L}`JH3pJEbe_NjX*Dh^6M;3w@*=L|KeLAV`$OK!f+iBtOdV z&mu3&l%ncekiq0-T^&YVmM^2JZ>L1w@qU>k@(!N5Ux9<)xG?V{B~RUX1*1Q8zghB3 zXSU>-j}pl}nw^vt5p6OGb{tOp=9e9=tqtTz`a*O1d{vyeH zab72R+O|saEUy~LGyQEQ|J{Ax#^;(Q=^+WB9SCnibv;s>Pc#&$!!^&9AG z=&iG&fvC6ozJ&2<+dQ0w4Z+U_&-8R=6ohUx@|_c9_>B?MNtZm+q2BbTeR%yK&vb@L zp6Rftl+1X^M{EdrV*gnBGkuayL6FFoyk3ZQBn5;%;0=A$blc*kMRQkT()_}?`9*gH zOUojAbuplHVQ@h#|M?xeA&SY8c%?m8?h2N_aPg9rm`un?$7)7y=U~Q?LeaA=0c4sr z9)+SbCR&G#@};`-ilri&Dg^M}t6cW$OoV^}1q2l133!_C;*(e}l zbe8H=IHE>Gr4ojtXZy7J z6|Y#_*>A}L;dgb^hY_9Nmj@SVOH0w<3!+k4Rd&`*a{&YqtTbU$i}GOg?Br2&*WGiAmn?{w zib4xlp@iUfk;Z9s5G(Q*7pb}OvFy}Ys#9)^4&u9j%u+BDC+J^fQv82+()#mGC*M3hopfiWJ^g@G#@OWy0gNU*YjPdNbZs8D_=f91kO6j4r)1@99R9`9`x-cK!f^JJL7F!7x0ZPxFc36IZO3U96jZvnz$>BqVJW;_Rk zRC(}TPT^evW19239AT7GL^)DV$eHnyfXDl;8*wmwg?9mr8Lu2+IXDz4yf49!&yfLH z0LcVTJU$mOjC$N4^}{2DpuPBIx{4@A`k_U?sldyHKk@hos_-TO$gJNHgz?^0k-{4X zIr2F&;2~3f`3S7=`dILeA&l>06e&EP1@9>n9v+nS75>8 z9JQMeu1MK0Xu-?GLxU<`KGG;W%~BrxMuyK9iWJ`0@F$-m0~SLl6Fl|v;ZS%-A&37+ zKlwf!kHf8qa-<{hC!a$HXan#D<4n9OaVWfhSoAB0+lz2T3hxB`&3Jo(r}BFhgcaUv z7Q8yR?@?eP4*j_m~B*5O}Ko^)umBTJW-fNBtG4 z{8m`-mIF`qFMQ-v`f<*-xjd!=FIIoWxwedxBNMvcgvaN2g;#9B;~uRHSETeSwBS7s zyi5que%IhocoQvn_X96h`xtA%Yct_xoA5F%c#i{bF2WTl{jRX!eFD6h5Tbs3{#N>J zg7M7u<2re4mx>f#4TQ+&$bcMNq#MB#Z#WKxx7>o4g8;s}SETT`Mu{2kB=Al{hPBtNuM_=?{*elUMa+v77N~K6CV3>rQcOx%=X(0 zJoCMi!t;V5pM!&xkcxeIab|w6!@)4tTiV}@_ZjfMhQA`pk+_b58Lu38d*M&K>v1T& z?cmLLr*U)Rg`XmY_XIr5csaPJ&4VBD{4$LC@x7H9FA0TF06#?v?>=~#@#=u5@_T~} zBi;fWX1rCvi&eg?<7T`x+{dc&9dE+RwcwQltPlJY5rd?3$Pq5|%_h8w@S_~{djA)8P!r$Zz?Mj=43MPcu4sNZ7p&b2d185jegoG35+-s%U7jTh=#s<(>s`#8t(y>XLM%)i8>JZKhCK;|0wo@RR} zqabb2fd)WJ;D!>+BjVV*=~eIIh?{2M1sz) z$mro26<2E04&+neW+G-FohBz{5n*1;c6+li1xU?m3{=}f$&*i(|9kIYV|u7lOuvNa zS6V2!RAiuFy*eRQWy9Mz@89_o(mz@ATY_dd=1u%H9|?V-K}X{Yk*LU%k} zkm?eJfxvyTh`>S$Ri@#aJGM5zxJJ2ADCV@FKdo2a-d>P4S{TrdTbe5UKuyGi`GdM3 zGA0-~Pl<$k%BtyX(~sIuInEnXMoqZ13G$pN@;q8U(9jCwU`haI^@a4owR_zOgAyig z?ozo0`SG!y;HR?ZS(@0ao3aJZz&sy+3YrF~>5r)CthfUW6?N}dmolAJs(ToEZqxTr z%LiP6Rh%a#Z1sS1>+t@F;x60J$jvc&>h2!p_xiVBelhfF)FIzyFX+!XlbA03fOAlS zw6mB``GCv$b^HIuB%eXJwkzs9$A>*(2iZ0A)rjvdcva{id(_he!*L-tkv-~ekKuBV zLdw`RuSuHWnHG1J#XV50IY>{wr$|8z^ZgpTSo2&0y6=%$;(cU_=G3;}tcc+arV9hz za!5sp&^;CR8j9#nmv|f#O3_?m9Y%AwLpNM}kCUQZqU}_HI5U2m#XZtwa)vLH`pf{I zf)^weP1`>MkMG1&CT9?(DGOB*z zRzvW_;QbN(8P5A-@@y&NBu~6N$*UHk696PIm11zKHSdIOe0c#9x=Edht7B}CM0M3X zmn$UCc>N{McsY`1ylIlBJ|tZ>N0And1QKaUCA-3{)ECkf-cq$y2sK@;C|7GmNvqPd9jh$;3f?52)5-6}kbCvcsf5W%(>X z8Kz~%p0}YX(zIrJFq&1{%Phoiooi%WTMA-DH9W_vshID%1S9cgNo9tP zJaO`WtdU4rf6+U9+W=y0sm`U`d9*U7ww=W~LmAcgJC!nvQOg+Pn&?iy7Y)OO3AYpx zI*sebI9{wIse7iGaFfSnS`e>=W@0~2dJgwORykg$6e+p8!IhJ20; z;93s6CJ)6ye;&M++ziHyHx7QhA5cU&(v4uq=gj~4Yc9=DU{a3Gi59%&z*FVH{3yI8OL;5?9_^t>>Bn_& z&HC*CUM7U7AM>N|Hdydh0dJfFlX7(a+=BO(36Hn!3hzC{$A6@~{SFS=LlNajZ^NH_ z4jrI#COpZBjw9ZI9C080di(Mb^@yZ%QWFVV!?9*Z;I4`Ct{E` zfgztm2Ph4AnK-jNc+bu->XC?RfLXs;z(duF5amet@;VA{4DcAAcv(0U-ao*Y@#X=K zc2T78PJkhwBLi|x`t^q&!-&uCcg%Q?054Ym?1zvUZ!z#xc?>k+Wmxc@0bV)66%m8P zx!Y#EM&RYbpZUES2g9h}MjX_SZHF`r0SgRP{4$Kk8#d#tf@%q1BFd1CLC!oL!Rs`M z>5`P(7?cM@BSbvLWjLR?3D0(l+lFO9(}2WxjYnh;&K@>Q3`l(Uc!ZdEfHaJIge>%f zVmzXv^@}yTHiVM!ooJfQ!3p*5wEXFgu?0lKMk5xt@a+6EqF!&ZhinyX25vUKBcF9e zL$KSVofR3~JdKxU1XIWQMppPnV7uB1-*D_qTj3jq4V#T`w&Spk@Ua99u^#>^eNz2c zUuwonQ~3rqPJD*C=G@js+k_&m-|^XbWhE7LPtE7yDW4D@YlHlk0oUUJ^gf%Y;&8|N{J(fPWY0~J3?VYWZ5MubcU~6Q(W6| z=zy5^u5LTBV6X5ocQbsco-JQChYQzXtRt>4c+h!-Uuy??c5M#d#zd2kIz*a*ulP2( zap&!>W?#3qyec21cDs;4c;nl6<3rspaJPnU+v5^ndIxqVz!JiZ(Uib@Se{}zf{sHN zYbJc;M7{*35&5II)^OphozN{#eC8f_&p}@39q38EL+6mcCA)2%=h{=a1dQ4kF}}v{ zw`qKoLbUM**?XV9&b9Bec55xcxI{%p_n(CD`n-I_e5li8$3Ry+bGO=#kT*6ZZ))jU zzH6@tqPNRd+A8XSUA&lo_#=)5AeLRkf0{!VHLh^HNMo%8>`lBE~yHJ@~Zry zU{!Xgq{l%Es z^80cb5@?N808-ukf}=}*vc7z%zacyhI>Wo7?k!Wb#U|uI)^7~vI62aiAKwf?jybf| zAK3|U_+>aN!qcy90fLgU#hrdLSpW@TMVu}SB?cOh2HMc*Gsxy~Wcg4ijI19*){i6W zXR6TVl8n5^x0JMPJQ{bh{+y9Yv|7|wWWu}#$B1>XYf6nTxxtsTtz>hsDi4Edeqf_& zA}#C!4rq=KqFiE_RhTbg+ve}tpZN8%lA?7DVGfAG91Y>6s-`Uv^=+2;or>R%UMI+2 zCypJ?Imhfgv0lZjbxmvm2zhw5UKE_E3yiD;wm9J97j4>k%)upJ8p2Z%+_Db%7z%_7&0Pe2q`TwGHkNUOxH+8F z8lH6`JXP5ITpqBo?oF|4{XwiaAk9@63{;neOXRVAoc z+v-sYn|Dsy2*ZyJkAe}M+K^zk8NpOk+CydGvTRgXUxhD~wY3`u!#VKSWNWEE=s3Ai zR#(pq9Z;$&jDnp|Q*kSBdQ?eic&0lpzwYOZ6pvMOX!JWOD}t%mro1&g3W=i=VPku^ z`D=JJhiA5i$HC*_$@cz}4G%;;$dN|KlzwS=jgbT9=zAttY|jk^C$_kJ7%DxAQQh_L zw>SGz5vegxM4MzE6u15z!>0c)+YI_j;C3`Ap_FM*oMqC}G!H;~#wZ8$fwQr`Myk3d zCcr{>tY`>lwuX&`GDJt}SuNJ9=)cdVVabe*)m1CgE<>g)@p_*Y@lu1R!?avr%QwO! z!Eo*VnzcrZot_A%o((66`p60-lntEyDztHBS{!h(EQZ^*?;qw1LP!1}9Jp4%v^Jx} z*^kJ@C`?^@q~=A%6H7HUw65V0wZ`@fkM07hq55fni|rEfmIrY$N$C(4Vo5by1|b%e!Cs_#3a7Au!*-3!YO__kLSu8R4MZRhwLT32(NzpY4b) z3uH4 zIWEcZ=s44RL(0Es$*;*N@;lb_tV4OP1^+&azMP9l`WOetuO~~uYlYjRWm@EaWznDO z2$T4X&hhCw;WFk)r{Ig%9v1m$E&6bsOGVUofJOg1RUpm`|An+~f=Dkzdq~O~`u5Sj zmf?>=mgCJQWjN=lb3EH)!JlMF|DTrpdM*0%9U+O&;VBs98zNlB5A~a4aZj?i=UDI; zOMJ?uU?;IxWH_->@b$PFuO|%sFgHaIpF2~uABtyBHQvo^9o{k^TU>rIDKzt5W-;s|Z&lg1?z6Vg>>2hdajp?&| z)R_Kw$+K&`S@P6ITzdJ~;n?Jo8Z? zdFJCW$ul3PCC_|(DS76Dr2C9BtBsyv@YGw`S=jta!=LYJQ)T_?CwV$KN0|PMH%{`5 zN7B9c0bPYdjos6&#=AvYvg|}!eHd!g1--Aq(?+ViXd|5&2hm146#;p1===d?;?VmG zR@g|D7pnrt`bo5r8u$O9?~iB2|H6^kQayAi&WTF+R6uiHAjNu3*?#39g?T)D#_!dRZ5=ei}ntA>fb8;nf^PH zXZjyXp7!}d@?M-tIwymGn1-51LAO4Nzs5Kn*I7}d>XonwJ1r2?R%<_qyk8@{jrJw; z$o!|2uc3#YBUoW~-EZ)se8(ERz>$?i;DBd3>?XLMF7>C$$TJ>Et--)cu3Gm+ z__N}J1ZIlC_q*tbdQ^ZIg|)1C&@uMhX*Nof2M5>NEEa6ucjfh)}VM45UM9S_d?^7{;29|3W!R}&=rP@=t?8v!}Lx| z1q2s#_T!Qtj2nBRP9!s2J|IS_X73IQEnBz{E1|3?xOgQobf(>d%U6_Izw%cJ8ErSV zY>av>I;ro6X%STk7B4{4DOiH}K&ZoFE|RHWl#rp7(OE^!O)_L-SFwwV$H)h>Ao>{d z#HViq|CR_Bga2-ZXqG&)8C}dI#!Sgh zQ^HgS9u>f58s*W^f`s=)&1njaUE88inT&P$ijHfym^UUzNIR_ zqT{$x>dl)INx0n=lmv#nd>vqU6J^}nQ1G|5&T_o>Qp9^8QUZX?c)9S)VSpqhXNMg5 z9O*v__j`|kzX1pRdGP+}&v-U5SRU zd=5Q9{8nD&m-U)qbX(U(S%3ifxP#CRJnPyhYQ0A4XP#R%-ICur;PH7u5z{4cOnDJ_X7pwl=4mrlj!9kj5!s`RK!uyK_@2!jI_nrlBu?dg%R(Q`_ z@QwhlI~9;bIa0F)Z#qW~!GKZd^9l)bL)Q|n8!mG33cr8_FF;9HBPgEk#_0qp1kp zY4?Tm?^ufE8Y8p&zH@Hh=)uEAeb2dlds**W zo|ON#W1a~UMVjukku7m~xSdVXhU9xWgwKfwp08|^3_bR6p4{!Oz;L~y9*RR?kMm%> z@bh#tX1l<#UVO7TC=SyC;xH|M=^5CgoI~<`+*!uQugs4DaY*O*n0H-sELv{<7rSyv=$|-5Xm@;4AW~y&K!xH-zeD zB}^GIww1fXZ1e50znXoN-^F9P#Yfl@C9Nut(J<8t^BO*@K7lQu>}?T={aPr9DHip{ zmQ?1saKc8%wb^-4U?XmoLfGF+C^RIPR8>-SrXrkEb$s&8vkw)mD+-tGEc0W+n3#Wq z31i8aFb12AsXoDSJUeA$Z)19Iw_Nbyfvowm`K5)4mLt*@rNJ=OQ4v1bM3Z zY$GDKA#zAW-i--mNrSN!RUWsZiZ#!JYf6a9g&$Q1M4rO>kl>((@ThfSdPjbk({Gy8 zIurPk|EcQ3tkNf@lrkWG4}&oM>EU=7!c*v&e6z4ZP2DqFHrBkVZT8R3o}FClN1@cG zMHR}qgu?=R4{Hnn)?-HGpj*@W2Qi%`5!2B|Rn$FGy$3WIAGNGPC_U&F}3<9ycW&HXjkxYkUJkT^f9YDt9}4 zYyxHeetDCEvrEd~+na}duk34GO^)lZW=C-sOtp%`oGG!%R8ckz(qxC)n3N{sVHOoLO)dW`~@WBOfh)XK!#62 zX-rto#ZgpJcBTvsH5XFo;od&+@^s9N6ZNKWqg*^DP@`k2DJHrd#spyIH!|tfQ-l0Q z=1xx+d6NmFtb?JF>SYyId5i4@Y3YMmIK~cun2Bo4P5mZxrh0yUFlo{AaVV$tpR~{W zVsGnJJ|uQnik@QAgI!C%gy?$AP6gaX(cy&>8si{ab)3BrX8vJb?oLc3t;dwro#=(a zm{xiSz0h&Y0Sqrc5gvCIGhI24QsR9kJCAkfJZ#R_BmIQg#^fLyGgK1y4n5p8m0VQHL%Y&jLvPQP0*8Iv)@W@JKYq^&ia(B!}dUP54^ z9&$_%RaCL9p;(Mro@{)KMO8)PyGR|d>S}h6@aYY{J~h6pLS0nb>sL~?t_ZtRZOh*5 zukdA6)sOY{t?*@51@kct6nUYkGr~C~V7W~f+6aEv+8M;DkhY`FQ;u`>hW#4cuywd1 zJgjObj2y1gIh7Q17)$oV=WaZR3B2dl8Gndk#dqLit=m%8js<5&}DeF#<#vQ zRmmA%HO{8^RsNIlh1thGN5z?XI6N3AYFc2k1D#|T>!-vUu@GllI27;0GA<(q*VMId z9o@hD;l1g*pC6r(Ub{KIAy;dOZwp6cp+$|R5Zs(13v6JZd8&5Gyhj@5x7Z(cZnPP( zx5aIJCJynP9&JWA7k-#EEVlDQ&x)C(M`btMozv7YfqlNeA&jl;xObT7h)`V?MX;3r zQ8pFU2jYP>>VvtUO+4x(g6@cZ3sKvN|#m!EhEgE|%8~foCt!V72 zYq%BI!T9rR8W5UbufXjaE`XomvYmn2dcwFq;+kOyjEKzgjgPFqQw$ZO=8ML_zF04};j8&43#+|a`T4ZED>RM#V^8e@T2*0c1v4_MYd^8kP zl8T05!Ufik*HSaIdU#`PDk#*^+P(TkX`eaJw?~wN3@T6T1P5;tG7_F!{CCPo^1m+m+6clYXmh zX1}^dDvK$`va~5z_XPYr{UdQpto6ZT)9XcLaC?mN1Q^1@mZ4yxOO|dGZxnyDQPecAbZ8qltiK3FKIU-aCc{{&qgbM!tAP;}c5$KsO92R*pk+SDtU(Q{?ah^81Nt$;@UUJRZ;&$_4D{ZrKG)mSDx4*(#ekCJ$GR?d|QOqNk6@| zCq_JQ(+7_&t_q*0Hm`j1Ui66{OtLxqXx>^s+V_slN#3>#xbxfiY!OC~xJcABFOkhW7Rybu*O{_cO?C|CNTe zvwT9|=J4DdufVElkU?nR4qn+s$U#>#eDQiZSzJr8A!zH1v^|iFJAZMnpvoIIVtC^zJH71pB zPc9GXbs=wg1$e4%@XP zYZL>9PG^!OQ!U@)~hWIE?c&6 zflIT>WP7uWIU?S|;9U!_w#S_dDQ*=T0g4>AiYieuXcXKYzi( zf<=Wzcig$S_^u^OOG=k5Uvc-!Rb{JxvS#g1?^*X<;o;U7UwV1pD{ZgtKk(YY*Z=E{ zLx+L_jbL8Fk{`CIQKmX;p-|^Ic>CS)s>=zC1_85BEgz`D7p8fgmH(JL1{gtY$ zveaPZ(LM!DTi3mCPx57@SM{t)%D-a%v@=;x<^FZu`MbV!#%F*2(Bpnb?>F|`KEB}9 z-@p6%+JETJp1eBYy}R%{PX{K-CKIWQ_!#G!z*vQO1ma`=k&^!zN3zfdFV%9G;F^8y~}Hd&GI{b z`s809&s{ol+p#~rQdpa7~pq2{>xc!UVZ4}Z_+%!z3KF?Zu#b!{S%w(23@}9 zx5;H6U4MM^k1|?<59fHk+Wp1AO@Uv&d)>6tfA4Y6ho^Jq-}v^X1rM&Q{Jr;g)BgFw zmo0yE4V~*){Mhz~E+4;s>YAp1J@UnmuKT%u$+#b${=cDQmvcY5&inB@q1*npVDAHQ z#S5}7OnWzL^4w`np!Q zdjH~CkN3f8%Rj#1@6$fZJpb_E#d`NYT-NieKWy0c=5@)n@5c2QIXua)_TT?y>AC!&zM%tWetOI4uP?lE@2TOxzCH1ak*hC#>7&)J zPaN||@&Ny9Z}oinjzEgvF~ZgBqoLn?;P19z*0IMwYVGl1VfF|A`Mc25pRTy(!Md#8 z>1V!9nwR&dhaYPE{@rfCyx^4PzA^YNqASI>4`F>TGM zfdibg?)pW4&s!f~^WF_v4TeJh|KIwPd z;`!)@Gwa?y(){|WJ4d~F??|oR6My>K_(vZ7qy9`n!{iSp+*bW++^&!9&%RmI>#|>; zyS~?3-b)uh^42G#Gt!>;_2C=dZ1c94PTsP#<^Gl>-e-pGTR*4%V43sinqR#>{HlK^ z^j*^D-o<`L(c3qk{PBj@uTPn&2v3&%Zlk+JmKu<7f7| z_n#qukKS8fKXTX5l($A)8UEuBm)CCDJ-PkRKmCsQpWdH+;*vX0JwGoz{J{@?)9v>^ zYh7D-u*+*LFQtu0*tq7l>vDec)aVNrPF_=5^X8JSS01}%B)!rE&9`E(b|*7-4i9_Ojv1T_g8^F;*|lz3UpXd%p$$#fZr5Iv z?tVJQI{KQV8NY{?A(L!Gh%IUd1BUn3%B21Q5q_m5zR%*ehF_(P#26&$5|RGRhC}|w z+LyOV4#?aK85>rp|GSLO^(kzT)fo(c&inRWW5Lh1xQANY!^NBqdTzjBi<(8k{ExQC zn`fCY{5ngxU;C1V2Vv?8>_1QYQre%AHhe*`UE0$t!h>2(lsjMJ`YWW{aoDip$n{a- z^R>QF?giR*S$_O>OUDX;4@9{OG@S!*AeOI=UH&eY?k9x1P`k;_P)+mV(6u6HY>;2L z?~pFz#C?n3l|F>gHS-r*w8un?{3Pv8S$=&GVvAbgh4ND@^3yEtn=I};?M~#Av;>Du zyH)V&$1c7oQZC}((%}GS?<7B4yH?uE$j@Sn{EsYdmP!ZNqjoeP{=AMraCR+dapzmy z^DXWL7WYDnyTIaJWN{Z-+(j0*wLGomw^)qXsz@CBw0?7VM%te;3?D4p>m2ahhkCuN z|0;Zm#r>$o{l0V?@w;eu%JNY0D`b06ZgY!d`oEC%cNX{*j6(O3ZVdUtouqMY66p#Y zDHzqAF4HR$?(W(-nch>vovwvtd^kn^UXtx)zX-oV<2p);nEnupe!sEU=dUt8<52#u z7JQG?PlZ2W3BT8Zw^-s$hkpuIK<2(hiijV!;C*OuTlbZ|(PHoO7Wr+m{W1;Wd&x+m z`~R_oUuv<(o6=s(Aj^HRP1zB6%@S*Z2)|ydwBWsOvB!9e{k;-!3FNr1HQtd$i28kD zu@3|FsfGxHblK&wTIe?#{>*}!kI8vITVKzrX<> z!2wTM5qD;Xye_*e>aO#m3u0Z?<)xEx)OUu-k|%~&@=TL+XDCAqzvPL*Y^!e(d3{pr z5wi-Y?+<&Lc(9r-FL6RodArevGP2(Aib|g0#gdQM#~gPU0zpE5c?}c#fM;CNMazZC zf|xh`Ho+P;k@%d0q)XkrJl9%No%9H>git>9fraM6L)N8)vX{);=PwaJ)?}c-X zk!5-z4wF`D@8%;_TE7oGkEe z$x~m>ZzaxP@FZmi2YG1+VJmaJVgm&snx?ZNfP~!^7`(96LWB3>q}m1bP~TBg4`nN1 zH)$);PA@|sNR%UZ>cVSTDtPKLPx7?YD#=rq`z258UrC?ZRo>^9Tzr%w7(gBNy_{Uk5{+~=Ca zxa3(rJtWU`e3EB6VyES!{ZrZDfrNd)GoHAP zfM@s^9F$?YB>g7iEbxD5@B)9i!HfJ}Z}1|&w;DY4(;*L4MW0AM6FlAOTW&A;AK?eY zFrAqOW#P~Z1Z&iDcDkU!IP?<1iaCe+3WFa-f8bBSnfmKF_yOhMP~QxXBR>Q`pj;g4 z8{nzr+0a4Lap)8T&BUShK%YgP7X;94IP{5v)#i~W7-#_wos9`ph(n(wSZy)+yA6IR z`I`-%=A+Kc!YawH#W@j2>J|6_(N^RWaL$mt1LqNvr|o|rdD@=Ui}LiJCwZ0wO-X;& zXQn}(*cFoZ;#@2FOq`n~PnqK;{sYNp;rxx{2jbj~?OI~?lswBy^xM*ZzDee%k{cxkT~_ICqmg(6P)dvVrSCxOZIMP5qjiS@T|q>d7- zas2|%a26;1sRK!;u|cA&uQhm4*5D~m{Zhe4C z10!EC^AkwpYfa-TQ_JcG{A%)|0peRx6+x|Puw+4SdGKmEA$=|f=;XTo{2D&?r_f?3 zPbOpR0br8t{AuUK#G?{kylDQ_tBf5QzAe#Z3l|p%B`^AAypft!PJD2yGHDnHpUE4R zv_M@<%KSNP$8HnhOP0o{?n@&ZmRu~kZ`q7QRX1)} z(viG*@0!m0kwovbp`lpj7e~i7S~z{Lj-~Ok(!1v_Ux{r?Vg+LGT?WS3hQ?6WXaLv- z=dJ}N(TiCzwscHei5}+r;#!2w)>G?dEL&b`Ud=*$dS0{`d#hlE!jj@BgQLcpD{=># zk>&Y?3+LZ?@tPuoEsJBs{FFVaW&<*6wF_&qvQpm}QI%O>C9t&xIzXSgt|CUQKr`FNi446pf`PxYbb9 z);P?k@G#j>X|wvyrN-66lJdpEg~}@M&hLn93KticsO(&gEqRuAY{z3+9cFHRa9KxS ztW`B)^d4-BOYY)YATa{j7LCB~)fPKMzfW82kp8Z=*dci_TvJ=5a7Q&(cN1zjW-L!?qyLk1lqc9z1qtXP~a z`4?)h8Wy`!t{NK45-d{~NrhPrVG52>Fsp`KB&qC(KQzw1Ive-3-9Z9%F7xWMOlIOiPX_#?}{PLcf)ECcnRyp2S|kYk)29Hb*Aym+`3-qRMm zMuf%E?>{Yg-?#z^LmYUM6@5@qbR(E7Q9}-n}u*i z3U8hTZ@SlbS46z7I22xQ3*K_zDGXvNo@?SFC{kZm!NKQ3MN00BrQB-0MtLyZBpfQ; zi6}%f9^aiP3}PyNfJJTtNJgL`(VZ0A8&6GS*VQ zzw>tBbu-~{-5Ya0eg}tqoQG6LKGH0BZ+Sb~2Vb`;{r-i@XvX8W?}!>9mEVsbXU^|A zZ-;(-=2v(xS@3dz_f!O}L%%;*@REETcpOtuc-*(gtluZV%Zh>b9OM`$M}}nqZytD- zM{gVoZ=(f|H`9W58hG+Gi-1&kH(BrooA9nQ;q6A}VAd}e0Or0|;XMmEvwrh{r}BH1 z3Gdeyyfui#IcAC!-ewEl5#TjKi23b{gL1Urd@yGHxYiEsqDbNW7!3Iw8BmT)-Ups| z{ctdhc%#6W@s0qGb0!o~jx-bu`5Zbxj!a`N81V+sje~gQwrIR8)Z1A7=}#bM#(M~O zxrk3ZzIRf1`4+q!;N6RGMU*4mZozxsgvYTdh4(%#sOJ2#{lzNZcOb_&IXFm}DAWx& zQ$Jqs72Y2#c$_E0Ie3aFN7`+{dj@!_eEB+3;c+b{vwmFD!b<>23h!l0esAkzyu+k^ zc*PgNtGD3I1Ku(PCgtelT3E!+p#!u7c=K>39^bbr{eFY`Vb*n=e%rvC^;?5>pQON~9G#C#K8Fra9qOe5b-ABPB83zUO6q;bGg`b~pd<@X!( z8|L!3A9(CH6j6@!1?0%*&;cqm>30*{3h!zQ-Y_VKsudxH*Uy4i3%q%dVtM4@Pn(Vz zfVTwUij;oWTJY8YFB3x4kHgFn{Ve%Cc`^Mg`K>eQH`|0a$%6M8@cJNJk-vFL!zpVcXZ#ViUmd6kSPRj(|1Cr;7VLZ+x z7-yC4PROCEMu;+`28pNS_Cn4pLX00JS8b6yb`iOe7CAml#KOD6BImt`T!U=CO1~V) zsr^2vq0;YX7P)FXY{ioM5`8h_D7?4uaAI!13XgkknB~@ZH0=o{C`rjpwBY&haN<=$ zI4ikXl2_^aA?J@F_okEstf2cK$Ff(X_+c`?N-lH}IgX7}hrtrye#k9QU^p|3M}fTV ztDw`6GZSS(YqGi2DGSVRFxLcd6`|&^Y8k zMqp0+pe|}1h)8&sh7?<6PuGElmLXV5BGDwGaMs$~HczD?_;@huX08Cj?%-(EGGpAOV=6R!^fAI_vJTDJ`DcX!7GscSeU!CHMxF3vwK2z)wSK8h({V zm`8#&ti<|UNa~mq!Aat`m-x*Rzx>j_p*2VRP8Gki2J+igD5Z9*GTRPmVI_>#HAogI z@!MynTT%CrJl937--Yx&8Tz-XXn^CFvZdHsFRf2ncPMHk(9qfo@C~h5>%=#=6&bxf z*o-gZa!;1c9gj@ijzyPxS8s*hrLSbB--3|J;h!{Q^ftts>x})~EIBdKYBmtvg-yHYX4>TNjnp`zhN^5?R#*Tav4cQj49E!1ePNWdvFZKx(r4;B1 z40k#)RujXWXojE-=xL+<3Db9r*g93%NUjfN(q~RYpWPk$s5OzIKH}}j2R;Qy+IJu( zwowy1cWxI+av=~TD08FMa}sN0?Tr3Toyy?*Wp~=dmbf6M7mU!Vd};x>M_s6{Esmn( z&{^p)-tODs%w)gCTZ!r zkoP8I6}4j5ge$nZ)xO@^196)Z9*EyG>Q0C^*;|q~>j%3a5*8$RF0NJ&wYr_2thmtG zK;yafDVk@ZBb1z$#Z zVOmvo`ZFRkyOIya8_QOFl}LNBBzAFSlfYN579Ejl+AciT&o;pev(#p9>So(_mA2zZ z(t#Hl+gNsGf{$y0?7Kp{b<=8riDgs77v%3b4?Jen=a9|4c~fojnsepP?r^(lW3JZ{ z*zYis)L7>OAK76^muHn7mOS^_zC@&0(5=5fMDV_NtsuAO>B{6CA#anj@|Ve>6JaZGEWYy zqF^le6iJJXR+Tl{OcVS2=dQXu9<6lBKQYFwKn%0AGQ?7m93>Q;eo`!wYW06M{l-& zKHLHS-luEEX%%hfD$=xyabg{Uak|Ky$u^#Vkr~4tr<~_`jbXM#d{aeHaZFy{i&Z^U zxoMrb?-OxE*yy>jrU%=dHa6G|M&im$aC@#5I)+;7(X>ak7o91q51kznOvZ-Oo>4Zp zTmt;2$-t4@B4QFRvm!k2+D6I@UG(7D&>2rw7bO5>p;2IekpOHEYXcfyTMFIjKp)~u zM$6_-uZuF!nIz(>1IPXX)em6v(_gDEuj_W0R{ zCY2Ng%htKMS{jz?stJ0gC9HK7+h+Juuo_x*U*yTo`yD&4T=-2Nhjl#4?@L-V>Munb zOR?{_%$3{L>oq`&E9n>q%-X+^5i=&%oGoc@&+uJ_onH^3M=0Fs*^gzk*8iC6E6qB- z{%=|+JTFu+D8W-0=eE1kst&PS!}A_&)q3QF4r!tK2A`)cl+^4?+0j_h>bq?FZSyu) zY({GI5=0@tP-4$o`wrJ|>a6FYeadM2k2?fc-aO)yUJHyRk7I*ZMJOR7M}6y`;CXTcJmHtd%ww6y?e|46GE9IVXX54 zQ$JvTG%nCHVg0|`L;lkttQ)$aHfdIN1GXji-8%ZY#Glpd&vd&R>I=8mH|*CoyJ}v| zoU%RrwO49CRhk%TU}dt8uyW;P`E6-=xI2y?m5sIH;q4g8PQ*qT-NCh#4irp$_-s==Hjzbrops!~ zOv~UoRN^`5L{b&`y$u6~k}C2qU+-acOLb3v)KR%xe>5IHYh8(3tMAadO_OFC*1R77Do;K%1luS3_LWYI}Ju7kh)?ERh4h=ylFJq;_l)z-H zv}QDWR#B(8ym_{ytaT0Xc~l6{RkK8!1ltrJ_$X0?=C|Q;%i8=Tej4_%8Mx!ncTii@ zr8%Oe-?HeJr%LPELmQXQN`h%?cWw!tNYIcIlw7kf8H@IDm7=n+XM5M{&_x;Q%sP$& zaK|g8)uJm}xoFd=COelu@}<;llo zbi#p4OucAyDA9_n-sq<)Q~FMGRn)cDZY-}#a`)J4D|x8(w2mcNputShuP)=EW;!kw_9XS;2!Yr<3Q&XLIc z6*Y8nAomZphju2eLY}G)xzo^_yAvvc-EPOyd?@|HZK!9dO?DP=Vu-6Y1zabf$7+_n zG82}jv>oATA)W99~tmA|fE>yR~p`QJpJMnNV+7^u=dVJU-@DZDZ z;g6)@GwYD^dECC4?=`>k-ss!zsj<%FqqfkiKHQ*Wxk6uhj&vE+Wp;LvUY0!Cm+#A* zVXWK9+w22R;HTkbKDna5uvdhW&{e?umXW_aiw83 zg}yz`HvLF4WZ{>ATkM<@;Ux5FO>ujiN98)K&7%3k1GyaJ5)bG|06mCPJFs%(CTtg< z14AG%a+CQTH)oOiVZ<>W75MmyhVAy?_MHoXd8+MezHSn}cf`3b0X)jYeh|0)=PyB| z^={si!HYL?#jZd=tl7mr*onI}AuL0l6HdDnuFi0{SOvC==po(9e8W zNAjet$UiA>>`S=83qlv}bMM)&m-$9#m%hxKzIb}f(eX4TxGj3`(^6;Lx`AuVZZXzd z?R^@px6!xCk9zDl>Ok{F>Dta8c)roc=ThZ!;%lr59uGIK7lT}D?Sa;>4!qsyYe5%d z)QHwE^YDt**Wy2zI4bWbdujlco;xtq5K=xfz8I~$6G!>cmqWwtT|?Q;ZE1x*Jn&N%t9M%r9=?5!}oi zQy~_jE71Bc@Y!w2N8N^W>p$r}n0Ul*sM>nUa4SVyKauF!GW=udPL}aM61v!ra6N3| ze;CTfbCFNv0}D+ww!0G>DU0`d!r)M2!ehLo2|esp(58{rqXJ*?+F(Nlz8@icY`eSsfTY%1+*Z-4lX3utss_C4@;xcdBTUs3XuiFu-3 z@@>wV&$sq@ktGIxYoA@Sv9N4fP_~qYFzWzv1+zNZe5etkhK$9s-Mmd`iWm1{DANqR zA)E%!5Z}gRCHL)VgHG^5Cy81~7`|(TpKM)_s_4tbd++scZLzI?1Ix3cn-Ch_@oAB- zFn)$uJFtm80~2DGA(EaE5A9b%`)q-a8>%?%;hsz#OGC$tCg+)PVf|%H94`-H0(>Ud zGsj(9n_RiMJ3M!4Tzl2?9u_NBd{6SmdlI>h@>xa~*jc{5TV!6K2XrvM_pq+tKEjW3 zK_L{{PzZ%KW65AD{_s~?^D9%C5xTINdH-}_3m;#Z<8~hPmbs5(fr*ktcf^hXFAml* z43QG6Yx;KIRQuPOx(l0XySN9)@bj!}k@|zW6je{eJMlCd?h(>#t+)vnYZ!CIdfIi6 zYfV;VO{UO6{FG*NUwW@Uy>K1%#CY=yoa!sud;0v7CMF}9ibOJwf4}bu!bj%j$B*lQ_nfQ6yTyyGF~!5v_RwrYpNnG zIPccn&V4q%32hL1Py-aG`$%QVJa=tn&C`8ew(aYS-fhi5qrr(j8xcSF#+~Sct>R&A z8${U;o17w_0K*v(`oywlCqQU7M?7zu$b#6?Nm zY}AXr8;qB&anHTv-e=dwluaD%a=*K&R;=mDcNQ!g871;=39nsq+wt19?JMWkNE3U6 zsPtl;N7Q4DPw3=1XREbus_nlkd$x~d-%z~_TB97edNc0+#JEiL&A6$-rVUQd9IYjL zP$Cu>uEQ`*^?WqWc=!aiUnt71sJmah34&@cSUzs;U_DkiV@!jbuf6@0!*g{UD%ar` zvl_xlA`b3}A$raSfk$0|A}oh%0JZQ|F)-OC+;}2A&4fCmd^PyG7B?d~qlFRTVZeQk-{&7n;-3%lZ82siip#mH1M5JYDissFKT z`9JX+u@1fKU=%>F${<%qhk4oaO17fz5%IE*$+Jo1hganZYvRSmljs2XxQ-Vj;hExT z*W`tT+!5eT&lVBwXaR^9*jvtrr&CfiAWRkk6yFJ7)u9>>uW zu_cT-!in%q#A&jHr1&2lDs7ZwLwFS~O_BI2#QiH=z@UW377OugIF0E`Ku@c-=G>yJ zc;r)DITS_&y&*gkX}|zR_9Kb0e~|_GKV9ec+v>rH<66;~NykSY$_OUGu5L$FcoN@E zPO=B_<1DLhi!b%{>XqojXWKhbc?#C=H>sK818 zd0U9j0Pua{3xYJRYsr4Twr|MQ;(NZ<8^R#l^R+#utV|yl+BmWHx6=}Cw@rAf-5uvn z4Y>Y2;k|ZuH#{2$LZ7XF$J#JWhQz&M3F@-(L?#~6D7GjTM5Dr` zNKvGSibfQ$UDOyf7C?=FCL$3P8;GD63nGXuCidP7wpb7qzH?@0U|G;4&-=Z9e9!0T zvcH)*^P4kg&dkp4y>}<2s^~?vtQRzol^FB^N{pCOkzk7JQK$zBD^!zA7k6rg9}$9q zjUN;GGMxU5EvgpX>zj9T;1h~LAZh=U(4Buo9+#Rbl9+HPYwNO#2aLXA22aYnFU$ z+CZyL&VxsQ-Jzq1)m3U-0xxIi62@F>Z2b6Bkvi;s;d`W+`-;Oy$-VCh13s>li))4_^rmSI^2S zz&OABl~UF2h#9Ubiw*cU>JR!P(}Wj)lZxQ6R82)H1@OR%RkY|yHTbrdGu(Tqz~f)? zNm1T=ypMuOK>{x2dAS1bOYq(sW0mi+)T1Tj)*nZJXXV>0b+~O-y+&d!-hx%&mK(&O zFsP^fMqxFgxLJnt;S&7i(T**p~(h?;ZWfDKJ?vRV8MOf}&4FchiV<4`mn zRE2J@DQ0WH2|tqr&wQX>epHrDSNIxVRFe~}`KL7CVVBMLxlkQy2gM$@54IW@G0Vfz z+4``4Cpno&K||33(vm`M7N`>|^D7teG# z;}2>A1Ir3#d{dB5Fo1QqYLeCBPAy={H&qy5LE!|XT~*}HMa$tnK&4FMnkpF-@EII( zYC=_n(Lx^-bBHMICkH>3(+6Q-;!M4PromQ@5zumXIgD3qxaT-sKq}ySnqM4T&zl@!!%$_tdJU<_-vP$8p~ zUyzTJD4a_(;OQUM$0?j)5e`yH1nr_gPF93HiOt44 zPvc1AVCPx#^uku41ynRaB~&d7+h00bXOd@k7(_7EVa|q6dT>SLscr;Ub-ywd9W(4- zj}x$YTj?BV8}>}ig2iC)B%O9;nx2MLIt!wm6HLPu@#a=b(u3rKvF-wV-~m*l8(A($ zjW7O~U=Y3_eo1^}@k3aFn$B{DwMS{kU4^aSsiR7$<~0om4=@wR+sUF06q~V*%OKi0^7v~V zMUdP$;8l@?^MIRA7=N&L2DLT$JPj;83AS~xB`X7T_%5)X6wNy@&#|QyxqtefUe}R_ ze;fn#@T&u|oC1INud4&1A*>HZ@aqGdeoLp3>nV&}bgka-s2%+dr!{mmPhUx3V>MZ` zSbzOpbWH&ZBh0B;AJl6%spQ|RLuRV;YYs3mS$3%7LZqWwsoy#B@D#3|uw;OwckmFA zEKI-wNWug9coi-;e8L5;Zjl=0_{9r+T`lU-@#oLU` zfzB|d9IO=1i;X1?&Ruk}bnvM;j3dt_a35YBdqlr?negRl8=Eh)zD zC&O2NNjm->0KP^|um<236eB?s?k4=D??9s%1siipOor_~@cpMsgdBWT9)A-_cys}` z;gkep9t)QLEm(2=8xC&P-TPbj?`LIi*}uD^ZTIfZ_O`BW{aqdUadvLb-TT`(I6B)n zxH!1*wO^>S|}}0zJ^*p`TkndmDRaOE*U=YZqI`?lvynU7#y%yMqS*XW_qhlc@h3INbbZ zxXH*dbQ>MmBF8UmD!fBvYLrP>xVIm?KqsoR3BEPNguJoGWB}VSM^Feh%xR!dSX59z zBwwnw%+Ro@QGsEh0gBB0HPFYnrA3q+PQE5t|YI{TU|{oZB!6 z@y#c*=k#>W-EQo8r}E{-qal~2KR#J+o&9N%ue!1Kz+BFI{p$Qp!JmtY(5TO(gy);A>rO~F7O*13=VKexOW7z zKmWY<2Q5qssFGhfvC{C{67qIRVceuP0!Wqo3amCswa%~QFdu%%CJ3rEzkJ~nRqOn^ z80E1QwE>>W*G2%Ta!#VSt0?X+iVxvN;>8d`3LGlr&734k{;0y6MxCj>FOmF%wV8la z>&cH2<>N1jYJ)0yE2%K{^7NmfK;KDL^_x+LtKTM zEy|A;#l`t^xOcedfq>mAfsO438;~e>1Wqd4Vc3A4kGqigUtA*1$KO?}aQFF4`d5{k zD~iX8;^Ou#5alblxzv8xjbKtq-#T#>NU9C04)&^BBmwQ;JzpA)Pb>g3Dg#oE@;`;JM`Qq`Z6y+Zl#gB^OMckj% zA9_NL3Rfh`FBZj1MDdfN_$g8Rj3|Ci6hAMD|0RlF;6zRX=I^EU?grS9bKz!)+T%szT}Xa^Zj&f~p2!|nBK-^m9)$I= z5mHY0265{|G+K=yW!O$5F zLwI{o7>#!)@o}7z`lknp`*N@wC<&${K9Mt`@xCNJ2{t?y=7(^vY5(Gt-;i6*Inf_c zO;TWNdJNcojqYdRinNPG>qo9fSx?-UN-v4-JWI1IU8I9)nF;JZ)^VfTj< zG~bWp|Hf^k`EN)(vu3ZRZX~{)vk;A+^ThF_zpNMK?-a$KiN;fa zDBnXA2Q_Q<4#1`v3G|gjVlG|VMerEioxRVW$kX;CE$%~vQJj+5oW3!n1^zK?*h>IZ#}~vy_)1 z@O4X6b}yIWI$O_!EzjPLjxD913iopf(g^IbuVo5b;o& zjvSs8vo4jafCLDnE~*cyi`GkYqvH*y86&_b+lpe8#US~aKNA}Y#-n64pHBJ+322b4 zctm6^kr}r-%Ajt?Y>VrYDfj^VBP<|p$ulMaC+Xyh`6Pb;? zJgO^6EaLOn^pZ-zt&L}%JxMCV`mbfPnDJJI1eFoQ#qL?Eu0I3v7p zLePN&G1l3QV&rh67`a0!Hi0wIALOwu^JzNjxQb%bF@s{%F_&WG`IBPQ1p~7)a?=SqrA;EcSIE${~d@of}lKBBJwig4NGf7z!l0@>1 z0ApD*I1po5Qdd_15Qsjed>S^@2rvthT|6T4yLpWDvHm4KOy>>Kr>l4w(x*Znru}Gw zW$8SC`mp_O%n_%-9|+h+$sPj9lPbvs9@}ENH;)|<@8xkX#B{E6MZAwsAA*?9`NI+W z^Xa1yPvWr`Vn-g2M@)Us2XPLcj>Xu189|7r^666$;~xm&a7cO*NS@(He&R9di}pMw zehXL)qQq|jV_y(o1#AM?9S$SF*ruTrqmIE8%ixTzi85&WJc^Cre4Jvm{auQ&KVMO7 z0_Qgrqx}LUJdYD#T)!fxE8w*hV_lai9s>9!#aI{K51>5iYeF&FcpJrNV|)(~%AgJl z1-LyJ0Mn7*kz#Ye{uE=oVkpKwSxYhUlvC^v*ct{W@=O6dh~gl?V=2Zy!FTwej27TE z6h{Frq1XrTZHlq1HVg)o$M)`{7~9nw)-0HA26!CBy#NPMjJj>47~AqY#hn3fr`Qs( z927wwTfop1P9hwGFkxdFav9;|4S~ogcnn23i4Bj@cFb?lUd;EfZ`hoPe!#{Bs8F*{ zO*@K_dmzQg9ZfNECs2&sIE-=s8sx@l8ZmNXVDkXcGnr2#deU|gJ?Xqb^jyWu5IyNw zBYM)YhHYopH50^i-hi&)jBvt(pa%zHtka5OtkacZtaBvA$Tv}t9!fFlGKXRlI4dZ| zvZTGhk21M59rZ1vxTfv1AOQktFKs(%FD}p^koL-XOxpW1k4bw&cwDc&{(QO_oFvp% z;GUe3EuW5@h_UT3^%IQs51<&!c?d90mne^VWl)S97C4q6-3YKF#i-X|iczmJicJ7x zU~4L@oAoa`sW2?6V1{fP3o{|*MM4>9r)p9GBg-Dx`Vkv@WS)S37sVC2If z+0UP)a5Cz}WBkkXB>K>64e1L7FGKX9eMI_V6rWD|g8G{Y@@(YO(WY!|Y>s#~pWYcU zDhR<64oL=qWNfqRh&Ch{_2$!22gKOkP6FJIV$@eoG0KKfjQTF581>yuG4hb{2%M;U zE=@-p7Eo*g=lc{R=QD~)o3MYOEY_<=u`S@v6eE8xim~196l1$RDaLk(3*=`|jQU{t z&-O(cWI`Z)ktx%MsrOjJjccn2zlt;~g*t2RJYt+vP$r%3yb5I&u>o&=?Sq zOLCAver#^#G11{y9vi~R$eAzq4aLZ5K{1>-dy0{d)CKaWgC9*tJ`9pW{29x$d0rK; z5h@FzDIAC~pR^G$>We|5Bqx4th7LjlyB8zvQu2v})0M|~dtd~(hG#XOPTIbi$Ed4> zwwJX1H$I(=gM2nSZFv7@CfJGblz~7E_G6 zoE4rcXolL`dF zxs=DmKGbf+KJ;2f?6aJgA@*6pV|6$g;RFnU*dH*~GY$?+$9nuI#(Ky#2-2~h=`ZqZr$ZK|K(@OG=Y;5V63wR#aO2~#VFgCVyx4ZVyx4j zVyrWeVyrWgViP!%aRmIBj>}4{3wbcGJq@vL2^t;(X)j$HVBPFqlC-y!i161Yx~_v} zaz?nQgkS;(V&o$}0~q;iX*%+uTcZr}O{N&zGL>R1yIFvDQ;a;h6eAA?$w~f9^r!j| zo%8v0qBCt5*1_gC(nouF8PZ3%fQ4WJ2kUFnuF;rE*I;E4#X&HPBG?VVC!4LL)%Mus2`HP^C6=AIv+5~ zlItVj8lGrgrk*~h_;g}V>KnwKv@T*#YC~)r8^35H)<-6YX}_2u4uU@r%;8{ro1&d1 zv|lU{{|tX15dD35O!@^d>PY+qFzW9DhY?`Z(T!r%#h+r7pG`69h15)*j1ee{@_T4H zw(kwa*ghHd9mtpf{)S?dA=d>+$2O7mHejslM=FEudq6R^Zo{wQ0*w`U< zrftVM*qll1Onrvf`7|=nIiLEB3B=j;7jQC!w7H^5sZffU#UBIE(;eU2`eMx)La^sf+4Q z>Y4(X5U>neACh%@7)d7kP#FP6*$_Aoqb!k+g0&b7OyZM(rvWyBJY0v&2i%$B9|1d1 zyaBK)#ajRmr#KrhOp&B)A>bg2O92BNN&gdYEX6kfFQfPo;3SH1FCPr30|wGY!06XZ zXBeLRbpg_Gh>?B-d=#(|9Aq5@XAFotfX^}>d`8Q7G617}QRWd~#)F?VGoHzSi9B`) z1cK-Bc#x__pT0lD)ZK#)cFZGNdIrx9@D7chO*3mZp=&sw?wuFzJry^Co$~p@4dvGq z_79uxJ0$=&zxzzp4GNIr!c74i*p>NndxNq~6+gREbDa#q4x07rBO5o;J)QrlI-x9M z!aW;>>7S{L-|^5dESzl#&ANv1!1uqs>j~Af(LWH7Y{rP1@d<3J>Y6EdtsJ% zM|+lslLA_PS`fIh-}I=nG#k5xrOt zDP{?D?rA~6lcKy?$$I3qLyvU-7b<92vOz*J_Wli@KoGVg_6rUF@{p<(U^ZthMcebk z4rN#>X}^3@06K_2T!G}DNPxg+CMQciH6mKt+ay!r`FLOM%0vm zx=E9Qr%a(s^E#sZYW;KOgYol)meuBxMzMhjzrBl+7{RyeSb1&D8eKh7ScaP2y(D_&W={c(GHL4OEq;+JK?QzwOaPl^l+ z^`0sZWwH%T0ACQVry+Wgz`?)J+=e9^B1Dh-*PLQu)^2nJ;oYY9l-h2taT5Oi60<&I zIo>HJMFud5hU_H}VzmoO)N3JIXb5B)Vr@XI9u>dT_y;0^5K|8gKuQS{f~U^#4h{2f z$P_4#{Rg8*AR^XUEF~m|wS%B!orbVtwRL}vxK^Sb0e^Xh8Lg%P4UyEBsz*eoyDyT| zm8eHR=Eg4))Rm}1fJ0k6{BXzzvu+W$>K_Z#qer^h^}?5#KPOv{RID?91NVj5;By6V zp2IfPF7)b9k%}>&bV6`+fY>e#<<-*`Tp7xLK|3nI92iOYQ8Xn??q74Y@RLuO66Ply zFGO=(D8X0?h>Y@vCpe;7J}*(zwAu%T4Hs`Hzou}Vr$-Ic-B5l_Vfs9<;c5k$(1@4v#wu2Aw=;LW3-yR-#AHomyXn;q^B;>)vX2kf}C%ie1>lWK#2Mcm_%KGur+~Z`SbzqU z!*CtsgnX$2K3&LXd=o@`n`s_$U|@V+BED?`zD87z^oNKq1M={*9u^p%g@`X#z-Iu$ zOusC>y6r87yoUTG1LUxb6C4KFk@tuJ@{7j1lrr#V9-&Fx04kxBx z4-wx-$ivS%Szvtl{c&NxHG>GtLs^DLgB)TfOoZ@SU>9r;=AoS(M0~A)5A#`Id^RFJ z{K5^EN4uckFutcEK3m9d$j%Q$d@|r;cE-nA2 zCJ|rkXY~6;#Meu}XCmO6C*o58UsuRyf!S}ih;NjDuN?@p_FjWQ02DRzX)Z(<2XZoe z5#$g%VIqVnz{mQ-4C0uF@dF~heBf)yul9-fq6K{Ty#>ZM2R=9y>WA+z!Os#|KsgLE zArY|?Mj$KzK1(>GznH_B@r@JlJ%oH8$Y+7^jTZ6k0lr=!gnSloW_&gxK6e$~4r0Ep zBEA>EXGZxt3-}s|_(lOA%CW%o(-!d=Io0x^KQR5OL0|Y^)4$Qc$2gFa;Ytuf?1YIB z9Gq(V*An84?~aIX4)Arv0yHo_d{>N+&(*1x&l+SI-$4=I=FjN2U&J?Dz=vx9#yV{UM+6JpwG$FADff zAdLmacNY>6JJF1%0N8xx4rz?<5MUwSD&Q-pW$?uK@+fw~LRVX!1Mjq!DZIQ*{}Z`&XPfA7HpV6f{(GIs z_Zf@>IQOH#t9=3qFrkB8xC>I!|Pi|07Aa=z?TB)ET9~Q zb^s7NVFbcO;F|(x)NcfwF%S9hcY8vxI* z3`<3P!-0?avnS*;{U(X{HbcB2{p2FPAc1~f0=~W?zHJc4`IZHyUk?#qlt906Ak6gp zUNj%vg>nt)=P8;GmI?UA3;66rd{2STlqpB$Fls5{+brOlNae79bKrhK*uVO)E`v*V zOW$mRtWU-2Vth)UAT!9wl@~|V5w6R7~c($L+nIz)Ld)VFOwjR@u`Z|lS<%gsDG>U z>hhTbAGQPA8zkVn3UWgIih<9R>VPM#7sCY+pDpmQ@eu;~OuuiT5+NVnk3muSa1HN65&H}TaxrnbBkl{Rvd^6z8`eQK|3zBNC9~XhojFC|}jK+f; zmT|%egeky>{fd0(4~)-O#P<>SE@J^2P!7Wc5#L4NON4afn+<2iH(m6c<|2%Hb0naF z@r8??(*zBy)o%{SGQRO5K70s)Yk3wJ-xv|!dEi?BLa5(dI5WN#Ms@9X6XNIxEHJ)h zkdD}iW_S&%?cZ2PV|-B}z6yx{Ov~Vj@r8-_QU!eR0=^xh_AY~mB#cAImnmxRL*PSy z!}cx^@U0N>B?4btB%*-7Vs?sS(HP5d)2!3+X;LQlnYOc&l=WsHo;KT950&8!fh%X=bMu8COw;ax_y{RI;iqGh`PQ<4_v{pYHcZ@Ga#HSC9O=HSY zIgGOVY$uFBZ~{IU!bHE7aAth?E+sTSEHg;h1AN%;EU@-A5?zlJz=w9m_O606<9n)G zmrn^oHjIqQVe|pWVHqckKu85XGdLsP8aOk)OwslHHSl2`3k?4%x}F~eK5Pf_CBd2T zEf(=r0ACA6M&&RXFXB5R;7g%$$R8u}XMA^#7820F^othx^Ht!3s)>H<;mq`#DB^1c zeBUxMDu>arBEHuGzF(*u>Zb<8!v1v!J`+f1f$3K*;*)(>>o2Jw%=Eh}(k}@3@V##= zFh2YZ0AeSaF$(w=0LK1Ehcn|-iuhuoGvJb56ByqC5#L4NWA@uD;M*wTO9Vc@8aBRO zjHZbAUI3pZq@#Yn!I|l|1^_mXjgQyBX995+n0_k&AaFvIHP`Jw-e4x zztJMTRltYu1!RHo4HxmrJZkxHJ;wO7b?e%%bDM_krw(#h#)($+0{F0fsNWtqGrpIQ zi0UwZaR9y!v<#k@eosM8$oCQW%pf26_E9c>!NEq@#WZsT{V~1=hDh`z4t)Y`@+hhdMaHf#D4B`M??Z zlyGMHwHNW_n{ebk-XKB(Yi}D7pCv2~n0|*rlJT7s@x_`p?0?5ad>O!J20WNllh!_PZMf}Bu46R+C&;HrSHyNE9d_;4Qt7MOlkBEBTx zTL40+-*q@M{T}Jp)z7O_!~KiTQH1)n8e8jsHwAn}B0hiMYiNEc6!AF;_-+gM7K{8P z^)vd#i~Pl3z;{=`=P%;h27Hc?&jPj)gSUuJA>g|Y`OJPzME>#+_#mk!Fg|^ezib1( zULb}2@et08?``9{{qYg_JZji@IgGvpIV|IZ5eN?je2*c{_(qBJ8*b6Ce#1oinT@NR zpPvf&>_vS3z?X;$(7@VjE#eyme5}3CK$htzZBn;8P z%-UgY+3-3n6Xb;Lh=L1`JCs8^zlSqx$0HG+(`WeZium#cd>;gS_&F7b*0k3P_yo_zIFqx0cCfy{bmY^gI>$jA_0xx=o0XNli6B_k!+c72 zTU(N2W$9>VO`wnVJhvhJB@$L6);+PNexQbTM)7&J7=fqN(byrPkeMV(5JX+B)Rz}z ze}(@83&du_p5299j0*09iMwRuPOq9bwKzvjou6gJYjail-{aD%t5cIxlccFqE)E{i z1vZfd#RnS6jC}(eui&`kwF!%ZXRfHOPPR|z7~B-V%E0E3zB16zH_*U0P#sxX$+gW*3-DUx=6v>qlhj4#fxJ2FhSu*`vtWs|9CWQs4ChVM-L``=BY;ldH4Hu=BBZ@~?bop_0D zzg6ob)DmEqf9E9C)%~5AC8FzV3chPEOGvJD?Ejf9;saaz1~y9%Y})z-c=Z1ZIyZ*x zdJ;5EtE*eT=!JwhR_Yl6Z1GPNU0`!32Tkv$gel(KzklB}gn z1|_5wx|#E4>1OGGP?l_GmHyyslMhx*h&g? zC&)mH3A%ZEmGkrmKl`NXne$23TBcW~7o+=0>fWftHYluz=h#MNx&v$^WqLz(L5rb! zB}dN$>JP4t(evC#q(h0cL!*%PUO!p54Qv#uYi}(H)$6SbRrJ;i@jEkym)`p+^Y@a> zki7I_eN+h)(vH^4Bg%jl1-eX!#Z@&rXcHZV{YxFRi4I|3)*&xHA};@RRtM{5`uhED0uTiXpzH(tn% z^>uXd@pTR!@yfS}wQu8DD;*=@TKCG=(Aw9)+E@S4E5~z}4m+mr+~vH>*GRd`d4GK3 zO6TO;vGL9cyCPuNX>#el#_5NL0FY_L`?gU?;(c3N`!-AWh3SdcCw6Bw89)4<@K5TE zgQRHp+?1oaS~6W(^DOCp`SG5TEby@by(FJ>Gk4@ROMRkDP4y{|Zs`NIPu*damzk?@ zD9+m*Bi$co-xF*%%OE^cSs;y$n~4%TGnKjKc_AQ=p2N#0nP1F{ERc4zhm`#ikSLG_ zI}^`( zECZDpUQogAVV17)kX7dI6>%?~DO0PI@0)??%B4ZhTlz}M(HM_2 z!|y8}SH3qdm)0azW>{rDt(-f{AxruI<_Fyu)mAam<9)!gvkz1r$oxImG_T}@I~cSV zGw7g_6JEl2kG%asTY5@1U=1lL>8Y^B(>ET-nc^jd_tKNl?E){Y@rhe7H@4Cd`Gk8% z^F0omEsj*2SKN)4H?9m)yiPc~WZ%whN`={y%Q7ul^K$7Wt1Z1H<86dhbXSR&8$9yJlG1-NV_dmx;5>14@s!jeo2-TdMit-K<%)p;pLMZW!JX9xl!Tz|s3%P1}p9-Y!S6t`|q_0f%Z&oWUPbxzmhe~Jm2FeWQ z)E&wS$%~W9ynQzhD9fb|XDia8SHNsuu2tbtnR)Yx^5!9{y!_$_%_&?@g#f%Js)1L#7nyviPB8S>QIiOTKDT-&^mO3wmx#R9Du95XRm zW92V=4Zxl-2(-B7PC*7Hlj1TbO^{vy7u0&O!>S@;T=k2$%24!?P%WR+%GoC~x8*(d zdI@$&J(iepD|MSP*EMhU<9E;`tC`rOPtu^mE%so$7rz=nExn+Yn>(z4{I;p#@Mm$e zpGBL7KU2m?y>5-cyzo=XN}e;@@>rq|(2b&WwIQ;ekX}Y}egC3wBj7aP-7`53KVANt?c|{Drru3Nrt;DgZ_2LF<8~!$~@=fNB zPuTKLT9uiXGxHv26z0B!ff(0gwsMSe_#cTGQJJ3}??7&Yca*y~&;1fA3Dp{5s^8Ak zaNLNHfC*CbIGB^fv(^kXpD=p`#&wiGG9ss zPGvRBO!nA9%hT#UQjDnEouU&-}z`a(L8gdC{2#U~k(q)%#?IC+<8W6J~J ze-m(^fzDx8L#2_XjlnuYwVX~WONz#wj5IZvJ+fqas5DaEcnn%ic^ZVEzM)!!MwA>2 znezDl&_<8c%FwmSw0xdhm7K~PKh_8)E*xPXoVl&|Wy$PWW@S?7-!d(jO-g3_WGOR` zpRmo6&crSXKMiwJU~ljdpBw7oF~s!_o9dTTzITN}aD^m=GGX9B(kMYvr4JbI^a=kg z={w{hGbuC#JhDKUm!EkBU1Q(n(i2g1MmclZ3bHq7r7SN|WGYssRwpX-jos;#cGN_s z(pgq_O5@<(x79kF$?#$vqwT5bqiC0;RZ*Ps+{L`fMMwFmTqW!&SkYuXR9A2>ovC)3L(FBV>Klw|3o<|~t$&3To#b(TR+ zy5`zEZCOhVRc_}_pBzUunNEM$HsV9l#bkNP>=EY1vsV`vrkuR!eCDe1VfM{(<)db@ zMzS`cdSlbZI7&hrZO{YDZfKOUE+jciFSjrUY|$tap)-N0$;ymuoLC#(OjgDwOA>Rf zlFakAezw+!$#E&Oy$WZ)Ns=d?RywU$CY#IjWUWJW$AB~GZP3Na^hjm8xpMHPEIp_J zT6#_IObx$74S(C(RyD#_RVP&>uSgl^;5_c<-0YOnfgUCPxp6yZD09oa&;*=RxE9t3nyKq(k7alzS>-${Hsim>XD(N{SnIB1v8noa7Pm zKB=&BYf?mFiZa;?)?+O<=)mf9gKig{nKqIxx)#q;eks=(0QVcZkCV%FqOH8*#(>vC zq)g|b{6Tj~nQjR}4_vD9un^`~gvAkXZG^=c>-CJFoGsG4$}N3At6^nQVM^bW_9M&< zEdr8Ogq%o|L#9W4cq#%uOq-f>yxvPj!oX0MiMtP#RTeKpl08 zqX#nrcF)OODfYwleIvTRp#ZdG;bUuO_}T-5n`LPqQ{A(!jenFHz<>% zae!^mgIj|Qje6_B>a2I89+@dAFs4?x^P>s}n1dCJHn!d=)ElHvL1zN!ckM zD*clpLQaIk2vgt)+n_rDTtzQb7pG{w5Ufu(Hv-47US{&lIs>dY>7Og`fC>UajwWR% zLIp`k54IH1!>~nim>=rWXSjR(a|LNoL14%+oFOuher7#-@Fb+KJ2@2RQtHMsZ4Khc zS*mM$No3l2`7jz~Ex<=Ucx8j?7n0Hvp)Yb}GVBXfUKXl{wviFr=*BY9Pt1{h7+JiG&o=h@a+v{~s`<^oGUPCgIE=n!0SzeM3 z&ODy-Ql>3ybxmu7cDXc3x8?iyx*KF$+QJR{q~;ofueJPT-}d{CDoMrQ>B+@iH0ezc zzut|ly+H%i-5J)toxc^WeWN?ZcQj=e8sFott(x58@HtABW`TN{#x-@gwhYxyKkhD5 z8B%iritnhuGOao>Nq=RaeydrqPKjL*7awTAm(rxA+65Z0J2Fytc6GIE3fw!A%T*Wc zdUIE7kmeEeOuJcsLFH^mS50JZPpmySVYU`6geXj>VecJtdbF$_u zPNcq0N8X(pHgv7+70A_L!I2a+~H3m%@T zbF(xCPikqSFkEc&IzBaVN!;OL4sLX_RN(GKlk*%WjW_)!UTzw1Y8EdyNiUS8%iHZL zbnUeaO2((gE{RJo=60pt1l@t&bG8Oa1B#mR>QH{4!eGk4#NyQWLRY*y(ovu;q%tVY zN)%|5`cz!x->@tsCXaqSAM@h1#KI0_hCv^bNW2UO>;=n!4XovcvS#seeOV{CN3t$7 zvX(c2yDOPyXJQjou!$A1NvwaW(?X?_!Y{%3W-;+1)dG#)TA1hjts-7-G-i+NM>S$6 z1&k7h*Xe~r4i`GXb9m5M9c-j|xNwNjW*W1ghZ0Pk6g(*~q!$`(HNct+G!-?KDzLf? z1M&zv-qaw;IRz_Im@eL1KyS#8p0zMuAI znc3uW1AV{f%f;2JziqB*Wqxi?_KC?x-7Bsq3#*WTy)~%q#Terl#OXqLUgE2a&?Z9s z{|Ec9HVXX;F{baS9^Jm5qfW=Xi-#`c>~tOOY3=;x_uXo;h1%+SOk0mP_$$`hww=LY z&p!%P2klR6Y(4MLp2-C=y&T)Q+`{CzKVAI?XpT#r-mmQbjdnvmw12l(;b&ja+hY89 zw@%j@_j!?fGu^mut>~-xc|Qg*7W(t&WcZTx%L?Vc%KY!OkI6Zy%oja@Fg~#-FNA>@Ve2({&n0?zvDukg&1wZzIP?Y7{?$^7s~SzUuA?g5#q1*`RW@& ze-PrYzQND2!ujYwW1O7&4xfC!t=sdLww-$`ZcMY&Je1wDKsmzrho9#@^>A$Nc}x0o z`HF-+xqmm=o&0^|<@9Gx3-_g(rmSq6(rUSUf1lNGkIPLexOdoU?%en5TtXHW?sm7i zo>86Nv9NWO`Pc`~XHFcPme+geWS<@86{dUpsyoK{uXowAy8WcmKEISbQd7&(SiZ0b zIEGI;yK%;S-I!+ zKm2rN!20H+7XIeGr|G8*Ed#xeA2v@2IJ&9B%*#F8ot?X%SvK+9p`NMkJMLfIo+q4t zv7Rsa=vP1f-|K&0>i7RL@5~%IwQXzn#wO+_9sX?pw&&EyALnmK)SlEQf9tcfD`P%v zy|mZzZ`Z+t9!(j4wL{_P*bfh?XFFR?fBS5VW#^C6rQ>4uX)dd7cJ<`sQ@7rY?_|7S z^`SWz4hYNmTAxZO80p&MaQlKgw>nkD~olD2eE#1HU+|sqdYTb^HYCV3` z^71Z?-DVy>(OPcQqJPEOPe(5wv8$LnYKy1)+IYP-iSK@s@7*-paan{&zc1P0tN(xX zf8ljqh}jq!`Bc-YF*jgwM2psmowoe3t-V3cyylm)4flACDwjrdYjVT+{_weB6B?O^ zI&6w>vwv9!^Hc4v9nVmEa=yp#L2Y4mTpoLxxwbS(MXb)rl*sRUG%s`P27FpI`M9U4J`wRr6L%PPaL(FN{a+bzI7L z+w3?$;P$S?&ole~)!p`HhldaK3uIL#^RC<(_HyonO#>8@`xfTJ_4qBl+U<1E3;$NF zn~dz$!C5ul#UO6QOw<1T^~^i1ct1>i{Vjj5r&XPFa(qYpd3yEoC)wjSAAWB#z4gH* z0Rd`{RIC*}^^eS(yklRF(_6k#+cssYaogRWX)lf;;WINK7LG4rx)3uve~IU-3_nhV zb`#>S_W5cbp+5-m|90Q_+r5XEr%$H&!lL*t-Kyiv@5gSsZ;@8E-6g1K9k*_1OoWzA zc*%Odzx2+X*uDEl%TmpcCv3LgKi_xh(MMNuH(bjsS@m(|&~1ee_8))s?Utqn^Y#{} zEIskEt9DwCZ!*SBDDRT*m-M*A*)~Jp_r-=2F4jW6vD-&nrz=a3=myIPx$^S{*fV!_?*aVxbh_Gr|mELvmKi;QmH zmYm)0*Kx_k!6n~MboU-K@cPwV261f_-yh>rTm0~=8TU^5>QlSu(_0TcRz9`%^PJ#t zJtmmjx;}o*;=R`{Ptc0{BfIqg{cZD_%NIE}@33`<^Y}ia!~em4IB(;72QY}SaQ^?C z3}3Q-S)u$_nXmQ{`hyUE^^LE-@n647y7relK4Z@wJ-niz-Gwfi1^c2bPTRaVc(z;- zF*u`q?ui!5E#BVHdpM-gF}rt5jy%2Ih6_C0+WIH`4+pw5{rhg!#m1xE^us&%8PP}n zQf%#NW z9anYII()d?eZ!^;J+mD5^i)sD$PC^Udg<)YK~vYXX*$W;v1m-p{gtWR54*kReD^#b z+yAQ1rJu}pK62i?ct%3w^Lo1~jXkew`<~0T-StvqSNZ5;1NLe*Y5KO?sw3A%b^G+& z`DI&A4eh#raQ~CLMi=kuvE8aXAz$AmJC&B z+x=p*eoj+a#jV)`RW`e7{G=1!En?x|()Y_lF1PH|FRkyXrsu3D=$@MrZ-4LOpkA+6 z?pd;W;led9wQaja&HW)QGjGw%Vd?kgJ@*+Nd*Qs*wi8uPwOeeQ-0k3s3poz%+1nQ; zRjJS0xZ>a^1FPOfjmJ)ZXelXO*Xm2(L&f>=OW#Gs{G0D{&-6a`M`fE&$sL+kHJ;i^ zZ;1Px^rn*Dn;OI0`#5f+@%W!I%NuzeI@ZtjXLXAqckfIoDKa|z%^&@yT)_Mz%C1<-j9>e_P?$O_E|6XN=(c7gJ zuUAfX$r~DB_dwP;Y2B}Fw`2Z}R)cSR|H>mrJt})#Q6oM1Lo=!Gj*nN|`rV2hjrqOe ztFn&VJAKg%ejh*M#kk5ox%al^OmfIv`)LuWf9xN!US}ume3?IX&yR`vIq7Q#th+yY z$=zq!1FuA5dFQp|*Q&ui%9-N}ZrU^_ufTrLXHC12 zw;mn5**HJV_^G5t3U^}mk!ioW-FiK-5X)z*{_B#p<+o>Mx=7XK7IWjLEl5{a_y@dK z?UJ|~^R*vzT{t>+&a6g-+oJdE_%QX4Bj(FzHEZi-+yC@H%=h!on9_fKzskz3KO5}R z91}IuVuNbJ+zY*aSmt{g^IbbP9(%HK!7m>B-SfvB-#zD}wu4#M9_HWVYxm2={ITEs zUid7$*R8*=xV0V>JKgSK+o4@j)L)lQ)_(zSi{m)E)wixTS#;!wr&l|k^-MF;9jo)# z%l$)>3uRweR2j*xzgQEPN#)ceujzU!^;A1w=?rJE*q5Q{kFxK+uYL9X4dQK zjwP7?fBK!>@ZvnRoWbYb{a)0*N2;{P*w!0{y!UE<@`g(J51ke_s_f+y{K`pZQ_`s& z8SW~&tqgtF?U2ro&Ggz*WOy)q)r>oLV`82!s=i}??aHF1S{>(Hc)McMkZ*>iRGClw z^di(=HTbVJe_qa7Iq=2C_tX0QvSZ8HzXP2$Z$z)|lh&^H+55eIy=`(RWWor$3x~Fk zOFy{gb%n~2%_aj!J>DIErR$Z)Drcv+@_n)J^)ExNIwtsq9vyR0bwa!Fd0j??owz(~ zgMa0os?A3)SlI7ZW{xdd+Slt+xmR+)J4H-~WrN9^6?W&ivn@Ba>>I3=68U1Q!R{(Oqsw#j{+R#vVa4KiA43xl z&g(n-+Y60PTfgeED%9muR>~c3mjesRKd$aHEiJH*${ov5cFVP|1*%?1TPyEbA$w)h z%WJf4`%TFcjJhIUh*Nz*OwXIRL zi}Td2>8ah)hP6$I&+PMeZllRRE&D6z!RZD+2MlZUV?l>T5BHZooosug_lCO@ z+UWo3dV7@lFWE1r4$0b`bLX&^@`G)^Z`R+i({wIqzHh4jQ@y7L{whBGyzl%LiibL# z_U^xVV$*g-|28wr=I++tXL{!RCS$E+w+aSm=aw1ZHkVgU+iCh)9PCCBKiAu)@z)-9Nv$! z$X%niYe->q=i^$*&CPPgnm<}F>b~(c2g@trowd{FjNkC+&;B~z^L2a%+sEubG12Vr z-m~USX*Ta(t6@H7?<~qM-d-^;Vc^QOTe|)jvfDAPal+n|+#g-m|LAsqaNl8V+71Yq zIJVu%Nbi?Fx9Hf$_SpA+uYUC!-=u5N>v?%z;}(Q@XZ_ZF?$vj<0@a3QJ{vQm#~h z?!I9eKTmkvBU$B7o!)oa{J~k>mu+`wrbLs(d{1|2}hl_{X)eT{ZNZ46S_EF(CN+N$JzOt~ch! z?X>)+h0BLUF0qA2XMEp!{_<54?|4W1@aJvQUR(*$|Nhj`bz%C$4GheN4Vfix+9NW* zD$=Xp|LyNA_g~3%j=s{?zUkjjax~uU%kQ1v`Siu|kq<^p|6$YbM>;ROw;|g3?TiK6 zMtMFQvAZ;*AoSJt&HEBsUY0aE)oRY$;X{TzNxVPw`1#pq2XpJ-9l*{rwG|+sA%rn{;~HirB>&Q@t#;wrH)g{usEi(=Q8N-%9R#nUs;=YztShy>~72-*QW0d-!(sb-KINJ%4~dRdnzoi zHrjX~H}khYwSD6DA2W8%?Dp5IX*Zty{X^7=-QTYc-KO@WNwGKgcJFW#^Rtp2FU&)S zS;ci*<=(&B#eIHr9u2>=Y`@VZd%x@YD!Ki$PW|8zKcLH`Est#4uYCXWstott!yXOV z=AjkYt;OZ6)c0|>qSy9F@w=Eet3^{=s~={Mn-J4w{u;x<&80VUMlTuj?7OLRpBiik zzPkJJMXjKLs;V|&=7T0&*`mJe@1Y--uguPPs_WnLyN{pF3|6$9Fn_&A@TrJtZ*s>O zwQtei&pUrexNEbr=jDe7Uh|(jcj(G=>p9XhegEnldUIHSZ1$)=#+4ri?U^-hnc9Sw z-(Jp7iSpRy`Oe!TNT=v#>-@&wZBxy8bL{>(MP6y8o_Tw(z{+R8#16iA^hT4rFZI0c zcOH9KbzO&!$;RKd)5-h$ry~~YK018tI=^?-FTGl7jVbF=IM8A5YL}%p32h%sGFvyk zF#JHDC+AW|oEtS~?W>zMQ_C+c9)4_`-CSd*Ci8P`zTN!0>Warzg##R)tB*aCc*sn5 zhQUa!9c{Z^D;VyceJ{4vg3-}NPu^ad*ypz$Z;z`zFt{C1;=H=&_W2j@4{fK>rE=ak z7MbS#*Uq}q#B)KZ($n*bp4N#s=YP5Hd#1&l#(!$YWR1LOZJMe)<`8GvUhmw2RvzkS z+Qe^-*m9)fp`y&3{iOkJH}>~$+W(D1-(A@gN?Iv8P4Rnl!96$s<%Q&Bht-oq?@x>m zy*KyIALNxWk}LcC42rxQUl+xUCT{o<12Su2l? znR0o>!@#CWr|4x1=5BnQd3pTYU2Cqm^ojIO4ea>dxoN*U4>KlRJK1lpvASya!KdAS za!$OLB%8dUom&3*MSiooh3GB0-YKxJO74nzQ6G)`Q*B;P9^T3|VsWmbuUpG+7pfoo ze~5d>;L5(JjWg-kwrx9|q+{E*ZQJbFwr$(CZQGiEzmxatR87rH&H4J&{?)VAxo6*f z_uXeLK?M{Zs;^mWhkaUOrrdcm?990x^|q!etOVd{#~4kO8cv~2x_EqIMVzQN*GxMT zEwL2D5mQCt9G0)+0eTWY$eC@t++oK z>~WwNGxc?psigTjd%b>6AD{hAq{PwHmB(Vuh7w7Z(utK|UrqEfD91DyrQq;gofVLO zEWY1%4jhqJZE@`GYV6uq(37avS}1M1gGfaoVjC@R@Jb{7oeON_Xvb zt+~7qDN)gA{@Nm8p>dR(fo_4~XsZM+f+d&Q zS*jA*bS)RiI(MkLOzsaT;=1jIBOx&cCw-IPdl%I5zxZ9D8gteNoH}DBen*&d{wWlq zRp7_?@ph#_)?Q%l!l#Loi(4jh179x-;fREs6|;P_-f1gSG7CzLAx&%g!SW`ntKf8b zr_*=N5n_=IvPT#%gIUrHlx5{PK4TVI!jZ-Ka&7u`K@5(P3n~!@)6DG1^RS7TBYq&% zZy+Nx)xI=8c@?$&$Dz4m8??z+%5PNxHc2_rcH{I#CR*q`9*@q+`ENWd8uLX;%e zFcF(hpaMl@bt{J)Ri}kpG?sXR=59oBma%gn{P#^+=E?)UOnAqKaaE`6_Ku2(Fz3{2HdX<@4zJNtvHE{5hnfUDImb&9p>N&-XZPUox-G`1ejfj|= zYQMCGMn+#An~+{?;9G|A2k0>%GLS&76JJcZ6U~h<7@`P`oJ4t&o^_2fB zVA|eCEI`Yq82&uP^5Js-$B8*pYV>k3ac+zl{a0bHGt<(jZgZ#~jqY)$K9onZzN%gz0SC7Iq+WiSYAXXX_^n93EP0nKh3>wAb z`~-Zmf>MSIVbg(qTFHf6=r?eMpMTXws6ADG(eTznwXHElnoJQ1qy{R8*bCxmP*(M> z7RZJg{8!Az$;<&@fI%V#XB!h>#SEl2Oti#S|JplTN!H^!oa+mVNR-GRwh0DUk&8He zIE{q8Kk)rKTg;ep$I3KZb9^9PAt)E7+5jswQ4(qfR4%SMN-S@rVaLf?0U}f&WGtq@ z<&QQ&!+(1q!G;sDy)M0I%H#cB8nuRw*^RLTwb;0qy9n1p)xA3mU3DGyMtHRnkuFoX z{EgqEWv#2hsY*sfzC+S1P*x%|$%)0V9s*Md4qayi!^&n^N9X(@Sz`dh^$cGwDtQ{HiB?F_E;+96#FZVZnt90W-NKveB7%P(K~U z3NM)hinq~IyMi|y@5sU#8-~NRx;Aiz1C^L}MY1MJT|X}D@f<-o_|j$t!4gj?X_uAN z9s3_}ONL@GSb{|1e)}?njnSq*mWIXpT;&U*=7KA_Jte;W&Z>wi zTw%igG67TLEi=?4N&dQS)~WI+q5^DD8ToX-gHygkX%(6 z7MjKP|Hiv9|Mn67-*`XfABV1%=A4Y~WGzKPkYrs`#{?;e+?CdenbAxI&cW4vUmfOsQ3?y}xX$at_&+fKpP1k#4abC+&ZOIZTsqimJ5n={qM#3=4(J@uv-mDiuF--> zwhVw3a)nWJl5w>oP*U~r9N-NTbfMQ6o+w18$UTmPOliP$8R zp*DDZYlY4%c=PPT2FB@#*umQ_E6=4h=K0rBfjAl3PB~{qemE@flQaNdjKv4m zcxx{0jMPK~J4+WuOB?Eh^9ffTd4z z$1PYtakUnq{4K|W4{-!1!^|b9eEbCwV=Wt#rWKs_wVeByhjQYzzd`U`;L+L*_ARt6 z=K`h4{7XL_95Hw*&HTdYN!aSg&ym`LE0=DqI1gK(`NmzE7jIe`3hNFP%>{dgEH^Hj zf3w?7++75^KiZBzuCKqu@>{!_MYszeZ}ICwi@5(ZuhtI-H*zH1KI{3lW$M%g5<@L8 zGndcYUZPB*YV_9w0( zZhBXEbUwKx9PAydfZ2EtAgD(=OW+hsp2ZIa4bF2}f4cXt7iW$j(zOiM$M{*vW9vCD zKZv1upjTB<;=HTVA3s=b(0?rw?*|^>HA8?nrcEnvo_oOx9{w<%{0cJ~uxD)uJxely z(%LR@(kC*Kt6iF6eCK>Aspy{xDJHVd_fYQrAnEeGC6n4So5CgN=To+UiVw zbg6joHQd3#_V^NZW!qRo9Y9E$rqId`=~#>r>F6CQ+^`0DvR2rI6QlWD3vK@n;krk3 zEZn>kJNU!lWbNn_Mfhu9-k$pmmDRm%O1_&H{qeEn_k{s@cx=X@J&E|(H4l9ISOVjx zHsF?$e=iYd)Xz}q)F>kryRcU$_rtM=;B))0&>d4d1A1G|owawohLlY8Xk@NvY6ht3 z)(S-q@NQ!!Ku3#SVqBE{JR5(x1Xggqx+zd_8(?bH*>@$vg;uR>JtD(7P*x!=8WBf!k2!GhZq*rwTk z`~Z;FweH34H@b}~27+@#&1sdm&>0G)N`@q%;;koyQ9L@0XTb7j%hUyTj^OY9#3N=%J~(m%I{;2 zVrU-G9z6Wy+3~XFv7!B z^WfG2CnS^UjhRUU%yIG7N41f#q{P0{Gb+-T4x2=Q&juPApVYaKYa@(;A;|0G_+K?o~fc&2(T$=|kvd!uQ1k?++fXXUi z={P(LFQW~JZ&wr{1IB~y*cn&VHCYjdA3sD}yia@$zY~X|c6Li|ShS87+B_z(I2mWu zX&pt7`=z{YB0y38!j3i0ohQqBF?{gHORguo2|i}zSXl&JJAI zJY{vvVX?H8dZ(Btb~(fpxJD7;!M=IqihSZk))gNn7RY(sl-R|6N4ZW5alR3TUoB$W zq_Jyu;*deXUATVjhcgkS)`$i7P`yewOTDuKd|mOd+*XtCJvs?4r(EQ0!W4;S@TEMn zYFGBuk1R4+%wR9+`;@0rtc6hT@j|!DR?Z ztbR~+Q2yHVe42Va$z|@>fY8}6=U(yQ?|YDIY3W_2tMXEvUBHqen*YgjYvMM*3c*&w zvj|sz9iW01E}8&Q=a}7{Z5y1-2A^Wr5(lZR0wX#CqcB)9r^*iCQk=}xHi<8(hD{m} zh{UXj){h?&KzsTaG&y|7cRnM{2AV75$;mRliFUAsDR4-G)4Xr)5&|E0jdVYFi!eb* zpCBEtEl&(hBT~KP3VjOk+Zn(Aoi`W(ctg%hRh6sdpuUw^tz!U7&E>d-*20a)e zqO?&!Zh5kz(V}lMB=i$1#XjIhhoV231etY`(0us2o?#Y#;(DjxKmw176?t-dr7MM; zUMdf9&&McNsyu-L98|{0%);36|9v(O6=`HKd=KXzV!1*~bjOh?X3MZu?S56WW^3>h zm$Njb?C0N}b9p#VXM>e6p$nQ;>4&SJ>E1-mB&{+vsIm1q)4%Eox~spsU9wvxM`<>C zru}dSEU6~gf;aXI?H7OiP}A3{;b*3hyFh2Y;BUmV)#f}L^JHY@HIn4jC{EHcovrfM z_}1jJXMbfz@qUw8ab^~Uaz@x7H*s9y{i&5PVEEx!EoXhtv6ujj$)ITMpC|;!Jrk$o zjU$+X(vs{Z4CW{8_*=If3y{>H8#RbIptC5dX>{lZOZGOW-zDa?=dl=d|8VTp^lKz= z8&+VHrfSUE4B)NJg4db7ObypS$CLzFsoE?T2Dm4)%nJSp9&|Gt@n(C=ygBW^C&PmG zbYhFvkj~8g@$Jqk@NW(Q5DpBXk_q}NKTt;Bc-u>E(rPAxP1iTC$~iAh4+33M zy9^ys2{|W45J91=KIo`d+;j*u;p^xRM;*41QDZw}kt~UgI+TSzm$$*}`+O(?d{jxd zvP=~@lw#tQ76hQvDoU_TxulwzDg;L)TirNF}mL6XVNW;9zyddk&3d_?C;o-GO!ZcXQw6Avy9nIDEWK3u%}R@kU^DC!Sb-`I48%b>7O2oF*5 z)vAMrHpCcr>Hj-F%hy*I!pdmx!nusySq(mA$DsdZGPOL}`H1k1!SIPm((tt~-Sb+Q zq3kuOw;%7OlUba{K~{zIb#pgLsRxswyZ`Y+83Ly>od*aGJvw5|5>jZA!1G@bYhv8H z){b8+w!Jzjq-r^`z`pW9FUr>Z(UGx66?x-@Tgb%h0OOA2N5#keIzRbgaVUw-f;C7Q z!EzbyWq;jR;hHXSU%nsM)JYqyJjIOvn5NQR^h+$k2z8>s8y=onDOHy;NPLw(p9GGc zjNKZt`|%UH@JWJ@YJFA{0LcBWTqxbgx#8HiJbe<~dApep2DInVbxNxmX#8P^@5<%| zRb;q-S79_VN~cE}e+UCT)H0s&?(odL{UT+=TG@Z}2x*ojO z>~KIwt5?Nlg_(Wc{P{EZu)f5g)7C@e#0p)1#5)s#s<7#YvlsZen5OKb>DgXjgJ>=F zf&-rGpP}#Qk)=uqf`h{1mKHj#3F7*mP+>vm2H{|Gv6ADva&qy`|9A}5>?i86y8pvD zQ7FCCi(3vN6%bhl{X#g)aa zt|g)AJzieybVq#s-}#5IEYDXfdU8aR!_6?)gsYi*SnS)UqFl*Oktg7WyQ48APMn=T zy!`1HO6DpnuCS|Z6C>&F#)7u%W3w*&P?B)rC(q5GVil?0FNn?~fO2O~^2Y*U##DIe zl=<6miC|Qg)>*{;4ehab`Sv>2isT*{ZnQu`-$iSA0e0tG(P(V`<9qZ!ajhi$Asxk8 zt%67<$Di!I=S>`K)J@0TaMWnk@XD!+ykVNU5)9vb2gWglE`TTw?xCO;AOS3HE4l`I#U{_E@c?;^0Q3aC|5x~ee= z6!8qu4AX#@+N9U5IZ`WTbtY!a&fMhpdoQ3xG7U+H{Z7q+(9;UYb*^U9bipkF4jw3V z1p(d}qF zmg~!fGq=iI|JF(^o6+vBif+CC#8v&B1wlx76lIA_j)bL;NI2nR0#ws;57N^Q_f8_p z^8jV7kiuF&pK$J{NLVn@OZeFKQMzp!Ol21b+kdBeB6s@3`M>+VzKshvOps_vsXo{? zPJKO~B1rI4H3nrUEmKSrohYlM#ySFW(Rdrms&~!Z!suGt@xx|hQbDQ>jlKDna$Y^GdKLmpJ(lgV?K_44WkB|PbV&QMIOu-KS)P=x$ z9jd}CYMjJ#N#KSDC#6b>#kBJQ>CxIjwf#j@N>R#*ikU0fi`0M}4P-%i{3R3`*C#o~ z>0s9M&6myVI;dK6s_Jv9+R+eqV=ayCXnmnWzw~o9qI!xwd_y7&>n|L>-E=*VRVS5v zNTdTb6gO*e(ZHCB;f$8Y`>mW@oP0*V(pYtArty-PF1U-HAYb}r@TvjM!VaZ<=lcIP zr~f!Dtfwqj4)jw(*SN-$<5zlL?z?D zF`pv1i-o71nyBMG=>eOrUr#pP)>&Uup`}qq3+}&2BOv&)=LNgCZef z`#l!DLdQOvs2P;U?mc9lhlZ^C(`QtnOEq)3O`{e5w{G~qssZrtk^R4_1Mp8zwIn3u z4Xbjei`xxRW~ojOtp;ZyI|IJFQTY6y^J~2`*-`ffiu4@oaC(ZQvnh`R&sdE(Pu|}k zYtjG4!;?C698l;hvn8TM^ru%$)ULa1Zz2Jw{Q4mLpDCll=vJNW+O0AbkgXz3L(b^U z38_@P@++Ou-^Tdgcq#20-u|LJT;?>JX#`T^AUB7SX(~ikw$^$`)qncD8-Nlpa||Y= zB6gn;G!{`XMtRAH!^V~Ud;HWt{l#ggf6nKP z<)>!0xMbo$#tVoHX}*4z0l4uSwvg~pC^j(t8@~$89}@t@prc4zH8QL-XIt7)$#=}i z=@*_XAMj7dL~`$}O3?j`OHXXDHm$=$5$lrsGDdMcVmtWyr$41%8IEFgx~%CimqIm@ z$j2bnvcG4#UUD2`z5UbQ>zf7RECBqI{RMf@F;&e`UV09$db))S-}v^UZDfjv1>{4-%?piiwL{W49v1M^Y1kbW zisXMf!upc=pg=*c9+Rw|ZSLt53W~K3AavwgP;Of0Kizuhc~5*YU5{Bxy=Bj;NS5(W z6WTttjS+5v+P~6S04_3~Vw2YATp*)(%~C1DCX$~i_=)ZKoI7_8asTwa>v#G$M9dm@ zN#X{LQAs%WP3^!$DbmaRw^z=8x_LgW`$n-ssb{udU>(dCgI*Yx3v`&>#oM>f|J*z=LFh4K zKRSt&93(%eD#T;f{HOmvt)XyywTx>L%;-quP+PhDYx^&ESF0B6i8eA|Kgd$^BJl^(w8zF|KSw72+J8%sVv$&9;S#+k zqH|Tv-tPmY#lG&*u2wZ-BymbZA;hgVnQP@P@a|sYGRO|rFM1`0;Nk|HZgf8rGX73* zkbr_sm3diwgYttI+Zj(gt3I#--9QJ4wV>!Z0k@(Yq`5eouKzX9`Ujgj7OzW zu$3vyhW=H}oP`(|`f9cG7vLbNqEBOwevY7>?wh_-yMioan$}SA+b&n+dra6?Kx1Z? z;(`Z|nKA_c4qTB#(~+Ld){h;gaIYkp_(BCG)CTKQowIZbdAqf`8{!tP=A86C0J6Gm zhrAseS}D&hcOu3LBi-R-+ycT$Bn=m}an{|`j_fQN1LbY(E_0N;O1;8K+xS<1O=-xsS6{~f* zJ$729dABGXx!)2K=S-mlpz>zPxkGB#tvz3-qA7If=Y={81P`74{L*4t)u2G zT|P$h|Afu0n{SZR4D%`eLa-=8&|jdz@M5mV_hBpRTo5|xI~_bzXZ%g#?N)vK=Rnb} zi$!{-CSfzWv2W7}Ozae!4qR-=r3on1rUk{MU>^Iv@Z1fM*VkqU6SZDXus0yh-*0u7Q@e@`W zUYJGfPN@-9Y)Vo(sF$`nB1d?_*eYdm99xHT}(*jk>sKolCk%2x$7`HvDUp8IIQU&;6 zV+?jfMX~324e2G~$1b~NrJ(cN3G~;I$J=9XkK`|-6T6I`Jbo_-lXnt07^83#YPI2n z5g-=IECko|7Z8+TD1qX_V3u5xo9LVm6OVOwGSQQe84sO_Y+*j(wepJ5w&q{JUpcwS|~gMVn#`E7qy?Ll@*4H>hIPDNyEcVm% zbI$kafsMG;%$ z&w#z{yrghPl%3*PAu2DkE^}h_o2OQO+9CIW<1T> zufdz)n%w1@Q8;%rxJH97&p1g?QWcWLLipym8U$L`TUQ){7!q_=@}sJ{C;g-Pj#i7pG+3_h}|s?@cX9_lM&9$r7qt^hLOuk3NeFWm@3wx1C|bxSX#DSdUy* zkr=XvW;kje(6@9ie=d|#Rrrc2Vg&pcB>T|?Wwo5gH*W?t(twW8I0(W%loDdi^Bjd) z?l}3u>E`F0#rQ+!ePYgXp z`W9ni2Lf-}1})X=rQdf{PAs5eias;{{(9kyW_VM7VyZaZf7%g0o(q(o%p*izK=iyM zXogdOM*{&Rrk0+?&0hY~n_YgxmI$PcI2C|JiLPffeWF>IXWJ6&%$e|n(~Gk1Y) zhI`|3;JH8XBIq%&^L){;J##&Mk6gCTo|og!ah9~3(Uf((+J4=NKBZnZ=z&VKx3Y)4 z9idHw(6Tc3P;(SVP-x-g$fmv5&*%T^ni%mb;fj1q7C3vqZwWtXB!B>w_L*)RnqoprWiZcYSSsVg^;n2#tSEuY3JYigTeaZ3u7Mc49y%^Yw9xtHZ3#E~k zJx@bYOwfMt;RK!p!`|(Ldof6eBd28qu9YJ37Zh-YQR>#%{|*!0lK#>lY&XI5yCNG= z+;gv5qn>e0iz%~?n9xDxt+@1J3#mwXsr8kN1m^Ecp{}GiW9ea}1)vj*yy-zz1zVof z&DE%W_W%OXc5@g(n_`#H))>)+h1ARR)CVWINwM=mBV7)df8)Bb1@os6(S#6aHbQ|d zE#`TQghiG5zYJoDq#K!qo% zphUa7*ckALv^b?|$DUWeT1__8qSt<|2-~FXJXM}tz=}*70TM<&lfaxA2lY|@O-cNNC+XyTy10K z5t>_#bU>dc(%1_(*RvUp&2{%0SufcZVKr?roLgeeC3Bk~o;(6%1L*IFj#$dENJuJD z+|!vE<;q@KKjX7KL%+pF;*fMvg5w!GYh=8!I=!8E>A_aH*F_`i#%~U0T-zz6pl=ih zA(;zW-4FEiK$Ctl#lwSw_xy!(GSJ zZ!iY8y0JBdpS%#7;xB?&!!mw4&m4Vj+ZYf9o1q{b&>^2Vf5&$orVc0$a5?Y}aU~_U z5Sj@dkHX6(Ts@YGVjqy&{L27V`Wro4%;)=<7`t@;^w8$bcO=5HS!SmW(`kbUhCg=& zHZKwH@GoIx7l5u&kUJMnV@(d+Bebo$+{2b(yNk?~#|7iEA%5*+^tPEn0#kL;_hmFv z0L`{=<_o9(46bU06C;+cYw`^fkdbXD*Zv@}oDMj69-5r#1@}kR_%Gdh>(o8{O5kI$ zYVCbR_sgOzbO?qMkOaYvmY@XWX0|?ACzQ3NA-KBISe}zszeM;il>F-Vu29kAy!NfZ$_*nuHn`q5lgd0!>{wSNFlbIbYb0`qPVdVytC;VtOGNl>5Ly43tDI#M}*WKq<~Xh;u&PuRtRI3>haL$ zNuG4HU}XGe?*0Iz;!L`73|OrC2@SW{7S#vc)?2Q8y9+QB~8?Wvb)Dmj3`t2*dn7;+CwJajnWrr_f(PBdBKi32y zV8!Jt#sJKkL&K6s&^G=SY|L?O(fXy@*d>HqdHpv=ijuKHG}TEHk|~;X#4>RK@BVzP z??5sZ|DNRhHu0Ro2A|oF2IUaR+c2WCxB~{=n=R|@#2^2e#@$7JoFZ@C{m7;;XGm7F z<4C3xH+%79kh_^)2uKNjy(ofE8m-E86h~l8nni3uBrpp9K9TOMqXE5sL9{CD(TF=N z_>KyH)=Ac&@<@|<$7`F02aIPb8@&l6?d4|ijUUH~&k_e{6qbrk0A0SY!C)7(8FF>t z6IEAHz-wz;LcC_YMmjQ~cQ0sL=H{$1-S!$@xsOBZo_duU2Ag(*PBFx{#(ua_Hb2m% zdA7Q=AwuhI#rzQ%FU$-9><3?Cuc_ zEJCin<6a5l(SE?Jtn%SxGnI+W;pM22RmkpN*}tD@3b1eaVv^!}M1gOB4PRn@vpf%; zLiRh?FfBYbTmW!7Q@Zxl%@Zp?VAkrBWSlIr(s*M!s%N1}oz@^ewN|&uMP?ktP<*N1 zzjH}166q3s5yi2_&${Kxs%X}xp|R`bS;ZEDQ+x3^=Xo?S9ps*=MoNoO5T$)m_>60S zVsU!-Ctv!hCir5#CL$*ID65<=mC*;w%gsUaeT?Aopf9*UK*pXfMJIpBA);~_l$_TK zcx={r0;t9Ctsgwb&cLEmst0(|?Xu;<+|n7i5%j#-;F(Ncq%aG$KfI=gJ(_));21`? zu5)y+)DKsNN5+5OlfQ91y}kAak-CS5NiDjqAZ(pWV+$9UuQ@W8;C9YGB42$~VMylN z2^hU3*juu^#gMG*wKE4MP&SKPgJ=xMClZAHeSzX(Nxp&6~w%VCpJK zr;yNO!7g8t?MF`%pKD`n`avgQ=qCFOxWIa;!twj~{x;~0WvM4ezAcP%f)HEym!*46 zE|!_Tl1fXsC3+A{=x3AcskF}tSe%CDtOP>ZN)m~(qg=*ChLTTH_&6uLxh@kJ;Hj9} z(NH1nT^pl;;0q{Jp&*$LA-!V-+=L90-e+xhvRENDPPn0|2i%0qOFPG_bYR9)QpdE_ zUM|fmRpLO53IiaB_5^NwcS?che%O9a-6TiapEzb+_pp>k`6zsDPT*+uihR;0F^CK} zHGAVZc1nG}vB431ZSs7-Vtj^z+cU2ap=jz<2pfZQItS-9Owg{aJPHU}Ck}cVe!lcx zb+rCS2GytpDeiLJh3`*XIDx86{l9nj_*iAle3=>r4>7;@?VerjJB=Wq0LR!UEm36* z)zqi*V;a&rp2^si3~)HD(b*cxQVE5^sGB__i@1wH;VR$5S1diwL};^&xM1o zguRh~`Leho1ZW)}pV~tIf>D42k)EZ8or9kUG@^l-e6Bj!pi`U^M5PEgri4x)uYk7~ z?GL2fnWOh_W(~8)<^bIR>$_KzfE)n)@?4$3p~L!rc{*cjQESndaXxu^;<|MGzSUsnW%KAQd}Gi zP@~1MR_45O(L&|bE)P^@x#K%RN^~dX-F%=8J|9NDf)in8hxG`Iliu6+rc8`bV)J{r z96M~1nAe~3quxp=NzCA2UH;EN1BS-Lh)=skh)53smzfv4imbdOI+sGBs1-rKq0st( z6^huzY&%*DGmWL0-CGX1IQQjA7ROl>`}#yi`=l@CRdYvb!0^^#e=4wy2*<(j| zk()G2>*7R28c%KuIlL0xb$hA3&sigLGh*v;KjjO~D!&V~o%IEvTCp-vY?NheDib}= zHB!i^dYYo~t*s$-v$dTU3q2;x^(;-Q0o?&ZHO=TyUlm5rwy)wq#r?iTPGHhA!$|y| zr#qjJlX=yZD#MBClJgv`Xfs6i!WeU@=CPrG)@YV$wrsiSw^c|eO&el&l-I(xO}$fr zl7kgm97i(}n~k=BUGW$i7UOYijq7#JT0mOh9b8ae6P~>ht+i0AB-fXDB$Z1NE1{`7 zl6bPgFZd2zP@w46D?`((h_F)I^(hn&zfs#LeMYA>;g?s=E~V@Y_hkL^H@G?=ZZ2W6 zETaN&>_w95Q{FGL4Yh}GPrQ#b_f!IC>HWv4Af1XbfA|0uvl!=lg+Kp)*HAh;wTQII z3>9dX2~H|jo@L7{f4eGvge}_Vz0R^)Vr1ICR7O_8j4~^@l;V7|bFwfVbjC*RYMk6v zA3tWrk;k@(azD?HSggUz=XD2Y-Uf5b4FK^#W*$DQO6M z-W=33n(ma-OQ8+E+SWz?La%ZQU5C`) z8n~fl740hleZo)E8&fC^*VDqn>)HtnP<8HHt^4~3c6_+3`+&_}9Y$RrU`8RuC!+ht zqR|WVe;X`=cO1HKyOmkLV6{UA%VD`%Uv+$mB`I&WPzV&`0;9}J!bKc6_-p@bKurJH zn+~lZZ8@<$xL>-sWTFPIDW}Mr!}e}n<7)7?@cO@H`mM0>o_^Ig{K4Mox8@@)Vc4O6 z7&JwRe$~3sau(cJ2&Ik3)JA%?(LyEJWj{FFw8`m1oaXX3U&c5o8wm(vrGr7ta4J}^ z%5g$1fJ9+8dg-ueXf#>@x-zs3SG!Adw6-M2)Ywv?DXP zpm+Y}`$QC?^)5FQJ9@3%ulT-#(J##S*7u#{1BI+mH#@C4MTho-K^3VaL}I(d7ZFv0}z&*RR(jNF3fznhVq<_951 zNweN|@t|KF8zL_?2~Ht4AEZ{$2cB3thDR$j-^>bfEFu%IJ?vOjJv)V`nsG9;&z6!T zibT#2b#8S~wo+}32|5pfTaJ35#O7~+0S-XclkP$DF~83oz!}R@nIM{&t*<}y;Q1L6 zm~S7LrpaS6;J02wLp;t$ja$~<*0_t%a&Gkf6&RI(=n5IdF%UA~QR~T0onk;}46tKF zT>yiyhL_RgER%8lR^q&bf{(OFNC3fo-)|i*R25#Q{SF5S{^E+H2MT@|nB9f(oldY;l;aE2(y0=Y;j!OAa` zJ-^iq0&5{~)E+xmE+KWWX*o{zjfx@@(Z2|@Rgl%J);TuxoE5d&WE--^(Nekcf>3#s z)|+xRiSMnq;4&>UN010zhfS4?0=~m~?7hlKB4+Czm;`mwvjuVpk}_4(w$M&+71TPY zNkc=3hZBeSA%3@8+p%F9UtKn(qjm!0YrS_T=DaZHe+zBJrK3CCGLopC8}uUYXYs-z z>Vaiu06Z&WytjqCqCgvKdE@nx*NDJ8CXJC@Nf1$mc{iGlplS7&q5T5C!p}T2EJl`H z@Y0#iS$umb9@;>Tbnb-2L{HhMF);Ymyr`i*Bv-pEfx@AurOCLPWs5Z>XSjkMAfIlP zSD>Vf!CY|mL0_umyN|*e(GEI-g9cNHiobL-ac`h7N2b0Z+zC^eL_mk2iy|j}#7DgGl+Mb0)71FcMhs~Z7gJi zyj3RepZ!}vVI}(QB{=j^`63>mO)NuNSs_kig7!PK?_4>9Hj1Mb$kgL zSTP9LUA^>1YMM*jn2~haVSc84`5*W8UVW%rYbTqtMCGAddbeb$FtW7v&V0GPGkSto z2{WI$`8;_43FRSO+l>$-`6*^w&yY`_n6nv)5bLP@4>6Y!O_B z&CqofRh?%RQv$;x;RdVp|HhM`7nbk6khfkGWJvl=O6Fo(V&ckiV*1y$dGk)SiQA8> zo^*gZvapr-(BUfWSLv#`k?y_z{^>hd;L&ekqwL*i=$c(%|IBlwZtfh>JV$U+XUB3V ziW7Qk9Ux{;_9-d**WX+P9iEy~=)Nt)LVmXpKrNt#&lk6(weVJUh_sc6L)N(F{l16u zkXtJjz?w-R8dd9DJ%fKAUwhNS+PyE$>?5iekq}-{!DQbgr%zsF2~M{zyth5+P6Ftm zj9?3)QY%K=EGdiC)L}fbz$=+!>o#JhOfL81b)lE>=+H2HGI?KI-4&4t6Hl%gR9I+2 z6~3xHMUY{qCfrW4BL~(|H(jj59g=&%k_mpl=#&gK&iMu29A}S5J3*MkDpVfH*d`BG zc>Q_hGH-w{9l^O8Trxv#sUWEk+&C9i)Y7pLO<%S*D+q6ZVNElJx*+ZvT4>Te?B{Hw z;NQvo^yCqMZ&T{{&8|ga{08Cxgk^?MV2qgL@k>&$amy-YcClpdQLyFjQzVEf3YC3_ z*x|ON;PQ6#d6X}RVQ5+Nfh|r3a{Fm|tC5!R-_Xa~-mpAWdWEBR8vlmkgYPy5xAHzA zi05VqSIHRosy@LDG*^+~1vCK+$1EZg!`}{hsbtO|j;uQK$h8a=VCA3bK!c0JT{Sp& z&<+l%#~vZ`%%6K{B;3QS0SX(0p3??OhzK=3%u-}=73iob{Cb(R-$;;NcVMR2q9x z&S%W^OmhTM`ul&MKqIL725RTt9&>wu%qb8bORtrh{wv#+uE^L0D$w}(ytIlR*0q3j zLYfFa)e!1-R76(6*w#6mUsRRh(UofuF)78poz(8-Qj7pP0n6ZrfACQ0p>unEpxE^g z4kWVOpa9@g6K-0RgIeogqXFAb$+$0I==A=cgRT@VZOx+Sn~Z`xewR^5HQRn~TZvS; zl2kCLy|$?|TQ$`S(VFwH!t?uWvk=cd6Ap63ODY&cY#fJ9 z^^5GwDR`ThioTYR5$lV%kL=miX8H3V$93YYN0wNSjY`Hx^{CI5O<=K@h0C`E(@Fvn zz~iWh4W)A?eXPuHdMaZ-Lf2gZdQAeTI7)y}r5b>W@rKZJV>LCkOCXg8&yMe*@pF?k za}Qr~mKF~*NkG&&T&yAl8dIqxe?i5`vnY^b6scWz^{v!)D`0c9FxJ$gDLcsO zS&`M>)S@W=a6x#Th-V|v(}S29`O+sC%u;165%fzQ(alUba8^)$9jV#%al!#INtgLmE9CU>28t9TN z@V$hvHx39ObyWq*=z7M8ZtwQsf$VZMYr!S045<|T;qU$Y^}{xtD=)hcT~0NG>R#Uu zsUJw?M_7S={Dec?1Uqa6IdtqkGu+L*bR1mn?!Uw3s(8iRS@E+sOJ`h$U2zQ8aukNW z*gTAt5@zKDVM`k|*jadcMn>Uo9NYx-;6;SYeC_S|Z4pw{)X#cF0)^WU2sEt^OKy$!KB8*!$0j(sN1cdV?-XqhA(8HdZF&SHc3c1~6 zGJXYF!a1~X>lEcLn?;u2S7?x3U<|aJUaP~0v|YkH+@r9aTGab$C-9&BqQ1$9z~rX~ z6<8AUi@TkP8I6rMFCsi$g4pOcLrCk3gv>9ppGnu(H~m~M`SVmF#( zpuaUmg4Z-QiKACZBuWS5#*dhVDepOw+0rksFA%NAhC_`Paxv({LzPud(E{x_CBshh zc=;k20?un6xuOV!*33wf&Yy0h}paX$dK)Nt&&_sg;sso=!Q=A>qHvO5pg zU{fZTF#YVLT~>Hopw*uS^8X<2J;0+XzVP9hyBmoR6)<8{)J0JvQbP-h8k&M2BF$JK zBnt_onF7HY5H(;!M2(6+0ULHy)F>9fhKe0EcI?fpcMT=>Da(X?SN{&C9utDc=(IC{dqho_%Y zGIqq*-=EZ{vgqr(M;-UgL0^B}=DM%`xT9<5jI~=YYxVH`_Z0ux_w)bV`|g%*d+&aE z@M+;8x!D&TbN1n%96hS&H%s@9cuTG;RHdq=!K`kAi}eDR#^ z_&(b7;e~eeJ6x~Yo4&see}qf@Xz#G<%BpyEb;;CNVQE46wAjpeRdq>4c`T=A_g>w5 z#j=ZQYAUM_@6lsgNlkI>lc=*mesJ#+f@ z%*`2~e!R|fLw&C^e>@6URQ$BfHb&sDgY`OsYIcSW2BNokJ|Lb4-=wGra-%k{46fDs ziBKJg9^wJ5k12gwaG=%`FAp~8pJ~oh_KSu2f2xQ#h*ur|^TpNbC)9+fhk7X%h%+E| zSn}XYig{uq{*fIhdGIC0g`$(gFA^nsycdBz5W9(sb^G|U@KT&FE{E?}h}VnDbo<2T zh@npVb45qpKH1L^kLmV^pDRAr?GZmuoTS@}K^s!c66yyM0TZtilbra>78$y|Jcy$d zXNe!2c-Dxex;?tSR@|@KBR*5a)lWDt!`VE~X9wp*Sr~T<-scxV2 zMIz9D#Dm(8i$bUUsp3ti{R73py8SF@Q;JEVn{J=@WO0ygpLl`T=CnUWtkUh1{WQ_R zY5#OF%W3}%@wJZUP}Sba;s|XgK2g+Zf5az<^dm7ELe#)lAodqm>i(b`DJ~U1pb-k` z^Tk)X|HMxct8{;9eVig@GNmP)2pm;>LNBjtJj?>;z zT20>~>M!6Wt0F=-uB#$q=cEx(M6_Xi7shvE9Bxcji9mep5)pgY6#VbWxcSW)R2_l& zW0#27*QRj&{)~4Lzv=klvXbJ=po>=g1m6SEpXm=|{2=j>bA1&=Jy{~+kR$;V5r>NB z9DOy@t6!&^xF#aHB`|^r+~4d1cT1asUH!OyqAnu(CNP3X%6RnT)~blmlOe(NM20{R*|!}t-npgaU+F7_S?k;dPxyqAs*IKj`$s7qdv_Nzf-i*Q4g^XJzNC0SJgMgw@dw2RdVUdKC3e&Ei}*vLo1S099~P7K{38B{I8VD87-;#)bCf4J@2TBaSr1)H1;>@ov#2xw;Pxddx2l^IB z{44Qi2e=SQ48Ek;EV?=K>uWL6nP1i1q#+>*aB#(09cd$Iz ziQge|s1v_z`L(lt50$N)_;ryl>hlMU=PHUTHQSv#xzYsrKex7c(pC=dS{e|p<(>~AwEf7p!XNzljV$TJAMUnz7xMG@=Pawh4Km~enoPY6Ti5;TJJC9f2us! ziQhDNgWg}rUJU;ilihxaJj03KblJ&?-wb)Q6F>7CH_1mtoJK(Z8xf~7eg@-{7@y2| z0pnA|>w3SzZ35oM${+Q9L%du*p!XZ%74kK`-w>~q5uI=1XUa}G-^8orc%5(J)v`+G zn|O`9Rqr>%Yvt2=zac(T{-*aE;wFVGO9ndM#Lt#7op0jj z$aI}=;^)ePb-sz8CwJBPCVsx`s`E{}UcROG8{%{1FEI)+@wxJ0z26YOKyK9g4e@#M zTD{*8zfeA;_Z#9D$<2DdA%3yk2>}%14RU}!FA|?GPtyAh@da{$-fxIsB3J1BhWMrI zepW=z^}i7jXM8H-(-<#iyoB-T;!!={VqlTtGWm|4Z^SQ`*X#L4{0iBm=Ns{b@>_j> zBYvgaSST_L~e1O&u)~v>iI_Y|Hht;!EY@dcF}~ zCf`Ezp2pDXs&`x`DJcpoK?(DRM>5At6<--!PxJL>(7_!fDB zo^Ql|l4W|n5&u~()$@(`FY-w}--vIOKk4~K{8zb~-rtD-CI{>JM*Md-k3fFIlSR8}Yy8cs<{U|0ApPd?Ws^Jf)M}-ZojM=Ns8Yu(#gd zh|3^1X6u9CFFoJL9trl+`y26S@PVFh#M6R5_p-0wDd>g=J>WXR=E~Tx3(Y-(Adj1LN}b`i1!cf zZ7WnEo*P`F_Z#8^f>nCIA%1wUMDI7mj|d*q`wj7d!E(Ld5I-_lqxT!)M+GbNenb4| z;5ohD5YG!{=>3NHpkRJXs6u>jFiM{vhz|*->-~oK(4d>%&xsEUM(Xne@neGXaH2rT zgD)wL4VLKrhWPN{RlVO39}#@7_Z#BJ1u?y!6CW8IrOyws4| z>GeYVgkY0iFT}?L>-Bmeeq!*YUN6MQ2CwM#LVR5Con9}*#|KyH^+J3?aGzc;#3u$- zdcPrlQm|037vlNBIKAHxKRGy4?>EFx32xE*4e?Whb-^TdujIUt)4#w|f{4U1t zX8az;?`8Zx##b_aKjRND{vhM47=MWIhZ%o_@g~L}W&AP5S2O-N<4-XDB;!vpzJ~F& zjIU$-X~v&n{8`4IWBhr>*E9YC<1aG)65|^ff0^-D7=M-V*BF1D@i!QMlkts=zs305 zjK9NpGvn_v{vPA+GyVbNA2R+C;~z7=iSbVu|CI6182_B{FBt!l@vj))%=p)gf5Z5< zjDN@Y_l*C*_>YWlVf-h?e`fp_#jQ_#-pN#*-_}`5G!}!09Z(|&e zXjX~9k4IP(?wcvr^F{~clcb!T?-7aNSdC$slrJcse# zjQ3%@FXR0f@6WjT3rMCv1DO4A#*bipAmc|eeiY+JGoHuzAjZxA&0zXBgxQBOK8*2W z7(bTr;f#-9{5Zx(GCqp&;~5{#_z8@UVf;kK$1*;S@$rmLV0qd^Y1}F@84V=P-UQL<5x3&4dd4`-pKfM zj9<_A4U8{g{6@zA$M{W*FJ*igA5Q?->7{ z@gErfk?}2z|HSyujQ_&;R>ps2{5QsbXS{{+KN$a$@xK`VoAG}b|CjM?jKlw;Y880? zXFOm$!g!SNG{$#gycOg4e>Eoy{Qtm=w`RNz;~9+a!uYO?@5Xpr#?AljPkoAr_RPLJ zM@5J~4j33B&XT}d=-2CjE`h|6ywJ;KAQ0p7$3vrHB8K1!TM8;2IJfHEC89#;bQyD*v@zWVUgYij>PiDM;@hOZKGG4@ZobjoQPh-58 z@e;=Iw@@TYM9g5Ee;!=M?B$GCFkZ>{nT+$_$50(ymzL~LTY&bAKyG_Lo*s4eE7|p3 zb|QN-=-R{Y%dmGCyxxug@(WtI{?;;ohbPSf^(D-HjWt5F_hR-5jL&6ybT8-ApzvS0 zfN(nE)6gnJ27Jkx3aa1ZBQGIM7S_)r+!67mgky;HFD~kg_(H1BMqC5`KT*P|X4@9h|d>&#w-G?I9Q++sMy{twd)=O#(V!fQkD?R)JB_F<|zK!GXq`rku zMyzk&MTqsSyBP8A6tq&r`iM}8SRW5?NKzj~>k#W>=sAe>5wsq$K7P(atdF`4i1jh| zQpEa*yAW{|`~zh%d`bOi)reR>RxLrSAE}li){j%SAl8p=D-i3)w!0DQN4AxSE8rg} ztKduOR|QRo^=pF15$jh3YY^+#1J5AVuOikX)~_KpAl9!SUPFulgR&96LwFP7a|wTrcoyN!i0cS{hj=#OEr|OP-ikPfa0}vIg#Sid4F6z(D!GjE7)9KN zH0g+Y6V5=~k8oSW`s2k+#Mn5LEX4X_%Z`YrQhf}u{&=!8V*Sx&He&27l&*;NN8&vZ z>yOj1EAm;=`GQyJ)-$J+u@wtSH5uZi46!C1rm59$ET!Z)=!k8*~HepPyJdZGLL*{h7i^fs- z-bv$h_}*1xY=5A}*#0n$vHj5+WBcPZ#@tTU82eJ9G4`cKwM5PtrIG@KlY_ z&*d7&0AH_hXTW!8{2E|T0scqhF@PfxYHK+7-(6$OE&lF5?86wqhiE(= za5s&y{{uA62RvBg(*Pf@G4{Ve;E)wl@o-x?PK-llOW;2=t4uLPW?@p!74S@rGXc-h zxF_I+8e`0_)3^`d7c`Cm#v)Ipy%4Gu#{8#ijO!*tW1QD*HCFqL#ucE?(s&JEY!7{| z27OFp?0aX8ajoMRP=oQqF(Af068nuf4>VZh71%5MU7dh&Kv3`qn|Zo|VlvKKz+?dp zE)*zAug`}AfoD!q)$0EUMV!!U|7yIp{{qtE5h@cf>hWzDV$@pw@u^~dC0?mxuKR{LmW!xf#bKI~i2dMOCSbH=Ym99jrZM^(tTE;g zhN1N64~x8reB!?n7a$Z!rO3pa8x-_~m{g#-*rP8~a?%4%=o>uxN=pwIRrn>ZB0aWi z@@~guPpHqVhJT=_@dCyx`oS00<8{L|#_N<%9Yf_)`&T{}Q(G7pc{O1b=W7V>kA7<5 zA1FQG3o%-TXpH`*XpH_AYmENzScdvUoOK`YdS{H+Qd_D&jf4-uYiGefP*huh(NYRu zSdZ=EQ3)|#r^dCM=D+Iy&4goMGwY%&;#;Ub7xArx#~{9q@M(x|CtQPg1>t(ccMxtw zd?(>s5Z^`kam05MUXS=5!kZA^OZYp)_YuZ3hg?Y*@0ap^!gz0!4-m$CvwV;+-iPEW z!g!C7cr%1jiTGi{=OBKB@M6SGgqI?IlyDQ`#|S@z7&j{@A0U35@MgqM5Ek%FK1nzO zG2VEgbVj^}Fuo0xYYD4dtRt*)@igHWT;t^88LC&gc$Tor1>Ve|s9ZcxSmk0p;d-#i z7YM6dyhvE(;w8c=7aItxT;QPq$|m@duMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnCt6bpW z0*cDTTZC0E-X^Sa@eW~?i)O+q7w-~Qxp%I2&-ItOjzY& z6JeE$PYA1Ad`ej5;xocA=(m%LMJ;tRqm7he)qx%i5(%Ee~F_2}no!YUWv5LUVP zmaxjjcZ5|gz9+m1ul<3r%Ega_RW7y=R=N0zu*${HgjFtnA*^z-m9WaiuY^@Dej}`M zfd@b+Di_?xiG1s)i&z&H6XVU>$*gjFuo9R%*_sF8R# z(R)-tSmgo_8&G2K<>Vqt^(q%>gjFtfBCK-Jim=Ls{>8ra=x1lDSGj0SSmmM(VU>#v z!YUWL5Z;8>?n+qYVmHDn7i|fvT(l#sa?zf!$^{;lp{QJB5>~m`gRsg)2f`{BdlFW; z$RezAu@_;Li@gb}T(`x92Vh!Iw~=tOup=H&pw;}IW7 zxD;_`!gYubBD@gs!GxC}#)kkXxE;%E!fOy8N*I^A>_QlqmOP9wP9xcsFs4o70|XT8 zqU=r>&9VpKp@@4D9)q|S;bO!&gliD@CXBzcTlOK`h`2A|m5B8(NPZk~f2!YzIG6Ay z#P|>cr3LZfgriZwM-c9acp%|y#77d&LwpqBQHYNwT!c7}a3$hFgw?(@n6O$4LkP#9 zZD%cD0HCO~FpRKT3&#*vYvEYJYAp;WTo2dC5roxR(7&wt7OWph^=d7QBCOT|KBz(2 z1YdGAVYL=cAgtB`CIO0C3nvm*Yhf&5wHC$^R%>BAVYL<}5LRnpB4M=_P9m(4eoSgi$o z$bzEQLM36f7S1HB)?mVYL=8U{KUrxQy^7;PP_9YAswr zSgnPHgwAiVYL=+B&^oL{|KwKa1&v*7M2oLYhf8-m5b$sRW5EO9D{y1xwwVuRW5EN zta5Q1VU>&939DSJAY6}r?jWpkaVKGwi@OM`T-;4q<>DT~oABCu39DS(M_AEoYDi^B=t6V%pSmokj!YUV!5LUTpBCK-pC}EY0#|W!jtR}2-feQ$DgjFuq5>~lbM_A?JX~Hq^>*V4Ys#m#qmaxjjbA(kco+qqw zv7T@}`gwt{%EgO>RW4p4ta7n|u*${Dgg4=}uMk$bc$Kiq#cPCBE?y_Ba`6UXm5VnC zt6bp514ZTHEy5}nZxdFzc!#jcMKfWQi+2gDT)anE<>Gz9DiE8KG0-`=_?+rhF1{eFa`7c$m5Z+kt6Xd*T#tUfCaiMt z4PljwZwaehd`DR2;(NlI@Y){;t6cm@Smk01VU>%Y2&-KDOjzaO7s4tRTM4UN{7P8m z;y1!77rzr$xxkwP6qSoV2&-KDNm%9LFTyGpe-l=@_=m8{#lM7AF18U?xlnIC%yUFk zwWV@_FJ+;qTto=RfIGRsn-vt53w&`4Mde~A!YUW72&-J^58UfPCwHcLm5bJdZ^8OD zgjFsw2&-J|LU3=2Vs?q4un-M z_9U!wkwsYL0$)f&QMuTgu*$_ggjFu^1`b8#Vqd~47yA)bx!9ku%0-N@S{I!N({lu2 zdX6Amis$^!gy}hg@ItIVm@qv@5T@q{!fQ~2FV3ORa|GefvHmc^^c+Dr9j1%yMmUDJ zJK?T~dk`LqxF_K;hA#VYL><6IN>hKRkh=*1|->YAu{ZSgi&8Pz8!w3nvp+ zYvB~aYAxW0El|{2IE}Dc3#SuSYXLumfuh!e{)1I&Elj3*wH68p({lu2dX6Bh)&eFF z3Oz>A@VS0`rOwSR7)mkVaOwSR7)moTAn4TjDtF=%@SgnO}!fGv45LRmeClM62 z7S1HB)LH?6~iKS$plh&mJB2 zY}bDG%w2ZfZRgf)GLAUEUe1wo$(8bc`G9;-u96SQ zhvg%(Nj@qcldI+9@(KB*d`hm7Yvnrmw0s7B$Yz6lS-v7)m9NRyMz6BDcz4%uiPfmjssvmj#yxR|E@#D}zPBRl(xm z>foB-+MqGGF1S9pAy^XJ82m4|DOegT3zi2r2e$;b2Db&b2P=X*f;)q|g1duzf_sDe zf|bD|K~wN(@K~@qcszI_crth@SQD%b)&)-o&jil~&jrs1>w_197lW6A4Z+L7E5WP5 zYr*Tm8^N2w#^9~s?cklDIe0gCFL*!rAowu&DEK(o6nqkV8hjRf9()me8GIFN4!#b) z3BC=!3%(D22!0H<1V05o2fqYcgI|N+f`5Z;L49OSWNzew$h^pfk&7Z1M;apYBMTyz zL@te77P&lfMPy;*%E+R~RguM!t0UJ$u8lNCu8UkBxgoM7a%1Gy$Ze6^BP$|zMDC2- z6}dZdPvqXneUX)s`y&rT9*nGtJQR62@<^m9@@V9-$m+=BktZTgMxKhSiL8yRi##29 zCbA*&a^#iBtC80tuSed9ycyXTc`NdE?h1dGzM! zEzw(}w?%J{u87_dy)$}O^zP_A(R-u!MOQ}ek3JB6FuE%GQ1s#GBhjYlqtVBrtD}!c zpNKvgeJZ*px;DBl`gHV}=(Ex1qR&UyM_-7(7=0mS-$lQV{t*2!x+VHk^yla=(XG*6 zqrXLekG4eri2fPO? zU7mJD+QPIe(-x&&m9{wT>a=Upu1#x9yDshev>Vcvq}`bIzqFgumZr5zkETs8KT~wC zikB92uZh>ybdMKSPAaP?nlz(gN@+>WS=t0JUR6+~m6&m3rXG%A^xL@T3X#df;v) z^c;u7Ds%dzR_cM*iLxp2qMFj`NoAEKlcrTw%o1w$2>d&wW%2TwgdLhhdu`>UlJXL$ zj+a%(lUBUClvflK6-_FbQk`&tqUz$3sWp?T5}_@ut(qCn>D#y0fJv2ZWuHE|R+WmI znvh9ZGD4KGqy^O!`ea>F%`M8env6*`)=^55bx9ADk)#FHln}R$^1(NC>y>f%~c2cL5)Re}{-PlsVStSNMS*3!a0-mf(27m&dw4j>8 znygEzxkdR_0Z*#2jsl*nOM0MyCoQO^fV*`Ra8{=R?$%Mj%bh^c)GQU<%PVT)-H#nT zp<8uLLE#KXQ&wAwE5)h9X^wT>@sIUR0tSEIcbZNmPWg)RctVequA?kQl?b;%6Vj7nOPGb&k^RMU(~T9Px$t)m&0tV?>J8I`moXOvqQwjKI_jQVMvjel~wR5%I?G%G? z2zSA-RP4ZP+HX`ILH{d0uZa&+E+?b8JJhTRSkDUOQLY z-A*wWhrPDnp2uw3bIf*oDF&1Ie%sBwZAEvcmv((>P;4t+Wirp}P3Gr;bbTk$HBd0uZaZ`UWinK9W`dq}+AWIm-{XP(!a%=3CP#vI#_?A8v6q&(97A&8W@L`p9$AXPWF*yKrmH<Y>a8l}ZY*&hlB=rhCU30cOU2Ur!BD+30AQK_mY6pndoA}uENpB`Rw$+XfuQ$O-sn@aL z^(HjDJ~0a0knGkD%!yvxS3BM2hQxfd4axRG&2}z&g6q&(97D1rW@L`p z9$AXPWF*yKrmNj`bY*gqdWD{@y|z1DZL1Ta(5n&=vaC*kSbZWsR((i#EUOb8R-XtC zuQ#z_^@-51dNYdN_TZD<+JV_5)w$a4c8b9`%-Mc>97!vb8yuDB}IyC+4 z6@Fc)8Lu->F3xpmNTfg9p&41qb@chf_(>^-#0;<<>Mp=1bs<+I=0M67dU^D;CP#7( zm>AhsJ4AMU@+uP{+iC}h*PHm*^+|6gJhm0RndtC(6P%QKy*zlm2@S6|qv&lLlHJ;Y z+4S1E+U|CW!8pv>etRCXY0oj+?WGt@ZhM8d7iva_rk|ecLd|$xVtLr@p~0lzS7SwcYI$gK-ESMQpDvJ`{KNUA}nB*kEIl43AX=(F7z*;YG5c71X{CPKE=4iK+5 z@v-ZZ-b~_cs~sI)Z-SFjuVcgOO=x(%83lY45jK5xU^cyWuC}|KVlbJ2xB6l2g_`YL zc&;=3bj)@(QVb>?jv+N4j@cerios+g)nKNpJ!Euca*}#Q;uDVT#i+LxK|4fteR4o1 zLblZo5U)4!vFnrGOyX^;9UWe8f|F9OW5erBXn4ID1$-0{7MdNHO|PA+?QW+S67w;< zy->5A3-~l(d;N6Gb~aKBCLN9;H6M=I9$AXPWF*yKrmNj`bY*gqdPU+Bj z?ZBMqwS6^qFVSsoFtLWW`rAu|W43eQ7*hM`m{pwgj~b>J64N!jBW7eN*O`%}7)(Y| z4Q9I9En(kGPExN(e8REa7+Dc?LS)s4M98u_0b=!u_*nHxZ;9|&R`iyL4y#WDhu53f zu=+%3SiPB#@KHoqXm(&Wy>_m)yPaY%4&kGS?X~AIoAw;D-Cl|zu{^@t3pJxd(@*$d zVSD{_%y^yItWpe#^oKh%BTKn1F#+uBR7>io($xnU$sX!1m`^xdLt+kuxT?aPv}fp8 zO^j@-9U{9vIiXDeZL1w1UT@-K*C)N1@Yq)LW}?IE&GJa8*UN*~o6zujGYa@9A{onM zw{~DQy>_m)yPaY%4&kGS?X~AIoAw;D-Cl~p3_9Ln%qmE z1HMa=CVoj@|0TxcUILN!U6M4pm%wcGU6M4pmq2KImn2Q@B`W^Di)) zz;*b0TTC(j4gj6)ZzcH40ulP#8NM5TyD@(oz@PoMevH4?%-?#;UmMHcWVqhWM=mrL z*1uEPcsE)8cCq{&!~Erezl*?bis|1V=C8%_w;PDfc()$m_HRA-!@Qef{QU?z#Ch7# z7XBE9iC;UYGyXnc{x;%xA;zW{fA27V+2F4;h%g_!!*}EFROask2yR&aCNh7ctp4p` z`5VIgZ3chOn@(vRd=p18e??aR_O$%1W&T#SrM{yNEXMWY%wGfe!*Sqv_tHA#cQAje zz~7#bOH+)$TbRGamcM;KY~r_#&*u)5H}3CGHlLS*zn&n%{_Sh|`-=Jd9Q@($G&05X z?^EXQHSjkaMCcEH@4M;Wi_Bj>1UGDbJj?uL!Qb>T^RJWTZzc0L8T@6M&S@ReyO_V8 zmcIkF4)bvp^H<~P-{s8TaLeC8mcQA|-#MQC)i8gPEq{kt{!U~57JB-367yGQ`8(9| zH<s#{LN(k9tVFD z6W&ON^i1Y&1NbxZxrgO1oB7LxNrm&u6w|*0nZLimAA~^l5AXM;e{Gq+uHbBEyaDK9 z{Iy~Jak_D`v+_mVe#vzugQb&Sn9!_8E;?U#vg7aw!h)v?VLrYlv-evL2{wEo~>EP4Mzje0Q!;#cF*ozLQT zi$`}6^u&(KMvv}77C($r*f<8V`1Ju^Zw3i%8Q34{5$C}dmJL!S?yGZwqYd}Ji7bAr z;P9FU^`;nq8(93ddUSg+U7w@F{i)v#42{6_SEa_IdkL&|{8o8%`0mEmZT09bB^L9FH?zX>dkM3-EuVw4 z64cgJdUV^mxVi?9Zr}EK;d z#GMDZ9^E-?|I7F2irD^F=h4k&`(L9+H=XT&O&(nX+y9z9y2?)Ocw0QW%hO$5)^XwS z>&5oJT#xPqSTy$f&G+cqv;D8mqr>-yw!cP??w1@_*W}T)WBXsTM>mx1e=Q!}6t@3m zjSP?9)olOE_2?dC`(M6C_hlD%ymcO3l+=g}R<_dk!WnD2ic-3^Di`DpU!9%cDx_UOLLcKx+@bglXRcYJvK zem>asm+R5B<@=vU*V5VbSLe}n$Z&Oy9^JnOxVk2fu48Lg*X+?n`Tpn89l-a$(c$r1 zo9nil>(PC@zpKml=$7|&b#)%y8hF{~?0+8J1$_VW=$7r}`fK*+Ho}LGcDpSe-On9d zUDgTV@jIxStIPH1hVcE*qnpY1KaXy4JGb3NkM1A7|A7v+oJ29_zkS&GZ?i}D5!?T= z#)SL(o9%zYJ-Qz3{8#7E9nbc^6&_uEcQ-E09^L=g{+E7Y_&8o?`(Lg{_aoc?iaojm z4t4w2=+Wi1b#?1Kx@>m-Yw_rg+12%zJvMy2-P!ps-=iDF_P+*?4nNPb*IScEH!W;nBUv_P=J2u7&M?>Epx4u{y_%U#>^@ zF5CZ#J-UpZuD?c)t_wT=t@r3oXZv4^M|XCn+iv!R@bTWu_P>0OZbLiQUxPu*7`8svdvv?A_0i(d^g{@dcwHL>$w?&R?Pz0J;l^&Z`m?EJUhqx*oJ|JoLWw>x)$JFoIR zx}`B!x74F6?C0t>dvtU5b#*n2 z7J76av-?}KNB0lAzs078_wNgKe=GLrB5b{_^ypUPx^Zst=$_l()#XhK@85iO{%i2) zZtv*&d(ESp&dz^X#o_HX?B)8K?9r`e_m34G-Mj4mvBjgyVCy5dB)orJ*z-}nM|V0q z|E>4v&SvMow$sDgEzEY~lJC*YVe4b5M^|#N>ur?Zwtdc3F7;`m^;>>CwHw&wrqUqg0|q zHTsI3|6cRx?quh`%^ux)cK#FP;qCs#&VN}R-Ck_{_VnmRvGqILqnpmw?_`he#;)!> zsPpJnv-96VkM4&x{w9^F{B|22Aa7qb1Y$)mfO?SIW4-P>&cYw_r|wspsmRTUn;57_>f>(TwWtLrb{ zqx+QYe{~+6VEbRAN4NPvx7{X>ZYQ??HG6bFbaMT*cyt+T|I4ZlkKZb`|K)mgZ@{9l z_wjs>?rOIG)p>Levi+~oqnp{=ZMVszTg>*qW{>Xqp02+ZkM0Y$|7F#L$1jWRf4LrA zKeqqndvqmi|Eu%pE^hCRqtTFZFW$<$82q zv-f}b9$iPi|9NzW^Zn1GE93j0M|a8Y?l_t~x+nSm=h1z@_rICp@q32ve;(bZeE;+4 zUgZ0qN4Gh{9dDyY_Zr{-Jh~rRyZ)Lzy0`iM=h1CVcl~9}3Xk6neE;+49_9O=M|Vy? zx7|9A?s~red32}ucKtPZbZ7JZ&!fAS?|&ZMhCSVOv+Ba*x2>D2%k}8?-NV)8dvs&? z{^!w^^Zn1G`n-~T+iwtWBd=(_X$&!g+W z_dk!W58wYhx{iGR^XLxe``_8&@p~`VomaUYT?>1EmG9B5?(6!i^XT4X@2?s?x+OWT zzb23FvAtYfvq$$mJ0G-obZz+lcTRZxj^g{DM|WDL+rNB|?ust1uFj*or=6>7^yv2J z@9LUB2e*JkG0(rf+4*m?NB0}s|FX^v_m{bk+wO3W?pU_})p>Mrw*Rg0=o;Dn*X+?f z%=W+Z^TNmRHQWDkJ-Sxx{8#MJ9nSW@MvpF^?SJb%x;(c3wRm)Au>CLl{P6J}!}h;? zkFJRAe+?epD8B!Bbko`Xx7ni`%l5yl`tWg7vi)zkN7sIUJ5TF8x}Gstx5A_Qh3$XM z9$mYAU4Q9w!pE_Z?SHu*-Op_QEB5FPV&}g`k8TLt|JHkSGui&v;?XT;`(O6l@bNy+ z_P>0O?hCg6HF$Jav(LAhJh}&WbMvv;qq~89zLj-B_&6SA?}vtabj#TL@j8$0sWxu^ zR(N!`AK>bmJ-TPv`=RuC;p3Rj&j%h|!~Sl&#U9;Awmup?x{{8rzx5tnSGGP{Ji6o9 z`pCX8e7xtf^Fh8xcS8rae+?epD_vb(lSlU*yMJu<==NvpBkQ8@aU99k$8eACAhtg0 zJh~xleXQ{44m;Q#Z?i`?f~}AAi^Ip!tF!Ab*P}aut&d`lu0LBJjUL?uwm#N-bbqq* zRf|WL#nwl5L-=^#XYbeYJ-R>G`KrOAD`fp^0$rX+mZ*kv_H*Oh;?WId{mY#n?r#d~ zU!6yHH9P+`d2|o5^IwZc_a!_3RLRyrJY<| z?q%WqdotbC)p>Mz_wA zlb!!^uL$qoVs`$k^XQ)M=C<49(S5&MNQvR!{o9^D(e zxw;mQ?lE?M%e^wZf6cqN{^~rsHSGS@n0F|8lPi?_UEu|J8YPBXitwGmGA z509>#uMdxIB3~cZhWD?AuMdxIFTOrJy8e89cyxdEar2hj7~a1uzCJvydxnN{YRp^Z0v-u^8QD zJ0)X`_2_Tm2(r%yJ^ZJBzjVC3rmCWHcK5>W6;r17h{bxwl7%q++pkX_W$4?tCxO`H z*5?l!b&QmzMf80}qJ3<$Zdd%*{N0Ca`2F5VZNEVxqs^ni++|}HEMK>5@tkejHl>T@ z>)Or{0>Hjo=t?0#*AN_>zCW6jCL?|Bl<{+yjbE_*fn^J+>YSGO0bT*xxd)8zIN;(t zq6gf!Zr?2(M=Wfdd;Ov*B`1$9$sb%YF{fn0J`HenhEgki$C2RTp5W!khf!#@TkB-Q zrUUT3-zQ>J*2R7Iu38&p?1K8}6KOBE0)1KQi8G_4(vE?&M8^&qk~3&nJRc+U;?FcQdI8kXP z-WHkrbW3CUih?_@yDmNF>CAnGHk>#&d;Gb_dUIQZO7-Nm~!8m zivqEt(*sNEQ^sM1(+e@q>BlyuRo(Z@F&)JKIiekmYQfz3oig?)*tRVra#`B(>GuSi zb`s~do_K5&27g;t?-iY1PP;Mkz>9xxZu7v4EzND7hx})r>L@>qTz}*8 z7c<*5yxeAD<3Alnih(WH=I*o4yhY38wTthEcBZV&fS^N;cESL++II_7WV9KTficIb zv1;1gllBA>XtvcqXh{QNzEc*l=G@kB@x-tGM4uVxGjY}Je~fB_j$0|WFYojrPM!|O z!4=PayiJXx?V@F;UB4)!^&LAedI7pSF@GEA!N&^u#7^tmf%>Aiwt3^`GxQtOYWdnR z8LdX`G-%s4n0Y&Gii+iH+iG;;wrw58ie<3g(nM83XIP1gmM*;h$|*011-HS9e4-Vq zpVO;ObsV}e@y^KHPIa)v4$bK}a%JP(1*Wv92V)s$}9?A=as- zR#3NY?U+%!z&LQcU0{MOTrg+(dW;=ZWbE1D0p0#Gs7O=sSA9LQl~F#hc8u!w#4dkd z)@sq(F$=C+v@?!j!JQAZ77K5PEjmu@(=fI9^L=_xz2L=+^hIDnMTY@@VD*p2jc%}2 zhvk1jQ_p=$v4pkN^)4{o6L}d||A;i)7-F$uqsNauVa&;~ns{~1;W06_prkZj)LK*) zR9EA7cz_&MU0D^ct}dAxD=aN2pB9@Luc|JoD39gz?B1(;uUK|*O-*I>;XQgxE2$~2 zozlIqqO3>UT+*YobY@w%%BqU#@xq$!pooE~8(ldmr)N&zp1C;#;NhK>)69(v>Z9T( zXEH?amx@~@qW*GDvI4dmF+krRYN0w1?UP185$7)rAm{c>ajT?D?oijmL!eb6&QJQ| z_1q4J2&+UyOnj#Mvj@}%0uFOliKxE_k*tWM*t5mzq*?X;cE;hcK$RH$+aCTh(K6j0 zRt)xzS24d|Wj^iQ|&L&s} z!WUxHo~$wYn4vLVhecwipkTK$twWpC{ZZ{||EHq{mME5+;0v+os_~=rI##NmI8Z36 zpE@QOV-rJoWD-)33u9=;g~Kyrk0IV4{(;gNzRY;>vP?aYI*rkOiN@F$c!W?I?8~hh z<0bcKjD2}TW9-WYjj=DEYK(os-zAQ1#QSvJV^rhSaaQBS3Mgv4 zI?igmF;%VFkb4qV;|2eF0nLUl2^gE}sxdZ)Dapj-Ls9bzF!lwn#d?gxFpaTaBQ?fu zsJMX!`_-W9v0r#Z#%p8n{T7X}{W~?r_8-<5``%h6^?PWH?PD>qg5$Nw#6<&TS5X!( zE3BL?y5k>((|-p}{e8HyDef!?UGl-L@E?!n0uMx~tT~kn1Q@y=5rxnx`$E$WQ3`Z0iklM(cqpbqn5v6K zcf1`>Dkv&~JNPtFSp|(uO-L(C3u>lTRFzFSD_&Jma#q|9oN1PN&xXj1EDO#hq2Zfa z6*rCfGOr}ev2~dfz@pl+ve}cWD{89>xm(jyR}$JO2$Jg~R5i7>ypTo1^wPAYB${*w zadk~qO~DlSKD!LR8#zs9@KphGsQ^`QxT2N$-~OEnHw=9%Qx|*!o6usb0=58Ea34af zZ%fYKDMSJ8O<3l`7uVsnrWoBks6d>j4VS|HiTf4qN7y{taE~j2FWcWh;4%0z#rP|N z3ftc;mOtFDjK2%uK5zRw4QyfkI}dcWzsD_qxYZkfh0I?O*t)=%DX7D82J^Sk^0zbC zjlUM=Zz0$)CZ-sF$HO4(aXbzJV?(XM!$E{N4=bU32kl~9(I%e?8ean!%=Tm*`IE@cUsbE>TEEPpHTKq2BoG!2E3nTP=K>u81jlT~8+y07x=vyRMlKwCb zcugLBVZon`GXC&*X8bLI>urBEKtP%(rhnH$z3uND5Sev^-;KZ7%-=b{@j1m5;}6@h z{Vlfq;StvOI|>#lNE7=(HpD&KIMX_$13+i{yBqw~K|RI~&l|?ye$3w(@P~8F6x3na zi}}OUTW}LphKL8l~C4$KQmuC14kS3$C$r0 zU5lmEr0lgY5ZNN^N|B}Sl$A|fdtjR*mwLoRev|JZ2?`8QqVs}_XGgMrksYG zvQ>=jGXVCx+fC3vv|;?P7+pE^4~CK`=+EpqW}V~y(W6)IzR9<>|KZ)Oeuo?T5ASZx z^J*W}i)?tK0KNPF;k`%qL=-T8@ZLk8#S_P8cFJ?lbLPZRSy5UVa?-GT?+6|V0!T}u zGyyt3!IHVd9OBoG&JuW^MV*;j80WCLg?UDuDUAl`@5UAbZqF_39~RROqZz2amSwvJcGf6V&+yBv|bN4t@j8D8$fV>rDYjGZ|d-WAqQYun+=0ACum+LSIn zY~A5yv3A=w^%C)k=yQQsE7Y6e$P>{I@s%+cF77Z9{>AIwjw&5gpWeDdtsJvz&BLc2 ze#*^j)%8$&#Dxob*AHETqNMYLKXeXC?2mT7@0KAW#ta`eHr6dRzBnF(hfsK>7%z%V zjTh9^R>fl_)iGEdv4WZK2D4yFXqH1QUorGib~+EXhAtNQXQ*` z7z@bolWQ&(HvoX>7be4G+2weTrdaGKjio+RO0;GcXYULCKs})=nuc zDU3lpYat{w+EAai(A5noC@rjo=T{wN)75H-eZ0n%Vz35{8x3!+RYLW&!3W=h8k|ps z6;)M`!qVBg3xjA@XwNh?T#q=M7=(IORS8TU82?mwhwe(o#cOIXIM^}BUTtYDEs-Olg*25k)WQ->vI79JS62~Y=hC`WBJ9TQj3e#RwQ4y;ygGr1^>Pt<9rNl`G zFKxE7WV*(1iX~-l{^vbRNyC<>GaHoZ81Fu&%+U98wLGgJ zr-?Of&(tx)a4#5L5kpW68kkl%F)QHB5`L>KFA}7|f8hlMy3@-C(^FSTJ0EHM-68wf zaf4zbCYtLZbj9(yZnO$@D-+5SvkWsHiVPYyAN*>09WsqkagZTeF;phc-TG&wdXt3+% zAn>2Mjee2?w*zCjq7e=&EiHj#Lt!kj@umi8^oVie$qu)ZkSI+k_f1m_Z&67#9+cn+ z1=+!h#Qd;sEdR$_B~4BkXGLudp1DG9P%ywD<9g*lT>ryF)XHP@G0!>U={08u##(pP zg?PhAHa2GPF#FE0JlXq}>D2#)DKlhT-~T!~6iz5NyQkGb)p4|rP29Mx!9mK3N~Xd6 z9On}|`C@qS!v8A+=?{)@KG5E5O;a8Gq7poSz;QKJgFBKLi0VCF>z{)K<+E#WuZ&gH zz^5>9+k}k@Z^SSo)lC19jYG@cW2wL*ok{D^YCSG+2 z?o?AN5;}UO(VJJIc6*0ila7h;DjEbHgy=S(xZaL41y$2vjh0u`PAj&$p%2{rX#`Iax-Jfvmv_TY2CK!maibt*gJSA9 z28ZB+%3`=pCA+U~iiz`a_t^Liwj}`FHho?q-HU=1nb7GOzQ`j`h;do1D|01=7i{N|`8+O7m ziFlZn3M*<$i&VH18xc%5Sn}|SAyz#bULb&@!kBvLq%Ve3_t??Ls>b2DVrEGZtQC;s z634!&N5*(kTUc6xn_qH2!G4)u!=pVsJmIAzgGYb34P&U)5`^a(v=zAT81R*X_CJK2 zC)~j(;l)C{9Q#xqhlju_IIF`E*}MzEy$CeUO&Im~Lt@D;4;nRQG|q{dio%N0>g0J2 zI#U3*jzn)`1x3(8O-Xg!OtkS}tC-~;+Ho7Kig$w#O>tMjW0{`d@M8cp-g0=ok;ou~ zcgUdFkYap917Sjx2nxiS=C29DARLgnm%$4mnnU*FpfJOy%(2RNVp0!+DOLkds0F1k zhW~yU^iM~Y<_^pom;&&)IJE?Zr%w20$ETdaZa!}G2pwGv5cUD599;o#7m{JMW^Q$C zT7_~{f%nM5(h9ss(rOq}RZ)mP<%hRpde<|=x?91mxd?(i1K*8NDD?J27k7a(3N4w~ z==iL0=%=E5d`aO9c=0?sJI6W1S4*Tb$*44F`C047qAdb5D>t}4O%I))Gq|78WU zRY#%uX%Gm=dKJ7!fR(8pY+%DvLxzv}sT-qVhpViB#^F?p%LgBHWATD2c$`oNif|P@ z;iSmCPhaF^ctKUsEWD8w6c)l^M86j>FKD1?cqxe|8TCfMUg|rzuzE&GWhGqKBUT!p ziif+3a{Ug%v}-b97L(d(uo;-#WhLc3$_naYQ}AiMpsK`KM9CzU$EU$mvEMH02+P#%IP$ z^*(BRz#R<2gfBN{sU3S3+{tJh_$m#4ng`wh(QL&i&^U_B#nzGCED6}h#;N^rxY`~e z9dIm8Mp_Sc==f3N^v)bBtA(`zQw4627&O{e?Yq3bW>DBu6wPq8>~Lk!G%he*)>p#L zf>R&Ybn<4a4(jk&iKlj08_8!xxQoENiNk_Xy968ys_`|S_BABAljw~TUtm+a_zq0V z)P9{f^3=e3hLu}uoS;?TzVJu4U=o7405eYBlXowAg_dj{wivuY>o-%S6%{k8_1inV zzv=zoY}r;{+`Tw4wMxqAHjZP!vkh(B_DY4#yd(~Ha!6z%tm+nBQf^)hLEMqRy$)Wi z!W~(yc6yvq*P45nnXcW`yN&;cy>|hRqDa?(duDQHkR*f}ue$W_5rH;f7s6c^%!fU+AfNvEV z^1pBOS2I1G3Ezg6|sTVGwey1KfnS~nOq>sV^`>}Wi5moHhy8zBki zYty<*URtbLC_3#T^as|=VLUOrc*%_z(Jc)ff^oQqnJ3KsvxHaT^*FNwIWJR!`7Kz2 zAu0$||0oo=ILe(U0@$AW&gFBJz-*J{L>xYLM7SXp7=q(P^HLHRB86OeaWbfv%~8-O z=D8*FmYY3oAT#Cw4*xO0LPar;rlK)zV8-CH-hXnievaun;m8ZzfnSaMps6i4dn}y> z8};zKDVGe-8-L00$$3BeURjc{)9B2%yxFxTjFCeLu9vM%CRw=8c?WByUC0_e4^nlT zcOH7dDfUohxev6MsYaWs)~Ikpz{{uy-jqdOFbj-pcJt&-KiScpCa%%z;dWXE=e+h}(4(e|8F15* zxwzTJ<)skswdy;#+>w)UYLAuMH;zV1=PaDJtk?(*P?x?E_4GDuxEZ9zhPioTLnk7v zzB-{We3P%rge6zw3WQ6n3cnf8ZUd7vXp(r?D9;-4%w+j&KCCvBAMT+U#752=3&d9q zSYN_q!dz5Gs<|J!8iU#l~18kvi<(NTz+Id8`Y!MIxt zq!}7x1cwgj?u1X9-RjU-Y#nAklMFtPRAzIaK)a!&AHD_)WLWOxk=a>hNm^!&0~AI; zLDvNu%o5y4<9dm1Usa?rY%E@Y=0hx8UP7Ch=jLKQlhseYRGv{z+9Y*n&SzmkigV65 z1QJ89&G{_V{pf-ZF^+YExmrAUHy@e>6G7B)rwm7S=CBG6aINW>`NaI$yyd)0LXt=s zLrje1@oW|u!T@`DDW^6)C8eeCFO^yNv$3e5XHm&bC92CsJ~+$Mhb4yRu5fZ7fzyu< zMbAbf#!wk|M2qllv$Z%|Z8F1iCyX3FKHRxy3DI@l^86bF?>qi%n^CRMvFCQ8(in?F<*k$ou*AGXtGTI z$&(uCA7DMtzCtV%uthY>BV8wQF{W&aaBAO()e6c!btP5ZIADIXPZY5}IB zS%;`;jp72FQ-yQTnJXo>C%#!{Q%17r)6PGR<#HOD|B-olSM%j2^(sVQdQkhS*%DMq z0s0F(bvGN5o^_r$K6lEftMhm!w47Z)aZA&-sD(CJ+vICt2*h_F*kJX_5M%Uk)w}9u zr|#WaobQat^s?3#Xh>H+T0_={g{g1 zR;?{^$N~u-^gan(b41Lw5D9{@v`g)3L4SrbOz%IS;=14g;kr5QpTKa618aOJjPKw- z2;)1jrst7#bFGEmmw<8UUk-l{F%==*@T31@@W-Fw;G#-M41Rha2Cj!9X1Z#9JpjWm z7JpK4Ee&;8HiHB+&C4wQqXnnn$n`DM=UTRW!5$oM5Zn#Ng@VcXbHTLHFPQ1xEtonF z2xhumd!p?DRC%02iAmm|XP#3_o3N+)ILX)BmTyw43-YV2|L} zfJ+6>MBOYBd@1lU!KY>29pfGVE))Mtut@Mu!ApUeN9x=Me2?IFf!7OmcfopN!P&sf zFZE{wbKM;A-N03Xp9ZcLd>pt&a2ztSOYjxIwSsR1en#*f;CjLCu7>fl;7ft`3LX#q zn&2CO8wIZi{z7msoTeuQpG29Q7JLNwTfsYkzZd*G;&Sm2^D-I72*C?+;HO9kHmyh!j!;AMhifmaCr zE81R};6JoQTN3;|uwQUC7FpgSxEOf7;75S(7yKr0rQnmmYCSD%>wrbMRpLJp_^9BY zM;OL?f(HXP3GM*=k>Ed|&-zsGbHHB+egOES;DNxW1-AkIR`5rt3oagG`80wvLh#># zV+40Xm|O55VD_WbUxN0QBKQg5RKX{KJ%R_g(FY1%3e5GmjQcEbAHn|wR%;~T-xcMV zCH^CU2MN9wc&OlC0OtsP2$=1RoNaObE))DZHZ-|a@EyQqf{|O}PQjM|`vp$`<~~B? zVZX9o@NVGy1vdd#3XVtlRSC`kf3@H^;2OctqC?vycs_8g;J(1m2>xeBocn@b0e)HV zR^YvYZvlQya6jOKf=^>%_F=($fsYDa1AI*IINE?~TO)9U;IDyW1gFNM{Rkcl94~kYFt4|aTM3*h_z%Dy z!Q79go8SWAbivO6_Yr&wI74t27TIPAo(nuk@D|{qf{y~{2u{QT>hXfF0iGiGe&A_> zyCA>Z!;5z20xuI>47@_{8ej@_-tQK?4thPo>)_wJ2d{%g@JBY4etM7Kb?{#Jqj@O* zYvGSegTimZAAbs$!5>K|{114h3vTR*G7&t~YpzeFJxOWidQIXx;6F%ou7Lkg!B4|K zNAP3dA0gNWo5u+L5BQH4Tm%1!f|HQ$6v4lP|1`lv;Xh08V&Gc^x4|H%Oz;TcI|X+G zzDMvMV9))6{{~zw_`M5**V7+>pArA3!2g=y_b)Q{Sz>;>03Q|q9N_l^uLS-`@bkc5 z2#)O*yoRm;J}v$OfWH;|67cteX8`9o%(|F^^3>O?yMd>O{~v+%b?P(NsjoZNBfrZ; zXDRTlg70UU2!4xYBKRM`_X{43yz6Vn4Zzjn?_>E0-p29~d>VGXEVvWu=rzGPz>R|2 zp&=a;F)Y-{kR^};C^^&>!Stc9!33@%qcBULH+c@Vmw-zsoqbTiRVL@6mDfh znO4+f!h5kP?KTyi@3BYdl=@%?_vC`d?Vn-=@Ssmw-G*8zGuLPKZAVe z0#q3Ja`3bAmBJl^pBBw`89c0fA6e{+mN4?A;%DVs1~*RifM`D2VdXmsKKAkS$1pcw z-(?`P@>L?N4}MxSUpADid@-43KTAFgy#jpPr^L$l8p0maWTHoBXB%HJ_zuFKd>CE@ z_#P6z{_vyBhkGac1`(#k-)C}kihojX^lg@grt|R;!matp0&xrqnCZq#7|VGce&p4B z>-(DHV|Xdie1&jX`GyWQ$3Eo4B|nf4)*<=WMkqy>gx|m6Iw(<3OC$8GqQlsqTla6^ zc|>8l6s>n3fX)N`$=4*|Y=^X+`JOj>fo1oG^Vq*3YhYH!dG6m3(GLkg%yT&17%A3e zb5G}e*p(T36gZo#yEvQrf&a}4eUQD%DBa)V<2F6Mj`3CPUDLriYQEv-=EK!7dE}o;3-I3FCr%#$*Fn#g#%v5(> zL;Q!>OqcPFw=v@-C;1mw7SvCw$;~SqkXP70udsbyVPaKd?%U1HhY!YAeY(8qpy%-C z@nv5olDg8|ytXkHp|xh{UsdQ!j;5D9dtdU@6%JdkLf4z2pQ+GIj;2kX zy>EK<6<$KMFc@7_oFFT%4=64+Sd)6QG94SomRW+{lRqPw%9(5ur^&duZ z&f)J@t-q@FpAmq2-&*x%5{|Vmt}0tt`$E*Bvy=LESprD^%fZd1zn{OR0{f6R#LwTk4I2z^ z&VVgl=FWZYlVb1gC{gVj<=Z-K?U7WsZdIx^TK5h|d1MzDV;!v3VLn$o_xF42<8vOW z^>?a_J+g1i;g@PZ?XsfHe?77z!QC$P)tZFwUaV_l)K1AQz?RIHL>ldLntH7&@h)&5 zYI{6l)|K<842!dtS;wz@jf#)xTq@Kgto`shoXwTpT;$9%Gmo!{H!l) zKfS;}v%NF7?B0x;&Q<=5{g?@f-g5z>)b3byczNxo9jm@1f#>m6_0d&77p|N~YwP1` z!BH1K>!sTIHpWYe<8G6qP4lgB+b?vEI@-LbK6fi_TVIM_)VO@_pFGnXM@G8W*XP1x zJv?wCjEtyyBfjilLfJQtz0IDJjm!6qY}eG7TXitLX~ptI2R-{n##F70FS|LRY?A{o zWGt#&UNJHnXGayzj^gFBHhC&W8i)VWbNJ-fUyZ!r@Uh$@BimNJug;e*9f#ld9R76q zha=n6KJTe*`uf9>QML8Cbt5CIEN!E#X8E>}uD!cGRkdH&jf|_R$=x(Iw*Kpi zk0F|HPS{+vmR6PW38>*sCBu$ZpxOaY(E?cD2LU9UJ8| z+?{S2uxP~I&Hi!NhJMQS!4dA*Q5ctW+Kg@Jr%rb~_e|!DCGMz6hOsVc?Z$1f#@eUR z5UL)}*fy5iTGxNho(|13(&+zc{IJ(f`V&SEI+}c^!|y<6foAH`E!5v-K${Wy)o1k1 z_JLE;$lhvTSMjHIY~8V8$EwlKMU?K`?=r?lCs!M#2d;TKHsh|nqw8I4yS}u%agFYF z?w=gLV9ij+@pctyliz(|<4ZAXhQ{R||6!EVIMHs+%cqZDkl*$P_fJZrk6-Y{rOUdt}0laxecm#xC|xT3dnY>9P|QvuJbt_D)eV zD%k|&O@jKvB^%n16>}x#vgX=`ZgcyIp z=s`~;--({_=87jOw;{o|*6usvHo6=?GTx{<6#pNoQJWjv_}{qf($XJij$|hq zrM%ffyUbPH=-M;BOA6WF7u>& z<8QYP-dOMAwc_y9gu^2ed>7?;(BiZv#}cL{y6mS}7Ew5#VvLD*dK$gQ9DBFm%Hc^* zNUm>_Q<)3ivQ6b-~9D86dohX1PDi8z*dg30E8ZXAIx$8?`MzU8+Fte3j% z2IG)xx3j-DCC%HZ!rR5??Y#1-@~xXDZQ9Ulm9HVAd~ta$DmBx;q1@}=TAtv4s@$Qz zgRm$1&4S|*CnA5~Hd)C-6zT5h0lc5dXP=H|453j^O>@Kx2W zUFB;ue2t#+58P3?&COd4qpqr~zxuR^uORhM+`6c|f~1m$7YYVHRlc~&pYUS(jt$!i z65d?3ub}JLt+z!L7I@MMI{T_lsxK?-i8_Q2G^8TiKJSIe$BeDb%@`x@aqjbaa1}w3 zEGcMz%L;#Vtv>-ns^F4X*ng`UlyuvwZyaV;`EBHzN zRPJTA&D(ybe^5;Sf*$^8SVW?7UqKgNLH9s@3c97n_zEuaRaKe!D@ZHP^?5Hsd-rxj z@8s={PS@L`oRzfG?~f6dcPviBSi4d=8)K06PXDK{#muAn8pxi=eFfel1&JRPbo?Q@ zDayznGCr>${`%MT>)rr%|*}ou}-b2O?E9jtk zecqo)xqa*0+T7gVn*-;}JeD z3-`9j{293@J)burw9L}Zqr?J?PS&b-m^blw#D`ufgwHS2xv%qfL1>{jnPqceNFev_ zI&TMf<$2@tH{)wDrggTQ=OO1|v&5VmMj>(@Wj3hrIfsH~cB_0xnfbmxE`MtOKnTC- zg74@=9PxHk^_QVT_CzmkZhqlZ|AKgQNztrFpV#wT`YavZ$E`AXq|q3Efv@V}wX42r zG>~1^=jRvuyghp~I`{8F`}b~f4Qp)jdArm#dIE6+F%Cr>`=BY-$bT^%QAVd^MO6hV zF)Y0_qyycdUg7m_OmVKh&k_S>z#vu3AEJ@9^WwJLY2?3)JG)wSW}0nr7%C(Jc6viA z1YR$CdcCc!wADu%>cbgG%hnPNBhV6^t+zzYY}SXg!~E}30{*HsB}!e~(oy@@pW5e* zM$$7~(;+ARO#F8=z09)p}wcVocLep;u|_2l(&7~C|6EeKtS{a*E#cZmwOE|*p7)D0JlGv^a$jin?LMH$b5Zvqyp_4M*AS0^ z#fpZks}6qI2JbD0iLrDMwxHMX;tca;S-b&o4ms2OS;gu(OH&uj|Kn>zjA`jnBAzZRXk~sYBflJWw1v`I6sV&~5Bv&vt)m{)w-5 zw*AXBFV6n?;LcATnfl*J^M7L;Yh4jf`|$hUes_CDLG~}YUQ_+a$Qh3>9DTIU7wz|a zJ!D>8;x&8zbHa7K|K9UZ(PMr7K4Z_tkA3&dwQpYia)0lmf4cv>&t`m**m-nz;*n2& zby@UX`CUF3w`<$?ZxuZJ`V-A(+I%;v_vxX@n+{JrG@x$n8%w{rvg(4j|DJeFw}F>@ zy{^nPxaZ^do<2HldD6-M+SF}(k3SE2Fkoy!Nw^W80tUSMyc%IN#haQ}3;9eD>(?W_)&Pvu*>PR1@V4 zGLN&mna8q4=CP{OJnkK19-F3^N85H-FQ| z$9KPbC?sMoHo{k(rjs+%(RzSP@(Ie*5kJ9kEQd8EzY`Ek28UOug9!{{rf z-}SG=r>zA8FB_j8b>Fy~fARH&+j@_lTJliu#aAEN|Lvu7KmO;>OP5`=w5-JV=-1uq zE{Y#>{_9OoByF8?qTAC8 zyZ4_^|N7k7{l0qX>8tM;o!;)XiHolJ;k{n}xq0-3%lFU8J$m%rx8MA1NT)~dy?gW( zRVNF-Vf-Vv`-@Zm+->NXjN}==eD9ylT|e7;>@UxZ{@cQDp07-wyKv;HPu3?snRWb~ z4^Lh??V(qJ>93iz4M;hd&f*~`_kpxYwwQF_xT6C z{*Rx`zVF3b;$D99ABE**9d`dK@oDR;H}ySrV8w0ypBUY6*{RAAZ#~)hg9&Xm&j0T9 zOTPJ!hhE&$bmm##?+0g9pL}5azU<51xMD@&uHhFHJ^s+?j_qR*jznXmN zo9kChp7X2To-ga_dO!JoQKzbDk6(S`vKvmf+xzPCWnYaL+4qsZo_hUQpZB-rmT&Z2 z@NK^lPuzY5>Um>A=Jp*9`F7-Bl(9309Vw~gy ze~1V9bKq`diMY#fbl}b=LELQY4!r4)TW%$Ll{?FLAtZdTalMYO_=Xt&5PdU#wlO9o z{HI2rkobd)--m=>VN`{L4>Z<!E*PJA7zDvS2Ej70AewOx5eZE(xg>K$+ zYN7ibX@B&idmI5|AL8*lrk3a``~mU!Cv+0=X3j22?~lseLA@``_!RPWk#K&yCJ|qF zyi(G;TDiT(uf;tJx`{@2<6Rsn<@hBUy^KX76!}flRLgKg#$h>SrqK z=&KGY?@5;U4tbY`P0EoG)Nz>6%=IGuO@DGbq46_H!zm$lN_lebB?;>vD0A`Cc)4K4y35xA`pqJi`Yj@s`Yk4w`Yk1v`dvf} z&XqVW6U_5wh2WcUbm5nTj+^D}7L0?zY|uXjM`o3n;i_)|X4x+l|0Eo55}bnLD#0xK zdj)%N+#;BKFAHWFaH@p-tcU*)+y}?@Y}@e90PZR{3ph>iAmBcNSr3_lbASg49sxX7 zFzbP9xX3vk_;JB3=Qjj1F9!s(%pXPHOnvG!2xgsd-3k4f-*zZO;#t7G1Q!8k3ugU% zA-EKHU__8}l3;R95zKU-#~4nh`=#Jz@b7|?hyE*oGX=ArlT+GvPE9iK`Z+)DtKT`F zU4pNvEWxLImtm_3dEq?djcmM985(N;G^+^u+~>@?EK z>+$3XRnu?YTVA=R(gN&|WaF@Tw@6-nWZ0w$R}9u~5L*({Wvy~({T6XJ4*6KIjwAKM zE!$^ux2lTmfXRksTkS!+>c2)nU{%ct_Tzd#?p?(}DaRcJV?wL-{ugtIq^ z!om?+f?KpIGckOQ`7DJI)InlrS;~O3SbdUvCO0+#pZOKxlAG`y>7qF+!UQc^)@l&8 zJ8CryjQsLi2&G#(Bm;v9NH?nyJR zxg&sS55ss3<~7gCHwb>XBm_kBacpSitF-VjJDM*S*viLiV`_lS)T5KvSSw#O_~!$gJ+44IL#)T`t%We5xZ{fpjLV&NEjjsrN zoEy=i?Yq#%R|7tMet0c>58C*i!O0!3$wZIN4K}`yz^Bh&RCU0<#Wudzz&DEoBHF%E z8(&iQARl0W?`>daPoE#%aNi%Ueh*5V92_YlK%(oHx0psqR+h?n_eaL!tlLi(@TMI;q>O)^eWNGm%&eqrv5uTh}rj0 zQZP^{GNJm+_BM zCbo<$#?XE4jj|dt!xIz}oBy-r+vxqXGP6yMbAQL0`D7G)6mOatjY&?nYP~(TVz9(1q zOmAE9sWP^>Ft63Bt^e1Ww$U^X4p@xfHwjw=yTts$$6OLa3Jd=J@%OhNzqK2#U|#(fh2% zFIrk)&Q>jGZB8R-nN>I78+L}H#fBLRie{><9n7>qWc0Joy@XL|ImH!7b|%!-ESusA zJKGgrS5^M`{Tq)q%r>co_k#bloR=E%$e%Pt>2Gx`vmMek9Y4FCrMav2O1&xg(LV=2 z$}V(b96Rz{q&*CydjNh`zCmzPM~mj}2M;SB_hQm~Jgqd}6TntJZHJw2hmDW(=bDdw zujcdF_@=?l{zHql?>2Z??c;t=nh$+-fUgsbv)Z>z!t8uWP_puIZz#=Yojc(5%F4F_ zZuVzdw0(bthn0`}NNGOn+`$o>efJ}tbZv@K^BuC;$9r7OXPrCPVdHxkEbL#kXufJ2 z9~%jVO{y(e=MGlc_zpsc>1xq@1vb57P+&iF z@lXsLv*6aE`Pg=-r}J10N0C;NFowqq)F`e zVz_R9OtbigqPf;hE6zDqyHo~ko^y}YDw%mmminKL^3&ES5A`qm17l^viKyd|h2Ebm z@pjGgrhX;+M(lAN;!?;7arqHWjJ4Ea!b5Q--Vz7aY$}gq30TS)t#r0ExW~6yg)CyF zWMI{6Srx`#B3LuItpQtQjAvA6CC}zMI4rtED#s&FL@A!j<3>5S_9;2b=O#cRB|5we1l~Z${?U!7mVGo#G4M@UXudMhJVB8L9y8rYA_l@x9uF1aJ9gSh~ZE=WeMue59 zK*g~;+Fb1VZy2FspB+cAHp7ikgQ2``Ndp(paAVTzBy2Q}>fImD0 zwJ`j&IP!7in6;-4#F60-+VnZksDwaAC)vGv#UvY{8?swEXK{%*UKi>~x zkQy5Ulb?N%e$S|doiYwroV@r!RNgrNhp^w*Ht-tckXsF2_Z?CQ9%5dYAl>kDaKH{p z$Il_RB7KP2`9j!j>vxgJPfWX1IRG%P^TeNavEHb|>3cyok`%R2J-uXWJrG00yEAU7g2?uU|bXu)G?$yTI9@xUWwI{Ap zOpEXU`YhI> z;vD=aS#W4R>%G8agjxAG_6%p=Rq(g+6~WOBezcF>55ss)4#3aKw+rsk_-UaYr5}F8 zIrvfhaA^DVSd4rtL1yJU4L|B>(R|CGWaX=e<4!2iKI^@}3>#lJxOtt?qWPxU_=cj; z)j@>^6DSwsU^5NaFCoF#a~l5eFsvpl228Q1;?y9rLoC zQfMDV>pcr#rQkhW4*VF-Hp%?P`;$M_*xbn2khKTy8cj^}RSjU?C9a~~{ zyXzCyJmlCNvwm~@noSXJdiSGYrk8u);*JsJ1(}BN=A^yl@#VR>&CT@5+#TiT4jz5u z^3!6lw^rn#=q49k!=mdNX6}w^oMbxlqA*H4X6%ltPiS z9E$d5nry>dR<=SXU8d?bY{=DI>BTlK+Z;2omrw4@vbFITx~_h&+3nocaG@UbwN?t* z*xycVPlu5@(#oIVD!@?J)f8nMihFAbG9??+rMGPBSDk=ti#t3aZ5cy5Wc7(7h(Bv5x%q}klwN) zd4MB1LTS{%GP&;=cXM4sgfdi7Er`n>g>964h3&T~?>*$VYzL?9*2nCE&~jTFxsv;d zpp38=M%-Kd&9ZSR?)(>BC^QzUa^@AL3@hviq&J?lH*z0HtocIIW@esQzrSUjnVZHx4s+I9~%xC^8jBQ zbqR|zc?CAL>d+%4#+TNa~#Rpa$ko)1eG|F zd!HHAmB(d~Z~4k|k#F<9C%D&C!fvN|*YkPAZf9{W>rS=n{Lit;&Ymc9hpFDKJy8py zXDyq}Lh^G*9_)v8%YfUW@=yPlS(cHiF!DFU=Jwc|ps>9=&eFC*+uez_Ah3j@Uo!iL zWS?n1g6q&xuz3UGXzwVf|34wwA2{5-%{sUocVn~MQRtv@(F%F0Pr`Nz1^pJ|hWJD7 z&eEhFdX&UKtwHU_f_QsexOZkruXEwXd1Yque5bqP>d8F!OhvU}qE#_@XN0@s{_#e6 zLNBkojG7&R-tQJ?lK4;FsjmC+2xB_e@!`d`>UV5KmygiA4oV z@zpnOX<=6#RZzOr)WywL)tiq`JN4nm)$jjw&(+`j^xhaz`%YQfY0=*JTdK>ucY5GwSME2u{^F|n7k~SRiEJo>w(Xe7fcO7SgLmmcY56S89&Vj=;21viL9@$93z7l3)GCOemkW35 zZingS7|nr^b+!bP$%&EVO%gsxg=ZP%;-0A71C0sdR`=V8T^JJ1yXv60)QH^b)+1HZ z&t>Qlu6A>z9~77EX^2a$VzP#7>rFow@9M=K`fv=&`*RBK+c~fE2g|^f;VCx#36>i* zhR?9++vjmUvxR3#{4Z5{u?F`v)(wn*-J~pMB{4-XTqyZmw0KP~YLfKM3#J95f2T zxQ;Xh%{ilsOw4;c&OK4MJc*cmIfBVIPB8f<2qxcO1aq#3;^=N3l|5pcvPaTY_DH^z zJ>5)w7B}aBD4d!irjr!J~&2h-%}aNw^3D?&qVg`6 z2{uOuJs=+Z^g2owC3*O6UpjGL{Dbtt&mj*j*=8Kl{bmu<12PCd#$|TcR*5ghF^5}6i-(}s0|#{gFdrVZ?y z8JFeonqb=STfwX!ibL8G>qDPMF5n~@2I1*M%#UWb!(x1TCt@Xd~|j&gKf^|vqZT{ zEc8twOEE6f)x-ri)*97R!AzT<;67)8Yqhf^$r72vXB^AsEWsML|GB3QmW+WP-?l%e zwaO4G+SZ(*1ke3o;;aoxo>G`P_E(jHrP}ggh6)Rbt%@=jMT&3sjriDoD1CSxU6sgF zaBbnTm5X%jR%*)fP^ESAm69a^Gg2#zXp=J+EtykPGMl?M&O|;+a2hO}eGWs+{Mxdr z)3j$<)LOM*PODFXLK@H6Y0Nf06CYnH#!|j>Gurh7Mu&a(%{=*k+3Ld$K8|}>etc%7`ATejpMq}(!nJ6= zA{*aO3m@~N`F;an&F}pv_i**g{f8JQM-nOppRQjHxisIyHa>nIllS{ts7KidK%7Gd zq{hO>VLZcFo}B@#_VL}iaOW@gJ+SI|TG9In?6KU{j!mJfc1@?(T+(R}X%5a&q1AUqhI1x!8CR z=n>~gKrQ%mKiLC*3}Za5U$*jHhXAj{;X(7gYU67JUpIua{L)2_e0Sq#I>oFf5WfbSz<^7Y1#VdN{q&&qcg0h~9|LOlxS42W~^qZ~%(Qwcrt^}&x}8)k>+N=3TECSI*jW*t?wsPqMT8r zsvS^W>s<{`Z5#c`H&M<7_D8Ibc>GEi+_-G1<)z$ny^}jID?96a-%qIL1rm~_{-@)7 zau|3vnY`3-tH11yS|cXMvwlOx2z(vmTYTtbK>n-v&T6zrEJVDp@zSvWe=N@@Ya&)SHO;Ysg_Qp{En)}CI`E;uJ9I>3wkA1GB3Redm zCmAf;TpjTZI(&l$bmha`(e9*m5!WO;)GrHm!CV>)LF8`1H2wqU{eJ!KbI(o$xPz z#rGc;v>$s49|&2wYSUBiGz@E)h-b@NXW@zD?g%_Zjpox%R%itF_eUj6h|AAvyRBhj zsv959@uGYpo1FCgs7>ALcp5y>JreJ6D4*BxoO<-w)aoFrqba~ zuHByi4Kwg`G~gar<0;b_5pAla=mufkyAbWas<}_>o|t{r4<2aPchGq8;6Arebuid99gQN|6J0(D$-Bp_ zdC<{k%rnu3oV z)xMDsq(%wAc(ggye5zyZA^5aL^)XfNd+^nicxjB$TFrk7K3%5zKfu>A_dkz9K|6Ct zT$+Lw!ETQyFLi}#NT!Fek(_y z-K(+FN_CD_s>4~T;@$i;>_i&q^&-}BWq>=Seih19E2(RytN$})fccXe;1Y->nTAJ&9Ny0>TN`%3GuNMu!6*}vlj0Azlc z9*6g& z#K_wcU5%@bt59=IL?V3d6gTf5xSqFzjc3~e|bsvr}XClQ$(*x;C)3B zBZ+8!4t4pAjKX^u{Vaz0aL98^&MoNYdc053&+Iss)z9EO#9i;dLIuh!@L?plX?R}fQ&_tnHK z1B!zWAtCTK^m_=Cf%U$!3k5U0OLS*^o!Q)7G0Z~%bxSexra4PW=IVVG?K9|MR6?e# z&2TJCxN!;Q%$FCImdu_R+_f=0TWi{3i18hzA3+>Oo16xhbE`Gd1%+URoamfuc3s>R++011(&Ro85Y012W=Chx(K9Do>FBw0}Gr5*}s1`nNqisl#R;YF3 zOO?;OISWxMYW>Ty<;o&?j-W#EFv8{=`rwRY)*LW_kSqpEB=qr{ZRf>6xrJR$qn~WF zSO*h`*7D(yj$;W3}i+t7JM4bz~crq1%rD5R#8 zp7IIz1jNQKHE3O}Z$2U!F>}Jm$&+(OkDNLD>Z>MC$-QdI%wf}~jGT;zH(Fuh)M4Yt z4!4Kn6h1E*hkgWq0r?(%<;xZibWuuvz<*+NCrZrweR1HxK7;Zxlk&CkaVCvjseS5jH1-` zeGNS;ABSx^zdUL_+GFMWRKgUQ1^-TPjs&2R*3G#$KjE-Z;g#_5ZoNsY0=PU<2wkx@1aCKj!!h7ea`p` zGh5kz-OK0As=6Z(tLQ75mJ7q!N+l>7R|>rtb9!tK8|TL-_OzRSs%!b zlEoO1YD^D?Q69GGEp0__7$Pu^9{VhZUXfxj|1pfei;)PATHfJ6*djWN-%PO1$$pD` z&~}y!MeF6kKC9jDkx$ZKJ7FBQYg}k8GqN7fx#ncE23>mIYsQ*bIS{k`rQ=zMY2A;R z3uS!jk1ODsjHW2e7S5gjQ}>+dd7SVZc;(aX5twv}GUkr!HFntDnEr$wW>}+)O3XE? z>CH~o=}iP!CO1hA0e?-Nd+xl>mtrzC>rx-)IE!8G(YZ)58q+-yM$ND*U)>W8aJO}i z(>j^yU-QfxKYlXPOg``*U97dr0{(W8of`ogOTS5OO!w#YD0W6|#e{2*G0v!88>P?t z9^JJj**WTAeCPgO zqL9}`Er`PeC6-gLu{}Q`$m7>B-U8;Mrn&ys1Sblbl z`^pz`eN~kzm6}zD%$0~*cTZGfE~bQ`_*kU&wQZP>XY6I1ouP%&ys`R2}!(&zOg{du=zudA>j zUQG=vLve~J(^=P?9YpT`7(E^H*zu|ENrr(Z3z77DFv>l)upx#~A|}LQ9VB(3gavL9 zrp8TJs>DTAC}tJoCYOKMXw0B@#Plf@U8Z*wiq>rAW(m|MAYTYSqV{1?2Eb)zkn?`3 zM8!5d_wn6v$G>NStS9<*EiLEAEP+rupS?UZ7mr*M`LI|cO7!W+ zaEnv9f6oBORQ$LG#6Dkjy9zbmQ|FqHr)=r{(?Ur8t+sIP$E$_m-)IMpbn7)e^rrhE z8{Z2ycZ`iskKZ1Kf1Ipfw3siGX;5DG_5765p$CNHGR~uk({RWO zMOJ;jYoX`V`Uwu`Tlpm}$6R`Tjbjcy|3wqE{T$Qjxi*f&^jw>VSjG?Ch~?dPjtlj? zTOVRZf@I*Q=apDqdR}P|u}taq2If2z1$%-4$^X@EpOk zozME|PcvQ->;Xd zb9iC*Jmef#7+vxOXSdAxzTl+Ozc$miR8Lc#b)GL&>wk2X&zg~cGr*smtwr$zG(w(;F*;p4SZ^F@Iis)2lr zmoPh@1A12b)?4^^-PU}6Mt^VRn~1P*b7=2F&&tR5#dLnr^#=G309*NH!Oi|!3ppsS z<7efo0U!Hm4}R?bwS8NGt$f9BPsLA*=6e_(R=&L!K3>W--*R9p-(I-G*|$jIFjI4}RA7p|6$m1L{h+@4UwJpzV~)ZF(HEhSSSH z1jflwv7iIJBEdW`j6eIn@YXdMT93y|kcf2-Z5H|~=F!7I2)QT&VV~8WVx$`n4~FYG zW{!6j6opKoopTN?b3k^6`C{X__ZsE5I4EXcnQjz|b(phi<8zm+863Nzxp}?6id(vK z_Y2OI#gwO&CziuuMm_6)=qIN|`JKtfB5M*CV@H(vE`LfJKbg}vU`p6u<&UXSJGDeb za(|H3F8;@tiit7&Rd@e2iI|9}Nh`qA@prg;^u@%UtWUtSQcW8C-EXP+xN}*9z2sXn z6gIANdSP3mk$j&~8IwHLsBvMsrt8Vd&TTfi=WiTxdTVoY)uyV-*s55gzI{y!%!(3Z z7#O|OkNv}c&n2P_-@SsG<|z>f2^o>@V)Ntfakm1J86F`RjUpM zd~b1qYg7bP`7)`*cbYKyw4=@yt9QfMk+v=xTe3i3&8IOQ?l_|Pj%zE~GQBNjVAl)O z&x%M?POr$yPG+r)-5RVFRVSm|Moo&lOB5Ol4*Sttrl<{N(5TFCOtsQSmCJsI>50sQ z>?mYUUEJqmUvUKN>lC5w8)Uan8HPebQ#ad?*o6rO<>p-F`IvJ)wv3@I|8!|vvVXiS z=VOV%?=-YhVx0Fj&#Rb7ea?>#J?Hnw8Sbtq4R=>G616=Q-ik#5?MG8nyN$VI8?yb% zd$)F;yTXuma-QLHs+qT#imK-I>G5oV^zUz^Cz`#PX*vA7{HR20`8Z#H@Z9E19*ya8 zqkwb!=%JE#Mxx+NI4%H@TJnpoKtNm&&IrQqoZvBIZssmh3c8&=H#@!j<^?+y@Pz!M zzw!&@6H3ziv{FymAJEq1LN~hT6!(g>7r)ZXW&IP@KSOdh;)_tN74ES|?{s zWAq+tXd~tFinI=Um1F*H*c)s(=78`|nl)R!ocB_7Uh65iPiE;RQC)cxeg`8%#a>;Js##PB5 zMxZ<@BZ||KM@8ht#MU)%M<`ejZR8JOU#R-F{I$**&naUHR3P@Eny-vQ@lbF-23pQ7-RH#%UMN&7jjaVRY1My&_?Crf;5o5cJ4$%ULb$9tINj%^L* z4tAK%X3YFV`hY8t>*TL6n@t~t2b+)Ik-Xvzw#7<6BkJZxa3FC0Kp)i>Nf>pKCp_%u zc_i&?!ia%J-q?vFCydC<&M+pA$<5@y{{6GmVPG~70|qJAz|8)1Y5N@j@j0do!(}5$ zFvmq2W0+*5ioY613C3{A$SA`D0uTU=m2W@?kZ>Ag3|I`R!=YxsOA1v zG8h%Dmit|$+v0P^H7Kr-yA<+s7C9)czzE;;<9<|G(l9*mau@|cWgwT@;UnnfQoE8^ z-MK-B(jRGakF~ic*xY$Gw>|wr<2V~OgeA{s6$_Qi++Q{kEql79Nw9XaZ0-d%_b+Vj zF*f(xJXu7@*Pkbo2;JR8{|4Yhykv8;O@E@zeUHukYnywH&3%QqixhvnaolF#BVr2= zwC8r4`+1xDO`E&I=H4PVV0+=8i1yC+Q?-zv-*nVMce*WnsLkDM(_b&{If%=5kvmF# zl9PP=2Dlcw``W^DZSDx0`vHkR1#uIxU))XX_(aGz!REfl=B~22XWQJT*@;5fQWNpC zVXCFSBL5JZn{xnK7+z*`kF~jvNd0n7KN08aPb5F=c@nXo+$_m2?}rnyzunb1QW!1K z$Tps^l|SdYDC`LnjLCs_@lE$sgKNSmru!NrEyO+D(0eJH;ny0RV+-nEZwwD{&osW2 z@>&a}MC@Rso3m-}P@_r3Hvh3aj!1hr3Y=(MVf=^W_afyUZe$DJb;>>3NEZD}<-XGB zAmz7Mxv$0m5ddPQH%VbfnmVYJ3n9<$BrPW4=x*w;934GO%se}KnwYja(oLL1+{?u5 zhaA%FvbT3|G7G{vD84_>aQf?a=}AY-bovTr`U3=$d$3@pe}!PCKVGoDsyGml@s$1e z$9T$qV5Xz&7p&|DR%s%Pafy}vz)S}R!$AUw;-LaW@$@sX;;xVJe`Tj& zWhZdH=HbLEMDegNAu4W`iB;TzCRTB?O|0trQWJY{a4;cAH~buZ6vXusX-oU`2&U~B zf|=%Jf|-sg2k6tEEthd=%e8{(KUc5^N49zD(EnD!v~jh?e}iD!`)iB;F2S_-8Nn<+ z3fE;^gQF^E;8I|wL4P)H>S?UX3jVq9Q)MMsl@+iL{)&euBt-EHF|p!d0YDTF8wEu1 zTyA2;^HUS6b|pq~{*(L5k-LXr>Qa^dR8!>%K<Wgz)VM#18^X}@XUh0vJ;rauIvQv2CVWc7ze|Fe}Vi8 zR(1l@RK+9YiiZh86whcAE1oeXR{0%kV#PDg#45juCRX_cCb!Bja3H_Hf&2mo@(av# zRDOX2`E75>FK{5gz=8Y!{LP|MD=M56mfV=pwgOZVwG0DiB($AVYo_*9ScOIo@7VpZlc zK2i19#q?MC1ty<5*MP~V@&!!3>+wqhCf^H!sdGRuxs^R)LnQrKI1n^Vg&D4N#5QHK z*spAsxXQM!j4Atw0yADW{E~nfFIzCt%YA^sLzs;MROJuVcJf-%{6zH7g#JNs?F}W zhu>MU5uzje-z{InHHveJW)_vq!}gj>TPdHwMw60j<1Vkv5gs(lv}4b^!J84GpIx8RI^ZQXef?*q~YqMRd&Qo?QVGz-L!5+vi!5U}J49I9QCPj%{gX z_$I8^X@-4c4y76r-l9N4gY6ZjnokHpYi&%FbZtsi*nHW>Y+g`gk+t;AwEG1MN0h@C z2TRUejftjGvT$DO-BU}=($bq2aL>#oSP0y*zxr?Oxrz!1SrHqi{6fN8R!~TA*a`~K z2$O)SMNzUd68Q^^x*z;hAaE3zn{_ z8n$p37A%+(*l5|Z-r1f_OHi2dwS>0Jqzbg+S<(fwxLaZ^Y}Ks*|*_sw-)$)MhAOSZeXIXlN+}(n0|Qu$gzOGZQI=Y@(}K z0tH|W+s^BMZ_FKWjI3oM#`hKQ)8Y`|!I3yh+*xwe2aYKzzk-5YPlqvF<4w>b&Y>sd zWIJ;lJP(-mFpT5Tl{P-!J8=xEMe{AQ@qKUM<9&$cD+adOHxX`3*#t!Mox%K|Rc{tF zJOQm>KK=tVe7z~_e0W%*QTkCZHY~w3K*bVq;(doW#<14oCVJa=ahqv^VeNG|x z0!O*kQa+lmBlN8HHG*#nG-w~oSKF6jvyXfGhvRE+vo95MTw{dq0t?^wwtDLZz9NKc z(e`~~tG6QXY5QPmz`jexKAm5GEB5ub*;jAj!*o!9?A-_Wu0@!O|+5w1n&cdCuA6nxJ>iF~{V*L)8M9}Y_H0SH$g>ur1< z+>q+><9VX_xIc~6zM59}WelbN6;N#v0R=(H3H%H>|pz}M*#`m(t zKITW;$ND56Xq5CpClD^bci8yiQ3*P~yv^5q3vkkt56w%-m{$1seyKITMc~u<^&qC^ zn`q?~J=zN28}O$M zIrvegfKTVQ2i)4eCvAKu;pTjW7V1%U+V~!}*vIop^L-(FI=>?j5UzedvGJX>@NwQ! z^F0+4n%`Ni@a=*gnGvnTlclqaNi!8{a+P)Ai90;hOJ& z@ag=%hk$VTeci^_WZ}!O@TJ(=-?!jnf1yR&Hv=h)!3xu^b7>vG8TXk9y?$7{JQc2Yfm3*P{8F z0ElxWU_AKt0<%BmSb<^Wv+rkK3cj`Q*P{9C`AJ0efjmA&&wf%pn zdl&esigRsz?Mrq-*lH4Di~_n70t8GjK|nxkcOV21vzI)WzAZ9&8!)a>3p2q!*rA=K0Z$odu6~eEx#NFQ+#KDb-p_AWy&}_DZY;+ z_Rtt&n^p5=AE!{B2%D^Yxr&?ENBfEe8DRr}*`mg4(N_G_qCAs>KmvBW$n zzB877Z4&rYKlweW$8vfJ@pb#ABVM@cXtB)4U?u`7g5HfL6#vP=e1v`_^+B-!zTyF6hxtW#98%@ZDkIYti`l`d!(_ zHKTOC)-L$2wD7&E@y*cqxJHrAceo3_7cAv>MC0SIfwJ#!7QW+M@O@$7`-8@Jx5js~ zCBGkZ!8gp3-_si3OpPxMnbq@q4tySjD`7q;2hiYky%@B|aQE{z=rN9$ksx0nUDfVq z!>!7NHjs~f3MCDE1tt{#8OCF?%&!Wnfu1hZp+uuU)xWPAkKgggifGRaS9*gHA4MGy z^39TY>jPif$KPFe1rhRr)uq-b8j&${m`BK^zpu)W1;^(H{^}Yet;76jclW#2t2y6+ zj}JJny4Ju4IdYD<3V^@V7W=si?|Y{Xj``;w_S989`{t*%K4a%X2YgkN5w~hI(O~{d z#>8-ZttCIeS^m^LzsrB=_0zvE^`!je*ZbPGUvdAJ0}ren*CQvR$@WOj*T?HBO1A$s zd)?0OcXa&ncXw4K$JWeyXmQ=wKOVE<>7=OVC(Q19?N{Dkcw6)C{6W9w*I)ej?wA|i znG&CEU-jXZLmj{0I)6~EB-}1?W8J`}D z=KUw+3 zryWP{Uj5+re$=$+)Q4&Rj2~lra!YK~?Ug^8^4FoCkKDKSt=|pY_}evqW-Sa`Wy8|< zSodBnU2hjl*E<4B*JJ&meNnrQRyv%ujtHgX5=xO$sl+qe*Q3%ARqN=c6rzPfca0_f zWYoJ^l@52U<1(dmxlp=7Q;NY-MwO13T1TwXi4!_Kq|V2l_k9T$TWWuWr_6U1mJf0y z);g|M9M=ero|0pRXRnQnpRXWmY9qCGCkWjfn zs!Z^V_VuoGWYjt`mBL`5aAS~TOQrAHO2?2|$55p*OsL!xRM}YRyROnPyw)*7sf-jV zHwRUGl|E0UV^po<7NznXq4M2;N~JI9mZ$-FT$3uf`lnoT3=b*3`$g)_bZCR&36wc`T-(KBJ^<&x@OXx)aOc)z>`#g10_)N4@7z zeZ|WeJ9fuZ?9FK2wx@Y#N5`J#hF@i!YqsrZ_H1r$-JP*xPfY9HjJJ|vsyFQMGu&UX zC#%74+u`>#`)l@O>}ZLp*_-k4&O^W6^Ku)eB<$URr1!?Q?)6l^(a@5yu!y&0P~ z?Wt$nunEt|Z2mcthFxKkuKvkI(mnp!p*Js*Zdp>SNV=;$pI_X({UW)Z@Lu)mizU8A zB#!b9o9Wbzn`@EnuF^j4yJ(4zh^>C0bJ{4;n!PO1LkEy;k@6d3cgW&KRW|HpRc?Mn zrTfx@rLvw;l@)tgmCaA79PfJD(;O@68THt@m-SeDw0aFvh0Xqom$O=BH3w21zv|Gd z7fbhvi>3SIMbfSQvC30Acr0=#LdQG*j zKtb=Vcq60Xa7@MFjNw_EA5vG`>nv(qaeL}_9F!MhaZ>ZshniVU%?Wn?lSFe+GFtpVl%S)}LVO_?N_KeL> zsN`Pzd9InAh}3!}N>Ac`{M{LwwX zI<%LJdv|n7?Z=(cYDZxp*V8jMKcaG7pH<_xX}NwYDYki=%J_3bTkB()@vW_O8R!XD z+V{MKo=|j1FR&cZ6E^QgN4cXuBQ^HW{>_ikl=>QEPF5*0hYVCd08`M%`74k$zYW>m z?7#m)>+ds;9QV|m%xK_0xR6Hb1U<$esTgBMkbaz7@UeZqF$MuL^d)d$V?kt8%ly z^_S>;J-BF_pHU5b57WgJjda;_dn!cF{mIEa`)HSz^xoFv8ApEaX*ij&`Oy>gw5z`6 zC=))y2HbigHh60M8K*yM{`cx?HZFff z^RxzkEF19Y)~bw(AA64YGxjv9z^5OXB?3S3w{FX5X!4wDMjzE&zXh)`>ua_!U9)z6 zmci|M>N8q4p4h7@2pO)ov4ZMZT)Rba?F?oKMJ-Bm^WI&)WE%c^R>kS}gyG1SzXIj$ zkA>lT{FT1GtdHZ&TJw{rEQB{VAm6gGa4T(nBct_@r(%7^e%v}9Q?2W#%sX0FGbs8r z<@pCzud5p9A6c8!XS2U*r2p31q!fT#{dd+T^#!=Iv2FZa@*7b7dwYHxIW@{}zqPL3 zzIFswbj-nT->XM`nd^@!x;mmRu4jFHoDZ)T>+F-dRjg=T_PleY!xd-L?oX_@Rd2;N zlaZ%fe5&4NZ{e0lrP;0b-B=R);<4Voj*gWM@o}fi82pNN^sB99uY1Q0J(FK<;DhFs zj)X6;P(pERb!B6FB9{5&8loX~Wf{fxQGcsh6H~T7vHF=^4Hdg?HF`FW`e9y2$J(1O zt9YYTeW#Aii)z|4+^#Hq!pZGIkY?nm2xHWGY_vglv3=HqKd&4;W!8qQ%F&Z&J&6B# zN7lqvj?VSRxkq5nsagJ2m7}L}x1`Z`aJQt<`P^V<^fXC?N1HK**h|SF_ENHoy_9Tt z)EVOx-jTxFCA=fJ^HP-X?k>Eeg?Bgq3Btd;jfPR5*{fT9620&>ZB+YUr*FYXk5TGdvZN5} zA4MBQzLNPw-@5p|ZARbhIo~ejg2E+Bd~*vu=4`@mfg2VU6c)`bF1csk`~}#zdvV#4 z@}>7KTfXAH|4Z_$(POg5=8PLZ;nsEo zzEb~w$+CXF8e4ANsJFhiq6+5DOB$SW6q`#WFl z2gb^OOqhRY?t3>MEq}J|t!3|i`Ey^dv?sD2f8vg_Uo>9-r-Rd;n{Z-KQsj&G{VP^E z<(RONOMiEb7q^-?#O(Q?ha+S)EtV+;x;5$i9W_fkD4oBPPBtd9av-HRY?z5ZQo8v% z$%gkx97CbpgnZb<*Kekq|2uy--9H#8!c#5o0mdfHhwsGDUkQoDe|~p-T&71)hHsMP z$DGC)-Q-&>hMM7A^NC`{zsz{ebc*i_xQ7t;nW21ucXHfAsJGOwfgktuQEQlfBHXQ16)|hQQQ|bEpDg~YkQ+zXaEQ-RM)JRO+ta_N5;aDRzs0q00u09+(-G4O*D z&j)@=;!@yOBrXSjU*hG!HgJ>we&9rjD}V<}yc&3-#D3sHiPrrUjW}P@p<4UB)$NALSoffsO!s#Ftsjk3NZJ_rHsX)_R8hBjlv95*RmcL z!-8T@TKWkd*i9LXBVJ;bcRbzj?oe`9g2;eBt+ze5h3JNdy0|QCI<=`tkxkG_Dd3Bzx?(`*bjYX$0Or1 z36=?YSWYbBc=`0m6EV}rR6>E7KKbd-v&b(n)9EMuX-kI0w9zNA2j?G4Oj{n6nCV~E zJ+RvrCzghvV~TGp3g;Kis96mE$a|J31-&bS~%ET4$&4lY(;5HnP!MJGu z2|p$3aYytM@I*H(WQaVg6R&B?N*s)%>!~n?E4*A{FFhemn8V0xI~@n@p`NF+hsa`x)HCUg>`h>9Vh9J0P!0Hv(ij-wuY+LyF>~lFsMB zO+~dU){Ejh39R!y4+noEC{cXJ;i2=Tkq-@&_VIqD`1qW!^VOjec+DtLd|caA=Npc> zb-dS+k3Rzx-&Y{h`5M4iqsXKlou5HT=gS3O3jE1OUd2~y;mbgwgtKphg|A$*kB=~l zuiU~n9DJW3TnY6ki!6NWHT!taR(vNc<(G1qVR%R&Me)6DDZd@yQ|(2ctNe9rF-!CnEr@%K0;VeH74rL$vJ7gu$uRRRDRJfHWz8l~{?3DptRKjv#@+IR?d}!t& zd@qBq5q?S(A0DGZ_*yi+6dA_${VDQ6`}hn>`2iyKF`@X+Fdi@CAJ0%1vI=_qZLfr3 zl))Cg7F>+1FD1&pTP=FWpjWDta8`U%BxYSvve5|@m{9zu9*>!lPX#sUot4yK*uO(h zpPQ3``xdjoa;A`r@*+I7>=}X&9t>Cg0ZcY-$Q(M zFwZSo5*LNp2t_vOQIYljl zi~6T2CUF+?!}6PL?x?ko+HMouSYhny&4`nXxdyunb#z#k&xJjTVbVl}XccVB=0(UG=p&_Szg^)F+L`WBPYgK_Xv_?T3d{-Ua%i{!f-FIcrYe^d4HL5WMz)4 zGA9D5z>3Nod!?{p-P0fxbZ+OJ57#`9)w88v4|~o4!(DyH9(zuIV|Q$&%U$bIv$tGg z_LeI+d#h?^r7Nn|rKW(n#1t@Ba0*z}mP(hi)}`io`*rMnb@%R$owaU9RhAo#r&k2xSNTTyt1?$4T|CKJS7f8hwaew)?~15eRk5B^ zA&lnO3NeiV6#|nZjoL_Ma-=XhGH7ybWMpHcYgeRme`G|}mN4;mB1>^x@%ly!;UX^ zjdL|LWi^hAU}EDOOl+K;iH)tR}inO$Ai~8#v=DQx7jO` z;@!^CS=UX7tbOf#5?-^n*w=i==+`4J-{HpQkuTU?H_N6y{_@;cvfgU*pyqFJopmjU z{5ldPnIFyZ!^v$PH>Z}0tri=zqAD9YDyn1Boe9IcZNX1L*8+#Dx42IF8}20;yiU5^ z)~(+Q_M8-KKKNE!)cb8|XfLEY;q+%#ZS*Hqt@7ug5}HsMVmKI=q^KBNP!0a2xTYE^ zzQkqKfPv*4TVoCu7>?>C*I9S_t0H00nmCT1rbo9&x+6qu6~@hAP-EM5?yIt3ZsaK^ zV~VqT-L?ogd!Iu#p#ytPMx1q-nY`~G$fSD``~-=+`z|w&n`7#2O&c59vyS4jI2_Y( zdg-ado+Bq>Do(~?LLVlFv<~!m9&XJz7~|g1dbahp$m5YEu_xa7{LS+xyRYoNXVGkz z@zLI>S<5_SS=ZtEnsw6iR#sHcy+!N(v=ixFzU}h!wvVo}ZR@_$x#<@;Rcwg)C=uu4 z*!(*`ANaJm3K!VZyQAPrA`cww5dCMM!cBnnr3d7>?E@me8WNF-+twoXjSd@@yKZzi zb~)_(9T9IiobNj#KX>6ut9P6kZYgCT4t@}my@*}Uuic&nt zF=uyi#j?thtXZpfRJNZRRaKu^m9!vgLquJs(al@hxN85wQ-<5?*|E{>9G3=rvF3Ke zvl)$CaJ%;4`TMJ%seh+3!l;c<*K~xqrX#d#IwG<$!nG^Hxj!PJ$`|IEUi?4pQ+Bl_ zvgM_|-!=-_YRW^VZi&wSQzZ7%+*v!;Svgj83S%RAosJcq!dTHMj1`^2SkWnrwf*fL{*y3Nfw>V!;jVg*$mdS2%ETU}S#)d} z6;-u!K+=p=e&3ybf7FrXv1oVxwhhRbE;(e^-iz5CiX?YBjqM42PE3!+!r^K<$f zh-6qx=9~7Dk*Bj{NPfTM+amp|cAx`Hs$SvWS@l_!4Qb!$A09=b?&#V-Z}TGU_V-RY zs#ur#xAubbPJeq;Wm3%AUUt_4(DI(vaVLpanyCwlGVPnE{KI@$7X87N$Y)`Fv&wsSCJ)`RA z#A(U)G8Xems%H$ylBLzrai2d`lvaXS zTKin%kG|b6=pi4h%K(XXdWiZI+b_&vcHnE@8oj==>IUNNHVZme#(A zvu-g-CI6FdD6Ia8_ME;X!@df3lkT1L=sZWIQX$@i|7snom0F+7bpZr3FzrA9XB>+@;C^+rp?@BZW3r;7SL+BjW>KXRhKacI%IKkqyBF9SDxHhj_dAKvox<;S1; z_phQi_@14aeCNL6F~>YNZD{9MRv4N8=GzY@dN=*~?N_#cXWWsrtK)xoTm8&O#}sYM zU%I|W!cRICUnoV^nXUQ9nw>v-;WxMcv+z;hN4LFr{ymr?e_uPL=*qo6p0n=os-o4!SJlk@&DQG2FTb&$isIUH--rK|vi|Ge^jjMF zccW*g!clsG^S|IF2-04xy?FTc=j8M-{>qCJ@>`s_@9;x1J-!RD;VN#DZoYrDiL05~ zrf?r(UBc}Up#KTzyrNVmzKX5fKE$ldsF!&mALg~abG_JE~=nO>lEh&YZ;`Sl2Y_0M4>DJagJ z_ipH82~V-O`&!)A^f_`K6i3KgT)vYU5DWxzh?QM~UJmh9zV1#l`pEjGFZ*IO=O`AK zbD9QP!ta*#uk=eS;ry0Y3HgRg#|)e~2TILRqBq024hMxThxCf#N?PPF|Rp_O{OKTNk)PoT44UwWfC)7 zT&H}o4-t0Cya+opOn+e~9(XCdFWV$1$0XD|u55|Pd9TFeUM(@XH%g3?@w&uJrxayR z9;UNaVnE|35;N`&O(zDKp+0R9_H$4WBJ7uT3j3v_1 z=j2dE;2>r?w@OT1QReVxlw#@c!MR3a+Hy={+VX+KET6Lyi}aZ<@KDDiG1Iz1V%jo9 zVy1Pw#C$FKgv1`;*CZw<)39aWAB0>sStg=<`U!85o~lRst9dLFB_>BQIq~#H4pIKV z)D?SZ1Jh=TDnpU3M|hd(CYxBKn`C0fQFDYuz36j?y$j{<&5Vh`{(iDv=x zS%5k$SFR^T%yQ*8DlvIZY51(fQ{n%24R?#W?25~KTp1sjRn>X6j2zR5A@3b!S?xe9N*~xt-Jke%2w(U?D># zq>zO>WQ6ll6UC1f@J6XO;wgnf!GPU(n%l2uQI zQ6+$(MC_#}q&3d$|Jm;{d4{3uGX4{X&d0tu7KakWcM2Xl-(igpk4OPNKH}+oli)^{ z1ETnNPt^I2gO9fH;PWlRXdmy#I$r_Ye1=z|_;~Nq`Jym6g!c^cb(3M_`z|uC^R>c{ zag`{(k2)ZkdKdn3?tul7QS})>AyY|AJ@at`HD3@=27wW!TmzF?-as#&sC!M zu7#e?R{=iW!)V_XI2515!gm2-{EebS@%U>-eaW$04$M&H3UV@%(p9cYHicIR! zxy!=mjW?fT$Oq~G-y;^jN#NseBqdCjQe)wJ7<{epCm)vL3-JBL!so#S1=WBkKJFDq z?3E#0Z;)I(Sbq#-{r(~KJrB(2>N@8>@$(g#)T48| z#9lfet>DW>MB2x>;)?Glz&c+!`1qSqiL$R69>iW5;6x@XBp-iWD!vBUp3!WCtUzPe zuMeh0S!dB(1wEA(!}2-cB;}n4Lz2>62-mTqW47?di;Ke zyo!%x;rP~B^xR$O6tbtu1vo<3)2H9B3kKgF-~_?;9~1L6f=1^gJ^4+q;z430%5Sl@ckqS^P{;1P1E zIYXH@-86W((7g1VA^#9005MOgST|W&XZmBV&Psdo_O}w2*)h5@yFDJmB6-+$?7+G9 zDF0P!AB$}1e=5RA*aM&VCf9}9N|0vxU14q7Ao4ffR+m^b;fj`2WDrCBVz=UiYcL-GP>Y80fX6oOb)0aY;U8%R zp@1yovZCDF_JqIMd>tH0LYcKEXa%;}Xeye0AThrh#U=KTMiJ@Udkp`rRSy51RZf;- zC_nTz*fG9WdoU5q2-|h=LQD6xKaJdV@O(@6n|gNNbuh81+vDBy?*#c)XXU{&sEr6~ zZHV-~wYp^u!>)dDz569!UNpG>DzuUIR2Z4#Gz5+(wh;r=JN${^a`x@E6H!h@iBV`9 zNYfQz>=dO{_x*&cZH;flxBqls^xDVH!Io=GTg=qIT^q;-JHC~2{{L!z*a}6TaHiA6 zm#Fm#=h-KiU4v-UMn{Lfdo9Xom9fD7=#=jM_=J{dcSP;>x_aA2tdEdayS<`5v$o;i z>a*^`N(rL|)W@!LoQ=4Da$Vj>yX`s2MqSFC^;lRRbH-}wGV^aYnlhicy1Xf?VQWmy zFJl}2?0NKWPPDt5Ho5DPHhm}I{a^1m9(y3lXyY8VeUT?G$F+>1^t2Tp?T#GP`=b$& zc>gl$GBCgY>*J;l7k_wqV9#ZH5}S(}mbLoh-Iw>A#>r8C?7$?jYcEUQ-oR`0F>?`x z(mt(bXTWE6B{l#a6y2Zwe>i{K2EzLDo)Au-zhA=n^BGO~Q%8xOE`O^ip}%@g(Vv-U zPdI=2h4WXxr^u`G&>p3)mjm_G^CWRN(e+iHthO_ro=@7{mFRXUK0U6wH|u(ePuElV z(ft%wXW9@g4blDZ=qE(?!{d<llt z%>$c4Pjhw;qv@MJZDC2dum$=aI*jj4GX}01zvi!(*}B<`!Ub4GB@0^^@x#oq>2!Ix zqY<6coDs^Z!m<+I{M(n}HBgx`ML0YQP1h1VXqq!d#wcBcoCJt-g)2ZD8aT}v8xm>E zqJlz0#+XBFstfOFPNy{3rjvCiX4Zbo( zmX;V36bSfCbEYYp!i9xpqQvu-qRxs+ko$1~KhNTT=iGp2P;r{mEosV2%I6mvQ^kK1 zPje2EVFe3=F|sieA3IPjEm=}rSRh)KmV~Z2&6y>mmo6z>TCiy0iUme)00sTJ)%L4; z=<~D!n~myAOA3r>s4mZh0)sdZdNo4}7NPDJqE(k-MYsTBwoF8qL)WX8@C3AeGg|M}(TWb1rV_I*Iw1vtt zD0k8Pk~t-Kcdn}kJg;}zA|fIkqEhCSrlU&kEiB7gT3&2SoixRBN8xM_E-`p{=*RLz zYPjkR8PCr25O2=>5(I|C8za2Bh$lKR#=|u=rDX0xZg$3t%A*{TUtD3(6J0}Y*`jik z8cmgh|*-e`My)jdARjS0g2~Jz(2Ypr9EGt>E zbYXgtZ(({t;k_ku3XMBT(x*(j9rZT9#J6xxp(m%LaDIU&tE|xHK^-kyR5s6(nv-?= z03&PR3Xdr96{@$hIl0d99VO+(lc!{jT{x#~MXAUaTpsKJR?L;A0=f|fwqi=pyomOc z@mZMx^~rtR9WVe%1(ruPUfidDO0l2bEixRc-oAzCBD#RVHO4kRB^!-&dFUm z8&@?t7xNx~4r}Zf&pbGi@yNYiWRFd2xPNi=kDrbLK3FA!Csp~HZ#PjNWxQ8rtoF`NBq>7qsRbFn!p;sxBM zQz>>22IQJa1r$xEQoKx4L;>oIrjuJIL%HhDts*xRzxu|KTL7&6Qq5)mcS7=K&V z7+xPR)y%a$N(IuyK(M?B@X%%N7EpklK?SqnQz2R@(AawX?d z7+Urwp{}R@?o&3Xvo-A7c8A)gQZ>(fm}7TtB#HmY;(s6U|2pyCBmM`9TK^rHB&l?J z`-akoxOBaX{jS&bR6Xc^$_Cv}{muT~olD4pjb_YrfXsF91qX51E326Bj1w}M`r3%pr6&*5yt z3j$pn#tpg?@o&VstELynS8ayR5`L30MV4=a2*=x1O&nrIUC_f}eAjqM))&X$Y{r~m zAdmxZM7T#BWjqc%MGCC`ImE6@%0+!^`C0RC&7al2DM2zIN2m5-Z4c8e`gdB~-?zB$ zvbgopKc>f-f*+6S)_E26z(LWLADpKaQ8L1J`iODjyTL! zSL;!Fg*)9ii8F=QOB{B&`as(674D(N4I%c9FusuXn)#{M#+CzgioM%U`{AiZ7JqGll`Vm4y5zlr&<>?R$}VLORV}>TR(U}6i*&( z>BPf8h~NPZ@BjpO`kOioqdj-Zun>D>zFEhdYfN3v^-%Mg0S#L!|4VyhUW7g1{1wU( z(|`i&|8X7$*8(I@vcv&2qfnsC9L+B>|co2~*q~2M{ z5Me(sb%p)F)TMOA6VJ&z5K#`mj4ODgKf`SD7NBhCiwC1lHY89}#sv=8035KPkEx@0 z?hePpLV^ezfCD_hm*R=XJZp-`3ozpf9_i08TL%A|VYU=pA83%B@*;1sA}(;i2H=1V znV~$-hvVVI9*E!p4)6ezhi=-y%U0Mh1^}Yk60xX9ImeuLj(A||E|QoW4@t~;6mkZx zJK$ruKosZ4z${|wd0m`1=$_+JIgVxmr8;NcSA04(nL@E->}Uiwc5&XpL;0+{pV zp>rSbEa|@vxLD#xfagoR4S2c4zXYz3xE*-4#HWC3B>oJzPGZ{pn8dWXN#ef(?~u3y z_<4!1z_s5h@pZuM5~l(mmUtxaafv4ZpOSbQ@COpl1wJS73gGh+W3dn8g2WF4N8!H0 zGJG01M&j+j@e;QIdnEoXaH_;7fyMrFh)YZ%PoVDt{v7_QPT3&XPN>8Frsy0;k;X8;e8csMYHJb``&I1m0REn<<@08>|`^?mqzWL)A@i3@>MS_^?yTEwHM zGZ6nE**KW)a`=zea4zxn_y?JegF2Paxl6+Z#A)~knU8}y>!DMs;pN2X_y?)LK^^Yd zyIRBRiTR-g_UHdOyUG!3T+7VlfXsrcT4{T!0{4uA52vj%YZ%7|KEU9C4LZC)x}SMhe-c=U{M#~ z-vXR1{htLMFYyb&qAsAb4_MX3>%gimjsh1*{da*?UHl1H)x}w0Q5WF(61YO@{{win z#8G@mkeCofB+7x00V?n85@V!4n};d~R-Y<|!N49IEW>P^aT0hE&ZFJhf->Kp|=C;g8BpO={H@?VhnBVYpu_0QpqaSVa~hBMc? zqyN`9tA6_`JKC7^=eMSb5_^F?5@!RaNSq6-`ty8X)t}!5%rYhaEMS%?G1p)nCGk&y zy%PTvc)Y}%!^v`|KIgBB_XWVafu~CUSAg%5m~%O2Nz8Ah3M4)WTrBZ>z@-wO0WO!g z19-W_{0{SeiF*LAmiQ`Qzr=%p*GudLrqIs7?;YT2@OMl9`M~iK{|LC3#FfAvi8lhL zO8isc42hor9wPBh;87CuyN+y$+kwYRd=fZU;=ce-m-syJT@qjB3|@o%fz>s5J#eYi z84FBdz5>6$fakzp<*OVxM(Wf8CrbQNV3kMy-u6iUL%=GJzXeW{{@mwW<@a;o;nM#f zz$(A7cz*LrfBvRd`Q@JIlcfK5fmPmb16Fy@2UdA62A(DLmjV|{{BOXj93BOxFzzj>4_Q^GT<>1xcMPyc#?1w$kSFl$4crSIz2fN$tavhj70(D@kBplQtjaA9 zSe4bCz^ZK&0;{qr1J0Ile+aC~Y7MX|pND`|`8)=!%I6ti3T+NN=L7!={>tV*0;{^d z0PK7`h@x46fybG1%hU&VVbdnz>=iQ$=V*%7Ma5O3;dH~2ej_%iq`n&L z^qE|zuLzYHn1F=2M{{Ok76~UDT)d#dDu*>%emm!ze<{jNiduCv@hbo7q4OQu?<%Mc#c83OpO`&w&oF$oqXJTCR z8yFr|SxYZ$c-UkY6nul^LX@;*lz+&_pi36Y&q2ei#ILRm)$hy{vzIP@X@t|&Y*;>Y zaK=nud3l-66*j9vX-V;-vhtZ?!rjG_4X>>wjBb-3RnJ^1W`A8IvrrThzdC7m)r`7~ z5H?$~#V;thL>FV#3ri*&>P$?Tz}5<3KY&(s7)CWLB^n9mBV2+lR7)#n6@X+f@+t42 zNrTYO4$8b~IMOk{lMZ+d>+Ch8lh<&50UYSdnMaksqOwH`X8M*aUeLUNVe)k66m@ zu=K}Ch~lfUlwTCy&!#|w<%dVM0N-2--*JSE!l6X*&9?BRX?z^>Q1;CP*7M8Xm$X}n z;=2vqWA{FL+2~k`1r1xVYK6BG*F$7zdaQPf&+LM z^mM*D@G(Bi4?_?Ez8)4n{(hCO+MyNXyWGO}l*Y$l31#0zG#=f)`EZ0QzZ~f4_U+K} ztAA@e(89;xzxw5`^3FZVbiQL6A4ltzeYfM{)9q`5LviT&od7+Z@4S{@mXG4Q-op1B z_~g(4=>pvSEPPH3HmUjmb%2k1VC_a+ue9wc=i*O~>qx=Jh&X=O`@fEz{ zI|i)teF463?e8}hzVYBw?T>w);(OM@cL99iuHUCEe6uwBIIO4mes9Td8m_Bw<@XNs z^!%>Y_-@qrUa;^D2cH+=O2|RkVc~1i_=X}}+1C#Ms)6T-QQD`_?$_>{&WJu6<@i`uU*8#`)sre zK65Bhe2Xmk9RfbyyVzbP;!u1qgNV@;AIGS36`9ndlk1f+j+YKdR3Gy_D*0~1q4;Wn zb-qMASDb^N5@p{8c<6lP;9D>4`<@JAyO;zkaFAoRx z$afFyAs@%lC{5tY?rviKXBdy)SkgU%hrXv6AVsCiciqHZ>3;#~wxaBr?o=EMW4b&T zU6peU9{Se9twiy`yb!*Zar5IdIr%tCPw|aMz3Y6vFejw~;Yt+W80ZmuWx&G&gXJ6S?O_(f^Oe4UFe;$=xysl?_G=DFS^j<+yy<| z-CgL#S@eF@g`N`yqVu&wFWm1VemSp~a}6Fc#-lt~Z$2EVoVQ!@!8LQ1BU}mfD9zB* z`Hq9{dH9oW4i3fl0os~w-~HfYx=Iw^AEBr7txpTuR|sXrmjp~cbq{(KdaUZye?^<E^bfSD z!Uci$#I|y&Hg(gm!9%`jo0^5|hoail0Hi()`+r4MC0E5&VJR7eRs7l92dLuH;C?_N zlJ5RXFs$Ni5DPv0J0`;`G(8o@bHy3NLA+sYM#BEfOY&A^4e(VaB~~q7j8!)xuxD5# zw){xKwp|HB;B>{0f;PZ#qd)hX1 zs~(9_?tXRloL1vt(l*9#&um`bh`nj-?yDY;oO_M!arb}LB)t@Hxu1PJQo3^e zt#ym5y7ioryS}wo$xiHjlzP?f#W?pW%A$>Lx=uNbmc{Lv3DvG!u*=TtL+!4g8~)7P z;#PO`{?iOycjb6}Rg`hm(Q=J~)F zqi0_atX{DxbpqD3>2?1$`z_8>4kP~>XX9&${>%n{Ym#An*kV7h+}PD-?#+ah>XPzD z_D+5+HEsHV>kVOL!c7q^ZGPYG#2Hb&&-EH`i*r+|n}lgt;K%{XU1&EpHw^M;-eUJ4 z(;ely$~c{u@Rw+J@lC1roEwayCH4cE zMq1+9hwM3njkM`&d)N=$VzgsZ84t3)<_4qjwH~I)9UU;)HOXRfbX@XlebN$PN93B5 z9qz>T%$CKew(19Jql}_@SI_D2-qexa9b0?Eu6@y-Gm5MH^qRlYu`LqDCG6=goTg)> z=17mozsK!fUS;!Vu5=veZ*;B@Q9}Ku3@n;6;W(}BwGNZZ1WN0^#udoHzKD~TpUy(@ zx}0VxHlpG#Z|CWUx_;3>I}kO^b)H(E781mwI6BtN6fy+7oWIt zSNpFBFMn}S^se?N09%s&I;>yyy4Dvmj_i#wdU_527VpliJ-_(8yHW8IPvt~o;|FBh##x`!y1EU(-oW0foV#6O^NKwYh==?jd#aXXiZBFz0fyX!- zJmmg+C+%k)Uvoj8mC>C@;F}(4S%^zZewYtDvfPlaJ6yVMYr5`m=~_rGm2Mj{loH4< zz&;1^>pII?LH5?#kGv8K4JIuLMP@lg?C^zMckE}KUvoD_X4%4HO&WcDlikTz}+~$~&1=w8KvT=`p$D>)B{XP9_UvgDNByWGG_qiFd2|cmJ zomrQ+MJEjDUc3>F`Zh9ebMA8;Uwj%nMKK%E31y-)bgoG@RxF;Lv@N1I3r4>gjkwG6 zwngs4{(#WKRpK(5??~M^!Im)EJ}J`uUM%<(b|-0N|Z6wbJ)31(x7&q6#_LH_%$3ASEQ?U}C+N7uleJDZY_aC&6UmFP?3 zd%3fO5BIuDF%xf=(mhMKO6Y#n;{HUYw*c|t442qnLf7ZqQzeYg^<|aNeZ=DCoKPhU z=X_%&bl+_Wf6C&1(qf;}l0M(vDIwn;i<@H)N*MmBboT>}Gp-3)W0~O^y(sSn>A`ut zamKY`ey+}UzlGm!aZl3-$$yU}Jk#Pvl?R0SY`!+x%*6XH`P)a>Dw`uuHre#p;%xAs znnz-eeWVi0%LT6sgwAN3he(`<^KglaapwCN^86dlUgE3q4>BGH_o<-d;!t~cOeL1h zeLC?K_y@TQhmDOHG7E=Iz88!Ijz`{^KaMpL(>%VHAZA{hBxcrjNX&e{ATi7{PDt#< z`7aV@w$B-8Fv)$vl7$hUr0=w_exw0{6~pd z-d{@0dT^pWk%#&NBqmR$=08H>0{DMVV%mA9#I%#5_A}wThj{*j^ua;w6fWpoX9Buy zc)v@D!eR5^AB6R4OA=6AU$$fu$J1X9^1Fc5x1yq*V6q1JXb1ht$1)-&-$aRHaL$*Q zd=wiEgmkhe#q<~U^ffW#+t@KcI@v=-h_DAZU=MJ>9$=~odjJCV00->pFK9a3!^}Y# zU+oVg?7_QbN+)~dt&5jgJTUFS>r8=Z568pkPrlnFCf^+r2ken$F3N|EAHsLk@ld88 zxrmk6(o7`uWnV-c)h7s>C6BN<-PGqbtlE#TnFR@9Q-}v9-&Bdo_d|)vS0l0DF*(ygDd_=<^OU(4Ykl2HBn7wIA3m1q<-zE22 zroHI_obRVkn`0Pe4&o52mxYPhIaJIUWJKRZBX$lALUIf|wJCKfSGGFi(zR4<8e3Stv{bZ+1*J4u>@{PV_O7WHAaVmBA%V10#nu)efy zVmg(D7G|Aq%Tf>Ff(;>VQKun3SQ@f$*pQip3&qNx$|&iJX3zCNmG2zie2jzyoV48B zriqO;;7$9(c#EXre-wY-SJzCgTBgz>OJ`p}67)uX2VovA>a^T98|M`Z#5p+a zl?75ddtO12b*^hjK*$7F_8#9z&f@-$zksCRett7MYANV)h1`Vy#Jq1)*x%`*qFf0j ztDbx`6zWRvJ&Rs8LfKa;QF?!X9-)iBasxv_nL*TLgV94LdCZUnbq?<9(?kV zP%tXKS||~Fg)hb?wfs_F@h!3N6@ZVw$CW6)g%-Y3;F|>{=2u;dY}bj1!04b6azB2* zq)5z@;_CrG?4>8fi$*dZXYzS)FpPY50G+P^e0<-egnE>(9ie>Bfp0nd$(M{n@uf+= z!SJJOkHUKz6N>+&=JAOnOS1rqb5^pa3-nmNW+=;@-u#z0RW17?3up?wsk z_a*WH)qp$)zFF{NIHur;eDL}#4NfWWP%b$JJVZ?_xb(b&Y+kSs^Inr`j793^7_b@v z7JE|QJ+9xLP;4~C`I}DRJ@vX(+%ghKjSnDB_e%GOwIjN1?C7ZRH>6^akh_Rfv~_e; zv|@}&?1hr>fUVA+Kf>mJ2vN7jCESDG@b0KJ2H&2iBZgs6pZ3T&NOZiBgjWFP7I$>` zH<__c7%S{0BWDbpaLtHlrXj)+2Wf1uV;_~{hCeF7Z}^8}%#kmlbzbh|fbp)cBUjp! zIy&;pjf@9935nqMM<)0?^84EUW`ivv;@!~+h5z(Np11kOCq&truEIc!Qw}_l6VYYn z!RL>y67lRx>FdZq(q^8JuE^KR=Gk~1c5E>?xRZ(9S(2`7Op4FXH*(i{@>`sKXF{

          zS3Hnam$!EJKv6E~j^5|;pLO|H!9ctU^0j2PCmqi^9eX}c8aQ$80W9J+*N-t1RIoqF zef6fqTins-d!Fu&TrC#)LZqzYVw?a22sXd3F3N4+U{Ba>G`ai(f@xxOQl#1BTJtG# ztLjpe`4*JNfK} zV)w@SRV9l{lIm8~$JTAEx0$6bGZd&8>=9C#6jz%R+n5xyb#c9~D$k!)mFdr`O7i=v zV*O^;wso#DVYjR=)|uf5baBF|{tbK2*oStsKk2&nldi2z>eZOk8)M+ne#cQ%-S9|O z;GepGob_(rLEnV7t&3-@s^3_$W%o{0BO6D;!04j6lUXNiaHZxY4D9B2B=}wasG{X_ z{5||pb&G3#G4&Yr?WoxtvjvYSyFIwJwneqCI=r~0dp%NHB?eg5^f1yd zLrY#<>5D;5KSM6x^B+Zy-$RZ+tBS2miZNTMqooaVds})4O^oX{bW~KwfV-y21A7Ae z>e^A)6u(U!KRI8B*HWA4TQ=D1qQILl!k*x?H#rja*iKg`{MgnKUG)9Lx^6{RC$#ivO628x>T=N` z2pgWc`m{K!{2e#yq7tf%rbN-EwSL1)1Nl5}_*?L=DGrlTIDJI+J%Yt-6@m+HaVfE| z5;0L@A+~QVDe&a-g_c$R1?zSG5zkFZ!i_DdFrGV)4e?GLl+NpK@`)`dj*ur(^65`7 zbbErzK#q_n2)fl>(^SLQr$t}gwN)6lLGCek*IEw9hQBVFuSEp(Nvo1Iw=^KU-oP-u!d@6(zK%!QyVWxc_2t zGpvVkwEY$YQ)QO=kHcxhO@O3GhFD)_oH|e z7VAplB)$Pt>rLiJf9g}z*pblZKM2E=Kl88N9}68Bk!@M6JvmEaUg@P0Q|%dv$#G0# zmWOU9ABokNLx#i*pC@s^P7gdF$vEO!co1QyM?mp=z{Wrb)3EgsQ1m9Y6ce*2vGp~v zhnN=}gu%A{0*cjq)%usBE^txPo@^ZSXCCKE%zTwe%rq+{W|gg#m}yo^?7{g3iD~<< zB@UDi_-V@^`ZFO2dnaPrApBYR5aAC@e^D>|p$`%M!1TWv2gf3q7Hv{%aIzmDrVho1 z-)j^$uaGeZRtSW8woC!dGM7J)Xrg+5-!~(3@QsNnVc*!!n~5z@N{YJLt{p2?sBpfL z47{krCJr-kEWxRC$r7n!F2NFf52xPh1xPf7PA@T4LYhwKOVD}zlzpKV9EKvGp(R~v znre-0CC9r^ZdHOez<7UM=9@oAqX>kB&0AoYAWY0an0jHaeVwl*AYN9pK(UI28j1+R zW>K?dLAr@Zj4sA==9$R{$2?5EzzP;i zu))oo;z4*#Kfh2fE>;wVDzGrcMNFWD7g^{8&Dx@2&4by2&BSJF9KWIsT~}+Dx>izA zmEVZ63r#Db7@z5~d_zWWf)&n2CCU%Wrtr;Dm{F1cyI~IF1Ke=rBapbcd>1zqhs(Ur z@V|O&*6-H%+pM)NG_ukghhhe((9 zW#i!E4#Sv_e@7hVl3??3jB<(MCo<6w3nB)e5mJW#`_2n^nAp_F;S7> ztoYssAoj|zb}b+JI0qk{b-r0}C=Nzdm~C9=JEPgh`ePXFW82pG3gF-~s1n6T9i8vI z#;1>StcRY?w;GOc?U~QuIv;l6474jgmn-|`S@<3U-+#bQiL$Q<9y%Y_L>v#lY#gdA znBO^;`sG|j`YTaeNmBL?%;=9ShR|>uqD3LE2hvMVB zGo9}|_!I{@6&?aTVlO=*4{P?Nz|An)cddnw>pBdFzY@iFwS})i<72;|_NI#j)6EB#{62> zVaP@R-%Ti?9%U91)zh7hfG9Ia{8xJ8EPAsL5U%`2LyvL1l4CXOW4q7B!QX}qqka7> ze02y2m+oa2y$0xoOPBo>X+0ycCU39leGVTj-T%29 zY7~PE=0A>y2A#>kVADoS zGgaB(0IA4E{$MdyBC--{doVvD7r{(@JGto0aswZXAgm7)Y5#H2*-ABc7f{qE$8WQ2 zC3!QlCS=}bpPiK2*f!m5Pn)z#eh-%HyV89P#^>NZ6=h&7c`3hCgvTiNDudtpB0!9A zZgoBLQY;<(z&A;J6wESOku=yBU)k2H($}N0ZBnKn+86OA$DQ7ce!cPf(LR1BSLwSN zQ7iM(S|4m3*#Z;ZYMTlVC?Q6|K-(z{U0x=V3a~dOU0LEQ;b`?fXL}}wg7eOEWH;gO z#!g(uVl+|Mm(FkLgi(lLa^{yA3AdWxpQ#py`bU_U3UFi~zU73Q-(kDwZHsy-&bF=F z+BkfG-H_^0`fNL*SXq8Py!u}dq2k{ieaA~&TBi3o;e#<<*GcDT`5hVdxjMJ(1rCav z^9slzt|Oc=&O0M%Lgt9r!AWtGlVV3F#VE?H&SyZ$I3-!gGUqI?43Ed2PCB27Oq*kT zf=jk{+7vq@srcyhHbwHx!&k4!T)_epv0cYw&pJeriCF-&mjo1__os7{0P7>wsdKVTM+ z6W^ekU#p@4b#$z)qx%6c9+@NLfVUS~82s=;-LU&iJKy?a>x`58D#ent2|2{5RWM83A5<5IftLuHaDPx;9O4aA z(5LhK1pSvC-&bB~aE~iW3=X@Pc_*CWANLC_km39dVi#Wo>f!vw78D15soX3dM)^!` z5BcT7^!TPCC=R@7_=7Bh@4(w0@}`mco}e-izjfuhq?DmJI)95RA4G))_4^sSq&*x< zw1>R0V>o|V2gQM3#wC(J7T$L8OIZ(33p#)t_@&C1`KKL>u5 zw8}=#Iga+guM`z-K0%u<@((lC$R@ydGIqFiao`v36S98z+s_{IiO#c*# z$&;$#G!3&%7?<|)&Y<|27lqkF6Eojli5Z?PG0SGW#G`TMbwz!ajmV>{FHyF#?3ph$ zCyP_C)SN8ZL(DQ5DzOJ=-bLuoJo23wG4n?oh{?yEmzd?jUXqw)MzNs{Fdbo!#G=fB zC%|8nIWW^97xe|7#I%KJ)8B)$D05(P(yjby6EVwJl)1!oD}UyZn6`^DmpY=%B^G54 z%)EM~KI1VCG3lfKS-XoA?dO#a5=^2{h9rdq^7T-PvX2b+C_bD&m}R`yf$IOAx3>?9EC4%*3yUf z2*{@i)|d+k-T`N}^rtK-A?`ZEF9oLzCJq{bgFNMF3-ZJvCB$8C_=&i@X@gjn8Q>{D zTJrI9H^2iVY{En&>9TG!j$UGTGEN2oKtpkmkL$2ecni0xlLFIc_zQi&$K_F>{0I{G z;Cbx}`D+Y$)~yWiart`50^H#|dFD!Y=lM-wq+dVh@ zGZuU~ zKt3FLE;-pZm}2lEt?33Y(wb@TDlOWtUs`OqKt3G*6U@Pg*AJ5oIp}{||DnJXX$6Qb z@Aa%uAYq?d3|^E`k-__L(r+_(nqI%%;IqjuHux1OgHwlkuO9WqtZT=OpK#-(sd+ce zzBzwR;k*T3Ub0dxe4%DgauTH2J55dAxQ7qtTz#ci&}3O+nlZ?C{brq91&oSXbm$Jk2Od|GYZcd zDkHL%a7O7sSv0DsH8df6)M<;P1!`F zBWJ?*$syqcPwJcCVbn0`WzLmx=V8^86XXq3nCHePq-_pJye9gEn9I%-XilBp|E>A= zhIVp-eZr;JKP0aAK;pE}XU)^^HyK~4ZCKJ+IEiM%M;hgQ>+cw$VwI!*fxK$s_h|D? zFCl=MC3wg+ed3d72ADS<-$YVr31RUyi80|^-nK2x`sb0gTqmCeE6jaa%+H&)l)F;8 z5c?m_l`lYtkIyZNPU1Q7u0hI$KAdFl$C*5aQ3S~@v2+>zZ8|;$o>k5lm+F)I2y*N< z2V~eTbY}Tzz;vh&!{~m)f_EqU7T{1sInpT$UIcin;7>e0rzpHJ$Q$*u;UG2PSVTsW z!uulR$OokVS>T-mPdxVX6<(D^Kgwj|P^9p_X3_67#tKw^X>Nsgw*`;uqAXQlQjX3g z7QEj8uLAzmkI$zH?}rjk<#!A4XhTIxzo#sC_uzT#QwR}{&man~6}-88Uw~sE`+ZNw z3E)gxiiZovC7yY%{2sW?cpM|X1V2Sezg_SkA5Z~!Ajv>P;vwsC{m!C-Cg7nmDGWwc z{I4Nr#>>Dnrz#IV2QiH9*DQFMz(ZAtlfvU3ux31;36GDn3h%2Hylmi^hGv8u!6(5E z=6uY(Ou7>xXHItl665n3?ZUH4cen-bPT%8_1!zgfR+CjCYsT;Xw@Uo+lgaLdPBfurz#Y{B~`@Ww!b`f*4=;bmFy_-=b3 z{YG2xo;K;{GvT=`cxU0Bif~0rKaS^<56FNXlYUw7Q~DjWl!p%i1L^mKr9A#<(r=6j z?_mob*BqKGb>NBVk~qhoe1Hy+!`o-Sv2^309;+<*U4;OJf#5j*6-$1zfyekPk8CMN zcfJL04ZwKaDpJ_9EO=8)c-KLga>TRl$y#%qFmApJVv&o~NiiwTd{9mAMk?xk$TYlRzC zAx@MdHGm->paT>!;Z1^@VZ_^wo0u8zI06RJuL5#rye1PK`v3}Wg9Wb#0lXd+QI53Q zg4b!nn}%?O*I;QU&mv$T{rncWbCC0kl#CyhZmBIXzkKIKJ1A0e8z4tMAOl{9ew4c( z2Z#F@M)x8Mo)36F_$yL){C2^N_ZINRK!|v3e-$3rqA-_7K-M!Wo)dD66Hoyd6ju7N zy;OMrWx3ww0*~ddh;pRgTdp^c2`_+fh1Ue-%=&RpMTJ2e#eWAv6hF^${q6;xs(&2%r5xSUEqL!-M!!iGyvIy<>{lwhd6w(^ZuUzRsr*i{$mPI2LjP>)#`gyOsiyl-y4tM?N6^kDJP4Is6#Lbl(P;8Si=E zv7RbYcw9fBIk;~{;2|30I z;2>=?;jMw2VJwdj7&G2p;K4L;q8#ZSFysStfWB$MTL(A8h<8@z*9M-{3Ox2l6e+x4 zTk`t^@E(E?%VPr$g;yw_yVX7DH1KXzU^r8E9{fg(XO%AZvK=Vh2Q2AkUwK+~a{~MQW~}a;q@bBlEX!&mdji z2bnHO$<0SP%Et63-XfU>?a2J5;t&I@lj5JgU2zT3DY>72AITRuPyu4UlusX5LA$DV z=`H!LeHKBYj5mk+Oz8 zwfpv9no5#3JJ~x_Z=DmprXaL3+*GxrbC4fqGrpBOxVRxy5c+CCXhlKjo|f3Au4daF zeglPQ5gWGH%e1*>X_543R^5?rWQCiz)a?oPXt(uv7DB4sb|fEi!DL&+77l&2-oK(T zQfmu0@2cC=)uSQpc3UR}yfe98D*SoO^@W6JHdn)$5O>~Hr>yg8C&mpi2 zfx;HIjsYNI8QDBxoW0HTEw^I){BjxfQ&9`PX_PxVLbBMBP?(vN~ z5T(GM=6&Xi%MKg*)^f?$-N{R1d1t)8^NDz<;wcf7024O&G+`a`*^&1VmXEl#dpt?u z&@j}Q+A=yr_zC0d#1_OV?$O$@x-5{f@t?cPKP*xPKKT0)BDAGP6C3sgldo28VX2ND ztp}x%LDA*IBh5K5!#;1T9v7lQW})O^Fn)pna%~p4kgno(#Fj!oA|FlLkRN&f*=(=j z)$YazNhu7tE;VIcu=yWG-FBE zl*m&JzhhxwLEf~;K5vii85B8L*N%;Ak2chGbfn-^KVRD$%}(8u5Q*x0a6&87uQ|No% z$ufQU(t8=Sb+@YC8Hg zq%k;jY1C};e31j1fJ4oB%OTGfG9dO#bOM9&aOkqX!f_y7K2!$C%LmaS@>CSG0Eb#n z(Fb15wheK|`AnEkh(0+-b>w$= zieD&s>T8`^x4LA@hPCB#tDE?n_deg1+-ZvMt>a;#t@q^`dr;knr5)8ekm{|rjF~V; zP3$4WIcteKFiBA?Iyd09Ocun%H5CCVmtX9gVWA=zj}x3WR&sx6Tgm3juX?z8Ywn~3 zIm;S{3Q=k*_f%58+?ELWyzDMZaYJnj{m&LRR0+xC`|r$T@rm0$VHHA!B1&Pv5S2ai z+zV!oZeyN~W#WRc+m>P#s%EjMlw<)=KzWJv{1|P3HT_sCKNmfS`i-g_ryR7Q--e$e zTo!`Z7Lk|DvwZe5!uZSUl5_{+TICiQLE=}*-3~eO0U5Rm7jr9kHqX?DVZ5fNTJRo% zpZWVWg_mQ&OTshdwxsa>6}%bm z8Q`&>ph)4p4i7V41aq}jegPfF`!aaq<=`NVhr!nvtoUUZkJ0$yS<%C)V5El%y92)_2!X^gY|G~->||J#}%gLeEz*j7RdXtQ6AZtm#%By zecc!ns5;p=yPHJjBqHs-aoyy`Kg9G z>-~9+Md79w6@AhUAq`B3F4w|`zFX7ynvj{HWV&Kg@Ni_Ldfi`JVpGCR$HjA()PKIQ zVvUGoj34yb%u0&Ai>}NDcl5qJWh4QDh!O^(f?}kf5G5)Cr@;G-5*58VGEOR zDBq9AO#hUzMK;&J^hR#2_fM_4+E(~#FVrxe*t+~vJN(ly&?68HzZQSaDgWem{gcl7 z3&Q^V+L*{nxJRo!Yz$IBtaDG#K3E^aCM`~a!LD)`r3GV5`LFk2({$t%cE=MYtkv-wyPFn9YO*LQv#n$aT%RlNJT<5BOHiQ8_EvF^%N_HXxcz^7JI;yb$41eIs(B1f>@?3oA$?h>WN}FvcKCoI4C4+cr*qHd%Y|tS zPehc1U*b~0x-^lK(O3hPU4bcbjlDqnZ-1gLCtWet^R#BYvY9I%?M6MES{o|%Pif_L z^+;|-GS0OeZxCY<4tUA&pJn@sLbF}oIq7~>|Dswy<@Ss(Yj=0%_bh(LhSgFgCNGKQ z6vws%!>Jvy3GMD4zlbe8CtU>wpiVK?Ffo~e=LgToMO}x5uq}j&-Qt-C%Wvt3aSUzg zz7x*cG~h&Qdtk#&~ zLNnJ@7gc{WSa*6fpKnpYZF37J`LgdQ%Fi7?)3^2Bk}X@-u1Us?=5O$rz9``y7$4RX zRm+~xiA*TzKDNo?wmuWT zA>;BydG4jAi0*$h-7M*T*%H3Q63+gFBFdY@1^!oL;Ch@n#!zSypgg)qaiY5`?lSbN zv!wT^wC8I0b4*~1C47(t|0@>vcP;XtNcT9T%RNqpSi;pF9#o6^sWnlQ`*92Y)fRV_ z1Q*#Yvwt;PYe$rAv? z=RGwJAo{+Tr%B>-xOy(0MV^U(0yxxj@m%s={D6vZsOREE?EDlaeRYZzPYC_669KahbmNq!7?juTNn8$9QUkY~Od zB%cHRN0O%vUXna*@F&UB2Do5F+yK}wNS-zbNWKXCV#zN6{}sv89wc3k2~a;ZCcylw zF#+aZjRi6P`e^)sSe$$wCw&nId19z>17h4F{fV($^28{XJnc_X_-siyXGxJxV35$w zCs<=V#BcCIw=9Dfx?N-NEE`o%M17;dLBnuxFBcNCL7qAgf;`jtlH}w1!=LFqEd7~I ztK^wZDa!&fOozm40j<7qja)0d#B*B)!9jf9ATRQc0fg0C`abWI&#f2;;75O-@%bJe z1B?xHC#~F28e09Cdv07_w%qlWIye&v1JH*M;- zAB2)rI#>ov%m8uJ%_VEZNRm_q*w`#$pe-Tdu{o52?>O(Rr^y3NhakSAAdhB5&=h%AC)G}J&19?Gok|F2C07GE@&OsP z0PW3j@LXen$uo@Y8~2ko<3-@dK8qrSx50wvK_ixgh{Q9G?<|4ajK{U0*hVT+cnjfS z){lEq@m@we^Y{+$C1yMa^k5%Nk-{4T4>R5(;1$7-cx-PO#{8axK4!d4GG7Q1r11U# zIWt}qc#Kaxc5f8k&n$RbfX63!-R;&flRJ~4DonRR(Q?e&3Jhzd{nJCDZIzvLp~rw z)&P(7fOzafD!jh~Z^jD%&;0bD@G51T0M4XcCOqEL72ZLaUp4>g4&YrYVi-S6i^m`3 zImhtUIL~*Dzu^=l9b#k=!dEhC*twhfZ-@Ykq`DY zw%ofVRK9g>e5CJ+YiCcz>e)WhmDkRGA=gOWXk)T*-6`!1|Hc>Om><^6HhlX3VqMi0 zHjk?$tt*x>YcK{E@X*YaO2rV|Pcf~<8C~31(G_!?iY4vAYa%{U$HyiRr_WEscu~fP z?7*}bu3y{AC7KcAShDwLoHx{N3~dB$pGMNwWqvW@h-NgD)necw(~$FI){I!@@l+2p z2FP~(Cze!Qm%Tbsu2u(P_?1hZ$~L4yKeNk77-u@0AUzF!!V9@nO8-e;Kwet1vhAsVZlsoqT3jkP-UgbbeI;# zxJqr9mo#fI20}51!2XWYC>L7U6+PS-nJ%piAo~MG;FTiSGlLMtP-0b zW7FPTY-Q|^?869FvoV6@c-#G+`=VRSZh=zX5uC*&U~63ofUkT^Zv(Ct`vEufgKKwS z?uXmJ6VoVy*ZoyN!63q>!3&?n+4-MDT+=gcWte9r^UwTpZFio;{YbTZ@a9j0zZjup5D$4{rHsvuCVQO7n0JPE*~xIvl-hhDgn`uh zo+%Bv^*w=xPAqIr~UiN6&&I%^fckE?0e81~Pr_h;8Mg#5HQ zrkU8Z;CyH6na=mgwK-Z3cgDyiJ6iX3Hj~?EZ!PQGL+%w@>*CH3x$CeOIC4|#Z_Phu zi*PXUU|MUgWFu)$MQzpBXt#YYGBgNbs;UvuMx+I$Vo3i}5@E4nVkF2YyzuwSiydVjC+LrnC%31|9;OUw!JS+W~OZ-n&4=O|8ThSwTal< zJRF-~yx{TSDvfD0(CM=GoEKfSY(xCLz38qy^*vkl7>3j|+Nw8^nV4KN!q#14+#*B0 zy?LR(RLupHos!imWhAKa@1vEE1;RB%l} zGmdm;CVQ?kbW2F}{GfiRvg>2>%s9|#E1ZU;tEXzMClOPY-Uk2DH19@df?=*h>vb$y zm^FBv-E0iemMXwJN4pKJY3s?;izS|6<~p>1!pzyZ=+d3!dq6`|ZzFVPJ4X}6>zZMK zieFjt?-_Es?BWoS|7hC8V=>9`5)euSH^A47F@VZY5 z|D%`2?fLoTpmz^~;Kbw|^|tO?dRs%mcmG0kS)uV6kgCdfyY}v1kcZY#_v_~ComW(q zsjp$W!VDJIc$JKRzO&KILy|Lc=l`fB=IM&1q8BY}8r-Ny@}s$RmBO3XmuNZAMJ#^v zrxWpNIkFgg1%z;a`4n$v5tH{Rh&b>vFnCLPM@;j0a#@|<_Ppo0=)o-t{x7B)qDtuf-K)Ny>KSw(s&8DYq+H+cU78!0+VQBZyQvql zg&&#A{Bq?T?{l)u5BIg(DEHlHJ;pB{pFci#hMxtW)D_E|H8>x-IMAumBcZ6jZietS zUNS>P+@7-D4X_sMFu_(k`fdkgq+xGj*_~$>Org`Xyrdjc*J9 zTU+a|KlI({nMDT1sivl5_68j=QT@P($-(8Hio}nIP`Ud=@B%6-c~JwSy7wrrS{Ra7 zEj02^&s?X_nvdCM4+7f4NUw3>a*3J zG_F&x*k>x;g~{GAwy0j1p`nlO@8K;I$?i_}esmr>2^|)?t9yE*dSp=a>INfSs7^4) zINSgnya5pe${DW@Eoc%@fk(_ej%pbliNCLPNbD zI%>->5h64`w=$oFvY;!r2$v6RhO6OCTSXZ@aj5qXtwXUOC~(S{Yr>KdRhi<#;^_1> z8dsH{*9X29X^90e38G8g<-H>~48ci6X*CVIJN)U*82)?Auu1S0*Li=&yZ)gi%_TbK zoOt*RQcvjgVk9FjkDB_ah&=k->BBuSL!pM|+I=N^(3_Bt(JI#2kmw&7vC>}-X6apG zRtg@QT&MHj6V=z~BC2OxWjCJLH#ED2-vIUbyVB;U&)!FzyV3f|>wEs3lsm&18)$XJ zy*%7{s-0sJ74=k-Fh=7AIT3J%LP#A^iXOoq~3z7gLD^bz+Ix+wLB;i2Dntx3A?6z*%a+mSEQG2tGqJtEyZh1+ig%3nK1^&gb> zxek6d4Ns^hvL~#d!Tf$vv&-}r2>GcdX@*&YtiE zI^9-%CtKvL`c2oyy81*?!G0?3LtnbTWeIPygzvP34>nZ^#{VUOKx1HU&Xy{_rp0~AqA%A~P(=A(S;D`l0&!-zDLLW3$)eB8mh`T& zxPNPrUt+OOzD1uOTjGzl$hTVX{>h^M1e3zlpWh)UqI-d?uk@q4#DdRvtBQoYCB2_m z+>coBKedE^Q|iOLwbQk$HLeGyi1_0y?&&HJXNKQk(eG6Y{vR#*=RAK!jQ@$nzV#No zn=S5NN`1eMb2?V0|FT6tV(Vj!6qvO7eva=-^=l1(rmK%NcrjmToWYCvO4$bQ!%5Ad zBb@qvj=^gF-30Qo3E;Fk&LbnypFGnKNS^6`Me-h;izQE8N+nNS>LgEH8YQ2BbBD?Q zCCU46eqZv`%L$t>UE-%mo^i$ZVeqG3YOb6#k*3Qgi~8vl0ExUvyN`yOYdJ74G!uEs z@;xtkrX}WWNf|if_7|8F=_9Yz8w{R0={FiY-@RsVq5z1+L!M~~TY)FWz0#j)bxWRh zJ1KeMosm4_lJp$oOt&tZUB*{+L+F6!ek1H8>VSN4E$V=5mVK0;f*(*e4qZ0SG?PA! zzQ#8+y1Xdz;MVyAnuSB3Ay`od^qB@fm;N^yd=YsHf)?P=XA4%Wcd65;pgVEsHw#vL zf2#)!o|jDq-gOg?@9oJi#hLS2$lrsrC@=7&LLBs`J=RK|Nta7Lfb)6DQ?JRaKai(h z_eq{*Q73uYl56TvhGp?H$em=N^H1J~GxM*{!4HT!(VxXfoyf1inL3f*i8FN~zaMAnME+@2odpY`9rarUYt$3jF0mfy1OTnVq2`&cAurp&4dhu_K$~#r z%mio)4mF>58+rLXYX$jv_yO5*WN_jOh@Zidr_Fe&lMmp`YE7PMd|C1fa9%BW=A%^d z%tx){lW_i~bWehkjXB)<#iF3Gcwy(IaiIRA^} zX*14)r_RKGSMsZHwzF=-pY|IpdD?HB56Mj;{00r6X&AjS#DEo1`hofN}gp{DtXF?>kBx{JNqF_mu34M z$>)IQe0cg#0sp+@SAjn*d18Jj`8@EPFHiYd;C-kZ#pb(nQI#zRi`q z2j@kSr!K{kr!Icl84NKtNS2H(%wBZjVPhFmqJZ;r2dCGqxdFmyuBjEVJr!(&oGfVQ+m;Gk? z({9rxPkYXlJoB+k^2A>$`6=MV{YzrPd3k$Md62N7Y#W8$WZURNm}(n^4W(_VhiV(C zpXw7*C)Iw6do*t>AU?ZhfTun4CC{W6NuIF6o{*s~yQDvD7?wQsdPMTfZ=2+OIG-}{ zzm+`oy(oF=#W|$Zf%@i2p81$(@~3_Y*XH%`08u}EiC_&|U4woE;!!_+lHo7xc89?W z``l^p!X|QZo)2Cb5M(;DBu_isBYB*R`vPQ`=Ka#2`F%+8w2!!7K!)izOMf_xH4?xu z??00MKAhi>JoWmuF6qy7R!JTwqwfcQ=5M?7Xa06dp81PNo_21KJn^5DJn_3EPyF9Wp7!{?Ce21J}3NVfe)DEmq^|R|D}?rxzvq@?i|U}hVf4dxbei6&G^b- zrP!vTxa7W2dEaLzrCUla>%V$4zfVd0OvSVd6;`AWpQ`jNT7m5%`1Jy0wiovWsTCCl z4z+xUvQo@`UAc98@qie86Z9`5DBxsD*jZyhkbc1m)s#6S11do5ud)GKj;u@o99Z}M zIae@9*vMX=$iNUtWmCy&vHh2^W`(k0KO~c+3Zt@e|FH7V4$Fck%;Ng;Ei3V{%BB*0 z>eD|`+$;W_3P0gda;z`-mIgc546t5`0ls-VgH79dZCP7t@whk9P0)lG^pIP~B&56v z-}5AXCZZ}_s614<)$%n*UxhP=sv5F=>sr=SbC9w!A|`~Y%rhg#MYMh0y2OpV%tb4< zcgtJ3{XV&g*4i~(m!-dQ@w)Jt5tP1G>HjA9K;i>K=YAe-%|iWQwys@m7BJbhFBfr{ zxOMN9%it&v^|8^~)vU6jB{F@*#X3@4vW?pbsR*oprQ0{f-SHX>Iqa`ja^Dp`_lnB{ zI}XBhSmWtuT0kZ)d*9~!cCIboYzkM|9Z*E+8V?j7iuG$lQJ?w(6riloGE5;UGhNnO zt#D%?Uiq6e14`?$Gu%ciy4`j*L&+HR}dlHkWZuZ(Sq5<*yZ#%(HLGo%Cu zWzckrjRX4ytS@K7liR{)bu^iEY{(S`)7)tHow! zecx~N`w~r=^?%{xGTh!Vt4;JFc&jIQ&^P-r{1l-JB505eeF$(a>1JQWOzbz1PT;W0 zu|K6q$@Rd4d_V>~guZkIcn&GDPs1?wKc2#2##;k7-|;9?crEZS<9!OeXW&OXrwk+B z&)_iQMc`onP?5spddOzHr_uRi|B84t55tJpVZn<6ZxQ?zDZF+IUJvltKP28D914%m zjb{DM!ohSEDLg)Fk`KrL$7rKpOg#3h72b#7&3GEh@vMx)lfrvn@&S5+rU36woQXFW zhr*kT!ZG7<409F26)C(MAV)qR10ult4S3>VC?$?({l2US@%WBdkz%dimu*7-n$LU0 zOT$4qmIt4q%=+y@VX^OWSoHT z#Tb(bZkg~7oyM9N)%`oC!1ICQk1U$YY zS426|7r>AY&;e=!p1OWfb>ev6u;8si<;)W?j30$pZNa;9OrL%*WgKs#1uqIbzOz@P z@YY)JUIpH12+@9i9F${z55V^3{HifW1PM}j^^hYUFub)VuI(8 zB89icf;S2e(aL^+j^q8sg7+92zk$k^`=XfjdmVVIfW!QbGvW1E@LmTV=SV10`u)^` zmjjT;AVfS44N#8uJAt@n`~3nJ_gwfZQg}TOA|H?eubS|#ho8cG(t?+nZj5QlXhM#B zvjuNMwlP*m{U+j2csniaeG?iB>a9rWx82g-KY~oE_T@$hE4<|vydMH@p!Vf13*HZb zHwHM=kI(K3?}9DSey4#q(EaTL$T3a;2kCX-F(1U6j6>o5y9Mto@D?Ck5#>m4TJYWi zUJm?;$KhRt_axdomaiOM)23u#T#z1;$nsb%(}a&^!TNymwJTVxtz;LCi_o?Gq}dwG8D?`x+`pFGJY=*r*MdSDZh zab0HP9g3lyb*`%+)%QCsB)(m7yyMo^jo2iI1JH@Kb?jze+|pbI{`KHkxKM~U7Mb6^s_QwqBv?5%T@ zx?RIKPZ5b;HzF}n&h4FXATQbD!PjtQm}H%)_4xbd7Gkb2l!F@zb*E`alamg`r?ac- z?%26ucXB*ZLDdlD8z9uZ(rA)ZrSW_3Qx%@+PKlmL|9A`&}rwj4m-}6^K|lur!%7Nl%ycELNiL8FS(H z2QNkP>mG`xHAXg8APma6#b-06$@`!D6dtoYC?KI%<6n1Hw{38}*V|_Z)W22->PS~i zejO2fQ#-Bqq#-}DnEI@ErMldQYH+acZd(>DJO~yp3&9@lcU;=o5w=3VW|~$EzlF&g z_AQB}vUoWU+2a;fz0{o#4=j0q!i`U+9hhnDEx_j^6r-8BZNn&!_*Q|_UMD8+@3QSI zH|FEg3Wi@8lafb?dMB*A>*J@gZQaYYo#D3Z(dUFhyaxEO)?$7FmkMp$3ya-Tv0(9sh71yMQkC;qU@z6 za>BPsLTKjMM4_yY_$gFsyGwowC4_$e+eD#Le~Fjid!AB$RwcxC{yITyRrrpb6|UvI z{Higb6_eM%87(}<`?W~b*8Gl`Xb;tF@}Nuaf{$^Xy-jPEqV1%}F;R1kdE;Zv4?^++ zn}!S~)#i4@($T~~9v^GTx}IeV$2?ehQV++{eUalkdzyQD4-1*MZSUDHvgMSQ^Np5! zE}^a0_q5oAQk#)dTABDp69$thy=%wC(9V4@){RJFDwyVD$L0m}xNeM*Y+RQ#p$jxk z(8A9POUyAJa5i;v-~4mSbZQx5n!jzCxo(O&(8TtH__y?*yKag;VCdgsZO6pt>;7vy zvR_VOKaX>_&BV1H%{0(l>|WV{!XpFXr-zNA?ARvhiKV*?# zDrHlU4(BGDk`wqo8O{^qFSW!UYl^_|$E2I@ak-YG-ID$Yi+&$KP7&k(ALYQA?%zv1 zJ`-?l#zU6yJc~ZxvAA!y=*PJ^q0Tq;eg$y2Xq zCC@bf)x^_ {jHOWubwNzI=imRc8)H8Mk%$<30NPED;RDdc54Dr_S2B5WdUC2S%u zM`06L)rC!{42UvneZpyyCpNETwLalW$rJnUCC_+INS@e7B~NUUj`22<&{JMg7|Idr z5YnG=@ihs-U$%T@9z|Yc9z|YczC>OI6H(4T@CjDqN!5)p$y4`k$a!nbA9<+{<8o|`B+3^*Oo!E!{!9l$5Q3-d z1j#d3mu8KAgoh0)J7p)GL?1mrLT|AMXu~Nf5@|2Gd(T6#?(A49SG| z{pvm3XG^Kqp#}h6UJi&6PoYmh!BSfzvY018y!cxtzMxuLv1N1lKwc|Xo4myfMgwNR zm-T%2mGIKt6alXuHYu4Vktz=yZ-d`*A_*TupE$;UkJT8-HzX9GTUs+Pv zv7Z=B@_Epdn2N7nlJZR+&`WlzU0C|(PwaoAg4KnXkV7e~4(dZZ)xMhXmcpO?T}3Kg#v>n)0jq#l0iOQs1}eO7gE!-?frD+jB8B%Y zc$o1{1CQ-G@!T?u`fbNy#@htP0{AIXcw69M#ye-iV;6;C#QQeloAG!b=RHJ`!s9$? zGhPxR-w7e=2k1B+^)ci90uJ`?6)C*+7QA~*c)Tww{WzE1jQ2X+1KIC=_?z{68hFZn zsA6%vUs>=tZ(iPtg^EhQUs&*ZOnAKQEB($uIkSGOOj87s@uTqGvgG$2;O&J7?T1$p zaXh|LG~-PH9-n6vDLj@F`G5@A0;9bOo_OpoD*a9)z8P-i;DifahJ?$Fg&8%Mq@I+rl0xG35{oB=muJCy26(d&PCRxe6<&u0?{(mfLAWA?*KWZ(2RwCs@G(Q-eanLP z7vQZ?U{a3GS_|G>RN_tWr+$7M3hy>Bw4ZtpwbX6AFNK#NhVkHhU!G|*k_Q)&Ib9`} zCd=25!uuif#RgBxk?x0_`8^cdaT4_-DY-e&4_S#5@%Bm^sOu;dq3Xt`UPKvdxEgPo z4Bq&iHf4(NoRl+3id^|U)ThvuWL%fo7-=!In&RbZI8Stwbkuhe ziiga0Tg+DVaN%;#KnB(F)BrzJt7gQAWoiW4I{v1QDQX3Me9TLU<1UJOHTB;K# zw=qoY=&HbNYeVI0Ht#_9+R_V6Tqb{j&bOG6XZWk0pGw*kG;pd=Y2|7$HP4vXH!zI4 z8aV@X0PzH91I^OcR{A6at_f`m#f?NwSFYQB-)b2%Ay8?^V5Q3qkVJ=jTc{Z4%2J;H z8?*y;Nj3u_RypcQjj4VqmS-NaIwai78Bx`XObA)!RG3+AD1_)ApeN{KxOx9&--P-w zjP6S~%y@Zlo3B8H{R#Zdcn;)4;hFoL5ewb|84o8x3hzO<%y_9LJYF6QBmNc~X8jhy zEt`CBh8)lLN#k9nhhIXFm<;8-I#d8Q0$1rBrnfNQ(sU!==$CHDXr`YRH6@ME~DFD#22bMqz{y#aHdz|1H1 z4|1pEO8G1I5AKwOqWT9zkUH+?-nDwzuGKrVs@j}zfi`mT$hjl4Qtk?V{Sxl<2oKw| zdYfL=kXAL`r}_eu3bdR^ez-uVM}kbPuij?U8q!*9_Nq30Z==tM1sM@%d$_=!Q}sc( z!1lT06VcIPb5^yb0j|a7(%RBGZ0@Rm(wlzZ+dI?8x3AP;Nr9uFKwA_+67EGz!nKGh zIs^2v2SlO)rS#vR+oAMz}Nn-s>9Sc8PTp zC^AC0-QqiPy5|UYlJ-M7KsVxGzvQ#;<`tXqt;%QKqSYO0<@RkQn+CW|S$YTCx8Ylu z(5900_u)&J?HG*Aon~kdzc+HA<_aQP`k_plaz&JWBK=V&V-J{w+k1aqAoBTX5kys+ z$5=jG?32{R54U1@=5eL_F53dDoP3Rg5TiZg`9U0JxjW$==zg%uBFFm%>y;waj&jd) zGhPJ*Sl<*Wxj(|gEcY1PtcQw}+{^GV%XPxd`l(3CJqZu9+^2A}-YQaZ*7lpr3loD<)& zS3bOn2HfBi+wW;P(~Jkb&#{k3kt|r%evg;hq3v7n4a~3*>)nbLTC~aDdU|t?iF~~4 z?d`qlQyfrJ5Zi4u{C3f{qm{*bX|&sR)o$1N_VxB+t@T=4*zTyeJ9!77luJmtW$PZ7 zN)OwUTI_?+N>|nSTI|VerR^z3D-9n4WrgjY7W-f&GDL`6l^`-HY)`GXr>V5kMOs7S zY1I~l?HTpTFA3W->+M&o@DU<>WM6o3*gmS>K3au;L4<#?FTA{^%ja>A zS^&EpbHi>eT~kJJy-%>^#c7F?d|*HCU)z;z}`e&wNJ``u% zAaH&pT%6WD3{yCteI~H+r-5hkJ)>1&c|NXsA$3<$)kCRu>w>#%SY#6MIJM7{gh-x| zLJkw)QsA{}?(q+w`R5Z3@2gr@aoWZoF^n1-59rg*Xv@-~llF%58_KZOMniNS|9w|Hn+P=nm?MRwi3q37+i^F!=N z?e%~6!RM7X8&5p$e);`3W+Am1p%d<>X6q-CS`VLozo|WZ`pkKM>g&DX)6KrO!*8x^ zo7(up`XP?4Al)(HUQIhS#9j5ae*ADWuN_0puJNMzB9mZCGK{HcM3EpOZMnthX7X3lMU zVtLy__kmgZ!lVn0*?T^Y`3|+TH5_f=wiy8KfJ!%oJ5TmBKmC08=ug}3X+7L@DBSk_ z#tR!C=}g;@fArbLdwu)EjsI}W-H`v$3~2DU`>C6eJ7_Qy8XU=OcV{5i78KWh8Ie5C%;RHQz?t>|!GEbyb2qiq-38XH^pG(8DLT65cuMBjhC zA>4Yh%b(ixYPfY@Q%kt*p2kO8&oq56+;%YVVfey@qd!^bK9c*3yLdUM-PUwX#CglB?`=yyi zSxgpXf$U#Q>N#2T{_z)DiuO%H0nBO1E6bTA%>N3q+Y@{J)s|P&&Ls-ftJT}cU z%zM^W-aVzRW=W9-_sD4dx-`#)s#lITKIP#Y>Gh`LQqkS^R8x8WmZnut&reNx z?)cAA1F!lj3U@wMaet*=v~EMNevY=cVte@<``#@dl+Us4t;jE*qwjXUGy_;wb*bmR zlZqyLTmi%Dmvz^dRqfF zJDKAVv91!ahE$=yJ!i1lfa>0Z_DaVD_XX9QONb4l-*IZZSGmO+xT0;7O{m~Ib=Xge z$q`8j^f^w`VqAya;o<7Wwfn+N57h1VXU?noq5^-xn!(xh1S+jg;)(Qydm*BxoM_vF6g;_f)! z;d-kd+45ur!l@oxFzK%@7xsgNBRegacOg4%^toN>Yck7JdvB33JgC2k7p67jAwjYP> z*iU)@N2_aeENAhw?yl>48O&nd6mvTgJF^3awI zC98dfo6EPC`j)KSim|=b8+^C&8(e_=zenTl+!5O9D=shDgy)F~zR-PZeA_mx^=-wt z;D$=yw$1mi-I_eNWQ}iqW%*hWy1t~ec+*;6$$dg@N2qx1%;fw{n|!4urCTd~JJv#s z0L7cjH?L>x3CZ~qvvhOmT3>l++lH;a&D*yj$Hi-J_*;x}Yg&t`!#U76x7pnN=Xr9} zsE;_0lVfzGui`<)mN4qZXBYD*9Nig)u>7^hM>Gr%JKmlim0E>EG9Je>Y3B32EM;+wS@sy>$JLI}h=@{jISmNI-!bfOLCII4( zvA7FldhJ5~3&N#KvvX`MVVqz3)0P=1Ka#MkdETLv@gq#lU%XZFd_Eb4^y$xdeCI%( zV`QX+d604dkmD0-Z|0ejCr+`6|2vZm*!Y}I%Bgo2V=2Q#K{wz?n0F|37V?=w#K@O? zn52HXoHr@vw4rNCVl=g8CoM;wNn9uSc)sM*j=&#{K#;H-3j`$aW!0ybng>aIeH0~( zu{@oX21GA4x6(%*_>>(Z`7E5XB~M+bF6RX@O(sL0X)>#7ej(K&PaMW4&+zLd&oqVI z;Lmg>OMm8Rw&Zcr{z39SoWC!5>XI_Vqt^4e{07tVreoUZ`7*Ce1`v$D9_m}qLcJJK z&%?%?vnxOv^U~Iq8q2*HGjDhkf1M7y1hLN=jhF<8CS6yn5}{t!kkW zks#mFtQ2#?tRrHdkwv*(^c9p)QV9!kSoVXCkF*UiJ*uB&FpOl5;kiF~y+Flt};WkD&TQW$7lQBJ~&mkiP~6j;4=TVC9Omu9&)=cnB`O$!xdj6`2amhXb{*Y@LHul zl%xAz9A>;cxZ{I2;1%9F$p>&Ic}#fbcV(QHY{n~stioVC#a{x06x&b|60 z@YqLFr1Z1Sz4D>(RXt#LMB&Wk9{D8_m;FD$F@mM6s}o6rp2Q}o*^zM7jgl~^F$fazeqfF zZEu4d{^P`S>AqdcDZE|q^u?w6@QzvJ9)sMa0pwP|k2ej^ zaQ_5u9>CGyuEO!a^El(sAXCKy>1c32a0o{Sjvv7fhxQDPAA^UV26yk%I3I=^hX%hY z$XCIy_q#aS;rEYlNm=N`q70n`0G>C@e)xmvXFp{{Y+E5e5! z9*0lHm%(`u(F?z-g}cf}jjuUkD{SDruf36`NKzBFuVZ36jWnurWEzF{sWeJt8r2)5 zPvJVvRST@K6H17+$c&YBs1iHn8G4VCP~9t4#Cs&uE%uv&-i1rFLcue8*Gl>7yOn&N zVA2mVx9Q*OzE=u#-ysFCr>T*D*9ztH@4c>KDOP>E^ej~AR=?3Jb!R-#?AKg_ljUI)3?sK5=HQ4lrh<3-+QK&9}Z zLkxPdH+<-LP5J|c*&^@h+|M3x*l{-N(7l8!5&G7ouMmpt$~ttv^jI(QesAG^nN8Ot z2D7YtpY*Bzdy${?*{(EYlW!P7Q?m}0N*Hc>R#QJF>(C~qwl%?bNY+t`-UtG@!l45}HL6mCha`L@eDMe{6y5GKERPT>gSD8`YF zqX0)1i^T5JwBBpb?->Ig2OrKI@YCU^^9F&=8S?Wm*1_0`wxVYIwe_d}_eQH zA^cB_{rQlwzfKX^cDn4^x<3!{R8&2PA?Iy^YHoNa62{Z16Ye zFb5V?fo!`|sy5F}_@pBu}M!iZeJ6_@7efLlgdL@z6@Ex8O zuW0{9aFbVT-HpaL;;qL;d&Jf~5sSQ3>OK2At51o{i>wFVb!^a=h&^H3xeg3Ljpbk5 z@3}A1r<9v@d)Hy*7h=K#2FF_?$_a#4-SBSJ;qA3yXKQGTEmnoB*l!k9z;JmR9dVS> zWaC;eK)l7+FO&GkY`d|{l1SEjKi-m6pXuE|ESVTy-nhEo>aBcm{MI;<$JPCBy@vTN zJ%BT>g#hY&5+02P;TVd;hQp47f5xj9KBC*TD#)3-ov0g3%h=Qr^@66Zuon-fZ&h_F zD&v8ullIu!6kmY zGqr3?DD1pjx_fkQ+ouyf#+3tGvh7gqh^Wh{aQkpb!gU)?*Pz4RXe#r2b(V?uk~j3p zOcr`N#69-bXK^-e@9|b+{`Ujj$HktU;u4-`UZ6^)#l2N^RAXmHYz&sjVOhP+D-~r` zjIt7#8}?gCj1F$~~23oz*@24RQN>4q2~T_d!NP-r?;sb`3>d<85U=5|wpH z zLQ%G*vZai#AtTZcC@qZhG}z=$-Qy~uO+-wKJu3Evhl}!wqy~FL{WjV*^mh$Ii5gEo zY@S=zS<`bM(NMdSVJLYgSU>zATVXsgd@)fA%+;0GpxGa77}m3~jSr1qJTG^=)B6OI zzqNCa>}NrPj#y?_EQ9voMUM^V>ujfMyzki`cGqX>4f$uI^|4gmWX|`9yt(8ZrXu8h z(~d%)&c;VnZcmDA{{e%Ip}mhgKKyusXkr@Dj&WP$gEiRvIoTaeYdCN^(*3*M@NnH5 zwMFx5t{#u8r0~67WAA9Re#Rss=<>=Zks5CV<+;83x4n3$emC!RHAkFKzwiv(H1Td+ zs6FDN$hcZ3^Fc#;kA8$ze4G`b!e92{?!G%Ixc-CgU-d?FyWdQ((x+N)ui0*w5Q;Wv zMw-XD%#oM1f$z?t5byt3aL%nSwCANMTkS^fH5LYLL$x|ur}9IU-jB7`EU{BEl}Nr+ zt!dZyc0r*?Ln|0eV)F=pB5gbhZkR!HB8G|Jf!HB&cnHkb0in@;OyGL z{GPiyV{oRu?1vN8-1~?Y$wg;0lJ6}V67eGoku-0%=G{3sGWB3An%{6Z+FVteTH6ej zI%0t?WqGETlI2g0ricA$t(kipb8yc>mpZ!V!%tG9VediofwmX&Np5F%77T{S8HRlk zv&CKPPmNT2TkR0)9;xL;mqu`9%Jt3AvEAsLQIGjL%zXwqO-v##0 z7LWNVeV$QgcVodv#{$nOajl5P4kdgF#eZ)^zcqTT*WvIa)yEtycCBNO*7SoMOhU!C z4Gk%CgHK#SM-;7w_cWHgb1abaJCP_9m+dADhGb2l?35b{#O;kdPz*M%3L7RBo2d(H zB-}6i9>U^rWgbj%?>YrlhMYHYqb!OXoi}o{K03}j7AvwbM^00Y?m~{%1)r2T3T9%K znMrF}4)-=gagk;|$~ck?d-B?|doyv1V)+}FvNubIU*{!O8~Px7cH?v*7H zJuB1&!}|Z8af|aFup#|OJg>zCj*^6&#(N^DCW_ykT>V#hXJOtsti%gSTpKFyGT#UX zeybhV&_kkItmJSF-Or@O!;HLk`s>a7_c8sYXK=H< z-{ml_&SUns*@EHb{gh*#6Kk9nIJ{GIPg0Fnk2veTSM|d237mfnk%-OXYZh*s4^T=4Ug?1-LZ0)XKk-q-GL|2N|a%e~O zAeO&qJ?<5fP^Mo&tRF5@Hqr`dkyvf6C$kny=|*yEMSI)-iqy2vsDo%*mMxx_zrtSN z9~JhG_Sh%o-!?tdTmu&fZG`=Bg%-O?ay$G(vtnapUmt41o}skjP-<7~Hp)6hj~cRJ zdsx4%<~elS?nfT${X==fh~{#6*m1ooDkuUJNweeC!)?D;*x^ zlKk5+v2gk@JG$ zGdY*}mkBey8_QU5mB>}RzRI>VzvjTTUN;t(%&5mrF-gN6chNH6$aNzlDLaBsUEFvP^6tr%6#@4P zbjL6D5|=QZm4Jv0RksLO_{>V8y)Sa0vbq|=K# zVt1;xd}4Boe^{y08`d6oMeGnGBKbgcW=kwb^uv#_(ZJ^kp^VzHaA;`H zqn%&(uC`Skj^x)iFU?)HZ<#;R3=17*9nOJL-5k8CB&f@yU0&?;; z>rrPUe~Eus<5PQk;#HiwGWGQs!tX}QTKyvW`y5-javeM2GU`~d-~WHPdl&Gks%vd{ zt(_}jgF9inNg(JB0*0%AC_$kO2muwVSdD1)Kmq}x34{;?yfs9d?4X_kQb|zSB-#?J zmWx(`mzJPHyl@Us+oDHL!Cut1o~pGftu+7pjycxO+ABNg>GOTh|3CkPmHEy&#~gFa zG4GeP_EA(YtetdYWMng|SHD`VUfHa34T;bD4+Jc49ow?zd4E?Gvef@{W==9Fqnk|99u%`m46aCzpIrvI*j%;5f$l|W>2D}+DeCp~sr8yY<$JO;qLS5m&i(i(*vVJ;b zmVtNf)WTa&P)zJDL7-x6f&uT90;!`kIcm%<-W%jq{3q&zhLyxF2R>J~Sc@wNo;(bIkh6 zIhGvOI1?>zTj%@|-|6kv)}#A7x;Kv8#Lr)mv&ZvHAabOk9c6Lwp>tbyVDm1p3qN%_ zp!Y6pZ4XEy-ZHx}+Q~rY*bYY+w|^KmvgIdEoGn9Q=)N>l$dlByp7MgSz^w%smRCMO zm$@*<-k&q{XwHz`Im7&E+k3Mq-W_;n#~SILleu}&chHCL7rn9k<+Xb^T-v;S*Y)kY z+spPhn~BQXIydDO=oJZra|U9a4vkhf2Aa`!vwU@p#pBy&nN5NO8E5D2y1Hn<)kRrt zH60r<3}ao3TKEyh)f15o^+)QbMo!d^i+og{gJoNNdQDEcnI)in-fRB6U2CJxeMYBU z*S~Hw=6F(u2+J*UPp7$#kr3D7MfPf26CwjX{XBuI281IXr_xeSpcl8Uy3}O-t9okb zK~K6F8VPJ}_`jne>A$F<`{QcJ=w>)y&lY3cx#9-S9ghIVj=M*mi1rXr1+iXv4BqSD z4*{$y{Jc+%FV&ybn1hYq!r^^3?y%NxV&&L8Lgo-z=KybO>|2{GbBL@UomqW1KCWb_ zL&>>V08D7d@c_n{=+a_y;_4&Zv6MZl%?)`i?Sbt)?$GtJKVee)q+OH7AKTnfS30iL ztQFeQbyxRJ{DMPyQsFAAfV0>&b8{f0EIv{(yT^i_eFE!6a;dKX3;N_KDXmA~39ryP zymPO#n9X5kjSa>@A2#Hy=h`K;1$%^Mnc>W-obiwS2ggI`jrxRcO;ZbH_>cz-!<#dE zGw+#6>@XU>#;MQU0jvR8P0<)Rx^b@b7ipO9AMlw8)NygXS@XEFb&&ZV;KixFKl=p6 z1^>I5c6rLtpIC=~5%|cmJ{x2oN}2y!I8&h6#v`t?WKJ~`zaHy?CFuEp@W0UayX)NSLUZ6dVCb}==o)0Th{*~e9kX#)+>z6wF_DI!(Z+&8-r%rxZ!S-UcebTwhI!RDceVffM7=ymld51luQ~jO#M8G2Ioa zaLvqAv;Ct4+}Clst^ZXyqRb^8Y}qk#+0y&N{grHHjB(@cpO|yQM9KX0{6raZ!#FSc zXXiauKHQynGWI1}0X%kfBJU(v{ea^b-D}|nOEWiE_P3y3h1zV?dTBIJ8}~gDH#U7C zJ3NWW7s(#tJ!ZoTyQ^{<674dt4ufqoI;Qz%QkE3qR2Yu{D^3W+I`X@ogMVWcUzNE!wL#DTtow~RUdoy}^im?>*1%b1c=*4;}EDZAzdDQkQOKJ7$?oTIsKBh9XM%sEl` zf7k9WoNB+FP?M8e-;QmqqO+05>ibPozWw^<(p|gT?{KEwH}!$oqtl9W&Musm+`mj6|B>t}FoQl79D^_=y7b^9bO=ajmw*ZBV{ImL=?+k2b+mp+jq$Del` z_^5LaR-!v@t^G^q8_Q3w9gg1;DnquONZMNz&A|A-=Wh6X?Gq`-mgg0Hkd$m&@3faq zIb-++UO|~wlpbluy7m4u8g|`u#_IOZvJxV@E{fEDG*ufxSazXD0~#Z z#KT=mJ-p*SPCD|wu^(r~O?z3A?VX*clHT@h+uCpa+^PP%j{iPj_09kA_=bZI`9eQQ zI{1+E)_bM5#$B!F%@TWNJNoHCQxW&zpo@tIUa)Pe?LP*7+p;pZrWPbY0O&|g6_(6F z50N}N5&g`|&8!!AC4ckJ`_Gz+y1qW96K`zZ{PlM`9%#F}6c;C!%qcA@joBf^Powg; zt+;tWEl4hL>#e_iMM~kLCkx)CrmIEQykjG#^V|ErVdmj0SPwEV%rU zQ%QAa_l6VQBW4b@S^T?b$9(P^7Z(L9i~2>@ViFeFfRcR;7-&RVTn73 zOWdhk;*P`q2v@xQxZ(|RPlkJcZzsIB3({eK`5o&}O6Xx6OG3uhBk*gYP7d2=Oz5Sziq*jJ%0<4Foc>oewca=yBY zRSws-*x8;fbK}B}gqoC~|0G7#!psD;#Pqs;{ZNl_F68F~8SAo7*Se%?z3%V_A0Xi3vv&unI*p#M}o) z8FpGd^f^uuM%S*P4$Pf`*;zI%2mSe(oJzs5YKc*m;b zO!*s-)p|oFh~!R;5ZV5NtDZ_K-f^o;EqT%?)8O*7!VspG=H&4ZOAzOdi+Jv6%2eiF zPMOldOKH+?{iNVe(5sBq2@-J)&JJs3PIpX2rmpGJ18^Z zJ&7V`jv#L6gDYCtn3d@${y25ZR5VmU%8VOFFP{8#^*bn}MUTFPyx|s3dK7zMWWSsbef01#IQMzu#LHl6Bjc}*oLxF|(nPYBdHc+u5u^thM5m3YB}jTv))dCU6)Q{B zi`$ou8Y2^Dwow%9gXKr|)ld9i$wOH#H8sBnSx%*VkSu-98OT?v$dqMd3T4Uq!zELe zqo>G32vnHqi_Dyvmrbc=MvGB9ozUs^M7ipXT;}3rS0SNIy`6L@@%eNt)7E4+TEJhF$IZovnD~V@=^7Pqxk|+;TGc zudGIHgF5sGB4(8Y(!J5rWgr~?o~L~^ucD! z`4k%hZpmFxPHBw3-B!s>l>!}FWdZ#59fsbOuozzY0hqBE67Y}orWSrN;QLX zLk%f4O-<`sjK`g6T#r9mQ=D7l`=PV{^}~WQt=8f>;Ec=mmB*9eIG%+2_j321&Kf#f z=-f?b3!VEzX}-3jbnb`qK%(jS(r}?^RB!mAKfrQqcgs$!A#rnyOEt+8FPROlmrZ$T zq{z7OZ-DgwHhquPp|VMl%3Akj*tE*-B6?WCK0=EiotjDneo z_xHli1Ih@u+>mBy&6I|r&A97VlreMfknu(77@3C--m!eOY+kYwu1Oj-5T|5^5;2pL zg3R9@4n3BX-?*=FXjhpaCW@tC8KxL4mWP_NAKup(xb&mY$%Nvj&iM_2-5saqzZ&@T zxncX8^vuiZoxgA22LGVLuLVM1SnWItYijGAJPU&__16r%@A~3q-I8D z#q@ol2}3Yr#_N?0&6MxoE&L+ujLd-u<^FYRd)wNM{)vEbp|!NS33`?H@&z$e{|bNpG66Sv_reZ0PQ729b-8|U1k)0Py4 ze1A(`Ztm0jYAdXkmjVcnjv5DUMtciAHDLI-rU+MV2*ajY{gIlNR%5dNQl3n-P#V?M z8|rsW!kv=R_L?N@f@k7W=S{7@dq^5B^Yqh(GJ2#T&6vggZH- zQ|2B=d= zuR96n(e~NMD?RI{BB?vmu#}mYiEWqC!s|Xewz8vyQH*GXGx2-8?)ZO;NqO-nF)6S5 ztKr@@=TJh#us+bynOjs{xu9Wfb^X4E6X@0&=B(R`JmxLOo*Fw`=(HlTuVzM|V(`A( z&Y!e=cu`^T`?=%Tdz98@bmq>%CQIpeMrFM5eEJ#~smejr%?Mc%1X%Fff+_YV30y^nb>_aH#; z@Lj_bc}aa1ZwJo8*P;{sXI_OV#(U@?i3bJ4`3{q2tSqecC1 zzrXs)sk@6p8?&{~E8ejND!@rk!RtH_s@NVlVOj5P8IJeZP(MShDgItpH+5dO)pwxW z;%k0`d}fEVeG+mSy8L0UT4cvMXq7)`UVAhOTa(PtNSW z#g>iT!aoL!bIz-2pTE0fw!=~GSc9r?M87pTx7R{hl82j^2eh`wh9G+n2JZO0v54I| z??#WU9|xBBjGcVJ4&Snyiae$qN{TE;6zKlboaa;UqCu-w)7xqohe}*?IpjAv0@WNQ z_V+|5eF@p!0g6x7t=->&d)X3>Mn0u*?%$nw@}|r4X$-myKh$oRp}d(cJVR*%r=+aT zNzTTC^OdY-6_EoD^%bsIG3H=B_PIdirymi%r-%fj@E_5of zbaPGnjWtD?_4daHhafUyqKn7dh>{1iwT(Ib>l(+vTXItP2VZM@WJEpnW^!4}m3v}s z5)vrI&JZ$zNe`NollRr_J-m^^&ZK3>gR652c6UxmDR`=rC(i{>b8gDH4jw{&L4or_ z%wIa|(RKB5<}w%RI&K!4KITb~r}_a*Uzl!P7T0e$scq(XwJmEvU1Ki8^}0ECld7L& z`=}epzfYL%u5i3HNnX;#lHIJFDadD-wF6{$a}lEsu6?ekSowf5Exd(WcJBzYT1B;nd;Az^8j}Z$@5w$+Tr4 zF35x)ONQJ{jZL%g7I0bU#V_8-d716&{q*X)!o~bq@%_#7F`dRT4zlCL#N({WczYp& z@sIg|yLDXQDlVy+W$y8vCw)^6al?5St~)-vGwsvdGiy_=>`9xyZ~OZ<%}lR*VB@I7 zO9z`11)=e0-I-Q5=`WF->ghEHoQ;3zU4HGJrxm<2h}7i##XUcjcaHgy4$quk^w#~4 zPjr|BJ-Uor-_bH(YrTy(^ltLWT(r8*Y(H>bTD>Yz^F-&myHNo?ozwbtNL_vigUw|NU za>JVg;o21<*#ka&a-s62fXa7+6}fg8zG6^rMSi*N{>x_-l*zOUmlv;*H2V8$aUIg+ zoJ63eHm)Za@13Mt7&qf)%_87 z7>2x?tSioVKZhB<0BNK1_a8E6Hib3AFd63Dk~(}MVM?#(*&kvW`tcAf!DeJ_Ov0O< zJdnlGvN61I#sF5-kgwpo*2aUU@*4v!FAbcP^EBSny^q(&&`NghZNJHAO&?Fcq>T|5ASt zsj$XQ4ltjEA6s~hNMy#6$?prb_(;PJ39s(vY)!=OD|$D)8=KkGk}*C&Uq(FJkS_ zlo;qMK~|pD%8eX}Ew4A+ne3e2`s7PNxIc;my^ZbDYufX7;hyC8Mzy9j^opd`ek1BJI6#cx$7jo#$WA_oY&LS<`S> zwFaxe$!IWI>|-ahWq^y_o*J|0A)90_l;6sM#WCM34asTrvE>`;$4H-u^i+P6pW zjib6fy~pEhH^mw+`g_xpj_a2=6XAc#6K7 zgH}U{rQ9hj&Qd{Ky)jVJUeU}w_NmuTott{;xM_N?`3Y*@+>k8EZxC$Xt&zDd#?56> zzs}}+(sd7C_6A-{Ma1p)-f_Y+RG5rm4HIsSU!Hbrhf2R-YI26PWNJaW)i!SP5RSLlib@{LdQ{hV%T9dvYtnlBrbNeOa{6zKy$)APOE*(p$xn4+&48EJhniL%zq zY%f!e>KbxyzqjDmoe-h8BXHn70+r>4g5P)Ees6URze%P_n^Y|ylB3yt7Q^Q{MsjTKzW?+`8vPpMh?T?r*&j85>5)98Dmm76Hxb<&n+PuFkHnY1x0#ZbpS)adD`)SY97C3rn0s;|RmiP3v-#FY1VwDo=J+ zV#etV$X&VULZ!U?{=43!zbS#X)p zKfu2jiON8_y(RQ_o@-%af-q>S zy1OVdAgAGYRV(xe?zHM1Lu{3JDjry#GToKNkI6$3?^2v`GMV)-vwvxNxvMS~`g+0p zRPvH^*2dOA4OBkjc8tNHl_{nx`(Y2*{_B!^VYbSDB9=E#ppxwl^3|to3{KT(myx70b|rI;WnDHAg4Qyqa#OOm`_#i&*mHG z(axZF$0~f^A<{dNF|M<7V#EAdb3#w0MV5z_q}AI?SRLn}J|*KN=_IT06?`WHJ{|G} zr$5?&PRPx6S4iO&D?1lGKz1euoEqC-)A51n3UH{nIdAsvmX0~10lX*Q^}Q-A1Jc|0 zdmOFl%aLn*uVX6z6yZDzDk$(XMky4%;V@4JWT(W>8^9{q@vEb>f47oEz=QPY3Df57&cjT4i9#m4C9uk_4C z*T?AZYN!og=Zn!_Jl)v|I9*R!lU|dYit%_+?v0Vq2JXepi4-o%yE3w9QQl>^B7`qs z;L{5fgL5R*{b>pBrSERGr^)pq9{9)`k2j_5ZoZ0CT!(g1uR7D_1Ojt@$4|;L?)x0( z{XUMhyi1bMwHE2D$K9D~%i5PfHH4V9&!Tn+JT& z-wR*)+<9o=RfJ{ky> z`$3LRn3A?7a0H=v6MPh9+4*_^FM)+FOjFygDD(f!GoL@`32#Uo#^jPERsX-e@9zIqov+5y825Kk z=VxL^c$dX@d>`TZWG&{S!+X~a7*1Vn;l~14-vY0kC}_1&}O_QS7*%|!`(Ij6}aI*j#4 zTFepFzy9)9zODC&B>I@t%Pnd99tj-Wk~k&tK#jEr!VVm^7IVdi*wP?=-9YYa)(w<* z$nSAJp2w|_)P45^4mS7-R&s7xy(v)r2v?tVTP~_=oCp9XKL5uLES8Z^J{s3Qb~Xl3 zmv=rFsD2@k|5hM0C3*crEAWec*z2vH6h2Ul?TlS~A9&`T#_7$da}NYiZMQY%wd3l? zlL7c_+nB_^1N*mZv(TGP9Mpn3GkKYo0J|LhO{ClLCX zZx?Ft^SpTCXJ@eUsI=3&j-#EP#di9$<`Xy{9u)NV#(ahh2fFHQ)9ZoIP1fOkf5YzQ zzSjc>2c6fBqTf0LfA_s8Nxl^?Nd_Nk>hPQGvVBOhgIC^PW0KkV)_*iZNG9pmB+*p- zY%1AJucbo-oF?V}GY~r4-goZ`E0W%XYbEvJ!+GI?G^=o_efaf2;q&-~y@L-8wC-i# z`n)js?3wIKzN^!pc;JrCgU{OjgwfcglD5Wnks$5CLjRu*7xql7Fdo+!Koq%BbYnj4Xbs{O!6UL@<`OD1H;jW z4%_qaz$RP_yX!bk7S7^~;``L#@jnJW!jaTjk75^Xx&@vP$=oe_Y;Shjo{Qd{-K$+M z9W~)ys8^B`tx;(QeAeW&THDIL3<{r}wlxiMAwArLTZ@hEXZ)Y<$s3xT>WuzgzS2JU@5pD6bSuD{x! ziBA?pG8W|xjioCNz3Fq&Rr+VuXGHf|D1}d1m`OM@51>k&NCEeq(TG=uwq` zGr8@9L+iMQt2eAJ9q-R`amIm%d}Fe6MM>qYC6x=xN=uejaS&r6IJOO(f`>LYQ362} zUUqnFes);w0Q~s70el?8-+u_>8H*<$kK+au$_#N!_1ap!p4Lp|={9`|T# zG=GEx=4#}`XZ@K)88r#`C2AiF7^V+Gd@;XFO?h0(0!@N-fzUdC60AuM6gxqFwX4f3 z0UP4K)hs*-Z=W^O`j!4T{IA4)c^5HIf;GeAp6PL4>T!GHUtyJMdPgO{AA9mU#}ofr zkNbL$`zDXO$m1^YxJy0ma*unt$Gy_}J{ttg&+z!H+XXv+@Ld_Jf)hL4WF@Ut>Sdh6FPi4=#%N=ISl6I&s6xWfHo@zth9- z+aCAb9(SGn^TCE8M;6RJJ>mCy+~4)Mz4Q-w!Z&-|4|&{P{r%Z*-xrX0xaUb`@Kjv}2>2bg1asRi+?d5mE{zFW9zxU94-GA_e|Iy?2 z&fosW6aJyc?VbO8;tBW8CqDOt|J~#M!sGs@$L(!DK2P~2dfeUS*PifHkK0=x(mdh4 zeNPNC<;!U=e;awG{*LgwpyY2OAJq=%F$wQu&C>GW%qRoDLYd@rP;dwEH1Q7%yQK{5 zPVhI`9K)c?HJs5htp5BMVAL?^#~$~|GfeQkurjQH);3L_zN9~E43RN(zo(el%COG1 zE_R*eGW@5?&&YR*T@o=blGo z4Bfx-xMz6EC&!~N-w-FZ;kV4IUsnqt|I5_v`?pobXVX$g)o0$*>->`e=Ki7#aBG>=#Be)EMUPW0j9SbiaHyk!2ml zlVRa|RZ4H_$B(UIPyFE&RE_A%BhR;$-@Ty8u%5IAD!q|skG04{pYCzzY5Z!5|EyK0 z;YOaHTRZw_;;@*0QeWdf0xQFM!8)dH`Z9cswy#$u{8j5Q4h%4C1{rwatTV>_3#&H^ z9wr4(hV@IULDyf#{VRMFP=e(T`47|fL=U=uqv5B3GpskP+eR?N7=}Nk{OCjX-!%L_ z;0)`y)u8<7onigX`i-Z4-_{EOY8d}IO)p8>`+L@LPyLzVNv}xLn}fI+)}O79m7huP zL+c9FN0NkpZ2dMS|9`cX#<)MR9@O+XEM!=Jvwo!fjr&vU$}|MP824vZS`7W?R^J%< zlhzMa9z&1cW6Lt}O?y0L{l(K>|5L+BMSZ-^h-&B_uIo_~KgphvV*o78-Ouiuy=(u5EjGFQu)}7GpuyGO6iw~`%K$E5X%MfE2|6_IE0i0o7Vej{pN7^Vu8Q_w`Cn_Vf!-WL z{_W~s1)O1BZx?BO_=UJ{vcIduroPRyOVw@qule>%D*rz*kI1kV*l(sQ0W9(#pz_m~ z?%(l`8p3Iw`PgAk_(2{2KM?-6*x5SX%|l#_m-Zl?UvXNTVXd+U>U`$k#J$#@LB*>f z>-Tj&GaWd?`i|YK^6nLPy**aljpDxF#_isyVSGEsI8A!rv;UeH4VL_cV&-Fw_N=a8 z3IBzM{vvivFh@`h8CJ9Xh({kIJ@u(d-D43a!}_7U-y`2Mp7;aQeVx#6x9h_IFzgmH ztRLIEwf>s=`4fBEXbF~`{0wWSeL>i`4gD_rC^HUY=%2FZg~h4-p0<~0e`dn>+HJ#4 zIMtS6J!=ow_Hcu^_uJ!iJzFX6pV`0F{*|$)@4Hk#EfRjfeq8CD@H&-esf52`57P9F z`#?;(12%G%~~6zsn$ZiD@W;^$y_fg>Oibnx+ zmx=ykfuB`80hqf-^v?t4&JVF4_*aTEfq$bo8~AM09nu7Vhbj&N=PUjMxIppez}G8| z0MAo=AMnkJ_W@TZei3+$;%k6w6wd{|SMgiGn-m`h-m16)_(zJXfOjcw1>U3habWi4 zlz%etA;tN?G&b7#G58@^@H@b%iXR82UPwcK=AZZ)VCLWPr@n|w;7@%y{$a)Y;XlOX zpR1T--6)qo%ZYL6Kf&dn=kjMB9RB$(|LHFOSuX$CikZi&Tr|`*`Ou%bc6i?C@}KYW zU+D5*;_@$ZVU~x(hvnhm)h>L83s<}FJuVz^;rkR*x9eU0n-o)54KDwO6<-PZCYS%C zidhz|E}F*`lg~~Ue#(X06tfOI=knj@@_$h=?>96|&!NvHK4|C)I*E~1~ujbA?f-8x|-gUP}Z1g0L&R!lt%RZLwm4bo62mnml6 zuTmU_eZ6ApYMx^1YPn+O>u$x2Tdz0_d!u6Jw?Q%UD>_8F%&phr_%(R|X%(OZb zGc8sx%A61TxMG&k9~DzKl*8#m!o=D}IJFI;VNoa41u^Xm#fh+)9{s5k>7#&Ym^S?> z+X%&^mHq_&QN00&;ZI}hI*5E7d6>5SHbb@FJ8UqrWbx`34Ru7!cwbY@cvmT=%uL(< z4gSDLevb>3w4Jmlb4=c`E+$XOJ1}`l-hpW(@4yT{2Tu@~dKj*l;>macf2NtQ{$beP zRLnG`o`8n@Xqbu%zMCVRl==knxxC3z#yWr~Z^@s$%k!bU{OYCF)Na z#<6wXBv%DJG8^#gt{IV#;_#G4;$ULY|cCL&cPf#(vk>OwWGLV9DeA1~b0R1_2}aQk{!# zxqyQS;|T(j$0dr%;~K@3ZN6gWWtC#`UZ`Bx{wG5dCjFlc&Lw8Y2{Q_hGcGV2K~+dtG4nD`F=dgq2^z|BrTSAADHr%tmRr=H zvV2D|*)}Q;!){T`vTIdLx%McgTr^I*lXB6vPdRL@SCqrvK}yrEocbv``M~&#PF^sW za@hZ4aG3b8!IZ1&S%lb&4s=HpPs0LNR5rY!jEVoUJ$v ze7?)SP%&jJS4_FMm&bG|7xz<%!@xB5hsLHH!EhIL=n9zOH1?;)cGF`Rwt^&t5qkWI(tl?Bh5i+T zDMw6NLyW)l55T0Iizf(7TB(QXFL6&A`V`U(HCSW@W?T$2;!j#Pz35P7NFWV6Q5cyM z0yA!ZJoIP0n-oWN^#wd&Nax7UIuSgVzBr4)L(Fg*`=7=puVAjh{A-UkI0;se0|<=p zbhnF_jK9dd%U~&Yy|O0l!e>i>vv1h zTK$>MeTtcmv*Lj9U>I`sHZ^FI9{NHIdc_}p{H`;V~$RFx)mTUBi%Xkd*?4G{lra`Ve5sz-mN)@}c^ODf1Ut1MZmgf|QVbj=?jV)!AXR!ERWw4YH17Vo9Gwv`AJ7Dt5G@QIM z4X3=q#E0<*=1e@niv(KJ6jSEeikZ&Mim9vH6f@1o6f?~uikT+6Z}McCpDPZ-78%^- z!p&3|$>S7(re6YPT2hyQnU?f9z?5wio*;0vT!1Nqv=Ly&y+&ym_a?=pU!a(LRw`!P zh+@j$pqTRRQXGa&V^1}<^rc@jSp2Utm}xuhh-t@^3ooz0Fb!MtE;>0Z-f~tR%r{u_ z3mnZaFy)_shcry*QpHTCOfmEFZN*Gyy<(;#@|yaf;AGJTqux=jW!OwZ=wD9jLIZmz>5;|Wd| zDDjDz7UdwOY=afkFIRCGcAnxPuvt{3r);nUQ?{!VQ?~hvDGNBWJg~aMA}O@?R#<$PXNqADHqN;Rynh$5zFZd8cBg^K%yl zwCrd2SI?dwu{nDNjBh(F`WSP6gPJJg>%XdFJGpR0|ZyAFg& zqjg{i@hBrtF7arCM-d;!ADFZ81lizVhTsRz+5Fy+M1B{Y-`%}g+LQmB}^ zk~Rx^%5|6ehheuWrd+Qord)3-rd%}kc`kj9b?H;(XBxq4gw*tJz?4nO8kn-tIQbP_ zvB1^X6c8o}PmqGcFpkrX@`zQ3lZmGo8S;t0X7F_4uNypzSoJCObFS$}C%``lOe1;& zj>-wlG+BhCp^R%3Q|B^H!9NHr^$<7{c$3mlw_6m4VK*tJZhxdW7xv?dsoUL($HJC& z2cDGiJ@wCnEo)o&GvB?CJ<663EbClg=5?g{6Vt@#^9JK5{!@*9m}h&M!KuWmTjtr( zA!Q1F3x8np@enf}k`zqZm5RxO#yO)G{ya2>k-q&#fu?Q)Gn~dri}8auiI@CwWD`DG zrZT3ZA<|FUCL5(1d!{R2N-ynbo*}pxRuDLv?xo%7L!_B+=*KH2z4WEA zb#es=VHhVy55?jw?I#FKJxKosOny?nz|@1}9hiDxbtFCYz~U#S9wLgV2Wgw|4+C#f zf9gTnCj6;~CiSNteyo^!Xj4piUsFsy$ejwrr5-pXWxAy4Deqx~+4`Cl({{!krtRo~ zat9aS56oG3h^dDQ6_fWhim3-ADKyl>62;WRQpMzVt77WmL&ag(T)LA#Wsy4}z?6k) zIDIVBaQcBT@f=fjrC&3Dq7%cfZY_Q}@+bq*|@;H|G8k0wsv3;$<(}}rR2s4XV_d0q32RY$| zk+uw+2#lq*_%ltJ&%mE)vfCv+{TYpzysH$G_uYyq*9OJZ$!5jWNt0sgM8*;D2?IZ_ z{-a>OtC)HEK=BaRe^s0dTk0_4GOsdr08=(jk0@Ihn8Q3V)4D+MWMH`q1pho>c5S4| z2d0V9f2r|fe5XGQ6SKpBp-hhcDU+jT=E2eP0N~)w_yZHhLrguBo|w8FqnNsyp_qB$ z6x^Y~bVo3C3vmTgu2qV|ud^7jW0-hw|c zVLZf?f0$y*$u#KCyyPn;Kan5)5-Q_S!( z#jwQK3tfCPzrsg(UIeP(azi^`G1G)9#h_%ios)vRsIRYKf@oGd^|QA9L#h)_98={0vv=;%wr$L%p+x`KaI2(;4rYv z-+;-3Q##Txzm1BihsP8%{nr%-VZWuAG}5ObZXWO@5QTh1KZ>b?{fe1yzR5`%=KHTM zob5CI)WKNAlYu8I&Ig{WnEd6gAox%QxxWWY{=ZQg>hGV5nb!1#F8(hlrfk%geG-3Q z((nX1;KO9#A!ay@b56%N&OMeeaVatZBjxyAfu_ znZfzQf5IP_>3HmN<3Eddsll^}kKqr@Re0=uL}qT|+@F~Xw{vECBeB-Q`NSXK56nV5 z&e``8;=}Yc?bJD2tbp68x0E@!niRTb0j7S6@X$XM_RWe}ml&7+0oYB7S$|~Ag?}cn ztkHm}S2knPhhhIt@etS)m;TgoFQ|Z+^+f6(@K|6jSLiks%)_qmFx`)?>FpKmD+13#hoD&RK7*8u;g;<>;<);;jN5qO;9 z`M|Rkljkjp7XsHPCZ7isv#g$S`L`=Bga0AL)O{F_eJB3FoPj5Jn<=kM#VjwGXTqQ5 zMO~AI<#nE7me&P}8Bh8R(9lf9Lwd?QQ*jtJjZhSO)Yb?|)NF`OyW4KhvpGOdcB*hhaA;W?sLqI2ZP#ibuhwvF|pv zj2(9wEb`xDF!{#x1KPgG*U3BiI(Gue*KWffn6Y@Ab~=IhY5Hn=f6Cxlu$*y$`E|yH zYlwelXyy{@STmnk#{$u3wb7f5alq84%%gy5C|j`FlzV|<>h?;-)UAvQ)ux@UR{uQM zGDg5ZA9yz&@|h0%GsVo)DaAL!K9_B(+SEsGbrDa7|0Kovz_R{@KQX&J(p&|6mtyAo z5yjLEzkom*>gKnK$@7$A#_h{?2O7qe_6y8%o2dR_;Ms~P^IeKbbH9t`r!N0jT>f%b zyjuGuwmV?TFi|meQm!}*{5{2#?MI4PhB6*ioA&pv`m?@#p?EBCIMMK*4}7uWFfa}4 zD*Ih{3;qN)%bWiH0o$*bGyxYDdM>bFgkI~9Lr;I9KTKq3g5NP%>KHJ2Wa6Pec}!7E z9+xX74@pZuBf_v?E&jmd;&Jdu#iSJ(RJI`8_PzK6!?c_>6(&X=X@=l&>OXlpV_6b# zkevaH$P7&WsiEy=&Si! zZ?NPGI1$cKc!I!8e}-c6zD99A?4^pCuPVjN*IkM!<0i#S|Hq1%kCzlvZ@*U@hW#hS zLtuZQm^^ueOnE4m?12D}1(v=YI2V}P$D|?8>lITstVZZyOq^Z)}J#z3>Eq8BcVpc(D4D2jwOWdC)lgB`r=Q zVI-{@gC(tMS6ZBOz@*~|0yCcUEx?Q?brLwrpNfZ(`uu>w{Ohzk@n@l_iShrQ@e~=f z{;+K9`;0sy!-Ixq0IVP|xN zika3$ikZjhikVKOVy080nCaZ-@&~l+XZcrUUT<_FGCybhMGq=7({Rd5@}lJ;Wx>f5 zjO;l8Q|1wPg23b_^Il-`o2CBbccWtRqxnB3&%=hF$O9ae2RJGZa8w@Ps64=whjE;8 zkvg!|@H_`r5SZaK_9Mm?z5UQ&(c31YPtn_tjK5oN{oob+zVVlK1Wca0)StBfrI@^b ztC+ky6_YoOQ!XOIbH-0(&@vSnw5&x2t@Bb3A2f1ilaJPa$#09{BYg`nWgCYl2+VXQ zC}ujBC}uj}aN(O2lV0W$h|BcRWe6XpPnD4;)2HEDfP6&%z%4hMG_O1pdHCz521iS+Ih@GLEn#GET0LvZ= z{HdGO>OTtje#O)Wzo^H!R{_iW$iUYCKd$~PlS7L0fn`mnX`NL6x$x(g$;gL1&rnRB z_%R#tpAYV>!`ZcqkqQf0hURM*_1vh%W#RE4~Pr zx}ZPlsSAgGlw$H^nbDt^W#iDZY#e%)4KevsM^0Tm1335-{DG124%iPo5D)z+J7pkd zUPmZqUdfaGLD-ioCjA`6q$yI&xXTqY-|H2V9z#)-{|^*1?k>gT-=UcFM--FiuN9O2 zeZ{2zT(RhtWeqvQ@JmyCBXE}Dxxi8nLBqUWq5iqRGPi_3^*vAh#{!oqo&YR!PS8-_ zcd9>iBlA!A=L5@o@xY{SQ<~|(KT|vl_<-Wsz`s^}4e&dP$^Uc3WX@?cjFHX^+L?FlJEp~;txz; zJj98xWljQ|3LI8{KkQ+O1F$bv9E3epaVG4`6lcS}MKNjCDkhDLS>R89G-FAZ{(BXN zVgFq55ZJFOWyb#EB+&F%Hhz9&Xt}r(I5X!+gCinMW3gb{8^R`|9r*&1ADsS ziOB0L#hJjfUHB@+)WJ0_JXdjF_}{3wAMkv|gMb$*9t^xhG3m<`lfFVR`B%B{Y8U+- zF8XT4Ejdb16I=}Q>2{vDhR!jSC1pips!CQ@jj32sG;d+aig_zas^;BNvSwaI zQDte>8l@;JttzQ3D(i`;ytrgxRoM!O&$#5_#E&v(z`~Ns(p!tFN|!AangvA_MGGXA zo~RasQx{dNw3Q|0%Wf?ZVHXxv70p{zxvYF%IXo-liG4b1NB;7P(s`?p?UH%LrAv#z z#vM>uQnWDYUsArH!bv46`;wv+OXlI18A=y9L2kXdLq*w8MM)*nE2^k~T}1XVk)wRO z2f6un4~<4FFIo`G(jCtg7)P81%PQ7TwcaY?@pm)y1VyDlt*WYA=H}*()jc#C(NklV zt*ok8DU~x$t^6|Do|u*{{mMMMNaN_MWOc=|O1E&)1iOW}bMFd_!?d(K%G9Zeq$*iZ zF|UW9N(8%tJng$%h+7m_U>s2@if$>H$JPk4vQjkKc$MRHMDCMI;E+!KLY;+|-tS!X3FTDovv*|G(<%&V#_TDk&50e-25 zLeE=KwybL2s?w?@^D34hBTo0?PT*gOA3yPbCBe9H;*`gN(uyVMwOPcaw|46!;{>|1 z_*EiDYgd$g91bx=RDu;pRHFFiyMiDD#{9w0~@hPIpcgbfuF?U>7U>xD4 za=A+@%CuXEo2e@>4pW(h#bw$p#Ld(d7>6mRXmNRZ1KcdT!s2jrm;H*WBDROqRx+iD zExb5PgupFDcbYiTbd_;WvUH<}l_Y+!TMjQp94WMomn>aSxu&A04k9+xoq{KNoCKth zV;MxNT%0gB^O)dxtXHflFE6R8#GIg~1bU)~Nv1ndoWwMz3rkL?sMt_jz z(Gbr>Y*lH6S=e&E6lZXa7aq+>*F=6^>C&oYMx5@QqJ;~)`K?%4EPi7aEJLe7 z1drM)i&n`jwPWPfH#r?b4;CU7FxhadG9c zmDCTsJ^7V(yv!ZsPS_pl*0xEYq#SeK7>$=z&6C3DmW+&?PbPXg zpwxEMgXjukg|sBffht*gTUS$Y*v9C(sBG~vZ0am2pND;x^3p1Y$emXygdXTBmvMVZ z_P%-`ljIx~QDRialFG`J6;-9hWhJsmC@)$)Z&`(tbX2}CBXrC7WwbpoWrq`+de2N_ zXrsA~P1xZTr|P)}eX?4*vfO04n}SYHN!C44#7VYmj6Z#%r=ug=_~CI9l);8ezp|30 zi>sD&E7cyt-FokVBwB`^R1Oy9$c44jXfggULujv4S!+&`kXB=T!aYwUk8IA-iODZ_b zE;U(m=bvPZz~x?2cNJ4z}! z5#&?|$4m>CmAhMqo3tB+(+ixID4N^oDN9T$4iDxsK1Gy)7L9ZekT_1~5T7E-Ko8wm z-A}`$XR0WpsGwiM>U4BbX5Eegzk+aG2bf;sDBJFh`ZRg|QsNl4uHzcBmiZFSUq6Iv<&X&%0&eqBtu264Gcd6P(HvV7icC6&uW zfT*-)4WPSZB^9M*%NDPMfSz#E=SPF%$Rlk~J6Erga-`pQC4yE6KzqalPexktW-Tx zxK$d5D2_y`%as+}c=XnWc!BODV#DKbm--T)clRJSXLo2EzS7;t=i5EV&DR|ohcByP ze74;}++4c_Mr&}i!QgsWoQ^6cIF39fylmN0C$fjJE5t2N&(WNXjd_*J${e2Vn4a)x zay_&};Sxt~Z8o|F^H!_4p>8QW1aT6O%H0F|IALz)F~Lqhyax{UK(>ZT7lMm9#MHgAvQl2i?B_D4)(EbS3KJr)P;o=u zNqY#KtS*q723~F+In7qu5_D=x=w{qAEi++?Z44q}K2=pz40}yE?KnA%Gc7W&H%JmV zjkd-VuUIi=aoMtBY=H2f)-#5eELfoD{>v8eWDC-o3b0^B)wm0zt}(M$;4_TcOGNpgiYUJ?Lb3d2A@lEo#xah3pMlQJuLAr&0Ui1A z8x@XxUsw4Y7Gn|cp2JM(=)A}y-@-f1cgV=Ex6)C6uc3V1<&gEQ%ka>>2fFXXq3Z)W#>v;P>}vCV8Rg@p_Dc=%O;-??O@#^HU7hu@~^E`F?E4!>z0eh-6Rs>4j_=$zu=*HqnA zU-*p*hhKjWzem9jMHDrTd>I~oZPi`;Q1nrLA3~XK{T&0pu~BY@j?O=Uj=b~ffH_=k z=vW?n|J{-AH4nd3RQ7urL5(BdK@UH^__-c5lyA7wQN9~I z{2m8CewV;8j(pd8_$A_H&JRIEej{N!@|}d@-1>V9o$YjonbOhu3FsInpAMK$z;6g_ z^5gd>9DW@he&ICpJq5<0Asx*N9)6kkpx#3e@;eXV4!`|5vGR>Y=RHI?m_H7`=RrrD zuVG@XRFxHBNqS0G(UD#M&?@e_6Zu#!P2ModvGo_>Rm!M;ud^%vh0Kdtw zDc=m(4!<@Jzem9juYgC5Bj1xAetD6u{LXaoJLKuF=AvI`y?2bmufx+{HGp3kh$!Es zupRlDJ^Uiz_bZ2)($V>_hhJiS*Z6z6(y@G}g1=jT^U-)mk%1aVK7M8kLekjVQapZg4!*8F9-#0<+KE#GV4Hw1hr z-?c7&dp-Pa1i!ga>ALd%l!xDk;OErm>s)435AxjsI=6f`y7=AX;q? z1ulO1!(-)Z>p{MYLFbn5IQTj3qr}B;h=<>c;5P>0jv)`4vpxL&?8@(Aggg0NKPpzf zPrwgdLex0??ggD&zQBE5^{>>$ugb$O5smHUC^y4{&Sf5cx!~vM?-m!ocRl@PjB(FKYUT>M!79rUa;a6U(h{^9PvIQ3_J}>$qNS&_#U8Y_Vyn&ndDg6V?{}}v4*2_@ z^XUtddDmL+`mT3f=DKFjIK0UH$>aGQiuW1@5jOS2`PD)2qz{M{eIM+!e@nrOAf5i* zY3&%^;qVTD7uJ4HI=q#NcbDQ_Js{P;O0cmZC1RyVNAOSmVVCuemr=L7ZG06+28L0uM|dXzk9G2UXH_?0$zi_tQ~{C!#k{a zIJHdhs!)jT-^1XAwcquyqYrT`l)SGc+mGdoe{qL*6g=*4MQBGkA9mE^3_zlacQ3+B zV>@lceq8%E2{(^~f#ih#AnY`6BzVlv_CwVZystXEDd3$+kQHGsb9iGE@9VG?|6c8z z>R&B**t8NNyr08P`!@l+aj>F)>#!EylMe4u@P3(~1$GQR?(iDHll{R1igyf+r`vB4 z27Orn{s~6fzoX#E_VJM7{inlQ4x?Fg$cohWHHVjlMibr!*h+o7L{t4c45LzkSvv;v zqN)D%QoN1Uj{W_I&!_V8dU)PDh!+w64#SRm+$IbIZ!>iE$0Jyae_4Z4c}Kw$2D6IZ zHZYZU5Ih-w-&DLKutU=%_NT|d!={=L;r-U(9Z|e*!&>~i&lxY>PY-Xu)y{bN5Ih+# zn-p)J!y5%&XF6;}{JYuVja!>MetZYE;@=*pKgQv>SSm1U$KZ2Le>?@AjF<0PJGSS; z4sQ;4uM=QJ{CmjZ?E_Ex_i@;Ye~&x;5x2)hm)Gp{$0BUB(!X02ufgGs0Wa+OZKcDj zRlM&j-kq`3@iG&alVQ!J7jk`u9Vu z#lIr#+YMes@cUP1IrV*2wcoRf7jbw4z^g^N2z{dDI=my`Ek!)r?>VfczLz`oeG)ujkR$py zr@qs05R&%Wt$0Hm-gfZNgb5MeK!-O+@qVg!pL9v>k5|FNkWPs3K7t+fxJ_9Ko?LIW zAdYGD_g4<@D0r{gJX{Iymkw_;c+-&1_IttFkyoFS>L2%qVaMOQVW<7edoa0u{7msK zb9k-b4MDny_&3(!MHTO57)yQooto<3C*X0vDq7-I}BbvK~{vf(BZWz z-haTBcI5xf;T?-6eL`}=zxN&98;ZyACA|F(??dpy{A+c1hZOG@ikICjwf*=3mRzKZ zNPX8Ar`qMEvHMR{+DB##FCzu88)kK`g!dZksK*%zIST(qVa@)16KkpOGY)SIc%L$Z z72)l4cx4YI@5jCcTj4c0`};9{!jG5Lj@?Yy{YDD4JO*dNPS@i_lq=^E2dy1k^NyaC z+Ad@IhTli}J?u1Z&Nq_V(XSQn-yGf~@a{vph_uVk9NwegNjo2cv9!zA^Hcph1fDR+ z6nzcssK*%zIRGB($9{VkYvIjzc!$A*D+v+aEe`Ln;vH7JD^N(vxGD|WMS#M)1a{Qp zHsP46?|&nXY4mrX!{c>nHVd#KyfTM302e1XRW$WIg0=9bpmN&3aX9F+91-Dt33k-u zHsN{jN};p;{)n~khB>@R;7zo7xDwuAhj&Qvjw;?CI;Hxz89ZTV-eK4=KF&x;R%5b% z|I9EJ)~nUwJqaFMNrkcO;G7 zT2w~&+cDUM9e}9{d=n7eVmtC-+kbf3Jh!EeF!`1ahn!Z zJbu%jY25GL;`GNc@Q^hj!n@Jwj{)FG`|+Z(?rz_QrCBc1C@o(GHx;SF`JFI&Nr^SaL~-sui+DR?W9 zF2Zst-5g%lBRIE1Jog7N#jC<~8MDj&Fe^Ds?>!)}RIrW`AFnoS+tyA9v;7R-On-J0;%N*W=;Bh>ONPQPMJboK& zrS-4B;{C*_@Ag6A{ypo|w-G$??`*|uc6bND3-j-r4(|=+-$2FN)+4olj}H#o!maNU zuw&ihHet%QlKa2Gig&-m`vknO<6FJMo2hseiZ``as(-~8RO7`ttffD$g`M_qK6sOm z&hau-@h)iX!!AMKJ2uA@lDC&?}dtYox@uR-kBl(O?G%w6z?L% zyA^{2!9@Q)2_7zm5+e1jhMo3rK6s_D;&{GT@vd-qd%#~#C(eJ9z!@~j-k%P@!cD0sgJ;SF|p1HhXD zJ8o|`DE}G|hhSp7%pVcHzn|gQ)x)kg;zXofp2v2nd7EK3PK>Y?yJujh>)QzbmLi@0 zRVn}0IlN=w{WCKO6yALfui!D9+k!*h48^+e$H03pr2W=9 zyhY#hyzSty{ccgbu02!zdoUi1Q*lxH;}qCw|4KI}+i$Mo{f~3Lu?xJZ0>fH(e{{|_ z%E6QI%x`GYj@!rYaWF$L(SF@4!_PO~g`M{AQSi`3roIal@23uL9C+`-PDK3svBTR3 z-dY&3{T3=-aY?Fw14bw7NT%>kg`M{A`Yp-!Tda70bheLj@Je`E&D#!M1a@q{yA|&lhj$-%V?ua49p3Zcm0I3C ziq}|}>ffv24G7^q06Xp9A@Igo-fG30mfp) zD198>i{MHB-m7>y4(}j%8v}&-D?H!feF&Z$-|knur~9O~-_lFM&rf&2PPgBjA0&?- zUst^Q99}(m*M#`D+TpDPPwKl)@s3AR{W}bv)R9=x{{lPh-&5ep_Gc}{)zfmaG6ZXX*I??^1QzGdJo78usT`z`EreUE`B z{ku`|=nI00{Xr9W!XQ?3?5;9M@lzM-^|2;@urh<*fy;YY1=4;8eTEU?*kKT=d6a zr_0@kaygFJZ~PuP(-^+p;cW)*OvH-_Z?VHWpm;w}yio&F{d*NWoYEvjc!Q&^{))P zuzF0zMTD-$DA=40d>VJCoz!S;gDgKh?k4;Kk^e z74fyKSE}88utO0E5xc&y)AcAuxwPZ>dtQ}$io<&hyqW|p*)E+N-T?4$NH;uwvz%qI zf1{mK{p)^Z_;%hCcG|y1;K_bykK*MxyfW~v4e`%+c#kRGUd3DN>~~j!7Y*UfclNt) zfHw+uY`+&3Z-T>n47}zL-enH2;D^cUGJfY>+V88*_Azckc>gYQwvXlDNq@8|UX{a} z2Hve9{$20zUR1n)Q@mnl+`pQ}zf+xYA9*V2-#*3r$noz;8vj0U{F|hB|E_p3Xa6^4 zV)%7HFWBkv_b7O>e|}Z*vK-zt@P>u7U)z9G-e&M*dwX5+ith@EXBeiga#ozf!ypoc-1IFNOE-d(Qr<;OS(498|nr4sRED z=*onMe?N41Ws3J}#oJSs+J1+@!>&Cc!rS7EgMvxn3;4QOxxFUm6>F_>O^*Ewv?;SPTrpt zZyIhkBbexqgWyd=SVVZ&!A|pzfJcAG<8RNH#_(W=H|iSvZbzI&y710&cpri{40hyw zpm;-^`zi(3hwo1ZI`>t|o=^72hl8yN3>*6QH^rN6{gWy_ zcth~KfXkcV_*c3c&-sEw-f_hnU6I-!-M*4UmfOo$* zhqctV*x?-lZza;{-zSQ9CH4mhCdSJf;IZFDgm)?Iw0|>yn!GRYPsJ;Dc!$7SEikNw zcecZ;2X7S8>7R#%cJ$*ZDB8c-xap0o2@&2lDAeON=aoKZ6{?htLPcnDbfx_7}*XU?`4QEjq=CAsdi7N zvHO!9FW4O!c^-D$?~1V80xTa}J1O@l?BZgCwfJ`&#`HlL1E!_k_huTG5Bdgcs7BUK zvx;3wJ)XqHZsz#5d5ErM(uY3{o-a1z0AaEFD*O}QXh+`m9zi;?82?z0!9#{rM3t1c z(}S4d!-koZ5$6sW8JJAVzw4s$V|`yrB>O9g@_|m=fE#84Wq4mz($>qyotg|>4fwnw zXfMNKS_>Lqb9bxF1D&+Q(f$yhIMtZl?^MVw@ip+?cLP4 z!t=J~?9Mur=dEaKgO;&B^X+Ve2Ify5eae&_$2XO&8~M)c6$f5h?_d4!>dh^yf1KTC z+if{Ry#3j?-`5-~-r;%AoW5j7TiY|Ip9g(^muF7TSXJhIP}TLSs-n88!u3@J8!PH! zg$=Q~SW!b^U94+^U)M6>-pwd(ckbJn@8x`&v8tQbr>g4*RYiM^eZ%_=m36U#hR|%0 zp2)aA_r1(db6(2zZhZEFy;WW7s@jwHcX>PKy^Nq*raH41OdjIb`B$%5-HP7{kg!`ZM(hX@A>O6q#i2R)YkTRkLpeMnRbssM$f?S_TfcCMqO8LU0d7Q`U3pj z&=|jWI%2oxAp0&K+A7mcuGQ&|)z+N-S#Pt*u`G4j*i(qyn6crZihFD550lJV`W@l> z^Cy@2D7@~fj0v@W9rZChs2iOd$s3r5W=S*VhF5y^8T7MzPxH5n@%glSo8f6rrWdUJ zV2vW`GIG{8{nLPRA{mL+MjNK#OY08zvzEP9jgh>nVMlTV*TwGUfUe^>U(rxi6RVxx zGVa7891sU{o(#RpHe>v*(#-Il@;B@_zi+^|2!M z(Z-BbQEwBwY@qp@F}9y~RaIf1s)CQ-Z+NGnqW*o3?gEbPLXPfnW^|+RKd36Kt17tW z{r>Ot4>iJ1nKFaEz+Y@})3e}B?dm-ZIn6EO(1>g_8!<4e_puvy^$m*cuS(ka@-g(~ z+o!yjx$0!@<@d*KRgd&flbt z%iyry=4323c7Hu17sYrUtBNc^JJN46=uXOaJ)ZlC&ne@%9o#g%9n0z3rpmj-w_D6$ z(>lRce)hf1A7D>`%{#-pczE|96!`yk_IvECRXN_pPj|wwG<&Sx$AbE0*?l$YY8tMj z2>Y;lzadw)u8!(j<$aKm+q~_zk4DVg)dHt5?b5x%ICVPp#><}dO@+;X3B14#S0Z!v zpGvnf5%KgheFH-}8Z`Fgd_R)ECA%&ox6yCtv4n9CKaDL6aoAHUe zL9mD-X<(3Z>X7mw=ai2ea<0AvPK?X~bz+m{z2BBdfRc%Sd>13-RV*3iZN(;N{$!^7 zx`_6jl8MkVJ=_pfl4;)ln~cazxl2rY++b3YY2GHAjL7sppA10DOqoq$7$-7HGVwN0 z-rp7Bxk*G$qM$Q;nG+uDgl|zNJhbPbjq*h-MP3(k{m1YHD5nUA#UZLaY0vp~5r$RJ zl+XD*5vJo&l!P$6*-0OiNDch|v*T}$+Uqd?X-@bpC;!JzxX3B*1{)6QSLp4s?SWHE z)VG^=svRGtCfvi@rX>`ZotUHqn$5Or~F9%PTYKF>i@epYJ>2hn(Mp1=EePKq)L zi*E;hoH_vz`dZA2Ko~`x!9G@Jy*MryPg`yq)LE|)Rv(Eqw^hc|_9Ckf!1{8lv;3>A z9>*HD8;pG^*0Ze6yti1Lc^6upb-L5)tkZg{v)vxGI-BA#tFsD&N8EZ zz+@fGI0T>Z6xoirxfQceD=G2z@MPNjjKILO`I&)EuFsB!&=0AvY5#l^ZH{Qg&{;>* z{?J*RX>;ggRA8YE+2>oGJTt}+&+?hyKMQ{#%%4)0J!~?6F?8B;Q=v{<FWC(H<@f_JKG^+|@qrBh zF+L0lbaa(h+$GStqD~)}jXHhc(5KFP1FTNoc&oF_DOP8h#)n~0AjXGt0^Rs9JkX5~ z);HP|pAy7#w?&;kaQsoH4;&WM$uNBfo%yb`@hsEyBjU+Ue2rzs>?-`n*EyE)!`k>3 zNFwE?8FSsJ8ObQ~9W?!A6Zz%|KRseThf+0tUdnT%)K zr$o@JAY#^B^ivqXd`D(sBE@vyqNrgXpR`uI?n-?4QLL0((yI6b@>G2IJTa)~Ou97sZniP= zrSFtn$$gCd+M5)~JWdpgX#Y(($&jdTib>k~y6mJQDc=J#&CXAfNin9;8PU8#0s7noRI}TD;B2EOSN=7R2m%1d`!)1_&zdZg? zp26bUm6?>_kJ#-*ka|3b_735EW)gHB=IIa9c#M1ii{@RAFs~s+g!eT>Xx=cKpe#ik zc|7kD-sOO6-lGVNLAr?W#=%bWo&;|ijL73Ti13CwyhGr`XXLLc(o2Mu6W&GEIiz^Pw}r2 z3Bn*#bRTxq~@W*YrF==k?25=s#-LOaTvj(<}WkLT>d`w})5-F|zJ!1G!W z;avec>T#Pe6TEWhY(HLt3vZyqJBWliHV;?AD|2`cf+ypJm$kyX$f@r*^&c)SH!YI!lmJL=STIl^J>_j|(YJIiURGwIS2kk8eBM$7~#M!u&hnY##$~+>-V?Tk(GE@K%DyduSr! z-;W&L_25bS4TQ1ycN-dy?Z>hx{5I6gKsA4v#$}c*SCVevK|={`DEwWgo-^n1m%?#M z5xcWcPDT)A{!Rn0)|P>$H2yK`;30N0JQ~Oe=gfx;4<^r}C!RCUi9M z^SJjQco!D*yyv$S?8$1&g3f=O*X8_f;hrq72uoL_T^P^u#$fSlvpm>(ap;v;GWKM) z^#!36?SUl+OI8#>#z8RWbwB4p*X}YCyN_h=XlvVEU%(0zgVTgAVP`H@Fo>cQV#Z|MHH-p8=NMlL1htQ-KZeJRt6+>VK=$a!^5 zwW}Y@7~Qm|q?@-T8#&B$a$+XYv`gf3h*z_YDm7?3X~RTYGkQM%)S};Nv%DzY=XL6y zpg*Lq+Tx~<*az%4{Pl)!@~R7`cl9vCjRJEI<$3-6Ycd9AU)9x*WEvl;W4m+qXTQx^ z#NGKN&z&N6b8{#E_;dssW2<{) zeZpV+a1=2ORdrc;>$5sZdcH~ToJ^lsmzA|XD_hcYOnPoIy|OOLTc71idWK2QOr}?K zoPT{*W^-1?&Ma?lmfx_V_P)aH^-=GM!rF~~(?;Xpf}Jgqy-j;q$DFa5!Ltq~usdsi z_JKmQ!Q`7eFThk!Q68dK7iFzNw_X@nu!SbC>4d<6Snd6sqFlSPpalbG*`~I(mmkTA z^lbGp6kgp`x%Rn&NH4Ev+6)0@y?ez^i zZy!2;-=3=*r@rF9+rsVf@|>+%yDIl*FP-={hj-xruByq`91HRJ7^tDkyhq(6V?p2k>N#pIbEzx0PTv#(Wc zO?7w`3N0ClY4Y`td3ZK~?b*nOGjOtTZ}UzwO}?KGCP4kF{n; zGD@ER=gUu-r#OzcF$@x!xs~midoz3_FoAc*=wk=6KJi%P4 zl4QjEWfQCMyiysTS2~jqf}GJ%SQG0vJytrpr8Lrc{62WLHS5_ba?Rc_EAf!k<@qIt zGmzZ4uC^g?p}4N4)I2=`>-wsJd8;4HADe;AcS(KK>SCV{f$XXrm~%ny(!$xXDHW{~ zOAey;r9s^<&!1fU4}?Bwi6Vl9T!06x?#waWkHj$_*RP0lex|Fx=7+T}?}6d#W?Z2p zBrf`>ensPgH4P2fk*rm}GVPRF;~$GUFFpM23j>iq5_iu^T0YF|Qiia%&6V7>7$$;iU@*x#_p{e1g7R0N=UiQa zfc@M4Sp+woXJbkEzj!v`LHH%YbG~bB{W!nMX9qH^|GZ8t!rg^sj{RNgM3VXQ1co)k zhj3mg!thg0{;#C)3(b6sw!g^+O0nkLezn6>I8)wEn|{6VzlZl5$G-_q{xTb$YWTgq zeNOtbw){ROJ?7o73S@n9Z1_!+-p~884gbP~`Z%p44*wnoZ36D%9Ctg;vMP zJZ-{wUcdCS@hpeeAu{(}VRg322&?lt^8%|6zl&-`8h5GHdEN9?t4FbJuzDQpuUmZ#*4wQ<9_y#A&hnqPIjr2*k-Kb zG_14Hj?`yDr||os6w`*PkK~yIwyDe`vrYXXTBptfvJNswOrLyv4T9T+UNONC-XEY& z9YCzjJ1}WNx*39QxB%XP-WA^^wr|`$pQ2g3jOmQ6B@Hzl)>JvGJDG*>debJQz!OP zt25tftCPLa>SX^^#lNEB`MWoAXkTD;+8h7bDG-(+z8RnGb0EfN4hjf$&Y@FcSY*z< zztzb&*Xp#LWOeck|MO5FXnHemPTjN{{?HfRE0p^MJ88H`2d*+*NQ?P=N;HpG6}#*=Z6)mi2@tWK0^XDBR_^1tCHtHJxk zlzv#Kv)<=1&GLy@x)#kGe?Iv(#lFLko1x3nqr#3%96PzqM zb&^@iPL7F$d!{_)llDa#x_xrG+2^2MDHF!&DwJX*C5fY|M6nBf6;UYv4)BRBk#?Qj9wA#M+6EwlPy?dy@@3b$->%nbo)6GrBJBH8G!J3#`g%4$KxK; z$m4GpwSU_Y5C)PHI^1-9?xkskJlOYG=;bX?-hqPMe%Tokl_6&BbCQ@ z6YzL0BEE7?Rr@y+ym2sMeR*sb|28_jD8j6pi0~eCcu#^?3_J30SWED}?C`n+APh1^ zpWyKJ*kdDkJlCQf+tdAydM_k|wV(SP^?i!R>lopE1v;yj7^g_!@mYj+lxwh1k7J=6 z0FTFa`lshkd0wS?qmZc-aU#MSh6v3&rg%IrWg6?d1%q4jrXhjliU{v9*lAwgDM7jP zkL@G8l@4zy5_kQiv-T-fuosXx>urqKFd_-f=`|UK~8xe*4-q^4`Rvd5z#P zPDFUGBSQ1)!JCFS`p5HHrja)uFwL8fommv|BEq{EMw)j-`FAFag?EO-TMHhqr$vMp zb9m)A&P;<5{o{3v@a9_{#}Z`*Hr|jX` zySb+1T6<^wn!05*L$0#7vKJ6f5DB= z%caB6LML+{)HJ32!~32UDnI*EA8Q!?yS3#$k@q3L;Ml9684tW}rBq_!eaa_HDA+gf zH&GOyCm;}xp_F?YcEDlNGWVRAPVwznHugL@fG|op)Qjy{G50*6)Ano|Z?k*8&C6Q~ zJkK*?uSe~p)`_d7;0a)LCdw0WToO#hW$M(K^X67n--;94nyR_87U8#e&gI?7*d{JF zZu$(+6WJ!9__d(LRxMgoQ$2n0B3#F%o-fnMa5LwcW>Dw_N9x&r)tou=W~7|l&#A^U z*dZtPw%Jc+RfWN2yVaPl#Q0dC2Ars7EWiSX0wclx!UnLCu6`dn^JqI68?+X?qgIbI z67nH3@tlOWGU*TPcLEOC3c?!?UGt_O%yLA8cQGO~ zkLQA=h@*cv+$4B?p=;huge$R#2#>d`G;f^Z>2vW-u+zNFHlNGmHHqfU0gv^dfBIZ} zDZ-lfB*LXwM8v;^h|s*HipM<))5zy>iM(_oah}oIC8Z94m(m9WgvOo}Tzv**d}$oj6v$2k&sq zGQViXI(Zyh;o*f6>tlt@v4SlVH&!-OG{ovFG0#4+!C!&f*}RBeq*QlyatrGrD996 z#88NRu)tIZ^o+vDf=HJFNxv5g&gp#Z4+{TXF>B}M*?MV&9(46kjq zKC4ZY*Vq+KG&i+vIPdfId66C)GaB&Lg3I{QhIY-6grofWj2pWbD!XWJ(4LW=&t|x73QF=f@QIE|dSuR>=u`Ug0-rkRF)GlG;bSj>=2*7uZi=mjY0~thZNcobZIP)*A~&9g zI#9H?W!lb`>ziAqtZ$iwm#)0q)b{2V&TozE>TE~xx{WKgEO@r+m5HxZ)>q*@77MTq zt-xln?j-8*zqxIoO}d))?s=~shG_B0KlUQs8!{sKtN0RuWokSAf6RmNa%!TG_FZb) z95%^Eh4==BkkQ9}gk52RW#5{^2S?1~MA+)BP2#ZEUA_*ab3w^WNZ@1~$cc zrYVw5ApEXqp-dR=e1W!!Iwc=pv3?W?Y(HO%5jc}DvNlCY8&x4|Wo;sXO$ejKTejeM z(Yq~6UvF8ow`Km$mO0HWv)8xGtZA86*VOjW$jjl#)xRAJmrtl!j7S-%5gu?1uCHH^h~oUwR(L89P9JO8W7O^m_r9Hh;AyQBSOAKK2# zU_1ol{N(L1#?Ws9ZVyfN?f;5RNwTc)fzN$j2KIS3_UIMt@R;EQ`)Lkm?EAUBOsH!y zyGi7FwhiX zi5&$WF5HZL-Yu*68Yc{cNJcYgiD$r)+YigccxBs!wB7&7KCGACgx)i++DWq$W8Vei z;j`rl#ze4VP}{O>4zgbe-qZl7;j|?Ub5pHBy2ySF9Rs;+>!hlY|xkFq!9iEcYAP+W1ll%^R>U< zV{fe3wr&5;o#6h9O~$n>X9|*%X`UF-VSP2rYv10Sx&gx z3D0%H3!Ly`C%nuF-|2*L#88rHo(xGwWTt$fk^bMGOoW!1@`XBvA9B(+I^l0R;Z08X zyH0qE6W;2CcR1l6IpJrW@NOsE;)H+ZgkN#O`PWYEj_$?>=wiABG3IEQU&KnvK z-ghZNi{{wpm9kAZ3qP)4Y9PD^aHvP155cMkxvp^1@3HA;n)J@zNGJWLcJk>WlYXif zb<%IP>3m+N2zShvsvAfw|4JL?J)a`n?frxGA3<~f_9r$Rr1$iG&x%=L{uga{DD)!E z9H|?|O#c;Mo&n*UQW1Vt`2ZWj3e)G?FsoUFcXHkA@Gr7qZplTsgL}K>5yAXd*>I45 zu-76tiER3#HXNi6^(yWDlGQHq&hd`f_6fqny@#Fl>uPW0^fC75dcU#HnIUM(m*-3e zoAe93Iw$`Q8bZ#%QiQv0PdVueEI&xU$m2IFD7+6@=S`zxh4ue}4POVn z$h*w@_fC=;`1hm@2jk;PudPdJ`kOY)`JN*0OI{b=Y_~%G?|2gp5~N@4y{~R;G5u8= z?hU=jyUx4a>HlkNnD-uwFthnnxmkuV^MA{RgYhxLyU6LkekuKTlh@DEuamw4aj(zt4uF(2Kk~ zylu|-F0orlJ%^&8kwqd$a4k;QqKo)n2sBnv=KmPu$NAUu&cc$I=Y#H#W^8b5;&ay`{+K}H z(BS*fMEtRVX5!Ux${!cRa}1`uPwdhlo?Rf%Q8UILui|b0nD{G#_;RfHe3pnmAJAUySiP@r#0ZR<)Re&We9qpqTdI0nm!SG*C=DH*72Z?SW$AdBC&c zFAo%UPjS>nV|&`mrKP*(ifKr#OGkyzN*srbGser2GWa=9b6;;#x66W>o_!KqjA zXQ=o!D*j9re_x=RaaGnnJ_}L)*MfLQF{jwC^c&tZebo!85GhA zbYc49>N$(>M9PWV_oi95&Z?6*iK#{9+8(HJL3PnRWK5$c)p#IHg+ za6Z*sw{U7oySFTcG_vWFd5ag#Uo5{J>7Zb3tc%t09dCZdvijDOFDzaqWWr%GB9a3ujL~$zt1Q(Pg(!?bw0OQgS=nbnUpX`leeyQ=Qxl zx<(zPowP@06rE%PD_iY{ite~c)4q)~WMfjcx-1plaanV#W}NJ}Nt)`ClCd2Zq{o$c z^XG|=h3&KGg4?Hd>_BoDoMiEC23@$D)^X8xdrtjX+KG1zVy_DhMWx$}%qS2_;9>`* zrdaDTQxZC^Y1P7IcwsD_lAIy0-8^wOhvZ2qJsmP#t!)z}ezlkK^S+Qx$g$UDJ4q*~ zJKjT?cx~^=wYK=E%QUSm2`4Bq*)*vcI_l;2c~VMmpUfspp2^|Yj`;23!a4JB@Rlch zJNA-K`BvS8my?<|37@cG9P@O&Y+f$halv{I!85yC7tftKZ+_UbyUxjQx{SJ^(%E$E zQgXlXnH&nwrrim*=-3%E()et1_)C&QHkEccv+7eje&{OS>Gp^md6I zm!7&G4gCRZNc}@|X)i(zI`+ggTiB0wJKBi3t4YnHy-15pw=t#e=RRX=*j|$6D*T_)b&RO|w!!CPP?4@(u(AV9mDebPAlgWeJ-))$ah;$vN_C4~$@)MnOw9lfOwtZ^Hy=gbJlPx^e zTo;_0(s7}Qv3;_|x*2rAZd%7hn_+&k#cE?+q>k^nII{;i+2XXZE>6dHT%6igPJH&< z-ZAl>hAPvPA1rlv5Ff?5w|=S>bEAed!0hZwKv^@GfUjCk=NOGuHrD0o_>PNHJ!XoXgP*;fxJyEFX$L|LI`$;d&7Z-KkUZLpkmQbi zuzQ@)*JY$X19RS*LBlXmx=q0hj*~4?8|$j-_>SvnHvN+=P8;jubbQCfaVVZ_Y06d? zrlLD8E7;8D%)9j@hOn~LWvS?n%d#Wf9{f*wlS#EtHzdr!O*QRcx07m}j%j|^*>Rmr zui`u`^urt>O?QG0P+eayk?F7t2-=^oNEuk}v_(%okuqkR<(S&8L^?FPq zx_0W3hQypKKPIN_MuDOpl}OmViTQPHHwJc677G^rb=XmlGZJzf^ZOC3k76O0X$(K< z@WvrdO{pe$k2}09OfUhO9g z9_Mj|_cSKYb^CFuH_X2suw#523#Cl)_RXMy5 zZJNuw-r>a+kB^WDZ-m1;j!I_E)H*|;z3RDe&lR#Q_}di9d_Ek`HF|3l;GXv@c2%fF#m3M zc*_-!yAP@FbJ$pbNbEP3r}6J;*lGXj6_1a=2=9J}R|}qc^ugG{+^ctZ4=NrXkrCc& z*iUHxo=W52KGXmIJ_qnkB``he>Y+0rTsgQ#=q&X)Bf#J zync#zuERSB9{XQ}49YNv_oCvRiFEOAl+z!_)A%>S>5o?xkB{vLFXHe%0q+tzWJUbT zb$ACA?`+r#?-Hj!_|5@g5Gnc?r$3G;9v}4)UWvmS4_;XN6*{~R6_1Ys3GV?YsA6LK zn4QMIufdLa;#iDyPaco>sF3hxI6S@+AQS%+?>}swIM$R=igy9R;vbLS zn)gW>|Gs1M#IdG~Q@k%CEWEp*YaUMq)uVX{|M-ZZZof&2SE+a$znaJQZ8M*U=rgR} zahotr@h(K1_&3tw4M^kPP=_~1@h(!l9dJ(jHwnBv>jPKf-xTQD?)o%#=ODATn+ZE% zXkIz&7$0XOWU2Cx`!}g?p2OpF(bt(A!5?8~I=q#NcbVdS2Pc=>zZcW^_bu3I|JEwr z<%)Nk!)pbP?JFYwEpT{`D&CbamiqoXPA;{71xOGEnWDb}JL+*pLN+VjM1+~f?d=hV z$LF%uBbf=_HyqwmiuWbOJBWuRwSQy4V_71izX?0)ahtG5@xF{WrqRDG4sRS1!u;cV z{WNc%;$5wHFJs(m|M(t4<`WTpFYGk$fZ|;PW2Tw*b9l>pqaL>j#}w}d#4(Njl{&m8B=og;xDwvy9o{F3H`Usa_YfX-*8aT+ zfG{*~E$kQ{XCx#K2UX@jilqt*(-^LHc>ESx*!kZ~hgYn4GZc^S$J72DL6~KUh<=)l zkK2T(;>|)F?dae8*j_d7C=y_r5aAt#9rd_P8K8JKAx?PHaB-t~dG@@~W=r^b9qcr3 zq~cX8-Z>600$!MZw^5cKX#?@Pqv#l@=&%b-kk^w?=Te2dmcR8 zN=u0N_ZukG<2L1a#p5|2)9By#o%4+YY5e=1bH354cqyLC1sc+QbWnmDoKaXO$7mL()=BcUecRY=MQ(?zEaV(Sq z#k(J2;SF_opQQ0`ki+Yxcwbk%35eI@xy)YI(+7&w_cGXN|H>3^owZ~A`#QV<;Dzm9 zKIia;Dc%E$_wRse|Hh~B?-kf-|Kf`Gkm7yY;Y~>6-@^`Xyy9(8yjH|(|M*^EX)~B5 z^cP^K{hOkA8x`*nhqow=f8TI;GZpU<#T()rj~-0p-$3VhG+*()sd#w~uMxabq>D)1 zGacS?#rrmlX@@5EKEQrlx8L(={Cf{}y8Y@EZ8 z9J==J7n3_IqD+l20l_anp!ueZaCfEVUp zcZXN1c+V(ale0e^zVCiKM}WSk1F2J5huKL&iQj0!opxy(eJbI zaYjNmE8c#Dg*VON4L~@|zv~>{Q;PQ=iZ`TlYJKZ%KKeir{|3U2dYqAvJ&N}l!s1_! z!(+X|_Rqe<+oyQHP`nqN>-{&<`1e!idjEjp{ZjEBad-#7>yLC1sqZ%&-eJXi6UI{C zIPTNv@sefhHliuab{l{h?pAE=MOtQ~`e4(}7i`!8$9= zzdSsL!u&_EysdcmIJ|Q3qDU8!_N#Sxe7}P5egk7^zZ=kay8R}k@lWQ}Iy{+y3?3W+uju-OQ))kEJv7wRQT(4bUu!#weZ#=c+Fa8}5tbL&J&dd#s z`D3&3(&5^B3MP*WUbH%4MdjqbeERCr!dD8Pja^bv?MF&>Ha!XQR=(&I-?JXZ&xCK~ z3x*?ktGoJh^YCTuwFdrp4}V}DOKmo99L?R&9J}*NZplLVCPx)+tK{It#FIbBs*g1m zZfG1**Hph|kpb?`ZLKhGz6>m0H{U+V+MNqVP7Zv-7f$+YyB+Rs&Vv2!ENzXKri)Xu z?tQG@za-DRRX%9IHneA@)1GLvWrfxL?3PIGve?cdzq!bJw_!a6i7w{$AFn$?vJ-vogQ`B*GWzZVf&wGcdRJF_x9Nn>9v!Kz$uwt4SJ333pdE zJ!$n)gTeUg6CJa4G=L%@5Y~br@GA-SOptlJB*Z+}_rw z#f(>eq^AYDd^6m0c4xdzx8~-TjKxRFIRX*FU$a&4jjq#8KR3Zu(Pnp;N2Fn%)dZTWKiy<=tVg_Xxj z3+q>$xhs1?TidEGUfm{qhN$-5g2~6Tn`1@5H0(f^Zo>PzcQp8~|J(ANEu;3flq3E~ zm3d+Jo%tgxOFrs6Wg^g3Xq_B`&haLn=JmG(Gzd{<+#;hH-E6wLZ5|53b~Unc>4Mo+ ztNT-*Qn8`?S!P=+7@No8!iXMNZ|L5&t{EAk>wn zG$;qv-LeBV8#i6E?wVNRrj3P-J2v{Sw_5+1JI}oSy%RpTH2I^y1m2rY%t6eQiId;_ z;L;zWmC&nVOpW}6+0@nlCGD;`2>ABFe) z*TuRu#IA}JqXX7S&z7PryG?N)fYCcJyV_rdSNogp?OuUC$V4AR@Hgn*m4%J5)f=yF zZs|U;t?f=YgeqlwfgN_q8CjP;19KCJJcxNWWAi%nlNra8i!xBd&Fj|u>fM&^AGAae zzsqkeM4GW(g>$@Zw*b8W_PM6mTo1WTU(1>mZu=XDb{iXULHoL%%<*n`RmR&{`!ny) zScl!lLj`y{_$F-M8^5@|JH8*_H9gD2T+?#}@3gi3{*kjd;%j18Tot=~bZmSiXL?m- z)0Tpr-Tk^vS!-6j+nT7oX~1QLm&C5Am|hjHi&fU=b*_)RGB9WLxu>F>H5>bMGP|t$ zrrCL@r5#)50E;oYc5@V)ivjM=X{|gk(X`2w*yNoVJ7aO!M|uVAQi=A+V$=5Vcg8B2 z5J791sFKl{ODn+Lnr%i33o%XK9E;mFjm4`FgY7C-$tK3%9P~O2QB||QA6bZTo4vH+ z?c7hf^8&WyQWW;mAKL0O@Aw7|_^W$7-e+6&OTTN|gQh>k=J#=8fTa^pgshJ4@z_0k zupGj|_&r#PDCOnlm8YF{TIIju17dLHw>YO1Y5z`XoUkj&^m0{*�%KFlL&sStd;~ z&DSG!__SmITBi9rVlpZ-WmcZ)eUpjC{!Axa=Dnf(FF@)xbppz8AKWt#VR*M=-&a+U z>3lX+gyC}~fHlJ_o$yy2-b5$dVEH}R-+1c%HJg72*8C<~)RtFe!kxS;o$~+W)MupQ z?;a=orV~~;E&vU|qZ2oz_-IYEIgG90Th17yM5+C>QC}miD z+;5}|z~U1IDaYdDzBPr{G(MhTrLY?EK1|$>N_;bqmu8H|ttfMkfI6?SZ?N%n<7TU~ zh-Fr%{ase4{ry&FJs!0>*^gO0iuH3=r|%rsEQ`MX$?Bz8bHB%U)*}~fMxFJb_;z=| z@_ZHqp?^|e`X}{ewdFmZgRIW3CX4a(|01iCccs) zuD!-J{n$H*XOwSmJV&X2K8QDcVaJ{63+N1z!)M*N?q_xK&aygr!>mqUzGU?%*0Ze6 z_!_Iz$6Bki9&4;ln+;Z{4Mp14)XTQ5sh1r~re1a|(Wcmr>poT|zs&07n>L3H>owfQ zGv8RNlYNEN$u{k5$3OG?G5moTf9y75{IP9o{9)k`)6Uk=NoMpGOPoEI)2_mOswwEdO$=v-~Qnv;3Q^9>w}LtCwP3XZ0x7rv1UEJw@7_e)u$o zunm27K4btE-`2OB`WcM1+qFHkjYQaICdeo(zP%9{r*7M140YRgtc$dd>APG+K$y1} zI(_-F)$_2fwmN-TVfA5HoACpC=KH>lk7NCm)mi3`tdZ$8>r=z0V-U?}J^iyybg&O048nGiex$q7k5THjA88}+4IW{2 z`eybC*r~A0sWzTve%0zM^BY!Y+y21nz5`xW>D8HU9lVpMM=^`U`2in<-caq712sGi4Xg(y56%5y_8 ztF!KBTAi+%Z5H;d#{wJAdYEGw;#rTCHlFoZYxOABPg}hd>*uY`Ivun+eK+G49Qyu& zji>MbuzDQpB924YunkVLI@_SPCqHqWHDmtN`Sb8<54>2l8ZX_PUVUp-&9X%D-1*hv z3CVmld}~ffwy^kFGiKtat-&vj6J-!JWA>~Ww@k&WIq^eO`x9jI^Ivh3KYyiN@^vK6 z50y`77>Y~2fa?S}Whf=l9lQm_yhv2X1?_l(dg#}uoS^6wQ(cg0;1iV7?qw_|C@jRD z4X65w9cX^1Jrh5#W|I0vw0I}IHD?}%hJD{EK1D3H@`LCTo6D=v#FA}}8qcq)uEASn zs*`?koTfxzq|LT5!H1HQ2qes?nuC`S&6-g&D~T{U`2H~S(d31RD&rT|ram<_^J)^2 zbfkLW)Z1s(%sXKN)XbXCuNdFDsA^I5yjxGu0j9~E9Ljau_z6Gg8GWv)x)q;%PDIna zxr^s`9lUTypg~_HH%s$^&<>ppw+-385<`XWA~+#3@s5jh4T_FWzVQxwgP9#MLyhP0 zC+>p=jbFH=deMy8gBDdypEGNaZiuj4DX(ft7|*F%bmP35xn>0D*RrI1bXpJBlmrgf zln68UoEYpC7uVc23#0hPdBLyrZ>qtlo0-zfH`UBrJbx-jO(GhD+xgTr{1`OD8?jYjF@?3Z2JJ`olCH z*C#r>If&zZ6A|H!cX)YSf_rP^@iInuJT7bh>Ji|%fr#*UET18)c7M1=QEL}=cF;PD)ZJh+549LOaSwu+zK)iWft=@b*E`yaMbj#u!5Ihjx^gp-_)A02zZpw-#&q*B1-Z z=wCAw&6`9XBdpMl@=Ykz;|xIF0FU(`uOAksk@q1KW=C@yY0L|*&1}%vQ9mE;pzZd- zj{5--ap8LaQD@&%-h$oCKsA4v#^v|6oh9i4?(~!h?<|ZD{ai^Cjz>&mJt$)L3GAc} zjE{rIZJp_|zv8$ZJoKFM&+=T!h>BtMIg}GWS8~0*ZVirwWw?jud!M$oeM*1A1oM}T zd}3hDmbz_ABKJOielJe0J>1mTsi~9sLbd0u3Y50CvAJH!TmCA{K;g^Ph{q(O`GoaY z-ztarWJp8Cz`T>2;Oxk+Fke;NUC=Y&dwoU;pI*U7tXYSGMTRHU{c zXp`m_3U-?Q8+(eE)H{3TF(5P~9*Mx*Vqk>oXNwVZJTxHj@V!2xAyYjO66#_ivLjz< zl<>E{8RHP$SgE=(7;or_V7%e^vOsZ1VDPQ#ptJG!WGC8x|NDfS9d0WLKk+z8bL*#T zpD6g-k9+RGjCOu}`}TE_UVEM^DEYn_Vr!a~=8etbLkhjl-OxQNl81hdbZ=T(cu982 zQ{I4{=#H(y(;`cr%5L6v8%Ab5XSE-e+K*j_U9TO)L0#S2hi!l6yTo9l?)akovg}Cy z$u>c<0hBh}&%6c?f?b|Dq@^H|y?4_DP(5VoVwEt=5nQG1F`IZRFyVD6j z?}X+1tjt6E2b}a-HvB`RaW1{TEq{gy_ciB(zV#WWc8U3Do=f`NnLx;ud-#l!d-%Mr zmbnrRGtTo;aO!MyVxv|kufNq<&Pc11U1@c)FSR<^6d(Rxj5S%*zks#z6Z$#Oji1mb zK{tL{-S`QeTb%LJ>fGOva|YH?r5irZy(xxoH)X@O^N)tliyw&L69zGSyJ;JK$b4}r z?EEPHK+3TAF{7IEUcXPEmowg0d>HkBZ`k>j3x+AOv@+rZ2{A)fB7vhl3zgH~tTJf?IrCk1=9({nbS z^=q{{>qqf(f@c<3AL>_Q&9bR;-(%VzI_qTG-|FPj2FLcG{h@DyZrUF@$4nFpZDwO_ z_?Ww)7=FJ%H~cdK-SE#0bi*$Tbkn~aybx3=F`vl$9GpWWJ8E_E23VctTx4~!Ct98C z8?0`-+w*bgV%?3O&@Y2-{Dl5R=*Caz=Rr4qTHW{wokP_4X?4>M&{?%87V@bZzC8>Y z{@I9x7(N|`7(NFS#PA0Ny5SEFbi=pf)3izFAl_{I&=YL}o$UTt_{~$6ImGH@pKo=t z$5@@^Utx8YL-7F_iM8<`I^8h-L$8F+GH5diYvaGwjsMUS`vI#P|Dh+^$Lfa9NJ*tTHf7NxO;9qg~5sqjarnZPI`Eq8&B#iwNnhPBXQOZ=c_f6vTVmVvFsQp z%63fq*b3J&*)i65P|ECDM?Dh$DFN{{v00>=wVRYQjS>15_jaTdt8`6fjU=;eGAEWz z=0w>hYad(TS|*#!8h6-8A+L-V-;zzFjMCL>hOv>Xwpyu?tW|1^tyH_n3db&4rFN#= z<)lo5n&F18oF(QXZ6PT}h{I6RR>>kvH0wSiczZfWK*(e$ce*Dh({b{UsZ5XHSW&|h z3M;-^Q_rzsdziJM;8?)GAS|vOk4GXrW>9!OLOqU!l7;i5aac2+{xFTl5pz7kTFRXO zeF_#4;qlTz^Tvb6V-R_)j_|$&o&IHDp=`!dYP8^w@UB2m^Kb{*%x{n*8kF8nBr$OAgzpF1BGK|WqyytS4GjFEDLORdh8 z_;;_v+YFx6mzUb&AAhT$>&y4T4hZ38!j5_3HjU@G!t04R;r$LU&8r3Phc*va;@=?{ zX&Pc9bcOe_0rG;-8+MjKUx7-xL6f1BCf2yq-?` z%?EE3Ea+bh3+*CU_#R@-n}dWIh!+vwM~;6_Dqde03$MTBVP)i1B*d-GmGEkyvs`-` z?-gLDH0`)v0j|&vmmm+pIBft2@c=BXS%67zSfWbpY z4E=2LgeU*|^CxYG4Wk3N!W#td+V0xZ=4I?bukFF*8An~J1oLf6{dI5`zu@I>?+Sv+ zi9>nbOPw(Hhbbj9Z4=C}^{(4gyQX<(Q*AIM(Y!YrD4Zk2J;q4qz0G{Kdn+dqF#DL8 zHbgm`X~^JjG2hO9kG~~1^B7_NwV^3xZV7Ftn>E#WgnSN?5E)+OV;*sech$Bfs}_6J zoR6zr6;$CmH5s_KtG}}=JzM?ADOYW~{lV%oPUYDR*(E%Gy%ZhZu6?vpb)5gNpKh9V+ zn)jKS?0nMnrrKqrhit07`ssn^77l62d$*~UKVe<*L91zYc#7X*XTp2o_BNBN8Q!wdXr9SG`)4G3U^afK z-86gEp0;J9fnJR!%0Uy2U$tTQf4%e^hS9%XKFhclZ;|KzjK(}nftS3Jxe332-BN%t z^UTBDnp+FdM&{?tX7U?NgO@4LVq>uBp3>aP?a^AuL?L+C7RrJ)Or(`e$L~$eH2Wpl z!IZDNE$TT`@y%W1H|u7WQ+6KbVCS*Z%n`yl{094FF9_MGQOp+h>Wn%d5q_HO>4yB5 zD)b(v;#~Z2clPK==D8K?U;30k1m9Tjw`XIhrPnFm)U+Kc>G&=3(=| zM*dQi+Z|?R8~yQj*X)g=)bWwmTOyTa9zKiXzFW>E%!JK07+{mXoW-5l&ML<3&pec4 zj51p*kQbhrV809jZOyIs;WaqFGgZPVb75-?F_G+D6~U}10vwTvCK}$tc5n2?=Uu$3 z6Morjn|o)Ase1-~o6VizYu7}34(++I^O(tx{gdxG zs4u{-3_r={_Mg$*;*Ga$s0vGzih1`HS$vN`U2J^=UJ$UZp|UQvwxMErOEi+py)&wt zvzvP|Zf|%M0)Kb@9=Cn`^1KyQZn16+Y<BSI!j;}r=SU8xVvgEhR55~8CY{J_bS^yJU=hORhp^`3Uh^DUqCD#BI9uWkFEVZuGVzuPb|T2kgc^Jr(8>bb+)t2MY5e&+jzF~{Z?l? zKVo&Z-*&6h-+#Ay6zjuQFU2|^W0^j)EeBbhZG4T@nfGp`e?#ftwt6{ip0YaI{%8Lm zdH(_*Rdw|b<7Z}aBMdqdU_dVQOhj&i&g34vJek}Cy!?P_1gnos1SJR<0?4KCG)$FD zg0?XhNm6Y?>Lo;xkXjoOsYz6bH1t8LEkIY+fm3+WcEsPnlX@zgdJ?DXltbav znfUv7QfK1N;3>)s@YjIr(*G}bQcp!s-4s1_CQkm;LE+Rv(NhOSFUpVPpCSDzf3^vq zX~J)m_+Oy+91~7kkSF8LH{o|E8ax-8@I@wki3wk(aPTiQ;j1P7F8tS-@Qo7x2>t}h zKoE71h6e~cb5Ru_?CdshVP{zvhB0i2;m>zX;t_b#{=^w?qQn{RDv2`*E)9}~d3&A2 znI=J&p$?gNLfuD4N;`3IkwI zN}RfgwhlPsF&h2JJ4xc?JwxK;C+an5DEm#)A5LQrG7ze;LHbjt8i`Y<-4drxuS#6U z^R&d7F8dtHz;p@9R+LrgNE2{Ah;Rpf#2HRd?W&-c`A%6a@gi8{hvG?DRa^HB;3MP^ zf@u>cj|_>EcD}^P?;eR$cWwFN<#!iiC#Kl^7g{+muQ{Hxw8G16%>;w(@-xwduQ$qz zhK)^p16K%T(A|vvf3cv)X!4R<^NQX1nENB2fWAP2Ev8xvst?*-;VA0}b{wtNJD*CxpgRV86m;CFk zd75%ZtqBg0M&*D?MrO|d+Vf|{05YXuI7^Wil9I`oS4EJVRASQ%%J1*8)5twnfO7}5Wng$es3X+{fPo4-?lJ*h2U2QBFe{p zTj{$wjNdfIvnp==@@)*`HyTW61M(YY;`fr|r&w^Er?{V;NS98o_nGZ?2aH!N`LX*{ z^8Fq-yhG)s0sI)IK;azQn)$s4p;UgD*WFq`XXf`J_zjjHFNN{@(8N!z7m)vH#5eQn zgq!0M1xmiZO1U#+z-Qn$0r+(M%N->ZZCxKOGBiIMilW^@!lE6Z=H#sdEMNkyAEn z_Naon`M%)=-U4?4j#qAM8^I}LuFGJ4|N7X*w&7;?kVfO^TooSEG}k@`1R&oRyEo1? zG`eH%5zK&N?pczgMg}dV@j+*)wP^PStV3?E%nVp!?iqbez%s;`{2n)Dd*zh@r#K2W z=(y)}e9$ZC#snbNP&bq10t=N5d&vwPLRvwEe%DL!m#2<%u= zcJI7s5nZfSS;vho*%qVU!3z<$5VGfinFQX*T;!9lkJsbi!$x+);8{#(-Wl?ZN zQcHf4`+!G^-&lXyUg@1UJn5cQ3j~9}j)i4M-fhJ8t`DFE_jR4+gn!-`Tfl0kHLtO! z?jME|RyX8Mz}dh^(i8*ho}n17sa!Ha)Z8&xn=7ys#V^=mF|hmv?`CdzFh52cTN21$ zu(Yx4`Ludyhuekp=9(6lMJvCJy>|CJ=A~jd9DPb4e*V>!V7&e6#bp5yG!C&g z&b+vBh^2AnMHNG|ikZVm0V(F=S+=e5g@)#;#us+~JU!*zqOy{CGc|aRWpLTEkWH>| z!0+~s_Wb!1e=_2pyRTDu#D&h?8<_XXXCJM+JXY#O2lblodi*T)WC7ap*FJk}?x{Xh zK~Y9jW}>V}eI^KI%r`4+$K|^2NO1zJYXi$0crZn=qZ5(8^HVH?;n&xInu}FJtr70s z_`waHk67b(-;26ZGG#byQ8MK+)|=5+3&YJAe{$pck|~$cG5S=+?uzY|lW?Hy_>+Pr zPI$k&KSJC1#`e*_-dMW55^Gow$du!EZybM;`_BFi%Qae-YSf|sVCyyP+Xy$~XBA(S z38(nOy?UJYBrL?wI$$)#u|G${{c!Gj4o8puaPHnb^JtI!R0Gn6tHi&H_Xj3mI8+Jj${RN-zfFV0nT$?e<=C?Qn(|vWip&`NPkgS`ZtHAcOuOF z&oK8TVeZB-e%}uZHzhC9-$y|J@8B1Q^{^vh@pp&CkCY5r1^q~IUL{Zg)F(^goZI9% zt^{>9Dow?G00fS+EQ|o)SWL~y(M!$Y>BKQsAWXndtdz^R%=eu$hgayoZ?QPr3}^2xE4aI0wK!>S;8dlWTH;LD;Pi@O z@!d-WfpIz?J{T`ryvSh4gyjtA;4<95W_95jMKag~nP5DCYH&scE4~IFGtuB|zG{+P zh$D%@XW5k*#58;VNnUqh=5fWU)dS8#6KsSup^4%vagdn5$iI9s=8abkW;4Zp;69sh zn+-}8o>7BNh6|ZgbTfrYB2*9tBO2VCgRxP#=4-;O zXsk@b2kjBGeT&(ENl;^vEpQW$lKx5ZsU9jy1^V!Cy2*+NPeu0#=!j>?Fdcp2Ex_4q zQyzw~?JNxAcL)4_iJt<+@4hg8tHEy_h{%uqjpE1it<3UGhJ)?00>v*kjNd2V=K&G< z0S)m}-(4%aq=6sD)e02931R%kp>t9E%=61xh;NpU=i&_}-*xaO?+lsHjo>!{IORiE z6Ozvz#;+3Y92tiXB_GdsHuEbq$;U3AVa$&g@dIh79Q42;hb8ds=eJwp8T16yfZt3! zDIdo~iXYyk2Jrg={N90|0wv$W@G#5wA^0tXANe_D80Gr{KeK$?H!+xe|B!Jq@FdJc zCMfyL^UGZbGxPfl{8|}7f|BoTxXtpFgP$tT9A7Yu^3A}{%#ZWmgXJ&B$!30k0KWuF4;Wt%@J_{h0ajT(-gN$8ToLbo}ORA^0dz z>9&H1c!mr}L%PZ?mV?%fOQB!(jj14gu7+Bl%4Qx&@D1h@t1V`aot13VZiU0 zkO@>+2I$Q5l)V3vVYD+r(cOvoN;dlUz?}gPhI4F4_RPntlDzWVGGn&VW16%yaN}=E zQj!QsOY)`|BwsyG$vfN$N#gHhyst><3Wdkue<;)-fO$)Ngl^22Y}R;RUP;v$`>=O> z@8Afdm{0rqQvId&XRXOYXc?b4z{r+7}-7 z(WTCkF|qd8{T7}%mOD`Dra*8_&lTZC{+U$Tg<`dUj*0o_f2k*!`BIa`CC*wE8=G|hgbDDL;hsmYU zplfm>ZR{|J`jFp9W9uc2+_kU*3%e=o*k>OT*HMaj zSn+K?rgi@oR+-M1hp%vzr5})o1-|8xhp_i$p4*v;478>9XCRbE1_g#L5E~r@#g^vzppOWhW`u}|FBxgM7YB8wul!m`#t$Csy_|CnqoJe_sa7j%;i^B!p& ziayRF!PLfZ4ME7RvQ9lkN$35Y1L}}fi$-~mhGERzP`{B(81B%ctx&{~gu27iS1@-y zwmgh3T^VqXD&1VUJ1X zL!xK5-wC{A+r+vZvmTu#YdY?uwBgFgxhC~+lBO`EY(2Q1Hvti0ly#DsFbdjLVO7yK zuzj+qwA6F_$+{guf9azz)#h0%XSsu$ab4x3{cX%q?}xs#wknKJWL7zctz!J^=lxx(qKYT)wtK@=%N+3KcS#E9{utv% z1$6&bIq;-Ae9hu>)A&=+hs6)S3+<7x^f<0p!1yao_NCh&=3Xx8$Ab^|oGh1-Yw_fo zM<9&;mN56rlKyr{{vpHvF6iBw zCoDYtyucC}-XrKQ$6wfNn0N?T)Orlx8P$4>uq*!nM&PH`V>tJ$)?@firPg335GNsE zGJa}ZWEyd~F5)517fJx%E7blJ4yx4p4P{X4H{$zh$WA}E^ruLP5~m%nl{k~WLE@D0 z0f|$_??_z7vqs{S7j3;ri}H3#obvWaobrAoamxFd$scIw8+&G-vIAvR-`i7GwWo&i zsXaAL;A&q_yu``l3W-xMF{h7mM}9M5obD_3n0#TLQdf1?U(*cv%rL}lDLj% zK;lfNT;ilBsJ#qKPuW)JDA%rpj!X!^V$D4@1RX!(5Cg5Ofs= zW5GNKL8Qxx8i24Hl?DjAae@h;<7b&jOs-8%GVsZGD0@yLE@k!*mokfTF5fIt;IHnm zyGi0qKVRaMd5Od+^9qU6ZW|;{8NV-aCh-G_Pr&mjiIe8%5+}{e64&uOB5}%oOyZQi zSK^eNaV%5t2cY9;nM%w!H-_gQ5-2NiJ~=N%oH7f2fz!s6iT?Pn3EhEEm+PfJ+ zKhyk{^w;qu{LA^pN(RvJvrs9(Wcw=`6bIR`6}Io z9b|bXU(1#F10Y`ul?Ei?r^;{|aWV!V`Ox|$b>^BS?L&ICmMQWS{vrDSC+%WM!}OO* zoN0!H67t#$%c+P4hsZ96Goqwe} zj8Lfqsj)h{YO!gZe9$xox#R7;J8n#p%X{2#MOJ7PE|j7v%-AxfWMX{$R?*U{R;g`R z<{RbuQwXt@kruDI>wf=Y-1)acEME?`-poZuKd!UFigZ!I-C>k!O<2it9%2>DRE^T0 z5;TV(RLQdl_r|R+R38MKV`7s$11Y~k9z|?U)sRPpTp7Na5Bm?e^sfIFyn!3&1}w)b z{-Hw7OV1W9?!ViPhTtZh^BJ7sgI!a1;Q~8Y3?&LV;-^Xp_hStx42Bs7cvIE@xcr?E2}<=D`ODsNIVe6|A^d z8+d4@q7u8-#O5j*VU@U)Zt?Qv_dn3T_KqxP*y{C#i_Mu!BT+(>v-=kt73=iX6CxmWNK}2>cXSB(fL? zaXH)-;{!#*C;L0XBE0*A)3I+>py=)b9q|kq@CEw(a^O?(Ly!n#Uzr@nZyEeJU!g$p z<654X-@}OfB8bS3>M)G_eu|%2zK7vpU#dXydjTG1ei?W{xdwjZ7cIlc?-BgW{GNh? zeYyh0F9;7azm4EG6Mp13M23;yBK*w!IFma8ehL)7yWnBw_Zs*ugdh3Alp%eu18(NW zZwzYTr$F)Jw}xhZ6D~5&%p*Ur4)Nn2I5WQv@I#Raf#P=wh|K)zz>nh*^5ZazVbu3i z{LK7#M_m^D6exb5z{AY%DEO)T;1EvndjyD?pN?{oq?k!MI)k7y^Wz@yb?~Qr95yO` z>I_I#?r#A<&L1ft9pUaUeh-76Dt~;3Qv8xo7|rs{M8E{W!T3Wu!d0LnoW`O7I5#qYH+elx-E?~0kEqw|$8eskiCxhKl!mUNWwzfgWb8fqsq&{(9wtw71Q z9&~2;#-Y$D`7Q&olJAx5yH0-N#@TXbhBfy zZzGcBHxj!3)!#Ei||vR_%NS|E2vb6e5x=VZgbh9 zd;}$jqRWM!xonZ2jvvG6Px*|pmEtwNqcQ$|RoO~PNk}p%zq)KS#Uc@aDqB|}b?hkm z53HdNZL|-uk8Z;XX3T-BExU&7if@&Zzh$)AnlEvVA>#GN z!s2viXJ=1e-**uIQ}F*?WB~jx!FMNl^Reu@b_>2zxKwkc;aape`})THv%RJ-uzS^} z*yFKdPq-#oTrJk2EvF7m&L2Ob`{KN3zT6V4ogUxX=WxBEo!+!**t3^*Z;Fljdmpav zd(O81vp(1LwyL#IV^?%fjCM9U_??L{`q*IUci>h0{np~|x*z2=gn>tKjYY83`nk;> z6J>=I1@<9TwyJ?wBvM~2uo^ZA$=rXhAx}a@BGY37yH}S~V3*dq@h7P#^TDuXN$vP& z;;y$3*#otAuWo-@tA6h2)ZfNkTJgr@168N6$~rAr957_5csi!KvU14win!XNk--fU zV_cAW!%oPDEoz7?q+GWJvoX61I!O=>s$-8p;c87KmzUV{I%cGA+pN-xyf94ujk~X&Q^ZZO4i~5#j=E#JaK2MUv z^_V5?^06mAic5XTmR_{n_V>>mTcWhF^*iTbZ`|0@vxW}kog*p|KVx9zhn2y{ml z9hkg*`);QHZ)l&@y;@ZMtJkHYv~S5qGy;8`CDij7rn3#)qKNhu16LE+uyV+DnBd3H zI^b=D?XydSsXw-J!Z|D754O-(iH4tTz|Md2o2reJ@=gLt95lRAHlCw}J4Snq4W|UQ zn}3vU_FHing^iT%XNB8=kKGJnwtaDU8%U7uF~U7YcA2P z0yuu+Ix6Qf3A9U`ri;0By0e6Pg7$*sPe01{faK3{ZyaXX`97uAC4q+atx;{YerNV) z|Dfi9k%ggkC^qS89qN4af~V||;z=*@r4lFaO(uU-EkVQK)WZ^|-UPLtE98;=3HwyF zPmJSWwNFgY$f6`D3Ms{z+5-PF%*$Pn(FMo^D>Wge$_5TZTOBUYd1ykSJOD8k`Bxi)z|{WL1^2Je zE<7L?qxUPB>VVjV*a=p!YBi?J&zVvzzc^JQi zG7Jv^ik}|FugS!Zx+#8^Fn)^=#(q+P;>SHH#4}{TYbJhd>lMHEKxfu>Bf=Q2K=J!+ z7{9~d$8@PLn{majIgH$|_v*nj2{bxl8=3m z;@1ltq@nWi8t`ZFQ=s_$5gx=dWWZ?fn+cryGJVCbFigH>a1Ulbe!FGnx6mXX$03T} z4PpFN!)?67fk@KvnH$D$or&KFNk=;-;|J1^zIAX6CZ9*f$-t9P4t}aUbHu0QgZBV_ z4dCZz1PP=gFio?*Paxt1_|bmM7sYQH2uVx61dfw9PE(-xJsei<`K=o5ra;jh45Q12 zo8vkKiY^}>=5%?d3iVZ>=pKWInQjs22D9JyK*u;4_z_y6kSc#15i^YZH{fUHw+#H$ zcpE{2j?Xm`&!7Wv)WlDRTk-1vZszy=dE|Rl#>v2waMHvt9&W{NH*hn*7r`%!5hRd~ zP>&z+4EzW&XrGn76W~_-mLtBI-)Xo9v)>Zn7xb0+n}s@~86j|KG}14rKc}Ws7eVYgQL5yYlWU@6TU))mN^uB;bPDuR9N3BinM- zcE!PBm^%#YUNNa|cwqPaC2^Oy;;n(*8%iq1#P9wdj{VwQP!fk3+~p+|I2)^+6Q~t9 zRO^&6H|mP8-0;0bk+#`#^9a+>>9xfiS*bIfh{wc__We*5t| zAkOd#)KrxP#-*2}k8=0*VeYwH-uVOz7>a+Dvq59d^+*PM1pV`Yqd^{9B-8F3=uv|w96LRd2l*Q%`dX8Ce9%7tub(p zZ`iNUpJPzI6A&lu42d({|B(1NJhLS}0#AYk4U$?%S2+0+pM@v+5}$@A`6`_870xt> z>v%E^;^axU@}D4a^5Hm5#id)})P*?pV7*rUX(s#{iBqQxi8CJcBK=f6XG)xYH%grL zPq@_-%!m-!iyaM-?c#GI*Hj z(7b87BEnPAJtXlA8OHY=J8;f5v(+FS-S^;U=Jz7pH{+*3@$pr0eL`ab*ru`ddgx%~a7t+jI|ym`|df4#17`9}{d-%zzaaQlvr-&yhA%VWQP^Vx6i zG-R{}Y+8lQQe5RMF4Ze=hi;X#)@CcNx0F}w@G1Qu;J+$hi>R@7NaRGm7z&4@6cDbUNC}<{`XdD55TEI5B!Ztu(<_>~tRP z)C=58I~!isdw#QR;R)yA6T1Gs=Wvx?{)A`gTh&j3Iq0gK@JaX1sA|~j34So+X!E`e zEe&r!J*UNaxJBP}(N1T5O9P^R>^yw4uD|7J{nNIEoz9+4UH`<>^O4^3u_xem)Tj0S ze#42L#MeD1oSqZ8dcKYF8>kW@@TiD_(|Dmq$^+4x_pMv$Jvpbq!hCXjBE^l$Rw&=Yrhkxl= z@@DUEgq7Y|TrR9s-PsBaKam=Gpkbo3=l6Oj!GPOcT`3YwV`f07`t-w(=`@S5lK!p- zwr+jZbHp82zw01XeEsP;LYLn9@@h}Jdw6eW^%D@d{cXL<*;=JHztIY5-*Y0X^>;i2 zQk+2*1MUgUO*2{`dBWRzixc*neKl09d1>21VL827s(89>_J0cvU;9}`zlH&KeD6`H z_;B&TTWf;O)}UVhVb7Lr3xDM-zERg7^mz7fTli~d>mj}MeTRMx%-Eocb?v~E zXZPXMhYGu$@Tu-DzShxzcrDK2t$Oi3hd$pk=Y*rDML*`gtoldIRrOWnKYiU(0gEov#1ha~OEHv!Po*{IWy8(=%s*V@`{H%Iz%s zesi!sSiE;}dC=Jq)Mq#KeC%LJ7maN34@J724%n^TeO0?(pABOoX{aoW+4Y9!2}e&A zgu1lr{pu$Xa+KMGVqNx856t|&F!KUWD8Cw@^$nhk8yy+lNIj|S`=|V)yC?vvL(q9R zsLwb$=T1i}1n6`YKdcuYa_BQX8Bn|vX-t@L;^439J6r$w^c+zSnmfxsam+cP7rDna z|Gc*ax_`vN1|yYy+yj08)7g-t>$fP~uhl)jaOl7G9DdJnxCN2iWhDc2uWp+2EmP9J zbm&Jthu?Rgd>wJ89`RpN{p3NKUFkmKos1_Pb7+|O8HQC*)P+?H-GAjQM^(MU6RI5L zNF5dOTIN;0J2Brss%(o8pqV9w#!s8`U5Cu5eR{*M9s0LKrgwupZT6q?{jRR}QAR%a zqodo|!!pu(+)?~J7{*imqdPB}=O15I3QIorx+mx?59-Z94|3r5&hj7WmPc0uGPztT$Ph8-eVw4IprT& z{bNx9npoCY0ru)oddjcXi=i*1sMO293&OEw-#^HbrRpKl{iUZhO_yyqYT&Ou^W4c@ zZ_o38qqiG&?Y*@|+Lh@ZH|cP~)BC6DA0h9Lu@OOeKUk$7_w=L>u*50%WimyS5K;4+ zgZdlcDV}m)()GLMeJHEHe%&LQu-+Dyv#a&;-%!oN@92jg^Ax$`tGD;Ew0+EW)<_Yy zADCjHY$CZXnOwtu+P?Lddh1U;`Do2v>SEOxnB2SlokV%JC)2HWy(Mh$``10f z1_!&D)yMT>WKz)S3F^fsz-v_RpF{;jHB$uwX82@)rHb5__WoHI>p6;EgQlRW{CS7| zk>@aYiN>wxxTEF;y?%FD*{6MdXM)8j&?rtUvBe)b^fV9qpiXB^r|x;)(NnM2Kiyn^ zroN^nr$Lm}uI7e12c!%2ay=gjcF%N?3hht5^DsKNuEWnckVzp0dOjr8G57fT7Y>q8 zbrb0Fb~(_ahDt0NKtVXB{)Ou5Ggala%=7cBf%drmg|afJ0m7iOMyRpVfg%(t;60xh z9NqOV2u)DmFQ~~=LX#tJ>lfB!wA2IzTy%Kn(Inp;U;m8I7_G%~%1t_sH>W|=(St1w zT^`x&p)PcLZtp&Ls1C(ggt7KkOY_Xb~o>9Kq(nq!VQ$L>(-j{Nr*NN z5{A0#b0r)nBt)|@xPZ=+!l;1!M_(e-x-(7s%)B1O+auR)Ii|25Q=k$&<=Hgr3-0*_u!#72Lv6EvE80%nF zIjr=N6HQrvr;bMR1o{@|hR)vpUcIcd2CW|wXmOrIe_iE)2~N4=&IC<%=&CIL9*Ue} zK#^!ZdKfw!cVY+T572 zP%Xm?$e#GyJL{jXF|}t<;S;LRUw2@O6P~5aZgfJTXDs`u=0~2xVBYOKiGfR}r>E01 zg9YmVhm;tAH=jOP>Pc|BXZ#R(U&#hR3{*~*I?z3HoOr_7@C&{5mk!W&9Vp{8NLgpA zdPAw_AXDGyIr*Dy3;Udhf2S9ob(}nb!Rv_n-M#f?^)(nah>pT z7dGnB3wJqccI&-=KpS0OgE5jw^k99%V2Pe`f8*ePS3iMtVFY8OURCqCLtpO+4Gs!l zb~L=Acl}x<3T5S3WY9!2-D70B=&CQ2?!nhZqG})vWd}?26l%VqEZV;drJLY(_5NPy z`xWV)a*zIc`kr!+lS!-h?B160cOCjaJvGRXdS_w1e)5b1ewFQ1E8bA64iBdFJohCW$&{59tM0Y8uCPq+e=!SsdS5JS!CV;*brvCRPBe{Q?hTK2)R6lmG3Iz$HOj(ea*5{_QcB8p) z*YECPWx#8ksL;J4xihBZUhy>lthWVeVTfr`ZD3jn?(s4?^a>Y9Zk$X`jgbaR?v#6E z^D83757!i%QVbb$J!&XypjZD$C^*oVZ|Jf^U#c&B9@7ZlsDEB4s2ZmY2lbtvn&*{* zAL~8!=ol`oe{KWKpvJ08>-CpC4b7^J$JqXd?1iegEu~4(9f&recQ4-&|LH_)ftCSH zNa45j)_d4KEL^59Jb)H^^uYt@Rytcz7RA83>ywjTI`kG#!>`oDM6=%TJlfs(dJG;> z#4z?2t-c23-srE-oJ8yTJ2BO>!6T=s-q%kacj(JK3zs>1 z{)9T<>iv@_AAevy#d~#iOX0U2p~k)e4dXJ;!ahgOU-aHTR{sbpp~V-Ca@R*a)sFJ* zXxAoG|G10FqNx`X0|!4p31xpLCI-+Pp>-22z)4iX`#cL*I1c{?>FQmWCW5}mUon2E zf3I+pqX(t?gcFl(hfV3?eX92_1Dc5D-kzO~nrHR;r<$1+YLt3V==%zX4X|+NE!&*# zJol)sw?(=~*AyG$rVFHdY42Zz%6K~#DmRBz9>e!js2my~2$f$E6J+ZLPa4OLN|iBQ z`bw4EQsq$BBUKjTUZHi99NC(+ZuT5T8`teD?AA|i61lv>QTTw4Q$07VI*5L+bpuC> z=#r{C8#X%nJI0Si&WKz_zaq89@MJ(n=ex&MKaPwpE&c%qIp|@H;lY!bB4??VQ#zOt z!TiAYbPSft9%^o4k!)#L`%qzvv#>?4|Mtm$=%IA^0@|$?a;U3gUVx36X}GZ4Q~#5L z%wP4+&@84d#b^OdX5rtrEnMpaJN-MJ!cBVXT2wpNhBeJUM{;Y}wj#OeZ}wn6?I*-L3j!L6};mQ9y-HHs0v5(dz?x*&Jv0D#{ns>*AK7tYMz;0*mx8bqx@;d)$6 zr+w}z{0+4`yjItL>%qvNryK9)u3545Bk8uje5^oBzl?DvEQUHd1&0t zj^bB3OnMB%5u?ZI;4lb%WLH)Bf5ZE_gTLycNmZe5?xbpec489yh<}RS?ZI?ND@(vN zUGGD?t;Nl9s*FSTiPD(ZHtL^zbY-YYH~Oc4xaa6~&HE0vH2NoX+%OACs_H*0udH=X+k0g-W{XN!1ZsXzwz;-LYphv<(uvhD z^M+KemH9Q-Eipms?8+)@NqU5RNG{e}FS+J#b8yGxC6SeJW2>s-{F>&fwB9(Rczx^I z7b7;=qT;lQ_Hk8~vYj~LJGv)|t75yXO+5CzFuQd_VuACex5oSX`Zn3b4$mkp;nj@H z*IJ7XWL%&8N#1HLDpK2IbA5)*p-Y@)f!dC7*nt=UHfGTvSI}A+XP=>s$tbScj8aqS ztg>A5Id;8XQ@TCPT2ZsE_>ETV3&q+77W1OD#x~9Vu)u=xfh-LparxgWvaH2H zUm(j8ObBE}2=8d&9VNUYgPDP>7~wrsc*hFwA;EcpEW7Z&Sa@F~yoUwz16dB?JzRLl z32$e=!B;w`+{==9dk?P2K_e#Oa1x#M~uC7|DXHpajv&W9A$xF z@I)HpPfoUsKdI~UX3fdDDSJ9UVOza;)oT5+%NNbiHQp+;825L_YWMi@{UC4h{@(_a z`u|<<=imLm%W(N(oGW$jVtrA;y|B#x0&hsTXz@MwE-6@g-?HT^?k`+fv}*O52iC4z z&#&ylMF|v$At?ub(+<_6;}Qbo2k2Gk4xM zZ@D$^w)qQgKfmlAZ$e^Ha!P6%&&UafP*^|J{|Hn3EkJDeU4-8l{P>Lr_btr9?+NEa zPrv@r7q|E)$87(v5C1l^@$yH!L*ILH`sMds_fgjiN#Fj{XYYOY_T2A$`Mt)NfArj0 zx#5Qqv%golzoF#Q+lPK}XH@B5W*s^6$D*dqdoHWH>x_HBT`B(J*R{yH<@k(}r&oH`H(olo z^oMJ%%(?B_8`3{}_ty#6JQsN7?u7gPSqvHfNAPdh^L+)4E#chn4^4rfIrsZRxq(*3 zKldzh^UfK@58u;0M*BN69FT$ExqHaDqop6X$6MVOS_5y3HbvVcAMnN1Kp_->Hp~IAzlDQ)zKukJ?+_0|x4>;WhYxi#YkbjStF*lh0BxAWl9X zA_3x52j?;foT9#s#OTj&Ls!AB#C6~Vi`0d(sxwa~09Sj_b0p621tuJ5=K&Nm?X5AL{;6ow%$r)J>h|OL}!br`Q{hUYvG_m;R)kByrkdn#5@b zuf)mYT8T5w>m{z^Nl>y0U6@e-rlHOYU>X)O2k@cJVP_haOX+KT$7hjMSm>n-ZzF#% zHsqZEFUF-jlO?X>$$^R5pHCAIrz||Pi#TN=YvPpUGKnib^kYA%Q7h9r{l1u2qYd-E$X*T4A5mUXZf?)8EjSy64i% zt2s%bHcX#~=-ln<=Mv(p+am4{KR+u)ajv!nE3jXC1@>6?t6f-h|J@i*ok!^lMlil< z?q@~g;e%nEJGyxJ-OCI6zkw8HWe5-QJZDq-xnlOSya%>B?{S@jkcEph_yL=RMbPV> z(1E0d%lxbFxxZ-nT^kk`-Op1tO-DSOYyUNc+-QFud-aPnfJ}TceJ(4U)v)5LIhm=> z!$_RGIq;;3b5oN<;U*HfwtP{4ZVj^CO?}yZ_o~&22~geOfeiIt>Aj$}zRFCfrC$$H z(IK%pR)h&uP4n*h@1SH9)daw;5d>=o?G1I9qhAX^G;u-V=T!RLO?bVg| zF?rI_y&OL?zcjcxCQzXGErAE|3>h%f#1CC*h#&7*G4s1ohRJ9l`91-incpoYe&}LD z{Qf(P-yDR=Zb7gl4+8f^oB1s?@k2Kq;w*mUn zPJ`KRa~QvMCVm{7FkR+H7k*~@ZG@YBhyo>F3p~tp<#4mlSD@%#f(P*o8Svl)HFDv-xr@>Ew;>SHvW_}qc^bf+1^2N(AmcQZnnfcuUetg$Zp!i(`4>P~lO#CLu zF!H-q>YE@L*kFvQ66b?y@%JtK;SoRUtl zI10}i_$yHS)H$t+Zk@Y74@s-&?vgn3l+XmaMFuMVl8!%~Nyevwaq$W>o+>N`37Yqx z%tZeNkwt!xQqlbfJe6$pCqEq?3|IA>?U6Wp+t?;6w!nVX{*#21^mOC0*00`w^49-h z%KiIKo|4iPzk+?30L)>px2){zb3LYQt;N=oXf1Dp&GnR4+dgey1YOlu*VAyNVNw;Y zW{c|?xOCh{30IfaWO0qP)V7a+%T>l1-!gGNAdVKiyKieP+&wYc&bZt&A}yxJbW=8q zdjT`uBLeQ>rS5<`uGATDJ4?OzxW3efsa)5$Ewe0JGj~Pw*tERcBR69XniI-9<7Qf1 zuM5#4F(HkxYMbkT5H7mIC)`$hbd%S01w_(2ob;J(X>#X%o7aLhxn2JR?FdZcV{&A6 zzpxZb$R&_L{-k^W+t_XXzP_E0!bDNpov|>_&OHLRkJuDZ>vyJBTQ=EXrk!oV_mK#A zJYuVGJ9lob*{MHC=aaTw5es&tjW z6ih~m9`HLhMa28#AoWh4pqL&z^HcDy0PppFaNP#3rEgZv4Ss;-zl@-#!tE$tuOp3{ za7ATY?d#b)-6G!3PitSFv(stdAIy9Gj$M%gzcv;#*%L=uqmngO+^_`}M4G&3U0ZNR z-h3;v#C6&d-0Z5eAS0JNipwmmSW3a{`RzmCv5PbNJ4Xinm2-^`A zd?GYLduGfk`%pj9i`;8L=DTJ`xw0bX9hhbxipUJUMPLZ2kC=BLE#!Tz@}6O0{#>= zZlA5gk63v#B2=a8m@C})G1w##NTTB1Q~+&>MCh-lF2+-R#B_ova-Y^ie!mrhp~)dYfkIRxUuM`C=OTh7W>6np&aL)&Yf7j*!|SCkahp8HU?VFUZ<)U?s} z3?ByWn_*X0F;tMud#5JcJB2HO;1M4`MLwsB=j1rGPWKC=Z(#W&fOff6TqG>&Jh;2Y zAknQ4_`o?D#rmb*lk<=rQA{ZkT?5kUJu525OH+Sic(O9yJJss%>zf{>lF`D`VZ9_d ziQO_4<6c(!tj3v24oRh6{hoCXPQ@B-~h=#Vy=|h6xB; z?mxTbA1qF)To07^t6jw}_m`2B&0+-cQ;(5X;-cu@s|r>IY921zoZq3X6#7NuVB%u2 z&X2NP+qPQ#T_XNwi@&UowQYBZzjMUjY2q(yW=EW18ftN8Y~HOCwiXHQ_-eq9{O1C{ zVV~D?%fMus2yE<-)#Du5w&e;jcuz<5pNyd-aZGu z`(nlNHua4=*1j6nREB78%l7f+V$@cI-s)iL$74+>8GC4-gbwQcw}^-rn0PE1ws{Rm4_nx z{SHMd?w3cjw~sj1j!Gahax*O1&9(^It+B$hv29w=3%OmlYjZUXM?iPPDK^Nrrj#9TgEGEvy@H?X^SQ{-)R)}puf*<(t!SvEyZj}A3+sx}q3^w$~X zhi@HbZC-AxZR6d`kcl=(2*giz&5U5OnXEezsJ`sFpxVqN5 zjhrCZHcYsTu>A>Ix~PSLQvcRKsn31@iIiG=;*R^$xwu~2J#?+>`q*IH(5AGNyKIM| zj&3$gc=-_eL8^YQzeTsVO<3Y*`=s*V^{8v3{E!Ce&-6h=QMlJc7C4cN5W}cz8z(RE z&UBZItjPPBP4S3QJRY)wW7Ikya#j}j#TFxH$pk^j)fg?Rvv0m7WTfel!nWqNYcSi= z#;`B=xQ0jJZfgGmZ-H<9N__aoVU)Wzeky{%9LLK4!&bSn{Mqs=%C@H^cf^%kip<&qWK!pC0g3DT)gmZ=85f7{4<@k6C_^@ zovXjxkc>o{ycp)PS$`xpZ^_vvf6!9AwROW|Wu+AzU)smi&eA$ox?a|X@_W%HH^`d& z8&4OPc*^FwIa!$hwVMqhL zhG<|%{$t^H?{@9C;JSj!Rrv6zF;;80Y7H-Y8Z&Wx{Lreg@p(JHtgzfQwyMH+S8-x1 zIVYZ;Z;AR<-<=WrJNrZ*YA$~mtMBOR+c@*KCcaa&YzxM1Z?fj%m10Q6^_uIkXnwRb z#cQ8ZalK`Mdrq)*z3+-i6Vqk{I=-l=SyVOG?%EV_Q_TFi=(hRY6>bKwYIz;n(1#|D z9CBxjYw4FLZI48{I;?m%ANnAqi#Qu}1~Rn{x9bUQY%Po zUx(yak$H-7Ng#g8#L*-2M%!q2(L;7e9*;U39TlY&c-OnvJA>X*i+vav7@^09ogG+a z1}!U0!#qZ?3_&`3@Ul7Dnwy~2#RZ=0D=Vvb{$iTuN^S4TS#w!Ccly^m15X9ZHV0$y zcJtJOWt-Q<1fD{NyCf!5U0r1{_Q}O%<(2-Xl_lx_wR7dMwuMr-j=5qil-C@wer}*` z;n;OcRxZ5_RcVW-(qEQ-EPkqwrEXu;p-9xm2)x=@;m23uL(zx`kEs?UbEHiNKh{|k z5WIjaM@P1>@hOgD(8!{1xsfj(`=XE!O)IAl9e?ul%9F1+?W2pI)7#th3d_PHcI{ZC zcKCgMZ#uSfXy4dd^LBsP-nOv*`3`@3=a)Z!BEmj2*RC~mwib7;I?}eVt7YuF_MyjW ziq8%$8m1NY=_d;p_N;ZBT&owZ^%bx6H2-{T_t4I~abGsqqi_~)#jYn^-mx&BIh_Oex-uo-^wvPSs7Fk}+^*O~K(;amvVwW{A zb&4DBfs-SajA8a{VfLgY2cGhjZJrr(tc^8U3{I!V=Eb8m7VapRF5bXCMFV-p#dFOojWVSl3fuRJKhVa?$)fj}Q4` zcIg$tlEl6El=S3-&iQ*v5?{C?_+&)MPa`wF+scMtw1JU(y@zbmhd|cg=B?}icCIXC z7qHVeYi_zfBe7NgZfn^?Bp;DEOB*`BZpXgJDQ$;gGjux)m*qUL2>2qRK$ zdbDE)8W7b)$byD;CfK&|^M5(7Lgf_iP$9gZ=OI+)Ia_sqU*Ebm*JRDL%z{=XFUE3I zye~u^XA_S%qZDmA-a4D&>|-z%L`H3l+KKo4FX;gnI;Cxql-+3jqGwu!)t2KG%wn{O z>h;OxinuniDGo(oR|Fz9#o-k(lH*I^6b{$pmX5e-V;N5jTt4Un=Q<1I$bBF0uTkB7 z#=DF$KXq*+#;1NPdGykoaYRRFkJ|sofql1Gcl0kf%4cP%-&GMY%ZIOV*={3&n_^d@ zZ2sWl#mHa$n(~vEbwJJ-xcY)hJI*@CbKX+cPc1242fwPS@ z)UUv~%eI_DqFK-`hjY8My-sxn% z|5Zcz!_-(=Y|!^CLMCft*!y6B-Z?CXlZ z>*#RbJKAz6;@(P&-GyYX*uMRmyOvHihM_MX3>4069l8j1+GTyieF$Un5B*@r7ZO`{ z)DpMn@sqf9NE?z-T>faSWn6i+qrx|?;1!O#F(i0=m1Kd><&CNu59x$@g862JuTB*{Dtr~ zUhj9I1A-{_$lJ#3hBb40`{p~NJ`$BDlt<=_k+@NZ=8CV_MMZ_3Zi_CkzaafN{N>>=@*7HK#SVBo+G zQ;f|vVMIX(cwyL!am94LEh>4@R-$OQ)@gY;#vD-~ek$j^>_d**(0Ct@*~mJl`cCkW z!#Wk;tnPq$nsB}amgUxUXan713dO4Jbh@go_A$`dikE3vrK&{hNU^thVf+tx*`*dhVVtcxza~8ju_S>Agald=7fbPvnvxd zHtJKM3zFExS1RuPm^5Y&1lr$=b4AhSo9Y+dU&8Hzk!ws|rKrGosbxE8ywe=#lo-w8 z<{X>JAm9-kUK+Qx7E^kmjKgw{oYX_U9TfEUrjSy zlcHYt8)z3y_gHWqw&={3|9%}fLAxZy4r9(Yva5_ZP`x^=g%=g zzohZiC5G#_7QXj~0{<*#1eDYDbJ54LS!am}Ts9?;KP7P4)Ik1Jd-N8y$_5=>^Teb{ zEgA;20i0B*#S`g>zhd5^UCg(&i#ay2fVY(-LNY-l=0e)VbVs|Gj%(*M-2h{n?5fbg z%AgAS|HU)KZ!2muUJ+rGK+St%LeH2U7xio0(6+ulWHl<+)s`vIy-0$ z!e@sKBz)H1Pl&0ie!@{h2NI5o?I#>zCM>};nxX7wp(ljDEgIsv=4m@Lj&TMC=XFJd zc^tHnROl0^c}+~z?!nc3C15ApR25+lK5wy~YMVw|MT?r{y4`9Y6^agt4H;Af!^INn zs)#g_Snpqtf^7&a_yu<0E$>K&c8rs?&zEgJg+?B7a|Yki?#>r}nB5hkv85Mbt}@Ba zK5G95eP5raeNf;_h(k4e8nDT+@ai0aW|h5F+`h|7kk{*F7^!dXN&!caW{e~)Hke^H~W;4HW)|M_bGPa zWcKK_)z6?BvYc#N^bp6mPmG*O!o+keHL1&r>>rY9w&dsCA9$#8w zHvZ*!l5=vBQ?pWXlXH_(JSn-E$=OMnSt(iBiQw)@^LTy9Iq6B6nW?Fnp44PdYC>Y7 z&y$&zn(50*%Y`zj=~@=#^yFlw=4NFlq$MXLBxZq&&zI>-&dl~fse~+#H_MmpP0#Tq zr6u{&Qt?boO-)Hm&4D72Gb=N}<4Mj+&Ps*pac}Ic=2Jw1wlDsKti4ZN3Jbm6Ak0&cJG2NG%p6p3O z-X>&cr>FSRVGLh#c6v6lD=piXl8B5>@a1X=No1LpoRpG=JkHI|PV^*tVBm!0oRlO; zosyE}OG-`1%t}gvU!vEOkeim7%b8^zMJXtA;NxA9iK(n)v4KQDh2O+5mS*f|$$>dE+@S<3x zBw@o-mJb=2fRdA%mYL>FP0UQsO-qB_(^3)>5|TWrzFco^PB!GuNyyB}Oi4uqZ*p#8 z4$6)fcNc)KHyP&k=A?ZtMjz`y8`C*uZ|C{|u6ZsJopbkIlfGUIKN)&2bxXH;0AK3v=g%xo;11|7VyxUpp>8Hoa5G&#!#@!G_bW|G|$00gvHl z)ryIRz!ti3)9|usOG9BqY}gg@+AzcG8-oApu<)WVcX;>%Vc{FX-2WBkE)H`C!rXWf zGl5MjGr1`5_rly2VeZGZ$+G_Nn^tS+hEaperd5a0KN05sQJDM314<~r6Fe=;BMIq# zDuS3MEY1CJOjiNJx8Yku0>7WoijTF-{@J1X7$el!km#ybeui)-X^({I_nDMe#dn0ccS(J>iTG)l?<1uFl=sFk zen-Oe@rTi`33FG-{N%pRIPDs(CoKIp!pdKhq^AT-e^yw2m}?-z?~&z)BiA_G+VG<= zd2bA}=O4n-iwFyUCM^BZFnxxEg}cM_X_xY_=EY&x^CeM009p9OX}4(iN%vM!zUOOG z!sIz1!*3JxcWB>``pgmTh1y%NBViJLarol+DJj3;g4d813tViMu-y-o)-2Z?FK%|=?P-9Prl!4`!A5IYX?Y1RT zpkhCSg#`wH?EsoZmH|H0{#*>_1kQ9Z+7md_87^@aQ?JCyJ5SB{ozlsNgYEYhFxk|eIGjm2z}Tm%9p;5UNAfQ9%GC!hNy zE`ziIab=!z1UN#L(OV_XxVKCELUDyXW%*(;908nheG+HfLX$sG%`%&R4c*jOj&UqE z3U8xaNo6_u9B|LH%t!LI%r)rE_7vrT9RWbdChLaK5jfKk`)7fZ#}xc{FEx2wCvoz) zLE@w*SiWgIMY>W3k?t*qzetzH1BiMd>kyM40i1lq{%+vp!BH*!$zzVh$>T1G51OtV zDvETajv_5NgcoT6XWWtG1Dt71kT~P9+R#75-)ztM2m}cJvd#*zg&wqsh>6nUwTg-@AV=v1 zi%LC6r6pdF)8eUGPxWurN{e@G(ch!i(&m5PwZCs>&7PSg$ND^;^FQZ%X3u`tTHkut zw=R3_wb$NzZERjCp910q_=C*Are)_H>~8>o82hEaGWIt*{>FY*4#e2s>|kU6C}jnCbYjWdbvudcn*KucGMBG_MxSH18M8G!F=7ntu}P!=B<5JB|Hf zr?G*Z5CmP1Cli?A#vWkWL-8(l_H-)`ZSwMyFA06Bn4e8?a>pQ};W9X)`x36Nebib_Y{0^Hj(048hbr zPcU{)T)XYDQ9z76(ymPTGb0e1r8fJBrEF7yGg+~a05)Q#WzH|aw9E9Lz~uh1=#cvf z!9MIS=5YZXmf>>2OnR+grf>2qcAETlz!PF@7JE$IzvB3tb1pFBO~;lA%y?CTscSe_ z06+|9r-N~bdNO^E-&umGYtGm3SMiQ>5WCmRF%CAIcG*h1HFmNQK}>tjbujbkl`=Qw zEO|6-b*!U9)l6V=n>Gead#@LNa_40PI<*lhAH$FIq|v_1M~ zve7|s*c;5euvqC&zWJ8_5)0oTn0b6!ut|sYg}6*-m|*%F+obK8dif`KLcWA8^Q#8( z*#UzYK1DF&l?kS86nmVk=Mj^(l!M8mwA+}rDs9+Do-4`bymOv8(ZOhT9%80dESNT2 zESR>La)1ug+$jD`^I5@6liv*_59?^5U>~sQE8x$1r|5aal+R+vFP;7^4mSCcbBD=S ztK)C-CFc&Nq34Ssz?o+{Iy^*)$<3lCCb#JyfXU4!LVt3bb1N{puNHrDZxqZj;pY7o z{vhPaoMfPx%_a`(taAKKzRqwk^`q)bjzNLrdoip=l~g+KG?-Qf5$dA-(Sl3uyy@)IL)4D?Asd^&I` z@pSw_%CYIWxSE&^5K@cHyWBuCK4DzGbI&^Uu5|nt5X*7eNDQ4O=qwi82HZ-_Ku9|_ zZ(xxa*<6hIpOhzgGOW!GArm)Jqrf)%b&?V#{P{*?}KJ4!ooQ?epf^)D>M*UG|BCzRKf${TX zia+b^G{MNGXNq9f)%k);fGY%-0tW@Nei{X{e)#=Nrd11krC>kswSrkr-x17m+9r4& z@NU86;d&e7VSTzq}8lVw7TNTG|Fc6QdMEBe`F>(3Dgk7R6OG zbo|J)6WXv0Yr?H^FM1az+|r7%D5f!nVkyH5l38ss+|VukzR39ygryqqFtbc?X~z)v zyW$@#b?d~CIJMqKB}6I2M0aYtkLXbfG0~;XHLP$~pk3OQlI<-It~7-h+YV@KYFydi zc*k1_&#Awrj?l9DruL9L+0sW2P$Th`V{+qYN=Jd7YM|VSV#FliDE3bqPcMed%9lLA zGq6I4R!%@0$x^g>f+mjwP81_10Y|Za+Gss(AUthiamNr=Pz*O3`gNc?vi(pxA!$hL z&#`184%~LEcZhhox@@LRYF5b%do+TqMH_WY7Ob#%1rkjK;}$h_;%p9so7y^>EV~=| zeS5B^sp-<{@Nv;zzoNb^IxLbSEJ7ZR)drrX&Xw(9kA}{Wtbv*M0Mau(d#Sz~P8>~B zA~Y6ToM0`K#2PV0szl+F{s8TYryoP^G^KtREhViEHZ0VeSvE9=l$FX5Te-QV6^onJ zFKt}bCS~eGThttCtM9nfUCv?erOP^-a%WdwcqZCI!=+J_Z0xWj%CBu@Ypmb0#u&f) z##lcdC{cWkp{P|(jlnoT+E?O`SzO<-*kyE7kezokX2qJEElU^Kd1o7FU(tldjFE0@ z%hJY3xZO-*RFoQR85B_+%*v(Vbyedm-iq{aG=!p6G%01JRZ&`Ts}~1WeJgU)+Im@A z2!*)e(bAkr2(z}3Ts*JtxbtnevMU$$&z%0 zt_oFaor*GDrJVy=NLICwCzILc70cQ}ovYh*{aBNjDT_8F)27~9?skY$nFV3h!9y+D z1MPA}lk&vm#R}6jl!_T~f@5N_I;3HQ+Lkp&u`?Pr)18HT6`ZRhYMM}AnrZ~|)3Wq3 zrV=Sl_~9gE{Opc-HG2$qtvH@ax2(l!OWZG99m0CK8e+jnQ*1XyfEuzw8|qtImo?aj zrcy9J?JIF`YN%#3jskRZp@!qUvwk7=tJ}<8mgLPXXGrdJq!P78uXFJ`fd2!-_*`N{ zUiN!DAHh!r(*i~cp+wAUYYL_Zq9jFJcLBKdIRB!edba@(`z7EICQ&#Ca}PG!!!X9X z0>I|;!;kX}D%7K_0wDI&0XYJ`Z0yN52phx5w-Iv&Hs22M$Ib}#DAz*I<{K*9M8 zd`}7&cgpu=7hk)T-;*r9OAx`%?=HCG*>@5A$?eBRxz)1oWVji|c;^Awe2>C?FZ@-g zN0|;l?56|rBg;O{<1>tWuK?J5jW~GX+4p~3e9u_+aXwc0Xpha;4nCPWhL)qp{lB{S z-UOf4FYoCo->-1+*?dRA$1oMezknXGUjjzpJ_z%{_JUiuVZMi4d>?}E1c}3)^4;&^ z%eMH&SbUe^;Ir);jD|fp4&QR<+4kjGd}A%X8W&#%_;TX#Rl4|QfKS`=IE$|p2eWNo zVFLSZcctr3ptlE|m(5oSJrq?~wET`i$=0ieUS?P;QqCVk$u5^#$SADV2KkI(z!7w*>%fv*{E6)l$y zF1}-yeayGo_X7GCo38+coS|f*M>nO>v-D&w-4beYG11BI6n$LEx+@itbFebjn40W#N#_iD$4gd z^oacuP=foOT7L9XzOSQSw9D@p@|7)dxKqA)(jWUJ>{0NkeKSQ5Q9V;!d_MF`y%L8z z<;!*PWfVllB_*OqzCEt|`p_=uucCYpx$?UPeA-XWf-?0OZ;Oj>BKXECnds4Zmy7RK z@MXiF^~-)n`I23H)!>_ma22)h@90m7{SvSTd|DqDz)$)9?CN*dfRFEpsVLvuF21~} z&OKGySB_2j9&y#j`Y*-rUv|6dV>kG;{3s)-dg73R(oaoVcjf?LP_;3iD@~aj- z)(6jfcKa*Hh+n_QLC-F~W0rk9KWKj6aoOhwUopZ}wESLo*_VkZM>2A(s>gA(oIJ!R!P3H`gB-_77-y{jl+2K0#i z65t1)w!d${Px+3z?ArmpYKg<0^1b7-Zyxxv5l;ISh#u|uWpcEApMXy}5FEw_phtf{ zJt1qr$N1!1h>c-%Z*lP*1K$Mrt0?zfF1{{{uMx`1cLe7jyZo|o5#v)b(WCSC&|@4w z9gthWr|qv9ZsmK@#a9A8zQd_PJ<5I;-%H?I0DtCpF*fD9%f+`n(+Pu$5#_th#W$lc zQhrOIseGL-z8&C;SANS}e5Dp&tHn3P)t^2CzKM=$QTFA!`qNtQk%#$RicRfHb@3eo z-|r2R^QZasy7=~k??$MQuN|B6{nRyXf9WKr-8*cNvV0hNjN_MpYCP|w?|3@6f8KeK)xHHiA#{+iCG##kU!J zd?!vt?K{uKcPsd47x~s;Q@%f?N82|77v(;Lt0>=F&?ELsK>9fm`*>Zgd@s283c+`a z#Nkf)u*_r>-vaP0KsfDNi%t0+0%rEmT^czAJ{($MQNH`(L+qE3{oq3qhHoAA%6A>G z&G$U`aH0Q0wtU82>417pZVQj@$p!-`6hyI z7yMMzzTd*b=9`FvZ2|nq*Ck=JkMnLe-%H?&cYK6g_H6{8=9gv0w8-ao@x2Sa>F`%k z`_6IkZ3mwo9~+^pe2u`ieL17z*KbJT__3!vZ`t?Ha4R3n)aJ_r-z$tDqV^TTP3#x{ zcP+jfC5-tEy85e((M~*xW;lo|T>VwbxsmpFGs4xrX)Zp#8^Q5|irSa&;>)o3ZiTY) zjRdgs+X+6FuZr@W1VHSUfYIRFgotb}w_#%#^ZS?NXg)sJ&N)yO<@*qNHs9{^(5|3I zzD?Ma?<>Qi`Hp?X33Ky}gr3d!gg;V#cUpYMyZAgl=XrHE-(VNtGZx=wi|-BLn=Aw) zeOQ|Sc~fE8a{GQQ#% z`q}ee>HkK`q`$LT-FGz;?_03 zuB$iwI4m4>$Kjnr9(nfFGO0nW-n&&FB4j9a_)JO6^N2eC+a&kSR_Sw)u!p8z>{xO=%1ciSiFBf5*a zpWQU~+EehoA+!Et_wX6>%#xqob5}jEbI_h=O)j(UOy)<7wp^bvqYNviZaCXB>Zgy; zxhem;ZlrTs&y1Z(W_4UH9(?d{my<%)V}G6XZ&;ap#$!FD`-Z-F_`OuKL^;g<;AqaX z6<8y3#=aycfnTK2F%)b0&UK7??oSVbbWoV9?y>iF4$65}^qWTxfpLdXP~(R-NK8|b zb-{NW=g_XL4$;iF;eovG8+!1t<8#_uqe{ANTDv}D(^WaoUOPQ$*2}a}nCss5NLH~r z@Sdd9Cwp`1Q#YY`u=r9B9+oxYXWh~pZc~W>*44a%ZS6^XqNX10fU94cuf?GCqygVM z^8d0O8T1xDki?G$WPSR#g+1wGnAWRFXbW5@17FvmdtcfWgOOpB-ikp8z^661#wncZ zu=r;BV?Cy=IZF-K1+gTj@nXIu*Z6FWvpU_=LnRY+fABo!EEtG(VYHwi>!%^*L@OLl zO9;%cAHH$b=?m@P$txCF@~PgH2rZ5}yB=L^YE+ z=ko~obVp>3~;nl^E~OJcJNbChJFn>7w(&>v*{@pWCZAfO{(0N`bm5*>tG8HZy4UJSdnFfq738cOScUuyc22R7r zioT0{q`oePTii7@t$N2XhqjptdK9#&ZF5wuOvwrkF=?WN%{PaT?8E6!6UGNDoO-Ui z4M#`{451Pa8z?n%d0HI(9lE!TB@@WV7ybc>&R1dTD znvMk2S$p~J@qsL}X8lS0c;GuJFga^mN>&HyVFFGW#)N5Tyi6`)R2B-|G143xXrayg zoYJ*f$HRtev(gs+=4U)wSPa@~*#@}qH>vn>DzonLqLD8hc)2$zc~IJM#}7a8es*j<7;pI`Tf6o z0v&kvs-vT&+1JoozjP7Ta_itiag+0M@p)xm&f?C__KveBO#$*R$P%u* zc8BHWc!$qPsL*}BS6$9{=t@_3PbAokm&RK5GyY_kezl9w>(YPErN7g~f3qvR&gDMn za=#|&&4EAH&H6vC@Dn8b38ceyv(`y^-Nt>q=Qaud1@=msF!S_R!OYXCC`-m=p2iDio_Noh{v0o# z&2+FaPn4)KmvS~`E@jJ|mKE*R@;7BJWkOrMm>;6hRxKaK)pdnoxKA+Cc~~&hp=jG6ueJwczto+vUu-k>OWiT6y7mxxiOIooBqqoCmVcGy zf2m+{e@igADN*)FTQ&CZ4`OVPwr$FgBoI@EVslIx;vNl!$4sW&ubCs5x)%v1RfAwA zXY7PN{Vx}Prhk)Q>aZUpCv|=-m^vQ{rp__J)cF$IlGrd#F!N#FnTJ2~(JcP7?Fqq* zOVRQnuhtjC^xb|_K2i>*e5eR9Wg_M2gIn8}smD}m;C)bRx=vHRU~=P>XZ*=MPcXS# z1v7~?f~jxH2b|QuNBpV(Bf-q$gM!&+_F4Gf1k>K%2`2wLg30-*VDj+Nl{S-SxL_Z! zIey{KbUnFz?ljSZmf^?y`+jLAj#|vqtT8Xj#CvYjQqspc`D|*ucPRL{xcv?V_4K_8 z`+3!cO^uzc9eh|e@hcYQ!R$Wl`7AGGz?@dTKas$eaFNN26OLLu8{%swDqr(FbBClF zk1qPH41M%9w>*T0wwHEv=4!b|7Z~2)$Q5c;Fa^H2r5TUBdvg1DC!nzf4;H)L3HV3e z6VP`8q91g(t%`m$8x_&lv(0wIMGcMo7&xAz?+h(&YHi2hGPfb}@Up2=K1Uq=JTZ@= z0m&4ci|`9e2F47$7ovhg)Cl+7aEKZykiG7BJX2nRl3UMjLYzOVeFg!)y3BdKaSBj`z^4|hiMA4h7G)pDBpj;MeH}eSZl=Mb~tMQ$nQ~v`92Gnb`{9-95VA+%kG=jZK>}r zT5->t@a)c?>!D%YSB)<1UXJv;>*<<{`Q|b8y}hFfvR3dL6PP_o^-SN|@&KsJH{8x0 zT6f~m=Ilx9w))JsOYp&~w61*E+lJ}kJmZV+Up$?LX(OmMq#f6s^^teOC%rQ^tzEzF zCVbWL5u~+t{g#86j>&VBPQ;`OVy0imui|!b)*LY(Pd>PO|N3?K5aJ^yXd8k!?_4)B zDeDC9R^0M@0IsgB6@$kYo_^rD-ccpv3z7~z)0>{0n(QeYL+eEco2`NUrlMznfboXrjAbE*l~?#`*i7ithv@)-_qLDIMh?Wu;H^5JeI6m*wBby6MoJ3 zEy8axel7Sd!S7Q1TJdYcZz+Du@N36!`DaT_V&U*G*OGj1;QM!+H*I$6RZI4sH*Wc= z>c?6)Kl9?<>o=WOGWwk7mhQd(f~|jamsZvW`Z?|k)lJ168f z6<{TyFJRV)>kO(4WX|YAQT`$JUYw0@5x3JP9&fG>=*9Dn*R1L%3fLu^vykm(tcWC= zvx@B=7WKRt`gdgOpZLkEgDvGj9aU z^CbId`tv+eNG#_SlV2Vz5R+eEnnyj(i!gnkVA?fSF#VVob!bbzVA`T{D$LqU@n;#b zT~eR<-Xxg$en~LPm8THuko!2nwD)Ae%tuOU;ww*{?_w5{a9_)~l`z%Y#`ooQJa59C zm)oOXWOpLUtL#`}rma2l0w5D+2O3(qve~>yt#1Z~13FgXW$6T0JBC@`PmX#GS1+@S zh9=;CIoAZb-e7eo`D!Ty93dlTfW;xf2bKV^0-@+;d~Q zq_DniVLPHUK*_DgwxptZ-+&UaUjp{P!G4g_skDb-Z0~bie5LT4jZH=QX1Vx2wD|1n zms~`&?Yj|frmLcSr^AETF9CTV*$qtlaJYu;qm4G-A-L^+RQWWHAK{cE79V>?>XB=; ze%~$^<*O7u z(xwi}rh_6o2)uHJ+OMq63V6ixR$0L=sa$;W#f3_lJV^TGZL zN5kZ)(;_45{>Ie>c~b}c97!h=f;eqI@pB~8#w1;lls@93Jt?RCc;l%@7dm5XemxOG zJlubmd+UENqil1p&-r*`-D75yjqxl;*=I&Z*)qnSR)hxtNMXKJhz~J3=6r7d(|VFB zlG9TcWe!3j8!+(3czf%%?Vj|L;5JrgU7Yd#p85IPdi)53jjygBK5@v}?)}|Y?OH$l z=B@a6@qTB7{s0H@bAuSfgQE!de7V1=Y&q^Cw!A;8IqPN)+xOHz%{#L#&#pcU#(gPf zu#8)tS;y^oe^pQO8DsIK+PO~;>MBA?6&QZ|aaVNEtLDyb-H_u-vOe^te##;Hbuwhf z^DWnzA-msEO2uH`zmAsx9J1d87LY$YXz}~IHVogil|y#t>HxMKXJ;n_m3s?w+@AufJ~2(er1{JEio&KUKc5a}ne3U6u9o8@#`IyQs+j%Gd8dZS1b( z`g?9W`J0<}XY|&8;5lh$_P3YRKbKm#=e7OgZ%IFI!Ss7(9GTzPJ7&>G@4ol^DZfkY zdHSiPm)w#0*PE}}`qUrRzi{57_t)N8y8U+Fu#~pxhn^Zf@tK(`o12?f_{_Wh_2z?L zdZFT6&5UdO|K@UrT^h$gyq5VQu18L?I>dookN9CGWto?K>G6(3{&~GYf64-EUW`sJ zigIUqekyLBXS|-Q@I7muPrT*}2>>Fo*C#Tt4Tp2|8^q~7!F82*C_XjSw-s7%8Twd?oOd<#`5qSNQYLz$n54z%?=yK<|+jVJx73^DddlQH)2q61>=aZERP;&qToA7S28jEZxwQcmcj=`T&eM=S

          6&Z`I^Aj$9d=>`1XJxx|l3snhbvy*|$&+@pkKV170;6d6G}$xn=j^?i#m1)7{AZ zcFvc~oepErA;Kan;-PmsyH9i;eq@er9X*>j0IyH%i{1O zAieZX>-%I#FJuJYe8^|kt=Rv`z*~>L54j^NGTEGX-kg6+fy-d>uA+6DSu~BZHr$FhucVuR=|JgW~t@F+*k>tdI&d^o~*H)c#NE0uC;YZ;x zvBB-AO*IGPH19ioYG>HH-MRR9o2Ir_Yd0xpBrVmemiS-nYa4QwBjd?k;qcGPZo6~T zsph2D3uisEN1nJf90p`fhq=*{RazQQEf&AU9JEM17SpD2-dB@4f9#Ullf0U#O>=c> zE}uYvuWdZgu`tC=b>=;m9#|m z-$wu2i^*Pd`gcn$MKeo1IR&08HjUl?OE$rlpkyExB_VZkW>3;XCPi3O7_`98wP(L?!qzUcPakR ziLMc35x-7({{_z%@Pl3`!JwN1)_!QlGkRKf%g@ZsvnA4yHcCx!dbK2fLXvbi$@`28 zxlor~J??H9XC9m`weKjZQr}4SZC%vr+aSlwDT{}E{c?rx5MuA^f}FnE`PK*Gx5o$i zsa$xrBpkI59n!iWxRPKh{+@HbZM*eAT+N4H4b|EwNK1C8zjCUzNfld5Yn@9!Qu`}> z=b?(Xpo;TQ#YetO#MPIiW+wSe&+KKY2#0$&oQ?a+3dEBM%4-tBY}s`qB7=*W)y(Ak z0!~VZs-xDER1{7oG-C=W9G))oQbf_Ga;&JPXM)Jr$jiv;_}_yfkMhHd{Oyloi{PV= zuBmgaT8nL8E`C14RggCWd!Ag`4I4MEe{{~xH`lM(*zlN#PLkdHpzv}tZ8x8e^J5P^ zxN74JaJb+!UH7@7Ag|!oyuyN_941K2Kbp4`#wvXzax=5CNCrpPSR{0U490?;I1Bju zMm)`Ir%IH;VyrA+ZMn)FgEoV)u-l%a78Wd0|0Vj$`YFHV@6^sDWAf7!<4)&s$u!}Y zjGaf{HB|akzZV-k(0dktZ)E(Vq$gwCzZdhq9DKr%fBFs~nalVkV<*hLG5p3c8S&Gd zWx~+=<6J)7f0}eTM&3X0_e}66vz;PnS9m)@W0Mr_PHn4c6#l{7j9&^5r-akwPR7LR z?+l_z02mj3;vNX{mcp3{j%a!v$7u=^OY_X0`Z**Q@eouNr_t2v-)4e6%~_XmdkT~E zNBk~4$%weXDk49HVd5PLG|^Iu9sgjK;YT#_HgKAF89&cT6t;=}!BB2ZAx9W;CYt=B z3^JOWp5ipcTuyMBpe}Km;=;mGK)?{6X*?r!9TEeK4ZjrhU&!R*M>K_tt{tNZ zV+p4z+*dgr2^ahXb(-6g41eIX3(voDn)FG=G(mqd9df-<7%8MY7!r|aa*ysmU9-Lc zhfQ(r>EQ>(F>JPhleT1TT(jz7ob;%F@H;D_uHq!kNDSmN7P|JajSVZr>6L4_i$f{o zKGNw}v0c^>sNsyO5b0W6{NU;}w(Ig(>WB2MeJo)Zn+Qql$<+_|;WR8x_05PmK{aF8 zAt2%N>Ju}b2iYktilR6&{Alg9kI-;=*nZz@Y_BzF%g8otgRX(6@ew+d`S-Dg@m&jy zZ4&quSR#f*smX#f-2mnTpUq zV(9y0yb5OQyHOyE4HhO2QiCVayowt(_dqPH%;I?xzgRxuX5<^HrlDcMqqF$r5J00gviAfk*d%81WXvjp`s_gsim3gy>@Ku-Sk| z^|iqJ5@1HWd*If@{m?_;(Oo1)Ji33I>Q0I;Rlx%9h8VmPaGQ*uFaj?v2Cox%#7B74 z>4@#R1 zJHn%;UEs0y9q$N^nf1Wi$Z2{AJZc+^c=s6alDHem@o(^Nl<$4Ki1r805xi5dH{vw` zPoxL6!9u=6F?f<$??Vw586n?GF?emjqr5=zr9O$kTL=GOjl}l~-Y4T-7=cIMcqh7; zJG^g*uh0d>w=xDV1BHkBXu=3Q`i8v`&w)%Y(l-sv9a5{W^`Kr zFXm3B(H)n>!)8c0r$#UAlqPT*F^wJ7N zHuHIah}0t!vud%#tvce--<*g2!weE& za@?Rz@@4u=-0exY9WZ}o(by;(gY=7>Y0=-PZ0hmC{s-XlhS)8O+YxR#jI#J%L6T7JO8DgNx7sO5(i+OuZM-yPlrmvL$Fr~i|iGU|pdB_B(qn48-r|iIOT(U#;Im~pB_*4z&_Ok!EiTCe0YjTzPT5BTr6mVfAIUSU>YJlwr% zXEtKQO0F)KK6goKmQ$q(#Zq>cF<85bg+^tLkZ%;&ZL&FYetR#ldiW{#`QOi`Y; zDEC+hgQgDGu~Z;M>u8$8w`0@Rr5h@1EAzDtn10&|W$f^o&O@_FNQai^O%GT}XCr%7 z?ltNDp~k3B+;K*>n*zMrH7U#VV2Q!B`#FeTRXJj%+`xL&Y7h}Po$UCKlkQHfuio*Vn1txJ`hAs(gAZ( z=21&!{z>aQrmx~2a3D7F8E?H)w&sV!axw%$z$?8wT$)q4C|$9Hl6o_T^3Rx%DQ(iC zThhzw%FYf82Ju%d@pAXhRH_B^JnwfqeM>nPxx1bIy?GrpM~6Z}Rgz%}TDVUh!5y*} zlt`r|mSRlfmY9pZpQ$A#plM5bFuA;#Wh#Qw`Kn7ScQL-ZM&he^m*mivAR+bXMS~2n zNd-Lc7VMooCj^C{F2UQJP%TKiRPA=k9VH;Gs1fGuk>x7THmN4T%9xQa}=>HTP2_vD<%wS{AFqNrs;_Rfw`@}hoB)9jgf9$9EC7AhFe z?cmwUTcb>>3mL*qa3$V(;2q}5F{Zh(A)DRxdA^16ghSzQ zE%awcGnS^@VPzKVEl+uaRXMz(VJ(mdY+XW4Gn#2GR zpQ+a8Qelkvu zLsz2&bweCVM)eeDKa$+WUevvlTlc^P_Uhie);)M4B;UQkUoFRzMCg2}b&pQUGfQtL zx%F^i$7+1^8V0O-O6_huuP20^t;HY#kqS<6>dDhs=L8y3sIe|3bQ#Z0 zmoq63`lmQGdoVRVxO8055nneUJGkf5{oOrNk`E`S4u_ohO2E23u^eNS)Js~DS~&{x zFiA9fb+%g>7q|K2&Hu68wkVK$OS(Jc*dAXqHJl!lbM;6l`#)D2DdYJ&cO8wp>&?y~ z`K)8g@{~Wvz4?coFPNL>NdI~9$~XT!>h&M}<=ry_6D4KWsLtQF4Ll&Fzxs;*H*;F$ zc>fX!63VG+<>=s=ahko{A_cQ2kyT<3v+7L^zG&H(ZXUcz>UGd_l2o1TQl59n4*91$ z&<0FEG!KQtCv9is-`(PrMisZ6+tK+Kr}9IoW$v0q+M*No&%-ra!avVmp4%&rhpen{ zAen;=in9OD{w@i=hitFkQgHA@=Nb8AeCH@>ASl^w(!h&Svqc)%BiYT;z-|epWMHqf z{yo>}Wv1d2u7PFJqWz2RZN3yn@vIy(@sh5ROe#~bStd1Bz*1!2|EK3j^_df8i0Vb^ z@}X@I1)ld;SQFFe$!+ww8a>k*JyRP!?nX~$qbI2rpNM`+YOJnk^xRaAT;jQDQ#E^= z6m+Ncv)qjO-c!`*DQxu2ZY+H{=+5isYqX7?xs9GVjh1Kt^h)ia_t@vi3I)eZWB4atB(#IbliL2Go}=ODY}0#A}|SJ_h(WMRU-(qE(sdQEVtzfvvg5$^@nO+1|G z%!;t9J*lOh@dX}5P85PNo~5TN2Z}Bb8^#XCb~!eIfw9G$33dNXQhq6g{-!)BX>q8H zlvI=*HOr|wq`Fiq7$#oQ&@Nkd1`0xx5EL|ZG-2RH)<2FrOKbTU%3PVGH=TPwI3I1e zCSD5t4IVHSq@=28`~s+Qn!f_qXY0|Rcx*9mzO4LIQpeg`Znddn;}-T>sM&%)q#XL0 zW+fr4#rd&>XXh&M_@AwGf2C&UC>37~eoFHMMIPYcDK~kaa{3y%t}-IJ3Jz>! zat!ZA!isbPf6Covd4l{VEGRY;EV9ElwQ@pHLcpwan~%l^a%+6y?p!-^q#2oW16KK` zqT_VHUQ-hWt9j5wEexvfZZjXa0khO|V}a)eh;RmV#oKy)fdaQ99PS7N;@d4mXf!I~ zGQiEh$2(GgR__b%(K-T^@%}yAI%C!^x+TH|PC*6f7j$JK(+rE_b~AJcZ5EkG zi|L>vP3WfPDyjINt@I+q9Ayb=bL5c^c+4wJ`|+iN;Wl@8`pWEM^${SPAW1XGVYM^82yJ?E&N?4Wz9@-C$Z zWgZ$)tDdR)M23hPDV)a-I?~I4#Wv5euy7GFsItUby=VQhKq%g`XCw4=hv^}$*P-LV zd08MQ{vj>Lfss7oK*JJd*&VNZAw8s35+fh3h&dUS7g7p5WA&t_bn&~#$*IaFb0Dp4 zSBd;ZXS>sX{A;;m=bUj};c#brXK(xqjsuR)Lr zx5PZST&im_H{Ta!xNDxHBKAIEFGTrNDPhX1TWe!2 z>wKVpg#mXdW>f97$C2hlhcZ#Cp(Q+xncH5|P!fAndT6fFPLsKI)@$YU1gQx5o*^>- z;3h;5I$#(AnoEFbVcXBFQq2+Cr)OccBzl9>6IkbmF)}pZ6nJLxcG1P3nN&UEMGuEw zCKY(x;=RB#iLCT@E{oeeA7!n@Z;CYFBh;y!S6N^JFKfg3{HT&ieF?JU{bbcMpMZpo zae8#VvW&d*=~2}^|49wq`3mTVflwI2Aa0HB`N|W--!eXl(5N@3&%6>v(U{NTT9QWT%!5X_u1}vM8-)*}mv*zyrZ&YWxXxnK4VIz8ij`PPG%HQyPpAI$Pai`V4j}EvD9;Sfu~x>*DlmlNZQ9rh2+jon|Nt6(>?rdH=|)~khF{F zdt_&mM_oV6{vz22q);}}0jYP*Rt`8?X~4|ZOA;_|v@_L-#KTw{UDebCkm!~%eS#$C z0CjdLtYQ`%#bLWS;0VS$YTh-4QujWTs>aKSn!l6Ufy))&+ClX!W@ej5OTA|Zqcbee zQF2W^iBjULZLd0CnG@F^4)?v{Wbi zf`T3%z8`^hQ=mtj@|;)ZBnV8jBnY(kj560uA->u6p7VEeQpxpf=b2GiM@M;IH685D zNBBK&e#t~A#A=t6*vmvqB@uqy8A`}HG77tky;?p5Qis0e9Zr_-p+ER=)bvVPa-w!Q z+bTQC(Vf9?Q8W4Xx;r#ARl+7`e{z$YurJNw^{s+TYH|}nXCp)EYLqVhGbi}NH7fc} zeM;y#x;`{LLCs25940k8g$*gi_;l&7+h3n`aECf3)5A0}I-7z6cwp!}0@ z43uaR10V{Ek7BC7);^#?Or#D31|NdaBFdj>6RMtP`QBS58tNGlCWTLXm{IR2jgs=B zBrm{DR)}qXPLjX(^Ls}h!h8x%RiQy}NcWe`zIBS0td>ct*{qhCG&ki-zPT7Xm6Nb# zm+e=!EGo-;`q8|hJ}sG*fX7*pFxy?y@+B?vmTConNZ;Kv;5?o`P2PaP}sgxim>RV`|E7woAwJv81MSj6wt;e)_xinJjJ((7M>`OX}xkH

          #vklhkG2>n) z%`F1}#u9A(?|}6I`6Q+MN!ycUh;U6|oa#<*-RU{LqJCb3mwA8%3mc=4bhXSpcVmxx zf-={1r##?J7kT0&=GD_%pHSTyv2j``#l~r&g~w?j+xWfEv}j>^bIZIq6?H#UR+jtt z6R(-evr#an;oUw(l1KT?n-INu2|JIN2d796w+B1JotvC~vl%0*q5LOao6tN_dh&(M zPqrQD3%b*X^7qYsJlD5hd${R|dEb5~pR}dACqlBSaQH50JMP$(rU<*HcFd^ zFC%40HbuVt@NO1H^S_}$aKp-=UV`GN1hMjik|ENPRWwwVsN4vHe9GRUHjy!%V4)|< z*cP+$LGrSDGEvBXnq2&R-{ng4;Cqs4m4YuybmC(CX{+hj{3h829;ntyvj~}44K+?xlqvBdP~m3=c`Waz(0rl zfOcK9<(TAGfBECfh33JZNNX}x>rx5rv2_`5`mOi3HMmNTEms~Nqy92f-)k=4D}9(h zf0Vw|4*4-4!czM~+0Z4?Y*igASu|&@EX$gn5Lss@g7Fm4f;*Ho@e+m%h!2Xp=7Dzp6=#Lw!t+DMvqSI}xlC!@z2=Y7)z4bq{9P)R@9tNl)BvrmtgIOsxa z6;_A3u*qYM_bl8r&jI1>Pe|%7zW_0~Q97RVVP^34Cx1*+{D<>T+UJithv|GAz93)`a6 z?W#0s`40u!p6>f&wz+wkl)Gl-(|y5ssVCm#{Xr7-kGhi}?wQO}cQ_Y@%=T(Y`5ZGC zTiFZ-sWVr3axAusSXn;4qYl2$Wd5-C|V6P|`JYkpUDm z&XCAH3our{-3Bqdt*CRUpq@JH?5R(GxNhb1eXn$z%co1q#lN!o2bR7Ql!p=qveJ** znM8xV;bJ6Qp}83wUNF9<>>_%KR&!gg3rKUzlpmYH^-AHx^GB~kZb9rg)Das&S+z{O zt6Ax-W!PC@0qf5zih;(VD6Luatiz&*(gMx#3>;19j74P&$C=C9k)<*zUp-Xjk29aO zT+APA8(yXj1^1&Q!^<^D)EiwW)CE?}tX#CPZi_`r&N#d?H6QU|eSn&W%xnu#UFul4 ztBz51sca_z^$%+H(_vMZ*nRP)P9!{3-d&A$)J3G8qWuk%Wb zn?s=wx|5pBJpP0(5E&(Chc1@bvFWKUHBohsR~pa`rYa6=BnoW30AbiA*_QEgemJZp zFHDtTVZkmIC5{@6EjDoD8c!Bs#!9=JXmNG84)jSieBUHSHeIslfBFWOFwY5jw@SK5 zxE41YE@A1wmgx{4ZP%!2j@Qh7N4z|tE^R`eJy97%TVvEaM$gVF*VD}YGBx?CS_om1?3c8$+BPAno-b&)I zbqgF{9j*(jv@VVtrI*46+JIn5--gLJ~uMA|zcF z8S~fIGqlD=MyyvuF6@L*o*3!~3dGurZf{#o>K;246R<3-5#6h>f~uZ7cV%XFXAv_E-08Y;B3m z1n==O>ketjRKOmv)!Z9a_neA&dY>pAi_(B{wc541wFM)z8VzDEiMX}i7oxNWL&yfC zL&oJ3T>?=g`OqoS=1rrZ(8X8$7m@2zzAD+8Ay(mOoSZb0U9c^C$C3=PC{T zscxei7~K3lfj`ALAFQ{b+U;)18D%I#%}zFu#7cj(Ts0@cZY;(L+69a-5do$a)V z2lL7zJ4frzE}ZAX;7@fIVLWPZxBo57s)@R^iGfmDp>Ch#caIGfDILQw{~R{@`A>Qi z^;`2F!+}aA{wvktj6k#eTYfIQ&hqnZQ?S7Oxqm^Ny1=e3u=zW`_Ajui3oP;yb%9xK zP#2iwLUn=k%&O1@IbD`7^rvnJhmYrDRV}E|w42S<~$qEQTV~`1e}(`Qy)aboh^dv%O^J%-awo z@pk^9qj$jZUi#w);uB!FUUdK+=aaOIQH%tfZ?@ix?ouRDg!v;>R^;*dyt!3sc ztvYs8Resf|s$7g+L`)XdVbC{}((Zt~Nv_;*vEH<0f=j!@sw8i!m@ylmfO3nkfSg|&Qe_kj0d zDSa=?3Y%=3sy3O}>g-$5KFn8aZIzv^rn;#)3k9FIX}^yt_pEL}2{hIXhMMN@lGvBI z#jK654TozSR_%kDUJI6U9nP8}3mW*kwCMqd`$bDu(M?)vOM&Z-yDPgYxwM9MgrvEH=A4m)FNdjSI!SKAO9hn;YGpB3HMS50j{aCzTx zsmDJ3U7`A6$(svUmk&b{D~2R=Kwa4*g+9>JrTI))%}P=0$GYqBKUu9$(mud6CQCEr zj!)Hu_$h%=ayyoxnorUU7P>O{Kc`IFP^|S`K4Z2IVWZbr?Ss?V(|WT5asGJ6P}T9S zcG^^$8Q9UD6zFO<4GiUN4TssDbeyUm_gD2;abQDByV-siVUHcK77tXsSADD`u;H%u zzMb>TL9cZ38J75AqD8@%l_ zUbY9rL5I}iFzG|r0f$*Sk#yQ&@&4J=_iNX|*IX!27fa5aaH7=GDE3tvzoJa{?RRzG z7d-yuf)Cbb1s%>F2MRKcxCb1`EX=XSFs~8fm;uM=(+>H9 zV^pv{`+pK*PH-rtcf-CPnC!YRRpuLY0)*X34oc@nC*q(YR8T0kjqzs{m)ulY4$W_w>e~0mYMU>Z?H)Bb&Tq@hDuJ_v|8j{ zr9%p(EGnzH<7>=QYgV=XHZ|)uW$1XutH@!jh@l6)uqSJ5UrEg`+m-O(c;1(In+^(bGtyov;pXJ$dg&eg9mSt$=zDKqy#?B( zpI3!>ExXbx9YVRXNghugwocJ2Vo0xPLHF3&a2WLfEUA0Pwnd?fSc1J*g=UHi)p$X- z^BksX+_YJb{@bO{$0#58N4C)oRG|x~cFBSEB1JvZUL->w8IW{#;Ho{chzEUJIlYpWS?CuP|o5URs2%ma>+*3`l_Vud}l4rxtQEo6#v4O*l% zB@wPK$m3SMulW-{^}W{Que081_LRkMu{4%B(wcmY`ab{GDH-Pm_lZO&P7e zsjC(Ce_TP?DC~~ORPXU*IMmg7(1E)8X7$C3>gpK<_avxYCiR{;wR5m_cMn!p*6N|v zjlVhA??PHOc9FK%B&|z0NqG!mmE3r`|3>)+*dDMRwKpU&`0?j)j@gy;@6Ys0!pi5x`u*6RD;b?CNew^~?kh);vR*L66(-$!z{r z7+a5h*23DloBGIU^&~kVxY}K?I+ML+;JTXWs%_ulvY_tWbFNp0V6^QTEQ?|g}| zw?1Jjv9$u^olKf9p>+d6$L0jsD}Ea-5eJdzNOD>rW_!Hd*+^eG4vWFqA%o1?=*el+ zH^-1oF0;V~#i>E}MB37XBmI#rO+8oVSA-)|3(odB;&UML>bQaUBU*WzeXr(gn)I`Eb3Ybi>A=39LjS}_fhH(H*e`C%58Kij$a zV+9AEa>mtck~D`udy;b8q^3!jGS5BSg$_h~r{2&*1x#fjRZ}@7S`m+2}o^d01 zBu_Ks!NwXUkD1GJI>UZ45#EmY*m4O7htlfVb!*k@k0B-FGdpi-wJBE3Pz z4IbEL#p`cuYZj)op3wJezlG(s@zUjA*)|~kCQ3&9j%(p#?hN=iX*UetG93T)==2L8 zud=Qc zmC(QZD$J`}wXH6#FTldBz)Yru;gcWdIN2n2TcKDS!ezz0L2R>&F<~DD3V#^_B zdg{__YPM2?mEAFFcBay6^`q=9wdQJ&zCKOP4dH!zf>LC$|2LYxbz@lQn9N<&FUJ08 z{cKVwDZMqL2z3Z{ySH_;6)aVJNncSXrpMfTJgjB5JU3TMQkvorZUEaY+OP{{i85>* zdW-oZ)>hib@Tm#3ukq5AL-3nY9GQ5~*Q>{D83P?q1tKOnaMFY2o2Emo$2BiElTQGh zq+SXFnj4W9+CHEIOnU}g&7bL6rp$N{T+cFB{og}}m$~_gf&Qt1Cg(5losye5-rf9p z>j?OdaJwh?bC$`3Ox9Ep=@Lm&KD8ET>(sb-c|WFZcd+pe{^KlE`(tDQJ+bY4?GNG& zk;5D1v8O{HFCKlNc6<-Ub8{06@y98&d;peWCV#Kyt7_fo=}%oOA1|Sh?AU{Ek*fEG zmc2X;pPM>qrI6juWg%Ls0bN2o4OP7*=*pqH2d9f#;N#Od(|U7;%mcFHO6ljd1GVGb zwMtIrK<4=4Nkg^AO%GieI8LK2Bm`=b5A23{BiLe&nChqI0;%zhyr504oA8~U{?vi~ z<%o7XmJO7fdDRdZ$Ff<#%<*ci!uQF)#RlYv2I9@9oVBNs-WM{*+Y?CsheC@JA+fGj zhI7EI(J@Uqt~o{W@6|dU><@>b)Q;PGt@GmjwMsj-ZVYwYdjK5`CLRR;omp0@Fhk7z zlOpK2vkk6RNw+gtPz6<#kHJ8UjCy=&Z$r;+>Ng!AvUyje(z-@{Kf^6@9loDxpo7*WR>18F`ST*j zxk=!mA2yEDS2A@!v(Dr2$C|g+ncbP+Rx=;)^*3fN$I+kay0L244Xt|@)2Hzcf8;w4 zWub4`veTMLJ-W(6l-@L_ac6>JWkV7hYp=R@)XkZyS`+0Qbg1R{ovCTE*32pkQD^Dt zV6iWh@YS^Ppq0-tKaik2I67#J2QE;RBcr>kmTt}ILJm^TU^$2mz&B$P>D(naNTI|BYm@P5ylQ+H4`0DcqOagl$h3N;ms6$!tO4~;Nxi$q5!chdc-fB+ z-r6?xsfsDn7G_i`lM@ba=&oJ5!`I)OBOTum9Godyd?VB8Qk5hPGYKDU;|J+OqcYxstCRz4ZAG9kxR0*gJIz zRBFvWkG+;p?!Dt@sIJY@nJ#sDwK8Ou6Xi67c_6;&t=Gq!4kVt(wTvGP9r|Fr`BFzx zaQfZQSi9-MZ(Q?eF0OI#9!kHsimf7o!ALuces0l6G&q`d00-uoHWW845(wRH#Ww`? z90o1)u)!xFQ5l}sQt*+_>KFU&8gjBvQyz%x{b)WNfkq}ZlLm!O%Ks96!PZnVw4uB; z+_vY!vi8pQzED@Yz2`;CD?6>N?e=ZPbqH1rn*TM-;0fCtI^WxWmNF1Z^Ybxn2V`R# z%WTcR3l~D99c&!||91wyAumEAqxV1`B2e~4qCALpV-cGch4s#>@u=~d9@qTK@RA+M z^OulWHqe(A(YwYf!yA-QP!8xtdE+nB69x}Qs(OqCrrhnQTR>xdYO=925+}FU(7;UJ z;EAdcJgjO!=N#@-($4DpdibD9xYK7WV%@0^Vl>qg4R4TQnRw^()!!EH#D;cA=I(S`M4- z`Ly?)ZR+gQzar3#C4v(54$1p{+J(z#le)X09$R(h(0=b`3~B6J>~*VV%ui7FzR~)! zX1>yUF%&$ud|-FM>3(V%kN`;PTd6t|c?cU1^h}ANqJkyL8L&Zj?=pfB9Jy-LmKA$DfbM{i-4ck`=eC(ldQ8S8JFaHpJtI- zAbFn`ky=0jvv5@MG)_e5*Teg$5v*@9xv1Jx`fy{OjI_*%+ zk|gzZN#Cb+A-x-iz=>+B4b1hH@J z=QMfBXzW{CSTwoV*H>T2r-b5I;Dj7_Xt%euFW6nUU-QMww(0cY*pW?ZY~G+fvHtA5 z&0p-CdZRykMlkzktsuSka6wzgKzg^FCMTYZf2AYom5i}FLy@f?G|)ep_{y&TYWt#i z+5}YVJG1{I(h-j8Smc_V-MA-9h;3nP>g&M=@=rX-X&b0VF7g)iidq8wVtazz-BMI9r%9>BlCR6Z_lKyil?IzX%c;d-ntsZJ)S3iK zaPMvVyMqZ*4K~KJ9Wclzqp8kU+NI#0&HKAU2{kxPlRZ)SVtgn;**~7!w+G^DFxdk8 z53N_?>2OJO{|pPiVLU(%*ip?tkdR)Ew!@4q8YE;{v3&{G;Lzut2S4knv~~tcda`Eu7eQgOf|d4+ zHU9e9d|Sj}l+}juq-lLi3X30YNx5$P8uBrfRyqFvbw35=tR0wqtZm0xwYgVB1#+I$ z!$u3x_tixJd88>Bx`7I@ttBD-KJ@9Wm=|7Ja^3U1r0}Ksi3Ul!|Hf$kBkGZuce490 zo-e)6MCUlj{(g~nefnO`C+HpXAlvELjBP!_9k2iVE|!Y%JN*uxzYB+dZ*YUN^tR#s zB$wd;w`<398-5K2o@OEE)^K=*pb3Z@tXbY^Rwp|f9p<{(R?XVz;Jd(BpA+h2xfTps zg$k!VEw?_bm!|fv;NBl%vO?*`W`S^9y)$6NG9KnCrZiP5f3)P(;_y55myWX5cZ5AN zR^H3iteEG^u2tS~U^mwjsrShh_HmN-slU_fZ@}zEzv#CxL7GxT+2-kp$$We;rh5Z6 zL2cDPZG&PX&Sf94eicV$E`{=qJcN1KfGaq8>dp?ge{yEVL;Kn%_$S|pEs^r8uXK!Q z?LLHg<`^U(056*D~v4?Yil0V*zk6ELgz~WdJ&gAAJIXb>ai>|j|>-OA9S(x=g!JmBN zobDdfZi!=i5@=yFm|&LPNYWSMdh-u1b6);GW;B?~3T9(N>Ky5vlA7(v2rAA?U=@3E zUFuxXe4VHCWD9EA`)YQoQlSL0?@Ke=@1roL9u5^EZsDAD`%oRThGnRVSx=`e ziCNhRTXA(wNlS9vU>=?|1&N7g5nJpsZay83sq?H?NYj{j&`Y{LFF@5O6gBTA_E`uT zfPn{?O;xOpL>TO8n7Sgl;Ys^+aXj)=onkIu7X||3U}=N{G0>cG*IPlNHw-0*6dn)Dep@2xHI)b_Icx)e-Y+o_{AxrG)vMxPOApH?FRas zfsXo;q|YPvCRQhrn>?vL-OlY6^5;)DhBt_L+AgWG_D-|1%B-#4 zfpe1hEWy%zWysWcEY*<4NS1g>J(e*@lk;o}5T%``0bBxB^>{_&@v=h4k~nqp{2F{( zEjo@tf{^Z5^-=RV4kabjWv3b3p(LhbUd^~C&u3|d(=0W~reXC8!$Gppk@G-PJUYpK zoI%$DR%8njVRK{74X1N5h8)_bOLr7)U9(|LW?(BeDeP!BeLS=pfrM(0#{HRknClXh z@|f`l>LBVWYGs)8T~bw8vNNz$?K}~vZOzfM3VBnOVYx1l+}`Ee5$vA~K=RPVcHptP z0?XQw?8)-7jVj3Ov@U&h1l6RY<@@H^aQIA_W*u-q&I??w-h6_8(kK%UG10<2;JWik zsWta;SD|;C1SHJL$*Hm#A-v$&r7Y)EEqaWw`-rO z*=hK+36AU3;23-*J#$P*cM!@Z>$KixlQb{290epqjRnSl^hFmIH|^7pv(uCt`RG3? zgUAh{%-d*+IE{eUm@sRECzjfLeD-McJcs?m@U%07AB3k3VW-=)i{<}EFCEKWJP*e_ z9^v*FpBeJw1_(t9+$0<&OwjFwE@<`7R_$?OfgP)iaAPj?4HDIzQte4mJ!1_R3?R}8 zd3=QM+YNSm476l0FL8VHUC_~QM0LVuN0@#}kO$1@!Dw#TUYBZHQy^#i+*rO}X3{?P zPo3s(n5N4Zx}ZPLe7xr4cP<3X+B=G79-5CYEe3InXP>iXzbW)#&q*g`kuQw(m5xrI zl&nj|Vy&& zNh{WmQ$&0VFNvDdR?*-CLh!C?_)jG{al7{?&{ zv5xC_)qSHMdGn5a?HTNFaeZ2WTser3U>Mq1Gqn}D@=HSZs33#=lK6lO=~zDgW_OQ! z>b@V`(h-83^6OwdNeQ6LiB7umXvw+rsDI7M4v?DvG^}r*WWNrh3u2D9Jw-ewYn4F;pB<Htz)Ypq^K>_EylCk8Yy)8TneS6yWc7Vmv!nW zt@&M@m+cB>wTWXSHzfKLtY2uf!f#zHXM)Q-d=3?hFK{|)8#3uGSV|k7&-6vMNDyo& zgZxG^QZ~>X*awhADbu@hDA#{Qo)MB+2S1@bKJ5JaPw}Z?XE0S!rkedjGq4aY-;W)R ziSK#OI)69UhONx|#wO+-52i^k$k@7v{Xx^BXR*&3b&5G6Zx=r&3H^S;-M;)=IQ*sH zLz0?r;^{~A{dvqA$@Vq27@fzlB`hciy9}DYL%R$vH<-)UN;&zJRkRsUtjOb&JT;9t zLhZ(i{KrXH#=zF7!sIncMg0%oB0snTa}t7@fwm011w{sHo!utPx_1rjz?VxmV0E5Wr2-299;)4!mKA)_depkFeT#pu z)RJQ!bkQc7j=;~0reP^+XX+IHUVIwBRX!e9JeBy5e}2?@kZ&wloEQj|U~q`{n$InP zs@a(4EtK-GR!)nrqyyXML# z=qCF2K$y|~-H>3ne>WufA+{y^_u%z;{~o-4*Zzq<*vd{C>aTlHG2|;u+E4^D**EOY zsEbYR#gh7~FQBis5Ss{HZ0-5gmu){_hj|y{pg>Y5Hg7=G#WwFV;yn0bOW#v{flOaK zl1Dw07;sEWz?PwQ90$(M*E`n7d!j^}f;f`l~gkvEBG=(go}_{yOQ@|K;s#;N+UlxbNNFe27JC2SISdhD~i^ z6B`!6MpgxjB!VD1nas@Yj?C_io!MlUXoILwDkVtKiuj76MSY|`+R*rFX;rmVO*Ke; zv|3ePX;JV0f6jAe&YZck(f9ZM-oxGVKhJs2|2*e8pZCtq%%6jee+riWY2+b)e{;%F zk7E^mw&t(PZfkk*$uWg>8Ecv4!}qYP(TMW*DP;Z*{iyI^%vaw398VB2Q@(%uA4V|x z&LK}fv(?IB%l?gn;p%ZCALVlN*@zu~YTqxMrz*h5;j6Nk7C2lN&bH^;KH}7peUJV; zk9pVPtr<&a$tCKX)m^o0Xm3L!{IJuum}Ns7)Vn-*Go=b&tF`aXo`Ps^Z{3P@`0kI@ z`0kH~wqJ63u;fB^Jxs>?YZo1K_9YkW+p=Sye_8FWE0^E24u`3W@Z$AYe22qUmt1^c z%iGV48Rw_AUo&jSv#YUZTs#$apE^-}422uCTkuW6N8sP<&pGPqt=A5_i%;^ayd7Vz zIp)FxTi#f+)3J-@Ogwp)&+thlN}Y#$yY0V$TOskKcD=breNUe^xCCnNb3J^H2MruO zhOONG{M2Fm+7uL4`|vmZ^?Bnb80%k=*IDpG#q<<@m&fvv`L_ocYqi4$hVUOloF*TA zcaJy=%Tn_qjJ0#Va#Tx3k3@A|hMj85#6c7PP-j^0H1Fsk^QR5nmESTZQ)ybwArHt* znr6+UY1T}dR*ip8an4O3gHP~)i=U}uKCQmdQxl5IJk8a?{!sx+M#}uSch!=U>#NSc zsrsU;MxS3j!hFq0?RWIsi}+w^?Qk6L@OkGD^bLkC_KzXBty=uAWkYE#{-OHNQzAp| z!M@?~Rp;7E**JBec*uhaKbwMz`2Y@n;*k_DukpKx)fbZCQ@y`xA-+^uB<2-GZ9CR~ z4Zgr%)K0AfruqXn^6tNP%$Ls}Gw$NECXH!W{g~Wn8TX$tV#oW39X)Yi3HfG1ShO5^QFTN3Z>R0ZNasFl`@a;}9Rr2I3 zK1TB1$69o$dq1)?U;9vL;;6zpPX5;iDybFs{NPVDFQ0VTHY>-R@?-o1?B|!g_VihJ z%l?YTTJEaFL(Y4T@pk?GuHV^u*~!B{fBD&G&cf?u_g6jnr_XDvhCZ(Q;zrZGYaf5i zo1(r$w(9TIpV=S0>icH(QX_O4Lv`4%+Xnm_9`*>z<>M^bcnjls*TBTo)Kh1kTebQz zzCaCEcYS>Fj$YTB&iS4nUn5^VPJVO*lxuksRLjQ65234BSe>Kr?y;oUFuc2rZ!s{` zSYT#e9K$;k$3AAC@rOM#=ChiMw}(15!)42Ae|AvpAb;h=eRdx5n3_*eUj1a#l&$|% z^VZC+sh@F{Q=|5fU+V`i!&=5XSBulA3_W%GfiZJ1 z30Pct3(_}gBrRHRRKv+N^1x=<#M_78K9i@Km|4Fur;e+_^W&lFjRUk&o;5wE|7l^@ z_N4Rpp3!)`y1m~?xnyq+zl9j@ipA3V<$B}JPb7|)Uw`7yB^o?FH;~)U$kVC$y|Lbb z{R+P^;teyeSUQymX1AXhOq{TPpnujY z*O$sCC*XGgAznCf!X&S+XF*Q}erlj(oM*&3-rr<<$IU(|$Y(M^I0&MLThBiE zAOk0R(~TV>#1DLC)5$#idt$N|rBbJ2YJP2?xmhWRO&|2S2lhpSVkK;H%#bguB(RvY`)D%ueI)q2gBv)$o}g&80e{ zu`~v3S1cDK`m*U%936w<(39^?C37RxPXtMkM6x5+mqyVqQYN3yO`P<9Q&~yDFI;7J z3P19ydMMkMSKWio;^4K1nEG`*V}6uBj)=jZOwnU#Q%{UTAb>YAz4$fQ?t=r&;eK-H z=@+Vk+!M=-=B$NARwNjR(bn065zvzftB&?!bai7yquUY~oePrzekU@gx`5-hFQ1Hd z$8vcLYgtt3;Y_wKjV_Dkdoh18p}RTb?Bd1)iLUNwJeH2*=Mdw)$-LJ#{kVgJV}pW+ zlJP`Wi303QXL>r5Tq6{FcPgK!le>~wvmiXHFPY2JTJ>{?K|I-;Pj#pPL>qDoQrVCk zE>X6oh4s1=>+MW723!yitO+^iT%|c^9??jz)}^V(%1cEp$ymGC!7}|CEVAH-4@;)~WUl?Rt~r z%}Dlgd7YMA+Nm!6fOz^a0bOVo%fwypuDzs58^|9Vu5>2HaqCL=4YaVlQJt@p39zc3S zO2pFH9<8d1q8SOyNNF}Rt@`#I>JJ$*tlIYkRCzc#nhj_?hY^cK4)=)}&|mC5B*V=x$^Hm}z|x#=J+8HjRO@i?&T^`+s+XHmLT5**tZB>Ul_>FC9>G!sv6Hg~&y*Q9@k?HJ7 zosEfUb&}T|>&MTv#yYz(NTPcC@OT>Q%VAm4Yi{8<5$){F^kp%i%viDpqlbfbG}oKY zdR?e5KR+4Ed+2ht#iJXd>DU0q1%BT=pNVJEQFAOqmZD20loMq|R|h>;v3w4toDy&2q=ixBeqYgpQ zuI^aeE83RD*)AXD5){KqVSa----X|ErlOjI2{cac(Po=9KR&E)4|w9h#)3o0*~w@+ z#T9azI&V+sp2|ZhJfN}qI}1DSz%1$Y&O#NI&Q}7qfa>A5*|5Y`jN*SIcsWrdG?W0XSJUi zZJRoKDo--Ajz22E5L$>OBBAa@)GdnKxeO$+2AY%a1Rj`!6HjdC>QJ2WJRS4Qw||hq zfq4r`lSE1FL)t1PJxoetKxpJP+d0T~hAq^)DVnnJ(9R?@JZQD3* zG+0p4%K78v)SWYTaHWR|9=fp!#24iHy1oCmx7RpZ#wT=n#r>bF1@GMwLBm+wQI5w! zO2gujp!5t^I75|+rA0g*s2_1ww*>}8e(}K*l^E~jAtiLn%Fzh z!y|xHPd1ZD&zL-M64K1szooe(N2i%HY4QQ01GK;{ZRJd2X{9}>89GE04>H_9ko8ZR zJbB_lUVn3Qi@BRE93u2WTR3jeAv_cn1RRT=(GGC>!LeH%n~EB^fx>MNPc|hbv2OEh z9>5|VuQ4~U;EAk3RskHE(f!H9xWa0IXBT!UbwE>_+5noS<~nc9y3|?BtT0ZQY;OnG z)>0zVF5x1tx=%>xO>00|Vzol_vPran_ku9rT4c+%N^?q^#t|LlyU_Kj=(Jh0S)BLK zdcnrQu@8?&I#Hj!!SJ*xUBPO?mCQ*msy6mG?)=rkCyKipPt|5yXgw9dI?$0(9>cKb zD$&6ctfw`s%swmAOxA8Zb}5v$6{cmf1AN4Ur#U^C4_wEJr|+Z9g8@FII>9^!V1maD z>)A>wi)RYz-a9yy2SFT@6Pa%P=tt?!$J3w%MA-N-gZml-Ja8!B)WQP9mLs@uf|K8S zFFo59g&+-4g-_LaR_(0zj!}BL!L0%wUggob3)!2fBQOWCEf<=0dCaP5z) z1{c59kY9Df-@E2NHMJi9BBew1&>`M`QC)RSHB8{&>Y+o24;fxF+{ZE62aV)F>JP0R zGGw?vq`C&V$l)jc49{%$^6D{Nk2kM>a{f1$Y#9CPaaG3;zohfoeAU)Jx%H4QUAO1V zV}=iWtGVV+?_Ra@kDfbt+OAFej_CeZG;-hxuTJjnp85EZn=ZV6;ry?D?a2??k9hmm z1OL8Y>(A#t@WIdr|Nf7b1)rRD@eQ~9;D-9`7azOF8%H;E%zS6l>4!eh8|k$;Th_ z$jX}c^6B9}A2nw2q~%}z%7g=cdC2SEThuse+iz4~x6cKu-x;?0^824SOYR*oh4!Y{-#eco(%)jjL!rr4+{%6R@9eTfY+9h{>ze~6J^UwEPhd#i?u#@`r z?%h0%6|5SdM zk}vVuchySn`Rq&nhBstBzmj1nE|m2-E~;?Vc^lO@VZZML%yGl9Rp+h4rN`G!z`Fr& zg=;E4?BqXH;Fz1LevKPIg8AAAGiGQXgZXFtw2Q%fm6G|22=f(8=BwRk1B3bcPu9&~ z{Syf-z+c+Rc9>w=Zqg>EpNu{9CH+8unU6%-HqIsbf&OA!jD3KGVA@s?SirQ?5-I4; z&+SEl?X%~p@rzsje@fFCY%Cjw#en00?Pbz#qff6@*9@T_0$fY13s8kXVwP2YIx@#+ zsJT=}5KrS#1Xn{IwJotK-H>Oi=t}Pqjs9BWHD41MwpgW zV`N@Thal{MtI9i?!>bUgoe@!u5xGx`&OQK9l~?a=B0$jT2Az<<)%b<`@zS1UV6O81 z?eNz-`g=QRmyfG@F;si_AjJyRSlPcLMe>m29Ta=2z+VS=zurd|;CQd{rdXxv&x4(` zn}3+MsDyu8hyMugVadl(ME%=2`CsvF6o2XZXLy?q)K%(qyHo!$PTI{s-pQZgq-Q(n zIZk@6lb+|K6L!jWM{ha*$o%DfD`VfB{ z4MRxas`92f`G-4cH-DOwf0UDU_m^Xx{1g0c@y~G7?|a)Cw+>O zKHX37CINxd*!SwHUY5hx$w*guG5;gkA|opQOH~(@=trt{k+ja=q3UYrG0?s$uhV}? zrA#{EzsYbJB4qop90}PP)@cr<`=R zlRnEy_c`eSCw;DyUgD&eI%%E)ilN%O)JZS*|ICE}A&blRMmzpl;pne)(%1Vl4p7Ct z08y3aS6wOlt4@FBe?D2~b68b*Kk$!`e4YNj!?(&wyW{U>Cx4A^TFjNa3imI%HvPBS zbNTOd%KyMg-|eLDb<+1a=?9$jLr(f9PI{gHtG%>shbw#6Ir)z}X}nu%g=+8TPWqQl z`UNNbJ170Jlm4@le%(pG>7@VWq~CSY?>p%ao%F{}+C86s;=dv5??04(hB*ECnN$9A zC+$1>_;o-lRC_MpFel#~KU+Kb?)la|kGkj2?Va*c?| zq}~0`JukZRe|M++9!@%N(tA4Ty_|HtlO9`j&;;E?tG0^EIM0H-^JwSl4Bd$6; zUE59`R&ZOb!;_Yy_hGJn4p-+jdo%ff0%0|-IJKFAv-1a1>`-YjpUqz_W*6TJzJ{mVyCTL+eZf2>LA_V3OI5)zm{ zo*T0Srmq(MbAao-lfAzfqp$?%~A!X#XE-f7;Rl4iHnd0+LOC`r%vekSJymSKHM zopi0(cRE&G0uSutftPp!0V9y*7{35b7I%|7kZndJl#--*Y(d101$NgBJX(~ z>=5YoI&YbGk*o-s?_%#>sZXab@kYw|fzzhWyUaUc97`K}F86-Zq|^LM|72u;Z3C|J zuJ#%^aS*b#ZS4=vzc}H7WnHW{jf^k=N%yFxJs|}_7neUzK6U+Infc0!&T=!>iyQ4pWBK5 z=BoUkdG|c0*XS~DrWoaGgDj7~n!1NQ+z7v4!ykB_-?5VN}`DVvDQsw`~+gJRj z`}?=vrQ&~`{+)M(tXF!x{2o7(uK9HOC2uQP-*oy9-UOLnRIBqgcz4M9JWr)JdT&bq zaM;&*Z+O3y@~tZUw)d9!N7w&1?@Adzn*SZ|^OE%6z2B9L*ME4^nn8r1%fIX8==ehV zpI)1+Z+iUv%llO3gVz7RJ8uVD|3mMO6Ycaz-cMwF=>6?uFHXY{Xm*{q+55MQCr-mU z@84dFtW&S4n4Rz?_^Q3=u z{l5RI_~$^SKg54m`nOM|xAHHS^ngll<0obQPgUuWez%MtBo+TOF6;;*poU~e4SQvr!%oV=Zf$O}9{@$|w^{ez`|8yBI>s0z6 z|LgSt2+MHQd58LkSF5D@L%#Q&_RVnSbC;7p-^p*aCOr9qJxckn5r030dh5L7{F`L_ zQH%N$gzs_SI`1Uk-=8_2_aCJ{)8ASA%V}Kao$B8fFjohb-;IAH5Z)r=l_I7yGM-KP z_c9-nu)EGX!~cQQKOYKp-U5G<(_c|p9~xAC#y?Zq$EeQh_2&ct2vo!V>t8PWot|%t z{CxuE!Y{b$ymS1=_hZWQ4#S20*gsDE)1uPn`+GGpSAR~5{nEc;f=(ZUsLs2@?~wA0 z>b!6HpGm$>U*T^f>l;h4{hx~cCjE-+SMNZ8{m_5Z8L#iMkOabaWxViC4f~zHgZPhk zYIWZC{C5MRt?PSM)>}$h{>#uaf$1fUCZ+Qa7d}dvKYF~**Z#fL|IyYu&A-gQQ~Ybv z*E#tYIqm(8oS%5-S?AsBpCj#^2ZB0pt$&F4!|)wHmI(Vf)}cD@5r36q@BYqw*evtw z0;T`7f0LAdRE^*DeiH|d1ls?Y4A(uJhjWSIPPNRF!_#Ps)1mxk^9p?;z_x zlBzu3+fiW~RsW0r`OfcQp-$~yt{xkX8I{kZ!)4xxl z9uvsN?lgDFG|hip=W-b!?nTTY=F6jSmZAJ|#GLB>AMpo)+Ysfnn@1*p1O6ZcxG0~E zn4A%5FU=%ooooUz^SK=ov(71kS?A$`S?6hjSaldzm(N zHd77(Wk(1`RHDN@K0=2f9E^*Y`V9U?6_w~KAHJ&P%5Se}to-)6#>#J-G**85i^i&7 zhHA{R5n$HE=}k=Tg9J1GXu;$@MKHO$1ylc0!Su-r!K{q@Wmcw|C?G)QzA0g zw--#^KrnR~{I_(h%D$~J>+{7As_h%J9Np|iw$hl#3}SL}OCctQ@-r|wz9MpRoFSNP zXYjYvv8tB_B5Z>zg8h#&PHSQY#ShH77>vzK`)id*m5Go5p&l3U7WKs#r4L-t|Ba&2 zoYwm8|4qx4AFOr9$XVY1nWe*qBXCMbfD8OPE3rzOvdRxqR{0-u@GYp(L^GFFUqJ5r z#rgXz@|CaT+{f)80?fL`3MTh7!5m{V1S8UOQ}pMHociYqrY)BVX8p?r(=GXama-o8Yh4hLb&+6Xzz zF_4p=N-6%AwM_9pp|RqJ4nG;<^oYoWQZ@s#+&Gc5+yub|{(1-y6#t$YtNxXBT-glF zd5 zh~Pp$egXl4s`pckRlSxCk-fECjW=NG*5jg_x(vSXFdgCMAfZIwV5GXgm{RqkUtYkX zt?HG&GyQb~{TtBf`@vEvIiT5sXOBS?JdQUnz3(+$9*po2C(S$fshq&EKe?9zQi&PT!fap~jDlPx{E0vCaDY2Xxthc!(~`Hsg&;mBBXq zpDC!??Egn&GnSa5eH@c**xP8IKTMaUFZ|&ew-G;&KM2!tnXxyAct1*U&x?yZW56?y zSmuJ78F1Prp^a~=>sl#w0R!lD!7lBZQ@%H z#I3+H1k=Zh1hefI2&TXJsTuWW09RFM+z!l7!ziB(yq{o}ohFz*yF@VST`rhq8MvNY z1sVH*_-nw!Ele)Tvyjv8Mu)y8J_&OA*U0H#g9E{*Lx=vQyc3xIC5{0%3hoAGFk?*F zBWs|tN7g`PgN%P=18-^&lnpYElntAdSl?@~QxGr|y$CS5cM?qQX2Im1DVXi%2%X>->S>05O9vuga*lJnnf>7@*n$d>^p#t;`G6t`WK|s$KRR->B&HJ&v?1 zAU}M_Fa%d*qJnxo2WFkjrkr&$o0xT~a}+S^oGWtH*&NegBhzbQCC%<#XoOW8I_ zm)jdr1emrp3Z`xQ38rlfJ{MO6RhEl^1T!|aMLKeT7Ak*oaYbNxp9e4mN-$kWhXH0RBI71>uJRm0cJfj1+$)01hbyg1hXFHPw2BA20zfY z?E)NWp+pCNijIdOitq+Yf?4xb8>QdX8SfCSp!yV;`A6c40Mlm0bEwu)V;-1t22~~sVA}ar!G$r| z1_8ouxFSa=sQ&nvOl+&N0eF94WrJWfCIu^h0yjcOjY*NKF)4E8XORccBR@Io1+y%J zKhamQs`n@bbw6?-AdJNo0cJjf{}nxcl|C^0MA<1=*(q4r3CwA$>=e1OQ{>7{kq5$0 zPGzU)DE?z0L?Dh(0YQyDVA`@fF3OpIf?(FK`T}y+9~XImI3<|%oGUm$e1TxfuMr#| z{;puke<+yk_=#Zp^H+ic#A>fcz0`kI2DVYA@ z8&QS_NzXr8`=&-P=hJY(uOL=q2|8<0PK_nOYAgv>V+ok`tFa{VKzP0hIsL`D$ip@p zOq&dDvT(D7TP!?9F#Eq%@U4j31mB4mZY^-OTX=?rXIprVh38s$p5RLnCj|E*?h?#n zOjwt1S7=f^Ua> zjU~U+!gpKvJ`1n4@FNypCz$h(ZKIv{BYs-&!-$_1%;y`=3#Pwc6g&xX2ESQ@8sfnCf{DTBEX{%t7jb|=dplt*25*9nDv}4cqC#5-gB`o z<&(FxOxgLi##ntRb%Cc(=;}Ipbp0beeyE0Mia|9b_j6fRQy3u{sE?qd*h;<+&n`Nlluh0OeFnzK; znnzCRb0`~}5=>6M6-+sO#Wz%mDQ^?ZvS$dU4;lP~j#V2sYCH^4B&IRBh?&pwzW9N> zehd{Nkjtzs0r9K&gV2D>e@#JsPyM>aO_cKxfzV96NkR3m-Xd{b*A$3|>4%J9)^odH z+V!d605Kl}QJ-}xUja7)t1}NU>ueMq*2$%o`V2=3X8Vp2%=VomnEpRcFze;Iz_PT5 zZ|)M)KSv7=fHzoppK7f``Q?J^fmz0ngA76WHleZdEnh4^VBO~4mcHOzV_@CHpFk}j zmU%~BzeAT*{^uk^pfCJREm!{U(pdSQg9xF8Iy}%Jz)UZaR8a2)z_j;3k<;EI1k+wj z%YuGPFl}ETn6~!_rVq~&%y#4j2Z+BRn6_Ujm~FaIFm1n0Fx&J~!Ljql&7^%*e>dHfU}WUp1ab&lrM&S2ymnme-LN`G40=4FlB0Ogq(KmD014x z+c4_WE;Yx2X;+`fY1f5<1H>x?BhvR%(5FwX6*=uy_g0Y8-aAE(NZ)5c-UNKF$k`6s z>dQZ$p{;BegYp~jH_=AgXWFj(CjJR1hYtNiJIq|B9Xg7Qz7#`_?O08>|;2Y|^p zRpi4Fw+Uw3j}japo-LU6s&Rs{)K}vKn7&ox1ems`aj`DizF2SrVg}R3;eua6zq7nq zLsZ){dJLFx^39<#PGk(I_M+|YqU;H;i`b7Cb>cUY*aR!J_6HL1p%$}m!_@S1mHfD9ZR2$FInDv=wHLAV6TF&}> z-qa!lxct1v^rQKFq>1=V{6QdpB(0!+ehW-L93yhtqRw)VQ&;sJFm1U=bZCnjpODj* zwIZi2zZ4uGeo-*n`$xgF>kYw;h~E}W8yU==OPh>;wgQfHGnen#Xv};Dcbq(paZbC< zI8lD^N1nCN zpNq74-)0_ht+t_y7&?8>$qIh03P08-_zqy&AK_wyfT62!9^s%(!0fwOxJmP?R|-btT_-q!_0m5Wl5n#5J^%4(9e28GS`!K;H5zi1zKHMrOefl6Sm_ATvHt=u^-zD+@ z@vjBbH=6|0Hy-;D`t;3Cg6R+SSu^BKz%xZo8!r@0-(1N4f=(;&j|9^lGJ81h&nr;cT1nZ9puaakFivuh};9T!n2Q|1ZJMwwd*x z^+s~|gP_hoz%{_?`~%E<_51;tcClXS)90*U>eEy7=b?&Nlcw03y(C{{jWI&p*+)h4No$JcW3J z#;wE$XnWd-`9KIADBL1Tc{I3O#6xH1GRSm(+8@5fdgQ*UjVb*ak!{oi}*aj^oKepKu*5vMb3VF zSTOsMUB$BW4Vy$v-@Gok74Zl(k8=8Eq+t4Hg5Y-GqXpA9rwFER&JaxBFtERNM1$!I zU&g>Tz>y{RgP``-B|0BN#fzLzsrYlL#{66IEL7$xeQM?=ePQOBnqS{wDVayWteP${YB2X`~OhNU>|DDEYju*MulK);~RqrJl??s(&S~|~bto(41 zu4@E!F4giKEIdIlbs5aND?@=Jmno4RSAxfh+|^h7-_rVDq7E>1ngr{dBEQnVTuYTb zf+_L2s3Rzy5 zhc7Ety=E@=Rf2Vx^_lJQzpdrX#3=hF%5t6)Z-YVJCU{@qcENLjX-DKrJ#UT`93V~z zCU>`BMEd**{U+c=B4?e81=C*jYz;aL{I(MEw*d2V5n|e0x(I`jvZ zU1It}J#zyl|HUE)RNpp1oqFKwEcy2Yw?clSVEW)@!Q|m{e3oT+KrsFBW5KlH5y75~XB`|C@B=`*z^L(Y7)W&%fmn?;8{J6P~̉Y5VMWsq|fFGM&v~W zHz1xbn7&l&2K3pc8%55x{!wrq@mqos>GwII-w*r`k+a?J37&#@XO0c%FpL)547`V6 z_SK$(sn3rajsAgxTOmJKF#E7oFx%HIxE(kq7|`RRXYwoo?i9QfSly#R-UO`XCh!bk zHNSuv)cgXT4SbuF<+$MIWaOls{5+U=F7U&G=K;SY7|{Ep-~{k1g1dlU6-@j8A((z< zFk@*rvD}N*63Yj&90%sTlnAlxSsVu(Zwvu0;yMhZdSY378%4e!re73iRm>6T}y$kwx6JM?6YeoJz zQKt#<-f#hNGw?XUY{xXgQ-Gs_S?_$ot-wjaZNU6UhCI`O)t(4UecrlI{toch1+)H3 z1XG7cF6wLq=5c{|6Y!OS*%q}|LjD%;Dv`GX|3EN#?h!l#_&&k2fgco1o}UYz1N@xe zxxmj0rceGRcpk8tv#2)#tUi|nW`7Q?(srhS8w4){o*?*AVE#L9wuQEJ30@AoK=2CS z)q=CYk6Zdr2+l*!XP4yZ2mYs}^S91o9TaOM%a@bmj?u1oF6G@^lEMJp+Q-M_(7b4)`L$>w&Kp%(j0=@YBF|S#q9t zY5(((|48t&zz+y!UC#-A5tzZ8Z6NmiRg~!O{)k+s*NyFvCN{x;Oe1x_#txEDBELZk z73WPF4@cx*i@}RfOZ>Qkh36Q5!Sq)v%Qd-$a@kYbh_BcB z?ZnXe1vqC5ejRuY@prY(Tw)FY1oA{~)a{)ncr@aK;0DAO31&Sj1hXC22&QkZ70miq z3#QI3f?E;OT-HT@a9Jm&j#>|aM*^$$5I6$-Ptl=oJ{L^=Dqojv0v;l`8CZQ@kFso& zdj0@B1$al%VY}2B26FNoD)Je?>O2EEeWun}VERlwqX2FM=11VPnLOVVOrCEE4uI9# z2p#sJI?n(z+%7uw=MM#whwllIb1sz-d^nH&P$QW85B){?9f(;U@#BaY%ve%75Z2&k zU+Ku$pij-`hU0-FH)}tudo*B%<8e{WI%f(dAALbN`54@~_I2uFKT)R@a<2kIT@Hoyl!a79HH|N z*niY{7dmPT57Y91@)z(2fj%{#3CI9D*BK6^v{2r%7Bopr!x31(lZ^ETw`ftOfiFA&@c z`8Nc&0jqrk`qP2g<>X{wmlNL&{IuY9;JvGgI^zV-gS=620{A$=Y~y^vUBEqp)4+Mb zdEjpg2J}`4UJQJV;3dG<3SJ6)yQP1p;2DtrP%zu|py1iSKM_p-sPi-0bsz8xB3}#q zieNzRRlyCwn*=uk|66bqm8y$=s202i;;k+Dwu0}3e0#yPEwFU<5_1`GS`NCk2lN9uT|&_)5Wm9^YeNzpn)Tj^OKoZ?SaN z2wnyG9fEHLzF#nHX5buW7>t$Gsi}+H+Ul&Xp&lkJ`@r8ovKc=Z4AihyBBE9ZGUJtC+ zJz)09UvW{t5%Fh&5y1&s-UL`Jn0+-=FzXsCn0 zv%pUYX1%`_oB*z=()@YgF@pPn_ZJN49Uz!}b&%jCz(-m-(*-Yu{8+)ufEhU67>45_ z9*zCCme@Xr*T5)*2<4j;)aMO$4nly7Wv8I5I_KO$spgCT*8pR9d&I0~TfwYHy#opP zNZ>IdXFZbyk3xL3U_|OHNS@KaCx|>i%;2_VZdhA3D%FyvlDW{8Gpp ziMf~{a9o-*Ml&(W@{GZ8Nz5}wtKfT3R<-?32oO};f$0+*y}Sr8eZn>q*CIYZFnw~E zVCJUMV78Chls6)NKrq|)2f=LLp9Qmh z>OPl+5dMjaWv3v1UvMj82DdMs2DcW8dvXYRk+M4$Ix(}@#WXNJhfqci3RJ{owQ;GKZg*uDz_1SGu(F#A#U zFEC}Qe}QX(cNQJ?BW<8Q!{NAy*{4ScrVmaL93WmQnC-qza06meuq@mCv|#F}{(_wN zQ;}1@3e7Y6b%G(*-+cjn_Vp-{(|^5|4qsx=2$p0mnef1wp=QF{xA@{1Z&Fn)4cO0HR zymWnIADFSnJ}_qh+T^bWF#>%`9o}1+@zxC<`p)d>t;BQy0&O+pmbRMr*=V27&P1Sn zJ|8wC%)>?g^TA14ha2*~mxz%_`~cmt+PjW^(0VD=w%7}R+HcqH(_xF}~^ z)p-DzZKa)*v#nI1hcGqZU8yMN?g=wK&;jrVERdoTVVR>hoVCp z9~8{Cz96_2v07(@^EHvTA^wYCa=s^+oc|U)9kCBr(gp@@SHvyATuO*p_Dh0Uc2~h1 ztBr!`kD~<709Kz_78a75mSO z&yj*xK*)YF`!9W6@*OgpAwXb%uq;3SY9MAq5!gP!yI_FXFat-$;Uft=023~W1t@!|IzAF>YW@Us`TjrhmV35fZDA%gMY zA0cl=+RQIC{y7j3M&OD7)1TW2W}PDi)1PX+g${jkp2!jD{T*`ZUTVoN7fiohA(-~6 z^%nZH_Xd%(FIEc<5W@w^9z@=c1k=wC3r3{JEqJB_KPB=e#J?0wAO2l1B7Me#KK-xG zc);|{N4VJbR>W%U1#SaoaQ$z;)Acv_lWjKRS@~alPFwxA$ROi6ru#zq@LoOkvdD`7 zQ@2kr?N@Uaa@w!vEHJs(iVh;}2guo9KeOa&tU?|@_Ke8ckIxFOMf@wlv|XLGpwE8U zAad5F<}&0An{m-j_M?Yp5OWMLm^QKw<16J8jKiTAROB`OVIP~bgc@V)ScDyLMS$6s zv4Y9R`Y5N(`wAxa1i|D!N-%9cM=WO!B(HggMEQ25wm+bJt;Y4ldm|vTPrN|5F{)zQ~U?=HC+eBbMCm3yc#6)fd2TgM>V0JhN^7!`g>seQ}wV z2h@=>3ERW5_g|1G|NjvJgeF{+{{eEgllU3nDT24%Ue+e*qv;~w3-WeiPF93%aYeY9 zBkYEYnEe$9rf>HW%r@;U7***$g+AM))+k`M=~&TWf1N5gK%5fH`UeEFuEm1c7hf05 zcAqbp?Or9A?NVn!!UYP`2QLV2Mf{53HpH(Arau_W*^+k9hYV~d@ni56 z+xdUncWjS2>#_~xd>))^gZuv2+mNfilYUWq>pCbR(7%y&x?gq@%zoKLFzr=+w@%xu z)Fuk($O4$mpaoEjc2k(C!NYCdt>R!YTe21 zctKk+k}00aEJ!7z@vdZiK{V0V-3>lNRVlw{lclk!7X}Q%P?8_gpnMd+ubt{Z^<|my zOizc&HC~9PvR%nuI3m9wIpAe;v1lTh%lBpmqD)(EQzpjJaUqD(%jsliEN-+)T3bOe z+$7awv7S7;ESruE6nildP4#qSq8+`N?r1!Z-zhG-%rro|4h>6mMYFNqn5}3``Xahz zrgbLs(Rg2PZ?Y#J?aucVyVGVXQ!1l@XLWJrRBC|k)L1&(6D?|mSs$ucRww+BOGdu{ zoug>COxM&E>q+FgVhfVd?p&v3TUnJ_J(uc4wYFmAMwIK8k!thG6~jm?=~g05_F|qy zdt%*5t675(JNmY(I?{c)u4tw&pY1~rmsO~yUD1*GRCf}(l@!&gwFRAcvNw;pa#l1R zi>6b#l3~U9Abpoir!!RR!;F@ZXBs%TR#_8zleuJ1BHA?wqwSDz^)goFn0#-nCzs9i z<_oi)wq;peM=T#pV?3d?C7JYPI;nJ0JsfaUu$BfA#IlM4i&&K23Tb|sMwxw_+}R{X ziN&ClSV26UjP;gf+x`vLD654FL{~1FS%ht<+)~@E;hJTH%B^33u2j!dlt|9+>x^c5 zQ&{%m1;-Vd-Iq6KYbM_UtwBO>0L%DTN~Or-lO7b#;` z?ZkM>X3!>koY;KkB*3AY$F5@(O`Eo$8_#riW1|R})HGD@$e4<`zI1UY_fKv*h%Sb+ zGaV@m=tQz37OIfyNfnF9j;&9Qa}r%8 zCCm7?z^bwhS2B)0-YQT=#-7FwWT}K%TCSytII4<+FodI`LT?6hA~qo;-&o$wgN)UO zRP9KoI=k{w<+pCSHncfWbvT+IOLWKLSnH{X11QF5$%?3y^x=u447pnv8MacGk4mOP zp(-?^i*`uqaD#Dx!DLG&qTR6^j?y?<#(OPuIUwRZ9y)T>xnUXhf<&SUElc3kyD-U9 zYi^KHYHL}YqgJt8Svy5sp+;Gb6Ft!`tQV*?+>vT^FDg|&!D8gf3NTm;Wb_s_!+Qb8 z^NIUMlRdHdSXgj^>cLLhlU!7|R|AD7qo`VZlf6YB zGg~%^iut;Ds;5|bf;HE&I$Jyu?d;9;Wh*ww7sKYTa3A>Hj;*8shn&B1}^DQRf5Z8sO zlvGx(7*rm4sQbP;ua=LM;=ejQN5EY+fY%3vg-cW=u~vU7onn? zx?;I5m{OrKJ!yGnP4>sJ7j@#cD}(#-!otK!gGDKy%pvM670azxKBKZKu37qlhaLmG zr^EervUiXb(@gL15@k-y=J5DKFU1%ndJ7nYeGql=wY{7SqFrW)Iv{3pd3A>;tIr^Y zgsR(hbG7Gf8GTipQaLm=mQJ0G?G7`PM&KqX1_xBqGVT;DQ$z7AsBYa!V6uu&X!^3! zfU?HIxI$)yT?qMx5!<+3pp30}3R=_~%MMChrfTYl3u9Muy|WI}Y+ZlRyfVGr&}c4qRaSRNZ!#R0_IxKP!w=Bsm& zt6esXlo1tc=Wx(ZOM9?l$>Nph%cfIt+fq~g7gR4Zf?kt3H%Nb$Yn2gkf!H!piB=hh z@m}|U$}5twHzBf7wXSNzDQkzmk2p&4PHQ5#3e`$`I&5Anok8QnKHO)X#1=K zbu@)X!TbaWG$E6lrk30oRhqN1PT&wZNUvB*_WEX<(}!&!T4X6RUrm}~e%J^rs)U!u zZ2}H7*azc-Rm7GTZb|vLWw3@-R4%iCo3ZkDb}+sYt)5IiIpL_|PZ|%S;|mH$6#LN) zK9Q}|F*FU6Cf5UvFmKuUW!5TJvZ(1UoNhbtur1eROVnd45m#8!QH~#7sh0CLZID3{ zqG}F+xkagbylX<9&s|DBLoO?0?6sWK5#>{`g56dQKYj}t`>OH1Jz-fK$b2l>$&W;{ z=oNfaQeftU)Q2yAO2V89PO*BK-U;uYGNrOk((45K5jTY$Nqne^MIJtm;>of({8chR z>v8^T7Y@=dA*x&Km+~^{^uq2awjmtR!W@fpcVV1_Yp7mH%rCmz?#TIl9iBQ#byR9F zoCPf&L-LF@W!c7!JOR>=3uEa%(}XhHs9@~|gZM05GnBBn zn}2cY!OCoLM=!6Y%r1B#r9bN{J^~x0wS%aaQ5TOssUCbdz)#N9c4wS!ddhSRdu&T( z2C0Ngp?YdIi1|f&SG$b3cuPB&y|$KV2j;1Mw@g~DYdnQTmeVIckS(rgdd%Xk$h;9$k_%5( z&WWcpJ;rBc78jNZRM;g?3=-cASk&j3RX>dhl zMa#L#?R|gMVK~O|hAf0}OM0?oO=vGUK~*kgMhZ2Yl~$@RYqi>!IWo;B?uBVsc>F4p z2Y0D_AjU%+9HY+=+;nj#(jCM3E?SyZbR~ymA(NkRNa3P}dLC_xTN>7<9{R1MFdc1z z+N{f!%Gz64(+25WOQ)>7@|PLz@fgkk)vhkAEsmmbo*aauczdk0b=W#|1IntDrvb6Pd>4;fmF~a_`KBt_s#rXWI|;f- zl{fkHo_f(wKQpbwTRcPHaVp+5>rG`6;=@o=)$0?ogmoLuFb~nNP~~vi)E2o48f64r zoApa{1)VU9LexU3)O&4PWGdAvBhniIS;9;y=7v8?RHouZX}t_vhYqzm4>HETP{A@| zS;|`R)$<9x7j2=cK?{XelZnm49rDw&0~L6br4YxSMZrBs!{F+@IKzk}~#^VcoT1#ljO2RBz{FHCbr(BfOEA zO(*loQVq4k$&OXjsIXJ%GrxXn2A;}`cc@~S=k#g+3(&cWWlU;@mM)G-+!gf33s#mD zpcRZ>AJ=jHishbw}80;cev$HZ%zze&Y56@j$nV!z-3k4nBRuzZ)84 zc?i=Bc|sMYRysE1Xv2=fKT4T2`2eRD9he>uVmq%ii*yR z%ut)kGWDJk&*dl5AB9wN==3Ue;r=Z~%Z!)`E-We*+FL#YVQx{cjL>yqQMEuB;+dkB zO*p8c>%wvh%Z0^ERm`3+T>VSm#Y=GBPmE4-hTRt~r27VwYvKg{E8#B|j+(50tIKGw z{21S%#(x|s!I${DD*QW5;GvS{zooPT|E(uO(}Z$8lgE66cX0GrCI6kL2}W-u^oUy} zW5##%zaQoItWwU4|DH5DzO-KcTh)48CQy&zH0TkxGJ!A`eDe^Kk8Lx2tqxy5@@~Rq zg5f*F;d=yp%b`R*{+n0B_pZao@402Z35M^l4qyAV#rE>wkQ=^d9lm<-@p~{#Fnmur zd~?7z3QDw(elvWxIDF{}_N{XGvX*`Lr^yAr^BlfB_>M8gi5`=S9lphuef+n<#=awf zK~Wfg>yQYLHo>%)-&;W3Dj6%l$Facn)*&{0y93*N8<7a>-<_pQD`JMXz?Vi$z6fH& z_rRA+`IaJ|{x!kacMtSz`(|IK$0_-CgtFng!r@zve25Cc@LlHc^;>-GXTx^_zUaYj z?<3%2z6pl!80ZnVO2+lz3FCsr7Wf&R0-5tJX!8aZG?VR_Wd9zx}~SbUApHGD(yg&VegBavY^NNKPSJ>pgh5uUdAuvHcKHjFOii=faB zs)YVy_2@plOHY`%@)<2r zk7oeZ#r~O&FEX+H*NzM{tq`ckFb#UdtxO<{{BCi5=J+yvV;sINWUN*t^dG}F+Tlxp zuOBLGFQ!<5?+T~AwL`-FcbU`P4d65WJJ{mucK9OT<6dEcv9HVF`@rIx0%gn*-Ei*F(}C)m26N@u-~SbWD@e7z3e>9?x?o7`$3PxhO*)7!1oH;?M)2R^|*X7=-Kw&48D3O(Y`qrU#r8%?*`|7V1lvl z5Qpz+i|;fj8~b*4_-+QD;UK5M5r^*`@R{*9*W&vSo0;9-HQ?iU-2}t;Pv{Z1O2%f3 z@2ik8kNl4~_B~R;z6TxqYE~8Pn+G1lx60vLSHZsP9KMkj-+YU&`b(wleGz;d?!5;I-LRuhVNB}@A*~wyGO~_0bRp4dqgSU610o; znPB)%fF5zHWXxTyzhjepU62{R1023h;JX1jCK$en4qy9CMf=XQ`1*v;P%K5K^Soq& z;mbOFFWp?cKTkv1*moGdug&(~ec-D%WTMC9LC|BFRwfX-ZYiE$dXP4J+c|tMf$tZp zg#JT4h7k_mBjD?Yoc_xqHheRk`Em0$;r6vV^P~CJ;{9r`#n<5QJq^BVkZ*#qZ!d>$ zmBp8bvaxS$eX0NE;aoA&kcl3X0rXg=l?jB}+luFxg-9E||Lj%Dmj&OUs)YVSJ%$gV zXY)<5_~=K&*NpFvv-|gM@EH#B7`z|!Y`!%3&~>Um&bIirbNKE9AG)#-4BrTcuixTZ zZ1GjQ{Q*9R3c>JQk8_gUj^``r-2f$9@1+WQkH|d2cBR6`3VQ$Ey_D}Q=;3Hq2*$n( z0PK1Cb=px2y)eF49Q#H=4@*oTn0oU;X}$Fo^nQ-RfZdKJ z=wXT!g5f(4^VHUBgr303 z;(D;c;yc*k8x6iT5=k(8lO4Vp7T?v-r5@XR2+G^-orm-=;bLU?);M}yNGpGduF;#B(4)LnIObaIz$3mwJKo2_V)HElAEs6z818>S&*tm0 z_;AZy;M>FDTT!9CyEuG#@NwL89N@@U;Nt^j+rCxcn^~|<>oNHW)?M4aOTkwUIr(lx z%sl#i2r9ApJ^)|X{CI4)Qax@S!%^M@@-f`(=naQn*!;Z#dbWLcTkXY>qF~=MPJ09J znYvh?!RsCWJq9pL?Iaau5|R)K(D@_RqVHKLC9*1u< zI%}!$-DmNQcleg!J|k?NH#mH&z{hsbz6UJ6tsTDW!52rq32X<$P={|l_@+QkzO{%= zd&fEZs)zfpuzst?Lms=|YN2Q9Vtoex*Lm*aeZM$A=tooUi_o+AMuP7+5=k(8zjF9$ zExt#gYxpLMeQ2Hv^T5|2n33UYf*x@zg$Sd-*N>Qf`6*(<_nSRS?OO)E;VdA*@cj~c zHs5maaUCMxV~7pkYKLz*_~sfi(PQ$v4&NG!?`NXN`8Eubf&N1^D!fyny;ab&?OSKH z_X(6V_MPX9g9rvG=Z6W@V_58*uUhUX_U}{3H+*v)zBcf!qrnmk-zg4X8~C1v9{u+W zbPeC_!e`oBgT?P9LneAm-t6$zVv$;gLgf2}=+S?VIP2*K@P+m7gV3W5t+*Ig{IJ-+ z&mnE>yVBv?1ilkg3H`^k_gfC%ofhA(EWT}FFWrUhL4{_N3$t%4=-KwIxA=aIlE%Kj zfXwEb0=^@Kn~||^Bb02u4Hn;TEWWWAi`@F4pX$8G0+m-6AfZjGC_I>W? z-CRMh8uwRrz4ukn8;kYR)>{uf;|tp_0rYIYd;q_29C2K|Z29Hi*e`6pr@;po6oTRY z0D3kbf7HeBZLs)O?_J9G68NyR7lPsYF7#}^TJV|m{uPVwYYyKB;G0)qE4F>W;hPRV z>ao2W5wkAZ`wxe2HpT_zCK&tPcKFtSuO3R|dkwMSd&c3L2fna%e7(c>ti`v<;(OIO zCoTiu2xFY+G5LfuURG3S$2#cI)>alm_$TT${q`o(rXANhe5=6M$^sIo$8eRy_o>y6 zw~=r7UUT-}jo=Gg4=%&HV~@YLpcgie{_W^(uAuik46ylz;}9EG@1f15dLt|7b>nbh z^Np&YcL?ORUVyam8U1GPPL5tZ(qZSTIw{}E!U(}V#eVx2(#Fppp|D+V3(AGH_naL{ z^;#?F{dQuh-t-E3Ya2`TWi9 z$>Dpkf_?Wn{ks8r7`laE_%3(!-hm#vybz4ud2p(2-)87xNEU+8yU!W-BXJ(YQKt}$ zUjLq@eD!i}G>S$q2R-6e$!N63!RL@MkMnt^!`A@5Fh93Dd@U9qe=p1Mz2wZdHt>aw z)89bPwyzC*W*z6x@EX4R9lkl>J5buhhJG-*jkjU)ajx`-a0e5}grd-+2z-$a{TM50XRFGiwCPR<7Rpjkf zJ4Rad9z3bE-VNZZmokhBe9*J`=77)mnZFmyJdXR}4j&I2NfJpgeAN!$D)6PD!+wic ze5)M3F7O!+QW|`n!&m#GV!!QZ@nsyoH282NECj=Mro%VN;^Xh&QjhJOGPKlxi@_H* zFVoI^TMj*zH^J1~>CCr!t6u&Vsj2s9hwpmuwHh+ShOf=xYXV0#yYV;p}uabJ~$7%bQ+BYf)UtbP`o^4+n z$go5xzI`mdJsiFOd@#8XjD5Q}d~+?naTeb<9KJU2wG`Nj{yWd%%Y$zo^w?hh4yS4F znGWA#@U5yY5*quG4&RI5`={`YxA;zsl=^RUz23JBqv1Oqdc>`gvHpJit|u_<+t1<~ z@9@n5-|JF_k>P7__~t!;=M2av-$aXVw{fNRO&J@0Uoi@Lwtc~a#dUIji|^BhQoaQE z`e~R1W8cTnv-!HfXWBd2;+y51CpUmEtbdP#p3PUYw)oufK#Ol5hcANrrFF(Q#Kyio z9lmAYqaOWtkj1yKzO=nBg0C@z?=0xq_D%nBar_-(@tx@KdHdiwO$gud4&NH^Ef@O^ zwfKS|rS>fYA6#Duw25I?=-KwQJXCy7;c$!ZGbkZh*w60RAH^lbZ@9x1MWM_GI^hp!EMdxY@Kb@--Rd`DY+-x^bDUjlrKL-;O+o^9Ve z@Vx{*j^|@7zB3)Zjo^DKZ2fciTJX?$GkC~%oW-}CYt_z-#M2w;i0p! z?*xnQMTd_+LiwK%`+nu{4PS?T6Z>Xbd}E#Q^6A9z^(An|%gD!y>&uB2-&PJ^GwgWW zG#0UGZ;ivZ0(>x0`R^o)ZzLYdAX%7i^rzu~xPZ5Yp54E*Q7QLt_Qxp}-`}??<@*$T zbtIBtxZi@F%{R~DJJsU*B`UG)8;N~!t|3Eg_@05D&6ftB=?}hl#yr}4o5Pm|Uy>C_ zFnp^WzWmSh`I_xL!{Yn3v);dm#U*V1KI^Xc>x=U@YVqCT@NEF!$;LRu#=cb!-ztkQ zX7T+BW!OAScNLl^7da>}eD?y|dM(fkYsXzurWG;6TGUIw(k}_C-pe4f`C2Q~n|1Ws zD%86GdbG6_7sGn1-cGCDTb%jP4!)7Pi27^VyULj#&x5ZC8f-_(;yd5rniwVCiLv~Hi6Ihx!dB~-{D&iK5R*aVA?yu;hSRdWh}lJHVY&R z+S_8so%{S$g&`^>=*+U=Nb)!S>;J1Z!ycjN*3H)l;lOgm;d?^QKH&*V|p;NzfY z*E`#)x6i8g%MM>N_`;sojdl3uS$vBuzP~ztnO(uYzc_wLTYLi+-{TJ79Pq(ag<#tI zsKeK9@ttGw{dm7pKlfL#Z-t|`7-%FN#->~>D#yP~cuLXQz{#yz?+rCdN`<7XJCpvts;5$Z} zr2ZQFj(7NmKUwtOB^KWqPJ1r}pWz^(!E>DUHiFNrYnNJl;~c)_;De|T3}3y&*8)B> zUicH|)Fb}~PJ7o?ufEX@XK#hQ4oZJJsnFK|}HjEf1NZ-P! z&E=yt8Eyf=0<|_+Qxj^_pkg7lEn01f^?i%hz9o1eDq+57?X&jGo~_y7L;m&tj~ zI%_|B?Y-Atd!I9B&XM&!4L!mse4rA1MZh#Zo>BPr8u-RwaD2jfXe0R=4SeUocb55n zr11R@*1*{HkB_L?`uQ7iQIdS!&{OSe`E6hwTc_}~8u)U+cZmw%B>7qld~-Vk_un@t zd^U8lYTue$`aiD?gPv+%=SfX-AS1QkE`{%-0l|D9g6~Tzz+m5p&{O%&zmD&T!9{#O zQTYCAcrf3&TQ%*nB*RwLw+4DDU&txkGr{&XDtvhczV{HEKanH~pVPqC_7<)mK#%P6 zDtv=*-h^F$|8~yrKfYWKJ=MNXx&q^EkHYuS#9+SD;KLN)8Ua3Zxu|cm!Z*mk_Zj%mRQ@FSt~c-{DtreOzAv!;QSFOb z5U`0zC0`G(r&74284BMah3~Y1F9v-5+4qKlFGb;dLE+mK9c!<3q8Uq zBt%*YzGiI6UydkzWd^<-;QO2!fRp4~Z{Yh3d=%%2@0h~(2J=BIk~^*cb$f?_uj&th zb@q!2UwLS7ee1x7OP2m5?JI_!THhlI-%AQ#nt|^S_#W`H1=??(f$tpn=0cC^+oJF- z92;z(?RNe5Ns?09mjXT2z7c;6Tt|Od;TvJ#s{~(+Y)p_!z99y_)8M0VOZHKmAw3!| z9ixNob1&+@KiZ+E+ERQr;<1J`X|SNPT%_+A9xDrp?H(mwjWT;ruxt?(T+@V$9Y|Mnd+@WuX*rnR9^;`^h*_mqKe zMh1SLhvPCy`>G9mXTe8)M|@`$zT)KI_IvZ*{;%s5Ku>MI#`EwKw(nhq?-m1J;z}s> zW8X{zU(rW_c<`RWSB=FAWw&w#6XDEQviXy&?@o+;Rj&Yg3;bHT?X?>rU2NtT;!;2ZIefS-0Ne77NkYTq;WVNRE1*h;=R0EAQcnC+9m_eXzI z_y!vI&Vi5a7m-QwU1#7c0-pnVSZyNX}-j8~49@*Q4+~j`K_G`un2{e3FAWCEf@<)xNXfvoYVN3g1ctUnTf(>D8Yk-(3d2 z4;4OIr;;A=kHPhI)xJjX(RxiL$u|mms(ly0w+l+tA9UU-`63K_?}5)v1#pslAqKwf zm}J_ZLwt0eDfzY;&Qo%n`Y|KllZNw@r9FZ6`&!}4GVm3E&mqaMmG-SQ@U2w%`V_v~ zah(ji{{D4?PjV2g#Hr9DoI*mR9EH!P@QpI?Z3mx2H2q21_frGk+>3#AU8urG*JknOZ@*8n z0&PU3lJ6lXsrDs*8t}g`g^#}5Q~4%l>%X&-21>qV2EMn!C*xm)!uMmISEn<N zjAYZxqVjeo>KIu?n!8ccDjCy8mb)E#YCRf13(UVZrQA{j-;rzZ{mh^@=8^u-Q(iEX zd-?Ogb<7)-a&rd;*JB3w!j*bZT`8@(Ay{uN^yHjF$7MVG@AbiYsnAoJ&#(7=17F59 z_y!vE)?9<{VH85PN;}G+Cj?|1lB`E<J%Necb3;fqsiK)MFF$`m1mEb-{ct=&AFO zwC5>9JO2cFp|ViLzPk(>g@DasM7*9*M}MNj&RkJkqKRnhTHmvq0PcA+HozI$`P=Sfa{ zZNv5B?_giH%amz1Pjx6s-O;iBf98xCLhGj4Q>W^Z2O__}aA}&!Bugaj`~BrpnJa7P zzr4>V5$m>qu6_jnf8_J|@qY+rI|vC-q4k{TiSiTrFV4ue4Bl~!(r#b zwOKEkJJxGcx3qZ@Qtzv;Z84`6Xtr?Ie6uaqHQ(fF^ttA1u7uR#Zr6MZwyyaht|r^I zUz~vUZg7AB()--oM%xF6*g{uDqXbRsYFwujk?^9qIzw}8X|t``I@{cFmu72mrJ7cx zYAaGhQA%ovEzy-~S&?d9A5RSKFi&_y-p~glZ{0+NuUD1SZPihtC8^*TZAXojN&}0nmf!D zZbN`rui4UTLJhR!`-=C&pNq}zFUk{# zi$bif@Mzo69qy=%SX6-kYw)Ta&iPHVWvBY6ZcB4M0Xau=KA9bsC)9)Jp zophWg4^F>U@c$@y!#rJK5avpel(rblvhlqAgUq+h=ldPwPHY<@IWIP&@f{SUNxZ$x z$8O{OMZ6`Q=lR%AmHbB({0qjvRAiJ-d&cJrZS(oAyc&pGU)_f9v|-Ckd`v0$T@tot zd_+>>+kBSI;q719o=36&BtA7Pr+lSKx#f%>ma-b3?{SHLpxf~j@1Nkw>J4m9Gu92k zIRNjQpc{h^<(z=+EY6$CTd7am`xV(ez&X7C8|E61`OTPYiY!{UI`ei?(RA71;IQCIT>bWO^5xJvK;g@Em<+8HR5XnlQ} zb_JhrOb9XR@!331=VCjLaTc}(j7j$y#W=6<3Y(5vF6-U|z9}We`az?LkF84au9*A?rEw71o#YNZ9bc#7+?-B$y z*m*ciOarTijJzQB5Z0={OSEY>m=NbWt~0q3qSDiCmg&wlwsGw~-x;5;8$ZFLoUPV# zp_(fs($jhArSaypBbxhCR${E(zShX-BA>mFbAk&ihgmrcO_oX-jI?G%Ahltmy%nw6QqS-Z4SUg}OaL z-e-lzBrE2Fu`sl2&-2JS4{Z|GN{wN&qg-LMm{_|e>r?5TpQeSFl(MFY<&i}z7!pU3 z|D0J{8)^IOa0tK(XLM?R&55!^bD}M+=PcTyAv8zAqUv9fz1CLxU;Rsc3O<9|dALF_ zHqPf8c>xtKNQVVMZA&d{jkF!udfc4$U6XC77Mr5gG&nwOu8cyHL+-^&giWEDiG`sp)jm)h~FTeZ#lIa3^Ekzjg*CU z{7mz!BiwTf8q~8!Np)+pXqSh{QgnHspJh&0s9y8xOPXHu`X=wb*v9%O`#VXSlLXZ_D{+SHjFCovx;`ZJUpEYF)d}qgBWUBJC%}pfu?})!R{2+=#;3SaZks07rSk zwQ-Bg*6*3>!aNZX`Ss?GjV9X?>qgT!Xgm_AjHpSd;tR8TZVg=jr(dU^JJr=iXhq1itgow|3^;<~yBoZ-X5@gwagBf9piP{m^5Zj0So zZ%$ilwmnk4#*BUtW=)FJOQxnz`@UEwN95O;t1n>5*YPiZucZAK9>yJqJT%N!^`M1k z9Jc5qZu->@dvkkW#I=U@g}5m)%pQV%bs-GCQyXitS-lBSsr$aO_+Zvztrq2druF!I z9iOUW&|0aj>b4CQmLfn1uW^mLs{QmuGJ0qAd9frsYZ=En}te+6&f9xBVXimeqNkWvjb4?tSD7vh0u7Q5lle8xFB+PUz3aQ!~ zUA0XtOBaPgH??z(XqeVWci8#n-WE9h`c7my9P&QfJ^c=UFY~w$10Pc@7n)Xx2Sk11+I?kP3{C5 zFZXKhS;On&p_)pLYs)g!p^#ry&1uxK4asG$&`FiAXmdvh4# zGa#t#+g^Z!CMLO@Yj$EaQ`hA4)xK;_dx}Wqm=+AsMYN|=B0a7`h%l98JG5EY$pKc0 zO+q2i7L(*)rq<{`xXaimg1cGk*m{NA;!oX5TfCtiiyMfp@-!Z5Xts?&@p}Jzrs&q` z)0k*ea;T11{jT3J!xRt4HEZLV&D9%BVqo4|XYTl4lP%p!|2lps+w!DdBHFUUN1hjO z$SJ57X1E2exHUMT%%8Q`?aEJvn`EUcvFksNTejh%9ZwC=E0Z-(Y5(e3K3k_JVZzq> z93FTd)z+<2XU+dKN{XuI#fFJ8QKH^$V!o{YDBwJz)!{sA%sqIFlRjyZtTl9H56zkh zQK&sUs&kAUmTvqz!qP#_wz&F$W_x4(^RRjU@$3BEg7LD*{BpW0B;;5~Xw@6hRc|_~ zwnravJC6E%M|z{a+J?ww{TRy}Ouw!WQ_W^qh`HuLSBRx%r|p*G-6wn41nS!_kLm_s z6_Xy)JmkO`j5+xEfp%Mm7<%q@EP$?_f#K6~0nyUkdj=eZL)<+XiJG;y&;55N#=}aJ z7w4s4X~zYjoQ$9q`xFZ#vNK@3fzOFY4XbZ+R11Y429(0|$u(zS6WVc_&*$!*;Jz4c!4eV9SYtXI)^g@lXz_LLhy2qb zqW$~Ur1(EgKMNbg;%H^h`J=r}1v|ZsJ}kg6mO5@S*%n#xk7IE)mQHfq7X5whPuN}Bqkk8oIulO^Je`T zU?@&rzP2UfG^F}VtWM$+lh&s;`B2lwx`;+xQ47Zul;)sSmGnVT!8kGRh+2#Ilva2J z7Q552sKV+dtwOUcsxJ43EbCMg&XOK*JH~A^SHGgI$e)NXiFl!(TzpHI48(>$Ye6># zI!-TSb5qQLWRe9=^QAW-zIKke`Zm4Tu05;K&el1at+S=a(>czYFoCAfn=}uWd*jX4 zY1;7~OnIwJ+eYhGy7qhyeR5nnA%w?<9Se`xj9r?p4&3g(bRf1a>{vwjv2?RLqIc+} zm(3m1wEZpSw5giQY_4*fJZ1|53}TAM98y&ujR@i~hwkWgAV{8R_xVn?ckR6%CBR^@ zZ1U`DZfH)LzN&j-C`xIyoC>WuijrLBcwyDr@UFcv-BiDpGo9^y7U4k?W4HcXT&1Sa z(Y1F7?tK%z-L>Zf$(;5lI_WJmc^Z8?JW*JXcFZJinMvWo)3~LfSFYg%H|lB2u};6@ zbw*=+%JXCD>#n_KNl7ib%9}9Lvp6IlE6X2&$zGr>cDutfHqwGNail$bPID|)($e*; zFQV1AUA*XAgSn=@r>dq+j5OO!n61ai&D0RB)|xY@vb$&732_qrb$p}GQ6E){6Z`8; z@|gpQynkFPk~Q9H4SsvGS} zi1#Fn+E#PROkB;)vYPV~&DH-!mZQ#l9s@<%VLdc=?J3jS2>qMncDD)cW`r7(dltU-5_8Ng|UBv)<*_xtC$9;~jh@5#?<>bfD+p z0Sw*6C&if_pX4D6NYvd^e&wk8NA&5xIL^19yEUp|*PQxW>ggQj z7R~3044O3fKt$i(oPqiCC&rn%uYJE{E5^zT7elUCy-`SRirclWxLNn_)k zYh6tXwr%!yYONuiN8L@Rg)3CUtm_FiX$NS*k1d$}JJ$7jd4V?xtKhs`Zc_i~8)B5{3XynYQx zZ;-=bi9MK3y>a*IExWpUtvRV+)=TEJGrqL>`eK(fMXaH&o;wlsLc_5yh~WkoB>$=E z7V*OZmq3RE1$6yHE3}m^(cl<`bo)V?lri*KMgiZQwNhEJ-WrLM1G6^$8keyGXMue* zo2(iFI$;>RqiZhv^iJ4Rz5TK+5(h=uGrj4d@y^vWjC(PR>%#3d7{+J2&!6cq19%cg z61FeWnup?>AzLIou%*S_e4?r7_4X5QYA2k_UCy<~oNMBptHw`5AJiykPv?HncGTy4 zx%a7$PT(>ZDrbG4;wM&Ne+(J}cYTdE^u*m)RYNCz2rjP0)~e&tRZoeNzQti93S9ZK zo~qFo@wP8L>6&bFbx97|nS+(F*m3LE2qdSh4tJETX6x)Ex@PojledYkoMb#=)_0dK z7JCC|@5v@lV1fjYp@&*igq~AYd!$W{;p%Y|-JbQHOrT}T%gL*~$0Emh zBNM7#k3RAWtwPD{Gx4&ldmP1{eyy9JUiaYjhRDed5ht#*g+#hKzeeMD z8v76ztT$e6iOq+GZc2d7O z`$a^3dwkrQgjdWRd75K;+t!=S)j8V9qqDIF8--IGvj|D%KuFr@^W7SOsN`xY5Lek; zO+_NikU8Siy}=|b6W35OUKgkIbj6jf{4S*{!Fd=YNp38pj>WBBj!ZN?+1J_KM?IZa za0uTFr2PoeX<=y*L3Zv?PmW-+w;|`c2~q`#L@cAo`^C2ND8y- zckXD8f^7$yYA7U9*F+spw?FTnt86#5V`bv(+RIn7EGygl=&F}kg2bN~-L>~FQBJF+ z)7fVhrhtM@F6+$hb~~0r2^qa6_oceT=BEAi_PXTe_WkuYcsr@kR&!@NwZZFYqICd~ z73Xc~I9cj!Kbc(DRG$dVR@&>U_b7P7=$cd2fCZ9|WkW^Rq_yj|3<)$+brq^!2G&utT&!k)l6U7Y`V zP1oLyQlTTp=Lt7?!?mPdESajdMf>}3YF(83D0d>-(9I+j^tiJ(m(E*m^G|F3THbu1>^F3|mK;)6zA4-L)@5)?>-fH)F*;TbsM` zQsSZ!8)0(VXl-ILl&!b2^4_nc-)`2lYKNBhs<}E2D?rkjA$7V{oguiTVe6>Jz)U(x zQs=nT5rx7V=p=noWZ_Z!^swrWztrdBy`73_h&cl(H?`USN;zoZ29&qM#?<>p%Y%A- zFy-IUPCoN?klbISJzh(D>q~d{wtHI6RQsV%&Z9A4a;{>zcN`bNYieT;CS!8mwnFlaZo&RMyYF#KlS@$Hn#qh@nJ- z7^4T6VNtHQ)#D1x9cftG+~;*J2Mvy+-SOY+T#+$BtNy{|i*akaa5Qc;0+GwPimZ#G z^MF+~Sb<~hgl`o-5HtBHYc&wzyY?+b-Gy9y z%|>I>`dg0GdyiC~(Svx`zLai`XV!y#u7r6RE5$bx1MDPr{3NkoZ8QwE9)hz4_mFtUnTcc-*MS~mL^O1)V{}2NOi*%no0-Q6HV@; zd9fdg3|;%ma47AvZcW#|b=d3Zy`p|W`u`)IxmnvdkY*jaGF%*anAWC+%V*C!FzrB` zdtObnTRJ0Mfz!V;G53+T%^qmDAw@S*@XZr^^hN9Ndoc%wfN_2*V#l7WFO0gpE;0o^Mze;v%EmZOoX^F&aBa7r8+%|I z?j?X-c`-xWX58aM=hgTEvW_kzY^}FY9xnGMQ~=dgFW|DoapYzFbTHqW5p;y_ThN|D znNB}KhlG|}G+YOmb(ij2-rrKOfqIFxBAKAqOI#@Mz7(W$ zqOl~%HnzXDBUT%*<>9)F;n}Wud=(ehP*=W4^PIKXhIz5wXKJ8pMy=LUkVW+J<@xCMwM5r7=`slChRoQ8Vw;g7wV$2R6WyX8&*3(zb~L`|LU|zjaPQ=8cWr| zXzh4((Q z{4D)GkFI^STvn)zpyYuG8e5COW2ojG0m_COvi+|;#iuPXdE>PPjNhkJRk$`D^JZWfnJ0yPpL zZa>}Ei6i3TEq!$&FpRZ7s$Zw?+J76$mC`uj_d)Ug@+BXVrqTUaC=a*)R(YeK4~_#C zNAtYRV%>Bgq|Rasw~yB{=9qDU)!@ay9S5UqN&9b!@-~Ma^x}J@`Vd=Ty`@^%Gbx;6 zKky8^KeTY76)74%t6+ns>KlQuzM*g;U-02DmANwcrfP7Hcay z9RAx|Oot-|{Om+yU)wLEYKNPC5K%QD3X|19&pvI|fx%?_(=W{)fVf^eDAcphQu}oL z$P1pm+N|-{d-g!qf($*K?oIFr=O_x9WPPO&9qRYuEk=MMv}+%}w}@S^w&{YyV)|D3KKux-Xdw z_g_j|<^7&lZj%yh)w|Si&!IR1+r^gd>2;D_+n(5|X2_C0TEH$F2o~sL7 z`#QHh?!$$l?5BJCTEuxLtHkgI4d`&vWQgtcv8h96;q_Vs4%PCS^mhBii)C4=uMlRnO#(v zTT(eWTO-lK<%N~GndP}9x%s7)h0e;t(vr;Fjg`u=iVbCDrR9~mIhkdpg(a1ld8OsW z&dLgdR(4^IK~n78n3-4Z%r8b^nMJuJ`IQ9*jogy#@<+-lGb;;nOEQa{*~Y^gD|1V7 zP;RlYu!`J@3No~^FnfJ&rN~y`EXk=TaIVjt9j$lm z9Q3UtacsqS$E5E_sNMPnMfU=!mS+4Hy!RNe)MG zVaXiFeN#7%-MDrl+Y;D^@5vo4m_B<$Ihv*tonMSmHMVGj;dnWQTxl^{r82j|aEL06 z099754^-+TExWL+00wVBym1tk?SWCJ zaTb-8D492utS>2jSdqXZ-~?!v4UWXZe2h7artv|;HV1>`q1?>%xsOz6MY;LTY#K01 z%VEr7WUr@DSelpT@DEWfNGnsgpFi4Td|*03mP7=_4duDx`=u6M>cr&nF#PEo>B#G8 z+$8E2jt_*Ren)y?2}TMPpH5R#h6n>I^e7->g`=>-QCV8*s3^chEFDyiekH(2QFdwR z`odgxGt7s%6~cN<+t~#edt9CjTNQq(^hhOQo^bQ1Me>C^+P*Lgw-Jq!u&?92-h< zHMIPx3dT_^ zCSAlQ!=xLeEu+^}ldV{HQMiNw;3yJR60xYH)Dd*B5CN^UxEL##Am({Xm))t@7`!_N zz5xT_8q`H)<)xLS*`-ARr{#c)F$W4PLrd~=sn09c7nTK2Q9&9s$>!7AEIX$l6O*wM zi@3b<(&EhQT)42}vuZBs@6yHlJLV|fP@zxDS(x8pL>W4&KN~SvHWcMJN^&tO5DB1H zqREk7SW<>bGRIlzgcmx-B3{E>v1Gu)h?Wc#Vz92{>Q*2cIV%wwG*OdWETAetSyA8* zPG##ekqZ-eU^w(^lkQMdFIreEoWCI5k?kyVW)+VdW#4==Vw36_4uo4Ia zA~AnC<|15cI6B9%%%N{@m)ljrbrNf?t1H#Ng;b-34uoT>o_{^3Hh{8HQhc#L4Y3+g znvQe&y$xqRXf;QFS?`i3KaRVk4>;x(t7+@Br~5n?Aq<88d{8bk^-`W zX99%yvf>IYFSEQPUsHRVdZ6-=vRqnYh#2d)0TF{UlY4WqijxMyiSX`gDv zg#{{*3{#BIL|-tUY$Fs;QBA4x)n)r#v?TXo%sb+on@9fZx7r1nIgYvuV z5d08GRj_ClZM#XAEWpN$Ct7S_gw1~snYO#Nt*2Ks4{oA#Ry#InYK3^+h zlkODzOSGwMf?mHnwU_y~)Gl#+x%L;f=T@;lL>tA=%Xn4n-=f{b?Xykn&(i*cEu~a^ z%-T)bJA8bh*q@>$vb}nFN!nkS50BGi(#L7J&-IxPh6$^^8yEfEZTg-KJ|Ja zS%Th-O8Sce2Z1cw62tx-hJEtdK(YiqiHq_t4;%!tXm=U*?=kG(YuI09*uPI3pbX(C z91Z31NQ$)2?oGS;^K$t3TKMrmEmZrCRUGmkU#ARt%Kwnz_;(G*e`DAmX(<00<#+YO zw@Z0e1MUBi#}gSq`-cpC>hJRD_$NF*rM}g`FMo?JkH2C#{bKl;2_KzXC&kuc18^^F;Z(m5@&Sa}4>>#r{Oc|7t?0G#P<_Je~dEp$CC#C z8D_{o%~0Nl275j>+7nom-GJ{aU{f$3RprUfL`pQ~l!kcs9Hc^^hz z2jfSu9mANO&7R2kIcz5~J_Gqw#z(Q8!8inQfP9DS`8~FC33FSeu>2ynWQvK~D4pdt zaME+a(q?gPx@; z<^Rjr0r?k-{4!(e2WoezAIX^dVW1+9Wt<54aK*@ObnCaml(1J8y>oN!SUU zR@h8+C;fpK%MQZn_=hwGAJZZM^|3|P^CT;~&!7 z_>j&L=)A``8~7YyUUr>l`FhAdA)JAKNT1{$r>3d^GOghvC@vn>ffiuuq%I9t~rLpVpriG*`?Je6>&ru_qLOEJiFn=YTra*GY`=Ve?A z&ZUfhM}5KgIOGM4{{&pd_!96&#tG2hL^x09uOfVtj@^X$l;;`3d^*%fI91cWi@bXn z)4H&kaK4`R5aHQ6K0=sJjb0>tt1f?ya4O~;8$fF=+GD-{(S_!-8)uaGZe91;y*V*Cc=4-np{>ld(mHsTz@ zxE90b0V5d4V7q{EEVhdo)A2hPgHodqPkF~+o5$FJEe%(aCt~|O#we10Ln7p{W_>Ou z9g3Y>Sx%gX7&{<;jWNa1PZ$%=zZg%&_9EjM*nZBKczleLvArJkq_QY)G~>B+oN)^9 z5XK9D6BPYPjHA%!QzeED&7s6ebKM<`iJ#_5S=N1w(bd}hjBUV9#$@Mu#?_H;ybJh!#>77gZB6=(z!Mo0{}jf1fTuHV2F_P>)-hfKzGBAdzz;K~ zcHYgH+W7!uYUg+qBJHHuM>rjFY9qo+fs+_70A9-&8!ekL#mjQW6pw2dQ|#Q&m}1PI z8IwJsi0Q;n_6%T5_RMBX>o|I+m$YpGV|s@kt>;Ki@oza}>X$4z8H!HRw?;};>Pd7bjM04Feh26zhN?Z7h`Q#;IN90fm_%Qyx&O=9Sj zF{bvU^#t)#dp^mSc%EWR>+z=j_b?{TXBj7Br;ahLr(R%8b$^>N)%{(@RCoM-N${sYe=N?g zs4Q9o-pM!zI>n4*P;ND2sB1Nh7hq>Q<8+`M7{3SH$M_uZ z4LI*2oezNrGCmKS$oNIz*^EB{PGd~`^vrC^djWVU6(SqAIEqGGN&^pAI@eR3%pU$e~j@O$iK&!=9g;56#svq= zfclFuty^ADbdEAUjl7+VslP5TrvCbZG4+=f*M_A15sWoz2Pp?0D>3ww7}NRIJ&OE3 z#);6spYbNxR?L{zXg^o|;#+V~*18-vW6k;{xEp zj7euWV>(y9kuh=3VEhT>a~NL$Udfp9-p`oMgYy)55#!IGzmYM;r7FhnLB3Vd-^TcE z@ce)=o$u0lGPOVDZDJe+Ih`}he)%QiBG~*Z#$~{7F{b!)j`0X!6V9b6ZzJr#o-ru3 zXvPlcjAYyi`9#Kvkk3-|=P;fM`K^p+054Q@(ity>d4L1 z+`*W}`(&vPo|%kyK%UQ-@~&gN5xAJ~Cg3BC-vn+~^j~8<5u9%-^501e{w~JkZ|9{P zJpW)k2J#Dxk3jx4;}poRvj==Witz%-2Qf|u9 z_A-7E_*KRZ;CC5Q`@GNiGsyp2k)LOL8S;NHrZL{jco(o4UnI+T70x&uq~jTrZPOU1 zpnn%KUI6@E#$?02jME`6W4si2ALC`fKVwXO{vqQw@PERXc>cwB7i_-BxDohs#(RKG z7`S9J#e@*X&5#ddOgyoSPovy%jLBDTQgmiA?nU0Yj9-DyJVobr#w)>tciD(?*8mqW zegODs#yP-y7?TYL8Pi<+5@WLASBwiF|Ba&mhNACNFwY z_W=J?(fK*!7RXO3@;4c`q5Xfy_%+~98FvC-H#}fZ6yrA`AH?`H@Epcxfm0a22fTst zIpFUzCjY^&>qQ+~Am66Qf57+x%J2i(;8qZt0hf*@#u5YQW={u%Y@QAtt z)4ds@?(=mWT!z$QZq)HO#*~ljCpqPt!kF?=`j7b?BAaNR7+~U`j1OVrpT^kF|0o1V z(tg6y{&oP>eyXy(H$e0k>evmP(U8Z)Q%=1-2@_u$K7@(yUdAM+TM9@{91k$2a*7yJ zIhBmbM<`L-Qj&ItAifJbxow4=Yjhn4HZfy#EZP~E@{MOX<-3_N<)g30NuRs)sLv zm@4i{COM@$@F7gx%NSE$(axMVm*vD=#26dx8OBtPM#k7^`xsN54lpLpR~S?MUS;gS z_VT-ecwc5M}?L&FweNdD~`d%F6O~gN>1bhfnSrZsjzFCYZ zAKk`5I@c=e=r@!FH`QW@7>SA`Ol2i8rm{pIK~80*u>4wO{q-BlqFW7OCgLB`SbPXm zS)yEEDogk+unk!FE%3F<3XSZi4dHuqe=OyZ?J511?#CDdc?<;%BveUYDr*vBvSBu3 z;+V&n{3o3;HrkzxiF-L?$}4;l{FGPtBry5X2G+qwdyFyFU3^as9m-4l(q^*BM2bkF zE;OMaiSdX!Qj+zeciB-H(wC@?GzMow9uFKd75|V#djb=83O*z!?)w=NcMfCX&Sy;A z6^zM7VL$RZfVU{}?To1|PctUYdd6heF2=+u#vOQw^C-&`v88<(4~dH~y^m0|3CBZR zI?`gM>$+$@fw2*DpOhn;kQ2v3#>64w3G!0iDVa9u+y2UZP?ozu*P%S7$8{|GVn1|5 zU)-b1scvNRPa$_O{sr(D#`JDPs;BHPToTq|X5b$ZM`FPvvAVrgB98LT4iIdX^LagN$Ratz=B~s9{XD{DiRsTS_K!SR~4C?4ws<9N8!D zs}yZT!3l}VApNsY5N*Z%cpV*^NgBAOhYw-mraBO&x{DYHOx!oIoVZgMlYSawDrXU6 zDo2b>cjF6?pB5vWM3D3blBq5)x zWBPB}tYcA@OUJ||+fB3;+9Ux$v=z6BXsai5{aDhcN+3}kC@B@GIy$fU{Um`s)~zjkIstf`3S| zUW7%xP{<2(trz>!H$+{sNrT75lR8eshU(Y_{i%#!1fD^d+lQK1w!;F(PeI259Fu~7 zNMsLTY7?@7Fxh2iO!;uCD&)i+$2c8Z5&u(kj+HE@y!SIEJ||F)V@qEdc+Uzo8(ho7|oN!nD z9;6gK4rs->#o2g)y!^SUv!Y}go*$5#n_1$-16?xdr~8>jg%y>Vc<2*7ltY_biKi|2 z_5Huc7Y~P;T%KFx6bh3AKm84UsEMLigeTOLJB$7uRVq{H;b-j?x%j2@RnMi;i&iPW zMb$_te}LZ4)3>h4{jGWYh3LP6md~k>PujYg_?z_nWO~iMo$QR0q+U=;kd$SFhD*Q?dlfQ%@00q$jrYF4}Lz{wV3)nnjFVS^!gBkop40>h+J={RMmIYVo(W6N4j0qaccw&sdJbC~@w(?*B zY2;PU4Uh+NabF_JBw-A+}+kl5oh$qxZT{7kNp8A%FCr?yl z!X5mjQTFW8lDtej;YYYnVfIzW@$3x!aYkk9waIvtPwwQ~@4ROcd@Vb`qlT^Gvce$# z;v58FrU-hFkdi4+JUq#tO*tYSR-%LgwQAzYLF+T=p(B}iKwqX>5?PI64ZZvy=cdPI zWa0^$=-Yh1dDLof1%Iv7V`BA2hE+NP8PxjV*(!b_7)+|-sbs2YdH@qo1oG=rq2f88 zc=So8(y6Mys~mx$iKn39u`rmO^Z@Y+IRGkO6=d`~5}8Pk(#-&b zQ)mb2#l^S>02zrd6dyW9d{028@|^=0U00Av@_i3VD&I;}VhogsFAN{aN5At?`RKdg z1(J;QXm^!?Zxi_FngQ|AH6_VM*LYRF8E6c;rXdsQQF;g;!YTMrIs`ttW9Cj=_rdGI{|8S&AzLON!{=TC3|mG2Yq6-g4-!$#|Zp30Yw3#N&< zI7EE7WaQ^NXy9839eVzSOpn|3l`p0=(7%HfzJmrnH~8rL0hy$IdkuUG z6h7R7v2>r)pwzR?=1LkgIp$QUy6ZmkHR+`%98JK?hkaI zNU`Jk_vej<{&*XFbWM=@VROz06#;RBn%C&zCbWYWG_2EI4Jm&$o)Bl)Hq_zr{|-H1(3@`dXy;6s(jnQC)+Ox$0grs7^m8|;~Mt8 z0VS2MQ?YN7!uPy^Zx8qul0lrLeftc2y^4KPpeyZr3s|-9lWW*_lJlfsOKC<$p#5mJ zmwfwxRX+NnB$YC7lJ+%WpKuDxbHFFt?&2HkL2rxajJbICg}Gg82LUm)b}j-UW5|y-J^@48; zl&HS*@R5AKHt=l%-wTqA^=S832EI*L&@@9%eDm>|-Pl;}5|gi~k- zY0Sfc{#}TD$ya9JTMEAZ+K+xys`70FUlDl7zS|YP?1!bx8~84RPmbRuI4C(q?AVjq+@0=&6ZxDD8qj zTbBB;>eH%dpUy)mk$se;-UQfZ)Q8!b(?)P-KxMZUQ5kNp;uGI(L2Y)KYAC~imV~2S@!8!gXOy+ zPgCVMRXrOhlYWELU#esMBT7E`KC4$*_G|SRlhAL(WQyhEaZ;}a<;wS8NhNH_no`oi zd+z8rT{2ZExSBEjo{LgGwhzeTc(3J3#`CdF#wUXJ>33?W=zB`bu_ZsHM8D&c>7Zis zP6gL8-lfRsw{($c0cfP$hK;Q3SIqjWi z?Bi_(Z@mgX>Aet1|M6@G-fDQynOEX%KHm$h|B{k#4VS0qM7?>xl(%KPeUP{1yd{10 z*{rnxg*=u*d+;UR4?%gg@|b)#q^_dPQEXYN;K%0a3Qw`@1KvKy+Zou#;&TC?&savk zOBRX7@&Cd5;#p3zT*Mbj>v+4Kx4KmS|2WDFWBGNwwPQOHpLpIU&F?clrpP3Zd_L?S zaqRDW{JcT$V`X1Hua?Z3-oO1ZWsy&KVZv_JR{!KJx#pW&!Y7X88P_M&&_GiXmMgz zsQO`}JG_zJK?rxjd-Lek$hN`a)yP@Sm=(?^z0NHM;#_f0(z~@|#OuFtDNVc|S-i5+ zqOBT&7XZ?Wv_tF#WqOG|UpE&wqQI3u%at(Gw#bvNwOn$Cc@u}>{eYf?na`i>dMD+B z_GKP#OvBELC+XeZeUVPwt~f=rM(XcAJ|lUonl0SrjOhrWcWD-++s3xzkpg_MHT0ZC zb6F#82k`Rpjux}cuEnNk)lHs#H{wOC8HrlQ&&=*i^iIOwM{FUR$u2S3O^VEj*Q~?1 zB-}Q*)P#f8J8Ay2?l9S`SYKd#ym%>U#(1qd z)oiP;O*W_H(hEy5W<}due`E%A2VUqo&M$)%R*<>F@ZQBZpKsi7bH_9j%Jb~~V}sj; z_a)XXnJ4p;?x_%H`|FI|RA)39lQ7fe9N4x0lWtKlU9IzWK|9?!$Q3tmNiyD?ZN^Ik zVhT;RnO*yPyK#D?E1!sq?z5oB>%v^)2UAOJHG_3}+`z}?r#heTCQLo*^S%7~2MH-% z3AcI25Ak?y4LgsCo)V3h_G+M;&}RRly+FUfIMfTT!%SLE@7<-BMjj43KJS$1uEvkI zZLQg9TUqnqW}mNSx$P`o-foLUO>F5kJ+9p^)O3^lj1zAZO|EHo?S8rD=scef&II$E zg9@A62^j@wt%(`oro&+^54xAbdnQHVCG%FZ#U17ek8s6BdE*A|A8K+x7@sg4zEeYr zJ*Ps?cAr0kcgI?_i)M6ZOFJY-|4D7@!uvwwqHAN#*0;bs(i2YaiFDxtQ*$(4ds|iG z*ooVhH}B|;vdx@E6*_@-6dhx6#SKF77tJP@*(^%x+Wnhu?heaz9Hef>3$gL$_v+70 zWcuT-gkdNkqh>i?vYRn}c~Xn52o-Locei5;H-iJrc~pOI=k9j}8CWm~@<+S!#}+hM zU-iLP-05gBctA~ekdGb{p0RRB9GF7U^>;)TTZZ2(ydc#XGrhkdjS9&j9h&7Fgyxw& z1O>Rl&3VZoWPGG2ZlE^;j=%r7xw@HtYd9=LJJ57&-;GBOM%jmrKi23wg13vi6TJyD zmxj9*TRn?IU2)N_#UY@vx8P;MH{=Zs^(2b-#)gUa#;!Zwb71FV+tBl_p_(mpg>#_Y zJvFJ`7U^{kjKgh}KHv1+mQC*-IO=Wu>cAPiHrDHm_U_XTw0rlW-<6C>q17OsHv6y~jDw8yD5k;96v=a?f)u(vqHW#b_BDd#&|a zUDHNM|wYKd-3qd{YI&;T`kf6HiL$qT7RnK0B7Xxo< zaJ$1ZHqyXM9BJU$M=uZ829jnp&;aMw&y!Af6OC@`4=u9pCkjZ3 zVY^{(%^BKjr+-K3Uz5Ai-n$?l!~HswYYdHs#>A)xYTA;f&q6)JO&Hx(E;7xPrad0I zHloTSZA&v98#5>=4=*@3yL-?$@y?j>reXP3!ghr}d=9vF}W`2#5Z;q+R;7@XPAc8Wtsfs&%<1WP_(0SL)$^eiG-Qn zr6EV&iK==(x~krE8gKhOyP<1o7`^tl@pJD|E4}=8Y3Pxx@73?>wv$G{_KqclRx!QuJMS=aU%*bPj%df*?$zK5!+Y$;Q%W! zje8;@vf>8j*PGLBHreJ^&oJ3KJqe?>9X|$FMXsXXHZ1imnK>w5r$JFaoj~53Os4FQB*jBC#$@8yT4J@jB)t|Jtc~ zvxYvjx~b+gH@0?TJ@q)uqs1CUy<-Ve5e~3Q8|OCX6^yX0gbcIUf)Gza^6&%R{A6#! zObWKNkn?n2@iu;qSZptxg*LKyX07Bbzq^wRTNw`*YOV2>auv zwvVIw2CR)}^F{srIdj^xri+73N%v&@>xwtll;qAh*k}Er2}JyAZ+%S%|Fde<3;jdd zonWsUup(hXYQiYQ@Kq*T8u+{RM0Ar6v|9T@gww-N_e$)C$XM6KO}6JcD5m{HUnpP( zs;x8GI`VHecce>&VQ5p~^w!_0YfB*tj^jL;z>I#U5@oKpB0Mh|Lf3fuUGX$;Zd@7V zNtkFq8Ba@(iPlc}p6xzSEj_Bn;gs@%KbQqvUI^uSu-U0Eghmu>bmEM_y|b#iO$@S` zws$Zax)Nrh(hY8`z;-+<2IXEJl-~46PkKb~AjD{syrTLeFI)`K#N5)g=SE=}rbt(a zh6R^3%fI&O_>(?fLa?s$hKFh|NALJQ4nzdh@=Me*sySiYFtc^1$-DQxg9qv&FJVlr zHV=QUK9bG`#AM229^|NV+Em1zCsN#PuK89EUSRKz5>s3|0u<{}uOmv*^bq&Nh(b^P zES&c2K!*I}tVLS-kV#f2T8jqtt&v!$i70UO2^R?E+N{;w7lJSW%~eAT^L@NcHxcu( z<;thFH(a_>)tZV3m8+$v~AO|Qgmz^k7csh=n8r@NdB{UsAL?vJx?EcjHgDXO*YfoIq zB^}Ck;`ZF9&w=Q)v_}810()wL;DC1Zj4QTZ*Ih~-A8X%ocG=SoL@mt!X?0u;Ua#n0 zSski(TG#IV)x%6Uw^$OkG~Kntx@Np*N$Ao?JWE2Be&ktVSp#HV`lV-y3DYZuk$ue# z%@eJg#WheXrbyHzt0I%XxR_u@h16)4mhIX?2J@-Vb$jSy**r39~WGeaW4S^+WTJ13f56c$w{l zCnoaVW!f(_TUy$Gqq(A! zhoD4M*{U7r89rK+>F$9`^;=}Xzx()XY5WlPB@9SUM2LO%eQz||tP_{Q2C@1Sm0B>) zeW^3q`&z<*o@1R+dNa|1n)V-9Y}2O&VneI>l%^^`x11`h4|gc8HaZCrztzNAGZp6=a&peW^K7S|hny z&51|hYJp1)E#0Tg@wiSvvcu-Wp8LkR66O_0(kLBa(qr!aq1{wpDA;1p_PFk#aOk-s zv^fE7dPkW3_4%HJ)C={rI&|F;?gDm4yY7f^HN|fG#fgN}=Wji1$%3cDd7ErP^7>7} zb)dQJ3Dl`WqgDI5^ZLmHt_X};E{Y2!Z(rAp`XMUq>ul(BhxN9cZ|>T|jo24ye{P|_ z(Gc}`O&&+{6|$~wb|oYuB5ykhimG?o^z6s}FLCbzA60ek{qLE{jWBA0aSVbwfgk|_ z1VjiF+Js983KkGCQ51$;NHCC)1W6RzWW+Fu*g{G*ply?I5m9=C(i*IsLny>(rLX3A zTI`Wltf!?HPnBa870mnlt@W&#Jws5>`M>}7U7t+$cR%}C&$?gsnmucqDLwMMd1lbN zS}T+O5pjxnz;d6wvtwVZS$Q}+N~!kj_yl>8^X%tp5E=9@hvM6Jo!q3?tV$K*g{YD?6oy(ssz*lii=n4y2R?o}ne)rI=3J+Lhil_C z&aMZoM`O~lN``f%QHx~s-JnhIMh-dLygRUc&p5PPjzlhNVbqX2e&+1@XNUiIDtgw9 z2b^6$cc{tI@?%3K4&T=X^esZ*e;zF<|Edgg=)0IARA|~ZRuhU#Gcu6uA@iy&vNhCT&#;+ zjU`OJ9uj@{S_rv%L3)MI)P8i#wePdaupDH#^)#-+keZ$0KrJqBg3lslbXLGKj9iw7OV#~+agqQbm`9pk(m}j>8l2%UU=<;R^E_eox zKsPz1)PFK-MdpBIfg{arGq(@N7VdYcW!y(({<8aV6^4#)drDHnW2*BB^+{uq_-OmA zrSfa0tdN$NJr~&Fh&sO3zQSY|>tae$)3)Xns!rzP{^tO0`@28O2w(x?!s8t)5M?!Y zbib@tjnJI-g{>KV@id?Lcp+xFnlxgjKS+gZ7Kz@u!o;y_?Ps2w5-`U@d@yGif<>x0 zEX4XAralMIRq-G_9Xd=@Wu0M0vq$4SH(c&HcUkFa)epQb?PHa5ble4}9+vzmiA@dj z&m2KD^tUH9)gSHFxpgY~Zl{`xqJmVujPDuzz748JGUMA>-9BRxEyM#sPm5OV7%?5x zBH7l6qTX{_PXr?6C~D827y5UtZ)yz0d2$zGrRSCW6S0BVhFc@BB#lH)KA|2 zWSYAinP=*BrC?zn^I2RUnp1aPcZ0j1Q1w^WmZ>HF90#uFaD{nLz@Ot%YbMU4PU~n+ zl)o*t>G`{MOVm;A_Mm=F8Ofm;^BAT;X+S8`2O}>hq^sWz!x~aq&xG~w>A6s2Pqs9~za3r4VGrib+`y$*tz{Tr_6{6kI0l)Rl~q!!g?A zweKUJRqeK|>2wu*=FZ!Am2-JY;t1_Bz@cty`H@bfH?EG%bd@cZC`2*8VBoN>EsI_4$;V<0 zj@&vps^_w#jem2yZGfCU**?AJ4Or3R)nwqXmBm27= zIC80??HbIE*FJYNN(Z8Y-59Fc^qnTXIotHirF(nF7R)S9w#1%0bmnQ??H=7Z0e)c~ z^UCjfO#r8HcTjpkQu`2NX8Ns|t)GR5;rwARj5>>#q@E%8g-;rf4Yg48-}!q4TI<^vd)Akr7M1SYfLqZ1Pva|?L$6~A)cx60 zKX>MAu(sb0&pCbz?RJ}E&^g^^cm4yO_xO~*K@ShdHfn1-TV*p9vG=_PSB~>b!S+x z@DS5|vC_+8z2%1&(4Uk##&@SmKI~Hp7hEba{0`IO!7wn~^U9T;i33z#_v}0dot#fU zGuex_(A9Fj)`wNmDcjonIWeJb?&q=&CAL1}#k9Pwx3_h2!j!EWw-xX4`9~%MN-$ih zFQ|{o*PfnA`C>)2tDIS!TsF6E*v{-V?X{lqM$#HSyAW0bxDNA?q)w-`JrpsPO2ccP zsfDn5&!M_@3~w(SSdqCmz_sdJR7wnY?J4!P5f38VzCeZ{<7r3JC#r-^*MPwRQJ_jn zz3Nd*0Q}1Fhyfk2|j8 z^`^&A6pNeiwglJn+nil*TB8D!GXEU#HK%3YF!1JpFA(RC>tCFfrOR~Jr?A_QWF2Wh zUzXVPGHqXf^BH$cz52@JaP%qM59yjUBqLbxXs5rmU@8rFu3i7j!dE6SC#}E-i#u*o zDm}X$s2eDBHLkcvrEh{Yl*kN6&(5DCyc)DOeJz-1j&xmbeBQJHD+34O9Cg1;Y+d55 z+m-m-UT;S|+Tqiu_ilT9fHUSftL3!Hno+sB4NArw>Xb!c&p+PdY^!m9;55Fpoa}7C zg8)%Zc7IVWd-s=?a7%OG^xgfqur>-Rs)xj`F18*L-%g+0_@hh-=j&k+zvbY_U)Bfv zoW%p0?wlDoJwI^7J#gFp#?y=A&gDGWJ2>y-v`OxkkM}%SjD_&&mb+u)kDTc4Z}=By z*9tDNqQ30feX&_Ive8z0+Q)nDP0xgnu36U95+3Jr!nW~xXG5N>&+Zx*;ThL4ig0lY z6TqH2cXHzg4Rb8dzeL?|y))((Yz=x;9F{SU>r;VaB-hx)aY zU|w|Sg9E-Kf815Y$*WM*w*>rnJ|ybVs5u{?-FNi!Jb=aU0eK&^rzAAT^I?tlc!%{$ z;^rr1QGZ*)<4;_}ktUS>Ay&i63%K7}+^?TI`Ig5zVg}v5s^8*Yeug;_zw%EQHFMI0 z_J(9uEZ!?zu?A0ne(-2Cg4zfP;qxs?yP8vQk=yn?VKE7dFeCSh83BJ_m#4LI@YfV?Gb#9=VaQ5t8j`L6jMpWt^ z#v@uSA2*I*jY>({mRm0ajJjpl&j6?rZcjb^jk1uA(IjJ|EuI2i^ zzh~F=G0XJgf6wk1Xmz!J9@y_W_k)H9KmQ6(xBZ`0nV4;jpB{XQIl{I)*9o1#5Ko8m z=#c4yHf`K`mEUD;eDVq|T^<;;qh9iw6(4oF^*$yj$|_EZhMFf+uLk$Dej8%cL9Bvv zB*nlYoT9!rOZG3%<`-}XAI~VOClc|@v5F1sN5o2o&#Cm~da#L@rS_vghQN_?(9+x_O|K*69AeT`S{j`u`I!`{e1ejG+H zhv!{aAhELh^HDb@w<=$Pmq5yj z%vaMKc+woN9gXSwU7u-Z9-&Mgbb3B?!2F<=+1v2-r68(_-=^L%?)8K7(szAoaQWb+tao_q}~t~cbz}Mxa)zl zjbo}w6J}n63j9N`xSO)QrE-qdd@{y;O*@Xe9ozRHEIg{HYS2yDXcKKeVq};bxB=x# za&2O*qo=La*rW7Y4t? zRkvq3mMT@>+V&^p-2&zv9{h;5Jn!~HSClN@xwQQq7g5B~TqAL+hiV5N=!`nyI>lUm zFy1rV84LtLZM?dG{~y0s3iLdDH~hV~=4|(*m$RpLMztSHIPg-!IK;^ne2#0+*~+$q zcv691?9`(^MIBaIuHx2yr3s#K#!NVBc`jli)<4I^n3M9XK)Z!A`gdNS|4Zkc$)7Jf zesS(z!Z&^!GV!#k!@Mv_r*xEfOm^Zmz;(JD>2cfhwF)0?l3c|0?^`Rdq> zhthO;?BLWDS&oO1QCW4n+mU8uDeO+_p}<5g+*RiJ)I!$W$!_*!5}r%+)NpK8S3UQu za=+3uB8mAz4{T4n>b3_m;}*}r#qnv^w)+x1dp$Zs+y58prwY0B1J5t6o|BlL;*N4p zMBVVWziE4J>ok_3@bDJ;-Zp>xUmCL!VBNjhZtMu~7!H&y4Hx zV7ioWL#{LD1}38=WqY6`F5qfTyV0LE!H*>_JaW^?DGQV7u{`JSfaR5W{YDjU!Ozk5 z$k(BFTyyuR$8Z(1v69bqNIP5zX`gZv&T>K(IiJ?Dwu=Co0s zfsW?1k)A_Vb6T1w-}0x8Se*M8vGPr5b#3WY8H|ViCdZv~$raw7!amcVn^^Key_60H zwOQ)sZH!-0HLRl&V|cF;Uf`o0Ih7an z@e}LuYNKowDj&KZbO)BTqpZ>e`Pom8dpaeM-Iy3yVCtrNIJcfrQH>~nKtwabn1mGK z3q<$T6&&U9s4%|;QgM6gZbU=*MdaKa{ux}2o?-cCL|4v;a*t@9;quRLx=R|PVAI~V zCS7K0OXxGF+0Mt?cqEwfB-f~p=MU=d7hgvm!Iv&^4h&R>u-=^*yhq)FXUu96?tf(C zL3|m}Y1Yb2>{8U2JVYKYIl-2J)wZSb_>EdKF{*gTHsHEH(C9+C&vvg@IgVgY+r~b$ zQhRzvNBrKY4!NK+Y7A~pyV5hq(cyY-=Mnedr_!gGh{s%QwWIP~ z<7h|adjXv0xfB0KEFKwJ!U~O>Ds4Uet@i$oQNMiIRrf;TYd`mT207|}&c&zwczW^v zgd;nTtlJyPm{3|$ICgUtE-mS>^HePExE41#F!4j>U$^ZFgpX`F>{c1(+3P&#;xHS` zl29DnqmH&#p)XK1TG`Zj7&bfkwykVAH`!o2-(?tib3eF9&g&l0IcHZj|gzu@Q) zJj2ktF#Fnt*@NBvw)v*UzMSnTbMUK}P3RW8t(G{?h^Y3~SNA?0!=aE*;-}zjqu0GVj z1nYsOx+k*dZ%b%*S&whOu5L&6{H6p@5XjtMMi$!==o6AB%ut6Q+B94L)z8MnD^+2$?Tn>R1Ra}imamtoGHrA`4E>NLZg zR;beob6WRLIsvA1J$%BrzNRoL6fS2nh)vS93r((016%g0~` zEr=^d%T`c!9$i&iHP*<>N|#sqDr?7vc9qiGU5+WRG*{oz2S~;Z&lR`wGLX8jVZ%!?uiLl)rGZ6_w@H zE1#l+gDjwx_X6)C^lfM#_oJo*4hf} zfN9&t(H@5Pz8llM!4mrN_+v}DHHhe1Z(30e_8!AtYd9HU6<7LJsI368T^cswn+AoT z2x(hUT|!ZitQlpch+1wDc0~&+`l?IIS9`G&q&KuDoIR@PCKpTn!Yjmr;i{{?u z9XDotLtN`bTngKB^rEZWdeB$Bwi5dWmaQnSL=Uj4>S86cKc5$cRf;V^3%qL6 zz%SCQD91j--s1AgRle$r^{_*9u*{`OTomezIWsSk$qvij>XM?>-c`PWixp~6-wRPA zSNX7CY^ArV2pd#ZU!-Qr9Z9*jkIUQ++vaEO>U&q0ud_*zF66py1IR$++v*h~*yf5# z??c$AhD&G7o4+W3>B3pJ&YJzrMRT$j&H3i7OXu90^G$C^E$pKAwi&lA_7<+CDKzNS zMJvjyOI3xl%8FL_3TnfJ>E7ko)A3#^qq&7zFRa_Vs(mU$3Gt#|tfH4RWDClCM4zTr z^HaOQqq=^fIaW?IVQ-p_A-aI21=wM8X~A*}vA0+5DsSm(FE_F-UyYcrtwtEDix6`b zu-R5?=OL;GEAO`X=)c!A`MMnx~c&fXEFhlCfGBiPlWxk0C?>tWfdRqPE0 z)mA4KaW0gO5;A0USfkKcNfCN}W?`X)QJvWursg#@0@r8g?g!T`sr$M^MnLzkHKNL* zl`5;J*y|hy74cD8r82~~maPynn;Zi|DR0K#NimE$9mt9Z*EM8lN{+nB$ zmctvm1oYEd-!fTWgpLhmrZT^}vX&VfUIT_^OsLUgxlPWht_oyIaKz~QDl43-ml1uN zbxC#9`q6k@0^^I_F)yuGwYF64^y+1s(8C7?l+ub4%)4-@$QDIJBB=e9t7n+4%Az%E zk@Hnyfyp!s7ExefSFqJ|VJT+>cBvOr!BVu(u=s}JZi_F{t)>ZN{LC+Ixjg#>eH90fiehOD$T)pd-$7HZ0Qcx z90`V9gxO-);>{%Y9k#tPL2o3@PJ>0td31Qg4f7w_s_hrOX?%GHGIfNt3O5aA<{PRg zeMLwnC2|RG&$y4hCd`_$U8Kku?~Uug7JvDaHs>#!>@U5=bT@itGUP{>-#mNt%LY9fdz*)z_BDm$O^7F_ql z_JP6lB;iHgmxj8tQcWehY6>Qop;lE=jyfZTFj~*NHB{7n84AY3UjOxaMP#+oU5Z-D zfUmFx1bdAO79y*)eGhiq(tuq*xI#dEWp$|@$(Hgp9&4AEVX}1zufd>LU(mM}pepg! zN7s{Eyus_X*L-M$ra06EyU&Xv!MA;s7IMy49eSsf((3CqAR+J4LCLFILUNtLu&XB4 z$nY=ERVG#Cs$`9760`F|buMh8cDvlg&A;sy-0w>&qA4OJ}^18H0sQFIP0R&!yut#^02YIezj8+m|33_nI|uoJQeycyb9R>A36cK_)Bh^bE!8KhXgLQQ?>n^J57h2OTG2cem*L60&=Oh z$%aHO^~Oc}`MA)D(!Vj{{HBQWNfGBP#gKEUoqp}-(?Ta8SJ=+!JkO4}J|p6MR>V1L zVaU0xT&tgLe==^3$bD9gA6_3Dk-kr2c||*3pB-_1zHQ$+ zUcWLz|8DWi1Fz4Dh%fiYHICQ0XPFOaJ*1 z`Oz6+uPh>cEfM~&h=`wC`VYpL_P-SopWzYuFGb|%e@2|Y6`}u)i1Vi-^6Sxv^VcHI zPekPRu!!{KMZ|YWM0$rsT;CIsU!I8gpNhEtY=ph5Bk~`QwFMpXuPGwFuSBHGjLi1SGi@pnYT|A$f^esTlbd%X36lpl*_0D6HT z5%pzTg#YG<_*O@x_e4beuZYO6k_i8sBK&WN2#?LhA)5~~jt=Rfnb(d9_y@G%i7Ig)wz z?~`Ok7VbHGXy;kQKi5V%HoIrLk|H*5V?k;g;+9QhV4?-2Rx@Own~ z&){QZRtmUo@;uG2iB2B+x;MzfwfrrS{|NTq6>f_|-jZ+CI`518O4$F9{7o%CPoA$i z3T=hu)rGp}79InAwjs(NNkBf6Cuse2k^dR;4Dtdk&lLG9kY@>h1kM%S1D-E@KN|HS z@-?4*!7s4RW5ApCspNep_^+kq>9c zcWOD`Z9>0;AwMt7J)-dgCChP_)`=r8(d;J6L??+1zc;~eGMO*WhVzP?`)j9?muh)B zd70)3qVoWBrV4Wp?3uzPkmm_=KkQ|~_kk;fe*=Av5e}cWsoqzSfxN*uu|afx2j)1y zcsfvrHw$N>zHKEh*M3_>eh=h3g}JBmv%=fKFA8&y=Oe=E!~Sc+)7W0f1={{e zGCNVYx5!1B-z6h%eDT%$!raUHobdO+=Y_k$9Ehm@3OG*qS+JX2tZgQV`~>8Kh0lV$ z!Xpq?s_B4?+26=_HIe}cFIa73g2A!$Ge*|X<4`w-%OSOJ3d4%TqImA@jN+2%W-?B3V#b`Io(Y{y6Mow6eHWzJMk#TaE*Dnmh*b5Z~~4T z=Bb0Jlf|Kz%^JI#*Mol|%(>yu zh3g<^JEuO~uY}p(pS8*VA)Ele9A~MY1dfItITe1#3bUT`eV>%Go*xm;1^+^LD>x4M zLLHWaUl?NRVPW2Dv&~Y6^WxpYsnB^%m|^`|m|^`zm~-b3h37&ZjW$m^baBGxpwnM? z5#))&=vu9THvPfEgCW0O*b5#d%=l#6^k*7|{n^4%;03~Lcgu|qxJa1ec!}_O$X5%W zfxKEc8S-tyKd<0>X32%bD%BFLla1!#ZRyYA%FC2h=z^2c8B*u9H%UU=S z+#@^}`fm#Ztv?7)h0Y&^v%vqb>3k;Kf_zwr`wH5pyIr^t`gy`7;AO&PVE%T+=szgD z2mb4Xc|Z4*F!Sw~!pyhVh10?B3eN@qLl|hC6Xsmnf%_bWm4|Sz5~fbF@Dj-RJ0$8X z179aR6FPjin2G0T;q}nT5UvB?Xw&C=o~XYG@=9TbwN`jDD-yI0>jU2d zMt#7d!@KY~LJI@Hy&VFIqd0m)sJ1-2e)hqlr$empO!ts54 zt`hzboGi>a%QWHh;90`7lPlZ-`7OdPf)@*KhEA#QR&cE_{jL}O8~EG8XTaYVZUsLf z+>QL-B@8j%rK02fD&)@yzXs+SCDZZ-_+{af;9m>V@0-GJLH?HT+u(PM4(jlK2uFd> z2*-i@;|7NIb75zMup9Dm!U^CB!b#xi!pY!S!h^x3!i-P3uov=Q+vINwZ$=&XoiNuQ z{wll`{JAjKV*6vwm~o@KT$uL+iNdYmB;lFR87#a9JVy9k*?N-yoka z{63g#*$kI9*V^!}reik~jg`Wdg*>q}!k3jy2Fx&M( zo6ZZuT<3UQm~9~n_vb9pCP;xoFhCFX`e4#0{eFfGvDqJ zE`!`BTmh~SPD8oW+w?aGr$fF;crf?}Hl0>sFXTIfQ^C&)=YbE~^p6Pdf&67*hWlHa z&MDzVkpI!9^RZ3mQ{g)3IPnFQ$-`*jw;_)cei!T!W>~{*`XhxaARjH90nWAQ+$y{i zWtT6!2fWOtQ!IQC@=D3%>~NH(00r2-q!r3_MAA0&LC{W;|yLXF{H5liwx$ zEaZj4?0eVRbZUf`K>mR6GVmsw&Ub}3K)zj=ef~2xogWKVL%v_Q2K=^7=Z{7QW%mzZ z_J>Zai<`C+E&MLhHNYmnN;nHPuMuY7GE6uZJi(?vNq8>gvxK*T7YjcJF0knr3m=5M zRJa3tzfI>s;X=skgiFAU!i+$}wKJ8u9@)`BlOvQNGE-Z-FNXw}S7n>HCDAg}hMsIdHX2XPxki$iw@EkANQ( zW*dA&m}T?>VVJR6h07q{Av_=aj7{gq!aJeAUw8xfW1G&W!kNgc3&K;u$=*<&Tqn#t zNwdkv2)_aOe49L9_*Ka3Z1M)-w;}(&Fu%7sY18?ga4zKk5I$&O9-b14&*j1$kS7Yi z2p(h8nIOCfc4ioTgnO&-Yv64*{T~T4ZjK?LuwsSNU?*9a-#6vibnX#81Ha|Me*-rO zzYG4pP5%ku4A|K#JOTVmo6hUP36Q@noCN;JrgL8S9PIZSs^fefoG6Sev91>8cW7zC z{0?orO()YZAC=cJ37RLS8DI3SMK=Stpzf`Bve<;3sW5?ZWRPp8JJA1Rt^K zbP01k{@;Y%;Bz*e&xNxfcc<#KA3;0^2?MR`gpYw!guB5bY&v6w`5oX4n|zKizn5EJ zldrS!gTnmIuuga;>_2JKX&0Ugo&Cbgz%K|Fg5AS({7b;IZTyrlOj`SdH$dlkoBXhF z8RWkce#2o||0!Gn`6t5FVCM}wtT-2*uM+0`Gg+8nT_;=v{WP0=l<=$286*4}`0F;E znZg11yCBoh-~aVAxl7_#KE>cnTQBsN`?r$a@2Z%kL7?g{Oiu zge!2IAk6P}GKH@OPZj3(Dp|t!A}U&0(SSGWoHi*tpa2G1AH!n*h(8|MlC0Xj>B zyTHqYuf+XUq3|lmON42s%*H^=v5x;GKbasnm7m~S@x6-5&q-RIfP;B1LggWJRzn9< z11pIc49C18vwX$~)8031@>#;Pkt@t_m`3_#I7}BAe>x5~0^oRVo}n^vpj?$B;=|`m zyws66t8y%-2EMDpCkc5&Hw+&#ty#_?@o zriG5rQP43w@)qP9!!z+z`7H6LACu1`!AXn^98Hj^%j_Tr^A=2hvqjE0+#!sEdbXAN z41XCu#xL-qxG@heiksvimWr(;)LA-)L8i^Ch3RjoFylE&m~o?v%!e-u3(>V46O^}L z`Thp^<`p~q-Y=EBK@&itaz1aO-0J>Ycm*YFPxmn~BdSsfiU zl!l(=UI%@2?^e3gI@e3!KD+!r?1T#mqnE3FT2ZqWBdoz&(NwkxOEVnLajq+Gjd^!n9K;%<5(}uJby-*Hh(P4w5z^X!a5{!=HZLNO!vPC)27Np=ra$0E%GcJuW{&b zXM*`#bH;(`TPw_b`hl<)%=KuK#-9kMLjE)1H1Hu|hTAF3a<|4*7M1zNRAVEWF`+Fb zWV?*8ohr0q8MfT2^p$;y?y90y1r?#qEke5_sDSzoQ}#SC8yp})qIYqSmsAZVL+^5Q ziCuJ-_HFyC`UwW2H{J*ZqIR6Ax`g#FRgN&Lb_T*0jM$**3oS%!gj>Dq{(nClMQ%r)dY%WSm0Z|w6HuZ*K`MFw&XLqOuyPg zDe?l0aEr8{37oT9EibLcHh@7XbDUzkOx2mtK9@_^qS-G+eF%D@f~rq?2kWKSX0PC0 zYYetNDjGBU*4sy;O5xnZ(B76;Rg?zhw6dy@TO#Ql;?#CyeRwKXo5|VBJ~D!8zqCFw z+O~rt`cdre8VoxuPE{*{a$08h&y7r%BF7N9uxrdJyH)D;p@z0LZoJA@-88V*C@Otb z3A-6(|Et)I)X@eQF`aAH7;ciZ6q^EKlg999>L}?{*ss}>jg8iVNs|^B*fi}Z62FRqC>&Zf@X@n_#(>ftNF2O z*=wR61Hxjen~i;IFuP|x8|mw+v={CMA7(GI3UDG2rl4Ab-bh*PoEml!yJE7+V-qp- zX;s`asm-1l`UuDf&Y~!kDN2(EV*n#0lwa|`*m?>RK(caROPJ|(B*nOXwdSJRzQHDJk z!-G=UEt8YJHFWhT#*C(_B*L?<8y8(d4r9AHd(N`3q$24&4ej>#CHF2NMUz31d*T_n z8cOY(<(Uf%TyUSenoc}3!Ys6G%gbh zU;{2UXSg31EXR=?Bj>!&wmaTO({1m6u^#V@jWc@RhaNdgF08*puT{;(Ipf1?yw|=r z!XEFTxz1#qu~!^nuNC%qpHF*Sw=?$me1bh40bH{sSLs1y6(gZ`y%xw?Xh@t1*9Sdv zmdM{ixcpre!;QnoggZIHUIxy&H;{40-h>EyORzS==h|owW`p(~6MIfE@NT+Z4~ew5 zCBoijtgrC-Cfak`>>Z5Amqnv>{3GqXC*k6t+!E+)UwC~MH3JHp;3*yH-KakN1f8(}Z$p-_5J{e$-Y5@D|!_R^IF{m&-8!8Z1(tjdwcw*VzB5deosTm9>3IwL-8AKv)345 zZ$9j0;kt3OLAN2o-XhpD@#FUl)N|w0j*mTln_-W7#u++5~%w6xA&pV9{VF+qrJc4pWR*w>}5i3oUzB>>)P!lKN9Ls z`51$-cRa#gE9`MDVVtpdB*I<|?7a%5x%f=O$Jk@tvBxhHnUMvVamLcT|<9|ZQ9=}3l9(9Z}_Wlg8+uQnR zXuO;OWnQDbUjpp*o`XH^F>D<5=(+&pES|u*zk@amJ%&9CA6}z97bbi3j%KUeI(%{W zgslVQHGV$4EL?BEH$!7KJv!y{Bk7+x_R%FnuTZ1Rf>!D|N)T5h@cI2Ad zTMn$_Ip^baCJ&9?am0^tFizQ%zJzIGdK2&&J8p8O*XA-VVlA0CVS>6c{>Jf>#w%JD z|Ls|Ga~uv6BIAFL${Q2r{CS!ts6!f_-4b2AhxUl>B))BZSG_Ya6xC=oEjA|lJWi~S ztM%otnX_PWwtr`CQ+-~Xf9K4m`b-?Mn(Axf+B?1OsH5%A)#GP`e7#>A9t&*!WJQNF zC)=7Ew+_c|@VmY{I-D`n_%_@+KVL}rcuV!ZD?-){q`;XIhMcucTM#RbFKM- z?B@1UB0AMnKfT-f+Rpu`E@k7?tAd}Hxi6|?4PJHVvQ}=W%(XlltwDP_d?#WdxWD0< z5`U|Nu(`vFsOk47;^o9oS()Ry60A17z;%#?3kTX9*}c8p*(Vpg9fgx1z@vvoDJoIO%G~-Ld=ee){#V z>ldKX$LM(T>Quacbxz7Y=k%0>+U#1#*<)ELy}eH-9(GNOSrvUE=2X;suD6}m;!hp5 zFurXSGzg1Z{aC~91J3eF)&jQq2wb^(bZsRz2Z0(wSU+IFv2Vv%i>Eki*WhKZzQDM~1&u-Fp5tlmF*Y?52qom}%?^ab^X%V44LkuzyG|HUu1BVCk*mVRkB(GgpU_T%5- zZK_92amUP!UBKFcm`0=4zpbQl+TNLgmV}xVZEq=8G`IF{UYM|LLGexTgJT;mv&P}& zp?6sRqvtmV65O9W-Z5wkf{)AEym^cJn$~Rzo~NxXc;{`PwI(jdX${WY_jp;<6rF>=-2(!OOJRY zm}VA#FBWG9+MOx}Xk)(K-cziSxb%l;UTSmT1<-4>cOa5Oqv|1;YG+i~oLs75Ag@k$r!v8vDh*1D#Ki~aT-uW@XqSvBi+A3UYJPggxwrUSYKJvb9~+xB+K4c{r^>F$$05?e!371}gI8w%SPJ?A zX9}!?DSZ7lJ5Q&rE(SZ(t^M)5DL&R?dJGC)xCBgeIP$Y6FPP>WGBhDDy)v$!|D_8b zp?kcj$G{_%fz~|fF|H2w7(*)f`CQ2wq9d_i>1HL6!%=f%+M!)w-W z>Es*RGoUkFO)#Jq)tCsydcL8ZZ%fWya4PCdwlcc-s59S}k2h?uVf-@TX`ku`0`%Y> z)w5%=hysjpT8bKF_QfDd(dfFp>S(4RU)VlW)+X|Q9cI&gJHBf>+Z|i!yRN-++2Box zuSz-x_k{`Q5$hTg`povoQR(W|b&1Fy(+y@~cv|D{^fvlx7t{u;&g+;?eTP}1dOnpI zo*@o*JVZD_+HwY3De5imJ1xKO8rbtM;80a}lXpDkBc00*bb5O_YamyH+2WOs_LS>N z*OYS5=bY$N?3wHfEIBhEtbyTJlq1x17>{zw=V`Xg$Z+lZMs;7D((F3b`{jAscUE3f zIGGjWLGJyjOwDpw93@~cSl&2c!L*dh+Jk>ZKO2Byjc+2ow-^**FiHC;c;Pxtno)&87~3y@94o@|*$bXGKO z$*<3km_cmcf;RHzfzAxHcGi70YsSmMwYeIE({P1VyT7*0-?#tG7x`DEqb#uQ*C9eE z7xhAU&l^s>Nu14S1MDiP>RK??&yDq|Y8itnQi19jV~viw_WisC2RbX>!Hkmar`uPu z<`gG;^WqmDJdgPgW`gP!_B}hkcbXw!CKzqai*5L;ngL&;sAPV8(N#TX)H9)^JzGuga zh!yiR=0a3Mlyx>XP7;4i%lE8-!ED@q_rn|G{jDuc%R}Zin1cRSqpSO1^-RyIxQ+$Le0yE{5M`C~yIy$C`F*eQLG>uy>o`tD zLHF+XJ!?E`8DW<9XN+)f?*-mU&5Q2p>Gj9QZs(pFVwjuuRghpq>ORC_4^EH{jSxFpI#Pv1q@X|z|{^EAPx zKhfcw=NzA!5STF}uAlp|9^dfJ-d?{e)m@5e<>`p_@1EN9kU!aK@BTCM{)L2(9`PP% z?Zu@2KdhoKB*Boj0!dKI6s4It~PsF~*s*UP!gLG!Qqv#9uDC$B?&Mla#BnNAg=4u6c9e?7L4+QFFWKZ`EcXJ#)ES=UUROIB=Kw{$-Rn5_UcE?kJy{zgbu-J1TWjN1S={;T2_3eJqe0 z8F$pe&eX0<%N^(U4a3CMms**ckT)AMK#V85=0G=v7O^7ZZ{6Bde*kH2-K^b!dqx<=f_dWA8Q=k}iuX+VCz-28j$m>ZN-o2))rWXmTNmO}^ zyW_c+u@kRp3HJ$C*#hJvuXsl;N&5OSKirN%heK5wKy3ljR z)t-8rJBF&wy8|5ywvTGwy=VI^?yq&PITib!Q`M|MeS6w%fqH-1LaMoMIT5Wd<<=vH zXH!z&Ng3wvO!fPQs>Pf=<(}zd)VJaaate(k z>O>4G5ei+D&K~#n>}p}u)irfxi1L2+cvjD@Cz0kpuFUV*)oS;H8TzhvB{&fi;EdjV z&4IRM$YUUe##C2eMt58w_CQ=*PiJa9>s@e+ka2MLad_vISltNba{y=vu%BppXbzTP zQ(4GrPT`K}+Su2O#rb7@@5IyA@*xTO9%%Pl2oGHZ2D4}@kb|44qn&Qv>u}h0&`rVPDwAIms_i*Cx$ z(A9W`deyW0V?;`YujcZ|)!m;$qSpPQt>D6_q%$<`+eU;-jrTT{|2ZORcFz-2oYS2C zp$Tj7)n{HHcY0jEl-^$NPOn?#PxQfEaM#eahds8DA&CGXv)x3At4Ry zs%`zn-MAgi@I34aIMH3eb|AMKy#{Z2kq%Bh(P76J<6fjA6eD=dIm3=4=a0P$mtTcb z9g;gH1_Iv=yz4u(W*l2u#c5R?uqIJ54s&u|tj~A!?5)Fj- zdU|Juy5Gm0PR%%Eg;69~0w&QSL{0!_mJzF79Y&R8MF8JDtp3 zSnyoq*dO}d2Li5c1ss@9J(S((a(6f4M$0^MiFd)ST~$$CTD}?&sTLQP7I^V|Z&3{& zRxPT;BZj5-6?jXkymGO?>#GQHk-;jPN|jBe${SQE!u!iB=zDVUY;_PDPi9HB%Ldcb2cRtk!#*dV98aU1@cRcX+7ShJS%p zsF;U`<%f=sE^rec1S=K6vOO~EEnQt)uJU47p?VW^arxTSg`#1*xYl;jq|7|F8}@6N zkPt;`>{PAAPa(B6zHM5EVa$Xofo>?a2k#?)!lBc}M|Dy6iVD}3A-AjXMEcSq=HR8X zK>rxXDT_15&htKOHH3#FxxT=7*@;Qj4Bc1OWSqHn|xAtceZ%R1Q=RlcQ_ zzIEzZXx|Dv!>@i$M`>XZ9)K>dcNOS@wmZp1_%)huUsvoF{ zmd+jdp>N2BeukY{qI=3vE%JsgUBXxCeV6itE2s+goawuc&QsOOBoNuHGY8{Eu+W3K zfH;Q#gf6Uuu=$W$8q84JrJym%GRe{}(2xPfrXi30BRW$g`C-vjxu)MAuglZsRcEPp z&f-gZ#5LsHmt})Wx|fe4*&aty&sKXOUoY(oh&;J+y|1aJ%|6jJ% zy}sTv?{esr#^B&kJFMt){&!ii*4uJ=H;zuVdy5Ega9OqmICXwm=%PBmBI2A+eutb( z?e<_l=abDL=Tc7++s}uFPCzc~+*BaxyAtVeUi6;yQ4#v1BhJT0ob$=dkaMXgA?@dU z@-XCF*4M2nW*po%@o@&9B2yy7Z@LEg@3Jt{v^ke`v+a!OF;Agsu}fJEskkmGp9P_d zAQyH5sg?5N1=d&FsX8Aj@io`iMU%9n{v8qLgKY+Qo$vWEj_2GT(>R_xBm8?K&aW5$ zIk3z3wm&4_NHXOE@D{nRi~f5!Pqc2u7q!N^PS53{{~M*BX#G@H1P&{ES6P3O>)fAX z0G_-*F7Z30&abr=$@y7zo}%{E0jhma24ELG?(Jk8({ocq`p1ZU>hSu%N9f-k&nsAH zRPh;MJ*rRDf9n4r;{4i(^zl7hbl*|_$63cBuJb)e#?jv8k>zPF;>hc{crKFe+sfWe z!5a2k$Ohn-0^gGO4^ih+t;ZtDi+e&DM|%Yk`SDD|^&du@AC&OlMZOO}4?9Q7>o{x; zz^;+MmH7V{`8oi<5P4AYk6|)AI)@kk;F9q%?|5Xt>`0+h_TXUx;L`AM3{|N2<4M(= zLHRJv6UaAc#^bKR_Y6-Z(*Rr+K8_J2Z8J&YO*>>(qnX0Y!g<1c2KF{#jujh(8TUqE z#{H+lUL4h4GO)?0{z~LbJIjb+F-kGWcXB%TDq+TDm@w1C-_lTrX__R=G))oC0@FF9 zOcKFKOo%uKjl)so-~-NZjBApV5#vYZb)}O6fMc2+*DF+I=8$fd>30m*a#ePcx3p>U z)=RdB#mt1`Gwn%Wp5_QMoMplc|6yU~RkJX|d|a4eZWm^lox)xm=^S4CgH!RmPP2-q zKn_$!Ayc_@22v~Cjig0~4X-9Hp&y4!@A?w<%}ftfZ_XK2^dJ(d5G=bSwxNq^uK4(18u%!e5w zXFN-UX|F;!m=Dlr9)9I;WoqN49dIyQa4=jj!z~gWhPz6b;T{nFZ-q-`I4?d);9$7m zV7TC5dcnc;f*I~##V=03dU`K|GMpEmByccXa4=jj!z~sahPzsr;eJb);nI&OU!FTy z3E}9Ud>4-N@0fspaH;q>*y!QX@S#ovj_G9lrh_g6AIhJ>k>0}g4`XKrHx(c1yntht z@W10YlPqoRYH-r!I*kmA%=l7=%=q3c%=pd|W_*_jGrh}&5uDyr4Sv1g`$f()Jt9n- zTZ9?rR$->EO&AC3pMTmru!w~OdQ`8rv6`qnFkkyvv9o3q0`0m(K)>M z2gfve4+1v(dtkl0)@uz;XM*A#_c6`W;-a%oesY^Hm z$6pIGO{_Q6XPSN|%ryO3*oz~7M@5}19QjiYGX1LYTKqC?CZCxG$5{M>Q+dwF!|}j+ zOMhOn)Op66@*5y$yiJ`~Wx;=N8TdHHDAer&`W4VuWx>e6O~r?HZiYNdnEOu7Bum@L z6*>1rn@g7V!Z;@lz&|)np~y_rbYYek{Zfu3>ph0S^tV#vOlyTOqM`SYgN_^gkjSai zD9m(!SD5K$d!~IR`Is=%-6KrDCxw~TPlc(k#yI$;eiG6~JJeTu$bp$fYU~4Nf=AkP zGK8}rzfsr=o-WLMx<{CK$@?#3UyYTp$-JR+a4?5s-Z{RmP`ANvXl7opjOdt;ik+}W zmioZUjuiZZ^Wx*k!aq3X7xk}#KJ$zG2gHTxH+?MANqHyaE->E*M>h~3GUGK$I1b0D z!i?8!8>{{h`m{G+v;=w zyx_}`2F96wRhfdB2dYfLEMM+vZ*)|7iOwvM)4nPT8i!+=nLo3Uhm42GbJ{X(ma5cY zJ5_lu^IoQt^40LmyfE#Q>7;xVZLs{1d4}<=C@*wZat$l3S@*NqSD zzXO}Ek!6f{gPeBBnF~HBOq;I?Q>RC`1pIHpW#Io1t^l94>GL=8OiMN7p9$0E zb*LYd(`Kr04S2XP%k&$<>%nTDY0+OK@(qxe3NHiSFI))TFB||L6J}Vi2yX(P5N3Sd zwCVg__*uwVj~P$ud?@@HnD2$8{0%VQK|`(s^Zi@oMc`E7&ET7a8HcY4Zv}r{nD!Ui zbojnP+G&COZeiwgx$u+Vb;7OS-wE#o|Ccbs`b2mS__8Q%lkzKtp97B_yfu9qm{htYUgAWPM1a}F~2lKsJ4C__!o5IXnI`$!S5G#&F zI^xI^DAnV-=^K-A?zmBj_1GbOPAcUQ~GEQZY$KxN|OnhkPdDzJ%%NR6Q8hDAwbHK}l z3&4fK-v*ZmKLIWy-++H`75Fd?KSkQB$+IYxF*jRt9S+oCTi-xtWZ~lQN#f)ePK{Y$ zL|N}U4(9cd_)v#oGJnW!9C;f|W|>SAPQvk4VU|gyFoM=&7WBQ~T_UHQXM|I6{IPHv zj=vI4$MJPxmeqU0j7zUD?L<3td{}OA!i`g}0UYNW`iqxyfyStj#EUJYI)ydL~5 zo1G29b&ziqrk%%yYrxOj^bZTqhy34!7lFs2u9&z@63&BM^~s3O5^$x+mx0-?s9y;F zfp7_!&cTGkMd4%Cds%NBEJQfwk(sX!1DkgZjS;3l)z4g`>l>Rib?7fG9Z&b@UBYcU z17G~e0=`!7`?;9#E&cu*9*t`FLp_lXgz&s{mD-Sz4@21E7 z_2ub{gRwn2^WP2Z(q6wf$WZ$-k7a$u)Lrb6jj_6XDf1eSu$EU=saCEYBP%UXyYQ~9 zqJk8Py2`zI!=+}o&WnpqbtBqnMAuRNzlnPr_^7IDZT!qkG6`YO35Fp+&>27oCLqzs zm)Ir*Lin%-)EN9I3?z_9fRF?U7H`9d$po>56eXdy4M8waX_Zois=W!-h^^de>TS{5 z`+~K%*w(&4Tg58oeV%>Ro;hbv z+G~9Is@Q04J2Y5RQ&qkMJyExtK6Hg|{cInBex8ypPNB;a9hPB{yq94R7H|<^Y4y>z zs|??oW>={I^}SuJAYX*GuQJM*WNk>%?A#3Mb(k*i z-3qvMu(n$IzR0LI8@jSAE>)pgJ`bJH_q{gwr98|*fA0;_D!UnPO9Q-^RBJ$b9J`Cy zfVLXjjxl>JHpmyT&SD~%k;zAW7H#se*olUuwALJz2OX5(#@j6zTZ*a0i>6_5FaBo! z^EyNCsjS>Z0T_Bw4QPet+HCy1YJ9f7v}`;qD_4}p97SL*+jOt#wNH<~A^VGSidjO8 zzv2JFB(o8hWWN8v5?i^E)A3x=U*BQ9F3<-+j7Lu8vc=aP*Y0#aEcoqoGt4OUtLc(K zN1P*ZqsE%gK1I04V}*+2y8n*}vHbX4ldpvmI(WvrptJI82fx=4PJVdYj_|u5%&qcu z;6}>?vIt%aIxD{#Jp57~@)h}TZ@&bRTav+(N&V$zZSZ*W=V^Ws^J z&rsTFe%%PL%C`mlQV~Y^Sbdt`Gr(4Uso=-`X6-b;rx0M}_k@Mt0Ewe~wEb%3R||fl zG&7-7x3==W0DgSlq#-;f^W#h+vte;96dYa#pHh%tb(fYvSe1zW%NMM!k zHgx#j?X?{a&{6=9g3s3>#G(Ud3X5~j)-=Bhp{4i8U_}z*0 zOs?md0;HRPd+jv8+d*gLSAz|~O&}sabma)Y>umhCfFHk)*G}^rXXAGs{LX-g{LpkF z{7#{NS>P8+`x@OxR((9`@bplnutm3YC> zj(Ey9L+Hrw4Gb7o{bgd33?p1S&F?kPS^1?xX=S3nd=N8^{PdX@AXn}X`0=}Z?KD68 znHP0mHg!e$3UFzD_uAwu!6b<)jyTP))Fxj?uK8Yy{N~`&{BmvlYQXQ72se|Cx6^F= z&RF=(v+$cJ;}EJvxu1dG2ZHHQw{*iWJ`rR1QSRw9tT&K{c8ufoiTIk|Dokn?vIxIZ z7>`M>>1sg7exaS#%MKge)1b@IMDR7;onS_O6C~~o=t?YfjN`Qj{gS?Rw~f-s^mW{E z&{=I{`=^`FC#(-TP3M7px(o~_ztlHFB`*#r5aMuf#`KYa15{$h02GB>()&EcErTuQtLPN*&}YFw%a3 z*W78(V-2j#J-va?ctnq$=XIW*gmDQGi#s1s_(*xTK-lBW|dCl>R!_Q5t48V?2i}&d*9SuiHVD-HzICSTq zhyB~SX-g^}?+9IHWVAmy<&F`-ly`%J4+eeR!PIlXAyvUao1aq#&AMqy4JOszHI47M zjs~w#D%tSyn0=X}2j;>~dr?z@XGA9(^K!`6<ba(YgneNE{86jzwfMz3gt?cY} zz1nj$aP`5!=#4DrxPIXM9p|_ta2+$&>7EO_Fhd%eh6?)!PBGn!PUx&HFyvrhcz%-6 z6dV}Z9oLxG{I|v-VOI!7c4pH!Jru}_^G)w(Qa*O>&tccH5fhqIcT7zRCpPVNHXL!* zmx#`v{3(R$P3ObUgwiMaYGHvK>@YI_M#}c&Y9w$c8L$_%4Sz*zF7Jn)xHDX?>}?6{ zD=B7)pS&NmN+i|A$0c-afmO5AjPvJ$!!n&Cf`PGmEO->3=7dG9OnAH5Y^NAmi4W}w5QfG&vbrwo6mZc_!0)s*@ z!P6}EQ1?8qvO<++eiA?_@_P2=9bB5(iKg;omrBb%=^TE>7m91YqAfUljbWUm#ox56 zVInWV7!e!+b4P8#tM>&$fzgf0p}>fkvGsuK9J)iCvG58^Aej#%i~4JNJQ*8x6LIH{ z?HLQpxN{p|kGLst1)7EX$I!$TO@X0X!yRpb!A(idwj@^_de>e4x<`}I!P){Ttz*4o zVA*j$@{iWv>q_1uXU{>8&~GBYeGdiFTITO;hJu@d$&DN*LP4+ZKgWaugRcoUcFqll zf`dGXXgw{v`13|%ZsVH9Q!sHj(i=*=`otT}r*@<|PV53dwAz3d_9ctXXH+qRL6zZ- z=Cch`obDeQM*}J0PMqHXIClr4nu1qA_@)FWhX#Csr-z1)gn-Uzx zzT~>i{;gqu2h6$-Q))T#%mW?>&tdO1DB@0tI5ac7F8zAXv32SBzFD5pJDgobhB<-l z9dJt8ph|l%aK+KUP&4(C%&vt-Cevg#H|%icXBwG@8wNYw1xDAchUWx>t}{kI=j_VU zyh{4yb#!!BzLCi^UE_^ulffo`qE1D-sj3&)B^W)>>7FFx=HBs|3buoD>#x^|`Ax8y zn7&o~gIBt*Ar;2ty@filss~gQ>H!U;C5RT&vc{MGX8u*0A$wo1(iBZk>l&n~ruRv; z#Fy{kD1c5xn{IwKY4l0a_BTAVbB)216O)^k4+oA(ch-L!U=RdC>+P!S@$|#NEWtrM zcLRNK5M(}|h&7aq#mDm(e}?9GArXen*Qn@WW`|V^lD&_42C5uB;GBbT3S8?JcBr5S zoG&_$v$tbl?Us>n@8hS?YlneS8fdc@O+H*)^p=b2Ox5%ua{<`Bw=@58QNo@-LihQG zo+JL6KlL*i*Zx*N=`*BlUi0*;9nhu9@Lg?N@hN1e#4!!EH+<$vd>}D@6sD>0=8flM znmWAZSg206C zzoog~E_~wO;(fB^3aIJuwu1$uIx*DkJ&6=uuuVJ!z1`DqYlC-L>N*c}FHG46{|FM* zu#hkW6UPf_|2EYX3XE#r*w`<2?Bz2@_ufySUr8}yS!#mtLsg|MNE~&zV58!Pg+(e) z9l_`_XluH+E1d;oejn)k4z{kWZ`Q>=0-p8XlRDd*4Vte0pK)E)i9JW{_G&C^uOI4r z5FE5%O>g(#6&gHWt#q2Je)TMri}LWKpU`Lyj=ogWaNZj#PDQ8zp5=0@B~$)bLzyy{ zX9gx!k!G6^)Bj9v&bw~aqTFd{B8p6{{yZ5+J7KafZllUu4U6aE!Z_+@^DnwP4bLDI z{(;#miWay|IF1F(>4jD_F@}zC9&;R~eRl|`0tPxD{(^$5)4m@GOt6$ul|!BaYQKQ4 z?7C}->dxeYW;oV8uLNkd{*G`MSLWcwk5X@OJh;$Ru(Pq>mN@3Fx~0SFp2}4 zU(Q(D-RV`OQjH51FYm)(y}6;Vwj=b)XIL+6ZT4<$&TX2>=^3+f9ZnvZsm_>E#y_KN z)u~M1VuZ$H@`?WE6FsgeSyNC=pzu7Tbc~~@ShdGY1;3~*>=rF^n$6KXe+d#4Imkqh zD2E-M-{L#&AoygU&Y7dM9c9|`E?s{sUG9(cqvwluUFtJHK=315+^=l+)ct=&_5Ogh zzh|MXB%E{^p)ua3MCY<8am@)${gT>RdpM@PpX3?RRN(Ub_GqWK8&+%;t?FS1FAHZC zBf@o&QxmNw5^SvIo%TuZeBKQQ(b*W=$J+KGaOOf&u}7d zrQn70RWDFY!1JGqkB|UA-x{TR_JXH zd~+NbEjeLt&VFyh(3FfL2>MR{qJMrC8tlkeSCsx~*9@aMt6^+P(-W>8si{qS@H?<+ zuWLv1?{J0|`q0j>XKcfi*Nbz{$D8BU6C0>HHx%0*f3US~qp|{8^iSM91O06=?|nOE zk@ZCQ6ze0*12l@SE_&z__o<$?!3LCmAqi!{S!9}Ut75AN!|_e6ukAbxI^j0;Qz&No zo(*%t3lr_BC(TEFKCxS+=Hr**0P;Do>VH15`w8{hzey6nreQN@?e6LxlT=xNTgPMPn021*V&$0AL>T6 zA~ePAXo@al;l|l(_65-t*Ptmzimvvp4!AEQDA8y8_=MJbtHN0NfRfbQO7RWE5p!jO znGKsUvU$_YX8!ElUbn~0$;dRMJ$tYv7t6lRQp-M&bxzO{O_BJi;zK6XlAeav_1}p4 zHs>VYM|eo=lnD^^kAs8MI`IuP4CX32HH&VGogCB%>hdKzY6of!!lM3Kx5w~|3F`e{ z*uhP}h!DsBeL&xl+n6*zJ`fMRl+RyiR|n=_a|m!^@s9`EffsLjCi7)aAFj80V7XZ> z7m|F}npWe@a_aDydiwjnUQbtES{}1`#;i|twJ3d#!5X*B8`aJ|Nxpm|4G)4w+Ow+l zESz6%*OECl z__5%PQ?W3^xIAEh$zh=QSBjqtf4bnA;_JK;^gZ4=%oTn!#m~`sX=3;|Tk8R5IH3u< z{BI?MQv3OE5GbZGY^S#;7W~nZ5!Ca#YO83Hm}28+|IvV!!@N$k|^+JtH>%oD8(0R8S(ad&yfYYlf zDb6^`jK_G&1%mnTs&#;~;T8ma(aHT(R#%-X7=E4O{iT&DMy^!X9a$+FR)AJ1e zGP%FCJ*hPb&Cwlatc>q+;^kz$!$`|V>-4yH_4Ksv^DmjP9;dX70`~Xh|@o z9EBLfM|vMmVD&0cDC60)yMDOa^1pAS3>q9{#_GCj2Q?Kes z1LuYK;%#`%uq5a!cUZ&EZ$zkP?$OT7?#^`N2A!xyQukE_e=Ocr_KYPTrLF+}W_h^b z$4>V;;;$_i`aW}h{yp-{7XYskt+m7H!*SC0-1N!4b(P2Z&sdOAa{LE|| zZ+b4k=c9%%b1PKq+suWB))WN4y{R$xOqgdT7KXiNn%82*8=7Ghe$R`2tGXXLw(j(A zZC~3q!-b|;xAh-QGn`xx&%pG1BrDQ}4{%I%8Hd+|GKS;Ky+SnH_O;lhYnl;P*zT>{ zpIjGqv|=SqMhRR}laX67ia(bzTGnCf%~jOhiA z=>^95;F)koM)87R3ff*iYtvk6^E5f9;)I6_bM8*SWUW@gY9%^7m@?a3=|i_Dz4?fB zc$cbNY2roiI?!(0u$vw?dT3lz>Y)BDO~r%Kej8~3ST9%xjQ>e!dq+jqd{2e>=YVt8 z^-lLFW7x5L4B%kGT$HOZYx-_iXtxvH1l#+` zE1luoJ0_DboP^gcHzgf#s>AahNSZac-vL)RxnXc^7y7!ZIrV^RN47hh*z9PSQkt9%ttieW&I;jcs#%`QGBfCQCP{Ffm8K4NKWq^>n zGf%eV!>6zt-t~9cAKE>UoN@RSJ6QdP80ytJ+@ji;mu1jLc@}mz5*rgHZ0hg~!Pr|g zx!?Nag@IW=S~FkC*f<~T8goM~J`6UwqIE5tAT-KcEn{CVuk7@abuf+w0aKZXO z(y{ylSUUdBqmC}|B{+-Tc7y}IVq;9|r204`oaH<33?*=_j=s>GwIeld>rPYyH)YG_KS{ zu|A#wFE~+g`D+ZeFDxJ=GJsR&j!e zwYllZMFnb8VfS07%szOz+K;jfY>!0;!xqpya5d(o6#<9)FFzn+8ze~U~o_cPX^`q1!F5}sWH)ej)DeDX{&Be~W9=u!c zL$S|B^yuTIG3?!>*r{U5z%neDX?9+_*U3uj4&V&*a865DV|yS~p|3#k`Y? z*6Ar|#F>osjodnGOva4lz!*Flo%6KoK!O?q0;iL)tO`4DP>+OgP(Vml-3b4%>-#S& zdiGOHz#|IA)Ss03p|!65*FBk^#jTbvyFaxs0-LS#vUCkZFN*YNTKE`MZNiGWBd z{fykpxtILTVq$JwRWNx;(5pt~s^CC9G`FQen6+Valq_zt0#yCc6r=eCF7OBlphzk5{rQ zJ2rJRUFK}NOubKi-e31^zE6F9ws+R#+mCE}|I}NZuf8$iXa|PEa4}{v=KTmh2k^Zs zZ;#q;h{zRbcxdx&fqZ?gW82l3jR9o?!Ty#%IE(=7i@S z+weEv?IQ}FDSjio&6hYL)L9TZc7G$*?8y&@8?!vz$7tNaMoV0<}o1+|+?3 z-V|s4cH=~6_!M5k)^9g5o_iVvO;BHEBsdH;ZJ7m~yL|^<({91}ZpU`DZt2ME#}~K{ z8)M%Xc8z~aM|YC(8+6u2W3-*Jex5a^+>fZ97>nvdVch3$UkDDGy{(#*8#k*H!?VfE+$u*C8 zZCj*udQ*ROXlyucbn0bArvsh=Z>4yOPvLzJ+VzLsfs`gkM^izq=d$+^jAMhJEx5Yb z-MoGRCbAGthnHrSvjyK;LXrN;r)Oz{L# zaAB*8?HShHw)d2*%W!x-yV*2y29E=7cXl*&Aad?#WVo?|I*dPc-?(U{XeaCS9_xzr z!3W$618R+&)tE4Q8=iXR&WFUiigg)}$6s)%HtQMD-TEp+SropdZp?+?zPN$hFdgCx zC*zRJo}PWlFS3I0+`87w^2GB@X#|AbP3c4Mq)~)X&mjmwFTzq??0@pzQt?#M8;|T@1*qK8*wWfpL&dDApSnZl21c>gMuD*HX zs;?jzPHEa5wbC;XVV%Jh#PqH^) z2Dkndd8q^-ujR9pDGfd~H>K&M3TGfK+DHQS-9uxqz$Z>^V^i?p=|b@#abm+zhbQ$6 z*OIf>K<#&_G+$F`F5rZF(1hJ>>DTzKafH${8n%0opXkz;^_=4_F#HCWo5g4ASpe|x9$@uCOah)W49S`T%uqTMD4=Q%w;ZoOAqbv z^gXi;ckeQn%M8L3jLS&R8h*xwIrCFIo&Bv^{U`3?xzgGS^}J~f1I9VuDA&5j;?ffH z2e3e!>pdUuz@hbs>-Bs@Jd&bJ4L-|3ex9KXDbB7h8T+!PqXT3)|OL$h}VwREJ zt>{k!4tCysw6i!8@U{ovG8_#I4t1tB;?vP{oh2&jMe_}xZ?inN?c%po)FHX-!aCz> ze!#&Lp6fgD{a2uSR|hE0b*7>hVfUGzrOuu|+tIzN6Tu8P7C6tUTKAYc&2u=n>kE|e zSfcwM%=2)rrIg2#+tj-@h=J(DLl(zB6q}+||>Am5uv0KDgi!uxq~InHeV>>hT6*svM$hS zaq!;HM&N-6C)n0)?+Bj@Paf9(BtA5|!6;7-<&9YKvytI*$0qwKoClA2(E%{so;%>I zoxFa{ddE3@mUUyN-a88?Ba{1=wa;G;xknp|O}R(n4NLf=aC!hAdYXGx`P?zU^F4RD z@*Uxi+PU+Gr1&Tubojzdq*QzFh*GQijQUxJ^O(SS<74gfcVti5x~b#Y^y}~Gch|D+ z&NS39U!AJ)(l=DTywK_KjkCE4d%%qfZlA9X)LXN88F!uWVp$#4d_wI#7-WTYJN9a_ zF2rNzHSZ&=FT@umeHunmY*e%-Y&hLG|4e;H)3ML|`@F5~xox*_Nrm+dH{ot^s4a`R z_qd^FQ{mhTOy`%46CUbl4m9>t1lc-HofqrkL$tipEzVsST7hJVRh~2R(DXbz0ZQ+f~A zjD%p^D;ckboUqfKX;kIKPvfZ59B9fjDwQf)a??)ZIRe8sco_-Ycu@O;zJkPuZ++MN zenh<;R+F{)wt(wEQ9hfHtO({lxQ+YRI2HZr!?_3Z-1}dy+tMMQnB;K_1v@9~R(T20 z@gmPPVM|9dzEzzz6?K9diD^LT0ZhNxglI6=>tMeF-&nlWV`|*~oTY z$6lUej|D%rQB=e2ZaWA4t%1}|EJsk{N!d##Z0~rs{BG4$mZ0HpM?+bXr^Z~am(kur zdGQ?E^5XC?MxHyv=TI$df!%EvPDOc{?PY|e2R!1gSF77`mL1J|Wqx3lL(Z7@)zdk- zT6Jr#iHD#0|Kre1^VqrZOAYf(GxOF@J4mHd{a06~UtKcRVn(F0YW336>gq-MM7mO# z8L>p0N7j`w6sH%~RISJFnzcCh?;@JgRZFYZSJsr4z$8sg>8ffRFIa67ttQr7KEn{6_hz`+^naC8qrTt4oakS(U9UuU$Ax{N)vZItljulj@GS5Z5&VKUYs@1E;;XGA;o}w)vslTFh z8Be*a^7GWvD!*vHeARLuP}d7<$X1P5oRA6QQhs$jY56MDpha&gRczhezAAD6BlS#W z`d2UWL(cIrw(m?6EalaUBIG7&qPX+`N$v|0&Pq39+PvTOb0sB7k0QMx?1biJSEYM>OQ(Uqk&WvgRz zi0T3+!m4lvX<4uey#aQ5{N>fEeN^CZ#wgWzL!Eev6JD#J_^$+4^7vk@O{;Ysvy#nz zyb5GWk7nA4HvP-h`I}J&QKLVSd~KyVZ@6TUqO7(sp@d3UOa5P3?O$6RgxMa6VY4M& zP#*v~{-O#;v{_~=Z=Ns9bfvX87I@Y2Qvb@;I5pIgkzG!5(Zq`su|-mwTBD^kwGphS zTxDT>u?|UKVOL$gd=;$2p{{}z%U4(7h~1S|(JoGp1SC}~()~ycgHa{^u`&HBSW>d6 zta?#dNfk}e;XvA@D{%U=ffJu;;Vp7+FL!LwR1O#EZK|KA1eaEp;Rx2MV1>~O!6hSk zaISSgT8YMtb8`J0XizCD(c6MGtE*UBdITSD+^RZ=zwp+%eRUDEm1sNELyoGE@y1t5 zm#?lVN6Aa{U^LZ#7kk$|29m7|!aP)L-^)~Gv|7R{FS+UJS~FM~_(BETbah3oWh60M zbW~~sdHUH?O3ZFyPJ767tby9G#;Ey_5g24^R{N_;mzMH0Y(K|}@y5)&83oto=g%mJ zvcXiK_}sn)=SjuKLb*;Jb5{%L1HS4KOj$NwDvaT*_8^&yzNzGHHt^IfP zvSp10$1qh_jv`w^cm#EDZA}^ViM5l;evukGMHWt>x)JLU9a9$mN_5jDGo?06 zo%^*VHO|S)g5?#ZFmi*!>gaSe#lTu5#+0f4*qBJuWX!TfTum)nx+G@g;f%gW9h%;| z!CxrHJWJP{KGkv#P2OD2p%8sX-nN=;dewS=!GZcB(x{EM_EGnz2(g*eSHp5${ZdtVo)zY%nSc}-kpK3pbV2lkMfTN?SxnMPuFH*_- zSm5-PCbr|Lf!Hccv?p@yz?s{xa*4Ug6kSFZ7cweF$1L5DBBSB0Tq&c|np0>r7Yt0) zdd#R|8QSF3bWr$pX66LXF%N?khCHj3nSKm_F#}UHCmW&J8hT}_MnG%7HP@1n^So)? z(5#2r+LAJ5hFMSPwoF8tSe?g+w5ldrFx{zjSJxt1Y9Z2$t))hPslqDzVu`f@!pQR9 zY_RGechhzub%lu`LSQy~5~x;>W$O|(uyb|J(Z>`i@+=fBN;QXxOT_k?B*M`8@MP(+ z>ha2C+6P77kr=M6X@d7*JmTzui9sKW&Q+_G$gn0z$AYeW)mV&at4hkbwlOl?j`;Wl zd}3rJ!`ebkB2)e8YThU*Eg7q(0n8OxdPL?DOLwfq*sB^1`Ak*gxj(X0^GB9yY~Zq# zh<5+jw7T_vUh>E@faMug%Gak{P)%gQwHDZ%-fmTvFJqeydUv&IHRY?!MuQ=A*|PGb z7{}(~v3lu!{+lcf4IQ`Fhv!Q)V>MY;*6{Ipr8);*Y&=IFZ>Rc8Rs%+h@=7Wqm z%_6v5t@cYYIY(722`*isr#KAbm!@C6YFYVmETZuUg|1M;bhL8XOCoUgn-gm_3VL6u ze@Q7ubv|W|S5MbfrI>F^{dVd6D`6fsGPuahjK;GFqlccTSn5u zM}y0%bC;EhOxCrA%+9^6LX19@9OAGKHYSs&-vz! z{JJiZKUtkE&FJNd-#s>ZOJyR)1&g0f(brhqJB>9qdKeS4IF~wgFdE=e7BsE*!=pDq zF4T|Jx%kzB#krIP$!LH}om6SP9}~R+av78|>Rif#qV;}U^ajYKEEqkm?srI$dMsIIlx7y-wx82`iySMYZ%Xn4V^ZlT78bRZi zG%yDDEH0-}YNSh-OIPxg8(ZPiZO7$QC&#K=^@IPEMQ?yy>h#KJkPG~+&SfmM-h#f= zcE8+qUv9f!VY^>xyI*a)xA&iFTYQayZ@waqL)&(#4+ir7BN^ZHy|slh{wf&{b^Por zh)l<*IWoR|6M7to@$3T||7&dgzbXBn9GL#QmLZS#kJ#t~GM;IAsV?5C^e@@?-6!>} z<8QLv=Uawc=GSgZ|F%t@|80xE!SWv|rnjh9$@6HeXyf;qE&dr> z{0Lilif#9^Z2Fs%taCT@wZe9P%qH)7>Ay@xd7t2qIKsvH20rgQZ2WGu$@`}5{!ttK zOE!56ZThOV$#GR0v5#Pm7b6w|PhHzkEI7TaIFiXcM6W>id!o(%SAbcKv8L=Nf za22>5vfQX42F(umwBhQ&SzL5=xERi`u;39GusGzT$h_ne90#AGFgy|dSiv6nEE2=1 z#%l$qz|R$&3ZG>p4fA4AHJ`5v-T*%+xDGyN9?~$~dchU&DW^{Ru;5Dg-w@2QZWmk( zf2Uy9)qcU*@Lv*4UH(ci%f)pk`7eh5mSF1me+j+~{vQRC{!fB8!T&%oW&DTWE$}}P zTn66({gQtnFg}k~cn0tQ!7T4pg8jhb1v9TK!J~k)1*Zc~5}XMBbd5j-81|T@KXe{9$5D}oP3E{4}MEH z%foQ$hUL-pEDtgD#QM|WtUqFwk7dx|ECVrhkYfp_el-nsLCiMA@({lSpY@?>SjWU{ zJ8VNb{B8?gEST-I#1dX6nDtp<39l5)x~&m>H!z(Zui}W2`Sl1_dIk;yD?Q72rTV6f zfvP_OGaYr60?c&R3T8Sw@}$%JpVIt=r{XV5M^%rYAC5Mff;3D!5m?n7J1d+Ymtzr; zY3rUew}M91(P9;>Y}e}ZO;sI%<{W5L9RdFWI0vM9ES*7&@b4pB)ltyoGf%>kT~bF& z%y5tz4q3jcIzqrq(5N~B{wnZd(!f4AT?sDo$DcOLaT2%4H)2|sYJ<0Ac?2!B)XXDH(dVm4s7 zcW{wr2xv|UejYNsM_h&ndXNZyZ70~}(@SlLs6YEDjv^mlYccUE& z{wHWWg1>}tuiz@+6v1}^rwZN;oJPFD%-1jBlakQ>i7U+T2@;-*aE_C@e@&Kf_OEGz z*}rm#W!~r5K{?-oUm*A>{6fK*(A#Z-SEH>K3r+yWkYS|A`eu+|s8fxB3{M13mv9e! zE>jrphku`7c*aHxZV>E+zgch!{Oy8M;j_KzeA@(%g8!6Y=J`XxY4D#H4A1Bk%yOI) zoC$v_?#Xik@Ew8yje7*o04}wJS6cAbELhDc;6t5llJFd)-61#|Se?%b8oC!Gd@}Iw z1s4GG{2X0IpJ3LHUogu!QZUPyYoVVdnC*qn`Q$SSn0raY>A+tV%yzU=FxVK?g4w3- z6P$za$1F5F>xO*hA^dxS3xN*`MsqS=vCtpaG~lVua79|y zMKJpl#}uUpU^f~*G5c1LV6Zpt7F-EjA-D$k-vrkIKPtEuc&FeEz{4?KkY^Zpu3$i8 zzTjiP3kAOhyu(7nF`8+c5zakN;>UrHTWEeI_%OnMEBFQAzgcKL7W@*zlQ>R+51m)= zo4~1pPXJG_&`cEk1j6$Kw*zyG(|m%0w;;S+@K)fB7McdZPa*u9f}aN7Blsln5et2% z;P(*zsU>_^LNwozf=`2HqTs&(&$ZCZ7kmcc+{e~3*IV!w!J9y{-4gyi3x2_Zj|%=f z=wB9`1AI#GdEoPcKLzfe7|oYwk5Pt02p?hzze?~s2p?k!A1AmK;oKM3^4}=nLsK@+bv%bh z%Xy7pFT!b3M~CMKjzf5XCHyObJ0K4o=QTQHrSMA3j~-%K2c}5)lL${Emi68!3I8#| z(}`E&2W|o`^862kXA>7QRMzCHOgs&qW3`EMh-aI4263f{3y9a4cpkCL#T1wPH-kT# zfRQrHq`|Giaqzi4z;KqyE0|>(DHxvl+zJ}TkCpHg_}2?gg+Ea+%RN&tJhc`je?RbC zT*TDJt%9kKC4%9p9aPd}0+&fR^~5C$!>OnH1y6>*MKJaBgy0n&k+mUUWTDFAV=16t3C>3kv7QrR$Ws z&~-{(=sIQjb)B;O4k`>T8<(zM)i%I?KJvw|YNT9A3bQVW=r*GA)#FmPyqM!u`MxN;u2ZESP25Czxe=Rxr!-vS7;chG2MV zjm>;nzrT@imX+mkRN)7X<Z!!I}mKJ~?L z>ik;4EK{yvKYTt$l7?lf70h&x31(g`f~oVz1+(1W6U=fyFPM7n5S#=5KLk?;rvy_6 zE{B=#C}57=l!1Bm7hDK@nP8|_jm4yy2TZ5yj%kRmg8r$Cm_8--#qv99@B_#EbiJe# zS2EPpm97_-jXbC6I%VU9W7!za=a(G8VPKYr;a>&48YemU!KrZ)n02S>5t#C_o>G7* zFL@F(EGU@rZV;RXzfCYaV~=1z{QZJiCN*Ax56kqLglED(Ef}6TUV&x;@LwgIWj!yL z^*99Op*)mJ?Sld50ADBJDZpyK3*mI?IR$tI@J&KPeW<#CPUu)R>gR{h57Rr=GSqCB zj{8i^a+2maX#B+M%y3m-2>&(0SvFn2ESsa&q+xlOw*TeQAJ?1VEDytHA)MtQt_RK` z<|F_|x%KlY%Je9{8%Rk(RoAPQp{+9~Dgfy&~8TzgsZVo)A0={wJ1jwHFGW z)ZZZ19WdpZBA98vESS1nD44qZy5Jn(trq&n1XE{imhe4-ixJ)~nEE>;croyEf~m`w z1yhD!2)+&YSAu5%^V<~ z!4u%qIlgZCESsaw#4H3zeS#-IUgDLaSvZ*p| zRHSAZrCiK|X<05^MwUyJWt>S*o+-dAOMk%(!?32pnUCrVpkY2#0qI#5W<$(;?iS2^ z=LWLGbOslLhnr^fY2B46Xo|BTGSZ3}=Ia zE5zm4q@eju0X)|u?P7)lw*r?5{t<8m@oN0Q)!-t{YY49s{3qb8f=A(bshM~we&AYh zk)H3CpA!6K;6uda_<=i&ORqOxAVxghOSqW!Bk+G+@H<}FD@OQ}z$Ybq9q@a^QrD*? zoOS&d!K`aPa0)v&oNBAUalopr0w)5iwhGL;MmCBb?2S7Fr@+5YFg){}Am~$pH%K_^ zeWPGM{6_@CQ@WxI?*M;G!cW5gwqSV1cLl!*f0y7B@b?LZXYQ$j&uhRxlgLaaN#7$Fp5cVPNHYpJUT``v_bVArH%4$K@HK)b0IPM8(5Q70 za5lo#x(IkOaGual16F&v2%iDGSi%c{)t)WFbAZ1u;q!ohEVvLDb|511yegRW_L|^g z;9m;%1OLH7e_HU}2>-L-#lVKsju z5xfE6HG=Da*9rCmZxOr+c)MUgV~5}l;GKeB0&Ww04ESlmVc_=!0~&u6yao7Ag0}+m zT>|TLJMguF(}D8@Hv_A^T+loYyi&qjfqx_z(0Eqx6Tn9-G_MM7NBC=kp921a;HQC4 z3qAz=q2R;7L*q=@UI3H9fc`Z0a@Ct;d3g)|lG{I|u{enk< z`6$7pr!JT;=`#hBKY~;^akhnivW0${VDirqO#XBn-{@3XfcdUdl?9mZB~@8C@W7?u z((7s^KPO2zB|qp-;bGa2d-8l4m~y6EXO{Ir!SIYm!G8E#1T&w<1hd>~{6SheHRcHZ zA@0eO@*WgSd4DXJeEwZ9b$?VaW$zXY&-k4M|6VZ5@!x{UN9p7t063+SdK0TUMH%VH zm*wSNveJp@O6>z=D-xxX6kzhZnrVQ^@9Tn@*ABtt{T;z6@LL6wH=Vt{rX`4MOU!sJ zoAsSF-*sAL^OKLPfkzQHm}%3AZ^JwTo)d_}X82?YUxRS94w-0%Q@#{nmTRzJma9-O z%f&}K(l8&@1|+STkARtHlh9B`HO?bE6WE9L%CwY4JqJnJFH1P(;=4N1K&7g05Ytsl zIQ4O#V9L8*F!Op)FzdZuupgMtu4ik%;Jap)O|SRJSL@SHEP7Kq6x~uj^5i#@N}ucm zaH?-2{0PExa8H^yfv*Qn0U_mlPcY^DhhRT^?vIm(I?NEvJe7W!3EWHxXZ{6(Df$KBAy4Xmi(o*5-|z4JQ+rthuZ zQzh*M)E(=IeEtN?JW{5b^R9x)$$;Sgjv@)R_m9UeCE-3&)$ z1?U$G-T+)iyc9ohmAFVV2jMk>_X5`n{sZs^!LI=i0#2ERA2?NCz^s=maWNbu_)6Zy ze)tCj!!v#)nDzUt;B@#e35I9<(t_W%;6GTfS{oxT>ie$}PJN#hoC5z7!K~}g1gF7Q z-^d{?b^J2>4)6rvlY+B>9c=#yr&E0jn7U7raPl7|m}KfZ0e~D}^_>9l4B&@^hT&@6 zi0}enwN?aX9sWRQ3W1*$d>il?!DYao2rdTpxT3NR6wErj#}Zy;eRIf z-mm#BH`|%+%Pfy$3x42Iap^uaiWodMf}S!FuLfqDb8wP}W1DkGKg}iv&C8&fESTp6 zLPW#y4gA36;3AC+;WLO?5V!(d3?GVcwkP88z-&*%Jo65o;rJ$g;MAHVM?v$w3^2>> z$CUz%qMP$9um_k+2ZpoU^985CUo4pA4hg27!-DM+H+)YD~y6*E8=(IBEVS7@qO5;B5HnTiF~_e^;_!1JkKzKPfBy1cDI=CQ(^W$Q>q8o*a_&u~S)}QVdl$+tMBzgW?f&e((wud8}WzcOhhnS584qe|! znXaI@t_G&w*v=T92!E_#%APIQ1E13>X;R>?7R+> zn05WUU_bny31<0T70mqAJO!RC-#H1V%%2LT%&JX-hBB))Dllap$2tY3K2+NS&H-k6 z$9DX{F})sJm`3ZLtzVSDYvdK%I%m-is(2~0Gb)N zj~QofRwU*)bBl=!NyC8wt{4~P*?_c*1@8qe6Z}))O5$?-z+H|jg_*$3#6`?=BQwQY9wA8_2!K7Dphj7;WPbJ(B|9=S{1z)WbK$8xv>Ij%=y{s4D zOyDa7PXJcWUkIoE_)QyWsK1*9Gp!mQ5Y9TiRl;+Civ%OeXb@ZgtiE+b;5^_H7Cyff zd^f_?H~^Z(z#mC?3GhD!Q^!81DNhBk+7kmkb)&v@1TF+#AT*TocEPAJqgXKOkWRNT z)&cP^PFn|+A%lzLZ!l@K`~@KJGp)#8#^2&OEka>bMSSufZR|C@p-;}e46 z8BYq%hQD7hWj`R8va9g{`Q`whm+%?%9cEtC?NGs)z#|1y&n%B!pXX2*mPhN8Wgv}z zfQ-+gAJygyO&%;y3NUqYm0y!sV8N74)hWWsW4MHq2lk6rmabe{xxN1SmcF?6LQlSu>QY(68WmE8oW4+2eWtTzX4+NklltNUeNKX2 z*+&fPSmv9BEeRSq@*>;iwGJikDqUbBf9*Sd6( zO!mDJ_sLdUx3U`P-&_Pr#sTBtHr8?jhvjWT)k8YLBCu~T_*LaP-^Q%qaIOeQea zrmQe2`-NYi`}9TMEAxnczX0P{+Fr_|>{Ts_m`1%+nR+o~+*eJB7Wz!lYq_jrtv1wk z=?r>H5mUxeSW{aD^I{b+J&Hj;GJTYkE?K)AW_n?{a?w&tI0y9QG^7Z_T&TMhr4}oE z#(0=KTM2_p5iZf;Uzu-S4ST=kv9V%T=;8>|>YKKq)~8)0T^OspuswLG5gg`>Y=)pe zXO`$QLDgznX1i$4>V;m58CA#^w~cH~YgS0au37b^${8{G#$KRpW?#Cw^qRz)zga6V zrBv>r=(iR#k=q*YqoxJ+Ug z`dU;GTwfY1g0wSb8;iC<#W-n) z=*VaTil&!2wz{TNC(*h6YpJ9;|7(eC165=NsZ5ibE3rPi*CmK;Y?qaaQdUH&iv`b|#SDR;zcH|gR zSgPyID6~}sAz>G=+Ksl7tcGpBl~l2^iAbx`)>sh-M#^D9c2TghvZ8z`Y~0b7K25bM zqn3TsN84)e)U@WRtzGuPkR)Q-un!99r7KF7K~I%56RO6km|~EN*Z{s*TBKSH!?#gk zX)4%C#)&U7meLC13S&Gh`<9NM^_APlVTfCb``(^?dNF~lt&NHiO?KqV+hPLM~rt~%80O*p!S9dQ@HjOqvd>1 zP-bN#d~F13WPk-))!Skzqq@;rH=8wx#Y}#LX_VB|O`n9zs!B^^Qt8#sMG)t5&aE1dS}hF&4VC%-5b^9+ndTE;$G#HHykH6?#8>zKwCq1L5Z z3ahZIm&O#*Yze0E?wCVoFxV}Jadw^5UJ>RI6QZL<)s>}7E!KO@WeJYO8ILtA?Bv5= zzf$?Ks2V@dH2FMU8PT^qGW0USTgTAxS=m#dR(a5>9Ai@3K(;AdGK$ zx$!R!TdB&;0wBhxg34u!uRZQV(s`0DrrT;psb5W(06O9viMt!`re+|6THI3}#&Hkx zt$wlmUP2gc{%NQAy$L!izgF&z;#~>(ao<$)n=bMpO1ayFMs5`y@l7`Qp1^)=naG!b zc+Kxayd1OYj`5q|4z{AwYPKC6&2YWb>c{7x*yx6f!iUugu0TJBW8C z5QO~L{58K@piHZLeh8nVIGI11-yF~p>$r*~=JyliHwc&JH^#zQn!KL|qipFi__c-{`=CF2J zzK=j><=0wb7=F-^-!NR7-vwKJ97AQz)69g9x94s3(NSuCD^GrWkD>YfhmBv#K>RPW z7x`Yb@w$M@k@`QAih;=3R1G`}MVu*!F`+to(|>kFrp{vA7sV zem}AC+W>yAAzVAs(f!!Q?=<+mhj8-Cz@_R0wgA(xLH`wHN z11`-k#m4V$3_hc^P(laKxZK9?%qoocE|cFR3%_dNr@PoD3>GuUK%8d1%Es^MDzjZt zzA3o0eA&puS|7*2uebKX|M@UY4lcS4)lvQ3h7TbXI* z;HTSPuF$bPe+A{R%6AC-_zqt?E#GWgc{A6VcKcY~JX~5ne*13acLx0UJ->FEAHSm^ z&XI_x!S6j_@|%fE^ZS;qJ~jnUa6-r1=WYB>g5M#8Q@)#V zY56_?Gb=w%E}Iaq9qH&!gNQhXH*nk6N9W&LaIg9C+e$0HP2e|OGZ8wb=YKV<{2s@L zIIly`lyAP!vHksQKrFvwV|!l@{SuV#?OBZ=F48{x538m?tjB` zfXH{dg9CBH?uw0s+F{CIQ%zwy$JbaWeR{EmSi zdGQM3()_vrtnzIDKZqD{nqMaXagM~~JQVG}OA*F6mY4QGt^A$>zh@;4J<`!_2O!Sj z4cvC{>wr)BN^voc{H}_R}zGm>lkQH%S zzE^GhD#4HQD&<>)OUw7p6(&DagL0kVch^9C-#2gM#Gb^K7PF$Cxjnxp5#ICzN_LF=9-6o@7{3=e??(T<9x); zH;-ArLmjhT=5*g~ln2Vr>69ye1k{-2yEpNH{_UfIk;3=3Bb3xH-))#@lJ9QP{1E4f z@0!6g-;>`RJ*<25&`@VuW3bV2!1-dr@wjjn2#W4?hu3Ug*Pa~u`329%FD5ih@uv;O z(db*lt>MJhL?i7t^=>0`Fpja9HrO3!q}|cwG}0zF42|;)&c}>1cxC@~=SDo{L5$7L zu=CyYjPCSnqS?458{Zt`o+S4O19>g0dL;l!4WoPaFHf=9VHSINcE#fD9T^P`Q%W*h zn(`c;_yu{!gvUDCUj64YJv~qV+}m+1_h??+&fjz&|Lo}(%`@S73Ves00v}&@AaWwS zYxBOtx%>LJ2O5)Ff-MeF%e%-73OnGu;6i@m;)kD!t)>6DyNT9w*n>SizByWk%UIxq zlc=hJ(4NQHo*=p#swu9}6vIZC0;sw!~KPM+x^IUrR$H7qg*v9#dS)opEW1ulPoYm;?3{dG_M5976ijw+;b2l%$+3lH# zKGXd~G7{_fc*IZG)X{Y8vt1ZI_IX>|bKCNax|ZbD7XQ}fT(qx7@auje)tW}Ni_D$i zfz+W9-q4Bu&520Rl6WAYE73R~JiR7t6KJ^3kOKLp8sn0NpP^9sKettx6K$e4(u;j} zI@`yX`FNaAEB80Xg%Z{`qJ?fa$42nSKZ%GrhY~~ zdiB&NzwPi0X>Cak;87+!t`GLo;jH3%shfNc`(li<;AIX;Pnh?*|s(859PV; z+I@6)+!{2>1apADdjNE3W;5CwPH)=nYM7GxwcVcnM|Zm-G%GdD*v`zKY=rrWT@W48 zHl65yxL@n{{rmdeIkIWb>pN@DC-}ae)U@Z#oyDO+Mkwe-FH>W4Tb@}Rs?6cDV-7pJ zsttd*qiK+_qGiWnXMUwjH*K>(c)%U*LC3x{EnYk5@SE=pf^8!iu(ys?${sG7iLrMbv2bThY)Juez2wlDFLy&C!#%c|q76 zuJx27r}Q^!&-&gU(A;^)bI$w%qp+dlLrkFg#=?zenRX3V2~YM@n%Fz7WzEj!?jc6g z@%KNR;;b(<(%#zf9cTSgBkg_o?lnf!4?bxL?)=XDo}R)M@2;Mn9Y1lp?>3s!2NkV1 z!tSQ@k-pi3LPLxIM)+g@m9d^Z4wcuE+tk|A5@>3Dr6rlSS%vN1!}E{#59hK9Uiqv$ z)hK$~flLbrA6*w6}fD{+8~A#`kNhg30S;b+BvMDRYiNQ}z7dA1rwY!s(9Q%VHUEb=+Y+w1FGAQ7TqTyc zdo5V#oQ90Q-?7C#Blkzd=YJEGd#I=9n}YwU!z7B{tvU=f`eoqj_5IGCo{u#adcOO# zx^GzS3k7>EX}&69%Pe#%eN%J}`7IVl+RYSv2EIOLY@USGi0=Xa^@6L!e+Ygft~kVD zZZ>w{8tZ%tPf&1p-lF>*--Sn#8Xq{g0r_@l+ohCc<@uW!a9 z79O%z0?(89&nx?oc8iZKX&GyRRhmA%_k*~6FFm58)vLc@(el< z53nTYTM!)77EIX}2n7Z;CWit(J-_amD_uE3t%Md19)5;nkU9PojhI|EI7=-ia3*Au zr>4Hpp<}HPX@~OXL?Xr|6&=jB#(EBQO?P-)*9B9q3tr(F-HG+rlW$@?JKNJUpIN== zJ{gZCU14`89~#s>2ftlCJw+q(rU$OboZN88nQu521d|s8QbO?~=7yVI`mcs5&itv4 zl}X)u<}U~&cYSPNWe4-wJw2y-dMI+jNtY2CFMVt{(RU)fY;ZuS!3i~_-B!QXSTM%x$>{9q zc>|`qq8WM~KH532+Z@J4g$Jh|3=H(7JvYr+|G$h8fh$5zqsi&0+m~E-ufMLIi;-=Z zU<$mUUwk%eva_q0Bfcs}*MG8Br6yu(<>-}AuUdPlT6xp`XA5P~yJ;H{rzem}YQbx& zMTN_PH%e2~JtU^KQu2ReplDi`xk`pO%&Zp`ZTf^0fAkD#y4i6ZN*JCr+37xHGzGoU zLbfE=wfNhdPGf)aL8q(k7YF`oUDyFdw4V2$TbX9A z9fHZG%qU2l(H%$*jZ1@`u;8oTU`|4eR^^N{0(gD?U8@QXdSXhny{nBS`aj*h3wTu3 z)jxb@CYf9qHNiMU!1fGs2@)_MLPWF)Vu*kWh=_{9kOUG8BqX7L;@f1zFp0Em(Ml_+eZ^ZPRI9f7zCvw91@rxW`>Z{4a+08Z{{QFszUSLdPR{SF zv-a9+uYEn|>{%OyrQ(d0+Tr8#9;zFk0G22E=baHTmGvGZ?j+~g_f-#A;&_v!mqWYmRQX z*W*jAIqExm)ALEb#0Lkv*8OcSdg1v`X1c2{b-moWYxCAdcElr+YWD06`u82&hZi^5 zc#pPoE{X-_L`lS8V(2z}X`!GRX*zaZi(3|bWGC*7jt$4{jZdKdEVK|F9tXO;d9HBl zyhHBL&gS|(wYx^mNsj@;v$5(m%aouWkLVY-GM$x5*vZ&%C*n?V51D^3^y0hdJ*)pD z^W~jqB2TJ&kGSfB$uA$=*LeMAWC9PHqvmMox{px2`#RP17Pu~u zR9oXq+!gQNIj&~quBz#wQ6HgG8rk~so>@QHU*E~W=mFP^e|_;=w|BSev!Cp*i*=)0 zYl`(4PbF{qnTfYIuWe02--r&ZZM*BsqoG)%F1Fh!@LFz?@2-QoF7iDNMx`VFU4>5) z=zfMq8=1<52gB3iwDbTT`F6hE5lDLL&i14G!~181>ksY?BtxCHKe+xq+Fku;S12~7 zE;g3qO|4nkoQ&@G(XB~M2fpD$S_NNuipfbwU4D*Ch!* zTO5gis?2tQZqjXB)H$g-^XP`h+|`SX%DeYB1(LQ*a#t@jiVjXe?a7_?m^}rI)mdC59m+t44mGGt}kld6uaNZ3@C~c5G zo^vUft}c)a>lO_P6%F(a1Zh|6v+NK24`uOU&$BTHc-a(4Uc78jcu#2Az)<3vx`tzT zCJs$svur)p^|_#Kb1SrMOK=SdCXY%R0qS&@*_*D-jSYoKOYt&jifeJuU(|h^AmipERL$W z&8Y(S{_LAMfiwM=pEV_zTo*_=G9qcvms1i9|J-x>-H8_N4MxV{>JyR3-uiEvUL1%% z&bJPA6|(0&WQ1Y^zL98d-u>v*>W}))%)qOH%;fOMx(8zLHp7c|Ll1arrj1*g?i;0Y zbRhO!_4f3J(Q^XH_tj?l+!F`7E^%LUbohC0?=#=D9kP<^*g2=u(YK(UwEe;8*l`3V z*c~?oW{NRF?qU9qhAP{1?D$yS0M+*}c&*gf?cEg9Hq=0$y}AC1`h=}%9fAJO1Q^3LQYlee9v)hgz>%!WVWM>0kd(M*1rTw6#ZVw>x6HoR5d6qrXvQ z)3I|Q^1C|@RCJ^>ZwX-9bGNazb4sK?M%f<;CLxPT?=O!cW2ml%fjL7w=RT_QMA!M% zFr?9PRQ2XZ0!hb@PVcJkyy4|9o^j{o7@uw2zhQ#gJJlF<^|WW))pr^p-QM{^~v?5=AsI&dxOOLy& z|Iig~JRTq3YR-J`DU%g?(OSk&|zSPi^VL4}7g#;Ztt-6hV@k)4zsr$kC}g zDj(bGhO=WE(d+;CB>uPEb#ioK&W#cEI`w=`Pu-XgHSx=-h$!Bv#C!Ngv~7h&?bz{! zqFU7$iQ3y?&ShP`8>>VopS$gLiPLajn=fL2L_aDv_WqY<*j9~3O>=cL{Jae>*jZK` z4UHCW+me&vJtr|fT2I?n|7Vpss#3Uh!#!^Ac)R?Z3C7y0%nw874)(_nZ$1}g#45Kf z8DC}U+D{JlqJFKZ+VX_kTh20W?CNUR+EAZ>&(h0d+g2Di%(0co#nfqM8WdSuwL4Bt zl)|mk({7I)@f){ys9|o|A8y=w5FKHgiN4Cft5H0a8funcJ(6y1-87%&jTZ><#+8Z9 zRqfNE&$BV_`lwT)HGX#NY(NTYkiyAW%d$Clq2`9;(-Zh+w#DOYBi=feq*b3cMhdm9 z#)2I?*LSM&T~k&4;5V3)o@YI+FV4jy;F-?_QhaYi2d00XQGNJ?_k$BwRaMX6)B*;Q z`akgGs8G$ya8)?IzA&8N&oyRjy{`UW^^MJ&A53-CZ{BpbiP3IrlK*YkaCu6NaF}!kh%h2#jzE#Nd zTlHb*Z^SZUm&?1-z16W&S$00=eX(n@7oTJXqwh0(-pzamU@qpU8)~emJ-3_P^w5hh z8hDZO{H=JGvpASi6o|gdK{?%Z$oDIpcE>#HKHxom5Jtl2Jj7#r4#Hh%%yH+wW8NkG zD{Rj?%~c^-4*j;fZGf@(vb9PP-^D>x*@$fq;AOAmmfg^sDBwEJ8dR3hWteqzZTcw5 zHv|0#b%;|FlkkVWgt}Z;00V~GP*u13@e=_owW!J*kPR*miVAO2p4jaLz~j*3Z+Twz zSfyJupsndd_+Y60r0=W^zq#qgP|d*&6NBM{l^gcgxjjwpm`Y5!Z!;^m@FQz;Yr_>u z(=w+_kV5>I2(i8Y}96%3wJ!oH6+bdpK?MA5yxX-&*mzXQ~!{d#;z{3 zqBiuEXB-Rqzm%^KDh^w{iZ$fdb>PV<;eg1zyixs$p1{1*_VG8;e~gOCop;2Al-ju% zMp6pG&D<1Dbas2&&NkA<0|^z72QC2(~o7(9AjT_27%`wCb%V)r;T% zAN<3*j5Ymdv!B3>a(N;;f>@(y_C?vd#_kG)v$4ivwyqX<6Jm|i?vu34Mg7%>czjFx zvAZrU3Ew0zm-*OLe;m(lO(O^TC%Nhp)`a83YbtA!)QovVs>^4^(Pra!sD7}kdhMXk zcw7h{s~eJJO~bi(LVfcv%q)Cc`hkvWoo(M(y5F#_?B8kheWZE2d+~@Q)P>sWa6J3^ zFu&t&I4^bHA?tl_$AiV4(PKFE3?@=Nej>lW= z_Q7?CtL@1=(N^gFkGQS2@Zcug_nyvusIZ(0vH1G1ZiW1Rp#*vNMy}}Hjv{Cdtup2 z-OkC|>g&!nR(5p_{`;0ma~csfA*-Qbvu_YTw*KAIlr|rVL3#hJ?mc|=!&qezZkO3f zLn|}^2`h=1$?7=D^~IGH&c}%FPjEH;>g$KLHgX!3)CgCA`yLq`*UL%|IL))Z+nn<2 z4U)lHsGHmq$NvZ`etc(d*tdFA-qP{6FT(O4d{8e~mKQPfS}?^KglL{rnb$V<;y)nloboai%~I9*gc%3J|{{dN>h#1;`czGo7v zIzDmyg_8Htk=J`%M8kC`+cHPpF)j5vtBN#K*yaNLuziiI zKCWqG+O9y|$dOxNZA zC#8qK*2RTgmU*{dqh$nG?qL_+HP>HJmypoN_F-<=I-)(fB~Yc(QN7C)_7JFC+n02T zUaE(P$h)Z%oz7cbQZSVe)6=*@=}}IVT!J3$Cs1A!8rgO+x0r)vFRP5Odk&VpT$r3u zv48Dm)p}5W8#f@yD%IRs>n7qkdYFM%*;T9YzUN#cgl34x95h4QV-99}D>ogN@@m{@ z2^bmJ?fx=YlMEq)|GM~BUuUa#fj(6}*`Z(GS~IrkEaSloh8c-jX65GkDs<=mLat?v zQ;TcDV>b-U#^R#p+4aFK^%IxX)~^J|sB5QXzT{0rZ{?}}N~Q>nwXhv)Je5|(x>Clw zwtiT87Qz^ZUNBsjYBUG8Y#U`6ym2qIEDT_+6BSJVdZiWL>H;v;#x-8L*3U*|{Eq#Z z8q+GzRcj#ddoE}HEcL$>OFMn3TUrXE_5Sx}<^8Ppd$2TiS5n7_q$4{g|NY%#=NJ$E za?#*-AAHvBHTek%c6#l#%~%fOPo)i^^~pqQ5NbS%yy*Hk>aj;(*iTciFXJdI`TYxc zoOQp=i&EUBm&bfaDH1XLu7K1>>D+K*!{7~}UwvI$^Jq9}Grl6?OToKc0oA>6Z3Dx5 z&b1V_I{7~Cxw0y)br0Y@DZH@~*Q%Qkye*6sdhsXYrd{A}OEYQ$YsZcZ`Z8-~BPm~Q zO*Sj!NUjI1pUpS)!;KkvOF- zy$5pXXz^cR$D_;FmY=Wb#YKzDf@N#ZkNUT;ym*X(KZ{$6O3m&*N6m=8qjF1N6DqKXQ#P>$vD z!YnQ-uP_`6h^M5Yg7V%|a6}*DjBkl9H;Ps$k2|LFo0 z3e1WUvm8DhFE&+KMhefNg~jY3N{NY}-lI;^bXqHpt~g<#}TYjflS|tF}%;bv4t5m5($>U#g*T31GR+1&#Kx z)6GNPWVFn3GmZa78oBf~I;WtbZ0($am8%NS)UHu}?-bq8PUcJ-(bV3FA~$=;h_GC_ zs<@)4w79^`oinH0)DetpSHP`WL0$!_0&bW^E6iSvImSTN%UMf`R=~xaNynOG?v}-G z^_gjumIoK+BWGnLYguFL<_VUSJKP6ama;l5!+w#jTP3vb(HPB=CFb0j*Nkz*fET>{ zlI7;&wH4^7bYEk0sFXG=WBi(tCcNtgmlwd-wIh07VF}u;X^Sw4#fCU0N}Xm{9LzV1 z3zi1+)}pO1M<)q$m8^jID+){UyGe^SjBfQq8Nh1Y^kQc$DOt55zt0Z3FVl7Joo#|5 zt+zayeh(oLCKb^(1SvmnuPVTC2Diu27C1xU&)gww@>6^7=t)f5wM z>y*vQ;3U(8(?T?+#Rd6v@Wou&d>%&3e~KdN>1jEl^U|`CRi&(!`7oGP1TtkLKyyVC zkKB+J6}gWge^r@j$r!dO-K;1qD2iSi?0~JC^a_hEuNZSx{P7u$87G5u#nL)kn}7c$8|SnMF%ilyC|-k}a^LEZ;1L!$i#9Fr|y~nR&q#ERw|q z=Bjcq!z_j7^57bCNm+0y-9)21Q>`PSgmL)_52mMb*R)< ziCIlG;;TGjqr9k3LySb$SQjx-Z#V6gLHQd*V@1AWx45}3E`rz5BGp%|G8{BC zgS>)*{Bm<527K3zv+uDcAw=omcuntbN9VlEt)G48^Q%yAcujHV@MO62VV zf75WZ+q*K4;V~ZL56%&;z~MIf8CStS0>fAwZtOk90pw90gQ6r4>w_(Ll*gVZ z!Gro>4<6-#Cra_qvys#vQt^`{;~Ds~(Sg_ccVeXR`X>(lA4+|xM}6pz_BfM_63Bnh z*5r8I3_gZf#eb$TN7_GWy#JxpCw-k^YvR2Bo`YZi{z~(2cIe+}YvPPQ&`VD2JqbDe z;grjiE`rJS$Lgb0NB%B!q*v^a|BmDOuOgpmFg^S4|9H(k;dS8kAV+=&oT2Yp@#oln zBSrqp9O<2O==X3mx=R0V@=ljz#?NusBh?`fZH zzhC+veO>3U$23R$EXVaKhdrh`;{U^;&tcmT!1Q-I%6FMVKKEkRf&96S_{Svu&(C6g z8EQQ5;J-#k#+mV39P$$!?ZNIdjQo|3{QTN+eZX4S@O>b^`cWtIwN`sIQt zbB|yX=fi@Trxf&8l*71cPds4e?*~Fp2d=X5Y!J+R*9vC78C)pCcW|aG;@{(}>@Qf^ zANV!UnK$wftFi!o23VB^a4WDX3*a_j69@UEOsac~sd!pOe6am}`HF7!+z7Co7FS2q43u$iS$Fv1WV z#7v(vA7b9(T$PwA-5{8HtrSe1R|}>tw+f~%8wHyr+ z4$y}Ziw#v;$si!8@&#s^xj0gQsY8)qroTZj)BlBFroUY<(|=Gf)88kUJiilc;{2Ro z>cZg4vCd4JdNMF=;=RyW2lxPEWzc#bBSpfgatTUC>PoxpZE&=Lny?-xc7sCV`rfpO|4?1l#Q|Q#EOfYS($_qTS*-wQ|Irj)= z89ipBw+J?IenIe1oIe-LxL*mTUD;NtTRP6?!0uX4wpC)aDreK$GL)M0iQ2;F0k6q9Q^Zv9~C2E^s|8c%oi_S2f)|1QieQ%AJ2w6g1?PkQ zm0+gJiokSP*L;F$+Zw^-`KjPy;5xx9BL-K%I+IVgHJ{)!Fz8T^Zu1;w3W0Tn{BI$m zDR?pXSr1%S;vWL_AkUqkX9?a1%yJ_ARbYzK{m&wyzXf_e@m2VTz`VJxR?uokSr%s5 zP|i2tuOyye(ZfPN1M}RC#M19=BA#sV+)s?WvmCb*L(W9-HxtjoKZHkc=zYr{CkD?f z@H``UHSi0>@(B5w&_9jC9^HaRLAQ5^ufacr!#F5sGs^IN!G8n(MDX9ie?st9VEmj= z@$;F)M?4od5xDobi-Rpfs_=CAP%gxDQixy@UuWSo;rTsy(uvs+5XK9A5$J52uInv& z7BL4#gk0gd4?Ntrociwuo=beA#WSCHfrS?l-(=x@;+rj8OpLhaU{X;^ywIYr5&CtY zuNPbcyisro@I8Xtfg1$B58NzxJMas{i!7P13Vl81BCit%E&4k`{}=cV6EC*t9}(wS z_%q=dh&+ByoNv)j2t5<@c=QR(3;oj2*Df)i<5C4*h;&WCHvmr-Tmn2*FxMaD5*JwV zXA&>5F!x%g%uV3W7yK9CLgI5Ro(iE40DX<%#2Cw8EaN5tR|@?q;Pu2yt+-)gHY|jV z!gB+7HVIx0e2?I5z#PLUa}RI>ai$e_JMnoIZWf;NW6^d5&jeCOb-Uox(WYJ%JOubP;$@bc*NJbj@FC%O1#;dI{1xzF!Ksk>iQs#H zKO<&Gh44A?I13*a9`$UA_DTI`fFHjgG+Y@LPrT5Vf$k$7W6_g{(=D7LJQ?6gB`&t; z+zW*=C&Qj5ahgRRN<7@cX~MG;`lk!#vu%dpewBklcowjjPrEC@8f)>;3S;cyvgr_9GY9lU8{LOzr#ka6PyluqmBNQV5n*A7tA{Q zyx?`fZGxFDpZS><)jlGabvXrcNv9n8fhNwtSv_w8j|WzB4`9k+zek=-ocSJ?nEl-4 zg0pa5DVR37Q!wR+1^bZhU4oN-nDGV#NJGFw5$w;6*qa z%o~JIhcg5Z27Rz#6L^$h>NZC3P|(K;W?sh&-Uyy7!7RJ01ylYa!IYCHI39S3<_9hk zOdGBh%sl>1FsnD)m(Jr6!5N@`Ab33RKLxY9_{PTXLjD=|IOuFs#3z8+j))ED++Q%q zkbq$7KTa_9zff=?c-R&gw;1?h!PNh9!5nku31-~u1y_K+KrqLmg@S3r3LF1w!Rx@I z=5e2a}|h2T{1 zuN2I*Dg>Lr|0S4dRS9NVKNifiHfap|-z_*E_?LoN7LVHSA;E`1|BK-Ffjb4WPU3f# zR+&QQp@JWW%<~0vo-$tWOyJ7|Q=gfFH-f&&M!!$+BcN{;JQMtT1V0Ko){v`o9|!(W za4~p}3#R;U1n&pWK+HL`%}v3y;kkl2K4%CX3i<_tX~TJfDf4>4?AI3vHh~ukrk=M5 zrXBuUa5{M26#N3{9|_I?{hxv<|KEZ$LH|k82Dbn8-e%Q_z^oi7ScUaa0B9|3TEB7Qt;=9`$NIB;X1)=3qKOv4E~LR zhk|~u;7y=63ufG33BCvP7QywvPYX^1&pU#dE`4WG=XXF4_$+)Fc!c2hf%$Bv^L4Rc z12QkO(YYRgJoCYSmF9u`*@Btw5*t7LE|R|ma@God1~_cvxl8aS$k{CT9^iWf&xFhd z!K_Qog6qNa8^Oh(|64HYsvFPzO!sl{EEBvRc)4Kq1Gfuq2j+Vgo%gWdL!jR!m~+x? zf)4{fB$(};d(!B*t%6?zy-o1zz@ON7{#WoLp!dUj5FPh)!5=~YWWk>R4;K6xF!x2& z{M;Lccqr_dC792Y*VuUG2~Gq3W*eRR*)VP?Wd2Yv>*`N!JogIbGv&jA+ku}J%)aQi zf?4jrx6%J#qrWGZ&ut$Fu7sRpf?1#cCHPUuJg)gc|5|V}=&^VhQ~3owUNF<;H*IZ` zfr9S`|2cvifQJdD4M*GfFVOtZCrdE%b(vtw=N?*=UkIL{VCr0K!zF?%Kra)_cD+il z2^_NV|Ja7>ZTJ_08MjgJRHVDt#`7D&??cb01hY?j)yDHj!JmNMA^0=k_XTf)d`_a7 zFV4L^g6{_o2xcBf2!0hh+$?x5=t~4|0`RXeW*?Y20U0WZIUne zb;!9*F!NO<_z>tnx6vOE{0`_(+30^1d=KJw+UV~KZUFs5!P|jP?{DeZ41AX0M}W^0 zOdUoGeiS%E@Z-Q22;K;Mxs5+p@av$@5PS%@z{XQ3xCQiE1V00OpWyw#TLr%W{E*;w z;1kejj)O-n;9vm@N1(>^5C6`|Y6M_dzeR@mJXJ?Sel7&s~Dq zw{H?mea=p?(&F>+B*A>oG)pk;IZv2()zjJ&w(Eh{2B1?ZTtrX zvuz$0%=cKI3TA)UW#f;<$7$Mx{DTEkw-Gj+DVX(ny5OOZGgmNWuCVb}2k!#=@$Z-FLjxJ<+NGce4dFrOt;1(VKp?lSS719rg4aN!^6Lk08w5cA+NEqc0O zz8}gEO#bnL`TihNa2R;9V7{x%5={Q7Hk@n2GX+;7-B~vJT)}lX&lk-1f(ry^L7zo} zDL>za3vIaAhD!zCjJOqo*~hFA%)NTo*>I)c1E8uvn^+xQy1ZU#hDR?r@{}4=>M+Il$OuM+s@ehGIxhfR2`kz%6W`0~hw6IBxa$%q?h`C=M z^RLSq(^w;g#zyetAZ8h{3KBET3j{Mw>PkBE!m38hG%puy;ygnz)4WPB(_A4q9%rh~ zxXdGi){|)y^BXkzi20p`e7bI{yh|NZ`32ADIH~8d_Je8bZ_O&dSA&4S@^EDlNq>vD zmm;pp?C_6w$+*{sRlR~tWYJn<1I)ZO z3J>%8uwdH%SAv=EX9VM9t+7Ge4B!`q&bWURJRWC;Q`wg9t{A5`+p>)HcRg+AO7JV& z!ftm1tF}DavYWCYFavc;0Vc1iKfp{UOXxTmIf7}2D+JRHGX;~MpS>xEcHk#xVupMi z#MEo4VDhuuBHhGU)iGe&jp0;wP~ZE=BmF1i=zdJ+eLwPRlAeHn2-*&BfS!(P7YPW= zyNe1VunhFN&@5uu&4o-(C1zzo$i+eW2+)~#-8N?loof%6?UeH^J6|XmC#wyDP90Uf z1*RP+ll&&ms;&Z4mm;BO;`}4QI2m^ej=?!B80r{z38qX{harbq`?=6@vie5Qnf={D zPs909!L;Qwf@!DM1ZUvfDHtc?L&39f{$Ig!asEc|WSslCtbEaa>iZzlWiW-#e56X!VE5Hcx;zs(`e1Rf-qW%ND4Ch#c1 zfGTL4Gd{7spXYaZW&cyO!3SV0=F_#tlE<`_9MGAzixXo6Ou38{bUe(9Y8Svmfmu|f zQ^s|IaZ>BBNvFI;IEbmsa>0~+n_!%bD#6Uhdcjb^T8}4jHw&G1R_z6J1~r!erfqlP z&}ls?*u?oU!7LZGt`ht#(*r_hnX2#Upr-+AdjeWE6x%Xw+K20=C`tST)nDT6;@Vh*PKE7k{rgRDKu= zgJlIaE&8gMz47)c)aLl))T-JTyO{@Gl@=~Rp%%kF`0;+X=D)O{VqwJDgXIb$udJxF zqW7jq?x@SDg>?FmhacZ-?w(ogI|6<&PfrTnl(Cwga->kQuxLe5uXo`=W>rN2+!6Hg zyKtTL{DQ@+mZI4ft*8JqRCE}(Fj#KSi~M%|6g8)>U#OqDP);37>7+Gw_U@K%C~+#I zehl9|sqY@IC+D|1B!c~|AK8Di^rjdl8qE zSLl%qO}@_owba39R~=On?E^k1R+OtYv=H8H7E+jat+zs#1d!h2^DoQ=KZ3R8)9p&{1?x@Snx% zbL@%g*Da|&TF;UqcoTwKmxcBQ)Xl&$Eh#QS4`j73dsd_E&|cbh7f*fKxz7l8Ls+Sc z?}%=CDF-gS-EcIsZjq$6C_hwi{-WGUvFTbZ(m;!Vx0-G-;KpNNVY#Y&Xq)gGly?g{ z({3y!aJjKu*|4{}lB9ISaPL%Hlm}-V@X?`aKk9vVY2EpwrP(_-8-{k&(uY8@h(n@2 zIIJWKZ^>T*Ta?1Z8QK~8l-|o(dKHdVbZgYTn~hcn2b;Z2sSr%c*mg1pON_7Vmtdc~ z9`~7Iq^RiN1c}4*P{EjKS6w?Aaq^<#?Bf}_jc&a>N z%jW6JZg;zZqIH25RGqlP{NKiHzi-(=_v5z5j&Ax{T+#<&?1+VEL>7nvYbw?@Nn8qM_XmEcx?Ccl&_#} z>{cNum#mz=m952pREP)263mm9$KM>-T^+Q%ZD6v?`wYU0!9@L%acFrrJLD~byjUh6LCd?|A#VYU z%=dbfcP0)kZw-ve=(^q);s))igO*ngKH@C7aUAkk4=C>}99rI7hr9~hkk8#Jrj~cL zLtfH!>pd{#4Y0`@7vEjKM%l~MgK%hh$uOMVevhCrR^q-6TAmMl#94A9bq3zgA|mCTgG0-E2l4Il z(h-lofppOD4e;6JrO(9oB-B;P`#ugWZy*|1^(IX@)6|my|WHl-ZAhIXUUC2MbUmE4K&`PyjLCajziuh z5{D-(?eBhbJv>wnN@5n>>8ti^$vNsDJlE-ppR)-3vaueua?N3_jKa zj`v!>Vu!qsAkRgGC20MYI^-qYV*Q?)^6+UUBJUn_{`UNSf=ZIEg$W-oe+oXkev68u z;}JetMC6q?M;ZkP8s)4)AD}pkoP&{>H6{mo4nyr&aU6Ak=A#2EmF%1 zfQdLuZrooIoeyP$#(T8iQ5<%8&5)N(f&?w^6I|QnEx^QX7Wint%j6#AEpe2`C+GyS zK-WRb3p&c>o*kZ$4)>F`&RmPh9=SJ>p;=aAP7d2i#s4m!VF$7k1XBjkMsChCWwGm>BaUfW(C>qlE_IGpkt z!DpAZt|F@6l{R_h4ted6$M5MnX#My*KfAn-AW!RewN2g=m<%%dI1%vYF<5Vau}}xz z<8dh}1J9_|Dl9~!h!e~c?=cjJy#Cguu>^dkV4fJCSTa*do$E!Qz#*H6mQ5Gfs=<=C4E|*S` zvTu&0&otj*g+myx{->e-MR^s;@oz$QWPddOL~Gx<^mjY0{dcS#()Orr)S`RosIBlE zQf!wsw!Oc6+(;4of^*+8>^(Qfl0Wktksl|ULxn~J1{ZCqPYsRueqFq=rw~J%SE!bDF;QBvaa;U%`Gw*aauH#yjzznA_vM z=NS{nuj1ZC1GYT5eAL}r#+Pq;eSee3c+TUhd?vZ!X|wX-XG~5x5vmp|v(6yWPojhu#RYugyDl7q` zA#P9fZ*coY1<6?l&fVC>mTZGM8t<060Ln=kDJPLzfrWGT#wR@2nmO~dBdz1B7{QVf z=UULORcs0hEsD)zgWuCzN;a|tji?rm?JbO?tnXKHgzEO)q6x zX7KY!d#=_r*SGTpK4?Y|RH%n8p-wd^`X=-1*w>7i95u`(Ve1qP2df63K?X4l7 z+G)(EcN#lxLQv_|N!-D##i)xvW69aEb!q;2*Bf=i0{)j>p|cHtp{u#^$SaFSZ7mHa zO-s!gwF|_bC(b)A`@OQDf6a}Zk;5M+&T7uSDIR5j3;!@<-ZB?(ePeA6l-Mxg zzEE>4U~`hMV0ogoqg`Vlsz&%&C@pnL!>iMqAf_{yo zudXtFN99g)Z|j;+V@7RN zN4qie^iX4ZZPl@M_6zN^q43E>|4;P>U=us>s$h)lBiJ~``&3srh@Pb}6qpeT=0?i? zVrZZQLd4db>*S zh|+s^Y)jR}iVe6XRi@0ovH_RfZA&uI@D6pWt#`;E~K! zb+pc8wzw7F?TPaS#O@88=^Ov#<0G(-cgW{zYUrv%Gudj=$TcxiMc#ld5W{U$>wVQ5 z4?r?2IH{=MmaROhf?IpYHN6cEb(@WSZ!oFu+@!4sceOTzldvOZozH_ks_T5*UTxDF zGyKn{v{e6e*7KXVlexNvnt%sl#|8V(nCySa^YR|wz`c$2;MvuP8*>8v!~be3O!e2s zSe)1_8{^gLmPJy>|7EE-F3`XF&s`yKALk~csbH(!xZ!Sh+YeD zSQL19?7r-W!lMdvkB;ojsNTO}yt{3hG2@!+o^V&^8nddgRjP9vyw^r1jlec|*b>&` z+`jR(+$7)A9Zl@NVAS2rhN^0DXD9>tQ3%1a)+UDnk!_}%X8V4Nd)N$*tmj>r)|q=0 zIb8afyY20+@K|h0on07c!)m^MKkjGSox16I6|E`IAF9r2*b~PyRV{Zc-@Ty(BXx>qz;+=M!%ngdge_a90a zp6YHJfto%up|0@k;RCj%{|ptadbF;CUsqqPqsDr#BSgR5)XzIzQ%C1a(=elYYFDtU zYw4Ex3%HB2Wp;LGR{L!l=#4Yf{mgXcp~rm_x`B=YV5Hl<)u(qs8}!|YUCJssPj#g~ z94Su@Vj_5Wr`0w*C*!=ky7f+0PZf{;%*Q_MzMlP*#bN!&UX50-@xY~!I2Nk7In6+S zHMpZSm8x0uhI+(o0y{k$t zaoz}5OHh$8QDd`%NzwwD$zt8BJH@o@lWhgSc_mB8dKN)7WmJkG8a`m)l8G6iri2Xx zF9nsQao0UYR(rqF?jTxWl+?Hqqvd^okH z)87)e>)_Vb@MV|~hZ?8WRy~K=(rKZ_tlBD>b+Af9V7_7TdOsCU-1}D zH()qY&&n;Gu$=#?GZqgpFn6xpDf8wl6N?%bHD`ktx34(pA8O2d$_1gEIcJ2Eo%?iQcny zK6(O=nx=-`^)2D%BZ0G;S2hJxni}dKYHWJNXbPSg3ihuHCT|^!(Yz)Q3Y=Mk@eX33 zTl2w|&I2*;dX5KG@iz@%3j)O4GbPS99DQHM1Dz;;G-~ew4~nVdfg?y2Ocq6rk%hBI zZ3zu<%{%mwl=DBqq6#(ru56jNs;cVw(W!IkQI|P;PnmzMg|4Ysp>~=A(Jn*TG z9~xlz>%VGg4b5;>q7$1z?dk%oSoS>v`pE#e)=KnF;bpMSIbm?`*_GxI;#iSwjq3wonBv`ux9L*EsN^2 zw+7bEUhBHy_?OAPsVtuDbHQ)*5izQSc)Mf!JWx?YAms*7NZ42$*D)>0$`JmCWG=mZ zfhya>Uh8?$8`&(J&l@N~(7Qh_N~^t1NylyW+=s@tXAho1`BqlE|Nb^3_cH$SeT>y3 z?1OBTA1IBiPuZD0y=C#v^~(;0-ACf%d$-wrh@%v+Y?h)5BBrBN^+;Jp2>DkkK08(E{8L7&_4E~S+kb%A#_(q!`3w>}g<+@EXs++Msx88N|^G9}j- zoEus?amvz6yuc&hvmDJwC(bJ)`;^?_qrH}-9e$=tF@2;OP2Y(obV46UE6ha(&e9v>8S8Q{m6dY-UDnG=X|z! zc+#lHLX8ErJFCzTn8VPH!rJP!@jiEN*-`mW{h&L+gYPa@z^_+zo6dqCns00Wh=e(I zQSudmJWOZS~g%oPfrCf(b5IyzM5kyF3WpSm{lJxh}BiVYW?mEF}f zWp*5G#1}6$*=Srj9%D*!oIfUh^)@#y!`bzLP1o+ft$x$p*;{@S8^i-mnlWY0BSo&d z;Yp#Q>&CUF&UnD*9n4n{s!Ffj3{+D!Wwvj(J2d1v$lkEeweEOmHfBnTYHw9~JWCV# zC%N}@8^ZAJOO?sa37tsA$LE{s(~Rc0j@A^2Yze6C*Zs8;OO1&T6NxnivB1~tI;ksC zcy@hqO+xjF-b~5&GRZ^5^!9fy+fc8njOzopyCG~hA77Vq-dvOIbB`Q5GC7>Brw%)B zQtkayKI6t3;Xq||l0VafnhyJJt8Y$N^pLqLVbtBex3)|g)QBQa$ZCkb>%x;jIDSzW zk3Fa%unEM+*Nnw}@=@{F`(0$Ge;q)%Byi5u3*Wj3-`<85V1%-}^+xgkclV^W))30C z5yo)KQmj-gTU&}n&pm!!Vqf8itwFhp+O%z%8(F8Sca1*9w$Jtjl9meJ{nr+eZ6Wib z3sd#BlTjV8qPQ@+b80WFJyp<)Lv76ZXM4S+*{gJJTB%l9+BXj+XHQ~poH`%9MbP&m zy6Cm3+TKxxdfbVm)#FYir5<+>Cu&al(L;0xQQM04=-#2u4RF7OU9Vt|Y&8mHdL$W9 zJrB2*7RWBzrdqZdQNEXZbNK5K^O|dBMz#*+PRiWF*k1Bnof}EgS|@M)xNC0NsuftU zUyyIpDEhmVZZfR(&yn8%tC|@z60y__LS7s_kt6?YEa$Kq3UMOqOTBiDGmSO!4 z7ln%ML05#*Tcn-yhXxU9bm4lBY^(j+ZDxqHK($C48sEA~?>(+JS>+Dz_AKj#=cZO- z&4n2kq3cEAsJ-0t@q;J(Ud*Kh*frReq@f7NhGU~*gL`V*`Fh)D+@^?SdRw_!o5ETf zI%At|tsZQ|0#Ft@RdlrxG~#hj;#EazLAXtLWOL()+^ChY!aZ+QF`JH6Mhp2XTV?4U zU6YN$Ov4W5OGeA?!uca7NeQdiW}2?vx`c4Q*K~9-{V}k+;)89$Iygw>>Q}LhgxaMlWXz-}jclK+pGKq$sd#qj-y$R$|tFfXa54`Do3e+j2nnRy{lHM!0*B^W8KJ2(Z%#r^lhrFj9 z`8k{I8sS#R>5tX(&pGUI#Bt3v(hRF0w?9_1|Boa86CBsKN&K4;r$1JguXO11Q-{7D zxqp+gU%)ue*4}B44UYT{7khqB=`+l@Tdto}>5asPRR9T$U+cJj&ru%vBL6n<_J>EM ziQyMq@%pYIPAeaGj*W6hp~2;VWi66 zCB`2e>D?moOzJUHu;Gudx&82ju1@Q=Lwc14A&qK5PH)SOK5xQ3H_@4M3&Q7}%%790M#V5ZX`nCUzqnCa{mO#L4f%ry54#!2m^%5)hH z;vnYb>w+os4Z)Q8SHYC|H^G$2pz9Um6LZO;%Dd!O<^6k#)v9Brg_&nvUSwt5a}bxe zT><<<7>dKiN`#Px!*#BLJ^iO4?jyK0o;<*1P-ZIeFpEEzc({dU5rd~4JoAZJF%cHv za4`{tML5Va6m2Y@SlURT(0>4WDe;;3hfsmTg*DdH zIAeLO;%Avsf5v6`{8%tf#@&KhR$B#|I6o$MD9*nXoQ`v=V476<0fWrRz*CVot><*X z>p`Cg69HXBbaq+v5lWTg&B7d=%qG#jSc@)a3Og13N8kI zUT`UJKaVAc_3nFu0S)?4ru;R)BLuUo)xJoevpzDg9x}w>Am$hzPt3wa@ZoUT+bnn< z0gd&8{6WYft8Tw0aXS7X48`FZt)SIrv9_Fnw_P&LWm&rT4}oPvnHk^*3NUS%B$&1wBG`xXRf2J{#uxBYcF;y&Dwr~s38uZN zGv%k^yjn1Ae}`b4j2gkz@fpD;&MymQnH(0JhVwrKvrJ-Gw}&wAh+1+!i(6AWnW@hWm| z6FTkoUxI13IvanzVAebSE`{eUNHk(E)?VWX3w^P<97c+>!`oy@8BP}#rBZZ9>L5-on z)J2Vl`u5k@bu?73ZK}mT8$_>U*zXoGky(;5UJPfrD|W`)>r3e+YCU zo#8ye%+tk!nWw7+Gf#Oo{vyH5AA|PS&HQLTji?T4pLgC@{Sq?B`!rb!F!M_@5i`FG z&N6x#>5#9tGNN5vCjKGN7L3a|8*QZLY^ofGki)Wtp0m*wx_qgFYce^kIf0(1W#L-S z(^wX+H2g!Dg+o7^uw3-B$$VmYHd#OneK`xGK3WTj!7~;0s#tIda4E6O z@hXIV2k7gF?ejM(j<6mF@_UK6)bWVWr{esfV4RFk1ylDE zf=!%Nzm2%*zx8b)j7B;C3;IxEsjJKn=`rY!SgyMLvRp|IfX;Gt zW#b>hWE{FJWD$dB5Oh;@I}ro~RkwkuyQRpj+4P}_~g&RIhpktn08{IeHe5(Uf5eXW+@hB3-V{f=FGn?J5`P{KANOc z0R*0OS*UVkMi5jvLeAB?Tv#9os$B4ox~OsiX1Sb)BL$e{a*<%1j2{SQ8BGyPy{;2X zy-EesR<{Z^ajq6j9k&RkjynY7WcjN{y407!X)F4Hp?=-!Jo3eMPn}#-8B1&hy7sT4 zeW6n)7b_Zqi9nxRIHJ@s^-XyE8`~fPdQ5wSJ^*c@tdSix3IQ9eoSRO z8-l+PnEIu#Vj_T~F!OSjVCtgkDtO4N>Zi8qU zCeA+*jFTF>sSovi)JA_oa2n401T!rLrwtzgP1z6`+9P??^_g*WKdfxUgb+*|l=C+D zNlH1x(plvZnBj69q?3NGR50bJwhVsS^LC+A z-@64`TU{sD-4vSeTJLFVyJZDA^3;D`l58;0&C%3m%X28DEo8T;*Ulu$S=RXO?$#_#R z^?FY*&HH!3vvB@GFlC+)oP~3jV9HEzS@{Aq&JaxdaX%{Nmo{c_vGYKP!9m+z4M5xJ zIzZd$cQUjE>3QHWiDkYqROoz;RDD-62nal-;2+4=I}>2arX5MAY*qh(p^{~PVCJ_} zcqqF{Fyqz_SJ>%+cH={_Syd;xRaL*J`(EZ^^1q2AZ4*jH$1PFlRQ zFXz^F2bEZO(rrmbpX;K=IK5Iw)~%@Zg3k4Wr>q6`g@)f|K|3#M7}j=0^tIYS*1Djbh|%s#t?h%i%^seFzfH|PBkDAu9Gl+aq6()+V#g{&9f3-H2WQ1} z9jljH_TdhgET?uDOwA$|vRv`n)nN5fu1!n(cF{|9m*=Zms94oHyi-;M%VfIha%G!x z@~T$+Ib6-!m9eVDDI;rkd;j5d8w_{5NHAI*o%gM!X%2={=BIZT#2j?`_6XiMVVme|qWMN8Ouw+prry-`7r8U3%+(Rr2=Xzj7wEPWa14?;mc5J|venhMtf5PRi%yqxuk&sGeR@ove< z$LAj%G~Yz<5ogJbtl`#kHDBXUAKs%HXFBBZxpM*z9ke{Y-?z)V$0m>O;k3Mq@L*`y zFN}Mp7AAbW91lLbypL@1_-v`=#XICR;~t+Gbs!&u$02X>2L&@f{KGu|Ah0 zBX)U%QCNIGql1>W0(^FP`!lR>f|NG^hn6?hA&+Z(xzkN$m=v@qf0<#O=Z^&33SdXGqXd=IAOWjf@&19|-RqJ!4&0*AcukcTWQ`|L%5QwwnMn2>fA|mzsJ`OGK1z@|p*CCJVfpyUGeg}eG-m4ej z{gKqafZSvGo|D*J-gs2bsalxu@iG;Bc6py)XuYqae&-4w<$Z|G!LHvL$m9BB9khN& zz-O1&j7~BIe3Ul~2k%i{twX>1{+69_O9d_OPKSQaOpMk)bPW-C^BnTpA@50%#gmpd z+aWItmA)DGr{fqYeAMqoM6l<#5{)qpbRD$3c>u&&a^oY&TLVmaqj2yZ<&6fg%WH-QG;?D`c#-g@v*9;$Xk z-me|<+9B^Hk;Rji_mD&0Cy=)v_bCrmJ0kBbM}M^monvq1`)Bak^?T&v===axF(Pk= zLtYEy?ZkZ@w0;c^c`S_k!9@K~G!c1o9qnxq-v7_n!i0~PS3BC<{gBrTI^{vth`jy| zc`cB~_4PVv{Z4bpn|eufJOYf!b7L}NFW>hu81z=YCn4Bwzwo6|`|({j@3H>93SgI) zlxi5SfUX1i7+wM(&f*2aJCLXCmyK)Qqr5rzM|tRORd@^XZpPTC1Ml(3lX{OXRE12_ zFz^=%doHU<$DlDc^q399x<)&SLy=)c#jACL8-H* sCj~UJ&g5YzMBeQFeAmFZ)PePYLGulPU9@hbQ(lIYC915-2glj}2Q^a&2LJ#7 literal 430242 zcmeFa4SZD9nLmDK@*YM_FpkQLP7pB2TN2)aZ<|1fK@fS9g4G>|%!EV}5+;cRtKBeF zn9#b#l$M0PEJV~`#R7F}Y|C!KS{hr~Ro305yLFfJ=WlDfwF|D>+E&f~`#twLGxy$^ zA+)=nPyheV-vcN2d(QKm=RD^*FZY}?=iXa*b0Az(cWdr!pWPK(f+n{9_4yXgFD^4# z?#nd{SAk(%KkLH&)?XS%GJnUn4I`Pqr^_%d#((W!4dZX-C-<*EZ5YY?M>iP8|A)Nm zSGO9;ygTc5<75A^4KAh)q&?JS(5GjQwfnCxGSdHtJ|oL(WE}ohg3r8pmhlJr#*Lw1 zYeS1a7~0sj$=?!c^|#iALoIbp4MD?BYYx|MZuK{|Y)Tp*4z(tY-`G~0G`_L9K52ZY zra5VRO*pCiT7Re}SQkst*xcd|hXTP+*k8Z7KAyr7UmFgElJVDuLh%w?_%~S!W{Iw8 zYHUoNK{!;?5U6jA<mH-&o(;5ZY`jW}HJ6$KO)F$>02dKhSVtrO4*wu~^05))Hz# zE3;*lKyPk&z{apO41@Y>8tPFW{<=^@Lz9hM)711peX<5&#;a~v-xz9YbF=}IoKTY@ z4$0c$y+>7&nLufiOaZjY8oT1GqM(0MxT&q#-`eCyrP|Vov67Nn1874DDVoDgtxYve z4gLqw%<7vq+ZZ_VG>2>bt=pQDBxOB^+MAog7?i+ZOUcq{Guc&CW%9SeeD?TYs3yFv zxz%qSk(7;S1B@CqO<{WrSL0$h)Z7r*=1(+KXmfIL7(7Fp?Sg7Utu=M%{mqW*tZk^@ zREM&K1Dji{g9){2YYxJkezX98a}x$$7|&J_wGC}8btI<{n$Skf7MY}&>^5dJjSW>$ zNw%zDu-Xv&HpT(V*hwvs?m@p410!N{L#Wj>66B zrZk%tl-z)_hgw^P2tAG2F@X-e)GnrHkd!gW=l*Cbi)g=sM<-^ z_N3OOJZAmcgp=Yo>rYj_jo4aW^MF#%G7n*gk$8-|7(tSyfXa^hgd|C{nGjUXCli%0 zBGfc(u0;c~*9C3ljAJ!7ZQYzSzBz;moHGG#!|MK#kfkOtm%65w)`VGxW~gauc2vB1 z`>_>_dSQ48sd3Ob>9G?V1CG1Cot&VDIfIS~w`J>~*@qUBD0NZW5ZGiVH#OsKSN{;Z zCT?XdZT7imAQ<%5wfO6TVcxYb#DckfN*1%doNY8ABC$=fbC`F8 zlr?TDMYVB{cHHiD)_TCP563pDts+zdMz>RU-9(BiET<%iBsIhbHn-MeB<7?c1;@rf zurW}B*|+nS&-RO(eqd8L(CBXt)I8uE@W z%iP<>K*5sS7O%=;No4Okii&Ay$sDz;2(`=YjrL2zS;IRprnI&74N1(a#xrmv$v?pR zX1#r4#o+=yvt@I9DQr%eRCH2dEF_ZDBoimJ;AVdvCX9CFg_g8skd~@p)CD-B4`Ar= zJC``ha?VJ}#~H18opnwN(9-4#Gd7Ue>}Th(RHThd<}4WDnp*;P3hzk4I`k;^tBsC2 zP@2W4HLdN*(l+`VF=I)x9EFWD}l~I%3*v#x5 z%|}HB8k#Wylckqk8trK#CzhBS3CZRwN;FN8lBoJeIJAW=l=};bvh}*DwJx+7I~I<0 zHS0>6Q+D`$(uyOCxum@? z5Bd%&F7eL8^lZD3A*&(u`fUwOj-`QSLqnE@Zz?WxBI+E`nLgQ_M%PSBz_CTA2??6S zZ{}#}_N|*3$!1)P#kc{bZnber!tJRQ{mP%9TEg544N-9>=*kv~kuG88Ch@^gZ2-+F zvB4ruLM9v*)uv*zefP-{pRgxqZskdPthY~18o4+YksOL`He-aD%w)3>%@w5@jQ!k= za;#h|WLq*e0h8U7jBRV#G;;_bBko9kGlzPNAZCIjd6CsB=You;JT5U(vWf1Tv9xhl zA)x@VCT1>eYr^%-_Tj)>@XI|cVbcY>?DY?ZIBl|5I!B9m`&|Yl^16r7h&RkH}^P3RYiRU*lZl$}U9;YP`%_!+~aOad>tY&j(Q%^OqwSWnzztkq2QKf1J9ah5rTNpP)vn4m-mWcl2 z+_N^dNmW@=l_5+z!fGErp*l?tH8a3SVbjGFos?v%DK%o*?xuKqvxu8gw#5^MJk@Ya z8L?$nLWfkdIrbiN(>qljEoMm*@=*6#)1sJ(V1qS`wrDFXOEkw{_dt*{5$uNsvAEnA zvfuwqoj!gYac;>I@x zUVt^w+}yxkrS|I8)awGwoI^BX`vLpf~<{w<^Cb2vwdt~A;fysLE z+G%cTHbo`xwPuFwWGxs3gKgMZ#f=j?o61^A@{|cv+)B;`j1&P|+-=Y;&Uc~wxgk#O z-^WIh#99Xz$|9~vs`hRwZuZamASO-qt@wG+-&Bj$0jyGot?!@=NA^B%O=#A`@0-f{ z>sR7%V9Lh`iFG}lgLfNC4*%=?<72Crg|_}t133<#sGdvO2VEXGIepZj{4q| z^!Eg7@-oMsQKJ|y@T0@@{!fx$jElXcr){zEC`CayQ6*Grrfvl z&*sD=Yq9D&a+xit0`rH{w;gyhbHkRUfrZ<>i>^SOMMY(qWkUpE4CcJvawE(KL(7G>WcghxyUoykpte zhB9FB_6*b~8{3_|gIB34eyI@3!;+mP8!Fypvm#z~*lpJH`uuk?KFm^90^8w?{=zpi zqb1<_;jc}WGZpV-C~}JI&H6u(zO7_}#B(=iM=GX9DyGc9b+V^yBSbyjy`|%&SY9^$GgDWcqb8FF=MU%AZ`p8u>F^y{ z-pB;lwrqkoeF7}oKVDgOL7zLb0S&kuo#J&*c2}>_vkLvBr-I$%K-ZHaJtahijLYvj zFw!%~;L*;&JK5uZ899jICp=^v&Vsco&TRSF_UM6F1sqQs8a{I#Lqm=c9xMk-$xz|a zC(x(z!BQPSmbXVE*~ZlF4Db5%s>_V%>$gXnqXXT8yX$HqPebr(2u2@2l^H#X6!$;I zQ7ksfDA_c!k~6-2eC5fXkLYBc%o(?_Rb(8`JjJ0Yvj5fUCw3h~+dj^=GyiF1 z(d4_{-o9?`+bO#f?kQ8Rzh>%{m#q7#JFqej9n^Iibjwqi2S?j0q?}ljxeoSi%`I>4iiR)WiruphyZp<~1w#9edlpvsi zW0x~;HR?C3U*CKym-%FSkUUdb44e~fYY6&qrovZ;HA`r7uCZisW%Z4|Rr=a2;330U z(t;%ie#5Wz;eaF*mrY_{Y4NO*StY)ry4Kd_mK$f!-c;XO*S2vMmQS-oI?3#Yh6fvG zV(xl>sHSxmID8<@G*kLZi%aJfmz6G@meA>b=8i|D8|P#9RK}*^-;aczjOHUCma2uA8NuFYh)PPEak~VT&{#$6g|gy$U*Ox z9F{8jCB}Uc=7s44!oSHy`T0f-u5^=B_-bR=3>x?2I@Y+txJ>AbX8PX{h-277R`elD z1nGYwygx$xSYx8`ywGn!{8*zqQ2EZo^(w(P z;mS1Bhx+;iSK~Skz918S;ELgina>=-%;yt=nNOWyX8oXG=7YyMR9fagESPytfUPOh z2fR!$dFZsQbh(xzE}>k)%>1bTYFvp6q?=3dbaXex{?d<;zNdQ~82< zJuuVg`qKHTdS*O`ZMaT^FJK}#JZ_>eb+}nDNo;rIp}a2(ro7{VS+p$L1U#v1vK2g( zrS(y|;ZFzRly1`9ncl^UfK&A@?LpQ1)n>d87wW$g*U5sZSCQcDxXvKH0)OC&;rZ+j z-CTI4-H$6rl!6@mfnz)|%f3)B^<69&NsMa2)R*-~eu`y3CZ@g~+5wpQP893|UL%}c&qY37(*P{!Lb5Yr(dGq0j(FIu_p=h61ywHz=;b*(r_{kki9Q0|1S-5wHX5F^p zu9?^&#aZxCY{bVlM%N(Dm8vN6+{UP)9M5;)H$b&DFshn(N@Y~p>ZI{3PAvR5BZtH3 zI!!92)zR_M#qxmpgDsoYp}pGFnyRg?*t0el66@gH*wQk~+~J8osv{dF#w;AzZw+k3 zbz7slhMTy}&S=cB*ds2=op*D76n7rnZ}Th>=-SGu{tG0xEj0!SNnKPQ1o{T#F^!c^ z)5xgtv*05xXC&NrF%GeRbDUxJq%j%O$jb+nL z>-PZ)Vb$*q88fLLZ-ZLDe+8elyvsr398EhdkMkg_ykA)40mkHg9@r{x0AY@Y+G%;a z5Mh;<4x>y)9QEUThcw!+0p2R_HH4SKYp3OHLWEUb5#$vkj`A)M8s)8b*pG7!=Bu5S zx5iN)>mlzxFi{?7)8wPPc@BBykjFWyc3NJsLta1RwS$TBc;C?S&H!7>+lO?#?`fyy z{XHUx%Y{%3qj4TVd6&a$d4CCPmG@o9yB~4dX?aHwVU^clk;hxRmUlOVS>+X>vGZQ6 zotAeOn5^>pAg>xs)Q{5-EpLHCUOD7(POqJoSL%>=4)WH5iSjsA(em)vuT8%o2<&s( zX?YxBh|7ggiOTE)raaD7v^?69>ge&{D;eNs8l{YcBj2kgRDVgM=Q@B__C>mG3_d{xMlxAFM$Wn}7BGed)Z?*i-JK?ccx8fg8@8 zR~Dh2n%ZHn#gjE-xw(sybvD~rx^dy^nOU*DnFP9>=KTWhD&9Wh;rFZZjmYyKox~p4 zYVVM{F5-RAUH)Lr`taR-kd2*I%6>d!(+lqA9Rr<_haT$;Z+amo^8ANYY1o14jKG(6 zPFgy4p?jwKEdlv}oeXFCT-n-rXkr(?Xb$oeX!An`);f|hx1wAWv?dwVRUSTZE zxG|cU3k6Q*8lEvn`Um>P9(i_P!MDeF|J(KLo}Tnua(B240>!)QGo7WLoX2x|7BL&| z&yD?G7>GRoLDla@BG3P>>bLm&!O8bWU?=2{g0&k_XytKFJooUsF_S1e&JP&gIn+FD zz1#ae*V|*Gld2cht@hTsx+C6#oW1>5b{rb;T=v!MlNrXtzs{Uycn@ZUpa1R2smAX2 z2hRO+z>{-0=TOPBpT7MW&n2D-$30uWo&D1nbG@$`JMxX=m;7|Wd#5g0_iCDF!oYX( z)-6lx-}uZ;vtM!T`xfgdbExEJg}>nrWVB@0)6x80e~H+kLe^bmTi83t9d&i4Wo8*3 zl(Mrl{QPfrV5>i8Z`p+1-2*>e=%uwg!=9`O%eNZ_w$4~FnJ$BzBdT)$2s=)O@pau< zVBKVUPRi)=Cr!;7;xTFJE^Q6xn;lZ3*te<$bA0BW(Cv~R?E3Yp{OSft3e=+E@Lchdbc{8-uJa$#Je<8Wfzqp`;8!45nwPG;b) zhu8Zx47)gJz;XQ3JRB#re6G2<7ehzA^?uFEg30Sxq<>SA-nx`0(&$$!0 zQpsRWeDq4zfT`GU-YeN6z>*El7N{r2N7X0B=v=hf7BNsrJtTf%3#c=hqvmMgN>x7f z;QZ)<)Z_KB$Ma{^BrH`}l^5gs(LOCr%P2iTsGIn#i@BkjS z&>uWX8V1KJG`X1T2f95Liq{)WMsFSeENroM&oP92x?R!6$=Vg`n0(rGYamxm^C4_) zSJaPA>!JA;A}rA52|A}>aYOTJl-1(&)A9QqOPI7{%)?Tc&uV( zt|Wr2cDHA&cc&|Wa}qmu?iq794d*!0&t@9l`;GP&*X{ji;<;@ZTpGqR(dbJ!hX#o{ z$Sd;Skbkc`n&G*+$K}1s?a3+}8EMRp?l2{1LbBWN{&U*+tT1 zbCqZ8&10ya8~Qzx>)n*S&gMep=GhD?R^-~bue`s|GggazJlDHEZJKMS5WIc)o%zSJ!8kK_ z-9}?Zc9HA0{%iUR!P=g$WNO(H&lTY)P~phP#B)n`ZpT_OiwCNZX*9ocZ?v%UnVFe( z<0RI>x_xe(6LIYvm-p4|=u6%+#xvdj9sPFaODH}rZsY`UeJ=BAvo-3+d(73>wZ$;J zKQQ`x&t@5YT_)enV_>Q*90dW7C%fY_YdR;z^-%Td-Q)@w28>euB1)7A%~9M(($~H9 zku;k>!p#qDK(ztF+|Lt%a&SFX{sguYmX3yc|(o|YMllLQY6eToWCRAX$ibvo~zF4^njI9(tE zJNH6~NvCsBNjTPoUXL@Zf;jgUq#G`Dx6v)6`0tEi~il0tol3w z*JZ?%&5cQ7%Ko%q%HAcI>U~Kt`3D6vAKH#-eYpNeFta`@n0nFaJqJ}5(O;EC7DviH zGG23^o4=8hccEbN(&^u}l^jV+8h?|fV^r+-X<*wK2rIudbE;AROnKIggxGz_j}!WM zE&(ro!w=o+CvN@wby61lPvWr|Y2t6=@zm;>&skck{_WgJzmSCZujHwv#CdF64e@N^ zJ1MD!D4rDQ`8%rZ9eFq$(1>5uFE|;u?4raqQO5Q^6bd)t*_D(=w{vN;;ng6m>SaUr z44RWq^)ZzyKKA(?d}Rn*?8j|!_)m30osQ4<1LRg$~^#Y)$a|2--p*u%lirr<^2ZnR(XApHyKQn$M&V={j)>f8H9P?*G|j(2Zy{@E%FM$ ztmS>#A#Z{^dHeg4L*6;a)9sHlC@rtuA#XC|P1ec@AA>CpdD&?G zJl%Gr3z|^B=_NZAkaz z92glnIx;eh;eKS~#H)EY+W+C0M?8&}{M74N{r$YUtVc4|O&vLD7(csgSm!pl5Y|B@wO?F53GshU0(h+=-p^t=d8X5WQm4nfg7a96c_&SsDX`bH+&(ghRY0Qe- z53Ez#g>(FL_zd{IR}JG3{Il>g2GAGa{{nV9%q#q4_#*fR46H41Er4g!`39~}!taFt zEc_$zE%006Up8=Wg})a#0KW!)Df}JqOW>!&&xZe+VHnTx3V$8^_3)bv!^pw)a`-vG z&*Rz)zXN_3{KN2J_y^(t%78rhdw}nQUkzUkzZ||2{yCKCF#OjI!*~YaGWc%-&&L(^ zHJ-rr%kX>QzYgCBzXg61{Idquh`26*KL$Jx*WI}8#`R0^`{192Z-8%xuZ16h|Ed9x z>n*s>gD(ZX0sb=hS@2WgGvE)ve+nM|jYr`h2iOMR3Eu|qhp&NO1-}gbPWW5kd5`-F zt~cX48@>d18vLd3GvTMer^D}ue+d5DhGA5|e-5}EJ__Fo|EKU9;a9@n4!;8aX87k} zufv96ya@kA_%9%?2fhiu9{xGQFun!92fhp8Zurgcb?{$D+Czq6JO%s>Tpx%3Jn$Fc z55YeGAA;{Qa1I&Q=W+cU{GS8wf$xLAA3g}537-dl6a0rL0$&zla`*Q*SVLbn_>0`x~URo-;l7I{CYgRL+I=` zba$lVDHS;OAv2t=!t76G*sa2}jTz2RVYW>(oUOuar)D@)g;@_~I7@|d2F!4V+mxRx z;VcPXr|Ib?eY%7%mGETEpJCExNH|Zzhb3Gj{NIR&-7Md85}qpb=i^~T4@RkTAzTx-1FLHiJe67ER=zC*dp!bIhbG z5`K=4bO@{Ram=HeDs+x-bOJWbQnO*+SAx=ST|!+;7JSs5n1RKj@@=GaVEApE=+(0PT< z@tba<(0RY0yH@Dw11bppa+Q9($IxX-nD+&`3>-M7{dupTyHvtc2N(i>hDo0_pn|Ax zGt7GiU4iho4X7aWGwD$YPZWBmgs&BPpUIB=%<=D#g!3}Y@bePR5c)SHoF(+nX}a6w ze_Ycg%zF-9k(NK8f()znaZtijh29qrD?0B#bOl2H;(!XGd}e-sF5!tn|Gb2+75cL# zJIZH{-(Qz-UWOSyCgBXBe^bI)Lg(CqF2il|KVb$@e`ffZ0W+dV%a4bZ{!dGIs?eW} zhZUW37PAx&tucUv@Fx{o;=Kb!lg!3}YFy|a}8A9j$gf2_yd(0s0XYzkh!dVjT9xx*cBt7Re zbY4l{HK2m%UuOC*NcdWzuaa=Nj0c>H(Jheh$^jKLZk6$ab1Axc5^fq$L8Dyc)k}DR zgf~n0R>{9k!t*5jfP~AXy>T8zw?M-852zsWH`{Aa!t*3tBjIuxFYc7^0ts)F@U1ew ztcayI$E!dry?KAVBbMF_bN)?ttK2`A52zr@Z_>9&c!AV+bBu1bmwP2#F7tt>mH9(;EWJtRe3`CX#+zjWDhT_S;}hq*bhpa*bo+n`LO+wfM#ANCzgr^V1rlB@ z;albYSSjIo5^jv8H~Z73Sb8(u5KC`{Yb88S`kUc!ZJQt1jQ0y0YnQJnnK@@>#ga8M zOXtm>dE4SUX0EBOm{T^_N+~HV(-bf{DT~cCDJW%>XQ3^wuE77&;+ZS&T)v@XPVqbo zeI_3rUovy`nu?j9Sh}`)=0)%##YJ&nyxf&*mR)r27st!IFOHKXzc^0QQkK%Q23b#w z7cHhmSxI6}2NSD#R3?igsk`LD5?e-cK1-(3wo>!i+hA%ww7XGCiH2F0nnjiILNbIQ zm5jv|cPv@Hd})Q%>?w^EW4;(m#F#I}yfJ1Dd<+0|KqSe^wNis^HJ6em4ZYd6+Dv^!uG>VOANt~Ec5v7I` zQ^i__jiho*mPQEDB4TM`wPH~-p%^hHi@K?qERyVHN+u=+2W2>FKT&0B`xXVkc*EsGP`T$;&!$Cn|Koa>Wd3F?DjqVw|I99OF!4dV4uyoRpbN zPq6C=X383H@L1G~*MWm4Rbi8`C94Mqn)gcf{cc- zG%+(;)Pz!YWnxSgbrZ@OW1^%~29Gf%u{v*dF}+gMTmsL<%5l_SQaO%VOyIGYNZBWW z!D5~ZFi7nrPaUh(1hQ0Ma=}8h%zk2)jG5e`J`_!q6JxX#L)WrRn;0V{I%+yOW0G1z zS58*nj(SSMl|;KFT$aMBk|trX2uj9cE9HgNim_TmYRmB^9;=HKtvZ1xiMm0X zTxgsUd1iQu!FMUpnfftT)T2}jS@m;I*~Iyzn)&Kyov4m}-s)1pOh;D6GhKmT53bac z@zi~yVA59$CO@5)p8>3&lTxy>aL!C|#CepSSDTS&hOu{~ULx4ZugW4#P07zO(~coO zF!@zkfSvjzqn6edxiF0{PpyH_%oYDaT zlsypU89dhKWWhJ%I#=*ITq^~Kaa}983)i4vo_T5&{0m$k73@XZ*dv(j;1>jU z0lzGm&-T3`co_IC!I`M<_XN)Z#!vZ5=XJmZfISJd{FRDfL{=dpUI7v1s4IoA$SGwTY_7G-xItK7(Z1j{Re>A zmTCY00G=$^i$*n9a0PIs;0EBef_DQ41-}5?D);gd z3w{Xr4Z(YX-xB;S;P(Xo8!(O%D4ny>m-y@>^`8YiS@2rmxq=@7t`z(<@LItqfrEno z9k^9+CK~0Vf~NxS5xf}qpy2y}Ul6uoDTY`P)|L+N|1jbPkl~)}wpD|^=p9h{S_*=kp1-}VgDL5VD#ah9|z(K+H z0JjQ`0zWGF1>ik`-vB-+_&wkk1Q%eed0FsW;5P)X0)9*IX5jY(?*ztC3#D@}FyFIH z{l5b|S@1ss&lUVT;7Y+hj9+U7F98k;z8|<%@Sg)eD)<=i9>MX$(hTsjrZwYP(eoychfpHW_>HGpP?=95-P2kCbGjVg8D|j|=rQr3z>>K3&G;mPx zLEu)w-v@qF@Xvww2)+V0#Djv%fnN|D1b$g?6!;Cn&jG(B_%-171fK`S(J!UL*s;)G z@J+yz1qXrW3Vs~8Qt-Ec*9!h8;Gp35fm;P%jj}x|_(tG8g8je;1wRV>g5X2IFAM%# z;5P*SC-7T>^9rE9;1XaQjZ*rr2Il>i_G|~9Eck1{?9YsU8MspL&wtQ)x(xyI`DW^Q z4tTQQt1!u#EBF@RO2Hd}*9zVV92EQnD;mW3p#ulknQLvE+?! zX|#sb)5s|vqmF+LOnnqozIV=#!pV2ZFYt))=xGz5KDMN3!_&R$^X~~yN{_Cq`pPeg zhA)*ko|Cp()nW+qbGEh=3Ci&ks@5d@PM-OB;0xq&!9?a;vS%%C*;Uv6+hneCJQcoqdzZr02D2NZViS5)o;pOYW+nV)b?4uf+ z-yHru3ZdAol@nG?iXHBfyegtr^2u90k1 zNX|WK4JS*co~(~|RD6gp;jK=y;xB-oJ8Le~`h(sFk0rb9+53HSF*in>c31`|$16Ri z70Q9l<}lq;ZY%ye`7nIPoaPH7hPYfP=WZ~cr=?s>eH9JUHe&_6Ro-%hKLM|umbVlU zR(ZbZxc4BA@>m?wDDO?qt8vxkI0%eebwrAkh4OH#jmbLz<*fP*ftF0auYk#_U$;fx7>m5HL*8qk!PGIQ^=ov- z3P41xev1)EWy@+Mg1VagSgHv(+cFNgs3 z&`#suB7(SF2y-Eic4m1oO^V4o32c?ey$aH`)A9xpVU<^Ik;knh(kLIt)@|}SQs~D` zV5_|47J1yY)bjow>G3~SACDqXh_H6#qx)OLTji~{$m7EJmvA58>H*;g>7K= z{1TtljrJ~yg{AW0Uf<~Nl9=m525_cs@%R0kvG}{k{(iz({O2w4e2-xYmz0u{JB5%x zB>Hn^&hrahjc(8NgCirSpWHP(GE#y^6lT9x^=RnWp!@kmhhE*b#fO)c{XqjNy%D3|;X`)#IL5rk}{oshyBM>76ppyU*yIGTt-h#c{3~ zp57@v&n8c=_J$G101>bJIOzs?eFo7mkd4Yf9*q^Dk{b^u(e`CaD2d~;;i_x?5Vjepx)wiqVw3XJVOzw4#x2YUngOSjBO2hXYW&S7vZ3S70+ z<+*7P^>|=-cx0r4Hh8x%|17>b`m1Q!`0n1qv3tLr@0m`HCw~GCrPai9eOvC{*E1No zeNyySLuIRfaNV(?yu%q$ij4m1tLfEcO7Ocwc_RC_DrHXzs{QsQ(acD8PVH6qcAtND z+7a)a?nv*;yEa6wFd~7gI;o6dobL6g1nT3#ps>K%XNJ26Z+nSfL@w_cI50A@e|_HG zdG4w+BaupDe5LmvjOh7eMMn;&pUOCUiE(!&z7HF?GCFu$zkA2ujg&_RepTeII)!i5 zMl+*z>$8{UPp`z=N_qlI3%#M-W!-pN<yv{$XJY}5~)rDPw{6&GWQnovC z&s3o?3>BeP)1$AWwBEaoMTKKeUSS+IzYcxqK(s)WV~{3o9Hu?{D?ZFX_lORH6Y8A& zx~Q|`5WhJ5SYAi80!8TfVtz-bPhl56{(Jy|&ZE;Sy9)D{b*|6(YWBK$zm85_cg8Ii zePmebLKX4km$b}1Ba!{Eh|7}=nbRwyg&mI$bO&~K=k4yUxHr8zzY96_cLOE;LhAWvhq<{?&POOV9zD4NMT-Ni4l3`T;KU!&-Ua_ ze{AOq?vq7^l*019bDQ$LnJ6`N`l)M>)p+Fvhzh&xi?bPfJu_UYs$)M)hl``M8~)UDYynffWuHL7M&^yrqZ!m%A22Bb&NT=rO`woH{5#BE;B zc!f`mQC9MvaLee{hrD)-!x*OIpueiYcw-vK==)FhgM4zVq2)Z1JE<_=`^<}y`0%j$ zZZU@HET+Tvbs~iY9p4*3zl^RwR_Mh5Ws1{d`*DaYO(}E@kG;sdp0ZH2|k_w~UM| znEP(t7xR5q9baLO?^>L7({ml)&O6dyacpt=Cx6`WxEgI1 zyE}f7zx!)y3|O4qu`mBfkBKunzN$x|#c9VT-SXup&AjS)yE{ySM<(TUJ#%hfv^yJ} zrzhL;4Wn4OtaBYH*Zl4LhE7J*9VwdSt-Hh=a`rzytUe~MUdN2Vc)<(q9kUD+=T~*^ zsu_66^MvfkVhm)RC6UF(!omkyrd22bec9f-(|TOX))!*30#mq+#@wxQ|E&4Zf$?A3 zTefxMZARpKAM|IB-+CBd3&((V|JG%X^<~_fz3#>j`wNfk92m;)^hAb!`vhKh)R(uv zucCKZdPg*We^d>=%QB)MeqaumUCZ2{>=sJegj}>E*Z|{okV%D*PWbv3!&L1?EZh6EVxgNuav8d?Eb(KamYf;g4p3Ds;^%*c9`pN$DV!o_S z-ict0=#~Yz+tnGxxZA;mwTAbN{78Y}&CZ*aUthTJ=mRyLdKks$5AORJ0f@}d>c-uqB`bjv1aztFhPyjL$Uz!|A>@s3z!AT!hU zALb&u^SqiU@D@83MmU_M^!sYY^d8j1S2LnV_tixTT+=Jp)%{mdVfE44`tj!AabQB6 zyO1wwE5vb^bDpPGSGp!u8j)9idtAN3%xo2v>BoNf!R{}sZdA#3AT6XaqvNx>O;o16 zH2jil*?V#iEgCk*CU%ta9RuAZojKc~9tSv7rM2JSjoVKAd!V6tbG#6a zY(>-fZ=IXMO>NCB7Je!gBl{G&hy|TytUyHuZzDf5_Z9i3wEGa-WHR{z5287!pTvwc z`lnQrWEGDcfvaL)I+|!)^GEse3f>=wJr(Veo#lMYWm1pg;x_mLwi*7p3SXk$1IL)3 zBHpcbjZHfLCZ65ou6*1je!q>o;&GRzzH({}b5}a<(&YPUIwlRL1Q+YgFhp{%Wl;1b z55xSvk9G|I9|u3rerZSgYYu*kI3@2{2me}&J(>Q5gZ?E4{YMsobBQ^IKjqM8m4m<4q2J{WeV%fJk4pMxY`XERD$mzx$NUN$`Av7o zPj`fwmftw1BZ-*5O=S~HVJMgJcwLw}7pl*iato62g^1_=t3G$?lX#v#SbY<|a0tMB(9VzqENL$W${_p@-3D5W*#8(SG2)vRQ=Q!xr!n@>$gZ0F+ zM|ux2(*6$oLBZF-ZgqnB4&Mf1Ze+qW!@H#Gv=YlX)pp`B_yhMaylb3-MhCGRbAFUq zHlw4&$oD1W`#Hh?2Y5HJoHgA;jKPSm8=m}!aQ%wlS8?4>d@cUK9fWuJ@CU9B-c_ie zdN-wOl8KKn{yG!CKn$6Uxb_oIHsil5@sHy=AoyKehXnr^SDK>$wxQ!lL7a|jp5Sa; z=Lkj?>b;bjze3^%a9t|+WnBMEFfPVpf+>$vU7Z%Ml~S11$KTQzUjWR$N=)-s2`&Qu zq~ICApBD^hd{M9u_^X0h{1*im1M@c<%A5=QuHZ6Yjsses9Kkmu-Xpjic#4H*x?tMR zZ;1~Hu0;H9OZ=AvS0kR^BVk_4f%y$v;`@Me(3go<0$(b4E%4=n*8{H;3~1aV_#WV+ zmiQM12N91~X2!~uEw~Qx8w581hXpqScMEO>{s+PBz`59ar*01emkRCxzEAL@z@N47 zJZ<55M=)57{}LPp&dM}pehzrLVDiinyc?MBm1e%r0pBC|2yml?zeVs1i2sz}J;3}< zGSkv^3GN2&7Tgc~tcB-@;O`>-n}Q2~|HZ;HEch#k=h;QdC(lQM_XA&#j->OQBlsZV z?-kq!Ovipo2Qw?&09o0@G7gjMnu5m1v8&731&WYPCdWu(37&Xo|KhLPtGg~s0^Ia4VZdzNM(FXPXOw< zPU0zhgJ82qD%Uw)Lqs71oKH zTX857X8@BYG>nt8?68GdsaqO!0bin=IfhghzFE+{I-U^POL<#s}mMQxlU z#JM?377hjKWZ7%s(1*O@<*_sAPwZGVO0~cbhBmh0EF+Ffw)(^PaIiIvwNlKrvtR8j zP?eSh&Qhs}3v-$|#g?A2Q>cmg;$&=~0bjfETLq>%!DkvX38%J|ReloYL^77iT-)=M zESC4S(x%uDvC80CzE~mg4WO0>62AJQ*{wCu*s{r%Q%h?g+`!qDbsPW)`2jX{5HhaWW3ZOz7@&MvlLZ^6&41v%r1gP%C?sLRRLs?1W; zY<5u)Q!-liMob=upq3E6KqYM&&AquHgu~XhtgI6B8A+;Owh?Ta%|gxM*e$Nx8r4;w z&u(cgng55LTl^c`0B~!Fxk{`d&he%o4nwGNyf+ZzHmw}TSF6)W`fwj}^1W(d)O=5Z zkGNcDXR#*ZcUE{$p+2PX9>nLntnwJ(x>GwXZ<|Bj2e@hRj2-1+dKZ)TFw$G)HKSlY zEll_r+zKYEesvI3jd;pq_FBKY9rAWV9`{YO)B5onCRTYzAm~0YQC<$bmiKF5u*U3M z38D{S?X*0uldSUcus+oKae1ia{Rr49F9>-**TRI4!8Zh#GXS?9^6tZx`f*C4G~mWH?EXtJ+~M^*eY)iv zIMUc&h5?wo6rS!=h+M%2C5|-uzZX6Apr{W+h{bny%XgyZs8|_@t zocVL+n+Y!BToD^4oY~il44-I+-~afd0e|bed8l&{e*Y>}ABsWz!bR~<#>jVT6yJnp zI)#O9O2_v=wj0L=jTs&s3rRE9-I(UN9n27ZJl8W}JAPwlM(cjyQatgn(Tg-=5C+wg zt3Kw+^GufCDxuGTkrD5^8Q$+@MAHCw&RyHFXW(0}tmrNsf9O!@?!JnnBO^zi&D%ZH zHt?*kx7s-JQeMY*@;iE5{JF8e?O1ghenZ^7|G#^y-TbYx+SQ-7?6aNf2#fnv+MDU` zWPE7;m}{0w|E}mbZ#Dk_$`DO2gaY%f?s#lq!Yg~r^6yPs>OwJZ$%Xo$c*pT~p5+y= zYZ}huq#Nsg{t-~-sVw3fJ~}qYLotWbz+LTHcf*H$>4=%|D&i0mO^*ys=uB6iw6UJ) zf`MV%$Y6S>YYSer-J9-hORs&o5D}+`CY*?UB3DX*Z>v81>y3lynVGm&Wf{w!L_lS6 zoQ3rM7SR)aNG(*E@w;|(5jebk?yfWgHtS7u8PD?IMsJ$C&ZI#(-BWr)h|c>7%wn@E&j>Up_1);>-NZNnt_4b;?mUU5|2nj@8dJZbPe$Mps&LE z5BH_5F4;F#AG0uUxM-9xmvP)z)e?BW8H>BlpIh`N{}GoYz=dJ`O;fIA$Kp$*+z--@ z^h+H4U)MxjNq6-FNvG5Mz>1$Y2sqZL-uvafLd)SjpgjaZ+gJ7m3O|R3H9BDSRhu$}4z3Y8r z)_np0z~L6EFl7`9ru^xGDepGHl=n%&l&A6)oq5sw$w~*=+hKfxjQQLeCT6-tf=OQ` znCa|mYV}y5?TIk+r$|5N;H~wIp{BN0W0qd(S(e1s`L-l6Kc|}d0U`Apr}?O&PTeSv zE?UBMje#1h5&6|rXRKPM=qD4^0#rm7VUMW6CspM$swo}@ zG;>qGQ;(jTusOcSYRO%dnonuA)EUWFRu}z!RZ}sw`W#&`lg+7!`J=nl{`H${n?`@8 zP8z~!-&!>_w0&$96<|pf+nf-Aw2q@JmKs;ocsR+Ti_QLG9N(cJLz7}J$HM77%XqAZ zLe&?+G1|H+2p*=f^09Afr?DRq#N|TRjR5;9f4ZSQq%m9pZ{jUa(I(&#^hKfG%9CitvQ(|Q4{>rIYBbj+7d^Zf$pts>4M z!1*QVx_{74vlsrJ-$X5$BMZ*a*PC@ys8M{qIU}Z>8UMfa7wf{viC=nN*|~6R;m8Qi zb>d5((d_+d9fs4lr$;_d@0}6t^R#h& z(S*oBCY-sxKV9j8Vsu2*hhAgp zL08|y?RqkO=fcazboV~#er92o*&eJPs|BB@`oeNNb&2$rP)&2m!qNvyaEMQ#u!%}b z=Sm!qj+-}M$IY8Bad`2hpn0VwKpUI!`bu>*DI1&Tm6RgfUOI1H$wH%j?%Xn?wl-K7 zDlOJ%PVs_LGj4A2!uckeUov;DiOQgzao37vcYb1p5pD_K#St|vCHyfA`Pd`)4on*d zayCLWK_p_?lwLYvJX)#AXeN(GtI{xrj zx1>v|kTqX_<((@WsZDh)LTs5!X)Y>rlx}I&hGfZ2t^JFauB?Uy)~sBzI2l*f(iKbB zR4=Kt(M0=EBnVeh302GQT2t*`bXQf?lGST$vSG_gd?9Mt68|SwSFF5irH!~^$tV14 zmaJLB?Zb+LGjzoKd_>%nZ0NsXpOf_c%BsykON z@s~n{(c1Q6r)*X5q`Jm9FJ9(oR*YBYohZI7SAN{hKgT~xou=gSt2U$u0{^;-<#*Y8 z5%N}iJ02MTS^=Ex6V{LR({ zJQr8~u1B7);L6{Wh`VrA=U#yM8!3NdWBjLa<(VAfR$P68n{Z|67+;5Lk>LAqogsKV zuKbOSJS%Z!-o#b7mI>zX+w_bt#kE{8OoAsXbWQ6k~$I7W-KQ$?XBt^ znB`{K7*G3^3#QFzBgV5H=vcppaaCoJLk+4d_;bP)Z^P=DPT}uEyebQL_zb8j3vdM3 zCp=BSsw{}F2UcYP4gk*(o;!e5SrESvSd|5s&s3?h0AC8M$^!grq$`)SXK__!LHyqV zS4;d~;ksP#_mQ>`nCI5YaaHXTI31YzGM?pDZ4#LItM&%WI=l~_Jj{QKVCwatU|ft( z31@Cu={yDBt4)yxHVA^JnV3wmt@C;nPCYUyRQZVh^Cz!gk&M4D|>oLKs z2Rc`#Stgc~nCY?wGau^5c;>@$5-Ys~Q?{yK#8bAaUtsD&$2RjC@>cRMG2V3;qyzx!{Q?;7Y;#X4YE4_W-XK z909&Z@Hc?(6a25hLBTw)Qzw|uA~y)G0d5xjY2a4DJfA{Go&OcsgDdfGf%61kf%c?% zih+@x;#mr;>mmpYb`}3;z`8EJ224kp$ANX)w}ExqaTv>V+7-Y$?dO1XJ^lb#*JCad zI=>!~{7fUxSK^f}emt?{IBciS2l9|z0+a0^CSSwf9Io}Z;?4UPl9Y>k#TAk~64ND=_2QG#0+=ng zHq|sW_+_HaEPp=<=A*FuREVmVqyiEQ&yP>=kx^S2lRf8{lrf3Hlkz2Go2;}KXpI+O zPY|8N3>T1`l-qHD*M3r$m1REvi0419Y!W3Wjv|8i`h`+ImNAIDSeG~eGMg1B4=Z(*YN0q}HqW=|T&r9<#mc~OLS zz-y=F9Ylmx-dTAzjPf|lYIzh!dAPkOmxn;LU|zJm-w7^fB;1e38^#%2DG$S8Odj9a zV%2Xw0=$=Kr{ygMpH;sXa5H=hOq9pt_N1}AlN|CmhkOz7+G%+c9rC)d>^cV~${Pc( zG%J1vj*C96ChUexmPg+}{*59zJ)_NUNq0P$9NS6Sq7MXvSh zameGdtv=AT)B5dk$SbzUV;Qx)?Z8(3hLA3q{T`My<+##STjbF`TArGdAguc(-&>W; zexHyu<+#$_XOV}l7n8?#L|FBEJB5DZz(*a*;py5f^3YXc^4>#wtGsh5^y9lPtnzkS z@#wn)6%An`Ds}bjUl4O5=P>J1x)ekT)0dZUz(OO@=2Q z+x@UZ-g}UTAtvUuydOK{HA5c9XUdxjujO%!1FM>M<6`8Yvjqvnkw#xF^`YZi*(oiK zJap^9XFY?=`wSiPrPF+$1D~!l##3H1h@|U&&ar@ZN4$7oR?V!YjrY&?jrz>%{5d!W z=%X9`407`s=4`GrxFUHarkxqjv$2z|^j>AY<$C$O!{+-m-5>JF%-%^}5Q~phoMI^9 zNmrHjDo>Vo$OTSt)ZTEpdN1caw+zSMGyCwblfAN*xpz38?KCyA{O!S6)-U56@P53X zbr^31-h%g!?hirsDn71zD(h^9u{58rQ$M}GmO1j-+EZCdb-cGWJIC9P*IKLROx?%R zPVueSkK}q^OqZA8w#CYt1qyD&SnuQXES^#&r}_TU{hx4;gr3|SMa(4U)Uoj(GN zsMtcAEBH@!9Bfh}SlI>wHcNP|T(6Mp`@Gq~y(U*YJNse!9q#V*-kcoIm0QQ9d&;WN z)M6V0a-tPXkuP?nTH)m^) z`^a|(1`T82cX@rezy9|4L#qy1b%ty_bS($pe^Xd{b^1+TfRL`q<9c(lj^$*Y$Voq) zlkt$TTuP$y;H-J$E^;I+m80n(uafNy!WTW`i5a?XUz5gr5fR&ULlV_5ReTTN|z1RF;J|Aa@7%_7^Cdoqj406{Xme5lRDj+eb!9 z3-i^}>L=1CMACi?!p^UZJ#;>@|6g}~v-jnRV1VJ(L+|%*?K@w4jQRwCL5} z@2;4c{&-f^HO81-p365D=I@+ydvyN$!6NUuuKc}!lC!I8e9zuLai832ObX171g`1K zj}*?9o_PAHQ^R;Qdx7C;|8?07o@gWxr<8+Ib*YR~PxD(6hcobUd#JJF^^te~?)~2c zqia7K?OglWoinrAmu~&*3E{wOss7VXt%5Bydm(GObGZ5Q1D!!n=Ei_;W8m72foqPv zGP!rKeY<)eL1eJ~{%BWr`u)B5{KxKn#a-3u<7;bo{4`RSf4Zn3vj4lgwwDeWk^TL< zwjUefKKkLbh38MDzr%qwQaB5*wMT(&E5tjrpV|aP1Jw0+7G8Xxh9(WmMlV+^r=MyX z#v@^a?Z0{5q=Om_b}v4ah7W4=xXOli{nzQIwy2UG&w9jj%5Bnb+toRAW#8QX%AcsL zN&_>CKRfU&j5Q;&|Giz?BhV}`y(@4-Per6~I^JzwIHR*LQaF=_hF+2V-MgOIJ~Gn( z`kC{p@8UBhZh3M3Q=f%CpdHRoud)Z)+2zjs=E#o6MxvI7&32n?*>9#~Gu!MlLFA8? zco|0FiRY%?;NEe!vF&xwO&BjuKlNipJC$WtdUSqw5Z@%|48C1;da79^lPpz&GPqB1 zaEMjMveQrf=dgL3&cIF6-O0~BoG6^td$Jtj4-Fr8pUpBJ&&6vJ9?9OJ+u2h+nW2%Q z!J%N^aR2L|Ka#ud*LaadJ1o;TjPwk%{w3i3ts4!#e?A+M>LD=B^?ThX=Z&a)!|A7S zTNnGXsc@nY4TcNzyBDYm?|yyPZ#>Ih8Xg=OdFANor`5Z}Ga6N`FEAU-)7K1-j7%DA zKb(QDLmWjVsRr}wim#I9$N_x)h|>%Pzb z#9QQ=6u4%ZeA?jY+n{e|$w=?X$%lrS0opLKh_1Z>9W5I4y*===V7$#;V>Yg*Z`caf z{^3*ZH?uxe#mx0?)B+!aPOz6Wu!-lk4fh2jXjuEkMu(q`j){gL{d{fFW#eBwnXdc# z=Q7hrpntS%*Us_%5ZxJo4#m6jI=46P%6lYxe6;fkw9W%Y&z9ZYEt7sUasXQoM|U2( zsr!lD(Sgnbc)!W(b;D(W!|whA7zz&!-mqi9XY}IzBw0~@UL!i#u`93p^?ltvuaBP; z4el)chm)8kAW`4z?N4Z)?fd)kp!XrZ2)}t>UNqP56XY zIp5LQ59KohldLOG>(k`)ty5IF7 z+O7Go4{Z8!TOiZ^RmY3*-3PWl5R9}1muP|JVeKy*w)XvQ0L}B%)<=~w)9ei5)K)Ky zX!qyYI(POymmFA$cYWkFecWRoyXWZ0vU#qGh2@u9TV_k^-?gjdA9JTgkXn_$vdx~#c=X-YBmNC|j)}EBJ|GM1TS1-PIkB+`a``Cj#I3=yl zx3yV~6Pxv+8~Ln{6TN9^!DnY7$M$YNYHe+Xp?K}idsg46ep~1E?gKuN^rH9YTemuy zr_ktSamtCqHMRSaATDd_H;q&s+4ZASSXx|dnDZx;e@oo}?dc!y8_~KQs}0X6m&f7q zjO=0=3akD-sn3}o`|!5N6F%=@A0Igo}R$GT7&_Hy#UMFuApNvKBos2?YH zJ&(B099xOGMf7p&m(6+!o(Syh+>W;y*=?`-@Y)?{pWM|CMP2J$WaWv9V`%B#v^2T+ z5^TnJbKfW)Na|@ zvh8e--VAqfB7iq;sT#dAuzgFrwPgWDHGCWPu(f4^QS;6!Ep!fPY~FgC-#r<^XzKt9 ztMjwN%nww8;Pd?>Dh~AgqNn>aRe0`GXRR!Wk-qI-k4o!El*#;KD3jd_jX*!L_K)x$ zTL!IAK7960w2=?**(JV4#&>kU8)@-JYQe~eu1ITdWYo#X$oC>+&O}CM9VmMCn=|>^ zuz$SwJ?*_`zdm`5cJkSCy;p0!&wkalRO@>7-@&W2;In7_S8D!ezw|Ca3&tcFQ)O@e z+18bqb+23QjQw4}Dcw2Bd1TWA3mA(%w$44l|9*V^|s z-c+W>>%b*#-6JLKKka*1CQiG5*q1r*KeS-`{2bV|yG_}JxnGQ4hesgmuR6KAUBu_C z%4EH{!^7UsU~VK!F%hHQ+KL|4;y*hYtqVi#{WEiW*H0W?%X#g6_a6{X^zwm%Q@+Tp zzv#cD=-A4m(JBwSFY!el@wKY$8CLe_j?khKfW4*e5-+~6d|&j ze?MPs)AWmkZTp2AE<$vFSNJ9lUsT;E$Hj4O<=Wd4BPfV)E$)_Yn|#4rhIjnsT?g$0^# zk7GlEH$BClJ{q$I&%nUVzB%2)^=@d-J<#sU#@m(DI|)ahNuTKWd!jde{J*lSEtg4G zvnSZHOgoc4es1$zi)xc6^bL!cCF>Cfl;>nw`_h?h?H>MHZlAPV?a#I6@N@?MrSV@v z)50FStjL4<2$2&1waO*9?|V9LyTD z@I42OpqMe;qZ~fY&KO6ZaY4l)K|f;%*|{|d=fh6ZxgEe z>>HJOxGk`VC1^|2w6f%bzVxyzzRgix#`<~1g{rWbbgY-swI$6192WzjKIvfWCtR_jmnm$$D4$_`b~pX)H$d&zNzCT(wUgA9Oz%uy$q4ICNw|S4Jl0 z*@wos{JRo&_|EM7`pha#k89@$#I>JGrGOPLeuJM)|K9WHh5n2gr?CtARdI_&+jM5^ z=`$HK&Qv_9Pe^wmU^4zHVnIVrcZw@pww66 zg7iI0O<}GU_LyXhYLlGbV#v|&d>{Nh;~ael_MlZtPpCcS^^#bh*Ksz^>zeC0J4|oM zXu8sp@tB<6l5++I{I0B^Yi5`0(pFEarQ^cKN(0 z^*iE3fen@2(+8utyNZ}@%euMN*W)dkdq+fJ#aBM7-xh0+u_te7x7;1$cV%w#J?35gAKZ?*u+yNHeSgP5`!UK6Z1nge zY+RL1FS0%phzQ1N-Jc!WG4bVgulrD2U?es`miOnpG2^2&6}?1vQw%y6=&w43jgXf3 zbuqUkTPjZB;sMxlb=>{$kM>5`0-v=7+>Vuz{Uf>~g09&}CoTp?_=~b|(OWb}wcSHI z_5~{r<)>mKMLce$PW=w-y`Pxvf!juK}DwH?MdRfyKe%Ea8lIUf=90f66 z*X$Jqwrr8dW{VunZFX+KursdN_I|G?UgqN`)L^BG4IxA2<<9Q)YVP>*X0Iu6e)pj( z_abqD5gR<+5j!4eo975z;%L{T@Q{Oedu_!*6ru|2DErf^;|gDkL@uBt3$OiPFwIIB zNK8GlXK!L4!Cx@E%l)Kb0Rx%~(U5ejRNEt?qx7-VWb--ha88SqhVXl%-;qlDJ2_YF zEzytKmT|Z(IbU_7CscoAMC*0&axmj?uqe@6dD!ck7tDCNE8|F4(Y!9#{9w`iuF9vq zl}Akd1J*v>9!%AI_e{h>_E?$v7*KRF;YNjC_wskvh zHD+0N4h&p3@1kW__T2wIM<3_B4Y2L*zG1zWViG73mIn zepa1eUQHW#ykL^QVz6nRNIO3h`RB%U-K+Y4!7%+KSzMlt6CN+FRoo_oJKJKJJL3*( zQF@lC-Oo@d!Hb#~tIcz~tULlQ=Wa`m@~eA)e%$+O@9B)`ii@=;?T=lYV%cw7jz^Nz z+f{qhXLc>+y+Pca<79fNHJCoHD}8=%`i!onk-??f<8L&cTpIKEt6!X48qK${E{)>c zeQ5;e?n|x8i)Gm__&U<2g9#l^JE7B?J_}*OZ&!MvV}5)v{nEYLd($&JUg<#{`{OGw z?(9v^dhu9q`s|L!diEX&rqAe&(@w@&n%+t1Iqp0eXVu22@>B7szSCPiCzyUo zuVt3^SaMgt+_kDWR#cv~tcCBX^{3Cmk{BzLrmaq{ik4Ws=`;Q5m!cSMzCI9x+mmIZ zXSmYm8fKt+YMNd>)91xFC-?lJ4vz_>VVARR;JPmEis6T`7{VN^bO4x%_-(i|Z)x?k zFR#q0OvA0w1Rn--`+QHRU(??qdnSG6^`7goRAmBX{-vg6-t@UQV17Lp!O@+GvNFu+ z?fAPruIpE$F#_Ce?~m!V$G#JZ+fF#8IKv%bDWeJgGx`If56jPz?|?Yq!&@6 zE5#d#D-PCGJmq&k;jifS2b*^I>I&3cj&l~qZB={NURPRbWm~}Rb&bP~sMIBG0gIhu z6vkDfk3t-(UyR4d#Qao~o)`}aK}2gQx0Nmahe>&eO#$nfj7-i*=N!YjV`s)GeXq)h zJl@o!izyg>#FS)VLpo8}*JM*oC~hIv++EW zob&geG3Q;9z;_GJUV*J-^njC&p<=1JlEWSlqa#rS-TEbQSl-G^JIvmJ-6NRdCIYv;f~ z$6obj=z>T**T5gC=g-qe@g2VIt`tlLyLgu&7WbXuO-vZn5 zQsxBJ(jB=MnA&IGG|Y58dO@-j)iUY~W68opAA=p2T*DG#OzN=ZXt_~*LZ}a`(=7WK zoa~KuTp6hwh~m?;snr29y!kfVb(@VG@@72cSQYh<%{RBuH&8h@dW3oHk$Ryjg_dYm z1CxD9iV*j6?q!mv>1|VA%#J->RQc49z6;gmymNF+toP_2uHr0E-MheT0{t!XxQ152 zzGIhlOH!0q4c+*?MEmHrpINgDdSF7+W)3dchikgmc-eWbMGx~?nIkZKDgq z9(MT9BT*P+%Cd&4seVE1X`f-NWQ;y4n)6?k^O)KA&zaJw;Ak40YS2w)jD20dmF z^-q7X1-|Zuiq6_$VMVt^qne;bdRc3oU9NPy%|7u;p zY&y$_E%p4-(~unJca8DJVo|Ts;By9JRT^TAG{j08{IM};cD+c$1@=5|nrrzquBX4}-B)@(9lqy5oIHNGXTiVD4L@{f-kt{+IQ|}i zwC=y)h2&TE4|nYQ8p#~!}C!Ur_kfSN73ba<=y3&S3w$_F;!6TaFJq>2hN&(Ocxkg>82> zYh$vpMS?4L$NF6vO|4GU0KIlim+w@vj@1kQgAX6`kab^Tf_}>Xe$jbY+;)?HUVl=~ zUl;dJ;&Lw32j=^Sc)TJmxmdz46Zd9ujWy{;IjygBYFG?&oeh69pq}!zfD|+l*fFdT%gloV$Lhe<-E=$_Zp06OYSrnJ;PH5GcwcB zEAroodoA2cg)`ue5iS$EMi}Xm=PR=%->wn)m2y6Nr+I&BJ-R;bK6+hK?a_`6yjc_) zw5#h+t^7mT(E>~Okyrvg>dW&2^*SM`mpof0<3|1a4m)A3jleCac zxTe-TeO9gTu$EioLLY_yxkZzq>_}GoH0;N3ii75Lo!00HTwiS&xfQ2dMs9BDu(Dr@ z<+S+((mdYpn#h~yztv{C;vEYw*>CMi8`+zdbTTdRy|e@*-$zyen49Lvf5pO4uh>5F>L{df zSs>o=qSd}+n=jrTi=7_iAs*0%;r{VYs3O_%xgLzZzM$DJm!;&D<@Is^*06O zDr}|Gq$3K#T zdWBnwX_#T3-Ojn##%;f1ZjHg5`t+`xBl~u|gx7w(aCqKz4r|K`7Fc60gPZIoyUuP$ zf{_L+;+cx$Q4COvPC{$E+N=jHyMubs>dOzSn)i+@oUFCjtV= ztrlH2-$;F(Wvscl{_;j?Ykf}dBF#Vkkt^H%#gDK8Bv_1E{l=+}_|Ry66w2U zR6`X=`UBOXW_ApqQQ;;cc4Qruu|*mC9c8g-U_msnBUY?_b2EOmBIB3ge!YnWTkg%) zrGs@T=t}XrMq`U-yQb~%p@#HzbGL&xk&r&sx>gkNPOIJ*U{l6ir^zXlk4qAF$vcq$4W2EcqnlP|hDkOVPetoZ1Rx#b5HgmJ;Z&Nn4}iE#8Uy3p*EjCqA+rBh22O zGifRRnrF>Ft@%CZO4Hdy-9{4~%#UcRr7JC^EIFkM-HL1cmZx(=iy0{c+&D#Egrz0= zl>z3}cyvag1;@ZZiwh4?L3$=_j5jTXb&?${TAzw9M+F$E;TtoKTP)rwNkx_tZu`Rc z3@x=_i-TpX5?+=ZqjE~mCx6=5Epyj~qLIF8IbP$G=1}+T%0^$0B)5&U_U#=AB-;Oo zhw%CeEcPRG^DSQYrH*bbup*_seFYw@iT<8$W5{x4TlD9MIfxlN7SIUx&<@@uJZ@`A z)BAX9{?7)YXIXktL{c+QvS09tB=fq_YLqNOKruzXF%Yo&V;wiy3M;=b-D6N)@p3#A z^XdSaR%eoZDasc~y*m>A9P<)PYagW=y-Bk_<9DUJ^kQ#O>Y*`~O}?$I-l8#H%Z9CY zd5gwQ@p+3bLQO!Yh4I0gmg-L%LxpkPw6PdFP|vpoxUU>^jm0xh`d3%D7{Aiea^*Ls zxcXcJ2xW`I5ngV%&%|C+4>_1NHt2Ehwa8OXdbNg`?AE@9f5gSF{#f&8X(%@)=x_$> z#1tu5YhTNN{q~2j`!{BX4~x!}eZc}P^GLkUy5|9F^Z|{ls4;u6B^Y=5NW!qaZS#Mh zvZLiOt+kmQ|CJr+OWhaj%~4|$SII%Fl4VsrtfSJI)f^bnzT9uKVYThG;j0Xz@G~?% ze1(Vm+1pk*SzJ>03)UZvM0sHxUVek`U|7s0gS<2aO8OKb`Y`&f@RXvq0^yBlE{tB(T ztMr$4?nA?_VCjCx&6Zxs(#Aj+67(1Tv=rPvE`3CA0dwsshsH!6k7Y;p%t=(c<5KNf zckB-qjq#(=7NvDrHXM1T3zhHbuA*^WMHh9YjqNIOb;Vima3*paE62jEm^;|Yl2`b6 zW6yn6YQ>iJeDpB(kK3{?M;Gk14KGW+)Sluo(y0bu8LME|O>y=qL(-%gSK;>`<6XbO zKG=StN-`6I9>?g72K%>`+s}m!kES}%_lI+-8{3kdzFhyVh_*oT8CRO#qzC=8oqq6* z*EJ<2;4hluPaC-=9*+}X$hMvKCE$A^ zE&Xh5Mt`Aq0;os7HMhY~*Wl6$Cq`5p^Bus**LUeTea{>n$Mk7v;Y2NZI(JHp zFryP$Lk+u(uWX=+wtS>NHE7g*7>snaaBxfIUW5t|5>r@8sOJ#SJd;|b##EI&Pr4`gwKHOiB+mQc$TtTztJIoC|bh5HQI zmVtpDgMAnqh3^)3mvIg2w;cv!{dK>vhA>YVj0n{pp*LOKDoJ1t=r?#AiP%D;`1-cw z%hcStk6Z4pN#m@2nb_1Ghr3$jS^BOYiYylIAy!J(<8 zsl9z{vUilUC4aBb_TQlb73*O)?v&{_b+0hh$!5t@b^SZ#roNC#)iw;?){y(1 zG$rib!;lzQhq#|MW$Im&v)Sl3#^o7CUXL{WWMPzvhnqNF81-X4zT9Pv^;sR=Ha@P@ zug|R!@Evi{7ip$vtCq8!s%NW=?V?5uvO)BN>_PSY5{H%aeH5&>}!ZPfcZi=7w%ru?PF|pP{ z3_+OPIVvvXheO$TlwHhLb{!s5aTL{b`?aq3L;$v5v~HOtH9zyZgUGcFbeb3QRP@k+`s|&k9Z(;-`-&P zxM2B35blqn@CYSigXO8^$(Bt&xuMltJ_flzB;K*7Wv>?-sJz>8BmKRF#m^Bu!omUD zJ|E)a!_*-E(o4NXV=>6LA-Fq_Y{lFXg$Ms$S0*R0xaA*@XW{0*;dhO;&$B;me;ZZs zP7H@LA-J=B(^mU@`|5XWCyQqIi&EZt<7Cn7lSP+4jaez5UwcW-M2jvu0vFTK)P0<~ zvTmsGosI&{<#M3|k~>Ve2W0x;h&bUSasMTC;S+IH7*orVhnv|j%K!PipA;*lg->qg8tUzT)`?l!M(J-X%$}zv(k`2o^?$h@cZ~2z%d?x%!Lyq=FFR#n_QA3Vr zzk3ZvTK*_$``DDmIJur==oxXt{aj=RME~dF-YfDu#k~V=k+6D}9L>Y=0`Ac1JB3F3 z^r+Sqx}TQL5*aco7xYhhg!hrae1ZOLlRsE5J}erH#@ z({T&#EW4T}6gyU`d%h9JS;7$E0eo+{3mO$3misXMW=^`x;Y;zRJ16_{*O}J^eFw2+ z*V>H8Ti4sIsT*3Cr&i#rKD#1Y(V+(xY^vS z9*w>!uJA9T&|~2SSK;-R!1A_0y!l!wuLW}20&{(f18HpmYfFU|NWhL`^m_CpSOPir z#&Ak7K?~wOW*qMBS+SZmjk$dnYk~B#xg#)n$e4NmVXbpc%8|o!+9q40%QeJ?NemVq z>EpcRPT#1&j5c>H?)r+2?5S*=RZQXRB8%&HBe!AoeWRi$N~DD^MPgCi-HZi={Yv&V zFLk9)-t)kmpe^3<*T`UcPT>u>^Ek{gIkNCeF8%n_1NTuP>{+d$qP{7vd}LnXNJk64 z1Z_-qSqs!d{i@TPlsq9nOEa}wxoA)6?cnzbRmK*+G@Qkp@=^XzxOY)L6)6i1T2jk~ zw7+PzGslgWQqFo+KY>mH;Ze3WBs*o?Pv^c4XUmu;1{Q^aW}Yci)6@Vl{}`&a%-dH zTSi~bV#E#Ef=hkPNcWI@f&r=ht)mcsi+Y;UXm`!b5t;uF?UUpwcw>BL)AyVD2A-q; z!;|j#jS(Bx@_cBoJ2CZ{7pAP~c1@apLsx9P{%w)*F0Rb}O0PR_?a`VoYk7Eo`GSmG0efa*I$~#2*(m4(Tti zHp_5rW!U+ou=Ck+K1$r-;@&8(S}TMK8NW!Q+C~)1$k7&$ZmfWJB~;BDIwc8vR*zq$ zz*Ay_s>V}ds*dD;9-5_3i`#TIy>rsyuKB9YWAU7kkTG;UfTv$!0Os(Ri4M-;RoH5l z7M+Y|WAXT$qmw&{$~HWSa**FJG|D~SuHoyj<#Sx+S&m+`Vm!K}e|Hen zvD;}6OMd8NS+{3!vK*tEq_;WlWDZW2#Sqk2N6;GVU5VK}*2ernh#=fx?<`#q?9Ik$ z*Uq)fHAbkd3Rjl?U?yo z%4L}*2i+M&nP>s2^&`;J7>BUDfbRhaqh6Lz?yS#t?yx- zQ@{8@GdS2?zZ~07Y1ppz_RRIn>At!$$3ENcZk>Va`goauJ|VY*I}Dr7wpuX$&FD{i zBjMACbJ4yW_|HCwF%fm%x7_P~1c3xRZQUuu%F3c&bK~(MbGdVQgK4X&KB4bq5XKx1 zX~u1qC*tis$6MCNJ9{#p%~^aTW82f2^X9$Oi-$(-7x52x-TY zJ&WhzOBY8Yu}AJ$Iq*_fFMeTVeD#$!E?Yad^Ykmub1{yx zZ+frN?86ox>Brao9A8@SdkjZ@w(Vy*JN)==f<2XY_ut<6>ONR>+rbB#K6w>9%;IR}3{a?_b$$G}nB@z|5Yv^@`9lJfMhR|=)k4Kg31#n^w?SJ6x|FO)>{9k@GTfZxMGu!l;vT`f9>=7#rmLpGF**uYMwY zO5FFweM8(r@q;-eHsLVIelyzZb~rXfWA)NHBNrQut}9wS8S8!PXS%a}>+9U(?YSPK zPeHxvTz`}+a@L}`+vn!YwPdY75xQ3s!E0wdt;><~3;J)%$}rt8#!nkWX?Q|1)Okw3 zBX#QfG;d^tKax)~HdQ*k*k0_#_Eq8xy=osmRgB%qb)EUPhS@Xtc68ZSLFPn z-pk4l-Qj)V+1Bkt?w{bU(X< zWxn_`ky`8ajOL64AHvepg#^d+d!U`QJ`GJ?HBZ$yvQZ)mRmn28XIRcWw?MypqwiZp ztXhr)?~j?h`HXGBSNCs7Ydeza+}h*qKi^JtmiZqIOpE+-`x1Ffc8h+apAdW zw%CZEdlU)^H{N0@JnuvoOIanx zeqoL-#S$HlERB?W#9qL0j$+71wJ)G{6B6Y%kIdPSL6K;MzMab|dc1w_dl#j6`#$t8 zO7caKby-+lfro>srHe!8JkRasQ$soOX`^m~PP z;WK_WxpG};owK3FIkCjKu3pnmOE=V3)|HlMmtF2O|FU#(MQQOZYwAjiYwAig-EkH* zmX(#(sUJbC_0-ju%H=f`rJfSV&E88&i|aPlHmrdcZNX*V9Wr7qtyZcG9j`ZbHq?2l z>&t5D);aOB$hTIOl$Ow9QBvU*c}kpO5q?FwvAChJuJpT=OA%J7;eVd9rm>;6vB6pE z*;rNMDbZG_1Um5>*$t)D4bF+THzKwgXO*X}ymYE_oo7Sky2f=BYYUg;X}Kx`2IE4| zM#wNzY{Jhg>;7@6rm?(2!^>k3B^1_qibI*Su4GLG&ev?%ut8f==xnUVb$2DKsH^r= zWekc`cC4#xfd355Q&LjdP+0>FXNjl5qx+%}Ig4`gw4$)2;)g1$N~@ih(fp~-%Ie~( z#*#|B>n77#v=Kj%?yM<8HXy|6@{m=+B0*>{+$>W@}mQPWse;;b&k zPmE&=ptiQOT5GIlf{hy1P=V}VAzYoaFdfBF+TfYSeAEgca29*2iW{pu%wK1jr?Lud z0yWq0%i4*`D)m}b*8i~{nj3)>hMQ^3a4vA7*;Q2*S2nDvymbvri5D`Qnn{gX$Y|3= zsVCaXoW-i>zqQzmNLg%Qp`kjvot3vDL=_wBcky8GQ=BtkncF!<+2%xK8QMC$Bgs=< z>QuP~lkvhMqaMo@1mP^HL2Y8SU*~Bkt_WEbs^3G*m^e{4K~kJ{nKLuwqqspe3g){x zqml1rr3e{y7!66wMf-15W}ya~J013MMU^#fp{v4gx-b-QQ@2(PM<{VqD?X_xEQ+{VQW)f+=ggN-G4S^O=fP6kMcIf-}! zRcUp}w}{XQS5?&@LX~b!4<1QG=U9y*n^+<(s|cN6O?A~q)v#_WMb?NHeF!M4YOJr2 zPLjniYIb@_w8CkZ5&i`bC-nf+|P;Uqyha|x;(=%w^ml?DPIS>Sd#{e#>ffx#75`k&WVi~regb+(eSpq$_8V!3?B}|jYgW3`uVXL zgH>pNn&+&qyuDQK-pxZ*9^Q$4zW2d_?YsOn)}on|u2DmOed9Vc(2IGhJ1tR?@WgzV zwV{OQqk-~kj4A9*QE@mD>sRNYVU+WI8yv1MS{d(SyUcmx#Kw6O8*f5qWg5H*mVdtK~JS?Mp9JT+_&*)p?s5B5tem)GBkz(P7k;uJfSKtIOBOoL~)_Ji80_ z1=_U@l~q-+NLr8QRtyZDqN-AKMb6^Jx;jQ2Qa0C6)o|A6X=IV>xg=R}enn!LVgRd? zuH`%hl|SsOWi&TsRYiSBjv9X}>U)W)@TE2);?l}nQLoDy)pY5+2sj(4XXjB}T(Y`!xs11!cp4h(k%^e-Vail`Yh_JiJ$hjk zsRYAnVm87k%!LcDHF9LC6J>1-OnOldxhnHmXk^aZFqqK`VMuxDLN&R&7K1o*z8+KS z!FmGAq=HDHVA_uwaGu9$uy9=|YlpU^yqY8Hc`9fb%=Z}=UxI1%x?1FRQ6*lvvJnGu zNolBtda6q6Fk#RO+LWwv6bnY_u*=Ngc}7>DRn|K_n4&dc8azbL=|&%cp)Nz$D6XnO zW}}=d%MiI9lYRxu47A)*#8s(R1{KU;el?=pWv-J`%Xym8%HvcKy_y;*hD5BHL{*r7 zR$YdsBQXM5uqF+|lu!p*tcu5}PrjY?h~ zHKTHKE_=SZkp>Kvm6(6A&8lAZHq$DN<~q3ssjMzi&63@rrW&LgTg`ng^5Huz<5E>$ zbYkMpMaevr5m%p1%xo}w@f6>pqQR=L7-b0s)k?#>sL7u0uigoxVe|R@^tVK%{DrdE zNcVX`=plbw#26rrdZJG@#dy@!qEcp@*p0sCTcSrLRkQGijogLcS zgzQ%OJVW19Q6K7_YHR8-u{P$F+F&qT>V&3$Q?aONP}BH|8n$fC7@fscm7J7SvaK@} z)iu@A^p;0r3*+KjZ$7L;=VgOY*`;q|%2a(0)!>i>aSgWDAq{|S2d{BLhhZcsRjcLSJSV$w z&f!9RDCVXNM6KS8AY@)*mi=GM0W&vD+z>tmWOvLt+K|)_%`XmznA{n0B4a%zu(tsv zT{4)*7i*F%HKXycEh0}<=QVFI5lj*E^jQ?DjJ6Q(Rl^usXN1l^5c68>kg;#7E3K{a zY(zAA*hbCarV}@@pjBEDs?8k3)qJEBGd$P}146x))TAZVeA_UapyAtT8u_(+eOhN! zMfQB(Hl3S@-bf<9SSxF+s@kZbL*^n0bPX59p>D$H10i7-2Ez=W&S_4yca|$5eTyIL zWEEFkjGmj-Gvm8LM)hW@k#A~68nQ&iq;g1&oMK>N)g?8zu`y0#HP(~OlK9^Qqwgiqv&kbWqF7=S7-!$ImXiUq zbVG3|`w~_KOrx+LHH{kr&Z`z_Ed3@(3kT1GFmqpTZPVP)10c)E{*&DJzfts zE7#Sk1=%|8W7OAru%^IZQdU>0hC;*2uuQ;@bgU@#)YoHriJ38SM6Er(Er--DnyTYP zl@04WwHg1fVF^=fHAgYR<{c6t^ zb;VeG7`scxLT*TCMp`GvTATMwk%X(UaaM-3417K#m@6JjUJ!tnDct$A#t)c4EAp3 zIz#dQ$6cI}(JBFY+@bzDlo=Xk!}XQi!qJOgc~ZrXHi{h$cDQOkm^%Y#eW+PAw^TwK zV=?z#e;SQO}w_1*4ojauB>C2N6zC9JuRbYo!4^FKZ)fmEU+d|A4$~LZ$ zy<3S8D+d)MrybaiR%5?f-(zE6Ni^L8U40(r4ZM-S-HZoQ zx0({?LN(_vpkbO52WNX+(5f6I7=0NwcDPZlqEwk-n1Xqc*rIkvHJme}WCx15Z0ytx zO@i)!h*!ys|BY{zTSI4=szi;rSaprNBdGI(iyBi~=UqM{r??xbcZJ5y2)Eo~!xjU! zSV|-=**6@j`)yNZ=qnqYx0lw{Op~79==1e04g@-w)SAXR_G?&{;6569aE_{>oeb2& zP)*LOxz>qM7qt^nVCZ1QGQ$0qtxt9_#%0|KBh7}gKFL7mjq)ksLVR%H88VNn%4z3! z=GTQi0>lE(T%ASa^AFLVGUB9b~8|X-g>L#!`s&652 z!ewm04{8tIC1ESTEo5~ps>k*p@}~^_4|e53>!+ES7tgqOhSOcq&`?`HZ~F9dOyL`g zE=Fncj=%0@dR5h}>!x8Rfop+_q2c6%0lLpMGc#vinwd3oZiXJukpEfo96p7S_!^`6 zVuTi9KE)Z|!Z>(DX!r@3X#IQ+UXo~4Z$va-H$7Aaam0DoM`%}y%7qsCA3Nw->Eor5 zrXxb*n>+`Pi1YNvsrOD&qY59ZHgQlH6rqg|I}g8}9(H|7*m-8y`7G_%QM%|BI96?* z_Gg=Z{sVP>xqc%5@w`sh`Mj`mzDaZNh|t3QXAfQkMQC|p=LOpR^6Z`)SFGA&+WROM z9*gm@s$5a0>R*I<Vz{PpEsk@~p{@mjTG+E?>OWcD*C) ze0SLSzOZxV(%=!H{c`XG6rmjmJ3kn9-W_&+B<%c|u=DWz{!Q5RV`1mdhMhmBJtF1D z3#{trr2S0;Cu&hzp7cjk)p@LTt>iCGmHtYp561a?x!wqWiP}i*mN5N?qXTkL@b|Mr)hH@^3LHYfaxxR`~@vkLOhSzOOBk{7Z%`QM+CnEAh`#=c~0V=n2R3D!ps9Z=`OyHjhI^lw(@_h=V~ zmFMrm>T|Bde^8a@{hA}JJ$)wSf#6j8I3)FPva;`CjL`Z~4ku9yYOzwjlrk%x4m)2i z=a(q`Uugd!?R%m+@6`Bi1RnI8sO{BChLqp0@BqEKtlkfvs6C-gl5<`EDeY@HH^QK6 zVP(g`q9${!Vln{1b!eJj^ z4u?g+xVFP(x-8$rKOC&n7Re8`N9sHR*GXQ6e>f)KV_B|HbCaQS2<}w!3SFKl^54N_ zbxNXdCFp=#9rHyRYWGCDb;Uu`sJIZNSy)Yb& zGX%Z?q=aExc3MzfV)e00^BZPIGCyE;V=)L7IwnrVU(lFbL5X7Z9wJuQvEvZ zv#^rjV7SzO9XcvMr7Vm*{2S!7i8||1Ve*830cLQP@8cg121lLeAYUy!30xw)7vWS1 zUk+{%{wLZW+eVVKTiQUbg*!!ia1z{3 z;bge|!YtD_h2dy#3$KOyXJMx4Jz+cCzY4R?6j}z;a=ow<^3}o1q3;yF z63l$G&=U^kBXvBGPbHh{Ff#`S(_>*J!ol=dZcwPvKBM1Y8W_%RU?kIE^f}B&%C|z! zyd$@PnRgZr{5Tj5<+~wg8IWHEuO(9vM+rU_Uc^y>4|URDa~1g}O7(hg;oyg(0Urx1 zIF1eYSk{v8J_&p*9)(&H8R2|}xHglEbh%IDOCY~X_%+0}O?WiQ=U(At=mdnF;0MXY z_=lqdABLX+`D4NsbgGXF{~KXGDZB?92R7bQ7B391`dDMr``cM29geTmXBfG{sc;dc zlH1`ji>br#ZV^s``x{|6+VjFpw`#x8=b_pxn0fFaK89_d3Ma#Luq}vwsxZ@+E}RX{ z6J876AUpxQO&F-%FT4%hE<6?dr0~7q*M*tiQ&0wsm-&6UFi^`A?f@?qE&wkV-VMH0 zxD))4iGM8&v6?e7e3siEP4ahzosbVhnNf#n;hLE222T{G{d0vg!QT@GYPSfpJU0ku zf$tVx0REY9Huzy-ptf5$56pVQcniQUnsiPGFNORs!pp$l2(JVWi`4xBwFKc+;0eOC z;ZhS{W71zKyc#-dgx7-E&S_5x_z_{C_H*G1aHlYB{=G@(FTz!j;|G>iIJMxl!VO@b z@CNWv;R)bRgg1c)gn?QV#xdH{1hxq?-gM#3;CaH#la<0uI}f&B9xzSu-{2y+(EQL& zmcBP$be6K7lBF+olGoxN4%%w;X>KyYzYqGXD@LEpx?*8L;FyKa|J3(pQwQO^jd1eF zENC1|C*{9`ob`arw#Cb2jth*2{3_}-%hKp$*NU8dY>6<(jtXIp7c3|GT@S7m{yD;7 zIZ@8>ljTH?fShGRX8+kF%)QLbWJZF+hYxk?Aiql(U*-+;l7P1}ge+a`-X`wtG zyhY@UlWTj*li@xfd@tOe3&YVK6=wRL5PlHuE5fO8KNEJsbt26Sa{_pVFi@K#>;_*Y zOuuTr1brv?fJy(DiT`fm5y*FjKNb4pg)_lRglB;Zg|omF!VAE)!a%*hML5~u|1iln z3$s4HF3h+-G3lHUZh)No7PMyrI7@gF_-f%M@O{FY!JWcD?U%x=Uk8Nqz<)LAL`CZ1 zQ(yIsi0dx!6q9_0@KVU<3NvrBO*;9)Y!gi;d5iEW$R8434Sw9Db5M9KhqW+JBoEsQLuDyvF_^9yZ#@EC?J)_)vZq zhf;R$ee3A^EbEj$&jnnQ{`+*6|8Cdj7=F9k0U25Py& zcY&`I_JMCO>8usbhP+-l54^>sbGI<<>@dlHAzT3YFNGI?pEBt@Elk^95N7_oX43hi z@G{8XH_87h%zE^>@M^G)eIU}#yj6WNm~}+0B_)5B4ZZ!>!91 zhH4AY;jtDU>N5-;MqDaav7K0MR;r;j_y{yo)lLyVk2rjiz>JI8O=fuX zOJ;aXGnukU!n8d@nDvTBxIG)f?4cj(1R!UaS=~Dd?m^NnOL%&Ry>Z8E4cb>?d za32?@y+?%MXh((JaC?NO!aXhwM|)K`8}9FgnWndd3*i2jFdXdz;RSF%7G{`V3&Y{7 zoRrP9-O4r#o0(^JVYV+GmUX&|Y}Aslw`UyTWtV|U!u&Gotx-jLd&HR^nrf zYpco7`4enJ0hw1~E>2u-3-zj8rXtVK~h0}%O;m#C>n!axd$Obov z9FD#x40$S8&BMV?un!-G$-MceF!RI1a)F#jiLe`7E=*f)7pA`28x;NDhB4KlJS^3^8%eI$*+#xv zXH+3AiG_>9jSrc+%y%+%d04WQqpn%l5OFBK@<!302bKZjItBd_;g`S_WSI}JjH%;8 zyqm}}{%#ie4#@8keiR%K&IWf1CxcZRcR_$dwQ(@>I~kuOFjVxu6wLfsC2}}=9}YQ+ zSlLN^C-`Q3$Q^K5UC2Cc#fQ8b?nYtS(jp8;YZZPB?yrR>!0i{_2KR(89PKsXd*Qw= z%(SX|5QytRu$qsF4IhgR>&qv?NpL?GX1X=@70`DBUBXkr>i&X+^PtExA%8@87Fdn@ z&|#Sz7dcSlvmFex3H*EE&EU68I;!u2&H~6!i98$pFX24!SHcD0bHYo(!>oGvtWz1n zE5Y9v25PH>tH3u3mw?xqbktnJrLSGoTmnp;ABs)|_$MZPpKvYYcM3Ov?-AYr-Y%R4 z4hjP`?)frLR)IT(SA)AuI!_7vAXoh=^zQ=murP2Oarh*SSE$cDCg{xnY$H5u_>iqo zwv(A@IFj(8dffI4Xi zpJ^k{gAVhNd)zc2+nU?nKr@#LINg6b5RS3NHg^2{S*gHR-5% z0{mt}uI35gJg}N?gA2fFUJd4Phxp9`Hwm*Ge8O(<&rIQ~`-AYC3b|^(U?+H|=rE5T zH|akiJQebT!Yu#8!YqFtmaBA^`EJ}dSN$go3Wu5lgL$0?%bEwvhRpGTWn1!aXg2Q@od!_Wa!Mq-0NN8YryZ5We)I($e%*^ zp9}v0VSa5e^f@+JmcYefBO}a>(1{m*1e_||3!Wf+8Rk`P@^am8rpT{@e1UK|n9pu9 z%pZZ53GW535`G@c^)Gea1Xl?!KqtnzI_2L$zKQ%FdR%OqmLKVSFL{&B4~qUl)SunL zXTgsNyHSq3kIyh426vOM)BW~{{LxX!XR=$DzbbP6-u@fH-@}CPZE~Kj^S;Qxg8Z~_ zGs5{=_&8X@xMRuJ^&`oPb+(aVk3AV5;o)FD(?|K2@S7^^fZQ#7E$rc*Ds?UgFA%;T z>CF>fi#%LPZqnmgDe@0dj$HfGuNV5HCXPk_tzWrTl7m_>X<7(wZKcL4S)?}(gr?L*l0=;cM87-oqL4Y zcKN&-{j%*oZqk23_!Gzv3bP&e2)~ao-x8+HnUQ)pjO!BN)!^B}YrzXmI_f?w;w^!k z&vMZQ)`uUNbiBeo$bTYy7x+GtPCz&S`2)faf*%v^03Q?{wT{U z9y~HyXWEb~?1Vf;cmnt$Vb=4jgf~Hct#A|g2f_@;Bb<%;ULwr?yGnR9^luj~fc$_k z{XQwY7V<;F?8{#>>Hn9o8{wQ0rr$4wr$T;KI1~JD;U4Hj#pvms1v$T?z6k(QcmN5G&-ZL=#UM2htzngT<2rq^F3*lwpowmWab_<_{e2?(g;2z=4i1$5{{$GSwLgyplRp8GJ9h3z( zq-cL6c!n_h<~hO~^A`w1Tf0Iy9&&!qh<=m6OHDf86HbPFg)rv`YfL&t!mlAr?&mU` zH^7^O-v<9k_+7A9nDzES;rGG66lU6I#p&SywK>9P!CZeb{I9`zh7R&!neb`IxsIjI z=iox&9`MbEK6sr;zt*JRXwv_QN#7?NiMZ|*wt;_c(&-d_1@cFQUj;vJ(&-mo3;D~! zCE(u+vkiV?(*L_~1LXWJ6w|c|nwDsZN7EjY`h&+nwsZ!-K|F3ft4 zx0x%s6I>#EFZ|vr46(LRH~{%3;RnI|UY23c7U3+^ldZy>Gx|+B_X$sh{2`OPL-=vT zwM&?`Ju2)3KPAk0#8F}PSG~ee(ViFPzEQt0=bz}=8RVY` zuLS=~_;aLvlzlMmV}##@e5~;M;EBQ?fhU{vrwOxtWeT%>@v!_*cO%JH>I@adZv*1V zOLaN(h&o?G?iOA>T%TW3o(o!W$4y6WNP@ zIB=>Z%}}V_E==3+5N3UA5~jUB7G^rO3p?TdT$p}4g|py3D$H~|A)F2O@4`)R|1C_v z-w5ZywIJVV8`B*tOdY$h4b1O|QwK@ZMwxWR2rq?vtT6M;DNOs_!b#xy!VLd%;i=#p z;Y{!n;aOnz9Ukzs4HvFo!0K(Y-xmpW=SymfOe$~1F zawp_IlixdqCqRCWup1mS>HJ)HE##fTCE!PeX`9-ELiiQnBPPE`g{vU%5v~P4Yx4WD za0BE#EKSPMpCOs4GxNy8Kya|kjCR4e$q%9uvJAr8MHl2w%4_fs2h&D<-s@-C82cV9 z56VwKAJcFxi3>`){D2w%cwxprN!SiILzuQOOzP9$<-)B0Il`>}#llXwb;1m@QJ7`H zvSc{4m)!xGVQ&?t{@ucvaJLCF9XyQup&t1|q>Hv1`J?iUk>H?x)QP~NoAw!bLOUoQ z4>__+OOn9jgqbG@R>>I;!=w)5xmcL8D}>=_xx&n!MZ%1~K$!6t3d7OA&xJ6Z;MMpr zeA>k$JdIbt&hygPtm_(Syzx8ISP!|IVK(Xdh(?9)hdf*OO)%|byw8GFo?Hq64wWb1 zP@aH8c><ZQ{kps25sZB>9lzP98DE3B%FvAwq}c_ydvCc8{alW+PP4e{_=(CZ>cctq@EGJ3KQX5ae>#2 z@Kyd-L4bp{8qf8qvY4;LdRc7Mc`9`f&IAOKNnWPQSr?6a+*#yiUCw-_{u=1hHcN#r zUnz1I)`hEu{m|iM>K_6(2)};O;5_6UxQX&R@ehX&AL_ft4St6r7kn?}P56f+fRC}4 z{vde;rLt!Zzpo*#$8gSY9zys}3LgbOBRmf}&k3_Xc~v+L@+fc;6OAJgA2RcPq%g}U zS=bIYMHpW7J^}hkU{#J_>V98zSPpB1op9F+Pk_5kH~_a(nCa^krVY;vzXG>kn6{r3 zMs)gpXFwI0YaZG^3(R$ek(L_a4Uns6V4$-JtmX!yuf})qQpg=v-ER|EeU}Y#+H7=`2s5qfITnO-FIe5@l`z$JF2Eg-H;evm@ZF{`w+Xu;|C#Vq zaJ%pV@NSd-9%1I$ev?kONk=_1gLr$OqrO`Qehz$0bTYwzFzLT3ybAKSg;#?=5MB#b z&j}+O=9SvR1hZ__9wzuPuoZm-^Qr)xDop)x!X;q!eLd(@fZZnjOq2d4!r9Pazr!%| zz}Y7Kr6zs#{XXa{gU$+(uLRecbn1m4hx}IIC&6CfwcxELef51ngt-~=Z6f!9)pr9S zXCCe}>8tMsLf#Fz`fecj8Sp;Qp*|1e{tNSk?V5)jA96j~bv$_~rARkE7EY{iu&Yg) zr%=B~0A?6#MQ(#zEX?rAgc)A7FvH_v#7jTqx1pqLFvlx>Y^vz6KXHOr6a6Zh-!pwu4 zgyHCA0UbA3l?8YzxDp@w&4k-33`gBRrFFD>W|>5=U!?+$XyF2|TDL;ZvQq0-uoJA- zr=qXcr{J}aJH;={jb+1fp+e$ZDGDp-w9WZgQCy!pnL+{ z8--~j56gDlRcZI@Oq-0c9?d~ZVuU!l_hdKBa9^Eg~5fFx>eyK$ zGj8LV4I|%9K+gE6V@JYOzO94+M*%*R{{{uUjLd&HR^dbW`;e~{9*@dXAd6L(SJVyI*)^^MNV6OC=5sc4gz$#!ObG4 zjhlrTFR#%yn6Lld0+`3!_)s2z`)A^-yrOS{3hWEV6~q{k2p4q{4TKiZXM*? zzz>o597xKJbr)v%u;(N$4*Ct7jv@+2ChH2dMo< zn6~u_Gm7Vhmx5msrk!sHuLQp(yz2jO_wI2~UFZJrp8Eh>GoX%KG#SPVs9*$*0%{6K z5Y)60m8eNdX5<<{kV}MA-vc`dY-n;0PSQG%qzA?%qOGk`ThYY#08I!cvB%h+6O+dN zqNnG?rtLY#CdQ<(^M0ST_nO%ZX!8Dk?_clwFzmJ0de(P6>shyF-S&c=>AeW}AnZ)< zh5cdJ+4m@5FNS@xL6KWI>@!t+GwcHH4cb=IBrL2gsdO!@$7KTxwI5(*w|^Ajd$9Nt zvPy$ngGy>$l{Y8ThNlm>s-L$ms;X}gSPX#=#op{MdZ#Q!yY)2D@a8 z<#H{xGVFHh@yVHpit~w^Xz8+oB6oFlWl_n_K)HoG75b{0fD02FyXJ7rx5ib*$E8i_ z2h>ZGgoRwZJYGTzAqnP?mI&WwFD|+z%vg$vQIrcX>Glb9Up2Tkl|G(6R#MtXCnOIg zKq1668|-81)MnAw{Kp83DkHn#772CLG}I`KDcZ2W&EI3l*@xM2b0Em7t28v@y9+8; zh@9O*_qBxTZFO3@pol0Jl(gRJZqTuE`i5b~6$pxlUEWi~E?^0yotHpr2`8xW+NPD& z1eJ!^V3*>c{Z!qdQlQ_#y=7AEy%~Qt27q;dcCnZr)438j=r~Fggeq}>nd(43GJP> zHwPY1HI7HFchcPyHwV&Ean7}QMxnVot{|(&Ej(34bm0V=Gg85;svj-6S*Eg<=N55m z{TcgI+7yw6-cL9-0XL`PtP(}A0R@NS#Y2~70r>87#MS z;S;VfyhWnFL9lUAsS1aB$wm>~?Qx43CZg8LCBW^?@@;|(635D4i#7o<_tv&KXaH{( zoqBH}DZ#f$m6nP}z=H4>Rn^wOjFV%aOJJSEEh3wca2(uN)%+H4A%vV`l(SH7S$oT_ zibIdL9fJb8>?{QNRy2%9BEaym)`bi}Ys0ReR{A^ARBMYT!21T|NNsf3CCfK&BflodxG0pN#Q&=(ZW<(zDBRhLo8H)c zbx?#BZW9*P)z{X$+;}!sv1e^HT_(41TV4GUBwl#|4ek-5`L=Ipvatw(X}X|!9dpdI zFrgYui84b=lw`*=J2Nydsx?OSHY_FWY1Ln#K)9%l~KGCKjcT@eiMS1 z3AbeYxZ!xe4#8Wb!Gl)-Z#fd6O$W{0PQ>3*&}sSGsKKLkSI!@u3(?}y9BvYR+;IM; zgy1!5@MsN;<2`%ZSiC;?WpXf;j$Z!>bXxwN2VN)KNq)2!i{sUV;9Z8_oA`0V`P&|X zmxRTIDOGR7nmde7xtE`cvSq!kIKbuA$T)T znCKoEZa9D8A$ZR>EBhvhziIe!yg!DI*HW59libmbXxwBp1_>G%HMRAj`$l1 z!CL`Gx~GL3&fic7-sLB;=7owz{Lz{)=PxUyyqt{+uE7!}$6FCnUY=-I z3&A@NJlf;U4ac*E;B^9THi!t1)BFCe>-&(xib^t_`U%UqIdF6~BL|VMFz-xp% z;VrUPB08C-BjUUkwUPVYd z^kKZ>4lianUU5h}bp3}x`Q?C;<#2InIgu zK{}H_*qQi|$pjvn7?$2VJUM?mL-5uCZ#D%`4d<^i1aGqjkJ=fIHxiQG8sOPDm`X>l zLm}y{0p23GQ+}+&kK=WP;57s9+wkXx^Y?5BUXKQk=sDh{u(9$x3p|cNnB4wq2;FZ% zhoTiQobEX2$eyYCoJG7;jwl`L@gqNa|090da{nptj=+r@j`s&RXz@M(-dAuVybY=! z;hn@!i}&Iz>?PL2Q8gUz7kJm=o%cfT1RddRQvC>T1@tg2Uin-l9K4v}cy!)Yi`V&F zFunJKlKcqI7J^p^JSuJPZ#@%|6! z$eyWs^l9RK5Nw`bZ`MW9|$;BLkmk6chb&5bW z98VX5_u%s=FQ6m5hwn;h4m|2#xZ(WG z3c;JL!7Bza=kGIEw0KMAONeFVfDkLs2d?=0|Eb1;>T zUVk2fcV2@><%{E849Sn^`O5xG!XU%>qqFzlETZlw!>8^l|_Q7$(@!kz7 zr?ZnFH}K32r#lx?POl&xec+koyc0j3j$@`I1Ja#xZ-fz(0y&oc%b<34+8*)g_-@k#5?3t=Z`A?O7a>U;* z{5XI6L-1y-RQ%LnjE?L-3c)*eB-oxdY4EB;@EpLK!ogHJdVM4WZ%~8xJ(Uh5LS2ab zmH?0RQf_#9cZA6AZQxach|;?UKc3$F5WGs@p(q3l$IA)9OFJqEgP2ir7wH6i1Q z=uG8|Z77~Igl;qFzRQX5PhA$X0zqq|qQ;ru-ng17P2puYAa4PFZDTKT<*L?m%Am5yG?ZH)Z>?_mAt zQT?dApgA3bcNTbMaN~yaXN7|nZ!_>Hog_b>>PL8algHwv#@gqONbB5sM0Bh2fE?_9-Y_Kro#ceRQPkl)3GW9uTjGvy1D?KBLr_F@F3EF;dq~fl)qxo zO(d5;hm^lg#QQMNNG@nv1M!{>!Se!-@{1cD?^_{wSAaJNBElQMkLakpEQduamz=eV zAH101c=Sy_vS%vJ!jZvX`8x?W@*_M4ELyxg;2nfJH$+D!4i>U!(hJP1gF!qrT>-p@ z!^Yx$3cQUJKs6k%8ZOl_7W^ z458gn#~-i;@QR=;6MwwS&A$)lN$%iiiXZtGsC4KKnbFrM80ss-ApT zT}Yu_nk9%4!#zDMbOioGt1$Bli2m8{CtCQOGD-SQF{b&wL8-^z{IqRdd#5aQ6v)%; zdBSKS`h8LC_4|LBv*O-KXImrRNL#Y@C2=OOfK>RHzScb_JG&Fd!aW9Eb5~?@yTfD9 z3tf>ugQ5A5uCv<#mv)mFo*d4ir8tFu^7}I(8*acui{F3P1i(Gvh|0d&Bu^Jlw58v> z7ff0+JDc~4F`cr_K5CE?JiS6&`jTvSLaKYN+dXHk&*k@@vV3S33P0BQhSw?944oLU z6Oj53EkfZVf*8kaS{5kor7ePQNDwVaBBDn?tFTUPeq8EsOU}7IXM(uylo@Uhg%_3> z@CwKNAt6arobJ-g_O&nLi@S}9ZeWl+PMOaT#zWyr5tJMXn`~la^0R%Jdpm^5!++VT^w^qp&uA%{H9Ib9YdZ)#hM4p1dw!^o-i%clLS1q|vB$bDwMEf*&c${Q!w3Ilwe~ z)aO6q`2v2B1Gz7~D3Ba{ladnKexYw&B9J^rMadZHG1{nXbvdNd&bDd#kz}E3Z~A)a zwW#)%wNJF~6vM=6>*V%##Ju()u+x5&{<&6~x_X}u^S(o+*}cbj*m%l3IwT(@(S+;n zd&ZX5`?Tp^OX2AoeXiCRVe?+;b(`dh%4^AXMHaYh($Kp0Pmu15NcSi0DN?+xJzk2B zY>$-UqmcBMdD3@Yu-q^b=1BqaZR?(iB#f8@DSpcR-pSyjZ~ZAFlXxo*r~CcdGKg}& z)`wz>LW+`$|NUd?=sk7VxmH(KQR>)M>Dp1|Q1|aUQWq`6o*hSGd3}9NUB;bvmQ~c3 zH@N9o(48eb$epwoIT?q69x2&YzYr7-cqJ<#i&7V*-nA$#HGLilJ;c!bAvZ?h6JAo8 zlYthnHO3%7Y0(%1c9N`8-%Ih-vz-<}0t4I0p?!}GzQAS}Gjl@k(?k5@*nOMak=oOL zS6`@Kh!RX=+C%cEvz273@QV_{*qwmP0sqK9Q^((w_XPF563$W3;vWm~ekRsK=@be|44^!}*I?`7Ddu+!q2rc)vR->dJpGyj?RkA6UH z_pPwgw?N5IU#O!&2+UmkrmFGKToT#IpNtOcZ)8YEp}B1`^x)r-r(jc6VuB+(y~e6` zit}#OP8fx%U4;tpMqxNV6h^0Z6xp?;F=M7veB6D^}h|4L>memeRGL#2=I z%qBzLWT&u{cVs88J*u5}dt9{>Z^Npcp#D>}lfKRPw8H{JVRUK{oI!RXfMGIG`>%WO zJ{5Kf2bGiADPGdC$(=9;RXfEsqS}dvbE=)NFRFGm3W49b#rRQWg(;!HJ-dWO_uZ0z zaA#vhO*sz#;b_bD5`HX}?LMS^tMwJzw&V0jS;>x~pf5iuF%bcU4251I^w!NQwt1XWWB5j51?VngT{G9DA(?a9Kb2e%f6 zoQGLB=8y*uIsWK`yM&#&p(OGnoOQ07pQTXwVLM5`o^37JxZR~HRBd&=t3GsZIpe1_+2we*hv2;iKWZ1b;dn72c=rKs zHi!t1x=xPwCG1-M&f~ojKW;eQXK)~Urs`1-ycMt$9`%tNF9UWhUJhO;pSa<8cfmo6 zcSOS_9Jp)oWZ*pvBEr+|ef_r(yirufiR#DM5WLI4 z}oA^gM1je}_ZxC{m6`8X?Df9(KZ8qyqdm@QPJCJ;;xK58@v^ zxhdcgsSez)5*F=T2(^D?oXR7Bk%oA{V!&(!-k=%>uWzLPutvGEZsE3t)$T{`bU40l zE+lhkb3XwkW%vm`z({VG{x^f*YmxL_{0oNK43z? z&>s1rRoIfUMR%@ex7MAF8G)1-*Y<-HsdsjV4?)zCqSTwyAr<5atwupyK17g>7yW() z2{6%u;bnV#yH53Mf!|^M4Uj#Bf1dsKC{e;ebk8ap{K|$^LJ5a$QM^#uHBVKrqdB+QQ-=n8s7BDm1JFp&n zSxy-~Gzp^FU6$l7iU$Iq$%&o;r4TaFCkia zbC*TWyduqtwR?5_v*N^99zNDSUpG7}u76f6;*kvXc3DU^Lkd_1xzax?iDX0U0L=Y& zHn9`r8vNR$7{fFV;&Udc<9cT-jq7`vTmy4&6fCr?fd_I1&U(y&%+ejEwC)MVl-#ZX z3p~wJkn?V5lKoK~rj|^?sc<;5NhU<5B*6Y3y13(k)VP!EkLciW%5a957Oky%{FB^C zt*m$^TLUR*=H&%t`PZB%tcH?^NJa?B zrZRCYR&1t_*c(Voh(G9>J6LcQ^5*}R_6l3p=VxWdPb-L@YJbvT-)NvXCSPRm=w_SG;5{rb0+kT*X$Vg>n;=uMzIwkxTZAi00AlD|2 zMB(+P45L}+*E2C{6NvOLki;+A(!-EFoia;aJeAQ2l85=lrrwIZTUzpWrn}~?7mYjp z{(|^uRPQXLrad0z2Ot z1Fq4X=UXoCMbEi*S6oinvu{llDe`%b`GN`ZKos*L59`z8PZ{!4&KTd*-LO1lrNVf= zxy&XSQ~Z803Jf9Qhnx30FvELUxNhi+9EcxHIj=)uGYM-K$K{mfTo@A#(k~gp#4Y=x zskSS{+2gdeZ&9hp-)ZygcXao`ALXB#9?irX_n$g}KX^~g60)-lnV3<{(q}e*CS~b> zCU5S?Ozk>W=m<)oE66h3$LQ{xh_3K`;zQnyj8vuoH9Ul774Sftx_@d$9|VFn18*69 zE?CV%fzu|g$%560TA%TfD6WUyglkeTVGJTj@k4`9INy*?jHd2)Wc2ay2waQ6Ta}Op zM3I7ZE7-DbtW*?^ARDX|^ghhW9|(NI8&!UKyd6H^`i7UF?_-us{O1{?h8x$;sqULO z9;er)pSM3_+x-f%7!xUJQR`A=Dz-U&02I#DbkEiyHA;iI#Xp@Q7 zA|NE;-A;JnD2CS3=;>D%b;vZsd1WgFY4I!I!WI|Iss)Et1M&+AUI9oK%)7mE9qg-7b~Q zl+e?bEtSgdlFF7yWhvAjYUNM%vs$G$)N`VDaLS#Vd;R_|18=NtuhRSGPPK2Pya20x z*8)~)uFc-avWQw%Y3|g*^8)q%4=a?u(y8*b!cpc#SL<`i5EVL6A)RKa^wjqeq#9pNRQ#)RQ58S2wj*ge`L`?0Qe6JVdNi6hy z(D9OD6_;e+Lwqao!i}~5&=iJ^N{+thzNpCG%vMU!pRscF;%e?pyv?;KbxSlAl-huX z3RX}$weK39Tdu`Zne@!H$!1@4m~Tt8&l*-5JKHxm%2#nhvRcK6<6h&_5xE#kL|>63 zrTj_Yg>fO93lg37O_tqPcmIcY`2|y)bHU=iF#8%|ZC6|BCviS;0r*Aq_LE=OAE$25 z({uKe<-WIiM#T%(xereJi{;#}ZTnu(w=NVuzI^?=f0^{gKmXt0ryeaz=v6m(u*>&~ckN3jSf%kulz$bD9L;GNmbimfTA((&rWo-8d*N@P%>twPhers1a4Ca2VE?C@dr z6Kj{0$i7Q1sGe`qIu?6Fq)nG<-FFxM94vf`v5;Bo{uXCC(3`O~KExGnsoCI%J;T%| za)I96cd;ilrDt>~D%r21Nr8K|J0;bHYjYwV+Xr=T7EC*ahzBZ1?n3w_Rjwvx+7T_buo0htn?+8Fb)@`XMez(C*R4 zLp+}g_FoBopW7c3un23lVg(o-MS@MT3Z>CT5X`(HPx0(G?(?Sh&4NrI$W!6N`7@(8{mRQo4qh|JTJ}n>_PM-{%OxGAKE`u=Y!!iZPx%T>GjdgVM1_zx$f~=YllF z+;*2qnqpZ!V4xNm;V@o+UZuB(`(=wKG09%>cTZxnJq-Wn+YjE55*OI>Zj5|N!rBe}w! zU&|!I()P3-vV#=UbtJv_1d?8pK+=Pn5CwWxM)=rGm5KjfAe+HppT=~#Bzq&&v1EHR z{?E4$AjSpu%_NPHx%A(@AxwJhUp+rNyKg|B>%>*$V(fZkzLBcCd%pdBL$-SX)k`R^ z_gc~MpkI)6_Un4Mb+ken`_g8Mv8QMt=)*v7jn3^(9?+dJgHp8QPG<3l^xx;4??P;k z==z<6ha7_osxplP7f9~;7(Ch!393UfMu&WO&eO;%fSOjwOQ{FHF|M$#PRm0fwI>>V ziCzfpkgh+m3v`GC&TtFZo#kC@T#EE5e&t^K$3k{FQLFm7I@!R=!qimv6v{jpynCF} z#Ay2$I&X~U^xwtqeHqhw{r;Y=o`J9ztcR^V5dxO~Ge*$ug&hv-cTQ=GGbV>qFX%)A z)1?cvQamBw?1^}N2CI?)(Q2Qs_r|KRL+(fY{v#~@aEd)$3~!4K!(`22>kHPl?ue(u z%ou5hzW~?2iiu+EfhgV6VVdFg*E291B$=6f7S3pN;N4_18OU9KAExNPg$cV%EOy^# zGQ$nLKCSolG(*Qh$#DMcG4X@8pF|IjUS09f8!P7^4b4yW$krZYea~QS651(!>l&eS zvwq}3p|nxox>0~--Fy3@^&?vaU$21F0j6~m4P~Fv=VoK!G!hQjfJ6Vij@G*sA2Zf{ z$NJ=EC_W?Up+4qpio6wjS{XjRLZE#$L$79WC5MK~T|^-e??{Ro>0Av7wnBRys68z3 zNIdg_8)wvfJNZm$3gNOfmO1YTIy0P+>CAb1(3z!nBnkr}FmO1+97&9TZ}Vi;(kjv& zc;*Pkpo#2Yw$;FVdj&IG7(Ma@C4%foJgzG+_HPmnnyFcb+lW^CMgIQ((4al6h}@#f zkC%EnJ8E5!r3DR+)bo5tHf9CQbRLuD_D18;nxW@AhZ)EL-Do6xv-gwUXQoL>GkV%U zUr1s?xo3zhJg5oL4UHG08GRNo4VZ``rM~ba?Eo{d))5L;aySr8q#B!);VW=b-AmPe z(4ju#sfEOg5)Zx1N_9K=d#ZaDIVtZf%WmFYu1EVj!F=8{HlMe0qWQd)O1opCSxnc{MVk*L_Yy?Q@S#Z3vp~^D3*52U?wC|J z=7Jf&+3pRg?gE8YzEqee$XD%of-^B@=9S${jtKj-9{pUoAYX<)keEmTm9#SV%jE7A z`Vx^1=;vap>A5a~gR^rTJ9 zIGz#CF;NZ?>A-pWay`ZPR_6z{cQc~N_d?J4NeQPWHNT=eGLVA!```MCv5aS-0An%sC!L?W;wD`b|^bn7i zVOx^uLhZra)@!r+hZn67VU?UQ&EBkTiK%MsFY^dq8HKU5lx*h=ZHTZH035j;X zZen;FvtPSkaz@(+bd8B-U_r?}ISEXI<+%5;v6Rwt7usLxjje5qXV>QFYuNtT8qDJ6 z2+MOQ=y`#y9UV5J3$Y51!7Z+1pZm0{Y;kcjBZGs&J1oR}eZMo-{x@OR8OO^91=%Gz zXMp)$(pYWH0}V&O|7xKpg#XnBmH*XjC+}+A+SPHbZHp}uT4a*#f=72PHeob@m+}-j ztD~*m-1Z9-;>m@+Z^hbyILV{mjrSGd`%W6D3uwxEuFKcs?`g7m^!0`FbdMe0{k@*I z2K$|H$5;G*LB~mXd*iOf$KH$gm^rx7l*6;3kVl+N2a?$f_*KwZE{1d+G zI8V1A&;EhX?@T&uWE0eKdRTVf6(yf#)f!%d}sa>Iyf=UG^4qVO=rz=1=s!d-V2? zZri#s9+mp%x2^txzV)mi8BtTvU_08U@BX6m*+pB^l^O)~TB$*;Z=eRX{aoMrI%xGC zqq@z$JwY-W+L!s>u&q6YN`tW-3i=z1`d^!^R2t*`9%G@;xT)W`Q51*EVu#D3(eR>Y zJaWi^Su~`THw!X0TW_Jw*4W5z+}c_0$bRhsd#gkG)yriA z`jHofm7=obs*ELR$u$wOftZxlRjhQ-3V+Rpl$4ZSwrY`4%v|6L6jaOO4cDX8V#D;Hd>|C4Q^wYd-d)WRwS;q zN|1i_IV`!`h0~Gm#rxja^W$SFf^Z_`jQQTlSYn~$5l`5}$ylXIhAQ(w&gyCU)_?N1 z7U7l}Ipq;==aYl~m8c(iKv+=m@RNhSFrhz8*Zf>0sUZhR>gVInuCcA|)8}pwF#W%B za&SoOE5j&!3ib;qg?>#b!k>@-i{ZcW^yWN4G7BCv%k?gY4F_z%9?QZ`XtBcv@K%%1R4sbqTB6L|8^S z1=vzTTu06sGsu3KmkA_f3<|cO7CSw%3i*T_$A778#@Z*^ro|$!rPaa%u-+yaO;TC% z_9yO-)(_!xTcTQ~#?(n(>F}JY?s3*Qjj^K6_o70k8fCrxvVo})203cRiG9&2;GXr@ zg^%djwvW>2De#x9lS-qRPC$Km;USu60hxuLxnSA}W_y5|8zuD7%q!?_go_J?{CAW67Fmob8=CDV*!DSp2kwK`fvqz3F_uv=)tZ;uJo zxLS`106u26!-W>##>#|GK|L438)aI*#*MxmMTT@7CRuEwW(#Eun+sr1c;R%jSMLi8 z6QfIGWBZ(?8Phyr*0vav$M-gb>+y~HoVM=n_ON!RXxb8(lLyzkbWrHP9m8dKH%J+v zPB$1Ii)@dHGp*?t{-EKN`21tYJL_xWA>9LJ*}|lY)kM2I9VIVuvzUhFEg{{WM`a*) zsvswnMpI>CnkUwkB!h-GEKDlFXg!}(xK-{0<;}uZo-p1D(ka^Mo)F%i(7em4o$(vU zaJF87xXi+ga;a>Ym?xE`NeN4_281bVMF%<)0cp{0nNT?fIMI{`LgJb-N$ci@)*HbK zR<`YyNgm5&7p{o4*xS(qO$P?*Czj93rhBZnF}G;Nt)ML0bKt9PS+-*Q*4>8n6Odwo z@4$LgPRt!(f$spGzBe>$dj}wIq`;T355&F%FGw+e(4Wvngb7~e_`JPa$fFt6!^Xmm zSXDj3Tz>)iA|&M()pDu#Y)2c$IE6C8)hT}2?^^qeN(6m0xp9=`tvV&a5|1?cP{}fA z)K6?U)$L0(^S}nJpmIiP*=;7YtPDAdufzyJB!f_y0=`R z^981x9H!Hforoyc0OgBDGr4RukgMyvw6;`?1MV5~dszT2?EY`r)lqsrYtJO<%sQZT z#kVa%$27&$dwci5I`Obsj)(BvBbgA26!t;K0Z-V4?rzWNZ+B(wTXHv|B-)dPd#%p>hJ}4D`7c#^oZYo${oI%)~48!O1vT zyQSqQ1`kiIN5e^*C9zKg){$%eEjxFQLQ$V9|LZ)LWQgz>!ut(j!v<^L=LbK+cG%Ak zzI*VE=C^giE0Ke*u%Xa%j^_6q(rcf-oA$z6t61N4V*MH8%1Malp>X?4Lf=Oyq<9(m zUw$cJs#G?`S%&{nQdy+@5ufd|$6k}d!{%;|n4721{Wt$bL4a;?(eKa5ky|q5!E5LB zBmau-VT%0Gxy0mwM6U%p$f)b|(XQU6y-o4n-mXaR(JtNa=psbLHV5O}vFQ`(wM=hI zTbF)h5HU{~Hf9dzeNgaPmbc};uEBjP^yXJEx%d0-zAQ`&n?A%gl>}CWe}Fx{!+96t zwlKOkPUy`?LHGCWK1S4^Fhz>E(D9_VrMYYHTE2edpxS)V>=k+7s13OcF zt6%k<{?oM%y}1#u(}t~f;ITAJM-1nz(ajfhgJ&GfWyU#c+$C$wRcoxTETj2nksls% z2xwW})}f&Rfv;@2=k$MEo2Sn$@q4Vd`>ZoD$%Ho9bAO{}^p3ukeck$z@51K}Y1Gl4 z(v@YeFv^zf#D&-^+Gn(f8`f@2K`}81a#maSq`s6>#?dT!CyEVJ@U=PWbo$3PFu5ze z{*{dVR(DGYcia2UAwOhS`|243?bDI>taQukrTg>bEN@CjJ}t1Ou|AWEy)VHA8d#iV zwuj7eOWRa^Ylc5}1*?}v^^7Fd%L(_js1^1el@9uaypf}W0+%%&pBl$l%o!|F%Y{~P!yfE6zpe7)9i`1!P)1e zO-=OQDD+*0u<(yur!m)Q z&`4A&wzL1!JUNrF%OYOdSUSTh6{jNIQgMp3|FTrPs4L5}FIYH3?~A9M>?mMQ8y7g^Hr@Zj zKg5-KBRhZC>4^~v-}?&VRMDy|qBTRGM)`@S87Zw@TMFP$YmmO3s1Mk*ixo(=N!B?Z zMZg6plRcKUUa-cFbpGv^;h7JeyK^x&Y+aB2qX04e$_=3io1L-=^ zDyAzdAn?c9LzI~Dg8qQlnBc`GA~7r>`ud0SXtxy`UqwjDijr8dFU>&f32|8PB3y}F zu);v`IT0Ue1q{!VXxn|&jzb{xrWZB|velC~%YIrX#R&Ft-GURnXivg=WZSanhy`y+ zal$FF@H&oBBx5x$C{f@X*6+Srx`BqhW+W{Fn-O6he#^FRM)b*n^ADU7m%VW1O}QUS zJl~_TiUOutX;XPAEuiqNw9m!Ya~5UdjJ5x5+kv=AZ=OE?;F*Yo7p|Oa$089tGz&s3 z4Kup-d8r+?Z@^g=D^!0h_~i&vw5i<)5k+8kg#rkM4$S!T$rI<|tf$1b7yjqX_QKzM zW&V^G%K#SfF#3sQL|$F?^^mpQz{Qx!+rON1dI!>bs>IzPrM(?5-`fLrSXy zF4zeYJWqv-B!>F%ui+mWP7jI-umt!Z^ zzo5pX%jWC(@<4iR#523!r{%JCTOsBg@3dk29AAE(MU+8U3LSJND$Bgv0^l`TmTfe^bv|o;Idv>`TX>YV3UN2TbIHDB+ z{Y+_Ho})vkUt_+a1EH!hYv{u@cJjuTZ*Jasz_1wJVfqA3)VbOX$`wQ2wYr4~ApBFzIKmBwh24cELt`DE4!51TXJw-N#@(3w_LHbNo|BFlLg{-a5 z^S({HcR(pU%Kzsa!M7fb{bh~)XBs?^NlX@!yr=A8H?}jeoGV zbZSBA6sh<2j+fVo5YLHE+Al&tP=4F?8RJP?%s<+KJf_)|d&BL2&@mCR9;!5BzGRFL z=VAI!4BHnSBg(Csra_(eykWqiA3i;mdvLGMsO~|1DBS+!WS=n%xInePKl$MLEiLnU zQEEKCE7;;-e$o2R>=^mIUEDt7U0W-T- z$aY2L>sFYC{Qh;5uMVy2J9^4={*yoMl;43j)&-o(*_c4QeZA@m#Z{wK(_ZEpgsaA| z(E11nCTkKdNg6FZK9-iE>6z`cOH*rt6F$*>L?R`h%4wd8g#UH@(Dr z6q)t)o-&=$U;l(!AL5@}{eEJfdBEA*GCEJ*Tbj009BsFYhV-R7#ER+ri1ijrKBsV-Z(=JR2i_JE}s%Qr)Fqqh{6Tl$CAW&HTa*FPCO`q6a#mF`Gi@&<^jOLysC9V=+^t#)MN zdeB)z3*&|C+T#wKO5={TS4;dNcFN=qzz2!yFh= z5XY3k)=&H|7#g!icjk8b`&>QGT*^3vyzJ}kGSkZHK4V8$YrDFnz}iw)&dtaCK-ELT z*?WPe9#B<(5L|j=br7tO9Ft8r(kD+TP5hR)mWm;5Lq(H)fD*;Z?Fc3`)?#NBbKVyO zVe7>JVKbkW);Il|ciJ~yMLF1sjdm_*$XFA2Q$PtASkGSU9oUYBIYYHw!vo`yxf`sd zt0GZdsOv>Pf)le9G^|rLH>#v-VuN8qZ4YYv9@5w`fOij3I|cm;3j6{kEf@WMN+U@` zqtnw=z+vS>iB;i+h1k@@b$Yd-gX=Zu-1LTwrPJ4i*Yqo_?M6C>E-rUz>Nje)nN1Fh z3*KRMlpGLUl|>0p64xGA6g51DrtNl(-yItJ*QYHwo|rIgY&>zRv|-5b|3TU)J^!NN zo7VH*;P2|X;9LBih%sJkQr~~7K96brL4q+_HmP3&9WT0Pd+min?d-0?cd_@BB8#fp!N@0&%H=%dJ3dT+rP9heT*vT$cg~? zMONon*GarCr7E*IrTIygC@cv6fG27dDZ`$gp6=^t)s^N)?Z*MQ_3_pz;Ob<@MrE9B zIzv_Xu_v)L7kJ+IE*%Cr5Y6UD=^lYLC@F%vhcGiPb3pM<5HnU}UB{CPxegW0i@Zgu+X%=W=uY3k&iQtb%Y``C-k9fQ7~ z7zK@pq$>VzJFWe ze&bszK_)hyaCh|^tBw2}B)e7nQan+f_vkU7UQQzyUY@9pqIOs^hl>Z>(u>3xAv#lN z@AbU=BPeP1%SKOvO}6-~*156Kg>UM8`xhQM=nEGLaSB`A1A; zY|q%*H?Rbaq+ZzCnmv0{q46vD`bNL#Ir3S5zOl!f)t|7`v(`k8`Q{lFp0Z`?u8tF^ zVhXGOTYEd$$7v{k(MEKk)ITCGzphkcWlUmW1P~*i)oPo`3xM)`F65nDx2PYhYW{w3 zE`{7jHTf^J`~82Qcg(kZNzYclf4b%)SO4%nmY?xE_a2__`u+JDziidsr9NNK_?^?( zDNe=cgilrXKXZR|UQEaNM?6zidoy?w26Vy-_5E)3d0lP-!nyN_$tY@8ut1!o^-; z@|v(NSsD{Dw{b1a$UKe%#|E6frm&}&_7U986Ie$!sam^i!i=f?v^F}bh z{mj$T>?z0W%n%=wGA86{DD~5*K!~H5lJ+`$bLQ{sc6#Q-&v@iOSFC5w9oRl8zH+?# zwvK~GG4Z$pZ8R!_{gD}cpY22=jss(M<-A{0S2S5kNa$BZzNqKPkEJ_} zQJzy8efN7Q?*O?Jrti5W6`U$QqbAx7VNjF9_M4xQ*r1LtRG6j=E2g1-NR z^x$zm<^2hSGIX>OM2C8pc>NVF+M0_l#=ul_N@b!%g8j|2e6>55En*$Ml3vI zv;WcAg;gxnCJcLAatZb=)xI9BX`flV((5y5YA@LDGgq%kI-OU0I!Cs8ExtLn{`oK1 zpA&|Cjc*{URQ?OSA~oP4x5IkNSov7vL(r`M2Hg z;h=Hre2g>go5Kf~vQ9HQin3un z{>)u%&o3){#$a}+rAp}^sEWp8qx@)s+$ntH$zROop}{>9c&=F3Y|BFo>+jxxAob~&*T->*8lJ) zozK1GPZ~8}^e0`$<`T6Rc}@G#Ki;+A`L61Yv79FUosb)?5hAOZis*CNT*!538m0ob z4GZ&FtAQV~3U)Y4&Z!0Nsgiq&27>|cu2=Z|1o7+c2r@EBW1p(p!4niqH->*)SXc#z z9Emd-`)W(0OY}{@8!UMy2gbDi(pV#L#gR47-x&AbKhB7xqzn`X6vi6dGO_BdC0ox6}|~ zw?$OITji4rAWoA$N_Bk5`?`?#2F?3!)!w2$i`8c{^Z?4YU_a<$Ok&4^b1LUo)(=~) zNQd0$aV}kZf-!m{d_9y)|ClzGjj7)rc4teyVu!C5w8xPyN)>j7reQm-d)bUUX*J~t zCI;=-p|Ydbm>WI0@VX#g#|Z*CDo#d;7yC3qP}xzpRc=IBk2A_se!}C-@HvHiq#^<@8%n#+T>eX$EY`pa=$p6tsQ(CmwLXxkB5qDEO5xdTV^ zJ?`ZmcLw4{JkF^eca-;P*EyDfZ1hZ70|k?KVVj3BJFRNtS|xw`B=App zptC*w*1`US`3Ig`+}#K6#1Sx{H1ZkR`9u|G#R|rsf@9`eZ8`rGlcEKvF}41|?=C}$ zjqW%AY?N1q3`wX(6x#x=b7P{YkvxcATN!M~mJt-wFS@1&iwMC%xPdl+B}#8TlF6PD>X+7GwPK*bYJ}_Iz<{7Yb0IyS~QJvz0rJrEi zNE|4OLV+l_j>`%ZmVOiuHp|92Mv#ovVom1ZSGai%)$9B)$gm%{r=x_ zI%Mbj+)i!hMU34=bA>5H-WIm>0^wja++0no;n&LbBbCCul>GH5TY;5h9Ih>_MGbUf z<@jpkmU!AOlonMHnLf0Au~>pMbRDIC??5^4g>KNbm)=_F-%i@!vLag$4y=kyn+j5uk@7QojA(29>aU#7Y6V8Wf6Z7sk$hC@X2wo+)qp*RDadPmJgQ}XM)<2b(Q^p0GwPq;M#oT{yLxn8M3T#GGJxnWVAv_LoNdk#L`iAOB`hf|gFkI3MpQvnV$~oy5i3 zVzaPp$u_ogqV2>33m$J<;%a_v&|?t#afi{5BRg?GvODs~2?w%^&ZMtcg*`wgBTnvL za7bLx{N~^ruN0oM>aeNxl2tGKJ@V}Ta(sBf(RsnP{4XD^SUrpm_if|H@`1G9j>N02 zFZw>6wr~1`wZ&#({Mx@-f6dnddT#Dt{g?tmZ8>!Cy>NPTEgwA{=C#OQKuPk=v$0Y6 zjd1(FsNDn0{}vVjmT!A%P&HcrD=@7hY|_ezM6C8_B+o76*NuH^8k*(~)V&s=N-vvh z6Y&)Y`}E0F(-PUf6YQeU=gtup{OS!j%@qcp9mKa9e30SE$mRze%}-MHgJtabYD<5t zl1kMdwXLka{w+-31bN)>n0XD*ap6SGBE{YigAdCyh1Ua+={#P*Cv zMl{z>24xMSI1}5XADHpqiKb~u6Uy56a#v%)kd?$h9x+YSiux>CYF7#QCig0H9DUtM ztxl_q%YUiXrd68Sv`SN(RvEC*|9kt9Xr()a)~3`cU$4L_RZ!(2{z$9C7AN|~DEsab z){Q<^9PzPK)kU+L4vA9duUG=V$v<#HWJ|Mj6?^kr-0}0W;}d;DiO5sP7@n+K#C%P5 zSb9o+WJNr8sq zD5&$_Z)?U3}dVkl`lSbory{bR^)Fo^k_Y5sLY{sNi{~96gP+V7p zTxj*bU;4&z{mAd}k;L3n_-8()mS92n!31MJp6x%G!0)KW?H3w5_6Vh~-=p9BdEqo+ z^GEI>$`V%VGeUT@GnDd!!s;8E(a$my0q}V_ zoHA$Fc$;|z%Y-g`iCTNktMDoi|ytJtUF>`G>Ts92LUk(D>Sm;^5f49 z6Zmb`xIL(`L+|dl|9>XOJIkx9O75&}*s-Ie z_Rd|^wcF`xvt;$kmz&v>>zeBBXU)H!fJkfX{~zpb1B20bfw zIJQ;qD6J?H=G0|4=F}z5X_yy`4-WWScr(9=Jr)WjjTLqEbwVIw_Ab=aR_v&EsQ3Pq zR=UdS9Epn>=PXKXoF^nxOciwwT!^$#s4K5-s4RBuD8W^7j&fH`P00?yRasfREpg6c z4GwoxeM#LsN2#l#vZPp;Q%u1qbuP!FuF8sH$HsLV94QMIJCu8U>KZEQOBM<_aD6mo zVXDxuWBZP3h$)d=<_X+cc`oMO!o3?eIqIvc9hKF)9HrH@j@puK)wRVCOpS|Wgs`o$ zq6Dd_quYx}Zo-!821ivxT|LV;HFt}Y3x4WxsZ|v&yxQhY1m8fTxP_H>BW*j1>&ji* zON13GH81d~E!k00R$X5~cOz-R#)P;T5typ2FADmi;0XD+xvIid8H@#D+mTT3sD_M% zJkE#eh&%dfDog4i-VG(S2vt#6QjDb5Hf*bJz+Hb17qAhww!~H3By7Z8UL}+X$fn{7 zTmV?H1L4V1?5cN-_pWZJFRKoCe`iN!6O#ua)HT%9RM%3x%$eULhm4%Q2B6|I7(RM!8J>`;;NX+J>Bm_8NqI4LLRUuWg1;+h+D{5>2Vj;Rg@LE zDp6j`U3HG)hMLNXZO9lDhaL5`6(x1y?1~UINO4K2tDzD>ze$+-%DR-)|DDLj1pLNP zE->p%CW}EQs206YRe_ruS)SE2)Uymj_EB-x7CLrc7Ee$Si44`Dq=ICKRPJz5p>RMx z)wQ_du`0uXO5I2pN`0J=1il-_2d&ezJZcjK22uXXcA!k`sGcY~;uqzu3S}G_S&Z`f zXo&+i$JMb+p_1HCUs6=%s;fsqS6f+D5B>+!hI#RRK6W*W+l5_)SN3d!&Ogh zB-D)JiZT>RvZ2XG!@IVm>7K@I5Dg%CE>{)PosGD#Q0qW_O|ZEDNka{iJSLFBiQp<` z-9w-~pe9vmGBovGK(D8%=5@&4suIToa~dC_7Nw5$xq*fw#P{11HV|mBOTa-%@j^in zjFP}_yMP-|tO7}5jlZk5t^`RXITY;x9c%N*r*20D>Jn)rwG)JJRo3iKNLf%MqZl<( zO*VOI;%nGJRi$i4#bYR5ny7>-S0k<=bd^;hsYOa7D3F%XP>0H;v>btMvZ$=Kx}gSQ z;S$k^RDk|iR99PHBb1jQi`*rydI5~Ht_yiyROxC$>TvaLef75L$|A0Akgh;*CB;RW z7KSM>;G(KVReZ*JHr15yG>i#E?lnsKq5XlKa%c|4>|RgsRM}L-Dn~FmYKLDZY^$!` zUV*T6+ld%5RZ3z}RdsO*e1i>U5#97jg$UiSP+d`6R9aDqhQ3aysjjQnG_r{SFizf@Dv zda2(;^N6nWv67<73aaO;m>!u&Jp(CQkbq)m{|nH6G!>}1{_T=o8|a?p>Kz-|6{#2s zY^!amfgW-XA0E^RtAe7@+BwE1Mf(-9)~)-_{YCd}SX)$Z&xTF+-nTLTJKxqg-g95x zJ@?*IkhN~S_dQt!>$Vi-WNpk6zEeYu2U>41T~XTPAQ?L-he(xU8u_Ep(b;f?lwN8A znO@FP%rtWLt`awupx$%+Zy~9Tjtv{uk&=eNNkgsDP=S^-pT&-9sEuDkl&TW3wwKr$ z69cIYc}?zG&46Kn%3>;w3K(ljz2wOWa7ReDh@6KGq&f8##1%W3mb6eE;LM{I7%dG% z;Z9Z+)H*)a;mxkn+me2Y)^XeRx`wJ?mo-+$2=wt|omF7!zSy;+Op$F$oU>?2V-i${ zd6Z&}n(L}3g#ub`$+nuiQd4SE1dLfLcGOf?SKfD5N-EyTXK~t+F+R#W`K10oyuAy2 zR7KW3dQK8Tz{p@|F$!t}5rYH_7!ee;g@{oziVP|$nuH{fND^Wa6ck5{h`~WceDDy* zfG>1#L`B6B6<-W0Dx%|{qJo2pjt_jJADaJKRlB;Yt4{~Nd;j;=k4~-HwQJShyXsWc zIo(YkIYe}TCflv8n!#+Xv}Ku-S%B zJF~brAy~O5j^wROxO^%$hJK0FQ+eWx9V#08snZiiVB`smVs)L@D?Bo`BgA{9pTHcF zKXjVCQv~Uh*I>8ytmi3MJSR?3)9w&`@Sez{u4q`5Q`I)0D~;#1cwiH4Z7YnNQa_y! zr|=x84hs_(|JX78Wb;gckGD=YPY_sOe5}VZ>ZirkZF~4wo)~eSu9#A*9~vp$33!e) znFwbqJh+*f7sj)SD6YOZ3bCsTjvn>me|cMeJ3A%>X@Dx`o;vud!;5*g`u}%sp7{Fc zxC37JNp|%cz+I5@zs3Qaxi>tdIzx>yn*GsOdJipJDJ0G~U=Y;Rh3ST|u$-n-qU&s1eZ>^n_dE{xQ ztXY`$O;b(A%h|nV44!wvsDVRXJLW%sy(BNY%k0$K4!vsG7af<~@aT)@@0?OR=A{q% zzw+ZPUV%S-dSF!6zX$a_}?&K3{{z5zvlR5c{4dR(Ax9xv%jd9Is)pLn+V?QZ#eo-;YTZ_MnSIx!!q|A?q z^S854kT)y&7Q^1EyjJl8CL~rUXQam1>?+bv^L2B^gm%+c^WRdiUtSlqmp<}qTwa44e{Kc5-3SlPA2?{>pm1(gQ&WB8(T5*C36J@vP8f(M2z-k}H#xkf=Hl7` zxShPPvb<>^G{Sr*M7Jy%oIm);{Go$~aYczww{tO(l;(Y7mMJB{e-C4-q|6bErBpRq zc9{{5rBu#ZE2UzE>LnBhL!ROt9XF>^ozYIkuUePrA7=IrQTjPvPcC>!x}2*E@;4Q~ zFkLDBtORq4_kqKoTDr#bbbo$^?xJkBYPcgm$sxx)K_ivUt3uAvm~LS2x*sa}~y*g(DcRJb%2)~Oom1}Ulrx=jSO1S;P4K0fuic&ckY6Yp4X1_g{p8fU z`q_TZe9c#ir8mVp$kFfVl->HUQ=j9MbDeUY|19?@qzb%JyunU=zEgJV3!M6)PT5`G zhx=iP2lqSQ`^wRe_(iheKMlL^TUbtgp;In$%EkUP*@8MN{;&PNgaDAv!Yjoa<9CsI zihXaVzbH=s8$Um;{#*Z6Hb$boDc(4LvnrYLnSKWzEReX<`QDHINGWrh^SvMZOXUB= z&Q#^^9eYPR$2sM5o$>`vd4f}}a>|pP@)W1s=#(#U%9lCiE1dFG zPWc+A{1?AP_OG81zZCBi{}tK)b@?OzD5<|g)!*)4D)qX&$l<%eDZBIQCZ~RZQ+D}o zbLww*%6B;BrB3-yr+l|lzRxK?;FKS7%8xqbC!F$APWf4<{GwA{@02$<<&94HEvLNM zDZlHKw>V|@ytdV;|HvtCcgmkQwyPfiHPPxrrcNi`tB;KcH;U=aVZwMuIMgF+;nKPETZys@&D9JQM(l;w;=94v_tiGV)!(g;x^G6U>bpFw1?V zJylqq+=s~XYVpc~7pJO{=V^OFUVq+rNTU93>xPfzRH@Gg&ho?}3PgF=^e@}@$O_+&U-bC-u&Um(pe_NoN z)p%ujb>6ofRna?7l^eWAMV~ZT-o@Thsi&J+ z-ZbxMIq&Q8bnh&=qICIE?`UbS%a?h@ay{`_kmb$rdf}YIM6wyjR|0L%hhAqpR?>%ju zhqAnzyv;eNK+^Wy>^&jR2S|(mhSyso*ORvAcJDGSOi0?^JG=`;e}BlbaFs6>eO_i+ z-re4BY>1@eeXsY1#8>m(=l!6o)ibXw?|!dJu5Vs8S>E5gKT7#oRsOs8srXl_$`5;! zBz~H2mG>15K{^qyEbnn|hjTq2CGi`p>YwsHllE&d&RO2`-p9`Thd7!T&x^&s(}A(bw^P-CH8@*X51gI9ZSMe0js$PwI7flXnOKk}kjLJuU0W zRLHWtx4nfj9-QV`-ezxy=torfJ#Uf3OZWG_SIC7DN%MW+t&A&w=+(u|&#m5N`C4DM z-{$={?t1#j`+*M|k@S4o?mZy$U+aJ34VL+-%b$8x1GT;`@9<9Tr^_cH%kn<+mdN^~ z>p%A{iYx!u`&R7H^Xm)mRVnN7|I#~{4Uri3Ebl9CviMK4vb?Xohh)A}hvRu)m`Fdj z%<{hV=1V+|f-KAX(Q6g|bi9A@B2u2N>VNZomGM47m3{vp8E+I7|3>lmG*#chA96Tr z%=OU8e^=Ho9lyQ&zS4gLI$2&9zjGJ>iQQ&lHF`(db6RJ42l&TvVV6XIcJ(zS-G7RV zC#9^+Nqigv=gRa+dr0 znKEDIsPbX{XT4a9uOZ`=mmDKd>#<{P5I)EM4tCKURmDN{+Z5vZ*$^*4aSX$ zC;cpMj(^==y8N>$U+3>9^MO+KcR3Fxl2|?rdM2^Fx2$iJvHZC3neu&7ugBvSzrR!e zv*S-Ur+%nY{~vaO^rfO=Q(OEy= za`xB9r2H)U&GH`f&yfB29Q2jtJ>qwl^z#vTd_Pz9FZ)}i+)0&R^Vi7wlCH{|@Ktin zw@9^r+wbQ1`-~I+*PZp1;SUK1mtz0#nva(`aRYK*(*E;W&KOXB19Dz-{tH^p^A_a` zkh4qwMJ*2#Lp~NcIYZ(P-6m$A95Q0obGagBpTh;S&*KHN&vON{pNj;O=MuqT`)}Jhx+-D0WcdcOR&lSv=+$@-VGWipAuIv|k zl>HmE9Nl;!S*y6D5K}iSn7T~-&wrWhw(QRrP8A1go4^wD-d_@aCV=DQrq_qVl<8ZS9l^Y$zR%ywbH zY^QvLob8xs&j9c!eu0wl#RYqT0) zS^t&Iz^rHT-_^O&>7{XkypJV+Ut`7pfyT=I4>eZyZ`GJ%;BV7d@iQ1m7*6&7AdrJy z^8Z92#{j|PI7V=E9RC9WlInN6#;RY-hEQKESMv>+x;c1JPF*Hncvuc`6Oa@q&oxp# zUM#78F)q7teX4$C?96!m8*(%M?*caS{|aEW-lFZfz+rH44*ZISdBiW{4^lo}{tgAb z0%8s<(onpp&vR~s_*MKtD#VNOW58J?xL+6iz9w*p69kEF5L1^tMt+=N+BnLR7Yinz zTIH;u=pa+?ij$LmbN@E{(*)D+*_M2+V7RXLb>Zh;&bA!uzY0d?-6c2; z`MrW^50@m<*E@p4$UhNGzdsYq82@C+`OYfaGTwU$X1os(4Cv(wX3Y8vCg(uGv|)(g z;lRTMM}V39&vj0_&3?@`{(rTc{+n@Eb4KPQ$HSNTtmX`zMhfHQe?g?j!2eQX+T?$% zG5z#E(pb$U%nc?rmw@XqH|UT5l@hBnkN>sCg_N(+xQJNh*jQq;Jr!-o5zCxc*K&WY zudZca`l{w0Fnv7|uMjYOC8xpUA?8@0XUQ)S%y={lrp}Fm8JjxQTkjDILVu&g2h3GUA+xzm7 z3uR9l1_y~;oc~NJp1>SW6;HVq=%@d>Qqg@Kp>bcf0jACBS^#E05s|Z>GX%3AwZ=k+ z{hTXu_M>7Bc{HB9Aw$BE!V48BsQ&mvHBP6T9ZE9mjPg<9tj-cgX$6KR1kCyq1=D85 z!-GH4AMgqRQ_f`i+6y>zv=V83ZrVtyFWJ{r3}4i86|0RJhmn~%*#kH$mNS|%6^HJnh)X&`!M%$YF-@+ z0g|#Am>dJ}3IUUY;UFf5nxDYrI8WsCg~^YoOnufm#EVaokDJlMft78*ST1yI1uNSG zlZ*N}$d#QUXDp1IeiD->Y+<%BI)I+fLobr*ccg-Pd{5B$Kx83c)-(Ad^!lmvfg_Nq z7z$Q)3RZRktLs?WQeW9Aa%HFJhbB4ize>-oGNIEeDC5^(y|5v;Q$7 zXPn9fhmltc&Ov^;;4pGEm(Z5-1(y7F!IVEJn0`DhI1l;jg2TxFC7Al#1k+b8RkS&b ze3xMA@Kat!&iCJlDeq&+`&n{+%E{;MHiS=8|AF z=LM^|1kC=`ToQR$IR659j$rc8XZA}>n+(pkaDjz~T6nl%j(Z!Z?)ui3BC{V<(7Pfg;!d5m4#PZc#VbE3g-1k-)QHf$kz*g z68Q$fyuaQknDKr~@LW7`3w9ku<{r9 zVPM)v9nObtz@b0tdbNfFGv(k#Id%I9CO409l#^TawH5#=j92J1EgK*hnU0Cb)m|*P z%F?N~u+6z2MPWIZk5}6Y6km7?XEU zrRKo%l**a*42}PQECfuxo`T6YR51C}IRrY4+i@Z%_X&c@jcK8H$id_vqwP`ijTN5G`bguNrYOH+c#fYRhWp2~HxOsS%Qqgk{nC;Yj0A{ubY{-$8^eIS@|=m3|fPaSp7F8FkjljknMjKeCyj1}KUGJTzz65~OY=a1)K z8Pk_ER`)OGXiVM^Fzr|VitlQyPXsX%`!m;gm{_j;T;f;o2PqFPe}jVhdC@4{wt(_i zwY)R3(0RHqnng@*HX{xr-z=Ei+XR#QJHh$LcMB$WM|8usO#2F^A6z0S&jeP_PkS0`YPtUp+{m|{6A{UxcH}OtYXfIg9OvO(D@3g z?|l)|Ms@!JOdCgt4sGPLF#2VJY42pgw6{($<93l?+TJ8MjQl#mwEZ^0w0Egs`th`2 z+OE!@u!pv*7)nf3+<=E8_9|`?6WZa+N5f6rPKJ((74-K4R=!^VMWo(%g@DO@h+z6o zJ1A#AYM%mTKPo=J>}Ry-uq~Gr>eF{zq6)MBa>3M@C^(F~S}^UZ5lnt2Gw!s5_$=70 z{1qRSzXO%3o+mskBN>1B{hu((=D8VtAfN9%af+_1Fn0%!lYJ9&! zB@+Ad#rH5Vbm%*I&9z2epGF}m-%AzL@1+7$SM9~X$V%gU^ z0f#DC%g--p%z7qw-2a&pKkmx+b1i={zG1n7?^gm-yGx%1tZh@7vxpIe-$}nqvj9fO!wi%wzzvhXyFE9GM$e?%~#_n2VD@(ID?f!7Ew1zs<>0yqsXGtV;xKi)-OZ)RSF zD3|$}O)O{2FfqxI7jd{izDjTy`9B3S2LBPv80->Ezkd_Vc<@;O`(g|x3Z{);aeN_X3-z%mzY2c#72=^1 zNu5c68D~rzC1*W{nL4zEeG$`^g9X!;Lj^Pb^qD%urwL}eQo*!K?F-Ne1K%g|T;%Hn zBf}@gH4o#wK``UbWZutG_Sa~cl0Tv`eekDiOdZDaUnZWVdXCXPpM#I2Vhf!NG*q#D zRLfOtAs-HT7$W~MEvFCUoC-PZ_Al3R+UoO=g;ao-v6FMc=fZ=;_?W#QLfli^Q%GE< zaS<^ez9JP9bD=^SjhFv~f@;0+%eBrp%2#VS-1I`V8m9|}nR*-{XFT>7Ib%RysLvSC zeqzQz?FGP$!SNywBUkG`pqnxqf5<@%|nBgO4Y?wG+|Lh{`q|AZ6ArDPc)q1Z4 zW~@{UFV%8|XK2j7anJEKYB^(Su1Dg~pS4`Y8JL`mBjv1T^0{Cjb-*ihg@XEeoT+gi z%CFRzf6e>vM$x);h`t!3jFEEgiv1=UFXh-+qJki}Q)&wHm^%f*%Ct9QFCY04W=<&@~F`dq!Y# z94&Ijne&4>nV9!w!8)8T@L0;@9s3N8ZvNHAmnv0(CiBX~40lRF=-#~871bGBg{pA!&?efxh? zP|uB9G*)xtCXK_$%=wcsGUw7fV$6r5K$tJMA27#>@>*auf4+hMiLs-6I^^`noRjGf ziZgUu0-3JC=xFOCsFvqI5VCt*A zUi6O=c?9yK1s4KG1k*ot9)Nx^FppEFuL{94AfF_7Ch%o~^MTbhC4H%D3V1Z+_lnL~ z;QIyBHoo^s{&B!h3LX!H0%m-PIsa*^dCtlBn)me> z7wX&yefm$#>yCaBFN2(Oi1$a`L;QSQ&%Za(@BCRBbd^hB)iLcP|wIa_#FxL~$)bfqQ{DZU^FShNE zw%Y}F0scbp7g_Q-pBo@R8iZE}I1Tww!EjN3h6?gb;E5v7MqVv=2Xe-WZOJ`Fa1L@F z?{yTw+WSQ329du7 z`Fz2ffo~B^Uv3w?1$dd@V&Ij6X`9*;!8saO?TNr+fz_S}Or8y*KMweH!Q+8931&>x zdwkF@1?K;#!8lX^t7kjFRlw;fT3!P@PB3jaPjCzH1%l@SFA`i2{G_G-wBRPlpA|d} z_%loA3&9&8|61@Y;GYDi0sks^2C#a+40g@~E=|>T-V8ib@Iv651k>hQ1up@9(2_qa z_%6sF72FEES}@02J)1&b8-d>v`EuZo1(Sb=;1$6C6}%F7Ul`8VQYTyROyC}ZX8|8= z=^QI~732}Y7Pv()Iqwj>9+=6$N#_uI zzMNY+0f%nX>%bobYc1$}ppnwY+QO8H7uT8ZyUIHMyb|kkk-g4u)$*Rym-~@0F%OSJ7bw-&GvyycJ``p19zi;AXg)RM>;X)>u*4~O26FZO6y&r~-P;0#MxRN5 zL%;*@A`fGGl3?0+rr8o<4FN~v2^@_la5SF4)a@hsA>=BakVoSQ9E~S%7&U<=a)#%70L z#^xu%)c-{=$KqGP^uvRD%H znauoAI+zdpV)0Qr&+B@|&b*JT=Kmr+*VMf{Fw<#xg@D=T8G^}2pD8CFliSyDr!V?L zoiiX03!V&2pM8Fa6)BHc=G#zW=wAk%2(i3hTqJV7UtCQ575*U69_p`woHm6xxscRe z08IO{@S>dd?<<(P$}iDZegTIdKUZ`ZCp^-Ma`M)NJRFzn1k=B}1S8Ymi-8Wu`hJmz zkv|}qes2_NyGYIaj$|k(2&$ z2_Vh~zR}XZS#Sa53j}i<)ck}#uT3U*tlyBBn{|fq@~;H}662!uJIb0b;}xd-Df~fV zEX;dk^q=~j_mQ=0A~j?WeOY7LVLpq+SWv$=^wr$pg@sfh@}nWIBHlo$=gq{6`j0?9 zi&*B~T#+w;{AR%~051{zHE=6256(!-iNO=bq*_5N&zV;eU#E3e5!Y(GmKge{Lw~*C zLBJb{o3zemk=H@KUGR;--wR#}yj$=;fz!~8oY{zNrr-wH$@_it-hG((RWw4%6&>Cy z@P40dKf&0kYvDGn!|@6Mry=hlI0N}Xf-{kyE12UvSuisFejnO~fG-j``I-dxM6T9( z>8n-b`LKoS7yG4M{}voZzC~~j@=pa9ApchIP~>fbha*?_P{KbDT;$9_K1eWQ5D{Di zeRZutCl4~UhD+Nqq7#A6nSu*})x8*W*tS~a#lY&GOWLY?E?_=J_?zfJ#rsZhDe#Yi zD}a0O-U0gbaj@Vj;Nt|>02c~oEctmL>N8ado&h{r@J!%3!Lxw*87ZUxXThT(zfv&$ zx=t|tx<&9<;Dv%Yr%Tl((^?g}1$#=_XPU2q6; zbI-^SNCqvUk@4`q~J5snzy!!EZr6 zQ}AZs>#Vj*EPZvq2A-|ZStj!B!1oK@0lZ2u`{n=b%Q>(G_zl5;-dloS0RFe&^}rtr z-T?fmU_kG4!5Nr8Ukc{BnAbt`e*v8$!9~F53TE5$1@8nd75qIg-{&y%vtIBn$QuRk z2ENA9xz=Fxd!1me(@b1%nKJMq9>8^*_<2g@oX>~5NFlt;x}8n@Ii=Wd@M7CPqAlpX z&=UMXA}2B2)}Ju|rmTy|*-v-DU6J<^%zg$7W5@V;SPy?oAdKfV({?%Je-&t zAW|VQUc{r3e=nGR>=rx@xq2T2IvlTl2m$pO zC-r`Z@bGIPlovoA5zP3h^8nui9t*7I7%<0*$vkJ{c$oKhI38wRbrpO!glaCyzQeIG&-55~e=GhVF}`fe z_l$ChzoJyu=WQA@j@0=HI`q^0KQK%ej~^q5}b?tX~B%sdclm7 znxCyYuAhjUeW^JKIsN-Ww(oCy^Pwj7XYUL?}JwenEh~Uh}q9Uf;n~<2~bqAJlmkfuL{1FGD9x%uN8v#PAEqBPg3|OnAYn<B_Br$&Ekb%veyq8}X#i zW?UI7K}{C0Xk{G&s%ae zS0N8W_L9gsjvEBi_SXf|_ICtxT($^iU+TIB57REZXeY?ts?8C&0yu|xq z6DO~U569S?2h<$98v>+#@d^Q_AwNVg`Pd)jw7I`vat{>q~+`y68hp}JzvXxS~)@C9wNQ{fmix`Ra`+Rd7DUX<& zJW@Vh{$I7cfOsRNa-F`aF>MGf*I2Eqz_hoY$Z7A9f~k9=VA`wp9q5yLg2-w6p9Rx) zbv;5S49srW7j0ZEI0N}w!IZ0c1)ZV5>UlEoaNv(bhkpMmI2U;jxJOR<%4E&}D(0Nj zNc4g8Wbq&3uOk)n50#3J`Bsfp%z4N~3gcz=efCG5$H7Be&HJS6oAPTRS8)cu6qt5X z{u*$Ecq9HG72!qse;_X=mhn>i%l*`l=a#_qL+vlX8Nj{p3IWq6#)6pRGEgvmV(cjA zSd11-pGpLWk=F`l|5pfRU(JHaeYIfv{TIRX`(DBH`vJl9d%a-x|B7J7;61?++2d9dIV(jBf~-KB=(- zj*cC0bnJkmV+S0Dz8X8=Vqi6P!0bzn9Wc4o*a1h!4mb~THFm(!u>+2d9dLB)fTLpv z96?((cEE+eYV3fcV~6?7--VzZoZBY>(`Vv80cQ%H1gypp@{57hI09b-OrNR01eiV( z-whlV{2(xWqx@}P`bPX6aGv13un5yP%KHG*H)8%D(DaS?XkhwAd?Ii}@Hk-lMtKP^ zeIvdYxLEM@z@r5(1|BQ;@4({(uLmA4coT4`;BCMaf`10C65JWVsS(@@xL$BRFcWQ9 z4Q%51Dln@k|H8swb&17o7jT~FWLRramRWPqwl}b`GY_~%^oIb?5IhQauHezYO9Y<_ zyh3mV@EXB&z#9Zl1!kh1=Vr#{2LBIL;|nqVDV-4jW^SAYY~}`a%-pB}?kW0|hb?U8 z2IaXTzZ^Kv(lK*`I%aO%2yEsC<-U zjo)G~t4Xd_TUlEk)mDsTDxWfCa&=`%Ie+iGq+)7qE%*#ovig`!mc}IwFrXcVxcUHx zno8sc+!MXU&!0~;wI&MjKWkmzScYFuZ)|FqGQEU9bDe~vqN%2_q^z!qF|MyEGoeec zMs-+G#h+y_t1T&Sn$}K?lj$aqPO5Aw!7rub_u`vMYMZ9U!fae(FcXv#Xc|GInzJU^ z{LsNJtEsOmiD{W(wfhTHOz2bpJpJ#Wa}*PMs>1J`H&&HRt}Ll-oMhRS(4{u4v3gQT zS&glj+=)cp1X68YqGAwfGTmgPl?|A`C3R)Bm6luW5Ig#Is3z7-ZLBJpGPS9GDn>Y= zLp9@Kfo!U-t%PneMYWpjL8rX3p$V77MJ45BB{kKJanp*kQV&K|WlhZ#s!hd}=3Ei& zYbCgVA7!qrt0-xY(GEzkdIGBoOjAQyU1R-}hNkG6O55t$-Ndq{vKq`McpF#ASk_c3 zo$5MHI4W2xFA2)(6$KWT5=JY){RE8!`*?BJS7Me}3`&U|l-E?2H6&D<36xwTp%*R? zRgEQ6E~&HoF+_G)gEbQfRak!qUA&&@sG@Sh)JY}v4b@oo%AQaVa)Vt%*(LX-DP{V~7##DHE$Pp(`pUmIW$Q*Hy=w z$xfe-Esx+Hh5tV~@8Q zB#?2Wu>)BuL6#GUwz9Z_k4S&EQd}tGpz7SJ6~mKDm+x2CJH} zHfpwAYNRoDd3q^P3uI+OEKams7V^0If!G7e2C}wZ6Nq0WlNzQ>txsx*sdZa7PQ|Ur zglOa72nK63z3A#0f|aXmQhSlm@r_pwHXrv-7gxs5C!SYJ z^d6>cLq|#4R@YZyGIDO%VT^bG_Yg5eRb`D;qzUed5j%oQ3vLC*t1mF#ec3G%{HSll;{d%x zB0_p;Zil@c^@b^Gs@bbVpth~RrIPn7a40%Y8(~dZP4%VNDRAk~VB9~H!Ny=6TfL(o|j6gex=Y1mgWoplXo&>OkRYCrl${MAF_l9rWY9IxH!&x>QW9uc!MWnWD8t;_2P9_@-xtX$5Oc>1N#c;%FCFu)C zo;~#CoFdu@lB?<3(ok7GrJ(|QOFeFE+wo3CA^I2-Pn6r~Ge9@NQw|=UEZ`v#HZ`&( zXegFF)$_8fMZ6|dH`P?udDsA%C0QvLd;KH~_XpETCN`8|?X)pdB% z_P^mz+8}{GIum1-2N@lp7JRVM+qZdK($0XoiV2pLRp9Qdv81Y^p#*1*7-KR;9vR{k zgAJTgkBu9XeScCyKzFdoEtp2p}Q%yzpJnI zTLc`1+HasN;u0ih@G13EYxuYVm2`$#?@X ziSOgpBVu^IA7$pnq7O!Vw9lF(dyq8(G(R|Y2};4sqrQ+CXxvs!ti;=aScMUZ5d1y4OnZ}4UVq1xh9^SugQqPeut!$XWiX?-lM_4^L5S5@F6SWco39l(D zX)L?gbQZ{zsFpxw?oIbV6`-c5IB^5&j5P_>CX76IF^(6P)l4-mB-lm;YY}cIX2F_) zgt1NZ_fxmmW{(?bVmAqPAqv%48*osGJs4`o+ji6wsAKnHCd_7R%usNQY%L?lHL4$w zM&~&sYE2b!l36Y{ws>cng6V8;T>GiRTSBD(u z?uk?6Y-QKN<>WQxHB;)0cL^3puL^WnHKnnMZ^ySYrtPQ)Q2$QK1hoVzh9h>I*n^Ep zl@%@L5jTb-^c$Fs>QP_-WO?XyBS>aI_rS?3`DYR zT7A+$-k*$4@#r(T*!!A%NUMPC|Qqo~qQ(am&lF10@DTZ%cfTJhicGQc?xw8s9>T zX(m}GWS_$&EsR<(Xn6`yH4oq7CW$>265806>LVZO!xea9*%<5(@9Uyr;N+5bJ>%r6 zkirn7Hj@>5PtBBanNf;~mm!|4;6z@BZO&8~qJ-K6N7R(4tSfJr zUXL5Ls>(WycDY9b&~{*X^fHMa*v%&m^`}Atc3|$2c%KR%$5o%SDk+~3prpDr5zvQl zyvqd5;B|_e>cass9pj=2jgFbE7VIlOh`^5U9u&^{$fwt;Jh)>ykl;-aeBYp*D>+Cn z;E6?$T699#2MZ1yJ~Ti0$RSRrbhBN>csjFcsQsdS!sMz^%7jnkCbO_zMMY<3W}r<8 zm3sLvZ)_UGctlGD_IybanInc8Ei+^Gs2KHE1=@{EJA}zqqm%)W2_|e;(G6iDg%!eB zrD|qhFkGnPKeJS!o-LFNcBb9$ZluQs7uTSHgYZqL-X|yK7`)8UsK@jv^oS!YAZ3ED6gm0mo8f!a;hToKJMl8f@U3_FYQQ%SO622r z66FnBkI(!*7>+j^zKE}=P4R-iy zlGr!E;R}P0JmkYy7o&V#9KI&-oq~FkjK7^6zC6o5ey7mbHv$+G(fPL)g)qt{89x61 z3B(bpCqLT>oR9~#d$3-yePNyfgj zp=aBdc8i{;u@B79YQRY4|4eiMMYJ_=2vt^Py+kR}4OW zuafp1VDSxc_%@@S-)}a_*f+@GYXP4b5B6{D`vn7Hk4I5zaQuFNo^9V2@X=4&$1yd0 z?>T(@fARSpQj?5*Z##V7Tk#7++3=lJ5O3cs@EHzr8hi%yh$9ptW#1aRK6;~U_=Y=t zE#Nyuwa|YI-%$=VT_@pU^Q-oBMd?CSzO+rE5@udl`T^Wb>CRY~mo9(p$4aEp)M zZMfo1@5zn_P ziG2@4&*m$&_y$^h*ExKjPm`A#`g7FfJQ;<%lFW;`IdukEO>bR4zc() zIeeqhXc_8FA_vo}4&QF@ajz!dP~_BO{KnniKWH)rp7zU&VAJN2ki$?(mBp3Qd`_&87K z?{UZtUzx*~3%&`ODvocw!}pfO7qR$0!{%=LJ2#1a+o5OMm$oow-w2EE8HaBP_|8<8 z=|9Hbe>i*v7GI&o_YnrkwvWFj5H!B;L(jIa0(=mu_>Hpoo^bg1`v8EWXn$zWW`%;YsYf+u>Vn@r}0lCS=Et?>O+~qTVDEzrQ$oGod%kC?Pj` z$2ofZzxzW0dc&Z{HW8_NVPWh%#C6MzN4CSa5qy_P8)l~8ZVsQfD8_e|#rGQ~uRWiO zJL+*al!otT=-KuS2VV}9IA6wDe48DF||WeEdH#smJ;Eki$0@e1?Oh z2Cs1VW`WPl=kcP)@^ud1Jn&_aNRr`earow0d>261*f+LQeEjZ8V&Cb|W1EQdv&7;n zh0O2`b@-MivF`|nZ@I-c!Qxwm|1`=T-!Smm$~tJTaxt4|5M)P+n$84zhmD{=;6|eCe!bd zgW~yiC(*mCTfANd&Sg-ICd0Qs=B;gCHuQqVtm$3 zNVBYYbv4SY<2>!*@a2IITXHlRzU~g+Jd5udXdAwd4vDv~5PU)7`xY*KJ1(Q47moHC z^W$~s*?ufRzeUjFdT_1P??Vn>J@~E&;9KGFZ3kbe@XfXOuJ09Z-%jwESdiA>IncB1 zD{PIe2iIGC6CA$p!BPEWB6t|d^r~1;}+j1!iVsyl#iQ6Ovz|6eA^tpeDF??HmR)Ftx)k6O<_8sr=y~Ie0QSEI*#x3a6I2!@Zl&LO@^-tdN$v7i|<=# z8@@Ttb+jCOLGy1G^lZMJ;2RDeUgzIid=nkMHQ+l6^(Gnn${fDD`(k`QLfP220Q1Nm zkMF^UA&Mr$Hy?VoeO2INylCGp;oA+qsZlnq$6|%U*95*I$jSE$a>I9&!`FoK zWsrS?9lkY|eY-8b42N$9_@<-YB;#+Y!?zxMnBvO5-;f*ozDMxv`0WCp;UK5Mn;gB} z&^v(&l8oM~&?AnBe3#`1e-npwjQc;Gbt8i7B`j^28NTPBXY-}qAB%IU#dnLtR|>w< z0{G@Re8u1^g&xPPgT*)C@c6i_1fQ{qv{|ss995#p@crc2 zx7yO_hz!!8~9_Uya&OF@=J}hmDFWcf<;qZ+EUvFa^a%11U4&P3T?*NOh zo3pRZ0N>C6zAn(S{mobryDs?|Sk`fTesb(v1-{bM7@@K6TgSdC@NI`0$KxQ2FU>g* zh2U(EeQmhkwe2f@Aols)u*LTQ^iYh>zhdxx7c(y!zjqwIE#O-v_Vu>-oFM|7m z+yK6(p=aAS@9(j7lArly9pksm;j04Qv;e-_9lp)rTLL}Cudl_I>Z}J_!Iu}n_Z#AD z+t>79Y<&6qcgDWW&Uj?z;4@DFd~Z5@Z-LL)cbLVuwO4%n7J@IxzW1PK+gHCbW?!Dg z_mso;0{B`2>|5>dZ3N#ui64LSoqcgURs*0In=goa(D*(AJ+_J9#Z>xG?0zuc;=9G+ zYXV<|ZleB@gJ~WBafAh=Rp2xB4Yv3ez!=-U%}MN=4?UZ&@Zs3|-31okMGl|WSN~p| zwnB3d*EoDD!N+;Z`8UMk6P|uqgWsBMOkh33+1K)P&(cj?~-+YH}7Wm!_SpTkb z_=aO~Ndp)8ja{m>ItN9loa3 zvGsYB#kaguynQ+OF%FyWPUzY80kKBASeSGabGHi|-VRZxkjW ziqZHD2jBQ8Tg=uIpl90`0bd3h(!OGg?_h^-A^7+kza|;`4siI2{-Mu7ylN9c&NLVO(r(6uzu9g4xDGO#uRck?^^RUsl71&ckK7Twm=;?7 zjWc(fFtj~9WF9%BWgTD)H{K$3qTEJIj$dDVpJ`Ue{i*LNe*Rf}O zTy`djOA7SJ9g)7iu>8Hi;@jRMo{!&CfGN>r?E4UUHs3CbuhioEyYqRPo=3!dB&p$> z>*$4{hb23jjNUcSv-?e36PqvPR==0x9E@Ugo<_ijrqN{h-ge?w3cc*8R?NPW9lmMM z!zB|bIa4$!19`ufjvc>dzLXT}CQrFe;x7zZz#@Poqf-fV0Z<4bQ z_5>gOoW2B+_7&-68k=O>|0^kcZtRKn8Vi!K5SjlWbAv$;ahFl$DbHC z_Fd`lZA@a{42N%{W#45M-{}tDTS@FY#o^mx*~jV< zxW?i;)8XSo@1NL#BxB!bhp+eohb&f+^B&jr~$T?nQfqtEv)-_g*s?aO!pzcq@6 z;B*Rw&J=?yW;F|{}`n$m5JJsQv z3%)xH8FIrn%Hf;&vgfT8zC{+_Kx{rJM(xWR5o}*SIiE$K%M^JfX5VcVUxve11->Br zQXRgH;9Cn``pch4rytxuR&eVjWj`#R%!1kEwmTLt(+QMTCl zc7UGk?+%OaZj0{&DA|0|z*ic;_YU-IzHHnunf>Eli*H=-c)rcx8y~>;C+OLHW5G8M zdK};TEWX1XzJgJn$Irx=L=L9I9KP+~ z;+y60g-*ujpAdVKjD1%)e4#h-ybgM_??H>NXn!Yur|EO2%Qq5wcKoJca~lgK@;zkn zb#eH1gYO(ehTPcK$>G}ozG=euh{d;eR=j=VP7i*Lo&i1EzQT86e2-duAMX>-HxGR4 z0_@ugJ)3V0_;3j;e;>E_z8(@!jw6<&MMWvjgnA+u>UYzA*I2_nO7`2+C}3=2Za}p`mn8lJWQN(6jyB_@7w( zHd=hwIeazXOJ@fTA3yVH^W|)h&C^X5UxmZhbT0fbWXO$uB@W+C@R@y(`vdhjzQ;Ly zH-m3c0N*f&FYn{nc)V@#?d#n4l$;Zzl!<#n^a&uRn<- z8NUBQk2oUog%;nt7T@^%c)n8bnKo={_|Ar&&3700mZP5bZL#=HaQIrmw~_`+GJJf_ zZSxg>5*yzSEWYQQbMff&gWvyn$~hNjf9iQ_(I@TOYVj?0_*%jDlQ9mtvF{d#Z!`FI z3*Sc;-xY)7_;!FV$i6WS-_4)J?EA#x`^0 z5_Z`#Ck(I4XN8+)U+U(``Onx}0lke>kYxIunWNhny#gGbBSs0i(Yp+K#HMZq>|2X6 z*O%Rvef=H#n!xAIXO{2o8{h9N=;cCglIgcACMk8t1wE)S;tpyPo0~puG06!&b5j8tcD9 z3JR3g5km$I(WtcZ6(<&t@_o}Ixi5(J4{C4L75r=7PtL{vgAvo!HTZjLTU!+WFTs#9 z@A8z)j5+CZ_E~u7#Qn!*9`kHlTk!+i+S;ycYkQ#M)(r2cRVnKxd-=20&Oda-d5adT zP8n6@Wo9&wOv%h{9_cr?wl$CRnhzb(qosLdD)Q!$Y0XPBuYLSEXx|AAFhF`<%e8&F z@0*s{;hcTYgXe8(onm!y=&F?2XL;dSYctQeW?0I)KY5v}n@9L#MtEaJbU-g7(lT?K zN2HD!kuteA8Cp8d&*(I9|BL1?J#q1ZWu3g+J9NJ=z1ml%Z)*KIo_O6UB%Z&taPg%1 z>7H^ReUvx63LU_U5ngk;2h&HS&TKiMc|^){>E3fA;6To`kDs^fN?fL}9<3I(bgc46 z;pq)}U)+0HMkcy^H&u7Ibl+{BXM#mf4rPZwj!PMJh)3g7Gds;6k%I2#kMLSLHfLnQ zpO%i9=a8v6WAE;}QiSIyo2OtBNFFOHqm8LBtY`K75kAb#Jn@`;&Ky`%PgAH!J*~cw`M=) zb8Sk?j}5s!R43`p8T)i!-%-!GrPJ66rgi!pA1ENBbHP3{=Y$nbW#=tFHs>DDeRWFrYdC6%>C$V#`9S)w9a~7*^5es~2b{`j|0*w? zmJXM;xCUeIOO_tt;x6ea3vadX)DyJA-g}Fp_|ESNG4+xBb<^hBwzii9KZpDlYlA;% zFWn|ra+Z!3TxiMekv8{RZU1KBhXp@o$rSU=ZEYRawzd8COl*Dn<#_B%uwxKjegyYr z$bU6`S?k!bkTV@A`MaXigz^=5T_tkrTxj)ME4abP=Crj+^?*-)i zzgq0{wv>NCzBlx9@ERoTj+H#-m2P>C$XOZnjh2it!qC{=l@ngY?^svtWQ$6 z{pxwY;ni-!I$+lyA=l;*fR{$X31wte!AqHWc?U&Lh9uyyY}mu`qLvR z>8GhR>xR~rjMfb7Iq8Mb{b=0@grh$6u(qyyA3Jf^aYdPFBg!tw?E7q6+Z%0d+c2%U z(La^GHPvhG(0Ts)pC0R%GJC$)^3#Oe?C$9&H@9xM_MXiCXpaT0`-Nkh`yMgBZ^8Vs zZp~#`%bqRL^5&O+%N&NILHg-_=3cW;^U+UBQFB>WtfysT1|OO~=FlOT{iVaUwi7(> zfsR|#XcO`bueNjddk$6`77bGSzylqBO-Idu^aFQh9`Y>K*}MLRiW8Kj9ndth`;}s~ z+WnsEt@pdT9vt9TvWTNichesUkQnb5lB!sRU;cdg#By!p@}r>=ka*`iH%?!Y){yPA6% zySAa1$>^n5&*}x)DYMT9Ja~SF*Z1U%RZN^K)-IYr2PS z`W@JP*g?xXb^rXph5L8^`HGe*7(9RJw8b|*_mY`fXZ7{g9hhRZ@TL(_{m{;m2+;>UH`I+s%7ttPMhu;V~f?{ zG&B2}MJcoQPsyCVE<5E)6?+aWrW%epB^W=4pM1z@LC!s+|n=y6Y zS&;2#rY}3R>xerCo^t<$Q@jOe^SJj7M*A_DzG|+|p5qP171vF5_f)DLvF8rdo?F+I zKFuMZ7w%98PfVN4KfqfI3Z^&2%je(w#p2cT?_9ljy`Bo2?&7S{gbgG#^KsqhZGCf7 z*5$L=vh@|cFi%o&HBTtZg8t0eJVVVtbV&2bX*2KHXXdr)7YE_zh@su7aw5n-48fwc}Elgd$qN7 zKkOOIkK6%R?QU#qTfA^7-m?Bj%DNg&ir8&aW~5OUYgH^Zigq1t0b=W(5^>tEd+#@G z)4iLuP4L3=M&0H;+^ZYHGrx7q;^mn=wGBAiH}tW1A;sdzK^%31hwH{nsGVMK%$F3e z@A8!NdSA`yh2LPRjJnm&ESi0b3BpUp-pu})D-@UZQ>}PrM&L2S;mX*|6PtTw;nri) zQRlWaPa2AG8eAl^GqZhFCMP*Io~v= z`g685r>0<^8k4H;L(F*onvUxo{bBzqO3Pe7XTR=`{q>wTT0ZU7)^-Nw#Q&k~UErgr zvi$Mt?xgde)dWJ55R~fhNQZ={2;rd;z$UyD5Mw|vbl!oyOo9YQXOk8~CE^M_YC6%` zNt#zcnSsb^K-ozcClef*k<1HcbjLXEEIRHEVN@a#^821!r#jV5klD}Y|1ap&w@#gV z?z#7#d+wvE?mchtVifR%q17G>D^~s+SExJ6e`BPVAM4H^tz5<(BI4#{zIhq4@?+!j zM_WcC{in#%HildGuTy%f6oaQnf_}BK+ZF*ucPp~z9R5JDEw5892cIQ&R(V2+A z7U9kxW0~hv8*s7*+z-P2gk(!1C4utythuJh=X$J@W(kAS(g*j8r1(fYeic?_Nle;B zaZjN($)la^UXwHg+7$_~*;8RTwK8vC?*bjn<0gr_u%8*m?Ou6;#D{UGbB4&NVvXq)+0<9{!I@!=%GMNql$bd}Gai>B?KDhZ$Rk8LHlj zY)_OYot*d9&Ur@j8Ohoj^v$sk&VAN#_+P2_VzwmL_Cl4~o|J)s=>r33q&6#;LQQDN z;SXvJM?%_qyLvtf`X3XDKQT9c)<=j_w0`H$UFhgL=4~24(+VrCxg9NG=NQ#@AtP(< zFb3-F_(Q)hODK;K7gAp{a-f5J*J)9vu$mw#GcU=;Jru9~C~OIAWU8>eqh9YjhZT3a z+O}9?Q2jff!l2pRHIZuLNuzm&v zJJHjDq1CzW{q!giB_=ABd#|UlC2_{O-lSm2KV>=_T-!luFvbaeHimZZAKpWHwDokI z>o+OAxS15a^WTk*y{g~t-aitLH<4S^FZ@KXLUPS7zuPC9zrBXWsH!E!yEI6&O2JCV zY5U|>dlEH2El`D&Frx?jttFZIvPX~yarVhu)-+2}Q$v#{tO<@R6b0Y;7RRKuADZ{q zT)jxENpkGChJryy7``ek53RTZF=eI(foM&aTe2 zf!*#1bV;ysy(JZ|LyMZ*)YvEHFw}~T(!pF%j``_pUgvO^b4_g|Tz@S$8~f?evM9gK zyI4!KS49R(SKXyc&PQj&PpW#lT~rCntPa&xuunN-F46FY6j{J!y)tizI^cMS;>i-acJIqY;!qXE00AQwv*b1#V03Vvdjt=cTPu+B40@JiF11mO||ae2?;{Om%QrUnw`fysTkf1A6Y}yCv(6 z!}IDO*!9k}+Fpw}DYW(+Vyf++KgZ^W);1H^gLKqZyPBoi$LP`t$GEznhy0;EamEbi zqps%Ex@vEiL{(N%YqM0PM7oUz=@51Os7X7v+a96xZc^Igq4kH-q}PQ3AdsuMqOSUM zmvp{a*@NVzt-s4<+vv7ET6bcQ1LDDqpyaxMi;`9lGQGq?*M1C2ttb-2*j6YWE9#j<+RIL)ZmY^$5!frm-;c9PU+=huWz& z!TkzX>&-uE{o^#;!t^VX+}?K@mCST$&M1&!ETRnE^F>*7@7n{hon!kg;i@=z0dHz> z9C8hg;DUtFjI|by;C%0eo=)@_LfrP-30s#+EissMwuHk%+S-(s)6J>xcAS1sI_=!( za&BmKJ`(3#pD^8Jd!*LpvTdLWyAczc&$S9-HUGeGIQ05$f{>$n(bT`GA7@ZH~ZOIwby6)#ywQO4?@$TboSO6aTV44 ztXWnfEVVo5Ovd=Qtyg-v+1pG*%(U%B8Zf`yykZ$$Ee)ruXPezkO{lhMq115`W!H(( z@^!A^tl9cGkBX6(HVGc#Memt-YU58%Snq8OkN1X8tU4Td^rSrO)i>sboNREPvDZhB z6hgcA+iJF6bDx<=7QbGy3_H=Y-hC--g7weTvqt;6e_jv!H*|ll!d^rX+Nh2Xsmfd) zP;y^Ob;Kg5-hUu3TwUKHGu%!6ExpvF{OdI|)6NZU=Oe;(9P}8?bI^ZvBo7V~SP$xY z&04QCc~X$`fRhxrZMZu%1STU!Pm_lw(3lw|dn%l6W2i z90&RJ^axjTp=d2!&85N>XvwrT8blg|k4<}5ZB4|5wQf00Ugf%Mk0vTE=cBE*M^+;Z zW;g}wm61xXyXzWmQRLs}ngM^{B&D@<`Fdd?*F+r12+;s{@2f{T9eeuMopXhaZ)kRh zjiV;$kPM{`9jhfLMx_#QBGvkc+Lfh{cS7!&>hArk5f*)DQ~J4nnpO~Z`AC^>=muV z-QitJM0BT2ABn!hyYvK%BB_N;ibUu%IGC~V0G(L2i3q@89zNg>HF!g%#6I+6s_G(l zC(BAN9$@YKkcPfi5DrbBzEs_5otKlan_XHBTDp0u+qGy z%WnOAyert`4mOf)%#oKreW<7Q+)i}DU&chM!5u6S{Tmq>eA%94>AP%Sn>*H6lZc0( zJI5LwE7kFD_kl2u585vO_iBtC?w01KU$);rrjm4=C?zF>y(Wd&(I4Lb?I3$K#?|Ab z+@Bh2#!H9=Y@M@N>VE1rb0$G%XAGW*LR_az^@rr4qo~R|ImjrY7YQftQc!Je4e307 zh52Y=fdvY_&JkKve@FfdMnwh=BkjaP$$1?pivw{10c+rx#GU;#-KH1mi`p6|)x2~? zIal{kOHb9|_F;9N4ou0K_YOExHL1x6+tQ0XtNChRhI7pv_37|Ap081;PkPC=!FpS` za?W$C?t}L~X-Dr%>xfjd8B;$@GCz3*4J-AC^)fDXq#g+oV&GO(pE3yz@FNrRjgIB$ zbZqcC*C789jo0~L+9av->#LV+8@oZbJp!-ea;~4@jGTiI>uU|7D}#>kC!)c|z#WB2 zrcC{lJfA-@|LK}mVXfzbAREaO-3+7ZEuUmfp^B7<+hnYhyb9${nr1cG5S)V53U;iS5yD+s0Pg2Bkw}v)XaNLsfMW6U|NM zPp_h}nqST3qUMe$OY^%|tQa^YcEI)zJSkM^OuVY}Dxt2>VOG0Asm_i5m^CH0QuABx z_a7+06=oLo4`}}X#{Aq0&%l*9YjV)(xP=#YMOtEZd*u2T;xRC<_t@y&iPqS1r%0(; zO2b@Lb97xRSl>N}0h;xS35h{kz4R=*Gf2vf3dUrXHCgSDbbEJz3>y%mc2OXVZPb^+ z97<-&P!Hyja6BV~Ub#`D6eHeIpb;aUX?SS5U}uAg!f?Dz6aloOWD>KaZ52MVwA7ZHfVMZuA^i^L=$Ln%}!%v<3y2nP|{I`$4tryyRYV=@NZ35v@oU z)s}8=n;*~Vrs8VW)5fl!^6jUN7-`s!ZJzYlELR*JDnvGV%9cuQ@5M%sWwe)2Z(|Dr zV$xqcIl3!_ME|iz9nTv1jf?G(+YQ~`KlN~45VfC%0-RA4Hc)ol!uj7KDVHoU?)=F*xu5&V4NT>Af?4hlgxp(MZkvR(LvX5PQ1D)pmPVm4 z3D(=rb%H_glN}i-J4h#c%>P+7#iu>zg$*HZtY4a7>am_B4YRGGhS(oiMz@AZZ=SqA zwqcl(W~XY6^4+`EFMHJH-)Eo9Guw|RplFaYt*IYg!d%bt4wU2G6?*2ums*ChYrW2D z-YCX3_9@mELoCTl+Oja=jOwILR=D4}R_|F|W-<;_wt1Ge1Y5(6^RiMfwShJxNZQso ztS$HmSs?0mxVdHI@`utkb9Z|08Na*?Od zu9&J`Xt#{6pQMhzx(}{*ghKA^{!1KJuxRoyY|?mP#r@$(n0?mHpT^ckYExMU{!I%2 z2B926T;+vLsg@z7cfyzsz*^Ou@#gcVeq@NIrYclGiB4oSREp~lxV zP<4<-2uSiFQ)x>I!ypBvVok*(FEkFI)$QDau~tijCGp_A+bqkP6wKR1)CO7dYfZOb z6cI@z7c!qSy6t#6Vm%>w!*0tR9qdks#uHg3)NQv}&lp@Wk~QCuc%m847-E`~h}qG@ z5`XE6l}=gG`mWu6adO!07fDCR@hr52diMq$jG6A;YnmK-u;IRGO3E;WTuB?Iv@Ow= z!Xu%-m}fW=HthA&P5td}MbyU{o(rp*6oCe5xch)K`_M?}-1vhx<_vQmFw~C-b{{a+ z{~+%6i|+l>?1Wq0`#|e;?=#hp_#5U{-1~9)iF-dTKb#yIXzoK=A>Ltvo^T3f_GDy{ zS`sIXs7u1Y)bZfKTe-}r+7XxW6g3{!lZGcR@jPPp!7v?<$V_T~U76?#=~Vah9&BwiCz@@@)x&KUqI04v5kYBO zpYPh+R`7|cqZc+HXU)Mc z)+_VF8bXyzF1$sO8tiU*uQ6YJWJt}V^<*%`rgVk6;%0e_EhjvO8m1qz9g6f!Z!n-d zr+w2tS4liia?Phg{)g&3;{2NXJ_mn-IL)7MNABP&x_otF4EvwjjRRmqIf<@{6Yn~n zA3$t#6;Dv}z(CWXh$cJ=NF{gN)FAJsc@~2bl&HYm%{6BSrskIvrP2r)oTf1({{evh7o8pLlGeK7B?;R$)O-amAD@iAdYZ3Mz6k z%5sWx@=7WSoD~Hn#Thx36}o%nTT4qz$|`cQGfGPeiYqd5OUjCz73Be3Sq0evlp<$k zMsAriuLzN46y_A?RpbY7

          L>Z7;3JsL0PL&M0zb1>UZ#$SKZ7yhVYLmFJX~lcE&` zSzEB@JL#M6EY2>^cW%jEfHQ43Skg3lf-jH|6(brn9^vr!1p9C#x){;%1>Z zqh&Rtb=>7B8Op!_hLT)aEophe6I-Rb?~zNLW#u{GDtkPqOwD_V4KstRuPn!zjXzl> zW!aK{S(N2GwlxQuW+%y+TPx(^k_tJ$q`0IkCtJ?k&H|<4lH$p}f|rY670$dIIeTl_ zb!Cg`b=ZPV4UHSoX5|z-4za>AWawFtyB&rhqL=31Jya6(f|4kRFdC-vrCb8Fksp~Q zTVa{sX)m|$(k&LwRFq-bS~+JwTL z0x2k4e;o%|qzUD+c9riemosy6ijkY;TZ?kCB_~QOAY@j432aH$X$ASvCXkI&Av+86 zNP|EfhZGZ-9Tg=N&cZ<>W>ZzuBN7fpb$)P=Q&R7KcQsXc{A;^P`;NNG3^%KsDjVl3 zyS?kwySaZ-#W)K~i*Ib|!g4p4kwwC223@KVzsS`eY z8|>*j#gWxhy|JqrCJefxA!~X;F=`4$pGqx6ns5VaR4<_U3b~+Mt|%#y%k$A5Y6hy+ zew~BSNLeK%TMBa6%+M_5lnd?AdS>OL?s0sY+bS=3B1ck#NR+@VIoDZG2*+ffKt2z( z+rJPfc@-I1`8iozP`d^_)sU$pPbuQ16#8YGZ~~~8#gm`NDJ#*Gy#b3)1ge6pHSSs% zUr9=Sl|bHFoKsnvlLcQMaD&@u=^-=`@Ra_cG;>0z2UWj~`$A8j5?rq)Q~zP|%9KSq zqxMU$Pz)Ujxk$8q@J|74pC7m8y{>EXME8f>B@}>+LXjlli;7ERzncYcXeC8O=t%fU zPFb<)ew~i~mvdnoP!Og;MO0c=Qc;psQaEU|>~K-%AR-G@Dldo1ynIVRsecpY$3cy3 z9(9qjvhy?07(3CI$}KA?%E-!r3F~ZDA4;=#&BTYgCl_rkSDWQbwC_-&6a_Vuj;JhK z3$x|o9MlSU0`L_}T1_t~E=41m?W}OZ3grp#*HBk<8PGqWE(5t3bniI1R8;jXmP5XQ*%w9 zSCn@JxdmC&v$U&$w?f+lX%NFK%Jo5p%tCu<`Id}=Y&fZcitQOF_X@5`gB3kHzew#Q zu@;L{SHd>X6Bu+vqWzNR!(B_bJ6B#MtLG)!d7XcnM4#*WL=CMWrRY8x?wFG2>(A*k zK-W{!+2T+fqBo+;Iu7ZxHViBD?JItt* z7T+&ZZX#!QT0VE`)I8MNt(jBMNYWgJ7@p)#Ei8PzXfhhU&1hJs zfJ3IK4mD)PjA=9OnwC6cPJ(W_NrUmXXo$Xr?$ysiNhbW;Wl--g#>ps!iM=I>@}jub z1;({W3ZYxR!vuc)Ve;GQi1-7;-zHt453+I0M7&1q^m;#kjE~RlalKNabz$hZA3vis zTWaR}Sl$HJ_ez)e`lz^`Cq2X}U|A>JUnHgSH-~C^98x!bljsunmr7&#`|;Ps^_|k4 zoc=m-JyrSx&UD;|pAjpTe8BhB>v+k|`l<5AN&m_6E(`v#_^_2iW9@PLj8d#r!dd1L z*Q4l`?=VS`K1{&mx3d#nj|{jU7#<(G>kd44(Opsa+XJr023*?$uEzyjPYAe<54iTX zIFsKBFBJde0RE`~*LaemJ4_N5CD0uv=`P(B$(tQ;JtyFLUcmL;0oV5iT&DzFFABJ( zQXf3H4#P`~L{I ze>NcgpXgj7g>MK5?+wULoq8g^T>abTMAb> z9RBvnfcP&2$h#%r{<(nr69Vr4ARzuz0s5{D$dAbZ*AW5f|F?knvIEMKipM|;g5e-j zBD@SvfTA_9yQ3^5`bL~-4Islk_=6)FKLfi!EW;vrXe~dP@phcYGyXB?cE&%#If?N( z(5EpzhVx9uL8$j+I~4D4aK=e8a9%B7`X!tf6XrZhWx542X`P%X_8rv95vKHwW=uh_ z#FU^@ICdCZ+H9OedZ(h@0pn^B%^4(qhJx?j?+gzedMH zeJ2V_c|dCn6DA&7-;pro!FxJ>S`Uus3qYr}%?Q)+F=HyX3p)D$GL}LAT1UUin970j zU6T{en958zvmZ^##iX2~2U>7*kw{j47@~j4ADf zjB%367*jmYFece_7`RJCay30k7U2Yx1Ig0TF7!+R0f*3Yp^7Q(28tYqjGuur8HXJ| zl2d*g*RT5o*;l9PP=At%hwJYG=Kl@&Nd&ESL&pmI3`+zQYeACCKZ9oj(Nk4=Het|z zhqVbP?S%gho(jfCfvXrl54?-eu%jWTiSRP~!LbiN!*T(o*9e2> zPVgKjObX&?!_Tl%K&hQDc)B6Ki}B~c?-8cXKaStxM?9B6KTr4pqN2XwNAxS8Utl~O zaeYB}75?D3h@WA#fB^W$1#Ta%g{c`gy*Pq zJJahxCtpK4+yR-%jMG3Te?{~Kps!{8DDVcx-v`cS{A1vJ!WpXkLc)_(TtS$JBvpi` zs`OoiA^-OXyPNUffnOlJN#!BmWZ>b;D};II(nOetEk_AM&MnaSIANz6_HCw*0==DZ zrb>T@aF&X@2xqJKeZr6v5B@J0&jJ3DaE{8;$MjP;UuC?M`V#n2*uQ}m#P|-JErfH` zun|mu3Fj!nc`7}c>0jYIhVe+)n9O(@FpZB5`6_=B;Q|#;W1h#sGm~)xa5CY|D$jhT zw}QTa@o#_^Grj_xN_dOPPkS6tT1E$>+!@~syn*rk@SmFqC#w9^mm>a&pwnJrh6I&f z$n+4MN0`c)#wvtK{z}HFxLC!Q z%I87GB=Zr*ZLpU-#uRol;}>u)VoYsgDPs!z5@Sl&LB!_yy4ag|P>i+9pkhHyNkme3J1@oTsBa zG@hA^QEjE!j28eqbv${D$@e_Yn0(uFjL8qZ%2?D_CBk=U*s!D4%Lw*jB%2dF@6R30me0cPP0J|8! z2K)l!+oDSU0xDEI(jB%3w%9!f?XN=o{dv!ctGJX>Dt2(+7?FXfW>KyIgLHJAX zOkoUGX(nR{d7Pr7FJ?^jW(i~JldfS*{v(6&Mc^F9B)^<-A8;k(tH4h)rg&=@FM!Ni z#*2aXFdh%=(eb~`xC!)sW4sTT+Ehvx$^0?ntDqlaETMc)>v*~tQ$O*2#`A&y!Z-@} zqK^L`jH5ySn(-K5+Q(J1lRMF-YC6neOns~S7*|1`m5eKa*Xj5-Fg{B8!*~Pm3p$>9 z#w!rEk#RP7-e#q$ zX>E2&FO4C_pqVJ-5O!b@AVWhA!%81rx)a1-!JRbBpjP1ZFjLDBWbo@&h zF94m^btE~9fgfN@K7{6(iB2|9!Wb$@WsKhe-paTOxRUXEz`Gc~5Bxmi-vYnE_&o5> z7?aFS#vcNoVf-=hpBdYsL!XZSTgG34evL7W+lE13El+M`yaRG*jY*Lf;LSRo62|W! zY#HM&;5Ho(t=CCm+d%)Bj^4?573j2%C-JNWrZqe@9X`-_khe51EqH)G*YRA`FzlqC zaVT&o#$&`!wsb#Z%B!`EBS3$caXw_`GL8bhMaO@XaWv?ijL8oF%y0`O)XPbuTK5%wt^y^3)=^l8-5>3IRk-vk|+7-s|TWlUxLOUBd>`Xghq zjgJ_Yf==uAlAN``U+Q?SFs89lKVy&Wc*v;EsW0tmookknC9`bOF(y5qVY~x$g)!B~dW|1)e#H1m z(7PE^*xxbE2R_fZ5O_2mEKz#ffD;)L{}jg2kU2|7pTqbf=<^v<|1*^_rDYZ49l#lk zNoFSF2+;EwH-TQpI0^I}I{uxEr-5F_cqXu0$Kzp4^C$;(^uIBtdSMu$rqP2uu`qrG zIEHZ(@GQm_;MI&t=e3MK1bu^!p27H2&@&lR-7ICS06(GQuVVZK^n8i29r!TgB;eyZ z{3C8YKMDGB##O-U7^eeg>-aY_egX8y8GC?t>3H0XcY*$IjCTVc z(DA&+xB~Py7*_)ST*vcE#v4HY1LIA=f7bE*7vmkE_cB(1WAQ**vl$!XS3tj0N1w&` zHRS&s#z%oSGCmHxO~?NP<2KNrV*EDnKF03=|ABEAa1Ud$nNJz-1N{pf{qKy=gH98f zq;nGBZHy`GNX9dXg>f?QWF60)jL9bN*3lQ~=$SftKI5avlV^1FXBoc+dOc&Z?ZY~r zBaDBGxQ;R=pZ`-G|1TKN2mQ~C+kwB*@eDAgG#X>nw7&ra4hGn<~Z`EJO^Wv_ppvmj|_>QWNczg@f0$qcq$lE9@9b35$MqLd=^4UuJ*iM=*hat zphwY51UM$*N0`DTFs5*KF{W^oJmR5v=?IML*WVGBuz`Eka9W=H7x*bVNKP>9OeUP6 z^4OV9^8q5?=q3)Ko2=@YgzG3^u!wReOnNTBkMMY$moUZ&Z`!JKl1=5Sg%$ZMt6_7P zPO=Lb<0QSrn9|{8jFZ&Dn9}qrW76k87*qN>7|S^SjxkQspBPh~|0iP#OLa+0%O%D) z%JT^18-*FFd~Fmq4u5dO<42g{qIyD@!p&w(`9{S<^c%&M{2g&oG*Oh{IPCZlrnnLr zQ(Vc6ePslm8^x7-v$)7$afrBpeQ^Q%;sW-?1$?8pb`2F5Z1Mo;6h?bLL9<(WrVQ1k zD2g11$WLI3YchUBCmrT6CK)M=$$nB9<0RhsCVrB=n&}i)*d*u_R@fvk+0s_#!Abfa zV@mt?8B4pBFOY5qy1kt#Y489%CQUF{NcEW0LtCV;Se&j7jDX8RI1FXG~>6 z2kA@)$s&9TeqQ7QrwhYSDJqFL_*p08S-2)Tg%f25OyNY?0b79SFjS~#O+H--`G~6z zaS@;P{*uUNDl{BgK2HGyr9pe=hw_5-oCUhf_#R+N578rl?Sxr>L?J~@!5L4)bGJ)v`s@8GPNf+S*ng2oNp?K05Q#_9{PQrN$W0Lr8kSDf}+=-xEJBHh85WK$Z5PO^os118yb zGM&=CfHCnq7*jk;8B;u>4k9e2g$~0u^(^$SRI$ka87j8o6a`H8g&zPW9i}p!bXdli zbVwjP6Mt|l!7qx8jt|3j6^OW=P_dR*bS3f%dH7=}K(aJ@5P3z;0EfsciVz2-f%2T* z-9iLML8o{`T7W6sLgpdm3j>3A~oax%|B>v#g(nVOL3p(G0N-ENI4^cT?8&oXgWOz!&q%);)9r%+N&jX%Dm~95C z`0`-^5)fu*9HqO8*GzE9(v<;BzSv2adKMzIsCH)POvx*3H9$zV z!KhK|Mc#xpP^9*?=@2X4+)(yS!}uamKY7$XO4nAmxnA&h@%eP=yWvk;$j>g$U3y{W2ZfExVyJAEKdUouNKO3QV8wC(^tD5tuNtU!QwJacR;6zx>xFk&-4> z+|br15WFxetgA3YEH`2G>8#o%m*sbhyb0^jB7JK=456c+z(GbWGXfVN(C9)-{Zazj z4ay=i+wc79d$1;ND|41^E%ljKRz(K2LPe#lsYs7r^k7IfE36TvF>4j{pXDzrp(bt0 z&Dr%F*W0vSRgrqpF8QsXB9^+jVdf9Ps>O&lHOpC?kzL};A&NoO0pE~|b*D65x+6*? z@CKD3tz?l|P=QatrSgh0I%&bQyLy@`%5Qxcjh$|llwvU|tOYQ*`i%arZY`$_d`MnS z=HQEsf@hT!=VoBtjtp9ytsv{V`}h=IU8JORi!=obbmUA~a{ohFn~TiSTVsTh_XW%qc8}uU^?>xQo<^G$E&bA%xo} zD)mQw)WL2i))A<1mR0yI+ey*XdyebZHD6!>&N*7Q`gsbLA;`J@oIJY z%psLT)(FK^(?tV_rCt1ji}VPx%94{+nvqvlvb8jjQJ0r0Cj{NVAlc|L3Q(D}9;h^B zC`ULXr#=-(*y9C)WT+cdj%<@?O7b+r%_zqTRX(Z2#HM*Y6Wt70NOKBYD$Gur zQog;2&iZsvsbd)sbbQoRjL2tD@QfKKQ?&s?XsnJwBd~w!n2Sjf8p~=&P?;p&jnS?# zq!S0GCM3dU^-|2^F%%~n`_e)0{RZ-_P;ZI98sBCB!VCD`uEpv%YxE3*^r3q+?wkvt zmsbTEeXFk>#7DjLB@K^~2tNgmCwX!2+(Mz7yYWCo4zwS)NRps6v! z3-F_31LV<|o#fFRlO~VmQ}puax%P{oX@@57eh~EXJdn2uG?GX2W}3Wq7=T{h1;|^a z31L2*q_@DQm)8e*ABU*&Fn!{a_k#d=$(RVCZ_l+u6aB9N^3FeiX9AdDA^jrp)AYN@ z@=y%o*kQvv8;t3s$)k65_4-BRs`DBoZv^v^z2rh?eR|JB-caS?1fO1>B~P8>B6%Zq z^6m+c_a)@Ha9=w#{pJM7TMK!cz(n#!;YWO=Up5k|*RL`T^D&@nhbAure0u$kL!M@T zl--)V*#Yu)LEb`581vEPi~xC`LY`)SvCK#M{VqV>`;bTRYKNvDJ#W_QC+Dlr&?vpP z_z8=Y=XS$lav9MpgygtYqD*r}xRr(I%qvJq;ylIf9=@*atn!H~D>-BpL@`lpy42M~OGaZFG{St7k$vXh7m)8z? zL+RJdVHV&_$16Jh5^=4`n*?Ecd7;P*nF8=Zd~{3z6X6APf#W>nrQ%HXG8sQj9?gU5 z<=G*x4m9o1rt&>14{LzE9EUtR=-Q#liwv-rw;^vWm`EPA_L_cu zP)@JkhmiNWCXD&$@*e@|jVM%~N0YoenUC~q4yYfyCl1|S()&I7^tM6Xc!Vc;cj@HO zyH0xjnjnwb9_`T5yDdQ8hmfb)-)t~z>HRF&U*1K?8_K_Y3O>Dl(M5Q-5OPSrIXZbi z3y>$n*pK4Ac4+$jM}WLnAg={XByS#mntt@Hjy}EbL!ONL+M&t&L4dr)#e?Nbk0LaA zr2+CTLf(2!81vEPmH>Gk$U_zi{peY}CT~TUzkVxVd_&dWCE%kl3-F^Os6>6PLg`JR zYy8Mw=vxSVdN)BHnrh!cd~{d>Aq7)kb{zW6E9UG?-=eHVjTo27L3dEQ%tZd9vy z7WVYQ#!aEQ(FxwTdqMmdyLgPo`4nwl;my3)x}Nr_eVdBT^I57z zT-yF28WYa+{eXl$fu`!@(RT#eLEjG0k;3OYa2}=I$DUueF}{L$XnmM=j_(A{5x1&g z>AQ`1#z}mpJ5J^$yi|uDV7yjGOK1Fh4*y3!|C!HUEMb3`EgG&H7jn;yp zV-cU}`>~JlYs2;1OpDUupgQ~Vz(51jDO@@7mJa$}l8)_sRE;y3dF6Q7| zrODZ)S(M6iv%iJ~H{($6SLyvC2dTntKL1Q;!#~CK&q(^e^K>C!-qG^rp9uaL`>|Qo zK~EX`Mu{z;&WSz8Q^bZzK~mqSF(WR&Zge~?*+dIb^?Z{O+JqJ%+VLXo{^be{vf4A% zfV?;6$3c?VavPgDTb5$O-nPq1h}S+E+b3c7?^n-sf3V<_jumciRO6mYXVk5yoC5>a zj0$Y$q;66#qBcvGP?vLr`8@+-Nl&#*>=@k3_>_5}b2y^Gw$zqG*e|uS&}fOGJ-Bx? zyARw!dvM#O&OD=XnYL`Yu-Rg&hC5VuYsE&W?n*T#xJ{d(8rv+bqxP)xVS~k->8w^` zOJr3joGv2ARf8plB5G*%9`IuCZ)@21Ee-X_#?GmlAG$ zt%P7#s)@12nh=8!2OBx_g-`ZVWwV^{3jNP8*=T*k%E>OOd-hjNG+x|RrO z$dEW^S_gH7o`?e5gC(w}eFkY? z;Ugg@QbYn=O`q58tbNRqURw>_YMqwzwY}KA(-~<=t?hB`eXaH!kvp8&U@aMYX76pQ zZJs_b00VMHAWa2(l=!qz!;z4-YQ-s(v0@L^B}Qy59~!3gdTo&hW3V%7Tzo8SrIz@5 z&IX@9ccBA&=$WNUMigJ$F;JTShjwXpVc#@c1h!7^tbtYCj-CHpp|nT$?mpRqZVUEY zY!|8{YlB?2;fU{&(cm%~h3xLVKl9yOh?`W5*zS|Ikv(dFmTg;H@uT51(`pw(a9YCR z#5PMI($?}Ac@y&YINli$);9wc=X#qN6|2;a z5;e}4n;b-OhkMEX55oR;NifUN3#3EMtq1NndN{&5DXz6?;3(~TYV*d=S`q46W_B+N z&RiA*0oFF`d3alHOt9N7wz>ni5gfmV#7ayVuWyJxg5g zTysTB@i8{9E#hFqO6+ZX=)pbMo+p;s?wDh1(VIS~0 zwqc&OV@DezaGAE$;I>63Hn^RUExnD6uBC=5CB?N=N_+udsii4>j_s1Cd8fKTUi5Ei zgS_ZpnfnH4gS_aU(*}9bKXrULfZFM2ufjuFQeAn;JH1gk zogJnc-;5~Dcl4lcU!i^FYL?Qby<(4J(9|OBGvCi{OLGd^9V9C z5lPxY!y0FV5<)j#ePhgfYRuhRsJi;{q^3k7%Se}8_LtKt$+GRYTU*ArL|fO7w)mUXIrVKuM~2~)x${wS zw4w$~4!`}PR&g8;_|gi$Y#gD_+r1{imFF>bR!f#tb2YJ|zQZq6)kVMr+In5frK-lr zs#=*0V!7e)v&-|zFGOu$O*=db-`YGdaQIMacv_TUp?yx;acN<~57X943+;DUKfPDk z<37K@5{x{p?S<^x9ylP?8PU}-qBj%Tqf}T!@6JOt`ya_Qet1i7lRaWnZF}O3*=Xj$EMuB+qxu?x-pX0iSI z4}&*`%zbE5?!xg8rOo`N<^#4Sv`Z({&9l4r{@QWOw~uxYTarz6xE+3NPUlgmGs10q zW_L>pd^tS9?yjxvhvn1pv%D*Uj(!kP^-*M1gW-K_6L@}W_lgkOFRR8n`0( zs3!uTswHywVHtZ0wj$K>F!%D%R~1oDu#KfV6`miNqN@?Ked1vICj722tw9>>lDCdj z`xc^(K!5XJxYD`eZDR`HmK|xZ!m;q7mMaHijGb%HRJp^#mNXb0j~XlsYc?7zUGDg? zbthV>v9gUR{6*tZZfLsj zZf4Vmn`x&~*m8fk_4%#3y4U#^Uoy;(Y1#f(4+^1Jf>T7`{8ZsBTH~iJjGyH)hfh?D zx%p!(>Bt#)@Wnyy_~h6_-n?XQ{48=(5?I__*St;NQZFGU(GonPX<(Ws!ctccb*~sL zqotSyQe(5XIhuT2f@J>6h`xX;VN@Di5vt!fcS1cm-VruT7ketL1(mJNNN+SYoXl>G zk&xrJIdc1o{L>{K?eS_gsxkSMt6h1smFlXRc5VhfKr`Tq zpM_W(6?7DKzbLB1ey$GQ)Nprdn7{e^I(?K)s$5px5>xLnI(AEz^qS}Wb*1FP&yS<3 zx=LwxIm~XcN4d-SOs%0~us)v(>JNr#vD*#yHKM z9qHNz%lplbORcu3YG@aHR&8_8nX6gbFG@{qH&8}L)D3#I@RYxcjH3Gue`=p-ZHRH( z6RdM$V1e$Y-HmPTrdJxfU<=-^Y=~AHlo`u(GHdQMTnduVI8k{;L*9{)8R#;ZXz?%V zFl_`dVD$obkdZf$4l?b|mqlyVz0W2B^qawdDac?gStKNP?~507P#ssKf?l;+y7zh- zTatpEV*lY_bUak+o!6n|V+uvyFM5Ayyh5d1Gz~T>`LgFu>t`XJ5YHLw_7G2eT0%%c zN1SN8#3rjihzQ)Lo7;|`Lj z468<5#^>fG-fK^trV`Ua+Zoa4H=6zNYEJ z_1u)gTrR1tfSNZoGpS%Ut9wC%WEs0!m>YK40J+6|@C!JQy={$MN=RSZg_iDpEEi4k zuN^)m)%}jCI@rj6Bk1}TS9~%&VBMKL(Dj3MH8{qos#;KE&0ui&*Wqdn5KV~D{5{FC z)bRwVutqqoBV>`36jh`Wa-pTKty^^fYQNd)+N5eDY#foWmqZQaqevfLsBY4*lBBf8UO$LV(@F#SS%-KZ z@O_Jgs#rqM?HobVD3NG>YgIqny>FVhDLj)oeLzjzf!B2L&(C)`$mckyt&3G$4wD!f z7*7XDryW7A=J9oJK5{^`7r6gOIubiKha5}_983@_Qn_sXo5^dRTrC`qayfU>G?#s{ z)qdyZ8Hf$->48s#3TkRGj9o;rEs|V|Os+-7HMR(|frjq+lPMeTg1vh~Ef(_+&DKUL z3JU+NF8o{<_32ISRO6T@yr~A!|B1k?9kiMQAD-T8&DTnBgkP|vIVd>_i(;eT76(dw zZZ4$+$*>-#@g8cJb+ln~>uI%GQDsI}ZqDD_T8+mGKksIH2AP^XsdN2RrDt9;v80NO zRs9L79Z$ws_ZgIPRXfC3Ymrp-f;P@tWLWleVlt+&kQ;fkS3S+$xy)1;KGg7yRXVgj z0rhA*f6!0?JFt`b2XEYe@HgSv6247+uQP<$k6Fy}f zMgXlCuXcTlX%Tl*e|_6@7`N!hSl`b)g+@ zz~zmqt3KT&p-hg1d=!kXl9=<$Jm#`J<8tnRs6+dbDnun8(HMjT%gf*T07~Hv?5wOfgbtF6sGi31*m%5&`+-1}HEYm6fP6eMe zqGKg)W^4AVCzf7MbT=uDeSu_Kgr~QTO{k{yYO8I;(av^=^&i6yjMZ$#eE(IbhuIRx zPIC7mj~p+GWC`<^D<-(h3R~5FpPo$!w3txpTU+!3@x;D*32KUI67_8 zrGnPjpLh#i$3(2u5a|sKC-2%QdqamceI~m@L%pGx1R zuDzz6qmAb8OG##Uu>wQlS`PT4P@_K>!M3kP?z{I^HnvQs{wx|{le8u%?%_9#oo>nX z^YOL4J6nzB-D+nw^PO=l;Q%C5u13XECwr93>yo`)5td;|mTG*y+XEG-Hw@A#5~%gY z9fzg$J2FGZd3ramOMJ0@hOy?)Y9rpg?@ip(%FwYZz=w^cbdjHJ4GxEV0pVL+t!fAq zc_rB}gwM)vorAfq{4XPSz$~ zP#c?5su#1CMX0fgKAibqRo~LRFQbQa_W2f`AL!ngwpNfAmuJg#{5by__8LY^(eK;9Rg`l(bw zyZ1FYrir3zYHI9LJ@8;Z6vbqI=$d~SFML5wsqmXM52`Z&=o=zMEvwD-SH-+Wwe^E~ zFC6yC*1Y7y3QhW@A`&=oudQ0=!$Cqv8#FI^|ug9rgrhDJ#h@Gro&1p;G{G@6&mYT4B^vrkDqq_dN&m^YD|NAdzI7iGe zB!0~mr?&^M)~){LoS1i7zXL<%VTW3q22S*1Qq%J7!MBW#8B*gz@pl=KPw1{R7-A`# z(7)MFQ&BCeMYz~!;**W$d!%_(hs@=ixBG8%d@#_yBeL#i%4(N=?D`9qAX3YW*7~EM zejb9i(jzX-=Q&2=ff^jcjIQyl-hUtxQLjxRB6_A~wdO%YnL{LudYv_y19dyllw*ur^;TrlBXZ-5^%#=vRsC-wbs)(W#tGRcj`94Zb^k@` zLe(}a$I!+*WP>Zn#B)#y@^V*g2WBg4ZU@zX5e6CaH?rmY&L7QD3w{4;KYf-TpY%)U zsySKAs~!GE>8M*=^-#Mdy0$s(#cv!(2F9dcw$HVAF58V}S<3y9(Y#2qwC%*0BUPIC zQ=>VbX9)Jc2}K8!Dn#S8jVV%+{c=ljQZho+IHdXcbY4lF)SY9Eo#|TO#Q}N=t8Z>dNv1XYTuqq(dYWVy4=%h#N9J^>tCB<>C#@g%`2VyYas@<9! zAO+b%Z4V8@=5@f9_rDYv7EL>8XC6l!R8HiO^~opsqqX4qemBX!Lk*VEcy@sy$nxWe z%W<0~=QTf8+@$gmIbjahc%Ho>4{B$eWS*myV%pY^YML}9euXq>R%*UXBR|snvY#v^ zJ~vuzJG=LP3x2e=s*UfD>3sW|CEByvRggk8$8Arxo-n~9gpo(+<|(}ci3n43*>jj`8C(EF?4_C0NwYjb|*wM)6*@>uoL0UST3;PM3^VPq4z{jt8;`a zbYyOHnbNyl!MMQ^<{TJ!F028rAkx#@7G_-@w9poj-qUi<9Zp8>4L3;dM(%z^MviW3 zh^T*gwAzMh4hv8JzwE=vCT)9|C3^V_Z9%aQtqe>1_FK=n#D<1*@Z#dx?Cd#SM~tNO zDxucCTOJediXiUvp67x+y}NUoQhPk-mZ4FUst!lG!wk}i$fj3ibQeocM0m_^HpC)I z%3Yf67Nt=02Z|DX_p}&e;^Nse+hZSsoEPypC+&kP*7G6kJMxhKHFrpTF~aY3A1L=P zkKU?h@VbiUa%}>v#%mjKDAn&NFZGc`Dsih?9j`V9fd(Zopi+GgaDTXJ#|M-ivTHNE zoM@vD6ykc&YT0)Qe_#_&T!f7rAbYdirrD0_-VZzvV$159-(OKh?N6wgNliA{)QryQ zJb!;+6u2C1*OX>!^nQ$S{)snw{=a3xOA#{``rhIUkj?M9fk%n6wi!>yEsWi@^M#Qv zleF`d+i2#pHFj^cnyXi+IYio;o+gQVQ3V6a(}+3=g52Dut}OHM&#BV(KBcSXB0 zQ|OTp;>SCi65hWQnn3oA-pHEel%6u$1_tI&{Ca$Fchl*bVUpWqfD^P;)kbtTy_i@fF!6}|2(`)^!>tp7A#F{5Jz5%rb$E~xxlAeRx|X;IqH5_i3e5Z9of9`6fE*Ho z9=nWDkv9U}f9qx`?jdPdZsJ4Mda3Le*Af>iw!GwD*$v{|+70H;k8bpC8S(|?@RZT| zB_%A@v!r2^#b^yR#QwlCx;0FC^JG$N!!RYyu003rZZ`IaIx4JH-!Vf5i0RhW)DJI( zNtWduaNx~kha&w*q4rL%pEaON5WiZiZ=`eguX!WK!NqzNIUtHy#NoMwr=(o0ezNF- z%9zS}hy!Iy?hGgXY@t;3ksj-a!qk0_6y3b)1^eUTuloujhoZ~YdvK)n(|*Zh5;@>19A zGbsx@g1qlUwEiLjbrzMgn(9Api?5tg>GJ|C?a~&8U56t%v5N? z(v7%jKF?3#yg|64@J2D>xN+WT`E#@LcjxX6LgU@|Sv_LXlLpLBg(F|B2TjT-yq_m# zPvEonP8DgwykM}TEOd`D*Cz+NM}_P>VOPsz@10tjsWPkeZto*>q?60IP!mSyYF8J$6&d1+q!q@d!O`{5W z;b=Q7vsU919PdZE_jb-lO9Pan`7igG)QsFa9AP1uo~5QnruRSvQ5Z$xRtL?IiUv)cStiei zCkWev%r*Sb!~1)o7L0<0i8&Qj&CVyef4sL)Fu{=pOEug4-8tF|G6rN%o z8T#k&n&NovP%%BB)SAHVZhGOmc^r{AKllEvPG{1$3g0+pj>4;YlkpVB3(GhOJjuEqe-qOt4NkKMq^&jF&>b!%zI(=0 zbtLlW6SDPTseNDjw!?#&G1!jUsDEbt1`?xA89xfaa3-zJV2*$VPOh)N4RInXPFc>1 zx_{W%XQD<#(5&enrLt(zHIH1JfYUGAaB!qhY!_+ z!0XUUkfA0JPZ$N!`m*FseAzPW%^1UTVM;VyiWn;-X5}4MyF8e0bBs{Oe3ZgL8+M{y ziIBcmSM_qrs)h)!NvdzWqiS!;s=5gDOLsO5KU}lKV>C}!`zi>k^+Wvg2~w0xUD1jW zuaCQ$s_Lq}cxHmcSDL7#MtnJ*rm1;Kq%^HUUF^9!|gROc-rLs*0pgP@Lqsre;EIaABF z78mD~P2E;fwqlf7ZH=i+H`))w&dniWYJ1VrCTc`b;%zv zIkBjjqz{rL^P)jAEeR#!&U9w`N!2)R5Du$uO%dVz#g>+pRFq_u6w17o*IfCL3E6We zWN(BrSg2`xPPVLSl_X~ulxI21vI~myG)1w#Rt44oESI*HVu3T=DqZ?G->ST9AjE@BE@+$I)MSq6!L9Nw1*N5QPo!Ek>LgjWniMVG8h95gJz;Guv5=fToGg|U zC33lxTe7t{TYfO73_9MArMCv}@h!gv?5?{@>u)(Lww7VZw8FfSvVw~IqVnsRwAHI* z6jlM&m&=mHl3L%zSz3bCDP>x-%vo_gAJ!H1l{uTlb+Im5y7)R8ugfV{kh1puXrMP69j)HU{*VQ_J3`D*a z=Os`L&nb8ual;HV?pwKP?YfLL_uYTrk_XloDL=UA|1tM2 z@KIG)`|z2WWD>$y6AWX(s54w7NVo(L145fX3_-CHq-m%k3Jip5J;mY1joXDwU2G_@RD{$B_m^&-U1Y6ZylM?BU)CivS$jbuDy&Nk{FWA#aQ$IY18{;@ zg8tb>->B|}z9_d^lvoC<5sh_$Jqiz}h1k89n)6c6iMmcLMt3(f=s`iO7M06DbPrB} zvRdpiTi&V4Uml1wSd_bn9l3{uu+!|XPe&cEyrTru2-Jv5g=LCYq8I8G67i#4vrK{=!Cjo14r<1ZogusBc*6wH#ECTFjKJz%sZD z3my(>vXG+l$c6ACizN+QTyphg`-0R9Ee?NO#ueLBWMq}BT*I2y7I&HDsE)GbCFRiy z??uBe9GDh`;4@kmMF~j{*b}KaPGbEUS)MtVd+?@i@WK@=oOK4uS7I<&4r4eH!|g1` zzAhts&n%y_Nb1_8M5OMmy{?&hOr=|(ObWe~IkJxL>aX7@cckS=HXJgvLr#l#l=RYR zINrA1u5u7zm2zF(wIg>)@9gDfWFU<$;9=C^)^glL=#_A^q4cDXEK(#2KG^TzC#vV6L5(lNVSND(&L&RuzNg!E8vkm=q`sSn51W&eQd|kXb}lCTi8LRy@@1T1)-fYk4&!=k8l9O_O>b(QS0 zNmy(~dsXpDv>6eE**oX!(W>rAP(%;2{o4;MoXyG}Qq=Pdq*6x;j*ZnX;P_ zbR~~j5^KQn=*}dHt0y1x(d05fEw(oRh|=v6c8Ns?;0+ur>Wi()qAIJ3X;e|C&yBXZ zE(^DB$X(s6o36+Gzm!6{H{2LwrZXCamNEOL>@ICLTHD4l1=C!~lFG>FB#L)uP*vBB z9I5ou#h4B_l!S_~W@L*lU#VwQG+zu@ylGdx&CW5BQb!f7TwJzdSh+m_sN&d5R&F*S zO6uB4_me2%xK%&3lT>PNfpip6(gJhP`&S=8&?C|m9eR9BC7#2ylP z+%CHKy0*-I7_tOC3*MpiDl9N|%qVzh4x|;AmzS1J8a;X`9%8InI0~zJKD)%asH|kk zXnJlRiB%nMY({}2z(<^R%K2l*jJ;}1=GckD`TW}vM(O9@pvPG6cX`p`vEcN~2p%im z`Y6UGw7Te*EL-ifN6H&G-0(SJxA*IPft{$KkfFQu`Jvf=WNq`kBOMsrcd6 z6v^^y>Uya4PjPbSn#aUFDA4|ZG+bzH;wqY*r6hp;HYqjpdti?e=KT*O}%Y2-g4@%p+```VKD{?a~mJpC{0!1PBQ`p_?>4vc@t zas8B|JRiXqpbq4J-Vy(G@qI-e#(ygPL0``!kihtB9s2&zk$jH^yVe4|bF<+o3OBoJIoqzv773`ze!&@!K8tdEH^pF^>3$9p!!4 znV&=7mu39b`Q74>|D;2|Hix`4NBjzhKJPl@bB}r*SiZfE>z_OH?{wIEgY<_-2eW@C zSi7YD$kq?NzOSRd)HwA0jzeGWk*)*v$#>}gfTKUb{&|0ha;Zd#WmXIppLFF zHYTqt!^Rw|l3@q(!sWffVDpB7vQ{DI)F zbD4p5PdRr3(=R>kPdoXD(*Y2Yh378Br4V0f(*r_J1APebG@G6-^ba9(JaLXq&m_Lq z##zFHe-yX!h|_HPETQj0+Css<04^516#VOnb8Y@jLcb979mLaZ`fj2B9%-Kt{C8mP zweDg85e^d1u<&50O0(LZ$mN+CvF{2laE;u~x^Lxlbt(9;Ef0z6*uKH$lM??NZdBL2Fa zHi!5|8_yJ;MObdm5j-7uf#8wA%LMO$oN~cW16L5wvgK3>oqkx?6X)A>j+w66Hr^~e zd%@En_!q#9f{y_=3w{xJzu?~kA0)oXmh+6z>DRWEn4J~jDDgLJ{DSZ#zz(kv%i`-b zp$9=fE%<*RhkG8l#3Awr#O(A4=ZNRp7>hhr7n6`ShWJ}H-6!;UpeGXFY|~SSIba|J zgr^ETX@Wh-cZ}fWpyvoq1bwF9?*MaNV;gu4HeWz23#nqEAI7*}D)_g+6@otmRzB^K z_FA;JD$==mD?(U!7Jrl{EXmK_6xyNf!m4a+wxx^USQ*w zh(k6$A^iOAjq5d*YYo!AE4TspjNs$I9|-;p@TY>G1m=X}T4>9RCx)C3&=UoJ1e`3G z_nj$%Zw5{k+yER9ya9L!@giGh8gY@0(}m~f;29(MZ@}XP2T?DX#EWhI$;4OKIEQ$N zjb{q~C9q+kU?22cAozP=Dn37!CaQgA--TY{GZ zpB8*C@VkQd0DmCZ7mL16yv)|&Q=z|yGj7!^*C3l7Lp&0WTtJT}4%l?2Cw&j-iNu%L z^kkuL0iAyBU8y!bRp`q>4-gNu=|hChd!;nu6q}wd^h-b=L(Ih&!g!&7h_Yl7FSqHF zh0gw$MT~U;Lypi7gPupc!lus@dJyMX#G`Eb9HBSjTqrozi!n;@Cpa$rQ@!IWJr z_&V^H6A!UvRtSAB=)A{st+eS?#HBV~FFgMZp0MC|fj0>riM8uy!E-?0DmV<>Ab2It z)SLD4U5MrKIvM3=K$lb)=Cm;6DvaqJ>v9`2p6ZexL$x(bFwHnsFivVe81ke6=LtO> z=eq=F;=DmHPHKM^@{a+&Pw3-u-Ypm>>rufAaDH5H5zZ$CvunRE7$>!sqf9p4e+!-S zhK2q~I;XaNf&s1mf-}*lxRxUi*ABS`&kVt(pwAS{wZJz8bDEoP@Glfx1X+AeMwy(i z!UoU1f|r4QzhKT|+Xa^cKO&fO+K&ZuPW!cB&S|d-UJuN57xUu$_J-h8=oycL^i4Rf z5X`a<7rYsCuA|7a6~}mk=W4+_&~_#XW;^2ZLGsVSF~i`$QSbsZrX_-lfY%A;SY9KT zy4^3B<9ZBaQ6@uz;0n-(30@04S8yWIg#=fDzCtk5mJ41F`U3|2LBZ!>n{9%*_8bg8 z=F3}{D+GsuZxEYR9#REoLC#3QfNH!V&q?r%6FU3K zM8QLVvkiWZQRL@PIbCo7_-2EL&(6qm2K12N4}fnM%s#@gg**&*2|fp0BbY-C#}@K% zU4Oq|4!O;O+1`FG7-Wlk?U26(N1I@-kIor9923bi1~&XmFx%JV7@J7n3^_Ll&H{ar z;5ndwTQKh->I5_2O@dE@{yo9Gx7Z_?_4uk_wtYT}V_rUBSDcO6ei8&z=7oZjK~EOU zd3=Ciw$<+${Plw0LfY*HeUE{g1fnDzLELH~=! zki&f|D5o6wUBMN={}#-3Uo!3ubY24ma}7AfpidLL74$;En}8P?JSBpu=PJQ3A+HL9 z=R1Pm1^v5%PXjj_JU8G>H`E--lJ3a&yMxK;3Y;O`1v4}7n| zf4^X^ySE751iV!+`~D8W4Zz%wjC#I=d=CqL1^Cy3spoOQCqREm@N2;T5WF5Z0naok zCk#A5Fw>?A-URyPf;R&X5=?zY3!a1YlLRyE6v2g{X9>Oq_(s9JcUfTYFA|&zI-kW; zA0O~qgXb>6iJ;dAP6obLa31gugZ~GDw}Rd*nE4(uc%BiQ1NyTD51%_z2ZmP#mxAY% zL4QkdJLqoFxmAHfSi_X!RFryD$@1-}J5j}?3xc#7b6f#(_giv*{j zzdUWwTLlL|kH}oo3eE$4o8Xzie-xYrp1&CU z?+Bg+o_7UTpuW!=Jlt@ZcH4|PN)XIBWq@Gjn<}^k^veZ513XAD`^Z%Wf2QD*tW&`p z6V?jO0{>=%{{g|1p~sH}pF!F~f5v(NXHhI8 z?`1C+O#VTF<3S%P*atj9Fz4%Wf)hbsE0}5T5}XBkjo=*M?-@Mxf-^z?zF_v9M!{8( z^Mt|wW5MIWf56~BZ16vC@V_Xy6*6BId=&T}f;T~ar{K-N7hfE0lLG}G1^pU>{#C(S zQTA-X4Zt~q_d|Yx;2ogP72F7XyWrixD+D(K*9d+B_#VOgfqyJ`2xLAZ80uL6EjSJI zmkj!E1vh~HnqZEH?-@L21kVKhpMqxr$D~Bd9w)dQ^nQXl4i7eXt`J-V`f$O;z?%%7 zdcjYie;qUEe>Ct(!7bo~ev1vi48B6v6O zaDyjZ@Ep)b3oZnnBAEHkH27~6TmgEa!L!uhxlQmg@Ej3L{azHD0{ptce^PKN=zkU* z0REf7^S5z9 z-fqxe6nq-=zZ!JcrM3>cq0hyF0j+_8n}IJC`~>hwgJ+!JS0M8n2K{Ei)H5V_Khl;O zJY|9pf_{hK7T`+3nZS1&{P!DptKgH6|5Jnh--1to{uhJ(uHbh;|3om~lYABLd33wY z5zKccGY$HUf}eptvjw*TR~S6s6}$jx?-R^=X%PGx@GA!Y9|cpNL6=8$NE19BawZDS z1YT$G+%5P6q}?j`9Pp0?p85}XJ8Ex};176|4$x8;Hpf!7KKi&Z0-@6EOd9s|5hFj%Y~ z2p$6ZGlJ8Aj|v8h^=rYO!X~e3I(SZN44%IWP6qwF;1uA?g3)>zBAD;l#vAlWf{Q@^ zx@Pm@7!7F-DW&jc?6ZWUY#{Dxp3#>RewY(2|CpCy>|n+*Cv z!6>fvwBXI)KWfl_Ew}>obAtH{-ZR*iUj^(F%r$4SV6Hg_38wrs!Rx_4)}Ut!-U|8* z!R#aXf_Yz4Xz<@EI1K*f2E9!1CeYUz^ss>+Fz`0Pw}79)g?qEHI3sI?`Mx_|@H`jF zDEQwvCkpn0j@tsoU+2NRCiqPV!BDE`)H5J>4)74ckKmjpnD5`x1zW&l1YeEwc)@(H zk|~(qj7}EJ_ZwM)$3o{E!5@I0C%6P?^dq>wMerWr1%l54 z7YUvTTr8Mrml+t)a+UE{>^aiLU{mjHr{O(-vL_3NpzL|Ojg<|-zX&`SlC5OiA2Ouj zAckqJQGzM&YX<#V!IY6FnEA{R%zRib%3-}JeQ0b1Uh8j=v<{@JdW1fI1rFeFiO#AX zMQ51WO2)kt!z3KU)H6pgz@%yKdCJvamN zBZfC2yIi8Dva{%K+WAWGCu6P8Koby?cbwpeZ9!)`r9Uur_@?mSq`viJTIRn12Qkw! zICY~9mCa4v#D;i$XeDFa%)mT|DHGxpW;%3Pg{kKV!PJf6KgmngZ-$*t*Y69kTR`Nz z3(We^-|3|Zy%BWcWUSQ~l&u6$#5L*Ed9q;YoF|w%&k{_Xl?^5BLZRcN`jnPK(-2e6 zoq{RnF2S@@tzew2O@gW8_XIQTPX)8wM+D|C>5hc~KaG$_qG>7jPsm;7DG;k-X;HX_-csk!gte zKNC!&`##fFKliibL83ntHW!PHl^CGb<5Z&b0Rk zW;xXO10L$zD0Ip>D0n>1t%8~MnBYvDUpMG~797C&ZwCE+!L-u{f@voP{VgBm(w+<~ zGx6g9-RfnrVzKK5Ja2+!-9ZkiuPg=a zd6~vTU^&Tu4H_Z)e&icn;yL(1$iqRN?}KNi;8NgOg86?aWF^n5$hT1NSAlOKF2xVR z0v!6g)*|A$_(3Sf!L-Z3zfACRC_9sp&hMN(z+9g(T!4d^_M=URY2!hH!ETRZLZ2#h z%BIemzd$haxm9pE&Wi*m;=E2U>tVCt0M7daGvB8KvmV+F`b&b-aQ>a(be!K1JO<}? z1kb|xtl;rDPjE%`ZY=${JC13kfQ%V*tQEO-HMP;e3OIKi~fM8Rw$(+s-$W(nnDdnq*Nw+b!>oq=tD zfwG8i#Dp79OhX~CZjy&8Xk8|lyg|X_WpGv4XDx?UY(tdU*3TYK_4vl}lm05`0b&*$ zAq@xVcVi97y3{&QPBJC|%El`@g;~E>8gwL6^dUGij{KCT=3-#VyGH1&mt4U(S>F&$ z`Lq|)vRpR{X8x)TgPsUnDRlC$6-+y+aS}W%UyaZMI5YIL?xkFo_akke8x*TOMsZ+9 z2;k5*VcE1zSUselLfVUglZV^(87P?LRclV6PZ2t8lO>okrU|C(>jh`xtmXwtyF%zJ zmzpC$4*-`7ooSUFK&Q$_6i{AsAaTy#stqv{w0^a3|moF-fx=M)t&%Mg1=RD;<==HzLLm}bo zo@KABkz&|Bb9(W~GQVfpUp7r76WfhLG!x~&q^uX|U&!nbtNhHsGZWnXe6B<%pXqtP zE)kvlDG_FrtxhDW$5zmT8=ucrr8j;vUt6W9pM~XROMB5xd^_|OtNc~XUja{$hE5I} zE-EQ9BD=SvuJMk<;+|tZoxjb83&zit)FZQ5Zqt>krWY+UsD<(G3RJ+yK{A@)QDthx;tK4R6d{M_wrKHtU8OX@@$7e^Woo2GwV+FW%*aH zgm=Ess4vUz=%ZcSODZRzz1DLNtU6QlH~0yhU$nA|)$EZ?!jf`$kBd-gagt4%Y8+8_iSyT>f6qsIh$KRVtl=1eRuLsKm1<44FXs7h*|z9* zYZTn*EFLxe>)#j&2R69YYMVWId1*<6PASWa=w8S6Hl|!x^^j)fgelsgtB4| zGD`lJk?Z8K1yC{DYSt(^+?fvtb8z_ARZUwZyA)=eS!_7%iWChVwaYpF&8Pp=l5a1L zM9>~A^YWENi^V5gw6%2MGTVba4tI&RTlAu+C!;R0_KKjVSZT`iF5V@Dvm!VdcVSR% z(sq@rd}DTrgr7q;JZOXAri`vLBhgD%FOFWQ=3skQLg^h5rf)IbZ0!VSBT?^9s4cVY zcH>meV&^Llily+K24`Q6mi%Q>m^{ifYv5ATUZJR_%%LBGoorDbbXcwQ#%Q*8#p4hJ zm&|wQ=^smm(q-_n*EK6;ZdoAo%wac=C0JFI6+05!ZKGQhEDQ%?re$e+X-KwBqyF2z z;Qk@Xs14-wa;E8OmNVU-=?G>nZ5&hHQuv%#{bYU_oVRx|yJ-0NOs2`zkPIQr!5&xa znGb&dN0pVYhWlHbE0^c2kf9&By@D`rEl-f}JYW?^>W~P2G;W-Gu;iEj-SL^qP!!C2KwDs2_wY=X;zBs9H z3;6gvK?lwEvLoNXT02kX%V&5x-yb>TRY2ZtTA1+h@-c_JV#r$nI_2TfPedNSt1|2D zEyznlybfAFzFQ~Gl8AOgKRgbK$Q$dB=fiW4KS~;&w7iiHd5L()Q-OHu*I)Q(?}w4V z)bBLp@p+F9THb>I#90y%hP=tZl*i|NjHA320H!=Xl-S{}bGG38Z3-b5ylKt6^zhrBtEr^|aO;1q z2QBXr5KR4Es=~V&&{!YnQW1H4>}$$vg*-*Ti9yTb^I22gvg&C4!sHQobK)KHM%(?I zvKX|y8^LGFE3S!-yGRm|H_jn16Go;_NgcF2{$H#qujOuhcZGuGfsyk)<9s+i!(o

          $G9@(?Y}2F|BjP5$~%t3l(!%9rh}$~me&q~Deo0S-c=Guc`NZ_$~y;n zn_ZBeqn}S2@_jdqOzY{PX zd2}Ej!#e=PS-e2FB^;fPIDRmW_In<{lovo{wUQu#d<^t~LY&15gjXOh06ylOje~KN zM_)Tkj%romS z!Dj~YF=X|@`f_IHO28^!bG^%;ZK(NXKtJZM!@H2zDtYMsn~2EK851)DMi|o#+ms38 z$E%pJ)M&QE|<=c`roQ-qx0NJFhgDq{V+ip+iqR6>q%@uy=)b>ii@)z9=Ffavg)`O@V2{W=UM)HtV^0(LdRo4 z_*U%?i?bjeJ5sg;pcr(5M(Yv^eulkS0|$1x@;f`*vrpuoj3sd?_EHTTX!59Rj( z>^Py?ni1UR#TU~Ex}FCiijQX#W48#|8IW%%MMu^DJden~JKs!Iy5s&nPzlfGw% z`o0?Co`i=z*orsqq}M8#mlW#0lr z?W|L~gu2mqJSSGY7ki!+s!PxEMf%7;%X+Xuj1}JlHA0%;iYq~1so51!`yBebGvm_^R)_%9?00wC9ur|5NA-V?e`|_bSUb zz!$%-Ps^$e54-loZ`kU3Bp%r|HJyBXXVb5(4clBdB;coV6)W^70VY)aZ%RVJ197-I z(BxJcpsR&CJ6~s$MAV;S8MV`OJm$nIoAS$;C0E6y`i@<|qBi753X68rLt)$FYdtJ% z|474V$40f(xh15^5YfXIzu_X+K2O&sG9^LR(9FJeIY)X_uQl5JU6$P!B4g!*omQkx ze|YGUoskxO$$qrx$1Ri_EgIDj)2-E3Bq0|Lfvn->b9Zt>-?}X|$Fl0GD_5aXjK(=P zTlM3qzF)8(uph^rkEvs!3U2eD9jo@teKc#kr|o#Q)c2xJ6J{C?Nu8Z`^ZtLMY{j~4 zB|Q}kTZlhddNN7Jvp0NBvCOgR|EW5|v^C6{yK`>7um9XF-HTR| z9m3dqYyyhrth2|x7=L!o#Ryc>-a~D79GmMXTERw-odR{t{Y|^qa!q6H#^3vXq)qsr z)pPZiX~XS3wc&QN4UeC@3T-%4)7Xl3nEzb%a~V)NGP$6FJKER!ek2urp4*tS4FZ*JEVO;pqCHTBAhhy@3fX*E;XqjCnB=v!}QR4NeSCof_YVSu(rj3H8Th z{^`B1hE+LhyUsA-q`G|Hh&B{qSN~J?@U5Z6Pj zZAnMk0y8hb=CFv_=Q(T_*uUD|V7X&g+9{Q0pXWR`3(ifkFkgqTSNZjAXg9k?oa*eH z-4@73+wq)_JsCss`@Dzaj>i^ezaD!!Ls_rjh#MwmqH99bZ7dS)^Bni81ild+*wLKn zk9)(^H7#kT7vspjI5oXsDWlG|@eSK|>o3aIN&KzCD!S*uJ&Ch@ajQeYrnUv?Goh?n z0&=pSorn>#sxI+E%u+oM+{P?*apRpy)yPPO#Y{|Bt7_T;b)m}q%1Bds8EdTjX%96L zDogkWxqJyA;Q|G#9cTsFtZH^!HK9u&uO^?#_B}lvaEsIGzm|-1ag`PdaKDRj3;B-CY}Uq3W=At95t7 zu*%SLt9)^9syPxZH10Ut=nV<}@w$x`q5XJATiMvR_$q65D0MEICtF&{sm{)`b~<-m zK2k05XUo!}t+Z~--0HcGRmJu#=pL^gXd8nOK($FOj&Dd1ajTF|?S)q5la)JbdQQK& zTY6PFN&@>!1r(}glYm(ND{i%Ic*m}_kgKR_xWW8CGcKf>rWehm6iw7?jl|aLh4}~C zO5emPlijC1RJ`hSE&y*xC^+~j)uFeXqqe zJ2Rub*CqI;dxnQ5=9jE$ii-yoG_1F7^32Un3oSe{Cm(#?!ye|D;6Lb5`@DDTdiGd9 zdynmoT?e5RZR$NAQyXKQjfmc&(0z(Yi@pV#*v`|(n3u~ zlCx2U7z*>7;SHDBz}`i^-cy}O;eE3cY%#dqalIY`u6YT~tNd%U ze*d)f!@!1miS_=WvnH;uZ#Wi&({URR#%(}qd~tT&)cPw1%ow|^U(>FbriIDd2Gz7D z*13;8@2n@On;2u&ZuHYGRW>1HtsayZp6<_cH>rsP`7ckX!PesOLww)jQhSE`NLqv6 z7uS)t%^N3GvioD*?!b^cuyf!2A z_Qj5jRii)bF(KPxq0$<*d1}(O)y4SS!?wADk*OIrsan*x2gcj z1-!k-;)_GDS{Lp4Afhe{LQVb0tOLQceO{OYKQWg7R~$4jC+yv7^NLA)v8X9;xix!G zV)3>1Vs6hh$S<2c2kAI8Rv&=j8@Fz(KB86zkf+AyKWP2F2L5Ant<~N>`{Kf!_P%II zDOSSBVE4(C3w`lkk2Pp%Sw}D}GvsaPvc|lF%j*ZoC+WEUNMMX70nfBa> zGUZO>edWggQ;nMaNk?#)PK)b(-gl@L=9Gxeh15CSs@PJwvl3Q36l#N;k&KQ#w}Oro zb=mve=kmkZNCk#1m0bU9T+^{9bc%Lq3AJaOk5jQVgJ%2VW10rtG%@7!Ox!uqRlloZ z`~P_-Sih^GGGqH1-!<*|gaRm~4vU?)>%$aj5v23D-W^Klg!$mDEr=$m*v)RtBg z8iL0zoVQx?kH?+ZVyk^|jI`)=$RDcc%2UmJ?<2O(n#dZ>t3J?JY}Y=Q$s^;i>*|Iu3VeniLT&_J$AIS=J)Y)+X$vvX2`kG4A;``nh-eeZEXUQPqm?ezOSzW&*; zdD9P3B&2|OV~@w2=kx21z5f8sAT+h5SM1EiBfg{O4>We}4=1Khp1A5z=(&8}ML~%k z9)Dp`;Ia0vPyAK%!6-&fJkqmG+qD0bjCFE<7(QEm8t)XId%Clxu_Z5i<6Dz{ zhQVGHz_#VS*ePF8_VnkSSktlxk@%r3J-LvhcR+t%6nTz<#in?Yo! zJ|B~rfdNECcI=%m)b@Og-B_YvoNw@81owHyhK5dbHB`5(+Wt3;^4o9s-HiL<*c-m0 z>f0XU6^rlo<8iOYzQ?wVb^tx8r0?1gd-R=2`N^oyXT+hZ`jQ8KT+=ytKSz zs_>8p?E=ulLTr_9qO@WM2}A2mk*qd>oc785m)-BFDH4Ke@YAj-zi zSIh7nchQ<igi(Qhe90{>_WjqQ&?qcx5GHtm&&)t|?W`A@Z+M zqpZBpilVaO(Cv$LanO^ax<#^d*xBUJ|3IN~XRGX?7NkW-rP#JBv!>Z&StLRarCOVt z)W7Co5YSrc;knn&s{V0GxNPglKcGfs*xz;2B=SE;Jw^4Bs^pH|5+R2Btjky3Ms-D` z+v?n)nw2gf%xxP7^F^f6BUXTpUH`SK%K%}dkX9Nos1X$rCMFY;eh!CBFb0Qw3J-NA zN%6a=s|;%Il5N+gkyN&&pHa|zLd3yxUt|VV^Z-8};-Nz-KmZ573ChBuuK`ui*Nn%D z4|gmM+*a{nmpcJRUmP(w5)n_iCV!UDblm?o-~TUm;hu`Z>Cn?2-27i~1}_em^46g) z)sM%Dvrfw8Je=Lu1#)GdJQl2G1W&j43yoOX{UXOTzgmul?t4^U9*qR@D6dXYk_TRZ z_Q})A6qLiQyxW-ZBcc~7{Yb|(zuJlhkMay*Uh}KMXz(a+5$5$*t-~}N!i_lG%3F)N zR6ibTYV-ogqdZJRNgn0h%e#YEX4&&H*? zUM}U)@!aD^2lDT9T&EfW7(c~$dd%xd4u1MS)PeE0Ij&3OS;siYBmcb-LKMTSQi=no&3Lc@E1Dj_fCg=?(xGwzYzVfldo=(Z-UkjU&Xdd{R~vslPx@A zhy><0&XNBjhdoX^^!ZHk`yK4w4PEU4!^*kK6P` z%fSDia1B<_3J?#mF;A|cHclhH!p7;u!)!c;n2`wMakz#nX!{1a(#DfXm*ItTMY8Bk z`NSxW>ixttS)R~oqe{V?NANELil6#EDwy*23l8AiCYZASCYb8|TQGG`fSs8absr#@ zx?d(Z6F4ZCx~B{F0W)xqD25~)$y8o~-UpB*7c)Xo<&}0sosxkWuXx1fl-Te{4qDLwf=0tiY^8W|ygL$?{$hi+q3UAHl^>Ndvu&}CGvCF+!+e(uX1)gm z|3~?f86kip890(Ja3o*gNO^%HNAd+`zDtCM`K}Pm zeAV~{9_GuS_ibl-UDu3ru|XnG7V*tEQ}8mYgFH{;oF({AIOh;kFhYME+;53t1P)@BooR`wJJ-X+)P0fQh#f$u z?y3(0(+=Me9%OBgQJ@Eazb|x_Z?9m=d_pi)`mtb^^{8O-{8})}{gPmo`;UTI?vDkN zpN~t7o$Kxpx!S2AW(1emx7;p>;5%a=+}XsC7Axe za)_nxz7EOnX8w%ldD@_#O<)?iZSbpN^uqSoW_NQFkf5}Q7 z_E}~BAP5L7GwCakmSxs`mSrY=1n8XZtM#ppHw0hjP@I2|D$?OXvZdHw&ijj|e9JF2S^cnzN9Wc|9g{+T%IFr)37kVL^)icC#_Bo3!@9nOSn7I#(0NZ)L_7&U2*o(` z__>VuI#TWS&wRI`4V2@Wcqr0V5MM$L%c{ab`gNeMC#JFpVH~7$U9^dK9DWcs;~>2l z{96S-0K7x+Q^1YHBk_Z<8wdG+3wpEQR_ODD;EzDxFPQs39~3+ixJB@E;AaGffLn=k z@Plv^2j#yBnSFti{iKS|c3|2@&HKQ#O%@LFAY0q#DsVjT?LznATqZaL=SsneIIHz1 z_>+Ov7y^u}ZC|6n0pOqGp!^{?w+m+4wPTdBCkgr_5u57XUvexCr=NgXgT^Qqcb;nE8GM^{wr| zXBEWdpevuoz|42F&?|tyYVhX>t^$3bVA`ilFzxeW!Rvw9UUgo_1cyO?LGW7Omj$!F zP6^%wd{!{a%e_e`XEQMOvC}fSUmfvQ&@U29JE(ozL2m%2KL_&c0NyIN5%@8|l>cMF zyMYe~rmcQq@EjG~4EnDOo_`rUp9p>eJeS4T`R)hi-iOrTAaJ4J7GV1RApIHO3c;zs zTLiZP?-oow9~XQSc%NYE`Ly84zzpoy3?M5U2fgBnWz6&uXW|DT5r<12@uv`9MXHS9 z%oHJj!^IzjAvh?13S=@`kEQ8CFOa;FDGWi)o50kCOIXsWiyB*isY{N~sY||K_M?S@ zDQcBq7EP@`K@0#tBy^nY`4M#L*ocF9QAc&}2233py3BDIHciK)vreW6 zPR9A`f>|dOf|0e|HozYMeq893vtRHKoSzcRqCGD-9p@JXkHPt`f~m`=f+@$%HUasp zrdYw$=W4;!Ay04sSlwTMe=_hBLZ_Sqf@#;E2&SB03#R@4B)A-yK1G=CTHrn$4}mG? zLcvwQ{RC6a1i@LrTpw%x8wBToev@F@?=HctR_=wV`TtAsOwfO5(4P`K3-sp%&jAji zedx4m9EP5Spyvtw7T|?~7XYsnTm*cd;9_6~y)Q!y@o+`5$1ye*1eRYvuO14V%m#%p z3I{RMars5eHa0;p(_J}gxFz1K4G*^6KOVtr_MX3!>FW0GKS-!qyME;3{6K`)CCio5 zLVg@!=otN~!TEWGaA{YqpUY@_sk1*}SQc8i81DVxeYT{+_DyRsdlp@N2%tWGnIBq+ z5AeEtPeM0%(GMz&FUBI?jVY%4$1vi)*eH{>NmOO|N~PCNfWFB5UoO3JJKH_;FZ^QY zi*o-G0_+MHHM0!gsx2xW1s8+M7I$%%YuC+}kQDLr-n}4Qzoz>lt$X6`#X@3U`Hba@ z1b5}uYMKsH>4n;s(o2TUwqE9F>{@8F1@)GqmkdNl^$}d;3!X1ou$~fqem2HOIsa*9 zy(j(rETcVDfAIAsOV>RiyLI`>`Ls1Yj$OIBOpO=n1GN%(AukV=uPGygREmo2PSw6K zyH}kWkZhrjL1^Wga(v4-e_>_$;vVBmR&he$VlB& z=<-Adc(~^7VL-JVdK;}i+IE$jS=-4e4WPc{>#E3?;q9%A@;#*4kfL8?cFjhYC7PWc zkUlSUFB$jn{pT0u)@zbpve4Q^+w6Z{vfk77l4E=c}gsg=151DSFAE z$8UN^>3P0;9reurWn75EU3br(ug$^wbG=)$p(}6NQWdJ@bDITy-D87?$Kgfu^_S#e zUA@?0L!$w9XVn&v9>?w?9+yqm)?J)TD-{(Z6;`g7;Y(TzVs5rD_0_c~|_y{;TkIHlC&N=2QZ1u~hH_5aSkDh4FIMC*D^u zEWk~LlP^of*gu-@X7CZ~xG}hwS&wVp7vYvi#qpjb!y%9NeSDv#gO-=>karOBTERql zxc!gF<1;H$zh+!$8DNXx{|29_Upelts1N1E2_LV&?~up)*_oj0pk;4%$g48s^#L>a zD38x`P5pR}i=st>mdE!Mrhc0sF9kH}$LiDao&+}KS-3Bq2bvCA-V-30@^%~YE|56t zccY`c3m|WZ7AAbWyv|YHXCROF!qkuN(Y1a<9P-vf9&Mn5*6(tMyu=aqvlz-t!lC7T zi1cQ8Z$Y{oEll`$`9AoVCW{vcYawql&XmXJF6Uc{ zbjstaBrPuuz|?O68YiER=%D2d1|ZIoh)*GJ2r%VcjDvBkj}IO8O`OFGghV`0 z(e?}CnsL6c zBIRMIj>y}M^h~bjnJlEs(ZYm}mp=fXsbAHY==_1M9Fe!yA#Xk8@tb@dw0?IwiGVK63Q8 zgLvVd13t=w=!m>Jv|m%dwHMgWWu5ZYgU{5DzJ51@iSqb-ka29!a~<*yLLR@t)!Z-S7u2YFm0P@c9KB^I2cR z_=mDlzdRgT-a&`F6ikw+;z-c)e(aF9KHIi4<41Wn7Ul5q&Ct8gdey(gF_m`H`6VSFOS@S{QzCbwT84;>iC;}bb+d4mQ=$8_>) zdFw=;=1T(~`-KkLE^EQSG@7pne8@TyG~XD9ysBRK{(^bHl(z$XSrKVb`+W;cC^kIZ2NwP^~<37ZiarktfW)k85EN7gKz+< z_A`3y*f9Ykm=`v-f3;8V@nf%=I6?7$u}|;U>X8WohH`{7>;;S5#kU+OHL$fayx#-u zPd(6_>3F@z8`sBX|l=qaTK<@4+cZW4u*O{}3mYQ=@NQq`Yk~5j-GI zP>wt7sDfW5rDh(>F)02GiOLs-&0ITza*mBL8Ls|HEj%fytSPtq9>X3N4>rjxX+3z;9qJx z6QM})gLOU*1@|UKbUEfT_`M0VYfVauKhH{S$LsvL{f@=JX-*r=iqBKTroNWCe!jSo z@QY+u&;P%E@9XMQr)o>rYbx8F0^)X|2FO94kL0Tm`?~jEv*-5C^}mg&dZ4qj^NsEr z^MByDo{xn3C=Yzr(sOF^>d-~LD^PbGd)rZW*|w{elc>=CN7`m}w9Qog04{Cl9W4_HVf-fP9hkvG>or>rScU6%$|HxGMwhjNHd#PU4?a z;|8UtY#3jxdPB#ak>F2zpYH6FpeNS4xnB|gGrP|t>V4G$W30&|AOUx;k}3{S=r1wW z%-canesJ&PL2kBBw!QQLr=mx~{r1GR$|uMEYH-^7;j=R`mAX(BpM>rir-YpMgsJC< z_4UVI-*BkE>hB$UGIie2EBB4g@Y$yJM7nehw}JP%aWx*R-s7rzEUD_cK-K!B&EdeT zhQxwC-sUH7dwRq_Ke~q73zQZop1HU6`UfA%y!BAq!jQj&E)a2ZPP!Y&6_*Z@8$W;&f7l>w_#-UK4qN=x7K@On!K@9PbY1@IZ*Zeq{eN5(iw@< zTimrjgl9NyW#;{`%KOlkkK0svYaabz;{(`fVB4v>KK|dOT~~Yi319q{&dzPs+(w`- z8w$0zy}GJ06h0M>Z>WZs#Dd}pt@pJyY}qi;o%=`Y`dhwv*zNt3HS50CdY`*$TT+wH zV?m3D15}|T5t~KS{?x-tS`oOL$Z@Z_iEj>IvEz{RNJ*~_? z=fW$tx^tIUQdhrK#(+|=hcf%&*y1)g6NPe`eOswR|U#)H~j~0-IXoF(LbJ#^)!TmXUkCmCl5WB z?QFJF60W$2+h$0kpc_QhNh*W2<8|6&-P4-oElaN*sWrURU}a@(!7XMuvAylN?78{= zl-F_xi_E=WH5jXzXIC3e8(f>BWnO5q+CH7k>~{@@AOC7BO+tQOd`+l-T~bYutz7l1 zy|?%-LmXU*v2Im6!p;S2&$YK*o#sBa$vUyBBJ_u6+}@JT@Tqh0Xo3~N!tC70kkU}= z?ga6C{Ji+O{B@9S3uavu`7Tm=V+Rdv((zq8Tn+AqO8Bt$w_D0u+*|=|yKngAaN#;P+$27!W!-(DJ<9F9-N8kuIz5lXM zPoZBby7KrsB{p~eXVT{PLC&$yKC}7u9ISmr!$Zdoedb@}PEGUnv09!C=kITC)!N%u zn5M1p?b?@M%zkzKro`p`{xfD12M>+0Cw3~Y<5Lp+)952|!$od*m25s0PO#ffT>|Tm zlg^Zc2XAtPUv9|*7mH7l7sdCscH(zrocA8lX>Tr+RpyDYye%9FS+)r%Tdi_$%kh>D z0pS^1;`$@b>ytTV&+~|@775ta;87V%_tF(xty@nw|Bl#-)o^UF&b$`%V-I%PGxBeY zx%sexTMZnUyA5zq$IEv+)cw05A14q`nKjn>9N=~ zMfvSZ@ONlWdg350a3H9 z)NtL!BfXKPA!Umg4~80t`%oROGH_%M1hmb3=ChwVcMW7OKKN7uTvCjo^tApU|r|O`E{Ury9RF)INGFEM(iQ>h&=!kb6vmXo?3Np z32WQY z^$n=c^Z5QG##QyMT2~W{n;G=Q&dvTX)17;zHG7)1@t4;u5*u@~2E{g(HePbc-Bq=% zHSM2q%(bmN%@wusG&l3MO(_jrmD~3_)gF~4$1G{JjTr}HitN=M+n903ZGykabqtf` zNA-Sog($Jmx=SKirp(3d~`D0+{h+w*^V{kPvYPr_ zxMW~#{qU56N|h++f6Uc1!17<`8nJCmIC0G5i5mtck2nOL%G=Xd$Mc!V1ULq+RMSbcf^p@!Xb6#xMU=IKEVM-m!a^N~;8#{fn&tvzfgk4QxWX6S7el_rrcXUo%6hTwf~Z3EB4A2L{7Ko27Bp94FL;|087G zCW``4a{cz`kKqJ4=PN$U!Fo`Xbi9uD;2Daq0&64RuuycYfH!DPZFYK&cj~g2Co1C& zy`kee({BCHGpHv=uk#81(e_%)maFN$b9EPMlVlsRXbZ@*yIN$2Eq9W@AW`3El<$ui zt*hz+H92eQ;qdx&qVL+5r7go-Gl$1;TysmfdEwCtS$z1PjzN=SRpNC~KUPWHVR!8e zv%b7=aIXhSdugh!B6Z1Df$CCSLX9F?9@>jXGQ`#?>0YG(R)8I5yUrbHEtDq|I-P9I z5?4pB>M%e!uRgv{-)+9z9-1^V*x9+W6LV5yL!ZVzR%$FRjwM+5o#(}%pL#8?y;kb8 zJY#W?FfRcP>nD>9|6rt|XXmVix8@9hmz+8Yl8ZYu4ZS&#)H+Jo%f#b z{m542P_fq2w=IA-dx z5pT8?o^6|RXw~tUSF0fdcV+iPyQkE>TBnS}b{RABOF|FV)@7d!_D8?n@U__Yu@O$F z|Cw-herM;baN?PUHCXcGg=%uFSwBd`BaW&cyEbnRY;IoDl;c6Ws@nXo`W!qh%C5=5 zxPB-jgwon;XuCDGtg0Dt88-Qvg;vhVkXH$c zJv-tuyZzx#EkiZxbl;Jjcr+R4*qqHa5cK0A7guFD!>gK;s1fm%HKAn864z_P9`_dK zpZA8P)y#hM%(uezLBB6%M*Q~LhH7ksksGwCwzc{OKJ@gusd=ucdDgiQo+phcUKmO) zft*9ttUX;Gw-RJ8FFE#MGC+45miR5K^rnWAXKq@KV68q*MmfiDagH^c65aYMX+hIM`T>TUn>4{*aK`*d9tCvl zO2r6dM>H)i9j}9F+HC6 z=+E8WEbG7(@LWCUX1{;Hg~OA41GZ&6{=l~C5!<$HsoynpTW|}OJUe~Ex2+-w)$dB* zmQR$8N?8{l-clNF#VX!A%BsP36nMfGr=PH82C{BS+!q_(2`ijWnAq47@dIgZ&lW`V`AQz&j$GwJq_RSRpp!`o0AJ$1&bdI#W-7GjlrX z(TdHgs@l?!fw9$J>|w?7Ud{is8}e#W`~_+5XqHdnZj57M$F8eSfzfN{I=0Y1Vnajq zLqBup{-!f6>C!VN>>FpWyl>yLaX_9tB52+__uMk1zU+F`d)eR(b}RLg&F->O%W8utYr%ZG%` ze+7f5QZ_Vh$hK%juniQ*`A~yBJ^vrpVH0?3fsI8bO7pjIcqZ(b>u0`&F0bbS5M*NCQ z9<>Q)!PCB)!AfXDQhlL?T|qqGt{v9m&V9NwcM#Vz4fz`eJZ|sxvTHkqAnAqbp&)hg zejv|yc7=|)>)R{gT6h zor*fwzTX)wc|~@?=}+3&GIxQWWx7z^_P!Ta`%dS33GnjYtpyolgZVxS&xF>wr$1GA z$>3q*Zw;((o$ax{nfZ;%q;E~dBTD=$sB7V_7%=>-&enYRbANcopMk8ApSL`FqY?R(uzi+_Z4jE;OahxNR=SDXG+3jTlcrxPZnf6^v- zBj;?aEuixy{}*#_10Gd%?GK-sB$E(Foj@2OANB+h5(uB71jIHWkOTqcTTpBml7U3> zMLq;9w8@BJg4RNcB|&d*5)cB_7SLMoqfJmFw%Wg>-WJ<>ud%jjYwrbW6{|S^-*2CF zX3iWE+WWlE`@HXdp2_*0b=F>c?X~w_d!LW2-4zPWFAK|;#>+N!BSk@~P3u2{SL8Qw^Z%%6a}Fs0tAD|3Gn%J>{QVPl3% zS~^0A@-Gpx3ZP{<4MWTQPMFpY;5$XG!Ef@#uJL)cIwuu%;@uyn+nZs&o^}W9hYDjQ z#a;}b)jdjc2k}<0d!)AV+_=JZcr$UGwt9CbjKP`Z*`zwW^?4u(i;2^r&>KO|_UYw2 z{xELBn5k9hlo{#UPuw%_m#<8%?A+Gbbd|IHsu;c}dQPuR&?BwEd1y;N)``b<|P2ZIbG1`ZQ_2Ml`xUac#)h=lmi|vUGSYNUa^t2~M`fM`t zU9QhIE()H$H8`(h%g5ejshNwKdxKrxgw#M+e&E#B##DDgV;7sh9vju{BAA?!(754H zTT5?ySALLdjMeuW@1wdO*3KLap2j;T*LSpW&m6fQuf?#qNosdFG&TFOy6K*IO?%)i z8?@%$j<%gUI!|rbKGWHNoyJ!#+|hY*fc6T$R@kPEj&Nw~MHJLBklU586=#h&An-+0Ya_mKX^VYR4haiEyGxAZ`Jg4)&Od{=%wd`x_L zHdafREq|_U`ItqgWuNjj>|jGJ@Zi@z$sr^ zc1K%tZ+_RE}^B6!mw?gW~o* zt~)|9gdXaR_()e_XmsoXR;9goZ*bNMdArr#YT*%Q%RZdZu*7tf6T26h@CMgyCcG(k z9*ZIGqZSdV+*>bPBV+&8_6jhlyHbvep7sqUKc17aGtA_GuP00Q%uqP5L1mu-i!uGS z`_MmJdW0vHrFryOQ66TJmSvplmTw~Dy9%tE)pIs1HuFa{$2V_w-`aY@<9!q#7ffh< z&f~qpdF&hyHnp7#7vM&bLpLvHS1sB+|x$NOhT`@xS7cXT9@@v!HW zy;mK}9|hdApZ=lY3T%<39*@T0WgEd}XVbxt_ck{VI2sBaY4QA|Wr!gd_S^pz2(DMX zKH^XIUuPj6Yb{F!3vHoBPv1*H(+G9&!F3PY<}UN%zj(wtakFnFRxx;f>zca@>z{cW zP`S1%pw(pPfydLIW%I6Qq-W*i#rZHwPwO|Sv2m?&5!%cfo6OgO*LZ`2rYE`ikrW1% zyqf%jS~tfW&sOgjgU+V3YjEeved^zieP@8$R4f*)?jj!z^|bMe81>vQ z?n0_k#~t6`*5+VnOL1%kfhI@#2tRs*%e*11W%8_>S&QN=o1)V3; z#vMx=t5h=-d;cGp04e9D?lW9o^w}G^mh$2DbfqJ(OlwRnNosWEJvAQv%*Rhp)U6z1 z*BPIltk5fej89L{7~VUzK;nSW`NPNEkaxpxjIr6Kycp|`;!_c#5Stn;UV)|Np@g(l zHCj-XsRPz;>DhQyzg%mK2XEd}H>FQ5acoX%OzpeqG`;eeCwTo&n&UgNQU3BB8cRNt zHkqZ2j4Gx7(bdno=%#uHt;XhjA@O9_DsEA?!nEV^p^3-3mf|C+Fd=b3PipeX)WLx+ zPvhi9$N8>R>e36w%Ovj(vpW>_8fzz-qYV$ZynIl?9PVj8_J?9zKi}o~EOilWCXavT zPM+)NY2yya1_|pf^?J4=l^+>FlJ_5&t32km(C(p}FcZ0h6sm38$2`&UuJjrc%Q`dN zJQr(a+s;iR-XV0K9Q|^=McAPmAG)q>6)*#Og^;egs&ufWvX{M_c6sXjdHLV*zpV(ZHlK>cPF6ECG{o7 zg7ma{*6x!r=F$Q$j>JuKccxaiyEAw`m^rNDAns^y)Jl>9IV0D+cwO-PsZ4LF^Vlg5 zS{Ezv^G`ZAWp1wD>^OhQqvlORV30RC_pLqd<8pSiwpwZ4eH~`0;HSZ~)KEw_9&hDx zIPmcpp0MRQf}eJzK}%%CN2lOZL!JH+&z*V=KSVz;t|9MuPH<5m*Lm~zj{EjZoxXEh z=QC+HwD|5?+ta1jqb_(2XEg0lEFa1^nHg%SYw#85mM%2&ao_kW(A(>Gti=Mt+*HD*dtdD>|xr%foy6 z3kfS0t=ymPxM`q zt-l-JMZ~XkY>qSLse=R24vW;#j^hi(X;YU$|7VJCcc%q%VybeS8Bfp3aa84Kr*eZX z+z!v%2OC1o3%Qbi6!NQ{<1TJ?G!DSkCpiZ3j7jzO<^))*C1Je%^H-Z*YAhLkR;_#5 zQ@n0xdK`CoUb`C0lIaO}nx>wFc=KWQE;xsS&!A*wI}|tKtaq#{mFnNA)L+`36Q^o` z1yqi6=2X;SWRBK~PMO2``j$lGxtKUTX*vfD{Qtq%DU9O@7fRxYR4wFnuGGT3i8}aP zuiW#28>RNM&S4$ZUf1UHF7X)BLh$cpd={r_R)x>Fuo36Vq((Fh+N0-SCCY&8C;5qm zQ%&vE?PB8Q$#|?euIFG4uFFNR(V@@6whZ*#$L+#2@fuL*Z8Qw#o1R)@K~(lb%DA+JUF}8u(h!e9&vWw{k!nsBYWqw zo+HPzkL9=yzg+iFr};*lPtox3jAJGzKH?5?VkSM**__lkVCIZ^)rV|-M9qN8UZ!Wo z(b7-&4$f6VKN`S}-yQKr2W)>4cGv(rIp0wmNlu$uG--F|GbLYF&A$d6csCk zv;2rtV7YAUwpC0jc2}#Z+Kj&&YOycbB|QG}!m7=cHU1(5wy5!!S7ZCLYOQ*GNu^%t ztE%?vg^?W(bz?`sOGK3WHzKx8HM17floYP_*XUYF`MtiMSZyyww&l)KRHx z(I9{EV!hn&FM??NeV36&eN5&8#cY)p-4+p@4D-1B-Okg$zfBp^~maN9z^k0eJzQpr%5v z@)!EKKda6mH$j_|Gdn*bK~LjoOV^f_gRNp+dC7fXZA5ey2^P4Us;UJORIdPeKB12A{!=04T^kD=jPO@a{`Bd zEyFzPtEs4><27e8Oi~40Qxp`giSkKY^%SVBjr$J6iIy}vr7=mXMGf45v8aKC`@gsp ztqV;y>zIJ5wZ(pPDsInNUafXLR@?dFN|Z9_W$1YkrUL9?TTon8Wp1b0*E+(oK#;YY za1|C;RQtYVl-*oa z14Y^)swz<@8Dh)uLPiSK!m5~VZ-(jVmTN%aE?b%%M6F<;+m?fF54H>ERV0JG?9#BJLnMui2ab zS@!V#hvm*q>esJcFim&@vsT!co0q82wb5M%qrF=7nv!y()4*G{Sc_ zT$dEUZJ4VEIaMyf&RSkkUg$R&)yWJkr^=5Q%^by8jT$1YDV*IA>ilYLoLv7V@;Ox`JW4ZCj3&(C za}gdsAE3R5_(4pJLE^;Dp1(%Dn0oMYYIC#{Iqz2I+1f@q&%o<#C!+CBk=NYyO5f?) zX&jld_+h&?S6eaAI6sAhQ|*FeobzvA`&P3Yrb;E>XPn627!^q`LW)5oy!)m8=^#7R zPJh2E3}>aZRhK3=OwoD z^|tde+j)iUe1q-0+IC)RJKtzK-=qz)Jaeb3{7~APj67#tDKqih+QWIC&Oed}k6T;- z&sWPe9(ewX0S4g_*p>U7&k}!VUXQbtS8w@$8Roy&#xKpIg!1|`HvUEMi)P~W6x(^K zv^RNpeXlM5T^1M4>%F$?VlbByFw4Ke zR=<%pdoE2Pr;(^nt?hiSO}_=U{_sO)l0^7(TmCsV{SfOXoXG$0HvW2>ey45ae{8e= z?`-EE*yJCS`HzLNyab!RV{P)kY2)v)@fX|lL#GWVvTn8Y_rKZdmm~e1naJ-J|7xDQ zl8KDO>oaWSHQ4x{wCVq_t$#dZ)8`9Yeb(9f?~^w9BW(KD+U(2jKi-ZJS?B)Bc>cyo0vNI1XHhdf@z!0f?21aVCH>La4C)t3uaw+3to!jUcuDyu;58J zz9g8o{FPwJ{Iy^<>sx|X~K7vlK7VDkT2a2<|+6---l4bFN|-_HdX;pl*UNvAyq z3C;q(MsPl`+Vd1V!+~cAon_r3SO?A$JPJ5Ra2oJJ!83vH510I_u#UOnb1sN&h2`$%1Knwzo-V9f)ar-9o3{q|+YM+vI0E5z{to zCzDQHiCHJ=YSLLxV%9s$LT8;#o_xXVN30L&FX70xGU2Fz`;|oA3u|H-6+f4SKWS)xeJt(*Q`V_>t#+(Dw@-2HZhB1%Hs9z>hrH zpdS%@Bk+JDWP+pwATb5j5YR%ciaO4(wq1> z)+?x;AucuW?};J*De%7|_}9Si5zoXQq_g;u=TD%2O#D?+VK4j~WeTc&>&SBp=KTb; zx1-#kBM_L%n+H1YEy(j4jwyoY;)o%nCChxyX`C2EF%+)C2{@(+cH_82u#V#cf^jf> zIPzuyD<2L_Gq&MJnQW#X3&z3N2NrbdMH`YQ1;;l8<6!u3&^^G)hm#-p5BQn zc24jp9F?yIKXvDPPyXRJCZarICXZm+W0Hk_li*D7%(u`N3#LBH1XG_~g4tvp7XBX! z&I0{sf@cH&MKJ68--4+dZuY{u4Ygoha6VY_EOg#avo7;NzeDgs-~z#{-}fy1j|pB1 zo}UR`0Xzm{fO1v?j}=@5yi_otcBkN{f&GGy1FOAO#h!bG-VFNVf*%8ZT`-{bE5S9u z|0#GAZ~{7=*)CTJ-VgdUf;)gGT6k_0d<68_7CQIWq?}IBmkE9exWd9yD|j2|+XM%J zn=L%w7hDYbA;BEBFIsqB75otBZwlTC{E^_-fVl`W>y;q*4UoTTp|7-H?%z!QH^EaS z_zds^7M=$M{~q**1=j%|6TAZWw1xjSg5LrCw-$cQ710fm7F4-kfahwHj{cJ(I2QOT zg6U%>m^|R0DwzIen&3Ln^DR8L30?*IatqyO!HoZG+Uom)-vj?sfa zvEWwF@3hcY3w{FhLcw*wRTiF2g3p4^L?6zSfFE%+e7l=i)*Hz}e-88%;tKph((xnz zo1l*(miaf0n8rcMz|XNkL1T?E-@sEzuQG5ZakYW7h#~Vy$jm2RW6&20eJAKpU+vG! zD~W>MyFL)-7)RX)CX5q-`oOm{lHwtF?JSUwg4?kkczEv=7 zvsf_Me1dUM>m2eA2VN(19Y;>#q|;{V{sox2sCyP*+H9ZjOv3RQ!L->cf-`aaqhK7g z4+PV^YW{*8+KkEGzS%Ge?P9hs>qDNcAgZ>Oc7zB;{|q)~9UMjYgQVkUwkhl2V4+B? zgW0AT#L}j$gJU`VAgOjoS!F0I3+F8N4q(-$!^k0R3LFcp))K%8z|=Dt80=~<0%9gU zO(y2`S%O)QMS^iqPh82v@_7qQOdE0uWy)bUC1$;A1hd`^f^{6fFPQayN-*pFl3>>R zv|!fzPl9pKJ`~Kp_mSW%9GM&}5Q%j*+l%!iJ_^9PneAn^%X^@!c9HQ#ogDJ0lw~uo z4g<2zX4|oBbKRIlEMsssv9#BGV&ruq?-jtw*WwS-VEl-wBXuBVyTD`$Q(v-@PJPD; zPR4P(VCGZp1s>|Ip0fZ`_j`qh_S`L)W$h81fup)-2S4lgZ$fANo)esjW2a!&^_POP zaO@S#x+2_$(o+ZK9Ann&YQg!S4-`y$Fq!SbIuqXr`>@VtyQnsjwoq-v3L&v>rp;M5 z)8?#?X>-*^khvH#RT}}<0IPAKgAqyjI^8lZfT;`1O$Mee%u7s~PcU`aB6v8C`vv2m z9TcqN_=I5UtLzCP^;I?mroMm1kMf!RiXSoC;;dj*584g%WYAoK0kr{w*+$Cdx}h)i zHf>A2iC;$DncuMye~^?tHyN09AkQDbqZ8AKA}KqA{t@WP&N6>dZ^wO##h8P@!}mu@ z*KZhf>O`4$gH9U~KL(sdOyeQV#*g$9pyvzz0m@n^co*;r;x+h#q{hxjLl^3k49qkR zKjK&%X**)p^#;Mzcc z`~#uWmM1KE)%^~5XnQ8dR^v!JI=*RO>T24bHe!1*(MH7ogSMlM%rUDIe+z$**hb_T zj=&oRxov>%O-yYjJ(3#L5kK|1p>nPr*fu0>hQW7=Hl5KyeVmC=$}DJ1d}vs^WHfJsA> zDLQ3%1ycr-y{rMaU@c44@qU9>wL9w0cYQkZ-eu5HjFOWL`Xs?if!Rise-AMGx;cl= zCT69PR^#W`MkLR*9x!kz4$Qj=d20m!JMb34$AIgIWxfas{THC`7W^S_hu}|uj}ZIu z2kAI|l%JR+&yIkTfL|khJvrogk<965a8CZ;p)KAKd;s_Z!F(U711EFRMpEq#%(hVN z4x9k2+8vlSUWy<2p_;M20;avyJPypH*0;bZz^ps@*$(WQ#5#`O7L0@8_dtIS_`5=< zj*kk)!B~TV=l8&ELVpLxLxOQI<}&cS3H&3W(+0-`Q~z$kIB2g59)%-qNZrzK{EJ{5 zwEq^If#W&BlW_b}Fb>8ueB_-9%==r)$pluww)(Lr*~MYQfup2MP`Xt7lWF%R|7oTKLuTDA0F;zEJ49 zftLu@flCE91M~SZZSolKHw3o=9~BI!JuP@Y@J|GH0DmU<3E(dTrvZCn44FrOrwM)< zc!uEP!1aOwwQYi*2i|Vs;U1{etrPTS!7l+H5qt{xDZ#G+cL{z2n2GNkIVZ;o&IV2p z%;&Cd!R$L8!7G511%C*6DS}sn&g5t?j!Ncs1Cu{_yn%JWyv{@)!ld|t2f%?V9f}OP zDi?I?`-oBCQRT{dOb4quM~@;78hO)*k#{cmClNOq^r=EG1YOMq6Ail36PUUT!7mw@ zx-1k-dvMuDI?K6VFb;;#0i9(w37tB|(O#fu0Q1{AV(OyCBQVp~gigIwJ%z5uATVv< z7ar4TB&cQCHG; zf}TmdgVe}cw+nQ&{+w*I)qA*>3`{-$E?CEr&$UUXJ<|o#J~s;n)Yvb{!!lY1q^8>+@sh+WmK7SWFWnK_WnaaP3ZiDGVfM+!?X{}F#8zmNglp8Oe4Mve~>cpb3CY^;ZL#*%sP_40_Dymo^8;xh#xXANsd_t zo=*(^2JkN=USZIe66YG2B=YP7&nm%uX1`kS+rUM{e*8fy#*h48f?g{4tMQTd$fJM< zf}T7Le~@TvVpP#+Utrp7vCwrKRsR(JBSIgA<5PlZn=ZjP80{kbzp>EYwcrl~yKz)& zOYpNz)Y=l5ZE`_)sN?5?**?nOf+qub3fhwTPXbmx3V158i+%=}Nv*qpGl7*~0;c?% zgokZ)mteL}onW>}lVG;VPXz;NF9}`^d_geVAqL}(#rgq)WJQ>J={2%T$y|3m0mz;9df{z32x z(9a8IfBd^(_JJ65BGx@0*d>_ll_WR|SiN%;p5Ydr(SpIEzGI-A`M@_?^4=_X6X<}d zpW_f-8~h}p4_|i&_U#3odT?C)9atC4y{FTN*WeFQI)2HwD5$>dCT2M#5hJTHE`Zrr zzb4I}_{0#Qeld zFvh8?-R~U&oqC(Tj=DN{(}_e~O&`KCDCZpbm3@HU0?r`)Vf;awgrDPn1;cA94+_mB z{UL)slNfm?fSx6odvMGq7GIh#^iz;OpZGiYgR~Go2aSic6hF#Y1)ddxtASSu-VUth zDLzm~x(2^wVA_MWCPuNwb0=WhlX{X)dn^%5d$22zPJ3(5xWpfep6I@{`L!Ib}Vi<~zE zuK-=$BO@={@Cyr%(`o1*3p&4}VqMrTZWPRNXA1^2`aBmJNNi*F6DGDX@d6Op#%7;a z{UnPgGe_F8Puv0BI$q~v_pz)I)c239&tU05FL!f(&nFU`8>LcbsMQN%^~gOr9J`Tq^{3}P8mlZe@Q zkz(*mo}-{PSTOY(Ef`siZ&SfTz0`UDn0m4On3sBS7!y;kLcts_Rf5UCNwAJ%onY$A zYBMkOZ4*p=e=L~#QYQx;ClYlseU!45%|3iTtL#&x*fpK};7Lvto9r>@$_}7^1@x)p zxznI$65nRvEMoB72Axh z!0LIL=%9QB@G8*X6aLk}7X=pqYxD`=p^ZlfE(O*F)86@l7XqvGp2+{Y(Aj)G!7G57 z*mg{858~5kJGO_}XV?agX8b{78<6J{@URUWoaB-4I!sGmprA2N0aKoOh7U}6*9s5q zmLr(5na#|r<|zv(qp0|O=swevg<#12*F~G^ZQAQe%A2D^F zB$zs@brI;)nQcHG>Rclj2Tk3(fzC3w3Y~ek3ugK4f^ksK`6-9G{6OgBe@d{9Ba^+p z_t@%7oy_NHs*O;u?}A4seJ}nXjlz#|x>NS z<5A;i)l=yPJ?{sgT+{w>z{$%De##|gz9E9Cn`#%(DMQV(z?8Agp_Tc|3M)7F@n7*O ziUz_26xEg@;#Up-L)`DHD(#Ck90M-$kNyl2QnI!$X5&A(E&tnZvQDV-m-;5uAfCa5 zNaO*7J1P*#nu?;$n!#LJQp0dD{|Z0lO0LTl5gkKA#Vz@lit0C?tuP~iR=?brR_HPr zDi|JP!i4!oOpOUD>W{?~m&w_Op$+bEWEE>9wf+q7PqWzS-bY(T%8Lpr(_e}ITM0G= z>VROyN)r;bHs!3xcD0`>2l*-Yy)k z@N#wPBkpB?EhSdyH%FiKvbs?-g3aX%=qpE59sLM9v=)w~6paRd9-bMB{A+606;xIs z>|H^jg-&0+j^WV|u?B6o-fsz4rAcjgykqGDKCk>5FI|K-$)^*x>k)4 zhU;?P9nnC-#Y!}g%bTg+3{{5Lwa-v}@SAFq)i9eS=+$L9O*m!|`>GiT_43;GnZ;VZ zVOc~X@|RXewS}RW1XNjD>RT6mSw(%V#`Iqml}m-rGNuRyZnR%EM|>Zb`VDAi)z<7F z1~bCf6qNcl`=eEmzQQ;(e#YgK(1B5E8a$DXxv|PuSzFn6Kk0|-(h2zzMpN^`ngTAS z%AyJ|FGl)HB)_a`s%!ja7PGYfT`uX8|GP{!cM@L0sUUgG2%I*SP}54uW+kY<%ES}&Ki-`%2I(4S!HZf6+?{iTCG<_ z9SH&FtE?<7DMY9!Mr3BFL&kW!41Z*B^v%s^h-P%Segu+5LV@+eA#P!P(OTH4l416g zV~kRZQY7GKpRT%}CTASV{zlDZvRrCFC{}^klo5MSvXzZfZg_rRyfPGAUQy$pkayd% z@o?LPrXsdp-bc_?Ga#UZUF}c*f1cB-pS4?>^8wc$YK>>ackR=#eUxHE7yaLB7nRS{ z&AMn{U^J7i7A7^mD4W}_!#|Z&7h4*|&R|p;QOOGJToX!5?=54*HH6NL6lzrlAz;JG zRF?W`I8q822@XT8?-Zz(G&_bU~n?kM|h%**95EoHWVzpzqPl_j_dsj4U|fY}QW z>E6m{Z6?Ko>wRi#n#zclU0@obUrjI1Z}X#3ee|D-?wi}JRUslfRuo26(&%nR)#KA=OHpCf=FzoCw0V{SqF2Zqh8IPv4VjtXFN%`7} zf-u^3o@2u>64;h!#Uz0BgKH@C7_U1giZ$U;rOOC;h*Z3^-PMf?=&>k_B0ygC>v&nPg zy#l}AqdY!;HRZi1^6*+jr4<011oL3Z`>9P{ES}->dr!)X7e4AY67NQ+j%k-SAa8gd z`i%e|WoO~XRJzdk=7#c6R9L?YqMs@6BN&6R9L;3v_cxns9g$W-|e_^xV^LPi)0Xp?d!q1e~VUza- z9^bQ=@&b5?VYT1$I7d~&$<%Kv=)_raWpx3*a{{J3z7H|w@&9+M@>0MY)whM^fsZ%~Kc?M2<9kHPOU2KWmu{0c9On-*gCtYl zD4RTfsAKkLzMC@TeFlB3`gI^5-$$9rl=m_Ch_mEE2jtBJrheDsXUcocCa)9nW=I|$ zOnI-^+6BA>9}qt zQ@@YFXRYrl$TRCZ4$NkKLvW;4`^|^Ek4$00$J2j+&nmAO^7#Ld)Nj1-vA(Bm@-i{F z8T;2vrhc#4@;Kp}^7wyX z*7{~a9!wQZrhdN$A90pkIRkm@SCn@Hex|%9Z1VCUZ>Hqo!IXE8Pkx zzip70*@wJQ;IrzNP-1+)M*XH)l;Iqmrx+kLF&0sd=&9=#_gFMDcHj^puYc_cwK%TkY;CBh8ysK^U zo`7>qGldBsPZMqO7M2>{?$CZ;6F%1WZCiW133=V1o5|GgjIBM6K;C;`qP%SUO#S%n zt<`>yUE8;Qr)>J|E{pW%9E&`D6Ks|D66E#Zx|vMr|ELgW$%V)8k&?N7$pg)lx7sEzSw|jIi11MaW7t{covMhe|K9am(`$~$&@z;e8gFDVRv<8{c<~Kro7%Oqvdr#9{)GcOs2fwgU>4Ov6{&Gevw7q z3Y)wOn5_DmFPGTl?Y=iMA1$%SOS8%IV6d$ zZxiIvu4XdpJ05)2`noq7e3W+wex|(7ZR_1_khj7VCVV{QH(XYEDUde`bjn+apDFJd zTl@YV@}}atnaIa<)YiT;A#W$>ly?_?ro4KaJP#)OzWmD;o4nT`uS4YBZISl^u+@HN zAP-$3oJ{?WgF>7oS86sz{1uj#Vg0DHRo?uuMyz?sruc{-#Lp^k#bzV^0qg6NYi!3y z(RZ!#p3mreK4+{otGu)KMfyvjMcyi#yfcu;GR@%Mf(^BVPQ1F-71 zbiC0I?D8H1pH*HnjuYVji<^&6FJ)OQLn zlOOWN;~vgTv;}|9;t!AL)++7J?%U1BGLGi8 z;;ZreX?}=JRL3j(Q4i|CdN7%MUk-}sMmptn4lu5p{?r5d#3@s!>XtO=5^PXz61E#| znmT!k;#r;etvT~^9S*ZZ%Kmz|e3ltohd)S$e@=tnjqn;*@Yk}pZkT3*kO_?AP1wUc zeskPrwdXi@YrmN2y?Q{&B4g9seUJ2FY0Z6e8-2LuQ`-@{7OCxsi=ExKY23hEUB}hw zlh-c+hj*`Q)A^1upn`TwV$YbN?~WN3=+e1uHuiOodp-6Y>|sAPz9b17TQ3W=hU)J3 zG@ZKW{zq|k=HxxkI$dAYh7V~Ag<4x$n+LQG(1!meH(oQg1m3r^*VxRNin?9h6R_Di zb9Fe4(!4vILFc<^<9pIFq6$=doO^H8$`V~8HI`cSN~%cw9V9;K46=52Of6lwyK~(3 z?bC}gTAFekZr7R|ZPFv1?XUjhXee~#=bp|}*(Y;i_x`5m^)HXSVC;{~9g#a_N94G= zC&RlV$Lu(CJoV5O9g7+hTQ;=FUex>k+f*MLh9_v_T_etB3~{{?nmMHVm!aWzG`t=f zK7CJ0tb2&-7oqt>x?i<5RdmDsKRmlB8#}ziYEQ;P6CYabR%4g>o_%gwBpz+#9+->q z>+FcHN0^ZW%{$cONHRHwjWo7OW`FBL*_(XW^n67Z`xi=@HgzfXZ(g69H+??N>KZ(1 zr)I70dr5VTYFGIj$2jgm{yH~(zvup{{J5(8*sA=Ps(k0%q`9&;_`V4!8~QxyR3@Ao z_w9Juui4h;F)U3tVpz(i-%a)G_Z!+&kM5qKdUTqzAyYfnHT+~(N>5iZRKa%9*u%ci zyCX5&!^Xxyfe$wXo#)fWe&!3LjcZ)gI62VeX-sWQ3Qoq(@mH#Rva9{_u>*qHJJv36 zxo_gu-}^@(vw1xZvL|ihHuP->3uWv?pJUmHKF84rc|H3_S@Wn`XY7Rx@_bWqUq*e`L5A;?Ah3*dm#3ZA9jCZcBA8bR|+}fUvQn8d?xj; zYyitv==)ZQuZzFPW*>2OZg#lW74#bI7O(6dOq!cOTSV0twm^y^U22cU+eN&p+=YHm2pL=jsMq(rNoLDr#&Y;JAP0NOzK|PQY zbJxC;`(m-yNN;tc`}}@4}}_c z!J<{8J%NK~8|!y$mmSydyzcy%Bi-CU&gb|i?7j|UjFct>CT2x z+VHnJ+V(u+#N0IeLmV3>Xqy)`{qXa>k8B8qDqB2lq0pWg6-{YFmT%UAuBNo>ywk4_ zT%)DJX$ME0m^{}vuEibKhLB0w?X96hsqL+=97s)ow@gFC;_}E0(n~{r#F4L>NYzUr)V8*>$kW2m^OJn1Yn?`U zKlc3Km3Oe++F4|tm+ZG7T#XUZ=8%WVdsz4{F>*gJC)S>gszAK z>K-@e*Sz?79Xp>T3+CS=#{8QXcPuYlspE>T@n6@GJN-gc^h_lk4%2BxL z9`1zPp<3F8k$G{(0<3+Td1d`Z3c1^=gyliAykX0RZOmV^cy?^v14)51 zj=*g6`|QB%n2g`{QJJjmom*pfY@ZbDZ0>3tKzEiJ3XM36cGwwYOXmBIPj-DXgn1## z)s^EJg*BbQJwP~pTYMON+S@{ZSB@WA`2Gq^&a*h4v(QaB@hBq^Kewf_dgjbfw_qIHm|rmg7u0X3KGg92elY2tU3{FTgL| z$*1~AxF=%T2pZFRITC+M@HPwWVZk@z*d_Q0(R;QW=gDy;j$g;`*9-7(Ot=x+34D)S z)2#Cw%4!DvF}aqH<1bAe?6@Z-7h4)?e& zyoL&edPAYfDoYGTrOJS5IRW=I-sRKX!@@l3%0)q4;;y zE`_eoG`JDpU{{B>wNMFy7`W(mr~59q+d^n^97|1htNX_I z*I5>r7HjTJjYGz}Ec&9fI4q_t<@;12E-f&|6F8G_Ji(NS^QL_h_67r3f(9pzCrHMU0BB){1o;+hm{$t`~ufzC%YE*bnymAozrN$LZRhT zGG_Tavr-3TWVW2!{OLa+wLyGpFI>L(j5{TFJuPbXHT+svMax*YqllZNG*4Qb4qHGJ2)-V>ADxKGVsj% zZ=I8tX-TSU(c7I)?QqgDXH4BM99RhK+^g^G$o7Ros}FlH@2_t0)PXJNKoT1Ue+&1M?z|}byy#BrPSM=nHS010V^W8g>}g&V81of$ZueVznisjJ zc16bH3$YlH?%zdsS?_)G$0xcx*0w+^;kG=|Hpcn!#vz=d)!N*wH05PB4#BEl4MuZ( zyRL|I+)(J8_=1_^Ql;%)r#G>*9SVp+YxX=&@1pFf@)$NSvQdW0)_ktXHyDpPRLe(r zVJtQJ&Hi+b-NE&Q!~H?->Co_EJpO3%d0y>0(S|YJcy8R{S-!!z?YcR-|D8CkR%L;M zA2*-d(dbS*l#ss5>%FCM!=d_H1LMw|O!d5Vbm6xs^%d3#)p_H5G5NA=bgy|cyBat`+p4fi`f>t39pflg&eh_A?r=ECLWjMe8 z#u(Y|b-G3wi#&^&gYj$9Ccu8)wI7{1_uB_f^>zk3=LMU)j-`62%v+96#yefVa|GgI zo8sc=ZFcB&9ZBfNN3f25{YyOXYWS7ITU@*Mp>NE|3U-bQE{=2Eaop*8+tK0jj(s2H zLWMi_UUgh~+Su2*I`xi?>F~~5yFBqr*KR6GCk{`Z+?W(d9W3`yP|^Lcs>DTB0&!P@ zuE4sl!c@WD=5u>joH_a%%tpsT!3`G@I_ewRv|Aq;ImXle^2i;B_w04%Ua$2$zT_Zo z7VAT;Sih$^yT2J4x1;Cr6}*QZP9{3)o=@8OoL={6Qs=A6f4=5<<)_Z> z>X3I{+|Lh>JKXblL02er?D66gy>)-?{Ny&Lt1R?xf_6T^Q5Q;j=YRB9zVGbLa?JbS zecUyD+i^a@334DIMmwH#7E&M7vCMww+0O0HIddBvJ03omd7}O0p+`}(Erwl|AJzhK zsqS<%XLk!`GxwlLLC^BwSArv(_QmeWbmo2oH^VWFc~jP9xW_4DydL+qdJ6LA>(Gh6 z_w3i)&S^s(w>YQwjvni5nC!@X&M{-w8sFd&$DF& zo$jG~W;h$>Xz8cNUHJ5AXT#mv+1;J(2^#J_0{Cp}cv9;RbhLIG9%ZI^#+-2GF5~UC zZ*aPClWX>&Z^wMr+t`LC3Z83E8@l{XOmoA$7wAerYd(jDEg2Rl8R{Mi%Aqbb-+RY; zQU6;K;g2|AJI;-~XV{c`h6WOAn_ADqWPw|2gS}&e)bws@+R;T#@6^VnjREPDruU_1 z$I;e&Paf3l)a+xBbq`X-TTh}~%v{E8n|I)CeaP78a3u~e~8I!pm$Cp+;UUu zpm)c3hJ7|`faZN^;1v&GqHUNKc1aCK@$@;^*1T&+NxN_Gp|F{xAEW$rgQplJif>1Q zbpM|(O;Y!FwT#bGF?7Q|iJH9iWl!qBlc|H;4=OsOU`f$*6z--eVU&ACU5m$ijpjZ> zC)&^%meufZ*su4p@gWJG48ptd;4sDI4+Z1ZT|XX{IC0H;;YVm5HH&(0{gJCA6xOL+ zYdIZd&kxV_8qd_@KkJ1us$DSwV1hdM1-;v$1n;waV#mn_)DO;G=)Dzp(|5l5>GRI+ z+qJU~b#A}O*|0zxcY7WPYqYEaeVAgI0H|)Lrk?SqKTumn{dh^fS`m$<^ z7wF8E-?u9_k!z5^C09_t88VE z)KDnb`(^Oc=J=)o2~GJm&3P>;nCW%|rYDSh{3t#J;i?;kx;t^&BM$eVK&nU0vEIQ$ zdmcaAtLAWYqlCuZ?T^H`QyP2G9o^ULe9_}hJUHC3)H6c=0H(zCCOGkMdNzw-Uck0 zxLE0F{eJhACTufTK0OC2lmajk1k7KbYW7)HrTb=+|8YZy+@D-@JA>y&<~xG#H=gTA zt5*%-J$!W_aljQpcgX@Lro-+B=ofbJ$tmvYAhXP$XT0TT z+tK1qXvuCIu<*N{#zif@?JdLV(dM`nQ-0>auX2x@I-F_vF>BY@7Ch~3_TCz}E7*9N z=k;jM#>pAS8@oiE=3Tfu$XyAiId4VqG#C89rxyl0JB~Ibs>v5$bDFm-&~v(H8h93J z%|`EO*9@YsUS6JC!!(-y2(9cB5zlQSM@L>==Jy4a+50Suj*Zp&$}rWwp7jn!=XKf zJ`3x&tIzuee_YS)QLqU+DV`Wo>n?!Ba>q zwi<#7=tBhChXZF#OLz4H}hP?}(YkxM%^zGA-FQSVaf_z7aa3AWs5oA0 zg9_i+S_T!Usq`VWwC+|{p z+O3p7Ex0{oBlbT!VN<3=K+OvNFDzu2zL~~;JNxcp}ljmLP z>WKHDZC#r8w*xx(Ow~Iy9u{eI1mm01#(Jv1{u(wa8)9(T&Ra7@st( zOSw^fx3FNq@(UN?ObsKnZHFvrGtMM4$89kBwzJ#KZ)Y3aT5xgz(;6IFuqj2`^S#l= zIB4rY#^T9Ox`He}<8$z`CdM$QhiXnjN9+Eg&zFmKyQ%r8?mCVB75~H1S3>_TL;o(H zgy)GVdycP-^y^1;JkY@-#H0B3@IFubXb-;|IedPow(;M;KK!@%%)~WLYlGnUtk%|D zbvr!XGXsp7Gye4}Xu2QWw|(#3VvYAvDOC+zNR>rBx=P!dpr4CeG6ua%+nfZas5(>I z+suivLzkHGAoA8LYtW{Vca#?sjj5~cBXW}gm&ZMIe+rTA8lV_P*Te zFCNAHjz8Xe5EWF3$h;LTar*9wc4dNTVgp2WcH#ob~v_^a$mhQuAk434NdGZ^x zr{SS&I=``NUc^W7qqTX3>p&W#sd+&yvST8PY<;t5BbL}Yw<@spQ+HFRO-=TG4*hGn`&)gm4AF; zMfuv2b+uLgB7NbKd3t#*#8&CI=+_r%h8SIiOUTd>Wu>HiUBA*Y^op{Qni{fDju9nB zFDAh}vQMz*H$+!!CFLrlimsxmQQxH{h3ow_dP%h&sgy=((G(Rm zLN~+ngrhWA%y&unGb4*paNkOYLvHG3_{)f)wM#C}(C@lo#?-s}xp2eXT6qQPP_e$m zuh&%Q)d(JVv##1Q+;}!E3}zcqT1*7>oppxUu85R?e`L;RQ77Nru_g zp?$bOlcra!)tAm+GQpMu!ODs%%JemxYcTrF0c;69lXm^2shiSu#70G=AVkHnWiKqQ zKm~M5h8b)&JGwb+>xE@>FT9q+!RfUF&3i=lgzgbd*AWX#-+8nbR zEs>hfovkhQ7y3)?Mc1;>EbtQlpyKA}Ykei9$OH4%78wnO!4c8L&@|lcW`I2-EN^Y3 zJDU;tF6Cqc7(KYuU%sxU7#+E=q6$Nz2JKX;1_Oc=p}&^YY&IsOx#IDaPnRp`VZ{}- zrA2zVA4TcKh>hnj*Gx`JPtg(jOSO3wf+y+-{D#4_#$UuxNUW75G+nrjB3~rzs*2i5+N}r%GZmp{GTbYMD~5RZf{du}b$~x6uUnJfj7ovMZ;n zgj+3VL_tzU`_}@Sb70oi_$?9NB4G)aY%D>TH_m$DAbnJ!TD6`8Ak@LWb}hm+F?yfB zve;k7aOFHJh@90*_0>FqSwQtyJsi?C(zMkY-2Y{++Pi#M1P7-XNH$Eg$~9aEBRof_ zTAE(6uDpWFt#oZpd12M&O1SAcrX=_-4uxtRejXt{*OmL>w8D|5j4>Au86B=wVI)=@ zrW9k+3RkMHi`M2-aojNKDyoXKb?5{>y{{a+!bM3RCE4|}@D!NZ-4vu+k}m?-7@ah<@e18qVwpf?ZKnQd3-J^_dolra+6$pz7uGqd&o~YcQd) zwwqI4bo<&ljKn`1b1J(;pY*=Er}V~1H#I|PhWn{nB^mN8#xYjsmykJw_8sHj95<2J zsR&z!IJZ@BUWEu}rfcCbGea+`DEG5^M$bkdWnBW%=@O|q+(G)dW^d9y;xJ2adMIxoCnfmD-P2%ov26N{pFKZXc{ywAr`caa-Qv*_tOA{{lN)pOiIRSH~fU zPjHPq4j9qrqXB-y&TrZAIkEb-9k;$td`|4-_wL%9YGYxtRxd2|K`)sj^(m7kAQYUQ zR$Nn4Sv_Oo#C7QOwQCsdn>T`LEwgqaLtc)@GWH(KkQ2b6^M29DSukbNlp7~yPMMy5 z$)k#G;k$AEU+=l7#~(3TjP@}UW15SfQ@cXj0Ogq`f&u8d=ui z;MAsR1H`@`tMhqkpJ{U7H6X6%X_YuKEmP+?+9Y%!rfv8+5&h*Z$&cp_IKNq2D&O+Q zDgGO@8>RkZ)b)w@8%Z%LYJ~NCbmRmmCMp^Y&!hWKjM`B(k|jn(SF)bl%VV#Jq?mAT zF=#Pr7d-3rX^|74n5gJcJipm?{TADK^n0WjE!%cI$96u)cAjTD=O~Dz7;RqU1Sm%B zh!i2ksNH<6=ZhjIihr@~e2MLRsqK8Z_NHY>@PE=Du$?=le=#GkbMJJfe?xy5i19by zI8}dn{c&6V55dP2ulNUPj0I&T@_$$Q8)-ammi}d)FR=`9UN`?A#k~FmVuP58*T1mo zdyC7sT8VN7BD&jY`M(PmGf+#_#>;pj7xUk1(`UO){nm;YxM!r9sL$7J@^za%eqb`=Nd9MS<@s#(_{i2ij45d*=6Bodaf7Y=RW|tufe=p2 zf3vN;-M0MQw(<_!&hHR^M4^t5sN!Qu+hW1CP?5nUIwJ(jS!m;8_hGy0v5( zo9v>*%*PcKF=cbLMNHY$nV9leq{&0k#FVXc$O1r8I*4vc2jD7{t8|dQN7tAv{*fy+ zVwTG_C^6-!z64Bp%Y;sOD+E)XvO^L8lG0(2ft3!ny7P)^JLq!}ShbzlY81{n7OsPy zX~d!@>+Zq+piMl@aMIlQBGrspp-7sn-U<)On*|>Vj}nil4eXBv{As z2ZE{B4+T@Np9-d4e-%vmOi_J<8IkDXlc@~SK>UcQGk=ch_=7~f9UR0+WOd9|&}gqY z1~%=+Gi5i}svfq|ac=G@&mw8V$89zo0eUhEN1A{iG0V>tO#S_Wsf)4?c&N*FgigC1 z5KLX35KLW^4*|ap+$D7Kyds!-{ai3@$V5Gvs0Z;e=uADLd~Y5(B7NpP@R)VK2(06p z**DC(XTk@ujHvzt`3pdwN_rOlAZ6mma=oC>6kH9wkT@TIke1@dHliI?5zoaRq}BK_ z?_=OE68s);vEZR-^isjM09OiD`^*FL#+ONrJ7C&?^&*`%P~#eyZBZa}>QEyXm$W*; zIA{+Drp@;Y#=-FOV5aP+gs$WGu3#Lr4+M|G@h^hYaJ&NcHT6sqoB{e+!IOa1KCqBK z6_|a|ZF7J z5%9AHQ?ET{|lHpnd6AIBhOz!Url@){vZ|M=io$v#Ckfih>V!p zG5#RE zgdced!SkBn9l&oA%cAu6Lf;JiKM*_%6Ute^7yoZ@=L1(&mG1q0z(0t`0wct-Iv6S@ z8Y&s3%^Z}JlqM~QsBuyh6cZCsM{Vo|C&QyTH>7T&S%YLFmX$h9gJ~s><51b1q<_}v zq-JGzytndNIc0HwzqOuq&SG=WnfJc$=Ut!AW`EDKpY^O~{oQ}qdo9S%kSF2~1KOmA zCp`pwxTfsi2pumuPs`)Tw`xujou1I)y!Re9PJ|SZKa2BdD)}}o=NzhLt>FyOIR>2( z!ry_jh5rSdL;jhLn@gUgc|7^&n)5~f5$I1M-=XDG$Q(!zc%9~%qR=TJ7igYOMi~yr z_3x4f6ZxH5#xy{16A>Tuurfu#M`4_l$d7I2egm6&g z7a;CoGEYhf$H~(*e<3=V&^bk(q2*^po(Fjh`Z)8Fk96aNi;xz_6Ux_veZss)8zKA` zaJDelGvKJuQsF1Si^z9sJ4;0V9OUJ~ z`@l2 zBywNPy+r3bl!;HcH~dKv&Vf8lcq#ULuIQPg<7SHdTC~UWAxeYSGQJ7=ZQ^NG^MPZIxuM6jb4+(SJIwee--w02H{99p; zXPvN_eDS$1*@wMXI0gIjg_-VU!l~F_C7g!+RAHu7B*Wp<}<9C)!X)8bgfa!7#uUg0D#J{?nXwwZqw=6RCi4E4zz zL&&tlXQqk~_eJ3t@JqtX?`y)7Ab(GI3iuP@Lhxt8snGvQnD#ji(0&Z~J7Ju1ogaj0 z|2&j0byy}7ggGqC6Q-SC2&aP=3uk~Eg*nXb5gq|PBFwnQginM2Lzv}|h=ZmadJ0z| zFTI2x1`iUZZ+=UElyEw9MhjnmK>uakpcFyy{Q=tEQ;X?3UOXpQ#+UNYk z^o?Wf`-UMuC`|jG3uEV;G;-*3E@Z~#*nC=;{iOrW0j6F$3nw9NtT5BQk3fI7gIN^2R3xso^f0=M0c&KnOc%CrZ#&O|Y zi2FBT_LtMbOjZ@)lvH73I}& znO3|o(@GGog?CdzH zUo2j3@q@yfVP~E27VxiyS?14L`p*l~=iduwL;p45m5?75t^$87{4n?{;mzP5gv${( z?!0hWB?_;E{Bq$caHg=TJ4^pI;Rfi;5#9;DSD0g3K$v-1X~`e7s2sgmaDNFv1@J`4t$4wpE635|e zVfr&xco*|4%&~5nFzezW;XTmVAk4T=3G=>lrzPJlycGI>7G@c~CtQoT9}3rlKNj8q z{#GLhZyTEzEd%(q(&Me_3$nO%~ z2Yy8OO)zHMRpt3Mc#|;4tIfg(!P|uogLetjhrPmV|E~(O55~u9n@!+UVd@VO-UoTE zCBIqtO~|KO@_LJ(6@D8!ZwVg&|Habz#Ny9|4??F!nCG|-_&*8TPZj+6l`x-SJS*G* zyvHzfUK2hAJMRde2LH{{`BL~WY>RU&&J~^lo$ z{GZ^U@Bv&?tQ7tVat8DKzXN%=60vJI372d33G+CEXRh8W{VO!%7RpKJqZ#fg=J6P8 ze4feR#YX1bysF+=@Cd4|uhrZOJL;^4j*ncX6)PK_}0@u)CuJ|Ucd{U%|SO@lDws{f(Gf0k3D z$WyU@Lzr>j6!v5Pp)kwxGhy2KTsRYZ{`M@u9|TpuSa*zpK6w@@)c+$}q&bOlls^N@ zh0Haad}OIpoc5gr7BE60HZtpiO^wVnhYB-I`awC=}$d zOoPn-->H0o)pKmhS>On?Yub$QKY;stALa7yL<*USAf#e5|EFVpc>MT-z&c=B4% z%kybr=6ky^cFrrp%*SqF#@#2Jfjz_7%Jy00opB1#*zPBz4D%2-o4go*5OT0lz6A1I@@Pus90&PG$dM%{;YwZRJYSL-RKEk$U)6@e z%oA-=$A^8sF#Vb-oQeIt!r19|DxlAL35uNc@_;aH{+lrC!m6A+;e7F(V){QG$JPHkz!Smh{~chK-ylmrLzwx#T9{>dy`{tV z)o9ZXIrC}S2J=aN2<6Otn(-t~E9^K^1M};{_@}6jLUSU2-BBE!c0@0kHr2akux8gg_)1% zgc(9?x%=`tgQI2GFKLRuEgCdW^{!wA<^#2y2!!q9>a_T=T z?8APmFzf3jVV1$G!q_=~7G`-g3)7Ceet>lHeyG6J@WMf2N z{>}Rgv_*Zs&!Fn1kQ!1K(={h!mw zt{7MjTz`XUko{oVBIkom*^UJ-?D2~`Cpd%3ib@Iw@vFr_;jhxv7kr^Fl|`pyCceun zC~049cG2u~mVJ z?ML`pxozh=yMDwRst?+W3(&~=rG>R>gyA=5Ky^0f6|p_lUGH3D_Ex?hK1e)d?(r?#1tk+ozd%3!jZ zEh$n`|9CtO$n)o@St*Lj%I1{K3zZU2I=YO|Ce7RfRG(3V>7!;&o6Nb87R+O8Nlwl6 z(pK8mnUaF3MJ16^l8?HlmlVvH*UnjC&b;~NRD>?seqV9v*-qf&X0%5&4}@y7lQCPz zWE!)T1!D37jW9vw}YcqvY#HM1O8QOKbl~UWJLf_m^URYL8x}enI znSFMtT~ud_q~}IL#TA(-rsw^0vDzK$!~V5Os-3nxeI{l{nR$27WKmYlxm5wTZS8he z!D6Ue>>V&R{0VHx$kRgO8 z5Kh_BUITEc**T;`D0RlR#XNuEl!qC7Fz#Xab024lq1xoE5J(&o-4qQP^OK(rM4V}1 zbM^@cHP_S0U!@nNe0ySTy;r zB22t8Q`P;T*#$F@#qcpSPE2YMxy04EdM2jEDVw(dcOopKVqQ_TTlVco;CvID&Z7(y zs)S0#E-lR85|T3;YF54iBx+5*)Jj2@hB;$ccO((CWV8uS9}_vh`iu~|3~M)=Zaup( zX}8ocQo3L&x*TTIDlC?JoCvO|b1w7A*023!gjQ4GMTlndts4!dXfw0Nwe>|CZC7!6 zSy54|1eEVGm5*&rcf5khYQiXV?CEnRPcNG@dops2`_@(_R6F3jQj_n(3~cSHSyiib zEHl&8bS|x|>Y~+`M!32wTWlr`K3&%+FP)@(@n424-P2cak6 zh7tS4v$;1}SB+lfb~Y}WnPFTip=s#5qG|Ky4<05BMMUl2eztRJ8Z>zD(2zlRf!SO5 zVBsGOtIyZpTpIO5a~!7+A6iK8$o>=T$$0dp0-vYYfzK}(ilf@<@wti#MsFJQ$bLDH zGg3ddxgEcwvGEw6eWbYTl|sh(B}_2(E_2yC27AY#M0R5t>HfT?*`J504f@_WlMXyIjU2o_V$dwUE6}pl90)X6t9{w1-DKA$u>m?6Ev= zpdksg!O#F8`}qUm&20UAoA$b5<1v;W|G#4U$M?7*`PWC{__1e5xn4g%qdh#<3)y4+ z+xGZw2%mSFz;qd?WBWG|_HrPjJv6zHy~9wn?eSfIKDRT$*!v5VY=nZv{}*6_vA5P`FJ^SO{apZMV=otl$>^rtbFL6RpEJSO8v{MEUk+@5J(e^5 zyAYePm+G>&2nW(64tK`hF1_{A2VxI?V6I*o?gl6rAnf=8pP#E^ROvdsjlww)ZCNoxyS1 zyF~QpUkl>f_I!xPIx)fEx6rfg?L*^BMO&r4%dqhn?Y)l5wCz>l|8&S&C>VQ1F1;G) zjo?5f!RSqao}KQgvHHDsrrR5vNq30L-rMM8oF~KtV{f3#Uc-3&pAQY5_ENAJdyk4e zWKjnsR%IA_WA71{y^N{&KN|{w_WFt*%Vn0UoU35ZKCc*iO;EPWZx8g4L?{@&KR}P{ zmm|lfh5JW;$aswDu65bl2YXjY9PW%gexGaGJ7d`!AbPaN|Fhcuoo>g!e$cb+B@~AJ z8)(_WYKYt)(!(Ki1 ztT)z+v3H5fUJ2}VWC9YX$G|nfZF?tRFB5vShkyNq>^+BeY5O-nMYlWJU@-Qcf}U+J zWqSC0#DAOc81u{TjBR^0ur~v86O6t4UG^5iUI~=wAO1BGvUf8g*!G-0`hPlZdpAOl zw*7M880;+t)7~}McuchyfNd`m_V(kL3Djfg2O#_T1ECn1IDkFv@qg+(Mtl9DTif%Z zlchp#g0a^ddbT}(vHl+|?Olh>*yFcdwtpG0x6~LDJ^ti7fVRC_*fZ_r$D&97`ofrP zuL1V*X+Q#PFeF3CwwE(gzcWJrvasRmpvQ*tCaE^2W8{mtFCeU z7zR_nF(!Ka$#1V1$Il-K`FDl;+l}~b>^Xe@Cb7EX zw83ppSG_lfg3z-Abr?>eT%vPZ;FVL(-v>ZQLX|Ur8@*p6AI3MzX>S(_kjHs{#(XgU zR}LAL>9az58`hFx85!!xkil0C(~>E%_g^N>uQZK>xytyWiBNmOQa`ZiS+6iXZ1tpj|(pE z5a@SBpy|x=jsrW%`WU&_9l@tcw1-G))yxX6>+^=T5lY_%wYHTlh`?C4MS0v3K6d6C zorkcbHGTSN>))+@S?iDu%Zm2)ZRA=j{f@M>WWn_)6h#Ne``zxwjONC4`cLogiA`J< z*0?0CYc5xtRpndvC;wcv zoJ-;@PIc|mm3XPKcHi2Dv|fihW14{>S%(6ROX`}YZfhKY#RNM$2O7N>zqjMgYgRSw z4|vrIDqgeF&uJeFmHs%6D+e_=)iLK!@7b|BH7V~lr@Bva;;WuOPbab1Q@{1-Yf}fT zDGkP5oiuvDCI}yk%{wh?_tm}yx7C6|SoU=|%#H5IcS4$LUxFN~q#*lT4^}&j!cztH zbjxQG-ka} zreekN(wex{!>YYER0Vyd^>N;bH+qe?+M`E8eg#hkQj><%?z^@g ziVa*~F>$PC$?=A{T>1rb~2a ziKNm+ae>#*EX*9dt#L_Uea4E4<|ZfiyukYO6%{9&^wLC46OhvPv561Lnmx6rVYYIR ztb|ni`Q8^=f(7VK6@ld3K*0^BA=I8hyHX}$=o!7fcW~>Wj?;^;Z!Q=c*!z7$)|O!0 z*9{l1LQjbCS5>Xji@a@;_3E%bRkX9EGOpJ(^@CSq?Z4RC74d}AWZIep$D7?pI&DMrh+WX07#UU@eNBODtT)DKRX+Ij) zcSdkeY^PyXFKyN9LTiq>r0VCrAD{(bYknX5_riTUOc7!sRa;sfMBE2j%k1NdD{&lY zkjps^@&l^~VVK9G$A!ATA-@xtUyKV_@N38J#_`RKxhNay(Rn>OVhLyOh~Mw*Hxes1 zcktBJw&08P@-;p#xwpInnicxN`qeOl7#*ET3@&=@re8sXYdR%$bq&2<(-To95{HT1 z1>Lt5#LwK1g%;N|ZrWNKjKjKi)g7YI{`Gp`Rf~MVlXa;{iLssv)qB)0jW-+_my!5s zl=q@->+|9JruC>*94<~ud@&lo@hgxVkHLIl!x-`I`O5cNf+xB1UlI=099gk^*+WsI zOX)oFQ+Fv`>-4%T*SUW45qu)EK3`>JQdjiy(feA0NA3=etKU|8FRt<7gkEEHZdOan zrd8V~yq|^T=F?Z~;u5e?qwBb+Q{M5^>gXusi5bG$acknMa(rWkM^!%N3?F*+i&3K= zcMxF=)___^*He?Y?(X4k7@C6>3sbu^tP0Lu)}wRfA*W$g-lv&k?_0JbYV^ZS`J=n) z*RQ@ds&bVxAQLNuUcG~uzGD|oV|6i}^4H?4*7?d`jj!G8^FI~0aYt0A70$Merfr6(#2aF_C*M}k|I4R>1M<`F$9nAD>GDXfR`t86PNSSDkVU&!tMd1c>xbo1 zheueg%AXVG-O*eZgEGnd@)_oVr zD~2H#xBfP2^ud-wv%h;D|Dx+FxBZd$*pVZwo|jlYfBTi4QQ zC2I9#YLZ@sPp@n!ZMk@V-mM3ie2-vMbxh3ko?X$@rgn*%J}hc#Ol-}`>i$VsLK3o( z{U4jTKQW_IUEQLm){MsTv${S1us5`>Vl>*rmn|)+Up^C+Uod)1%fRUTf=+5BVCLuc zBhnXCI*IT5ruVE5p3Lo1UECAHeP!HqEW|yXi&&1n$Ej{wGBWkjqrIZzb?jlP5WeS9i$P=~Mzx%6wdD{) zl()8{O3~Y8b<&8fcod)(sAGS9ac>XPxc7|CHu&1;?gmd(o=>Fi=X<>^TU$`BXq4WS z+H&IU#)$r6uo_N3SuAbIygjH3zI$6_{K;CZYw z>^>9o`wKkJbZ*$%w13OaxMdf6e$_c~UWcl+J}%VS6Myn*qVI{W#;R+{J*sNr@^16s zq=fhx-D{DQ2^y8~H;+ibpjn}5h^X&JM6>?FN9tZLQLF5VyAiTAN%Ru4?u zq0?nMma_X0=9L-MxbNvux$B3y@bb}4JAX)fS{+c=3S#PG_@}iy@4dMNnMXEfdc6I) zzsBQT&JsaYo;M<<@{cWP2S)E{No(r#hnBSCdmCGwD)fl|$l1>oSjSGr;UYMRszF{+ zEI0%7YHmzYZm7KH^|%0+25QyCy3|MW?#2XHbyr-HIMykSMS*)e)onceRQi%6{XGZNE z>Rc1Ad+ZZ__yXPj$!jKX9Y%OiKVkT_Sim>01H@QW5Apgr7^rgk{_J5a*}V61XXL0T ze=sXB%HuEpDlp1v7&d$;$DLr7iahqdseOOiJIB*I2P0(OC*RfHw+oAO2gXK~*JM?X z^^_ydSf@TYa7A48#xK?ePsjAH=$3@exP7l;| zS$5IT!20rK7hO92+vLE8=w;pGudY?c%tvGh@9;7?lD~;@Bx~3>r*o9ByWQ zgP$Ld{w_k3uv}=3Xe;z5ItI_q-S-~<$URJJYk1i15?J>nJTk06?n^cdK?zMzMXIhp za9`qY#_fTO**C`KWpu6ovN}0#h+3w%pfBzQ0+&CUw+O>sAoY^O)R@*{~2oj2`Y z(-<6uo07o#>=hNeahcjJu-?C-f){$K4q_Y_E9|s*Yan?%23K<;dE!mX*5tIkH%Z(R6{y{Z`yt)epJ+r@)G(KY1t14B;%aY0wh;~N zfO@HY8uhkfySjzJQt??W$~LZ6aUY{x*w*CatVb8=>@@8EdR$cHET{SpLwI|VnN+uD z>ZXdi*UxO4Ti-bDsZ9klC*0Eo=c>f*PF_UXVU+UiRbIjl6kLSw=pa8}oC|JJ~o9@}>&N^Hz8R$rlC+5=_Nx=y;^1Wk@3~ zy1tJN>ME&e2-Y7>zOa67T|q)!ZOv2b>t1u}3N8o~bgwRmUo$w6+EzaO8~+hoVmxAcY%a>w2&)0CBsL(AnD;V_x$HFY2FHzi&k2>a}@8H>3(BEm4DZ z@q_`Z13f%>2afA{-oR@^RnKV;WXX7~hP6(C7W}R(=gAUFPb)hr-9=mT-u~<8^Euq& ze7YgY#1CM7*_v+~8Uy1zKt-o?A`)*w{!JE{ZrP7ZF9`(qr)oX+_2#hI9s6d+sWxQZg*o`bECRN*XPB& zjb8M_m>BPQpVoN1m*OmO^Am$_Z>WA^{@MfjR$iV9ER@TI4O~lD`K%r$RQ6VDsiq!U zGGhR6G{mcN zNPLPnC9K+Ih>VKrq;J_fh1N6vMMxf6msg*Kb^ZLt9Oj^XU~p4buW=PJ9^nS?>vNWI zg!AsO0#lyHU|eMgUZc21J~4Q#F0NqI(U_RXWyXP}f?3gJmY^!4Lvv$jWW#yry=YjQ zntG_lGh=(lxwv`h>Wpouk4H3hVrq&OWNjFM^uq@R8MZ&w2*cM zIFEVxSfqKw85mIcLy4lm6Pq{upiHWz$~!vSdS7VDviV7m`-n;#XZ)jyA4pHFKUyL8 zdfqN;PA)&HuM(a-PsKz6tKvz6 zPN3-O>Y_}&Y%$kI9~j&Gd@h;1JRW1@xJKr! z5;0Ed4#^aZQ9L1fS8iLLd;oo=va`dbzVn-sw>5fIve1~$WYNc-tO_Noo|58er#oAr zXB*~<66JeO)Y$v3&is)#X-va4FQjDQ4%fA8F|SdI^?I&eWpzT->??{8DRBS9`jaU*j8c z>(M~pI4sXyTvpc@=Z#9^GnAL;GWK{lfNR&e!L5n;>~!V7jiV07(L-KnR65R(2{D0w zWvg0RmTmVeIUSgQ%b0yDu7(zLUSgVwA9%L5I<4RmRgH2_zH%m#w zC??(+6(Iua`!FKF>@%IDnFR;ec$RmGRI*Ndij=GU+-Yq~3(gO>CEpW8E4CArgZsw^v&<>{$ukpBex3i5clI5fU^4D~6Z50d600|!T3b`!Wy({&O_q7#T&J{YTAhZ6Wr*m~M`s1N+BJF?!zAuqPo z-j%HD)jYTVbMiCuKVDl9|MDd(qb@CKShc$@KJo4yEAQz1c$cG1^+VVFzgXg0K6n_^ z`rSeM1<0HA>)bwTEz;1N(PlZ`LE#nhriEWIH7oFi)%hl2c$vrus^*o$@N2y0HBU>~ ze47_qmCrgB(Rz4!LYJm`JJMc^F`}l)M`$ra%ZfP`^2NMmYKkW8P@5x&qaA2-B$QH{ zBZw0&PWezGyqKc(ihFn&MfYl-=TJAVw1-w*gfnfD47olHhh`MXO2R(%W@*Uz2*+;b z7bm`3ZpjU;qR7=`xsIz{^L%+Wl%(}Bi!%}HyWmIZ3(aHY_q z!a>d`tGDKG+KI3lD3-`9ns-;f`M%i&TymC}v7o1^lQ0 zi$|lNeCk6iM}J(4O2lwr3cPfdNKh-%|~>VkP#@H4z#=e+)E8Ck5rIx5SDt~B#5C%KjL%DjBg;!~fMVFmBZ zMXl;Ig3h#(qJlDqD;nDwiM05$RZ@AXZCDLUR<*`g#>HGD*_0nDku5}3;n|{_cwAo= zA6D=yWy^SIq1uq$a5KPL@zWNRurEvT@`Gnpm~F;NOTm|lWu>PNl+P#&`(G7};PD6f!i)s|t`?pM zJKga{|EFEdQSJZtuHTQj(&zlSCeYqhE`Nqfdi!v!JKk7)%XOUVHJQNpbuN3HQ`!U` z-|hPSk?VJFdAaH>lv{Uv0q`HL@{4tq&;6o57wLA#8~KSY{X1Oc^@JSf{7l{PhWsTi z|L=7D4!V9b9TS)z&ZBPvf8%VS!fmQPdOGv0F396tL&OCBo*?yeiSqvv=Vkf*0*-Ml z(05$^Z*%>Qb=BuevCpYxy5ptP%U#Dg|1!f3*t%o(9?qp^0{!9qj|_jp)*Z7qnYD$r zy}?eI%ifi){Bv$26KLPN?pRgh8&~?zi+vyB#>?8b9(k#bsva6epcyjj z5wD^-9vRAbm~u`l$8p{xgFVM_4?l=NV3SD@zxk~MnYJ$xrfr`vZQmqJor%Is=T>1R zQ6Nlvg~Cje!T48VycBY^rW3Pl#ke8DO;t#@7Y?MC@d5}Da(r`chBji>1O`VfcYLd zZL&Q0jVyUQc)svNFt3G-4^_f!Uuw-D@!^jmp9J|wmcCji2s$N@b3SO=DFt82ej;(N zwb(DrG9M+(GS9bk?hu|2`F+Amz}tk&!MwgU_WvZj6!O=EbHGQ0gWyxbE5T=kflg=m zXzX;i_!5g#Egmdfg}B3o9|n)MbaI8+4{jA+2cBu^%n{xI`9k4(@V&y+UoKn=-YdKr zd|0>__@ppUuepQYTfiOBVNAZd3O^5dUt#vSp~8OfaADdUBMfxL3ul7!EuBJ3=T6~l z=*$*o`7aS(1g;dO{c2&LQzOi{j|wv`1IGadWJ&S0Xv;BVHW&miHqT&%dQ6t1jBi*N3bC0va*N5(DMeY72tNugCCl~je33r~`4Y0Ut8%imtEHmz z7IapUFT@{&Dr~er3G#=9%Tczh{si98AgHznhMT(Wfm!xGY}8>L%@&3!y|$plWm?o> zJ**aH75rY9MY>x!1^YLJv2)%PrjLIW&c^;DVeIsL;IL2MPmA1#eKFf4|KPht7d2E!np9|((4W_L62(xYrg{OekT6?fl2(GmB zR|>P99~CYE^LY?$mV&vSin0H)@KVT|goEJMg<0NQmxB7K;J*rw2dncYq!{;KAD!>aKjV%F;=*~}tv2%VV%zWG-%zUtJsL!wh8#xtwbsq<&@3kVQ?^}fF zd!sORdi`|hvpn{TJQMr(g|X9f+ltO-BKKi`LYU=uS{OU$2Vp<g*^^WA@#dXeW;s$RhKMb!%!uIf4J z!K{~SuqBB8kA>;iNMZVQt1$hVBh2z#EbPPneqs9fh%kNJAdH<}+Z1WB?ik!<)dBs6 z{s#`UkH8GZsj?aDj#sDe85bf zk6IGIEFbzxX8Jr8ky$3HJ%gG4Eh1<7sy##Q1J4pUc6vT}$mt7%JMRy`w>EjdUhAs7 zHlzH9%pc;%lq;+>GsgNCf!5OY12M&FbZRs zDsvVBf)AT#3`xcu=p;iY6~CD-=f+xTF>bCPezS6_4hw%GjbyDn2&NcUh&|2Czvk~bKZyFsZjY)6FP^c;G7qJvFQKyWW{)W zLrodZiIeA>If&a#a;x923cq?4nr68D#?WpQQ(vLN48MDG)_xRzLrmU-Yd>w7HxUy| z&MPjMRTP?Gcxq80=Wd*aNs#qq!^Ri1r)dRup;AJ%8KD+r(!(}|qf=9_nnjun_grqa z8_{x(O?2wa`R++|T`#?v2=ra%+dbQ4x@?N(?Z0-WtEI}>C$yz!p?0dLinZNf^U_mD zwm*d|-Nj6koVZ@8s@KHM+7xt=nWoDzO7$uALYmZ4`?EoxHL~&D?#%94Y5$L=wLNQo zBF}Kk!MXixM2r)0(plA%XNAibJg+H-Z>_Trf~6dK^<#WcPIhiT~NOrKeDj&cpXLVC6-a?j=7 zKV+nhuex{e45i*r3^kNcX0(Fp@`Xiu2@|b())sDR-Mq9Hn!Wd2xj09}cB)jjfPXr% zcA~W@q*gNsxB9`pW~SS3b3mKN%ZGEyTF)MAzkhEMQ@v2l!plCX2FBT~V{z!^v2#pM zJWbClZ07GZ_UWmdCyPo-=HSfLc7EZrR;lzd^+I^7sfN#0rR_!xyA=LRp}k3p!@9^{ zgf~P@cK^xQg{O7Z|GU8Dy$V12kzUW;{PqZNemF87YpTHeB|GrGgrNWmZatqmqW>5@ zKAR`|<=8@mhfk3abg+qO3eH{x3mF$>2~r6GG<%h9%1io)Rgf+o-g!$+?2^QK{bLga(? zm`Ccd{J4IhZ7&;%r9*ClvA59W-P~=i9cu`LJidH)!nTxa^f9(Os}Z zd%QO`_SPbAw!PzUn)kyd7<>N)J+fa8_y_CfEVRex9>(4jm%Y=l$LHcE7<)f+*~^DL zmJ99iag(w4E!g%iAB9^3nF+=opDmF6av%tM^AVBu_&Ctm+XJ@keF1xXpV9y~D7_XN@Kp|CYGymEu`j zJ(TEQGB)EM->rb#p>eVXjR{>n6pX!pfgaf}N0RW+X%U$AF2`o<{nTY|7wr8~;&5l| zjd$6rg1x0UPJ4YskNx*z^e@}L5eX<~$W1Wz5}`--%Yg(u_~o-O+Utjn$7t{4*w*&O z!`Kawn_%o6hMsM2yk)OHl#RX4uKccpy)W*v818kX%AgFWbXdMi*z zCQy$X>ymq8FVz>$6T~WA?mvVQ^?1%;DE8_9tE(UQ!(-eA$@$30_xTLzJ#`qWa6Y%^ j936q{I{J{Mj%r)PS;&X+jlXG+?+MZlhC<~Z&!7JThNaJe diff --git a/esp-mbedtls-sys/src/include/riscv32imac-unknown-none-elf.rs b/esp-mbedtls-sys/src/include/riscv32imac-unknown-none-elf.rs index 42738ece..a7588196 100644 --- a/esp-mbedtls-sys/src/include/riscv32imac-unknown-none-elf.rs +++ b/esp-mbedtls-sys/src/include/riscv32imac-unknown-none-elf.rs @@ -137,6 +137,36 @@ where } } } +#[repr(C)] +#[derive(Default)] +pub struct __IncompleteArrayField(::core::marker::PhantomData, [T; 0]); +impl __IncompleteArrayField { + #[inline] + pub const fn new() -> Self { + __IncompleteArrayField(::core::marker::PhantomData, []) + } + #[inline] + pub fn as_ptr(&self) -> *const T { + self as *const _ as *const T + } + #[inline] + pub fn as_mut_ptr(&mut self) -> *mut T { + self as *mut _ as *mut T + } + #[inline] + pub unsafe fn as_slice(&self, len: usize) -> &[T] { + ::core::slice::from_raw_parts(self.as_ptr(), len) + } + #[inline] + pub unsafe fn as_mut_slice(&mut self, len: usize) -> &mut [T] { + ::core::slice::from_raw_parts_mut(self.as_mut_ptr(), len) + } +} +impl ::core::fmt::Debug for __IncompleteArrayField { + fn fmt(&self, fmt: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result { + fmt.write_str("__IncompleteArrayField") + } +} pub const MBEDTLS_CONFIG_FILE: &[u8; 9] = b"config.h\0"; pub const MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT: u32 = 0; pub const MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: u32 = 1024; @@ -144,14 +174,33 @@ pub const MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE: u32 = 6000; pub const MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH: u32 = 32; pub const MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS: u32 = 1; pub const MBEDTLS_VERSION_MAJOR: u32 = 3; -pub const MBEDTLS_VERSION_MINOR: u32 = 4; -pub const MBEDTLS_VERSION_PATCH: u32 = 0; -pub const MBEDTLS_VERSION_NUMBER: u32 = 50593792; -pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.4.0\0"; -pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"mbed TLS 3.4.0\0"; +pub const MBEDTLS_VERSION_MINOR: u32 = 6; +pub const MBEDTLS_VERSION_PATCH: u32 = 5; +pub const MBEDTLS_VERSION_NUMBER: u32 = 50726144; +pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.6.5\0"; +pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"Mbed TLS 3.6.5\0"; +pub const PSA_WANT_ALG_MD5: u32 = 1; +pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; +pub const PSA_WANT_ALG_SHA_1: u32 = 1; +pub const PSA_WANT_ALG_SHA_224: u32 = 1; +pub const PSA_WANT_ALG_SHA_256: u32 = 1; +pub const PSA_WANT_ALG_SHA_384: u32 = 1; +pub const PSA_WANT_ALG_SHA_512: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_256: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_384: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_512: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_255: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_448: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_224: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_256: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_384: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_521: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CCM: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CMAC: u32 = 1; pub const PSA_WANT_ALG_CMAC: u32 = 1; @@ -162,10 +211,40 @@ pub const PSA_WANT_ALG_ECDSA: u32 = 1; pub const PSA_WANT_ALG_ECDSA_ANY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA: u32 = 1; pub const PSA_WANT_ALG_DETERMINISTIC_ECDSA: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_ALG_FFDH: u32 = 1; +pub const PSA_WANT_DH_RFC7919_2048: u32 = 1; +pub const PSA_WANT_DH_RFC7919_3072: u32 = 1; +pub const PSA_WANT_DH_RFC7919_4096: u32 = 1; +pub const PSA_WANT_DH_RFC7919_6144: u32 = 1; +pub const PSA_WANT_DH_RFC7919_8192: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_FFDH: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_GCM: u32 = 1; pub const PSA_WANT_ALG_GCM: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HMAC: u32 = 1; @@ -176,17 +255,16 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXTRACT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXPAND: u32 = 1; +pub const PSA_WANT_KEY_TYPE_HMAC: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF: u32 = 1; pub const PSA_WANT_ALG_TLS12_PRF: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const PSA_WANT_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_MD5: u32 = 1; -pub const PSA_WANT_ALG_MD5: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_PAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_JPAKE: u32 = 1; pub const PSA_WANT_ALG_JPAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160: u32 = 1; -pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const PSA_WANT_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN: u32 = 1; @@ -196,20 +274,19 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP: u32 = 1; pub const PSA_WANT_ALG_RSA_OAEP: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS: u32 = 1; pub const PSA_WANT_ALG_RSA_PSS: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_1: u32 = 1; -pub const PSA_WANT_ALG_SHA_1: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_224: u32 = 1; -pub const PSA_WANT_ALG_SHA_224: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_256: u32 = 1; -pub const PSA_WANT_ALG_SHA_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_384: u32 = 1; -pub const PSA_WANT_ALG_SHA_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_512: u32 = 1; -pub const PSA_WANT_ALG_SHA_512: u32 = 1; pub const PSA_WANT_KEY_TYPE_AES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES: u32 = 1; pub const PSA_WANT_KEY_TYPE_ARIA: u32 = 1; @@ -221,8 +298,8 @@ pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_KEY_TYPE_CHACHA20: u32 = 1; -pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20: u32 = 1; +pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER: u32 = 1; pub const PSA_WANT_ALG_CHACHA20_POLY1305: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305: u32 = 1; @@ -250,8 +327,7 @@ pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256: u32 = 1; -pub const PSA_HAVE_FULL_ECDSA: u32 = 1; -pub const PSA_HAVE_FULL_JPAKE: u32 = 1; +pub const PSA_WANT_ALG_SOME_PAKE: u32 = 1; pub const PSA_WANT_KEY_TYPE_DERIVE: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD_HASH: u32 = 1; @@ -272,7 +348,7 @@ pub const MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: i32 = -12; pub const MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: i32 = -14; pub const MBEDTLS_ERR_MPI_ALLOC_FAILED: i32 = -16; pub const MBEDTLS_MPI_MAX_LIMBS: u32 = 10000; -pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 2; +pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 3; pub const MBEDTLS_MPI_MAX_SIZE: u32 = 1024; pub const MBEDTLS_MPI_MAX_BITS: u32 = 8192; pub const MBEDTLS_MPI_MAX_BITS_SCALE100: u32 = 819200; @@ -320,6 +396,8 @@ pub const MBEDTLS_CIPHER_VARIABLE_KEY_LEN: u32 = 2; pub const MBEDTLS_MAX_IV_LENGTH: u32 = 16; pub const MBEDTLS_MAX_BLOCK_LENGTH: u32 = 16; pub const MBEDTLS_MAX_KEY_LENGTH: u32 = 64; +pub const MBEDTLS_KEY_BITLEN_SHIFT: u32 = 6; +pub const MBEDTLS_IV_SIZE_SHIFT: u32 = 2; pub const MBEDTLS_CCM_DECRYPT: u32 = 0; pub const MBEDTLS_CCM_ENCRYPT: u32 = 1; pub const MBEDTLS_CCM_STAR_DECRYPT: u32 = 2; @@ -332,7 +410,26 @@ pub const MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: i32 = -84; pub const MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: i32 = -86; pub const MBEDTLS_AES_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_DES3_BLOCK_SIZE: u32 = 8; +pub const MBEDTLS_CMAC_MAX_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_CIPHER_BLKSIZE_MAX: u32 = 16; +pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; +pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; +pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; +pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; +pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; +pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; +pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; +pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; +pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; +pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; +pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; +pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; +pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; +pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; +pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; +pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; +pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; +pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: i32 = -52; pub const MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: i32 = -54; pub const MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: i32 = -56; @@ -367,12 +464,6 @@ pub const MBEDTLS_ECP_MAX_PT_LEN: u32 = 133; pub const MBEDTLS_ECP_PF_UNCOMPRESSED: u32 = 0; pub const MBEDTLS_ECP_PF_COMPRESSED: u32 = 1; pub const MBEDTLS_ECP_TLS_NAMED_CURVE: u32 = 3; -pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; -pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; -pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; -pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; -pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; -pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; pub const MBEDTLS_ERR_RSA_BAD_INPUT_DATA: i32 = -16512; pub const MBEDTLS_ERR_RSA_INVALID_PADDING: i32 = -16640; pub const MBEDTLS_ERR_RSA_KEY_GEN_FAILED: i32 = -16768; @@ -387,6 +478,55 @@ pub const MBEDTLS_RSA_PKCS_V21: u32 = 1; pub const MBEDTLS_RSA_SIGN: u32 = 1; pub const MBEDTLS_RSA_CRYPT: u32 = 2; pub const MBEDTLS_RSA_SALT_LEN_ANY: i32 = -1; +pub const MBEDTLS_RSA_GEN_KEY_MIN_BITS: u32 = 1024; +pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; +pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; +pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; +pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; +pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; +pub const PSA_HASH_MAX_SIZE: u32 = 64; +pub const PSA_MAC_MAX_SIZE: u32 = 64; +pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; +pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; +pub const PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS: u32 = 1024; +pub const PSA_VENDOR_FFDH_MAX_KEY_BITS: u32 = 8192; +pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; +pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; +pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; +pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; +pub const PSA_VENDOR_PBKDF2_MAX_ITERATIONS: u32 = 4294967295; +pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; +pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_SIGNATURE_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_KEY_PAIR_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_PUBLIC_KEY_MAX_SIZE: u32 = 1; +pub const PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE: u32 = 1; +pub const PSA_CIPHER_MAX_KEY_LENGTH: u32 = 32; +pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; +pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; +pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; +pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; +pub const MBEDTLS_ERR_SHA3_BAD_INPUT_DATA: i32 = -118; +pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; +pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; +pub const MBEDTLS_GCM_DECRYPT: u32 = 0; +pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; +pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; +pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; +pub const MBEDTLS_GCM_HTABLE_SIZE: u32 = 16; +pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; +pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; +pub const PSA_MAX_KEY_BITS: u32 = 65528; +pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; +pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; +pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; +pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; +pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; +pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; +pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_ERR_PK_ALLOC_FAILED: i32 = -16256; pub const MBEDTLS_ERR_PK_TYPE_MISMATCH: i32 = -16128; pub const MBEDTLS_ERR_PK_BAD_INPUT_DATA: i32 = -16000; @@ -597,45 +737,6 @@ pub const MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256: u32 = 4869; pub const MBEDTLS_CIPHERSUITE_WEAK: u32 = 1; pub const MBEDTLS_CIPHERSUITE_SHORT_TAG: u32 = 2; pub const MBEDTLS_CIPHERSUITE_NODTLS: u32 = 4; -pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; -pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; -pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; -pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; -pub const PSA_HASH_MAX_SIZE: u32 = 64; -pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; -pub const PSA_MAC_MAX_SIZE: u32 = 64; -pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; -pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; -pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; -pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; -pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; -pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; -pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; -pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; -pub const MBEDTLS_GCM_DECRYPT: u32 = 0; -pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; -pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; -pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; -pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; -pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; -pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; -pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; -pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; -pub const PSA_MAX_KEY_BITS: u32 = 65528; -pub const MBEDTLS_PSA_KA_MASK_DUAL_USE: u32 = 0; -pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; -pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; -pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; -pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; -pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; -pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; -pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_X509_MAX_INTERMEDIATE_CA: u32 = 8; pub const MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE: i32 = -8320; pub const MBEDTLS_ERR_X509_UNKNOWN_OID: i32 = -8448; @@ -743,7 +844,9 @@ pub const MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: i32 = -30848; pub const MBEDTLS_ERR_SSL_BAD_CERTIFICATE: i32 = -31232; pub const MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET: i32 = -31488; pub const MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA: i32 = -31616; -pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31872; +pub const MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND: i32 = -32384; pub const MBEDTLS_ERR_SSL_ALLOC_FAILED: i32 = -32512; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FAILED: i32 = -32640; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: i32 = -28544; @@ -770,6 +873,7 @@ pub const MBEDTLS_ERR_SSL_EARLY_MESSAGE: i32 = -25728; pub const MBEDTLS_ERR_SSL_UNEXPECTED_CID: i32 = -24576; pub const MBEDTLS_ERR_SSL_VERSION_MISMATCH: i32 = -24320; pub const MBEDTLS_ERR_SSL_BAD_CONFIG: i32 = -24192; +pub const MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME: i32 = -23936; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE: u32 = 1; pub const MBEDTLS_SSL_IANA_TLS_GROUP_NONE: u32 = 0; @@ -841,6 +945,8 @@ pub const MBEDTLS_SSL_TRUNC_HMAC_ENABLED: u32 = 1; pub const MBEDTLS_SSL_TRUNCATED_HMAC_LEN: u32 = 10; pub const MBEDTLS_SSL_SESSION_TICKETS_DISABLED: u32 = 0; pub const MBEDTLS_SSL_SESSION_TICKETS_ENABLED: u32 = 1; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED: u32 = 0; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED: u32 = 1; pub const MBEDTLS_SSL_PRESET_DEFAULT: u32 = 0; pub const MBEDTLS_SSL_PRESET_SUITEB: u32 = 2; pub const MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED: u32 = 1; @@ -854,6 +960,9 @@ pub const MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN: u32 = 48; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN: u32 = 1000; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX: u32 = 60000; +pub const MBEDTLS_SSL_EARLY_DATA_NO_DISCARD: u32 = 0; +pub const MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD: u32 = 1; +pub const MBEDTLS_SSL_EARLY_DATA_DISCARD: u32 = 2; pub const MBEDTLS_SSL_IN_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_OUT_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_DTLS_MAX_BUFFERING: u32 = 32768; @@ -988,18 +1097,6 @@ pub const MBEDTLS_SSL_UNEXPECTED_CID_IGNORE: u32 = 0; pub const MBEDTLS_SSL_UNEXPECTED_CID_FAIL: u32 = 1; pub const MBEDTLS_PRINTF_SIZET: &[u8; 3] = b"zu\0"; pub const MBEDTLS_PRINTF_LONGLONG: &[u8; 4] = b"lld\0"; -pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; -pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; -pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; -pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; -pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; -pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; -pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; -pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; -pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; -pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; -pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; -pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_HKDF_BAD_INPUT_DATA: i32 = -24448; pub const MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: i32 = -3; pub const MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: i32 = -5; @@ -1041,6 +1138,7 @@ pub const MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS: u32 = 4096; pub const MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY: u32 = 8192; pub const MBEDTLS_OID_X509_EXT_FRESHEST_CRL: u32 = 16384; pub const MBEDTLS_OID_X509_EXT_NS_CERT_TYPE: u32 = 65536; +pub const MBEDTLS_OID_MAX_COMPONENTS: u32 = 128; pub const MBEDTLS_OID_ISO_MEMBER_BODIES: &[u8; 2] = b"*\0"; pub const MBEDTLS_OID_ISO_IDENTIFIED_ORG: &[u8; 2] = b"+\0"; pub const MBEDTLS_OID_ISO_CCITT_DS: &[u8; 2] = b"U\0"; @@ -1055,6 +1153,8 @@ pub const MBEDTLS_OID_ORG_OIW: &[u8; 2] = b"\x0E\0"; pub const MBEDTLS_OID_OIW_SECSIG: &[u8; 3] = b"\x0E\x03\0"; pub const MBEDTLS_OID_OIW_SECSIG_ALG: &[u8; 4] = b"\x0E\x03\x02\0"; pub const MBEDTLS_OID_OIW_SECSIG_SHA1: &[u8; 5] = b"\x0E\x03\x02\x1A\0"; +pub const MBEDTLS_OID_ORG_THAWTE: &[u8; 2] = b"e\0"; +pub const MBEDTLS_OID_THAWTE: &[u8; 3] = b"+e\0"; pub const MBEDTLS_OID_ORG_CERTICOM: &[u8; 3] = b"\x81\x04\0"; pub const MBEDTLS_OID_CERTICOM: &[u8; 4] = b"+\x81\x04\0"; pub const MBEDTLS_OID_ORG_TELETRUST: &[u8; 2] = b"$\0"; @@ -1153,14 +1253,26 @@ pub const MBEDTLS_OID_DIGEST_ALG_SHA256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x pub const MBEDTLS_OID_DIGEST_ALG_SHA384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x02\0"; pub const MBEDTLS_OID_DIGEST_ALG_SHA512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x03\0"; pub const MBEDTLS_OID_DIGEST_ALG_RIPEMD160: &[u8; 6] = b"+$\x03\x02\x01\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x07\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x08\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\t\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA1: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x07\0"; pub const MBEDTLS_OID_HMAC_SHA224: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x08\0"; pub const MBEDTLS_OID_HMAC_SHA256: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\t\0"; pub const MBEDTLS_OID_HMAC_SHA384: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA512: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x0B\0"; +pub const MBEDTLS_OID_HMAC_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\r\0"; +pub const MBEDTLS_OID_HMAC_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0E\0"; +pub const MBEDTLS_OID_HMAC_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0F\0"; +pub const MBEDTLS_OID_HMAC_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x10\0"; +pub const MBEDTLS_OID_HMAC_RIPEMD160: &[u8; 9] = b"+\x06\x01\x05\x05\x08\x01\x04\0"; pub const MBEDTLS_OID_DES_CBC: &[u8; 6] = b"+\x0E\x03\x02\x07\0"; pub const MBEDTLS_OID_DES_EDE3_CBC: &[u8; 9] = b"*\x86H\x86\xF7\r\x03\x07\0"; pub const MBEDTLS_OID_AES: &[u8; 9] = b"`\x86H\x01e\x03\x04\x01\0"; +pub const MBEDTLS_OID_AES_128_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x02\0"; +pub const MBEDTLS_OID_AES_192_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x16\0"; +pub const MBEDTLS_OID_AES_256_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01*\0"; pub const MBEDTLS_OID_AES128_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x05\0"; pub const MBEDTLS_OID_AES128_KWP: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x08\0"; pub const MBEDTLS_OID_AES192_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x19\0"; @@ -1213,6 +1325,10 @@ pub const MBEDTLS_OID_ECDSA_SHA224: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x01\0"; pub const MBEDTLS_OID_ECDSA_SHA256: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x02\0"; pub const MBEDTLS_OID_ECDSA_SHA384: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x03\0"; pub const MBEDTLS_OID_ECDSA_SHA512: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x04\0"; +pub const MBEDTLS_OID_X25519: &[u8; 4] = b"+en\0"; +pub const MBEDTLS_OID_X448: &[u8; 4] = b"+eo\0"; +pub const MBEDTLS_OID_ED25519: &[u8; 4] = b"+ep\0"; +pub const MBEDTLS_OID_ED448: &[u8; 4] = b"+eq\0"; pub const MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT: i32 = -4224; pub const MBEDTLS_ERR_PEM_INVALID_DATA: i32 = -4352; pub const MBEDTLS_ERR_PEM_ALLOC_FAILED: i32 = -4480; @@ -1226,8 +1342,6 @@ pub const MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA: i32 = -12160; pub const MBEDTLS_ERR_PKCS5_INVALID_FORMAT: i32 = -12032; pub const MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE: i32 = -11904; pub const MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH: i32 = -11776; -pub const MBEDTLS_PKCS5_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS5_ENCRYPT: u32 = 1; pub const MBEDTLS_ERR_PKCS7_INVALID_FORMAT: i32 = -21248; pub const MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE: i32 = -21376; pub const MBEDTLS_ERR_PKCS7_INVALID_VERSION: i32 = -21504; @@ -1248,8 +1362,6 @@ pub const MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH: i32 = -7680; pub const MBEDTLS_PKCS12_DERIVE_KEY: u32 = 1; pub const MBEDTLS_PKCS12_DERIVE_IV: u32 = 2; pub const MBEDTLS_PKCS12_DERIVE_MAC_KEY: u32 = 3; -pub const MBEDTLS_PKCS12_PBE_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS12_PBE_ENCRYPT: u32 = 1; pub const MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT: u32 = 86400; pub const MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES: u32 = 50; pub const MBEDTLS_SSL_COOKIE_TIMEOUT: u32 = 60; @@ -1375,6 +1487,59 @@ unsafe extern "C" { /// \param len Length of the buffer in bytes pub fn mbedtls_platform_zeroize(buf: *mut ::core::ffi::c_void, len: usize); } +/// \brief The type of custom random generator (RNG) callbacks. +/// +/// Many Mbed TLS functions take two parameters +/// `mbedtls_f_rng_t *f_rng, void *p_rng`. The +/// library will call \c f_rng to generate +/// random values. +/// +/// \note This is typically one of the following: +/// - mbedtls_ctr_drbg_random() with \c p_rng +/// pointing to a #mbedtls_ctr_drbg_context; +/// - mbedtls_hmac_drbg_random() with \c p_rng +/// pointing to a #mbedtls_hmac_drbg_context; +/// - mbedtls_psa_get_random() with +/// `prng = MBEDTLS_PSA_RANDOM_STATE`. +/// +/// \note Generally, given a call +/// `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback +/// and the context only need to remain valid until +/// the call to `mbedtls_foo` returns. However, there +/// are a few exceptions where the callback is stored +/// in for future use. Check the documentation of +/// the calling function. +/// +/// \warning In a multithreaded environment, calling the +/// function should be thread-safe. The standard +/// functions provided by the library are thread-safe +/// when #MBEDTLS_THREADING_C is enabled. +/// +/// \warning This function must either provide as many +/// bytes as requested of **cryptographic quality** +/// random data, or return a negative error code. +/// +/// \param p_rng The \c p_rng argument that was passed along \c f_rng. +/// The library always passes \c p_rng unchanged. +/// This is typically a pointer to the random generator +/// state, or \c NULL if the custom random generator +/// doesn't need a context-specific state. +/// \param[out] output On success, this must be filled with \p output_size +/// bytes of cryptographic-quality random data. +/// \param output_size The number of bytes to output. +/// +/// \return \c 0 on success, or a negative error code on failure. +/// Library functions will generally propagate this +/// error code, so \c MBEDTLS_ERR_xxx values are +/// recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is +/// typically sensible for RNG failures. +pub type mbedtls_f_rng_t = ::core::option::Option< + unsafe extern "C" fn( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + ) -> ::core::ffi::c_int, +>; /// \brief The AES context-type definition. #[repr(C)] #[derive(Copy, Clone)] @@ -1933,6 +2098,10 @@ pub type mbedtls_t_udbl = u64; #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_mpi { + /// Pointer to limbs. + /// + /// This may be \c NULL if \c n is 0. + pub private_p: *mut mbedtls_mpi_uint, /// Sign: -1 if the mpi is negative, 1 otherwise. /// /// The number 0 must be represented with `s = +1`. Although many library @@ -1943,13 +2112,9 @@ pub struct mbedtls_mpi { /// /// Note that this implies that calloc() or `... = {0}` does not create /// a valid MPI representation. You must call mbedtls_mpi_init(). - pub private_s: ::core::ffi::c_int, + pub private_s: ::core::ffi::c_short, /// Total number of limbs in \c p. - pub private_n: usize, - /// Pointer to limbs. - /// - /// This may be \c NULL if \c n is 0. - pub private_p: *mut mbedtls_mpi_uint, + pub private_n: ::core::ffi::c_ushort, } impl Default for mbedtls_mpi { fn default() -> Self { @@ -2224,7 +2389,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2241,7 +2406,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2296,6 +2461,8 @@ unsafe extern "C" { /// \brief Perform a left-shift on an MPI: X <<= count /// /// \param X The MPI to shift. This must point to an initialized MPI. + /// The MPI pointed by \p X may be resized to fit + /// the resulting number. /// \param count The number of bits to shift by. /// /// \return \c 0 if successful. @@ -2588,7 +2755,7 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Perform a sliding-window exponentiation: X = A^E mod N + /// \brief Perform a modular exponentiation: X = A^E mod N /// /// \param X The destination MPI. This must point to an initialized MPI. /// This must not alias E or N. @@ -2639,13 +2806,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_fill_random( X: *mut mbedtls_mpi, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2685,13 +2846,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, min: mbedtls_mpi_sint, N: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2699,6 +2854,7 @@ unsafe extern "C" { /// \brief Compute the greatest common divisor: G = gcd(A, B) /// /// \param G The destination MPI. This must point to an initialized MPI. + /// This will always be positive or 0. /// \param A The first operand. This must point to an initialized MPI. /// \param B The second operand. This must point to an initialized MPI. /// @@ -2715,17 +2871,19 @@ unsafe extern "C" { /// \brief Compute the modular inverse: X = A^-1 mod N /// /// \param X The destination MPI. This must point to an initialized MPI. + /// The value returned on success will be between [1, N-1]. /// \param A The MPI to calculate the modular inverse of. This must point - /// to an initialized MPI. + /// to an initialized MPI. This value can be negative, in which + /// case a positive answer will still be returned in \p X. /// \param N The base of the modular inversion. This must point to an - /// initialized MPI. + /// initialized MPI and be greater than one. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. /// \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than /// or equal to one. - /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - /// with respect to \p N. + /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + /// inverse with respect to \p N. pub fn mbedtls_mpi_inv_mod( X: *mut mbedtls_mpi, A: *const mbedtls_mpi, @@ -2748,7 +2906,7 @@ unsafe extern "C" { /// This must point to an initialized MPI. /// \param rounds The number of bases to perform the Miller-Rabin primality /// test for. The probability of returning 0 on a composite is - /// at most 2-2*\p rounds. + /// at most 2-2*\p rounds . /// \param f_rng The RNG function to use. This must not be \c NULL. /// \param p_rng The RNG parameter to be passed to \p f_rng. /// This may be \c NULL if \p f_rng doesn't use @@ -2761,13 +2919,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_is_prime_ext( X: *const mbedtls_mpi, rounds: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2804,13 +2956,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, nbits: usize, flags: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -3187,7 +3333,7 @@ unsafe extern "C" { /// on a successful invocation. /// \param end The end of the ASN.1 SEQUENCE container. /// \param tag_must_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_must_value. + /// the SEQUENCE before comparing to \p tag_must_val. /// \param tag_must_val The required value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_must_mask. /// Mismatching tags lead to an error. @@ -3196,7 +3342,7 @@ unsafe extern "C" { /// while a value of \c 0xFF for \p tag_must_mask means /// that \p tag_must_val is the only allowed tag. /// \param tag_may_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_may_value. + /// the SEQUENCE before comparing to \p tag_may_val. /// \param tag_may_val The desired value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_may_mask. /// Mismatching tags will be silently ignored. @@ -3489,6 +3635,30 @@ unsafe extern "C" { par_len: usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + /// + /// \note This function works backwards in data buffer. + /// + /// \param p The reference to the current position pointer. + /// \param start The start of the buffer, for bounds-checking. + /// \param oid The OID of the algorithm to write. + /// \param oid_len The length of the algorithm's OID. + /// \param par_len The length of the parameters, which must be already written. + /// \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + /// and \p par_len is 0, NULL parameters are added. + /// + /// \return The number of bytes written to \p p on success. + /// \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_asn1_write_algorithm_identifier_ext( + p: *mut *mut ::core::ffi::c_uchar, + start: *const ::core::ffi::c_uchar, + oid: *const ::core::ffi::c_char, + oid_len: usize, + par_len: usize, + has_par: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value /// in ASN.1 format. @@ -3991,32 +4161,17 @@ pub struct mbedtls_cipher_base_t { /// mbedtls_cipher_info_from_type(), /// mbedtls_cipher_info_from_values(), /// mbedtls_cipher_info_from_psa(). +/// +/// \note Some fields store a value that has been right-shifted to save +/// code-size, so should not be used directly. The accessor +/// functions adjust for this and return the "natural" value. #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_cipher_info_t { - /// Full cipher identifier. For example, - /// MBEDTLS_CIPHER_AES_256_CBC. - pub private_type: mbedtls_cipher_type_t, - /// The cipher mode. For example, MBEDTLS_MODE_CBC. - pub private_mode: mbedtls_cipher_mode_t, - /// The cipher key length, in bits. This is the - /// default length for variable sized ciphers. - /// Includes parity bits for ciphers like DES. - pub private_key_bitlen: ::core::ffi::c_uint, /// Name of the cipher. pub private_name: *const ::core::ffi::c_char, - /// IV or nonce size, in Bytes. - /// For ciphers that accept variable IV sizes, - /// this is the recommended size. - pub private_iv_size: ::core::ffi::c_uint, - /// Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and - /// MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the - /// cipher supports variable IV or variable key sizes, respectively. - pub private_flags: ::core::ffi::c_int, - /// The block size, in Bytes. - pub private_block_size: ::core::ffi::c_uint, - /// Struct for base cipher information and functions. - pub private_base: *const mbedtls_cipher_base_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize]>, } impl Default for mbedtls_cipher_info_t { fn default() -> Self { @@ -4027,46 +4182,321 @@ impl Default for mbedtls_cipher_info_t { } } } -/// Generic cipher context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_cipher_context_t { - /// Information about the associated cipher. - pub private_cipher_info: *const mbedtls_cipher_info_t, - /// Key length to use. - pub private_key_bitlen: ::core::ffi::c_int, - /// Operation that the key of the context has been - /// initialized for. - pub private_operation: mbedtls_operation_t, - /// Padding functions to use, if relevant for - /// the specific cipher mode. - pub private_add_padding: ::core::option::Option< - unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), - >, - pub private_get_padding: ::core::option::Option< - unsafe extern "C" fn( - input: *mut ::core::ffi::c_uchar, - ilen: usize, - data_len: *mut usize, - ) -> ::core::ffi::c_int, - >, - /// Buffer for input that has not been processed yet. - pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], - /// Number of Bytes that have not been processed yet. - pub private_unprocessed_len: usize, - /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number - /// for XTS-mode. - pub private_iv: [::core::ffi::c_uchar; 16usize], - /// IV size in Bytes, for ciphers with variable-length IVs. - pub private_iv_size: usize, - /// The cipher-specific context. - pub private_cipher_ctx: *mut ::core::ffi::c_void, - /// CMAC-specific context. - pub private_cmac_ctx: *mut mbedtls_cmac_context_t, -} -impl Default for mbedtls_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); +impl mbedtls_cipher_info_t { + #[inline] + pub fn private_block_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_block_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_block_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_block_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(5usize, 3u8) as u32) } + } + #[inline] + pub fn set_private_iv_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(5usize, 3u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 5usize, + 3u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 5usize, + 3u8, + val as u64, + ) + } + } + #[inline] + pub fn private_key_bitlen(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(8usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_key_bitlen(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(8usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_key_bitlen_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 8usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_key_bitlen_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 8usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_mode(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(12usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_mode(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(12usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_mode_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 12usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_mode_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 12usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_type(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(16usize, 8u8) as u32) } + } + #[inline] + pub fn set_private_type(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(16usize, 8u8, val as u64) + } + } + #[inline] + pub unsafe fn private_type_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 16usize, + 8u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_type_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 16usize, + 8u8, + val as u64, + ) + } + } + #[inline] + pub fn private_flags(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(24usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_flags(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(24usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_flags_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 24usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_flags_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 24usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_base_idx(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(26usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_base_idx(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(26usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_base_idx_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 26usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_base_idx_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 26usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_block_size: ::core::ffi::c_uint, + private_iv_size: ::core::ffi::c_uint, + private_key_bitlen: ::core::ffi::c_uint, + private_mode: ::core::ffi::c_uint, + private_type: ::core::ffi::c_uint, + private_flags: ::core::ffi::c_uint, + private_base_idx: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 4usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 4usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 5u8, { + let private_block_size: u32 = unsafe { ::core::mem::transmute(private_block_size) }; + private_block_size as u64 + }); + __bindgen_bitfield_unit.set(5usize, 3u8, { + let private_iv_size: u32 = unsafe { ::core::mem::transmute(private_iv_size) }; + private_iv_size as u64 + }); + __bindgen_bitfield_unit.set(8usize, 4u8, { + let private_key_bitlen: u32 = unsafe { ::core::mem::transmute(private_key_bitlen) }; + private_key_bitlen as u64 + }); + __bindgen_bitfield_unit.set(12usize, 4u8, { + let private_mode: u32 = unsafe { ::core::mem::transmute(private_mode) }; + private_mode as u64 + }); + __bindgen_bitfield_unit.set(16usize, 8u8, { + let private_type: u32 = unsafe { ::core::mem::transmute(private_type) }; + private_type as u64 + }); + __bindgen_bitfield_unit.set(24usize, 2u8, { + let private_flags: u32 = unsafe { ::core::mem::transmute(private_flags) }; + private_flags as u64 + }); + __bindgen_bitfield_unit.set(26usize, 5u8, { + let private_base_idx: u32 = unsafe { ::core::mem::transmute(private_base_idx) }; + private_base_idx as u64 + }); + __bindgen_bitfield_unit + } +} +/// Generic cipher context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_cipher_context_t { + /// Information about the associated cipher. + pub private_cipher_info: *const mbedtls_cipher_info_t, + /// Key length to use. + pub private_key_bitlen: ::core::ffi::c_int, + /// Operation that the key of the context has been + /// initialized for. + pub private_operation: mbedtls_operation_t, + /// Padding functions to use, if relevant for + /// the specific cipher mode. + pub private_add_padding: ::core::option::Option< + unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), + >, + pub private_get_padding: ::core::option::Option< + unsafe extern "C" fn( + input: *mut ::core::ffi::c_uchar, + ilen: usize, + data_len: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int, + >, + /// Buffer for input that has not been processed yet. + pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], + /// Number of Bytes that have not been processed yet. + pub private_unprocessed_len: usize, + /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + /// for XTS-mode. + pub private_iv: [::core::ffi::c_uchar; 16usize], + /// IV size in Bytes, for ciphers with variable-length IVs. + pub private_iv_size: usize, + /// The cipher-specific context. + pub private_cipher_ctx: *mut ::core::ffi::c_void, + /// CMAC-specific context. + pub private_cmac_ctx: *mut mbedtls_cmac_context_t, +} +impl Default for mbedtls_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); s.assume_init() @@ -4134,7 +4564,7 @@ unsafe extern "C" { ) -> *const mbedtls_cipher_info_t; } unsafe extern "C" { - /// \brief This function initializes a \p cipher_context as NONE. + /// \brief This function initializes a \p ctx as NONE. /// /// \param ctx The context to be initialized. This must not be \c NULL. pub fn mbedtls_cipher_init(ctx: *mut mbedtls_cipher_context_t); @@ -4205,7 +4635,6 @@ unsafe extern "C" { /// \brief This function sets the padding mode, for cipher modes /// that use padding. /// - /// The default passing mode is PKCS7 padding. /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a cipher information structure. @@ -4255,23 +4684,24 @@ unsafe extern "C" { /// /// \note With non-AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update() one or more times - /// 4. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update() zero, one or more times; + /// 4. mbedtls_cipher_finish_padded() (recommended for decryption + /// if the mode uses padding) or mbedtls_cipher_finish(). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. /// /// \note With AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update_ad() - /// 4. mbedtls_cipher_update() one or more times - /// 5. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update_ad(); + /// 4. mbedtls_cipher_update() zero, one or more times; + /// 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); /// 6. mbedtls_cipher_check_tag() (for decryption) or - /// mbedtls_cipher_write_tag() (for encryption). + /// mbedtls_cipher_write_tag() (for encryption). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. @@ -4306,7 +4736,8 @@ unsafe extern "C" { /// many block-sized blocks of data as possible to output. /// Any data that cannot be written immediately is either /// added to the next block, or flushed when - /// mbedtls_cipher_finish() is called. + /// mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + /// is called. /// Exception: For MBEDTLS_MODE_ECB, expects a single block /// in size. For example, 16 Bytes for AES. /// @@ -4342,12 +4773,30 @@ unsafe extern "C" { /// contained in it is padded to the size of /// the last block, and written to the \p output buffer. /// + /// \warning This function reports invalid padding through an error + /// code. Adversaries may be able to decrypt encrypted + /// data if they can submit chosen ciphertexts and + /// detect whether it has valid padding or not, + /// either through direct observation or through a side + /// channel such as timing. This is known as a + /// padding oracle attack. + /// Therefore applications that call this function for + /// decryption with a cipher that involves padding + /// should take care around error handling. Preferably, + /// such applications should use + /// mbedtls_cipher_finish_padded() instead of this function. + /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a key. /// \param output The buffer to write data to. This needs to be a writable - /// buffer of at least \p block_size Bytes. + /// buffer of at least block_size Bytes. /// \param olen The length of the data written to the \p output buffer. /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// above), although less efficiently than through + /// the invalid-padding condition. /// /// \return \c 0 on success. /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on @@ -4355,7 +4804,8 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption /// expecting a full block but not receiving one. /// \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding - /// while decrypting. + /// while decrypting. Note that invalid-padding errors + /// should be handled carefully; see the warning above. /// \return A cipher-specific error code on failure. pub fn mbedtls_cipher_finish( ctx: *mut mbedtls_cipher_context_t, @@ -4363,10 +4813,60 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief The generic cipher finalization function. If data still + /// needs to be flushed from an incomplete block, the data + /// contained in it is padded to the size of + /// the last block, and written to the \p output buffer. + /// + /// \note This function is similar to mbedtls_cipher_finish(). + /// The only difference is that it reports invalid padding + /// decryption differently, through the \p invalid_padding + /// parameter rather than an error code. + /// For encryption, and in modes without padding (including + /// all authenticated modes), this function is identical + /// to mbedtls_cipher_finish(). + /// + /// \param[in,out] ctx The generic cipher context. This must be initialized and + /// bound to a key. + /// \param[out] output The buffer to write data to. This needs to be a writable + /// buffer of at least block_size Bytes. + /// \param[out] olen The length of the data written to the \p output buffer. + /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// on mbedtls_cipher_finish()). + /// \param[out] invalid_padding + /// If this function returns \c 0 on decryption, + /// \p *invalid_padding is \c 0 if the ciphertext was + /// valid, and all-bits-one if the ciphertext had invalid + /// padding. + /// On encryption, or in a mode without padding (including + /// all authenticated modes), \p *invalid_padding is \c 0 + /// on success. + /// The value in \p *invalid_padding is unspecified if + /// this function returns a nonzero status. + /// + /// \return \c 0 on success. + /// Also \c 0 for decryption with invalid padding. + /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + /// parameter-verification failure. + /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + /// expecting a full block but not receiving one. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_cipher_finish_padded( + ctx: *mut mbedtls_cipher_context_t, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief This function writes a tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized, /// bound to a key, and have just completed a cipher @@ -4387,7 +4887,8 @@ unsafe extern "C" { unsafe extern "C" { /// \brief This function checks the tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized. /// \param tag The buffer holding the tag. This must be a readable @@ -4572,8 +5073,6 @@ pub struct mbedtls_ccm_context { pub private_y: [::core::ffi::c_uchar; 16usize], ///< The counter buffer pub private_ctr: [::core::ffi::c_uchar; 16usize], - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Total plaintext length pub private_plaintext_len: usize, ///< Total authentication data length @@ -4588,16 +5087,17 @@ pub struct mbedtls_ccm_context { ///auth data input is finished. pub private_processed: usize, ///< The Q working value - pub private_q: ::core::ffi::c_uchar, + pub private_q: ::core::ffi::c_uint, ///< The operation to perform: ///#MBEDTLS_CCM_ENCRYPT or ///#MBEDTLS_CCM_DECRYPT or ///#MBEDTLS_CCM_STAR_ENCRYPT or ///#MBEDTLS_CCM_STAR_DECRYPT. - pub private_mode: ::core::ffi::c_uchar, + pub private_mode: ::core::ffi::c_uint, + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Working value holding context's - ///state. Used for chunked data - ///input + ///state. Used for chunked data input pub private_state: ::core::ffi::c_int, } impl Default for mbedtls_ccm_context { @@ -5840,47 +6340,59 @@ unsafe extern "C" { /// \return \c 1 on failure. pub fn mbedtls_cmac_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -/// \brief The CTR_DRBG context structure. +///< None. +pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; +///< The MD5 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 3; +///< The RIPEMD-160 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 4; +///< The SHA-1 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 5; +///< The SHA-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 8; +///< The SHA-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 9; +///< The SHA-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 10; +///< The SHA-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 11; +///< The SHA3-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_224: mbedtls_md_type_t = 16; +///< The SHA3-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_256: mbedtls_md_type_t = 17; +///< The SHA3-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_384: mbedtls_md_type_t = 18; +///< The SHA3-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_512: mbedtls_md_type_t = 19; +/// \brief Supported message digests. +/// +/// \warning MD5 and SHA-1 are considered weak message digests and +/// their use constitutes a security risk. We recommend considering +/// stronger message digests instead. +pub type mbedtls_md_type_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct mbedtls_ctr_drbg_context { - ///< The counter (V). - pub private_counter: [::core::ffi::c_uchar; 16usize], - ///< The reseed counter. - /// This is the number of requests that have - /// been made since the last (re)seeding, - /// minus one. - /// Before the initial seeding, this field - /// contains the amount of entropy in bytes - /// to use as a nonce for the initial seeding, - /// or -1 if no nonce length has been explicitly - /// set (see mbedtls_ctr_drbg_set_nonce_len()). - pub private_reseed_counter: ::core::ffi::c_int, - ///< This determines whether prediction - ///resistance is enabled, that is - ///whether to systematically reseed before - ///each random generation. - pub private_prediction_resistance: ::core::ffi::c_int, - ///< The amount of entropy grabbed on each - ///seed or reseed operation, in bytes. - pub private_entropy_len: usize, - ///< The reseed interval. - /// This is the maximum number of requests - /// that can be made between reseedings. - pub private_reseed_interval: ::core::ffi::c_int, - ///< The AES context. - pub private_aes_ctx: mbedtls_aes_context, - pub private_f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - ///< The context for the entropy function. - pub private_p_entropy: *mut ::core::ffi::c_void, +pub struct mbedtls_md_info_t { + _unused: [u8; 0], } -impl Default for mbedtls_ctr_drbg_context { +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; +/// Used internally to indicate whether a context uses legacy or PSA. +/// +/// Internal use only. +pub type mbedtls_md_engine_t = ::core::ffi::c_uint; +/// The generic message-digest context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md_context_t { + /// Information about the associated message digest. + pub private_md_info: *const mbedtls_md_info_t, + /// The digest-specific context (legacy) or the PSA operation. + pub private_md_ctx: *mut ::core::ffi::c_void, + /// The HMAC part of the context. + pub private_hmac_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_md_context_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -5890,4389 +6402,3745 @@ impl Default for mbedtls_ctr_drbg_context { } } unsafe extern "C" { - /// \brief This function initializes the CTR_DRBG context, - /// and prepares it for mbedtls_ctr_drbg_seed() - /// or mbedtls_ctr_drbg_free(). + /// \brief This function returns the message-digest information + /// associated with the given digest type. /// - /// \note The reseed interval is - /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. - /// You can override it by calling - /// mbedtls_ctr_drbg_set_reseed_interval(). + /// \param md_type The type of digest to search for. /// - /// \param ctx The CTR_DRBG context to initialize. - pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); + /// \return The message-digest information associated with \p md_type. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// - The \p custom string. - /// - /// \note To achieve the nominal security strength permitted - /// by CTR_DRBG, the entropy length must be: - /// - at least 16 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 32 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// In addition, if you do not pass a nonce in \p custom, - /// the sum of the entropy length - /// and the entropy nonce length must be: - /// - at least 24 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 48 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// \param ctx The CTR_DRBG context to seed. - /// It must have been initialized with - /// mbedtls_ctr_drbg_init(). - /// After a successful call to mbedtls_ctr_drbg_seed(), - /// you may not call mbedtls_ctr_drbg_seed() again on - /// the same context unless you call - /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() - /// again first. - /// After a failed call to mbedtls_ctr_drbg_seed(), - /// you must call mbedtls_ctr_drbg_free(). - /// \param f_entropy The entropy callback, taking as arguments the - /// \p p_entropy context, the buffer to fill, and the - /// length of the buffer. - /// \p f_entropy is always called with a buffer size - /// less than or equal to the entropy length. - /// \param p_entropy The entropy context to pass to \p f_entropy. - /// \param custom The personalization string. - /// This can be \c NULL, in which case the personalization - /// string is empty regardless of the value of \p len. - /// \param len The length of the personalization string. - /// This must be at most - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function initializes a message-digest context without + /// binding it to a particular message-digest algorithm. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_seed( - ctx: *mut mbedtls_ctr_drbg_context, - f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_entropy: *mut ::core::ffi::c_void, - custom: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// This function should always be called first. It prepares the + /// context for mbedtls_md_setup() for binding it to a + /// message-digest algorithm. + pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function resets CTR_DRBG context to the state immediately - /// after initial call of mbedtls_ctr_drbg_init(). + /// \brief This function clears the internal structure of \p ctx and + /// frees any embedded internal structure, but does not free + /// \p ctx itself. /// - /// \param ctx The CTR_DRBG context to clear. - pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); + /// If you have called mbedtls_md_setup() on \p ctx, you must + /// call mbedtls_md_free() when you are no longer using the + /// context. + /// Calling this function if you have previously + /// called mbedtls_md_init() and nothing else is optional. + /// You must not call this function if you have not called + /// mbedtls_md_init(). + pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function turns prediction resistance on or off. - /// The default value is off. + /// \brief This function selects the message digest algorithm to use, + /// and allocates internal structures. /// - /// \note If enabled, entropy is gathered at the beginning of - /// every call to mbedtls_ctr_drbg_random_with_add() - /// or mbedtls_ctr_drbg_random(). - /// Only use this if your entropy source has sufficient - /// throughput. + /// It should be called after mbedtls_md_init() or + /// mbedtls_md_free(). Makes it necessary to call + /// mbedtls_md_free() later. /// - /// \param ctx The CTR_DRBG context. - /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. - pub fn mbedtls_ctr_drbg_set_prediction_resistance( - ctx: *mut mbedtls_ctr_drbg_context, - resistance: ::core::ffi::c_int, - ); + /// \param ctx The context to set up. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + /// or non-zero: HMAC is used with this context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + pub fn mbedtls_md_setup( + ctx: *mut mbedtls_md_context_t, + md_info: *const mbedtls_md_info_t, + hmac: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed on each - /// seed or reseed. - /// - /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function clones the state of a message-digest + /// context. /// - /// \note The security strength of CTR_DRBG is bounded by the - /// entropy length. Thus: - /// - When using AES-256 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, - /// which is the default), - /// \p len must be at least 32 (in bytes) - /// to achieve a 256-bit strength. - /// - When using AES-128 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) - /// \p len must be at least 16 (in bytes) - /// to achieve a 128-bit strength. + /// \note You must call mbedtls_md_setup() on \c dst before calling + /// this function. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. - pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); -} -unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed - /// as a nonce for the initial seeding. + /// \note The two contexts must have the same type, + /// for example, both are SHA-256. /// - /// Call this function before calling mbedtls_ctr_drbg_seed() to read - /// a nonce from the entropy source during the initial seeding. + /// \warning This function clones the message-digest state, not the + /// HMAC state. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab for the nonce, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. + /// \param dst The destination context. + /// \param src The context to be cloned. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is - /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED - /// if the initial seeding has already taken place. - pub fn mbedtls_ctr_drbg_set_nonce_len( - ctx: *mut mbedtls_ctr_drbg_context, - len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + /// not using the same engine. This can be avoided by moving + /// the call to psa_crypto_init() before the first call to + /// mbedtls_md_setup(). + pub fn mbedtls_md_clone( + dst: *mut mbedtls_md_context_t, + src: *const mbedtls_md_context_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the reseed interval. - /// - /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() - /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function - /// is called again. + /// \brief This function extracts the message-digest size from the + /// message-digest information structure. /// - /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param interval The reseed interval. - pub fn mbedtls_ctr_drbg_set_reseed_interval( - ctx: *mut mbedtls_ctr_drbg_context, - interval: ::core::ffi::c_int, - ); + /// \return The size of the message-digest output in Bytes. + pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; } unsafe extern "C" { - /// \brief This function reseeds the CTR_DRBG context, that is - /// extracts data from the entropy source. + /// \brief This function extracts the message-digest type from the + /// message-digest information structure. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param additional Additional data to add to the state. Can be \c NULL. - /// \param len The length of the additional data. - /// This must be less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \return The type of the message digest. + pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; +} +unsafe extern "C" { + /// \brief This function starts a message-digest computation. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_reseed( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// You must call this function after setting up the context + /// with mbedtls_md_setup(), and before passing data with + /// mbedtls_md_update(). + /// + /// \param ctx The generic message-digest context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates the state of the CTR_DRBG context. + /// \brief This function feeds an input buffer into an ongoing + /// message-digest computation. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// You must call mbedtls_md_starts() before calling this + /// function. You may call this function multiple times. + /// Afterwards, call mbedtls_md_finish(). /// - /// \param ctx The CTR_DRBG context. - /// \param additional The data to update the state with. This must not be - /// \c NULL unless \p add_len is \c 0. - /// \param add_len Length of \p additional in bytes. This must be at - /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \param ctx The generic message-digest context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if - /// \p add_len is more than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return An error from the underlying AES cipher on failure. - pub fn mbedtls_ctr_drbg_update( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - add_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates a CTR_DRBG instance with additional - /// data and uses it to generate random data. - /// - /// This function automatically reseeds if the reseed counter is exceeded - /// or prediction resistance is enabled. + /// \brief This function finishes the digest operation, + /// and writes the result to the output buffer. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// Call this function after a call to mbedtls_md_starts(), + /// followed by any number of calls to mbedtls_md_update(). + /// Afterwards, you may either clear the context with + /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse + /// the context for another digest operation with the same + /// algorithm. /// - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. - /// \param additional Additional data to update. Can be \c NULL, in which - /// case the additional data is empty regardless of - /// the value of \p add_len. - /// \param add_len The length of the additional data - /// if \p additional is not \c NULL. - /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT - /// and less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \param ctx The generic message-digest context. + /// \param output The buffer for the generic message-digest checksum result. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random_with_add( - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_finish( + ctx: *mut mbedtls_md_context_t, output: *mut ::core::ffi::c_uchar, - output_len: usize, - additional: *const ::core::ffi::c_uchar, - add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. + /// \brief This function calculates the message-digest of a buffer, + /// with respect to a configurable message-digest algorithm + /// in a single call. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random( - p_rng: *mut ::core::ffi::c_void, + /// The result is calculated as + /// Output = message_digest(input buffer). + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param input The buffer holding the data. + /// \param ilen The length of the input data. + /// \param output The generic message-digest checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md( + md_info: *const mbedtls_md_info_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, output: *mut ::core::ffi::c_uchar, - output_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The CTR_DRBG checkup routine. + /// \brief This function returns the list of digests supported by the + /// generic digest module. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< Curve not defined. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; -///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; -///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; -///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; -///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; -///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; -///< Domain parameters for 256-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; -///< Domain parameters for 384-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; -///< Domain parameters for 512-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; -///< Domain parameters for Curve25519. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; -///< Domain parameters for 192-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; -///< Domain parameters for 224-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; -///< Domain parameters for 256-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; -///< Domain parameters for Curve448. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; -/// Domain-parameter identifiers: curve, subgroup, and generator. -/// -/// \note Only curves over prime fields are supported. -/// -/// \warning This library does not support validation of arbitrary domain -/// parameters. Therefore, only standardized domain parameters from trusted -/// sources should be used. See mbedtls_ecp_group_load(). -pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; -pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_NONE: mbedtls_ecp_modulus_type = 0; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_COORDINATE: mbedtls_ecp_modulus_type = 1; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_SCALAR: mbedtls_ecp_modulus_type = 2; -pub type mbedtls_ecp_modulus_type = ::core::ffi::c_uint; -/// Curve information, for use by other modules. -/// -/// The fields of this structure are part of the public API and can be -/// accessed directly by applications. Future versions of the library may -/// add extra fields or reorder existing fields. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_curve_info { - ///< An internal identifier. - pub grp_id: mbedtls_ecp_group_id, - ///< The TLS NamedCurve identifier. - pub tls_id: u16, - ///< The curve size in bits. - pub bit_size: u16, - ///< A human-friendly name. - pub name: *const ::core::ffi::c_char, + /// \note The list starts with the strongest available hashes. + /// + /// \return A statically allocated array of digests. Each element + /// in the returned list is an integer belonging to the + /// message-digest enumeration #mbedtls_md_type_t. + /// The last entry is 0. + pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; } -impl Default for mbedtls_ecp_curve_info { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief This function returns the message-digest information + /// associated with the given digest name. + /// + /// \param md_name The name of the digest to search for. + /// + /// \return The message-digest information associated with \p md_name. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_string( + md_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_md_info_t; } -/// \brief The ECP point structure, in Jacobian coordinates. -/// -/// \note All functions expect and return points satisfying -/// the following condition: Z == 0 or -/// Z == 1. Other values of \p Z are -/// used only by internal functions. -/// The point is zero, or "at infinity", if Z == 0. -/// Otherwise, \p X and \p Y are its standard (affine) -/// coordinates. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_point { - ///< The X coordinate of the ECP point. - pub private_X: mbedtls_mpi, - ///< The Y coordinate of the ECP point. - pub private_Y: mbedtls_mpi, - ///< The Z coordinate of the ECP point. - pub private_Z: mbedtls_mpi, -} -impl Default for mbedtls_ecp_point { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief The ECP group structure. -/// -/// We consider two types of curve equations: -///

          -/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. -/// -/// For Short Weierstrass, this subgroup is the whole curve, and its -/// cardinality is denoted by \p N. Our code requires that \p N is an -/// odd prime as mbedtls_ecp_mul() requires an odd number, and -/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. -/// -/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, -/// which is the quantity used in the formulas. Additionally, \p nbits is -/// not the size of \p N but the required size for private keys. -/// -/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. -/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the -/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer -/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits -/// in size, so that it may be efficiently brought in the 0..P-1 range by a few -/// additions or subtractions. Therefore, it is only an approximative modular -/// reduction. It must return 0 on success and non-zero on failure. -/// -/// \note Alternative implementations of the ECP module must obey the -/// following constraints. -/// * Group IDs must be distinct: if two group structures have -/// the same ID, then they must be identical. -/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, -/// \c pbits and \c nbits must have the same type and semantics -/// as in the built-in implementation. -/// They must be available for reading, but direct modification -/// of these fields does not need to be supported. -/// They do not need to be at the same offset in the structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_group { - ///< An internal group identifier. - pub id: mbedtls_ecp_group_id, - ///< The prime modulus of the base field. - pub P: mbedtls_mpi, - ///< For Short Weierstrass: \p A in the equation. For - ///Montgomery curves: (A + 2) / 4. - pub A: mbedtls_mpi, - ///< For Short Weierstrass: \p B in the equation. - ///For Montgomery curves: unused. - pub B: mbedtls_mpi, - ///< The generator of the subgroup used. - pub G: mbedtls_ecp_point, - ///< The order of \p G. - pub N: mbedtls_mpi, - ///< The number of bits in \p P. - pub pbits: usize, - ///< For Short Weierstrass: The number of bits in \p P. - ///For Montgomery curves: the number of bits in the - ///private keys. - pub nbits: usize, - ///< \internal 1 if the constants are static. - pub private_h: ::core::ffi::c_uint, - ///< The function for fast pseudo-reduction - ///mod \p P (see above). - pub private_modp: - ::core::option::Option ::core::ffi::c_int>, - ///< Unused. - pub private_t_pre: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_post: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_data: *mut ::core::ffi::c_void, - ///< Pre-computed points for ecp_mul_comb(). - pub private_T: *mut mbedtls_ecp_point, - ///< The number of dynamic allocated pre-computed points. - pub private_T_size: usize, -} -impl Default for mbedtls_ecp_group { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; -/// \brief The ECP key-pair structure. -/// -/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. -/// -/// \note Members are deliberately in the same order as in the -/// ::mbedtls_ecdsa_context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_keypair { - ///< Elliptic curve and base point - pub private_grp: mbedtls_ecp_group, - ///< our secret value - pub private_d: mbedtls_mpi, - ///< our public value - pub private_Q: mbedtls_ecp_point, -} -impl Default for mbedtls_ecp_keypair { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +unsafe extern "C" { + /// \brief This function returns the name of the message digest for + /// the message-digest information structure given. + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// + /// \return The name of the message digest. + pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; } unsafe extern "C" { - /// \brief This function retrieves the information defined in - /// mbedtls_ecp_curve_info() for all supported curves. + /// \brief This function returns the message-digest information + /// from the given context. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// \param ctx The context from which to extract the information. + /// This must be initialized (or \c NULL). /// - /// \return A statically allocated array. The last entry is 0. - pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; + /// \return The message-digest information associated with \p ctx. + /// \return \c NULL if \p ctx is \c NULL. + pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// \brief This function retrieves the list of internal group - /// identifiers of all supported curves in the order of - /// preference. + /// \brief This function sets the HMAC key and prepares to + /// authenticate a new message. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// Call this function after mbedtls_md_setup(), to use + /// the MD context for an HMAC calculation, then call + /// mbedtls_md_hmac_update() to provide the input data, and + /// mbedtls_md_hmac_finish() to get the HMAC value. /// - /// \return A statically allocated array, - /// terminated with MBEDTLS_ECP_DP_NONE. - pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC key in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_starts( + ctx: *mut mbedtls_md_context_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from an internal - /// group identifier. + /// \brief This function feeds an input buffer into an ongoing HMAC + /// computation. /// - /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + /// before calling this function. + /// You may call this function multiple times to pass the + /// input piecewise. + /// Afterwards, call mbedtls_md_hmac_finish(). /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_grp_id( - grp_id: mbedtls_ecp_group_id, - ) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a TLS - /// NamedCurve value. + /// \brief This function finishes the HMAC operation, and writes + /// the result to the output buffer. /// - /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call this function after mbedtls_md_hmac_starts() and + /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards + /// you may either call mbedtls_md_free() to clear the context, + /// or call mbedtls_md_hmac_reset() to reuse the context with + /// the same HMAC key. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param output The generic HMAC checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_finish( + ctx: *mut mbedtls_md_context_t, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a - /// human-readable name. + /// \brief This function prepares to authenticate a new message with + /// the same key as the previous HMAC operation. /// - /// \param name The human-readable name. + /// You may call this function after mbedtls_md_hmac_finish(). + /// Afterwards call mbedtls_md_hmac_update() to pass the new + /// input. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_name( - name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ecp_curve_info; -} -unsafe extern "C" { - /// \brief This function initializes a point as zero. + /// \param ctx The message digest context containing an embedded HMAC + /// context. /// - /// \param pt The point to initialize. - pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECP group context - /// without loading any domain parameters. + /// \brief This function calculates the full generic HMAC + /// on the input buffer with the provided key. /// - /// \note After this function is called, domain parameters - /// for various ECP groups can be loaded through the - /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() - /// functions. - pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); -} -unsafe extern "C" { - /// \brief This function initializes a key pair as an invalid one. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param key The key pair to initialize. - pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); -} -unsafe extern "C" { - /// \brief This function frees the components of a point. + /// The HMAC result is calculated as + /// output = generic HMAC(hmac key, input buffer). /// - /// \param pt The point to free. - pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); -} -unsafe extern "C" { - /// \brief This function frees the components of an ECP group. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC secret key in Bytes. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// \param output The generic HMAC result. /// - /// \param grp The group to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP group. - pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac( + md_info: *const mbedtls_md_info_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function frees the components of a key pair. - /// - /// \param key The key pair to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP key pair. - pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +/// \brief Entropy poll callback pointer +/// +/// \param data Callback-specific data pointer +/// \param output Data to fill +/// \param len Maximum size to provide +/// \param olen The actual amount of bytes put into the buffer (Can be 0) +/// +/// \return 0 if no critical failures occurred, +/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise +pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< + unsafe extern "C" fn( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + ) -> ::core::ffi::c_int, +>; +/// \brief Entropy source state +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_source_state { + ///< The entropy source callback + pub private_f_source: mbedtls_entropy_f_source_ptr, + ///< The callback data pointer + pub private_p_source: *mut ::core::ffi::c_void, + ///< Amount received in bytes + pub private_size: usize, + ///< Minimum bytes required before release + pub private_threshold: usize, + ///< Is the source strong? + pub private_strong: ::core::ffi::c_int, } -unsafe extern "C" { - /// \brief This function copies the contents of point \p Q into - /// point \p P. - /// - /// \param P The destination point. This must be initialized. - /// \param Q The source point. This must be initialized. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code for other kinds of failure. - pub fn mbedtls_ecp_copy( - P: *mut mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_entropy_source_state { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +/// \brief Entropy context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_context { + pub private_accumulator: mbedtls_md_context_t, + pub private_accumulator_started: ::core::ffi::c_int, + pub private_source_count: ::core::ffi::c_int, + pub private_source: [mbedtls_entropy_source_state; 20usize], +} +impl Default for mbedtls_entropy_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function copies the contents of group \p src into - /// group \p dst. - /// - /// \param dst The destination group. This must be initialized. - /// \param src The source group. This must be initialized. + /// \brief Initialize the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_copy( - dst: *mut mbedtls_ecp_group, - src: *const mbedtls_ecp_group, - ) -> ::core::ffi::c_int; + /// \param ctx Entropy context to initialize + pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function sets a point to the point at infinity. - /// - /// \param pt The point to set. This must be initialized. + /// \brief Free the data in the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \param ctx Entropy context to free + pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function checks if a point is the point at infinity. + /// \brief Adds an entropy source to poll + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param pt The point to test. This must be initialized. + /// \param ctx Entropy context + /// \param f_source Entropy function + /// \param p_source Function data + /// \param threshold Minimum required from source before entropy is released + /// ( with mbedtls_entropy_func() ) (in bytes) + /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + /// MBEDTLS_ENTROPY_SOURCE_WEAK. + /// At least one strong source needs to be added. + /// Weaker sources (such as the cycle counter) can be used as + /// a complement. /// - /// \return \c 1 if the point is zero. - /// \return \c 0 if the point is non-zero. - /// \return A negative error code on failure. - pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + pub fn mbedtls_entropy_add_source( + ctx: *mut mbedtls_entropy_context, + f_source: mbedtls_entropy_f_source_ptr, + p_source: *mut ::core::ffi::c_void, + threshold: usize, + strong: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function compares two points. - /// - /// \note This assumes that the points are normalized. Otherwise, - /// they may compare as "not equal" even if they are. + /// \brief Trigger an extra gather poll for the accumulator + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The first point to compare. This must be initialized. - /// \param Q The second point to compare. This must be initialized. + /// \param ctx Entropy context /// - /// \return \c 0 if the points are equal. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. - pub fn mbedtls_ecp_point_cmp( - P: *const mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a non-zero point from two ASCII - /// strings. + /// \brief Retrieve entropy from the accumulator + /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The destination point. This must be initialized. - /// \param radix The numeric base of the input. - /// \param x The first affine coordinate, as a null-terminated string. - /// \param y The second affine coordinate, as a null-terminated string. + /// \param data Entropy context + /// \param output Buffer to fill + /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. - pub fn mbedtls_ecp_point_read_string( - P: *mut mbedtls_ecp_point, - radix: ::core::ffi::c_int, - x: *const ::core::ffi::c_char, - y: *const ::core::ffi::c_char, + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_func( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point into unsigned binary data. + /// \brief Add data to the accumulator manually + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The point to export. This must be initialized. - /// \param format The point format. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// (For groups without these formats, this parameter is - /// ignored. But it still has to be either of the above - /// values.) - /// \param olen The address at which to store the length of - /// the output in Bytes. This must not be \c NULL. - /// \param buf The output buffer. This must be a writable buffer - /// of length \p buflen Bytes. - /// \param buflen The length of the output buffer \p buf in Bytes. + /// \param ctx Entropy context + /// \param data Data to add + /// \param len Length of data /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer - /// is too small to hold the point. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format - /// or the export for the given group is not implemented. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_point_write_binary( - grp: *const mbedtls_ecp_group, - P: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, + /// \return 0 if successful + pub fn mbedtls_entropy_update_manual( + ctx: *mut mbedtls_entropy_context, + data: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a point from unsigned binary data. + /// \brief Checkup routine /// - /// \note This function does not check that the point actually - /// belongs to the given group, see mbedtls_ecp_check_pubkey() - /// for that. + /// This module self-test also calls the entropy self-test, + /// mbedtls_entropy_source_self_test(); /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The CTR_DRBG context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ctr_drbg_context { + ///< The counter (V). + pub private_counter: [::core::ffi::c_uchar; 16usize], + ///< The reseed counter. + /// This is the number of requests that have + /// been made since the last (re)seeding, + /// minus one. + /// Before the initial seeding, this field + /// contains the amount of entropy in bytes + /// to use as a nonce for the initial seeding, + /// or -1 if no nonce length has been explicitly + /// set (see mbedtls_ctr_drbg_set_nonce_len()). + pub private_reseed_counter: ::core::ffi::c_int, + ///< This determines whether prediction + ///resistance is enabled, that is + ///whether to systematically reseed before + ///each random generation. + pub private_prediction_resistance: ::core::ffi::c_int, + ///< The amount of entropy grabbed on each + ///seed or reseed operation, in bytes. + pub private_entropy_len: usize, + ///< The reseed interval. + /// This is the maximum number of requests + /// that can be made between reseedings. + pub private_reseed_interval: ::core::ffi::c_int, + ///< The AES context. + pub private_aes_ctx: mbedtls_aes_context, + pub private_f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + ///< The context for the entropy function. + pub private_p_entropy: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_ctr_drbg_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes the CTR_DRBG context, + /// and prepares it for mbedtls_ctr_drbg_seed() + /// or mbedtls_ctr_drbg_free(). /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The destination context to import the point to. - /// This must be initialized. - /// \param buf The input buffer. This must be a readable buffer - /// of length \p ilen Bytes. - /// \param ilen The length of the input buffer \p buf in Bytes. + /// \note The reseed interval is + /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + /// You can override it by calling + /// mbedtls_ctr_drbg_set_reseed_interval(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the - /// given group is not implemented. - pub fn mbedtls_ecp_point_read_binary( - grp: *const mbedtls_ecp_group, - P: *mut mbedtls_ecp_point, - buf: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to initialize. + pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function imports a point from a TLS ECPoint record. + /// - The \p custom string. /// - /// \note On function return, \p *buf is updated to point immediately - /// after the ECPoint record. + /// \note To achieve the nominal security strength permitted + /// by CTR_DRBG, the entropy length must be: + /// - at least 16 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 32 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The destination point. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the buffer. + /// In addition, if you do not pass a nonce in \p custom, + /// the sum of the entropy length + /// and the entropy nonce length must be: + /// - at least 24 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 48 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization - /// failure. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - pub fn mbedtls_ecp_tls_read_point( - grp: *const mbedtls_ecp_group, - pt: *mut mbedtls_ecp_point, - buf: *mut *const ::core::ffi::c_uchar, + /// \param ctx The CTR_DRBG context to seed. + /// It must have been initialized with + /// mbedtls_ctr_drbg_init(). + /// After a successful call to mbedtls_ctr_drbg_seed(), + /// you may not call mbedtls_ctr_drbg_seed() again on + /// the same context unless you call + /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + /// again first. + /// After a failed call to mbedtls_ctr_drbg_seed(), + /// you must call mbedtls_ctr_drbg_free(). + /// \param f_entropy The entropy callback, taking as arguments the + /// \p p_entropy context, the buffer to fill, and the + /// length of the buffer. + /// \p f_entropy is always called with a buffer size + /// less than or equal to the entropy length. + /// \param p_entropy The entropy context to pass to \p f_entropy. + /// \param custom The personalization string. + /// This can be \c NULL, in which case the personalization + /// string is empty regardless of the value of \p len. + /// \param len The length of the personalization string. + /// This must be at most + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_seed( + ctx: *mut mbedtls_ctr_drbg_context, + f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + p_entropy: *mut ::core::ffi::c_void, + custom: *const ::core::ffi::c_uchar, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point as a TLS ECPoint record - /// defined in RFC 4492, Section 5.4. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to be exported. This must be initialized. - /// \param format The point format to use. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// \param olen The address at which to store the length in Bytes - /// of the data written. - /// \param buf The target buffer. This must be a writable buffer of - /// length \p blen Bytes. - /// \param blen The length of the target buffer \p buf in Bytes. + /// \brief This function resets CTR_DRBG context to the state immediately + /// after initial call of mbedtls_ctr_drbg_init(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer - /// is too small to hold the exported point. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_point( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to clear. + pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function sets up an ECP group context - /// from a standardized set of domain parameters. - /// - /// \note The index should be a value of the NamedCurve enum, - /// as defined in RFC-4492: Elliptic Curve Cryptography - /// (ECC) Cipher Suites for Transport Layer Security (TLS), - /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + /// \brief This function turns prediction resistance on or off. + /// The default value is off. /// - /// \param grp The group context to setup. This must be initialized. - /// \param id The identifier of the domain parameter set to load. + /// \note If enabled, entropy is gathered at the beginning of + /// every call to mbedtls_ctr_drbg_random_with_add() + /// or mbedtls_ctr_drbg_random(). + /// Only use this if your entropy source has sufficient + /// throughput. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_load( - grp: *mut mbedtls_ecp_group, - id: mbedtls_ecp_group_id, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + pub fn mbedtls_ctr_drbg_set_prediction_resistance( + ctx: *mut mbedtls_ctr_drbg_context, + resistance: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function sets up an ECP group context from a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed on each + /// seed or reseed. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. /// - /// \param grp The group context to setup. This must be initialized. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \note The security strength of CTR_DRBG is bounded by the + /// entropy length. Thus: + /// - When using AES-256 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + /// which is the default), + /// \p len must be at least 32 (in bytes) + /// to achieve a 256-bit strength. + /// - When using AES-128 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + /// \p len must be at least 16 (in bytes) + /// to achieve a 128-bit strength. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group( - grp: *mut mbedtls_ecp_group, - buf: *mut *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. + pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); } unsafe extern "C" { - /// \brief This function extracts an elliptic curve group ID from a - /// TLS ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed + /// as a nonce for the initial seeding. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// Call this function before calling mbedtls_ctr_drbg_seed() to read + /// a nonce from the entropy source during the initial seeding. /// - /// \param grp The address at which to store the group id. - /// This must not be \c NULL. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab for the nonce, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group_id( - grp: *mut mbedtls_ecp_group_id, - buf: *mut *const ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + /// if the initial seeding has already taken place. + pub fn mbedtls_ctr_drbg_set_nonce_len( + ctx: *mut mbedtls_ctr_drbg_context, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports an elliptic curve as a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the reseed interval. /// - /// \param grp The ECP group to be exported. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param olen The address at which to store the number of Bytes written. - /// This must not be \c NULL. - /// \param buf The buffer to write to. This must be a writable buffer - /// of length \p blen Bytes. - /// \param blen The length of the output buffer \p buf in Bytes. + /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function + /// is called again. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output - /// buffer is too small to hold the exported group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_group( - grp: *const mbedtls_ecp_group, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// + /// \param ctx The CTR_DRBG context. + /// \param interval The reseed interval. + pub fn mbedtls_ctr_drbg_set_reseed_interval( + ctx: *mut mbedtls_ctr_drbg_context, + interval: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function performs a scalar multiplication of a point - /// by an integer: \p R = \p m * \p P. - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function reseeds the CTR_DRBG context, that is + /// extracts data from the entropy source. /// - /// \note To prevent timing attacks, this function - /// executes the exact same sequence of base-field - /// operations for any valid \p m. It avoids any if-branch or - /// array index depending on the value of \p m. It also uses - /// \p f_rng to randomize some intermediate results. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param ctx The CTR_DRBG context. + /// \param additional Additional data to add to the state. Can be \c NULL. + /// \param len The length of the additional data. + /// This must be less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_reseed( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication of a point by - /// an integer: \p R = \p m * \p P in a restartable way. - /// - /// \see mbedtls_ecp_mul() + /// \brief This function updates the state of the CTR_DRBG context. /// - /// \note This function does the same as \c mbedtls_ecp_mul(), but - /// it can return early and restart according to the limit set - /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. - /// \param rs_ctx The restart context (NULL disables restart). + /// \param ctx The CTR_DRBG context. + /// \param additional The data to update the state with. This must not be + /// \c NULL unless \p add_len is \c 0. + /// \param add_len Length of \p additional in bytes. This must be at + /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecp_restart_ctx, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + /// \p add_len is more than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return An error from the underlying AES cipher on failure. + pub fn mbedtls_ctr_drbg_update( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function updates a CTR_DRBG instance with additional + /// data and uses it to generate random data. /// - /// \note In contrast to mbedtls_ecp_mul(), this function does not - /// guarantee a constant execution flow and timing. + /// This function automatically reseeds if the reseed counter is exceeded + /// or prediction resistance is enabled. /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. + /// \param additional Additional data to update. Can be \c NULL, in which + /// case the additional data is empty regardless of + /// the value of \p add_len. + /// \param add_len The length of the additional data + /// if \p additional is not \c NULL. + /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + /// and less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random_with_add( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q in a - /// restartable way. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. /// - /// \see \c mbedtls_ecp_muladd() + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The CTR_DRBG checkup routine. /// - /// \note This function works the same as \c mbedtls_ecp_muladd(), - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. - /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. - /// \param rs_ctx The restart context (NULL disables restart). - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, - rs_ctx: *mut mbedtls_ecp_restart_ctx, - ) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function checks that a point is a valid public key - /// on this curve. - /// - /// It only checks that the point is non-zero, has - /// valid coordinates and lies on the curve. It does not verify - /// that it is indeed a multiple of \p G. This additional - /// check is computationally more expensive, is not required - /// by standards, and should not be necessary if the group - /// used has a small cofactor. In particular, it is useless for - /// the NIST groups which all have a cofactor of 1. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure, to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the point should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid public key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not - /// a valid public key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_pubkey( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +///< Curve not defined. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; +///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; +///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; +///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; +///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; +///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; +///< Domain parameters for 256-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; +///< Domain parameters for 384-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; +///< Domain parameters for 512-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; +///< Domain parameters for Curve25519. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; +///< Domain parameters for 192-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; +///< Domain parameters for 224-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; +///< Domain parameters for 256-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; +///< Domain parameters for Curve448. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; +/// Domain-parameter identifiers: curve, subgroup, and generator. +/// +/// \note Only curves over prime fields are supported. +/// +/// \warning This library does not support validation of arbitrary domain +/// parameters. Therefore, only standardized domain parameters from trusted +/// sources should be used. See mbedtls_ecp_group_load(). +pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; +pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; +/// Curve information, for use by other modules. +/// +/// The fields of this structure are part of the public API and can be +/// accessed directly by applications. Future versions of the library may +/// add extra fields or reorder existing fields. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_curve_info { + ///< An internal identifier. + pub grp_id: mbedtls_ecp_group_id, + ///< The TLS NamedCurve identifier. + pub tls_id: u16, + ///< The curve size in bits. + pub bit_size: u16, + ///< A human-friendly name. + pub name: *const ::core::ffi::c_char, } -unsafe extern "C" { - /// \brief This function checks that an \p mbedtls_mpi is a - /// valid private key for this curve. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the private key should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The integer to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid private key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid - /// private key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_privkey( - grp: *const mbedtls_ecp_group, - d: *const mbedtls_mpi, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_curve_info { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates a private key. - /// - /// \param grp The ECP group to generate a private key for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_privkey( - grp: *const mbedtls_ecp_group, - d: *mut mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +/// \brief The ECP point structure, in Jacobian coordinates. +/// +/// \note All functions expect and return points satisfying +/// the following condition: Z == 0 or +/// Z == 1. Other values of \p Z are +/// used only by internal functions. +/// The point is zero, or "at infinity", if Z == 0. +/// Otherwise, \p X and \p Y are its standard (affine) +/// coordinates. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_point { + ///< The X coordinate of the ECP point. + pub private_X: mbedtls_mpi, + ///< The Y coordinate of the ECP point. + pub private_Y: mbedtls_mpi, + ///< The Z coordinate of the ECP point. + pub private_Z: mbedtls_mpi, } -unsafe extern "C" { - /// \brief This function generates a keypair with a configurable base - /// point. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param G The base point to use. This must be initialized - /// and belong to \p grp. It replaces the default base - /// point \c grp->G used by mbedtls_ecp_gen_keypair(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair_base( - grp: *mut mbedtls_ecp_group, - G: *const mbedtls_ecp_point, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_point { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates an ECP keypair. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. +/// \brief The ECP group structure. +/// +/// We consider two types of curve equations: +///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P +/// (SEC1 + RFC-4492)
            • +///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, +/// Curve448)
          +/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. +/// +/// For Short Weierstrass, this subgroup is the whole curve, and its +/// cardinality is denoted by \p N. Our code requires that \p N is an +/// odd prime as mbedtls_ecp_mul() requires an odd number, and +/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. +/// +/// The default implementation only initializes \p A without setting it to the +/// authentic value for curves with A = -3(SECP256R1, etc), in which +/// case you need to load \p A by yourself when using domain parameters directly, +/// for example: +/// \code +/// mbedtls_mpi_init(&A); +/// mbedtls_ecp_group_init(&grp); +/// CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); +/// if (mbedtls_ecp_group_a_is_minus_3(&grp)) { +/// CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); +/// } else { +/// CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); +/// } +/// +/// do_something_with_a(&A); +/// +/// cleanup: +/// mbedtls_mpi_free(&A); +/// mbedtls_ecp_group_free(&grp); +/// \endcode +/// +/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, +/// which is the quantity used in the formulas. Additionally, \p nbits is +/// not the size of \p N but the required size for private keys. +/// +/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. +/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the +/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer +/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits +/// in size, so that it may be efficiently brought in the 0..P-1 range by a few +/// additions or subtractions. Therefore, it is only an approximate modular +/// reduction. It must return 0 on success and non-zero on failure. +/// +/// \note Alternative implementations of the ECP module must obey the +/// following constraints. +/// * Group IDs must be distinct: if two group structures have +/// the same ID, then they must be identical. +/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, +/// \c pbits and \c nbits must have the same type and semantics +/// as in the built-in implementation. +/// They must be available for reading, but direct modification +/// of these fields does not need to be supported. +/// They do not need to be at the same offset in the structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_group { + ///< An internal group identifier. + pub id: mbedtls_ecp_group_id, + ///< The prime modulus of the base field. + pub P: mbedtls_mpi, + ///< For Short Weierstrass: \p A in the equation. Note that + ///\p A is not set to the authentic value in some cases. + ///Refer to detailed description of ::mbedtls_ecp_group if + ///using domain parameters in the structure. + ///For Montgomery curves: (A + 2) / 4. + pub A: mbedtls_mpi, + ///< For Short Weierstrass: \p B in the equation. + ///For Montgomery curves: unused. + pub B: mbedtls_mpi, + ///< The generator of the subgroup used. + pub G: mbedtls_ecp_point, + ///< The order of \p G. + pub N: mbedtls_mpi, + ///< The number of bits in \p P. + pub pbits: usize, + ///< For Short Weierstrass: The number of bits in \p P. + ///For Montgomery curves: the number of bits in the + ///private keys. + pub nbits: usize, + ///< \internal 1 if the constants are static. + pub private_h: ::core::ffi::c_uint, + ///< The function for fast pseudo-reduction + ///mod \p P (see above). + pub private_modp: + ::core::option::Option ::core::ffi::c_int>, + ///< Unused. + pub private_t_pre: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_post: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_data: *mut ::core::ffi::c_void, + ///< Pre-computed points for ecp_mul_comb(). + pub private_T: *mut mbedtls_ecp_point, + ///< The number of dynamic allocated pre-computed points. + pub private_T_size: usize, +} +impl Default for mbedtls_ecp_group { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; +/// \brief The ECP key-pair structure. +/// +/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. +/// +/// \note Members are deliberately in the same order as in the +/// ::mbedtls_ecdsa_context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_keypair { + ///< Elliptic curve and base point + pub private_grp: mbedtls_ecp_group, + ///< our secret value + pub private_d: mbedtls_mpi, + ///< our public value + pub private_Q: mbedtls_ecp_point, +} +impl Default for mbedtls_ecp_keypair { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +} +unsafe extern "C" { + /// \brief This function retrieves the information defined in + /// mbedtls_ecp_curve_info() for all supported curves. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair( - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. + /// + /// \return A statically allocated array. The last entry is 0. + pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function generates an ECP key. + /// \brief This function retrieves the list of internal group + /// identifiers of all supported curves in the order of + /// preference. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. This must be initialized. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_key( - grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return A statically allocated array, + /// terminated with MBEDTLS_ECP_DP_NONE. + pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function reads an elliptic curve private key. + /// \brief This function retrieves curve information from an internal + /// group identifier. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. - /// \param buf The buffer containing the binary representation of the - /// key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The length of the buffer in bytes. + /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is - /// invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_read_key( + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_grp_id( grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - buf: *const ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports an elliptic curve private key. + /// \brief This function retrieves curve information from a TLS + /// NamedCurve value. /// - /// \param key The private key. - /// \param buf The output buffer for containing the binary representation - /// of the key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The total length of the buffer in bytes. + /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key - ///representation is larger than the available space in \p buf. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_write_key( - key: *mut mbedtls_ecp_keypair, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function checks that the keypair objects - /// \p pub and \p prv have the same group and the - /// same public point, and that the private key in - /// \p prv is consistent with the public key. + /// \brief This function retrieves curve information from a + /// human-readable name. /// - /// \param pub The keypair structure holding the public key. This - /// must be initialized. If it contains a private key, that - /// part is ignored. - /// \param prv The keypair structure holding the full keypair. - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param name The human-readable name. /// - /// \return \c 0 on success, meaning that the keys are valid and match. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. - /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX - /// error code on calculation failure. - pub fn mbedtls_ecp_check_pub_priv( - pub_: *const mbedtls_ecp_keypair, - prv: *const mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_name( + name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports generic key-pair parameters. - /// - /// \param key The key pair to export from. - /// \param grp Slot for exported ECP group. - /// It must point to an initialized ECP group. - /// \param d Slot for the exported secret value. - /// It must point to an initialized mpi. - /// \param Q Slot for the exported public value. - /// It must point to an initialized ECP point. + /// \brief This function initializes a point as zero. /// - /// \return \c 0 on success, - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_export( - key: *const mbedtls_ecp_keypair, - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \param pt The point to initialize. + pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief The ECP checkup routine. + /// \brief This function initializes an ECP group context + /// without loading any domain parameters. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< None. -pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; -///< The MD5 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 1; -///< The SHA-1 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 2; -///< The SHA-224 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 3; -///< The SHA-256 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 4; -///< The SHA-384 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 5; -///< The SHA-512 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 6; -///< The RIPEMD-160 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 7; -/// \brief Supported message digests. -/// -/// \warning MD5 and SHA-1 are considered weak message digests and -/// their use constitutes a security risk. We recommend considering -/// stronger message digests instead. -pub type mbedtls_md_type_t = ::core::ffi::c_uint; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_info_t { - _unused: [u8; 0], -} -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; -/// Used internally to indicate whether a context uses legacy or PSA. -/// -/// Internal use only. -pub type mbedtls_md_engine_t = ::core::ffi::c_uint; -/// The generic message-digest context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_context_t { - /// Information about the associated message digest. - pub private_md_info: *const mbedtls_md_info_t, - /// The digest-specific context (legacy) or the PSA operation. - pub private_md_ctx: *mut ::core::ffi::c_void, - /// The HMAC part of the context. - pub private_hmac_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_md_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \note After this function is called, domain parameters + /// for various ECP groups can be loaded through the + /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + /// functions. + pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest type. - /// - /// \param md_type The type of digest to search for. + /// \brief This function initializes a key pair as an invalid one. /// - /// \return The message-digest information associated with \p md_type. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; + /// \param key The key pair to initialize. + pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); } unsafe extern "C" { - /// \brief This function initializes a message-digest context without - /// binding it to a particular message-digest algorithm. + /// \brief This function frees the components of a point. /// - /// This function should always be called first. It prepares the - /// context for mbedtls_md_setup() for binding it to a - /// message-digest algorithm. - pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); + /// \param pt The point to free. + pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief This function clears the internal structure of \p ctx and - /// frees any embedded internal structure, but does not free - /// \p ctx itself. + /// \brief This function frees the components of an ECP group. /// - /// If you have called mbedtls_md_setup() on \p ctx, you must - /// call mbedtls_md_free() when you are no longer using the - /// context. - /// Calling this function if you have previously - /// called mbedtls_md_init() and nothing else is optional. - /// You must not call this function if you have not called - /// mbedtls_md_init(). - pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); + /// \param grp The group to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP group. + pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function selects the message digest algorithm to use, - /// and allocates internal structures. + /// \brief This function frees the components of a key pair. /// - /// It should be called after mbedtls_md_init() or - /// mbedtls_md_free(). Makes it necessary to call - /// mbedtls_md_free() later. + /// \param key The key pair to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP key pair. + pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +} +unsafe extern "C" { + /// \brief This function copies the contents of point \p Q into + /// point \p P. /// - /// \param ctx The context to set up. - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), - /// or non-zero: HMAC is used with this context. + /// \param P The destination point. This must be initialized. + /// \param Q The source point. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. - pub fn mbedtls_md_setup( - ctx: *mut mbedtls_md_context_t, - md_info: *const mbedtls_md_info_t, - hmac: ::core::ffi::c_int, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code for other kinds of failure. + pub fn mbedtls_ecp_copy( + P: *mut mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function clones the state of a message-digest - /// context. - /// - /// \note You must call mbedtls_md_setup() on \c dst before calling - /// this function. - /// - /// \note The two contexts must have the same type, - /// for example, both are SHA-256. - /// - /// \warning This function clones the message-digest state, not the - /// HMAC state. + /// \brief This function copies the contents of group \p src into + /// group \p dst. /// - /// \param dst The destination context. - /// \param src The context to be cloned. + /// \param dst The destination group. This must be initialized. + /// \param src The source group. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. - /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are - /// not using the same engine. This can be avoided by moving - /// the call to psa_crypto_init() before the first call to - /// mbedtls_md_setup(). - pub fn mbedtls_md_clone( - dst: *mut mbedtls_md_context_t, - src: *const mbedtls_md_context_t, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_copy( + dst: *mut mbedtls_ecp_group, + src: *const mbedtls_ecp_group, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest size from the - /// message-digest information structure. + /// \brief This function sets a point to the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to set. This must be initialized. /// - /// \return The size of the message-digest output in Bytes. - pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest type from the - /// message-digest information structure. + /// \brief This function checks if a point is the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to test. This must be initialized. /// - /// \return The type of the message digest. - pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; + /// \return \c 1 if the point is zero. + /// \return \c 0 if the point is non-zero. + /// \return A negative error code on failure. + pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function starts a message-digest computation. + /// \brief This function compares two points. /// - /// You must call this function after setting up the context - /// with mbedtls_md_setup(), and before passing data with - /// mbedtls_md_update(). + /// \note This assumes that the points are normalized. Otherwise, + /// they may compare as "not equal" even if they are. /// - /// \param ctx The generic message-digest context. + /// \param P The first point to compare. This must be initialized. + /// \param Q The second point to compare. This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return \c 0 if the points are equal. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + pub fn mbedtls_ecp_point_cmp( + P: *const mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// message-digest computation. - /// - /// You must call mbedtls_md_starts() before calling this - /// function. You may call this function multiple times. - /// Afterwards, call mbedtls_md_finish(). + /// \brief This function imports a non-zero point from two ASCII + /// strings. /// - /// \param ctx The generic message-digest context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param P The destination point. This must be initialized. + /// \param radix The numeric base of the input. + /// \param x The first affine coordinate, as a null-terminated string. + /// \param y The second affine coordinate, as a null-terminated string. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + pub fn mbedtls_ecp_point_read_string( + P: *mut mbedtls_ecp_point, + radix: ::core::ffi::c_int, + x: *const ::core::ffi::c_char, + y: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the digest operation, - /// and writes the result to the output buffer. - /// - /// Call this function after a call to mbedtls_md_starts(), - /// followed by any number of calls to mbedtls_md_update(). - /// Afterwards, you may either clear the context with - /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse - /// the context for another digest operation with the same - /// algorithm. + /// \brief This function exports a point into unsigned binary data. /// - /// \param ctx The generic message-digest context. - /// \param output The buffer for the generic message-digest checksum result. + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The point to export. This must be initialized. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_point_write_binary( + grp: *const mbedtls_ecp_group, + P: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the message-digest of a buffer, - /// with respect to a configurable message-digest algorithm - /// in a single call. + /// \brief This function imports a point from unsigned binary data. /// - /// The result is calculated as - /// Output = message_digest(input buffer). + /// \note This function does not check that the point actually + /// belongs to the given group, see mbedtls_ecp_check_pubkey() + /// for that. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param input The buffer holding the data. - /// \param ilen The length of the input data. - /// \param output The generic message-digest checksum result. + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md( - md_info: *const mbedtls_md_info_t, - input: *const ::core::ffi::c_uchar, + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The destination context to import the point to. + /// This must be initialized. + /// \param buf The input buffer. This must be a readable buffer + /// of length \p ilen Bytes. + /// \param ilen The length of the input buffer \p buf in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + /// given group is not implemented. + pub fn mbedtls_ecp_point_read_binary( + grp: *const mbedtls_ecp_group, + P: *mut mbedtls_ecp_point, + buf: *const ::core::ffi::c_uchar, ilen: usize, - output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the list of digests supported by the - /// generic digest module. - /// - /// \note The list starts with the strongest available hashes. + /// \brief This function imports a point from a TLS ECPoint record. /// - /// \return A statically allocated array of digests. Each element - /// in the returned list is an integer belonging to the - /// message-digest enumeration #mbedtls_md_type_t. - /// The last entry is 0. - pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest name. + /// \note On function return, \p *buf is updated to point immediately + /// after the ECPoint record. /// - /// \param md_name The name of the digest to search for. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The destination point. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the buffer. /// - /// \return The message-digest information associated with \p md_name. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_string( - md_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_md_info_t; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + /// failure. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + pub fn mbedtls_ecp_tls_read_point( + grp: *const mbedtls_ecp_group, + pt: *mut mbedtls_ecp_point, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest name from the - /// message-digest information structure. + /// \brief This function exports a point as a TLS ECPoint record + /// defined in RFC 4492, Section 5.4. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to be exported. This must be initialized. + /// \param format The point format to use. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// \param olen The address at which to store the length in Bytes + /// of the data written. + /// \param buf The target buffer. This must be a writable buffer of + /// length \p blen Bytes. + /// \param blen The length of the target buffer \p buf in Bytes. /// - /// \return The name of the message digest. - pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + /// is too small to hold the exported point. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_point( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// from the given context. + /// \brief This function sets up an ECP group context + /// from a standardized set of domain parameters. /// - /// \param ctx The context from which to extract the information. - /// This must be initialized (or \c NULL). + /// \note The index should be a value of the NamedCurve enum, + /// as defined in RFC-4492: Elliptic Curve Cryptography + /// (ECC) Cipher Suites for Transport Layer Security (TLS), + /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. /// - /// \return The message-digest information associated with \p ctx. - /// \return \c NULL if \p ctx is \c NULL. - pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; + /// \param grp The group context to setup. This must be initialized. + /// \param id The identifier of the domain parameter set to load. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_load( + grp: *mut mbedtls_ecp_group, + id: mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the HMAC key and prepares to - /// authenticate a new message. + /// \brief This function sets up an ECP group context from a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_setup(), to use - /// the MD context for an HMAC calculation, then call - /// mbedtls_md_hmac_update() to provide the input data, and - /// mbedtls_md_hmac_finish() to get the HMAC value. + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC key in Bytes. + /// \param grp The group context to setup. This must be initialized. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_starts( - ctx: *mut mbedtls_md_context_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group( + grp: *mut mbedtls_ecp_group, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing HMAC - /// computation. + /// \brief This function extracts an elliptic curve group ID from a + /// TLS ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() - /// before calling this function. - /// You may call this function multiple times to pass the - /// input piecewise. - /// Afterwards, call mbedtls_md_hmac_finish(). + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param grp The address at which to store the group id. + /// This must not be \c NULL. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group_id( + grp: *mut mbedtls_ecp_group_id, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the HMAC operation, and writes - /// the result to the output buffer. + /// \brief This function exports an elliptic curve as a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_hmac_starts() and - /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards - /// you may either call mbedtls_md_free() to clear the context, - /// or call mbedtls_md_hmac_reset() to reuse the context with - /// the same HMAC key. - /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param output The generic HMAC checksum result. + /// \param grp The ECP group to be exported. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param olen The address at which to store the number of Bytes written. + /// This must not be \c NULL. + /// \param buf The buffer to write to. This must be a writable buffer + /// of length \p blen Bytes. + /// \param blen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + /// buffer is too small to hold the exported group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_group( + grp: *const mbedtls_ecp_group, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function prepares to authenticate a new message with - /// the same key as the previous HMAC operation. + /// \brief This function performs a scalar multiplication of a point + /// by an integer: \p R = \p m * \p P. /// - /// You may call this function after mbedtls_md_hmac_finish(). - /// Afterwards call mbedtls_md_hmac_update() to pass the new - /// input. + /// It is not thread-safe to use same group in multiple threads. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. + /// \note To prevent timing attacks, this function + /// executes the exact same sequence of base-field + /// operations for any valid \p m. It avoids any if-branch or + /// array index depending on the value of \p m. It also uses + /// \p f_rng to randomize some intermediate results. + /// + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the full generic HMAC - /// on the input buffer with the provided key. + /// \brief This function performs multiplication of a point by + /// an integer: \p R = \p m * \p P in a restartable way. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// \see mbedtls_ecp_mul() /// - /// The HMAC result is calculated as - /// output = generic HMAC(hmac key, input buffer). + /// \note This function does the same as \c mbedtls_ecp_mul(), but + /// it can return early and restart according to the limit set + /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC secret key in Bytes. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. - /// \param output The generic HMAC result. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac( - md_info: *const mbedtls_md_info_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecp_restart_ctx, ) -> ::core::ffi::c_int; } -/// \brief The RSA context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_rsa_context { - ///< Reserved for internal purposes. - /// Do not set this field in application - /// code. Its meaning might change without - /// notice. - pub private_ver: ::core::ffi::c_int, - ///< The size of \p N in Bytes. - pub private_len: usize, - ///< The public modulus. - pub private_N: mbedtls_mpi, - ///< The public exponent. - pub private_E: mbedtls_mpi, - ///< The private exponent. - pub private_D: mbedtls_mpi, - ///< The first prime factor. - pub private_P: mbedtls_mpi, - ///< The second prime factor. - pub private_Q: mbedtls_mpi, - ///< D % (P - 1). - pub private_DP: mbedtls_mpi, - ///< D % (Q - 1). - pub private_DQ: mbedtls_mpi, - ///< 1 / (Q % P). - pub private_QP: mbedtls_mpi, - ///< cached R^2 mod N. - pub private_RN: mbedtls_mpi, - ///< cached R^2 mod P. - pub private_RP: mbedtls_mpi, - ///< cached R^2 mod Q. - pub private_RQ: mbedtls_mpi, - ///< The cached blinding value. - pub private_Vi: mbedtls_mpi, - ///< The cached un-blinding value. - pub private_Vf: mbedtls_mpi, - ///< Selects padding mode: - ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and - ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. - pub private_padding: ::core::ffi::c_int, - ///< Hash identifier of mbedtls_md_type_t type, - ///as specified in md.h for use in the MGF - ///mask generating function used in the - ///EME-OAEP and EMSA-PSS encodings. - pub private_hash_id: ::core::ffi::c_int, -} -impl Default for mbedtls_rsa_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes an RSA context. - /// - /// \note This function initializes the padding and the hash - /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and - /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more - /// information about those parameters. - /// - /// \param ctx The RSA context to initialize. This must not be \c NULL. - pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); -} -unsafe extern "C" { - /// \brief This function sets padding for an already initialized RSA - /// context. - /// - /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP - /// encryption scheme and the RSASSA-PSS signature scheme. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q /// - /// \note The \p hash_id parameter is ignored when using - /// #MBEDTLS_RSA_PKCS_V15 padding. + /// It is not thread-safe to use same group in multiple threads. /// - /// \note The choice of padding mode is strictly enforced for private - /// key operations, since there might be security concerns in - /// mixing padding modes. For public key operations it is - /// a default value, which can be overridden by calling specific - /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx - /// functions. + /// \note In contrast to mbedtls_ecp_mul(), this function does not + /// guarantee a constant execution flow and timing. /// - /// \note The hash selected in \p hash_id is always used for OEAP - /// encryption. For PSS signatures, it is always used for - /// making signatures, but can be overridden for verifying them. - /// If set to #MBEDTLS_MD_NONE, it is always overridden. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \param ctx The initialized RSA context to be configured. - /// \param padding The padding mode to use. This must be either - /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. - /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is - /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this - /// function but may be not suitable for some operations. - /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: - /// \p padding or \p hash_id is invalid. - pub fn mbedtls_rsa_set_padding( - ctx: *mut mbedtls_rsa_context, - padding: ::core::ffi::c_int, - hash_id: mbedtls_md_type_t, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves padding mode of initialized - /// RSA context. - /// - /// \param ctx The initialized RSA context. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q in a + /// restartable way. /// - /// \return RSA padding mode. - pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function retrieves hash identifier of mbedtls_md_type_t - /// type. + /// \see \c mbedtls_ecp_muladd() /// - /// \param ctx The initialized RSA context. + /// \note This function works the same as \c mbedtls_ecp_muladd(), + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return Hash identifier of mbedtls_md_type_t type. - pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function imports a set of core parameters into an - /// RSA context. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, + rs_ctx: *mut mbedtls_ecp_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function checks that a point is a valid public key + /// on this curve. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// It only checks that the point is non-zero, has + /// valid coordinates and lies on the curve. It does not verify + /// that it is indeed a multiple of \c G. This additional + /// check is computationally more expensive, is not required + /// by standards, and should not be necessary if the group + /// used has a small cofactor. In particular, it is useless for + /// the NIST groups which all have a cofactor of 1. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure, to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param E The public exponent. This may be \c NULL. + /// \param grp The ECP group the point should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to check. This must be initialized. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import( - ctx: *mut mbedtls_rsa_context, - N: *const mbedtls_mpi, - P: *const mbedtls_mpi, - Q: *const mbedtls_mpi, - D: *const mbedtls_mpi, - E: *const mbedtls_mpi, + /// \return \c 0 if the point is a valid public key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + /// a valid public key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_pubkey( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports core RSA parameters, in raw big-endian - /// binary format, into an RSA context. - /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \brief This function checks that an \c mbedtls_mpi is a + /// valid private key for this curve. /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// \param grp The ECP group the private key should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The integer to check. This must be initialized. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \return \c 0 if the point is a valid private key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + /// private key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_privkey( + grp: *const mbedtls_ecp_group, + d: *const mbedtls_mpi, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates a private key. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. - /// \param E The public exponent. This may be \c NULL. - /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// \param grp The ECP group to generate a private key for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import_raw( - ctx: *mut mbedtls_rsa_context, - N: *const ::core::ffi::c_uchar, - N_len: usize, - P: *const ::core::ffi::c_uchar, - P_len: usize, - Q: *const ::core::ffi::c_uchar, - Q_len: usize, - D: *const ::core::ffi::c_uchar, - D_len: usize, - E: *const ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_privkey( + grp: *const mbedtls_ecp_group, + d: *mut mbedtls_mpi, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function completes an RSA context from - /// a set of imported core parameters. - /// - /// To setup an RSA public key, precisely \p N and \p E - /// must have been imported. + /// \brief This function generates a keypair with a configurable base + /// point. /// - /// To setup an RSA private key, sufficient information must - /// be present for the other parameters to be derivable. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// The default implementation supports the following: - ///
          • Derive \p P, \p Q from \p N, \p D, \p E.
            • - ///
          • Derive \p N, \p D from \p P, \p Q, \p E.
          - /// Alternative implementations need not support these. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param G The base point to use. This must be initialized + /// and belong to \p grp. It replaces the default base + /// point \c grp->G used by mbedtls_ecp_gen_keypair(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// If this function runs successfully, it guarantees that - /// the RSA context can be used for RSA operations without - /// the risk of failure or crash. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair_base( + grp: *mut mbedtls_ecp_group, + G: *const mbedtls_ecp_point, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates an ECP keypair. /// - /// \warning This function need not perform consistency checks - /// for the imported parameters. In particular, parameters that - /// are not needed by the implementation might be silently - /// discarded and left unchecked. To check the consistency - /// of the key material, see mbedtls_rsa_check_privkey(). + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context holding imported parameters. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations - /// failed. - pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair( + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports the core parameters of an RSA key. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. - /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \brief This function generates an ECP key. /// - /// \param ctx The initialized RSA context. - /// \param N The MPI to hold the RSA modulus. - /// This may be \c NULL if this field need not be exported. - /// \param P The MPI to hold the first prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param Q The MPI to hold the second prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param D The MPI to hold the private exponent. - /// This may be \c NULL if this field need not be exported. - /// \param E The MPI to hold the public exponent. - /// This may be \c NULL if this field need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. This must be initialized. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export( - ctx: *const mbedtls_rsa_context, - N: *mut mbedtls_mpi, - P: *mut mbedtls_mpi, - Q: *mut mbedtls_mpi, - D: *mut mbedtls_mpi, - E: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports core parameters of an RSA key - /// in raw big-endian binary format. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. + /// \brief Set the public key in a key pair object. /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \note This function does not check that the point actually + /// belongs to the given group. Call mbedtls_ecp_check_pubkey() + /// on \p Q before calling this function to check that. /// - /// \note The length parameters are ignored if the corresponding - /// buffer pointers are NULL. + /// \note This function does not check that the public key matches + /// the private key that is already in \p key, if any. + /// To check the consistency of the resulting key pair object, + /// call mbedtls_ecp_check_pub_priv() after setting both + /// the public key and the private key. /// - /// \param ctx The initialized RSA context. - /// \param N The Byte array to store the RSA modulus, - /// or \c NULL if this field need not be exported. - /// \param N_len The size of the buffer for the modulus. - /// \param P The Byte array to hold the first prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param P_len The size of the buffer for the first prime factor. - /// \param Q The Byte array to hold the second prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param Q_len The size of the buffer for the second prime factor. - /// \param D The Byte array to hold the private exponent, - /// or \c NULL if this field need not be exported. - /// \param D_len The size of the buffer for the private exponent. - /// \param E The Byte array to hold the public exponent, - /// or \c NULL if this field need not be exported. - /// \param E_len The size of the buffer for the public exponent. + /// \param grp_id The ECP group identifier. + /// \param key The key pair object. It must be initialized. + /// If its group has already been set, it must match \p grp_id. + /// If its group has not been set, it will be set to \p grp_id. + /// If the public key has already been set, it is overwritten. + /// \param Q The public key to copy. This must be a point on the + /// curve indicated by \p grp_id. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export_raw( - ctx: *const mbedtls_rsa_context, - N: *mut ::core::ffi::c_uchar, - N_len: usize, - P: *mut ::core::ffi::c_uchar, - P_len: usize, - Q: *mut ::core::ffi::c_uchar, - Q_len: usize, - D: *mut ::core::ffi::c_uchar, - D_len: usize, - E: *mut ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + /// match \p grp_id. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_public_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports CRT parameters of a private RSA key. + /// \brief This function reads an elliptic curve private key. /// - /// \note Alternative RSA implementations not using CRT-parameters - /// internally can implement this function based on - /// mbedtls_rsa_deduce_opt(). + /// \note This function does not set the public key in the + /// key pair object. Without a public key, the key pair object + /// cannot be used with operations that require the public key. + /// Call mbedtls_ecp_keypair_calc_public() to set the public + /// key from the private key. Alternatively, you can call + /// mbedtls_ecp_set_public_key() to set the public key part, + /// and then optionally mbedtls_ecp_check_pub_priv() to check + /// that the private and public parts are consistent. + /// + /// \note If a public key has already been set in the key pair + /// object, this function does not check that it is consistent + /// with the private key. Call mbedtls_ecp_check_pub_priv() + /// after setting both the public key and the private key + /// to make that check. /// - /// \param ctx The initialized RSA context. - /// \param DP The MPI to hold \c D modulo `P-1`, - /// or \c NULL if it need not be exported. - /// \param DQ The MPI to hold \c D modulo `Q-1`, - /// or \c NULL if it need not be exported. - /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, - /// or \c NULL if it need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. + /// \param buf The buffer containing the binary representation of the + /// key. (Big endian integer for Weierstrass curves, byte + /// string for Montgomery curves.) + /// \param buflen The length of the buffer in bytes. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_export_crt( - ctx: *const mbedtls_rsa_context, - DP: *mut mbedtls_mpi, - DQ: *mut mbedtls_mpi, - QP: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + /// invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_read_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + buf: *const ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves the length of RSA modulus in Bytes. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context. + /// \deprecated Note that although this function accepts an output + /// buffer that is smaller or larger than the key, most key + /// import interfaces require the output to have exactly + /// key's nominal length. It is generally simplest to + /// pass the key's nominal length as \c buflen, after + /// checking that the output buffer is large enough. + /// See the description of the \p buflen parameter for + /// how to calculate the nominal length. + /// To avoid this difficulty, use mbedtls_ecp_write_key_ext() + /// instead. + /// mbedtls_ecp_write_key() is deprecated and will be + /// removed in a future version of the library. + /// + /// \note If the private key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \return The length of the RSA modulus in Bytes. - pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; + /// \param key The private key. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// For Weierstrass curves, this is the big-endian + /// representation, padded with null bytes at the beginning + /// to reach \p buflen bytes. + /// For Montgomery curves, this is the standard byte string + /// representation (which is little-endian), padded with + /// null bytes at the end to reach \p buflen bytes. + /// \param buflen The total length of the buffer in bytes. + /// The length of the output is + /// (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// For Weierstrass keys, if the output buffer is smaller, + /// leading zeros are trimmed to fit if possible. For + /// Montgomery keys, the output buffer must always be large + /// enough for the nominal length. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + /// #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key( + key: *mut mbedtls_ecp_keypair, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an RSA keypair. - /// - /// \note mbedtls_rsa_init() must be called before this function, - /// to set up the RSA context. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context used to hold the key. - /// \param f_rng The RNG function to be used for key generation. - /// This is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. - /// This may be \c NULL if \p f_rng doesn't need a context. - /// \param nbits The size of the public key in bits. - /// \param exponent The public exponent to use. For example, \c 65537. - /// This must be odd and greater than \c 1. + /// \param key The private key. + /// \param olen On success, the length of the private key. + /// This is always (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// \param buflen The total length of the buffer in bytes. + /// #MBEDTLS_ECP_MAX_BYTES is always sufficient. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_gen_key( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - nbits: ::core::ffi::c_uint, - exponent: ::core::ffi::c_int, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + /// set in \p key. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key_ext( + key: *const mbedtls_ecp_keypair, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains at least an RSA - /// public key. + /// \brief This function exports an elliptic curve public key. /// - /// If the function runs successfully, it is guaranteed that - /// enough information is present to perform an RSA public key - /// operation using mbedtls_rsa_public(). + /// \note If the public key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to check. + /// \param key The public key. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_write_public_key( + key: *const mbedtls_ecp_keypair, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains an RSA private key - /// and perform basic consistency checks. - /// - /// \note The consistency checks performed by this function not only - /// ensure that mbedtls_rsa_private() can be called successfully - /// on the given context, but that the various parameters are - /// mutually consistent with high probability, in the sense that - /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// \brief This function checks that the keypair objects + /// \p pub and \p prv have the same group and the + /// same public point, and that the private key in + /// \p prv is consistent with the public key. /// - /// \warning This function should catch accidental misconfigurations - /// like swapping of parameters, but it cannot establish full - /// trust in neither the quality nor the consistency of the key - /// material that was used to setup the given RSA context: - ///
          • Consistency: Imported parameters that are irrelevant - /// for the implementation might be silently dropped. If dropped, - /// the current function does not have access to them, - /// and therefore cannot check them. See mbedtls_rsa_complete(). - /// If you want to check the consistency of the entire - /// content of a PKCS1-encoded RSA private key, for example, you - /// should use mbedtls_rsa_validate_params() before setting - /// up the RSA context. - /// Additionally, if the implementation performs empirical checks, - /// these checks substantiate but do not guarantee consistency.
            • - ///
          • Quality: This function is not expected to perform - /// extended quality assessments like checking that the prime - /// factors are safe. Additionally, it is the responsibility of the - /// user to ensure the trustworthiness of the source of his RSA - /// parameters, which goes beyond what is effectively checkable - /// by the library.
          - /// - /// \param ctx The initialized RSA context to check. + /// \param pub The keypair structure holding the public key. This + /// must be initialized. If it contains a private key, that + /// part is ignored. + /// \param prv The keypair structure holding the full keypair. + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success, meaning that the keys are valid and match. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_check_pub_priv( + pub_: *const mbedtls_ecp_keypair, + prv: *const mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks a public-private RSA key pair. - /// - /// It checks each of the contexts, and makes sure they match. + /// \brief Calculate the public key from a private key in a key pair. /// - /// \param pub The initialized RSA context holding the public key. - /// \param prv The initialized RSA context holding the private key. + /// \param key A keypair structure. It must have a private key set. + /// If the public key is set, it will be overwritten. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pub_priv( - pub_: *const mbedtls_rsa_context, - prv: *const mbedtls_rsa_context, + /// \return \c 0 on success. The key pair object can be used for + /// operations that require the public key. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_keypair_calc_public( + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs an RSA public key operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// - /// \note This function does not handle message padding. + /// \brief Query the group that a key pair belongs to. /// - /// \note Make sure to set \p input[0] = 0 or ensure that - /// input is smaller than \p N. + /// \param key The key pair to query. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_public( - ctx: *mut mbedtls_rsa_context, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The group ID for the group registered in the key pair + /// object. + /// This is \c MBEDTLS_ECP_DP_NONE if no group has been set + /// in the key pair object. + pub fn mbedtls_ecp_keypair_get_group_id( + key: *const mbedtls_ecp_keypair, + ) -> mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function performs an RSA private key operation. - /// - /// \note Blinding is used if and only if a PRNG is provided. + /// \brief This function exports generic key-pair parameters. /// - /// \note If blinding is used, both the base of exponentiation - /// and the exponent are blinded, providing protection - /// against some side-channel attacks. + /// Each of the output parameters can be a null pointer + /// if you do not need that parameter. /// - /// \warning It is deprecated and a security risk to not provide - /// a PRNG here and thereby prevent the use of blinding. - /// Future versions of the library may enforce the presence - /// of a PRNG. + /// \note If the private key or the public key was not set in \p key, + /// the corresponding output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function, used for blinding. It is mandatory. - /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param key The key pair to export from. + /// \param grp Slot for exported ECP group. + /// It must either be null or point to an initialized ECP group. + /// \param d Slot for the exported secret value. + /// It must either be null or point to an initialized mpi. + /// \param Q Slot for the exported public value. + /// It must either be null or point to an initialized ECP point. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_private( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_export( + key: *const mbedtls_ecp_keypair, + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function adds the message padding, then performs an RSA - /// operation. - /// - /// It is the generic wrapper for performing a PKCS#1 encryption - /// operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG to use. It is used for padding generation - /// and it is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. May be - /// \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \brief The ECP checkup routine. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return \c 1 on failure. + pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The RSA context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_rsa_context { + ///< Reserved for internal purposes. + /// Do not set this field in application + /// code. Its meaning might change without + /// notice. + pub private_ver: ::core::ffi::c_int, + ///< The size of \p N in Bytes. + pub private_len: usize, + ///< The public modulus. + pub private_N: mbedtls_mpi, + ///< The public exponent. + pub private_E: mbedtls_mpi, + ///< The private exponent. + pub private_D: mbedtls_mpi, + ///< The first prime factor. + pub private_P: mbedtls_mpi, + ///< The second prime factor. + pub private_Q: mbedtls_mpi, + ///< D % (P - 1). + pub private_DP: mbedtls_mpi, + ///< D % (Q - 1). + pub private_DQ: mbedtls_mpi, + ///< 1 / (Q % P). + pub private_QP: mbedtls_mpi, + ///< cached R^2 mod N. + pub private_RN: mbedtls_mpi, + ///< cached R^2 mod P. + pub private_RP: mbedtls_mpi, + ///< cached R^2 mod Q. + pub private_RQ: mbedtls_mpi, + ///< The cached blinding value. + pub private_Vi: mbedtls_mpi, + ///< The cached un-blinding value. + pub private_Vf: mbedtls_mpi, + ///< Selects padding mode: + ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. + pub private_padding: ::core::ffi::c_int, + ///< Hash identifier of mbedtls_md_type_t type, + ///as specified in md.h for use in the MGF + ///mask generating function used in the + ///EME-OAEP and EMSA-PSS encodings. + pub private_hash_id: ::core::ffi::c_int, +} +impl Default for mbedtls_rsa_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 encryption operation - /// (RSAES-PKCS1-v1_5-ENCRYPT). + /// \brief This function initializes an RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. It is mandatory and used for - /// padding generation. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note This function initializes the padding and the hash + /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + /// information about those parameters. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The RSA context to initialize. This must not be \c NULL. + pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP encryption - /// operation (RSAES-OAEP-ENCRYPT). - /// - /// \note The output buffer must be as large as the size - /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \brief This function sets padding for an already initialized RSA + /// context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is needed for padding - /// generation and is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param ilen The length of the plaintext buffer \p input in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + /// encryption scheme and the RSASSA-PSS signature scheme. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs an RSA operation, then removes the - /// message padding. + /// \note The \p hash_id parameter is ignored when using + /// #MBEDTLS_RSA_PKCS_V15 padding. /// - /// It is the generic wrapper for performing a PKCS#1 decryption - /// operation. + /// \note The choice of padding mode is strictly enforced for private + /// key operations, since there might be security concerns in + /// mixing padding modes. For public key operations it is + /// a default value, which can be overridden by calling specific + /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + /// functions. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N (for example, - /// 128 Bytes if RSA-1024 is used) to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note The hash selected in \p hash_id is always used for OEAP + /// encryption. For PSS signatures, it is always used for + /// making signatures, but can be overridden for verifying them. + /// If set to #MBEDTLS_MD_NONE, it is always overridden. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \param ctx The initialized RSA context to be configured. + /// \param padding The padding mode to use. This must be either + /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is + /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + /// function but may be not suitable for some operations. + /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_decrypt( + /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + /// \p padding or \p hash_id is invalid. + pub fn mbedtls_rsa_set_padding( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + padding: ::core::ffi::c_int, + hash_id: mbedtls_md_type_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 decryption - /// operation (RSAES-PKCS1-v1_5-DECRYPT). + /// \brief This function retrieves padding mode of initialized + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for example, - /// 128 Bytes if RSA-1024 is used, to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \param ctx The initialized RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \return RSA padding mode. + pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function retrieves hash identifier of mbedtls_md_type_t + /// type. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context. + /// + /// \return Hash identifier of mbedtls_md_type_t type. + pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP decryption - /// operation (RSAES-OAEP-DECRYPT). + /// \brief This function imports a set of core parameters into an + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for - /// example, 128 Bytes if RSA-1024 is used, to be able to - /// hold an arbitrary decrypted message. If it is not - /// large enough to hold the decryption of the particular - /// ciphertext provided, the function returns - /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. + /// + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. + /// + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. + /// + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param E The public exponent. This may be \c NULL. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_decrypt( + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + N: *const mbedtls_mpi, + P: *const mbedtls_mpi, + Q: *const mbedtls_mpi, + D: *const mbedtls_mpi, + E: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a private RSA operation to sign - /// a message digest using PKCS#1. + /// \brief This function imports core RSA parameters, in raw big-endian + /// binary format, into an RSA context. /// - /// It is the generic wrapper for performing a PKCS#1 - /// signature. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_sign() for details on - /// \p md_alg and \p hash_id. + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is mandatory and - /// must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_sign( + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + /// \param E The public exponent. This may be \c NULL. + /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import_raw( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + N: *const ::core::ffi::c_uchar, + N_len: usize, + P: *const ::core::ffi::c_uchar, + P_len: usize, + Q: *const ::core::ffi::c_uchar, + Q_len: usize, + D: *const ::core::ffi::c_uchar, + D_len: usize, + E: *const ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 signature - /// operation (RSASSA-PKCS1-v1_5-SIGN). + /// \brief This function completes an RSA context from + /// a set of imported core parameters. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// To setup an RSA public key, precisely \c N and \c E + /// must have been imported. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// To setup an RSA private key, sufficient information must + /// be present for the other parameters to be derivable. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// The default implementation supports the following: + ///
          • Derive \c P, \c Q from \c N, \c D, \c E.
            • + ///
          • Derive \c N, \c D from \c P, \c Q, \c E.
          + /// Alternative implementations need not support these. /// - /// \note This function enforces that the provided salt length complies - /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 - /// step 3. The constraint is that the hash length plus the salt - /// length plus 2 bytes must be at most the key length. If this - /// constraint is not met, this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// If this function runs successfully, it guarantees that + /// the RSA context can be used for RSA operations without + /// the risk of failure or crash. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param saltlen The length of the salt that should be used. - /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use - /// the largest possible salt length up to the hash length, - /// which is the largest permitted by some standards including - /// FIPS 186-4 §5.5. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \warning This function need not perform consistency checks + /// for the imported parameters. In particular, parameters that + /// are not needed by the implementation might be silently + /// discarded and left unchecked. To check the consistency + /// of the key material, see mbedtls_rsa_check_privkey(). /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign_ext( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - saltlen: ::core::ffi::c_int, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context holding imported parameters. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + /// failed. + pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// \brief This function exports the core parameters of an RSA key. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \note This function always uses the maximum possible salt size, - /// up to the length of the payload hash. This choice of salt - /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 - /// v2.2) §9.1.1 step 3. Furthermore this function enforces a - /// minimum salt size which is the hash size minus 2 bytes. If - /// this minimum size is too large given the key size (the salt - /// size, plus the hash size, plus 2 bytes must be no more than - /// the key size in bytes), this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param N The MPI to hold the RSA modulus. + /// This may be \c NULL if this field need not be exported. + /// \param P The MPI to hold the first prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param Q The MPI to hold the second prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param D The MPI to hold the private exponent. + /// This may be \c NULL if this field need not be exported. + /// \param E The MPI to hold the public exponent. + /// This may be \c NULL if this field need not be exported. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export( + ctx: *const mbedtls_rsa_context, + N: *mut mbedtls_mpi, + P: *mut mbedtls_mpi, + Q: *mut mbedtls_mpi, + D: *mut mbedtls_mpi, + E: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a public RSA operation and checks - /// the message digest. - /// - /// This is the generic wrapper for performing a PKCS#1 - /// verification. + /// \brief This function exports core parameters of an RSA key + /// in raw big-endian binary format. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - /// \p hash_id. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \note The length parameters are ignored if the corresponding + /// buffer pointers are NULL. + /// + /// \param ctx The initialized RSA context. + /// \param N The Byte array to store the RSA modulus, + /// or \c NULL if this field need not be exported. + /// \param N_len The size of the buffer for the modulus. + /// \param P The Byte array to hold the first prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param P_len The size of the buffer for the first prime factor. + /// \param Q The Byte array to hold the second prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param Q_len The size of the buffer for the second prime factor. + /// \param D The Byte array to hold the private exponent, + /// or \c NULL if this field need not be exported. + /// \param D_len The size of the buffer for the private exponent. + /// \param E The Byte array to hold the public exponent, + /// or \c NULL if this field need not be exported. + /// \param E_len The size of the buffer for the public exponent. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export_raw( + ctx: *const mbedtls_rsa_context, + N: *mut ::core::ffi::c_uchar, + N_len: usize, + P: *mut ::core::ffi::c_uchar, + P_len: usize, + Q: *mut ::core::ffi::c_uchar, + Q_len: usize, + D: *mut ::core::ffi::c_uchar, + D_len: usize, + E: *mut ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 verification - /// operation (RSASSA-PKCS1-v1_5-VERIFY). + /// \brief This function exports CRT parameters of a private RSA key. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Alternative RSA implementations not using CRT-parameters + /// internally can implement this function based on + /// mbedtls_rsa_deduce_opt(). /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param DP The MPI to hold \c D modulo `P-1`, + /// or \c NULL if it need not be exported. + /// \param DQ The MPI to hold \c D modulo `Q-1`, + /// or \c NULL if it need not be exported. + /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, + /// or \c NULL if it need not be exported. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_export_crt( + ctx: *const mbedtls_rsa_context, + DP: *mut mbedtls_mpi, + DQ: *mut mbedtls_mpi, + QP: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). - /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. If the \c hash_id set in \p ctx by - /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg - /// parameter is used. + /// \brief This function retrieves the length of the RSA modulus in bits. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param ctx The initialized RSA context. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The length of the RSA modulus in bits. + pub fn mbedtls_rsa_get_bitlen(ctx: *const mbedtls_rsa_context) -> usize; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). + /// \brief This function retrieves the length of RSA modulus in Bytes. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \param ctx The initialized RSA context. /// - /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is - /// ignored. + /// \return The length of the RSA modulus in Bytes. + pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; +} +unsafe extern "C" { + /// \brief This function generates an RSA keypair. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param mgf1_hash_id The message digest algorithm used for the - /// verification operation and the mask generation - /// function (MGF1). For more details on the encoding - /// operation and the mask generation function, consult - /// RFC-3447: Public-Key Cryptography Standards - /// (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. - /// \param expected_salt_len The length of the salt used in padding. Use - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note mbedtls_rsa_init() must be called before this function, + /// to set up the RSA context. /// - /// \return \c 0 if the verify operation was successful. + /// \param ctx The initialized RSA context used to hold the key. + /// \param f_rng The RNG function to be used for key generation. + /// This is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. + /// This may be \c NULL if \p f_rng doesn't need a context. + /// \param nbits The size of the public key in bits. + /// \param exponent The public exponent to use. For example, \c 65537. + /// This must be odd and greater than \c 1. + /// + /// \return \c 0 on success. /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify_ext( + pub fn mbedtls_rsa_gen_key( ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - mgf1_hash_id: mbedtls_md_type_t, - expected_salt_len: ::core::ffi::c_int, - sig: *const ::core::ffi::c_uchar, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + nbits: ::core::ffi::c_uint, + exponent: ::core::ffi::c_int, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function copies the components of an RSA context. + /// \brief This function checks if a context contains at least an RSA + /// public key. /// - /// \param dst The destination context. This must be initialized. - /// \param src The source context. This must be initialized. + /// If the function runs successfully, it is guaranteed that + /// enough information is present to perform an RSA public key + /// operation using mbedtls_rsa_public(). + /// + /// \param ctx The initialized RSA context to check. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. - pub fn mbedtls_rsa_copy( - dst: *mut mbedtls_rsa_context, - src: *const mbedtls_rsa_context, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees the components of an RSA key. + /// \brief This function checks if a context contains an RSA private key + /// and perform basic consistency checks. /// - /// \param ctx The RSA context to free. May be \c NULL, in which case - /// this function is a no-op. If it is not \c NULL, it must - /// point to an initialized RSA context. - pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); + /// \note The consistency checks performed by this function not only + /// ensure that mbedtls_rsa_private() can be called successfully + /// on the given context, but that the various parameters are + /// mutually consistent with high probability, in the sense that + /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// + /// \warning This function should catch accidental misconfigurations + /// like swapping of parameters, but it cannot establish full + /// trust in neither the quality nor the consistency of the key + /// material that was used to setup the given RSA context: + ///
          • Consistency: Imported parameters that are irrelevant + /// for the implementation might be silently dropped. If dropped, + /// the current function does not have access to them, + /// and therefore cannot check them. See mbedtls_rsa_complete(). + /// If you want to check the consistency of the entire + /// content of a PKCS1-encoded RSA private key, for example, you + /// should use mbedtls_rsa_validate_params() before setting + /// up the RSA context. + /// Additionally, if the implementation performs empirical checks, + /// these checks substantiate but do not guarantee consistency.
            • + ///
          • Quality: This function is not expected to perform + /// extended quality assessments like checking that the prime + /// factors are safe. Additionally, it is the responsibility of the + /// user to ensure the trustworthiness of the source of his RSA + /// parameters, which goes beyond what is effectively checkable + /// by the library.
          + /// + /// \param ctx The initialized RSA context to check. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The RSA checkup routine. + /// \brief This function checks a public-private RSA key pair. + /// + /// It checks each of the contexts, and makes sure they match. + /// + /// \param pub The initialized RSA context holding the public key. + /// \param prv The initialized RSA context holding the private key. /// /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief The ECDSA context structure. -/// -/// \warning Performing multiple operations concurrently on the same -/// ECDSA context is not supported; objects of this type -/// should not be shared between multiple threads. -/// -/// \note pk_wrap module assumes that "ecdsa_context" is identical -/// to "ecp_keypair" (see for example structure -/// "mbedtls_eckey_info" where ECDSA sign/verify functions -/// are used also for EC key) -pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; -pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pub_priv( + pub_: *const mbedtls_rsa_context, + prv: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { - /// \brief This function checks whether a given group can be used - /// for ECDSA. + /// \brief This function performs an RSA public key operation. /// - /// \param gid The ECP group ID to check. + /// \param ctx The initialized RSA context to use. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 1 if the group can be used, \c 0 otherwise - pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; + /// \note This function does not handle message padding. + /// + /// \note Make sure to set \p input[0] = 0 or ensure that + /// input is smaller than \c N. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_public( + ctx: *mut mbedtls_rsa_context, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message. + /// \brief This function performs an RSA private key operation. /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_ext() is usually preferred. + /// \note Blinding is used if and only if a PRNG is provided. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated - /// as defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \note If blinding is used, both the base of exponentiation + /// and the exponent are blinded, providing protection + /// against some side-channel attacks. /// - /// \see ecp.h + /// \warning It is deprecated and a security risk to not provide + /// a PRNG here and thereby prevent the use of blinding. + /// Future versions of the library may enforce the presence + /// of a PRNG. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized. - /// \param buf The content to be signed. This is usually the hash of - /// the original data to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function, used for blinding. It is mandatory. + /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX - /// or \c MBEDTLS_MPI_XXX error code on failure. - pub fn mbedtls_ecdsa_sign( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_private( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, deterministic version. + /// \brief This function adds the message padding, then performs an RSA + /// operation. /// - /// For more information, see RFC-6979: Deterministic - /// Usage of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). + /// It is the generic wrapper for performing a PKCS#1 encryption + /// operation. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG to use. It is used for padding generation + /// and it is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. May be + /// \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \see ecp.h + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v1.5 encryption operation + /// (RSAES-PKCS1-v1_5-ENCRYPT). /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. It is mandatory and used for + /// padding generation. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_ext( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 OAEP encryption + /// operation (RSAES-OAEP-ENCRYPT). /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_restartable() is usually - /// preferred. + /// \note The output buffer must be as large as the size + /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \note This function is like \c mbedtls_ecdsa_sign() but - /// it can return early and restart according to the - /// limit set with \c mbedtls_ecp_set_max_ops() to - /// reduce blocking. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is needed for padding + /// generation and is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param ilen The length of the plaintext buffer \p input in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs an RSA operation, then removes the + /// message padding. /// - /// \see ecp.h + /// It is the generic wrapper for performing a PKCS#1 decryption + /// operation. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + /// mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + /// inherently dangerous function (CWE-242). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N (for example, + /// 128 Bytes if RSA-1024 is used) to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. - /// - /// \note This function is like \c - /// mbedtls_ecdsa_sign_det_ext() but it can return - /// early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 decryption + /// operation (RSAES-PKCS1-v1_5-DECRYPT). /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \warning This is an inherently dangerous function (CWE-242). Unless + /// it is used in a side channel free and safe way (eg. + /// implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + /// the calling code is vulnerable. /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for example, + /// 128 Bytes if RSA-1024 is used, to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message. - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \brief This function performs a PKCS#1 v2.1 OAEP decryption + /// operation (RSAES-OAEP-DECRYPT). /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for + /// example, 128 Bytes if RSA-1024 is used, to be able to + /// hold an arbitrary decrypted message. If it is not + /// large enough to hold the decryption of the particular + /// ciphertext provided, the function returns + /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message, in a restartable manner + /// \brief This function performs a private RSA operation to sign + /// a message digest using PKCS#1. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// It is the generic wrapper for performing a PKCS#1 + /// signature. /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify_restartable( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, serialized as defined in RFC-4492: - /// Elliptic Curve Cryptography (ECC) Cipher Suites for - /// Transport Layer Security (TLS). - /// - /// \warning It is not thread-safe to use the same context in - /// multiple threads. - /// - /// \note The deterministic version is used if - /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more - /// information, see RFC-6979: Deterministic Usage - /// of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. - /// - /// \see ecp.h + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_sign() for details on + /// \p md_alg and \p hash_id. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is used only for blinding and may be set to \c NULL, but - /// doing so is DEPRECATED. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is mandatory and + /// must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, in a restartable way. - /// - /// \see \c mbedtls_ecdsa_write_signature() - /// - /// \note This function is like \c mbedtls_ecdsa_write_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 signature + /// operation (RSASSA-PKCS1-v1_5-SIGN). /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is unused and may be set to \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \see ecp.h + /// \note This function enforces that the provided salt length complies + /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + /// step 3. The constraint is that the hash length plus the salt + /// length plus 2 bytes must be at most the key length. If this + /// constraint is not met, this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param saltlen The length of the salt that should be used. + /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + /// the largest possible salt length up to the hash length, + /// which is the largest permitted by some standards including + /// FIPS 186-4 §5.5. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign_ext( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, - sig: *const ::core::ffi::c_uchar, - slen: usize, + saltlen: ::core::ffi::c_int, + sig: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature, - /// in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \see \c mbedtls_ecdsa_read_signature() + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \note This function is like \c mbedtls_ecdsa_read_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function always uses the maximum possible salt size, + /// up to the length of the payload hash. This choice of salt + /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + /// v2.2) §9.1.1 step 3. Furthermore this function enforces a + /// minimum salt size which is the hash size minus 2 bytes. If + /// this minimum size is too large given the key size (the salt + /// size, plus the hash size, plus 2 bytes must be no more than + /// the key size in bytes), this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a public RSA operation and checks + /// the message digest. + /// + /// This is the generic wrapper for performing a PKCS#1 + /// verification. + /// + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + /// \c hash_id. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *const ::core::ffi::c_uchar, - slen: usize, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an ECDSA keypair on the given curve. + /// \brief This function performs a PKCS#1 v1.5 verification + /// operation (RSASSA-PKCS1-v1_5-VERIFY). /// - /// \see ecp.h + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \param ctx The ECDSA context to store the keypair in. - /// This must be initialized. - /// \param gid The elliptic curve to use. One of the various - /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_genkey( - ctx: *mut mbedtls_ecdsa_context, - gid: mbedtls_ecp_group_id, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. If the \c hash_id set in \p ctx by + /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + /// parameter is used. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets up an ECDSA context from an EC key pair. + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param ctx The ECDSA context to setup. This must be initialized. - /// \param key The EC key to use. This must be initialized and hold - /// a private-public key pair or a public key. In the former - /// case, the ECDSA context may be used for signature creation - /// and verification after this call. In the latter case, it - /// may be used for signature verification. + /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + /// ignored. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_from_keypair( - ctx: *mut mbedtls_ecdsa_context, - key: *const mbedtls_ecp_keypair, + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param mgf1_hash_id The message digest algorithm used for the + /// verification operation and the mask generation + /// function (MGF1). For more details on the encoding + /// operation and the mask generation function, consult + /// RFC-3447: Public-Key Cryptography Standards + /// (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. + /// \param expected_salt_len The length of the salt used in padding. Use + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify_ext( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + mgf1_hash_id: mbedtls_md_type_t, + expected_salt_len: ::core::ffi::c_int, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECDSA context. + /// \brief This function copies the components of an RSA context. /// - /// \param ctx The ECDSA context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); + /// \param dst The destination context. This must be initialized. + /// \param src The source context. This must be initialized. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + pub fn mbedtls_rsa_copy( + dst: *mut mbedtls_rsa_context, + src: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees an ECDSA context. + /// \brief This function frees the components of an RSA key. /// - /// \param ctx The ECDSA context to free. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must be initialized. - pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); + /// \param ctx The RSA context to free. May be \c NULL, in which case + /// this function is a no-op. If it is not \c NULL, it must + /// point to an initialized RSA context. + pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); } -pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; -pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; -/// \brief Public key types -pub type mbedtls_pk_type_t = ::core::ffi::c_uint; -/// \brief Options for RSASSA-PSS signature verification. -/// See \c mbedtls_rsa_rsassa_pss_verify_ext() -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_rsassa_pss_options { - /// The digest to use for MGF1 in PSS. +unsafe extern "C" { + /// \brief The RSA checkup routine. /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is - /// disabled, this must be equal to the \c md_alg argument passed - /// to mbedtls_pk_verify_ext(). In a future version of the library, - /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is - /// enabled regardless of the status of #MBEDTLS_RSA_C. - pub mgf1_hash_id: mbedtls_md_type_t, - /// The expected length of the salt, in bytes. This may be - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only - /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be - /// ignored (allowing any salt length). - pub expected_salt_len: ::core::ffi::c_int, -} -impl Default for mbedtls_pk_rsassa_pss_options { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; -/// \brief Types for interfacing with the debug module -pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; -/// \brief Item to send to the debug module -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_debug_item { - pub private_type: mbedtls_pk_debug_type, - pub private_name: *const ::core::ffi::c_char, - pub private_value: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_debug_item { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_info_t { - _unused: [u8; 0], -} -/// \brief Public key container -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_context { - ///< Public key information - pub private_pk_info: *const mbedtls_pk_info_t, - ///< Underlying public key context - pub private_pk_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; -/// \brief Types for RSA-alt abstraction -pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_key_len_func = - ::core::option::Option usize>; +/// \brief The ECDSA context structure. +/// +/// \warning Performing multiple operations concurrently on the same +/// ECDSA context is not supported; objects of this type +/// should not be shared between multiple threads. +/// +/// \note pk_wrap module assumes that "ecdsa_context" is identical +/// to "ecp_keypair" (see for example structure +/// "mbedtls_eckey_info" where ECDSA sign/verify functions +/// are used also for EC key) +pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; +pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; unsafe extern "C" { - /// \brief Return information associated with the given PK type - /// - /// \param pk_type PK type to search for. + /// \brief This function checks whether a given group can be used + /// for ECDSA. /// - /// \return The PK info associated with the type or NULL if not found. - pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; -} -unsafe extern "C" { - /// \brief Initialize a #mbedtls_pk_context (as NONE). + /// \param gid The ECP group ID to check. /// - /// \param ctx The context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); + /// \return \c 1 if the group can be used, \c 0 otherwise + pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Free the components of a #mbedtls_pk_context. + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message. /// - /// \param ctx The context to clear. It must have been initialized. - /// If this is \c NULL, this function does nothing. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_ext() is usually preferred. /// - /// \note For contexts that have been set up with - /// mbedtls_pk_setup_opaque(), this does not free the underlying - /// PSA key and you still need to call psa_destroy_key() - /// independently if you want to destroy that key. - pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); -} -unsafe extern "C" { - /// \brief Initialize a PK context with the information given - /// and allocates the type-specific PK subcontext. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated + /// as defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param info Information to use + /// \see ecp.h /// - /// \return 0 on success, - /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, - /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized. + /// \param buf The content to be signed. This is usually the hash of + /// the original data to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function, used both to generate the ECDSA nonce + /// and for blinding. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. /// - /// \note For contexts holding an RSA-alt key, use - /// \c mbedtls_pk_setup_rsa_alt() instead. - pub fn mbedtls_pk_setup( - ctx: *mut mbedtls_pk_context, - info: *const mbedtls_pk_info_t, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX + /// or \c MBEDTLS_MPI_XXX error code on failure. + pub fn mbedtls_ecdsa_sign( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Initialize an RSA-alt context + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, deterministic version. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param key RSA key pointer - /// \param decrypt_func Decryption function - /// \param sign_func Signing function - /// \param key_len_func Function returning key length in bytes + /// For more information, see RFC-6979: Deterministic + /// Usage of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the - /// context wasn't already initialized as RSA_ALT. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. - pub fn mbedtls_pk_setup_rsa_alt( - ctx: *mut mbedtls_pk_context, - key: *mut ::core::ffi::c_void, - decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, - sign_func: mbedtls_pk_rsa_alt_sign_func, - key_len_func: mbedtls_pk_rsa_alt_key_len_func, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Get the size in bits of the underlying key + /// \see ecp.h /// - /// \param ctx The context to query. It must have been initialized. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + /// may be \c NULL if \p f_rng_blind doesn't need a context + /// parameter. /// - /// \return Key size in bits, or 0 on error - pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_ext( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + md_alg: mbedtls_md_type_t, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Tell if a context can do the operation given by type + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \param ctx The context to query. It must have been initialized. - /// \param type The desired type. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_restartable() is usually + /// preferred. /// - /// \return 1 if the context can do operations on the given type. - /// \return 0 if the context cannot do the operations on the given - /// type. This is always the case for a context that has - /// been initialized but not set up, or that has been - /// cleared with mbedtls_pk_free(). - pub fn mbedtls_pk_can_do( - ctx: *const mbedtls_pk_context, - type_: mbedtls_pk_type_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Verify signature (including padding if relevant). + /// \note This function is like \c mbedtls_ecdsa_sign() but + /// it can return early and restart according to the + /// limit set with \c mbedtls_ecp_set_max_ops() to + /// reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used. - /// This can be #MBEDTLS_MD_NONE if the signature algorithm - /// does not rely on a hash algorithm (non-deterministic - /// ECDSA, RSA PKCS#1 v1.5). - /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then - /// \p hash is the DigestInfo structure used by RFC 8017 - /// §9.2 steps 3–6. If \p md_alg is a valid hash - /// algorithm then \p hash is the digest itself, and this - /// function calculates the DigestInfo encoding internally. - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \see ecp.h /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) - /// to verify RSASSA_PSS signatures. - pub fn mbedtls_pk_verify( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_verify() + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_verify(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_verify(). + /// \note This function is like \c + /// mbedtls_ecdsa_sign_det_ext() but it can return + /// early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length - /// \param rs_ctx Restart context (NULL to disable restart) + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return See \c mbedtls_pk_verify(), or - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_verify_restartable( - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + /// \c NULL if \p f_rng_blind doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, - rs_ctx: *mut mbedtls_pk_restart_ctx, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify signature, with options. - /// (Includes verification of the padding depending on type.) - /// - /// \param type Signature type (inc. possible padding type) to verify - /// \param options Pointer to type-specific options, or NULL - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be - /// used for this type of signatures, - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note If hash_len is 0, then the length associated with md_alg - /// is used instead, or an error returned if it is invalid. + /// \see ecp.h /// - /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. /// - /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point - /// to a mbedtls_pk_rsassa_pss_options structure, - /// otherwise it must be NULL. Note that if - /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not - /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. - pub fn mbedtls_pk_verify_ext( - type_: mbedtls_pk_type_t, - options: *const ::core::ffi::c_void, - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature, including padding if relevant. - /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message, in a restartable manner /// - /// \return 0 on success, or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// There is no interface in the PK module to make RSASSA-PSS - /// signatures yet. + /// \see ecp.h /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify_restartable( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature given a signature type. + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, serialized as defined in RFC-4492: + /// Elliptic Curve Cryptography (ECC) Cipher Suites for + /// Transport Layer Security (TLS). /// - /// \param pk_type Signature type. - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \warning It is not thread-safe to use the same context in + /// multiple threads. /// - /// \return 0 on success, or a specific error code. + /// \note The deterministic version is used if + /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + /// information, see RFC-6979: Deterministic Usage + /// of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, - /// see #PSA_ALG_RSA_PSS for a description of PSS options used. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign_ext( - pk_type: mbedtls_pk_type_t, - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_sign() + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_sign(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_sign(). + /// \see \c mbedtls_ecdsa_write_signature() /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. + /// \note This function is like \c mbedtls_ecdsa_write_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// \param rs_ctx Restart context (NULL to disable restart) + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return See \c mbedtls_pk_sign(). + /// \return \c 0 on success. /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_sign_restartable( - ctx: *mut mbedtls_pk_context, + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_pk_restart_ctx, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Decrypt message (including padding if relevant). + /// \brief This function reads and verifies an ECDSA signature. /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param input Input to decrypt - /// \param ilen Input size - /// \param output Decrypted output - /// \param olen Decrypted message length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \see ecp.h /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_decrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Encrypt message (including padding if relevant). - /// - /// \param ctx The PK context to use. It must have been set up. - /// \param input Message to encrypt - /// \param ilen Message size - /// \param output Encrypted output - /// \param olen Encrypted output length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function reads and verifies an ECDSA signature, + /// in a restartable way. /// - /// \note \p f_rng is used for padding generation. + /// \see \c mbedtls_ecdsa_read_signature() /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \note This function is like \c mbedtls_ecdsa_read_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_encrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if a public-private pair of keys matches. - /// - /// \param pub Context holding a public key. - /// \param prv Context holding a private (and public) key. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// - /// \return \c 0 on success (keys were checked and match each other). - /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not - /// be checked - in that case they may or may not match. - /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. - /// \return Another non-zero value if the keys do not match. - pub fn mbedtls_pk_check_pair( - pub_: *const mbedtls_pk_context, - prv: *const mbedtls_pk_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Export debug information - /// - /// \param ctx The PK context to use. It must have been initialized. - /// \param items Place to write debug items + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA - pub fn mbedtls_pk_debug( - ctx: *const mbedtls_pk_context, - items: *mut mbedtls_pk_debug_item, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Access the type name - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type name on success, or "invalid PK" - pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; -} -unsafe extern "C" { - /// \brief Get the key type - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type on success. - /// \return #MBEDTLS_PK_NONE for a context that has not been set up. - pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a private key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// \param pwd Optional password for decryption. - /// Pass \c NULL if expecting a non-encrypted key. - /// Pass a string of \p pwdlen bytes if expecting an encrypted - /// key; a non-encrypted key will also be accepted. - /// The empty password is not supported. - /// \param pwdlen Size of the password in bytes. - /// Ignored if \p pwd is \c NULL. - /// \param f_rng RNG function, must not be \c NULL. Used for blinding. - /// \param p_rng RNG parameter + /// \brief This function generates an ECDSA keypair on the given curve. /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to store the keypair in. + /// This must be initialized. + /// \param gid The elliptic curve to use. One of the various + /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, - pwd: *const ::core::ffi::c_uchar, - pwdlen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_genkey( + ctx: *mut mbedtls_ecdsa_context, + gid: mbedtls_ecp_group_id, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a public key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \brief This function sets up an ECDSA context from an EC key pair. /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to setup. This must be initialized. + /// \param key The EC key to use. This must be initialized and hold + /// a private-public key pair or a public key. In the former + /// case, the ECDSA context may be used for signature creation + /// and verification after this call. In the latter case, it + /// may be used for signature verification. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_public_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_from_keypair( + ctx: *mut mbedtls_ecdsa_context, + key: *const mbedtls_ecp_keypair, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function initializes an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_key_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); } unsafe extern "C" { - /// \brief Write a public key to a SubjectPublicKeyInfo DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function frees an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_pubkey_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to free. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must be initialized. + pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); } -unsafe extern "C" { - /// \brief Write a public key to a PEM string - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_pubkey_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 PEM string - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_key_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Parse a SubjectPublicKeyInfo DER structure - /// - /// \param p the position in the ASN.1 data - /// \param end end of the buffer - /// \param pk The PK context to fill. It must have been initialized - /// but not set up. - /// - /// \return 0 if successful, or a specific PK error code - pub fn mbedtls_pk_parse_subpubkey( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - pk: *mut mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a subjectPublicKey to ASN.1 data - /// Note: function works backwards in data buffer - /// - /// \param p reference to current position pointer - /// \param start start of the buffer (for bounds-checking) - /// \param key PK context which must contain a valid public or private key. - /// - /// \return the length written or a negative error code - pub fn mbedtls_pk_write_pubkey( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - key: *const mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = - 3; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: - mbedtls_key_exchange_type_t = 4; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = - 8; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = - 9; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = - 10; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = - 11; -pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; -/// \brief This structure is used for storing ciphersuite information -/// -/// \note members are defined using integral types instead of enums -/// in order to pack structure and reduce memory usage by internal -/// \c ciphersuite_definitions[] -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ssl_ciphersuite_t { - pub private_id: ::core::ffi::c_int, - pub private_name: *const ::core::ffi::c_char, - pub private_cipher: u8, - pub private_mac: u8, - pub private_key_exchange: u8, - pub private_flags: u8, - pub private_min_tls_version: u16, - pub private_max_tls_version: u16, -} -impl Default for mbedtls_ssl_ciphersuite_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_string( - ciphersuite_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_id( - ciphersuite_id: ::core::ffi::c_int, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_pk_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_ec( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_psk( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> usize; -} -/// The type of the context passed to mbedtls_psa_external_get_random(). -/// -/// Mbed TLS initializes the context to all-bits-zero before calling -/// mbedtls_psa_external_get_random() for the first time. -/// -/// The definition of this type in the Mbed TLS source code is for -/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() -/// are expected to replace it with a custom definition. -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_external_random_context_t { - pub private_opaque: [usize; 2usize], +/// The type of the context passed to mbedtls_psa_external_get_random(). +/// +/// Mbed TLS initializes the context to all-bits-zero before calling +/// mbedtls_psa_external_get_random() for the first time. +/// +/// The definition of this type in the Mbed TLS source code is for +/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() +/// are expected to replace it with a custom definition. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_external_random_context_t { + pub private_opaque: [usize; 2usize], } pub type psa_status_t = i32; /// \brief Encoding of a key type. @@ -10579,6478 +10447,7672 @@ pub type psa_key_attributes_t = psa_key_attributes_s; /// Values of this type are generally constructed by macros called /// `PSA_KEY_DERIVATION_INPUT_xxx`. pub type psa_key_derivation_step_t = u16; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following field: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// +/// Functions that take such a structure as input also take an associated +/// input buffer \c custom_data of length \c custom_data_length. +/// +/// The interpretation of this structure and the associated \c custom_data +/// parameter depend on the type of the created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c custom_data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_custom_key_parameters_t = psa_custom_key_parameters_s; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following fields: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// - \c data: a flexible array of bytes. +/// +/// The interpretation of this structure depend on the type of the +/// created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty or if the custom production parameters are omitted +/// altogether, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_key_production_parameters_t = psa_key_production_parameters_s; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; +/// For encrypt-decrypt functions, whether the operation is an encryption +/// or a decryption. +pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; +/// \brief MD5 context structure +/// +/// \warning MD5 is considered a weak message digest and its use +/// constitutes a security risk. We recommend considering +/// stronger message digests instead. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md5_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 4usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_md5_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { - /// \brief Library initialization. - /// - /// Applications must call this function before calling any other - /// function in this module. - /// - /// Applications may call this function more than once. Once a call - /// succeeds, subsequent calls are guaranteed to succeed. + /// \brief Initialize MD5 context /// - /// If the application calls other functions before calling psa_crypto_init(), - /// the behavior is undefined. Implementations are encouraged to either perform - /// the operation as if the library had been initialized or to return - /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, - /// implementations should not return a success status if the lack of - /// initialization may have security implications, for example due to improper - /// seeding of the random number generator. + /// \param ctx MD5 context to be initialized /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - pub fn psa_crypto_init() -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Retrieve the attributes of a key. - /// - /// This function first resets the attribute structure as with - /// psa_reset_key_attributes(). It then copies the attributes of - /// the given key into the given attribute structure. - /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \brief Clear MD5 context /// - /// \param[in] key Identifier of the key to query. - /// \param[in,out] attributes On success, the attributes of the key. - /// On failure, equivalent to a - /// freshly-initialized structure. + /// \param ctx MD5 context to be cleared /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_get_key_attributes( - key: mbedtls_svc_key_id_t, - attributes: *mut psa_key_attributes_t, - ) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Reset a key attribute structure to a freshly initialized state. - /// - /// You must initialize the attribute structure as described in the - /// documentation of the type #psa_key_attributes_t before calling this - /// function. Once the structure has been initialized, you may call this - /// function at any time. + /// \brief Clone (the state of) an MD5 context /// - /// This function frees any auxiliary resources that the structure - /// may contain. + /// \param dst The destination context + /// \param src The context to be cloned /// - /// \param[in,out] attributes The attribute structure to reset. - pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); } unsafe extern "C" { - /// Remove non-essential copies of key material from memory. + /// \brief MD5 context setup /// - /// If the key identifier designates a volatile key, this functions does not do - /// anything and returns successfully. - /// - /// If the key identifier designates a persistent key, then this function will - /// free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and the key can still be used. + /// \param ctx context to be initialized /// - /// \param key Identifier of the key to purge. + /// \return 0 if successful /// - /// \retval #PSA_SUCCESS - /// The key material will have been removed from memory if it is not - /// currently required. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid key identifier. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Make a copy of a key. + /// \brief MD5 process buffer /// - /// Copy key material from one location to another. + /// \param ctx MD5 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// This function is primarily useful to copy a key from one location - /// to another, since it populates a key using the material from - /// another key which may have a different lifetime. + /// \return 0 if successful /// - /// This function may be used to share a key with a different party, - /// subject to implementation-defined restrictions on key sharing. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_update( + ctx: *mut mbedtls_md5_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 final digest /// - /// The policy on the source key must have the usage flag - /// #PSA_KEY_USAGE_COPY set. - /// This flag is sufficient to permit the copy if the key has the lifetime - /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. - /// Some secure elements do not provide a way to copy a key without - /// making it extractable from the secure element. If a key is located - /// in such a secure element, then the key must have both usage flags - /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make - /// a copy of the key outside the secure element. + /// \param ctx MD5 context + /// \param output MD5 checksum result /// - /// The resulting key may only be used in a way that conforms to - /// both the policy of the original key and the policy specified in - /// the \p attributes parameter: - /// - The usage flags on the resulting key are the bitwise-and of the - /// usage flags on the source policy and the usage flags in \p attributes. - /// - If both allow the same algorithm or wildcard-based - /// algorithm policy, the resulting key has the same algorithm policy. - /// - If either of the policies allows an algorithm and the other policy - /// allows a wildcard-based algorithm policy that includes this algorithm, - /// the resulting key allows the same algorithm. - /// - If the policies do not allow any algorithm in common, this function - /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// \return 0 if successful /// - /// The effect of this function on implementation-defined attributes is - /// implementation-defined. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_finish( + ctx: *mut mbedtls_md5_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 process data block (internal use only) /// - /// \param source_key The key to copy. It must allow the usage - /// #PSA_KEY_USAGE_COPY. If a private or secret key is - /// being copied outside of a secure element it must - /// also allow #PSA_KEY_USAGE_EXPORT. - /// \param[in] attributes The attributes for the new key. - /// They are used as follows: - /// - The key type and size may be 0. If either is - /// nonzero, it must match the corresponding - /// attribute of the source key. - /// - The key location (the lifetime and, for - /// persistent keys, the key identifier) is - /// used directly. - /// - The policy constraints (usage flags and - /// algorithm policy) are combined from - /// the source key and \p attributes so that - /// both sets of restrictions apply, as - /// described in the documentation of this function. - /// \param[out] target_key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param ctx MD5 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p source_key is invalid. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The lifetime or identifier in \p attributes are invalid, or - /// the policy constraints on the source and specified in - /// \p attributes are incompatible, or - /// \p attributes specifies a key type or key size - /// which does not match the attributes of the source key. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or - /// the source key is not exportable and its lifetime does not - /// allow copying it to the target's lifetime. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_copy_key( - source_key: mbedtls_svc_key_id_t, - attributes: *const psa_key_attributes_t, - target_key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + /// + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_internal_md5_process( + ctx: *mut mbedtls_md5_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Destroy a key. + /// \brief Output = MD5( input buffer ) /// - /// This function destroys a key from both volatile - /// memory and, if applicable, non-volatile storage. Implementations shall - /// make a best effort to ensure that the key material cannot be recovered. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output MD5 checksum result /// - /// This function also erases any metadata such as policies and frees - /// resources associated with the key. + /// \return 0 if successful /// - /// If a key is currently in use in a multipart operation, then destroying the - /// key will cause the multipart operation to fail. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \param key Identifier of the key to erase. If this is \c 0, do nothing and - /// return #PSA_SUCCESS. + /// \return 0 if successful, or 1 if the test failed /// - /// \retval #PSA_SUCCESS - /// \p key was a valid identifier and the key material that it - /// referred to has been erased. Alternatively, \p key is \c 0. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key cannot be erased because it is - /// read-only, either due to a policy or due to physical restrictions. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p key is not a valid identifier nor \c 0. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE - /// There was a failure in communication with the cryptoprocessor. - /// The key material may still be present in the cryptoprocessor. - /// \retval #PSA_ERROR_DATA_INVALID - /// This error is typically a result of either storage corruption on a - /// cleartext storage backend, or an attempt to read data that was - /// written by an incompatible version of the library. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The storage is corrupted. Implementations shall make a best effort - /// to erase key material even in this stage, however applications - /// should be aware that it may be impossible to guarantee that the - /// key material is not recoverable in such cases. - /// \retval #PSA_ERROR_CORRUPTION_DETECTED - /// An unexpected condition which is not a storage corruption or - /// a communication failure occurred. The cryptoprocessor may have - /// been compromised. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief RIPEMD-160 context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ripemd160_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 5usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_ripemd160_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief Import a key in binary format. + /// \brief Initialize RIPEMD-160 context /// - /// This function supports any output from psa_export_key(). Refer to the - /// documentation of psa_export_public_key() for the format of public keys - /// and to the documentation of psa_export_key() for the format for - /// other key types. + /// \param ctx RIPEMD-160 context to be initialized + pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clear RIPEMD-160 context /// - /// The key data determines the key size. The attributes may optionally - /// specify a key size; in this case it must match the size determined - /// from the key data. A key size of 0 in \p attributes indicates that - /// the key size is solely determined by the key data. + /// \param ctx RIPEMD-160 context to be cleared + pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clone (the state of) a RIPEMD-160 context /// - /// Implementations must reject an attempt to import a key of size 0. + /// \param dst The destination context + /// \param src The context to be cloned + pub fn mbedtls_ripemd160_clone( + dst: *mut mbedtls_ripemd160_context, + src: *const mbedtls_ripemd160_context, + ); +} +unsafe extern "C" { + /// \brief RIPEMD-160 context setup /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. - /// - /// \param[in] attributes The attributes for the new key. - /// The key size is always determined from the - /// \p data buffer. - /// If the key size in \p attributes is nonzero, - /// it must be equal to the size from \p data. - /// \param[out] key On success, an identifier to the newly created key. - /// For persistent keys, this is the key identifier - /// defined in \p attributes. - /// \c 0 on failure. - /// \param[in] data Buffer containing the key data. The content of this - /// buffer is interpreted according to the type declared - /// in \p attributes. - /// All implementations must support at least the format - /// described in the documentation - /// of psa_export_key() or psa_export_public_key() for - /// the chosen type. Implementations may allow other - /// formats, but should be conservative: implementations - /// should err on the side of rejecting content if it - /// may be erroneous (e.g. wrong type or truncated data). - /// \param data_length Size of the \p data buffer in bytes. + /// \param ctx context to be initialized /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular persistent location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key attributes, as a whole, are invalid, or - /// the key data is not correctly formatted, or - /// the size in \p attributes is nonzero and does not match the size - /// of the key data. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_import_key( - attributes: *const psa_key_attributes_t, - data: *const u8, - data_length: usize, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a key in binary format. - /// - /// The output of this function can be passed to psa_import_key() to - /// create an equivalent object. + /// \brief RIPEMD-160 process buffer /// - /// If the implementation of psa_import_key() supports other formats - /// beyond the format specified here, the output from psa_export_key() - /// must use the representation specified here, not the original - /// representation. + /// \param ctx RIPEMD-160 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// For standard key types, the output format is as follows: + /// \return 0 if successful + pub fn mbedtls_ripemd160_update( + ctx: *mut mbedtls_ripemd160_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 final digest /// - /// - For symmetric keys (including MAC keys), the format is the - /// raw bytes of the key. - /// - For DES, the key data consists of 8 bytes. The parity bits must be - /// correct. - /// - For Triple-DES, the format is the concatenation of the - /// two or three DES keys. - /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format - /// is the non-encrypted DER encoding of the representation defined by - /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. - /// ``` - /// RSAPrivateKey ::= SEQUENCE { - /// version INTEGER, -- must be 0 - /// modulus INTEGER, -- n - /// publicExponent INTEGER, -- e - /// privateExponent INTEGER, -- d - /// prime1 INTEGER, -- p - /// prime2 INTEGER, -- q - /// exponent1 INTEGER, -- d mod (p-1) - /// exponent2 INTEGER, -- d mod (q-1) - /// coefficient INTEGER, -- (inverse of q) mod p - /// } - /// ``` - /// - For elliptic curve key pairs (key types for which - /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is - /// a representation of the private value as a `ceiling(m/8)`-byte string - /// where `m` is the bit size associated with the curve, i.e. the bit size - /// of the order of the curve's coordinate field. This byte string is - /// in little-endian order for Montgomery curves (curve types - /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass - /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` - /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). - /// For Weierstrass curves, this is the content of the `privateKey` field of - /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, - /// the format is defined by RFC 7748, and output is masked according to §5. - /// For twisted Edwards curves, the private key is as defined by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For Diffie-Hellman key exchange key pairs (key types for which - /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the - /// format is the representation of the private key `x` as a big-endian byte - /// string. The length of the byte string is the private key size in bytes - /// (leading zeroes are not stripped). - /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is - /// true), the format is the same as for psa_export_public_key(). + /// \param ctx RIPEMD-160 context + /// \param output RIPEMD-160 checksum result /// - /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// \return 0 if successful + pub fn mbedtls_ripemd160_finish( + ctx: *mut mbedtls_ripemd160_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 process data block (internal use only) /// - /// \param key Identifier of the key to export. It must allow the - /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public - /// key. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. + /// \param ctx RIPEMD-160 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_internal_ripemd160_process( + ctx: *mut mbedtls_ripemd160_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a public key or the public part of a key pair in binary format. + /// \brief Output = RIPEMD-160( input buffer ) /// - /// The output of this function can be passed to psa_import_key() to - /// create an object that is equivalent to the public key. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output RIPEMD-160 checksum result /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. + /// \return 0 if successful + pub fn mbedtls_ripemd160( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// For standard key types, the output format is as follows: - /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of - /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. - /// ``` - /// RSAPublicKey ::= SEQUENCE { - /// modulus INTEGER, -- n - /// publicExponent INTEGER } -- e - /// ``` - /// - For elliptic curve keys on a twisted Edwards curve (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY - /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined - /// by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For other elliptic curve public keys (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed - /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. - /// Let `m` be the bit size associated with the curve, i.e. the bit size of - /// `q` for a curve over `F_q`. The representation consists of: - /// - The byte 0x04; - /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; - /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. - /// - For Diffie-Hellman key exchange public keys (key types for which - /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), - /// the format is the representation of the public key `y = g^x mod p` as a - /// big-endian byte string. The length of the byte string is the length of the - /// base prime `p` in bytes. + /// \return 0 if successful, or 1 if the test failed + pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha1_context { + pub work_area: [::core::ffi::c_uchar; 208usize], +} +impl Default for mbedtls_sha1_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-1 context. /// - /// Exporting a public key object or the public part of a key pair is - /// always permitted, regardless of the key's usage flags. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param key Identifier of the key to export. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key is neither a public key nor a key pair. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_public_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message. - /// - /// \note To verify the hash of a message against an - /// expected value, use psa_hash_compare() instead. + /// \brief This function clears a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\p alg). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p hash_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compute( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it is + /// not \c NULL, it must point to an initialized + /// SHA-1 context. + pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message and compare it with a - /// reference value. + /// \brief This function clones the state of a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p input_length or \p hash_length do not match the hash size for \p alg - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compare( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \param dst The SHA-1 context to clone to. This must be initialized. + /// \param src The SHA-1 context to clone from. This must be initialized. + pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); } -/// The type of the state data structure for multipart hash operations. -/// -/// Before calling any function on a hash operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_hash_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_hash_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, -/// for example: -/// \code -/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_hash_operation_init() -/// to the structure, for example: -/// \code -/// psa_hash_operation_t operation; -/// operation = psa_hash_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_hash_operation_t = psa_hash_operation_s; unsafe extern "C" { - /// Set up a multipart hash operation. - /// - /// The sequence of operations to calculate a hash (message digest) - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. - /// -# Call psa_hash_setup() to specify the algorithm. - /// -# Call psa_hash_update() zero, one or more times, passing a fragment - /// of the message each time. The hash that is calculated is the hash - /// of the concatenation of these messages in order. - /// -# To calculate the hash, call psa_hash_finish(). - /// To compare the hash with an expected value, call psa_hash_verify(). - /// - /// If an error occurs at any step after a call to psa_hash_setup(), the - /// operation will need to be reset by a call to psa_hash_abort(). The - /// application may call psa_hash_abort() at any time after the operation - /// has been initialized. + /// \brief This function starts a SHA-1 checksum calculation. /// - /// After a successful call to psa_hash_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_hash_finish() or psa_hash_verify(). - /// - A call to psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_hash_operation_t and not yet in use. - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param ctx The SHA-1 context to initialize. This must be initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a hash algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_setup( - operation: *mut psa_hash_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart hash operation. - /// - /// The application must call psa_hash_setup() before calling this function. + /// \brief This function feeds an input buffer into an ongoing SHA-1 + /// checksum calculation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] input Buffer containing the message fragment to hash. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-1 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_update( - operation: *mut psa_hash_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_update( + ctx: *mut mbedtls_sha1_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message. + /// \brief This function finishes the SHA-1 operation, and writes + /// the result to the output buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \param ctx The SHA-1 context to use. This must be initialized and + /// have a hash operation started. + /// \param output The SHA-1 checksum result. This must be a writable + /// buffer of length \c 20 Bytes. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the hash. Call psa_hash_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// hash values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the hashed data which could allow an attacker to guess - /// a valid hash and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_finish( + ctx: *mut mbedtls_sha1_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief SHA-1 process data block (internal use only). /// - /// \param[in,out] operation Active hash operation. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\c alg) where \c alg is the - /// hash algorithm that is calculated. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p hash buffer is too small. You can determine a - /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) - /// where \c alg is the hash algorithm that is calculated. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_finish( - operation: *mut psa_hash_operation_t, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to use. This must be initialized. + /// \param data The data block being processed. This must be a + /// readable buffer of length \c 64 Bytes. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha1_process( + ctx: *mut mbedtls_sha1_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-1 checksum of a buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). It then - /// compares the calculated hash with the expected hash passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// The SHA-1 result is calculated as + /// output = SHA-1(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual hash and the expected hash is performed - /// in constant time. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. + /// \param output The SHA-1 checksum result. + /// This must be a writable buffer of length \c 20 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_verify( - operation: *mut psa_hash_operation_t, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a hash operation. + /// \brief The SHA-1 checkup routine. /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_hash_setup() again. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_hash_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha256_context { + pub work_area: [::core::ffi::c_uchar; 208usize], + pub is224: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha256_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-256 context. /// - /// In particular, calling psa_hash_abort() after the operation has been - /// terminated by a call to psa_hash_abort(), psa_hash_finish() or - /// psa_hash_verify() is safe and has no effect. + /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-256 context. /// - /// \param[in,out] operation Initialized hash operation. + /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-256 context. + pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-256 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha256_clone( + dst: *mut mbedtls_sha256_context, + src: *const mbedtls_sha256_context, + ); } unsafe extern "C" { - /// Clone a hash operation. + /// \brief This function starts a SHA-224 or SHA-256 checksum + /// calculation. /// - /// This function copies the state of an ongoing hash operation to - /// a new operation object. In other words, this function is equivalent - /// to calling psa_hash_setup() on \p target_operation with the same - /// algorithm that \p source_operation was set up for, then - /// psa_hash_update() on \p target_operation with the same input that - /// that was passed to \p source_operation. After this function returns, the - /// two objects are independent, i.e. subsequent calls involving one of - /// the objects do not affect the other object. + /// \param ctx The context to use. This must be initialized. + /// \param is224 This determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// \param[in] source_operation The active hash operation to clone. - /// \param[in,out] target_operation The operation object to set up. - /// It must be initialized but not active. + /// \note is224 must be defined accordingly to the enabled + /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The \p source_operation state is not valid (it must be active), or - /// the \p target_operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_clone( - source_operation: *const psa_hash_operation_t, - target_operation: *mut psa_hash_operation_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_starts( + ctx: *mut mbedtls_sha256_context, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC (message authentication code) of a message. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-256 checksum calculation. /// - /// \note To verify the MAC of a message against an - /// expected value, use psa_mac_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_update( + ctx: *mut mbedtls_sha256_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function finishes the SHA-256 operation, and writes + /// the result to the output buffer. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p mac_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_compute( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_finish( + ctx: *mut mbedtls_sha256_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC of a message and compare it with a reference value. + /// \brief This function processes a single data block within + /// the ongoing SHA-256 computation. This function is for + /// internal use only. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \param ctx The SHA-256 context. This must be initialized. + /// \param data The buffer holding one block of data. This must + /// be a readable buffer of length \c 64 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected value. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha256_process( + ctx: *mut mbedtls_sha256_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart MAC operations. -/// -/// Before calling any function on a MAC operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_mac_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_mac_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, -/// for example: -/// \code -/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_mac_operation_init() -/// to the structure, for example: -/// \code -/// psa_mac_operation_t operation; -/// operation = psa_mac_operation_init(); -/// \endcode -/// -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Set up a multipart MAC calculation operation. + /// \brief This function calculates the SHA-224 or SHA-256 + /// checksum of a buffer. /// - /// This function sets up the calculation of the MAC - /// (message authentication code) of a byte string. - /// To verify the MAC of a message against an - /// expected value, use psa_mac_verify_setup() instead. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// The sequence of operations to calculate a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_sign_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_sign_finish() to finish - /// calculating the MAC value and retrieve it. + /// The SHA-256 result is calculated as + /// output = SHA-256(input buffer). /// - /// If an error occurs at any step after a call to psa_mac_sign_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// \param is224 Determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// After a successful call to psa_mac_sign_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_sign_finish(). - /// - A call to psa_mac_abort(). + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-224 checkup routine. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-256 checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha512_context { + pub work_area: [::core::ffi::c_uchar; 304usize], + pub is384: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha512_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Set up a multipart MAC verification operation. + /// \brief This function initializes a SHA-512 context. /// - /// This function sets up the verification of the MAC - /// (message authentication code) of a byte string against an expected value. + /// \param ctx The SHA-512 context to initialize. This must + /// not be \c NULL. + pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-512 context. /// - /// The sequence of operations to verify a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_verify_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_verify_finish() to finish - /// calculating the actual MAC of the message and verify it against - /// the expected value. + /// \param ctx The SHA-512 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must point to an initialized + /// SHA-512 context. + pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-512 context. /// - /// If an error occurs at any step after a call to psa_mac_verify_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha512_clone( + dst: *mut mbedtls_sha512_context, + src: *const mbedtls_sha512_context, + ); +} +unsafe extern "C" { + /// \brief This function starts a SHA-384 or SHA-512 checksum + /// calculation. /// - /// After a successful call to psa_mac_verify_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_verify_finish(). - /// - A call to psa_mac_abort(). + /// \param ctx The SHA-512 context to use. This must be initialized. + /// \param is384 Determines which function to use. This must be + /// either \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage - /// PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \note is384 must be defined accordingly to the enabled + /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c key is not compatible with \c alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_starts( + ctx: *mut mbedtls_sha512_context, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart MAC operation. - /// - /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() - /// before calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \brief This function feeds an input buffer into an ongoing + /// SHA-512 checksum calculation. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] input Buffer containing the message fragment to add to - /// the MAC calculation. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. This must + /// be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_update( - operation: *mut psa_mac_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_update( + ctx: *mut mbedtls_sha512_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message. - /// - /// The application must call psa_mac_sign_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). + /// \brief This function finishes the SHA-512 operation, and writes + /// the result to the output buffer. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the MAC. Call psa_mac_verify_finish() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_finish( + ctx: *mut mbedtls_sha512_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function processes a single data block within + /// the ongoing SHA-512 computation. + /// This function is for internal use only. /// - /// \param[in,out] operation Active MAC operation. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. This is always - /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of the key and \c alg is the - /// MAC algorithm that is calculated. + /// \param ctx The SHA-512 context. This must be initialized. + /// \param data The buffer holding one block of data. This + /// must be a readable buffer of length \c 128 Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p mac buffer is too small. You can determine a - /// sufficient buffer size by calling PSA_MAC_LENGTH(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac sign - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_finish( - operation: *mut psa_mac_operation_t, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha512_process( + ctx: *mut mbedtls_sha512_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-512 or SHA-384 + /// checksum of a buffer. /// - /// The application must call psa_mac_verify_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). It then - /// compares the calculated MAC with the expected MAC passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// The SHA-512 result is calculated as + /// output = SHA-512(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual MAC and the expected MAC is performed - /// in constant time. + /// \param input The buffer holding the input data. This must be + /// a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. + /// \param is384 Determines which function to use. This must be either + /// \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \note is384 must be defined accordingly with the supported + /// symbols in the config file. If: + /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + /// then the function will return + /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected MAC. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac verify - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_finish( - operation: *mut psa_mac_operation_t, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a MAC operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_mac_sign_setup() or psa_mac_verify_setup() again. + /// \brief The SHA-384 checkup routine. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_mac_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-512 checkup routine. /// - /// In particular, calling psa_mac_abort() after the operation has been - /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or - /// psa_mac_verify_finish() is safe and has no effect. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +///< Operation not defined. +pub const mbedtls_sha3_id_MBEDTLS_SHA3_NONE: mbedtls_sha3_id = 0; +///< SHA3-224 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_224: mbedtls_sha3_id = 1; +///< SHA3-256 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_256: mbedtls_sha3_id = 2; +///< SHA3-384 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_384: mbedtls_sha3_id = 3; +///< SHA3-512 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_512: mbedtls_sha3_id = 4; +/// SHA-3 family id. +/// +/// It identifies the family (SHA3-256, SHA3-512, etc.) +pub type mbedtls_sha3_id = ::core::ffi::c_uint; +/// \brief The SHA-3 context structure. +/// +/// The structure is used SHA-3 checksum calculations. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_sha3_context { + pub private_state: [u64; 25usize], + pub private_index: u32, + pub private_olen: u16, + pub private_max_block_size: u16, +} +unsafe extern "C" { + /// \brief This function initializes a SHA-3 context. /// - /// \param[in,out] operation Initialized MAC operation. + /// \param ctx The SHA-3 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha3_init(ctx: *mut mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-3 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; + /// \param ctx The SHA-3 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-3 context. + pub fn mbedtls_sha3_free(ctx: *mut mbedtls_sha3_context); } unsafe extern "C" { - /// Encrypt a message using a symmetric cipher. + /// \brief This function clones the state of a SHA-3 context. /// - /// This function encrypts a message with a random IV (initialization - /// vector). Use the multipart operation interface with a - /// #psa_cipher_operation_t object to provide other forms of IV. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha3_clone(dst: *mut mbedtls_sha3_context, src: *const mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function starts a SHA-3 checksum + /// calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// The output contains the IV followed by - /// the ciphertext proper. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The context to use. This must be initialized. + /// \param id The id of the SHA-3 family. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_starts( + ctx: *mut mbedtls_sha3_context, + id: mbedtls_sha3_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Decrypt a message using a symmetric cipher. - /// - /// This function decrypts a message encrypted with a symmetric cipher. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-3 checksum calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to decrypt. - /// This consists of the IV followed by the - /// ciphertext proper. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the plaintext is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_update( + ctx: *mut mbedtls_sha3_context, input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + ilen: usize, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart cipher operations. -/// -/// Before calling any function on a cipher operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_cipher_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_cipher_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, -/// for example: -/// \code -/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_cipher_operation_init() -/// to the structure, for example: -/// \code -/// psa_cipher_operation_t operation; -/// operation = psa_cipher_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// Set the key for a multipart symmetric encryption operation. + /// \brief This function finishes the SHA-3 operation, and writes + /// the result to the output buffer. /// - /// The sequence of operations to encrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. - /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to - /// generate or set the IV (initialization vector). You should use - /// psa_cipher_generate_iv() unless the protocol you are implementing - /// requires a specific IV value. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. /// - /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_finish( + ctx: *mut mbedtls_sha3_context, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function calculates the SHA-3 + /// checksum of a buffer. /// - /// After a successful call to psa_cipher_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// The SHA-3 result is calculated as + /// output = SHA-3(id, input buffer, d). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \param id The id of the SHA-3 family. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3( + id: mbedtls_sha3_id, + input: *const u8, + ilen: usize, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart symmetric decryption operation. + /// \brief Checkup routine for the algorithms implemented + /// by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. /// - /// The sequence of operations to decrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. - /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the - /// decryption. If the IV is prepended to the ciphertext, you can call - /// psa_cipher_update() on a buffer containing the IV followed by the - /// beginning of the message. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). - /// - /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_cipher_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). - /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if the test failed. + pub fn mbedtls_sha3_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// Generate an IV for a symmetric encryption operation. - /// - /// This function generates a random IV (initialization vector), nonce - /// or initial counter value for the encryption operation as appropriate - /// for the chosen algorithm, key type and key size. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] iv Buffer where the generated IV is to be written. - /// \param iv_size Size of the \p iv buffer in bytes. - /// \param[out] iv_length On success, the number of bytes of the - /// generated IV. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p iv buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no IV set), - /// or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_generate_iv( - operation: *mut psa_cipher_operation_t, - iv: *mut u8, - iv_size: usize, - iv_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hash_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// Set the IV for a symmetric encryption or decryption operation. - /// - /// This function sets the IV (initialization vector), nonce - /// or initial counter value for the encryption or decryption operation. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \note When encrypting, applications should use psa_cipher_generate_iv() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] iv Buffer containing the IV to use. - /// \param iv_length Size of the IV in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p iv is not acceptable for the chosen algorithm, - /// or the chosen algorithm does not use an IV. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active cipher - /// encrypt operation, with no IV set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_set_iv( - operation: *mut psa_cipher_operation_t, - iv: *const u8, - iv_length: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub md5: mbedtls_md5_context, + pub ripemd160: mbedtls_ripemd160_context, + pub sha1: mbedtls_sha1_context, + pub sha256: mbedtls_sha256_context, + pub sha512: mbedtls_sha512_context, } -unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active cipher operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() - /// (recommended when encrypting) or psa_cipher_set_iv(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_update( - operation: *mut psa_cipher_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Finish encrypting or decrypting a message in a cipher operation. - /// - /// The application must call psa_cipher_encrypt_setup() or - /// psa_cipher_decrypt_setup() before calling this function. The choice - /// of setup function determines whether this function encrypts or - /// decrypts its input. - /// - /// This function finishes the encryption or decryption of the message - /// formed by concatenating the inputs passed to preceding calls to - /// psa_cipher_update(). - /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input size passed to this operation is not valid for - /// this particular algorithm. For example, the algorithm is a based - /// on block cipher and requires a whole number of blocks, but the - /// total input size is not a multiple of the block size. - /// \retval #PSA_ERROR_INVALID_PADDING - /// This is a decryption operation for an algorithm that includes - /// padding, and the ciphertext does not contain valid padding. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_finish( - operation: *mut psa_cipher_operation_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_cipher_operation_t { + pub private_alg: psa_algorithm_t, + pub private_iv_length: u8, + pub private_block_length: u8, + pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_cipher: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_cipher_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_hash_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_hash_operation_t, +} +impl Default for psa_driver_hash_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_cipher_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, +} +impl Default for psa_driver_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hash_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h. + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. the driver context is not active, in use). + pub private_id: ::core::ffi::c_uint, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_hash_context_t, +} +impl Default for psa_hash_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_cipher_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_default_iv_length: u8, + pub private_ctx: psa_driver_cipher_context_t, +} +impl Default for psa_cipher_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_cipher_operation_s { + #[inline] + pub fn private_iv_required(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_iv_required: ::core::ffi::c_uint, + private_iv_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; + private_iv_required as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; + private_iv_set as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The GCM context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_gcm_context { + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, + ///< Precalculated HTable. + pub private_H: [[u64; 2usize]; 16usize], + ///< The total length of the encrypted data. + pub private_len: u64, + ///< The total length of the additional data. + pub private_add_len: u64, + ///< The first ECTR for tag. + pub private_base_ectr: [::core::ffi::c_uchar; 16usize], + ///< The Y working value. + pub private_y: [::core::ffi::c_uchar; 16usize], + ///< The buf working value. + pub private_buf: [::core::ffi::c_uchar; 16usize], + ///< The operation to perform: + ///#MBEDTLS_GCM_ENCRYPT or + ///#MBEDTLS_GCM_DECRYPT. + pub private_mode: ::core::ffi::c_uchar, + ///< The acceleration to use. + pub private_acceleration: ::core::ffi::c_uchar, +} +impl Default for mbedtls_gcm_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Abort a cipher operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. - /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_cipher_operation_t. - /// - /// In particular, calling psa_cipher_abort() after the operation has been - /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() - /// is safe and has no effect. + /// \brief This function initializes the specified GCM context, + /// to make references valid, and prepares the context + /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). /// - /// \param[in,out] operation Initialized cipher operation. + /// The function does not bind the GCM context to a particular + /// cipher, nor set the key. For this purpose, use + /// mbedtls_gcm_setkey(). /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; + /// \param ctx The GCM context to initialize. This must not be \c NULL. + pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Process an authenticated encryption operation. + /// \brief This function associates a GCM context with a + /// cipher algorithm and a key. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that will be authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] plaintext Data that will be authenticated and - /// encrypted. - /// \param plaintext_length Size of \p plaintext in bytes. - /// \param[out] ciphertext Output buffer for the authenticated and - /// encrypted data. The additional data is not - /// part of this output. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate outputs, the - /// authentication tag is appended to the - /// encrypted data. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p plaintext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p - /// plaintext_length) evaluates to the maximum - /// ciphertext size of any supported AEAD - /// encryption. - /// \param[out] ciphertext_length On success, the size of the output - /// in the \p ciphertext buffer. + /// \param ctx The GCM context. This must be initialized. + /// \param cipher The 128-bit block cipher to use. + /// \param key The encryption key. This must be a readable buffer of at + /// least \p keybits bits. + /// \param keybits The key size in bits. Valid options are: + ///
          • 128 bits
            • + ///
          • 192 bits
            • + ///
          • 256 bits
          /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p ciphertext_size is too small. - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p plaintext_length) or - /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - plaintext: *const u8, - plaintext_length: usize, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_gcm_setkey( + ctx: *mut mbedtls_gcm_context, + cipher: mbedtls_cipher_id_t, + key: *const ::core::ffi::c_uchar, + keybits: ::core::ffi::c_uint, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Process an authenticated decryption operation. + /// \brief This function performs GCM encryption or decryption of a buffer. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that has been authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] ciphertext Data that has been authenticated and - /// encrypted. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate inputs, the buffer - /// must contain the encrypted data followed - /// by the authentication tag. - /// \param ciphertext_length Size of \p ciphertext in bytes. - /// \param[out] plaintext Output buffer for the decrypted data. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p ciphertext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p - /// ciphertext_length) evaluates to the maximum - /// plaintext size of any supported AEAD - /// decryption. - /// \param[out] plaintext_length On success, the size of the output - /// in the \p plaintext buffer. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The ciphertext is not authentic. - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p plaintext_size is too small. - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p ciphertext_length) or - /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used - /// to determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - ciphertext: *const u8, - ciphertext_length: usize, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - ) -> psa_status_t; + /// \warning When this function performs a decryption, it outputs the + /// authentication tag and does not verify that the data is + /// authentic. You should use this function to perform encryption + /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// + /// \param ctx The GCM context to use for encryption or decryption. This + /// must be initialized. + /// \param mode The operation to perform: + /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + /// The ciphertext is written to \p output and the + /// authentication tag is written to \p tag. + /// - #MBEDTLS_GCM_DECRYPT to perform decryption. + /// The plaintext is written to \p output and the + /// authentication tag is written to \p tag. + /// Note that this mode is not recommended, because it does + /// not verify the authenticity of the data. For this reason, + /// you should use mbedtls_gcm_auth_decrypt() instead of + /// calling this function in decryption mode. + /// \param length The length of the input data, which is equal to the length + /// of the output data. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param input The buffer holding the input data. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size in Bytes. + /// \param output The buffer for holding the output data. If \p length is greater + /// than zero, this must be a writable buffer of at least that + /// size in Bytes. + /// \param tag_len The length of the tag to generate. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// + /// \return \c 0 if the encryption or decryption was performed + /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + /// this does not indicate that the data is authentic. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the encryption + /// or decryption failed. + pub fn mbedtls_gcm_crypt_and_tag( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + tag_len: usize, + tag: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart AEAD operations. -/// -/// Before calling any function on an AEAD operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_aead_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_aead_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, -/// for example: -/// \code -/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_aead_operation_init() -/// to the structure, for example: -/// \code -/// psa_aead_operation_t operation; -/// operation = psa_aead_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// Set the key for a multipart authenticated encryption operation. + /// \brief This function performs a GCM authenticated decryption of a + /// buffer. /// - /// The sequence of operations to encrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to - /// generate or set the nonce. You should use - /// psa_aead_generate_nonce() unless the protocol you are implementing - /// requires a specific nonce value. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the message to encrypt each time. - /// -# Call psa_aead_finish(). - /// - /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_finish(). - /// - A call to psa_aead_abort(). + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param length The length of the ciphertext to decrypt, which is also + /// the length of the decrypted plaintext. + /// \param iv The initialization vector. This must be a readable buffer + /// of at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param tag The buffer holding the tag to verify. This must be a + /// readable buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to verify. + /// \param input The buffer holding the ciphertext. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size. + /// \param output The buffer for holding the decrypted plaintext. If \p length + /// is greater than zero, this must be a writable buffer of at + /// least that size. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 if successful and authenticated. + /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the decryption + /// failed. + pub fn mbedtls_gcm_auth_decrypt( + ctx: *mut mbedtls_gcm_context, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + tag: *const ::core::ffi::c_uchar, + tag_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart authenticated decryption operation. - /// - /// The sequence of operations to decrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call psa_aead_set_nonce() with the nonce for the decryption. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the ciphertext to decrypt each time. - /// -# Call psa_aead_verify(). - /// - /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_verify(). - /// - A call to psa_aead_abort(). + /// \brief This function starts a GCM encryption or decryption + /// operation. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + /// #MBEDTLS_GCM_DECRYPT. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_starts( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Generate a random nonce for an authenticated encryption operation. - /// - /// This function generates a random nonce for the authenticated encryption - /// operation with an appropriate size for the chosen algorithm, key type - /// and key size. - /// - /// The application must call psa_aead_encrypt_setup() before - /// calling this function. + /// \brief This function feeds an input buffer as associated data + /// (authenticated but not encrypted data) in a GCM + /// encryption or decryption operation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// Call this function after mbedtls_gcm_starts() to pass + /// the associated data. If the associated data is empty, + /// you do not need to call this function. You may not + /// call this function after calling mbedtls_cipher_update(). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] nonce Buffer where the generated nonce is to be - /// written. - /// \param nonce_size Size of the \p nonce buffer in bytes. - /// \param[out] nonce_length On success, the number of bytes of the - /// generated nonce. + /// \param ctx The GCM context. This must have been started with + /// mbedtls_gcm_starts() and must not have yet received + /// any input with mbedtls_gcm_update(). + /// \param add The buffer holding the additional data, or \c NULL + /// if \p add_len is \c 0. + /// \param add_len The length of the additional data. If \c 0, + /// \p add may be \c NULL. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p nonce buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active aead encrypt - /// operation, with no nonce set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_generate_nonce( - operation: *mut psa_aead_operation_t, - nonce: *mut u8, - nonce_size: usize, - nonce_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_update_ad( + ctx: *mut mbedtls_gcm_context, + add: *const ::core::ffi::c_uchar, + add_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the nonce for an authenticated encryption or decryption operation. + /// \brief This function feeds an input buffer into an ongoing GCM + /// encryption or decryption operation. /// - /// This function sets the nonce for the authenticated - /// encryption or decryption operation. + /// You may call this function zero, one or more times + /// to pass successive parts of the input: the plaintext to + /// encrypt, or the ciphertext (not including the tag) to + /// decrypt. After the last part of the input, call + /// mbedtls_gcm_finish(). /// - /// The application must call psa_aead_encrypt_setup() or - /// psa_aead_decrypt_setup() before calling this function. + /// This function may produce output in one of the following + /// ways: + /// - Immediate output: the output length is always equal + /// to the input length. + /// - Buffered output: the output consists of a whole number + /// of 16-byte blocks. If the total input length so far + /// (not including associated data) is 16 \* *B* + *A* + /// with *A* < 16 then the total output length is 16 \* *B*. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// In particular: + /// - It is always correct to call this function with + /// \p output_size >= \p input_length + 15. + /// - If \p input_length is a multiple of 16 for all the calls + /// to this function during an operation, then it is + /// correct to use \p output_size = \p input_length. /// - /// \note When encrypting, applications should use psa_aead_generate_nonce() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] nonce Buffer containing the nonce to use. - /// \param nonce_length Size of the nonce in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param input The buffer holding the input data. If \p input_length + /// is greater than zero, this must be a readable buffer + /// of at least \p input_length bytes. + /// \param input_length The length of the input data in bytes. + /// \param output The buffer for the output data. If \p output_size + /// is greater than zero, this must be a writable buffer of + /// of at least \p output_size bytes. + /// \param output_size The size of the output buffer in bytes. + /// See the function description regarding the output size. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p nonce is not acceptable for the chosen algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no nonce - /// set), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_nonce( - operation: *mut psa_aead_operation_t, - nonce: *const u8, - nonce_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// total input length too long, + /// unsupported input/output buffer overlap detected, + /// or \p output_size too small. + pub fn mbedtls_gcm_update( + ctx: *mut mbedtls_gcm_context, + input: *const ::core::ffi::c_uchar, + input_length: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Declare the lengths of the message and additional data for AEAD. - /// - /// The application must call this function before calling - /// psa_aead_update_ad() or psa_aead_update() if the algorithm for - /// the operation requires it. If the algorithm does not require it, - /// calling this function is optional, but if this function is called - /// then the implementation must enforce the lengths. - /// - /// You may call this function before or after setting the nonce with - /// psa_aead_set_nonce() or psa_aead_generate_nonce(). - /// - /// - For #PSA_ALG_CCM, calling this function is required. - /// - For the other AEAD algorithms defined in this specification, calling - /// this function is not required. - /// - For vendor-defined algorithm, refer to the vendor documentation. + /// \brief This function finishes the GCM operation and generates + /// the authentication tag. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// It wraps up the GCM stream, and generates the + /// tag. The tag can have a maximum length of 16 Bytes. /// - /// \param[in,out] operation Active AEAD operation. - /// \param ad_length Size of the non-encrypted additional - /// authenticated data in bytes. - /// \param plaintext_length Size of the plaintext to encrypt in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to generate. This must be at least + /// four. + /// \param output The buffer for the final output. + /// If \p output_size is nonzero, this must be a writable + /// buffer of at least \p output_size bytes. + /// \param output_size The size of the \p output buffer in bytes. + /// This must be large enough for the output that + /// mbedtls_gcm_update() has not produced. In particular: + /// - If mbedtls_gcm_update() produces immediate output, + /// or if the total input size is a multiple of \c 16, + /// then mbedtls_gcm_finish() never produces any output, + /// so \p output_size can be \c 0. + /// - \p output_size never needs to be more than \c 15. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// At least one of the lengths is not acceptable for the chosen - /// algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and - /// psa_aead_update_ad() and psa_aead_update() must not have been - /// called yet), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_lengths( - operation: *mut psa_aead_operation_t, - ad_length: usize, - plaintext_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// invalid value of \p tag_len, + /// or \p output_size too small. + pub fn mbedtls_gcm_finish( + ctx: *mut mbedtls_gcm_context, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + tag: *mut ::core::ffi::c_uchar, + tag_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Pass additional data to an active AEAD operation. - /// - /// Additional data is authenticated, but not encrypted. - /// - /// You may call this function multiple times to pass successive fragments - /// of the additional data. You may not call this function after passing - /// data to encrypt or decrypt with psa_aead_update(). - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, - /// treat the input as untrusted and prepare to undo any action that - /// depends on the input if psa_aead_verify() returns an error status. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the fragment of - /// additional data. - /// \param input_length Size of the \p input buffer in bytes. + /// \brief This function clears a GCM context and the underlying + /// cipher sub-context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input length overflows the additional data length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, have lengths set if required by the algorithm, and - /// psa_aead_update() must not have been called yet), or the library - /// has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update_ad( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The GCM context to clear. If this is \c NULL, the call has + /// no effect. Otherwise, this must be initialized. + pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active AEAD operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// 3. Call psa_aead_update_ad() to pass all the additional data. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: - /// - Do not use the output in any way other than storing it in a - /// confidential location. If you take any action that depends - /// on the tentative decrypted data, this action will need to be - /// undone if the input turns out not to be valid. Furthermore, - /// if an adversary can observe that this action took place - /// (for example through timing), they may be able to use this - /// fact as an oracle to decrypt any message encrypted with the - /// same key. - /// - In particular, do not copy the output anywhere but to a - /// memory or storage space that you have exclusive access to. - /// - /// This function does not require the input to be aligned to any - /// particular block boundary. If the implementation can only process - /// a whole block at a time, it must consume all the input provided, but - /// it may delay the end of the corresponding output until a subsequent - /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() - /// provides sufficient input. The amount of data that can be delayed - /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, - /// \c alg, \p input_length) where - /// \c key_type is the type of key and \c alg is - /// the algorithm that were used to set up the - /// operation. - /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p - /// input_length) evaluates to the maximum - /// output size of any supported AEAD - /// algorithm. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// \brief The GCM checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or - /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total input length overflows the plaintext length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, and have lengths set if required by the algorithm), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hmac_operation_t { + /// The HMAC algorithm in use + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + /// The hash context. + pub hash_ctx: psa_hash_operation_s, + /// The HMAC part of the context. + pub private_opad: [u8; 128usize], +} +impl Default for mbedtls_psa_hmac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_mac_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_hmac: mbedtls_psa_hmac_operation_t, + pub private_cmac: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_mac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_aead_operation_t { + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_tag_length: u8, + pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub private_ccm: mbedtls_ccm_context, + pub private_gcm: mbedtls_gcm_context, + pub private_chachapoly: mbedtls_chachapoly_context, +} +impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_aead_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl mbedtls_psa_aead_operation_t { + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_sign_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_verify_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +///< Client +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; +///< Server +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; +///< Undefined +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_NONE: mbedtls_ecjpake_role = 2; +/// Roles in the EC J-PAKE exchange +pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; +/// EC J-PAKE context structure. +/// +/// J-PAKE is a symmetric protocol, except for the identifiers used in +/// Zero-Knowledge Proofs, and the serialization of the second message +/// (KeyExchange) as defined by the Thread spec. +/// +/// In order to benefit from this symmetry, we choose a different naming +/// convention from the Thread v1.0 spec. Correspondence is indicated in the +/// description as a pair C: client name, S: server name +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecjpake_context { + ///< Hash to use + pub private_md_type: mbedtls_md_type_t, + ///< Elliptic curve + pub private_grp: mbedtls_ecp_group, + ///< Are we client or server? + pub private_role: mbedtls_ecjpake_role, + ///< Format for point export + pub private_point_format: ::core::ffi::c_int, + ///< My public key 1 C: X1, S: X3 + pub private_Xm1: mbedtls_ecp_point, + ///< My public key 2 C: X2, S: X4 + pub private_Xm2: mbedtls_ecp_point, + ///< Peer public key 1 C: X3, S: X1 + pub private_Xp1: mbedtls_ecp_point, + ///< Peer public key 2 C: X4, S: X2 + pub private_Xp2: mbedtls_ecp_point, + ///< Peer public key C: Xs, S: Xc + pub private_Xp: mbedtls_ecp_point, + ///< My private key 1 C: x1, S: x3 + pub private_xm1: mbedtls_mpi, + ///< My private key 2 C: x2, S: x4 + pub private_xm2: mbedtls_mpi, + ///< Pre-shared secret (passphrase) + pub private_s: mbedtls_mpi, +} +impl Default for mbedtls_ecjpake_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Finish encrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_encrypt_setup(). + /// \brief Initialize an ECJPAKE context. /// - /// This function finishes the authentication of the additional data - /// formed by concatenating the inputs passed to preceding calls to - /// psa_aead_update_ad() with the plaintext formed by concatenating the - /// inputs passed to preceding calls to psa_aead_update(). + /// \param ctx The ECJPAKE context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Set up an ECJPAKE context for use. /// - /// This function has two output buffers: - /// - \p ciphertext contains trailing ciphertext that was buffered from - /// preceding calls to psa_aead_update(). - /// - \p tag contains the authentication tag. + /// \note Currently the only values for hash/curve allowed by the + /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to set up. This must be initialized. + /// \param role The role of the caller. This must be either + /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + /// \param hash The identifier of the hash function to use, + /// for example #MBEDTLS_MD_SHA256. + /// \param curve The identifier of the elliptic curve to use, + /// for example #MBEDTLS_ECP_DP_SECP256R1. + /// \param secret The pre-shared secret (passphrase). This must be + /// a readable not empty buffer of length \p len Bytes. It need + /// only be valid for the duration of this call. + /// \param len The length of the pre-shared secret \p secret. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] ciphertext Buffer where the last part of the ciphertext - /// is to be written. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] ciphertext_length On success, the number of bytes of - /// returned ciphertext. - /// \param[out] tag Buffer where the authentication tag is - /// to be written. - /// \param tag_size Size of the \p tag buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c - /// key_type, \c key_bits, \c alg) where - /// \c key_type and \c key_bits are the type and - /// bit-size of the key, and \c alg is the - /// algorithm that were used in the call to - /// psa_aead_encrypt_setup(). - /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the - /// maximum tag size of any supported AEAD - /// algorithm. - /// \param[out] tag_length On success, the number of bytes - /// that make up the returned tag. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p ciphertext or \p tag buffer is too small. - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the - /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, - /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to - /// determine the required \p tag buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active encryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_finish( - operation: *mut psa_aead_operation_t, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - tag: *mut u8, - tag_size: usize, - tag_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_setup( + ctx: *mut mbedtls_ecjpake_context, + role: mbedtls_ecjpake_role, + hash: mbedtls_md_type_t, + curve: mbedtls_ecp_group_id, + secret: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish authenticating and decrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_decrypt_setup(). - /// - /// This function finishes the authenticated decryption of the message - /// components: + /// \brief Set the point format for future reads and writes. /// - /// - The additional data consisting of the concatenation of the inputs - /// passed to preceding calls to psa_aead_update_ad(). - /// - The ciphertext consisting of the concatenation of the inputs passed to - /// preceding calls to psa_aead_update(). - /// - The tag passed to this function call. + /// \param ctx The ECJPAKE context to configure. + /// \param point_format The point format to use: + /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + /// or #MBEDTLS_ECP_PF_COMPRESSED. /// - /// If the authentication tag is correct, this function outputs any remaining - /// plaintext and reports success. If the authentication tag is not correct, - /// this function returns #PSA_ERROR_INVALID_SIGNATURE. + /// \return \c 0 if successful. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + /// is invalid. + pub fn mbedtls_ecjpake_set_point_format( + ctx: *mut mbedtls_ecjpake_context, + point_format: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if an ECJPAKE context is ready for use. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to check. This must be + /// initialized. /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual tag and the expected tag is performed - /// in constant time. + /// \return \c 0 if the context is ready for use. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] plaintext Buffer where the last part of the plaintext - /// is to be written. This is the remaining data - /// from previous calls to psa_aead_update() - /// that could not be processed until the end - /// of the input. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] plaintext_length On success, the number of bytes of - /// returned plaintext. - /// \param[in] tag Buffer containing the authentication tag. - /// \param tag_length Size of the \p tag buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be + /// initialized and set up. + /// \param buf The buffer to write the contents to. This must be a + /// writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number + /// of Bytes written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculations were successful, but the authentication tag is - /// not correct. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p plaintext buffer is too small. - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the - /// required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active decryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_verify( - operation: *mut psa_aead_operation_t, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - tag: *const u8, - tag_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort an AEAD operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// \brief Read and process the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_aead_operation_t. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up. + /// \param buf The buffer holding the first round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// In particular, calling psa_aead_abort() after the operation has been - /// terminated by a call to psa_aead_abort(), psa_aead_finish() or - /// psa_aead_verify() is safe and has no effect. + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \param[in,out] operation Initialized AEAD operation. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up, and already have performed round one. + /// \param buf The buffer to write the round two contents to. + /// This must be a writable buffer of length \p len Bytes. + /// \param len The size of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a message with a private key. For hash-and-sign algorithms, - /// this includes the hashing step. + /// \brief Read and process the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \note To perform a multi-part hash-and-sign signature algorithm, first use - /// a multi-part hash operation and then pass the resulting hash to - /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the - /// hash algorithm to use. - /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The input message to sign. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param[in] signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up and already have performed round one. + /// \param buf The buffer holding the second round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a message with a public key, using - /// a hash-and-sign verification algorithm. - /// - /// \note To perform a multi-part hash-and-sign signature verification - /// algorithm, first use a multi-part hash operation to hash the message - /// and then pass the resulting hash to psa_verify_hash(). - /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm - /// to use. + /// \brief Derive the shared secret + /// (TLS: Pre-Master Secret). /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The message whose signature is to be verified. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer containing the signature to verify. - /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed signature - /// is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_derive_secret( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a hash or short message with a private key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief Write the shared key material to be passed to a Key + /// Derivation Function as described in RFC8236. /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. - /// \param[out] signature_length On success, the number of bytes - /// that make up the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_shared_key( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a hash or short message using a public key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief This clears an ECJPAKE context and frees any + /// embedded data structure. /// - /// \param key Identifier of the key to use for the operation. It - /// must be a public key or an asymmetric key pair. The - /// key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message whose signature is to be - /// verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to free. This may be \c NULL, + /// in which case this function does nothing. If it is not + /// \c NULL, it must point to an initialized ECJPAKE context. + pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \retval #PSA_SUCCESS - /// The signature is valid. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief Encrypt a short message with a public key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the encrypted message is to - /// be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_pake_operation_t { + pub private_alg: psa_algorithm_t, + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_role: mbedtls_ecjpake_role, + pub private_buffer: [u8; 336usize], + pub private_buffer_length: usize, + pub private_buffer_offset: usize, + pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// \brief Decrypt a short message with a private key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. It must - /// allow the usage #PSA_KEY_USAGE_DECRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_jpake: mbedtls_ecjpake_context, } -/// The type of the state data structure for key derivation operations. -/// -/// Before calling any function on a key derivation operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_key_derivation_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, -/// for example: -/// \code -/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_key_derivation_operation_init() -/// to the structure, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// operation = psa_key_derivation_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_key_derivation_operation_t = psa_key_derivation_s; -unsafe extern "C" { - /// Set up a key derivation operation. - /// - /// A key derivation algorithm takes some inputs and uses them to generate - /// a byte stream in a deterministic way. - /// This byte stream can be used to produce keys and other - /// cryptographic material. - /// - /// To derive a key: - /// -# Start with an initialized object of type #psa_key_derivation_operation_t. - /// -# Call psa_key_derivation_setup() to select the algorithm. - /// -# Provide the inputs for the key derivation by calling - /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() - /// as appropriate. Which inputs are needed, in what order, and whether - /// they may be keys and if so of what type depends on the algorithm. - /// -# Optionally set the operation's maximum capacity with - /// psa_key_derivation_set_capacity(). You may do this before, in the middle - /// of or after providing inputs. For some algorithms, this step is mandatory - /// because the output depends on the maximum capacity. - /// -# To derive a key, call psa_key_derivation_output_key(). - /// To derive a byte string for a different purpose, call - /// psa_key_derivation_output_bytes(). - /// Successive calls to these functions use successive output bytes - /// calculated by the key derivation algorithm. - /// -# Clean up the key derivation operation object with - /// psa_key_derivation_abort(). - /// - /// If this function returns an error, the key derivation operation object is - /// not changed. - /// - /// If an error occurs at any step after a call to psa_key_derivation_setup(), - /// the operation will need to be reset by a call to psa_key_derivation_abort(). - /// - /// Implementations must reject an attempt to derive a key of size 0. - /// - /// \param[in,out] operation The key derivation operation object - /// to set up. It must - /// have been initialized but not set up yet. - /// \param alg The key derivation algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c alg is not a key derivation algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_setup( - operation: *mut psa_key_derivation_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Retrieve the current capacity of a key derivation operation. - /// - /// The capacity of a key derivation is the maximum number of bytes that it can - /// return. When you get *N* bytes of output from a key derivation operation, - /// this reduces its capacity by *N*. - /// - /// \param[in] operation The operation to query. - /// \param[out] capacity On success, the capacity of the operation. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_get_capacity( - operation: *const psa_key_derivation_operation_t, - capacity: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Set the maximum capacity of a key derivation operation. - /// - /// The capacity of a key derivation operation is the maximum number of bytes - /// that the key derivation operation can return from this point onwards. - /// - /// \param[in,out] operation The key derivation operation object to modify. - /// \param capacity The new capacity of the operation. - /// It must be less or equal to the operation's - /// current capacity. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p capacity is larger than the operation's current capacity. - /// In this case, the operation object remains valid and its capacity - /// remains unchanged. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_set_capacity( - operation: *mut psa_key_derivation_operation_t, - capacity: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_mac_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_mac_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function passes direct inputs, which is usually correct for - /// non-secret inputs. To pass a secret input, which should be in a key - /// object, call psa_key_derivation_input_key() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] data Input data to use. - /// \param data_length Size of the \p data buffer in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow direct inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_bytes( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - data: *const u8, - data_length: usize, - ) -> psa_status_t; +impl Default for psa_driver_mac_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Provide a numeric input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// However, when an algorithm requires a particular order, numeric inputs - /// usually come first as they tend to be configuration parameters. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function is used for inputs which are fixed-size non-negative - /// integers. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] value The value of the numeric input. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow numeric inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_integer( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - value: u64, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_aead_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_aead_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation in the form of a key. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function obtains input from a key object, which is usually correct for - /// secret inputs or for non-secret personalization strings kept in the key - /// store. To pass a non-secret parameter which is not in the key store, - /// call psa_key_derivation_input_bytes() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param key Identifier of the key. It must have an - /// appropriate type for step and must allow the - /// usage #PSA_KEY_USAGE_DERIVE or - /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) - /// and the algorithm used by the operation. - /// - /// \note Once all inputs steps are completed, the operations will allow: - /// - psa_key_derivation_output_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_output_key() if the input for step - /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD - /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was - /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_verify_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; - /// - psa_key_derivation_verify_key() under the same conditions as - /// psa_key_derivation_verify_bytes(). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key allows neither #PSA_KEY_USAGE_DERIVE nor - /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this - /// algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow key inputs of the given type - /// or does not allow key inputs at all. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_key( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - key: mbedtls_svc_key_id_t, - ) -> psa_status_t; +impl Default for psa_driver_aead_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Perform a key agreement and use the shared secret as input to a key - /// derivation. - /// - /// A key agreement algorithm takes two inputs: a private key \p private_key - /// a public key \p peer_key. - /// The result of this function is passed as input to a key derivation. - /// The output of this key derivation can be extracted by reading from the - /// resulting operation to produce keys and other cryptographic material. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() with a - /// key agreement and derivation algorithm - /// \c alg (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true - /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) - /// is false). - /// The operation must be ready for an - /// input of the type given by \p step. - /// \param step Which step the input data is for. - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. The peer key must be in the - /// same format that psa_import_key() accepts for the - /// public key type corresponding to the type of - /// private_key. That is, this function performs the - /// equivalent of - /// #psa_import_key(..., - /// `peer_key`, `peer_key_length`) where - /// with key attributes indicating the public key - /// type corresponding to the type of `private_key`. - /// For example, for EC keys, this means that peer_key - /// is interpreted as a point on the curve that the - /// private key is on. The standard formats for public - /// keys are documented in the documentation of - /// psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_sign_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, +} +impl Default for psa_driver_sign_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_verify_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, +} +impl Default for psa_driver_verify_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_pake_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_pake_operation_t, +} +impl Default for psa_driver_pake_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_mac_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_mac_size: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_mac_context_t, +} +impl Default for psa_mac_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_mac_operation_s { + #[inline] + pub fn private_is_sign(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_sign: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; + private_is_sign as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_aead_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub private_ad_remaining: usize, + pub private_body_remaining: usize, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_ctx: psa_driver_aead_context_t, +} +impl Default for psa_aead_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_aead_operation_s { + #[inline] + pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_ad_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_body_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(3usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 3usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 3usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(4usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 4usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 4usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_nonce_set: ::core::ffi::c_uint, + private_lengths_set: ::core::ffi::c_uint, + private_ad_started: ::core::ffi::c_uint, + private_body_started: ::core::ffi::c_uint, + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; + private_nonce_set as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; + private_lengths_set as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; + private_ad_started as u64 + }); + __bindgen_bitfield_unit.set(3usize, 1u8, { + let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; + private_body_started as u64 + }); + __bindgen_bitfield_unit.set(4usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hkdf_key_derivation_t { + pub private_info: *mut u8, + pub private_info_length: usize, + pub private_offset_in_block: u8, + pub private_block_number: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_output_block: [u8; 64usize], + pub private_prk: [u8; 64usize], + pub __bindgen_padding_0: [u64; 0usize], + pub private_hmac: psa_mac_operation_s, +} +impl Default for psa_hkdf_key_derivation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_hkdf_key_derivation_t { + #[inline] + pub fn private_state(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_info_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_state: ::core::ffi::c_uint, + private_info_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 2u8, { + let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; + private_state as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; + private_info_set as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_tls12_ecjpake_to_pms_t { + pub private_data: [u8; 32usize], +} +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: + psa_tls12_prf_key_derivation_state_t = 0; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: + psa_tls12_prf_key_derivation_state_t = 1; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 2; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 3; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: + psa_tls12_prf_key_derivation_state_t = 4; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: + psa_tls12_prf_key_derivation_state_t = 5; +pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_tls12_prf_key_derivation_s { + pub private_left_in_block: u8, + pub private_block_number: u8, + pub private_state: psa_tls12_prf_key_derivation_state_t, + pub private_secret: *mut u8, + pub private_secret_length: usize, + pub private_seed: *mut u8, + pub private_seed_length: usize, + pub private_label: *mut u8, + pub private_label_length: usize, + pub private_other_secret: *mut u8, + pub private_other_secret_length: usize, + pub private_Ai: [u8; 64usize], + pub private_output_block: [u8; 64usize], +} +impl Default for psa_tls12_prf_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_key_derivation_context_t { + pub dummy: ::core::ffi::c_uint, + pub private_hkdf: psa_hkdf_key_derivation_t, + pub private_tls12_prf: psa_tls12_prf_key_derivation_t, + pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +} +impl Default for psa_driver_key_derivation_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_key_derivation_s { + pub private_alg: psa_algorithm_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_capacity: usize, + pub __bindgen_padding_0: [u64; 0usize], + pub private_ctx: psa_driver_key_derivation_context_t, +} +impl Default for psa_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_key_derivation_s { + #[inline] + pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_can_output_key: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_can_output_key: u32 = + unsafe { ::core::mem::transmute(private_can_output_key) }; + private_can_output_key as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_custom_key_parameters_s { + pub flags: u32, +} +#[repr(C)] +#[derive(Default)] +pub struct psa_key_production_parameters_s { + pub flags: u32, + pub data: __IncompleteArrayField, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_policy_s { + pub private_usage: psa_key_usage_t, + pub private_alg: psa_algorithm_t, + pub private_alg2: psa_algorithm_t, +} +pub type psa_key_policy_t = psa_key_policy_s; +pub type psa_key_bits_t = u16; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_attributes_s { + pub private_type: psa_key_type_t, + pub private_bits: psa_key_bits_t, + pub private_lifetime: psa_key_lifetime_t, + pub private_policy: psa_key_policy_t, + pub private_id: mbedtls_svc_key_id_t, +} +/// \brief The context for PSA interruptible hash signing. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_sign_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_sign_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_sign_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_sign_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The context for PSA interruptible hash verification. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_verify_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_verify_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_verify_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_verify_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +unsafe extern "C" { + /// \brief Library initialization. + /// + /// Applications must call this function before calling any other + /// function in this module. + /// + /// Applications may call this function more than once. Once a call + /// succeeds, subsequent calls are guaranteed to succeed. + /// + /// If the application calls other functions before calling psa_crypto_init(), + /// the behavior is undefined. Implementations are encouraged to either perform + /// the operation as if the library had been initialized or to return + /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + /// implementations should not return a success status if the lack of + /// initialization may have security implications, for example due to improper + /// seeding of the random number generator. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + pub fn psa_crypto_init() -> psa_status_t; +} +unsafe extern "C" { + /// Retrieve the attributes of a key. + /// + /// This function first resets the attribute structure as with + /// psa_reset_key_attributes(). It then copies the attributes of + /// the given key into the given attribute structure. + /// + /// \note This function may allocate memory or other resources. + /// Once you have called this function on an attribute structure, + /// you must call psa_reset_key_attributes() to free these resources. + /// + /// \param[in] key Identifier of the key to query. + /// \param[in,out] attributes On success, the attributes of the key. + /// On failure, equivalent to a + /// freshly-initialized structure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_get_key_attributes( + key: mbedtls_svc_key_id_t, + attributes: *mut psa_key_attributes_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Reset a key attribute structure to a freshly initialized state. + /// + /// You must initialize the attribute structure as described in the + /// documentation of the type #psa_key_attributes_t before calling this + /// function. Once the structure has been initialized, you may call this + /// function at any time. + /// + /// This function frees any auxiliary resources that the structure + /// may contain. + /// + /// \param[in,out] attributes The attribute structure to reset. + pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); +} +unsafe extern "C" { + /// Remove non-essential copies of key material from memory. + /// + /// If the key identifier designates a volatile key, this functions does not do + /// anything and returns successfully. + /// + /// If the key identifier designates a persistent key, then this function will + /// free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and the key can still be used. + /// + /// \param key Identifier of the key to purge. + /// + /// \retval #PSA_SUCCESS + /// The key material will have been removed from memory if it is not + /// currently required. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid key identifier. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// Make a copy of a key. + /// + /// Copy key material from one location to another. + /// + /// This function is primarily useful to copy a key from one location + /// to another, since it populates a key using the material from + /// another key which may have a different lifetime. + /// + /// This function may be used to share a key with a different party, + /// subject to implementation-defined restrictions on key sharing. + /// + /// The policy on the source key must have the usage flag + /// #PSA_KEY_USAGE_COPY set. + /// This flag is sufficient to permit the copy if the key has the lifetime + /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + /// Some secure elements do not provide a way to copy a key without + /// making it extractable from the secure element. If a key is located + /// in such a secure element, then the key must have both usage flags + /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + /// a copy of the key outside the secure element. + /// + /// The resulting key may only be used in a way that conforms to + /// both the policy of the original key and the policy specified in + /// the \p attributes parameter: + /// - The usage flags on the resulting key are the bitwise-and of the + /// usage flags on the source policy and the usage flags in \p attributes. + /// - If both allow the same algorithm or wildcard-based + /// algorithm policy, the resulting key has the same algorithm policy. + /// - If either of the policies allows an algorithm and the other policy + /// allows a wildcard-based algorithm policy that includes this algorithm, + /// the resulting key allows the same algorithm. + /// - If the policies do not allow any algorithm in common, this function + /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// + /// The effect of this function on implementation-defined attributes is + /// implementation-defined. + /// + /// \param source_key The key to copy. It must allow the usage + /// #PSA_KEY_USAGE_COPY. If a private or secret key is + /// being copied outside of a secure element it must + /// also allow #PSA_KEY_USAGE_EXPORT. + /// \param[in] attributes The attributes for the new key. + /// They are used as follows: + /// - The key type and size may be 0. If either is + /// nonzero, it must match the corresponding + /// attribute of the source key. + /// - The key location (the lifetime and, for + /// persistent keys, the key identifier) is + /// used directly. + /// - The policy constraints (usage flags and + /// algorithm policy) are combined from + /// the source key and \p attributes so that + /// both sets of restrictions apply, as + /// described in the documentation of this function. + /// \param[out] target_key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p source_key is invalid. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The lifetime or identifier in \p attributes are invalid, or + /// the policy constraints on the source and specified in + /// \p attributes are incompatible, or + /// \p attributes specifies a key type or key size + /// which does not match the attributes of the source key. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + /// the source key is not exportable and its lifetime does not + /// allow copying it to the target's lifetime. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_copy_key( + source_key: mbedtls_svc_key_id_t, + attributes: *const psa_key_attributes_t, + target_key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Destroy a key. + /// + /// This function destroys a key from both volatile + /// memory and, if applicable, non-volatile storage. Implementations shall + /// make a best effort to ensure that the key material cannot be recovered. + /// + /// This function also erases any metadata such as policies and frees + /// resources associated with the key. + /// + /// If a key is currently in use in a multipart operation, then destroying the + /// key will cause the multipart operation to fail. + /// + /// \warning We can only guarantee that the the key material will + /// eventually be wiped from memory. With threading enabled + /// and during concurrent execution, copies of the key material may + /// still exist until all threads have finished using the key. + /// + /// \param key Identifier of the key to erase. If this is \c 0, do nothing and + /// return #PSA_SUCCESS. + /// + /// \retval #PSA_SUCCESS + /// \p key was a valid identifier and the key material that it + /// referred to has been erased. Alternatively, \p key is \c 0. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key cannot be erased because it is + /// read-only, either due to a policy or due to physical restrictions. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p key is not a valid identifier nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE + /// There was a failure in communication with the cryptoprocessor. + /// The key material may still be present in the cryptoprocessor. + /// \retval #PSA_ERROR_DATA_INVALID + /// This error is typically a result of either storage corruption on a + /// cleartext storage backend, or an attempt to read data that was + /// written by an incompatible version of the library. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The storage is corrupted. Implementations shall make a best effort + /// to erase key material even in this stage, however applications + /// should be aware that it may be impossible to guarantee that the + /// key material is not recoverable in such cases. + /// \retval #PSA_ERROR_CORRUPTION_DETECTED + /// An unexpected condition which is not a storage corruption or + /// a communication failure occurred. The cryptoprocessor may have + /// been compromised. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Import a key in binary format. + /// + /// This function supports any output from psa_export_key(). Refer to the + /// documentation of psa_export_public_key() for the format of public keys + /// and to the documentation of psa_export_key() for the format for + /// other key types. + /// + /// The key data determines the key size. The attributes may optionally + /// specify a key size; in this case it must match the size determined + /// from the key data. A key size of 0 in \p attributes indicates that + /// the key size is solely determined by the key data. + /// + /// Implementations must reject an attempt to import a key of size 0. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// \param[in] attributes The attributes for the new key. + /// The key size is always determined from the + /// \p data buffer. + /// If the key size in \p attributes is nonzero, + /// it must be equal to the size from \p data. + /// \param[out] key On success, an identifier to the newly created key. + /// For persistent keys, this is the key identifier + /// defined in \p attributes. + /// \c 0 on failure. + /// \param[in] data Buffer containing the key data. The content of this + /// buffer is interpreted according to the type declared + /// in \p attributes. + /// All implementations must support at least the format + /// described in the documentation + /// of psa_export_key() or psa_export_public_key() for + /// the chosen type. Implementations may allow other + /// formats, but should be conservative: implementations + /// should err on the side of rejecting content if it + /// may be erroneous (e.g. wrong type or truncated data). + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular persistent location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key attributes, as a whole, are invalid, or + /// the key data is not correctly formatted, or + /// the size in \p attributes is nonzero and does not match the size + /// of the key data. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_import_key( + attributes: *const psa_key_attributes_t, + data: *const u8, + data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a key in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an equivalent object. + /// + /// If the implementation of psa_import_key() supports other formats + /// beyond the format specified here, the output from psa_export_key() + /// must use the representation specified here, not the original + /// representation. + /// + /// For standard key types, the output format is as follows: + /// + /// - For symmetric keys (including MAC keys), the format is the + /// raw bytes of the key. + /// - For DES, the key data consists of 8 bytes. The parity bits must be + /// correct. + /// - For Triple-DES, the format is the concatenation of the + /// two or three DES keys. + /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + /// is the non-encrypted DER encoding of the representation defined by + /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + /// ``` + /// RSAPrivateKey ::= SEQUENCE { + /// version INTEGER, -- must be 0 + /// modulus INTEGER, -- n + /// publicExponent INTEGER, -- e + /// privateExponent INTEGER, -- d + /// prime1 INTEGER, -- p + /// prime2 INTEGER, -- q + /// exponent1 INTEGER, -- d mod (p-1) + /// exponent2 INTEGER, -- d mod (q-1) + /// coefficient INTEGER, -- (inverse of q) mod p + /// } + /// ``` + /// - For elliptic curve key pairs (key types for which + /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + /// a representation of the private value as a `ceiling(m/8)`-byte string + /// where `m` is the bit size associated with the curve, i.e. the bit size + /// of the order of the curve's coordinate field. This byte string is + /// in little-endian order for Montgomery curves (curve types + /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + /// For Weierstrass curves, this is the content of the `privateKey` field of + /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + /// the format is defined by RFC 7748, and output is masked according to §5. + /// For twisted Edwards curves, the private key is as defined by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For Diffie-Hellman key exchange key pairs (key types for which + /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + /// format is the representation of the private key `x` as a big-endian byte + /// string. The length of the byte string is the private key size in bytes + /// (leading zeroes are not stripped). + /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + /// true), the format is the same as for psa_export_public_key(). + /// + /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// + /// \param key Identifier of the key to export. It must allow the + /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public + /// key. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a public key or the public part of a key pair in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an object that is equivalent to the public key. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// For standard key types, the output format is as follows: + /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + /// ``` + /// RSAPublicKey ::= SEQUENCE { + /// modulus INTEGER, -- n + /// publicExponent INTEGER } -- e + /// ``` + /// - For elliptic curve keys on a twisted Edwards curve (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + /// by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For other elliptic curve public keys (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. + /// Let `m` be the bit size associated with the curve, i.e. the bit size of + /// `q` for a curve over `F_q`. The representation consists of: + /// - The byte 0x04; + /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + /// - For Diffie-Hellman key exchange public keys (key types for which + /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + /// the format is the representation of the public key `y = g^x mod p` as a + /// big-endian byte string. The length of the byte string is the length of the + /// base prime `p` in bytes. + /// + /// Exporting a public key object or the public part of a key pair is + /// always permitted, regardless of the key's usage flags. + /// + /// \param key Identifier of the key to export. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key is neither a public key nor a key pair. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_public_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message. + /// + /// \note To verify the hash of a message against an + /// expected value, use psa_hash_compare() instead. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\p alg). /// /// \retval #PSA_SUCCESS /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p hash_size is too small + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compute( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message and compare it with a + /// reference value. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the input. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c private_key is not compatible with \c alg, - /// or \p peer_key is not valid for \c alg or not compatible with - /// \c private_key, or \c step does not allow an input resulting - /// from a key agreement. + /// \p input_length or \p hash_length do not match the hash size for \p alg + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compare( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; +} +/// The type of the state data structure for multipart hash operations. +/// +/// Before calling any function on a hash operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_hash_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_hash_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, +/// for example: +/// \code +/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_hash_operation_init() +/// to the structure, for example: +/// \code +/// psa_hash_operation_t operation; +/// operation = psa_hash_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_hash_operation_t = psa_hash_operation_s; +unsafe extern "C" { + /// Set up a multipart hash operation. + /// + /// The sequence of operations to calculate a hash (message digest) + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + /// -# Call psa_hash_setup() to specify the algorithm. + /// -# Call psa_hash_update() zero, one or more times, passing a fragment + /// of the message each time. The hash that is calculated is the hash + /// of the concatenation of these messages in order. + /// -# To calculate the hash, call psa_hash_finish(). + /// To compare the hash with an expected value, call psa_hash_verify(). + /// + /// If an error occurs at any step after a call to psa_hash_setup(), the + /// operation will need to be reset by a call to psa_hash_abort(). The + /// application may call psa_hash_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_hash_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_hash_finish() or psa_hash_verify(). + /// - A call to psa_hash_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_hash_operation_t and not yet in use. + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. + /// \p alg is not a supported hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a hash algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this key agreement \p step, - /// or the library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_key_agreement( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, + pub fn psa_hash_setup( + operation: *mut psa_hash_operation_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// Read some data from a key derivation operation. + /// Add a message fragment to a multipart hash operation. /// - /// This function calculates output bytes from a key derivation algorithm and - /// return those bytes. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the requested number of bytes from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. + /// The application must call psa_hash_setup() before calling this function. /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] output Buffer where the output will be written. - /// \param output_length Number of bytes to output. + /// \param[in,out] operation Active hash operation. + /// \param[in] input Buffer containing the message fragment to hash. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// no output is written to the output buffer. - /// The operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller output buffer. + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_update( + operation: *mut psa_hash_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \warning Applications should not call this function if they expect + /// a specific value for the hash. Call psa_hash_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// hash values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the hashed data which could allow an attacker to guess + /// a valid hash and thereby bypass security controls. + /// + /// \param[in,out] operation Active hash operation. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\c alg) where \c alg is the + /// hash algorithm that is calculated. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p hash buffer is too small. You can determine a + /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + /// where \c alg is the hash algorithm that is calculated. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_finish( + operation: *mut psa_hash_operation_t, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message and compare it with + /// an expected value. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). It then + /// compares the calculated hash with the expected hash passed as a + /// parameter to this function. + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual hash and the expected hash is performed + /// in constant time. + /// + /// \param[in,out] operation Active hash operation. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_bytes( - operation: *mut psa_key_derivation_operation_t, - output: *mut u8, - output_length: usize, + pub fn psa_hash_verify( + operation: *mut psa_hash_operation_t, + hash: *const u8, + hash_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// Derive a key from an ongoing key derivation operation. - /// - /// This function calculates output bytes from a key derivation algorithm - /// and uses those bytes to generate a key deterministically. - /// The key's location, usage policy, type and size are taken from - /// \p attributes. - /// - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads as many bytes as required from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// How much output is produced and consumed from the operation, and how - /// the key is derived, depends on the key type and on the key size - /// (denoted \c bits below): - /// - /// - For key types for which the key is an arbitrary sequence of bytes - /// of a given size, this function is functionally equivalent to - /// calling #psa_key_derivation_output_bytes - /// and passing the resulting output to #psa_import_key. - /// However, this function has a security benefit: - /// if the implementation provides an isolation boundary then - /// the key material is not exposed outside the isolation boundary. - /// As a consequence, for these key types, this function always consumes - /// exactly (\c bits / 8) bytes from the operation. - /// The following key types defined in this specification follow this scheme: - /// - /// - #PSA_KEY_TYPE_AES; - /// - #PSA_KEY_TYPE_ARIA; - /// - #PSA_KEY_TYPE_CAMELLIA; - /// - #PSA_KEY_TYPE_DERIVE; - /// - #PSA_KEY_TYPE_HMAC; - /// - #PSA_KEY_TYPE_PASSWORD_HASH. - /// - /// - For ECC keys on a Montgomery elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Montgomery curve), this function always draws a byte string whose - /// length is determined by the curve, and sets the mandatory bits - /// accordingly. That is: + /// Abort a hash operation. /// - /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte - /// string and process it as specified in RFC 7748 §5. - /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte - /// string and process it as specified in RFC 7748 §5. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_hash_setup() again. /// - /// - For key types for which the key is represented by a single sequence of - /// \c bits bits with constraints as to which bit sequences are acceptable, - /// this function draws a byte string of length (\c bits / 8) bytes rounded - /// up to the nearest whole number of bytes. If the resulting byte string - /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. - /// This process is repeated until an acceptable byte string is drawn. - /// The byte string drawn from the operation is interpreted as specified - /// for the output produced by psa_export_key(). - /// The following key types defined in this specification follow this scheme: + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_hash_operation_t. /// - /// - #PSA_KEY_TYPE_DES. - /// Force-set the parity bits, but discard forbidden weak keys. - /// For 2-key and 3-key triple-DES, the three keys are generated - /// successively (for example, for 3-key triple-DES, - /// if the first 8 bytes specify a weak key and the next 8 bytes do not, - /// discard the first 8 bytes, use the next 8 bytes as the first key, - /// and continue reading output from the operation to derive the other - /// two keys). - /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) - /// where \c group designates any Diffie-Hellman group) and - /// ECC keys on a Weierstrass elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Weierstrass curve). - /// For these key types, interpret the byte string as integer - /// in big-endian order. Discard it if it is not in the range - /// [0, *N* - 2] where *N* is the boundary of the private key domain - /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, - /// or the order of the curve's base point for ECC). - /// Add 1 to the resulting integer and use this as the private key *x*. - /// This method allows compliance to NIST standards, specifically - /// the methods titled "key-pair generation by testing candidates" - /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, - /// in FIPS 186-4 §B.1.2 for DSA, and - /// in NIST SP 800-56A §5.6.1.2.2 or - /// FIPS 186-4 §B.4.2 for elliptic curve keys. + /// In particular, calling psa_hash_abort() after the operation has been + /// terminated by a call to psa_hash_abort(), psa_hash_finish() or + /// psa_hash_verify() is safe and has no effect. /// - /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, - /// the way in which the operation output is consumed is - /// implementation-defined. + /// \param[in,out] operation Initialized hash operation. /// - /// In all cases, the data that is read is discarded from the operation. - /// The operation's capacity is decreased by the number of bytes read. + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Clone a hash operation. /// - /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, - /// the input to that step must be provided with psa_key_derivation_input_key(). - /// Future versions of this specification may include additional restrictions - /// on the derived key based on the attributes and strength of the secret key. + /// This function copies the state of an ongoing hash operation to + /// a new operation object. In other words, this function is equivalent + /// to calling psa_hash_setup() on \p target_operation with the same + /// algorithm that \p source_operation was set up for, then + /// psa_hash_update() on \p target_operation with the same input that + /// that was passed to \p source_operation. After this function returns, the + /// two objects are independent, i.e. subsequent calls involving one of + /// the objects do not affect the other object. /// - /// \param[in] attributes The attributes for the new key. - /// If the key type to be created is - /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in - /// the policy must be the same as in the current - /// operation. - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in] source_operation The active hash operation to clone. + /// \param[in,out] target_operation The operation object to set up. + /// It must be initialized but not active. /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// There was not enough data to create the desired key. - /// Note that in this case, no output is written to the output buffer. - /// The operation's capacity is set to 0, thus subsequent calls to - /// this function will not succeed, even with a smaller output buffer. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The provided key attributes are not valid for the operation. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The #PSA_KEY_DERIVATION_INPUT_SECRET or - /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a - /// key; or one of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_SUCCESS \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The \p source_operation state is not valid (it must be active), or + /// the \p target_operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_key( - attributes: *const psa_key_attributes_t, - operation: *mut psa_key_derivation_operation_t, - key: *mut mbedtls_svc_key_id_t, + pub fn psa_hash_clone( + source_operation: *const psa_hash_operation_t, + target_operation: *mut psa_hash_operation_t, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value in constant time. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the expected number of bytes from the - /// stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to the following code: - /// \code - /// psa_key_derivation_output_bytes(operation, tmp, output_length); - /// if (memcmp(output, tmp, output_length) != 0) - /// return PSA_ERROR_INVALID_SIGNATURE; - /// \endcode - /// except (1) it works even if the key's policy does not allow outputting the - /// bytes, and (2) the comparison will be done in constant time. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC (message authentication code) of a message. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected_output Buffer containing the expected derivation output. - /// \param output_length Length of the expected output; this is also the - /// number of bytes that will be read. + /// \note To verify the MAC of a message against an + /// expected value, use psa_mac_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but it differs from the expected - /// output. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p mac_size is too small /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_bytes( - operation: *mut psa_key_derivation_operation_t, - expected_output: *const u8, - output_length: usize, + pub fn psa_mac_compute( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value - /// stored in a key object. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value, provided as key of type - /// #PSA_KEY_TYPE_PASSWORD_HASH. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the number of bytes corresponding to the - /// length of the expected value from the stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to exporting the key and calling - /// psa_key_derivation_verify_bytes() on the result, except that it - /// works even if the key cannot be exported. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC of a message and compare it with a reference value. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH - /// containing the expected output. Its policy must - /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag - /// and the permitted algorithm must match the - /// operation. The value of this key was likely - /// computed by a previous call to - /// psa_key_derivation_output_key(). + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the input. /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but if differs from the expected - /// output. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// The key passed as the expected value does not exist. + /// The MAC of the message was calculated successfully, but it + /// differs from the expected value. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key passed as the expected value has an invalid type. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key passed as the expected value does not allow this usage or - /// this algorithm; or one of the inputs was a key whose policy didn't - /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// the length of the expected value. In this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_key( - operation: *mut psa_key_derivation_operation_t, - expected: psa_key_id_t, + pub fn psa_mac_verify( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *const u8, + mac_length: usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart MAC operations. +/// +/// Before calling any function on a MAC operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_mac_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_mac_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, +/// for example: +/// \code +/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_mac_operation_init() +/// to the structure, for example: +/// \code +/// psa_mac_operation_t operation; +/// operation = psa_mac_operation_init(); +/// \endcode +/// +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Abort a key derivation operation. + /// Set up a multipart MAC calculation operation. /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_key_derivation_setup() again. + /// This function sets up the calculation of the MAC + /// (message authentication code) of a byte string. + /// To verify the MAC of a message against an + /// expected value, use psa_mac_verify_setup() instead. /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_key_derivation_operation_t. + /// The sequence of operations to calculate a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_sign_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_sign_finish() to finish + /// calculating the MAC value and retrieve it. /// - /// In particular, it is valid to call psa_key_derivation_abort() twice, or to - /// call psa_key_derivation_abort() on an operation that has not been set up. + /// If an error occurs at any step after a call to psa_mac_sign_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. /// - /// \param[in,out] operation The operation to abort. + /// After a successful call to psa_mac_sign_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_sign_finish(). + /// - A call to psa_mac_abort(). /// - /// \retval #PSA_SUCCESS \emptydescription + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) - -> psa_status_t; + pub fn psa_mac_sign_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Perform a key agreement and return the raw shared secret. + /// Set up a multipart MAC verification operation. /// - /// \warning The raw result of a key agreement algorithm such as finite-field - /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should - /// not be used directly as key material. It should instead be passed as - /// input to a key derivation algorithm. To chain a key agreement with - /// a key derivation, use psa_key_derivation_key_agreement() and other - /// functions from the key derivation interface. + /// This function sets up the verification of the MAC + /// (message authentication code) of a byte string against an expected value. /// - /// \param alg The key agreement algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) - /// is true). - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. It must be - /// in the same format that psa_import_key() - /// accepts. The standard formats for public - /// keys are documented in the documentation - /// of psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// The sequence of operations to verify a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_verify_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_verify_finish() to finish + /// calculating the actual MAC of the message and verify it against + /// the expected value. + /// + /// If an error occurs at any step after a call to psa_mac_verify_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_mac_verify_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_verify_finish(). + /// - A call to psa_mac_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage + /// PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). /// /// \retval #PSA_SUCCESS /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a key agreement algorithm, or - /// \p private_key is not compatible with \p alg, - /// or \p peer_key is not valid for \p alg or not compatible with - /// \p private_key. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p output_size is too small + /// \c key is not compatible with \c alg. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported key agreement algorithm. + /// \c alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_raw_key_agreement( + pub fn psa_mac_verify_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate random bytes. - /// - /// \warning This function **can** fail! Callers MUST check the return status - /// and MUST NOT use the content of the output buffer if the return - /// status is not #PSA_SUCCESS. - /// - /// \note To generate a key, use psa_generate_key() instead. - /// - /// \param[out] output Output buffer for the generated data. - /// \param output_size Number of bytes to generate and output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Generate a key or key pair. - /// - /// The key is generated randomly. - /// Its location, usage policy, type and size are taken from \p attributes. + /// Add a message fragment to a multipart MAC operation. /// - /// Implementations must reject an attempt to generate a key of size 0. + /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + /// before calling this function. /// - /// The following type-specific considerations apply: - /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the public exponent is 65537. - /// The modulus is a product of two probabilistic primes - /// between 2^{n-1} and 2^n where n is the bit size specified in the - /// attributes. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param[in] attributes The attributes for the new key. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in,out] operation Active MAC operation. + /// \param[in] input Buffer containing the message fragment to add to + /// the MAC calculation. + /// \param input_length Size of the \p input buffer in bytes. /// /// \retval #PSA_SUCCESS /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_generate_key( - attributes: *const psa_key_attributes_t, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; -} -/// The type of the state data structure for interruptible hash -/// signing operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = -/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_sign_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// operation = psa_sign_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; -/// The type of the state data structure for interruptible hash -/// verification operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = -/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_verify_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// operation = psa_verify_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; -unsafe extern "C" { - /// \brief Set the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note The time taken to execute a single op is - /// implementation specific and depends on - /// software, hardware, the algorithm, key type and - /// curve chosen. Even within a single operation, - /// successive ops can take differing amounts of - /// time. The only guarantee is that lower values - /// for \p max_ops means functions will block for a - /// lesser maximum amount of time. The functions - /// \c psa_sign_interruptible_get_num_ops() and - /// \c psa_verify_interruptible_get_num_ops() are - /// provided to help with tuning this value. - /// - /// \note This value defaults to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which - /// means the whole operation will be done in one - /// go, regardless of the number of ops required. - /// - /// \note If more ops are needed to complete a - /// computation, #PSA_OPERATION_INCOMPLETE will be - /// returned by the function performing the - /// computation. It is then the caller's - /// responsibility to either call again with the - /// same operation context until it returns 0 or an - /// error code; or to call the relevant abort - /// function if the answer is no longer required. - /// - /// \note The interpretation of \p max_ops is also - /// implementation defined. On a hard real time - /// system, this can indicate a hard deadline, as a - /// real-time system needs a guarantee of not - /// spending more than X time, however care must be - /// taken in such an implementation to avoid the - /// situation whereby calls just return, not being - /// able to do any actual work within the allotted - /// time. On a non-real-time system, the - /// implementation can be more relaxed, but again - /// whether this number should be interpreted as as - /// hard or soft limit or even whether a less than - /// or equals as regards to ops executed in a - /// single call is implementation defined. - /// - /// \note For keys in local storage when no accelerator - /// driver applies, please see also the - /// documentation for \c mbedtls_ecp_set_max_ops(), - /// which is the internal implementation in these - /// cases. - /// - /// \warning With implementations that interpret this number - /// as a hard limit, setting this number too small - /// may result in an infinite loop, whereby each - /// call results in immediate return with no ops - /// done (as there is not enough time to execute - /// any), and thus no result will ever be achieved. - /// - /// \note This only applies to functions whose - /// documentation mentions they may return - /// #PSA_OPERATION_INCOMPLETE. - /// - /// \param max_ops The maximum number of ops to be executed in a - /// single call. This can be a number from 0 to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 - /// is the least amount of work done per call. - pub fn psa_interruptible_set_max_ops(max_ops: u32); -} -unsafe extern "C" { - /// \brief Get the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. This will return the last - /// value set by - /// \c psa_interruptible_set_max_ops() or - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if - /// that function has never been called. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \return Maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - pub fn psa_interruptible_get_max_ops() -> u32; + pub fn psa_mac_update( + operation: *mut psa_mac_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash signing - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling - /// \c psa_sign_hash_interruptible_abort() on - /// the operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message. /// - /// \note This interface is guaranteed re-entrant and - /// thus may be called from driver code. + /// The application must call psa_mac_sign_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// \warning Applications should not call this function if they expect + /// a specific value for the MAC. Call psa_mac_verify_finish() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \param operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// \param[in,out] operation Active MAC operation. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. This is always + /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of the key and \c alg is the + /// MAC algorithm that is calculated. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_sign_hash_get_num_ops( - operation: *const psa_sign_hash_interruptible_operation_t, - ) -> u32; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p mac buffer is too small. You can determine a + /// sufficient buffer size by calling PSA_MAC_LENGTH(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac sign + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_sign_finish( + operation: *mut psa_mac_operation_t, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash verification - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling \c - /// psa_verify_hash_interruptible_abort() on the - /// operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message and compare it with + /// an expected value. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// The application must call psa_mac_verify_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). It then + /// compares the calculated MAC with the expected MAC passed as a + /// parameter to this function. /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param operation The \c - /// psa_verify_hash_interruptible_operation_t to - /// use. This must be initialized first. + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual MAC and the expected MAC is performed + /// in constant time. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_verify_hash_get_num_ops( - operation: *const psa_verify_hash_interruptible_operation_t, - ) -> u32; + /// \param[in,out] operation Active MAC operation. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The MAC of the message was calculated successfully, but it + /// differs from the expected MAC. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac verify + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_verify_finish( + operation: *mut psa_mac_operation_t, + mac: *const u8, + mac_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start signing a hash or short message with a - /// private key, in an interruptible manner. + /// Abort a MAC operation. /// - /// \see \c psa_sign_hash_complete() + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_mac_sign_setup() or psa_mac_verify_setup() again. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_mac_operation_t. /// - /// \note This function combined with \c - /// psa_sign_hash_complete() is equivalent to - /// \c psa_sign_hash() but - /// \c psa_sign_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// In particular, calling psa_mac_abort() after the operation has been + /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + /// psa_mac_verify_finish() is safe and has no effect. /// - /// \note Users should call \c psa_sign_hash_complete() - /// repeatedly on the same context after a - /// successful call to this function until \c - /// psa_sign_hash_complete() either returns 0 or an - /// error. \c psa_sign_hash_complete() will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// \param[in,out] operation Initialized MAC operation. /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_sign_hash_abort(). + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Encrypt a message using a symmetric cipher. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// This function encrypts a message with a random IV (initialization + /// vector). Use the multipart operation interface with a + /// #psa_cipher_operation_t object to provide other forms of IV. /// /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. + /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// The output contains the IV followed by + /// the ciphertext proper. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. /// /// \retval #PSA_SUCCESS - /// The operation started successfully - call \c psa_sign_hash_complete() - /// with the same context to complete the operation - /// + /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does - /// not permit the requested algorithm. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// An operation has previously been started on this context, and is - /// still in progress. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Decrypt a message using a symmetric cipher. + /// + /// This function decrypts a message encrypted with a symmetric cipher. + /// + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to decrypt. + /// This consists of the IV followed by the + /// ciphertext proper. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the plaintext is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_start( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt( key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart cipher operations. +/// +/// Before calling any function on a cipher operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_cipher_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_cipher_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, +/// for example: +/// \code +/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_cipher_operation_init() +/// to the structure, for example: +/// \code +/// psa_cipher_operation_t operation; +/// operation = psa_cipher_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// signing a hash or short message with a private - /// key, in an interruptible manner. - /// - /// \see \c psa_sign_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_sign_hash_start() is equivalent to - /// \c psa_sign_hash() but this function can return - /// early and resume according to the limit set with - /// \c psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// Set the key for a multipart symmetric encryption operation. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// The sequence of operations to encrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + /// generate or set the IV (initialization vector). You should use + /// psa_cipher_generate_iv() unless the protocol you are implementing + /// requires a specific IV value. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_sign_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_sign_hash_start() called with it - /// first. + /// After a successful call to psa_cipher_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c - /// key_bits, \c alg) where \c key_type and \c - /// key_bits are the type and bit-size - /// respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// Operation completed successfully - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_sign_hash_start(). - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_sign_hash_start() with this operation object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_sign_hash_complete( - operation: *mut psa_sign_hash_interruptible_operation_t, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Abort a sign hash operation. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function is the only function that clears - /// the number of ops completed as part of the - /// operation. Please ensure you copy this value via - /// \c psa_sign_hash_get_num_ops() if required - /// before calling. - /// - /// \note Aborting an operation frees all associated - /// resources except for the \p operation structure - /// itself. Once aborted, the operation object can - /// be reused for another operation by calling \c - /// psa_sign_hash_start() again. - /// - /// \note You may call this function any time after the - /// operation object has been initialized. In - /// particular, calling \c psa_sign_hash_abort() - /// after the operation has already been terminated - /// by a call to \c psa_sign_hash_abort() or - /// psa_sign_hash_complete() is safe. - /// - /// \param[in,out] operation Initialized sign hash operation. - /// - /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_abort( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_encrypt_setup( + operation: *mut psa_cipher_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start reading and verifying a hash or short - /// message, in an interruptible manner. - /// - /// \see \c psa_verify_hash_complete() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_verify_hash_complete() is equivalent to - /// \c psa_verify_hash() but \c - /// psa_verify_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function. + /// Set the key for a multipart symmetric decryption operation. /// - /// \note Users should call \c psa_verify_hash_complete() - /// repeatedly on the same operation object after a - /// successful call to this function until \c - /// psa_verify_hash_complete() either returns 0 or - /// an error. \c psa_verify_hash_complete() will - /// return #PSA_OPERATION_INCOMPLETE if there is - /// more work to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The sequence of operations to decrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + /// decryption. If the IV is prepended to the ciphertext, you can call + /// psa_cipher_update() on a buffer containing the IV followed by the + /// beginning of the message. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_verify_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// After a successful call to psa_cipher_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. /// \param key Identifier of the key to use for the operation. - /// The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash whose signature is to be verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// The operation started successfully - please call \c - /// psa_verify_hash_complete() with the same context to complete the - /// operation. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// Another operation has already been started on this context, and is - /// still in progress. - /// - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does - /// not permit the requested algorithm. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_start( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt_setup( + operation: *mut psa_cipher_operation_t, key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// reading and verifying a hash or short message - /// signed with a private key, in an interruptible - /// manner. - /// - /// \see \c psa_verify_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// Generate an IV for a symmetric encryption operation. /// - /// \note This function combined with \c - /// psa_verify_hash_start() is equivalent to - /// \c psa_verify_hash() but this function can - /// return early and resume according to the limit - /// set with \c psa_interruptible_set_max_ops() to - /// reduce the maximum time spent in a function - /// call. + /// This function generates a random IV (initialization vector), nonce + /// or initial counter value for the encryption operation as appropriate + /// for the chosen algorithm, key type and key size. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_verify_hash_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_verify_hash_start() called with it - /// first. + /// \param[in,out] operation Active cipher operation. + /// \param[out] iv Buffer where the generated IV is to be written. + /// \param iv_size Size of the \p iv buffer in bytes. + /// \param[out] iv_length On success, the number of bytes of the + /// generated IV. /// /// \retval #PSA_SUCCESS - /// Operation completed successfully, and the passed signature is valid. - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_verify_hash_start(). - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p iv buffer is too small. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_verify_hash_start() on this object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_verify_hash_complete( - operation: *mut psa_verify_hash_interruptible_operation_t, + /// The operation state is not valid (it must be active, with no IV set), + /// or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_generate_iv( + operation: *mut psa_cipher_operation_t, + iv: *mut u8, + iv_size: usize, + iv_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Abort a verify hash operation. + /// Set the IV for a symmetric encryption or decryption operation. /// - /// \warning This is a beta API, and thus subject to change at - /// any point. It is not bound by the usual interface - /// stability promises. + /// This function sets the IV (initialization vector), nonce + /// or initial counter value for the encryption or decryption operation. /// - /// \note This function is the only function that clears the - /// number of ops completed as part of the operation. - /// Please ensure you copy this value via - /// \c psa_verify_hash_get_num_ops() if required - /// before calling. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note Aborting an operation frees all associated - /// resources except for the operation structure - /// itself. Once aborted, the operation object can be - /// reused for another operation by calling \c - /// psa_verify_hash_start() again. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \note You may call this function any time after the - /// operation object has been initialized. - /// In particular, calling \c psa_verify_hash_abort() - /// after the operation has already been terminated by - /// a call to \c psa_verify_hash_abort() or - /// psa_verify_hash_complete() is safe. + /// \note When encrypting, applications should use psa_cipher_generate_iv() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \param[in,out] operation Initialized verify hash operation. + /// \param[in,out] operation Active cipher operation. + /// \param[in] iv Buffer containing the IV to use. + /// \param iv_length Size of the IV in bytes. /// /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p iv is not acceptable for the chosen algorithm, + /// or the chosen algorithm does not use an IV. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be an active cipher + /// encrypt operation, with no IV set), or the library has not been + /// previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_abort( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_set_iv( + operation: *mut psa_cipher_operation_t, + iv: *const u8, + iv_length: usize, ) -> psa_status_t; } -/// \brief The GCM context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_gcm_context { - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, - ///< Precalculated HTable low. - pub private_HL: [u64; 16usize], - ///< Precalculated HTable high. - pub private_HH: [u64; 16usize], - ///< The total length of the encrypted data. - pub private_len: u64, - ///< The total length of the additional data. - pub private_add_len: u64, - ///< The first ECTR for tag. - pub private_base_ectr: [::core::ffi::c_uchar; 16usize], - ///< The Y working value. - pub private_y: [::core::ffi::c_uchar; 16usize], - ///< The buf working value. - pub private_buf: [::core::ffi::c_uchar; 16usize], - ///< The operation to perform: - ///#MBEDTLS_GCM_ENCRYPT or - ///#MBEDTLS_GCM_DECRYPT. - pub private_mode: ::core::ffi::c_int, -} -impl Default for mbedtls_gcm_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes the specified GCM context, - /// to make references valid, and prepares the context - /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + /// Encrypt or decrypt a message fragment in an active cipher operation. /// - /// The function does not bind the GCM context to a particular - /// cipher, nor set the key. For this purpose, use - /// mbedtls_gcm_setkey(). + /// Before calling this function, you must: + /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + /// (recommended when encrypting) or psa_cipher_set_iv(). /// - /// \param ctx The GCM context to initialize. This must not be \c NULL. - pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief This function associates a GCM context with a - /// cipher algorithm and a key. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param cipher The 128-bit block cipher to use. - /// \param key The encryption key. This must be a readable buffer of at - /// least \p keybits bits. - /// \param keybits The key size in bits. Valid options are: - ///
          • 128 bits
            • - ///
          • 192 bits
            • - ///
          • 256 bits
          + /// \param[in,out] operation Active cipher operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A cipher-specific error code on failure. - pub fn mbedtls_gcm_setkey( - ctx: *mut mbedtls_gcm_context, - cipher: mbedtls_cipher_id_t, - key: *const ::core::ffi::c_uchar, - keybits: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_update( + operation: *mut psa_cipher_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs GCM encryption or decryption of a buffer. + /// Finish encrypting or decrypting a message in a cipher operation. /// - /// \note For encryption, the output buffer can be the same as the - /// input buffer. For decryption, the output buffer cannot be - /// the same as input buffer. If the buffers overlap, the output - /// buffer must trail at least 8 Bytes behind the input buffer. + /// The application must call psa_cipher_encrypt_setup() or + /// psa_cipher_decrypt_setup() before calling this function. The choice + /// of setup function determines whether this function encrypts or + /// decrypts its input. /// - /// \warning When this function performs a decryption, it outputs the - /// authentication tag and does not verify that the data is - /// authentic. You should use this function to perform encryption - /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// This function finishes the encryption or decryption of the message + /// formed by concatenating the inputs passed to preceding calls to + /// psa_cipher_update(). /// - /// \param ctx The GCM context to use for encryption or decryption. This - /// must be initialized. - /// \param mode The operation to perform: - /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. - /// The ciphertext is written to \p output and the - /// authentication tag is written to \p tag. - /// - #MBEDTLS_GCM_DECRYPT to perform decryption. - /// The plaintext is written to \p output and the - /// authentication tag is written to \p tag. - /// Note that this mode is not recommended, because it does - /// not verify the authenticity of the data. For this reason, - /// you should use mbedtls_gcm_auth_decrypt() instead of - /// calling this function in decryption mode. - /// \param length The length of the input data, which is equal to the length - /// of the output data. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param input The buffer holding the input data. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size in Bytes. - /// \param output The buffer for holding the output data. If \p length is greater - /// than zero, this must be a writable buffer of at least that - /// size in Bytes. - /// \param tag_len The length of the tag to generate. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \return \c 0 if the encryption or decryption was performed - /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, - /// this does not indicate that the data is authentic. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the encryption - /// or decryption failed. - pub fn mbedtls_gcm_crypt_and_tag( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - tag_len: usize, - tag: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active cipher operation. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input size passed to this operation is not valid for + /// this particular algorithm. For example, the algorithm is a based + /// on block cipher and requires a whole number of blocks, but the + /// total input size is not a multiple of the block size. + /// \retval #PSA_ERROR_INVALID_PADDING + /// This is a decryption operation for an algorithm that includes + /// padding, and the ciphertext does not contain valid padding. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_finish( + operation: *mut psa_cipher_operation_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs a GCM authenticated decryption of a - /// buffer. + /// Abort a cipher operation. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. /// - /// \param ctx The GCM context. This must be initialized. - /// \param length The length of the ciphertext to decrypt, which is also - /// the length of the decrypted plaintext. - /// \param iv The initialization vector. This must be a readable buffer - /// of at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param tag The buffer holding the tag to verify. This must be a - /// readable buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to verify. - /// \param input The buffer holding the ciphertext. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size. - /// \param output The buffer for holding the decrypted plaintext. If \p length - /// is greater than zero, this must be a writable buffer of at - /// least that size. + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_cipher_operation_t. /// - /// \return \c 0 if successful and authenticated. - /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the decryption - /// failed. - pub fn mbedtls_gcm_auth_decrypt( - ctx: *mut mbedtls_gcm_context, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - tag: *const ::core::ffi::c_uchar, - tag_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// In particular, calling psa_cipher_abort() after the operation has been + /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() + /// is safe and has no effect. + /// + /// \param[in,out] operation Initialized cipher operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a GCM encryption or decryption - /// operation. + /// Process an authenticated encryption operation. /// - /// \param ctx The GCM context. This must be initialized. - /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or - /// #MBEDTLS_GCM_DECRYPT. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that will be authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] plaintext Data that will be authenticated and + /// encrypted. + /// \param plaintext_length Size of \p plaintext in bytes. + /// \param[out] ciphertext Output buffer for the authenticated and + /// encrypted data. The additional data is not + /// part of this output. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate outputs, the + /// authentication tag is appended to the + /// encrypted data. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p plaintext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + /// plaintext_length) evaluates to the maximum + /// ciphertext size of any supported AEAD + /// encryption. + /// \param[out] ciphertext_length On success, the size of the output + /// in the \p ciphertext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_starts( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p ciphertext_size is too small. + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p plaintext_length) or + /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + plaintext: *const u8, + plaintext_length: usize, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer as associated data - /// (authenticated but not encrypted data) in a GCM - /// encryption or decryption operation. - /// - /// Call this function after mbedtls_gcm_starts() to pass - /// the associated data. If the associated data is empty, - /// you do not need to call this function. You may not - /// call this function after calling mbedtls_cipher_update(). + /// Process an authenticated decryption operation. /// - /// \param ctx The GCM context. This must have been started with - /// mbedtls_gcm_starts() and must not have yet received - /// any input with mbedtls_gcm_update(). - /// \param add The buffer holding the additional data, or \c NULL - /// if \p add_len is \c 0. - /// \param add_len The length of the additional data. If \c 0, - /// \p add may be \c NULL. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that has been authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] ciphertext Data that has been authenticated and + /// encrypted. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate inputs, the buffer + /// must contain the encrypted data followed + /// by the authentication tag. + /// \param ciphertext_length Size of \p ciphertext in bytes. + /// \param[out] plaintext Output buffer for the decrypted data. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p ciphertext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + /// ciphertext_length) evaluates to the maximum + /// plaintext size of any supported AEAD + /// decryption. + /// \param[out] plaintext_length On success, the size of the output + /// in the \p plaintext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_update_ad( - ctx: *mut mbedtls_gcm_context, - add: *const ::core::ffi::c_uchar, - add_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The ciphertext is not authentic. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p plaintext_size is too small. + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p ciphertext_length) or + /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + /// to determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + ciphertext: *const u8, + ciphertext_length: usize, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for multipart AEAD operations. +/// +/// Before calling any function on an AEAD operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_aead_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_aead_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, +/// for example: +/// \code +/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_aead_operation_init() +/// to the structure, for example: +/// \code +/// psa_aead_operation_t operation; +/// operation = psa_aead_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing GCM - /// encryption or decryption operation. - /// - /// You may call this function zero, one or more times - /// to pass successive parts of the input: the plaintext to - /// encrypt, or the ciphertext (not including the tag) to - /// decrypt. After the last part of the input, call - /// mbedtls_gcm_finish(). + /// Set the key for a multipart authenticated encryption operation. /// - /// This function may produce output in one of the following - /// ways: - /// - Immediate output: the output length is always equal - /// to the input length. - /// - Buffered output: the output consists of a whole number - /// of 16-byte blocks. If the total input length so far - /// (not including associated data) is 16 \* *B* + *A* - /// with *A* < 16 then the total output length is 16 \* *B*. + /// The sequence of operations to encrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + /// generate or set the nonce. You should use + /// psa_aead_generate_nonce() unless the protocol you are implementing + /// requires a specific nonce value. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the message to encrypt each time. + /// -# Call psa_aead_finish(). /// - /// In particular: - /// - It is always correct to call this function with - /// \p output_size >= \p input_length + 15. - /// - If \p input_length is a multiple of 16 for all the calls - /// to this function during an operation, then it is - /// correct to use \p output_size = \p input_length. + /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// After a successful call to psa_aead_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_finish(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param input The buffer holding the input data. If \p input_length - /// is greater than zero, this must be a readable buffer - /// of at least \p input_length bytes. - /// \param input_length The length of the input data in bytes. - /// \param output The buffer for the output data. If \p output_size - /// is greater than zero, this must be a writable buffer of - /// of at least \p output_size bytes. - /// \param output_size The size of the output buffer in bytes. - /// See the function description regarding the output size. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// total input length too long, - /// unsupported input/output buffer overlap detected, - /// or \p output_size too small. - pub fn mbedtls_gcm_update( - ctx: *mut mbedtls_gcm_context, - input: *const ::core::ffi::c_uchar, - input_length: usize, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the GCM operation and generates - /// the authentication tag. + /// Set the key for a multipart authenticated decryption operation. /// - /// It wraps up the GCM stream, and generates the - /// tag. The tag can have a maximum length of 16 Bytes. + /// The sequence of operations to decrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call psa_aead_set_nonce() with the nonce for the decryption. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the ciphertext to decrypt each time. + /// -# Call psa_aead_verify(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to generate. This must be at least - /// four. - /// \param output The buffer for the final output. - /// If \p output_size is nonzero, this must be a writable - /// buffer of at least \p output_size bytes. - /// \param output_size The size of the \p output buffer in bytes. - /// This must be large enough for the output that - /// mbedtls_gcm_update() has not produced. In particular: - /// - If mbedtls_gcm_update() produces immediate output, - /// or if the total input size is a multiple of \c 16, - /// then mbedtls_gcm_finish() never produces any output, - /// so \p output_size can be \c 0. - /// - \p output_size never needs to be more than \c 15. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// invalid value of \p tag_len, - /// or \p output_size too small. - pub fn mbedtls_gcm_finish( - ctx: *mut mbedtls_gcm_context, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - tag: *mut ::core::ffi::c_uchar, - tag_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function clears a GCM context and the underlying - /// cipher sub-context. + /// After a successful call to psa_aead_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_verify(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context to clear. If this is \c NULL, the call has - /// no effect. Otherwise, this must be initialized. - pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief The GCM checkup routine. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; -/// For encrypt-decrypt functions, whether the operation is an encryption -/// or a decryption. -pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; -/// \brief MD5 context structure -/// -/// \warning MD5 is considered a weak message digest and its use -/// constitutes a security risk. We recommend considering -/// stronger message digests instead. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md5_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 4usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_md5_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize MD5 context + /// Generate a random nonce for an authenticated encryption operation. /// - /// \param ctx MD5 context to be initialized + /// This function generates a random nonce for the authenticated encryption + /// operation with an appropriate size for the chosen algorithm, key type + /// and key size. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief Clear MD5 context + /// The application must call psa_aead_encrypt_setup() before + /// calling this function. /// - /// \param ctx MD5 context to be cleared + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); + /// \param[in,out] operation Active AEAD operation. + /// \param[out] nonce Buffer where the generated nonce is to be + /// written. + /// \param nonce_size Size of the \p nonce buffer in bytes. + /// \param[out] nonce_length On success, the number of bytes of the + /// generated nonce. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p nonce buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active aead encrypt + /// operation, with no nonce set), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_generate_nonce( + operation: *mut psa_aead_operation_t, + nonce: *mut u8, + nonce_size: usize, + nonce_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) an MD5 context + /// Set the nonce for an authenticated encryption or decryption operation. /// - /// \param dst The destination context - /// \param src The context to be cloned + /// This function sets the nonce for the authenticated + /// encryption or decryption operation. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief MD5 context setup + /// The application must call psa_aead_encrypt_setup() or + /// psa_aead_decrypt_setup() before calling this function. /// - /// \param ctx context to be initialized + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \note When encrypting, applications should use psa_aead_generate_nonce() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] nonce Buffer containing the nonce to use. + /// \param nonce_length Size of the nonce in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p nonce is not acceptable for the chosen algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with no nonce + /// set), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_nonce( + operation: *mut psa_aead_operation_t, + nonce: *const u8, + nonce_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process buffer + /// Declare the lengths of the message and additional data for AEAD. /// - /// \param ctx MD5 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// The application must call this function before calling + /// psa_aead_update_ad() or psa_aead_update() if the algorithm for + /// the operation requires it. If the algorithm does not require it, + /// calling this function is optional, but if this function is called + /// then the implementation must enforce the lengths. /// - /// \return 0 if successful + /// You may call this function before or after setting the nonce with + /// psa_aead_set_nonce() or psa_aead_generate_nonce(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_update( - ctx: *mut mbedtls_md5_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief MD5 final digest + /// - For #PSA_ALG_CCM, calling this function is required. + /// - For the other AEAD algorithms defined in this specification, calling + /// this function is not required. + /// - For vendor-defined algorithm, refer to the vendor documentation. /// - /// \param ctx MD5 context - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \param[in,out] operation Active AEAD operation. + /// \param ad_length Size of the non-encrypted additional + /// authenticated data in bytes. + /// \param plaintext_length Size of the plaintext to encrypt in bytes. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_finish( - ctx: *mut mbedtls_md5_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// At least one of the lengths is not acceptable for the chosen + /// algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and + /// psa_aead_update_ad() and psa_aead_update() must not have been + /// called yet), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_lengths( + operation: *mut psa_aead_operation_t, + ad_length: usize, + plaintext_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process data block (internal use only) + /// Pass additional data to an active AEAD operation. /// - /// \param ctx MD5 context - /// \param data buffer holding one block of data + /// Additional data is authenticated, but not encrypted. /// - /// \return 0 if successful + /// You may call this function multiple times to pass successive fragments + /// of the additional data. You may not call this function after passing + /// data to encrypt or decrypt with psa_aead_update(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_internal_md5_process( - ctx: *mut mbedtls_md5_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = MD5( input buffer ) + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + /// treat the input as untrusted and prepare to undo any action that + /// depends on the input if psa_aead_verify() returns an error status. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the fragment of + /// additional data. + /// \param input_length Size of the \p input buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input length overflows the additional data length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, have lengths set if required by the algorithm, and + /// psa_aead_update() must not have been called yet), or the library + /// has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update_ad( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Encrypt or decrypt a message fragment in an active AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + /// 3. Call psa_aead_update_ad() to pass all the additional data. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief RIPEMD-160 context structure -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ripemd160_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 5usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_ripemd160_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize RIPEMD-160 context + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \param ctx RIPEMD-160 context to be initialized - pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); -} -unsafe extern "C" { - /// \brief Clear RIPEMD-160 context + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + /// - Do not use the output in any way other than storing it in a + /// confidential location. If you take any action that depends + /// on the tentative decrypted data, this action will need to be + /// undone if the input turns out not to be valid. Furthermore, + /// if an adversary can observe that this action took place + /// (for example through timing), they may be able to use this + /// fact as an oracle to decrypt any message encrypted with the + /// same key. + /// - In particular, do not copy the output anywhere but to a + /// memory or storage space that you have exclusive access to. /// - /// \param ctx RIPEMD-160 context to be cleared - pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); + /// This function does not require the input to be aligned to any + /// particular block boundary. If the implementation can only process + /// a whole block at a time, it must consume all the input provided, but + /// it may delay the end of the corresponding output until a subsequent + /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + /// provides sufficient input. The amount of data that can be delayed + /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + /// \c alg, \p input_length) where + /// \c key_type is the type of key and \c alg is + /// the algorithm that were used to set up the + /// operation. + /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + /// input_length) evaluates to the maximum + /// output size of any supported AEAD + /// algorithm. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total input length overflows the plaintext length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, and have lengths set if required by the algorithm), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) a RIPEMD-160 context + /// Finish encrypting a message in an AEAD operation. /// - /// \param dst The destination context - /// \param src The context to be cloned - pub fn mbedtls_ripemd160_clone( - dst: *mut mbedtls_ripemd160_context, - src: *const mbedtls_ripemd160_context, - ); -} -unsafe extern "C" { - /// \brief RIPEMD-160 context setup + /// The operation must have been set up with psa_aead_encrypt_setup(). /// - /// \param ctx context to be initialized + /// This function finishes the authentication of the additional data + /// formed by concatenating the inputs passed to preceding calls to + /// psa_aead_update_ad() with the plaintext formed by concatenating the + /// inputs passed to preceding calls to psa_aead_update(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process buffer + /// This function has two output buffers: + /// - \p ciphertext contains trailing ciphertext that was buffered from + /// preceding calls to psa_aead_update(). + /// - \p tag contains the authentication tag. /// - /// \param ctx RIPEMD-160 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_update( - ctx: *mut mbedtls_ripemd160_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[out] ciphertext Buffer where the last part of the ciphertext + /// is to be written. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] ciphertext_length On success, the number of bytes of + /// returned ciphertext. + /// \param[out] tag Buffer where the authentication tag is + /// to be written. + /// \param tag_size Size of the \p tag buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + /// key_type, \c key_bits, \c alg) where + /// \c key_type and \c key_bits are the type and + /// bit-size of the key, and \c alg is the + /// algorithm that were used in the call to + /// psa_aead_encrypt_setup(). + /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + /// maximum tag size of any supported AEAD + /// algorithm. + /// \param[out] tag_length On success, the number of bytes + /// that make up the returned tag. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p ciphertext or \p tag buffer is too small. + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + /// determine the required \p tag buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active encryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_finish( + operation: *mut psa_aead_operation_t, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + tag: *mut u8, + tag_size: usize, + tag_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief RIPEMD-160 final digest + /// Finish authenticating and decrypting a message in an AEAD operation. /// - /// \param ctx RIPEMD-160 context - /// \param output RIPEMD-160 checksum result + /// The operation must have been set up with psa_aead_decrypt_setup(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_finish( - ctx: *mut mbedtls_ripemd160_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process data block (internal use only) + /// This function finishes the authenticated decryption of the message + /// components: /// - /// \param ctx RIPEMD-160 context - /// \param data buffer holding one block of data + /// - The additional data consisting of the concatenation of the inputs + /// passed to preceding calls to psa_aead_update_ad(). + /// - The ciphertext consisting of the concatenation of the inputs passed to + /// preceding calls to psa_aead_update(). + /// - The tag passed to this function call. /// - /// \return 0 if successful - pub fn mbedtls_internal_ripemd160_process( - ctx: *mut mbedtls_ripemd160_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = RIPEMD-160( input buffer ) + /// If the authentication tag is correct, this function outputs any remaining + /// plaintext and reports success. If the authentication tag is not correct, + /// this function returns #PSA_ERROR_INVALID_SIGNATURE. /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output RIPEMD-160 checksum result + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual tag and the expected tag is performed + /// in constant time. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[out] plaintext Buffer where the last part of the plaintext + /// is to be written. This is the remaining data + /// from previous calls to psa_aead_update() + /// that could not be processed until the end + /// of the input. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] plaintext_length On success, the number of bytes of + /// returned plaintext. + /// \param[in] tag Buffer containing the authentication tag. + /// \param tag_length Size of the \p tag buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculations were successful, but the authentication tag is + /// not correct. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p plaintext buffer is too small. + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + /// required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active decryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_verify( + operation: *mut psa_aead_operation_t, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + tag: *const u8, + tag_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Abort an AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed - pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha1_context { - pub work_area: [::core::ffi::c_uchar; 208usize], -} -impl Default for mbedtls_sha1_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_aead_operation_t. + /// + /// In particular, calling psa_aead_abort() after the operation has been + /// terminated by a call to psa_aead_abort(), psa_aead_finish() or + /// psa_aead_verify() is safe and has no effect. + /// + /// \param[in,out] operation Initialized AEAD operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-1 context. - /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \brief Sign a message with a private key. For hash-and-sign algorithms, + /// this includes the hashing step. /// - /// \param ctx The SHA-1 context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-1 context. + /// \note To perform a multi-part hash-and-sign signature algorithm, first use + /// a multi-part hash operation and then pass the resulting hash to + /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + /// hash algorithm to use. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in] key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The input message to sign. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param[in] signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. /// - /// \param ctx The SHA-1 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it is - /// not \c NULL, it must point to an initialized - /// SHA-1 context. - pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-1 context. + /// \brief Verify the signature of a message with a public key, using + /// a hash-and-sign verification algorithm. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \note To perform a multi-part hash-and-sign signature verification + /// algorithm, first use a multi-part hash operation to hash the message + /// and then pass the resulting hash to psa_verify_hash(). + /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + /// to use. /// - /// \param dst The SHA-1 context to clone to. This must be initialized. - /// \param src The SHA-1 context to clone from. This must be initialized. - pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); + /// \param[in] key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The message whose signature is to be verified. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed signature + /// is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-1 checksum calculation. + /// \brief Sign a hash or short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context to initialize. This must be initialized. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. + /// \param[out] signature_length On success, the number of bytes + /// that make up the returned signature value. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing SHA-1 - /// checksum calculation. + /// \brief Verify the signature of a hash or short message using a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. + /// \param key Identifier of the key to use for the operation. It + /// must be a public key or an asymmetric key pair. The + /// key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message whose signature is to be + /// verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_update( - ctx: *mut mbedtls_sha1_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// The signature is valid. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the SHA-1 operation, and writes - /// the result to the output buffer. + /// \brief Encrypt a short message with a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized and - /// have a hash operation started. - /// \param output The SHA-1 checksum result. This must be a writable - /// buffer of length \c 20 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the encrypted message is to + /// be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_finish( - ctx: *mut mbedtls_sha1_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief SHA-1 process data block (internal use only). + /// \brief Decrypt a short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. It must + /// allow the usage #PSA_KEY_USAGE_DECRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized. - /// \param data The data block being processed. This must be a - /// readable buffer of length \c 64 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha1_process( - ctx: *mut mbedtls_sha1_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for key derivation operations. +/// +/// Before calling any function on a key derivation operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_key_derivation_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, +/// for example: +/// \code +/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_key_derivation_operation_init() +/// to the structure, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// operation = psa_key_derivation_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_key_derivation_operation_t = psa_key_derivation_s; unsafe extern "C" { - /// \brief This function calculates the SHA-1 checksum of a buffer. + /// Set up a key derivation operation. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// A key derivation algorithm takes some inputs and uses them to generate + /// a byte stream in a deterministic way. + /// This byte stream can be used to produce keys and other + /// cryptographic material. /// - /// The SHA-1 result is calculated as - /// output = SHA-1(input buffer). + /// To derive a key: + /// -# Start with an initialized object of type #psa_key_derivation_operation_t. + /// -# Call psa_key_derivation_setup() to select the algorithm. + /// -# Provide the inputs for the key derivation by calling + /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + /// as appropriate. Which inputs are needed, in what order, and whether + /// they may be keys and if so of what type depends on the algorithm. + /// -# Optionally set the operation's maximum capacity with + /// psa_key_derivation_set_capacity(). You may do this before, in the middle + /// of or after providing inputs. For some algorithms, this step is mandatory + /// because the output depends on the maximum capacity. + /// -# To derive a key, call psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// To derive a byte string for a different purpose, call + /// psa_key_derivation_output_bytes(). + /// Successive calls to these functions use successive output bytes + /// calculated by the key derivation algorithm. + /// -# Clean up the key derivation operation object with + /// psa_key_derivation_abort(). /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// If this function returns an error, the key derivation operation object is + /// not changed. /// - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. - /// \param output The SHA-1 checksum result. - /// This must be a writable buffer of length \c 20 Bytes. + /// If an error occurs at any step after a call to psa_key_derivation_setup(), + /// the operation will need to be reset by a call to psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-1 checkup routine. + /// Implementations must reject an attempt to derive a key of size 0. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in,out] operation The key derivation operation object + /// to set up. It must + /// have been initialized but not set up yet. + /// \param alg The key derivation algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha256_context { - pub work_area: [::core::ffi::c_uchar; 208usize], - pub is224: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha256_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c alg is not a key derivation algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_setup( + operation: *mut psa_key_derivation_operation_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-256 context. + /// Retrieve the current capacity of a key derivation operation. /// - /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. - pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-256 context. + /// The capacity of a key derivation is the maximum number of bytes that it can + /// return. When you get *N* bytes of output from a key derivation operation, + /// this reduces its capacity by *N*. /// - /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which - /// case this function returns immediately. If it is not \c NULL, - /// it must point to an initialized SHA-256 context. - pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clones the state of a SHA-256 context. + /// \param[in] operation The operation to query. + /// \param[out] capacity On success, the capacity of the operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha256_clone( - dst: *mut mbedtls_sha256_context, - src: *const mbedtls_sha256_context, - ); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_get_capacity( + operation: *const psa_key_derivation_operation_t, + capacity: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-224 or SHA-256 checksum - /// calculation. + /// Set the maximum capacity of a key derivation operation. /// - /// \param ctx The context to use. This must be initialized. - /// \param is224 This determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// The capacity of a key derivation operation is the maximum number of bytes + /// that the key derivation operation can return from this point onwards. /// - /// \note is224 must be defined accordingly to the enabled - /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to modify. + /// \param capacity The new capacity of the operation. + /// It must be less or equal to the operation's + /// current capacity. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_starts( - ctx: *mut mbedtls_sha256_context, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p capacity is larger than the operation's current capacity. + /// In this case, the operation object remains valid and its capacity + /// remains unchanged. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_set_capacity( + operation: *mut psa_key_derivation_operation_t, + capacity: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-256 checksum calculation. + /// Provide an input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_update( - ctx: *mut mbedtls_sha256_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-256 operation, and writes - /// the result to the output buffer. + /// This function passes direct inputs, which is usually correct for + /// non-secret inputs. To pass a secret input, which should be in a key + /// object, call psa_key_derivation_input_key() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_finish( - ctx: *mut mbedtls_sha256_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] data Input data to use. + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow direct inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_bytes( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + data: *const u8, + data_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-256 computation. This function is for - /// internal use only. + /// Provide a numeric input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized. - /// \param data The buffer holding one block of data. This must - /// be a readable buffer of length \c 64 Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// However, when an algorithm requires a particular order, numeric inputs + /// usually come first as they tend to be configuration parameters. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha256_process( - ctx: *mut mbedtls_sha256_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// This function is used for inputs which are fixed-size non-negative + /// integers. + /// + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] value The value of the numeric input. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow numeric inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_integer( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + value: u64, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function calculates the SHA-224 or SHA-256 - /// checksum of a buffer. + /// Provide an input for key derivation in the form of a key. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// The SHA-256 result is calculated as - /// output = SHA-256(input buffer). + /// This function obtains input from a key object, which is usually correct for + /// secret inputs or for non-secret personalization strings kept in the key + /// store. To pass a non-secret parameter which is not in the key store, + /// call psa_key_derivation_input_bytes() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. - /// \param is224 Determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param key Identifier of the key. It must have an + /// appropriate type for step and must allow the + /// usage #PSA_KEY_USAGE_DERIVE or + /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + /// and the algorithm used by the operation. + /// + /// \note Once all inputs steps are completed, the operations will allow: + /// - psa_key_derivation_output_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + /// if the input for step + /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_verify_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + /// - psa_key_derivation_verify_key() under the same conditions as + /// psa_key_derivation_verify_bytes(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key allows neither #PSA_KEY_USAGE_DERIVE nor + /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + /// algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow key inputs of the given type + /// or does not allow key inputs at all. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_key( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + key: mbedtls_svc_key_id_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief The SHA-224 checkup routine. + /// Perform a key agreement and use the shared secret as input to a key + /// derivation. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-256 checkup routine. + /// A key agreement algorithm takes two inputs: a private key \p private_key + /// a public key \p peer_key. + /// The result of this function is passed as input to a key derivation. + /// The output of this key derivation can be extracted by reading from the + /// resulting operation to produce keys and other cryptographic material. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha512_context { - pub work_area: [::core::ffi::c_uchar; 304usize], - pub is384: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha512_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief This function initializes a SHA-512 context. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \param ctx The SHA-512 context to initialize. This must - /// not be \c NULL. - pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-512 context. + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() with a + /// key agreement and derivation algorithm + /// \c alg (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + /// is false). + /// The operation must be ready for an + /// input of the type given by \p step. + /// \param step Which step the input data is for. + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. The peer key must be in the + /// same format that psa_import_key() accepts for the + /// public key type corresponding to the type of + /// private_key. That is, this function performs the + /// equivalent of + /// #psa_import_key(..., + /// `peer_key`, `peer_key_length`) where + /// with key attributes indicating the public key + /// type corresponding to the type of `private_key`. + /// For example, for EC keys, this means that peer_key + /// is interpreted as a point on the curve that the + /// private key is on. The standard formats for public + /// keys are documented in the documentation of + /// psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. /// - /// \param ctx The SHA-512 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must point to an initialized - /// SHA-512 context. - pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c private_key is not compatible with \c alg, + /// or \p peer_key is not valid for \c alg or not compatible with + /// \c private_key, or \c step does not allow an input resulting + /// from a key agreement. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this key agreement \p step, + /// or the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_key_agreement( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-512 context. + /// Read some data from a key derivation operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha512_clone( - dst: *mut mbedtls_sha512_context, - src: *const mbedtls_sha512_context, - ); -} -unsafe extern "C" { - /// \brief This function starts a SHA-384 or SHA-512 checksum - /// calculation. + /// This function calculates output bytes from a key derivation algorithm and + /// return those bytes. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the requested number of bytes from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context to use. This must be initialized. - /// \param is384 Determines which function to use. This must be - /// either \c 0 for SHA-512, or \c 1 for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \note is384 must be defined accordingly to the enabled - /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] output Buffer where the output will be written. + /// \param output_length Number of bytes to output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_starts( - ctx: *mut mbedtls_sha512_context, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// no output is written to the output buffer. + /// The operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_bytes( + operation: *mut psa_key_derivation_operation_t, + output: *mut u8, + output_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-512 checksum calculation. + /// Derive a key from an ongoing key derivation operation. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. This must - /// be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// This function calculates output bytes from a key derivation algorithm + /// and uses those bytes to generate a key deterministically. + /// The key's location, usage policy, type and size are taken from + /// \p attributes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_update( - ctx: *mut mbedtls_sha512_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-512 operation, and writes - /// the result to the output buffer. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads as many bytes as required from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_finish( - ctx: *mut mbedtls_sha512_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-512 computation. - /// This function is for internal use only. + /// How much output is produced and consumed from the operation, and how + /// the key is derived, depends on the key type and on the key size + /// (denoted \c bits below): /// - /// \param ctx The SHA-512 context. This must be initialized. - /// \param data The buffer holding one block of data. This - /// must be a readable buffer of length \c 128 Bytes. + /// - For key types for which the key is an arbitrary sequence of bytes + /// of a given size, this function is functionally equivalent to + /// calling #psa_key_derivation_output_bytes + /// and passing the resulting output to #psa_import_key. + /// However, this function has a security benefit: + /// if the implementation provides an isolation boundary then + /// the key material is not exposed outside the isolation boundary. + /// As a consequence, for these key types, this function always consumes + /// exactly (\c bits / 8) bytes from the operation. + /// The following key types defined in this specification follow this scheme: /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha512_process( - ctx: *mut mbedtls_sha512_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function calculates the SHA-512 or SHA-384 - /// checksum of a buffer. + /// - #PSA_KEY_TYPE_AES; + /// - #PSA_KEY_TYPE_ARIA; + /// - #PSA_KEY_TYPE_CAMELLIA; + /// - #PSA_KEY_TYPE_DERIVE; + /// - #PSA_KEY_TYPE_HMAC; + /// - #PSA_KEY_TYPE_PASSWORD_HASH. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// - For ECC keys on a Montgomery elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Montgomery curve), this function always draws a byte string whose + /// length is determined by the curve, and sets the mandatory bits + /// accordingly. That is: /// - /// The SHA-512 result is calculated as - /// output = SHA-512(input buffer). + /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + /// string and process it as specified in RFC 7748 §5. + /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + /// string and process it as specified in RFC 7748 §5. /// - /// \param input The buffer holding the input data. This must be - /// a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. - /// \param is384 Determines which function to use. This must be either - /// \c 0 for SHA-512, or \c 1 for SHA-384. + /// - For key types for which the key is represented by a single sequence of + /// \c bits bits with constraints as to which bit sequences are acceptable, + /// this function draws a byte string of length (\c bits / 8) bytes rounded + /// up to the nearest whole number of bytes. If the resulting byte string + /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + /// This process is repeated until an acceptable byte string is drawn. + /// The byte string drawn from the operation is interpreted as specified + /// for the output produced by psa_export_key(). + /// The following key types defined in this specification follow this scheme: /// - /// \note is384 must be defined accordingly with the supported - /// symbols in the config file. If: - /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or - /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined - /// then the function will return - /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// - #PSA_KEY_TYPE_DES. + /// Force-set the parity bits, but discard forbidden weak keys. + /// For 2-key and 3-key triple-DES, the three keys are generated + /// successively (for example, for 3-key triple-DES, + /// if the first 8 bytes specify a weak key and the next 8 bytes do not, + /// discard the first 8 bytes, use the next 8 bytes as the first key, + /// and continue reading output from the operation to derive the other + /// two keys). + /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + /// where \c group designates any Diffie-Hellman group) and + /// ECC keys on a Weierstrass elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Weierstrass curve). + /// For these key types, interpret the byte string as integer + /// in big-endian order. Discard it if it is not in the range + /// [0, *N* - 2] where *N* is the boundary of the private key domain + /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + /// or the order of the curve's base point for ECC). + /// Add 1 to the resulting integer and use this as the private key *x*. + /// This method allows compliance to NIST standards, specifically + /// the methods titled "key-pair generation by testing candidates" + /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + /// in FIPS 186-4 §B.1.2 for DSA, and + /// in NIST SP 800-56A §5.6.1.2.2 or + /// FIPS 186-4 §B.4.2 for elliptic curve keys. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-384 checkup routine. + /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + /// the way in which the operation output is consumed is + /// implementation-defined. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-512 checkup routine. + /// In all cases, the data that is read is discarded from the operation. + /// The operation's capacity is decreased by the number of bytes read. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hash_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub md5: mbedtls_md5_context, - pub ripemd160: mbedtls_ripemd160_context, - pub sha1: mbedtls_sha1_context, - pub sha256: mbedtls_sha256_context, - pub sha512: mbedtls_sha512_context, -} -impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_hash_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_cipher_operation_t { - pub private_alg: psa_algorithm_t, - pub private_iv_length: u8, - pub private_block_length: u8, - pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_cipher: mbedtls_cipher_context_t, -} -impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_cipher_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_hash_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_hash_operation_t, -} -impl Default for psa_driver_hash_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_cipher_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, -} -impl Default for psa_driver_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_hash_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h. - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. the driver context is not active, in use). - pub private_id: ::core::ffi::c_uint, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_hash_context_t, -} -impl Default for psa_hash_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_cipher_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_default_iv_length: u8, - pub private_ctx: psa_driver_cipher_context_t, + /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + /// the input to that step must be provided with psa_key_derivation_input_key(). + /// Future versions of this specification may include additional restrictions + /// on the derived key based on the attributes and strength of the secret key. + /// + /// \note This function is equivalent to calling + /// psa_key_derivation_output_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for psa_cipher_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// See the description of psa_key_derivation_out_key() for the operation of + /// this function with the default production parameters. + /// Mbed TLS currently does not currently support any non-default production + /// parameters. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_custom( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl psa_cipher_operation_s { - #[inline] - pub fn private_iv_required(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_iv_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_iv_required: ::core::ffi::c_uint, - private_iv_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; - private_iv_required as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; - private_iv_set as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] params Customization parameters for the key derivation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// Mbed TLS currently only supports the default + /// production parameters, i.e. + /// #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + /// for all key types. + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_ext( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hmac_operation_t { - /// The HMAC algorithm in use - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - /// The hash context. - pub hash_ctx: psa_hash_operation_s, - /// The HMAC part of the context. - pub private_opad: [u8; 128usize], +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value in constant time. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the expected number of bytes from the + /// stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to the following code: + /// \code + /// psa_key_derivation_output_bytes(operation, tmp, output_length); + /// if (memcmp(output, tmp, output_length) != 0) + /// return PSA_ERROR_INVALID_SIGNATURE; + /// \endcode + /// except (1) it works even if the key's policy does not allow outputting the + /// bytes, and (2) the comparison will be done in constant time. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected Buffer containing the expected derivation output. + /// \param expected_length Length of the expected output; this is also the + /// number of bytes that will be read. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but it differs from the expected + /// output. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_bytes( + operation: *mut psa_key_derivation_operation_t, + expected: *const u8, + expected_length: usize, + ) -> psa_status_t; } -impl Default for mbedtls_psa_hmac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value + /// stored in a key object. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value, provided as key of type + /// #PSA_KEY_TYPE_PASSWORD_HASH. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the number of bytes corresponding to the + /// length of the expected value from the stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to exporting the key and calling + /// psa_key_derivation_verify_bytes() on the result, except that it + /// works even if the key cannot be exported. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + /// containing the expected output. Its policy must + /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + /// and the permitted algorithm must match the + /// operation. The value of this key was likely + /// computed by a previous call to + /// psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but if differs from the expected + /// output. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// The key passed as the expected value does not exist. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key passed as the expected value has an invalid type. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key passed as the expected value does not allow this usage or + /// this algorithm; or one of the inputs was a key whose policy didn't + /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// the length of the expected value. In this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_key( + operation: *mut psa_key_derivation_operation_t, + expected: psa_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_mac_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// Abort a key derivation operation. + /// + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_key_derivation_setup() again. + /// + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_key_derivation_operation_t. + /// + /// In particular, it is valid to call psa_key_derivation_abort() twice, or to + /// call psa_key_derivation_abort() on an operation that has not been set up. + /// + /// \param[in,out] operation The operation to abort. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) + -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_hmac: mbedtls_psa_hmac_operation_t, - pub private_cmac: mbedtls_cipher_context_t, +unsafe extern "C" { + /// Perform a key agreement and return the raw shared secret. + /// + /// \warning The raw result of a key agreement algorithm such as finite-field + /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + /// not be used directly as key material. It should instead be passed as + /// input to a key derivation algorithm. To chain a key agreement with + /// a key derivation, use psa_key_derivation_key_agreement() and other + /// functions from the key derivation interface. + /// + /// \param alg The key agreement algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + /// is true). + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. It must be + /// in the same format that psa_import_key() + /// accepts. The standard formats for public + /// keys are documented in the documentation + /// of psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a key agreement algorithm, or + /// \p private_key is not compatible with \p alg, + /// or \p peer_key is not valid for \p alg or not compatible with + /// \p private_key. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p output_size is too small + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not a supported key agreement algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_raw_key_agreement( + alg: psa_algorithm_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Generate random bytes. + /// + /// \warning This function **can** fail! Callers MUST check the return status + /// and MUST NOT use the content of the output buffer if the return + /// status is not #PSA_SUCCESS. + /// + /// \note To generate a key, use psa_generate_key() instead. + /// + /// \param[out] output Output buffer for the generated data. + /// \param output_size Number of bytes to generate and output. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair. + /// + /// The key is generated randomly. + /// Its location, usage policy, type and size are taken from \p attributes. + /// + /// Implementations must reject an attempt to generate a key of size 0. + /// + /// The following type-specific considerations apply: + /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + /// the public exponent is 65537. + /// The modulus is a product of two probabilistic primes + /// between 2^{n-1} and 2^n where n is the bit size specified in the + /// attributes. + /// + /// \note This function is equivalent to calling psa_generate_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key( + attributes: *const psa_key_attributes_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// See the description of psa_generate_key() for the operation of this + /// function with the default production parameters. In addition, this function + /// supports the following production customizations, described in more detail + /// in the documentation of ::psa_custom_key_parameters_t: + /// + /// - RSA keys: generation with a custom public exponent. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_custom( + attributes: *const psa_key_attributes_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_aead_operation_t { - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_tag_length: u8, - pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] params Customization parameters for the key generation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_ext( + attributes: *const psa_key_attributes_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub private_ccm: mbedtls_ccm_context, - pub private_gcm: mbedtls_gcm_context, - pub private_chachapoly: mbedtls_chachapoly_context, +/// The type of the state data structure for interruptible hash +/// signing operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = +/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_sign_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// operation = psa_sign_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; +/// The type of the state data structure for interruptible hash +/// verification operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = +/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_verify_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// operation = psa_verify_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; +unsafe extern "C" { + /// \brief Set the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note The time taken to execute a single op is + /// implementation specific and depends on + /// software, hardware, the algorithm, key type and + /// curve chosen. Even within a single operation, + /// successive ops can take differing amounts of + /// time. The only guarantee is that lower values + /// for \p max_ops means functions will block for a + /// lesser maximum amount of time. The functions + /// \c psa_sign_interruptible_get_num_ops() and + /// \c psa_verify_interruptible_get_num_ops() are + /// provided to help with tuning this value. + /// + /// \note This value defaults to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + /// means the whole operation will be done in one + /// go, regardless of the number of ops required. + /// + /// \note If more ops are needed to complete a + /// computation, #PSA_OPERATION_INCOMPLETE will be + /// returned by the function performing the + /// computation. It is then the caller's + /// responsibility to either call again with the + /// same operation context until it returns 0 or an + /// error code; or to call the relevant abort + /// function if the answer is no longer required. + /// + /// \note The interpretation of \p max_ops is also + /// implementation defined. On a hard real time + /// system, this can indicate a hard deadline, as a + /// real-time system needs a guarantee of not + /// spending more than X time, however care must be + /// taken in such an implementation to avoid the + /// situation whereby calls just return, not being + /// able to do any actual work within the allotted + /// time. On a non-real-time system, the + /// implementation can be more relaxed, but again + /// whether this number should be interpreted as as + /// hard or soft limit or even whether a less than + /// or equals as regards to ops executed in a + /// single call is implementation defined. + /// + /// \note For keys in local storage when no accelerator + /// driver applies, please see also the + /// documentation for \c mbedtls_ecp_set_max_ops(), + /// which is the internal implementation in these + /// cases. + /// + /// \warning With implementations that interpret this number + /// as a hard limit, setting this number too small + /// may result in an infinite loop, whereby each + /// call results in immediate return with no ops + /// done (as there is not enough time to execute + /// any), and thus no result will ever be achieved. + /// + /// \note This only applies to functions whose + /// documentation mentions they may return + /// #PSA_OPERATION_INCOMPLETE. + /// + /// \param max_ops The maximum number of ops to be executed in a + /// single call. This can be a number from 0 to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + /// is the least amount of work done per call. + pub fn psa_interruptible_set_max_ops(max_ops: u32); } -impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. This will return the last + /// value set by + /// \c psa_interruptible_set_max_ops() or + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + /// that function has never been called. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \return Maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + pub fn psa_interruptible_get_max_ops() -> u32; } -impl Default for mbedtls_psa_aead_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash signing + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling + /// \c psa_sign_hash_interruptible_abort() on + /// the operation, a value of 0 will be returned. + /// + /// \note This interface is guaranteed re-entrant and + /// thus may be called from driver code. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_sign_hash_get_num_ops( + operation: *const psa_sign_hash_interruptible_operation_t, + ) -> u32; } -impl mbedtls_psa_aead_operation_t { - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash verification + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling \c + /// psa_verify_hash_interruptible_abort() on the + /// operation, a value of 0 will be returned. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c + /// psa_verify_hash_interruptible_operation_t to + /// use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_verify_hash_get_num_ops( + operation: *const psa_verify_hash_interruptible_operation_t, + ) -> u32; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_sign_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Start signing a hash or short message with a + /// private key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_complete() is equivalent to + /// \c psa_sign_hash() but + /// \c psa_sign_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call \c psa_sign_hash_complete() + /// repeatedly on the same context after a + /// successful call to this function until \c + /// psa_sign_hash_complete() either returns 0 or an + /// error. \c psa_sign_hash_complete() will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - call \c psa_sign_hash_complete() + /// with the same context to complete the operation + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + /// not permit the requested algorithm. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation has previously been started on this context, and is + /// still in progress. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_start( + operation: *mut psa_sign_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_verify_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Continue and eventually complete the action of + /// signing a hash or short message with a private + /// key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_start() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_start() is equivalent to + /// \c psa_sign_hash() but this function can return + /// early and resume according to the limit set with + /// \c psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_sign_hash_start() called with it + /// first. + /// + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + /// key_bits, \c alg) where \c key_type and \c + /// key_bits are the type and bit-size + /// respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. + /// + /// \retval #PSA_SUCCESS + /// Operation completed successfully + /// + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \c key. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_sign_hash_start(). + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_sign_hash_start() with this operation object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_sign_hash_complete( + operation: *mut psa_sign_hash_interruptible_operation_t, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } -///< Client -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; -///< Server -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; -/// Roles in the EC J-PAKE exchange -pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; -/// EC J-PAKE context structure. -/// -/// J-PAKE is a symmetric protocol, except for the identifiers used in -/// Zero-Knowledge Proofs, and the serialization of the second message -/// (KeyExchange) as defined by the Thread spec. -/// -/// In order to benefit from this symmetry, we choose a different naming -/// convention from the Thread v1.0 spec. Correspondence is indicated in the -/// description as a pair C: client name, S: server name -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecjpake_context { - ///< Hash to use - pub private_md_type: mbedtls_md_type_t, - ///< Elliptic curve - pub private_grp: mbedtls_ecp_group, - ///< Are we client or server? - pub private_role: mbedtls_ecjpake_role, - ///< Format for point export - pub private_point_format: ::core::ffi::c_int, - ///< My public key 1 C: X1, S: X3 - pub private_Xm1: mbedtls_ecp_point, - ///< My public key 2 C: X2, S: X4 - pub private_Xm2: mbedtls_ecp_point, - ///< Peer public key 1 C: X3, S: X1 - pub private_Xp1: mbedtls_ecp_point, - ///< Peer public key 2 C: X4, S: X2 - pub private_Xp2: mbedtls_ecp_point, - ///< Peer public key C: Xs, S: Xc - pub private_Xp: mbedtls_ecp_point, - ///< My private key 1 C: x1, S: x3 - pub private_xm1: mbedtls_mpi, - ///< My private key 2 C: x2, S: x4 - pub private_xm2: mbedtls_mpi, - ///< Pre-shared secret (passphrase) - pub private_s: mbedtls_mpi, +unsafe extern "C" { + /// \brief Abort a sign hash operation. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function is the only function that clears + /// the number of ops completed as part of the + /// operation. Please ensure you copy this value via + /// \c psa_sign_hash_get_num_ops() if required + /// before calling. + /// + /// \note Aborting an operation frees all associated + /// resources except for the \p operation structure + /// itself. Once aborted, the operation object can + /// be reused for another operation by calling \c + /// psa_sign_hash_start() again. + /// + /// \note You may call this function any time after the + /// operation object has been initialized. In + /// particular, calling \c psa_sign_hash_abort() + /// after the operation has already been terminated + /// by a call to \c psa_sign_hash_abort() or + /// psa_sign_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized sign hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_abort( + operation: *mut psa_sign_hash_interruptible_operation_t, + ) -> psa_status_t; } -impl Default for mbedtls_ecjpake_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Start reading and verifying a hash or short + /// message, in an interruptible manner. + /// + /// \see \c psa_verify_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_verify_hash_complete() is equivalent to + /// \c psa_verify_hash() but \c + /// psa_verify_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function. + /// + /// \note Users should call \c psa_verify_hash_complete() + /// repeatedly on the same operation object after a + /// successful call to this function until \c + /// psa_verify_hash_complete() either returns 0 or + /// an error. \c psa_verify_hash_complete() will + /// return #PSA_OPERATION_INCOMPLETE if there is + /// more work to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_verify_hash_abort(). + /// + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash whose signature is to be verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - please call \c + /// psa_verify_hash_complete() with the same context to complete the + /// operation. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// Another operation has already been started on this context, and is + /// still in progress. + /// + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + /// not permit the requested algorithm. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_start( + operation: *mut psa_verify_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize an ECJPAKE context. + /// \brief Continue and eventually complete the action of + /// reading and verifying a hash or short message + /// signed with a private key, in an interruptible + /// manner. /// - /// \param ctx The ECJPAKE context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); -} -unsafe extern "C" { - /// \brief Set up an ECJPAKE context for use. + /// \see \c psa_verify_hash_start() /// - /// \note Currently the only values for hash/curve allowed by the - /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. /// - /// \param ctx The ECJPAKE context to set up. This must be initialized. - /// \param role The role of the caller. This must be either - /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. - /// \param hash The identifier of the hash function to use, - /// for example #MBEDTLS_MD_SHA256. - /// \param curve The identifier of the elliptic curve to use, - /// for example #MBEDTLS_ECP_DP_SECP256R1. - /// \param secret The pre-shared secret (passphrase). This must be - /// a readable not empty buffer of length \p len Bytes. It need - /// only be valid for the duration of this call. - /// \param len The length of the pre-shared secret \p secret. + /// \note This function combined with \c + /// psa_verify_hash_start() is equivalent to + /// \c psa_verify_hash() but this function can + /// return early and resume according to the limit + /// set with \c psa_interruptible_set_max_ops() to + /// reduce the maximum time spent in a function + /// call. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_setup( - ctx: *mut mbedtls_ecjpake_context, - role: mbedtls_ecjpake_role, - hash: mbedtls_md_type_t, - curve: mbedtls_ecp_group_id, - secret: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the point format for future reads and writes. + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. /// - /// \param ctx The ECJPAKE context to configure. - /// \param point_format The point format to use: - /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) - /// or #MBEDTLS_ECP_PF_COMPRESSED. + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_verify_hash_abort(). /// - /// \return \c 0 if successful. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format - /// is invalid. - pub fn mbedtls_ecjpake_set_point_format( - ctx: *mut mbedtls_ecjpake_context, - point_format: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if an ECJPAKE context is ready for use. + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_verify_hash_start() called with it + /// first. /// - /// \param ctx The ECJPAKE context to check. This must be - /// initialized. + /// \retval #PSA_SUCCESS + /// Operation completed successfully, and the passed signature is valid. /// - /// \return \c 0 if the context is ready for use. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. - pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_verify_hash_start(). + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_verify_hash_start() on this object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_verify_hash_complete( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate and write the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \brief Abort a verify hash operation. /// - /// \param ctx The ECJPAKE context to use. This must be - /// initialized and set up. - /// \param buf The buffer to write the contents to. This must be a - /// writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number - /// of Bytes written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \warning This is a beta API, and thus subject to change at + /// any point. It is not bound by the usual interface + /// stability promises. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Read and process the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \note This function is the only function that clears the + /// number of ops completed as part of the operation. + /// Please ensure you copy this value via + /// \c psa_verify_hash_get_num_ops() if required + /// before calling. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up. - /// \param buf The buffer holding the first round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// \note Aborting an operation frees all associated + /// resources except for the operation structure + /// itself. Once aborted, the operation object can be + /// reused for another operation by calling \c + /// psa_verify_hash_start() again. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \note You may call this function any time after the + /// operation object has been initialized. + /// In particular, calling \c psa_verify_hash_abort() + /// after the operation has already been terminated by + /// a call to \c psa_verify_hash_abort() or + /// psa_verify_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized verify hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_abort( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } +pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// \brief Generate and write the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Open a handle to an existing persistent key. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up, and already have performed round one. - /// \param buf The buffer to write the round two contents to. - /// This must be a writable buffer of length \p len Bytes. - /// \param len The size of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Open a handle to a persistent key. A key is persistent if it was created + /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + /// always has a nonzero key identifier, set with psa_set_key_id() when + /// creating the key. Implementations may provide additional pre-provisioned + /// keys that can be opened with psa_open_key(). Such keys have an application + /// key identifier in the vendor range, as documented in the description of + /// #psa_key_id_t. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// The application must eventually close the handle with psa_close_key() or + /// psa_destroy_key() to release associated resources. If the application dies + /// without calling one of these functions, the implementation should perform + /// the equivalent of a call to psa_close_key(). + /// + /// Some implementations permit an application to open the same key multiple + /// times. If this is successful, each call to psa_open_key() will return a + /// different key handle. + /// + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. + /// + /// \note Applications that rely on opening a key multiple times will not be + /// portable to implementations that only permit a single key handle to be + /// opened. See also :ref:\`key-handles\`. + /// + /// + /// \param key The persistent identifier of the key. + /// \param[out] handle On success, a handle to the key. + /// + /// \retval #PSA_SUCCESS + /// Success. The application can now use the value of `*handle` + /// to access the key. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY + /// The implementation does not have sufficient resources to open the + /// key. This can be due to reaching an implementation limit on the + /// number of open keys, the number of open key handles, or available + /// memory. + /// \retval #PSA_ERROR_DOES_NOT_EXIST + /// There is no persistent key with key identifier \p key. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid persistent key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The specified key exists, but the application does not have the + /// permission to access it. Note that this specification does not + /// define any way to create such a key, but it may be possible + /// through implementation-specific means. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Read and process the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Close a key handle. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up and already have performed round one. - /// \param buf The buffer holding the second round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// If the handle designates a volatile key, this will destroy the key material + /// and free all associated resources, just like psa_destroy_key(). /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Derive the shared secret - /// (TLS: Pre-Master Secret). + /// If this is the last open handle to a persistent key, then closing the handle + /// will free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and can be opened again later + /// with a call to psa_open_key(). /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Closing the key handle makes the handle invalid, and the key handle + /// must not be used again by the application. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_derive_secret( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write the shared key material to be passed to a Key - /// Derivation Function as described in RFC8236. + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \note If the key handle was used to set up an active + /// :ref:\`multipart operation \`, then closing the + /// key handle can cause the multipart operation to fail. Applications should + /// maintain the key handle until after the multipart operation has finished. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_shared_key( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This clears an ECJPAKE context and frees any - /// embedded data structure. + /// \param handle The key handle to close. + /// If this is \c 0, do nothing and return \c PSA_SUCCESS. /// - /// \param ctx The ECJPAKE context to free. This may be \c NULL, - /// in which case this function does nothing. If it is not - /// \c NULL, it must point to an initialized ECJPAKE context. - pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); + /// \retval #PSA_SUCCESS + /// \p handle was a valid handle or \c 0. It is now closed. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p handle is not a valid handle nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// \brief Library deinitialization. /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_pake_operation_t { - pub private_alg: psa_algorithm_t, - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: u8, - pub private_buffer: [u8; 336usize], - pub private_buffer_length: usize, - pub private_buffer_offset: usize, - pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_jpake: mbedtls_ecjpake_context, -} -impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_pake_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_mac_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_mac_operation_t, -} -impl Default for psa_driver_mac_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_aead_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_aead_operation_t, -} -impl Default for psa_driver_aead_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_sign_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, -} -impl Default for psa_driver_sign_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_verify_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, -} -impl Default for psa_driver_verify_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_pake_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_pake_operation_t, -} -impl Default for psa_driver_pake_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// This function clears all data associated with the PSA layer, + /// including the whole key store. + /// This function is not thread safe, it wipes every key slot regardless of + /// state and reader count. It should only be called when no slot is in use. + /// + /// This is an Mbed TLS extension. + pub fn mbedtls_psa_crypto_free(); } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. #[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_mac_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_mac_size: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_mac_context_t, +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_stats_s { + /// Number of slots containing key material for a volatile key. + pub private_volatile_slots: usize, + /// Number of slots containing key material for a key which is in + /// internal persistent storage. + pub private_persistent_slots: usize, + /// Number of slots containing a reference to a key in a + /// secure element. + pub private_external_slots: usize, + /// Number of slots which are occupied, but do not contain + /// key material yet. + pub private_half_filled_slots: usize, + /// Number of slots that contain cache data. + pub private_cache_slots: usize, + /// Number of slots that are not used for anything. + pub private_empty_slots: usize, + /// Number of slots that are locked. + pub private_locked_slots: usize, + /// Largest key id value among open keys in internal persistent storage. + pub private_max_open_internal_key_id: psa_key_id_t, + /// Largest key id value among open keys in secure elements. + pub private_max_open_external_key_id: psa_key_id_t, } -impl Default for psa_mac_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. +pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; +unsafe extern "C" { + /// \brief Get statistics about + /// resource consumption related to the PSA keystore. + /// + /// \note When Mbed TLS is built as part of a service, with isolation + /// between the application and the keystore, the service may or + /// may not expose this function. + pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); } -impl psa_mac_operation_s { - #[inline] - pub fn private_is_sign(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_sign: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; - private_is_sign as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Inject an initial entropy seed for the random generator into + /// secure storage. + /// + /// This function injects data to be used as a seed for the random generator + /// used by the PSA Crypto implementation. On devices that lack a trusted + /// entropy source (preferably a hardware random number generator), + /// the Mbed PSA Crypto implementation uses this value to seed its + /// random generator. + /// + /// On devices without a trusted entropy source, this function must be + /// called exactly once in the lifetime of the device. On devices with + /// a trusted entropy source, calling this function is optional. + /// In all cases, this function may only be called before calling any + /// other function in the PSA Crypto API, including psa_crypto_init(). + /// + /// When this function returns successfully, it populates a file in + /// persistent storage. Once the file has been created, this function + /// can no longer succeed. + /// + /// If any error occurs, this function does not change the system state. + /// You can call this function again after correcting the reason for the + /// error if possible. + /// + /// \warning This function **can** fail! Callers MUST check the return status. + /// + /// \warning If you use this function, you should use it as part of a + /// factory provisioning process. The value of the injected seed + /// is critical to the security of the device. It must be + /// *secret*, *unpredictable* and (statistically) *unique per device*. + /// You should be generate it randomly using a cryptographically + /// secure random generator seeded from trusted entropy sources. + /// You should transmit it securely to the device and ensure + /// that its value is not leaked or stored anywhere beyond the + /// needs of transmitting it from the point of generation to + /// the call of this function, and erase all copies of the value + /// once this function returns. + /// + /// This is an Mbed TLS extension. + /// + /// \note This function is only available on the following platforms: + /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + /// Note that you must provide compatible implementations of + /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. + /// * In a client-server integration of PSA Cryptography, on the client side, + /// if the server supports this feature. + /// \param[in] seed Buffer containing the seed value to inject. + /// \param[in] seed_size Size of the \p seed buffer. + /// The size of the seed in bytes must be greater + /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + /// in `library/entropy_poll.h` in the Mbed TLS source + /// code. + /// It must be less or equal to + /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + /// + /// \retval #PSA_SUCCESS + /// The seed value was injected successfully. The random generator + /// of the PSA Crypto implementation is now ready for use. + /// You may now call psa_crypto_init() and use the PSA Crypto + /// implementation. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p seed_size is out of range. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// There was a failure reading or writing from storage. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The library has already been initialized. It is no longer + /// possible to call this function. + pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_aead_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub private_ad_remaining: usize, - pub private_body_remaining: usize, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_ctx: psa_driver_aead_context_t, +unsafe extern "C" { + /// External random generator function, implemented by the platform. + /// + /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + /// this function replaces Mbed TLS's entropy and DRBG modules for all + /// random generation triggered via PSA crypto interfaces. + /// + /// \note This random generator must deliver random numbers with cryptographic + /// quality and high performance. It must supply unpredictable numbers + /// with a uniform distribution. The implementation of this function + /// is responsible for ensuring that the random generator is seeded + /// with sufficient entropy. If you have a hardware TRNG which is slow + /// or delivers non-uniform output, declare it as an entropy source + /// with mbedtls_entropy_add_source() instead of enabling this option. + /// + /// \param[in,out] context Pointer to the random generator context. + /// This is all-bits-zero on the first call + /// and preserved between successive calls. + /// \param[out] output Output buffer. On success, this buffer + /// contains random data with a uniform + /// distribution. + /// \param output_size The size of the \p output buffer in bytes. + /// \param[out] output_length On success, set this value to \p output_size. + /// + /// \retval #PSA_SUCCESS + /// Success. The output buffer contains \p output_size bytes of + /// cryptographic-quality random data, and \c *output_length is + /// set to \p output_size. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + /// The random generator requires extra entropy and there is no + /// way to obtain entropy under current environment conditions. + /// This error should not happen under normal circumstances since + /// this function is responsible for obtaining as much entropy as + /// it needs. However implementations of this function may return + /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + /// entropy without blocking indefinitely. + /// \retval #PSA_ERROR_HARDWARE_FAILURE + /// A failure of the random generator hardware that isn't covered + /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. + pub fn mbedtls_psa_external_get_random( + context: *mut mbedtls_psa_external_random_context_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_aead_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// A slot number identifying a key in a driver. +/// +/// Values of this type are used to identify built-in keys. +pub type psa_drv_slot_number_t = u64; +unsafe extern "C" { + /// Check if PSA is capable of handling the specified hash algorithm. + /// + /// This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + /// set and that psa_crypto_init has already been called. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the algorithm. + /// This might be improved in the future. + /// + /// \param hash_alg The hash algorithm. + /// + /// \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + pub fn psa_can_do_hash(hash_alg: psa_algorithm_t) -> ::core::ffi::c_int; } -impl psa_aead_operation_s { - #[inline] - pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_ad_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_body_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(3usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 3usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 3usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(4usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 4usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 4usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_nonce_set: ::core::ffi::c_uint, - private_lengths_set: ::core::ffi::c_uint, - private_ad_started: ::core::ffi::c_uint, - private_body_started: ::core::ffi::c_uint, - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; - private_nonce_set as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; - private_lengths_set as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; - private_ad_started as u64 - }); - __bindgen_bitfield_unit.set(3usize, 1u8, { - let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; - private_body_started as u64 - }); - __bindgen_bitfield_unit.set(4usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Tell if PSA is ready for this cipher. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the key type and algorithm. + /// This might be improved in the future. + /// + /// \param key_type The key type. + /// \param cipher_alg The cipher algorithm. + /// + /// \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + pub fn psa_can_do_cipher( + key_type: psa_key_type_t, + cipher_alg: psa_algorithm_t, + ) -> ::core::ffi::c_int; +} +/// \brief Encoding of the application role of PAKE +/// +/// Encodes the application's role in the algorithm is being executed. For more +/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX +/// constants. +pub type psa_pake_role_t = u8; +/// Encoding of input and output indicators for PAKE. +/// +/// Some PAKE algorithms need to exchange more data than just a single key share. +/// This type is for encoding additional input and output data for such +/// algorithms. +pub type psa_pake_step_t = u8; +/// Encoding of the type of the PAKE's primitive. +/// +/// Values defined by this standard will never be in the range 0x80-0xff. +/// Vendors who define additional types must use an encoding in this range. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_primitive_type_t = u8; +/// \brief Encoding of the family of the primitive associated with the PAKE. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_family_t = u8; +/// \brief Encoding of the primitive associated with the PAKE. +/// +/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. +pub type psa_pake_primitive_t = u32; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_pake_cipher_suite_s { + pub algorithm: psa_algorithm_t, + pub type_: psa_pake_primitive_type_t, + pub family: psa_pake_family_t, + pub bits: u16, + pub hash: psa_algorithm_t, } #[repr(C)] -#[repr(align(16))] #[derive(Copy, Clone)] -pub struct psa_hkdf_key_derivation_t { - pub private_info: *mut u8, - pub private_info_length: usize, - pub private_offset_in_block: u8, - pub private_block_number: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_output_block: [u8; 64usize], - pub private_prk: [u8; 64usize], - pub __bindgen_padding_0: [u64; 0usize], - pub private_hmac: psa_mac_operation_s, +pub struct psa_crypto_driver_pake_inputs_s { + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_user: *mut u8, + pub private_user_len: usize, + pub private_peer: *mut u8, + pub private_peer_len: usize, + pub private_attributes: psa_key_attributes_t, + pub private_cipher_suite: psa_pake_cipher_suite_s, } -impl Default for psa_hkdf_key_derivation_t { +impl Default for psa_crypto_driver_pake_inputs_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17059,126 +18121,97 @@ impl Default for psa_hkdf_key_derivation_t { } } } -impl psa_hkdf_key_derivation_t { - #[inline] - pub fn private_state(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } - } - #[inline] - pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 2u8, val as u64) - } - } - #[inline] - pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 2u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 2u8, - val as u64, - ) - } - } - #[inline] - pub fn private_info_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { +pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = + 10; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = + 11; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; +pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; +pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; +pub const psa_jpake_round_PSA_JPAKE_FIRST: psa_jpake_round = 0; +pub const psa_jpake_round_PSA_JPAKE_SECOND: psa_jpake_round = 1; +pub const psa_jpake_round_PSA_JPAKE_FINISHED: psa_jpake_round = 2; +pub type psa_jpake_round = ::core::ffi::c_uint; +pub use self::psa_jpake_round as psa_jpake_round_t; +pub const psa_jpake_io_mode_PSA_JPAKE_INPUT: psa_jpake_io_mode = 0; +pub const psa_jpake_io_mode_PSA_JPAKE_OUTPUT: psa_jpake_io_mode = 1; +pub type psa_jpake_io_mode = ::core::ffi::c_uint; +pub use self::psa_jpake_io_mode as psa_jpake_io_mode_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_jpake_computation_stage_s { + pub private_round: psa_jpake_round_t, + pub private_io_mode: psa_jpake_io_mode_t, + pub private_inputs: u8, + pub private_outputs: u8, + pub private_step: psa_pake_step_t, +} +impl Default for psa_jpake_computation_stage_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_pake_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_primitive: psa_pake_primitive_t, + pub private_stage: u8, + pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, + pub private_data: psa_pake_operation_s__bindgen_ty_2, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_pake_operation_s__bindgen_ty_1 { + pub private_dummy: u8, + pub private_jpake: psa_jpake_computation_stage_s, +} +impl Default for psa_pake_operation_s__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub fn new_bitfield_1( - private_state: ::core::ffi::c_uint, - private_info_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 2u8, { - let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; - private_state as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; - private_info_set as u64 - }); - __bindgen_bitfield_unit - } -} -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_tls12_ecjpake_to_pms_t { - pub private_data: [u8; 32usize], } -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: - psa_tls12_prf_key_derivation_state_t = 0; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: - psa_tls12_prf_key_derivation_state_t = 1; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 2; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 3; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: - psa_tls12_prf_key_derivation_state_t = 4; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: - psa_tls12_prf_key_derivation_state_t = 5; -pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct psa_tls12_prf_key_derivation_s { - pub private_left_in_block: u8, - pub private_block_number: u8, - pub private_state: psa_tls12_prf_key_derivation_state_t, - pub private_secret: *mut u8, - pub private_secret_length: usize, - pub private_seed: *mut u8, - pub private_seed_length: usize, - pub private_label: *mut u8, - pub private_label_length: usize, - pub private_other_secret: *mut u8, - pub private_other_secret_length: usize, - pub private_Ai: [u8; 64usize], - pub private_output_block: [u8; 64usize], +pub union psa_pake_operation_s__bindgen_ty_2 { + pub private_ctx: psa_driver_pake_context_t, + pub private_inputs: psa_crypto_driver_pake_inputs_s, } -impl Default for psa_tls12_prf_key_derivation_s { +impl Default for psa_pake_operation_s__bindgen_ty_2 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for psa_pake_operation_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17187,1462 +18220,1629 @@ impl Default for psa_tls12_prf_key_derivation_s { } } } -pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_key_derivation_s { - pub private_alg: psa_algorithm_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_capacity: usize, - pub __bindgen_padding_0: [u64; 0usize], - pub private_ctx: psa_key_derivation_s__bindgen_ty_1, +/// The type of the data structure for PAKE cipher suites. +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; +/// The type of the state data structure for PAKE operations. +/// +/// Before calling any function on a PAKE operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_pake_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_pake_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, +/// for example: +/// \code +/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_pake_operation_init() +/// to the structure, for example: +/// \code +/// psa_pake_operation_t operation; +/// operation = psa_pake_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_operation_t = psa_pake_operation_s; +/// The type of input values for PAKE operations. +pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; +/// The type of computation stage for J-PAKE operations. +pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; +unsafe extern "C" { + /// Get the length of the password in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] password_len Password length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + password_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the password from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] buffer Return buffer for password. + /// \param buffer_size Size of the return buffer in bytes. + /// \param[out] buffer_length Actual size of the password in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password( + inputs: *const psa_crypto_driver_pake_inputs_t, + buffer: *mut u8, + buffer_size: usize, + buffer_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the user id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_len User id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_user_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the peer id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_len Peer id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_peer_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_len: *mut usize, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_key_derivation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_hkdf: psa_hkdf_key_derivation_t, - pub private_tls12_prf: psa_tls12_prf_key_derivation_t, - pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +unsafe extern "C" { + /// Get the user id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_id User id. + /// \param user_id_size Size of \p user_id in bytes. + /// \param[out] user_id_len Size of the user id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p user_id is too small. + pub fn psa_crypto_driver_pake_get_user( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_id: *mut u8, + user_id_size: usize, + user_id_len: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the peer id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_id Peer id. + /// \param peer_id_size Size of \p peer_id in bytes. + /// \param[out] peer_id_length Size of the peer id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p peer_id is too small. + pub fn psa_crypto_driver_pake_get_peer( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_id: *mut u8, + peer_id_size: usize, + peer_id_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the cipher suite from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] cipher_suite Return buffer for role. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Cipher_suite hasn't been set yet. + pub fn psa_crypto_driver_pake_get_cipher_suite( + inputs: *const psa_crypto_driver_pake_inputs_t, + cipher_suite: *mut psa_pake_cipher_suite_t, + ) -> psa_status_t; } -impl psa_key_derivation_s { - #[inline] - pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_can_output_key: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_can_output_key: u32 = - unsafe { ::core::mem::transmute(private_can_output_key) }; - private_can_output_key as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Set the session information for a password-authenticated key exchange. + /// + /// The sequence of operations to set up a password-authenticated key exchange + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_pake_operation_t, e.g. + /// #PSA_PAKE_OPERATION_INIT. + /// -# Call psa_pake_setup() to specify the cipher suite. + /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the + /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + /// to be called depends on the algorithm in use. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// A typical sequence of calls to perform a password-authenticated key + /// exchange: + /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + /// key share that needs to be sent to the peer. + /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + /// the key share that was received from the peer. + /// -# Depending on the algorithm additional calls to psa_pake_output() and + /// psa_pake_input() might be necessary. + /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// If an error occurs at any step after a call to psa_pake_setup(), + /// the operation will need to be reset by a call to psa_pake_abort(). The + /// application may call psa_pake_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_pake_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A call to psa_pake_abort(). + /// - A successful call to psa_pake_get_implicit_key(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized but not set up yet. + /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + /// characterizes a PAKE algorithm and determines + /// the algorithm as well.) + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the + /// PAKE primitive in \p cipher_suite is not compatible with the + /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + /// or not compatible with the PAKE algorithm and primitive. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, + /// or the PAKE primitive in \p cipher_suite is not supported or not + /// compatible with the PAKE algorithm, or the hash algorithm in + /// \p cipher_suite is not supported or not compatible with the PAKE + /// algorithm and primitive. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_setup( + operation: *mut psa_pake_operation_t, + cipher_suite: *const psa_pake_cipher_suite_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_key_policy_s { - pub private_usage: psa_key_usage_t, - pub private_alg: psa_algorithm_t, - pub private_alg2: psa_algorithm_t, +unsafe extern "C" { + /// Set the password for a password-authenticated key exchange from key ID. + /// + /// Call this function when the password, or a value derived from the password, + /// is already present in the key store. + /// + /// \param[in,out] operation The operation object to set the password for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the password hasn't + /// been set yet (psa_pake_set_password_key() + /// hasn't been called yet). + /// \param password Identifier of the key holding the password or a + /// value derived from the password (eg. by a + /// memory-hard function). It must remain valid + /// until the operation terminates. It must be of + /// type #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + /// the usage #PSA_KEY_USAGE_DERIVE. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p password is not a valid key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + /// permit the \p operation's algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + /// the \p operation's cipher suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size of \p password is not supported with the + /// \p operation's cipher suite. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must have been set up.), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_password_key( + operation: *mut psa_pake_operation_t, + password: mbedtls_svc_key_id_t, + ) -> psa_status_t; } -pub type psa_key_policy_t = psa_key_policy_s; -pub type psa_key_bits_t = u16; -/// A mask of flags that can be stored in key attributes. -/// -/// This type is also used internally to store flags in slots. Internal -/// flags are defined in library/psa_crypto_core.h. Internal flags may have -/// the same value as external flags if they are properly handled during -/// key creation and in psa_get_key_attributes. -pub type psa_key_attributes_flag_t = u16; -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_core_key_attributes_t { - pub private_type: psa_key_type_t, - pub private_bits: psa_key_bits_t, - pub private_lifetime: psa_key_lifetime_t, - pub private_id: mbedtls_svc_key_id_t, - pub private_policy: psa_key_policy_t, - pub private_flags: psa_key_attributes_flag_t, +unsafe extern "C" { + /// Set the user ID for a password-authenticated key exchange. + /// + /// Call this function to set the user ID. For PAKE algorithms that associate a + /// user identifier with each side of the session you need to call + /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single + /// user identifier with the session, call psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the user ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the user ID hasn't + /// been set (psa_pake_set_user() hasn't been + /// called yet). + /// \param[in] user_id The user ID to authenticate with. + /// \param user_id_len Size of the \p user_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p user_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The value of \p user_id is not supported by the implementation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_user( + operation: *mut psa_pake_operation_t, + user_id: *const u8, + user_id_len: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_key_attributes_s { - pub private_core: psa_core_key_attributes_t, - pub private_domain_parameters: *mut ::core::ffi::c_void, - pub private_domain_parameters_size: usize, +unsafe extern "C" { + /// Set the peer ID for a password-authenticated key exchange. + /// + /// Call this function in addition to psa_pake_set_user() for PAKE algorithms + /// that associate a user identifier with each side of the session. For PAKE + /// algorithms that associate a single user identifier with the session, call + /// psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the peer ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the peer ID hasn't + /// been set (psa_pake_set_peer() hasn't been + /// called yet). + /// \param[in] peer_id The peer's ID to authenticate. + /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p peer_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm doesn't associate a second identity with the session. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// Calling psa_pake_set_peer() is invalid with the \p operation's + /// algorithm, the operation state is not valid, or the library has not + /// been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_peer( + operation: *mut psa_pake_operation_t, + peer_id: *const u8, + peer_id_len: usize, + ) -> psa_status_t; } -impl Default for psa_key_attributes_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Set the application role for a password-authenticated key exchange. + /// + /// Not all PAKE algorithms need to differentiate the communicating entities. + /// It is optional to call this function for PAKEs that don't require a role + /// to be specified. For such PAKEs the application role parameter is ignored, + /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \param[in,out] operation The operation object to specify the + /// application's role for. It must have been set up + /// by psa_pake_setup() and not yet in use (neither + /// psa_pake_output() nor psa_pake_input() has been + /// called yet). It must be on operation for which + /// the application's role hasn't been specified + /// (psa_pake_set_role() hasn't been called yet). + /// \param role A value of type ::psa_pake_role_t indicating the + /// application's role in the PAKE the algorithm + /// that is being set up. For more information see + /// the documentation of \c PSA_PAKE_ROLE_XXX + /// constants. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The \p role is not a valid PAKE role in the \p operation’s algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The \p role for this algorithm is not supported or is not valid. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_role( + operation: *mut psa_pake_operation_t, + role: psa_pake_role_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Set domain parameters for a key. + /// Get output for a step of a password-authenticated key exchange. /// - /// Some key types require additional domain parameters in addition to - /// the key type identifier and the key size. Use this function instead - /// of psa_set_key_type() when you need to specify domain parameters. + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. /// - /// The format for the required domain parameters varies based on the key type. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the domain parameter data consists of the public exponent, - /// represented as a big-endian integer with no leading zeros. - /// This information is used when generating an RSA key pair. - /// When importing a key, the public exponent is read from the imported - /// key data and the exponent recorded in the attribute structure is ignored. - /// As an exception, the public exponent 65537 is represented by an empty - /// byte string. - /// - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR), - /// the `Dss-Params` format as defined by RFC 3279 §2.3.2. - /// ``` - /// Dss-Params ::= SEQUENCE { - /// p INTEGER, - /// q INTEGER, - /// g INTEGER - /// } - /// ``` - /// - For Diffie-Hellman key exchange keys - /// (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or - /// #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the - /// `DomainParameters` format as defined by RFC 3279 §2.3.3. - /// ``` - /// DomainParameters ::= SEQUENCE { - /// p INTEGER, -- odd prime, p=jq +1 - /// g INTEGER, -- generator, g - /// q INTEGER, -- factor of p-1 - /// j INTEGER OPTIONAL, -- subgroup factor - /// validationParams ValidationParams OPTIONAL - /// } - /// ValidationParams ::= SEQUENCE { - /// seed BIT STRING, - /// pgenCounter INTEGER - /// } - /// ``` + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step of the algorithm for which the output is + /// requested. + /// \param[out] output Buffer where the output is to be written in the + /// format appropriate for this \p step. Refer to + /// the documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param output_size Size of the \p output buffer in bytes. This must + /// be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + /// primitive, \p output_step) where \c alg and + /// \p primitive are the PAKE algorithm and primitive + /// in the operation's cipher suite, and \p step is + /// the output step. + /// + /// \param[out] output_length On success, the number of bytes of the returned + /// output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p step is not compatible with the operation's algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step is not supported with the operation's algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_output( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Provide input for a step of a password-authenticated key exchange. + /// + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. + /// + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \param[in,out] attributes Attribute structure where the specified domain - /// parameters will be stored. - /// If this function fails, the content of - /// \p attributes is not modified. - /// \param type Key type (a \c PSA_KEY_TYPE_XXX value). - /// \param[in] data Buffer containing the key domain parameters. - /// The content of this buffer is interpreted - /// according to \p type as described above. - /// \param data_length Size of the \p data buffer in bytes. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step for which the input is provided. + /// \param[in] input Buffer containing the input in the format + /// appropriate for this \p step. Refer to the + /// documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p input_length is not compatible with the \p operation’s algorithm, + /// or the \p input is not valid for the \p operation's algorithm, + /// cipher suite or \p step. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step p is not supported with the \p operation's algorithm, or the + /// \p input is not supported for the \p operation's algorithm, cipher + /// suite or \p step. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - pub fn psa_set_key_domain_parameters( - attributes: *mut psa_key_attributes_t, - type_: psa_key_type_t, - data: *const u8, - data_length: usize, + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_input( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + input: *const u8, + input_length: usize, ) -> psa_status_t; } -/// \brief The context for PSA interruptible hash signing. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_sign_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_sign_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_sign_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_sign_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -/// \brief The context for PSA interruptible hash verification. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_verify_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_verify_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_verify_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_verify_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// Open a handle to an existing persistent key. - /// - /// Open a handle to a persistent key. A key is persistent if it was created - /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key - /// always has a nonzero key identifier, set with psa_set_key_id() when - /// creating the key. Implementations may provide additional pre-provisioned - /// keys that can be opened with psa_open_key(). Such keys have an application - /// key identifier in the vendor range, as documented in the description of - /// #psa_key_id_t. + /// Get implicitly confirmed shared secret from a PAKE. /// - /// The application must eventually close the handle with psa_close_key() or - /// psa_destroy_key() to release associated resources. If the application dies - /// without calling one of these functions, the implementation should perform - /// the equivalent of a call to psa_close_key(). + /// At this point there is a cryptographic guarantee that only the authenticated + /// party who used the same password is able to compute the key. But there is no + /// guarantee that the peer is the party it claims to be and was able to do so. /// - /// Some implementations permit an application to open the same key multiple - /// times. If this is successful, each call to psa_open_key() will return a - /// different key handle. + /// That is, the authentication is only implicit. Since the peer is not + /// authenticated yet, no action should be taken yet that assumes that the peer + /// is who it claims to be. For example, do not access restricted files on the + /// peer's behalf until an explicit authentication has succeeded. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function can be called after the key exchange phase of the operation + /// has completed. It imports the shared secret output of the PAKE into the + /// provided derivation operation. The input step + /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + /// material in the key derivation operation. /// - /// \note Applications that rely on opening a key multiple times will not be - /// portable to implementations that only permit a single key handle to be - /// opened. See also :ref:\`key-handles\`. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// + /// When this function returns successfully, \p operation becomes inactive. + /// If this function returns an error status, both \p operation + /// and \c key_derivation operations enter an error state and must be aborted by + /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. /// - /// \param key The persistent identifier of the key. - /// \param[out] handle On success, a handle to the key. + /// \param[in,out] operation Active PAKE operation. + /// \param[out] output A key derivation operation that is ready + /// for an input step of type + /// #PSA_KEY_DERIVATION_INPUT_SECRET. /// /// \retval #PSA_SUCCESS - /// Success. The application can now use the value of `*handle` - /// to access the key. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY - /// The implementation does not have sufficient resources to open the - /// key. This can be due to reaching an implementation limit on the - /// number of open keys, the number of open key handles, or available - /// memory. - /// \retval #PSA_ERROR_DOES_NOT_EXIST - /// There is no persistent key with key identifier \p key. + /// Success. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid persistent key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The specified key exists, but the application does not have the - /// permission to access it. Note that this specification does not - /// define any way to create such a key, but it may be possible - /// through implementation-specific means. + /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + /// algorithm in the \p output key derivation operation. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// Input from a PAKE is not supported by the algorithm in the \p output + /// key derivation operation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The PAKE operation state is not valid (it must be active, but beyond + /// that validity is specific to the algorithm), or + /// the library has not been previously initialized by psa_crypto_init(), + /// or the state of \p output is not valid for + /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + /// step is out of order or the application has done this step already + /// and it may not be repeated. /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_get_implicit_key( + operation: *mut psa_pake_operation_t, + output: *mut psa_key_derivation_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Close a key handle. - /// - /// If the handle designates a volatile key, this will destroy the key material - /// and free all associated resources, just like psa_destroy_key(). - /// - /// If this is the last open handle to a persistent key, then closing the handle - /// will free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and can be opened again later - /// with a call to psa_open_key(). + /// Abort a PAKE operation. /// - /// Closing the key handle makes the handle invalid, and the key handle - /// must not be used again by the application. + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_pake_setup() again. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_pake_operation_t. /// - /// \note If the key handle was used to set up an active - /// :ref:\`multipart operation \`, then closing the - /// key handle can cause the multipart operation to fail. Applications should - /// maintain the key handle until after the multipart operation has finished. + /// In particular, calling psa_pake_abort() after the operation has been + /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + /// is safe and has no effect. /// - /// \param handle The key handle to close. - /// If this is \c 0, do nothing and return \c PSA_SUCCESS. + /// \param[in,out] operation The operation to abort. /// /// \retval #PSA_SUCCESS - /// \p handle was a valid handle or \c 0. It is now closed. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p handle is not a valid handle nor \c 0. + /// Success. /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; } -unsafe extern "C" { - /// \brief Library deinitialization. +pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; +pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; +/// \brief Public key types +pub type mbedtls_pk_type_t = ::core::ffi::c_uint; +/// \brief Options for RSASSA-PSS signature verification. +/// See \c mbedtls_rsa_rsassa_pss_verify_ext() +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_rsassa_pss_options { + /// The digest to use for MGF1 in PSS. /// - /// This function clears all data associated with the PSA layer, - /// including the whole key store. + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + /// disabled, this must be equal to the \c md_alg argument passed + /// to mbedtls_pk_verify_ext(). In a future version of the library, + /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + /// enabled regardless of the status of #MBEDTLS_RSA_C. + pub mgf1_hash_id: mbedtls_md_type_t, + /// The expected length of the salt, in bytes. This may be + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. /// - /// This is an Mbed TLS extension. - pub fn mbedtls_psa_crypto_free(); + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + /// ignored (allowing any salt length). + pub expected_salt_len: ::core::ffi::c_int, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. +impl Default for mbedtls_pk_rsassa_pss_options { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_PSA_EC: mbedtls_pk_debug_type = 3; +/// \brief Types for interfacing with the debug module +pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; +/// \brief Item to send to the debug module #[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_stats_s { - /// Number of slots containing key material for a volatile key. - pub private_volatile_slots: usize, - /// Number of slots containing key material for a key which is in - /// internal persistent storage. - pub private_persistent_slots: usize, - /// Number of slots containing a reference to a key in a - /// secure element. - pub private_external_slots: usize, - /// Number of slots which are occupied, but do not contain - /// key material yet. - pub private_half_filled_slots: usize, - /// Number of slots that contain cache data. - pub private_cache_slots: usize, - /// Number of slots that are not used for anything. - pub private_empty_slots: usize, - /// Number of slots that are locked. - pub private_locked_slots: usize, - /// Largest key id value among open keys in internal persistent storage. - pub private_max_open_internal_key_id: psa_key_id_t, - /// Largest key id value among open keys in secure elements. - pub private_max_open_external_key_id: psa_key_id_t, +#[derive(Copy, Clone)] +pub struct mbedtls_pk_debug_item { + pub private_type: mbedtls_pk_debug_type, + pub private_name: *const ::core::ffi::c_char, + pub private_value: *mut ::core::ffi::c_void, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. -pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; -unsafe extern "C" { - /// \brief Get statistics about - /// resource consumption related to the PSA keystore. - /// - /// \note When Mbed Crypto is built as part of a service, with isolation - /// between the application and the keystore, the service may or - /// may not expose this function. - pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); +impl Default for mbedtls_pk_debug_item { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief Inject an initial entropy seed for the random generator into - /// secure storage. - /// - /// This function injects data to be used as a seed for the random generator - /// used by the PSA Crypto implementation. On devices that lack a trusted - /// entropy source (preferably a hardware random number generator), - /// the Mbed PSA Crypto implementation uses this value to seed its - /// random generator. - /// - /// On devices without a trusted entropy source, this function must be - /// called exactly once in the lifetime of the device. On devices with - /// a trusted entropy source, calling this function is optional. - /// In all cases, this function may only be called before calling any - /// other function in the PSA Crypto API, including psa_crypto_init(). - /// - /// When this function returns successfully, it populates a file in - /// persistent storage. Once the file has been created, this function - /// can no longer succeed. - /// - /// If any error occurs, this function does not change the system state. - /// You can call this function again after correcting the reason for the - /// error if possible. - /// - /// \warning This function **can** fail! Callers MUST check the return status. - /// - /// \warning If you use this function, you should use it as part of a - /// factory provisioning process. The value of the injected seed - /// is critical to the security of the device. It must be - /// *secret*, *unpredictable* and (statistically) *unique per device*. - /// You should be generate it randomly using a cryptographically - /// secure random generator seeded from trusted entropy sources. - /// You should transmit it securely to the device and ensure - /// that its value is not leaked or stored anywhere beyond the - /// needs of transmitting it from the point of generation to - /// the call of this function, and erase all copies of the value - /// once this function returns. - /// - /// This is an Mbed TLS extension. - /// - /// \note This function is only available on the following platforms: - /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. - /// Note that you must provide compatible implementations of - /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. - /// * In a client-server integration of PSA Cryptography, on the client side, - /// if the server supports this feature. - /// \param[in] seed Buffer containing the seed value to inject. - /// \param[in] seed_size Size of the \p seed buffer. - /// The size of the seed in bytes must be greater - /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE - /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM - /// in `library/entropy_poll.h` in the Mbed TLS source - /// code. - /// It must be less or equal to - /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. - /// - /// \retval #PSA_SUCCESS - /// The seed value was injected successfully. The random generator - /// of the PSA Crypto implementation is now ready for use. - /// You may now call psa_crypto_init() and use the PSA Crypto - /// implementation. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p seed_size is out of range. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// There was a failure reading or writing from storage. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The library has already been initialized. It is no longer - /// possible to call this function. - pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_info_t { + _unused: [u8; 0], } -unsafe extern "C" { - /// \brief Get domain parameters for a key. - /// - /// Get the domain parameters for a key with this function, if any. The format - /// of the domain parameters written to \p data is specified in the - /// documentation for psa_set_key_domain_parameters(). - /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. - /// - /// \param[in] attributes The key attribute structure to query. - /// \param[out] data On success, the key domain parameters. - /// \param data_size Size of the \p data buffer in bytes. - /// The buffer is guaranteed to be large - /// enough if its size in bytes is at least - /// the value given by - /// PSA_KEY_DOMAIN_PARAMETERS_SIZE(). - /// \param[out] data_length On success, the number of bytes - /// that make up the key domain parameters data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - pub fn psa_get_key_domain_parameters( - attributes: *const psa_key_attributes_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; +/// \brief Public key container +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_context { + ///< Public key information + pub private_pk_info: *const mbedtls_pk_info_t, + ///< Underlying public key context + pub private_pk_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_pk_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } +pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; +/// \brief Types for RSA-alt abstraction +pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_key_len_func = + ::core::option::Option usize>; unsafe extern "C" { - /// Convert an ECC curve identifier from the PSA encoding to Mbed TLS. - /// - /// \note This function is provided solely for the convenience of - /// Mbed TLS and may be removed at any time without notice. + /// \brief Return information associated with the given PK type /// - /// \param curve A PSA elliptic curve identifier - /// (`PSA_ECC_FAMILY_xxx`). - /// \param bits The bit-length of a private key on \p curve. - /// \param bits_is_sloppy If true, \p bits may be the bit-length rounded up - /// to the nearest multiple of 8. This allows the caller - /// to infer the exact curve from the length of a key - /// which is supplied as a byte string. + /// \param pk_type PK type to search for. /// - /// \return The corresponding Mbed TLS elliptic curve identifier - /// (`MBEDTLS_ECP_DP_xxx`). - /// \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized. - /// \return #MBEDTLS_ECP_DP_NONE if \p bits is not - /// correct for \p curve. - pub fn mbedtls_ecc_group_of_psa( - curve: psa_ecc_family_t, - bits: usize, - bits_is_sloppy: ::core::ffi::c_int, - ) -> mbedtls_ecp_group_id; + /// \return The PK info associated with the type or NULL if not found. + pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; } unsafe extern "C" { - /// External random generator function, implemented by the platform. - /// - /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, - /// this function replaces Mbed TLS's entropy and DRBG modules for all - /// random generation triggered via PSA crypto interfaces. - /// - /// \note This random generator must deliver random numbers with cryptographic - /// quality and high performance. It must supply unpredictable numbers - /// with a uniform distribution. The implementation of this function - /// is responsible for ensuring that the random generator is seeded - /// with sufficient entropy. If you have a hardware TRNG which is slow - /// or delivers non-uniform output, declare it as an entropy source - /// with mbedtls_entropy_add_source() instead of enabling this option. - /// - /// \param[in,out] context Pointer to the random generator context. - /// This is all-bits-zero on the first call - /// and preserved between successive calls. - /// \param[out] output Output buffer. On success, this buffer - /// contains random data with a uniform - /// distribution. - /// \param output_size The size of the \p output buffer in bytes. - /// \param[out] output_length On success, set this value to \p output_size. + /// \brief Initialize a #mbedtls_pk_context (as NONE). /// - /// \retval #PSA_SUCCESS - /// Success. The output buffer contains \p output_size bytes of - /// cryptographic-quality random data, and \c *output_length is - /// set to \p output_size. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY - /// The random generator requires extra entropy and there is no - /// way to obtain entropy under current environment conditions. - /// This error should not happen under normal circumstances since - /// this function is responsible for obtaining as much entropy as - /// it needs. However implementations of this function may return - /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain - /// entropy without blocking indefinitely. - /// \retval #PSA_ERROR_HARDWARE_FAILURE - /// A failure of the random generator hardware that isn't covered - /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. - pub fn mbedtls_psa_external_get_random( - context: *mut mbedtls_psa_external_random_context_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); } -/// A slot number identifying a key in a driver. -/// -/// Values of this type are used to identify built-in keys. -pub type psa_drv_slot_number_t = u64; -/// \brief Encoding of the application role of PAKE -/// -/// Encodes the application's role in the algorithm is being executed. For more -/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX -/// constants. -pub type psa_pake_role_t = u8; -/// Encoding of input and output indicators for PAKE. -/// -/// Some PAKE algorithms need to exchange more data than just a single key share. -/// This type is for encoding additional input and output data for such -/// algorithms. -pub type psa_pake_step_t = u8; -/// Encoding of the type of the PAKE's primitive. -/// -/// Values defined by this standard will never be in the range 0x80-0xff. -/// Vendors who define additional types must use an encoding in this range. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_primitive_type_t = u8; -/// \brief Encoding of the family of the primitive associated with the PAKE. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_family_t = u8; -/// \brief Encoding of the primitive associated with the PAKE. -/// -/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. -pub type psa_pake_primitive_t = u32; -/// The type of the data structure for PAKE cipher suites. -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; -/// The type of the state data structure for PAKE operations. -/// -/// Before calling any function on a PAKE operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_pake_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_pake_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, -/// for example: -/// \code -/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_pake_operation_init() -/// to the structure, for example: -/// \code -/// psa_pake_operation_t operation; -/// operation = psa_pake_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_operation_t = psa_pake_operation_s; -/// The type of input values for PAKE operations. -pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; -/// The type of computation stage for J-PAKE operations. -pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; unsafe extern "C" { - /// Get the length of the password in bytes from given inputs. + /// \brief Free the components of a #mbedtls_pk_context. /// - /// \param[in] inputs Operation inputs. - /// \param[out] password_len Password length. + /// \param ctx The context to clear. It must have been initialized. + /// If this is \c NULL, this function does nothing. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - password_len: *mut usize, - ) -> psa_status_t; + /// \note For contexts that have been set up with + /// mbedtls_pk_setup_opaque(), this does not free the underlying + /// PSA key and you still need to call psa_destroy_key() + /// independently if you want to destroy that key. + pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); } unsafe extern "C" { - /// Get the password from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] buffer Return buffer for password. - /// \param buffer_size Size of the return buffer in bytes. - /// \param[out] buffer_length Actual size of the password in bytes. + /// \brief Initialize a PK context with the information given + /// and allocates the type-specific PK subcontext. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password( - inputs: *const psa_crypto_driver_pake_inputs_t, - buffer: *mut u8, - buffer_size: usize, - buffer_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// Get the role from given inputs. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param info Information to use /// - /// \param[in] inputs Operation inputs. - /// \param[out] role Return buffer for role. + /// \return 0 on success, + /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Role hasn't been set yet. - pub fn psa_crypto_driver_pake_get_role( - inputs: *const psa_crypto_driver_pake_inputs_t, - role: *mut psa_pake_role_t, - ) -> psa_status_t; + /// \note For contexts holding an RSA-alt key, use + /// \c mbedtls_pk_setup_rsa_alt() instead. + pub fn mbedtls_pk_setup( + ctx: *mut mbedtls_pk_context, + info: *const mbedtls_pk_info_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the user id in bytes from given inputs. + /// \brief Initialize an RSA-alt context /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_len User id length. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param key RSA key pointer + /// \param decrypt_func Decryption function + /// \param sign_func Signing function + /// \param key_len_func Function returning key length in bytes /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_user_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_len: *mut usize, - ) -> psa_status_t; + /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + /// context wasn't already initialized as RSA_ALT. + /// + /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + pub fn mbedtls_pk_setup_rsa_alt( + ctx: *mut mbedtls_pk_context, + key: *mut ::core::ffi::c_void, + decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, + sign_func: mbedtls_pk_rsa_alt_sign_func, + key_len_func: mbedtls_pk_rsa_alt_key_len_func, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the peer id in bytes from given inputs. + /// \brief Get the size in bits of the underlying key /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_len Peer id length. + /// \param ctx The context to query. It must have been initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_peer_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_len: *mut usize, - ) -> psa_status_t; + /// \return Key size in bits, or 0 on error + pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; } unsafe extern "C" { - /// Get the user id from given inputs. + /// \brief Tell if a context can do the operation given by type /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_id User id. - /// \param user_id_size Size of \p user_id in bytes. - /// \param[out] user_id_len Size of the user id in bytes. + /// \param ctx The context to query. It must have been initialized. + /// \param type The desired type. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p user_id is too small. - pub fn psa_crypto_driver_pake_get_user( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_id: *mut u8, - user_id_size: usize, - user_id_len: *mut usize, - ) -> psa_status_t; + /// \return 1 if the context can do operations on the given type. + /// \return 0 if the context cannot do the operations on the given + /// type. This is always the case for a context that has + /// been initialized but not set up, or that has been + /// cleared with mbedtls_pk_free(). + pub fn mbedtls_pk_can_do( + ctx: *const mbedtls_pk_context, + type_: mbedtls_pk_type_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the peer id from given inputs. + /// \brief Determine valid PSA attributes that can be used to + /// import a key into PSA. /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_id Peer id. - /// \param peer_id_size Size of \p peer_id in bytes. - /// \param[out] peer_id_length Size of the peer id in bytes. + /// The attributes determined by this function are suitable + /// for calling mbedtls_pk_import_into_psa() to create + /// a PSA key with the same key material. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p peer_id is too small. - pub fn psa_crypto_driver_pake_get_peer( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_id: *mut u8, - peer_id_size: usize, - peer_id_length: *mut usize, - ) -> psa_status_t; + /// The typical flow of operations involving this function is + /// ``` + /// psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + /// int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + /// if (ret != 0) ...; // error handling omitted + /// // Tweak attributes if desired + /// psa_key_id_t key_id = 0; + /// ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + /// if (ret != 0) ...; // error handling omitted + /// ``` + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + /// - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_ENCRYPT as well as + /// #PSA_KEY_USAGE_DECRYPT. + /// - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type. + /// - #PSA_KEY_USAGE_ENCRYPT: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_HASH as well as + /// #PSA_KEY_USAGE_SIGN_HASH. + /// - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + /// #PSA_KEY_USAGE_SIGN_MESSAGE. + /// - #PSA_KEY_USAGE_VERIFY_HASH: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + /// \p attributes will contain a public key type. + /// \param[out] attributes + /// On success, valid attributes to import the key into PSA. + /// - The lifetime and key identifier are unchanged. If the + /// attribute structure was initialized or reset before + /// calling this function, this will result in a volatile + /// key. Call psa_set_key_identifier() before or after this + /// function if you wish to create a persistent key. Call + /// psa_set_key_lifetime() before or after this function if + /// you wish to import the key in a secure element. + /// - The key type and bit-size are determined by the contents + /// of the PK context. If the PK context contains a key + /// pair, the key type can be either a key pair type or + /// the corresponding public key type, depending on + /// \p usage. If the PK context contains a public key, + /// the key type is a public key type. + /// - The key's policy is determined by the key type and + /// the \p usage parameter. The usage always allows + /// \p usage, exporting and copying the key, and + /// possibly other permissions as documented for the + /// \p usage parameter. + /// The permitted algorithm policy is determined as follows + /// based on the #mbedtls_pk_type_t type of \p pk, + /// the chosen \p usage and other factors: + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V15: + /// #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_PKCS1V15_CRYPT + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V21 and the digest type + /// corresponding to the PSA algorithm \c hash: + /// #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_OAEP(\c hash) + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA_ALT: not supported. + /// - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + /// if \p usage is SIGN/VERIFY: + /// #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + /// if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + /// otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + /// - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + /// if \p usage is DERIVE: + /// #PSA_ALG_ECDH. + /// - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + /// set for the underlying PSA key, except that + /// sign/decrypt flags are removed if the type is + /// set to a public key type. + /// The underlying key must allow \p usage. + /// Note that the enrollment algorithm set with + /// psa_set_key_enrollment_algorithm() is not copied. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_get_psa_attributes( + pk: *const mbedtls_pk_context, + usage: psa_key_usage_t, + attributes: *mut psa_key_attributes_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the cipher suite from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] cipher_suite Return buffer for role. + /// \brief Import a key into the PSA key store. + /// + /// This function is equivalent to calling psa_import_key() + /// with the key material from \p pk. + /// + /// The typical way to use this function is: + /// -# Call mbedtls_pk_get_psa_attributes() to obtain + /// attributes for the given key. + /// -# If desired, modify the attributes, for example: + /// - To create a persistent key, call + /// psa_set_key_identifier() and optionally + /// psa_set_key_lifetime(). + /// - To import only the public part of a key pair: + /// + /// psa_set_key_type(&attributes, + /// PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + /// psa_get_key_type(&attributes))); + /// - Restrict the key usage if desired. + /// -# Call mbedtls_pk_import_into_psa(). + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param[in] attributes + /// The attributes to use for the new key. They must be + /// compatible with \p pk. In particular, the key type + /// must match the content of \p pk. + /// If \p pk contains a key pair, the key type in + /// attributes can be either the key pair type or the + /// corresponding public key type (to import only the + /// public part). + /// \param[out] key_id + /// On success, the identifier of the newly created key. + /// On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_import_into_psa( + pk: *const mbedtls_pk_context, + attributes: *const psa_key_attributes_t, + key_id: *mut mbedtls_svc_key_id_t, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Create a PK context starting from a key stored in PSA. + /// This key: + /// - must be exportable and + /// - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + /// + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. + /// + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + /// mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. + /// * For ECDSA, the choice of deterministic vs randomized will + /// be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + /// * For an RSA key, the output PK context will allow both + /// encrypt/decrypt and sign/verify regardless of the original + /// key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. + /// + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Cipher_suite hasn't been set yet. - pub fn psa_crypto_driver_pake_get_cipher_suite( - inputs: *const psa_crypto_driver_pake_inputs_t, - cipher_suite: *mut psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the session information for a password-authenticated key exchange. + /// \brief Create a PK context for the public key of a PSA key. /// - /// The sequence of operations to set up a password-authenticated key exchange - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_pake_operation_t, e.g. - /// #PSA_PAKE_OPERATION_INIT. - /// -# Call psa_pake_setup() to specify the cipher suite. - /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the - /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs - /// to be called depends on the algorithm in use. + /// The key must be an RSA or ECC key. It can be either a + /// public key or a key pair, and only the public key is copied. + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_verify() or + /// mbedtls_pk_encrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. /// - /// A typical sequence of calls to perform a password-authenticated key - /// exchange: - /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the - /// key share that needs to be sent to the peer. - /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide - /// the key share that was received from the peer. - /// -# Depending on the algorithm additional calls to psa_pake_output() and - /// psa_pake_input() might be necessary. - /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// For an RSA key, the output PK context will allow both + /// encrypt and verify regardless of the original key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// If an error occurs at any step after a call to psa_pake_setup(), - /// the operation will need to be reset by a call to psa_pake_abort(). The - /// application may call psa_pake_abort() at any time after the operation - /// has been initialized. + /// \return 0 on success. + /// \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_public_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature (including padding if relevant). /// - /// After a successful call to psa_pake_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A call to psa_pake_abort(). - /// - A successful call to psa_pake_get_implicit_key(). + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used. + /// This can be #MBEDTLS_MD_NONE if the signature algorithm + /// does not rely on a hash algorithm (non-deterministic + /// ECDSA, RSA PKCS#1 v1.5). + /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + /// \p hash is the DigestInfo structure used by RFC 8017 + /// §9.2 steps 3–6. If \p md_alg is a valid hash + /// algorithm then \p hash is the digest itself, and this + /// function calculates the DigestInfo encoding internally. + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Signature to verify + /// \param sig_len Signature length /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized but not set up yet. - /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully - /// characterizes a PAKE algorithm and determines - /// the algorithm as well.) + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (accepting any salt length), + /// depending on the padding mode in the underlying RSA context. + /// For a pk object constructed by parsing, this is PKCS#1 v1.5 + /// by default. Use mbedtls_pk_verify_ext() to explicitly select + /// a different algorithm. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the - /// PAKE primitive in \p cipher_suite is not compatible with the - /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid - /// or not compatible with the PAKE algorithm and primitive. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, - /// or the PAKE primitive in \p cipher_suite is not supported or not - /// compatible with the PAKE algorithm, or the hash algorithm in - /// \p cipher_suite is not supported or not compatible with the PAKE - /// algorithm and primitive. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_setup( - operation: *mut psa_pake_operation_t, - cipher_suite: *const psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + pub fn mbedtls_pk_verify( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the password for a password-authenticated key exchange from key ID. + /// \brief Restartable version of \c mbedtls_pk_verify() /// - /// Call this function when the password, or a value derived from the password, - /// is already present in the key store. + /// \note Performs the same job as \c mbedtls_pk_verify(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_verify(). /// - /// \param[in,out] operation The operation object to set the password for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the password hasn't - /// been set yet (psa_pake_set_password_key() - /// hasn't been called yet). - /// \param password Identifier of the key holding the password or a - /// value derived from the password (eg. by a - /// memory-hard function). It must remain valid - /// until the operation terminates. It must be of - /// type #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow - /// the usage #PSA_KEY_USAGE_DERIVE. + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p password is not a valid key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not - /// permit the \p operation's algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with - /// the \p operation's cipher suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size of \p password is not supported with the - /// \p operation's cipher suite. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must have been set up.), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_password_key( - operation: *mut psa_pake_operation_t, - password: mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return See \c mbedtls_pk_verify(), or + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_verify_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature, with options. + /// (Includes verification of the padding depending on type.) + /// + /// \param type Signature type (inc. possible padding type) to verify + /// \param options Pointer to type-specific options, or NULL + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + /// used for this type of signatures, + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + /// + /// \note If hash_len is 0, then the length associated with md_alg + /// is used instead, or an error returned if it is invalid. + /// + /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// + /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + /// to a mbedtls_pk_rsassa_pss_options structure, + /// otherwise it must be NULL. Note that if + /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + pub fn mbedtls_pk_verify_ext( + type_: mbedtls_pk_type_t, + options: *const ::core::ffi::c_void, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the user ID for a password-authenticated key exchange. + /// \brief Make signature, including padding if relevant. /// - /// Call this function to set the user ID. For PAKE algorithms that associate a - /// user identifier with each side of the session you need to call - /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single - /// user identifier with the session, call psa_pake_set_user() only. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (using the largest possible salt + /// length up to the hash length), depending on the padding mode + /// in the underlying RSA context. For a pk object constructed + /// by parsing, this is PKCS#1 v1.5 by default. Use + /// mbedtls_pk_verify_ext() to explicitly select a different + /// algorithm. /// - /// \param[in,out] operation The operation object to set the user ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the user ID hasn't - /// been set (psa_pake_set_user() hasn't been - /// called yet). - /// \param[in] user_id The user ID to authenticate with. - /// (temporary limitation: "client" or "server" only) - /// \param user_id_len Size of the \p user_id buffer in bytes. + /// \return 0 on success, or a specific error code. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The value of \p user_id is not supported by the implementation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_user( - operation: *mut psa_pake_operation_t, - user_id: *const u8, - user_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the peer ID for a password-authenticated key exchange. + /// \brief Make signature given a signature type. /// - /// Call this function in addition to psa_pake_set_user() for PAKE algorithms - /// that associate a user identifier with each side of the session. For PAKE - /// algorithms that associate a single user identifier with the session, call - /// psa_pake_set_user() only. + /// \param pk_type Signature type. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \return 0 on success, or a specific error code. /// - /// \param[in,out] operation The operation object to set the peer ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the peer ID hasn't - /// been set (psa_pake_set_peer() hasn't been - /// called yet). - /// \param[in] peer_id The peer's ID to authenticate. - /// (temporary limitation: "client" or "server" only) - /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + /// see #PSA_ALG_RSA_PSS for a description of PSS options used. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm doesn't associate a second identity with the session. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// Calling psa_pake_set_peer() is invalid with the \p operation's - /// algorithm, the operation state is not valid, or the library has not - /// been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_peer( - operation: *mut psa_pake_operation_t, - peer_id: *const u8, - peer_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign_ext( + pk_type: mbedtls_pk_type_t, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the application role for a password-authenticated key exchange. + /// \brief Restartable version of \c mbedtls_pk_sign() /// - /// Not all PAKE algorithms need to differentiate the communicating entities. - /// It is optional to call this function for PAKEs that don't require a role - /// to be specified. For such PAKEs the application role parameter is ignored, - /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// \note Performs the same job as \c mbedtls_pk_sign(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_sign(). /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \param[in,out] operation The operation object to specify the - /// application's role for. It must have been set up - /// by psa_pake_setup() and not yet in use (neither - /// psa_pake_output() nor psa_pake_input() has been - /// called yet). It must be on operation for which - /// the application's role hasn't been specified - /// (psa_pake_set_role() hasn't been called yet). - /// \param role A value of type ::psa_pake_role_t indicating the - /// application's role in the PAKE the algorithm - /// that is being set up. For more information see - /// the documentation of \c PSA_PAKE_ROLE_XXX - /// constants. + /// \return See \c mbedtls_pk_sign(). + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_sign_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Decrypt message (including padding if relevant). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The \p role is not a valid PAKE role in the \p operation’s algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The \p role for this algorithm is not supported or is not valid. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_role( - operation: *mut psa_pake_operation_t, - role: psa_pake_role_t, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param input Input to decrypt + /// \param ilen Input size + /// \param output Decrypted output + /// \param olen Decrypted message length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. + /// + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_decrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get output for a step of a password-authenticated key exchange. + /// \brief Encrypt message (including padding if relevant). /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been set up. + /// \param input Message to encrypt + /// \param ilen Message size + /// \param output Encrypted output + /// \param olen Encrypted output length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \note \p f_rng is used for padding generation. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step of the algorithm for which the output is - /// requested. - /// \param[out] output Buffer where the output is to be written in the - /// format appropriate for this \p step. Refer to - /// the documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param output_size Size of the \p output buffer in bytes. This must - /// be at least #PSA_PAKE_OUTPUT_SIZE(\p alg, \p - /// primitive, \p step) where \p alg and - /// \p primitive are the PAKE algorithm and primitive - /// in the operation's cipher suite, and \p step is - /// the output step. + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_encrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if a public-private pair of keys matches. /// - /// \param[out] output_length On success, the number of bytes of the returned - /// output. + /// \param pub Context holding a public key. + /// \param prv Context holding a private (and public) key. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p step is not compatible with the operation's algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step is not supported with the operation's algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_output( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success (keys were checked and match each other). + /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + /// be checked - in that case they may or may not match. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + /// \return Another non-zero value if the keys do not match. + pub fn mbedtls_pk_check_pair( + pub_: *const mbedtls_pk_context, + prv: *const mbedtls_pk_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Provide input for a step of a password-authenticated key exchange. + /// \brief Export debug information /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been initialized. + /// \param items Place to write debug items /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + pub fn mbedtls_pk_debug( + ctx: *const mbedtls_pk_context, + items: *mut mbedtls_pk_debug_item, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Access the type name /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \param ctx The PK context to use. It must have been initialized. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step for which the input is provided. - /// \param[in] input Buffer containing the input in the format - /// appropriate for this \p step. Refer to the - /// documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param input_length Size of the \p input buffer in bytes. + /// \return Type name on success, or "invalid PK" + pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; +} +unsafe extern "C" { + /// \brief Get the key type /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p is not compatible with the \p operation’s algorithm, or the - /// \p input is not valid for the \p operation's algorithm, cipher suite - /// or \p step. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step p is not supported with the \p operation's algorithm, or the - /// \p input is not supported for the \p operation's algorithm, cipher - /// suite or \p step. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_input( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been initialized. + /// + /// \return Type on success. + /// \return #MBEDTLS_PK_NONE for a context that has not been set up. + pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; } unsafe extern "C" { - /// Get implicitly confirmed shared secret from a PAKE. + /// \ingroup pk_module */ + ////** + /// \brief Parse a private key in PEM or DER format /// - /// At this point there is a cryptographic guarantee that only the authenticated - /// party who used the same password is able to compute the key. But there is no - /// guarantee that the peer is the party it claims to be and was able to do so. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// That is, the authentication is only implicit. Since the peer is not - /// authenticated yet, no action should be taken yet that assumes that the peer - /// is who it claims to be. For example, do not access restricted files on the - /// peer's behalf until an explicit authentication has succeeded. + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// \param pwd Optional password for decryption. + /// Pass \c NULL if expecting a non-encrypted key. + /// Pass a string of \p pwdlen bytes if expecting an encrypted + /// key; a non-encrypted key will also be accepted. + /// The empty password is not supported. + /// \param pwdlen Size of the password in bytes. + /// Ignored if \p pwd is \c NULL. + /// \param f_rng RNG function, must not be \c NULL. Used for blinding. + /// \param p_rng RNG parameter /// - /// This function can be called after the key exchange phase of the operation - /// has completed. It imports the shared secret output of the PAKE into the - /// provided derivation operation. The input step - /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key - /// material in the key derivation operation. + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note The key is also checked for correctness. /// - /// When this function returns successfully, \p operation becomes inactive. - /// If this function returns an error status, both \p operation - /// and \p key_derivation operations enter an error state and must be aborted by - /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \ingroup pk_module */ + ////** + /// \brief Parse a public key in PEM or DER format /// - /// \param[in,out] operation Active PAKE operation. - /// \param[out] output A key derivation operation that is ready - /// for an input step of type - /// #PSA_KEY_DERIVATION_INPUT_SECRET. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the - /// algorithm in the \p output key derivation operation. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// Input from a PAKE is not supported by the algorithm in the \p output - /// key derivation operation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The PAKE operation state is not valid (it must be active, but beyond - /// that validity is specific to the algorithm), or - /// the library has not been previously initialized by psa_crypto_init(), - /// or the state of \p output is not valid for - /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the - /// step is out of order or the application has done this step already - /// and it may not be repeated. - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_get_implicit_key( - operation: *mut psa_pake_operation_t, - output: *mut psa_key_derivation_operation_t, - ) -> psa_status_t; + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). + /// + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. + /// + /// \note The key is also checked for correctness. + /// + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_public_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a PAKE operation. + /// \brief Write a private key to a PKCS#1 or SEC1 DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_pake_setup() again. + /// \param ctx PK context which must contain a valid private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_pake_operation_t. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_key_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a SubjectPublicKeyInfo DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// In particular, calling psa_pake_abort() after the operation has been - /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() - /// is safe and has no effect. + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// \param[in,out] operation The operation to abort. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_pubkey_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a PEM string /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_pubkey_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_pake_cipher_suite_s { - pub algorithm: psa_algorithm_t, - pub type_: psa_pake_primitive_type_t, - pub family: psa_pake_family_t, - pub bits: u16, - pub hash: psa_algorithm_t, +unsafe extern "C" { + /// \brief Write a private key to a PKCS#1 or SEC1 PEM string + /// + /// \param ctx PK context which must contain a valid private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_key_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_crypto_driver_pake_inputs_s { - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: psa_pake_role_t, - pub private_user: *mut u8, - pub private_user_len: usize, - pub private_peer: *mut u8, - pub private_peer_len: usize, - pub private_attributes: psa_key_attributes_t, - pub private_cipher_suite: psa_pake_cipher_suite_t, +unsafe extern "C" { + /// \brief Parse a SubjectPublicKeyInfo DER structure + /// + /// \param p the position in the ASN.1 data + /// \param end end of the buffer + /// \param pk The PK context to fill. It must have been initialized + /// but not set up. + /// + /// \return 0 if successful, or a specific PK error code + pub fn mbedtls_pk_parse_subpubkey( + p: *mut *mut ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -impl Default for psa_crypto_driver_pake_inputs_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Write a subjectPublicKey to ASN.1 data + /// Note: function works backwards in data buffer + /// + /// \param p reference to current position pointer + /// \param start start of the buffer (for bounds-checking) + /// \param key PK context which must contain a valid public or private key. + /// + /// \return the length written or a negative error code + pub fn mbedtls_pk_write_pubkey( + p: *mut *mut ::core::ffi::c_uchar, + start: *mut ::core::ffi::c_uchar, + key: *const mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -pub const psa_jpake_step_PSA_PAKE_STEP_INVALID: psa_jpake_step = 0; -pub const psa_jpake_step_PSA_PAKE_STEP_X1_X2: psa_jpake_step = 1; -pub const psa_jpake_step_PSA_PAKE_STEP_X2S: psa_jpake_step = 2; -pub const psa_jpake_step_PSA_PAKE_STEP_DERIVE: psa_jpake_step = 3; -pub type psa_jpake_step = ::core::ffi::c_uint; -pub use self::psa_jpake_step as psa_jpake_step_t; -pub const psa_jpake_state_PSA_PAKE_STATE_INVALID: psa_jpake_state = 0; -pub const psa_jpake_state_PSA_PAKE_STATE_SETUP: psa_jpake_state = 1; -pub const psa_jpake_state_PSA_PAKE_STATE_READY: psa_jpake_state = 2; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X1_X2: psa_jpake_state = 3; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X2S: psa_jpake_state = 4; -pub const psa_jpake_state_PSA_PAKE_INPUT_X1_X2: psa_jpake_state = 5; -pub const psa_jpake_state_PSA_PAKE_INPUT_X4S: psa_jpake_state = 6; -pub type psa_jpake_state = ::core::ffi::c_uint; -pub use self::psa_jpake_state as psa_jpake_state_t; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_INVALID: psa_jpake_sequence = 0; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_KEY_SHARE: psa_jpake_sequence = 1; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PUBLIC: psa_jpake_sequence = 2; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PROOF: psa_jpake_sequence = 3; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_KEY_SHARE: psa_jpake_sequence = 4; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PUBLIC: psa_jpake_sequence = 5; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PROOF: psa_jpake_sequence = 6; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_END: psa_jpake_sequence = 7; -pub type psa_jpake_sequence = ::core::ffi::c_uint; -pub use self::psa_jpake_sequence as psa_jpake_sequence_t; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = + 3; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + mbedtls_key_exchange_type_t = 4; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = + 8; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = + 9; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = 10; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = 11; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; -pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; -pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_jpake_computation_stage_s { - pub private_state: psa_jpake_state_t, - pub private_sequence: psa_jpake_sequence_t, - pub private_input_step: psa_jpake_step_t, - pub private_output_step: psa_jpake_step_t, -} -impl Default for psa_jpake_computation_stage_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_pake_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_stage: u8, - pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, - pub private_data: psa_pake_operation_s__bindgen_ty_2, -} +pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; +/// \brief This structure is used for storing ciphersuite information +/// +/// \note members are defined using integral types instead of enums +/// in order to pack structure and reduce memory usage by internal +/// \c ciphersuite_definitions[] #[repr(C)] #[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_jpake: psa_jpake_computation_stage_t, +pub struct mbedtls_ssl_ciphersuite_t { + pub private_id: ::core::ffi::c_int, + pub private_name: *const ::core::ffi::c_char, + pub private_cipher: u8, + pub private_mac: u8, + pub private_key_exchange: u8, + pub private_flags: u8, + pub private_min_tls_version: u16, + pub private_max_tls_version: u16, } -impl Default for psa_pake_operation_s__bindgen_ty_1 { +impl Default for mbedtls_ssl_ciphersuite_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -18651,29 +19851,23 @@ impl Default for psa_pake_operation_s__bindgen_ty_1 { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_2 { - pub private_ctx: psa_driver_pake_context_t, - pub private_inputs: psa_crypto_driver_pake_inputs_t, +unsafe extern "C" { + pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; } -impl Default for psa_pake_operation_s__bindgen_ty_2 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_string( + ciphersuite_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ssl_ciphersuite_t; } -impl Default for psa_pake_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_id( + ciphersuite_id: ::core::ffi::c_int, + ) -> *const mbedtls_ssl_ciphersuite_t; +} +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( + info: *const mbedtls_ssl_ciphersuite_t, + ) -> usize; } /// Type-length-value structure that allows for ASN1 using DER. pub type mbedtls_x509_buf = mbedtls_asn1_buf; @@ -18684,6 +19878,23 @@ pub type mbedtls_x509_bitstring = mbedtls_asn1_bitstring; pub type mbedtls_x509_name = mbedtls_asn1_named_data; /// Container for a sequence of ASN.1 items pub type mbedtls_x509_sequence = mbedtls_asn1_sequence; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_authority { + pub keyIdentifier: mbedtls_x509_buf, + pub authorityCertIssuer: mbedtls_x509_sequence, + pub authorityCertSerialNumber: mbedtls_x509_buf, + pub raw: mbedtls_x509_buf, +} +impl Default for mbedtls_x509_authority { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} /// Container for date and time (precision in seconds). #[repr(C)] #[derive(Default, Copy, Clone)] @@ -18775,9 +19986,9 @@ pub struct mbedtls_x509_subject_alternative_name { #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_x509_subject_alternative_name__bindgen_ty_1 { - ///< The otherName supported type. pub other_name: mbedtls_x509_san_other_name, - ///< The buffer for the unconstructed types. Only rfc822Name, dnsName and uniformResourceIdentifier are currently supported + pub directory_name: mbedtls_x509_name, + ///< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. pub unstructured_name: mbedtls_x509_buf, } impl Default for mbedtls_x509_subject_alternative_name__bindgen_ty_1 { @@ -18798,6 +20009,21 @@ impl Default for mbedtls_x509_subject_alternative_name { } } } +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_san_list { + pub node: mbedtls_x509_subject_alternative_name, + pub next: *mut mbedtls_x509_san_list, +} +impl Default for mbedtls_x509_san_list { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { /// \brief Store the certificate DN in printable form into buf; /// no more than size characters will be written. @@ -18814,6 +20040,26 @@ unsafe extern "C" { dn: *const mbedtls_x509_name, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Convert the certificate DN string \p name into + /// a linked list of mbedtls_x509_name (equivalent to + /// mbedtls_asn1_named_data). + /// + /// \note This function allocates a linked list, and places the head + /// pointer in \p head. This list must later be freed by a + /// call to mbedtls_asn1_free_named_data_list(). + /// + /// \param[out] head Address in which to store the pointer to the head of the + /// allocated list of mbedtls_x509_name. Must point to NULL on + /// entry. + /// \param[in] name The string representation of a DN to convert + /// + /// \return 0 on success, or a negative error code. + pub fn mbedtls_x509_string_to_names( + head: *mut *mut mbedtls_asn1_named_data, + name: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Store the certificate serial in printable form into buf; /// no more than size characters will be written. @@ -18830,6 +20076,20 @@ unsafe extern "C" { serial: *const mbedtls_x509_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Compare pair of mbedtls_x509_time. + /// + /// \param t1 mbedtls_x509_time to compare + /// \param t2 mbedtls_x509_time to compare + /// + /// \return < 0 if t1 is before t2 + /// 0 if t1 equals t2 + /// > 0 if t1 is after t2 + pub fn mbedtls_x509_time_cmp( + t1: *const mbedtls_x509_time, + t2: *const mbedtls_x509_time, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Check a given mbedtls_x509_time against the system time /// and tell if it's in the past. @@ -18858,21 +20118,25 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief This function parses an item in the SubjectAlternativeNames - /// extension. + /// extension. Please note that this function might allocate + /// additional memory for a subject alternative name, thus + /// mbedtls_x509_free_subject_alt_name has to be called + /// to dispose of this additional memory afterwards. /// /// \param san_buf The buffer holding the raw data item of the subject /// alternative name. /// \param san The target structure to populate with the parsed presentation - /// of the subject alternative name encoded in \p san_raw. + /// of the subject alternative name encoded in \p san_buf. /// /// \note Supported GeneralName types, as defined in RFC 5280: - /// "rfc822Name", "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + /// "rfc822Name", "dnsName", "directoryName", + /// "uniformResourceIdentifier" and "hardware_module_name" /// of type "otherName", as defined in RFC 4108. /// /// \note This function should be called on a single raw data of /// subject alternative name. For example, after successful /// certificate parsing, one must iterate on every item in the - /// \p crt->subject_alt_names sequence, and pass it to + /// \c crt->subject_alt_names sequence, and pass it to /// this function. /// /// \warning The target structure contains pointers to the raw data of the @@ -18889,173 +20153,29 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \} addtogroup x509_module - pub fn mbedtls_x509_get_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - cur: *mut mbedtls_x509_name, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg_null( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - params: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_rsassa_pss_params( - params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - mgf_md: *mut mbedtls_md_type_t, - salt_len: *mut ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - sig: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig_alg( - sig_oid: *const mbedtls_x509_buf, - sig_params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - pk_alg: *mut mbedtls_pk_type_t, - sig_opts: *mut *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_time( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - t: *mut mbedtls_x509_time, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_serial( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - serial: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ext( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ext: *mut mbedtls_x509_buf, - tag: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_sig_alg_gets( - buf: *mut ::core::ffi::c_char, - size: usize, - sig_oid: *const mbedtls_x509_buf, - pk_alg: mbedtls_pk_type_t, - md_alg: mbedtls_md_type_t, - sig_opts: *const ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_key_size_helper( - buf: *mut ::core::ffi::c_char, - buf_size: usize, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_string_to_names( - head: *mut *mut mbedtls_asn1_named_data, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_set_extension( - head: *mut *mut mbedtls_asn1_named_data, - oid: *const ::core::ffi::c_char, - oid_len: usize, - critical: ::core::ffi::c_int, - val: *const ::core::ffi::c_uchar, - val_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_extensions( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_names( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_sig( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - oid: *const ::core::ffi::c_char, - oid_len: usize, - sig: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ns_cert_type( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ns_cert_type: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_key_usage( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - key_usage: *mut ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_subject_alt_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - subject_alt_name: *mut mbedtls_x509_sequence, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_subject_alt_name( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - subject_alt_name: *const mbedtls_x509_sequence, - prefix: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_cert_type( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - ns_cert_type: ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \brief Unallocate all data related to subject alternative name + /// + /// \param san SAN structure - extra memory owned by this structure will be freed + pub fn mbedtls_x509_free_subject_alt_name(san: *mut mbedtls_x509_subject_alternative_name); } unsafe extern "C" { - pub fn mbedtls_x509_info_key_usage( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - key_usage: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \brief This function parses a CN string as an IP address. + /// + /// \param cn The CN string to parse. CN string MUST be null-terminated. + /// \param dst The target buffer to populate with the binary IP address. + /// The buffer MUST be 16 bytes to save IPv6, and should be + /// 4-byte aligned if the result will be used as struct in_addr. + /// e.g. uint32_t dst[4] + /// + /// \note \p cn is parsed as an IPv6 address if string contains ':', + /// else \p cn is parsed as an IPv4 address. + /// + /// \return Length of binary IP address; num bytes written to target. + /// \return \c 0 on failure to parse CN string as an IP address. + pub fn mbedtls_x509_crt_parse_cn_inet_pton( + cn: *const ::core::ffi::c_char, + dst: *mut ::core::ffi::c_void, + ) -> usize; } /// Certificate revocation list entry. /// Contains the CA-specific serial numbers and revocation dates. @@ -19247,8 +20367,12 @@ pub struct mbedtls_x509_crt { pub subject_id: mbedtls_x509_buf, ///< Optional X.509 v3 extensions. pub v3_ext: mbedtls_x509_buf, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, + ///< Optional X.509 v3 extension subject key identifier. + pub subject_key_id: mbedtls_x509_buf, + ///< Optional X.509 v3 extension authority key identifier. + pub authority_key_id: mbedtls_x509_authority, ///< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). pub certificate_policies: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions @@ -19347,6 +20471,22 @@ impl Default for mbedtls_x509write_cert { } } } +unsafe extern "C" { + /// \brief Set Subject Alternative Name + /// + /// \param ctx Certificate context to use + /// \param san_list List of SAN values + /// + /// \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + /// + /// \note "dnsName", "uniformResourceIdentifier", "IP address", + /// "otherName", and "DirectoryName", as defined in RFC 5280, + /// are supported. + pub fn mbedtls_x509write_crt_set_subject_alternative_name( + ctx: *mut mbedtls_x509write_cert, + san_list: *const mbedtls_x509_san_list, + ) -> ::core::ffi::c_int; +} /// Item in a verification chain: cert and flags for it #[repr(C)] #[derive(Copy, Clone)] @@ -19685,8 +20825,12 @@ unsafe extern "C" { /// \param cn The expected Common Name. This will be checked to be /// present in the certificate's subjectAltNames extension or, /// if this extension is absent, as a CN component in its - /// Subject name. Currently only DNS names are supported. This - /// may be \c NULL if the CN need not be verified. + /// Subject name. DNS names and IP addresses are fully + /// supported, while the URI subtype is partially supported: + /// only exact matching, without any normalization procedures + /// described in 7.4 of RFC5280, will result in a positive + /// URI verification. + /// This may be \c NULL if the CN need not be verified. /// \param flags The address at which to store the result of the verification. /// If the verification couldn't be completed, the flag value is /// set to (uint32_t) -1. @@ -19917,6 +21061,16 @@ unsafe extern "C" { /// \param crt Certificate chain to free pub fn mbedtls_x509_crt_free(crt: *mut mbedtls_x509_crt); } +unsafe extern "C" { + /// \brief Access the ca_istrue field + /// + /// \param[in] crt Certificate to be queried, must not be \c NULL + /// + /// \return \c 1 if this a CA certificate \c 0 otherwise. + /// \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + /// the Optional Basic Constraint extension. + pub fn mbedtls_x509_crt_get_ca_istrue(crt: *const mbedtls_x509_crt) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Initialize a CRT writing context /// @@ -19997,7 +21151,7 @@ unsafe extern "C" { /// \brief Set the issuer name for a Certificate /// Issuer names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS CA" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS CA" /// /// \param ctx CRT context to use /// \param issuer_name issuer name to set @@ -20013,7 +21167,7 @@ unsafe extern "C" { /// \brief Set the subject name for a Certificate /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CRT context to use /// \param subject_name subject name to set @@ -20183,13 +21337,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20209,13 +21357,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20336,13 +21478,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20415,13 +21551,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20455,13 +21585,7 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, output_size: usize, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20492,7 +21616,7 @@ unsafe extern "C" { /// initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p field is invalid. + /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. /// \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. pub fn mbedtls_dhm_get_value( ctx: *const mbedtls_dhm_context, @@ -20620,6 +21744,18 @@ impl Default for mbedtls_ecdh_context { } } } +unsafe extern "C" { + /// \brief Return the ECP group for provided context. + /// + /// \note To access group specific fields, users should use + /// `mbedtls_ecp_curve_info_from_grp_id` or + /// `mbedtls_ecp_group_load` on the extracted `group_id`. + /// + /// \param ctx The ECDH context to parse. This must not be \c NULL. + /// + /// \return The \c mbedtls_ecp_group_id of the context. + pub fn mbedtls_ecdh_get_grp_id(ctx: *mut mbedtls_ecdh_context) -> mbedtls_ecp_group_id; +} unsafe extern "C" { /// \brief Check whether a given group can be used for ECDH. /// @@ -20656,13 +21792,7 @@ unsafe extern "C" { grp: *mut mbedtls_ecp_group, d: *mut mbedtls_mpi, Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20701,13 +21831,7 @@ unsafe extern "C" { z: *mut mbedtls_mpi, Q: *const mbedtls_ecp_point, d: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20774,13 +21898,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20816,7 +21934,7 @@ unsafe extern "C" { /// \brief This function sets up an ECDH context from an EC key. /// /// It is used by clients and servers in place of the - /// ServerKeyEchange for static ECDH, and imports ECDH + /// ServerKeyExchange for static ECDH, and imports ECDH /// parameters from the EC key information of a certificate. /// /// \see ecp.h @@ -20865,13 +21983,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20932,19 +22044,14 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_ssl_premaster_secret { + pub dummy: ::core::ffi::c_uchar, pub _pms_rsa: [::core::ffi::c_uchar; 48usize], pub _pms_dhm: [::core::ffi::c_uchar; 1024usize], pub _pms_ecdh: [::core::ffi::c_uchar; 66usize], @@ -21216,6 +22323,8 @@ pub struct mbedtls_ssl_session { ///< MaxFragmentLength negotiated by peer pub private_mfl_code: ::core::ffi::c_uchar, pub private_exported: ::core::ffi::c_uchar, + ///< 0: client, 1: server + pub private_endpoint: u8, /// TLS version negotiated in the session. Used if and when renegotiating /// or resuming a session instead of the configured minor TLS version. pub private_tls_version: mbedtls_ssl_protocol_version, @@ -21234,15 +22343,13 @@ pub struct mbedtls_ssl_session { ///< RFC 5077 session ticket pub private_ticket: *mut ::core::ffi::c_uchar, ///< session ticket length - pub private_ticket_len: usize, - ///< ticket lifetime hint - pub private_ticket_lifetime: u32, - ///< 0: client, 1: server - pub private_endpoint: u8, - ///< Ticket flags - pub private_ticket_flags: u8, + pub private_ticket_len: usize, + ///< ticket lifetime hint + pub private_ticket_lifetime: u32, ///< Randomly generated value used to obscure the age of the ticket pub private_ticket_age_add: u32, + ///< Ticket flags + pub private_ticket_flags: u8, ///< resumption_key length pub private_resumption_key_len: u8, pub private_resumption_key: [::core::ffi::c_uchar; 48usize], @@ -21581,22 +22688,30 @@ pub struct mbedtls_ssl_context { ///number of retransmissions of request if ///renego_max_records is < 0 pub private_renego_records_seen: ::core::ffi::c_int, - /// Server: Negotiated TLS protocol version. - /// Client: Maximum TLS version to be negotiated, then negotiated TLS - /// version. - /// - /// It is initialized as the maximum TLS version to be negotiated in the - /// ClientHello writing preparation stage and used throughout the - /// ClientHello writing. For a fresh handshake not linked to any previous - /// handshake, it is initialized to the configured maximum TLS version - /// to be negotiated. When renegotiating or resuming a session, it is - /// initialized to the previously negotiated TLS version. - /// - /// Updated to the negotiated TLS version as soon as the ServerHello is - /// received. + /// Maximum TLS version to be negotiated, then negotiated TLS version. + /// + /// It is initialized as the configured maximum TLS version to be + /// negotiated by mbedtls_ssl_setup(). + /// + /// When renegotiating or resuming a session, it is overwritten in the + /// ClientHello writing preparation stage with the previously negotiated + /// TLS version. + /// + /// On client side, it is updated to the TLS version selected by the server + /// for the handshake when the ServerHello is received. + /// + /// On server side, it is updated to the TLS version the server selects for + /// the handshake when the ClientHello is received. pub private_tls_version: mbedtls_ssl_protocol_version, - ///< records with a bad MAC received - pub private_badmac_seen: ::core::ffi::c_uint, + /// Multipurpose field. + /// + /// - DTLS: records with a bad MAC received. + /// - TLS: accumulated length of handshake fragments (up to \c in_hslen). + /// + /// This field is multipurpose in order to preserve the ABI in the + /// Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + /// and called `badmac_seen`. + pub private_badmac_seen_or_in_hsfraglen: ::core::ffi::c_uint, /// Callback to customize X.509 certificate chain verification pub private_f_vrfy: ::core::option::Option< unsafe extern "C" fn( @@ -21733,8 +22848,33 @@ pub struct mbedtls_ssl_context { pub private_cur_out_ctr: [::core::ffi::c_uchar; 8usize], ///< path mtu, used to fragment outgoing messages pub private_mtu: u16, - ///< expected peer CN for verification - ///(and SNI if available) + /// Expected peer CN for verification. + /// + /// Also used on clients for SNI, + /// and for TLS 1.3 session resumption using tickets. + /// + /// The value of this field can be: + /// - \p NULL in a newly initialized or reset context. + /// - A heap-allocated copy of the last value passed to + /// mbedtls_ssl_set_hostname(), if the last call had a non-null + /// \p hostname argument. + /// - A special value to indicate that mbedtls_ssl_set_hostname() + /// was called with \p NULL (as opposed to never having been called). + /// See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + /// + /// If this field contains the value \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is unset, on a TLS client, attempting to verify a server certificate + /// results in the error + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + /// + /// If this field contains the special value described above, or if + /// the value is \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is set, then the peer name verification is skipped, which may be + /// insecure, especially on a client. Furthermore, on a client, the + /// server_name extension is not sent, and the server name is ignored + /// in TLS 1.3 session resumption using tickets. pub private_hostname: *mut ::core::ffi::c_char, ///< negotiated protocol pub private_alpn_chosen: *const ::core::ffi::c_char, @@ -21830,6 +22970,14 @@ unsafe extern "C" { /// Calling mbedtls_ssl_setup again is not supported, even /// if no session is active. /// + /// \warning After setting up a client context, if certificate-based + /// authentication is enabled, you should call + /// mbedtls_ssl_set_hostname() to specifiy the expected + /// name of the server. Without this, in most scenarios, + /// the TLS connection is insecure. See + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more information. + /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. @@ -21933,18 +23081,16 @@ unsafe extern "C" { unsafe extern "C" { /// \brief Set the random number generator callback /// + /// \note The callback with its parameter must remain valid as + /// long as there is an SSL context that uses the + /// SSL configuration. + /// /// \param conf SSL configuration /// \param f_rng RNG function (mandatory) /// \param p_rng RNG parameter pub fn mbedtls_ssl_conf_rng( conf: *mut mbedtls_ssl_config, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ); } @@ -22047,10 +23193,10 @@ unsafe extern "C" { /// \param own_cid The address of the readable buffer holding the CID we want /// the peer to use when sending encrypted messages to us. /// This may be \c NULL if \p own_cid_len is \c 0. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// \param own_cid_len The length of \p own_cid. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// /// \note The value of \p own_cid_len must match the value of the @@ -22705,16 +23851,16 @@ unsafe extern "C" { /// a full handshake. /// /// \note This function can handle a variety of mechanisms for session - /// resumption: For TLS 1.2, both session ID-based resumption and - /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and loading - /// one or more sessions via this call will lead to their - /// corresponding tickets being advertised as resumption PSKs - /// by the client. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// resumption: For TLS 1.2, both session ID-based resumption + /// and ticket-based resumption will be considered. For TLS 1.3, + /// sessions equate to tickets, and loading one session by + /// calling this function will lead to its corresponding ticket + /// being advertised as resumption PSK by the client. This + /// depends on session tickets being enabled (see + /// #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + /// If session tickets are disabled, a call to this function + /// with a TLS 1.3 session, will not have any effect on the next + /// handshake for the SSL context \p ssl. /// /// \param ssl The SSL context representing the connection which should /// be attempted to be setup using session resumption. This @@ -22729,9 +23875,10 @@ unsafe extern "C" { /// /// \return \c 0 if successful. /// \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session - /// could not be loaded because of an implementation limitation. - /// This error is non-fatal, and has no observable effect on - /// the SSL context or the session that was attempted to be loaded. + /// could not be loaded because one session has already been + /// loaded. This error is non-fatal, and has no observable + /// effect on the SSL context or the session that was attempted + /// to be loaded. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_get_session() @@ -22789,8 +23936,8 @@ unsafe extern "C" { /// /// \param session The session structure to be saved. /// \param buf The buffer to write the serialized data to. It must be a - /// writeable buffer of at least \p len bytes, or may be \c - /// NULL if \p len is \c 0. + /// writeable buffer of at least \p buf_len bytes, or may be \c + /// NULL if \p buf_len is \c 0. /// \param buf_len The number of bytes available for writing in \p buf. /// \param olen The size in bytes of the data that has been or would have /// been written. It must point to a valid \c size_t. @@ -22800,8 +23947,16 @@ unsafe extern "C" { /// to determine the necessary size by calling this function /// with \p buf set to \c NULL and \p buf_len to \c 0. /// + /// \note For TLS 1.3 sessions, this feature is supported only if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + /// as in TLS 1.3 session resumption is possible only with + /// tickets. + /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + /// and the session is a TLS 1.3 session. pub fn mbedtls_ssl_session_save( session: *const mbedtls_ssl_session, buf: *mut ::core::ffi::c_uchar, @@ -22927,7 +24082,7 @@ unsafe extern "C" { /// record headers. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len /// is too large. pub fn mbedtls_ssl_conf_cid( conf: *mut mbedtls_ssl_config, @@ -23254,6 +24409,8 @@ unsafe extern "C" { /// used for certificate signature are controlled by the /// verification profile, see \c mbedtls_ssl_conf_cert_profile(). /// + /// \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + /// /// \note This list should be ordered by decreasing preference /// (preferred hash first). /// @@ -23278,27 +24435,43 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Configure allowed signature algorithms for use in TLS 1.3 + /// \brief Configure allowed signature algorithms for use in TLS /// /// \param conf The SSL configuration to use. /// \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, - /// terminated by \c MBEDTLS_TLS1_3_SIG_NONE. The list must remain - /// available throughout the lifetime of the conf object. Supported - /// values are available as \c MBEDTLS_TLS1_3_SIG_XXXX + /// terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + /// available throughout the lifetime of the conf object. + /// - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + /// used. + /// - For TLS 1.2, values should be given as + /// "(HashAlgorithm << 8) | SignatureAlgorithm". pub fn mbedtls_ssl_conf_sig_algs(conf: *mut mbedtls_ssl_config, sig_algs: *const u16); } unsafe extern "C" { /// \brief Set or reset the hostname to check against the received - /// server certificate. It sets the ServerName TLS extension, - /// too, if that extension is enabled. (client-side only) + /// peer certificate. On a client, this also sets the + /// ServerName TLS extension, if that extension is enabled. + /// On a TLS 1.3 client, this also sets the server name in + /// the session resumption ticket, if that feature is enabled. /// /// \param ssl SSL context - /// \param hostname the server hostname, may be NULL to clear hostname - /// - /// \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. - /// - /// \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on - /// allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + /// \param hostname The server hostname. This may be \c NULL to clear + /// the hostname. + /// + /// \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + /// + /// \note If the hostname is \c NULL on a client, then the server + /// is not authenticated: it only needs to have a valid + /// certificate, not a certificate matching its name. + /// Therefore you should always call this function on a client, + /// unless the connection is set up to only allow + /// pre-shared keys, or in scenarios where server + /// impersonation is not a concern. See the documentation of + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more details. + /// + /// \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + /// allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on /// too long input hostname. /// /// Hostname set to the one provided on success (cleared @@ -23311,8 +24484,8 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief Retrieve SNI extension value for the current handshake. - /// Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), - /// this is the same value passed to \p f_sni callback of + /// Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + /// this is the same value passed to \c f_sni callback of /// \c mbedtls_ssl_conf_sni() and may be used instead of /// \c mbedtls_ssl_conf_sni(). /// @@ -23321,10 +24494,10 @@ unsafe extern "C" { /// 0 if SNI extension is not present or not yet processed. /// /// \return const pointer to SNI extension value. - /// - value is valid only when called in \p f_cert_cb + /// - value is valid only when called in \c f_cert_cb /// registered with \c mbedtls_ssl_conf_cert_cb(). /// - value is NULL if SNI extension is not present. - /// - value is not '\0'-terminated. Use \c name_len for len. + /// - value is not '\0'-terminated. Use \c name_len for len. /// - value must not be freed. pub fn mbedtls_ssl_get_hs_sni( ssl: *mut mbedtls_ssl_context, @@ -23574,6 +24747,10 @@ unsafe extern "C" { /// with \c mbedtls_ssl_read()), not handshake messages. /// With DTLS, this affects both ApplicationData and handshake. /// + /// \note Defragmentation of TLS handshake messages is supported + /// with some limitations. See the documentation of + /// mbedtls_ssl_handshake() for details. + /// /// \note This sets the maximum length for a record's payload, /// excluding record overhead that will be added to it, see /// \c mbedtls_ssl_get_record_expansion(). @@ -23607,19 +24784,48 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Enable / Disable session tickets (client only). - /// (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + /// \brief Enable / Disable TLS 1.2 session tickets (client only, + /// TLS 1.2 only). Enabled by default. /// /// \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). /// /// \param conf SSL configuration - /// \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or - /// MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + /// \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) pub fn mbedtls_ssl_conf_session_tickets( conf: *mut mbedtls_ssl_config, use_tickets: ::core::ffi::c_int, ); } +unsafe extern "C" { + /// \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + /// (client only, TLS 1.3 only). + /// + /// The handling of TLS 1.3 NewSessionTicket messages is disabled by + /// default. + /// + /// In TLS 1.3, servers may send a NewSessionTicket message at any time, + /// and may send multiple NewSessionTicket messages. By default, TLS 1.3 + /// clients ignore NewSessionTicket messages. + /// + /// To support session tickets in TLS 1.3 clients, call this function + /// with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + /// this is enabled, when a client receives a NewSessionTicket message, + /// the next call to a message processing functions (notably + /// mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + /// call mbedtls_ssl_get_session() to retrieve the session ticket before + /// calling the same message processing function again. + /// + /// \param conf SSL configuration + /// \param signal_new_session_tickets Enable or disable + /// (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + pub fn mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + conf: *mut mbedtls_ssl_config, + signal_new_session_tickets: ::core::ffi::c_int, + ); +} unsafe extern "C" { /// \brief Number of NewSessionTicket messages for the server to send /// after handshake completion. @@ -23948,29 +25154,22 @@ unsafe extern "C" { /// \param ssl The SSL context representing the connection for which to /// to export a session structure for later resumption. /// \param session The target structure in which to store the exported session. - /// This must have been initialized with mbedtls_ssl_init_session() + /// This must have been initialized with mbedtls_ssl_session_init() /// but otherwise be unused. /// /// \note This function can handle a variety of mechanisms for session /// resumption: For TLS 1.2, both session ID-based resumption and /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and calling - /// this function multiple times will export the available - /// tickets one a time until no further tickets are available, - /// in which case MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE will - /// be returned. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// sessions equate to tickets, and if session tickets are + /// enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + /// option), this function exports the last received ticket and + /// the exported session may be used to resume the TLS 1.3 + /// session. If session tickets are disabled, exported sessions + /// cannot be used to resume a TLS 1.3 session. /// /// \return \c 0 if successful. In this case, \p session can be used for /// session resumption by passing it to mbedtls_ssl_set_session(), /// and serialized for storage via mbedtls_ssl_session_save(). - /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no further session - /// is available for export. - /// This error is a non-fatal, and has no observable effect on - /// the SSL context or the destination session. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_set_session() @@ -24002,6 +25201,17 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use /// and the client did not demonstrate reachability yet - in /// this case you must stop using the context (see below). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24010,7 +25220,9 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24030,10 +25242,31 @@ unsafe extern "C" { /// currently being processed might or might not contain further /// DTLS records. /// - /// \note If the context is configured to allow TLS 1.3, or if - /// #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. + /// Otherwise, the handshake may call psa_crypto_init() + /// if a negotiation involving TLS 1.3 takes place (this may + /// be the case even if TLS 1.3 is offered but eventually + /// not selected). + /// + /// \note In TLS, reception of fragmented handshake messages is + /// supported with some limitations (those limitations do + /// not apply to DTLS, where defragmentation is fully + /// supported): + /// - On an Mbed TLS server that only accepts TLS 1.2, + /// the initial ClientHello message must not be fragmented. + /// A TLS 1.2 ClientHello may be fragmented if the server + /// also accepts TLS 1.3 connections (meaning + /// that #MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the + /// accepted versions have not been restricted with + /// mbedtls_ssl_conf_max_tls_version() or the like). + /// - The first fragment of a handshake message must be + /// at least 4 bytes long. + /// - Non-handshake records must not be interleaved between + /// the fragments of a handshake message. (This is permitted + /// in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + /// even in TLS 1.2.) pub fn mbedtls_ssl_handshake(ssl: *mut mbedtls_ssl_context) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -24062,8 +25295,10 @@ unsafe extern "C" { /// /// \warning If this function returns something other than \c 0, /// #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using /// the SSL context for reading or writing, and either free it /// or call \c mbedtls_ssl_session_reset() on it before /// re-using it for a new connection; the current connection @@ -24126,6 +25361,24 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server /// side of a DTLS connection and the client is initiating a /// new connection using the same source port. See below. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. + /// This error code is only returned on the client side. It is + /// only returned if handling of TLS 1.3 NewSessionTicket + /// messages has been enabled through + /// mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + /// This error code indicates that a TLS 1.3 NewSessionTicket + /// message has been received and parsed successfully by the + /// client. The ticket data can be retrieved from the SSL + /// context by calling mbedtls_ssl_get_session(). It remains + /// available until the next call to mbedtls_ssl_read(). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24134,8 +25387,10 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24202,6 +25457,17 @@ unsafe extern "C" { /// operation is in progress (see mbedtls_ecp_set_max_ops()) - /// in this case you must call this function again to complete /// the handshake when you're done attending other tasks. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24209,8 +25475,10 @@ unsafe extern "C" { /// a non-negative value, /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24451,381 +25719,64 @@ unsafe extern "C" { /// \brief Free an SSL configuration context /// /// \param conf SSL configuration context - pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); -} -unsafe extern "C" { - /// \brief Initialize SSL session structure - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief Free referenced items in an SSL session including the - /// peer certificate and clear memory - /// - /// \note A session object can be freed even if the SSL context - /// that was used to retrieve the session is still in use. - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief TLS-PRF function for key derivation. - /// - /// \param prf The tls_prf type function type to be used. - /// \param secret Secret for the key derivation function. - /// \param slen Length of the secret. - /// \param label String label for the key derivation function, - /// terminated with null character. - /// \param random Random bytes. - /// \param rlen Length of the random bytes buffer. - /// \param dstbuf The buffer holding the derived key. - /// \param dlen Length of the output buffer. - /// - /// \return 0 on success. An SSL specific error on failure. - pub fn mbedtls_ssl_tls_prf( - prf: mbedtls_tls_prf_types, - secret: *const ::core::ffi::c_uchar, - slen: usize, - label: *const ::core::ffi::c_char, - random: *const ::core::ffi::c_uchar, - rlen: usize, - dstbuf: *mut ::core::ffi::c_uchar, - dlen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the threshold error level to handle globally all debug output. - /// Debug messages that have a level over the threshold value are - /// discarded. - /// (Default value: 0 = No debug ) - /// - /// \param threshold threshold level of messages to filter on. Messages at a - /// higher level will be discarded. - /// - Debug levels - /// - 0 No debug - /// - 1 Error - /// - 2 State change - /// - 3 Informational - /// - 4 Verbose - pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); -} -unsafe extern "C" { - /// \brief Print a message to the debug output. This function is always used - /// through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl - /// context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the message has occurred in - /// \param line line number the message has occurred at - /// \param format format specifier, in printf format - /// \param ... variables used by the format specifier - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_msg( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - format: *const ::core::ffi::c_char, - ... - ); -} -unsafe extern "C" { - /// \brief Print the return value of a function to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text the name of the function that returned the error - /// \param ret the return code value - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ret( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - ret: ::core::ffi::c_int, - ); -} -unsafe extern "C" { - /// \brief Output a buffer of size len bytes to the debug output. This function - /// is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the buffer being dumped. Normally the - /// variable or buffer name - /// \param buf the buffer to be outputted - /// \param len length of the buffer - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_buf( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - buf: *const ::core::ffi::c_uchar, - len: usize, - ); -} -unsafe extern "C" { - /// \brief Print a MPI variable to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the MPI being output. Normally the - /// variable name - /// \param X the MPI variable - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_mpi( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_mpi, - ); -} -unsafe extern "C" { - /// \brief Print an ECP point to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the ECP point being output. Normally the - /// variable name - /// \param X the ECP point - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ecp( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_ecp_point, - ); -} -unsafe extern "C" { - /// \brief Print a X.509 certificate structure to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the certificate being output - /// \param crt X.509 certificate structure - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_crt( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - crt: *const mbedtls_x509_crt, - ); -} -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Q: mbedtls_debug_ecdh_attr = 0; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_QP: mbedtls_debug_ecdh_attr = 1; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Z: mbedtls_debug_ecdh_attr = 2; -pub type mbedtls_debug_ecdh_attr = ::core::ffi::c_uint; -unsafe extern "C" { - /// \brief Print a field of the ECDH structure in the SSL context to the debug - /// output. This function is always used through the - /// MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file - /// and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param ecdh the ECDH context - /// \param attr the identifier of the attribute being output - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_printf_ecdh( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - ecdh: *const mbedtls_ecdh_context, - attr: mbedtls_debug_ecdh_attr, - ); -} -/// \brief Entropy poll callback pointer -/// -/// \param data Callback-specific data pointer -/// \param output Data to fill -/// \param len Maximum size to provide -/// \param olen The actual amount of bytes put into the buffer (Can be 0) -/// -/// \return 0 if no critical failures occurred, -/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise -pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< - unsafe extern "C" fn( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - ) -> ::core::ffi::c_int, ->; -/// \brief Entropy source state -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_source_state { - ///< The entropy source callback - pub private_f_source: mbedtls_entropy_f_source_ptr, - ///< The callback data pointer - pub private_p_source: *mut ::core::ffi::c_void, - ///< Amount received in bytes - pub private_size: usize, - ///< Minimum bytes required before release - pub private_threshold: usize, - ///< Is the source strong? - pub private_strong: ::core::ffi::c_int, -} -impl Default for mbedtls_entropy_source_state { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief Entropy context structure -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_context { - pub private_accumulator_started: ::core::ffi::c_int, - pub __bindgen_padding_0: u64, - pub private_accumulator: mbedtls_sha512_context, - pub private_source_count: ::core::ffi::c_int, - pub private_source: [mbedtls_entropy_source_state; 20usize], -} -impl Default for mbedtls_entropy_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize the context - /// - /// \param ctx Entropy context to initialize - pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Free the data in the context - /// - /// \param ctx Entropy context to free - pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Adds an entropy source to poll - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context - /// \param f_source Entropy function - /// \param p_source Function data - /// \param threshold Minimum required from source before entropy is released - /// ( with mbedtls_entropy_func() ) (in bytes) - /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or - /// MBEDTLS_ENTROPY_SOURCE_WEAK. - /// At least one strong source needs to be added. - /// Weaker sources (such as the cycle counter) can be used as - /// a complement. - /// - /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES - pub fn mbedtls_entropy_add_source( - ctx: *mut mbedtls_entropy_context, - f_source: mbedtls_entropy_f_source_ptr, - p_source: *mut ::core::ffi::c_void, - threshold: usize, - strong: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); } unsafe extern "C" { - /// \brief Trigger an extra gather poll for the accumulator - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context + /// \brief Initialize SSL session structure /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Retrieve entropy from the accumulator - /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief Free referenced items in an SSL session including the + /// peer certificate and clear memory /// - /// \param data Entropy context - /// \param output Buffer to fill - /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + /// \note A session object can be freed even if the SSL context + /// that was used to retrieve the session is still in use. /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_func( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Add data to the accumulator manually - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief TLS-PRF function for key derivation. /// - /// \param ctx Entropy context - /// \param data Data to add - /// \param len Length of data + /// \param prf The tls_prf type function type to be used. + /// \param secret Secret for the key derivation function. + /// \param slen Length of the secret. + /// \param label String label for the key derivation function, + /// terminated with null character. + /// \param random Random bytes. + /// \param rlen Length of the random bytes buffer. + /// \param dstbuf The buffer holding the derived key. + /// \param dlen Length of the output buffer. /// - /// \return 0 if successful - pub fn mbedtls_entropy_update_manual( - ctx: *mut mbedtls_entropy_context, - data: *const ::core::ffi::c_uchar, - len: usize, + /// \return 0 on success. An SSL specific error on failure. + pub fn mbedtls_ssl_tls_prf( + prf: mbedtls_tls_prf_types, + secret: *const ::core::ffi::c_uchar, + slen: usize, + label: *const ::core::ffi::c_char, + random: *const ::core::ffi::c_uchar, + rlen: usize, + dstbuf: *mut ::core::ffi::c_uchar, + dlen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Checkup routine - /// - /// This module self-test also calls the entropy self-test, - /// mbedtls_entropy_source_self_test(); + /// \brief Set the threshold error level to handle globally all debug output. + /// Debug messages that have a level over the threshold value are + /// discarded. + /// (Default value: 0 = No debug ) /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; + /// \param threshold threshold level of messages to filter on. Messages at a + /// higher level will be discarded. + /// - Debug levels + /// - 0 No debug + /// - 1 Error + /// - 2 State change + /// - 3 Informational + /// - 4 Verbose + pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); } unsafe extern "C" { /// \brief This is the HMAC-based Extract-and-Expand Key Derivation Function @@ -24994,8 +25945,8 @@ unsafe extern "C" { /// \param len The length of the personalization string. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + /// where \c entropy_len is the entropy length /// described above. /// /// \return \c 0 if successful. @@ -25120,8 +26071,8 @@ unsafe extern "C" { /// \param len The length of the additional data. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length /// (see mbedtls_hmac_drbg_set_entropy_len()). /// /// \return \c 0 if successful. @@ -25604,6 +26555,28 @@ unsafe extern "C" { oid: *const mbedtls_asn1_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate a string containing a dotted-decimal + /// representation of an ASN.1 OID into its encoded form + /// (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + /// On success, this function allocates oid->buf from the + /// heap. It must be freed by the caller using mbedtls_free(). + /// + /// \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + /// \param oid_str string representation of the OID to parse + /// \param size length of the OID string, not including any null terminator + /// + /// \return 0 if successful + /// \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + /// represent a valid OID + /// \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + /// allocate oid->buf + pub fn mbedtls_oid_from_numeric_string( + oid: *mut mbedtls_asn1_buf, + oid_str: *const ::core::ffi::c_char, + size: usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate an X.509 extension OID into local values /// @@ -25681,6 +26654,34 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate AlgorithmIdentifier OID into an EC group identifier, + /// for curves that are directly encoded at this level + /// + /// \param oid OID to use + /// \param grp_id place to store group id + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_ec_grp_algid( + oid: *const mbedtls_asn1_buf, + grp_id: *mut mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Translate EC group identifier into AlgorithmIdentifier OID, + /// for curves that are directly encoded at this level + /// + /// \param grp_id EC group identifier + /// \param oid place to store ASN.1 OID string pointer + /// \param olen length of the OID + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_oid_by_ec_grp_algid( + grp_id: mbedtls_ecp_group_id, + oid: *mut *const ::core::ffi::c_char, + olen: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate SignatureAlgorithm OID into md_type and pk_type /// @@ -25848,11 +26849,11 @@ unsafe extern "C" { /// \param data source data to look in (must be nul-terminated) /// \param pwd password for decryption (can be NULL) /// \param pwdlen length of password - /// \param use_len destination for total length used (set after header is - /// correctly read, so unless you get + /// \param use_len destination for total length used from data buffer. It is + /// set after header is correctly read, so unless you get /// MBEDTLS_ERR_PEM_BAD_INPUT_DATA or /// MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is - /// the length to skip) + /// the length to skip. /// /// \note Attempts to check password correctness by verifying if /// the decrypted text starts with an ASN.1 sequence of @@ -25917,13 +26918,40 @@ unsafe extern "C" { unsafe extern "C" { /// \brief PKCS#5 PBES2 function /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs5_pbes2_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params the ASN.1 algorithm parameters - /// \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT /// \param pwd password to use when generating key /// \param pwdlen length of password /// \param data data to process /// \param datalen length of data - /// \param output output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. pub fn mbedtls_pkcs5_pbes2( @@ -25936,6 +26964,50 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief PKCS#5 PBES2 function + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params the ASN.1 algorithm parameters + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + /// \param pwd password to use when generating key + /// \param pwdlen length of password + /// \param data data to process + /// \param datalen length of data + /// \param output Output buffer. + /// On success, it contains the decrypted data. + /// On failure, the content is indetermidate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + pub fn mbedtls_pkcs5_pbes2_ext( + pbe_params: *const mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, + datalen: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context /// @@ -26167,6 +27239,25 @@ unsafe extern "C" { /// \brief PKCS12 Password Based function (encryption / decryption) /// for cipher-based and mbedtls_md-based PBE's /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs12_pbe_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or /// #MBEDTLS_PKCS12_PBE_DECRYPT @@ -26175,9 +27266,17 @@ unsafe extern "C" { /// \param pwd Latin1-encoded password used. This may only be \c NULL when /// \p pwdlen is 0. No null terminator should be used. /// \param pwdlen length of the password (may be 0) - /// \param input the input data + /// \param data the input data /// \param len data length - /// \param output the output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \return 0 if successful, or a MBEDTLS_ERR_XXX code pub fn mbedtls_pkcs12_pbe( @@ -26187,9 +27286,62 @@ unsafe extern "C" { md_type: mbedtls_md_type_t, pwd: *const ::core::ffi::c_uchar, pwdlen: usize, - input: *const ::core::ffi::c_uchar, + data: *const ::core::ffi::c_uchar, + len: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief PKCS12 Password Based function (encryption / decryption) + /// for cipher-based and mbedtls_md-based PBE's + /// + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + /// #MBEDTLS_PKCS12_PBE_DECRYPT + /// \param cipher_type the cipher used + /// \param md_type the mbedtls_md used + /// \param pwd Latin1-encoded password used. This may only be \c NULL when + /// \p pwdlen is 0. No null terminator should be used. + /// \param pwdlen length of the password (may be 0) + /// \param data the input data + /// \param len data length + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \return 0 if successful, or a MBEDTLS_ERR_XXX code + pub fn mbedtls_pkcs12_pbe_ext( + pbe_params: *mut mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + cipher_type: mbedtls_cipher_type_t, + md_type: mbedtls_md_type_t, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, len: usize, output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -26288,6 +27440,11 @@ unsafe extern "C" { /// \param session_id_len The length of \p session_id in bytes. /// \param session The address at which to store the session /// associated with \p session_id, if present. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + /// no cache entry with specified session ID found, or + /// any other negative error code for other failures. pub fn mbedtls_ssl_cache_get( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26304,6 +27461,9 @@ unsafe extern "C" { /// associated to \p session. /// \param session_id_len The length of \p session_id in bytes. /// \param session The session to store. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_set( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26317,12 +27477,13 @@ unsafe extern "C" { /// /// \param data The SSL cache context to use. /// \param session_id The pointer to the buffer holding the session ID - /// associated to \p session. + /// associated to session. /// \param session_id_len The length of \p session_id in bytes. /// - /// \return 0: The cache entry for session with provided ID - /// is removed or does not exist. - /// Otherwise: fail. + /// \return \c 0 on success. This indicates the cache entry for + /// the session with provided ID is removed or does not + /// exist. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_remove( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26375,13 +27536,7 @@ unsafe extern "C" { /// \brief Setup cookie context (generate keys) pub fn mbedtls_ssl_cookie_setup( ctx: *mut mbedtls_ssl_cookie_ctx, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26427,6 +27582,9 @@ unsafe extern "C" { #[derive(Copy, Clone)] pub struct mbedtls_ssl_ticket_key { pub private_name: [::core::ffi::c_uchar; 4usize], + /// Lifetime of the key in seconds. This is also the lifetime of the + /// tickets created under that key. + pub private_lifetime: u32, ///< context for auth enc/decryption pub private_ctx: mbedtls_cipher_context_t, } @@ -26482,7 +27640,9 @@ unsafe extern "C" { /// /// \param ctx Context to be set up /// \param f_rng RNG callback function (mandatory) - /// \param p_rng RNG callback context + /// \param p_rng RNG callback context. + /// Note that the RNG callback must remain valid + /// until the ticket context is freed. /// \param cipher AEAD cipher to use for ticket protection. /// Recommended value: MBEDTLS_CIPHER_AES_256_GCM. /// \param lifetime Tickets lifetime in seconds @@ -26492,21 +27652,21 @@ unsafe extern "C" { /// least as strong as the strongest ciphersuite /// supported. Usually that means a 256-bit key. /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_setup( ctx: *mut mbedtls_ssl_ticket_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, cipher: mbedtls_cipher_type_t, lifetime: u32, @@ -26537,10 +27697,16 @@ unsafe extern "C" { /// \note \c klength must be sufficient for use by cipher specified /// to \c mbedtls_ssl_ticket_setup /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_rotate( @@ -26606,7 +27772,7 @@ pub struct mbedtls_x509_csr { pub key_usage: ::core::ffi::c_uint, ///< Optional Netscape certificate type extension value: See the values in x509.h pub ns_cert_type: ::core::ffi::c_uchar, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions pub private_ext_types: ::core::ffi::c_int, @@ -26646,25 +27812,12 @@ impl Default for mbedtls_x509write_csr { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_x509_san_list { - pub node: mbedtls_x509_subject_alternative_name, - pub next: *mut mbedtls_x509_san_list, -} -impl Default for mbedtls_x509_san_list { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR) in DER format /// - /// \note CSR attributes (if any) are currently silently ignored. + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the CSR is rejected. /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling @@ -26681,6 +27834,70 @@ unsafe extern "C" { buflen: usize, ) -> ::core::ffi::c_int; } +/// \brief The type of certificate extension callbacks. +/// +/// Callbacks of this type are passed to and used by the +/// mbedtls_x509_csr_parse_der_with_ext_cb() routine when +/// it encounters either an unsupported extension. +/// Future versions of the library may invoke the callback +/// in other cases, if and when the need arises. +/// +/// \param p_ctx An opaque context passed to the callback. +/// \param csr The CSR being parsed. +/// \param oid The OID of the extension. +/// \param critical Whether the extension is critical. +/// \param p Pointer to the start of the extension value +/// (the content of the OCTET STRING). +/// \param end End of extension value. +/// +/// \note The callback must fail and return a negative error code +/// if it can not parse or does not support the extension. +/// When the callback fails to parse a critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() also fails. +/// When the callback fails to parse a non critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() simply skips +/// the extension and continues parsing. +/// +/// \return \c 0 on success. +/// \return A negative error code on failure. +pub type mbedtls_x509_csr_ext_cb_t = ::core::option::Option< + unsafe extern "C" fn( + p_ctx: *mut ::core::ffi::c_void, + csr: *const mbedtls_x509_csr, + oid: *const mbedtls_x509_buf, + critical: ::core::ffi::c_int, + p: *const ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +unsafe extern "C" { + /// \brief Load a Certificate Signing Request (CSR) in DER format + /// + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the result of the callback function decides whether + /// CSR is rejected. + /// + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. + /// + /// \param csr CSR context to fill + /// \param buf buffer holding the CRL data + /// \param buflen size of the buffer + /// \param cb A callback invoked for every unsupported certificate + /// extension. + /// \param p_ctx An opaque context passed to the callback. + /// + /// \return 0 if successful, or a specific X509 error code + pub fn mbedtls_x509_csr_parse_der_with_ext_cb( + csr: *mut mbedtls_x509_csr, + buf: *const ::core::ffi::c_uchar, + buflen: usize, + cb: mbedtls_x509_csr_ext_cb_t, + p_ctx: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR), DER or PEM format /// @@ -26742,7 +27959,7 @@ unsafe extern "C" { /// \brief Set the subject name for a CSR /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CSR context to use /// \param subject_name subject name to set @@ -26873,13 +28090,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26900,13 +28111,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } diff --git a/esp-mbedtls-sys/src/include/riscv32imc-unknown-none-elf.rs b/esp-mbedtls-sys/src/include/riscv32imc-unknown-none-elf.rs index 42738ece..a7588196 100644 --- a/esp-mbedtls-sys/src/include/riscv32imc-unknown-none-elf.rs +++ b/esp-mbedtls-sys/src/include/riscv32imc-unknown-none-elf.rs @@ -137,6 +137,36 @@ where } } } +#[repr(C)] +#[derive(Default)] +pub struct __IncompleteArrayField(::core::marker::PhantomData, [T; 0]); +impl __IncompleteArrayField { + #[inline] + pub const fn new() -> Self { + __IncompleteArrayField(::core::marker::PhantomData, []) + } + #[inline] + pub fn as_ptr(&self) -> *const T { + self as *const _ as *const T + } + #[inline] + pub fn as_mut_ptr(&mut self) -> *mut T { + self as *mut _ as *mut T + } + #[inline] + pub unsafe fn as_slice(&self, len: usize) -> &[T] { + ::core::slice::from_raw_parts(self.as_ptr(), len) + } + #[inline] + pub unsafe fn as_mut_slice(&mut self, len: usize) -> &mut [T] { + ::core::slice::from_raw_parts_mut(self.as_mut_ptr(), len) + } +} +impl ::core::fmt::Debug for __IncompleteArrayField { + fn fmt(&self, fmt: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result { + fmt.write_str("__IncompleteArrayField") + } +} pub const MBEDTLS_CONFIG_FILE: &[u8; 9] = b"config.h\0"; pub const MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT: u32 = 0; pub const MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: u32 = 1024; @@ -144,14 +174,33 @@ pub const MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE: u32 = 6000; pub const MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH: u32 = 32; pub const MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS: u32 = 1; pub const MBEDTLS_VERSION_MAJOR: u32 = 3; -pub const MBEDTLS_VERSION_MINOR: u32 = 4; -pub const MBEDTLS_VERSION_PATCH: u32 = 0; -pub const MBEDTLS_VERSION_NUMBER: u32 = 50593792; -pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.4.0\0"; -pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"mbed TLS 3.4.0\0"; +pub const MBEDTLS_VERSION_MINOR: u32 = 6; +pub const MBEDTLS_VERSION_PATCH: u32 = 5; +pub const MBEDTLS_VERSION_NUMBER: u32 = 50726144; +pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.6.5\0"; +pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"Mbed TLS 3.6.5\0"; +pub const PSA_WANT_ALG_MD5: u32 = 1; +pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; +pub const PSA_WANT_ALG_SHA_1: u32 = 1; +pub const PSA_WANT_ALG_SHA_224: u32 = 1; +pub const PSA_WANT_ALG_SHA_256: u32 = 1; +pub const PSA_WANT_ALG_SHA_384: u32 = 1; +pub const PSA_WANT_ALG_SHA_512: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_256: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_384: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_512: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_255: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_448: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_224: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_256: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_384: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_521: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CCM: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CMAC: u32 = 1; pub const PSA_WANT_ALG_CMAC: u32 = 1; @@ -162,10 +211,40 @@ pub const PSA_WANT_ALG_ECDSA: u32 = 1; pub const PSA_WANT_ALG_ECDSA_ANY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA: u32 = 1; pub const PSA_WANT_ALG_DETERMINISTIC_ECDSA: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_ALG_FFDH: u32 = 1; +pub const PSA_WANT_DH_RFC7919_2048: u32 = 1; +pub const PSA_WANT_DH_RFC7919_3072: u32 = 1; +pub const PSA_WANT_DH_RFC7919_4096: u32 = 1; +pub const PSA_WANT_DH_RFC7919_6144: u32 = 1; +pub const PSA_WANT_DH_RFC7919_8192: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_FFDH: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_GCM: u32 = 1; pub const PSA_WANT_ALG_GCM: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HMAC: u32 = 1; @@ -176,17 +255,16 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXTRACT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXPAND: u32 = 1; +pub const PSA_WANT_KEY_TYPE_HMAC: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF: u32 = 1; pub const PSA_WANT_ALG_TLS12_PRF: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const PSA_WANT_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_MD5: u32 = 1; -pub const PSA_WANT_ALG_MD5: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_PAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_JPAKE: u32 = 1; pub const PSA_WANT_ALG_JPAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160: u32 = 1; -pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const PSA_WANT_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN: u32 = 1; @@ -196,20 +274,19 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP: u32 = 1; pub const PSA_WANT_ALG_RSA_OAEP: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS: u32 = 1; pub const PSA_WANT_ALG_RSA_PSS: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_1: u32 = 1; -pub const PSA_WANT_ALG_SHA_1: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_224: u32 = 1; -pub const PSA_WANT_ALG_SHA_224: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_256: u32 = 1; -pub const PSA_WANT_ALG_SHA_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_384: u32 = 1; -pub const PSA_WANT_ALG_SHA_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_512: u32 = 1; -pub const PSA_WANT_ALG_SHA_512: u32 = 1; pub const PSA_WANT_KEY_TYPE_AES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES: u32 = 1; pub const PSA_WANT_KEY_TYPE_ARIA: u32 = 1; @@ -221,8 +298,8 @@ pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_KEY_TYPE_CHACHA20: u32 = 1; -pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20: u32 = 1; +pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER: u32 = 1; pub const PSA_WANT_ALG_CHACHA20_POLY1305: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305: u32 = 1; @@ -250,8 +327,7 @@ pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256: u32 = 1; -pub const PSA_HAVE_FULL_ECDSA: u32 = 1; -pub const PSA_HAVE_FULL_JPAKE: u32 = 1; +pub const PSA_WANT_ALG_SOME_PAKE: u32 = 1; pub const PSA_WANT_KEY_TYPE_DERIVE: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD_HASH: u32 = 1; @@ -272,7 +348,7 @@ pub const MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: i32 = -12; pub const MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: i32 = -14; pub const MBEDTLS_ERR_MPI_ALLOC_FAILED: i32 = -16; pub const MBEDTLS_MPI_MAX_LIMBS: u32 = 10000; -pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 2; +pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 3; pub const MBEDTLS_MPI_MAX_SIZE: u32 = 1024; pub const MBEDTLS_MPI_MAX_BITS: u32 = 8192; pub const MBEDTLS_MPI_MAX_BITS_SCALE100: u32 = 819200; @@ -320,6 +396,8 @@ pub const MBEDTLS_CIPHER_VARIABLE_KEY_LEN: u32 = 2; pub const MBEDTLS_MAX_IV_LENGTH: u32 = 16; pub const MBEDTLS_MAX_BLOCK_LENGTH: u32 = 16; pub const MBEDTLS_MAX_KEY_LENGTH: u32 = 64; +pub const MBEDTLS_KEY_BITLEN_SHIFT: u32 = 6; +pub const MBEDTLS_IV_SIZE_SHIFT: u32 = 2; pub const MBEDTLS_CCM_DECRYPT: u32 = 0; pub const MBEDTLS_CCM_ENCRYPT: u32 = 1; pub const MBEDTLS_CCM_STAR_DECRYPT: u32 = 2; @@ -332,7 +410,26 @@ pub const MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: i32 = -84; pub const MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: i32 = -86; pub const MBEDTLS_AES_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_DES3_BLOCK_SIZE: u32 = 8; +pub const MBEDTLS_CMAC_MAX_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_CIPHER_BLKSIZE_MAX: u32 = 16; +pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; +pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; +pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; +pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; +pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; +pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; +pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; +pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; +pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; +pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; +pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; +pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; +pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; +pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; +pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; +pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; +pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; +pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: i32 = -52; pub const MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: i32 = -54; pub const MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: i32 = -56; @@ -367,12 +464,6 @@ pub const MBEDTLS_ECP_MAX_PT_LEN: u32 = 133; pub const MBEDTLS_ECP_PF_UNCOMPRESSED: u32 = 0; pub const MBEDTLS_ECP_PF_COMPRESSED: u32 = 1; pub const MBEDTLS_ECP_TLS_NAMED_CURVE: u32 = 3; -pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; -pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; -pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; -pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; -pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; -pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; pub const MBEDTLS_ERR_RSA_BAD_INPUT_DATA: i32 = -16512; pub const MBEDTLS_ERR_RSA_INVALID_PADDING: i32 = -16640; pub const MBEDTLS_ERR_RSA_KEY_GEN_FAILED: i32 = -16768; @@ -387,6 +478,55 @@ pub const MBEDTLS_RSA_PKCS_V21: u32 = 1; pub const MBEDTLS_RSA_SIGN: u32 = 1; pub const MBEDTLS_RSA_CRYPT: u32 = 2; pub const MBEDTLS_RSA_SALT_LEN_ANY: i32 = -1; +pub const MBEDTLS_RSA_GEN_KEY_MIN_BITS: u32 = 1024; +pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; +pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; +pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; +pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; +pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; +pub const PSA_HASH_MAX_SIZE: u32 = 64; +pub const PSA_MAC_MAX_SIZE: u32 = 64; +pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; +pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; +pub const PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS: u32 = 1024; +pub const PSA_VENDOR_FFDH_MAX_KEY_BITS: u32 = 8192; +pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; +pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; +pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; +pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; +pub const PSA_VENDOR_PBKDF2_MAX_ITERATIONS: u32 = 4294967295; +pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; +pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_SIGNATURE_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_KEY_PAIR_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_PUBLIC_KEY_MAX_SIZE: u32 = 1; +pub const PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE: u32 = 1; +pub const PSA_CIPHER_MAX_KEY_LENGTH: u32 = 32; +pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; +pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; +pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; +pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; +pub const MBEDTLS_ERR_SHA3_BAD_INPUT_DATA: i32 = -118; +pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; +pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; +pub const MBEDTLS_GCM_DECRYPT: u32 = 0; +pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; +pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; +pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; +pub const MBEDTLS_GCM_HTABLE_SIZE: u32 = 16; +pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; +pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; +pub const PSA_MAX_KEY_BITS: u32 = 65528; +pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; +pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; +pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; +pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; +pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; +pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; +pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_ERR_PK_ALLOC_FAILED: i32 = -16256; pub const MBEDTLS_ERR_PK_TYPE_MISMATCH: i32 = -16128; pub const MBEDTLS_ERR_PK_BAD_INPUT_DATA: i32 = -16000; @@ -597,45 +737,6 @@ pub const MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256: u32 = 4869; pub const MBEDTLS_CIPHERSUITE_WEAK: u32 = 1; pub const MBEDTLS_CIPHERSUITE_SHORT_TAG: u32 = 2; pub const MBEDTLS_CIPHERSUITE_NODTLS: u32 = 4; -pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; -pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; -pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; -pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; -pub const PSA_HASH_MAX_SIZE: u32 = 64; -pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; -pub const PSA_MAC_MAX_SIZE: u32 = 64; -pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; -pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; -pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; -pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; -pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; -pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; -pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; -pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; -pub const MBEDTLS_GCM_DECRYPT: u32 = 0; -pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; -pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; -pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; -pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; -pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; -pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; -pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; -pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; -pub const PSA_MAX_KEY_BITS: u32 = 65528; -pub const MBEDTLS_PSA_KA_MASK_DUAL_USE: u32 = 0; -pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; -pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; -pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; -pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; -pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; -pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; -pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_X509_MAX_INTERMEDIATE_CA: u32 = 8; pub const MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE: i32 = -8320; pub const MBEDTLS_ERR_X509_UNKNOWN_OID: i32 = -8448; @@ -743,7 +844,9 @@ pub const MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: i32 = -30848; pub const MBEDTLS_ERR_SSL_BAD_CERTIFICATE: i32 = -31232; pub const MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET: i32 = -31488; pub const MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA: i32 = -31616; -pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31872; +pub const MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND: i32 = -32384; pub const MBEDTLS_ERR_SSL_ALLOC_FAILED: i32 = -32512; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FAILED: i32 = -32640; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: i32 = -28544; @@ -770,6 +873,7 @@ pub const MBEDTLS_ERR_SSL_EARLY_MESSAGE: i32 = -25728; pub const MBEDTLS_ERR_SSL_UNEXPECTED_CID: i32 = -24576; pub const MBEDTLS_ERR_SSL_VERSION_MISMATCH: i32 = -24320; pub const MBEDTLS_ERR_SSL_BAD_CONFIG: i32 = -24192; +pub const MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME: i32 = -23936; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE: u32 = 1; pub const MBEDTLS_SSL_IANA_TLS_GROUP_NONE: u32 = 0; @@ -841,6 +945,8 @@ pub const MBEDTLS_SSL_TRUNC_HMAC_ENABLED: u32 = 1; pub const MBEDTLS_SSL_TRUNCATED_HMAC_LEN: u32 = 10; pub const MBEDTLS_SSL_SESSION_TICKETS_DISABLED: u32 = 0; pub const MBEDTLS_SSL_SESSION_TICKETS_ENABLED: u32 = 1; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED: u32 = 0; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED: u32 = 1; pub const MBEDTLS_SSL_PRESET_DEFAULT: u32 = 0; pub const MBEDTLS_SSL_PRESET_SUITEB: u32 = 2; pub const MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED: u32 = 1; @@ -854,6 +960,9 @@ pub const MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN: u32 = 48; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN: u32 = 1000; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX: u32 = 60000; +pub const MBEDTLS_SSL_EARLY_DATA_NO_DISCARD: u32 = 0; +pub const MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD: u32 = 1; +pub const MBEDTLS_SSL_EARLY_DATA_DISCARD: u32 = 2; pub const MBEDTLS_SSL_IN_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_OUT_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_DTLS_MAX_BUFFERING: u32 = 32768; @@ -988,18 +1097,6 @@ pub const MBEDTLS_SSL_UNEXPECTED_CID_IGNORE: u32 = 0; pub const MBEDTLS_SSL_UNEXPECTED_CID_FAIL: u32 = 1; pub const MBEDTLS_PRINTF_SIZET: &[u8; 3] = b"zu\0"; pub const MBEDTLS_PRINTF_LONGLONG: &[u8; 4] = b"lld\0"; -pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; -pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; -pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; -pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; -pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; -pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; -pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; -pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; -pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; -pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; -pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; -pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_HKDF_BAD_INPUT_DATA: i32 = -24448; pub const MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: i32 = -3; pub const MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: i32 = -5; @@ -1041,6 +1138,7 @@ pub const MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS: u32 = 4096; pub const MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY: u32 = 8192; pub const MBEDTLS_OID_X509_EXT_FRESHEST_CRL: u32 = 16384; pub const MBEDTLS_OID_X509_EXT_NS_CERT_TYPE: u32 = 65536; +pub const MBEDTLS_OID_MAX_COMPONENTS: u32 = 128; pub const MBEDTLS_OID_ISO_MEMBER_BODIES: &[u8; 2] = b"*\0"; pub const MBEDTLS_OID_ISO_IDENTIFIED_ORG: &[u8; 2] = b"+\0"; pub const MBEDTLS_OID_ISO_CCITT_DS: &[u8; 2] = b"U\0"; @@ -1055,6 +1153,8 @@ pub const MBEDTLS_OID_ORG_OIW: &[u8; 2] = b"\x0E\0"; pub const MBEDTLS_OID_OIW_SECSIG: &[u8; 3] = b"\x0E\x03\0"; pub const MBEDTLS_OID_OIW_SECSIG_ALG: &[u8; 4] = b"\x0E\x03\x02\0"; pub const MBEDTLS_OID_OIW_SECSIG_SHA1: &[u8; 5] = b"\x0E\x03\x02\x1A\0"; +pub const MBEDTLS_OID_ORG_THAWTE: &[u8; 2] = b"e\0"; +pub const MBEDTLS_OID_THAWTE: &[u8; 3] = b"+e\0"; pub const MBEDTLS_OID_ORG_CERTICOM: &[u8; 3] = b"\x81\x04\0"; pub const MBEDTLS_OID_CERTICOM: &[u8; 4] = b"+\x81\x04\0"; pub const MBEDTLS_OID_ORG_TELETRUST: &[u8; 2] = b"$\0"; @@ -1153,14 +1253,26 @@ pub const MBEDTLS_OID_DIGEST_ALG_SHA256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x pub const MBEDTLS_OID_DIGEST_ALG_SHA384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x02\0"; pub const MBEDTLS_OID_DIGEST_ALG_SHA512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x03\0"; pub const MBEDTLS_OID_DIGEST_ALG_RIPEMD160: &[u8; 6] = b"+$\x03\x02\x01\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x07\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x08\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\t\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA1: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x07\0"; pub const MBEDTLS_OID_HMAC_SHA224: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x08\0"; pub const MBEDTLS_OID_HMAC_SHA256: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\t\0"; pub const MBEDTLS_OID_HMAC_SHA384: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA512: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x0B\0"; +pub const MBEDTLS_OID_HMAC_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\r\0"; +pub const MBEDTLS_OID_HMAC_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0E\0"; +pub const MBEDTLS_OID_HMAC_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0F\0"; +pub const MBEDTLS_OID_HMAC_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x10\0"; +pub const MBEDTLS_OID_HMAC_RIPEMD160: &[u8; 9] = b"+\x06\x01\x05\x05\x08\x01\x04\0"; pub const MBEDTLS_OID_DES_CBC: &[u8; 6] = b"+\x0E\x03\x02\x07\0"; pub const MBEDTLS_OID_DES_EDE3_CBC: &[u8; 9] = b"*\x86H\x86\xF7\r\x03\x07\0"; pub const MBEDTLS_OID_AES: &[u8; 9] = b"`\x86H\x01e\x03\x04\x01\0"; +pub const MBEDTLS_OID_AES_128_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x02\0"; +pub const MBEDTLS_OID_AES_192_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x16\0"; +pub const MBEDTLS_OID_AES_256_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01*\0"; pub const MBEDTLS_OID_AES128_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x05\0"; pub const MBEDTLS_OID_AES128_KWP: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x08\0"; pub const MBEDTLS_OID_AES192_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x19\0"; @@ -1213,6 +1325,10 @@ pub const MBEDTLS_OID_ECDSA_SHA224: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x01\0"; pub const MBEDTLS_OID_ECDSA_SHA256: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x02\0"; pub const MBEDTLS_OID_ECDSA_SHA384: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x03\0"; pub const MBEDTLS_OID_ECDSA_SHA512: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x04\0"; +pub const MBEDTLS_OID_X25519: &[u8; 4] = b"+en\0"; +pub const MBEDTLS_OID_X448: &[u8; 4] = b"+eo\0"; +pub const MBEDTLS_OID_ED25519: &[u8; 4] = b"+ep\0"; +pub const MBEDTLS_OID_ED448: &[u8; 4] = b"+eq\0"; pub const MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT: i32 = -4224; pub const MBEDTLS_ERR_PEM_INVALID_DATA: i32 = -4352; pub const MBEDTLS_ERR_PEM_ALLOC_FAILED: i32 = -4480; @@ -1226,8 +1342,6 @@ pub const MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA: i32 = -12160; pub const MBEDTLS_ERR_PKCS5_INVALID_FORMAT: i32 = -12032; pub const MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE: i32 = -11904; pub const MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH: i32 = -11776; -pub const MBEDTLS_PKCS5_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS5_ENCRYPT: u32 = 1; pub const MBEDTLS_ERR_PKCS7_INVALID_FORMAT: i32 = -21248; pub const MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE: i32 = -21376; pub const MBEDTLS_ERR_PKCS7_INVALID_VERSION: i32 = -21504; @@ -1248,8 +1362,6 @@ pub const MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH: i32 = -7680; pub const MBEDTLS_PKCS12_DERIVE_KEY: u32 = 1; pub const MBEDTLS_PKCS12_DERIVE_IV: u32 = 2; pub const MBEDTLS_PKCS12_DERIVE_MAC_KEY: u32 = 3; -pub const MBEDTLS_PKCS12_PBE_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS12_PBE_ENCRYPT: u32 = 1; pub const MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT: u32 = 86400; pub const MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES: u32 = 50; pub const MBEDTLS_SSL_COOKIE_TIMEOUT: u32 = 60; @@ -1375,6 +1487,59 @@ unsafe extern "C" { /// \param len Length of the buffer in bytes pub fn mbedtls_platform_zeroize(buf: *mut ::core::ffi::c_void, len: usize); } +/// \brief The type of custom random generator (RNG) callbacks. +/// +/// Many Mbed TLS functions take two parameters +/// `mbedtls_f_rng_t *f_rng, void *p_rng`. The +/// library will call \c f_rng to generate +/// random values. +/// +/// \note This is typically one of the following: +/// - mbedtls_ctr_drbg_random() with \c p_rng +/// pointing to a #mbedtls_ctr_drbg_context; +/// - mbedtls_hmac_drbg_random() with \c p_rng +/// pointing to a #mbedtls_hmac_drbg_context; +/// - mbedtls_psa_get_random() with +/// `prng = MBEDTLS_PSA_RANDOM_STATE`. +/// +/// \note Generally, given a call +/// `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback +/// and the context only need to remain valid until +/// the call to `mbedtls_foo` returns. However, there +/// are a few exceptions where the callback is stored +/// in for future use. Check the documentation of +/// the calling function. +/// +/// \warning In a multithreaded environment, calling the +/// function should be thread-safe. The standard +/// functions provided by the library are thread-safe +/// when #MBEDTLS_THREADING_C is enabled. +/// +/// \warning This function must either provide as many +/// bytes as requested of **cryptographic quality** +/// random data, or return a negative error code. +/// +/// \param p_rng The \c p_rng argument that was passed along \c f_rng. +/// The library always passes \c p_rng unchanged. +/// This is typically a pointer to the random generator +/// state, or \c NULL if the custom random generator +/// doesn't need a context-specific state. +/// \param[out] output On success, this must be filled with \p output_size +/// bytes of cryptographic-quality random data. +/// \param output_size The number of bytes to output. +/// +/// \return \c 0 on success, or a negative error code on failure. +/// Library functions will generally propagate this +/// error code, so \c MBEDTLS_ERR_xxx values are +/// recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is +/// typically sensible for RNG failures. +pub type mbedtls_f_rng_t = ::core::option::Option< + unsafe extern "C" fn( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + ) -> ::core::ffi::c_int, +>; /// \brief The AES context-type definition. #[repr(C)] #[derive(Copy, Clone)] @@ -1933,6 +2098,10 @@ pub type mbedtls_t_udbl = u64; #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_mpi { + /// Pointer to limbs. + /// + /// This may be \c NULL if \c n is 0. + pub private_p: *mut mbedtls_mpi_uint, /// Sign: -1 if the mpi is negative, 1 otherwise. /// /// The number 0 must be represented with `s = +1`. Although many library @@ -1943,13 +2112,9 @@ pub struct mbedtls_mpi { /// /// Note that this implies that calloc() or `... = {0}` does not create /// a valid MPI representation. You must call mbedtls_mpi_init(). - pub private_s: ::core::ffi::c_int, + pub private_s: ::core::ffi::c_short, /// Total number of limbs in \c p. - pub private_n: usize, - /// Pointer to limbs. - /// - /// This may be \c NULL if \c n is 0. - pub private_p: *mut mbedtls_mpi_uint, + pub private_n: ::core::ffi::c_ushort, } impl Default for mbedtls_mpi { fn default() -> Self { @@ -2224,7 +2389,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2241,7 +2406,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2296,6 +2461,8 @@ unsafe extern "C" { /// \brief Perform a left-shift on an MPI: X <<= count /// /// \param X The MPI to shift. This must point to an initialized MPI. + /// The MPI pointed by \p X may be resized to fit + /// the resulting number. /// \param count The number of bits to shift by. /// /// \return \c 0 if successful. @@ -2588,7 +2755,7 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Perform a sliding-window exponentiation: X = A^E mod N + /// \brief Perform a modular exponentiation: X = A^E mod N /// /// \param X The destination MPI. This must point to an initialized MPI. /// This must not alias E or N. @@ -2639,13 +2806,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_fill_random( X: *mut mbedtls_mpi, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2685,13 +2846,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, min: mbedtls_mpi_sint, N: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2699,6 +2854,7 @@ unsafe extern "C" { /// \brief Compute the greatest common divisor: G = gcd(A, B) /// /// \param G The destination MPI. This must point to an initialized MPI. + /// This will always be positive or 0. /// \param A The first operand. This must point to an initialized MPI. /// \param B The second operand. This must point to an initialized MPI. /// @@ -2715,17 +2871,19 @@ unsafe extern "C" { /// \brief Compute the modular inverse: X = A^-1 mod N /// /// \param X The destination MPI. This must point to an initialized MPI. + /// The value returned on success will be between [1, N-1]. /// \param A The MPI to calculate the modular inverse of. This must point - /// to an initialized MPI. + /// to an initialized MPI. This value can be negative, in which + /// case a positive answer will still be returned in \p X. /// \param N The base of the modular inversion. This must point to an - /// initialized MPI. + /// initialized MPI and be greater than one. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. /// \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than /// or equal to one. - /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - /// with respect to \p N. + /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + /// inverse with respect to \p N. pub fn mbedtls_mpi_inv_mod( X: *mut mbedtls_mpi, A: *const mbedtls_mpi, @@ -2748,7 +2906,7 @@ unsafe extern "C" { /// This must point to an initialized MPI. /// \param rounds The number of bases to perform the Miller-Rabin primality /// test for. The probability of returning 0 on a composite is - /// at most 2-2*\p rounds. + /// at most 2-2*\p rounds . /// \param f_rng The RNG function to use. This must not be \c NULL. /// \param p_rng The RNG parameter to be passed to \p f_rng. /// This may be \c NULL if \p f_rng doesn't use @@ -2761,13 +2919,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_is_prime_ext( X: *const mbedtls_mpi, rounds: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2804,13 +2956,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, nbits: usize, flags: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -3187,7 +3333,7 @@ unsafe extern "C" { /// on a successful invocation. /// \param end The end of the ASN.1 SEQUENCE container. /// \param tag_must_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_must_value. + /// the SEQUENCE before comparing to \p tag_must_val. /// \param tag_must_val The required value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_must_mask. /// Mismatching tags lead to an error. @@ -3196,7 +3342,7 @@ unsafe extern "C" { /// while a value of \c 0xFF for \p tag_must_mask means /// that \p tag_must_val is the only allowed tag. /// \param tag_may_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_may_value. + /// the SEQUENCE before comparing to \p tag_may_val. /// \param tag_may_val The desired value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_may_mask. /// Mismatching tags will be silently ignored. @@ -3489,6 +3635,30 @@ unsafe extern "C" { par_len: usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + /// + /// \note This function works backwards in data buffer. + /// + /// \param p The reference to the current position pointer. + /// \param start The start of the buffer, for bounds-checking. + /// \param oid The OID of the algorithm to write. + /// \param oid_len The length of the algorithm's OID. + /// \param par_len The length of the parameters, which must be already written. + /// \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + /// and \p par_len is 0, NULL parameters are added. + /// + /// \return The number of bytes written to \p p on success. + /// \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_asn1_write_algorithm_identifier_ext( + p: *mut *mut ::core::ffi::c_uchar, + start: *const ::core::ffi::c_uchar, + oid: *const ::core::ffi::c_char, + oid_len: usize, + par_len: usize, + has_par: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value /// in ASN.1 format. @@ -3991,32 +4161,17 @@ pub struct mbedtls_cipher_base_t { /// mbedtls_cipher_info_from_type(), /// mbedtls_cipher_info_from_values(), /// mbedtls_cipher_info_from_psa(). +/// +/// \note Some fields store a value that has been right-shifted to save +/// code-size, so should not be used directly. The accessor +/// functions adjust for this and return the "natural" value. #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_cipher_info_t { - /// Full cipher identifier. For example, - /// MBEDTLS_CIPHER_AES_256_CBC. - pub private_type: mbedtls_cipher_type_t, - /// The cipher mode. For example, MBEDTLS_MODE_CBC. - pub private_mode: mbedtls_cipher_mode_t, - /// The cipher key length, in bits. This is the - /// default length for variable sized ciphers. - /// Includes parity bits for ciphers like DES. - pub private_key_bitlen: ::core::ffi::c_uint, /// Name of the cipher. pub private_name: *const ::core::ffi::c_char, - /// IV or nonce size, in Bytes. - /// For ciphers that accept variable IV sizes, - /// this is the recommended size. - pub private_iv_size: ::core::ffi::c_uint, - /// Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and - /// MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the - /// cipher supports variable IV or variable key sizes, respectively. - pub private_flags: ::core::ffi::c_int, - /// The block size, in Bytes. - pub private_block_size: ::core::ffi::c_uint, - /// Struct for base cipher information and functions. - pub private_base: *const mbedtls_cipher_base_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize]>, } impl Default for mbedtls_cipher_info_t { fn default() -> Self { @@ -4027,46 +4182,321 @@ impl Default for mbedtls_cipher_info_t { } } } -/// Generic cipher context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_cipher_context_t { - /// Information about the associated cipher. - pub private_cipher_info: *const mbedtls_cipher_info_t, - /// Key length to use. - pub private_key_bitlen: ::core::ffi::c_int, - /// Operation that the key of the context has been - /// initialized for. - pub private_operation: mbedtls_operation_t, - /// Padding functions to use, if relevant for - /// the specific cipher mode. - pub private_add_padding: ::core::option::Option< - unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), - >, - pub private_get_padding: ::core::option::Option< - unsafe extern "C" fn( - input: *mut ::core::ffi::c_uchar, - ilen: usize, - data_len: *mut usize, - ) -> ::core::ffi::c_int, - >, - /// Buffer for input that has not been processed yet. - pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], - /// Number of Bytes that have not been processed yet. - pub private_unprocessed_len: usize, - /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number - /// for XTS-mode. - pub private_iv: [::core::ffi::c_uchar; 16usize], - /// IV size in Bytes, for ciphers with variable-length IVs. - pub private_iv_size: usize, - /// The cipher-specific context. - pub private_cipher_ctx: *mut ::core::ffi::c_void, - /// CMAC-specific context. - pub private_cmac_ctx: *mut mbedtls_cmac_context_t, -} -impl Default for mbedtls_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); +impl mbedtls_cipher_info_t { + #[inline] + pub fn private_block_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_block_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_block_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_block_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(5usize, 3u8) as u32) } + } + #[inline] + pub fn set_private_iv_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(5usize, 3u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 5usize, + 3u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 5usize, + 3u8, + val as u64, + ) + } + } + #[inline] + pub fn private_key_bitlen(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(8usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_key_bitlen(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(8usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_key_bitlen_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 8usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_key_bitlen_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 8usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_mode(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(12usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_mode(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(12usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_mode_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 12usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_mode_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 12usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_type(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(16usize, 8u8) as u32) } + } + #[inline] + pub fn set_private_type(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(16usize, 8u8, val as u64) + } + } + #[inline] + pub unsafe fn private_type_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 16usize, + 8u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_type_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 16usize, + 8u8, + val as u64, + ) + } + } + #[inline] + pub fn private_flags(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(24usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_flags(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(24usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_flags_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 24usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_flags_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 24usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_base_idx(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(26usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_base_idx(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(26usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_base_idx_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 26usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_base_idx_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 26usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_block_size: ::core::ffi::c_uint, + private_iv_size: ::core::ffi::c_uint, + private_key_bitlen: ::core::ffi::c_uint, + private_mode: ::core::ffi::c_uint, + private_type: ::core::ffi::c_uint, + private_flags: ::core::ffi::c_uint, + private_base_idx: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 4usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 4usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 5u8, { + let private_block_size: u32 = unsafe { ::core::mem::transmute(private_block_size) }; + private_block_size as u64 + }); + __bindgen_bitfield_unit.set(5usize, 3u8, { + let private_iv_size: u32 = unsafe { ::core::mem::transmute(private_iv_size) }; + private_iv_size as u64 + }); + __bindgen_bitfield_unit.set(8usize, 4u8, { + let private_key_bitlen: u32 = unsafe { ::core::mem::transmute(private_key_bitlen) }; + private_key_bitlen as u64 + }); + __bindgen_bitfield_unit.set(12usize, 4u8, { + let private_mode: u32 = unsafe { ::core::mem::transmute(private_mode) }; + private_mode as u64 + }); + __bindgen_bitfield_unit.set(16usize, 8u8, { + let private_type: u32 = unsafe { ::core::mem::transmute(private_type) }; + private_type as u64 + }); + __bindgen_bitfield_unit.set(24usize, 2u8, { + let private_flags: u32 = unsafe { ::core::mem::transmute(private_flags) }; + private_flags as u64 + }); + __bindgen_bitfield_unit.set(26usize, 5u8, { + let private_base_idx: u32 = unsafe { ::core::mem::transmute(private_base_idx) }; + private_base_idx as u64 + }); + __bindgen_bitfield_unit + } +} +/// Generic cipher context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_cipher_context_t { + /// Information about the associated cipher. + pub private_cipher_info: *const mbedtls_cipher_info_t, + /// Key length to use. + pub private_key_bitlen: ::core::ffi::c_int, + /// Operation that the key of the context has been + /// initialized for. + pub private_operation: mbedtls_operation_t, + /// Padding functions to use, if relevant for + /// the specific cipher mode. + pub private_add_padding: ::core::option::Option< + unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), + >, + pub private_get_padding: ::core::option::Option< + unsafe extern "C" fn( + input: *mut ::core::ffi::c_uchar, + ilen: usize, + data_len: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int, + >, + /// Buffer for input that has not been processed yet. + pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], + /// Number of Bytes that have not been processed yet. + pub private_unprocessed_len: usize, + /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + /// for XTS-mode. + pub private_iv: [::core::ffi::c_uchar; 16usize], + /// IV size in Bytes, for ciphers with variable-length IVs. + pub private_iv_size: usize, + /// The cipher-specific context. + pub private_cipher_ctx: *mut ::core::ffi::c_void, + /// CMAC-specific context. + pub private_cmac_ctx: *mut mbedtls_cmac_context_t, +} +impl Default for mbedtls_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); s.assume_init() @@ -4134,7 +4564,7 @@ unsafe extern "C" { ) -> *const mbedtls_cipher_info_t; } unsafe extern "C" { - /// \brief This function initializes a \p cipher_context as NONE. + /// \brief This function initializes a \p ctx as NONE. /// /// \param ctx The context to be initialized. This must not be \c NULL. pub fn mbedtls_cipher_init(ctx: *mut mbedtls_cipher_context_t); @@ -4205,7 +4635,6 @@ unsafe extern "C" { /// \brief This function sets the padding mode, for cipher modes /// that use padding. /// - /// The default passing mode is PKCS7 padding. /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a cipher information structure. @@ -4255,23 +4684,24 @@ unsafe extern "C" { /// /// \note With non-AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update() one or more times - /// 4. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update() zero, one or more times; + /// 4. mbedtls_cipher_finish_padded() (recommended for decryption + /// if the mode uses padding) or mbedtls_cipher_finish(). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. /// /// \note With AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update_ad() - /// 4. mbedtls_cipher_update() one or more times - /// 5. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update_ad(); + /// 4. mbedtls_cipher_update() zero, one or more times; + /// 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); /// 6. mbedtls_cipher_check_tag() (for decryption) or - /// mbedtls_cipher_write_tag() (for encryption). + /// mbedtls_cipher_write_tag() (for encryption). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. @@ -4306,7 +4736,8 @@ unsafe extern "C" { /// many block-sized blocks of data as possible to output. /// Any data that cannot be written immediately is either /// added to the next block, or flushed when - /// mbedtls_cipher_finish() is called. + /// mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + /// is called. /// Exception: For MBEDTLS_MODE_ECB, expects a single block /// in size. For example, 16 Bytes for AES. /// @@ -4342,12 +4773,30 @@ unsafe extern "C" { /// contained in it is padded to the size of /// the last block, and written to the \p output buffer. /// + /// \warning This function reports invalid padding through an error + /// code. Adversaries may be able to decrypt encrypted + /// data if they can submit chosen ciphertexts and + /// detect whether it has valid padding or not, + /// either through direct observation or through a side + /// channel such as timing. This is known as a + /// padding oracle attack. + /// Therefore applications that call this function for + /// decryption with a cipher that involves padding + /// should take care around error handling. Preferably, + /// such applications should use + /// mbedtls_cipher_finish_padded() instead of this function. + /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a key. /// \param output The buffer to write data to. This needs to be a writable - /// buffer of at least \p block_size Bytes. + /// buffer of at least block_size Bytes. /// \param olen The length of the data written to the \p output buffer. /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// above), although less efficiently than through + /// the invalid-padding condition. /// /// \return \c 0 on success. /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on @@ -4355,7 +4804,8 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption /// expecting a full block but not receiving one. /// \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding - /// while decrypting. + /// while decrypting. Note that invalid-padding errors + /// should be handled carefully; see the warning above. /// \return A cipher-specific error code on failure. pub fn mbedtls_cipher_finish( ctx: *mut mbedtls_cipher_context_t, @@ -4363,10 +4813,60 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief The generic cipher finalization function. If data still + /// needs to be flushed from an incomplete block, the data + /// contained in it is padded to the size of + /// the last block, and written to the \p output buffer. + /// + /// \note This function is similar to mbedtls_cipher_finish(). + /// The only difference is that it reports invalid padding + /// decryption differently, through the \p invalid_padding + /// parameter rather than an error code. + /// For encryption, and in modes without padding (including + /// all authenticated modes), this function is identical + /// to mbedtls_cipher_finish(). + /// + /// \param[in,out] ctx The generic cipher context. This must be initialized and + /// bound to a key. + /// \param[out] output The buffer to write data to. This needs to be a writable + /// buffer of at least block_size Bytes. + /// \param[out] olen The length of the data written to the \p output buffer. + /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// on mbedtls_cipher_finish()). + /// \param[out] invalid_padding + /// If this function returns \c 0 on decryption, + /// \p *invalid_padding is \c 0 if the ciphertext was + /// valid, and all-bits-one if the ciphertext had invalid + /// padding. + /// On encryption, or in a mode without padding (including + /// all authenticated modes), \p *invalid_padding is \c 0 + /// on success. + /// The value in \p *invalid_padding is unspecified if + /// this function returns a nonzero status. + /// + /// \return \c 0 on success. + /// Also \c 0 for decryption with invalid padding. + /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + /// parameter-verification failure. + /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + /// expecting a full block but not receiving one. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_cipher_finish_padded( + ctx: *mut mbedtls_cipher_context_t, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief This function writes a tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized, /// bound to a key, and have just completed a cipher @@ -4387,7 +4887,8 @@ unsafe extern "C" { unsafe extern "C" { /// \brief This function checks the tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized. /// \param tag The buffer holding the tag. This must be a readable @@ -4572,8 +5073,6 @@ pub struct mbedtls_ccm_context { pub private_y: [::core::ffi::c_uchar; 16usize], ///< The counter buffer pub private_ctr: [::core::ffi::c_uchar; 16usize], - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Total plaintext length pub private_plaintext_len: usize, ///< Total authentication data length @@ -4588,16 +5087,17 @@ pub struct mbedtls_ccm_context { ///auth data input is finished. pub private_processed: usize, ///< The Q working value - pub private_q: ::core::ffi::c_uchar, + pub private_q: ::core::ffi::c_uint, ///< The operation to perform: ///#MBEDTLS_CCM_ENCRYPT or ///#MBEDTLS_CCM_DECRYPT or ///#MBEDTLS_CCM_STAR_ENCRYPT or ///#MBEDTLS_CCM_STAR_DECRYPT. - pub private_mode: ::core::ffi::c_uchar, + pub private_mode: ::core::ffi::c_uint, + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Working value holding context's - ///state. Used for chunked data - ///input + ///state. Used for chunked data input pub private_state: ::core::ffi::c_int, } impl Default for mbedtls_ccm_context { @@ -5840,47 +6340,59 @@ unsafe extern "C" { /// \return \c 1 on failure. pub fn mbedtls_cmac_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -/// \brief The CTR_DRBG context structure. +///< None. +pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; +///< The MD5 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 3; +///< The RIPEMD-160 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 4; +///< The SHA-1 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 5; +///< The SHA-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 8; +///< The SHA-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 9; +///< The SHA-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 10; +///< The SHA-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 11; +///< The SHA3-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_224: mbedtls_md_type_t = 16; +///< The SHA3-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_256: mbedtls_md_type_t = 17; +///< The SHA3-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_384: mbedtls_md_type_t = 18; +///< The SHA3-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_512: mbedtls_md_type_t = 19; +/// \brief Supported message digests. +/// +/// \warning MD5 and SHA-1 are considered weak message digests and +/// their use constitutes a security risk. We recommend considering +/// stronger message digests instead. +pub type mbedtls_md_type_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct mbedtls_ctr_drbg_context { - ///< The counter (V). - pub private_counter: [::core::ffi::c_uchar; 16usize], - ///< The reseed counter. - /// This is the number of requests that have - /// been made since the last (re)seeding, - /// minus one. - /// Before the initial seeding, this field - /// contains the amount of entropy in bytes - /// to use as a nonce for the initial seeding, - /// or -1 if no nonce length has been explicitly - /// set (see mbedtls_ctr_drbg_set_nonce_len()). - pub private_reseed_counter: ::core::ffi::c_int, - ///< This determines whether prediction - ///resistance is enabled, that is - ///whether to systematically reseed before - ///each random generation. - pub private_prediction_resistance: ::core::ffi::c_int, - ///< The amount of entropy grabbed on each - ///seed or reseed operation, in bytes. - pub private_entropy_len: usize, - ///< The reseed interval. - /// This is the maximum number of requests - /// that can be made between reseedings. - pub private_reseed_interval: ::core::ffi::c_int, - ///< The AES context. - pub private_aes_ctx: mbedtls_aes_context, - pub private_f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - ///< The context for the entropy function. - pub private_p_entropy: *mut ::core::ffi::c_void, +pub struct mbedtls_md_info_t { + _unused: [u8; 0], } -impl Default for mbedtls_ctr_drbg_context { +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; +/// Used internally to indicate whether a context uses legacy or PSA. +/// +/// Internal use only. +pub type mbedtls_md_engine_t = ::core::ffi::c_uint; +/// The generic message-digest context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md_context_t { + /// Information about the associated message digest. + pub private_md_info: *const mbedtls_md_info_t, + /// The digest-specific context (legacy) or the PSA operation. + pub private_md_ctx: *mut ::core::ffi::c_void, + /// The HMAC part of the context. + pub private_hmac_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_md_context_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -5890,4389 +6402,3745 @@ impl Default for mbedtls_ctr_drbg_context { } } unsafe extern "C" { - /// \brief This function initializes the CTR_DRBG context, - /// and prepares it for mbedtls_ctr_drbg_seed() - /// or mbedtls_ctr_drbg_free(). + /// \brief This function returns the message-digest information + /// associated with the given digest type. /// - /// \note The reseed interval is - /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. - /// You can override it by calling - /// mbedtls_ctr_drbg_set_reseed_interval(). + /// \param md_type The type of digest to search for. /// - /// \param ctx The CTR_DRBG context to initialize. - pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); + /// \return The message-digest information associated with \p md_type. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// - The \p custom string. - /// - /// \note To achieve the nominal security strength permitted - /// by CTR_DRBG, the entropy length must be: - /// - at least 16 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 32 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// In addition, if you do not pass a nonce in \p custom, - /// the sum of the entropy length - /// and the entropy nonce length must be: - /// - at least 24 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 48 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// \param ctx The CTR_DRBG context to seed. - /// It must have been initialized with - /// mbedtls_ctr_drbg_init(). - /// After a successful call to mbedtls_ctr_drbg_seed(), - /// you may not call mbedtls_ctr_drbg_seed() again on - /// the same context unless you call - /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() - /// again first. - /// After a failed call to mbedtls_ctr_drbg_seed(), - /// you must call mbedtls_ctr_drbg_free(). - /// \param f_entropy The entropy callback, taking as arguments the - /// \p p_entropy context, the buffer to fill, and the - /// length of the buffer. - /// \p f_entropy is always called with a buffer size - /// less than or equal to the entropy length. - /// \param p_entropy The entropy context to pass to \p f_entropy. - /// \param custom The personalization string. - /// This can be \c NULL, in which case the personalization - /// string is empty regardless of the value of \p len. - /// \param len The length of the personalization string. - /// This must be at most - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function initializes a message-digest context without + /// binding it to a particular message-digest algorithm. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_seed( - ctx: *mut mbedtls_ctr_drbg_context, - f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_entropy: *mut ::core::ffi::c_void, - custom: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// This function should always be called first. It prepares the + /// context for mbedtls_md_setup() for binding it to a + /// message-digest algorithm. + pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function resets CTR_DRBG context to the state immediately - /// after initial call of mbedtls_ctr_drbg_init(). + /// \brief This function clears the internal structure of \p ctx and + /// frees any embedded internal structure, but does not free + /// \p ctx itself. /// - /// \param ctx The CTR_DRBG context to clear. - pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); + /// If you have called mbedtls_md_setup() on \p ctx, you must + /// call mbedtls_md_free() when you are no longer using the + /// context. + /// Calling this function if you have previously + /// called mbedtls_md_init() and nothing else is optional. + /// You must not call this function if you have not called + /// mbedtls_md_init(). + pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function turns prediction resistance on or off. - /// The default value is off. + /// \brief This function selects the message digest algorithm to use, + /// and allocates internal structures. /// - /// \note If enabled, entropy is gathered at the beginning of - /// every call to mbedtls_ctr_drbg_random_with_add() - /// or mbedtls_ctr_drbg_random(). - /// Only use this if your entropy source has sufficient - /// throughput. + /// It should be called after mbedtls_md_init() or + /// mbedtls_md_free(). Makes it necessary to call + /// mbedtls_md_free() later. /// - /// \param ctx The CTR_DRBG context. - /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. - pub fn mbedtls_ctr_drbg_set_prediction_resistance( - ctx: *mut mbedtls_ctr_drbg_context, - resistance: ::core::ffi::c_int, - ); + /// \param ctx The context to set up. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + /// or non-zero: HMAC is used with this context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + pub fn mbedtls_md_setup( + ctx: *mut mbedtls_md_context_t, + md_info: *const mbedtls_md_info_t, + hmac: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed on each - /// seed or reseed. - /// - /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function clones the state of a message-digest + /// context. /// - /// \note The security strength of CTR_DRBG is bounded by the - /// entropy length. Thus: - /// - When using AES-256 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, - /// which is the default), - /// \p len must be at least 32 (in bytes) - /// to achieve a 256-bit strength. - /// - When using AES-128 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) - /// \p len must be at least 16 (in bytes) - /// to achieve a 128-bit strength. + /// \note You must call mbedtls_md_setup() on \c dst before calling + /// this function. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. - pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); -} -unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed - /// as a nonce for the initial seeding. + /// \note The two contexts must have the same type, + /// for example, both are SHA-256. /// - /// Call this function before calling mbedtls_ctr_drbg_seed() to read - /// a nonce from the entropy source during the initial seeding. + /// \warning This function clones the message-digest state, not the + /// HMAC state. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab for the nonce, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. + /// \param dst The destination context. + /// \param src The context to be cloned. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is - /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED - /// if the initial seeding has already taken place. - pub fn mbedtls_ctr_drbg_set_nonce_len( - ctx: *mut mbedtls_ctr_drbg_context, - len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + /// not using the same engine. This can be avoided by moving + /// the call to psa_crypto_init() before the first call to + /// mbedtls_md_setup(). + pub fn mbedtls_md_clone( + dst: *mut mbedtls_md_context_t, + src: *const mbedtls_md_context_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the reseed interval. - /// - /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() - /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function - /// is called again. + /// \brief This function extracts the message-digest size from the + /// message-digest information structure. /// - /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param interval The reseed interval. - pub fn mbedtls_ctr_drbg_set_reseed_interval( - ctx: *mut mbedtls_ctr_drbg_context, - interval: ::core::ffi::c_int, - ); + /// \return The size of the message-digest output in Bytes. + pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; } unsafe extern "C" { - /// \brief This function reseeds the CTR_DRBG context, that is - /// extracts data from the entropy source. + /// \brief This function extracts the message-digest type from the + /// message-digest information structure. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param additional Additional data to add to the state. Can be \c NULL. - /// \param len The length of the additional data. - /// This must be less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \return The type of the message digest. + pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; +} +unsafe extern "C" { + /// \brief This function starts a message-digest computation. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_reseed( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// You must call this function after setting up the context + /// with mbedtls_md_setup(), and before passing data with + /// mbedtls_md_update(). + /// + /// \param ctx The generic message-digest context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates the state of the CTR_DRBG context. + /// \brief This function feeds an input buffer into an ongoing + /// message-digest computation. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// You must call mbedtls_md_starts() before calling this + /// function. You may call this function multiple times. + /// Afterwards, call mbedtls_md_finish(). /// - /// \param ctx The CTR_DRBG context. - /// \param additional The data to update the state with. This must not be - /// \c NULL unless \p add_len is \c 0. - /// \param add_len Length of \p additional in bytes. This must be at - /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \param ctx The generic message-digest context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if - /// \p add_len is more than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return An error from the underlying AES cipher on failure. - pub fn mbedtls_ctr_drbg_update( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - add_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates a CTR_DRBG instance with additional - /// data and uses it to generate random data. - /// - /// This function automatically reseeds if the reseed counter is exceeded - /// or prediction resistance is enabled. + /// \brief This function finishes the digest operation, + /// and writes the result to the output buffer. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// Call this function after a call to mbedtls_md_starts(), + /// followed by any number of calls to mbedtls_md_update(). + /// Afterwards, you may either clear the context with + /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse + /// the context for another digest operation with the same + /// algorithm. /// - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. - /// \param additional Additional data to update. Can be \c NULL, in which - /// case the additional data is empty regardless of - /// the value of \p add_len. - /// \param add_len The length of the additional data - /// if \p additional is not \c NULL. - /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT - /// and less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \param ctx The generic message-digest context. + /// \param output The buffer for the generic message-digest checksum result. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random_with_add( - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_finish( + ctx: *mut mbedtls_md_context_t, output: *mut ::core::ffi::c_uchar, - output_len: usize, - additional: *const ::core::ffi::c_uchar, - add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. + /// \brief This function calculates the message-digest of a buffer, + /// with respect to a configurable message-digest algorithm + /// in a single call. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random( - p_rng: *mut ::core::ffi::c_void, + /// The result is calculated as + /// Output = message_digest(input buffer). + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param input The buffer holding the data. + /// \param ilen The length of the input data. + /// \param output The generic message-digest checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md( + md_info: *const mbedtls_md_info_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, output: *mut ::core::ffi::c_uchar, - output_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The CTR_DRBG checkup routine. + /// \brief This function returns the list of digests supported by the + /// generic digest module. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< Curve not defined. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; -///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; -///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; -///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; -///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; -///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; -///< Domain parameters for 256-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; -///< Domain parameters for 384-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; -///< Domain parameters for 512-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; -///< Domain parameters for Curve25519. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; -///< Domain parameters for 192-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; -///< Domain parameters for 224-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; -///< Domain parameters for 256-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; -///< Domain parameters for Curve448. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; -/// Domain-parameter identifiers: curve, subgroup, and generator. -/// -/// \note Only curves over prime fields are supported. -/// -/// \warning This library does not support validation of arbitrary domain -/// parameters. Therefore, only standardized domain parameters from trusted -/// sources should be used. See mbedtls_ecp_group_load(). -pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; -pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_NONE: mbedtls_ecp_modulus_type = 0; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_COORDINATE: mbedtls_ecp_modulus_type = 1; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_SCALAR: mbedtls_ecp_modulus_type = 2; -pub type mbedtls_ecp_modulus_type = ::core::ffi::c_uint; -/// Curve information, for use by other modules. -/// -/// The fields of this structure are part of the public API and can be -/// accessed directly by applications. Future versions of the library may -/// add extra fields or reorder existing fields. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_curve_info { - ///< An internal identifier. - pub grp_id: mbedtls_ecp_group_id, - ///< The TLS NamedCurve identifier. - pub tls_id: u16, - ///< The curve size in bits. - pub bit_size: u16, - ///< A human-friendly name. - pub name: *const ::core::ffi::c_char, + /// \note The list starts with the strongest available hashes. + /// + /// \return A statically allocated array of digests. Each element + /// in the returned list is an integer belonging to the + /// message-digest enumeration #mbedtls_md_type_t. + /// The last entry is 0. + pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; } -impl Default for mbedtls_ecp_curve_info { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief This function returns the message-digest information + /// associated with the given digest name. + /// + /// \param md_name The name of the digest to search for. + /// + /// \return The message-digest information associated with \p md_name. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_string( + md_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_md_info_t; } -/// \brief The ECP point structure, in Jacobian coordinates. -/// -/// \note All functions expect and return points satisfying -/// the following condition: Z == 0 or -/// Z == 1. Other values of \p Z are -/// used only by internal functions. -/// The point is zero, or "at infinity", if Z == 0. -/// Otherwise, \p X and \p Y are its standard (affine) -/// coordinates. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_point { - ///< The X coordinate of the ECP point. - pub private_X: mbedtls_mpi, - ///< The Y coordinate of the ECP point. - pub private_Y: mbedtls_mpi, - ///< The Z coordinate of the ECP point. - pub private_Z: mbedtls_mpi, -} -impl Default for mbedtls_ecp_point { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief The ECP group structure. -/// -/// We consider two types of curve equations: -///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P -/// (SEC1 + RFC-4492)
            • -///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, -/// Curve448)
          -/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. -/// -/// For Short Weierstrass, this subgroup is the whole curve, and its -/// cardinality is denoted by \p N. Our code requires that \p N is an -/// odd prime as mbedtls_ecp_mul() requires an odd number, and -/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. -/// -/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, -/// which is the quantity used in the formulas. Additionally, \p nbits is -/// not the size of \p N but the required size for private keys. -/// -/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. -/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the -/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer -/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits -/// in size, so that it may be efficiently brought in the 0..P-1 range by a few -/// additions or subtractions. Therefore, it is only an approximative modular -/// reduction. It must return 0 on success and non-zero on failure. -/// -/// \note Alternative implementations of the ECP module must obey the -/// following constraints. -/// * Group IDs must be distinct: if two group structures have -/// the same ID, then they must be identical. -/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, -/// \c pbits and \c nbits must have the same type and semantics -/// as in the built-in implementation. -/// They must be available for reading, but direct modification -/// of these fields does not need to be supported. -/// They do not need to be at the same offset in the structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_group { - ///< An internal group identifier. - pub id: mbedtls_ecp_group_id, - ///< The prime modulus of the base field. - pub P: mbedtls_mpi, - ///< For Short Weierstrass: \p A in the equation. For - ///Montgomery curves: (A + 2) / 4. - pub A: mbedtls_mpi, - ///< For Short Weierstrass: \p B in the equation. - ///For Montgomery curves: unused. - pub B: mbedtls_mpi, - ///< The generator of the subgroup used. - pub G: mbedtls_ecp_point, - ///< The order of \p G. - pub N: mbedtls_mpi, - ///< The number of bits in \p P. - pub pbits: usize, - ///< For Short Weierstrass: The number of bits in \p P. - ///For Montgomery curves: the number of bits in the - ///private keys. - pub nbits: usize, - ///< \internal 1 if the constants are static. - pub private_h: ::core::ffi::c_uint, - ///< The function for fast pseudo-reduction - ///mod \p P (see above). - pub private_modp: - ::core::option::Option ::core::ffi::c_int>, - ///< Unused. - pub private_t_pre: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_post: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_data: *mut ::core::ffi::c_void, - ///< Pre-computed points for ecp_mul_comb(). - pub private_T: *mut mbedtls_ecp_point, - ///< The number of dynamic allocated pre-computed points. - pub private_T_size: usize, -} -impl Default for mbedtls_ecp_group { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; -/// \brief The ECP key-pair structure. -/// -/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. -/// -/// \note Members are deliberately in the same order as in the -/// ::mbedtls_ecdsa_context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_keypair { - ///< Elliptic curve and base point - pub private_grp: mbedtls_ecp_group, - ///< our secret value - pub private_d: mbedtls_mpi, - ///< our public value - pub private_Q: mbedtls_ecp_point, -} -impl Default for mbedtls_ecp_keypair { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +unsafe extern "C" { + /// \brief This function returns the name of the message digest for + /// the message-digest information structure given. + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// + /// \return The name of the message digest. + pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; } unsafe extern "C" { - /// \brief This function retrieves the information defined in - /// mbedtls_ecp_curve_info() for all supported curves. + /// \brief This function returns the message-digest information + /// from the given context. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// \param ctx The context from which to extract the information. + /// This must be initialized (or \c NULL). /// - /// \return A statically allocated array. The last entry is 0. - pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; + /// \return The message-digest information associated with \p ctx. + /// \return \c NULL if \p ctx is \c NULL. + pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// \brief This function retrieves the list of internal group - /// identifiers of all supported curves in the order of - /// preference. + /// \brief This function sets the HMAC key and prepares to + /// authenticate a new message. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// Call this function after mbedtls_md_setup(), to use + /// the MD context for an HMAC calculation, then call + /// mbedtls_md_hmac_update() to provide the input data, and + /// mbedtls_md_hmac_finish() to get the HMAC value. /// - /// \return A statically allocated array, - /// terminated with MBEDTLS_ECP_DP_NONE. - pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC key in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_starts( + ctx: *mut mbedtls_md_context_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from an internal - /// group identifier. + /// \brief This function feeds an input buffer into an ongoing HMAC + /// computation. /// - /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + /// before calling this function. + /// You may call this function multiple times to pass the + /// input piecewise. + /// Afterwards, call mbedtls_md_hmac_finish(). /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_grp_id( - grp_id: mbedtls_ecp_group_id, - ) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a TLS - /// NamedCurve value. + /// \brief This function finishes the HMAC operation, and writes + /// the result to the output buffer. /// - /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call this function after mbedtls_md_hmac_starts() and + /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards + /// you may either call mbedtls_md_free() to clear the context, + /// or call mbedtls_md_hmac_reset() to reuse the context with + /// the same HMAC key. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param output The generic HMAC checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_finish( + ctx: *mut mbedtls_md_context_t, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a - /// human-readable name. + /// \brief This function prepares to authenticate a new message with + /// the same key as the previous HMAC operation. /// - /// \param name The human-readable name. + /// You may call this function after mbedtls_md_hmac_finish(). + /// Afterwards call mbedtls_md_hmac_update() to pass the new + /// input. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_name( - name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ecp_curve_info; -} -unsafe extern "C" { - /// \brief This function initializes a point as zero. + /// \param ctx The message digest context containing an embedded HMAC + /// context. /// - /// \param pt The point to initialize. - pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECP group context - /// without loading any domain parameters. + /// \brief This function calculates the full generic HMAC + /// on the input buffer with the provided key. /// - /// \note After this function is called, domain parameters - /// for various ECP groups can be loaded through the - /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() - /// functions. - pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); -} -unsafe extern "C" { - /// \brief This function initializes a key pair as an invalid one. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param key The key pair to initialize. - pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); -} -unsafe extern "C" { - /// \brief This function frees the components of a point. + /// The HMAC result is calculated as + /// output = generic HMAC(hmac key, input buffer). /// - /// \param pt The point to free. - pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); -} -unsafe extern "C" { - /// \brief This function frees the components of an ECP group. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC secret key in Bytes. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// \param output The generic HMAC result. /// - /// \param grp The group to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP group. - pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac( + md_info: *const mbedtls_md_info_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function frees the components of a key pair. - /// - /// \param key The key pair to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP key pair. - pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +/// \brief Entropy poll callback pointer +/// +/// \param data Callback-specific data pointer +/// \param output Data to fill +/// \param len Maximum size to provide +/// \param olen The actual amount of bytes put into the buffer (Can be 0) +/// +/// \return 0 if no critical failures occurred, +/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise +pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< + unsafe extern "C" fn( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + ) -> ::core::ffi::c_int, +>; +/// \brief Entropy source state +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_source_state { + ///< The entropy source callback + pub private_f_source: mbedtls_entropy_f_source_ptr, + ///< The callback data pointer + pub private_p_source: *mut ::core::ffi::c_void, + ///< Amount received in bytes + pub private_size: usize, + ///< Minimum bytes required before release + pub private_threshold: usize, + ///< Is the source strong? + pub private_strong: ::core::ffi::c_int, } -unsafe extern "C" { - /// \brief This function copies the contents of point \p Q into - /// point \p P. - /// - /// \param P The destination point. This must be initialized. - /// \param Q The source point. This must be initialized. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code for other kinds of failure. - pub fn mbedtls_ecp_copy( - P: *mut mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_entropy_source_state { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +/// \brief Entropy context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_context { + pub private_accumulator: mbedtls_md_context_t, + pub private_accumulator_started: ::core::ffi::c_int, + pub private_source_count: ::core::ffi::c_int, + pub private_source: [mbedtls_entropy_source_state; 20usize], +} +impl Default for mbedtls_entropy_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function copies the contents of group \p src into - /// group \p dst. - /// - /// \param dst The destination group. This must be initialized. - /// \param src The source group. This must be initialized. + /// \brief Initialize the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_copy( - dst: *mut mbedtls_ecp_group, - src: *const mbedtls_ecp_group, - ) -> ::core::ffi::c_int; + /// \param ctx Entropy context to initialize + pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function sets a point to the point at infinity. - /// - /// \param pt The point to set. This must be initialized. + /// \brief Free the data in the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \param ctx Entropy context to free + pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function checks if a point is the point at infinity. + /// \brief Adds an entropy source to poll + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param pt The point to test. This must be initialized. + /// \param ctx Entropy context + /// \param f_source Entropy function + /// \param p_source Function data + /// \param threshold Minimum required from source before entropy is released + /// ( with mbedtls_entropy_func() ) (in bytes) + /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + /// MBEDTLS_ENTROPY_SOURCE_WEAK. + /// At least one strong source needs to be added. + /// Weaker sources (such as the cycle counter) can be used as + /// a complement. /// - /// \return \c 1 if the point is zero. - /// \return \c 0 if the point is non-zero. - /// \return A negative error code on failure. - pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + pub fn mbedtls_entropy_add_source( + ctx: *mut mbedtls_entropy_context, + f_source: mbedtls_entropy_f_source_ptr, + p_source: *mut ::core::ffi::c_void, + threshold: usize, + strong: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function compares two points. - /// - /// \note This assumes that the points are normalized. Otherwise, - /// they may compare as "not equal" even if they are. + /// \brief Trigger an extra gather poll for the accumulator + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The first point to compare. This must be initialized. - /// \param Q The second point to compare. This must be initialized. + /// \param ctx Entropy context /// - /// \return \c 0 if the points are equal. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. - pub fn mbedtls_ecp_point_cmp( - P: *const mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a non-zero point from two ASCII - /// strings. + /// \brief Retrieve entropy from the accumulator + /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The destination point. This must be initialized. - /// \param radix The numeric base of the input. - /// \param x The first affine coordinate, as a null-terminated string. - /// \param y The second affine coordinate, as a null-terminated string. + /// \param data Entropy context + /// \param output Buffer to fill + /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. - pub fn mbedtls_ecp_point_read_string( - P: *mut mbedtls_ecp_point, - radix: ::core::ffi::c_int, - x: *const ::core::ffi::c_char, - y: *const ::core::ffi::c_char, + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_func( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point into unsigned binary data. + /// \brief Add data to the accumulator manually + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The point to export. This must be initialized. - /// \param format The point format. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// (For groups without these formats, this parameter is - /// ignored. But it still has to be either of the above - /// values.) - /// \param olen The address at which to store the length of - /// the output in Bytes. This must not be \c NULL. - /// \param buf The output buffer. This must be a writable buffer - /// of length \p buflen Bytes. - /// \param buflen The length of the output buffer \p buf in Bytes. + /// \param ctx Entropy context + /// \param data Data to add + /// \param len Length of data /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer - /// is too small to hold the point. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format - /// or the export for the given group is not implemented. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_point_write_binary( - grp: *const mbedtls_ecp_group, - P: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, + /// \return 0 if successful + pub fn mbedtls_entropy_update_manual( + ctx: *mut mbedtls_entropy_context, + data: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a point from unsigned binary data. + /// \brief Checkup routine /// - /// \note This function does not check that the point actually - /// belongs to the given group, see mbedtls_ecp_check_pubkey() - /// for that. + /// This module self-test also calls the entropy self-test, + /// mbedtls_entropy_source_self_test(); /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The CTR_DRBG context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ctr_drbg_context { + ///< The counter (V). + pub private_counter: [::core::ffi::c_uchar; 16usize], + ///< The reseed counter. + /// This is the number of requests that have + /// been made since the last (re)seeding, + /// minus one. + /// Before the initial seeding, this field + /// contains the amount of entropy in bytes + /// to use as a nonce for the initial seeding, + /// or -1 if no nonce length has been explicitly + /// set (see mbedtls_ctr_drbg_set_nonce_len()). + pub private_reseed_counter: ::core::ffi::c_int, + ///< This determines whether prediction + ///resistance is enabled, that is + ///whether to systematically reseed before + ///each random generation. + pub private_prediction_resistance: ::core::ffi::c_int, + ///< The amount of entropy grabbed on each + ///seed or reseed operation, in bytes. + pub private_entropy_len: usize, + ///< The reseed interval. + /// This is the maximum number of requests + /// that can be made between reseedings. + pub private_reseed_interval: ::core::ffi::c_int, + ///< The AES context. + pub private_aes_ctx: mbedtls_aes_context, + pub private_f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + ///< The context for the entropy function. + pub private_p_entropy: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_ctr_drbg_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes the CTR_DRBG context, + /// and prepares it for mbedtls_ctr_drbg_seed() + /// or mbedtls_ctr_drbg_free(). /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The destination context to import the point to. - /// This must be initialized. - /// \param buf The input buffer. This must be a readable buffer - /// of length \p ilen Bytes. - /// \param ilen The length of the input buffer \p buf in Bytes. + /// \note The reseed interval is + /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + /// You can override it by calling + /// mbedtls_ctr_drbg_set_reseed_interval(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the - /// given group is not implemented. - pub fn mbedtls_ecp_point_read_binary( - grp: *const mbedtls_ecp_group, - P: *mut mbedtls_ecp_point, - buf: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to initialize. + pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function imports a point from a TLS ECPoint record. + /// - The \p custom string. /// - /// \note On function return, \p *buf is updated to point immediately - /// after the ECPoint record. + /// \note To achieve the nominal security strength permitted + /// by CTR_DRBG, the entropy length must be: + /// - at least 16 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 32 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The destination point. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the buffer. + /// In addition, if you do not pass a nonce in \p custom, + /// the sum of the entropy length + /// and the entropy nonce length must be: + /// - at least 24 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 48 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization - /// failure. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - pub fn mbedtls_ecp_tls_read_point( - grp: *const mbedtls_ecp_group, - pt: *mut mbedtls_ecp_point, - buf: *mut *const ::core::ffi::c_uchar, + /// \param ctx The CTR_DRBG context to seed. + /// It must have been initialized with + /// mbedtls_ctr_drbg_init(). + /// After a successful call to mbedtls_ctr_drbg_seed(), + /// you may not call mbedtls_ctr_drbg_seed() again on + /// the same context unless you call + /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + /// again first. + /// After a failed call to mbedtls_ctr_drbg_seed(), + /// you must call mbedtls_ctr_drbg_free(). + /// \param f_entropy The entropy callback, taking as arguments the + /// \p p_entropy context, the buffer to fill, and the + /// length of the buffer. + /// \p f_entropy is always called with a buffer size + /// less than or equal to the entropy length. + /// \param p_entropy The entropy context to pass to \p f_entropy. + /// \param custom The personalization string. + /// This can be \c NULL, in which case the personalization + /// string is empty regardless of the value of \p len. + /// \param len The length of the personalization string. + /// This must be at most + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_seed( + ctx: *mut mbedtls_ctr_drbg_context, + f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + p_entropy: *mut ::core::ffi::c_void, + custom: *const ::core::ffi::c_uchar, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point as a TLS ECPoint record - /// defined in RFC 4492, Section 5.4. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to be exported. This must be initialized. - /// \param format The point format to use. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// \param olen The address at which to store the length in Bytes - /// of the data written. - /// \param buf The target buffer. This must be a writable buffer of - /// length \p blen Bytes. - /// \param blen The length of the target buffer \p buf in Bytes. + /// \brief This function resets CTR_DRBG context to the state immediately + /// after initial call of mbedtls_ctr_drbg_init(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer - /// is too small to hold the exported point. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_point( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to clear. + pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function sets up an ECP group context - /// from a standardized set of domain parameters. - /// - /// \note The index should be a value of the NamedCurve enum, - /// as defined in RFC-4492: Elliptic Curve Cryptography - /// (ECC) Cipher Suites for Transport Layer Security (TLS), - /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + /// \brief This function turns prediction resistance on or off. + /// The default value is off. /// - /// \param grp The group context to setup. This must be initialized. - /// \param id The identifier of the domain parameter set to load. + /// \note If enabled, entropy is gathered at the beginning of + /// every call to mbedtls_ctr_drbg_random_with_add() + /// or mbedtls_ctr_drbg_random(). + /// Only use this if your entropy source has sufficient + /// throughput. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_load( - grp: *mut mbedtls_ecp_group, - id: mbedtls_ecp_group_id, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + pub fn mbedtls_ctr_drbg_set_prediction_resistance( + ctx: *mut mbedtls_ctr_drbg_context, + resistance: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function sets up an ECP group context from a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed on each + /// seed or reseed. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. /// - /// \param grp The group context to setup. This must be initialized. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \note The security strength of CTR_DRBG is bounded by the + /// entropy length. Thus: + /// - When using AES-256 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + /// which is the default), + /// \p len must be at least 32 (in bytes) + /// to achieve a 256-bit strength. + /// - When using AES-128 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + /// \p len must be at least 16 (in bytes) + /// to achieve a 128-bit strength. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group( - grp: *mut mbedtls_ecp_group, - buf: *mut *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. + pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); } unsafe extern "C" { - /// \brief This function extracts an elliptic curve group ID from a - /// TLS ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed + /// as a nonce for the initial seeding. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// Call this function before calling mbedtls_ctr_drbg_seed() to read + /// a nonce from the entropy source during the initial seeding. /// - /// \param grp The address at which to store the group id. - /// This must not be \c NULL. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab for the nonce, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group_id( - grp: *mut mbedtls_ecp_group_id, - buf: *mut *const ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + /// if the initial seeding has already taken place. + pub fn mbedtls_ctr_drbg_set_nonce_len( + ctx: *mut mbedtls_ctr_drbg_context, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports an elliptic curve as a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the reseed interval. /// - /// \param grp The ECP group to be exported. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param olen The address at which to store the number of Bytes written. - /// This must not be \c NULL. - /// \param buf The buffer to write to. This must be a writable buffer - /// of length \p blen Bytes. - /// \param blen The length of the output buffer \p buf in Bytes. + /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function + /// is called again. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output - /// buffer is too small to hold the exported group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_group( - grp: *const mbedtls_ecp_group, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// + /// \param ctx The CTR_DRBG context. + /// \param interval The reseed interval. + pub fn mbedtls_ctr_drbg_set_reseed_interval( + ctx: *mut mbedtls_ctr_drbg_context, + interval: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function performs a scalar multiplication of a point - /// by an integer: \p R = \p m * \p P. - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function reseeds the CTR_DRBG context, that is + /// extracts data from the entropy source. /// - /// \note To prevent timing attacks, this function - /// executes the exact same sequence of base-field - /// operations for any valid \p m. It avoids any if-branch or - /// array index depending on the value of \p m. It also uses - /// \p f_rng to randomize some intermediate results. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param ctx The CTR_DRBG context. + /// \param additional Additional data to add to the state. Can be \c NULL. + /// \param len The length of the additional data. + /// This must be less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_reseed( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication of a point by - /// an integer: \p R = \p m * \p P in a restartable way. - /// - /// \see mbedtls_ecp_mul() + /// \brief This function updates the state of the CTR_DRBG context. /// - /// \note This function does the same as \c mbedtls_ecp_mul(), but - /// it can return early and restart according to the limit set - /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. - /// \param rs_ctx The restart context (NULL disables restart). + /// \param ctx The CTR_DRBG context. + /// \param additional The data to update the state with. This must not be + /// \c NULL unless \p add_len is \c 0. + /// \param add_len Length of \p additional in bytes. This must be at + /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecp_restart_ctx, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + /// \p add_len is more than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return An error from the underlying AES cipher on failure. + pub fn mbedtls_ctr_drbg_update( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function updates a CTR_DRBG instance with additional + /// data and uses it to generate random data. /// - /// \note In contrast to mbedtls_ecp_mul(), this function does not - /// guarantee a constant execution flow and timing. + /// This function automatically reseeds if the reseed counter is exceeded + /// or prediction resistance is enabled. /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. + /// \param additional Additional data to update. Can be \c NULL, in which + /// case the additional data is empty regardless of + /// the value of \p add_len. + /// \param add_len The length of the additional data + /// if \p additional is not \c NULL. + /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + /// and less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random_with_add( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q in a - /// restartable way. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. /// - /// \see \c mbedtls_ecp_muladd() + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The CTR_DRBG checkup routine. /// - /// \note This function works the same as \c mbedtls_ecp_muladd(), - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. - /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. - /// \param rs_ctx The restart context (NULL disables restart). - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, - rs_ctx: *mut mbedtls_ecp_restart_ctx, - ) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function checks that a point is a valid public key - /// on this curve. - /// - /// It only checks that the point is non-zero, has - /// valid coordinates and lies on the curve. It does not verify - /// that it is indeed a multiple of \p G. This additional - /// check is computationally more expensive, is not required - /// by standards, and should not be necessary if the group - /// used has a small cofactor. In particular, it is useless for - /// the NIST groups which all have a cofactor of 1. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure, to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the point should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid public key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not - /// a valid public key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_pubkey( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +///< Curve not defined. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; +///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; +///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; +///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; +///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; +///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; +///< Domain parameters for 256-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; +///< Domain parameters for 384-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; +///< Domain parameters for 512-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; +///< Domain parameters for Curve25519. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; +///< Domain parameters for 192-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; +///< Domain parameters for 224-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; +///< Domain parameters for 256-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; +///< Domain parameters for Curve448. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; +/// Domain-parameter identifiers: curve, subgroup, and generator. +/// +/// \note Only curves over prime fields are supported. +/// +/// \warning This library does not support validation of arbitrary domain +/// parameters. Therefore, only standardized domain parameters from trusted +/// sources should be used. See mbedtls_ecp_group_load(). +pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; +pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; +/// Curve information, for use by other modules. +/// +/// The fields of this structure are part of the public API and can be +/// accessed directly by applications. Future versions of the library may +/// add extra fields or reorder existing fields. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_curve_info { + ///< An internal identifier. + pub grp_id: mbedtls_ecp_group_id, + ///< The TLS NamedCurve identifier. + pub tls_id: u16, + ///< The curve size in bits. + pub bit_size: u16, + ///< A human-friendly name. + pub name: *const ::core::ffi::c_char, } -unsafe extern "C" { - /// \brief This function checks that an \p mbedtls_mpi is a - /// valid private key for this curve. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the private key should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The integer to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid private key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid - /// private key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_privkey( - grp: *const mbedtls_ecp_group, - d: *const mbedtls_mpi, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_curve_info { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates a private key. - /// - /// \param grp The ECP group to generate a private key for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_privkey( - grp: *const mbedtls_ecp_group, - d: *mut mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +/// \brief The ECP point structure, in Jacobian coordinates. +/// +/// \note All functions expect and return points satisfying +/// the following condition: Z == 0 or +/// Z == 1. Other values of \p Z are +/// used only by internal functions. +/// The point is zero, or "at infinity", if Z == 0. +/// Otherwise, \p X and \p Y are its standard (affine) +/// coordinates. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_point { + ///< The X coordinate of the ECP point. + pub private_X: mbedtls_mpi, + ///< The Y coordinate of the ECP point. + pub private_Y: mbedtls_mpi, + ///< The Z coordinate of the ECP point. + pub private_Z: mbedtls_mpi, } -unsafe extern "C" { - /// \brief This function generates a keypair with a configurable base - /// point. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param G The base point to use. This must be initialized - /// and belong to \p grp. It replaces the default base - /// point \c grp->G used by mbedtls_ecp_gen_keypair(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair_base( - grp: *mut mbedtls_ecp_group, - G: *const mbedtls_ecp_point, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_point { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates an ECP keypair. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. +/// \brief The ECP group structure. +/// +/// We consider two types of curve equations: +///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P +/// (SEC1 + RFC-4492)
            • +///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, +/// Curve448)
          +/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. +/// +/// For Short Weierstrass, this subgroup is the whole curve, and its +/// cardinality is denoted by \p N. Our code requires that \p N is an +/// odd prime as mbedtls_ecp_mul() requires an odd number, and +/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. +/// +/// The default implementation only initializes \p A without setting it to the +/// authentic value for curves with A = -3(SECP256R1, etc), in which +/// case you need to load \p A by yourself when using domain parameters directly, +/// for example: +/// \code +/// mbedtls_mpi_init(&A); +/// mbedtls_ecp_group_init(&grp); +/// CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); +/// if (mbedtls_ecp_group_a_is_minus_3(&grp)) { +/// CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); +/// } else { +/// CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); +/// } +/// +/// do_something_with_a(&A); +/// +/// cleanup: +/// mbedtls_mpi_free(&A); +/// mbedtls_ecp_group_free(&grp); +/// \endcode +/// +/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, +/// which is the quantity used in the formulas. Additionally, \p nbits is +/// not the size of \p N but the required size for private keys. +/// +/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. +/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the +/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer +/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits +/// in size, so that it may be efficiently brought in the 0..P-1 range by a few +/// additions or subtractions. Therefore, it is only an approximate modular +/// reduction. It must return 0 on success and non-zero on failure. +/// +/// \note Alternative implementations of the ECP module must obey the +/// following constraints. +/// * Group IDs must be distinct: if two group structures have +/// the same ID, then they must be identical. +/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, +/// \c pbits and \c nbits must have the same type and semantics +/// as in the built-in implementation. +/// They must be available for reading, but direct modification +/// of these fields does not need to be supported. +/// They do not need to be at the same offset in the structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_group { + ///< An internal group identifier. + pub id: mbedtls_ecp_group_id, + ///< The prime modulus of the base field. + pub P: mbedtls_mpi, + ///< For Short Weierstrass: \p A in the equation. Note that + ///\p A is not set to the authentic value in some cases. + ///Refer to detailed description of ::mbedtls_ecp_group if + ///using domain parameters in the structure. + ///For Montgomery curves: (A + 2) / 4. + pub A: mbedtls_mpi, + ///< For Short Weierstrass: \p B in the equation. + ///For Montgomery curves: unused. + pub B: mbedtls_mpi, + ///< The generator of the subgroup used. + pub G: mbedtls_ecp_point, + ///< The order of \p G. + pub N: mbedtls_mpi, + ///< The number of bits in \p P. + pub pbits: usize, + ///< For Short Weierstrass: The number of bits in \p P. + ///For Montgomery curves: the number of bits in the + ///private keys. + pub nbits: usize, + ///< \internal 1 if the constants are static. + pub private_h: ::core::ffi::c_uint, + ///< The function for fast pseudo-reduction + ///mod \p P (see above). + pub private_modp: + ::core::option::Option ::core::ffi::c_int>, + ///< Unused. + pub private_t_pre: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_post: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_data: *mut ::core::ffi::c_void, + ///< Pre-computed points for ecp_mul_comb(). + pub private_T: *mut mbedtls_ecp_point, + ///< The number of dynamic allocated pre-computed points. + pub private_T_size: usize, +} +impl Default for mbedtls_ecp_group { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; +/// \brief The ECP key-pair structure. +/// +/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. +/// +/// \note Members are deliberately in the same order as in the +/// ::mbedtls_ecdsa_context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_keypair { + ///< Elliptic curve and base point + pub private_grp: mbedtls_ecp_group, + ///< our secret value + pub private_d: mbedtls_mpi, + ///< our public value + pub private_Q: mbedtls_ecp_point, +} +impl Default for mbedtls_ecp_keypair { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +} +unsafe extern "C" { + /// \brief This function retrieves the information defined in + /// mbedtls_ecp_curve_info() for all supported curves. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair( - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. + /// + /// \return A statically allocated array. The last entry is 0. + pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function generates an ECP key. + /// \brief This function retrieves the list of internal group + /// identifiers of all supported curves in the order of + /// preference. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. This must be initialized. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_key( - grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return A statically allocated array, + /// terminated with MBEDTLS_ECP_DP_NONE. + pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function reads an elliptic curve private key. + /// \brief This function retrieves curve information from an internal + /// group identifier. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. - /// \param buf The buffer containing the binary representation of the - /// key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The length of the buffer in bytes. + /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is - /// invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_read_key( + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_grp_id( grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - buf: *const ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports an elliptic curve private key. + /// \brief This function retrieves curve information from a TLS + /// NamedCurve value. /// - /// \param key The private key. - /// \param buf The output buffer for containing the binary representation - /// of the key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The total length of the buffer in bytes. + /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key - ///representation is larger than the available space in \p buf. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_write_key( - key: *mut mbedtls_ecp_keypair, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function checks that the keypair objects - /// \p pub and \p prv have the same group and the - /// same public point, and that the private key in - /// \p prv is consistent with the public key. + /// \brief This function retrieves curve information from a + /// human-readable name. /// - /// \param pub The keypair structure holding the public key. This - /// must be initialized. If it contains a private key, that - /// part is ignored. - /// \param prv The keypair structure holding the full keypair. - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param name The human-readable name. /// - /// \return \c 0 on success, meaning that the keys are valid and match. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. - /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX - /// error code on calculation failure. - pub fn mbedtls_ecp_check_pub_priv( - pub_: *const mbedtls_ecp_keypair, - prv: *const mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_name( + name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports generic key-pair parameters. - /// - /// \param key The key pair to export from. - /// \param grp Slot for exported ECP group. - /// It must point to an initialized ECP group. - /// \param d Slot for the exported secret value. - /// It must point to an initialized mpi. - /// \param Q Slot for the exported public value. - /// It must point to an initialized ECP point. + /// \brief This function initializes a point as zero. /// - /// \return \c 0 on success, - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_export( - key: *const mbedtls_ecp_keypair, - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \param pt The point to initialize. + pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief The ECP checkup routine. + /// \brief This function initializes an ECP group context + /// without loading any domain parameters. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< None. -pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; -///< The MD5 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 1; -///< The SHA-1 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 2; -///< The SHA-224 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 3; -///< The SHA-256 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 4; -///< The SHA-384 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 5; -///< The SHA-512 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 6; -///< The RIPEMD-160 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 7; -/// \brief Supported message digests. -/// -/// \warning MD5 and SHA-1 are considered weak message digests and -/// their use constitutes a security risk. We recommend considering -/// stronger message digests instead. -pub type mbedtls_md_type_t = ::core::ffi::c_uint; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_info_t { - _unused: [u8; 0], -} -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; -/// Used internally to indicate whether a context uses legacy or PSA. -/// -/// Internal use only. -pub type mbedtls_md_engine_t = ::core::ffi::c_uint; -/// The generic message-digest context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_context_t { - /// Information about the associated message digest. - pub private_md_info: *const mbedtls_md_info_t, - /// The digest-specific context (legacy) or the PSA operation. - pub private_md_ctx: *mut ::core::ffi::c_void, - /// The HMAC part of the context. - pub private_hmac_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_md_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \note After this function is called, domain parameters + /// for various ECP groups can be loaded through the + /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + /// functions. + pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest type. - /// - /// \param md_type The type of digest to search for. + /// \brief This function initializes a key pair as an invalid one. /// - /// \return The message-digest information associated with \p md_type. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; + /// \param key The key pair to initialize. + pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); } unsafe extern "C" { - /// \brief This function initializes a message-digest context without - /// binding it to a particular message-digest algorithm. + /// \brief This function frees the components of a point. /// - /// This function should always be called first. It prepares the - /// context for mbedtls_md_setup() for binding it to a - /// message-digest algorithm. - pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); + /// \param pt The point to free. + pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief This function clears the internal structure of \p ctx and - /// frees any embedded internal structure, but does not free - /// \p ctx itself. + /// \brief This function frees the components of an ECP group. /// - /// If you have called mbedtls_md_setup() on \p ctx, you must - /// call mbedtls_md_free() when you are no longer using the - /// context. - /// Calling this function if you have previously - /// called mbedtls_md_init() and nothing else is optional. - /// You must not call this function if you have not called - /// mbedtls_md_init(). - pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); + /// \param grp The group to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP group. + pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function selects the message digest algorithm to use, - /// and allocates internal structures. + /// \brief This function frees the components of a key pair. /// - /// It should be called after mbedtls_md_init() or - /// mbedtls_md_free(). Makes it necessary to call - /// mbedtls_md_free() later. + /// \param key The key pair to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP key pair. + pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +} +unsafe extern "C" { + /// \brief This function copies the contents of point \p Q into + /// point \p P. /// - /// \param ctx The context to set up. - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), - /// or non-zero: HMAC is used with this context. + /// \param P The destination point. This must be initialized. + /// \param Q The source point. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. - pub fn mbedtls_md_setup( - ctx: *mut mbedtls_md_context_t, - md_info: *const mbedtls_md_info_t, - hmac: ::core::ffi::c_int, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code for other kinds of failure. + pub fn mbedtls_ecp_copy( + P: *mut mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function clones the state of a message-digest - /// context. - /// - /// \note You must call mbedtls_md_setup() on \c dst before calling - /// this function. - /// - /// \note The two contexts must have the same type, - /// for example, both are SHA-256. - /// - /// \warning This function clones the message-digest state, not the - /// HMAC state. + /// \brief This function copies the contents of group \p src into + /// group \p dst. /// - /// \param dst The destination context. - /// \param src The context to be cloned. + /// \param dst The destination group. This must be initialized. + /// \param src The source group. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. - /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are - /// not using the same engine. This can be avoided by moving - /// the call to psa_crypto_init() before the first call to - /// mbedtls_md_setup(). - pub fn mbedtls_md_clone( - dst: *mut mbedtls_md_context_t, - src: *const mbedtls_md_context_t, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_copy( + dst: *mut mbedtls_ecp_group, + src: *const mbedtls_ecp_group, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest size from the - /// message-digest information structure. + /// \brief This function sets a point to the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to set. This must be initialized. /// - /// \return The size of the message-digest output in Bytes. - pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest type from the - /// message-digest information structure. + /// \brief This function checks if a point is the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to test. This must be initialized. /// - /// \return The type of the message digest. - pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; + /// \return \c 1 if the point is zero. + /// \return \c 0 if the point is non-zero. + /// \return A negative error code on failure. + pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function starts a message-digest computation. + /// \brief This function compares two points. /// - /// You must call this function after setting up the context - /// with mbedtls_md_setup(), and before passing data with - /// mbedtls_md_update(). + /// \note This assumes that the points are normalized. Otherwise, + /// they may compare as "not equal" even if they are. /// - /// \param ctx The generic message-digest context. + /// \param P The first point to compare. This must be initialized. + /// \param Q The second point to compare. This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return \c 0 if the points are equal. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + pub fn mbedtls_ecp_point_cmp( + P: *const mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// message-digest computation. - /// - /// You must call mbedtls_md_starts() before calling this - /// function. You may call this function multiple times. - /// Afterwards, call mbedtls_md_finish(). + /// \brief This function imports a non-zero point from two ASCII + /// strings. /// - /// \param ctx The generic message-digest context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param P The destination point. This must be initialized. + /// \param radix The numeric base of the input. + /// \param x The first affine coordinate, as a null-terminated string. + /// \param y The second affine coordinate, as a null-terminated string. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + pub fn mbedtls_ecp_point_read_string( + P: *mut mbedtls_ecp_point, + radix: ::core::ffi::c_int, + x: *const ::core::ffi::c_char, + y: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the digest operation, - /// and writes the result to the output buffer. - /// - /// Call this function after a call to mbedtls_md_starts(), - /// followed by any number of calls to mbedtls_md_update(). - /// Afterwards, you may either clear the context with - /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse - /// the context for another digest operation with the same - /// algorithm. + /// \brief This function exports a point into unsigned binary data. /// - /// \param ctx The generic message-digest context. - /// \param output The buffer for the generic message-digest checksum result. + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The point to export. This must be initialized. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_point_write_binary( + grp: *const mbedtls_ecp_group, + P: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the message-digest of a buffer, - /// with respect to a configurable message-digest algorithm - /// in a single call. + /// \brief This function imports a point from unsigned binary data. /// - /// The result is calculated as - /// Output = message_digest(input buffer). + /// \note This function does not check that the point actually + /// belongs to the given group, see mbedtls_ecp_check_pubkey() + /// for that. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param input The buffer holding the data. - /// \param ilen The length of the input data. - /// \param output The generic message-digest checksum result. + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md( - md_info: *const mbedtls_md_info_t, - input: *const ::core::ffi::c_uchar, + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The destination context to import the point to. + /// This must be initialized. + /// \param buf The input buffer. This must be a readable buffer + /// of length \p ilen Bytes. + /// \param ilen The length of the input buffer \p buf in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + /// given group is not implemented. + pub fn mbedtls_ecp_point_read_binary( + grp: *const mbedtls_ecp_group, + P: *mut mbedtls_ecp_point, + buf: *const ::core::ffi::c_uchar, ilen: usize, - output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the list of digests supported by the - /// generic digest module. - /// - /// \note The list starts with the strongest available hashes. + /// \brief This function imports a point from a TLS ECPoint record. /// - /// \return A statically allocated array of digests. Each element - /// in the returned list is an integer belonging to the - /// message-digest enumeration #mbedtls_md_type_t. - /// The last entry is 0. - pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest name. + /// \note On function return, \p *buf is updated to point immediately + /// after the ECPoint record. /// - /// \param md_name The name of the digest to search for. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The destination point. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the buffer. /// - /// \return The message-digest information associated with \p md_name. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_string( - md_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_md_info_t; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + /// failure. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + pub fn mbedtls_ecp_tls_read_point( + grp: *const mbedtls_ecp_group, + pt: *mut mbedtls_ecp_point, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest name from the - /// message-digest information structure. + /// \brief This function exports a point as a TLS ECPoint record + /// defined in RFC 4492, Section 5.4. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to be exported. This must be initialized. + /// \param format The point format to use. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// \param olen The address at which to store the length in Bytes + /// of the data written. + /// \param buf The target buffer. This must be a writable buffer of + /// length \p blen Bytes. + /// \param blen The length of the target buffer \p buf in Bytes. /// - /// \return The name of the message digest. - pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + /// is too small to hold the exported point. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_point( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// from the given context. + /// \brief This function sets up an ECP group context + /// from a standardized set of domain parameters. /// - /// \param ctx The context from which to extract the information. - /// This must be initialized (or \c NULL). + /// \note The index should be a value of the NamedCurve enum, + /// as defined in RFC-4492: Elliptic Curve Cryptography + /// (ECC) Cipher Suites for Transport Layer Security (TLS), + /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. /// - /// \return The message-digest information associated with \p ctx. - /// \return \c NULL if \p ctx is \c NULL. - pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; + /// \param grp The group context to setup. This must be initialized. + /// \param id The identifier of the domain parameter set to load. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_load( + grp: *mut mbedtls_ecp_group, + id: mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the HMAC key and prepares to - /// authenticate a new message. + /// \brief This function sets up an ECP group context from a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_setup(), to use - /// the MD context for an HMAC calculation, then call - /// mbedtls_md_hmac_update() to provide the input data, and - /// mbedtls_md_hmac_finish() to get the HMAC value. + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC key in Bytes. + /// \param grp The group context to setup. This must be initialized. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_starts( - ctx: *mut mbedtls_md_context_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group( + grp: *mut mbedtls_ecp_group, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing HMAC - /// computation. + /// \brief This function extracts an elliptic curve group ID from a + /// TLS ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() - /// before calling this function. - /// You may call this function multiple times to pass the - /// input piecewise. - /// Afterwards, call mbedtls_md_hmac_finish(). + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param grp The address at which to store the group id. + /// This must not be \c NULL. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group_id( + grp: *mut mbedtls_ecp_group_id, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the HMAC operation, and writes - /// the result to the output buffer. + /// \brief This function exports an elliptic curve as a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_hmac_starts() and - /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards - /// you may either call mbedtls_md_free() to clear the context, - /// or call mbedtls_md_hmac_reset() to reuse the context with - /// the same HMAC key. - /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param output The generic HMAC checksum result. + /// \param grp The ECP group to be exported. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param olen The address at which to store the number of Bytes written. + /// This must not be \c NULL. + /// \param buf The buffer to write to. This must be a writable buffer + /// of length \p blen Bytes. + /// \param blen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + /// buffer is too small to hold the exported group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_group( + grp: *const mbedtls_ecp_group, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function prepares to authenticate a new message with - /// the same key as the previous HMAC operation. + /// \brief This function performs a scalar multiplication of a point + /// by an integer: \p R = \p m * \p P. /// - /// You may call this function after mbedtls_md_hmac_finish(). - /// Afterwards call mbedtls_md_hmac_update() to pass the new - /// input. + /// It is not thread-safe to use same group in multiple threads. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. + /// \note To prevent timing attacks, this function + /// executes the exact same sequence of base-field + /// operations for any valid \p m. It avoids any if-branch or + /// array index depending on the value of \p m. It also uses + /// \p f_rng to randomize some intermediate results. + /// + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the full generic HMAC - /// on the input buffer with the provided key. + /// \brief This function performs multiplication of a point by + /// an integer: \p R = \p m * \p P in a restartable way. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// \see mbedtls_ecp_mul() /// - /// The HMAC result is calculated as - /// output = generic HMAC(hmac key, input buffer). + /// \note This function does the same as \c mbedtls_ecp_mul(), but + /// it can return early and restart according to the limit set + /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC secret key in Bytes. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. - /// \param output The generic HMAC result. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac( - md_info: *const mbedtls_md_info_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecp_restart_ctx, ) -> ::core::ffi::c_int; } -/// \brief The RSA context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_rsa_context { - ///< Reserved for internal purposes. - /// Do not set this field in application - /// code. Its meaning might change without - /// notice. - pub private_ver: ::core::ffi::c_int, - ///< The size of \p N in Bytes. - pub private_len: usize, - ///< The public modulus. - pub private_N: mbedtls_mpi, - ///< The public exponent. - pub private_E: mbedtls_mpi, - ///< The private exponent. - pub private_D: mbedtls_mpi, - ///< The first prime factor. - pub private_P: mbedtls_mpi, - ///< The second prime factor. - pub private_Q: mbedtls_mpi, - ///< D % (P - 1). - pub private_DP: mbedtls_mpi, - ///< D % (Q - 1). - pub private_DQ: mbedtls_mpi, - ///< 1 / (Q % P). - pub private_QP: mbedtls_mpi, - ///< cached R^2 mod N. - pub private_RN: mbedtls_mpi, - ///< cached R^2 mod P. - pub private_RP: mbedtls_mpi, - ///< cached R^2 mod Q. - pub private_RQ: mbedtls_mpi, - ///< The cached blinding value. - pub private_Vi: mbedtls_mpi, - ///< The cached un-blinding value. - pub private_Vf: mbedtls_mpi, - ///< Selects padding mode: - ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and - ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. - pub private_padding: ::core::ffi::c_int, - ///< Hash identifier of mbedtls_md_type_t type, - ///as specified in md.h for use in the MGF - ///mask generating function used in the - ///EME-OAEP and EMSA-PSS encodings. - pub private_hash_id: ::core::ffi::c_int, -} -impl Default for mbedtls_rsa_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes an RSA context. - /// - /// \note This function initializes the padding and the hash - /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and - /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more - /// information about those parameters. - /// - /// \param ctx The RSA context to initialize. This must not be \c NULL. - pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); -} -unsafe extern "C" { - /// \brief This function sets padding for an already initialized RSA - /// context. - /// - /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP - /// encryption scheme and the RSASSA-PSS signature scheme. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q /// - /// \note The \p hash_id parameter is ignored when using - /// #MBEDTLS_RSA_PKCS_V15 padding. + /// It is not thread-safe to use same group in multiple threads. /// - /// \note The choice of padding mode is strictly enforced for private - /// key operations, since there might be security concerns in - /// mixing padding modes. For public key operations it is - /// a default value, which can be overridden by calling specific - /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx - /// functions. + /// \note In contrast to mbedtls_ecp_mul(), this function does not + /// guarantee a constant execution flow and timing. /// - /// \note The hash selected in \p hash_id is always used for OEAP - /// encryption. For PSS signatures, it is always used for - /// making signatures, but can be overridden for verifying them. - /// If set to #MBEDTLS_MD_NONE, it is always overridden. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \param ctx The initialized RSA context to be configured. - /// \param padding The padding mode to use. This must be either - /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. - /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is - /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this - /// function but may be not suitable for some operations. - /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: - /// \p padding or \p hash_id is invalid. - pub fn mbedtls_rsa_set_padding( - ctx: *mut mbedtls_rsa_context, - padding: ::core::ffi::c_int, - hash_id: mbedtls_md_type_t, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves padding mode of initialized - /// RSA context. - /// - /// \param ctx The initialized RSA context. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q in a + /// restartable way. /// - /// \return RSA padding mode. - pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function retrieves hash identifier of mbedtls_md_type_t - /// type. + /// \see \c mbedtls_ecp_muladd() /// - /// \param ctx The initialized RSA context. + /// \note This function works the same as \c mbedtls_ecp_muladd(), + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return Hash identifier of mbedtls_md_type_t type. - pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function imports a set of core parameters into an - /// RSA context. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, + rs_ctx: *mut mbedtls_ecp_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function checks that a point is a valid public key + /// on this curve. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// It only checks that the point is non-zero, has + /// valid coordinates and lies on the curve. It does not verify + /// that it is indeed a multiple of \c G. This additional + /// check is computationally more expensive, is not required + /// by standards, and should not be necessary if the group + /// used has a small cofactor. In particular, it is useless for + /// the NIST groups which all have a cofactor of 1. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure, to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param E The public exponent. This may be \c NULL. + /// \param grp The ECP group the point should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to check. This must be initialized. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import( - ctx: *mut mbedtls_rsa_context, - N: *const mbedtls_mpi, - P: *const mbedtls_mpi, - Q: *const mbedtls_mpi, - D: *const mbedtls_mpi, - E: *const mbedtls_mpi, + /// \return \c 0 if the point is a valid public key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + /// a valid public key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_pubkey( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports core RSA parameters, in raw big-endian - /// binary format, into an RSA context. - /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \brief This function checks that an \c mbedtls_mpi is a + /// valid private key for this curve. /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// \param grp The ECP group the private key should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The integer to check. This must be initialized. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \return \c 0 if the point is a valid private key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + /// private key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_privkey( + grp: *const mbedtls_ecp_group, + d: *const mbedtls_mpi, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates a private key. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. - /// \param E The public exponent. This may be \c NULL. - /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// \param grp The ECP group to generate a private key for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import_raw( - ctx: *mut mbedtls_rsa_context, - N: *const ::core::ffi::c_uchar, - N_len: usize, - P: *const ::core::ffi::c_uchar, - P_len: usize, - Q: *const ::core::ffi::c_uchar, - Q_len: usize, - D: *const ::core::ffi::c_uchar, - D_len: usize, - E: *const ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_privkey( + grp: *const mbedtls_ecp_group, + d: *mut mbedtls_mpi, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function completes an RSA context from - /// a set of imported core parameters. - /// - /// To setup an RSA public key, precisely \p N and \p E - /// must have been imported. + /// \brief This function generates a keypair with a configurable base + /// point. /// - /// To setup an RSA private key, sufficient information must - /// be present for the other parameters to be derivable. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// The default implementation supports the following: - ///
          • Derive \p P, \p Q from \p N, \p D, \p E.
            • - ///
          • Derive \p N, \p D from \p P, \p Q, \p E.
          - /// Alternative implementations need not support these. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param G The base point to use. This must be initialized + /// and belong to \p grp. It replaces the default base + /// point \c grp->G used by mbedtls_ecp_gen_keypair(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// If this function runs successfully, it guarantees that - /// the RSA context can be used for RSA operations without - /// the risk of failure or crash. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair_base( + grp: *mut mbedtls_ecp_group, + G: *const mbedtls_ecp_point, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates an ECP keypair. /// - /// \warning This function need not perform consistency checks - /// for the imported parameters. In particular, parameters that - /// are not needed by the implementation might be silently - /// discarded and left unchecked. To check the consistency - /// of the key material, see mbedtls_rsa_check_privkey(). + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context holding imported parameters. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations - /// failed. - pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair( + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports the core parameters of an RSA key. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. - /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \brief This function generates an ECP key. /// - /// \param ctx The initialized RSA context. - /// \param N The MPI to hold the RSA modulus. - /// This may be \c NULL if this field need not be exported. - /// \param P The MPI to hold the first prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param Q The MPI to hold the second prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param D The MPI to hold the private exponent. - /// This may be \c NULL if this field need not be exported. - /// \param E The MPI to hold the public exponent. - /// This may be \c NULL if this field need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. This must be initialized. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export( - ctx: *const mbedtls_rsa_context, - N: *mut mbedtls_mpi, - P: *mut mbedtls_mpi, - Q: *mut mbedtls_mpi, - D: *mut mbedtls_mpi, - E: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports core parameters of an RSA key - /// in raw big-endian binary format. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. + /// \brief Set the public key in a key pair object. /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \note This function does not check that the point actually + /// belongs to the given group. Call mbedtls_ecp_check_pubkey() + /// on \p Q before calling this function to check that. /// - /// \note The length parameters are ignored if the corresponding - /// buffer pointers are NULL. + /// \note This function does not check that the public key matches + /// the private key that is already in \p key, if any. + /// To check the consistency of the resulting key pair object, + /// call mbedtls_ecp_check_pub_priv() after setting both + /// the public key and the private key. /// - /// \param ctx The initialized RSA context. - /// \param N The Byte array to store the RSA modulus, - /// or \c NULL if this field need not be exported. - /// \param N_len The size of the buffer for the modulus. - /// \param P The Byte array to hold the first prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param P_len The size of the buffer for the first prime factor. - /// \param Q The Byte array to hold the second prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param Q_len The size of the buffer for the second prime factor. - /// \param D The Byte array to hold the private exponent, - /// or \c NULL if this field need not be exported. - /// \param D_len The size of the buffer for the private exponent. - /// \param E The Byte array to hold the public exponent, - /// or \c NULL if this field need not be exported. - /// \param E_len The size of the buffer for the public exponent. + /// \param grp_id The ECP group identifier. + /// \param key The key pair object. It must be initialized. + /// If its group has already been set, it must match \p grp_id. + /// If its group has not been set, it will be set to \p grp_id. + /// If the public key has already been set, it is overwritten. + /// \param Q The public key to copy. This must be a point on the + /// curve indicated by \p grp_id. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export_raw( - ctx: *const mbedtls_rsa_context, - N: *mut ::core::ffi::c_uchar, - N_len: usize, - P: *mut ::core::ffi::c_uchar, - P_len: usize, - Q: *mut ::core::ffi::c_uchar, - Q_len: usize, - D: *mut ::core::ffi::c_uchar, - D_len: usize, - E: *mut ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + /// match \p grp_id. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_public_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports CRT parameters of a private RSA key. + /// \brief This function reads an elliptic curve private key. /// - /// \note Alternative RSA implementations not using CRT-parameters - /// internally can implement this function based on - /// mbedtls_rsa_deduce_opt(). + /// \note This function does not set the public key in the + /// key pair object. Without a public key, the key pair object + /// cannot be used with operations that require the public key. + /// Call mbedtls_ecp_keypair_calc_public() to set the public + /// key from the private key. Alternatively, you can call + /// mbedtls_ecp_set_public_key() to set the public key part, + /// and then optionally mbedtls_ecp_check_pub_priv() to check + /// that the private and public parts are consistent. + /// + /// \note If a public key has already been set in the key pair + /// object, this function does not check that it is consistent + /// with the private key. Call mbedtls_ecp_check_pub_priv() + /// after setting both the public key and the private key + /// to make that check. /// - /// \param ctx The initialized RSA context. - /// \param DP The MPI to hold \c D modulo `P-1`, - /// or \c NULL if it need not be exported. - /// \param DQ The MPI to hold \c D modulo `Q-1`, - /// or \c NULL if it need not be exported. - /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, - /// or \c NULL if it need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. + /// \param buf The buffer containing the binary representation of the + /// key. (Big endian integer for Weierstrass curves, byte + /// string for Montgomery curves.) + /// \param buflen The length of the buffer in bytes. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_export_crt( - ctx: *const mbedtls_rsa_context, - DP: *mut mbedtls_mpi, - DQ: *mut mbedtls_mpi, - QP: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + /// invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_read_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + buf: *const ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves the length of RSA modulus in Bytes. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context. + /// \deprecated Note that although this function accepts an output + /// buffer that is smaller or larger than the key, most key + /// import interfaces require the output to have exactly + /// key's nominal length. It is generally simplest to + /// pass the key's nominal length as \c buflen, after + /// checking that the output buffer is large enough. + /// See the description of the \p buflen parameter for + /// how to calculate the nominal length. + /// To avoid this difficulty, use mbedtls_ecp_write_key_ext() + /// instead. + /// mbedtls_ecp_write_key() is deprecated and will be + /// removed in a future version of the library. + /// + /// \note If the private key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \return The length of the RSA modulus in Bytes. - pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; + /// \param key The private key. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// For Weierstrass curves, this is the big-endian + /// representation, padded with null bytes at the beginning + /// to reach \p buflen bytes. + /// For Montgomery curves, this is the standard byte string + /// representation (which is little-endian), padded with + /// null bytes at the end to reach \p buflen bytes. + /// \param buflen The total length of the buffer in bytes. + /// The length of the output is + /// (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// For Weierstrass keys, if the output buffer is smaller, + /// leading zeros are trimmed to fit if possible. For + /// Montgomery keys, the output buffer must always be large + /// enough for the nominal length. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + /// #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key( + key: *mut mbedtls_ecp_keypair, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an RSA keypair. - /// - /// \note mbedtls_rsa_init() must be called before this function, - /// to set up the RSA context. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context used to hold the key. - /// \param f_rng The RNG function to be used for key generation. - /// This is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. - /// This may be \c NULL if \p f_rng doesn't need a context. - /// \param nbits The size of the public key in bits. - /// \param exponent The public exponent to use. For example, \c 65537. - /// This must be odd and greater than \c 1. + /// \param key The private key. + /// \param olen On success, the length of the private key. + /// This is always (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// \param buflen The total length of the buffer in bytes. + /// #MBEDTLS_ECP_MAX_BYTES is always sufficient. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_gen_key( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - nbits: ::core::ffi::c_uint, - exponent: ::core::ffi::c_int, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + /// set in \p key. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key_ext( + key: *const mbedtls_ecp_keypair, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains at least an RSA - /// public key. + /// \brief This function exports an elliptic curve public key. /// - /// If the function runs successfully, it is guaranteed that - /// enough information is present to perform an RSA public key - /// operation using mbedtls_rsa_public(). + /// \note If the public key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to check. + /// \param key The public key. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_write_public_key( + key: *const mbedtls_ecp_keypair, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains an RSA private key - /// and perform basic consistency checks. - /// - /// \note The consistency checks performed by this function not only - /// ensure that mbedtls_rsa_private() can be called successfully - /// on the given context, but that the various parameters are - /// mutually consistent with high probability, in the sense that - /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// \brief This function checks that the keypair objects + /// \p pub and \p prv have the same group and the + /// same public point, and that the private key in + /// \p prv is consistent with the public key. /// - /// \warning This function should catch accidental misconfigurations - /// like swapping of parameters, but it cannot establish full - /// trust in neither the quality nor the consistency of the key - /// material that was used to setup the given RSA context: - ///
          • Consistency: Imported parameters that are irrelevant - /// for the implementation might be silently dropped. If dropped, - /// the current function does not have access to them, - /// and therefore cannot check them. See mbedtls_rsa_complete(). - /// If you want to check the consistency of the entire - /// content of a PKCS1-encoded RSA private key, for example, you - /// should use mbedtls_rsa_validate_params() before setting - /// up the RSA context. - /// Additionally, if the implementation performs empirical checks, - /// these checks substantiate but do not guarantee consistency.
            • - ///
          • Quality: This function is not expected to perform - /// extended quality assessments like checking that the prime - /// factors are safe. Additionally, it is the responsibility of the - /// user to ensure the trustworthiness of the source of his RSA - /// parameters, which goes beyond what is effectively checkable - /// by the library.
          - /// - /// \param ctx The initialized RSA context to check. + /// \param pub The keypair structure holding the public key. This + /// must be initialized. If it contains a private key, that + /// part is ignored. + /// \param prv The keypair structure holding the full keypair. + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success, meaning that the keys are valid and match. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_check_pub_priv( + pub_: *const mbedtls_ecp_keypair, + prv: *const mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks a public-private RSA key pair. - /// - /// It checks each of the contexts, and makes sure they match. + /// \brief Calculate the public key from a private key in a key pair. /// - /// \param pub The initialized RSA context holding the public key. - /// \param prv The initialized RSA context holding the private key. + /// \param key A keypair structure. It must have a private key set. + /// If the public key is set, it will be overwritten. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pub_priv( - pub_: *const mbedtls_rsa_context, - prv: *const mbedtls_rsa_context, + /// \return \c 0 on success. The key pair object can be used for + /// operations that require the public key. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_keypair_calc_public( + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs an RSA public key operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// - /// \note This function does not handle message padding. + /// \brief Query the group that a key pair belongs to. /// - /// \note Make sure to set \p input[0] = 0 or ensure that - /// input is smaller than \p N. + /// \param key The key pair to query. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_public( - ctx: *mut mbedtls_rsa_context, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The group ID for the group registered in the key pair + /// object. + /// This is \c MBEDTLS_ECP_DP_NONE if no group has been set + /// in the key pair object. + pub fn mbedtls_ecp_keypair_get_group_id( + key: *const mbedtls_ecp_keypair, + ) -> mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function performs an RSA private key operation. - /// - /// \note Blinding is used if and only if a PRNG is provided. + /// \brief This function exports generic key-pair parameters. /// - /// \note If blinding is used, both the base of exponentiation - /// and the exponent are blinded, providing protection - /// against some side-channel attacks. + /// Each of the output parameters can be a null pointer + /// if you do not need that parameter. /// - /// \warning It is deprecated and a security risk to not provide - /// a PRNG here and thereby prevent the use of blinding. - /// Future versions of the library may enforce the presence - /// of a PRNG. + /// \note If the private key or the public key was not set in \p key, + /// the corresponding output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function, used for blinding. It is mandatory. - /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param key The key pair to export from. + /// \param grp Slot for exported ECP group. + /// It must either be null or point to an initialized ECP group. + /// \param d Slot for the exported secret value. + /// It must either be null or point to an initialized mpi. + /// \param Q Slot for the exported public value. + /// It must either be null or point to an initialized ECP point. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_private( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_export( + key: *const mbedtls_ecp_keypair, + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function adds the message padding, then performs an RSA - /// operation. - /// - /// It is the generic wrapper for performing a PKCS#1 encryption - /// operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG to use. It is used for padding generation - /// and it is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. May be - /// \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \brief The ECP checkup routine. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return \c 1 on failure. + pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The RSA context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_rsa_context { + ///< Reserved for internal purposes. + /// Do not set this field in application + /// code. Its meaning might change without + /// notice. + pub private_ver: ::core::ffi::c_int, + ///< The size of \p N in Bytes. + pub private_len: usize, + ///< The public modulus. + pub private_N: mbedtls_mpi, + ///< The public exponent. + pub private_E: mbedtls_mpi, + ///< The private exponent. + pub private_D: mbedtls_mpi, + ///< The first prime factor. + pub private_P: mbedtls_mpi, + ///< The second prime factor. + pub private_Q: mbedtls_mpi, + ///< D % (P - 1). + pub private_DP: mbedtls_mpi, + ///< D % (Q - 1). + pub private_DQ: mbedtls_mpi, + ///< 1 / (Q % P). + pub private_QP: mbedtls_mpi, + ///< cached R^2 mod N. + pub private_RN: mbedtls_mpi, + ///< cached R^2 mod P. + pub private_RP: mbedtls_mpi, + ///< cached R^2 mod Q. + pub private_RQ: mbedtls_mpi, + ///< The cached blinding value. + pub private_Vi: mbedtls_mpi, + ///< The cached un-blinding value. + pub private_Vf: mbedtls_mpi, + ///< Selects padding mode: + ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. + pub private_padding: ::core::ffi::c_int, + ///< Hash identifier of mbedtls_md_type_t type, + ///as specified in md.h for use in the MGF + ///mask generating function used in the + ///EME-OAEP and EMSA-PSS encodings. + pub private_hash_id: ::core::ffi::c_int, +} +impl Default for mbedtls_rsa_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 encryption operation - /// (RSAES-PKCS1-v1_5-ENCRYPT). + /// \brief This function initializes an RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. It is mandatory and used for - /// padding generation. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note This function initializes the padding and the hash + /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + /// information about those parameters. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The RSA context to initialize. This must not be \c NULL. + pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP encryption - /// operation (RSAES-OAEP-ENCRYPT). - /// - /// \note The output buffer must be as large as the size - /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \brief This function sets padding for an already initialized RSA + /// context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is needed for padding - /// generation and is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param ilen The length of the plaintext buffer \p input in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + /// encryption scheme and the RSASSA-PSS signature scheme. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs an RSA operation, then removes the - /// message padding. + /// \note The \p hash_id parameter is ignored when using + /// #MBEDTLS_RSA_PKCS_V15 padding. /// - /// It is the generic wrapper for performing a PKCS#1 decryption - /// operation. + /// \note The choice of padding mode is strictly enforced for private + /// key operations, since there might be security concerns in + /// mixing padding modes. For public key operations it is + /// a default value, which can be overridden by calling specific + /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + /// functions. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N (for example, - /// 128 Bytes if RSA-1024 is used) to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note The hash selected in \p hash_id is always used for OEAP + /// encryption. For PSS signatures, it is always used for + /// making signatures, but can be overridden for verifying them. + /// If set to #MBEDTLS_MD_NONE, it is always overridden. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \param ctx The initialized RSA context to be configured. + /// \param padding The padding mode to use. This must be either + /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is + /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + /// function but may be not suitable for some operations. + /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_decrypt( + /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + /// \p padding or \p hash_id is invalid. + pub fn mbedtls_rsa_set_padding( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + padding: ::core::ffi::c_int, + hash_id: mbedtls_md_type_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 decryption - /// operation (RSAES-PKCS1-v1_5-DECRYPT). + /// \brief This function retrieves padding mode of initialized + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for example, - /// 128 Bytes if RSA-1024 is used, to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \param ctx The initialized RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \return RSA padding mode. + pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function retrieves hash identifier of mbedtls_md_type_t + /// type. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context. + /// + /// \return Hash identifier of mbedtls_md_type_t type. + pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP decryption - /// operation (RSAES-OAEP-DECRYPT). + /// \brief This function imports a set of core parameters into an + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for - /// example, 128 Bytes if RSA-1024 is used, to be able to - /// hold an arbitrary decrypted message. If it is not - /// large enough to hold the decryption of the particular - /// ciphertext provided, the function returns - /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. + /// + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. + /// + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. + /// + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param E The public exponent. This may be \c NULL. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_decrypt( + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + N: *const mbedtls_mpi, + P: *const mbedtls_mpi, + Q: *const mbedtls_mpi, + D: *const mbedtls_mpi, + E: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a private RSA operation to sign - /// a message digest using PKCS#1. + /// \brief This function imports core RSA parameters, in raw big-endian + /// binary format, into an RSA context. /// - /// It is the generic wrapper for performing a PKCS#1 - /// signature. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_sign() for details on - /// \p md_alg and \p hash_id. + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is mandatory and - /// must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_sign( + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + /// \param E The public exponent. This may be \c NULL. + /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import_raw( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + N: *const ::core::ffi::c_uchar, + N_len: usize, + P: *const ::core::ffi::c_uchar, + P_len: usize, + Q: *const ::core::ffi::c_uchar, + Q_len: usize, + D: *const ::core::ffi::c_uchar, + D_len: usize, + E: *const ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 signature - /// operation (RSASSA-PKCS1-v1_5-SIGN). + /// \brief This function completes an RSA context from + /// a set of imported core parameters. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// To setup an RSA public key, precisely \c N and \c E + /// must have been imported. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// To setup an RSA private key, sufficient information must + /// be present for the other parameters to be derivable. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// The default implementation supports the following: + ///
          • Derive \c P, \c Q from \c N, \c D, \c E.
            • + ///
          • Derive \c N, \c D from \c P, \c Q, \c E.
          + /// Alternative implementations need not support these. /// - /// \note This function enforces that the provided salt length complies - /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 - /// step 3. The constraint is that the hash length plus the salt - /// length plus 2 bytes must be at most the key length. If this - /// constraint is not met, this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// If this function runs successfully, it guarantees that + /// the RSA context can be used for RSA operations without + /// the risk of failure or crash. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param saltlen The length of the salt that should be used. - /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use - /// the largest possible salt length up to the hash length, - /// which is the largest permitted by some standards including - /// FIPS 186-4 §5.5. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \warning This function need not perform consistency checks + /// for the imported parameters. In particular, parameters that + /// are not needed by the implementation might be silently + /// discarded and left unchecked. To check the consistency + /// of the key material, see mbedtls_rsa_check_privkey(). /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign_ext( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - saltlen: ::core::ffi::c_int, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context holding imported parameters. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + /// failed. + pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// \brief This function exports the core parameters of an RSA key. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \note This function always uses the maximum possible salt size, - /// up to the length of the payload hash. This choice of salt - /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 - /// v2.2) §9.1.1 step 3. Furthermore this function enforces a - /// minimum salt size which is the hash size minus 2 bytes. If - /// this minimum size is too large given the key size (the salt - /// size, plus the hash size, plus 2 bytes must be no more than - /// the key size in bytes), this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param N The MPI to hold the RSA modulus. + /// This may be \c NULL if this field need not be exported. + /// \param P The MPI to hold the first prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param Q The MPI to hold the second prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param D The MPI to hold the private exponent. + /// This may be \c NULL if this field need not be exported. + /// \param E The MPI to hold the public exponent. + /// This may be \c NULL if this field need not be exported. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export( + ctx: *const mbedtls_rsa_context, + N: *mut mbedtls_mpi, + P: *mut mbedtls_mpi, + Q: *mut mbedtls_mpi, + D: *mut mbedtls_mpi, + E: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a public RSA operation and checks - /// the message digest. - /// - /// This is the generic wrapper for performing a PKCS#1 - /// verification. + /// \brief This function exports core parameters of an RSA key + /// in raw big-endian binary format. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - /// \p hash_id. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \note The length parameters are ignored if the corresponding + /// buffer pointers are NULL. + /// + /// \param ctx The initialized RSA context. + /// \param N The Byte array to store the RSA modulus, + /// or \c NULL if this field need not be exported. + /// \param N_len The size of the buffer for the modulus. + /// \param P The Byte array to hold the first prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param P_len The size of the buffer for the first prime factor. + /// \param Q The Byte array to hold the second prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param Q_len The size of the buffer for the second prime factor. + /// \param D The Byte array to hold the private exponent, + /// or \c NULL if this field need not be exported. + /// \param D_len The size of the buffer for the private exponent. + /// \param E The Byte array to hold the public exponent, + /// or \c NULL if this field need not be exported. + /// \param E_len The size of the buffer for the public exponent. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export_raw( + ctx: *const mbedtls_rsa_context, + N: *mut ::core::ffi::c_uchar, + N_len: usize, + P: *mut ::core::ffi::c_uchar, + P_len: usize, + Q: *mut ::core::ffi::c_uchar, + Q_len: usize, + D: *mut ::core::ffi::c_uchar, + D_len: usize, + E: *mut ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 verification - /// operation (RSASSA-PKCS1-v1_5-VERIFY). + /// \brief This function exports CRT parameters of a private RSA key. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Alternative RSA implementations not using CRT-parameters + /// internally can implement this function based on + /// mbedtls_rsa_deduce_opt(). /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param DP The MPI to hold \c D modulo `P-1`, + /// or \c NULL if it need not be exported. + /// \param DQ The MPI to hold \c D modulo `Q-1`, + /// or \c NULL if it need not be exported. + /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, + /// or \c NULL if it need not be exported. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_export_crt( + ctx: *const mbedtls_rsa_context, + DP: *mut mbedtls_mpi, + DQ: *mut mbedtls_mpi, + QP: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). - /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. If the \c hash_id set in \p ctx by - /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg - /// parameter is used. + /// \brief This function retrieves the length of the RSA modulus in bits. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param ctx The initialized RSA context. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The length of the RSA modulus in bits. + pub fn mbedtls_rsa_get_bitlen(ctx: *const mbedtls_rsa_context) -> usize; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). + /// \brief This function retrieves the length of RSA modulus in Bytes. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \param ctx The initialized RSA context. /// - /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is - /// ignored. + /// \return The length of the RSA modulus in Bytes. + pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; +} +unsafe extern "C" { + /// \brief This function generates an RSA keypair. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param mgf1_hash_id The message digest algorithm used for the - /// verification operation and the mask generation - /// function (MGF1). For more details on the encoding - /// operation and the mask generation function, consult - /// RFC-3447: Public-Key Cryptography Standards - /// (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. - /// \param expected_salt_len The length of the salt used in padding. Use - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note mbedtls_rsa_init() must be called before this function, + /// to set up the RSA context. /// - /// \return \c 0 if the verify operation was successful. + /// \param ctx The initialized RSA context used to hold the key. + /// \param f_rng The RNG function to be used for key generation. + /// This is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. + /// This may be \c NULL if \p f_rng doesn't need a context. + /// \param nbits The size of the public key in bits. + /// \param exponent The public exponent to use. For example, \c 65537. + /// This must be odd and greater than \c 1. + /// + /// \return \c 0 on success. /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify_ext( + pub fn mbedtls_rsa_gen_key( ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - mgf1_hash_id: mbedtls_md_type_t, - expected_salt_len: ::core::ffi::c_int, - sig: *const ::core::ffi::c_uchar, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + nbits: ::core::ffi::c_uint, + exponent: ::core::ffi::c_int, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function copies the components of an RSA context. + /// \brief This function checks if a context contains at least an RSA + /// public key. /// - /// \param dst The destination context. This must be initialized. - /// \param src The source context. This must be initialized. + /// If the function runs successfully, it is guaranteed that + /// enough information is present to perform an RSA public key + /// operation using mbedtls_rsa_public(). + /// + /// \param ctx The initialized RSA context to check. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. - pub fn mbedtls_rsa_copy( - dst: *mut mbedtls_rsa_context, - src: *const mbedtls_rsa_context, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees the components of an RSA key. + /// \brief This function checks if a context contains an RSA private key + /// and perform basic consistency checks. /// - /// \param ctx The RSA context to free. May be \c NULL, in which case - /// this function is a no-op. If it is not \c NULL, it must - /// point to an initialized RSA context. - pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); + /// \note The consistency checks performed by this function not only + /// ensure that mbedtls_rsa_private() can be called successfully + /// on the given context, but that the various parameters are + /// mutually consistent with high probability, in the sense that + /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// + /// \warning This function should catch accidental misconfigurations + /// like swapping of parameters, but it cannot establish full + /// trust in neither the quality nor the consistency of the key + /// material that was used to setup the given RSA context: + ///
          • Consistency: Imported parameters that are irrelevant + /// for the implementation might be silently dropped. If dropped, + /// the current function does not have access to them, + /// and therefore cannot check them. See mbedtls_rsa_complete(). + /// If you want to check the consistency of the entire + /// content of a PKCS1-encoded RSA private key, for example, you + /// should use mbedtls_rsa_validate_params() before setting + /// up the RSA context. + /// Additionally, if the implementation performs empirical checks, + /// these checks substantiate but do not guarantee consistency.
            • + ///
          • Quality: This function is not expected to perform + /// extended quality assessments like checking that the prime + /// factors are safe. Additionally, it is the responsibility of the + /// user to ensure the trustworthiness of the source of his RSA + /// parameters, which goes beyond what is effectively checkable + /// by the library.
          + /// + /// \param ctx The initialized RSA context to check. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The RSA checkup routine. + /// \brief This function checks a public-private RSA key pair. + /// + /// It checks each of the contexts, and makes sure they match. + /// + /// \param pub The initialized RSA context holding the public key. + /// \param prv The initialized RSA context holding the private key. /// /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief The ECDSA context structure. -/// -/// \warning Performing multiple operations concurrently on the same -/// ECDSA context is not supported; objects of this type -/// should not be shared between multiple threads. -/// -/// \note pk_wrap module assumes that "ecdsa_context" is identical -/// to "ecp_keypair" (see for example structure -/// "mbedtls_eckey_info" where ECDSA sign/verify functions -/// are used also for EC key) -pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; -pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pub_priv( + pub_: *const mbedtls_rsa_context, + prv: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { - /// \brief This function checks whether a given group can be used - /// for ECDSA. + /// \brief This function performs an RSA public key operation. /// - /// \param gid The ECP group ID to check. + /// \param ctx The initialized RSA context to use. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 1 if the group can be used, \c 0 otherwise - pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; + /// \note This function does not handle message padding. + /// + /// \note Make sure to set \p input[0] = 0 or ensure that + /// input is smaller than \c N. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_public( + ctx: *mut mbedtls_rsa_context, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message. + /// \brief This function performs an RSA private key operation. /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_ext() is usually preferred. + /// \note Blinding is used if and only if a PRNG is provided. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated - /// as defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \note If blinding is used, both the base of exponentiation + /// and the exponent are blinded, providing protection + /// against some side-channel attacks. /// - /// \see ecp.h + /// \warning It is deprecated and a security risk to not provide + /// a PRNG here and thereby prevent the use of blinding. + /// Future versions of the library may enforce the presence + /// of a PRNG. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized. - /// \param buf The content to be signed. This is usually the hash of - /// the original data to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function, used for blinding. It is mandatory. + /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX - /// or \c MBEDTLS_MPI_XXX error code on failure. - pub fn mbedtls_ecdsa_sign( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_private( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, deterministic version. + /// \brief This function adds the message padding, then performs an RSA + /// operation. /// - /// For more information, see RFC-6979: Deterministic - /// Usage of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). + /// It is the generic wrapper for performing a PKCS#1 encryption + /// operation. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG to use. It is used for padding generation + /// and it is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. May be + /// \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \see ecp.h + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v1.5 encryption operation + /// (RSAES-PKCS1-v1_5-ENCRYPT). /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. It is mandatory and used for + /// padding generation. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_ext( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 OAEP encryption + /// operation (RSAES-OAEP-ENCRYPT). /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_restartable() is usually - /// preferred. + /// \note The output buffer must be as large as the size + /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \note This function is like \c mbedtls_ecdsa_sign() but - /// it can return early and restart according to the - /// limit set with \c mbedtls_ecp_set_max_ops() to - /// reduce blocking. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is needed for padding + /// generation and is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param ilen The length of the plaintext buffer \p input in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs an RSA operation, then removes the + /// message padding. /// - /// \see ecp.h + /// It is the generic wrapper for performing a PKCS#1 decryption + /// operation. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + /// mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + /// inherently dangerous function (CWE-242). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N (for example, + /// 128 Bytes if RSA-1024 is used) to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. - /// - /// \note This function is like \c - /// mbedtls_ecdsa_sign_det_ext() but it can return - /// early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 decryption + /// operation (RSAES-PKCS1-v1_5-DECRYPT). /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \warning This is an inherently dangerous function (CWE-242). Unless + /// it is used in a side channel free and safe way (eg. + /// implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + /// the calling code is vulnerable. /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for example, + /// 128 Bytes if RSA-1024 is used, to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message. - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \brief This function performs a PKCS#1 v2.1 OAEP decryption + /// operation (RSAES-OAEP-DECRYPT). /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for + /// example, 128 Bytes if RSA-1024 is used, to be able to + /// hold an arbitrary decrypted message. If it is not + /// large enough to hold the decryption of the particular + /// ciphertext provided, the function returns + /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message, in a restartable manner + /// \brief This function performs a private RSA operation to sign + /// a message digest using PKCS#1. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// It is the generic wrapper for performing a PKCS#1 + /// signature. /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify_restartable( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, serialized as defined in RFC-4492: - /// Elliptic Curve Cryptography (ECC) Cipher Suites for - /// Transport Layer Security (TLS). - /// - /// \warning It is not thread-safe to use the same context in - /// multiple threads. - /// - /// \note The deterministic version is used if - /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more - /// information, see RFC-6979: Deterministic Usage - /// of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. - /// - /// \see ecp.h + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_sign() for details on + /// \p md_alg and \p hash_id. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is used only for blinding and may be set to \c NULL, but - /// doing so is DEPRECATED. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is mandatory and + /// must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, in a restartable way. - /// - /// \see \c mbedtls_ecdsa_write_signature() - /// - /// \note This function is like \c mbedtls_ecdsa_write_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 signature + /// operation (RSASSA-PKCS1-v1_5-SIGN). /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is unused and may be set to \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \see ecp.h + /// \note This function enforces that the provided salt length complies + /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + /// step 3. The constraint is that the hash length plus the salt + /// length plus 2 bytes must be at most the key length. If this + /// constraint is not met, this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param saltlen The length of the salt that should be used. + /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + /// the largest possible salt length up to the hash length, + /// which is the largest permitted by some standards including + /// FIPS 186-4 §5.5. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign_ext( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, - sig: *const ::core::ffi::c_uchar, - slen: usize, + saltlen: ::core::ffi::c_int, + sig: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature, - /// in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \see \c mbedtls_ecdsa_read_signature() + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \note This function is like \c mbedtls_ecdsa_read_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function always uses the maximum possible salt size, + /// up to the length of the payload hash. This choice of salt + /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + /// v2.2) §9.1.1 step 3. Furthermore this function enforces a + /// minimum salt size which is the hash size minus 2 bytes. If + /// this minimum size is too large given the key size (the salt + /// size, plus the hash size, plus 2 bytes must be no more than + /// the key size in bytes), this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a public RSA operation and checks + /// the message digest. + /// + /// This is the generic wrapper for performing a PKCS#1 + /// verification. + /// + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + /// \c hash_id. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *const ::core::ffi::c_uchar, - slen: usize, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an ECDSA keypair on the given curve. + /// \brief This function performs a PKCS#1 v1.5 verification + /// operation (RSASSA-PKCS1-v1_5-VERIFY). /// - /// \see ecp.h + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \param ctx The ECDSA context to store the keypair in. - /// This must be initialized. - /// \param gid The elliptic curve to use. One of the various - /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_genkey( - ctx: *mut mbedtls_ecdsa_context, - gid: mbedtls_ecp_group_id, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. If the \c hash_id set in \p ctx by + /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + /// parameter is used. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets up an ECDSA context from an EC key pair. + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param ctx The ECDSA context to setup. This must be initialized. - /// \param key The EC key to use. This must be initialized and hold - /// a private-public key pair or a public key. In the former - /// case, the ECDSA context may be used for signature creation - /// and verification after this call. In the latter case, it - /// may be used for signature verification. + /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + /// ignored. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_from_keypair( - ctx: *mut mbedtls_ecdsa_context, - key: *const mbedtls_ecp_keypair, + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param mgf1_hash_id The message digest algorithm used for the + /// verification operation and the mask generation + /// function (MGF1). For more details on the encoding + /// operation and the mask generation function, consult + /// RFC-3447: Public-Key Cryptography Standards + /// (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. + /// \param expected_salt_len The length of the salt used in padding. Use + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify_ext( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + mgf1_hash_id: mbedtls_md_type_t, + expected_salt_len: ::core::ffi::c_int, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECDSA context. + /// \brief This function copies the components of an RSA context. /// - /// \param ctx The ECDSA context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); + /// \param dst The destination context. This must be initialized. + /// \param src The source context. This must be initialized. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + pub fn mbedtls_rsa_copy( + dst: *mut mbedtls_rsa_context, + src: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees an ECDSA context. + /// \brief This function frees the components of an RSA key. /// - /// \param ctx The ECDSA context to free. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must be initialized. - pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); + /// \param ctx The RSA context to free. May be \c NULL, in which case + /// this function is a no-op. If it is not \c NULL, it must + /// point to an initialized RSA context. + pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); } -pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; -pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; -/// \brief Public key types -pub type mbedtls_pk_type_t = ::core::ffi::c_uint; -/// \brief Options for RSASSA-PSS signature verification. -/// See \c mbedtls_rsa_rsassa_pss_verify_ext() -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_rsassa_pss_options { - /// The digest to use for MGF1 in PSS. +unsafe extern "C" { + /// \brief The RSA checkup routine. /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is - /// disabled, this must be equal to the \c md_alg argument passed - /// to mbedtls_pk_verify_ext(). In a future version of the library, - /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is - /// enabled regardless of the status of #MBEDTLS_RSA_C. - pub mgf1_hash_id: mbedtls_md_type_t, - /// The expected length of the salt, in bytes. This may be - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only - /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be - /// ignored (allowing any salt length). - pub expected_salt_len: ::core::ffi::c_int, -} -impl Default for mbedtls_pk_rsassa_pss_options { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; -/// \brief Types for interfacing with the debug module -pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; -/// \brief Item to send to the debug module -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_debug_item { - pub private_type: mbedtls_pk_debug_type, - pub private_name: *const ::core::ffi::c_char, - pub private_value: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_debug_item { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_info_t { - _unused: [u8; 0], -} -/// \brief Public key container -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_context { - ///< Public key information - pub private_pk_info: *const mbedtls_pk_info_t, - ///< Underlying public key context - pub private_pk_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; -/// \brief Types for RSA-alt abstraction -pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_key_len_func = - ::core::option::Option usize>; +/// \brief The ECDSA context structure. +/// +/// \warning Performing multiple operations concurrently on the same +/// ECDSA context is not supported; objects of this type +/// should not be shared between multiple threads. +/// +/// \note pk_wrap module assumes that "ecdsa_context" is identical +/// to "ecp_keypair" (see for example structure +/// "mbedtls_eckey_info" where ECDSA sign/verify functions +/// are used also for EC key) +pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; +pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; unsafe extern "C" { - /// \brief Return information associated with the given PK type - /// - /// \param pk_type PK type to search for. + /// \brief This function checks whether a given group can be used + /// for ECDSA. /// - /// \return The PK info associated with the type or NULL if not found. - pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; -} -unsafe extern "C" { - /// \brief Initialize a #mbedtls_pk_context (as NONE). + /// \param gid The ECP group ID to check. /// - /// \param ctx The context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); + /// \return \c 1 if the group can be used, \c 0 otherwise + pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Free the components of a #mbedtls_pk_context. + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message. /// - /// \param ctx The context to clear. It must have been initialized. - /// If this is \c NULL, this function does nothing. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_ext() is usually preferred. /// - /// \note For contexts that have been set up with - /// mbedtls_pk_setup_opaque(), this does not free the underlying - /// PSA key and you still need to call psa_destroy_key() - /// independently if you want to destroy that key. - pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); -} -unsafe extern "C" { - /// \brief Initialize a PK context with the information given - /// and allocates the type-specific PK subcontext. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated + /// as defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param info Information to use + /// \see ecp.h /// - /// \return 0 on success, - /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, - /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized. + /// \param buf The content to be signed. This is usually the hash of + /// the original data to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function, used both to generate the ECDSA nonce + /// and for blinding. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. /// - /// \note For contexts holding an RSA-alt key, use - /// \c mbedtls_pk_setup_rsa_alt() instead. - pub fn mbedtls_pk_setup( - ctx: *mut mbedtls_pk_context, - info: *const mbedtls_pk_info_t, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX + /// or \c MBEDTLS_MPI_XXX error code on failure. + pub fn mbedtls_ecdsa_sign( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Initialize an RSA-alt context + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, deterministic version. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param key RSA key pointer - /// \param decrypt_func Decryption function - /// \param sign_func Signing function - /// \param key_len_func Function returning key length in bytes + /// For more information, see RFC-6979: Deterministic + /// Usage of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the - /// context wasn't already initialized as RSA_ALT. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. - pub fn mbedtls_pk_setup_rsa_alt( - ctx: *mut mbedtls_pk_context, - key: *mut ::core::ffi::c_void, - decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, - sign_func: mbedtls_pk_rsa_alt_sign_func, - key_len_func: mbedtls_pk_rsa_alt_key_len_func, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Get the size in bits of the underlying key + /// \see ecp.h /// - /// \param ctx The context to query. It must have been initialized. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + /// may be \c NULL if \p f_rng_blind doesn't need a context + /// parameter. /// - /// \return Key size in bits, or 0 on error - pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_ext( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + md_alg: mbedtls_md_type_t, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Tell if a context can do the operation given by type + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \param ctx The context to query. It must have been initialized. - /// \param type The desired type. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_restartable() is usually + /// preferred. /// - /// \return 1 if the context can do operations on the given type. - /// \return 0 if the context cannot do the operations on the given - /// type. This is always the case for a context that has - /// been initialized but not set up, or that has been - /// cleared with mbedtls_pk_free(). - pub fn mbedtls_pk_can_do( - ctx: *const mbedtls_pk_context, - type_: mbedtls_pk_type_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Verify signature (including padding if relevant). + /// \note This function is like \c mbedtls_ecdsa_sign() but + /// it can return early and restart according to the + /// limit set with \c mbedtls_ecp_set_max_ops() to + /// reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used. - /// This can be #MBEDTLS_MD_NONE if the signature algorithm - /// does not rely on a hash algorithm (non-deterministic - /// ECDSA, RSA PKCS#1 v1.5). - /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then - /// \p hash is the DigestInfo structure used by RFC 8017 - /// §9.2 steps 3–6. If \p md_alg is a valid hash - /// algorithm then \p hash is the digest itself, and this - /// function calculates the DigestInfo encoding internally. - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \see ecp.h /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) - /// to verify RSASSA_PSS signatures. - pub fn mbedtls_pk_verify( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_verify() + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_verify(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_verify(). + /// \note This function is like \c + /// mbedtls_ecdsa_sign_det_ext() but it can return + /// early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length - /// \param rs_ctx Restart context (NULL to disable restart) + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return See \c mbedtls_pk_verify(), or - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_verify_restartable( - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + /// \c NULL if \p f_rng_blind doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, - rs_ctx: *mut mbedtls_pk_restart_ctx, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify signature, with options. - /// (Includes verification of the padding depending on type.) - /// - /// \param type Signature type (inc. possible padding type) to verify - /// \param options Pointer to type-specific options, or NULL - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be - /// used for this type of signatures, - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note If hash_len is 0, then the length associated with md_alg - /// is used instead, or an error returned if it is invalid. + /// \see ecp.h /// - /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. /// - /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point - /// to a mbedtls_pk_rsassa_pss_options structure, - /// otherwise it must be NULL. Note that if - /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not - /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. - pub fn mbedtls_pk_verify_ext( - type_: mbedtls_pk_type_t, - options: *const ::core::ffi::c_void, - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature, including padding if relevant. - /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message, in a restartable manner /// - /// \return 0 on success, or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// There is no interface in the PK module to make RSASSA-PSS - /// signatures yet. + /// \see ecp.h /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify_restartable( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature given a signature type. + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, serialized as defined in RFC-4492: + /// Elliptic Curve Cryptography (ECC) Cipher Suites for + /// Transport Layer Security (TLS). /// - /// \param pk_type Signature type. - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \warning It is not thread-safe to use the same context in + /// multiple threads. /// - /// \return 0 on success, or a specific error code. + /// \note The deterministic version is used if + /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + /// information, see RFC-6979: Deterministic Usage + /// of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, - /// see #PSA_ALG_RSA_PSS for a description of PSS options used. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign_ext( - pk_type: mbedtls_pk_type_t, - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_sign() + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_sign(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_sign(). + /// \see \c mbedtls_ecdsa_write_signature() /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. + /// \note This function is like \c mbedtls_ecdsa_write_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// \param rs_ctx Restart context (NULL to disable restart) + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return See \c mbedtls_pk_sign(). + /// \return \c 0 on success. /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_sign_restartable( - ctx: *mut mbedtls_pk_context, + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_pk_restart_ctx, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Decrypt message (including padding if relevant). + /// \brief This function reads and verifies an ECDSA signature. /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param input Input to decrypt - /// \param ilen Input size - /// \param output Decrypted output - /// \param olen Decrypted message length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \see ecp.h /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_decrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Encrypt message (including padding if relevant). - /// - /// \param ctx The PK context to use. It must have been set up. - /// \param input Message to encrypt - /// \param ilen Message size - /// \param output Encrypted output - /// \param olen Encrypted output length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function reads and verifies an ECDSA signature, + /// in a restartable way. /// - /// \note \p f_rng is used for padding generation. + /// \see \c mbedtls_ecdsa_read_signature() /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \note This function is like \c mbedtls_ecdsa_read_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_encrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if a public-private pair of keys matches. - /// - /// \param pub Context holding a public key. - /// \param prv Context holding a private (and public) key. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// - /// \return \c 0 on success (keys were checked and match each other). - /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not - /// be checked - in that case they may or may not match. - /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. - /// \return Another non-zero value if the keys do not match. - pub fn mbedtls_pk_check_pair( - pub_: *const mbedtls_pk_context, - prv: *const mbedtls_pk_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Export debug information - /// - /// \param ctx The PK context to use. It must have been initialized. - /// \param items Place to write debug items + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA - pub fn mbedtls_pk_debug( - ctx: *const mbedtls_pk_context, - items: *mut mbedtls_pk_debug_item, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Access the type name - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type name on success, or "invalid PK" - pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; -} -unsafe extern "C" { - /// \brief Get the key type - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type on success. - /// \return #MBEDTLS_PK_NONE for a context that has not been set up. - pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a private key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// \param pwd Optional password for decryption. - /// Pass \c NULL if expecting a non-encrypted key. - /// Pass a string of \p pwdlen bytes if expecting an encrypted - /// key; a non-encrypted key will also be accepted. - /// The empty password is not supported. - /// \param pwdlen Size of the password in bytes. - /// Ignored if \p pwd is \c NULL. - /// \param f_rng RNG function, must not be \c NULL. Used for blinding. - /// \param p_rng RNG parameter + /// \brief This function generates an ECDSA keypair on the given curve. /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to store the keypair in. + /// This must be initialized. + /// \param gid The elliptic curve to use. One of the various + /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, - pwd: *const ::core::ffi::c_uchar, - pwdlen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_genkey( + ctx: *mut mbedtls_ecdsa_context, + gid: mbedtls_ecp_group_id, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a public key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \brief This function sets up an ECDSA context from an EC key pair. /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to setup. This must be initialized. + /// \param key The EC key to use. This must be initialized and hold + /// a private-public key pair or a public key. In the former + /// case, the ECDSA context may be used for signature creation + /// and verification after this call. In the latter case, it + /// may be used for signature verification. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_public_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_from_keypair( + ctx: *mut mbedtls_ecdsa_context, + key: *const mbedtls_ecp_keypair, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function initializes an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_key_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); } unsafe extern "C" { - /// \brief Write a public key to a SubjectPublicKeyInfo DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function frees an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_pubkey_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to free. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must be initialized. + pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); } -unsafe extern "C" { - /// \brief Write a public key to a PEM string - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_pubkey_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 PEM string - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_key_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Parse a SubjectPublicKeyInfo DER structure - /// - /// \param p the position in the ASN.1 data - /// \param end end of the buffer - /// \param pk The PK context to fill. It must have been initialized - /// but not set up. - /// - /// \return 0 if successful, or a specific PK error code - pub fn mbedtls_pk_parse_subpubkey( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - pk: *mut mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a subjectPublicKey to ASN.1 data - /// Note: function works backwards in data buffer - /// - /// \param p reference to current position pointer - /// \param start start of the buffer (for bounds-checking) - /// \param key PK context which must contain a valid public or private key. - /// - /// \return the length written or a negative error code - pub fn mbedtls_pk_write_pubkey( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - key: *const mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = - 3; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: - mbedtls_key_exchange_type_t = 4; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = - 8; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = - 9; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = - 10; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = - 11; -pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; -/// \brief This structure is used for storing ciphersuite information -/// -/// \note members are defined using integral types instead of enums -/// in order to pack structure and reduce memory usage by internal -/// \c ciphersuite_definitions[] -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ssl_ciphersuite_t { - pub private_id: ::core::ffi::c_int, - pub private_name: *const ::core::ffi::c_char, - pub private_cipher: u8, - pub private_mac: u8, - pub private_key_exchange: u8, - pub private_flags: u8, - pub private_min_tls_version: u16, - pub private_max_tls_version: u16, -} -impl Default for mbedtls_ssl_ciphersuite_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_string( - ciphersuite_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_id( - ciphersuite_id: ::core::ffi::c_int, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_pk_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_ec( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_psk( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> usize; -} -/// The type of the context passed to mbedtls_psa_external_get_random(). -/// -/// Mbed TLS initializes the context to all-bits-zero before calling -/// mbedtls_psa_external_get_random() for the first time. -/// -/// The definition of this type in the Mbed TLS source code is for -/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() -/// are expected to replace it with a custom definition. -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_external_random_context_t { - pub private_opaque: [usize; 2usize], +/// The type of the context passed to mbedtls_psa_external_get_random(). +/// +/// Mbed TLS initializes the context to all-bits-zero before calling +/// mbedtls_psa_external_get_random() for the first time. +/// +/// The definition of this type in the Mbed TLS source code is for +/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() +/// are expected to replace it with a custom definition. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_external_random_context_t { + pub private_opaque: [usize; 2usize], } pub type psa_status_t = i32; /// \brief Encoding of a key type. @@ -10579,6478 +10447,7672 @@ pub type psa_key_attributes_t = psa_key_attributes_s; /// Values of this type are generally constructed by macros called /// `PSA_KEY_DERIVATION_INPUT_xxx`. pub type psa_key_derivation_step_t = u16; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following field: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// +/// Functions that take such a structure as input also take an associated +/// input buffer \c custom_data of length \c custom_data_length. +/// +/// The interpretation of this structure and the associated \c custom_data +/// parameter depend on the type of the created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c custom_data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_custom_key_parameters_t = psa_custom_key_parameters_s; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following fields: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// - \c data: a flexible array of bytes. +/// +/// The interpretation of this structure depend on the type of the +/// created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty or if the custom production parameters are omitted +/// altogether, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_key_production_parameters_t = psa_key_production_parameters_s; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; +/// For encrypt-decrypt functions, whether the operation is an encryption +/// or a decryption. +pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; +/// \brief MD5 context structure +/// +/// \warning MD5 is considered a weak message digest and its use +/// constitutes a security risk. We recommend considering +/// stronger message digests instead. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md5_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 4usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_md5_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { - /// \brief Library initialization. - /// - /// Applications must call this function before calling any other - /// function in this module. - /// - /// Applications may call this function more than once. Once a call - /// succeeds, subsequent calls are guaranteed to succeed. + /// \brief Initialize MD5 context /// - /// If the application calls other functions before calling psa_crypto_init(), - /// the behavior is undefined. Implementations are encouraged to either perform - /// the operation as if the library had been initialized or to return - /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, - /// implementations should not return a success status if the lack of - /// initialization may have security implications, for example due to improper - /// seeding of the random number generator. + /// \param ctx MD5 context to be initialized /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - pub fn psa_crypto_init() -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Retrieve the attributes of a key. - /// - /// This function first resets the attribute structure as with - /// psa_reset_key_attributes(). It then copies the attributes of - /// the given key into the given attribute structure. - /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \brief Clear MD5 context /// - /// \param[in] key Identifier of the key to query. - /// \param[in,out] attributes On success, the attributes of the key. - /// On failure, equivalent to a - /// freshly-initialized structure. + /// \param ctx MD5 context to be cleared /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_get_key_attributes( - key: mbedtls_svc_key_id_t, - attributes: *mut psa_key_attributes_t, - ) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Reset a key attribute structure to a freshly initialized state. - /// - /// You must initialize the attribute structure as described in the - /// documentation of the type #psa_key_attributes_t before calling this - /// function. Once the structure has been initialized, you may call this - /// function at any time. + /// \brief Clone (the state of) an MD5 context /// - /// This function frees any auxiliary resources that the structure - /// may contain. + /// \param dst The destination context + /// \param src The context to be cloned /// - /// \param[in,out] attributes The attribute structure to reset. - pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); } unsafe extern "C" { - /// Remove non-essential copies of key material from memory. + /// \brief MD5 context setup /// - /// If the key identifier designates a volatile key, this functions does not do - /// anything and returns successfully. - /// - /// If the key identifier designates a persistent key, then this function will - /// free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and the key can still be used. + /// \param ctx context to be initialized /// - /// \param key Identifier of the key to purge. + /// \return 0 if successful /// - /// \retval #PSA_SUCCESS - /// The key material will have been removed from memory if it is not - /// currently required. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid key identifier. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Make a copy of a key. + /// \brief MD5 process buffer /// - /// Copy key material from one location to another. + /// \param ctx MD5 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// This function is primarily useful to copy a key from one location - /// to another, since it populates a key using the material from - /// another key which may have a different lifetime. + /// \return 0 if successful /// - /// This function may be used to share a key with a different party, - /// subject to implementation-defined restrictions on key sharing. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_update( + ctx: *mut mbedtls_md5_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 final digest /// - /// The policy on the source key must have the usage flag - /// #PSA_KEY_USAGE_COPY set. - /// This flag is sufficient to permit the copy if the key has the lifetime - /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. - /// Some secure elements do not provide a way to copy a key without - /// making it extractable from the secure element. If a key is located - /// in such a secure element, then the key must have both usage flags - /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make - /// a copy of the key outside the secure element. + /// \param ctx MD5 context + /// \param output MD5 checksum result /// - /// The resulting key may only be used in a way that conforms to - /// both the policy of the original key and the policy specified in - /// the \p attributes parameter: - /// - The usage flags on the resulting key are the bitwise-and of the - /// usage flags on the source policy and the usage flags in \p attributes. - /// - If both allow the same algorithm or wildcard-based - /// algorithm policy, the resulting key has the same algorithm policy. - /// - If either of the policies allows an algorithm and the other policy - /// allows a wildcard-based algorithm policy that includes this algorithm, - /// the resulting key allows the same algorithm. - /// - If the policies do not allow any algorithm in common, this function - /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// \return 0 if successful /// - /// The effect of this function on implementation-defined attributes is - /// implementation-defined. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_finish( + ctx: *mut mbedtls_md5_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 process data block (internal use only) /// - /// \param source_key The key to copy. It must allow the usage - /// #PSA_KEY_USAGE_COPY. If a private or secret key is - /// being copied outside of a secure element it must - /// also allow #PSA_KEY_USAGE_EXPORT. - /// \param[in] attributes The attributes for the new key. - /// They are used as follows: - /// - The key type and size may be 0. If either is - /// nonzero, it must match the corresponding - /// attribute of the source key. - /// - The key location (the lifetime and, for - /// persistent keys, the key identifier) is - /// used directly. - /// - The policy constraints (usage flags and - /// algorithm policy) are combined from - /// the source key and \p attributes so that - /// both sets of restrictions apply, as - /// described in the documentation of this function. - /// \param[out] target_key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param ctx MD5 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p source_key is invalid. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The lifetime or identifier in \p attributes are invalid, or - /// the policy constraints on the source and specified in - /// \p attributes are incompatible, or - /// \p attributes specifies a key type or key size - /// which does not match the attributes of the source key. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or - /// the source key is not exportable and its lifetime does not - /// allow copying it to the target's lifetime. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_copy_key( - source_key: mbedtls_svc_key_id_t, - attributes: *const psa_key_attributes_t, - target_key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + /// + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_internal_md5_process( + ctx: *mut mbedtls_md5_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Destroy a key. + /// \brief Output = MD5( input buffer ) /// - /// This function destroys a key from both volatile - /// memory and, if applicable, non-volatile storage. Implementations shall - /// make a best effort to ensure that the key material cannot be recovered. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output MD5 checksum result /// - /// This function also erases any metadata such as policies and frees - /// resources associated with the key. + /// \return 0 if successful /// - /// If a key is currently in use in a multipart operation, then destroying the - /// key will cause the multipart operation to fail. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \param key Identifier of the key to erase. If this is \c 0, do nothing and - /// return #PSA_SUCCESS. + /// \return 0 if successful, or 1 if the test failed /// - /// \retval #PSA_SUCCESS - /// \p key was a valid identifier and the key material that it - /// referred to has been erased. Alternatively, \p key is \c 0. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key cannot be erased because it is - /// read-only, either due to a policy or due to physical restrictions. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p key is not a valid identifier nor \c 0. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE - /// There was a failure in communication with the cryptoprocessor. - /// The key material may still be present in the cryptoprocessor. - /// \retval #PSA_ERROR_DATA_INVALID - /// This error is typically a result of either storage corruption on a - /// cleartext storage backend, or an attempt to read data that was - /// written by an incompatible version of the library. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The storage is corrupted. Implementations shall make a best effort - /// to erase key material even in this stage, however applications - /// should be aware that it may be impossible to guarantee that the - /// key material is not recoverable in such cases. - /// \retval #PSA_ERROR_CORRUPTION_DETECTED - /// An unexpected condition which is not a storage corruption or - /// a communication failure occurred. The cryptoprocessor may have - /// been compromised. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief RIPEMD-160 context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ripemd160_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 5usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_ripemd160_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief Import a key in binary format. + /// \brief Initialize RIPEMD-160 context /// - /// This function supports any output from psa_export_key(). Refer to the - /// documentation of psa_export_public_key() for the format of public keys - /// and to the documentation of psa_export_key() for the format for - /// other key types. + /// \param ctx RIPEMD-160 context to be initialized + pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clear RIPEMD-160 context /// - /// The key data determines the key size. The attributes may optionally - /// specify a key size; in this case it must match the size determined - /// from the key data. A key size of 0 in \p attributes indicates that - /// the key size is solely determined by the key data. + /// \param ctx RIPEMD-160 context to be cleared + pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clone (the state of) a RIPEMD-160 context /// - /// Implementations must reject an attempt to import a key of size 0. + /// \param dst The destination context + /// \param src The context to be cloned + pub fn mbedtls_ripemd160_clone( + dst: *mut mbedtls_ripemd160_context, + src: *const mbedtls_ripemd160_context, + ); +} +unsafe extern "C" { + /// \brief RIPEMD-160 context setup /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. - /// - /// \param[in] attributes The attributes for the new key. - /// The key size is always determined from the - /// \p data buffer. - /// If the key size in \p attributes is nonzero, - /// it must be equal to the size from \p data. - /// \param[out] key On success, an identifier to the newly created key. - /// For persistent keys, this is the key identifier - /// defined in \p attributes. - /// \c 0 on failure. - /// \param[in] data Buffer containing the key data. The content of this - /// buffer is interpreted according to the type declared - /// in \p attributes. - /// All implementations must support at least the format - /// described in the documentation - /// of psa_export_key() or psa_export_public_key() for - /// the chosen type. Implementations may allow other - /// formats, but should be conservative: implementations - /// should err on the side of rejecting content if it - /// may be erroneous (e.g. wrong type or truncated data). - /// \param data_length Size of the \p data buffer in bytes. + /// \param ctx context to be initialized /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular persistent location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key attributes, as a whole, are invalid, or - /// the key data is not correctly formatted, or - /// the size in \p attributes is nonzero and does not match the size - /// of the key data. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_import_key( - attributes: *const psa_key_attributes_t, - data: *const u8, - data_length: usize, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a key in binary format. - /// - /// The output of this function can be passed to psa_import_key() to - /// create an equivalent object. + /// \brief RIPEMD-160 process buffer /// - /// If the implementation of psa_import_key() supports other formats - /// beyond the format specified here, the output from psa_export_key() - /// must use the representation specified here, not the original - /// representation. + /// \param ctx RIPEMD-160 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// For standard key types, the output format is as follows: + /// \return 0 if successful + pub fn mbedtls_ripemd160_update( + ctx: *mut mbedtls_ripemd160_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 final digest /// - /// - For symmetric keys (including MAC keys), the format is the - /// raw bytes of the key. - /// - For DES, the key data consists of 8 bytes. The parity bits must be - /// correct. - /// - For Triple-DES, the format is the concatenation of the - /// two or three DES keys. - /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format - /// is the non-encrypted DER encoding of the representation defined by - /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. - /// ``` - /// RSAPrivateKey ::= SEQUENCE { - /// version INTEGER, -- must be 0 - /// modulus INTEGER, -- n - /// publicExponent INTEGER, -- e - /// privateExponent INTEGER, -- d - /// prime1 INTEGER, -- p - /// prime2 INTEGER, -- q - /// exponent1 INTEGER, -- d mod (p-1) - /// exponent2 INTEGER, -- d mod (q-1) - /// coefficient INTEGER, -- (inverse of q) mod p - /// } - /// ``` - /// - For elliptic curve key pairs (key types for which - /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is - /// a representation of the private value as a `ceiling(m/8)`-byte string - /// where `m` is the bit size associated with the curve, i.e. the bit size - /// of the order of the curve's coordinate field. This byte string is - /// in little-endian order for Montgomery curves (curve types - /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass - /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` - /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). - /// For Weierstrass curves, this is the content of the `privateKey` field of - /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, - /// the format is defined by RFC 7748, and output is masked according to §5. - /// For twisted Edwards curves, the private key is as defined by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For Diffie-Hellman key exchange key pairs (key types for which - /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the - /// format is the representation of the private key `x` as a big-endian byte - /// string. The length of the byte string is the private key size in bytes - /// (leading zeroes are not stripped). - /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is - /// true), the format is the same as for psa_export_public_key(). + /// \param ctx RIPEMD-160 context + /// \param output RIPEMD-160 checksum result /// - /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// \return 0 if successful + pub fn mbedtls_ripemd160_finish( + ctx: *mut mbedtls_ripemd160_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 process data block (internal use only) /// - /// \param key Identifier of the key to export. It must allow the - /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public - /// key. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. + /// \param ctx RIPEMD-160 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_internal_ripemd160_process( + ctx: *mut mbedtls_ripemd160_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a public key or the public part of a key pair in binary format. + /// \brief Output = RIPEMD-160( input buffer ) /// - /// The output of this function can be passed to psa_import_key() to - /// create an object that is equivalent to the public key. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output RIPEMD-160 checksum result /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. + /// \return 0 if successful + pub fn mbedtls_ripemd160( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// For standard key types, the output format is as follows: - /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of - /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. - /// ``` - /// RSAPublicKey ::= SEQUENCE { - /// modulus INTEGER, -- n - /// publicExponent INTEGER } -- e - /// ``` - /// - For elliptic curve keys on a twisted Edwards curve (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY - /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined - /// by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For other elliptic curve public keys (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed - /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. - /// Let `m` be the bit size associated with the curve, i.e. the bit size of - /// `q` for a curve over `F_q`. The representation consists of: - /// - The byte 0x04; - /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; - /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. - /// - For Diffie-Hellman key exchange public keys (key types for which - /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), - /// the format is the representation of the public key `y = g^x mod p` as a - /// big-endian byte string. The length of the byte string is the length of the - /// base prime `p` in bytes. + /// \return 0 if successful, or 1 if the test failed + pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha1_context { + pub work_area: [::core::ffi::c_uchar; 208usize], +} +impl Default for mbedtls_sha1_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-1 context. /// - /// Exporting a public key object or the public part of a key pair is - /// always permitted, regardless of the key's usage flags. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param key Identifier of the key to export. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key is neither a public key nor a key pair. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_public_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message. - /// - /// \note To verify the hash of a message against an - /// expected value, use psa_hash_compare() instead. + /// \brief This function clears a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\p alg). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p hash_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compute( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it is + /// not \c NULL, it must point to an initialized + /// SHA-1 context. + pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message and compare it with a - /// reference value. + /// \brief This function clones the state of a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p input_length or \p hash_length do not match the hash size for \p alg - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compare( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \param dst The SHA-1 context to clone to. This must be initialized. + /// \param src The SHA-1 context to clone from. This must be initialized. + pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); } -/// The type of the state data structure for multipart hash operations. -/// -/// Before calling any function on a hash operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_hash_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_hash_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, -/// for example: -/// \code -/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_hash_operation_init() -/// to the structure, for example: -/// \code -/// psa_hash_operation_t operation; -/// operation = psa_hash_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_hash_operation_t = psa_hash_operation_s; unsafe extern "C" { - /// Set up a multipart hash operation. - /// - /// The sequence of operations to calculate a hash (message digest) - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. - /// -# Call psa_hash_setup() to specify the algorithm. - /// -# Call psa_hash_update() zero, one or more times, passing a fragment - /// of the message each time. The hash that is calculated is the hash - /// of the concatenation of these messages in order. - /// -# To calculate the hash, call psa_hash_finish(). - /// To compare the hash with an expected value, call psa_hash_verify(). - /// - /// If an error occurs at any step after a call to psa_hash_setup(), the - /// operation will need to be reset by a call to psa_hash_abort(). The - /// application may call psa_hash_abort() at any time after the operation - /// has been initialized. + /// \brief This function starts a SHA-1 checksum calculation. /// - /// After a successful call to psa_hash_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_hash_finish() or psa_hash_verify(). - /// - A call to psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_hash_operation_t and not yet in use. - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param ctx The SHA-1 context to initialize. This must be initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a hash algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_setup( - operation: *mut psa_hash_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart hash operation. - /// - /// The application must call psa_hash_setup() before calling this function. + /// \brief This function feeds an input buffer into an ongoing SHA-1 + /// checksum calculation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] input Buffer containing the message fragment to hash. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-1 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_update( - operation: *mut psa_hash_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_update( + ctx: *mut mbedtls_sha1_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message. + /// \brief This function finishes the SHA-1 operation, and writes + /// the result to the output buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \param ctx The SHA-1 context to use. This must be initialized and + /// have a hash operation started. + /// \param output The SHA-1 checksum result. This must be a writable + /// buffer of length \c 20 Bytes. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the hash. Call psa_hash_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// hash values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the hashed data which could allow an attacker to guess - /// a valid hash and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_finish( + ctx: *mut mbedtls_sha1_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief SHA-1 process data block (internal use only). /// - /// \param[in,out] operation Active hash operation. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\c alg) where \c alg is the - /// hash algorithm that is calculated. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p hash buffer is too small. You can determine a - /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) - /// where \c alg is the hash algorithm that is calculated. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_finish( - operation: *mut psa_hash_operation_t, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to use. This must be initialized. + /// \param data The data block being processed. This must be a + /// readable buffer of length \c 64 Bytes. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha1_process( + ctx: *mut mbedtls_sha1_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-1 checksum of a buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). It then - /// compares the calculated hash with the expected hash passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// The SHA-1 result is calculated as + /// output = SHA-1(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual hash and the expected hash is performed - /// in constant time. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. + /// \param output The SHA-1 checksum result. + /// This must be a writable buffer of length \c 20 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_verify( - operation: *mut psa_hash_operation_t, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a hash operation. + /// \brief The SHA-1 checkup routine. /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_hash_setup() again. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_hash_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha256_context { + pub work_area: [::core::ffi::c_uchar; 208usize], + pub is224: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha256_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-256 context. /// - /// In particular, calling psa_hash_abort() after the operation has been - /// terminated by a call to psa_hash_abort(), psa_hash_finish() or - /// psa_hash_verify() is safe and has no effect. + /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-256 context. /// - /// \param[in,out] operation Initialized hash operation. + /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-256 context. + pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-256 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha256_clone( + dst: *mut mbedtls_sha256_context, + src: *const mbedtls_sha256_context, + ); } unsafe extern "C" { - /// Clone a hash operation. + /// \brief This function starts a SHA-224 or SHA-256 checksum + /// calculation. /// - /// This function copies the state of an ongoing hash operation to - /// a new operation object. In other words, this function is equivalent - /// to calling psa_hash_setup() on \p target_operation with the same - /// algorithm that \p source_operation was set up for, then - /// psa_hash_update() on \p target_operation with the same input that - /// that was passed to \p source_operation. After this function returns, the - /// two objects are independent, i.e. subsequent calls involving one of - /// the objects do not affect the other object. + /// \param ctx The context to use. This must be initialized. + /// \param is224 This determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// \param[in] source_operation The active hash operation to clone. - /// \param[in,out] target_operation The operation object to set up. - /// It must be initialized but not active. + /// \note is224 must be defined accordingly to the enabled + /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The \p source_operation state is not valid (it must be active), or - /// the \p target_operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_clone( - source_operation: *const psa_hash_operation_t, - target_operation: *mut psa_hash_operation_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_starts( + ctx: *mut mbedtls_sha256_context, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC (message authentication code) of a message. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-256 checksum calculation. /// - /// \note To verify the MAC of a message against an - /// expected value, use psa_mac_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_update( + ctx: *mut mbedtls_sha256_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function finishes the SHA-256 operation, and writes + /// the result to the output buffer. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p mac_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_compute( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_finish( + ctx: *mut mbedtls_sha256_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC of a message and compare it with a reference value. + /// \brief This function processes a single data block within + /// the ongoing SHA-256 computation. This function is for + /// internal use only. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \param ctx The SHA-256 context. This must be initialized. + /// \param data The buffer holding one block of data. This must + /// be a readable buffer of length \c 64 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected value. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha256_process( + ctx: *mut mbedtls_sha256_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart MAC operations. -/// -/// Before calling any function on a MAC operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_mac_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_mac_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, -/// for example: -/// \code -/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_mac_operation_init() -/// to the structure, for example: -/// \code -/// psa_mac_operation_t operation; -/// operation = psa_mac_operation_init(); -/// \endcode -/// -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Set up a multipart MAC calculation operation. + /// \brief This function calculates the SHA-224 or SHA-256 + /// checksum of a buffer. /// - /// This function sets up the calculation of the MAC - /// (message authentication code) of a byte string. - /// To verify the MAC of a message against an - /// expected value, use psa_mac_verify_setup() instead. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// The sequence of operations to calculate a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_sign_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_sign_finish() to finish - /// calculating the MAC value and retrieve it. + /// The SHA-256 result is calculated as + /// output = SHA-256(input buffer). /// - /// If an error occurs at any step after a call to psa_mac_sign_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// \param is224 Determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// After a successful call to psa_mac_sign_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_sign_finish(). - /// - A call to psa_mac_abort(). + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-224 checkup routine. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-256 checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha512_context { + pub work_area: [::core::ffi::c_uchar; 304usize], + pub is384: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha512_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Set up a multipart MAC verification operation. + /// \brief This function initializes a SHA-512 context. /// - /// This function sets up the verification of the MAC - /// (message authentication code) of a byte string against an expected value. + /// \param ctx The SHA-512 context to initialize. This must + /// not be \c NULL. + pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-512 context. /// - /// The sequence of operations to verify a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_verify_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_verify_finish() to finish - /// calculating the actual MAC of the message and verify it against - /// the expected value. + /// \param ctx The SHA-512 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must point to an initialized + /// SHA-512 context. + pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-512 context. /// - /// If an error occurs at any step after a call to psa_mac_verify_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha512_clone( + dst: *mut mbedtls_sha512_context, + src: *const mbedtls_sha512_context, + ); +} +unsafe extern "C" { + /// \brief This function starts a SHA-384 or SHA-512 checksum + /// calculation. /// - /// After a successful call to psa_mac_verify_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_verify_finish(). - /// - A call to psa_mac_abort(). + /// \param ctx The SHA-512 context to use. This must be initialized. + /// \param is384 Determines which function to use. This must be + /// either \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage - /// PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \note is384 must be defined accordingly to the enabled + /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c key is not compatible with \c alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_starts( + ctx: *mut mbedtls_sha512_context, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart MAC operation. - /// - /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() - /// before calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \brief This function feeds an input buffer into an ongoing + /// SHA-512 checksum calculation. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] input Buffer containing the message fragment to add to - /// the MAC calculation. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. This must + /// be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_update( - operation: *mut psa_mac_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_update( + ctx: *mut mbedtls_sha512_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message. - /// - /// The application must call psa_mac_sign_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). + /// \brief This function finishes the SHA-512 operation, and writes + /// the result to the output buffer. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the MAC. Call psa_mac_verify_finish() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_finish( + ctx: *mut mbedtls_sha512_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function processes a single data block within + /// the ongoing SHA-512 computation. + /// This function is for internal use only. /// - /// \param[in,out] operation Active MAC operation. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. This is always - /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of the key and \c alg is the - /// MAC algorithm that is calculated. + /// \param ctx The SHA-512 context. This must be initialized. + /// \param data The buffer holding one block of data. This + /// must be a readable buffer of length \c 128 Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p mac buffer is too small. You can determine a - /// sufficient buffer size by calling PSA_MAC_LENGTH(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac sign - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_finish( - operation: *mut psa_mac_operation_t, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha512_process( + ctx: *mut mbedtls_sha512_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-512 or SHA-384 + /// checksum of a buffer. /// - /// The application must call psa_mac_verify_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). It then - /// compares the calculated MAC with the expected MAC passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// The SHA-512 result is calculated as + /// output = SHA-512(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual MAC and the expected MAC is performed - /// in constant time. + /// \param input The buffer holding the input data. This must be + /// a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. + /// \param is384 Determines which function to use. This must be either + /// \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \note is384 must be defined accordingly with the supported + /// symbols in the config file. If: + /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + /// then the function will return + /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected MAC. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac verify - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_finish( - operation: *mut psa_mac_operation_t, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a MAC operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_mac_sign_setup() or psa_mac_verify_setup() again. + /// \brief The SHA-384 checkup routine. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_mac_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-512 checkup routine. /// - /// In particular, calling psa_mac_abort() after the operation has been - /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or - /// psa_mac_verify_finish() is safe and has no effect. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +///< Operation not defined. +pub const mbedtls_sha3_id_MBEDTLS_SHA3_NONE: mbedtls_sha3_id = 0; +///< SHA3-224 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_224: mbedtls_sha3_id = 1; +///< SHA3-256 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_256: mbedtls_sha3_id = 2; +///< SHA3-384 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_384: mbedtls_sha3_id = 3; +///< SHA3-512 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_512: mbedtls_sha3_id = 4; +/// SHA-3 family id. +/// +/// It identifies the family (SHA3-256, SHA3-512, etc.) +pub type mbedtls_sha3_id = ::core::ffi::c_uint; +/// \brief The SHA-3 context structure. +/// +/// The structure is used SHA-3 checksum calculations. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_sha3_context { + pub private_state: [u64; 25usize], + pub private_index: u32, + pub private_olen: u16, + pub private_max_block_size: u16, +} +unsafe extern "C" { + /// \brief This function initializes a SHA-3 context. /// - /// \param[in,out] operation Initialized MAC operation. + /// \param ctx The SHA-3 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha3_init(ctx: *mut mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-3 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; + /// \param ctx The SHA-3 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-3 context. + pub fn mbedtls_sha3_free(ctx: *mut mbedtls_sha3_context); } unsafe extern "C" { - /// Encrypt a message using a symmetric cipher. + /// \brief This function clones the state of a SHA-3 context. /// - /// This function encrypts a message with a random IV (initialization - /// vector). Use the multipart operation interface with a - /// #psa_cipher_operation_t object to provide other forms of IV. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha3_clone(dst: *mut mbedtls_sha3_context, src: *const mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function starts a SHA-3 checksum + /// calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// The output contains the IV followed by - /// the ciphertext proper. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The context to use. This must be initialized. + /// \param id The id of the SHA-3 family. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_starts( + ctx: *mut mbedtls_sha3_context, + id: mbedtls_sha3_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Decrypt a message using a symmetric cipher. - /// - /// This function decrypts a message encrypted with a symmetric cipher. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-3 checksum calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to decrypt. - /// This consists of the IV followed by the - /// ciphertext proper. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the plaintext is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_update( + ctx: *mut mbedtls_sha3_context, input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + ilen: usize, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart cipher operations. -/// -/// Before calling any function on a cipher operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_cipher_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_cipher_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, -/// for example: -/// \code -/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_cipher_operation_init() -/// to the structure, for example: -/// \code -/// psa_cipher_operation_t operation; -/// operation = psa_cipher_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// Set the key for a multipart symmetric encryption operation. + /// \brief This function finishes the SHA-3 operation, and writes + /// the result to the output buffer. /// - /// The sequence of operations to encrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. - /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to - /// generate or set the IV (initialization vector). You should use - /// psa_cipher_generate_iv() unless the protocol you are implementing - /// requires a specific IV value. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. /// - /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_finish( + ctx: *mut mbedtls_sha3_context, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function calculates the SHA-3 + /// checksum of a buffer. /// - /// After a successful call to psa_cipher_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// The SHA-3 result is calculated as + /// output = SHA-3(id, input buffer, d). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \param id The id of the SHA-3 family. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3( + id: mbedtls_sha3_id, + input: *const u8, + ilen: usize, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart symmetric decryption operation. + /// \brief Checkup routine for the algorithms implemented + /// by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. /// - /// The sequence of operations to decrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. - /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the - /// decryption. If the IV is prepended to the ciphertext, you can call - /// psa_cipher_update() on a buffer containing the IV followed by the - /// beginning of the message. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). - /// - /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_cipher_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). - /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if the test failed. + pub fn mbedtls_sha3_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// Generate an IV for a symmetric encryption operation. - /// - /// This function generates a random IV (initialization vector), nonce - /// or initial counter value for the encryption operation as appropriate - /// for the chosen algorithm, key type and key size. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] iv Buffer where the generated IV is to be written. - /// \param iv_size Size of the \p iv buffer in bytes. - /// \param[out] iv_length On success, the number of bytes of the - /// generated IV. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p iv buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no IV set), - /// or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_generate_iv( - operation: *mut psa_cipher_operation_t, - iv: *mut u8, - iv_size: usize, - iv_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hash_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// Set the IV for a symmetric encryption or decryption operation. - /// - /// This function sets the IV (initialization vector), nonce - /// or initial counter value for the encryption or decryption operation. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \note When encrypting, applications should use psa_cipher_generate_iv() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] iv Buffer containing the IV to use. - /// \param iv_length Size of the IV in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p iv is not acceptable for the chosen algorithm, - /// or the chosen algorithm does not use an IV. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active cipher - /// encrypt operation, with no IV set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_set_iv( - operation: *mut psa_cipher_operation_t, - iv: *const u8, - iv_length: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub md5: mbedtls_md5_context, + pub ripemd160: mbedtls_ripemd160_context, + pub sha1: mbedtls_sha1_context, + pub sha256: mbedtls_sha256_context, + pub sha512: mbedtls_sha512_context, } -unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active cipher operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() - /// (recommended when encrypting) or psa_cipher_set_iv(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_update( - operation: *mut psa_cipher_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Finish encrypting or decrypting a message in a cipher operation. - /// - /// The application must call psa_cipher_encrypt_setup() or - /// psa_cipher_decrypt_setup() before calling this function. The choice - /// of setup function determines whether this function encrypts or - /// decrypts its input. - /// - /// This function finishes the encryption or decryption of the message - /// formed by concatenating the inputs passed to preceding calls to - /// psa_cipher_update(). - /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input size passed to this operation is not valid for - /// this particular algorithm. For example, the algorithm is a based - /// on block cipher and requires a whole number of blocks, but the - /// total input size is not a multiple of the block size. - /// \retval #PSA_ERROR_INVALID_PADDING - /// This is a decryption operation for an algorithm that includes - /// padding, and the ciphertext does not contain valid padding. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_finish( - operation: *mut psa_cipher_operation_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_cipher_operation_t { + pub private_alg: psa_algorithm_t, + pub private_iv_length: u8, + pub private_block_length: u8, + pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_cipher: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_cipher_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_hash_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_hash_operation_t, +} +impl Default for psa_driver_hash_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_cipher_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, +} +impl Default for psa_driver_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hash_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h. + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. the driver context is not active, in use). + pub private_id: ::core::ffi::c_uint, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_hash_context_t, +} +impl Default for psa_hash_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_cipher_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_default_iv_length: u8, + pub private_ctx: psa_driver_cipher_context_t, +} +impl Default for psa_cipher_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_cipher_operation_s { + #[inline] + pub fn private_iv_required(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_iv_required: ::core::ffi::c_uint, + private_iv_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; + private_iv_required as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; + private_iv_set as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The GCM context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_gcm_context { + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, + ///< Precalculated HTable. + pub private_H: [[u64; 2usize]; 16usize], + ///< The total length of the encrypted data. + pub private_len: u64, + ///< The total length of the additional data. + pub private_add_len: u64, + ///< The first ECTR for tag. + pub private_base_ectr: [::core::ffi::c_uchar; 16usize], + ///< The Y working value. + pub private_y: [::core::ffi::c_uchar; 16usize], + ///< The buf working value. + pub private_buf: [::core::ffi::c_uchar; 16usize], + ///< The operation to perform: + ///#MBEDTLS_GCM_ENCRYPT or + ///#MBEDTLS_GCM_DECRYPT. + pub private_mode: ::core::ffi::c_uchar, + ///< The acceleration to use. + pub private_acceleration: ::core::ffi::c_uchar, +} +impl Default for mbedtls_gcm_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Abort a cipher operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. - /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_cipher_operation_t. - /// - /// In particular, calling psa_cipher_abort() after the operation has been - /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() - /// is safe and has no effect. + /// \brief This function initializes the specified GCM context, + /// to make references valid, and prepares the context + /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). /// - /// \param[in,out] operation Initialized cipher operation. + /// The function does not bind the GCM context to a particular + /// cipher, nor set the key. For this purpose, use + /// mbedtls_gcm_setkey(). /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; + /// \param ctx The GCM context to initialize. This must not be \c NULL. + pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Process an authenticated encryption operation. + /// \brief This function associates a GCM context with a + /// cipher algorithm and a key. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that will be authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] plaintext Data that will be authenticated and - /// encrypted. - /// \param plaintext_length Size of \p plaintext in bytes. - /// \param[out] ciphertext Output buffer for the authenticated and - /// encrypted data. The additional data is not - /// part of this output. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate outputs, the - /// authentication tag is appended to the - /// encrypted data. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p plaintext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p - /// plaintext_length) evaluates to the maximum - /// ciphertext size of any supported AEAD - /// encryption. - /// \param[out] ciphertext_length On success, the size of the output - /// in the \p ciphertext buffer. + /// \param ctx The GCM context. This must be initialized. + /// \param cipher The 128-bit block cipher to use. + /// \param key The encryption key. This must be a readable buffer of at + /// least \p keybits bits. + /// \param keybits The key size in bits. Valid options are: + ///
          • 128 bits
            • + ///
          • 192 bits
            • + ///
          • 256 bits
          /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p ciphertext_size is too small. - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p plaintext_length) or - /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - plaintext: *const u8, - plaintext_length: usize, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_gcm_setkey( + ctx: *mut mbedtls_gcm_context, + cipher: mbedtls_cipher_id_t, + key: *const ::core::ffi::c_uchar, + keybits: ::core::ffi::c_uint, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Process an authenticated decryption operation. + /// \brief This function performs GCM encryption or decryption of a buffer. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that has been authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] ciphertext Data that has been authenticated and - /// encrypted. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate inputs, the buffer - /// must contain the encrypted data followed - /// by the authentication tag. - /// \param ciphertext_length Size of \p ciphertext in bytes. - /// \param[out] plaintext Output buffer for the decrypted data. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p ciphertext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p - /// ciphertext_length) evaluates to the maximum - /// plaintext size of any supported AEAD - /// decryption. - /// \param[out] plaintext_length On success, the size of the output - /// in the \p plaintext buffer. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The ciphertext is not authentic. - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p plaintext_size is too small. - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p ciphertext_length) or - /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used - /// to determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - ciphertext: *const u8, - ciphertext_length: usize, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - ) -> psa_status_t; + /// \warning When this function performs a decryption, it outputs the + /// authentication tag and does not verify that the data is + /// authentic. You should use this function to perform encryption + /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// + /// \param ctx The GCM context to use for encryption or decryption. This + /// must be initialized. + /// \param mode The operation to perform: + /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + /// The ciphertext is written to \p output and the + /// authentication tag is written to \p tag. + /// - #MBEDTLS_GCM_DECRYPT to perform decryption. + /// The plaintext is written to \p output and the + /// authentication tag is written to \p tag. + /// Note that this mode is not recommended, because it does + /// not verify the authenticity of the data. For this reason, + /// you should use mbedtls_gcm_auth_decrypt() instead of + /// calling this function in decryption mode. + /// \param length The length of the input data, which is equal to the length + /// of the output data. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param input The buffer holding the input data. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size in Bytes. + /// \param output The buffer for holding the output data. If \p length is greater + /// than zero, this must be a writable buffer of at least that + /// size in Bytes. + /// \param tag_len The length of the tag to generate. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// + /// \return \c 0 if the encryption or decryption was performed + /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + /// this does not indicate that the data is authentic. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the encryption + /// or decryption failed. + pub fn mbedtls_gcm_crypt_and_tag( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + tag_len: usize, + tag: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart AEAD operations. -/// -/// Before calling any function on an AEAD operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_aead_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_aead_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, -/// for example: -/// \code -/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_aead_operation_init() -/// to the structure, for example: -/// \code -/// psa_aead_operation_t operation; -/// operation = psa_aead_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// Set the key for a multipart authenticated encryption operation. + /// \brief This function performs a GCM authenticated decryption of a + /// buffer. /// - /// The sequence of operations to encrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to - /// generate or set the nonce. You should use - /// psa_aead_generate_nonce() unless the protocol you are implementing - /// requires a specific nonce value. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the message to encrypt each time. - /// -# Call psa_aead_finish(). - /// - /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_finish(). - /// - A call to psa_aead_abort(). + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param length The length of the ciphertext to decrypt, which is also + /// the length of the decrypted plaintext. + /// \param iv The initialization vector. This must be a readable buffer + /// of at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param tag The buffer holding the tag to verify. This must be a + /// readable buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to verify. + /// \param input The buffer holding the ciphertext. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size. + /// \param output The buffer for holding the decrypted plaintext. If \p length + /// is greater than zero, this must be a writable buffer of at + /// least that size. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 if successful and authenticated. + /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the decryption + /// failed. + pub fn mbedtls_gcm_auth_decrypt( + ctx: *mut mbedtls_gcm_context, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + tag: *const ::core::ffi::c_uchar, + tag_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart authenticated decryption operation. - /// - /// The sequence of operations to decrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call psa_aead_set_nonce() with the nonce for the decryption. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the ciphertext to decrypt each time. - /// -# Call psa_aead_verify(). - /// - /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_verify(). - /// - A call to psa_aead_abort(). + /// \brief This function starts a GCM encryption or decryption + /// operation. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + /// #MBEDTLS_GCM_DECRYPT. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_starts( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Generate a random nonce for an authenticated encryption operation. - /// - /// This function generates a random nonce for the authenticated encryption - /// operation with an appropriate size for the chosen algorithm, key type - /// and key size. - /// - /// The application must call psa_aead_encrypt_setup() before - /// calling this function. + /// \brief This function feeds an input buffer as associated data + /// (authenticated but not encrypted data) in a GCM + /// encryption or decryption operation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// Call this function after mbedtls_gcm_starts() to pass + /// the associated data. If the associated data is empty, + /// you do not need to call this function. You may not + /// call this function after calling mbedtls_cipher_update(). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] nonce Buffer where the generated nonce is to be - /// written. - /// \param nonce_size Size of the \p nonce buffer in bytes. - /// \param[out] nonce_length On success, the number of bytes of the - /// generated nonce. + /// \param ctx The GCM context. This must have been started with + /// mbedtls_gcm_starts() and must not have yet received + /// any input with mbedtls_gcm_update(). + /// \param add The buffer holding the additional data, or \c NULL + /// if \p add_len is \c 0. + /// \param add_len The length of the additional data. If \c 0, + /// \p add may be \c NULL. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p nonce buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active aead encrypt - /// operation, with no nonce set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_generate_nonce( - operation: *mut psa_aead_operation_t, - nonce: *mut u8, - nonce_size: usize, - nonce_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_update_ad( + ctx: *mut mbedtls_gcm_context, + add: *const ::core::ffi::c_uchar, + add_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the nonce for an authenticated encryption or decryption operation. + /// \brief This function feeds an input buffer into an ongoing GCM + /// encryption or decryption operation. /// - /// This function sets the nonce for the authenticated - /// encryption or decryption operation. + /// You may call this function zero, one or more times + /// to pass successive parts of the input: the plaintext to + /// encrypt, or the ciphertext (not including the tag) to + /// decrypt. After the last part of the input, call + /// mbedtls_gcm_finish(). /// - /// The application must call psa_aead_encrypt_setup() or - /// psa_aead_decrypt_setup() before calling this function. + /// This function may produce output in one of the following + /// ways: + /// - Immediate output: the output length is always equal + /// to the input length. + /// - Buffered output: the output consists of a whole number + /// of 16-byte blocks. If the total input length so far + /// (not including associated data) is 16 \* *B* + *A* + /// with *A* < 16 then the total output length is 16 \* *B*. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// In particular: + /// - It is always correct to call this function with + /// \p output_size >= \p input_length + 15. + /// - If \p input_length is a multiple of 16 for all the calls + /// to this function during an operation, then it is + /// correct to use \p output_size = \p input_length. /// - /// \note When encrypting, applications should use psa_aead_generate_nonce() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] nonce Buffer containing the nonce to use. - /// \param nonce_length Size of the nonce in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param input The buffer holding the input data. If \p input_length + /// is greater than zero, this must be a readable buffer + /// of at least \p input_length bytes. + /// \param input_length The length of the input data in bytes. + /// \param output The buffer for the output data. If \p output_size + /// is greater than zero, this must be a writable buffer of + /// of at least \p output_size bytes. + /// \param output_size The size of the output buffer in bytes. + /// See the function description regarding the output size. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p nonce is not acceptable for the chosen algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no nonce - /// set), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_nonce( - operation: *mut psa_aead_operation_t, - nonce: *const u8, - nonce_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// total input length too long, + /// unsupported input/output buffer overlap detected, + /// or \p output_size too small. + pub fn mbedtls_gcm_update( + ctx: *mut mbedtls_gcm_context, + input: *const ::core::ffi::c_uchar, + input_length: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Declare the lengths of the message and additional data for AEAD. - /// - /// The application must call this function before calling - /// psa_aead_update_ad() or psa_aead_update() if the algorithm for - /// the operation requires it. If the algorithm does not require it, - /// calling this function is optional, but if this function is called - /// then the implementation must enforce the lengths. - /// - /// You may call this function before or after setting the nonce with - /// psa_aead_set_nonce() or psa_aead_generate_nonce(). - /// - /// - For #PSA_ALG_CCM, calling this function is required. - /// - For the other AEAD algorithms defined in this specification, calling - /// this function is not required. - /// - For vendor-defined algorithm, refer to the vendor documentation. + /// \brief This function finishes the GCM operation and generates + /// the authentication tag. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// It wraps up the GCM stream, and generates the + /// tag. The tag can have a maximum length of 16 Bytes. /// - /// \param[in,out] operation Active AEAD operation. - /// \param ad_length Size of the non-encrypted additional - /// authenticated data in bytes. - /// \param plaintext_length Size of the plaintext to encrypt in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to generate. This must be at least + /// four. + /// \param output The buffer for the final output. + /// If \p output_size is nonzero, this must be a writable + /// buffer of at least \p output_size bytes. + /// \param output_size The size of the \p output buffer in bytes. + /// This must be large enough for the output that + /// mbedtls_gcm_update() has not produced. In particular: + /// - If mbedtls_gcm_update() produces immediate output, + /// or if the total input size is a multiple of \c 16, + /// then mbedtls_gcm_finish() never produces any output, + /// so \p output_size can be \c 0. + /// - \p output_size never needs to be more than \c 15. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// At least one of the lengths is not acceptable for the chosen - /// algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and - /// psa_aead_update_ad() and psa_aead_update() must not have been - /// called yet), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_lengths( - operation: *mut psa_aead_operation_t, - ad_length: usize, - plaintext_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// invalid value of \p tag_len, + /// or \p output_size too small. + pub fn mbedtls_gcm_finish( + ctx: *mut mbedtls_gcm_context, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + tag: *mut ::core::ffi::c_uchar, + tag_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Pass additional data to an active AEAD operation. - /// - /// Additional data is authenticated, but not encrypted. - /// - /// You may call this function multiple times to pass successive fragments - /// of the additional data. You may not call this function after passing - /// data to encrypt or decrypt with psa_aead_update(). - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, - /// treat the input as untrusted and prepare to undo any action that - /// depends on the input if psa_aead_verify() returns an error status. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the fragment of - /// additional data. - /// \param input_length Size of the \p input buffer in bytes. + /// \brief This function clears a GCM context and the underlying + /// cipher sub-context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input length overflows the additional data length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, have lengths set if required by the algorithm, and - /// psa_aead_update() must not have been called yet), or the library - /// has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update_ad( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The GCM context to clear. If this is \c NULL, the call has + /// no effect. Otherwise, this must be initialized. + pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active AEAD operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// 3. Call psa_aead_update_ad() to pass all the additional data. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: - /// - Do not use the output in any way other than storing it in a - /// confidential location. If you take any action that depends - /// on the tentative decrypted data, this action will need to be - /// undone if the input turns out not to be valid. Furthermore, - /// if an adversary can observe that this action took place - /// (for example through timing), they may be able to use this - /// fact as an oracle to decrypt any message encrypted with the - /// same key. - /// - In particular, do not copy the output anywhere but to a - /// memory or storage space that you have exclusive access to. - /// - /// This function does not require the input to be aligned to any - /// particular block boundary. If the implementation can only process - /// a whole block at a time, it must consume all the input provided, but - /// it may delay the end of the corresponding output until a subsequent - /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() - /// provides sufficient input. The amount of data that can be delayed - /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, - /// \c alg, \p input_length) where - /// \c key_type is the type of key and \c alg is - /// the algorithm that were used to set up the - /// operation. - /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p - /// input_length) evaluates to the maximum - /// output size of any supported AEAD - /// algorithm. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// \brief The GCM checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or - /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total input length overflows the plaintext length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, and have lengths set if required by the algorithm), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hmac_operation_t { + /// The HMAC algorithm in use + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + /// The hash context. + pub hash_ctx: psa_hash_operation_s, + /// The HMAC part of the context. + pub private_opad: [u8; 128usize], +} +impl Default for mbedtls_psa_hmac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_mac_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_hmac: mbedtls_psa_hmac_operation_t, + pub private_cmac: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_mac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_aead_operation_t { + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_tag_length: u8, + pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub private_ccm: mbedtls_ccm_context, + pub private_gcm: mbedtls_gcm_context, + pub private_chachapoly: mbedtls_chachapoly_context, +} +impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_aead_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl mbedtls_psa_aead_operation_t { + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_sign_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_verify_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +///< Client +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; +///< Server +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; +///< Undefined +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_NONE: mbedtls_ecjpake_role = 2; +/// Roles in the EC J-PAKE exchange +pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; +/// EC J-PAKE context structure. +/// +/// J-PAKE is a symmetric protocol, except for the identifiers used in +/// Zero-Knowledge Proofs, and the serialization of the second message +/// (KeyExchange) as defined by the Thread spec. +/// +/// In order to benefit from this symmetry, we choose a different naming +/// convention from the Thread v1.0 spec. Correspondence is indicated in the +/// description as a pair C: client name, S: server name +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecjpake_context { + ///< Hash to use + pub private_md_type: mbedtls_md_type_t, + ///< Elliptic curve + pub private_grp: mbedtls_ecp_group, + ///< Are we client or server? + pub private_role: mbedtls_ecjpake_role, + ///< Format for point export + pub private_point_format: ::core::ffi::c_int, + ///< My public key 1 C: X1, S: X3 + pub private_Xm1: mbedtls_ecp_point, + ///< My public key 2 C: X2, S: X4 + pub private_Xm2: mbedtls_ecp_point, + ///< Peer public key 1 C: X3, S: X1 + pub private_Xp1: mbedtls_ecp_point, + ///< Peer public key 2 C: X4, S: X2 + pub private_Xp2: mbedtls_ecp_point, + ///< Peer public key C: Xs, S: Xc + pub private_Xp: mbedtls_ecp_point, + ///< My private key 1 C: x1, S: x3 + pub private_xm1: mbedtls_mpi, + ///< My private key 2 C: x2, S: x4 + pub private_xm2: mbedtls_mpi, + ///< Pre-shared secret (passphrase) + pub private_s: mbedtls_mpi, +} +impl Default for mbedtls_ecjpake_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Finish encrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_encrypt_setup(). + /// \brief Initialize an ECJPAKE context. /// - /// This function finishes the authentication of the additional data - /// formed by concatenating the inputs passed to preceding calls to - /// psa_aead_update_ad() with the plaintext formed by concatenating the - /// inputs passed to preceding calls to psa_aead_update(). + /// \param ctx The ECJPAKE context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Set up an ECJPAKE context for use. /// - /// This function has two output buffers: - /// - \p ciphertext contains trailing ciphertext that was buffered from - /// preceding calls to psa_aead_update(). - /// - \p tag contains the authentication tag. + /// \note Currently the only values for hash/curve allowed by the + /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to set up. This must be initialized. + /// \param role The role of the caller. This must be either + /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + /// \param hash The identifier of the hash function to use, + /// for example #MBEDTLS_MD_SHA256. + /// \param curve The identifier of the elliptic curve to use, + /// for example #MBEDTLS_ECP_DP_SECP256R1. + /// \param secret The pre-shared secret (passphrase). This must be + /// a readable not empty buffer of length \p len Bytes. It need + /// only be valid for the duration of this call. + /// \param len The length of the pre-shared secret \p secret. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] ciphertext Buffer where the last part of the ciphertext - /// is to be written. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] ciphertext_length On success, the number of bytes of - /// returned ciphertext. - /// \param[out] tag Buffer where the authentication tag is - /// to be written. - /// \param tag_size Size of the \p tag buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c - /// key_type, \c key_bits, \c alg) where - /// \c key_type and \c key_bits are the type and - /// bit-size of the key, and \c alg is the - /// algorithm that were used in the call to - /// psa_aead_encrypt_setup(). - /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the - /// maximum tag size of any supported AEAD - /// algorithm. - /// \param[out] tag_length On success, the number of bytes - /// that make up the returned tag. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p ciphertext or \p tag buffer is too small. - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the - /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, - /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to - /// determine the required \p tag buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active encryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_finish( - operation: *mut psa_aead_operation_t, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - tag: *mut u8, - tag_size: usize, - tag_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_setup( + ctx: *mut mbedtls_ecjpake_context, + role: mbedtls_ecjpake_role, + hash: mbedtls_md_type_t, + curve: mbedtls_ecp_group_id, + secret: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish authenticating and decrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_decrypt_setup(). - /// - /// This function finishes the authenticated decryption of the message - /// components: + /// \brief Set the point format for future reads and writes. /// - /// - The additional data consisting of the concatenation of the inputs - /// passed to preceding calls to psa_aead_update_ad(). - /// - The ciphertext consisting of the concatenation of the inputs passed to - /// preceding calls to psa_aead_update(). - /// - The tag passed to this function call. + /// \param ctx The ECJPAKE context to configure. + /// \param point_format The point format to use: + /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + /// or #MBEDTLS_ECP_PF_COMPRESSED. /// - /// If the authentication tag is correct, this function outputs any remaining - /// plaintext and reports success. If the authentication tag is not correct, - /// this function returns #PSA_ERROR_INVALID_SIGNATURE. + /// \return \c 0 if successful. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + /// is invalid. + pub fn mbedtls_ecjpake_set_point_format( + ctx: *mut mbedtls_ecjpake_context, + point_format: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if an ECJPAKE context is ready for use. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to check. This must be + /// initialized. /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual tag and the expected tag is performed - /// in constant time. + /// \return \c 0 if the context is ready for use. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] plaintext Buffer where the last part of the plaintext - /// is to be written. This is the remaining data - /// from previous calls to psa_aead_update() - /// that could not be processed until the end - /// of the input. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] plaintext_length On success, the number of bytes of - /// returned plaintext. - /// \param[in] tag Buffer containing the authentication tag. - /// \param tag_length Size of the \p tag buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be + /// initialized and set up. + /// \param buf The buffer to write the contents to. This must be a + /// writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number + /// of Bytes written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculations were successful, but the authentication tag is - /// not correct. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p plaintext buffer is too small. - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the - /// required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active decryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_verify( - operation: *mut psa_aead_operation_t, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - tag: *const u8, - tag_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort an AEAD operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// \brief Read and process the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_aead_operation_t. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up. + /// \param buf The buffer holding the first round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// In particular, calling psa_aead_abort() after the operation has been - /// terminated by a call to psa_aead_abort(), psa_aead_finish() or - /// psa_aead_verify() is safe and has no effect. + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \param[in,out] operation Initialized AEAD operation. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up, and already have performed round one. + /// \param buf The buffer to write the round two contents to. + /// This must be a writable buffer of length \p len Bytes. + /// \param len The size of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a message with a private key. For hash-and-sign algorithms, - /// this includes the hashing step. + /// \brief Read and process the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \note To perform a multi-part hash-and-sign signature algorithm, first use - /// a multi-part hash operation and then pass the resulting hash to - /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the - /// hash algorithm to use. - /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The input message to sign. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param[in] signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up and already have performed round one. + /// \param buf The buffer holding the second round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a message with a public key, using - /// a hash-and-sign verification algorithm. - /// - /// \note To perform a multi-part hash-and-sign signature verification - /// algorithm, first use a multi-part hash operation to hash the message - /// and then pass the resulting hash to psa_verify_hash(). - /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm - /// to use. + /// \brief Derive the shared secret + /// (TLS: Pre-Master Secret). /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The message whose signature is to be verified. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer containing the signature to verify. - /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed signature - /// is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_derive_secret( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a hash or short message with a private key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief Write the shared key material to be passed to a Key + /// Derivation Function as described in RFC8236. /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. - /// \param[out] signature_length On success, the number of bytes - /// that make up the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_shared_key( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a hash or short message using a public key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief This clears an ECJPAKE context and frees any + /// embedded data structure. /// - /// \param key Identifier of the key to use for the operation. It - /// must be a public key or an asymmetric key pair. The - /// key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message whose signature is to be - /// verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to free. This may be \c NULL, + /// in which case this function does nothing. If it is not + /// \c NULL, it must point to an initialized ECJPAKE context. + pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \retval #PSA_SUCCESS - /// The signature is valid. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief Encrypt a short message with a public key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the encrypted message is to - /// be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_pake_operation_t { + pub private_alg: psa_algorithm_t, + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_role: mbedtls_ecjpake_role, + pub private_buffer: [u8; 336usize], + pub private_buffer_length: usize, + pub private_buffer_offset: usize, + pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// \brief Decrypt a short message with a private key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. It must - /// allow the usage #PSA_KEY_USAGE_DECRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_jpake: mbedtls_ecjpake_context, } -/// The type of the state data structure for key derivation operations. -/// -/// Before calling any function on a key derivation operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_key_derivation_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, -/// for example: -/// \code -/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_key_derivation_operation_init() -/// to the structure, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// operation = psa_key_derivation_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_key_derivation_operation_t = psa_key_derivation_s; -unsafe extern "C" { - /// Set up a key derivation operation. - /// - /// A key derivation algorithm takes some inputs and uses them to generate - /// a byte stream in a deterministic way. - /// This byte stream can be used to produce keys and other - /// cryptographic material. - /// - /// To derive a key: - /// -# Start with an initialized object of type #psa_key_derivation_operation_t. - /// -# Call psa_key_derivation_setup() to select the algorithm. - /// -# Provide the inputs for the key derivation by calling - /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() - /// as appropriate. Which inputs are needed, in what order, and whether - /// they may be keys and if so of what type depends on the algorithm. - /// -# Optionally set the operation's maximum capacity with - /// psa_key_derivation_set_capacity(). You may do this before, in the middle - /// of or after providing inputs. For some algorithms, this step is mandatory - /// because the output depends on the maximum capacity. - /// -# To derive a key, call psa_key_derivation_output_key(). - /// To derive a byte string for a different purpose, call - /// psa_key_derivation_output_bytes(). - /// Successive calls to these functions use successive output bytes - /// calculated by the key derivation algorithm. - /// -# Clean up the key derivation operation object with - /// psa_key_derivation_abort(). - /// - /// If this function returns an error, the key derivation operation object is - /// not changed. - /// - /// If an error occurs at any step after a call to psa_key_derivation_setup(), - /// the operation will need to be reset by a call to psa_key_derivation_abort(). - /// - /// Implementations must reject an attempt to derive a key of size 0. - /// - /// \param[in,out] operation The key derivation operation object - /// to set up. It must - /// have been initialized but not set up yet. - /// \param alg The key derivation algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c alg is not a key derivation algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_setup( - operation: *mut psa_key_derivation_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Retrieve the current capacity of a key derivation operation. - /// - /// The capacity of a key derivation is the maximum number of bytes that it can - /// return. When you get *N* bytes of output from a key derivation operation, - /// this reduces its capacity by *N*. - /// - /// \param[in] operation The operation to query. - /// \param[out] capacity On success, the capacity of the operation. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_get_capacity( - operation: *const psa_key_derivation_operation_t, - capacity: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Set the maximum capacity of a key derivation operation. - /// - /// The capacity of a key derivation operation is the maximum number of bytes - /// that the key derivation operation can return from this point onwards. - /// - /// \param[in,out] operation The key derivation operation object to modify. - /// \param capacity The new capacity of the operation. - /// It must be less or equal to the operation's - /// current capacity. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p capacity is larger than the operation's current capacity. - /// In this case, the operation object remains valid and its capacity - /// remains unchanged. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_set_capacity( - operation: *mut psa_key_derivation_operation_t, - capacity: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_mac_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_mac_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function passes direct inputs, which is usually correct for - /// non-secret inputs. To pass a secret input, which should be in a key - /// object, call psa_key_derivation_input_key() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] data Input data to use. - /// \param data_length Size of the \p data buffer in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow direct inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_bytes( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - data: *const u8, - data_length: usize, - ) -> psa_status_t; +impl Default for psa_driver_mac_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Provide a numeric input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// However, when an algorithm requires a particular order, numeric inputs - /// usually come first as they tend to be configuration parameters. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function is used for inputs which are fixed-size non-negative - /// integers. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] value The value of the numeric input. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow numeric inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_integer( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - value: u64, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_aead_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_aead_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation in the form of a key. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function obtains input from a key object, which is usually correct for - /// secret inputs or for non-secret personalization strings kept in the key - /// store. To pass a non-secret parameter which is not in the key store, - /// call psa_key_derivation_input_bytes() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param key Identifier of the key. It must have an - /// appropriate type for step and must allow the - /// usage #PSA_KEY_USAGE_DERIVE or - /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) - /// and the algorithm used by the operation. - /// - /// \note Once all inputs steps are completed, the operations will allow: - /// - psa_key_derivation_output_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_output_key() if the input for step - /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD - /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was - /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_verify_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; - /// - psa_key_derivation_verify_key() under the same conditions as - /// psa_key_derivation_verify_bytes(). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key allows neither #PSA_KEY_USAGE_DERIVE nor - /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this - /// algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow key inputs of the given type - /// or does not allow key inputs at all. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_key( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - key: mbedtls_svc_key_id_t, - ) -> psa_status_t; +impl Default for psa_driver_aead_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Perform a key agreement and use the shared secret as input to a key - /// derivation. - /// - /// A key agreement algorithm takes two inputs: a private key \p private_key - /// a public key \p peer_key. - /// The result of this function is passed as input to a key derivation. - /// The output of this key derivation can be extracted by reading from the - /// resulting operation to produce keys and other cryptographic material. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() with a - /// key agreement and derivation algorithm - /// \c alg (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true - /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) - /// is false). - /// The operation must be ready for an - /// input of the type given by \p step. - /// \param step Which step the input data is for. - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. The peer key must be in the - /// same format that psa_import_key() accepts for the - /// public key type corresponding to the type of - /// private_key. That is, this function performs the - /// equivalent of - /// #psa_import_key(..., - /// `peer_key`, `peer_key_length`) where - /// with key attributes indicating the public key - /// type corresponding to the type of `private_key`. - /// For example, for EC keys, this means that peer_key - /// is interpreted as a point on the curve that the - /// private key is on. The standard formats for public - /// keys are documented in the documentation of - /// psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_sign_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, +} +impl Default for psa_driver_sign_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_verify_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, +} +impl Default for psa_driver_verify_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_pake_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_pake_operation_t, +} +impl Default for psa_driver_pake_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_mac_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_mac_size: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_mac_context_t, +} +impl Default for psa_mac_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_mac_operation_s { + #[inline] + pub fn private_is_sign(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_sign: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; + private_is_sign as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_aead_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub private_ad_remaining: usize, + pub private_body_remaining: usize, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_ctx: psa_driver_aead_context_t, +} +impl Default for psa_aead_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_aead_operation_s { + #[inline] + pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_ad_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_body_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(3usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 3usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 3usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(4usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 4usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 4usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_nonce_set: ::core::ffi::c_uint, + private_lengths_set: ::core::ffi::c_uint, + private_ad_started: ::core::ffi::c_uint, + private_body_started: ::core::ffi::c_uint, + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; + private_nonce_set as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; + private_lengths_set as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; + private_ad_started as u64 + }); + __bindgen_bitfield_unit.set(3usize, 1u8, { + let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; + private_body_started as u64 + }); + __bindgen_bitfield_unit.set(4usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hkdf_key_derivation_t { + pub private_info: *mut u8, + pub private_info_length: usize, + pub private_offset_in_block: u8, + pub private_block_number: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_output_block: [u8; 64usize], + pub private_prk: [u8; 64usize], + pub __bindgen_padding_0: [u64; 0usize], + pub private_hmac: psa_mac_operation_s, +} +impl Default for psa_hkdf_key_derivation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_hkdf_key_derivation_t { + #[inline] + pub fn private_state(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_info_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_state: ::core::ffi::c_uint, + private_info_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 2u8, { + let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; + private_state as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; + private_info_set as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_tls12_ecjpake_to_pms_t { + pub private_data: [u8; 32usize], +} +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: + psa_tls12_prf_key_derivation_state_t = 0; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: + psa_tls12_prf_key_derivation_state_t = 1; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 2; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 3; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: + psa_tls12_prf_key_derivation_state_t = 4; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: + psa_tls12_prf_key_derivation_state_t = 5; +pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_tls12_prf_key_derivation_s { + pub private_left_in_block: u8, + pub private_block_number: u8, + pub private_state: psa_tls12_prf_key_derivation_state_t, + pub private_secret: *mut u8, + pub private_secret_length: usize, + pub private_seed: *mut u8, + pub private_seed_length: usize, + pub private_label: *mut u8, + pub private_label_length: usize, + pub private_other_secret: *mut u8, + pub private_other_secret_length: usize, + pub private_Ai: [u8; 64usize], + pub private_output_block: [u8; 64usize], +} +impl Default for psa_tls12_prf_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_key_derivation_context_t { + pub dummy: ::core::ffi::c_uint, + pub private_hkdf: psa_hkdf_key_derivation_t, + pub private_tls12_prf: psa_tls12_prf_key_derivation_t, + pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +} +impl Default for psa_driver_key_derivation_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_key_derivation_s { + pub private_alg: psa_algorithm_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_capacity: usize, + pub __bindgen_padding_0: [u64; 0usize], + pub private_ctx: psa_driver_key_derivation_context_t, +} +impl Default for psa_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_key_derivation_s { + #[inline] + pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_can_output_key: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_can_output_key: u32 = + unsafe { ::core::mem::transmute(private_can_output_key) }; + private_can_output_key as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_custom_key_parameters_s { + pub flags: u32, +} +#[repr(C)] +#[derive(Default)] +pub struct psa_key_production_parameters_s { + pub flags: u32, + pub data: __IncompleteArrayField, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_policy_s { + pub private_usage: psa_key_usage_t, + pub private_alg: psa_algorithm_t, + pub private_alg2: psa_algorithm_t, +} +pub type psa_key_policy_t = psa_key_policy_s; +pub type psa_key_bits_t = u16; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_attributes_s { + pub private_type: psa_key_type_t, + pub private_bits: psa_key_bits_t, + pub private_lifetime: psa_key_lifetime_t, + pub private_policy: psa_key_policy_t, + pub private_id: mbedtls_svc_key_id_t, +} +/// \brief The context for PSA interruptible hash signing. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_sign_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_sign_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_sign_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_sign_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The context for PSA interruptible hash verification. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_verify_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_verify_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_verify_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_verify_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +unsafe extern "C" { + /// \brief Library initialization. + /// + /// Applications must call this function before calling any other + /// function in this module. + /// + /// Applications may call this function more than once. Once a call + /// succeeds, subsequent calls are guaranteed to succeed. + /// + /// If the application calls other functions before calling psa_crypto_init(), + /// the behavior is undefined. Implementations are encouraged to either perform + /// the operation as if the library had been initialized or to return + /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + /// implementations should not return a success status if the lack of + /// initialization may have security implications, for example due to improper + /// seeding of the random number generator. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + pub fn psa_crypto_init() -> psa_status_t; +} +unsafe extern "C" { + /// Retrieve the attributes of a key. + /// + /// This function first resets the attribute structure as with + /// psa_reset_key_attributes(). It then copies the attributes of + /// the given key into the given attribute structure. + /// + /// \note This function may allocate memory or other resources. + /// Once you have called this function on an attribute structure, + /// you must call psa_reset_key_attributes() to free these resources. + /// + /// \param[in] key Identifier of the key to query. + /// \param[in,out] attributes On success, the attributes of the key. + /// On failure, equivalent to a + /// freshly-initialized structure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_get_key_attributes( + key: mbedtls_svc_key_id_t, + attributes: *mut psa_key_attributes_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Reset a key attribute structure to a freshly initialized state. + /// + /// You must initialize the attribute structure as described in the + /// documentation of the type #psa_key_attributes_t before calling this + /// function. Once the structure has been initialized, you may call this + /// function at any time. + /// + /// This function frees any auxiliary resources that the structure + /// may contain. + /// + /// \param[in,out] attributes The attribute structure to reset. + pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); +} +unsafe extern "C" { + /// Remove non-essential copies of key material from memory. + /// + /// If the key identifier designates a volatile key, this functions does not do + /// anything and returns successfully. + /// + /// If the key identifier designates a persistent key, then this function will + /// free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and the key can still be used. + /// + /// \param key Identifier of the key to purge. + /// + /// \retval #PSA_SUCCESS + /// The key material will have been removed from memory if it is not + /// currently required. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid key identifier. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// Make a copy of a key. + /// + /// Copy key material from one location to another. + /// + /// This function is primarily useful to copy a key from one location + /// to another, since it populates a key using the material from + /// another key which may have a different lifetime. + /// + /// This function may be used to share a key with a different party, + /// subject to implementation-defined restrictions on key sharing. + /// + /// The policy on the source key must have the usage flag + /// #PSA_KEY_USAGE_COPY set. + /// This flag is sufficient to permit the copy if the key has the lifetime + /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + /// Some secure elements do not provide a way to copy a key without + /// making it extractable from the secure element. If a key is located + /// in such a secure element, then the key must have both usage flags + /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + /// a copy of the key outside the secure element. + /// + /// The resulting key may only be used in a way that conforms to + /// both the policy of the original key and the policy specified in + /// the \p attributes parameter: + /// - The usage flags on the resulting key are the bitwise-and of the + /// usage flags on the source policy and the usage flags in \p attributes. + /// - If both allow the same algorithm or wildcard-based + /// algorithm policy, the resulting key has the same algorithm policy. + /// - If either of the policies allows an algorithm and the other policy + /// allows a wildcard-based algorithm policy that includes this algorithm, + /// the resulting key allows the same algorithm. + /// - If the policies do not allow any algorithm in common, this function + /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// + /// The effect of this function on implementation-defined attributes is + /// implementation-defined. + /// + /// \param source_key The key to copy. It must allow the usage + /// #PSA_KEY_USAGE_COPY. If a private or secret key is + /// being copied outside of a secure element it must + /// also allow #PSA_KEY_USAGE_EXPORT. + /// \param[in] attributes The attributes for the new key. + /// They are used as follows: + /// - The key type and size may be 0. If either is + /// nonzero, it must match the corresponding + /// attribute of the source key. + /// - The key location (the lifetime and, for + /// persistent keys, the key identifier) is + /// used directly. + /// - The policy constraints (usage flags and + /// algorithm policy) are combined from + /// the source key and \p attributes so that + /// both sets of restrictions apply, as + /// described in the documentation of this function. + /// \param[out] target_key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p source_key is invalid. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The lifetime or identifier in \p attributes are invalid, or + /// the policy constraints on the source and specified in + /// \p attributes are incompatible, or + /// \p attributes specifies a key type or key size + /// which does not match the attributes of the source key. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + /// the source key is not exportable and its lifetime does not + /// allow copying it to the target's lifetime. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_copy_key( + source_key: mbedtls_svc_key_id_t, + attributes: *const psa_key_attributes_t, + target_key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Destroy a key. + /// + /// This function destroys a key from both volatile + /// memory and, if applicable, non-volatile storage. Implementations shall + /// make a best effort to ensure that the key material cannot be recovered. + /// + /// This function also erases any metadata such as policies and frees + /// resources associated with the key. + /// + /// If a key is currently in use in a multipart operation, then destroying the + /// key will cause the multipart operation to fail. + /// + /// \warning We can only guarantee that the the key material will + /// eventually be wiped from memory. With threading enabled + /// and during concurrent execution, copies of the key material may + /// still exist until all threads have finished using the key. + /// + /// \param key Identifier of the key to erase. If this is \c 0, do nothing and + /// return #PSA_SUCCESS. + /// + /// \retval #PSA_SUCCESS + /// \p key was a valid identifier and the key material that it + /// referred to has been erased. Alternatively, \p key is \c 0. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key cannot be erased because it is + /// read-only, either due to a policy or due to physical restrictions. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p key is not a valid identifier nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE + /// There was a failure in communication with the cryptoprocessor. + /// The key material may still be present in the cryptoprocessor. + /// \retval #PSA_ERROR_DATA_INVALID + /// This error is typically a result of either storage corruption on a + /// cleartext storage backend, or an attempt to read data that was + /// written by an incompatible version of the library. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The storage is corrupted. Implementations shall make a best effort + /// to erase key material even in this stage, however applications + /// should be aware that it may be impossible to guarantee that the + /// key material is not recoverable in such cases. + /// \retval #PSA_ERROR_CORRUPTION_DETECTED + /// An unexpected condition which is not a storage corruption or + /// a communication failure occurred. The cryptoprocessor may have + /// been compromised. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Import a key in binary format. + /// + /// This function supports any output from psa_export_key(). Refer to the + /// documentation of psa_export_public_key() for the format of public keys + /// and to the documentation of psa_export_key() for the format for + /// other key types. + /// + /// The key data determines the key size. The attributes may optionally + /// specify a key size; in this case it must match the size determined + /// from the key data. A key size of 0 in \p attributes indicates that + /// the key size is solely determined by the key data. + /// + /// Implementations must reject an attempt to import a key of size 0. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// \param[in] attributes The attributes for the new key. + /// The key size is always determined from the + /// \p data buffer. + /// If the key size in \p attributes is nonzero, + /// it must be equal to the size from \p data. + /// \param[out] key On success, an identifier to the newly created key. + /// For persistent keys, this is the key identifier + /// defined in \p attributes. + /// \c 0 on failure. + /// \param[in] data Buffer containing the key data. The content of this + /// buffer is interpreted according to the type declared + /// in \p attributes. + /// All implementations must support at least the format + /// described in the documentation + /// of psa_export_key() or psa_export_public_key() for + /// the chosen type. Implementations may allow other + /// formats, but should be conservative: implementations + /// should err on the side of rejecting content if it + /// may be erroneous (e.g. wrong type or truncated data). + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular persistent location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key attributes, as a whole, are invalid, or + /// the key data is not correctly formatted, or + /// the size in \p attributes is nonzero and does not match the size + /// of the key data. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_import_key( + attributes: *const psa_key_attributes_t, + data: *const u8, + data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a key in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an equivalent object. + /// + /// If the implementation of psa_import_key() supports other formats + /// beyond the format specified here, the output from psa_export_key() + /// must use the representation specified here, not the original + /// representation. + /// + /// For standard key types, the output format is as follows: + /// + /// - For symmetric keys (including MAC keys), the format is the + /// raw bytes of the key. + /// - For DES, the key data consists of 8 bytes. The parity bits must be + /// correct. + /// - For Triple-DES, the format is the concatenation of the + /// two or three DES keys. + /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + /// is the non-encrypted DER encoding of the representation defined by + /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + /// ``` + /// RSAPrivateKey ::= SEQUENCE { + /// version INTEGER, -- must be 0 + /// modulus INTEGER, -- n + /// publicExponent INTEGER, -- e + /// privateExponent INTEGER, -- d + /// prime1 INTEGER, -- p + /// prime2 INTEGER, -- q + /// exponent1 INTEGER, -- d mod (p-1) + /// exponent2 INTEGER, -- d mod (q-1) + /// coefficient INTEGER, -- (inverse of q) mod p + /// } + /// ``` + /// - For elliptic curve key pairs (key types for which + /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + /// a representation of the private value as a `ceiling(m/8)`-byte string + /// where `m` is the bit size associated with the curve, i.e. the bit size + /// of the order of the curve's coordinate field. This byte string is + /// in little-endian order for Montgomery curves (curve types + /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + /// For Weierstrass curves, this is the content of the `privateKey` field of + /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + /// the format is defined by RFC 7748, and output is masked according to §5. + /// For twisted Edwards curves, the private key is as defined by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For Diffie-Hellman key exchange key pairs (key types for which + /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + /// format is the representation of the private key `x` as a big-endian byte + /// string. The length of the byte string is the private key size in bytes + /// (leading zeroes are not stripped). + /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + /// true), the format is the same as for psa_export_public_key(). + /// + /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// + /// \param key Identifier of the key to export. It must allow the + /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public + /// key. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a public key or the public part of a key pair in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an object that is equivalent to the public key. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// For standard key types, the output format is as follows: + /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + /// ``` + /// RSAPublicKey ::= SEQUENCE { + /// modulus INTEGER, -- n + /// publicExponent INTEGER } -- e + /// ``` + /// - For elliptic curve keys on a twisted Edwards curve (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + /// by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For other elliptic curve public keys (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. + /// Let `m` be the bit size associated with the curve, i.e. the bit size of + /// `q` for a curve over `F_q`. The representation consists of: + /// - The byte 0x04; + /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + /// - For Diffie-Hellman key exchange public keys (key types for which + /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + /// the format is the representation of the public key `y = g^x mod p` as a + /// big-endian byte string. The length of the byte string is the length of the + /// base prime `p` in bytes. + /// + /// Exporting a public key object or the public part of a key pair is + /// always permitted, regardless of the key's usage flags. + /// + /// \param key Identifier of the key to export. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key is neither a public key nor a key pair. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_public_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message. + /// + /// \note To verify the hash of a message against an + /// expected value, use psa_hash_compare() instead. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\p alg). /// /// \retval #PSA_SUCCESS /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p hash_size is too small + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compute( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message and compare it with a + /// reference value. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the input. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c private_key is not compatible with \c alg, - /// or \p peer_key is not valid for \c alg or not compatible with - /// \c private_key, or \c step does not allow an input resulting - /// from a key agreement. + /// \p input_length or \p hash_length do not match the hash size for \p alg + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compare( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; +} +/// The type of the state data structure for multipart hash operations. +/// +/// Before calling any function on a hash operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_hash_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_hash_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, +/// for example: +/// \code +/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_hash_operation_init() +/// to the structure, for example: +/// \code +/// psa_hash_operation_t operation; +/// operation = psa_hash_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_hash_operation_t = psa_hash_operation_s; +unsafe extern "C" { + /// Set up a multipart hash operation. + /// + /// The sequence of operations to calculate a hash (message digest) + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + /// -# Call psa_hash_setup() to specify the algorithm. + /// -# Call psa_hash_update() zero, one or more times, passing a fragment + /// of the message each time. The hash that is calculated is the hash + /// of the concatenation of these messages in order. + /// -# To calculate the hash, call psa_hash_finish(). + /// To compare the hash with an expected value, call psa_hash_verify(). + /// + /// If an error occurs at any step after a call to psa_hash_setup(), the + /// operation will need to be reset by a call to psa_hash_abort(). The + /// application may call psa_hash_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_hash_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_hash_finish() or psa_hash_verify(). + /// - A call to psa_hash_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_hash_operation_t and not yet in use. + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. + /// \p alg is not a supported hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a hash algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this key agreement \p step, - /// or the library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_key_agreement( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, + pub fn psa_hash_setup( + operation: *mut psa_hash_operation_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// Read some data from a key derivation operation. + /// Add a message fragment to a multipart hash operation. /// - /// This function calculates output bytes from a key derivation algorithm and - /// return those bytes. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the requested number of bytes from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. + /// The application must call psa_hash_setup() before calling this function. /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] output Buffer where the output will be written. - /// \param output_length Number of bytes to output. + /// \param[in,out] operation Active hash operation. + /// \param[in] input Buffer containing the message fragment to hash. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// no output is written to the output buffer. - /// The operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller output buffer. + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_update( + operation: *mut psa_hash_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \warning Applications should not call this function if they expect + /// a specific value for the hash. Call psa_hash_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// hash values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the hashed data which could allow an attacker to guess + /// a valid hash and thereby bypass security controls. + /// + /// \param[in,out] operation Active hash operation. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\c alg) where \c alg is the + /// hash algorithm that is calculated. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p hash buffer is too small. You can determine a + /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + /// where \c alg is the hash algorithm that is calculated. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_finish( + operation: *mut psa_hash_operation_t, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message and compare it with + /// an expected value. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). It then + /// compares the calculated hash with the expected hash passed as a + /// parameter to this function. + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual hash and the expected hash is performed + /// in constant time. + /// + /// \param[in,out] operation Active hash operation. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_bytes( - operation: *mut psa_key_derivation_operation_t, - output: *mut u8, - output_length: usize, + pub fn psa_hash_verify( + operation: *mut psa_hash_operation_t, + hash: *const u8, + hash_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// Derive a key from an ongoing key derivation operation. - /// - /// This function calculates output bytes from a key derivation algorithm - /// and uses those bytes to generate a key deterministically. - /// The key's location, usage policy, type and size are taken from - /// \p attributes. - /// - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads as many bytes as required from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// How much output is produced and consumed from the operation, and how - /// the key is derived, depends on the key type and on the key size - /// (denoted \c bits below): - /// - /// - For key types for which the key is an arbitrary sequence of bytes - /// of a given size, this function is functionally equivalent to - /// calling #psa_key_derivation_output_bytes - /// and passing the resulting output to #psa_import_key. - /// However, this function has a security benefit: - /// if the implementation provides an isolation boundary then - /// the key material is not exposed outside the isolation boundary. - /// As a consequence, for these key types, this function always consumes - /// exactly (\c bits / 8) bytes from the operation. - /// The following key types defined in this specification follow this scheme: - /// - /// - #PSA_KEY_TYPE_AES; - /// - #PSA_KEY_TYPE_ARIA; - /// - #PSA_KEY_TYPE_CAMELLIA; - /// - #PSA_KEY_TYPE_DERIVE; - /// - #PSA_KEY_TYPE_HMAC; - /// - #PSA_KEY_TYPE_PASSWORD_HASH. - /// - /// - For ECC keys on a Montgomery elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Montgomery curve), this function always draws a byte string whose - /// length is determined by the curve, and sets the mandatory bits - /// accordingly. That is: + /// Abort a hash operation. /// - /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte - /// string and process it as specified in RFC 7748 §5. - /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte - /// string and process it as specified in RFC 7748 §5. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_hash_setup() again. /// - /// - For key types for which the key is represented by a single sequence of - /// \c bits bits with constraints as to which bit sequences are acceptable, - /// this function draws a byte string of length (\c bits / 8) bytes rounded - /// up to the nearest whole number of bytes. If the resulting byte string - /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. - /// This process is repeated until an acceptable byte string is drawn. - /// The byte string drawn from the operation is interpreted as specified - /// for the output produced by psa_export_key(). - /// The following key types defined in this specification follow this scheme: + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_hash_operation_t. /// - /// - #PSA_KEY_TYPE_DES. - /// Force-set the parity bits, but discard forbidden weak keys. - /// For 2-key and 3-key triple-DES, the three keys are generated - /// successively (for example, for 3-key triple-DES, - /// if the first 8 bytes specify a weak key and the next 8 bytes do not, - /// discard the first 8 bytes, use the next 8 bytes as the first key, - /// and continue reading output from the operation to derive the other - /// two keys). - /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) - /// where \c group designates any Diffie-Hellman group) and - /// ECC keys on a Weierstrass elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Weierstrass curve). - /// For these key types, interpret the byte string as integer - /// in big-endian order. Discard it if it is not in the range - /// [0, *N* - 2] where *N* is the boundary of the private key domain - /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, - /// or the order of the curve's base point for ECC). - /// Add 1 to the resulting integer and use this as the private key *x*. - /// This method allows compliance to NIST standards, specifically - /// the methods titled "key-pair generation by testing candidates" - /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, - /// in FIPS 186-4 §B.1.2 for DSA, and - /// in NIST SP 800-56A §5.6.1.2.2 or - /// FIPS 186-4 §B.4.2 for elliptic curve keys. + /// In particular, calling psa_hash_abort() after the operation has been + /// terminated by a call to psa_hash_abort(), psa_hash_finish() or + /// psa_hash_verify() is safe and has no effect. /// - /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, - /// the way in which the operation output is consumed is - /// implementation-defined. + /// \param[in,out] operation Initialized hash operation. /// - /// In all cases, the data that is read is discarded from the operation. - /// The operation's capacity is decreased by the number of bytes read. + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Clone a hash operation. /// - /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, - /// the input to that step must be provided with psa_key_derivation_input_key(). - /// Future versions of this specification may include additional restrictions - /// on the derived key based on the attributes and strength of the secret key. + /// This function copies the state of an ongoing hash operation to + /// a new operation object. In other words, this function is equivalent + /// to calling psa_hash_setup() on \p target_operation with the same + /// algorithm that \p source_operation was set up for, then + /// psa_hash_update() on \p target_operation with the same input that + /// that was passed to \p source_operation. After this function returns, the + /// two objects are independent, i.e. subsequent calls involving one of + /// the objects do not affect the other object. /// - /// \param[in] attributes The attributes for the new key. - /// If the key type to be created is - /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in - /// the policy must be the same as in the current - /// operation. - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in] source_operation The active hash operation to clone. + /// \param[in,out] target_operation The operation object to set up. + /// It must be initialized but not active. /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// There was not enough data to create the desired key. - /// Note that in this case, no output is written to the output buffer. - /// The operation's capacity is set to 0, thus subsequent calls to - /// this function will not succeed, even with a smaller output buffer. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The provided key attributes are not valid for the operation. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The #PSA_KEY_DERIVATION_INPUT_SECRET or - /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a - /// key; or one of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_SUCCESS \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The \p source_operation state is not valid (it must be active), or + /// the \p target_operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_key( - attributes: *const psa_key_attributes_t, - operation: *mut psa_key_derivation_operation_t, - key: *mut mbedtls_svc_key_id_t, + pub fn psa_hash_clone( + source_operation: *const psa_hash_operation_t, + target_operation: *mut psa_hash_operation_t, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value in constant time. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the expected number of bytes from the - /// stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to the following code: - /// \code - /// psa_key_derivation_output_bytes(operation, tmp, output_length); - /// if (memcmp(output, tmp, output_length) != 0) - /// return PSA_ERROR_INVALID_SIGNATURE; - /// \endcode - /// except (1) it works even if the key's policy does not allow outputting the - /// bytes, and (2) the comparison will be done in constant time. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC (message authentication code) of a message. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected_output Buffer containing the expected derivation output. - /// \param output_length Length of the expected output; this is also the - /// number of bytes that will be read. + /// \note To verify the MAC of a message against an + /// expected value, use psa_mac_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but it differs from the expected - /// output. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p mac_size is too small /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_bytes( - operation: *mut psa_key_derivation_operation_t, - expected_output: *const u8, - output_length: usize, + pub fn psa_mac_compute( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value - /// stored in a key object. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value, provided as key of type - /// #PSA_KEY_TYPE_PASSWORD_HASH. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the number of bytes corresponding to the - /// length of the expected value from the stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to exporting the key and calling - /// psa_key_derivation_verify_bytes() on the result, except that it - /// works even if the key cannot be exported. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC of a message and compare it with a reference value. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH - /// containing the expected output. Its policy must - /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag - /// and the permitted algorithm must match the - /// operation. The value of this key was likely - /// computed by a previous call to - /// psa_key_derivation_output_key(). + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the input. /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but if differs from the expected - /// output. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// The key passed as the expected value does not exist. + /// The MAC of the message was calculated successfully, but it + /// differs from the expected value. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key passed as the expected value has an invalid type. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key passed as the expected value does not allow this usage or - /// this algorithm; or one of the inputs was a key whose policy didn't - /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// the length of the expected value. In this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_key( - operation: *mut psa_key_derivation_operation_t, - expected: psa_key_id_t, + pub fn psa_mac_verify( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *const u8, + mac_length: usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart MAC operations. +/// +/// Before calling any function on a MAC operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_mac_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_mac_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, +/// for example: +/// \code +/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_mac_operation_init() +/// to the structure, for example: +/// \code +/// psa_mac_operation_t operation; +/// operation = psa_mac_operation_init(); +/// \endcode +/// +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Abort a key derivation operation. + /// Set up a multipart MAC calculation operation. /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_key_derivation_setup() again. + /// This function sets up the calculation of the MAC + /// (message authentication code) of a byte string. + /// To verify the MAC of a message against an + /// expected value, use psa_mac_verify_setup() instead. /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_key_derivation_operation_t. + /// The sequence of operations to calculate a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_sign_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_sign_finish() to finish + /// calculating the MAC value and retrieve it. /// - /// In particular, it is valid to call psa_key_derivation_abort() twice, or to - /// call psa_key_derivation_abort() on an operation that has not been set up. + /// If an error occurs at any step after a call to psa_mac_sign_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. /// - /// \param[in,out] operation The operation to abort. + /// After a successful call to psa_mac_sign_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_sign_finish(). + /// - A call to psa_mac_abort(). /// - /// \retval #PSA_SUCCESS \emptydescription + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) - -> psa_status_t; + pub fn psa_mac_sign_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Perform a key agreement and return the raw shared secret. + /// Set up a multipart MAC verification operation. /// - /// \warning The raw result of a key agreement algorithm such as finite-field - /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should - /// not be used directly as key material. It should instead be passed as - /// input to a key derivation algorithm. To chain a key agreement with - /// a key derivation, use psa_key_derivation_key_agreement() and other - /// functions from the key derivation interface. + /// This function sets up the verification of the MAC + /// (message authentication code) of a byte string against an expected value. /// - /// \param alg The key agreement algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) - /// is true). - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. It must be - /// in the same format that psa_import_key() - /// accepts. The standard formats for public - /// keys are documented in the documentation - /// of psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// The sequence of operations to verify a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_verify_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_verify_finish() to finish + /// calculating the actual MAC of the message and verify it against + /// the expected value. + /// + /// If an error occurs at any step after a call to psa_mac_verify_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_mac_verify_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_verify_finish(). + /// - A call to psa_mac_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage + /// PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). /// /// \retval #PSA_SUCCESS /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a key agreement algorithm, or - /// \p private_key is not compatible with \p alg, - /// or \p peer_key is not valid for \p alg or not compatible with - /// \p private_key. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p output_size is too small + /// \c key is not compatible with \c alg. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported key agreement algorithm. + /// \c alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_raw_key_agreement( + pub fn psa_mac_verify_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate random bytes. - /// - /// \warning This function **can** fail! Callers MUST check the return status - /// and MUST NOT use the content of the output buffer if the return - /// status is not #PSA_SUCCESS. - /// - /// \note To generate a key, use psa_generate_key() instead. - /// - /// \param[out] output Output buffer for the generated data. - /// \param output_size Number of bytes to generate and output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Generate a key or key pair. - /// - /// The key is generated randomly. - /// Its location, usage policy, type and size are taken from \p attributes. + /// Add a message fragment to a multipart MAC operation. /// - /// Implementations must reject an attempt to generate a key of size 0. + /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + /// before calling this function. /// - /// The following type-specific considerations apply: - /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the public exponent is 65537. - /// The modulus is a product of two probabilistic primes - /// between 2^{n-1} and 2^n where n is the bit size specified in the - /// attributes. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param[in] attributes The attributes for the new key. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in,out] operation Active MAC operation. + /// \param[in] input Buffer containing the message fragment to add to + /// the MAC calculation. + /// \param input_length Size of the \p input buffer in bytes. /// /// \retval #PSA_SUCCESS /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_generate_key( - attributes: *const psa_key_attributes_t, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; -} -/// The type of the state data structure for interruptible hash -/// signing operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = -/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_sign_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// operation = psa_sign_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; -/// The type of the state data structure for interruptible hash -/// verification operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = -/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_verify_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// operation = psa_verify_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; -unsafe extern "C" { - /// \brief Set the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note The time taken to execute a single op is - /// implementation specific and depends on - /// software, hardware, the algorithm, key type and - /// curve chosen. Even within a single operation, - /// successive ops can take differing amounts of - /// time. The only guarantee is that lower values - /// for \p max_ops means functions will block for a - /// lesser maximum amount of time. The functions - /// \c psa_sign_interruptible_get_num_ops() and - /// \c psa_verify_interruptible_get_num_ops() are - /// provided to help with tuning this value. - /// - /// \note This value defaults to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which - /// means the whole operation will be done in one - /// go, regardless of the number of ops required. - /// - /// \note If more ops are needed to complete a - /// computation, #PSA_OPERATION_INCOMPLETE will be - /// returned by the function performing the - /// computation. It is then the caller's - /// responsibility to either call again with the - /// same operation context until it returns 0 or an - /// error code; or to call the relevant abort - /// function if the answer is no longer required. - /// - /// \note The interpretation of \p max_ops is also - /// implementation defined. On a hard real time - /// system, this can indicate a hard deadline, as a - /// real-time system needs a guarantee of not - /// spending more than X time, however care must be - /// taken in such an implementation to avoid the - /// situation whereby calls just return, not being - /// able to do any actual work within the allotted - /// time. On a non-real-time system, the - /// implementation can be more relaxed, but again - /// whether this number should be interpreted as as - /// hard or soft limit or even whether a less than - /// or equals as regards to ops executed in a - /// single call is implementation defined. - /// - /// \note For keys in local storage when no accelerator - /// driver applies, please see also the - /// documentation for \c mbedtls_ecp_set_max_ops(), - /// which is the internal implementation in these - /// cases. - /// - /// \warning With implementations that interpret this number - /// as a hard limit, setting this number too small - /// may result in an infinite loop, whereby each - /// call results in immediate return with no ops - /// done (as there is not enough time to execute - /// any), and thus no result will ever be achieved. - /// - /// \note This only applies to functions whose - /// documentation mentions they may return - /// #PSA_OPERATION_INCOMPLETE. - /// - /// \param max_ops The maximum number of ops to be executed in a - /// single call. This can be a number from 0 to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 - /// is the least amount of work done per call. - pub fn psa_interruptible_set_max_ops(max_ops: u32); -} -unsafe extern "C" { - /// \brief Get the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. This will return the last - /// value set by - /// \c psa_interruptible_set_max_ops() or - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if - /// that function has never been called. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \return Maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - pub fn psa_interruptible_get_max_ops() -> u32; + pub fn psa_mac_update( + operation: *mut psa_mac_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash signing - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling - /// \c psa_sign_hash_interruptible_abort() on - /// the operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message. /// - /// \note This interface is guaranteed re-entrant and - /// thus may be called from driver code. + /// The application must call psa_mac_sign_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// \warning Applications should not call this function if they expect + /// a specific value for the MAC. Call psa_mac_verify_finish() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \param operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// \param[in,out] operation Active MAC operation. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. This is always + /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of the key and \c alg is the + /// MAC algorithm that is calculated. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_sign_hash_get_num_ops( - operation: *const psa_sign_hash_interruptible_operation_t, - ) -> u32; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p mac buffer is too small. You can determine a + /// sufficient buffer size by calling PSA_MAC_LENGTH(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac sign + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_sign_finish( + operation: *mut psa_mac_operation_t, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash verification - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling \c - /// psa_verify_hash_interruptible_abort() on the - /// operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message and compare it with + /// an expected value. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// The application must call psa_mac_verify_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). It then + /// compares the calculated MAC with the expected MAC passed as a + /// parameter to this function. /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param operation The \c - /// psa_verify_hash_interruptible_operation_t to - /// use. This must be initialized first. + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual MAC and the expected MAC is performed + /// in constant time. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_verify_hash_get_num_ops( - operation: *const psa_verify_hash_interruptible_operation_t, - ) -> u32; + /// \param[in,out] operation Active MAC operation. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The MAC of the message was calculated successfully, but it + /// differs from the expected MAC. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac verify + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_verify_finish( + operation: *mut psa_mac_operation_t, + mac: *const u8, + mac_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start signing a hash or short message with a - /// private key, in an interruptible manner. + /// Abort a MAC operation. /// - /// \see \c psa_sign_hash_complete() + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_mac_sign_setup() or psa_mac_verify_setup() again. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_mac_operation_t. /// - /// \note This function combined with \c - /// psa_sign_hash_complete() is equivalent to - /// \c psa_sign_hash() but - /// \c psa_sign_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// In particular, calling psa_mac_abort() after the operation has been + /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + /// psa_mac_verify_finish() is safe and has no effect. /// - /// \note Users should call \c psa_sign_hash_complete() - /// repeatedly on the same context after a - /// successful call to this function until \c - /// psa_sign_hash_complete() either returns 0 or an - /// error. \c psa_sign_hash_complete() will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// \param[in,out] operation Initialized MAC operation. /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_sign_hash_abort(). + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Encrypt a message using a symmetric cipher. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// This function encrypts a message with a random IV (initialization + /// vector). Use the multipart operation interface with a + /// #psa_cipher_operation_t object to provide other forms of IV. /// /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. + /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// The output contains the IV followed by + /// the ciphertext proper. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. /// /// \retval #PSA_SUCCESS - /// The operation started successfully - call \c psa_sign_hash_complete() - /// with the same context to complete the operation - /// + /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does - /// not permit the requested algorithm. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// An operation has previously been started on this context, and is - /// still in progress. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Decrypt a message using a symmetric cipher. + /// + /// This function decrypts a message encrypted with a symmetric cipher. + /// + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to decrypt. + /// This consists of the IV followed by the + /// ciphertext proper. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the plaintext is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_start( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt( key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart cipher operations. +/// +/// Before calling any function on a cipher operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_cipher_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_cipher_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, +/// for example: +/// \code +/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_cipher_operation_init() +/// to the structure, for example: +/// \code +/// psa_cipher_operation_t operation; +/// operation = psa_cipher_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// signing a hash or short message with a private - /// key, in an interruptible manner. - /// - /// \see \c psa_sign_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_sign_hash_start() is equivalent to - /// \c psa_sign_hash() but this function can return - /// early and resume according to the limit set with - /// \c psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// Set the key for a multipart symmetric encryption operation. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// The sequence of operations to encrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + /// generate or set the IV (initialization vector). You should use + /// psa_cipher_generate_iv() unless the protocol you are implementing + /// requires a specific IV value. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_sign_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_sign_hash_start() called with it - /// first. + /// After a successful call to psa_cipher_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c - /// key_bits, \c alg) where \c key_type and \c - /// key_bits are the type and bit-size - /// respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// Operation completed successfully - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_sign_hash_start(). - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_sign_hash_start() with this operation object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_sign_hash_complete( - operation: *mut psa_sign_hash_interruptible_operation_t, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Abort a sign hash operation. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function is the only function that clears - /// the number of ops completed as part of the - /// operation. Please ensure you copy this value via - /// \c psa_sign_hash_get_num_ops() if required - /// before calling. - /// - /// \note Aborting an operation frees all associated - /// resources except for the \p operation structure - /// itself. Once aborted, the operation object can - /// be reused for another operation by calling \c - /// psa_sign_hash_start() again. - /// - /// \note You may call this function any time after the - /// operation object has been initialized. In - /// particular, calling \c psa_sign_hash_abort() - /// after the operation has already been terminated - /// by a call to \c psa_sign_hash_abort() or - /// psa_sign_hash_complete() is safe. - /// - /// \param[in,out] operation Initialized sign hash operation. - /// - /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_abort( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_encrypt_setup( + operation: *mut psa_cipher_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start reading and verifying a hash or short - /// message, in an interruptible manner. - /// - /// \see \c psa_verify_hash_complete() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_verify_hash_complete() is equivalent to - /// \c psa_verify_hash() but \c - /// psa_verify_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function. + /// Set the key for a multipart symmetric decryption operation. /// - /// \note Users should call \c psa_verify_hash_complete() - /// repeatedly on the same operation object after a - /// successful call to this function until \c - /// psa_verify_hash_complete() either returns 0 or - /// an error. \c psa_verify_hash_complete() will - /// return #PSA_OPERATION_INCOMPLETE if there is - /// more work to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The sequence of operations to decrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + /// decryption. If the IV is prepended to the ciphertext, you can call + /// psa_cipher_update() on a buffer containing the IV followed by the + /// beginning of the message. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_verify_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// After a successful call to psa_cipher_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. /// \param key Identifier of the key to use for the operation. - /// The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash whose signature is to be verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// The operation started successfully - please call \c - /// psa_verify_hash_complete() with the same context to complete the - /// operation. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// Another operation has already been started on this context, and is - /// still in progress. - /// - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does - /// not permit the requested algorithm. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_start( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt_setup( + operation: *mut psa_cipher_operation_t, key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// reading and verifying a hash or short message - /// signed with a private key, in an interruptible - /// manner. - /// - /// \see \c psa_verify_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// Generate an IV for a symmetric encryption operation. /// - /// \note This function combined with \c - /// psa_verify_hash_start() is equivalent to - /// \c psa_verify_hash() but this function can - /// return early and resume according to the limit - /// set with \c psa_interruptible_set_max_ops() to - /// reduce the maximum time spent in a function - /// call. + /// This function generates a random IV (initialization vector), nonce + /// or initial counter value for the encryption operation as appropriate + /// for the chosen algorithm, key type and key size. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_verify_hash_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_verify_hash_start() called with it - /// first. + /// \param[in,out] operation Active cipher operation. + /// \param[out] iv Buffer where the generated IV is to be written. + /// \param iv_size Size of the \p iv buffer in bytes. + /// \param[out] iv_length On success, the number of bytes of the + /// generated IV. /// /// \retval #PSA_SUCCESS - /// Operation completed successfully, and the passed signature is valid. - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_verify_hash_start(). - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p iv buffer is too small. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_verify_hash_start() on this object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_verify_hash_complete( - operation: *mut psa_verify_hash_interruptible_operation_t, + /// The operation state is not valid (it must be active, with no IV set), + /// or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_generate_iv( + operation: *mut psa_cipher_operation_t, + iv: *mut u8, + iv_size: usize, + iv_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Abort a verify hash operation. + /// Set the IV for a symmetric encryption or decryption operation. /// - /// \warning This is a beta API, and thus subject to change at - /// any point. It is not bound by the usual interface - /// stability promises. + /// This function sets the IV (initialization vector), nonce + /// or initial counter value for the encryption or decryption operation. /// - /// \note This function is the only function that clears the - /// number of ops completed as part of the operation. - /// Please ensure you copy this value via - /// \c psa_verify_hash_get_num_ops() if required - /// before calling. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note Aborting an operation frees all associated - /// resources except for the operation structure - /// itself. Once aborted, the operation object can be - /// reused for another operation by calling \c - /// psa_verify_hash_start() again. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \note You may call this function any time after the - /// operation object has been initialized. - /// In particular, calling \c psa_verify_hash_abort() - /// after the operation has already been terminated by - /// a call to \c psa_verify_hash_abort() or - /// psa_verify_hash_complete() is safe. + /// \note When encrypting, applications should use psa_cipher_generate_iv() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \param[in,out] operation Initialized verify hash operation. + /// \param[in,out] operation Active cipher operation. + /// \param[in] iv Buffer containing the IV to use. + /// \param iv_length Size of the IV in bytes. /// /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p iv is not acceptable for the chosen algorithm, + /// or the chosen algorithm does not use an IV. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be an active cipher + /// encrypt operation, with no IV set), or the library has not been + /// previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_abort( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_set_iv( + operation: *mut psa_cipher_operation_t, + iv: *const u8, + iv_length: usize, ) -> psa_status_t; } -/// \brief The GCM context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_gcm_context { - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, - ///< Precalculated HTable low. - pub private_HL: [u64; 16usize], - ///< Precalculated HTable high. - pub private_HH: [u64; 16usize], - ///< The total length of the encrypted data. - pub private_len: u64, - ///< The total length of the additional data. - pub private_add_len: u64, - ///< The first ECTR for tag. - pub private_base_ectr: [::core::ffi::c_uchar; 16usize], - ///< The Y working value. - pub private_y: [::core::ffi::c_uchar; 16usize], - ///< The buf working value. - pub private_buf: [::core::ffi::c_uchar; 16usize], - ///< The operation to perform: - ///#MBEDTLS_GCM_ENCRYPT or - ///#MBEDTLS_GCM_DECRYPT. - pub private_mode: ::core::ffi::c_int, -} -impl Default for mbedtls_gcm_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes the specified GCM context, - /// to make references valid, and prepares the context - /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + /// Encrypt or decrypt a message fragment in an active cipher operation. /// - /// The function does not bind the GCM context to a particular - /// cipher, nor set the key. For this purpose, use - /// mbedtls_gcm_setkey(). + /// Before calling this function, you must: + /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + /// (recommended when encrypting) or psa_cipher_set_iv(). /// - /// \param ctx The GCM context to initialize. This must not be \c NULL. - pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief This function associates a GCM context with a - /// cipher algorithm and a key. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param cipher The 128-bit block cipher to use. - /// \param key The encryption key. This must be a readable buffer of at - /// least \p keybits bits. - /// \param keybits The key size in bits. Valid options are: - ///
          • 128 bits
            • - ///
          • 192 bits
            • - ///
          • 256 bits
          + /// \param[in,out] operation Active cipher operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A cipher-specific error code on failure. - pub fn mbedtls_gcm_setkey( - ctx: *mut mbedtls_gcm_context, - cipher: mbedtls_cipher_id_t, - key: *const ::core::ffi::c_uchar, - keybits: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_update( + operation: *mut psa_cipher_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs GCM encryption or decryption of a buffer. + /// Finish encrypting or decrypting a message in a cipher operation. /// - /// \note For encryption, the output buffer can be the same as the - /// input buffer. For decryption, the output buffer cannot be - /// the same as input buffer. If the buffers overlap, the output - /// buffer must trail at least 8 Bytes behind the input buffer. + /// The application must call psa_cipher_encrypt_setup() or + /// psa_cipher_decrypt_setup() before calling this function. The choice + /// of setup function determines whether this function encrypts or + /// decrypts its input. /// - /// \warning When this function performs a decryption, it outputs the - /// authentication tag and does not verify that the data is - /// authentic. You should use this function to perform encryption - /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// This function finishes the encryption or decryption of the message + /// formed by concatenating the inputs passed to preceding calls to + /// psa_cipher_update(). /// - /// \param ctx The GCM context to use for encryption or decryption. This - /// must be initialized. - /// \param mode The operation to perform: - /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. - /// The ciphertext is written to \p output and the - /// authentication tag is written to \p tag. - /// - #MBEDTLS_GCM_DECRYPT to perform decryption. - /// The plaintext is written to \p output and the - /// authentication tag is written to \p tag. - /// Note that this mode is not recommended, because it does - /// not verify the authenticity of the data. For this reason, - /// you should use mbedtls_gcm_auth_decrypt() instead of - /// calling this function in decryption mode. - /// \param length The length of the input data, which is equal to the length - /// of the output data. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param input The buffer holding the input data. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size in Bytes. - /// \param output The buffer for holding the output data. If \p length is greater - /// than zero, this must be a writable buffer of at least that - /// size in Bytes. - /// \param tag_len The length of the tag to generate. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \return \c 0 if the encryption or decryption was performed - /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, - /// this does not indicate that the data is authentic. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the encryption - /// or decryption failed. - pub fn mbedtls_gcm_crypt_and_tag( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - tag_len: usize, - tag: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active cipher operation. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input size passed to this operation is not valid for + /// this particular algorithm. For example, the algorithm is a based + /// on block cipher and requires a whole number of blocks, but the + /// total input size is not a multiple of the block size. + /// \retval #PSA_ERROR_INVALID_PADDING + /// This is a decryption operation for an algorithm that includes + /// padding, and the ciphertext does not contain valid padding. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_finish( + operation: *mut psa_cipher_operation_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs a GCM authenticated decryption of a - /// buffer. + /// Abort a cipher operation. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. /// - /// \param ctx The GCM context. This must be initialized. - /// \param length The length of the ciphertext to decrypt, which is also - /// the length of the decrypted plaintext. - /// \param iv The initialization vector. This must be a readable buffer - /// of at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param tag The buffer holding the tag to verify. This must be a - /// readable buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to verify. - /// \param input The buffer holding the ciphertext. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size. - /// \param output The buffer for holding the decrypted plaintext. If \p length - /// is greater than zero, this must be a writable buffer of at - /// least that size. + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_cipher_operation_t. /// - /// \return \c 0 if successful and authenticated. - /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the decryption - /// failed. - pub fn mbedtls_gcm_auth_decrypt( - ctx: *mut mbedtls_gcm_context, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - tag: *const ::core::ffi::c_uchar, - tag_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// In particular, calling psa_cipher_abort() after the operation has been + /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() + /// is safe and has no effect. + /// + /// \param[in,out] operation Initialized cipher operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a GCM encryption or decryption - /// operation. + /// Process an authenticated encryption operation. /// - /// \param ctx The GCM context. This must be initialized. - /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or - /// #MBEDTLS_GCM_DECRYPT. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that will be authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] plaintext Data that will be authenticated and + /// encrypted. + /// \param plaintext_length Size of \p plaintext in bytes. + /// \param[out] ciphertext Output buffer for the authenticated and + /// encrypted data. The additional data is not + /// part of this output. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate outputs, the + /// authentication tag is appended to the + /// encrypted data. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p plaintext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + /// plaintext_length) evaluates to the maximum + /// ciphertext size of any supported AEAD + /// encryption. + /// \param[out] ciphertext_length On success, the size of the output + /// in the \p ciphertext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_starts( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p ciphertext_size is too small. + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p plaintext_length) or + /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + plaintext: *const u8, + plaintext_length: usize, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer as associated data - /// (authenticated but not encrypted data) in a GCM - /// encryption or decryption operation. - /// - /// Call this function after mbedtls_gcm_starts() to pass - /// the associated data. If the associated data is empty, - /// you do not need to call this function. You may not - /// call this function after calling mbedtls_cipher_update(). + /// Process an authenticated decryption operation. /// - /// \param ctx The GCM context. This must have been started with - /// mbedtls_gcm_starts() and must not have yet received - /// any input with mbedtls_gcm_update(). - /// \param add The buffer holding the additional data, or \c NULL - /// if \p add_len is \c 0. - /// \param add_len The length of the additional data. If \c 0, - /// \p add may be \c NULL. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that has been authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] ciphertext Data that has been authenticated and + /// encrypted. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate inputs, the buffer + /// must contain the encrypted data followed + /// by the authentication tag. + /// \param ciphertext_length Size of \p ciphertext in bytes. + /// \param[out] plaintext Output buffer for the decrypted data. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p ciphertext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + /// ciphertext_length) evaluates to the maximum + /// plaintext size of any supported AEAD + /// decryption. + /// \param[out] plaintext_length On success, the size of the output + /// in the \p plaintext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_update_ad( - ctx: *mut mbedtls_gcm_context, - add: *const ::core::ffi::c_uchar, - add_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The ciphertext is not authentic. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p plaintext_size is too small. + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p ciphertext_length) or + /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + /// to determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + ciphertext: *const u8, + ciphertext_length: usize, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for multipart AEAD operations. +/// +/// Before calling any function on an AEAD operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_aead_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_aead_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, +/// for example: +/// \code +/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_aead_operation_init() +/// to the structure, for example: +/// \code +/// psa_aead_operation_t operation; +/// operation = psa_aead_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing GCM - /// encryption or decryption operation. - /// - /// You may call this function zero, one or more times - /// to pass successive parts of the input: the plaintext to - /// encrypt, or the ciphertext (not including the tag) to - /// decrypt. After the last part of the input, call - /// mbedtls_gcm_finish(). + /// Set the key for a multipart authenticated encryption operation. /// - /// This function may produce output in one of the following - /// ways: - /// - Immediate output: the output length is always equal - /// to the input length. - /// - Buffered output: the output consists of a whole number - /// of 16-byte blocks. If the total input length so far - /// (not including associated data) is 16 \* *B* + *A* - /// with *A* < 16 then the total output length is 16 \* *B*. + /// The sequence of operations to encrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + /// generate or set the nonce. You should use + /// psa_aead_generate_nonce() unless the protocol you are implementing + /// requires a specific nonce value. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the message to encrypt each time. + /// -# Call psa_aead_finish(). /// - /// In particular: - /// - It is always correct to call this function with - /// \p output_size >= \p input_length + 15. - /// - If \p input_length is a multiple of 16 for all the calls - /// to this function during an operation, then it is - /// correct to use \p output_size = \p input_length. + /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// After a successful call to psa_aead_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_finish(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param input The buffer holding the input data. If \p input_length - /// is greater than zero, this must be a readable buffer - /// of at least \p input_length bytes. - /// \param input_length The length of the input data in bytes. - /// \param output The buffer for the output data. If \p output_size - /// is greater than zero, this must be a writable buffer of - /// of at least \p output_size bytes. - /// \param output_size The size of the output buffer in bytes. - /// See the function description regarding the output size. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// total input length too long, - /// unsupported input/output buffer overlap detected, - /// or \p output_size too small. - pub fn mbedtls_gcm_update( - ctx: *mut mbedtls_gcm_context, - input: *const ::core::ffi::c_uchar, - input_length: usize, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the GCM operation and generates - /// the authentication tag. + /// Set the key for a multipart authenticated decryption operation. /// - /// It wraps up the GCM stream, and generates the - /// tag. The tag can have a maximum length of 16 Bytes. + /// The sequence of operations to decrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call psa_aead_set_nonce() with the nonce for the decryption. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the ciphertext to decrypt each time. + /// -# Call psa_aead_verify(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to generate. This must be at least - /// four. - /// \param output The buffer for the final output. - /// If \p output_size is nonzero, this must be a writable - /// buffer of at least \p output_size bytes. - /// \param output_size The size of the \p output buffer in bytes. - /// This must be large enough for the output that - /// mbedtls_gcm_update() has not produced. In particular: - /// - If mbedtls_gcm_update() produces immediate output, - /// or if the total input size is a multiple of \c 16, - /// then mbedtls_gcm_finish() never produces any output, - /// so \p output_size can be \c 0. - /// - \p output_size never needs to be more than \c 15. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// invalid value of \p tag_len, - /// or \p output_size too small. - pub fn mbedtls_gcm_finish( - ctx: *mut mbedtls_gcm_context, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - tag: *mut ::core::ffi::c_uchar, - tag_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function clears a GCM context and the underlying - /// cipher sub-context. + /// After a successful call to psa_aead_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_verify(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context to clear. If this is \c NULL, the call has - /// no effect. Otherwise, this must be initialized. - pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief The GCM checkup routine. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; -/// For encrypt-decrypt functions, whether the operation is an encryption -/// or a decryption. -pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; -/// \brief MD5 context structure -/// -/// \warning MD5 is considered a weak message digest and its use -/// constitutes a security risk. We recommend considering -/// stronger message digests instead. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md5_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 4usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_md5_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize MD5 context + /// Generate a random nonce for an authenticated encryption operation. /// - /// \param ctx MD5 context to be initialized + /// This function generates a random nonce for the authenticated encryption + /// operation with an appropriate size for the chosen algorithm, key type + /// and key size. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief Clear MD5 context + /// The application must call psa_aead_encrypt_setup() before + /// calling this function. /// - /// \param ctx MD5 context to be cleared + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); + /// \param[in,out] operation Active AEAD operation. + /// \param[out] nonce Buffer where the generated nonce is to be + /// written. + /// \param nonce_size Size of the \p nonce buffer in bytes. + /// \param[out] nonce_length On success, the number of bytes of the + /// generated nonce. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p nonce buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active aead encrypt + /// operation, with no nonce set), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_generate_nonce( + operation: *mut psa_aead_operation_t, + nonce: *mut u8, + nonce_size: usize, + nonce_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) an MD5 context + /// Set the nonce for an authenticated encryption or decryption operation. /// - /// \param dst The destination context - /// \param src The context to be cloned + /// This function sets the nonce for the authenticated + /// encryption or decryption operation. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief MD5 context setup + /// The application must call psa_aead_encrypt_setup() or + /// psa_aead_decrypt_setup() before calling this function. /// - /// \param ctx context to be initialized + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \note When encrypting, applications should use psa_aead_generate_nonce() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] nonce Buffer containing the nonce to use. + /// \param nonce_length Size of the nonce in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p nonce is not acceptable for the chosen algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with no nonce + /// set), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_nonce( + operation: *mut psa_aead_operation_t, + nonce: *const u8, + nonce_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process buffer + /// Declare the lengths of the message and additional data for AEAD. /// - /// \param ctx MD5 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// The application must call this function before calling + /// psa_aead_update_ad() or psa_aead_update() if the algorithm for + /// the operation requires it. If the algorithm does not require it, + /// calling this function is optional, but if this function is called + /// then the implementation must enforce the lengths. /// - /// \return 0 if successful + /// You may call this function before or after setting the nonce with + /// psa_aead_set_nonce() or psa_aead_generate_nonce(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_update( - ctx: *mut mbedtls_md5_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief MD5 final digest + /// - For #PSA_ALG_CCM, calling this function is required. + /// - For the other AEAD algorithms defined in this specification, calling + /// this function is not required. + /// - For vendor-defined algorithm, refer to the vendor documentation. /// - /// \param ctx MD5 context - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \param[in,out] operation Active AEAD operation. + /// \param ad_length Size of the non-encrypted additional + /// authenticated data in bytes. + /// \param plaintext_length Size of the plaintext to encrypt in bytes. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_finish( - ctx: *mut mbedtls_md5_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// At least one of the lengths is not acceptable for the chosen + /// algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and + /// psa_aead_update_ad() and psa_aead_update() must not have been + /// called yet), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_lengths( + operation: *mut psa_aead_operation_t, + ad_length: usize, + plaintext_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process data block (internal use only) + /// Pass additional data to an active AEAD operation. /// - /// \param ctx MD5 context - /// \param data buffer holding one block of data + /// Additional data is authenticated, but not encrypted. /// - /// \return 0 if successful + /// You may call this function multiple times to pass successive fragments + /// of the additional data. You may not call this function after passing + /// data to encrypt or decrypt with psa_aead_update(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_internal_md5_process( - ctx: *mut mbedtls_md5_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = MD5( input buffer ) + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + /// treat the input as untrusted and prepare to undo any action that + /// depends on the input if psa_aead_verify() returns an error status. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the fragment of + /// additional data. + /// \param input_length Size of the \p input buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input length overflows the additional data length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, have lengths set if required by the algorithm, and + /// psa_aead_update() must not have been called yet), or the library + /// has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update_ad( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Encrypt or decrypt a message fragment in an active AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + /// 3. Call psa_aead_update_ad() to pass all the additional data. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief RIPEMD-160 context structure -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ripemd160_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 5usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_ripemd160_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize RIPEMD-160 context + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \param ctx RIPEMD-160 context to be initialized - pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); -} -unsafe extern "C" { - /// \brief Clear RIPEMD-160 context + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + /// - Do not use the output in any way other than storing it in a + /// confidential location. If you take any action that depends + /// on the tentative decrypted data, this action will need to be + /// undone if the input turns out not to be valid. Furthermore, + /// if an adversary can observe that this action took place + /// (for example through timing), they may be able to use this + /// fact as an oracle to decrypt any message encrypted with the + /// same key. + /// - In particular, do not copy the output anywhere but to a + /// memory or storage space that you have exclusive access to. /// - /// \param ctx RIPEMD-160 context to be cleared - pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); + /// This function does not require the input to be aligned to any + /// particular block boundary. If the implementation can only process + /// a whole block at a time, it must consume all the input provided, but + /// it may delay the end of the corresponding output until a subsequent + /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + /// provides sufficient input. The amount of data that can be delayed + /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + /// \c alg, \p input_length) where + /// \c key_type is the type of key and \c alg is + /// the algorithm that were used to set up the + /// operation. + /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + /// input_length) evaluates to the maximum + /// output size of any supported AEAD + /// algorithm. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total input length overflows the plaintext length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, and have lengths set if required by the algorithm), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) a RIPEMD-160 context + /// Finish encrypting a message in an AEAD operation. /// - /// \param dst The destination context - /// \param src The context to be cloned - pub fn mbedtls_ripemd160_clone( - dst: *mut mbedtls_ripemd160_context, - src: *const mbedtls_ripemd160_context, - ); -} -unsafe extern "C" { - /// \brief RIPEMD-160 context setup + /// The operation must have been set up with psa_aead_encrypt_setup(). /// - /// \param ctx context to be initialized + /// This function finishes the authentication of the additional data + /// formed by concatenating the inputs passed to preceding calls to + /// psa_aead_update_ad() with the plaintext formed by concatenating the + /// inputs passed to preceding calls to psa_aead_update(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process buffer + /// This function has two output buffers: + /// - \p ciphertext contains trailing ciphertext that was buffered from + /// preceding calls to psa_aead_update(). + /// - \p tag contains the authentication tag. /// - /// \param ctx RIPEMD-160 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_update( - ctx: *mut mbedtls_ripemd160_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[out] ciphertext Buffer where the last part of the ciphertext + /// is to be written. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] ciphertext_length On success, the number of bytes of + /// returned ciphertext. + /// \param[out] tag Buffer where the authentication tag is + /// to be written. + /// \param tag_size Size of the \p tag buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + /// key_type, \c key_bits, \c alg) where + /// \c key_type and \c key_bits are the type and + /// bit-size of the key, and \c alg is the + /// algorithm that were used in the call to + /// psa_aead_encrypt_setup(). + /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + /// maximum tag size of any supported AEAD + /// algorithm. + /// \param[out] tag_length On success, the number of bytes + /// that make up the returned tag. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p ciphertext or \p tag buffer is too small. + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + /// determine the required \p tag buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active encryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_finish( + operation: *mut psa_aead_operation_t, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + tag: *mut u8, + tag_size: usize, + tag_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief RIPEMD-160 final digest + /// Finish authenticating and decrypting a message in an AEAD operation. /// - /// \param ctx RIPEMD-160 context - /// \param output RIPEMD-160 checksum result + /// The operation must have been set up with psa_aead_decrypt_setup(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_finish( - ctx: *mut mbedtls_ripemd160_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process data block (internal use only) + /// This function finishes the authenticated decryption of the message + /// components: /// - /// \param ctx RIPEMD-160 context - /// \param data buffer holding one block of data + /// - The additional data consisting of the concatenation of the inputs + /// passed to preceding calls to psa_aead_update_ad(). + /// - The ciphertext consisting of the concatenation of the inputs passed to + /// preceding calls to psa_aead_update(). + /// - The tag passed to this function call. /// - /// \return 0 if successful - pub fn mbedtls_internal_ripemd160_process( - ctx: *mut mbedtls_ripemd160_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = RIPEMD-160( input buffer ) + /// If the authentication tag is correct, this function outputs any remaining + /// plaintext and reports success. If the authentication tag is not correct, + /// this function returns #PSA_ERROR_INVALID_SIGNATURE. /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output RIPEMD-160 checksum result + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual tag and the expected tag is performed + /// in constant time. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[out] plaintext Buffer where the last part of the plaintext + /// is to be written. This is the remaining data + /// from previous calls to psa_aead_update() + /// that could not be processed until the end + /// of the input. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] plaintext_length On success, the number of bytes of + /// returned plaintext. + /// \param[in] tag Buffer containing the authentication tag. + /// \param tag_length Size of the \p tag buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculations were successful, but the authentication tag is + /// not correct. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p plaintext buffer is too small. + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + /// required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active decryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_verify( + operation: *mut psa_aead_operation_t, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + tag: *const u8, + tag_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Abort an AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed - pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha1_context { - pub work_area: [::core::ffi::c_uchar; 208usize], -} -impl Default for mbedtls_sha1_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_aead_operation_t. + /// + /// In particular, calling psa_aead_abort() after the operation has been + /// terminated by a call to psa_aead_abort(), psa_aead_finish() or + /// psa_aead_verify() is safe and has no effect. + /// + /// \param[in,out] operation Initialized AEAD operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-1 context. - /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \brief Sign a message with a private key. For hash-and-sign algorithms, + /// this includes the hashing step. /// - /// \param ctx The SHA-1 context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-1 context. + /// \note To perform a multi-part hash-and-sign signature algorithm, first use + /// a multi-part hash operation and then pass the resulting hash to + /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + /// hash algorithm to use. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in] key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The input message to sign. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param[in] signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. /// - /// \param ctx The SHA-1 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it is - /// not \c NULL, it must point to an initialized - /// SHA-1 context. - pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-1 context. + /// \brief Verify the signature of a message with a public key, using + /// a hash-and-sign verification algorithm. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \note To perform a multi-part hash-and-sign signature verification + /// algorithm, first use a multi-part hash operation to hash the message + /// and then pass the resulting hash to psa_verify_hash(). + /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + /// to use. /// - /// \param dst The SHA-1 context to clone to. This must be initialized. - /// \param src The SHA-1 context to clone from. This must be initialized. - pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); + /// \param[in] key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The message whose signature is to be verified. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed signature + /// is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-1 checksum calculation. + /// \brief Sign a hash or short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context to initialize. This must be initialized. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. + /// \param[out] signature_length On success, the number of bytes + /// that make up the returned signature value. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing SHA-1 - /// checksum calculation. + /// \brief Verify the signature of a hash or short message using a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. + /// \param key Identifier of the key to use for the operation. It + /// must be a public key or an asymmetric key pair. The + /// key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message whose signature is to be + /// verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_update( - ctx: *mut mbedtls_sha1_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// The signature is valid. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the SHA-1 operation, and writes - /// the result to the output buffer. + /// \brief Encrypt a short message with a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized and - /// have a hash operation started. - /// \param output The SHA-1 checksum result. This must be a writable - /// buffer of length \c 20 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the encrypted message is to + /// be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_finish( - ctx: *mut mbedtls_sha1_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief SHA-1 process data block (internal use only). + /// \brief Decrypt a short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. It must + /// allow the usage #PSA_KEY_USAGE_DECRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized. - /// \param data The data block being processed. This must be a - /// readable buffer of length \c 64 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha1_process( - ctx: *mut mbedtls_sha1_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for key derivation operations. +/// +/// Before calling any function on a key derivation operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_key_derivation_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, +/// for example: +/// \code +/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_key_derivation_operation_init() +/// to the structure, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// operation = psa_key_derivation_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_key_derivation_operation_t = psa_key_derivation_s; unsafe extern "C" { - /// \brief This function calculates the SHA-1 checksum of a buffer. + /// Set up a key derivation operation. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// A key derivation algorithm takes some inputs and uses them to generate + /// a byte stream in a deterministic way. + /// This byte stream can be used to produce keys and other + /// cryptographic material. /// - /// The SHA-1 result is calculated as - /// output = SHA-1(input buffer). + /// To derive a key: + /// -# Start with an initialized object of type #psa_key_derivation_operation_t. + /// -# Call psa_key_derivation_setup() to select the algorithm. + /// -# Provide the inputs for the key derivation by calling + /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + /// as appropriate. Which inputs are needed, in what order, and whether + /// they may be keys and if so of what type depends on the algorithm. + /// -# Optionally set the operation's maximum capacity with + /// psa_key_derivation_set_capacity(). You may do this before, in the middle + /// of or after providing inputs. For some algorithms, this step is mandatory + /// because the output depends on the maximum capacity. + /// -# To derive a key, call psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// To derive a byte string for a different purpose, call + /// psa_key_derivation_output_bytes(). + /// Successive calls to these functions use successive output bytes + /// calculated by the key derivation algorithm. + /// -# Clean up the key derivation operation object with + /// psa_key_derivation_abort(). /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// If this function returns an error, the key derivation operation object is + /// not changed. /// - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. - /// \param output The SHA-1 checksum result. - /// This must be a writable buffer of length \c 20 Bytes. + /// If an error occurs at any step after a call to psa_key_derivation_setup(), + /// the operation will need to be reset by a call to psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-1 checkup routine. + /// Implementations must reject an attempt to derive a key of size 0. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in,out] operation The key derivation operation object + /// to set up. It must + /// have been initialized but not set up yet. + /// \param alg The key derivation algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha256_context { - pub work_area: [::core::ffi::c_uchar; 208usize], - pub is224: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha256_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c alg is not a key derivation algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_setup( + operation: *mut psa_key_derivation_operation_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-256 context. + /// Retrieve the current capacity of a key derivation operation. /// - /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. - pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-256 context. + /// The capacity of a key derivation is the maximum number of bytes that it can + /// return. When you get *N* bytes of output from a key derivation operation, + /// this reduces its capacity by *N*. /// - /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which - /// case this function returns immediately. If it is not \c NULL, - /// it must point to an initialized SHA-256 context. - pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clones the state of a SHA-256 context. + /// \param[in] operation The operation to query. + /// \param[out] capacity On success, the capacity of the operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha256_clone( - dst: *mut mbedtls_sha256_context, - src: *const mbedtls_sha256_context, - ); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_get_capacity( + operation: *const psa_key_derivation_operation_t, + capacity: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-224 or SHA-256 checksum - /// calculation. + /// Set the maximum capacity of a key derivation operation. /// - /// \param ctx The context to use. This must be initialized. - /// \param is224 This determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// The capacity of a key derivation operation is the maximum number of bytes + /// that the key derivation operation can return from this point onwards. /// - /// \note is224 must be defined accordingly to the enabled - /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to modify. + /// \param capacity The new capacity of the operation. + /// It must be less or equal to the operation's + /// current capacity. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_starts( - ctx: *mut mbedtls_sha256_context, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p capacity is larger than the operation's current capacity. + /// In this case, the operation object remains valid and its capacity + /// remains unchanged. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_set_capacity( + operation: *mut psa_key_derivation_operation_t, + capacity: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-256 checksum calculation. + /// Provide an input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_update( - ctx: *mut mbedtls_sha256_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-256 operation, and writes - /// the result to the output buffer. + /// This function passes direct inputs, which is usually correct for + /// non-secret inputs. To pass a secret input, which should be in a key + /// object, call psa_key_derivation_input_key() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_finish( - ctx: *mut mbedtls_sha256_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] data Input data to use. + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow direct inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_bytes( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + data: *const u8, + data_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-256 computation. This function is for - /// internal use only. + /// Provide a numeric input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized. - /// \param data The buffer holding one block of data. This must - /// be a readable buffer of length \c 64 Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// However, when an algorithm requires a particular order, numeric inputs + /// usually come first as they tend to be configuration parameters. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha256_process( - ctx: *mut mbedtls_sha256_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// This function is used for inputs which are fixed-size non-negative + /// integers. + /// + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] value The value of the numeric input. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow numeric inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_integer( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + value: u64, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function calculates the SHA-224 or SHA-256 - /// checksum of a buffer. + /// Provide an input for key derivation in the form of a key. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// The SHA-256 result is calculated as - /// output = SHA-256(input buffer). + /// This function obtains input from a key object, which is usually correct for + /// secret inputs or for non-secret personalization strings kept in the key + /// store. To pass a non-secret parameter which is not in the key store, + /// call psa_key_derivation_input_bytes() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. - /// \param is224 Determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param key Identifier of the key. It must have an + /// appropriate type for step and must allow the + /// usage #PSA_KEY_USAGE_DERIVE or + /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + /// and the algorithm used by the operation. + /// + /// \note Once all inputs steps are completed, the operations will allow: + /// - psa_key_derivation_output_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + /// if the input for step + /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_verify_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + /// - psa_key_derivation_verify_key() under the same conditions as + /// psa_key_derivation_verify_bytes(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key allows neither #PSA_KEY_USAGE_DERIVE nor + /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + /// algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow key inputs of the given type + /// or does not allow key inputs at all. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_key( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + key: mbedtls_svc_key_id_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief The SHA-224 checkup routine. + /// Perform a key agreement and use the shared secret as input to a key + /// derivation. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-256 checkup routine. + /// A key agreement algorithm takes two inputs: a private key \p private_key + /// a public key \p peer_key. + /// The result of this function is passed as input to a key derivation. + /// The output of this key derivation can be extracted by reading from the + /// resulting operation to produce keys and other cryptographic material. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha512_context { - pub work_area: [::core::ffi::c_uchar; 304usize], - pub is384: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha512_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief This function initializes a SHA-512 context. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \param ctx The SHA-512 context to initialize. This must - /// not be \c NULL. - pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-512 context. + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() with a + /// key agreement and derivation algorithm + /// \c alg (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + /// is false). + /// The operation must be ready for an + /// input of the type given by \p step. + /// \param step Which step the input data is for. + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. The peer key must be in the + /// same format that psa_import_key() accepts for the + /// public key type corresponding to the type of + /// private_key. That is, this function performs the + /// equivalent of + /// #psa_import_key(..., + /// `peer_key`, `peer_key_length`) where + /// with key attributes indicating the public key + /// type corresponding to the type of `private_key`. + /// For example, for EC keys, this means that peer_key + /// is interpreted as a point on the curve that the + /// private key is on. The standard formats for public + /// keys are documented in the documentation of + /// psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. /// - /// \param ctx The SHA-512 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must point to an initialized - /// SHA-512 context. - pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c private_key is not compatible with \c alg, + /// or \p peer_key is not valid for \c alg or not compatible with + /// \c private_key, or \c step does not allow an input resulting + /// from a key agreement. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this key agreement \p step, + /// or the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_key_agreement( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-512 context. + /// Read some data from a key derivation operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha512_clone( - dst: *mut mbedtls_sha512_context, - src: *const mbedtls_sha512_context, - ); -} -unsafe extern "C" { - /// \brief This function starts a SHA-384 or SHA-512 checksum - /// calculation. + /// This function calculates output bytes from a key derivation algorithm and + /// return those bytes. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the requested number of bytes from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context to use. This must be initialized. - /// \param is384 Determines which function to use. This must be - /// either \c 0 for SHA-512, or \c 1 for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \note is384 must be defined accordingly to the enabled - /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] output Buffer where the output will be written. + /// \param output_length Number of bytes to output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_starts( - ctx: *mut mbedtls_sha512_context, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// no output is written to the output buffer. + /// The operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_bytes( + operation: *mut psa_key_derivation_operation_t, + output: *mut u8, + output_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-512 checksum calculation. + /// Derive a key from an ongoing key derivation operation. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. This must - /// be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// This function calculates output bytes from a key derivation algorithm + /// and uses those bytes to generate a key deterministically. + /// The key's location, usage policy, type and size are taken from + /// \p attributes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_update( - ctx: *mut mbedtls_sha512_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-512 operation, and writes - /// the result to the output buffer. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads as many bytes as required from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_finish( - ctx: *mut mbedtls_sha512_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-512 computation. - /// This function is for internal use only. + /// How much output is produced and consumed from the operation, and how + /// the key is derived, depends on the key type and on the key size + /// (denoted \c bits below): /// - /// \param ctx The SHA-512 context. This must be initialized. - /// \param data The buffer holding one block of data. This - /// must be a readable buffer of length \c 128 Bytes. + /// - For key types for which the key is an arbitrary sequence of bytes + /// of a given size, this function is functionally equivalent to + /// calling #psa_key_derivation_output_bytes + /// and passing the resulting output to #psa_import_key. + /// However, this function has a security benefit: + /// if the implementation provides an isolation boundary then + /// the key material is not exposed outside the isolation boundary. + /// As a consequence, for these key types, this function always consumes + /// exactly (\c bits / 8) bytes from the operation. + /// The following key types defined in this specification follow this scheme: /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha512_process( - ctx: *mut mbedtls_sha512_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function calculates the SHA-512 or SHA-384 - /// checksum of a buffer. + /// - #PSA_KEY_TYPE_AES; + /// - #PSA_KEY_TYPE_ARIA; + /// - #PSA_KEY_TYPE_CAMELLIA; + /// - #PSA_KEY_TYPE_DERIVE; + /// - #PSA_KEY_TYPE_HMAC; + /// - #PSA_KEY_TYPE_PASSWORD_HASH. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// - For ECC keys on a Montgomery elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Montgomery curve), this function always draws a byte string whose + /// length is determined by the curve, and sets the mandatory bits + /// accordingly. That is: /// - /// The SHA-512 result is calculated as - /// output = SHA-512(input buffer). + /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + /// string and process it as specified in RFC 7748 §5. + /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + /// string and process it as specified in RFC 7748 §5. /// - /// \param input The buffer holding the input data. This must be - /// a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. - /// \param is384 Determines which function to use. This must be either - /// \c 0 for SHA-512, or \c 1 for SHA-384. + /// - For key types for which the key is represented by a single sequence of + /// \c bits bits with constraints as to which bit sequences are acceptable, + /// this function draws a byte string of length (\c bits / 8) bytes rounded + /// up to the nearest whole number of bytes. If the resulting byte string + /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + /// This process is repeated until an acceptable byte string is drawn. + /// The byte string drawn from the operation is interpreted as specified + /// for the output produced by psa_export_key(). + /// The following key types defined in this specification follow this scheme: /// - /// \note is384 must be defined accordingly with the supported - /// symbols in the config file. If: - /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or - /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined - /// then the function will return - /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// - #PSA_KEY_TYPE_DES. + /// Force-set the parity bits, but discard forbidden weak keys. + /// For 2-key and 3-key triple-DES, the three keys are generated + /// successively (for example, for 3-key triple-DES, + /// if the first 8 bytes specify a weak key and the next 8 bytes do not, + /// discard the first 8 bytes, use the next 8 bytes as the first key, + /// and continue reading output from the operation to derive the other + /// two keys). + /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + /// where \c group designates any Diffie-Hellman group) and + /// ECC keys on a Weierstrass elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Weierstrass curve). + /// For these key types, interpret the byte string as integer + /// in big-endian order. Discard it if it is not in the range + /// [0, *N* - 2] where *N* is the boundary of the private key domain + /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + /// or the order of the curve's base point for ECC). + /// Add 1 to the resulting integer and use this as the private key *x*. + /// This method allows compliance to NIST standards, specifically + /// the methods titled "key-pair generation by testing candidates" + /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + /// in FIPS 186-4 §B.1.2 for DSA, and + /// in NIST SP 800-56A §5.6.1.2.2 or + /// FIPS 186-4 §B.4.2 for elliptic curve keys. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-384 checkup routine. + /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + /// the way in which the operation output is consumed is + /// implementation-defined. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-512 checkup routine. + /// In all cases, the data that is read is discarded from the operation. + /// The operation's capacity is decreased by the number of bytes read. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hash_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub md5: mbedtls_md5_context, - pub ripemd160: mbedtls_ripemd160_context, - pub sha1: mbedtls_sha1_context, - pub sha256: mbedtls_sha256_context, - pub sha512: mbedtls_sha512_context, -} -impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_hash_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_cipher_operation_t { - pub private_alg: psa_algorithm_t, - pub private_iv_length: u8, - pub private_block_length: u8, - pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_cipher: mbedtls_cipher_context_t, -} -impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_cipher_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_hash_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_hash_operation_t, -} -impl Default for psa_driver_hash_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_cipher_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, -} -impl Default for psa_driver_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_hash_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h. - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. the driver context is not active, in use). - pub private_id: ::core::ffi::c_uint, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_hash_context_t, -} -impl Default for psa_hash_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_cipher_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_default_iv_length: u8, - pub private_ctx: psa_driver_cipher_context_t, + /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + /// the input to that step must be provided with psa_key_derivation_input_key(). + /// Future versions of this specification may include additional restrictions + /// on the derived key based on the attributes and strength of the secret key. + /// + /// \note This function is equivalent to calling + /// psa_key_derivation_output_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for psa_cipher_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// See the description of psa_key_derivation_out_key() for the operation of + /// this function with the default production parameters. + /// Mbed TLS currently does not currently support any non-default production + /// parameters. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_custom( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl psa_cipher_operation_s { - #[inline] - pub fn private_iv_required(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_iv_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_iv_required: ::core::ffi::c_uint, - private_iv_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; - private_iv_required as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; - private_iv_set as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] params Customization parameters for the key derivation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// Mbed TLS currently only supports the default + /// production parameters, i.e. + /// #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + /// for all key types. + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_ext( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hmac_operation_t { - /// The HMAC algorithm in use - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - /// The hash context. - pub hash_ctx: psa_hash_operation_s, - /// The HMAC part of the context. - pub private_opad: [u8; 128usize], +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value in constant time. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the expected number of bytes from the + /// stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to the following code: + /// \code + /// psa_key_derivation_output_bytes(operation, tmp, output_length); + /// if (memcmp(output, tmp, output_length) != 0) + /// return PSA_ERROR_INVALID_SIGNATURE; + /// \endcode + /// except (1) it works even if the key's policy does not allow outputting the + /// bytes, and (2) the comparison will be done in constant time. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected Buffer containing the expected derivation output. + /// \param expected_length Length of the expected output; this is also the + /// number of bytes that will be read. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but it differs from the expected + /// output. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_bytes( + operation: *mut psa_key_derivation_operation_t, + expected: *const u8, + expected_length: usize, + ) -> psa_status_t; } -impl Default for mbedtls_psa_hmac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value + /// stored in a key object. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value, provided as key of type + /// #PSA_KEY_TYPE_PASSWORD_HASH. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the number of bytes corresponding to the + /// length of the expected value from the stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to exporting the key and calling + /// psa_key_derivation_verify_bytes() on the result, except that it + /// works even if the key cannot be exported. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + /// containing the expected output. Its policy must + /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + /// and the permitted algorithm must match the + /// operation. The value of this key was likely + /// computed by a previous call to + /// psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but if differs from the expected + /// output. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// The key passed as the expected value does not exist. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key passed as the expected value has an invalid type. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key passed as the expected value does not allow this usage or + /// this algorithm; or one of the inputs was a key whose policy didn't + /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// the length of the expected value. In this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_key( + operation: *mut psa_key_derivation_operation_t, + expected: psa_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_mac_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// Abort a key derivation operation. + /// + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_key_derivation_setup() again. + /// + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_key_derivation_operation_t. + /// + /// In particular, it is valid to call psa_key_derivation_abort() twice, or to + /// call psa_key_derivation_abort() on an operation that has not been set up. + /// + /// \param[in,out] operation The operation to abort. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) + -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_hmac: mbedtls_psa_hmac_operation_t, - pub private_cmac: mbedtls_cipher_context_t, +unsafe extern "C" { + /// Perform a key agreement and return the raw shared secret. + /// + /// \warning The raw result of a key agreement algorithm such as finite-field + /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + /// not be used directly as key material. It should instead be passed as + /// input to a key derivation algorithm. To chain a key agreement with + /// a key derivation, use psa_key_derivation_key_agreement() and other + /// functions from the key derivation interface. + /// + /// \param alg The key agreement algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + /// is true). + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. It must be + /// in the same format that psa_import_key() + /// accepts. The standard formats for public + /// keys are documented in the documentation + /// of psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a key agreement algorithm, or + /// \p private_key is not compatible with \p alg, + /// or \p peer_key is not valid for \p alg or not compatible with + /// \p private_key. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p output_size is too small + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not a supported key agreement algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_raw_key_agreement( + alg: psa_algorithm_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Generate random bytes. + /// + /// \warning This function **can** fail! Callers MUST check the return status + /// and MUST NOT use the content of the output buffer if the return + /// status is not #PSA_SUCCESS. + /// + /// \note To generate a key, use psa_generate_key() instead. + /// + /// \param[out] output Output buffer for the generated data. + /// \param output_size Number of bytes to generate and output. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair. + /// + /// The key is generated randomly. + /// Its location, usage policy, type and size are taken from \p attributes. + /// + /// Implementations must reject an attempt to generate a key of size 0. + /// + /// The following type-specific considerations apply: + /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + /// the public exponent is 65537. + /// The modulus is a product of two probabilistic primes + /// between 2^{n-1} and 2^n where n is the bit size specified in the + /// attributes. + /// + /// \note This function is equivalent to calling psa_generate_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key( + attributes: *const psa_key_attributes_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// See the description of psa_generate_key() for the operation of this + /// function with the default production parameters. In addition, this function + /// supports the following production customizations, described in more detail + /// in the documentation of ::psa_custom_key_parameters_t: + /// + /// - RSA keys: generation with a custom public exponent. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_custom( + attributes: *const psa_key_attributes_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_aead_operation_t { - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_tag_length: u8, - pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] params Customization parameters for the key generation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_ext( + attributes: *const psa_key_attributes_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub private_ccm: mbedtls_ccm_context, - pub private_gcm: mbedtls_gcm_context, - pub private_chachapoly: mbedtls_chachapoly_context, +/// The type of the state data structure for interruptible hash +/// signing operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = +/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_sign_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// operation = psa_sign_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; +/// The type of the state data structure for interruptible hash +/// verification operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = +/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_verify_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// operation = psa_verify_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; +unsafe extern "C" { + /// \brief Set the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note The time taken to execute a single op is + /// implementation specific and depends on + /// software, hardware, the algorithm, key type and + /// curve chosen. Even within a single operation, + /// successive ops can take differing amounts of + /// time. The only guarantee is that lower values + /// for \p max_ops means functions will block for a + /// lesser maximum amount of time. The functions + /// \c psa_sign_interruptible_get_num_ops() and + /// \c psa_verify_interruptible_get_num_ops() are + /// provided to help with tuning this value. + /// + /// \note This value defaults to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + /// means the whole operation will be done in one + /// go, regardless of the number of ops required. + /// + /// \note If more ops are needed to complete a + /// computation, #PSA_OPERATION_INCOMPLETE will be + /// returned by the function performing the + /// computation. It is then the caller's + /// responsibility to either call again with the + /// same operation context until it returns 0 or an + /// error code; or to call the relevant abort + /// function if the answer is no longer required. + /// + /// \note The interpretation of \p max_ops is also + /// implementation defined. On a hard real time + /// system, this can indicate a hard deadline, as a + /// real-time system needs a guarantee of not + /// spending more than X time, however care must be + /// taken in such an implementation to avoid the + /// situation whereby calls just return, not being + /// able to do any actual work within the allotted + /// time. On a non-real-time system, the + /// implementation can be more relaxed, but again + /// whether this number should be interpreted as as + /// hard or soft limit or even whether a less than + /// or equals as regards to ops executed in a + /// single call is implementation defined. + /// + /// \note For keys in local storage when no accelerator + /// driver applies, please see also the + /// documentation for \c mbedtls_ecp_set_max_ops(), + /// which is the internal implementation in these + /// cases. + /// + /// \warning With implementations that interpret this number + /// as a hard limit, setting this number too small + /// may result in an infinite loop, whereby each + /// call results in immediate return with no ops + /// done (as there is not enough time to execute + /// any), and thus no result will ever be achieved. + /// + /// \note This only applies to functions whose + /// documentation mentions they may return + /// #PSA_OPERATION_INCOMPLETE. + /// + /// \param max_ops The maximum number of ops to be executed in a + /// single call. This can be a number from 0 to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + /// is the least amount of work done per call. + pub fn psa_interruptible_set_max_ops(max_ops: u32); } -impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. This will return the last + /// value set by + /// \c psa_interruptible_set_max_ops() or + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + /// that function has never been called. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \return Maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + pub fn psa_interruptible_get_max_ops() -> u32; } -impl Default for mbedtls_psa_aead_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash signing + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling + /// \c psa_sign_hash_interruptible_abort() on + /// the operation, a value of 0 will be returned. + /// + /// \note This interface is guaranteed re-entrant and + /// thus may be called from driver code. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_sign_hash_get_num_ops( + operation: *const psa_sign_hash_interruptible_operation_t, + ) -> u32; } -impl mbedtls_psa_aead_operation_t { - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash verification + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling \c + /// psa_verify_hash_interruptible_abort() on the + /// operation, a value of 0 will be returned. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c + /// psa_verify_hash_interruptible_operation_t to + /// use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_verify_hash_get_num_ops( + operation: *const psa_verify_hash_interruptible_operation_t, + ) -> u32; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_sign_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Start signing a hash or short message with a + /// private key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_complete() is equivalent to + /// \c psa_sign_hash() but + /// \c psa_sign_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call \c psa_sign_hash_complete() + /// repeatedly on the same context after a + /// successful call to this function until \c + /// psa_sign_hash_complete() either returns 0 or an + /// error. \c psa_sign_hash_complete() will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - call \c psa_sign_hash_complete() + /// with the same context to complete the operation + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + /// not permit the requested algorithm. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation has previously been started on this context, and is + /// still in progress. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_start( + operation: *mut psa_sign_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_verify_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Continue and eventually complete the action of + /// signing a hash or short message with a private + /// key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_start() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_start() is equivalent to + /// \c psa_sign_hash() but this function can return + /// early and resume according to the limit set with + /// \c psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_sign_hash_start() called with it + /// first. + /// + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + /// key_bits, \c alg) where \c key_type and \c + /// key_bits are the type and bit-size + /// respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. + /// + /// \retval #PSA_SUCCESS + /// Operation completed successfully + /// + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \c key. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_sign_hash_start(). + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_sign_hash_start() with this operation object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_sign_hash_complete( + operation: *mut psa_sign_hash_interruptible_operation_t, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } -///< Client -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; -///< Server -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; -/// Roles in the EC J-PAKE exchange -pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; -/// EC J-PAKE context structure. -/// -/// J-PAKE is a symmetric protocol, except for the identifiers used in -/// Zero-Knowledge Proofs, and the serialization of the second message -/// (KeyExchange) as defined by the Thread spec. -/// -/// In order to benefit from this symmetry, we choose a different naming -/// convention from the Thread v1.0 spec. Correspondence is indicated in the -/// description as a pair C: client name, S: server name -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecjpake_context { - ///< Hash to use - pub private_md_type: mbedtls_md_type_t, - ///< Elliptic curve - pub private_grp: mbedtls_ecp_group, - ///< Are we client or server? - pub private_role: mbedtls_ecjpake_role, - ///< Format for point export - pub private_point_format: ::core::ffi::c_int, - ///< My public key 1 C: X1, S: X3 - pub private_Xm1: mbedtls_ecp_point, - ///< My public key 2 C: X2, S: X4 - pub private_Xm2: mbedtls_ecp_point, - ///< Peer public key 1 C: X3, S: X1 - pub private_Xp1: mbedtls_ecp_point, - ///< Peer public key 2 C: X4, S: X2 - pub private_Xp2: mbedtls_ecp_point, - ///< Peer public key C: Xs, S: Xc - pub private_Xp: mbedtls_ecp_point, - ///< My private key 1 C: x1, S: x3 - pub private_xm1: mbedtls_mpi, - ///< My private key 2 C: x2, S: x4 - pub private_xm2: mbedtls_mpi, - ///< Pre-shared secret (passphrase) - pub private_s: mbedtls_mpi, +unsafe extern "C" { + /// \brief Abort a sign hash operation. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function is the only function that clears + /// the number of ops completed as part of the + /// operation. Please ensure you copy this value via + /// \c psa_sign_hash_get_num_ops() if required + /// before calling. + /// + /// \note Aborting an operation frees all associated + /// resources except for the \p operation structure + /// itself. Once aborted, the operation object can + /// be reused for another operation by calling \c + /// psa_sign_hash_start() again. + /// + /// \note You may call this function any time after the + /// operation object has been initialized. In + /// particular, calling \c psa_sign_hash_abort() + /// after the operation has already been terminated + /// by a call to \c psa_sign_hash_abort() or + /// psa_sign_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized sign hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_abort( + operation: *mut psa_sign_hash_interruptible_operation_t, + ) -> psa_status_t; } -impl Default for mbedtls_ecjpake_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Start reading and verifying a hash or short + /// message, in an interruptible manner. + /// + /// \see \c psa_verify_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_verify_hash_complete() is equivalent to + /// \c psa_verify_hash() but \c + /// psa_verify_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function. + /// + /// \note Users should call \c psa_verify_hash_complete() + /// repeatedly on the same operation object after a + /// successful call to this function until \c + /// psa_verify_hash_complete() either returns 0 or + /// an error. \c psa_verify_hash_complete() will + /// return #PSA_OPERATION_INCOMPLETE if there is + /// more work to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_verify_hash_abort(). + /// + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash whose signature is to be verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - please call \c + /// psa_verify_hash_complete() with the same context to complete the + /// operation. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// Another operation has already been started on this context, and is + /// still in progress. + /// + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + /// not permit the requested algorithm. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_start( + operation: *mut psa_verify_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize an ECJPAKE context. + /// \brief Continue and eventually complete the action of + /// reading and verifying a hash or short message + /// signed with a private key, in an interruptible + /// manner. /// - /// \param ctx The ECJPAKE context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); -} -unsafe extern "C" { - /// \brief Set up an ECJPAKE context for use. + /// \see \c psa_verify_hash_start() /// - /// \note Currently the only values for hash/curve allowed by the - /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. /// - /// \param ctx The ECJPAKE context to set up. This must be initialized. - /// \param role The role of the caller. This must be either - /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. - /// \param hash The identifier of the hash function to use, - /// for example #MBEDTLS_MD_SHA256. - /// \param curve The identifier of the elliptic curve to use, - /// for example #MBEDTLS_ECP_DP_SECP256R1. - /// \param secret The pre-shared secret (passphrase). This must be - /// a readable not empty buffer of length \p len Bytes. It need - /// only be valid for the duration of this call. - /// \param len The length of the pre-shared secret \p secret. + /// \note This function combined with \c + /// psa_verify_hash_start() is equivalent to + /// \c psa_verify_hash() but this function can + /// return early and resume according to the limit + /// set with \c psa_interruptible_set_max_ops() to + /// reduce the maximum time spent in a function + /// call. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_setup( - ctx: *mut mbedtls_ecjpake_context, - role: mbedtls_ecjpake_role, - hash: mbedtls_md_type_t, - curve: mbedtls_ecp_group_id, - secret: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the point format for future reads and writes. + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. /// - /// \param ctx The ECJPAKE context to configure. - /// \param point_format The point format to use: - /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) - /// or #MBEDTLS_ECP_PF_COMPRESSED. + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_verify_hash_abort(). /// - /// \return \c 0 if successful. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format - /// is invalid. - pub fn mbedtls_ecjpake_set_point_format( - ctx: *mut mbedtls_ecjpake_context, - point_format: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if an ECJPAKE context is ready for use. + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_verify_hash_start() called with it + /// first. /// - /// \param ctx The ECJPAKE context to check. This must be - /// initialized. + /// \retval #PSA_SUCCESS + /// Operation completed successfully, and the passed signature is valid. /// - /// \return \c 0 if the context is ready for use. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. - pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_verify_hash_start(). + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_verify_hash_start() on this object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_verify_hash_complete( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate and write the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \brief Abort a verify hash operation. /// - /// \param ctx The ECJPAKE context to use. This must be - /// initialized and set up. - /// \param buf The buffer to write the contents to. This must be a - /// writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number - /// of Bytes written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \warning This is a beta API, and thus subject to change at + /// any point. It is not bound by the usual interface + /// stability promises. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Read and process the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \note This function is the only function that clears the + /// number of ops completed as part of the operation. + /// Please ensure you copy this value via + /// \c psa_verify_hash_get_num_ops() if required + /// before calling. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up. - /// \param buf The buffer holding the first round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// \note Aborting an operation frees all associated + /// resources except for the operation structure + /// itself. Once aborted, the operation object can be + /// reused for another operation by calling \c + /// psa_verify_hash_start() again. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \note You may call this function any time after the + /// operation object has been initialized. + /// In particular, calling \c psa_verify_hash_abort() + /// after the operation has already been terminated by + /// a call to \c psa_verify_hash_abort() or + /// psa_verify_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized verify hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_abort( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } +pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// \brief Generate and write the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Open a handle to an existing persistent key. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up, and already have performed round one. - /// \param buf The buffer to write the round two contents to. - /// This must be a writable buffer of length \p len Bytes. - /// \param len The size of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Open a handle to a persistent key. A key is persistent if it was created + /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + /// always has a nonzero key identifier, set with psa_set_key_id() when + /// creating the key. Implementations may provide additional pre-provisioned + /// keys that can be opened with psa_open_key(). Such keys have an application + /// key identifier in the vendor range, as documented in the description of + /// #psa_key_id_t. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// The application must eventually close the handle with psa_close_key() or + /// psa_destroy_key() to release associated resources. If the application dies + /// without calling one of these functions, the implementation should perform + /// the equivalent of a call to psa_close_key(). + /// + /// Some implementations permit an application to open the same key multiple + /// times. If this is successful, each call to psa_open_key() will return a + /// different key handle. + /// + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. + /// + /// \note Applications that rely on opening a key multiple times will not be + /// portable to implementations that only permit a single key handle to be + /// opened. See also :ref:\`key-handles\`. + /// + /// + /// \param key The persistent identifier of the key. + /// \param[out] handle On success, a handle to the key. + /// + /// \retval #PSA_SUCCESS + /// Success. The application can now use the value of `*handle` + /// to access the key. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY + /// The implementation does not have sufficient resources to open the + /// key. This can be due to reaching an implementation limit on the + /// number of open keys, the number of open key handles, or available + /// memory. + /// \retval #PSA_ERROR_DOES_NOT_EXIST + /// There is no persistent key with key identifier \p key. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid persistent key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The specified key exists, but the application does not have the + /// permission to access it. Note that this specification does not + /// define any way to create such a key, but it may be possible + /// through implementation-specific means. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Read and process the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Close a key handle. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up and already have performed round one. - /// \param buf The buffer holding the second round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// If the handle designates a volatile key, this will destroy the key material + /// and free all associated resources, just like psa_destroy_key(). /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Derive the shared secret - /// (TLS: Pre-Master Secret). + /// If this is the last open handle to a persistent key, then closing the handle + /// will free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and can be opened again later + /// with a call to psa_open_key(). /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Closing the key handle makes the handle invalid, and the key handle + /// must not be used again by the application. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_derive_secret( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write the shared key material to be passed to a Key - /// Derivation Function as described in RFC8236. + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \note If the key handle was used to set up an active + /// :ref:\`multipart operation \`, then closing the + /// key handle can cause the multipart operation to fail. Applications should + /// maintain the key handle until after the multipart operation has finished. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_shared_key( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This clears an ECJPAKE context and frees any - /// embedded data structure. + /// \param handle The key handle to close. + /// If this is \c 0, do nothing and return \c PSA_SUCCESS. /// - /// \param ctx The ECJPAKE context to free. This may be \c NULL, - /// in which case this function does nothing. If it is not - /// \c NULL, it must point to an initialized ECJPAKE context. - pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); + /// \retval #PSA_SUCCESS + /// \p handle was a valid handle or \c 0. It is now closed. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p handle is not a valid handle nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// \brief Library deinitialization. /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_pake_operation_t { - pub private_alg: psa_algorithm_t, - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: u8, - pub private_buffer: [u8; 336usize], - pub private_buffer_length: usize, - pub private_buffer_offset: usize, - pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_jpake: mbedtls_ecjpake_context, -} -impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_pake_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_mac_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_mac_operation_t, -} -impl Default for psa_driver_mac_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_aead_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_aead_operation_t, -} -impl Default for psa_driver_aead_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_sign_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, -} -impl Default for psa_driver_sign_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_verify_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, -} -impl Default for psa_driver_verify_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_pake_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_pake_operation_t, -} -impl Default for psa_driver_pake_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// This function clears all data associated with the PSA layer, + /// including the whole key store. + /// This function is not thread safe, it wipes every key slot regardless of + /// state and reader count. It should only be called when no slot is in use. + /// + /// This is an Mbed TLS extension. + pub fn mbedtls_psa_crypto_free(); } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. #[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_mac_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_mac_size: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_mac_context_t, +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_stats_s { + /// Number of slots containing key material for a volatile key. + pub private_volatile_slots: usize, + /// Number of slots containing key material for a key which is in + /// internal persistent storage. + pub private_persistent_slots: usize, + /// Number of slots containing a reference to a key in a + /// secure element. + pub private_external_slots: usize, + /// Number of slots which are occupied, but do not contain + /// key material yet. + pub private_half_filled_slots: usize, + /// Number of slots that contain cache data. + pub private_cache_slots: usize, + /// Number of slots that are not used for anything. + pub private_empty_slots: usize, + /// Number of slots that are locked. + pub private_locked_slots: usize, + /// Largest key id value among open keys in internal persistent storage. + pub private_max_open_internal_key_id: psa_key_id_t, + /// Largest key id value among open keys in secure elements. + pub private_max_open_external_key_id: psa_key_id_t, } -impl Default for psa_mac_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. +pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; +unsafe extern "C" { + /// \brief Get statistics about + /// resource consumption related to the PSA keystore. + /// + /// \note When Mbed TLS is built as part of a service, with isolation + /// between the application and the keystore, the service may or + /// may not expose this function. + pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); } -impl psa_mac_operation_s { - #[inline] - pub fn private_is_sign(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_sign: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; - private_is_sign as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Inject an initial entropy seed for the random generator into + /// secure storage. + /// + /// This function injects data to be used as a seed for the random generator + /// used by the PSA Crypto implementation. On devices that lack a trusted + /// entropy source (preferably a hardware random number generator), + /// the Mbed PSA Crypto implementation uses this value to seed its + /// random generator. + /// + /// On devices without a trusted entropy source, this function must be + /// called exactly once in the lifetime of the device. On devices with + /// a trusted entropy source, calling this function is optional. + /// In all cases, this function may only be called before calling any + /// other function in the PSA Crypto API, including psa_crypto_init(). + /// + /// When this function returns successfully, it populates a file in + /// persistent storage. Once the file has been created, this function + /// can no longer succeed. + /// + /// If any error occurs, this function does not change the system state. + /// You can call this function again after correcting the reason for the + /// error if possible. + /// + /// \warning This function **can** fail! Callers MUST check the return status. + /// + /// \warning If you use this function, you should use it as part of a + /// factory provisioning process. The value of the injected seed + /// is critical to the security of the device. It must be + /// *secret*, *unpredictable* and (statistically) *unique per device*. + /// You should be generate it randomly using a cryptographically + /// secure random generator seeded from trusted entropy sources. + /// You should transmit it securely to the device and ensure + /// that its value is not leaked or stored anywhere beyond the + /// needs of transmitting it from the point of generation to + /// the call of this function, and erase all copies of the value + /// once this function returns. + /// + /// This is an Mbed TLS extension. + /// + /// \note This function is only available on the following platforms: + /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + /// Note that you must provide compatible implementations of + /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. + /// * In a client-server integration of PSA Cryptography, on the client side, + /// if the server supports this feature. + /// \param[in] seed Buffer containing the seed value to inject. + /// \param[in] seed_size Size of the \p seed buffer. + /// The size of the seed in bytes must be greater + /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + /// in `library/entropy_poll.h` in the Mbed TLS source + /// code. + /// It must be less or equal to + /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + /// + /// \retval #PSA_SUCCESS + /// The seed value was injected successfully. The random generator + /// of the PSA Crypto implementation is now ready for use. + /// You may now call psa_crypto_init() and use the PSA Crypto + /// implementation. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p seed_size is out of range. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// There was a failure reading or writing from storage. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The library has already been initialized. It is no longer + /// possible to call this function. + pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_aead_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub private_ad_remaining: usize, - pub private_body_remaining: usize, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_ctx: psa_driver_aead_context_t, +unsafe extern "C" { + /// External random generator function, implemented by the platform. + /// + /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + /// this function replaces Mbed TLS's entropy and DRBG modules for all + /// random generation triggered via PSA crypto interfaces. + /// + /// \note This random generator must deliver random numbers with cryptographic + /// quality and high performance. It must supply unpredictable numbers + /// with a uniform distribution. The implementation of this function + /// is responsible for ensuring that the random generator is seeded + /// with sufficient entropy. If you have a hardware TRNG which is slow + /// or delivers non-uniform output, declare it as an entropy source + /// with mbedtls_entropy_add_source() instead of enabling this option. + /// + /// \param[in,out] context Pointer to the random generator context. + /// This is all-bits-zero on the first call + /// and preserved between successive calls. + /// \param[out] output Output buffer. On success, this buffer + /// contains random data with a uniform + /// distribution. + /// \param output_size The size of the \p output buffer in bytes. + /// \param[out] output_length On success, set this value to \p output_size. + /// + /// \retval #PSA_SUCCESS + /// Success. The output buffer contains \p output_size bytes of + /// cryptographic-quality random data, and \c *output_length is + /// set to \p output_size. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + /// The random generator requires extra entropy and there is no + /// way to obtain entropy under current environment conditions. + /// This error should not happen under normal circumstances since + /// this function is responsible for obtaining as much entropy as + /// it needs. However implementations of this function may return + /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + /// entropy without blocking indefinitely. + /// \retval #PSA_ERROR_HARDWARE_FAILURE + /// A failure of the random generator hardware that isn't covered + /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. + pub fn mbedtls_psa_external_get_random( + context: *mut mbedtls_psa_external_random_context_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_aead_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// A slot number identifying a key in a driver. +/// +/// Values of this type are used to identify built-in keys. +pub type psa_drv_slot_number_t = u64; +unsafe extern "C" { + /// Check if PSA is capable of handling the specified hash algorithm. + /// + /// This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + /// set and that psa_crypto_init has already been called. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the algorithm. + /// This might be improved in the future. + /// + /// \param hash_alg The hash algorithm. + /// + /// \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + pub fn psa_can_do_hash(hash_alg: psa_algorithm_t) -> ::core::ffi::c_int; } -impl psa_aead_operation_s { - #[inline] - pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_ad_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_body_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(3usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 3usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 3usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(4usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 4usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 4usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_nonce_set: ::core::ffi::c_uint, - private_lengths_set: ::core::ffi::c_uint, - private_ad_started: ::core::ffi::c_uint, - private_body_started: ::core::ffi::c_uint, - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; - private_nonce_set as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; - private_lengths_set as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; - private_ad_started as u64 - }); - __bindgen_bitfield_unit.set(3usize, 1u8, { - let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; - private_body_started as u64 - }); - __bindgen_bitfield_unit.set(4usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Tell if PSA is ready for this cipher. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the key type and algorithm. + /// This might be improved in the future. + /// + /// \param key_type The key type. + /// \param cipher_alg The cipher algorithm. + /// + /// \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + pub fn psa_can_do_cipher( + key_type: psa_key_type_t, + cipher_alg: psa_algorithm_t, + ) -> ::core::ffi::c_int; +} +/// \brief Encoding of the application role of PAKE +/// +/// Encodes the application's role in the algorithm is being executed. For more +/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX +/// constants. +pub type psa_pake_role_t = u8; +/// Encoding of input and output indicators for PAKE. +/// +/// Some PAKE algorithms need to exchange more data than just a single key share. +/// This type is for encoding additional input and output data for such +/// algorithms. +pub type psa_pake_step_t = u8; +/// Encoding of the type of the PAKE's primitive. +/// +/// Values defined by this standard will never be in the range 0x80-0xff. +/// Vendors who define additional types must use an encoding in this range. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_primitive_type_t = u8; +/// \brief Encoding of the family of the primitive associated with the PAKE. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_family_t = u8; +/// \brief Encoding of the primitive associated with the PAKE. +/// +/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. +pub type psa_pake_primitive_t = u32; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_pake_cipher_suite_s { + pub algorithm: psa_algorithm_t, + pub type_: psa_pake_primitive_type_t, + pub family: psa_pake_family_t, + pub bits: u16, + pub hash: psa_algorithm_t, } #[repr(C)] -#[repr(align(16))] #[derive(Copy, Clone)] -pub struct psa_hkdf_key_derivation_t { - pub private_info: *mut u8, - pub private_info_length: usize, - pub private_offset_in_block: u8, - pub private_block_number: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_output_block: [u8; 64usize], - pub private_prk: [u8; 64usize], - pub __bindgen_padding_0: [u64; 0usize], - pub private_hmac: psa_mac_operation_s, +pub struct psa_crypto_driver_pake_inputs_s { + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_user: *mut u8, + pub private_user_len: usize, + pub private_peer: *mut u8, + pub private_peer_len: usize, + pub private_attributes: psa_key_attributes_t, + pub private_cipher_suite: psa_pake_cipher_suite_s, } -impl Default for psa_hkdf_key_derivation_t { +impl Default for psa_crypto_driver_pake_inputs_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17059,126 +18121,97 @@ impl Default for psa_hkdf_key_derivation_t { } } } -impl psa_hkdf_key_derivation_t { - #[inline] - pub fn private_state(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } - } - #[inline] - pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 2u8, val as u64) - } - } - #[inline] - pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 2u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 2u8, - val as u64, - ) - } - } - #[inline] - pub fn private_info_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { +pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = + 10; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = + 11; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; +pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; +pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; +pub const psa_jpake_round_PSA_JPAKE_FIRST: psa_jpake_round = 0; +pub const psa_jpake_round_PSA_JPAKE_SECOND: psa_jpake_round = 1; +pub const psa_jpake_round_PSA_JPAKE_FINISHED: psa_jpake_round = 2; +pub type psa_jpake_round = ::core::ffi::c_uint; +pub use self::psa_jpake_round as psa_jpake_round_t; +pub const psa_jpake_io_mode_PSA_JPAKE_INPUT: psa_jpake_io_mode = 0; +pub const psa_jpake_io_mode_PSA_JPAKE_OUTPUT: psa_jpake_io_mode = 1; +pub type psa_jpake_io_mode = ::core::ffi::c_uint; +pub use self::psa_jpake_io_mode as psa_jpake_io_mode_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_jpake_computation_stage_s { + pub private_round: psa_jpake_round_t, + pub private_io_mode: psa_jpake_io_mode_t, + pub private_inputs: u8, + pub private_outputs: u8, + pub private_step: psa_pake_step_t, +} +impl Default for psa_jpake_computation_stage_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_pake_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_primitive: psa_pake_primitive_t, + pub private_stage: u8, + pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, + pub private_data: psa_pake_operation_s__bindgen_ty_2, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_pake_operation_s__bindgen_ty_1 { + pub private_dummy: u8, + pub private_jpake: psa_jpake_computation_stage_s, +} +impl Default for psa_pake_operation_s__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub fn new_bitfield_1( - private_state: ::core::ffi::c_uint, - private_info_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 2u8, { - let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; - private_state as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; - private_info_set as u64 - }); - __bindgen_bitfield_unit - } -} -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_tls12_ecjpake_to_pms_t { - pub private_data: [u8; 32usize], } -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: - psa_tls12_prf_key_derivation_state_t = 0; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: - psa_tls12_prf_key_derivation_state_t = 1; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 2; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 3; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: - psa_tls12_prf_key_derivation_state_t = 4; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: - psa_tls12_prf_key_derivation_state_t = 5; -pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct psa_tls12_prf_key_derivation_s { - pub private_left_in_block: u8, - pub private_block_number: u8, - pub private_state: psa_tls12_prf_key_derivation_state_t, - pub private_secret: *mut u8, - pub private_secret_length: usize, - pub private_seed: *mut u8, - pub private_seed_length: usize, - pub private_label: *mut u8, - pub private_label_length: usize, - pub private_other_secret: *mut u8, - pub private_other_secret_length: usize, - pub private_Ai: [u8; 64usize], - pub private_output_block: [u8; 64usize], +pub union psa_pake_operation_s__bindgen_ty_2 { + pub private_ctx: psa_driver_pake_context_t, + pub private_inputs: psa_crypto_driver_pake_inputs_s, } -impl Default for psa_tls12_prf_key_derivation_s { +impl Default for psa_pake_operation_s__bindgen_ty_2 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for psa_pake_operation_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17187,1462 +18220,1629 @@ impl Default for psa_tls12_prf_key_derivation_s { } } } -pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_key_derivation_s { - pub private_alg: psa_algorithm_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_capacity: usize, - pub __bindgen_padding_0: [u64; 0usize], - pub private_ctx: psa_key_derivation_s__bindgen_ty_1, +/// The type of the data structure for PAKE cipher suites. +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; +/// The type of the state data structure for PAKE operations. +/// +/// Before calling any function on a PAKE operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_pake_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_pake_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, +/// for example: +/// \code +/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_pake_operation_init() +/// to the structure, for example: +/// \code +/// psa_pake_operation_t operation; +/// operation = psa_pake_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_operation_t = psa_pake_operation_s; +/// The type of input values for PAKE operations. +pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; +/// The type of computation stage for J-PAKE operations. +pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; +unsafe extern "C" { + /// Get the length of the password in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] password_len Password length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + password_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the password from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] buffer Return buffer for password. + /// \param buffer_size Size of the return buffer in bytes. + /// \param[out] buffer_length Actual size of the password in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password( + inputs: *const psa_crypto_driver_pake_inputs_t, + buffer: *mut u8, + buffer_size: usize, + buffer_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the user id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_len User id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_user_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the peer id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_len Peer id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_peer_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_len: *mut usize, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_key_derivation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_hkdf: psa_hkdf_key_derivation_t, - pub private_tls12_prf: psa_tls12_prf_key_derivation_t, - pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +unsafe extern "C" { + /// Get the user id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_id User id. + /// \param user_id_size Size of \p user_id in bytes. + /// \param[out] user_id_len Size of the user id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p user_id is too small. + pub fn psa_crypto_driver_pake_get_user( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_id: *mut u8, + user_id_size: usize, + user_id_len: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the peer id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_id Peer id. + /// \param peer_id_size Size of \p peer_id in bytes. + /// \param[out] peer_id_length Size of the peer id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p peer_id is too small. + pub fn psa_crypto_driver_pake_get_peer( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_id: *mut u8, + peer_id_size: usize, + peer_id_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the cipher suite from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] cipher_suite Return buffer for role. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Cipher_suite hasn't been set yet. + pub fn psa_crypto_driver_pake_get_cipher_suite( + inputs: *const psa_crypto_driver_pake_inputs_t, + cipher_suite: *mut psa_pake_cipher_suite_t, + ) -> psa_status_t; } -impl psa_key_derivation_s { - #[inline] - pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_can_output_key: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_can_output_key: u32 = - unsafe { ::core::mem::transmute(private_can_output_key) }; - private_can_output_key as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Set the session information for a password-authenticated key exchange. + /// + /// The sequence of operations to set up a password-authenticated key exchange + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_pake_operation_t, e.g. + /// #PSA_PAKE_OPERATION_INIT. + /// -# Call psa_pake_setup() to specify the cipher suite. + /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the + /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + /// to be called depends on the algorithm in use. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// A typical sequence of calls to perform a password-authenticated key + /// exchange: + /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + /// key share that needs to be sent to the peer. + /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + /// the key share that was received from the peer. + /// -# Depending on the algorithm additional calls to psa_pake_output() and + /// psa_pake_input() might be necessary. + /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// If an error occurs at any step after a call to psa_pake_setup(), + /// the operation will need to be reset by a call to psa_pake_abort(). The + /// application may call psa_pake_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_pake_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A call to psa_pake_abort(). + /// - A successful call to psa_pake_get_implicit_key(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized but not set up yet. + /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + /// characterizes a PAKE algorithm and determines + /// the algorithm as well.) + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the + /// PAKE primitive in \p cipher_suite is not compatible with the + /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + /// or not compatible with the PAKE algorithm and primitive. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, + /// or the PAKE primitive in \p cipher_suite is not supported or not + /// compatible with the PAKE algorithm, or the hash algorithm in + /// \p cipher_suite is not supported or not compatible with the PAKE + /// algorithm and primitive. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_setup( + operation: *mut psa_pake_operation_t, + cipher_suite: *const psa_pake_cipher_suite_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_key_policy_s { - pub private_usage: psa_key_usage_t, - pub private_alg: psa_algorithm_t, - pub private_alg2: psa_algorithm_t, +unsafe extern "C" { + /// Set the password for a password-authenticated key exchange from key ID. + /// + /// Call this function when the password, or a value derived from the password, + /// is already present in the key store. + /// + /// \param[in,out] operation The operation object to set the password for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the password hasn't + /// been set yet (psa_pake_set_password_key() + /// hasn't been called yet). + /// \param password Identifier of the key holding the password or a + /// value derived from the password (eg. by a + /// memory-hard function). It must remain valid + /// until the operation terminates. It must be of + /// type #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + /// the usage #PSA_KEY_USAGE_DERIVE. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p password is not a valid key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + /// permit the \p operation's algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + /// the \p operation's cipher suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size of \p password is not supported with the + /// \p operation's cipher suite. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must have been set up.), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_password_key( + operation: *mut psa_pake_operation_t, + password: mbedtls_svc_key_id_t, + ) -> psa_status_t; } -pub type psa_key_policy_t = psa_key_policy_s; -pub type psa_key_bits_t = u16; -/// A mask of flags that can be stored in key attributes. -/// -/// This type is also used internally to store flags in slots. Internal -/// flags are defined in library/psa_crypto_core.h. Internal flags may have -/// the same value as external flags if they are properly handled during -/// key creation and in psa_get_key_attributes. -pub type psa_key_attributes_flag_t = u16; -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_core_key_attributes_t { - pub private_type: psa_key_type_t, - pub private_bits: psa_key_bits_t, - pub private_lifetime: psa_key_lifetime_t, - pub private_id: mbedtls_svc_key_id_t, - pub private_policy: psa_key_policy_t, - pub private_flags: psa_key_attributes_flag_t, +unsafe extern "C" { + /// Set the user ID for a password-authenticated key exchange. + /// + /// Call this function to set the user ID. For PAKE algorithms that associate a + /// user identifier with each side of the session you need to call + /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single + /// user identifier with the session, call psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the user ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the user ID hasn't + /// been set (psa_pake_set_user() hasn't been + /// called yet). + /// \param[in] user_id The user ID to authenticate with. + /// \param user_id_len Size of the \p user_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p user_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The value of \p user_id is not supported by the implementation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_user( + operation: *mut psa_pake_operation_t, + user_id: *const u8, + user_id_len: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_key_attributes_s { - pub private_core: psa_core_key_attributes_t, - pub private_domain_parameters: *mut ::core::ffi::c_void, - pub private_domain_parameters_size: usize, +unsafe extern "C" { + /// Set the peer ID for a password-authenticated key exchange. + /// + /// Call this function in addition to psa_pake_set_user() for PAKE algorithms + /// that associate a user identifier with each side of the session. For PAKE + /// algorithms that associate a single user identifier with the session, call + /// psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the peer ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the peer ID hasn't + /// been set (psa_pake_set_peer() hasn't been + /// called yet). + /// \param[in] peer_id The peer's ID to authenticate. + /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p peer_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm doesn't associate a second identity with the session. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// Calling psa_pake_set_peer() is invalid with the \p operation's + /// algorithm, the operation state is not valid, or the library has not + /// been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_peer( + operation: *mut psa_pake_operation_t, + peer_id: *const u8, + peer_id_len: usize, + ) -> psa_status_t; } -impl Default for psa_key_attributes_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Set the application role for a password-authenticated key exchange. + /// + /// Not all PAKE algorithms need to differentiate the communicating entities. + /// It is optional to call this function for PAKEs that don't require a role + /// to be specified. For such PAKEs the application role parameter is ignored, + /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \param[in,out] operation The operation object to specify the + /// application's role for. It must have been set up + /// by psa_pake_setup() and not yet in use (neither + /// psa_pake_output() nor psa_pake_input() has been + /// called yet). It must be on operation for which + /// the application's role hasn't been specified + /// (psa_pake_set_role() hasn't been called yet). + /// \param role A value of type ::psa_pake_role_t indicating the + /// application's role in the PAKE the algorithm + /// that is being set up. For more information see + /// the documentation of \c PSA_PAKE_ROLE_XXX + /// constants. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The \p role is not a valid PAKE role in the \p operation’s algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The \p role for this algorithm is not supported or is not valid. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_role( + operation: *mut psa_pake_operation_t, + role: psa_pake_role_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Set domain parameters for a key. + /// Get output for a step of a password-authenticated key exchange. /// - /// Some key types require additional domain parameters in addition to - /// the key type identifier and the key size. Use this function instead - /// of psa_set_key_type() when you need to specify domain parameters. + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. /// - /// The format for the required domain parameters varies based on the key type. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the domain parameter data consists of the public exponent, - /// represented as a big-endian integer with no leading zeros. - /// This information is used when generating an RSA key pair. - /// When importing a key, the public exponent is read from the imported - /// key data and the exponent recorded in the attribute structure is ignored. - /// As an exception, the public exponent 65537 is represented by an empty - /// byte string. - /// - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR), - /// the `Dss-Params` format as defined by RFC 3279 §2.3.2. - /// ``` - /// Dss-Params ::= SEQUENCE { - /// p INTEGER, - /// q INTEGER, - /// g INTEGER - /// } - /// ``` - /// - For Diffie-Hellman key exchange keys - /// (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or - /// #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the - /// `DomainParameters` format as defined by RFC 3279 §2.3.3. - /// ``` - /// DomainParameters ::= SEQUENCE { - /// p INTEGER, -- odd prime, p=jq +1 - /// g INTEGER, -- generator, g - /// q INTEGER, -- factor of p-1 - /// j INTEGER OPTIONAL, -- subgroup factor - /// validationParams ValidationParams OPTIONAL - /// } - /// ValidationParams ::= SEQUENCE { - /// seed BIT STRING, - /// pgenCounter INTEGER - /// } - /// ``` + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step of the algorithm for which the output is + /// requested. + /// \param[out] output Buffer where the output is to be written in the + /// format appropriate for this \p step. Refer to + /// the documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param output_size Size of the \p output buffer in bytes. This must + /// be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + /// primitive, \p output_step) where \c alg and + /// \p primitive are the PAKE algorithm and primitive + /// in the operation's cipher suite, and \p step is + /// the output step. + /// + /// \param[out] output_length On success, the number of bytes of the returned + /// output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p step is not compatible with the operation's algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step is not supported with the operation's algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_output( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Provide input for a step of a password-authenticated key exchange. + /// + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. + /// + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \param[in,out] attributes Attribute structure where the specified domain - /// parameters will be stored. - /// If this function fails, the content of - /// \p attributes is not modified. - /// \param type Key type (a \c PSA_KEY_TYPE_XXX value). - /// \param[in] data Buffer containing the key domain parameters. - /// The content of this buffer is interpreted - /// according to \p type as described above. - /// \param data_length Size of the \p data buffer in bytes. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step for which the input is provided. + /// \param[in] input Buffer containing the input in the format + /// appropriate for this \p step. Refer to the + /// documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p input_length is not compatible with the \p operation’s algorithm, + /// or the \p input is not valid for the \p operation's algorithm, + /// cipher suite or \p step. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step p is not supported with the \p operation's algorithm, or the + /// \p input is not supported for the \p operation's algorithm, cipher + /// suite or \p step. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - pub fn psa_set_key_domain_parameters( - attributes: *mut psa_key_attributes_t, - type_: psa_key_type_t, - data: *const u8, - data_length: usize, + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_input( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + input: *const u8, + input_length: usize, ) -> psa_status_t; } -/// \brief The context for PSA interruptible hash signing. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_sign_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_sign_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_sign_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_sign_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -/// \brief The context for PSA interruptible hash verification. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_verify_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_verify_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_verify_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_verify_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// Open a handle to an existing persistent key. - /// - /// Open a handle to a persistent key. A key is persistent if it was created - /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key - /// always has a nonzero key identifier, set with psa_set_key_id() when - /// creating the key. Implementations may provide additional pre-provisioned - /// keys that can be opened with psa_open_key(). Such keys have an application - /// key identifier in the vendor range, as documented in the description of - /// #psa_key_id_t. + /// Get implicitly confirmed shared secret from a PAKE. /// - /// The application must eventually close the handle with psa_close_key() or - /// psa_destroy_key() to release associated resources. If the application dies - /// without calling one of these functions, the implementation should perform - /// the equivalent of a call to psa_close_key(). + /// At this point there is a cryptographic guarantee that only the authenticated + /// party who used the same password is able to compute the key. But there is no + /// guarantee that the peer is the party it claims to be and was able to do so. /// - /// Some implementations permit an application to open the same key multiple - /// times. If this is successful, each call to psa_open_key() will return a - /// different key handle. + /// That is, the authentication is only implicit. Since the peer is not + /// authenticated yet, no action should be taken yet that assumes that the peer + /// is who it claims to be. For example, do not access restricted files on the + /// peer's behalf until an explicit authentication has succeeded. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function can be called after the key exchange phase of the operation + /// has completed. It imports the shared secret output of the PAKE into the + /// provided derivation operation. The input step + /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + /// material in the key derivation operation. /// - /// \note Applications that rely on opening a key multiple times will not be - /// portable to implementations that only permit a single key handle to be - /// opened. See also :ref:\`key-handles\`. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// + /// When this function returns successfully, \p operation becomes inactive. + /// If this function returns an error status, both \p operation + /// and \c key_derivation operations enter an error state and must be aborted by + /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. /// - /// \param key The persistent identifier of the key. - /// \param[out] handle On success, a handle to the key. + /// \param[in,out] operation Active PAKE operation. + /// \param[out] output A key derivation operation that is ready + /// for an input step of type + /// #PSA_KEY_DERIVATION_INPUT_SECRET. /// /// \retval #PSA_SUCCESS - /// Success. The application can now use the value of `*handle` - /// to access the key. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY - /// The implementation does not have sufficient resources to open the - /// key. This can be due to reaching an implementation limit on the - /// number of open keys, the number of open key handles, or available - /// memory. - /// \retval #PSA_ERROR_DOES_NOT_EXIST - /// There is no persistent key with key identifier \p key. + /// Success. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid persistent key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The specified key exists, but the application does not have the - /// permission to access it. Note that this specification does not - /// define any way to create such a key, but it may be possible - /// through implementation-specific means. + /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + /// algorithm in the \p output key derivation operation. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// Input from a PAKE is not supported by the algorithm in the \p output + /// key derivation operation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The PAKE operation state is not valid (it must be active, but beyond + /// that validity is specific to the algorithm), or + /// the library has not been previously initialized by psa_crypto_init(), + /// or the state of \p output is not valid for + /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + /// step is out of order or the application has done this step already + /// and it may not be repeated. /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_get_implicit_key( + operation: *mut psa_pake_operation_t, + output: *mut psa_key_derivation_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Close a key handle. - /// - /// If the handle designates a volatile key, this will destroy the key material - /// and free all associated resources, just like psa_destroy_key(). - /// - /// If this is the last open handle to a persistent key, then closing the handle - /// will free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and can be opened again later - /// with a call to psa_open_key(). + /// Abort a PAKE operation. /// - /// Closing the key handle makes the handle invalid, and the key handle - /// must not be used again by the application. + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_pake_setup() again. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_pake_operation_t. /// - /// \note If the key handle was used to set up an active - /// :ref:\`multipart operation \`, then closing the - /// key handle can cause the multipart operation to fail. Applications should - /// maintain the key handle until after the multipart operation has finished. + /// In particular, calling psa_pake_abort() after the operation has been + /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + /// is safe and has no effect. /// - /// \param handle The key handle to close. - /// If this is \c 0, do nothing and return \c PSA_SUCCESS. + /// \param[in,out] operation The operation to abort. /// /// \retval #PSA_SUCCESS - /// \p handle was a valid handle or \c 0. It is now closed. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p handle is not a valid handle nor \c 0. + /// Success. /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; } -unsafe extern "C" { - /// \brief Library deinitialization. +pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; +pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; +/// \brief Public key types +pub type mbedtls_pk_type_t = ::core::ffi::c_uint; +/// \brief Options for RSASSA-PSS signature verification. +/// See \c mbedtls_rsa_rsassa_pss_verify_ext() +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_rsassa_pss_options { + /// The digest to use for MGF1 in PSS. /// - /// This function clears all data associated with the PSA layer, - /// including the whole key store. + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + /// disabled, this must be equal to the \c md_alg argument passed + /// to mbedtls_pk_verify_ext(). In a future version of the library, + /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + /// enabled regardless of the status of #MBEDTLS_RSA_C. + pub mgf1_hash_id: mbedtls_md_type_t, + /// The expected length of the salt, in bytes. This may be + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. /// - /// This is an Mbed TLS extension. - pub fn mbedtls_psa_crypto_free(); + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + /// ignored (allowing any salt length). + pub expected_salt_len: ::core::ffi::c_int, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. +impl Default for mbedtls_pk_rsassa_pss_options { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_PSA_EC: mbedtls_pk_debug_type = 3; +/// \brief Types for interfacing with the debug module +pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; +/// \brief Item to send to the debug module #[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_stats_s { - /// Number of slots containing key material for a volatile key. - pub private_volatile_slots: usize, - /// Number of slots containing key material for a key which is in - /// internal persistent storage. - pub private_persistent_slots: usize, - /// Number of slots containing a reference to a key in a - /// secure element. - pub private_external_slots: usize, - /// Number of slots which are occupied, but do not contain - /// key material yet. - pub private_half_filled_slots: usize, - /// Number of slots that contain cache data. - pub private_cache_slots: usize, - /// Number of slots that are not used for anything. - pub private_empty_slots: usize, - /// Number of slots that are locked. - pub private_locked_slots: usize, - /// Largest key id value among open keys in internal persistent storage. - pub private_max_open_internal_key_id: psa_key_id_t, - /// Largest key id value among open keys in secure elements. - pub private_max_open_external_key_id: psa_key_id_t, +#[derive(Copy, Clone)] +pub struct mbedtls_pk_debug_item { + pub private_type: mbedtls_pk_debug_type, + pub private_name: *const ::core::ffi::c_char, + pub private_value: *mut ::core::ffi::c_void, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. -pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; -unsafe extern "C" { - /// \brief Get statistics about - /// resource consumption related to the PSA keystore. - /// - /// \note When Mbed Crypto is built as part of a service, with isolation - /// between the application and the keystore, the service may or - /// may not expose this function. - pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); +impl Default for mbedtls_pk_debug_item { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief Inject an initial entropy seed for the random generator into - /// secure storage. - /// - /// This function injects data to be used as a seed for the random generator - /// used by the PSA Crypto implementation. On devices that lack a trusted - /// entropy source (preferably a hardware random number generator), - /// the Mbed PSA Crypto implementation uses this value to seed its - /// random generator. - /// - /// On devices without a trusted entropy source, this function must be - /// called exactly once in the lifetime of the device. On devices with - /// a trusted entropy source, calling this function is optional. - /// In all cases, this function may only be called before calling any - /// other function in the PSA Crypto API, including psa_crypto_init(). - /// - /// When this function returns successfully, it populates a file in - /// persistent storage. Once the file has been created, this function - /// can no longer succeed. - /// - /// If any error occurs, this function does not change the system state. - /// You can call this function again after correcting the reason for the - /// error if possible. - /// - /// \warning This function **can** fail! Callers MUST check the return status. - /// - /// \warning If you use this function, you should use it as part of a - /// factory provisioning process. The value of the injected seed - /// is critical to the security of the device. It must be - /// *secret*, *unpredictable* and (statistically) *unique per device*. - /// You should be generate it randomly using a cryptographically - /// secure random generator seeded from trusted entropy sources. - /// You should transmit it securely to the device and ensure - /// that its value is not leaked or stored anywhere beyond the - /// needs of transmitting it from the point of generation to - /// the call of this function, and erase all copies of the value - /// once this function returns. - /// - /// This is an Mbed TLS extension. - /// - /// \note This function is only available on the following platforms: - /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. - /// Note that you must provide compatible implementations of - /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. - /// * In a client-server integration of PSA Cryptography, on the client side, - /// if the server supports this feature. - /// \param[in] seed Buffer containing the seed value to inject. - /// \param[in] seed_size Size of the \p seed buffer. - /// The size of the seed in bytes must be greater - /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE - /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM - /// in `library/entropy_poll.h` in the Mbed TLS source - /// code. - /// It must be less or equal to - /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. - /// - /// \retval #PSA_SUCCESS - /// The seed value was injected successfully. The random generator - /// of the PSA Crypto implementation is now ready for use. - /// You may now call psa_crypto_init() and use the PSA Crypto - /// implementation. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p seed_size is out of range. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// There was a failure reading or writing from storage. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The library has already been initialized. It is no longer - /// possible to call this function. - pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_info_t { + _unused: [u8; 0], } -unsafe extern "C" { - /// \brief Get domain parameters for a key. - /// - /// Get the domain parameters for a key with this function, if any. The format - /// of the domain parameters written to \p data is specified in the - /// documentation for psa_set_key_domain_parameters(). - /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. - /// - /// \param[in] attributes The key attribute structure to query. - /// \param[out] data On success, the key domain parameters. - /// \param data_size Size of the \p data buffer in bytes. - /// The buffer is guaranteed to be large - /// enough if its size in bytes is at least - /// the value given by - /// PSA_KEY_DOMAIN_PARAMETERS_SIZE(). - /// \param[out] data_length On success, the number of bytes - /// that make up the key domain parameters data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - pub fn psa_get_key_domain_parameters( - attributes: *const psa_key_attributes_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; +/// \brief Public key container +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_context { + ///< Public key information + pub private_pk_info: *const mbedtls_pk_info_t, + ///< Underlying public key context + pub private_pk_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_pk_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } +pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; +/// \brief Types for RSA-alt abstraction +pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_key_len_func = + ::core::option::Option usize>; unsafe extern "C" { - /// Convert an ECC curve identifier from the PSA encoding to Mbed TLS. - /// - /// \note This function is provided solely for the convenience of - /// Mbed TLS and may be removed at any time without notice. + /// \brief Return information associated with the given PK type /// - /// \param curve A PSA elliptic curve identifier - /// (`PSA_ECC_FAMILY_xxx`). - /// \param bits The bit-length of a private key on \p curve. - /// \param bits_is_sloppy If true, \p bits may be the bit-length rounded up - /// to the nearest multiple of 8. This allows the caller - /// to infer the exact curve from the length of a key - /// which is supplied as a byte string. + /// \param pk_type PK type to search for. /// - /// \return The corresponding Mbed TLS elliptic curve identifier - /// (`MBEDTLS_ECP_DP_xxx`). - /// \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized. - /// \return #MBEDTLS_ECP_DP_NONE if \p bits is not - /// correct for \p curve. - pub fn mbedtls_ecc_group_of_psa( - curve: psa_ecc_family_t, - bits: usize, - bits_is_sloppy: ::core::ffi::c_int, - ) -> mbedtls_ecp_group_id; + /// \return The PK info associated with the type or NULL if not found. + pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; } unsafe extern "C" { - /// External random generator function, implemented by the platform. - /// - /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, - /// this function replaces Mbed TLS's entropy and DRBG modules for all - /// random generation triggered via PSA crypto interfaces. - /// - /// \note This random generator must deliver random numbers with cryptographic - /// quality and high performance. It must supply unpredictable numbers - /// with a uniform distribution. The implementation of this function - /// is responsible for ensuring that the random generator is seeded - /// with sufficient entropy. If you have a hardware TRNG which is slow - /// or delivers non-uniform output, declare it as an entropy source - /// with mbedtls_entropy_add_source() instead of enabling this option. - /// - /// \param[in,out] context Pointer to the random generator context. - /// This is all-bits-zero on the first call - /// and preserved between successive calls. - /// \param[out] output Output buffer. On success, this buffer - /// contains random data with a uniform - /// distribution. - /// \param output_size The size of the \p output buffer in bytes. - /// \param[out] output_length On success, set this value to \p output_size. + /// \brief Initialize a #mbedtls_pk_context (as NONE). /// - /// \retval #PSA_SUCCESS - /// Success. The output buffer contains \p output_size bytes of - /// cryptographic-quality random data, and \c *output_length is - /// set to \p output_size. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY - /// The random generator requires extra entropy and there is no - /// way to obtain entropy under current environment conditions. - /// This error should not happen under normal circumstances since - /// this function is responsible for obtaining as much entropy as - /// it needs. However implementations of this function may return - /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain - /// entropy without blocking indefinitely. - /// \retval #PSA_ERROR_HARDWARE_FAILURE - /// A failure of the random generator hardware that isn't covered - /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. - pub fn mbedtls_psa_external_get_random( - context: *mut mbedtls_psa_external_random_context_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); } -/// A slot number identifying a key in a driver. -/// -/// Values of this type are used to identify built-in keys. -pub type psa_drv_slot_number_t = u64; -/// \brief Encoding of the application role of PAKE -/// -/// Encodes the application's role in the algorithm is being executed. For more -/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX -/// constants. -pub type psa_pake_role_t = u8; -/// Encoding of input and output indicators for PAKE. -/// -/// Some PAKE algorithms need to exchange more data than just a single key share. -/// This type is for encoding additional input and output data for such -/// algorithms. -pub type psa_pake_step_t = u8; -/// Encoding of the type of the PAKE's primitive. -/// -/// Values defined by this standard will never be in the range 0x80-0xff. -/// Vendors who define additional types must use an encoding in this range. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_primitive_type_t = u8; -/// \brief Encoding of the family of the primitive associated with the PAKE. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_family_t = u8; -/// \brief Encoding of the primitive associated with the PAKE. -/// -/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. -pub type psa_pake_primitive_t = u32; -/// The type of the data structure for PAKE cipher suites. -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; -/// The type of the state data structure for PAKE operations. -/// -/// Before calling any function on a PAKE operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_pake_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_pake_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, -/// for example: -/// \code -/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_pake_operation_init() -/// to the structure, for example: -/// \code -/// psa_pake_operation_t operation; -/// operation = psa_pake_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_operation_t = psa_pake_operation_s; -/// The type of input values for PAKE operations. -pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; -/// The type of computation stage for J-PAKE operations. -pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; unsafe extern "C" { - /// Get the length of the password in bytes from given inputs. + /// \brief Free the components of a #mbedtls_pk_context. /// - /// \param[in] inputs Operation inputs. - /// \param[out] password_len Password length. + /// \param ctx The context to clear. It must have been initialized. + /// If this is \c NULL, this function does nothing. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - password_len: *mut usize, - ) -> psa_status_t; + /// \note For contexts that have been set up with + /// mbedtls_pk_setup_opaque(), this does not free the underlying + /// PSA key and you still need to call psa_destroy_key() + /// independently if you want to destroy that key. + pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); } unsafe extern "C" { - /// Get the password from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] buffer Return buffer for password. - /// \param buffer_size Size of the return buffer in bytes. - /// \param[out] buffer_length Actual size of the password in bytes. + /// \brief Initialize a PK context with the information given + /// and allocates the type-specific PK subcontext. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password( - inputs: *const psa_crypto_driver_pake_inputs_t, - buffer: *mut u8, - buffer_size: usize, - buffer_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// Get the role from given inputs. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param info Information to use /// - /// \param[in] inputs Operation inputs. - /// \param[out] role Return buffer for role. + /// \return 0 on success, + /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Role hasn't been set yet. - pub fn psa_crypto_driver_pake_get_role( - inputs: *const psa_crypto_driver_pake_inputs_t, - role: *mut psa_pake_role_t, - ) -> psa_status_t; + /// \note For contexts holding an RSA-alt key, use + /// \c mbedtls_pk_setup_rsa_alt() instead. + pub fn mbedtls_pk_setup( + ctx: *mut mbedtls_pk_context, + info: *const mbedtls_pk_info_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the user id in bytes from given inputs. + /// \brief Initialize an RSA-alt context /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_len User id length. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param key RSA key pointer + /// \param decrypt_func Decryption function + /// \param sign_func Signing function + /// \param key_len_func Function returning key length in bytes /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_user_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_len: *mut usize, - ) -> psa_status_t; + /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + /// context wasn't already initialized as RSA_ALT. + /// + /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + pub fn mbedtls_pk_setup_rsa_alt( + ctx: *mut mbedtls_pk_context, + key: *mut ::core::ffi::c_void, + decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, + sign_func: mbedtls_pk_rsa_alt_sign_func, + key_len_func: mbedtls_pk_rsa_alt_key_len_func, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the peer id in bytes from given inputs. + /// \brief Get the size in bits of the underlying key /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_len Peer id length. + /// \param ctx The context to query. It must have been initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_peer_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_len: *mut usize, - ) -> psa_status_t; + /// \return Key size in bits, or 0 on error + pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; } unsafe extern "C" { - /// Get the user id from given inputs. + /// \brief Tell if a context can do the operation given by type /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_id User id. - /// \param user_id_size Size of \p user_id in bytes. - /// \param[out] user_id_len Size of the user id in bytes. + /// \param ctx The context to query. It must have been initialized. + /// \param type The desired type. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p user_id is too small. - pub fn psa_crypto_driver_pake_get_user( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_id: *mut u8, - user_id_size: usize, - user_id_len: *mut usize, - ) -> psa_status_t; + /// \return 1 if the context can do operations on the given type. + /// \return 0 if the context cannot do the operations on the given + /// type. This is always the case for a context that has + /// been initialized but not set up, or that has been + /// cleared with mbedtls_pk_free(). + pub fn mbedtls_pk_can_do( + ctx: *const mbedtls_pk_context, + type_: mbedtls_pk_type_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the peer id from given inputs. + /// \brief Determine valid PSA attributes that can be used to + /// import a key into PSA. /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_id Peer id. - /// \param peer_id_size Size of \p peer_id in bytes. - /// \param[out] peer_id_length Size of the peer id in bytes. + /// The attributes determined by this function are suitable + /// for calling mbedtls_pk_import_into_psa() to create + /// a PSA key with the same key material. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p peer_id is too small. - pub fn psa_crypto_driver_pake_get_peer( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_id: *mut u8, - peer_id_size: usize, - peer_id_length: *mut usize, - ) -> psa_status_t; + /// The typical flow of operations involving this function is + /// ``` + /// psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + /// int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + /// if (ret != 0) ...; // error handling omitted + /// // Tweak attributes if desired + /// psa_key_id_t key_id = 0; + /// ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + /// if (ret != 0) ...; // error handling omitted + /// ``` + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + /// - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_ENCRYPT as well as + /// #PSA_KEY_USAGE_DECRYPT. + /// - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type. + /// - #PSA_KEY_USAGE_ENCRYPT: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_HASH as well as + /// #PSA_KEY_USAGE_SIGN_HASH. + /// - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + /// #PSA_KEY_USAGE_SIGN_MESSAGE. + /// - #PSA_KEY_USAGE_VERIFY_HASH: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + /// \p attributes will contain a public key type. + /// \param[out] attributes + /// On success, valid attributes to import the key into PSA. + /// - The lifetime and key identifier are unchanged. If the + /// attribute structure was initialized or reset before + /// calling this function, this will result in a volatile + /// key. Call psa_set_key_identifier() before or after this + /// function if you wish to create a persistent key. Call + /// psa_set_key_lifetime() before or after this function if + /// you wish to import the key in a secure element. + /// - The key type and bit-size are determined by the contents + /// of the PK context. If the PK context contains a key + /// pair, the key type can be either a key pair type or + /// the corresponding public key type, depending on + /// \p usage. If the PK context contains a public key, + /// the key type is a public key type. + /// - The key's policy is determined by the key type and + /// the \p usage parameter. The usage always allows + /// \p usage, exporting and copying the key, and + /// possibly other permissions as documented for the + /// \p usage parameter. + /// The permitted algorithm policy is determined as follows + /// based on the #mbedtls_pk_type_t type of \p pk, + /// the chosen \p usage and other factors: + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V15: + /// #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_PKCS1V15_CRYPT + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V21 and the digest type + /// corresponding to the PSA algorithm \c hash: + /// #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_OAEP(\c hash) + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA_ALT: not supported. + /// - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + /// if \p usage is SIGN/VERIFY: + /// #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + /// if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + /// otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + /// - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + /// if \p usage is DERIVE: + /// #PSA_ALG_ECDH. + /// - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + /// set for the underlying PSA key, except that + /// sign/decrypt flags are removed if the type is + /// set to a public key type. + /// The underlying key must allow \p usage. + /// Note that the enrollment algorithm set with + /// psa_set_key_enrollment_algorithm() is not copied. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_get_psa_attributes( + pk: *const mbedtls_pk_context, + usage: psa_key_usage_t, + attributes: *mut psa_key_attributes_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the cipher suite from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] cipher_suite Return buffer for role. + /// \brief Import a key into the PSA key store. + /// + /// This function is equivalent to calling psa_import_key() + /// with the key material from \p pk. + /// + /// The typical way to use this function is: + /// -# Call mbedtls_pk_get_psa_attributes() to obtain + /// attributes for the given key. + /// -# If desired, modify the attributes, for example: + /// - To create a persistent key, call + /// psa_set_key_identifier() and optionally + /// psa_set_key_lifetime(). + /// - To import only the public part of a key pair: + /// + /// psa_set_key_type(&attributes, + /// PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + /// psa_get_key_type(&attributes))); + /// - Restrict the key usage if desired. + /// -# Call mbedtls_pk_import_into_psa(). + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param[in] attributes + /// The attributes to use for the new key. They must be + /// compatible with \p pk. In particular, the key type + /// must match the content of \p pk. + /// If \p pk contains a key pair, the key type in + /// attributes can be either the key pair type or the + /// corresponding public key type (to import only the + /// public part). + /// \param[out] key_id + /// On success, the identifier of the newly created key. + /// On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_import_into_psa( + pk: *const mbedtls_pk_context, + attributes: *const psa_key_attributes_t, + key_id: *mut mbedtls_svc_key_id_t, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Create a PK context starting from a key stored in PSA. + /// This key: + /// - must be exportable and + /// - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + /// + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. + /// + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + /// mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. + /// * For ECDSA, the choice of deterministic vs randomized will + /// be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + /// * For an RSA key, the output PK context will allow both + /// encrypt/decrypt and sign/verify regardless of the original + /// key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. + /// + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Cipher_suite hasn't been set yet. - pub fn psa_crypto_driver_pake_get_cipher_suite( - inputs: *const psa_crypto_driver_pake_inputs_t, - cipher_suite: *mut psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the session information for a password-authenticated key exchange. + /// \brief Create a PK context for the public key of a PSA key. /// - /// The sequence of operations to set up a password-authenticated key exchange - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_pake_operation_t, e.g. - /// #PSA_PAKE_OPERATION_INIT. - /// -# Call psa_pake_setup() to specify the cipher suite. - /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the - /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs - /// to be called depends on the algorithm in use. + /// The key must be an RSA or ECC key. It can be either a + /// public key or a key pair, and only the public key is copied. + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_verify() or + /// mbedtls_pk_encrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. /// - /// A typical sequence of calls to perform a password-authenticated key - /// exchange: - /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the - /// key share that needs to be sent to the peer. - /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide - /// the key share that was received from the peer. - /// -# Depending on the algorithm additional calls to psa_pake_output() and - /// psa_pake_input() might be necessary. - /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// For an RSA key, the output PK context will allow both + /// encrypt and verify regardless of the original key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// If an error occurs at any step after a call to psa_pake_setup(), - /// the operation will need to be reset by a call to psa_pake_abort(). The - /// application may call psa_pake_abort() at any time after the operation - /// has been initialized. + /// \return 0 on success. + /// \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_public_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature (including padding if relevant). /// - /// After a successful call to psa_pake_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A call to psa_pake_abort(). - /// - A successful call to psa_pake_get_implicit_key(). + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used. + /// This can be #MBEDTLS_MD_NONE if the signature algorithm + /// does not rely on a hash algorithm (non-deterministic + /// ECDSA, RSA PKCS#1 v1.5). + /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + /// \p hash is the DigestInfo structure used by RFC 8017 + /// §9.2 steps 3–6. If \p md_alg is a valid hash + /// algorithm then \p hash is the digest itself, and this + /// function calculates the DigestInfo encoding internally. + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Signature to verify + /// \param sig_len Signature length /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized but not set up yet. - /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully - /// characterizes a PAKE algorithm and determines - /// the algorithm as well.) + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (accepting any salt length), + /// depending on the padding mode in the underlying RSA context. + /// For a pk object constructed by parsing, this is PKCS#1 v1.5 + /// by default. Use mbedtls_pk_verify_ext() to explicitly select + /// a different algorithm. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the - /// PAKE primitive in \p cipher_suite is not compatible with the - /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid - /// or not compatible with the PAKE algorithm and primitive. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, - /// or the PAKE primitive in \p cipher_suite is not supported or not - /// compatible with the PAKE algorithm, or the hash algorithm in - /// \p cipher_suite is not supported or not compatible with the PAKE - /// algorithm and primitive. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_setup( - operation: *mut psa_pake_operation_t, - cipher_suite: *const psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + pub fn mbedtls_pk_verify( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the password for a password-authenticated key exchange from key ID. + /// \brief Restartable version of \c mbedtls_pk_verify() /// - /// Call this function when the password, or a value derived from the password, - /// is already present in the key store. + /// \note Performs the same job as \c mbedtls_pk_verify(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_verify(). /// - /// \param[in,out] operation The operation object to set the password for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the password hasn't - /// been set yet (psa_pake_set_password_key() - /// hasn't been called yet). - /// \param password Identifier of the key holding the password or a - /// value derived from the password (eg. by a - /// memory-hard function). It must remain valid - /// until the operation terminates. It must be of - /// type #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow - /// the usage #PSA_KEY_USAGE_DERIVE. + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p password is not a valid key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not - /// permit the \p operation's algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with - /// the \p operation's cipher suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size of \p password is not supported with the - /// \p operation's cipher suite. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must have been set up.), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_password_key( - operation: *mut psa_pake_operation_t, - password: mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return See \c mbedtls_pk_verify(), or + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_verify_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature, with options. + /// (Includes verification of the padding depending on type.) + /// + /// \param type Signature type (inc. possible padding type) to verify + /// \param options Pointer to type-specific options, or NULL + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + /// used for this type of signatures, + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + /// + /// \note If hash_len is 0, then the length associated with md_alg + /// is used instead, or an error returned if it is invalid. + /// + /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// + /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + /// to a mbedtls_pk_rsassa_pss_options structure, + /// otherwise it must be NULL. Note that if + /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + pub fn mbedtls_pk_verify_ext( + type_: mbedtls_pk_type_t, + options: *const ::core::ffi::c_void, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the user ID for a password-authenticated key exchange. + /// \brief Make signature, including padding if relevant. /// - /// Call this function to set the user ID. For PAKE algorithms that associate a - /// user identifier with each side of the session you need to call - /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single - /// user identifier with the session, call psa_pake_set_user() only. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (using the largest possible salt + /// length up to the hash length), depending on the padding mode + /// in the underlying RSA context. For a pk object constructed + /// by parsing, this is PKCS#1 v1.5 by default. Use + /// mbedtls_pk_verify_ext() to explicitly select a different + /// algorithm. /// - /// \param[in,out] operation The operation object to set the user ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the user ID hasn't - /// been set (psa_pake_set_user() hasn't been - /// called yet). - /// \param[in] user_id The user ID to authenticate with. - /// (temporary limitation: "client" or "server" only) - /// \param user_id_len Size of the \p user_id buffer in bytes. + /// \return 0 on success, or a specific error code. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The value of \p user_id is not supported by the implementation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_user( - operation: *mut psa_pake_operation_t, - user_id: *const u8, - user_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the peer ID for a password-authenticated key exchange. + /// \brief Make signature given a signature type. /// - /// Call this function in addition to psa_pake_set_user() for PAKE algorithms - /// that associate a user identifier with each side of the session. For PAKE - /// algorithms that associate a single user identifier with the session, call - /// psa_pake_set_user() only. + /// \param pk_type Signature type. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \return 0 on success, or a specific error code. /// - /// \param[in,out] operation The operation object to set the peer ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the peer ID hasn't - /// been set (psa_pake_set_peer() hasn't been - /// called yet). - /// \param[in] peer_id The peer's ID to authenticate. - /// (temporary limitation: "client" or "server" only) - /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + /// see #PSA_ALG_RSA_PSS for a description of PSS options used. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm doesn't associate a second identity with the session. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// Calling psa_pake_set_peer() is invalid with the \p operation's - /// algorithm, the operation state is not valid, or the library has not - /// been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_peer( - operation: *mut psa_pake_operation_t, - peer_id: *const u8, - peer_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign_ext( + pk_type: mbedtls_pk_type_t, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the application role for a password-authenticated key exchange. + /// \brief Restartable version of \c mbedtls_pk_sign() /// - /// Not all PAKE algorithms need to differentiate the communicating entities. - /// It is optional to call this function for PAKEs that don't require a role - /// to be specified. For such PAKEs the application role parameter is ignored, - /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// \note Performs the same job as \c mbedtls_pk_sign(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_sign(). /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \param[in,out] operation The operation object to specify the - /// application's role for. It must have been set up - /// by psa_pake_setup() and not yet in use (neither - /// psa_pake_output() nor psa_pake_input() has been - /// called yet). It must be on operation for which - /// the application's role hasn't been specified - /// (psa_pake_set_role() hasn't been called yet). - /// \param role A value of type ::psa_pake_role_t indicating the - /// application's role in the PAKE the algorithm - /// that is being set up. For more information see - /// the documentation of \c PSA_PAKE_ROLE_XXX - /// constants. + /// \return See \c mbedtls_pk_sign(). + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_sign_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Decrypt message (including padding if relevant). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The \p role is not a valid PAKE role in the \p operation’s algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The \p role for this algorithm is not supported or is not valid. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_role( - operation: *mut psa_pake_operation_t, - role: psa_pake_role_t, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param input Input to decrypt + /// \param ilen Input size + /// \param output Decrypted output + /// \param olen Decrypted message length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. + /// + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_decrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get output for a step of a password-authenticated key exchange. + /// \brief Encrypt message (including padding if relevant). /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been set up. + /// \param input Message to encrypt + /// \param ilen Message size + /// \param output Encrypted output + /// \param olen Encrypted output length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \note \p f_rng is used for padding generation. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step of the algorithm for which the output is - /// requested. - /// \param[out] output Buffer where the output is to be written in the - /// format appropriate for this \p step. Refer to - /// the documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param output_size Size of the \p output buffer in bytes. This must - /// be at least #PSA_PAKE_OUTPUT_SIZE(\p alg, \p - /// primitive, \p step) where \p alg and - /// \p primitive are the PAKE algorithm and primitive - /// in the operation's cipher suite, and \p step is - /// the output step. + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_encrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if a public-private pair of keys matches. /// - /// \param[out] output_length On success, the number of bytes of the returned - /// output. + /// \param pub Context holding a public key. + /// \param prv Context holding a private (and public) key. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p step is not compatible with the operation's algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step is not supported with the operation's algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_output( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success (keys were checked and match each other). + /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + /// be checked - in that case they may or may not match. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + /// \return Another non-zero value if the keys do not match. + pub fn mbedtls_pk_check_pair( + pub_: *const mbedtls_pk_context, + prv: *const mbedtls_pk_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Provide input for a step of a password-authenticated key exchange. + /// \brief Export debug information /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been initialized. + /// \param items Place to write debug items /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + pub fn mbedtls_pk_debug( + ctx: *const mbedtls_pk_context, + items: *mut mbedtls_pk_debug_item, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Access the type name /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \param ctx The PK context to use. It must have been initialized. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step for which the input is provided. - /// \param[in] input Buffer containing the input in the format - /// appropriate for this \p step. Refer to the - /// documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param input_length Size of the \p input buffer in bytes. + /// \return Type name on success, or "invalid PK" + pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; +} +unsafe extern "C" { + /// \brief Get the key type /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p is not compatible with the \p operation’s algorithm, or the - /// \p input is not valid for the \p operation's algorithm, cipher suite - /// or \p step. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step p is not supported with the \p operation's algorithm, or the - /// \p input is not supported for the \p operation's algorithm, cipher - /// suite or \p step. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_input( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been initialized. + /// + /// \return Type on success. + /// \return #MBEDTLS_PK_NONE for a context that has not been set up. + pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; } unsafe extern "C" { - /// Get implicitly confirmed shared secret from a PAKE. + /// \ingroup pk_module */ + ////** + /// \brief Parse a private key in PEM or DER format /// - /// At this point there is a cryptographic guarantee that only the authenticated - /// party who used the same password is able to compute the key. But there is no - /// guarantee that the peer is the party it claims to be and was able to do so. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// That is, the authentication is only implicit. Since the peer is not - /// authenticated yet, no action should be taken yet that assumes that the peer - /// is who it claims to be. For example, do not access restricted files on the - /// peer's behalf until an explicit authentication has succeeded. + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// \param pwd Optional password for decryption. + /// Pass \c NULL if expecting a non-encrypted key. + /// Pass a string of \p pwdlen bytes if expecting an encrypted + /// key; a non-encrypted key will also be accepted. + /// The empty password is not supported. + /// \param pwdlen Size of the password in bytes. + /// Ignored if \p pwd is \c NULL. + /// \param f_rng RNG function, must not be \c NULL. Used for blinding. + /// \param p_rng RNG parameter /// - /// This function can be called after the key exchange phase of the operation - /// has completed. It imports the shared secret output of the PAKE into the - /// provided derivation operation. The input step - /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key - /// material in the key derivation operation. + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note The key is also checked for correctness. /// - /// When this function returns successfully, \p operation becomes inactive. - /// If this function returns an error status, both \p operation - /// and \p key_derivation operations enter an error state and must be aborted by - /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \ingroup pk_module */ + ////** + /// \brief Parse a public key in PEM or DER format /// - /// \param[in,out] operation Active PAKE operation. - /// \param[out] output A key derivation operation that is ready - /// for an input step of type - /// #PSA_KEY_DERIVATION_INPUT_SECRET. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the - /// algorithm in the \p output key derivation operation. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// Input from a PAKE is not supported by the algorithm in the \p output - /// key derivation operation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The PAKE operation state is not valid (it must be active, but beyond - /// that validity is specific to the algorithm), or - /// the library has not been previously initialized by psa_crypto_init(), - /// or the state of \p output is not valid for - /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the - /// step is out of order or the application has done this step already - /// and it may not be repeated. - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_get_implicit_key( - operation: *mut psa_pake_operation_t, - output: *mut psa_key_derivation_operation_t, - ) -> psa_status_t; + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). + /// + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. + /// + /// \note The key is also checked for correctness. + /// + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_public_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a PAKE operation. + /// \brief Write a private key to a PKCS#1 or SEC1 DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_pake_setup() again. + /// \param ctx PK context which must contain a valid private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_pake_operation_t. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_key_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a SubjectPublicKeyInfo DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// In particular, calling psa_pake_abort() after the operation has been - /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() - /// is safe and has no effect. + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// \param[in,out] operation The operation to abort. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_pubkey_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a PEM string /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_pubkey_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_pake_cipher_suite_s { - pub algorithm: psa_algorithm_t, - pub type_: psa_pake_primitive_type_t, - pub family: psa_pake_family_t, - pub bits: u16, - pub hash: psa_algorithm_t, +unsafe extern "C" { + /// \brief Write a private key to a PKCS#1 or SEC1 PEM string + /// + /// \param ctx PK context which must contain a valid private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_key_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_crypto_driver_pake_inputs_s { - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: psa_pake_role_t, - pub private_user: *mut u8, - pub private_user_len: usize, - pub private_peer: *mut u8, - pub private_peer_len: usize, - pub private_attributes: psa_key_attributes_t, - pub private_cipher_suite: psa_pake_cipher_suite_t, +unsafe extern "C" { + /// \brief Parse a SubjectPublicKeyInfo DER structure + /// + /// \param p the position in the ASN.1 data + /// \param end end of the buffer + /// \param pk The PK context to fill. It must have been initialized + /// but not set up. + /// + /// \return 0 if successful, or a specific PK error code + pub fn mbedtls_pk_parse_subpubkey( + p: *mut *mut ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -impl Default for psa_crypto_driver_pake_inputs_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Write a subjectPublicKey to ASN.1 data + /// Note: function works backwards in data buffer + /// + /// \param p reference to current position pointer + /// \param start start of the buffer (for bounds-checking) + /// \param key PK context which must contain a valid public or private key. + /// + /// \return the length written or a negative error code + pub fn mbedtls_pk_write_pubkey( + p: *mut *mut ::core::ffi::c_uchar, + start: *mut ::core::ffi::c_uchar, + key: *const mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -pub const psa_jpake_step_PSA_PAKE_STEP_INVALID: psa_jpake_step = 0; -pub const psa_jpake_step_PSA_PAKE_STEP_X1_X2: psa_jpake_step = 1; -pub const psa_jpake_step_PSA_PAKE_STEP_X2S: psa_jpake_step = 2; -pub const psa_jpake_step_PSA_PAKE_STEP_DERIVE: psa_jpake_step = 3; -pub type psa_jpake_step = ::core::ffi::c_uint; -pub use self::psa_jpake_step as psa_jpake_step_t; -pub const psa_jpake_state_PSA_PAKE_STATE_INVALID: psa_jpake_state = 0; -pub const psa_jpake_state_PSA_PAKE_STATE_SETUP: psa_jpake_state = 1; -pub const psa_jpake_state_PSA_PAKE_STATE_READY: psa_jpake_state = 2; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X1_X2: psa_jpake_state = 3; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X2S: psa_jpake_state = 4; -pub const psa_jpake_state_PSA_PAKE_INPUT_X1_X2: psa_jpake_state = 5; -pub const psa_jpake_state_PSA_PAKE_INPUT_X4S: psa_jpake_state = 6; -pub type psa_jpake_state = ::core::ffi::c_uint; -pub use self::psa_jpake_state as psa_jpake_state_t; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_INVALID: psa_jpake_sequence = 0; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_KEY_SHARE: psa_jpake_sequence = 1; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PUBLIC: psa_jpake_sequence = 2; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PROOF: psa_jpake_sequence = 3; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_KEY_SHARE: psa_jpake_sequence = 4; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PUBLIC: psa_jpake_sequence = 5; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PROOF: psa_jpake_sequence = 6; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_END: psa_jpake_sequence = 7; -pub type psa_jpake_sequence = ::core::ffi::c_uint; -pub use self::psa_jpake_sequence as psa_jpake_sequence_t; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = + 3; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + mbedtls_key_exchange_type_t = 4; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = + 8; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = + 9; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = 10; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = 11; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; -pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; -pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_jpake_computation_stage_s { - pub private_state: psa_jpake_state_t, - pub private_sequence: psa_jpake_sequence_t, - pub private_input_step: psa_jpake_step_t, - pub private_output_step: psa_jpake_step_t, -} -impl Default for psa_jpake_computation_stage_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_pake_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_stage: u8, - pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, - pub private_data: psa_pake_operation_s__bindgen_ty_2, -} +pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; +/// \brief This structure is used for storing ciphersuite information +/// +/// \note members are defined using integral types instead of enums +/// in order to pack structure and reduce memory usage by internal +/// \c ciphersuite_definitions[] #[repr(C)] #[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_jpake: psa_jpake_computation_stage_t, +pub struct mbedtls_ssl_ciphersuite_t { + pub private_id: ::core::ffi::c_int, + pub private_name: *const ::core::ffi::c_char, + pub private_cipher: u8, + pub private_mac: u8, + pub private_key_exchange: u8, + pub private_flags: u8, + pub private_min_tls_version: u16, + pub private_max_tls_version: u16, } -impl Default for psa_pake_operation_s__bindgen_ty_1 { +impl Default for mbedtls_ssl_ciphersuite_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -18651,29 +19851,23 @@ impl Default for psa_pake_operation_s__bindgen_ty_1 { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_2 { - pub private_ctx: psa_driver_pake_context_t, - pub private_inputs: psa_crypto_driver_pake_inputs_t, +unsafe extern "C" { + pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; } -impl Default for psa_pake_operation_s__bindgen_ty_2 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_string( + ciphersuite_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ssl_ciphersuite_t; } -impl Default for psa_pake_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_id( + ciphersuite_id: ::core::ffi::c_int, + ) -> *const mbedtls_ssl_ciphersuite_t; +} +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( + info: *const mbedtls_ssl_ciphersuite_t, + ) -> usize; } /// Type-length-value structure that allows for ASN1 using DER. pub type mbedtls_x509_buf = mbedtls_asn1_buf; @@ -18684,6 +19878,23 @@ pub type mbedtls_x509_bitstring = mbedtls_asn1_bitstring; pub type mbedtls_x509_name = mbedtls_asn1_named_data; /// Container for a sequence of ASN.1 items pub type mbedtls_x509_sequence = mbedtls_asn1_sequence; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_authority { + pub keyIdentifier: mbedtls_x509_buf, + pub authorityCertIssuer: mbedtls_x509_sequence, + pub authorityCertSerialNumber: mbedtls_x509_buf, + pub raw: mbedtls_x509_buf, +} +impl Default for mbedtls_x509_authority { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} /// Container for date and time (precision in seconds). #[repr(C)] #[derive(Default, Copy, Clone)] @@ -18775,9 +19986,9 @@ pub struct mbedtls_x509_subject_alternative_name { #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_x509_subject_alternative_name__bindgen_ty_1 { - ///< The otherName supported type. pub other_name: mbedtls_x509_san_other_name, - ///< The buffer for the unconstructed types. Only rfc822Name, dnsName and uniformResourceIdentifier are currently supported + pub directory_name: mbedtls_x509_name, + ///< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. pub unstructured_name: mbedtls_x509_buf, } impl Default for mbedtls_x509_subject_alternative_name__bindgen_ty_1 { @@ -18798,6 +20009,21 @@ impl Default for mbedtls_x509_subject_alternative_name { } } } +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_san_list { + pub node: mbedtls_x509_subject_alternative_name, + pub next: *mut mbedtls_x509_san_list, +} +impl Default for mbedtls_x509_san_list { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { /// \brief Store the certificate DN in printable form into buf; /// no more than size characters will be written. @@ -18814,6 +20040,26 @@ unsafe extern "C" { dn: *const mbedtls_x509_name, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Convert the certificate DN string \p name into + /// a linked list of mbedtls_x509_name (equivalent to + /// mbedtls_asn1_named_data). + /// + /// \note This function allocates a linked list, and places the head + /// pointer in \p head. This list must later be freed by a + /// call to mbedtls_asn1_free_named_data_list(). + /// + /// \param[out] head Address in which to store the pointer to the head of the + /// allocated list of mbedtls_x509_name. Must point to NULL on + /// entry. + /// \param[in] name The string representation of a DN to convert + /// + /// \return 0 on success, or a negative error code. + pub fn mbedtls_x509_string_to_names( + head: *mut *mut mbedtls_asn1_named_data, + name: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Store the certificate serial in printable form into buf; /// no more than size characters will be written. @@ -18830,6 +20076,20 @@ unsafe extern "C" { serial: *const mbedtls_x509_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Compare pair of mbedtls_x509_time. + /// + /// \param t1 mbedtls_x509_time to compare + /// \param t2 mbedtls_x509_time to compare + /// + /// \return < 0 if t1 is before t2 + /// 0 if t1 equals t2 + /// > 0 if t1 is after t2 + pub fn mbedtls_x509_time_cmp( + t1: *const mbedtls_x509_time, + t2: *const mbedtls_x509_time, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Check a given mbedtls_x509_time against the system time /// and tell if it's in the past. @@ -18858,21 +20118,25 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief This function parses an item in the SubjectAlternativeNames - /// extension. + /// extension. Please note that this function might allocate + /// additional memory for a subject alternative name, thus + /// mbedtls_x509_free_subject_alt_name has to be called + /// to dispose of this additional memory afterwards. /// /// \param san_buf The buffer holding the raw data item of the subject /// alternative name. /// \param san The target structure to populate with the parsed presentation - /// of the subject alternative name encoded in \p san_raw. + /// of the subject alternative name encoded in \p san_buf. /// /// \note Supported GeneralName types, as defined in RFC 5280: - /// "rfc822Name", "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + /// "rfc822Name", "dnsName", "directoryName", + /// "uniformResourceIdentifier" and "hardware_module_name" /// of type "otherName", as defined in RFC 4108. /// /// \note This function should be called on a single raw data of /// subject alternative name. For example, after successful /// certificate parsing, one must iterate on every item in the - /// \p crt->subject_alt_names sequence, and pass it to + /// \c crt->subject_alt_names sequence, and pass it to /// this function. /// /// \warning The target structure contains pointers to the raw data of the @@ -18889,173 +20153,29 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \} addtogroup x509_module - pub fn mbedtls_x509_get_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - cur: *mut mbedtls_x509_name, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg_null( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - params: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_rsassa_pss_params( - params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - mgf_md: *mut mbedtls_md_type_t, - salt_len: *mut ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - sig: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig_alg( - sig_oid: *const mbedtls_x509_buf, - sig_params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - pk_alg: *mut mbedtls_pk_type_t, - sig_opts: *mut *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_time( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - t: *mut mbedtls_x509_time, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_serial( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - serial: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ext( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ext: *mut mbedtls_x509_buf, - tag: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_sig_alg_gets( - buf: *mut ::core::ffi::c_char, - size: usize, - sig_oid: *const mbedtls_x509_buf, - pk_alg: mbedtls_pk_type_t, - md_alg: mbedtls_md_type_t, - sig_opts: *const ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_key_size_helper( - buf: *mut ::core::ffi::c_char, - buf_size: usize, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_string_to_names( - head: *mut *mut mbedtls_asn1_named_data, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_set_extension( - head: *mut *mut mbedtls_asn1_named_data, - oid: *const ::core::ffi::c_char, - oid_len: usize, - critical: ::core::ffi::c_int, - val: *const ::core::ffi::c_uchar, - val_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_extensions( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_names( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_sig( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - oid: *const ::core::ffi::c_char, - oid_len: usize, - sig: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ns_cert_type( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ns_cert_type: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_key_usage( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - key_usage: *mut ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_subject_alt_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - subject_alt_name: *mut mbedtls_x509_sequence, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_subject_alt_name( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - subject_alt_name: *const mbedtls_x509_sequence, - prefix: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_cert_type( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - ns_cert_type: ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \brief Unallocate all data related to subject alternative name + /// + /// \param san SAN structure - extra memory owned by this structure will be freed + pub fn mbedtls_x509_free_subject_alt_name(san: *mut mbedtls_x509_subject_alternative_name); } unsafe extern "C" { - pub fn mbedtls_x509_info_key_usage( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - key_usage: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \brief This function parses a CN string as an IP address. + /// + /// \param cn The CN string to parse. CN string MUST be null-terminated. + /// \param dst The target buffer to populate with the binary IP address. + /// The buffer MUST be 16 bytes to save IPv6, and should be + /// 4-byte aligned if the result will be used as struct in_addr. + /// e.g. uint32_t dst[4] + /// + /// \note \p cn is parsed as an IPv6 address if string contains ':', + /// else \p cn is parsed as an IPv4 address. + /// + /// \return Length of binary IP address; num bytes written to target. + /// \return \c 0 on failure to parse CN string as an IP address. + pub fn mbedtls_x509_crt_parse_cn_inet_pton( + cn: *const ::core::ffi::c_char, + dst: *mut ::core::ffi::c_void, + ) -> usize; } /// Certificate revocation list entry. /// Contains the CA-specific serial numbers and revocation dates. @@ -19247,8 +20367,12 @@ pub struct mbedtls_x509_crt { pub subject_id: mbedtls_x509_buf, ///< Optional X.509 v3 extensions. pub v3_ext: mbedtls_x509_buf, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, + ///< Optional X.509 v3 extension subject key identifier. + pub subject_key_id: mbedtls_x509_buf, + ///< Optional X.509 v3 extension authority key identifier. + pub authority_key_id: mbedtls_x509_authority, ///< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). pub certificate_policies: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions @@ -19347,6 +20471,22 @@ impl Default for mbedtls_x509write_cert { } } } +unsafe extern "C" { + /// \brief Set Subject Alternative Name + /// + /// \param ctx Certificate context to use + /// \param san_list List of SAN values + /// + /// \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + /// + /// \note "dnsName", "uniformResourceIdentifier", "IP address", + /// "otherName", and "DirectoryName", as defined in RFC 5280, + /// are supported. + pub fn mbedtls_x509write_crt_set_subject_alternative_name( + ctx: *mut mbedtls_x509write_cert, + san_list: *const mbedtls_x509_san_list, + ) -> ::core::ffi::c_int; +} /// Item in a verification chain: cert and flags for it #[repr(C)] #[derive(Copy, Clone)] @@ -19685,8 +20825,12 @@ unsafe extern "C" { /// \param cn The expected Common Name. This will be checked to be /// present in the certificate's subjectAltNames extension or, /// if this extension is absent, as a CN component in its - /// Subject name. Currently only DNS names are supported. This - /// may be \c NULL if the CN need not be verified. + /// Subject name. DNS names and IP addresses are fully + /// supported, while the URI subtype is partially supported: + /// only exact matching, without any normalization procedures + /// described in 7.4 of RFC5280, will result in a positive + /// URI verification. + /// This may be \c NULL if the CN need not be verified. /// \param flags The address at which to store the result of the verification. /// If the verification couldn't be completed, the flag value is /// set to (uint32_t) -1. @@ -19917,6 +21061,16 @@ unsafe extern "C" { /// \param crt Certificate chain to free pub fn mbedtls_x509_crt_free(crt: *mut mbedtls_x509_crt); } +unsafe extern "C" { + /// \brief Access the ca_istrue field + /// + /// \param[in] crt Certificate to be queried, must not be \c NULL + /// + /// \return \c 1 if this a CA certificate \c 0 otherwise. + /// \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + /// the Optional Basic Constraint extension. + pub fn mbedtls_x509_crt_get_ca_istrue(crt: *const mbedtls_x509_crt) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Initialize a CRT writing context /// @@ -19997,7 +21151,7 @@ unsafe extern "C" { /// \brief Set the issuer name for a Certificate /// Issuer names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS CA" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS CA" /// /// \param ctx CRT context to use /// \param issuer_name issuer name to set @@ -20013,7 +21167,7 @@ unsafe extern "C" { /// \brief Set the subject name for a Certificate /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CRT context to use /// \param subject_name subject name to set @@ -20183,13 +21337,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20209,13 +21357,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20336,13 +21478,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20415,13 +21551,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20455,13 +21585,7 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, output_size: usize, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20492,7 +21616,7 @@ unsafe extern "C" { /// initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p field is invalid. + /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. /// \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. pub fn mbedtls_dhm_get_value( ctx: *const mbedtls_dhm_context, @@ -20620,6 +21744,18 @@ impl Default for mbedtls_ecdh_context { } } } +unsafe extern "C" { + /// \brief Return the ECP group for provided context. + /// + /// \note To access group specific fields, users should use + /// `mbedtls_ecp_curve_info_from_grp_id` or + /// `mbedtls_ecp_group_load` on the extracted `group_id`. + /// + /// \param ctx The ECDH context to parse. This must not be \c NULL. + /// + /// \return The \c mbedtls_ecp_group_id of the context. + pub fn mbedtls_ecdh_get_grp_id(ctx: *mut mbedtls_ecdh_context) -> mbedtls_ecp_group_id; +} unsafe extern "C" { /// \brief Check whether a given group can be used for ECDH. /// @@ -20656,13 +21792,7 @@ unsafe extern "C" { grp: *mut mbedtls_ecp_group, d: *mut mbedtls_mpi, Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20701,13 +21831,7 @@ unsafe extern "C" { z: *mut mbedtls_mpi, Q: *const mbedtls_ecp_point, d: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20774,13 +21898,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20816,7 +21934,7 @@ unsafe extern "C" { /// \brief This function sets up an ECDH context from an EC key. /// /// It is used by clients and servers in place of the - /// ServerKeyEchange for static ECDH, and imports ECDH + /// ServerKeyExchange for static ECDH, and imports ECDH /// parameters from the EC key information of a certificate. /// /// \see ecp.h @@ -20865,13 +21983,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20932,19 +22044,14 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_ssl_premaster_secret { + pub dummy: ::core::ffi::c_uchar, pub _pms_rsa: [::core::ffi::c_uchar; 48usize], pub _pms_dhm: [::core::ffi::c_uchar; 1024usize], pub _pms_ecdh: [::core::ffi::c_uchar; 66usize], @@ -21216,6 +22323,8 @@ pub struct mbedtls_ssl_session { ///< MaxFragmentLength negotiated by peer pub private_mfl_code: ::core::ffi::c_uchar, pub private_exported: ::core::ffi::c_uchar, + ///< 0: client, 1: server + pub private_endpoint: u8, /// TLS version negotiated in the session. Used if and when renegotiating /// or resuming a session instead of the configured minor TLS version. pub private_tls_version: mbedtls_ssl_protocol_version, @@ -21234,15 +22343,13 @@ pub struct mbedtls_ssl_session { ///< RFC 5077 session ticket pub private_ticket: *mut ::core::ffi::c_uchar, ///< session ticket length - pub private_ticket_len: usize, - ///< ticket lifetime hint - pub private_ticket_lifetime: u32, - ///< 0: client, 1: server - pub private_endpoint: u8, - ///< Ticket flags - pub private_ticket_flags: u8, + pub private_ticket_len: usize, + ///< ticket lifetime hint + pub private_ticket_lifetime: u32, ///< Randomly generated value used to obscure the age of the ticket pub private_ticket_age_add: u32, + ///< Ticket flags + pub private_ticket_flags: u8, ///< resumption_key length pub private_resumption_key_len: u8, pub private_resumption_key: [::core::ffi::c_uchar; 48usize], @@ -21581,22 +22688,30 @@ pub struct mbedtls_ssl_context { ///number of retransmissions of request if ///renego_max_records is < 0 pub private_renego_records_seen: ::core::ffi::c_int, - /// Server: Negotiated TLS protocol version. - /// Client: Maximum TLS version to be negotiated, then negotiated TLS - /// version. - /// - /// It is initialized as the maximum TLS version to be negotiated in the - /// ClientHello writing preparation stage and used throughout the - /// ClientHello writing. For a fresh handshake not linked to any previous - /// handshake, it is initialized to the configured maximum TLS version - /// to be negotiated. When renegotiating or resuming a session, it is - /// initialized to the previously negotiated TLS version. - /// - /// Updated to the negotiated TLS version as soon as the ServerHello is - /// received. + /// Maximum TLS version to be negotiated, then negotiated TLS version. + /// + /// It is initialized as the configured maximum TLS version to be + /// negotiated by mbedtls_ssl_setup(). + /// + /// When renegotiating or resuming a session, it is overwritten in the + /// ClientHello writing preparation stage with the previously negotiated + /// TLS version. + /// + /// On client side, it is updated to the TLS version selected by the server + /// for the handshake when the ServerHello is received. + /// + /// On server side, it is updated to the TLS version the server selects for + /// the handshake when the ClientHello is received. pub private_tls_version: mbedtls_ssl_protocol_version, - ///< records with a bad MAC received - pub private_badmac_seen: ::core::ffi::c_uint, + /// Multipurpose field. + /// + /// - DTLS: records with a bad MAC received. + /// - TLS: accumulated length of handshake fragments (up to \c in_hslen). + /// + /// This field is multipurpose in order to preserve the ABI in the + /// Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + /// and called `badmac_seen`. + pub private_badmac_seen_or_in_hsfraglen: ::core::ffi::c_uint, /// Callback to customize X.509 certificate chain verification pub private_f_vrfy: ::core::option::Option< unsafe extern "C" fn( @@ -21733,8 +22848,33 @@ pub struct mbedtls_ssl_context { pub private_cur_out_ctr: [::core::ffi::c_uchar; 8usize], ///< path mtu, used to fragment outgoing messages pub private_mtu: u16, - ///< expected peer CN for verification - ///(and SNI if available) + /// Expected peer CN for verification. + /// + /// Also used on clients for SNI, + /// and for TLS 1.3 session resumption using tickets. + /// + /// The value of this field can be: + /// - \p NULL in a newly initialized or reset context. + /// - A heap-allocated copy of the last value passed to + /// mbedtls_ssl_set_hostname(), if the last call had a non-null + /// \p hostname argument. + /// - A special value to indicate that mbedtls_ssl_set_hostname() + /// was called with \p NULL (as opposed to never having been called). + /// See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + /// + /// If this field contains the value \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is unset, on a TLS client, attempting to verify a server certificate + /// results in the error + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + /// + /// If this field contains the special value described above, or if + /// the value is \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is set, then the peer name verification is skipped, which may be + /// insecure, especially on a client. Furthermore, on a client, the + /// server_name extension is not sent, and the server name is ignored + /// in TLS 1.3 session resumption using tickets. pub private_hostname: *mut ::core::ffi::c_char, ///< negotiated protocol pub private_alpn_chosen: *const ::core::ffi::c_char, @@ -21830,6 +22970,14 @@ unsafe extern "C" { /// Calling mbedtls_ssl_setup again is not supported, even /// if no session is active. /// + /// \warning After setting up a client context, if certificate-based + /// authentication is enabled, you should call + /// mbedtls_ssl_set_hostname() to specifiy the expected + /// name of the server. Without this, in most scenarios, + /// the TLS connection is insecure. See + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more information. + /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. @@ -21933,18 +23081,16 @@ unsafe extern "C" { unsafe extern "C" { /// \brief Set the random number generator callback /// + /// \note The callback with its parameter must remain valid as + /// long as there is an SSL context that uses the + /// SSL configuration. + /// /// \param conf SSL configuration /// \param f_rng RNG function (mandatory) /// \param p_rng RNG parameter pub fn mbedtls_ssl_conf_rng( conf: *mut mbedtls_ssl_config, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ); } @@ -22047,10 +23193,10 @@ unsafe extern "C" { /// \param own_cid The address of the readable buffer holding the CID we want /// the peer to use when sending encrypted messages to us. /// This may be \c NULL if \p own_cid_len is \c 0. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// \param own_cid_len The length of \p own_cid. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// /// \note The value of \p own_cid_len must match the value of the @@ -22705,16 +23851,16 @@ unsafe extern "C" { /// a full handshake. /// /// \note This function can handle a variety of mechanisms for session - /// resumption: For TLS 1.2, both session ID-based resumption and - /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and loading - /// one or more sessions via this call will lead to their - /// corresponding tickets being advertised as resumption PSKs - /// by the client. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// resumption: For TLS 1.2, both session ID-based resumption + /// and ticket-based resumption will be considered. For TLS 1.3, + /// sessions equate to tickets, and loading one session by + /// calling this function will lead to its corresponding ticket + /// being advertised as resumption PSK by the client. This + /// depends on session tickets being enabled (see + /// #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + /// If session tickets are disabled, a call to this function + /// with a TLS 1.3 session, will not have any effect on the next + /// handshake for the SSL context \p ssl. /// /// \param ssl The SSL context representing the connection which should /// be attempted to be setup using session resumption. This @@ -22729,9 +23875,10 @@ unsafe extern "C" { /// /// \return \c 0 if successful. /// \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session - /// could not be loaded because of an implementation limitation. - /// This error is non-fatal, and has no observable effect on - /// the SSL context or the session that was attempted to be loaded. + /// could not be loaded because one session has already been + /// loaded. This error is non-fatal, and has no observable + /// effect on the SSL context or the session that was attempted + /// to be loaded. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_get_session() @@ -22789,8 +23936,8 @@ unsafe extern "C" { /// /// \param session The session structure to be saved. /// \param buf The buffer to write the serialized data to. It must be a - /// writeable buffer of at least \p len bytes, or may be \c - /// NULL if \p len is \c 0. + /// writeable buffer of at least \p buf_len bytes, or may be \c + /// NULL if \p buf_len is \c 0. /// \param buf_len The number of bytes available for writing in \p buf. /// \param olen The size in bytes of the data that has been or would have /// been written. It must point to a valid \c size_t. @@ -22800,8 +23947,16 @@ unsafe extern "C" { /// to determine the necessary size by calling this function /// with \p buf set to \c NULL and \p buf_len to \c 0. /// + /// \note For TLS 1.3 sessions, this feature is supported only if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + /// as in TLS 1.3 session resumption is possible only with + /// tickets. + /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + /// and the session is a TLS 1.3 session. pub fn mbedtls_ssl_session_save( session: *const mbedtls_ssl_session, buf: *mut ::core::ffi::c_uchar, @@ -22927,7 +24082,7 @@ unsafe extern "C" { /// record headers. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len /// is too large. pub fn mbedtls_ssl_conf_cid( conf: *mut mbedtls_ssl_config, @@ -23254,6 +24409,8 @@ unsafe extern "C" { /// used for certificate signature are controlled by the /// verification profile, see \c mbedtls_ssl_conf_cert_profile(). /// + /// \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + /// /// \note This list should be ordered by decreasing preference /// (preferred hash first). /// @@ -23278,27 +24435,43 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Configure allowed signature algorithms for use in TLS 1.3 + /// \brief Configure allowed signature algorithms for use in TLS /// /// \param conf The SSL configuration to use. /// \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, - /// terminated by \c MBEDTLS_TLS1_3_SIG_NONE. The list must remain - /// available throughout the lifetime of the conf object. Supported - /// values are available as \c MBEDTLS_TLS1_3_SIG_XXXX + /// terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + /// available throughout the lifetime of the conf object. + /// - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + /// used. + /// - For TLS 1.2, values should be given as + /// "(HashAlgorithm << 8) | SignatureAlgorithm". pub fn mbedtls_ssl_conf_sig_algs(conf: *mut mbedtls_ssl_config, sig_algs: *const u16); } unsafe extern "C" { /// \brief Set or reset the hostname to check against the received - /// server certificate. It sets the ServerName TLS extension, - /// too, if that extension is enabled. (client-side only) + /// peer certificate. On a client, this also sets the + /// ServerName TLS extension, if that extension is enabled. + /// On a TLS 1.3 client, this also sets the server name in + /// the session resumption ticket, if that feature is enabled. /// /// \param ssl SSL context - /// \param hostname the server hostname, may be NULL to clear hostname - /// - /// \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. - /// - /// \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on - /// allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + /// \param hostname The server hostname. This may be \c NULL to clear + /// the hostname. + /// + /// \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + /// + /// \note If the hostname is \c NULL on a client, then the server + /// is not authenticated: it only needs to have a valid + /// certificate, not a certificate matching its name. + /// Therefore you should always call this function on a client, + /// unless the connection is set up to only allow + /// pre-shared keys, or in scenarios where server + /// impersonation is not a concern. See the documentation of + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more details. + /// + /// \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + /// allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on /// too long input hostname. /// /// Hostname set to the one provided on success (cleared @@ -23311,8 +24484,8 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief Retrieve SNI extension value for the current handshake. - /// Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), - /// this is the same value passed to \p f_sni callback of + /// Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + /// this is the same value passed to \c f_sni callback of /// \c mbedtls_ssl_conf_sni() and may be used instead of /// \c mbedtls_ssl_conf_sni(). /// @@ -23321,10 +24494,10 @@ unsafe extern "C" { /// 0 if SNI extension is not present or not yet processed. /// /// \return const pointer to SNI extension value. - /// - value is valid only when called in \p f_cert_cb + /// - value is valid only when called in \c f_cert_cb /// registered with \c mbedtls_ssl_conf_cert_cb(). /// - value is NULL if SNI extension is not present. - /// - value is not '\0'-terminated. Use \c name_len for len. + /// - value is not '\0'-terminated. Use \c name_len for len. /// - value must not be freed. pub fn mbedtls_ssl_get_hs_sni( ssl: *mut mbedtls_ssl_context, @@ -23574,6 +24747,10 @@ unsafe extern "C" { /// with \c mbedtls_ssl_read()), not handshake messages. /// With DTLS, this affects both ApplicationData and handshake. /// + /// \note Defragmentation of TLS handshake messages is supported + /// with some limitations. See the documentation of + /// mbedtls_ssl_handshake() for details. + /// /// \note This sets the maximum length for a record's payload, /// excluding record overhead that will be added to it, see /// \c mbedtls_ssl_get_record_expansion(). @@ -23607,19 +24784,48 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Enable / Disable session tickets (client only). - /// (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + /// \brief Enable / Disable TLS 1.2 session tickets (client only, + /// TLS 1.2 only). Enabled by default. /// /// \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). /// /// \param conf SSL configuration - /// \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or - /// MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + /// \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) pub fn mbedtls_ssl_conf_session_tickets( conf: *mut mbedtls_ssl_config, use_tickets: ::core::ffi::c_int, ); } +unsafe extern "C" { + /// \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + /// (client only, TLS 1.3 only). + /// + /// The handling of TLS 1.3 NewSessionTicket messages is disabled by + /// default. + /// + /// In TLS 1.3, servers may send a NewSessionTicket message at any time, + /// and may send multiple NewSessionTicket messages. By default, TLS 1.3 + /// clients ignore NewSessionTicket messages. + /// + /// To support session tickets in TLS 1.3 clients, call this function + /// with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + /// this is enabled, when a client receives a NewSessionTicket message, + /// the next call to a message processing functions (notably + /// mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + /// call mbedtls_ssl_get_session() to retrieve the session ticket before + /// calling the same message processing function again. + /// + /// \param conf SSL configuration + /// \param signal_new_session_tickets Enable or disable + /// (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + pub fn mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + conf: *mut mbedtls_ssl_config, + signal_new_session_tickets: ::core::ffi::c_int, + ); +} unsafe extern "C" { /// \brief Number of NewSessionTicket messages for the server to send /// after handshake completion. @@ -23948,29 +25154,22 @@ unsafe extern "C" { /// \param ssl The SSL context representing the connection for which to /// to export a session structure for later resumption. /// \param session The target structure in which to store the exported session. - /// This must have been initialized with mbedtls_ssl_init_session() + /// This must have been initialized with mbedtls_ssl_session_init() /// but otherwise be unused. /// /// \note This function can handle a variety of mechanisms for session /// resumption: For TLS 1.2, both session ID-based resumption and /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and calling - /// this function multiple times will export the available - /// tickets one a time until no further tickets are available, - /// in which case MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE will - /// be returned. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// sessions equate to tickets, and if session tickets are + /// enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + /// option), this function exports the last received ticket and + /// the exported session may be used to resume the TLS 1.3 + /// session. If session tickets are disabled, exported sessions + /// cannot be used to resume a TLS 1.3 session. /// /// \return \c 0 if successful. In this case, \p session can be used for /// session resumption by passing it to mbedtls_ssl_set_session(), /// and serialized for storage via mbedtls_ssl_session_save(). - /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no further session - /// is available for export. - /// This error is a non-fatal, and has no observable effect on - /// the SSL context or the destination session. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_set_session() @@ -24002,6 +25201,17 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use /// and the client did not demonstrate reachability yet - in /// this case you must stop using the context (see below). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24010,7 +25220,9 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24030,10 +25242,31 @@ unsafe extern "C" { /// currently being processed might or might not contain further /// DTLS records. /// - /// \note If the context is configured to allow TLS 1.3, or if - /// #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. + /// Otherwise, the handshake may call psa_crypto_init() + /// if a negotiation involving TLS 1.3 takes place (this may + /// be the case even if TLS 1.3 is offered but eventually + /// not selected). + /// + /// \note In TLS, reception of fragmented handshake messages is + /// supported with some limitations (those limitations do + /// not apply to DTLS, where defragmentation is fully + /// supported): + /// - On an Mbed TLS server that only accepts TLS 1.2, + /// the initial ClientHello message must not be fragmented. + /// A TLS 1.2 ClientHello may be fragmented if the server + /// also accepts TLS 1.3 connections (meaning + /// that #MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the + /// accepted versions have not been restricted with + /// mbedtls_ssl_conf_max_tls_version() or the like). + /// - The first fragment of a handshake message must be + /// at least 4 bytes long. + /// - Non-handshake records must not be interleaved between + /// the fragments of a handshake message. (This is permitted + /// in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + /// even in TLS 1.2.) pub fn mbedtls_ssl_handshake(ssl: *mut mbedtls_ssl_context) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -24062,8 +25295,10 @@ unsafe extern "C" { /// /// \warning If this function returns something other than \c 0, /// #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using /// the SSL context for reading or writing, and either free it /// or call \c mbedtls_ssl_session_reset() on it before /// re-using it for a new connection; the current connection @@ -24126,6 +25361,24 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server /// side of a DTLS connection and the client is initiating a /// new connection using the same source port. See below. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. + /// This error code is only returned on the client side. It is + /// only returned if handling of TLS 1.3 NewSessionTicket + /// messages has been enabled through + /// mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + /// This error code indicates that a TLS 1.3 NewSessionTicket + /// message has been received and parsed successfully by the + /// client. The ticket data can be retrieved from the SSL + /// context by calling mbedtls_ssl_get_session(). It remains + /// available until the next call to mbedtls_ssl_read(). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24134,8 +25387,10 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24202,6 +25457,17 @@ unsafe extern "C" { /// operation is in progress (see mbedtls_ecp_set_max_ops()) - /// in this case you must call this function again to complete /// the handshake when you're done attending other tasks. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24209,8 +25475,10 @@ unsafe extern "C" { /// a non-negative value, /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24451,381 +25719,64 @@ unsafe extern "C" { /// \brief Free an SSL configuration context /// /// \param conf SSL configuration context - pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); -} -unsafe extern "C" { - /// \brief Initialize SSL session structure - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief Free referenced items in an SSL session including the - /// peer certificate and clear memory - /// - /// \note A session object can be freed even if the SSL context - /// that was used to retrieve the session is still in use. - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief TLS-PRF function for key derivation. - /// - /// \param prf The tls_prf type function type to be used. - /// \param secret Secret for the key derivation function. - /// \param slen Length of the secret. - /// \param label String label for the key derivation function, - /// terminated with null character. - /// \param random Random bytes. - /// \param rlen Length of the random bytes buffer. - /// \param dstbuf The buffer holding the derived key. - /// \param dlen Length of the output buffer. - /// - /// \return 0 on success. An SSL specific error on failure. - pub fn mbedtls_ssl_tls_prf( - prf: mbedtls_tls_prf_types, - secret: *const ::core::ffi::c_uchar, - slen: usize, - label: *const ::core::ffi::c_char, - random: *const ::core::ffi::c_uchar, - rlen: usize, - dstbuf: *mut ::core::ffi::c_uchar, - dlen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the threshold error level to handle globally all debug output. - /// Debug messages that have a level over the threshold value are - /// discarded. - /// (Default value: 0 = No debug ) - /// - /// \param threshold threshold level of messages to filter on. Messages at a - /// higher level will be discarded. - /// - Debug levels - /// - 0 No debug - /// - 1 Error - /// - 2 State change - /// - 3 Informational - /// - 4 Verbose - pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); -} -unsafe extern "C" { - /// \brief Print a message to the debug output. This function is always used - /// through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl - /// context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the message has occurred in - /// \param line line number the message has occurred at - /// \param format format specifier, in printf format - /// \param ... variables used by the format specifier - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_msg( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - format: *const ::core::ffi::c_char, - ... - ); -} -unsafe extern "C" { - /// \brief Print the return value of a function to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text the name of the function that returned the error - /// \param ret the return code value - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ret( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - ret: ::core::ffi::c_int, - ); -} -unsafe extern "C" { - /// \brief Output a buffer of size len bytes to the debug output. This function - /// is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the buffer being dumped. Normally the - /// variable or buffer name - /// \param buf the buffer to be outputted - /// \param len length of the buffer - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_buf( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - buf: *const ::core::ffi::c_uchar, - len: usize, - ); -} -unsafe extern "C" { - /// \brief Print a MPI variable to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the MPI being output. Normally the - /// variable name - /// \param X the MPI variable - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_mpi( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_mpi, - ); -} -unsafe extern "C" { - /// \brief Print an ECP point to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the ECP point being output. Normally the - /// variable name - /// \param X the ECP point - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ecp( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_ecp_point, - ); -} -unsafe extern "C" { - /// \brief Print a X.509 certificate structure to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the certificate being output - /// \param crt X.509 certificate structure - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_crt( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - crt: *const mbedtls_x509_crt, - ); -} -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Q: mbedtls_debug_ecdh_attr = 0; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_QP: mbedtls_debug_ecdh_attr = 1; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Z: mbedtls_debug_ecdh_attr = 2; -pub type mbedtls_debug_ecdh_attr = ::core::ffi::c_uint; -unsafe extern "C" { - /// \brief Print a field of the ECDH structure in the SSL context to the debug - /// output. This function is always used through the - /// MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file - /// and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param ecdh the ECDH context - /// \param attr the identifier of the attribute being output - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_printf_ecdh( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - ecdh: *const mbedtls_ecdh_context, - attr: mbedtls_debug_ecdh_attr, - ); -} -/// \brief Entropy poll callback pointer -/// -/// \param data Callback-specific data pointer -/// \param output Data to fill -/// \param len Maximum size to provide -/// \param olen The actual amount of bytes put into the buffer (Can be 0) -/// -/// \return 0 if no critical failures occurred, -/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise -pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< - unsafe extern "C" fn( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - ) -> ::core::ffi::c_int, ->; -/// \brief Entropy source state -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_source_state { - ///< The entropy source callback - pub private_f_source: mbedtls_entropy_f_source_ptr, - ///< The callback data pointer - pub private_p_source: *mut ::core::ffi::c_void, - ///< Amount received in bytes - pub private_size: usize, - ///< Minimum bytes required before release - pub private_threshold: usize, - ///< Is the source strong? - pub private_strong: ::core::ffi::c_int, -} -impl Default for mbedtls_entropy_source_state { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief Entropy context structure -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_context { - pub private_accumulator_started: ::core::ffi::c_int, - pub __bindgen_padding_0: u64, - pub private_accumulator: mbedtls_sha512_context, - pub private_source_count: ::core::ffi::c_int, - pub private_source: [mbedtls_entropy_source_state; 20usize], -} -impl Default for mbedtls_entropy_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize the context - /// - /// \param ctx Entropy context to initialize - pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Free the data in the context - /// - /// \param ctx Entropy context to free - pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Adds an entropy source to poll - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context - /// \param f_source Entropy function - /// \param p_source Function data - /// \param threshold Minimum required from source before entropy is released - /// ( with mbedtls_entropy_func() ) (in bytes) - /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or - /// MBEDTLS_ENTROPY_SOURCE_WEAK. - /// At least one strong source needs to be added. - /// Weaker sources (such as the cycle counter) can be used as - /// a complement. - /// - /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES - pub fn mbedtls_entropy_add_source( - ctx: *mut mbedtls_entropy_context, - f_source: mbedtls_entropy_f_source_ptr, - p_source: *mut ::core::ffi::c_void, - threshold: usize, - strong: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); } unsafe extern "C" { - /// \brief Trigger an extra gather poll for the accumulator - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context + /// \brief Initialize SSL session structure /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Retrieve entropy from the accumulator - /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief Free referenced items in an SSL session including the + /// peer certificate and clear memory /// - /// \param data Entropy context - /// \param output Buffer to fill - /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + /// \note A session object can be freed even if the SSL context + /// that was used to retrieve the session is still in use. /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_func( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Add data to the accumulator manually - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief TLS-PRF function for key derivation. /// - /// \param ctx Entropy context - /// \param data Data to add - /// \param len Length of data + /// \param prf The tls_prf type function type to be used. + /// \param secret Secret for the key derivation function. + /// \param slen Length of the secret. + /// \param label String label for the key derivation function, + /// terminated with null character. + /// \param random Random bytes. + /// \param rlen Length of the random bytes buffer. + /// \param dstbuf The buffer holding the derived key. + /// \param dlen Length of the output buffer. /// - /// \return 0 if successful - pub fn mbedtls_entropy_update_manual( - ctx: *mut mbedtls_entropy_context, - data: *const ::core::ffi::c_uchar, - len: usize, + /// \return 0 on success. An SSL specific error on failure. + pub fn mbedtls_ssl_tls_prf( + prf: mbedtls_tls_prf_types, + secret: *const ::core::ffi::c_uchar, + slen: usize, + label: *const ::core::ffi::c_char, + random: *const ::core::ffi::c_uchar, + rlen: usize, + dstbuf: *mut ::core::ffi::c_uchar, + dlen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Checkup routine - /// - /// This module self-test also calls the entropy self-test, - /// mbedtls_entropy_source_self_test(); + /// \brief Set the threshold error level to handle globally all debug output. + /// Debug messages that have a level over the threshold value are + /// discarded. + /// (Default value: 0 = No debug ) /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; + /// \param threshold threshold level of messages to filter on. Messages at a + /// higher level will be discarded. + /// - Debug levels + /// - 0 No debug + /// - 1 Error + /// - 2 State change + /// - 3 Informational + /// - 4 Verbose + pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); } unsafe extern "C" { /// \brief This is the HMAC-based Extract-and-Expand Key Derivation Function @@ -24994,8 +25945,8 @@ unsafe extern "C" { /// \param len The length of the personalization string. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + /// where \c entropy_len is the entropy length /// described above. /// /// \return \c 0 if successful. @@ -25120,8 +26071,8 @@ unsafe extern "C" { /// \param len The length of the additional data. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length /// (see mbedtls_hmac_drbg_set_entropy_len()). /// /// \return \c 0 if successful. @@ -25604,6 +26555,28 @@ unsafe extern "C" { oid: *const mbedtls_asn1_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate a string containing a dotted-decimal + /// representation of an ASN.1 OID into its encoded form + /// (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + /// On success, this function allocates oid->buf from the + /// heap. It must be freed by the caller using mbedtls_free(). + /// + /// \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + /// \param oid_str string representation of the OID to parse + /// \param size length of the OID string, not including any null terminator + /// + /// \return 0 if successful + /// \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + /// represent a valid OID + /// \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + /// allocate oid->buf + pub fn mbedtls_oid_from_numeric_string( + oid: *mut mbedtls_asn1_buf, + oid_str: *const ::core::ffi::c_char, + size: usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate an X.509 extension OID into local values /// @@ -25681,6 +26654,34 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate AlgorithmIdentifier OID into an EC group identifier, + /// for curves that are directly encoded at this level + /// + /// \param oid OID to use + /// \param grp_id place to store group id + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_ec_grp_algid( + oid: *const mbedtls_asn1_buf, + grp_id: *mut mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Translate EC group identifier into AlgorithmIdentifier OID, + /// for curves that are directly encoded at this level + /// + /// \param grp_id EC group identifier + /// \param oid place to store ASN.1 OID string pointer + /// \param olen length of the OID + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_oid_by_ec_grp_algid( + grp_id: mbedtls_ecp_group_id, + oid: *mut *const ::core::ffi::c_char, + olen: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate SignatureAlgorithm OID into md_type and pk_type /// @@ -25848,11 +26849,11 @@ unsafe extern "C" { /// \param data source data to look in (must be nul-terminated) /// \param pwd password for decryption (can be NULL) /// \param pwdlen length of password - /// \param use_len destination for total length used (set after header is - /// correctly read, so unless you get + /// \param use_len destination for total length used from data buffer. It is + /// set after header is correctly read, so unless you get /// MBEDTLS_ERR_PEM_BAD_INPUT_DATA or /// MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is - /// the length to skip) + /// the length to skip. /// /// \note Attempts to check password correctness by verifying if /// the decrypted text starts with an ASN.1 sequence of @@ -25917,13 +26918,40 @@ unsafe extern "C" { unsafe extern "C" { /// \brief PKCS#5 PBES2 function /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs5_pbes2_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params the ASN.1 algorithm parameters - /// \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT /// \param pwd password to use when generating key /// \param pwdlen length of password /// \param data data to process /// \param datalen length of data - /// \param output output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. pub fn mbedtls_pkcs5_pbes2( @@ -25936,6 +26964,50 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief PKCS#5 PBES2 function + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params the ASN.1 algorithm parameters + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + /// \param pwd password to use when generating key + /// \param pwdlen length of password + /// \param data data to process + /// \param datalen length of data + /// \param output Output buffer. + /// On success, it contains the decrypted data. + /// On failure, the content is indetermidate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + pub fn mbedtls_pkcs5_pbes2_ext( + pbe_params: *const mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, + datalen: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context /// @@ -26167,6 +27239,25 @@ unsafe extern "C" { /// \brief PKCS12 Password Based function (encryption / decryption) /// for cipher-based and mbedtls_md-based PBE's /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs12_pbe_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or /// #MBEDTLS_PKCS12_PBE_DECRYPT @@ -26175,9 +27266,17 @@ unsafe extern "C" { /// \param pwd Latin1-encoded password used. This may only be \c NULL when /// \p pwdlen is 0. No null terminator should be used. /// \param pwdlen length of the password (may be 0) - /// \param input the input data + /// \param data the input data /// \param len data length - /// \param output the output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \return 0 if successful, or a MBEDTLS_ERR_XXX code pub fn mbedtls_pkcs12_pbe( @@ -26187,9 +27286,62 @@ unsafe extern "C" { md_type: mbedtls_md_type_t, pwd: *const ::core::ffi::c_uchar, pwdlen: usize, - input: *const ::core::ffi::c_uchar, + data: *const ::core::ffi::c_uchar, + len: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief PKCS12 Password Based function (encryption / decryption) + /// for cipher-based and mbedtls_md-based PBE's + /// + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + /// #MBEDTLS_PKCS12_PBE_DECRYPT + /// \param cipher_type the cipher used + /// \param md_type the mbedtls_md used + /// \param pwd Latin1-encoded password used. This may only be \c NULL when + /// \p pwdlen is 0. No null terminator should be used. + /// \param pwdlen length of the password (may be 0) + /// \param data the input data + /// \param len data length + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \return 0 if successful, or a MBEDTLS_ERR_XXX code + pub fn mbedtls_pkcs12_pbe_ext( + pbe_params: *mut mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + cipher_type: mbedtls_cipher_type_t, + md_type: mbedtls_md_type_t, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, len: usize, output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -26288,6 +27440,11 @@ unsafe extern "C" { /// \param session_id_len The length of \p session_id in bytes. /// \param session The address at which to store the session /// associated with \p session_id, if present. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + /// no cache entry with specified session ID found, or + /// any other negative error code for other failures. pub fn mbedtls_ssl_cache_get( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26304,6 +27461,9 @@ unsafe extern "C" { /// associated to \p session. /// \param session_id_len The length of \p session_id in bytes. /// \param session The session to store. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_set( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26317,12 +27477,13 @@ unsafe extern "C" { /// /// \param data The SSL cache context to use. /// \param session_id The pointer to the buffer holding the session ID - /// associated to \p session. + /// associated to session. /// \param session_id_len The length of \p session_id in bytes. /// - /// \return 0: The cache entry for session with provided ID - /// is removed or does not exist. - /// Otherwise: fail. + /// \return \c 0 on success. This indicates the cache entry for + /// the session with provided ID is removed or does not + /// exist. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_remove( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26375,13 +27536,7 @@ unsafe extern "C" { /// \brief Setup cookie context (generate keys) pub fn mbedtls_ssl_cookie_setup( ctx: *mut mbedtls_ssl_cookie_ctx, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26427,6 +27582,9 @@ unsafe extern "C" { #[derive(Copy, Clone)] pub struct mbedtls_ssl_ticket_key { pub private_name: [::core::ffi::c_uchar; 4usize], + /// Lifetime of the key in seconds. This is also the lifetime of the + /// tickets created under that key. + pub private_lifetime: u32, ///< context for auth enc/decryption pub private_ctx: mbedtls_cipher_context_t, } @@ -26482,7 +27640,9 @@ unsafe extern "C" { /// /// \param ctx Context to be set up /// \param f_rng RNG callback function (mandatory) - /// \param p_rng RNG callback context + /// \param p_rng RNG callback context. + /// Note that the RNG callback must remain valid + /// until the ticket context is freed. /// \param cipher AEAD cipher to use for ticket protection. /// Recommended value: MBEDTLS_CIPHER_AES_256_GCM. /// \param lifetime Tickets lifetime in seconds @@ -26492,21 +27652,21 @@ unsafe extern "C" { /// least as strong as the strongest ciphersuite /// supported. Usually that means a 256-bit key. /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_setup( ctx: *mut mbedtls_ssl_ticket_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, cipher: mbedtls_cipher_type_t, lifetime: u32, @@ -26537,10 +27697,16 @@ unsafe extern "C" { /// \note \c klength must be sufficient for use by cipher specified /// to \c mbedtls_ssl_ticket_setup /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_rotate( @@ -26606,7 +27772,7 @@ pub struct mbedtls_x509_csr { pub key_usage: ::core::ffi::c_uint, ///< Optional Netscape certificate type extension value: See the values in x509.h pub ns_cert_type: ::core::ffi::c_uchar, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions pub private_ext_types: ::core::ffi::c_int, @@ -26646,25 +27812,12 @@ impl Default for mbedtls_x509write_csr { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_x509_san_list { - pub node: mbedtls_x509_subject_alternative_name, - pub next: *mut mbedtls_x509_san_list, -} -impl Default for mbedtls_x509_san_list { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR) in DER format /// - /// \note CSR attributes (if any) are currently silently ignored. + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the CSR is rejected. /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling @@ -26681,6 +27834,70 @@ unsafe extern "C" { buflen: usize, ) -> ::core::ffi::c_int; } +/// \brief The type of certificate extension callbacks. +/// +/// Callbacks of this type are passed to and used by the +/// mbedtls_x509_csr_parse_der_with_ext_cb() routine when +/// it encounters either an unsupported extension. +/// Future versions of the library may invoke the callback +/// in other cases, if and when the need arises. +/// +/// \param p_ctx An opaque context passed to the callback. +/// \param csr The CSR being parsed. +/// \param oid The OID of the extension. +/// \param critical Whether the extension is critical. +/// \param p Pointer to the start of the extension value +/// (the content of the OCTET STRING). +/// \param end End of extension value. +/// +/// \note The callback must fail and return a negative error code +/// if it can not parse or does not support the extension. +/// When the callback fails to parse a critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() also fails. +/// When the callback fails to parse a non critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() simply skips +/// the extension and continues parsing. +/// +/// \return \c 0 on success. +/// \return A negative error code on failure. +pub type mbedtls_x509_csr_ext_cb_t = ::core::option::Option< + unsafe extern "C" fn( + p_ctx: *mut ::core::ffi::c_void, + csr: *const mbedtls_x509_csr, + oid: *const mbedtls_x509_buf, + critical: ::core::ffi::c_int, + p: *const ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +unsafe extern "C" { + /// \brief Load a Certificate Signing Request (CSR) in DER format + /// + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the result of the callback function decides whether + /// CSR is rejected. + /// + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. + /// + /// \param csr CSR context to fill + /// \param buf buffer holding the CRL data + /// \param buflen size of the buffer + /// \param cb A callback invoked for every unsupported certificate + /// extension. + /// \param p_ctx An opaque context passed to the callback. + /// + /// \return 0 if successful, or a specific X509 error code + pub fn mbedtls_x509_csr_parse_der_with_ext_cb( + csr: *mut mbedtls_x509_csr, + buf: *const ::core::ffi::c_uchar, + buflen: usize, + cb: mbedtls_x509_csr_ext_cb_t, + p_ctx: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR), DER or PEM format /// @@ -26742,7 +27959,7 @@ unsafe extern "C" { /// \brief Set the subject name for a CSR /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CSR context to use /// \param subject_name subject name to set @@ -26873,13 +28090,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26900,13 +28111,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } diff --git a/esp-mbedtls-sys/src/include/xtensa-esp32-none-elf.rs b/esp-mbedtls-sys/src/include/xtensa-esp32-none-elf.rs index 8a8f52f3..f6ce94cd 100644 --- a/esp-mbedtls-sys/src/include/xtensa-esp32-none-elf.rs +++ b/esp-mbedtls-sys/src/include/xtensa-esp32-none-elf.rs @@ -137,6 +137,36 @@ where } } } +#[repr(C)] +#[derive(Default)] +pub struct __IncompleteArrayField(::core::marker::PhantomData, [T; 0]); +impl __IncompleteArrayField { + #[inline] + pub const fn new() -> Self { + __IncompleteArrayField(::core::marker::PhantomData, []) + } + #[inline] + pub fn as_ptr(&self) -> *const T { + self as *const _ as *const T + } + #[inline] + pub fn as_mut_ptr(&mut self) -> *mut T { + self as *mut _ as *mut T + } + #[inline] + pub unsafe fn as_slice(&self, len: usize) -> &[T] { + ::core::slice::from_raw_parts(self.as_ptr(), len) + } + #[inline] + pub unsafe fn as_mut_slice(&mut self, len: usize) -> &mut [T] { + ::core::slice::from_raw_parts_mut(self.as_mut_ptr(), len) + } +} +impl ::core::fmt::Debug for __IncompleteArrayField { + fn fmt(&self, fmt: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result { + fmt.write_str("__IncompleteArrayField") + } +} pub const MBEDTLS_CONFIG_FILE: &[u8; 9] = b"config.h\0"; pub const MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT: u32 = 0; pub const MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: u32 = 1024; @@ -144,14 +174,33 @@ pub const MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE: u32 = 6000; pub const MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH: u32 = 32; pub const MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS: u32 = 1; pub const MBEDTLS_VERSION_MAJOR: u32 = 3; -pub const MBEDTLS_VERSION_MINOR: u32 = 4; -pub const MBEDTLS_VERSION_PATCH: u32 = 0; -pub const MBEDTLS_VERSION_NUMBER: u32 = 50593792; -pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.4.0\0"; -pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"mbed TLS 3.4.0\0"; +pub const MBEDTLS_VERSION_MINOR: u32 = 6; +pub const MBEDTLS_VERSION_PATCH: u32 = 5; +pub const MBEDTLS_VERSION_NUMBER: u32 = 50726144; +pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.6.5\0"; +pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"Mbed TLS 3.6.5\0"; +pub const PSA_WANT_ALG_MD5: u32 = 1; +pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; +pub const PSA_WANT_ALG_SHA_1: u32 = 1; +pub const PSA_WANT_ALG_SHA_224: u32 = 1; +pub const PSA_WANT_ALG_SHA_256: u32 = 1; +pub const PSA_WANT_ALG_SHA_384: u32 = 1; +pub const PSA_WANT_ALG_SHA_512: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_256: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_384: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_512: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_255: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_448: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_224: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_256: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_384: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_521: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CCM: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CMAC: u32 = 1; pub const PSA_WANT_ALG_CMAC: u32 = 1; @@ -162,10 +211,40 @@ pub const PSA_WANT_ALG_ECDSA: u32 = 1; pub const PSA_WANT_ALG_ECDSA_ANY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA: u32 = 1; pub const PSA_WANT_ALG_DETERMINISTIC_ECDSA: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_ALG_FFDH: u32 = 1; +pub const PSA_WANT_DH_RFC7919_2048: u32 = 1; +pub const PSA_WANT_DH_RFC7919_3072: u32 = 1; +pub const PSA_WANT_DH_RFC7919_4096: u32 = 1; +pub const PSA_WANT_DH_RFC7919_6144: u32 = 1; +pub const PSA_WANT_DH_RFC7919_8192: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_FFDH: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_GCM: u32 = 1; pub const PSA_WANT_ALG_GCM: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HMAC: u32 = 1; @@ -176,17 +255,16 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXTRACT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXPAND: u32 = 1; +pub const PSA_WANT_KEY_TYPE_HMAC: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF: u32 = 1; pub const PSA_WANT_ALG_TLS12_PRF: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const PSA_WANT_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_MD5: u32 = 1; -pub const PSA_WANT_ALG_MD5: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_PAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_JPAKE: u32 = 1; pub const PSA_WANT_ALG_JPAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160: u32 = 1; -pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const PSA_WANT_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN: u32 = 1; @@ -196,20 +274,19 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP: u32 = 1; pub const PSA_WANT_ALG_RSA_OAEP: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS: u32 = 1; pub const PSA_WANT_ALG_RSA_PSS: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_1: u32 = 1; -pub const PSA_WANT_ALG_SHA_1: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_224: u32 = 1; -pub const PSA_WANT_ALG_SHA_224: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_256: u32 = 1; -pub const PSA_WANT_ALG_SHA_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_384: u32 = 1; -pub const PSA_WANT_ALG_SHA_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_512: u32 = 1; -pub const PSA_WANT_ALG_SHA_512: u32 = 1; pub const PSA_WANT_KEY_TYPE_AES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES: u32 = 1; pub const PSA_WANT_KEY_TYPE_ARIA: u32 = 1; @@ -221,8 +298,8 @@ pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_KEY_TYPE_CHACHA20: u32 = 1; -pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20: u32 = 1; +pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER: u32 = 1; pub const PSA_WANT_ALG_CHACHA20_POLY1305: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305: u32 = 1; @@ -250,8 +327,7 @@ pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256: u32 = 1; -pub const PSA_HAVE_FULL_ECDSA: u32 = 1; -pub const PSA_HAVE_FULL_JPAKE: u32 = 1; +pub const PSA_WANT_ALG_SOME_PAKE: u32 = 1; pub const PSA_WANT_KEY_TYPE_DERIVE: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD_HASH: u32 = 1; @@ -272,7 +348,7 @@ pub const MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: i32 = -12; pub const MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: i32 = -14; pub const MBEDTLS_ERR_MPI_ALLOC_FAILED: i32 = -16; pub const MBEDTLS_MPI_MAX_LIMBS: u32 = 10000; -pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 2; +pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 3; pub const MBEDTLS_MPI_MAX_SIZE: u32 = 1024; pub const MBEDTLS_MPI_MAX_BITS: u32 = 8192; pub const MBEDTLS_MPI_MAX_BITS_SCALE100: u32 = 819200; @@ -320,6 +396,8 @@ pub const MBEDTLS_CIPHER_VARIABLE_KEY_LEN: u32 = 2; pub const MBEDTLS_MAX_IV_LENGTH: u32 = 16; pub const MBEDTLS_MAX_BLOCK_LENGTH: u32 = 16; pub const MBEDTLS_MAX_KEY_LENGTH: u32 = 64; +pub const MBEDTLS_KEY_BITLEN_SHIFT: u32 = 6; +pub const MBEDTLS_IV_SIZE_SHIFT: u32 = 2; pub const MBEDTLS_CCM_DECRYPT: u32 = 0; pub const MBEDTLS_CCM_ENCRYPT: u32 = 1; pub const MBEDTLS_CCM_STAR_DECRYPT: u32 = 2; @@ -332,7 +410,26 @@ pub const MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: i32 = -84; pub const MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: i32 = -86; pub const MBEDTLS_AES_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_DES3_BLOCK_SIZE: u32 = 8; +pub const MBEDTLS_CMAC_MAX_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_CIPHER_BLKSIZE_MAX: u32 = 16; +pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; +pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; +pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; +pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; +pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; +pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; +pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; +pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; +pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; +pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; +pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; +pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; +pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; +pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; +pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; +pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; +pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; +pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: i32 = -52; pub const MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: i32 = -54; pub const MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: i32 = -56; @@ -367,12 +464,6 @@ pub const MBEDTLS_ECP_MAX_PT_LEN: u32 = 133; pub const MBEDTLS_ECP_PF_UNCOMPRESSED: u32 = 0; pub const MBEDTLS_ECP_PF_COMPRESSED: u32 = 1; pub const MBEDTLS_ECP_TLS_NAMED_CURVE: u32 = 3; -pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; -pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; -pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; -pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; -pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; -pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; pub const MBEDTLS_ERR_RSA_BAD_INPUT_DATA: i32 = -16512; pub const MBEDTLS_ERR_RSA_INVALID_PADDING: i32 = -16640; pub const MBEDTLS_ERR_RSA_KEY_GEN_FAILED: i32 = -16768; @@ -387,6 +478,55 @@ pub const MBEDTLS_RSA_PKCS_V21: u32 = 1; pub const MBEDTLS_RSA_SIGN: u32 = 1; pub const MBEDTLS_RSA_CRYPT: u32 = 2; pub const MBEDTLS_RSA_SALT_LEN_ANY: i32 = -1; +pub const MBEDTLS_RSA_GEN_KEY_MIN_BITS: u32 = 1024; +pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; +pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; +pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; +pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; +pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; +pub const PSA_HASH_MAX_SIZE: u32 = 64; +pub const PSA_MAC_MAX_SIZE: u32 = 64; +pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; +pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; +pub const PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS: u32 = 1024; +pub const PSA_VENDOR_FFDH_MAX_KEY_BITS: u32 = 8192; +pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; +pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; +pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; +pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; +pub const PSA_VENDOR_PBKDF2_MAX_ITERATIONS: u32 = 4294967295; +pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; +pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_SIGNATURE_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_KEY_PAIR_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_PUBLIC_KEY_MAX_SIZE: u32 = 1; +pub const PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE: u32 = 1; +pub const PSA_CIPHER_MAX_KEY_LENGTH: u32 = 32; +pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; +pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; +pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; +pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; +pub const MBEDTLS_ERR_SHA3_BAD_INPUT_DATA: i32 = -118; +pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; +pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; +pub const MBEDTLS_GCM_DECRYPT: u32 = 0; +pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; +pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; +pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; +pub const MBEDTLS_GCM_HTABLE_SIZE: u32 = 16; +pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; +pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; +pub const PSA_MAX_KEY_BITS: u32 = 65528; +pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; +pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; +pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; +pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; +pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; +pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; +pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_ERR_PK_ALLOC_FAILED: i32 = -16256; pub const MBEDTLS_ERR_PK_TYPE_MISMATCH: i32 = -16128; pub const MBEDTLS_ERR_PK_BAD_INPUT_DATA: i32 = -16000; @@ -597,45 +737,6 @@ pub const MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256: u32 = 4869; pub const MBEDTLS_CIPHERSUITE_WEAK: u32 = 1; pub const MBEDTLS_CIPHERSUITE_SHORT_TAG: u32 = 2; pub const MBEDTLS_CIPHERSUITE_NODTLS: u32 = 4; -pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; -pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; -pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; -pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; -pub const PSA_HASH_MAX_SIZE: u32 = 64; -pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; -pub const PSA_MAC_MAX_SIZE: u32 = 64; -pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; -pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; -pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; -pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; -pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; -pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; -pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; -pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; -pub const MBEDTLS_GCM_DECRYPT: u32 = 0; -pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; -pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; -pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; -pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; -pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; -pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; -pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; -pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; -pub const PSA_MAX_KEY_BITS: u32 = 65528; -pub const MBEDTLS_PSA_KA_MASK_DUAL_USE: u32 = 0; -pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; -pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; -pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; -pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; -pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; -pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; -pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_X509_MAX_INTERMEDIATE_CA: u32 = 8; pub const MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE: i32 = -8320; pub const MBEDTLS_ERR_X509_UNKNOWN_OID: i32 = -8448; @@ -743,7 +844,9 @@ pub const MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: i32 = -30848; pub const MBEDTLS_ERR_SSL_BAD_CERTIFICATE: i32 = -31232; pub const MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET: i32 = -31488; pub const MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA: i32 = -31616; -pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31872; +pub const MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND: i32 = -32384; pub const MBEDTLS_ERR_SSL_ALLOC_FAILED: i32 = -32512; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FAILED: i32 = -32640; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: i32 = -28544; @@ -770,6 +873,7 @@ pub const MBEDTLS_ERR_SSL_EARLY_MESSAGE: i32 = -25728; pub const MBEDTLS_ERR_SSL_UNEXPECTED_CID: i32 = -24576; pub const MBEDTLS_ERR_SSL_VERSION_MISMATCH: i32 = -24320; pub const MBEDTLS_ERR_SSL_BAD_CONFIG: i32 = -24192; +pub const MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME: i32 = -23936; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE: u32 = 1; pub const MBEDTLS_SSL_IANA_TLS_GROUP_NONE: u32 = 0; @@ -841,6 +945,8 @@ pub const MBEDTLS_SSL_TRUNC_HMAC_ENABLED: u32 = 1; pub const MBEDTLS_SSL_TRUNCATED_HMAC_LEN: u32 = 10; pub const MBEDTLS_SSL_SESSION_TICKETS_DISABLED: u32 = 0; pub const MBEDTLS_SSL_SESSION_TICKETS_ENABLED: u32 = 1; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED: u32 = 0; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED: u32 = 1; pub const MBEDTLS_SSL_PRESET_DEFAULT: u32 = 0; pub const MBEDTLS_SSL_PRESET_SUITEB: u32 = 2; pub const MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED: u32 = 1; @@ -854,6 +960,9 @@ pub const MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN: u32 = 48; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN: u32 = 1000; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX: u32 = 60000; +pub const MBEDTLS_SSL_EARLY_DATA_NO_DISCARD: u32 = 0; +pub const MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD: u32 = 1; +pub const MBEDTLS_SSL_EARLY_DATA_DISCARD: u32 = 2; pub const MBEDTLS_SSL_IN_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_OUT_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_DTLS_MAX_BUFFERING: u32 = 32768; @@ -988,18 +1097,6 @@ pub const MBEDTLS_SSL_UNEXPECTED_CID_IGNORE: u32 = 0; pub const MBEDTLS_SSL_UNEXPECTED_CID_FAIL: u32 = 1; pub const MBEDTLS_PRINTF_SIZET: &[u8; 3] = b"zu\0"; pub const MBEDTLS_PRINTF_LONGLONG: &[u8; 4] = b"lld\0"; -pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; -pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; -pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; -pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; -pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; -pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; -pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; -pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; -pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; -pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; -pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; -pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_HKDF_BAD_INPUT_DATA: i32 = -24448; pub const MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: i32 = -3; pub const MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: i32 = -5; @@ -1041,6 +1138,7 @@ pub const MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS: u32 = 4096; pub const MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY: u32 = 8192; pub const MBEDTLS_OID_X509_EXT_FRESHEST_CRL: u32 = 16384; pub const MBEDTLS_OID_X509_EXT_NS_CERT_TYPE: u32 = 65536; +pub const MBEDTLS_OID_MAX_COMPONENTS: u32 = 128; pub const MBEDTLS_OID_ISO_MEMBER_BODIES: &[u8; 2] = b"*\0"; pub const MBEDTLS_OID_ISO_IDENTIFIED_ORG: &[u8; 2] = b"+\0"; pub const MBEDTLS_OID_ISO_CCITT_DS: &[u8; 2] = b"U\0"; @@ -1055,6 +1153,8 @@ pub const MBEDTLS_OID_ORG_OIW: &[u8; 2] = b"\x0E\0"; pub const MBEDTLS_OID_OIW_SECSIG: &[u8; 3] = b"\x0E\x03\0"; pub const MBEDTLS_OID_OIW_SECSIG_ALG: &[u8; 4] = b"\x0E\x03\x02\0"; pub const MBEDTLS_OID_OIW_SECSIG_SHA1: &[u8; 5] = b"\x0E\x03\x02\x1A\0"; +pub const MBEDTLS_OID_ORG_THAWTE: &[u8; 2] = b"e\0"; +pub const MBEDTLS_OID_THAWTE: &[u8; 3] = b"+e\0"; pub const MBEDTLS_OID_ORG_CERTICOM: &[u8; 3] = b"\x81\x04\0"; pub const MBEDTLS_OID_CERTICOM: &[u8; 4] = b"+\x81\x04\0"; pub const MBEDTLS_OID_ORG_TELETRUST: &[u8; 2] = b"$\0"; @@ -1153,14 +1253,26 @@ pub const MBEDTLS_OID_DIGEST_ALG_SHA256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x pub const MBEDTLS_OID_DIGEST_ALG_SHA384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x02\0"; pub const MBEDTLS_OID_DIGEST_ALG_SHA512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x03\0"; pub const MBEDTLS_OID_DIGEST_ALG_RIPEMD160: &[u8; 6] = b"+$\x03\x02\x01\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x07\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x08\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\t\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA1: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x07\0"; pub const MBEDTLS_OID_HMAC_SHA224: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x08\0"; pub const MBEDTLS_OID_HMAC_SHA256: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\t\0"; pub const MBEDTLS_OID_HMAC_SHA384: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA512: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x0B\0"; +pub const MBEDTLS_OID_HMAC_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\r\0"; +pub const MBEDTLS_OID_HMAC_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0E\0"; +pub const MBEDTLS_OID_HMAC_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0F\0"; +pub const MBEDTLS_OID_HMAC_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x10\0"; +pub const MBEDTLS_OID_HMAC_RIPEMD160: &[u8; 9] = b"+\x06\x01\x05\x05\x08\x01\x04\0"; pub const MBEDTLS_OID_DES_CBC: &[u8; 6] = b"+\x0E\x03\x02\x07\0"; pub const MBEDTLS_OID_DES_EDE3_CBC: &[u8; 9] = b"*\x86H\x86\xF7\r\x03\x07\0"; pub const MBEDTLS_OID_AES: &[u8; 9] = b"`\x86H\x01e\x03\x04\x01\0"; +pub const MBEDTLS_OID_AES_128_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x02\0"; +pub const MBEDTLS_OID_AES_192_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x16\0"; +pub const MBEDTLS_OID_AES_256_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01*\0"; pub const MBEDTLS_OID_AES128_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x05\0"; pub const MBEDTLS_OID_AES128_KWP: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x08\0"; pub const MBEDTLS_OID_AES192_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x19\0"; @@ -1213,6 +1325,10 @@ pub const MBEDTLS_OID_ECDSA_SHA224: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x01\0"; pub const MBEDTLS_OID_ECDSA_SHA256: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x02\0"; pub const MBEDTLS_OID_ECDSA_SHA384: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x03\0"; pub const MBEDTLS_OID_ECDSA_SHA512: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x04\0"; +pub const MBEDTLS_OID_X25519: &[u8; 4] = b"+en\0"; +pub const MBEDTLS_OID_X448: &[u8; 4] = b"+eo\0"; +pub const MBEDTLS_OID_ED25519: &[u8; 4] = b"+ep\0"; +pub const MBEDTLS_OID_ED448: &[u8; 4] = b"+eq\0"; pub const MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT: i32 = -4224; pub const MBEDTLS_ERR_PEM_INVALID_DATA: i32 = -4352; pub const MBEDTLS_ERR_PEM_ALLOC_FAILED: i32 = -4480; @@ -1226,8 +1342,6 @@ pub const MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA: i32 = -12160; pub const MBEDTLS_ERR_PKCS5_INVALID_FORMAT: i32 = -12032; pub const MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE: i32 = -11904; pub const MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH: i32 = -11776; -pub const MBEDTLS_PKCS5_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS5_ENCRYPT: u32 = 1; pub const MBEDTLS_ERR_PKCS7_INVALID_FORMAT: i32 = -21248; pub const MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE: i32 = -21376; pub const MBEDTLS_ERR_PKCS7_INVALID_VERSION: i32 = -21504; @@ -1248,8 +1362,6 @@ pub const MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH: i32 = -7680; pub const MBEDTLS_PKCS12_DERIVE_KEY: u32 = 1; pub const MBEDTLS_PKCS12_DERIVE_IV: u32 = 2; pub const MBEDTLS_PKCS12_DERIVE_MAC_KEY: u32 = 3; -pub const MBEDTLS_PKCS12_PBE_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS12_PBE_ENCRYPT: u32 = 1; pub const MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT: u32 = 86400; pub const MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES: u32 = 50; pub const MBEDTLS_SSL_COOKIE_TIMEOUT: u32 = 60; @@ -1373,6 +1485,59 @@ unsafe extern "C" { /// \param len Length of the buffer in bytes pub fn mbedtls_platform_zeroize(buf: *mut ::core::ffi::c_void, len: usize); } +/// \brief The type of custom random generator (RNG) callbacks. +/// +/// Many Mbed TLS functions take two parameters +/// `mbedtls_f_rng_t *f_rng, void *p_rng`. The +/// library will call \c f_rng to generate +/// random values. +/// +/// \note This is typically one of the following: +/// - mbedtls_ctr_drbg_random() with \c p_rng +/// pointing to a #mbedtls_ctr_drbg_context; +/// - mbedtls_hmac_drbg_random() with \c p_rng +/// pointing to a #mbedtls_hmac_drbg_context; +/// - mbedtls_psa_get_random() with +/// `prng = MBEDTLS_PSA_RANDOM_STATE`. +/// +/// \note Generally, given a call +/// `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback +/// and the context only need to remain valid until +/// the call to `mbedtls_foo` returns. However, there +/// are a few exceptions where the callback is stored +/// in for future use. Check the documentation of +/// the calling function. +/// +/// \warning In a multithreaded environment, calling the +/// function should be thread-safe. The standard +/// functions provided by the library are thread-safe +/// when #MBEDTLS_THREADING_C is enabled. +/// +/// \warning This function must either provide as many +/// bytes as requested of **cryptographic quality** +/// random data, or return a negative error code. +/// +/// \param p_rng The \c p_rng argument that was passed along \c f_rng. +/// The library always passes \c p_rng unchanged. +/// This is typically a pointer to the random generator +/// state, or \c NULL if the custom random generator +/// doesn't need a context-specific state. +/// \param[out] output On success, this must be filled with \p output_size +/// bytes of cryptographic-quality random data. +/// \param output_size The number of bytes to output. +/// +/// \return \c 0 on success, or a negative error code on failure. +/// Library functions will generally propagate this +/// error code, so \c MBEDTLS_ERR_xxx values are +/// recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is +/// typically sensible for RNG failures. +pub type mbedtls_f_rng_t = ::core::option::Option< + unsafe extern "C" fn( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + ) -> ::core::ffi::c_int, +>; /// \brief The AES context-type definition. #[repr(C)] #[derive(Copy, Clone)] @@ -1931,6 +2096,10 @@ pub type mbedtls_t_udbl = u64; #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_mpi { + /// Pointer to limbs. + /// + /// This may be \c NULL if \c n is 0. + pub private_p: *mut mbedtls_mpi_uint, /// Sign: -1 if the mpi is negative, 1 otherwise. /// /// The number 0 must be represented with `s = +1`. Although many library @@ -1941,13 +2110,9 @@ pub struct mbedtls_mpi { /// /// Note that this implies that calloc() or `... = {0}` does not create /// a valid MPI representation. You must call mbedtls_mpi_init(). - pub private_s: ::core::ffi::c_int, + pub private_s: ::core::ffi::c_short, /// Total number of limbs in \c p. - pub private_n: usize, - /// Pointer to limbs. - /// - /// This may be \c NULL if \c n is 0. - pub private_p: *mut mbedtls_mpi_uint, + pub private_n: ::core::ffi::c_ushort, } impl Default for mbedtls_mpi { fn default() -> Self { @@ -2222,7 +2387,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2239,7 +2404,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2294,6 +2459,8 @@ unsafe extern "C" { /// \brief Perform a left-shift on an MPI: X <<= count /// /// \param X The MPI to shift. This must point to an initialized MPI. + /// The MPI pointed by \p X may be resized to fit + /// the resulting number. /// \param count The number of bits to shift by. /// /// \return \c 0 if successful. @@ -2586,7 +2753,7 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Perform a sliding-window exponentiation: X = A^E mod N + /// \brief Perform a modular exponentiation: X = A^E mod N /// /// \param X The destination MPI. This must point to an initialized MPI. /// This must not alias E or N. @@ -2637,13 +2804,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_fill_random( X: *mut mbedtls_mpi, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2683,13 +2844,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, min: mbedtls_mpi_sint, N: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2697,6 +2852,7 @@ unsafe extern "C" { /// \brief Compute the greatest common divisor: G = gcd(A, B) /// /// \param G The destination MPI. This must point to an initialized MPI. + /// This will always be positive or 0. /// \param A The first operand. This must point to an initialized MPI. /// \param B The second operand. This must point to an initialized MPI. /// @@ -2713,17 +2869,19 @@ unsafe extern "C" { /// \brief Compute the modular inverse: X = A^-1 mod N /// /// \param X The destination MPI. This must point to an initialized MPI. + /// The value returned on success will be between [1, N-1]. /// \param A The MPI to calculate the modular inverse of. This must point - /// to an initialized MPI. + /// to an initialized MPI. This value can be negative, in which + /// case a positive answer will still be returned in \p X. /// \param N The base of the modular inversion. This must point to an - /// initialized MPI. + /// initialized MPI and be greater than one. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. /// \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than /// or equal to one. - /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - /// with respect to \p N. + /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + /// inverse with respect to \p N. pub fn mbedtls_mpi_inv_mod( X: *mut mbedtls_mpi, A: *const mbedtls_mpi, @@ -2746,7 +2904,7 @@ unsafe extern "C" { /// This must point to an initialized MPI. /// \param rounds The number of bases to perform the Miller-Rabin primality /// test for. The probability of returning 0 on a composite is - /// at most 2-2*\p rounds. + /// at most 2-2*\p rounds . /// \param f_rng The RNG function to use. This must not be \c NULL. /// \param p_rng The RNG parameter to be passed to \p f_rng. /// This may be \c NULL if \p f_rng doesn't use @@ -2759,13 +2917,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_is_prime_ext( X: *const mbedtls_mpi, rounds: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2802,13 +2954,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, nbits: usize, flags: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -3185,7 +3331,7 @@ unsafe extern "C" { /// on a successful invocation. /// \param end The end of the ASN.1 SEQUENCE container. /// \param tag_must_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_must_value. + /// the SEQUENCE before comparing to \p tag_must_val. /// \param tag_must_val The required value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_must_mask. /// Mismatching tags lead to an error. @@ -3194,7 +3340,7 @@ unsafe extern "C" { /// while a value of \c 0xFF for \p tag_must_mask means /// that \p tag_must_val is the only allowed tag. /// \param tag_may_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_may_value. + /// the SEQUENCE before comparing to \p tag_may_val. /// \param tag_may_val The desired value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_may_mask. /// Mismatching tags will be silently ignored. @@ -3487,6 +3633,30 @@ unsafe extern "C" { par_len: usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + /// + /// \note This function works backwards in data buffer. + /// + /// \param p The reference to the current position pointer. + /// \param start The start of the buffer, for bounds-checking. + /// \param oid The OID of the algorithm to write. + /// \param oid_len The length of the algorithm's OID. + /// \param par_len The length of the parameters, which must be already written. + /// \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + /// and \p par_len is 0, NULL parameters are added. + /// + /// \return The number of bytes written to \p p on success. + /// \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_asn1_write_algorithm_identifier_ext( + p: *mut *mut ::core::ffi::c_uchar, + start: *const ::core::ffi::c_uchar, + oid: *const ::core::ffi::c_char, + oid_len: usize, + par_len: usize, + has_par: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value /// in ASN.1 format. @@ -3989,32 +4159,17 @@ pub struct mbedtls_cipher_base_t { /// mbedtls_cipher_info_from_type(), /// mbedtls_cipher_info_from_values(), /// mbedtls_cipher_info_from_psa(). +/// +/// \note Some fields store a value that has been right-shifted to save +/// code-size, so should not be used directly. The accessor +/// functions adjust for this and return the "natural" value. #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_cipher_info_t { - /// Full cipher identifier. For example, - /// MBEDTLS_CIPHER_AES_256_CBC. - pub private_type: mbedtls_cipher_type_t, - /// The cipher mode. For example, MBEDTLS_MODE_CBC. - pub private_mode: mbedtls_cipher_mode_t, - /// The cipher key length, in bits. This is the - /// default length for variable sized ciphers. - /// Includes parity bits for ciphers like DES. - pub private_key_bitlen: ::core::ffi::c_uint, /// Name of the cipher. pub private_name: *const ::core::ffi::c_char, - /// IV or nonce size, in Bytes. - /// For ciphers that accept variable IV sizes, - /// this is the recommended size. - pub private_iv_size: ::core::ffi::c_uint, - /// Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and - /// MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the - /// cipher supports variable IV or variable key sizes, respectively. - pub private_flags: ::core::ffi::c_int, - /// The block size, in Bytes. - pub private_block_size: ::core::ffi::c_uint, - /// Struct for base cipher information and functions. - pub private_base: *const mbedtls_cipher_base_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize]>, } impl Default for mbedtls_cipher_info_t { fn default() -> Self { @@ -4025,46 +4180,321 @@ impl Default for mbedtls_cipher_info_t { } } } -/// Generic cipher context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_cipher_context_t { - /// Information about the associated cipher. - pub private_cipher_info: *const mbedtls_cipher_info_t, - /// Key length to use. - pub private_key_bitlen: ::core::ffi::c_int, - /// Operation that the key of the context has been - /// initialized for. - pub private_operation: mbedtls_operation_t, - /// Padding functions to use, if relevant for - /// the specific cipher mode. - pub private_add_padding: ::core::option::Option< - unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), - >, - pub private_get_padding: ::core::option::Option< - unsafe extern "C" fn( - input: *mut ::core::ffi::c_uchar, - ilen: usize, - data_len: *mut usize, - ) -> ::core::ffi::c_int, - >, - /// Buffer for input that has not been processed yet. - pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], - /// Number of Bytes that have not been processed yet. - pub private_unprocessed_len: usize, - /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number - /// for XTS-mode. - pub private_iv: [::core::ffi::c_uchar; 16usize], - /// IV size in Bytes, for ciphers with variable-length IVs. - pub private_iv_size: usize, - /// The cipher-specific context. - pub private_cipher_ctx: *mut ::core::ffi::c_void, - /// CMAC-specific context. - pub private_cmac_ctx: *mut mbedtls_cmac_context_t, -} -impl Default for mbedtls_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); +impl mbedtls_cipher_info_t { + #[inline] + pub fn private_block_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_block_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_block_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_block_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(5usize, 3u8) as u32) } + } + #[inline] + pub fn set_private_iv_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(5usize, 3u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 5usize, + 3u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 5usize, + 3u8, + val as u64, + ) + } + } + #[inline] + pub fn private_key_bitlen(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(8usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_key_bitlen(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(8usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_key_bitlen_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 8usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_key_bitlen_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 8usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_mode(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(12usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_mode(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(12usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_mode_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 12usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_mode_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 12usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_type(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(16usize, 8u8) as u32) } + } + #[inline] + pub fn set_private_type(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(16usize, 8u8, val as u64) + } + } + #[inline] + pub unsafe fn private_type_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 16usize, + 8u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_type_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 16usize, + 8u8, + val as u64, + ) + } + } + #[inline] + pub fn private_flags(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(24usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_flags(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(24usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_flags_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 24usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_flags_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 24usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_base_idx(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(26usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_base_idx(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(26usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_base_idx_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 26usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_base_idx_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 26usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_block_size: ::core::ffi::c_uint, + private_iv_size: ::core::ffi::c_uint, + private_key_bitlen: ::core::ffi::c_uint, + private_mode: ::core::ffi::c_uint, + private_type: ::core::ffi::c_uint, + private_flags: ::core::ffi::c_uint, + private_base_idx: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 4usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 4usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 5u8, { + let private_block_size: u32 = unsafe { ::core::mem::transmute(private_block_size) }; + private_block_size as u64 + }); + __bindgen_bitfield_unit.set(5usize, 3u8, { + let private_iv_size: u32 = unsafe { ::core::mem::transmute(private_iv_size) }; + private_iv_size as u64 + }); + __bindgen_bitfield_unit.set(8usize, 4u8, { + let private_key_bitlen: u32 = unsafe { ::core::mem::transmute(private_key_bitlen) }; + private_key_bitlen as u64 + }); + __bindgen_bitfield_unit.set(12usize, 4u8, { + let private_mode: u32 = unsafe { ::core::mem::transmute(private_mode) }; + private_mode as u64 + }); + __bindgen_bitfield_unit.set(16usize, 8u8, { + let private_type: u32 = unsafe { ::core::mem::transmute(private_type) }; + private_type as u64 + }); + __bindgen_bitfield_unit.set(24usize, 2u8, { + let private_flags: u32 = unsafe { ::core::mem::transmute(private_flags) }; + private_flags as u64 + }); + __bindgen_bitfield_unit.set(26usize, 5u8, { + let private_base_idx: u32 = unsafe { ::core::mem::transmute(private_base_idx) }; + private_base_idx as u64 + }); + __bindgen_bitfield_unit + } +} +/// Generic cipher context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_cipher_context_t { + /// Information about the associated cipher. + pub private_cipher_info: *const mbedtls_cipher_info_t, + /// Key length to use. + pub private_key_bitlen: ::core::ffi::c_int, + /// Operation that the key of the context has been + /// initialized for. + pub private_operation: mbedtls_operation_t, + /// Padding functions to use, if relevant for + /// the specific cipher mode. + pub private_add_padding: ::core::option::Option< + unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), + >, + pub private_get_padding: ::core::option::Option< + unsafe extern "C" fn( + input: *mut ::core::ffi::c_uchar, + ilen: usize, + data_len: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int, + >, + /// Buffer for input that has not been processed yet. + pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], + /// Number of Bytes that have not been processed yet. + pub private_unprocessed_len: usize, + /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + /// for XTS-mode. + pub private_iv: [::core::ffi::c_uchar; 16usize], + /// IV size in Bytes, for ciphers with variable-length IVs. + pub private_iv_size: usize, + /// The cipher-specific context. + pub private_cipher_ctx: *mut ::core::ffi::c_void, + /// CMAC-specific context. + pub private_cmac_ctx: *mut mbedtls_cmac_context_t, +} +impl Default for mbedtls_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); s.assume_init() @@ -4132,7 +4562,7 @@ unsafe extern "C" { ) -> *const mbedtls_cipher_info_t; } unsafe extern "C" { - /// \brief This function initializes a \p cipher_context as NONE. + /// \brief This function initializes a \p ctx as NONE. /// /// \param ctx The context to be initialized. This must not be \c NULL. pub fn mbedtls_cipher_init(ctx: *mut mbedtls_cipher_context_t); @@ -4203,7 +4633,6 @@ unsafe extern "C" { /// \brief This function sets the padding mode, for cipher modes /// that use padding. /// - /// The default passing mode is PKCS7 padding. /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a cipher information structure. @@ -4253,23 +4682,24 @@ unsafe extern "C" { /// /// \note With non-AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update() one or more times - /// 4. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update() zero, one or more times; + /// 4. mbedtls_cipher_finish_padded() (recommended for decryption + /// if the mode uses padding) or mbedtls_cipher_finish(). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. /// /// \note With AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update_ad() - /// 4. mbedtls_cipher_update() one or more times - /// 5. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update_ad(); + /// 4. mbedtls_cipher_update() zero, one or more times; + /// 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); /// 6. mbedtls_cipher_check_tag() (for decryption) or - /// mbedtls_cipher_write_tag() (for encryption). + /// mbedtls_cipher_write_tag() (for encryption). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. @@ -4304,7 +4734,8 @@ unsafe extern "C" { /// many block-sized blocks of data as possible to output. /// Any data that cannot be written immediately is either /// added to the next block, or flushed when - /// mbedtls_cipher_finish() is called. + /// mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + /// is called. /// Exception: For MBEDTLS_MODE_ECB, expects a single block /// in size. For example, 16 Bytes for AES. /// @@ -4340,12 +4771,30 @@ unsafe extern "C" { /// contained in it is padded to the size of /// the last block, and written to the \p output buffer. /// + /// \warning This function reports invalid padding through an error + /// code. Adversaries may be able to decrypt encrypted + /// data if they can submit chosen ciphertexts and + /// detect whether it has valid padding or not, + /// either through direct observation or through a side + /// channel such as timing. This is known as a + /// padding oracle attack. + /// Therefore applications that call this function for + /// decryption with a cipher that involves padding + /// should take care around error handling. Preferably, + /// such applications should use + /// mbedtls_cipher_finish_padded() instead of this function. + /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a key. /// \param output The buffer to write data to. This needs to be a writable - /// buffer of at least \p block_size Bytes. + /// buffer of at least block_size Bytes. /// \param olen The length of the data written to the \p output buffer. /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// above), although less efficiently than through + /// the invalid-padding condition. /// /// \return \c 0 on success. /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on @@ -4353,7 +4802,8 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption /// expecting a full block but not receiving one. /// \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding - /// while decrypting. + /// while decrypting. Note that invalid-padding errors + /// should be handled carefully; see the warning above. /// \return A cipher-specific error code on failure. pub fn mbedtls_cipher_finish( ctx: *mut mbedtls_cipher_context_t, @@ -4361,10 +4811,60 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief The generic cipher finalization function. If data still + /// needs to be flushed from an incomplete block, the data + /// contained in it is padded to the size of + /// the last block, and written to the \p output buffer. + /// + /// \note This function is similar to mbedtls_cipher_finish(). + /// The only difference is that it reports invalid padding + /// decryption differently, through the \p invalid_padding + /// parameter rather than an error code. + /// For encryption, and in modes without padding (including + /// all authenticated modes), this function is identical + /// to mbedtls_cipher_finish(). + /// + /// \param[in,out] ctx The generic cipher context. This must be initialized and + /// bound to a key. + /// \param[out] output The buffer to write data to. This needs to be a writable + /// buffer of at least block_size Bytes. + /// \param[out] olen The length of the data written to the \p output buffer. + /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// on mbedtls_cipher_finish()). + /// \param[out] invalid_padding + /// If this function returns \c 0 on decryption, + /// \p *invalid_padding is \c 0 if the ciphertext was + /// valid, and all-bits-one if the ciphertext had invalid + /// padding. + /// On encryption, or in a mode without padding (including + /// all authenticated modes), \p *invalid_padding is \c 0 + /// on success. + /// The value in \p *invalid_padding is unspecified if + /// this function returns a nonzero status. + /// + /// \return \c 0 on success. + /// Also \c 0 for decryption with invalid padding. + /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + /// parameter-verification failure. + /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + /// expecting a full block but not receiving one. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_cipher_finish_padded( + ctx: *mut mbedtls_cipher_context_t, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief This function writes a tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized, /// bound to a key, and have just completed a cipher @@ -4385,7 +4885,8 @@ unsafe extern "C" { unsafe extern "C" { /// \brief This function checks the tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized. /// \param tag The buffer holding the tag. This must be a readable @@ -4570,8 +5071,6 @@ pub struct mbedtls_ccm_context { pub private_y: [::core::ffi::c_uchar; 16usize], ///< The counter buffer pub private_ctr: [::core::ffi::c_uchar; 16usize], - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Total plaintext length pub private_plaintext_len: usize, ///< Total authentication data length @@ -4586,16 +5085,17 @@ pub struct mbedtls_ccm_context { ///auth data input is finished. pub private_processed: usize, ///< The Q working value - pub private_q: ::core::ffi::c_uchar, + pub private_q: ::core::ffi::c_uint, ///< The operation to perform: ///#MBEDTLS_CCM_ENCRYPT or ///#MBEDTLS_CCM_DECRYPT or ///#MBEDTLS_CCM_STAR_ENCRYPT or ///#MBEDTLS_CCM_STAR_DECRYPT. - pub private_mode: ::core::ffi::c_uchar, + pub private_mode: ::core::ffi::c_uint, + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Working value holding context's - ///state. Used for chunked data - ///input + ///state. Used for chunked data input pub private_state: ::core::ffi::c_int, } impl Default for mbedtls_ccm_context { @@ -5838,47 +6338,59 @@ unsafe extern "C" { /// \return \c 1 on failure. pub fn mbedtls_cmac_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -/// \brief The CTR_DRBG context structure. +///< None. +pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; +///< The MD5 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 3; +///< The RIPEMD-160 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 4; +///< The SHA-1 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 5; +///< The SHA-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 8; +///< The SHA-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 9; +///< The SHA-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 10; +///< The SHA-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 11; +///< The SHA3-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_224: mbedtls_md_type_t = 16; +///< The SHA3-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_256: mbedtls_md_type_t = 17; +///< The SHA3-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_384: mbedtls_md_type_t = 18; +///< The SHA3-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_512: mbedtls_md_type_t = 19; +/// \brief Supported message digests. +/// +/// \warning MD5 and SHA-1 are considered weak message digests and +/// their use constitutes a security risk. We recommend considering +/// stronger message digests instead. +pub type mbedtls_md_type_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct mbedtls_ctr_drbg_context { - ///< The counter (V). - pub private_counter: [::core::ffi::c_uchar; 16usize], - ///< The reseed counter. - /// This is the number of requests that have - /// been made since the last (re)seeding, - /// minus one. - /// Before the initial seeding, this field - /// contains the amount of entropy in bytes - /// to use as a nonce for the initial seeding, - /// or -1 if no nonce length has been explicitly - /// set (see mbedtls_ctr_drbg_set_nonce_len()). - pub private_reseed_counter: ::core::ffi::c_int, - ///< This determines whether prediction - ///resistance is enabled, that is - ///whether to systematically reseed before - ///each random generation. - pub private_prediction_resistance: ::core::ffi::c_int, - ///< The amount of entropy grabbed on each - ///seed or reseed operation, in bytes. - pub private_entropy_len: usize, - ///< The reseed interval. - /// This is the maximum number of requests - /// that can be made between reseedings. - pub private_reseed_interval: ::core::ffi::c_int, - ///< The AES context. - pub private_aes_ctx: mbedtls_aes_context, - pub private_f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - ///< The context for the entropy function. - pub private_p_entropy: *mut ::core::ffi::c_void, +pub struct mbedtls_md_info_t { + _unused: [u8; 0], } -impl Default for mbedtls_ctr_drbg_context { +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; +/// Used internally to indicate whether a context uses legacy or PSA. +/// +/// Internal use only. +pub type mbedtls_md_engine_t = ::core::ffi::c_uint; +/// The generic message-digest context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md_context_t { + /// Information about the associated message digest. + pub private_md_info: *const mbedtls_md_info_t, + /// The digest-specific context (legacy) or the PSA operation. + pub private_md_ctx: *mut ::core::ffi::c_void, + /// The HMAC part of the context. + pub private_hmac_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_md_context_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -5888,4389 +6400,3745 @@ impl Default for mbedtls_ctr_drbg_context { } } unsafe extern "C" { - /// \brief This function initializes the CTR_DRBG context, - /// and prepares it for mbedtls_ctr_drbg_seed() - /// or mbedtls_ctr_drbg_free(). + /// \brief This function returns the message-digest information + /// associated with the given digest type. /// - /// \note The reseed interval is - /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. - /// You can override it by calling - /// mbedtls_ctr_drbg_set_reseed_interval(). + /// \param md_type The type of digest to search for. /// - /// \param ctx The CTR_DRBG context to initialize. - pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); + /// \return The message-digest information associated with \p md_type. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// - The \p custom string. - /// - /// \note To achieve the nominal security strength permitted - /// by CTR_DRBG, the entropy length must be: - /// - at least 16 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 32 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// In addition, if you do not pass a nonce in \p custom, - /// the sum of the entropy length - /// and the entropy nonce length must be: - /// - at least 24 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 48 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// \param ctx The CTR_DRBG context to seed. - /// It must have been initialized with - /// mbedtls_ctr_drbg_init(). - /// After a successful call to mbedtls_ctr_drbg_seed(), - /// you may not call mbedtls_ctr_drbg_seed() again on - /// the same context unless you call - /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() - /// again first. - /// After a failed call to mbedtls_ctr_drbg_seed(), - /// you must call mbedtls_ctr_drbg_free(). - /// \param f_entropy The entropy callback, taking as arguments the - /// \p p_entropy context, the buffer to fill, and the - /// length of the buffer. - /// \p f_entropy is always called with a buffer size - /// less than or equal to the entropy length. - /// \param p_entropy The entropy context to pass to \p f_entropy. - /// \param custom The personalization string. - /// This can be \c NULL, in which case the personalization - /// string is empty regardless of the value of \p len. - /// \param len The length of the personalization string. - /// This must be at most - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function initializes a message-digest context without + /// binding it to a particular message-digest algorithm. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_seed( - ctx: *mut mbedtls_ctr_drbg_context, - f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_entropy: *mut ::core::ffi::c_void, - custom: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// This function should always be called first. It prepares the + /// context for mbedtls_md_setup() for binding it to a + /// message-digest algorithm. + pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function resets CTR_DRBG context to the state immediately - /// after initial call of mbedtls_ctr_drbg_init(). + /// \brief This function clears the internal structure of \p ctx and + /// frees any embedded internal structure, but does not free + /// \p ctx itself. /// - /// \param ctx The CTR_DRBG context to clear. - pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); + /// If you have called mbedtls_md_setup() on \p ctx, you must + /// call mbedtls_md_free() when you are no longer using the + /// context. + /// Calling this function if you have previously + /// called mbedtls_md_init() and nothing else is optional. + /// You must not call this function if you have not called + /// mbedtls_md_init(). + pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function turns prediction resistance on or off. - /// The default value is off. + /// \brief This function selects the message digest algorithm to use, + /// and allocates internal structures. /// - /// \note If enabled, entropy is gathered at the beginning of - /// every call to mbedtls_ctr_drbg_random_with_add() - /// or mbedtls_ctr_drbg_random(). - /// Only use this if your entropy source has sufficient - /// throughput. + /// It should be called after mbedtls_md_init() or + /// mbedtls_md_free(). Makes it necessary to call + /// mbedtls_md_free() later. /// - /// \param ctx The CTR_DRBG context. - /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. - pub fn mbedtls_ctr_drbg_set_prediction_resistance( - ctx: *mut mbedtls_ctr_drbg_context, - resistance: ::core::ffi::c_int, - ); + /// \param ctx The context to set up. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + /// or non-zero: HMAC is used with this context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + pub fn mbedtls_md_setup( + ctx: *mut mbedtls_md_context_t, + md_info: *const mbedtls_md_info_t, + hmac: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed on each - /// seed or reseed. - /// - /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function clones the state of a message-digest + /// context. /// - /// \note The security strength of CTR_DRBG is bounded by the - /// entropy length. Thus: - /// - When using AES-256 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, - /// which is the default), - /// \p len must be at least 32 (in bytes) - /// to achieve a 256-bit strength. - /// - When using AES-128 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) - /// \p len must be at least 16 (in bytes) - /// to achieve a 128-bit strength. + /// \note You must call mbedtls_md_setup() on \c dst before calling + /// this function. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. - pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); -} -unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed - /// as a nonce for the initial seeding. + /// \note The two contexts must have the same type, + /// for example, both are SHA-256. /// - /// Call this function before calling mbedtls_ctr_drbg_seed() to read - /// a nonce from the entropy source during the initial seeding. + /// \warning This function clones the message-digest state, not the + /// HMAC state. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab for the nonce, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. + /// \param dst The destination context. + /// \param src The context to be cloned. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is - /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED - /// if the initial seeding has already taken place. - pub fn mbedtls_ctr_drbg_set_nonce_len( - ctx: *mut mbedtls_ctr_drbg_context, - len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + /// not using the same engine. This can be avoided by moving + /// the call to psa_crypto_init() before the first call to + /// mbedtls_md_setup(). + pub fn mbedtls_md_clone( + dst: *mut mbedtls_md_context_t, + src: *const mbedtls_md_context_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the reseed interval. - /// - /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() - /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function - /// is called again. + /// \brief This function extracts the message-digest size from the + /// message-digest information structure. /// - /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param interval The reseed interval. - pub fn mbedtls_ctr_drbg_set_reseed_interval( - ctx: *mut mbedtls_ctr_drbg_context, - interval: ::core::ffi::c_int, - ); + /// \return The size of the message-digest output in Bytes. + pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; } unsafe extern "C" { - /// \brief This function reseeds the CTR_DRBG context, that is - /// extracts data from the entropy source. + /// \brief This function extracts the message-digest type from the + /// message-digest information structure. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param additional Additional data to add to the state. Can be \c NULL. - /// \param len The length of the additional data. - /// This must be less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \return The type of the message digest. + pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; +} +unsafe extern "C" { + /// \brief This function starts a message-digest computation. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_reseed( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// You must call this function after setting up the context + /// with mbedtls_md_setup(), and before passing data with + /// mbedtls_md_update(). + /// + /// \param ctx The generic message-digest context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates the state of the CTR_DRBG context. + /// \brief This function feeds an input buffer into an ongoing + /// message-digest computation. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// You must call mbedtls_md_starts() before calling this + /// function. You may call this function multiple times. + /// Afterwards, call mbedtls_md_finish(). /// - /// \param ctx The CTR_DRBG context. - /// \param additional The data to update the state with. This must not be - /// \c NULL unless \p add_len is \c 0. - /// \param add_len Length of \p additional in bytes. This must be at - /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \param ctx The generic message-digest context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if - /// \p add_len is more than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return An error from the underlying AES cipher on failure. - pub fn mbedtls_ctr_drbg_update( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - add_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates a CTR_DRBG instance with additional - /// data and uses it to generate random data. - /// - /// This function automatically reseeds if the reseed counter is exceeded - /// or prediction resistance is enabled. + /// \brief This function finishes the digest operation, + /// and writes the result to the output buffer. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// Call this function after a call to mbedtls_md_starts(), + /// followed by any number of calls to mbedtls_md_update(). + /// Afterwards, you may either clear the context with + /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse + /// the context for another digest operation with the same + /// algorithm. /// - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. - /// \param additional Additional data to update. Can be \c NULL, in which - /// case the additional data is empty regardless of - /// the value of \p add_len. - /// \param add_len The length of the additional data - /// if \p additional is not \c NULL. - /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT - /// and less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \param ctx The generic message-digest context. + /// \param output The buffer for the generic message-digest checksum result. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random_with_add( - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_finish( + ctx: *mut mbedtls_md_context_t, output: *mut ::core::ffi::c_uchar, - output_len: usize, - additional: *const ::core::ffi::c_uchar, - add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. + /// \brief This function calculates the message-digest of a buffer, + /// with respect to a configurable message-digest algorithm + /// in a single call. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random( - p_rng: *mut ::core::ffi::c_void, + /// The result is calculated as + /// Output = message_digest(input buffer). + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param input The buffer holding the data. + /// \param ilen The length of the input data. + /// \param output The generic message-digest checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md( + md_info: *const mbedtls_md_info_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, output: *mut ::core::ffi::c_uchar, - output_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The CTR_DRBG checkup routine. + /// \brief This function returns the list of digests supported by the + /// generic digest module. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< Curve not defined. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; -///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; -///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; -///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; -///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; -///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; -///< Domain parameters for 256-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; -///< Domain parameters for 384-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; -///< Domain parameters for 512-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; -///< Domain parameters for Curve25519. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; -///< Domain parameters for 192-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; -///< Domain parameters for 224-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; -///< Domain parameters for 256-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; -///< Domain parameters for Curve448. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; -/// Domain-parameter identifiers: curve, subgroup, and generator. -/// -/// \note Only curves over prime fields are supported. -/// -/// \warning This library does not support validation of arbitrary domain -/// parameters. Therefore, only standardized domain parameters from trusted -/// sources should be used. See mbedtls_ecp_group_load(). -pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; -pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_NONE: mbedtls_ecp_modulus_type = 0; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_COORDINATE: mbedtls_ecp_modulus_type = 1; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_SCALAR: mbedtls_ecp_modulus_type = 2; -pub type mbedtls_ecp_modulus_type = ::core::ffi::c_uint; -/// Curve information, for use by other modules. -/// -/// The fields of this structure are part of the public API and can be -/// accessed directly by applications. Future versions of the library may -/// add extra fields or reorder existing fields. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_curve_info { - ///< An internal identifier. - pub grp_id: mbedtls_ecp_group_id, - ///< The TLS NamedCurve identifier. - pub tls_id: u16, - ///< The curve size in bits. - pub bit_size: u16, - ///< A human-friendly name. - pub name: *const ::core::ffi::c_char, + /// \note The list starts with the strongest available hashes. + /// + /// \return A statically allocated array of digests. Each element + /// in the returned list is an integer belonging to the + /// message-digest enumeration #mbedtls_md_type_t. + /// The last entry is 0. + pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; } -impl Default for mbedtls_ecp_curve_info { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief This function returns the message-digest information + /// associated with the given digest name. + /// + /// \param md_name The name of the digest to search for. + /// + /// \return The message-digest information associated with \p md_name. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_string( + md_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_md_info_t; } -/// \brief The ECP point structure, in Jacobian coordinates. -/// -/// \note All functions expect and return points satisfying -/// the following condition: Z == 0 or -/// Z == 1. Other values of \p Z are -/// used only by internal functions. -/// The point is zero, or "at infinity", if Z == 0. -/// Otherwise, \p X and \p Y are its standard (affine) -/// coordinates. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_point { - ///< The X coordinate of the ECP point. - pub private_X: mbedtls_mpi, - ///< The Y coordinate of the ECP point. - pub private_Y: mbedtls_mpi, - ///< The Z coordinate of the ECP point. - pub private_Z: mbedtls_mpi, -} -impl Default for mbedtls_ecp_point { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief The ECP group structure. -/// -/// We consider two types of curve equations: -///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P -/// (SEC1 + RFC-4492)
            • -///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, -/// Curve448)
          -/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. -/// -/// For Short Weierstrass, this subgroup is the whole curve, and its -/// cardinality is denoted by \p N. Our code requires that \p N is an -/// odd prime as mbedtls_ecp_mul() requires an odd number, and -/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. -/// -/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, -/// which is the quantity used in the formulas. Additionally, \p nbits is -/// not the size of \p N but the required size for private keys. -/// -/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. -/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the -/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer -/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits -/// in size, so that it may be efficiently brought in the 0..P-1 range by a few -/// additions or subtractions. Therefore, it is only an approximative modular -/// reduction. It must return 0 on success and non-zero on failure. -/// -/// \note Alternative implementations of the ECP module must obey the -/// following constraints. -/// * Group IDs must be distinct: if two group structures have -/// the same ID, then they must be identical. -/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, -/// \c pbits and \c nbits must have the same type and semantics -/// as in the built-in implementation. -/// They must be available for reading, but direct modification -/// of these fields does not need to be supported. -/// They do not need to be at the same offset in the structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_group { - ///< An internal group identifier. - pub id: mbedtls_ecp_group_id, - ///< The prime modulus of the base field. - pub P: mbedtls_mpi, - ///< For Short Weierstrass: \p A in the equation. For - ///Montgomery curves: (A + 2) / 4. - pub A: mbedtls_mpi, - ///< For Short Weierstrass: \p B in the equation. - ///For Montgomery curves: unused. - pub B: mbedtls_mpi, - ///< The generator of the subgroup used. - pub G: mbedtls_ecp_point, - ///< The order of \p G. - pub N: mbedtls_mpi, - ///< The number of bits in \p P. - pub pbits: usize, - ///< For Short Weierstrass: The number of bits in \p P. - ///For Montgomery curves: the number of bits in the - ///private keys. - pub nbits: usize, - ///< \internal 1 if the constants are static. - pub private_h: ::core::ffi::c_uint, - ///< The function for fast pseudo-reduction - ///mod \p P (see above). - pub private_modp: - ::core::option::Option ::core::ffi::c_int>, - ///< Unused. - pub private_t_pre: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_post: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_data: *mut ::core::ffi::c_void, - ///< Pre-computed points for ecp_mul_comb(). - pub private_T: *mut mbedtls_ecp_point, - ///< The number of dynamic allocated pre-computed points. - pub private_T_size: usize, -} -impl Default for mbedtls_ecp_group { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; -/// \brief The ECP key-pair structure. -/// -/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. -/// -/// \note Members are deliberately in the same order as in the -/// ::mbedtls_ecdsa_context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_keypair { - ///< Elliptic curve and base point - pub private_grp: mbedtls_ecp_group, - ///< our secret value - pub private_d: mbedtls_mpi, - ///< our public value - pub private_Q: mbedtls_ecp_point, -} -impl Default for mbedtls_ecp_keypair { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +unsafe extern "C" { + /// \brief This function returns the name of the message digest for + /// the message-digest information structure given. + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// + /// \return The name of the message digest. + pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; } unsafe extern "C" { - /// \brief This function retrieves the information defined in - /// mbedtls_ecp_curve_info() for all supported curves. + /// \brief This function returns the message-digest information + /// from the given context. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// \param ctx The context from which to extract the information. + /// This must be initialized (or \c NULL). /// - /// \return A statically allocated array. The last entry is 0. - pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; + /// \return The message-digest information associated with \p ctx. + /// \return \c NULL if \p ctx is \c NULL. + pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// \brief This function retrieves the list of internal group - /// identifiers of all supported curves in the order of - /// preference. + /// \brief This function sets the HMAC key and prepares to + /// authenticate a new message. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// Call this function after mbedtls_md_setup(), to use + /// the MD context for an HMAC calculation, then call + /// mbedtls_md_hmac_update() to provide the input data, and + /// mbedtls_md_hmac_finish() to get the HMAC value. /// - /// \return A statically allocated array, - /// terminated with MBEDTLS_ECP_DP_NONE. - pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC key in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_starts( + ctx: *mut mbedtls_md_context_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from an internal - /// group identifier. + /// \brief This function feeds an input buffer into an ongoing HMAC + /// computation. /// - /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + /// before calling this function. + /// You may call this function multiple times to pass the + /// input piecewise. + /// Afterwards, call mbedtls_md_hmac_finish(). /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_grp_id( - grp_id: mbedtls_ecp_group_id, - ) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a TLS - /// NamedCurve value. + /// \brief This function finishes the HMAC operation, and writes + /// the result to the output buffer. /// - /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call this function after mbedtls_md_hmac_starts() and + /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards + /// you may either call mbedtls_md_free() to clear the context, + /// or call mbedtls_md_hmac_reset() to reuse the context with + /// the same HMAC key. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param output The generic HMAC checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_finish( + ctx: *mut mbedtls_md_context_t, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a - /// human-readable name. + /// \brief This function prepares to authenticate a new message with + /// the same key as the previous HMAC operation. /// - /// \param name The human-readable name. + /// You may call this function after mbedtls_md_hmac_finish(). + /// Afterwards call mbedtls_md_hmac_update() to pass the new + /// input. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_name( - name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ecp_curve_info; -} -unsafe extern "C" { - /// \brief This function initializes a point as zero. + /// \param ctx The message digest context containing an embedded HMAC + /// context. /// - /// \param pt The point to initialize. - pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECP group context - /// without loading any domain parameters. + /// \brief This function calculates the full generic HMAC + /// on the input buffer with the provided key. /// - /// \note After this function is called, domain parameters - /// for various ECP groups can be loaded through the - /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() - /// functions. - pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); -} -unsafe extern "C" { - /// \brief This function initializes a key pair as an invalid one. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param key The key pair to initialize. - pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); -} -unsafe extern "C" { - /// \brief This function frees the components of a point. + /// The HMAC result is calculated as + /// output = generic HMAC(hmac key, input buffer). /// - /// \param pt The point to free. - pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); -} -unsafe extern "C" { - /// \brief This function frees the components of an ECP group. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC secret key in Bytes. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// \param output The generic HMAC result. /// - /// \param grp The group to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP group. - pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac( + md_info: *const mbedtls_md_info_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function frees the components of a key pair. - /// - /// \param key The key pair to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP key pair. - pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +/// \brief Entropy poll callback pointer +/// +/// \param data Callback-specific data pointer +/// \param output Data to fill +/// \param len Maximum size to provide +/// \param olen The actual amount of bytes put into the buffer (Can be 0) +/// +/// \return 0 if no critical failures occurred, +/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise +pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< + unsafe extern "C" fn( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + ) -> ::core::ffi::c_int, +>; +/// \brief Entropy source state +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_source_state { + ///< The entropy source callback + pub private_f_source: mbedtls_entropy_f_source_ptr, + ///< The callback data pointer + pub private_p_source: *mut ::core::ffi::c_void, + ///< Amount received in bytes + pub private_size: usize, + ///< Minimum bytes required before release + pub private_threshold: usize, + ///< Is the source strong? + pub private_strong: ::core::ffi::c_int, } -unsafe extern "C" { - /// \brief This function copies the contents of point \p Q into - /// point \p P. - /// - /// \param P The destination point. This must be initialized. - /// \param Q The source point. This must be initialized. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code for other kinds of failure. - pub fn mbedtls_ecp_copy( - P: *mut mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_entropy_source_state { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +/// \brief Entropy context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_context { + pub private_accumulator: mbedtls_md_context_t, + pub private_accumulator_started: ::core::ffi::c_int, + pub private_source_count: ::core::ffi::c_int, + pub private_source: [mbedtls_entropy_source_state; 20usize], +} +impl Default for mbedtls_entropy_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function copies the contents of group \p src into - /// group \p dst. - /// - /// \param dst The destination group. This must be initialized. - /// \param src The source group. This must be initialized. + /// \brief Initialize the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_copy( - dst: *mut mbedtls_ecp_group, - src: *const mbedtls_ecp_group, - ) -> ::core::ffi::c_int; + /// \param ctx Entropy context to initialize + pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function sets a point to the point at infinity. - /// - /// \param pt The point to set. This must be initialized. + /// \brief Free the data in the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \param ctx Entropy context to free + pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function checks if a point is the point at infinity. + /// \brief Adds an entropy source to poll + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param pt The point to test. This must be initialized. + /// \param ctx Entropy context + /// \param f_source Entropy function + /// \param p_source Function data + /// \param threshold Minimum required from source before entropy is released + /// ( with mbedtls_entropy_func() ) (in bytes) + /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + /// MBEDTLS_ENTROPY_SOURCE_WEAK. + /// At least one strong source needs to be added. + /// Weaker sources (such as the cycle counter) can be used as + /// a complement. /// - /// \return \c 1 if the point is zero. - /// \return \c 0 if the point is non-zero. - /// \return A negative error code on failure. - pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + pub fn mbedtls_entropy_add_source( + ctx: *mut mbedtls_entropy_context, + f_source: mbedtls_entropy_f_source_ptr, + p_source: *mut ::core::ffi::c_void, + threshold: usize, + strong: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function compares two points. - /// - /// \note This assumes that the points are normalized. Otherwise, - /// they may compare as "not equal" even if they are. + /// \brief Trigger an extra gather poll for the accumulator + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The first point to compare. This must be initialized. - /// \param Q The second point to compare. This must be initialized. + /// \param ctx Entropy context /// - /// \return \c 0 if the points are equal. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. - pub fn mbedtls_ecp_point_cmp( - P: *const mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a non-zero point from two ASCII - /// strings. + /// \brief Retrieve entropy from the accumulator + /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The destination point. This must be initialized. - /// \param radix The numeric base of the input. - /// \param x The first affine coordinate, as a null-terminated string. - /// \param y The second affine coordinate, as a null-terminated string. + /// \param data Entropy context + /// \param output Buffer to fill + /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. - pub fn mbedtls_ecp_point_read_string( - P: *mut mbedtls_ecp_point, - radix: ::core::ffi::c_int, - x: *const ::core::ffi::c_char, - y: *const ::core::ffi::c_char, + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_func( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point into unsigned binary data. + /// \brief Add data to the accumulator manually + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The point to export. This must be initialized. - /// \param format The point format. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// (For groups without these formats, this parameter is - /// ignored. But it still has to be either of the above - /// values.) - /// \param olen The address at which to store the length of - /// the output in Bytes. This must not be \c NULL. - /// \param buf The output buffer. This must be a writable buffer - /// of length \p buflen Bytes. - /// \param buflen The length of the output buffer \p buf in Bytes. + /// \param ctx Entropy context + /// \param data Data to add + /// \param len Length of data /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer - /// is too small to hold the point. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format - /// or the export for the given group is not implemented. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_point_write_binary( - grp: *const mbedtls_ecp_group, - P: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, + /// \return 0 if successful + pub fn mbedtls_entropy_update_manual( + ctx: *mut mbedtls_entropy_context, + data: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a point from unsigned binary data. + /// \brief Checkup routine /// - /// \note This function does not check that the point actually - /// belongs to the given group, see mbedtls_ecp_check_pubkey() - /// for that. + /// This module self-test also calls the entropy self-test, + /// mbedtls_entropy_source_self_test(); /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The CTR_DRBG context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ctr_drbg_context { + ///< The counter (V). + pub private_counter: [::core::ffi::c_uchar; 16usize], + ///< The reseed counter. + /// This is the number of requests that have + /// been made since the last (re)seeding, + /// minus one. + /// Before the initial seeding, this field + /// contains the amount of entropy in bytes + /// to use as a nonce for the initial seeding, + /// or -1 if no nonce length has been explicitly + /// set (see mbedtls_ctr_drbg_set_nonce_len()). + pub private_reseed_counter: ::core::ffi::c_int, + ///< This determines whether prediction + ///resistance is enabled, that is + ///whether to systematically reseed before + ///each random generation. + pub private_prediction_resistance: ::core::ffi::c_int, + ///< The amount of entropy grabbed on each + ///seed or reseed operation, in bytes. + pub private_entropy_len: usize, + ///< The reseed interval. + /// This is the maximum number of requests + /// that can be made between reseedings. + pub private_reseed_interval: ::core::ffi::c_int, + ///< The AES context. + pub private_aes_ctx: mbedtls_aes_context, + pub private_f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + ///< The context for the entropy function. + pub private_p_entropy: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_ctr_drbg_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes the CTR_DRBG context, + /// and prepares it for mbedtls_ctr_drbg_seed() + /// or mbedtls_ctr_drbg_free(). /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The destination context to import the point to. - /// This must be initialized. - /// \param buf The input buffer. This must be a readable buffer - /// of length \p ilen Bytes. - /// \param ilen The length of the input buffer \p buf in Bytes. + /// \note The reseed interval is + /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + /// You can override it by calling + /// mbedtls_ctr_drbg_set_reseed_interval(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the - /// given group is not implemented. - pub fn mbedtls_ecp_point_read_binary( - grp: *const mbedtls_ecp_group, - P: *mut mbedtls_ecp_point, - buf: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to initialize. + pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function imports a point from a TLS ECPoint record. + /// - The \p custom string. /// - /// \note On function return, \p *buf is updated to point immediately - /// after the ECPoint record. + /// \note To achieve the nominal security strength permitted + /// by CTR_DRBG, the entropy length must be: + /// - at least 16 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 32 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The destination point. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the buffer. + /// In addition, if you do not pass a nonce in \p custom, + /// the sum of the entropy length + /// and the entropy nonce length must be: + /// - at least 24 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 48 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization - /// failure. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - pub fn mbedtls_ecp_tls_read_point( - grp: *const mbedtls_ecp_group, - pt: *mut mbedtls_ecp_point, - buf: *mut *const ::core::ffi::c_uchar, + /// \param ctx The CTR_DRBG context to seed. + /// It must have been initialized with + /// mbedtls_ctr_drbg_init(). + /// After a successful call to mbedtls_ctr_drbg_seed(), + /// you may not call mbedtls_ctr_drbg_seed() again on + /// the same context unless you call + /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + /// again first. + /// After a failed call to mbedtls_ctr_drbg_seed(), + /// you must call mbedtls_ctr_drbg_free(). + /// \param f_entropy The entropy callback, taking as arguments the + /// \p p_entropy context, the buffer to fill, and the + /// length of the buffer. + /// \p f_entropy is always called with a buffer size + /// less than or equal to the entropy length. + /// \param p_entropy The entropy context to pass to \p f_entropy. + /// \param custom The personalization string. + /// This can be \c NULL, in which case the personalization + /// string is empty regardless of the value of \p len. + /// \param len The length of the personalization string. + /// This must be at most + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_seed( + ctx: *mut mbedtls_ctr_drbg_context, + f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + p_entropy: *mut ::core::ffi::c_void, + custom: *const ::core::ffi::c_uchar, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point as a TLS ECPoint record - /// defined in RFC 4492, Section 5.4. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to be exported. This must be initialized. - /// \param format The point format to use. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// \param olen The address at which to store the length in Bytes - /// of the data written. - /// \param buf The target buffer. This must be a writable buffer of - /// length \p blen Bytes. - /// \param blen The length of the target buffer \p buf in Bytes. + /// \brief This function resets CTR_DRBG context to the state immediately + /// after initial call of mbedtls_ctr_drbg_init(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer - /// is too small to hold the exported point. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_point( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to clear. + pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function sets up an ECP group context - /// from a standardized set of domain parameters. - /// - /// \note The index should be a value of the NamedCurve enum, - /// as defined in RFC-4492: Elliptic Curve Cryptography - /// (ECC) Cipher Suites for Transport Layer Security (TLS), - /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + /// \brief This function turns prediction resistance on or off. + /// The default value is off. /// - /// \param grp The group context to setup. This must be initialized. - /// \param id The identifier of the domain parameter set to load. + /// \note If enabled, entropy is gathered at the beginning of + /// every call to mbedtls_ctr_drbg_random_with_add() + /// or mbedtls_ctr_drbg_random(). + /// Only use this if your entropy source has sufficient + /// throughput. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_load( - grp: *mut mbedtls_ecp_group, - id: mbedtls_ecp_group_id, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + pub fn mbedtls_ctr_drbg_set_prediction_resistance( + ctx: *mut mbedtls_ctr_drbg_context, + resistance: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function sets up an ECP group context from a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed on each + /// seed or reseed. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. /// - /// \param grp The group context to setup. This must be initialized. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \note The security strength of CTR_DRBG is bounded by the + /// entropy length. Thus: + /// - When using AES-256 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + /// which is the default), + /// \p len must be at least 32 (in bytes) + /// to achieve a 256-bit strength. + /// - When using AES-128 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + /// \p len must be at least 16 (in bytes) + /// to achieve a 128-bit strength. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group( - grp: *mut mbedtls_ecp_group, - buf: *mut *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. + pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); } unsafe extern "C" { - /// \brief This function extracts an elliptic curve group ID from a - /// TLS ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed + /// as a nonce for the initial seeding. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// Call this function before calling mbedtls_ctr_drbg_seed() to read + /// a nonce from the entropy source during the initial seeding. /// - /// \param grp The address at which to store the group id. - /// This must not be \c NULL. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab for the nonce, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group_id( - grp: *mut mbedtls_ecp_group_id, - buf: *mut *const ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + /// if the initial seeding has already taken place. + pub fn mbedtls_ctr_drbg_set_nonce_len( + ctx: *mut mbedtls_ctr_drbg_context, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports an elliptic curve as a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the reseed interval. /// - /// \param grp The ECP group to be exported. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param olen The address at which to store the number of Bytes written. - /// This must not be \c NULL. - /// \param buf The buffer to write to. This must be a writable buffer - /// of length \p blen Bytes. - /// \param blen The length of the output buffer \p buf in Bytes. + /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function + /// is called again. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output - /// buffer is too small to hold the exported group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_group( - grp: *const mbedtls_ecp_group, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// + /// \param ctx The CTR_DRBG context. + /// \param interval The reseed interval. + pub fn mbedtls_ctr_drbg_set_reseed_interval( + ctx: *mut mbedtls_ctr_drbg_context, + interval: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function performs a scalar multiplication of a point - /// by an integer: \p R = \p m * \p P. - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function reseeds the CTR_DRBG context, that is + /// extracts data from the entropy source. /// - /// \note To prevent timing attacks, this function - /// executes the exact same sequence of base-field - /// operations for any valid \p m. It avoids any if-branch or - /// array index depending on the value of \p m. It also uses - /// \p f_rng to randomize some intermediate results. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param ctx The CTR_DRBG context. + /// \param additional Additional data to add to the state. Can be \c NULL. + /// \param len The length of the additional data. + /// This must be less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_reseed( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication of a point by - /// an integer: \p R = \p m * \p P in a restartable way. - /// - /// \see mbedtls_ecp_mul() + /// \brief This function updates the state of the CTR_DRBG context. /// - /// \note This function does the same as \c mbedtls_ecp_mul(), but - /// it can return early and restart according to the limit set - /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. - /// \param rs_ctx The restart context (NULL disables restart). + /// \param ctx The CTR_DRBG context. + /// \param additional The data to update the state with. This must not be + /// \c NULL unless \p add_len is \c 0. + /// \param add_len Length of \p additional in bytes. This must be at + /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecp_restart_ctx, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + /// \p add_len is more than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return An error from the underlying AES cipher on failure. + pub fn mbedtls_ctr_drbg_update( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function updates a CTR_DRBG instance with additional + /// data and uses it to generate random data. /// - /// \note In contrast to mbedtls_ecp_mul(), this function does not - /// guarantee a constant execution flow and timing. + /// This function automatically reseeds if the reseed counter is exceeded + /// or prediction resistance is enabled. /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. + /// \param additional Additional data to update. Can be \c NULL, in which + /// case the additional data is empty regardless of + /// the value of \p add_len. + /// \param add_len The length of the additional data + /// if \p additional is not \c NULL. + /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + /// and less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random_with_add( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q in a - /// restartable way. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. /// - /// \see \c mbedtls_ecp_muladd() + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The CTR_DRBG checkup routine. /// - /// \note This function works the same as \c mbedtls_ecp_muladd(), - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. - /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. - /// \param rs_ctx The restart context (NULL disables restart). - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, - rs_ctx: *mut mbedtls_ecp_restart_ctx, - ) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function checks that a point is a valid public key - /// on this curve. - /// - /// It only checks that the point is non-zero, has - /// valid coordinates and lies on the curve. It does not verify - /// that it is indeed a multiple of \p G. This additional - /// check is computationally more expensive, is not required - /// by standards, and should not be necessary if the group - /// used has a small cofactor. In particular, it is useless for - /// the NIST groups which all have a cofactor of 1. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure, to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the point should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid public key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not - /// a valid public key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_pubkey( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +///< Curve not defined. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; +///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; +///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; +///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; +///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; +///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; +///< Domain parameters for 256-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; +///< Domain parameters for 384-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; +///< Domain parameters for 512-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; +///< Domain parameters for Curve25519. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; +///< Domain parameters for 192-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; +///< Domain parameters for 224-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; +///< Domain parameters for 256-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; +///< Domain parameters for Curve448. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; +/// Domain-parameter identifiers: curve, subgroup, and generator. +/// +/// \note Only curves over prime fields are supported. +/// +/// \warning This library does not support validation of arbitrary domain +/// parameters. Therefore, only standardized domain parameters from trusted +/// sources should be used. See mbedtls_ecp_group_load(). +pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; +pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; +/// Curve information, for use by other modules. +/// +/// The fields of this structure are part of the public API and can be +/// accessed directly by applications. Future versions of the library may +/// add extra fields or reorder existing fields. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_curve_info { + ///< An internal identifier. + pub grp_id: mbedtls_ecp_group_id, + ///< The TLS NamedCurve identifier. + pub tls_id: u16, + ///< The curve size in bits. + pub bit_size: u16, + ///< A human-friendly name. + pub name: *const ::core::ffi::c_char, } -unsafe extern "C" { - /// \brief This function checks that an \p mbedtls_mpi is a - /// valid private key for this curve. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the private key should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The integer to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid private key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid - /// private key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_privkey( - grp: *const mbedtls_ecp_group, - d: *const mbedtls_mpi, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_curve_info { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates a private key. - /// - /// \param grp The ECP group to generate a private key for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_privkey( - grp: *const mbedtls_ecp_group, - d: *mut mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +/// \brief The ECP point structure, in Jacobian coordinates. +/// +/// \note All functions expect and return points satisfying +/// the following condition: Z == 0 or +/// Z == 1. Other values of \p Z are +/// used only by internal functions. +/// The point is zero, or "at infinity", if Z == 0. +/// Otherwise, \p X and \p Y are its standard (affine) +/// coordinates. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_point { + ///< The X coordinate of the ECP point. + pub private_X: mbedtls_mpi, + ///< The Y coordinate of the ECP point. + pub private_Y: mbedtls_mpi, + ///< The Z coordinate of the ECP point. + pub private_Z: mbedtls_mpi, } -unsafe extern "C" { - /// \brief This function generates a keypair with a configurable base - /// point. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param G The base point to use. This must be initialized - /// and belong to \p grp. It replaces the default base - /// point \c grp->G used by mbedtls_ecp_gen_keypair(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair_base( - grp: *mut mbedtls_ecp_group, - G: *const mbedtls_ecp_point, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_point { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates an ECP keypair. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. +/// \brief The ECP group structure. +/// +/// We consider two types of curve equations: +///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P +/// (SEC1 + RFC-4492)
            • +///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, +/// Curve448)
          +/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. +/// +/// For Short Weierstrass, this subgroup is the whole curve, and its +/// cardinality is denoted by \p N. Our code requires that \p N is an +/// odd prime as mbedtls_ecp_mul() requires an odd number, and +/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. +/// +/// The default implementation only initializes \p A without setting it to the +/// authentic value for curves with A = -3(SECP256R1, etc), in which +/// case you need to load \p A by yourself when using domain parameters directly, +/// for example: +/// \code +/// mbedtls_mpi_init(&A); +/// mbedtls_ecp_group_init(&grp); +/// CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); +/// if (mbedtls_ecp_group_a_is_minus_3(&grp)) { +/// CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); +/// } else { +/// CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); +/// } +/// +/// do_something_with_a(&A); +/// +/// cleanup: +/// mbedtls_mpi_free(&A); +/// mbedtls_ecp_group_free(&grp); +/// \endcode +/// +/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, +/// which is the quantity used in the formulas. Additionally, \p nbits is +/// not the size of \p N but the required size for private keys. +/// +/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. +/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the +/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer +/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits +/// in size, so that it may be efficiently brought in the 0..P-1 range by a few +/// additions or subtractions. Therefore, it is only an approximate modular +/// reduction. It must return 0 on success and non-zero on failure. +/// +/// \note Alternative implementations of the ECP module must obey the +/// following constraints. +/// * Group IDs must be distinct: if two group structures have +/// the same ID, then they must be identical. +/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, +/// \c pbits and \c nbits must have the same type and semantics +/// as in the built-in implementation. +/// They must be available for reading, but direct modification +/// of these fields does not need to be supported. +/// They do not need to be at the same offset in the structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_group { + ///< An internal group identifier. + pub id: mbedtls_ecp_group_id, + ///< The prime modulus of the base field. + pub P: mbedtls_mpi, + ///< For Short Weierstrass: \p A in the equation. Note that + ///\p A is not set to the authentic value in some cases. + ///Refer to detailed description of ::mbedtls_ecp_group if + ///using domain parameters in the structure. + ///For Montgomery curves: (A + 2) / 4. + pub A: mbedtls_mpi, + ///< For Short Weierstrass: \p B in the equation. + ///For Montgomery curves: unused. + pub B: mbedtls_mpi, + ///< The generator of the subgroup used. + pub G: mbedtls_ecp_point, + ///< The order of \p G. + pub N: mbedtls_mpi, + ///< The number of bits in \p P. + pub pbits: usize, + ///< For Short Weierstrass: The number of bits in \p P. + ///For Montgomery curves: the number of bits in the + ///private keys. + pub nbits: usize, + ///< \internal 1 if the constants are static. + pub private_h: ::core::ffi::c_uint, + ///< The function for fast pseudo-reduction + ///mod \p P (see above). + pub private_modp: + ::core::option::Option ::core::ffi::c_int>, + ///< Unused. + pub private_t_pre: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_post: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_data: *mut ::core::ffi::c_void, + ///< Pre-computed points for ecp_mul_comb(). + pub private_T: *mut mbedtls_ecp_point, + ///< The number of dynamic allocated pre-computed points. + pub private_T_size: usize, +} +impl Default for mbedtls_ecp_group { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; +/// \brief The ECP key-pair structure. +/// +/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. +/// +/// \note Members are deliberately in the same order as in the +/// ::mbedtls_ecdsa_context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_keypair { + ///< Elliptic curve and base point + pub private_grp: mbedtls_ecp_group, + ///< our secret value + pub private_d: mbedtls_mpi, + ///< our public value + pub private_Q: mbedtls_ecp_point, +} +impl Default for mbedtls_ecp_keypair { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +} +unsafe extern "C" { + /// \brief This function retrieves the information defined in + /// mbedtls_ecp_curve_info() for all supported curves. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair( - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. + /// + /// \return A statically allocated array. The last entry is 0. + pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function generates an ECP key. + /// \brief This function retrieves the list of internal group + /// identifiers of all supported curves in the order of + /// preference. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. This must be initialized. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_key( - grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return A statically allocated array, + /// terminated with MBEDTLS_ECP_DP_NONE. + pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function reads an elliptic curve private key. + /// \brief This function retrieves curve information from an internal + /// group identifier. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. - /// \param buf The buffer containing the binary representation of the - /// key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The length of the buffer in bytes. + /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is - /// invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_read_key( + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_grp_id( grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - buf: *const ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports an elliptic curve private key. + /// \brief This function retrieves curve information from a TLS + /// NamedCurve value. /// - /// \param key The private key. - /// \param buf The output buffer for containing the binary representation - /// of the key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The total length of the buffer in bytes. + /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key - ///representation is larger than the available space in \p buf. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_write_key( - key: *mut mbedtls_ecp_keypair, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function checks that the keypair objects - /// \p pub and \p prv have the same group and the - /// same public point, and that the private key in - /// \p prv is consistent with the public key. + /// \brief This function retrieves curve information from a + /// human-readable name. /// - /// \param pub The keypair structure holding the public key. This - /// must be initialized. If it contains a private key, that - /// part is ignored. - /// \param prv The keypair structure holding the full keypair. - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param name The human-readable name. /// - /// \return \c 0 on success, meaning that the keys are valid and match. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. - /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX - /// error code on calculation failure. - pub fn mbedtls_ecp_check_pub_priv( - pub_: *const mbedtls_ecp_keypair, - prv: *const mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_name( + name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports generic key-pair parameters. - /// - /// \param key The key pair to export from. - /// \param grp Slot for exported ECP group. - /// It must point to an initialized ECP group. - /// \param d Slot for the exported secret value. - /// It must point to an initialized mpi. - /// \param Q Slot for the exported public value. - /// It must point to an initialized ECP point. + /// \brief This function initializes a point as zero. /// - /// \return \c 0 on success, - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_export( - key: *const mbedtls_ecp_keypair, - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \param pt The point to initialize. + pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief The ECP checkup routine. + /// \brief This function initializes an ECP group context + /// without loading any domain parameters. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< None. -pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; -///< The MD5 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 1; -///< The SHA-1 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 2; -///< The SHA-224 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 3; -///< The SHA-256 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 4; -///< The SHA-384 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 5; -///< The SHA-512 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 6; -///< The RIPEMD-160 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 7; -/// \brief Supported message digests. -/// -/// \warning MD5 and SHA-1 are considered weak message digests and -/// their use constitutes a security risk. We recommend considering -/// stronger message digests instead. -pub type mbedtls_md_type_t = ::core::ffi::c_uint; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_info_t { - _unused: [u8; 0], -} -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; -/// Used internally to indicate whether a context uses legacy or PSA. -/// -/// Internal use only. -pub type mbedtls_md_engine_t = ::core::ffi::c_uint; -/// The generic message-digest context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_context_t { - /// Information about the associated message digest. - pub private_md_info: *const mbedtls_md_info_t, - /// The digest-specific context (legacy) or the PSA operation. - pub private_md_ctx: *mut ::core::ffi::c_void, - /// The HMAC part of the context. - pub private_hmac_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_md_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \note After this function is called, domain parameters + /// for various ECP groups can be loaded through the + /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + /// functions. + pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest type. - /// - /// \param md_type The type of digest to search for. + /// \brief This function initializes a key pair as an invalid one. /// - /// \return The message-digest information associated with \p md_type. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; + /// \param key The key pair to initialize. + pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); } unsafe extern "C" { - /// \brief This function initializes a message-digest context without - /// binding it to a particular message-digest algorithm. + /// \brief This function frees the components of a point. /// - /// This function should always be called first. It prepares the - /// context for mbedtls_md_setup() for binding it to a - /// message-digest algorithm. - pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); + /// \param pt The point to free. + pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief This function clears the internal structure of \p ctx and - /// frees any embedded internal structure, but does not free - /// \p ctx itself. + /// \brief This function frees the components of an ECP group. /// - /// If you have called mbedtls_md_setup() on \p ctx, you must - /// call mbedtls_md_free() when you are no longer using the - /// context. - /// Calling this function if you have previously - /// called mbedtls_md_init() and nothing else is optional. - /// You must not call this function if you have not called - /// mbedtls_md_init(). - pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); + /// \param grp The group to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP group. + pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function selects the message digest algorithm to use, - /// and allocates internal structures. + /// \brief This function frees the components of a key pair. /// - /// It should be called after mbedtls_md_init() or - /// mbedtls_md_free(). Makes it necessary to call - /// mbedtls_md_free() later. + /// \param key The key pair to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP key pair. + pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +} +unsafe extern "C" { + /// \brief This function copies the contents of point \p Q into + /// point \p P. /// - /// \param ctx The context to set up. - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), - /// or non-zero: HMAC is used with this context. + /// \param P The destination point. This must be initialized. + /// \param Q The source point. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. - pub fn mbedtls_md_setup( - ctx: *mut mbedtls_md_context_t, - md_info: *const mbedtls_md_info_t, - hmac: ::core::ffi::c_int, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code for other kinds of failure. + pub fn mbedtls_ecp_copy( + P: *mut mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function clones the state of a message-digest - /// context. - /// - /// \note You must call mbedtls_md_setup() on \c dst before calling - /// this function. - /// - /// \note The two contexts must have the same type, - /// for example, both are SHA-256. - /// - /// \warning This function clones the message-digest state, not the - /// HMAC state. + /// \brief This function copies the contents of group \p src into + /// group \p dst. /// - /// \param dst The destination context. - /// \param src The context to be cloned. + /// \param dst The destination group. This must be initialized. + /// \param src The source group. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. - /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are - /// not using the same engine. This can be avoided by moving - /// the call to psa_crypto_init() before the first call to - /// mbedtls_md_setup(). - pub fn mbedtls_md_clone( - dst: *mut mbedtls_md_context_t, - src: *const mbedtls_md_context_t, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_copy( + dst: *mut mbedtls_ecp_group, + src: *const mbedtls_ecp_group, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest size from the - /// message-digest information structure. + /// \brief This function sets a point to the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to set. This must be initialized. /// - /// \return The size of the message-digest output in Bytes. - pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest type from the - /// message-digest information structure. + /// \brief This function checks if a point is the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to test. This must be initialized. /// - /// \return The type of the message digest. - pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; + /// \return \c 1 if the point is zero. + /// \return \c 0 if the point is non-zero. + /// \return A negative error code on failure. + pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function starts a message-digest computation. + /// \brief This function compares two points. /// - /// You must call this function after setting up the context - /// with mbedtls_md_setup(), and before passing data with - /// mbedtls_md_update(). + /// \note This assumes that the points are normalized. Otherwise, + /// they may compare as "not equal" even if they are. /// - /// \param ctx The generic message-digest context. + /// \param P The first point to compare. This must be initialized. + /// \param Q The second point to compare. This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return \c 0 if the points are equal. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + pub fn mbedtls_ecp_point_cmp( + P: *const mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// message-digest computation. - /// - /// You must call mbedtls_md_starts() before calling this - /// function. You may call this function multiple times. - /// Afterwards, call mbedtls_md_finish(). + /// \brief This function imports a non-zero point from two ASCII + /// strings. /// - /// \param ctx The generic message-digest context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param P The destination point. This must be initialized. + /// \param radix The numeric base of the input. + /// \param x The first affine coordinate, as a null-terminated string. + /// \param y The second affine coordinate, as a null-terminated string. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + pub fn mbedtls_ecp_point_read_string( + P: *mut mbedtls_ecp_point, + radix: ::core::ffi::c_int, + x: *const ::core::ffi::c_char, + y: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the digest operation, - /// and writes the result to the output buffer. - /// - /// Call this function after a call to mbedtls_md_starts(), - /// followed by any number of calls to mbedtls_md_update(). - /// Afterwards, you may either clear the context with - /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse - /// the context for another digest operation with the same - /// algorithm. + /// \brief This function exports a point into unsigned binary data. /// - /// \param ctx The generic message-digest context. - /// \param output The buffer for the generic message-digest checksum result. + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The point to export. This must be initialized. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_point_write_binary( + grp: *const mbedtls_ecp_group, + P: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the message-digest of a buffer, - /// with respect to a configurable message-digest algorithm - /// in a single call. + /// \brief This function imports a point from unsigned binary data. /// - /// The result is calculated as - /// Output = message_digest(input buffer). + /// \note This function does not check that the point actually + /// belongs to the given group, see mbedtls_ecp_check_pubkey() + /// for that. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param input The buffer holding the data. - /// \param ilen The length of the input data. - /// \param output The generic message-digest checksum result. + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md( - md_info: *const mbedtls_md_info_t, - input: *const ::core::ffi::c_uchar, + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The destination context to import the point to. + /// This must be initialized. + /// \param buf The input buffer. This must be a readable buffer + /// of length \p ilen Bytes. + /// \param ilen The length of the input buffer \p buf in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + /// given group is not implemented. + pub fn mbedtls_ecp_point_read_binary( + grp: *const mbedtls_ecp_group, + P: *mut mbedtls_ecp_point, + buf: *const ::core::ffi::c_uchar, ilen: usize, - output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the list of digests supported by the - /// generic digest module. - /// - /// \note The list starts with the strongest available hashes. + /// \brief This function imports a point from a TLS ECPoint record. /// - /// \return A statically allocated array of digests. Each element - /// in the returned list is an integer belonging to the - /// message-digest enumeration #mbedtls_md_type_t. - /// The last entry is 0. - pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest name. + /// \note On function return, \p *buf is updated to point immediately + /// after the ECPoint record. /// - /// \param md_name The name of the digest to search for. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The destination point. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the buffer. /// - /// \return The message-digest information associated with \p md_name. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_string( - md_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_md_info_t; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + /// failure. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + pub fn mbedtls_ecp_tls_read_point( + grp: *const mbedtls_ecp_group, + pt: *mut mbedtls_ecp_point, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest name from the - /// message-digest information structure. + /// \brief This function exports a point as a TLS ECPoint record + /// defined in RFC 4492, Section 5.4. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to be exported. This must be initialized. + /// \param format The point format to use. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// \param olen The address at which to store the length in Bytes + /// of the data written. + /// \param buf The target buffer. This must be a writable buffer of + /// length \p blen Bytes. + /// \param blen The length of the target buffer \p buf in Bytes. /// - /// \return The name of the message digest. - pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + /// is too small to hold the exported point. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_point( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// from the given context. + /// \brief This function sets up an ECP group context + /// from a standardized set of domain parameters. /// - /// \param ctx The context from which to extract the information. - /// This must be initialized (or \c NULL). + /// \note The index should be a value of the NamedCurve enum, + /// as defined in RFC-4492: Elliptic Curve Cryptography + /// (ECC) Cipher Suites for Transport Layer Security (TLS), + /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. /// - /// \return The message-digest information associated with \p ctx. - /// \return \c NULL if \p ctx is \c NULL. - pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; + /// \param grp The group context to setup. This must be initialized. + /// \param id The identifier of the domain parameter set to load. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_load( + grp: *mut mbedtls_ecp_group, + id: mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the HMAC key and prepares to - /// authenticate a new message. + /// \brief This function sets up an ECP group context from a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_setup(), to use - /// the MD context for an HMAC calculation, then call - /// mbedtls_md_hmac_update() to provide the input data, and - /// mbedtls_md_hmac_finish() to get the HMAC value. + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC key in Bytes. + /// \param grp The group context to setup. This must be initialized. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_starts( - ctx: *mut mbedtls_md_context_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group( + grp: *mut mbedtls_ecp_group, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing HMAC - /// computation. + /// \brief This function extracts an elliptic curve group ID from a + /// TLS ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() - /// before calling this function. - /// You may call this function multiple times to pass the - /// input piecewise. - /// Afterwards, call mbedtls_md_hmac_finish(). + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param grp The address at which to store the group id. + /// This must not be \c NULL. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group_id( + grp: *mut mbedtls_ecp_group_id, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the HMAC operation, and writes - /// the result to the output buffer. + /// \brief This function exports an elliptic curve as a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_hmac_starts() and - /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards - /// you may either call mbedtls_md_free() to clear the context, - /// or call mbedtls_md_hmac_reset() to reuse the context with - /// the same HMAC key. - /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param output The generic HMAC checksum result. + /// \param grp The ECP group to be exported. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param olen The address at which to store the number of Bytes written. + /// This must not be \c NULL. + /// \param buf The buffer to write to. This must be a writable buffer + /// of length \p blen Bytes. + /// \param blen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + /// buffer is too small to hold the exported group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_group( + grp: *const mbedtls_ecp_group, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function prepares to authenticate a new message with - /// the same key as the previous HMAC operation. + /// \brief This function performs a scalar multiplication of a point + /// by an integer: \p R = \p m * \p P. /// - /// You may call this function after mbedtls_md_hmac_finish(). - /// Afterwards call mbedtls_md_hmac_update() to pass the new - /// input. + /// It is not thread-safe to use same group in multiple threads. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. + /// \note To prevent timing attacks, this function + /// executes the exact same sequence of base-field + /// operations for any valid \p m. It avoids any if-branch or + /// array index depending on the value of \p m. It also uses + /// \p f_rng to randomize some intermediate results. + /// + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the full generic HMAC - /// on the input buffer with the provided key. + /// \brief This function performs multiplication of a point by + /// an integer: \p R = \p m * \p P in a restartable way. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// \see mbedtls_ecp_mul() /// - /// The HMAC result is calculated as - /// output = generic HMAC(hmac key, input buffer). + /// \note This function does the same as \c mbedtls_ecp_mul(), but + /// it can return early and restart according to the limit set + /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC secret key in Bytes. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. - /// \param output The generic HMAC result. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac( - md_info: *const mbedtls_md_info_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecp_restart_ctx, ) -> ::core::ffi::c_int; } -/// \brief The RSA context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_rsa_context { - ///< Reserved for internal purposes. - /// Do not set this field in application - /// code. Its meaning might change without - /// notice. - pub private_ver: ::core::ffi::c_int, - ///< The size of \p N in Bytes. - pub private_len: usize, - ///< The public modulus. - pub private_N: mbedtls_mpi, - ///< The public exponent. - pub private_E: mbedtls_mpi, - ///< The private exponent. - pub private_D: mbedtls_mpi, - ///< The first prime factor. - pub private_P: mbedtls_mpi, - ///< The second prime factor. - pub private_Q: mbedtls_mpi, - ///< D % (P - 1). - pub private_DP: mbedtls_mpi, - ///< D % (Q - 1). - pub private_DQ: mbedtls_mpi, - ///< 1 / (Q % P). - pub private_QP: mbedtls_mpi, - ///< cached R^2 mod N. - pub private_RN: mbedtls_mpi, - ///< cached R^2 mod P. - pub private_RP: mbedtls_mpi, - ///< cached R^2 mod Q. - pub private_RQ: mbedtls_mpi, - ///< The cached blinding value. - pub private_Vi: mbedtls_mpi, - ///< The cached un-blinding value. - pub private_Vf: mbedtls_mpi, - ///< Selects padding mode: - ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and - ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. - pub private_padding: ::core::ffi::c_int, - ///< Hash identifier of mbedtls_md_type_t type, - ///as specified in md.h for use in the MGF - ///mask generating function used in the - ///EME-OAEP and EMSA-PSS encodings. - pub private_hash_id: ::core::ffi::c_int, -} -impl Default for mbedtls_rsa_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes an RSA context. - /// - /// \note This function initializes the padding and the hash - /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and - /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more - /// information about those parameters. - /// - /// \param ctx The RSA context to initialize. This must not be \c NULL. - pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); -} -unsafe extern "C" { - /// \brief This function sets padding for an already initialized RSA - /// context. - /// - /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP - /// encryption scheme and the RSASSA-PSS signature scheme. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q /// - /// \note The \p hash_id parameter is ignored when using - /// #MBEDTLS_RSA_PKCS_V15 padding. + /// It is not thread-safe to use same group in multiple threads. /// - /// \note The choice of padding mode is strictly enforced for private - /// key operations, since there might be security concerns in - /// mixing padding modes. For public key operations it is - /// a default value, which can be overridden by calling specific - /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx - /// functions. + /// \note In contrast to mbedtls_ecp_mul(), this function does not + /// guarantee a constant execution flow and timing. /// - /// \note The hash selected in \p hash_id is always used for OEAP - /// encryption. For PSS signatures, it is always used for - /// making signatures, but can be overridden for verifying them. - /// If set to #MBEDTLS_MD_NONE, it is always overridden. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \param ctx The initialized RSA context to be configured. - /// \param padding The padding mode to use. This must be either - /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. - /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is - /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this - /// function but may be not suitable for some operations. - /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: - /// \p padding or \p hash_id is invalid. - pub fn mbedtls_rsa_set_padding( - ctx: *mut mbedtls_rsa_context, - padding: ::core::ffi::c_int, - hash_id: mbedtls_md_type_t, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves padding mode of initialized - /// RSA context. - /// - /// \param ctx The initialized RSA context. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q in a + /// restartable way. /// - /// \return RSA padding mode. - pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function retrieves hash identifier of mbedtls_md_type_t - /// type. + /// \see \c mbedtls_ecp_muladd() /// - /// \param ctx The initialized RSA context. + /// \note This function works the same as \c mbedtls_ecp_muladd(), + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return Hash identifier of mbedtls_md_type_t type. - pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function imports a set of core parameters into an - /// RSA context. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, + rs_ctx: *mut mbedtls_ecp_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function checks that a point is a valid public key + /// on this curve. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// It only checks that the point is non-zero, has + /// valid coordinates and lies on the curve. It does not verify + /// that it is indeed a multiple of \c G. This additional + /// check is computationally more expensive, is not required + /// by standards, and should not be necessary if the group + /// used has a small cofactor. In particular, it is useless for + /// the NIST groups which all have a cofactor of 1. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure, to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param E The public exponent. This may be \c NULL. + /// \param grp The ECP group the point should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to check. This must be initialized. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import( - ctx: *mut mbedtls_rsa_context, - N: *const mbedtls_mpi, - P: *const mbedtls_mpi, - Q: *const mbedtls_mpi, - D: *const mbedtls_mpi, - E: *const mbedtls_mpi, + /// \return \c 0 if the point is a valid public key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + /// a valid public key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_pubkey( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports core RSA parameters, in raw big-endian - /// binary format, into an RSA context. - /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \brief This function checks that an \c mbedtls_mpi is a + /// valid private key for this curve. /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// \param grp The ECP group the private key should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The integer to check. This must be initialized. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \return \c 0 if the point is a valid private key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + /// private key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_privkey( + grp: *const mbedtls_ecp_group, + d: *const mbedtls_mpi, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates a private key. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. - /// \param E The public exponent. This may be \c NULL. - /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// \param grp The ECP group to generate a private key for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import_raw( - ctx: *mut mbedtls_rsa_context, - N: *const ::core::ffi::c_uchar, - N_len: usize, - P: *const ::core::ffi::c_uchar, - P_len: usize, - Q: *const ::core::ffi::c_uchar, - Q_len: usize, - D: *const ::core::ffi::c_uchar, - D_len: usize, - E: *const ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_privkey( + grp: *const mbedtls_ecp_group, + d: *mut mbedtls_mpi, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function completes an RSA context from - /// a set of imported core parameters. - /// - /// To setup an RSA public key, precisely \p N and \p E - /// must have been imported. + /// \brief This function generates a keypair with a configurable base + /// point. /// - /// To setup an RSA private key, sufficient information must - /// be present for the other parameters to be derivable. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// The default implementation supports the following: - ///
          • Derive \p P, \p Q from \p N, \p D, \p E.
            • - ///
          • Derive \p N, \p D from \p P, \p Q, \p E.
          - /// Alternative implementations need not support these. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param G The base point to use. This must be initialized + /// and belong to \p grp. It replaces the default base + /// point \c grp->G used by mbedtls_ecp_gen_keypair(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// If this function runs successfully, it guarantees that - /// the RSA context can be used for RSA operations without - /// the risk of failure or crash. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair_base( + grp: *mut mbedtls_ecp_group, + G: *const mbedtls_ecp_point, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates an ECP keypair. /// - /// \warning This function need not perform consistency checks - /// for the imported parameters. In particular, parameters that - /// are not needed by the implementation might be silently - /// discarded and left unchecked. To check the consistency - /// of the key material, see mbedtls_rsa_check_privkey(). + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context holding imported parameters. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations - /// failed. - pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair( + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports the core parameters of an RSA key. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. - /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \brief This function generates an ECP key. /// - /// \param ctx The initialized RSA context. - /// \param N The MPI to hold the RSA modulus. - /// This may be \c NULL if this field need not be exported. - /// \param P The MPI to hold the first prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param Q The MPI to hold the second prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param D The MPI to hold the private exponent. - /// This may be \c NULL if this field need not be exported. - /// \param E The MPI to hold the public exponent. - /// This may be \c NULL if this field need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. This must be initialized. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export( - ctx: *const mbedtls_rsa_context, - N: *mut mbedtls_mpi, - P: *mut mbedtls_mpi, - Q: *mut mbedtls_mpi, - D: *mut mbedtls_mpi, - E: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports core parameters of an RSA key - /// in raw big-endian binary format. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. + /// \brief Set the public key in a key pair object. /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \note This function does not check that the point actually + /// belongs to the given group. Call mbedtls_ecp_check_pubkey() + /// on \p Q before calling this function to check that. /// - /// \note The length parameters are ignored if the corresponding - /// buffer pointers are NULL. + /// \note This function does not check that the public key matches + /// the private key that is already in \p key, if any. + /// To check the consistency of the resulting key pair object, + /// call mbedtls_ecp_check_pub_priv() after setting both + /// the public key and the private key. /// - /// \param ctx The initialized RSA context. - /// \param N The Byte array to store the RSA modulus, - /// or \c NULL if this field need not be exported. - /// \param N_len The size of the buffer for the modulus. - /// \param P The Byte array to hold the first prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param P_len The size of the buffer for the first prime factor. - /// \param Q The Byte array to hold the second prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param Q_len The size of the buffer for the second prime factor. - /// \param D The Byte array to hold the private exponent, - /// or \c NULL if this field need not be exported. - /// \param D_len The size of the buffer for the private exponent. - /// \param E The Byte array to hold the public exponent, - /// or \c NULL if this field need not be exported. - /// \param E_len The size of the buffer for the public exponent. + /// \param grp_id The ECP group identifier. + /// \param key The key pair object. It must be initialized. + /// If its group has already been set, it must match \p grp_id. + /// If its group has not been set, it will be set to \p grp_id. + /// If the public key has already been set, it is overwritten. + /// \param Q The public key to copy. This must be a point on the + /// curve indicated by \p grp_id. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export_raw( - ctx: *const mbedtls_rsa_context, - N: *mut ::core::ffi::c_uchar, - N_len: usize, - P: *mut ::core::ffi::c_uchar, - P_len: usize, - Q: *mut ::core::ffi::c_uchar, - Q_len: usize, - D: *mut ::core::ffi::c_uchar, - D_len: usize, - E: *mut ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + /// match \p grp_id. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_public_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports CRT parameters of a private RSA key. + /// \brief This function reads an elliptic curve private key. /// - /// \note Alternative RSA implementations not using CRT-parameters - /// internally can implement this function based on - /// mbedtls_rsa_deduce_opt(). + /// \note This function does not set the public key in the + /// key pair object. Without a public key, the key pair object + /// cannot be used with operations that require the public key. + /// Call mbedtls_ecp_keypair_calc_public() to set the public + /// key from the private key. Alternatively, you can call + /// mbedtls_ecp_set_public_key() to set the public key part, + /// and then optionally mbedtls_ecp_check_pub_priv() to check + /// that the private and public parts are consistent. + /// + /// \note If a public key has already been set in the key pair + /// object, this function does not check that it is consistent + /// with the private key. Call mbedtls_ecp_check_pub_priv() + /// after setting both the public key and the private key + /// to make that check. /// - /// \param ctx The initialized RSA context. - /// \param DP The MPI to hold \c D modulo `P-1`, - /// or \c NULL if it need not be exported. - /// \param DQ The MPI to hold \c D modulo `Q-1`, - /// or \c NULL if it need not be exported. - /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, - /// or \c NULL if it need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. + /// \param buf The buffer containing the binary representation of the + /// key. (Big endian integer for Weierstrass curves, byte + /// string for Montgomery curves.) + /// \param buflen The length of the buffer in bytes. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_export_crt( - ctx: *const mbedtls_rsa_context, - DP: *mut mbedtls_mpi, - DQ: *mut mbedtls_mpi, - QP: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + /// invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_read_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + buf: *const ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves the length of RSA modulus in Bytes. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context. + /// \deprecated Note that although this function accepts an output + /// buffer that is smaller or larger than the key, most key + /// import interfaces require the output to have exactly + /// key's nominal length. It is generally simplest to + /// pass the key's nominal length as \c buflen, after + /// checking that the output buffer is large enough. + /// See the description of the \p buflen parameter for + /// how to calculate the nominal length. + /// To avoid this difficulty, use mbedtls_ecp_write_key_ext() + /// instead. + /// mbedtls_ecp_write_key() is deprecated and will be + /// removed in a future version of the library. + /// + /// \note If the private key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \return The length of the RSA modulus in Bytes. - pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; + /// \param key The private key. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// For Weierstrass curves, this is the big-endian + /// representation, padded with null bytes at the beginning + /// to reach \p buflen bytes. + /// For Montgomery curves, this is the standard byte string + /// representation (which is little-endian), padded with + /// null bytes at the end to reach \p buflen bytes. + /// \param buflen The total length of the buffer in bytes. + /// The length of the output is + /// (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// For Weierstrass keys, if the output buffer is smaller, + /// leading zeros are trimmed to fit if possible. For + /// Montgomery keys, the output buffer must always be large + /// enough for the nominal length. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + /// #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key( + key: *mut mbedtls_ecp_keypair, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an RSA keypair. - /// - /// \note mbedtls_rsa_init() must be called before this function, - /// to set up the RSA context. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context used to hold the key. - /// \param f_rng The RNG function to be used for key generation. - /// This is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. - /// This may be \c NULL if \p f_rng doesn't need a context. - /// \param nbits The size of the public key in bits. - /// \param exponent The public exponent to use. For example, \c 65537. - /// This must be odd and greater than \c 1. + /// \param key The private key. + /// \param olen On success, the length of the private key. + /// This is always (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// \param buflen The total length of the buffer in bytes. + /// #MBEDTLS_ECP_MAX_BYTES is always sufficient. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_gen_key( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - nbits: ::core::ffi::c_uint, - exponent: ::core::ffi::c_int, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + /// set in \p key. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key_ext( + key: *const mbedtls_ecp_keypair, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains at least an RSA - /// public key. + /// \brief This function exports an elliptic curve public key. /// - /// If the function runs successfully, it is guaranteed that - /// enough information is present to perform an RSA public key - /// operation using mbedtls_rsa_public(). + /// \note If the public key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to check. + /// \param key The public key. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_write_public_key( + key: *const mbedtls_ecp_keypair, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains an RSA private key - /// and perform basic consistency checks. - /// - /// \note The consistency checks performed by this function not only - /// ensure that mbedtls_rsa_private() can be called successfully - /// on the given context, but that the various parameters are - /// mutually consistent with high probability, in the sense that - /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// \brief This function checks that the keypair objects + /// \p pub and \p prv have the same group and the + /// same public point, and that the private key in + /// \p prv is consistent with the public key. /// - /// \warning This function should catch accidental misconfigurations - /// like swapping of parameters, but it cannot establish full - /// trust in neither the quality nor the consistency of the key - /// material that was used to setup the given RSA context: - ///
          • Consistency: Imported parameters that are irrelevant - /// for the implementation might be silently dropped. If dropped, - /// the current function does not have access to them, - /// and therefore cannot check them. See mbedtls_rsa_complete(). - /// If you want to check the consistency of the entire - /// content of a PKCS1-encoded RSA private key, for example, you - /// should use mbedtls_rsa_validate_params() before setting - /// up the RSA context. - /// Additionally, if the implementation performs empirical checks, - /// these checks substantiate but do not guarantee consistency.
            • - ///
          • Quality: This function is not expected to perform - /// extended quality assessments like checking that the prime - /// factors are safe. Additionally, it is the responsibility of the - /// user to ensure the trustworthiness of the source of his RSA - /// parameters, which goes beyond what is effectively checkable - /// by the library.
          - /// - /// \param ctx The initialized RSA context to check. + /// \param pub The keypair structure holding the public key. This + /// must be initialized. If it contains a private key, that + /// part is ignored. + /// \param prv The keypair structure holding the full keypair. + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success, meaning that the keys are valid and match. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_check_pub_priv( + pub_: *const mbedtls_ecp_keypair, + prv: *const mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks a public-private RSA key pair. - /// - /// It checks each of the contexts, and makes sure they match. + /// \brief Calculate the public key from a private key in a key pair. /// - /// \param pub The initialized RSA context holding the public key. - /// \param prv The initialized RSA context holding the private key. + /// \param key A keypair structure. It must have a private key set. + /// If the public key is set, it will be overwritten. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pub_priv( - pub_: *const mbedtls_rsa_context, - prv: *const mbedtls_rsa_context, + /// \return \c 0 on success. The key pair object can be used for + /// operations that require the public key. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_keypair_calc_public( + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs an RSA public key operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// - /// \note This function does not handle message padding. + /// \brief Query the group that a key pair belongs to. /// - /// \note Make sure to set \p input[0] = 0 or ensure that - /// input is smaller than \p N. + /// \param key The key pair to query. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_public( - ctx: *mut mbedtls_rsa_context, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The group ID for the group registered in the key pair + /// object. + /// This is \c MBEDTLS_ECP_DP_NONE if no group has been set + /// in the key pair object. + pub fn mbedtls_ecp_keypair_get_group_id( + key: *const mbedtls_ecp_keypair, + ) -> mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function performs an RSA private key operation. - /// - /// \note Blinding is used if and only if a PRNG is provided. + /// \brief This function exports generic key-pair parameters. /// - /// \note If blinding is used, both the base of exponentiation - /// and the exponent are blinded, providing protection - /// against some side-channel attacks. + /// Each of the output parameters can be a null pointer + /// if you do not need that parameter. /// - /// \warning It is deprecated and a security risk to not provide - /// a PRNG here and thereby prevent the use of blinding. - /// Future versions of the library may enforce the presence - /// of a PRNG. + /// \note If the private key or the public key was not set in \p key, + /// the corresponding output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function, used for blinding. It is mandatory. - /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param key The key pair to export from. + /// \param grp Slot for exported ECP group. + /// It must either be null or point to an initialized ECP group. + /// \param d Slot for the exported secret value. + /// It must either be null or point to an initialized mpi. + /// \param Q Slot for the exported public value. + /// It must either be null or point to an initialized ECP point. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_private( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_export( + key: *const mbedtls_ecp_keypair, + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function adds the message padding, then performs an RSA - /// operation. - /// - /// It is the generic wrapper for performing a PKCS#1 encryption - /// operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG to use. It is used for padding generation - /// and it is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. May be - /// \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \brief The ECP checkup routine. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return \c 1 on failure. + pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The RSA context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_rsa_context { + ///< Reserved for internal purposes. + /// Do not set this field in application + /// code. Its meaning might change without + /// notice. + pub private_ver: ::core::ffi::c_int, + ///< The size of \p N in Bytes. + pub private_len: usize, + ///< The public modulus. + pub private_N: mbedtls_mpi, + ///< The public exponent. + pub private_E: mbedtls_mpi, + ///< The private exponent. + pub private_D: mbedtls_mpi, + ///< The first prime factor. + pub private_P: mbedtls_mpi, + ///< The second prime factor. + pub private_Q: mbedtls_mpi, + ///< D % (P - 1). + pub private_DP: mbedtls_mpi, + ///< D % (Q - 1). + pub private_DQ: mbedtls_mpi, + ///< 1 / (Q % P). + pub private_QP: mbedtls_mpi, + ///< cached R^2 mod N. + pub private_RN: mbedtls_mpi, + ///< cached R^2 mod P. + pub private_RP: mbedtls_mpi, + ///< cached R^2 mod Q. + pub private_RQ: mbedtls_mpi, + ///< The cached blinding value. + pub private_Vi: mbedtls_mpi, + ///< The cached un-blinding value. + pub private_Vf: mbedtls_mpi, + ///< Selects padding mode: + ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. + pub private_padding: ::core::ffi::c_int, + ///< Hash identifier of mbedtls_md_type_t type, + ///as specified in md.h for use in the MGF + ///mask generating function used in the + ///EME-OAEP and EMSA-PSS encodings. + pub private_hash_id: ::core::ffi::c_int, +} +impl Default for mbedtls_rsa_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 encryption operation - /// (RSAES-PKCS1-v1_5-ENCRYPT). + /// \brief This function initializes an RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. It is mandatory and used for - /// padding generation. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note This function initializes the padding and the hash + /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + /// information about those parameters. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The RSA context to initialize. This must not be \c NULL. + pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP encryption - /// operation (RSAES-OAEP-ENCRYPT). - /// - /// \note The output buffer must be as large as the size - /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \brief This function sets padding for an already initialized RSA + /// context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is needed for padding - /// generation and is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param ilen The length of the plaintext buffer \p input in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + /// encryption scheme and the RSASSA-PSS signature scheme. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs an RSA operation, then removes the - /// message padding. + /// \note The \p hash_id parameter is ignored when using + /// #MBEDTLS_RSA_PKCS_V15 padding. /// - /// It is the generic wrapper for performing a PKCS#1 decryption - /// operation. + /// \note The choice of padding mode is strictly enforced for private + /// key operations, since there might be security concerns in + /// mixing padding modes. For public key operations it is + /// a default value, which can be overridden by calling specific + /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + /// functions. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N (for example, - /// 128 Bytes if RSA-1024 is used) to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note The hash selected in \p hash_id is always used for OEAP + /// encryption. For PSS signatures, it is always used for + /// making signatures, but can be overridden for verifying them. + /// If set to #MBEDTLS_MD_NONE, it is always overridden. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \param ctx The initialized RSA context to be configured. + /// \param padding The padding mode to use. This must be either + /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is + /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + /// function but may be not suitable for some operations. + /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_decrypt( + /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + /// \p padding or \p hash_id is invalid. + pub fn mbedtls_rsa_set_padding( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + padding: ::core::ffi::c_int, + hash_id: mbedtls_md_type_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 decryption - /// operation (RSAES-PKCS1-v1_5-DECRYPT). + /// \brief This function retrieves padding mode of initialized + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for example, - /// 128 Bytes if RSA-1024 is used, to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \param ctx The initialized RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \return RSA padding mode. + pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function retrieves hash identifier of mbedtls_md_type_t + /// type. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context. + /// + /// \return Hash identifier of mbedtls_md_type_t type. + pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP decryption - /// operation (RSAES-OAEP-DECRYPT). + /// \brief This function imports a set of core parameters into an + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for - /// example, 128 Bytes if RSA-1024 is used, to be able to - /// hold an arbitrary decrypted message. If it is not - /// large enough to hold the decryption of the particular - /// ciphertext provided, the function returns - /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. + /// + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. + /// + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. + /// + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param E The public exponent. This may be \c NULL. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_decrypt( + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + N: *const mbedtls_mpi, + P: *const mbedtls_mpi, + Q: *const mbedtls_mpi, + D: *const mbedtls_mpi, + E: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a private RSA operation to sign - /// a message digest using PKCS#1. + /// \brief This function imports core RSA parameters, in raw big-endian + /// binary format, into an RSA context. /// - /// It is the generic wrapper for performing a PKCS#1 - /// signature. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_sign() for details on - /// \p md_alg and \p hash_id. + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is mandatory and - /// must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_sign( + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + /// \param E The public exponent. This may be \c NULL. + /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import_raw( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + N: *const ::core::ffi::c_uchar, + N_len: usize, + P: *const ::core::ffi::c_uchar, + P_len: usize, + Q: *const ::core::ffi::c_uchar, + Q_len: usize, + D: *const ::core::ffi::c_uchar, + D_len: usize, + E: *const ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 signature - /// operation (RSASSA-PKCS1-v1_5-SIGN). + /// \brief This function completes an RSA context from + /// a set of imported core parameters. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// To setup an RSA public key, precisely \c N and \c E + /// must have been imported. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// To setup an RSA private key, sufficient information must + /// be present for the other parameters to be derivable. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// The default implementation supports the following: + ///
          • Derive \c P, \c Q from \c N, \c D, \c E.
            • + ///
          • Derive \c N, \c D from \c P, \c Q, \c E.
          + /// Alternative implementations need not support these. /// - /// \note This function enforces that the provided salt length complies - /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 - /// step 3. The constraint is that the hash length plus the salt - /// length plus 2 bytes must be at most the key length. If this - /// constraint is not met, this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// If this function runs successfully, it guarantees that + /// the RSA context can be used for RSA operations without + /// the risk of failure or crash. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param saltlen The length of the salt that should be used. - /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use - /// the largest possible salt length up to the hash length, - /// which is the largest permitted by some standards including - /// FIPS 186-4 §5.5. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \warning This function need not perform consistency checks + /// for the imported parameters. In particular, parameters that + /// are not needed by the implementation might be silently + /// discarded and left unchecked. To check the consistency + /// of the key material, see mbedtls_rsa_check_privkey(). /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign_ext( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - saltlen: ::core::ffi::c_int, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context holding imported parameters. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + /// failed. + pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// \brief This function exports the core parameters of an RSA key. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \note This function always uses the maximum possible salt size, - /// up to the length of the payload hash. This choice of salt - /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 - /// v2.2) §9.1.1 step 3. Furthermore this function enforces a - /// minimum salt size which is the hash size minus 2 bytes. If - /// this minimum size is too large given the key size (the salt - /// size, plus the hash size, plus 2 bytes must be no more than - /// the key size in bytes), this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param N The MPI to hold the RSA modulus. + /// This may be \c NULL if this field need not be exported. + /// \param P The MPI to hold the first prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param Q The MPI to hold the second prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param D The MPI to hold the private exponent. + /// This may be \c NULL if this field need not be exported. + /// \param E The MPI to hold the public exponent. + /// This may be \c NULL if this field need not be exported. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export( + ctx: *const mbedtls_rsa_context, + N: *mut mbedtls_mpi, + P: *mut mbedtls_mpi, + Q: *mut mbedtls_mpi, + D: *mut mbedtls_mpi, + E: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a public RSA operation and checks - /// the message digest. - /// - /// This is the generic wrapper for performing a PKCS#1 - /// verification. + /// \brief This function exports core parameters of an RSA key + /// in raw big-endian binary format. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - /// \p hash_id. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \note The length parameters are ignored if the corresponding + /// buffer pointers are NULL. + /// + /// \param ctx The initialized RSA context. + /// \param N The Byte array to store the RSA modulus, + /// or \c NULL if this field need not be exported. + /// \param N_len The size of the buffer for the modulus. + /// \param P The Byte array to hold the first prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param P_len The size of the buffer for the first prime factor. + /// \param Q The Byte array to hold the second prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param Q_len The size of the buffer for the second prime factor. + /// \param D The Byte array to hold the private exponent, + /// or \c NULL if this field need not be exported. + /// \param D_len The size of the buffer for the private exponent. + /// \param E The Byte array to hold the public exponent, + /// or \c NULL if this field need not be exported. + /// \param E_len The size of the buffer for the public exponent. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export_raw( + ctx: *const mbedtls_rsa_context, + N: *mut ::core::ffi::c_uchar, + N_len: usize, + P: *mut ::core::ffi::c_uchar, + P_len: usize, + Q: *mut ::core::ffi::c_uchar, + Q_len: usize, + D: *mut ::core::ffi::c_uchar, + D_len: usize, + E: *mut ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 verification - /// operation (RSASSA-PKCS1-v1_5-VERIFY). + /// \brief This function exports CRT parameters of a private RSA key. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Alternative RSA implementations not using CRT-parameters + /// internally can implement this function based on + /// mbedtls_rsa_deduce_opt(). /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param DP The MPI to hold \c D modulo `P-1`, + /// or \c NULL if it need not be exported. + /// \param DQ The MPI to hold \c D modulo `Q-1`, + /// or \c NULL if it need not be exported. + /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, + /// or \c NULL if it need not be exported. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_export_crt( + ctx: *const mbedtls_rsa_context, + DP: *mut mbedtls_mpi, + DQ: *mut mbedtls_mpi, + QP: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). - /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. If the \c hash_id set in \p ctx by - /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg - /// parameter is used. + /// \brief This function retrieves the length of the RSA modulus in bits. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param ctx The initialized RSA context. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The length of the RSA modulus in bits. + pub fn mbedtls_rsa_get_bitlen(ctx: *const mbedtls_rsa_context) -> usize; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). + /// \brief This function retrieves the length of RSA modulus in Bytes. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \param ctx The initialized RSA context. /// - /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is - /// ignored. + /// \return The length of the RSA modulus in Bytes. + pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; +} +unsafe extern "C" { + /// \brief This function generates an RSA keypair. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param mgf1_hash_id The message digest algorithm used for the - /// verification operation and the mask generation - /// function (MGF1). For more details on the encoding - /// operation and the mask generation function, consult - /// RFC-3447: Public-Key Cryptography Standards - /// (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. - /// \param expected_salt_len The length of the salt used in padding. Use - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note mbedtls_rsa_init() must be called before this function, + /// to set up the RSA context. /// - /// \return \c 0 if the verify operation was successful. + /// \param ctx The initialized RSA context used to hold the key. + /// \param f_rng The RNG function to be used for key generation. + /// This is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. + /// This may be \c NULL if \p f_rng doesn't need a context. + /// \param nbits The size of the public key in bits. + /// \param exponent The public exponent to use. For example, \c 65537. + /// This must be odd and greater than \c 1. + /// + /// \return \c 0 on success. /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify_ext( + pub fn mbedtls_rsa_gen_key( ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - mgf1_hash_id: mbedtls_md_type_t, - expected_salt_len: ::core::ffi::c_int, - sig: *const ::core::ffi::c_uchar, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + nbits: ::core::ffi::c_uint, + exponent: ::core::ffi::c_int, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function copies the components of an RSA context. + /// \brief This function checks if a context contains at least an RSA + /// public key. /// - /// \param dst The destination context. This must be initialized. - /// \param src The source context. This must be initialized. + /// If the function runs successfully, it is guaranteed that + /// enough information is present to perform an RSA public key + /// operation using mbedtls_rsa_public(). + /// + /// \param ctx The initialized RSA context to check. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. - pub fn mbedtls_rsa_copy( - dst: *mut mbedtls_rsa_context, - src: *const mbedtls_rsa_context, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees the components of an RSA key. + /// \brief This function checks if a context contains an RSA private key + /// and perform basic consistency checks. /// - /// \param ctx The RSA context to free. May be \c NULL, in which case - /// this function is a no-op. If it is not \c NULL, it must - /// point to an initialized RSA context. - pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); + /// \note The consistency checks performed by this function not only + /// ensure that mbedtls_rsa_private() can be called successfully + /// on the given context, but that the various parameters are + /// mutually consistent with high probability, in the sense that + /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// + /// \warning This function should catch accidental misconfigurations + /// like swapping of parameters, but it cannot establish full + /// trust in neither the quality nor the consistency of the key + /// material that was used to setup the given RSA context: + ///
          • Consistency: Imported parameters that are irrelevant + /// for the implementation might be silently dropped. If dropped, + /// the current function does not have access to them, + /// and therefore cannot check them. See mbedtls_rsa_complete(). + /// If you want to check the consistency of the entire + /// content of a PKCS1-encoded RSA private key, for example, you + /// should use mbedtls_rsa_validate_params() before setting + /// up the RSA context. + /// Additionally, if the implementation performs empirical checks, + /// these checks substantiate but do not guarantee consistency.
            • + ///
          • Quality: This function is not expected to perform + /// extended quality assessments like checking that the prime + /// factors are safe. Additionally, it is the responsibility of the + /// user to ensure the trustworthiness of the source of his RSA + /// parameters, which goes beyond what is effectively checkable + /// by the library.
          + /// + /// \param ctx The initialized RSA context to check. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The RSA checkup routine. + /// \brief This function checks a public-private RSA key pair. + /// + /// It checks each of the contexts, and makes sure they match. + /// + /// \param pub The initialized RSA context holding the public key. + /// \param prv The initialized RSA context holding the private key. /// /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief The ECDSA context structure. -/// -/// \warning Performing multiple operations concurrently on the same -/// ECDSA context is not supported; objects of this type -/// should not be shared between multiple threads. -/// -/// \note pk_wrap module assumes that "ecdsa_context" is identical -/// to "ecp_keypair" (see for example structure -/// "mbedtls_eckey_info" where ECDSA sign/verify functions -/// are used also for EC key) -pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; -pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pub_priv( + pub_: *const mbedtls_rsa_context, + prv: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { - /// \brief This function checks whether a given group can be used - /// for ECDSA. + /// \brief This function performs an RSA public key operation. /// - /// \param gid The ECP group ID to check. + /// \param ctx The initialized RSA context to use. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 1 if the group can be used, \c 0 otherwise - pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; + /// \note This function does not handle message padding. + /// + /// \note Make sure to set \p input[0] = 0 or ensure that + /// input is smaller than \c N. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_public( + ctx: *mut mbedtls_rsa_context, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message. + /// \brief This function performs an RSA private key operation. /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_ext() is usually preferred. + /// \note Blinding is used if and only if a PRNG is provided. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated - /// as defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \note If blinding is used, both the base of exponentiation + /// and the exponent are blinded, providing protection + /// against some side-channel attacks. /// - /// \see ecp.h + /// \warning It is deprecated and a security risk to not provide + /// a PRNG here and thereby prevent the use of blinding. + /// Future versions of the library may enforce the presence + /// of a PRNG. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized. - /// \param buf The content to be signed. This is usually the hash of - /// the original data to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function, used for blinding. It is mandatory. + /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX - /// or \c MBEDTLS_MPI_XXX error code on failure. - pub fn mbedtls_ecdsa_sign( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_private( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, deterministic version. + /// \brief This function adds the message padding, then performs an RSA + /// operation. /// - /// For more information, see RFC-6979: Deterministic - /// Usage of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). + /// It is the generic wrapper for performing a PKCS#1 encryption + /// operation. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG to use. It is used for padding generation + /// and it is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. May be + /// \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \see ecp.h + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v1.5 encryption operation + /// (RSAES-PKCS1-v1_5-ENCRYPT). /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. It is mandatory and used for + /// padding generation. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_ext( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 OAEP encryption + /// operation (RSAES-OAEP-ENCRYPT). /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_restartable() is usually - /// preferred. + /// \note The output buffer must be as large as the size + /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \note This function is like \c mbedtls_ecdsa_sign() but - /// it can return early and restart according to the - /// limit set with \c mbedtls_ecp_set_max_ops() to - /// reduce blocking. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is needed for padding + /// generation and is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param ilen The length of the plaintext buffer \p input in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs an RSA operation, then removes the + /// message padding. /// - /// \see ecp.h + /// It is the generic wrapper for performing a PKCS#1 decryption + /// operation. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + /// mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + /// inherently dangerous function (CWE-242). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N (for example, + /// 128 Bytes if RSA-1024 is used) to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. - /// - /// \note This function is like \c - /// mbedtls_ecdsa_sign_det_ext() but it can return - /// early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 decryption + /// operation (RSAES-PKCS1-v1_5-DECRYPT). /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \warning This is an inherently dangerous function (CWE-242). Unless + /// it is used in a side channel free and safe way (eg. + /// implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + /// the calling code is vulnerable. /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for example, + /// 128 Bytes if RSA-1024 is used, to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message. - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \brief This function performs a PKCS#1 v2.1 OAEP decryption + /// operation (RSAES-OAEP-DECRYPT). /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for + /// example, 128 Bytes if RSA-1024 is used, to be able to + /// hold an arbitrary decrypted message. If it is not + /// large enough to hold the decryption of the particular + /// ciphertext provided, the function returns + /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message, in a restartable manner + /// \brief This function performs a private RSA operation to sign + /// a message digest using PKCS#1. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// It is the generic wrapper for performing a PKCS#1 + /// signature. /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify_restartable( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, serialized as defined in RFC-4492: - /// Elliptic Curve Cryptography (ECC) Cipher Suites for - /// Transport Layer Security (TLS). - /// - /// \warning It is not thread-safe to use the same context in - /// multiple threads. - /// - /// \note The deterministic version is used if - /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more - /// information, see RFC-6979: Deterministic Usage - /// of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. - /// - /// \see ecp.h + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_sign() for details on + /// \p md_alg and \p hash_id. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is used only for blinding and may be set to \c NULL, but - /// doing so is DEPRECATED. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is mandatory and + /// must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, in a restartable way. - /// - /// \see \c mbedtls_ecdsa_write_signature() - /// - /// \note This function is like \c mbedtls_ecdsa_write_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 signature + /// operation (RSASSA-PKCS1-v1_5-SIGN). /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is unused and may be set to \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \see ecp.h + /// \note This function enforces that the provided salt length complies + /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + /// step 3. The constraint is that the hash length plus the salt + /// length plus 2 bytes must be at most the key length. If this + /// constraint is not met, this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param saltlen The length of the salt that should be used. + /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + /// the largest possible salt length up to the hash length, + /// which is the largest permitted by some standards including + /// FIPS 186-4 §5.5. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign_ext( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, - sig: *const ::core::ffi::c_uchar, - slen: usize, + saltlen: ::core::ffi::c_int, + sig: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature, - /// in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \see \c mbedtls_ecdsa_read_signature() + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \note This function is like \c mbedtls_ecdsa_read_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function always uses the maximum possible salt size, + /// up to the length of the payload hash. This choice of salt + /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + /// v2.2) §9.1.1 step 3. Furthermore this function enforces a + /// minimum salt size which is the hash size minus 2 bytes. If + /// this minimum size is too large given the key size (the salt + /// size, plus the hash size, plus 2 bytes must be no more than + /// the key size in bytes), this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a public RSA operation and checks + /// the message digest. + /// + /// This is the generic wrapper for performing a PKCS#1 + /// verification. + /// + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + /// \c hash_id. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *const ::core::ffi::c_uchar, - slen: usize, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an ECDSA keypair on the given curve. + /// \brief This function performs a PKCS#1 v1.5 verification + /// operation (RSASSA-PKCS1-v1_5-VERIFY). /// - /// \see ecp.h + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \param ctx The ECDSA context to store the keypair in. - /// This must be initialized. - /// \param gid The elliptic curve to use. One of the various - /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_genkey( - ctx: *mut mbedtls_ecdsa_context, - gid: mbedtls_ecp_group_id, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. If the \c hash_id set in \p ctx by + /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + /// parameter is used. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets up an ECDSA context from an EC key pair. + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param ctx The ECDSA context to setup. This must be initialized. - /// \param key The EC key to use. This must be initialized and hold - /// a private-public key pair or a public key. In the former - /// case, the ECDSA context may be used for signature creation - /// and verification after this call. In the latter case, it - /// may be used for signature verification. + /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + /// ignored. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_from_keypair( - ctx: *mut mbedtls_ecdsa_context, - key: *const mbedtls_ecp_keypair, + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param mgf1_hash_id The message digest algorithm used for the + /// verification operation and the mask generation + /// function (MGF1). For more details on the encoding + /// operation and the mask generation function, consult + /// RFC-3447: Public-Key Cryptography Standards + /// (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. + /// \param expected_salt_len The length of the salt used in padding. Use + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify_ext( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + mgf1_hash_id: mbedtls_md_type_t, + expected_salt_len: ::core::ffi::c_int, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECDSA context. + /// \brief This function copies the components of an RSA context. /// - /// \param ctx The ECDSA context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); + /// \param dst The destination context. This must be initialized. + /// \param src The source context. This must be initialized. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + pub fn mbedtls_rsa_copy( + dst: *mut mbedtls_rsa_context, + src: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees an ECDSA context. + /// \brief This function frees the components of an RSA key. /// - /// \param ctx The ECDSA context to free. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must be initialized. - pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); + /// \param ctx The RSA context to free. May be \c NULL, in which case + /// this function is a no-op. If it is not \c NULL, it must + /// point to an initialized RSA context. + pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); } -pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; -pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; -/// \brief Public key types -pub type mbedtls_pk_type_t = ::core::ffi::c_uint; -/// \brief Options for RSASSA-PSS signature verification. -/// See \c mbedtls_rsa_rsassa_pss_verify_ext() -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_rsassa_pss_options { - /// The digest to use for MGF1 in PSS. +unsafe extern "C" { + /// \brief The RSA checkup routine. /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is - /// disabled, this must be equal to the \c md_alg argument passed - /// to mbedtls_pk_verify_ext(). In a future version of the library, - /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is - /// enabled regardless of the status of #MBEDTLS_RSA_C. - pub mgf1_hash_id: mbedtls_md_type_t, - /// The expected length of the salt, in bytes. This may be - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only - /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be - /// ignored (allowing any salt length). - pub expected_salt_len: ::core::ffi::c_int, -} -impl Default for mbedtls_pk_rsassa_pss_options { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; -/// \brief Types for interfacing with the debug module -pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; -/// \brief Item to send to the debug module -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_debug_item { - pub private_type: mbedtls_pk_debug_type, - pub private_name: *const ::core::ffi::c_char, - pub private_value: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_debug_item { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_info_t { - _unused: [u8; 0], -} -/// \brief Public key container -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_context { - ///< Public key information - pub private_pk_info: *const mbedtls_pk_info_t, - ///< Underlying public key context - pub private_pk_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; -/// \brief Types for RSA-alt abstraction -pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_key_len_func = - ::core::option::Option usize>; +/// \brief The ECDSA context structure. +/// +/// \warning Performing multiple operations concurrently on the same +/// ECDSA context is not supported; objects of this type +/// should not be shared between multiple threads. +/// +/// \note pk_wrap module assumes that "ecdsa_context" is identical +/// to "ecp_keypair" (see for example structure +/// "mbedtls_eckey_info" where ECDSA sign/verify functions +/// are used also for EC key) +pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; +pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; unsafe extern "C" { - /// \brief Return information associated with the given PK type - /// - /// \param pk_type PK type to search for. + /// \brief This function checks whether a given group can be used + /// for ECDSA. /// - /// \return The PK info associated with the type or NULL if not found. - pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; -} -unsafe extern "C" { - /// \brief Initialize a #mbedtls_pk_context (as NONE). + /// \param gid The ECP group ID to check. /// - /// \param ctx The context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); + /// \return \c 1 if the group can be used, \c 0 otherwise + pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Free the components of a #mbedtls_pk_context. + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message. /// - /// \param ctx The context to clear. It must have been initialized. - /// If this is \c NULL, this function does nothing. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_ext() is usually preferred. /// - /// \note For contexts that have been set up with - /// mbedtls_pk_setup_opaque(), this does not free the underlying - /// PSA key and you still need to call psa_destroy_key() - /// independently if you want to destroy that key. - pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); -} -unsafe extern "C" { - /// \brief Initialize a PK context with the information given - /// and allocates the type-specific PK subcontext. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated + /// as defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param info Information to use + /// \see ecp.h /// - /// \return 0 on success, - /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, - /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized. + /// \param buf The content to be signed. This is usually the hash of + /// the original data to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function, used both to generate the ECDSA nonce + /// and for blinding. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. /// - /// \note For contexts holding an RSA-alt key, use - /// \c mbedtls_pk_setup_rsa_alt() instead. - pub fn mbedtls_pk_setup( - ctx: *mut mbedtls_pk_context, - info: *const mbedtls_pk_info_t, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX + /// or \c MBEDTLS_MPI_XXX error code on failure. + pub fn mbedtls_ecdsa_sign( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Initialize an RSA-alt context + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, deterministic version. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param key RSA key pointer - /// \param decrypt_func Decryption function - /// \param sign_func Signing function - /// \param key_len_func Function returning key length in bytes + /// For more information, see RFC-6979: Deterministic + /// Usage of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the - /// context wasn't already initialized as RSA_ALT. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. - pub fn mbedtls_pk_setup_rsa_alt( - ctx: *mut mbedtls_pk_context, - key: *mut ::core::ffi::c_void, - decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, - sign_func: mbedtls_pk_rsa_alt_sign_func, - key_len_func: mbedtls_pk_rsa_alt_key_len_func, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Get the size in bits of the underlying key + /// \see ecp.h /// - /// \param ctx The context to query. It must have been initialized. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + /// may be \c NULL if \p f_rng_blind doesn't need a context + /// parameter. /// - /// \return Key size in bits, or 0 on error - pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_ext( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + md_alg: mbedtls_md_type_t, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Tell if a context can do the operation given by type + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \param ctx The context to query. It must have been initialized. - /// \param type The desired type. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_restartable() is usually + /// preferred. /// - /// \return 1 if the context can do operations on the given type. - /// \return 0 if the context cannot do the operations on the given - /// type. This is always the case for a context that has - /// been initialized but not set up, or that has been - /// cleared with mbedtls_pk_free(). - pub fn mbedtls_pk_can_do( - ctx: *const mbedtls_pk_context, - type_: mbedtls_pk_type_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Verify signature (including padding if relevant). + /// \note This function is like \c mbedtls_ecdsa_sign() but + /// it can return early and restart according to the + /// limit set with \c mbedtls_ecp_set_max_ops() to + /// reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used. - /// This can be #MBEDTLS_MD_NONE if the signature algorithm - /// does not rely on a hash algorithm (non-deterministic - /// ECDSA, RSA PKCS#1 v1.5). - /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then - /// \p hash is the DigestInfo structure used by RFC 8017 - /// §9.2 steps 3–6. If \p md_alg is a valid hash - /// algorithm then \p hash is the digest itself, and this - /// function calculates the DigestInfo encoding internally. - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \see ecp.h /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) - /// to verify RSASSA_PSS signatures. - pub fn mbedtls_pk_verify( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_verify() + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_verify(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_verify(). + /// \note This function is like \c + /// mbedtls_ecdsa_sign_det_ext() but it can return + /// early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length - /// \param rs_ctx Restart context (NULL to disable restart) + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return See \c mbedtls_pk_verify(), or - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_verify_restartable( - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + /// \c NULL if \p f_rng_blind doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, - rs_ctx: *mut mbedtls_pk_restart_ctx, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify signature, with options. - /// (Includes verification of the padding depending on type.) - /// - /// \param type Signature type (inc. possible padding type) to verify - /// \param options Pointer to type-specific options, or NULL - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be - /// used for this type of signatures, - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note If hash_len is 0, then the length associated with md_alg - /// is used instead, or an error returned if it is invalid. + /// \see ecp.h /// - /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. /// - /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point - /// to a mbedtls_pk_rsassa_pss_options structure, - /// otherwise it must be NULL. Note that if - /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not - /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. - pub fn mbedtls_pk_verify_ext( - type_: mbedtls_pk_type_t, - options: *const ::core::ffi::c_void, - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature, including padding if relevant. - /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message, in a restartable manner /// - /// \return 0 on success, or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// There is no interface in the PK module to make RSASSA-PSS - /// signatures yet. + /// \see ecp.h /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify_restartable( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature given a signature type. + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, serialized as defined in RFC-4492: + /// Elliptic Curve Cryptography (ECC) Cipher Suites for + /// Transport Layer Security (TLS). /// - /// \param pk_type Signature type. - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \warning It is not thread-safe to use the same context in + /// multiple threads. /// - /// \return 0 on success, or a specific error code. + /// \note The deterministic version is used if + /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + /// information, see RFC-6979: Deterministic Usage + /// of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, - /// see #PSA_ALG_RSA_PSS for a description of PSS options used. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign_ext( - pk_type: mbedtls_pk_type_t, - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_sign() + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_sign(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_sign(). + /// \see \c mbedtls_ecdsa_write_signature() /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. + /// \note This function is like \c mbedtls_ecdsa_write_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// \param rs_ctx Restart context (NULL to disable restart) + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return See \c mbedtls_pk_sign(). + /// \return \c 0 on success. /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_sign_restartable( - ctx: *mut mbedtls_pk_context, + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_pk_restart_ctx, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Decrypt message (including padding if relevant). + /// \brief This function reads and verifies an ECDSA signature. /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param input Input to decrypt - /// \param ilen Input size - /// \param output Decrypted output - /// \param olen Decrypted message length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \see ecp.h /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_decrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Encrypt message (including padding if relevant). - /// - /// \param ctx The PK context to use. It must have been set up. - /// \param input Message to encrypt - /// \param ilen Message size - /// \param output Encrypted output - /// \param olen Encrypted output length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function reads and verifies an ECDSA signature, + /// in a restartable way. /// - /// \note \p f_rng is used for padding generation. + /// \see \c mbedtls_ecdsa_read_signature() /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \note This function is like \c mbedtls_ecdsa_read_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_encrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if a public-private pair of keys matches. - /// - /// \param pub Context holding a public key. - /// \param prv Context holding a private (and public) key. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// - /// \return \c 0 on success (keys were checked and match each other). - /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not - /// be checked - in that case they may or may not match. - /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. - /// \return Another non-zero value if the keys do not match. - pub fn mbedtls_pk_check_pair( - pub_: *const mbedtls_pk_context, - prv: *const mbedtls_pk_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Export debug information - /// - /// \param ctx The PK context to use. It must have been initialized. - /// \param items Place to write debug items + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA - pub fn mbedtls_pk_debug( - ctx: *const mbedtls_pk_context, - items: *mut mbedtls_pk_debug_item, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Access the type name - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type name on success, or "invalid PK" - pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; -} -unsafe extern "C" { - /// \brief Get the key type - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type on success. - /// \return #MBEDTLS_PK_NONE for a context that has not been set up. - pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a private key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// \param pwd Optional password for decryption. - /// Pass \c NULL if expecting a non-encrypted key. - /// Pass a string of \p pwdlen bytes if expecting an encrypted - /// key; a non-encrypted key will also be accepted. - /// The empty password is not supported. - /// \param pwdlen Size of the password in bytes. - /// Ignored if \p pwd is \c NULL. - /// \param f_rng RNG function, must not be \c NULL. Used for blinding. - /// \param p_rng RNG parameter + /// \brief This function generates an ECDSA keypair on the given curve. /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to store the keypair in. + /// This must be initialized. + /// \param gid The elliptic curve to use. One of the various + /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, - pwd: *const ::core::ffi::c_uchar, - pwdlen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_genkey( + ctx: *mut mbedtls_ecdsa_context, + gid: mbedtls_ecp_group_id, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a public key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \brief This function sets up an ECDSA context from an EC key pair. /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to setup. This must be initialized. + /// \param key The EC key to use. This must be initialized and hold + /// a private-public key pair or a public key. In the former + /// case, the ECDSA context may be used for signature creation + /// and verification after this call. In the latter case, it + /// may be used for signature verification. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_public_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_from_keypair( + ctx: *mut mbedtls_ecdsa_context, + key: *const mbedtls_ecp_keypair, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function initializes an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_key_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); } unsafe extern "C" { - /// \brief Write a public key to a SubjectPublicKeyInfo DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function frees an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_pubkey_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to free. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must be initialized. + pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); } -unsafe extern "C" { - /// \brief Write a public key to a PEM string - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_pubkey_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 PEM string - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_key_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Parse a SubjectPublicKeyInfo DER structure - /// - /// \param p the position in the ASN.1 data - /// \param end end of the buffer - /// \param pk The PK context to fill. It must have been initialized - /// but not set up. - /// - /// \return 0 if successful, or a specific PK error code - pub fn mbedtls_pk_parse_subpubkey( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - pk: *mut mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a subjectPublicKey to ASN.1 data - /// Note: function works backwards in data buffer - /// - /// \param p reference to current position pointer - /// \param start start of the buffer (for bounds-checking) - /// \param key PK context which must contain a valid public or private key. - /// - /// \return the length written or a negative error code - pub fn mbedtls_pk_write_pubkey( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - key: *const mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = - 3; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: - mbedtls_key_exchange_type_t = 4; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = - 8; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = - 9; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = - 10; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = - 11; -pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; -/// \brief This structure is used for storing ciphersuite information -/// -/// \note members are defined using integral types instead of enums -/// in order to pack structure and reduce memory usage by internal -/// \c ciphersuite_definitions[] -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ssl_ciphersuite_t { - pub private_id: ::core::ffi::c_int, - pub private_name: *const ::core::ffi::c_char, - pub private_cipher: u8, - pub private_mac: u8, - pub private_key_exchange: u8, - pub private_flags: u8, - pub private_min_tls_version: u16, - pub private_max_tls_version: u16, -} -impl Default for mbedtls_ssl_ciphersuite_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_string( - ciphersuite_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_id( - ciphersuite_id: ::core::ffi::c_int, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_pk_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_ec( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_psk( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> usize; -} -/// The type of the context passed to mbedtls_psa_external_get_random(). -/// -/// Mbed TLS initializes the context to all-bits-zero before calling -/// mbedtls_psa_external_get_random() for the first time. -/// -/// The definition of this type in the Mbed TLS source code is for -/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() -/// are expected to replace it with a custom definition. -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_external_random_context_t { - pub private_opaque: [usize; 2usize], +/// The type of the context passed to mbedtls_psa_external_get_random(). +/// +/// Mbed TLS initializes the context to all-bits-zero before calling +/// mbedtls_psa_external_get_random() for the first time. +/// +/// The definition of this type in the Mbed TLS source code is for +/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() +/// are expected to replace it with a custom definition. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_external_random_context_t { + pub private_opaque: [usize; 2usize], } pub type psa_status_t = i32; /// \brief Encoding of a key type. @@ -10577,6478 +10445,7672 @@ pub type psa_key_attributes_t = psa_key_attributes_s; /// Values of this type are generally constructed by macros called /// `PSA_KEY_DERIVATION_INPUT_xxx`. pub type psa_key_derivation_step_t = u16; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following field: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// +/// Functions that take such a structure as input also take an associated +/// input buffer \c custom_data of length \c custom_data_length. +/// +/// The interpretation of this structure and the associated \c custom_data +/// parameter depend on the type of the created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c custom_data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_custom_key_parameters_t = psa_custom_key_parameters_s; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following fields: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// - \c data: a flexible array of bytes. +/// +/// The interpretation of this structure depend on the type of the +/// created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty or if the custom production parameters are omitted +/// altogether, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_key_production_parameters_t = psa_key_production_parameters_s; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; +/// For encrypt-decrypt functions, whether the operation is an encryption +/// or a decryption. +pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; +/// \brief MD5 context structure +/// +/// \warning MD5 is considered a weak message digest and its use +/// constitutes a security risk. We recommend considering +/// stronger message digests instead. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md5_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 4usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_md5_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { - /// \brief Library initialization. - /// - /// Applications must call this function before calling any other - /// function in this module. - /// - /// Applications may call this function more than once. Once a call - /// succeeds, subsequent calls are guaranteed to succeed. + /// \brief Initialize MD5 context /// - /// If the application calls other functions before calling psa_crypto_init(), - /// the behavior is undefined. Implementations are encouraged to either perform - /// the operation as if the library had been initialized or to return - /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, - /// implementations should not return a success status if the lack of - /// initialization may have security implications, for example due to improper - /// seeding of the random number generator. + /// \param ctx MD5 context to be initialized /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - pub fn psa_crypto_init() -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Retrieve the attributes of a key. - /// - /// This function first resets the attribute structure as with - /// psa_reset_key_attributes(). It then copies the attributes of - /// the given key into the given attribute structure. - /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \brief Clear MD5 context /// - /// \param[in] key Identifier of the key to query. - /// \param[in,out] attributes On success, the attributes of the key. - /// On failure, equivalent to a - /// freshly-initialized structure. + /// \param ctx MD5 context to be cleared /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_get_key_attributes( - key: mbedtls_svc_key_id_t, - attributes: *mut psa_key_attributes_t, - ) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Reset a key attribute structure to a freshly initialized state. - /// - /// You must initialize the attribute structure as described in the - /// documentation of the type #psa_key_attributes_t before calling this - /// function. Once the structure has been initialized, you may call this - /// function at any time. + /// \brief Clone (the state of) an MD5 context /// - /// This function frees any auxiliary resources that the structure - /// may contain. + /// \param dst The destination context + /// \param src The context to be cloned /// - /// \param[in,out] attributes The attribute structure to reset. - pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); } unsafe extern "C" { - /// Remove non-essential copies of key material from memory. + /// \brief MD5 context setup /// - /// If the key identifier designates a volatile key, this functions does not do - /// anything and returns successfully. - /// - /// If the key identifier designates a persistent key, then this function will - /// free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and the key can still be used. + /// \param ctx context to be initialized /// - /// \param key Identifier of the key to purge. + /// \return 0 if successful /// - /// \retval #PSA_SUCCESS - /// The key material will have been removed from memory if it is not - /// currently required. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid key identifier. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Make a copy of a key. + /// \brief MD5 process buffer /// - /// Copy key material from one location to another. + /// \param ctx MD5 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// This function is primarily useful to copy a key from one location - /// to another, since it populates a key using the material from - /// another key which may have a different lifetime. + /// \return 0 if successful /// - /// This function may be used to share a key with a different party, - /// subject to implementation-defined restrictions on key sharing. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_update( + ctx: *mut mbedtls_md5_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 final digest /// - /// The policy on the source key must have the usage flag - /// #PSA_KEY_USAGE_COPY set. - /// This flag is sufficient to permit the copy if the key has the lifetime - /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. - /// Some secure elements do not provide a way to copy a key without - /// making it extractable from the secure element. If a key is located - /// in such a secure element, then the key must have both usage flags - /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make - /// a copy of the key outside the secure element. + /// \param ctx MD5 context + /// \param output MD5 checksum result /// - /// The resulting key may only be used in a way that conforms to - /// both the policy of the original key and the policy specified in - /// the \p attributes parameter: - /// - The usage flags on the resulting key are the bitwise-and of the - /// usage flags on the source policy and the usage flags in \p attributes. - /// - If both allow the same algorithm or wildcard-based - /// algorithm policy, the resulting key has the same algorithm policy. - /// - If either of the policies allows an algorithm and the other policy - /// allows a wildcard-based algorithm policy that includes this algorithm, - /// the resulting key allows the same algorithm. - /// - If the policies do not allow any algorithm in common, this function - /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// \return 0 if successful /// - /// The effect of this function on implementation-defined attributes is - /// implementation-defined. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_finish( + ctx: *mut mbedtls_md5_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 process data block (internal use only) /// - /// \param source_key The key to copy. It must allow the usage - /// #PSA_KEY_USAGE_COPY. If a private or secret key is - /// being copied outside of a secure element it must - /// also allow #PSA_KEY_USAGE_EXPORT. - /// \param[in] attributes The attributes for the new key. - /// They are used as follows: - /// - The key type and size may be 0. If either is - /// nonzero, it must match the corresponding - /// attribute of the source key. - /// - The key location (the lifetime and, for - /// persistent keys, the key identifier) is - /// used directly. - /// - The policy constraints (usage flags and - /// algorithm policy) are combined from - /// the source key and \p attributes so that - /// both sets of restrictions apply, as - /// described in the documentation of this function. - /// \param[out] target_key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param ctx MD5 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p source_key is invalid. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The lifetime or identifier in \p attributes are invalid, or - /// the policy constraints on the source and specified in - /// \p attributes are incompatible, or - /// \p attributes specifies a key type or key size - /// which does not match the attributes of the source key. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or - /// the source key is not exportable and its lifetime does not - /// allow copying it to the target's lifetime. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_copy_key( - source_key: mbedtls_svc_key_id_t, - attributes: *const psa_key_attributes_t, - target_key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + /// + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_internal_md5_process( + ctx: *mut mbedtls_md5_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Destroy a key. + /// \brief Output = MD5( input buffer ) /// - /// This function destroys a key from both volatile - /// memory and, if applicable, non-volatile storage. Implementations shall - /// make a best effort to ensure that the key material cannot be recovered. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output MD5 checksum result /// - /// This function also erases any metadata such as policies and frees - /// resources associated with the key. + /// \return 0 if successful /// - /// If a key is currently in use in a multipart operation, then destroying the - /// key will cause the multipart operation to fail. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \param key Identifier of the key to erase. If this is \c 0, do nothing and - /// return #PSA_SUCCESS. + /// \return 0 if successful, or 1 if the test failed /// - /// \retval #PSA_SUCCESS - /// \p key was a valid identifier and the key material that it - /// referred to has been erased. Alternatively, \p key is \c 0. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key cannot be erased because it is - /// read-only, either due to a policy or due to physical restrictions. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p key is not a valid identifier nor \c 0. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE - /// There was a failure in communication with the cryptoprocessor. - /// The key material may still be present in the cryptoprocessor. - /// \retval #PSA_ERROR_DATA_INVALID - /// This error is typically a result of either storage corruption on a - /// cleartext storage backend, or an attempt to read data that was - /// written by an incompatible version of the library. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The storage is corrupted. Implementations shall make a best effort - /// to erase key material even in this stage, however applications - /// should be aware that it may be impossible to guarantee that the - /// key material is not recoverable in such cases. - /// \retval #PSA_ERROR_CORRUPTION_DETECTED - /// An unexpected condition which is not a storage corruption or - /// a communication failure occurred. The cryptoprocessor may have - /// been compromised. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief RIPEMD-160 context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ripemd160_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 5usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_ripemd160_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief Import a key in binary format. + /// \brief Initialize RIPEMD-160 context /// - /// This function supports any output from psa_export_key(). Refer to the - /// documentation of psa_export_public_key() for the format of public keys - /// and to the documentation of psa_export_key() for the format for - /// other key types. + /// \param ctx RIPEMD-160 context to be initialized + pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clear RIPEMD-160 context /// - /// The key data determines the key size. The attributes may optionally - /// specify a key size; in this case it must match the size determined - /// from the key data. A key size of 0 in \p attributes indicates that - /// the key size is solely determined by the key data. + /// \param ctx RIPEMD-160 context to be cleared + pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clone (the state of) a RIPEMD-160 context /// - /// Implementations must reject an attempt to import a key of size 0. + /// \param dst The destination context + /// \param src The context to be cloned + pub fn mbedtls_ripemd160_clone( + dst: *mut mbedtls_ripemd160_context, + src: *const mbedtls_ripemd160_context, + ); +} +unsafe extern "C" { + /// \brief RIPEMD-160 context setup /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. - /// - /// \param[in] attributes The attributes for the new key. - /// The key size is always determined from the - /// \p data buffer. - /// If the key size in \p attributes is nonzero, - /// it must be equal to the size from \p data. - /// \param[out] key On success, an identifier to the newly created key. - /// For persistent keys, this is the key identifier - /// defined in \p attributes. - /// \c 0 on failure. - /// \param[in] data Buffer containing the key data. The content of this - /// buffer is interpreted according to the type declared - /// in \p attributes. - /// All implementations must support at least the format - /// described in the documentation - /// of psa_export_key() or psa_export_public_key() for - /// the chosen type. Implementations may allow other - /// formats, but should be conservative: implementations - /// should err on the side of rejecting content if it - /// may be erroneous (e.g. wrong type or truncated data). - /// \param data_length Size of the \p data buffer in bytes. + /// \param ctx context to be initialized /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular persistent location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key attributes, as a whole, are invalid, or - /// the key data is not correctly formatted, or - /// the size in \p attributes is nonzero and does not match the size - /// of the key data. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_import_key( - attributes: *const psa_key_attributes_t, - data: *const u8, - data_length: usize, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a key in binary format. - /// - /// The output of this function can be passed to psa_import_key() to - /// create an equivalent object. + /// \brief RIPEMD-160 process buffer /// - /// If the implementation of psa_import_key() supports other formats - /// beyond the format specified here, the output from psa_export_key() - /// must use the representation specified here, not the original - /// representation. + /// \param ctx RIPEMD-160 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// For standard key types, the output format is as follows: + /// \return 0 if successful + pub fn mbedtls_ripemd160_update( + ctx: *mut mbedtls_ripemd160_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 final digest /// - /// - For symmetric keys (including MAC keys), the format is the - /// raw bytes of the key. - /// - For DES, the key data consists of 8 bytes. The parity bits must be - /// correct. - /// - For Triple-DES, the format is the concatenation of the - /// two or three DES keys. - /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format - /// is the non-encrypted DER encoding of the representation defined by - /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. - /// ``` - /// RSAPrivateKey ::= SEQUENCE { - /// version INTEGER, -- must be 0 - /// modulus INTEGER, -- n - /// publicExponent INTEGER, -- e - /// privateExponent INTEGER, -- d - /// prime1 INTEGER, -- p - /// prime2 INTEGER, -- q - /// exponent1 INTEGER, -- d mod (p-1) - /// exponent2 INTEGER, -- d mod (q-1) - /// coefficient INTEGER, -- (inverse of q) mod p - /// } - /// ``` - /// - For elliptic curve key pairs (key types for which - /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is - /// a representation of the private value as a `ceiling(m/8)`-byte string - /// where `m` is the bit size associated with the curve, i.e. the bit size - /// of the order of the curve's coordinate field. This byte string is - /// in little-endian order for Montgomery curves (curve types - /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass - /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` - /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). - /// For Weierstrass curves, this is the content of the `privateKey` field of - /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, - /// the format is defined by RFC 7748, and output is masked according to §5. - /// For twisted Edwards curves, the private key is as defined by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For Diffie-Hellman key exchange key pairs (key types for which - /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the - /// format is the representation of the private key `x` as a big-endian byte - /// string. The length of the byte string is the private key size in bytes - /// (leading zeroes are not stripped). - /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is - /// true), the format is the same as for psa_export_public_key(). + /// \param ctx RIPEMD-160 context + /// \param output RIPEMD-160 checksum result /// - /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// \return 0 if successful + pub fn mbedtls_ripemd160_finish( + ctx: *mut mbedtls_ripemd160_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 process data block (internal use only) /// - /// \param key Identifier of the key to export. It must allow the - /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public - /// key. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. + /// \param ctx RIPEMD-160 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_internal_ripemd160_process( + ctx: *mut mbedtls_ripemd160_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a public key or the public part of a key pair in binary format. + /// \brief Output = RIPEMD-160( input buffer ) /// - /// The output of this function can be passed to psa_import_key() to - /// create an object that is equivalent to the public key. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output RIPEMD-160 checksum result /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. + /// \return 0 if successful + pub fn mbedtls_ripemd160( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// For standard key types, the output format is as follows: - /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of - /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. - /// ``` - /// RSAPublicKey ::= SEQUENCE { - /// modulus INTEGER, -- n - /// publicExponent INTEGER } -- e - /// ``` - /// - For elliptic curve keys on a twisted Edwards curve (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY - /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined - /// by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For other elliptic curve public keys (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed - /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. - /// Let `m` be the bit size associated with the curve, i.e. the bit size of - /// `q` for a curve over `F_q`. The representation consists of: - /// - The byte 0x04; - /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; - /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. - /// - For Diffie-Hellman key exchange public keys (key types for which - /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), - /// the format is the representation of the public key `y = g^x mod p` as a - /// big-endian byte string. The length of the byte string is the length of the - /// base prime `p` in bytes. + /// \return 0 if successful, or 1 if the test failed + pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha1_context { + pub work_area: [::core::ffi::c_uchar; 208usize], +} +impl Default for mbedtls_sha1_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-1 context. /// - /// Exporting a public key object or the public part of a key pair is - /// always permitted, regardless of the key's usage flags. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param key Identifier of the key to export. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key is neither a public key nor a key pair. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_public_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message. - /// - /// \note To verify the hash of a message against an - /// expected value, use psa_hash_compare() instead. + /// \brief This function clears a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\p alg). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p hash_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compute( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it is + /// not \c NULL, it must point to an initialized + /// SHA-1 context. + pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message and compare it with a - /// reference value. + /// \brief This function clones the state of a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p input_length or \p hash_length do not match the hash size for \p alg - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compare( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \param dst The SHA-1 context to clone to. This must be initialized. + /// \param src The SHA-1 context to clone from. This must be initialized. + pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); } -/// The type of the state data structure for multipart hash operations. -/// -/// Before calling any function on a hash operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_hash_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_hash_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, -/// for example: -/// \code -/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_hash_operation_init() -/// to the structure, for example: -/// \code -/// psa_hash_operation_t operation; -/// operation = psa_hash_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_hash_operation_t = psa_hash_operation_s; unsafe extern "C" { - /// Set up a multipart hash operation. - /// - /// The sequence of operations to calculate a hash (message digest) - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. - /// -# Call psa_hash_setup() to specify the algorithm. - /// -# Call psa_hash_update() zero, one or more times, passing a fragment - /// of the message each time. The hash that is calculated is the hash - /// of the concatenation of these messages in order. - /// -# To calculate the hash, call psa_hash_finish(). - /// To compare the hash with an expected value, call psa_hash_verify(). - /// - /// If an error occurs at any step after a call to psa_hash_setup(), the - /// operation will need to be reset by a call to psa_hash_abort(). The - /// application may call psa_hash_abort() at any time after the operation - /// has been initialized. + /// \brief This function starts a SHA-1 checksum calculation. /// - /// After a successful call to psa_hash_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_hash_finish() or psa_hash_verify(). - /// - A call to psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_hash_operation_t and not yet in use. - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param ctx The SHA-1 context to initialize. This must be initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a hash algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_setup( - operation: *mut psa_hash_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart hash operation. - /// - /// The application must call psa_hash_setup() before calling this function. + /// \brief This function feeds an input buffer into an ongoing SHA-1 + /// checksum calculation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] input Buffer containing the message fragment to hash. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-1 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_update( - operation: *mut psa_hash_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_update( + ctx: *mut mbedtls_sha1_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message. + /// \brief This function finishes the SHA-1 operation, and writes + /// the result to the output buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \param ctx The SHA-1 context to use. This must be initialized and + /// have a hash operation started. + /// \param output The SHA-1 checksum result. This must be a writable + /// buffer of length \c 20 Bytes. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the hash. Call psa_hash_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// hash values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the hashed data which could allow an attacker to guess - /// a valid hash and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_finish( + ctx: *mut mbedtls_sha1_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief SHA-1 process data block (internal use only). /// - /// \param[in,out] operation Active hash operation. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\c alg) where \c alg is the - /// hash algorithm that is calculated. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p hash buffer is too small. You can determine a - /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) - /// where \c alg is the hash algorithm that is calculated. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_finish( - operation: *mut psa_hash_operation_t, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to use. This must be initialized. + /// \param data The data block being processed. This must be a + /// readable buffer of length \c 64 Bytes. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha1_process( + ctx: *mut mbedtls_sha1_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-1 checksum of a buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). It then - /// compares the calculated hash with the expected hash passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// The SHA-1 result is calculated as + /// output = SHA-1(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual hash and the expected hash is performed - /// in constant time. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. + /// \param output The SHA-1 checksum result. + /// This must be a writable buffer of length \c 20 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_verify( - operation: *mut psa_hash_operation_t, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a hash operation. + /// \brief The SHA-1 checkup routine. /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_hash_setup() again. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_hash_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha256_context { + pub work_area: [::core::ffi::c_uchar; 208usize], + pub is224: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha256_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-256 context. /// - /// In particular, calling psa_hash_abort() after the operation has been - /// terminated by a call to psa_hash_abort(), psa_hash_finish() or - /// psa_hash_verify() is safe and has no effect. + /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-256 context. /// - /// \param[in,out] operation Initialized hash operation. + /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-256 context. + pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-256 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha256_clone( + dst: *mut mbedtls_sha256_context, + src: *const mbedtls_sha256_context, + ); } unsafe extern "C" { - /// Clone a hash operation. + /// \brief This function starts a SHA-224 or SHA-256 checksum + /// calculation. /// - /// This function copies the state of an ongoing hash operation to - /// a new operation object. In other words, this function is equivalent - /// to calling psa_hash_setup() on \p target_operation with the same - /// algorithm that \p source_operation was set up for, then - /// psa_hash_update() on \p target_operation with the same input that - /// that was passed to \p source_operation. After this function returns, the - /// two objects are independent, i.e. subsequent calls involving one of - /// the objects do not affect the other object. + /// \param ctx The context to use. This must be initialized. + /// \param is224 This determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// \param[in] source_operation The active hash operation to clone. - /// \param[in,out] target_operation The operation object to set up. - /// It must be initialized but not active. + /// \note is224 must be defined accordingly to the enabled + /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The \p source_operation state is not valid (it must be active), or - /// the \p target_operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_clone( - source_operation: *const psa_hash_operation_t, - target_operation: *mut psa_hash_operation_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_starts( + ctx: *mut mbedtls_sha256_context, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC (message authentication code) of a message. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-256 checksum calculation. /// - /// \note To verify the MAC of a message against an - /// expected value, use psa_mac_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_update( + ctx: *mut mbedtls_sha256_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function finishes the SHA-256 operation, and writes + /// the result to the output buffer. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p mac_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_compute( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_finish( + ctx: *mut mbedtls_sha256_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC of a message and compare it with a reference value. + /// \brief This function processes a single data block within + /// the ongoing SHA-256 computation. This function is for + /// internal use only. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \param ctx The SHA-256 context. This must be initialized. + /// \param data The buffer holding one block of data. This must + /// be a readable buffer of length \c 64 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected value. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha256_process( + ctx: *mut mbedtls_sha256_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart MAC operations. -/// -/// Before calling any function on a MAC operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_mac_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_mac_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, -/// for example: -/// \code -/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_mac_operation_init() -/// to the structure, for example: -/// \code -/// psa_mac_operation_t operation; -/// operation = psa_mac_operation_init(); -/// \endcode -/// -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Set up a multipart MAC calculation operation. + /// \brief This function calculates the SHA-224 or SHA-256 + /// checksum of a buffer. /// - /// This function sets up the calculation of the MAC - /// (message authentication code) of a byte string. - /// To verify the MAC of a message against an - /// expected value, use psa_mac_verify_setup() instead. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// The sequence of operations to calculate a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_sign_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_sign_finish() to finish - /// calculating the MAC value and retrieve it. + /// The SHA-256 result is calculated as + /// output = SHA-256(input buffer). /// - /// If an error occurs at any step after a call to psa_mac_sign_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// \param is224 Determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// After a successful call to psa_mac_sign_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_sign_finish(). - /// - A call to psa_mac_abort(). + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-224 checkup routine. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-256 checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha512_context { + pub work_area: [::core::ffi::c_uchar; 304usize], + pub is384: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha512_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Set up a multipart MAC verification operation. + /// \brief This function initializes a SHA-512 context. /// - /// This function sets up the verification of the MAC - /// (message authentication code) of a byte string against an expected value. + /// \param ctx The SHA-512 context to initialize. This must + /// not be \c NULL. + pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-512 context. /// - /// The sequence of operations to verify a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_verify_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_verify_finish() to finish - /// calculating the actual MAC of the message and verify it against - /// the expected value. + /// \param ctx The SHA-512 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must point to an initialized + /// SHA-512 context. + pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-512 context. /// - /// If an error occurs at any step after a call to psa_mac_verify_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha512_clone( + dst: *mut mbedtls_sha512_context, + src: *const mbedtls_sha512_context, + ); +} +unsafe extern "C" { + /// \brief This function starts a SHA-384 or SHA-512 checksum + /// calculation. /// - /// After a successful call to psa_mac_verify_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_verify_finish(). - /// - A call to psa_mac_abort(). + /// \param ctx The SHA-512 context to use. This must be initialized. + /// \param is384 Determines which function to use. This must be + /// either \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage - /// PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \note is384 must be defined accordingly to the enabled + /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c key is not compatible with \c alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_starts( + ctx: *mut mbedtls_sha512_context, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart MAC operation. - /// - /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() - /// before calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \brief This function feeds an input buffer into an ongoing + /// SHA-512 checksum calculation. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] input Buffer containing the message fragment to add to - /// the MAC calculation. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. This must + /// be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_update( - operation: *mut psa_mac_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_update( + ctx: *mut mbedtls_sha512_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message. - /// - /// The application must call psa_mac_sign_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). + /// \brief This function finishes the SHA-512 operation, and writes + /// the result to the output buffer. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the MAC. Call psa_mac_verify_finish() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_finish( + ctx: *mut mbedtls_sha512_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function processes a single data block within + /// the ongoing SHA-512 computation. + /// This function is for internal use only. /// - /// \param[in,out] operation Active MAC operation. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. This is always - /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of the key and \c alg is the - /// MAC algorithm that is calculated. + /// \param ctx The SHA-512 context. This must be initialized. + /// \param data The buffer holding one block of data. This + /// must be a readable buffer of length \c 128 Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p mac buffer is too small. You can determine a - /// sufficient buffer size by calling PSA_MAC_LENGTH(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac sign - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_finish( - operation: *mut psa_mac_operation_t, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha512_process( + ctx: *mut mbedtls_sha512_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-512 or SHA-384 + /// checksum of a buffer. /// - /// The application must call psa_mac_verify_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). It then - /// compares the calculated MAC with the expected MAC passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// The SHA-512 result is calculated as + /// output = SHA-512(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual MAC and the expected MAC is performed - /// in constant time. + /// \param input The buffer holding the input data. This must be + /// a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. + /// \param is384 Determines which function to use. This must be either + /// \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \note is384 must be defined accordingly with the supported + /// symbols in the config file. If: + /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + /// then the function will return + /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected MAC. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac verify - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_finish( - operation: *mut psa_mac_operation_t, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a MAC operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_mac_sign_setup() or psa_mac_verify_setup() again. + /// \brief The SHA-384 checkup routine. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_mac_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-512 checkup routine. /// - /// In particular, calling psa_mac_abort() after the operation has been - /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or - /// psa_mac_verify_finish() is safe and has no effect. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +///< Operation not defined. +pub const mbedtls_sha3_id_MBEDTLS_SHA3_NONE: mbedtls_sha3_id = 0; +///< SHA3-224 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_224: mbedtls_sha3_id = 1; +///< SHA3-256 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_256: mbedtls_sha3_id = 2; +///< SHA3-384 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_384: mbedtls_sha3_id = 3; +///< SHA3-512 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_512: mbedtls_sha3_id = 4; +/// SHA-3 family id. +/// +/// It identifies the family (SHA3-256, SHA3-512, etc.) +pub type mbedtls_sha3_id = ::core::ffi::c_uint; +/// \brief The SHA-3 context structure. +/// +/// The structure is used SHA-3 checksum calculations. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_sha3_context { + pub private_state: [u64; 25usize], + pub private_index: u32, + pub private_olen: u16, + pub private_max_block_size: u16, +} +unsafe extern "C" { + /// \brief This function initializes a SHA-3 context. /// - /// \param[in,out] operation Initialized MAC operation. + /// \param ctx The SHA-3 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha3_init(ctx: *mut mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-3 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; + /// \param ctx The SHA-3 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-3 context. + pub fn mbedtls_sha3_free(ctx: *mut mbedtls_sha3_context); } unsafe extern "C" { - /// Encrypt a message using a symmetric cipher. + /// \brief This function clones the state of a SHA-3 context. /// - /// This function encrypts a message with a random IV (initialization - /// vector). Use the multipart operation interface with a - /// #psa_cipher_operation_t object to provide other forms of IV. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha3_clone(dst: *mut mbedtls_sha3_context, src: *const mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function starts a SHA-3 checksum + /// calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// The output contains the IV followed by - /// the ciphertext proper. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The context to use. This must be initialized. + /// \param id The id of the SHA-3 family. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_starts( + ctx: *mut mbedtls_sha3_context, + id: mbedtls_sha3_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Decrypt a message using a symmetric cipher. - /// - /// This function decrypts a message encrypted with a symmetric cipher. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-3 checksum calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to decrypt. - /// This consists of the IV followed by the - /// ciphertext proper. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the plaintext is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_update( + ctx: *mut mbedtls_sha3_context, input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + ilen: usize, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart cipher operations. -/// -/// Before calling any function on a cipher operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_cipher_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_cipher_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, -/// for example: -/// \code -/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_cipher_operation_init() -/// to the structure, for example: -/// \code -/// psa_cipher_operation_t operation; -/// operation = psa_cipher_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// Set the key for a multipart symmetric encryption operation. + /// \brief This function finishes the SHA-3 operation, and writes + /// the result to the output buffer. /// - /// The sequence of operations to encrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. - /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to - /// generate or set the IV (initialization vector). You should use - /// psa_cipher_generate_iv() unless the protocol you are implementing - /// requires a specific IV value. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. /// - /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_finish( + ctx: *mut mbedtls_sha3_context, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function calculates the SHA-3 + /// checksum of a buffer. /// - /// After a successful call to psa_cipher_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// The SHA-3 result is calculated as + /// output = SHA-3(id, input buffer, d). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \param id The id of the SHA-3 family. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3( + id: mbedtls_sha3_id, + input: *const u8, + ilen: usize, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart symmetric decryption operation. + /// \brief Checkup routine for the algorithms implemented + /// by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. /// - /// The sequence of operations to decrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. - /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the - /// decryption. If the IV is prepended to the ciphertext, you can call - /// psa_cipher_update() on a buffer containing the IV followed by the - /// beginning of the message. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). - /// - /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_cipher_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). - /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if the test failed. + pub fn mbedtls_sha3_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// Generate an IV for a symmetric encryption operation. - /// - /// This function generates a random IV (initialization vector), nonce - /// or initial counter value for the encryption operation as appropriate - /// for the chosen algorithm, key type and key size. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] iv Buffer where the generated IV is to be written. - /// \param iv_size Size of the \p iv buffer in bytes. - /// \param[out] iv_length On success, the number of bytes of the - /// generated IV. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p iv buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no IV set), - /// or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_generate_iv( - operation: *mut psa_cipher_operation_t, - iv: *mut u8, - iv_size: usize, - iv_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hash_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// Set the IV for a symmetric encryption or decryption operation. - /// - /// This function sets the IV (initialization vector), nonce - /// or initial counter value for the encryption or decryption operation. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \note When encrypting, applications should use psa_cipher_generate_iv() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] iv Buffer containing the IV to use. - /// \param iv_length Size of the IV in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p iv is not acceptable for the chosen algorithm, - /// or the chosen algorithm does not use an IV. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active cipher - /// encrypt operation, with no IV set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_set_iv( - operation: *mut psa_cipher_operation_t, - iv: *const u8, - iv_length: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub md5: mbedtls_md5_context, + pub ripemd160: mbedtls_ripemd160_context, + pub sha1: mbedtls_sha1_context, + pub sha256: mbedtls_sha256_context, + pub sha512: mbedtls_sha512_context, } -unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active cipher operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() - /// (recommended when encrypting) or psa_cipher_set_iv(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_update( - operation: *mut psa_cipher_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Finish encrypting or decrypting a message in a cipher operation. - /// - /// The application must call psa_cipher_encrypt_setup() or - /// psa_cipher_decrypt_setup() before calling this function. The choice - /// of setup function determines whether this function encrypts or - /// decrypts its input. - /// - /// This function finishes the encryption or decryption of the message - /// formed by concatenating the inputs passed to preceding calls to - /// psa_cipher_update(). - /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input size passed to this operation is not valid for - /// this particular algorithm. For example, the algorithm is a based - /// on block cipher and requires a whole number of blocks, but the - /// total input size is not a multiple of the block size. - /// \retval #PSA_ERROR_INVALID_PADDING - /// This is a decryption operation for an algorithm that includes - /// padding, and the ciphertext does not contain valid padding. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_finish( - operation: *mut psa_cipher_operation_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_cipher_operation_t { + pub private_alg: psa_algorithm_t, + pub private_iv_length: u8, + pub private_block_length: u8, + pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_cipher: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_cipher_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_hash_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_hash_operation_t, +} +impl Default for psa_driver_hash_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_cipher_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, +} +impl Default for psa_driver_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hash_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h. + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. the driver context is not active, in use). + pub private_id: ::core::ffi::c_uint, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_hash_context_t, +} +impl Default for psa_hash_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_cipher_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_default_iv_length: u8, + pub private_ctx: psa_driver_cipher_context_t, +} +impl Default for psa_cipher_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_cipher_operation_s { + #[inline] + pub fn private_iv_required(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_iv_required: ::core::ffi::c_uint, + private_iv_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; + private_iv_required as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; + private_iv_set as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The GCM context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_gcm_context { + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, + ///< Precalculated HTable. + pub private_H: [[u64; 2usize]; 16usize], + ///< The total length of the encrypted data. + pub private_len: u64, + ///< The total length of the additional data. + pub private_add_len: u64, + ///< The first ECTR for tag. + pub private_base_ectr: [::core::ffi::c_uchar; 16usize], + ///< The Y working value. + pub private_y: [::core::ffi::c_uchar; 16usize], + ///< The buf working value. + pub private_buf: [::core::ffi::c_uchar; 16usize], + ///< The operation to perform: + ///#MBEDTLS_GCM_ENCRYPT or + ///#MBEDTLS_GCM_DECRYPT. + pub private_mode: ::core::ffi::c_uchar, + ///< The acceleration to use. + pub private_acceleration: ::core::ffi::c_uchar, +} +impl Default for mbedtls_gcm_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Abort a cipher operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. - /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_cipher_operation_t. - /// - /// In particular, calling psa_cipher_abort() after the operation has been - /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() - /// is safe and has no effect. + /// \brief This function initializes the specified GCM context, + /// to make references valid, and prepares the context + /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). /// - /// \param[in,out] operation Initialized cipher operation. + /// The function does not bind the GCM context to a particular + /// cipher, nor set the key. For this purpose, use + /// mbedtls_gcm_setkey(). /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; + /// \param ctx The GCM context to initialize. This must not be \c NULL. + pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Process an authenticated encryption operation. + /// \brief This function associates a GCM context with a + /// cipher algorithm and a key. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that will be authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] plaintext Data that will be authenticated and - /// encrypted. - /// \param plaintext_length Size of \p plaintext in bytes. - /// \param[out] ciphertext Output buffer for the authenticated and - /// encrypted data. The additional data is not - /// part of this output. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate outputs, the - /// authentication tag is appended to the - /// encrypted data. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p plaintext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p - /// plaintext_length) evaluates to the maximum - /// ciphertext size of any supported AEAD - /// encryption. - /// \param[out] ciphertext_length On success, the size of the output - /// in the \p ciphertext buffer. + /// \param ctx The GCM context. This must be initialized. + /// \param cipher The 128-bit block cipher to use. + /// \param key The encryption key. This must be a readable buffer of at + /// least \p keybits bits. + /// \param keybits The key size in bits. Valid options are: + ///
          • 128 bits
            • + ///
          • 192 bits
            • + ///
          • 256 bits
          /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p ciphertext_size is too small. - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p plaintext_length) or - /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - plaintext: *const u8, - plaintext_length: usize, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_gcm_setkey( + ctx: *mut mbedtls_gcm_context, + cipher: mbedtls_cipher_id_t, + key: *const ::core::ffi::c_uchar, + keybits: ::core::ffi::c_uint, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Process an authenticated decryption operation. + /// \brief This function performs GCM encryption or decryption of a buffer. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that has been authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] ciphertext Data that has been authenticated and - /// encrypted. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate inputs, the buffer - /// must contain the encrypted data followed - /// by the authentication tag. - /// \param ciphertext_length Size of \p ciphertext in bytes. - /// \param[out] plaintext Output buffer for the decrypted data. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p ciphertext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p - /// ciphertext_length) evaluates to the maximum - /// plaintext size of any supported AEAD - /// decryption. - /// \param[out] plaintext_length On success, the size of the output - /// in the \p plaintext buffer. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The ciphertext is not authentic. - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p plaintext_size is too small. - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p ciphertext_length) or - /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used - /// to determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - ciphertext: *const u8, - ciphertext_length: usize, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - ) -> psa_status_t; + /// \warning When this function performs a decryption, it outputs the + /// authentication tag and does not verify that the data is + /// authentic. You should use this function to perform encryption + /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// + /// \param ctx The GCM context to use for encryption or decryption. This + /// must be initialized. + /// \param mode The operation to perform: + /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + /// The ciphertext is written to \p output and the + /// authentication tag is written to \p tag. + /// - #MBEDTLS_GCM_DECRYPT to perform decryption. + /// The plaintext is written to \p output and the + /// authentication tag is written to \p tag. + /// Note that this mode is not recommended, because it does + /// not verify the authenticity of the data. For this reason, + /// you should use mbedtls_gcm_auth_decrypt() instead of + /// calling this function in decryption mode. + /// \param length The length of the input data, which is equal to the length + /// of the output data. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param input The buffer holding the input data. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size in Bytes. + /// \param output The buffer for holding the output data. If \p length is greater + /// than zero, this must be a writable buffer of at least that + /// size in Bytes. + /// \param tag_len The length of the tag to generate. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// + /// \return \c 0 if the encryption or decryption was performed + /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + /// this does not indicate that the data is authentic. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the encryption + /// or decryption failed. + pub fn mbedtls_gcm_crypt_and_tag( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + tag_len: usize, + tag: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart AEAD operations. -/// -/// Before calling any function on an AEAD operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_aead_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_aead_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, -/// for example: -/// \code -/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_aead_operation_init() -/// to the structure, for example: -/// \code -/// psa_aead_operation_t operation; -/// operation = psa_aead_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// Set the key for a multipart authenticated encryption operation. + /// \brief This function performs a GCM authenticated decryption of a + /// buffer. /// - /// The sequence of operations to encrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to - /// generate or set the nonce. You should use - /// psa_aead_generate_nonce() unless the protocol you are implementing - /// requires a specific nonce value. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the message to encrypt each time. - /// -# Call psa_aead_finish(). - /// - /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_finish(). - /// - A call to psa_aead_abort(). + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param length The length of the ciphertext to decrypt, which is also + /// the length of the decrypted plaintext. + /// \param iv The initialization vector. This must be a readable buffer + /// of at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param tag The buffer holding the tag to verify. This must be a + /// readable buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to verify. + /// \param input The buffer holding the ciphertext. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size. + /// \param output The buffer for holding the decrypted plaintext. If \p length + /// is greater than zero, this must be a writable buffer of at + /// least that size. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 if successful and authenticated. + /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the decryption + /// failed. + pub fn mbedtls_gcm_auth_decrypt( + ctx: *mut mbedtls_gcm_context, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + tag: *const ::core::ffi::c_uchar, + tag_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart authenticated decryption operation. - /// - /// The sequence of operations to decrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call psa_aead_set_nonce() with the nonce for the decryption. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the ciphertext to decrypt each time. - /// -# Call psa_aead_verify(). - /// - /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_verify(). - /// - A call to psa_aead_abort(). + /// \brief This function starts a GCM encryption or decryption + /// operation. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + /// #MBEDTLS_GCM_DECRYPT. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_starts( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Generate a random nonce for an authenticated encryption operation. - /// - /// This function generates a random nonce for the authenticated encryption - /// operation with an appropriate size for the chosen algorithm, key type - /// and key size. - /// - /// The application must call psa_aead_encrypt_setup() before - /// calling this function. + /// \brief This function feeds an input buffer as associated data + /// (authenticated but not encrypted data) in a GCM + /// encryption or decryption operation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// Call this function after mbedtls_gcm_starts() to pass + /// the associated data. If the associated data is empty, + /// you do not need to call this function. You may not + /// call this function after calling mbedtls_cipher_update(). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] nonce Buffer where the generated nonce is to be - /// written. - /// \param nonce_size Size of the \p nonce buffer in bytes. - /// \param[out] nonce_length On success, the number of bytes of the - /// generated nonce. + /// \param ctx The GCM context. This must have been started with + /// mbedtls_gcm_starts() and must not have yet received + /// any input with mbedtls_gcm_update(). + /// \param add The buffer holding the additional data, or \c NULL + /// if \p add_len is \c 0. + /// \param add_len The length of the additional data. If \c 0, + /// \p add may be \c NULL. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p nonce buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active aead encrypt - /// operation, with no nonce set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_generate_nonce( - operation: *mut psa_aead_operation_t, - nonce: *mut u8, - nonce_size: usize, - nonce_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_update_ad( + ctx: *mut mbedtls_gcm_context, + add: *const ::core::ffi::c_uchar, + add_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the nonce for an authenticated encryption or decryption operation. + /// \brief This function feeds an input buffer into an ongoing GCM + /// encryption or decryption operation. /// - /// This function sets the nonce for the authenticated - /// encryption or decryption operation. + /// You may call this function zero, one or more times + /// to pass successive parts of the input: the plaintext to + /// encrypt, or the ciphertext (not including the tag) to + /// decrypt. After the last part of the input, call + /// mbedtls_gcm_finish(). /// - /// The application must call psa_aead_encrypt_setup() or - /// psa_aead_decrypt_setup() before calling this function. + /// This function may produce output in one of the following + /// ways: + /// - Immediate output: the output length is always equal + /// to the input length. + /// - Buffered output: the output consists of a whole number + /// of 16-byte blocks. If the total input length so far + /// (not including associated data) is 16 \* *B* + *A* + /// with *A* < 16 then the total output length is 16 \* *B*. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// In particular: + /// - It is always correct to call this function with + /// \p output_size >= \p input_length + 15. + /// - If \p input_length is a multiple of 16 for all the calls + /// to this function during an operation, then it is + /// correct to use \p output_size = \p input_length. /// - /// \note When encrypting, applications should use psa_aead_generate_nonce() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] nonce Buffer containing the nonce to use. - /// \param nonce_length Size of the nonce in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param input The buffer holding the input data. If \p input_length + /// is greater than zero, this must be a readable buffer + /// of at least \p input_length bytes. + /// \param input_length The length of the input data in bytes. + /// \param output The buffer for the output data. If \p output_size + /// is greater than zero, this must be a writable buffer of + /// of at least \p output_size bytes. + /// \param output_size The size of the output buffer in bytes. + /// See the function description regarding the output size. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p nonce is not acceptable for the chosen algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no nonce - /// set), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_nonce( - operation: *mut psa_aead_operation_t, - nonce: *const u8, - nonce_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// total input length too long, + /// unsupported input/output buffer overlap detected, + /// or \p output_size too small. + pub fn mbedtls_gcm_update( + ctx: *mut mbedtls_gcm_context, + input: *const ::core::ffi::c_uchar, + input_length: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Declare the lengths of the message and additional data for AEAD. - /// - /// The application must call this function before calling - /// psa_aead_update_ad() or psa_aead_update() if the algorithm for - /// the operation requires it. If the algorithm does not require it, - /// calling this function is optional, but if this function is called - /// then the implementation must enforce the lengths. - /// - /// You may call this function before or after setting the nonce with - /// psa_aead_set_nonce() or psa_aead_generate_nonce(). - /// - /// - For #PSA_ALG_CCM, calling this function is required. - /// - For the other AEAD algorithms defined in this specification, calling - /// this function is not required. - /// - For vendor-defined algorithm, refer to the vendor documentation. + /// \brief This function finishes the GCM operation and generates + /// the authentication tag. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// It wraps up the GCM stream, and generates the + /// tag. The tag can have a maximum length of 16 Bytes. /// - /// \param[in,out] operation Active AEAD operation. - /// \param ad_length Size of the non-encrypted additional - /// authenticated data in bytes. - /// \param plaintext_length Size of the plaintext to encrypt in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to generate. This must be at least + /// four. + /// \param output The buffer for the final output. + /// If \p output_size is nonzero, this must be a writable + /// buffer of at least \p output_size bytes. + /// \param output_size The size of the \p output buffer in bytes. + /// This must be large enough for the output that + /// mbedtls_gcm_update() has not produced. In particular: + /// - If mbedtls_gcm_update() produces immediate output, + /// or if the total input size is a multiple of \c 16, + /// then mbedtls_gcm_finish() never produces any output, + /// so \p output_size can be \c 0. + /// - \p output_size never needs to be more than \c 15. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// At least one of the lengths is not acceptable for the chosen - /// algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and - /// psa_aead_update_ad() and psa_aead_update() must not have been - /// called yet), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_lengths( - operation: *mut psa_aead_operation_t, - ad_length: usize, - plaintext_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// invalid value of \p tag_len, + /// or \p output_size too small. + pub fn mbedtls_gcm_finish( + ctx: *mut mbedtls_gcm_context, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + tag: *mut ::core::ffi::c_uchar, + tag_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Pass additional data to an active AEAD operation. - /// - /// Additional data is authenticated, but not encrypted. - /// - /// You may call this function multiple times to pass successive fragments - /// of the additional data. You may not call this function after passing - /// data to encrypt or decrypt with psa_aead_update(). - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, - /// treat the input as untrusted and prepare to undo any action that - /// depends on the input if psa_aead_verify() returns an error status. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the fragment of - /// additional data. - /// \param input_length Size of the \p input buffer in bytes. + /// \brief This function clears a GCM context and the underlying + /// cipher sub-context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input length overflows the additional data length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, have lengths set if required by the algorithm, and - /// psa_aead_update() must not have been called yet), or the library - /// has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update_ad( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The GCM context to clear. If this is \c NULL, the call has + /// no effect. Otherwise, this must be initialized. + pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active AEAD operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// 3. Call psa_aead_update_ad() to pass all the additional data. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: - /// - Do not use the output in any way other than storing it in a - /// confidential location. If you take any action that depends - /// on the tentative decrypted data, this action will need to be - /// undone if the input turns out not to be valid. Furthermore, - /// if an adversary can observe that this action took place - /// (for example through timing), they may be able to use this - /// fact as an oracle to decrypt any message encrypted with the - /// same key. - /// - In particular, do not copy the output anywhere but to a - /// memory or storage space that you have exclusive access to. - /// - /// This function does not require the input to be aligned to any - /// particular block boundary. If the implementation can only process - /// a whole block at a time, it must consume all the input provided, but - /// it may delay the end of the corresponding output until a subsequent - /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() - /// provides sufficient input. The amount of data that can be delayed - /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, - /// \c alg, \p input_length) where - /// \c key_type is the type of key and \c alg is - /// the algorithm that were used to set up the - /// operation. - /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p - /// input_length) evaluates to the maximum - /// output size of any supported AEAD - /// algorithm. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// \brief The GCM checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or - /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total input length overflows the plaintext length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, and have lengths set if required by the algorithm), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hmac_operation_t { + /// The HMAC algorithm in use + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + /// The hash context. + pub hash_ctx: psa_hash_operation_s, + /// The HMAC part of the context. + pub private_opad: [u8; 128usize], +} +impl Default for mbedtls_psa_hmac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_mac_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_hmac: mbedtls_psa_hmac_operation_t, + pub private_cmac: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_mac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_aead_operation_t { + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_tag_length: u8, + pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub private_ccm: mbedtls_ccm_context, + pub private_gcm: mbedtls_gcm_context, + pub private_chachapoly: mbedtls_chachapoly_context, +} +impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_aead_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl mbedtls_psa_aead_operation_t { + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_sign_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_verify_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +///< Client +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; +///< Server +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; +///< Undefined +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_NONE: mbedtls_ecjpake_role = 2; +/// Roles in the EC J-PAKE exchange +pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; +/// EC J-PAKE context structure. +/// +/// J-PAKE is a symmetric protocol, except for the identifiers used in +/// Zero-Knowledge Proofs, and the serialization of the second message +/// (KeyExchange) as defined by the Thread spec. +/// +/// In order to benefit from this symmetry, we choose a different naming +/// convention from the Thread v1.0 spec. Correspondence is indicated in the +/// description as a pair C: client name, S: server name +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecjpake_context { + ///< Hash to use + pub private_md_type: mbedtls_md_type_t, + ///< Elliptic curve + pub private_grp: mbedtls_ecp_group, + ///< Are we client or server? + pub private_role: mbedtls_ecjpake_role, + ///< Format for point export + pub private_point_format: ::core::ffi::c_int, + ///< My public key 1 C: X1, S: X3 + pub private_Xm1: mbedtls_ecp_point, + ///< My public key 2 C: X2, S: X4 + pub private_Xm2: mbedtls_ecp_point, + ///< Peer public key 1 C: X3, S: X1 + pub private_Xp1: mbedtls_ecp_point, + ///< Peer public key 2 C: X4, S: X2 + pub private_Xp2: mbedtls_ecp_point, + ///< Peer public key C: Xs, S: Xc + pub private_Xp: mbedtls_ecp_point, + ///< My private key 1 C: x1, S: x3 + pub private_xm1: mbedtls_mpi, + ///< My private key 2 C: x2, S: x4 + pub private_xm2: mbedtls_mpi, + ///< Pre-shared secret (passphrase) + pub private_s: mbedtls_mpi, +} +impl Default for mbedtls_ecjpake_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Finish encrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_encrypt_setup(). + /// \brief Initialize an ECJPAKE context. /// - /// This function finishes the authentication of the additional data - /// formed by concatenating the inputs passed to preceding calls to - /// psa_aead_update_ad() with the plaintext formed by concatenating the - /// inputs passed to preceding calls to psa_aead_update(). + /// \param ctx The ECJPAKE context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Set up an ECJPAKE context for use. /// - /// This function has two output buffers: - /// - \p ciphertext contains trailing ciphertext that was buffered from - /// preceding calls to psa_aead_update(). - /// - \p tag contains the authentication tag. + /// \note Currently the only values for hash/curve allowed by the + /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to set up. This must be initialized. + /// \param role The role of the caller. This must be either + /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + /// \param hash The identifier of the hash function to use, + /// for example #MBEDTLS_MD_SHA256. + /// \param curve The identifier of the elliptic curve to use, + /// for example #MBEDTLS_ECP_DP_SECP256R1. + /// \param secret The pre-shared secret (passphrase). This must be + /// a readable not empty buffer of length \p len Bytes. It need + /// only be valid for the duration of this call. + /// \param len The length of the pre-shared secret \p secret. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] ciphertext Buffer where the last part of the ciphertext - /// is to be written. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] ciphertext_length On success, the number of bytes of - /// returned ciphertext. - /// \param[out] tag Buffer where the authentication tag is - /// to be written. - /// \param tag_size Size of the \p tag buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c - /// key_type, \c key_bits, \c alg) where - /// \c key_type and \c key_bits are the type and - /// bit-size of the key, and \c alg is the - /// algorithm that were used in the call to - /// psa_aead_encrypt_setup(). - /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the - /// maximum tag size of any supported AEAD - /// algorithm. - /// \param[out] tag_length On success, the number of bytes - /// that make up the returned tag. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p ciphertext or \p tag buffer is too small. - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the - /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, - /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to - /// determine the required \p tag buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active encryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_finish( - operation: *mut psa_aead_operation_t, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - tag: *mut u8, - tag_size: usize, - tag_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_setup( + ctx: *mut mbedtls_ecjpake_context, + role: mbedtls_ecjpake_role, + hash: mbedtls_md_type_t, + curve: mbedtls_ecp_group_id, + secret: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish authenticating and decrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_decrypt_setup(). - /// - /// This function finishes the authenticated decryption of the message - /// components: + /// \brief Set the point format for future reads and writes. /// - /// - The additional data consisting of the concatenation of the inputs - /// passed to preceding calls to psa_aead_update_ad(). - /// - The ciphertext consisting of the concatenation of the inputs passed to - /// preceding calls to psa_aead_update(). - /// - The tag passed to this function call. + /// \param ctx The ECJPAKE context to configure. + /// \param point_format The point format to use: + /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + /// or #MBEDTLS_ECP_PF_COMPRESSED. /// - /// If the authentication tag is correct, this function outputs any remaining - /// plaintext and reports success. If the authentication tag is not correct, - /// this function returns #PSA_ERROR_INVALID_SIGNATURE. + /// \return \c 0 if successful. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + /// is invalid. + pub fn mbedtls_ecjpake_set_point_format( + ctx: *mut mbedtls_ecjpake_context, + point_format: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if an ECJPAKE context is ready for use. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to check. This must be + /// initialized. /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual tag and the expected tag is performed - /// in constant time. + /// \return \c 0 if the context is ready for use. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] plaintext Buffer where the last part of the plaintext - /// is to be written. This is the remaining data - /// from previous calls to psa_aead_update() - /// that could not be processed until the end - /// of the input. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] plaintext_length On success, the number of bytes of - /// returned plaintext. - /// \param[in] tag Buffer containing the authentication tag. - /// \param tag_length Size of the \p tag buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be + /// initialized and set up. + /// \param buf The buffer to write the contents to. This must be a + /// writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number + /// of Bytes written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculations were successful, but the authentication tag is - /// not correct. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p plaintext buffer is too small. - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the - /// required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active decryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_verify( - operation: *mut psa_aead_operation_t, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - tag: *const u8, - tag_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort an AEAD operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// \brief Read and process the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_aead_operation_t. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up. + /// \param buf The buffer holding the first round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// In particular, calling psa_aead_abort() after the operation has been - /// terminated by a call to psa_aead_abort(), psa_aead_finish() or - /// psa_aead_verify() is safe and has no effect. + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \param[in,out] operation Initialized AEAD operation. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up, and already have performed round one. + /// \param buf The buffer to write the round two contents to. + /// This must be a writable buffer of length \p len Bytes. + /// \param len The size of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a message with a private key. For hash-and-sign algorithms, - /// this includes the hashing step. + /// \brief Read and process the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \note To perform a multi-part hash-and-sign signature algorithm, first use - /// a multi-part hash operation and then pass the resulting hash to - /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the - /// hash algorithm to use. - /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The input message to sign. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param[in] signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up and already have performed round one. + /// \param buf The buffer holding the second round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a message with a public key, using - /// a hash-and-sign verification algorithm. - /// - /// \note To perform a multi-part hash-and-sign signature verification - /// algorithm, first use a multi-part hash operation to hash the message - /// and then pass the resulting hash to psa_verify_hash(). - /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm - /// to use. + /// \brief Derive the shared secret + /// (TLS: Pre-Master Secret). /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The message whose signature is to be verified. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer containing the signature to verify. - /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed signature - /// is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_derive_secret( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a hash or short message with a private key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief Write the shared key material to be passed to a Key + /// Derivation Function as described in RFC8236. /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. - /// \param[out] signature_length On success, the number of bytes - /// that make up the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_shared_key( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a hash or short message using a public key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief This clears an ECJPAKE context and frees any + /// embedded data structure. /// - /// \param key Identifier of the key to use for the operation. It - /// must be a public key or an asymmetric key pair. The - /// key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message whose signature is to be - /// verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to free. This may be \c NULL, + /// in which case this function does nothing. If it is not + /// \c NULL, it must point to an initialized ECJPAKE context. + pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \retval #PSA_SUCCESS - /// The signature is valid. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief Encrypt a short message with a public key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the encrypted message is to - /// be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_pake_operation_t { + pub private_alg: psa_algorithm_t, + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_role: mbedtls_ecjpake_role, + pub private_buffer: [u8; 336usize], + pub private_buffer_length: usize, + pub private_buffer_offset: usize, + pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// \brief Decrypt a short message with a private key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. It must - /// allow the usage #PSA_KEY_USAGE_DECRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_jpake: mbedtls_ecjpake_context, } -/// The type of the state data structure for key derivation operations. -/// -/// Before calling any function on a key derivation operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_key_derivation_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, -/// for example: -/// \code -/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_key_derivation_operation_init() -/// to the structure, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// operation = psa_key_derivation_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_key_derivation_operation_t = psa_key_derivation_s; -unsafe extern "C" { - /// Set up a key derivation operation. - /// - /// A key derivation algorithm takes some inputs and uses them to generate - /// a byte stream in a deterministic way. - /// This byte stream can be used to produce keys and other - /// cryptographic material. - /// - /// To derive a key: - /// -# Start with an initialized object of type #psa_key_derivation_operation_t. - /// -# Call psa_key_derivation_setup() to select the algorithm. - /// -# Provide the inputs for the key derivation by calling - /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() - /// as appropriate. Which inputs are needed, in what order, and whether - /// they may be keys and if so of what type depends on the algorithm. - /// -# Optionally set the operation's maximum capacity with - /// psa_key_derivation_set_capacity(). You may do this before, in the middle - /// of or after providing inputs. For some algorithms, this step is mandatory - /// because the output depends on the maximum capacity. - /// -# To derive a key, call psa_key_derivation_output_key(). - /// To derive a byte string for a different purpose, call - /// psa_key_derivation_output_bytes(). - /// Successive calls to these functions use successive output bytes - /// calculated by the key derivation algorithm. - /// -# Clean up the key derivation operation object with - /// psa_key_derivation_abort(). - /// - /// If this function returns an error, the key derivation operation object is - /// not changed. - /// - /// If an error occurs at any step after a call to psa_key_derivation_setup(), - /// the operation will need to be reset by a call to psa_key_derivation_abort(). - /// - /// Implementations must reject an attempt to derive a key of size 0. - /// - /// \param[in,out] operation The key derivation operation object - /// to set up. It must - /// have been initialized but not set up yet. - /// \param alg The key derivation algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c alg is not a key derivation algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_setup( - operation: *mut psa_key_derivation_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Retrieve the current capacity of a key derivation operation. - /// - /// The capacity of a key derivation is the maximum number of bytes that it can - /// return. When you get *N* bytes of output from a key derivation operation, - /// this reduces its capacity by *N*. - /// - /// \param[in] operation The operation to query. - /// \param[out] capacity On success, the capacity of the operation. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_get_capacity( - operation: *const psa_key_derivation_operation_t, - capacity: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Set the maximum capacity of a key derivation operation. - /// - /// The capacity of a key derivation operation is the maximum number of bytes - /// that the key derivation operation can return from this point onwards. - /// - /// \param[in,out] operation The key derivation operation object to modify. - /// \param capacity The new capacity of the operation. - /// It must be less or equal to the operation's - /// current capacity. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p capacity is larger than the operation's current capacity. - /// In this case, the operation object remains valid and its capacity - /// remains unchanged. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_set_capacity( - operation: *mut psa_key_derivation_operation_t, - capacity: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_mac_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_mac_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function passes direct inputs, which is usually correct for - /// non-secret inputs. To pass a secret input, which should be in a key - /// object, call psa_key_derivation_input_key() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] data Input data to use. - /// \param data_length Size of the \p data buffer in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow direct inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_bytes( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - data: *const u8, - data_length: usize, - ) -> psa_status_t; +impl Default for psa_driver_mac_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Provide a numeric input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// However, when an algorithm requires a particular order, numeric inputs - /// usually come first as they tend to be configuration parameters. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function is used for inputs which are fixed-size non-negative - /// integers. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] value The value of the numeric input. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow numeric inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_integer( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - value: u64, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_aead_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_aead_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation in the form of a key. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function obtains input from a key object, which is usually correct for - /// secret inputs or for non-secret personalization strings kept in the key - /// store. To pass a non-secret parameter which is not in the key store, - /// call psa_key_derivation_input_bytes() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param key Identifier of the key. It must have an - /// appropriate type for step and must allow the - /// usage #PSA_KEY_USAGE_DERIVE or - /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) - /// and the algorithm used by the operation. - /// - /// \note Once all inputs steps are completed, the operations will allow: - /// - psa_key_derivation_output_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_output_key() if the input for step - /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD - /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was - /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_verify_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; - /// - psa_key_derivation_verify_key() under the same conditions as - /// psa_key_derivation_verify_bytes(). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key allows neither #PSA_KEY_USAGE_DERIVE nor - /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this - /// algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow key inputs of the given type - /// or does not allow key inputs at all. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_key( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - key: mbedtls_svc_key_id_t, - ) -> psa_status_t; +impl Default for psa_driver_aead_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Perform a key agreement and use the shared secret as input to a key - /// derivation. - /// - /// A key agreement algorithm takes two inputs: a private key \p private_key - /// a public key \p peer_key. - /// The result of this function is passed as input to a key derivation. - /// The output of this key derivation can be extracted by reading from the - /// resulting operation to produce keys and other cryptographic material. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() with a - /// key agreement and derivation algorithm - /// \c alg (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true - /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) - /// is false). - /// The operation must be ready for an - /// input of the type given by \p step. - /// \param step Which step the input data is for. - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. The peer key must be in the - /// same format that psa_import_key() accepts for the - /// public key type corresponding to the type of - /// private_key. That is, this function performs the - /// equivalent of - /// #psa_import_key(..., - /// `peer_key`, `peer_key_length`) where - /// with key attributes indicating the public key - /// type corresponding to the type of `private_key`. - /// For example, for EC keys, this means that peer_key - /// is interpreted as a point on the curve that the - /// private key is on. The standard formats for public - /// keys are documented in the documentation of - /// psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_sign_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, +} +impl Default for psa_driver_sign_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_verify_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, +} +impl Default for psa_driver_verify_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_pake_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_pake_operation_t, +} +impl Default for psa_driver_pake_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_mac_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_mac_size: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_mac_context_t, +} +impl Default for psa_mac_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_mac_operation_s { + #[inline] + pub fn private_is_sign(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_sign: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; + private_is_sign as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_aead_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub private_ad_remaining: usize, + pub private_body_remaining: usize, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_ctx: psa_driver_aead_context_t, +} +impl Default for psa_aead_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_aead_operation_s { + #[inline] + pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_ad_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_body_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(3usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 3usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 3usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(4usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 4usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 4usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_nonce_set: ::core::ffi::c_uint, + private_lengths_set: ::core::ffi::c_uint, + private_ad_started: ::core::ffi::c_uint, + private_body_started: ::core::ffi::c_uint, + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; + private_nonce_set as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; + private_lengths_set as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; + private_ad_started as u64 + }); + __bindgen_bitfield_unit.set(3usize, 1u8, { + let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; + private_body_started as u64 + }); + __bindgen_bitfield_unit.set(4usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hkdf_key_derivation_t { + pub private_info: *mut u8, + pub private_info_length: usize, + pub private_offset_in_block: u8, + pub private_block_number: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_output_block: [u8; 64usize], + pub private_prk: [u8; 64usize], + pub __bindgen_padding_0: [u64; 0usize], + pub private_hmac: psa_mac_operation_s, +} +impl Default for psa_hkdf_key_derivation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_hkdf_key_derivation_t { + #[inline] + pub fn private_state(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_info_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_state: ::core::ffi::c_uint, + private_info_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 2u8, { + let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; + private_state as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; + private_info_set as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_tls12_ecjpake_to_pms_t { + pub private_data: [u8; 32usize], +} +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: + psa_tls12_prf_key_derivation_state_t = 0; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: + psa_tls12_prf_key_derivation_state_t = 1; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 2; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 3; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: + psa_tls12_prf_key_derivation_state_t = 4; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: + psa_tls12_prf_key_derivation_state_t = 5; +pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_tls12_prf_key_derivation_s { + pub private_left_in_block: u8, + pub private_block_number: u8, + pub private_state: psa_tls12_prf_key_derivation_state_t, + pub private_secret: *mut u8, + pub private_secret_length: usize, + pub private_seed: *mut u8, + pub private_seed_length: usize, + pub private_label: *mut u8, + pub private_label_length: usize, + pub private_other_secret: *mut u8, + pub private_other_secret_length: usize, + pub private_Ai: [u8; 64usize], + pub private_output_block: [u8; 64usize], +} +impl Default for psa_tls12_prf_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_key_derivation_context_t { + pub dummy: ::core::ffi::c_uint, + pub private_hkdf: psa_hkdf_key_derivation_t, + pub private_tls12_prf: psa_tls12_prf_key_derivation_t, + pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +} +impl Default for psa_driver_key_derivation_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_key_derivation_s { + pub private_alg: psa_algorithm_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_capacity: usize, + pub __bindgen_padding_0: [u64; 0usize], + pub private_ctx: psa_driver_key_derivation_context_t, +} +impl Default for psa_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_key_derivation_s { + #[inline] + pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_can_output_key: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_can_output_key: u32 = + unsafe { ::core::mem::transmute(private_can_output_key) }; + private_can_output_key as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_custom_key_parameters_s { + pub flags: u32, +} +#[repr(C)] +#[derive(Default)] +pub struct psa_key_production_parameters_s { + pub flags: u32, + pub data: __IncompleteArrayField, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_policy_s { + pub private_usage: psa_key_usage_t, + pub private_alg: psa_algorithm_t, + pub private_alg2: psa_algorithm_t, +} +pub type psa_key_policy_t = psa_key_policy_s; +pub type psa_key_bits_t = u16; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_attributes_s { + pub private_type: psa_key_type_t, + pub private_bits: psa_key_bits_t, + pub private_lifetime: psa_key_lifetime_t, + pub private_policy: psa_key_policy_t, + pub private_id: mbedtls_svc_key_id_t, +} +/// \brief The context for PSA interruptible hash signing. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_sign_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_sign_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_sign_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_sign_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The context for PSA interruptible hash verification. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_verify_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_verify_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_verify_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_verify_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +unsafe extern "C" { + /// \brief Library initialization. + /// + /// Applications must call this function before calling any other + /// function in this module. + /// + /// Applications may call this function more than once. Once a call + /// succeeds, subsequent calls are guaranteed to succeed. + /// + /// If the application calls other functions before calling psa_crypto_init(), + /// the behavior is undefined. Implementations are encouraged to either perform + /// the operation as if the library had been initialized or to return + /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + /// implementations should not return a success status if the lack of + /// initialization may have security implications, for example due to improper + /// seeding of the random number generator. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + pub fn psa_crypto_init() -> psa_status_t; +} +unsafe extern "C" { + /// Retrieve the attributes of a key. + /// + /// This function first resets the attribute structure as with + /// psa_reset_key_attributes(). It then copies the attributes of + /// the given key into the given attribute structure. + /// + /// \note This function may allocate memory or other resources. + /// Once you have called this function on an attribute structure, + /// you must call psa_reset_key_attributes() to free these resources. + /// + /// \param[in] key Identifier of the key to query. + /// \param[in,out] attributes On success, the attributes of the key. + /// On failure, equivalent to a + /// freshly-initialized structure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_get_key_attributes( + key: mbedtls_svc_key_id_t, + attributes: *mut psa_key_attributes_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Reset a key attribute structure to a freshly initialized state. + /// + /// You must initialize the attribute structure as described in the + /// documentation of the type #psa_key_attributes_t before calling this + /// function. Once the structure has been initialized, you may call this + /// function at any time. + /// + /// This function frees any auxiliary resources that the structure + /// may contain. + /// + /// \param[in,out] attributes The attribute structure to reset. + pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); +} +unsafe extern "C" { + /// Remove non-essential copies of key material from memory. + /// + /// If the key identifier designates a volatile key, this functions does not do + /// anything and returns successfully. + /// + /// If the key identifier designates a persistent key, then this function will + /// free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and the key can still be used. + /// + /// \param key Identifier of the key to purge. + /// + /// \retval #PSA_SUCCESS + /// The key material will have been removed from memory if it is not + /// currently required. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid key identifier. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// Make a copy of a key. + /// + /// Copy key material from one location to another. + /// + /// This function is primarily useful to copy a key from one location + /// to another, since it populates a key using the material from + /// another key which may have a different lifetime. + /// + /// This function may be used to share a key with a different party, + /// subject to implementation-defined restrictions on key sharing. + /// + /// The policy on the source key must have the usage flag + /// #PSA_KEY_USAGE_COPY set. + /// This flag is sufficient to permit the copy if the key has the lifetime + /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + /// Some secure elements do not provide a way to copy a key without + /// making it extractable from the secure element. If a key is located + /// in such a secure element, then the key must have both usage flags + /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + /// a copy of the key outside the secure element. + /// + /// The resulting key may only be used in a way that conforms to + /// both the policy of the original key and the policy specified in + /// the \p attributes parameter: + /// - The usage flags on the resulting key are the bitwise-and of the + /// usage flags on the source policy and the usage flags in \p attributes. + /// - If both allow the same algorithm or wildcard-based + /// algorithm policy, the resulting key has the same algorithm policy. + /// - If either of the policies allows an algorithm and the other policy + /// allows a wildcard-based algorithm policy that includes this algorithm, + /// the resulting key allows the same algorithm. + /// - If the policies do not allow any algorithm in common, this function + /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// + /// The effect of this function on implementation-defined attributes is + /// implementation-defined. + /// + /// \param source_key The key to copy. It must allow the usage + /// #PSA_KEY_USAGE_COPY. If a private or secret key is + /// being copied outside of a secure element it must + /// also allow #PSA_KEY_USAGE_EXPORT. + /// \param[in] attributes The attributes for the new key. + /// They are used as follows: + /// - The key type and size may be 0. If either is + /// nonzero, it must match the corresponding + /// attribute of the source key. + /// - The key location (the lifetime and, for + /// persistent keys, the key identifier) is + /// used directly. + /// - The policy constraints (usage flags and + /// algorithm policy) are combined from + /// the source key and \p attributes so that + /// both sets of restrictions apply, as + /// described in the documentation of this function. + /// \param[out] target_key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p source_key is invalid. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The lifetime or identifier in \p attributes are invalid, or + /// the policy constraints on the source and specified in + /// \p attributes are incompatible, or + /// \p attributes specifies a key type or key size + /// which does not match the attributes of the source key. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + /// the source key is not exportable and its lifetime does not + /// allow copying it to the target's lifetime. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_copy_key( + source_key: mbedtls_svc_key_id_t, + attributes: *const psa_key_attributes_t, + target_key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Destroy a key. + /// + /// This function destroys a key from both volatile + /// memory and, if applicable, non-volatile storage. Implementations shall + /// make a best effort to ensure that the key material cannot be recovered. + /// + /// This function also erases any metadata such as policies and frees + /// resources associated with the key. + /// + /// If a key is currently in use in a multipart operation, then destroying the + /// key will cause the multipart operation to fail. + /// + /// \warning We can only guarantee that the the key material will + /// eventually be wiped from memory. With threading enabled + /// and during concurrent execution, copies of the key material may + /// still exist until all threads have finished using the key. + /// + /// \param key Identifier of the key to erase. If this is \c 0, do nothing and + /// return #PSA_SUCCESS. + /// + /// \retval #PSA_SUCCESS + /// \p key was a valid identifier and the key material that it + /// referred to has been erased. Alternatively, \p key is \c 0. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key cannot be erased because it is + /// read-only, either due to a policy or due to physical restrictions. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p key is not a valid identifier nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE + /// There was a failure in communication with the cryptoprocessor. + /// The key material may still be present in the cryptoprocessor. + /// \retval #PSA_ERROR_DATA_INVALID + /// This error is typically a result of either storage corruption on a + /// cleartext storage backend, or an attempt to read data that was + /// written by an incompatible version of the library. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The storage is corrupted. Implementations shall make a best effort + /// to erase key material even in this stage, however applications + /// should be aware that it may be impossible to guarantee that the + /// key material is not recoverable in such cases. + /// \retval #PSA_ERROR_CORRUPTION_DETECTED + /// An unexpected condition which is not a storage corruption or + /// a communication failure occurred. The cryptoprocessor may have + /// been compromised. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Import a key in binary format. + /// + /// This function supports any output from psa_export_key(). Refer to the + /// documentation of psa_export_public_key() for the format of public keys + /// and to the documentation of psa_export_key() for the format for + /// other key types. + /// + /// The key data determines the key size. The attributes may optionally + /// specify a key size; in this case it must match the size determined + /// from the key data. A key size of 0 in \p attributes indicates that + /// the key size is solely determined by the key data. + /// + /// Implementations must reject an attempt to import a key of size 0. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// \param[in] attributes The attributes for the new key. + /// The key size is always determined from the + /// \p data buffer. + /// If the key size in \p attributes is nonzero, + /// it must be equal to the size from \p data. + /// \param[out] key On success, an identifier to the newly created key. + /// For persistent keys, this is the key identifier + /// defined in \p attributes. + /// \c 0 on failure. + /// \param[in] data Buffer containing the key data. The content of this + /// buffer is interpreted according to the type declared + /// in \p attributes. + /// All implementations must support at least the format + /// described in the documentation + /// of psa_export_key() or psa_export_public_key() for + /// the chosen type. Implementations may allow other + /// formats, but should be conservative: implementations + /// should err on the side of rejecting content if it + /// may be erroneous (e.g. wrong type or truncated data). + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular persistent location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key attributes, as a whole, are invalid, or + /// the key data is not correctly formatted, or + /// the size in \p attributes is nonzero and does not match the size + /// of the key data. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_import_key( + attributes: *const psa_key_attributes_t, + data: *const u8, + data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a key in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an equivalent object. + /// + /// If the implementation of psa_import_key() supports other formats + /// beyond the format specified here, the output from psa_export_key() + /// must use the representation specified here, not the original + /// representation. + /// + /// For standard key types, the output format is as follows: + /// + /// - For symmetric keys (including MAC keys), the format is the + /// raw bytes of the key. + /// - For DES, the key data consists of 8 bytes. The parity bits must be + /// correct. + /// - For Triple-DES, the format is the concatenation of the + /// two or three DES keys. + /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + /// is the non-encrypted DER encoding of the representation defined by + /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + /// ``` + /// RSAPrivateKey ::= SEQUENCE { + /// version INTEGER, -- must be 0 + /// modulus INTEGER, -- n + /// publicExponent INTEGER, -- e + /// privateExponent INTEGER, -- d + /// prime1 INTEGER, -- p + /// prime2 INTEGER, -- q + /// exponent1 INTEGER, -- d mod (p-1) + /// exponent2 INTEGER, -- d mod (q-1) + /// coefficient INTEGER, -- (inverse of q) mod p + /// } + /// ``` + /// - For elliptic curve key pairs (key types for which + /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + /// a representation of the private value as a `ceiling(m/8)`-byte string + /// where `m` is the bit size associated with the curve, i.e. the bit size + /// of the order of the curve's coordinate field. This byte string is + /// in little-endian order for Montgomery curves (curve types + /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + /// For Weierstrass curves, this is the content of the `privateKey` field of + /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + /// the format is defined by RFC 7748, and output is masked according to §5. + /// For twisted Edwards curves, the private key is as defined by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For Diffie-Hellman key exchange key pairs (key types for which + /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + /// format is the representation of the private key `x` as a big-endian byte + /// string. The length of the byte string is the private key size in bytes + /// (leading zeroes are not stripped). + /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + /// true), the format is the same as for psa_export_public_key(). + /// + /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// + /// \param key Identifier of the key to export. It must allow the + /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public + /// key. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a public key or the public part of a key pair in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an object that is equivalent to the public key. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// For standard key types, the output format is as follows: + /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + /// ``` + /// RSAPublicKey ::= SEQUENCE { + /// modulus INTEGER, -- n + /// publicExponent INTEGER } -- e + /// ``` + /// - For elliptic curve keys on a twisted Edwards curve (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + /// by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For other elliptic curve public keys (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. + /// Let `m` be the bit size associated with the curve, i.e. the bit size of + /// `q` for a curve over `F_q`. The representation consists of: + /// - The byte 0x04; + /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + /// - For Diffie-Hellman key exchange public keys (key types for which + /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + /// the format is the representation of the public key `y = g^x mod p` as a + /// big-endian byte string. The length of the byte string is the length of the + /// base prime `p` in bytes. + /// + /// Exporting a public key object or the public part of a key pair is + /// always permitted, regardless of the key's usage flags. + /// + /// \param key Identifier of the key to export. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key is neither a public key nor a key pair. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_public_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message. + /// + /// \note To verify the hash of a message against an + /// expected value, use psa_hash_compare() instead. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\p alg). /// /// \retval #PSA_SUCCESS /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p hash_size is too small + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compute( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message and compare it with a + /// reference value. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the input. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c private_key is not compatible with \c alg, - /// or \p peer_key is not valid for \c alg or not compatible with - /// \c private_key, or \c step does not allow an input resulting - /// from a key agreement. + /// \p input_length or \p hash_length do not match the hash size for \p alg + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compare( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; +} +/// The type of the state data structure for multipart hash operations. +/// +/// Before calling any function on a hash operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_hash_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_hash_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, +/// for example: +/// \code +/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_hash_operation_init() +/// to the structure, for example: +/// \code +/// psa_hash_operation_t operation; +/// operation = psa_hash_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_hash_operation_t = psa_hash_operation_s; +unsafe extern "C" { + /// Set up a multipart hash operation. + /// + /// The sequence of operations to calculate a hash (message digest) + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + /// -# Call psa_hash_setup() to specify the algorithm. + /// -# Call psa_hash_update() zero, one or more times, passing a fragment + /// of the message each time. The hash that is calculated is the hash + /// of the concatenation of these messages in order. + /// -# To calculate the hash, call psa_hash_finish(). + /// To compare the hash with an expected value, call psa_hash_verify(). + /// + /// If an error occurs at any step after a call to psa_hash_setup(), the + /// operation will need to be reset by a call to psa_hash_abort(). The + /// application may call psa_hash_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_hash_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_hash_finish() or psa_hash_verify(). + /// - A call to psa_hash_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_hash_operation_t and not yet in use. + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. + /// \p alg is not a supported hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a hash algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this key agreement \p step, - /// or the library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_key_agreement( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, + pub fn psa_hash_setup( + operation: *mut psa_hash_operation_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// Read some data from a key derivation operation. + /// Add a message fragment to a multipart hash operation. /// - /// This function calculates output bytes from a key derivation algorithm and - /// return those bytes. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the requested number of bytes from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. + /// The application must call psa_hash_setup() before calling this function. /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] output Buffer where the output will be written. - /// \param output_length Number of bytes to output. + /// \param[in,out] operation Active hash operation. + /// \param[in] input Buffer containing the message fragment to hash. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// no output is written to the output buffer. - /// The operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller output buffer. + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_update( + operation: *mut psa_hash_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \warning Applications should not call this function if they expect + /// a specific value for the hash. Call psa_hash_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// hash values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the hashed data which could allow an attacker to guess + /// a valid hash and thereby bypass security controls. + /// + /// \param[in,out] operation Active hash operation. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\c alg) where \c alg is the + /// hash algorithm that is calculated. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p hash buffer is too small. You can determine a + /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + /// where \c alg is the hash algorithm that is calculated. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_finish( + operation: *mut psa_hash_operation_t, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message and compare it with + /// an expected value. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). It then + /// compares the calculated hash with the expected hash passed as a + /// parameter to this function. + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual hash and the expected hash is performed + /// in constant time. + /// + /// \param[in,out] operation Active hash operation. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_bytes( - operation: *mut psa_key_derivation_operation_t, - output: *mut u8, - output_length: usize, + pub fn psa_hash_verify( + operation: *mut psa_hash_operation_t, + hash: *const u8, + hash_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// Derive a key from an ongoing key derivation operation. - /// - /// This function calculates output bytes from a key derivation algorithm - /// and uses those bytes to generate a key deterministically. - /// The key's location, usage policy, type and size are taken from - /// \p attributes. - /// - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads as many bytes as required from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// How much output is produced and consumed from the operation, and how - /// the key is derived, depends on the key type and on the key size - /// (denoted \c bits below): - /// - /// - For key types for which the key is an arbitrary sequence of bytes - /// of a given size, this function is functionally equivalent to - /// calling #psa_key_derivation_output_bytes - /// and passing the resulting output to #psa_import_key. - /// However, this function has a security benefit: - /// if the implementation provides an isolation boundary then - /// the key material is not exposed outside the isolation boundary. - /// As a consequence, for these key types, this function always consumes - /// exactly (\c bits / 8) bytes from the operation. - /// The following key types defined in this specification follow this scheme: - /// - /// - #PSA_KEY_TYPE_AES; - /// - #PSA_KEY_TYPE_ARIA; - /// - #PSA_KEY_TYPE_CAMELLIA; - /// - #PSA_KEY_TYPE_DERIVE; - /// - #PSA_KEY_TYPE_HMAC; - /// - #PSA_KEY_TYPE_PASSWORD_HASH. - /// - /// - For ECC keys on a Montgomery elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Montgomery curve), this function always draws a byte string whose - /// length is determined by the curve, and sets the mandatory bits - /// accordingly. That is: + /// Abort a hash operation. /// - /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte - /// string and process it as specified in RFC 7748 §5. - /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte - /// string and process it as specified in RFC 7748 §5. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_hash_setup() again. /// - /// - For key types for which the key is represented by a single sequence of - /// \c bits bits with constraints as to which bit sequences are acceptable, - /// this function draws a byte string of length (\c bits / 8) bytes rounded - /// up to the nearest whole number of bytes. If the resulting byte string - /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. - /// This process is repeated until an acceptable byte string is drawn. - /// The byte string drawn from the operation is interpreted as specified - /// for the output produced by psa_export_key(). - /// The following key types defined in this specification follow this scheme: + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_hash_operation_t. /// - /// - #PSA_KEY_TYPE_DES. - /// Force-set the parity bits, but discard forbidden weak keys. - /// For 2-key and 3-key triple-DES, the three keys are generated - /// successively (for example, for 3-key triple-DES, - /// if the first 8 bytes specify a weak key and the next 8 bytes do not, - /// discard the first 8 bytes, use the next 8 bytes as the first key, - /// and continue reading output from the operation to derive the other - /// two keys). - /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) - /// where \c group designates any Diffie-Hellman group) and - /// ECC keys on a Weierstrass elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Weierstrass curve). - /// For these key types, interpret the byte string as integer - /// in big-endian order. Discard it if it is not in the range - /// [0, *N* - 2] where *N* is the boundary of the private key domain - /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, - /// or the order of the curve's base point for ECC). - /// Add 1 to the resulting integer and use this as the private key *x*. - /// This method allows compliance to NIST standards, specifically - /// the methods titled "key-pair generation by testing candidates" - /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, - /// in FIPS 186-4 §B.1.2 for DSA, and - /// in NIST SP 800-56A §5.6.1.2.2 or - /// FIPS 186-4 §B.4.2 for elliptic curve keys. + /// In particular, calling psa_hash_abort() after the operation has been + /// terminated by a call to psa_hash_abort(), psa_hash_finish() or + /// psa_hash_verify() is safe and has no effect. /// - /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, - /// the way in which the operation output is consumed is - /// implementation-defined. + /// \param[in,out] operation Initialized hash operation. /// - /// In all cases, the data that is read is discarded from the operation. - /// The operation's capacity is decreased by the number of bytes read. + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Clone a hash operation. /// - /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, - /// the input to that step must be provided with psa_key_derivation_input_key(). - /// Future versions of this specification may include additional restrictions - /// on the derived key based on the attributes and strength of the secret key. + /// This function copies the state of an ongoing hash operation to + /// a new operation object. In other words, this function is equivalent + /// to calling psa_hash_setup() on \p target_operation with the same + /// algorithm that \p source_operation was set up for, then + /// psa_hash_update() on \p target_operation with the same input that + /// that was passed to \p source_operation. After this function returns, the + /// two objects are independent, i.e. subsequent calls involving one of + /// the objects do not affect the other object. /// - /// \param[in] attributes The attributes for the new key. - /// If the key type to be created is - /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in - /// the policy must be the same as in the current - /// operation. - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in] source_operation The active hash operation to clone. + /// \param[in,out] target_operation The operation object to set up. + /// It must be initialized but not active. /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// There was not enough data to create the desired key. - /// Note that in this case, no output is written to the output buffer. - /// The operation's capacity is set to 0, thus subsequent calls to - /// this function will not succeed, even with a smaller output buffer. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The provided key attributes are not valid for the operation. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The #PSA_KEY_DERIVATION_INPUT_SECRET or - /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a - /// key; or one of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_SUCCESS \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The \p source_operation state is not valid (it must be active), or + /// the \p target_operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_key( - attributes: *const psa_key_attributes_t, - operation: *mut psa_key_derivation_operation_t, - key: *mut mbedtls_svc_key_id_t, + pub fn psa_hash_clone( + source_operation: *const psa_hash_operation_t, + target_operation: *mut psa_hash_operation_t, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value in constant time. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the expected number of bytes from the - /// stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to the following code: - /// \code - /// psa_key_derivation_output_bytes(operation, tmp, output_length); - /// if (memcmp(output, tmp, output_length) != 0) - /// return PSA_ERROR_INVALID_SIGNATURE; - /// \endcode - /// except (1) it works even if the key's policy does not allow outputting the - /// bytes, and (2) the comparison will be done in constant time. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC (message authentication code) of a message. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected_output Buffer containing the expected derivation output. - /// \param output_length Length of the expected output; this is also the - /// number of bytes that will be read. + /// \note To verify the MAC of a message against an + /// expected value, use psa_mac_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but it differs from the expected - /// output. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p mac_size is too small /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_bytes( - operation: *mut psa_key_derivation_operation_t, - expected_output: *const u8, - output_length: usize, + pub fn psa_mac_compute( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value - /// stored in a key object. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value, provided as key of type - /// #PSA_KEY_TYPE_PASSWORD_HASH. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the number of bytes corresponding to the - /// length of the expected value from the stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to exporting the key and calling - /// psa_key_derivation_verify_bytes() on the result, except that it - /// works even if the key cannot be exported. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC of a message and compare it with a reference value. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH - /// containing the expected output. Its policy must - /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag - /// and the permitted algorithm must match the - /// operation. The value of this key was likely - /// computed by a previous call to - /// psa_key_derivation_output_key(). + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the input. /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but if differs from the expected - /// output. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// The key passed as the expected value does not exist. + /// The MAC of the message was calculated successfully, but it + /// differs from the expected value. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key passed as the expected value has an invalid type. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key passed as the expected value does not allow this usage or - /// this algorithm; or one of the inputs was a key whose policy didn't - /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// the length of the expected value. In this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_key( - operation: *mut psa_key_derivation_operation_t, - expected: psa_key_id_t, + pub fn psa_mac_verify( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *const u8, + mac_length: usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart MAC operations. +/// +/// Before calling any function on a MAC operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_mac_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_mac_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, +/// for example: +/// \code +/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_mac_operation_init() +/// to the structure, for example: +/// \code +/// psa_mac_operation_t operation; +/// operation = psa_mac_operation_init(); +/// \endcode +/// +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Abort a key derivation operation. + /// Set up a multipart MAC calculation operation. /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_key_derivation_setup() again. + /// This function sets up the calculation of the MAC + /// (message authentication code) of a byte string. + /// To verify the MAC of a message against an + /// expected value, use psa_mac_verify_setup() instead. /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_key_derivation_operation_t. + /// The sequence of operations to calculate a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_sign_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_sign_finish() to finish + /// calculating the MAC value and retrieve it. /// - /// In particular, it is valid to call psa_key_derivation_abort() twice, or to - /// call psa_key_derivation_abort() on an operation that has not been set up. + /// If an error occurs at any step after a call to psa_mac_sign_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. /// - /// \param[in,out] operation The operation to abort. + /// After a successful call to psa_mac_sign_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_sign_finish(). + /// - A call to psa_mac_abort(). /// - /// \retval #PSA_SUCCESS \emptydescription + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) - -> psa_status_t; + pub fn psa_mac_sign_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Perform a key agreement and return the raw shared secret. + /// Set up a multipart MAC verification operation. /// - /// \warning The raw result of a key agreement algorithm such as finite-field - /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should - /// not be used directly as key material. It should instead be passed as - /// input to a key derivation algorithm. To chain a key agreement with - /// a key derivation, use psa_key_derivation_key_agreement() and other - /// functions from the key derivation interface. + /// This function sets up the verification of the MAC + /// (message authentication code) of a byte string against an expected value. /// - /// \param alg The key agreement algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) - /// is true). - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. It must be - /// in the same format that psa_import_key() - /// accepts. The standard formats for public - /// keys are documented in the documentation - /// of psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// The sequence of operations to verify a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_verify_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_verify_finish() to finish + /// calculating the actual MAC of the message and verify it against + /// the expected value. + /// + /// If an error occurs at any step after a call to psa_mac_verify_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_mac_verify_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_verify_finish(). + /// - A call to psa_mac_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage + /// PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). /// /// \retval #PSA_SUCCESS /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a key agreement algorithm, or - /// \p private_key is not compatible with \p alg, - /// or \p peer_key is not valid for \p alg or not compatible with - /// \p private_key. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p output_size is too small + /// \c key is not compatible with \c alg. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported key agreement algorithm. + /// \c alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_raw_key_agreement( + pub fn psa_mac_verify_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate random bytes. - /// - /// \warning This function **can** fail! Callers MUST check the return status - /// and MUST NOT use the content of the output buffer if the return - /// status is not #PSA_SUCCESS. - /// - /// \note To generate a key, use psa_generate_key() instead. - /// - /// \param[out] output Output buffer for the generated data. - /// \param output_size Number of bytes to generate and output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Generate a key or key pair. - /// - /// The key is generated randomly. - /// Its location, usage policy, type and size are taken from \p attributes. + /// Add a message fragment to a multipart MAC operation. /// - /// Implementations must reject an attempt to generate a key of size 0. + /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + /// before calling this function. /// - /// The following type-specific considerations apply: - /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the public exponent is 65537. - /// The modulus is a product of two probabilistic primes - /// between 2^{n-1} and 2^n where n is the bit size specified in the - /// attributes. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param[in] attributes The attributes for the new key. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in,out] operation Active MAC operation. + /// \param[in] input Buffer containing the message fragment to add to + /// the MAC calculation. + /// \param input_length Size of the \p input buffer in bytes. /// /// \retval #PSA_SUCCESS /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_generate_key( - attributes: *const psa_key_attributes_t, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; -} -/// The type of the state data structure for interruptible hash -/// signing operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = -/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_sign_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// operation = psa_sign_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; -/// The type of the state data structure for interruptible hash -/// verification operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = -/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_verify_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// operation = psa_verify_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; -unsafe extern "C" { - /// \brief Set the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note The time taken to execute a single op is - /// implementation specific and depends on - /// software, hardware, the algorithm, key type and - /// curve chosen. Even within a single operation, - /// successive ops can take differing amounts of - /// time. The only guarantee is that lower values - /// for \p max_ops means functions will block for a - /// lesser maximum amount of time. The functions - /// \c psa_sign_interruptible_get_num_ops() and - /// \c psa_verify_interruptible_get_num_ops() are - /// provided to help with tuning this value. - /// - /// \note This value defaults to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which - /// means the whole operation will be done in one - /// go, regardless of the number of ops required. - /// - /// \note If more ops are needed to complete a - /// computation, #PSA_OPERATION_INCOMPLETE will be - /// returned by the function performing the - /// computation. It is then the caller's - /// responsibility to either call again with the - /// same operation context until it returns 0 or an - /// error code; or to call the relevant abort - /// function if the answer is no longer required. - /// - /// \note The interpretation of \p max_ops is also - /// implementation defined. On a hard real time - /// system, this can indicate a hard deadline, as a - /// real-time system needs a guarantee of not - /// spending more than X time, however care must be - /// taken in such an implementation to avoid the - /// situation whereby calls just return, not being - /// able to do any actual work within the allotted - /// time. On a non-real-time system, the - /// implementation can be more relaxed, but again - /// whether this number should be interpreted as as - /// hard or soft limit or even whether a less than - /// or equals as regards to ops executed in a - /// single call is implementation defined. - /// - /// \note For keys in local storage when no accelerator - /// driver applies, please see also the - /// documentation for \c mbedtls_ecp_set_max_ops(), - /// which is the internal implementation in these - /// cases. - /// - /// \warning With implementations that interpret this number - /// as a hard limit, setting this number too small - /// may result in an infinite loop, whereby each - /// call results in immediate return with no ops - /// done (as there is not enough time to execute - /// any), and thus no result will ever be achieved. - /// - /// \note This only applies to functions whose - /// documentation mentions they may return - /// #PSA_OPERATION_INCOMPLETE. - /// - /// \param max_ops The maximum number of ops to be executed in a - /// single call. This can be a number from 0 to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 - /// is the least amount of work done per call. - pub fn psa_interruptible_set_max_ops(max_ops: u32); -} -unsafe extern "C" { - /// \brief Get the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. This will return the last - /// value set by - /// \c psa_interruptible_set_max_ops() or - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if - /// that function has never been called. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \return Maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - pub fn psa_interruptible_get_max_ops() -> u32; + pub fn psa_mac_update( + operation: *mut psa_mac_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash signing - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling - /// \c psa_sign_hash_interruptible_abort() on - /// the operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message. /// - /// \note This interface is guaranteed re-entrant and - /// thus may be called from driver code. + /// The application must call psa_mac_sign_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// \warning Applications should not call this function if they expect + /// a specific value for the MAC. Call psa_mac_verify_finish() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \param operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// \param[in,out] operation Active MAC operation. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. This is always + /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of the key and \c alg is the + /// MAC algorithm that is calculated. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_sign_hash_get_num_ops( - operation: *const psa_sign_hash_interruptible_operation_t, - ) -> u32; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p mac buffer is too small. You can determine a + /// sufficient buffer size by calling PSA_MAC_LENGTH(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac sign + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_sign_finish( + operation: *mut psa_mac_operation_t, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash verification - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling \c - /// psa_verify_hash_interruptible_abort() on the - /// operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message and compare it with + /// an expected value. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// The application must call psa_mac_verify_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). It then + /// compares the calculated MAC with the expected MAC passed as a + /// parameter to this function. /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param operation The \c - /// psa_verify_hash_interruptible_operation_t to - /// use. This must be initialized first. + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual MAC and the expected MAC is performed + /// in constant time. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_verify_hash_get_num_ops( - operation: *const psa_verify_hash_interruptible_operation_t, - ) -> u32; + /// \param[in,out] operation Active MAC operation. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The MAC of the message was calculated successfully, but it + /// differs from the expected MAC. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac verify + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_verify_finish( + operation: *mut psa_mac_operation_t, + mac: *const u8, + mac_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start signing a hash or short message with a - /// private key, in an interruptible manner. + /// Abort a MAC operation. /// - /// \see \c psa_sign_hash_complete() + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_mac_sign_setup() or psa_mac_verify_setup() again. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_mac_operation_t. /// - /// \note This function combined with \c - /// psa_sign_hash_complete() is equivalent to - /// \c psa_sign_hash() but - /// \c psa_sign_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// In particular, calling psa_mac_abort() after the operation has been + /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + /// psa_mac_verify_finish() is safe and has no effect. /// - /// \note Users should call \c psa_sign_hash_complete() - /// repeatedly on the same context after a - /// successful call to this function until \c - /// psa_sign_hash_complete() either returns 0 or an - /// error. \c psa_sign_hash_complete() will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// \param[in,out] operation Initialized MAC operation. /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_sign_hash_abort(). + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Encrypt a message using a symmetric cipher. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// This function encrypts a message with a random IV (initialization + /// vector). Use the multipart operation interface with a + /// #psa_cipher_operation_t object to provide other forms of IV. /// /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. + /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// The output contains the IV followed by + /// the ciphertext proper. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. /// /// \retval #PSA_SUCCESS - /// The operation started successfully - call \c psa_sign_hash_complete() - /// with the same context to complete the operation - /// + /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does - /// not permit the requested algorithm. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// An operation has previously been started on this context, and is - /// still in progress. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Decrypt a message using a symmetric cipher. + /// + /// This function decrypts a message encrypted with a symmetric cipher. + /// + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to decrypt. + /// This consists of the IV followed by the + /// ciphertext proper. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the plaintext is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_start( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt( key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart cipher operations. +/// +/// Before calling any function on a cipher operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_cipher_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_cipher_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, +/// for example: +/// \code +/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_cipher_operation_init() +/// to the structure, for example: +/// \code +/// psa_cipher_operation_t operation; +/// operation = psa_cipher_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// signing a hash or short message with a private - /// key, in an interruptible manner. - /// - /// \see \c psa_sign_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_sign_hash_start() is equivalent to - /// \c psa_sign_hash() but this function can return - /// early and resume according to the limit set with - /// \c psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// Set the key for a multipart symmetric encryption operation. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// The sequence of operations to encrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + /// generate or set the IV (initialization vector). You should use + /// psa_cipher_generate_iv() unless the protocol you are implementing + /// requires a specific IV value. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_sign_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_sign_hash_start() called with it - /// first. + /// After a successful call to psa_cipher_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c - /// key_bits, \c alg) where \c key_type and \c - /// key_bits are the type and bit-size - /// respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// Operation completed successfully - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_sign_hash_start(). - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_sign_hash_start() with this operation object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_sign_hash_complete( - operation: *mut psa_sign_hash_interruptible_operation_t, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Abort a sign hash operation. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function is the only function that clears - /// the number of ops completed as part of the - /// operation. Please ensure you copy this value via - /// \c psa_sign_hash_get_num_ops() if required - /// before calling. - /// - /// \note Aborting an operation frees all associated - /// resources except for the \p operation structure - /// itself. Once aborted, the operation object can - /// be reused for another operation by calling \c - /// psa_sign_hash_start() again. - /// - /// \note You may call this function any time after the - /// operation object has been initialized. In - /// particular, calling \c psa_sign_hash_abort() - /// after the operation has already been terminated - /// by a call to \c psa_sign_hash_abort() or - /// psa_sign_hash_complete() is safe. - /// - /// \param[in,out] operation Initialized sign hash operation. - /// - /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_abort( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_encrypt_setup( + operation: *mut psa_cipher_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start reading and verifying a hash or short - /// message, in an interruptible manner. - /// - /// \see \c psa_verify_hash_complete() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_verify_hash_complete() is equivalent to - /// \c psa_verify_hash() but \c - /// psa_verify_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function. + /// Set the key for a multipart symmetric decryption operation. /// - /// \note Users should call \c psa_verify_hash_complete() - /// repeatedly on the same operation object after a - /// successful call to this function until \c - /// psa_verify_hash_complete() either returns 0 or - /// an error. \c psa_verify_hash_complete() will - /// return #PSA_OPERATION_INCOMPLETE if there is - /// more work to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The sequence of operations to decrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + /// decryption. If the IV is prepended to the ciphertext, you can call + /// psa_cipher_update() on a buffer containing the IV followed by the + /// beginning of the message. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_verify_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// After a successful call to psa_cipher_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. /// \param key Identifier of the key to use for the operation. - /// The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash whose signature is to be verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// The operation started successfully - please call \c - /// psa_verify_hash_complete() with the same context to complete the - /// operation. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// Another operation has already been started on this context, and is - /// still in progress. - /// - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does - /// not permit the requested algorithm. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_start( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt_setup( + operation: *mut psa_cipher_operation_t, key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// reading and verifying a hash or short message - /// signed with a private key, in an interruptible - /// manner. - /// - /// \see \c psa_verify_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// Generate an IV for a symmetric encryption operation. /// - /// \note This function combined with \c - /// psa_verify_hash_start() is equivalent to - /// \c psa_verify_hash() but this function can - /// return early and resume according to the limit - /// set with \c psa_interruptible_set_max_ops() to - /// reduce the maximum time spent in a function - /// call. + /// This function generates a random IV (initialization vector), nonce + /// or initial counter value for the encryption operation as appropriate + /// for the chosen algorithm, key type and key size. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_verify_hash_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_verify_hash_start() called with it - /// first. + /// \param[in,out] operation Active cipher operation. + /// \param[out] iv Buffer where the generated IV is to be written. + /// \param iv_size Size of the \p iv buffer in bytes. + /// \param[out] iv_length On success, the number of bytes of the + /// generated IV. /// /// \retval #PSA_SUCCESS - /// Operation completed successfully, and the passed signature is valid. - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_verify_hash_start(). - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p iv buffer is too small. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_verify_hash_start() on this object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_verify_hash_complete( - operation: *mut psa_verify_hash_interruptible_operation_t, + /// The operation state is not valid (it must be active, with no IV set), + /// or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_generate_iv( + operation: *mut psa_cipher_operation_t, + iv: *mut u8, + iv_size: usize, + iv_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Abort a verify hash operation. + /// Set the IV for a symmetric encryption or decryption operation. /// - /// \warning This is a beta API, and thus subject to change at - /// any point. It is not bound by the usual interface - /// stability promises. + /// This function sets the IV (initialization vector), nonce + /// or initial counter value for the encryption or decryption operation. /// - /// \note This function is the only function that clears the - /// number of ops completed as part of the operation. - /// Please ensure you copy this value via - /// \c psa_verify_hash_get_num_ops() if required - /// before calling. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note Aborting an operation frees all associated - /// resources except for the operation structure - /// itself. Once aborted, the operation object can be - /// reused for another operation by calling \c - /// psa_verify_hash_start() again. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \note You may call this function any time after the - /// operation object has been initialized. - /// In particular, calling \c psa_verify_hash_abort() - /// after the operation has already been terminated by - /// a call to \c psa_verify_hash_abort() or - /// psa_verify_hash_complete() is safe. + /// \note When encrypting, applications should use psa_cipher_generate_iv() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \param[in,out] operation Initialized verify hash operation. + /// \param[in,out] operation Active cipher operation. + /// \param[in] iv Buffer containing the IV to use. + /// \param iv_length Size of the IV in bytes. /// /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p iv is not acceptable for the chosen algorithm, + /// or the chosen algorithm does not use an IV. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be an active cipher + /// encrypt operation, with no IV set), or the library has not been + /// previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_abort( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_set_iv( + operation: *mut psa_cipher_operation_t, + iv: *const u8, + iv_length: usize, ) -> psa_status_t; } -/// \brief The GCM context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_gcm_context { - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, - ///< Precalculated HTable low. - pub private_HL: [u64; 16usize], - ///< Precalculated HTable high. - pub private_HH: [u64; 16usize], - ///< The total length of the encrypted data. - pub private_len: u64, - ///< The total length of the additional data. - pub private_add_len: u64, - ///< The first ECTR for tag. - pub private_base_ectr: [::core::ffi::c_uchar; 16usize], - ///< The Y working value. - pub private_y: [::core::ffi::c_uchar; 16usize], - ///< The buf working value. - pub private_buf: [::core::ffi::c_uchar; 16usize], - ///< The operation to perform: - ///#MBEDTLS_GCM_ENCRYPT or - ///#MBEDTLS_GCM_DECRYPT. - pub private_mode: ::core::ffi::c_int, -} -impl Default for mbedtls_gcm_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes the specified GCM context, - /// to make references valid, and prepares the context - /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + /// Encrypt or decrypt a message fragment in an active cipher operation. /// - /// The function does not bind the GCM context to a particular - /// cipher, nor set the key. For this purpose, use - /// mbedtls_gcm_setkey(). + /// Before calling this function, you must: + /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + /// (recommended when encrypting) or psa_cipher_set_iv(). /// - /// \param ctx The GCM context to initialize. This must not be \c NULL. - pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief This function associates a GCM context with a - /// cipher algorithm and a key. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param cipher The 128-bit block cipher to use. - /// \param key The encryption key. This must be a readable buffer of at - /// least \p keybits bits. - /// \param keybits The key size in bits. Valid options are: - ///
          • 128 bits
            • - ///
          • 192 bits
            • - ///
          • 256 bits
          + /// \param[in,out] operation Active cipher operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A cipher-specific error code on failure. - pub fn mbedtls_gcm_setkey( - ctx: *mut mbedtls_gcm_context, - cipher: mbedtls_cipher_id_t, - key: *const ::core::ffi::c_uchar, - keybits: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_update( + operation: *mut psa_cipher_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs GCM encryption or decryption of a buffer. + /// Finish encrypting or decrypting a message in a cipher operation. /// - /// \note For encryption, the output buffer can be the same as the - /// input buffer. For decryption, the output buffer cannot be - /// the same as input buffer. If the buffers overlap, the output - /// buffer must trail at least 8 Bytes behind the input buffer. + /// The application must call psa_cipher_encrypt_setup() or + /// psa_cipher_decrypt_setup() before calling this function. The choice + /// of setup function determines whether this function encrypts or + /// decrypts its input. /// - /// \warning When this function performs a decryption, it outputs the - /// authentication tag and does not verify that the data is - /// authentic. You should use this function to perform encryption - /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// This function finishes the encryption or decryption of the message + /// formed by concatenating the inputs passed to preceding calls to + /// psa_cipher_update(). /// - /// \param ctx The GCM context to use for encryption or decryption. This - /// must be initialized. - /// \param mode The operation to perform: - /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. - /// The ciphertext is written to \p output and the - /// authentication tag is written to \p tag. - /// - #MBEDTLS_GCM_DECRYPT to perform decryption. - /// The plaintext is written to \p output and the - /// authentication tag is written to \p tag. - /// Note that this mode is not recommended, because it does - /// not verify the authenticity of the data. For this reason, - /// you should use mbedtls_gcm_auth_decrypt() instead of - /// calling this function in decryption mode. - /// \param length The length of the input data, which is equal to the length - /// of the output data. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param input The buffer holding the input data. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size in Bytes. - /// \param output The buffer for holding the output data. If \p length is greater - /// than zero, this must be a writable buffer of at least that - /// size in Bytes. - /// \param tag_len The length of the tag to generate. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \return \c 0 if the encryption or decryption was performed - /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, - /// this does not indicate that the data is authentic. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the encryption - /// or decryption failed. - pub fn mbedtls_gcm_crypt_and_tag( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - tag_len: usize, - tag: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active cipher operation. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input size passed to this operation is not valid for + /// this particular algorithm. For example, the algorithm is a based + /// on block cipher and requires a whole number of blocks, but the + /// total input size is not a multiple of the block size. + /// \retval #PSA_ERROR_INVALID_PADDING + /// This is a decryption operation for an algorithm that includes + /// padding, and the ciphertext does not contain valid padding. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_finish( + operation: *mut psa_cipher_operation_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs a GCM authenticated decryption of a - /// buffer. + /// Abort a cipher operation. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. /// - /// \param ctx The GCM context. This must be initialized. - /// \param length The length of the ciphertext to decrypt, which is also - /// the length of the decrypted plaintext. - /// \param iv The initialization vector. This must be a readable buffer - /// of at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param tag The buffer holding the tag to verify. This must be a - /// readable buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to verify. - /// \param input The buffer holding the ciphertext. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size. - /// \param output The buffer for holding the decrypted plaintext. If \p length - /// is greater than zero, this must be a writable buffer of at - /// least that size. + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_cipher_operation_t. /// - /// \return \c 0 if successful and authenticated. - /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the decryption - /// failed. - pub fn mbedtls_gcm_auth_decrypt( - ctx: *mut mbedtls_gcm_context, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - tag: *const ::core::ffi::c_uchar, - tag_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// In particular, calling psa_cipher_abort() after the operation has been + /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() + /// is safe and has no effect. + /// + /// \param[in,out] operation Initialized cipher operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a GCM encryption or decryption - /// operation. + /// Process an authenticated encryption operation. /// - /// \param ctx The GCM context. This must be initialized. - /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or - /// #MBEDTLS_GCM_DECRYPT. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that will be authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] plaintext Data that will be authenticated and + /// encrypted. + /// \param plaintext_length Size of \p plaintext in bytes. + /// \param[out] ciphertext Output buffer for the authenticated and + /// encrypted data. The additional data is not + /// part of this output. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate outputs, the + /// authentication tag is appended to the + /// encrypted data. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p plaintext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + /// plaintext_length) evaluates to the maximum + /// ciphertext size of any supported AEAD + /// encryption. + /// \param[out] ciphertext_length On success, the size of the output + /// in the \p ciphertext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_starts( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p ciphertext_size is too small. + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p plaintext_length) or + /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + plaintext: *const u8, + plaintext_length: usize, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer as associated data - /// (authenticated but not encrypted data) in a GCM - /// encryption or decryption operation. - /// - /// Call this function after mbedtls_gcm_starts() to pass - /// the associated data. If the associated data is empty, - /// you do not need to call this function. You may not - /// call this function after calling mbedtls_cipher_update(). + /// Process an authenticated decryption operation. /// - /// \param ctx The GCM context. This must have been started with - /// mbedtls_gcm_starts() and must not have yet received - /// any input with mbedtls_gcm_update(). - /// \param add The buffer holding the additional data, or \c NULL - /// if \p add_len is \c 0. - /// \param add_len The length of the additional data. If \c 0, - /// \p add may be \c NULL. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that has been authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] ciphertext Data that has been authenticated and + /// encrypted. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate inputs, the buffer + /// must contain the encrypted data followed + /// by the authentication tag. + /// \param ciphertext_length Size of \p ciphertext in bytes. + /// \param[out] plaintext Output buffer for the decrypted data. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p ciphertext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + /// ciphertext_length) evaluates to the maximum + /// plaintext size of any supported AEAD + /// decryption. + /// \param[out] plaintext_length On success, the size of the output + /// in the \p plaintext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_update_ad( - ctx: *mut mbedtls_gcm_context, - add: *const ::core::ffi::c_uchar, - add_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The ciphertext is not authentic. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p plaintext_size is too small. + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p ciphertext_length) or + /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + /// to determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + ciphertext: *const u8, + ciphertext_length: usize, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for multipart AEAD operations. +/// +/// Before calling any function on an AEAD operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_aead_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_aead_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, +/// for example: +/// \code +/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_aead_operation_init() +/// to the structure, for example: +/// \code +/// psa_aead_operation_t operation; +/// operation = psa_aead_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing GCM - /// encryption or decryption operation. - /// - /// You may call this function zero, one or more times - /// to pass successive parts of the input: the plaintext to - /// encrypt, or the ciphertext (not including the tag) to - /// decrypt. After the last part of the input, call - /// mbedtls_gcm_finish(). + /// Set the key for a multipart authenticated encryption operation. /// - /// This function may produce output in one of the following - /// ways: - /// - Immediate output: the output length is always equal - /// to the input length. - /// - Buffered output: the output consists of a whole number - /// of 16-byte blocks. If the total input length so far - /// (not including associated data) is 16 \* *B* + *A* - /// with *A* < 16 then the total output length is 16 \* *B*. + /// The sequence of operations to encrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + /// generate or set the nonce. You should use + /// psa_aead_generate_nonce() unless the protocol you are implementing + /// requires a specific nonce value. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the message to encrypt each time. + /// -# Call psa_aead_finish(). /// - /// In particular: - /// - It is always correct to call this function with - /// \p output_size >= \p input_length + 15. - /// - If \p input_length is a multiple of 16 for all the calls - /// to this function during an operation, then it is - /// correct to use \p output_size = \p input_length. + /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// After a successful call to psa_aead_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_finish(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param input The buffer holding the input data. If \p input_length - /// is greater than zero, this must be a readable buffer - /// of at least \p input_length bytes. - /// \param input_length The length of the input data in bytes. - /// \param output The buffer for the output data. If \p output_size - /// is greater than zero, this must be a writable buffer of - /// of at least \p output_size bytes. - /// \param output_size The size of the output buffer in bytes. - /// See the function description regarding the output size. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// total input length too long, - /// unsupported input/output buffer overlap detected, - /// or \p output_size too small. - pub fn mbedtls_gcm_update( - ctx: *mut mbedtls_gcm_context, - input: *const ::core::ffi::c_uchar, - input_length: usize, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the GCM operation and generates - /// the authentication tag. + /// Set the key for a multipart authenticated decryption operation. /// - /// It wraps up the GCM stream, and generates the - /// tag. The tag can have a maximum length of 16 Bytes. + /// The sequence of operations to decrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call psa_aead_set_nonce() with the nonce for the decryption. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the ciphertext to decrypt each time. + /// -# Call psa_aead_verify(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to generate. This must be at least - /// four. - /// \param output The buffer for the final output. - /// If \p output_size is nonzero, this must be a writable - /// buffer of at least \p output_size bytes. - /// \param output_size The size of the \p output buffer in bytes. - /// This must be large enough for the output that - /// mbedtls_gcm_update() has not produced. In particular: - /// - If mbedtls_gcm_update() produces immediate output, - /// or if the total input size is a multiple of \c 16, - /// then mbedtls_gcm_finish() never produces any output, - /// so \p output_size can be \c 0. - /// - \p output_size never needs to be more than \c 15. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// invalid value of \p tag_len, - /// or \p output_size too small. - pub fn mbedtls_gcm_finish( - ctx: *mut mbedtls_gcm_context, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - tag: *mut ::core::ffi::c_uchar, - tag_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function clears a GCM context and the underlying - /// cipher sub-context. + /// After a successful call to psa_aead_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_verify(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context to clear. If this is \c NULL, the call has - /// no effect. Otherwise, this must be initialized. - pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief The GCM checkup routine. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; -/// For encrypt-decrypt functions, whether the operation is an encryption -/// or a decryption. -pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; -/// \brief MD5 context structure -/// -/// \warning MD5 is considered a weak message digest and its use -/// constitutes a security risk. We recommend considering -/// stronger message digests instead. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md5_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 4usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_md5_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize MD5 context + /// Generate a random nonce for an authenticated encryption operation. /// - /// \param ctx MD5 context to be initialized + /// This function generates a random nonce for the authenticated encryption + /// operation with an appropriate size for the chosen algorithm, key type + /// and key size. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief Clear MD5 context + /// The application must call psa_aead_encrypt_setup() before + /// calling this function. /// - /// \param ctx MD5 context to be cleared + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); + /// \param[in,out] operation Active AEAD operation. + /// \param[out] nonce Buffer where the generated nonce is to be + /// written. + /// \param nonce_size Size of the \p nonce buffer in bytes. + /// \param[out] nonce_length On success, the number of bytes of the + /// generated nonce. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p nonce buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active aead encrypt + /// operation, with no nonce set), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_generate_nonce( + operation: *mut psa_aead_operation_t, + nonce: *mut u8, + nonce_size: usize, + nonce_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) an MD5 context + /// Set the nonce for an authenticated encryption or decryption operation. /// - /// \param dst The destination context - /// \param src The context to be cloned + /// This function sets the nonce for the authenticated + /// encryption or decryption operation. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief MD5 context setup + /// The application must call psa_aead_encrypt_setup() or + /// psa_aead_decrypt_setup() before calling this function. /// - /// \param ctx context to be initialized + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \note When encrypting, applications should use psa_aead_generate_nonce() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] nonce Buffer containing the nonce to use. + /// \param nonce_length Size of the nonce in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p nonce is not acceptable for the chosen algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with no nonce + /// set), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_nonce( + operation: *mut psa_aead_operation_t, + nonce: *const u8, + nonce_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process buffer + /// Declare the lengths of the message and additional data for AEAD. /// - /// \param ctx MD5 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// The application must call this function before calling + /// psa_aead_update_ad() or psa_aead_update() if the algorithm for + /// the operation requires it. If the algorithm does not require it, + /// calling this function is optional, but if this function is called + /// then the implementation must enforce the lengths. /// - /// \return 0 if successful + /// You may call this function before or after setting the nonce with + /// psa_aead_set_nonce() or psa_aead_generate_nonce(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_update( - ctx: *mut mbedtls_md5_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief MD5 final digest + /// - For #PSA_ALG_CCM, calling this function is required. + /// - For the other AEAD algorithms defined in this specification, calling + /// this function is not required. + /// - For vendor-defined algorithm, refer to the vendor documentation. /// - /// \param ctx MD5 context - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \param[in,out] operation Active AEAD operation. + /// \param ad_length Size of the non-encrypted additional + /// authenticated data in bytes. + /// \param plaintext_length Size of the plaintext to encrypt in bytes. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_finish( - ctx: *mut mbedtls_md5_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// At least one of the lengths is not acceptable for the chosen + /// algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and + /// psa_aead_update_ad() and psa_aead_update() must not have been + /// called yet), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_lengths( + operation: *mut psa_aead_operation_t, + ad_length: usize, + plaintext_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process data block (internal use only) + /// Pass additional data to an active AEAD operation. /// - /// \param ctx MD5 context - /// \param data buffer holding one block of data + /// Additional data is authenticated, but not encrypted. /// - /// \return 0 if successful + /// You may call this function multiple times to pass successive fragments + /// of the additional data. You may not call this function after passing + /// data to encrypt or decrypt with psa_aead_update(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_internal_md5_process( - ctx: *mut mbedtls_md5_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = MD5( input buffer ) + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + /// treat the input as untrusted and prepare to undo any action that + /// depends on the input if psa_aead_verify() returns an error status. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the fragment of + /// additional data. + /// \param input_length Size of the \p input buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input length overflows the additional data length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, have lengths set if required by the algorithm, and + /// psa_aead_update() must not have been called yet), or the library + /// has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update_ad( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Encrypt or decrypt a message fragment in an active AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + /// 3. Call psa_aead_update_ad() to pass all the additional data. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief RIPEMD-160 context structure -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ripemd160_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 5usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_ripemd160_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize RIPEMD-160 context + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \param ctx RIPEMD-160 context to be initialized - pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); -} -unsafe extern "C" { - /// \brief Clear RIPEMD-160 context + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + /// - Do not use the output in any way other than storing it in a + /// confidential location. If you take any action that depends + /// on the tentative decrypted data, this action will need to be + /// undone if the input turns out not to be valid. Furthermore, + /// if an adversary can observe that this action took place + /// (for example through timing), they may be able to use this + /// fact as an oracle to decrypt any message encrypted with the + /// same key. + /// - In particular, do not copy the output anywhere but to a + /// memory or storage space that you have exclusive access to. /// - /// \param ctx RIPEMD-160 context to be cleared - pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); + /// This function does not require the input to be aligned to any + /// particular block boundary. If the implementation can only process + /// a whole block at a time, it must consume all the input provided, but + /// it may delay the end of the corresponding output until a subsequent + /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + /// provides sufficient input. The amount of data that can be delayed + /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + /// \c alg, \p input_length) where + /// \c key_type is the type of key and \c alg is + /// the algorithm that were used to set up the + /// operation. + /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + /// input_length) evaluates to the maximum + /// output size of any supported AEAD + /// algorithm. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total input length overflows the plaintext length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, and have lengths set if required by the algorithm), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) a RIPEMD-160 context + /// Finish encrypting a message in an AEAD operation. /// - /// \param dst The destination context - /// \param src The context to be cloned - pub fn mbedtls_ripemd160_clone( - dst: *mut mbedtls_ripemd160_context, - src: *const mbedtls_ripemd160_context, - ); -} -unsafe extern "C" { - /// \brief RIPEMD-160 context setup + /// The operation must have been set up with psa_aead_encrypt_setup(). /// - /// \param ctx context to be initialized + /// This function finishes the authentication of the additional data + /// formed by concatenating the inputs passed to preceding calls to + /// psa_aead_update_ad() with the plaintext formed by concatenating the + /// inputs passed to preceding calls to psa_aead_update(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process buffer + /// This function has two output buffers: + /// - \p ciphertext contains trailing ciphertext that was buffered from + /// preceding calls to psa_aead_update(). + /// - \p tag contains the authentication tag. /// - /// \param ctx RIPEMD-160 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_update( - ctx: *mut mbedtls_ripemd160_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[out] ciphertext Buffer where the last part of the ciphertext + /// is to be written. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] ciphertext_length On success, the number of bytes of + /// returned ciphertext. + /// \param[out] tag Buffer where the authentication tag is + /// to be written. + /// \param tag_size Size of the \p tag buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + /// key_type, \c key_bits, \c alg) where + /// \c key_type and \c key_bits are the type and + /// bit-size of the key, and \c alg is the + /// algorithm that were used in the call to + /// psa_aead_encrypt_setup(). + /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + /// maximum tag size of any supported AEAD + /// algorithm. + /// \param[out] tag_length On success, the number of bytes + /// that make up the returned tag. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p ciphertext or \p tag buffer is too small. + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + /// determine the required \p tag buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active encryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_finish( + operation: *mut psa_aead_operation_t, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + tag: *mut u8, + tag_size: usize, + tag_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief RIPEMD-160 final digest + /// Finish authenticating and decrypting a message in an AEAD operation. /// - /// \param ctx RIPEMD-160 context - /// \param output RIPEMD-160 checksum result + /// The operation must have been set up with psa_aead_decrypt_setup(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_finish( - ctx: *mut mbedtls_ripemd160_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process data block (internal use only) + /// This function finishes the authenticated decryption of the message + /// components: /// - /// \param ctx RIPEMD-160 context - /// \param data buffer holding one block of data + /// - The additional data consisting of the concatenation of the inputs + /// passed to preceding calls to psa_aead_update_ad(). + /// - The ciphertext consisting of the concatenation of the inputs passed to + /// preceding calls to psa_aead_update(). + /// - The tag passed to this function call. /// - /// \return 0 if successful - pub fn mbedtls_internal_ripemd160_process( - ctx: *mut mbedtls_ripemd160_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = RIPEMD-160( input buffer ) + /// If the authentication tag is correct, this function outputs any remaining + /// plaintext and reports success. If the authentication tag is not correct, + /// this function returns #PSA_ERROR_INVALID_SIGNATURE. /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output RIPEMD-160 checksum result + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual tag and the expected tag is performed + /// in constant time. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[out] plaintext Buffer where the last part of the plaintext + /// is to be written. This is the remaining data + /// from previous calls to psa_aead_update() + /// that could not be processed until the end + /// of the input. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] plaintext_length On success, the number of bytes of + /// returned plaintext. + /// \param[in] tag Buffer containing the authentication tag. + /// \param tag_length Size of the \p tag buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculations were successful, but the authentication tag is + /// not correct. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p plaintext buffer is too small. + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + /// required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active decryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_verify( + operation: *mut psa_aead_operation_t, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + tag: *const u8, + tag_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Abort an AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed - pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha1_context { - pub work_area: [::core::ffi::c_uchar; 208usize], -} -impl Default for mbedtls_sha1_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_aead_operation_t. + /// + /// In particular, calling psa_aead_abort() after the operation has been + /// terminated by a call to psa_aead_abort(), psa_aead_finish() or + /// psa_aead_verify() is safe and has no effect. + /// + /// \param[in,out] operation Initialized AEAD operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-1 context. - /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \brief Sign a message with a private key. For hash-and-sign algorithms, + /// this includes the hashing step. /// - /// \param ctx The SHA-1 context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-1 context. + /// \note To perform a multi-part hash-and-sign signature algorithm, first use + /// a multi-part hash operation and then pass the resulting hash to + /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + /// hash algorithm to use. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in] key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The input message to sign. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param[in] signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. /// - /// \param ctx The SHA-1 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it is - /// not \c NULL, it must point to an initialized - /// SHA-1 context. - pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-1 context. + /// \brief Verify the signature of a message with a public key, using + /// a hash-and-sign verification algorithm. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \note To perform a multi-part hash-and-sign signature verification + /// algorithm, first use a multi-part hash operation to hash the message + /// and then pass the resulting hash to psa_verify_hash(). + /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + /// to use. /// - /// \param dst The SHA-1 context to clone to. This must be initialized. - /// \param src The SHA-1 context to clone from. This must be initialized. - pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); + /// \param[in] key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The message whose signature is to be verified. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed signature + /// is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-1 checksum calculation. + /// \brief Sign a hash or short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context to initialize. This must be initialized. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. + /// \param[out] signature_length On success, the number of bytes + /// that make up the returned signature value. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing SHA-1 - /// checksum calculation. + /// \brief Verify the signature of a hash or short message using a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. + /// \param key Identifier of the key to use for the operation. It + /// must be a public key or an asymmetric key pair. The + /// key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message whose signature is to be + /// verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_update( - ctx: *mut mbedtls_sha1_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// The signature is valid. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the SHA-1 operation, and writes - /// the result to the output buffer. + /// \brief Encrypt a short message with a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized and - /// have a hash operation started. - /// \param output The SHA-1 checksum result. This must be a writable - /// buffer of length \c 20 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the encrypted message is to + /// be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_finish( - ctx: *mut mbedtls_sha1_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief SHA-1 process data block (internal use only). + /// \brief Decrypt a short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. It must + /// allow the usage #PSA_KEY_USAGE_DECRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized. - /// \param data The data block being processed. This must be a - /// readable buffer of length \c 64 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha1_process( - ctx: *mut mbedtls_sha1_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for key derivation operations. +/// +/// Before calling any function on a key derivation operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_key_derivation_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, +/// for example: +/// \code +/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_key_derivation_operation_init() +/// to the structure, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// operation = psa_key_derivation_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_key_derivation_operation_t = psa_key_derivation_s; unsafe extern "C" { - /// \brief This function calculates the SHA-1 checksum of a buffer. + /// Set up a key derivation operation. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// A key derivation algorithm takes some inputs and uses them to generate + /// a byte stream in a deterministic way. + /// This byte stream can be used to produce keys and other + /// cryptographic material. /// - /// The SHA-1 result is calculated as - /// output = SHA-1(input buffer). + /// To derive a key: + /// -# Start with an initialized object of type #psa_key_derivation_operation_t. + /// -# Call psa_key_derivation_setup() to select the algorithm. + /// -# Provide the inputs for the key derivation by calling + /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + /// as appropriate. Which inputs are needed, in what order, and whether + /// they may be keys and if so of what type depends on the algorithm. + /// -# Optionally set the operation's maximum capacity with + /// psa_key_derivation_set_capacity(). You may do this before, in the middle + /// of or after providing inputs. For some algorithms, this step is mandatory + /// because the output depends on the maximum capacity. + /// -# To derive a key, call psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// To derive a byte string for a different purpose, call + /// psa_key_derivation_output_bytes(). + /// Successive calls to these functions use successive output bytes + /// calculated by the key derivation algorithm. + /// -# Clean up the key derivation operation object with + /// psa_key_derivation_abort(). /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// If this function returns an error, the key derivation operation object is + /// not changed. /// - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. - /// \param output The SHA-1 checksum result. - /// This must be a writable buffer of length \c 20 Bytes. + /// If an error occurs at any step after a call to psa_key_derivation_setup(), + /// the operation will need to be reset by a call to psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-1 checkup routine. + /// Implementations must reject an attempt to derive a key of size 0. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in,out] operation The key derivation operation object + /// to set up. It must + /// have been initialized but not set up yet. + /// \param alg The key derivation algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha256_context { - pub work_area: [::core::ffi::c_uchar; 208usize], - pub is224: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha256_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c alg is not a key derivation algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_setup( + operation: *mut psa_key_derivation_operation_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-256 context. + /// Retrieve the current capacity of a key derivation operation. /// - /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. - pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-256 context. + /// The capacity of a key derivation is the maximum number of bytes that it can + /// return. When you get *N* bytes of output from a key derivation operation, + /// this reduces its capacity by *N*. /// - /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which - /// case this function returns immediately. If it is not \c NULL, - /// it must point to an initialized SHA-256 context. - pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clones the state of a SHA-256 context. + /// \param[in] operation The operation to query. + /// \param[out] capacity On success, the capacity of the operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha256_clone( - dst: *mut mbedtls_sha256_context, - src: *const mbedtls_sha256_context, - ); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_get_capacity( + operation: *const psa_key_derivation_operation_t, + capacity: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-224 or SHA-256 checksum - /// calculation. + /// Set the maximum capacity of a key derivation operation. /// - /// \param ctx The context to use. This must be initialized. - /// \param is224 This determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// The capacity of a key derivation operation is the maximum number of bytes + /// that the key derivation operation can return from this point onwards. /// - /// \note is224 must be defined accordingly to the enabled - /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to modify. + /// \param capacity The new capacity of the operation. + /// It must be less or equal to the operation's + /// current capacity. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_starts( - ctx: *mut mbedtls_sha256_context, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p capacity is larger than the operation's current capacity. + /// In this case, the operation object remains valid and its capacity + /// remains unchanged. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_set_capacity( + operation: *mut psa_key_derivation_operation_t, + capacity: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-256 checksum calculation. + /// Provide an input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_update( - ctx: *mut mbedtls_sha256_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-256 operation, and writes - /// the result to the output buffer. + /// This function passes direct inputs, which is usually correct for + /// non-secret inputs. To pass a secret input, which should be in a key + /// object, call psa_key_derivation_input_key() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_finish( - ctx: *mut mbedtls_sha256_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] data Input data to use. + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow direct inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_bytes( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + data: *const u8, + data_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-256 computation. This function is for - /// internal use only. + /// Provide a numeric input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized. - /// \param data The buffer holding one block of data. This must - /// be a readable buffer of length \c 64 Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// However, when an algorithm requires a particular order, numeric inputs + /// usually come first as they tend to be configuration parameters. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha256_process( - ctx: *mut mbedtls_sha256_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// This function is used for inputs which are fixed-size non-negative + /// integers. + /// + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] value The value of the numeric input. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow numeric inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_integer( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + value: u64, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function calculates the SHA-224 or SHA-256 - /// checksum of a buffer. + /// Provide an input for key derivation in the form of a key. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// The SHA-256 result is calculated as - /// output = SHA-256(input buffer). + /// This function obtains input from a key object, which is usually correct for + /// secret inputs or for non-secret personalization strings kept in the key + /// store. To pass a non-secret parameter which is not in the key store, + /// call psa_key_derivation_input_bytes() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. - /// \param is224 Determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param key Identifier of the key. It must have an + /// appropriate type for step and must allow the + /// usage #PSA_KEY_USAGE_DERIVE or + /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + /// and the algorithm used by the operation. + /// + /// \note Once all inputs steps are completed, the operations will allow: + /// - psa_key_derivation_output_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + /// if the input for step + /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_verify_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + /// - psa_key_derivation_verify_key() under the same conditions as + /// psa_key_derivation_verify_bytes(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key allows neither #PSA_KEY_USAGE_DERIVE nor + /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + /// algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow key inputs of the given type + /// or does not allow key inputs at all. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_key( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + key: mbedtls_svc_key_id_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief The SHA-224 checkup routine. + /// Perform a key agreement and use the shared secret as input to a key + /// derivation. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-256 checkup routine. + /// A key agreement algorithm takes two inputs: a private key \p private_key + /// a public key \p peer_key. + /// The result of this function is passed as input to a key derivation. + /// The output of this key derivation can be extracted by reading from the + /// resulting operation to produce keys and other cryptographic material. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha512_context { - pub work_area: [::core::ffi::c_uchar; 304usize], - pub is384: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha512_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief This function initializes a SHA-512 context. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \param ctx The SHA-512 context to initialize. This must - /// not be \c NULL. - pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-512 context. + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() with a + /// key agreement and derivation algorithm + /// \c alg (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + /// is false). + /// The operation must be ready for an + /// input of the type given by \p step. + /// \param step Which step the input data is for. + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. The peer key must be in the + /// same format that psa_import_key() accepts for the + /// public key type corresponding to the type of + /// private_key. That is, this function performs the + /// equivalent of + /// #psa_import_key(..., + /// `peer_key`, `peer_key_length`) where + /// with key attributes indicating the public key + /// type corresponding to the type of `private_key`. + /// For example, for EC keys, this means that peer_key + /// is interpreted as a point on the curve that the + /// private key is on. The standard formats for public + /// keys are documented in the documentation of + /// psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. /// - /// \param ctx The SHA-512 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must point to an initialized - /// SHA-512 context. - pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c private_key is not compatible with \c alg, + /// or \p peer_key is not valid for \c alg or not compatible with + /// \c private_key, or \c step does not allow an input resulting + /// from a key agreement. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this key agreement \p step, + /// or the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_key_agreement( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-512 context. + /// Read some data from a key derivation operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha512_clone( - dst: *mut mbedtls_sha512_context, - src: *const mbedtls_sha512_context, - ); -} -unsafe extern "C" { - /// \brief This function starts a SHA-384 or SHA-512 checksum - /// calculation. + /// This function calculates output bytes from a key derivation algorithm and + /// return those bytes. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the requested number of bytes from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context to use. This must be initialized. - /// \param is384 Determines which function to use. This must be - /// either \c 0 for SHA-512, or \c 1 for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \note is384 must be defined accordingly to the enabled - /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] output Buffer where the output will be written. + /// \param output_length Number of bytes to output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_starts( - ctx: *mut mbedtls_sha512_context, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// no output is written to the output buffer. + /// The operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_bytes( + operation: *mut psa_key_derivation_operation_t, + output: *mut u8, + output_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-512 checksum calculation. + /// Derive a key from an ongoing key derivation operation. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. This must - /// be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// This function calculates output bytes from a key derivation algorithm + /// and uses those bytes to generate a key deterministically. + /// The key's location, usage policy, type and size are taken from + /// \p attributes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_update( - ctx: *mut mbedtls_sha512_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-512 operation, and writes - /// the result to the output buffer. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads as many bytes as required from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_finish( - ctx: *mut mbedtls_sha512_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-512 computation. - /// This function is for internal use only. + /// How much output is produced and consumed from the operation, and how + /// the key is derived, depends on the key type and on the key size + /// (denoted \c bits below): /// - /// \param ctx The SHA-512 context. This must be initialized. - /// \param data The buffer holding one block of data. This - /// must be a readable buffer of length \c 128 Bytes. + /// - For key types for which the key is an arbitrary sequence of bytes + /// of a given size, this function is functionally equivalent to + /// calling #psa_key_derivation_output_bytes + /// and passing the resulting output to #psa_import_key. + /// However, this function has a security benefit: + /// if the implementation provides an isolation boundary then + /// the key material is not exposed outside the isolation boundary. + /// As a consequence, for these key types, this function always consumes + /// exactly (\c bits / 8) bytes from the operation. + /// The following key types defined in this specification follow this scheme: /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha512_process( - ctx: *mut mbedtls_sha512_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function calculates the SHA-512 or SHA-384 - /// checksum of a buffer. + /// - #PSA_KEY_TYPE_AES; + /// - #PSA_KEY_TYPE_ARIA; + /// - #PSA_KEY_TYPE_CAMELLIA; + /// - #PSA_KEY_TYPE_DERIVE; + /// - #PSA_KEY_TYPE_HMAC; + /// - #PSA_KEY_TYPE_PASSWORD_HASH. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// - For ECC keys on a Montgomery elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Montgomery curve), this function always draws a byte string whose + /// length is determined by the curve, and sets the mandatory bits + /// accordingly. That is: /// - /// The SHA-512 result is calculated as - /// output = SHA-512(input buffer). + /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + /// string and process it as specified in RFC 7748 §5. + /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + /// string and process it as specified in RFC 7748 §5. /// - /// \param input The buffer holding the input data. This must be - /// a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. - /// \param is384 Determines which function to use. This must be either - /// \c 0 for SHA-512, or \c 1 for SHA-384. + /// - For key types for which the key is represented by a single sequence of + /// \c bits bits with constraints as to which bit sequences are acceptable, + /// this function draws a byte string of length (\c bits / 8) bytes rounded + /// up to the nearest whole number of bytes. If the resulting byte string + /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + /// This process is repeated until an acceptable byte string is drawn. + /// The byte string drawn from the operation is interpreted as specified + /// for the output produced by psa_export_key(). + /// The following key types defined in this specification follow this scheme: /// - /// \note is384 must be defined accordingly with the supported - /// symbols in the config file. If: - /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or - /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined - /// then the function will return - /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// - #PSA_KEY_TYPE_DES. + /// Force-set the parity bits, but discard forbidden weak keys. + /// For 2-key and 3-key triple-DES, the three keys are generated + /// successively (for example, for 3-key triple-DES, + /// if the first 8 bytes specify a weak key and the next 8 bytes do not, + /// discard the first 8 bytes, use the next 8 bytes as the first key, + /// and continue reading output from the operation to derive the other + /// two keys). + /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + /// where \c group designates any Diffie-Hellman group) and + /// ECC keys on a Weierstrass elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Weierstrass curve). + /// For these key types, interpret the byte string as integer + /// in big-endian order. Discard it if it is not in the range + /// [0, *N* - 2] where *N* is the boundary of the private key domain + /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + /// or the order of the curve's base point for ECC). + /// Add 1 to the resulting integer and use this as the private key *x*. + /// This method allows compliance to NIST standards, specifically + /// the methods titled "key-pair generation by testing candidates" + /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + /// in FIPS 186-4 §B.1.2 for DSA, and + /// in NIST SP 800-56A §5.6.1.2.2 or + /// FIPS 186-4 §B.4.2 for elliptic curve keys. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-384 checkup routine. + /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + /// the way in which the operation output is consumed is + /// implementation-defined. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-512 checkup routine. + /// In all cases, the data that is read is discarded from the operation. + /// The operation's capacity is decreased by the number of bytes read. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hash_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub md5: mbedtls_md5_context, - pub ripemd160: mbedtls_ripemd160_context, - pub sha1: mbedtls_sha1_context, - pub sha256: mbedtls_sha256_context, - pub sha512: mbedtls_sha512_context, -} -impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_hash_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_cipher_operation_t { - pub private_alg: psa_algorithm_t, - pub private_iv_length: u8, - pub private_block_length: u8, - pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_cipher: mbedtls_cipher_context_t, -} -impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_cipher_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_hash_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_hash_operation_t, -} -impl Default for psa_driver_hash_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_cipher_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, -} -impl Default for psa_driver_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_hash_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h. - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. the driver context is not active, in use). - pub private_id: ::core::ffi::c_uint, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_hash_context_t, -} -impl Default for psa_hash_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_cipher_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_default_iv_length: u8, - pub private_ctx: psa_driver_cipher_context_t, + /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + /// the input to that step must be provided with psa_key_derivation_input_key(). + /// Future versions of this specification may include additional restrictions + /// on the derived key based on the attributes and strength of the secret key. + /// + /// \note This function is equivalent to calling + /// psa_key_derivation_output_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for psa_cipher_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// See the description of psa_key_derivation_out_key() for the operation of + /// this function with the default production parameters. + /// Mbed TLS currently does not currently support any non-default production + /// parameters. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_custom( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl psa_cipher_operation_s { - #[inline] - pub fn private_iv_required(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_iv_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_iv_required: ::core::ffi::c_uint, - private_iv_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; - private_iv_required as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; - private_iv_set as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] params Customization parameters for the key derivation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// Mbed TLS currently only supports the default + /// production parameters, i.e. + /// #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + /// for all key types. + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_ext( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hmac_operation_t { - /// The HMAC algorithm in use - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - /// The hash context. - pub hash_ctx: psa_hash_operation_s, - /// The HMAC part of the context. - pub private_opad: [u8; 128usize], +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value in constant time. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the expected number of bytes from the + /// stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to the following code: + /// \code + /// psa_key_derivation_output_bytes(operation, tmp, output_length); + /// if (memcmp(output, tmp, output_length) != 0) + /// return PSA_ERROR_INVALID_SIGNATURE; + /// \endcode + /// except (1) it works even if the key's policy does not allow outputting the + /// bytes, and (2) the comparison will be done in constant time. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected Buffer containing the expected derivation output. + /// \param expected_length Length of the expected output; this is also the + /// number of bytes that will be read. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but it differs from the expected + /// output. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_bytes( + operation: *mut psa_key_derivation_operation_t, + expected: *const u8, + expected_length: usize, + ) -> psa_status_t; } -impl Default for mbedtls_psa_hmac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value + /// stored in a key object. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value, provided as key of type + /// #PSA_KEY_TYPE_PASSWORD_HASH. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the number of bytes corresponding to the + /// length of the expected value from the stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to exporting the key and calling + /// psa_key_derivation_verify_bytes() on the result, except that it + /// works even if the key cannot be exported. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + /// containing the expected output. Its policy must + /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + /// and the permitted algorithm must match the + /// operation. The value of this key was likely + /// computed by a previous call to + /// psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but if differs from the expected + /// output. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// The key passed as the expected value does not exist. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key passed as the expected value has an invalid type. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key passed as the expected value does not allow this usage or + /// this algorithm; or one of the inputs was a key whose policy didn't + /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// the length of the expected value. In this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_key( + operation: *mut psa_key_derivation_operation_t, + expected: psa_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_mac_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// Abort a key derivation operation. + /// + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_key_derivation_setup() again. + /// + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_key_derivation_operation_t. + /// + /// In particular, it is valid to call psa_key_derivation_abort() twice, or to + /// call psa_key_derivation_abort() on an operation that has not been set up. + /// + /// \param[in,out] operation The operation to abort. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) + -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_hmac: mbedtls_psa_hmac_operation_t, - pub private_cmac: mbedtls_cipher_context_t, +unsafe extern "C" { + /// Perform a key agreement and return the raw shared secret. + /// + /// \warning The raw result of a key agreement algorithm such as finite-field + /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + /// not be used directly as key material. It should instead be passed as + /// input to a key derivation algorithm. To chain a key agreement with + /// a key derivation, use psa_key_derivation_key_agreement() and other + /// functions from the key derivation interface. + /// + /// \param alg The key agreement algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + /// is true). + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. It must be + /// in the same format that psa_import_key() + /// accepts. The standard formats for public + /// keys are documented in the documentation + /// of psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a key agreement algorithm, or + /// \p private_key is not compatible with \p alg, + /// or \p peer_key is not valid for \p alg or not compatible with + /// \p private_key. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p output_size is too small + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not a supported key agreement algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_raw_key_agreement( + alg: psa_algorithm_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Generate random bytes. + /// + /// \warning This function **can** fail! Callers MUST check the return status + /// and MUST NOT use the content of the output buffer if the return + /// status is not #PSA_SUCCESS. + /// + /// \note To generate a key, use psa_generate_key() instead. + /// + /// \param[out] output Output buffer for the generated data. + /// \param output_size Number of bytes to generate and output. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair. + /// + /// The key is generated randomly. + /// Its location, usage policy, type and size are taken from \p attributes. + /// + /// Implementations must reject an attempt to generate a key of size 0. + /// + /// The following type-specific considerations apply: + /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + /// the public exponent is 65537. + /// The modulus is a product of two probabilistic primes + /// between 2^{n-1} and 2^n where n is the bit size specified in the + /// attributes. + /// + /// \note This function is equivalent to calling psa_generate_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key( + attributes: *const psa_key_attributes_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// See the description of psa_generate_key() for the operation of this + /// function with the default production parameters. In addition, this function + /// supports the following production customizations, described in more detail + /// in the documentation of ::psa_custom_key_parameters_t: + /// + /// - RSA keys: generation with a custom public exponent. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_custom( + attributes: *const psa_key_attributes_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_aead_operation_t { - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_tag_length: u8, - pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] params Customization parameters for the key generation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_ext( + attributes: *const psa_key_attributes_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub private_ccm: mbedtls_ccm_context, - pub private_gcm: mbedtls_gcm_context, - pub private_chachapoly: mbedtls_chachapoly_context, +/// The type of the state data structure for interruptible hash +/// signing operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = +/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_sign_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// operation = psa_sign_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; +/// The type of the state data structure for interruptible hash +/// verification operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = +/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_verify_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// operation = psa_verify_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; +unsafe extern "C" { + /// \brief Set the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note The time taken to execute a single op is + /// implementation specific and depends on + /// software, hardware, the algorithm, key type and + /// curve chosen. Even within a single operation, + /// successive ops can take differing amounts of + /// time. The only guarantee is that lower values + /// for \p max_ops means functions will block for a + /// lesser maximum amount of time. The functions + /// \c psa_sign_interruptible_get_num_ops() and + /// \c psa_verify_interruptible_get_num_ops() are + /// provided to help with tuning this value. + /// + /// \note This value defaults to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + /// means the whole operation will be done in one + /// go, regardless of the number of ops required. + /// + /// \note If more ops are needed to complete a + /// computation, #PSA_OPERATION_INCOMPLETE will be + /// returned by the function performing the + /// computation. It is then the caller's + /// responsibility to either call again with the + /// same operation context until it returns 0 or an + /// error code; or to call the relevant abort + /// function if the answer is no longer required. + /// + /// \note The interpretation of \p max_ops is also + /// implementation defined. On a hard real time + /// system, this can indicate a hard deadline, as a + /// real-time system needs a guarantee of not + /// spending more than X time, however care must be + /// taken in such an implementation to avoid the + /// situation whereby calls just return, not being + /// able to do any actual work within the allotted + /// time. On a non-real-time system, the + /// implementation can be more relaxed, but again + /// whether this number should be interpreted as as + /// hard or soft limit or even whether a less than + /// or equals as regards to ops executed in a + /// single call is implementation defined. + /// + /// \note For keys in local storage when no accelerator + /// driver applies, please see also the + /// documentation for \c mbedtls_ecp_set_max_ops(), + /// which is the internal implementation in these + /// cases. + /// + /// \warning With implementations that interpret this number + /// as a hard limit, setting this number too small + /// may result in an infinite loop, whereby each + /// call results in immediate return with no ops + /// done (as there is not enough time to execute + /// any), and thus no result will ever be achieved. + /// + /// \note This only applies to functions whose + /// documentation mentions they may return + /// #PSA_OPERATION_INCOMPLETE. + /// + /// \param max_ops The maximum number of ops to be executed in a + /// single call. This can be a number from 0 to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + /// is the least amount of work done per call. + pub fn psa_interruptible_set_max_ops(max_ops: u32); } -impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. This will return the last + /// value set by + /// \c psa_interruptible_set_max_ops() or + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + /// that function has never been called. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \return Maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + pub fn psa_interruptible_get_max_ops() -> u32; } -impl Default for mbedtls_psa_aead_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash signing + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling + /// \c psa_sign_hash_interruptible_abort() on + /// the operation, a value of 0 will be returned. + /// + /// \note This interface is guaranteed re-entrant and + /// thus may be called from driver code. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_sign_hash_get_num_ops( + operation: *const psa_sign_hash_interruptible_operation_t, + ) -> u32; } -impl mbedtls_psa_aead_operation_t { - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash verification + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling \c + /// psa_verify_hash_interruptible_abort() on the + /// operation, a value of 0 will be returned. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c + /// psa_verify_hash_interruptible_operation_t to + /// use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_verify_hash_get_num_ops( + operation: *const psa_verify_hash_interruptible_operation_t, + ) -> u32; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_sign_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Start signing a hash or short message with a + /// private key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_complete() is equivalent to + /// \c psa_sign_hash() but + /// \c psa_sign_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call \c psa_sign_hash_complete() + /// repeatedly on the same context after a + /// successful call to this function until \c + /// psa_sign_hash_complete() either returns 0 or an + /// error. \c psa_sign_hash_complete() will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - call \c psa_sign_hash_complete() + /// with the same context to complete the operation + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + /// not permit the requested algorithm. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation has previously been started on this context, and is + /// still in progress. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_start( + operation: *mut psa_sign_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_verify_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Continue and eventually complete the action of + /// signing a hash or short message with a private + /// key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_start() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_start() is equivalent to + /// \c psa_sign_hash() but this function can return + /// early and resume according to the limit set with + /// \c psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_sign_hash_start() called with it + /// first. + /// + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + /// key_bits, \c alg) where \c key_type and \c + /// key_bits are the type and bit-size + /// respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. + /// + /// \retval #PSA_SUCCESS + /// Operation completed successfully + /// + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \c key. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_sign_hash_start(). + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_sign_hash_start() with this operation object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_sign_hash_complete( + operation: *mut psa_sign_hash_interruptible_operation_t, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } -///< Client -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; -///< Server -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; -/// Roles in the EC J-PAKE exchange -pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; -/// EC J-PAKE context structure. -/// -/// J-PAKE is a symmetric protocol, except for the identifiers used in -/// Zero-Knowledge Proofs, and the serialization of the second message -/// (KeyExchange) as defined by the Thread spec. -/// -/// In order to benefit from this symmetry, we choose a different naming -/// convention from the Thread v1.0 spec. Correspondence is indicated in the -/// description as a pair C: client name, S: server name -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecjpake_context { - ///< Hash to use - pub private_md_type: mbedtls_md_type_t, - ///< Elliptic curve - pub private_grp: mbedtls_ecp_group, - ///< Are we client or server? - pub private_role: mbedtls_ecjpake_role, - ///< Format for point export - pub private_point_format: ::core::ffi::c_int, - ///< My public key 1 C: X1, S: X3 - pub private_Xm1: mbedtls_ecp_point, - ///< My public key 2 C: X2, S: X4 - pub private_Xm2: mbedtls_ecp_point, - ///< Peer public key 1 C: X3, S: X1 - pub private_Xp1: mbedtls_ecp_point, - ///< Peer public key 2 C: X4, S: X2 - pub private_Xp2: mbedtls_ecp_point, - ///< Peer public key C: Xs, S: Xc - pub private_Xp: mbedtls_ecp_point, - ///< My private key 1 C: x1, S: x3 - pub private_xm1: mbedtls_mpi, - ///< My private key 2 C: x2, S: x4 - pub private_xm2: mbedtls_mpi, - ///< Pre-shared secret (passphrase) - pub private_s: mbedtls_mpi, +unsafe extern "C" { + /// \brief Abort a sign hash operation. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function is the only function that clears + /// the number of ops completed as part of the + /// operation. Please ensure you copy this value via + /// \c psa_sign_hash_get_num_ops() if required + /// before calling. + /// + /// \note Aborting an operation frees all associated + /// resources except for the \p operation structure + /// itself. Once aborted, the operation object can + /// be reused for another operation by calling \c + /// psa_sign_hash_start() again. + /// + /// \note You may call this function any time after the + /// operation object has been initialized. In + /// particular, calling \c psa_sign_hash_abort() + /// after the operation has already been terminated + /// by a call to \c psa_sign_hash_abort() or + /// psa_sign_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized sign hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_abort( + operation: *mut psa_sign_hash_interruptible_operation_t, + ) -> psa_status_t; } -impl Default for mbedtls_ecjpake_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Start reading and verifying a hash or short + /// message, in an interruptible manner. + /// + /// \see \c psa_verify_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_verify_hash_complete() is equivalent to + /// \c psa_verify_hash() but \c + /// psa_verify_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function. + /// + /// \note Users should call \c psa_verify_hash_complete() + /// repeatedly on the same operation object after a + /// successful call to this function until \c + /// psa_verify_hash_complete() either returns 0 or + /// an error. \c psa_verify_hash_complete() will + /// return #PSA_OPERATION_INCOMPLETE if there is + /// more work to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_verify_hash_abort(). + /// + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash whose signature is to be verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - please call \c + /// psa_verify_hash_complete() with the same context to complete the + /// operation. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// Another operation has already been started on this context, and is + /// still in progress. + /// + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + /// not permit the requested algorithm. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_start( + operation: *mut psa_verify_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize an ECJPAKE context. + /// \brief Continue and eventually complete the action of + /// reading and verifying a hash or short message + /// signed with a private key, in an interruptible + /// manner. /// - /// \param ctx The ECJPAKE context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); -} -unsafe extern "C" { - /// \brief Set up an ECJPAKE context for use. + /// \see \c psa_verify_hash_start() /// - /// \note Currently the only values for hash/curve allowed by the - /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. /// - /// \param ctx The ECJPAKE context to set up. This must be initialized. - /// \param role The role of the caller. This must be either - /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. - /// \param hash The identifier of the hash function to use, - /// for example #MBEDTLS_MD_SHA256. - /// \param curve The identifier of the elliptic curve to use, - /// for example #MBEDTLS_ECP_DP_SECP256R1. - /// \param secret The pre-shared secret (passphrase). This must be - /// a readable not empty buffer of length \p len Bytes. It need - /// only be valid for the duration of this call. - /// \param len The length of the pre-shared secret \p secret. + /// \note This function combined with \c + /// psa_verify_hash_start() is equivalent to + /// \c psa_verify_hash() but this function can + /// return early and resume according to the limit + /// set with \c psa_interruptible_set_max_ops() to + /// reduce the maximum time spent in a function + /// call. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_setup( - ctx: *mut mbedtls_ecjpake_context, - role: mbedtls_ecjpake_role, - hash: mbedtls_md_type_t, - curve: mbedtls_ecp_group_id, - secret: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the point format for future reads and writes. + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. /// - /// \param ctx The ECJPAKE context to configure. - /// \param point_format The point format to use: - /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) - /// or #MBEDTLS_ECP_PF_COMPRESSED. + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_verify_hash_abort(). /// - /// \return \c 0 if successful. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format - /// is invalid. - pub fn mbedtls_ecjpake_set_point_format( - ctx: *mut mbedtls_ecjpake_context, - point_format: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if an ECJPAKE context is ready for use. + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_verify_hash_start() called with it + /// first. /// - /// \param ctx The ECJPAKE context to check. This must be - /// initialized. + /// \retval #PSA_SUCCESS + /// Operation completed successfully, and the passed signature is valid. /// - /// \return \c 0 if the context is ready for use. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. - pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_verify_hash_start(). + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_verify_hash_start() on this object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_verify_hash_complete( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate and write the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \brief Abort a verify hash operation. /// - /// \param ctx The ECJPAKE context to use. This must be - /// initialized and set up. - /// \param buf The buffer to write the contents to. This must be a - /// writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number - /// of Bytes written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \warning This is a beta API, and thus subject to change at + /// any point. It is not bound by the usual interface + /// stability promises. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Read and process the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \note This function is the only function that clears the + /// number of ops completed as part of the operation. + /// Please ensure you copy this value via + /// \c psa_verify_hash_get_num_ops() if required + /// before calling. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up. - /// \param buf The buffer holding the first round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// \note Aborting an operation frees all associated + /// resources except for the operation structure + /// itself. Once aborted, the operation object can be + /// reused for another operation by calling \c + /// psa_verify_hash_start() again. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \note You may call this function any time after the + /// operation object has been initialized. + /// In particular, calling \c psa_verify_hash_abort() + /// after the operation has already been terminated by + /// a call to \c psa_verify_hash_abort() or + /// psa_verify_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized verify hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_abort( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } +pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// \brief Generate and write the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Open a handle to an existing persistent key. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up, and already have performed round one. - /// \param buf The buffer to write the round two contents to. - /// This must be a writable buffer of length \p len Bytes. - /// \param len The size of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Open a handle to a persistent key. A key is persistent if it was created + /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + /// always has a nonzero key identifier, set with psa_set_key_id() when + /// creating the key. Implementations may provide additional pre-provisioned + /// keys that can be opened with psa_open_key(). Such keys have an application + /// key identifier in the vendor range, as documented in the description of + /// #psa_key_id_t. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// The application must eventually close the handle with psa_close_key() or + /// psa_destroy_key() to release associated resources. If the application dies + /// without calling one of these functions, the implementation should perform + /// the equivalent of a call to psa_close_key(). + /// + /// Some implementations permit an application to open the same key multiple + /// times. If this is successful, each call to psa_open_key() will return a + /// different key handle. + /// + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. + /// + /// \note Applications that rely on opening a key multiple times will not be + /// portable to implementations that only permit a single key handle to be + /// opened. See also :ref:\`key-handles\`. + /// + /// + /// \param key The persistent identifier of the key. + /// \param[out] handle On success, a handle to the key. + /// + /// \retval #PSA_SUCCESS + /// Success. The application can now use the value of `*handle` + /// to access the key. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY + /// The implementation does not have sufficient resources to open the + /// key. This can be due to reaching an implementation limit on the + /// number of open keys, the number of open key handles, or available + /// memory. + /// \retval #PSA_ERROR_DOES_NOT_EXIST + /// There is no persistent key with key identifier \p key. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid persistent key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The specified key exists, but the application does not have the + /// permission to access it. Note that this specification does not + /// define any way to create such a key, but it may be possible + /// through implementation-specific means. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Read and process the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Close a key handle. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up and already have performed round one. - /// \param buf The buffer holding the second round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// If the handle designates a volatile key, this will destroy the key material + /// and free all associated resources, just like psa_destroy_key(). /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Derive the shared secret - /// (TLS: Pre-Master Secret). + /// If this is the last open handle to a persistent key, then closing the handle + /// will free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and can be opened again later + /// with a call to psa_open_key(). /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Closing the key handle makes the handle invalid, and the key handle + /// must not be used again by the application. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_derive_secret( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write the shared key material to be passed to a Key - /// Derivation Function as described in RFC8236. + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \note If the key handle was used to set up an active + /// :ref:\`multipart operation \`, then closing the + /// key handle can cause the multipart operation to fail. Applications should + /// maintain the key handle until after the multipart operation has finished. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_shared_key( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This clears an ECJPAKE context and frees any - /// embedded data structure. + /// \param handle The key handle to close. + /// If this is \c 0, do nothing and return \c PSA_SUCCESS. /// - /// \param ctx The ECJPAKE context to free. This may be \c NULL, - /// in which case this function does nothing. If it is not - /// \c NULL, it must point to an initialized ECJPAKE context. - pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); + /// \retval #PSA_SUCCESS + /// \p handle was a valid handle or \c 0. It is now closed. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p handle is not a valid handle nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// \brief Library deinitialization. /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_pake_operation_t { - pub private_alg: psa_algorithm_t, - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: u8, - pub private_buffer: [u8; 336usize], - pub private_buffer_length: usize, - pub private_buffer_offset: usize, - pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_jpake: mbedtls_ecjpake_context, -} -impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_pake_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_mac_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_mac_operation_t, -} -impl Default for psa_driver_mac_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_aead_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_aead_operation_t, -} -impl Default for psa_driver_aead_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_sign_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, -} -impl Default for psa_driver_sign_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_verify_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, -} -impl Default for psa_driver_verify_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_pake_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_pake_operation_t, -} -impl Default for psa_driver_pake_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// This function clears all data associated with the PSA layer, + /// including the whole key store. + /// This function is not thread safe, it wipes every key slot regardless of + /// state and reader count. It should only be called when no slot is in use. + /// + /// This is an Mbed TLS extension. + pub fn mbedtls_psa_crypto_free(); } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. #[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_mac_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_mac_size: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_mac_context_t, +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_stats_s { + /// Number of slots containing key material for a volatile key. + pub private_volatile_slots: usize, + /// Number of slots containing key material for a key which is in + /// internal persistent storage. + pub private_persistent_slots: usize, + /// Number of slots containing a reference to a key in a + /// secure element. + pub private_external_slots: usize, + /// Number of slots which are occupied, but do not contain + /// key material yet. + pub private_half_filled_slots: usize, + /// Number of slots that contain cache data. + pub private_cache_slots: usize, + /// Number of slots that are not used for anything. + pub private_empty_slots: usize, + /// Number of slots that are locked. + pub private_locked_slots: usize, + /// Largest key id value among open keys in internal persistent storage. + pub private_max_open_internal_key_id: psa_key_id_t, + /// Largest key id value among open keys in secure elements. + pub private_max_open_external_key_id: psa_key_id_t, } -impl Default for psa_mac_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. +pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; +unsafe extern "C" { + /// \brief Get statistics about + /// resource consumption related to the PSA keystore. + /// + /// \note When Mbed TLS is built as part of a service, with isolation + /// between the application and the keystore, the service may or + /// may not expose this function. + pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); } -impl psa_mac_operation_s { - #[inline] - pub fn private_is_sign(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_sign: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; - private_is_sign as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Inject an initial entropy seed for the random generator into + /// secure storage. + /// + /// This function injects data to be used as a seed for the random generator + /// used by the PSA Crypto implementation. On devices that lack a trusted + /// entropy source (preferably a hardware random number generator), + /// the Mbed PSA Crypto implementation uses this value to seed its + /// random generator. + /// + /// On devices without a trusted entropy source, this function must be + /// called exactly once in the lifetime of the device. On devices with + /// a trusted entropy source, calling this function is optional. + /// In all cases, this function may only be called before calling any + /// other function in the PSA Crypto API, including psa_crypto_init(). + /// + /// When this function returns successfully, it populates a file in + /// persistent storage. Once the file has been created, this function + /// can no longer succeed. + /// + /// If any error occurs, this function does not change the system state. + /// You can call this function again after correcting the reason for the + /// error if possible. + /// + /// \warning This function **can** fail! Callers MUST check the return status. + /// + /// \warning If you use this function, you should use it as part of a + /// factory provisioning process. The value of the injected seed + /// is critical to the security of the device. It must be + /// *secret*, *unpredictable* and (statistically) *unique per device*. + /// You should be generate it randomly using a cryptographically + /// secure random generator seeded from trusted entropy sources. + /// You should transmit it securely to the device and ensure + /// that its value is not leaked or stored anywhere beyond the + /// needs of transmitting it from the point of generation to + /// the call of this function, and erase all copies of the value + /// once this function returns. + /// + /// This is an Mbed TLS extension. + /// + /// \note This function is only available on the following platforms: + /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + /// Note that you must provide compatible implementations of + /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. + /// * In a client-server integration of PSA Cryptography, on the client side, + /// if the server supports this feature. + /// \param[in] seed Buffer containing the seed value to inject. + /// \param[in] seed_size Size of the \p seed buffer. + /// The size of the seed in bytes must be greater + /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + /// in `library/entropy_poll.h` in the Mbed TLS source + /// code. + /// It must be less or equal to + /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + /// + /// \retval #PSA_SUCCESS + /// The seed value was injected successfully. The random generator + /// of the PSA Crypto implementation is now ready for use. + /// You may now call psa_crypto_init() and use the PSA Crypto + /// implementation. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p seed_size is out of range. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// There was a failure reading or writing from storage. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The library has already been initialized. It is no longer + /// possible to call this function. + pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_aead_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub private_ad_remaining: usize, - pub private_body_remaining: usize, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_ctx: psa_driver_aead_context_t, +unsafe extern "C" { + /// External random generator function, implemented by the platform. + /// + /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + /// this function replaces Mbed TLS's entropy and DRBG modules for all + /// random generation triggered via PSA crypto interfaces. + /// + /// \note This random generator must deliver random numbers with cryptographic + /// quality and high performance. It must supply unpredictable numbers + /// with a uniform distribution. The implementation of this function + /// is responsible for ensuring that the random generator is seeded + /// with sufficient entropy. If you have a hardware TRNG which is slow + /// or delivers non-uniform output, declare it as an entropy source + /// with mbedtls_entropy_add_source() instead of enabling this option. + /// + /// \param[in,out] context Pointer to the random generator context. + /// This is all-bits-zero on the first call + /// and preserved between successive calls. + /// \param[out] output Output buffer. On success, this buffer + /// contains random data with a uniform + /// distribution. + /// \param output_size The size of the \p output buffer in bytes. + /// \param[out] output_length On success, set this value to \p output_size. + /// + /// \retval #PSA_SUCCESS + /// Success. The output buffer contains \p output_size bytes of + /// cryptographic-quality random data, and \c *output_length is + /// set to \p output_size. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + /// The random generator requires extra entropy and there is no + /// way to obtain entropy under current environment conditions. + /// This error should not happen under normal circumstances since + /// this function is responsible for obtaining as much entropy as + /// it needs. However implementations of this function may return + /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + /// entropy without blocking indefinitely. + /// \retval #PSA_ERROR_HARDWARE_FAILURE + /// A failure of the random generator hardware that isn't covered + /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. + pub fn mbedtls_psa_external_get_random( + context: *mut mbedtls_psa_external_random_context_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_aead_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// A slot number identifying a key in a driver. +/// +/// Values of this type are used to identify built-in keys. +pub type psa_drv_slot_number_t = u64; +unsafe extern "C" { + /// Check if PSA is capable of handling the specified hash algorithm. + /// + /// This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + /// set and that psa_crypto_init has already been called. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the algorithm. + /// This might be improved in the future. + /// + /// \param hash_alg The hash algorithm. + /// + /// \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + pub fn psa_can_do_hash(hash_alg: psa_algorithm_t) -> ::core::ffi::c_int; } -impl psa_aead_operation_s { - #[inline] - pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_ad_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_body_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(3usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 3usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 3usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(4usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 4usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 4usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_nonce_set: ::core::ffi::c_uint, - private_lengths_set: ::core::ffi::c_uint, - private_ad_started: ::core::ffi::c_uint, - private_body_started: ::core::ffi::c_uint, - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; - private_nonce_set as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; - private_lengths_set as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; - private_ad_started as u64 - }); - __bindgen_bitfield_unit.set(3usize, 1u8, { - let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; - private_body_started as u64 - }); - __bindgen_bitfield_unit.set(4usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Tell if PSA is ready for this cipher. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the key type and algorithm. + /// This might be improved in the future. + /// + /// \param key_type The key type. + /// \param cipher_alg The cipher algorithm. + /// + /// \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + pub fn psa_can_do_cipher( + key_type: psa_key_type_t, + cipher_alg: psa_algorithm_t, + ) -> ::core::ffi::c_int; +} +/// \brief Encoding of the application role of PAKE +/// +/// Encodes the application's role in the algorithm is being executed. For more +/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX +/// constants. +pub type psa_pake_role_t = u8; +/// Encoding of input and output indicators for PAKE. +/// +/// Some PAKE algorithms need to exchange more data than just a single key share. +/// This type is for encoding additional input and output data for such +/// algorithms. +pub type psa_pake_step_t = u8; +/// Encoding of the type of the PAKE's primitive. +/// +/// Values defined by this standard will never be in the range 0x80-0xff. +/// Vendors who define additional types must use an encoding in this range. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_primitive_type_t = u8; +/// \brief Encoding of the family of the primitive associated with the PAKE. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_family_t = u8; +/// \brief Encoding of the primitive associated with the PAKE. +/// +/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. +pub type psa_pake_primitive_t = u32; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_pake_cipher_suite_s { + pub algorithm: psa_algorithm_t, + pub type_: psa_pake_primitive_type_t, + pub family: psa_pake_family_t, + pub bits: u16, + pub hash: psa_algorithm_t, } #[repr(C)] -#[repr(align(16))] #[derive(Copy, Clone)] -pub struct psa_hkdf_key_derivation_t { - pub private_info: *mut u8, - pub private_info_length: usize, - pub private_offset_in_block: u8, - pub private_block_number: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_output_block: [u8; 64usize], - pub private_prk: [u8; 64usize], - pub __bindgen_padding_0: [u64; 0usize], - pub private_hmac: psa_mac_operation_s, +pub struct psa_crypto_driver_pake_inputs_s { + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_user: *mut u8, + pub private_user_len: usize, + pub private_peer: *mut u8, + pub private_peer_len: usize, + pub private_attributes: psa_key_attributes_t, + pub private_cipher_suite: psa_pake_cipher_suite_s, } -impl Default for psa_hkdf_key_derivation_t { +impl Default for psa_crypto_driver_pake_inputs_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17057,126 +18119,97 @@ impl Default for psa_hkdf_key_derivation_t { } } } -impl psa_hkdf_key_derivation_t { - #[inline] - pub fn private_state(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } - } - #[inline] - pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 2u8, val as u64) - } - } - #[inline] - pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 2u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 2u8, - val as u64, - ) - } - } - #[inline] - pub fn private_info_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { +pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = + 10; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = + 11; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; +pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; +pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; +pub const psa_jpake_round_PSA_JPAKE_FIRST: psa_jpake_round = 0; +pub const psa_jpake_round_PSA_JPAKE_SECOND: psa_jpake_round = 1; +pub const psa_jpake_round_PSA_JPAKE_FINISHED: psa_jpake_round = 2; +pub type psa_jpake_round = ::core::ffi::c_uint; +pub use self::psa_jpake_round as psa_jpake_round_t; +pub const psa_jpake_io_mode_PSA_JPAKE_INPUT: psa_jpake_io_mode = 0; +pub const psa_jpake_io_mode_PSA_JPAKE_OUTPUT: psa_jpake_io_mode = 1; +pub type psa_jpake_io_mode = ::core::ffi::c_uint; +pub use self::psa_jpake_io_mode as psa_jpake_io_mode_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_jpake_computation_stage_s { + pub private_round: psa_jpake_round_t, + pub private_io_mode: psa_jpake_io_mode_t, + pub private_inputs: u8, + pub private_outputs: u8, + pub private_step: psa_pake_step_t, +} +impl Default for psa_jpake_computation_stage_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_pake_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_primitive: psa_pake_primitive_t, + pub private_stage: u8, + pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, + pub private_data: psa_pake_operation_s__bindgen_ty_2, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_pake_operation_s__bindgen_ty_1 { + pub private_dummy: u8, + pub private_jpake: psa_jpake_computation_stage_s, +} +impl Default for psa_pake_operation_s__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub fn new_bitfield_1( - private_state: ::core::ffi::c_uint, - private_info_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 2u8, { - let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; - private_state as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; - private_info_set as u64 - }); - __bindgen_bitfield_unit - } -} -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_tls12_ecjpake_to_pms_t { - pub private_data: [u8; 32usize], } -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: - psa_tls12_prf_key_derivation_state_t = 0; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: - psa_tls12_prf_key_derivation_state_t = 1; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 2; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 3; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: - psa_tls12_prf_key_derivation_state_t = 4; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: - psa_tls12_prf_key_derivation_state_t = 5; -pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct psa_tls12_prf_key_derivation_s { - pub private_left_in_block: u8, - pub private_block_number: u8, - pub private_state: psa_tls12_prf_key_derivation_state_t, - pub private_secret: *mut u8, - pub private_secret_length: usize, - pub private_seed: *mut u8, - pub private_seed_length: usize, - pub private_label: *mut u8, - pub private_label_length: usize, - pub private_other_secret: *mut u8, - pub private_other_secret_length: usize, - pub private_Ai: [u8; 64usize], - pub private_output_block: [u8; 64usize], +pub union psa_pake_operation_s__bindgen_ty_2 { + pub private_ctx: psa_driver_pake_context_t, + pub private_inputs: psa_crypto_driver_pake_inputs_s, } -impl Default for psa_tls12_prf_key_derivation_s { +impl Default for psa_pake_operation_s__bindgen_ty_2 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for psa_pake_operation_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17185,1462 +18218,1629 @@ impl Default for psa_tls12_prf_key_derivation_s { } } } -pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_key_derivation_s { - pub private_alg: psa_algorithm_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_capacity: usize, - pub __bindgen_padding_0: [u64; 0usize], - pub private_ctx: psa_key_derivation_s__bindgen_ty_1, +/// The type of the data structure for PAKE cipher suites. +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; +/// The type of the state data structure for PAKE operations. +/// +/// Before calling any function on a PAKE operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_pake_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_pake_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, +/// for example: +/// \code +/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_pake_operation_init() +/// to the structure, for example: +/// \code +/// psa_pake_operation_t operation; +/// operation = psa_pake_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_operation_t = psa_pake_operation_s; +/// The type of input values for PAKE operations. +pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; +/// The type of computation stage for J-PAKE operations. +pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; +unsafe extern "C" { + /// Get the length of the password in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] password_len Password length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + password_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the password from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] buffer Return buffer for password. + /// \param buffer_size Size of the return buffer in bytes. + /// \param[out] buffer_length Actual size of the password in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password( + inputs: *const psa_crypto_driver_pake_inputs_t, + buffer: *mut u8, + buffer_size: usize, + buffer_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the user id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_len User id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_user_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the peer id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_len Peer id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_peer_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_len: *mut usize, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_key_derivation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_hkdf: psa_hkdf_key_derivation_t, - pub private_tls12_prf: psa_tls12_prf_key_derivation_t, - pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +unsafe extern "C" { + /// Get the user id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_id User id. + /// \param user_id_size Size of \p user_id in bytes. + /// \param[out] user_id_len Size of the user id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p user_id is too small. + pub fn psa_crypto_driver_pake_get_user( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_id: *mut u8, + user_id_size: usize, + user_id_len: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the peer id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_id Peer id. + /// \param peer_id_size Size of \p peer_id in bytes. + /// \param[out] peer_id_length Size of the peer id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p peer_id is too small. + pub fn psa_crypto_driver_pake_get_peer( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_id: *mut u8, + peer_id_size: usize, + peer_id_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the cipher suite from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] cipher_suite Return buffer for role. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Cipher_suite hasn't been set yet. + pub fn psa_crypto_driver_pake_get_cipher_suite( + inputs: *const psa_crypto_driver_pake_inputs_t, + cipher_suite: *mut psa_pake_cipher_suite_t, + ) -> psa_status_t; } -impl psa_key_derivation_s { - #[inline] - pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_can_output_key: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_can_output_key: u32 = - unsafe { ::core::mem::transmute(private_can_output_key) }; - private_can_output_key as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Set the session information for a password-authenticated key exchange. + /// + /// The sequence of operations to set up a password-authenticated key exchange + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_pake_operation_t, e.g. + /// #PSA_PAKE_OPERATION_INIT. + /// -# Call psa_pake_setup() to specify the cipher suite. + /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the + /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + /// to be called depends on the algorithm in use. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// A typical sequence of calls to perform a password-authenticated key + /// exchange: + /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + /// key share that needs to be sent to the peer. + /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + /// the key share that was received from the peer. + /// -# Depending on the algorithm additional calls to psa_pake_output() and + /// psa_pake_input() might be necessary. + /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// If an error occurs at any step after a call to psa_pake_setup(), + /// the operation will need to be reset by a call to psa_pake_abort(). The + /// application may call psa_pake_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_pake_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A call to psa_pake_abort(). + /// - A successful call to psa_pake_get_implicit_key(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized but not set up yet. + /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + /// characterizes a PAKE algorithm and determines + /// the algorithm as well.) + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the + /// PAKE primitive in \p cipher_suite is not compatible with the + /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + /// or not compatible with the PAKE algorithm and primitive. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, + /// or the PAKE primitive in \p cipher_suite is not supported or not + /// compatible with the PAKE algorithm, or the hash algorithm in + /// \p cipher_suite is not supported or not compatible with the PAKE + /// algorithm and primitive. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_setup( + operation: *mut psa_pake_operation_t, + cipher_suite: *const psa_pake_cipher_suite_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_key_policy_s { - pub private_usage: psa_key_usage_t, - pub private_alg: psa_algorithm_t, - pub private_alg2: psa_algorithm_t, +unsafe extern "C" { + /// Set the password for a password-authenticated key exchange from key ID. + /// + /// Call this function when the password, or a value derived from the password, + /// is already present in the key store. + /// + /// \param[in,out] operation The operation object to set the password for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the password hasn't + /// been set yet (psa_pake_set_password_key() + /// hasn't been called yet). + /// \param password Identifier of the key holding the password or a + /// value derived from the password (eg. by a + /// memory-hard function). It must remain valid + /// until the operation terminates. It must be of + /// type #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + /// the usage #PSA_KEY_USAGE_DERIVE. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p password is not a valid key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + /// permit the \p operation's algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + /// the \p operation's cipher suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size of \p password is not supported with the + /// \p operation's cipher suite. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must have been set up.), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_password_key( + operation: *mut psa_pake_operation_t, + password: mbedtls_svc_key_id_t, + ) -> psa_status_t; } -pub type psa_key_policy_t = psa_key_policy_s; -pub type psa_key_bits_t = u16; -/// A mask of flags that can be stored in key attributes. -/// -/// This type is also used internally to store flags in slots. Internal -/// flags are defined in library/psa_crypto_core.h. Internal flags may have -/// the same value as external flags if they are properly handled during -/// key creation and in psa_get_key_attributes. -pub type psa_key_attributes_flag_t = u16; -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_core_key_attributes_t { - pub private_type: psa_key_type_t, - pub private_bits: psa_key_bits_t, - pub private_lifetime: psa_key_lifetime_t, - pub private_id: mbedtls_svc_key_id_t, - pub private_policy: psa_key_policy_t, - pub private_flags: psa_key_attributes_flag_t, +unsafe extern "C" { + /// Set the user ID for a password-authenticated key exchange. + /// + /// Call this function to set the user ID. For PAKE algorithms that associate a + /// user identifier with each side of the session you need to call + /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single + /// user identifier with the session, call psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the user ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the user ID hasn't + /// been set (psa_pake_set_user() hasn't been + /// called yet). + /// \param[in] user_id The user ID to authenticate with. + /// \param user_id_len Size of the \p user_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p user_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The value of \p user_id is not supported by the implementation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_user( + operation: *mut psa_pake_operation_t, + user_id: *const u8, + user_id_len: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_key_attributes_s { - pub private_core: psa_core_key_attributes_t, - pub private_domain_parameters: *mut ::core::ffi::c_void, - pub private_domain_parameters_size: usize, +unsafe extern "C" { + /// Set the peer ID for a password-authenticated key exchange. + /// + /// Call this function in addition to psa_pake_set_user() for PAKE algorithms + /// that associate a user identifier with each side of the session. For PAKE + /// algorithms that associate a single user identifier with the session, call + /// psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the peer ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the peer ID hasn't + /// been set (psa_pake_set_peer() hasn't been + /// called yet). + /// \param[in] peer_id The peer's ID to authenticate. + /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p peer_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm doesn't associate a second identity with the session. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// Calling psa_pake_set_peer() is invalid with the \p operation's + /// algorithm, the operation state is not valid, or the library has not + /// been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_peer( + operation: *mut psa_pake_operation_t, + peer_id: *const u8, + peer_id_len: usize, + ) -> psa_status_t; } -impl Default for psa_key_attributes_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Set the application role for a password-authenticated key exchange. + /// + /// Not all PAKE algorithms need to differentiate the communicating entities. + /// It is optional to call this function for PAKEs that don't require a role + /// to be specified. For such PAKEs the application role parameter is ignored, + /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \param[in,out] operation The operation object to specify the + /// application's role for. It must have been set up + /// by psa_pake_setup() and not yet in use (neither + /// psa_pake_output() nor psa_pake_input() has been + /// called yet). It must be on operation for which + /// the application's role hasn't been specified + /// (psa_pake_set_role() hasn't been called yet). + /// \param role A value of type ::psa_pake_role_t indicating the + /// application's role in the PAKE the algorithm + /// that is being set up. For more information see + /// the documentation of \c PSA_PAKE_ROLE_XXX + /// constants. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The \p role is not a valid PAKE role in the \p operation’s algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The \p role for this algorithm is not supported or is not valid. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_role( + operation: *mut psa_pake_operation_t, + role: psa_pake_role_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Set domain parameters for a key. + /// Get output for a step of a password-authenticated key exchange. /// - /// Some key types require additional domain parameters in addition to - /// the key type identifier and the key size. Use this function instead - /// of psa_set_key_type() when you need to specify domain parameters. + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. /// - /// The format for the required domain parameters varies based on the key type. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the domain parameter data consists of the public exponent, - /// represented as a big-endian integer with no leading zeros. - /// This information is used when generating an RSA key pair. - /// When importing a key, the public exponent is read from the imported - /// key data and the exponent recorded in the attribute structure is ignored. - /// As an exception, the public exponent 65537 is represented by an empty - /// byte string. - /// - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR), - /// the `Dss-Params` format as defined by RFC 3279 §2.3.2. - /// ``` - /// Dss-Params ::= SEQUENCE { - /// p INTEGER, - /// q INTEGER, - /// g INTEGER - /// } - /// ``` - /// - For Diffie-Hellman key exchange keys - /// (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or - /// #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the - /// `DomainParameters` format as defined by RFC 3279 §2.3.3. - /// ``` - /// DomainParameters ::= SEQUENCE { - /// p INTEGER, -- odd prime, p=jq +1 - /// g INTEGER, -- generator, g - /// q INTEGER, -- factor of p-1 - /// j INTEGER OPTIONAL, -- subgroup factor - /// validationParams ValidationParams OPTIONAL - /// } - /// ValidationParams ::= SEQUENCE { - /// seed BIT STRING, - /// pgenCounter INTEGER - /// } - /// ``` + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step of the algorithm for which the output is + /// requested. + /// \param[out] output Buffer where the output is to be written in the + /// format appropriate for this \p step. Refer to + /// the documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param output_size Size of the \p output buffer in bytes. This must + /// be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + /// primitive, \p output_step) where \c alg and + /// \p primitive are the PAKE algorithm and primitive + /// in the operation's cipher suite, and \p step is + /// the output step. + /// + /// \param[out] output_length On success, the number of bytes of the returned + /// output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p step is not compatible with the operation's algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step is not supported with the operation's algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_output( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Provide input for a step of a password-authenticated key exchange. + /// + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. + /// + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \param[in,out] attributes Attribute structure where the specified domain - /// parameters will be stored. - /// If this function fails, the content of - /// \p attributes is not modified. - /// \param type Key type (a \c PSA_KEY_TYPE_XXX value). - /// \param[in] data Buffer containing the key domain parameters. - /// The content of this buffer is interpreted - /// according to \p type as described above. - /// \param data_length Size of the \p data buffer in bytes. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step for which the input is provided. + /// \param[in] input Buffer containing the input in the format + /// appropriate for this \p step. Refer to the + /// documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p input_length is not compatible with the \p operation’s algorithm, + /// or the \p input is not valid for the \p operation's algorithm, + /// cipher suite or \p step. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step p is not supported with the \p operation's algorithm, or the + /// \p input is not supported for the \p operation's algorithm, cipher + /// suite or \p step. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - pub fn psa_set_key_domain_parameters( - attributes: *mut psa_key_attributes_t, - type_: psa_key_type_t, - data: *const u8, - data_length: usize, + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_input( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + input: *const u8, + input_length: usize, ) -> psa_status_t; } -/// \brief The context for PSA interruptible hash signing. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_sign_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_sign_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_sign_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_sign_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -/// \brief The context for PSA interruptible hash verification. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_verify_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_verify_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_verify_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_verify_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// Open a handle to an existing persistent key. - /// - /// Open a handle to a persistent key. A key is persistent if it was created - /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key - /// always has a nonzero key identifier, set with psa_set_key_id() when - /// creating the key. Implementations may provide additional pre-provisioned - /// keys that can be opened with psa_open_key(). Such keys have an application - /// key identifier in the vendor range, as documented in the description of - /// #psa_key_id_t. + /// Get implicitly confirmed shared secret from a PAKE. /// - /// The application must eventually close the handle with psa_close_key() or - /// psa_destroy_key() to release associated resources. If the application dies - /// without calling one of these functions, the implementation should perform - /// the equivalent of a call to psa_close_key(). + /// At this point there is a cryptographic guarantee that only the authenticated + /// party who used the same password is able to compute the key. But there is no + /// guarantee that the peer is the party it claims to be and was able to do so. /// - /// Some implementations permit an application to open the same key multiple - /// times. If this is successful, each call to psa_open_key() will return a - /// different key handle. + /// That is, the authentication is only implicit. Since the peer is not + /// authenticated yet, no action should be taken yet that assumes that the peer + /// is who it claims to be. For example, do not access restricted files on the + /// peer's behalf until an explicit authentication has succeeded. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function can be called after the key exchange phase of the operation + /// has completed. It imports the shared secret output of the PAKE into the + /// provided derivation operation. The input step + /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + /// material in the key derivation operation. /// - /// \note Applications that rely on opening a key multiple times will not be - /// portable to implementations that only permit a single key handle to be - /// opened. See also :ref:\`key-handles\`. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// + /// When this function returns successfully, \p operation becomes inactive. + /// If this function returns an error status, both \p operation + /// and \c key_derivation operations enter an error state and must be aborted by + /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. /// - /// \param key The persistent identifier of the key. - /// \param[out] handle On success, a handle to the key. + /// \param[in,out] operation Active PAKE operation. + /// \param[out] output A key derivation operation that is ready + /// for an input step of type + /// #PSA_KEY_DERIVATION_INPUT_SECRET. /// /// \retval #PSA_SUCCESS - /// Success. The application can now use the value of `*handle` - /// to access the key. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY - /// The implementation does not have sufficient resources to open the - /// key. This can be due to reaching an implementation limit on the - /// number of open keys, the number of open key handles, or available - /// memory. - /// \retval #PSA_ERROR_DOES_NOT_EXIST - /// There is no persistent key with key identifier \p key. + /// Success. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid persistent key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The specified key exists, but the application does not have the - /// permission to access it. Note that this specification does not - /// define any way to create such a key, but it may be possible - /// through implementation-specific means. + /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + /// algorithm in the \p output key derivation operation. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// Input from a PAKE is not supported by the algorithm in the \p output + /// key derivation operation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The PAKE operation state is not valid (it must be active, but beyond + /// that validity is specific to the algorithm), or + /// the library has not been previously initialized by psa_crypto_init(), + /// or the state of \p output is not valid for + /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + /// step is out of order or the application has done this step already + /// and it may not be repeated. /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_get_implicit_key( + operation: *mut psa_pake_operation_t, + output: *mut psa_key_derivation_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Close a key handle. - /// - /// If the handle designates a volatile key, this will destroy the key material - /// and free all associated resources, just like psa_destroy_key(). - /// - /// If this is the last open handle to a persistent key, then closing the handle - /// will free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and can be opened again later - /// with a call to psa_open_key(). + /// Abort a PAKE operation. /// - /// Closing the key handle makes the handle invalid, and the key handle - /// must not be used again by the application. + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_pake_setup() again. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_pake_operation_t. /// - /// \note If the key handle was used to set up an active - /// :ref:\`multipart operation \`, then closing the - /// key handle can cause the multipart operation to fail. Applications should - /// maintain the key handle until after the multipart operation has finished. + /// In particular, calling psa_pake_abort() after the operation has been + /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + /// is safe and has no effect. /// - /// \param handle The key handle to close. - /// If this is \c 0, do nothing and return \c PSA_SUCCESS. + /// \param[in,out] operation The operation to abort. /// /// \retval #PSA_SUCCESS - /// \p handle was a valid handle or \c 0. It is now closed. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p handle is not a valid handle nor \c 0. + /// Success. /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; } -unsafe extern "C" { - /// \brief Library deinitialization. +pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; +pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; +/// \brief Public key types +pub type mbedtls_pk_type_t = ::core::ffi::c_uint; +/// \brief Options for RSASSA-PSS signature verification. +/// See \c mbedtls_rsa_rsassa_pss_verify_ext() +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_rsassa_pss_options { + /// The digest to use for MGF1 in PSS. /// - /// This function clears all data associated with the PSA layer, - /// including the whole key store. + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + /// disabled, this must be equal to the \c md_alg argument passed + /// to mbedtls_pk_verify_ext(). In a future version of the library, + /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + /// enabled regardless of the status of #MBEDTLS_RSA_C. + pub mgf1_hash_id: mbedtls_md_type_t, + /// The expected length of the salt, in bytes. This may be + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. /// - /// This is an Mbed TLS extension. - pub fn mbedtls_psa_crypto_free(); + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + /// ignored (allowing any salt length). + pub expected_salt_len: ::core::ffi::c_int, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. +impl Default for mbedtls_pk_rsassa_pss_options { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_PSA_EC: mbedtls_pk_debug_type = 3; +/// \brief Types for interfacing with the debug module +pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; +/// \brief Item to send to the debug module #[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_stats_s { - /// Number of slots containing key material for a volatile key. - pub private_volatile_slots: usize, - /// Number of slots containing key material for a key which is in - /// internal persistent storage. - pub private_persistent_slots: usize, - /// Number of slots containing a reference to a key in a - /// secure element. - pub private_external_slots: usize, - /// Number of slots which are occupied, but do not contain - /// key material yet. - pub private_half_filled_slots: usize, - /// Number of slots that contain cache data. - pub private_cache_slots: usize, - /// Number of slots that are not used for anything. - pub private_empty_slots: usize, - /// Number of slots that are locked. - pub private_locked_slots: usize, - /// Largest key id value among open keys in internal persistent storage. - pub private_max_open_internal_key_id: psa_key_id_t, - /// Largest key id value among open keys in secure elements. - pub private_max_open_external_key_id: psa_key_id_t, +#[derive(Copy, Clone)] +pub struct mbedtls_pk_debug_item { + pub private_type: mbedtls_pk_debug_type, + pub private_name: *const ::core::ffi::c_char, + pub private_value: *mut ::core::ffi::c_void, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. -pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; -unsafe extern "C" { - /// \brief Get statistics about - /// resource consumption related to the PSA keystore. - /// - /// \note When Mbed Crypto is built as part of a service, with isolation - /// between the application and the keystore, the service may or - /// may not expose this function. - pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); +impl Default for mbedtls_pk_debug_item { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief Inject an initial entropy seed for the random generator into - /// secure storage. - /// - /// This function injects data to be used as a seed for the random generator - /// used by the PSA Crypto implementation. On devices that lack a trusted - /// entropy source (preferably a hardware random number generator), - /// the Mbed PSA Crypto implementation uses this value to seed its - /// random generator. - /// - /// On devices without a trusted entropy source, this function must be - /// called exactly once in the lifetime of the device. On devices with - /// a trusted entropy source, calling this function is optional. - /// In all cases, this function may only be called before calling any - /// other function in the PSA Crypto API, including psa_crypto_init(). - /// - /// When this function returns successfully, it populates a file in - /// persistent storage. Once the file has been created, this function - /// can no longer succeed. - /// - /// If any error occurs, this function does not change the system state. - /// You can call this function again after correcting the reason for the - /// error if possible. - /// - /// \warning This function **can** fail! Callers MUST check the return status. - /// - /// \warning If you use this function, you should use it as part of a - /// factory provisioning process. The value of the injected seed - /// is critical to the security of the device. It must be - /// *secret*, *unpredictable* and (statistically) *unique per device*. - /// You should be generate it randomly using a cryptographically - /// secure random generator seeded from trusted entropy sources. - /// You should transmit it securely to the device and ensure - /// that its value is not leaked or stored anywhere beyond the - /// needs of transmitting it from the point of generation to - /// the call of this function, and erase all copies of the value - /// once this function returns. - /// - /// This is an Mbed TLS extension. - /// - /// \note This function is only available on the following platforms: - /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. - /// Note that you must provide compatible implementations of - /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. - /// * In a client-server integration of PSA Cryptography, on the client side, - /// if the server supports this feature. - /// \param[in] seed Buffer containing the seed value to inject. - /// \param[in] seed_size Size of the \p seed buffer. - /// The size of the seed in bytes must be greater - /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE - /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM - /// in `library/entropy_poll.h` in the Mbed TLS source - /// code. - /// It must be less or equal to - /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. - /// - /// \retval #PSA_SUCCESS - /// The seed value was injected successfully. The random generator - /// of the PSA Crypto implementation is now ready for use. - /// You may now call psa_crypto_init() and use the PSA Crypto - /// implementation. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p seed_size is out of range. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// There was a failure reading or writing from storage. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The library has already been initialized. It is no longer - /// possible to call this function. - pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_info_t { + _unused: [u8; 0], } -unsafe extern "C" { - /// \brief Get domain parameters for a key. - /// - /// Get the domain parameters for a key with this function, if any. The format - /// of the domain parameters written to \p data is specified in the - /// documentation for psa_set_key_domain_parameters(). - /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. - /// - /// \param[in] attributes The key attribute structure to query. - /// \param[out] data On success, the key domain parameters. - /// \param data_size Size of the \p data buffer in bytes. - /// The buffer is guaranteed to be large - /// enough if its size in bytes is at least - /// the value given by - /// PSA_KEY_DOMAIN_PARAMETERS_SIZE(). - /// \param[out] data_length On success, the number of bytes - /// that make up the key domain parameters data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - pub fn psa_get_key_domain_parameters( - attributes: *const psa_key_attributes_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; +/// \brief Public key container +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_context { + ///< Public key information + pub private_pk_info: *const mbedtls_pk_info_t, + ///< Underlying public key context + pub private_pk_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_pk_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } +pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; +/// \brief Types for RSA-alt abstraction +pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_key_len_func = + ::core::option::Option usize>; unsafe extern "C" { - /// Convert an ECC curve identifier from the PSA encoding to Mbed TLS. - /// - /// \note This function is provided solely for the convenience of - /// Mbed TLS and may be removed at any time without notice. + /// \brief Return information associated with the given PK type /// - /// \param curve A PSA elliptic curve identifier - /// (`PSA_ECC_FAMILY_xxx`). - /// \param bits The bit-length of a private key on \p curve. - /// \param bits_is_sloppy If true, \p bits may be the bit-length rounded up - /// to the nearest multiple of 8. This allows the caller - /// to infer the exact curve from the length of a key - /// which is supplied as a byte string. + /// \param pk_type PK type to search for. /// - /// \return The corresponding Mbed TLS elliptic curve identifier - /// (`MBEDTLS_ECP_DP_xxx`). - /// \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized. - /// \return #MBEDTLS_ECP_DP_NONE if \p bits is not - /// correct for \p curve. - pub fn mbedtls_ecc_group_of_psa( - curve: psa_ecc_family_t, - bits: usize, - bits_is_sloppy: ::core::ffi::c_int, - ) -> mbedtls_ecp_group_id; + /// \return The PK info associated with the type or NULL if not found. + pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; } unsafe extern "C" { - /// External random generator function, implemented by the platform. - /// - /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, - /// this function replaces Mbed TLS's entropy and DRBG modules for all - /// random generation triggered via PSA crypto interfaces. - /// - /// \note This random generator must deliver random numbers with cryptographic - /// quality and high performance. It must supply unpredictable numbers - /// with a uniform distribution. The implementation of this function - /// is responsible for ensuring that the random generator is seeded - /// with sufficient entropy. If you have a hardware TRNG which is slow - /// or delivers non-uniform output, declare it as an entropy source - /// with mbedtls_entropy_add_source() instead of enabling this option. - /// - /// \param[in,out] context Pointer to the random generator context. - /// This is all-bits-zero on the first call - /// and preserved between successive calls. - /// \param[out] output Output buffer. On success, this buffer - /// contains random data with a uniform - /// distribution. - /// \param output_size The size of the \p output buffer in bytes. - /// \param[out] output_length On success, set this value to \p output_size. + /// \brief Initialize a #mbedtls_pk_context (as NONE). /// - /// \retval #PSA_SUCCESS - /// Success. The output buffer contains \p output_size bytes of - /// cryptographic-quality random data, and \c *output_length is - /// set to \p output_size. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY - /// The random generator requires extra entropy and there is no - /// way to obtain entropy under current environment conditions. - /// This error should not happen under normal circumstances since - /// this function is responsible for obtaining as much entropy as - /// it needs. However implementations of this function may return - /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain - /// entropy without blocking indefinitely. - /// \retval #PSA_ERROR_HARDWARE_FAILURE - /// A failure of the random generator hardware that isn't covered - /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. - pub fn mbedtls_psa_external_get_random( - context: *mut mbedtls_psa_external_random_context_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); } -/// A slot number identifying a key in a driver. -/// -/// Values of this type are used to identify built-in keys. -pub type psa_drv_slot_number_t = u64; -/// \brief Encoding of the application role of PAKE -/// -/// Encodes the application's role in the algorithm is being executed. For more -/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX -/// constants. -pub type psa_pake_role_t = u8; -/// Encoding of input and output indicators for PAKE. -/// -/// Some PAKE algorithms need to exchange more data than just a single key share. -/// This type is for encoding additional input and output data for such -/// algorithms. -pub type psa_pake_step_t = u8; -/// Encoding of the type of the PAKE's primitive. -/// -/// Values defined by this standard will never be in the range 0x80-0xff. -/// Vendors who define additional types must use an encoding in this range. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_primitive_type_t = u8; -/// \brief Encoding of the family of the primitive associated with the PAKE. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_family_t = u8; -/// \brief Encoding of the primitive associated with the PAKE. -/// -/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. -pub type psa_pake_primitive_t = u32; -/// The type of the data structure for PAKE cipher suites. -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; -/// The type of the state data structure for PAKE operations. -/// -/// Before calling any function on a PAKE operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_pake_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_pake_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, -/// for example: -/// \code -/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_pake_operation_init() -/// to the structure, for example: -/// \code -/// psa_pake_operation_t operation; -/// operation = psa_pake_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_operation_t = psa_pake_operation_s; -/// The type of input values for PAKE operations. -pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; -/// The type of computation stage for J-PAKE operations. -pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; unsafe extern "C" { - /// Get the length of the password in bytes from given inputs. + /// \brief Free the components of a #mbedtls_pk_context. /// - /// \param[in] inputs Operation inputs. - /// \param[out] password_len Password length. + /// \param ctx The context to clear. It must have been initialized. + /// If this is \c NULL, this function does nothing. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - password_len: *mut usize, - ) -> psa_status_t; + /// \note For contexts that have been set up with + /// mbedtls_pk_setup_opaque(), this does not free the underlying + /// PSA key and you still need to call psa_destroy_key() + /// independently if you want to destroy that key. + pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); } unsafe extern "C" { - /// Get the password from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] buffer Return buffer for password. - /// \param buffer_size Size of the return buffer in bytes. - /// \param[out] buffer_length Actual size of the password in bytes. + /// \brief Initialize a PK context with the information given + /// and allocates the type-specific PK subcontext. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password( - inputs: *const psa_crypto_driver_pake_inputs_t, - buffer: *mut u8, - buffer_size: usize, - buffer_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// Get the role from given inputs. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param info Information to use /// - /// \param[in] inputs Operation inputs. - /// \param[out] role Return buffer for role. + /// \return 0 on success, + /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Role hasn't been set yet. - pub fn psa_crypto_driver_pake_get_role( - inputs: *const psa_crypto_driver_pake_inputs_t, - role: *mut psa_pake_role_t, - ) -> psa_status_t; + /// \note For contexts holding an RSA-alt key, use + /// \c mbedtls_pk_setup_rsa_alt() instead. + pub fn mbedtls_pk_setup( + ctx: *mut mbedtls_pk_context, + info: *const mbedtls_pk_info_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the user id in bytes from given inputs. + /// \brief Initialize an RSA-alt context /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_len User id length. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param key RSA key pointer + /// \param decrypt_func Decryption function + /// \param sign_func Signing function + /// \param key_len_func Function returning key length in bytes /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_user_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_len: *mut usize, - ) -> psa_status_t; + /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + /// context wasn't already initialized as RSA_ALT. + /// + /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + pub fn mbedtls_pk_setup_rsa_alt( + ctx: *mut mbedtls_pk_context, + key: *mut ::core::ffi::c_void, + decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, + sign_func: mbedtls_pk_rsa_alt_sign_func, + key_len_func: mbedtls_pk_rsa_alt_key_len_func, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the peer id in bytes from given inputs. + /// \brief Get the size in bits of the underlying key /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_len Peer id length. + /// \param ctx The context to query. It must have been initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_peer_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_len: *mut usize, - ) -> psa_status_t; + /// \return Key size in bits, or 0 on error + pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; } unsafe extern "C" { - /// Get the user id from given inputs. + /// \brief Tell if a context can do the operation given by type /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_id User id. - /// \param user_id_size Size of \p user_id in bytes. - /// \param[out] user_id_len Size of the user id in bytes. + /// \param ctx The context to query. It must have been initialized. + /// \param type The desired type. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p user_id is too small. - pub fn psa_crypto_driver_pake_get_user( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_id: *mut u8, - user_id_size: usize, - user_id_len: *mut usize, - ) -> psa_status_t; + /// \return 1 if the context can do operations on the given type. + /// \return 0 if the context cannot do the operations on the given + /// type. This is always the case for a context that has + /// been initialized but not set up, or that has been + /// cleared with mbedtls_pk_free(). + pub fn mbedtls_pk_can_do( + ctx: *const mbedtls_pk_context, + type_: mbedtls_pk_type_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the peer id from given inputs. + /// \brief Determine valid PSA attributes that can be used to + /// import a key into PSA. /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_id Peer id. - /// \param peer_id_size Size of \p peer_id in bytes. - /// \param[out] peer_id_length Size of the peer id in bytes. + /// The attributes determined by this function are suitable + /// for calling mbedtls_pk_import_into_psa() to create + /// a PSA key with the same key material. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p peer_id is too small. - pub fn psa_crypto_driver_pake_get_peer( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_id: *mut u8, - peer_id_size: usize, - peer_id_length: *mut usize, - ) -> psa_status_t; + /// The typical flow of operations involving this function is + /// ``` + /// psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + /// int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + /// if (ret != 0) ...; // error handling omitted + /// // Tweak attributes if desired + /// psa_key_id_t key_id = 0; + /// ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + /// if (ret != 0) ...; // error handling omitted + /// ``` + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + /// - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_ENCRYPT as well as + /// #PSA_KEY_USAGE_DECRYPT. + /// - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type. + /// - #PSA_KEY_USAGE_ENCRYPT: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_HASH as well as + /// #PSA_KEY_USAGE_SIGN_HASH. + /// - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + /// #PSA_KEY_USAGE_SIGN_MESSAGE. + /// - #PSA_KEY_USAGE_VERIFY_HASH: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + /// \p attributes will contain a public key type. + /// \param[out] attributes + /// On success, valid attributes to import the key into PSA. + /// - The lifetime and key identifier are unchanged. If the + /// attribute structure was initialized or reset before + /// calling this function, this will result in a volatile + /// key. Call psa_set_key_identifier() before or after this + /// function if you wish to create a persistent key. Call + /// psa_set_key_lifetime() before or after this function if + /// you wish to import the key in a secure element. + /// - The key type and bit-size are determined by the contents + /// of the PK context. If the PK context contains a key + /// pair, the key type can be either a key pair type or + /// the corresponding public key type, depending on + /// \p usage. If the PK context contains a public key, + /// the key type is a public key type. + /// - The key's policy is determined by the key type and + /// the \p usage parameter. The usage always allows + /// \p usage, exporting and copying the key, and + /// possibly other permissions as documented for the + /// \p usage parameter. + /// The permitted algorithm policy is determined as follows + /// based on the #mbedtls_pk_type_t type of \p pk, + /// the chosen \p usage and other factors: + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V15: + /// #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_PKCS1V15_CRYPT + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V21 and the digest type + /// corresponding to the PSA algorithm \c hash: + /// #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_OAEP(\c hash) + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA_ALT: not supported. + /// - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + /// if \p usage is SIGN/VERIFY: + /// #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + /// if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + /// otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + /// - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + /// if \p usage is DERIVE: + /// #PSA_ALG_ECDH. + /// - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + /// set for the underlying PSA key, except that + /// sign/decrypt flags are removed if the type is + /// set to a public key type. + /// The underlying key must allow \p usage. + /// Note that the enrollment algorithm set with + /// psa_set_key_enrollment_algorithm() is not copied. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_get_psa_attributes( + pk: *const mbedtls_pk_context, + usage: psa_key_usage_t, + attributes: *mut psa_key_attributes_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the cipher suite from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] cipher_suite Return buffer for role. + /// \brief Import a key into the PSA key store. + /// + /// This function is equivalent to calling psa_import_key() + /// with the key material from \p pk. + /// + /// The typical way to use this function is: + /// -# Call mbedtls_pk_get_psa_attributes() to obtain + /// attributes for the given key. + /// -# If desired, modify the attributes, for example: + /// - To create a persistent key, call + /// psa_set_key_identifier() and optionally + /// psa_set_key_lifetime(). + /// - To import only the public part of a key pair: + /// + /// psa_set_key_type(&attributes, + /// PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + /// psa_get_key_type(&attributes))); + /// - Restrict the key usage if desired. + /// -# Call mbedtls_pk_import_into_psa(). + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param[in] attributes + /// The attributes to use for the new key. They must be + /// compatible with \p pk. In particular, the key type + /// must match the content of \p pk. + /// If \p pk contains a key pair, the key type in + /// attributes can be either the key pair type or the + /// corresponding public key type (to import only the + /// public part). + /// \param[out] key_id + /// On success, the identifier of the newly created key. + /// On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_import_into_psa( + pk: *const mbedtls_pk_context, + attributes: *const psa_key_attributes_t, + key_id: *mut mbedtls_svc_key_id_t, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Create a PK context starting from a key stored in PSA. + /// This key: + /// - must be exportable and + /// - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + /// + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. + /// + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + /// mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. + /// * For ECDSA, the choice of deterministic vs randomized will + /// be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + /// * For an RSA key, the output PK context will allow both + /// encrypt/decrypt and sign/verify regardless of the original + /// key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. + /// + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Cipher_suite hasn't been set yet. - pub fn psa_crypto_driver_pake_get_cipher_suite( - inputs: *const psa_crypto_driver_pake_inputs_t, - cipher_suite: *mut psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the session information for a password-authenticated key exchange. + /// \brief Create a PK context for the public key of a PSA key. /// - /// The sequence of operations to set up a password-authenticated key exchange - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_pake_operation_t, e.g. - /// #PSA_PAKE_OPERATION_INIT. - /// -# Call psa_pake_setup() to specify the cipher suite. - /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the - /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs - /// to be called depends on the algorithm in use. + /// The key must be an RSA or ECC key. It can be either a + /// public key or a key pair, and only the public key is copied. + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_verify() or + /// mbedtls_pk_encrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. /// - /// A typical sequence of calls to perform a password-authenticated key - /// exchange: - /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the - /// key share that needs to be sent to the peer. - /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide - /// the key share that was received from the peer. - /// -# Depending on the algorithm additional calls to psa_pake_output() and - /// psa_pake_input() might be necessary. - /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// For an RSA key, the output PK context will allow both + /// encrypt and verify regardless of the original key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// If an error occurs at any step after a call to psa_pake_setup(), - /// the operation will need to be reset by a call to psa_pake_abort(). The - /// application may call psa_pake_abort() at any time after the operation - /// has been initialized. + /// \return 0 on success. + /// \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_public_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature (including padding if relevant). /// - /// After a successful call to psa_pake_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A call to psa_pake_abort(). - /// - A successful call to psa_pake_get_implicit_key(). + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used. + /// This can be #MBEDTLS_MD_NONE if the signature algorithm + /// does not rely on a hash algorithm (non-deterministic + /// ECDSA, RSA PKCS#1 v1.5). + /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + /// \p hash is the DigestInfo structure used by RFC 8017 + /// §9.2 steps 3–6. If \p md_alg is a valid hash + /// algorithm then \p hash is the digest itself, and this + /// function calculates the DigestInfo encoding internally. + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Signature to verify + /// \param sig_len Signature length /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized but not set up yet. - /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully - /// characterizes a PAKE algorithm and determines - /// the algorithm as well.) + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (accepting any salt length), + /// depending on the padding mode in the underlying RSA context. + /// For a pk object constructed by parsing, this is PKCS#1 v1.5 + /// by default. Use mbedtls_pk_verify_ext() to explicitly select + /// a different algorithm. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the - /// PAKE primitive in \p cipher_suite is not compatible with the - /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid - /// or not compatible with the PAKE algorithm and primitive. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, - /// or the PAKE primitive in \p cipher_suite is not supported or not - /// compatible with the PAKE algorithm, or the hash algorithm in - /// \p cipher_suite is not supported or not compatible with the PAKE - /// algorithm and primitive. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_setup( - operation: *mut psa_pake_operation_t, - cipher_suite: *const psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + pub fn mbedtls_pk_verify( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the password for a password-authenticated key exchange from key ID. + /// \brief Restartable version of \c mbedtls_pk_verify() /// - /// Call this function when the password, or a value derived from the password, - /// is already present in the key store. + /// \note Performs the same job as \c mbedtls_pk_verify(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_verify(). /// - /// \param[in,out] operation The operation object to set the password for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the password hasn't - /// been set yet (psa_pake_set_password_key() - /// hasn't been called yet). - /// \param password Identifier of the key holding the password or a - /// value derived from the password (eg. by a - /// memory-hard function). It must remain valid - /// until the operation terminates. It must be of - /// type #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow - /// the usage #PSA_KEY_USAGE_DERIVE. + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p password is not a valid key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not - /// permit the \p operation's algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with - /// the \p operation's cipher suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size of \p password is not supported with the - /// \p operation's cipher suite. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must have been set up.), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_password_key( - operation: *mut psa_pake_operation_t, - password: mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return See \c mbedtls_pk_verify(), or + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_verify_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature, with options. + /// (Includes verification of the padding depending on type.) + /// + /// \param type Signature type (inc. possible padding type) to verify + /// \param options Pointer to type-specific options, or NULL + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + /// used for this type of signatures, + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + /// + /// \note If hash_len is 0, then the length associated with md_alg + /// is used instead, or an error returned if it is invalid. + /// + /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// + /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + /// to a mbedtls_pk_rsassa_pss_options structure, + /// otherwise it must be NULL. Note that if + /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + pub fn mbedtls_pk_verify_ext( + type_: mbedtls_pk_type_t, + options: *const ::core::ffi::c_void, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the user ID for a password-authenticated key exchange. + /// \brief Make signature, including padding if relevant. /// - /// Call this function to set the user ID. For PAKE algorithms that associate a - /// user identifier with each side of the session you need to call - /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single - /// user identifier with the session, call psa_pake_set_user() only. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (using the largest possible salt + /// length up to the hash length), depending on the padding mode + /// in the underlying RSA context. For a pk object constructed + /// by parsing, this is PKCS#1 v1.5 by default. Use + /// mbedtls_pk_verify_ext() to explicitly select a different + /// algorithm. /// - /// \param[in,out] operation The operation object to set the user ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the user ID hasn't - /// been set (psa_pake_set_user() hasn't been - /// called yet). - /// \param[in] user_id The user ID to authenticate with. - /// (temporary limitation: "client" or "server" only) - /// \param user_id_len Size of the \p user_id buffer in bytes. + /// \return 0 on success, or a specific error code. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The value of \p user_id is not supported by the implementation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_user( - operation: *mut psa_pake_operation_t, - user_id: *const u8, - user_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the peer ID for a password-authenticated key exchange. + /// \brief Make signature given a signature type. /// - /// Call this function in addition to psa_pake_set_user() for PAKE algorithms - /// that associate a user identifier with each side of the session. For PAKE - /// algorithms that associate a single user identifier with the session, call - /// psa_pake_set_user() only. + /// \param pk_type Signature type. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \return 0 on success, or a specific error code. /// - /// \param[in,out] operation The operation object to set the peer ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the peer ID hasn't - /// been set (psa_pake_set_peer() hasn't been - /// called yet). - /// \param[in] peer_id The peer's ID to authenticate. - /// (temporary limitation: "client" or "server" only) - /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + /// see #PSA_ALG_RSA_PSS for a description of PSS options used. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm doesn't associate a second identity with the session. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// Calling psa_pake_set_peer() is invalid with the \p operation's - /// algorithm, the operation state is not valid, or the library has not - /// been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_peer( - operation: *mut psa_pake_operation_t, - peer_id: *const u8, - peer_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign_ext( + pk_type: mbedtls_pk_type_t, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the application role for a password-authenticated key exchange. + /// \brief Restartable version of \c mbedtls_pk_sign() /// - /// Not all PAKE algorithms need to differentiate the communicating entities. - /// It is optional to call this function for PAKEs that don't require a role - /// to be specified. For such PAKEs the application role parameter is ignored, - /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// \note Performs the same job as \c mbedtls_pk_sign(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_sign(). /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \param[in,out] operation The operation object to specify the - /// application's role for. It must have been set up - /// by psa_pake_setup() and not yet in use (neither - /// psa_pake_output() nor psa_pake_input() has been - /// called yet). It must be on operation for which - /// the application's role hasn't been specified - /// (psa_pake_set_role() hasn't been called yet). - /// \param role A value of type ::psa_pake_role_t indicating the - /// application's role in the PAKE the algorithm - /// that is being set up. For more information see - /// the documentation of \c PSA_PAKE_ROLE_XXX - /// constants. + /// \return See \c mbedtls_pk_sign(). + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_sign_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Decrypt message (including padding if relevant). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The \p role is not a valid PAKE role in the \p operation’s algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The \p role for this algorithm is not supported or is not valid. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_role( - operation: *mut psa_pake_operation_t, - role: psa_pake_role_t, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param input Input to decrypt + /// \param ilen Input size + /// \param output Decrypted output + /// \param olen Decrypted message length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. + /// + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_decrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get output for a step of a password-authenticated key exchange. + /// \brief Encrypt message (including padding if relevant). /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been set up. + /// \param input Message to encrypt + /// \param ilen Message size + /// \param output Encrypted output + /// \param olen Encrypted output length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \note \p f_rng is used for padding generation. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step of the algorithm for which the output is - /// requested. - /// \param[out] output Buffer where the output is to be written in the - /// format appropriate for this \p step. Refer to - /// the documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param output_size Size of the \p output buffer in bytes. This must - /// be at least #PSA_PAKE_OUTPUT_SIZE(\p alg, \p - /// primitive, \p step) where \p alg and - /// \p primitive are the PAKE algorithm and primitive - /// in the operation's cipher suite, and \p step is - /// the output step. + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_encrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if a public-private pair of keys matches. /// - /// \param[out] output_length On success, the number of bytes of the returned - /// output. + /// \param pub Context holding a public key. + /// \param prv Context holding a private (and public) key. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p step is not compatible with the operation's algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step is not supported with the operation's algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_output( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success (keys were checked and match each other). + /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + /// be checked - in that case they may or may not match. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + /// \return Another non-zero value if the keys do not match. + pub fn mbedtls_pk_check_pair( + pub_: *const mbedtls_pk_context, + prv: *const mbedtls_pk_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Provide input for a step of a password-authenticated key exchange. + /// \brief Export debug information /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been initialized. + /// \param items Place to write debug items /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + pub fn mbedtls_pk_debug( + ctx: *const mbedtls_pk_context, + items: *mut mbedtls_pk_debug_item, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Access the type name /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \param ctx The PK context to use. It must have been initialized. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step for which the input is provided. - /// \param[in] input Buffer containing the input in the format - /// appropriate for this \p step. Refer to the - /// documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param input_length Size of the \p input buffer in bytes. + /// \return Type name on success, or "invalid PK" + pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; +} +unsafe extern "C" { + /// \brief Get the key type /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p is not compatible with the \p operation’s algorithm, or the - /// \p input is not valid for the \p operation's algorithm, cipher suite - /// or \p step. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step p is not supported with the \p operation's algorithm, or the - /// \p input is not supported for the \p operation's algorithm, cipher - /// suite or \p step. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_input( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been initialized. + /// + /// \return Type on success. + /// \return #MBEDTLS_PK_NONE for a context that has not been set up. + pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; } unsafe extern "C" { - /// Get implicitly confirmed shared secret from a PAKE. + /// \ingroup pk_module */ + ////** + /// \brief Parse a private key in PEM or DER format /// - /// At this point there is a cryptographic guarantee that only the authenticated - /// party who used the same password is able to compute the key. But there is no - /// guarantee that the peer is the party it claims to be and was able to do so. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// That is, the authentication is only implicit. Since the peer is not - /// authenticated yet, no action should be taken yet that assumes that the peer - /// is who it claims to be. For example, do not access restricted files on the - /// peer's behalf until an explicit authentication has succeeded. + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// \param pwd Optional password for decryption. + /// Pass \c NULL if expecting a non-encrypted key. + /// Pass a string of \p pwdlen bytes if expecting an encrypted + /// key; a non-encrypted key will also be accepted. + /// The empty password is not supported. + /// \param pwdlen Size of the password in bytes. + /// Ignored if \p pwd is \c NULL. + /// \param f_rng RNG function, must not be \c NULL. Used for blinding. + /// \param p_rng RNG parameter /// - /// This function can be called after the key exchange phase of the operation - /// has completed. It imports the shared secret output of the PAKE into the - /// provided derivation operation. The input step - /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key - /// material in the key derivation operation. + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note The key is also checked for correctness. /// - /// When this function returns successfully, \p operation becomes inactive. - /// If this function returns an error status, both \p operation - /// and \p key_derivation operations enter an error state and must be aborted by - /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \ingroup pk_module */ + ////** + /// \brief Parse a public key in PEM or DER format /// - /// \param[in,out] operation Active PAKE operation. - /// \param[out] output A key derivation operation that is ready - /// for an input step of type - /// #PSA_KEY_DERIVATION_INPUT_SECRET. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the - /// algorithm in the \p output key derivation operation. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// Input from a PAKE is not supported by the algorithm in the \p output - /// key derivation operation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The PAKE operation state is not valid (it must be active, but beyond - /// that validity is specific to the algorithm), or - /// the library has not been previously initialized by psa_crypto_init(), - /// or the state of \p output is not valid for - /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the - /// step is out of order or the application has done this step already - /// and it may not be repeated. - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_get_implicit_key( - operation: *mut psa_pake_operation_t, - output: *mut psa_key_derivation_operation_t, - ) -> psa_status_t; + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). + /// + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. + /// + /// \note The key is also checked for correctness. + /// + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_public_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a PAKE operation. + /// \brief Write a private key to a PKCS#1 or SEC1 DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_pake_setup() again. + /// \param ctx PK context which must contain a valid private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_pake_operation_t. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_key_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a SubjectPublicKeyInfo DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// In particular, calling psa_pake_abort() after the operation has been - /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() - /// is safe and has no effect. + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// \param[in,out] operation The operation to abort. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_pubkey_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a PEM string /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_pubkey_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_pake_cipher_suite_s { - pub algorithm: psa_algorithm_t, - pub type_: psa_pake_primitive_type_t, - pub family: psa_pake_family_t, - pub bits: u16, - pub hash: psa_algorithm_t, +unsafe extern "C" { + /// \brief Write a private key to a PKCS#1 or SEC1 PEM string + /// + /// \param ctx PK context which must contain a valid private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_key_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_crypto_driver_pake_inputs_s { - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: psa_pake_role_t, - pub private_user: *mut u8, - pub private_user_len: usize, - pub private_peer: *mut u8, - pub private_peer_len: usize, - pub private_attributes: psa_key_attributes_t, - pub private_cipher_suite: psa_pake_cipher_suite_t, +unsafe extern "C" { + /// \brief Parse a SubjectPublicKeyInfo DER structure + /// + /// \param p the position in the ASN.1 data + /// \param end end of the buffer + /// \param pk The PK context to fill. It must have been initialized + /// but not set up. + /// + /// \return 0 if successful, or a specific PK error code + pub fn mbedtls_pk_parse_subpubkey( + p: *mut *mut ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -impl Default for psa_crypto_driver_pake_inputs_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Write a subjectPublicKey to ASN.1 data + /// Note: function works backwards in data buffer + /// + /// \param p reference to current position pointer + /// \param start start of the buffer (for bounds-checking) + /// \param key PK context which must contain a valid public or private key. + /// + /// \return the length written or a negative error code + pub fn mbedtls_pk_write_pubkey( + p: *mut *mut ::core::ffi::c_uchar, + start: *mut ::core::ffi::c_uchar, + key: *const mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -pub const psa_jpake_step_PSA_PAKE_STEP_INVALID: psa_jpake_step = 0; -pub const psa_jpake_step_PSA_PAKE_STEP_X1_X2: psa_jpake_step = 1; -pub const psa_jpake_step_PSA_PAKE_STEP_X2S: psa_jpake_step = 2; -pub const psa_jpake_step_PSA_PAKE_STEP_DERIVE: psa_jpake_step = 3; -pub type psa_jpake_step = ::core::ffi::c_uint; -pub use self::psa_jpake_step as psa_jpake_step_t; -pub const psa_jpake_state_PSA_PAKE_STATE_INVALID: psa_jpake_state = 0; -pub const psa_jpake_state_PSA_PAKE_STATE_SETUP: psa_jpake_state = 1; -pub const psa_jpake_state_PSA_PAKE_STATE_READY: psa_jpake_state = 2; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X1_X2: psa_jpake_state = 3; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X2S: psa_jpake_state = 4; -pub const psa_jpake_state_PSA_PAKE_INPUT_X1_X2: psa_jpake_state = 5; -pub const psa_jpake_state_PSA_PAKE_INPUT_X4S: psa_jpake_state = 6; -pub type psa_jpake_state = ::core::ffi::c_uint; -pub use self::psa_jpake_state as psa_jpake_state_t; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_INVALID: psa_jpake_sequence = 0; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_KEY_SHARE: psa_jpake_sequence = 1; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PUBLIC: psa_jpake_sequence = 2; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PROOF: psa_jpake_sequence = 3; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_KEY_SHARE: psa_jpake_sequence = 4; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PUBLIC: psa_jpake_sequence = 5; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PROOF: psa_jpake_sequence = 6; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_END: psa_jpake_sequence = 7; -pub type psa_jpake_sequence = ::core::ffi::c_uint; -pub use self::psa_jpake_sequence as psa_jpake_sequence_t; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = + 3; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + mbedtls_key_exchange_type_t = 4; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = + 8; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = + 9; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = 10; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = 11; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; -pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; -pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_jpake_computation_stage_s { - pub private_state: psa_jpake_state_t, - pub private_sequence: psa_jpake_sequence_t, - pub private_input_step: psa_jpake_step_t, - pub private_output_step: psa_jpake_step_t, -} -impl Default for psa_jpake_computation_stage_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_pake_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_stage: u8, - pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, - pub private_data: psa_pake_operation_s__bindgen_ty_2, -} +pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; +/// \brief This structure is used for storing ciphersuite information +/// +/// \note members are defined using integral types instead of enums +/// in order to pack structure and reduce memory usage by internal +/// \c ciphersuite_definitions[] #[repr(C)] #[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_jpake: psa_jpake_computation_stage_t, +pub struct mbedtls_ssl_ciphersuite_t { + pub private_id: ::core::ffi::c_int, + pub private_name: *const ::core::ffi::c_char, + pub private_cipher: u8, + pub private_mac: u8, + pub private_key_exchange: u8, + pub private_flags: u8, + pub private_min_tls_version: u16, + pub private_max_tls_version: u16, } -impl Default for psa_pake_operation_s__bindgen_ty_1 { +impl Default for mbedtls_ssl_ciphersuite_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -18649,29 +19849,23 @@ impl Default for psa_pake_operation_s__bindgen_ty_1 { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_2 { - pub private_ctx: psa_driver_pake_context_t, - pub private_inputs: psa_crypto_driver_pake_inputs_t, +unsafe extern "C" { + pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; } -impl Default for psa_pake_operation_s__bindgen_ty_2 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_string( + ciphersuite_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ssl_ciphersuite_t; } -impl Default for psa_pake_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_id( + ciphersuite_id: ::core::ffi::c_int, + ) -> *const mbedtls_ssl_ciphersuite_t; +} +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( + info: *const mbedtls_ssl_ciphersuite_t, + ) -> usize; } /// Type-length-value structure that allows for ASN1 using DER. pub type mbedtls_x509_buf = mbedtls_asn1_buf; @@ -18682,6 +19876,23 @@ pub type mbedtls_x509_bitstring = mbedtls_asn1_bitstring; pub type mbedtls_x509_name = mbedtls_asn1_named_data; /// Container for a sequence of ASN.1 items pub type mbedtls_x509_sequence = mbedtls_asn1_sequence; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_authority { + pub keyIdentifier: mbedtls_x509_buf, + pub authorityCertIssuer: mbedtls_x509_sequence, + pub authorityCertSerialNumber: mbedtls_x509_buf, + pub raw: mbedtls_x509_buf, +} +impl Default for mbedtls_x509_authority { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} /// Container for date and time (precision in seconds). #[repr(C)] #[derive(Default, Copy, Clone)] @@ -18773,9 +19984,9 @@ pub struct mbedtls_x509_subject_alternative_name { #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_x509_subject_alternative_name__bindgen_ty_1 { - ///< The otherName supported type. pub other_name: mbedtls_x509_san_other_name, - ///< The buffer for the unconstructed types. Only rfc822Name, dnsName and uniformResourceIdentifier are currently supported + pub directory_name: mbedtls_x509_name, + ///< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. pub unstructured_name: mbedtls_x509_buf, } impl Default for mbedtls_x509_subject_alternative_name__bindgen_ty_1 { @@ -18796,6 +20007,21 @@ impl Default for mbedtls_x509_subject_alternative_name { } } } +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_san_list { + pub node: mbedtls_x509_subject_alternative_name, + pub next: *mut mbedtls_x509_san_list, +} +impl Default for mbedtls_x509_san_list { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { /// \brief Store the certificate DN in printable form into buf; /// no more than size characters will be written. @@ -18812,6 +20038,26 @@ unsafe extern "C" { dn: *const mbedtls_x509_name, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Convert the certificate DN string \p name into + /// a linked list of mbedtls_x509_name (equivalent to + /// mbedtls_asn1_named_data). + /// + /// \note This function allocates a linked list, and places the head + /// pointer in \p head. This list must later be freed by a + /// call to mbedtls_asn1_free_named_data_list(). + /// + /// \param[out] head Address in which to store the pointer to the head of the + /// allocated list of mbedtls_x509_name. Must point to NULL on + /// entry. + /// \param[in] name The string representation of a DN to convert + /// + /// \return 0 on success, or a negative error code. + pub fn mbedtls_x509_string_to_names( + head: *mut *mut mbedtls_asn1_named_data, + name: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Store the certificate serial in printable form into buf; /// no more than size characters will be written. @@ -18828,6 +20074,20 @@ unsafe extern "C" { serial: *const mbedtls_x509_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Compare pair of mbedtls_x509_time. + /// + /// \param t1 mbedtls_x509_time to compare + /// \param t2 mbedtls_x509_time to compare + /// + /// \return < 0 if t1 is before t2 + /// 0 if t1 equals t2 + /// > 0 if t1 is after t2 + pub fn mbedtls_x509_time_cmp( + t1: *const mbedtls_x509_time, + t2: *const mbedtls_x509_time, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Check a given mbedtls_x509_time against the system time /// and tell if it's in the past. @@ -18856,21 +20116,25 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief This function parses an item in the SubjectAlternativeNames - /// extension. + /// extension. Please note that this function might allocate + /// additional memory for a subject alternative name, thus + /// mbedtls_x509_free_subject_alt_name has to be called + /// to dispose of this additional memory afterwards. /// /// \param san_buf The buffer holding the raw data item of the subject /// alternative name. /// \param san The target structure to populate with the parsed presentation - /// of the subject alternative name encoded in \p san_raw. + /// of the subject alternative name encoded in \p san_buf. /// /// \note Supported GeneralName types, as defined in RFC 5280: - /// "rfc822Name", "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + /// "rfc822Name", "dnsName", "directoryName", + /// "uniformResourceIdentifier" and "hardware_module_name" /// of type "otherName", as defined in RFC 4108. /// /// \note This function should be called on a single raw data of /// subject alternative name. For example, after successful /// certificate parsing, one must iterate on every item in the - /// \p crt->subject_alt_names sequence, and pass it to + /// \c crt->subject_alt_names sequence, and pass it to /// this function. /// /// \warning The target structure contains pointers to the raw data of the @@ -18887,173 +20151,29 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \} addtogroup x509_module - pub fn mbedtls_x509_get_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - cur: *mut mbedtls_x509_name, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg_null( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - params: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_rsassa_pss_params( - params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - mgf_md: *mut mbedtls_md_type_t, - salt_len: *mut ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - sig: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig_alg( - sig_oid: *const mbedtls_x509_buf, - sig_params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - pk_alg: *mut mbedtls_pk_type_t, - sig_opts: *mut *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_time( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - t: *mut mbedtls_x509_time, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_serial( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - serial: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ext( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ext: *mut mbedtls_x509_buf, - tag: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_sig_alg_gets( - buf: *mut ::core::ffi::c_char, - size: usize, - sig_oid: *const mbedtls_x509_buf, - pk_alg: mbedtls_pk_type_t, - md_alg: mbedtls_md_type_t, - sig_opts: *const ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_key_size_helper( - buf: *mut ::core::ffi::c_char, - buf_size: usize, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_string_to_names( - head: *mut *mut mbedtls_asn1_named_data, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_set_extension( - head: *mut *mut mbedtls_asn1_named_data, - oid: *const ::core::ffi::c_char, - oid_len: usize, - critical: ::core::ffi::c_int, - val: *const ::core::ffi::c_uchar, - val_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_extensions( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_names( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_sig( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - oid: *const ::core::ffi::c_char, - oid_len: usize, - sig: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ns_cert_type( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ns_cert_type: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_key_usage( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - key_usage: *mut ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_subject_alt_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - subject_alt_name: *mut mbedtls_x509_sequence, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_subject_alt_name( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - subject_alt_name: *const mbedtls_x509_sequence, - prefix: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_cert_type( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - ns_cert_type: ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \brief Unallocate all data related to subject alternative name + /// + /// \param san SAN structure - extra memory owned by this structure will be freed + pub fn mbedtls_x509_free_subject_alt_name(san: *mut mbedtls_x509_subject_alternative_name); } unsafe extern "C" { - pub fn mbedtls_x509_info_key_usage( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - key_usage: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \brief This function parses a CN string as an IP address. + /// + /// \param cn The CN string to parse. CN string MUST be null-terminated. + /// \param dst The target buffer to populate with the binary IP address. + /// The buffer MUST be 16 bytes to save IPv6, and should be + /// 4-byte aligned if the result will be used as struct in_addr. + /// e.g. uint32_t dst[4] + /// + /// \note \p cn is parsed as an IPv6 address if string contains ':', + /// else \p cn is parsed as an IPv4 address. + /// + /// \return Length of binary IP address; num bytes written to target. + /// \return \c 0 on failure to parse CN string as an IP address. + pub fn mbedtls_x509_crt_parse_cn_inet_pton( + cn: *const ::core::ffi::c_char, + dst: *mut ::core::ffi::c_void, + ) -> usize; } /// Certificate revocation list entry. /// Contains the CA-specific serial numbers and revocation dates. @@ -19245,8 +20365,12 @@ pub struct mbedtls_x509_crt { pub subject_id: mbedtls_x509_buf, ///< Optional X.509 v3 extensions. pub v3_ext: mbedtls_x509_buf, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, + ///< Optional X.509 v3 extension subject key identifier. + pub subject_key_id: mbedtls_x509_buf, + ///< Optional X.509 v3 extension authority key identifier. + pub authority_key_id: mbedtls_x509_authority, ///< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). pub certificate_policies: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions @@ -19345,6 +20469,22 @@ impl Default for mbedtls_x509write_cert { } } } +unsafe extern "C" { + /// \brief Set Subject Alternative Name + /// + /// \param ctx Certificate context to use + /// \param san_list List of SAN values + /// + /// \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + /// + /// \note "dnsName", "uniformResourceIdentifier", "IP address", + /// "otherName", and "DirectoryName", as defined in RFC 5280, + /// are supported. + pub fn mbedtls_x509write_crt_set_subject_alternative_name( + ctx: *mut mbedtls_x509write_cert, + san_list: *const mbedtls_x509_san_list, + ) -> ::core::ffi::c_int; +} /// Item in a verification chain: cert and flags for it #[repr(C)] #[derive(Copy, Clone)] @@ -19683,8 +20823,12 @@ unsafe extern "C" { /// \param cn The expected Common Name. This will be checked to be /// present in the certificate's subjectAltNames extension or, /// if this extension is absent, as a CN component in its - /// Subject name. Currently only DNS names are supported. This - /// may be \c NULL if the CN need not be verified. + /// Subject name. DNS names and IP addresses are fully + /// supported, while the URI subtype is partially supported: + /// only exact matching, without any normalization procedures + /// described in 7.4 of RFC5280, will result in a positive + /// URI verification. + /// This may be \c NULL if the CN need not be verified. /// \param flags The address at which to store the result of the verification. /// If the verification couldn't be completed, the flag value is /// set to (uint32_t) -1. @@ -19915,6 +21059,16 @@ unsafe extern "C" { /// \param crt Certificate chain to free pub fn mbedtls_x509_crt_free(crt: *mut mbedtls_x509_crt); } +unsafe extern "C" { + /// \brief Access the ca_istrue field + /// + /// \param[in] crt Certificate to be queried, must not be \c NULL + /// + /// \return \c 1 if this a CA certificate \c 0 otherwise. + /// \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + /// the Optional Basic Constraint extension. + pub fn mbedtls_x509_crt_get_ca_istrue(crt: *const mbedtls_x509_crt) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Initialize a CRT writing context /// @@ -19995,7 +21149,7 @@ unsafe extern "C" { /// \brief Set the issuer name for a Certificate /// Issuer names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS CA" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS CA" /// /// \param ctx CRT context to use /// \param issuer_name issuer name to set @@ -20011,7 +21165,7 @@ unsafe extern "C" { /// \brief Set the subject name for a Certificate /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CRT context to use /// \param subject_name subject name to set @@ -20181,13 +21335,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20207,13 +21355,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20334,13 +21476,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20413,13 +21549,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20453,13 +21583,7 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, output_size: usize, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20490,7 +21614,7 @@ unsafe extern "C" { /// initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p field is invalid. + /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. /// \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. pub fn mbedtls_dhm_get_value( ctx: *const mbedtls_dhm_context, @@ -20618,6 +21742,18 @@ impl Default for mbedtls_ecdh_context { } } } +unsafe extern "C" { + /// \brief Return the ECP group for provided context. + /// + /// \note To access group specific fields, users should use + /// `mbedtls_ecp_curve_info_from_grp_id` or + /// `mbedtls_ecp_group_load` on the extracted `group_id`. + /// + /// \param ctx The ECDH context to parse. This must not be \c NULL. + /// + /// \return The \c mbedtls_ecp_group_id of the context. + pub fn mbedtls_ecdh_get_grp_id(ctx: *mut mbedtls_ecdh_context) -> mbedtls_ecp_group_id; +} unsafe extern "C" { /// \brief Check whether a given group can be used for ECDH. /// @@ -20654,13 +21790,7 @@ unsafe extern "C" { grp: *mut mbedtls_ecp_group, d: *mut mbedtls_mpi, Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20699,13 +21829,7 @@ unsafe extern "C" { z: *mut mbedtls_mpi, Q: *const mbedtls_ecp_point, d: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20772,13 +21896,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20814,7 +21932,7 @@ unsafe extern "C" { /// \brief This function sets up an ECDH context from an EC key. /// /// It is used by clients and servers in place of the - /// ServerKeyEchange for static ECDH, and imports ECDH + /// ServerKeyExchange for static ECDH, and imports ECDH /// parameters from the EC key information of a certificate. /// /// \see ecp.h @@ -20863,13 +21981,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20930,19 +22042,14 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_ssl_premaster_secret { + pub dummy: ::core::ffi::c_uchar, pub _pms_rsa: [::core::ffi::c_uchar; 48usize], pub _pms_dhm: [::core::ffi::c_uchar; 1024usize], pub _pms_ecdh: [::core::ffi::c_uchar; 66usize], @@ -21214,6 +22321,8 @@ pub struct mbedtls_ssl_session { ///< MaxFragmentLength negotiated by peer pub private_mfl_code: ::core::ffi::c_uchar, pub private_exported: ::core::ffi::c_uchar, + ///< 0: client, 1: server + pub private_endpoint: u8, /// TLS version negotiated in the session. Used if and when renegotiating /// or resuming a session instead of the configured minor TLS version. pub private_tls_version: mbedtls_ssl_protocol_version, @@ -21232,15 +22341,13 @@ pub struct mbedtls_ssl_session { ///< RFC 5077 session ticket pub private_ticket: *mut ::core::ffi::c_uchar, ///< session ticket length - pub private_ticket_len: usize, - ///< ticket lifetime hint - pub private_ticket_lifetime: u32, - ///< 0: client, 1: server - pub private_endpoint: u8, - ///< Ticket flags - pub private_ticket_flags: u8, + pub private_ticket_len: usize, + ///< ticket lifetime hint + pub private_ticket_lifetime: u32, ///< Randomly generated value used to obscure the age of the ticket pub private_ticket_age_add: u32, + ///< Ticket flags + pub private_ticket_flags: u8, ///< resumption_key length pub private_resumption_key_len: u8, pub private_resumption_key: [::core::ffi::c_uchar; 48usize], @@ -21579,22 +22686,30 @@ pub struct mbedtls_ssl_context { ///number of retransmissions of request if ///renego_max_records is < 0 pub private_renego_records_seen: ::core::ffi::c_int, - /// Server: Negotiated TLS protocol version. - /// Client: Maximum TLS version to be negotiated, then negotiated TLS - /// version. - /// - /// It is initialized as the maximum TLS version to be negotiated in the - /// ClientHello writing preparation stage and used throughout the - /// ClientHello writing. For a fresh handshake not linked to any previous - /// handshake, it is initialized to the configured maximum TLS version - /// to be negotiated. When renegotiating or resuming a session, it is - /// initialized to the previously negotiated TLS version. - /// - /// Updated to the negotiated TLS version as soon as the ServerHello is - /// received. + /// Maximum TLS version to be negotiated, then negotiated TLS version. + /// + /// It is initialized as the configured maximum TLS version to be + /// negotiated by mbedtls_ssl_setup(). + /// + /// When renegotiating or resuming a session, it is overwritten in the + /// ClientHello writing preparation stage with the previously negotiated + /// TLS version. + /// + /// On client side, it is updated to the TLS version selected by the server + /// for the handshake when the ServerHello is received. + /// + /// On server side, it is updated to the TLS version the server selects for + /// the handshake when the ClientHello is received. pub private_tls_version: mbedtls_ssl_protocol_version, - ///< records with a bad MAC received - pub private_badmac_seen: ::core::ffi::c_uint, + /// Multipurpose field. + /// + /// - DTLS: records with a bad MAC received. + /// - TLS: accumulated length of handshake fragments (up to \c in_hslen). + /// + /// This field is multipurpose in order to preserve the ABI in the + /// Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + /// and called `badmac_seen`. + pub private_badmac_seen_or_in_hsfraglen: ::core::ffi::c_uint, /// Callback to customize X.509 certificate chain verification pub private_f_vrfy: ::core::option::Option< unsafe extern "C" fn( @@ -21731,8 +22846,33 @@ pub struct mbedtls_ssl_context { pub private_cur_out_ctr: [::core::ffi::c_uchar; 8usize], ///< path mtu, used to fragment outgoing messages pub private_mtu: u16, - ///< expected peer CN for verification - ///(and SNI if available) + /// Expected peer CN for verification. + /// + /// Also used on clients for SNI, + /// and for TLS 1.3 session resumption using tickets. + /// + /// The value of this field can be: + /// - \p NULL in a newly initialized or reset context. + /// - A heap-allocated copy of the last value passed to + /// mbedtls_ssl_set_hostname(), if the last call had a non-null + /// \p hostname argument. + /// - A special value to indicate that mbedtls_ssl_set_hostname() + /// was called with \p NULL (as opposed to never having been called). + /// See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + /// + /// If this field contains the value \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is unset, on a TLS client, attempting to verify a server certificate + /// results in the error + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + /// + /// If this field contains the special value described above, or if + /// the value is \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is set, then the peer name verification is skipped, which may be + /// insecure, especially on a client. Furthermore, on a client, the + /// server_name extension is not sent, and the server name is ignored + /// in TLS 1.3 session resumption using tickets. pub private_hostname: *mut ::core::ffi::c_char, ///< negotiated protocol pub private_alpn_chosen: *const ::core::ffi::c_char, @@ -21828,6 +22968,14 @@ unsafe extern "C" { /// Calling mbedtls_ssl_setup again is not supported, even /// if no session is active. /// + /// \warning After setting up a client context, if certificate-based + /// authentication is enabled, you should call + /// mbedtls_ssl_set_hostname() to specifiy the expected + /// name of the server. Without this, in most scenarios, + /// the TLS connection is insecure. See + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more information. + /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. @@ -21931,18 +23079,16 @@ unsafe extern "C" { unsafe extern "C" { /// \brief Set the random number generator callback /// + /// \note The callback with its parameter must remain valid as + /// long as there is an SSL context that uses the + /// SSL configuration. + /// /// \param conf SSL configuration /// \param f_rng RNG function (mandatory) /// \param p_rng RNG parameter pub fn mbedtls_ssl_conf_rng( conf: *mut mbedtls_ssl_config, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ); } @@ -22045,10 +23191,10 @@ unsafe extern "C" { /// \param own_cid The address of the readable buffer holding the CID we want /// the peer to use when sending encrypted messages to us. /// This may be \c NULL if \p own_cid_len is \c 0. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// \param own_cid_len The length of \p own_cid. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// /// \note The value of \p own_cid_len must match the value of the @@ -22703,16 +23849,16 @@ unsafe extern "C" { /// a full handshake. /// /// \note This function can handle a variety of mechanisms for session - /// resumption: For TLS 1.2, both session ID-based resumption and - /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and loading - /// one or more sessions via this call will lead to their - /// corresponding tickets being advertised as resumption PSKs - /// by the client. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// resumption: For TLS 1.2, both session ID-based resumption + /// and ticket-based resumption will be considered. For TLS 1.3, + /// sessions equate to tickets, and loading one session by + /// calling this function will lead to its corresponding ticket + /// being advertised as resumption PSK by the client. This + /// depends on session tickets being enabled (see + /// #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + /// If session tickets are disabled, a call to this function + /// with a TLS 1.3 session, will not have any effect on the next + /// handshake for the SSL context \p ssl. /// /// \param ssl The SSL context representing the connection which should /// be attempted to be setup using session resumption. This @@ -22727,9 +23873,10 @@ unsafe extern "C" { /// /// \return \c 0 if successful. /// \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session - /// could not be loaded because of an implementation limitation. - /// This error is non-fatal, and has no observable effect on - /// the SSL context or the session that was attempted to be loaded. + /// could not be loaded because one session has already been + /// loaded. This error is non-fatal, and has no observable + /// effect on the SSL context or the session that was attempted + /// to be loaded. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_get_session() @@ -22787,8 +23934,8 @@ unsafe extern "C" { /// /// \param session The session structure to be saved. /// \param buf The buffer to write the serialized data to. It must be a - /// writeable buffer of at least \p len bytes, or may be \c - /// NULL if \p len is \c 0. + /// writeable buffer of at least \p buf_len bytes, or may be \c + /// NULL if \p buf_len is \c 0. /// \param buf_len The number of bytes available for writing in \p buf. /// \param olen The size in bytes of the data that has been or would have /// been written. It must point to a valid \c size_t. @@ -22798,8 +23945,16 @@ unsafe extern "C" { /// to determine the necessary size by calling this function /// with \p buf set to \c NULL and \p buf_len to \c 0. /// + /// \note For TLS 1.3 sessions, this feature is supported only if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + /// as in TLS 1.3 session resumption is possible only with + /// tickets. + /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + /// and the session is a TLS 1.3 session. pub fn mbedtls_ssl_session_save( session: *const mbedtls_ssl_session, buf: *mut ::core::ffi::c_uchar, @@ -22925,7 +24080,7 @@ unsafe extern "C" { /// record headers. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len /// is too large. pub fn mbedtls_ssl_conf_cid( conf: *mut mbedtls_ssl_config, @@ -23252,6 +24407,8 @@ unsafe extern "C" { /// used for certificate signature are controlled by the /// verification profile, see \c mbedtls_ssl_conf_cert_profile(). /// + /// \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + /// /// \note This list should be ordered by decreasing preference /// (preferred hash first). /// @@ -23276,27 +24433,43 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Configure allowed signature algorithms for use in TLS 1.3 + /// \brief Configure allowed signature algorithms for use in TLS /// /// \param conf The SSL configuration to use. /// \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, - /// terminated by \c MBEDTLS_TLS1_3_SIG_NONE. The list must remain - /// available throughout the lifetime of the conf object. Supported - /// values are available as \c MBEDTLS_TLS1_3_SIG_XXXX + /// terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + /// available throughout the lifetime of the conf object. + /// - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + /// used. + /// - For TLS 1.2, values should be given as + /// "(HashAlgorithm << 8) | SignatureAlgorithm". pub fn mbedtls_ssl_conf_sig_algs(conf: *mut mbedtls_ssl_config, sig_algs: *const u16); } unsafe extern "C" { /// \brief Set or reset the hostname to check against the received - /// server certificate. It sets the ServerName TLS extension, - /// too, if that extension is enabled. (client-side only) + /// peer certificate. On a client, this also sets the + /// ServerName TLS extension, if that extension is enabled. + /// On a TLS 1.3 client, this also sets the server name in + /// the session resumption ticket, if that feature is enabled. /// /// \param ssl SSL context - /// \param hostname the server hostname, may be NULL to clear hostname - /// - /// \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. - /// - /// \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on - /// allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + /// \param hostname The server hostname. This may be \c NULL to clear + /// the hostname. + /// + /// \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + /// + /// \note If the hostname is \c NULL on a client, then the server + /// is not authenticated: it only needs to have a valid + /// certificate, not a certificate matching its name. + /// Therefore you should always call this function on a client, + /// unless the connection is set up to only allow + /// pre-shared keys, or in scenarios where server + /// impersonation is not a concern. See the documentation of + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more details. + /// + /// \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + /// allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on /// too long input hostname. /// /// Hostname set to the one provided on success (cleared @@ -23309,8 +24482,8 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief Retrieve SNI extension value for the current handshake. - /// Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), - /// this is the same value passed to \p f_sni callback of + /// Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + /// this is the same value passed to \c f_sni callback of /// \c mbedtls_ssl_conf_sni() and may be used instead of /// \c mbedtls_ssl_conf_sni(). /// @@ -23319,10 +24492,10 @@ unsafe extern "C" { /// 0 if SNI extension is not present or not yet processed. /// /// \return const pointer to SNI extension value. - /// - value is valid only when called in \p f_cert_cb + /// - value is valid only when called in \c f_cert_cb /// registered with \c mbedtls_ssl_conf_cert_cb(). /// - value is NULL if SNI extension is not present. - /// - value is not '\0'-terminated. Use \c name_len for len. + /// - value is not '\0'-terminated. Use \c name_len for len. /// - value must not be freed. pub fn mbedtls_ssl_get_hs_sni( ssl: *mut mbedtls_ssl_context, @@ -23572,6 +24745,10 @@ unsafe extern "C" { /// with \c mbedtls_ssl_read()), not handshake messages. /// With DTLS, this affects both ApplicationData and handshake. /// + /// \note Defragmentation of TLS handshake messages is supported + /// with some limitations. See the documentation of + /// mbedtls_ssl_handshake() for details. + /// /// \note This sets the maximum length for a record's payload, /// excluding record overhead that will be added to it, see /// \c mbedtls_ssl_get_record_expansion(). @@ -23605,19 +24782,48 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Enable / Disable session tickets (client only). - /// (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + /// \brief Enable / Disable TLS 1.2 session tickets (client only, + /// TLS 1.2 only). Enabled by default. /// /// \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). /// /// \param conf SSL configuration - /// \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or - /// MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + /// \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) pub fn mbedtls_ssl_conf_session_tickets( conf: *mut mbedtls_ssl_config, use_tickets: ::core::ffi::c_int, ); } +unsafe extern "C" { + /// \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + /// (client only, TLS 1.3 only). + /// + /// The handling of TLS 1.3 NewSessionTicket messages is disabled by + /// default. + /// + /// In TLS 1.3, servers may send a NewSessionTicket message at any time, + /// and may send multiple NewSessionTicket messages. By default, TLS 1.3 + /// clients ignore NewSessionTicket messages. + /// + /// To support session tickets in TLS 1.3 clients, call this function + /// with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + /// this is enabled, when a client receives a NewSessionTicket message, + /// the next call to a message processing functions (notably + /// mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + /// call mbedtls_ssl_get_session() to retrieve the session ticket before + /// calling the same message processing function again. + /// + /// \param conf SSL configuration + /// \param signal_new_session_tickets Enable or disable + /// (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + pub fn mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + conf: *mut mbedtls_ssl_config, + signal_new_session_tickets: ::core::ffi::c_int, + ); +} unsafe extern "C" { /// \brief Number of NewSessionTicket messages for the server to send /// after handshake completion. @@ -23946,29 +25152,22 @@ unsafe extern "C" { /// \param ssl The SSL context representing the connection for which to /// to export a session structure for later resumption. /// \param session The target structure in which to store the exported session. - /// This must have been initialized with mbedtls_ssl_init_session() + /// This must have been initialized with mbedtls_ssl_session_init() /// but otherwise be unused. /// /// \note This function can handle a variety of mechanisms for session /// resumption: For TLS 1.2, both session ID-based resumption and /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and calling - /// this function multiple times will export the available - /// tickets one a time until no further tickets are available, - /// in which case MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE will - /// be returned. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// sessions equate to tickets, and if session tickets are + /// enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + /// option), this function exports the last received ticket and + /// the exported session may be used to resume the TLS 1.3 + /// session. If session tickets are disabled, exported sessions + /// cannot be used to resume a TLS 1.3 session. /// /// \return \c 0 if successful. In this case, \p session can be used for /// session resumption by passing it to mbedtls_ssl_set_session(), /// and serialized for storage via mbedtls_ssl_session_save(). - /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no further session - /// is available for export. - /// This error is a non-fatal, and has no observable effect on - /// the SSL context or the destination session. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_set_session() @@ -24000,6 +25199,17 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use /// and the client did not demonstrate reachability yet - in /// this case you must stop using the context (see below). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24008,7 +25218,9 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24028,10 +25240,31 @@ unsafe extern "C" { /// currently being processed might or might not contain further /// DTLS records. /// - /// \note If the context is configured to allow TLS 1.3, or if - /// #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. + /// Otherwise, the handshake may call psa_crypto_init() + /// if a negotiation involving TLS 1.3 takes place (this may + /// be the case even if TLS 1.3 is offered but eventually + /// not selected). + /// + /// \note In TLS, reception of fragmented handshake messages is + /// supported with some limitations (those limitations do + /// not apply to DTLS, where defragmentation is fully + /// supported): + /// - On an Mbed TLS server that only accepts TLS 1.2, + /// the initial ClientHello message must not be fragmented. + /// A TLS 1.2 ClientHello may be fragmented if the server + /// also accepts TLS 1.3 connections (meaning + /// that #MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the + /// accepted versions have not been restricted with + /// mbedtls_ssl_conf_max_tls_version() or the like). + /// - The first fragment of a handshake message must be + /// at least 4 bytes long. + /// - Non-handshake records must not be interleaved between + /// the fragments of a handshake message. (This is permitted + /// in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + /// even in TLS 1.2.) pub fn mbedtls_ssl_handshake(ssl: *mut mbedtls_ssl_context) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -24060,8 +25293,10 @@ unsafe extern "C" { /// /// \warning If this function returns something other than \c 0, /// #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using /// the SSL context for reading or writing, and either free it /// or call \c mbedtls_ssl_session_reset() on it before /// re-using it for a new connection; the current connection @@ -24124,6 +25359,24 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server /// side of a DTLS connection and the client is initiating a /// new connection using the same source port. See below. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. + /// This error code is only returned on the client side. It is + /// only returned if handling of TLS 1.3 NewSessionTicket + /// messages has been enabled through + /// mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + /// This error code indicates that a TLS 1.3 NewSessionTicket + /// message has been received and parsed successfully by the + /// client. The ticket data can be retrieved from the SSL + /// context by calling mbedtls_ssl_get_session(). It remains + /// available until the next call to mbedtls_ssl_read(). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24132,8 +25385,10 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24200,6 +25455,17 @@ unsafe extern "C" { /// operation is in progress (see mbedtls_ecp_set_max_ops()) - /// in this case you must call this function again to complete /// the handshake when you're done attending other tasks. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24207,8 +25473,10 @@ unsafe extern "C" { /// a non-negative value, /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24449,381 +25717,64 @@ unsafe extern "C" { /// \brief Free an SSL configuration context /// /// \param conf SSL configuration context - pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); -} -unsafe extern "C" { - /// \brief Initialize SSL session structure - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief Free referenced items in an SSL session including the - /// peer certificate and clear memory - /// - /// \note A session object can be freed even if the SSL context - /// that was used to retrieve the session is still in use. - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief TLS-PRF function for key derivation. - /// - /// \param prf The tls_prf type function type to be used. - /// \param secret Secret for the key derivation function. - /// \param slen Length of the secret. - /// \param label String label for the key derivation function, - /// terminated with null character. - /// \param random Random bytes. - /// \param rlen Length of the random bytes buffer. - /// \param dstbuf The buffer holding the derived key. - /// \param dlen Length of the output buffer. - /// - /// \return 0 on success. An SSL specific error on failure. - pub fn mbedtls_ssl_tls_prf( - prf: mbedtls_tls_prf_types, - secret: *const ::core::ffi::c_uchar, - slen: usize, - label: *const ::core::ffi::c_char, - random: *const ::core::ffi::c_uchar, - rlen: usize, - dstbuf: *mut ::core::ffi::c_uchar, - dlen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the threshold error level to handle globally all debug output. - /// Debug messages that have a level over the threshold value are - /// discarded. - /// (Default value: 0 = No debug ) - /// - /// \param threshold threshold level of messages to filter on. Messages at a - /// higher level will be discarded. - /// - Debug levels - /// - 0 No debug - /// - 1 Error - /// - 2 State change - /// - 3 Informational - /// - 4 Verbose - pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); -} -unsafe extern "C" { - /// \brief Print a message to the debug output. This function is always used - /// through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl - /// context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the message has occurred in - /// \param line line number the message has occurred at - /// \param format format specifier, in printf format - /// \param ... variables used by the format specifier - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_msg( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - format: *const ::core::ffi::c_char, - ... - ); -} -unsafe extern "C" { - /// \brief Print the return value of a function to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text the name of the function that returned the error - /// \param ret the return code value - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ret( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - ret: ::core::ffi::c_int, - ); -} -unsafe extern "C" { - /// \brief Output a buffer of size len bytes to the debug output. This function - /// is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the buffer being dumped. Normally the - /// variable or buffer name - /// \param buf the buffer to be outputted - /// \param len length of the buffer - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_buf( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - buf: *const ::core::ffi::c_uchar, - len: usize, - ); -} -unsafe extern "C" { - /// \brief Print a MPI variable to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the MPI being output. Normally the - /// variable name - /// \param X the MPI variable - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_mpi( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_mpi, - ); -} -unsafe extern "C" { - /// \brief Print an ECP point to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the ECP point being output. Normally the - /// variable name - /// \param X the ECP point - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ecp( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_ecp_point, - ); -} -unsafe extern "C" { - /// \brief Print a X.509 certificate structure to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the certificate being output - /// \param crt X.509 certificate structure - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_crt( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - crt: *const mbedtls_x509_crt, - ); -} -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Q: mbedtls_debug_ecdh_attr = 0; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_QP: mbedtls_debug_ecdh_attr = 1; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Z: mbedtls_debug_ecdh_attr = 2; -pub type mbedtls_debug_ecdh_attr = ::core::ffi::c_uint; -unsafe extern "C" { - /// \brief Print a field of the ECDH structure in the SSL context to the debug - /// output. This function is always used through the - /// MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file - /// and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param ecdh the ECDH context - /// \param attr the identifier of the attribute being output - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_printf_ecdh( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - ecdh: *const mbedtls_ecdh_context, - attr: mbedtls_debug_ecdh_attr, - ); -} -/// \brief Entropy poll callback pointer -/// -/// \param data Callback-specific data pointer -/// \param output Data to fill -/// \param len Maximum size to provide -/// \param olen The actual amount of bytes put into the buffer (Can be 0) -/// -/// \return 0 if no critical failures occurred, -/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise -pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< - unsafe extern "C" fn( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - ) -> ::core::ffi::c_int, ->; -/// \brief Entropy source state -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_source_state { - ///< The entropy source callback - pub private_f_source: mbedtls_entropy_f_source_ptr, - ///< The callback data pointer - pub private_p_source: *mut ::core::ffi::c_void, - ///< Amount received in bytes - pub private_size: usize, - ///< Minimum bytes required before release - pub private_threshold: usize, - ///< Is the source strong? - pub private_strong: ::core::ffi::c_int, -} -impl Default for mbedtls_entropy_source_state { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief Entropy context structure -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_context { - pub private_accumulator_started: ::core::ffi::c_int, - pub __bindgen_padding_0: u64, - pub private_accumulator: mbedtls_sha512_context, - pub private_source_count: ::core::ffi::c_int, - pub private_source: [mbedtls_entropy_source_state; 20usize], -} -impl Default for mbedtls_entropy_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize the context - /// - /// \param ctx Entropy context to initialize - pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Free the data in the context - /// - /// \param ctx Entropy context to free - pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Adds an entropy source to poll - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context - /// \param f_source Entropy function - /// \param p_source Function data - /// \param threshold Minimum required from source before entropy is released - /// ( with mbedtls_entropy_func() ) (in bytes) - /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or - /// MBEDTLS_ENTROPY_SOURCE_WEAK. - /// At least one strong source needs to be added. - /// Weaker sources (such as the cycle counter) can be used as - /// a complement. - /// - /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES - pub fn mbedtls_entropy_add_source( - ctx: *mut mbedtls_entropy_context, - f_source: mbedtls_entropy_f_source_ptr, - p_source: *mut ::core::ffi::c_void, - threshold: usize, - strong: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); } unsafe extern "C" { - /// \brief Trigger an extra gather poll for the accumulator - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context + /// \brief Initialize SSL session structure /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Retrieve entropy from the accumulator - /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief Free referenced items in an SSL session including the + /// peer certificate and clear memory /// - /// \param data Entropy context - /// \param output Buffer to fill - /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + /// \note A session object can be freed even if the SSL context + /// that was used to retrieve the session is still in use. /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_func( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Add data to the accumulator manually - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief TLS-PRF function for key derivation. /// - /// \param ctx Entropy context - /// \param data Data to add - /// \param len Length of data + /// \param prf The tls_prf type function type to be used. + /// \param secret Secret for the key derivation function. + /// \param slen Length of the secret. + /// \param label String label for the key derivation function, + /// terminated with null character. + /// \param random Random bytes. + /// \param rlen Length of the random bytes buffer. + /// \param dstbuf The buffer holding the derived key. + /// \param dlen Length of the output buffer. /// - /// \return 0 if successful - pub fn mbedtls_entropy_update_manual( - ctx: *mut mbedtls_entropy_context, - data: *const ::core::ffi::c_uchar, - len: usize, + /// \return 0 on success. An SSL specific error on failure. + pub fn mbedtls_ssl_tls_prf( + prf: mbedtls_tls_prf_types, + secret: *const ::core::ffi::c_uchar, + slen: usize, + label: *const ::core::ffi::c_char, + random: *const ::core::ffi::c_uchar, + rlen: usize, + dstbuf: *mut ::core::ffi::c_uchar, + dlen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Checkup routine - /// - /// This module self-test also calls the entropy self-test, - /// mbedtls_entropy_source_self_test(); + /// \brief Set the threshold error level to handle globally all debug output. + /// Debug messages that have a level over the threshold value are + /// discarded. + /// (Default value: 0 = No debug ) /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; + /// \param threshold threshold level of messages to filter on. Messages at a + /// higher level will be discarded. + /// - Debug levels + /// - 0 No debug + /// - 1 Error + /// - 2 State change + /// - 3 Informational + /// - 4 Verbose + pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); } unsafe extern "C" { /// \brief This is the HMAC-based Extract-and-Expand Key Derivation Function @@ -24992,8 +25943,8 @@ unsafe extern "C" { /// \param len The length of the personalization string. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + /// where \c entropy_len is the entropy length /// described above. /// /// \return \c 0 if successful. @@ -25118,8 +26069,8 @@ unsafe extern "C" { /// \param len The length of the additional data. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length /// (see mbedtls_hmac_drbg_set_entropy_len()). /// /// \return \c 0 if successful. @@ -25602,6 +26553,28 @@ unsafe extern "C" { oid: *const mbedtls_asn1_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate a string containing a dotted-decimal + /// representation of an ASN.1 OID into its encoded form + /// (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + /// On success, this function allocates oid->buf from the + /// heap. It must be freed by the caller using mbedtls_free(). + /// + /// \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + /// \param oid_str string representation of the OID to parse + /// \param size length of the OID string, not including any null terminator + /// + /// \return 0 if successful + /// \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + /// represent a valid OID + /// \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + /// allocate oid->buf + pub fn mbedtls_oid_from_numeric_string( + oid: *mut mbedtls_asn1_buf, + oid_str: *const ::core::ffi::c_char, + size: usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate an X.509 extension OID into local values /// @@ -25679,6 +26652,34 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate AlgorithmIdentifier OID into an EC group identifier, + /// for curves that are directly encoded at this level + /// + /// \param oid OID to use + /// \param grp_id place to store group id + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_ec_grp_algid( + oid: *const mbedtls_asn1_buf, + grp_id: *mut mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Translate EC group identifier into AlgorithmIdentifier OID, + /// for curves that are directly encoded at this level + /// + /// \param grp_id EC group identifier + /// \param oid place to store ASN.1 OID string pointer + /// \param olen length of the OID + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_oid_by_ec_grp_algid( + grp_id: mbedtls_ecp_group_id, + oid: *mut *const ::core::ffi::c_char, + olen: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate SignatureAlgorithm OID into md_type and pk_type /// @@ -25846,11 +26847,11 @@ unsafe extern "C" { /// \param data source data to look in (must be nul-terminated) /// \param pwd password for decryption (can be NULL) /// \param pwdlen length of password - /// \param use_len destination for total length used (set after header is - /// correctly read, so unless you get + /// \param use_len destination for total length used from data buffer. It is + /// set after header is correctly read, so unless you get /// MBEDTLS_ERR_PEM_BAD_INPUT_DATA or /// MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is - /// the length to skip) + /// the length to skip. /// /// \note Attempts to check password correctness by verifying if /// the decrypted text starts with an ASN.1 sequence of @@ -25915,13 +26916,40 @@ unsafe extern "C" { unsafe extern "C" { /// \brief PKCS#5 PBES2 function /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs5_pbes2_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params the ASN.1 algorithm parameters - /// \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT /// \param pwd password to use when generating key /// \param pwdlen length of password /// \param data data to process /// \param datalen length of data - /// \param output output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. pub fn mbedtls_pkcs5_pbes2( @@ -25934,6 +26962,50 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief PKCS#5 PBES2 function + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params the ASN.1 algorithm parameters + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + /// \param pwd password to use when generating key + /// \param pwdlen length of password + /// \param data data to process + /// \param datalen length of data + /// \param output Output buffer. + /// On success, it contains the decrypted data. + /// On failure, the content is indetermidate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + pub fn mbedtls_pkcs5_pbes2_ext( + pbe_params: *const mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, + datalen: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context /// @@ -26165,6 +27237,25 @@ unsafe extern "C" { /// \brief PKCS12 Password Based function (encryption / decryption) /// for cipher-based and mbedtls_md-based PBE's /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs12_pbe_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or /// #MBEDTLS_PKCS12_PBE_DECRYPT @@ -26173,9 +27264,17 @@ unsafe extern "C" { /// \param pwd Latin1-encoded password used. This may only be \c NULL when /// \p pwdlen is 0. No null terminator should be used. /// \param pwdlen length of the password (may be 0) - /// \param input the input data + /// \param data the input data /// \param len data length - /// \param output the output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \return 0 if successful, or a MBEDTLS_ERR_XXX code pub fn mbedtls_pkcs12_pbe( @@ -26185,9 +27284,62 @@ unsafe extern "C" { md_type: mbedtls_md_type_t, pwd: *const ::core::ffi::c_uchar, pwdlen: usize, - input: *const ::core::ffi::c_uchar, + data: *const ::core::ffi::c_uchar, + len: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief PKCS12 Password Based function (encryption / decryption) + /// for cipher-based and mbedtls_md-based PBE's + /// + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + /// #MBEDTLS_PKCS12_PBE_DECRYPT + /// \param cipher_type the cipher used + /// \param md_type the mbedtls_md used + /// \param pwd Latin1-encoded password used. This may only be \c NULL when + /// \p pwdlen is 0. No null terminator should be used. + /// \param pwdlen length of the password (may be 0) + /// \param data the input data + /// \param len data length + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \return 0 if successful, or a MBEDTLS_ERR_XXX code + pub fn mbedtls_pkcs12_pbe_ext( + pbe_params: *mut mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + cipher_type: mbedtls_cipher_type_t, + md_type: mbedtls_md_type_t, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, len: usize, output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -26286,6 +27438,11 @@ unsafe extern "C" { /// \param session_id_len The length of \p session_id in bytes. /// \param session The address at which to store the session /// associated with \p session_id, if present. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + /// no cache entry with specified session ID found, or + /// any other negative error code for other failures. pub fn mbedtls_ssl_cache_get( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26302,6 +27459,9 @@ unsafe extern "C" { /// associated to \p session. /// \param session_id_len The length of \p session_id in bytes. /// \param session The session to store. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_set( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26315,12 +27475,13 @@ unsafe extern "C" { /// /// \param data The SSL cache context to use. /// \param session_id The pointer to the buffer holding the session ID - /// associated to \p session. + /// associated to session. /// \param session_id_len The length of \p session_id in bytes. /// - /// \return 0: The cache entry for session with provided ID - /// is removed or does not exist. - /// Otherwise: fail. + /// \return \c 0 on success. This indicates the cache entry for + /// the session with provided ID is removed or does not + /// exist. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_remove( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26373,13 +27534,7 @@ unsafe extern "C" { /// \brief Setup cookie context (generate keys) pub fn mbedtls_ssl_cookie_setup( ctx: *mut mbedtls_ssl_cookie_ctx, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26425,6 +27580,9 @@ unsafe extern "C" { #[derive(Copy, Clone)] pub struct mbedtls_ssl_ticket_key { pub private_name: [::core::ffi::c_uchar; 4usize], + /// Lifetime of the key in seconds. This is also the lifetime of the + /// tickets created under that key. + pub private_lifetime: u32, ///< context for auth enc/decryption pub private_ctx: mbedtls_cipher_context_t, } @@ -26480,7 +27638,9 @@ unsafe extern "C" { /// /// \param ctx Context to be set up /// \param f_rng RNG callback function (mandatory) - /// \param p_rng RNG callback context + /// \param p_rng RNG callback context. + /// Note that the RNG callback must remain valid + /// until the ticket context is freed. /// \param cipher AEAD cipher to use for ticket protection. /// Recommended value: MBEDTLS_CIPHER_AES_256_GCM. /// \param lifetime Tickets lifetime in seconds @@ -26490,21 +27650,21 @@ unsafe extern "C" { /// least as strong as the strongest ciphersuite /// supported. Usually that means a 256-bit key. /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_setup( ctx: *mut mbedtls_ssl_ticket_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, cipher: mbedtls_cipher_type_t, lifetime: u32, @@ -26535,10 +27695,16 @@ unsafe extern "C" { /// \note \c klength must be sufficient for use by cipher specified /// to \c mbedtls_ssl_ticket_setup /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_rotate( @@ -26604,7 +27770,7 @@ pub struct mbedtls_x509_csr { pub key_usage: ::core::ffi::c_uint, ///< Optional Netscape certificate type extension value: See the values in x509.h pub ns_cert_type: ::core::ffi::c_uchar, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions pub private_ext_types: ::core::ffi::c_int, @@ -26644,25 +27810,12 @@ impl Default for mbedtls_x509write_csr { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_x509_san_list { - pub node: mbedtls_x509_subject_alternative_name, - pub next: *mut mbedtls_x509_san_list, -} -impl Default for mbedtls_x509_san_list { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR) in DER format /// - /// \note CSR attributes (if any) are currently silently ignored. + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the CSR is rejected. /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling @@ -26679,6 +27832,70 @@ unsafe extern "C" { buflen: usize, ) -> ::core::ffi::c_int; } +/// \brief The type of certificate extension callbacks. +/// +/// Callbacks of this type are passed to and used by the +/// mbedtls_x509_csr_parse_der_with_ext_cb() routine when +/// it encounters either an unsupported extension. +/// Future versions of the library may invoke the callback +/// in other cases, if and when the need arises. +/// +/// \param p_ctx An opaque context passed to the callback. +/// \param csr The CSR being parsed. +/// \param oid The OID of the extension. +/// \param critical Whether the extension is critical. +/// \param p Pointer to the start of the extension value +/// (the content of the OCTET STRING). +/// \param end End of extension value. +/// +/// \note The callback must fail and return a negative error code +/// if it can not parse or does not support the extension. +/// When the callback fails to parse a critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() also fails. +/// When the callback fails to parse a non critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() simply skips +/// the extension and continues parsing. +/// +/// \return \c 0 on success. +/// \return A negative error code on failure. +pub type mbedtls_x509_csr_ext_cb_t = ::core::option::Option< + unsafe extern "C" fn( + p_ctx: *mut ::core::ffi::c_void, + csr: *const mbedtls_x509_csr, + oid: *const mbedtls_x509_buf, + critical: ::core::ffi::c_int, + p: *const ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +unsafe extern "C" { + /// \brief Load a Certificate Signing Request (CSR) in DER format + /// + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the result of the callback function decides whether + /// CSR is rejected. + /// + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. + /// + /// \param csr CSR context to fill + /// \param buf buffer holding the CRL data + /// \param buflen size of the buffer + /// \param cb A callback invoked for every unsupported certificate + /// extension. + /// \param p_ctx An opaque context passed to the callback. + /// + /// \return 0 if successful, or a specific X509 error code + pub fn mbedtls_x509_csr_parse_der_with_ext_cb( + csr: *mut mbedtls_x509_csr, + buf: *const ::core::ffi::c_uchar, + buflen: usize, + cb: mbedtls_x509_csr_ext_cb_t, + p_ctx: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR), DER or PEM format /// @@ -26740,7 +27957,7 @@ unsafe extern "C" { /// \brief Set the subject name for a CSR /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CSR context to use /// \param subject_name subject name to set @@ -26871,13 +28088,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26898,13 +28109,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } diff --git a/esp-mbedtls-sys/src/include/xtensa-esp32s2-none-elf.rs b/esp-mbedtls-sys/src/include/xtensa-esp32s2-none-elf.rs index 8a8f52f3..f6ce94cd 100644 --- a/esp-mbedtls-sys/src/include/xtensa-esp32s2-none-elf.rs +++ b/esp-mbedtls-sys/src/include/xtensa-esp32s2-none-elf.rs @@ -137,6 +137,36 @@ where } } } +#[repr(C)] +#[derive(Default)] +pub struct __IncompleteArrayField(::core::marker::PhantomData, [T; 0]); +impl __IncompleteArrayField { + #[inline] + pub const fn new() -> Self { + __IncompleteArrayField(::core::marker::PhantomData, []) + } + #[inline] + pub fn as_ptr(&self) -> *const T { + self as *const _ as *const T + } + #[inline] + pub fn as_mut_ptr(&mut self) -> *mut T { + self as *mut _ as *mut T + } + #[inline] + pub unsafe fn as_slice(&self, len: usize) -> &[T] { + ::core::slice::from_raw_parts(self.as_ptr(), len) + } + #[inline] + pub unsafe fn as_mut_slice(&mut self, len: usize) -> &mut [T] { + ::core::slice::from_raw_parts_mut(self.as_mut_ptr(), len) + } +} +impl ::core::fmt::Debug for __IncompleteArrayField { + fn fmt(&self, fmt: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result { + fmt.write_str("__IncompleteArrayField") + } +} pub const MBEDTLS_CONFIG_FILE: &[u8; 9] = b"config.h\0"; pub const MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT: u32 = 0; pub const MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: u32 = 1024; @@ -144,14 +174,33 @@ pub const MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE: u32 = 6000; pub const MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH: u32 = 32; pub const MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS: u32 = 1; pub const MBEDTLS_VERSION_MAJOR: u32 = 3; -pub const MBEDTLS_VERSION_MINOR: u32 = 4; -pub const MBEDTLS_VERSION_PATCH: u32 = 0; -pub const MBEDTLS_VERSION_NUMBER: u32 = 50593792; -pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.4.0\0"; -pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"mbed TLS 3.4.0\0"; +pub const MBEDTLS_VERSION_MINOR: u32 = 6; +pub const MBEDTLS_VERSION_PATCH: u32 = 5; +pub const MBEDTLS_VERSION_NUMBER: u32 = 50726144; +pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.6.5\0"; +pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"Mbed TLS 3.6.5\0"; +pub const PSA_WANT_ALG_MD5: u32 = 1; +pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; +pub const PSA_WANT_ALG_SHA_1: u32 = 1; +pub const PSA_WANT_ALG_SHA_224: u32 = 1; +pub const PSA_WANT_ALG_SHA_256: u32 = 1; +pub const PSA_WANT_ALG_SHA_384: u32 = 1; +pub const PSA_WANT_ALG_SHA_512: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_256: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_384: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_512: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_255: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_448: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_224: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_256: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_384: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_521: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CCM: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CMAC: u32 = 1; pub const PSA_WANT_ALG_CMAC: u32 = 1; @@ -162,10 +211,40 @@ pub const PSA_WANT_ALG_ECDSA: u32 = 1; pub const PSA_WANT_ALG_ECDSA_ANY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA: u32 = 1; pub const PSA_WANT_ALG_DETERMINISTIC_ECDSA: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_ALG_FFDH: u32 = 1; +pub const PSA_WANT_DH_RFC7919_2048: u32 = 1; +pub const PSA_WANT_DH_RFC7919_3072: u32 = 1; +pub const PSA_WANT_DH_RFC7919_4096: u32 = 1; +pub const PSA_WANT_DH_RFC7919_6144: u32 = 1; +pub const PSA_WANT_DH_RFC7919_8192: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_FFDH: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_GCM: u32 = 1; pub const PSA_WANT_ALG_GCM: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HMAC: u32 = 1; @@ -176,17 +255,16 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXTRACT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXPAND: u32 = 1; +pub const PSA_WANT_KEY_TYPE_HMAC: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF: u32 = 1; pub const PSA_WANT_ALG_TLS12_PRF: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const PSA_WANT_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_MD5: u32 = 1; -pub const PSA_WANT_ALG_MD5: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_PAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_JPAKE: u32 = 1; pub const PSA_WANT_ALG_JPAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160: u32 = 1; -pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const PSA_WANT_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN: u32 = 1; @@ -196,20 +274,19 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP: u32 = 1; pub const PSA_WANT_ALG_RSA_OAEP: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS: u32 = 1; pub const PSA_WANT_ALG_RSA_PSS: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_1: u32 = 1; -pub const PSA_WANT_ALG_SHA_1: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_224: u32 = 1; -pub const PSA_WANT_ALG_SHA_224: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_256: u32 = 1; -pub const PSA_WANT_ALG_SHA_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_384: u32 = 1; -pub const PSA_WANT_ALG_SHA_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_512: u32 = 1; -pub const PSA_WANT_ALG_SHA_512: u32 = 1; pub const PSA_WANT_KEY_TYPE_AES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES: u32 = 1; pub const PSA_WANT_KEY_TYPE_ARIA: u32 = 1; @@ -221,8 +298,8 @@ pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_KEY_TYPE_CHACHA20: u32 = 1; -pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20: u32 = 1; +pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER: u32 = 1; pub const PSA_WANT_ALG_CHACHA20_POLY1305: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305: u32 = 1; @@ -250,8 +327,7 @@ pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256: u32 = 1; -pub const PSA_HAVE_FULL_ECDSA: u32 = 1; -pub const PSA_HAVE_FULL_JPAKE: u32 = 1; +pub const PSA_WANT_ALG_SOME_PAKE: u32 = 1; pub const PSA_WANT_KEY_TYPE_DERIVE: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD_HASH: u32 = 1; @@ -272,7 +348,7 @@ pub const MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: i32 = -12; pub const MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: i32 = -14; pub const MBEDTLS_ERR_MPI_ALLOC_FAILED: i32 = -16; pub const MBEDTLS_MPI_MAX_LIMBS: u32 = 10000; -pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 2; +pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 3; pub const MBEDTLS_MPI_MAX_SIZE: u32 = 1024; pub const MBEDTLS_MPI_MAX_BITS: u32 = 8192; pub const MBEDTLS_MPI_MAX_BITS_SCALE100: u32 = 819200; @@ -320,6 +396,8 @@ pub const MBEDTLS_CIPHER_VARIABLE_KEY_LEN: u32 = 2; pub const MBEDTLS_MAX_IV_LENGTH: u32 = 16; pub const MBEDTLS_MAX_BLOCK_LENGTH: u32 = 16; pub const MBEDTLS_MAX_KEY_LENGTH: u32 = 64; +pub const MBEDTLS_KEY_BITLEN_SHIFT: u32 = 6; +pub const MBEDTLS_IV_SIZE_SHIFT: u32 = 2; pub const MBEDTLS_CCM_DECRYPT: u32 = 0; pub const MBEDTLS_CCM_ENCRYPT: u32 = 1; pub const MBEDTLS_CCM_STAR_DECRYPT: u32 = 2; @@ -332,7 +410,26 @@ pub const MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: i32 = -84; pub const MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: i32 = -86; pub const MBEDTLS_AES_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_DES3_BLOCK_SIZE: u32 = 8; +pub const MBEDTLS_CMAC_MAX_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_CIPHER_BLKSIZE_MAX: u32 = 16; +pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; +pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; +pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; +pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; +pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; +pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; +pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; +pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; +pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; +pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; +pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; +pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; +pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; +pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; +pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; +pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; +pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; +pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: i32 = -52; pub const MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: i32 = -54; pub const MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: i32 = -56; @@ -367,12 +464,6 @@ pub const MBEDTLS_ECP_MAX_PT_LEN: u32 = 133; pub const MBEDTLS_ECP_PF_UNCOMPRESSED: u32 = 0; pub const MBEDTLS_ECP_PF_COMPRESSED: u32 = 1; pub const MBEDTLS_ECP_TLS_NAMED_CURVE: u32 = 3; -pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; -pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; -pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; -pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; -pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; -pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; pub const MBEDTLS_ERR_RSA_BAD_INPUT_DATA: i32 = -16512; pub const MBEDTLS_ERR_RSA_INVALID_PADDING: i32 = -16640; pub const MBEDTLS_ERR_RSA_KEY_GEN_FAILED: i32 = -16768; @@ -387,6 +478,55 @@ pub const MBEDTLS_RSA_PKCS_V21: u32 = 1; pub const MBEDTLS_RSA_SIGN: u32 = 1; pub const MBEDTLS_RSA_CRYPT: u32 = 2; pub const MBEDTLS_RSA_SALT_LEN_ANY: i32 = -1; +pub const MBEDTLS_RSA_GEN_KEY_MIN_BITS: u32 = 1024; +pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; +pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; +pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; +pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; +pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; +pub const PSA_HASH_MAX_SIZE: u32 = 64; +pub const PSA_MAC_MAX_SIZE: u32 = 64; +pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; +pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; +pub const PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS: u32 = 1024; +pub const PSA_VENDOR_FFDH_MAX_KEY_BITS: u32 = 8192; +pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; +pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; +pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; +pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; +pub const PSA_VENDOR_PBKDF2_MAX_ITERATIONS: u32 = 4294967295; +pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; +pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_SIGNATURE_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_KEY_PAIR_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_PUBLIC_KEY_MAX_SIZE: u32 = 1; +pub const PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE: u32 = 1; +pub const PSA_CIPHER_MAX_KEY_LENGTH: u32 = 32; +pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; +pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; +pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; +pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; +pub const MBEDTLS_ERR_SHA3_BAD_INPUT_DATA: i32 = -118; +pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; +pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; +pub const MBEDTLS_GCM_DECRYPT: u32 = 0; +pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; +pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; +pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; +pub const MBEDTLS_GCM_HTABLE_SIZE: u32 = 16; +pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; +pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; +pub const PSA_MAX_KEY_BITS: u32 = 65528; +pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; +pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; +pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; +pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; +pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; +pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; +pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_ERR_PK_ALLOC_FAILED: i32 = -16256; pub const MBEDTLS_ERR_PK_TYPE_MISMATCH: i32 = -16128; pub const MBEDTLS_ERR_PK_BAD_INPUT_DATA: i32 = -16000; @@ -597,45 +737,6 @@ pub const MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256: u32 = 4869; pub const MBEDTLS_CIPHERSUITE_WEAK: u32 = 1; pub const MBEDTLS_CIPHERSUITE_SHORT_TAG: u32 = 2; pub const MBEDTLS_CIPHERSUITE_NODTLS: u32 = 4; -pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; -pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; -pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; -pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; -pub const PSA_HASH_MAX_SIZE: u32 = 64; -pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; -pub const PSA_MAC_MAX_SIZE: u32 = 64; -pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; -pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; -pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; -pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; -pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; -pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; -pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; -pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; -pub const MBEDTLS_GCM_DECRYPT: u32 = 0; -pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; -pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; -pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; -pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; -pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; -pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; -pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; -pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; -pub const PSA_MAX_KEY_BITS: u32 = 65528; -pub const MBEDTLS_PSA_KA_MASK_DUAL_USE: u32 = 0; -pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; -pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; -pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; -pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; -pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; -pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; -pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_X509_MAX_INTERMEDIATE_CA: u32 = 8; pub const MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE: i32 = -8320; pub const MBEDTLS_ERR_X509_UNKNOWN_OID: i32 = -8448; @@ -743,7 +844,9 @@ pub const MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: i32 = -30848; pub const MBEDTLS_ERR_SSL_BAD_CERTIFICATE: i32 = -31232; pub const MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET: i32 = -31488; pub const MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA: i32 = -31616; -pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31872; +pub const MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND: i32 = -32384; pub const MBEDTLS_ERR_SSL_ALLOC_FAILED: i32 = -32512; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FAILED: i32 = -32640; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: i32 = -28544; @@ -770,6 +873,7 @@ pub const MBEDTLS_ERR_SSL_EARLY_MESSAGE: i32 = -25728; pub const MBEDTLS_ERR_SSL_UNEXPECTED_CID: i32 = -24576; pub const MBEDTLS_ERR_SSL_VERSION_MISMATCH: i32 = -24320; pub const MBEDTLS_ERR_SSL_BAD_CONFIG: i32 = -24192; +pub const MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME: i32 = -23936; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE: u32 = 1; pub const MBEDTLS_SSL_IANA_TLS_GROUP_NONE: u32 = 0; @@ -841,6 +945,8 @@ pub const MBEDTLS_SSL_TRUNC_HMAC_ENABLED: u32 = 1; pub const MBEDTLS_SSL_TRUNCATED_HMAC_LEN: u32 = 10; pub const MBEDTLS_SSL_SESSION_TICKETS_DISABLED: u32 = 0; pub const MBEDTLS_SSL_SESSION_TICKETS_ENABLED: u32 = 1; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED: u32 = 0; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED: u32 = 1; pub const MBEDTLS_SSL_PRESET_DEFAULT: u32 = 0; pub const MBEDTLS_SSL_PRESET_SUITEB: u32 = 2; pub const MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED: u32 = 1; @@ -854,6 +960,9 @@ pub const MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN: u32 = 48; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN: u32 = 1000; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX: u32 = 60000; +pub const MBEDTLS_SSL_EARLY_DATA_NO_DISCARD: u32 = 0; +pub const MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD: u32 = 1; +pub const MBEDTLS_SSL_EARLY_DATA_DISCARD: u32 = 2; pub const MBEDTLS_SSL_IN_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_OUT_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_DTLS_MAX_BUFFERING: u32 = 32768; @@ -988,18 +1097,6 @@ pub const MBEDTLS_SSL_UNEXPECTED_CID_IGNORE: u32 = 0; pub const MBEDTLS_SSL_UNEXPECTED_CID_FAIL: u32 = 1; pub const MBEDTLS_PRINTF_SIZET: &[u8; 3] = b"zu\0"; pub const MBEDTLS_PRINTF_LONGLONG: &[u8; 4] = b"lld\0"; -pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; -pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; -pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; -pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; -pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; -pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; -pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; -pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; -pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; -pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; -pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; -pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_HKDF_BAD_INPUT_DATA: i32 = -24448; pub const MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: i32 = -3; pub const MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: i32 = -5; @@ -1041,6 +1138,7 @@ pub const MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS: u32 = 4096; pub const MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY: u32 = 8192; pub const MBEDTLS_OID_X509_EXT_FRESHEST_CRL: u32 = 16384; pub const MBEDTLS_OID_X509_EXT_NS_CERT_TYPE: u32 = 65536; +pub const MBEDTLS_OID_MAX_COMPONENTS: u32 = 128; pub const MBEDTLS_OID_ISO_MEMBER_BODIES: &[u8; 2] = b"*\0"; pub const MBEDTLS_OID_ISO_IDENTIFIED_ORG: &[u8; 2] = b"+\0"; pub const MBEDTLS_OID_ISO_CCITT_DS: &[u8; 2] = b"U\0"; @@ -1055,6 +1153,8 @@ pub const MBEDTLS_OID_ORG_OIW: &[u8; 2] = b"\x0E\0"; pub const MBEDTLS_OID_OIW_SECSIG: &[u8; 3] = b"\x0E\x03\0"; pub const MBEDTLS_OID_OIW_SECSIG_ALG: &[u8; 4] = b"\x0E\x03\x02\0"; pub const MBEDTLS_OID_OIW_SECSIG_SHA1: &[u8; 5] = b"\x0E\x03\x02\x1A\0"; +pub const MBEDTLS_OID_ORG_THAWTE: &[u8; 2] = b"e\0"; +pub const MBEDTLS_OID_THAWTE: &[u8; 3] = b"+e\0"; pub const MBEDTLS_OID_ORG_CERTICOM: &[u8; 3] = b"\x81\x04\0"; pub const MBEDTLS_OID_CERTICOM: &[u8; 4] = b"+\x81\x04\0"; pub const MBEDTLS_OID_ORG_TELETRUST: &[u8; 2] = b"$\0"; @@ -1153,14 +1253,26 @@ pub const MBEDTLS_OID_DIGEST_ALG_SHA256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x pub const MBEDTLS_OID_DIGEST_ALG_SHA384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x02\0"; pub const MBEDTLS_OID_DIGEST_ALG_SHA512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x03\0"; pub const MBEDTLS_OID_DIGEST_ALG_RIPEMD160: &[u8; 6] = b"+$\x03\x02\x01\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x07\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x08\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\t\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA1: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x07\0"; pub const MBEDTLS_OID_HMAC_SHA224: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x08\0"; pub const MBEDTLS_OID_HMAC_SHA256: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\t\0"; pub const MBEDTLS_OID_HMAC_SHA384: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA512: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x0B\0"; +pub const MBEDTLS_OID_HMAC_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\r\0"; +pub const MBEDTLS_OID_HMAC_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0E\0"; +pub const MBEDTLS_OID_HMAC_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0F\0"; +pub const MBEDTLS_OID_HMAC_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x10\0"; +pub const MBEDTLS_OID_HMAC_RIPEMD160: &[u8; 9] = b"+\x06\x01\x05\x05\x08\x01\x04\0"; pub const MBEDTLS_OID_DES_CBC: &[u8; 6] = b"+\x0E\x03\x02\x07\0"; pub const MBEDTLS_OID_DES_EDE3_CBC: &[u8; 9] = b"*\x86H\x86\xF7\r\x03\x07\0"; pub const MBEDTLS_OID_AES: &[u8; 9] = b"`\x86H\x01e\x03\x04\x01\0"; +pub const MBEDTLS_OID_AES_128_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x02\0"; +pub const MBEDTLS_OID_AES_192_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x16\0"; +pub const MBEDTLS_OID_AES_256_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01*\0"; pub const MBEDTLS_OID_AES128_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x05\0"; pub const MBEDTLS_OID_AES128_KWP: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x08\0"; pub const MBEDTLS_OID_AES192_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x19\0"; @@ -1213,6 +1325,10 @@ pub const MBEDTLS_OID_ECDSA_SHA224: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x01\0"; pub const MBEDTLS_OID_ECDSA_SHA256: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x02\0"; pub const MBEDTLS_OID_ECDSA_SHA384: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x03\0"; pub const MBEDTLS_OID_ECDSA_SHA512: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x04\0"; +pub const MBEDTLS_OID_X25519: &[u8; 4] = b"+en\0"; +pub const MBEDTLS_OID_X448: &[u8; 4] = b"+eo\0"; +pub const MBEDTLS_OID_ED25519: &[u8; 4] = b"+ep\0"; +pub const MBEDTLS_OID_ED448: &[u8; 4] = b"+eq\0"; pub const MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT: i32 = -4224; pub const MBEDTLS_ERR_PEM_INVALID_DATA: i32 = -4352; pub const MBEDTLS_ERR_PEM_ALLOC_FAILED: i32 = -4480; @@ -1226,8 +1342,6 @@ pub const MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA: i32 = -12160; pub const MBEDTLS_ERR_PKCS5_INVALID_FORMAT: i32 = -12032; pub const MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE: i32 = -11904; pub const MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH: i32 = -11776; -pub const MBEDTLS_PKCS5_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS5_ENCRYPT: u32 = 1; pub const MBEDTLS_ERR_PKCS7_INVALID_FORMAT: i32 = -21248; pub const MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE: i32 = -21376; pub const MBEDTLS_ERR_PKCS7_INVALID_VERSION: i32 = -21504; @@ -1248,8 +1362,6 @@ pub const MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH: i32 = -7680; pub const MBEDTLS_PKCS12_DERIVE_KEY: u32 = 1; pub const MBEDTLS_PKCS12_DERIVE_IV: u32 = 2; pub const MBEDTLS_PKCS12_DERIVE_MAC_KEY: u32 = 3; -pub const MBEDTLS_PKCS12_PBE_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS12_PBE_ENCRYPT: u32 = 1; pub const MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT: u32 = 86400; pub const MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES: u32 = 50; pub const MBEDTLS_SSL_COOKIE_TIMEOUT: u32 = 60; @@ -1373,6 +1485,59 @@ unsafe extern "C" { /// \param len Length of the buffer in bytes pub fn mbedtls_platform_zeroize(buf: *mut ::core::ffi::c_void, len: usize); } +/// \brief The type of custom random generator (RNG) callbacks. +/// +/// Many Mbed TLS functions take two parameters +/// `mbedtls_f_rng_t *f_rng, void *p_rng`. The +/// library will call \c f_rng to generate +/// random values. +/// +/// \note This is typically one of the following: +/// - mbedtls_ctr_drbg_random() with \c p_rng +/// pointing to a #mbedtls_ctr_drbg_context; +/// - mbedtls_hmac_drbg_random() with \c p_rng +/// pointing to a #mbedtls_hmac_drbg_context; +/// - mbedtls_psa_get_random() with +/// `prng = MBEDTLS_PSA_RANDOM_STATE`. +/// +/// \note Generally, given a call +/// `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback +/// and the context only need to remain valid until +/// the call to `mbedtls_foo` returns. However, there +/// are a few exceptions where the callback is stored +/// in for future use. Check the documentation of +/// the calling function. +/// +/// \warning In a multithreaded environment, calling the +/// function should be thread-safe. The standard +/// functions provided by the library are thread-safe +/// when #MBEDTLS_THREADING_C is enabled. +/// +/// \warning This function must either provide as many +/// bytes as requested of **cryptographic quality** +/// random data, or return a negative error code. +/// +/// \param p_rng The \c p_rng argument that was passed along \c f_rng. +/// The library always passes \c p_rng unchanged. +/// This is typically a pointer to the random generator +/// state, or \c NULL if the custom random generator +/// doesn't need a context-specific state. +/// \param[out] output On success, this must be filled with \p output_size +/// bytes of cryptographic-quality random data. +/// \param output_size The number of bytes to output. +/// +/// \return \c 0 on success, or a negative error code on failure. +/// Library functions will generally propagate this +/// error code, so \c MBEDTLS_ERR_xxx values are +/// recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is +/// typically sensible for RNG failures. +pub type mbedtls_f_rng_t = ::core::option::Option< + unsafe extern "C" fn( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + ) -> ::core::ffi::c_int, +>; /// \brief The AES context-type definition. #[repr(C)] #[derive(Copy, Clone)] @@ -1931,6 +2096,10 @@ pub type mbedtls_t_udbl = u64; #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_mpi { + /// Pointer to limbs. + /// + /// This may be \c NULL if \c n is 0. + pub private_p: *mut mbedtls_mpi_uint, /// Sign: -1 if the mpi is negative, 1 otherwise. /// /// The number 0 must be represented with `s = +1`. Although many library @@ -1941,13 +2110,9 @@ pub struct mbedtls_mpi { /// /// Note that this implies that calloc() or `... = {0}` does not create /// a valid MPI representation. You must call mbedtls_mpi_init(). - pub private_s: ::core::ffi::c_int, + pub private_s: ::core::ffi::c_short, /// Total number of limbs in \c p. - pub private_n: usize, - /// Pointer to limbs. - /// - /// This may be \c NULL if \c n is 0. - pub private_p: *mut mbedtls_mpi_uint, + pub private_n: ::core::ffi::c_ushort, } impl Default for mbedtls_mpi { fn default() -> Self { @@ -2222,7 +2387,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2239,7 +2404,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2294,6 +2459,8 @@ unsafe extern "C" { /// \brief Perform a left-shift on an MPI: X <<= count /// /// \param X The MPI to shift. This must point to an initialized MPI. + /// The MPI pointed by \p X may be resized to fit + /// the resulting number. /// \param count The number of bits to shift by. /// /// \return \c 0 if successful. @@ -2586,7 +2753,7 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Perform a sliding-window exponentiation: X = A^E mod N + /// \brief Perform a modular exponentiation: X = A^E mod N /// /// \param X The destination MPI. This must point to an initialized MPI. /// This must not alias E or N. @@ -2637,13 +2804,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_fill_random( X: *mut mbedtls_mpi, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2683,13 +2844,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, min: mbedtls_mpi_sint, N: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2697,6 +2852,7 @@ unsafe extern "C" { /// \brief Compute the greatest common divisor: G = gcd(A, B) /// /// \param G The destination MPI. This must point to an initialized MPI. + /// This will always be positive or 0. /// \param A The first operand. This must point to an initialized MPI. /// \param B The second operand. This must point to an initialized MPI. /// @@ -2713,17 +2869,19 @@ unsafe extern "C" { /// \brief Compute the modular inverse: X = A^-1 mod N /// /// \param X The destination MPI. This must point to an initialized MPI. + /// The value returned on success will be between [1, N-1]. /// \param A The MPI to calculate the modular inverse of. This must point - /// to an initialized MPI. + /// to an initialized MPI. This value can be negative, in which + /// case a positive answer will still be returned in \p X. /// \param N The base of the modular inversion. This must point to an - /// initialized MPI. + /// initialized MPI and be greater than one. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. /// \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than /// or equal to one. - /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - /// with respect to \p N. + /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + /// inverse with respect to \p N. pub fn mbedtls_mpi_inv_mod( X: *mut mbedtls_mpi, A: *const mbedtls_mpi, @@ -2746,7 +2904,7 @@ unsafe extern "C" { /// This must point to an initialized MPI. /// \param rounds The number of bases to perform the Miller-Rabin primality /// test for. The probability of returning 0 on a composite is - /// at most 2-2*\p rounds. + /// at most 2-2*\p rounds . /// \param f_rng The RNG function to use. This must not be \c NULL. /// \param p_rng The RNG parameter to be passed to \p f_rng. /// This may be \c NULL if \p f_rng doesn't use @@ -2759,13 +2917,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_is_prime_ext( X: *const mbedtls_mpi, rounds: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2802,13 +2954,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, nbits: usize, flags: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -3185,7 +3331,7 @@ unsafe extern "C" { /// on a successful invocation. /// \param end The end of the ASN.1 SEQUENCE container. /// \param tag_must_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_must_value. + /// the SEQUENCE before comparing to \p tag_must_val. /// \param tag_must_val The required value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_must_mask. /// Mismatching tags lead to an error. @@ -3194,7 +3340,7 @@ unsafe extern "C" { /// while a value of \c 0xFF for \p tag_must_mask means /// that \p tag_must_val is the only allowed tag. /// \param tag_may_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_may_value. + /// the SEQUENCE before comparing to \p tag_may_val. /// \param tag_may_val The desired value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_may_mask. /// Mismatching tags will be silently ignored. @@ -3487,6 +3633,30 @@ unsafe extern "C" { par_len: usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + /// + /// \note This function works backwards in data buffer. + /// + /// \param p The reference to the current position pointer. + /// \param start The start of the buffer, for bounds-checking. + /// \param oid The OID of the algorithm to write. + /// \param oid_len The length of the algorithm's OID. + /// \param par_len The length of the parameters, which must be already written. + /// \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + /// and \p par_len is 0, NULL parameters are added. + /// + /// \return The number of bytes written to \p p on success. + /// \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_asn1_write_algorithm_identifier_ext( + p: *mut *mut ::core::ffi::c_uchar, + start: *const ::core::ffi::c_uchar, + oid: *const ::core::ffi::c_char, + oid_len: usize, + par_len: usize, + has_par: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value /// in ASN.1 format. @@ -3989,32 +4159,17 @@ pub struct mbedtls_cipher_base_t { /// mbedtls_cipher_info_from_type(), /// mbedtls_cipher_info_from_values(), /// mbedtls_cipher_info_from_psa(). +/// +/// \note Some fields store a value that has been right-shifted to save +/// code-size, so should not be used directly. The accessor +/// functions adjust for this and return the "natural" value. #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_cipher_info_t { - /// Full cipher identifier. For example, - /// MBEDTLS_CIPHER_AES_256_CBC. - pub private_type: mbedtls_cipher_type_t, - /// The cipher mode. For example, MBEDTLS_MODE_CBC. - pub private_mode: mbedtls_cipher_mode_t, - /// The cipher key length, in bits. This is the - /// default length for variable sized ciphers. - /// Includes parity bits for ciphers like DES. - pub private_key_bitlen: ::core::ffi::c_uint, /// Name of the cipher. pub private_name: *const ::core::ffi::c_char, - /// IV or nonce size, in Bytes. - /// For ciphers that accept variable IV sizes, - /// this is the recommended size. - pub private_iv_size: ::core::ffi::c_uint, - /// Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and - /// MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the - /// cipher supports variable IV or variable key sizes, respectively. - pub private_flags: ::core::ffi::c_int, - /// The block size, in Bytes. - pub private_block_size: ::core::ffi::c_uint, - /// Struct for base cipher information and functions. - pub private_base: *const mbedtls_cipher_base_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize]>, } impl Default for mbedtls_cipher_info_t { fn default() -> Self { @@ -4025,46 +4180,321 @@ impl Default for mbedtls_cipher_info_t { } } } -/// Generic cipher context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_cipher_context_t { - /// Information about the associated cipher. - pub private_cipher_info: *const mbedtls_cipher_info_t, - /// Key length to use. - pub private_key_bitlen: ::core::ffi::c_int, - /// Operation that the key of the context has been - /// initialized for. - pub private_operation: mbedtls_operation_t, - /// Padding functions to use, if relevant for - /// the specific cipher mode. - pub private_add_padding: ::core::option::Option< - unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), - >, - pub private_get_padding: ::core::option::Option< - unsafe extern "C" fn( - input: *mut ::core::ffi::c_uchar, - ilen: usize, - data_len: *mut usize, - ) -> ::core::ffi::c_int, - >, - /// Buffer for input that has not been processed yet. - pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], - /// Number of Bytes that have not been processed yet. - pub private_unprocessed_len: usize, - /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number - /// for XTS-mode. - pub private_iv: [::core::ffi::c_uchar; 16usize], - /// IV size in Bytes, for ciphers with variable-length IVs. - pub private_iv_size: usize, - /// The cipher-specific context. - pub private_cipher_ctx: *mut ::core::ffi::c_void, - /// CMAC-specific context. - pub private_cmac_ctx: *mut mbedtls_cmac_context_t, -} -impl Default for mbedtls_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); +impl mbedtls_cipher_info_t { + #[inline] + pub fn private_block_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_block_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_block_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_block_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(5usize, 3u8) as u32) } + } + #[inline] + pub fn set_private_iv_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(5usize, 3u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 5usize, + 3u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 5usize, + 3u8, + val as u64, + ) + } + } + #[inline] + pub fn private_key_bitlen(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(8usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_key_bitlen(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(8usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_key_bitlen_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 8usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_key_bitlen_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 8usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_mode(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(12usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_mode(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(12usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_mode_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 12usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_mode_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 12usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_type(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(16usize, 8u8) as u32) } + } + #[inline] + pub fn set_private_type(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(16usize, 8u8, val as u64) + } + } + #[inline] + pub unsafe fn private_type_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 16usize, + 8u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_type_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 16usize, + 8u8, + val as u64, + ) + } + } + #[inline] + pub fn private_flags(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(24usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_flags(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(24usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_flags_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 24usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_flags_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 24usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_base_idx(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(26usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_base_idx(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(26usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_base_idx_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 26usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_base_idx_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 26usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_block_size: ::core::ffi::c_uint, + private_iv_size: ::core::ffi::c_uint, + private_key_bitlen: ::core::ffi::c_uint, + private_mode: ::core::ffi::c_uint, + private_type: ::core::ffi::c_uint, + private_flags: ::core::ffi::c_uint, + private_base_idx: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 4usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 4usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 5u8, { + let private_block_size: u32 = unsafe { ::core::mem::transmute(private_block_size) }; + private_block_size as u64 + }); + __bindgen_bitfield_unit.set(5usize, 3u8, { + let private_iv_size: u32 = unsafe { ::core::mem::transmute(private_iv_size) }; + private_iv_size as u64 + }); + __bindgen_bitfield_unit.set(8usize, 4u8, { + let private_key_bitlen: u32 = unsafe { ::core::mem::transmute(private_key_bitlen) }; + private_key_bitlen as u64 + }); + __bindgen_bitfield_unit.set(12usize, 4u8, { + let private_mode: u32 = unsafe { ::core::mem::transmute(private_mode) }; + private_mode as u64 + }); + __bindgen_bitfield_unit.set(16usize, 8u8, { + let private_type: u32 = unsafe { ::core::mem::transmute(private_type) }; + private_type as u64 + }); + __bindgen_bitfield_unit.set(24usize, 2u8, { + let private_flags: u32 = unsafe { ::core::mem::transmute(private_flags) }; + private_flags as u64 + }); + __bindgen_bitfield_unit.set(26usize, 5u8, { + let private_base_idx: u32 = unsafe { ::core::mem::transmute(private_base_idx) }; + private_base_idx as u64 + }); + __bindgen_bitfield_unit + } +} +/// Generic cipher context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_cipher_context_t { + /// Information about the associated cipher. + pub private_cipher_info: *const mbedtls_cipher_info_t, + /// Key length to use. + pub private_key_bitlen: ::core::ffi::c_int, + /// Operation that the key of the context has been + /// initialized for. + pub private_operation: mbedtls_operation_t, + /// Padding functions to use, if relevant for + /// the specific cipher mode. + pub private_add_padding: ::core::option::Option< + unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), + >, + pub private_get_padding: ::core::option::Option< + unsafe extern "C" fn( + input: *mut ::core::ffi::c_uchar, + ilen: usize, + data_len: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int, + >, + /// Buffer for input that has not been processed yet. + pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], + /// Number of Bytes that have not been processed yet. + pub private_unprocessed_len: usize, + /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + /// for XTS-mode. + pub private_iv: [::core::ffi::c_uchar; 16usize], + /// IV size in Bytes, for ciphers with variable-length IVs. + pub private_iv_size: usize, + /// The cipher-specific context. + pub private_cipher_ctx: *mut ::core::ffi::c_void, + /// CMAC-specific context. + pub private_cmac_ctx: *mut mbedtls_cmac_context_t, +} +impl Default for mbedtls_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); s.assume_init() @@ -4132,7 +4562,7 @@ unsafe extern "C" { ) -> *const mbedtls_cipher_info_t; } unsafe extern "C" { - /// \brief This function initializes a \p cipher_context as NONE. + /// \brief This function initializes a \p ctx as NONE. /// /// \param ctx The context to be initialized. This must not be \c NULL. pub fn mbedtls_cipher_init(ctx: *mut mbedtls_cipher_context_t); @@ -4203,7 +4633,6 @@ unsafe extern "C" { /// \brief This function sets the padding mode, for cipher modes /// that use padding. /// - /// The default passing mode is PKCS7 padding. /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a cipher information structure. @@ -4253,23 +4682,24 @@ unsafe extern "C" { /// /// \note With non-AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update() one or more times - /// 4. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update() zero, one or more times; + /// 4. mbedtls_cipher_finish_padded() (recommended for decryption + /// if the mode uses padding) or mbedtls_cipher_finish(). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. /// /// \note With AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update_ad() - /// 4. mbedtls_cipher_update() one or more times - /// 5. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update_ad(); + /// 4. mbedtls_cipher_update() zero, one or more times; + /// 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); /// 6. mbedtls_cipher_check_tag() (for decryption) or - /// mbedtls_cipher_write_tag() (for encryption). + /// mbedtls_cipher_write_tag() (for encryption). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. @@ -4304,7 +4734,8 @@ unsafe extern "C" { /// many block-sized blocks of data as possible to output. /// Any data that cannot be written immediately is either /// added to the next block, or flushed when - /// mbedtls_cipher_finish() is called. + /// mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + /// is called. /// Exception: For MBEDTLS_MODE_ECB, expects a single block /// in size. For example, 16 Bytes for AES. /// @@ -4340,12 +4771,30 @@ unsafe extern "C" { /// contained in it is padded to the size of /// the last block, and written to the \p output buffer. /// + /// \warning This function reports invalid padding through an error + /// code. Adversaries may be able to decrypt encrypted + /// data if they can submit chosen ciphertexts and + /// detect whether it has valid padding or not, + /// either through direct observation or through a side + /// channel such as timing. This is known as a + /// padding oracle attack. + /// Therefore applications that call this function for + /// decryption with a cipher that involves padding + /// should take care around error handling. Preferably, + /// such applications should use + /// mbedtls_cipher_finish_padded() instead of this function. + /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a key. /// \param output The buffer to write data to. This needs to be a writable - /// buffer of at least \p block_size Bytes. + /// buffer of at least block_size Bytes. /// \param olen The length of the data written to the \p output buffer. /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// above), although less efficiently than through + /// the invalid-padding condition. /// /// \return \c 0 on success. /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on @@ -4353,7 +4802,8 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption /// expecting a full block but not receiving one. /// \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding - /// while decrypting. + /// while decrypting. Note that invalid-padding errors + /// should be handled carefully; see the warning above. /// \return A cipher-specific error code on failure. pub fn mbedtls_cipher_finish( ctx: *mut mbedtls_cipher_context_t, @@ -4361,10 +4811,60 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief The generic cipher finalization function. If data still + /// needs to be flushed from an incomplete block, the data + /// contained in it is padded to the size of + /// the last block, and written to the \p output buffer. + /// + /// \note This function is similar to mbedtls_cipher_finish(). + /// The only difference is that it reports invalid padding + /// decryption differently, through the \p invalid_padding + /// parameter rather than an error code. + /// For encryption, and in modes without padding (including + /// all authenticated modes), this function is identical + /// to mbedtls_cipher_finish(). + /// + /// \param[in,out] ctx The generic cipher context. This must be initialized and + /// bound to a key. + /// \param[out] output The buffer to write data to. This needs to be a writable + /// buffer of at least block_size Bytes. + /// \param[out] olen The length of the data written to the \p output buffer. + /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// on mbedtls_cipher_finish()). + /// \param[out] invalid_padding + /// If this function returns \c 0 on decryption, + /// \p *invalid_padding is \c 0 if the ciphertext was + /// valid, and all-bits-one if the ciphertext had invalid + /// padding. + /// On encryption, or in a mode without padding (including + /// all authenticated modes), \p *invalid_padding is \c 0 + /// on success. + /// The value in \p *invalid_padding is unspecified if + /// this function returns a nonzero status. + /// + /// \return \c 0 on success. + /// Also \c 0 for decryption with invalid padding. + /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + /// parameter-verification failure. + /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + /// expecting a full block but not receiving one. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_cipher_finish_padded( + ctx: *mut mbedtls_cipher_context_t, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief This function writes a tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized, /// bound to a key, and have just completed a cipher @@ -4385,7 +4885,8 @@ unsafe extern "C" { unsafe extern "C" { /// \brief This function checks the tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized. /// \param tag The buffer holding the tag. This must be a readable @@ -4570,8 +5071,6 @@ pub struct mbedtls_ccm_context { pub private_y: [::core::ffi::c_uchar; 16usize], ///< The counter buffer pub private_ctr: [::core::ffi::c_uchar; 16usize], - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Total plaintext length pub private_plaintext_len: usize, ///< Total authentication data length @@ -4586,16 +5085,17 @@ pub struct mbedtls_ccm_context { ///auth data input is finished. pub private_processed: usize, ///< The Q working value - pub private_q: ::core::ffi::c_uchar, + pub private_q: ::core::ffi::c_uint, ///< The operation to perform: ///#MBEDTLS_CCM_ENCRYPT or ///#MBEDTLS_CCM_DECRYPT or ///#MBEDTLS_CCM_STAR_ENCRYPT or ///#MBEDTLS_CCM_STAR_DECRYPT. - pub private_mode: ::core::ffi::c_uchar, + pub private_mode: ::core::ffi::c_uint, + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Working value holding context's - ///state. Used for chunked data - ///input + ///state. Used for chunked data input pub private_state: ::core::ffi::c_int, } impl Default for mbedtls_ccm_context { @@ -5838,47 +6338,59 @@ unsafe extern "C" { /// \return \c 1 on failure. pub fn mbedtls_cmac_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -/// \brief The CTR_DRBG context structure. +///< None. +pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; +///< The MD5 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 3; +///< The RIPEMD-160 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 4; +///< The SHA-1 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 5; +///< The SHA-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 8; +///< The SHA-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 9; +///< The SHA-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 10; +///< The SHA-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 11; +///< The SHA3-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_224: mbedtls_md_type_t = 16; +///< The SHA3-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_256: mbedtls_md_type_t = 17; +///< The SHA3-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_384: mbedtls_md_type_t = 18; +///< The SHA3-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_512: mbedtls_md_type_t = 19; +/// \brief Supported message digests. +/// +/// \warning MD5 and SHA-1 are considered weak message digests and +/// their use constitutes a security risk. We recommend considering +/// stronger message digests instead. +pub type mbedtls_md_type_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct mbedtls_ctr_drbg_context { - ///< The counter (V). - pub private_counter: [::core::ffi::c_uchar; 16usize], - ///< The reseed counter. - /// This is the number of requests that have - /// been made since the last (re)seeding, - /// minus one. - /// Before the initial seeding, this field - /// contains the amount of entropy in bytes - /// to use as a nonce for the initial seeding, - /// or -1 if no nonce length has been explicitly - /// set (see mbedtls_ctr_drbg_set_nonce_len()). - pub private_reseed_counter: ::core::ffi::c_int, - ///< This determines whether prediction - ///resistance is enabled, that is - ///whether to systematically reseed before - ///each random generation. - pub private_prediction_resistance: ::core::ffi::c_int, - ///< The amount of entropy grabbed on each - ///seed or reseed operation, in bytes. - pub private_entropy_len: usize, - ///< The reseed interval. - /// This is the maximum number of requests - /// that can be made between reseedings. - pub private_reseed_interval: ::core::ffi::c_int, - ///< The AES context. - pub private_aes_ctx: mbedtls_aes_context, - pub private_f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - ///< The context for the entropy function. - pub private_p_entropy: *mut ::core::ffi::c_void, +pub struct mbedtls_md_info_t { + _unused: [u8; 0], } -impl Default for mbedtls_ctr_drbg_context { +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; +/// Used internally to indicate whether a context uses legacy or PSA. +/// +/// Internal use only. +pub type mbedtls_md_engine_t = ::core::ffi::c_uint; +/// The generic message-digest context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md_context_t { + /// Information about the associated message digest. + pub private_md_info: *const mbedtls_md_info_t, + /// The digest-specific context (legacy) or the PSA operation. + pub private_md_ctx: *mut ::core::ffi::c_void, + /// The HMAC part of the context. + pub private_hmac_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_md_context_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -5888,4389 +6400,3745 @@ impl Default for mbedtls_ctr_drbg_context { } } unsafe extern "C" { - /// \brief This function initializes the CTR_DRBG context, - /// and prepares it for mbedtls_ctr_drbg_seed() - /// or mbedtls_ctr_drbg_free(). + /// \brief This function returns the message-digest information + /// associated with the given digest type. /// - /// \note The reseed interval is - /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. - /// You can override it by calling - /// mbedtls_ctr_drbg_set_reseed_interval(). + /// \param md_type The type of digest to search for. /// - /// \param ctx The CTR_DRBG context to initialize. - pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); + /// \return The message-digest information associated with \p md_type. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// - The \p custom string. - /// - /// \note To achieve the nominal security strength permitted - /// by CTR_DRBG, the entropy length must be: - /// - at least 16 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 32 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// In addition, if you do not pass a nonce in \p custom, - /// the sum of the entropy length - /// and the entropy nonce length must be: - /// - at least 24 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 48 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// \param ctx The CTR_DRBG context to seed. - /// It must have been initialized with - /// mbedtls_ctr_drbg_init(). - /// After a successful call to mbedtls_ctr_drbg_seed(), - /// you may not call mbedtls_ctr_drbg_seed() again on - /// the same context unless you call - /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() - /// again first. - /// After a failed call to mbedtls_ctr_drbg_seed(), - /// you must call mbedtls_ctr_drbg_free(). - /// \param f_entropy The entropy callback, taking as arguments the - /// \p p_entropy context, the buffer to fill, and the - /// length of the buffer. - /// \p f_entropy is always called with a buffer size - /// less than or equal to the entropy length. - /// \param p_entropy The entropy context to pass to \p f_entropy. - /// \param custom The personalization string. - /// This can be \c NULL, in which case the personalization - /// string is empty regardless of the value of \p len. - /// \param len The length of the personalization string. - /// This must be at most - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function initializes a message-digest context without + /// binding it to a particular message-digest algorithm. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_seed( - ctx: *mut mbedtls_ctr_drbg_context, - f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_entropy: *mut ::core::ffi::c_void, - custom: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// This function should always be called first. It prepares the + /// context for mbedtls_md_setup() for binding it to a + /// message-digest algorithm. + pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function resets CTR_DRBG context to the state immediately - /// after initial call of mbedtls_ctr_drbg_init(). + /// \brief This function clears the internal structure of \p ctx and + /// frees any embedded internal structure, but does not free + /// \p ctx itself. /// - /// \param ctx The CTR_DRBG context to clear. - pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); + /// If you have called mbedtls_md_setup() on \p ctx, you must + /// call mbedtls_md_free() when you are no longer using the + /// context. + /// Calling this function if you have previously + /// called mbedtls_md_init() and nothing else is optional. + /// You must not call this function if you have not called + /// mbedtls_md_init(). + pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function turns prediction resistance on or off. - /// The default value is off. + /// \brief This function selects the message digest algorithm to use, + /// and allocates internal structures. /// - /// \note If enabled, entropy is gathered at the beginning of - /// every call to mbedtls_ctr_drbg_random_with_add() - /// or mbedtls_ctr_drbg_random(). - /// Only use this if your entropy source has sufficient - /// throughput. + /// It should be called after mbedtls_md_init() or + /// mbedtls_md_free(). Makes it necessary to call + /// mbedtls_md_free() later. /// - /// \param ctx The CTR_DRBG context. - /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. - pub fn mbedtls_ctr_drbg_set_prediction_resistance( - ctx: *mut mbedtls_ctr_drbg_context, - resistance: ::core::ffi::c_int, - ); + /// \param ctx The context to set up. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + /// or non-zero: HMAC is used with this context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + pub fn mbedtls_md_setup( + ctx: *mut mbedtls_md_context_t, + md_info: *const mbedtls_md_info_t, + hmac: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed on each - /// seed or reseed. - /// - /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function clones the state of a message-digest + /// context. /// - /// \note The security strength of CTR_DRBG is bounded by the - /// entropy length. Thus: - /// - When using AES-256 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, - /// which is the default), - /// \p len must be at least 32 (in bytes) - /// to achieve a 256-bit strength. - /// - When using AES-128 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) - /// \p len must be at least 16 (in bytes) - /// to achieve a 128-bit strength. + /// \note You must call mbedtls_md_setup() on \c dst before calling + /// this function. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. - pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); -} -unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed - /// as a nonce for the initial seeding. + /// \note The two contexts must have the same type, + /// for example, both are SHA-256. /// - /// Call this function before calling mbedtls_ctr_drbg_seed() to read - /// a nonce from the entropy source during the initial seeding. + /// \warning This function clones the message-digest state, not the + /// HMAC state. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab for the nonce, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. + /// \param dst The destination context. + /// \param src The context to be cloned. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is - /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED - /// if the initial seeding has already taken place. - pub fn mbedtls_ctr_drbg_set_nonce_len( - ctx: *mut mbedtls_ctr_drbg_context, - len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + /// not using the same engine. This can be avoided by moving + /// the call to psa_crypto_init() before the first call to + /// mbedtls_md_setup(). + pub fn mbedtls_md_clone( + dst: *mut mbedtls_md_context_t, + src: *const mbedtls_md_context_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the reseed interval. - /// - /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() - /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function - /// is called again. + /// \brief This function extracts the message-digest size from the + /// message-digest information structure. /// - /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param interval The reseed interval. - pub fn mbedtls_ctr_drbg_set_reseed_interval( - ctx: *mut mbedtls_ctr_drbg_context, - interval: ::core::ffi::c_int, - ); + /// \return The size of the message-digest output in Bytes. + pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; } unsafe extern "C" { - /// \brief This function reseeds the CTR_DRBG context, that is - /// extracts data from the entropy source. + /// \brief This function extracts the message-digest type from the + /// message-digest information structure. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param additional Additional data to add to the state. Can be \c NULL. - /// \param len The length of the additional data. - /// This must be less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \return The type of the message digest. + pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; +} +unsafe extern "C" { + /// \brief This function starts a message-digest computation. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_reseed( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// You must call this function after setting up the context + /// with mbedtls_md_setup(), and before passing data with + /// mbedtls_md_update(). + /// + /// \param ctx The generic message-digest context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates the state of the CTR_DRBG context. + /// \brief This function feeds an input buffer into an ongoing + /// message-digest computation. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// You must call mbedtls_md_starts() before calling this + /// function. You may call this function multiple times. + /// Afterwards, call mbedtls_md_finish(). /// - /// \param ctx The CTR_DRBG context. - /// \param additional The data to update the state with. This must not be - /// \c NULL unless \p add_len is \c 0. - /// \param add_len Length of \p additional in bytes. This must be at - /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \param ctx The generic message-digest context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if - /// \p add_len is more than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return An error from the underlying AES cipher on failure. - pub fn mbedtls_ctr_drbg_update( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - add_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates a CTR_DRBG instance with additional - /// data and uses it to generate random data. - /// - /// This function automatically reseeds if the reseed counter is exceeded - /// or prediction resistance is enabled. + /// \brief This function finishes the digest operation, + /// and writes the result to the output buffer. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// Call this function after a call to mbedtls_md_starts(), + /// followed by any number of calls to mbedtls_md_update(). + /// Afterwards, you may either clear the context with + /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse + /// the context for another digest operation with the same + /// algorithm. /// - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. - /// \param additional Additional data to update. Can be \c NULL, in which - /// case the additional data is empty regardless of - /// the value of \p add_len. - /// \param add_len The length of the additional data - /// if \p additional is not \c NULL. - /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT - /// and less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \param ctx The generic message-digest context. + /// \param output The buffer for the generic message-digest checksum result. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random_with_add( - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_finish( + ctx: *mut mbedtls_md_context_t, output: *mut ::core::ffi::c_uchar, - output_len: usize, - additional: *const ::core::ffi::c_uchar, - add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. + /// \brief This function calculates the message-digest of a buffer, + /// with respect to a configurable message-digest algorithm + /// in a single call. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random( - p_rng: *mut ::core::ffi::c_void, + /// The result is calculated as + /// Output = message_digest(input buffer). + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param input The buffer holding the data. + /// \param ilen The length of the input data. + /// \param output The generic message-digest checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md( + md_info: *const mbedtls_md_info_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, output: *mut ::core::ffi::c_uchar, - output_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The CTR_DRBG checkup routine. + /// \brief This function returns the list of digests supported by the + /// generic digest module. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< Curve not defined. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; -///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; -///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; -///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; -///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; -///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; -///< Domain parameters for 256-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; -///< Domain parameters for 384-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; -///< Domain parameters for 512-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; -///< Domain parameters for Curve25519. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; -///< Domain parameters for 192-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; -///< Domain parameters for 224-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; -///< Domain parameters for 256-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; -///< Domain parameters for Curve448. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; -/// Domain-parameter identifiers: curve, subgroup, and generator. -/// -/// \note Only curves over prime fields are supported. -/// -/// \warning This library does not support validation of arbitrary domain -/// parameters. Therefore, only standardized domain parameters from trusted -/// sources should be used. See mbedtls_ecp_group_load(). -pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; -pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_NONE: mbedtls_ecp_modulus_type = 0; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_COORDINATE: mbedtls_ecp_modulus_type = 1; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_SCALAR: mbedtls_ecp_modulus_type = 2; -pub type mbedtls_ecp_modulus_type = ::core::ffi::c_uint; -/// Curve information, for use by other modules. -/// -/// The fields of this structure are part of the public API and can be -/// accessed directly by applications. Future versions of the library may -/// add extra fields or reorder existing fields. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_curve_info { - ///< An internal identifier. - pub grp_id: mbedtls_ecp_group_id, - ///< The TLS NamedCurve identifier. - pub tls_id: u16, - ///< The curve size in bits. - pub bit_size: u16, - ///< A human-friendly name. - pub name: *const ::core::ffi::c_char, + /// \note The list starts with the strongest available hashes. + /// + /// \return A statically allocated array of digests. Each element + /// in the returned list is an integer belonging to the + /// message-digest enumeration #mbedtls_md_type_t. + /// The last entry is 0. + pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; } -impl Default for mbedtls_ecp_curve_info { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief This function returns the message-digest information + /// associated with the given digest name. + /// + /// \param md_name The name of the digest to search for. + /// + /// \return The message-digest information associated with \p md_name. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_string( + md_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_md_info_t; } -/// \brief The ECP point structure, in Jacobian coordinates. -/// -/// \note All functions expect and return points satisfying -/// the following condition: Z == 0 or -/// Z == 1. Other values of \p Z are -/// used only by internal functions. -/// The point is zero, or "at infinity", if Z == 0. -/// Otherwise, \p X and \p Y are its standard (affine) -/// coordinates. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_point { - ///< The X coordinate of the ECP point. - pub private_X: mbedtls_mpi, - ///< The Y coordinate of the ECP point. - pub private_Y: mbedtls_mpi, - ///< The Z coordinate of the ECP point. - pub private_Z: mbedtls_mpi, -} -impl Default for mbedtls_ecp_point { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief The ECP group structure. -/// -/// We consider two types of curve equations: -///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P -/// (SEC1 + RFC-4492)
            • -///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, -/// Curve448)
          -/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. -/// -/// For Short Weierstrass, this subgroup is the whole curve, and its -/// cardinality is denoted by \p N. Our code requires that \p N is an -/// odd prime as mbedtls_ecp_mul() requires an odd number, and -/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. -/// -/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, -/// which is the quantity used in the formulas. Additionally, \p nbits is -/// not the size of \p N but the required size for private keys. -/// -/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. -/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the -/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer -/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits -/// in size, so that it may be efficiently brought in the 0..P-1 range by a few -/// additions or subtractions. Therefore, it is only an approximative modular -/// reduction. It must return 0 on success and non-zero on failure. -/// -/// \note Alternative implementations of the ECP module must obey the -/// following constraints. -/// * Group IDs must be distinct: if two group structures have -/// the same ID, then they must be identical. -/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, -/// \c pbits and \c nbits must have the same type and semantics -/// as in the built-in implementation. -/// They must be available for reading, but direct modification -/// of these fields does not need to be supported. -/// They do not need to be at the same offset in the structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_group { - ///< An internal group identifier. - pub id: mbedtls_ecp_group_id, - ///< The prime modulus of the base field. - pub P: mbedtls_mpi, - ///< For Short Weierstrass: \p A in the equation. For - ///Montgomery curves: (A + 2) / 4. - pub A: mbedtls_mpi, - ///< For Short Weierstrass: \p B in the equation. - ///For Montgomery curves: unused. - pub B: mbedtls_mpi, - ///< The generator of the subgroup used. - pub G: mbedtls_ecp_point, - ///< The order of \p G. - pub N: mbedtls_mpi, - ///< The number of bits in \p P. - pub pbits: usize, - ///< For Short Weierstrass: The number of bits in \p P. - ///For Montgomery curves: the number of bits in the - ///private keys. - pub nbits: usize, - ///< \internal 1 if the constants are static. - pub private_h: ::core::ffi::c_uint, - ///< The function for fast pseudo-reduction - ///mod \p P (see above). - pub private_modp: - ::core::option::Option ::core::ffi::c_int>, - ///< Unused. - pub private_t_pre: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_post: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_data: *mut ::core::ffi::c_void, - ///< Pre-computed points for ecp_mul_comb(). - pub private_T: *mut mbedtls_ecp_point, - ///< The number of dynamic allocated pre-computed points. - pub private_T_size: usize, -} -impl Default for mbedtls_ecp_group { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; -/// \brief The ECP key-pair structure. -/// -/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. -/// -/// \note Members are deliberately in the same order as in the -/// ::mbedtls_ecdsa_context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_keypair { - ///< Elliptic curve and base point - pub private_grp: mbedtls_ecp_group, - ///< our secret value - pub private_d: mbedtls_mpi, - ///< our public value - pub private_Q: mbedtls_ecp_point, -} -impl Default for mbedtls_ecp_keypair { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +unsafe extern "C" { + /// \brief This function returns the name of the message digest for + /// the message-digest information structure given. + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// + /// \return The name of the message digest. + pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; } unsafe extern "C" { - /// \brief This function retrieves the information defined in - /// mbedtls_ecp_curve_info() for all supported curves. + /// \brief This function returns the message-digest information + /// from the given context. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// \param ctx The context from which to extract the information. + /// This must be initialized (or \c NULL). /// - /// \return A statically allocated array. The last entry is 0. - pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; + /// \return The message-digest information associated with \p ctx. + /// \return \c NULL if \p ctx is \c NULL. + pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// \brief This function retrieves the list of internal group - /// identifiers of all supported curves in the order of - /// preference. + /// \brief This function sets the HMAC key and prepares to + /// authenticate a new message. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// Call this function after mbedtls_md_setup(), to use + /// the MD context for an HMAC calculation, then call + /// mbedtls_md_hmac_update() to provide the input data, and + /// mbedtls_md_hmac_finish() to get the HMAC value. /// - /// \return A statically allocated array, - /// terminated with MBEDTLS_ECP_DP_NONE. - pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC key in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_starts( + ctx: *mut mbedtls_md_context_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from an internal - /// group identifier. + /// \brief This function feeds an input buffer into an ongoing HMAC + /// computation. /// - /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + /// before calling this function. + /// You may call this function multiple times to pass the + /// input piecewise. + /// Afterwards, call mbedtls_md_hmac_finish(). /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_grp_id( - grp_id: mbedtls_ecp_group_id, - ) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a TLS - /// NamedCurve value. + /// \brief This function finishes the HMAC operation, and writes + /// the result to the output buffer. /// - /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call this function after mbedtls_md_hmac_starts() and + /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards + /// you may either call mbedtls_md_free() to clear the context, + /// or call mbedtls_md_hmac_reset() to reuse the context with + /// the same HMAC key. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param output The generic HMAC checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_finish( + ctx: *mut mbedtls_md_context_t, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a - /// human-readable name. + /// \brief This function prepares to authenticate a new message with + /// the same key as the previous HMAC operation. /// - /// \param name The human-readable name. + /// You may call this function after mbedtls_md_hmac_finish(). + /// Afterwards call mbedtls_md_hmac_update() to pass the new + /// input. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_name( - name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ecp_curve_info; -} -unsafe extern "C" { - /// \brief This function initializes a point as zero. + /// \param ctx The message digest context containing an embedded HMAC + /// context. /// - /// \param pt The point to initialize. - pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECP group context - /// without loading any domain parameters. + /// \brief This function calculates the full generic HMAC + /// on the input buffer with the provided key. /// - /// \note After this function is called, domain parameters - /// for various ECP groups can be loaded through the - /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() - /// functions. - pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); -} -unsafe extern "C" { - /// \brief This function initializes a key pair as an invalid one. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param key The key pair to initialize. - pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); -} -unsafe extern "C" { - /// \brief This function frees the components of a point. + /// The HMAC result is calculated as + /// output = generic HMAC(hmac key, input buffer). /// - /// \param pt The point to free. - pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); -} -unsafe extern "C" { - /// \brief This function frees the components of an ECP group. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC secret key in Bytes. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// \param output The generic HMAC result. /// - /// \param grp The group to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP group. - pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac( + md_info: *const mbedtls_md_info_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function frees the components of a key pair. - /// - /// \param key The key pair to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP key pair. - pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +/// \brief Entropy poll callback pointer +/// +/// \param data Callback-specific data pointer +/// \param output Data to fill +/// \param len Maximum size to provide +/// \param olen The actual amount of bytes put into the buffer (Can be 0) +/// +/// \return 0 if no critical failures occurred, +/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise +pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< + unsafe extern "C" fn( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + ) -> ::core::ffi::c_int, +>; +/// \brief Entropy source state +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_source_state { + ///< The entropy source callback + pub private_f_source: mbedtls_entropy_f_source_ptr, + ///< The callback data pointer + pub private_p_source: *mut ::core::ffi::c_void, + ///< Amount received in bytes + pub private_size: usize, + ///< Minimum bytes required before release + pub private_threshold: usize, + ///< Is the source strong? + pub private_strong: ::core::ffi::c_int, } -unsafe extern "C" { - /// \brief This function copies the contents of point \p Q into - /// point \p P. - /// - /// \param P The destination point. This must be initialized. - /// \param Q The source point. This must be initialized. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code for other kinds of failure. - pub fn mbedtls_ecp_copy( - P: *mut mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_entropy_source_state { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +/// \brief Entropy context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_context { + pub private_accumulator: mbedtls_md_context_t, + pub private_accumulator_started: ::core::ffi::c_int, + pub private_source_count: ::core::ffi::c_int, + pub private_source: [mbedtls_entropy_source_state; 20usize], +} +impl Default for mbedtls_entropy_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function copies the contents of group \p src into - /// group \p dst. - /// - /// \param dst The destination group. This must be initialized. - /// \param src The source group. This must be initialized. + /// \brief Initialize the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_copy( - dst: *mut mbedtls_ecp_group, - src: *const mbedtls_ecp_group, - ) -> ::core::ffi::c_int; + /// \param ctx Entropy context to initialize + pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function sets a point to the point at infinity. - /// - /// \param pt The point to set. This must be initialized. + /// \brief Free the data in the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \param ctx Entropy context to free + pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function checks if a point is the point at infinity. + /// \brief Adds an entropy source to poll + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param pt The point to test. This must be initialized. + /// \param ctx Entropy context + /// \param f_source Entropy function + /// \param p_source Function data + /// \param threshold Minimum required from source before entropy is released + /// ( with mbedtls_entropy_func() ) (in bytes) + /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + /// MBEDTLS_ENTROPY_SOURCE_WEAK. + /// At least one strong source needs to be added. + /// Weaker sources (such as the cycle counter) can be used as + /// a complement. /// - /// \return \c 1 if the point is zero. - /// \return \c 0 if the point is non-zero. - /// \return A negative error code on failure. - pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + pub fn mbedtls_entropy_add_source( + ctx: *mut mbedtls_entropy_context, + f_source: mbedtls_entropy_f_source_ptr, + p_source: *mut ::core::ffi::c_void, + threshold: usize, + strong: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function compares two points. - /// - /// \note This assumes that the points are normalized. Otherwise, - /// they may compare as "not equal" even if they are. + /// \brief Trigger an extra gather poll for the accumulator + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The first point to compare. This must be initialized. - /// \param Q The second point to compare. This must be initialized. + /// \param ctx Entropy context /// - /// \return \c 0 if the points are equal. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. - pub fn mbedtls_ecp_point_cmp( - P: *const mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a non-zero point from two ASCII - /// strings. + /// \brief Retrieve entropy from the accumulator + /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The destination point. This must be initialized. - /// \param radix The numeric base of the input. - /// \param x The first affine coordinate, as a null-terminated string. - /// \param y The second affine coordinate, as a null-terminated string. + /// \param data Entropy context + /// \param output Buffer to fill + /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. - pub fn mbedtls_ecp_point_read_string( - P: *mut mbedtls_ecp_point, - radix: ::core::ffi::c_int, - x: *const ::core::ffi::c_char, - y: *const ::core::ffi::c_char, + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_func( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point into unsigned binary data. + /// \brief Add data to the accumulator manually + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The point to export. This must be initialized. - /// \param format The point format. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// (For groups without these formats, this parameter is - /// ignored. But it still has to be either of the above - /// values.) - /// \param olen The address at which to store the length of - /// the output in Bytes. This must not be \c NULL. - /// \param buf The output buffer. This must be a writable buffer - /// of length \p buflen Bytes. - /// \param buflen The length of the output buffer \p buf in Bytes. + /// \param ctx Entropy context + /// \param data Data to add + /// \param len Length of data /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer - /// is too small to hold the point. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format - /// or the export for the given group is not implemented. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_point_write_binary( - grp: *const mbedtls_ecp_group, - P: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, + /// \return 0 if successful + pub fn mbedtls_entropy_update_manual( + ctx: *mut mbedtls_entropy_context, + data: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a point from unsigned binary data. + /// \brief Checkup routine /// - /// \note This function does not check that the point actually - /// belongs to the given group, see mbedtls_ecp_check_pubkey() - /// for that. + /// This module self-test also calls the entropy self-test, + /// mbedtls_entropy_source_self_test(); /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The CTR_DRBG context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ctr_drbg_context { + ///< The counter (V). + pub private_counter: [::core::ffi::c_uchar; 16usize], + ///< The reseed counter. + /// This is the number of requests that have + /// been made since the last (re)seeding, + /// minus one. + /// Before the initial seeding, this field + /// contains the amount of entropy in bytes + /// to use as a nonce for the initial seeding, + /// or -1 if no nonce length has been explicitly + /// set (see mbedtls_ctr_drbg_set_nonce_len()). + pub private_reseed_counter: ::core::ffi::c_int, + ///< This determines whether prediction + ///resistance is enabled, that is + ///whether to systematically reseed before + ///each random generation. + pub private_prediction_resistance: ::core::ffi::c_int, + ///< The amount of entropy grabbed on each + ///seed or reseed operation, in bytes. + pub private_entropy_len: usize, + ///< The reseed interval. + /// This is the maximum number of requests + /// that can be made between reseedings. + pub private_reseed_interval: ::core::ffi::c_int, + ///< The AES context. + pub private_aes_ctx: mbedtls_aes_context, + pub private_f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + ///< The context for the entropy function. + pub private_p_entropy: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_ctr_drbg_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes the CTR_DRBG context, + /// and prepares it for mbedtls_ctr_drbg_seed() + /// or mbedtls_ctr_drbg_free(). /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The destination context to import the point to. - /// This must be initialized. - /// \param buf The input buffer. This must be a readable buffer - /// of length \p ilen Bytes. - /// \param ilen The length of the input buffer \p buf in Bytes. + /// \note The reseed interval is + /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + /// You can override it by calling + /// mbedtls_ctr_drbg_set_reseed_interval(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the - /// given group is not implemented. - pub fn mbedtls_ecp_point_read_binary( - grp: *const mbedtls_ecp_group, - P: *mut mbedtls_ecp_point, - buf: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to initialize. + pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function imports a point from a TLS ECPoint record. + /// - The \p custom string. /// - /// \note On function return, \p *buf is updated to point immediately - /// after the ECPoint record. + /// \note To achieve the nominal security strength permitted + /// by CTR_DRBG, the entropy length must be: + /// - at least 16 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 32 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The destination point. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the buffer. + /// In addition, if you do not pass a nonce in \p custom, + /// the sum of the entropy length + /// and the entropy nonce length must be: + /// - at least 24 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 48 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization - /// failure. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - pub fn mbedtls_ecp_tls_read_point( - grp: *const mbedtls_ecp_group, - pt: *mut mbedtls_ecp_point, - buf: *mut *const ::core::ffi::c_uchar, + /// \param ctx The CTR_DRBG context to seed. + /// It must have been initialized with + /// mbedtls_ctr_drbg_init(). + /// After a successful call to mbedtls_ctr_drbg_seed(), + /// you may not call mbedtls_ctr_drbg_seed() again on + /// the same context unless you call + /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + /// again first. + /// After a failed call to mbedtls_ctr_drbg_seed(), + /// you must call mbedtls_ctr_drbg_free(). + /// \param f_entropy The entropy callback, taking as arguments the + /// \p p_entropy context, the buffer to fill, and the + /// length of the buffer. + /// \p f_entropy is always called with a buffer size + /// less than or equal to the entropy length. + /// \param p_entropy The entropy context to pass to \p f_entropy. + /// \param custom The personalization string. + /// This can be \c NULL, in which case the personalization + /// string is empty regardless of the value of \p len. + /// \param len The length of the personalization string. + /// This must be at most + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_seed( + ctx: *mut mbedtls_ctr_drbg_context, + f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + p_entropy: *mut ::core::ffi::c_void, + custom: *const ::core::ffi::c_uchar, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point as a TLS ECPoint record - /// defined in RFC 4492, Section 5.4. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to be exported. This must be initialized. - /// \param format The point format to use. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// \param olen The address at which to store the length in Bytes - /// of the data written. - /// \param buf The target buffer. This must be a writable buffer of - /// length \p blen Bytes. - /// \param blen The length of the target buffer \p buf in Bytes. + /// \brief This function resets CTR_DRBG context to the state immediately + /// after initial call of mbedtls_ctr_drbg_init(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer - /// is too small to hold the exported point. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_point( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to clear. + pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function sets up an ECP group context - /// from a standardized set of domain parameters. - /// - /// \note The index should be a value of the NamedCurve enum, - /// as defined in RFC-4492: Elliptic Curve Cryptography - /// (ECC) Cipher Suites for Transport Layer Security (TLS), - /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + /// \brief This function turns prediction resistance on or off. + /// The default value is off. /// - /// \param grp The group context to setup. This must be initialized. - /// \param id The identifier of the domain parameter set to load. + /// \note If enabled, entropy is gathered at the beginning of + /// every call to mbedtls_ctr_drbg_random_with_add() + /// or mbedtls_ctr_drbg_random(). + /// Only use this if your entropy source has sufficient + /// throughput. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_load( - grp: *mut mbedtls_ecp_group, - id: mbedtls_ecp_group_id, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + pub fn mbedtls_ctr_drbg_set_prediction_resistance( + ctx: *mut mbedtls_ctr_drbg_context, + resistance: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function sets up an ECP group context from a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed on each + /// seed or reseed. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. /// - /// \param grp The group context to setup. This must be initialized. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \note The security strength of CTR_DRBG is bounded by the + /// entropy length. Thus: + /// - When using AES-256 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + /// which is the default), + /// \p len must be at least 32 (in bytes) + /// to achieve a 256-bit strength. + /// - When using AES-128 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + /// \p len must be at least 16 (in bytes) + /// to achieve a 128-bit strength. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group( - grp: *mut mbedtls_ecp_group, - buf: *mut *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. + pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); } unsafe extern "C" { - /// \brief This function extracts an elliptic curve group ID from a - /// TLS ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed + /// as a nonce for the initial seeding. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// Call this function before calling mbedtls_ctr_drbg_seed() to read + /// a nonce from the entropy source during the initial seeding. /// - /// \param grp The address at which to store the group id. - /// This must not be \c NULL. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab for the nonce, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group_id( - grp: *mut mbedtls_ecp_group_id, - buf: *mut *const ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + /// if the initial seeding has already taken place. + pub fn mbedtls_ctr_drbg_set_nonce_len( + ctx: *mut mbedtls_ctr_drbg_context, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports an elliptic curve as a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the reseed interval. /// - /// \param grp The ECP group to be exported. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param olen The address at which to store the number of Bytes written. - /// This must not be \c NULL. - /// \param buf The buffer to write to. This must be a writable buffer - /// of length \p blen Bytes. - /// \param blen The length of the output buffer \p buf in Bytes. + /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function + /// is called again. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output - /// buffer is too small to hold the exported group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_group( - grp: *const mbedtls_ecp_group, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// + /// \param ctx The CTR_DRBG context. + /// \param interval The reseed interval. + pub fn mbedtls_ctr_drbg_set_reseed_interval( + ctx: *mut mbedtls_ctr_drbg_context, + interval: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function performs a scalar multiplication of a point - /// by an integer: \p R = \p m * \p P. - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function reseeds the CTR_DRBG context, that is + /// extracts data from the entropy source. /// - /// \note To prevent timing attacks, this function - /// executes the exact same sequence of base-field - /// operations for any valid \p m. It avoids any if-branch or - /// array index depending on the value of \p m. It also uses - /// \p f_rng to randomize some intermediate results. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param ctx The CTR_DRBG context. + /// \param additional Additional data to add to the state. Can be \c NULL. + /// \param len The length of the additional data. + /// This must be less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_reseed( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication of a point by - /// an integer: \p R = \p m * \p P in a restartable way. - /// - /// \see mbedtls_ecp_mul() + /// \brief This function updates the state of the CTR_DRBG context. /// - /// \note This function does the same as \c mbedtls_ecp_mul(), but - /// it can return early and restart according to the limit set - /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. - /// \param rs_ctx The restart context (NULL disables restart). + /// \param ctx The CTR_DRBG context. + /// \param additional The data to update the state with. This must not be + /// \c NULL unless \p add_len is \c 0. + /// \param add_len Length of \p additional in bytes. This must be at + /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecp_restart_ctx, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + /// \p add_len is more than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return An error from the underlying AES cipher on failure. + pub fn mbedtls_ctr_drbg_update( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function updates a CTR_DRBG instance with additional + /// data and uses it to generate random data. /// - /// \note In contrast to mbedtls_ecp_mul(), this function does not - /// guarantee a constant execution flow and timing. + /// This function automatically reseeds if the reseed counter is exceeded + /// or prediction resistance is enabled. /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. + /// \param additional Additional data to update. Can be \c NULL, in which + /// case the additional data is empty regardless of + /// the value of \p add_len. + /// \param add_len The length of the additional data + /// if \p additional is not \c NULL. + /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + /// and less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random_with_add( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q in a - /// restartable way. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. /// - /// \see \c mbedtls_ecp_muladd() + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The CTR_DRBG checkup routine. /// - /// \note This function works the same as \c mbedtls_ecp_muladd(), - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. - /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. - /// \param rs_ctx The restart context (NULL disables restart). - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, - rs_ctx: *mut mbedtls_ecp_restart_ctx, - ) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function checks that a point is a valid public key - /// on this curve. - /// - /// It only checks that the point is non-zero, has - /// valid coordinates and lies on the curve. It does not verify - /// that it is indeed a multiple of \p G. This additional - /// check is computationally more expensive, is not required - /// by standards, and should not be necessary if the group - /// used has a small cofactor. In particular, it is useless for - /// the NIST groups which all have a cofactor of 1. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure, to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the point should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid public key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not - /// a valid public key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_pubkey( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +///< Curve not defined. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; +///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; +///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; +///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; +///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; +///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; +///< Domain parameters for 256-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; +///< Domain parameters for 384-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; +///< Domain parameters for 512-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; +///< Domain parameters for Curve25519. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; +///< Domain parameters for 192-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; +///< Domain parameters for 224-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; +///< Domain parameters for 256-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; +///< Domain parameters for Curve448. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; +/// Domain-parameter identifiers: curve, subgroup, and generator. +/// +/// \note Only curves over prime fields are supported. +/// +/// \warning This library does not support validation of arbitrary domain +/// parameters. Therefore, only standardized domain parameters from trusted +/// sources should be used. See mbedtls_ecp_group_load(). +pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; +pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; +/// Curve information, for use by other modules. +/// +/// The fields of this structure are part of the public API and can be +/// accessed directly by applications. Future versions of the library may +/// add extra fields or reorder existing fields. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_curve_info { + ///< An internal identifier. + pub grp_id: mbedtls_ecp_group_id, + ///< The TLS NamedCurve identifier. + pub tls_id: u16, + ///< The curve size in bits. + pub bit_size: u16, + ///< A human-friendly name. + pub name: *const ::core::ffi::c_char, } -unsafe extern "C" { - /// \brief This function checks that an \p mbedtls_mpi is a - /// valid private key for this curve. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the private key should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The integer to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid private key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid - /// private key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_privkey( - grp: *const mbedtls_ecp_group, - d: *const mbedtls_mpi, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_curve_info { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates a private key. - /// - /// \param grp The ECP group to generate a private key for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_privkey( - grp: *const mbedtls_ecp_group, - d: *mut mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +/// \brief The ECP point structure, in Jacobian coordinates. +/// +/// \note All functions expect and return points satisfying +/// the following condition: Z == 0 or +/// Z == 1. Other values of \p Z are +/// used only by internal functions. +/// The point is zero, or "at infinity", if Z == 0. +/// Otherwise, \p X and \p Y are its standard (affine) +/// coordinates. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_point { + ///< The X coordinate of the ECP point. + pub private_X: mbedtls_mpi, + ///< The Y coordinate of the ECP point. + pub private_Y: mbedtls_mpi, + ///< The Z coordinate of the ECP point. + pub private_Z: mbedtls_mpi, } -unsafe extern "C" { - /// \brief This function generates a keypair with a configurable base - /// point. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param G The base point to use. This must be initialized - /// and belong to \p grp. It replaces the default base - /// point \c grp->G used by mbedtls_ecp_gen_keypair(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair_base( - grp: *mut mbedtls_ecp_group, - G: *const mbedtls_ecp_point, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_point { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates an ECP keypair. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. +/// \brief The ECP group structure. +/// +/// We consider two types of curve equations: +///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P +/// (SEC1 + RFC-4492)
            • +///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, +/// Curve448)
          +/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. +/// +/// For Short Weierstrass, this subgroup is the whole curve, and its +/// cardinality is denoted by \p N. Our code requires that \p N is an +/// odd prime as mbedtls_ecp_mul() requires an odd number, and +/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. +/// +/// The default implementation only initializes \p A without setting it to the +/// authentic value for curves with A = -3(SECP256R1, etc), in which +/// case you need to load \p A by yourself when using domain parameters directly, +/// for example: +/// \code +/// mbedtls_mpi_init(&A); +/// mbedtls_ecp_group_init(&grp); +/// CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); +/// if (mbedtls_ecp_group_a_is_minus_3(&grp)) { +/// CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); +/// } else { +/// CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); +/// } +/// +/// do_something_with_a(&A); +/// +/// cleanup: +/// mbedtls_mpi_free(&A); +/// mbedtls_ecp_group_free(&grp); +/// \endcode +/// +/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, +/// which is the quantity used in the formulas. Additionally, \p nbits is +/// not the size of \p N but the required size for private keys. +/// +/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. +/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the +/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer +/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits +/// in size, so that it may be efficiently brought in the 0..P-1 range by a few +/// additions or subtractions. Therefore, it is only an approximate modular +/// reduction. It must return 0 on success and non-zero on failure. +/// +/// \note Alternative implementations of the ECP module must obey the +/// following constraints. +/// * Group IDs must be distinct: if two group structures have +/// the same ID, then they must be identical. +/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, +/// \c pbits and \c nbits must have the same type and semantics +/// as in the built-in implementation. +/// They must be available for reading, but direct modification +/// of these fields does not need to be supported. +/// They do not need to be at the same offset in the structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_group { + ///< An internal group identifier. + pub id: mbedtls_ecp_group_id, + ///< The prime modulus of the base field. + pub P: mbedtls_mpi, + ///< For Short Weierstrass: \p A in the equation. Note that + ///\p A is not set to the authentic value in some cases. + ///Refer to detailed description of ::mbedtls_ecp_group if + ///using domain parameters in the structure. + ///For Montgomery curves: (A + 2) / 4. + pub A: mbedtls_mpi, + ///< For Short Weierstrass: \p B in the equation. + ///For Montgomery curves: unused. + pub B: mbedtls_mpi, + ///< The generator of the subgroup used. + pub G: mbedtls_ecp_point, + ///< The order of \p G. + pub N: mbedtls_mpi, + ///< The number of bits in \p P. + pub pbits: usize, + ///< For Short Weierstrass: The number of bits in \p P. + ///For Montgomery curves: the number of bits in the + ///private keys. + pub nbits: usize, + ///< \internal 1 if the constants are static. + pub private_h: ::core::ffi::c_uint, + ///< The function for fast pseudo-reduction + ///mod \p P (see above). + pub private_modp: + ::core::option::Option ::core::ffi::c_int>, + ///< Unused. + pub private_t_pre: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_post: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_data: *mut ::core::ffi::c_void, + ///< Pre-computed points for ecp_mul_comb(). + pub private_T: *mut mbedtls_ecp_point, + ///< The number of dynamic allocated pre-computed points. + pub private_T_size: usize, +} +impl Default for mbedtls_ecp_group { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; +/// \brief The ECP key-pair structure. +/// +/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. +/// +/// \note Members are deliberately in the same order as in the +/// ::mbedtls_ecdsa_context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_keypair { + ///< Elliptic curve and base point + pub private_grp: mbedtls_ecp_group, + ///< our secret value + pub private_d: mbedtls_mpi, + ///< our public value + pub private_Q: mbedtls_ecp_point, +} +impl Default for mbedtls_ecp_keypair { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +} +unsafe extern "C" { + /// \brief This function retrieves the information defined in + /// mbedtls_ecp_curve_info() for all supported curves. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair( - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. + /// + /// \return A statically allocated array. The last entry is 0. + pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function generates an ECP key. + /// \brief This function retrieves the list of internal group + /// identifiers of all supported curves in the order of + /// preference. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. This must be initialized. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_key( - grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return A statically allocated array, + /// terminated with MBEDTLS_ECP_DP_NONE. + pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function reads an elliptic curve private key. + /// \brief This function retrieves curve information from an internal + /// group identifier. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. - /// \param buf The buffer containing the binary representation of the - /// key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The length of the buffer in bytes. + /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is - /// invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_read_key( + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_grp_id( grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - buf: *const ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports an elliptic curve private key. + /// \brief This function retrieves curve information from a TLS + /// NamedCurve value. /// - /// \param key The private key. - /// \param buf The output buffer for containing the binary representation - /// of the key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The total length of the buffer in bytes. + /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key - ///representation is larger than the available space in \p buf. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_write_key( - key: *mut mbedtls_ecp_keypair, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function checks that the keypair objects - /// \p pub and \p prv have the same group and the - /// same public point, and that the private key in - /// \p prv is consistent with the public key. + /// \brief This function retrieves curve information from a + /// human-readable name. /// - /// \param pub The keypair structure holding the public key. This - /// must be initialized. If it contains a private key, that - /// part is ignored. - /// \param prv The keypair structure holding the full keypair. - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param name The human-readable name. /// - /// \return \c 0 on success, meaning that the keys are valid and match. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. - /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX - /// error code on calculation failure. - pub fn mbedtls_ecp_check_pub_priv( - pub_: *const mbedtls_ecp_keypair, - prv: *const mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_name( + name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports generic key-pair parameters. - /// - /// \param key The key pair to export from. - /// \param grp Slot for exported ECP group. - /// It must point to an initialized ECP group. - /// \param d Slot for the exported secret value. - /// It must point to an initialized mpi. - /// \param Q Slot for the exported public value. - /// It must point to an initialized ECP point. + /// \brief This function initializes a point as zero. /// - /// \return \c 0 on success, - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_export( - key: *const mbedtls_ecp_keypair, - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \param pt The point to initialize. + pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief The ECP checkup routine. + /// \brief This function initializes an ECP group context + /// without loading any domain parameters. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< None. -pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; -///< The MD5 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 1; -///< The SHA-1 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 2; -///< The SHA-224 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 3; -///< The SHA-256 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 4; -///< The SHA-384 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 5; -///< The SHA-512 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 6; -///< The RIPEMD-160 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 7; -/// \brief Supported message digests. -/// -/// \warning MD5 and SHA-1 are considered weak message digests and -/// their use constitutes a security risk. We recommend considering -/// stronger message digests instead. -pub type mbedtls_md_type_t = ::core::ffi::c_uint; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_info_t { - _unused: [u8; 0], -} -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; -/// Used internally to indicate whether a context uses legacy or PSA. -/// -/// Internal use only. -pub type mbedtls_md_engine_t = ::core::ffi::c_uint; -/// The generic message-digest context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_context_t { - /// Information about the associated message digest. - pub private_md_info: *const mbedtls_md_info_t, - /// The digest-specific context (legacy) or the PSA operation. - pub private_md_ctx: *mut ::core::ffi::c_void, - /// The HMAC part of the context. - pub private_hmac_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_md_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \note After this function is called, domain parameters + /// for various ECP groups can be loaded through the + /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + /// functions. + pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest type. - /// - /// \param md_type The type of digest to search for. + /// \brief This function initializes a key pair as an invalid one. /// - /// \return The message-digest information associated with \p md_type. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; + /// \param key The key pair to initialize. + pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); } unsafe extern "C" { - /// \brief This function initializes a message-digest context without - /// binding it to a particular message-digest algorithm. + /// \brief This function frees the components of a point. /// - /// This function should always be called first. It prepares the - /// context for mbedtls_md_setup() for binding it to a - /// message-digest algorithm. - pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); + /// \param pt The point to free. + pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief This function clears the internal structure of \p ctx and - /// frees any embedded internal structure, but does not free - /// \p ctx itself. + /// \brief This function frees the components of an ECP group. /// - /// If you have called mbedtls_md_setup() on \p ctx, you must - /// call mbedtls_md_free() when you are no longer using the - /// context. - /// Calling this function if you have previously - /// called mbedtls_md_init() and nothing else is optional. - /// You must not call this function if you have not called - /// mbedtls_md_init(). - pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); + /// \param grp The group to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP group. + pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function selects the message digest algorithm to use, - /// and allocates internal structures. + /// \brief This function frees the components of a key pair. /// - /// It should be called after mbedtls_md_init() or - /// mbedtls_md_free(). Makes it necessary to call - /// mbedtls_md_free() later. + /// \param key The key pair to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP key pair. + pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +} +unsafe extern "C" { + /// \brief This function copies the contents of point \p Q into + /// point \p P. /// - /// \param ctx The context to set up. - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), - /// or non-zero: HMAC is used with this context. + /// \param P The destination point. This must be initialized. + /// \param Q The source point. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. - pub fn mbedtls_md_setup( - ctx: *mut mbedtls_md_context_t, - md_info: *const mbedtls_md_info_t, - hmac: ::core::ffi::c_int, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code for other kinds of failure. + pub fn mbedtls_ecp_copy( + P: *mut mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function clones the state of a message-digest - /// context. - /// - /// \note You must call mbedtls_md_setup() on \c dst before calling - /// this function. - /// - /// \note The two contexts must have the same type, - /// for example, both are SHA-256. - /// - /// \warning This function clones the message-digest state, not the - /// HMAC state. + /// \brief This function copies the contents of group \p src into + /// group \p dst. /// - /// \param dst The destination context. - /// \param src The context to be cloned. + /// \param dst The destination group. This must be initialized. + /// \param src The source group. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. - /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are - /// not using the same engine. This can be avoided by moving - /// the call to psa_crypto_init() before the first call to - /// mbedtls_md_setup(). - pub fn mbedtls_md_clone( - dst: *mut mbedtls_md_context_t, - src: *const mbedtls_md_context_t, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_copy( + dst: *mut mbedtls_ecp_group, + src: *const mbedtls_ecp_group, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest size from the - /// message-digest information structure. + /// \brief This function sets a point to the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to set. This must be initialized. /// - /// \return The size of the message-digest output in Bytes. - pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest type from the - /// message-digest information structure. + /// \brief This function checks if a point is the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to test. This must be initialized. /// - /// \return The type of the message digest. - pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; + /// \return \c 1 if the point is zero. + /// \return \c 0 if the point is non-zero. + /// \return A negative error code on failure. + pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function starts a message-digest computation. + /// \brief This function compares two points. /// - /// You must call this function after setting up the context - /// with mbedtls_md_setup(), and before passing data with - /// mbedtls_md_update(). + /// \note This assumes that the points are normalized. Otherwise, + /// they may compare as "not equal" even if they are. /// - /// \param ctx The generic message-digest context. + /// \param P The first point to compare. This must be initialized. + /// \param Q The second point to compare. This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return \c 0 if the points are equal. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + pub fn mbedtls_ecp_point_cmp( + P: *const mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// message-digest computation. - /// - /// You must call mbedtls_md_starts() before calling this - /// function. You may call this function multiple times. - /// Afterwards, call mbedtls_md_finish(). + /// \brief This function imports a non-zero point from two ASCII + /// strings. /// - /// \param ctx The generic message-digest context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param P The destination point. This must be initialized. + /// \param radix The numeric base of the input. + /// \param x The first affine coordinate, as a null-terminated string. + /// \param y The second affine coordinate, as a null-terminated string. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + pub fn mbedtls_ecp_point_read_string( + P: *mut mbedtls_ecp_point, + radix: ::core::ffi::c_int, + x: *const ::core::ffi::c_char, + y: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the digest operation, - /// and writes the result to the output buffer. - /// - /// Call this function after a call to mbedtls_md_starts(), - /// followed by any number of calls to mbedtls_md_update(). - /// Afterwards, you may either clear the context with - /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse - /// the context for another digest operation with the same - /// algorithm. + /// \brief This function exports a point into unsigned binary data. /// - /// \param ctx The generic message-digest context. - /// \param output The buffer for the generic message-digest checksum result. + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The point to export. This must be initialized. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_point_write_binary( + grp: *const mbedtls_ecp_group, + P: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the message-digest of a buffer, - /// with respect to a configurable message-digest algorithm - /// in a single call. + /// \brief This function imports a point from unsigned binary data. /// - /// The result is calculated as - /// Output = message_digest(input buffer). + /// \note This function does not check that the point actually + /// belongs to the given group, see mbedtls_ecp_check_pubkey() + /// for that. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param input The buffer holding the data. - /// \param ilen The length of the input data. - /// \param output The generic message-digest checksum result. + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md( - md_info: *const mbedtls_md_info_t, - input: *const ::core::ffi::c_uchar, + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The destination context to import the point to. + /// This must be initialized. + /// \param buf The input buffer. This must be a readable buffer + /// of length \p ilen Bytes. + /// \param ilen The length of the input buffer \p buf in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + /// given group is not implemented. + pub fn mbedtls_ecp_point_read_binary( + grp: *const mbedtls_ecp_group, + P: *mut mbedtls_ecp_point, + buf: *const ::core::ffi::c_uchar, ilen: usize, - output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the list of digests supported by the - /// generic digest module. - /// - /// \note The list starts with the strongest available hashes. + /// \brief This function imports a point from a TLS ECPoint record. /// - /// \return A statically allocated array of digests. Each element - /// in the returned list is an integer belonging to the - /// message-digest enumeration #mbedtls_md_type_t. - /// The last entry is 0. - pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest name. + /// \note On function return, \p *buf is updated to point immediately + /// after the ECPoint record. /// - /// \param md_name The name of the digest to search for. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The destination point. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the buffer. /// - /// \return The message-digest information associated with \p md_name. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_string( - md_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_md_info_t; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + /// failure. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + pub fn mbedtls_ecp_tls_read_point( + grp: *const mbedtls_ecp_group, + pt: *mut mbedtls_ecp_point, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest name from the - /// message-digest information structure. + /// \brief This function exports a point as a TLS ECPoint record + /// defined in RFC 4492, Section 5.4. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to be exported. This must be initialized. + /// \param format The point format to use. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// \param olen The address at which to store the length in Bytes + /// of the data written. + /// \param buf The target buffer. This must be a writable buffer of + /// length \p blen Bytes. + /// \param blen The length of the target buffer \p buf in Bytes. /// - /// \return The name of the message digest. - pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + /// is too small to hold the exported point. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_point( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// from the given context. + /// \brief This function sets up an ECP group context + /// from a standardized set of domain parameters. /// - /// \param ctx The context from which to extract the information. - /// This must be initialized (or \c NULL). + /// \note The index should be a value of the NamedCurve enum, + /// as defined in RFC-4492: Elliptic Curve Cryptography + /// (ECC) Cipher Suites for Transport Layer Security (TLS), + /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. /// - /// \return The message-digest information associated with \p ctx. - /// \return \c NULL if \p ctx is \c NULL. - pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; + /// \param grp The group context to setup. This must be initialized. + /// \param id The identifier of the domain parameter set to load. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_load( + grp: *mut mbedtls_ecp_group, + id: mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the HMAC key and prepares to - /// authenticate a new message. + /// \brief This function sets up an ECP group context from a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_setup(), to use - /// the MD context for an HMAC calculation, then call - /// mbedtls_md_hmac_update() to provide the input data, and - /// mbedtls_md_hmac_finish() to get the HMAC value. + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC key in Bytes. + /// \param grp The group context to setup. This must be initialized. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_starts( - ctx: *mut mbedtls_md_context_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group( + grp: *mut mbedtls_ecp_group, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing HMAC - /// computation. + /// \brief This function extracts an elliptic curve group ID from a + /// TLS ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() - /// before calling this function. - /// You may call this function multiple times to pass the - /// input piecewise. - /// Afterwards, call mbedtls_md_hmac_finish(). + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param grp The address at which to store the group id. + /// This must not be \c NULL. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group_id( + grp: *mut mbedtls_ecp_group_id, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the HMAC operation, and writes - /// the result to the output buffer. + /// \brief This function exports an elliptic curve as a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_hmac_starts() and - /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards - /// you may either call mbedtls_md_free() to clear the context, - /// or call mbedtls_md_hmac_reset() to reuse the context with - /// the same HMAC key. - /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param output The generic HMAC checksum result. + /// \param grp The ECP group to be exported. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param olen The address at which to store the number of Bytes written. + /// This must not be \c NULL. + /// \param buf The buffer to write to. This must be a writable buffer + /// of length \p blen Bytes. + /// \param blen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + /// buffer is too small to hold the exported group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_group( + grp: *const mbedtls_ecp_group, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function prepares to authenticate a new message with - /// the same key as the previous HMAC operation. + /// \brief This function performs a scalar multiplication of a point + /// by an integer: \p R = \p m * \p P. /// - /// You may call this function after mbedtls_md_hmac_finish(). - /// Afterwards call mbedtls_md_hmac_update() to pass the new - /// input. + /// It is not thread-safe to use same group in multiple threads. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. + /// \note To prevent timing attacks, this function + /// executes the exact same sequence of base-field + /// operations for any valid \p m. It avoids any if-branch or + /// array index depending on the value of \p m. It also uses + /// \p f_rng to randomize some intermediate results. + /// + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the full generic HMAC - /// on the input buffer with the provided key. + /// \brief This function performs multiplication of a point by + /// an integer: \p R = \p m * \p P in a restartable way. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// \see mbedtls_ecp_mul() /// - /// The HMAC result is calculated as - /// output = generic HMAC(hmac key, input buffer). + /// \note This function does the same as \c mbedtls_ecp_mul(), but + /// it can return early and restart according to the limit set + /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC secret key in Bytes. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. - /// \param output The generic HMAC result. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac( - md_info: *const mbedtls_md_info_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecp_restart_ctx, ) -> ::core::ffi::c_int; } -/// \brief The RSA context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_rsa_context { - ///< Reserved for internal purposes. - /// Do not set this field in application - /// code. Its meaning might change without - /// notice. - pub private_ver: ::core::ffi::c_int, - ///< The size of \p N in Bytes. - pub private_len: usize, - ///< The public modulus. - pub private_N: mbedtls_mpi, - ///< The public exponent. - pub private_E: mbedtls_mpi, - ///< The private exponent. - pub private_D: mbedtls_mpi, - ///< The first prime factor. - pub private_P: mbedtls_mpi, - ///< The second prime factor. - pub private_Q: mbedtls_mpi, - ///< D % (P - 1). - pub private_DP: mbedtls_mpi, - ///< D % (Q - 1). - pub private_DQ: mbedtls_mpi, - ///< 1 / (Q % P). - pub private_QP: mbedtls_mpi, - ///< cached R^2 mod N. - pub private_RN: mbedtls_mpi, - ///< cached R^2 mod P. - pub private_RP: mbedtls_mpi, - ///< cached R^2 mod Q. - pub private_RQ: mbedtls_mpi, - ///< The cached blinding value. - pub private_Vi: mbedtls_mpi, - ///< The cached un-blinding value. - pub private_Vf: mbedtls_mpi, - ///< Selects padding mode: - ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and - ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. - pub private_padding: ::core::ffi::c_int, - ///< Hash identifier of mbedtls_md_type_t type, - ///as specified in md.h for use in the MGF - ///mask generating function used in the - ///EME-OAEP and EMSA-PSS encodings. - pub private_hash_id: ::core::ffi::c_int, -} -impl Default for mbedtls_rsa_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes an RSA context. - /// - /// \note This function initializes the padding and the hash - /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and - /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more - /// information about those parameters. - /// - /// \param ctx The RSA context to initialize. This must not be \c NULL. - pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); -} -unsafe extern "C" { - /// \brief This function sets padding for an already initialized RSA - /// context. - /// - /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP - /// encryption scheme and the RSASSA-PSS signature scheme. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q /// - /// \note The \p hash_id parameter is ignored when using - /// #MBEDTLS_RSA_PKCS_V15 padding. + /// It is not thread-safe to use same group in multiple threads. /// - /// \note The choice of padding mode is strictly enforced for private - /// key operations, since there might be security concerns in - /// mixing padding modes. For public key operations it is - /// a default value, which can be overridden by calling specific - /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx - /// functions. + /// \note In contrast to mbedtls_ecp_mul(), this function does not + /// guarantee a constant execution flow and timing. /// - /// \note The hash selected in \p hash_id is always used for OEAP - /// encryption. For PSS signatures, it is always used for - /// making signatures, but can be overridden for verifying them. - /// If set to #MBEDTLS_MD_NONE, it is always overridden. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \param ctx The initialized RSA context to be configured. - /// \param padding The padding mode to use. This must be either - /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. - /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is - /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this - /// function but may be not suitable for some operations. - /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: - /// \p padding or \p hash_id is invalid. - pub fn mbedtls_rsa_set_padding( - ctx: *mut mbedtls_rsa_context, - padding: ::core::ffi::c_int, - hash_id: mbedtls_md_type_t, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves padding mode of initialized - /// RSA context. - /// - /// \param ctx The initialized RSA context. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q in a + /// restartable way. /// - /// \return RSA padding mode. - pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function retrieves hash identifier of mbedtls_md_type_t - /// type. + /// \see \c mbedtls_ecp_muladd() /// - /// \param ctx The initialized RSA context. + /// \note This function works the same as \c mbedtls_ecp_muladd(), + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return Hash identifier of mbedtls_md_type_t type. - pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function imports a set of core parameters into an - /// RSA context. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, + rs_ctx: *mut mbedtls_ecp_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function checks that a point is a valid public key + /// on this curve. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// It only checks that the point is non-zero, has + /// valid coordinates and lies on the curve. It does not verify + /// that it is indeed a multiple of \c G. This additional + /// check is computationally more expensive, is not required + /// by standards, and should not be necessary if the group + /// used has a small cofactor. In particular, it is useless for + /// the NIST groups which all have a cofactor of 1. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure, to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param E The public exponent. This may be \c NULL. + /// \param grp The ECP group the point should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to check. This must be initialized. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import( - ctx: *mut mbedtls_rsa_context, - N: *const mbedtls_mpi, - P: *const mbedtls_mpi, - Q: *const mbedtls_mpi, - D: *const mbedtls_mpi, - E: *const mbedtls_mpi, + /// \return \c 0 if the point is a valid public key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + /// a valid public key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_pubkey( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports core RSA parameters, in raw big-endian - /// binary format, into an RSA context. - /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \brief This function checks that an \c mbedtls_mpi is a + /// valid private key for this curve. /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// \param grp The ECP group the private key should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The integer to check. This must be initialized. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \return \c 0 if the point is a valid private key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + /// private key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_privkey( + grp: *const mbedtls_ecp_group, + d: *const mbedtls_mpi, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates a private key. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. - /// \param E The public exponent. This may be \c NULL. - /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// \param grp The ECP group to generate a private key for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import_raw( - ctx: *mut mbedtls_rsa_context, - N: *const ::core::ffi::c_uchar, - N_len: usize, - P: *const ::core::ffi::c_uchar, - P_len: usize, - Q: *const ::core::ffi::c_uchar, - Q_len: usize, - D: *const ::core::ffi::c_uchar, - D_len: usize, - E: *const ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_privkey( + grp: *const mbedtls_ecp_group, + d: *mut mbedtls_mpi, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function completes an RSA context from - /// a set of imported core parameters. - /// - /// To setup an RSA public key, precisely \p N and \p E - /// must have been imported. + /// \brief This function generates a keypair with a configurable base + /// point. /// - /// To setup an RSA private key, sufficient information must - /// be present for the other parameters to be derivable. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// The default implementation supports the following: - ///
          • Derive \p P, \p Q from \p N, \p D, \p E.
            • - ///
          • Derive \p N, \p D from \p P, \p Q, \p E.
          - /// Alternative implementations need not support these. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param G The base point to use. This must be initialized + /// and belong to \p grp. It replaces the default base + /// point \c grp->G used by mbedtls_ecp_gen_keypair(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// If this function runs successfully, it guarantees that - /// the RSA context can be used for RSA operations without - /// the risk of failure or crash. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair_base( + grp: *mut mbedtls_ecp_group, + G: *const mbedtls_ecp_point, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates an ECP keypair. /// - /// \warning This function need not perform consistency checks - /// for the imported parameters. In particular, parameters that - /// are not needed by the implementation might be silently - /// discarded and left unchecked. To check the consistency - /// of the key material, see mbedtls_rsa_check_privkey(). + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context holding imported parameters. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations - /// failed. - pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair( + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports the core parameters of an RSA key. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. - /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \brief This function generates an ECP key. /// - /// \param ctx The initialized RSA context. - /// \param N The MPI to hold the RSA modulus. - /// This may be \c NULL if this field need not be exported. - /// \param P The MPI to hold the first prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param Q The MPI to hold the second prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param D The MPI to hold the private exponent. - /// This may be \c NULL if this field need not be exported. - /// \param E The MPI to hold the public exponent. - /// This may be \c NULL if this field need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. This must be initialized. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export( - ctx: *const mbedtls_rsa_context, - N: *mut mbedtls_mpi, - P: *mut mbedtls_mpi, - Q: *mut mbedtls_mpi, - D: *mut mbedtls_mpi, - E: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports core parameters of an RSA key - /// in raw big-endian binary format. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. + /// \brief Set the public key in a key pair object. /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \note This function does not check that the point actually + /// belongs to the given group. Call mbedtls_ecp_check_pubkey() + /// on \p Q before calling this function to check that. /// - /// \note The length parameters are ignored if the corresponding - /// buffer pointers are NULL. + /// \note This function does not check that the public key matches + /// the private key that is already in \p key, if any. + /// To check the consistency of the resulting key pair object, + /// call mbedtls_ecp_check_pub_priv() after setting both + /// the public key and the private key. /// - /// \param ctx The initialized RSA context. - /// \param N The Byte array to store the RSA modulus, - /// or \c NULL if this field need not be exported. - /// \param N_len The size of the buffer for the modulus. - /// \param P The Byte array to hold the first prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param P_len The size of the buffer for the first prime factor. - /// \param Q The Byte array to hold the second prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param Q_len The size of the buffer for the second prime factor. - /// \param D The Byte array to hold the private exponent, - /// or \c NULL if this field need not be exported. - /// \param D_len The size of the buffer for the private exponent. - /// \param E The Byte array to hold the public exponent, - /// or \c NULL if this field need not be exported. - /// \param E_len The size of the buffer for the public exponent. + /// \param grp_id The ECP group identifier. + /// \param key The key pair object. It must be initialized. + /// If its group has already been set, it must match \p grp_id. + /// If its group has not been set, it will be set to \p grp_id. + /// If the public key has already been set, it is overwritten. + /// \param Q The public key to copy. This must be a point on the + /// curve indicated by \p grp_id. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export_raw( - ctx: *const mbedtls_rsa_context, - N: *mut ::core::ffi::c_uchar, - N_len: usize, - P: *mut ::core::ffi::c_uchar, - P_len: usize, - Q: *mut ::core::ffi::c_uchar, - Q_len: usize, - D: *mut ::core::ffi::c_uchar, - D_len: usize, - E: *mut ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + /// match \p grp_id. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_public_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports CRT parameters of a private RSA key. + /// \brief This function reads an elliptic curve private key. /// - /// \note Alternative RSA implementations not using CRT-parameters - /// internally can implement this function based on - /// mbedtls_rsa_deduce_opt(). + /// \note This function does not set the public key in the + /// key pair object. Without a public key, the key pair object + /// cannot be used with operations that require the public key. + /// Call mbedtls_ecp_keypair_calc_public() to set the public + /// key from the private key. Alternatively, you can call + /// mbedtls_ecp_set_public_key() to set the public key part, + /// and then optionally mbedtls_ecp_check_pub_priv() to check + /// that the private and public parts are consistent. + /// + /// \note If a public key has already been set in the key pair + /// object, this function does not check that it is consistent + /// with the private key. Call mbedtls_ecp_check_pub_priv() + /// after setting both the public key and the private key + /// to make that check. /// - /// \param ctx The initialized RSA context. - /// \param DP The MPI to hold \c D modulo `P-1`, - /// or \c NULL if it need not be exported. - /// \param DQ The MPI to hold \c D modulo `Q-1`, - /// or \c NULL if it need not be exported. - /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, - /// or \c NULL if it need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. + /// \param buf The buffer containing the binary representation of the + /// key. (Big endian integer for Weierstrass curves, byte + /// string for Montgomery curves.) + /// \param buflen The length of the buffer in bytes. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_export_crt( - ctx: *const mbedtls_rsa_context, - DP: *mut mbedtls_mpi, - DQ: *mut mbedtls_mpi, - QP: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + /// invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_read_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + buf: *const ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves the length of RSA modulus in Bytes. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context. + /// \deprecated Note that although this function accepts an output + /// buffer that is smaller or larger than the key, most key + /// import interfaces require the output to have exactly + /// key's nominal length. It is generally simplest to + /// pass the key's nominal length as \c buflen, after + /// checking that the output buffer is large enough. + /// See the description of the \p buflen parameter for + /// how to calculate the nominal length. + /// To avoid this difficulty, use mbedtls_ecp_write_key_ext() + /// instead. + /// mbedtls_ecp_write_key() is deprecated and will be + /// removed in a future version of the library. + /// + /// \note If the private key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \return The length of the RSA modulus in Bytes. - pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; + /// \param key The private key. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// For Weierstrass curves, this is the big-endian + /// representation, padded with null bytes at the beginning + /// to reach \p buflen bytes. + /// For Montgomery curves, this is the standard byte string + /// representation (which is little-endian), padded with + /// null bytes at the end to reach \p buflen bytes. + /// \param buflen The total length of the buffer in bytes. + /// The length of the output is + /// (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// For Weierstrass keys, if the output buffer is smaller, + /// leading zeros are trimmed to fit if possible. For + /// Montgomery keys, the output buffer must always be large + /// enough for the nominal length. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + /// #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key( + key: *mut mbedtls_ecp_keypair, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an RSA keypair. - /// - /// \note mbedtls_rsa_init() must be called before this function, - /// to set up the RSA context. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context used to hold the key. - /// \param f_rng The RNG function to be used for key generation. - /// This is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. - /// This may be \c NULL if \p f_rng doesn't need a context. - /// \param nbits The size of the public key in bits. - /// \param exponent The public exponent to use. For example, \c 65537. - /// This must be odd and greater than \c 1. + /// \param key The private key. + /// \param olen On success, the length of the private key. + /// This is always (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// \param buflen The total length of the buffer in bytes. + /// #MBEDTLS_ECP_MAX_BYTES is always sufficient. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_gen_key( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - nbits: ::core::ffi::c_uint, - exponent: ::core::ffi::c_int, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + /// set in \p key. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key_ext( + key: *const mbedtls_ecp_keypair, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains at least an RSA - /// public key. + /// \brief This function exports an elliptic curve public key. /// - /// If the function runs successfully, it is guaranteed that - /// enough information is present to perform an RSA public key - /// operation using mbedtls_rsa_public(). + /// \note If the public key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to check. + /// \param key The public key. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_write_public_key( + key: *const mbedtls_ecp_keypair, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains an RSA private key - /// and perform basic consistency checks. - /// - /// \note The consistency checks performed by this function not only - /// ensure that mbedtls_rsa_private() can be called successfully - /// on the given context, but that the various parameters are - /// mutually consistent with high probability, in the sense that - /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// \brief This function checks that the keypair objects + /// \p pub and \p prv have the same group and the + /// same public point, and that the private key in + /// \p prv is consistent with the public key. /// - /// \warning This function should catch accidental misconfigurations - /// like swapping of parameters, but it cannot establish full - /// trust in neither the quality nor the consistency of the key - /// material that was used to setup the given RSA context: - ///
          • Consistency: Imported parameters that are irrelevant - /// for the implementation might be silently dropped. If dropped, - /// the current function does not have access to them, - /// and therefore cannot check them. See mbedtls_rsa_complete(). - /// If you want to check the consistency of the entire - /// content of a PKCS1-encoded RSA private key, for example, you - /// should use mbedtls_rsa_validate_params() before setting - /// up the RSA context. - /// Additionally, if the implementation performs empirical checks, - /// these checks substantiate but do not guarantee consistency.
            • - ///
          • Quality: This function is not expected to perform - /// extended quality assessments like checking that the prime - /// factors are safe. Additionally, it is the responsibility of the - /// user to ensure the trustworthiness of the source of his RSA - /// parameters, which goes beyond what is effectively checkable - /// by the library.
          - /// - /// \param ctx The initialized RSA context to check. + /// \param pub The keypair structure holding the public key. This + /// must be initialized. If it contains a private key, that + /// part is ignored. + /// \param prv The keypair structure holding the full keypair. + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success, meaning that the keys are valid and match. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_check_pub_priv( + pub_: *const mbedtls_ecp_keypair, + prv: *const mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks a public-private RSA key pair. - /// - /// It checks each of the contexts, and makes sure they match. + /// \brief Calculate the public key from a private key in a key pair. /// - /// \param pub The initialized RSA context holding the public key. - /// \param prv The initialized RSA context holding the private key. + /// \param key A keypair structure. It must have a private key set. + /// If the public key is set, it will be overwritten. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pub_priv( - pub_: *const mbedtls_rsa_context, - prv: *const mbedtls_rsa_context, + /// \return \c 0 on success. The key pair object can be used for + /// operations that require the public key. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_keypair_calc_public( + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs an RSA public key operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// - /// \note This function does not handle message padding. + /// \brief Query the group that a key pair belongs to. /// - /// \note Make sure to set \p input[0] = 0 or ensure that - /// input is smaller than \p N. + /// \param key The key pair to query. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_public( - ctx: *mut mbedtls_rsa_context, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The group ID for the group registered in the key pair + /// object. + /// This is \c MBEDTLS_ECP_DP_NONE if no group has been set + /// in the key pair object. + pub fn mbedtls_ecp_keypair_get_group_id( + key: *const mbedtls_ecp_keypair, + ) -> mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function performs an RSA private key operation. - /// - /// \note Blinding is used if and only if a PRNG is provided. + /// \brief This function exports generic key-pair parameters. /// - /// \note If blinding is used, both the base of exponentiation - /// and the exponent are blinded, providing protection - /// against some side-channel attacks. + /// Each of the output parameters can be a null pointer + /// if you do not need that parameter. /// - /// \warning It is deprecated and a security risk to not provide - /// a PRNG here and thereby prevent the use of blinding. - /// Future versions of the library may enforce the presence - /// of a PRNG. + /// \note If the private key or the public key was not set in \p key, + /// the corresponding output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function, used for blinding. It is mandatory. - /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param key The key pair to export from. + /// \param grp Slot for exported ECP group. + /// It must either be null or point to an initialized ECP group. + /// \param d Slot for the exported secret value. + /// It must either be null or point to an initialized mpi. + /// \param Q Slot for the exported public value. + /// It must either be null or point to an initialized ECP point. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_private( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_export( + key: *const mbedtls_ecp_keypair, + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function adds the message padding, then performs an RSA - /// operation. - /// - /// It is the generic wrapper for performing a PKCS#1 encryption - /// operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG to use. It is used for padding generation - /// and it is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. May be - /// \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \brief The ECP checkup routine. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return \c 1 on failure. + pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The RSA context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_rsa_context { + ///< Reserved for internal purposes. + /// Do not set this field in application + /// code. Its meaning might change without + /// notice. + pub private_ver: ::core::ffi::c_int, + ///< The size of \p N in Bytes. + pub private_len: usize, + ///< The public modulus. + pub private_N: mbedtls_mpi, + ///< The public exponent. + pub private_E: mbedtls_mpi, + ///< The private exponent. + pub private_D: mbedtls_mpi, + ///< The first prime factor. + pub private_P: mbedtls_mpi, + ///< The second prime factor. + pub private_Q: mbedtls_mpi, + ///< D % (P - 1). + pub private_DP: mbedtls_mpi, + ///< D % (Q - 1). + pub private_DQ: mbedtls_mpi, + ///< 1 / (Q % P). + pub private_QP: mbedtls_mpi, + ///< cached R^2 mod N. + pub private_RN: mbedtls_mpi, + ///< cached R^2 mod P. + pub private_RP: mbedtls_mpi, + ///< cached R^2 mod Q. + pub private_RQ: mbedtls_mpi, + ///< The cached blinding value. + pub private_Vi: mbedtls_mpi, + ///< The cached un-blinding value. + pub private_Vf: mbedtls_mpi, + ///< Selects padding mode: + ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. + pub private_padding: ::core::ffi::c_int, + ///< Hash identifier of mbedtls_md_type_t type, + ///as specified in md.h for use in the MGF + ///mask generating function used in the + ///EME-OAEP and EMSA-PSS encodings. + pub private_hash_id: ::core::ffi::c_int, +} +impl Default for mbedtls_rsa_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 encryption operation - /// (RSAES-PKCS1-v1_5-ENCRYPT). + /// \brief This function initializes an RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. It is mandatory and used for - /// padding generation. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note This function initializes the padding and the hash + /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + /// information about those parameters. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The RSA context to initialize. This must not be \c NULL. + pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP encryption - /// operation (RSAES-OAEP-ENCRYPT). - /// - /// \note The output buffer must be as large as the size - /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \brief This function sets padding for an already initialized RSA + /// context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is needed for padding - /// generation and is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param ilen The length of the plaintext buffer \p input in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + /// encryption scheme and the RSASSA-PSS signature scheme. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs an RSA operation, then removes the - /// message padding. + /// \note The \p hash_id parameter is ignored when using + /// #MBEDTLS_RSA_PKCS_V15 padding. /// - /// It is the generic wrapper for performing a PKCS#1 decryption - /// operation. + /// \note The choice of padding mode is strictly enforced for private + /// key operations, since there might be security concerns in + /// mixing padding modes. For public key operations it is + /// a default value, which can be overridden by calling specific + /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + /// functions. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N (for example, - /// 128 Bytes if RSA-1024 is used) to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note The hash selected in \p hash_id is always used for OEAP + /// encryption. For PSS signatures, it is always used for + /// making signatures, but can be overridden for verifying them. + /// If set to #MBEDTLS_MD_NONE, it is always overridden. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \param ctx The initialized RSA context to be configured. + /// \param padding The padding mode to use. This must be either + /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is + /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + /// function but may be not suitable for some operations. + /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_decrypt( + /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + /// \p padding or \p hash_id is invalid. + pub fn mbedtls_rsa_set_padding( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + padding: ::core::ffi::c_int, + hash_id: mbedtls_md_type_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 decryption - /// operation (RSAES-PKCS1-v1_5-DECRYPT). + /// \brief This function retrieves padding mode of initialized + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for example, - /// 128 Bytes if RSA-1024 is used, to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \param ctx The initialized RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \return RSA padding mode. + pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function retrieves hash identifier of mbedtls_md_type_t + /// type. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context. + /// + /// \return Hash identifier of mbedtls_md_type_t type. + pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP decryption - /// operation (RSAES-OAEP-DECRYPT). + /// \brief This function imports a set of core parameters into an + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for - /// example, 128 Bytes if RSA-1024 is used, to be able to - /// hold an arbitrary decrypted message. If it is not - /// large enough to hold the decryption of the particular - /// ciphertext provided, the function returns - /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. + /// + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. + /// + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. + /// + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param E The public exponent. This may be \c NULL. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_decrypt( + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + N: *const mbedtls_mpi, + P: *const mbedtls_mpi, + Q: *const mbedtls_mpi, + D: *const mbedtls_mpi, + E: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a private RSA operation to sign - /// a message digest using PKCS#1. + /// \brief This function imports core RSA parameters, in raw big-endian + /// binary format, into an RSA context. /// - /// It is the generic wrapper for performing a PKCS#1 - /// signature. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_sign() for details on - /// \p md_alg and \p hash_id. + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is mandatory and - /// must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_sign( + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + /// \param E The public exponent. This may be \c NULL. + /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import_raw( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + N: *const ::core::ffi::c_uchar, + N_len: usize, + P: *const ::core::ffi::c_uchar, + P_len: usize, + Q: *const ::core::ffi::c_uchar, + Q_len: usize, + D: *const ::core::ffi::c_uchar, + D_len: usize, + E: *const ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 signature - /// operation (RSASSA-PKCS1-v1_5-SIGN). + /// \brief This function completes an RSA context from + /// a set of imported core parameters. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// To setup an RSA public key, precisely \c N and \c E + /// must have been imported. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// To setup an RSA private key, sufficient information must + /// be present for the other parameters to be derivable. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// The default implementation supports the following: + ///
          • Derive \c P, \c Q from \c N, \c D, \c E.
            • + ///
          • Derive \c N, \c D from \c P, \c Q, \c E.
          + /// Alternative implementations need not support these. /// - /// \note This function enforces that the provided salt length complies - /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 - /// step 3. The constraint is that the hash length plus the salt - /// length plus 2 bytes must be at most the key length. If this - /// constraint is not met, this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// If this function runs successfully, it guarantees that + /// the RSA context can be used for RSA operations without + /// the risk of failure or crash. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param saltlen The length of the salt that should be used. - /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use - /// the largest possible salt length up to the hash length, - /// which is the largest permitted by some standards including - /// FIPS 186-4 §5.5. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \warning This function need not perform consistency checks + /// for the imported parameters. In particular, parameters that + /// are not needed by the implementation might be silently + /// discarded and left unchecked. To check the consistency + /// of the key material, see mbedtls_rsa_check_privkey(). /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign_ext( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - saltlen: ::core::ffi::c_int, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context holding imported parameters. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + /// failed. + pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// \brief This function exports the core parameters of an RSA key. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \note This function always uses the maximum possible salt size, - /// up to the length of the payload hash. This choice of salt - /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 - /// v2.2) §9.1.1 step 3. Furthermore this function enforces a - /// minimum salt size which is the hash size minus 2 bytes. If - /// this minimum size is too large given the key size (the salt - /// size, plus the hash size, plus 2 bytes must be no more than - /// the key size in bytes), this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param N The MPI to hold the RSA modulus. + /// This may be \c NULL if this field need not be exported. + /// \param P The MPI to hold the first prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param Q The MPI to hold the second prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param D The MPI to hold the private exponent. + /// This may be \c NULL if this field need not be exported. + /// \param E The MPI to hold the public exponent. + /// This may be \c NULL if this field need not be exported. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export( + ctx: *const mbedtls_rsa_context, + N: *mut mbedtls_mpi, + P: *mut mbedtls_mpi, + Q: *mut mbedtls_mpi, + D: *mut mbedtls_mpi, + E: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a public RSA operation and checks - /// the message digest. - /// - /// This is the generic wrapper for performing a PKCS#1 - /// verification. + /// \brief This function exports core parameters of an RSA key + /// in raw big-endian binary format. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - /// \p hash_id. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \note The length parameters are ignored if the corresponding + /// buffer pointers are NULL. + /// + /// \param ctx The initialized RSA context. + /// \param N The Byte array to store the RSA modulus, + /// or \c NULL if this field need not be exported. + /// \param N_len The size of the buffer for the modulus. + /// \param P The Byte array to hold the first prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param P_len The size of the buffer for the first prime factor. + /// \param Q The Byte array to hold the second prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param Q_len The size of the buffer for the second prime factor. + /// \param D The Byte array to hold the private exponent, + /// or \c NULL if this field need not be exported. + /// \param D_len The size of the buffer for the private exponent. + /// \param E The Byte array to hold the public exponent, + /// or \c NULL if this field need not be exported. + /// \param E_len The size of the buffer for the public exponent. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export_raw( + ctx: *const mbedtls_rsa_context, + N: *mut ::core::ffi::c_uchar, + N_len: usize, + P: *mut ::core::ffi::c_uchar, + P_len: usize, + Q: *mut ::core::ffi::c_uchar, + Q_len: usize, + D: *mut ::core::ffi::c_uchar, + D_len: usize, + E: *mut ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 verification - /// operation (RSASSA-PKCS1-v1_5-VERIFY). + /// \brief This function exports CRT parameters of a private RSA key. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Alternative RSA implementations not using CRT-parameters + /// internally can implement this function based on + /// mbedtls_rsa_deduce_opt(). /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param DP The MPI to hold \c D modulo `P-1`, + /// or \c NULL if it need not be exported. + /// \param DQ The MPI to hold \c D modulo `Q-1`, + /// or \c NULL if it need not be exported. + /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, + /// or \c NULL if it need not be exported. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_export_crt( + ctx: *const mbedtls_rsa_context, + DP: *mut mbedtls_mpi, + DQ: *mut mbedtls_mpi, + QP: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). - /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. If the \c hash_id set in \p ctx by - /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg - /// parameter is used. + /// \brief This function retrieves the length of the RSA modulus in bits. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param ctx The initialized RSA context. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The length of the RSA modulus in bits. + pub fn mbedtls_rsa_get_bitlen(ctx: *const mbedtls_rsa_context) -> usize; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). + /// \brief This function retrieves the length of RSA modulus in Bytes. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \param ctx The initialized RSA context. /// - /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is - /// ignored. + /// \return The length of the RSA modulus in Bytes. + pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; +} +unsafe extern "C" { + /// \brief This function generates an RSA keypair. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param mgf1_hash_id The message digest algorithm used for the - /// verification operation and the mask generation - /// function (MGF1). For more details on the encoding - /// operation and the mask generation function, consult - /// RFC-3447: Public-Key Cryptography Standards - /// (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. - /// \param expected_salt_len The length of the salt used in padding. Use - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note mbedtls_rsa_init() must be called before this function, + /// to set up the RSA context. /// - /// \return \c 0 if the verify operation was successful. + /// \param ctx The initialized RSA context used to hold the key. + /// \param f_rng The RNG function to be used for key generation. + /// This is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. + /// This may be \c NULL if \p f_rng doesn't need a context. + /// \param nbits The size of the public key in bits. + /// \param exponent The public exponent to use. For example, \c 65537. + /// This must be odd and greater than \c 1. + /// + /// \return \c 0 on success. /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify_ext( + pub fn mbedtls_rsa_gen_key( ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - mgf1_hash_id: mbedtls_md_type_t, - expected_salt_len: ::core::ffi::c_int, - sig: *const ::core::ffi::c_uchar, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + nbits: ::core::ffi::c_uint, + exponent: ::core::ffi::c_int, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function copies the components of an RSA context. + /// \brief This function checks if a context contains at least an RSA + /// public key. /// - /// \param dst The destination context. This must be initialized. - /// \param src The source context. This must be initialized. + /// If the function runs successfully, it is guaranteed that + /// enough information is present to perform an RSA public key + /// operation using mbedtls_rsa_public(). + /// + /// \param ctx The initialized RSA context to check. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. - pub fn mbedtls_rsa_copy( - dst: *mut mbedtls_rsa_context, - src: *const mbedtls_rsa_context, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees the components of an RSA key. + /// \brief This function checks if a context contains an RSA private key + /// and perform basic consistency checks. /// - /// \param ctx The RSA context to free. May be \c NULL, in which case - /// this function is a no-op. If it is not \c NULL, it must - /// point to an initialized RSA context. - pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); + /// \note The consistency checks performed by this function not only + /// ensure that mbedtls_rsa_private() can be called successfully + /// on the given context, but that the various parameters are + /// mutually consistent with high probability, in the sense that + /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// + /// \warning This function should catch accidental misconfigurations + /// like swapping of parameters, but it cannot establish full + /// trust in neither the quality nor the consistency of the key + /// material that was used to setup the given RSA context: + ///
          • Consistency: Imported parameters that are irrelevant + /// for the implementation might be silently dropped. If dropped, + /// the current function does not have access to them, + /// and therefore cannot check them. See mbedtls_rsa_complete(). + /// If you want to check the consistency of the entire + /// content of a PKCS1-encoded RSA private key, for example, you + /// should use mbedtls_rsa_validate_params() before setting + /// up the RSA context. + /// Additionally, if the implementation performs empirical checks, + /// these checks substantiate but do not guarantee consistency.
            • + ///
          • Quality: This function is not expected to perform + /// extended quality assessments like checking that the prime + /// factors are safe. Additionally, it is the responsibility of the + /// user to ensure the trustworthiness of the source of his RSA + /// parameters, which goes beyond what is effectively checkable + /// by the library.
          + /// + /// \param ctx The initialized RSA context to check. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The RSA checkup routine. + /// \brief This function checks a public-private RSA key pair. + /// + /// It checks each of the contexts, and makes sure they match. + /// + /// \param pub The initialized RSA context holding the public key. + /// \param prv The initialized RSA context holding the private key. /// /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief The ECDSA context structure. -/// -/// \warning Performing multiple operations concurrently on the same -/// ECDSA context is not supported; objects of this type -/// should not be shared between multiple threads. -/// -/// \note pk_wrap module assumes that "ecdsa_context" is identical -/// to "ecp_keypair" (see for example structure -/// "mbedtls_eckey_info" where ECDSA sign/verify functions -/// are used also for EC key) -pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; -pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pub_priv( + pub_: *const mbedtls_rsa_context, + prv: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { - /// \brief This function checks whether a given group can be used - /// for ECDSA. + /// \brief This function performs an RSA public key operation. /// - /// \param gid The ECP group ID to check. + /// \param ctx The initialized RSA context to use. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 1 if the group can be used, \c 0 otherwise - pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; + /// \note This function does not handle message padding. + /// + /// \note Make sure to set \p input[0] = 0 or ensure that + /// input is smaller than \c N. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_public( + ctx: *mut mbedtls_rsa_context, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message. + /// \brief This function performs an RSA private key operation. /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_ext() is usually preferred. + /// \note Blinding is used if and only if a PRNG is provided. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated - /// as defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \note If blinding is used, both the base of exponentiation + /// and the exponent are blinded, providing protection + /// against some side-channel attacks. /// - /// \see ecp.h + /// \warning It is deprecated and a security risk to not provide + /// a PRNG here and thereby prevent the use of blinding. + /// Future versions of the library may enforce the presence + /// of a PRNG. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized. - /// \param buf The content to be signed. This is usually the hash of - /// the original data to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function, used for blinding. It is mandatory. + /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX - /// or \c MBEDTLS_MPI_XXX error code on failure. - pub fn mbedtls_ecdsa_sign( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_private( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, deterministic version. + /// \brief This function adds the message padding, then performs an RSA + /// operation. /// - /// For more information, see RFC-6979: Deterministic - /// Usage of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). + /// It is the generic wrapper for performing a PKCS#1 encryption + /// operation. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG to use. It is used for padding generation + /// and it is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. May be + /// \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \see ecp.h + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v1.5 encryption operation + /// (RSAES-PKCS1-v1_5-ENCRYPT). /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. It is mandatory and used for + /// padding generation. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_ext( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 OAEP encryption + /// operation (RSAES-OAEP-ENCRYPT). /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_restartable() is usually - /// preferred. + /// \note The output buffer must be as large as the size + /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \note This function is like \c mbedtls_ecdsa_sign() but - /// it can return early and restart according to the - /// limit set with \c mbedtls_ecp_set_max_ops() to - /// reduce blocking. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is needed for padding + /// generation and is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param ilen The length of the plaintext buffer \p input in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs an RSA operation, then removes the + /// message padding. /// - /// \see ecp.h + /// It is the generic wrapper for performing a PKCS#1 decryption + /// operation. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + /// mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + /// inherently dangerous function (CWE-242). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N (for example, + /// 128 Bytes if RSA-1024 is used) to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. - /// - /// \note This function is like \c - /// mbedtls_ecdsa_sign_det_ext() but it can return - /// early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 decryption + /// operation (RSAES-PKCS1-v1_5-DECRYPT). /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \warning This is an inherently dangerous function (CWE-242). Unless + /// it is used in a side channel free and safe way (eg. + /// implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + /// the calling code is vulnerable. /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for example, + /// 128 Bytes if RSA-1024 is used, to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message. - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \brief This function performs a PKCS#1 v2.1 OAEP decryption + /// operation (RSAES-OAEP-DECRYPT). /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for + /// example, 128 Bytes if RSA-1024 is used, to be able to + /// hold an arbitrary decrypted message. If it is not + /// large enough to hold the decryption of the particular + /// ciphertext provided, the function returns + /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message, in a restartable manner + /// \brief This function performs a private RSA operation to sign + /// a message digest using PKCS#1. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// It is the generic wrapper for performing a PKCS#1 + /// signature. /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify_restartable( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, serialized as defined in RFC-4492: - /// Elliptic Curve Cryptography (ECC) Cipher Suites for - /// Transport Layer Security (TLS). - /// - /// \warning It is not thread-safe to use the same context in - /// multiple threads. - /// - /// \note The deterministic version is used if - /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more - /// information, see RFC-6979: Deterministic Usage - /// of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. - /// - /// \see ecp.h + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_sign() for details on + /// \p md_alg and \p hash_id. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is used only for blinding and may be set to \c NULL, but - /// doing so is DEPRECATED. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is mandatory and + /// must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, in a restartable way. - /// - /// \see \c mbedtls_ecdsa_write_signature() - /// - /// \note This function is like \c mbedtls_ecdsa_write_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 signature + /// operation (RSASSA-PKCS1-v1_5-SIGN). /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is unused and may be set to \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \see ecp.h + /// \note This function enforces that the provided salt length complies + /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + /// step 3. The constraint is that the hash length plus the salt + /// length plus 2 bytes must be at most the key length. If this + /// constraint is not met, this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param saltlen The length of the salt that should be used. + /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + /// the largest possible salt length up to the hash length, + /// which is the largest permitted by some standards including + /// FIPS 186-4 §5.5. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign_ext( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, - sig: *const ::core::ffi::c_uchar, - slen: usize, + saltlen: ::core::ffi::c_int, + sig: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature, - /// in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \see \c mbedtls_ecdsa_read_signature() + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \note This function is like \c mbedtls_ecdsa_read_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function always uses the maximum possible salt size, + /// up to the length of the payload hash. This choice of salt + /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + /// v2.2) §9.1.1 step 3. Furthermore this function enforces a + /// minimum salt size which is the hash size minus 2 bytes. If + /// this minimum size is too large given the key size (the salt + /// size, plus the hash size, plus 2 bytes must be no more than + /// the key size in bytes), this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a public RSA operation and checks + /// the message digest. + /// + /// This is the generic wrapper for performing a PKCS#1 + /// verification. + /// + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + /// \c hash_id. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *const ::core::ffi::c_uchar, - slen: usize, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an ECDSA keypair on the given curve. + /// \brief This function performs a PKCS#1 v1.5 verification + /// operation (RSASSA-PKCS1-v1_5-VERIFY). /// - /// \see ecp.h + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \param ctx The ECDSA context to store the keypair in. - /// This must be initialized. - /// \param gid The elliptic curve to use. One of the various - /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_genkey( - ctx: *mut mbedtls_ecdsa_context, - gid: mbedtls_ecp_group_id, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. If the \c hash_id set in \p ctx by + /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + /// parameter is used. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets up an ECDSA context from an EC key pair. + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param ctx The ECDSA context to setup. This must be initialized. - /// \param key The EC key to use. This must be initialized and hold - /// a private-public key pair or a public key. In the former - /// case, the ECDSA context may be used for signature creation - /// and verification after this call. In the latter case, it - /// may be used for signature verification. + /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + /// ignored. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_from_keypair( - ctx: *mut mbedtls_ecdsa_context, - key: *const mbedtls_ecp_keypair, + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param mgf1_hash_id The message digest algorithm used for the + /// verification operation and the mask generation + /// function (MGF1). For more details on the encoding + /// operation and the mask generation function, consult + /// RFC-3447: Public-Key Cryptography Standards + /// (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. + /// \param expected_salt_len The length of the salt used in padding. Use + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify_ext( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + mgf1_hash_id: mbedtls_md_type_t, + expected_salt_len: ::core::ffi::c_int, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECDSA context. + /// \brief This function copies the components of an RSA context. /// - /// \param ctx The ECDSA context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); + /// \param dst The destination context. This must be initialized. + /// \param src The source context. This must be initialized. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + pub fn mbedtls_rsa_copy( + dst: *mut mbedtls_rsa_context, + src: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees an ECDSA context. + /// \brief This function frees the components of an RSA key. /// - /// \param ctx The ECDSA context to free. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must be initialized. - pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); + /// \param ctx The RSA context to free. May be \c NULL, in which case + /// this function is a no-op. If it is not \c NULL, it must + /// point to an initialized RSA context. + pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); } -pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; -pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; -/// \brief Public key types -pub type mbedtls_pk_type_t = ::core::ffi::c_uint; -/// \brief Options for RSASSA-PSS signature verification. -/// See \c mbedtls_rsa_rsassa_pss_verify_ext() -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_rsassa_pss_options { - /// The digest to use for MGF1 in PSS. +unsafe extern "C" { + /// \brief The RSA checkup routine. /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is - /// disabled, this must be equal to the \c md_alg argument passed - /// to mbedtls_pk_verify_ext(). In a future version of the library, - /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is - /// enabled regardless of the status of #MBEDTLS_RSA_C. - pub mgf1_hash_id: mbedtls_md_type_t, - /// The expected length of the salt, in bytes. This may be - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only - /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be - /// ignored (allowing any salt length). - pub expected_salt_len: ::core::ffi::c_int, -} -impl Default for mbedtls_pk_rsassa_pss_options { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; -/// \brief Types for interfacing with the debug module -pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; -/// \brief Item to send to the debug module -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_debug_item { - pub private_type: mbedtls_pk_debug_type, - pub private_name: *const ::core::ffi::c_char, - pub private_value: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_debug_item { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_info_t { - _unused: [u8; 0], -} -/// \brief Public key container -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_context { - ///< Public key information - pub private_pk_info: *const mbedtls_pk_info_t, - ///< Underlying public key context - pub private_pk_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; -/// \brief Types for RSA-alt abstraction -pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_key_len_func = - ::core::option::Option usize>; +/// \brief The ECDSA context structure. +/// +/// \warning Performing multiple operations concurrently on the same +/// ECDSA context is not supported; objects of this type +/// should not be shared between multiple threads. +/// +/// \note pk_wrap module assumes that "ecdsa_context" is identical +/// to "ecp_keypair" (see for example structure +/// "mbedtls_eckey_info" where ECDSA sign/verify functions +/// are used also for EC key) +pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; +pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; unsafe extern "C" { - /// \brief Return information associated with the given PK type - /// - /// \param pk_type PK type to search for. + /// \brief This function checks whether a given group can be used + /// for ECDSA. /// - /// \return The PK info associated with the type or NULL if not found. - pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; -} -unsafe extern "C" { - /// \brief Initialize a #mbedtls_pk_context (as NONE). + /// \param gid The ECP group ID to check. /// - /// \param ctx The context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); + /// \return \c 1 if the group can be used, \c 0 otherwise + pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Free the components of a #mbedtls_pk_context. + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message. /// - /// \param ctx The context to clear. It must have been initialized. - /// If this is \c NULL, this function does nothing. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_ext() is usually preferred. /// - /// \note For contexts that have been set up with - /// mbedtls_pk_setup_opaque(), this does not free the underlying - /// PSA key and you still need to call psa_destroy_key() - /// independently if you want to destroy that key. - pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); -} -unsafe extern "C" { - /// \brief Initialize a PK context with the information given - /// and allocates the type-specific PK subcontext. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated + /// as defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param info Information to use + /// \see ecp.h /// - /// \return 0 on success, - /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, - /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized. + /// \param buf The content to be signed. This is usually the hash of + /// the original data to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function, used both to generate the ECDSA nonce + /// and for blinding. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. /// - /// \note For contexts holding an RSA-alt key, use - /// \c mbedtls_pk_setup_rsa_alt() instead. - pub fn mbedtls_pk_setup( - ctx: *mut mbedtls_pk_context, - info: *const mbedtls_pk_info_t, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX + /// or \c MBEDTLS_MPI_XXX error code on failure. + pub fn mbedtls_ecdsa_sign( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Initialize an RSA-alt context + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, deterministic version. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param key RSA key pointer - /// \param decrypt_func Decryption function - /// \param sign_func Signing function - /// \param key_len_func Function returning key length in bytes + /// For more information, see RFC-6979: Deterministic + /// Usage of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the - /// context wasn't already initialized as RSA_ALT. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. - pub fn mbedtls_pk_setup_rsa_alt( - ctx: *mut mbedtls_pk_context, - key: *mut ::core::ffi::c_void, - decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, - sign_func: mbedtls_pk_rsa_alt_sign_func, - key_len_func: mbedtls_pk_rsa_alt_key_len_func, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Get the size in bits of the underlying key + /// \see ecp.h /// - /// \param ctx The context to query. It must have been initialized. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + /// may be \c NULL if \p f_rng_blind doesn't need a context + /// parameter. /// - /// \return Key size in bits, or 0 on error - pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_ext( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + md_alg: mbedtls_md_type_t, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Tell if a context can do the operation given by type + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \param ctx The context to query. It must have been initialized. - /// \param type The desired type. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_restartable() is usually + /// preferred. /// - /// \return 1 if the context can do operations on the given type. - /// \return 0 if the context cannot do the operations on the given - /// type. This is always the case for a context that has - /// been initialized but not set up, or that has been - /// cleared with mbedtls_pk_free(). - pub fn mbedtls_pk_can_do( - ctx: *const mbedtls_pk_context, - type_: mbedtls_pk_type_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Verify signature (including padding if relevant). + /// \note This function is like \c mbedtls_ecdsa_sign() but + /// it can return early and restart according to the + /// limit set with \c mbedtls_ecp_set_max_ops() to + /// reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used. - /// This can be #MBEDTLS_MD_NONE if the signature algorithm - /// does not rely on a hash algorithm (non-deterministic - /// ECDSA, RSA PKCS#1 v1.5). - /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then - /// \p hash is the DigestInfo structure used by RFC 8017 - /// §9.2 steps 3–6. If \p md_alg is a valid hash - /// algorithm then \p hash is the digest itself, and this - /// function calculates the DigestInfo encoding internally. - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \see ecp.h /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) - /// to verify RSASSA_PSS signatures. - pub fn mbedtls_pk_verify( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_verify() + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_verify(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_verify(). + /// \note This function is like \c + /// mbedtls_ecdsa_sign_det_ext() but it can return + /// early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length - /// \param rs_ctx Restart context (NULL to disable restart) + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return See \c mbedtls_pk_verify(), or - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_verify_restartable( - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + /// \c NULL if \p f_rng_blind doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, - rs_ctx: *mut mbedtls_pk_restart_ctx, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify signature, with options. - /// (Includes verification of the padding depending on type.) - /// - /// \param type Signature type (inc. possible padding type) to verify - /// \param options Pointer to type-specific options, or NULL - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be - /// used for this type of signatures, - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note If hash_len is 0, then the length associated with md_alg - /// is used instead, or an error returned if it is invalid. + /// \see ecp.h /// - /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. /// - /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point - /// to a mbedtls_pk_rsassa_pss_options structure, - /// otherwise it must be NULL. Note that if - /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not - /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. - pub fn mbedtls_pk_verify_ext( - type_: mbedtls_pk_type_t, - options: *const ::core::ffi::c_void, - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature, including padding if relevant. - /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message, in a restartable manner /// - /// \return 0 on success, or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// There is no interface in the PK module to make RSASSA-PSS - /// signatures yet. + /// \see ecp.h /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify_restartable( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature given a signature type. + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, serialized as defined in RFC-4492: + /// Elliptic Curve Cryptography (ECC) Cipher Suites for + /// Transport Layer Security (TLS). /// - /// \param pk_type Signature type. - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \warning It is not thread-safe to use the same context in + /// multiple threads. /// - /// \return 0 on success, or a specific error code. + /// \note The deterministic version is used if + /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + /// information, see RFC-6979: Deterministic Usage + /// of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, - /// see #PSA_ALG_RSA_PSS for a description of PSS options used. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign_ext( - pk_type: mbedtls_pk_type_t, - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_sign() + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_sign(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_sign(). + /// \see \c mbedtls_ecdsa_write_signature() /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. + /// \note This function is like \c mbedtls_ecdsa_write_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// \param rs_ctx Restart context (NULL to disable restart) + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return See \c mbedtls_pk_sign(). + /// \return \c 0 on success. /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_sign_restartable( - ctx: *mut mbedtls_pk_context, + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_pk_restart_ctx, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Decrypt message (including padding if relevant). + /// \brief This function reads and verifies an ECDSA signature. /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param input Input to decrypt - /// \param ilen Input size - /// \param output Decrypted output - /// \param olen Decrypted message length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \see ecp.h /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_decrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Encrypt message (including padding if relevant). - /// - /// \param ctx The PK context to use. It must have been set up. - /// \param input Message to encrypt - /// \param ilen Message size - /// \param output Encrypted output - /// \param olen Encrypted output length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function reads and verifies an ECDSA signature, + /// in a restartable way. /// - /// \note \p f_rng is used for padding generation. + /// \see \c mbedtls_ecdsa_read_signature() /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \note This function is like \c mbedtls_ecdsa_read_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_encrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if a public-private pair of keys matches. - /// - /// \param pub Context holding a public key. - /// \param prv Context holding a private (and public) key. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// - /// \return \c 0 on success (keys were checked and match each other). - /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not - /// be checked - in that case they may or may not match. - /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. - /// \return Another non-zero value if the keys do not match. - pub fn mbedtls_pk_check_pair( - pub_: *const mbedtls_pk_context, - prv: *const mbedtls_pk_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Export debug information - /// - /// \param ctx The PK context to use. It must have been initialized. - /// \param items Place to write debug items + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA - pub fn mbedtls_pk_debug( - ctx: *const mbedtls_pk_context, - items: *mut mbedtls_pk_debug_item, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Access the type name - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type name on success, or "invalid PK" - pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; -} -unsafe extern "C" { - /// \brief Get the key type - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type on success. - /// \return #MBEDTLS_PK_NONE for a context that has not been set up. - pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a private key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// \param pwd Optional password for decryption. - /// Pass \c NULL if expecting a non-encrypted key. - /// Pass a string of \p pwdlen bytes if expecting an encrypted - /// key; a non-encrypted key will also be accepted. - /// The empty password is not supported. - /// \param pwdlen Size of the password in bytes. - /// Ignored if \p pwd is \c NULL. - /// \param f_rng RNG function, must not be \c NULL. Used for blinding. - /// \param p_rng RNG parameter + /// \brief This function generates an ECDSA keypair on the given curve. /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to store the keypair in. + /// This must be initialized. + /// \param gid The elliptic curve to use. One of the various + /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, - pwd: *const ::core::ffi::c_uchar, - pwdlen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_genkey( + ctx: *mut mbedtls_ecdsa_context, + gid: mbedtls_ecp_group_id, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a public key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \brief This function sets up an ECDSA context from an EC key pair. /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to setup. This must be initialized. + /// \param key The EC key to use. This must be initialized and hold + /// a private-public key pair or a public key. In the former + /// case, the ECDSA context may be used for signature creation + /// and verification after this call. In the latter case, it + /// may be used for signature verification. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_public_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_from_keypair( + ctx: *mut mbedtls_ecdsa_context, + key: *const mbedtls_ecp_keypair, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function initializes an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_key_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); } unsafe extern "C" { - /// \brief Write a public key to a SubjectPublicKeyInfo DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function frees an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_pubkey_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to free. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must be initialized. + pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); } -unsafe extern "C" { - /// \brief Write a public key to a PEM string - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_pubkey_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 PEM string - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_key_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Parse a SubjectPublicKeyInfo DER structure - /// - /// \param p the position in the ASN.1 data - /// \param end end of the buffer - /// \param pk The PK context to fill. It must have been initialized - /// but not set up. - /// - /// \return 0 if successful, or a specific PK error code - pub fn mbedtls_pk_parse_subpubkey( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - pk: *mut mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a subjectPublicKey to ASN.1 data - /// Note: function works backwards in data buffer - /// - /// \param p reference to current position pointer - /// \param start start of the buffer (for bounds-checking) - /// \param key PK context which must contain a valid public or private key. - /// - /// \return the length written or a negative error code - pub fn mbedtls_pk_write_pubkey( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - key: *const mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = - 3; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: - mbedtls_key_exchange_type_t = 4; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = - 8; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = - 9; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = - 10; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = - 11; -pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; -/// \brief This structure is used for storing ciphersuite information -/// -/// \note members are defined using integral types instead of enums -/// in order to pack structure and reduce memory usage by internal -/// \c ciphersuite_definitions[] -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ssl_ciphersuite_t { - pub private_id: ::core::ffi::c_int, - pub private_name: *const ::core::ffi::c_char, - pub private_cipher: u8, - pub private_mac: u8, - pub private_key_exchange: u8, - pub private_flags: u8, - pub private_min_tls_version: u16, - pub private_max_tls_version: u16, -} -impl Default for mbedtls_ssl_ciphersuite_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_string( - ciphersuite_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_id( - ciphersuite_id: ::core::ffi::c_int, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_pk_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_ec( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_psk( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> usize; -} -/// The type of the context passed to mbedtls_psa_external_get_random(). -/// -/// Mbed TLS initializes the context to all-bits-zero before calling -/// mbedtls_psa_external_get_random() for the first time. -/// -/// The definition of this type in the Mbed TLS source code is for -/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() -/// are expected to replace it with a custom definition. -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_external_random_context_t { - pub private_opaque: [usize; 2usize], +/// The type of the context passed to mbedtls_psa_external_get_random(). +/// +/// Mbed TLS initializes the context to all-bits-zero before calling +/// mbedtls_psa_external_get_random() for the first time. +/// +/// The definition of this type in the Mbed TLS source code is for +/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() +/// are expected to replace it with a custom definition. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_external_random_context_t { + pub private_opaque: [usize; 2usize], } pub type psa_status_t = i32; /// \brief Encoding of a key type. @@ -10577,6478 +10445,7672 @@ pub type psa_key_attributes_t = psa_key_attributes_s; /// Values of this type are generally constructed by macros called /// `PSA_KEY_DERIVATION_INPUT_xxx`. pub type psa_key_derivation_step_t = u16; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following field: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// +/// Functions that take such a structure as input also take an associated +/// input buffer \c custom_data of length \c custom_data_length. +/// +/// The interpretation of this structure and the associated \c custom_data +/// parameter depend on the type of the created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c custom_data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_custom_key_parameters_t = psa_custom_key_parameters_s; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following fields: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// - \c data: a flexible array of bytes. +/// +/// The interpretation of this structure depend on the type of the +/// created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty or if the custom production parameters are omitted +/// altogether, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_key_production_parameters_t = psa_key_production_parameters_s; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; +/// For encrypt-decrypt functions, whether the operation is an encryption +/// or a decryption. +pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; +/// \brief MD5 context structure +/// +/// \warning MD5 is considered a weak message digest and its use +/// constitutes a security risk. We recommend considering +/// stronger message digests instead. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md5_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 4usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_md5_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { - /// \brief Library initialization. - /// - /// Applications must call this function before calling any other - /// function in this module. - /// - /// Applications may call this function more than once. Once a call - /// succeeds, subsequent calls are guaranteed to succeed. + /// \brief Initialize MD5 context /// - /// If the application calls other functions before calling psa_crypto_init(), - /// the behavior is undefined. Implementations are encouraged to either perform - /// the operation as if the library had been initialized or to return - /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, - /// implementations should not return a success status if the lack of - /// initialization may have security implications, for example due to improper - /// seeding of the random number generator. + /// \param ctx MD5 context to be initialized /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - pub fn psa_crypto_init() -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Retrieve the attributes of a key. - /// - /// This function first resets the attribute structure as with - /// psa_reset_key_attributes(). It then copies the attributes of - /// the given key into the given attribute structure. - /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \brief Clear MD5 context /// - /// \param[in] key Identifier of the key to query. - /// \param[in,out] attributes On success, the attributes of the key. - /// On failure, equivalent to a - /// freshly-initialized structure. + /// \param ctx MD5 context to be cleared /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_get_key_attributes( - key: mbedtls_svc_key_id_t, - attributes: *mut psa_key_attributes_t, - ) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Reset a key attribute structure to a freshly initialized state. - /// - /// You must initialize the attribute structure as described in the - /// documentation of the type #psa_key_attributes_t before calling this - /// function. Once the structure has been initialized, you may call this - /// function at any time. + /// \brief Clone (the state of) an MD5 context /// - /// This function frees any auxiliary resources that the structure - /// may contain. + /// \param dst The destination context + /// \param src The context to be cloned /// - /// \param[in,out] attributes The attribute structure to reset. - pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); } unsafe extern "C" { - /// Remove non-essential copies of key material from memory. + /// \brief MD5 context setup /// - /// If the key identifier designates a volatile key, this functions does not do - /// anything and returns successfully. - /// - /// If the key identifier designates a persistent key, then this function will - /// free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and the key can still be used. + /// \param ctx context to be initialized /// - /// \param key Identifier of the key to purge. + /// \return 0 if successful /// - /// \retval #PSA_SUCCESS - /// The key material will have been removed from memory if it is not - /// currently required. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid key identifier. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Make a copy of a key. + /// \brief MD5 process buffer /// - /// Copy key material from one location to another. + /// \param ctx MD5 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// This function is primarily useful to copy a key from one location - /// to another, since it populates a key using the material from - /// another key which may have a different lifetime. + /// \return 0 if successful /// - /// This function may be used to share a key with a different party, - /// subject to implementation-defined restrictions on key sharing. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_update( + ctx: *mut mbedtls_md5_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 final digest /// - /// The policy on the source key must have the usage flag - /// #PSA_KEY_USAGE_COPY set. - /// This flag is sufficient to permit the copy if the key has the lifetime - /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. - /// Some secure elements do not provide a way to copy a key without - /// making it extractable from the secure element. If a key is located - /// in such a secure element, then the key must have both usage flags - /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make - /// a copy of the key outside the secure element. + /// \param ctx MD5 context + /// \param output MD5 checksum result /// - /// The resulting key may only be used in a way that conforms to - /// both the policy of the original key and the policy specified in - /// the \p attributes parameter: - /// - The usage flags on the resulting key are the bitwise-and of the - /// usage flags on the source policy and the usage flags in \p attributes. - /// - If both allow the same algorithm or wildcard-based - /// algorithm policy, the resulting key has the same algorithm policy. - /// - If either of the policies allows an algorithm and the other policy - /// allows a wildcard-based algorithm policy that includes this algorithm, - /// the resulting key allows the same algorithm. - /// - If the policies do not allow any algorithm in common, this function - /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// \return 0 if successful /// - /// The effect of this function on implementation-defined attributes is - /// implementation-defined. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_finish( + ctx: *mut mbedtls_md5_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 process data block (internal use only) /// - /// \param source_key The key to copy. It must allow the usage - /// #PSA_KEY_USAGE_COPY. If a private or secret key is - /// being copied outside of a secure element it must - /// also allow #PSA_KEY_USAGE_EXPORT. - /// \param[in] attributes The attributes for the new key. - /// They are used as follows: - /// - The key type and size may be 0. If either is - /// nonzero, it must match the corresponding - /// attribute of the source key. - /// - The key location (the lifetime and, for - /// persistent keys, the key identifier) is - /// used directly. - /// - The policy constraints (usage flags and - /// algorithm policy) are combined from - /// the source key and \p attributes so that - /// both sets of restrictions apply, as - /// described in the documentation of this function. - /// \param[out] target_key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param ctx MD5 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p source_key is invalid. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The lifetime or identifier in \p attributes are invalid, or - /// the policy constraints on the source and specified in - /// \p attributes are incompatible, or - /// \p attributes specifies a key type or key size - /// which does not match the attributes of the source key. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or - /// the source key is not exportable and its lifetime does not - /// allow copying it to the target's lifetime. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_copy_key( - source_key: mbedtls_svc_key_id_t, - attributes: *const psa_key_attributes_t, - target_key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + /// + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_internal_md5_process( + ctx: *mut mbedtls_md5_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Destroy a key. + /// \brief Output = MD5( input buffer ) /// - /// This function destroys a key from both volatile - /// memory and, if applicable, non-volatile storage. Implementations shall - /// make a best effort to ensure that the key material cannot be recovered. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output MD5 checksum result /// - /// This function also erases any metadata such as policies and frees - /// resources associated with the key. + /// \return 0 if successful /// - /// If a key is currently in use in a multipart operation, then destroying the - /// key will cause the multipart operation to fail. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \param key Identifier of the key to erase. If this is \c 0, do nothing and - /// return #PSA_SUCCESS. + /// \return 0 if successful, or 1 if the test failed /// - /// \retval #PSA_SUCCESS - /// \p key was a valid identifier and the key material that it - /// referred to has been erased. Alternatively, \p key is \c 0. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key cannot be erased because it is - /// read-only, either due to a policy or due to physical restrictions. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p key is not a valid identifier nor \c 0. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE - /// There was a failure in communication with the cryptoprocessor. - /// The key material may still be present in the cryptoprocessor. - /// \retval #PSA_ERROR_DATA_INVALID - /// This error is typically a result of either storage corruption on a - /// cleartext storage backend, or an attempt to read data that was - /// written by an incompatible version of the library. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The storage is corrupted. Implementations shall make a best effort - /// to erase key material even in this stage, however applications - /// should be aware that it may be impossible to guarantee that the - /// key material is not recoverable in such cases. - /// \retval #PSA_ERROR_CORRUPTION_DETECTED - /// An unexpected condition which is not a storage corruption or - /// a communication failure occurred. The cryptoprocessor may have - /// been compromised. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief RIPEMD-160 context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ripemd160_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 5usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_ripemd160_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief Import a key in binary format. + /// \brief Initialize RIPEMD-160 context /// - /// This function supports any output from psa_export_key(). Refer to the - /// documentation of psa_export_public_key() for the format of public keys - /// and to the documentation of psa_export_key() for the format for - /// other key types. + /// \param ctx RIPEMD-160 context to be initialized + pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clear RIPEMD-160 context /// - /// The key data determines the key size. The attributes may optionally - /// specify a key size; in this case it must match the size determined - /// from the key data. A key size of 0 in \p attributes indicates that - /// the key size is solely determined by the key data. + /// \param ctx RIPEMD-160 context to be cleared + pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clone (the state of) a RIPEMD-160 context /// - /// Implementations must reject an attempt to import a key of size 0. + /// \param dst The destination context + /// \param src The context to be cloned + pub fn mbedtls_ripemd160_clone( + dst: *mut mbedtls_ripemd160_context, + src: *const mbedtls_ripemd160_context, + ); +} +unsafe extern "C" { + /// \brief RIPEMD-160 context setup /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. - /// - /// \param[in] attributes The attributes for the new key. - /// The key size is always determined from the - /// \p data buffer. - /// If the key size in \p attributes is nonzero, - /// it must be equal to the size from \p data. - /// \param[out] key On success, an identifier to the newly created key. - /// For persistent keys, this is the key identifier - /// defined in \p attributes. - /// \c 0 on failure. - /// \param[in] data Buffer containing the key data. The content of this - /// buffer is interpreted according to the type declared - /// in \p attributes. - /// All implementations must support at least the format - /// described in the documentation - /// of psa_export_key() or psa_export_public_key() for - /// the chosen type. Implementations may allow other - /// formats, but should be conservative: implementations - /// should err on the side of rejecting content if it - /// may be erroneous (e.g. wrong type or truncated data). - /// \param data_length Size of the \p data buffer in bytes. + /// \param ctx context to be initialized /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular persistent location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key attributes, as a whole, are invalid, or - /// the key data is not correctly formatted, or - /// the size in \p attributes is nonzero and does not match the size - /// of the key data. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_import_key( - attributes: *const psa_key_attributes_t, - data: *const u8, - data_length: usize, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a key in binary format. - /// - /// The output of this function can be passed to psa_import_key() to - /// create an equivalent object. + /// \brief RIPEMD-160 process buffer /// - /// If the implementation of psa_import_key() supports other formats - /// beyond the format specified here, the output from psa_export_key() - /// must use the representation specified here, not the original - /// representation. + /// \param ctx RIPEMD-160 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// For standard key types, the output format is as follows: + /// \return 0 if successful + pub fn mbedtls_ripemd160_update( + ctx: *mut mbedtls_ripemd160_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 final digest /// - /// - For symmetric keys (including MAC keys), the format is the - /// raw bytes of the key. - /// - For DES, the key data consists of 8 bytes. The parity bits must be - /// correct. - /// - For Triple-DES, the format is the concatenation of the - /// two or three DES keys. - /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format - /// is the non-encrypted DER encoding of the representation defined by - /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. - /// ``` - /// RSAPrivateKey ::= SEQUENCE { - /// version INTEGER, -- must be 0 - /// modulus INTEGER, -- n - /// publicExponent INTEGER, -- e - /// privateExponent INTEGER, -- d - /// prime1 INTEGER, -- p - /// prime2 INTEGER, -- q - /// exponent1 INTEGER, -- d mod (p-1) - /// exponent2 INTEGER, -- d mod (q-1) - /// coefficient INTEGER, -- (inverse of q) mod p - /// } - /// ``` - /// - For elliptic curve key pairs (key types for which - /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is - /// a representation of the private value as a `ceiling(m/8)`-byte string - /// where `m` is the bit size associated with the curve, i.e. the bit size - /// of the order of the curve's coordinate field. This byte string is - /// in little-endian order for Montgomery curves (curve types - /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass - /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` - /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). - /// For Weierstrass curves, this is the content of the `privateKey` field of - /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, - /// the format is defined by RFC 7748, and output is masked according to §5. - /// For twisted Edwards curves, the private key is as defined by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For Diffie-Hellman key exchange key pairs (key types for which - /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the - /// format is the representation of the private key `x` as a big-endian byte - /// string. The length of the byte string is the private key size in bytes - /// (leading zeroes are not stripped). - /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is - /// true), the format is the same as for psa_export_public_key(). + /// \param ctx RIPEMD-160 context + /// \param output RIPEMD-160 checksum result /// - /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// \return 0 if successful + pub fn mbedtls_ripemd160_finish( + ctx: *mut mbedtls_ripemd160_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 process data block (internal use only) /// - /// \param key Identifier of the key to export. It must allow the - /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public - /// key. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. + /// \param ctx RIPEMD-160 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_internal_ripemd160_process( + ctx: *mut mbedtls_ripemd160_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a public key or the public part of a key pair in binary format. + /// \brief Output = RIPEMD-160( input buffer ) /// - /// The output of this function can be passed to psa_import_key() to - /// create an object that is equivalent to the public key. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output RIPEMD-160 checksum result /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. + /// \return 0 if successful + pub fn mbedtls_ripemd160( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// For standard key types, the output format is as follows: - /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of - /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. - /// ``` - /// RSAPublicKey ::= SEQUENCE { - /// modulus INTEGER, -- n - /// publicExponent INTEGER } -- e - /// ``` - /// - For elliptic curve keys on a twisted Edwards curve (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY - /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined - /// by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For other elliptic curve public keys (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed - /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. - /// Let `m` be the bit size associated with the curve, i.e. the bit size of - /// `q` for a curve over `F_q`. The representation consists of: - /// - The byte 0x04; - /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; - /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. - /// - For Diffie-Hellman key exchange public keys (key types for which - /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), - /// the format is the representation of the public key `y = g^x mod p` as a - /// big-endian byte string. The length of the byte string is the length of the - /// base prime `p` in bytes. + /// \return 0 if successful, or 1 if the test failed + pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha1_context { + pub work_area: [::core::ffi::c_uchar; 208usize], +} +impl Default for mbedtls_sha1_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-1 context. /// - /// Exporting a public key object or the public part of a key pair is - /// always permitted, regardless of the key's usage flags. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param key Identifier of the key to export. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key is neither a public key nor a key pair. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_public_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message. - /// - /// \note To verify the hash of a message against an - /// expected value, use psa_hash_compare() instead. + /// \brief This function clears a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\p alg). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p hash_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compute( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it is + /// not \c NULL, it must point to an initialized + /// SHA-1 context. + pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message and compare it with a - /// reference value. + /// \brief This function clones the state of a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p input_length or \p hash_length do not match the hash size for \p alg - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compare( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \param dst The SHA-1 context to clone to. This must be initialized. + /// \param src The SHA-1 context to clone from. This must be initialized. + pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); } -/// The type of the state data structure for multipart hash operations. -/// -/// Before calling any function on a hash operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_hash_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_hash_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, -/// for example: -/// \code -/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_hash_operation_init() -/// to the structure, for example: -/// \code -/// psa_hash_operation_t operation; -/// operation = psa_hash_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_hash_operation_t = psa_hash_operation_s; unsafe extern "C" { - /// Set up a multipart hash operation. - /// - /// The sequence of operations to calculate a hash (message digest) - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. - /// -# Call psa_hash_setup() to specify the algorithm. - /// -# Call psa_hash_update() zero, one or more times, passing a fragment - /// of the message each time. The hash that is calculated is the hash - /// of the concatenation of these messages in order. - /// -# To calculate the hash, call psa_hash_finish(). - /// To compare the hash with an expected value, call psa_hash_verify(). - /// - /// If an error occurs at any step after a call to psa_hash_setup(), the - /// operation will need to be reset by a call to psa_hash_abort(). The - /// application may call psa_hash_abort() at any time after the operation - /// has been initialized. + /// \brief This function starts a SHA-1 checksum calculation. /// - /// After a successful call to psa_hash_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_hash_finish() or psa_hash_verify(). - /// - A call to psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_hash_operation_t and not yet in use. - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param ctx The SHA-1 context to initialize. This must be initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a hash algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_setup( - operation: *mut psa_hash_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart hash operation. - /// - /// The application must call psa_hash_setup() before calling this function. + /// \brief This function feeds an input buffer into an ongoing SHA-1 + /// checksum calculation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] input Buffer containing the message fragment to hash. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-1 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_update( - operation: *mut psa_hash_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_update( + ctx: *mut mbedtls_sha1_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message. + /// \brief This function finishes the SHA-1 operation, and writes + /// the result to the output buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \param ctx The SHA-1 context to use. This must be initialized and + /// have a hash operation started. + /// \param output The SHA-1 checksum result. This must be a writable + /// buffer of length \c 20 Bytes. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the hash. Call psa_hash_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// hash values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the hashed data which could allow an attacker to guess - /// a valid hash and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_finish( + ctx: *mut mbedtls_sha1_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief SHA-1 process data block (internal use only). /// - /// \param[in,out] operation Active hash operation. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\c alg) where \c alg is the - /// hash algorithm that is calculated. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p hash buffer is too small. You can determine a - /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) - /// where \c alg is the hash algorithm that is calculated. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_finish( - operation: *mut psa_hash_operation_t, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to use. This must be initialized. + /// \param data The data block being processed. This must be a + /// readable buffer of length \c 64 Bytes. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha1_process( + ctx: *mut mbedtls_sha1_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-1 checksum of a buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). It then - /// compares the calculated hash with the expected hash passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// The SHA-1 result is calculated as + /// output = SHA-1(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual hash and the expected hash is performed - /// in constant time. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. + /// \param output The SHA-1 checksum result. + /// This must be a writable buffer of length \c 20 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_verify( - operation: *mut psa_hash_operation_t, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a hash operation. + /// \brief The SHA-1 checkup routine. /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_hash_setup() again. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_hash_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha256_context { + pub work_area: [::core::ffi::c_uchar; 208usize], + pub is224: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha256_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-256 context. /// - /// In particular, calling psa_hash_abort() after the operation has been - /// terminated by a call to psa_hash_abort(), psa_hash_finish() or - /// psa_hash_verify() is safe and has no effect. + /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-256 context. /// - /// \param[in,out] operation Initialized hash operation. + /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-256 context. + pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-256 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha256_clone( + dst: *mut mbedtls_sha256_context, + src: *const mbedtls_sha256_context, + ); } unsafe extern "C" { - /// Clone a hash operation. + /// \brief This function starts a SHA-224 or SHA-256 checksum + /// calculation. /// - /// This function copies the state of an ongoing hash operation to - /// a new operation object. In other words, this function is equivalent - /// to calling psa_hash_setup() on \p target_operation with the same - /// algorithm that \p source_operation was set up for, then - /// psa_hash_update() on \p target_operation with the same input that - /// that was passed to \p source_operation. After this function returns, the - /// two objects are independent, i.e. subsequent calls involving one of - /// the objects do not affect the other object. + /// \param ctx The context to use. This must be initialized. + /// \param is224 This determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// \param[in] source_operation The active hash operation to clone. - /// \param[in,out] target_operation The operation object to set up. - /// It must be initialized but not active. + /// \note is224 must be defined accordingly to the enabled + /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The \p source_operation state is not valid (it must be active), or - /// the \p target_operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_clone( - source_operation: *const psa_hash_operation_t, - target_operation: *mut psa_hash_operation_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_starts( + ctx: *mut mbedtls_sha256_context, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC (message authentication code) of a message. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-256 checksum calculation. /// - /// \note To verify the MAC of a message against an - /// expected value, use psa_mac_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_update( + ctx: *mut mbedtls_sha256_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function finishes the SHA-256 operation, and writes + /// the result to the output buffer. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p mac_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_compute( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_finish( + ctx: *mut mbedtls_sha256_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC of a message and compare it with a reference value. + /// \brief This function processes a single data block within + /// the ongoing SHA-256 computation. This function is for + /// internal use only. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \param ctx The SHA-256 context. This must be initialized. + /// \param data The buffer holding one block of data. This must + /// be a readable buffer of length \c 64 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected value. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha256_process( + ctx: *mut mbedtls_sha256_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart MAC operations. -/// -/// Before calling any function on a MAC operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_mac_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_mac_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, -/// for example: -/// \code -/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_mac_operation_init() -/// to the structure, for example: -/// \code -/// psa_mac_operation_t operation; -/// operation = psa_mac_operation_init(); -/// \endcode -/// -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Set up a multipart MAC calculation operation. + /// \brief This function calculates the SHA-224 or SHA-256 + /// checksum of a buffer. /// - /// This function sets up the calculation of the MAC - /// (message authentication code) of a byte string. - /// To verify the MAC of a message against an - /// expected value, use psa_mac_verify_setup() instead. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// The sequence of operations to calculate a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_sign_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_sign_finish() to finish - /// calculating the MAC value and retrieve it. + /// The SHA-256 result is calculated as + /// output = SHA-256(input buffer). /// - /// If an error occurs at any step after a call to psa_mac_sign_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// \param is224 Determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// After a successful call to psa_mac_sign_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_sign_finish(). - /// - A call to psa_mac_abort(). + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-224 checkup routine. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-256 checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha512_context { + pub work_area: [::core::ffi::c_uchar; 304usize], + pub is384: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha512_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Set up a multipart MAC verification operation. + /// \brief This function initializes a SHA-512 context. /// - /// This function sets up the verification of the MAC - /// (message authentication code) of a byte string against an expected value. + /// \param ctx The SHA-512 context to initialize. This must + /// not be \c NULL. + pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-512 context. /// - /// The sequence of operations to verify a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_verify_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_verify_finish() to finish - /// calculating the actual MAC of the message and verify it against - /// the expected value. + /// \param ctx The SHA-512 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must point to an initialized + /// SHA-512 context. + pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-512 context. /// - /// If an error occurs at any step after a call to psa_mac_verify_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha512_clone( + dst: *mut mbedtls_sha512_context, + src: *const mbedtls_sha512_context, + ); +} +unsafe extern "C" { + /// \brief This function starts a SHA-384 or SHA-512 checksum + /// calculation. /// - /// After a successful call to psa_mac_verify_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_verify_finish(). - /// - A call to psa_mac_abort(). + /// \param ctx The SHA-512 context to use. This must be initialized. + /// \param is384 Determines which function to use. This must be + /// either \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage - /// PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \note is384 must be defined accordingly to the enabled + /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c key is not compatible with \c alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_starts( + ctx: *mut mbedtls_sha512_context, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart MAC operation. - /// - /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() - /// before calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \brief This function feeds an input buffer into an ongoing + /// SHA-512 checksum calculation. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] input Buffer containing the message fragment to add to - /// the MAC calculation. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. This must + /// be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_update( - operation: *mut psa_mac_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_update( + ctx: *mut mbedtls_sha512_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message. - /// - /// The application must call psa_mac_sign_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). + /// \brief This function finishes the SHA-512 operation, and writes + /// the result to the output buffer. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the MAC. Call psa_mac_verify_finish() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_finish( + ctx: *mut mbedtls_sha512_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function processes a single data block within + /// the ongoing SHA-512 computation. + /// This function is for internal use only. /// - /// \param[in,out] operation Active MAC operation. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. This is always - /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of the key and \c alg is the - /// MAC algorithm that is calculated. + /// \param ctx The SHA-512 context. This must be initialized. + /// \param data The buffer holding one block of data. This + /// must be a readable buffer of length \c 128 Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p mac buffer is too small. You can determine a - /// sufficient buffer size by calling PSA_MAC_LENGTH(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac sign - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_finish( - operation: *mut psa_mac_operation_t, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha512_process( + ctx: *mut mbedtls_sha512_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-512 or SHA-384 + /// checksum of a buffer. /// - /// The application must call psa_mac_verify_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). It then - /// compares the calculated MAC with the expected MAC passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// The SHA-512 result is calculated as + /// output = SHA-512(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual MAC and the expected MAC is performed - /// in constant time. + /// \param input The buffer holding the input data. This must be + /// a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. + /// \param is384 Determines which function to use. This must be either + /// \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \note is384 must be defined accordingly with the supported + /// symbols in the config file. If: + /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + /// then the function will return + /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected MAC. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac verify - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_finish( - operation: *mut psa_mac_operation_t, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a MAC operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_mac_sign_setup() or psa_mac_verify_setup() again. + /// \brief The SHA-384 checkup routine. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_mac_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-512 checkup routine. /// - /// In particular, calling psa_mac_abort() after the operation has been - /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or - /// psa_mac_verify_finish() is safe and has no effect. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +///< Operation not defined. +pub const mbedtls_sha3_id_MBEDTLS_SHA3_NONE: mbedtls_sha3_id = 0; +///< SHA3-224 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_224: mbedtls_sha3_id = 1; +///< SHA3-256 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_256: mbedtls_sha3_id = 2; +///< SHA3-384 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_384: mbedtls_sha3_id = 3; +///< SHA3-512 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_512: mbedtls_sha3_id = 4; +/// SHA-3 family id. +/// +/// It identifies the family (SHA3-256, SHA3-512, etc.) +pub type mbedtls_sha3_id = ::core::ffi::c_uint; +/// \brief The SHA-3 context structure. +/// +/// The structure is used SHA-3 checksum calculations. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_sha3_context { + pub private_state: [u64; 25usize], + pub private_index: u32, + pub private_olen: u16, + pub private_max_block_size: u16, +} +unsafe extern "C" { + /// \brief This function initializes a SHA-3 context. /// - /// \param[in,out] operation Initialized MAC operation. + /// \param ctx The SHA-3 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha3_init(ctx: *mut mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-3 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; + /// \param ctx The SHA-3 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-3 context. + pub fn mbedtls_sha3_free(ctx: *mut mbedtls_sha3_context); } unsafe extern "C" { - /// Encrypt a message using a symmetric cipher. + /// \brief This function clones the state of a SHA-3 context. /// - /// This function encrypts a message with a random IV (initialization - /// vector). Use the multipart operation interface with a - /// #psa_cipher_operation_t object to provide other forms of IV. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha3_clone(dst: *mut mbedtls_sha3_context, src: *const mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function starts a SHA-3 checksum + /// calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// The output contains the IV followed by - /// the ciphertext proper. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The context to use. This must be initialized. + /// \param id The id of the SHA-3 family. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_starts( + ctx: *mut mbedtls_sha3_context, + id: mbedtls_sha3_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Decrypt a message using a symmetric cipher. - /// - /// This function decrypts a message encrypted with a symmetric cipher. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-3 checksum calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to decrypt. - /// This consists of the IV followed by the - /// ciphertext proper. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the plaintext is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_update( + ctx: *mut mbedtls_sha3_context, input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + ilen: usize, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart cipher operations. -/// -/// Before calling any function on a cipher operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_cipher_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_cipher_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, -/// for example: -/// \code -/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_cipher_operation_init() -/// to the structure, for example: -/// \code -/// psa_cipher_operation_t operation; -/// operation = psa_cipher_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// Set the key for a multipart symmetric encryption operation. + /// \brief This function finishes the SHA-3 operation, and writes + /// the result to the output buffer. /// - /// The sequence of operations to encrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. - /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to - /// generate or set the IV (initialization vector). You should use - /// psa_cipher_generate_iv() unless the protocol you are implementing - /// requires a specific IV value. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. /// - /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_finish( + ctx: *mut mbedtls_sha3_context, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function calculates the SHA-3 + /// checksum of a buffer. /// - /// After a successful call to psa_cipher_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// The SHA-3 result is calculated as + /// output = SHA-3(id, input buffer, d). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \param id The id of the SHA-3 family. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3( + id: mbedtls_sha3_id, + input: *const u8, + ilen: usize, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart symmetric decryption operation. + /// \brief Checkup routine for the algorithms implemented + /// by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. /// - /// The sequence of operations to decrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. - /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the - /// decryption. If the IV is prepended to the ciphertext, you can call - /// psa_cipher_update() on a buffer containing the IV followed by the - /// beginning of the message. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). - /// - /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_cipher_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). - /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if the test failed. + pub fn mbedtls_sha3_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// Generate an IV for a symmetric encryption operation. - /// - /// This function generates a random IV (initialization vector), nonce - /// or initial counter value for the encryption operation as appropriate - /// for the chosen algorithm, key type and key size. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] iv Buffer where the generated IV is to be written. - /// \param iv_size Size of the \p iv buffer in bytes. - /// \param[out] iv_length On success, the number of bytes of the - /// generated IV. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p iv buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no IV set), - /// or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_generate_iv( - operation: *mut psa_cipher_operation_t, - iv: *mut u8, - iv_size: usize, - iv_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hash_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// Set the IV for a symmetric encryption or decryption operation. - /// - /// This function sets the IV (initialization vector), nonce - /// or initial counter value for the encryption or decryption operation. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \note When encrypting, applications should use psa_cipher_generate_iv() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] iv Buffer containing the IV to use. - /// \param iv_length Size of the IV in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p iv is not acceptable for the chosen algorithm, - /// or the chosen algorithm does not use an IV. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active cipher - /// encrypt operation, with no IV set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_set_iv( - operation: *mut psa_cipher_operation_t, - iv: *const u8, - iv_length: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub md5: mbedtls_md5_context, + pub ripemd160: mbedtls_ripemd160_context, + pub sha1: mbedtls_sha1_context, + pub sha256: mbedtls_sha256_context, + pub sha512: mbedtls_sha512_context, } -unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active cipher operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() - /// (recommended when encrypting) or psa_cipher_set_iv(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_update( - operation: *mut psa_cipher_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Finish encrypting or decrypting a message in a cipher operation. - /// - /// The application must call psa_cipher_encrypt_setup() or - /// psa_cipher_decrypt_setup() before calling this function. The choice - /// of setup function determines whether this function encrypts or - /// decrypts its input. - /// - /// This function finishes the encryption or decryption of the message - /// formed by concatenating the inputs passed to preceding calls to - /// psa_cipher_update(). - /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input size passed to this operation is not valid for - /// this particular algorithm. For example, the algorithm is a based - /// on block cipher and requires a whole number of blocks, but the - /// total input size is not a multiple of the block size. - /// \retval #PSA_ERROR_INVALID_PADDING - /// This is a decryption operation for an algorithm that includes - /// padding, and the ciphertext does not contain valid padding. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_finish( - operation: *mut psa_cipher_operation_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_cipher_operation_t { + pub private_alg: psa_algorithm_t, + pub private_iv_length: u8, + pub private_block_length: u8, + pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_cipher: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_cipher_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_hash_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_hash_operation_t, +} +impl Default for psa_driver_hash_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_cipher_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, +} +impl Default for psa_driver_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hash_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h. + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. the driver context is not active, in use). + pub private_id: ::core::ffi::c_uint, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_hash_context_t, +} +impl Default for psa_hash_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_cipher_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_default_iv_length: u8, + pub private_ctx: psa_driver_cipher_context_t, +} +impl Default for psa_cipher_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_cipher_operation_s { + #[inline] + pub fn private_iv_required(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_iv_required: ::core::ffi::c_uint, + private_iv_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; + private_iv_required as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; + private_iv_set as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The GCM context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_gcm_context { + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, + ///< Precalculated HTable. + pub private_H: [[u64; 2usize]; 16usize], + ///< The total length of the encrypted data. + pub private_len: u64, + ///< The total length of the additional data. + pub private_add_len: u64, + ///< The first ECTR for tag. + pub private_base_ectr: [::core::ffi::c_uchar; 16usize], + ///< The Y working value. + pub private_y: [::core::ffi::c_uchar; 16usize], + ///< The buf working value. + pub private_buf: [::core::ffi::c_uchar; 16usize], + ///< The operation to perform: + ///#MBEDTLS_GCM_ENCRYPT or + ///#MBEDTLS_GCM_DECRYPT. + pub private_mode: ::core::ffi::c_uchar, + ///< The acceleration to use. + pub private_acceleration: ::core::ffi::c_uchar, +} +impl Default for mbedtls_gcm_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Abort a cipher operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. - /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_cipher_operation_t. - /// - /// In particular, calling psa_cipher_abort() after the operation has been - /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() - /// is safe and has no effect. + /// \brief This function initializes the specified GCM context, + /// to make references valid, and prepares the context + /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). /// - /// \param[in,out] operation Initialized cipher operation. + /// The function does not bind the GCM context to a particular + /// cipher, nor set the key. For this purpose, use + /// mbedtls_gcm_setkey(). /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; + /// \param ctx The GCM context to initialize. This must not be \c NULL. + pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Process an authenticated encryption operation. + /// \brief This function associates a GCM context with a + /// cipher algorithm and a key. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that will be authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] plaintext Data that will be authenticated and - /// encrypted. - /// \param plaintext_length Size of \p plaintext in bytes. - /// \param[out] ciphertext Output buffer for the authenticated and - /// encrypted data. The additional data is not - /// part of this output. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate outputs, the - /// authentication tag is appended to the - /// encrypted data. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p plaintext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p - /// plaintext_length) evaluates to the maximum - /// ciphertext size of any supported AEAD - /// encryption. - /// \param[out] ciphertext_length On success, the size of the output - /// in the \p ciphertext buffer. + /// \param ctx The GCM context. This must be initialized. + /// \param cipher The 128-bit block cipher to use. + /// \param key The encryption key. This must be a readable buffer of at + /// least \p keybits bits. + /// \param keybits The key size in bits. Valid options are: + ///
          • 128 bits
            • + ///
          • 192 bits
            • + ///
          • 256 bits
          /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p ciphertext_size is too small. - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p plaintext_length) or - /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - plaintext: *const u8, - plaintext_length: usize, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_gcm_setkey( + ctx: *mut mbedtls_gcm_context, + cipher: mbedtls_cipher_id_t, + key: *const ::core::ffi::c_uchar, + keybits: ::core::ffi::c_uint, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Process an authenticated decryption operation. + /// \brief This function performs GCM encryption or decryption of a buffer. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that has been authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] ciphertext Data that has been authenticated and - /// encrypted. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate inputs, the buffer - /// must contain the encrypted data followed - /// by the authentication tag. - /// \param ciphertext_length Size of \p ciphertext in bytes. - /// \param[out] plaintext Output buffer for the decrypted data. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p ciphertext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p - /// ciphertext_length) evaluates to the maximum - /// plaintext size of any supported AEAD - /// decryption. - /// \param[out] plaintext_length On success, the size of the output - /// in the \p plaintext buffer. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The ciphertext is not authentic. - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p plaintext_size is too small. - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p ciphertext_length) or - /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used - /// to determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - ciphertext: *const u8, - ciphertext_length: usize, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - ) -> psa_status_t; + /// \warning When this function performs a decryption, it outputs the + /// authentication tag and does not verify that the data is + /// authentic. You should use this function to perform encryption + /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// + /// \param ctx The GCM context to use for encryption or decryption. This + /// must be initialized. + /// \param mode The operation to perform: + /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + /// The ciphertext is written to \p output and the + /// authentication tag is written to \p tag. + /// - #MBEDTLS_GCM_DECRYPT to perform decryption. + /// The plaintext is written to \p output and the + /// authentication tag is written to \p tag. + /// Note that this mode is not recommended, because it does + /// not verify the authenticity of the data. For this reason, + /// you should use mbedtls_gcm_auth_decrypt() instead of + /// calling this function in decryption mode. + /// \param length The length of the input data, which is equal to the length + /// of the output data. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param input The buffer holding the input data. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size in Bytes. + /// \param output The buffer for holding the output data. If \p length is greater + /// than zero, this must be a writable buffer of at least that + /// size in Bytes. + /// \param tag_len The length of the tag to generate. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// + /// \return \c 0 if the encryption or decryption was performed + /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + /// this does not indicate that the data is authentic. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the encryption + /// or decryption failed. + pub fn mbedtls_gcm_crypt_and_tag( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + tag_len: usize, + tag: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart AEAD operations. -/// -/// Before calling any function on an AEAD operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_aead_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_aead_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, -/// for example: -/// \code -/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_aead_operation_init() -/// to the structure, for example: -/// \code -/// psa_aead_operation_t operation; -/// operation = psa_aead_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// Set the key for a multipart authenticated encryption operation. + /// \brief This function performs a GCM authenticated decryption of a + /// buffer. /// - /// The sequence of operations to encrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to - /// generate or set the nonce. You should use - /// psa_aead_generate_nonce() unless the protocol you are implementing - /// requires a specific nonce value. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the message to encrypt each time. - /// -# Call psa_aead_finish(). - /// - /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_finish(). - /// - A call to psa_aead_abort(). + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param length The length of the ciphertext to decrypt, which is also + /// the length of the decrypted plaintext. + /// \param iv The initialization vector. This must be a readable buffer + /// of at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param tag The buffer holding the tag to verify. This must be a + /// readable buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to verify. + /// \param input The buffer holding the ciphertext. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size. + /// \param output The buffer for holding the decrypted plaintext. If \p length + /// is greater than zero, this must be a writable buffer of at + /// least that size. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 if successful and authenticated. + /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the decryption + /// failed. + pub fn mbedtls_gcm_auth_decrypt( + ctx: *mut mbedtls_gcm_context, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + tag: *const ::core::ffi::c_uchar, + tag_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart authenticated decryption operation. - /// - /// The sequence of operations to decrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call psa_aead_set_nonce() with the nonce for the decryption. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the ciphertext to decrypt each time. - /// -# Call psa_aead_verify(). - /// - /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_verify(). - /// - A call to psa_aead_abort(). + /// \brief This function starts a GCM encryption or decryption + /// operation. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + /// #MBEDTLS_GCM_DECRYPT. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_starts( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Generate a random nonce for an authenticated encryption operation. - /// - /// This function generates a random nonce for the authenticated encryption - /// operation with an appropriate size for the chosen algorithm, key type - /// and key size. - /// - /// The application must call psa_aead_encrypt_setup() before - /// calling this function. + /// \brief This function feeds an input buffer as associated data + /// (authenticated but not encrypted data) in a GCM + /// encryption or decryption operation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// Call this function after mbedtls_gcm_starts() to pass + /// the associated data. If the associated data is empty, + /// you do not need to call this function. You may not + /// call this function after calling mbedtls_cipher_update(). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] nonce Buffer where the generated nonce is to be - /// written. - /// \param nonce_size Size of the \p nonce buffer in bytes. - /// \param[out] nonce_length On success, the number of bytes of the - /// generated nonce. + /// \param ctx The GCM context. This must have been started with + /// mbedtls_gcm_starts() and must not have yet received + /// any input with mbedtls_gcm_update(). + /// \param add The buffer holding the additional data, or \c NULL + /// if \p add_len is \c 0. + /// \param add_len The length of the additional data. If \c 0, + /// \p add may be \c NULL. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p nonce buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active aead encrypt - /// operation, with no nonce set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_generate_nonce( - operation: *mut psa_aead_operation_t, - nonce: *mut u8, - nonce_size: usize, - nonce_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_update_ad( + ctx: *mut mbedtls_gcm_context, + add: *const ::core::ffi::c_uchar, + add_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the nonce for an authenticated encryption or decryption operation. + /// \brief This function feeds an input buffer into an ongoing GCM + /// encryption or decryption operation. /// - /// This function sets the nonce for the authenticated - /// encryption or decryption operation. + /// You may call this function zero, one or more times + /// to pass successive parts of the input: the plaintext to + /// encrypt, or the ciphertext (not including the tag) to + /// decrypt. After the last part of the input, call + /// mbedtls_gcm_finish(). /// - /// The application must call psa_aead_encrypt_setup() or - /// psa_aead_decrypt_setup() before calling this function. + /// This function may produce output in one of the following + /// ways: + /// - Immediate output: the output length is always equal + /// to the input length. + /// - Buffered output: the output consists of a whole number + /// of 16-byte blocks. If the total input length so far + /// (not including associated data) is 16 \* *B* + *A* + /// with *A* < 16 then the total output length is 16 \* *B*. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// In particular: + /// - It is always correct to call this function with + /// \p output_size >= \p input_length + 15. + /// - If \p input_length is a multiple of 16 for all the calls + /// to this function during an operation, then it is + /// correct to use \p output_size = \p input_length. /// - /// \note When encrypting, applications should use psa_aead_generate_nonce() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] nonce Buffer containing the nonce to use. - /// \param nonce_length Size of the nonce in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param input The buffer holding the input data. If \p input_length + /// is greater than zero, this must be a readable buffer + /// of at least \p input_length bytes. + /// \param input_length The length of the input data in bytes. + /// \param output The buffer for the output data. If \p output_size + /// is greater than zero, this must be a writable buffer of + /// of at least \p output_size bytes. + /// \param output_size The size of the output buffer in bytes. + /// See the function description regarding the output size. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p nonce is not acceptable for the chosen algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no nonce - /// set), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_nonce( - operation: *mut psa_aead_operation_t, - nonce: *const u8, - nonce_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// total input length too long, + /// unsupported input/output buffer overlap detected, + /// or \p output_size too small. + pub fn mbedtls_gcm_update( + ctx: *mut mbedtls_gcm_context, + input: *const ::core::ffi::c_uchar, + input_length: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Declare the lengths of the message and additional data for AEAD. - /// - /// The application must call this function before calling - /// psa_aead_update_ad() or psa_aead_update() if the algorithm for - /// the operation requires it. If the algorithm does not require it, - /// calling this function is optional, but if this function is called - /// then the implementation must enforce the lengths. - /// - /// You may call this function before or after setting the nonce with - /// psa_aead_set_nonce() or psa_aead_generate_nonce(). - /// - /// - For #PSA_ALG_CCM, calling this function is required. - /// - For the other AEAD algorithms defined in this specification, calling - /// this function is not required. - /// - For vendor-defined algorithm, refer to the vendor documentation. + /// \brief This function finishes the GCM operation and generates + /// the authentication tag. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// It wraps up the GCM stream, and generates the + /// tag. The tag can have a maximum length of 16 Bytes. /// - /// \param[in,out] operation Active AEAD operation. - /// \param ad_length Size of the non-encrypted additional - /// authenticated data in bytes. - /// \param plaintext_length Size of the plaintext to encrypt in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to generate. This must be at least + /// four. + /// \param output The buffer for the final output. + /// If \p output_size is nonzero, this must be a writable + /// buffer of at least \p output_size bytes. + /// \param output_size The size of the \p output buffer in bytes. + /// This must be large enough for the output that + /// mbedtls_gcm_update() has not produced. In particular: + /// - If mbedtls_gcm_update() produces immediate output, + /// or if the total input size is a multiple of \c 16, + /// then mbedtls_gcm_finish() never produces any output, + /// so \p output_size can be \c 0. + /// - \p output_size never needs to be more than \c 15. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// At least one of the lengths is not acceptable for the chosen - /// algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and - /// psa_aead_update_ad() and psa_aead_update() must not have been - /// called yet), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_lengths( - operation: *mut psa_aead_operation_t, - ad_length: usize, - plaintext_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// invalid value of \p tag_len, + /// or \p output_size too small. + pub fn mbedtls_gcm_finish( + ctx: *mut mbedtls_gcm_context, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + tag: *mut ::core::ffi::c_uchar, + tag_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Pass additional data to an active AEAD operation. - /// - /// Additional data is authenticated, but not encrypted. - /// - /// You may call this function multiple times to pass successive fragments - /// of the additional data. You may not call this function after passing - /// data to encrypt or decrypt with psa_aead_update(). - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, - /// treat the input as untrusted and prepare to undo any action that - /// depends on the input if psa_aead_verify() returns an error status. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the fragment of - /// additional data. - /// \param input_length Size of the \p input buffer in bytes. + /// \brief This function clears a GCM context and the underlying + /// cipher sub-context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input length overflows the additional data length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, have lengths set if required by the algorithm, and - /// psa_aead_update() must not have been called yet), or the library - /// has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update_ad( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The GCM context to clear. If this is \c NULL, the call has + /// no effect. Otherwise, this must be initialized. + pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active AEAD operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// 3. Call psa_aead_update_ad() to pass all the additional data. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: - /// - Do not use the output in any way other than storing it in a - /// confidential location. If you take any action that depends - /// on the tentative decrypted data, this action will need to be - /// undone if the input turns out not to be valid. Furthermore, - /// if an adversary can observe that this action took place - /// (for example through timing), they may be able to use this - /// fact as an oracle to decrypt any message encrypted with the - /// same key. - /// - In particular, do not copy the output anywhere but to a - /// memory or storage space that you have exclusive access to. - /// - /// This function does not require the input to be aligned to any - /// particular block boundary. If the implementation can only process - /// a whole block at a time, it must consume all the input provided, but - /// it may delay the end of the corresponding output until a subsequent - /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() - /// provides sufficient input. The amount of data that can be delayed - /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, - /// \c alg, \p input_length) where - /// \c key_type is the type of key and \c alg is - /// the algorithm that were used to set up the - /// operation. - /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p - /// input_length) evaluates to the maximum - /// output size of any supported AEAD - /// algorithm. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// \brief The GCM checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or - /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total input length overflows the plaintext length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, and have lengths set if required by the algorithm), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hmac_operation_t { + /// The HMAC algorithm in use + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + /// The hash context. + pub hash_ctx: psa_hash_operation_s, + /// The HMAC part of the context. + pub private_opad: [u8; 128usize], +} +impl Default for mbedtls_psa_hmac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_mac_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_hmac: mbedtls_psa_hmac_operation_t, + pub private_cmac: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_mac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_aead_operation_t { + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_tag_length: u8, + pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub private_ccm: mbedtls_ccm_context, + pub private_gcm: mbedtls_gcm_context, + pub private_chachapoly: mbedtls_chachapoly_context, +} +impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_aead_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl mbedtls_psa_aead_operation_t { + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_sign_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_verify_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +///< Client +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; +///< Server +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; +///< Undefined +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_NONE: mbedtls_ecjpake_role = 2; +/// Roles in the EC J-PAKE exchange +pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; +/// EC J-PAKE context structure. +/// +/// J-PAKE is a symmetric protocol, except for the identifiers used in +/// Zero-Knowledge Proofs, and the serialization of the second message +/// (KeyExchange) as defined by the Thread spec. +/// +/// In order to benefit from this symmetry, we choose a different naming +/// convention from the Thread v1.0 spec. Correspondence is indicated in the +/// description as a pair C: client name, S: server name +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecjpake_context { + ///< Hash to use + pub private_md_type: mbedtls_md_type_t, + ///< Elliptic curve + pub private_grp: mbedtls_ecp_group, + ///< Are we client or server? + pub private_role: mbedtls_ecjpake_role, + ///< Format for point export + pub private_point_format: ::core::ffi::c_int, + ///< My public key 1 C: X1, S: X3 + pub private_Xm1: mbedtls_ecp_point, + ///< My public key 2 C: X2, S: X4 + pub private_Xm2: mbedtls_ecp_point, + ///< Peer public key 1 C: X3, S: X1 + pub private_Xp1: mbedtls_ecp_point, + ///< Peer public key 2 C: X4, S: X2 + pub private_Xp2: mbedtls_ecp_point, + ///< Peer public key C: Xs, S: Xc + pub private_Xp: mbedtls_ecp_point, + ///< My private key 1 C: x1, S: x3 + pub private_xm1: mbedtls_mpi, + ///< My private key 2 C: x2, S: x4 + pub private_xm2: mbedtls_mpi, + ///< Pre-shared secret (passphrase) + pub private_s: mbedtls_mpi, +} +impl Default for mbedtls_ecjpake_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Finish encrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_encrypt_setup(). + /// \brief Initialize an ECJPAKE context. /// - /// This function finishes the authentication of the additional data - /// formed by concatenating the inputs passed to preceding calls to - /// psa_aead_update_ad() with the plaintext formed by concatenating the - /// inputs passed to preceding calls to psa_aead_update(). + /// \param ctx The ECJPAKE context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Set up an ECJPAKE context for use. /// - /// This function has two output buffers: - /// - \p ciphertext contains trailing ciphertext that was buffered from - /// preceding calls to psa_aead_update(). - /// - \p tag contains the authentication tag. + /// \note Currently the only values for hash/curve allowed by the + /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to set up. This must be initialized. + /// \param role The role of the caller. This must be either + /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + /// \param hash The identifier of the hash function to use, + /// for example #MBEDTLS_MD_SHA256. + /// \param curve The identifier of the elliptic curve to use, + /// for example #MBEDTLS_ECP_DP_SECP256R1. + /// \param secret The pre-shared secret (passphrase). This must be + /// a readable not empty buffer of length \p len Bytes. It need + /// only be valid for the duration of this call. + /// \param len The length of the pre-shared secret \p secret. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] ciphertext Buffer where the last part of the ciphertext - /// is to be written. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] ciphertext_length On success, the number of bytes of - /// returned ciphertext. - /// \param[out] tag Buffer where the authentication tag is - /// to be written. - /// \param tag_size Size of the \p tag buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c - /// key_type, \c key_bits, \c alg) where - /// \c key_type and \c key_bits are the type and - /// bit-size of the key, and \c alg is the - /// algorithm that were used in the call to - /// psa_aead_encrypt_setup(). - /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the - /// maximum tag size of any supported AEAD - /// algorithm. - /// \param[out] tag_length On success, the number of bytes - /// that make up the returned tag. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p ciphertext or \p tag buffer is too small. - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the - /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, - /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to - /// determine the required \p tag buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active encryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_finish( - operation: *mut psa_aead_operation_t, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - tag: *mut u8, - tag_size: usize, - tag_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_setup( + ctx: *mut mbedtls_ecjpake_context, + role: mbedtls_ecjpake_role, + hash: mbedtls_md_type_t, + curve: mbedtls_ecp_group_id, + secret: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish authenticating and decrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_decrypt_setup(). - /// - /// This function finishes the authenticated decryption of the message - /// components: + /// \brief Set the point format for future reads and writes. /// - /// - The additional data consisting of the concatenation of the inputs - /// passed to preceding calls to psa_aead_update_ad(). - /// - The ciphertext consisting of the concatenation of the inputs passed to - /// preceding calls to psa_aead_update(). - /// - The tag passed to this function call. + /// \param ctx The ECJPAKE context to configure. + /// \param point_format The point format to use: + /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + /// or #MBEDTLS_ECP_PF_COMPRESSED. /// - /// If the authentication tag is correct, this function outputs any remaining - /// plaintext and reports success. If the authentication tag is not correct, - /// this function returns #PSA_ERROR_INVALID_SIGNATURE. + /// \return \c 0 if successful. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + /// is invalid. + pub fn mbedtls_ecjpake_set_point_format( + ctx: *mut mbedtls_ecjpake_context, + point_format: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if an ECJPAKE context is ready for use. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to check. This must be + /// initialized. /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual tag and the expected tag is performed - /// in constant time. + /// \return \c 0 if the context is ready for use. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] plaintext Buffer where the last part of the plaintext - /// is to be written. This is the remaining data - /// from previous calls to psa_aead_update() - /// that could not be processed until the end - /// of the input. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] plaintext_length On success, the number of bytes of - /// returned plaintext. - /// \param[in] tag Buffer containing the authentication tag. - /// \param tag_length Size of the \p tag buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be + /// initialized and set up. + /// \param buf The buffer to write the contents to. This must be a + /// writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number + /// of Bytes written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculations were successful, but the authentication tag is - /// not correct. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p plaintext buffer is too small. - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the - /// required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active decryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_verify( - operation: *mut psa_aead_operation_t, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - tag: *const u8, - tag_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort an AEAD operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// \brief Read and process the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_aead_operation_t. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up. + /// \param buf The buffer holding the first round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// In particular, calling psa_aead_abort() after the operation has been - /// terminated by a call to psa_aead_abort(), psa_aead_finish() or - /// psa_aead_verify() is safe and has no effect. + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \param[in,out] operation Initialized AEAD operation. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up, and already have performed round one. + /// \param buf The buffer to write the round two contents to. + /// This must be a writable buffer of length \p len Bytes. + /// \param len The size of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a message with a private key. For hash-and-sign algorithms, - /// this includes the hashing step. + /// \brief Read and process the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \note To perform a multi-part hash-and-sign signature algorithm, first use - /// a multi-part hash operation and then pass the resulting hash to - /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the - /// hash algorithm to use. - /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The input message to sign. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param[in] signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up and already have performed round one. + /// \param buf The buffer holding the second round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a message with a public key, using - /// a hash-and-sign verification algorithm. - /// - /// \note To perform a multi-part hash-and-sign signature verification - /// algorithm, first use a multi-part hash operation to hash the message - /// and then pass the resulting hash to psa_verify_hash(). - /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm - /// to use. + /// \brief Derive the shared secret + /// (TLS: Pre-Master Secret). /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The message whose signature is to be verified. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer containing the signature to verify. - /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed signature - /// is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_derive_secret( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a hash or short message with a private key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief Write the shared key material to be passed to a Key + /// Derivation Function as described in RFC8236. /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. - /// \param[out] signature_length On success, the number of bytes - /// that make up the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_shared_key( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a hash or short message using a public key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief This clears an ECJPAKE context and frees any + /// embedded data structure. /// - /// \param key Identifier of the key to use for the operation. It - /// must be a public key or an asymmetric key pair. The - /// key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message whose signature is to be - /// verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to free. This may be \c NULL, + /// in which case this function does nothing. If it is not + /// \c NULL, it must point to an initialized ECJPAKE context. + pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \retval #PSA_SUCCESS - /// The signature is valid. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief Encrypt a short message with a public key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the encrypted message is to - /// be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_pake_operation_t { + pub private_alg: psa_algorithm_t, + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_role: mbedtls_ecjpake_role, + pub private_buffer: [u8; 336usize], + pub private_buffer_length: usize, + pub private_buffer_offset: usize, + pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// \brief Decrypt a short message with a private key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. It must - /// allow the usage #PSA_KEY_USAGE_DECRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_jpake: mbedtls_ecjpake_context, } -/// The type of the state data structure for key derivation operations. -/// -/// Before calling any function on a key derivation operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_key_derivation_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, -/// for example: -/// \code -/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_key_derivation_operation_init() -/// to the structure, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// operation = psa_key_derivation_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_key_derivation_operation_t = psa_key_derivation_s; -unsafe extern "C" { - /// Set up a key derivation operation. - /// - /// A key derivation algorithm takes some inputs and uses them to generate - /// a byte stream in a deterministic way. - /// This byte stream can be used to produce keys and other - /// cryptographic material. - /// - /// To derive a key: - /// -# Start with an initialized object of type #psa_key_derivation_operation_t. - /// -# Call psa_key_derivation_setup() to select the algorithm. - /// -# Provide the inputs for the key derivation by calling - /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() - /// as appropriate. Which inputs are needed, in what order, and whether - /// they may be keys and if so of what type depends on the algorithm. - /// -# Optionally set the operation's maximum capacity with - /// psa_key_derivation_set_capacity(). You may do this before, in the middle - /// of or after providing inputs. For some algorithms, this step is mandatory - /// because the output depends on the maximum capacity. - /// -# To derive a key, call psa_key_derivation_output_key(). - /// To derive a byte string for a different purpose, call - /// psa_key_derivation_output_bytes(). - /// Successive calls to these functions use successive output bytes - /// calculated by the key derivation algorithm. - /// -# Clean up the key derivation operation object with - /// psa_key_derivation_abort(). - /// - /// If this function returns an error, the key derivation operation object is - /// not changed. - /// - /// If an error occurs at any step after a call to psa_key_derivation_setup(), - /// the operation will need to be reset by a call to psa_key_derivation_abort(). - /// - /// Implementations must reject an attempt to derive a key of size 0. - /// - /// \param[in,out] operation The key derivation operation object - /// to set up. It must - /// have been initialized but not set up yet. - /// \param alg The key derivation algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c alg is not a key derivation algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_setup( - operation: *mut psa_key_derivation_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Retrieve the current capacity of a key derivation operation. - /// - /// The capacity of a key derivation is the maximum number of bytes that it can - /// return. When you get *N* bytes of output from a key derivation operation, - /// this reduces its capacity by *N*. - /// - /// \param[in] operation The operation to query. - /// \param[out] capacity On success, the capacity of the operation. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_get_capacity( - operation: *const psa_key_derivation_operation_t, - capacity: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Set the maximum capacity of a key derivation operation. - /// - /// The capacity of a key derivation operation is the maximum number of bytes - /// that the key derivation operation can return from this point onwards. - /// - /// \param[in,out] operation The key derivation operation object to modify. - /// \param capacity The new capacity of the operation. - /// It must be less or equal to the operation's - /// current capacity. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p capacity is larger than the operation's current capacity. - /// In this case, the operation object remains valid and its capacity - /// remains unchanged. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_set_capacity( - operation: *mut psa_key_derivation_operation_t, - capacity: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_mac_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_mac_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function passes direct inputs, which is usually correct for - /// non-secret inputs. To pass a secret input, which should be in a key - /// object, call psa_key_derivation_input_key() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] data Input data to use. - /// \param data_length Size of the \p data buffer in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow direct inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_bytes( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - data: *const u8, - data_length: usize, - ) -> psa_status_t; +impl Default for psa_driver_mac_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Provide a numeric input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// However, when an algorithm requires a particular order, numeric inputs - /// usually come first as they tend to be configuration parameters. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function is used for inputs which are fixed-size non-negative - /// integers. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] value The value of the numeric input. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow numeric inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_integer( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - value: u64, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_aead_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_aead_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation in the form of a key. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function obtains input from a key object, which is usually correct for - /// secret inputs or for non-secret personalization strings kept in the key - /// store. To pass a non-secret parameter which is not in the key store, - /// call psa_key_derivation_input_bytes() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param key Identifier of the key. It must have an - /// appropriate type for step and must allow the - /// usage #PSA_KEY_USAGE_DERIVE or - /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) - /// and the algorithm used by the operation. - /// - /// \note Once all inputs steps are completed, the operations will allow: - /// - psa_key_derivation_output_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_output_key() if the input for step - /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD - /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was - /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_verify_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; - /// - psa_key_derivation_verify_key() under the same conditions as - /// psa_key_derivation_verify_bytes(). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key allows neither #PSA_KEY_USAGE_DERIVE nor - /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this - /// algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow key inputs of the given type - /// or does not allow key inputs at all. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_key( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - key: mbedtls_svc_key_id_t, - ) -> psa_status_t; +impl Default for psa_driver_aead_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Perform a key agreement and use the shared secret as input to a key - /// derivation. - /// - /// A key agreement algorithm takes two inputs: a private key \p private_key - /// a public key \p peer_key. - /// The result of this function is passed as input to a key derivation. - /// The output of this key derivation can be extracted by reading from the - /// resulting operation to produce keys and other cryptographic material. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() with a - /// key agreement and derivation algorithm - /// \c alg (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true - /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) - /// is false). - /// The operation must be ready for an - /// input of the type given by \p step. - /// \param step Which step the input data is for. - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. The peer key must be in the - /// same format that psa_import_key() accepts for the - /// public key type corresponding to the type of - /// private_key. That is, this function performs the - /// equivalent of - /// #psa_import_key(..., - /// `peer_key`, `peer_key_length`) where - /// with key attributes indicating the public key - /// type corresponding to the type of `private_key`. - /// For example, for EC keys, this means that peer_key - /// is interpreted as a point on the curve that the - /// private key is on. The standard formats for public - /// keys are documented in the documentation of - /// psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_sign_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, +} +impl Default for psa_driver_sign_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_verify_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, +} +impl Default for psa_driver_verify_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_pake_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_pake_operation_t, +} +impl Default for psa_driver_pake_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_mac_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_mac_size: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_mac_context_t, +} +impl Default for psa_mac_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_mac_operation_s { + #[inline] + pub fn private_is_sign(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_sign: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; + private_is_sign as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_aead_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub private_ad_remaining: usize, + pub private_body_remaining: usize, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_ctx: psa_driver_aead_context_t, +} +impl Default for psa_aead_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_aead_operation_s { + #[inline] + pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_ad_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_body_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(3usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 3usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 3usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(4usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 4usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 4usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_nonce_set: ::core::ffi::c_uint, + private_lengths_set: ::core::ffi::c_uint, + private_ad_started: ::core::ffi::c_uint, + private_body_started: ::core::ffi::c_uint, + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; + private_nonce_set as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; + private_lengths_set as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; + private_ad_started as u64 + }); + __bindgen_bitfield_unit.set(3usize, 1u8, { + let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; + private_body_started as u64 + }); + __bindgen_bitfield_unit.set(4usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hkdf_key_derivation_t { + pub private_info: *mut u8, + pub private_info_length: usize, + pub private_offset_in_block: u8, + pub private_block_number: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_output_block: [u8; 64usize], + pub private_prk: [u8; 64usize], + pub __bindgen_padding_0: [u64; 0usize], + pub private_hmac: psa_mac_operation_s, +} +impl Default for psa_hkdf_key_derivation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_hkdf_key_derivation_t { + #[inline] + pub fn private_state(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_info_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_state: ::core::ffi::c_uint, + private_info_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 2u8, { + let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; + private_state as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; + private_info_set as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_tls12_ecjpake_to_pms_t { + pub private_data: [u8; 32usize], +} +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: + psa_tls12_prf_key_derivation_state_t = 0; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: + psa_tls12_prf_key_derivation_state_t = 1; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 2; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 3; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: + psa_tls12_prf_key_derivation_state_t = 4; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: + psa_tls12_prf_key_derivation_state_t = 5; +pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_tls12_prf_key_derivation_s { + pub private_left_in_block: u8, + pub private_block_number: u8, + pub private_state: psa_tls12_prf_key_derivation_state_t, + pub private_secret: *mut u8, + pub private_secret_length: usize, + pub private_seed: *mut u8, + pub private_seed_length: usize, + pub private_label: *mut u8, + pub private_label_length: usize, + pub private_other_secret: *mut u8, + pub private_other_secret_length: usize, + pub private_Ai: [u8; 64usize], + pub private_output_block: [u8; 64usize], +} +impl Default for psa_tls12_prf_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_key_derivation_context_t { + pub dummy: ::core::ffi::c_uint, + pub private_hkdf: psa_hkdf_key_derivation_t, + pub private_tls12_prf: psa_tls12_prf_key_derivation_t, + pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +} +impl Default for psa_driver_key_derivation_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_key_derivation_s { + pub private_alg: psa_algorithm_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_capacity: usize, + pub __bindgen_padding_0: [u64; 0usize], + pub private_ctx: psa_driver_key_derivation_context_t, +} +impl Default for psa_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_key_derivation_s { + #[inline] + pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_can_output_key: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_can_output_key: u32 = + unsafe { ::core::mem::transmute(private_can_output_key) }; + private_can_output_key as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_custom_key_parameters_s { + pub flags: u32, +} +#[repr(C)] +#[derive(Default)] +pub struct psa_key_production_parameters_s { + pub flags: u32, + pub data: __IncompleteArrayField, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_policy_s { + pub private_usage: psa_key_usage_t, + pub private_alg: psa_algorithm_t, + pub private_alg2: psa_algorithm_t, +} +pub type psa_key_policy_t = psa_key_policy_s; +pub type psa_key_bits_t = u16; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_attributes_s { + pub private_type: psa_key_type_t, + pub private_bits: psa_key_bits_t, + pub private_lifetime: psa_key_lifetime_t, + pub private_policy: psa_key_policy_t, + pub private_id: mbedtls_svc_key_id_t, +} +/// \brief The context for PSA interruptible hash signing. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_sign_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_sign_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_sign_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_sign_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The context for PSA interruptible hash verification. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_verify_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_verify_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_verify_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_verify_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +unsafe extern "C" { + /// \brief Library initialization. + /// + /// Applications must call this function before calling any other + /// function in this module. + /// + /// Applications may call this function more than once. Once a call + /// succeeds, subsequent calls are guaranteed to succeed. + /// + /// If the application calls other functions before calling psa_crypto_init(), + /// the behavior is undefined. Implementations are encouraged to either perform + /// the operation as if the library had been initialized or to return + /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + /// implementations should not return a success status if the lack of + /// initialization may have security implications, for example due to improper + /// seeding of the random number generator. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + pub fn psa_crypto_init() -> psa_status_t; +} +unsafe extern "C" { + /// Retrieve the attributes of a key. + /// + /// This function first resets the attribute structure as with + /// psa_reset_key_attributes(). It then copies the attributes of + /// the given key into the given attribute structure. + /// + /// \note This function may allocate memory or other resources. + /// Once you have called this function on an attribute structure, + /// you must call psa_reset_key_attributes() to free these resources. + /// + /// \param[in] key Identifier of the key to query. + /// \param[in,out] attributes On success, the attributes of the key. + /// On failure, equivalent to a + /// freshly-initialized structure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_get_key_attributes( + key: mbedtls_svc_key_id_t, + attributes: *mut psa_key_attributes_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Reset a key attribute structure to a freshly initialized state. + /// + /// You must initialize the attribute structure as described in the + /// documentation of the type #psa_key_attributes_t before calling this + /// function. Once the structure has been initialized, you may call this + /// function at any time. + /// + /// This function frees any auxiliary resources that the structure + /// may contain. + /// + /// \param[in,out] attributes The attribute structure to reset. + pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); +} +unsafe extern "C" { + /// Remove non-essential copies of key material from memory. + /// + /// If the key identifier designates a volatile key, this functions does not do + /// anything and returns successfully. + /// + /// If the key identifier designates a persistent key, then this function will + /// free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and the key can still be used. + /// + /// \param key Identifier of the key to purge. + /// + /// \retval #PSA_SUCCESS + /// The key material will have been removed from memory if it is not + /// currently required. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid key identifier. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// Make a copy of a key. + /// + /// Copy key material from one location to another. + /// + /// This function is primarily useful to copy a key from one location + /// to another, since it populates a key using the material from + /// another key which may have a different lifetime. + /// + /// This function may be used to share a key with a different party, + /// subject to implementation-defined restrictions on key sharing. + /// + /// The policy on the source key must have the usage flag + /// #PSA_KEY_USAGE_COPY set. + /// This flag is sufficient to permit the copy if the key has the lifetime + /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + /// Some secure elements do not provide a way to copy a key without + /// making it extractable from the secure element. If a key is located + /// in such a secure element, then the key must have both usage flags + /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + /// a copy of the key outside the secure element. + /// + /// The resulting key may only be used in a way that conforms to + /// both the policy of the original key and the policy specified in + /// the \p attributes parameter: + /// - The usage flags on the resulting key are the bitwise-and of the + /// usage flags on the source policy and the usage flags in \p attributes. + /// - If both allow the same algorithm or wildcard-based + /// algorithm policy, the resulting key has the same algorithm policy. + /// - If either of the policies allows an algorithm and the other policy + /// allows a wildcard-based algorithm policy that includes this algorithm, + /// the resulting key allows the same algorithm. + /// - If the policies do not allow any algorithm in common, this function + /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// + /// The effect of this function on implementation-defined attributes is + /// implementation-defined. + /// + /// \param source_key The key to copy. It must allow the usage + /// #PSA_KEY_USAGE_COPY. If a private or secret key is + /// being copied outside of a secure element it must + /// also allow #PSA_KEY_USAGE_EXPORT. + /// \param[in] attributes The attributes for the new key. + /// They are used as follows: + /// - The key type and size may be 0. If either is + /// nonzero, it must match the corresponding + /// attribute of the source key. + /// - The key location (the lifetime and, for + /// persistent keys, the key identifier) is + /// used directly. + /// - The policy constraints (usage flags and + /// algorithm policy) are combined from + /// the source key and \p attributes so that + /// both sets of restrictions apply, as + /// described in the documentation of this function. + /// \param[out] target_key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p source_key is invalid. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The lifetime or identifier in \p attributes are invalid, or + /// the policy constraints on the source and specified in + /// \p attributes are incompatible, or + /// \p attributes specifies a key type or key size + /// which does not match the attributes of the source key. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + /// the source key is not exportable and its lifetime does not + /// allow copying it to the target's lifetime. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_copy_key( + source_key: mbedtls_svc_key_id_t, + attributes: *const psa_key_attributes_t, + target_key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Destroy a key. + /// + /// This function destroys a key from both volatile + /// memory and, if applicable, non-volatile storage. Implementations shall + /// make a best effort to ensure that the key material cannot be recovered. + /// + /// This function also erases any metadata such as policies and frees + /// resources associated with the key. + /// + /// If a key is currently in use in a multipart operation, then destroying the + /// key will cause the multipart operation to fail. + /// + /// \warning We can only guarantee that the the key material will + /// eventually be wiped from memory. With threading enabled + /// and during concurrent execution, copies of the key material may + /// still exist until all threads have finished using the key. + /// + /// \param key Identifier of the key to erase. If this is \c 0, do nothing and + /// return #PSA_SUCCESS. + /// + /// \retval #PSA_SUCCESS + /// \p key was a valid identifier and the key material that it + /// referred to has been erased. Alternatively, \p key is \c 0. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key cannot be erased because it is + /// read-only, either due to a policy or due to physical restrictions. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p key is not a valid identifier nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE + /// There was a failure in communication with the cryptoprocessor. + /// The key material may still be present in the cryptoprocessor. + /// \retval #PSA_ERROR_DATA_INVALID + /// This error is typically a result of either storage corruption on a + /// cleartext storage backend, or an attempt to read data that was + /// written by an incompatible version of the library. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The storage is corrupted. Implementations shall make a best effort + /// to erase key material even in this stage, however applications + /// should be aware that it may be impossible to guarantee that the + /// key material is not recoverable in such cases. + /// \retval #PSA_ERROR_CORRUPTION_DETECTED + /// An unexpected condition which is not a storage corruption or + /// a communication failure occurred. The cryptoprocessor may have + /// been compromised. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Import a key in binary format. + /// + /// This function supports any output from psa_export_key(). Refer to the + /// documentation of psa_export_public_key() for the format of public keys + /// and to the documentation of psa_export_key() for the format for + /// other key types. + /// + /// The key data determines the key size. The attributes may optionally + /// specify a key size; in this case it must match the size determined + /// from the key data. A key size of 0 in \p attributes indicates that + /// the key size is solely determined by the key data. + /// + /// Implementations must reject an attempt to import a key of size 0. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// \param[in] attributes The attributes for the new key. + /// The key size is always determined from the + /// \p data buffer. + /// If the key size in \p attributes is nonzero, + /// it must be equal to the size from \p data. + /// \param[out] key On success, an identifier to the newly created key. + /// For persistent keys, this is the key identifier + /// defined in \p attributes. + /// \c 0 on failure. + /// \param[in] data Buffer containing the key data. The content of this + /// buffer is interpreted according to the type declared + /// in \p attributes. + /// All implementations must support at least the format + /// described in the documentation + /// of psa_export_key() or psa_export_public_key() for + /// the chosen type. Implementations may allow other + /// formats, but should be conservative: implementations + /// should err on the side of rejecting content if it + /// may be erroneous (e.g. wrong type or truncated data). + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular persistent location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key attributes, as a whole, are invalid, or + /// the key data is not correctly formatted, or + /// the size in \p attributes is nonzero and does not match the size + /// of the key data. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_import_key( + attributes: *const psa_key_attributes_t, + data: *const u8, + data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a key in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an equivalent object. + /// + /// If the implementation of psa_import_key() supports other formats + /// beyond the format specified here, the output from psa_export_key() + /// must use the representation specified here, not the original + /// representation. + /// + /// For standard key types, the output format is as follows: + /// + /// - For symmetric keys (including MAC keys), the format is the + /// raw bytes of the key. + /// - For DES, the key data consists of 8 bytes. The parity bits must be + /// correct. + /// - For Triple-DES, the format is the concatenation of the + /// two or three DES keys. + /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + /// is the non-encrypted DER encoding of the representation defined by + /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + /// ``` + /// RSAPrivateKey ::= SEQUENCE { + /// version INTEGER, -- must be 0 + /// modulus INTEGER, -- n + /// publicExponent INTEGER, -- e + /// privateExponent INTEGER, -- d + /// prime1 INTEGER, -- p + /// prime2 INTEGER, -- q + /// exponent1 INTEGER, -- d mod (p-1) + /// exponent2 INTEGER, -- d mod (q-1) + /// coefficient INTEGER, -- (inverse of q) mod p + /// } + /// ``` + /// - For elliptic curve key pairs (key types for which + /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + /// a representation of the private value as a `ceiling(m/8)`-byte string + /// where `m` is the bit size associated with the curve, i.e. the bit size + /// of the order of the curve's coordinate field. This byte string is + /// in little-endian order for Montgomery curves (curve types + /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + /// For Weierstrass curves, this is the content of the `privateKey` field of + /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + /// the format is defined by RFC 7748, and output is masked according to §5. + /// For twisted Edwards curves, the private key is as defined by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For Diffie-Hellman key exchange key pairs (key types for which + /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + /// format is the representation of the private key `x` as a big-endian byte + /// string. The length of the byte string is the private key size in bytes + /// (leading zeroes are not stripped). + /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + /// true), the format is the same as for psa_export_public_key(). + /// + /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// + /// \param key Identifier of the key to export. It must allow the + /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public + /// key. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a public key or the public part of a key pair in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an object that is equivalent to the public key. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// For standard key types, the output format is as follows: + /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + /// ``` + /// RSAPublicKey ::= SEQUENCE { + /// modulus INTEGER, -- n + /// publicExponent INTEGER } -- e + /// ``` + /// - For elliptic curve keys on a twisted Edwards curve (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + /// by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For other elliptic curve public keys (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. + /// Let `m` be the bit size associated with the curve, i.e. the bit size of + /// `q` for a curve over `F_q`. The representation consists of: + /// - The byte 0x04; + /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + /// - For Diffie-Hellman key exchange public keys (key types for which + /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + /// the format is the representation of the public key `y = g^x mod p` as a + /// big-endian byte string. The length of the byte string is the length of the + /// base prime `p` in bytes. + /// + /// Exporting a public key object or the public part of a key pair is + /// always permitted, regardless of the key's usage flags. + /// + /// \param key Identifier of the key to export. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key is neither a public key nor a key pair. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_public_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message. + /// + /// \note To verify the hash of a message against an + /// expected value, use psa_hash_compare() instead. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\p alg). /// /// \retval #PSA_SUCCESS /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p hash_size is too small + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compute( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message and compare it with a + /// reference value. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the input. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c private_key is not compatible with \c alg, - /// or \p peer_key is not valid for \c alg or not compatible with - /// \c private_key, or \c step does not allow an input resulting - /// from a key agreement. + /// \p input_length or \p hash_length do not match the hash size for \p alg + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compare( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; +} +/// The type of the state data structure for multipart hash operations. +/// +/// Before calling any function on a hash operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_hash_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_hash_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, +/// for example: +/// \code +/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_hash_operation_init() +/// to the structure, for example: +/// \code +/// psa_hash_operation_t operation; +/// operation = psa_hash_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_hash_operation_t = psa_hash_operation_s; +unsafe extern "C" { + /// Set up a multipart hash operation. + /// + /// The sequence of operations to calculate a hash (message digest) + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + /// -# Call psa_hash_setup() to specify the algorithm. + /// -# Call psa_hash_update() zero, one or more times, passing a fragment + /// of the message each time. The hash that is calculated is the hash + /// of the concatenation of these messages in order. + /// -# To calculate the hash, call psa_hash_finish(). + /// To compare the hash with an expected value, call psa_hash_verify(). + /// + /// If an error occurs at any step after a call to psa_hash_setup(), the + /// operation will need to be reset by a call to psa_hash_abort(). The + /// application may call psa_hash_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_hash_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_hash_finish() or psa_hash_verify(). + /// - A call to psa_hash_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_hash_operation_t and not yet in use. + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. + /// \p alg is not a supported hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a hash algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this key agreement \p step, - /// or the library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_key_agreement( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, + pub fn psa_hash_setup( + operation: *mut psa_hash_operation_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// Read some data from a key derivation operation. + /// Add a message fragment to a multipart hash operation. /// - /// This function calculates output bytes from a key derivation algorithm and - /// return those bytes. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the requested number of bytes from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. + /// The application must call psa_hash_setup() before calling this function. /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] output Buffer where the output will be written. - /// \param output_length Number of bytes to output. + /// \param[in,out] operation Active hash operation. + /// \param[in] input Buffer containing the message fragment to hash. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// no output is written to the output buffer. - /// The operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller output buffer. + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_update( + operation: *mut psa_hash_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \warning Applications should not call this function if they expect + /// a specific value for the hash. Call psa_hash_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// hash values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the hashed data which could allow an attacker to guess + /// a valid hash and thereby bypass security controls. + /// + /// \param[in,out] operation Active hash operation. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\c alg) where \c alg is the + /// hash algorithm that is calculated. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p hash buffer is too small. You can determine a + /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + /// where \c alg is the hash algorithm that is calculated. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_finish( + operation: *mut psa_hash_operation_t, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message and compare it with + /// an expected value. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). It then + /// compares the calculated hash with the expected hash passed as a + /// parameter to this function. + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual hash and the expected hash is performed + /// in constant time. + /// + /// \param[in,out] operation Active hash operation. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_bytes( - operation: *mut psa_key_derivation_operation_t, - output: *mut u8, - output_length: usize, + pub fn psa_hash_verify( + operation: *mut psa_hash_operation_t, + hash: *const u8, + hash_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// Derive a key from an ongoing key derivation operation. - /// - /// This function calculates output bytes from a key derivation algorithm - /// and uses those bytes to generate a key deterministically. - /// The key's location, usage policy, type and size are taken from - /// \p attributes. - /// - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads as many bytes as required from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// How much output is produced and consumed from the operation, and how - /// the key is derived, depends on the key type and on the key size - /// (denoted \c bits below): - /// - /// - For key types for which the key is an arbitrary sequence of bytes - /// of a given size, this function is functionally equivalent to - /// calling #psa_key_derivation_output_bytes - /// and passing the resulting output to #psa_import_key. - /// However, this function has a security benefit: - /// if the implementation provides an isolation boundary then - /// the key material is not exposed outside the isolation boundary. - /// As a consequence, for these key types, this function always consumes - /// exactly (\c bits / 8) bytes from the operation. - /// The following key types defined in this specification follow this scheme: - /// - /// - #PSA_KEY_TYPE_AES; - /// - #PSA_KEY_TYPE_ARIA; - /// - #PSA_KEY_TYPE_CAMELLIA; - /// - #PSA_KEY_TYPE_DERIVE; - /// - #PSA_KEY_TYPE_HMAC; - /// - #PSA_KEY_TYPE_PASSWORD_HASH. - /// - /// - For ECC keys on a Montgomery elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Montgomery curve), this function always draws a byte string whose - /// length is determined by the curve, and sets the mandatory bits - /// accordingly. That is: + /// Abort a hash operation. /// - /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte - /// string and process it as specified in RFC 7748 §5. - /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte - /// string and process it as specified in RFC 7748 §5. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_hash_setup() again. /// - /// - For key types for which the key is represented by a single sequence of - /// \c bits bits with constraints as to which bit sequences are acceptable, - /// this function draws a byte string of length (\c bits / 8) bytes rounded - /// up to the nearest whole number of bytes. If the resulting byte string - /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. - /// This process is repeated until an acceptable byte string is drawn. - /// The byte string drawn from the operation is interpreted as specified - /// for the output produced by psa_export_key(). - /// The following key types defined in this specification follow this scheme: + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_hash_operation_t. /// - /// - #PSA_KEY_TYPE_DES. - /// Force-set the parity bits, but discard forbidden weak keys. - /// For 2-key and 3-key triple-DES, the three keys are generated - /// successively (for example, for 3-key triple-DES, - /// if the first 8 bytes specify a weak key and the next 8 bytes do not, - /// discard the first 8 bytes, use the next 8 bytes as the first key, - /// and continue reading output from the operation to derive the other - /// two keys). - /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) - /// where \c group designates any Diffie-Hellman group) and - /// ECC keys on a Weierstrass elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Weierstrass curve). - /// For these key types, interpret the byte string as integer - /// in big-endian order. Discard it if it is not in the range - /// [0, *N* - 2] where *N* is the boundary of the private key domain - /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, - /// or the order of the curve's base point for ECC). - /// Add 1 to the resulting integer and use this as the private key *x*. - /// This method allows compliance to NIST standards, specifically - /// the methods titled "key-pair generation by testing candidates" - /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, - /// in FIPS 186-4 §B.1.2 for DSA, and - /// in NIST SP 800-56A §5.6.1.2.2 or - /// FIPS 186-4 §B.4.2 for elliptic curve keys. + /// In particular, calling psa_hash_abort() after the operation has been + /// terminated by a call to psa_hash_abort(), psa_hash_finish() or + /// psa_hash_verify() is safe and has no effect. /// - /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, - /// the way in which the operation output is consumed is - /// implementation-defined. + /// \param[in,out] operation Initialized hash operation. /// - /// In all cases, the data that is read is discarded from the operation. - /// The operation's capacity is decreased by the number of bytes read. + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Clone a hash operation. /// - /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, - /// the input to that step must be provided with psa_key_derivation_input_key(). - /// Future versions of this specification may include additional restrictions - /// on the derived key based on the attributes and strength of the secret key. + /// This function copies the state of an ongoing hash operation to + /// a new operation object. In other words, this function is equivalent + /// to calling psa_hash_setup() on \p target_operation with the same + /// algorithm that \p source_operation was set up for, then + /// psa_hash_update() on \p target_operation with the same input that + /// that was passed to \p source_operation. After this function returns, the + /// two objects are independent, i.e. subsequent calls involving one of + /// the objects do not affect the other object. /// - /// \param[in] attributes The attributes for the new key. - /// If the key type to be created is - /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in - /// the policy must be the same as in the current - /// operation. - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in] source_operation The active hash operation to clone. + /// \param[in,out] target_operation The operation object to set up. + /// It must be initialized but not active. /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// There was not enough data to create the desired key. - /// Note that in this case, no output is written to the output buffer. - /// The operation's capacity is set to 0, thus subsequent calls to - /// this function will not succeed, even with a smaller output buffer. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The provided key attributes are not valid for the operation. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The #PSA_KEY_DERIVATION_INPUT_SECRET or - /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a - /// key; or one of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_SUCCESS \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The \p source_operation state is not valid (it must be active), or + /// the \p target_operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_key( - attributes: *const psa_key_attributes_t, - operation: *mut psa_key_derivation_operation_t, - key: *mut mbedtls_svc_key_id_t, + pub fn psa_hash_clone( + source_operation: *const psa_hash_operation_t, + target_operation: *mut psa_hash_operation_t, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value in constant time. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the expected number of bytes from the - /// stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to the following code: - /// \code - /// psa_key_derivation_output_bytes(operation, tmp, output_length); - /// if (memcmp(output, tmp, output_length) != 0) - /// return PSA_ERROR_INVALID_SIGNATURE; - /// \endcode - /// except (1) it works even if the key's policy does not allow outputting the - /// bytes, and (2) the comparison will be done in constant time. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC (message authentication code) of a message. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected_output Buffer containing the expected derivation output. - /// \param output_length Length of the expected output; this is also the - /// number of bytes that will be read. + /// \note To verify the MAC of a message against an + /// expected value, use psa_mac_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but it differs from the expected - /// output. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p mac_size is too small /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_bytes( - operation: *mut psa_key_derivation_operation_t, - expected_output: *const u8, - output_length: usize, + pub fn psa_mac_compute( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value - /// stored in a key object. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value, provided as key of type - /// #PSA_KEY_TYPE_PASSWORD_HASH. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the number of bytes corresponding to the - /// length of the expected value from the stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to exporting the key and calling - /// psa_key_derivation_verify_bytes() on the result, except that it - /// works even if the key cannot be exported. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC of a message and compare it with a reference value. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH - /// containing the expected output. Its policy must - /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag - /// and the permitted algorithm must match the - /// operation. The value of this key was likely - /// computed by a previous call to - /// psa_key_derivation_output_key(). + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the input. /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but if differs from the expected - /// output. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// The key passed as the expected value does not exist. + /// The MAC of the message was calculated successfully, but it + /// differs from the expected value. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key passed as the expected value has an invalid type. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key passed as the expected value does not allow this usage or - /// this algorithm; or one of the inputs was a key whose policy didn't - /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// the length of the expected value. In this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_key( - operation: *mut psa_key_derivation_operation_t, - expected: psa_key_id_t, + pub fn psa_mac_verify( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *const u8, + mac_length: usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart MAC operations. +/// +/// Before calling any function on a MAC operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_mac_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_mac_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, +/// for example: +/// \code +/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_mac_operation_init() +/// to the structure, for example: +/// \code +/// psa_mac_operation_t operation; +/// operation = psa_mac_operation_init(); +/// \endcode +/// +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Abort a key derivation operation. + /// Set up a multipart MAC calculation operation. /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_key_derivation_setup() again. + /// This function sets up the calculation of the MAC + /// (message authentication code) of a byte string. + /// To verify the MAC of a message against an + /// expected value, use psa_mac_verify_setup() instead. /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_key_derivation_operation_t. + /// The sequence of operations to calculate a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_sign_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_sign_finish() to finish + /// calculating the MAC value and retrieve it. /// - /// In particular, it is valid to call psa_key_derivation_abort() twice, or to - /// call psa_key_derivation_abort() on an operation that has not been set up. + /// If an error occurs at any step after a call to psa_mac_sign_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. /// - /// \param[in,out] operation The operation to abort. + /// After a successful call to psa_mac_sign_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_sign_finish(). + /// - A call to psa_mac_abort(). /// - /// \retval #PSA_SUCCESS \emptydescription + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) - -> psa_status_t; + pub fn psa_mac_sign_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Perform a key agreement and return the raw shared secret. + /// Set up a multipart MAC verification operation. /// - /// \warning The raw result of a key agreement algorithm such as finite-field - /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should - /// not be used directly as key material. It should instead be passed as - /// input to a key derivation algorithm. To chain a key agreement with - /// a key derivation, use psa_key_derivation_key_agreement() and other - /// functions from the key derivation interface. + /// This function sets up the verification of the MAC + /// (message authentication code) of a byte string against an expected value. /// - /// \param alg The key agreement algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) - /// is true). - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. It must be - /// in the same format that psa_import_key() - /// accepts. The standard formats for public - /// keys are documented in the documentation - /// of psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// The sequence of operations to verify a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_verify_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_verify_finish() to finish + /// calculating the actual MAC of the message and verify it against + /// the expected value. + /// + /// If an error occurs at any step after a call to psa_mac_verify_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_mac_verify_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_verify_finish(). + /// - A call to psa_mac_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage + /// PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). /// /// \retval #PSA_SUCCESS /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a key agreement algorithm, or - /// \p private_key is not compatible with \p alg, - /// or \p peer_key is not valid for \p alg or not compatible with - /// \p private_key. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p output_size is too small + /// \c key is not compatible with \c alg. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported key agreement algorithm. + /// \c alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_raw_key_agreement( + pub fn psa_mac_verify_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate random bytes. - /// - /// \warning This function **can** fail! Callers MUST check the return status - /// and MUST NOT use the content of the output buffer if the return - /// status is not #PSA_SUCCESS. - /// - /// \note To generate a key, use psa_generate_key() instead. - /// - /// \param[out] output Output buffer for the generated data. - /// \param output_size Number of bytes to generate and output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Generate a key or key pair. - /// - /// The key is generated randomly. - /// Its location, usage policy, type and size are taken from \p attributes. + /// Add a message fragment to a multipart MAC operation. /// - /// Implementations must reject an attempt to generate a key of size 0. + /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + /// before calling this function. /// - /// The following type-specific considerations apply: - /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the public exponent is 65537. - /// The modulus is a product of two probabilistic primes - /// between 2^{n-1} and 2^n where n is the bit size specified in the - /// attributes. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param[in] attributes The attributes for the new key. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in,out] operation Active MAC operation. + /// \param[in] input Buffer containing the message fragment to add to + /// the MAC calculation. + /// \param input_length Size of the \p input buffer in bytes. /// /// \retval #PSA_SUCCESS /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_generate_key( - attributes: *const psa_key_attributes_t, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; -} -/// The type of the state data structure for interruptible hash -/// signing operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = -/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_sign_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// operation = psa_sign_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; -/// The type of the state data structure for interruptible hash -/// verification operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = -/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_verify_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// operation = psa_verify_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; -unsafe extern "C" { - /// \brief Set the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note The time taken to execute a single op is - /// implementation specific and depends on - /// software, hardware, the algorithm, key type and - /// curve chosen. Even within a single operation, - /// successive ops can take differing amounts of - /// time. The only guarantee is that lower values - /// for \p max_ops means functions will block for a - /// lesser maximum amount of time. The functions - /// \c psa_sign_interruptible_get_num_ops() and - /// \c psa_verify_interruptible_get_num_ops() are - /// provided to help with tuning this value. - /// - /// \note This value defaults to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which - /// means the whole operation will be done in one - /// go, regardless of the number of ops required. - /// - /// \note If more ops are needed to complete a - /// computation, #PSA_OPERATION_INCOMPLETE will be - /// returned by the function performing the - /// computation. It is then the caller's - /// responsibility to either call again with the - /// same operation context until it returns 0 or an - /// error code; or to call the relevant abort - /// function if the answer is no longer required. - /// - /// \note The interpretation of \p max_ops is also - /// implementation defined. On a hard real time - /// system, this can indicate a hard deadline, as a - /// real-time system needs a guarantee of not - /// spending more than X time, however care must be - /// taken in such an implementation to avoid the - /// situation whereby calls just return, not being - /// able to do any actual work within the allotted - /// time. On a non-real-time system, the - /// implementation can be more relaxed, but again - /// whether this number should be interpreted as as - /// hard or soft limit or even whether a less than - /// or equals as regards to ops executed in a - /// single call is implementation defined. - /// - /// \note For keys in local storage when no accelerator - /// driver applies, please see also the - /// documentation for \c mbedtls_ecp_set_max_ops(), - /// which is the internal implementation in these - /// cases. - /// - /// \warning With implementations that interpret this number - /// as a hard limit, setting this number too small - /// may result in an infinite loop, whereby each - /// call results in immediate return with no ops - /// done (as there is not enough time to execute - /// any), and thus no result will ever be achieved. - /// - /// \note This only applies to functions whose - /// documentation mentions they may return - /// #PSA_OPERATION_INCOMPLETE. - /// - /// \param max_ops The maximum number of ops to be executed in a - /// single call. This can be a number from 0 to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 - /// is the least amount of work done per call. - pub fn psa_interruptible_set_max_ops(max_ops: u32); -} -unsafe extern "C" { - /// \brief Get the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. This will return the last - /// value set by - /// \c psa_interruptible_set_max_ops() or - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if - /// that function has never been called. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \return Maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - pub fn psa_interruptible_get_max_ops() -> u32; + pub fn psa_mac_update( + operation: *mut psa_mac_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash signing - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling - /// \c psa_sign_hash_interruptible_abort() on - /// the operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message. /// - /// \note This interface is guaranteed re-entrant and - /// thus may be called from driver code. + /// The application must call psa_mac_sign_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// \warning Applications should not call this function if they expect + /// a specific value for the MAC. Call psa_mac_verify_finish() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \param operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// \param[in,out] operation Active MAC operation. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. This is always + /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of the key and \c alg is the + /// MAC algorithm that is calculated. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_sign_hash_get_num_ops( - operation: *const psa_sign_hash_interruptible_operation_t, - ) -> u32; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p mac buffer is too small. You can determine a + /// sufficient buffer size by calling PSA_MAC_LENGTH(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac sign + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_sign_finish( + operation: *mut psa_mac_operation_t, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash verification - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling \c - /// psa_verify_hash_interruptible_abort() on the - /// operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message and compare it with + /// an expected value. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// The application must call psa_mac_verify_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). It then + /// compares the calculated MAC with the expected MAC passed as a + /// parameter to this function. /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param operation The \c - /// psa_verify_hash_interruptible_operation_t to - /// use. This must be initialized first. + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual MAC and the expected MAC is performed + /// in constant time. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_verify_hash_get_num_ops( - operation: *const psa_verify_hash_interruptible_operation_t, - ) -> u32; + /// \param[in,out] operation Active MAC operation. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The MAC of the message was calculated successfully, but it + /// differs from the expected MAC. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac verify + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_verify_finish( + operation: *mut psa_mac_operation_t, + mac: *const u8, + mac_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start signing a hash or short message with a - /// private key, in an interruptible manner. + /// Abort a MAC operation. /// - /// \see \c psa_sign_hash_complete() + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_mac_sign_setup() or psa_mac_verify_setup() again. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_mac_operation_t. /// - /// \note This function combined with \c - /// psa_sign_hash_complete() is equivalent to - /// \c psa_sign_hash() but - /// \c psa_sign_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// In particular, calling psa_mac_abort() after the operation has been + /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + /// psa_mac_verify_finish() is safe and has no effect. /// - /// \note Users should call \c psa_sign_hash_complete() - /// repeatedly on the same context after a - /// successful call to this function until \c - /// psa_sign_hash_complete() either returns 0 or an - /// error. \c psa_sign_hash_complete() will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// \param[in,out] operation Initialized MAC operation. /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_sign_hash_abort(). + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Encrypt a message using a symmetric cipher. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// This function encrypts a message with a random IV (initialization + /// vector). Use the multipart operation interface with a + /// #psa_cipher_operation_t object to provide other forms of IV. /// /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. + /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// The output contains the IV followed by + /// the ciphertext proper. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. /// /// \retval #PSA_SUCCESS - /// The operation started successfully - call \c psa_sign_hash_complete() - /// with the same context to complete the operation - /// + /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does - /// not permit the requested algorithm. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// An operation has previously been started on this context, and is - /// still in progress. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Decrypt a message using a symmetric cipher. + /// + /// This function decrypts a message encrypted with a symmetric cipher. + /// + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to decrypt. + /// This consists of the IV followed by the + /// ciphertext proper. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the plaintext is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_start( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt( key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart cipher operations. +/// +/// Before calling any function on a cipher operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_cipher_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_cipher_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, +/// for example: +/// \code +/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_cipher_operation_init() +/// to the structure, for example: +/// \code +/// psa_cipher_operation_t operation; +/// operation = psa_cipher_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// signing a hash or short message with a private - /// key, in an interruptible manner. - /// - /// \see \c psa_sign_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_sign_hash_start() is equivalent to - /// \c psa_sign_hash() but this function can return - /// early and resume according to the limit set with - /// \c psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// Set the key for a multipart symmetric encryption operation. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// The sequence of operations to encrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + /// generate or set the IV (initialization vector). You should use + /// psa_cipher_generate_iv() unless the protocol you are implementing + /// requires a specific IV value. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_sign_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_sign_hash_start() called with it - /// first. + /// After a successful call to psa_cipher_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c - /// key_bits, \c alg) where \c key_type and \c - /// key_bits are the type and bit-size - /// respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// Operation completed successfully - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_sign_hash_start(). - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_sign_hash_start() with this operation object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_sign_hash_complete( - operation: *mut psa_sign_hash_interruptible_operation_t, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Abort a sign hash operation. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function is the only function that clears - /// the number of ops completed as part of the - /// operation. Please ensure you copy this value via - /// \c psa_sign_hash_get_num_ops() if required - /// before calling. - /// - /// \note Aborting an operation frees all associated - /// resources except for the \p operation structure - /// itself. Once aborted, the operation object can - /// be reused for another operation by calling \c - /// psa_sign_hash_start() again. - /// - /// \note You may call this function any time after the - /// operation object has been initialized. In - /// particular, calling \c psa_sign_hash_abort() - /// after the operation has already been terminated - /// by a call to \c psa_sign_hash_abort() or - /// psa_sign_hash_complete() is safe. - /// - /// \param[in,out] operation Initialized sign hash operation. - /// - /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_abort( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_encrypt_setup( + operation: *mut psa_cipher_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start reading and verifying a hash or short - /// message, in an interruptible manner. - /// - /// \see \c psa_verify_hash_complete() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_verify_hash_complete() is equivalent to - /// \c psa_verify_hash() but \c - /// psa_verify_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function. + /// Set the key for a multipart symmetric decryption operation. /// - /// \note Users should call \c psa_verify_hash_complete() - /// repeatedly on the same operation object after a - /// successful call to this function until \c - /// psa_verify_hash_complete() either returns 0 or - /// an error. \c psa_verify_hash_complete() will - /// return #PSA_OPERATION_INCOMPLETE if there is - /// more work to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The sequence of operations to decrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + /// decryption. If the IV is prepended to the ciphertext, you can call + /// psa_cipher_update() on a buffer containing the IV followed by the + /// beginning of the message. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_verify_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// After a successful call to psa_cipher_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. /// \param key Identifier of the key to use for the operation. - /// The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash whose signature is to be verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// The operation started successfully - please call \c - /// psa_verify_hash_complete() with the same context to complete the - /// operation. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// Another operation has already been started on this context, and is - /// still in progress. - /// - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does - /// not permit the requested algorithm. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_start( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt_setup( + operation: *mut psa_cipher_operation_t, key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// reading and verifying a hash or short message - /// signed with a private key, in an interruptible - /// manner. - /// - /// \see \c psa_verify_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// Generate an IV for a symmetric encryption operation. /// - /// \note This function combined with \c - /// psa_verify_hash_start() is equivalent to - /// \c psa_verify_hash() but this function can - /// return early and resume according to the limit - /// set with \c psa_interruptible_set_max_ops() to - /// reduce the maximum time spent in a function - /// call. + /// This function generates a random IV (initialization vector), nonce + /// or initial counter value for the encryption operation as appropriate + /// for the chosen algorithm, key type and key size. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_verify_hash_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_verify_hash_start() called with it - /// first. + /// \param[in,out] operation Active cipher operation. + /// \param[out] iv Buffer where the generated IV is to be written. + /// \param iv_size Size of the \p iv buffer in bytes. + /// \param[out] iv_length On success, the number of bytes of the + /// generated IV. /// /// \retval #PSA_SUCCESS - /// Operation completed successfully, and the passed signature is valid. - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_verify_hash_start(). - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p iv buffer is too small. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_verify_hash_start() on this object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_verify_hash_complete( - operation: *mut psa_verify_hash_interruptible_operation_t, + /// The operation state is not valid (it must be active, with no IV set), + /// or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_generate_iv( + operation: *mut psa_cipher_operation_t, + iv: *mut u8, + iv_size: usize, + iv_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Abort a verify hash operation. + /// Set the IV for a symmetric encryption or decryption operation. /// - /// \warning This is a beta API, and thus subject to change at - /// any point. It is not bound by the usual interface - /// stability promises. + /// This function sets the IV (initialization vector), nonce + /// or initial counter value for the encryption or decryption operation. /// - /// \note This function is the only function that clears the - /// number of ops completed as part of the operation. - /// Please ensure you copy this value via - /// \c psa_verify_hash_get_num_ops() if required - /// before calling. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note Aborting an operation frees all associated - /// resources except for the operation structure - /// itself. Once aborted, the operation object can be - /// reused for another operation by calling \c - /// psa_verify_hash_start() again. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \note You may call this function any time after the - /// operation object has been initialized. - /// In particular, calling \c psa_verify_hash_abort() - /// after the operation has already been terminated by - /// a call to \c psa_verify_hash_abort() or - /// psa_verify_hash_complete() is safe. + /// \note When encrypting, applications should use psa_cipher_generate_iv() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \param[in,out] operation Initialized verify hash operation. + /// \param[in,out] operation Active cipher operation. + /// \param[in] iv Buffer containing the IV to use. + /// \param iv_length Size of the IV in bytes. /// /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p iv is not acceptable for the chosen algorithm, + /// or the chosen algorithm does not use an IV. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be an active cipher + /// encrypt operation, with no IV set), or the library has not been + /// previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_abort( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_set_iv( + operation: *mut psa_cipher_operation_t, + iv: *const u8, + iv_length: usize, ) -> psa_status_t; } -/// \brief The GCM context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_gcm_context { - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, - ///< Precalculated HTable low. - pub private_HL: [u64; 16usize], - ///< Precalculated HTable high. - pub private_HH: [u64; 16usize], - ///< The total length of the encrypted data. - pub private_len: u64, - ///< The total length of the additional data. - pub private_add_len: u64, - ///< The first ECTR for tag. - pub private_base_ectr: [::core::ffi::c_uchar; 16usize], - ///< The Y working value. - pub private_y: [::core::ffi::c_uchar; 16usize], - ///< The buf working value. - pub private_buf: [::core::ffi::c_uchar; 16usize], - ///< The operation to perform: - ///#MBEDTLS_GCM_ENCRYPT or - ///#MBEDTLS_GCM_DECRYPT. - pub private_mode: ::core::ffi::c_int, -} -impl Default for mbedtls_gcm_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes the specified GCM context, - /// to make references valid, and prepares the context - /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + /// Encrypt or decrypt a message fragment in an active cipher operation. /// - /// The function does not bind the GCM context to a particular - /// cipher, nor set the key. For this purpose, use - /// mbedtls_gcm_setkey(). + /// Before calling this function, you must: + /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + /// (recommended when encrypting) or psa_cipher_set_iv(). /// - /// \param ctx The GCM context to initialize. This must not be \c NULL. - pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief This function associates a GCM context with a - /// cipher algorithm and a key. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param cipher The 128-bit block cipher to use. - /// \param key The encryption key. This must be a readable buffer of at - /// least \p keybits bits. - /// \param keybits The key size in bits. Valid options are: - ///
          • 128 bits
            • - ///
          • 192 bits
            • - ///
          • 256 bits
          + /// \param[in,out] operation Active cipher operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A cipher-specific error code on failure. - pub fn mbedtls_gcm_setkey( - ctx: *mut mbedtls_gcm_context, - cipher: mbedtls_cipher_id_t, - key: *const ::core::ffi::c_uchar, - keybits: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_update( + operation: *mut psa_cipher_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs GCM encryption or decryption of a buffer. + /// Finish encrypting or decrypting a message in a cipher operation. /// - /// \note For encryption, the output buffer can be the same as the - /// input buffer. For decryption, the output buffer cannot be - /// the same as input buffer. If the buffers overlap, the output - /// buffer must trail at least 8 Bytes behind the input buffer. + /// The application must call psa_cipher_encrypt_setup() or + /// psa_cipher_decrypt_setup() before calling this function. The choice + /// of setup function determines whether this function encrypts or + /// decrypts its input. /// - /// \warning When this function performs a decryption, it outputs the - /// authentication tag and does not verify that the data is - /// authentic. You should use this function to perform encryption - /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// This function finishes the encryption or decryption of the message + /// formed by concatenating the inputs passed to preceding calls to + /// psa_cipher_update(). /// - /// \param ctx The GCM context to use for encryption or decryption. This - /// must be initialized. - /// \param mode The operation to perform: - /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. - /// The ciphertext is written to \p output and the - /// authentication tag is written to \p tag. - /// - #MBEDTLS_GCM_DECRYPT to perform decryption. - /// The plaintext is written to \p output and the - /// authentication tag is written to \p tag. - /// Note that this mode is not recommended, because it does - /// not verify the authenticity of the data. For this reason, - /// you should use mbedtls_gcm_auth_decrypt() instead of - /// calling this function in decryption mode. - /// \param length The length of the input data, which is equal to the length - /// of the output data. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param input The buffer holding the input data. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size in Bytes. - /// \param output The buffer for holding the output data. If \p length is greater - /// than zero, this must be a writable buffer of at least that - /// size in Bytes. - /// \param tag_len The length of the tag to generate. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \return \c 0 if the encryption or decryption was performed - /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, - /// this does not indicate that the data is authentic. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the encryption - /// or decryption failed. - pub fn mbedtls_gcm_crypt_and_tag( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - tag_len: usize, - tag: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active cipher operation. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input size passed to this operation is not valid for + /// this particular algorithm. For example, the algorithm is a based + /// on block cipher and requires a whole number of blocks, but the + /// total input size is not a multiple of the block size. + /// \retval #PSA_ERROR_INVALID_PADDING + /// This is a decryption operation for an algorithm that includes + /// padding, and the ciphertext does not contain valid padding. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_finish( + operation: *mut psa_cipher_operation_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs a GCM authenticated decryption of a - /// buffer. + /// Abort a cipher operation. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. /// - /// \param ctx The GCM context. This must be initialized. - /// \param length The length of the ciphertext to decrypt, which is also - /// the length of the decrypted plaintext. - /// \param iv The initialization vector. This must be a readable buffer - /// of at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param tag The buffer holding the tag to verify. This must be a - /// readable buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to verify. - /// \param input The buffer holding the ciphertext. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size. - /// \param output The buffer for holding the decrypted plaintext. If \p length - /// is greater than zero, this must be a writable buffer of at - /// least that size. + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_cipher_operation_t. /// - /// \return \c 0 if successful and authenticated. - /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the decryption - /// failed. - pub fn mbedtls_gcm_auth_decrypt( - ctx: *mut mbedtls_gcm_context, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - tag: *const ::core::ffi::c_uchar, - tag_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// In particular, calling psa_cipher_abort() after the operation has been + /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() + /// is safe and has no effect. + /// + /// \param[in,out] operation Initialized cipher operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a GCM encryption or decryption - /// operation. + /// Process an authenticated encryption operation. /// - /// \param ctx The GCM context. This must be initialized. - /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or - /// #MBEDTLS_GCM_DECRYPT. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that will be authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] plaintext Data that will be authenticated and + /// encrypted. + /// \param plaintext_length Size of \p plaintext in bytes. + /// \param[out] ciphertext Output buffer for the authenticated and + /// encrypted data. The additional data is not + /// part of this output. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate outputs, the + /// authentication tag is appended to the + /// encrypted data. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p plaintext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + /// plaintext_length) evaluates to the maximum + /// ciphertext size of any supported AEAD + /// encryption. + /// \param[out] ciphertext_length On success, the size of the output + /// in the \p ciphertext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_starts( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p ciphertext_size is too small. + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p plaintext_length) or + /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + plaintext: *const u8, + plaintext_length: usize, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer as associated data - /// (authenticated but not encrypted data) in a GCM - /// encryption or decryption operation. - /// - /// Call this function after mbedtls_gcm_starts() to pass - /// the associated data. If the associated data is empty, - /// you do not need to call this function. You may not - /// call this function after calling mbedtls_cipher_update(). + /// Process an authenticated decryption operation. /// - /// \param ctx The GCM context. This must have been started with - /// mbedtls_gcm_starts() and must not have yet received - /// any input with mbedtls_gcm_update(). - /// \param add The buffer holding the additional data, or \c NULL - /// if \p add_len is \c 0. - /// \param add_len The length of the additional data. If \c 0, - /// \p add may be \c NULL. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that has been authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] ciphertext Data that has been authenticated and + /// encrypted. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate inputs, the buffer + /// must contain the encrypted data followed + /// by the authentication tag. + /// \param ciphertext_length Size of \p ciphertext in bytes. + /// \param[out] plaintext Output buffer for the decrypted data. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p ciphertext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + /// ciphertext_length) evaluates to the maximum + /// plaintext size of any supported AEAD + /// decryption. + /// \param[out] plaintext_length On success, the size of the output + /// in the \p plaintext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_update_ad( - ctx: *mut mbedtls_gcm_context, - add: *const ::core::ffi::c_uchar, - add_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The ciphertext is not authentic. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p plaintext_size is too small. + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p ciphertext_length) or + /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + /// to determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + ciphertext: *const u8, + ciphertext_length: usize, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for multipart AEAD operations. +/// +/// Before calling any function on an AEAD operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_aead_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_aead_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, +/// for example: +/// \code +/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_aead_operation_init() +/// to the structure, for example: +/// \code +/// psa_aead_operation_t operation; +/// operation = psa_aead_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing GCM - /// encryption or decryption operation. - /// - /// You may call this function zero, one or more times - /// to pass successive parts of the input: the plaintext to - /// encrypt, or the ciphertext (not including the tag) to - /// decrypt. After the last part of the input, call - /// mbedtls_gcm_finish(). + /// Set the key for a multipart authenticated encryption operation. /// - /// This function may produce output in one of the following - /// ways: - /// - Immediate output: the output length is always equal - /// to the input length. - /// - Buffered output: the output consists of a whole number - /// of 16-byte blocks. If the total input length so far - /// (not including associated data) is 16 \* *B* + *A* - /// with *A* < 16 then the total output length is 16 \* *B*. + /// The sequence of operations to encrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + /// generate or set the nonce. You should use + /// psa_aead_generate_nonce() unless the protocol you are implementing + /// requires a specific nonce value. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the message to encrypt each time. + /// -# Call psa_aead_finish(). /// - /// In particular: - /// - It is always correct to call this function with - /// \p output_size >= \p input_length + 15. - /// - If \p input_length is a multiple of 16 for all the calls - /// to this function during an operation, then it is - /// correct to use \p output_size = \p input_length. + /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// After a successful call to psa_aead_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_finish(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param input The buffer holding the input data. If \p input_length - /// is greater than zero, this must be a readable buffer - /// of at least \p input_length bytes. - /// \param input_length The length of the input data in bytes. - /// \param output The buffer for the output data. If \p output_size - /// is greater than zero, this must be a writable buffer of - /// of at least \p output_size bytes. - /// \param output_size The size of the output buffer in bytes. - /// See the function description regarding the output size. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// total input length too long, - /// unsupported input/output buffer overlap detected, - /// or \p output_size too small. - pub fn mbedtls_gcm_update( - ctx: *mut mbedtls_gcm_context, - input: *const ::core::ffi::c_uchar, - input_length: usize, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the GCM operation and generates - /// the authentication tag. + /// Set the key for a multipart authenticated decryption operation. /// - /// It wraps up the GCM stream, and generates the - /// tag. The tag can have a maximum length of 16 Bytes. + /// The sequence of operations to decrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call psa_aead_set_nonce() with the nonce for the decryption. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the ciphertext to decrypt each time. + /// -# Call psa_aead_verify(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to generate. This must be at least - /// four. - /// \param output The buffer for the final output. - /// If \p output_size is nonzero, this must be a writable - /// buffer of at least \p output_size bytes. - /// \param output_size The size of the \p output buffer in bytes. - /// This must be large enough for the output that - /// mbedtls_gcm_update() has not produced. In particular: - /// - If mbedtls_gcm_update() produces immediate output, - /// or if the total input size is a multiple of \c 16, - /// then mbedtls_gcm_finish() never produces any output, - /// so \p output_size can be \c 0. - /// - \p output_size never needs to be more than \c 15. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// invalid value of \p tag_len, - /// or \p output_size too small. - pub fn mbedtls_gcm_finish( - ctx: *mut mbedtls_gcm_context, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - tag: *mut ::core::ffi::c_uchar, - tag_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function clears a GCM context and the underlying - /// cipher sub-context. + /// After a successful call to psa_aead_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_verify(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context to clear. If this is \c NULL, the call has - /// no effect. Otherwise, this must be initialized. - pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief The GCM checkup routine. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; -/// For encrypt-decrypt functions, whether the operation is an encryption -/// or a decryption. -pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; -/// \brief MD5 context structure -/// -/// \warning MD5 is considered a weak message digest and its use -/// constitutes a security risk. We recommend considering -/// stronger message digests instead. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md5_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 4usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_md5_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize MD5 context + /// Generate a random nonce for an authenticated encryption operation. /// - /// \param ctx MD5 context to be initialized + /// This function generates a random nonce for the authenticated encryption + /// operation with an appropriate size for the chosen algorithm, key type + /// and key size. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief Clear MD5 context + /// The application must call psa_aead_encrypt_setup() before + /// calling this function. /// - /// \param ctx MD5 context to be cleared + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); + /// \param[in,out] operation Active AEAD operation. + /// \param[out] nonce Buffer where the generated nonce is to be + /// written. + /// \param nonce_size Size of the \p nonce buffer in bytes. + /// \param[out] nonce_length On success, the number of bytes of the + /// generated nonce. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p nonce buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active aead encrypt + /// operation, with no nonce set), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_generate_nonce( + operation: *mut psa_aead_operation_t, + nonce: *mut u8, + nonce_size: usize, + nonce_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) an MD5 context + /// Set the nonce for an authenticated encryption or decryption operation. /// - /// \param dst The destination context - /// \param src The context to be cloned + /// This function sets the nonce for the authenticated + /// encryption or decryption operation. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief MD5 context setup + /// The application must call psa_aead_encrypt_setup() or + /// psa_aead_decrypt_setup() before calling this function. /// - /// \param ctx context to be initialized + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \note When encrypting, applications should use psa_aead_generate_nonce() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] nonce Buffer containing the nonce to use. + /// \param nonce_length Size of the nonce in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p nonce is not acceptable for the chosen algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with no nonce + /// set), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_nonce( + operation: *mut psa_aead_operation_t, + nonce: *const u8, + nonce_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process buffer + /// Declare the lengths of the message and additional data for AEAD. /// - /// \param ctx MD5 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// The application must call this function before calling + /// psa_aead_update_ad() or psa_aead_update() if the algorithm for + /// the operation requires it. If the algorithm does not require it, + /// calling this function is optional, but if this function is called + /// then the implementation must enforce the lengths. /// - /// \return 0 if successful + /// You may call this function before or after setting the nonce with + /// psa_aead_set_nonce() or psa_aead_generate_nonce(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_update( - ctx: *mut mbedtls_md5_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief MD5 final digest + /// - For #PSA_ALG_CCM, calling this function is required. + /// - For the other AEAD algorithms defined in this specification, calling + /// this function is not required. + /// - For vendor-defined algorithm, refer to the vendor documentation. /// - /// \param ctx MD5 context - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \param[in,out] operation Active AEAD operation. + /// \param ad_length Size of the non-encrypted additional + /// authenticated data in bytes. + /// \param plaintext_length Size of the plaintext to encrypt in bytes. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_finish( - ctx: *mut mbedtls_md5_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// At least one of the lengths is not acceptable for the chosen + /// algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and + /// psa_aead_update_ad() and psa_aead_update() must not have been + /// called yet), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_lengths( + operation: *mut psa_aead_operation_t, + ad_length: usize, + plaintext_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process data block (internal use only) + /// Pass additional data to an active AEAD operation. /// - /// \param ctx MD5 context - /// \param data buffer holding one block of data + /// Additional data is authenticated, but not encrypted. /// - /// \return 0 if successful + /// You may call this function multiple times to pass successive fragments + /// of the additional data. You may not call this function after passing + /// data to encrypt or decrypt with psa_aead_update(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_internal_md5_process( - ctx: *mut mbedtls_md5_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = MD5( input buffer ) + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + /// treat the input as untrusted and prepare to undo any action that + /// depends on the input if psa_aead_verify() returns an error status. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the fragment of + /// additional data. + /// \param input_length Size of the \p input buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input length overflows the additional data length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, have lengths set if required by the algorithm, and + /// psa_aead_update() must not have been called yet), or the library + /// has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update_ad( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Encrypt or decrypt a message fragment in an active AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + /// 3. Call psa_aead_update_ad() to pass all the additional data. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief RIPEMD-160 context structure -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ripemd160_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 5usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_ripemd160_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize RIPEMD-160 context + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \param ctx RIPEMD-160 context to be initialized - pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); -} -unsafe extern "C" { - /// \brief Clear RIPEMD-160 context + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + /// - Do not use the output in any way other than storing it in a + /// confidential location. If you take any action that depends + /// on the tentative decrypted data, this action will need to be + /// undone if the input turns out not to be valid. Furthermore, + /// if an adversary can observe that this action took place + /// (for example through timing), they may be able to use this + /// fact as an oracle to decrypt any message encrypted with the + /// same key. + /// - In particular, do not copy the output anywhere but to a + /// memory or storage space that you have exclusive access to. /// - /// \param ctx RIPEMD-160 context to be cleared - pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); + /// This function does not require the input to be aligned to any + /// particular block boundary. If the implementation can only process + /// a whole block at a time, it must consume all the input provided, but + /// it may delay the end of the corresponding output until a subsequent + /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + /// provides sufficient input. The amount of data that can be delayed + /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + /// \c alg, \p input_length) where + /// \c key_type is the type of key and \c alg is + /// the algorithm that were used to set up the + /// operation. + /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + /// input_length) evaluates to the maximum + /// output size of any supported AEAD + /// algorithm. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total input length overflows the plaintext length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, and have lengths set if required by the algorithm), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) a RIPEMD-160 context + /// Finish encrypting a message in an AEAD operation. /// - /// \param dst The destination context - /// \param src The context to be cloned - pub fn mbedtls_ripemd160_clone( - dst: *mut mbedtls_ripemd160_context, - src: *const mbedtls_ripemd160_context, - ); -} -unsafe extern "C" { - /// \brief RIPEMD-160 context setup + /// The operation must have been set up with psa_aead_encrypt_setup(). /// - /// \param ctx context to be initialized + /// This function finishes the authentication of the additional data + /// formed by concatenating the inputs passed to preceding calls to + /// psa_aead_update_ad() with the plaintext formed by concatenating the + /// inputs passed to preceding calls to psa_aead_update(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process buffer + /// This function has two output buffers: + /// - \p ciphertext contains trailing ciphertext that was buffered from + /// preceding calls to psa_aead_update(). + /// - \p tag contains the authentication tag. /// - /// \param ctx RIPEMD-160 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_update( - ctx: *mut mbedtls_ripemd160_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[out] ciphertext Buffer where the last part of the ciphertext + /// is to be written. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] ciphertext_length On success, the number of bytes of + /// returned ciphertext. + /// \param[out] tag Buffer where the authentication tag is + /// to be written. + /// \param tag_size Size of the \p tag buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + /// key_type, \c key_bits, \c alg) where + /// \c key_type and \c key_bits are the type and + /// bit-size of the key, and \c alg is the + /// algorithm that were used in the call to + /// psa_aead_encrypt_setup(). + /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + /// maximum tag size of any supported AEAD + /// algorithm. + /// \param[out] tag_length On success, the number of bytes + /// that make up the returned tag. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p ciphertext or \p tag buffer is too small. + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + /// determine the required \p tag buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active encryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_finish( + operation: *mut psa_aead_operation_t, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + tag: *mut u8, + tag_size: usize, + tag_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief RIPEMD-160 final digest + /// Finish authenticating and decrypting a message in an AEAD operation. /// - /// \param ctx RIPEMD-160 context - /// \param output RIPEMD-160 checksum result + /// The operation must have been set up with psa_aead_decrypt_setup(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_finish( - ctx: *mut mbedtls_ripemd160_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process data block (internal use only) + /// This function finishes the authenticated decryption of the message + /// components: /// - /// \param ctx RIPEMD-160 context - /// \param data buffer holding one block of data + /// - The additional data consisting of the concatenation of the inputs + /// passed to preceding calls to psa_aead_update_ad(). + /// - The ciphertext consisting of the concatenation of the inputs passed to + /// preceding calls to psa_aead_update(). + /// - The tag passed to this function call. /// - /// \return 0 if successful - pub fn mbedtls_internal_ripemd160_process( - ctx: *mut mbedtls_ripemd160_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = RIPEMD-160( input buffer ) + /// If the authentication tag is correct, this function outputs any remaining + /// plaintext and reports success. If the authentication tag is not correct, + /// this function returns #PSA_ERROR_INVALID_SIGNATURE. /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output RIPEMD-160 checksum result + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual tag and the expected tag is performed + /// in constant time. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[out] plaintext Buffer where the last part of the plaintext + /// is to be written. This is the remaining data + /// from previous calls to psa_aead_update() + /// that could not be processed until the end + /// of the input. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] plaintext_length On success, the number of bytes of + /// returned plaintext. + /// \param[in] tag Buffer containing the authentication tag. + /// \param tag_length Size of the \p tag buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculations were successful, but the authentication tag is + /// not correct. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p plaintext buffer is too small. + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + /// required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active decryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_verify( + operation: *mut psa_aead_operation_t, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + tag: *const u8, + tag_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Abort an AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed - pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha1_context { - pub work_area: [::core::ffi::c_uchar; 208usize], -} -impl Default for mbedtls_sha1_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_aead_operation_t. + /// + /// In particular, calling psa_aead_abort() after the operation has been + /// terminated by a call to psa_aead_abort(), psa_aead_finish() or + /// psa_aead_verify() is safe and has no effect. + /// + /// \param[in,out] operation Initialized AEAD operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-1 context. - /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \brief Sign a message with a private key. For hash-and-sign algorithms, + /// this includes the hashing step. /// - /// \param ctx The SHA-1 context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-1 context. + /// \note To perform a multi-part hash-and-sign signature algorithm, first use + /// a multi-part hash operation and then pass the resulting hash to + /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + /// hash algorithm to use. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in] key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The input message to sign. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param[in] signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. /// - /// \param ctx The SHA-1 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it is - /// not \c NULL, it must point to an initialized - /// SHA-1 context. - pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-1 context. + /// \brief Verify the signature of a message with a public key, using + /// a hash-and-sign verification algorithm. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \note To perform a multi-part hash-and-sign signature verification + /// algorithm, first use a multi-part hash operation to hash the message + /// and then pass the resulting hash to psa_verify_hash(). + /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + /// to use. /// - /// \param dst The SHA-1 context to clone to. This must be initialized. - /// \param src The SHA-1 context to clone from. This must be initialized. - pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); + /// \param[in] key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The message whose signature is to be verified. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed signature + /// is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-1 checksum calculation. + /// \brief Sign a hash or short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context to initialize. This must be initialized. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. + /// \param[out] signature_length On success, the number of bytes + /// that make up the returned signature value. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing SHA-1 - /// checksum calculation. + /// \brief Verify the signature of a hash or short message using a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. + /// \param key Identifier of the key to use for the operation. It + /// must be a public key or an asymmetric key pair. The + /// key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message whose signature is to be + /// verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_update( - ctx: *mut mbedtls_sha1_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// The signature is valid. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the SHA-1 operation, and writes - /// the result to the output buffer. + /// \brief Encrypt a short message with a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized and - /// have a hash operation started. - /// \param output The SHA-1 checksum result. This must be a writable - /// buffer of length \c 20 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the encrypted message is to + /// be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_finish( - ctx: *mut mbedtls_sha1_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief SHA-1 process data block (internal use only). + /// \brief Decrypt a short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. It must + /// allow the usage #PSA_KEY_USAGE_DECRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized. - /// \param data The data block being processed. This must be a - /// readable buffer of length \c 64 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha1_process( - ctx: *mut mbedtls_sha1_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for key derivation operations. +/// +/// Before calling any function on a key derivation operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_key_derivation_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, +/// for example: +/// \code +/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_key_derivation_operation_init() +/// to the structure, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// operation = psa_key_derivation_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_key_derivation_operation_t = psa_key_derivation_s; unsafe extern "C" { - /// \brief This function calculates the SHA-1 checksum of a buffer. + /// Set up a key derivation operation. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// A key derivation algorithm takes some inputs and uses them to generate + /// a byte stream in a deterministic way. + /// This byte stream can be used to produce keys and other + /// cryptographic material. /// - /// The SHA-1 result is calculated as - /// output = SHA-1(input buffer). + /// To derive a key: + /// -# Start with an initialized object of type #psa_key_derivation_operation_t. + /// -# Call psa_key_derivation_setup() to select the algorithm. + /// -# Provide the inputs for the key derivation by calling + /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + /// as appropriate. Which inputs are needed, in what order, and whether + /// they may be keys and if so of what type depends on the algorithm. + /// -# Optionally set the operation's maximum capacity with + /// psa_key_derivation_set_capacity(). You may do this before, in the middle + /// of or after providing inputs. For some algorithms, this step is mandatory + /// because the output depends on the maximum capacity. + /// -# To derive a key, call psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// To derive a byte string for a different purpose, call + /// psa_key_derivation_output_bytes(). + /// Successive calls to these functions use successive output bytes + /// calculated by the key derivation algorithm. + /// -# Clean up the key derivation operation object with + /// psa_key_derivation_abort(). /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// If this function returns an error, the key derivation operation object is + /// not changed. /// - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. - /// \param output The SHA-1 checksum result. - /// This must be a writable buffer of length \c 20 Bytes. + /// If an error occurs at any step after a call to psa_key_derivation_setup(), + /// the operation will need to be reset by a call to psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-1 checkup routine. + /// Implementations must reject an attempt to derive a key of size 0. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in,out] operation The key derivation operation object + /// to set up. It must + /// have been initialized but not set up yet. + /// \param alg The key derivation algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha256_context { - pub work_area: [::core::ffi::c_uchar; 208usize], - pub is224: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha256_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c alg is not a key derivation algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_setup( + operation: *mut psa_key_derivation_operation_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-256 context. + /// Retrieve the current capacity of a key derivation operation. /// - /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. - pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-256 context. + /// The capacity of a key derivation is the maximum number of bytes that it can + /// return. When you get *N* bytes of output from a key derivation operation, + /// this reduces its capacity by *N*. /// - /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which - /// case this function returns immediately. If it is not \c NULL, - /// it must point to an initialized SHA-256 context. - pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clones the state of a SHA-256 context. + /// \param[in] operation The operation to query. + /// \param[out] capacity On success, the capacity of the operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha256_clone( - dst: *mut mbedtls_sha256_context, - src: *const mbedtls_sha256_context, - ); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_get_capacity( + operation: *const psa_key_derivation_operation_t, + capacity: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-224 or SHA-256 checksum - /// calculation. + /// Set the maximum capacity of a key derivation operation. /// - /// \param ctx The context to use. This must be initialized. - /// \param is224 This determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// The capacity of a key derivation operation is the maximum number of bytes + /// that the key derivation operation can return from this point onwards. /// - /// \note is224 must be defined accordingly to the enabled - /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to modify. + /// \param capacity The new capacity of the operation. + /// It must be less or equal to the operation's + /// current capacity. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_starts( - ctx: *mut mbedtls_sha256_context, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p capacity is larger than the operation's current capacity. + /// In this case, the operation object remains valid and its capacity + /// remains unchanged. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_set_capacity( + operation: *mut psa_key_derivation_operation_t, + capacity: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-256 checksum calculation. + /// Provide an input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_update( - ctx: *mut mbedtls_sha256_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-256 operation, and writes - /// the result to the output buffer. + /// This function passes direct inputs, which is usually correct for + /// non-secret inputs. To pass a secret input, which should be in a key + /// object, call psa_key_derivation_input_key() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_finish( - ctx: *mut mbedtls_sha256_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] data Input data to use. + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow direct inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_bytes( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + data: *const u8, + data_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-256 computation. This function is for - /// internal use only. + /// Provide a numeric input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized. - /// \param data The buffer holding one block of data. This must - /// be a readable buffer of length \c 64 Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// However, when an algorithm requires a particular order, numeric inputs + /// usually come first as they tend to be configuration parameters. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha256_process( - ctx: *mut mbedtls_sha256_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// This function is used for inputs which are fixed-size non-negative + /// integers. + /// + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] value The value of the numeric input. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow numeric inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_integer( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + value: u64, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function calculates the SHA-224 or SHA-256 - /// checksum of a buffer. + /// Provide an input for key derivation in the form of a key. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// The SHA-256 result is calculated as - /// output = SHA-256(input buffer). + /// This function obtains input from a key object, which is usually correct for + /// secret inputs or for non-secret personalization strings kept in the key + /// store. To pass a non-secret parameter which is not in the key store, + /// call psa_key_derivation_input_bytes() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. - /// \param is224 Determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param key Identifier of the key. It must have an + /// appropriate type for step and must allow the + /// usage #PSA_KEY_USAGE_DERIVE or + /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + /// and the algorithm used by the operation. + /// + /// \note Once all inputs steps are completed, the operations will allow: + /// - psa_key_derivation_output_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + /// if the input for step + /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_verify_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + /// - psa_key_derivation_verify_key() under the same conditions as + /// psa_key_derivation_verify_bytes(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key allows neither #PSA_KEY_USAGE_DERIVE nor + /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + /// algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow key inputs of the given type + /// or does not allow key inputs at all. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_key( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + key: mbedtls_svc_key_id_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief The SHA-224 checkup routine. + /// Perform a key agreement and use the shared secret as input to a key + /// derivation. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-256 checkup routine. + /// A key agreement algorithm takes two inputs: a private key \p private_key + /// a public key \p peer_key. + /// The result of this function is passed as input to a key derivation. + /// The output of this key derivation can be extracted by reading from the + /// resulting operation to produce keys and other cryptographic material. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha512_context { - pub work_area: [::core::ffi::c_uchar; 304usize], - pub is384: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha512_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief This function initializes a SHA-512 context. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \param ctx The SHA-512 context to initialize. This must - /// not be \c NULL. - pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-512 context. + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() with a + /// key agreement and derivation algorithm + /// \c alg (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + /// is false). + /// The operation must be ready for an + /// input of the type given by \p step. + /// \param step Which step the input data is for. + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. The peer key must be in the + /// same format that psa_import_key() accepts for the + /// public key type corresponding to the type of + /// private_key. That is, this function performs the + /// equivalent of + /// #psa_import_key(..., + /// `peer_key`, `peer_key_length`) where + /// with key attributes indicating the public key + /// type corresponding to the type of `private_key`. + /// For example, for EC keys, this means that peer_key + /// is interpreted as a point on the curve that the + /// private key is on. The standard formats for public + /// keys are documented in the documentation of + /// psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. /// - /// \param ctx The SHA-512 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must point to an initialized - /// SHA-512 context. - pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c private_key is not compatible with \c alg, + /// or \p peer_key is not valid for \c alg or not compatible with + /// \c private_key, or \c step does not allow an input resulting + /// from a key agreement. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this key agreement \p step, + /// or the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_key_agreement( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-512 context. + /// Read some data from a key derivation operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha512_clone( - dst: *mut mbedtls_sha512_context, - src: *const mbedtls_sha512_context, - ); -} -unsafe extern "C" { - /// \brief This function starts a SHA-384 or SHA-512 checksum - /// calculation. + /// This function calculates output bytes from a key derivation algorithm and + /// return those bytes. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the requested number of bytes from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context to use. This must be initialized. - /// \param is384 Determines which function to use. This must be - /// either \c 0 for SHA-512, or \c 1 for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \note is384 must be defined accordingly to the enabled - /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] output Buffer where the output will be written. + /// \param output_length Number of bytes to output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_starts( - ctx: *mut mbedtls_sha512_context, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// no output is written to the output buffer. + /// The operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_bytes( + operation: *mut psa_key_derivation_operation_t, + output: *mut u8, + output_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-512 checksum calculation. + /// Derive a key from an ongoing key derivation operation. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. This must - /// be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// This function calculates output bytes from a key derivation algorithm + /// and uses those bytes to generate a key deterministically. + /// The key's location, usage policy, type and size are taken from + /// \p attributes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_update( - ctx: *mut mbedtls_sha512_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-512 operation, and writes - /// the result to the output buffer. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads as many bytes as required from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_finish( - ctx: *mut mbedtls_sha512_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-512 computation. - /// This function is for internal use only. + /// How much output is produced and consumed from the operation, and how + /// the key is derived, depends on the key type and on the key size + /// (denoted \c bits below): /// - /// \param ctx The SHA-512 context. This must be initialized. - /// \param data The buffer holding one block of data. This - /// must be a readable buffer of length \c 128 Bytes. + /// - For key types for which the key is an arbitrary sequence of bytes + /// of a given size, this function is functionally equivalent to + /// calling #psa_key_derivation_output_bytes + /// and passing the resulting output to #psa_import_key. + /// However, this function has a security benefit: + /// if the implementation provides an isolation boundary then + /// the key material is not exposed outside the isolation boundary. + /// As a consequence, for these key types, this function always consumes + /// exactly (\c bits / 8) bytes from the operation. + /// The following key types defined in this specification follow this scheme: /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha512_process( - ctx: *mut mbedtls_sha512_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function calculates the SHA-512 or SHA-384 - /// checksum of a buffer. + /// - #PSA_KEY_TYPE_AES; + /// - #PSA_KEY_TYPE_ARIA; + /// - #PSA_KEY_TYPE_CAMELLIA; + /// - #PSA_KEY_TYPE_DERIVE; + /// - #PSA_KEY_TYPE_HMAC; + /// - #PSA_KEY_TYPE_PASSWORD_HASH. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// - For ECC keys on a Montgomery elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Montgomery curve), this function always draws a byte string whose + /// length is determined by the curve, and sets the mandatory bits + /// accordingly. That is: /// - /// The SHA-512 result is calculated as - /// output = SHA-512(input buffer). + /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + /// string and process it as specified in RFC 7748 §5. + /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + /// string and process it as specified in RFC 7748 §5. /// - /// \param input The buffer holding the input data. This must be - /// a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. - /// \param is384 Determines which function to use. This must be either - /// \c 0 for SHA-512, or \c 1 for SHA-384. + /// - For key types for which the key is represented by a single sequence of + /// \c bits bits with constraints as to which bit sequences are acceptable, + /// this function draws a byte string of length (\c bits / 8) bytes rounded + /// up to the nearest whole number of bytes. If the resulting byte string + /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + /// This process is repeated until an acceptable byte string is drawn. + /// The byte string drawn from the operation is interpreted as specified + /// for the output produced by psa_export_key(). + /// The following key types defined in this specification follow this scheme: /// - /// \note is384 must be defined accordingly with the supported - /// symbols in the config file. If: - /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or - /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined - /// then the function will return - /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// - #PSA_KEY_TYPE_DES. + /// Force-set the parity bits, but discard forbidden weak keys. + /// For 2-key and 3-key triple-DES, the three keys are generated + /// successively (for example, for 3-key triple-DES, + /// if the first 8 bytes specify a weak key and the next 8 bytes do not, + /// discard the first 8 bytes, use the next 8 bytes as the first key, + /// and continue reading output from the operation to derive the other + /// two keys). + /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + /// where \c group designates any Diffie-Hellman group) and + /// ECC keys on a Weierstrass elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Weierstrass curve). + /// For these key types, interpret the byte string as integer + /// in big-endian order. Discard it if it is not in the range + /// [0, *N* - 2] where *N* is the boundary of the private key domain + /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + /// or the order of the curve's base point for ECC). + /// Add 1 to the resulting integer and use this as the private key *x*. + /// This method allows compliance to NIST standards, specifically + /// the methods titled "key-pair generation by testing candidates" + /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + /// in FIPS 186-4 §B.1.2 for DSA, and + /// in NIST SP 800-56A §5.6.1.2.2 or + /// FIPS 186-4 §B.4.2 for elliptic curve keys. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-384 checkup routine. + /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + /// the way in which the operation output is consumed is + /// implementation-defined. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-512 checkup routine. + /// In all cases, the data that is read is discarded from the operation. + /// The operation's capacity is decreased by the number of bytes read. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hash_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub md5: mbedtls_md5_context, - pub ripemd160: mbedtls_ripemd160_context, - pub sha1: mbedtls_sha1_context, - pub sha256: mbedtls_sha256_context, - pub sha512: mbedtls_sha512_context, -} -impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_hash_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_cipher_operation_t { - pub private_alg: psa_algorithm_t, - pub private_iv_length: u8, - pub private_block_length: u8, - pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_cipher: mbedtls_cipher_context_t, -} -impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_cipher_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_hash_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_hash_operation_t, -} -impl Default for psa_driver_hash_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_cipher_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, -} -impl Default for psa_driver_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_hash_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h. - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. the driver context is not active, in use). - pub private_id: ::core::ffi::c_uint, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_hash_context_t, -} -impl Default for psa_hash_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_cipher_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_default_iv_length: u8, - pub private_ctx: psa_driver_cipher_context_t, + /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + /// the input to that step must be provided with psa_key_derivation_input_key(). + /// Future versions of this specification may include additional restrictions + /// on the derived key based on the attributes and strength of the secret key. + /// + /// \note This function is equivalent to calling + /// psa_key_derivation_output_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for psa_cipher_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// See the description of psa_key_derivation_out_key() for the operation of + /// this function with the default production parameters. + /// Mbed TLS currently does not currently support any non-default production + /// parameters. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_custom( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl psa_cipher_operation_s { - #[inline] - pub fn private_iv_required(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_iv_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_iv_required: ::core::ffi::c_uint, - private_iv_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; - private_iv_required as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; - private_iv_set as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] params Customization parameters for the key derivation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// Mbed TLS currently only supports the default + /// production parameters, i.e. + /// #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + /// for all key types. + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_ext( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hmac_operation_t { - /// The HMAC algorithm in use - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - /// The hash context. - pub hash_ctx: psa_hash_operation_s, - /// The HMAC part of the context. - pub private_opad: [u8; 128usize], +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value in constant time. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the expected number of bytes from the + /// stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to the following code: + /// \code + /// psa_key_derivation_output_bytes(operation, tmp, output_length); + /// if (memcmp(output, tmp, output_length) != 0) + /// return PSA_ERROR_INVALID_SIGNATURE; + /// \endcode + /// except (1) it works even if the key's policy does not allow outputting the + /// bytes, and (2) the comparison will be done in constant time. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected Buffer containing the expected derivation output. + /// \param expected_length Length of the expected output; this is also the + /// number of bytes that will be read. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but it differs from the expected + /// output. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_bytes( + operation: *mut psa_key_derivation_operation_t, + expected: *const u8, + expected_length: usize, + ) -> psa_status_t; } -impl Default for mbedtls_psa_hmac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value + /// stored in a key object. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value, provided as key of type + /// #PSA_KEY_TYPE_PASSWORD_HASH. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the number of bytes corresponding to the + /// length of the expected value from the stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to exporting the key and calling + /// psa_key_derivation_verify_bytes() on the result, except that it + /// works even if the key cannot be exported. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + /// containing the expected output. Its policy must + /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + /// and the permitted algorithm must match the + /// operation. The value of this key was likely + /// computed by a previous call to + /// psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but if differs from the expected + /// output. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// The key passed as the expected value does not exist. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key passed as the expected value has an invalid type. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key passed as the expected value does not allow this usage or + /// this algorithm; or one of the inputs was a key whose policy didn't + /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// the length of the expected value. In this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_key( + operation: *mut psa_key_derivation_operation_t, + expected: psa_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_mac_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// Abort a key derivation operation. + /// + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_key_derivation_setup() again. + /// + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_key_derivation_operation_t. + /// + /// In particular, it is valid to call psa_key_derivation_abort() twice, or to + /// call psa_key_derivation_abort() on an operation that has not been set up. + /// + /// \param[in,out] operation The operation to abort. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) + -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_hmac: mbedtls_psa_hmac_operation_t, - pub private_cmac: mbedtls_cipher_context_t, +unsafe extern "C" { + /// Perform a key agreement and return the raw shared secret. + /// + /// \warning The raw result of a key agreement algorithm such as finite-field + /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + /// not be used directly as key material. It should instead be passed as + /// input to a key derivation algorithm. To chain a key agreement with + /// a key derivation, use psa_key_derivation_key_agreement() and other + /// functions from the key derivation interface. + /// + /// \param alg The key agreement algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + /// is true). + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. It must be + /// in the same format that psa_import_key() + /// accepts. The standard formats for public + /// keys are documented in the documentation + /// of psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a key agreement algorithm, or + /// \p private_key is not compatible with \p alg, + /// or \p peer_key is not valid for \p alg or not compatible with + /// \p private_key. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p output_size is too small + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not a supported key agreement algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_raw_key_agreement( + alg: psa_algorithm_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Generate random bytes. + /// + /// \warning This function **can** fail! Callers MUST check the return status + /// and MUST NOT use the content of the output buffer if the return + /// status is not #PSA_SUCCESS. + /// + /// \note To generate a key, use psa_generate_key() instead. + /// + /// \param[out] output Output buffer for the generated data. + /// \param output_size Number of bytes to generate and output. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair. + /// + /// The key is generated randomly. + /// Its location, usage policy, type and size are taken from \p attributes. + /// + /// Implementations must reject an attempt to generate a key of size 0. + /// + /// The following type-specific considerations apply: + /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + /// the public exponent is 65537. + /// The modulus is a product of two probabilistic primes + /// between 2^{n-1} and 2^n where n is the bit size specified in the + /// attributes. + /// + /// \note This function is equivalent to calling psa_generate_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key( + attributes: *const psa_key_attributes_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// See the description of psa_generate_key() for the operation of this + /// function with the default production parameters. In addition, this function + /// supports the following production customizations, described in more detail + /// in the documentation of ::psa_custom_key_parameters_t: + /// + /// - RSA keys: generation with a custom public exponent. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_custom( + attributes: *const psa_key_attributes_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_aead_operation_t { - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_tag_length: u8, - pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] params Customization parameters for the key generation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_ext( + attributes: *const psa_key_attributes_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub private_ccm: mbedtls_ccm_context, - pub private_gcm: mbedtls_gcm_context, - pub private_chachapoly: mbedtls_chachapoly_context, +/// The type of the state data structure for interruptible hash +/// signing operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = +/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_sign_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// operation = psa_sign_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; +/// The type of the state data structure for interruptible hash +/// verification operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = +/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_verify_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// operation = psa_verify_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; +unsafe extern "C" { + /// \brief Set the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note The time taken to execute a single op is + /// implementation specific and depends on + /// software, hardware, the algorithm, key type and + /// curve chosen. Even within a single operation, + /// successive ops can take differing amounts of + /// time. The only guarantee is that lower values + /// for \p max_ops means functions will block for a + /// lesser maximum amount of time. The functions + /// \c psa_sign_interruptible_get_num_ops() and + /// \c psa_verify_interruptible_get_num_ops() are + /// provided to help with tuning this value. + /// + /// \note This value defaults to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + /// means the whole operation will be done in one + /// go, regardless of the number of ops required. + /// + /// \note If more ops are needed to complete a + /// computation, #PSA_OPERATION_INCOMPLETE will be + /// returned by the function performing the + /// computation. It is then the caller's + /// responsibility to either call again with the + /// same operation context until it returns 0 or an + /// error code; or to call the relevant abort + /// function if the answer is no longer required. + /// + /// \note The interpretation of \p max_ops is also + /// implementation defined. On a hard real time + /// system, this can indicate a hard deadline, as a + /// real-time system needs a guarantee of not + /// spending more than X time, however care must be + /// taken in such an implementation to avoid the + /// situation whereby calls just return, not being + /// able to do any actual work within the allotted + /// time. On a non-real-time system, the + /// implementation can be more relaxed, but again + /// whether this number should be interpreted as as + /// hard or soft limit or even whether a less than + /// or equals as regards to ops executed in a + /// single call is implementation defined. + /// + /// \note For keys in local storage when no accelerator + /// driver applies, please see also the + /// documentation for \c mbedtls_ecp_set_max_ops(), + /// which is the internal implementation in these + /// cases. + /// + /// \warning With implementations that interpret this number + /// as a hard limit, setting this number too small + /// may result in an infinite loop, whereby each + /// call results in immediate return with no ops + /// done (as there is not enough time to execute + /// any), and thus no result will ever be achieved. + /// + /// \note This only applies to functions whose + /// documentation mentions they may return + /// #PSA_OPERATION_INCOMPLETE. + /// + /// \param max_ops The maximum number of ops to be executed in a + /// single call. This can be a number from 0 to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + /// is the least amount of work done per call. + pub fn psa_interruptible_set_max_ops(max_ops: u32); } -impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. This will return the last + /// value set by + /// \c psa_interruptible_set_max_ops() or + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + /// that function has never been called. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \return Maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + pub fn psa_interruptible_get_max_ops() -> u32; } -impl Default for mbedtls_psa_aead_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash signing + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling + /// \c psa_sign_hash_interruptible_abort() on + /// the operation, a value of 0 will be returned. + /// + /// \note This interface is guaranteed re-entrant and + /// thus may be called from driver code. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_sign_hash_get_num_ops( + operation: *const psa_sign_hash_interruptible_operation_t, + ) -> u32; } -impl mbedtls_psa_aead_operation_t { - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash verification + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling \c + /// psa_verify_hash_interruptible_abort() on the + /// operation, a value of 0 will be returned. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c + /// psa_verify_hash_interruptible_operation_t to + /// use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_verify_hash_get_num_ops( + operation: *const psa_verify_hash_interruptible_operation_t, + ) -> u32; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_sign_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Start signing a hash or short message with a + /// private key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_complete() is equivalent to + /// \c psa_sign_hash() but + /// \c psa_sign_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call \c psa_sign_hash_complete() + /// repeatedly on the same context after a + /// successful call to this function until \c + /// psa_sign_hash_complete() either returns 0 or an + /// error. \c psa_sign_hash_complete() will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - call \c psa_sign_hash_complete() + /// with the same context to complete the operation + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + /// not permit the requested algorithm. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation has previously been started on this context, and is + /// still in progress. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_start( + operation: *mut psa_sign_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_verify_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Continue and eventually complete the action of + /// signing a hash or short message with a private + /// key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_start() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_start() is equivalent to + /// \c psa_sign_hash() but this function can return + /// early and resume according to the limit set with + /// \c psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_sign_hash_start() called with it + /// first. + /// + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + /// key_bits, \c alg) where \c key_type and \c + /// key_bits are the type and bit-size + /// respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. + /// + /// \retval #PSA_SUCCESS + /// Operation completed successfully + /// + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \c key. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_sign_hash_start(). + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_sign_hash_start() with this operation object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_sign_hash_complete( + operation: *mut psa_sign_hash_interruptible_operation_t, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } -///< Client -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; -///< Server -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; -/// Roles in the EC J-PAKE exchange -pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; -/// EC J-PAKE context structure. -/// -/// J-PAKE is a symmetric protocol, except for the identifiers used in -/// Zero-Knowledge Proofs, and the serialization of the second message -/// (KeyExchange) as defined by the Thread spec. -/// -/// In order to benefit from this symmetry, we choose a different naming -/// convention from the Thread v1.0 spec. Correspondence is indicated in the -/// description as a pair C: client name, S: server name -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecjpake_context { - ///< Hash to use - pub private_md_type: mbedtls_md_type_t, - ///< Elliptic curve - pub private_grp: mbedtls_ecp_group, - ///< Are we client or server? - pub private_role: mbedtls_ecjpake_role, - ///< Format for point export - pub private_point_format: ::core::ffi::c_int, - ///< My public key 1 C: X1, S: X3 - pub private_Xm1: mbedtls_ecp_point, - ///< My public key 2 C: X2, S: X4 - pub private_Xm2: mbedtls_ecp_point, - ///< Peer public key 1 C: X3, S: X1 - pub private_Xp1: mbedtls_ecp_point, - ///< Peer public key 2 C: X4, S: X2 - pub private_Xp2: mbedtls_ecp_point, - ///< Peer public key C: Xs, S: Xc - pub private_Xp: mbedtls_ecp_point, - ///< My private key 1 C: x1, S: x3 - pub private_xm1: mbedtls_mpi, - ///< My private key 2 C: x2, S: x4 - pub private_xm2: mbedtls_mpi, - ///< Pre-shared secret (passphrase) - pub private_s: mbedtls_mpi, +unsafe extern "C" { + /// \brief Abort a sign hash operation. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function is the only function that clears + /// the number of ops completed as part of the + /// operation. Please ensure you copy this value via + /// \c psa_sign_hash_get_num_ops() if required + /// before calling. + /// + /// \note Aborting an operation frees all associated + /// resources except for the \p operation structure + /// itself. Once aborted, the operation object can + /// be reused for another operation by calling \c + /// psa_sign_hash_start() again. + /// + /// \note You may call this function any time after the + /// operation object has been initialized. In + /// particular, calling \c psa_sign_hash_abort() + /// after the operation has already been terminated + /// by a call to \c psa_sign_hash_abort() or + /// psa_sign_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized sign hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_abort( + operation: *mut psa_sign_hash_interruptible_operation_t, + ) -> psa_status_t; } -impl Default for mbedtls_ecjpake_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Start reading and verifying a hash or short + /// message, in an interruptible manner. + /// + /// \see \c psa_verify_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_verify_hash_complete() is equivalent to + /// \c psa_verify_hash() but \c + /// psa_verify_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function. + /// + /// \note Users should call \c psa_verify_hash_complete() + /// repeatedly on the same operation object after a + /// successful call to this function until \c + /// psa_verify_hash_complete() either returns 0 or + /// an error. \c psa_verify_hash_complete() will + /// return #PSA_OPERATION_INCOMPLETE if there is + /// more work to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_verify_hash_abort(). + /// + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash whose signature is to be verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - please call \c + /// psa_verify_hash_complete() with the same context to complete the + /// operation. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// Another operation has already been started on this context, and is + /// still in progress. + /// + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + /// not permit the requested algorithm. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_start( + operation: *mut psa_verify_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize an ECJPAKE context. + /// \brief Continue and eventually complete the action of + /// reading and verifying a hash or short message + /// signed with a private key, in an interruptible + /// manner. /// - /// \param ctx The ECJPAKE context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); -} -unsafe extern "C" { - /// \brief Set up an ECJPAKE context for use. + /// \see \c psa_verify_hash_start() /// - /// \note Currently the only values for hash/curve allowed by the - /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. /// - /// \param ctx The ECJPAKE context to set up. This must be initialized. - /// \param role The role of the caller. This must be either - /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. - /// \param hash The identifier of the hash function to use, - /// for example #MBEDTLS_MD_SHA256. - /// \param curve The identifier of the elliptic curve to use, - /// for example #MBEDTLS_ECP_DP_SECP256R1. - /// \param secret The pre-shared secret (passphrase). This must be - /// a readable not empty buffer of length \p len Bytes. It need - /// only be valid for the duration of this call. - /// \param len The length of the pre-shared secret \p secret. + /// \note This function combined with \c + /// psa_verify_hash_start() is equivalent to + /// \c psa_verify_hash() but this function can + /// return early and resume according to the limit + /// set with \c psa_interruptible_set_max_ops() to + /// reduce the maximum time spent in a function + /// call. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_setup( - ctx: *mut mbedtls_ecjpake_context, - role: mbedtls_ecjpake_role, - hash: mbedtls_md_type_t, - curve: mbedtls_ecp_group_id, - secret: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the point format for future reads and writes. + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. /// - /// \param ctx The ECJPAKE context to configure. - /// \param point_format The point format to use: - /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) - /// or #MBEDTLS_ECP_PF_COMPRESSED. + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_verify_hash_abort(). /// - /// \return \c 0 if successful. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format - /// is invalid. - pub fn mbedtls_ecjpake_set_point_format( - ctx: *mut mbedtls_ecjpake_context, - point_format: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if an ECJPAKE context is ready for use. + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_verify_hash_start() called with it + /// first. /// - /// \param ctx The ECJPAKE context to check. This must be - /// initialized. + /// \retval #PSA_SUCCESS + /// Operation completed successfully, and the passed signature is valid. /// - /// \return \c 0 if the context is ready for use. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. - pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_verify_hash_start(). + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_verify_hash_start() on this object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_verify_hash_complete( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate and write the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \brief Abort a verify hash operation. /// - /// \param ctx The ECJPAKE context to use. This must be - /// initialized and set up. - /// \param buf The buffer to write the contents to. This must be a - /// writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number - /// of Bytes written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \warning This is a beta API, and thus subject to change at + /// any point. It is not bound by the usual interface + /// stability promises. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Read and process the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \note This function is the only function that clears the + /// number of ops completed as part of the operation. + /// Please ensure you copy this value via + /// \c psa_verify_hash_get_num_ops() if required + /// before calling. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up. - /// \param buf The buffer holding the first round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// \note Aborting an operation frees all associated + /// resources except for the operation structure + /// itself. Once aborted, the operation object can be + /// reused for another operation by calling \c + /// psa_verify_hash_start() again. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \note You may call this function any time after the + /// operation object has been initialized. + /// In particular, calling \c psa_verify_hash_abort() + /// after the operation has already been terminated by + /// a call to \c psa_verify_hash_abort() or + /// psa_verify_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized verify hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_abort( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } +pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// \brief Generate and write the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Open a handle to an existing persistent key. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up, and already have performed round one. - /// \param buf The buffer to write the round two contents to. - /// This must be a writable buffer of length \p len Bytes. - /// \param len The size of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Open a handle to a persistent key. A key is persistent if it was created + /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + /// always has a nonzero key identifier, set with psa_set_key_id() when + /// creating the key. Implementations may provide additional pre-provisioned + /// keys that can be opened with psa_open_key(). Such keys have an application + /// key identifier in the vendor range, as documented in the description of + /// #psa_key_id_t. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// The application must eventually close the handle with psa_close_key() or + /// psa_destroy_key() to release associated resources. If the application dies + /// without calling one of these functions, the implementation should perform + /// the equivalent of a call to psa_close_key(). + /// + /// Some implementations permit an application to open the same key multiple + /// times. If this is successful, each call to psa_open_key() will return a + /// different key handle. + /// + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. + /// + /// \note Applications that rely on opening a key multiple times will not be + /// portable to implementations that only permit a single key handle to be + /// opened. See also :ref:\`key-handles\`. + /// + /// + /// \param key The persistent identifier of the key. + /// \param[out] handle On success, a handle to the key. + /// + /// \retval #PSA_SUCCESS + /// Success. The application can now use the value of `*handle` + /// to access the key. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY + /// The implementation does not have sufficient resources to open the + /// key. This can be due to reaching an implementation limit on the + /// number of open keys, the number of open key handles, or available + /// memory. + /// \retval #PSA_ERROR_DOES_NOT_EXIST + /// There is no persistent key with key identifier \p key. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid persistent key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The specified key exists, but the application does not have the + /// permission to access it. Note that this specification does not + /// define any way to create such a key, but it may be possible + /// through implementation-specific means. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Read and process the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Close a key handle. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up and already have performed round one. - /// \param buf The buffer holding the second round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// If the handle designates a volatile key, this will destroy the key material + /// and free all associated resources, just like psa_destroy_key(). /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Derive the shared secret - /// (TLS: Pre-Master Secret). + /// If this is the last open handle to a persistent key, then closing the handle + /// will free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and can be opened again later + /// with a call to psa_open_key(). /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Closing the key handle makes the handle invalid, and the key handle + /// must not be used again by the application. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_derive_secret( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write the shared key material to be passed to a Key - /// Derivation Function as described in RFC8236. + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \note If the key handle was used to set up an active + /// :ref:\`multipart operation \`, then closing the + /// key handle can cause the multipart operation to fail. Applications should + /// maintain the key handle until after the multipart operation has finished. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_shared_key( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This clears an ECJPAKE context and frees any - /// embedded data structure. + /// \param handle The key handle to close. + /// If this is \c 0, do nothing and return \c PSA_SUCCESS. /// - /// \param ctx The ECJPAKE context to free. This may be \c NULL, - /// in which case this function does nothing. If it is not - /// \c NULL, it must point to an initialized ECJPAKE context. - pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); + /// \retval #PSA_SUCCESS + /// \p handle was a valid handle or \c 0. It is now closed. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p handle is not a valid handle nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// \brief Library deinitialization. /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_pake_operation_t { - pub private_alg: psa_algorithm_t, - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: u8, - pub private_buffer: [u8; 336usize], - pub private_buffer_length: usize, - pub private_buffer_offset: usize, - pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_jpake: mbedtls_ecjpake_context, -} -impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_pake_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_mac_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_mac_operation_t, -} -impl Default for psa_driver_mac_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_aead_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_aead_operation_t, -} -impl Default for psa_driver_aead_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_sign_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, -} -impl Default for psa_driver_sign_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_verify_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, -} -impl Default for psa_driver_verify_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_pake_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_pake_operation_t, -} -impl Default for psa_driver_pake_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// This function clears all data associated with the PSA layer, + /// including the whole key store. + /// This function is not thread safe, it wipes every key slot regardless of + /// state and reader count. It should only be called when no slot is in use. + /// + /// This is an Mbed TLS extension. + pub fn mbedtls_psa_crypto_free(); } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. #[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_mac_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_mac_size: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_mac_context_t, +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_stats_s { + /// Number of slots containing key material for a volatile key. + pub private_volatile_slots: usize, + /// Number of slots containing key material for a key which is in + /// internal persistent storage. + pub private_persistent_slots: usize, + /// Number of slots containing a reference to a key in a + /// secure element. + pub private_external_slots: usize, + /// Number of slots which are occupied, but do not contain + /// key material yet. + pub private_half_filled_slots: usize, + /// Number of slots that contain cache data. + pub private_cache_slots: usize, + /// Number of slots that are not used for anything. + pub private_empty_slots: usize, + /// Number of slots that are locked. + pub private_locked_slots: usize, + /// Largest key id value among open keys in internal persistent storage. + pub private_max_open_internal_key_id: psa_key_id_t, + /// Largest key id value among open keys in secure elements. + pub private_max_open_external_key_id: psa_key_id_t, } -impl Default for psa_mac_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. +pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; +unsafe extern "C" { + /// \brief Get statistics about + /// resource consumption related to the PSA keystore. + /// + /// \note When Mbed TLS is built as part of a service, with isolation + /// between the application and the keystore, the service may or + /// may not expose this function. + pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); } -impl psa_mac_operation_s { - #[inline] - pub fn private_is_sign(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_sign: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; - private_is_sign as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Inject an initial entropy seed for the random generator into + /// secure storage. + /// + /// This function injects data to be used as a seed for the random generator + /// used by the PSA Crypto implementation. On devices that lack a trusted + /// entropy source (preferably a hardware random number generator), + /// the Mbed PSA Crypto implementation uses this value to seed its + /// random generator. + /// + /// On devices without a trusted entropy source, this function must be + /// called exactly once in the lifetime of the device. On devices with + /// a trusted entropy source, calling this function is optional. + /// In all cases, this function may only be called before calling any + /// other function in the PSA Crypto API, including psa_crypto_init(). + /// + /// When this function returns successfully, it populates a file in + /// persistent storage. Once the file has been created, this function + /// can no longer succeed. + /// + /// If any error occurs, this function does not change the system state. + /// You can call this function again after correcting the reason for the + /// error if possible. + /// + /// \warning This function **can** fail! Callers MUST check the return status. + /// + /// \warning If you use this function, you should use it as part of a + /// factory provisioning process. The value of the injected seed + /// is critical to the security of the device. It must be + /// *secret*, *unpredictable* and (statistically) *unique per device*. + /// You should be generate it randomly using a cryptographically + /// secure random generator seeded from trusted entropy sources. + /// You should transmit it securely to the device and ensure + /// that its value is not leaked or stored anywhere beyond the + /// needs of transmitting it from the point of generation to + /// the call of this function, and erase all copies of the value + /// once this function returns. + /// + /// This is an Mbed TLS extension. + /// + /// \note This function is only available on the following platforms: + /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + /// Note that you must provide compatible implementations of + /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. + /// * In a client-server integration of PSA Cryptography, on the client side, + /// if the server supports this feature. + /// \param[in] seed Buffer containing the seed value to inject. + /// \param[in] seed_size Size of the \p seed buffer. + /// The size of the seed in bytes must be greater + /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + /// in `library/entropy_poll.h` in the Mbed TLS source + /// code. + /// It must be less or equal to + /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + /// + /// \retval #PSA_SUCCESS + /// The seed value was injected successfully. The random generator + /// of the PSA Crypto implementation is now ready for use. + /// You may now call psa_crypto_init() and use the PSA Crypto + /// implementation. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p seed_size is out of range. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// There was a failure reading or writing from storage. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The library has already been initialized. It is no longer + /// possible to call this function. + pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_aead_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub private_ad_remaining: usize, - pub private_body_remaining: usize, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_ctx: psa_driver_aead_context_t, +unsafe extern "C" { + /// External random generator function, implemented by the platform. + /// + /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + /// this function replaces Mbed TLS's entropy and DRBG modules for all + /// random generation triggered via PSA crypto interfaces. + /// + /// \note This random generator must deliver random numbers with cryptographic + /// quality and high performance. It must supply unpredictable numbers + /// with a uniform distribution. The implementation of this function + /// is responsible for ensuring that the random generator is seeded + /// with sufficient entropy. If you have a hardware TRNG which is slow + /// or delivers non-uniform output, declare it as an entropy source + /// with mbedtls_entropy_add_source() instead of enabling this option. + /// + /// \param[in,out] context Pointer to the random generator context. + /// This is all-bits-zero on the first call + /// and preserved between successive calls. + /// \param[out] output Output buffer. On success, this buffer + /// contains random data with a uniform + /// distribution. + /// \param output_size The size of the \p output buffer in bytes. + /// \param[out] output_length On success, set this value to \p output_size. + /// + /// \retval #PSA_SUCCESS + /// Success. The output buffer contains \p output_size bytes of + /// cryptographic-quality random data, and \c *output_length is + /// set to \p output_size. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + /// The random generator requires extra entropy and there is no + /// way to obtain entropy under current environment conditions. + /// This error should not happen under normal circumstances since + /// this function is responsible for obtaining as much entropy as + /// it needs. However implementations of this function may return + /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + /// entropy without blocking indefinitely. + /// \retval #PSA_ERROR_HARDWARE_FAILURE + /// A failure of the random generator hardware that isn't covered + /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. + pub fn mbedtls_psa_external_get_random( + context: *mut mbedtls_psa_external_random_context_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_aead_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// A slot number identifying a key in a driver. +/// +/// Values of this type are used to identify built-in keys. +pub type psa_drv_slot_number_t = u64; +unsafe extern "C" { + /// Check if PSA is capable of handling the specified hash algorithm. + /// + /// This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + /// set and that psa_crypto_init has already been called. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the algorithm. + /// This might be improved in the future. + /// + /// \param hash_alg The hash algorithm. + /// + /// \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + pub fn psa_can_do_hash(hash_alg: psa_algorithm_t) -> ::core::ffi::c_int; } -impl psa_aead_operation_s { - #[inline] - pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_ad_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_body_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(3usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 3usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 3usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(4usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 4usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 4usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_nonce_set: ::core::ffi::c_uint, - private_lengths_set: ::core::ffi::c_uint, - private_ad_started: ::core::ffi::c_uint, - private_body_started: ::core::ffi::c_uint, - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; - private_nonce_set as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; - private_lengths_set as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; - private_ad_started as u64 - }); - __bindgen_bitfield_unit.set(3usize, 1u8, { - let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; - private_body_started as u64 - }); - __bindgen_bitfield_unit.set(4usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Tell if PSA is ready for this cipher. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the key type and algorithm. + /// This might be improved in the future. + /// + /// \param key_type The key type. + /// \param cipher_alg The cipher algorithm. + /// + /// \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + pub fn psa_can_do_cipher( + key_type: psa_key_type_t, + cipher_alg: psa_algorithm_t, + ) -> ::core::ffi::c_int; +} +/// \brief Encoding of the application role of PAKE +/// +/// Encodes the application's role in the algorithm is being executed. For more +/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX +/// constants. +pub type psa_pake_role_t = u8; +/// Encoding of input and output indicators for PAKE. +/// +/// Some PAKE algorithms need to exchange more data than just a single key share. +/// This type is for encoding additional input and output data for such +/// algorithms. +pub type psa_pake_step_t = u8; +/// Encoding of the type of the PAKE's primitive. +/// +/// Values defined by this standard will never be in the range 0x80-0xff. +/// Vendors who define additional types must use an encoding in this range. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_primitive_type_t = u8; +/// \brief Encoding of the family of the primitive associated with the PAKE. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_family_t = u8; +/// \brief Encoding of the primitive associated with the PAKE. +/// +/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. +pub type psa_pake_primitive_t = u32; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_pake_cipher_suite_s { + pub algorithm: psa_algorithm_t, + pub type_: psa_pake_primitive_type_t, + pub family: psa_pake_family_t, + pub bits: u16, + pub hash: psa_algorithm_t, } #[repr(C)] -#[repr(align(16))] #[derive(Copy, Clone)] -pub struct psa_hkdf_key_derivation_t { - pub private_info: *mut u8, - pub private_info_length: usize, - pub private_offset_in_block: u8, - pub private_block_number: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_output_block: [u8; 64usize], - pub private_prk: [u8; 64usize], - pub __bindgen_padding_0: [u64; 0usize], - pub private_hmac: psa_mac_operation_s, +pub struct psa_crypto_driver_pake_inputs_s { + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_user: *mut u8, + pub private_user_len: usize, + pub private_peer: *mut u8, + pub private_peer_len: usize, + pub private_attributes: psa_key_attributes_t, + pub private_cipher_suite: psa_pake_cipher_suite_s, } -impl Default for psa_hkdf_key_derivation_t { +impl Default for psa_crypto_driver_pake_inputs_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17057,126 +18119,97 @@ impl Default for psa_hkdf_key_derivation_t { } } } -impl psa_hkdf_key_derivation_t { - #[inline] - pub fn private_state(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } - } - #[inline] - pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 2u8, val as u64) - } - } - #[inline] - pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 2u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 2u8, - val as u64, - ) - } - } - #[inline] - pub fn private_info_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { +pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = + 10; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = + 11; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; +pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; +pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; +pub const psa_jpake_round_PSA_JPAKE_FIRST: psa_jpake_round = 0; +pub const psa_jpake_round_PSA_JPAKE_SECOND: psa_jpake_round = 1; +pub const psa_jpake_round_PSA_JPAKE_FINISHED: psa_jpake_round = 2; +pub type psa_jpake_round = ::core::ffi::c_uint; +pub use self::psa_jpake_round as psa_jpake_round_t; +pub const psa_jpake_io_mode_PSA_JPAKE_INPUT: psa_jpake_io_mode = 0; +pub const psa_jpake_io_mode_PSA_JPAKE_OUTPUT: psa_jpake_io_mode = 1; +pub type psa_jpake_io_mode = ::core::ffi::c_uint; +pub use self::psa_jpake_io_mode as psa_jpake_io_mode_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_jpake_computation_stage_s { + pub private_round: psa_jpake_round_t, + pub private_io_mode: psa_jpake_io_mode_t, + pub private_inputs: u8, + pub private_outputs: u8, + pub private_step: psa_pake_step_t, +} +impl Default for psa_jpake_computation_stage_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_pake_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_primitive: psa_pake_primitive_t, + pub private_stage: u8, + pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, + pub private_data: psa_pake_operation_s__bindgen_ty_2, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_pake_operation_s__bindgen_ty_1 { + pub private_dummy: u8, + pub private_jpake: psa_jpake_computation_stage_s, +} +impl Default for psa_pake_operation_s__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub fn new_bitfield_1( - private_state: ::core::ffi::c_uint, - private_info_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 2u8, { - let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; - private_state as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; - private_info_set as u64 - }); - __bindgen_bitfield_unit - } -} -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_tls12_ecjpake_to_pms_t { - pub private_data: [u8; 32usize], } -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: - psa_tls12_prf_key_derivation_state_t = 0; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: - psa_tls12_prf_key_derivation_state_t = 1; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 2; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 3; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: - psa_tls12_prf_key_derivation_state_t = 4; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: - psa_tls12_prf_key_derivation_state_t = 5; -pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct psa_tls12_prf_key_derivation_s { - pub private_left_in_block: u8, - pub private_block_number: u8, - pub private_state: psa_tls12_prf_key_derivation_state_t, - pub private_secret: *mut u8, - pub private_secret_length: usize, - pub private_seed: *mut u8, - pub private_seed_length: usize, - pub private_label: *mut u8, - pub private_label_length: usize, - pub private_other_secret: *mut u8, - pub private_other_secret_length: usize, - pub private_Ai: [u8; 64usize], - pub private_output_block: [u8; 64usize], +pub union psa_pake_operation_s__bindgen_ty_2 { + pub private_ctx: psa_driver_pake_context_t, + pub private_inputs: psa_crypto_driver_pake_inputs_s, } -impl Default for psa_tls12_prf_key_derivation_s { +impl Default for psa_pake_operation_s__bindgen_ty_2 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for psa_pake_operation_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17185,1462 +18218,1629 @@ impl Default for psa_tls12_prf_key_derivation_s { } } } -pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_key_derivation_s { - pub private_alg: psa_algorithm_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_capacity: usize, - pub __bindgen_padding_0: [u64; 0usize], - pub private_ctx: psa_key_derivation_s__bindgen_ty_1, +/// The type of the data structure for PAKE cipher suites. +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; +/// The type of the state data structure for PAKE operations. +/// +/// Before calling any function on a PAKE operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_pake_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_pake_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, +/// for example: +/// \code +/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_pake_operation_init() +/// to the structure, for example: +/// \code +/// psa_pake_operation_t operation; +/// operation = psa_pake_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_operation_t = psa_pake_operation_s; +/// The type of input values for PAKE operations. +pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; +/// The type of computation stage for J-PAKE operations. +pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; +unsafe extern "C" { + /// Get the length of the password in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] password_len Password length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + password_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the password from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] buffer Return buffer for password. + /// \param buffer_size Size of the return buffer in bytes. + /// \param[out] buffer_length Actual size of the password in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password( + inputs: *const psa_crypto_driver_pake_inputs_t, + buffer: *mut u8, + buffer_size: usize, + buffer_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the user id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_len User id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_user_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the peer id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_len Peer id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_peer_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_len: *mut usize, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_key_derivation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_hkdf: psa_hkdf_key_derivation_t, - pub private_tls12_prf: psa_tls12_prf_key_derivation_t, - pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +unsafe extern "C" { + /// Get the user id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_id User id. + /// \param user_id_size Size of \p user_id in bytes. + /// \param[out] user_id_len Size of the user id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p user_id is too small. + pub fn psa_crypto_driver_pake_get_user( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_id: *mut u8, + user_id_size: usize, + user_id_len: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the peer id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_id Peer id. + /// \param peer_id_size Size of \p peer_id in bytes. + /// \param[out] peer_id_length Size of the peer id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p peer_id is too small. + pub fn psa_crypto_driver_pake_get_peer( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_id: *mut u8, + peer_id_size: usize, + peer_id_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the cipher suite from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] cipher_suite Return buffer for role. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Cipher_suite hasn't been set yet. + pub fn psa_crypto_driver_pake_get_cipher_suite( + inputs: *const psa_crypto_driver_pake_inputs_t, + cipher_suite: *mut psa_pake_cipher_suite_t, + ) -> psa_status_t; } -impl psa_key_derivation_s { - #[inline] - pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_can_output_key: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_can_output_key: u32 = - unsafe { ::core::mem::transmute(private_can_output_key) }; - private_can_output_key as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Set the session information for a password-authenticated key exchange. + /// + /// The sequence of operations to set up a password-authenticated key exchange + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_pake_operation_t, e.g. + /// #PSA_PAKE_OPERATION_INIT. + /// -# Call psa_pake_setup() to specify the cipher suite. + /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the + /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + /// to be called depends on the algorithm in use. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// A typical sequence of calls to perform a password-authenticated key + /// exchange: + /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + /// key share that needs to be sent to the peer. + /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + /// the key share that was received from the peer. + /// -# Depending on the algorithm additional calls to psa_pake_output() and + /// psa_pake_input() might be necessary. + /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// If an error occurs at any step after a call to psa_pake_setup(), + /// the operation will need to be reset by a call to psa_pake_abort(). The + /// application may call psa_pake_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_pake_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A call to psa_pake_abort(). + /// - A successful call to psa_pake_get_implicit_key(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized but not set up yet. + /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + /// characterizes a PAKE algorithm and determines + /// the algorithm as well.) + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the + /// PAKE primitive in \p cipher_suite is not compatible with the + /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + /// or not compatible with the PAKE algorithm and primitive. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, + /// or the PAKE primitive in \p cipher_suite is not supported or not + /// compatible with the PAKE algorithm, or the hash algorithm in + /// \p cipher_suite is not supported or not compatible with the PAKE + /// algorithm and primitive. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_setup( + operation: *mut psa_pake_operation_t, + cipher_suite: *const psa_pake_cipher_suite_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_key_policy_s { - pub private_usage: psa_key_usage_t, - pub private_alg: psa_algorithm_t, - pub private_alg2: psa_algorithm_t, +unsafe extern "C" { + /// Set the password for a password-authenticated key exchange from key ID. + /// + /// Call this function when the password, or a value derived from the password, + /// is already present in the key store. + /// + /// \param[in,out] operation The operation object to set the password for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the password hasn't + /// been set yet (psa_pake_set_password_key() + /// hasn't been called yet). + /// \param password Identifier of the key holding the password or a + /// value derived from the password (eg. by a + /// memory-hard function). It must remain valid + /// until the operation terminates. It must be of + /// type #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + /// the usage #PSA_KEY_USAGE_DERIVE. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p password is not a valid key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + /// permit the \p operation's algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + /// the \p operation's cipher suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size of \p password is not supported with the + /// \p operation's cipher suite. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must have been set up.), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_password_key( + operation: *mut psa_pake_operation_t, + password: mbedtls_svc_key_id_t, + ) -> psa_status_t; } -pub type psa_key_policy_t = psa_key_policy_s; -pub type psa_key_bits_t = u16; -/// A mask of flags that can be stored in key attributes. -/// -/// This type is also used internally to store flags in slots. Internal -/// flags are defined in library/psa_crypto_core.h. Internal flags may have -/// the same value as external flags if they are properly handled during -/// key creation and in psa_get_key_attributes. -pub type psa_key_attributes_flag_t = u16; -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_core_key_attributes_t { - pub private_type: psa_key_type_t, - pub private_bits: psa_key_bits_t, - pub private_lifetime: psa_key_lifetime_t, - pub private_id: mbedtls_svc_key_id_t, - pub private_policy: psa_key_policy_t, - pub private_flags: psa_key_attributes_flag_t, +unsafe extern "C" { + /// Set the user ID for a password-authenticated key exchange. + /// + /// Call this function to set the user ID. For PAKE algorithms that associate a + /// user identifier with each side of the session you need to call + /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single + /// user identifier with the session, call psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the user ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the user ID hasn't + /// been set (psa_pake_set_user() hasn't been + /// called yet). + /// \param[in] user_id The user ID to authenticate with. + /// \param user_id_len Size of the \p user_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p user_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The value of \p user_id is not supported by the implementation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_user( + operation: *mut psa_pake_operation_t, + user_id: *const u8, + user_id_len: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_key_attributes_s { - pub private_core: psa_core_key_attributes_t, - pub private_domain_parameters: *mut ::core::ffi::c_void, - pub private_domain_parameters_size: usize, +unsafe extern "C" { + /// Set the peer ID for a password-authenticated key exchange. + /// + /// Call this function in addition to psa_pake_set_user() for PAKE algorithms + /// that associate a user identifier with each side of the session. For PAKE + /// algorithms that associate a single user identifier with the session, call + /// psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the peer ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the peer ID hasn't + /// been set (psa_pake_set_peer() hasn't been + /// called yet). + /// \param[in] peer_id The peer's ID to authenticate. + /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p peer_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm doesn't associate a second identity with the session. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// Calling psa_pake_set_peer() is invalid with the \p operation's + /// algorithm, the operation state is not valid, or the library has not + /// been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_peer( + operation: *mut psa_pake_operation_t, + peer_id: *const u8, + peer_id_len: usize, + ) -> psa_status_t; } -impl Default for psa_key_attributes_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Set the application role for a password-authenticated key exchange. + /// + /// Not all PAKE algorithms need to differentiate the communicating entities. + /// It is optional to call this function for PAKEs that don't require a role + /// to be specified. For such PAKEs the application role parameter is ignored, + /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \param[in,out] operation The operation object to specify the + /// application's role for. It must have been set up + /// by psa_pake_setup() and not yet in use (neither + /// psa_pake_output() nor psa_pake_input() has been + /// called yet). It must be on operation for which + /// the application's role hasn't been specified + /// (psa_pake_set_role() hasn't been called yet). + /// \param role A value of type ::psa_pake_role_t indicating the + /// application's role in the PAKE the algorithm + /// that is being set up. For more information see + /// the documentation of \c PSA_PAKE_ROLE_XXX + /// constants. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The \p role is not a valid PAKE role in the \p operation’s algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The \p role for this algorithm is not supported or is not valid. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_role( + operation: *mut psa_pake_operation_t, + role: psa_pake_role_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Set domain parameters for a key. + /// Get output for a step of a password-authenticated key exchange. /// - /// Some key types require additional domain parameters in addition to - /// the key type identifier and the key size. Use this function instead - /// of psa_set_key_type() when you need to specify domain parameters. + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. /// - /// The format for the required domain parameters varies based on the key type. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the domain parameter data consists of the public exponent, - /// represented as a big-endian integer with no leading zeros. - /// This information is used when generating an RSA key pair. - /// When importing a key, the public exponent is read from the imported - /// key data and the exponent recorded in the attribute structure is ignored. - /// As an exception, the public exponent 65537 is represented by an empty - /// byte string. - /// - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR), - /// the `Dss-Params` format as defined by RFC 3279 §2.3.2. - /// ``` - /// Dss-Params ::= SEQUENCE { - /// p INTEGER, - /// q INTEGER, - /// g INTEGER - /// } - /// ``` - /// - For Diffie-Hellman key exchange keys - /// (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or - /// #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the - /// `DomainParameters` format as defined by RFC 3279 §2.3.3. - /// ``` - /// DomainParameters ::= SEQUENCE { - /// p INTEGER, -- odd prime, p=jq +1 - /// g INTEGER, -- generator, g - /// q INTEGER, -- factor of p-1 - /// j INTEGER OPTIONAL, -- subgroup factor - /// validationParams ValidationParams OPTIONAL - /// } - /// ValidationParams ::= SEQUENCE { - /// seed BIT STRING, - /// pgenCounter INTEGER - /// } - /// ``` + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step of the algorithm for which the output is + /// requested. + /// \param[out] output Buffer where the output is to be written in the + /// format appropriate for this \p step. Refer to + /// the documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param output_size Size of the \p output buffer in bytes. This must + /// be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + /// primitive, \p output_step) where \c alg and + /// \p primitive are the PAKE algorithm and primitive + /// in the operation's cipher suite, and \p step is + /// the output step. + /// + /// \param[out] output_length On success, the number of bytes of the returned + /// output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p step is not compatible with the operation's algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step is not supported with the operation's algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_output( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Provide input for a step of a password-authenticated key exchange. + /// + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. + /// + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \param[in,out] attributes Attribute structure where the specified domain - /// parameters will be stored. - /// If this function fails, the content of - /// \p attributes is not modified. - /// \param type Key type (a \c PSA_KEY_TYPE_XXX value). - /// \param[in] data Buffer containing the key domain parameters. - /// The content of this buffer is interpreted - /// according to \p type as described above. - /// \param data_length Size of the \p data buffer in bytes. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step for which the input is provided. + /// \param[in] input Buffer containing the input in the format + /// appropriate for this \p step. Refer to the + /// documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p input_length is not compatible with the \p operation’s algorithm, + /// or the \p input is not valid for the \p operation's algorithm, + /// cipher suite or \p step. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step p is not supported with the \p operation's algorithm, or the + /// \p input is not supported for the \p operation's algorithm, cipher + /// suite or \p step. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - pub fn psa_set_key_domain_parameters( - attributes: *mut psa_key_attributes_t, - type_: psa_key_type_t, - data: *const u8, - data_length: usize, + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_input( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + input: *const u8, + input_length: usize, ) -> psa_status_t; } -/// \brief The context for PSA interruptible hash signing. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_sign_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_sign_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_sign_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_sign_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -/// \brief The context for PSA interruptible hash verification. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_verify_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_verify_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_verify_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_verify_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// Open a handle to an existing persistent key. - /// - /// Open a handle to a persistent key. A key is persistent if it was created - /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key - /// always has a nonzero key identifier, set with psa_set_key_id() when - /// creating the key. Implementations may provide additional pre-provisioned - /// keys that can be opened with psa_open_key(). Such keys have an application - /// key identifier in the vendor range, as documented in the description of - /// #psa_key_id_t. + /// Get implicitly confirmed shared secret from a PAKE. /// - /// The application must eventually close the handle with psa_close_key() or - /// psa_destroy_key() to release associated resources. If the application dies - /// without calling one of these functions, the implementation should perform - /// the equivalent of a call to psa_close_key(). + /// At this point there is a cryptographic guarantee that only the authenticated + /// party who used the same password is able to compute the key. But there is no + /// guarantee that the peer is the party it claims to be and was able to do so. /// - /// Some implementations permit an application to open the same key multiple - /// times. If this is successful, each call to psa_open_key() will return a - /// different key handle. + /// That is, the authentication is only implicit. Since the peer is not + /// authenticated yet, no action should be taken yet that assumes that the peer + /// is who it claims to be. For example, do not access restricted files on the + /// peer's behalf until an explicit authentication has succeeded. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function can be called after the key exchange phase of the operation + /// has completed. It imports the shared secret output of the PAKE into the + /// provided derivation operation. The input step + /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + /// material in the key derivation operation. /// - /// \note Applications that rely on opening a key multiple times will not be - /// portable to implementations that only permit a single key handle to be - /// opened. See also :ref:\`key-handles\`. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// + /// When this function returns successfully, \p operation becomes inactive. + /// If this function returns an error status, both \p operation + /// and \c key_derivation operations enter an error state and must be aborted by + /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. /// - /// \param key The persistent identifier of the key. - /// \param[out] handle On success, a handle to the key. + /// \param[in,out] operation Active PAKE operation. + /// \param[out] output A key derivation operation that is ready + /// for an input step of type + /// #PSA_KEY_DERIVATION_INPUT_SECRET. /// /// \retval #PSA_SUCCESS - /// Success. The application can now use the value of `*handle` - /// to access the key. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY - /// The implementation does not have sufficient resources to open the - /// key. This can be due to reaching an implementation limit on the - /// number of open keys, the number of open key handles, or available - /// memory. - /// \retval #PSA_ERROR_DOES_NOT_EXIST - /// There is no persistent key with key identifier \p key. + /// Success. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid persistent key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The specified key exists, but the application does not have the - /// permission to access it. Note that this specification does not - /// define any way to create such a key, but it may be possible - /// through implementation-specific means. + /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + /// algorithm in the \p output key derivation operation. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// Input from a PAKE is not supported by the algorithm in the \p output + /// key derivation operation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The PAKE operation state is not valid (it must be active, but beyond + /// that validity is specific to the algorithm), or + /// the library has not been previously initialized by psa_crypto_init(), + /// or the state of \p output is not valid for + /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + /// step is out of order or the application has done this step already + /// and it may not be repeated. /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_get_implicit_key( + operation: *mut psa_pake_operation_t, + output: *mut psa_key_derivation_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Close a key handle. - /// - /// If the handle designates a volatile key, this will destroy the key material - /// and free all associated resources, just like psa_destroy_key(). - /// - /// If this is the last open handle to a persistent key, then closing the handle - /// will free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and can be opened again later - /// with a call to psa_open_key(). + /// Abort a PAKE operation. /// - /// Closing the key handle makes the handle invalid, and the key handle - /// must not be used again by the application. + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_pake_setup() again. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_pake_operation_t. /// - /// \note If the key handle was used to set up an active - /// :ref:\`multipart operation \`, then closing the - /// key handle can cause the multipart operation to fail. Applications should - /// maintain the key handle until after the multipart operation has finished. + /// In particular, calling psa_pake_abort() after the operation has been + /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + /// is safe and has no effect. /// - /// \param handle The key handle to close. - /// If this is \c 0, do nothing and return \c PSA_SUCCESS. + /// \param[in,out] operation The operation to abort. /// /// \retval #PSA_SUCCESS - /// \p handle was a valid handle or \c 0. It is now closed. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p handle is not a valid handle nor \c 0. + /// Success. /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; } -unsafe extern "C" { - /// \brief Library deinitialization. +pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; +pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; +/// \brief Public key types +pub type mbedtls_pk_type_t = ::core::ffi::c_uint; +/// \brief Options for RSASSA-PSS signature verification. +/// See \c mbedtls_rsa_rsassa_pss_verify_ext() +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_rsassa_pss_options { + /// The digest to use for MGF1 in PSS. /// - /// This function clears all data associated with the PSA layer, - /// including the whole key store. + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + /// disabled, this must be equal to the \c md_alg argument passed + /// to mbedtls_pk_verify_ext(). In a future version of the library, + /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + /// enabled regardless of the status of #MBEDTLS_RSA_C. + pub mgf1_hash_id: mbedtls_md_type_t, + /// The expected length of the salt, in bytes. This may be + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. /// - /// This is an Mbed TLS extension. - pub fn mbedtls_psa_crypto_free(); + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + /// ignored (allowing any salt length). + pub expected_salt_len: ::core::ffi::c_int, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. +impl Default for mbedtls_pk_rsassa_pss_options { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_PSA_EC: mbedtls_pk_debug_type = 3; +/// \brief Types for interfacing with the debug module +pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; +/// \brief Item to send to the debug module #[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_stats_s { - /// Number of slots containing key material for a volatile key. - pub private_volatile_slots: usize, - /// Number of slots containing key material for a key which is in - /// internal persistent storage. - pub private_persistent_slots: usize, - /// Number of slots containing a reference to a key in a - /// secure element. - pub private_external_slots: usize, - /// Number of slots which are occupied, but do not contain - /// key material yet. - pub private_half_filled_slots: usize, - /// Number of slots that contain cache data. - pub private_cache_slots: usize, - /// Number of slots that are not used for anything. - pub private_empty_slots: usize, - /// Number of slots that are locked. - pub private_locked_slots: usize, - /// Largest key id value among open keys in internal persistent storage. - pub private_max_open_internal_key_id: psa_key_id_t, - /// Largest key id value among open keys in secure elements. - pub private_max_open_external_key_id: psa_key_id_t, +#[derive(Copy, Clone)] +pub struct mbedtls_pk_debug_item { + pub private_type: mbedtls_pk_debug_type, + pub private_name: *const ::core::ffi::c_char, + pub private_value: *mut ::core::ffi::c_void, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. -pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; -unsafe extern "C" { - /// \brief Get statistics about - /// resource consumption related to the PSA keystore. - /// - /// \note When Mbed Crypto is built as part of a service, with isolation - /// between the application and the keystore, the service may or - /// may not expose this function. - pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); +impl Default for mbedtls_pk_debug_item { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief Inject an initial entropy seed for the random generator into - /// secure storage. - /// - /// This function injects data to be used as a seed for the random generator - /// used by the PSA Crypto implementation. On devices that lack a trusted - /// entropy source (preferably a hardware random number generator), - /// the Mbed PSA Crypto implementation uses this value to seed its - /// random generator. - /// - /// On devices without a trusted entropy source, this function must be - /// called exactly once in the lifetime of the device. On devices with - /// a trusted entropy source, calling this function is optional. - /// In all cases, this function may only be called before calling any - /// other function in the PSA Crypto API, including psa_crypto_init(). - /// - /// When this function returns successfully, it populates a file in - /// persistent storage. Once the file has been created, this function - /// can no longer succeed. - /// - /// If any error occurs, this function does not change the system state. - /// You can call this function again after correcting the reason for the - /// error if possible. - /// - /// \warning This function **can** fail! Callers MUST check the return status. - /// - /// \warning If you use this function, you should use it as part of a - /// factory provisioning process. The value of the injected seed - /// is critical to the security of the device. It must be - /// *secret*, *unpredictable* and (statistically) *unique per device*. - /// You should be generate it randomly using a cryptographically - /// secure random generator seeded from trusted entropy sources. - /// You should transmit it securely to the device and ensure - /// that its value is not leaked or stored anywhere beyond the - /// needs of transmitting it from the point of generation to - /// the call of this function, and erase all copies of the value - /// once this function returns. - /// - /// This is an Mbed TLS extension. - /// - /// \note This function is only available on the following platforms: - /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. - /// Note that you must provide compatible implementations of - /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. - /// * In a client-server integration of PSA Cryptography, on the client side, - /// if the server supports this feature. - /// \param[in] seed Buffer containing the seed value to inject. - /// \param[in] seed_size Size of the \p seed buffer. - /// The size of the seed in bytes must be greater - /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE - /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM - /// in `library/entropy_poll.h` in the Mbed TLS source - /// code. - /// It must be less or equal to - /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. - /// - /// \retval #PSA_SUCCESS - /// The seed value was injected successfully. The random generator - /// of the PSA Crypto implementation is now ready for use. - /// You may now call psa_crypto_init() and use the PSA Crypto - /// implementation. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p seed_size is out of range. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// There was a failure reading or writing from storage. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The library has already been initialized. It is no longer - /// possible to call this function. - pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_info_t { + _unused: [u8; 0], } -unsafe extern "C" { - /// \brief Get domain parameters for a key. - /// - /// Get the domain parameters for a key with this function, if any. The format - /// of the domain parameters written to \p data is specified in the - /// documentation for psa_set_key_domain_parameters(). - /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. - /// - /// \param[in] attributes The key attribute structure to query. - /// \param[out] data On success, the key domain parameters. - /// \param data_size Size of the \p data buffer in bytes. - /// The buffer is guaranteed to be large - /// enough if its size in bytes is at least - /// the value given by - /// PSA_KEY_DOMAIN_PARAMETERS_SIZE(). - /// \param[out] data_length On success, the number of bytes - /// that make up the key domain parameters data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - pub fn psa_get_key_domain_parameters( - attributes: *const psa_key_attributes_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; +/// \brief Public key container +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_context { + ///< Public key information + pub private_pk_info: *const mbedtls_pk_info_t, + ///< Underlying public key context + pub private_pk_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_pk_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } +pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; +/// \brief Types for RSA-alt abstraction +pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_key_len_func = + ::core::option::Option usize>; unsafe extern "C" { - /// Convert an ECC curve identifier from the PSA encoding to Mbed TLS. - /// - /// \note This function is provided solely for the convenience of - /// Mbed TLS and may be removed at any time without notice. + /// \brief Return information associated with the given PK type /// - /// \param curve A PSA elliptic curve identifier - /// (`PSA_ECC_FAMILY_xxx`). - /// \param bits The bit-length of a private key on \p curve. - /// \param bits_is_sloppy If true, \p bits may be the bit-length rounded up - /// to the nearest multiple of 8. This allows the caller - /// to infer the exact curve from the length of a key - /// which is supplied as a byte string. + /// \param pk_type PK type to search for. /// - /// \return The corresponding Mbed TLS elliptic curve identifier - /// (`MBEDTLS_ECP_DP_xxx`). - /// \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized. - /// \return #MBEDTLS_ECP_DP_NONE if \p bits is not - /// correct for \p curve. - pub fn mbedtls_ecc_group_of_psa( - curve: psa_ecc_family_t, - bits: usize, - bits_is_sloppy: ::core::ffi::c_int, - ) -> mbedtls_ecp_group_id; + /// \return The PK info associated with the type or NULL if not found. + pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; } unsafe extern "C" { - /// External random generator function, implemented by the platform. - /// - /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, - /// this function replaces Mbed TLS's entropy and DRBG modules for all - /// random generation triggered via PSA crypto interfaces. - /// - /// \note This random generator must deliver random numbers with cryptographic - /// quality and high performance. It must supply unpredictable numbers - /// with a uniform distribution. The implementation of this function - /// is responsible for ensuring that the random generator is seeded - /// with sufficient entropy. If you have a hardware TRNG which is slow - /// or delivers non-uniform output, declare it as an entropy source - /// with mbedtls_entropy_add_source() instead of enabling this option. - /// - /// \param[in,out] context Pointer to the random generator context. - /// This is all-bits-zero on the first call - /// and preserved between successive calls. - /// \param[out] output Output buffer. On success, this buffer - /// contains random data with a uniform - /// distribution. - /// \param output_size The size of the \p output buffer in bytes. - /// \param[out] output_length On success, set this value to \p output_size. + /// \brief Initialize a #mbedtls_pk_context (as NONE). /// - /// \retval #PSA_SUCCESS - /// Success. The output buffer contains \p output_size bytes of - /// cryptographic-quality random data, and \c *output_length is - /// set to \p output_size. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY - /// The random generator requires extra entropy and there is no - /// way to obtain entropy under current environment conditions. - /// This error should not happen under normal circumstances since - /// this function is responsible for obtaining as much entropy as - /// it needs. However implementations of this function may return - /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain - /// entropy without blocking indefinitely. - /// \retval #PSA_ERROR_HARDWARE_FAILURE - /// A failure of the random generator hardware that isn't covered - /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. - pub fn mbedtls_psa_external_get_random( - context: *mut mbedtls_psa_external_random_context_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); } -/// A slot number identifying a key in a driver. -/// -/// Values of this type are used to identify built-in keys. -pub type psa_drv_slot_number_t = u64; -/// \brief Encoding of the application role of PAKE -/// -/// Encodes the application's role in the algorithm is being executed. For more -/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX -/// constants. -pub type psa_pake_role_t = u8; -/// Encoding of input and output indicators for PAKE. -/// -/// Some PAKE algorithms need to exchange more data than just a single key share. -/// This type is for encoding additional input and output data for such -/// algorithms. -pub type psa_pake_step_t = u8; -/// Encoding of the type of the PAKE's primitive. -/// -/// Values defined by this standard will never be in the range 0x80-0xff. -/// Vendors who define additional types must use an encoding in this range. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_primitive_type_t = u8; -/// \brief Encoding of the family of the primitive associated with the PAKE. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_family_t = u8; -/// \brief Encoding of the primitive associated with the PAKE. -/// -/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. -pub type psa_pake_primitive_t = u32; -/// The type of the data structure for PAKE cipher suites. -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; -/// The type of the state data structure for PAKE operations. -/// -/// Before calling any function on a PAKE operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_pake_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_pake_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, -/// for example: -/// \code -/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_pake_operation_init() -/// to the structure, for example: -/// \code -/// psa_pake_operation_t operation; -/// operation = psa_pake_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_operation_t = psa_pake_operation_s; -/// The type of input values for PAKE operations. -pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; -/// The type of computation stage for J-PAKE operations. -pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; unsafe extern "C" { - /// Get the length of the password in bytes from given inputs. + /// \brief Free the components of a #mbedtls_pk_context. /// - /// \param[in] inputs Operation inputs. - /// \param[out] password_len Password length. + /// \param ctx The context to clear. It must have been initialized. + /// If this is \c NULL, this function does nothing. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - password_len: *mut usize, - ) -> psa_status_t; + /// \note For contexts that have been set up with + /// mbedtls_pk_setup_opaque(), this does not free the underlying + /// PSA key and you still need to call psa_destroy_key() + /// independently if you want to destroy that key. + pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); } unsafe extern "C" { - /// Get the password from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] buffer Return buffer for password. - /// \param buffer_size Size of the return buffer in bytes. - /// \param[out] buffer_length Actual size of the password in bytes. + /// \brief Initialize a PK context with the information given + /// and allocates the type-specific PK subcontext. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password( - inputs: *const psa_crypto_driver_pake_inputs_t, - buffer: *mut u8, - buffer_size: usize, - buffer_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// Get the role from given inputs. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param info Information to use /// - /// \param[in] inputs Operation inputs. - /// \param[out] role Return buffer for role. + /// \return 0 on success, + /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Role hasn't been set yet. - pub fn psa_crypto_driver_pake_get_role( - inputs: *const psa_crypto_driver_pake_inputs_t, - role: *mut psa_pake_role_t, - ) -> psa_status_t; + /// \note For contexts holding an RSA-alt key, use + /// \c mbedtls_pk_setup_rsa_alt() instead. + pub fn mbedtls_pk_setup( + ctx: *mut mbedtls_pk_context, + info: *const mbedtls_pk_info_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the user id in bytes from given inputs. + /// \brief Initialize an RSA-alt context /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_len User id length. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param key RSA key pointer + /// \param decrypt_func Decryption function + /// \param sign_func Signing function + /// \param key_len_func Function returning key length in bytes /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_user_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_len: *mut usize, - ) -> psa_status_t; + /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + /// context wasn't already initialized as RSA_ALT. + /// + /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + pub fn mbedtls_pk_setup_rsa_alt( + ctx: *mut mbedtls_pk_context, + key: *mut ::core::ffi::c_void, + decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, + sign_func: mbedtls_pk_rsa_alt_sign_func, + key_len_func: mbedtls_pk_rsa_alt_key_len_func, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the peer id in bytes from given inputs. + /// \brief Get the size in bits of the underlying key /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_len Peer id length. + /// \param ctx The context to query. It must have been initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_peer_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_len: *mut usize, - ) -> psa_status_t; + /// \return Key size in bits, or 0 on error + pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; } unsafe extern "C" { - /// Get the user id from given inputs. + /// \brief Tell if a context can do the operation given by type /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_id User id. - /// \param user_id_size Size of \p user_id in bytes. - /// \param[out] user_id_len Size of the user id in bytes. + /// \param ctx The context to query. It must have been initialized. + /// \param type The desired type. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p user_id is too small. - pub fn psa_crypto_driver_pake_get_user( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_id: *mut u8, - user_id_size: usize, - user_id_len: *mut usize, - ) -> psa_status_t; + /// \return 1 if the context can do operations on the given type. + /// \return 0 if the context cannot do the operations on the given + /// type. This is always the case for a context that has + /// been initialized but not set up, or that has been + /// cleared with mbedtls_pk_free(). + pub fn mbedtls_pk_can_do( + ctx: *const mbedtls_pk_context, + type_: mbedtls_pk_type_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the peer id from given inputs. + /// \brief Determine valid PSA attributes that can be used to + /// import a key into PSA. /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_id Peer id. - /// \param peer_id_size Size of \p peer_id in bytes. - /// \param[out] peer_id_length Size of the peer id in bytes. + /// The attributes determined by this function are suitable + /// for calling mbedtls_pk_import_into_psa() to create + /// a PSA key with the same key material. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p peer_id is too small. - pub fn psa_crypto_driver_pake_get_peer( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_id: *mut u8, - peer_id_size: usize, - peer_id_length: *mut usize, - ) -> psa_status_t; + /// The typical flow of operations involving this function is + /// ``` + /// psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + /// int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + /// if (ret != 0) ...; // error handling omitted + /// // Tweak attributes if desired + /// psa_key_id_t key_id = 0; + /// ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + /// if (ret != 0) ...; // error handling omitted + /// ``` + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + /// - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_ENCRYPT as well as + /// #PSA_KEY_USAGE_DECRYPT. + /// - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type. + /// - #PSA_KEY_USAGE_ENCRYPT: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_HASH as well as + /// #PSA_KEY_USAGE_SIGN_HASH. + /// - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + /// #PSA_KEY_USAGE_SIGN_MESSAGE. + /// - #PSA_KEY_USAGE_VERIFY_HASH: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + /// \p attributes will contain a public key type. + /// \param[out] attributes + /// On success, valid attributes to import the key into PSA. + /// - The lifetime and key identifier are unchanged. If the + /// attribute structure was initialized or reset before + /// calling this function, this will result in a volatile + /// key. Call psa_set_key_identifier() before or after this + /// function if you wish to create a persistent key. Call + /// psa_set_key_lifetime() before or after this function if + /// you wish to import the key in a secure element. + /// - The key type and bit-size are determined by the contents + /// of the PK context. If the PK context contains a key + /// pair, the key type can be either a key pair type or + /// the corresponding public key type, depending on + /// \p usage. If the PK context contains a public key, + /// the key type is a public key type. + /// - The key's policy is determined by the key type and + /// the \p usage parameter. The usage always allows + /// \p usage, exporting and copying the key, and + /// possibly other permissions as documented for the + /// \p usage parameter. + /// The permitted algorithm policy is determined as follows + /// based on the #mbedtls_pk_type_t type of \p pk, + /// the chosen \p usage and other factors: + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V15: + /// #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_PKCS1V15_CRYPT + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V21 and the digest type + /// corresponding to the PSA algorithm \c hash: + /// #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_OAEP(\c hash) + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA_ALT: not supported. + /// - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + /// if \p usage is SIGN/VERIFY: + /// #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + /// if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + /// otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + /// - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + /// if \p usage is DERIVE: + /// #PSA_ALG_ECDH. + /// - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + /// set for the underlying PSA key, except that + /// sign/decrypt flags are removed if the type is + /// set to a public key type. + /// The underlying key must allow \p usage. + /// Note that the enrollment algorithm set with + /// psa_set_key_enrollment_algorithm() is not copied. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_get_psa_attributes( + pk: *const mbedtls_pk_context, + usage: psa_key_usage_t, + attributes: *mut psa_key_attributes_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the cipher suite from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] cipher_suite Return buffer for role. + /// \brief Import a key into the PSA key store. + /// + /// This function is equivalent to calling psa_import_key() + /// with the key material from \p pk. + /// + /// The typical way to use this function is: + /// -# Call mbedtls_pk_get_psa_attributes() to obtain + /// attributes for the given key. + /// -# If desired, modify the attributes, for example: + /// - To create a persistent key, call + /// psa_set_key_identifier() and optionally + /// psa_set_key_lifetime(). + /// - To import only the public part of a key pair: + /// + /// psa_set_key_type(&attributes, + /// PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + /// psa_get_key_type(&attributes))); + /// - Restrict the key usage if desired. + /// -# Call mbedtls_pk_import_into_psa(). + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param[in] attributes + /// The attributes to use for the new key. They must be + /// compatible with \p pk. In particular, the key type + /// must match the content of \p pk. + /// If \p pk contains a key pair, the key type in + /// attributes can be either the key pair type or the + /// corresponding public key type (to import only the + /// public part). + /// \param[out] key_id + /// On success, the identifier of the newly created key. + /// On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_import_into_psa( + pk: *const mbedtls_pk_context, + attributes: *const psa_key_attributes_t, + key_id: *mut mbedtls_svc_key_id_t, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Create a PK context starting from a key stored in PSA. + /// This key: + /// - must be exportable and + /// - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + /// + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. + /// + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + /// mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. + /// * For ECDSA, the choice of deterministic vs randomized will + /// be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + /// * For an RSA key, the output PK context will allow both + /// encrypt/decrypt and sign/verify regardless of the original + /// key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. + /// + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Cipher_suite hasn't been set yet. - pub fn psa_crypto_driver_pake_get_cipher_suite( - inputs: *const psa_crypto_driver_pake_inputs_t, - cipher_suite: *mut psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the session information for a password-authenticated key exchange. + /// \brief Create a PK context for the public key of a PSA key. /// - /// The sequence of operations to set up a password-authenticated key exchange - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_pake_operation_t, e.g. - /// #PSA_PAKE_OPERATION_INIT. - /// -# Call psa_pake_setup() to specify the cipher suite. - /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the - /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs - /// to be called depends on the algorithm in use. + /// The key must be an RSA or ECC key. It can be either a + /// public key or a key pair, and only the public key is copied. + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_verify() or + /// mbedtls_pk_encrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. /// - /// A typical sequence of calls to perform a password-authenticated key - /// exchange: - /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the - /// key share that needs to be sent to the peer. - /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide - /// the key share that was received from the peer. - /// -# Depending on the algorithm additional calls to psa_pake_output() and - /// psa_pake_input() might be necessary. - /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// For an RSA key, the output PK context will allow both + /// encrypt and verify regardless of the original key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// If an error occurs at any step after a call to psa_pake_setup(), - /// the operation will need to be reset by a call to psa_pake_abort(). The - /// application may call psa_pake_abort() at any time after the operation - /// has been initialized. + /// \return 0 on success. + /// \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_public_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature (including padding if relevant). /// - /// After a successful call to psa_pake_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A call to psa_pake_abort(). - /// - A successful call to psa_pake_get_implicit_key(). + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used. + /// This can be #MBEDTLS_MD_NONE if the signature algorithm + /// does not rely on a hash algorithm (non-deterministic + /// ECDSA, RSA PKCS#1 v1.5). + /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + /// \p hash is the DigestInfo structure used by RFC 8017 + /// §9.2 steps 3–6. If \p md_alg is a valid hash + /// algorithm then \p hash is the digest itself, and this + /// function calculates the DigestInfo encoding internally. + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Signature to verify + /// \param sig_len Signature length /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized but not set up yet. - /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully - /// characterizes a PAKE algorithm and determines - /// the algorithm as well.) + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (accepting any salt length), + /// depending on the padding mode in the underlying RSA context. + /// For a pk object constructed by parsing, this is PKCS#1 v1.5 + /// by default. Use mbedtls_pk_verify_ext() to explicitly select + /// a different algorithm. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the - /// PAKE primitive in \p cipher_suite is not compatible with the - /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid - /// or not compatible with the PAKE algorithm and primitive. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, - /// or the PAKE primitive in \p cipher_suite is not supported or not - /// compatible with the PAKE algorithm, or the hash algorithm in - /// \p cipher_suite is not supported or not compatible with the PAKE - /// algorithm and primitive. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_setup( - operation: *mut psa_pake_operation_t, - cipher_suite: *const psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + pub fn mbedtls_pk_verify( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the password for a password-authenticated key exchange from key ID. + /// \brief Restartable version of \c mbedtls_pk_verify() /// - /// Call this function when the password, or a value derived from the password, - /// is already present in the key store. + /// \note Performs the same job as \c mbedtls_pk_verify(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_verify(). /// - /// \param[in,out] operation The operation object to set the password for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the password hasn't - /// been set yet (psa_pake_set_password_key() - /// hasn't been called yet). - /// \param password Identifier of the key holding the password or a - /// value derived from the password (eg. by a - /// memory-hard function). It must remain valid - /// until the operation terminates. It must be of - /// type #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow - /// the usage #PSA_KEY_USAGE_DERIVE. + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p password is not a valid key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not - /// permit the \p operation's algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with - /// the \p operation's cipher suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size of \p password is not supported with the - /// \p operation's cipher suite. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must have been set up.), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_password_key( - operation: *mut psa_pake_operation_t, - password: mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return See \c mbedtls_pk_verify(), or + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_verify_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature, with options. + /// (Includes verification of the padding depending on type.) + /// + /// \param type Signature type (inc. possible padding type) to verify + /// \param options Pointer to type-specific options, or NULL + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + /// used for this type of signatures, + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + /// + /// \note If hash_len is 0, then the length associated with md_alg + /// is used instead, or an error returned if it is invalid. + /// + /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// + /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + /// to a mbedtls_pk_rsassa_pss_options structure, + /// otherwise it must be NULL. Note that if + /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + pub fn mbedtls_pk_verify_ext( + type_: mbedtls_pk_type_t, + options: *const ::core::ffi::c_void, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the user ID for a password-authenticated key exchange. + /// \brief Make signature, including padding if relevant. /// - /// Call this function to set the user ID. For PAKE algorithms that associate a - /// user identifier with each side of the session you need to call - /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single - /// user identifier with the session, call psa_pake_set_user() only. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (using the largest possible salt + /// length up to the hash length), depending on the padding mode + /// in the underlying RSA context. For a pk object constructed + /// by parsing, this is PKCS#1 v1.5 by default. Use + /// mbedtls_pk_verify_ext() to explicitly select a different + /// algorithm. /// - /// \param[in,out] operation The operation object to set the user ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the user ID hasn't - /// been set (psa_pake_set_user() hasn't been - /// called yet). - /// \param[in] user_id The user ID to authenticate with. - /// (temporary limitation: "client" or "server" only) - /// \param user_id_len Size of the \p user_id buffer in bytes. + /// \return 0 on success, or a specific error code. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The value of \p user_id is not supported by the implementation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_user( - operation: *mut psa_pake_operation_t, - user_id: *const u8, - user_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the peer ID for a password-authenticated key exchange. + /// \brief Make signature given a signature type. /// - /// Call this function in addition to psa_pake_set_user() for PAKE algorithms - /// that associate a user identifier with each side of the session. For PAKE - /// algorithms that associate a single user identifier with the session, call - /// psa_pake_set_user() only. + /// \param pk_type Signature type. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \return 0 on success, or a specific error code. /// - /// \param[in,out] operation The operation object to set the peer ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the peer ID hasn't - /// been set (psa_pake_set_peer() hasn't been - /// called yet). - /// \param[in] peer_id The peer's ID to authenticate. - /// (temporary limitation: "client" or "server" only) - /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + /// see #PSA_ALG_RSA_PSS for a description of PSS options used. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm doesn't associate a second identity with the session. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// Calling psa_pake_set_peer() is invalid with the \p operation's - /// algorithm, the operation state is not valid, or the library has not - /// been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_peer( - operation: *mut psa_pake_operation_t, - peer_id: *const u8, - peer_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign_ext( + pk_type: mbedtls_pk_type_t, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the application role for a password-authenticated key exchange. + /// \brief Restartable version of \c mbedtls_pk_sign() /// - /// Not all PAKE algorithms need to differentiate the communicating entities. - /// It is optional to call this function for PAKEs that don't require a role - /// to be specified. For such PAKEs the application role parameter is ignored, - /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// \note Performs the same job as \c mbedtls_pk_sign(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_sign(). /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \param[in,out] operation The operation object to specify the - /// application's role for. It must have been set up - /// by psa_pake_setup() and not yet in use (neither - /// psa_pake_output() nor psa_pake_input() has been - /// called yet). It must be on operation for which - /// the application's role hasn't been specified - /// (psa_pake_set_role() hasn't been called yet). - /// \param role A value of type ::psa_pake_role_t indicating the - /// application's role in the PAKE the algorithm - /// that is being set up. For more information see - /// the documentation of \c PSA_PAKE_ROLE_XXX - /// constants. + /// \return See \c mbedtls_pk_sign(). + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_sign_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Decrypt message (including padding if relevant). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The \p role is not a valid PAKE role in the \p operation’s algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The \p role for this algorithm is not supported or is not valid. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_role( - operation: *mut psa_pake_operation_t, - role: psa_pake_role_t, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param input Input to decrypt + /// \param ilen Input size + /// \param output Decrypted output + /// \param olen Decrypted message length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. + /// + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_decrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get output for a step of a password-authenticated key exchange. + /// \brief Encrypt message (including padding if relevant). /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been set up. + /// \param input Message to encrypt + /// \param ilen Message size + /// \param output Encrypted output + /// \param olen Encrypted output length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \note \p f_rng is used for padding generation. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step of the algorithm for which the output is - /// requested. - /// \param[out] output Buffer where the output is to be written in the - /// format appropriate for this \p step. Refer to - /// the documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param output_size Size of the \p output buffer in bytes. This must - /// be at least #PSA_PAKE_OUTPUT_SIZE(\p alg, \p - /// primitive, \p step) where \p alg and - /// \p primitive are the PAKE algorithm and primitive - /// in the operation's cipher suite, and \p step is - /// the output step. + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_encrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if a public-private pair of keys matches. /// - /// \param[out] output_length On success, the number of bytes of the returned - /// output. + /// \param pub Context holding a public key. + /// \param prv Context holding a private (and public) key. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p step is not compatible with the operation's algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step is not supported with the operation's algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_output( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success (keys were checked and match each other). + /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + /// be checked - in that case they may or may not match. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + /// \return Another non-zero value if the keys do not match. + pub fn mbedtls_pk_check_pair( + pub_: *const mbedtls_pk_context, + prv: *const mbedtls_pk_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Provide input for a step of a password-authenticated key exchange. + /// \brief Export debug information /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been initialized. + /// \param items Place to write debug items /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + pub fn mbedtls_pk_debug( + ctx: *const mbedtls_pk_context, + items: *mut mbedtls_pk_debug_item, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Access the type name /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \param ctx The PK context to use. It must have been initialized. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step for which the input is provided. - /// \param[in] input Buffer containing the input in the format - /// appropriate for this \p step. Refer to the - /// documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param input_length Size of the \p input buffer in bytes. + /// \return Type name on success, or "invalid PK" + pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; +} +unsafe extern "C" { + /// \brief Get the key type /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p is not compatible with the \p operation’s algorithm, or the - /// \p input is not valid for the \p operation's algorithm, cipher suite - /// or \p step. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step p is not supported with the \p operation's algorithm, or the - /// \p input is not supported for the \p operation's algorithm, cipher - /// suite or \p step. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_input( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been initialized. + /// + /// \return Type on success. + /// \return #MBEDTLS_PK_NONE for a context that has not been set up. + pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; } unsafe extern "C" { - /// Get implicitly confirmed shared secret from a PAKE. + /// \ingroup pk_module */ + ////** + /// \brief Parse a private key in PEM or DER format /// - /// At this point there is a cryptographic guarantee that only the authenticated - /// party who used the same password is able to compute the key. But there is no - /// guarantee that the peer is the party it claims to be and was able to do so. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// That is, the authentication is only implicit. Since the peer is not - /// authenticated yet, no action should be taken yet that assumes that the peer - /// is who it claims to be. For example, do not access restricted files on the - /// peer's behalf until an explicit authentication has succeeded. + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// \param pwd Optional password for decryption. + /// Pass \c NULL if expecting a non-encrypted key. + /// Pass a string of \p pwdlen bytes if expecting an encrypted + /// key; a non-encrypted key will also be accepted. + /// The empty password is not supported. + /// \param pwdlen Size of the password in bytes. + /// Ignored if \p pwd is \c NULL. + /// \param f_rng RNG function, must not be \c NULL. Used for blinding. + /// \param p_rng RNG parameter /// - /// This function can be called after the key exchange phase of the operation - /// has completed. It imports the shared secret output of the PAKE into the - /// provided derivation operation. The input step - /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key - /// material in the key derivation operation. + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note The key is also checked for correctness. /// - /// When this function returns successfully, \p operation becomes inactive. - /// If this function returns an error status, both \p operation - /// and \p key_derivation operations enter an error state and must be aborted by - /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \ingroup pk_module */ + ////** + /// \brief Parse a public key in PEM or DER format /// - /// \param[in,out] operation Active PAKE operation. - /// \param[out] output A key derivation operation that is ready - /// for an input step of type - /// #PSA_KEY_DERIVATION_INPUT_SECRET. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the - /// algorithm in the \p output key derivation operation. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// Input from a PAKE is not supported by the algorithm in the \p output - /// key derivation operation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The PAKE operation state is not valid (it must be active, but beyond - /// that validity is specific to the algorithm), or - /// the library has not been previously initialized by psa_crypto_init(), - /// or the state of \p output is not valid for - /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the - /// step is out of order or the application has done this step already - /// and it may not be repeated. - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_get_implicit_key( - operation: *mut psa_pake_operation_t, - output: *mut psa_key_derivation_operation_t, - ) -> psa_status_t; + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). + /// + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. + /// + /// \note The key is also checked for correctness. + /// + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_public_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a PAKE operation. + /// \brief Write a private key to a PKCS#1 or SEC1 DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_pake_setup() again. + /// \param ctx PK context which must contain a valid private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_pake_operation_t. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_key_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a SubjectPublicKeyInfo DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// In particular, calling psa_pake_abort() after the operation has been - /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() - /// is safe and has no effect. + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// \param[in,out] operation The operation to abort. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_pubkey_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a PEM string /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_pubkey_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_pake_cipher_suite_s { - pub algorithm: psa_algorithm_t, - pub type_: psa_pake_primitive_type_t, - pub family: psa_pake_family_t, - pub bits: u16, - pub hash: psa_algorithm_t, +unsafe extern "C" { + /// \brief Write a private key to a PKCS#1 or SEC1 PEM string + /// + /// \param ctx PK context which must contain a valid private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_key_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_crypto_driver_pake_inputs_s { - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: psa_pake_role_t, - pub private_user: *mut u8, - pub private_user_len: usize, - pub private_peer: *mut u8, - pub private_peer_len: usize, - pub private_attributes: psa_key_attributes_t, - pub private_cipher_suite: psa_pake_cipher_suite_t, +unsafe extern "C" { + /// \brief Parse a SubjectPublicKeyInfo DER structure + /// + /// \param p the position in the ASN.1 data + /// \param end end of the buffer + /// \param pk The PK context to fill. It must have been initialized + /// but not set up. + /// + /// \return 0 if successful, or a specific PK error code + pub fn mbedtls_pk_parse_subpubkey( + p: *mut *mut ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -impl Default for psa_crypto_driver_pake_inputs_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Write a subjectPublicKey to ASN.1 data + /// Note: function works backwards in data buffer + /// + /// \param p reference to current position pointer + /// \param start start of the buffer (for bounds-checking) + /// \param key PK context which must contain a valid public or private key. + /// + /// \return the length written or a negative error code + pub fn mbedtls_pk_write_pubkey( + p: *mut *mut ::core::ffi::c_uchar, + start: *mut ::core::ffi::c_uchar, + key: *const mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -pub const psa_jpake_step_PSA_PAKE_STEP_INVALID: psa_jpake_step = 0; -pub const psa_jpake_step_PSA_PAKE_STEP_X1_X2: psa_jpake_step = 1; -pub const psa_jpake_step_PSA_PAKE_STEP_X2S: psa_jpake_step = 2; -pub const psa_jpake_step_PSA_PAKE_STEP_DERIVE: psa_jpake_step = 3; -pub type psa_jpake_step = ::core::ffi::c_uint; -pub use self::psa_jpake_step as psa_jpake_step_t; -pub const psa_jpake_state_PSA_PAKE_STATE_INVALID: psa_jpake_state = 0; -pub const psa_jpake_state_PSA_PAKE_STATE_SETUP: psa_jpake_state = 1; -pub const psa_jpake_state_PSA_PAKE_STATE_READY: psa_jpake_state = 2; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X1_X2: psa_jpake_state = 3; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X2S: psa_jpake_state = 4; -pub const psa_jpake_state_PSA_PAKE_INPUT_X1_X2: psa_jpake_state = 5; -pub const psa_jpake_state_PSA_PAKE_INPUT_X4S: psa_jpake_state = 6; -pub type psa_jpake_state = ::core::ffi::c_uint; -pub use self::psa_jpake_state as psa_jpake_state_t; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_INVALID: psa_jpake_sequence = 0; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_KEY_SHARE: psa_jpake_sequence = 1; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PUBLIC: psa_jpake_sequence = 2; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PROOF: psa_jpake_sequence = 3; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_KEY_SHARE: psa_jpake_sequence = 4; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PUBLIC: psa_jpake_sequence = 5; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PROOF: psa_jpake_sequence = 6; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_END: psa_jpake_sequence = 7; -pub type psa_jpake_sequence = ::core::ffi::c_uint; -pub use self::psa_jpake_sequence as psa_jpake_sequence_t; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = + 3; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + mbedtls_key_exchange_type_t = 4; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = + 8; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = + 9; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = 10; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = 11; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; -pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; -pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_jpake_computation_stage_s { - pub private_state: psa_jpake_state_t, - pub private_sequence: psa_jpake_sequence_t, - pub private_input_step: psa_jpake_step_t, - pub private_output_step: psa_jpake_step_t, -} -impl Default for psa_jpake_computation_stage_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_pake_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_stage: u8, - pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, - pub private_data: psa_pake_operation_s__bindgen_ty_2, -} +pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; +/// \brief This structure is used for storing ciphersuite information +/// +/// \note members are defined using integral types instead of enums +/// in order to pack structure and reduce memory usage by internal +/// \c ciphersuite_definitions[] #[repr(C)] #[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_jpake: psa_jpake_computation_stage_t, +pub struct mbedtls_ssl_ciphersuite_t { + pub private_id: ::core::ffi::c_int, + pub private_name: *const ::core::ffi::c_char, + pub private_cipher: u8, + pub private_mac: u8, + pub private_key_exchange: u8, + pub private_flags: u8, + pub private_min_tls_version: u16, + pub private_max_tls_version: u16, } -impl Default for psa_pake_operation_s__bindgen_ty_1 { +impl Default for mbedtls_ssl_ciphersuite_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -18649,29 +19849,23 @@ impl Default for psa_pake_operation_s__bindgen_ty_1 { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_2 { - pub private_ctx: psa_driver_pake_context_t, - pub private_inputs: psa_crypto_driver_pake_inputs_t, +unsafe extern "C" { + pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; } -impl Default for psa_pake_operation_s__bindgen_ty_2 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_string( + ciphersuite_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ssl_ciphersuite_t; } -impl Default for psa_pake_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_id( + ciphersuite_id: ::core::ffi::c_int, + ) -> *const mbedtls_ssl_ciphersuite_t; +} +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( + info: *const mbedtls_ssl_ciphersuite_t, + ) -> usize; } /// Type-length-value structure that allows for ASN1 using DER. pub type mbedtls_x509_buf = mbedtls_asn1_buf; @@ -18682,6 +19876,23 @@ pub type mbedtls_x509_bitstring = mbedtls_asn1_bitstring; pub type mbedtls_x509_name = mbedtls_asn1_named_data; /// Container for a sequence of ASN.1 items pub type mbedtls_x509_sequence = mbedtls_asn1_sequence; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_authority { + pub keyIdentifier: mbedtls_x509_buf, + pub authorityCertIssuer: mbedtls_x509_sequence, + pub authorityCertSerialNumber: mbedtls_x509_buf, + pub raw: mbedtls_x509_buf, +} +impl Default for mbedtls_x509_authority { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} /// Container for date and time (precision in seconds). #[repr(C)] #[derive(Default, Copy, Clone)] @@ -18773,9 +19984,9 @@ pub struct mbedtls_x509_subject_alternative_name { #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_x509_subject_alternative_name__bindgen_ty_1 { - ///< The otherName supported type. pub other_name: mbedtls_x509_san_other_name, - ///< The buffer for the unconstructed types. Only rfc822Name, dnsName and uniformResourceIdentifier are currently supported + pub directory_name: mbedtls_x509_name, + ///< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. pub unstructured_name: mbedtls_x509_buf, } impl Default for mbedtls_x509_subject_alternative_name__bindgen_ty_1 { @@ -18796,6 +20007,21 @@ impl Default for mbedtls_x509_subject_alternative_name { } } } +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_san_list { + pub node: mbedtls_x509_subject_alternative_name, + pub next: *mut mbedtls_x509_san_list, +} +impl Default for mbedtls_x509_san_list { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { /// \brief Store the certificate DN in printable form into buf; /// no more than size characters will be written. @@ -18812,6 +20038,26 @@ unsafe extern "C" { dn: *const mbedtls_x509_name, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Convert the certificate DN string \p name into + /// a linked list of mbedtls_x509_name (equivalent to + /// mbedtls_asn1_named_data). + /// + /// \note This function allocates a linked list, and places the head + /// pointer in \p head. This list must later be freed by a + /// call to mbedtls_asn1_free_named_data_list(). + /// + /// \param[out] head Address in which to store the pointer to the head of the + /// allocated list of mbedtls_x509_name. Must point to NULL on + /// entry. + /// \param[in] name The string representation of a DN to convert + /// + /// \return 0 on success, or a negative error code. + pub fn mbedtls_x509_string_to_names( + head: *mut *mut mbedtls_asn1_named_data, + name: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Store the certificate serial in printable form into buf; /// no more than size characters will be written. @@ -18828,6 +20074,20 @@ unsafe extern "C" { serial: *const mbedtls_x509_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Compare pair of mbedtls_x509_time. + /// + /// \param t1 mbedtls_x509_time to compare + /// \param t2 mbedtls_x509_time to compare + /// + /// \return < 0 if t1 is before t2 + /// 0 if t1 equals t2 + /// > 0 if t1 is after t2 + pub fn mbedtls_x509_time_cmp( + t1: *const mbedtls_x509_time, + t2: *const mbedtls_x509_time, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Check a given mbedtls_x509_time against the system time /// and tell if it's in the past. @@ -18856,21 +20116,25 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief This function parses an item in the SubjectAlternativeNames - /// extension. + /// extension. Please note that this function might allocate + /// additional memory for a subject alternative name, thus + /// mbedtls_x509_free_subject_alt_name has to be called + /// to dispose of this additional memory afterwards. /// /// \param san_buf The buffer holding the raw data item of the subject /// alternative name. /// \param san The target structure to populate with the parsed presentation - /// of the subject alternative name encoded in \p san_raw. + /// of the subject alternative name encoded in \p san_buf. /// /// \note Supported GeneralName types, as defined in RFC 5280: - /// "rfc822Name", "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + /// "rfc822Name", "dnsName", "directoryName", + /// "uniformResourceIdentifier" and "hardware_module_name" /// of type "otherName", as defined in RFC 4108. /// /// \note This function should be called on a single raw data of /// subject alternative name. For example, after successful /// certificate parsing, one must iterate on every item in the - /// \p crt->subject_alt_names sequence, and pass it to + /// \c crt->subject_alt_names sequence, and pass it to /// this function. /// /// \warning The target structure contains pointers to the raw data of the @@ -18887,173 +20151,29 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \} addtogroup x509_module - pub fn mbedtls_x509_get_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - cur: *mut mbedtls_x509_name, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg_null( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - params: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_rsassa_pss_params( - params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - mgf_md: *mut mbedtls_md_type_t, - salt_len: *mut ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - sig: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig_alg( - sig_oid: *const mbedtls_x509_buf, - sig_params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - pk_alg: *mut mbedtls_pk_type_t, - sig_opts: *mut *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_time( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - t: *mut mbedtls_x509_time, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_serial( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - serial: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ext( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ext: *mut mbedtls_x509_buf, - tag: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_sig_alg_gets( - buf: *mut ::core::ffi::c_char, - size: usize, - sig_oid: *const mbedtls_x509_buf, - pk_alg: mbedtls_pk_type_t, - md_alg: mbedtls_md_type_t, - sig_opts: *const ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_key_size_helper( - buf: *mut ::core::ffi::c_char, - buf_size: usize, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_string_to_names( - head: *mut *mut mbedtls_asn1_named_data, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_set_extension( - head: *mut *mut mbedtls_asn1_named_data, - oid: *const ::core::ffi::c_char, - oid_len: usize, - critical: ::core::ffi::c_int, - val: *const ::core::ffi::c_uchar, - val_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_extensions( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_names( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_sig( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - oid: *const ::core::ffi::c_char, - oid_len: usize, - sig: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ns_cert_type( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ns_cert_type: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_key_usage( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - key_usage: *mut ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_subject_alt_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - subject_alt_name: *mut mbedtls_x509_sequence, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_subject_alt_name( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - subject_alt_name: *const mbedtls_x509_sequence, - prefix: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_cert_type( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - ns_cert_type: ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \brief Unallocate all data related to subject alternative name + /// + /// \param san SAN structure - extra memory owned by this structure will be freed + pub fn mbedtls_x509_free_subject_alt_name(san: *mut mbedtls_x509_subject_alternative_name); } unsafe extern "C" { - pub fn mbedtls_x509_info_key_usage( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - key_usage: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \brief This function parses a CN string as an IP address. + /// + /// \param cn The CN string to parse. CN string MUST be null-terminated. + /// \param dst The target buffer to populate with the binary IP address. + /// The buffer MUST be 16 bytes to save IPv6, and should be + /// 4-byte aligned if the result will be used as struct in_addr. + /// e.g. uint32_t dst[4] + /// + /// \note \p cn is parsed as an IPv6 address if string contains ':', + /// else \p cn is parsed as an IPv4 address. + /// + /// \return Length of binary IP address; num bytes written to target. + /// \return \c 0 on failure to parse CN string as an IP address. + pub fn mbedtls_x509_crt_parse_cn_inet_pton( + cn: *const ::core::ffi::c_char, + dst: *mut ::core::ffi::c_void, + ) -> usize; } /// Certificate revocation list entry. /// Contains the CA-specific serial numbers and revocation dates. @@ -19245,8 +20365,12 @@ pub struct mbedtls_x509_crt { pub subject_id: mbedtls_x509_buf, ///< Optional X.509 v3 extensions. pub v3_ext: mbedtls_x509_buf, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, + ///< Optional X.509 v3 extension subject key identifier. + pub subject_key_id: mbedtls_x509_buf, + ///< Optional X.509 v3 extension authority key identifier. + pub authority_key_id: mbedtls_x509_authority, ///< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). pub certificate_policies: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions @@ -19345,6 +20469,22 @@ impl Default for mbedtls_x509write_cert { } } } +unsafe extern "C" { + /// \brief Set Subject Alternative Name + /// + /// \param ctx Certificate context to use + /// \param san_list List of SAN values + /// + /// \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + /// + /// \note "dnsName", "uniformResourceIdentifier", "IP address", + /// "otherName", and "DirectoryName", as defined in RFC 5280, + /// are supported. + pub fn mbedtls_x509write_crt_set_subject_alternative_name( + ctx: *mut mbedtls_x509write_cert, + san_list: *const mbedtls_x509_san_list, + ) -> ::core::ffi::c_int; +} /// Item in a verification chain: cert and flags for it #[repr(C)] #[derive(Copy, Clone)] @@ -19683,8 +20823,12 @@ unsafe extern "C" { /// \param cn The expected Common Name. This will be checked to be /// present in the certificate's subjectAltNames extension or, /// if this extension is absent, as a CN component in its - /// Subject name. Currently only DNS names are supported. This - /// may be \c NULL if the CN need not be verified. + /// Subject name. DNS names and IP addresses are fully + /// supported, while the URI subtype is partially supported: + /// only exact matching, without any normalization procedures + /// described in 7.4 of RFC5280, will result in a positive + /// URI verification. + /// This may be \c NULL if the CN need not be verified. /// \param flags The address at which to store the result of the verification. /// If the verification couldn't be completed, the flag value is /// set to (uint32_t) -1. @@ -19915,6 +21059,16 @@ unsafe extern "C" { /// \param crt Certificate chain to free pub fn mbedtls_x509_crt_free(crt: *mut mbedtls_x509_crt); } +unsafe extern "C" { + /// \brief Access the ca_istrue field + /// + /// \param[in] crt Certificate to be queried, must not be \c NULL + /// + /// \return \c 1 if this a CA certificate \c 0 otherwise. + /// \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + /// the Optional Basic Constraint extension. + pub fn mbedtls_x509_crt_get_ca_istrue(crt: *const mbedtls_x509_crt) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Initialize a CRT writing context /// @@ -19995,7 +21149,7 @@ unsafe extern "C" { /// \brief Set the issuer name for a Certificate /// Issuer names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS CA" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS CA" /// /// \param ctx CRT context to use /// \param issuer_name issuer name to set @@ -20011,7 +21165,7 @@ unsafe extern "C" { /// \brief Set the subject name for a Certificate /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CRT context to use /// \param subject_name subject name to set @@ -20181,13 +21335,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20207,13 +21355,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20334,13 +21476,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20413,13 +21549,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20453,13 +21583,7 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, output_size: usize, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20490,7 +21614,7 @@ unsafe extern "C" { /// initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p field is invalid. + /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. /// \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. pub fn mbedtls_dhm_get_value( ctx: *const mbedtls_dhm_context, @@ -20618,6 +21742,18 @@ impl Default for mbedtls_ecdh_context { } } } +unsafe extern "C" { + /// \brief Return the ECP group for provided context. + /// + /// \note To access group specific fields, users should use + /// `mbedtls_ecp_curve_info_from_grp_id` or + /// `mbedtls_ecp_group_load` on the extracted `group_id`. + /// + /// \param ctx The ECDH context to parse. This must not be \c NULL. + /// + /// \return The \c mbedtls_ecp_group_id of the context. + pub fn mbedtls_ecdh_get_grp_id(ctx: *mut mbedtls_ecdh_context) -> mbedtls_ecp_group_id; +} unsafe extern "C" { /// \brief Check whether a given group can be used for ECDH. /// @@ -20654,13 +21790,7 @@ unsafe extern "C" { grp: *mut mbedtls_ecp_group, d: *mut mbedtls_mpi, Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20699,13 +21829,7 @@ unsafe extern "C" { z: *mut mbedtls_mpi, Q: *const mbedtls_ecp_point, d: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20772,13 +21896,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20814,7 +21932,7 @@ unsafe extern "C" { /// \brief This function sets up an ECDH context from an EC key. /// /// It is used by clients and servers in place of the - /// ServerKeyEchange for static ECDH, and imports ECDH + /// ServerKeyExchange for static ECDH, and imports ECDH /// parameters from the EC key information of a certificate. /// /// \see ecp.h @@ -20863,13 +21981,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20930,19 +22042,14 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_ssl_premaster_secret { + pub dummy: ::core::ffi::c_uchar, pub _pms_rsa: [::core::ffi::c_uchar; 48usize], pub _pms_dhm: [::core::ffi::c_uchar; 1024usize], pub _pms_ecdh: [::core::ffi::c_uchar; 66usize], @@ -21214,6 +22321,8 @@ pub struct mbedtls_ssl_session { ///< MaxFragmentLength negotiated by peer pub private_mfl_code: ::core::ffi::c_uchar, pub private_exported: ::core::ffi::c_uchar, + ///< 0: client, 1: server + pub private_endpoint: u8, /// TLS version negotiated in the session. Used if and when renegotiating /// or resuming a session instead of the configured minor TLS version. pub private_tls_version: mbedtls_ssl_protocol_version, @@ -21232,15 +22341,13 @@ pub struct mbedtls_ssl_session { ///< RFC 5077 session ticket pub private_ticket: *mut ::core::ffi::c_uchar, ///< session ticket length - pub private_ticket_len: usize, - ///< ticket lifetime hint - pub private_ticket_lifetime: u32, - ///< 0: client, 1: server - pub private_endpoint: u8, - ///< Ticket flags - pub private_ticket_flags: u8, + pub private_ticket_len: usize, + ///< ticket lifetime hint + pub private_ticket_lifetime: u32, ///< Randomly generated value used to obscure the age of the ticket pub private_ticket_age_add: u32, + ///< Ticket flags + pub private_ticket_flags: u8, ///< resumption_key length pub private_resumption_key_len: u8, pub private_resumption_key: [::core::ffi::c_uchar; 48usize], @@ -21579,22 +22686,30 @@ pub struct mbedtls_ssl_context { ///number of retransmissions of request if ///renego_max_records is < 0 pub private_renego_records_seen: ::core::ffi::c_int, - /// Server: Negotiated TLS protocol version. - /// Client: Maximum TLS version to be negotiated, then negotiated TLS - /// version. - /// - /// It is initialized as the maximum TLS version to be negotiated in the - /// ClientHello writing preparation stage and used throughout the - /// ClientHello writing. For a fresh handshake not linked to any previous - /// handshake, it is initialized to the configured maximum TLS version - /// to be negotiated. When renegotiating or resuming a session, it is - /// initialized to the previously negotiated TLS version. - /// - /// Updated to the negotiated TLS version as soon as the ServerHello is - /// received. + /// Maximum TLS version to be negotiated, then negotiated TLS version. + /// + /// It is initialized as the configured maximum TLS version to be + /// negotiated by mbedtls_ssl_setup(). + /// + /// When renegotiating or resuming a session, it is overwritten in the + /// ClientHello writing preparation stage with the previously negotiated + /// TLS version. + /// + /// On client side, it is updated to the TLS version selected by the server + /// for the handshake when the ServerHello is received. + /// + /// On server side, it is updated to the TLS version the server selects for + /// the handshake when the ClientHello is received. pub private_tls_version: mbedtls_ssl_protocol_version, - ///< records with a bad MAC received - pub private_badmac_seen: ::core::ffi::c_uint, + /// Multipurpose field. + /// + /// - DTLS: records with a bad MAC received. + /// - TLS: accumulated length of handshake fragments (up to \c in_hslen). + /// + /// This field is multipurpose in order to preserve the ABI in the + /// Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + /// and called `badmac_seen`. + pub private_badmac_seen_or_in_hsfraglen: ::core::ffi::c_uint, /// Callback to customize X.509 certificate chain verification pub private_f_vrfy: ::core::option::Option< unsafe extern "C" fn( @@ -21731,8 +22846,33 @@ pub struct mbedtls_ssl_context { pub private_cur_out_ctr: [::core::ffi::c_uchar; 8usize], ///< path mtu, used to fragment outgoing messages pub private_mtu: u16, - ///< expected peer CN for verification - ///(and SNI if available) + /// Expected peer CN for verification. + /// + /// Also used on clients for SNI, + /// and for TLS 1.3 session resumption using tickets. + /// + /// The value of this field can be: + /// - \p NULL in a newly initialized or reset context. + /// - A heap-allocated copy of the last value passed to + /// mbedtls_ssl_set_hostname(), if the last call had a non-null + /// \p hostname argument. + /// - A special value to indicate that mbedtls_ssl_set_hostname() + /// was called with \p NULL (as opposed to never having been called). + /// See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + /// + /// If this field contains the value \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is unset, on a TLS client, attempting to verify a server certificate + /// results in the error + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + /// + /// If this field contains the special value described above, or if + /// the value is \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is set, then the peer name verification is skipped, which may be + /// insecure, especially on a client. Furthermore, on a client, the + /// server_name extension is not sent, and the server name is ignored + /// in TLS 1.3 session resumption using tickets. pub private_hostname: *mut ::core::ffi::c_char, ///< negotiated protocol pub private_alpn_chosen: *const ::core::ffi::c_char, @@ -21828,6 +22968,14 @@ unsafe extern "C" { /// Calling mbedtls_ssl_setup again is not supported, even /// if no session is active. /// + /// \warning After setting up a client context, if certificate-based + /// authentication is enabled, you should call + /// mbedtls_ssl_set_hostname() to specifiy the expected + /// name of the server. Without this, in most scenarios, + /// the TLS connection is insecure. See + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more information. + /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. @@ -21931,18 +23079,16 @@ unsafe extern "C" { unsafe extern "C" { /// \brief Set the random number generator callback /// + /// \note The callback with its parameter must remain valid as + /// long as there is an SSL context that uses the + /// SSL configuration. + /// /// \param conf SSL configuration /// \param f_rng RNG function (mandatory) /// \param p_rng RNG parameter pub fn mbedtls_ssl_conf_rng( conf: *mut mbedtls_ssl_config, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ); } @@ -22045,10 +23191,10 @@ unsafe extern "C" { /// \param own_cid The address of the readable buffer holding the CID we want /// the peer to use when sending encrypted messages to us. /// This may be \c NULL if \p own_cid_len is \c 0. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// \param own_cid_len The length of \p own_cid. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// /// \note The value of \p own_cid_len must match the value of the @@ -22703,16 +23849,16 @@ unsafe extern "C" { /// a full handshake. /// /// \note This function can handle a variety of mechanisms for session - /// resumption: For TLS 1.2, both session ID-based resumption and - /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and loading - /// one or more sessions via this call will lead to their - /// corresponding tickets being advertised as resumption PSKs - /// by the client. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// resumption: For TLS 1.2, both session ID-based resumption + /// and ticket-based resumption will be considered. For TLS 1.3, + /// sessions equate to tickets, and loading one session by + /// calling this function will lead to its corresponding ticket + /// being advertised as resumption PSK by the client. This + /// depends on session tickets being enabled (see + /// #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + /// If session tickets are disabled, a call to this function + /// with a TLS 1.3 session, will not have any effect on the next + /// handshake for the SSL context \p ssl. /// /// \param ssl The SSL context representing the connection which should /// be attempted to be setup using session resumption. This @@ -22727,9 +23873,10 @@ unsafe extern "C" { /// /// \return \c 0 if successful. /// \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session - /// could not be loaded because of an implementation limitation. - /// This error is non-fatal, and has no observable effect on - /// the SSL context or the session that was attempted to be loaded. + /// could not be loaded because one session has already been + /// loaded. This error is non-fatal, and has no observable + /// effect on the SSL context or the session that was attempted + /// to be loaded. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_get_session() @@ -22787,8 +23934,8 @@ unsafe extern "C" { /// /// \param session The session structure to be saved. /// \param buf The buffer to write the serialized data to. It must be a - /// writeable buffer of at least \p len bytes, or may be \c - /// NULL if \p len is \c 0. + /// writeable buffer of at least \p buf_len bytes, or may be \c + /// NULL if \p buf_len is \c 0. /// \param buf_len The number of bytes available for writing in \p buf. /// \param olen The size in bytes of the data that has been or would have /// been written. It must point to a valid \c size_t. @@ -22798,8 +23945,16 @@ unsafe extern "C" { /// to determine the necessary size by calling this function /// with \p buf set to \c NULL and \p buf_len to \c 0. /// + /// \note For TLS 1.3 sessions, this feature is supported only if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + /// as in TLS 1.3 session resumption is possible only with + /// tickets. + /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + /// and the session is a TLS 1.3 session. pub fn mbedtls_ssl_session_save( session: *const mbedtls_ssl_session, buf: *mut ::core::ffi::c_uchar, @@ -22925,7 +24080,7 @@ unsafe extern "C" { /// record headers. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len /// is too large. pub fn mbedtls_ssl_conf_cid( conf: *mut mbedtls_ssl_config, @@ -23252,6 +24407,8 @@ unsafe extern "C" { /// used for certificate signature are controlled by the /// verification profile, see \c mbedtls_ssl_conf_cert_profile(). /// + /// \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + /// /// \note This list should be ordered by decreasing preference /// (preferred hash first). /// @@ -23276,27 +24433,43 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Configure allowed signature algorithms for use in TLS 1.3 + /// \brief Configure allowed signature algorithms for use in TLS /// /// \param conf The SSL configuration to use. /// \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, - /// terminated by \c MBEDTLS_TLS1_3_SIG_NONE. The list must remain - /// available throughout the lifetime of the conf object. Supported - /// values are available as \c MBEDTLS_TLS1_3_SIG_XXXX + /// terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + /// available throughout the lifetime of the conf object. + /// - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + /// used. + /// - For TLS 1.2, values should be given as + /// "(HashAlgorithm << 8) | SignatureAlgorithm". pub fn mbedtls_ssl_conf_sig_algs(conf: *mut mbedtls_ssl_config, sig_algs: *const u16); } unsafe extern "C" { /// \brief Set or reset the hostname to check against the received - /// server certificate. It sets the ServerName TLS extension, - /// too, if that extension is enabled. (client-side only) + /// peer certificate. On a client, this also sets the + /// ServerName TLS extension, if that extension is enabled. + /// On a TLS 1.3 client, this also sets the server name in + /// the session resumption ticket, if that feature is enabled. /// /// \param ssl SSL context - /// \param hostname the server hostname, may be NULL to clear hostname - /// - /// \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. - /// - /// \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on - /// allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + /// \param hostname The server hostname. This may be \c NULL to clear + /// the hostname. + /// + /// \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + /// + /// \note If the hostname is \c NULL on a client, then the server + /// is not authenticated: it only needs to have a valid + /// certificate, not a certificate matching its name. + /// Therefore you should always call this function on a client, + /// unless the connection is set up to only allow + /// pre-shared keys, or in scenarios where server + /// impersonation is not a concern. See the documentation of + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more details. + /// + /// \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + /// allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on /// too long input hostname. /// /// Hostname set to the one provided on success (cleared @@ -23309,8 +24482,8 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief Retrieve SNI extension value for the current handshake. - /// Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), - /// this is the same value passed to \p f_sni callback of + /// Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + /// this is the same value passed to \c f_sni callback of /// \c mbedtls_ssl_conf_sni() and may be used instead of /// \c mbedtls_ssl_conf_sni(). /// @@ -23319,10 +24492,10 @@ unsafe extern "C" { /// 0 if SNI extension is not present or not yet processed. /// /// \return const pointer to SNI extension value. - /// - value is valid only when called in \p f_cert_cb + /// - value is valid only when called in \c f_cert_cb /// registered with \c mbedtls_ssl_conf_cert_cb(). /// - value is NULL if SNI extension is not present. - /// - value is not '\0'-terminated. Use \c name_len for len. + /// - value is not '\0'-terminated. Use \c name_len for len. /// - value must not be freed. pub fn mbedtls_ssl_get_hs_sni( ssl: *mut mbedtls_ssl_context, @@ -23572,6 +24745,10 @@ unsafe extern "C" { /// with \c mbedtls_ssl_read()), not handshake messages. /// With DTLS, this affects both ApplicationData and handshake. /// + /// \note Defragmentation of TLS handshake messages is supported + /// with some limitations. See the documentation of + /// mbedtls_ssl_handshake() for details. + /// /// \note This sets the maximum length for a record's payload, /// excluding record overhead that will be added to it, see /// \c mbedtls_ssl_get_record_expansion(). @@ -23605,19 +24782,48 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Enable / Disable session tickets (client only). - /// (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + /// \brief Enable / Disable TLS 1.2 session tickets (client only, + /// TLS 1.2 only). Enabled by default. /// /// \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). /// /// \param conf SSL configuration - /// \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or - /// MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + /// \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) pub fn mbedtls_ssl_conf_session_tickets( conf: *mut mbedtls_ssl_config, use_tickets: ::core::ffi::c_int, ); } +unsafe extern "C" { + /// \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + /// (client only, TLS 1.3 only). + /// + /// The handling of TLS 1.3 NewSessionTicket messages is disabled by + /// default. + /// + /// In TLS 1.3, servers may send a NewSessionTicket message at any time, + /// and may send multiple NewSessionTicket messages. By default, TLS 1.3 + /// clients ignore NewSessionTicket messages. + /// + /// To support session tickets in TLS 1.3 clients, call this function + /// with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + /// this is enabled, when a client receives a NewSessionTicket message, + /// the next call to a message processing functions (notably + /// mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + /// call mbedtls_ssl_get_session() to retrieve the session ticket before + /// calling the same message processing function again. + /// + /// \param conf SSL configuration + /// \param signal_new_session_tickets Enable or disable + /// (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + pub fn mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + conf: *mut mbedtls_ssl_config, + signal_new_session_tickets: ::core::ffi::c_int, + ); +} unsafe extern "C" { /// \brief Number of NewSessionTicket messages for the server to send /// after handshake completion. @@ -23946,29 +25152,22 @@ unsafe extern "C" { /// \param ssl The SSL context representing the connection for which to /// to export a session structure for later resumption. /// \param session The target structure in which to store the exported session. - /// This must have been initialized with mbedtls_ssl_init_session() + /// This must have been initialized with mbedtls_ssl_session_init() /// but otherwise be unused. /// /// \note This function can handle a variety of mechanisms for session /// resumption: For TLS 1.2, both session ID-based resumption and /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and calling - /// this function multiple times will export the available - /// tickets one a time until no further tickets are available, - /// in which case MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE will - /// be returned. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// sessions equate to tickets, and if session tickets are + /// enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + /// option), this function exports the last received ticket and + /// the exported session may be used to resume the TLS 1.3 + /// session. If session tickets are disabled, exported sessions + /// cannot be used to resume a TLS 1.3 session. /// /// \return \c 0 if successful. In this case, \p session can be used for /// session resumption by passing it to mbedtls_ssl_set_session(), /// and serialized for storage via mbedtls_ssl_session_save(). - /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no further session - /// is available for export. - /// This error is a non-fatal, and has no observable effect on - /// the SSL context or the destination session. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_set_session() @@ -24000,6 +25199,17 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use /// and the client did not demonstrate reachability yet - in /// this case you must stop using the context (see below). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24008,7 +25218,9 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24028,10 +25240,31 @@ unsafe extern "C" { /// currently being processed might or might not contain further /// DTLS records. /// - /// \note If the context is configured to allow TLS 1.3, or if - /// #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. + /// Otherwise, the handshake may call psa_crypto_init() + /// if a negotiation involving TLS 1.3 takes place (this may + /// be the case even if TLS 1.3 is offered but eventually + /// not selected). + /// + /// \note In TLS, reception of fragmented handshake messages is + /// supported with some limitations (those limitations do + /// not apply to DTLS, where defragmentation is fully + /// supported): + /// - On an Mbed TLS server that only accepts TLS 1.2, + /// the initial ClientHello message must not be fragmented. + /// A TLS 1.2 ClientHello may be fragmented if the server + /// also accepts TLS 1.3 connections (meaning + /// that #MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the + /// accepted versions have not been restricted with + /// mbedtls_ssl_conf_max_tls_version() or the like). + /// - The first fragment of a handshake message must be + /// at least 4 bytes long. + /// - Non-handshake records must not be interleaved between + /// the fragments of a handshake message. (This is permitted + /// in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + /// even in TLS 1.2.) pub fn mbedtls_ssl_handshake(ssl: *mut mbedtls_ssl_context) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -24060,8 +25293,10 @@ unsafe extern "C" { /// /// \warning If this function returns something other than \c 0, /// #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using /// the SSL context for reading or writing, and either free it /// or call \c mbedtls_ssl_session_reset() on it before /// re-using it for a new connection; the current connection @@ -24124,6 +25359,24 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server /// side of a DTLS connection and the client is initiating a /// new connection using the same source port. See below. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. + /// This error code is only returned on the client side. It is + /// only returned if handling of TLS 1.3 NewSessionTicket + /// messages has been enabled through + /// mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + /// This error code indicates that a TLS 1.3 NewSessionTicket + /// message has been received and parsed successfully by the + /// client. The ticket data can be retrieved from the SSL + /// context by calling mbedtls_ssl_get_session(). It remains + /// available until the next call to mbedtls_ssl_read(). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24132,8 +25385,10 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24200,6 +25455,17 @@ unsafe extern "C" { /// operation is in progress (see mbedtls_ecp_set_max_ops()) - /// in this case you must call this function again to complete /// the handshake when you're done attending other tasks. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24207,8 +25473,10 @@ unsafe extern "C" { /// a non-negative value, /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24449,381 +25717,64 @@ unsafe extern "C" { /// \brief Free an SSL configuration context /// /// \param conf SSL configuration context - pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); -} -unsafe extern "C" { - /// \brief Initialize SSL session structure - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief Free referenced items in an SSL session including the - /// peer certificate and clear memory - /// - /// \note A session object can be freed even if the SSL context - /// that was used to retrieve the session is still in use. - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief TLS-PRF function for key derivation. - /// - /// \param prf The tls_prf type function type to be used. - /// \param secret Secret for the key derivation function. - /// \param slen Length of the secret. - /// \param label String label for the key derivation function, - /// terminated with null character. - /// \param random Random bytes. - /// \param rlen Length of the random bytes buffer. - /// \param dstbuf The buffer holding the derived key. - /// \param dlen Length of the output buffer. - /// - /// \return 0 on success. An SSL specific error on failure. - pub fn mbedtls_ssl_tls_prf( - prf: mbedtls_tls_prf_types, - secret: *const ::core::ffi::c_uchar, - slen: usize, - label: *const ::core::ffi::c_char, - random: *const ::core::ffi::c_uchar, - rlen: usize, - dstbuf: *mut ::core::ffi::c_uchar, - dlen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the threshold error level to handle globally all debug output. - /// Debug messages that have a level over the threshold value are - /// discarded. - /// (Default value: 0 = No debug ) - /// - /// \param threshold threshold level of messages to filter on. Messages at a - /// higher level will be discarded. - /// - Debug levels - /// - 0 No debug - /// - 1 Error - /// - 2 State change - /// - 3 Informational - /// - 4 Verbose - pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); -} -unsafe extern "C" { - /// \brief Print a message to the debug output. This function is always used - /// through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl - /// context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the message has occurred in - /// \param line line number the message has occurred at - /// \param format format specifier, in printf format - /// \param ... variables used by the format specifier - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_msg( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - format: *const ::core::ffi::c_char, - ... - ); -} -unsafe extern "C" { - /// \brief Print the return value of a function to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text the name of the function that returned the error - /// \param ret the return code value - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ret( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - ret: ::core::ffi::c_int, - ); -} -unsafe extern "C" { - /// \brief Output a buffer of size len bytes to the debug output. This function - /// is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the buffer being dumped. Normally the - /// variable or buffer name - /// \param buf the buffer to be outputted - /// \param len length of the buffer - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_buf( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - buf: *const ::core::ffi::c_uchar, - len: usize, - ); -} -unsafe extern "C" { - /// \brief Print a MPI variable to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the MPI being output. Normally the - /// variable name - /// \param X the MPI variable - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_mpi( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_mpi, - ); -} -unsafe extern "C" { - /// \brief Print an ECP point to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the ECP point being output. Normally the - /// variable name - /// \param X the ECP point - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ecp( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_ecp_point, - ); -} -unsafe extern "C" { - /// \brief Print a X.509 certificate structure to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the certificate being output - /// \param crt X.509 certificate structure - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_crt( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - crt: *const mbedtls_x509_crt, - ); -} -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Q: mbedtls_debug_ecdh_attr = 0; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_QP: mbedtls_debug_ecdh_attr = 1; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Z: mbedtls_debug_ecdh_attr = 2; -pub type mbedtls_debug_ecdh_attr = ::core::ffi::c_uint; -unsafe extern "C" { - /// \brief Print a field of the ECDH structure in the SSL context to the debug - /// output. This function is always used through the - /// MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file - /// and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param ecdh the ECDH context - /// \param attr the identifier of the attribute being output - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_printf_ecdh( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - ecdh: *const mbedtls_ecdh_context, - attr: mbedtls_debug_ecdh_attr, - ); -} -/// \brief Entropy poll callback pointer -/// -/// \param data Callback-specific data pointer -/// \param output Data to fill -/// \param len Maximum size to provide -/// \param olen The actual amount of bytes put into the buffer (Can be 0) -/// -/// \return 0 if no critical failures occurred, -/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise -pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< - unsafe extern "C" fn( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - ) -> ::core::ffi::c_int, ->; -/// \brief Entropy source state -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_source_state { - ///< The entropy source callback - pub private_f_source: mbedtls_entropy_f_source_ptr, - ///< The callback data pointer - pub private_p_source: *mut ::core::ffi::c_void, - ///< Amount received in bytes - pub private_size: usize, - ///< Minimum bytes required before release - pub private_threshold: usize, - ///< Is the source strong? - pub private_strong: ::core::ffi::c_int, -} -impl Default for mbedtls_entropy_source_state { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief Entropy context structure -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_context { - pub private_accumulator_started: ::core::ffi::c_int, - pub __bindgen_padding_0: u64, - pub private_accumulator: mbedtls_sha512_context, - pub private_source_count: ::core::ffi::c_int, - pub private_source: [mbedtls_entropy_source_state; 20usize], -} -impl Default for mbedtls_entropy_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize the context - /// - /// \param ctx Entropy context to initialize - pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Free the data in the context - /// - /// \param ctx Entropy context to free - pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Adds an entropy source to poll - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context - /// \param f_source Entropy function - /// \param p_source Function data - /// \param threshold Minimum required from source before entropy is released - /// ( with mbedtls_entropy_func() ) (in bytes) - /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or - /// MBEDTLS_ENTROPY_SOURCE_WEAK. - /// At least one strong source needs to be added. - /// Weaker sources (such as the cycle counter) can be used as - /// a complement. - /// - /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES - pub fn mbedtls_entropy_add_source( - ctx: *mut mbedtls_entropy_context, - f_source: mbedtls_entropy_f_source_ptr, - p_source: *mut ::core::ffi::c_void, - threshold: usize, - strong: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); } unsafe extern "C" { - /// \brief Trigger an extra gather poll for the accumulator - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context + /// \brief Initialize SSL session structure /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Retrieve entropy from the accumulator - /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief Free referenced items in an SSL session including the + /// peer certificate and clear memory /// - /// \param data Entropy context - /// \param output Buffer to fill - /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + /// \note A session object can be freed even if the SSL context + /// that was used to retrieve the session is still in use. /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_func( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Add data to the accumulator manually - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief TLS-PRF function for key derivation. /// - /// \param ctx Entropy context - /// \param data Data to add - /// \param len Length of data + /// \param prf The tls_prf type function type to be used. + /// \param secret Secret for the key derivation function. + /// \param slen Length of the secret. + /// \param label String label for the key derivation function, + /// terminated with null character. + /// \param random Random bytes. + /// \param rlen Length of the random bytes buffer. + /// \param dstbuf The buffer holding the derived key. + /// \param dlen Length of the output buffer. /// - /// \return 0 if successful - pub fn mbedtls_entropy_update_manual( - ctx: *mut mbedtls_entropy_context, - data: *const ::core::ffi::c_uchar, - len: usize, + /// \return 0 on success. An SSL specific error on failure. + pub fn mbedtls_ssl_tls_prf( + prf: mbedtls_tls_prf_types, + secret: *const ::core::ffi::c_uchar, + slen: usize, + label: *const ::core::ffi::c_char, + random: *const ::core::ffi::c_uchar, + rlen: usize, + dstbuf: *mut ::core::ffi::c_uchar, + dlen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Checkup routine - /// - /// This module self-test also calls the entropy self-test, - /// mbedtls_entropy_source_self_test(); + /// \brief Set the threshold error level to handle globally all debug output. + /// Debug messages that have a level over the threshold value are + /// discarded. + /// (Default value: 0 = No debug ) /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; + /// \param threshold threshold level of messages to filter on. Messages at a + /// higher level will be discarded. + /// - Debug levels + /// - 0 No debug + /// - 1 Error + /// - 2 State change + /// - 3 Informational + /// - 4 Verbose + pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); } unsafe extern "C" { /// \brief This is the HMAC-based Extract-and-Expand Key Derivation Function @@ -24992,8 +25943,8 @@ unsafe extern "C" { /// \param len The length of the personalization string. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + /// where \c entropy_len is the entropy length /// described above. /// /// \return \c 0 if successful. @@ -25118,8 +26069,8 @@ unsafe extern "C" { /// \param len The length of the additional data. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length /// (see mbedtls_hmac_drbg_set_entropy_len()). /// /// \return \c 0 if successful. @@ -25602,6 +26553,28 @@ unsafe extern "C" { oid: *const mbedtls_asn1_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate a string containing a dotted-decimal + /// representation of an ASN.1 OID into its encoded form + /// (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + /// On success, this function allocates oid->buf from the + /// heap. It must be freed by the caller using mbedtls_free(). + /// + /// \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + /// \param oid_str string representation of the OID to parse + /// \param size length of the OID string, not including any null terminator + /// + /// \return 0 if successful + /// \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + /// represent a valid OID + /// \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + /// allocate oid->buf + pub fn mbedtls_oid_from_numeric_string( + oid: *mut mbedtls_asn1_buf, + oid_str: *const ::core::ffi::c_char, + size: usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate an X.509 extension OID into local values /// @@ -25679,6 +26652,34 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate AlgorithmIdentifier OID into an EC group identifier, + /// for curves that are directly encoded at this level + /// + /// \param oid OID to use + /// \param grp_id place to store group id + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_ec_grp_algid( + oid: *const mbedtls_asn1_buf, + grp_id: *mut mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Translate EC group identifier into AlgorithmIdentifier OID, + /// for curves that are directly encoded at this level + /// + /// \param grp_id EC group identifier + /// \param oid place to store ASN.1 OID string pointer + /// \param olen length of the OID + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_oid_by_ec_grp_algid( + grp_id: mbedtls_ecp_group_id, + oid: *mut *const ::core::ffi::c_char, + olen: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate SignatureAlgorithm OID into md_type and pk_type /// @@ -25846,11 +26847,11 @@ unsafe extern "C" { /// \param data source data to look in (must be nul-terminated) /// \param pwd password for decryption (can be NULL) /// \param pwdlen length of password - /// \param use_len destination for total length used (set after header is - /// correctly read, so unless you get + /// \param use_len destination for total length used from data buffer. It is + /// set after header is correctly read, so unless you get /// MBEDTLS_ERR_PEM_BAD_INPUT_DATA or /// MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is - /// the length to skip) + /// the length to skip. /// /// \note Attempts to check password correctness by verifying if /// the decrypted text starts with an ASN.1 sequence of @@ -25915,13 +26916,40 @@ unsafe extern "C" { unsafe extern "C" { /// \brief PKCS#5 PBES2 function /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs5_pbes2_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params the ASN.1 algorithm parameters - /// \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT /// \param pwd password to use when generating key /// \param pwdlen length of password /// \param data data to process /// \param datalen length of data - /// \param output output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. pub fn mbedtls_pkcs5_pbes2( @@ -25934,6 +26962,50 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief PKCS#5 PBES2 function + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params the ASN.1 algorithm parameters + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + /// \param pwd password to use when generating key + /// \param pwdlen length of password + /// \param data data to process + /// \param datalen length of data + /// \param output Output buffer. + /// On success, it contains the decrypted data. + /// On failure, the content is indetermidate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + pub fn mbedtls_pkcs5_pbes2_ext( + pbe_params: *const mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, + datalen: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context /// @@ -26165,6 +27237,25 @@ unsafe extern "C" { /// \brief PKCS12 Password Based function (encryption / decryption) /// for cipher-based and mbedtls_md-based PBE's /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs12_pbe_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or /// #MBEDTLS_PKCS12_PBE_DECRYPT @@ -26173,9 +27264,17 @@ unsafe extern "C" { /// \param pwd Latin1-encoded password used. This may only be \c NULL when /// \p pwdlen is 0. No null terminator should be used. /// \param pwdlen length of the password (may be 0) - /// \param input the input data + /// \param data the input data /// \param len data length - /// \param output the output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \return 0 if successful, or a MBEDTLS_ERR_XXX code pub fn mbedtls_pkcs12_pbe( @@ -26185,9 +27284,62 @@ unsafe extern "C" { md_type: mbedtls_md_type_t, pwd: *const ::core::ffi::c_uchar, pwdlen: usize, - input: *const ::core::ffi::c_uchar, + data: *const ::core::ffi::c_uchar, + len: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief PKCS12 Password Based function (encryption / decryption) + /// for cipher-based and mbedtls_md-based PBE's + /// + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + /// #MBEDTLS_PKCS12_PBE_DECRYPT + /// \param cipher_type the cipher used + /// \param md_type the mbedtls_md used + /// \param pwd Latin1-encoded password used. This may only be \c NULL when + /// \p pwdlen is 0. No null terminator should be used. + /// \param pwdlen length of the password (may be 0) + /// \param data the input data + /// \param len data length + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \return 0 if successful, or a MBEDTLS_ERR_XXX code + pub fn mbedtls_pkcs12_pbe_ext( + pbe_params: *mut mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + cipher_type: mbedtls_cipher_type_t, + md_type: mbedtls_md_type_t, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, len: usize, output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -26286,6 +27438,11 @@ unsafe extern "C" { /// \param session_id_len The length of \p session_id in bytes. /// \param session The address at which to store the session /// associated with \p session_id, if present. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + /// no cache entry with specified session ID found, or + /// any other negative error code for other failures. pub fn mbedtls_ssl_cache_get( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26302,6 +27459,9 @@ unsafe extern "C" { /// associated to \p session. /// \param session_id_len The length of \p session_id in bytes. /// \param session The session to store. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_set( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26315,12 +27475,13 @@ unsafe extern "C" { /// /// \param data The SSL cache context to use. /// \param session_id The pointer to the buffer holding the session ID - /// associated to \p session. + /// associated to session. /// \param session_id_len The length of \p session_id in bytes. /// - /// \return 0: The cache entry for session with provided ID - /// is removed or does not exist. - /// Otherwise: fail. + /// \return \c 0 on success. This indicates the cache entry for + /// the session with provided ID is removed or does not + /// exist. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_remove( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26373,13 +27534,7 @@ unsafe extern "C" { /// \brief Setup cookie context (generate keys) pub fn mbedtls_ssl_cookie_setup( ctx: *mut mbedtls_ssl_cookie_ctx, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26425,6 +27580,9 @@ unsafe extern "C" { #[derive(Copy, Clone)] pub struct mbedtls_ssl_ticket_key { pub private_name: [::core::ffi::c_uchar; 4usize], + /// Lifetime of the key in seconds. This is also the lifetime of the + /// tickets created under that key. + pub private_lifetime: u32, ///< context for auth enc/decryption pub private_ctx: mbedtls_cipher_context_t, } @@ -26480,7 +27638,9 @@ unsafe extern "C" { /// /// \param ctx Context to be set up /// \param f_rng RNG callback function (mandatory) - /// \param p_rng RNG callback context + /// \param p_rng RNG callback context. + /// Note that the RNG callback must remain valid + /// until the ticket context is freed. /// \param cipher AEAD cipher to use for ticket protection. /// Recommended value: MBEDTLS_CIPHER_AES_256_GCM. /// \param lifetime Tickets lifetime in seconds @@ -26490,21 +27650,21 @@ unsafe extern "C" { /// least as strong as the strongest ciphersuite /// supported. Usually that means a 256-bit key. /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_setup( ctx: *mut mbedtls_ssl_ticket_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, cipher: mbedtls_cipher_type_t, lifetime: u32, @@ -26535,10 +27695,16 @@ unsafe extern "C" { /// \note \c klength must be sufficient for use by cipher specified /// to \c mbedtls_ssl_ticket_setup /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_rotate( @@ -26604,7 +27770,7 @@ pub struct mbedtls_x509_csr { pub key_usage: ::core::ffi::c_uint, ///< Optional Netscape certificate type extension value: See the values in x509.h pub ns_cert_type: ::core::ffi::c_uchar, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions pub private_ext_types: ::core::ffi::c_int, @@ -26644,25 +27810,12 @@ impl Default for mbedtls_x509write_csr { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_x509_san_list { - pub node: mbedtls_x509_subject_alternative_name, - pub next: *mut mbedtls_x509_san_list, -} -impl Default for mbedtls_x509_san_list { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR) in DER format /// - /// \note CSR attributes (if any) are currently silently ignored. + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the CSR is rejected. /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling @@ -26679,6 +27832,70 @@ unsafe extern "C" { buflen: usize, ) -> ::core::ffi::c_int; } +/// \brief The type of certificate extension callbacks. +/// +/// Callbacks of this type are passed to and used by the +/// mbedtls_x509_csr_parse_der_with_ext_cb() routine when +/// it encounters either an unsupported extension. +/// Future versions of the library may invoke the callback +/// in other cases, if and when the need arises. +/// +/// \param p_ctx An opaque context passed to the callback. +/// \param csr The CSR being parsed. +/// \param oid The OID of the extension. +/// \param critical Whether the extension is critical. +/// \param p Pointer to the start of the extension value +/// (the content of the OCTET STRING). +/// \param end End of extension value. +/// +/// \note The callback must fail and return a negative error code +/// if it can not parse or does not support the extension. +/// When the callback fails to parse a critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() also fails. +/// When the callback fails to parse a non critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() simply skips +/// the extension and continues parsing. +/// +/// \return \c 0 on success. +/// \return A negative error code on failure. +pub type mbedtls_x509_csr_ext_cb_t = ::core::option::Option< + unsafe extern "C" fn( + p_ctx: *mut ::core::ffi::c_void, + csr: *const mbedtls_x509_csr, + oid: *const mbedtls_x509_buf, + critical: ::core::ffi::c_int, + p: *const ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +unsafe extern "C" { + /// \brief Load a Certificate Signing Request (CSR) in DER format + /// + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the result of the callback function decides whether + /// CSR is rejected. + /// + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. + /// + /// \param csr CSR context to fill + /// \param buf buffer holding the CRL data + /// \param buflen size of the buffer + /// \param cb A callback invoked for every unsupported certificate + /// extension. + /// \param p_ctx An opaque context passed to the callback. + /// + /// \return 0 if successful, or a specific X509 error code + pub fn mbedtls_x509_csr_parse_der_with_ext_cb( + csr: *mut mbedtls_x509_csr, + buf: *const ::core::ffi::c_uchar, + buflen: usize, + cb: mbedtls_x509_csr_ext_cb_t, + p_ctx: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR), DER or PEM format /// @@ -26740,7 +27957,7 @@ unsafe extern "C" { /// \brief Set the subject name for a CSR /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CSR context to use /// \param subject_name subject name to set @@ -26871,13 +28088,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26898,13 +28109,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } diff --git a/esp-mbedtls-sys/src/include/xtensa-esp32s3-none-elf.rs b/esp-mbedtls-sys/src/include/xtensa-esp32s3-none-elf.rs index 8a8f52f3..f6ce94cd 100644 --- a/esp-mbedtls-sys/src/include/xtensa-esp32s3-none-elf.rs +++ b/esp-mbedtls-sys/src/include/xtensa-esp32s3-none-elf.rs @@ -137,6 +137,36 @@ where } } } +#[repr(C)] +#[derive(Default)] +pub struct __IncompleteArrayField(::core::marker::PhantomData, [T; 0]); +impl __IncompleteArrayField { + #[inline] + pub const fn new() -> Self { + __IncompleteArrayField(::core::marker::PhantomData, []) + } + #[inline] + pub fn as_ptr(&self) -> *const T { + self as *const _ as *const T + } + #[inline] + pub fn as_mut_ptr(&mut self) -> *mut T { + self as *mut _ as *mut T + } + #[inline] + pub unsafe fn as_slice(&self, len: usize) -> &[T] { + ::core::slice::from_raw_parts(self.as_ptr(), len) + } + #[inline] + pub unsafe fn as_mut_slice(&mut self, len: usize) -> &mut [T] { + ::core::slice::from_raw_parts_mut(self.as_mut_ptr(), len) + } +} +impl ::core::fmt::Debug for __IncompleteArrayField { + fn fmt(&self, fmt: &mut ::core::fmt::Formatter<'_>) -> ::core::fmt::Result { + fmt.write_str("__IncompleteArrayField") + } +} pub const MBEDTLS_CONFIG_FILE: &[u8; 9] = b"config.h\0"; pub const MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT: u32 = 0; pub const MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: u32 = 1024; @@ -144,14 +174,33 @@ pub const MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE: u32 = 6000; pub const MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH: u32 = 32; pub const MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS: u32 = 1; pub const MBEDTLS_VERSION_MAJOR: u32 = 3; -pub const MBEDTLS_VERSION_MINOR: u32 = 4; -pub const MBEDTLS_VERSION_PATCH: u32 = 0; -pub const MBEDTLS_VERSION_NUMBER: u32 = 50593792; -pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.4.0\0"; -pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"mbed TLS 3.4.0\0"; +pub const MBEDTLS_VERSION_MINOR: u32 = 6; +pub const MBEDTLS_VERSION_PATCH: u32 = 5; +pub const MBEDTLS_VERSION_NUMBER: u32 = 50726144; +pub const MBEDTLS_VERSION_STRING: &[u8; 6] = b"3.6.5\0"; +pub const MBEDTLS_VERSION_STRING_FULL: &[u8; 15] = b"Mbed TLS 3.6.5\0"; +pub const PSA_WANT_ALG_MD5: u32 = 1; +pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; +pub const PSA_WANT_ALG_SHA_1: u32 = 1; +pub const PSA_WANT_ALG_SHA_224: u32 = 1; +pub const PSA_WANT_ALG_SHA_256: u32 = 1; +pub const PSA_WANT_ALG_SHA_384: u32 = 1; +pub const PSA_WANT_ALG_SHA_512: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_256: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_384: u32 = 1; +pub const PSA_WANT_ECC_BRAINPOOL_P_R1_512: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_255: u32 = 1; +pub const PSA_WANT_ECC_MONTGOMERY_448: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_224: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_256: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_384: u32 = 1; +pub const PSA_WANT_ECC_SECP_R1_521: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_192: u32 = 1; +pub const PSA_WANT_ECC_SECP_K1_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CCM: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const PSA_WANT_ALG_CCM_STAR_NO_TAG: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CMAC: u32 = 1; pub const PSA_WANT_ALG_CMAC: u32 = 1; @@ -162,10 +211,40 @@ pub const PSA_WANT_ALG_ECDSA: u32 = 1; pub const PSA_WANT_ALG_ECDSA_ANY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA: u32 = 1; pub const PSA_WANT_ALG_DETERMINISTIC_ECDSA: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const PSA_WANT_ALG_FFDH: u32 = 1; +pub const PSA_WANT_DH_RFC7919_2048: u32 = 1; +pub const PSA_WANT_DH_RFC7919_3072: u32 = 1; +pub const PSA_WANT_DH_RFC7919_4096: u32 = 1; +pub const PSA_WANT_DH_RFC7919_6144: u32 = 1; +pub const PSA_WANT_DH_RFC7919_8192: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_ALG_FFDH: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_GCM: u32 = 1; pub const PSA_WANT_ALG_GCM: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HMAC: u32 = 1; @@ -176,17 +255,16 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXTRACT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND: u32 = 1; pub const PSA_WANT_ALG_HKDF_EXPAND: u32 = 1; +pub const PSA_WANT_KEY_TYPE_HMAC: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF: u32 = 1; pub const PSA_WANT_ALG_TLS12_PRF: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const PSA_WANT_ALG_TLS12_PSK_TO_MS: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_MD5: u32 = 1; -pub const PSA_WANT_ALG_MD5: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_PAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_JPAKE: u32 = 1; pub const PSA_WANT_ALG_JPAKE: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160: u32 = 1; -pub const PSA_WANT_ALG_RIPEMD160: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const PSA_WANT_ALG_RSA_PKCS1V15_CRYPT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN: u32 = 1; @@ -196,20 +274,19 @@ pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP: u32 = 1; pub const PSA_WANT_ALG_RSA_OAEP: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS: u32 = 1; pub const PSA_WANT_ALG_RSA_PSS: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; -pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT: u32 = 1; +pub const PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_1: u32 = 1; -pub const PSA_WANT_ALG_SHA_1: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_224: u32 = 1; -pub const PSA_WANT_ALG_SHA_224: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_256: u32 = 1; -pub const PSA_WANT_ALG_SHA_256: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_384: u32 = 1; -pub const PSA_WANT_ALG_SHA_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_SHA_512: u32 = 1; -pub const PSA_WANT_ALG_SHA_512: u32 = 1; pub const PSA_WANT_KEY_TYPE_AES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES: u32 = 1; pub const PSA_WANT_KEY_TYPE_ARIA: u32 = 1; @@ -221,8 +298,8 @@ pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS: u32 = 1; pub const PSA_WANT_KEY_TYPE_CHACHA20: u32 = 1; -pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20: u32 = 1; +pub const PSA_WANT_ALG_STREAM_CIPHER: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER: u32 = 1; pub const PSA_WANT_ALG_CHACHA20_POLY1305: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305: u32 = 1; @@ -250,8 +327,7 @@ pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192: u32 = 1; pub const MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256: u32 = 1; -pub const PSA_HAVE_FULL_ECDSA: u32 = 1; -pub const PSA_HAVE_FULL_JPAKE: u32 = 1; +pub const PSA_WANT_ALG_SOME_PAKE: u32 = 1; pub const PSA_WANT_KEY_TYPE_DERIVE: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD: u32 = 1; pub const PSA_WANT_KEY_TYPE_PASSWORD_HASH: u32 = 1; @@ -272,7 +348,7 @@ pub const MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: i32 = -12; pub const MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: i32 = -14; pub const MBEDTLS_ERR_MPI_ALLOC_FAILED: i32 = -16; pub const MBEDTLS_MPI_MAX_LIMBS: u32 = 10000; -pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 2; +pub const MBEDTLS_MPI_WINDOW_SIZE: u32 = 3; pub const MBEDTLS_MPI_MAX_SIZE: u32 = 1024; pub const MBEDTLS_MPI_MAX_BITS: u32 = 8192; pub const MBEDTLS_MPI_MAX_BITS_SCALE100: u32 = 819200; @@ -320,6 +396,8 @@ pub const MBEDTLS_CIPHER_VARIABLE_KEY_LEN: u32 = 2; pub const MBEDTLS_MAX_IV_LENGTH: u32 = 16; pub const MBEDTLS_MAX_BLOCK_LENGTH: u32 = 16; pub const MBEDTLS_MAX_KEY_LENGTH: u32 = 64; +pub const MBEDTLS_KEY_BITLEN_SHIFT: u32 = 6; +pub const MBEDTLS_IV_SIZE_SHIFT: u32 = 2; pub const MBEDTLS_CCM_DECRYPT: u32 = 0; pub const MBEDTLS_CCM_ENCRYPT: u32 = 1; pub const MBEDTLS_CCM_STAR_DECRYPT: u32 = 2; @@ -332,7 +410,26 @@ pub const MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: i32 = -84; pub const MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: i32 = -86; pub const MBEDTLS_AES_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_DES3_BLOCK_SIZE: u32 = 8; +pub const MBEDTLS_CMAC_MAX_BLOCK_SIZE: u32 = 16; pub const MBEDTLS_CIPHER_BLKSIZE_MAX: u32 = 16; +pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; +pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; +pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; +pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; +pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; +pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; +pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; +pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; +pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; +pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; +pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; +pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; +pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; +pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; +pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; +pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; +pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; +pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: i32 = -52; pub const MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: i32 = -54; pub const MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: i32 = -56; @@ -367,12 +464,6 @@ pub const MBEDTLS_ECP_MAX_PT_LEN: u32 = 133; pub const MBEDTLS_ECP_PF_UNCOMPRESSED: u32 = 0; pub const MBEDTLS_ECP_PF_COMPRESSED: u32 = 1; pub const MBEDTLS_ECP_TLS_NAMED_CURVE: u32 = 3; -pub const MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: i32 = -20608; -pub const MBEDTLS_ERR_MD_BAD_INPUT_DATA: i32 = -20736; -pub const MBEDTLS_ERR_MD_ALLOC_FAILED: i32 = -20864; -pub const MBEDTLS_ERR_MD_FILE_IO_ERROR: i32 = -20992; -pub const MBEDTLS_MD_MAX_SIZE: u32 = 64; -pub const MBEDTLS_MD_MAX_BLOCK_SIZE: u32 = 128; pub const MBEDTLS_ERR_RSA_BAD_INPUT_DATA: i32 = -16512; pub const MBEDTLS_ERR_RSA_INVALID_PADDING: i32 = -16640; pub const MBEDTLS_ERR_RSA_KEY_GEN_FAILED: i32 = -16768; @@ -387,6 +478,55 @@ pub const MBEDTLS_RSA_PKCS_V21: u32 = 1; pub const MBEDTLS_RSA_SIGN: u32 = 1; pub const MBEDTLS_RSA_CRYPT: u32 = 2; pub const MBEDTLS_RSA_SALT_LEN_ANY: i32 = -1; +pub const MBEDTLS_RSA_GEN_KEY_MIN_BITS: u32 = 1024; +pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; +pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; +pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; +pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; +pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; +pub const PSA_HASH_MAX_SIZE: u32 = 64; +pub const PSA_MAC_MAX_SIZE: u32 = 64; +pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; +pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; +pub const PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS: u32 = 1024; +pub const PSA_VENDOR_FFDH_MAX_KEY_BITS: u32 = 8192; +pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; +pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; +pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; +pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; +pub const PSA_VENDOR_PBKDF2_MAX_ITERATIONS: u32 = 4294967295; +pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; +pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; +pub const PSA_SIGNATURE_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_KEY_PAIR_MAX_SIZE: u32 = 1; +pub const PSA_EXPORT_PUBLIC_KEY_MAX_SIZE: u32 = 1; +pub const PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE: u32 = 1; +pub const PSA_CIPHER_MAX_KEY_LENGTH: u32 = 32; +pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; +pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; +pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; +pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; +pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; +pub const MBEDTLS_ERR_SHA3_BAD_INPUT_DATA: i32 = -118; +pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; +pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; +pub const MBEDTLS_GCM_DECRYPT: u32 = 0; +pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; +pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; +pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; +pub const MBEDTLS_GCM_HTABLE_SIZE: u32 = 16; +pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; +pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; +pub const PSA_MAX_KEY_BITS: u32 = 65528; +pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; +pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; +pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; +pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; +pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; +pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; +pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_ERR_PK_ALLOC_FAILED: i32 = -16256; pub const MBEDTLS_ERR_PK_TYPE_MISMATCH: i32 = -16128; pub const MBEDTLS_ERR_PK_BAD_INPUT_DATA: i32 = -16000; @@ -597,45 +737,6 @@ pub const MBEDTLS_TLS1_3_AES_128_CCM_8_SHA256: u32 = 4869; pub const MBEDTLS_CIPHERSUITE_WEAK: u32 = 1; pub const MBEDTLS_CIPHERSUITE_SHORT_TAG: u32 = 2; pub const MBEDTLS_CIPHERSUITE_NODTLS: u32 = 4; -pub const PSA_CRYPTO_API_VERSION_MAJOR: u32 = 1; -pub const PSA_CRYPTO_API_VERSION_MINOR: u32 = 0; -pub const PSA_MAC_TRUNCATION_OFFSET: u32 = 16; -pub const PSA_AEAD_TAG_LENGTH_OFFSET: u32 = 16; -pub const PSA_HASH_MAX_SIZE: u32 = 64; -pub const PSA_HMAC_MAX_HASH_BLOCK_SIZE: u32 = 128; -pub const PSA_MAC_MAX_SIZE: u32 = 64; -pub const PSA_AEAD_TAG_MAX_SIZE: u32 = 16; -pub const PSA_VENDOR_RSA_MAX_KEY_BITS: u32 = 4096; -pub const PSA_VENDOR_ECC_MAX_CURVE_BITS: u32 = 521; -pub const PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE: u32 = 128; -pub const PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE: u32 = 65; -pub const PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE: u32 = 32; -pub const PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_NONCE_MAX_SIZE: u32 = 13; -pub const PSA_AEAD_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_IV_MAX_SIZE: u32 = 16; -pub const PSA_CIPHER_FINISH_OUTPUT_MAX_SIZE: u32 = 16; -pub const MBEDTLS_GCM_ENCRYPT: u32 = 1; -pub const MBEDTLS_GCM_DECRYPT: u32 = 0; -pub const MBEDTLS_ERR_GCM_AUTH_FAILED: i32 = -18; -pub const MBEDTLS_ERR_GCM_BAD_INPUT: i32 = -20; -pub const MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: i32 = -22; -pub const MBEDTLS_ERR_SHA1_BAD_INPUT_DATA: i32 = -115; -pub const MBEDTLS_ERR_SHA256_BAD_INPUT_DATA: i32 = -116; -pub const MBEDTLS_ERR_SHA512_BAD_INPUT_DATA: i32 = -117; -pub const MBEDTLS_PSA_BUILTIN_CIPHER: u32 = 1; -pub const MBEDTLS_PSA_BUILTIN_AEAD: u32 = 1; -pub const MBEDTLS_PSA_JPAKE_BUFFER_SIZE: u32 = 336; -pub const PSA_MAX_KEY_BITS: u32 = 65528; -pub const MBEDTLS_PSA_KA_MASK_DUAL_USE: u32 = 0; -pub const PSA_CRYPTO_ITS_RANDOM_SEED_UID: u32 = 4294967122; -pub const MBEDTLS_PSA_KEY_SLOT_COUNT: u32 = 32; -pub const PSA_PAKE_OPERATION_STAGE_SETUP: u32 = 0; -pub const PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS: u32 = 1; -pub const PSA_PAKE_OPERATION_STAGE_COMPUTATION: u32 = 2; -pub const PSA_PAKE_OUTPUT_MAX_SIZE: u32 = 65; -pub const PSA_PAKE_INPUT_MAX_SIZE: u32 = 65; pub const MBEDTLS_X509_MAX_INTERMEDIATE_CA: u32 = 8; pub const MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE: i32 = -8320; pub const MBEDTLS_ERR_X509_UNKNOWN_OID: i32 = -8448; @@ -743,7 +844,9 @@ pub const MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: i32 = -30848; pub const MBEDTLS_ERR_SSL_BAD_CERTIFICATE: i32 = -31232; pub const MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET: i32 = -31488; pub const MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA: i32 = -31616; -pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA: i32 = -31744; +pub const MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA: i32 = -31872; +pub const MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND: i32 = -32384; pub const MBEDTLS_ERR_SSL_ALLOC_FAILED: i32 = -32512; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FAILED: i32 = -32640; pub const MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: i32 = -28544; @@ -770,6 +873,7 @@ pub const MBEDTLS_ERR_SSL_EARLY_MESSAGE: i32 = -25728; pub const MBEDTLS_ERR_SSL_UNEXPECTED_CID: i32 = -24576; pub const MBEDTLS_ERR_SSL_VERSION_MISMATCH: i32 = -24320; pub const MBEDTLS_ERR_SSL_BAD_CONFIG: i32 = -24192; +pub const MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME: i32 = -23936; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE: u32 = 1; pub const MBEDTLS_SSL_IANA_TLS_GROUP_NONE: u32 = 0; @@ -841,6 +945,8 @@ pub const MBEDTLS_SSL_TRUNC_HMAC_ENABLED: u32 = 1; pub const MBEDTLS_SSL_TRUNCATED_HMAC_LEN: u32 = 10; pub const MBEDTLS_SSL_SESSION_TICKETS_DISABLED: u32 = 0; pub const MBEDTLS_SSL_SESSION_TICKETS_ENABLED: u32 = 1; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED: u32 = 0; +pub const MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED: u32 = 1; pub const MBEDTLS_SSL_PRESET_DEFAULT: u32 = 0; pub const MBEDTLS_SSL_PRESET_SUITEB: u32 = 2; pub const MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED: u32 = 1; @@ -854,6 +960,9 @@ pub const MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_SERVER: u32 = 0; pub const MBEDTLS_SSL_TLS1_3_TICKET_RESUMPTION_KEY_LEN: u32 = 48; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN: u32 = 1000; pub const MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX: u32 = 60000; +pub const MBEDTLS_SSL_EARLY_DATA_NO_DISCARD: u32 = 0; +pub const MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD: u32 = 1; +pub const MBEDTLS_SSL_EARLY_DATA_DISCARD: u32 = 2; pub const MBEDTLS_SSL_IN_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_OUT_CONTENT_LEN: u32 = 16384; pub const MBEDTLS_SSL_DTLS_MAX_BUFFERING: u32 = 32768; @@ -988,18 +1097,6 @@ pub const MBEDTLS_SSL_UNEXPECTED_CID_IGNORE: u32 = 0; pub const MBEDTLS_SSL_UNEXPECTED_CID_FAIL: u32 = 1; pub const MBEDTLS_PRINTF_SIZET: &[u8; 3] = b"zu\0"; pub const MBEDTLS_PRINTF_LONGLONG: &[u8; 4] = b"lld\0"; -pub const MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: i32 = -60; -pub const MBEDTLS_ERR_ENTROPY_MAX_SOURCES: i32 = -62; -pub const MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: i32 = -64; -pub const MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: i32 = -61; -pub const MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR: i32 = -63; -pub const MBEDTLS_ENTROPY_MAX_SOURCES: u32 = 20; -pub const MBEDTLS_ENTROPY_MAX_GATHER: u32 = 128; -pub const MBEDTLS_ENTROPY_BLOCK_SIZE: u32 = 64; -pub const MBEDTLS_ENTROPY_MAX_SEED_SIZE: u32 = 1024; -pub const MBEDTLS_ENTROPY_SOURCE_MANUAL: u32 = 20; -pub const MBEDTLS_ENTROPY_SOURCE_STRONG: u32 = 1; -pub const MBEDTLS_ENTROPY_SOURCE_WEAK: u32 = 0; pub const MBEDTLS_ERR_HKDF_BAD_INPUT_DATA: i32 = -24448; pub const MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: i32 = -3; pub const MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: i32 = -5; @@ -1041,6 +1138,7 @@ pub const MBEDTLS_OID_X509_EXT_CRL_DISTRIBUTION_POINTS: u32 = 4096; pub const MBEDTLS_OID_X509_EXT_INIHIBIT_ANYPOLICY: u32 = 8192; pub const MBEDTLS_OID_X509_EXT_FRESHEST_CRL: u32 = 16384; pub const MBEDTLS_OID_X509_EXT_NS_CERT_TYPE: u32 = 65536; +pub const MBEDTLS_OID_MAX_COMPONENTS: u32 = 128; pub const MBEDTLS_OID_ISO_MEMBER_BODIES: &[u8; 2] = b"*\0"; pub const MBEDTLS_OID_ISO_IDENTIFIED_ORG: &[u8; 2] = b"+\0"; pub const MBEDTLS_OID_ISO_CCITT_DS: &[u8; 2] = b"U\0"; @@ -1055,6 +1153,8 @@ pub const MBEDTLS_OID_ORG_OIW: &[u8; 2] = b"\x0E\0"; pub const MBEDTLS_OID_OIW_SECSIG: &[u8; 3] = b"\x0E\x03\0"; pub const MBEDTLS_OID_OIW_SECSIG_ALG: &[u8; 4] = b"\x0E\x03\x02\0"; pub const MBEDTLS_OID_OIW_SECSIG_SHA1: &[u8; 5] = b"\x0E\x03\x02\x1A\0"; +pub const MBEDTLS_OID_ORG_THAWTE: &[u8; 2] = b"e\0"; +pub const MBEDTLS_OID_THAWTE: &[u8; 3] = b"+e\0"; pub const MBEDTLS_OID_ORG_CERTICOM: &[u8; 3] = b"\x81\x04\0"; pub const MBEDTLS_OID_CERTICOM: &[u8; 4] = b"+\x81\x04\0"; pub const MBEDTLS_OID_ORG_TELETRUST: &[u8; 2] = b"$\0"; @@ -1153,14 +1253,26 @@ pub const MBEDTLS_OID_DIGEST_ALG_SHA256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x pub const MBEDTLS_OID_DIGEST_ALG_SHA384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x02\0"; pub const MBEDTLS_OID_DIGEST_ALG_SHA512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x03\0"; pub const MBEDTLS_OID_DIGEST_ALG_RIPEMD160: &[u8; 6] = b"+$\x03\x02\x01\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x07\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x08\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\t\0"; +pub const MBEDTLS_OID_DIGEST_ALG_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA1: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x07\0"; pub const MBEDTLS_OID_HMAC_SHA224: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x08\0"; pub const MBEDTLS_OID_HMAC_SHA256: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\t\0"; pub const MBEDTLS_OID_HMAC_SHA384: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\n\0"; pub const MBEDTLS_OID_HMAC_SHA512: &[u8; 9] = b"*\x86H\x86\xF7\r\x02\x0B\0"; +pub const MBEDTLS_OID_HMAC_SHA3_224: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\r\0"; +pub const MBEDTLS_OID_HMAC_SHA3_256: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0E\0"; +pub const MBEDTLS_OID_HMAC_SHA3_384: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x0F\0"; +pub const MBEDTLS_OID_HMAC_SHA3_512: &[u8; 10] = b"`\x86H\x01e\x03\x04\x02\x10\0"; +pub const MBEDTLS_OID_HMAC_RIPEMD160: &[u8; 9] = b"+\x06\x01\x05\x05\x08\x01\x04\0"; pub const MBEDTLS_OID_DES_CBC: &[u8; 6] = b"+\x0E\x03\x02\x07\0"; pub const MBEDTLS_OID_DES_EDE3_CBC: &[u8; 9] = b"*\x86H\x86\xF7\r\x03\x07\0"; pub const MBEDTLS_OID_AES: &[u8; 9] = b"`\x86H\x01e\x03\x04\x01\0"; +pub const MBEDTLS_OID_AES_128_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x02\0"; +pub const MBEDTLS_OID_AES_192_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x16\0"; +pub const MBEDTLS_OID_AES_256_CBC: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01*\0"; pub const MBEDTLS_OID_AES128_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x05\0"; pub const MBEDTLS_OID_AES128_KWP: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x08\0"; pub const MBEDTLS_OID_AES192_KW: &[u8; 10] = b"`\x86H\x01e\x03\x04\x01\x19\0"; @@ -1213,6 +1325,10 @@ pub const MBEDTLS_OID_ECDSA_SHA224: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x01\0"; pub const MBEDTLS_OID_ECDSA_SHA256: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x02\0"; pub const MBEDTLS_OID_ECDSA_SHA384: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x03\0"; pub const MBEDTLS_OID_ECDSA_SHA512: &[u8; 9] = b"*\x86H\xCE=\x04\x03\x04\0"; +pub const MBEDTLS_OID_X25519: &[u8; 4] = b"+en\0"; +pub const MBEDTLS_OID_X448: &[u8; 4] = b"+eo\0"; +pub const MBEDTLS_OID_ED25519: &[u8; 4] = b"+ep\0"; +pub const MBEDTLS_OID_ED448: &[u8; 4] = b"+eq\0"; pub const MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT: i32 = -4224; pub const MBEDTLS_ERR_PEM_INVALID_DATA: i32 = -4352; pub const MBEDTLS_ERR_PEM_ALLOC_FAILED: i32 = -4480; @@ -1226,8 +1342,6 @@ pub const MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA: i32 = -12160; pub const MBEDTLS_ERR_PKCS5_INVALID_FORMAT: i32 = -12032; pub const MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE: i32 = -11904; pub const MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH: i32 = -11776; -pub const MBEDTLS_PKCS5_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS5_ENCRYPT: u32 = 1; pub const MBEDTLS_ERR_PKCS7_INVALID_FORMAT: i32 = -21248; pub const MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE: i32 = -21376; pub const MBEDTLS_ERR_PKCS7_INVALID_VERSION: i32 = -21504; @@ -1248,8 +1362,6 @@ pub const MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH: i32 = -7680; pub const MBEDTLS_PKCS12_DERIVE_KEY: u32 = 1; pub const MBEDTLS_PKCS12_DERIVE_IV: u32 = 2; pub const MBEDTLS_PKCS12_DERIVE_MAC_KEY: u32 = 3; -pub const MBEDTLS_PKCS12_PBE_DECRYPT: u32 = 0; -pub const MBEDTLS_PKCS12_PBE_ENCRYPT: u32 = 1; pub const MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT: u32 = 86400; pub const MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES: u32 = 50; pub const MBEDTLS_SSL_COOKIE_TIMEOUT: u32 = 60; @@ -1373,6 +1485,59 @@ unsafe extern "C" { /// \param len Length of the buffer in bytes pub fn mbedtls_platform_zeroize(buf: *mut ::core::ffi::c_void, len: usize); } +/// \brief The type of custom random generator (RNG) callbacks. +/// +/// Many Mbed TLS functions take two parameters +/// `mbedtls_f_rng_t *f_rng, void *p_rng`. The +/// library will call \c f_rng to generate +/// random values. +/// +/// \note This is typically one of the following: +/// - mbedtls_ctr_drbg_random() with \c p_rng +/// pointing to a #mbedtls_ctr_drbg_context; +/// - mbedtls_hmac_drbg_random() with \c p_rng +/// pointing to a #mbedtls_hmac_drbg_context; +/// - mbedtls_psa_get_random() with +/// `prng = MBEDTLS_PSA_RANDOM_STATE`. +/// +/// \note Generally, given a call +/// `mbedtls_foo(f_rng, p_rng, ....)`, the RNG callback +/// and the context only need to remain valid until +/// the call to `mbedtls_foo` returns. However, there +/// are a few exceptions where the callback is stored +/// in for future use. Check the documentation of +/// the calling function. +/// +/// \warning In a multithreaded environment, calling the +/// function should be thread-safe. The standard +/// functions provided by the library are thread-safe +/// when #MBEDTLS_THREADING_C is enabled. +/// +/// \warning This function must either provide as many +/// bytes as requested of **cryptographic quality** +/// random data, or return a negative error code. +/// +/// \param p_rng The \c p_rng argument that was passed along \c f_rng. +/// The library always passes \c p_rng unchanged. +/// This is typically a pointer to the random generator +/// state, or \c NULL if the custom random generator +/// doesn't need a context-specific state. +/// \param[out] output On success, this must be filled with \p output_size +/// bytes of cryptographic-quality random data. +/// \param output_size The number of bytes to output. +/// +/// \return \c 0 on success, or a negative error code on failure. +/// Library functions will generally propagate this +/// error code, so \c MBEDTLS_ERR_xxx values are +/// recommended. #MBEDTLS_ERR_ENTROPY_SOURCE_FAILED is +/// typically sensible for RNG failures. +pub type mbedtls_f_rng_t = ::core::option::Option< + unsafe extern "C" fn( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + ) -> ::core::ffi::c_int, +>; /// \brief The AES context-type definition. #[repr(C)] #[derive(Copy, Clone)] @@ -1931,6 +2096,10 @@ pub type mbedtls_t_udbl = u64; #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_mpi { + /// Pointer to limbs. + /// + /// This may be \c NULL if \c n is 0. + pub private_p: *mut mbedtls_mpi_uint, /// Sign: -1 if the mpi is negative, 1 otherwise. /// /// The number 0 must be represented with `s = +1`. Although many library @@ -1941,13 +2110,9 @@ pub struct mbedtls_mpi { /// /// Note that this implies that calloc() or `... = {0}` does not create /// a valid MPI representation. You must call mbedtls_mpi_init(). - pub private_s: ::core::ffi::c_int, + pub private_s: ::core::ffi::c_short, /// Total number of limbs in \c p. - pub private_n: usize, - /// Pointer to limbs. - /// - /// This may be \c NULL if \c n is 0. - pub private_p: *mut mbedtls_mpi_uint, + pub private_n: ::core::ffi::c_ushort, } impl Default for mbedtls_mpi { fn default() -> Self { @@ -2222,7 +2387,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2239,7 +2404,7 @@ unsafe extern "C" { /// \param X The destination MPI. This must point to an initialized MPI. /// \param buf The input buffer. This must be a readable buffer of length /// \p buflen Bytes. - /// \param buflen The length of the input buffer \p p in Bytes. + /// \param buflen The length of the input buffer \p buf in Bytes. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -2294,6 +2459,8 @@ unsafe extern "C" { /// \brief Perform a left-shift on an MPI: X <<= count /// /// \param X The MPI to shift. This must point to an initialized MPI. + /// The MPI pointed by \p X may be resized to fit + /// the resulting number. /// \param count The number of bits to shift by. /// /// \return \c 0 if successful. @@ -2586,7 +2753,7 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Perform a sliding-window exponentiation: X = A^E mod N + /// \brief Perform a modular exponentiation: X = A^E mod N /// /// \param X The destination MPI. This must point to an initialized MPI. /// This must not alias E or N. @@ -2637,13 +2804,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_fill_random( X: *mut mbedtls_mpi, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2683,13 +2844,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, min: mbedtls_mpi_sint, N: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2697,6 +2852,7 @@ unsafe extern "C" { /// \brief Compute the greatest common divisor: G = gcd(A, B) /// /// \param G The destination MPI. This must point to an initialized MPI. + /// This will always be positive or 0. /// \param A The first operand. This must point to an initialized MPI. /// \param B The second operand. This must point to an initialized MPI. /// @@ -2713,17 +2869,19 @@ unsafe extern "C" { /// \brief Compute the modular inverse: X = A^-1 mod N /// /// \param X The destination MPI. This must point to an initialized MPI. + /// The value returned on success will be between [1, N-1]. /// \param A The MPI to calculate the modular inverse of. This must point - /// to an initialized MPI. + /// to an initialized MPI. This value can be negative, in which + /// case a positive answer will still be returned in \p X. /// \param N The base of the modular inversion. This must point to an - /// initialized MPI. + /// initialized MPI and be greater than one. /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. /// \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than /// or equal to one. - /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - /// with respect to \p N. + /// \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + /// inverse with respect to \p N. pub fn mbedtls_mpi_inv_mod( X: *mut mbedtls_mpi, A: *const mbedtls_mpi, @@ -2746,7 +2904,7 @@ unsafe extern "C" { /// This must point to an initialized MPI. /// \param rounds The number of bases to perform the Miller-Rabin primality /// test for. The probability of returning 0 on a composite is - /// at most 2-2*\p rounds. + /// at most 2-2*\p rounds . /// \param f_rng The RNG function to use. This must not be \c NULL. /// \param p_rng The RNG parameter to be passed to \p f_rng. /// This may be \c NULL if \p f_rng doesn't use @@ -2759,13 +2917,7 @@ unsafe extern "C" { pub fn mbedtls_mpi_is_prime_ext( X: *const mbedtls_mpi, rounds: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -2802,13 +2954,7 @@ unsafe extern "C" { X: *mut mbedtls_mpi, nbits: usize, flags: ::core::ffi::c_int, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -3185,7 +3331,7 @@ unsafe extern "C" { /// on a successful invocation. /// \param end The end of the ASN.1 SEQUENCE container. /// \param tag_must_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_must_value. + /// the SEQUENCE before comparing to \p tag_must_val. /// \param tag_must_val The required value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_must_mask. /// Mismatching tags lead to an error. @@ -3194,7 +3340,7 @@ unsafe extern "C" { /// while a value of \c 0xFF for \p tag_must_mask means /// that \p tag_must_val is the only allowed tag. /// \param tag_may_mask A mask to be applied to the ASN.1 tags found within - /// the SEQUENCE before comparing to \p tag_may_value. + /// the SEQUENCE before comparing to \p tag_may_val. /// \param tag_may_val The desired value of each ASN.1 tag found in the /// SEQUENCE, after masking with \p tag_may_mask. /// Mismatching tags will be silently ignored. @@ -3487,6 +3633,30 @@ unsafe extern "C" { par_len: usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + /// + /// \note This function works backwards in data buffer. + /// + /// \param p The reference to the current position pointer. + /// \param start The start of the buffer, for bounds-checking. + /// \param oid The OID of the algorithm to write. + /// \param oid_len The length of the algorithm's OID. + /// \param par_len The length of the parameters, which must be already written. + /// \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + /// and \p par_len is 0, NULL parameters are added. + /// + /// \return The number of bytes written to \p p on success. + /// \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_asn1_write_algorithm_identifier_ext( + p: *mut *mut ::core::ffi::c_uchar, + start: *const ::core::ffi::c_uchar, + oid: *const ::core::ffi::c_char, + oid_len: usize, + par_len: usize, + has_par: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value /// in ASN.1 format. @@ -3989,32 +4159,17 @@ pub struct mbedtls_cipher_base_t { /// mbedtls_cipher_info_from_type(), /// mbedtls_cipher_info_from_values(), /// mbedtls_cipher_info_from_psa(). +/// +/// \note Some fields store a value that has been right-shifted to save +/// code-size, so should not be used directly. The accessor +/// functions adjust for this and return the "natural" value. #[repr(C)] #[derive(Copy, Clone)] pub struct mbedtls_cipher_info_t { - /// Full cipher identifier. For example, - /// MBEDTLS_CIPHER_AES_256_CBC. - pub private_type: mbedtls_cipher_type_t, - /// The cipher mode. For example, MBEDTLS_MODE_CBC. - pub private_mode: mbedtls_cipher_mode_t, - /// The cipher key length, in bits. This is the - /// default length for variable sized ciphers. - /// Includes parity bits for ciphers like DES. - pub private_key_bitlen: ::core::ffi::c_uint, /// Name of the cipher. pub private_name: *const ::core::ffi::c_char, - /// IV or nonce size, in Bytes. - /// For ciphers that accept variable IV sizes, - /// this is the recommended size. - pub private_iv_size: ::core::ffi::c_uint, - /// Bitflag comprised of MBEDTLS_CIPHER_VARIABLE_IV_LEN and - /// MBEDTLS_CIPHER_VARIABLE_KEY_LEN indicating whether the - /// cipher supports variable IV or variable key sizes, respectively. - pub private_flags: ::core::ffi::c_int, - /// The block size, in Bytes. - pub private_block_size: ::core::ffi::c_uint, - /// Struct for base cipher information and functions. - pub private_base: *const mbedtls_cipher_base_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize]>, } impl Default for mbedtls_cipher_info_t { fn default() -> Self { @@ -4025,46 +4180,321 @@ impl Default for mbedtls_cipher_info_t { } } } -/// Generic cipher context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_cipher_context_t { - /// Information about the associated cipher. - pub private_cipher_info: *const mbedtls_cipher_info_t, - /// Key length to use. - pub private_key_bitlen: ::core::ffi::c_int, - /// Operation that the key of the context has been - /// initialized for. - pub private_operation: mbedtls_operation_t, - /// Padding functions to use, if relevant for - /// the specific cipher mode. - pub private_add_padding: ::core::option::Option< - unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), - >, - pub private_get_padding: ::core::option::Option< - unsafe extern "C" fn( - input: *mut ::core::ffi::c_uchar, - ilen: usize, - data_len: *mut usize, - ) -> ::core::ffi::c_int, - >, - /// Buffer for input that has not been processed yet. - pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], - /// Number of Bytes that have not been processed yet. - pub private_unprocessed_len: usize, - /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number - /// for XTS-mode. - pub private_iv: [::core::ffi::c_uchar; 16usize], - /// IV size in Bytes, for ciphers with variable-length IVs. - pub private_iv_size: usize, - /// The cipher-specific context. - pub private_cipher_ctx: *mut ::core::ffi::c_void, - /// CMAC-specific context. - pub private_cmac_ctx: *mut mbedtls_cmac_context_t, -} -impl Default for mbedtls_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); +impl mbedtls_cipher_info_t { + #[inline] + pub fn private_block_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_block_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_block_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_block_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_size(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(5usize, 3u8) as u32) } + } + #[inline] + pub fn set_private_iv_size(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(5usize, 3u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_size_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 5usize, + 3u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_size_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 5usize, + 3u8, + val as u64, + ) + } + } + #[inline] + pub fn private_key_bitlen(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(8usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_key_bitlen(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(8usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_key_bitlen_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 8usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_key_bitlen_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 8usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_mode(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(12usize, 4u8) as u32) } + } + #[inline] + pub fn set_private_mode(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(12usize, 4u8, val as u64) + } + } + #[inline] + pub unsafe fn private_mode_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 12usize, + 4u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_mode_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 12usize, + 4u8, + val as u64, + ) + } + } + #[inline] + pub fn private_type(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(16usize, 8u8) as u32) } + } + #[inline] + pub fn set_private_type(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(16usize, 8u8, val as u64) + } + } + #[inline] + pub unsafe fn private_type_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 16usize, + 8u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_type_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 16usize, + 8u8, + val as u64, + ) + } + } + #[inline] + pub fn private_flags(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(24usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_flags(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(24usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_flags_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 24usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_flags_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 24usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_base_idx(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(26usize, 5u8) as u32) } + } + #[inline] + pub fn set_private_base_idx(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(26usize, 5u8, val as u64) + } + } + #[inline] + pub unsafe fn private_base_idx_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 4usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 26usize, + 5u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_base_idx_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 4usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 26usize, + 5u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_block_size: ::core::ffi::c_uint, + private_iv_size: ::core::ffi::c_uint, + private_key_bitlen: ::core::ffi::c_uint, + private_mode: ::core::ffi::c_uint, + private_type: ::core::ffi::c_uint, + private_flags: ::core::ffi::c_uint, + private_base_idx: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 4usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 4usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 5u8, { + let private_block_size: u32 = unsafe { ::core::mem::transmute(private_block_size) }; + private_block_size as u64 + }); + __bindgen_bitfield_unit.set(5usize, 3u8, { + let private_iv_size: u32 = unsafe { ::core::mem::transmute(private_iv_size) }; + private_iv_size as u64 + }); + __bindgen_bitfield_unit.set(8usize, 4u8, { + let private_key_bitlen: u32 = unsafe { ::core::mem::transmute(private_key_bitlen) }; + private_key_bitlen as u64 + }); + __bindgen_bitfield_unit.set(12usize, 4u8, { + let private_mode: u32 = unsafe { ::core::mem::transmute(private_mode) }; + private_mode as u64 + }); + __bindgen_bitfield_unit.set(16usize, 8u8, { + let private_type: u32 = unsafe { ::core::mem::transmute(private_type) }; + private_type as u64 + }); + __bindgen_bitfield_unit.set(24usize, 2u8, { + let private_flags: u32 = unsafe { ::core::mem::transmute(private_flags) }; + private_flags as u64 + }); + __bindgen_bitfield_unit.set(26usize, 5u8, { + let private_base_idx: u32 = unsafe { ::core::mem::transmute(private_base_idx) }; + private_base_idx as u64 + }); + __bindgen_bitfield_unit + } +} +/// Generic cipher context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_cipher_context_t { + /// Information about the associated cipher. + pub private_cipher_info: *const mbedtls_cipher_info_t, + /// Key length to use. + pub private_key_bitlen: ::core::ffi::c_int, + /// Operation that the key of the context has been + /// initialized for. + pub private_operation: mbedtls_operation_t, + /// Padding functions to use, if relevant for + /// the specific cipher mode. + pub private_add_padding: ::core::option::Option< + unsafe extern "C" fn(output: *mut ::core::ffi::c_uchar, olen: usize, data_len: usize), + >, + pub private_get_padding: ::core::option::Option< + unsafe extern "C" fn( + input: *mut ::core::ffi::c_uchar, + ilen: usize, + data_len: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int, + >, + /// Buffer for input that has not been processed yet. + pub private_unprocessed_data: [::core::ffi::c_uchar; 16usize], + /// Number of Bytes that have not been processed yet. + pub private_unprocessed_len: usize, + /// Current IV or NONCE_COUNTER for CTR-mode, data unit (or sector) number + /// for XTS-mode. + pub private_iv: [::core::ffi::c_uchar; 16usize], + /// IV size in Bytes, for ciphers with variable-length IVs. + pub private_iv_size: usize, + /// The cipher-specific context. + pub private_cipher_ctx: *mut ::core::ffi::c_void, + /// CMAC-specific context. + pub private_cmac_ctx: *mut mbedtls_cmac_context_t, +} +impl Default for mbedtls_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); s.assume_init() @@ -4132,7 +4562,7 @@ unsafe extern "C" { ) -> *const mbedtls_cipher_info_t; } unsafe extern "C" { - /// \brief This function initializes a \p cipher_context as NONE. + /// \brief This function initializes a \p ctx as NONE. /// /// \param ctx The context to be initialized. This must not be \c NULL. pub fn mbedtls_cipher_init(ctx: *mut mbedtls_cipher_context_t); @@ -4203,7 +4633,6 @@ unsafe extern "C" { /// \brief This function sets the padding mode, for cipher modes /// that use padding. /// - /// The default passing mode is PKCS7 padding. /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a cipher information structure. @@ -4253,23 +4682,24 @@ unsafe extern "C" { /// /// \note With non-AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update() one or more times - /// 4. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update() zero, one or more times; + /// 4. mbedtls_cipher_finish_padded() (recommended for decryption + /// if the mode uses padding) or mbedtls_cipher_finish(). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. /// /// \note With AEAD ciphers, the order of calls for each message /// is as follows: - /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce. - /// 2. mbedtls_cipher_reset() - /// 3. mbedtls_cipher_update_ad() - /// 4. mbedtls_cipher_update() one or more times - /// 5. mbedtls_cipher_finish() + /// 1. mbedtls_cipher_set_iv() if the mode uses an IV/nonce; + /// 2. mbedtls_cipher_reset(); + /// 3. mbedtls_cipher_update_ad(); + /// 4. mbedtls_cipher_update() zero, one or more times; + /// 5. mbedtls_cipher_finish() (or mbedtls_cipher_finish_padded()); /// 6. mbedtls_cipher_check_tag() (for decryption) or - /// mbedtls_cipher_write_tag() (for encryption). + /// mbedtls_cipher_write_tag() (for encryption). /// . /// This sequence can be repeated to encrypt or decrypt multiple /// messages with the same key. @@ -4304,7 +4734,8 @@ unsafe extern "C" { /// many block-sized blocks of data as possible to output. /// Any data that cannot be written immediately is either /// added to the next block, or flushed when - /// mbedtls_cipher_finish() is called. + /// mbedtls_cipher_finish() or mbedtls_cipher_finish_padded() + /// is called. /// Exception: For MBEDTLS_MODE_ECB, expects a single block /// in size. For example, 16 Bytes for AES. /// @@ -4340,12 +4771,30 @@ unsafe extern "C" { /// contained in it is padded to the size of /// the last block, and written to the \p output buffer. /// + /// \warning This function reports invalid padding through an error + /// code. Adversaries may be able to decrypt encrypted + /// data if they can submit chosen ciphertexts and + /// detect whether it has valid padding or not, + /// either through direct observation or through a side + /// channel such as timing. This is known as a + /// padding oracle attack. + /// Therefore applications that call this function for + /// decryption with a cipher that involves padding + /// should take care around error handling. Preferably, + /// such applications should use + /// mbedtls_cipher_finish_padded() instead of this function. + /// /// \param ctx The generic cipher context. This must be initialized and /// bound to a key. /// \param output The buffer to write data to. This needs to be a writable - /// buffer of at least \p block_size Bytes. + /// buffer of at least block_size Bytes. /// \param olen The length of the data written to the \p output buffer. /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// above), although less efficiently than through + /// the invalid-padding condition. /// /// \return \c 0 on success. /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on @@ -4353,7 +4802,8 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption /// expecting a full block but not receiving one. /// \return #MBEDTLS_ERR_CIPHER_INVALID_PADDING on invalid padding - /// while decrypting. + /// while decrypting. Note that invalid-padding errors + /// should be handled carefully; see the warning above. /// \return A cipher-specific error code on failure. pub fn mbedtls_cipher_finish( ctx: *mut mbedtls_cipher_context_t, @@ -4361,10 +4811,60 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief The generic cipher finalization function. If data still + /// needs to be flushed from an incomplete block, the data + /// contained in it is padded to the size of + /// the last block, and written to the \p output buffer. + /// + /// \note This function is similar to mbedtls_cipher_finish(). + /// The only difference is that it reports invalid padding + /// decryption differently, through the \p invalid_padding + /// parameter rather than an error code. + /// For encryption, and in modes without padding (including + /// all authenticated modes), this function is identical + /// to mbedtls_cipher_finish(). + /// + /// \param[in,out] ctx The generic cipher context. This must be initialized and + /// bound to a key. + /// \param[out] output The buffer to write data to. This needs to be a writable + /// buffer of at least block_size Bytes. + /// \param[out] olen The length of the data written to the \p output buffer. + /// This may not be \c NULL. + /// Note that when decrypting in a mode with padding, + /// the actual output length is sensitive and may be + /// used to mount a padding oracle attack (see warning + /// on mbedtls_cipher_finish()). + /// \param[out] invalid_padding + /// If this function returns \c 0 on decryption, + /// \p *invalid_padding is \c 0 if the ciphertext was + /// valid, and all-bits-one if the ciphertext had invalid + /// padding. + /// On encryption, or in a mode without padding (including + /// all authenticated modes), \p *invalid_padding is \c 0 + /// on success. + /// The value in \p *invalid_padding is unspecified if + /// this function returns a nonzero status. + /// + /// \return \c 0 on success. + /// Also \c 0 for decryption with invalid padding. + /// \return #MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA on + /// parameter-verification failure. + /// \return #MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED on decryption + /// expecting a full block but not receiving one. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_cipher_finish_padded( + ctx: *mut mbedtls_cipher_context_t, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + invalid_padding: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief This function writes a tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized, /// bound to a key, and have just completed a cipher @@ -4385,7 +4885,8 @@ unsafe extern "C" { unsafe extern "C" { /// \brief This function checks the tag for AEAD ciphers. /// Currently supported with GCM and ChaCha20+Poly1305. - /// This must be called after mbedtls_cipher_finish(). + /// This must be called after mbedtls_cipher_finish() + /// or mbedtls_cipher_finish_padded(). /// /// \param ctx The generic cipher context. This must be initialized. /// \param tag The buffer holding the tag. This must be a readable @@ -4570,8 +5071,6 @@ pub struct mbedtls_ccm_context { pub private_y: [::core::ffi::c_uchar; 16usize], ///< The counter buffer pub private_ctr: [::core::ffi::c_uchar; 16usize], - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Total plaintext length pub private_plaintext_len: usize, ///< Total authentication data length @@ -4586,16 +5085,17 @@ pub struct mbedtls_ccm_context { ///auth data input is finished. pub private_processed: usize, ///< The Q working value - pub private_q: ::core::ffi::c_uchar, + pub private_q: ::core::ffi::c_uint, ///< The operation to perform: ///#MBEDTLS_CCM_ENCRYPT or ///#MBEDTLS_CCM_DECRYPT or ///#MBEDTLS_CCM_STAR_ENCRYPT or ///#MBEDTLS_CCM_STAR_DECRYPT. - pub private_mode: ::core::ffi::c_uchar, + pub private_mode: ::core::ffi::c_uint, + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, ///< Working value holding context's - ///state. Used for chunked data - ///input + ///state. Used for chunked data input pub private_state: ::core::ffi::c_int, } impl Default for mbedtls_ccm_context { @@ -5838,47 +6338,59 @@ unsafe extern "C" { /// \return \c 1 on failure. pub fn mbedtls_cmac_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -/// \brief The CTR_DRBG context structure. +///< None. +pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; +///< The MD5 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 3; +///< The RIPEMD-160 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 4; +///< The SHA-1 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 5; +///< The SHA-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 8; +///< The SHA-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 9; +///< The SHA-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 10; +///< The SHA-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 11; +///< The SHA3-224 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_224: mbedtls_md_type_t = 16; +///< The SHA3-256 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_256: mbedtls_md_type_t = 17; +///< The SHA3-384 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_384: mbedtls_md_type_t = 18; +///< The SHA3-512 message digest. +pub const mbedtls_md_type_t_MBEDTLS_MD_SHA3_512: mbedtls_md_type_t = 19; +/// \brief Supported message digests. +/// +/// \warning MD5 and SHA-1 are considered weak message digests and +/// their use constitutes a security risk. We recommend considering +/// stronger message digests instead. +pub type mbedtls_md_type_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct mbedtls_ctr_drbg_context { - ///< The counter (V). - pub private_counter: [::core::ffi::c_uchar; 16usize], - ///< The reseed counter. - /// This is the number of requests that have - /// been made since the last (re)seeding, - /// minus one. - /// Before the initial seeding, this field - /// contains the amount of entropy in bytes - /// to use as a nonce for the initial seeding, - /// or -1 if no nonce length has been explicitly - /// set (see mbedtls_ctr_drbg_set_nonce_len()). - pub private_reseed_counter: ::core::ffi::c_int, - ///< This determines whether prediction - ///resistance is enabled, that is - ///whether to systematically reseed before - ///each random generation. - pub private_prediction_resistance: ::core::ffi::c_int, - ///< The amount of entropy grabbed on each - ///seed or reseed operation, in bytes. - pub private_entropy_len: usize, - ///< The reseed interval. - /// This is the maximum number of requests - /// that can be made between reseedings. - pub private_reseed_interval: ::core::ffi::c_int, - ///< The AES context. - pub private_aes_ctx: mbedtls_aes_context, - pub private_f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - ///< The context for the entropy function. - pub private_p_entropy: *mut ::core::ffi::c_void, +pub struct mbedtls_md_info_t { + _unused: [u8; 0], } -impl Default for mbedtls_ctr_drbg_context { +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; +pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; +/// Used internally to indicate whether a context uses legacy or PSA. +/// +/// Internal use only. +pub type mbedtls_md_engine_t = ::core::ffi::c_uint; +/// The generic message-digest context. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md_context_t { + /// Information about the associated message digest. + pub private_md_info: *const mbedtls_md_info_t, + /// The digest-specific context (legacy) or the PSA operation. + pub private_md_ctx: *mut ::core::ffi::c_void, + /// The HMAC part of the context. + pub private_hmac_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_md_context_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -5888,4389 +6400,3745 @@ impl Default for mbedtls_ctr_drbg_context { } } unsafe extern "C" { - /// \brief This function initializes the CTR_DRBG context, - /// and prepares it for mbedtls_ctr_drbg_seed() - /// or mbedtls_ctr_drbg_free(). + /// \brief This function returns the message-digest information + /// associated with the given digest type. /// - /// \note The reseed interval is - /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. - /// You can override it by calling - /// mbedtls_ctr_drbg_set_reseed_interval(). + /// \param md_type The type of digest to search for. /// - /// \param ctx The CTR_DRBG context to initialize. - pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); + /// \return The message-digest information associated with \p md_type. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// - The \p custom string. - /// - /// \note To achieve the nominal security strength permitted - /// by CTR_DRBG, the entropy length must be: - /// - at least 16 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 32 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// In addition, if you do not pass a nonce in \p custom, - /// the sum of the entropy length - /// and the entropy nonce length must be: - /// - at least 24 bytes for a 128-bit strength - /// (maximum achievable strength when using AES-128); - /// - at least 48 bytes for a 256-bit strength - /// (maximum achievable strength when using AES-256). - /// - /// \param ctx The CTR_DRBG context to seed. - /// It must have been initialized with - /// mbedtls_ctr_drbg_init(). - /// After a successful call to mbedtls_ctr_drbg_seed(), - /// you may not call mbedtls_ctr_drbg_seed() again on - /// the same context unless you call - /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() - /// again first. - /// After a failed call to mbedtls_ctr_drbg_seed(), - /// you must call mbedtls_ctr_drbg_free(). - /// \param f_entropy The entropy callback, taking as arguments the - /// \p p_entropy context, the buffer to fill, and the - /// length of the buffer. - /// \p f_entropy is always called with a buffer size - /// less than or equal to the entropy length. - /// \param p_entropy The entropy context to pass to \p f_entropy. - /// \param custom The personalization string. - /// This can be \c NULL, in which case the personalization - /// string is empty regardless of the value of \p len. - /// \param len The length of the personalization string. - /// This must be at most - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function initializes a message-digest context without + /// binding it to a particular message-digest algorithm. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_seed( - ctx: *mut mbedtls_ctr_drbg_context, - f_entropy: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_entropy: *mut ::core::ffi::c_void, - custom: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// This function should always be called first. It prepares the + /// context for mbedtls_md_setup() for binding it to a + /// message-digest algorithm. + pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function resets CTR_DRBG context to the state immediately - /// after initial call of mbedtls_ctr_drbg_init(). + /// \brief This function clears the internal structure of \p ctx and + /// frees any embedded internal structure, but does not free + /// \p ctx itself. /// - /// \param ctx The CTR_DRBG context to clear. - pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); + /// If you have called mbedtls_md_setup() on \p ctx, you must + /// call mbedtls_md_free() when you are no longer using the + /// context. + /// Calling this function if you have previously + /// called mbedtls_md_init() and nothing else is optional. + /// You must not call this function if you have not called + /// mbedtls_md_init(). + pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); } unsafe extern "C" { - /// \brief This function turns prediction resistance on or off. - /// The default value is off. + /// \brief This function selects the message digest algorithm to use, + /// and allocates internal structures. /// - /// \note If enabled, entropy is gathered at the beginning of - /// every call to mbedtls_ctr_drbg_random_with_add() - /// or mbedtls_ctr_drbg_random(). - /// Only use this if your entropy source has sufficient - /// throughput. + /// It should be called after mbedtls_md_init() or + /// mbedtls_md_free(). Makes it necessary to call + /// mbedtls_md_free() later. /// - /// \param ctx The CTR_DRBG context. - /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. - pub fn mbedtls_ctr_drbg_set_prediction_resistance( - ctx: *mut mbedtls_ctr_drbg_context, - resistance: ::core::ffi::c_int, - ); + /// \param ctx The context to set up. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), + /// or non-zero: HMAC is used with this context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. + pub fn mbedtls_md_setup( + ctx: *mut mbedtls_md_context_t, + md_info: *const mbedtls_md_info_t, + hmac: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed on each - /// seed or reseed. - /// - /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// \brief This function clones the state of a message-digest + /// context. /// - /// \note The security strength of CTR_DRBG is bounded by the - /// entropy length. Thus: - /// - When using AES-256 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, - /// which is the default), - /// \p len must be at least 32 (in bytes) - /// to achieve a 256-bit strength. - /// - When using AES-128 - /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) - /// \p len must be at least 16 (in bytes) - /// to achieve a 128-bit strength. + /// \note You must call mbedtls_md_setup() on \c dst before calling + /// this function. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. - pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); -} -unsafe extern "C" { - /// \brief This function sets the amount of entropy grabbed - /// as a nonce for the initial seeding. + /// \note The two contexts must have the same type, + /// for example, both are SHA-256. /// - /// Call this function before calling mbedtls_ctr_drbg_seed() to read - /// a nonce from the entropy source during the initial seeding. + /// \warning This function clones the message-digest state, not the + /// HMAC state. /// - /// \param ctx The CTR_DRBG context. - /// \param len The amount of entropy to grab for the nonce, in bytes. - /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - /// and at most the maximum length accepted by the - /// entropy function that is set in the context. + /// \param dst The destination context. + /// \param src The context to be cloned. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is - /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED - /// if the initial seeding has already taken place. - pub fn mbedtls_ctr_drbg_set_nonce_len( - ctx: *mut mbedtls_ctr_drbg_context, - len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. + /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are + /// not using the same engine. This can be avoided by moving + /// the call to psa_crypto_init() before the first call to + /// mbedtls_md_setup(). + pub fn mbedtls_md_clone( + dst: *mut mbedtls_md_context_t, + src: *const mbedtls_md_context_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the reseed interval. - /// - /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() - /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function - /// is called again. + /// \brief This function extracts the message-digest size from the + /// message-digest information structure. /// - /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param interval The reseed interval. - pub fn mbedtls_ctr_drbg_set_reseed_interval( - ctx: *mut mbedtls_ctr_drbg_context, - interval: ::core::ffi::c_int, - ); + /// \return The size of the message-digest output in Bytes. + pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; } unsafe extern "C" { - /// \brief This function reseeds the CTR_DRBG context, that is - /// extracts data from the entropy source. + /// \brief This function extracts the message-digest type from the + /// message-digest information structure. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// \param md_info The information structure of the message-digest algorithm + /// to use. /// - /// \param ctx The CTR_DRBG context. - /// \param additional Additional data to add to the state. Can be \c NULL. - /// \param len The length of the additional data. - /// This must be less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \return The type of the message digest. + pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; +} +unsafe extern "C" { + /// \brief This function starts a message-digest computation. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. - pub fn mbedtls_ctr_drbg_reseed( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// You must call this function after setting up the context + /// with mbedtls_md_setup(), and before passing data with + /// mbedtls_md_update(). + /// + /// \param ctx The generic message-digest context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates the state of the CTR_DRBG context. + /// \brief This function feeds an input buffer into an ongoing + /// message-digest computation. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// You must call mbedtls_md_starts() before calling this + /// function. You may call this function multiple times. + /// Afterwards, call mbedtls_md_finish(). /// - /// \param ctx The CTR_DRBG context. - /// \param additional The data to update the state with. This must not be - /// \c NULL unless \p add_len is \c 0. - /// \param add_len Length of \p additional in bytes. This must be at - /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \param ctx The generic message-digest context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if - /// \p add_len is more than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. - /// \return An error from the underlying AES cipher on failure. - pub fn mbedtls_ctr_drbg_update( - ctx: *mut mbedtls_ctr_drbg_context, - additional: *const ::core::ffi::c_uchar, - add_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function updates a CTR_DRBG instance with additional - /// data and uses it to generate random data. - /// - /// This function automatically reseeds if the reseed counter is exceeded - /// or prediction resistance is enabled. + /// \brief This function finishes the digest operation, + /// and writes the result to the output buffer. /// - /// \note This function is not thread-safe. It is not safe - /// to call this function if another thread might be - /// concurrently obtaining random numbers from the same - /// context or updating or reseeding the same context. + /// Call this function after a call to mbedtls_md_starts(), + /// followed by any number of calls to mbedtls_md_update(). + /// Afterwards, you may either clear the context with + /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse + /// the context for another digest operation with the same + /// algorithm. /// - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. - /// \param additional Additional data to update. Can be \c NULL, in which - /// case the additional data is empty regardless of - /// the value of \p add_len. - /// \param add_len The length of the additional data - /// if \p additional is not \c NULL. - /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT - /// and less than - /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len - /// where \c entropy_len is the entropy length - /// configured for the context. + /// \param ctx The generic message-digest context. + /// \param output The buffer for the generic message-digest checksum result. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random_with_add( - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_finish( + ctx: *mut mbedtls_md_context_t, output: *mut ::core::ffi::c_uchar, - output_len: usize, - additional: *const ::core::ffi::c_uchar, - add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \param p_rng The CTR_DRBG context. This must be a pointer to a - /// #mbedtls_ctr_drbg_context structure. - /// \param output The buffer to fill. - /// \param output_len The length of the buffer in bytes. + /// \brief This function calculates the message-digest of a buffer, + /// with respect to a configurable message-digest algorithm + /// in a single call. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or - /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. - pub fn mbedtls_ctr_drbg_random( - p_rng: *mut ::core::ffi::c_void, + /// The result is calculated as + /// Output = message_digest(input buffer). + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param input The buffer holding the data. + /// \param ilen The length of the input data. + /// \param output The generic message-digest checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md( + md_info: *const mbedtls_md_info_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, output: *mut ::core::ffi::c_uchar, - output_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The CTR_DRBG checkup routine. + /// \brief This function returns the list of digests supported by the + /// generic digest module. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< Curve not defined. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; -///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; -///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; -///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; -///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; -///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; -///< Domain parameters for 256-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; -///< Domain parameters for 384-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; -///< Domain parameters for 512-bit Brainpool curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; -///< Domain parameters for Curve25519. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; -///< Domain parameters for 192-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; -///< Domain parameters for 224-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; -///< Domain parameters for 256-bit "Koblitz" curve. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; -///< Domain parameters for Curve448. -pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; -/// Domain-parameter identifiers: curve, subgroup, and generator. -/// -/// \note Only curves over prime fields are supported. -/// -/// \warning This library does not support validation of arbitrary domain -/// parameters. Therefore, only standardized domain parameters from trusted -/// sources should be used. See mbedtls_ecp_group_load(). -pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; -pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; -pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_NONE: mbedtls_ecp_modulus_type = 0; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_COORDINATE: mbedtls_ecp_modulus_type = 1; -pub const mbedtls_ecp_modulus_type_MBEDTLS_ECP_MOD_SCALAR: mbedtls_ecp_modulus_type = 2; -pub type mbedtls_ecp_modulus_type = ::core::ffi::c_uint; -/// Curve information, for use by other modules. -/// -/// The fields of this structure are part of the public API and can be -/// accessed directly by applications. Future versions of the library may -/// add extra fields or reorder existing fields. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_curve_info { - ///< An internal identifier. - pub grp_id: mbedtls_ecp_group_id, - ///< The TLS NamedCurve identifier. - pub tls_id: u16, - ///< The curve size in bits. - pub bit_size: u16, - ///< A human-friendly name. - pub name: *const ::core::ffi::c_char, + /// \note The list starts with the strongest available hashes. + /// + /// \return A statically allocated array of digests. Each element + /// in the returned list is an integer belonging to the + /// message-digest enumeration #mbedtls_md_type_t. + /// The last entry is 0. + pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; } -impl Default for mbedtls_ecp_curve_info { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief This function returns the message-digest information + /// associated with the given digest name. + /// + /// \param md_name The name of the digest to search for. + /// + /// \return The message-digest information associated with \p md_name. + /// \return NULL if the associated message-digest information is not found. + pub fn mbedtls_md_info_from_string( + md_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_md_info_t; } -/// \brief The ECP point structure, in Jacobian coordinates. -/// -/// \note All functions expect and return points satisfying -/// the following condition: Z == 0 or -/// Z == 1. Other values of \p Z are -/// used only by internal functions. -/// The point is zero, or "at infinity", if Z == 0. -/// Otherwise, \p X and \p Y are its standard (affine) -/// coordinates. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_point { - ///< The X coordinate of the ECP point. - pub private_X: mbedtls_mpi, - ///< The Y coordinate of the ECP point. - pub private_Y: mbedtls_mpi, - ///< The Z coordinate of the ECP point. - pub private_Z: mbedtls_mpi, -} -impl Default for mbedtls_ecp_point { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief The ECP group structure. -/// -/// We consider two types of curve equations: -///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P -/// (SEC1 + RFC-4492)
            • -///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, -/// Curve448)
          -/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. -/// -/// For Short Weierstrass, this subgroup is the whole curve, and its -/// cardinality is denoted by \p N. Our code requires that \p N is an -/// odd prime as mbedtls_ecp_mul() requires an odd number, and -/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. -/// -/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, -/// which is the quantity used in the formulas. Additionally, \p nbits is -/// not the size of \p N but the required size for private keys. -/// -/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. -/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the -/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer -/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits -/// in size, so that it may be efficiently brought in the 0..P-1 range by a few -/// additions or subtractions. Therefore, it is only an approximative modular -/// reduction. It must return 0 on success and non-zero on failure. -/// -/// \note Alternative implementations of the ECP module must obey the -/// following constraints. -/// * Group IDs must be distinct: if two group structures have -/// the same ID, then they must be identical. -/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, -/// \c pbits and \c nbits must have the same type and semantics -/// as in the built-in implementation. -/// They must be available for reading, but direct modification -/// of these fields does not need to be supported. -/// They do not need to be at the same offset in the structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_group { - ///< An internal group identifier. - pub id: mbedtls_ecp_group_id, - ///< The prime modulus of the base field. - pub P: mbedtls_mpi, - ///< For Short Weierstrass: \p A in the equation. For - ///Montgomery curves: (A + 2) / 4. - pub A: mbedtls_mpi, - ///< For Short Weierstrass: \p B in the equation. - ///For Montgomery curves: unused. - pub B: mbedtls_mpi, - ///< The generator of the subgroup used. - pub G: mbedtls_ecp_point, - ///< The order of \p G. - pub N: mbedtls_mpi, - ///< The number of bits in \p P. - pub pbits: usize, - ///< For Short Weierstrass: The number of bits in \p P. - ///For Montgomery curves: the number of bits in the - ///private keys. - pub nbits: usize, - ///< \internal 1 if the constants are static. - pub private_h: ::core::ffi::c_uint, - ///< The function for fast pseudo-reduction - ///mod \p P (see above). - pub private_modp: - ::core::option::Option ::core::ffi::c_int>, - ///< Unused. - pub private_t_pre: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_post: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut mbedtls_ecp_point, - arg2: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int, - >, - ///< Unused. - pub private_t_data: *mut ::core::ffi::c_void, - ///< Pre-computed points for ecp_mul_comb(). - pub private_T: *mut mbedtls_ecp_point, - ///< The number of dynamic allocated pre-computed points. - pub private_T_size: usize, -} -impl Default for mbedtls_ecp_group { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; -/// \brief The ECP key-pair structure. -/// -/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. -/// -/// \note Members are deliberately in the same order as in the -/// ::mbedtls_ecdsa_context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecp_keypair { - ///< Elliptic curve and base point - pub private_grp: mbedtls_ecp_group, - ///< our secret value - pub private_d: mbedtls_mpi, - ///< our public value - pub private_Q: mbedtls_ecp_point, -} -impl Default for mbedtls_ecp_keypair { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +unsafe extern "C" { + /// \brief This function returns the name of the message digest for + /// the message-digest information structure given. + /// + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// + /// \return The name of the message digest. + pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; } unsafe extern "C" { - /// \brief This function retrieves the information defined in - /// mbedtls_ecp_curve_info() for all supported curves. + /// \brief This function returns the message-digest information + /// from the given context. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// \param ctx The context from which to extract the information. + /// This must be initialized (or \c NULL). /// - /// \return A statically allocated array. The last entry is 0. - pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; + /// \return The message-digest information associated with \p ctx. + /// \return \c NULL if \p ctx is \c NULL. + pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; } unsafe extern "C" { - /// \brief This function retrieves the list of internal group - /// identifiers of all supported curves in the order of - /// preference. + /// \brief This function sets the HMAC key and prepares to + /// authenticate a new message. /// - /// \note This function returns information about all curves - /// supported by the library. Some curves may not be - /// supported for all algorithms. Call mbedtls_ecdh_can_do() - /// or mbedtls_ecdsa_can_do() to check if a curve is - /// supported for ECDH or ECDSA. + /// Call this function after mbedtls_md_setup(), to use + /// the MD context for an HMAC calculation, then call + /// mbedtls_md_hmac_update() to provide the input data, and + /// mbedtls_md_hmac_finish() to get the HMAC value. /// - /// \return A statically allocated array, - /// terminated with MBEDTLS_ECP_DP_NONE. - pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC key in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_starts( + ctx: *mut mbedtls_md_context_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from an internal - /// group identifier. + /// \brief This function feeds an input buffer into an ongoing HMAC + /// computation. /// - /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() + /// before calling this function. + /// You may call this function multiple times to pass the + /// input piecewise. + /// Afterwards, call mbedtls_md_hmac_finish(). /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_grp_id( - grp_id: mbedtls_ecp_group_id, - ) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_update( + ctx: *mut mbedtls_md_context_t, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a TLS - /// NamedCurve value. + /// \brief This function finishes the HMAC operation, and writes + /// the result to the output buffer. /// - /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. + /// Call this function after mbedtls_md_hmac_starts() and + /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards + /// you may either call mbedtls_md_free() to clear the context, + /// or call mbedtls_md_hmac_reset() to reuse the context with + /// the same HMAC key. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; + /// \param ctx The message digest context containing an embedded HMAC + /// context. + /// \param output The generic HMAC checksum result. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_finish( + ctx: *mut mbedtls_md_context_t, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves curve information from a - /// human-readable name. + /// \brief This function prepares to authenticate a new message with + /// the same key as the previous HMAC operation. /// - /// \param name The human-readable name. + /// You may call this function after mbedtls_md_hmac_finish(). + /// Afterwards call mbedtls_md_hmac_update() to pass the new + /// input. /// - /// \return The associated curve information on success. - /// \return NULL on failure. - pub fn mbedtls_ecp_curve_info_from_name( - name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ecp_curve_info; -} -unsafe extern "C" { - /// \brief This function initializes a point as zero. + /// \param ctx The message digest context containing an embedded HMAC + /// context. /// - /// \param pt The point to initialize. - pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECP group context - /// without loading any domain parameters. + /// \brief This function calculates the full generic HMAC + /// on the input buffer with the provided key. /// - /// \note After this function is called, domain parameters - /// for various ECP groups can be loaded through the - /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() - /// functions. - pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); -} -unsafe extern "C" { - /// \brief This function initializes a key pair as an invalid one. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param key The key pair to initialize. - pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); -} -unsafe extern "C" { - /// \brief This function frees the components of a point. + /// The HMAC result is calculated as + /// output = generic HMAC(hmac key, input buffer). /// - /// \param pt The point to free. - pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); -} -unsafe extern "C" { - /// \brief This function frees the components of an ECP group. + /// \param md_info The information structure of the message-digest algorithm + /// to use. + /// \param key The HMAC secret key. + /// \param keylen The length of the HMAC secret key in Bytes. + /// \param input The buffer holding the input data. + /// \param ilen The length of the input data. + /// \param output The generic HMAC result. /// - /// \param grp The group to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP group. - pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification + /// failure. + pub fn mbedtls_md_hmac( + md_info: *const mbedtls_md_info_t, + key: *const ::core::ffi::c_uchar, + keylen: usize, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function frees the components of a key pair. - /// - /// \param key The key pair to free. This may be \c NULL, in which - /// case this function returns immediately. If it is not - /// \c NULL, it must point to an initialized ECP key pair. - pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +/// \brief Entropy poll callback pointer +/// +/// \param data Callback-specific data pointer +/// \param output Data to fill +/// \param len Maximum size to provide +/// \param olen The actual amount of bytes put into the buffer (Can be 0) +/// +/// \return 0 if no critical failures occurred, +/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise +pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< + unsafe extern "C" fn( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + ) -> ::core::ffi::c_int, +>; +/// \brief Entropy source state +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_source_state { + ///< The entropy source callback + pub private_f_source: mbedtls_entropy_f_source_ptr, + ///< The callback data pointer + pub private_p_source: *mut ::core::ffi::c_void, + ///< Amount received in bytes + pub private_size: usize, + ///< Minimum bytes required before release + pub private_threshold: usize, + ///< Is the source strong? + pub private_strong: ::core::ffi::c_int, } -unsafe extern "C" { - /// \brief This function copies the contents of point \p Q into - /// point \p P. - /// - /// \param P The destination point. This must be initialized. - /// \param Q The source point. This must be initialized. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code for other kinds of failure. - pub fn mbedtls_ecp_copy( - P: *mut mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_entropy_source_state { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +/// \brief Entropy context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_entropy_context { + pub private_accumulator: mbedtls_md_context_t, + pub private_accumulator_started: ::core::ffi::c_int, + pub private_source_count: ::core::ffi::c_int, + pub private_source: [mbedtls_entropy_source_state; 20usize], +} +impl Default for mbedtls_entropy_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function copies the contents of group \p src into - /// group \p dst. - /// - /// \param dst The destination group. This must be initialized. - /// \param src The source group. This must be initialized. + /// \brief Initialize the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_copy( - dst: *mut mbedtls_ecp_group, - src: *const mbedtls_ecp_group, - ) -> ::core::ffi::c_int; + /// \param ctx Entropy context to initialize + pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function sets a point to the point at infinity. - /// - /// \param pt The point to set. This must be initialized. + /// \brief Free the data in the context /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \param ctx Entropy context to free + pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); } unsafe extern "C" { - /// \brief This function checks if a point is the point at infinity. + /// \brief Adds an entropy source to poll + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param pt The point to test. This must be initialized. + /// \param ctx Entropy context + /// \param f_source Entropy function + /// \param p_source Function data + /// \param threshold Minimum required from source before entropy is released + /// ( with mbedtls_entropy_func() ) (in bytes) + /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or + /// MBEDTLS_ENTROPY_SOURCE_WEAK. + /// At least one strong source needs to be added. + /// Weaker sources (such as the cycle counter) can be used as + /// a complement. /// - /// \return \c 1 if the point is zero. - /// \return \c 0 if the point is non-zero. - /// \return A negative error code on failure. - pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; + /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES + pub fn mbedtls_entropy_add_source( + ctx: *mut mbedtls_entropy_context, + f_source: mbedtls_entropy_f_source_ptr, + p_source: *mut ::core::ffi::c_void, + threshold: usize, + strong: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function compares two points. - /// - /// \note This assumes that the points are normalized. Otherwise, - /// they may compare as "not equal" even if they are. + /// \brief Trigger an extra gather poll for the accumulator + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The first point to compare. This must be initialized. - /// \param Q The second point to compare. This must be initialized. + /// \param ctx Entropy context /// - /// \return \c 0 if the points are equal. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. - pub fn mbedtls_ecp_point_cmp( - P: *const mbedtls_ecp_point, - Q: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a non-zero point from two ASCII - /// strings. + /// \brief Retrieve entropy from the accumulator + /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param P The destination point. This must be initialized. - /// \param radix The numeric base of the input. - /// \param x The first affine coordinate, as a null-terminated string. - /// \param y The second affine coordinate, as a null-terminated string. + /// \param data Entropy context + /// \param output Buffer to fill + /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. - pub fn mbedtls_ecp_point_read_string( - P: *mut mbedtls_ecp_point, - radix: ::core::ffi::c_int, - x: *const ::core::ffi::c_char, - y: *const ::core::ffi::c_char, + /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + pub fn mbedtls_entropy_func( + data: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point into unsigned binary data. + /// \brief Add data to the accumulator manually + /// (Thread-safe if MBEDTLS_THREADING_C is enabled) /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The point to export. This must be initialized. - /// \param format The point format. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// (For groups without these formats, this parameter is - /// ignored. But it still has to be either of the above - /// values.) - /// \param olen The address at which to store the length of - /// the output in Bytes. This must not be \c NULL. - /// \param buf The output buffer. This must be a writable buffer - /// of length \p buflen Bytes. - /// \param buflen The length of the output buffer \p buf in Bytes. + /// \param ctx Entropy context + /// \param data Data to add + /// \param len Length of data /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer - /// is too small to hold the point. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format - /// or the export for the given group is not implemented. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_point_write_binary( - grp: *const mbedtls_ecp_group, - P: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, + /// \return 0 if successful + pub fn mbedtls_entropy_update_manual( + ctx: *mut mbedtls_entropy_context, + data: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports a point from unsigned binary data. + /// \brief Checkup routine /// - /// \note This function does not check that the point actually - /// belongs to the given group, see mbedtls_ecp_check_pubkey() - /// for that. + /// This module self-test also calls the entropy self-test, + /// mbedtls_entropy_source_self_test(); /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The CTR_DRBG context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ctr_drbg_context { + ///< The counter (V). + pub private_counter: [::core::ffi::c_uchar; 16usize], + ///< The reseed counter. + /// This is the number of requests that have + /// been made since the last (re)seeding, + /// minus one. + /// Before the initial seeding, this field + /// contains the amount of entropy in bytes + /// to use as a nonce for the initial seeding, + /// or -1 if no nonce length has been explicitly + /// set (see mbedtls_ctr_drbg_set_nonce_len()). + pub private_reseed_counter: ::core::ffi::c_int, + ///< This determines whether prediction + ///resistance is enabled, that is + ///whether to systematically reseed before + ///each random generation. + pub private_prediction_resistance: ::core::ffi::c_int, + ///< The amount of entropy grabbed on each + ///seed or reseed operation, in bytes. + pub private_entropy_len: usize, + ///< The reseed interval. + /// This is the maximum number of requests + /// that can be made between reseedings. + pub private_reseed_interval: ::core::ffi::c_int, + ///< The AES context. + pub private_aes_ctx: mbedtls_aes_context, + pub private_f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + ///< The context for the entropy function. + pub private_p_entropy: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_ctr_drbg_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes the CTR_DRBG context, + /// and prepares it for mbedtls_ctr_drbg_seed() + /// or mbedtls_ctr_drbg_free(). /// - /// \param grp The group to which the point should belong. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param P The destination context to import the point to. - /// This must be initialized. - /// \param buf The input buffer. This must be a readable buffer - /// of length \p ilen Bytes. - /// \param ilen The length of the input buffer \p buf in Bytes. + /// \note The reseed interval is + /// #MBEDTLS_CTR_DRBG_RESEED_INTERVAL by default. + /// You can override it by calling + /// mbedtls_ctr_drbg_set_reseed_interval(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the - /// given group is not implemented. - pub fn mbedtls_ecp_point_read_binary( - grp: *const mbedtls_ecp_group, - P: *mut mbedtls_ecp_point, - buf: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to initialize. + pub fn mbedtls_ctr_drbg_init(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function imports a point from a TLS ECPoint record. + /// - The \p custom string. /// - /// \note On function return, \p *buf is updated to point immediately - /// after the ECPoint record. + /// \note To achieve the nominal security strength permitted + /// by CTR_DRBG, the entropy length must be: + /// - at least 16 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 32 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The destination point. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the buffer. + /// In addition, if you do not pass a nonce in \p custom, + /// the sum of the entropy length + /// and the entropy nonce length must be: + /// - at least 24 bytes for a 128-bit strength + /// (maximum achievable strength when using AES-128); + /// - at least 48 bytes for a 256-bit strength + /// (maximum achievable strength when using AES-256). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization - /// failure. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - pub fn mbedtls_ecp_tls_read_point( - grp: *const mbedtls_ecp_group, - pt: *mut mbedtls_ecp_point, - buf: *mut *const ::core::ffi::c_uchar, + /// \param ctx The CTR_DRBG context to seed. + /// It must have been initialized with + /// mbedtls_ctr_drbg_init(). + /// After a successful call to mbedtls_ctr_drbg_seed(), + /// you may not call mbedtls_ctr_drbg_seed() again on + /// the same context unless you call + /// mbedtls_ctr_drbg_free() and mbedtls_ctr_drbg_init() + /// again first. + /// After a failed call to mbedtls_ctr_drbg_seed(), + /// you must call mbedtls_ctr_drbg_free(). + /// \param f_entropy The entropy callback, taking as arguments the + /// \p p_entropy context, the buffer to fill, and the + /// length of the buffer. + /// \p f_entropy is always called with a buffer size + /// less than or equal to the entropy length. + /// \param p_entropy The entropy context to pass to \p f_entropy. + /// \param custom The personalization string. + /// This can be \c NULL, in which case the personalization + /// string is empty regardless of the value of \p len. + /// \param len The length of the personalization string. + /// This must be at most + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// - #MBEDTLS_CTR_DRBG_ENTROPY_LEN. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_seed( + ctx: *mut mbedtls_ctr_drbg_context, + f_entropy: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut ::core::ffi::c_void, + arg2: *mut ::core::ffi::c_uchar, + arg3: usize, + ) -> ::core::ffi::c_int, + >, + p_entropy: *mut ::core::ffi::c_void, + custom: *const ::core::ffi::c_uchar, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports a point as a TLS ECPoint record - /// defined in RFC 4492, Section 5.4. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to be exported. This must be initialized. - /// \param format The point format to use. This must be either - /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. - /// \param olen The address at which to store the length in Bytes - /// of the data written. - /// \param buf The target buffer. This must be a writable buffer of - /// length \p blen Bytes. - /// \param blen The length of the target buffer \p buf in Bytes. + /// \brief This function resets CTR_DRBG context to the state immediately + /// after initial call of mbedtls_ctr_drbg_init(). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer - /// is too small to hold the exported point. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_point( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - format: ::core::ffi::c_int, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context to clear. + pub fn mbedtls_ctr_drbg_free(ctx: *mut mbedtls_ctr_drbg_context); } unsafe extern "C" { - /// \brief This function sets up an ECP group context - /// from a standardized set of domain parameters. - /// - /// \note The index should be a value of the NamedCurve enum, - /// as defined in RFC-4492: Elliptic Curve Cryptography - /// (ECC) Cipher Suites for Transport Layer Security (TLS), - /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. + /// \brief This function turns prediction resistance on or off. + /// The default value is off. /// - /// \param grp The group context to setup. This must be initialized. - /// \param id The identifier of the domain parameter set to load. + /// \note If enabled, entropy is gathered at the beginning of + /// every call to mbedtls_ctr_drbg_random_with_add() + /// or mbedtls_ctr_drbg_random(). + /// Only use this if your entropy source has sufficient + /// throughput. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_group_load( - grp: *mut mbedtls_ecp_group, - id: mbedtls_ecp_group_id, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param resistance #MBEDTLS_CTR_DRBG_PR_ON or #MBEDTLS_CTR_DRBG_PR_OFF. + pub fn mbedtls_ctr_drbg_set_prediction_resistance( + ctx: *mut mbedtls_ctr_drbg_context, + resistance: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function sets up an ECP group context from a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed on each + /// seed or reseed. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// The default value is #MBEDTLS_CTR_DRBG_ENTROPY_LEN. /// - /// \param grp The group context to setup. This must be initialized. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \note The security strength of CTR_DRBG is bounded by the + /// entropy length. Thus: + /// - When using AES-256 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is disabled, + /// which is the default), + /// \p len must be at least 32 (in bytes) + /// to achieve a 256-bit strength. + /// - When using AES-128 + /// (\c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is enabled) + /// \p len must be at least 16 (in bytes) + /// to achieve a 128-bit strength. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group( - grp: *mut mbedtls_ecp_group, - buf: *mut *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. + pub fn mbedtls_ctr_drbg_set_entropy_len(ctx: *mut mbedtls_ctr_drbg_context, len: usize); } unsafe extern "C" { - /// \brief This function extracts an elliptic curve group ID from a - /// TLS ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the amount of entropy grabbed + /// as a nonce for the initial seeding. /// - /// \note The read pointer \p buf is updated to point right after - /// the ECParameters record on exit. + /// Call this function before calling mbedtls_ctr_drbg_seed() to read + /// a nonce from the entropy source during the initial seeding. /// - /// \param grp The address at which to store the group id. - /// This must not be \c NULL. - /// \param buf The address of the pointer to the start of the input buffer. - /// \param len The length of the input buffer \c *buf in Bytes. + /// \param ctx The CTR_DRBG context. + /// \param len The amount of entropy to grab for the nonce, in bytes. + /// This must be at most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT + /// and at most the maximum length accepted by the + /// entropy function that is set in the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not - /// recognized. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_read_group_id( - grp: *mut mbedtls_ecp_group_id, - buf: *mut *const ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if \p len is + /// more than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED + /// if the initial seeding has already taken place. + pub fn mbedtls_ctr_drbg_set_nonce_len( + ctx: *mut mbedtls_ctr_drbg_context, len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports an elliptic curve as a TLS - /// ECParameters record as defined in RFC 4492, Section 5.4. + /// \brief This function sets the reseed interval. /// - /// \param grp The ECP group to be exported. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param olen The address at which to store the number of Bytes written. - /// This must not be \c NULL. - /// \param buf The buffer to write to. This must be a writable buffer - /// of length \p blen Bytes. - /// \param blen The length of the output buffer \p buf in Bytes. + /// The reseed interval is the number of calls to mbedtls_ctr_drbg_random() + /// or mbedtls_ctr_drbg_random_with_add() after which the entropy function + /// is called again. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output - /// buffer is too small to hold the exported group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_tls_write_group( - grp: *const mbedtls_ecp_group, - olen: *mut usize, - buf: *mut ::core::ffi::c_uchar, - blen: usize, - ) -> ::core::ffi::c_int; + /// The default value is #MBEDTLS_CTR_DRBG_RESEED_INTERVAL. + /// + /// \param ctx The CTR_DRBG context. + /// \param interval The reseed interval. + pub fn mbedtls_ctr_drbg_set_reseed_interval( + ctx: *mut mbedtls_ctr_drbg_context, + interval: ::core::ffi::c_int, + ); } unsafe extern "C" { - /// \brief This function performs a scalar multiplication of a point - /// by an integer: \p R = \p m * \p P. - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function reseeds the CTR_DRBG context, that is + /// extracts data from the entropy source. /// - /// \note To prevent timing attacks, this function - /// executes the exact same sequence of base-field - /// operations for any valid \p m. It avoids any if-branch or - /// array index depending on the value of \p m. It also uses - /// \p f_rng to randomize some intermediate results. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param ctx The CTR_DRBG context. + /// \param additional Additional data to add to the state. Can be \c NULL. + /// \param len The length of the additional data. + /// This must be less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED on failure. + pub fn mbedtls_ctr_drbg_reseed( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication of a point by - /// an integer: \p R = \p m * \p P in a restartable way. - /// - /// \see mbedtls_ecp_mul() + /// \brief This function updates the state of the CTR_DRBG context. /// - /// \note This function does the same as \c mbedtls_ecp_mul(), but - /// it can return early and restart according to the limit set - /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply. This must be initialized. - /// \param P The point to multiply. This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. - /// \param rs_ctx The restart context (NULL disables restart). + /// \param ctx The CTR_DRBG context. + /// \param additional The data to update the state with. This must not be + /// \c NULL unless \p add_len is \c 0. + /// \param add_len Length of \p additional in bytes. This must be at + /// most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private - /// key, or \p P is not a valid public key. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_mul_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecp_restart_ctx, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if + /// \p add_len is more than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT. + /// \return An error from the underlying AES cipher on failure. + pub fn mbedtls_ctr_drbg_update( + ctx: *mut mbedtls_ctr_drbg_context, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q - /// - /// It is not thread-safe to use same group in multiple threads. + /// \brief This function updates a CTR_DRBG instance with additional + /// data and uses it to generate random data. /// - /// \note In contrast to mbedtls_ecp_mul(), this function does not - /// guarantee a constant execution flow and timing. + /// This function automatically reseeds if the reseed counter is exceeded + /// or prediction resistance is enabled. /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. + /// \note This function is not thread-safe. It is not safe + /// to call this function if another thread might be + /// concurrently obtaining random numbers from the same + /// context or updating or reseeding the same context. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. + /// \param additional Additional data to update. Can be \c NULL, in which + /// case the additional data is empty regardless of + /// the value of \p add_len. + /// \param add_len The length of the additional data + /// if \p additional is not \c NULL. + /// This must be less than #MBEDTLS_CTR_DRBG_MAX_INPUT + /// and less than + /// #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length + /// configured for the context. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random_with_add( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + additional: *const ::core::ffi::c_uchar, + add_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs multiplication and addition of two - /// points by integers: \p R = \p m * \p P + \p n * \p Q in a - /// restartable way. + /// \param p_rng The CTR_DRBG context. This must be a pointer to a + /// #mbedtls_ctr_drbg_context structure. + /// \param output The buffer to fill. + /// \param output_len The length of the buffer in bytes. /// - /// \see \c mbedtls_ecp_muladd() + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED or + /// #MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG on failure. + pub fn mbedtls_ctr_drbg_random( + p_rng: *mut ::core::ffi::c_void, + output: *mut ::core::ffi::c_uchar, + output_len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The CTR_DRBG checkup routine. /// - /// \note This function works the same as \c mbedtls_ecp_muladd(), - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. - /// - /// \note This function is only defined for short Weierstrass curves. - /// It may not be included in builds without any short - /// Weierstrass curve. - /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param R The point in which to store the result of the calculation. - /// This must be initialized. - /// \param m The integer by which to multiply \p P. - /// This must be initialized. - /// \param P The point to multiply by \p m. This must be initialized. - /// \param n The integer by which to multiply \p Q. - /// This must be initialized. - /// \param Q The point to be multiplied by \p n. - /// This must be initialized. - /// \param rs_ctx The restart context (NULL disables restart). - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not - /// valid private keys, or \p P or \p Q are not valid public - /// keys. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not - /// designate a short Weierstrass curve. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_muladd_restartable( - grp: *mut mbedtls_ecp_group, - R: *mut mbedtls_ecp_point, - m: *const mbedtls_mpi, - P: *const mbedtls_ecp_point, - n: *const mbedtls_mpi, - Q: *const mbedtls_ecp_point, - rs_ctx: *mut mbedtls_ecp_restart_ctx, - ) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_ctr_drbg_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief This function checks that a point is a valid public key - /// on this curve. - /// - /// It only checks that the point is non-zero, has - /// valid coordinates and lies on the curve. It does not verify - /// that it is indeed a multiple of \p G. This additional - /// check is computationally more expensive, is not required - /// by standards, and should not be necessary if the group - /// used has a small cofactor. In particular, it is useless for - /// the NIST groups which all have a cofactor of 1. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure, to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the point should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param pt The point to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid public key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not - /// a valid public key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_pubkey( - grp: *const mbedtls_ecp_group, - pt: *const mbedtls_ecp_point, - ) -> ::core::ffi::c_int; +///< Curve not defined. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_NONE: mbedtls_ecp_group_id = 0; +///< Domain parameters for the 192-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192R1: mbedtls_ecp_group_id = 1; +///< Domain parameters for the 224-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224R1: mbedtls_ecp_group_id = 2; +///< Domain parameters for the 256-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256R1: mbedtls_ecp_group_id = 3; +///< Domain parameters for the 384-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP384R1: mbedtls_ecp_group_id = 4; +///< Domain parameters for the 521-bit curve defined by FIPS 186-4 and SEC1. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP521R1: mbedtls_ecp_group_id = 5; +///< Domain parameters for 256-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP256R1: mbedtls_ecp_group_id = 6; +///< Domain parameters for 384-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP384R1: mbedtls_ecp_group_id = 7; +///< Domain parameters for 512-bit Brainpool curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_BP512R1: mbedtls_ecp_group_id = 8; +///< Domain parameters for Curve25519. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE25519: mbedtls_ecp_group_id = 9; +///< Domain parameters for 192-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP192K1: mbedtls_ecp_group_id = 10; +///< Domain parameters for 224-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP224K1: mbedtls_ecp_group_id = 11; +///< Domain parameters for 256-bit "Koblitz" curve. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_SECP256K1: mbedtls_ecp_group_id = 12; +///< Domain parameters for Curve448. +pub const mbedtls_ecp_group_id_MBEDTLS_ECP_DP_CURVE448: mbedtls_ecp_group_id = 13; +/// Domain-parameter identifiers: curve, subgroup, and generator. +/// +/// \note Only curves over prime fields are supported. +/// +/// \warning This library does not support validation of arbitrary domain +/// parameters. Therefore, only standardized domain parameters from trusted +/// sources should be used. See mbedtls_ecp_group_load(). +pub type mbedtls_ecp_group_id = ::core::ffi::c_uint; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_NONE: mbedtls_ecp_curve_type = 0; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS: mbedtls_ecp_curve_type = 1; +pub const mbedtls_ecp_curve_type_MBEDTLS_ECP_TYPE_MONTGOMERY: mbedtls_ecp_curve_type = 2; +pub type mbedtls_ecp_curve_type = ::core::ffi::c_uint; +/// Curve information, for use by other modules. +/// +/// The fields of this structure are part of the public API and can be +/// accessed directly by applications. Future versions of the library may +/// add extra fields or reorder existing fields. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_curve_info { + ///< An internal identifier. + pub grp_id: mbedtls_ecp_group_id, + ///< The TLS NamedCurve identifier. + pub tls_id: u16, + ///< The curve size in bits. + pub bit_size: u16, + ///< A human-friendly name. + pub name: *const ::core::ffi::c_char, } -unsafe extern "C" { - /// \brief This function checks that an \p mbedtls_mpi is a - /// valid private key for this curve. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group the private key should belong to. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The integer to check. This must be initialized. - /// - /// \return \c 0 if the point is a valid private key. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid - /// private key for the given curve. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_check_privkey( - grp: *const mbedtls_ecp_group, - d: *const mbedtls_mpi, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_curve_info { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates a private key. - /// - /// \param grp The ECP group to generate a private key for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_privkey( - grp: *const mbedtls_ecp_group, - d: *mut mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +/// \brief The ECP point structure, in Jacobian coordinates. +/// +/// \note All functions expect and return points satisfying +/// the following condition: Z == 0 or +/// Z == 1. Other values of \p Z are +/// used only by internal functions. +/// The point is zero, or "at infinity", if Z == 0. +/// Otherwise, \p X and \p Y are its standard (affine) +/// coordinates. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_point { + ///< The X coordinate of the ECP point. + pub private_X: mbedtls_mpi, + ///< The Y coordinate of the ECP point. + pub private_Y: mbedtls_mpi, + ///< The Z coordinate of the ECP point. + pub private_Z: mbedtls_mpi, } -unsafe extern "C" { - /// \brief This function generates a keypair with a configurable base - /// point. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param G The base point to use. This must be initialized - /// and belong to \p grp. It replaces the default base - /// point \c grp->G used by mbedtls_ecp_gen_keypair(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair_base( - grp: *mut mbedtls_ecp_group, - G: *const mbedtls_ecp_point, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; +impl Default for mbedtls_ecp_point { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief This function generates an ECP keypair. - /// - /// \note This function uses bare components rather than an - /// ::mbedtls_ecp_keypair structure to ease use with other - /// structures, such as ::mbedtls_ecdh_context or - /// ::mbedtls_ecdsa_context. - /// - /// \param grp The ECP group to generate a key pair for. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param d The destination MPI (secret part). - /// This must be initialized. - /// \param Q The destination point (public part). - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. +/// \brief The ECP group structure. +/// +/// We consider two types of curve equations: +///
          • Short Weierstrass: y^2 = x^3 + A x + B mod P +/// (SEC1 + RFC-4492)
            • +///
          • Montgomery: y^2 = x^3 + A x^2 + x mod P (Curve25519, +/// Curve448)
          +/// In both cases, the generator (\p G) for a prime-order subgroup is fixed. +/// +/// For Short Weierstrass, this subgroup is the whole curve, and its +/// cardinality is denoted by \p N. Our code requires that \p N is an +/// odd prime as mbedtls_ecp_mul() requires an odd number, and +/// mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. +/// +/// The default implementation only initializes \p A without setting it to the +/// authentic value for curves with A = -3(SECP256R1, etc), in which +/// case you need to load \p A by yourself when using domain parameters directly, +/// for example: +/// \code +/// mbedtls_mpi_init(&A); +/// mbedtls_ecp_group_init(&grp); +/// CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); +/// if (mbedtls_ecp_group_a_is_minus_3(&grp)) { +/// CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); +/// } else { +/// CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); +/// } +/// +/// do_something_with_a(&A); +/// +/// cleanup: +/// mbedtls_mpi_free(&A); +/// mbedtls_ecp_group_free(&grp); +/// \endcode +/// +/// For Montgomery curves, we do not store \p A, but (A + 2) / 4, +/// which is the quantity used in the formulas. Additionally, \p nbits is +/// not the size of \p N but the required size for private keys. +/// +/// If \p modp is NULL, reduction modulo \p P is done using a generic algorithm. +/// Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the +/// range of 0..2^(2*pbits)-1, and transforms it in-place to an integer +/// which is congruent mod \p P to the given MPI, and is close enough to \p pbits +/// in size, so that it may be efficiently brought in the 0..P-1 range by a few +/// additions or subtractions. Therefore, it is only an approximate modular +/// reduction. It must return 0 on success and non-zero on failure. +/// +/// \note Alternative implementations of the ECP module must obey the +/// following constraints. +/// * Group IDs must be distinct: if two group structures have +/// the same ID, then they must be identical. +/// * The fields \c id, \c P, \c A, \c B, \c G, \c N, +/// \c pbits and \c nbits must have the same type and semantics +/// as in the built-in implementation. +/// They must be available for reading, but direct modification +/// of these fields does not need to be supported. +/// They do not need to be at the same offset in the structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_group { + ///< An internal group identifier. + pub id: mbedtls_ecp_group_id, + ///< The prime modulus of the base field. + pub P: mbedtls_mpi, + ///< For Short Weierstrass: \p A in the equation. Note that + ///\p A is not set to the authentic value in some cases. + ///Refer to detailed description of ::mbedtls_ecp_group if + ///using domain parameters in the structure. + ///For Montgomery curves: (A + 2) / 4. + pub A: mbedtls_mpi, + ///< For Short Weierstrass: \p B in the equation. + ///For Montgomery curves: unused. + pub B: mbedtls_mpi, + ///< The generator of the subgroup used. + pub G: mbedtls_ecp_point, + ///< The order of \p G. + pub N: mbedtls_mpi, + ///< The number of bits in \p P. + pub pbits: usize, + ///< For Short Weierstrass: The number of bits in \p P. + ///For Montgomery curves: the number of bits in the + ///private keys. + pub nbits: usize, + ///< \internal 1 if the constants are static. + pub private_h: ::core::ffi::c_uint, + ///< The function for fast pseudo-reduction + ///mod \p P (see above). + pub private_modp: + ::core::option::Option ::core::ffi::c_int>, + ///< Unused. + pub private_t_pre: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_post: ::core::option::Option< + unsafe extern "C" fn( + arg1: *mut mbedtls_ecp_point, + arg2: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int, + >, + ///< Unused. + pub private_t_data: *mut ::core::ffi::c_void, + ///< Pre-computed points for ecp_mul_comb(). + pub private_T: *mut mbedtls_ecp_point, + ///< The number of dynamic allocated pre-computed points. + pub private_T_size: usize, +} +impl Default for mbedtls_ecp_group { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type mbedtls_ecp_restart_ctx = ::core::ffi::c_void; +/// \brief The ECP key-pair structure. +/// +/// A generic key-pair that may be used for ECDSA and fixed ECDH, for example. +/// +/// \note Members are deliberately in the same order as in the +/// ::mbedtls_ecdsa_context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecp_keypair { + ///< Elliptic curve and base point + pub private_grp: mbedtls_ecp_group, + ///< our secret value + pub private_d: mbedtls_mpi, + ///< our public value + pub private_Q: mbedtls_ecp_point, +} +impl Default for mbedtls_ecp_keypair { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + pub fn mbedtls_ecp_get_type(grp: *const mbedtls_ecp_group) -> mbedtls_ecp_curve_type; +} +unsafe extern "C" { + /// \brief This function retrieves the information defined in + /// mbedtls_ecp_curve_info() for all supported curves. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_keypair( - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. + /// + /// \return A statically allocated array. The last entry is 0. + pub fn mbedtls_ecp_curve_list() -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function generates an ECP key. + /// \brief This function retrieves the list of internal group + /// identifiers of all supported curves in the order of + /// preference. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. This must be initialized. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. + /// \note This function returns information about all curves + /// supported by the library. Some curves may not be + /// supported for all algorithms. Call mbedtls_ecdh_can_do() + /// or mbedtls_ecdsa_can_do() to check if a curve is + /// supported for ECDH or ECDSA. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code - /// on failure. - pub fn mbedtls_ecp_gen_key( - grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return A statically allocated array, + /// terminated with MBEDTLS_ECP_DP_NONE. + pub fn mbedtls_ecp_grp_id_list() -> *const mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function reads an elliptic curve private key. + /// \brief This function retrieves curve information from an internal + /// group identifier. /// - /// \param grp_id The ECP group identifier. - /// \param key The destination key. - /// \param buf The buffer containing the binary representation of the - /// key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The length of the buffer in bytes. + /// \param grp_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is - /// invalid. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_read_key( + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_grp_id( grp_id: mbedtls_ecp_group_id, - key: *mut mbedtls_ecp_keypair, - buf: *const ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports an elliptic curve private key. + /// \brief This function retrieves curve information from a TLS + /// NamedCurve value. /// - /// \param key The private key. - /// \param buf The output buffer for containing the binary representation - /// of the key. (Big endian integer for Weierstrass curves, byte - /// string for Montgomery curves.) - /// \param buflen The total length of the buffer in bytes. + /// \param tls_id An \c MBEDTLS_ECP_DP_XXX value. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key - ///representation is larger than the available space in \p buf. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for - /// the group is not implemented. - /// \return Another negative error code on different kinds of failure. - pub fn mbedtls_ecp_write_key( - key: *mut mbedtls_ecp_keypair, - buf: *mut ::core::ffi::c_uchar, - buflen: usize, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_tls_id(tls_id: u16) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function checks that the keypair objects - /// \p pub and \p prv have the same group and the - /// same public point, and that the private key in - /// \p prv is consistent with the public key. + /// \brief This function retrieves curve information from a + /// human-readable name. /// - /// \param pub The keypair structure holding the public key. This - /// must be initialized. If it contains a private key, that - /// part is ignored. - /// \param prv The keypair structure holding the full keypair. - /// This must be initialized. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c - /// NULL if \p f_rng doesn't need a context. + /// \param name The human-readable name. /// - /// \return \c 0 on success, meaning that the keys are valid and match. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. - /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX - /// error code on calculation failure. - pub fn mbedtls_ecp_check_pub_priv( - pub_: *const mbedtls_ecp_keypair, - prv: *const mbedtls_ecp_keypair, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// \return The associated curve information on success. + /// \return NULL on failure. + pub fn mbedtls_ecp_curve_info_from_name( + name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ecp_curve_info; } unsafe extern "C" { - /// \brief This function exports generic key-pair parameters. - /// - /// \param key The key pair to export from. - /// \param grp Slot for exported ECP group. - /// It must point to an initialized ECP group. - /// \param d Slot for the exported secret value. - /// It must point to an initialized mpi. - /// \param Q Slot for the exported public value. - /// It must point to an initialized ECP point. + /// \brief This function initializes a point as zero. /// - /// \return \c 0 on success, - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. - /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't - /// correspond to a known group. - /// \return Another negative error code on other kinds of failure. - pub fn mbedtls_ecp_export( - key: *const mbedtls_ecp_keypair, - grp: *mut mbedtls_ecp_group, - d: *mut mbedtls_mpi, - Q: *mut mbedtls_ecp_point, - ) -> ::core::ffi::c_int; + /// \param pt The point to initialize. + pub fn mbedtls_ecp_point_init(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief The ECP checkup routine. + /// \brief This function initializes an ECP group context + /// without loading any domain parameters. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -///< None. -pub const mbedtls_md_type_t_MBEDTLS_MD_NONE: mbedtls_md_type_t = 0; -///< The MD5 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_MD5: mbedtls_md_type_t = 1; -///< The SHA-1 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA1: mbedtls_md_type_t = 2; -///< The SHA-224 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA224: mbedtls_md_type_t = 3; -///< The SHA-256 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA256: mbedtls_md_type_t = 4; -///< The SHA-384 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA384: mbedtls_md_type_t = 5; -///< The SHA-512 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_SHA512: mbedtls_md_type_t = 6; -///< The RIPEMD-160 message digest. -pub const mbedtls_md_type_t_MBEDTLS_MD_RIPEMD160: mbedtls_md_type_t = 7; -/// \brief Supported message digests. -/// -/// \warning MD5 and SHA-1 are considered weak message digests and -/// their use constitutes a security risk. We recommend considering -/// stronger message digests instead. -pub type mbedtls_md_type_t = ::core::ffi::c_uint; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_info_t { - _unused: [u8; 0], -} -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_LEGACY: mbedtls_md_engine_t = 0; -pub const mbedtls_md_engine_t_MBEDTLS_MD_ENGINE_PSA: mbedtls_md_engine_t = 1; -/// Used internally to indicate whether a context uses legacy or PSA. -/// -/// Internal use only. -pub type mbedtls_md_engine_t = ::core::ffi::c_uint; -/// The generic message-digest context. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md_context_t { - /// Information about the associated message digest. - pub private_md_info: *const mbedtls_md_info_t, - /// The digest-specific context (legacy) or the PSA operation. - pub private_md_ctx: *mut ::core::ffi::c_void, - /// The HMAC part of the context. - pub private_hmac_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_md_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \note After this function is called, domain parameters + /// for various ECP groups can be loaded through the + /// mbedtls_ecp_group_load() or mbedtls_ecp_tls_read_group() + /// functions. + pub fn mbedtls_ecp_group_init(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest type. - /// - /// \param md_type The type of digest to search for. + /// \brief This function initializes a key pair as an invalid one. /// - /// \return The message-digest information associated with \p md_type. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_type(md_type: mbedtls_md_type_t) -> *const mbedtls_md_info_t; + /// \param key The key pair to initialize. + pub fn mbedtls_ecp_keypair_init(key: *mut mbedtls_ecp_keypair); } unsafe extern "C" { - /// \brief This function initializes a message-digest context without - /// binding it to a particular message-digest algorithm. + /// \brief This function frees the components of a point. /// - /// This function should always be called first. It prepares the - /// context for mbedtls_md_setup() for binding it to a - /// message-digest algorithm. - pub fn mbedtls_md_init(ctx: *mut mbedtls_md_context_t); + /// \param pt The point to free. + pub fn mbedtls_ecp_point_free(pt: *mut mbedtls_ecp_point); } unsafe extern "C" { - /// \brief This function clears the internal structure of \p ctx and - /// frees any embedded internal structure, but does not free - /// \p ctx itself. + /// \brief This function frees the components of an ECP group. /// - /// If you have called mbedtls_md_setup() on \p ctx, you must - /// call mbedtls_md_free() when you are no longer using the - /// context. - /// Calling this function if you have previously - /// called mbedtls_md_init() and nothing else is optional. - /// You must not call this function if you have not called - /// mbedtls_md_init(). - pub fn mbedtls_md_free(ctx: *mut mbedtls_md_context_t); + /// \param grp The group to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP group. + pub fn mbedtls_ecp_group_free(grp: *mut mbedtls_ecp_group); } unsafe extern "C" { - /// \brief This function selects the message digest algorithm to use, - /// and allocates internal structures. + /// \brief This function frees the components of a key pair. /// - /// It should be called after mbedtls_md_init() or - /// mbedtls_md_free(). Makes it necessary to call - /// mbedtls_md_free() later. + /// \param key The key pair to free. This may be \c NULL, in which + /// case this function returns immediately. If it is not + /// \c NULL, it must point to an initialized ECP key pair. + pub fn mbedtls_ecp_keypair_free(key: *mut mbedtls_ecp_keypair); +} +unsafe extern "C" { + /// \brief This function copies the contents of point \p Q into + /// point \p P. /// - /// \param ctx The context to set up. - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param hmac Defines if HMAC is used. 0: HMAC is not used (saves some memory), - /// or non-zero: HMAC is used with this context. + /// \param P The destination point. This must be initialized. + /// \param Q The source point. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - /// \return #MBEDTLS_ERR_MD_ALLOC_FAILED on memory-allocation failure. - pub fn mbedtls_md_setup( - ctx: *mut mbedtls_md_context_t, - md_info: *const mbedtls_md_info_t, - hmac: ::core::ffi::c_int, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code for other kinds of failure. + pub fn mbedtls_ecp_copy( + P: *mut mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function clones the state of a message-digest - /// context. - /// - /// \note You must call mbedtls_md_setup() on \c dst before calling - /// this function. - /// - /// \note The two contexts must have the same type, - /// for example, both are SHA-256. - /// - /// \warning This function clones the message-digest state, not the - /// HMAC state. + /// \brief This function copies the contents of group \p src into + /// group \p dst. /// - /// \param dst The destination context. - /// \param src The context to be cloned. + /// \param dst The destination group. This must be initialized. + /// \param src The source group. This must be initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification failure. - /// \return #MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE if both contexts are - /// not using the same engine. This can be avoided by moving - /// the call to psa_crypto_init() before the first call to - /// mbedtls_md_setup(). - pub fn mbedtls_md_clone( - dst: *mut mbedtls_md_context_t, - src: *const mbedtls_md_context_t, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_copy( + dst: *mut mbedtls_ecp_group, + src: *const mbedtls_ecp_group, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest size from the - /// message-digest information structure. + /// \brief This function sets a point to the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to set. This must be initialized. /// - /// \return The size of the message-digest output in Bytes. - pub fn mbedtls_md_get_size(md_info: *const mbedtls_md_info_t) -> ::core::ffi::c_uchar; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest type from the - /// message-digest information structure. + /// \brief This function checks if a point is the point at infinity. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param pt The point to test. This must be initialized. /// - /// \return The type of the message digest. - pub fn mbedtls_md_get_type(md_info: *const mbedtls_md_info_t) -> mbedtls_md_type_t; + /// \return \c 1 if the point is zero. + /// \return \c 0 if the point is non-zero. + /// \return A negative error code on failure. + pub fn mbedtls_ecp_is_zero(pt: *mut mbedtls_ecp_point) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function starts a message-digest computation. + /// \brief This function compares two points. /// - /// You must call this function after setting up the context - /// with mbedtls_md_setup(), and before passing data with - /// mbedtls_md_update(). + /// \note This assumes that the points are normalized. Otherwise, + /// they may compare as "not equal" even if they are. /// - /// \param ctx The generic message-digest context. + /// \param P The first point to compare. This must be initialized. + /// \param Q The second point to compare. This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_starts(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return \c 0 if the points are equal. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the points are not equal. + pub fn mbedtls_ecp_point_cmp( + P: *const mbedtls_ecp_point, + Q: *const mbedtls_ecp_point, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// message-digest computation. - /// - /// You must call mbedtls_md_starts() before calling this - /// function. You may call this function multiple times. - /// Afterwards, call mbedtls_md_finish(). + /// \brief This function imports a non-zero point from two ASCII + /// strings. /// - /// \param ctx The generic message-digest context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param P The destination point. This must be initialized. + /// \param radix The numeric base of the input. + /// \param x The first affine coordinate, as a null-terminated string. + /// \param y The second affine coordinate, as a null-terminated string. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on failure. + pub fn mbedtls_ecp_point_read_string( + P: *mut mbedtls_ecp_point, + radix: ::core::ffi::c_int, + x: *const ::core::ffi::c_char, + y: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the digest operation, - /// and writes the result to the output buffer. - /// - /// Call this function after a call to mbedtls_md_starts(), - /// followed by any number of calls to mbedtls_md_update(). - /// Afterwards, you may either clear the context with - /// mbedtls_md_free(), or call mbedtls_md_starts() to reuse - /// the context for another digest operation with the same - /// algorithm. + /// \brief This function exports a point into unsigned binary data. /// - /// \param ctx The generic message-digest context. - /// \param output The buffer for the generic message-digest checksum result. + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The point to export. This must be initialized. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_point_write_binary( + grp: *const mbedtls_ecp_group, + P: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the message-digest of a buffer, - /// with respect to a configurable message-digest algorithm - /// in a single call. + /// \brief This function imports a point from unsigned binary data. /// - /// The result is calculated as - /// Output = message_digest(input buffer). + /// \note This function does not check that the point actually + /// belongs to the given group, see mbedtls_ecp_check_pubkey() + /// for that. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param input The buffer holding the data. - /// \param ilen The length of the input data. - /// \param output The generic message-digest checksum result. + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md( - md_info: *const mbedtls_md_info_t, - input: *const ::core::ffi::c_uchar, + /// \param grp The group to which the point should belong. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param P The destination context to import the point to. + /// This must be initialized. + /// \param buf The input buffer. This must be a readable buffer + /// of length \p ilen Bytes. + /// \param ilen The length of the input buffer \p buf in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the import for the + /// given group is not implemented. + pub fn mbedtls_ecp_point_read_binary( + grp: *const mbedtls_ecp_group, + P: *mut mbedtls_ecp_point, + buf: *const ::core::ffi::c_uchar, ilen: usize, - output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the list of digests supported by the - /// generic digest module. - /// - /// \note The list starts with the strongest available hashes. + /// \brief This function imports a point from a TLS ECPoint record. /// - /// \return A statically allocated array of digests. Each element - /// in the returned list is an integer belonging to the - /// message-digest enumeration #mbedtls_md_type_t. - /// The last entry is 0. - pub fn mbedtls_md_list() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function returns the message-digest information - /// associated with the given digest name. + /// \note On function return, \p *buf is updated to point immediately + /// after the ECPoint record. /// - /// \param md_name The name of the digest to search for. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The destination point. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the buffer. /// - /// \return The message-digest information associated with \p md_name. - /// \return NULL if the associated message-digest information is not found. - pub fn mbedtls_md_info_from_string( - md_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_md_info_t; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_MPI_XXX error code on initialization + /// failure. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + pub fn mbedtls_ecp_tls_read_point( + grp: *const mbedtls_ecp_group, + pt: *mut mbedtls_ecp_point, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function extracts the message-digest name from the - /// message-digest information structure. + /// \brief This function exports a point as a TLS ECPoint record + /// defined in RFC 4492, Section 5.4. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to be exported. This must be initialized. + /// \param format The point format to use. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// \param olen The address at which to store the length in Bytes + /// of the data written. + /// \param buf The target buffer. This must be a writable buffer of + /// length \p blen Bytes. + /// \param blen The length of the target buffer \p buf in Bytes. /// - /// \return The name of the message digest. - pub fn mbedtls_md_get_name(md_info: *const mbedtls_md_info_t) -> *const ::core::ffi::c_char; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the input is invalid. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the target buffer + /// is too small to hold the exported point. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_point( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function returns the message-digest information - /// from the given context. + /// \brief This function sets up an ECP group context + /// from a standardized set of domain parameters. /// - /// \param ctx The context from which to extract the information. - /// This must be initialized (or \c NULL). + /// \note The index should be a value of the NamedCurve enum, + /// as defined in RFC-4492: Elliptic Curve Cryptography + /// (ECC) Cipher Suites for Transport Layer Security (TLS), + /// usually in the form of an \c MBEDTLS_ECP_DP_XXX macro. /// - /// \return The message-digest information associated with \p ctx. - /// \return \c NULL if \p ctx is \c NULL. - pub fn mbedtls_md_info_from_ctx(ctx: *const mbedtls_md_context_t) -> *const mbedtls_md_info_t; + /// \param grp The group context to setup. This must be initialized. + /// \param id The identifier of the domain parameter set to load. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_group_load( + grp: *mut mbedtls_ecp_group, + id: mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets the HMAC key and prepares to - /// authenticate a new message. + /// \brief This function sets up an ECP group context from a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_setup(), to use - /// the MD context for an HMAC calculation, then call - /// mbedtls_md_hmac_update() to provide the input data, and - /// mbedtls_md_hmac_finish() to get the HMAC value. + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC key in Bytes. + /// \param grp The group context to setup. This must be initialized. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_starts( - ctx: *mut mbedtls_md_context_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group( + grp: *mut mbedtls_ecp_group, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing HMAC - /// computation. + /// \brief This function extracts an elliptic curve group ID from a + /// TLS ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call mbedtls_md_hmac_starts() or mbedtls_md_hmac_reset() - /// before calling this function. - /// You may call this function multiple times to pass the - /// input piecewise. - /// Afterwards, call mbedtls_md_hmac_finish(). + /// \note The read pointer \p buf is updated to point right after + /// the ECParameters record on exit. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. + /// \param grp The address at which to store the group id. + /// This must not be \c NULL. + /// \param buf The address of the pointer to the start of the input buffer. + /// \param len The length of the input buffer \c *buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_update( - ctx: *mut mbedtls_md_context_t, - input: *const ::core::ffi::c_uchar, - ilen: usize, + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if input is invalid. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the group is not + /// recognized. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_read_group_id( + grp: *mut mbedtls_ecp_group_id, + buf: *mut *const ::core::ffi::c_uchar, + len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function finishes the HMAC operation, and writes - /// the result to the output buffer. + /// \brief This function exports an elliptic curve as a TLS + /// ECParameters record as defined in RFC 4492, Section 5.4. /// - /// Call this function after mbedtls_md_hmac_starts() and - /// mbedtls_md_hmac_update() to get the HMAC value. Afterwards - /// you may either call mbedtls_md_free() to clear the context, - /// or call mbedtls_md_hmac_reset() to reuse the context with - /// the same HMAC key. - /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. - /// \param output The generic HMAC checksum result. + /// \param grp The ECP group to be exported. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param olen The address at which to store the number of Bytes written. + /// This must not be \c NULL. + /// \param buf The buffer to write to. This must be a writable buffer + /// of length \p blen Bytes. + /// \param blen The length of the output buffer \p buf in Bytes. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_finish( - ctx: *mut mbedtls_md_context_t, - output: *mut ::core::ffi::c_uchar, + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output + /// buffer is too small to hold the exported group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_tls_write_group( + grp: *const mbedtls_ecp_group, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + blen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function prepares to authenticate a new message with - /// the same key as the previous HMAC operation. + /// \brief This function performs a scalar multiplication of a point + /// by an integer: \p R = \p m * \p P. /// - /// You may call this function after mbedtls_md_hmac_finish(). - /// Afterwards call mbedtls_md_hmac_update() to pass the new - /// input. + /// It is not thread-safe to use same group in multiple threads. /// - /// \param ctx The message digest context containing an embedded HMAC - /// context. + /// \note To prevent timing attacks, this function + /// executes the exact same sequence of base-field + /// operations for any valid \p m. It avoids any if-branch or + /// array index depending on the value of \p m. It also uses + /// \p f_rng to randomize some intermediate results. + /// + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac_reset(ctx: *mut mbedtls_md_context_t) -> ::core::ffi::c_int; + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function calculates the full generic HMAC - /// on the input buffer with the provided key. + /// \brief This function performs multiplication of a point by + /// an integer: \p R = \p m * \p P in a restartable way. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// \see mbedtls_ecp_mul() /// - /// The HMAC result is calculated as - /// output = generic HMAC(hmac key, input buffer). + /// \note This function does the same as \c mbedtls_ecp_mul(), but + /// it can return early and restart according to the limit set + /// with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param md_info The information structure of the message-digest algorithm - /// to use. - /// \param key The HMAC secret key. - /// \param keylen The length of the HMAC secret key in Bytes. - /// \param input The buffer holding the input data. - /// \param ilen The length of the input data. - /// \param output The generic HMAC result. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply. This must be initialized. + /// \param P The point to multiply. This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MD_BAD_INPUT_DATA on parameter-verification - /// failure. - pub fn mbedtls_md_hmac( - md_info: *const mbedtls_md_info_t, - key: *const ::core::ffi::c_uchar, - keylen: usize, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m is not a valid private + /// key, or \p P is not a valid public key. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_mul_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecp_restart_ctx, ) -> ::core::ffi::c_int; } -/// \brief The RSA context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_rsa_context { - ///< Reserved for internal purposes. - /// Do not set this field in application - /// code. Its meaning might change without - /// notice. - pub private_ver: ::core::ffi::c_int, - ///< The size of \p N in Bytes. - pub private_len: usize, - ///< The public modulus. - pub private_N: mbedtls_mpi, - ///< The public exponent. - pub private_E: mbedtls_mpi, - ///< The private exponent. - pub private_D: mbedtls_mpi, - ///< The first prime factor. - pub private_P: mbedtls_mpi, - ///< The second prime factor. - pub private_Q: mbedtls_mpi, - ///< D % (P - 1). - pub private_DP: mbedtls_mpi, - ///< D % (Q - 1). - pub private_DQ: mbedtls_mpi, - ///< 1 / (Q % P). - pub private_QP: mbedtls_mpi, - ///< cached R^2 mod N. - pub private_RN: mbedtls_mpi, - ///< cached R^2 mod P. - pub private_RP: mbedtls_mpi, - ///< cached R^2 mod Q. - pub private_RQ: mbedtls_mpi, - ///< The cached blinding value. - pub private_Vi: mbedtls_mpi, - ///< The cached un-blinding value. - pub private_Vf: mbedtls_mpi, - ///< Selects padding mode: - ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and - ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. - pub private_padding: ::core::ffi::c_int, - ///< Hash identifier of mbedtls_md_type_t type, - ///as specified in md.h for use in the MGF - ///mask generating function used in the - ///EME-OAEP and EMSA-PSS encodings. - pub private_hash_id: ::core::ffi::c_int, -} -impl Default for mbedtls_rsa_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes an RSA context. - /// - /// \note This function initializes the padding and the hash - /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and - /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more - /// information about those parameters. - /// - /// \param ctx The RSA context to initialize. This must not be \c NULL. - pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); -} -unsafe extern "C" { - /// \brief This function sets padding for an already initialized RSA - /// context. - /// - /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP - /// encryption scheme and the RSASSA-PSS signature scheme. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q /// - /// \note The \p hash_id parameter is ignored when using - /// #MBEDTLS_RSA_PKCS_V15 padding. + /// It is not thread-safe to use same group in multiple threads. /// - /// \note The choice of padding mode is strictly enforced for private - /// key operations, since there might be security concerns in - /// mixing padding modes. For public key operations it is - /// a default value, which can be overridden by calling specific - /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx - /// functions. + /// \note In contrast to mbedtls_ecp_mul(), this function does not + /// guarantee a constant execution flow and timing. /// - /// \note The hash selected in \p hash_id is always used for OEAP - /// encryption. For PSS signatures, it is always used for - /// making signatures, but can be overridden for verifying them. - /// If set to #MBEDTLS_MD_NONE, it is always overridden. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \param ctx The initialized RSA context to be configured. - /// \param padding The padding mode to use. This must be either - /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. - /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is - /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this - /// function but may be not suitable for some operations. - /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: - /// \p padding or \p hash_id is invalid. - pub fn mbedtls_rsa_set_padding( - ctx: *mut mbedtls_rsa_context, - padding: ::core::ffi::c_int, - hash_id: mbedtls_md_type_t, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves padding mode of initialized - /// RSA context. - /// - /// \param ctx The initialized RSA context. + /// \brief This function performs multiplication and addition of two + /// points by integers: \p R = \p m * \p P + \p n * \p Q in a + /// restartable way. /// - /// \return RSA padding mode. - pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function retrieves hash identifier of mbedtls_md_type_t - /// type. + /// \see \c mbedtls_ecp_muladd() /// - /// \param ctx The initialized RSA context. + /// \note This function works the same as \c mbedtls_ecp_muladd(), + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return Hash identifier of mbedtls_md_type_t type. - pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function imports a set of core parameters into an - /// RSA context. + /// \note This function is only defined for short Weierstrass curves. + /// It may not be included in builds without any short + /// Weierstrass curve. /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param R The point in which to store the result of the calculation. + /// This must be initialized. + /// \param m The integer by which to multiply \p P. + /// This must be initialized. + /// \param P The point to multiply by \p m. This must be initialized. + /// \param n The integer by which to multiply \p Q. + /// This must be initialized. + /// \param Q The point to be multiplied by \p n. + /// This must be initialized. + /// \param rs_ctx The restart context (NULL disables restart). /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if \p m or \p n are not + /// valid private keys, or \p P or \p Q are not valid public + /// keys. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if \p grp does not + /// designate a short Weierstrass curve. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_muladd_restartable( + grp: *mut mbedtls_ecp_group, + R: *mut mbedtls_ecp_point, + m: *const mbedtls_mpi, + P: *const mbedtls_ecp_point, + n: *const mbedtls_mpi, + Q: *const mbedtls_ecp_point, + rs_ctx: *mut mbedtls_ecp_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function checks that a point is a valid public key + /// on this curve. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// It only checks that the point is non-zero, has + /// valid coordinates and lies on the curve. It does not verify + /// that it is indeed a multiple of \c G. This additional + /// check is computationally more expensive, is not required + /// by standards, and should not be necessary if the group + /// used has a small cofactor. In particular, it is useless for + /// the NIST groups which all have a cofactor of 1. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure, to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param E The public exponent. This may be \c NULL. + /// \param grp The ECP group the point should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param pt The point to check. This must be initialized. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import( - ctx: *mut mbedtls_rsa_context, - N: *const mbedtls_mpi, - P: *const mbedtls_mpi, - Q: *const mbedtls_mpi, - D: *const mbedtls_mpi, - E: *const mbedtls_mpi, + /// \return \c 0 if the point is a valid public key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not + /// a valid public key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_pubkey( + grp: *const mbedtls_ecp_group, + pt: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function imports core RSA parameters, in raw big-endian - /// binary format, into an RSA context. - /// - /// \note This function can be called multiple times for successive - /// imports, if the parameters are not simultaneously present. + /// \brief This function checks that an \c mbedtls_mpi is a + /// valid private key for this curve. /// - /// Any sequence of calls to this function should be followed - /// by a call to mbedtls_rsa_complete(), which checks and - /// completes the provided information to a ready-for-use - /// public or private RSA key. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \note See mbedtls_rsa_complete() for more information on which - /// parameters are necessary to set up a private or public - /// RSA key. + /// \param grp The ECP group the private key should belong to. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The integer to check. This must be initialized. /// - /// \note The imported parameters are copied and need not be preserved - /// for the lifetime of the RSA context being set up. + /// \return \c 0 if the point is a valid private key. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY if the point is not a valid + /// private key for the given curve. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_check_privkey( + grp: *const mbedtls_ecp_group, + d: *const mbedtls_mpi, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates a private key. /// - /// \param ctx The initialized RSA context to store the parameters in. - /// \param N The RSA modulus. This may be \c NULL. - /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. - /// \param P The first prime factor of \p N. This may be \c NULL. - /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. - /// \param Q The second prime factor of \p N. This may be \c NULL. - /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. - /// \param D The private exponent. This may be \c NULL. - /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. - /// \param E The public exponent. This may be \c NULL. - /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// \param grp The ECP group to generate a private key for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_import_raw( - ctx: *mut mbedtls_rsa_context, - N: *const ::core::ffi::c_uchar, - N_len: usize, - P: *const ::core::ffi::c_uchar, - P_len: usize, - Q: *const ::core::ffi::c_uchar, - Q_len: usize, - D: *const ::core::ffi::c_uchar, - D_len: usize, - E: *const ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_privkey( + grp: *const mbedtls_ecp_group, + d: *mut mbedtls_mpi, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function completes an RSA context from - /// a set of imported core parameters. - /// - /// To setup an RSA public key, precisely \p N and \p E - /// must have been imported. + /// \brief This function generates a keypair with a configurable base + /// point. /// - /// To setup an RSA private key, sufficient information must - /// be present for the other parameters to be derivable. + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// The default implementation supports the following: - ///
          • Derive \p P, \p Q from \p N, \p D, \p E.
            • - ///
          • Derive \p N, \p D from \p P, \p Q, \p E.
          - /// Alternative implementations need not support these. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param G The base point to use. This must be initialized + /// and belong to \p grp. It replaces the default base + /// point \c grp->G used by mbedtls_ecp_gen_keypair(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// If this function runs successfully, it guarantees that - /// the RSA context can be used for RSA operations without - /// the risk of failure or crash. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair_base( + grp: *mut mbedtls_ecp_group, + G: *const mbedtls_ecp_point, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function generates an ECP keypair. /// - /// \warning This function need not perform consistency checks - /// for the imported parameters. In particular, parameters that - /// are not needed by the implementation might be silently - /// discarded and left unchecked. To check the consistency - /// of the key material, see mbedtls_rsa_check_privkey(). + /// \note This function uses bare components rather than an + /// ::mbedtls_ecp_keypair structure to ease use with other + /// structures, such as ::mbedtls_ecdh_context or + /// ::mbedtls_ecdsa_context. /// - /// \param ctx The initialized RSA context holding imported parameters. + /// \param grp The ECP group to generate a key pair for. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param d The destination MPI (secret part). + /// This must be initialized. + /// \param Q The destination point (public part). + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations - /// failed. - pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_keypair( + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports the core parameters of an RSA key. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. - /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \brief This function generates an ECP key. /// - /// \param ctx The initialized RSA context. - /// \param N The MPI to hold the RSA modulus. - /// This may be \c NULL if this field need not be exported. - /// \param P The MPI to hold the first prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param Q The MPI to hold the second prime factor of \p N. - /// This may be \c NULL if this field need not be exported. - /// \param D The MPI to hold the private exponent. - /// This may be \c NULL if this field need not be exported. - /// \param E The MPI to hold the public exponent. - /// This may be \c NULL if this field need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. This must be initialized. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export( - ctx: *const mbedtls_rsa_context, - N: *mut mbedtls_mpi, - P: *mut mbedtls_mpi, - Q: *mut mbedtls_mpi, - D: *mut mbedtls_mpi, - E: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX error code + /// on failure. + pub fn mbedtls_ecp_gen_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports core parameters of an RSA key - /// in raw big-endian binary format. - /// - /// If this function runs successfully, the non-NULL buffers - /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully - /// written, with additional unused space filled leading by - /// zero Bytes. + /// \brief Set the public key in a key pair object. /// - /// Possible reasons for returning - /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            - ///
          • An alternative RSA implementation is in use, which - /// stores the key externally, and either cannot or should - /// not export it into RAM.
            • - ///
          • A SW or HW implementation might not support a certain - /// deduction. For example, \p P, \p Q from \p N, \p D, - /// and \p E if the former are not part of the - /// implementation.
          - /// If the function fails due to an unsupported operation, - /// the RSA context stays intact and remains usable. + /// \note This function does not check that the point actually + /// belongs to the given group. Call mbedtls_ecp_check_pubkey() + /// on \p Q before calling this function to check that. /// - /// \note The length parameters are ignored if the corresponding - /// buffer pointers are NULL. + /// \note This function does not check that the public key matches + /// the private key that is already in \p key, if any. + /// To check the consistency of the resulting key pair object, + /// call mbedtls_ecp_check_pub_priv() after setting both + /// the public key and the private key. /// - /// \param ctx The initialized RSA context. - /// \param N The Byte array to store the RSA modulus, - /// or \c NULL if this field need not be exported. - /// \param N_len The size of the buffer for the modulus. - /// \param P The Byte array to hold the first prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param P_len The size of the buffer for the first prime factor. - /// \param Q The Byte array to hold the second prime factor of \p N, - /// or \c NULL if this field need not be exported. - /// \param Q_len The size of the buffer for the second prime factor. - /// \param D The Byte array to hold the private exponent, - /// or \c NULL if this field need not be exported. - /// \param D_len The size of the buffer for the private exponent. - /// \param E The Byte array to hold the public exponent, - /// or \c NULL if this field need not be exported. - /// \param E_len The size of the buffer for the public exponent. + /// \param grp_id The ECP group identifier. + /// \param key The key pair object. It must be initialized. + /// If its group has already been set, it must match \p grp_id. + /// If its group has not been set, it will be set to \p grp_id. + /// If the public key has already been set, it is overwritten. + /// \param Q The public key to copy. This must be a point on the + /// curve indicated by \p grp_id. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the - /// requested parameters cannot be done due to missing - /// functionality or because of security policies. - /// \return A non-zero return code on any other failure. - pub fn mbedtls_rsa_export_raw( - ctx: *const mbedtls_rsa_context, - N: *mut ::core::ffi::c_uchar, - N_len: usize, - P: *mut ::core::ffi::c_uchar, - P_len: usize, - Q: *mut ::core::ffi::c_uchar, - Q_len: usize, - D: *mut ::core::ffi::c_uchar, - D_len: usize, - E: *mut ::core::ffi::c_uchar, - E_len: usize, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p key does not + /// match \p grp_id. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_set_public_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + Q: *const mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function exports CRT parameters of a private RSA key. + /// \brief This function reads an elliptic curve private key. /// - /// \note Alternative RSA implementations not using CRT-parameters - /// internally can implement this function based on - /// mbedtls_rsa_deduce_opt(). + /// \note This function does not set the public key in the + /// key pair object. Without a public key, the key pair object + /// cannot be used with operations that require the public key. + /// Call mbedtls_ecp_keypair_calc_public() to set the public + /// key from the private key. Alternatively, you can call + /// mbedtls_ecp_set_public_key() to set the public key part, + /// and then optionally mbedtls_ecp_check_pub_priv() to check + /// that the private and public parts are consistent. + /// + /// \note If a public key has already been set in the key pair + /// object, this function does not check that it is consistent + /// with the private key. Call mbedtls_ecp_check_pub_priv() + /// after setting both the public key and the private key + /// to make that check. /// - /// \param ctx The initialized RSA context. - /// \param DP The MPI to hold \c D modulo `P-1`, - /// or \c NULL if it need not be exported. - /// \param DQ The MPI to hold \c D modulo `Q-1`, - /// or \c NULL if it need not be exported. - /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, - /// or \c NULL if it need not be exported. + /// \param grp_id The ECP group identifier. + /// \param key The destination key. + /// \param buf The buffer containing the binary representation of the + /// key. (Big endian integer for Weierstrass curves, byte + /// string for Montgomery curves.) + /// \param buflen The length of the buffer in bytes. /// - /// \return \c 0 on success. - /// \return A non-zero error code on failure. - pub fn mbedtls_rsa_export_crt( - ctx: *const mbedtls_rsa_context, - DP: *mut mbedtls_mpi, - DQ: *mut mbedtls_mpi, - QP: *mut mbedtls_mpi, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_INVALID_KEY error if the key is + /// invalid. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the operation for + /// the group is not implemented. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_read_key( + grp_id: mbedtls_ecp_group_id, + key: *mut mbedtls_ecp_keypair, + buf: *const ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function retrieves the length of RSA modulus in Bytes. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context. + /// \deprecated Note that although this function accepts an output + /// buffer that is smaller or larger than the key, most key + /// import interfaces require the output to have exactly + /// key's nominal length. It is generally simplest to + /// pass the key's nominal length as \c buflen, after + /// checking that the output buffer is large enough. + /// See the description of the \p buflen parameter for + /// how to calculate the nominal length. + /// To avoid this difficulty, use mbedtls_ecp_write_key_ext() + /// instead. + /// mbedtls_ecp_write_key() is deprecated and will be + /// removed in a future version of the library. + /// + /// \note If the private key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \return The length of the RSA modulus in Bytes. - pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; + /// \param key The private key. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// For Weierstrass curves, this is the big-endian + /// representation, padded with null bytes at the beginning + /// to reach \p buflen bytes. + /// For Montgomery curves, this is the standard byte string + /// representation (which is little-endian), padded with + /// null bytes at the end to reach \p buflen bytes. + /// \param buflen The total length of the buffer in bytes. + /// The length of the output is + /// (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// For Weierstrass keys, if the output buffer is smaller, + /// leading zeros are trimmed to fit if possible. For + /// Montgomery keys, the output buffer must always be large + /// enough for the nominal length. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL or + /// #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key( + key: *mut mbedtls_ecp_keypair, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an RSA keypair. - /// - /// \note mbedtls_rsa_init() must be called before this function, - /// to set up the RSA context. + /// \brief This function exports an elliptic curve private key. /// - /// \param ctx The initialized RSA context used to hold the key. - /// \param f_rng The RNG function to be used for key generation. - /// This is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. - /// This may be \c NULL if \p f_rng doesn't need a context. - /// \param nbits The size of the public key in bits. - /// \param exponent The public exponent to use. For example, \c 65537. - /// This must be odd and greater than \c 1. + /// \param key The private key. + /// \param olen On success, the length of the private key. + /// This is always (`grp->nbits` + 7) / 8 bytes + /// where `grp->nbits` is the private key size in bits. + /// \param buf The output buffer for containing the binary representation + /// of the key. + /// \param buflen The total length of the buffer in bytes. + /// #MBEDTLS_ECP_MAX_BYTES is always sufficient. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_gen_key( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - nbits: ::core::ffi::c_uint, - exponent: ::core::ffi::c_int, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the \p key + /// representation is larger than the available space in \p buf. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if no private key is + /// set in \p key. + /// \return Another negative error code on different kinds of failure. + pub fn mbedtls_ecp_write_key_ext( + key: *const mbedtls_ecp_keypair, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains at least an RSA - /// public key. + /// \brief This function exports an elliptic curve public key. /// - /// If the function runs successfully, it is guaranteed that - /// enough information is present to perform an RSA public key - /// operation using mbedtls_rsa_public(). + /// \note If the public key was not set in \p key, + /// the output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to check. + /// \param key The public key. + /// \param format The point format. This must be either + /// #MBEDTLS_ECP_PF_COMPRESSED or #MBEDTLS_ECP_PF_UNCOMPRESSED. + /// (For groups without these formats, this parameter is + /// ignored. But it still has to be either of the above + /// values.) + /// \param olen The address at which to store the length of + /// the output in Bytes. This must not be \c NULL. + /// \param buf The output buffer. This must be a writable buffer + /// of length \p buflen Bytes. + /// \param buflen The length of the output buffer \p buf in Bytes. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL if the output buffer + /// is too small to hold the point. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if the point format + /// or the export for the given group is not implemented. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_write_public_key( + key: *const mbedtls_ecp_keypair, + format: ::core::ffi::c_int, + olen: *mut usize, + buf: *mut ::core::ffi::c_uchar, + buflen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks if a context contains an RSA private key - /// and perform basic consistency checks. - /// - /// \note The consistency checks performed by this function not only - /// ensure that mbedtls_rsa_private() can be called successfully - /// on the given context, but that the various parameters are - /// mutually consistent with high probability, in the sense that - /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// \brief This function checks that the keypair objects + /// \p pub and \p prv have the same group and the + /// same public point, and that the private key in + /// \p prv is consistent with the public key. /// - /// \warning This function should catch accidental misconfigurations - /// like swapping of parameters, but it cannot establish full - /// trust in neither the quality nor the consistency of the key - /// material that was used to setup the given RSA context: - ///
          • Consistency: Imported parameters that are irrelevant - /// for the implementation might be silently dropped. If dropped, - /// the current function does not have access to them, - /// and therefore cannot check them. See mbedtls_rsa_complete(). - /// If you want to check the consistency of the entire - /// content of a PKCS1-encoded RSA private key, for example, you - /// should use mbedtls_rsa_validate_params() before setting - /// up the RSA context. - /// Additionally, if the implementation performs empirical checks, - /// these checks substantiate but do not guarantee consistency.
            • - ///
          • Quality: This function is not expected to perform - /// extended quality assessments like checking that the prime - /// factors are safe. Additionally, it is the responsibility of the - /// user to ensure the trustworthiness of the source of his RSA - /// parameters, which goes beyond what is effectively checkable - /// by the library.
          - /// - /// \param ctx The initialized RSA context to check. + /// \param pub The keypair structure holding the public key. This + /// must be initialized. If it contains a private key, that + /// part is ignored. + /// \param prv The keypair structure holding the full keypair. + /// This must be initialized. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; + /// \return \c 0 on success, meaning that the keys are valid and match. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if the keys are invalid or do not match. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_check_pub_priv( + pub_: *const mbedtls_ecp_keypair, + prv: *const mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function checks a public-private RSA key pair. - /// - /// It checks each of the contexts, and makes sure they match. + /// \brief Calculate the public key from a private key in a key pair. /// - /// \param pub The initialized RSA context holding the public key. - /// \param prv The initialized RSA context holding the private key. + /// \param key A keypair structure. It must have a private key set. + /// If the public key is set, it will be overwritten. + /// \param f_rng The RNG function. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c + /// NULL if \p f_rng doesn't need a context. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_check_pub_priv( - pub_: *const mbedtls_rsa_context, - prv: *const mbedtls_rsa_context, + /// \return \c 0 on success. The key pair object can be used for + /// operations that require the public key. + /// \return An \c MBEDTLS_ERR_ECP_XXX or an \c MBEDTLS_ERR_MPI_XXX + /// error code on calculation failure. + pub fn mbedtls_ecp_keypair_calc_public( + key: *mut mbedtls_ecp_keypair, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs an RSA public key operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// - /// \note This function does not handle message padding. + /// \brief Query the group that a key pair belongs to. /// - /// \note Make sure to set \p input[0] = 0 or ensure that - /// input is smaller than \p N. + /// \param key The key pair to query. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_public( - ctx: *mut mbedtls_rsa_context, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The group ID for the group registered in the key pair + /// object. + /// This is \c MBEDTLS_ECP_DP_NONE if no group has been set + /// in the key pair object. + pub fn mbedtls_ecp_keypair_get_group_id( + key: *const mbedtls_ecp_keypair, + ) -> mbedtls_ecp_group_id; } unsafe extern "C" { - /// \brief This function performs an RSA private key operation. - /// - /// \note Blinding is used if and only if a PRNG is provided. + /// \brief This function exports generic key-pair parameters. /// - /// \note If blinding is used, both the base of exponentiation - /// and the exponent are blinded, providing protection - /// against some side-channel attacks. + /// Each of the output parameters can be a null pointer + /// if you do not need that parameter. /// - /// \warning It is deprecated and a security risk to not provide - /// a PRNG here and thereby prevent the use of blinding. - /// Future versions of the library may enforce the presence - /// of a PRNG. + /// \note If the private key or the public key was not set in \p key, + /// the corresponding output is unspecified. Future versions + /// may return an error in that case. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function, used for blinding. It is mandatory. - /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context. - /// \param input The input buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param key The key pair to export from. + /// \param grp Slot for exported ECP group. + /// It must either be null or point to an initialized ECP group. + /// \param d Slot for the exported secret value. + /// It must either be null or point to an initialized mpi. + /// \param Q Slot for the exported public value. + /// It must either be null or point to an initialized ECP point. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_private( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, + /// \return \c 0 on success, + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory-allocation failure. + /// \return #MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE if key id doesn't + /// correspond to a known group. + /// \return Another negative error code on other kinds of failure. + pub fn mbedtls_ecp_export( + key: *const mbedtls_ecp_keypair, + grp: *mut mbedtls_ecp_group, + d: *mut mbedtls_mpi, + Q: *mut mbedtls_ecp_point, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function adds the message padding, then performs an RSA - /// operation. - /// - /// It is the generic wrapper for performing a PKCS#1 encryption - /// operation. - /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG to use. It is used for padding generation - /// and it is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. May be - /// \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \brief The ECP checkup routine. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return \c 1 on failure. + pub fn mbedtls_ecp_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief The RSA context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_rsa_context { + ///< Reserved for internal purposes. + /// Do not set this field in application + /// code. Its meaning might change without + /// notice. + pub private_ver: ::core::ffi::c_int, + ///< The size of \p N in Bytes. + pub private_len: usize, + ///< The public modulus. + pub private_N: mbedtls_mpi, + ///< The public exponent. + pub private_E: mbedtls_mpi, + ///< The private exponent. + pub private_D: mbedtls_mpi, + ///< The first prime factor. + pub private_P: mbedtls_mpi, + ///< The second prime factor. + pub private_Q: mbedtls_mpi, + ///< D % (P - 1). + pub private_DP: mbedtls_mpi, + ///< D % (Q - 1). + pub private_DQ: mbedtls_mpi, + ///< 1 / (Q % P). + pub private_QP: mbedtls_mpi, + ///< cached R^2 mod N. + pub private_RN: mbedtls_mpi, + ///< cached R^2 mod P. + pub private_RP: mbedtls_mpi, + ///< cached R^2 mod Q. + pub private_RQ: mbedtls_mpi, + ///< The cached blinding value. + pub private_Vi: mbedtls_mpi, + ///< The cached un-blinding value. + pub private_Vf: mbedtls_mpi, + ///< Selects padding mode: + ///#MBEDTLS_RSA_PKCS_V15 for 1.5 padding and + ///#MBEDTLS_RSA_PKCS_V21 for OAEP or PSS. + pub private_padding: ::core::ffi::c_int, + ///< Hash identifier of mbedtls_md_type_t type, + ///as specified in md.h for use in the MGF + ///mask generating function used in the + ///EME-OAEP and EMSA-PSS encodings. + pub private_hash_id: ::core::ffi::c_int, +} +impl Default for mbedtls_rsa_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 encryption operation - /// (RSAES-PKCS1-v1_5-ENCRYPT). + /// \brief This function initializes an RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. It is mandatory and used for - /// padding generation. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param ilen The length of the plaintext in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note This function initializes the padding and the hash + /// identifier to respectively #MBEDTLS_RSA_PKCS_V15 and + /// #MBEDTLS_MD_NONE. See mbedtls_rsa_set_padding() for more + /// information about those parameters. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The RSA context to initialize. This must not be \c NULL. + pub fn mbedtls_rsa_init(ctx: *mut mbedtls_rsa_context); } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP encryption - /// operation (RSAES-OAEP-ENCRYPT). - /// - /// \note The output buffer must be as large as the size - /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \brief This function sets padding for an already initialized RSA + /// context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is needed for padding - /// generation and is mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may - /// be \c NULL if \p f_rng doesn't need a context argument. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param ilen The length of the plaintext buffer \p input in Bytes. - /// \param input The input data to encrypt. This must be a readable - /// buffer of size \p ilen Bytes. It may be \c NULL if - /// `ilen == 0`. - /// \param output The output buffer. This must be a writable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Set padding to #MBEDTLS_RSA_PKCS_V21 for the RSAES-OAEP + /// encryption scheme and the RSASSA-PSS signature scheme. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_encrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - ilen: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs an RSA operation, then removes the - /// message padding. + /// \note The \p hash_id parameter is ignored when using + /// #MBEDTLS_RSA_PKCS_V15 padding. /// - /// It is the generic wrapper for performing a PKCS#1 decryption - /// operation. + /// \note The choice of padding mode is strictly enforced for private + /// key operations, since there might be security concerns in + /// mixing padding modes. For public key operations it is + /// a default value, which can be overridden by calling specific + /// \c mbedtls_rsa_rsaes_xxx or \c mbedtls_rsa_rsassa_xxx + /// functions. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N (for example, - /// 128 Bytes if RSA-1024 is used) to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note The hash selected in \p hash_id is always used for OEAP + /// encryption. For PSS signatures, it is always used for + /// making signatures, but can be overridden for verifying them. + /// If set to #MBEDTLS_MD_NONE, it is always overridden. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \param ctx The initialized RSA context to be configured. + /// \param padding The padding mode to use. This must be either + /// #MBEDTLS_RSA_PKCS_V15 or #MBEDTLS_RSA_PKCS_V21. + /// \param hash_id The hash identifier for PSS or OAEP, if \p padding is + /// #MBEDTLS_RSA_PKCS_V21. #MBEDTLS_MD_NONE is accepted by this + /// function but may be not suitable for some operations. + /// Ignored if \p padding is #MBEDTLS_RSA_PKCS_V15. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_decrypt( + /// \return #MBEDTLS_ERR_RSA_INVALID_PADDING failure: + /// \p padding or \p hash_id is invalid. + pub fn mbedtls_rsa_set_padding( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + padding: ::core::ffi::c_int, + hash_id: mbedtls_md_type_t, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 decryption - /// operation (RSAES-PKCS1-v1_5-DECRYPT). + /// \brief This function retrieves padding mode of initialized + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for example, - /// 128 Bytes if RSA-1024 is used, to be able to hold an - /// arbitrary decrypted message. If it is not large enough to - /// hold the decryption of the particular ciphertext provided, - /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \param ctx The initialized RSA context. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// \return RSA padding mode. + pub fn mbedtls_rsa_get_padding_mode(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function retrieves hash identifier of mbedtls_md_type_t + /// type. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context. + /// + /// \return Hash identifier of mbedtls_md_type_t type. + pub fn mbedtls_rsa_get_md_alg(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 OAEP decryption - /// operation (RSAES-OAEP-DECRYPT). + /// \brief This function imports a set of core parameters into an + /// RSA context. /// - /// \note The output buffer length \c output_max_len should be - /// as large as the size \p ctx->len of \p ctx->N, for - /// example, 128 Bytes if RSA-1024 is used, to be able to - /// hold an arbitrary decrypted message. If it is not - /// large enough to hold the decryption of the particular - /// ciphertext provided, the function returns - /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context. - /// \param label The buffer holding the custom label to use. - /// This must be a readable buffer of length \p label_len - /// Bytes. It may be \c NULL if \p label_len is \c 0. - /// \param label_len The length of the label in Bytes. - /// \param olen The address at which to store the length of - /// the plaintext. This must not be \c NULL. - /// \param input The ciphertext buffer. This must be a readable buffer - /// of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. - /// \param output The buffer used to hold the plaintext. This must - /// be a writable buffer of length \p output_max_len Bytes. - /// \param output_max_len The length in Bytes of the output buffer \p output. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. + /// + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. + /// + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. + /// + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param E The public exponent. This may be \c NULL. /// /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsaes_oaep_decrypt( + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - label: *const ::core::ffi::c_uchar, - label_len: usize, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, + N: *const mbedtls_mpi, + P: *const mbedtls_mpi, + Q: *const mbedtls_mpi, + D: *const mbedtls_mpi, + E: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a private RSA operation to sign - /// a message digest using PKCS#1. + /// \brief This function imports core RSA parameters, in raw big-endian + /// binary format, into an RSA context. /// - /// It is the generic wrapper for performing a PKCS#1 - /// signature. + /// \note This function can be called multiple times for successive + /// imports, if the parameters are not simultaneously present. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// Any sequence of calls to this function should be followed + /// by a call to mbedtls_rsa_complete(), which checks and + /// completes the provided information to a ready-for-use + /// public or private RSA key. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_sign() for details on - /// \p md_alg and \p hash_id. + /// \note See mbedtls_rsa_complete() for more information on which + /// parameters are necessary to set up a private or public + /// RSA key. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function to use. This is mandatory and - /// must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \note The imported parameters are copied and need not be preserved + /// for the lifetime of the RSA context being set up. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_sign( + /// \param ctx The initialized RSA context to store the parameters in. + /// \param N The RSA modulus. This may be \c NULL. + /// \param N_len The Byte length of \p N; it is ignored if \p N == NULL. + /// \param P The first prime factor of \p N. This may be \c NULL. + /// \param P_len The Byte length of \p P; it is ignored if \p P == NULL. + /// \param Q The second prime factor of \p N. This may be \c NULL. + /// \param Q_len The Byte length of \p Q; it is ignored if \p Q == NULL. + /// \param D The private exponent. This may be \c NULL. + /// \param D_len The Byte length of \p D; it is ignored if \p D == NULL. + /// \param E The public exponent. This may be \c NULL. + /// \param E_len The Byte length of \p E; it is ignored if \p E == NULL. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_import_raw( ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + N: *const ::core::ffi::c_uchar, + N_len: usize, + P: *const ::core::ffi::c_uchar, + P_len: usize, + Q: *const ::core::ffi::c_uchar, + Q_len: usize, + D: *const ::core::ffi::c_uchar, + D_len: usize, + E: *const ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 signature - /// operation (RSASSA-PKCS1-v1_5-SIGN). + /// \brief This function completes an RSA context from + /// a set of imported core parameters. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. This is used for blinding and is - /// mandatory; see mbedtls_rsa_private() for more. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// To setup an RSA public key, precisely \c N and \c E + /// must have been imported. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// To setup an RSA private key, sufficient information must + /// be present for the other parameters to be derivable. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// The default implementation supports the following: + ///
          • Derive \c P, \c Q from \c N, \c D, \c E.
            • + ///
          • Derive \c N, \c D from \c P, \c Q, \c E.
          + /// Alternative implementations need not support these. /// - /// \note This function enforces that the provided salt length complies - /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 - /// step 3. The constraint is that the hash length plus the salt - /// length plus 2 bytes must be at most the key length. If this - /// constraint is not met, this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// If this function runs successfully, it guarantees that + /// the RSA context can be used for RSA operations without + /// the risk of failure or crash. /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param saltlen The length of the salt that should be used. - /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use - /// the largest possible salt length up to the hash length, - /// which is the largest permitted by some standards including - /// FIPS 186-4 §5.5. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// \warning This function need not perform consistency checks + /// for the imported parameters. In particular, parameters that + /// are not needed by the implementation might be silently + /// discarded and left unchecked. To check the consistency + /// of the key material, see mbedtls_rsa_check_privkey(). /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign_ext( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - saltlen: ::core::ffi::c_int, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param ctx The initialized RSA context holding imported parameters. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_RSA_BAD_INPUT_DATA if the attempted derivations + /// failed. + pub fn mbedtls_rsa_complete(ctx: *mut mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS signature - /// operation (RSASSA-PSS-SIGN). + /// \brief This function exports the core parameters of an RSA key. /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \note This function always uses the maximum possible salt size, - /// up to the length of the payload hash. This choice of salt - /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 - /// v2.2) §9.1.1 step 3. Furthermore this function enforces a - /// minimum salt size which is the hash size minus 2 bytes. If - /// this minimum size is too large given the key size (the salt - /// size, plus the hash size, plus 2 bytes must be no more than - /// the key size in bytes), this function returns - /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          /// - /// \param ctx The initialized RSA context to use. - /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL - /// if \p f_rng doesn't need a context argument. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer to hold the signature. This must be a writable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. A buffer length of - /// #MBEDTLS_MPI_MAX_SIZE is always safe. + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the signing operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_sign( - ctx: *mut mbedtls_rsa_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param N The MPI to hold the RSA modulus. + /// This may be \c NULL if this field need not be exported. + /// \param P The MPI to hold the first prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param Q The MPI to hold the second prime factor of \p N. + /// This may be \c NULL if this field need not be exported. + /// \param D The MPI to hold the private exponent. + /// This may be \c NULL if this field need not be exported. + /// \param E The MPI to hold the public exponent. + /// This may be \c NULL if this field need not be exported. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export( + ctx: *const mbedtls_rsa_context, + N: *mut mbedtls_mpi, + P: *mut mbedtls_mpi, + Q: *mut mbedtls_mpi, + D: *mut mbedtls_mpi, + E: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a public RSA operation and checks - /// the message digest. - /// - /// This is the generic wrapper for performing a PKCS#1 - /// verification. + /// \brief This function exports core parameters of an RSA key + /// in raw big-endian binary format. /// - /// \note For PKCS#1 v2.1 encoding, see comments on - /// mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - /// \p hash_id. + /// If this function runs successfully, the non-NULL buffers + /// pointed to by \p N, \p P, \p Q, \p D, and \p E are fully + /// written, with additional unused space filled leading by + /// zero Bytes. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// Possible reasons for returning + /// #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            + ///
          • An alternative RSA implementation is in use, which + /// stores the key externally, and either cannot or should + /// not export it into RAM.
            • + ///
          • A SW or HW implementation might not support a certain + /// deduction. For example, \p P, \p Q from \p N, \p D, + /// and \p E if the former are not part of the + /// implementation.
          + /// If the function fails due to an unsupported operation, + /// the RSA context stays intact and remains usable. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_pkcs1_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \note The length parameters are ignored if the corresponding + /// buffer pointers are NULL. + /// + /// \param ctx The initialized RSA context. + /// \param N The Byte array to store the RSA modulus, + /// or \c NULL if this field need not be exported. + /// \param N_len The size of the buffer for the modulus. + /// \param P The Byte array to hold the first prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param P_len The size of the buffer for the first prime factor. + /// \param Q The Byte array to hold the second prime factor of \p N, + /// or \c NULL if this field need not be exported. + /// \param Q_len The size of the buffer for the second prime factor. + /// \param D The Byte array to hold the private exponent, + /// or \c NULL if this field need not be exported. + /// \param D_len The size of the buffer for the private exponent. + /// \param E The Byte array to hold the public exponent, + /// or \c NULL if this field need not be exported. + /// \param E_len The size of the buffer for the public exponent. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED if exporting the + /// requested parameters cannot be done due to missing + /// functionality or because of security policies. + /// \return A non-zero return code on any other failure. + pub fn mbedtls_rsa_export_raw( + ctx: *const mbedtls_rsa_context, + N: *mut ::core::ffi::c_uchar, + N_len: usize, + P: *mut ::core::ffi::c_uchar, + P_len: usize, + Q: *mut ::core::ffi::c_uchar, + Q_len: usize, + D: *mut ::core::ffi::c_uchar, + D_len: usize, + E: *mut ::core::ffi::c_uchar, + E_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v1.5 verification - /// operation (RSASSA-PKCS1-v1_5-VERIFY). + /// \brief This function exports CRT parameters of a private RSA key. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note Alternative RSA implementations not using CRT-parameters + /// internally can implement this function based on + /// mbedtls_rsa_deduce_opt(). /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, + /// \param ctx The initialized RSA context. + /// \param DP The MPI to hold \c D modulo `P-1`, + /// or \c NULL if it need not be exported. + /// \param DQ The MPI to hold \c D modulo `Q-1`, + /// or \c NULL if it need not be exported. + /// \param QP The MPI to hold modular inverse of \c Q modulo \c P, + /// or \c NULL if it need not be exported. + /// + /// \return \c 0 on success. + /// \return A non-zero error code on failure. + pub fn mbedtls_rsa_export_crt( + ctx: *const mbedtls_rsa_context, + DP: *mut mbedtls_mpi, + DQ: *mut mbedtls_mpi, + QP: *mut mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). - /// - /// \note The \c hash_id set in \p ctx by calling - /// mbedtls_rsa_set_padding() selects the hash used for the - /// encoding operation and for the mask generation function - /// (MGF1). For more details on the encoding operation and the - /// mask generation function, consult RFC-3447: Public-Key - /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. If the \c hash_id set in \p ctx by - /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg - /// parameter is used. + /// \brief This function retrieves the length of the RSA modulus in bits. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \param ctx The initialized RSA context. /// - /// \return \c 0 if the verify operation was successful. - /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify( - ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \return The length of the RSA modulus in bits. + pub fn mbedtls_rsa_get_bitlen(ctx: *const mbedtls_rsa_context) -> usize; } unsafe extern "C" { - /// \brief This function performs a PKCS#1 v2.1 PSS verification - /// operation (RSASSA-PSS-VERIFY). + /// \brief This function retrieves the length of RSA modulus in Bytes. /// - /// \note The \p sig buffer must be as large as the size - /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. + /// \param ctx The initialized RSA context. /// - /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is - /// ignored. + /// \return The length of the RSA modulus in Bytes. + pub fn mbedtls_rsa_get_len(ctx: *const mbedtls_rsa_context) -> usize; +} +unsafe extern "C" { + /// \brief This function generates an RSA keypair. /// - /// \param ctx The initialized RSA public key context to use. - /// \param md_alg The message-digest algorithm used to hash the original data. - /// Use #MBEDTLS_MD_NONE for signing raw data. - /// \param hashlen The length of the message digest or raw data in Bytes. - /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the - /// output length of the corresponding hash algorithm. - /// \param hash The buffer holding the message digest or raw data. - /// This must be a readable buffer of at least \p hashlen Bytes. - /// \param mgf1_hash_id The message digest algorithm used for the - /// verification operation and the mask generation - /// function (MGF1). For more details on the encoding - /// operation and the mask generation function, consult - /// RFC-3447: Public-Key Cryptography Standards - /// (PKCS) #1 v2.1: RSA Cryptography - /// Specifications. - /// \param expected_salt_len The length of the salt used in padding. Use - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// \param sig The buffer holding the signature. This must be a readable - /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes - /// for an 2048-bit RSA modulus. + /// \note mbedtls_rsa_init() must be called before this function, + /// to set up the RSA context. /// - /// \return \c 0 if the verify operation was successful. + /// \param ctx The initialized RSA context used to hold the key. + /// \param f_rng The RNG function to be used for key generation. + /// This is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. + /// This may be \c NULL if \p f_rng doesn't need a context. + /// \param nbits The size of the public key in bits. + /// \param exponent The public exponent to use. For example, \c 65537. + /// This must be odd and greater than \c 1. + /// + /// \return \c 0 on success. /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. - pub fn mbedtls_rsa_rsassa_pss_verify_ext( + pub fn mbedtls_rsa_gen_key( ctx: *mut mbedtls_rsa_context, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - mgf1_hash_id: mbedtls_md_type_t, - expected_salt_len: ::core::ffi::c_int, - sig: *const ::core::ffi::c_uchar, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + nbits: ::core::ffi::c_uint, + exponent: ::core::ffi::c_int, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function copies the components of an RSA context. + /// \brief This function checks if a context contains at least an RSA + /// public key. /// - /// \param dst The destination context. This must be initialized. - /// \param src The source context. This must be initialized. + /// If the function runs successfully, it is guaranteed that + /// enough information is present to perform an RSA public key + /// operation using mbedtls_rsa_public(). + /// + /// \param ctx The initialized RSA context to check. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. - pub fn mbedtls_rsa_copy( - dst: *mut mbedtls_rsa_context, - src: *const mbedtls_rsa_context, - ) -> ::core::ffi::c_int; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pubkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees the components of an RSA key. + /// \brief This function checks if a context contains an RSA private key + /// and perform basic consistency checks. /// - /// \param ctx The RSA context to free. May be \c NULL, in which case - /// this function is a no-op. If it is not \c NULL, it must - /// point to an initialized RSA context. - pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); + /// \note The consistency checks performed by this function not only + /// ensure that mbedtls_rsa_private() can be called successfully + /// on the given context, but that the various parameters are + /// mutually consistent with high probability, in the sense that + /// mbedtls_rsa_public() and mbedtls_rsa_private() are inverses. + /// + /// \warning This function should catch accidental misconfigurations + /// like swapping of parameters, but it cannot establish full + /// trust in neither the quality nor the consistency of the key + /// material that was used to setup the given RSA context: + ///
          • Consistency: Imported parameters that are irrelevant + /// for the implementation might be silently dropped. If dropped, + /// the current function does not have access to them, + /// and therefore cannot check them. See mbedtls_rsa_complete(). + /// If you want to check the consistency of the entire + /// content of a PKCS1-encoded RSA private key, for example, you + /// should use mbedtls_rsa_validate_params() before setting + /// up the RSA context. + /// Additionally, if the implementation performs empirical checks, + /// these checks substantiate but do not guarantee consistency.
            • + ///
          • Quality: This function is not expected to perform + /// extended quality assessments like checking that the prime + /// factors are safe. Additionally, it is the responsibility of the + /// user to ensure the trustworthiness of the source of his RSA + /// parameters, which goes beyond what is effectively checkable + /// by the library.
          + /// + /// \param ctx The initialized RSA context to check. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_privkey(ctx: *const mbedtls_rsa_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief The RSA checkup routine. + /// \brief This function checks a public-private RSA key pair. + /// + /// It checks each of the contexts, and makes sure they match. + /// + /// \param pub The initialized RSA context holding the public key. + /// \param prv The initialized RSA context holding the private key. /// /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief The ECDSA context structure. -/// -/// \warning Performing multiple operations concurrently on the same -/// ECDSA context is not supported; objects of this type -/// should not be shared between multiple threads. -/// -/// \note pk_wrap module assumes that "ecdsa_context" is identical -/// to "ecp_keypair" (see for example structure -/// "mbedtls_eckey_info" where ECDSA sign/verify functions -/// are used also for EC key) -pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; -pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_check_pub_priv( + pub_: *const mbedtls_rsa_context, + prv: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { - /// \brief This function checks whether a given group can be used - /// for ECDSA. + /// \brief This function performs an RSA public key operation. /// - /// \param gid The ECP group ID to check. + /// \param ctx The initialized RSA context to use. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 1 if the group can be used, \c 0 otherwise - pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; + /// \note This function does not handle message padding. + /// + /// \note Make sure to set \p input[0] = 0 or ensure that + /// input is smaller than \c N. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_public( + ctx: *mut mbedtls_rsa_context, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message. + /// \brief This function performs an RSA private key operation. /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_ext() is usually preferred. + /// \note Blinding is used if and only if a PRNG is provided. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated - /// as defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \note If blinding is used, both the base of exponentiation + /// and the exponent are blinded, providing protection + /// against some side-channel attacks. /// - /// \see ecp.h + /// \warning It is deprecated and a security risk to not provide + /// a PRNG here and thereby prevent the use of blinding. + /// Future versions of the library may enforce the presence + /// of a PRNG. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized. - /// \param buf The content to be signed. This is usually the hash of - /// the original data to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function, used for blinding. It is mandatory. + /// \param p_rng The RNG context to pass to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context. + /// \param input The input buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX - /// or \c MBEDTLS_MPI_XXX error code on failure. - pub fn mbedtls_ecdsa_sign( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_private( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, deterministic version. + /// \brief This function adds the message padding, then performs an RSA + /// operation. /// - /// For more information, see RFC-6979: Deterministic - /// Usage of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). + /// It is the generic wrapper for performing a PKCS#1 encryption + /// operation. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG to use. It is used for padding generation + /// and it is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. May be + /// \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \see ecp.h + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v1.5 encryption operation + /// (RSAES-PKCS1-v1_5-ENCRYPT). /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. It is mandatory and used for + /// padding generation. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param ilen The length of the plaintext in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_ext( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 OAEP encryption + /// operation (RSAES-OAEP-ENCRYPT). /// - /// \note The deterministic version implemented in - /// mbedtls_ecdsa_sign_det_restartable() is usually - /// preferred. + /// \note The output buffer must be as large as the size + /// of ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \note This function is like \c mbedtls_ecdsa_sign() but - /// it can return early and restart according to the - /// limit set with \c mbedtls_ecp_set_max_ops() to - /// reduce blocking. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is needed for padding + /// generation and is mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may + /// be \c NULL if \p f_rng doesn't need a context argument. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param ilen The length of the plaintext buffer \p input in Bytes. + /// \param input The input data to encrypt. This must be a readable + /// buffer of size \p ilen Bytes. It may be \c NULL if + /// `ilen == 0`. + /// \param output The output buffer. This must be a writable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_encrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + ilen: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs an RSA operation, then removes the + /// message padding. /// - /// \see ecp.h + /// It is the generic wrapper for performing a PKCS#1 decryption + /// operation. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param f_rng The RNG function. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15, + /// mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an + /// inherently dangerous function (CWE-242). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N (for example, + /// 128 Bytes if RSA-1024 is used) to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns \c MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. + /// + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature of a - /// previously-hashed message, in a restartable way. - /// - /// \note This function is like \c - /// mbedtls_ecdsa_sign_det_ext() but it can return - /// early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 decryption + /// operation (RSAES-PKCS1-v1_5-DECRYPT). /// - /// \note If the bitlength of the message hash is larger - /// than the bitlength of the group order, then the - /// hash is truncated as defined in Standards for - /// Efficient Cryptography Group (SECG): SEC1 Elliptic - /// Curve Cryptography, section 4.1.3, step 5. + /// \warning This is an inherently dangerous function (CWE-242). Unless + /// it is used in a side channel free and safe way (eg. + /// implementing the TLS protocol as per 7.4.7.1 of RFC 5246), + /// the calling code is vulnerable. /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for example, + /// 128 Bytes if RSA-1024 is used, to be able to hold an + /// arbitrary decrypted message. If it is not large enough to + /// hold the decryption of the particular ciphertext provided, + /// the function returns #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The context for the elliptic curve to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param r The MPI context in which to store the first part - /// the signature. This must be initialized. - /// \param s The MPI context in which to store the second part - /// the signature. This must be initialized. - /// \param d The private signing key. This must be initialized - /// and setup, for example through - /// mbedtls_ecp_gen_privkey(). - /// \param buf The hashed content to be signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param md_alg The hash algorithm used to hash the original data. - /// \param f_rng_blind The RNG function used for blinding. This must not be - /// \c NULL. - /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context parameter. - /// \param rs_ctx The restart context to use. This may be \c NULL - /// to disable restarting. If it is not \c NULL, it - /// must point to an initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c - /// mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c - /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_sign_det_restartable( - grp: *mut mbedtls_ecp_group, - r: *mut mbedtls_mpi, - s: *mut mbedtls_mpi, - d: *const mbedtls_mpi, - buf: *const ::core::ffi::c_uchar, - blen: usize, - md_alg: mbedtls_md_type_t, - f_rng_blind: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng_blind: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_pkcs1_v15_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message. - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \brief This function performs a PKCS#1 v2.1 OAEP decryption + /// operation (RSAES-OAEP-DECRYPT). /// - /// \see ecp.h + /// \note The output buffer length \c output_max_len should be + /// as large as the size \p ctx->len of \p ctx->N, for + /// example, 128 Bytes if RSA-1024 is used, to be able to + /// hold an arbitrary decrypted message. If it is not + /// large enough to hold the decryption of the particular + /// ciphertext provided, the function returns + /// #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context. + /// \param label The buffer holding the custom label to use. + /// This must be a readable buffer of length \p label_len + /// Bytes. It may be \c NULL if \p label_len is \c 0. + /// \param label_len The length of the label in Bytes. + /// \param olen The address at which to store the length of + /// the plaintext. This must not be \c NULL. + /// \param input The ciphertext buffer. This must be a readable buffer + /// of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// \param output The buffer used to hold the plaintext. This must + /// be a writable buffer of length \p output_max_len Bytes. + /// \param output_max_len The length in Bytes of the output buffer \p output. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsaes_oaep_decrypt( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + label: *const ::core::ffi::c_uchar, + label_len: usize, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function verifies the ECDSA signature of a - /// previously-hashed message, in a restartable manner + /// \brief This function performs a private RSA operation to sign + /// a message digest using PKCS#1. /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// It is the generic wrapper for performing a PKCS#1 + /// signature. /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param grp The ECP group to use. - /// This must be initialized and have group parameters - /// set, for example through mbedtls_ecp_group_load(). - /// \param buf The hashed content that was signed. This must be a readable - /// buffer of length \p blen Bytes. It may be \c NULL if - /// \p blen is zero. - /// \param blen The length of \p buf in Bytes. - /// \param Q The public key to use for verification. This must be - /// initialized and setup. - /// \param r The first integer of the signature. - /// This must be initialized. - /// \param s The second integer of the signature. - /// This must be initialized. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. - /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX - /// error code on failure. - pub fn mbedtls_ecdsa_verify_restartable( - grp: *mut mbedtls_ecp_group, - buf: *const ::core::ffi::c_uchar, - blen: usize, - Q: *const mbedtls_ecp_point, - r: *const mbedtls_mpi, - s: *const mbedtls_mpi, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, serialized as defined in RFC-4492: - /// Elliptic Curve Cryptography (ECC) Cipher Suites for - /// Transport Layer Security (TLS). - /// - /// \warning It is not thread-safe to use the same context in - /// multiple threads. - /// - /// \note The deterministic version is used if - /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more - /// information, see RFC-6979: Deterministic Usage - /// of the Digital Signature Algorithm (DSA) and Elliptic - /// Curve Digital Signature Algorithm (ECDSA). - /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.3, step 5. - /// - /// \see ecp.h + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_sign() for details on + /// \p md_alg and \p hash_id. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is used only for blinding and may be set to \c NULL, but - /// doing so is DEPRECATED. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function to use. This is mandatory and + /// must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function computes the ECDSA signature and writes it - /// to a buffer, in a restartable way. - /// - /// \see \c mbedtls_ecdsa_write_signature() - /// - /// \note This function is like \c mbedtls_ecdsa_write_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \brief This function performs a PKCS#1 v1.5 signature + /// operation (RSASSA-PKCS1-v1_5-SIGN). /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and private key bound to it, for example - /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). - /// \param md_alg The message digest that was used to hash the message. - /// \param hash The message hash to be signed. This must be a readable - /// buffer of length \p blen Bytes. - /// \param hlen The length of the hash \p hash in Bytes. - /// \param sig The buffer to which to write the signature. This must be a - /// writable buffer of length at least twice as large as the - /// size of the curve used, plus 9. For example, 73 Bytes if - /// a 256-bit curve is used. A buffer length of - /// #MBEDTLS_ECDSA_MAX_LEN is always safe. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param slen The address at which to store the actual length of - /// the signature written. Must not be \c NULL. - /// \param f_rng The RNG function. This must not be \c NULL if - /// #MBEDTLS_ECDSA_DETERMINISTIC is unset. Otherwise, - /// it is unused and may be set to \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng is \c NULL or doesn't use a context. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. This is used for blinding and is + /// mandatory; see mbedtls_rsa_private() for more. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or - /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. - pub fn mbedtls_ecdsa_write_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - slen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \note If the bitlength of the message hash is larger than the - /// bitlength of the group order, then the hash is truncated as - /// defined in Standards for Efficient Cryptography Group - /// (SECG): SEC1 Elliptic Curve Cryptography, section - /// 4.1.4, step 3. + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \see ecp.h + /// \note This function enforces that the provided salt length complies + /// with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 v2.2) §9.1.1 + /// step 3. The constraint is that the hash length plus the salt + /// length plus 2 bytes must be at most the key length. If this + /// constraint is not met, this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param saltlen The length of the salt that should be used. + /// If passed #MBEDTLS_RSA_SALT_LEN_ANY, the function will use + /// the largest possible salt length up to the hash length, + /// which is the largest permitted by some standards including + /// FIPS 186-4 §5.5. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign_ext( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, - sig: *const ::core::ffi::c_uchar, - slen: usize, + saltlen: ::core::ffi::c_int, + sig: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function reads and verifies an ECDSA signature, - /// in a restartable way. + /// \brief This function performs a PKCS#1 v2.1 PSS signature + /// operation (RSASSA-PSS-SIGN). /// - /// \see \c mbedtls_ecdsa_read_signature() + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. /// - /// \note This function is like \c mbedtls_ecdsa_read_signature() - /// but it can return early and restart according to the limit - /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// \note This function always uses the maximum possible salt size, + /// up to the length of the payload hash. This choice of salt + /// size complies with FIPS 186-4 §5.5 (e) and RFC 8017 (PKCS#1 + /// v2.2) §9.1.1 step 3. Furthermore this function enforces a + /// minimum salt size which is the hash size minus 2 bytes. If + /// this minimum size is too large given the key size (the salt + /// size, plus the hash size, plus 2 bytes must be no more than + /// the key size in bytes), this function returns + /// #MBEDTLS_ERR_RSA_BAD_INPUT_DATA. /// - /// \param ctx The ECDSA context to use. This must be initialized - /// and have a group and public key bound to it. - /// \param hash The message hash that was signed. This must be a readable - /// buffer of length \p size Bytes. - /// \param hlen The size of the hash \p hash. - /// \param sig The signature to read and verify. This must be a readable - /// buffer of length \p slen Bytes. - /// \param slen The size of \p sig in Bytes. - /// \param rs_ctx The restart context to use. This may be \c NULL to disable - /// restarting. If it is not \c NULL, it must point to an - /// initialized restart context. + /// \param ctx The initialized RSA context to use. + /// \param f_rng The RNG function. It is mandatory and must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be \c NULL + /// if \p f_rng doesn't need a context argument. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer to hold the signature. This must be a writable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. A buffer length of + /// #MBEDTLS_MPI_MAX_SIZE is always safe. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. - /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid - /// signature in \p sig, but its length is less than \p siglen. - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX - /// error code on failure for any other reason. - pub fn mbedtls_ecdsa_read_signature_restartable( - ctx: *mut mbedtls_ecdsa_context, + /// \return \c 0 if the signing operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_sign( + ctx: *mut mbedtls_rsa_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a public RSA operation and checks + /// the message digest. + /// + /// This is the generic wrapper for performing a PKCS#1 + /// verification. + /// + /// \note For PKCS#1 v2.1 encoding, see comments on + /// mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + /// \c hash_id. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_pkcs1_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, hash: *const ::core::ffi::c_uchar, - hlen: usize, sig: *const ::core::ffi::c_uchar, - slen: usize, - rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function generates an ECDSA keypair on the given curve. + /// \brief This function performs a PKCS#1 v1.5 verification + /// operation (RSASSA-PKCS1-v1_5-VERIFY). /// - /// \see ecp.h + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. /// - /// \param ctx The ECDSA context to store the keypair in. - /// This must be initialized. - /// \param gid The elliptic curve to use. One of the various - /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG context to be passed to \p f_rng. This may be - /// \c NULL if \p f_rng doesn't need a context argument. + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pkcs1_v15_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_genkey( - ctx: *mut mbedtls_ecdsa_context, - gid: mbedtls_ecp_group_id, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \note The \c hash_id set in \p ctx by calling + /// mbedtls_rsa_set_padding() selects the hash used for the + /// encoding operation and for the mask generation function + /// (MGF1). For more details on the encoding operation and the + /// mask generation function, consult RFC-3447: Public-Key + /// Cryptography Standards (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. If the \c hash_id set in \p ctx by + /// mbedtls_rsa_set_padding() is #MBEDTLS_MD_NONE, the \p md_alg + /// parameter is used. + /// + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function sets up an ECDSA context from an EC key pair. + /// \brief This function performs a PKCS#1 v2.1 PSS verification + /// operation (RSASSA-PSS-VERIFY). /// - /// \see ecp.h + /// \note The \p sig buffer must be as large as the size + /// of \p ctx->N. For example, 128 Bytes if RSA-1024 is used. /// - /// \param ctx The ECDSA context to setup. This must be initialized. - /// \param key The EC key to use. This must be initialized and hold - /// a private-public key pair or a public key. In the former - /// case, the ECDSA context may be used for signature creation - /// and verification after this call. In the latter case, it - /// may be used for signature verification. + /// \note The \c hash_id set in \p ctx by mbedtls_rsa_set_padding() is + /// ignored. /// - /// \return \c 0 on success. - /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. - pub fn mbedtls_ecdsa_from_keypair( - ctx: *mut mbedtls_ecdsa_context, - key: *const mbedtls_ecp_keypair, + /// \param ctx The initialized RSA public key context to use. + /// \param md_alg The message-digest algorithm used to hash the original data. + /// Use #MBEDTLS_MD_NONE for signing raw data. + /// \param hashlen The length of the message digest or raw data in Bytes. + /// If \p md_alg is not #MBEDTLS_MD_NONE, this must match the + /// output length of the corresponding hash algorithm. + /// \param hash The buffer holding the message digest or raw data. + /// This must be a readable buffer of at least \p hashlen Bytes. + /// \param mgf1_hash_id The message digest algorithm used for the + /// verification operation and the mask generation + /// function (MGF1). For more details on the encoding + /// operation and the mask generation function, consult + /// RFC-3447: Public-Key Cryptography Standards + /// (PKCS) #1 v2.1: RSA Cryptography + /// Specifications. + /// \param expected_salt_len The length of the salt used in padding. Use + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. + /// \param sig The buffer holding the signature. This must be a readable + /// buffer of length \c ctx->len Bytes. For example, \c 256 Bytes + /// for an 2048-bit RSA modulus. + /// + /// \return \c 0 if the verify operation was successful. + /// \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. + pub fn mbedtls_rsa_rsassa_pss_verify_ext( + ctx: *mut mbedtls_rsa_context, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + mgf1_hash_id: mbedtls_md_type_t, + expected_salt_len: ::core::ffi::c_int, + sig: *const ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function initializes an ECDSA context. + /// \brief This function copies the components of an RSA context. /// - /// \param ctx The ECDSA context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); + /// \param dst The destination context. This must be initialized. + /// \param src The source context. This must be initialized. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_MPI_ALLOC_FAILED on memory allocation failure. + pub fn mbedtls_rsa_copy( + dst: *mut mbedtls_rsa_context, + src: *const mbedtls_rsa_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief This function frees an ECDSA context. + /// \brief This function frees the components of an RSA key. /// - /// \param ctx The ECDSA context to free. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must be initialized. - pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); + /// \param ctx The RSA context to free. May be \c NULL, in which case + /// this function is a no-op. If it is not \c NULL, it must + /// point to an initialized RSA context. + pub fn mbedtls_rsa_free(ctx: *mut mbedtls_rsa_context); } -pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; -pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; -pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; -pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; -/// \brief Public key types -pub type mbedtls_pk_type_t = ::core::ffi::c_uint; -/// \brief Options for RSASSA-PSS signature verification. -/// See \c mbedtls_rsa_rsassa_pss_verify_ext() -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_rsassa_pss_options { - /// The digest to use for MGF1 in PSS. +unsafe extern "C" { + /// \brief The RSA checkup routine. /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is - /// disabled, this must be equal to the \c md_alg argument passed - /// to mbedtls_pk_verify_ext(). In a future version of the library, - /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is - /// enabled regardless of the status of #MBEDTLS_RSA_C. - pub mgf1_hash_id: mbedtls_md_type_t, - /// The expected length of the salt, in bytes. This may be - /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. - /// - /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only - /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be - /// ignored (allowing any salt length). - pub expected_salt_len: ::core::ffi::c_int, -} -impl Default for mbedtls_pk_rsassa_pss_options { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; -pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; -/// \brief Types for interfacing with the debug module -pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; -/// \brief Item to send to the debug module -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_debug_item { - pub private_type: mbedtls_pk_debug_type, - pub private_name: *const ::core::ffi::c_char, - pub private_value: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_debug_item { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_info_t { - _unused: [u8; 0], -} -/// \brief Public key container -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_pk_context { - ///< Public key information - pub private_pk_info: *const mbedtls_pk_info_t, - ///< Underlying public key context - pub private_pk_ctx: *mut ::core::ffi::c_void, -} -impl Default for mbedtls_pk_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_rsa_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; -/// \brief Types for RSA-alt abstraction -pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - olen: *mut usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - output_max_len: usize, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< - unsafe extern "C" fn( - ctx: *mut ::core::ffi::c_void, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - md_alg: mbedtls_md_type_t, - hashlen: ::core::ffi::c_uint, - hash: *const ::core::ffi::c_uchar, - sig: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int, ->; -pub type mbedtls_pk_rsa_alt_key_len_func = - ::core::option::Option usize>; +/// \brief The ECDSA context structure. +/// +/// \warning Performing multiple operations concurrently on the same +/// ECDSA context is not supported; objects of this type +/// should not be shared between multiple threads. +/// +/// \note pk_wrap module assumes that "ecdsa_context" is identical +/// to "ecp_keypair" (see for example structure +/// "mbedtls_eckey_info" where ECDSA sign/verify functions +/// are used also for EC key) +pub type mbedtls_ecdsa_context = mbedtls_ecp_keypair; +pub type mbedtls_ecdsa_restart_ctx = ::core::ffi::c_void; unsafe extern "C" { - /// \brief Return information associated with the given PK type - /// - /// \param pk_type PK type to search for. + /// \brief This function checks whether a given group can be used + /// for ECDSA. /// - /// \return The PK info associated with the type or NULL if not found. - pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; -} -unsafe extern "C" { - /// \brief Initialize a #mbedtls_pk_context (as NONE). + /// \param gid The ECP group ID to check. /// - /// \param ctx The context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); + /// \return \c 1 if the group can be used, \c 0 otherwise + pub fn mbedtls_ecdsa_can_do(gid: mbedtls_ecp_group_id) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Free the components of a #mbedtls_pk_context. + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message. /// - /// \param ctx The context to clear. It must have been initialized. - /// If this is \c NULL, this function does nothing. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_ext() is usually preferred. /// - /// \note For contexts that have been set up with - /// mbedtls_pk_setup_opaque(), this does not free the underlying - /// PSA key and you still need to call psa_destroy_key() - /// independently if you want to destroy that key. - pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); -} -unsafe extern "C" { - /// \brief Initialize a PK context with the information given - /// and allocates the type-specific PK subcontext. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated + /// as defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param info Information to use + /// \see ecp.h /// - /// \return 0 on success, - /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, - /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized. + /// \param buf The content to be signed. This is usually the hash of + /// the original data to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function, used both to generate the ECDSA nonce + /// and for blinding. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. /// - /// \note For contexts holding an RSA-alt key, use - /// \c mbedtls_pk_setup_rsa_alt() instead. - pub fn mbedtls_pk_setup( - ctx: *mut mbedtls_pk_context, - info: *const mbedtls_pk_info_t, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX + /// or \c MBEDTLS_MPI_XXX error code on failure. + pub fn mbedtls_ecdsa_sign( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Initialize an RSA-alt context + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, deterministic version. /// - /// \param ctx Context to initialize. It must not have been set - /// up yet (type #MBEDTLS_PK_NONE). - /// \param key RSA key pointer - /// \param decrypt_func Decryption function - /// \param sign_func Signing function - /// \param key_len_func Function returning key length in bytes + /// For more information, see RFC-6979: Deterministic + /// Usage of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the - /// context wasn't already initialized as RSA_ALT. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. - pub fn mbedtls_pk_setup_rsa_alt( - ctx: *mut mbedtls_pk_context, - key: *mut ::core::ffi::c_void, - decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, - sign_func: mbedtls_pk_rsa_alt_sign_func, - key_len_func: mbedtls_pk_rsa_alt_key_len_func, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Get the size in bits of the underlying key + /// \see ecp.h /// - /// \param ctx The context to query. It must have been initialized. + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + /// may be \c NULL if \p f_rng_blind doesn't need a context + /// parameter. /// - /// \return Key size in bits, or 0 on error - pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_ext( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + md_alg: mbedtls_md_type_t, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Tell if a context can do the operation given by type + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \param ctx The context to query. It must have been initialized. - /// \param type The desired type. + /// \note The deterministic version implemented in + /// mbedtls_ecdsa_sign_det_restartable() is usually + /// preferred. /// - /// \return 1 if the context can do operations on the given type. - /// \return 0 if the context cannot do the operations on the given - /// type. This is always the case for a context that has - /// been initialized but not set up, or that has been - /// cleared with mbedtls_pk_free(). - pub fn mbedtls_pk_can_do( - ctx: *const mbedtls_pk_context, - type_: mbedtls_pk_type_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Verify signature (including padding if relevant). + /// \note This function is like \c mbedtls_ecdsa_sign() but + /// it can return early and restart according to the + /// limit set with \c mbedtls_ecp_set_max_ops() to + /// reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used. - /// This can be #MBEDTLS_MD_NONE if the signature algorithm - /// does not rely on a hash algorithm (non-deterministic - /// ECDSA, RSA PKCS#1 v1.5). - /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then - /// \p hash is the DigestInfo structure used by RFC 8017 - /// §9.2 steps 3–6. If \p md_alg is a valid hash - /// algorithm then \p hash is the digest itself, and this - /// function calculates the DigestInfo encoding internally. - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \see ecp.h /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// Use \c mbedtls_pk_verify_ext( MBEDTLS_PK_RSASSA_PSS, ... ) - /// to verify RSASSA_PSS signatures. - pub fn mbedtls_pk_verify( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param f_rng The RNG function used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_verify() + /// \brief This function computes the ECDSA signature of a + /// previously-hashed message, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_verify(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_verify(). + /// \note This function is like \c + /// mbedtls_ecdsa_sign_det_ext() but it can return + /// early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length - /// \param rs_ctx Restart context (NULL to disable restart) + /// \note If the bitlength of the message hash is larger + /// than the bitlength of the group order, then the + /// hash is truncated as defined in Standards for + /// Efficient Cryptography Group (SECG): SEC1 Elliptic + /// Curve Cryptography, section 4.1.3, step 5. /// - /// \return See \c mbedtls_pk_verify(), or - /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of - /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_verify_restartable( - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param grp The context for the elliptic curve to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param r The MPI context in which to store the first part + /// the signature. This must be initialized. + /// \param s The MPI context in which to store the second part + /// the signature. This must be initialized. + /// \param d The private signing key. This must be initialized + /// and setup, for example through + /// mbedtls_ecp_gen_privkey(). + /// \param buf The hashed content to be signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param md_alg The hash algorithm used to hash the original data. + /// \param f_rng_blind The RNG function used for blinding. This must not be + /// \c NULL. + /// \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This may be + /// \c NULL if \p f_rng_blind doesn't need a context parameter. + /// \param rs_ctx The restart context to use. This may be \c NULL + /// to disable restarting. If it is not \c NULL, it + /// must point to an initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c + /// mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c + /// MBEDTLS_ERR_MPI_XXX or \c MBEDTLS_ERR_ASN1_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_sign_det_restartable( + grp: *mut mbedtls_ecp_group, + r: *mut mbedtls_mpi, + s: *mut mbedtls_mpi, + d: *const mbedtls_mpi, + buf: *const ::core::ffi::c_uchar, + blen: usize, md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, - rs_ctx: *mut mbedtls_pk_restart_ctx, + f_rng_blind: mbedtls_f_rng_t, + p_rng_blind: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify signature, with options. - /// (Includes verification of the padding depending on type.) - /// - /// \param type Signature type (inc. possible padding type) to verify - /// \param options Pointer to type-specific options, or NULL - /// \param ctx The PK context to use. It must have been set up. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length or 0 (see notes) - /// \param sig Signature to verify - /// \param sig_len Signature length + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message. /// - /// \return 0 on success (signature is valid), - /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be - /// used for this type of signatures, - /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - /// signature in sig but its length is less than \p siglen, - /// or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note If hash_len is 0, then the length associated with md_alg - /// is used instead, or an error returned if it is invalid. + /// \see ecp.h /// - /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. /// - /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point - /// to a mbedtls_pk_rsassa_pss_options structure, - /// otherwise it must be NULL. Note that if - /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not - /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. - pub fn mbedtls_pk_verify_ext( - type_: mbedtls_pk_type_t, - options: *const ::core::ffi::c_void, - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *const ::core::ffi::c_uchar, - sig_len: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature, including padding if relevant. - /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function verifies the ECDSA signature of a + /// previously-hashed message, in a restartable manner /// - /// \return 0 on success, or a specific error code. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. - /// There is no interface in the PK module to make RSASSA-PSS - /// signatures yet. + /// \see ecp.h /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign( - ctx: *mut mbedtls_pk_context, - md_alg: mbedtls_md_type_t, - hash: *const ::core::ffi::c_uchar, - hash_len: usize, - sig: *mut ::core::ffi::c_uchar, - sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param grp The ECP group to use. + /// This must be initialized and have group parameters + /// set, for example through mbedtls_ecp_group_load(). + /// \param buf The hashed content that was signed. This must be a readable + /// buffer of length \p blen Bytes. It may be \c NULL if + /// \p blen is zero. + /// \param blen The length of \p buf in Bytes. + /// \param Q The public key to use for verification. This must be + /// initialized and setup. + /// \param r The first integer of the signature. + /// This must be initialized. + /// \param s The second integer of the signature. + /// This must be initialized. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX + /// error code on failure. + pub fn mbedtls_ecdsa_verify_restartable( + grp: *mut mbedtls_ecp_group, + buf: *const ::core::ffi::c_uchar, + blen: usize, + Q: *const mbedtls_ecp_point, + r: *const mbedtls_mpi, + s: *const mbedtls_mpi, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Make signature given a signature type. + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, serialized as defined in RFC-4492: + /// Elliptic Curve Cryptography (ECC) Cipher Suites for + /// Transport Layer Security (TLS). /// - /// \param pk_type Signature type. - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. - /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \warning It is not thread-safe to use the same context in + /// multiple threads. /// - /// \return 0 on success, or a specific error code. + /// \note The deterministic version is used if + /// #MBEDTLS_ECDSA_DETERMINISTIC is defined. For more + /// information, see RFC-6979: Deterministic Usage + /// of the Digital Signature Algorithm (DSA) and Elliptic + /// Curve Digital Signature Algorithm (ECDSA). /// - /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, - /// see #PSA_ALG_RSA_PSS for a description of PSS options used. + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.3, step 5. /// - /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. - /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. - pub fn mbedtls_pk_sign_ext( - pk_type: mbedtls_pk_type_t, - ctx: *mut mbedtls_pk_context, + /// \see ecp.h + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Restartable version of \c mbedtls_pk_sign() + /// \brief This function computes the ECDSA signature and writes it + /// to a buffer, in a restartable way. /// - /// \note Performs the same job as \c mbedtls_pk_sign(), but can - /// return early and restart according to the limit set with - /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC - /// operations. For RSA, same as \c mbedtls_pk_sign(). + /// \see \c mbedtls_ecdsa_write_signature() /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) - /// \param hash Hash of the message to sign - /// \param hash_len Hash length - /// \param sig Place to write the signature. - /// It must have enough room for the signature. - /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. - /// You may use a smaller buffer if it is large enough - /// given the key type. + /// \note This function is like \c mbedtls_ecdsa_write_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. + /// + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and private key bound to it, for example + /// via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). + /// \param md_alg The message digest that was used to hash the message. + /// \param hash The message hash to be signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The length of the hash \p hash in Bytes. + /// \param sig The buffer to which to write the signature. This must be a + /// writable buffer of length at least twice as large as the + /// size of the curve used, plus 9. For example, 73 Bytes if + /// a 256-bit curve is used. A buffer length of + /// #MBEDTLS_ECDSA_MAX_LEN is always safe. /// \param sig_size The size of the \p sig buffer in bytes. - /// \param sig_len On successful return, - /// the number of bytes written to \p sig. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// \param rs_ctx Restart context (NULL to disable restart) + /// \param slen The address at which to store the actual length of + /// the signature written. Must not be \c NULL. + /// \param f_rng The RNG function. This is used for blinding. + /// If #MBEDTLS_ECDSA_DETERMINISTIC is unset, this is also + /// used to generate the ECDSA nonce. + /// This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng is \c NULL or doesn't use a context. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return See \c mbedtls_pk_sign(). + /// \return \c 0 on success. /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of /// operations was reached: see \c mbedtls_ecp_set_max_ops(). - pub fn mbedtls_pk_sign_restartable( - ctx: *mut mbedtls_pk_context, + /// \return Another \c MBEDTLS_ERR_ECP_XXX, \c MBEDTLS_ERR_MPI_XXX or + /// \c MBEDTLS_ERR_ASN1_XXX error code on failure. + pub fn mbedtls_ecdsa_write_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, md_alg: mbedtls_md_type_t, hash: *const ::core::ffi::c_uchar, - hash_len: usize, + hlen: usize, sig: *mut ::core::ffi::c_uchar, sig_size: usize, - sig_len: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + slen: *mut usize, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, - rs_ctx: *mut mbedtls_pk_restart_ctx, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Decrypt message (including padding if relevant). + /// \brief This function reads and verifies an ECDSA signature. /// - /// \param ctx The PK context to use. It must have been set up - /// with a private key. - /// \param input Input to decrypt - /// \param ilen Input size - /// \param output Decrypted output - /// \param olen Decrypted message length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \note If the bitlength of the message hash is larger than the + /// bitlength of the group order, then the hash is truncated as + /// defined in Standards for Efficient Cryptography Group + /// (SECG): SEC1 Elliptic Curve Cryptography, section + /// 4.1.4, step 3. /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \see ecp.h /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_decrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Encrypt message (including padding if relevant). - /// - /// \param ctx The PK context to use. It must have been set up. - /// \param input Message to encrypt - /// \param ilen Message size - /// \param output Encrypted output - /// \param olen Encrypted output length - /// \param osize Size of the output buffer - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter + /// \brief This function reads and verifies an ECDSA signature, + /// in a restartable way. /// - /// \note \p f_rng is used for padding generation. + /// \see \c mbedtls_ecdsa_read_signature() /// - /// \note For RSA keys, the default padding type is PKCS#1 v1.5. + /// \note This function is like \c mbedtls_ecdsa_read_signature() + /// but it can return early and restart according to the limit + /// set with \c mbedtls_ecp_set_max_ops() to reduce blocking. /// - /// \return 0 on success, or a specific error code. - pub fn mbedtls_pk_encrypt( - ctx: *mut mbedtls_pk_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - olen: *mut usize, - osize: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if a public-private pair of keys matches. - /// - /// \param pub Context holding a public key. - /// \param prv Context holding a private (and public) key. - /// \param f_rng RNG function, must not be \c NULL. - /// \param p_rng RNG parameter - /// - /// \return \c 0 on success (keys were checked and match each other). - /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not - /// be checked - in that case they may or may not match. - /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. - /// \return Another non-zero value if the keys do not match. - pub fn mbedtls_pk_check_pair( - pub_: *const mbedtls_pk_context, - prv: *const mbedtls_pk_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Export debug information - /// - /// \param ctx The PK context to use. It must have been initialized. - /// \param items Place to write debug items + /// \param ctx The ECDSA context to use. This must be initialized + /// and have a group and public key bound to it. + /// \param hash The message hash that was signed. This must be a readable + /// buffer of length \p hlen Bytes. + /// \param hlen The size of the hash \p hash. + /// \param sig The signature to read and verify. This must be a readable + /// buffer of length \p slen Bytes. + /// \param slen The size of \p sig in Bytes. + /// \param rs_ctx The restart context to use. This may be \c NULL to disable + /// restarting. If it is not \c NULL, it must point to an + /// initialized restart context. /// - /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA - pub fn mbedtls_pk_debug( - ctx: *const mbedtls_pk_context, - items: *mut mbedtls_pk_debug_item, + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if signature is invalid. + /// \return #MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig, but its length is less than \p siglen. + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + /// \return Another \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_ERR_MPI_XXX + /// error code on failure for any other reason. + pub fn mbedtls_ecdsa_read_signature_restartable( + ctx: *mut mbedtls_ecdsa_context, + hash: *const ::core::ffi::c_uchar, + hlen: usize, + sig: *const ::core::ffi::c_uchar, + slen: usize, + rs_ctx: *mut mbedtls_ecdsa_restart_ctx, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Access the type name - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type name on success, or "invalid PK" - pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; -} -unsafe extern "C" { - /// \brief Get the key type - /// - /// \param ctx The PK context to use. It must have been initialized. - /// - /// \return Type on success. - /// \return #MBEDTLS_PK_NONE for a context that has not been set up. - pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a private key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// \param pwd Optional password for decryption. - /// Pass \c NULL if expecting a non-encrypted key. - /// Pass a string of \p pwdlen bytes if expecting an encrypted - /// key; a non-encrypted key will also be accepted. - /// The empty password is not supported. - /// \param pwdlen Size of the password in bytes. - /// Ignored if \p pwd is \c NULL. - /// \param f_rng RNG function, must not be \c NULL. Used for blinding. - /// \param p_rng RNG parameter + /// \brief This function generates an ECDSA keypair on the given curve. /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to store the keypair in. + /// This must be initialized. + /// \param gid The elliptic curve to use. One of the various + /// \c MBEDTLS_ECP_DP_XXX macros depending on configuration. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG context to be passed to \p f_rng. This may be + /// \c NULL if \p f_rng doesn't need a context argument. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, - pwd: *const ::core::ffi::c_uchar, - pwdlen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_genkey( + ctx: *mut mbedtls_ecdsa_context, + gid: mbedtls_ecp_group_id, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \ingroup pk_module */ - ////** - /// \brief Parse a public key in PEM or DER format - /// - /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto - /// subsystem must have been initialized by calling - /// psa_crypto_init() before calling this function. - /// - /// \param ctx The PK context to fill. It must have been initialized - /// but not set up. - /// \param key Input buffer to parse. - /// The buffer must contain the input exactly, with no - /// extra trailing material. For PEM, the buffer must - /// contain a null-terminated string. - /// \param keylen Size of \b key in bytes. - /// For PEM data, this includes the terminating null byte, - /// so \p keylen must be equal to `strlen(key) + 1`. - /// - /// \note On entry, ctx must be empty, either freshly initialised - /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a - /// specific key type, check the result with mbedtls_pk_can_do(). + /// \brief This function sets up an ECDSA context from an EC key pair. /// - /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for - /// limitations. + /// \see ecp.h /// - /// \note The key is also checked for correctness. + /// \param ctx The ECDSA context to setup. This must be initialized. + /// \param key The EC key to use. This must be initialized and hold + /// a private-public key pair or a public key. In the former + /// case, the ECDSA context may be used for signature creation + /// and verification after this call. In the latter case, it + /// may be used for signature verification. /// - /// \return 0 if successful, or a specific PK or PEM error code - pub fn mbedtls_pk_parse_public_key( - ctx: *mut mbedtls_pk_context, - key: *const ::core::ffi::c_uchar, - keylen: usize, + /// \return \c 0 on success. + /// \return An \c MBEDTLS_ERR_ECP_XXX code on failure. + pub fn mbedtls_ecdsa_from_keypair( + ctx: *mut mbedtls_ecdsa_context, + key: *const mbedtls_ecp_keypair, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function initializes an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_key_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecdsa_init(ctx: *mut mbedtls_ecdsa_context); } unsafe extern "C" { - /// \brief Write a public key to a SubjectPublicKeyInfo DER structure - /// Note: data is written at the end of the buffer! Use the - /// return value to determine where you should start - /// using the buffer - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf buffer to write to - /// \param size size of the buffer + /// \brief This function frees an ECDSA context. /// - /// \return length of data written if successful, or a specific - /// error code - pub fn mbedtls_pk_write_pubkey_der( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; + /// \param ctx The ECDSA context to free. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must be initialized. + pub fn mbedtls_ecdsa_free(ctx: *mut mbedtls_ecdsa_context); } -unsafe extern "C" { - /// \brief Write a public key to a PEM string - /// - /// \param ctx PK context which must contain a valid public or private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_pubkey_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a private key to a PKCS#1 or SEC1 PEM string - /// - /// \param ctx PK context which must contain a valid private key. - /// \param buf Buffer to write to. The output includes a - /// terminating null byte. - /// \param size Size of the buffer in bytes. - /// - /// \return 0 if successful, or a specific error code - pub fn mbedtls_pk_write_key_pem( - ctx: *const mbedtls_pk_context, - buf: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Parse a SubjectPublicKeyInfo DER structure - /// - /// \param p the position in the ASN.1 data - /// \param end end of the buffer - /// \param pk The PK context to fill. It must have been initialized - /// but not set up. - /// - /// \return 0 if successful, or a specific PK error code - pub fn mbedtls_pk_parse_subpubkey( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - pk: *mut mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write a subjectPublicKey to ASN.1 data - /// Note: function works backwards in data buffer - /// - /// \param p reference to current position pointer - /// \param start start of the buffer (for bounds-checking) - /// \param key PK context which must contain a valid public or private key. - /// - /// \return the length written or a negative error code - pub fn mbedtls_pk_write_pubkey( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - key: *const mbedtls_pk_context, - ) -> ::core::ffi::c_int; -} -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = - 3; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: - mbedtls_key_exchange_type_t = 4; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = - 8; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = - 9; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = - 10; -pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = - 11; -pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; -/// \brief This structure is used for storing ciphersuite information -/// -/// \note members are defined using integral types instead of enums -/// in order to pack structure and reduce memory usage by internal -/// \c ciphersuite_definitions[] -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ssl_ciphersuite_t { - pub private_id: ::core::ffi::c_int, - pub private_name: *const ::core::ffi::c_char, - pub private_cipher: u8, - pub private_mac: u8, - pub private_key_exchange: u8, - pub private_flags: u8, - pub private_min_tls_version: u16, - pub private_max_tls_version: u16, -} -impl Default for mbedtls_ssl_ciphersuite_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_string( - ciphersuite_name: *const ::core::ffi::c_char, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_from_id( - ciphersuite_id: ::core::ffi::c_int, - ) -> *const mbedtls_ssl_ciphersuite_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_pk_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_get_ciphersuite_sig_alg( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> mbedtls_pk_type_t; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_ec( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_uses_psk( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( - info: *const mbedtls_ssl_ciphersuite_t, - ) -> usize; -} -/// The type of the context passed to mbedtls_psa_external_get_random(). -/// -/// Mbed TLS initializes the context to all-bits-zero before calling -/// mbedtls_psa_external_get_random() for the first time. -/// -/// The definition of this type in the Mbed TLS source code is for -/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() -/// are expected to replace it with a custom definition. -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_external_random_context_t { - pub private_opaque: [usize; 2usize], +/// The type of the context passed to mbedtls_psa_external_get_random(). +/// +/// Mbed TLS initializes the context to all-bits-zero before calling +/// mbedtls_psa_external_get_random() for the first time. +/// +/// The definition of this type in the Mbed TLS source code is for +/// demonstration purposes. Implementers of mbedtls_psa_external_get_random() +/// are expected to replace it with a custom definition. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_external_random_context_t { + pub private_opaque: [usize; 2usize], } pub type psa_status_t = i32; /// \brief Encoding of a key type. @@ -10577,6478 +10445,7672 @@ pub type psa_key_attributes_t = psa_key_attributes_s; /// Values of this type are generally constructed by macros called /// `PSA_KEY_DERIVATION_INPUT_xxx`. pub type psa_key_derivation_step_t = u16; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following field: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// +/// Functions that take such a structure as input also take an associated +/// input buffer \c custom_data of length \c custom_data_length. +/// +/// The interpretation of this structure and the associated \c custom_data +/// parameter depend on the type of the created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c custom_data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_custom_key_parameters_t = psa_custom_key_parameters_s; +/// \brief Custom parameters for key generation or key derivation. +/// +/// This is a structure type with at least the following fields: +/// +/// - \c flags: an unsigned integer type. 0 for the default production parameters. +/// - \c data: a flexible array of bytes. +/// +/// The interpretation of this structure depend on the type of the +/// created key. +/// +/// - #PSA_KEY_TYPE_RSA_KEY_PAIR: +/// - \c flags: must be 0. +/// - \c data: the public exponent, in little-endian order. +/// This must be an odd integer and must not be 1. +/// Implementations must support 65537, should support 3 and may +/// support other values. +/// When not using a driver, Mbed TLS supports values up to \c INT_MAX. +/// If this is empty or if the custom production parameters are omitted +/// altogether, the default value 65537 is used. +/// - Other key types: reserved for future use. \c flags must be 0. +pub type psa_key_production_parameters_t = psa_key_production_parameters_s; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; +pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; +/// For encrypt-decrypt functions, whether the operation is an encryption +/// or a decryption. +pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; +/// \brief MD5 context structure +/// +/// \warning MD5 is considered a weak message digest and its use +/// constitutes a security risk. We recommend considering +/// stronger message digests instead. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_md5_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 4usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_md5_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { - /// \brief Library initialization. - /// - /// Applications must call this function before calling any other - /// function in this module. - /// - /// Applications may call this function more than once. Once a call - /// succeeds, subsequent calls are guaranteed to succeed. + /// \brief Initialize MD5 context /// - /// If the application calls other functions before calling psa_crypto_init(), - /// the behavior is undefined. Implementations are encouraged to either perform - /// the operation as if the library had been initialized or to return - /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, - /// implementations should not return a success status if the lack of - /// initialization may have security implications, for example due to improper - /// seeding of the random number generator. + /// \param ctx MD5 context to be initialized /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - pub fn psa_crypto_init() -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Retrieve the attributes of a key. - /// - /// This function first resets the attribute structure as with - /// psa_reset_key_attributes(). It then copies the attributes of - /// the given key into the given attribute structure. - /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \brief Clear MD5 context /// - /// \param[in] key Identifier of the key to query. - /// \param[in,out] attributes On success, the attributes of the key. - /// On failure, equivalent to a - /// freshly-initialized structure. + /// \param ctx MD5 context to be cleared /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_get_key_attributes( - key: mbedtls_svc_key_id_t, - attributes: *mut psa_key_attributes_t, - ) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); } unsafe extern "C" { - /// Reset a key attribute structure to a freshly initialized state. - /// - /// You must initialize the attribute structure as described in the - /// documentation of the type #psa_key_attributes_t before calling this - /// function. Once the structure has been initialized, you may call this - /// function at any time. + /// \brief Clone (the state of) an MD5 context /// - /// This function frees any auxiliary resources that the structure - /// may contain. + /// \param dst The destination context + /// \param src The context to be cloned /// - /// \param[in,out] attributes The attribute structure to reset. - pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); } unsafe extern "C" { - /// Remove non-essential copies of key material from memory. + /// \brief MD5 context setup /// - /// If the key identifier designates a volatile key, this functions does not do - /// anything and returns successfully. - /// - /// If the key identifier designates a persistent key, then this function will - /// free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and the key can still be used. + /// \param ctx context to be initialized /// - /// \param key Identifier of the key to purge. + /// \return 0 if successful /// - /// \retval #PSA_SUCCESS - /// The key material will have been removed from memory if it is not - /// currently required. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid key identifier. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Make a copy of a key. + /// \brief MD5 process buffer /// - /// Copy key material from one location to another. + /// \param ctx MD5 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// This function is primarily useful to copy a key from one location - /// to another, since it populates a key using the material from - /// another key which may have a different lifetime. + /// \return 0 if successful /// - /// This function may be used to share a key with a different party, - /// subject to implementation-defined restrictions on key sharing. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_update( + ctx: *mut mbedtls_md5_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 final digest /// - /// The policy on the source key must have the usage flag - /// #PSA_KEY_USAGE_COPY set. - /// This flag is sufficient to permit the copy if the key has the lifetime - /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. - /// Some secure elements do not provide a way to copy a key without - /// making it extractable from the secure element. If a key is located - /// in such a secure element, then the key must have both usage flags - /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make - /// a copy of the key outside the secure element. + /// \param ctx MD5 context + /// \param output MD5 checksum result /// - /// The resulting key may only be used in a way that conforms to - /// both the policy of the original key and the policy specified in - /// the \p attributes parameter: - /// - The usage flags on the resulting key are the bitwise-and of the - /// usage flags on the source policy and the usage flags in \p attributes. - /// - If both allow the same algorithm or wildcard-based - /// algorithm policy, the resulting key has the same algorithm policy. - /// - If either of the policies allows an algorithm and the other policy - /// allows a wildcard-based algorithm policy that includes this algorithm, - /// the resulting key allows the same algorithm. - /// - If the policies do not allow any algorithm in common, this function - /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// \return 0 if successful /// - /// The effect of this function on implementation-defined attributes is - /// implementation-defined. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_finish( + ctx: *mut mbedtls_md5_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief MD5 process data block (internal use only) /// - /// \param source_key The key to copy. It must allow the usage - /// #PSA_KEY_USAGE_COPY. If a private or secret key is - /// being copied outside of a secure element it must - /// also allow #PSA_KEY_USAGE_EXPORT. - /// \param[in] attributes The attributes for the new key. - /// They are used as follows: - /// - The key type and size may be 0. If either is - /// nonzero, it must match the corresponding - /// attribute of the source key. - /// - The key location (the lifetime and, for - /// persistent keys, the key identifier) is - /// used directly. - /// - The policy constraints (usage flags and - /// algorithm policy) are combined from - /// the source key and \p attributes so that - /// both sets of restrictions apply, as - /// described in the documentation of this function. - /// \param[out] target_key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param ctx MD5 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p source_key is invalid. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The lifetime or identifier in \p attributes are invalid, or - /// the policy constraints on the source and specified in - /// \p attributes are incompatible, or - /// \p attributes specifies a key type or key size - /// which does not match the attributes of the source key. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or - /// the source key is not exportable and its lifetime does not - /// allow copying it to the target's lifetime. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_copy_key( - source_key: mbedtls_svc_key_id_t, - attributes: *const psa_key_attributes_t, - target_key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + /// + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_internal_md5_process( + ctx: *mut mbedtls_md5_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Destroy a key. + /// \brief Output = MD5( input buffer ) /// - /// This function destroys a key from both volatile - /// memory and, if applicable, non-volatile storage. Implementations shall - /// make a best effort to ensure that the key material cannot be recovered. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output MD5 checksum result /// - /// This function also erases any metadata such as policies and frees - /// resources associated with the key. + /// \return 0 if successful /// - /// If a key is currently in use in a multipart operation, then destroying the - /// key will cause the multipart operation to fail. + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \param key Identifier of the key to erase. If this is \c 0, do nothing and - /// return #PSA_SUCCESS. + /// \return 0 if successful, or 1 if the test failed /// - /// \retval #PSA_SUCCESS - /// \p key was a valid identifier and the key material that it - /// referred to has been erased. Alternatively, \p key is \c 0. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key cannot be erased because it is - /// read-only, either due to a policy or due to physical restrictions. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p key is not a valid identifier nor \c 0. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE - /// There was a failure in communication with the cryptoprocessor. - /// The key material may still be present in the cryptoprocessor. - /// \retval #PSA_ERROR_DATA_INVALID - /// This error is typically a result of either storage corruption on a - /// cleartext storage backend, or an attempt to read data that was - /// written by an incompatible version of the library. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The storage is corrupted. Implementations shall make a best effort - /// to erase key material even in this stage, however applications - /// should be aware that it may be impossible to guarantee that the - /// key material is not recoverable in such cases. - /// \retval #PSA_ERROR_CORRUPTION_DETECTED - /// An unexpected condition which is not a storage corruption or - /// a communication failure occurred. The cryptoprocessor may have - /// been compromised. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; + /// \warning MD5 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. + pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +/// \brief RIPEMD-160 context structure +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ripemd160_context { + ///< number of bytes processed + pub private_total: [u32; 2usize], + ///< intermediate digest state + pub private_state: [u32; 5usize], + ///< data block being processed + pub private_buffer: [::core::ffi::c_uchar; 64usize], +} +impl Default for mbedtls_ripemd160_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// \brief Import a key in binary format. + /// \brief Initialize RIPEMD-160 context /// - /// This function supports any output from psa_export_key(). Refer to the - /// documentation of psa_export_public_key() for the format of public keys - /// and to the documentation of psa_export_key() for the format for - /// other key types. + /// \param ctx RIPEMD-160 context to be initialized + pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clear RIPEMD-160 context /// - /// The key data determines the key size. The attributes may optionally - /// specify a key size; in this case it must match the size determined - /// from the key data. A key size of 0 in \p attributes indicates that - /// the key size is solely determined by the key data. + /// \param ctx RIPEMD-160 context to be cleared + pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); +} +unsafe extern "C" { + /// \brief Clone (the state of) a RIPEMD-160 context /// - /// Implementations must reject an attempt to import a key of size 0. + /// \param dst The destination context + /// \param src The context to be cloned + pub fn mbedtls_ripemd160_clone( + dst: *mut mbedtls_ripemd160_context, + src: *const mbedtls_ripemd160_context, + ); +} +unsafe extern "C" { + /// \brief RIPEMD-160 context setup /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. - /// - /// \param[in] attributes The attributes for the new key. - /// The key size is always determined from the - /// \p data buffer. - /// If the key size in \p attributes is nonzero, - /// it must be equal to the size from \p data. - /// \param[out] key On success, an identifier to the newly created key. - /// For persistent keys, this is the key identifier - /// defined in \p attributes. - /// \c 0 on failure. - /// \param[in] data Buffer containing the key data. The content of this - /// buffer is interpreted according to the type declared - /// in \p attributes. - /// All implementations must support at least the format - /// described in the documentation - /// of psa_export_key() or psa_export_public_key() for - /// the chosen type. Implementations may allow other - /// formats, but should be conservative: implementations - /// should err on the side of rejecting content if it - /// may be erroneous (e.g. wrong type or truncated data). - /// \param data_length Size of the \p data buffer in bytes. + /// \param ctx context to be initialized /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular persistent location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key attributes, as a whole, are invalid, or - /// the key data is not correctly formatted, or - /// the size in \p attributes is nonzero and does not match the size - /// of the key data. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_import_key( - attributes: *const psa_key_attributes_t, - data: *const u8, - data_length: usize, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a key in binary format. - /// - /// The output of this function can be passed to psa_import_key() to - /// create an equivalent object. + /// \brief RIPEMD-160 process buffer /// - /// If the implementation of psa_import_key() supports other formats - /// beyond the format specified here, the output from psa_export_key() - /// must use the representation specified here, not the original - /// representation. + /// \param ctx RIPEMD-160 context + /// \param input buffer holding the data + /// \param ilen length of the input data /// - /// For standard key types, the output format is as follows: + /// \return 0 if successful + pub fn mbedtls_ripemd160_update( + ctx: *mut mbedtls_ripemd160_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 final digest /// - /// - For symmetric keys (including MAC keys), the format is the - /// raw bytes of the key. - /// - For DES, the key data consists of 8 bytes. The parity bits must be - /// correct. - /// - For Triple-DES, the format is the concatenation of the - /// two or three DES keys. - /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format - /// is the non-encrypted DER encoding of the representation defined by - /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. - /// ``` - /// RSAPrivateKey ::= SEQUENCE { - /// version INTEGER, -- must be 0 - /// modulus INTEGER, -- n - /// publicExponent INTEGER, -- e - /// privateExponent INTEGER, -- d - /// prime1 INTEGER, -- p - /// prime2 INTEGER, -- q - /// exponent1 INTEGER, -- d mod (p-1) - /// exponent2 INTEGER, -- d mod (q-1) - /// coefficient INTEGER, -- (inverse of q) mod p - /// } - /// ``` - /// - For elliptic curve key pairs (key types for which - /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is - /// a representation of the private value as a `ceiling(m/8)`-byte string - /// where `m` is the bit size associated with the curve, i.e. the bit size - /// of the order of the curve's coordinate field. This byte string is - /// in little-endian order for Montgomery curves (curve types - /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass - /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` - /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). - /// For Weierstrass curves, this is the content of the `privateKey` field of - /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, - /// the format is defined by RFC 7748, and output is masked according to §5. - /// For twisted Edwards curves, the private key is as defined by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For Diffie-Hellman key exchange key pairs (key types for which - /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the - /// format is the representation of the private key `x` as a big-endian byte - /// string. The length of the byte string is the private key size in bytes - /// (leading zeroes are not stripped). - /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is - /// true), the format is the same as for psa_export_public_key(). + /// \param ctx RIPEMD-160 context + /// \param output RIPEMD-160 checksum result /// - /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// \return 0 if successful + pub fn mbedtls_ripemd160_finish( + ctx: *mut mbedtls_ripemd160_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief RIPEMD-160 process data block (internal use only) /// - /// \param key Identifier of the key to export. It must allow the - /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public - /// key. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. + /// \param ctx RIPEMD-160 context + /// \param data buffer holding one block of data /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \return 0 if successful + pub fn mbedtls_internal_ripemd160_process( + ctx: *mut mbedtls_ripemd160_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Export a public key or the public part of a key pair in binary format. + /// \brief Output = RIPEMD-160( input buffer ) /// - /// The output of this function can be passed to psa_import_key() to - /// create an object that is equivalent to the public key. + /// \param input buffer holding the data + /// \param ilen length of the input data + /// \param output RIPEMD-160 checksum result /// - /// This specification supports a single format for each key type. - /// Implementations may support other formats as long as the standard - /// format is supported. Implementations that support other formats - /// should ensure that the formats are clearly unambiguous so as to - /// minimize the risk that an invalid input is accidentally interpreted - /// according to a different format. + /// \return 0 if successful + pub fn mbedtls_ripemd160( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// For standard key types, the output format is as follows: - /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of - /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. - /// ``` - /// RSAPublicKey ::= SEQUENCE { - /// modulus INTEGER, -- n - /// publicExponent INTEGER } -- e - /// ``` - /// - For elliptic curve keys on a twisted Edwards curve (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY - /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined - /// by RFC 8032 - /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). - /// - For other elliptic curve public keys (key types for which - /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed - /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. - /// Let `m` be the bit size associated with the curve, i.e. the bit size of - /// `q` for a curve over `F_q`. The representation consists of: - /// - The byte 0x04; - /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; - /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. - /// - For Diffie-Hellman key exchange public keys (key types for which - /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), - /// the format is the representation of the public key `y = g^x mod p` as a - /// big-endian byte string. The length of the byte string is the length of the - /// base prime `p` in bytes. + /// \return 0 if successful, or 1 if the test failed + pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha1_context { + pub work_area: [::core::ffi::c_uchar; 208usize], +} +impl Default for mbedtls_sha1_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-1 context. /// - /// Exporting a public key object or the public part of a key pair is - /// always permitted, regardless of the key's usage flags. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param key Identifier of the key to export. - /// \param[out] data Buffer where the key data is to be written. - /// \param data_size Size of the \p data buffer in bytes. - /// \param[out] data_length On success, the number of bytes - /// that make up the key data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key is neither a public key nor a key pair. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p data buffer is too small. You can determine a - /// sufficient buffer size by calling - /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) - /// where \c type is the key type - /// and \c bits is the key size in bits. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_export_public_key( - key: mbedtls_svc_key_id_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message. - /// - /// \note To verify the hash of a message against an - /// expected value, use psa_hash_compare() instead. + /// \brief This function clears a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\p alg). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p hash_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compute( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it is + /// not \c NULL, it must point to an initialized + /// SHA-1 context. + pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); } unsafe extern "C" { - /// Calculate the hash (digest) of a message and compare it with a - /// reference value. + /// \brief This function clones the state of a SHA-1 context. /// - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). - /// \param[in] input Buffer containing the message to hash. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p input_length or \p hash_length do not match the hash size for \p alg - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_compare( - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \param dst The SHA-1 context to clone to. This must be initialized. + /// \param src The SHA-1 context to clone from. This must be initialized. + pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); } -/// The type of the state data structure for multipart hash operations. -/// -/// Before calling any function on a hash operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_hash_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_hash_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, -/// for example: -/// \code -/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_hash_operation_init() -/// to the structure, for example: -/// \code -/// psa_hash_operation_t operation; -/// operation = psa_hash_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_hash_operation_t = psa_hash_operation_s; unsafe extern "C" { - /// Set up a multipart hash operation. - /// - /// The sequence of operations to calculate a hash (message digest) - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. - /// -# Call psa_hash_setup() to specify the algorithm. - /// -# Call psa_hash_update() zero, one or more times, passing a fragment - /// of the message each time. The hash that is calculated is the hash - /// of the concatenation of these messages in order. - /// -# To calculate the hash, call psa_hash_finish(). - /// To compare the hash with an expected value, call psa_hash_verify(). - /// - /// If an error occurs at any step after a call to psa_hash_setup(), the - /// operation will need to be reset by a call to psa_hash_abort(). The - /// application may call psa_hash_abort() at any time after the operation - /// has been initialized. + /// \brief This function starts a SHA-1 checksum calculation. /// - /// After a successful call to psa_hash_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_hash_finish() or psa_hash_verify(). - /// - A call to psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_hash_operation_t and not yet in use. - /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param ctx The SHA-1 context to initialize. This must be initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported hash algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a hash algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_setup( - operation: *mut psa_hash_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart hash operation. - /// - /// The application must call psa_hash_setup() before calling this function. + /// \brief This function feeds an input buffer into an ongoing SHA-1 + /// checksum calculation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] input Buffer containing the message fragment to hash. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-1 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_update( - operation: *mut psa_hash_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_update( + ctx: *mut mbedtls_sha1_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message. + /// \brief This function finishes the SHA-1 operation, and writes + /// the result to the output buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// \param ctx The SHA-1 context to use. This must be initialized and + /// have a hash operation started. + /// \param output The SHA-1 checksum result. This must be a writable + /// buffer of length \c 20 Bytes. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the hash. Call psa_hash_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// hash values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the hashed data which could allow an attacker to guess - /// a valid hash and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1_finish( + ctx: *mut mbedtls_sha1_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief SHA-1 process data block (internal use only). /// - /// \param[in,out] operation Active hash operation. - /// \param[out] hash Buffer where the hash is to be written. - /// \param hash_size Size of the \p hash buffer in bytes. - /// \param[out] hash_length On success, the number of bytes - /// that make up the hash value. This is always - /// #PSA_HASH_LENGTH(\c alg) where \c alg is the - /// hash algorithm that is calculated. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p hash buffer is too small. You can determine a - /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) - /// where \c alg is the hash algorithm that is calculated. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_finish( - operation: *mut psa_hash_operation_t, - hash: *mut u8, - hash_size: usize, - hash_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-1 context to use. This must be initialized. + /// \param data The data block being processed. This must be a + /// readable buffer of length \c 64 Bytes. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha1_process( + ctx: *mut mbedtls_sha1_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the hash of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-1 checksum of a buffer. /// - /// The application must call psa_hash_setup() before calling this function. - /// This function calculates the hash of the message formed by concatenating - /// the inputs passed to preceding calls to psa_hash_update(). It then - /// compares the calculated hash with the expected hash passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_hash_abort(). + /// The SHA-1 result is calculated as + /// output = SHA-1(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual hash and the expected hash is performed - /// in constant time. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// \param[in,out] operation Active hash operation. - /// \param[in] hash Buffer containing the expected hash value. - /// \param hash_length Size of the \p hash buffer in bytes. + /// \param input The buffer holding the input data. + /// This must be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data \p input in Bytes. + /// \param output The SHA-1 checksum result. + /// This must be a writable buffer of length \c 20 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected hash is identical to the actual hash of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The hash of the message was calculated successfully, but it - /// differs from the expected hash. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_verify( - operation: *mut psa_hash_operation_t, - hash: *const u8, - hash_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha1( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a hash operation. + /// \brief The SHA-1 checkup routine. /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_hash_setup() again. + /// \warning SHA-1 is considered a weak message digest and its use + /// constitutes a security risk. We recommend considering + /// stronger message digests instead. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_hash_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha256_context { + pub work_area: [::core::ffi::c_uchar; 208usize], + pub is224: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha256_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +unsafe extern "C" { + /// \brief This function initializes a SHA-256 context. /// - /// In particular, calling psa_hash_abort() after the operation has been - /// terminated by a call to psa_hash_abort(), psa_hash_finish() or - /// psa_hash_verify() is safe and has no effect. + /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-256 context. /// - /// \param[in,out] operation Initialized hash operation. + /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-256 context. + pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-256 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha256_clone( + dst: *mut mbedtls_sha256_context, + src: *const mbedtls_sha256_context, + ); } unsafe extern "C" { - /// Clone a hash operation. + /// \brief This function starts a SHA-224 or SHA-256 checksum + /// calculation. /// - /// This function copies the state of an ongoing hash operation to - /// a new operation object. In other words, this function is equivalent - /// to calling psa_hash_setup() on \p target_operation with the same - /// algorithm that \p source_operation was set up for, then - /// psa_hash_update() on \p target_operation with the same input that - /// that was passed to \p source_operation. After this function returns, the - /// two objects are independent, i.e. subsequent calls involving one of - /// the objects do not affect the other object. + /// \param ctx The context to use. This must be initialized. + /// \param is224 This determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// \param[in] source_operation The active hash operation to clone. - /// \param[in,out] target_operation The operation object to set up. - /// It must be initialized but not active. + /// \note is224 must be defined accordingly to the enabled + /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The \p source_operation state is not valid (it must be active), or - /// the \p target_operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_hash_clone( - source_operation: *const psa_hash_operation_t, - target_operation: *mut psa_hash_operation_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_starts( + ctx: *mut mbedtls_sha256_context, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC (message authentication code) of a message. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-256 checksum calculation. /// - /// \note To verify the MAC of a message against an - /// expected value, use psa_mac_verify() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_update( + ctx: *mut mbedtls_sha256_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function finishes the SHA-256 operation, and writes + /// the result to the output buffer. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p mac_size is too small - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_compute( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The SHA-256 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256_finish( + ctx: *mut mbedtls_sha256_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Calculate the MAC of a message and compare it with a reference value. + /// \brief This function processes a single data block within + /// the ongoing SHA-256 computation. This function is for + /// internal use only. /// - /// \param key Identifier of the key to use for the operation. It - /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). - /// \param[in] input Buffer containing the input message. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \param ctx The SHA-256 context. This must be initialized. + /// \param data The buffer holding one block of data. This must + /// be a readable buffer of length \c 64 Bytes. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the input. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected value. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha256_process( + ctx: *mut mbedtls_sha256_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart MAC operations. -/// -/// Before calling any function on a MAC operation object, the application must -/// initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_mac_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_mac_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, -/// for example: -/// \code -/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_mac_operation_init() -/// to the structure, for example: -/// \code -/// psa_mac_operation_t operation; -/// operation = psa_mac_operation_init(); -/// \endcode -/// -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Set up a multipart MAC calculation operation. + /// \brief This function calculates the SHA-224 or SHA-256 + /// checksum of a buffer. /// - /// This function sets up the calculation of the MAC - /// (message authentication code) of a byte string. - /// To verify the MAC of a message against an - /// expected value, use psa_mac_verify_setup() instead. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// The sequence of operations to calculate a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_sign_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_sign_finish() to finish - /// calculating the MAC value and retrieve it. + /// The SHA-256 result is calculated as + /// output = SHA-256(input buffer). /// - /// If an error occurs at any step after a call to psa_mac_sign_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-224 or SHA-256 checksum result. + /// This must be a writable buffer of length \c 32 bytes + /// for SHA-256, \c 28 bytes for SHA-224. + /// \param is224 Determines which function to use. This must be + /// either \c 0 for SHA-256, or \c 1 for SHA-224. /// - /// After a successful call to psa_mac_sign_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_sign_finish(). - /// - A call to psa_mac_abort(). + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha256( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is224: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-224 checkup routine. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-256 checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_sha512_context { + pub work_area: [::core::ffi::c_uchar; 304usize], + pub is384: ::core::ffi::c_uchar, +} +impl Default for mbedtls_sha512_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Set up a multipart MAC verification operation. + /// \brief This function initializes a SHA-512 context. /// - /// This function sets up the verification of the MAC - /// (message authentication code) of a byte string against an expected value. + /// \param ctx The SHA-512 context to initialize. This must + /// not be \c NULL. + pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-512 context. /// - /// The sequence of operations to verify a MAC is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. - /// -# Call psa_mac_verify_setup() to specify the algorithm and key. - /// -# Call psa_mac_update() zero, one or more times, passing a fragment - /// of the message each time. The MAC that is calculated is the MAC - /// of the concatenation of these messages in order. - /// -# At the end of the message, call psa_mac_verify_finish() to finish - /// calculating the actual MAC of the message and verify it against - /// the expected value. + /// \param ctx The SHA-512 context to clear. This may be \c NULL, + /// in which case this function does nothing. If it + /// is not \c NULL, it must point to an initialized + /// SHA-512 context. + pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); +} +unsafe extern "C" { + /// \brief This function clones the state of a SHA-512 context. /// - /// If an error occurs at any step after a call to psa_mac_verify_setup(), the - /// operation will need to be reset by a call to psa_mac_abort(). The - /// application may call psa_mac_abort() at any time after the operation - /// has been initialized. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha512_clone( + dst: *mut mbedtls_sha512_context, + src: *const mbedtls_sha512_context, + ); +} +unsafe extern "C" { + /// \brief This function starts a SHA-384 or SHA-512 checksum + /// calculation. /// - /// After a successful call to psa_mac_verify_setup(), the application must - /// eventually terminate the operation through one of the following methods: - /// - A successful call to psa_mac_verify_finish(). - /// - A call to psa_mac_abort(). + /// \param ctx The SHA-512 context to use. This must be initialized. + /// \param is384 Determines which function to use. This must be + /// either \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_mac_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. It - /// must remain valid until the operation terminates. - /// It must allow the usage - /// PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value - /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \note is384 must be defined accordingly to the enabled + /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the + /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c key is not compatible with \c alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a MAC algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The key could not be retrieved from storage. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_setup( - operation: *mut psa_mac_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_starts( + ctx: *mut mbedtls_sha512_context, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Add a message fragment to a multipart MAC operation. - /// - /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() - /// before calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \brief This function feeds an input buffer into an ongoing + /// SHA-512 checksum calculation. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] input Buffer containing the message fragment to add to - /// the MAC calculation. - /// \param input_length Size of the \p input buffer in bytes. + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the input data. This must + /// be a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_update( - operation: *mut psa_mac_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_update( + ctx: *mut mbedtls_sha512_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message. - /// - /// The application must call psa_mac_sign_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). + /// \brief This function finishes the SHA-512 operation, and writes + /// the result to the output buffer. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// \param ctx The SHA-512 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. /// - /// \warning Applications should not call this function if they expect - /// a specific value for the MAC. Call psa_mac_verify_finish() instead. - /// Beware that comparing integrity or authenticity data such as - /// MAC values with a function such as \c memcmp is risky - /// because the time taken by the comparison may leak information - /// about the MAC value which could allow an attacker to guess - /// a valid MAC and thereby bypass security controls. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512_finish( + ctx: *mut mbedtls_sha512_context, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function processes a single data block within + /// the ongoing SHA-512 computation. + /// This function is for internal use only. /// - /// \param[in,out] operation Active MAC operation. - /// \param[out] mac Buffer where the MAC value is to be written. - /// \param mac_size Size of the \p mac buffer in bytes. - /// \param[out] mac_length On success, the number of bytes - /// that make up the MAC value. This is always - /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of the key and \c alg is the - /// MAC algorithm that is calculated. + /// \param ctx The SHA-512 context. This must be initialized. + /// \param data The buffer holding one block of data. This + /// must be a readable buffer of length \c 128 Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p mac buffer is too small. You can determine a - /// sufficient buffer size by calling PSA_MAC_LENGTH(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac sign - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_sign_finish( - operation: *mut psa_mac_operation_t, - mac: *mut u8, - mac_size: usize, - mac_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_internal_sha512_process( + ctx: *mut mbedtls_sha512_context, + data: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish the calculation of the MAC of a message and compare it with - /// an expected value. + /// \brief This function calculates the SHA-512 or SHA-384 + /// checksum of a buffer. /// - /// The application must call psa_mac_verify_setup() before calling this function. - /// This function calculates the MAC of the message formed by concatenating - /// the inputs passed to preceding calls to psa_mac_update(). It then - /// compares the calculated MAC with the expected MAC passed as a - /// parameter to this function. + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_mac_abort(). + /// The SHA-512 result is calculated as + /// output = SHA-512(input buffer). /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual MAC and the expected MAC is performed - /// in constant time. + /// \param input The buffer holding the input data. This must be + /// a readable buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-384 or SHA-512 checksum result. + /// This must be a writable buffer of length \c 64 bytes + /// for SHA-512, \c 48 bytes for SHA-384. + /// \param is384 Determines which function to use. This must be either + /// \c 0 for SHA-512, or \c 1 for SHA-384. /// - /// \param[in,out] operation Active MAC operation. - /// \param[in] mac Buffer containing the expected MAC value. - /// \param mac_length Size of the \p mac buffer in bytes. + /// \note is384 must be defined accordingly with the supported + /// symbols in the config file. If: + /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or + /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined + /// then the function will return + /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. /// - /// \retval #PSA_SUCCESS - /// The expected MAC is identical to the actual MAC of the message. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The MAC of the message was calculated successfully, but it - /// differs from the expected MAC. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active mac verify - /// operation), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_verify_finish( - operation: *mut psa_mac_operation_t, - mac: *const u8, - mac_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha512( + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + is384: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a MAC operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_mac_sign_setup() or psa_mac_verify_setup() again. + /// \brief The SHA-384 checkup routine. /// - /// You may call this function any time after the operation object has - /// been initialized by one of the methods described in #psa_mac_operation_t. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief The SHA-512 checkup routine. /// - /// In particular, calling psa_mac_abort() after the operation has been - /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or - /// psa_mac_verify_finish() is safe and has no effect. + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +///< Operation not defined. +pub const mbedtls_sha3_id_MBEDTLS_SHA3_NONE: mbedtls_sha3_id = 0; +///< SHA3-224 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_224: mbedtls_sha3_id = 1; +///< SHA3-256 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_256: mbedtls_sha3_id = 2; +///< SHA3-384 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_384: mbedtls_sha3_id = 3; +///< SHA3-512 +pub const mbedtls_sha3_id_MBEDTLS_SHA3_512: mbedtls_sha3_id = 4; +/// SHA-3 family id. +/// +/// It identifies the family (SHA3-256, SHA3-512, etc.) +pub type mbedtls_sha3_id = ::core::ffi::c_uint; +/// \brief The SHA-3 context structure. +/// +/// The structure is used SHA-3 checksum calculations. +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_sha3_context { + pub private_state: [u64; 25usize], + pub private_index: u32, + pub private_olen: u16, + pub private_max_block_size: u16, +} +unsafe extern "C" { + /// \brief This function initializes a SHA-3 context. /// - /// \param[in,out] operation Initialized MAC operation. + /// \param ctx The SHA-3 context to initialize. This must not be \c NULL. + pub fn mbedtls_sha3_init(ctx: *mut mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function clears a SHA-3 context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; + /// \param ctx The SHA-3 context to clear. This may be \c NULL, in which + /// case this function returns immediately. If it is not \c NULL, + /// it must point to an initialized SHA-3 context. + pub fn mbedtls_sha3_free(ctx: *mut mbedtls_sha3_context); } unsafe extern "C" { - /// Encrypt a message using a symmetric cipher. + /// \brief This function clones the state of a SHA-3 context. /// - /// This function encrypts a message with a random IV (initialization - /// vector). Use the multipart operation interface with a - /// #psa_cipher_operation_t object to provide other forms of IV. + /// \param dst The destination context. This must be initialized. + /// \param src The context to clone. This must be initialized. + pub fn mbedtls_sha3_clone(dst: *mut mbedtls_sha3_context, src: *const mbedtls_sha3_context); +} +unsafe extern "C" { + /// \brief This function starts a SHA-3 checksum + /// calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// The output contains the IV followed by - /// the ciphertext proper. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The context to use. This must be initialized. + /// \param id The id of the SHA-3 family. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_starts( + ctx: *mut mbedtls_sha3_context, + id: mbedtls_sha3_id, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Decrypt a message using a symmetric cipher. - /// - /// This function decrypts a message encrypted with a symmetric cipher. + /// \brief This function feeds an input buffer into an ongoing + /// SHA-3 checksum calculation. /// - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// \param[in] input Buffer containing the message to decrypt. - /// This consists of the IV followed by the - /// ciphertext proper. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the plaintext is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the output. + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_update( + ctx: *mut mbedtls_sha3_context, input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + ilen: usize, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart cipher operations. -/// -/// Before calling any function on a cipher operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_cipher_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_cipher_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, -/// for example: -/// \code -/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_cipher_operation_init() -/// to the structure, for example: -/// \code -/// psa_cipher_operation_t operation; -/// operation = psa_cipher_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// Set the key for a multipart symmetric encryption operation. + /// \brief This function finishes the SHA-3 operation, and writes + /// the result to the output buffer. /// - /// The sequence of operations to encrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. - /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to - /// generate or set the IV (initialization vector). You should use - /// psa_cipher_generate_iv() unless the protocol you are implementing - /// requires a specific IV value. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). + /// \param ctx The SHA-3 context. This must be initialized + /// and have a hash operation started. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. /// - /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3_finish( + ctx: *mut mbedtls_sha3_context, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief This function calculates the SHA-3 + /// checksum of a buffer. /// - /// After a successful call to psa_cipher_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). + /// The function allocates the context, performs the + /// calculation, and frees the context. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// The SHA-3 result is calculated as + /// output = SHA-3(id, input buffer, d). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_encrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \param id The id of the SHA-3 family. + /// \param input The buffer holding the data. This must be a readable + /// buffer of length \p ilen Bytes. + /// \param ilen The length of the input data in Bytes. + /// \param output The SHA-3 checksum result. + /// This must be a writable buffer of length \c olen bytes. + /// \param olen Defines the length of output buffer (in bytes). For SHA-3 224, SHA-3 256, + /// SHA-3 384 and SHA-3 512 \c olen must equal to 28, 32, 48 and 64, + /// respectively. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. + pub fn mbedtls_sha3( + id: mbedtls_sha3_id, + input: *const u8, + ilen: usize, + output: *mut u8, + olen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart symmetric decryption operation. + /// \brief Checkup routine for the algorithms implemented + /// by this module: SHA3-224, SHA3-256, SHA3-384, SHA3-512. /// - /// The sequence of operations to decrypt a message with a symmetric cipher - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_cipher_operation_t, e.g. - /// #PSA_CIPHER_OPERATION_INIT. - /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. - /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the - /// decryption. If the IV is prepended to the ciphertext, you can call - /// psa_cipher_update() on a buffer containing the IV followed by the - /// beginning of the message. - /// -# Call psa_cipher_update() zero, one or more times, passing a fragment - /// of the message each time. - /// -# Call psa_cipher_finish(). - /// - /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), - /// the operation will need to be reset by a call to psa_cipher_abort(). The - /// application may call psa_cipher_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_cipher_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_cipher_finish(). - /// - A call to psa_cipher_abort(). - /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_cipher_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The cipher algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_CIPHER(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not a cipher algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_decrypt_setup( - operation: *mut psa_cipher_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if the test failed. + pub fn mbedtls_sha3_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// Generate an IV for a symmetric encryption operation. - /// - /// This function generates a random IV (initialization vector), nonce - /// or initial counter value for the encryption operation as appropriate - /// for the chosen algorithm, key type and key size. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] iv Buffer where the generated IV is to be written. - /// \param iv_size Size of the \p iv buffer in bytes. - /// \param[out] iv_length On success, the number of bytes of the - /// generated IV. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p iv buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no IV set), - /// or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_generate_iv( - operation: *mut psa_cipher_operation_t, - iv: *mut u8, - iv_size: usize, - iv_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hash_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// Set the IV for a symmetric encryption or decryption operation. - /// - /// This function sets the IV (initialization vector), nonce - /// or initial counter value for the encryption or decryption operation. - /// - /// The application must call psa_cipher_encrypt_setup() before - /// calling this function. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \note When encrypting, applications should use psa_cipher_generate_iv() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] iv Buffer containing the IV to use. - /// \param iv_length Size of the IV in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p iv is not acceptable for the chosen algorithm, - /// or the chosen algorithm does not use an IV. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active cipher - /// encrypt operation, with no IV set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_set_iv( - operation: *mut psa_cipher_operation_t, - iv: *const u8, - iv_length: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub md5: mbedtls_md5_context, + pub ripemd160: mbedtls_ripemd160_context, + pub sha1: mbedtls_sha1_context, + pub sha256: mbedtls_sha256_context, + pub sha512: mbedtls_sha512_context, } -unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active cipher operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() - /// (recommended when encrypting) or psa_cipher_set_iv(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_update( - operation: *mut psa_cipher_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Finish encrypting or decrypting a message in a cipher operation. - /// - /// The application must call psa_cipher_encrypt_setup() or - /// psa_cipher_decrypt_setup() before calling this function. The choice - /// of setup function determines whether this function encrypts or - /// decrypts its input. - /// - /// This function finishes the encryption or decryption of the message - /// formed by concatenating the inputs passed to preceding calls to - /// psa_cipher_update(). - /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_cipher_abort(). - /// - /// \param[in,out] operation Active cipher operation. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input size passed to this operation is not valid for - /// this particular algorithm. For example, the algorithm is a based - /// on block cipher and requires a whole number of blocks, but the - /// total input size is not a multiple of the block size. - /// \retval #PSA_ERROR_INVALID_PADDING - /// This is a decryption operation for an algorithm that includes - /// padding, and the ciphertext does not contain valid padding. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with an IV set - /// if required for the algorithm), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_finish( - operation: *mut psa_cipher_operation_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_hash_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_cipher_operation_t { + pub private_alg: psa_algorithm_t, + pub private_iv_length: u8, + pub private_block_length: u8, + pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_cipher: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_cipher_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_hash_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_hash_operation_t, +} +impl Default for psa_driver_hash_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_cipher_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, +} +impl Default for psa_driver_cipher_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hash_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h. + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. the driver context is not active, in use). + pub private_id: ::core::ffi::c_uint, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_hash_context_t, +} +impl Default for psa_hash_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_cipher_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_default_iv_length: u8, + pub private_ctx: psa_driver_cipher_context_t, +} +impl Default for psa_cipher_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_cipher_operation_s { + #[inline] + pub fn private_iv_required(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_iv_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_iv_required: ::core::ffi::c_uint, + private_iv_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; + private_iv_required as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; + private_iv_set as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The GCM context structure. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_gcm_context { + ///< The cipher context used. + pub private_cipher_ctx: mbedtls_cipher_context_t, + ///< Precalculated HTable. + pub private_H: [[u64; 2usize]; 16usize], + ///< The total length of the encrypted data. + pub private_len: u64, + ///< The total length of the additional data. + pub private_add_len: u64, + ///< The first ECTR for tag. + pub private_base_ectr: [::core::ffi::c_uchar; 16usize], + ///< The Y working value. + pub private_y: [::core::ffi::c_uchar; 16usize], + ///< The buf working value. + pub private_buf: [::core::ffi::c_uchar; 16usize], + ///< The operation to perform: + ///#MBEDTLS_GCM_ENCRYPT or + ///#MBEDTLS_GCM_DECRYPT. + pub private_mode: ::core::ffi::c_uchar, + ///< The acceleration to use. + pub private_acceleration: ::core::ffi::c_uchar, +} +impl Default for mbedtls_gcm_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Abort a cipher operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. - /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_cipher_operation_t. - /// - /// In particular, calling psa_cipher_abort() after the operation has been - /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() - /// is safe and has no effect. + /// \brief This function initializes the specified GCM context, + /// to make references valid, and prepares the context + /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). /// - /// \param[in,out] operation Initialized cipher operation. + /// The function does not bind the GCM context to a particular + /// cipher, nor set the key. For this purpose, use + /// mbedtls_gcm_setkey(). /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; + /// \param ctx The GCM context to initialize. This must not be \c NULL. + pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Process an authenticated encryption operation. + /// \brief This function associates a GCM context with a + /// cipher algorithm and a key. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that will be authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] plaintext Data that will be authenticated and - /// encrypted. - /// \param plaintext_length Size of \p plaintext in bytes. - /// \param[out] ciphertext Output buffer for the authenticated and - /// encrypted data. The additional data is not - /// part of this output. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate outputs, the - /// authentication tag is appended to the - /// encrypted data. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p plaintext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p - /// plaintext_length) evaluates to the maximum - /// ciphertext size of any supported AEAD - /// encryption. - /// \param[out] ciphertext_length On success, the size of the output - /// in the \p ciphertext buffer. + /// \param ctx The GCM context. This must be initialized. + /// \param cipher The 128-bit block cipher to use. + /// \param key The encryption key. This must be a readable buffer of at + /// least \p keybits bits. + /// \param keybits The key size in bits. Valid options are: + ///
          • 128 bits
            • + ///
          • 192 bits
            • + ///
          • 256 bits
          /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p ciphertext_size is too small. - /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p plaintext_length) or - /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - plaintext: *const u8, - plaintext_length: usize, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return A cipher-specific error code on failure. + pub fn mbedtls_gcm_setkey( + ctx: *mut mbedtls_gcm_context, + cipher: mbedtls_cipher_id_t, + key: *const ::core::ffi::c_uchar, + keybits: ::core::ffi::c_uint, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Process an authenticated decryption operation. + /// \brief This function performs GCM encryption or decryption of a buffer. /// - /// \param key Identifier of the key to use for the - /// operation. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). - /// \param[in] nonce Nonce or IV to use. - /// \param nonce_length Size of the \p nonce buffer in bytes. - /// \param[in] additional_data Additional data that has been authenticated - /// but not encrypted. - /// \param additional_data_length Size of \p additional_data in bytes. - /// \param[in] ciphertext Data that has been authenticated and - /// encrypted. For algorithms where the - /// encrypted data and the authentication tag - /// are defined as separate inputs, the buffer - /// must contain the encrypted data followed - /// by the authentication tag. - /// \param ciphertext_length Size of \p ciphertext in bytes. - /// \param[out] plaintext Output buffer for the decrypted data. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, - /// \p alg, \p ciphertext_length) where - /// \c key_type is the type of \p key. - /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p - /// ciphertext_length) evaluates to the maximum - /// plaintext size of any supported AEAD - /// decryption. - /// \param[out] plaintext_length On success, the size of the output - /// in the \p plaintext buffer. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The ciphertext is not authentic. - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p plaintext_size is too small. - /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, - /// \p ciphertext_length) or - /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used - /// to determine the required buffer size. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - nonce: *const u8, - nonce_length: usize, - additional_data: *const u8, - additional_data_length: usize, - ciphertext: *const u8, - ciphertext_length: usize, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - ) -> psa_status_t; + /// \warning When this function performs a decryption, it outputs the + /// authentication tag and does not verify that the data is + /// authentic. You should use this function to perform encryption + /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// + /// \param ctx The GCM context to use for encryption or decryption. This + /// must be initialized. + /// \param mode The operation to perform: + /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. + /// The ciphertext is written to \p output and the + /// authentication tag is written to \p tag. + /// - #MBEDTLS_GCM_DECRYPT to perform decryption. + /// The plaintext is written to \p output and the + /// authentication tag is written to \p tag. + /// Note that this mode is not recommended, because it does + /// not verify the authenticity of the data. For this reason, + /// you should use mbedtls_gcm_auth_decrypt() instead of + /// calling this function in decryption mode. + /// \param length The length of the input data, which is equal to the length + /// of the output data. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param input The buffer holding the input data. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size in Bytes. + /// \param output The buffer for holding the output data. If \p length is greater + /// than zero, this must be a writable buffer of at least that + /// size in Bytes. + /// \param tag_len The length of the tag to generate. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// + /// \return \c 0 if the encryption or decryption was performed + /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, + /// this does not indicate that the data is authentic. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the encryption + /// or decryption failed. + pub fn mbedtls_gcm_crypt_and_tag( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + tag_len: usize, + tag: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } -/// The type of the state data structure for multipart AEAD operations. -/// -/// Before calling any function on an AEAD operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_aead_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_aead_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, -/// for example: -/// \code -/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_aead_operation_init() -/// to the structure, for example: -/// \code -/// psa_aead_operation_t operation; -/// operation = psa_aead_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// Set the key for a multipart authenticated encryption operation. + /// \brief This function performs a GCM authenticated decryption of a + /// buffer. /// - /// The sequence of operations to encrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to - /// generate or set the nonce. You should use - /// psa_aead_generate_nonce() unless the protocol you are implementing - /// requires a specific nonce value. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the message to encrypt each time. - /// -# Call psa_aead_finish(). - /// - /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_encrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_finish(). - /// - A call to psa_aead_abort(). + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param length The length of the ciphertext to decrypt, which is also + /// the length of the decrypted plaintext. + /// \param iv The initialization vector. This must be a readable buffer + /// of at least \p iv_len Bytes. + /// \param iv_len The length of the IV. + /// \param add The buffer holding the additional data. This must be of at + /// least that size in Bytes. + /// \param add_len The length of the additional data. + /// \param tag The buffer holding the tag to verify. This must be a + /// readable buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to verify. + /// \param input The buffer holding the ciphertext. If \p length is greater + /// than zero, this must be a readable buffer of at least that + /// size. + /// \param output The buffer for holding the decrypted plaintext. If \p length + /// is greater than zero, this must be a writable buffer of at + /// least that size. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_encrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 if successful and authenticated. + /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are + /// not valid or a cipher-specific error code if the decryption + /// failed. + pub fn mbedtls_gcm_auth_decrypt( + ctx: *mut mbedtls_gcm_context, + length: usize, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + add: *const ::core::ffi::c_uchar, + add_len: usize, + tag: *const ::core::ffi::c_uchar, + tag_len: usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the key for a multipart authenticated decryption operation. - /// - /// The sequence of operations to decrypt a message with authentication - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_aead_operation_t, e.g. - /// #PSA_AEAD_OPERATION_INIT. - /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. - /// -# If needed, call psa_aead_set_lengths() to specify the length of the - /// inputs to the subsequent calls to psa_aead_update_ad() and - /// psa_aead_update(). See the documentation of psa_aead_set_lengths() - /// for details. - /// -# Call psa_aead_set_nonce() with the nonce for the decryption. - /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment - /// of the non-encrypted additional authenticated data each time. - /// -# Call psa_aead_update() zero, one or more times, passing a fragment - /// of the ciphertext to decrypt each time. - /// -# Call psa_aead_verify(). - /// - /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), - /// the operation will need to be reset by a call to psa_aead_abort(). The - /// application may call psa_aead_abort() at any time after the operation - /// has been initialized. - /// - /// After a successful call to psa_aead_decrypt_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A successful call to psa_aead_verify(). - /// - A call to psa_aead_abort(). + /// \brief This function starts a GCM encryption or decryption + /// operation. /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized as per the documentation for - /// #psa_aead_operation_t and not yet in use. - /// \param key Identifier of the key to use for the operation. - /// It must remain valid until the operation - /// terminates. It must allow the usage - /// #PSA_KEY_USAGE_DECRYPT. - /// \param alg The AEAD algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param ctx The GCM context. This must be initialized. + /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or + /// #MBEDTLS_GCM_DECRYPT. + /// \param iv The initialization vector. This must be a readable buffer of + /// at least \p iv_len Bytes. + /// \param iv_len The length of the IV. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not compatible with \p alg. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not supported or is not an AEAD algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_decrypt_setup( - operation: *mut psa_aead_operation_t, - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_starts( + ctx: *mut mbedtls_gcm_context, + mode: ::core::ffi::c_int, + iv: *const ::core::ffi::c_uchar, + iv_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Generate a random nonce for an authenticated encryption operation. - /// - /// This function generates a random nonce for the authenticated encryption - /// operation with an appropriate size for the chosen algorithm, key type - /// and key size. - /// - /// The application must call psa_aead_encrypt_setup() before - /// calling this function. + /// \brief This function feeds an input buffer as associated data + /// (authenticated but not encrypted data) in a GCM + /// encryption or decryption operation. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// Call this function after mbedtls_gcm_starts() to pass + /// the associated data. If the associated data is empty, + /// you do not need to call this function. You may not + /// call this function after calling mbedtls_cipher_update(). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] nonce Buffer where the generated nonce is to be - /// written. - /// \param nonce_size Size of the \p nonce buffer in bytes. - /// \param[out] nonce_length On success, the number of bytes of the - /// generated nonce. + /// \param ctx The GCM context. This must have been started with + /// mbedtls_gcm_starts() and must not have yet received + /// any input with mbedtls_gcm_update(). + /// \param add The buffer holding the additional data, or \c NULL + /// if \p add_len is \c 0. + /// \param add_len The length of the additional data. If \c 0, + /// \p add may be \c NULL. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p nonce buffer is too small. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active aead encrypt - /// operation, with no nonce set), or the library has not been - /// previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_generate_nonce( - operation: *mut psa_aead_operation_t, - nonce: *mut u8, - nonce_size: usize, - nonce_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + pub fn mbedtls_gcm_update_ad( + ctx: *mut mbedtls_gcm_context, + add: *const ::core::ffi::c_uchar, + add_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the nonce for an authenticated encryption or decryption operation. + /// \brief This function feeds an input buffer into an ongoing GCM + /// encryption or decryption operation. /// - /// This function sets the nonce for the authenticated - /// encryption or decryption operation. + /// You may call this function zero, one or more times + /// to pass successive parts of the input: the plaintext to + /// encrypt, or the ciphertext (not including the tag) to + /// decrypt. After the last part of the input, call + /// mbedtls_gcm_finish(). /// - /// The application must call psa_aead_encrypt_setup() or - /// psa_aead_decrypt_setup() before calling this function. + /// This function may produce output in one of the following + /// ways: + /// - Immediate output: the output length is always equal + /// to the input length. + /// - Buffered output: the output consists of a whole number + /// of 16-byte blocks. If the total input length so far + /// (not including associated data) is 16 \* *B* + *A* + /// with *A* < 16 then the total output length is 16 \* *B*. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// In particular: + /// - It is always correct to call this function with + /// \p output_size >= \p input_length + 15. + /// - If \p input_length is a multiple of 16 for all the calls + /// to this function during an operation, then it is + /// correct to use \p output_size = \p input_length. /// - /// \note When encrypting, applications should use psa_aead_generate_nonce() - /// instead of this function, unless implementing a protocol that requires - /// a non-random IV. + /// \note The output buffer \p output can be the same as the input + /// buffer \p input. If \p output is greater than \p input, they + /// cannot overlap. Implementations which require + /// MBEDTLS_GCM_ALT to be enabled may not provide support for + /// overlapping buffers. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] nonce Buffer containing the nonce to use. - /// \param nonce_length Size of the nonce in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param input The buffer holding the input data. If \p input_length + /// is greater than zero, this must be a readable buffer + /// of at least \p input_length bytes. + /// \param input_length The length of the input data in bytes. + /// \param output The buffer for the output data. If \p output_size + /// is greater than zero, this must be a writable buffer of + /// of at least \p output_size bytes. + /// \param output_size The size of the output buffer in bytes. + /// See the function description regarding the output size. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The size of \p nonce is not acceptable for the chosen algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, with no nonce - /// set), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_nonce( - operation: *mut psa_aead_operation_t, - nonce: *const u8, - nonce_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// total input length too long, + /// unsupported input/output buffer overlap detected, + /// or \p output_size too small. + pub fn mbedtls_gcm_update( + ctx: *mut mbedtls_gcm_context, + input: *const ::core::ffi::c_uchar, + input_length: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Declare the lengths of the message and additional data for AEAD. - /// - /// The application must call this function before calling - /// psa_aead_update_ad() or psa_aead_update() if the algorithm for - /// the operation requires it. If the algorithm does not require it, - /// calling this function is optional, but if this function is called - /// then the implementation must enforce the lengths. - /// - /// You may call this function before or after setting the nonce with - /// psa_aead_set_nonce() or psa_aead_generate_nonce(). - /// - /// - For #PSA_ALG_CCM, calling this function is required. - /// - For the other AEAD algorithms defined in this specification, calling - /// this function is not required. - /// - For vendor-defined algorithm, refer to the vendor documentation. + /// \brief This function finishes the GCM operation and generates + /// the authentication tag. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// It wraps up the GCM stream, and generates the + /// tag. The tag can have a maximum length of 16 Bytes. /// - /// \param[in,out] operation Active AEAD operation. - /// \param ad_length Size of the non-encrypted additional - /// authenticated data in bytes. - /// \param plaintext_length Size of the plaintext to encrypt in bytes. + /// \param ctx The GCM context. This must be initialized. + /// \param tag The buffer for holding the tag. This must be a writable + /// buffer of at least \p tag_len Bytes. + /// \param tag_len The length of the tag to generate. This must be at least + /// four. + /// \param output The buffer for the final output. + /// If \p output_size is nonzero, this must be a writable + /// buffer of at least \p output_size bytes. + /// \param output_size The size of the \p output buffer in bytes. + /// This must be large enough for the output that + /// mbedtls_gcm_update() has not produced. In particular: + /// - If mbedtls_gcm_update() produces immediate output, + /// or if the total input size is a multiple of \c 16, + /// then mbedtls_gcm_finish() never produces any output, + /// so \p output_size can be \c 0. + /// - \p output_size never needs to be more than \c 15. + /// \param output_length On success, \p *output_length contains the actual + /// length of the output written in \p output. + /// On failure, the content of \p *output_length is + /// unspecified. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// At least one of the lengths is not acceptable for the chosen - /// algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and - /// psa_aead_update_ad() and psa_aead_update() must not have been - /// called yet), or the library has not been previously initialized - /// by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_set_lengths( - operation: *mut psa_aead_operation_t, - ad_length: usize, - plaintext_length: usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: + /// invalid value of \p tag_len, + /// or \p output_size too small. + pub fn mbedtls_gcm_finish( + ctx: *mut mbedtls_gcm_context, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_length: *mut usize, + tag: *mut ::core::ffi::c_uchar, + tag_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Pass additional data to an active AEAD operation. - /// - /// Additional data is authenticated, but not encrypted. - /// - /// You may call this function multiple times to pass successive fragments - /// of the additional data. You may not call this function after passing - /// data to encrypt or decrypt with psa_aead_update(). - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, - /// treat the input as untrusted and prepare to undo any action that - /// depends on the input if psa_aead_verify() returns an error status. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the fragment of - /// additional data. - /// \param input_length Size of the \p input buffer in bytes. + /// \brief This function clears a GCM context and the underlying + /// cipher sub-context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total input length overflows the additional data length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, have lengths set if required by the algorithm, and - /// psa_aead_update() must not have been called yet), or the library - /// has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update_ad( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The GCM context to clear. If this is \c NULL, the call has + /// no effect. Otherwise, this must be initialized. + pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); } unsafe extern "C" { - /// Encrypt or decrypt a message fragment in an active AEAD operation. - /// - /// Before calling this function, you must: - /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). - /// The choice of setup function determines whether this function - /// encrypts or decrypts its input. - /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). - /// 3. Call psa_aead_update_ad() to pass all the additional data. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). - /// - /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, - /// there is no guarantee that the input is valid. Therefore, until - /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: - /// - Do not use the output in any way other than storing it in a - /// confidential location. If you take any action that depends - /// on the tentative decrypted data, this action will need to be - /// undone if the input turns out not to be valid. Furthermore, - /// if an adversary can observe that this action took place - /// (for example through timing), they may be able to use this - /// fact as an oracle to decrypt any message encrypted with the - /// same key. - /// - In particular, do not copy the output anywhere but to a - /// memory or storage space that you have exclusive access to. - /// - /// This function does not require the input to be aligned to any - /// particular block boundary. If the implementation can only process - /// a whole block at a time, it must consume all the input provided, but - /// it may delay the end of the corresponding output until a subsequent - /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() - /// provides sufficient input. The amount of data that can be delayed - /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. - /// - /// \param[in,out] operation Active AEAD operation. - /// \param[in] input Buffer containing the message fragment to - /// encrypt or decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[out] output Buffer where the output is to be written. - /// \param output_size Size of the \p output buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, - /// \c alg, \p input_length) where - /// \c key_type is the type of key and \c alg is - /// the algorithm that were used to set up the - /// operation. - /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p - /// input_length) evaluates to the maximum - /// output size of any supported AEAD - /// algorithm. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// \brief The GCM checkup routine. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or - /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to - /// determine the required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total input length overflows the plaintext length that - /// was previously specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, have a nonce - /// set, and have lengths set if required by the algorithm), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_update( - operation: *mut psa_aead_operation_t, - input: *const u8, - input_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success. + /// \return \c 1 on failure. + pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_hmac_operation_t { + /// The HMAC algorithm in use + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + /// The hash context. + pub hash_ctx: psa_hash_operation_s, + /// The HMAC part of the context. + pub private_opad: [u8; 128usize], +} +impl Default for mbedtls_psa_hmac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_mac_operation_t { + pub private_alg: psa_algorithm_t, + pub __bindgen_padding_0: u64, + pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_hmac: mbedtls_psa_hmac_operation_t, + pub private_cmac: mbedtls_cipher_context_t, +} +impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_mac_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_aead_operation_t { + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_tag_length: u8, + pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { + pub dummy: ::core::ffi::c_uint, + pub private_ccm: mbedtls_ccm_context, + pub private_gcm: mbedtls_gcm_context, + pub private_chachapoly: mbedtls_chachapoly_context, +} +impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for mbedtls_psa_aead_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl mbedtls_psa_aead_operation_t { + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_sign_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_verify_hash_interruptible_operation_t { + pub private_dummy: ::core::ffi::c_uint, +} +///< Client +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; +///< Server +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; +///< Undefined +pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_NONE: mbedtls_ecjpake_role = 2; +/// Roles in the EC J-PAKE exchange +pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; +/// EC J-PAKE context structure. +/// +/// J-PAKE is a symmetric protocol, except for the identifiers used in +/// Zero-Knowledge Proofs, and the serialization of the second message +/// (KeyExchange) as defined by the Thread spec. +/// +/// In order to benefit from this symmetry, we choose a different naming +/// convention from the Thread v1.0 spec. Correspondence is indicated in the +/// description as a pair C: client name, S: server name +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_ecjpake_context { + ///< Hash to use + pub private_md_type: mbedtls_md_type_t, + ///< Elliptic curve + pub private_grp: mbedtls_ecp_group, + ///< Are we client or server? + pub private_role: mbedtls_ecjpake_role, + ///< Format for point export + pub private_point_format: ::core::ffi::c_int, + ///< My public key 1 C: X1, S: X3 + pub private_Xm1: mbedtls_ecp_point, + ///< My public key 2 C: X2, S: X4 + pub private_Xm2: mbedtls_ecp_point, + ///< Peer public key 1 C: X3, S: X1 + pub private_Xp1: mbedtls_ecp_point, + ///< Peer public key 2 C: X4, S: X2 + pub private_Xp2: mbedtls_ecp_point, + ///< Peer public key C: Xs, S: Xc + pub private_Xp: mbedtls_ecp_point, + ///< My private key 1 C: x1, S: x3 + pub private_xm1: mbedtls_mpi, + ///< My private key 2 C: x2, S: x4 + pub private_xm2: mbedtls_mpi, + ///< Pre-shared secret (passphrase) + pub private_s: mbedtls_mpi, +} +impl Default for mbedtls_ecjpake_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } unsafe extern "C" { - /// Finish encrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_encrypt_setup(). + /// \brief Initialize an ECJPAKE context. /// - /// This function finishes the authentication of the additional data - /// formed by concatenating the inputs passed to preceding calls to - /// psa_aead_update_ad() with the plaintext formed by concatenating the - /// inputs passed to preceding calls to psa_aead_update(). + /// \param ctx The ECJPAKE context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Set up an ECJPAKE context for use. /// - /// This function has two output buffers: - /// - \p ciphertext contains trailing ciphertext that was buffered from - /// preceding calls to psa_aead_update(). - /// - \p tag contains the authentication tag. + /// \note Currently the only values for hash/curve allowed by the + /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to set up. This must be initialized. + /// \param role The role of the caller. This must be either + /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. + /// \param hash The identifier of the hash function to use, + /// for example #MBEDTLS_MD_SHA256. + /// \param curve The identifier of the elliptic curve to use, + /// for example #MBEDTLS_ECP_DP_SECP256R1. + /// \param secret The pre-shared secret (passphrase). This must be + /// a readable not empty buffer of length \p len Bytes. It need + /// only be valid for the duration of this call. + /// \param len The length of the pre-shared secret \p secret. /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] ciphertext Buffer where the last part of the ciphertext - /// is to be written. - /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] ciphertext_length On success, the number of bytes of - /// returned ciphertext. - /// \param[out] tag Buffer where the authentication tag is - /// to be written. - /// \param tag_size Size of the \p tag buffer in bytes. - /// This must be appropriate for the selected - /// algorithm and key: - /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c - /// key_type, \c key_bits, \c alg) where - /// \c key_type and \c key_bits are the type and - /// bit-size of the key, and \c alg is the - /// algorithm that were used in the call to - /// psa_aead_encrypt_setup(). - /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the - /// maximum tag size of any supported AEAD - /// algorithm. - /// \param[out] tag_length On success, the number of bytes - /// that make up the returned tag. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p ciphertext or \p tag buffer is too small. - /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the - /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, - /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to - /// determine the required \p tag buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active encryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_finish( - operation: *mut psa_aead_operation_t, - ciphertext: *mut u8, - ciphertext_size: usize, - ciphertext_length: *mut usize, - tag: *mut u8, - tag_size: usize, - tag_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_setup( + ctx: *mut mbedtls_ecjpake_context, + role: mbedtls_ecjpake_role, + hash: mbedtls_md_type_t, + curve: mbedtls_ecp_group_id, + secret: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Finish authenticating and decrypting a message in an AEAD operation. - /// - /// The operation must have been set up with psa_aead_decrypt_setup(). - /// - /// This function finishes the authenticated decryption of the message - /// components: + /// \brief Set the point format for future reads and writes. /// - /// - The additional data consisting of the concatenation of the inputs - /// passed to preceding calls to psa_aead_update_ad(). - /// - The ciphertext consisting of the concatenation of the inputs passed to - /// preceding calls to psa_aead_update(). - /// - The tag passed to this function call. + /// \param ctx The ECJPAKE context to configure. + /// \param point_format The point format to use: + /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) + /// or #MBEDTLS_ECP_PF_COMPRESSED. /// - /// If the authentication tag is correct, this function outputs any remaining - /// plaintext and reports success. If the authentication tag is not correct, - /// this function returns #PSA_ERROR_INVALID_SIGNATURE. + /// \return \c 0 if successful. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format + /// is invalid. + pub fn mbedtls_ecjpake_set_point_format( + ctx: *mut mbedtls_ecjpake_context, + point_format: ::core::ffi::c_int, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if an ECJPAKE context is ready for use. /// - /// When this function returns successfully, the operation becomes inactive. - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_aead_abort(). + /// \param ctx The ECJPAKE context to check. This must be + /// initialized. /// - /// \note Implementations shall make the best effort to ensure that the - /// comparison between the actual tag and the expected tag is performed - /// in constant time. + /// \return \c 0 if the context is ready for use. + /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. + pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// \param[in,out] operation Active AEAD operation. - /// \param[out] plaintext Buffer where the last part of the plaintext - /// is to be written. This is the remaining data - /// from previous calls to psa_aead_update() - /// that could not be processed until the end - /// of the input. - /// \param plaintext_size Size of the \p plaintext buffer in bytes. - /// This must be appropriate for the selected algorithm and key: - /// - A sufficient output size is - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, - /// \c alg) where \c key_type is the type of key - /// and \c alg is the algorithm that were used to - /// set up the operation. - /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to - /// the maximum output size of any supported AEAD - /// algorithm. - /// \param[out] plaintext_length On success, the number of bytes of - /// returned plaintext. - /// \param[in] tag Buffer containing the authentication tag. - /// \param tag_length Size of the \p tag buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be + /// initialized and set up. + /// \param buf The buffer to write the contents to. This must be a + /// writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number + /// of Bytes written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculations were successful, but the authentication tag is - /// not correct. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p plaintext buffer is too small. - /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or - /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the - /// required buffer size. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The total length of input to psa_aead_update_ad() so far is - /// less than the additional data length that was previously - /// specified with psa_aead_set_lengths(), or - /// the total length of input to psa_aead_update() so far is - /// less than the plaintext length that was previously - /// specified with psa_aead_set_lengths(). - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be an active decryption - /// operation with a nonce set), or the library has not been previously - /// initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_verify( - operation: *mut psa_aead_operation_t, - plaintext: *mut u8, - plaintext_size: usize, - plaintext_length: *mut usize, - tag: *const u8, - tag_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort an AEAD operation. - /// - /// Aborting an operation frees all associated resources except for the - /// \p operation structure itself. Once aborted, the operation object - /// can be reused for another operation by calling - /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// \brief Read and process the first round message + /// (TLS: contents of the Client/ServerHello extension, + /// excluding extension type and length bytes). /// - /// You may call this function any time after the operation object has - /// been initialized as described in #psa_aead_operation_t. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up. + /// \param buf The buffer holding the first round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// In particular, calling psa_aead_abort() after the operation has been - /// terminated by a call to psa_aead_abort(), psa_aead_finish() or - /// psa_aead_verify() is safe and has no effect. + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_one( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Generate and write the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \param[in,out] operation Initialized AEAD operation. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up, and already have performed round one. + /// \param buf The buffer to write the round two contents to. + /// This must be a writable buffer of length \p len Bytes. + /// \param len The size of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a message with a private key. For hash-and-sign algorithms, - /// this includes the hashing step. + /// \brief Read and process the second round message + /// (TLS: contents of the Client/ServerKeyExchange). /// - /// \note To perform a multi-part hash-and-sign signature algorithm, first use - /// a multi-part hash operation and then pass the resulting hash to - /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the - /// hash algorithm to use. - /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The input message to sign. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param[in] signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and - /// bit-size respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized + /// and set up and already have performed round one. + /// \param buf The buffer holding the second round message. This must + /// be a readable buffer of length \p len Bytes. + /// \param len The length in Bytes of \p buf. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_read_round_two( + ctx: *mut mbedtls_ecjpake_context, + buf: *const ::core::ffi::c_uchar, + len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a message with a public key, using - /// a hash-and-sign verification algorithm. - /// - /// \note To perform a multi-part hash-and-sign signature verification - /// algorithm, first use a multi-part hash operation to hash the message - /// and then pass the resulting hash to psa_verify_hash(). - /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm - /// to use. + /// \brief Derive the shared secret + /// (TLS: Pre-Master Secret). /// - /// \param[in] key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_MESSAGE. - /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) - /// is true), that is compatible with the type of - /// \p key. - /// \param[in] input The message whose signature is to be verified. - /// \param[in] input_length Size of the \p input buffer in bytes. - /// \param[out] signature Buffer containing the signature to verify. - /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of Bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, - /// or it does not permit the requested algorithm. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed signature - /// is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_message( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_derive_secret( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Sign a hash or short message with a private key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief Write the shared key material to be passed to a Key + /// Derivation Function as described in RFC8236. /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. - /// \param[out] signature_length On success, the number of bytes - /// that make up the returned signature value. + /// \param ctx The ECJPAKE context to use. This must be initialized, + /// set up and have performed both round one and two. + /// \param buf The buffer to write the derived secret to. This must + /// be a writable buffer of length \p len Bytes. + /// \param len The length of \p buf in Bytes. + /// \param olen The address at which to store the total number of bytes + /// written to \p buf. This must not be \c NULL. + /// \param f_rng The RNG function to use. This must not be \c NULL. + /// \param p_rng The RNG parameter to be passed to \p f_rng. This + /// may be \c NULL if \p f_rng doesn't use a context. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_sign_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 if successful. + /// \return A negative error code on failure. + pub fn mbedtls_ecjpake_write_shared_key( + ctx: *mut mbedtls_ecjpake_context, + buf: *mut ::core::ffi::c_uchar, + len: usize, + olen: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Verify the signature of a hash or short message using a public key. - /// - /// Note that to perform a hash-and-sign signature algorithm, you must - /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() - /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). - /// Then pass the resulting hash as the \p hash - /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) - /// to determine the hash algorithm to use. + /// \brief This clears an ECJPAKE context and frees any + /// embedded data structure. /// - /// \param key Identifier of the key to use for the operation. It - /// must be a public key or an asymmetric key pair. The - /// key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message whose signature is to be - /// verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// \param ctx The ECJPAKE context to free. This may be \c NULL, + /// in which case this function does nothing. If it is not + /// \c NULL, it must point to an initialized ECJPAKE context. + pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); +} +unsafe extern "C" { + /// \brief Checkup routine /// - /// \retval #PSA_SUCCESS - /// The signature is valid. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_verify_hash( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, - ) -> psa_status_t; + /// \return 0 if successful, or 1 if a test failed + pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; } -unsafe extern "C" { - /// \brief Encrypt a short message with a public key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be a public key or an asymmetric key - /// pair. It must allow the usage - /// #PSA_KEY_USAGE_ENCRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to encrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the encrypted message is to - /// be written. - /// \param output_size Size of the \p output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_encrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_psa_pake_operation_t { + pub private_alg: psa_algorithm_t, + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_role: mbedtls_ecjpake_role, + pub private_buffer: [u8; 336usize], + pub private_buffer_length: usize, + pub private_buffer_offset: usize, + pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, } -unsafe extern "C" { - /// \brief Decrypt a short message with a private key. - /// - /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. It must - /// allow the usage #PSA_KEY_USAGE_DECRYPT. - /// \param alg An asymmetric encryption algorithm that is - /// compatible with the type of \p key. - /// \param[in] input The message to decrypt. - /// \param input_length Size of the \p input buffer in bytes. - /// \param[in] salt A salt or label, if supported by the - /// encryption algorithm. - /// If the algorithm does not support a - /// salt, pass \c NULL. - /// If the algorithm supports an optional - /// salt and you do not want to pass a salt, - /// pass \c NULL. - /// - /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is - /// supported. - /// \param salt_length Size of the \p salt buffer in bytes. - /// If \p salt is \c NULL, pass 0. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_asymmetric_decrypt( - key: mbedtls_svc_key_id_t, - alg: psa_algorithm_t, - input: *const u8, - input_length: usize, - salt: *const u8, - salt_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { + pub private_dummy: ::core::ffi::c_uint, + pub private_jpake: mbedtls_ecjpake_context, } -/// The type of the state data structure for key derivation operations. -/// -/// Before calling any function on a key derivation operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_key_derivation_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, -/// for example: -/// \code -/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_key_derivation_operation_init() -/// to the structure, for example: -/// \code -/// psa_key_derivation_operation_t operation; -/// operation = psa_key_derivation_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_key_derivation_operation_t = psa_key_derivation_s; -unsafe extern "C" { - /// Set up a key derivation operation. - /// - /// A key derivation algorithm takes some inputs and uses them to generate - /// a byte stream in a deterministic way. - /// This byte stream can be used to produce keys and other - /// cryptographic material. - /// - /// To derive a key: - /// -# Start with an initialized object of type #psa_key_derivation_operation_t. - /// -# Call psa_key_derivation_setup() to select the algorithm. - /// -# Provide the inputs for the key derivation by calling - /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() - /// as appropriate. Which inputs are needed, in what order, and whether - /// they may be keys and if so of what type depends on the algorithm. - /// -# Optionally set the operation's maximum capacity with - /// psa_key_derivation_set_capacity(). You may do this before, in the middle - /// of or after providing inputs. For some algorithms, this step is mandatory - /// because the output depends on the maximum capacity. - /// -# To derive a key, call psa_key_derivation_output_key(). - /// To derive a byte string for a different purpose, call - /// psa_key_derivation_output_bytes(). - /// Successive calls to these functions use successive output bytes - /// calculated by the key derivation algorithm. - /// -# Clean up the key derivation operation object with - /// psa_key_derivation_abort(). - /// - /// If this function returns an error, the key derivation operation object is - /// not changed. - /// - /// If an error occurs at any step after a call to psa_key_derivation_setup(), - /// the operation will need to be reset by a call to psa_key_derivation_abort(). - /// - /// Implementations must reject an attempt to derive a key of size 0. - /// - /// \param[in,out] operation The key derivation operation object - /// to set up. It must - /// have been initialized but not set up yet. - /// \param alg The key derivation algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c alg is not a key derivation algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be inactive), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_setup( - operation: *mut psa_key_derivation_operation_t, - alg: psa_algorithm_t, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Retrieve the current capacity of a key derivation operation. - /// - /// The capacity of a key derivation is the maximum number of bytes that it can - /// return. When you get *N* bytes of output from a key derivation operation, - /// this reduces its capacity by *N*. - /// - /// \param[in] operation The operation to query. - /// \param[out] capacity On success, the capacity of the operation. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_get_capacity( - operation: *const psa_key_derivation_operation_t, - capacity: *mut usize, - ) -> psa_status_t; +impl Default for mbedtls_psa_pake_operation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Set the maximum capacity of a key derivation operation. - /// - /// The capacity of a key derivation operation is the maximum number of bytes - /// that the key derivation operation can return from this point onwards. - /// - /// \param[in,out] operation The key derivation operation object to modify. - /// \param capacity The new capacity of the operation. - /// It must be less or equal to the operation's - /// current capacity. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p capacity is larger than the operation's current capacity. - /// In this case, the operation object remains valid and its capacity - /// remains unchanged. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active), or the - /// library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_set_capacity( - operation: *mut psa_key_derivation_operation_t, - capacity: usize, - ) -> psa_status_t; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_mac_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_mac_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function passes direct inputs, which is usually correct for - /// non-secret inputs. To pass a secret input, which should be in a key - /// object, call psa_key_derivation_input_key() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] data Input data to use. - /// \param data_length Size of the \p data buffer in bytes. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow direct inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_bytes( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - data: *const u8, - data_length: usize, - ) -> psa_status_t; +impl Default for psa_driver_mac_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Provide a numeric input for key derivation or key agreement. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// However, when an algorithm requires a particular order, numeric inputs - /// usually come first as they tend to be configuration parameters. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function is used for inputs which are fixed-size non-negative - /// integers. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param[in] value The value of the numeric input. - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow numeric inputs. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_integer( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - value: u64, - ) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_aead_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_aead_operation_t, } -unsafe extern "C" { - /// Provide an input for key derivation in the form of a key. - /// - /// Which inputs are required and in what order depends on the algorithm. - /// Refer to the documentation of each key derivation or key agreement - /// algorithm for information. - /// - /// This function obtains input from a key object, which is usually correct for - /// secret inputs or for non-secret personalization strings kept in the key - /// store. To pass a non-secret parameter which is not in the key store, - /// call psa_key_derivation_input_bytes() instead of this function. - /// Refer to the documentation of individual step types - /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) - /// for more information. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() and must not - /// have produced any output yet. - /// \param step Which step the input data is for. - /// \param key Identifier of the key. It must have an - /// appropriate type for step and must allow the - /// usage #PSA_KEY_USAGE_DERIVE or - /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) - /// and the algorithm used by the operation. - /// - /// \note Once all inputs steps are completed, the operations will allow: - /// - psa_key_derivation_output_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_output_key() if the input for step - /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD - /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was - /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; - /// - psa_key_derivation_verify_bytes() if each input was either a direct input - /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; - /// - psa_key_derivation_verify_key() under the same conditions as - /// psa_key_derivation_verify_bytes(). - /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key allows neither #PSA_KEY_USAGE_DERIVE nor - /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this - /// algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c step is not compatible with the operation's algorithm, or - /// \c step does not allow key inputs of the given type - /// or does not allow key inputs at all. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this input \p step, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_key_derivation_input_key( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - key: mbedtls_svc_key_id_t, - ) -> psa_status_t; +impl Default for psa_driver_aead_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// Perform a key agreement and use the shared secret as input to a key - /// derivation. - /// - /// A key agreement algorithm takes two inputs: a private key \p private_key - /// a public key \p peer_key. - /// The result of this function is passed as input to a key derivation. - /// The output of this key derivation can be extracted by reading from the - /// resulting operation to produce keys and other cryptographic material. - /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// \param[in,out] operation The key derivation operation object to use. - /// It must have been set up with - /// psa_key_derivation_setup() with a - /// key agreement and derivation algorithm - /// \c alg (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true - /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) - /// is false). - /// The operation must be ready for an - /// input of the type given by \p step. - /// \param step Which step the input data is for. - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. The peer key must be in the - /// same format that psa_import_key() accepts for the - /// public key type corresponding to the type of - /// private_key. That is, this function performs the - /// equivalent of - /// #psa_import_key(..., - /// `peer_key`, `peer_key_length`) where - /// with key attributes indicating the public key - /// type corresponding to the type of `private_key`. - /// For example, for EC keys, this means that peer_key - /// is interpreted as a point on the curve that the - /// private key is on. The standard formats for public - /// keys are documented in the documentation of - /// psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_sign_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, +} +impl Default for psa_driver_sign_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_verify_hash_interruptible_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, +} +impl Default for psa_driver_verify_hash_interruptible_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_driver_pake_context_t { + pub dummy: ::core::ffi::c_uint, + pub mbedtls_ctx: mbedtls_psa_pake_operation_t, +} +impl Default for psa_driver_pake_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_mac_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_mac_size: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub __bindgen_padding_0: u64, + pub private_ctx: psa_driver_mac_context_t, +} +impl Default for psa_mac_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_mac_operation_s { + #[inline] + pub fn private_is_sign(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_is_sign: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; + private_is_sign as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_aead_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_key_type: psa_key_type_t, + pub private_ad_remaining: usize, + pub private_body_remaining: usize, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_ctx: psa_driver_aead_context_t, +} +impl Default for psa_aead_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_aead_operation_s { + #[inline] + pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(1usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 1usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 1usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_ad_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_body_started(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(3usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 3usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 3usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(4usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 4usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 4usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_nonce_set: ::core::ffi::c_uint, + private_lengths_set: ::core::ffi::c_uint, + private_ad_started: ::core::ffi::c_uint, + private_body_started: ::core::ffi::c_uint, + private_is_encrypt: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; + private_nonce_set as u64 + }); + __bindgen_bitfield_unit.set(1usize, 1u8, { + let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; + private_lengths_set as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; + private_ad_started as u64 + }); + __bindgen_bitfield_unit.set(3usize, 1u8, { + let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; + private_body_started as u64 + }); + __bindgen_bitfield_unit.set(4usize, 1u8, { + let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; + private_is_encrypt as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_hkdf_key_derivation_t { + pub private_info: *mut u8, + pub private_info_length: usize, + pub private_offset_in_block: u8, + pub private_block_number: u8, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_output_block: [u8; 64usize], + pub private_prk: [u8; 64usize], + pub __bindgen_padding_0: [u64; 0usize], + pub private_hmac: psa_mac_operation_s, +} +impl Default for psa_hkdf_key_derivation_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_hkdf_key_derivation_t { + #[inline] + pub fn private_state(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } + } + #[inline] + pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 2u8, val as u64) + } + } + #[inline] + pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 2u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 2u8, + val as u64, + ) + } + } + #[inline] + pub fn private_info_set(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(2usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 2usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 2usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_state: ::core::ffi::c_uint, + private_info_set: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 2u8, { + let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; + private_state as u64 + }); + __bindgen_bitfield_unit.set(2usize, 1u8, { + let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; + private_info_set as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_tls12_ecjpake_to_pms_t { + pub private_data: [u8; 32usize], +} +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: + psa_tls12_prf_key_derivation_state_t = 0; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: + psa_tls12_prf_key_derivation_state_t = 1; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 2; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: + psa_tls12_prf_key_derivation_state_t = 3; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: + psa_tls12_prf_key_derivation_state_t = 4; +pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: + psa_tls12_prf_key_derivation_state_t = 5; +pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_tls12_prf_key_derivation_s { + pub private_left_in_block: u8, + pub private_block_number: u8, + pub private_state: psa_tls12_prf_key_derivation_state_t, + pub private_secret: *mut u8, + pub private_secret_length: usize, + pub private_seed: *mut u8, + pub private_seed_length: usize, + pub private_label: *mut u8, + pub private_label_length: usize, + pub private_other_secret: *mut u8, + pub private_other_secret_length: usize, + pub private_Ai: [u8; 64usize], + pub private_output_block: [u8; 64usize], +} +impl Default for psa_tls12_prf_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub union psa_driver_key_derivation_context_t { + pub dummy: ::core::ffi::c_uint, + pub private_hkdf: psa_hkdf_key_derivation_t, + pub private_tls12_prf: psa_tls12_prf_key_derivation_t, + pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +} +impl Default for psa_driver_key_derivation_context_t { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +#[repr(C)] +#[repr(align(16))] +#[derive(Copy, Clone)] +pub struct psa_key_derivation_s { + pub private_alg: psa_algorithm_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_capacity: usize, + pub __bindgen_padding_0: [u64; 0usize], + pub private_ctx: psa_driver_key_derivation_context_t, +} +impl Default for psa_key_derivation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_key_derivation_s { + #[inline] + pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_can_output_key: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_can_output_key: u32 = + unsafe { ::core::mem::transmute(private_can_output_key) }; + private_can_output_key as u64 + }); + __bindgen_bitfield_unit + } +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_custom_key_parameters_s { + pub flags: u32, +} +#[repr(C)] +#[derive(Default)] +pub struct psa_key_production_parameters_s { + pub flags: u32, + pub data: __IncompleteArrayField, +} +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_policy_s { + pub private_usage: psa_key_usage_t, + pub private_alg: psa_algorithm_t, + pub private_alg2: psa_algorithm_t, +} +pub type psa_key_policy_t = psa_key_policy_s; +pub type psa_key_bits_t = u16; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_key_attributes_s { + pub private_type: psa_key_type_t, + pub private_bits: psa_key_bits_t, + pub private_lifetime: psa_key_lifetime_t, + pub private_policy: psa_key_policy_t, + pub private_id: mbedtls_svc_key_id_t, +} +/// \brief The context for PSA interruptible hash signing. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_sign_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_sign_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_sign_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_sign_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +/// \brief The context for PSA interruptible hash verification. +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_verify_hash_interruptible_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_ctx: psa_driver_verify_hash_interruptible_context_t, + pub _bitfield_align_1: [u8; 0], + pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, + pub private_num_ops: u32, +} +impl Default for psa_verify_hash_interruptible_operation_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl psa_verify_hash_interruptible_operation_s { + #[inline] + pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { + unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } + } + #[inline] + pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + self._bitfield_1.set(0usize, 1u8, val as u64) + } + } + #[inline] + pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { + unsafe { + ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( + ::core::ptr::addr_of!((*this)._bitfield_1), + 0usize, + 1u8, + ) as u32) + } + } + #[inline] + pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { + unsafe { + let val: u32 = ::core::mem::transmute(val); + <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( + ::core::ptr::addr_of_mut!((*this)._bitfield_1), + 0usize, + 1u8, + val as u64, + ) + } + } + #[inline] + pub fn new_bitfield_1( + private_error_occurred: ::core::ffi::c_uint, + ) -> __BindgenBitfieldUnit<[u8; 1usize]> { + let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); + __bindgen_bitfield_unit.set(0usize, 1u8, { + let private_error_occurred: u32 = + unsafe { ::core::mem::transmute(private_error_occurred) }; + private_error_occurred as u64 + }); + __bindgen_bitfield_unit + } +} +unsafe extern "C" { + /// \brief Library initialization. + /// + /// Applications must call this function before calling any other + /// function in this module. + /// + /// Applications may call this function more than once. Once a call + /// succeeds, subsequent calls are guaranteed to succeed. + /// + /// If the application calls other functions before calling psa_crypto_init(), + /// the behavior is undefined. Implementations are encouraged to either perform + /// the operation as if the library had been initialized or to return + /// #PSA_ERROR_BAD_STATE or some other applicable error. In particular, + /// implementations should not return a success status if the lack of + /// initialization may have security implications, for example due to improper + /// seeding of the random number generator. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + pub fn psa_crypto_init() -> psa_status_t; +} +unsafe extern "C" { + /// Retrieve the attributes of a key. + /// + /// This function first resets the attribute structure as with + /// psa_reset_key_attributes(). It then copies the attributes of + /// the given key into the given attribute structure. + /// + /// \note This function may allocate memory or other resources. + /// Once you have called this function on an attribute structure, + /// you must call psa_reset_key_attributes() to free these resources. + /// + /// \param[in] key Identifier of the key to query. + /// \param[in,out] attributes On success, the attributes of the key. + /// On failure, equivalent to a + /// freshly-initialized structure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_get_key_attributes( + key: mbedtls_svc_key_id_t, + attributes: *mut psa_key_attributes_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Reset a key attribute structure to a freshly initialized state. + /// + /// You must initialize the attribute structure as described in the + /// documentation of the type #psa_key_attributes_t before calling this + /// function. Once the structure has been initialized, you may call this + /// function at any time. + /// + /// This function frees any auxiliary resources that the structure + /// may contain. + /// + /// \param[in,out] attributes The attribute structure to reset. + pub fn psa_reset_key_attributes(attributes: *mut psa_key_attributes_t); +} +unsafe extern "C" { + /// Remove non-essential copies of key material from memory. + /// + /// If the key identifier designates a volatile key, this functions does not do + /// anything and returns successfully. + /// + /// If the key identifier designates a persistent key, then this function will + /// free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and the key can still be used. + /// + /// \param key Identifier of the key to purge. + /// + /// \retval #PSA_SUCCESS + /// The key material will have been removed from memory if it is not + /// currently required. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid key identifier. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_purge_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// Make a copy of a key. + /// + /// Copy key material from one location to another. + /// + /// This function is primarily useful to copy a key from one location + /// to another, since it populates a key using the material from + /// another key which may have a different lifetime. + /// + /// This function may be used to share a key with a different party, + /// subject to implementation-defined restrictions on key sharing. + /// + /// The policy on the source key must have the usage flag + /// #PSA_KEY_USAGE_COPY set. + /// This flag is sufficient to permit the copy if the key has the lifetime + /// #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + /// Some secure elements do not provide a way to copy a key without + /// making it extractable from the secure element. If a key is located + /// in such a secure element, then the key must have both usage flags + /// #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + /// a copy of the key outside the secure element. + /// + /// The resulting key may only be used in a way that conforms to + /// both the policy of the original key and the policy specified in + /// the \p attributes parameter: + /// - The usage flags on the resulting key are the bitwise-and of the + /// usage flags on the source policy and the usage flags in \p attributes. + /// - If both allow the same algorithm or wildcard-based + /// algorithm policy, the resulting key has the same algorithm policy. + /// - If either of the policies allows an algorithm and the other policy + /// allows a wildcard-based algorithm policy that includes this algorithm, + /// the resulting key allows the same algorithm. + /// - If the policies do not allow any algorithm in common, this function + /// fails with the status #PSA_ERROR_INVALID_ARGUMENT. + /// + /// The effect of this function on implementation-defined attributes is + /// implementation-defined. + /// + /// \param source_key The key to copy. It must allow the usage + /// #PSA_KEY_USAGE_COPY. If a private or secret key is + /// being copied outside of a secure element it must + /// also allow #PSA_KEY_USAGE_EXPORT. + /// \param[in] attributes The attributes for the new key. + /// They are used as follows: + /// - The key type and size may be 0. If either is + /// nonzero, it must match the corresponding + /// attribute of the source key. + /// - The key location (the lifetime and, for + /// persistent keys, the key identifier) is + /// used directly. + /// - The policy constraints (usage flags and + /// algorithm policy) are combined from + /// the source key and \p attributes so that + /// both sets of restrictions apply, as + /// described in the documentation of this function. + /// \param[out] target_key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p source_key is invalid. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The lifetime or identifier in \p attributes are invalid, or + /// the policy constraints on the source and specified in + /// \p attributes are incompatible, or + /// \p attributes specifies a key type or key size + /// which does not match the attributes of the source key. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The source key does not have the #PSA_KEY_USAGE_COPY usage flag, or + /// the source key is not exportable and its lifetime does not + /// allow copying it to the target's lifetime. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_copy_key( + source_key: mbedtls_svc_key_id_t, + attributes: *const psa_key_attributes_t, + target_key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Destroy a key. + /// + /// This function destroys a key from both volatile + /// memory and, if applicable, non-volatile storage. Implementations shall + /// make a best effort to ensure that the key material cannot be recovered. + /// + /// This function also erases any metadata such as policies and frees + /// resources associated with the key. + /// + /// If a key is currently in use in a multipart operation, then destroying the + /// key will cause the multipart operation to fail. + /// + /// \warning We can only guarantee that the the key material will + /// eventually be wiped from memory. With threading enabled + /// and during concurrent execution, copies of the key material may + /// still exist until all threads have finished using the key. + /// + /// \param key Identifier of the key to erase. If this is \c 0, do nothing and + /// return #PSA_SUCCESS. + /// + /// \retval #PSA_SUCCESS + /// \p key was a valid identifier and the key material that it + /// referred to has been erased. Alternatively, \p key is \c 0. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key cannot be erased because it is + /// read-only, either due to a policy or due to physical restrictions. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p key is not a valid identifier nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE + /// There was a failure in communication with the cryptoprocessor. + /// The key material may still be present in the cryptoprocessor. + /// \retval #PSA_ERROR_DATA_INVALID + /// This error is typically a result of either storage corruption on a + /// cleartext storage backend, or an attempt to read data that was + /// written by an incompatible version of the library. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The storage is corrupted. Implementations shall make a best effort + /// to erase key material even in this stage, however applications + /// should be aware that it may be impossible to guarantee that the + /// key material is not recoverable in such cases. + /// \retval #PSA_ERROR_CORRUPTION_DETECTED + /// An unexpected condition which is not a storage corruption or + /// a communication failure occurred. The cryptoprocessor may have + /// been compromised. + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_destroy_key(key: mbedtls_svc_key_id_t) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Import a key in binary format. + /// + /// This function supports any output from psa_export_key(). Refer to the + /// documentation of psa_export_public_key() for the format of public keys + /// and to the documentation of psa_export_key() for the format for + /// other key types. + /// + /// The key data determines the key size. The attributes may optionally + /// specify a key size; in this case it must match the size determined + /// from the key data. A key size of 0 in \p attributes indicates that + /// the key size is solely determined by the key data. + /// + /// Implementations must reject an attempt to import a key of size 0. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// \param[in] attributes The attributes for the new key. + /// The key size is always determined from the + /// \p data buffer. + /// If the key size in \p attributes is nonzero, + /// it must be equal to the size from \p data. + /// \param[out] key On success, an identifier to the newly created key. + /// For persistent keys, this is the key identifier + /// defined in \p attributes. + /// \c 0 on failure. + /// \param[in] data Buffer containing the key data. The content of this + /// buffer is interpreted according to the type declared + /// in \p attributes. + /// All implementations must support at least the format + /// described in the documentation + /// of psa_export_key() or psa_export_public_key() for + /// the chosen type. Implementations may allow other + /// formats, but should be conservative: implementations + /// should err on the side of rejecting content if it + /// may be erroneous (e.g. wrong type or truncated data). + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular persistent location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key attributes, as a whole, are invalid, or + /// the key data is not correctly formatted, or + /// the size in \p attributes is nonzero and does not match the size + /// of the key data. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_import_key( + attributes: *const psa_key_attributes_t, + data: *const u8, + data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a key in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an equivalent object. + /// + /// If the implementation of psa_import_key() supports other formats + /// beyond the format specified here, the output from psa_export_key() + /// must use the representation specified here, not the original + /// representation. + /// + /// For standard key types, the output format is as follows: + /// + /// - For symmetric keys (including MAC keys), the format is the + /// raw bytes of the key. + /// - For DES, the key data consists of 8 bytes. The parity bits must be + /// correct. + /// - For Triple-DES, the format is the concatenation of the + /// two or three DES keys. + /// - For RSA key pairs (#PSA_KEY_TYPE_RSA_KEY_PAIR), the format + /// is the non-encrypted DER encoding of the representation defined by + /// PKCS\#1 (RFC 8017) as `RSAPrivateKey`, version 0. + /// ``` + /// RSAPrivateKey ::= SEQUENCE { + /// version INTEGER, -- must be 0 + /// modulus INTEGER, -- n + /// publicExponent INTEGER, -- e + /// privateExponent INTEGER, -- d + /// prime1 INTEGER, -- p + /// prime2 INTEGER, -- q + /// exponent1 INTEGER, -- d mod (p-1) + /// exponent2 INTEGER, -- d mod (q-1) + /// coefficient INTEGER, -- (inverse of q) mod p + /// } + /// ``` + /// - For elliptic curve key pairs (key types for which + /// #PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is + /// a representation of the private value as a `ceiling(m/8)`-byte string + /// where `m` is the bit size associated with the curve, i.e. the bit size + /// of the order of the curve's coordinate field. This byte string is + /// in little-endian order for Montgomery curves (curve types + /// `PSA_ECC_FAMILY_CURVEXXX`), and in big-endian order for Weierstrass + /// curves (curve types `PSA_ECC_FAMILY_SECTXXX`, `PSA_ECC_FAMILY_SECPXXX` + /// and `PSA_ECC_FAMILY_BRAINPOOL_PXXX`). + /// For Weierstrass curves, this is the content of the `privateKey` field of + /// the `ECPrivateKey` format defined by RFC 5915. For Montgomery curves, + /// the format is defined by RFC 7748, and output is masked according to §5. + /// For twisted Edwards curves, the private key is as defined by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For Diffie-Hellman key exchange key pairs (key types for which + /// #PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the + /// format is the representation of the private key `x` as a big-endian byte + /// string. The length of the byte string is the private key size in bytes + /// (leading zeroes are not stripped). + /// - For public keys (key types for which #PSA_KEY_TYPE_IS_PUBLIC_KEY is + /// true), the format is the same as for psa_export_public_key(). + /// + /// The policy on the key must have the usage flag #PSA_KEY_USAGE_EXPORT set. + /// + /// \param key Identifier of the key to export. It must allow the + /// usage #PSA_KEY_USAGE_EXPORT, unless it is a public + /// key. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_EXPORT flag. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(\c type, \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Export a public key or the public part of a key pair in binary format. + /// + /// The output of this function can be passed to psa_import_key() to + /// create an object that is equivalent to the public key. + /// + /// This specification supports a single format for each key type. + /// Implementations may support other formats as long as the standard + /// format is supported. Implementations that support other formats + /// should ensure that the formats are clearly unambiguous so as to + /// minimize the risk that an invalid input is accidentally interpreted + /// according to a different format. + /// + /// For standard key types, the output format is as follows: + /// - For RSA public keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of + /// the representation defined by RFC 3279 §2.3.1 as `RSAPublicKey`. + /// ``` + /// RSAPublicKey ::= SEQUENCE { + /// modulus INTEGER, -- n + /// publicExponent INTEGER } -- e + /// ``` + /// - For elliptic curve keys on a twisted Edwards curve (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true and #PSA_KEY_TYPE_ECC_GET_FAMILY + /// returns #PSA_ECC_FAMILY_TWISTED_EDWARDS), the public key is as defined + /// by RFC 8032 + /// (a 32-byte string for Edwards25519, a 57-byte string for Edwards448). + /// - For other elliptic curve public keys (key types for which + /// #PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed + /// representation defined by SEC1 §2.3.3 as the content of an ECPoint. + /// Let `m` be the bit size associated with the curve, i.e. the bit size of + /// `q` for a curve over `F_q`. The representation consists of: + /// - The byte 0x04; + /// - `x_P` as a `ceiling(m/8)`-byte string, big-endian; + /// - `y_P` as a `ceiling(m/8)`-byte string, big-endian. + /// - For Diffie-Hellman key exchange public keys (key types for which + /// #PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), + /// the format is the representation of the public key `y = g^x mod p` as a + /// big-endian byte string. The length of the byte string is the length of the + /// base prime `p` in bytes. + /// + /// Exporting a public key object or the public part of a key pair is + /// always permitted, regardless of the key's usage flags. + /// + /// \param key Identifier of the key to export. + /// \param[out] data Buffer where the key data is to be written. + /// \param data_size Size of the \p data buffer in bytes. + /// \param[out] data_length On success, the number of bytes + /// that make up the key data. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key is neither a public key nor a key pair. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p data buffer is too small. You can determine a + /// sufficient buffer size by calling + /// #PSA_EXPORT_KEY_OUTPUT_SIZE(#PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(\c type), \c bits) + /// where \c type is the key type + /// and \c bits is the key size in bits. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_export_public_key( + key: mbedtls_svc_key_id_t, + data: *mut u8, + data_size: usize, + data_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message. + /// + /// \note To verify the hash of a message against an + /// expected value, use psa_hash_compare() instead. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\p alg). /// /// \retval #PSA_SUCCESS /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p hash_size is too small + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compute( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Calculate the hash (digest) of a message and compare it with a + /// reference value. + /// + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// \param[in] input Buffer containing the message to hash. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the input. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a hash algorithm. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \c private_key is not compatible with \c alg, - /// or \p peer_key is not valid for \c alg or not compatible with - /// \c private_key, or \c step does not allow an input resulting - /// from a key agreement. + /// \p input_length or \p hash_length do not match the hash size for \p alg + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_compare( + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; +} +/// The type of the state data structure for multipart hash operations. +/// +/// Before calling any function on a hash operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_hash_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_hash_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_HASH_OPERATION_INIT, +/// for example: +/// \code +/// psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_hash_operation_init() +/// to the structure, for example: +/// \code +/// psa_hash_operation_t operation; +/// operation = psa_hash_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_hash_operation_t = psa_hash_operation_s; +unsafe extern "C" { + /// Set up a multipart hash operation. + /// + /// The sequence of operations to calculate a hash (message digest) + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_hash_operation_t, e.g. #PSA_HASH_OPERATION_INIT. + /// -# Call psa_hash_setup() to specify the algorithm. + /// -# Call psa_hash_update() zero, one or more times, passing a fragment + /// of the message each time. The hash that is calculated is the hash + /// of the concatenation of these messages in order. + /// -# To calculate the hash, call psa_hash_finish(). + /// To compare the hash with an expected value, call psa_hash_verify(). + /// + /// If an error occurs at any step after a call to psa_hash_setup(), the + /// operation will need to be reset by a call to psa_hash_abort(). The + /// application may call psa_hash_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_hash_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_hash_finish() or psa_hash_verify(). + /// - A call to psa_hash_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_hash_operation_t and not yet in use. + /// \param alg The hash algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_HASH(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \c alg is not supported or is not a key derivation algorithm. + /// \p alg is not a supported hash algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a hash algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid for this key agreement \p step, - /// or the library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_key_agreement( - operation: *mut psa_key_derivation_operation_t, - step: psa_key_derivation_step_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, + pub fn psa_hash_setup( + operation: *mut psa_hash_operation_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// Read some data from a key derivation operation. + /// Add a message fragment to a multipart hash operation. /// - /// This function calculates output bytes from a key derivation algorithm and - /// return those bytes. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the requested number of bytes from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. + /// The application must call psa_hash_setup() before calling this function. /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] output Buffer where the output will be written. - /// \param output_length Number of bytes to output. + /// \param[in,out] operation Active hash operation. + /// \param[in] input Buffer containing the message fragment to hash. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// no output is written to the output buffer. - /// The operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller output buffer. + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_update( + operation: *mut psa_hash_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \warning Applications should not call this function if they expect + /// a specific value for the hash. Call psa_hash_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// hash values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the hashed data which could allow an attacker to guess + /// a valid hash and thereby bypass security controls. + /// + /// \param[in,out] operation Active hash operation. + /// \param[out] hash Buffer where the hash is to be written. + /// \param hash_size Size of the \p hash buffer in bytes. + /// \param[out] hash_length On success, the number of bytes + /// that make up the hash value. This is always + /// #PSA_HASH_LENGTH(\c alg) where \c alg is the + /// hash algorithm that is calculated. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p hash buffer is too small. You can determine a + /// sufficient buffer size by calling #PSA_HASH_LENGTH(\c alg) + /// where \c alg is the hash algorithm that is calculated. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_finish( + operation: *mut psa_hash_operation_t, + hash: *mut u8, + hash_size: usize, + hash_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Finish the calculation of the hash of a message and compare it with + /// an expected value. + /// + /// The application must call psa_hash_setup() before calling this function. + /// This function calculates the hash of the message formed by concatenating + /// the inputs passed to preceding calls to psa_hash_update(). It then + /// compares the calculated hash with the expected hash passed as a + /// parameter to this function. + /// + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_hash_abort(). + /// + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual hash and the expected hash is performed + /// in constant time. + /// + /// \param[in,out] operation Active hash operation. + /// \param[in] hash Buffer containing the expected hash value. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected hash is identical to the actual hash of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The hash of the message was calculated successfully, but it + /// differs from the expected hash. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_bytes( - operation: *mut psa_key_derivation_operation_t, - output: *mut u8, - output_length: usize, + pub fn psa_hash_verify( + operation: *mut psa_hash_operation_t, + hash: *const u8, + hash_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// Derive a key from an ongoing key derivation operation. - /// - /// This function calculates output bytes from a key derivation algorithm - /// and uses those bytes to generate a key deterministically. - /// The key's location, usage policy, type and size are taken from - /// \p attributes. - /// - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads as many bytes as required from the - /// stream. - /// The operation's capacity decreases by the number of bytes read. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error - /// state and must be aborted by calling psa_key_derivation_abort(). - /// - /// How much output is produced and consumed from the operation, and how - /// the key is derived, depends on the key type and on the key size - /// (denoted \c bits below): - /// - /// - For key types for which the key is an arbitrary sequence of bytes - /// of a given size, this function is functionally equivalent to - /// calling #psa_key_derivation_output_bytes - /// and passing the resulting output to #psa_import_key. - /// However, this function has a security benefit: - /// if the implementation provides an isolation boundary then - /// the key material is not exposed outside the isolation boundary. - /// As a consequence, for these key types, this function always consumes - /// exactly (\c bits / 8) bytes from the operation. - /// The following key types defined in this specification follow this scheme: - /// - /// - #PSA_KEY_TYPE_AES; - /// - #PSA_KEY_TYPE_ARIA; - /// - #PSA_KEY_TYPE_CAMELLIA; - /// - #PSA_KEY_TYPE_DERIVE; - /// - #PSA_KEY_TYPE_HMAC; - /// - #PSA_KEY_TYPE_PASSWORD_HASH. - /// - /// - For ECC keys on a Montgomery elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Montgomery curve), this function always draws a byte string whose - /// length is determined by the curve, and sets the mandatory bits - /// accordingly. That is: + /// Abort a hash operation. /// - /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte - /// string and process it as specified in RFC 7748 §5. - /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte - /// string and process it as specified in RFC 7748 §5. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_hash_setup() again. /// - /// - For key types for which the key is represented by a single sequence of - /// \c bits bits with constraints as to which bit sequences are acceptable, - /// this function draws a byte string of length (\c bits / 8) bytes rounded - /// up to the nearest whole number of bytes. If the resulting byte string - /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. - /// This process is repeated until an acceptable byte string is drawn. - /// The byte string drawn from the operation is interpreted as specified - /// for the output produced by psa_export_key(). - /// The following key types defined in this specification follow this scheme: + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_hash_operation_t. /// - /// - #PSA_KEY_TYPE_DES. - /// Force-set the parity bits, but discard forbidden weak keys. - /// For 2-key and 3-key triple-DES, the three keys are generated - /// successively (for example, for 3-key triple-DES, - /// if the first 8 bytes specify a weak key and the next 8 bytes do not, - /// discard the first 8 bytes, use the next 8 bytes as the first key, - /// and continue reading output from the operation to derive the other - /// two keys). - /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) - /// where \c group designates any Diffie-Hellman group) and - /// ECC keys on a Weierstrass elliptic curve - /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a - /// Weierstrass curve). - /// For these key types, interpret the byte string as integer - /// in big-endian order. Discard it if it is not in the range - /// [0, *N* - 2] where *N* is the boundary of the private key domain - /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, - /// or the order of the curve's base point for ECC). - /// Add 1 to the resulting integer and use this as the private key *x*. - /// This method allows compliance to NIST standards, specifically - /// the methods titled "key-pair generation by testing candidates" - /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, - /// in FIPS 186-4 §B.1.2 for DSA, and - /// in NIST SP 800-56A §5.6.1.2.2 or - /// FIPS 186-4 §B.4.2 for elliptic curve keys. + /// In particular, calling psa_hash_abort() after the operation has been + /// terminated by a call to psa_hash_abort(), psa_hash_finish() or + /// psa_hash_verify() is safe and has no effect. /// - /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, - /// the way in which the operation output is consumed is - /// implementation-defined. + /// \param[in,out] operation Initialized hash operation. /// - /// In all cases, the data that is read is discarded from the operation. - /// The operation's capacity is decreased by the number of bytes read. + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_hash_abort(operation: *mut psa_hash_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Clone a hash operation. /// - /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, - /// the input to that step must be provided with psa_key_derivation_input_key(). - /// Future versions of this specification may include additional restrictions - /// on the derived key based on the attributes and strength of the secret key. + /// This function copies the state of an ongoing hash operation to + /// a new operation object. In other words, this function is equivalent + /// to calling psa_hash_setup() on \p target_operation with the same + /// algorithm that \p source_operation was set up for, then + /// psa_hash_update() on \p target_operation with the same input that + /// that was passed to \p source_operation. After this function returns, the + /// two objects are independent, i.e. subsequent calls involving one of + /// the objects do not affect the other object. /// - /// \param[in] attributes The attributes for the new key. - /// If the key type to be created is - /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in - /// the policy must be the same as in the current - /// operation. - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in] source_operation The active hash operation to clone. + /// \param[in,out] target_operation The operation object to set up. + /// It must be initialized but not active. /// - /// \retval #PSA_SUCCESS - /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// There was not enough data to create the desired key. - /// Note that in this case, no output is written to the output buffer. - /// The operation's capacity is set to 0, thus subsequent calls to - /// this function will not succeed, even with a smaller output buffer. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size is not supported, either by the - /// implementation in general or in this particular location. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The provided key attributes are not valid for the operation. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The #PSA_KEY_DERIVATION_INPUT_SECRET or - /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a - /// key; or one of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_DERIVE. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_SUCCESS \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The \p source_operation state is not valid (it must be active), or + /// the \p target_operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_output_key( - attributes: *const psa_key_attributes_t, - operation: *mut psa_key_derivation_operation_t, - key: *mut mbedtls_svc_key_id_t, + pub fn psa_hash_clone( + source_operation: *const psa_hash_operation_t, + target_operation: *mut psa_hash_operation_t, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value in constant time. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the expected number of bytes from the - /// stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to the following code: - /// \code - /// psa_key_derivation_output_bytes(operation, tmp, output_length); - /// if (memcmp(output, tmp, output_length) != 0) - /// return PSA_ERROR_INVALID_SIGNATURE; - /// \endcode - /// except (1) it works even if the key's policy does not allow outputting the - /// bytes, and (2) the comparison will be done in constant time. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC (message authentication code) of a message. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected_output Buffer containing the expected derivation output. - /// \param output_length Length of the expected output; this is also the - /// number of bytes that will be read. + /// \note To verify the MAC of a message against an + /// expected value, use psa_mac_verify() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but it differs from the expected - /// output. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// One of the inputs was a key whose policy didn't allow - /// #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// \p output_length bytes. Note that in this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p mac_size is too small /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_bytes( - operation: *mut psa_key_derivation_operation_t, - expected_output: *const u8, - output_length: usize, + pub fn psa_mac_compute( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// Compare output data from a key derivation operation to an expected value - /// stored in a key object. - /// - /// This function calculates output bytes from a key derivation algorithm and - /// compares those bytes to an expected value, provided as key of type - /// #PSA_KEY_TYPE_PASSWORD_HASH. - /// If you view the key derivation's output as a stream of bytes, this - /// function destructively reads the number of bytes corresponding to the - /// length of the expected value from the stream before comparing them. - /// The operation's capacity decreases by the number of bytes read. - /// - /// This is functionally equivalent to exporting the key and calling - /// psa_key_derivation_verify_bytes() on the result, except that it - /// works even if the key cannot be exported. - /// - /// If this function returns an error status other than - /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, - /// the operation enters an error state and must be aborted by calling - /// psa_key_derivation_abort(). + /// Calculate the MAC of a message and compare it with a reference value. /// - /// \param[in,out] operation The key derivation operation object to read from. - /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH - /// containing the expected output. Its policy must - /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag - /// and the permitted algorithm must match the - /// operation. The value of this key was likely - /// computed by a previous call to - /// psa_key_derivation_output_key(). + /// \param key Identifier of the key to use for the operation. It + /// must allow the usage PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// \param[in] input Buffer containing the input message. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the input. /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The output was read successfully, but if differs from the expected - /// output. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// The key passed as the expected value does not exist. + /// The MAC of the message was calculated successfully, but it + /// differs from the expected value. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key passed as the expected value has an invalid type. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key passed as the expected value does not allow this usage or - /// this algorithm; or one of the inputs was a key whose policy didn't - /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. - /// \retval #PSA_ERROR_INSUFFICIENT_DATA - /// The operation's capacity was less than - /// the length of the expected value. In this case, - /// the operation's capacity is set to 0, thus - /// subsequent calls to this function will not - /// succeed, even with a smaller expected output. + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active and completed - /// all required input steps), or the library has not been previously - /// initialized by psa_crypto_init(). + /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_verify_key( - operation: *mut psa_key_derivation_operation_t, - expected: psa_key_id_t, + pub fn psa_mac_verify( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + mac: *const u8, + mac_length: usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart MAC operations. +/// +/// Before calling any function on a MAC operation object, the application must +/// initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_mac_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_mac_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_MAC_OPERATION_INIT, +/// for example: +/// \code +/// psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_mac_operation_init() +/// to the structure, for example: +/// \code +/// psa_mac_operation_t operation; +/// operation = psa_mac_operation_init(); +/// \endcode +/// +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_mac_operation_t = psa_mac_operation_s; unsafe extern "C" { - /// Abort a key derivation operation. + /// Set up a multipart MAC calculation operation. /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_key_derivation_setup() again. + /// This function sets up the calculation of the MAC + /// (message authentication code) of a byte string. + /// To verify the MAC of a message against an + /// expected value, use psa_mac_verify_setup() instead. /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_key_derivation_operation_t. + /// The sequence of operations to calculate a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_sign_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_sign_finish() to finish + /// calculating the MAC value and retrieve it. /// - /// In particular, it is valid to call psa_key_derivation_abort() twice, or to - /// call psa_key_derivation_abort() on an operation that has not been set up. + /// If an error occurs at any step after a call to psa_mac_sign_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. /// - /// \param[in,out] operation The operation to abort. + /// After a successful call to psa_mac_sign_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_sign_finish(). + /// - A call to psa_mac_abort(). /// - /// \retval #PSA_SUCCESS \emptydescription + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a MAC algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) - -> psa_status_t; + pub fn psa_mac_sign_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Perform a key agreement and return the raw shared secret. + /// Set up a multipart MAC verification operation. /// - /// \warning The raw result of a key agreement algorithm such as finite-field - /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should - /// not be used directly as key material. It should instead be passed as - /// input to a key derivation algorithm. To chain a key agreement with - /// a key derivation, use psa_key_derivation_key_agreement() and other - /// functions from the key derivation interface. + /// This function sets up the verification of the MAC + /// (message authentication code) of a byte string against an expected value. /// - /// \param alg The key agreement algorithm to compute - /// (\c PSA_ALG_XXX value such that - /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) - /// is true). - /// \param private_key Identifier of the private key to use. It must - /// allow the usage #PSA_KEY_USAGE_DERIVE. - /// \param[in] peer_key Public key of the peer. It must be - /// in the same format that psa_import_key() - /// accepts. The standard formats for public - /// keys are documented in the documentation - /// of psa_export_public_key(). - /// \param peer_key_length Size of \p peer_key in bytes. - /// \param[out] output Buffer where the decrypted message is to - /// be written. - /// \param output_size Size of the \c output buffer in bytes. - /// \param[out] output_length On success, the number of bytes - /// that make up the returned output. + /// The sequence of operations to verify a MAC is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_mac_operation_t, e.g. #PSA_MAC_OPERATION_INIT. + /// -# Call psa_mac_verify_setup() to specify the algorithm and key. + /// -# Call psa_mac_update() zero, one or more times, passing a fragment + /// of the message each time. The MAC that is calculated is the MAC + /// of the concatenation of these messages in order. + /// -# At the end of the message, call psa_mac_verify_finish() to finish + /// calculating the actual MAC of the message and verify it against + /// the expected value. + /// + /// If an error occurs at any step after a call to psa_mac_verify_setup(), the + /// operation will need to be reset by a call to psa_mac_abort(). The + /// application may call psa_mac_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_mac_verify_setup(), the application must + /// eventually terminate the operation through one of the following methods: + /// - A successful call to psa_mac_verify_finish(). + /// - A call to psa_mac_abort(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_mac_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. It + /// must remain valid until the operation terminates. + /// It must allow the usage + /// PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param alg The MAC algorithm to compute (\c PSA_ALG_XXX value + /// such that #PSA_ALG_IS_MAC(\p alg) is true). /// /// \retval #PSA_SUCCESS /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p alg is not a key agreement algorithm, or - /// \p private_key is not compatible with \p alg, - /// or \p peer_key is not valid for \p alg or not compatible with - /// \p private_key. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// \p output_size is too small + /// \c key is not compatible with \c alg. /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p alg is not a supported key agreement algorithm. + /// \c alg is not supported or is not a MAC algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The key could not be retrieved from storage. /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_raw_key_agreement( + pub fn psa_mac_verify_setup( + operation: *mut psa_mac_operation_t, + key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - private_key: mbedtls_svc_key_id_t, - peer_key: *const u8, - peer_key_length: usize, - output: *mut u8, - output_size: usize, - output_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate random bytes. - /// - /// \warning This function **can** fail! Callers MUST check the return status - /// and MUST NOT use the content of the output buffer if the return - /// status is not #PSA_SUCCESS. - /// - /// \note To generate a key, use psa_generate_key() instead. - /// - /// \param[out] output Output buffer for the generated data. - /// \param output_size Number of bytes to generate and output. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Generate a key or key pair. - /// - /// The key is generated randomly. - /// Its location, usage policy, type and size are taken from \p attributes. + /// Add a message fragment to a multipart MAC operation. /// - /// Implementations must reject an attempt to generate a key of size 0. + /// The application must call psa_mac_sign_setup() or psa_mac_verify_setup() + /// before calling this function. /// - /// The following type-specific considerations apply: - /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the public exponent is 65537. - /// The modulus is a product of two probabilistic primes - /// between 2^{n-1} and 2^n where n is the bit size specified in the - /// attributes. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param[in] attributes The attributes for the new key. - /// \param[out] key On success, an identifier for the newly created - /// key. For persistent keys, this is the key - /// identifier defined in \p attributes. - /// \c 0 on failure. + /// \param[in,out] operation Active MAC operation. + /// \param[in] input Buffer containing the message fragment to add to + /// the MAC calculation. + /// \param input_length Size of the \p input buffer in bytes. /// /// \retval #PSA_SUCCESS /// Success. - /// If the key is persistent, the key material and the key's metadata - /// have been saved to persistent storage. - /// \retval #PSA_ERROR_ALREADY_EXISTS - /// This is an attempt to create a persistent key, and there is - /// already a persistent key with the given identifier. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_generate_key( - attributes: *const psa_key_attributes_t, - key: *mut mbedtls_svc_key_id_t, - ) -> psa_status_t; -} -/// The type of the state data structure for interruptible hash -/// signing operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation = -/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_sign_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_sign_hash_interruptible_operation_t operation; -/// operation = psa_sign_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; -/// The type of the state data structure for interruptible hash -/// verification operations. -/// -/// Before calling any function on a sign hash operation object, the -/// application must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer -/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation = -/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function -/// psa_verify_hash_interruptible_operation_init() to the structure, for -/// example: -/// \code -/// psa_verify_hash_interruptible_operation_t operation; -/// operation = psa_verify_hash_interruptible_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; -unsafe extern "C" { - /// \brief Set the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note The time taken to execute a single op is - /// implementation specific and depends on - /// software, hardware, the algorithm, key type and - /// curve chosen. Even within a single operation, - /// successive ops can take differing amounts of - /// time. The only guarantee is that lower values - /// for \p max_ops means functions will block for a - /// lesser maximum amount of time. The functions - /// \c psa_sign_interruptible_get_num_ops() and - /// \c psa_verify_interruptible_get_num_ops() are - /// provided to help with tuning this value. - /// - /// \note This value defaults to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which - /// means the whole operation will be done in one - /// go, regardless of the number of ops required. - /// - /// \note If more ops are needed to complete a - /// computation, #PSA_OPERATION_INCOMPLETE will be - /// returned by the function performing the - /// computation. It is then the caller's - /// responsibility to either call again with the - /// same operation context until it returns 0 or an - /// error code; or to call the relevant abort - /// function if the answer is no longer required. - /// - /// \note The interpretation of \p max_ops is also - /// implementation defined. On a hard real time - /// system, this can indicate a hard deadline, as a - /// real-time system needs a guarantee of not - /// spending more than X time, however care must be - /// taken in such an implementation to avoid the - /// situation whereby calls just return, not being - /// able to do any actual work within the allotted - /// time. On a non-real-time system, the - /// implementation can be more relaxed, but again - /// whether this number should be interpreted as as - /// hard or soft limit or even whether a less than - /// or equals as regards to ops executed in a - /// single call is implementation defined. - /// - /// \note For keys in local storage when no accelerator - /// driver applies, please see also the - /// documentation for \c mbedtls_ecp_set_max_ops(), - /// which is the internal implementation in these - /// cases. - /// - /// \warning With implementations that interpret this number - /// as a hard limit, setting this number too small - /// may result in an infinite loop, whereby each - /// call results in immediate return with no ops - /// done (as there is not enough time to execute - /// any), and thus no result will ever be achieved. - /// - /// \note This only applies to functions whose - /// documentation mentions they may return - /// #PSA_OPERATION_INCOMPLETE. - /// - /// \param max_ops The maximum number of ops to be executed in a - /// single call. This can be a number from 0 to - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 - /// is the least amount of work done per call. - pub fn psa_interruptible_set_max_ops(max_ops: u32); -} -unsafe extern "C" { - /// \brief Get the maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. This will return the last - /// value set by - /// \c psa_interruptible_set_max_ops() or - /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if - /// that function has never been called. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \return Maximum number of ops allowed to be - /// executed by an interruptible function in a - /// single call. - pub fn psa_interruptible_get_max_ops() -> u32; + pub fn psa_mac_update( + operation: *mut psa_mac_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash signing - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling - /// \c psa_sign_hash_interruptible_abort() on - /// the operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message. /// - /// \note This interface is guaranteed re-entrant and - /// thus may be called from driver code. + /// The application must call psa_mac_sign_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// \warning Applications should not call this function if they expect + /// a specific value for the MAC. Call psa_mac_verify_finish() instead. + /// Beware that comparing integrity or authenticity data such as + /// MAC values with a function such as \c memcmp is risky + /// because the time taken by the comparison may leak information + /// about the MAC value which could allow an attacker to guess + /// a valid MAC and thereby bypass security controls. /// - /// \param operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// \param[in,out] operation Active MAC operation. + /// \param[out] mac Buffer where the MAC value is to be written. + /// \param mac_size Size of the \p mac buffer in bytes. + /// \param[out] mac_length On success, the number of bytes + /// that make up the MAC value. This is always + /// #PSA_MAC_LENGTH(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of the key and \c alg is the + /// MAC algorithm that is calculated. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_sign_hash_get_num_ops( - operation: *const psa_sign_hash_interruptible_operation_t, - ) -> u32; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p mac buffer is too small. You can determine a + /// sufficient buffer size by calling PSA_MAC_LENGTH(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac sign + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_sign_finish( + operation: *mut psa_mac_operation_t, + mac: *mut u8, + mac_size: usize, + mac_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Get the number of ops that a hash verification - /// operation has taken so far. If the operation - /// has completed, then this will represent the - /// number of ops required for the entire - /// operation. After initialization or calling \c - /// psa_verify_hash_interruptible_abort() on the - /// operation, a value of 0 will be returned. + /// Finish the calculation of the MAC of a message and compare it with + /// an expected value. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// The application must call psa_mac_verify_setup() before calling this function. + /// This function calculates the MAC of the message formed by concatenating + /// the inputs passed to preceding calls to psa_mac_update(). It then + /// compares the calculated MAC with the expected MAC passed as a + /// parameter to this function. /// - /// This is a helper provided to help you tune the - /// value passed to \c - /// psa_interruptible_set_max_ops(). + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_mac_abort(). /// - /// \param operation The \c - /// psa_verify_hash_interruptible_operation_t to - /// use. This must be initialized first. + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual MAC and the expected MAC is performed + /// in constant time. /// - /// \return Number of ops that the operation has taken so - /// far. - pub fn psa_verify_hash_get_num_ops( - operation: *const psa_verify_hash_interruptible_operation_t, - ) -> u32; + /// \param[in,out] operation Active MAC operation. + /// \param[in] mac Buffer containing the expected MAC value. + /// \param mac_length Size of the \p mac buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The expected MAC is identical to the actual MAC of the message. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The MAC of the message was calculated successfully, but it + /// differs from the expected MAC. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active mac verify + /// operation), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_verify_finish( + operation: *mut psa_mac_operation_t, + mac: *const u8, + mac_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start signing a hash or short message with a - /// private key, in an interruptible manner. + /// Abort a MAC operation. /// - /// \see \c psa_sign_hash_complete() + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_mac_sign_setup() or psa_mac_verify_setup() again. /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// You may call this function any time after the operation object has + /// been initialized by one of the methods described in #psa_mac_operation_t. /// - /// \note This function combined with \c - /// psa_sign_hash_complete() is equivalent to - /// \c psa_sign_hash() but - /// \c psa_sign_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// In particular, calling psa_mac_abort() after the operation has been + /// terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or + /// psa_mac_verify_finish() is safe and has no effect. /// - /// \note Users should call \c psa_sign_hash_complete() - /// repeatedly on the same context after a - /// successful call to this function until \c - /// psa_sign_hash_complete() either returns 0 or an - /// error. \c psa_sign_hash_complete() will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// \param[in,out] operation Initialized MAC operation. /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_sign_hash_abort(). + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_mac_abort(operation: *mut psa_mac_operation_t) -> psa_status_t; +} +unsafe extern "C" { + /// Encrypt a message using a symmetric cipher. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// This function encrypts a message with a random IV (initialization + /// vector). Use the multipart operation interface with a + /// #psa_cipher_operation_t object to provide other forms of IV. /// /// \param key Identifier of the key to use for the operation. - /// It must be an asymmetric key pair. The key must - /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash or message to sign. - /// \param hash_length Size of the \p hash buffer in bytes. + /// It must allow the usage #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// The output contains the IV followed by + /// the ciphertext proper. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. /// /// \retval #PSA_SUCCESS - /// The operation started successfully - call \c psa_sign_hash_complete() - /// with the same context to complete the operation - /// + /// Success. /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does - /// not permit the requested algorithm. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// An operation has previously been started on this context, and is - /// still in progress. - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Decrypt a message using a symmetric cipher. + /// + /// This function decrypts a message encrypted with a symmetric cipher. + /// + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). + /// \param[in] input Buffer containing the message to decrypt. + /// This consists of the IV followed by the + /// ciphertext proper. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the plaintext is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_start( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt( key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, ) -> psa_status_t; } +/// The type of the state data structure for multipart cipher operations. +/// +/// Before calling any function on a cipher operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_cipher_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_cipher_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_CIPHER_OPERATION_INIT, +/// for example: +/// \code +/// psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_cipher_operation_init() +/// to the structure, for example: +/// \code +/// psa_cipher_operation_t operation; +/// operation = psa_cipher_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_cipher_operation_t = psa_cipher_operation_s; unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// signing a hash or short message with a private - /// key, in an interruptible manner. - /// - /// \see \c psa_sign_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_sign_hash_start() is equivalent to - /// \c psa_sign_hash() but this function can return - /// early and resume according to the limit set with - /// \c psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function call. + /// Set the key for a multipart symmetric encryption operation. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_sign_hash_abort() at any point if they no - /// longer want the result. + /// The sequence of operations to encrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_encrypt_setup() to specify the algorithm and key. + /// -# Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to + /// generate or set the IV (initialization vector). You should use + /// psa_cipher_generate_iv() unless the protocol you are implementing + /// requires a specific IV value. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_sign_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_encrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_sign_hash_start() called with it - /// first. + /// After a successful call to psa_cipher_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// - /// \param[out] signature Buffer where the signature is to be written. - /// \param signature_size Size of the \p signature buffer in bytes. This - /// must be appropriate for the selected - /// algorithm and key: - /// - The required signature size is - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c - /// key_bits, \c alg) where \c key_type and \c - /// key_bits are the type and bit-size - /// respectively of key. - /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the - /// maximum signature size of any supported - /// signature algorithm. - /// \param[out] signature_length On success, the number of bytes that make up - /// the returned signature value. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// Operation completed successfully - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p signature buffer is too small. You can - /// determine a sufficient buffer size by calling - /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) - /// where \c key_type and \c key_bits are the type and bit-size - /// respectively of \p key. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_sign_hash_start(). - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_sign_hash_start() with this operation object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_sign_hash_complete( - operation: *mut psa_sign_hash_interruptible_operation_t, - signature: *mut u8, - signature_size: usize, - signature_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// \brief Abort a sign hash operation. - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function is the only function that clears - /// the number of ops completed as part of the - /// operation. Please ensure you copy this value via - /// \c psa_sign_hash_get_num_ops() if required - /// before calling. - /// - /// \note Aborting an operation frees all associated - /// resources except for the \p operation structure - /// itself. Once aborted, the operation object can - /// be reused for another operation by calling \c - /// psa_sign_hash_start() again. - /// - /// \note You may call this function any time after the - /// operation object has been initialized. In - /// particular, calling \c psa_sign_hash_abort() - /// after the operation has already been terminated - /// by a call to \c psa_sign_hash_abort() or - /// psa_sign_hash_complete() is safe. - /// - /// \param[in,out] operation Initialized sign hash operation. - /// - /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_sign_hash_abort( - operation: *mut psa_sign_hash_interruptible_operation_t, + pub fn psa_cipher_encrypt_setup( + operation: *mut psa_cipher_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Start reading and verifying a hash or short - /// message, in an interruptible manner. - /// - /// \see \c psa_verify_hash_complete() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. - /// - /// \note This function combined with \c - /// psa_verify_hash_complete() is equivalent to - /// \c psa_verify_hash() but \c - /// psa_verify_hash_complete() can return early and - /// resume according to the limit set with \c - /// psa_interruptible_set_max_ops() to reduce the - /// maximum time spent in a function. + /// Set the key for a multipart symmetric decryption operation. /// - /// \note Users should call \c psa_verify_hash_complete() - /// repeatedly on the same operation object after a - /// successful call to this function until \c - /// psa_verify_hash_complete() either returns 0 or - /// an error. \c psa_verify_hash_complete() will - /// return #PSA_OPERATION_INCOMPLETE if there is - /// more work to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The sequence of operations to decrypt a message with a symmetric cipher + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_cipher_operation_t, e.g. + /// #PSA_CIPHER_OPERATION_INIT. + /// -# Call psa_cipher_decrypt_setup() to specify the algorithm and key. + /// -# Call psa_cipher_set_iv() with the IV (initialization vector) for the + /// decryption. If the IV is prepended to the ciphertext, you can call + /// psa_cipher_update() on a buffer containing the IV followed by the + /// beginning of the message. + /// -# Call psa_cipher_update() zero, one or more times, passing a fragment + /// of the message each time. + /// -# Call psa_cipher_finish(). /// - /// \note If this function returns an error status, the - /// operation enters an error state and must be - /// aborted by calling \c psa_verify_hash_abort(). + /// If an error occurs at any step after a call to psa_cipher_decrypt_setup(), + /// the operation will need to be reset by a call to psa_cipher_abort(). The + /// application may call psa_cipher_abort() at any time after the operation + /// has been initialized. /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first. + /// After a successful call to psa_cipher_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_cipher_finish(). + /// - A call to psa_cipher_abort(). /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_cipher_operation_t and not yet in use. /// \param key Identifier of the key to use for the operation. - /// The key must allow the usage - /// #PSA_KEY_USAGE_VERIFY_HASH. - /// \param alg A signature algorithm (\c PSA_ALG_XXX - /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) - /// is true), that is compatible with - /// the type of \p key. - /// \param[in] hash The hash whose signature is to be verified. - /// \param hash_length Size of the \p hash buffer in bytes. - /// \param[in] signature Buffer containing the signature to verify. - /// \param signature_length Size of the \p signature buffer in bytes. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The cipher algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_CIPHER(\p alg) is true). /// /// \retval #PSA_SUCCESS - /// The operation started successfully - please call \c - /// psa_verify_hash_complete() with the same context to complete the - /// operation. - /// - /// \retval #PSA_ERROR_BAD_STATE - /// Another operation has already been started on this context, and is - /// still in progress. - /// - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does - /// not permit the requested algorithm. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not a cipher algorithm. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_start( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_decrypt_setup( + operation: *mut psa_cipher_operation_t, key: mbedtls_svc_key_id_t, alg: psa_algorithm_t, - hash: *const u8, - hash_length: usize, - signature: *const u8, - signature_length: usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Continue and eventually complete the action of - /// reading and verifying a hash or short message - /// signed with a private key, in an interruptible - /// manner. - /// - /// \see \c psa_verify_hash_start() - /// - /// \warning This is a beta API, and thus subject to change - /// at any point. It is not bound by the usual - /// interface stability promises. + /// Generate an IV for a symmetric encryption operation. /// - /// \note This function combined with \c - /// psa_verify_hash_start() is equivalent to - /// \c psa_verify_hash() but this function can - /// return early and resume according to the limit - /// set with \c psa_interruptible_set_max_ops() to - /// reduce the maximum time spent in a function - /// call. + /// This function generates a random IV (initialization vector), nonce + /// or initial counter value for the encryption operation as appropriate + /// for the chosen algorithm, key type and key size. /// - /// \note Users should call this function on the same - /// operation object repeatedly until it either - /// returns 0 or an error. This function will return - /// #PSA_OPERATION_INCOMPLETE if there is more work - /// to do. Alternatively users can call - /// \c psa_verify_hash_abort() at any point if they - /// no longer want the result. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note When this function returns successfully, the - /// operation becomes inactive. If this function - /// returns an error status, the operation enters an - /// error state and must be aborted by calling - /// \c psa_verify_hash_abort(). + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t - /// to use. This must be initialized first, and have - /// had \c psa_verify_hash_start() called with it - /// first. + /// \param[in,out] operation Active cipher operation. + /// \param[out] iv Buffer where the generated IV is to be written. + /// \param iv_size Size of the \p iv buffer in bytes. + /// \param[out] iv_length On success, the number of bytes of the + /// generated IV. /// /// \retval #PSA_SUCCESS - /// Operation completed successfully, and the passed signature is valid. - /// - /// \retval #PSA_OPERATION_INCOMPLETE - /// Operation was interrupted due to the setting of \c - /// psa_interruptible_set_max_ops(). There is still work to be done. - /// Call this function again with the same operation object. - /// - /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The calculation was performed successfully, but the passed - /// signature is not a valid signature. - /// \retval #PSA_ERROR_BAD_STATE - /// An operation was not previously started on this context via - /// \c psa_verify_hash_start(). - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p iv buffer is too small. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has either not been previously initialized by - /// psa_crypto_init() or you did not previously call - /// psa_verify_hash_start() on this object. It is - /// implementation-dependent whether a failure to initialize results in - /// this error code. - pub fn psa_verify_hash_complete( - operation: *mut psa_verify_hash_interruptible_operation_t, + /// The operation state is not valid (it must be active, with no IV set), + /// or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_generate_iv( + operation: *mut psa_cipher_operation_t, + iv: *mut u8, + iv_size: usize, + iv_length: *mut usize, ) -> psa_status_t; } unsafe extern "C" { - /// \brief Abort a verify hash operation. + /// Set the IV for a symmetric encryption or decryption operation. /// - /// \warning This is a beta API, and thus subject to change at - /// any point. It is not bound by the usual interface - /// stability promises. + /// This function sets the IV (initialization vector), nonce + /// or initial counter value for the encryption or decryption operation. /// - /// \note This function is the only function that clears the - /// number of ops completed as part of the operation. - /// Please ensure you copy this value via - /// \c psa_verify_hash_get_num_ops() if required - /// before calling. + /// The application must call psa_cipher_encrypt_setup() before + /// calling this function. /// - /// \note Aborting an operation frees all associated - /// resources except for the operation structure - /// itself. Once aborted, the operation object can be - /// reused for another operation by calling \c - /// psa_verify_hash_start() again. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \note You may call this function any time after the - /// operation object has been initialized. - /// In particular, calling \c psa_verify_hash_abort() - /// after the operation has already been terminated by - /// a call to \c psa_verify_hash_abort() or - /// psa_verify_hash_complete() is safe. + /// \note When encrypting, applications should use psa_cipher_generate_iv() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \param[in,out] operation Initialized verify hash operation. + /// \param[in,out] operation Active cipher operation. + /// \param[in] iv Buffer containing the IV to use. + /// \param iv_length Size of the IV in bytes. /// /// \retval #PSA_SUCCESS - /// The operation was aborted successfully. - /// - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p iv is not acceptable for the chosen algorithm, + /// or the chosen algorithm does not use an IV. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The operation state is not valid (it must be an active cipher + /// encrypt operation, with no IV set), or the library has not been + /// previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_verify_hash_abort( - operation: *mut psa_verify_hash_interruptible_operation_t, + pub fn psa_cipher_set_iv( + operation: *mut psa_cipher_operation_t, + iv: *const u8, + iv_length: usize, ) -> psa_status_t; } -/// \brief The GCM context structure. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_gcm_context { - ///< The cipher context used. - pub private_cipher_ctx: mbedtls_cipher_context_t, - ///< Precalculated HTable low. - pub private_HL: [u64; 16usize], - ///< Precalculated HTable high. - pub private_HH: [u64; 16usize], - ///< The total length of the encrypted data. - pub private_len: u64, - ///< The total length of the additional data. - pub private_add_len: u64, - ///< The first ECTR for tag. - pub private_base_ectr: [::core::ffi::c_uchar; 16usize], - ///< The Y working value. - pub private_y: [::core::ffi::c_uchar; 16usize], - ///< The buf working value. - pub private_buf: [::core::ffi::c_uchar; 16usize], - ///< The operation to perform: - ///#MBEDTLS_GCM_ENCRYPT or - ///#MBEDTLS_GCM_DECRYPT. - pub private_mode: ::core::ffi::c_int, -} -impl Default for mbedtls_gcm_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { - /// \brief This function initializes the specified GCM context, - /// to make references valid, and prepares the context - /// for mbedtls_gcm_setkey() or mbedtls_gcm_free(). + /// Encrypt or decrypt a message fragment in an active cipher operation. /// - /// The function does not bind the GCM context to a particular - /// cipher, nor set the key. For this purpose, use - /// mbedtls_gcm_setkey(). + /// Before calling this function, you must: + /// 1. Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. If the algorithm requires an IV, call psa_cipher_generate_iv() + /// (recommended when encrypting) or psa_cipher_set_iv(). /// - /// \param ctx The GCM context to initialize. This must not be \c NULL. - pub fn mbedtls_gcm_init(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief This function associates a GCM context with a - /// cipher algorithm and a key. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param cipher The 128-bit block cipher to use. - /// \param key The encryption key. This must be a readable buffer of at - /// least \p keybits bits. - /// \param keybits The key size in bits. Valid options are: - ///
          • 128 bits
            • - ///
          • 192 bits
            • - ///
          • 256 bits
          + /// \param[in,out] operation Active cipher operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A cipher-specific error code on failure. - pub fn mbedtls_gcm_setkey( - ctx: *mut mbedtls_gcm_context, - cipher: mbedtls_cipher_id_t, - key: *const ::core::ffi::c_uchar, - keybits: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_update( + operation: *mut psa_cipher_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs GCM encryption or decryption of a buffer. + /// Finish encrypting or decrypting a message in a cipher operation. /// - /// \note For encryption, the output buffer can be the same as the - /// input buffer. For decryption, the output buffer cannot be - /// the same as input buffer. If the buffers overlap, the output - /// buffer must trail at least 8 Bytes behind the input buffer. + /// The application must call psa_cipher_encrypt_setup() or + /// psa_cipher_decrypt_setup() before calling this function. The choice + /// of setup function determines whether this function encrypts or + /// decrypts its input. /// - /// \warning When this function performs a decryption, it outputs the - /// authentication tag and does not verify that the data is - /// authentic. You should use this function to perform encryption - /// only. For decryption, use mbedtls_gcm_auth_decrypt() instead. + /// This function finishes the encryption or decryption of the message + /// formed by concatenating the inputs passed to preceding calls to + /// psa_cipher_update(). /// - /// \param ctx The GCM context to use for encryption or decryption. This - /// must be initialized. - /// \param mode The operation to perform: - /// - #MBEDTLS_GCM_ENCRYPT to perform authenticated encryption. - /// The ciphertext is written to \p output and the - /// authentication tag is written to \p tag. - /// - #MBEDTLS_GCM_DECRYPT to perform decryption. - /// The plaintext is written to \p output and the - /// authentication tag is written to \p tag. - /// Note that this mode is not recommended, because it does - /// not verify the authenticity of the data. For this reason, - /// you should use mbedtls_gcm_auth_decrypt() instead of - /// calling this function in decryption mode. - /// \param length The length of the input data, which is equal to the length - /// of the output data. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param input The buffer holding the input data. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size in Bytes. - /// \param output The buffer for holding the output data. If \p length is greater - /// than zero, this must be a writable buffer of at least that - /// size in Bytes. - /// \param tag_len The length of the tag to generate. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_cipher_abort(). /// - /// \return \c 0 if the encryption or decryption was performed - /// successfully. Note that in #MBEDTLS_GCM_DECRYPT mode, - /// this does not indicate that the data is authentic. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the encryption - /// or decryption failed. - pub fn mbedtls_gcm_crypt_and_tag( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - tag_len: usize, - tag: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active cipher operation. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input size passed to this operation is not valid for + /// this particular algorithm. For example, the algorithm is a based + /// on block cipher and requires a whole number of blocks, but the + /// total input size is not a multiple of the block size. + /// \retval #PSA_ERROR_INVALID_PADDING + /// This is a decryption operation for an algorithm that includes + /// padding, and the ciphertext does not contain valid padding. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with an IV set + /// if required for the algorithm), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_finish( + operation: *mut psa_cipher_operation_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function performs a GCM authenticated decryption of a - /// buffer. + /// Abort a cipher operation. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again. /// - /// \param ctx The GCM context. This must be initialized. - /// \param length The length of the ciphertext to decrypt, which is also - /// the length of the decrypted plaintext. - /// \param iv The initialization vector. This must be a readable buffer - /// of at least \p iv_len Bytes. - /// \param iv_len The length of the IV. - /// \param add The buffer holding the additional data. This must be of at - /// least that size in Bytes. - /// \param add_len The length of the additional data. - /// \param tag The buffer holding the tag to verify. This must be a - /// readable buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to verify. - /// \param input The buffer holding the ciphertext. If \p length is greater - /// than zero, this must be a readable buffer of at least that - /// size. - /// \param output The buffer for holding the decrypted plaintext. If \p length - /// is greater than zero, this must be a writable buffer of at - /// least that size. + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_cipher_operation_t. /// - /// \return \c 0 if successful and authenticated. - /// \return #MBEDTLS_ERR_GCM_AUTH_FAILED if the tag does not match. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT if the lengths or pointers are - /// not valid or a cipher-specific error code if the decryption - /// failed. - pub fn mbedtls_gcm_auth_decrypt( - ctx: *mut mbedtls_gcm_context, - length: usize, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - add: *const ::core::ffi::c_uchar, - add_len: usize, - tag: *const ::core::ffi::c_uchar, - tag_len: usize, - input: *const ::core::ffi::c_uchar, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// In particular, calling psa_cipher_abort() after the operation has been + /// terminated by a call to psa_cipher_abort() or psa_cipher_finish() + /// is safe and has no effect. + /// + /// \param[in,out] operation Initialized cipher operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_cipher_abort(operation: *mut psa_cipher_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a GCM encryption or decryption - /// operation. + /// Process an authenticated encryption operation. /// - /// \param ctx The GCM context. This must be initialized. - /// \param mode The operation to perform: #MBEDTLS_GCM_ENCRYPT or - /// #MBEDTLS_GCM_DECRYPT. - /// \param iv The initialization vector. This must be a readable buffer of - /// at least \p iv_len Bytes. - /// \param iv_len The length of the IV. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that will be authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] plaintext Data that will be authenticated and + /// encrypted. + /// \param plaintext_length Size of \p plaintext in bytes. + /// \param[out] ciphertext Output buffer for the authenticated and + /// encrypted data. The additional data is not + /// part of this output. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate outputs, the + /// authentication tag is appended to the + /// encrypted data. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p plaintext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p + /// plaintext_length) evaluates to the maximum + /// ciphertext size of any supported AEAD + /// encryption. + /// \param[out] ciphertext_length On success, the size of the output + /// in the \p ciphertext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_starts( - ctx: *mut mbedtls_gcm_context, - mode: ::core::ffi::c_int, - iv: *const ::core::ffi::c_uchar, - iv_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p ciphertext_size is too small. + /// #PSA_AEAD_ENCRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p plaintext_length) or + /// #PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(\p plaintext_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + plaintext: *const u8, + plaintext_length: usize, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer as associated data - /// (authenticated but not encrypted data) in a GCM - /// encryption or decryption operation. - /// - /// Call this function after mbedtls_gcm_starts() to pass - /// the associated data. If the associated data is empty, - /// you do not need to call this function. You may not - /// call this function after calling mbedtls_cipher_update(). + /// Process an authenticated decryption operation. /// - /// \param ctx The GCM context. This must have been started with - /// mbedtls_gcm_starts() and must not have yet received - /// any input with mbedtls_gcm_update(). - /// \param add The buffer holding the additional data, or \c NULL - /// if \p add_len is \c 0. - /// \param add_len The length of the additional data. If \c 0, - /// \p add may be \c NULL. + /// \param key Identifier of the key to use for the + /// operation. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). + /// \param[in] nonce Nonce or IV to use. + /// \param nonce_length Size of the \p nonce buffer in bytes. + /// \param[in] additional_data Additional data that has been authenticated + /// but not encrypted. + /// \param additional_data_length Size of \p additional_data in bytes. + /// \param[in] ciphertext Data that has been authenticated and + /// encrypted. For algorithms where the + /// encrypted data and the authentication tag + /// are defined as separate inputs, the buffer + /// must contain the encrypted data followed + /// by the authentication tag. + /// \param ciphertext_length Size of \p ciphertext in bytes. + /// \param[out] plaintext Output buffer for the decrypted data. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, + /// \p alg, \p ciphertext_length) where + /// \c key_type is the type of \p key. + /// - #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p + /// ciphertext_length) evaluates to the maximum + /// plaintext size of any supported AEAD + /// decryption. + /// \param[out] plaintext_length On success, the size of the output + /// in the \p plaintext buffer. /// - /// \return \c 0 on success. - pub fn mbedtls_gcm_update_ad( - ctx: *mut mbedtls_gcm_context, - add: *const ::core::ffi::c_uchar, - add_len: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The ciphertext is not authentic. + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p plaintext_size is too small. + /// #PSA_AEAD_DECRYPT_OUTPUT_SIZE(\c key_type, \p alg, + /// \p ciphertext_length) or + /// #PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(\p ciphertext_length) can be used + /// to determine the required buffer size. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + nonce: *const u8, + nonce_length: usize, + additional_data: *const u8, + additional_data_length: usize, + ciphertext: *const u8, + ciphertext_length: usize, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for multipart AEAD operations. +/// +/// Before calling any function on an AEAD operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_aead_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_aead_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_AEAD_OPERATION_INIT, +/// for example: +/// \code +/// psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_aead_operation_init() +/// to the structure, for example: +/// \code +/// psa_aead_operation_t operation; +/// operation = psa_aead_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_aead_operation_t = psa_aead_operation_s; unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing GCM - /// encryption or decryption operation. - /// - /// You may call this function zero, one or more times - /// to pass successive parts of the input: the plaintext to - /// encrypt, or the ciphertext (not including the tag) to - /// decrypt. After the last part of the input, call - /// mbedtls_gcm_finish(). + /// Set the key for a multipart authenticated encryption operation. /// - /// This function may produce output in one of the following - /// ways: - /// - Immediate output: the output length is always equal - /// to the input length. - /// - Buffered output: the output consists of a whole number - /// of 16-byte blocks. If the total input length so far - /// (not including associated data) is 16 \* *B* + *A* - /// with *A* < 16 then the total output length is 16 \* *B*. + /// The sequence of operations to encrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_encrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to + /// generate or set the nonce. You should use + /// psa_aead_generate_nonce() unless the protocol you are implementing + /// requires a specific nonce value. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the message to encrypt each time. + /// -# Call psa_aead_finish(). /// - /// In particular: - /// - It is always correct to call this function with - /// \p output_size >= \p input_length + 15. - /// - If \p input_length is a multiple of 16 for all the calls - /// to this function during an operation, then it is - /// correct to use \p output_size = \p input_length. + /// If an error occurs at any step after a call to psa_aead_encrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \note For decryption, the output buffer cannot be the same as - /// input buffer. If the buffers overlap, the output buffer - /// must trail at least 8 Bytes behind the input buffer. + /// After a successful call to psa_aead_encrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_finish(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param input The buffer holding the input data. If \p input_length - /// is greater than zero, this must be a readable buffer - /// of at least \p input_length bytes. - /// \param input_length The length of the input data in bytes. - /// \param output The buffer for the output data. If \p output_size - /// is greater than zero, this must be a writable buffer of - /// of at least \p output_size bytes. - /// \param output_size The size of the output buffer in bytes. - /// See the function description regarding the output size. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// total input length too long, - /// unsupported input/output buffer overlap detected, - /// or \p output_size too small. - pub fn mbedtls_gcm_update( - ctx: *mut mbedtls_gcm_context, - input: *const ::core::ffi::c_uchar, - input_length: usize, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_encrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the GCM operation and generates - /// the authentication tag. + /// Set the key for a multipart authenticated decryption operation. /// - /// It wraps up the GCM stream, and generates the - /// tag. The tag can have a maximum length of 16 Bytes. + /// The sequence of operations to decrypt a message with authentication + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_aead_operation_t, e.g. + /// #PSA_AEAD_OPERATION_INIT. + /// -# Call psa_aead_decrypt_setup() to specify the algorithm and key. + /// -# If needed, call psa_aead_set_lengths() to specify the length of the + /// inputs to the subsequent calls to psa_aead_update_ad() and + /// psa_aead_update(). See the documentation of psa_aead_set_lengths() + /// for details. + /// -# Call psa_aead_set_nonce() with the nonce for the decryption. + /// -# Call psa_aead_update_ad() zero, one or more times, passing a fragment + /// of the non-encrypted additional authenticated data each time. + /// -# Call psa_aead_update() zero, one or more times, passing a fragment + /// of the ciphertext to decrypt each time. + /// -# Call psa_aead_verify(). /// - /// \param ctx The GCM context. This must be initialized. - /// \param tag The buffer for holding the tag. This must be a writable - /// buffer of at least \p tag_len Bytes. - /// \param tag_len The length of the tag to generate. This must be at least - /// four. - /// \param output The buffer for the final output. - /// If \p output_size is nonzero, this must be a writable - /// buffer of at least \p output_size bytes. - /// \param output_size The size of the \p output buffer in bytes. - /// This must be large enough for the output that - /// mbedtls_gcm_update() has not produced. In particular: - /// - If mbedtls_gcm_update() produces immediate output, - /// or if the total input size is a multiple of \c 16, - /// then mbedtls_gcm_finish() never produces any output, - /// so \p output_size can be \c 0. - /// - \p output_size never needs to be more than \c 15. - /// \param output_length On success, \p *output_length contains the actual - /// length of the output written in \p output. - /// On failure, the content of \p *output_length is - /// unspecified. + /// If an error occurs at any step after a call to psa_aead_decrypt_setup(), + /// the operation will need to be reset by a call to psa_aead_abort(). The + /// application may call psa_aead_abort() at any time after the operation + /// has been initialized. /// - /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_GCM_BAD_INPUT on failure: - /// invalid value of \p tag_len, - /// or \p output_size too small. - pub fn mbedtls_gcm_finish( - ctx: *mut mbedtls_gcm_context, - output: *mut ::core::ffi::c_uchar, - output_size: usize, - output_length: *mut usize, - tag: *mut ::core::ffi::c_uchar, - tag_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function clears a GCM context and the underlying - /// cipher sub-context. + /// After a successful call to psa_aead_decrypt_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A successful call to psa_aead_verify(). + /// - A call to psa_aead_abort(). /// - /// \param ctx The GCM context to clear. If this is \c NULL, the call has - /// no effect. Otherwise, this must be initialized. - pub fn mbedtls_gcm_free(ctx: *mut mbedtls_gcm_context); -} -unsafe extern "C" { - /// \brief The GCM checkup routine. + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized as per the documentation for + /// #psa_aead_operation_t and not yet in use. + /// \param key Identifier of the key to use for the operation. + /// It must remain valid until the operation + /// terminates. It must allow the usage + /// #PSA_KEY_USAGE_DECRYPT. + /// \param alg The AEAD algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_AEAD(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_gcm_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_DECRYPT: psa_encrypt_or_decrypt_t = 0; -pub const psa_encrypt_or_decrypt_t_PSA_CRYPTO_DRIVER_ENCRYPT: psa_encrypt_or_decrypt_t = 1; -/// For encrypt-decrypt functions, whether the operation is an encryption -/// or a decryption. -pub type psa_encrypt_or_decrypt_t = ::core::ffi::c_uint; -/// \brief MD5 context structure -/// -/// \warning MD5 is considered a weak message digest and its use -/// constitutes a security risk. We recommend considering -/// stronger message digests instead. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_md5_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 4usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_md5_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not compatible with \p alg. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not supported or is not an AEAD algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_decrypt_setup( + operation: *mut psa_aead_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize MD5 context + /// Generate a random nonce for an authenticated encryption operation. /// - /// \param ctx MD5 context to be initialized + /// This function generates a random nonce for the authenticated encryption + /// operation with an appropriate size for the chosen algorithm, key type + /// and key size. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_init(ctx: *mut mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief Clear MD5 context + /// The application must call psa_aead_encrypt_setup() before + /// calling this function. /// - /// \param ctx MD5 context to be cleared + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_free(ctx: *mut mbedtls_md5_context); + /// \param[in,out] operation Active AEAD operation. + /// \param[out] nonce Buffer where the generated nonce is to be + /// written. + /// \param nonce_size Size of the \p nonce buffer in bytes. + /// \param[out] nonce_length On success, the number of bytes of the + /// generated nonce. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p nonce buffer is too small. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active aead encrypt + /// operation, with no nonce set), or the library has not been + /// previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_generate_nonce( + operation: *mut psa_aead_operation_t, + nonce: *mut u8, + nonce_size: usize, + nonce_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) an MD5 context + /// Set the nonce for an authenticated encryption or decryption operation. /// - /// \param dst The destination context - /// \param src The context to be cloned + /// This function sets the nonce for the authenticated + /// encryption or decryption operation. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_clone(dst: *mut mbedtls_md5_context, src: *const mbedtls_md5_context); -} -unsafe extern "C" { - /// \brief MD5 context setup + /// The application must call psa_aead_encrypt_setup() or + /// psa_aead_decrypt_setup() before calling this function. /// - /// \param ctx context to be initialized + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \note When encrypting, applications should use psa_aead_generate_nonce() + /// instead of this function, unless implementing a protocol that requires + /// a non-random IV. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_starts(ctx: *mut mbedtls_md5_context) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] nonce Buffer containing the nonce to use. + /// \param nonce_length Size of the nonce in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The size of \p nonce is not acceptable for the chosen algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, with no nonce + /// set), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_nonce( + operation: *mut psa_aead_operation_t, + nonce: *const u8, + nonce_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process buffer + /// Declare the lengths of the message and additional data for AEAD. /// - /// \param ctx MD5 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// The application must call this function before calling + /// psa_aead_update_ad() or psa_aead_update() if the algorithm for + /// the operation requires it. If the algorithm does not require it, + /// calling this function is optional, but if this function is called + /// then the implementation must enforce the lengths. /// - /// \return 0 if successful + /// You may call this function before or after setting the nonce with + /// psa_aead_set_nonce() or psa_aead_generate_nonce(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_update( - ctx: *mut mbedtls_md5_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief MD5 final digest + /// - For #PSA_ALG_CCM, calling this function is required. + /// - For the other AEAD algorithms defined in this specification, calling + /// this function is not required. + /// - For vendor-defined algorithm, refer to the vendor documentation. /// - /// \param ctx MD5 context - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \param[in,out] operation Active AEAD operation. + /// \param ad_length Size of the non-encrypted additional + /// authenticated data in bytes. + /// \param plaintext_length Size of the plaintext to encrypt in bytes. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_finish( - ctx: *mut mbedtls_md5_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// At least one of the lengths is not acceptable for the chosen + /// algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and + /// psa_aead_update_ad() and psa_aead_update() must not have been + /// called yet), or the library has not been previously initialized + /// by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_set_lengths( + operation: *mut psa_aead_operation_t, + ad_length: usize, + plaintext_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief MD5 process data block (internal use only) + /// Pass additional data to an active AEAD operation. /// - /// \param ctx MD5 context - /// \param data buffer holding one block of data + /// Additional data is authenticated, but not encrypted. /// - /// \return 0 if successful + /// You may call this function multiple times to pass successive fragments + /// of the additional data. You may not call this function after passing + /// data to encrypt or decrypt with psa_aead_update(). /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_internal_md5_process( - ctx: *mut mbedtls_md5_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = MD5( input buffer ) + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output MD5 checksum result + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS, + /// treat the input as untrusted and prepare to undo any action that + /// depends on the input if psa_aead_verify() returns an error status. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the fragment of + /// additional data. + /// \param input_length Size of the \p input buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total input length overflows the additional data length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, have lengths set if required by the algorithm, and + /// psa_aead_update() must not have been called yet), or the library + /// has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update_ad( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Encrypt or decrypt a message fragment in an active AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed + /// Before calling this function, you must: + /// 1. Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). + /// The choice of setup function determines whether this function + /// encrypts or decrypts its input. + /// 2. Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce(). + /// 3. Call psa_aead_update_ad() to pass all the additional data. /// - /// \warning MD5 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. - pub fn mbedtls_md5_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -/// \brief RIPEMD-160 context structure -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ripemd160_context { - ///< number of bytes processed - pub private_total: [u32; 2usize], - ///< intermediate digest state - pub private_state: [u32; 5usize], - ///< data block being processed - pub private_buffer: [::core::ffi::c_uchar; 64usize], -} -impl Default for mbedtls_ripemd160_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize RIPEMD-160 context + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \param ctx RIPEMD-160 context to be initialized - pub fn mbedtls_ripemd160_init(ctx: *mut mbedtls_ripemd160_context); -} -unsafe extern "C" { - /// \brief Clear RIPEMD-160 context + /// \warning When decrypting, until psa_aead_verify() has returned #PSA_SUCCESS, + /// there is no guarantee that the input is valid. Therefore, until + /// you have called psa_aead_verify() and it has returned #PSA_SUCCESS: + /// - Do not use the output in any way other than storing it in a + /// confidential location. If you take any action that depends + /// on the tentative decrypted data, this action will need to be + /// undone if the input turns out not to be valid. Furthermore, + /// if an adversary can observe that this action took place + /// (for example through timing), they may be able to use this + /// fact as an oracle to decrypt any message encrypted with the + /// same key. + /// - In particular, do not copy the output anywhere but to a + /// memory or storage space that you have exclusive access to. /// - /// \param ctx RIPEMD-160 context to be cleared - pub fn mbedtls_ripemd160_free(ctx: *mut mbedtls_ripemd160_context); + /// This function does not require the input to be aligned to any + /// particular block boundary. If the implementation can only process + /// a whole block at a time, it must consume all the input provided, but + /// it may delay the end of the corresponding output until a subsequent + /// call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() + /// provides sufficient input. The amount of data that can be delayed + /// in this way is bounded by #PSA_AEAD_UPDATE_OUTPUT_SIZE. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[in] input Buffer containing the message fragment to + /// encrypt or decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[out] output Buffer where the output is to be written. + /// \param output_size Size of the \p output buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, + /// \c alg, \p input_length) where + /// \c key_type is the type of key and \c alg is + /// the algorithm that were used to set up the + /// operation. + /// - #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p + /// input_length) evaluates to the maximum + /// output size of any supported AEAD + /// algorithm. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// #PSA_AEAD_UPDATE_OUTPUT_SIZE(\c key_type, \c alg, \p input_length) or + /// #PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(\p input_length) can be used to + /// determine the required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total input length overflows the plaintext length that + /// was previously specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, have a nonce + /// set, and have lengths set if required by the algorithm), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_update( + operation: *mut psa_aead_operation_t, + input: *const u8, + input_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Clone (the state of) a RIPEMD-160 context + /// Finish encrypting a message in an AEAD operation. /// - /// \param dst The destination context - /// \param src The context to be cloned - pub fn mbedtls_ripemd160_clone( - dst: *mut mbedtls_ripemd160_context, - src: *const mbedtls_ripemd160_context, - ); -} -unsafe extern "C" { - /// \brief RIPEMD-160 context setup + /// The operation must have been set up with psa_aead_encrypt_setup(). /// - /// \param ctx context to be initialized + /// This function finishes the authentication of the additional data + /// formed by concatenating the inputs passed to preceding calls to + /// psa_aead_update_ad() with the plaintext formed by concatenating the + /// inputs passed to preceding calls to psa_aead_update(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_starts(ctx: *mut mbedtls_ripemd160_context) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process buffer + /// This function has two output buffers: + /// - \p ciphertext contains trailing ciphertext that was buffered from + /// preceding calls to psa_aead_update(). + /// - \p tag contains the authentication tag. /// - /// \param ctx RIPEMD-160 context - /// \param input buffer holding the data - /// \param ilen length of the input data + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_update( - ctx: *mut mbedtls_ripemd160_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation Active AEAD operation. + /// \param[out] ciphertext Buffer where the last part of the ciphertext + /// is to be written. + /// \param ciphertext_size Size of the \p ciphertext buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] ciphertext_length On success, the number of bytes of + /// returned ciphertext. + /// \param[out] tag Buffer where the authentication tag is + /// to be written. + /// \param tag_size Size of the \p tag buffer in bytes. + /// This must be appropriate for the selected + /// algorithm and key: + /// - The exact tag size is #PSA_AEAD_TAG_LENGTH(\c + /// key_type, \c key_bits, \c alg) where + /// \c key_type and \c key_bits are the type and + /// bit-size of the key, and \c alg is the + /// algorithm that were used in the call to + /// psa_aead_encrypt_setup(). + /// - #PSA_AEAD_TAG_MAX_SIZE evaluates to the + /// maximum tag size of any supported AEAD + /// algorithm. + /// \param[out] tag_length On success, the number of bytes + /// that make up the returned tag. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p ciphertext or \p tag buffer is too small. + /// #PSA_AEAD_FINISH_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_FINISH_OUTPUT_MAX_SIZE can be used to determine the + /// required \p ciphertext buffer size. #PSA_AEAD_TAG_LENGTH(\c key_type, + /// \c key_bits, \c alg) or #PSA_AEAD_TAG_MAX_SIZE can be used to + /// determine the required \p tag buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active encryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_finish( + operation: *mut psa_aead_operation_t, + ciphertext: *mut u8, + ciphertext_size: usize, + ciphertext_length: *mut usize, + tag: *mut u8, + tag_size: usize, + tag_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief RIPEMD-160 final digest + /// Finish authenticating and decrypting a message in an AEAD operation. /// - /// \param ctx RIPEMD-160 context - /// \param output RIPEMD-160 checksum result + /// The operation must have been set up with psa_aead_decrypt_setup(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160_finish( - ctx: *mut mbedtls_ripemd160_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief RIPEMD-160 process data block (internal use only) + /// This function finishes the authenticated decryption of the message + /// components: /// - /// \param ctx RIPEMD-160 context - /// \param data buffer holding one block of data + /// - The additional data consisting of the concatenation of the inputs + /// passed to preceding calls to psa_aead_update_ad(). + /// - The ciphertext consisting of the concatenation of the inputs passed to + /// preceding calls to psa_aead_update(). + /// - The tag passed to this function call. /// - /// \return 0 if successful - pub fn mbedtls_internal_ripemd160_process( - ctx: *mut mbedtls_ripemd160_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Output = RIPEMD-160( input buffer ) + /// If the authentication tag is correct, this function outputs any remaining + /// plaintext and reports success. If the authentication tag is not correct, + /// this function returns #PSA_ERROR_INVALID_SIGNATURE. /// - /// \param input buffer holding the data - /// \param ilen length of the input data - /// \param output RIPEMD-160 checksum result + /// When this function returns successfully, the operation becomes inactive. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_aead_abort(). /// - /// \return 0 if successful - pub fn mbedtls_ripemd160( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \note Implementations shall make the best effort to ensure that the + /// comparison between the actual tag and the expected tag is performed + /// in constant time. + /// + /// \param[in,out] operation Active AEAD operation. + /// \param[out] plaintext Buffer where the last part of the plaintext + /// is to be written. This is the remaining data + /// from previous calls to psa_aead_update() + /// that could not be processed until the end + /// of the input. + /// \param plaintext_size Size of the \p plaintext buffer in bytes. + /// This must be appropriate for the selected algorithm and key: + /// - A sufficient output size is + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, + /// \c alg) where \c key_type is the type of key + /// and \c alg is the algorithm that were used to + /// set up the operation. + /// - #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE evaluates to + /// the maximum output size of any supported AEAD + /// algorithm. + /// \param[out] plaintext_length On success, the number of bytes of + /// returned plaintext. + /// \param[in] tag Buffer containing the authentication tag. + /// \param tag_length Size of the \p tag buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculations were successful, but the authentication tag is + /// not correct. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p plaintext buffer is too small. + /// #PSA_AEAD_VERIFY_OUTPUT_SIZE(\c key_type, \c alg) or + /// #PSA_AEAD_VERIFY_OUTPUT_MAX_SIZE can be used to determine the + /// required buffer size. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The total length of input to psa_aead_update_ad() so far is + /// less than the additional data length that was previously + /// specified with psa_aead_set_lengths(), or + /// the total length of input to psa_aead_update() so far is + /// less than the plaintext length that was previously + /// specified with psa_aead_set_lengths(). + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be an active decryption + /// operation with a nonce set), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_verify( + operation: *mut psa_aead_operation_t, + plaintext: *mut u8, + plaintext_size: usize, + plaintext_length: *mut usize, + tag: *const u8, + tag_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// Abort an AEAD operation. /// - /// \return 0 if successful, or 1 if the test failed - pub fn mbedtls_ripemd160_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha1_context { - pub work_area: [::core::ffi::c_uchar; 208usize], -} -impl Default for mbedtls_sha1_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// Aborting an operation frees all associated resources except for the + /// \p operation structure itself. Once aborted, the operation object + /// can be reused for another operation by calling + /// psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again. + /// + /// You may call this function any time after the operation object has + /// been initialized as described in #psa_aead_operation_t. + /// + /// In particular, calling psa_aead_abort() after the operation has been + /// terminated by a call to psa_aead_abort(), psa_aead_finish() or + /// psa_aead_verify() is safe and has no effect. + /// + /// \param[in,out] operation Initialized AEAD operation. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_aead_abort(operation: *mut psa_aead_operation_t) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-1 context. - /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \brief Sign a message with a private key. For hash-and-sign algorithms, + /// this includes the hashing step. /// - /// \param ctx The SHA-1 context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_sha1_init(ctx: *mut mbedtls_sha1_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-1 context. + /// \note To perform a multi-part hash-and-sign signature algorithm, first use + /// a multi-part hash operation and then pass the resulting hash to + /// psa_sign_hash(). PSA_ALG_GET_HASH(\p alg) can be used to determine the + /// hash algorithm to use. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in] key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The input message to sign. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param[in] signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and + /// bit-size respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. /// - /// \param ctx The SHA-1 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it is - /// not \c NULL, it must point to an initialized - /// SHA-1 context. - pub fn mbedtls_sha1_free(ctx: *mut mbedtls_sha1_context); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-1 context. + /// \brief Verify the signature of a message with a public key, using + /// a hash-and-sign verification algorithm. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \note To perform a multi-part hash-and-sign signature verification + /// algorithm, first use a multi-part hash operation to hash the message + /// and then pass the resulting hash to psa_verify_hash(). + /// PSA_ALG_GET_HASH(\p alg) can be used to determine the hash algorithm + /// to use. /// - /// \param dst The SHA-1 context to clone to. This must be initialized. - /// \param src The SHA-1 context to clone from. This must be initialized. - pub fn mbedtls_sha1_clone(dst: *mut mbedtls_sha1_context, src: *const mbedtls_sha1_context); + /// \param[in] key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_MESSAGE. + /// \param[in] alg An asymmetric signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_MESSAGE(\p alg) + /// is true), that is compatible with the type of + /// \p key. + /// \param[in] input The message whose signature is to be verified. + /// \param[in] input_length Size of the \p input buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param[in] signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_MESSAGE flag, + /// or it does not permit the requested algorithm. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed signature + /// is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_message( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-1 checksum calculation. + /// \brief Sign a hash or short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context to initialize. This must be initialized. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. + /// \param[out] signature_length On success, the number of bytes + /// that make up the returned signature value. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_starts(ctx: *mut mbedtls_sha1_context) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing SHA-1 - /// checksum calculation. + /// \brief Verify the signature of a hash or short message using a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// Note that to perform a hash-and-sign signature algorithm, you must + /// first calculate the hash by calling psa_hash_setup(), psa_hash_update() + /// and psa_hash_finish(), or alternatively by calling psa_hash_compute(). + /// Then pass the resulting hash as the \p hash + /// parameter to this function. You can use #PSA_ALG_SIGN_GET_HASH(\p alg) + /// to determine the hash algorithm to use. /// - /// \param ctx The SHA-1 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. + /// \param key Identifier of the key to use for the operation. It + /// must be a public key or an asymmetric key pair. The + /// key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message whose signature is to be + /// verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_update( - ctx: *mut mbedtls_sha1_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// The signature is valid. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function finishes the SHA-1 operation, and writes - /// the result to the output buffer. + /// \brief Encrypt a short message with a public key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be a public key or an asymmetric key + /// pair. It must allow the usage + /// #PSA_KEY_USAGE_ENCRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to encrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized and - /// have a hash operation started. - /// \param output The SHA-1 checksum result. This must be a writable - /// buffer of length \c 20 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the encrypted message is to + /// be written. + /// \param output_size Size of the \p output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1_finish( - ctx: *mut mbedtls_sha1_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_encrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief SHA-1 process data block (internal use only). + /// \brief Decrypt a short message with a private key. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. It must + /// allow the usage #PSA_KEY_USAGE_DECRYPT. + /// \param alg An asymmetric encryption algorithm that is + /// compatible with the type of \p key. + /// \param[in] input The message to decrypt. + /// \param input_length Size of the \p input buffer in bytes. + /// \param[in] salt A salt or label, if supported by the + /// encryption algorithm. + /// If the algorithm does not support a + /// salt, pass \c NULL. + /// If the algorithm supports an optional + /// salt and you do not want to pass a salt, + /// pass \c NULL. /// - /// \param ctx The SHA-1 context to use. This must be initialized. - /// \param data The data block being processed. This must be a - /// readable buffer of length \c 64 Bytes. + /// - For #PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is + /// supported. + /// \param salt_length Size of the \p salt buffer in bytes. + /// If \p salt is \c NULL, pass 0. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha1_process( - ctx: *mut mbedtls_sha1_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(\c key_type, \c key_bits, \p alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \p key. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INVALID_PADDING \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_asymmetric_decrypt( + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + input: *const u8, + input_length: usize, + salt: *const u8, + salt_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } +/// The type of the state data structure for key derivation operations. +/// +/// Before calling any function on a key derivation operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_key_derivation_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_KEY_DERIVATION_OPERATION_INIT, +/// for example: +/// \code +/// psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_key_derivation_operation_init() +/// to the structure, for example: +/// \code +/// psa_key_derivation_operation_t operation; +/// operation = psa_key_derivation_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_key_derivation_operation_t = psa_key_derivation_s; unsafe extern "C" { - /// \brief This function calculates the SHA-1 checksum of a buffer. + /// Set up a key derivation operation. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// A key derivation algorithm takes some inputs and uses them to generate + /// a byte stream in a deterministic way. + /// This byte stream can be used to produce keys and other + /// cryptographic material. /// - /// The SHA-1 result is calculated as - /// output = SHA-1(input buffer). + /// To derive a key: + /// -# Start with an initialized object of type #psa_key_derivation_operation_t. + /// -# Call psa_key_derivation_setup() to select the algorithm. + /// -# Provide the inputs for the key derivation by calling + /// psa_key_derivation_input_bytes() or psa_key_derivation_input_key() + /// as appropriate. Which inputs are needed, in what order, and whether + /// they may be keys and if so of what type depends on the algorithm. + /// -# Optionally set the operation's maximum capacity with + /// psa_key_derivation_set_capacity(). You may do this before, in the middle + /// of or after providing inputs. For some algorithms, this step is mandatory + /// because the output depends on the maximum capacity. + /// -# To derive a key, call psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// To derive a byte string for a different purpose, call + /// psa_key_derivation_output_bytes(). + /// Successive calls to these functions use successive output bytes + /// calculated by the key derivation algorithm. + /// -# Clean up the key derivation operation object with + /// psa_key_derivation_abort(). /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// If this function returns an error, the key derivation operation object is + /// not changed. /// - /// \param input The buffer holding the input data. - /// This must be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data \p input in Bytes. - /// \param output The SHA-1 checksum result. - /// This must be a writable buffer of length \c 20 Bytes. + /// If an error occurs at any step after a call to psa_key_derivation_setup(), + /// the operation will need to be reset by a call to psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha1( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-1 checkup routine. + /// Implementations must reject an attempt to derive a key of size 0. /// - /// \warning SHA-1 is considered a weak message digest and its use - /// constitutes a security risk. We recommend considering - /// stronger message digests instead. + /// \param[in,out] operation The key derivation operation object + /// to set up. It must + /// have been initialized but not set up yet. + /// \param alg The key derivation algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_DERIVATION(\p alg) is true). /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha1_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha256_context { - pub work_area: [::core::ffi::c_uchar; 208usize], - pub is224: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha256_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c alg is not a key derivation algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be inactive), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_setup( + operation: *mut psa_key_derivation_operation_t, + alg: psa_algorithm_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function initializes a SHA-256 context. + /// Retrieve the current capacity of a key derivation operation. /// - /// \param ctx The SHA-256 context to initialize. This must not be \c NULL. - pub fn mbedtls_sha256_init(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-256 context. + /// The capacity of a key derivation is the maximum number of bytes that it can + /// return. When you get *N* bytes of output from a key derivation operation, + /// this reduces its capacity by *N*. /// - /// \param ctx The SHA-256 context to clear. This may be \c NULL, in which - /// case this function returns immediately. If it is not \c NULL, - /// it must point to an initialized SHA-256 context. - pub fn mbedtls_sha256_free(ctx: *mut mbedtls_sha256_context); -} -unsafe extern "C" { - /// \brief This function clones the state of a SHA-256 context. + /// \param[in] operation The operation to query. + /// \param[out] capacity On success, the capacity of the operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha256_clone( - dst: *mut mbedtls_sha256_context, - src: *const mbedtls_sha256_context, - ); + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_get_capacity( + operation: *const psa_key_derivation_operation_t, + capacity: *mut usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function starts a SHA-224 or SHA-256 checksum - /// calculation. + /// Set the maximum capacity of a key derivation operation. /// - /// \param ctx The context to use. This must be initialized. - /// \param is224 This determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// The capacity of a key derivation operation is the maximum number of bytes + /// that the key derivation operation can return from this point onwards. /// - /// \note is224 must be defined accordingly to the enabled - /// MBEDTLS_SHA224_C/MBEDTLS_SHA256_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to modify. + /// \param capacity The new capacity of the operation. + /// It must be less or equal to the operation's + /// current capacity. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_starts( - ctx: *mut mbedtls_sha256_context, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p capacity is larger than the operation's current capacity. + /// In this case, the operation object remains valid and its capacity + /// remains unchanged. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active), or the + /// library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_set_capacity( + operation: *mut psa_key_derivation_operation_t, + capacity: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-256 checksum calculation. + /// Provide an input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_update( - ctx: *mut mbedtls_sha256_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-256 operation, and writes - /// the result to the output buffer. + /// This function passes direct inputs, which is usually correct for + /// non-secret inputs. To pass a secret input, which should be in a key + /// object, call psa_key_derivation_input_key() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param ctx The SHA-256 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256_finish( - ctx: *mut mbedtls_sha256_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] data Input data to use. + /// \param data_length Size of the \p data buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow direct inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_bytes( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + data: *const u8, + data_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-256 computation. This function is for - /// internal use only. + /// Provide a numeric input for key derivation or key agreement. /// - /// \param ctx The SHA-256 context. This must be initialized. - /// \param data The buffer holding one block of data. This must - /// be a readable buffer of length \c 64 Bytes. + /// Which inputs are required and in what order depends on the algorithm. + /// However, when an algorithm requires a particular order, numeric inputs + /// usually come first as they tend to be configuration parameters. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha256_process( - ctx: *mut mbedtls_sha256_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// This function is used for inputs which are fixed-size non-negative + /// integers. + /// + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param[in] value The value of the numeric input. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow numeric inputs. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_integer( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + value: u64, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function calculates the SHA-224 or SHA-256 - /// checksum of a buffer. + /// Provide an input for key derivation in the form of a key. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// Which inputs are required and in what order depends on the algorithm. + /// Refer to the documentation of each key derivation or key agreement + /// algorithm for information. /// - /// The SHA-256 result is calculated as - /// output = SHA-256(input buffer). + /// This function obtains input from a key object, which is usually correct for + /// secret inputs or for non-secret personalization strings kept in the key + /// store. To pass a non-secret parameter which is not in the key store, + /// call psa_key_derivation_input_bytes() instead of this function. + /// Refer to the documentation of individual step types + /// (`PSA_KEY_DERIVATION_INPUT_xxx` values of type ::psa_key_derivation_step_t) + /// for more information. /// - /// \param input The buffer holding the data. This must be a readable - /// buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-224 or SHA-256 checksum result. - /// This must be a writable buffer of length \c 32 bytes - /// for SHA-256, \c 28 bytes for SHA-224. - /// \param is224 Determines which function to use. This must be - /// either \c 0 for SHA-256, or \c 1 for SHA-224. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() and must not + /// have produced any output yet. + /// \param step Which step the input data is for. + /// \param key Identifier of the key. It must have an + /// appropriate type for step and must allow the + /// usage #PSA_KEY_USAGE_DERIVE or + /// #PSA_KEY_USAGE_VERIFY_DERIVATION (see note) + /// and the algorithm used by the operation. + /// + /// \note Once all inputs steps are completed, the operations will allow: + /// - psa_key_derivation_output_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_output_key() or psa_key_derivation_output_key_custom() + /// if the input for step + /// #PSA_KEY_DERIVATION_INPUT_SECRET or #PSA_KEY_DERIVATION_INPUT_PASSWORD + /// was from a key slot with #PSA_KEY_USAGE_DERIVE and each other input was + /// either a direct input or a key with #PSA_KEY_USAGE_DERIVE set; + /// - psa_key_derivation_verify_bytes() if each input was either a direct input + /// or a key with #PSA_KEY_USAGE_VERIFY_DERIVATION set; + /// - psa_key_derivation_verify_key() under the same conditions as + /// psa_key_derivation_verify_bytes(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha256( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is224: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key allows neither #PSA_KEY_USAGE_DERIVE nor + /// #PSA_KEY_USAGE_VERIFY_DERIVATION, or it doesn't allow this + /// algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c step is not compatible with the operation's algorithm, or + /// \c step does not allow key inputs of the given type + /// or does not allow key inputs at all. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this input \p step, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_input_key( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + key: mbedtls_svc_key_id_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief The SHA-224 checkup routine. + /// Perform a key agreement and use the shared secret as input to a key + /// derivation. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha224_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-256 checkup routine. + /// A key agreement algorithm takes two inputs: a private key \p private_key + /// a public key \p peer_key. + /// The result of this function is passed as input to a key derivation. + /// The output of this key derivation can be extracted by reading from the + /// resulting operation to produce keys and other cryptographic material. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha256_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_sha512_context { - pub work_area: [::core::ffi::c_uchar; 304usize], - pub is384: ::core::ffi::c_uchar, -} -impl Default for mbedtls_sha512_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief This function initializes a SHA-512 context. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \param ctx The SHA-512 context to initialize. This must - /// not be \c NULL. - pub fn mbedtls_sha512_init(ctx: *mut mbedtls_sha512_context); -} -unsafe extern "C" { - /// \brief This function clears a SHA-512 context. + /// \param[in,out] operation The key derivation operation object to use. + /// It must have been set up with + /// psa_key_derivation_setup() with a + /// key agreement and derivation algorithm + /// \c alg (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_KEY_AGREEMENT(\c alg) is true + /// and #PSA_ALG_IS_RAW_KEY_AGREEMENT(\c alg) + /// is false). + /// The operation must be ready for an + /// input of the type given by \p step. + /// \param step Which step the input data is for. + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. The peer key must be in the + /// same format that psa_import_key() accepts for the + /// public key type corresponding to the type of + /// private_key. That is, this function performs the + /// equivalent of + /// #psa_import_key(..., + /// `peer_key`, `peer_key_length`) where + /// with key attributes indicating the public key + /// type corresponding to the type of `private_key`. + /// For example, for EC keys, this means that peer_key + /// is interpreted as a point on the curve that the + /// private key is on. The standard formats for public + /// keys are documented in the documentation of + /// psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. /// - /// \param ctx The SHA-512 context to clear. This may be \c NULL, - /// in which case this function does nothing. If it - /// is not \c NULL, it must point to an initialized - /// SHA-512 context. - pub fn mbedtls_sha512_free(ctx: *mut mbedtls_sha512_context); + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \c private_key is not compatible with \c alg, + /// or \p peer_key is not valid for \c alg or not compatible with + /// \c private_key, or \c step does not allow an input resulting + /// from a key agreement. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \c alg is not supported or is not a key derivation algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid for this key agreement \p step, + /// or the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_key_agreement( + operation: *mut psa_key_derivation_operation_t, + step: psa_key_derivation_step_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function clones the state of a SHA-512 context. + /// Read some data from a key derivation operation. /// - /// \param dst The destination context. This must be initialized. - /// \param src The context to clone. This must be initialized. - pub fn mbedtls_sha512_clone( - dst: *mut mbedtls_sha512_context, - src: *const mbedtls_sha512_context, - ); -} -unsafe extern "C" { - /// \brief This function starts a SHA-384 or SHA-512 checksum - /// calculation. + /// This function calculates output bytes from a key derivation algorithm and + /// return those bytes. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the requested number of bytes from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context to use. This must be initialized. - /// \param is384 Determines which function to use. This must be - /// either \c 0 for SHA-512, or \c 1 for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \note is384 must be defined accordingly to the enabled - /// MBEDTLS_SHA384_C/MBEDTLS_SHA512_C symbols otherwise the - /// function will return #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] output Buffer where the output will be written. + /// \param output_length Number of bytes to output. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_starts( - ctx: *mut mbedtls_sha512_context, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// no output is written to the output buffer. + /// The operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_bytes( + operation: *mut psa_key_derivation_operation_t, + output: *mut u8, + output_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief This function feeds an input buffer into an ongoing - /// SHA-512 checksum calculation. + /// Derive a key from an ongoing key derivation operation. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param input The buffer holding the input data. This must - /// be a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. + /// This function calculates output bytes from a key derivation algorithm + /// and uses those bytes to generate a key deterministically. + /// The key's location, usage policy, type and size are taken from + /// \p attributes. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_update( - ctx: *mut mbedtls_sha512_context, - input: *const ::core::ffi::c_uchar, - ilen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function finishes the SHA-512 operation, and writes - /// the result to the output buffer. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads as many bytes as required from the + /// stream. + /// The operation's capacity decreases by the number of bytes read. /// - /// \param ctx The SHA-512 context. This must be initialized - /// and have a hash operation started. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA, the operation enters an error + /// state and must be aborted by calling psa_key_derivation_abort(). /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512_finish( - ctx: *mut mbedtls_sha512_context, - output: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function processes a single data block within - /// the ongoing SHA-512 computation. - /// This function is for internal use only. + /// How much output is produced and consumed from the operation, and how + /// the key is derived, depends on the key type and on the key size + /// (denoted \c bits below): /// - /// \param ctx The SHA-512 context. This must be initialized. - /// \param data The buffer holding one block of data. This - /// must be a readable buffer of length \c 128 Bytes. + /// - For key types for which the key is an arbitrary sequence of bytes + /// of a given size, this function is functionally equivalent to + /// calling #psa_key_derivation_output_bytes + /// and passing the resulting output to #psa_import_key. + /// However, this function has a security benefit: + /// if the implementation provides an isolation boundary then + /// the key material is not exposed outside the isolation boundary. + /// As a consequence, for these key types, this function always consumes + /// exactly (\c bits / 8) bytes from the operation. + /// The following key types defined in this specification follow this scheme: /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_internal_sha512_process( - ctx: *mut mbedtls_sha512_context, - data: *const ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This function calculates the SHA-512 or SHA-384 - /// checksum of a buffer. + /// - #PSA_KEY_TYPE_AES; + /// - #PSA_KEY_TYPE_ARIA; + /// - #PSA_KEY_TYPE_CAMELLIA; + /// - #PSA_KEY_TYPE_DERIVE; + /// - #PSA_KEY_TYPE_HMAC; + /// - #PSA_KEY_TYPE_PASSWORD_HASH. /// - /// The function allocates the context, performs the - /// calculation, and frees the context. + /// - For ECC keys on a Montgomery elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Montgomery curve), this function always draws a byte string whose + /// length is determined by the curve, and sets the mandatory bits + /// accordingly. That is: /// - /// The SHA-512 result is calculated as - /// output = SHA-512(input buffer). + /// - Curve25519 (#PSA_ECC_FAMILY_MONTGOMERY, 255 bits): draw a 32-byte + /// string and process it as specified in RFC 7748 §5. + /// - Curve448 (#PSA_ECC_FAMILY_MONTGOMERY, 448 bits): draw a 56-byte + /// string and process it as specified in RFC 7748 §5. /// - /// \param input The buffer holding the input data. This must be - /// a readable buffer of length \p ilen Bytes. - /// \param ilen The length of the input data in Bytes. - /// \param output The SHA-384 or SHA-512 checksum result. - /// This must be a writable buffer of length \c 64 bytes - /// for SHA-512, \c 48 bytes for SHA-384. - /// \param is384 Determines which function to use. This must be either - /// \c 0 for SHA-512, or \c 1 for SHA-384. + /// - For key types for which the key is represented by a single sequence of + /// \c bits bits with constraints as to which bit sequences are acceptable, + /// this function draws a byte string of length (\c bits / 8) bytes rounded + /// up to the nearest whole number of bytes. If the resulting byte string + /// is acceptable, it becomes the key, otherwise the drawn bytes are discarded. + /// This process is repeated until an acceptable byte string is drawn. + /// The byte string drawn from the operation is interpreted as specified + /// for the output produced by psa_export_key(). + /// The following key types defined in this specification follow this scheme: /// - /// \note is384 must be defined accordingly with the supported - /// symbols in the config file. If: - /// - is384 is 0, but \c MBEDTLS_SHA384_C is not defined, or - /// - is384 is 1, but \c MBEDTLS_SHA512_C is not defined - /// then the function will return - /// #MBEDTLS_ERR_SHA512_BAD_INPUT_DATA. + /// - #PSA_KEY_TYPE_DES. + /// Force-set the parity bits, but discard forbidden weak keys. + /// For 2-key and 3-key triple-DES, the three keys are generated + /// successively (for example, for 3-key triple-DES, + /// if the first 8 bytes specify a weak key and the next 8 bytes do not, + /// discard the first 8 bytes, use the next 8 bytes as the first key, + /// and continue reading output from the operation to derive the other + /// two keys). + /// - Finite-field Diffie-Hellman keys (#PSA_KEY_TYPE_DH_KEY_PAIR(\c group) + /// where \c group designates any Diffie-Hellman group) and + /// ECC keys on a Weierstrass elliptic curve + /// (#PSA_KEY_TYPE_ECC_KEY_PAIR(\c curve) where \c curve designates a + /// Weierstrass curve). + /// For these key types, interpret the byte string as integer + /// in big-endian order. Discard it if it is not in the range + /// [0, *N* - 2] where *N* is the boundary of the private key domain + /// (the prime *p* for Diffie-Hellman, the subprime *q* for DSA, + /// or the order of the curve's base point for ECC). + /// Add 1 to the resulting integer and use this as the private key *x*. + /// This method allows compliance to NIST standards, specifically + /// the methods titled "key-pair generation by testing candidates" + /// in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, + /// in FIPS 186-4 §B.1.2 for DSA, and + /// in NIST SP 800-56A §5.6.1.2.2 or + /// FIPS 186-4 §B.4.2 for elliptic curve keys. /// - /// \return \c 0 on success. - /// \return A negative error code on failure. - pub fn mbedtls_sha512( - input: *const ::core::ffi::c_uchar, - ilen: usize, - output: *mut ::core::ffi::c_uchar, - is384: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-384 checkup routine. + /// - For other key types, including #PSA_KEY_TYPE_RSA_KEY_PAIR, + /// the way in which the operation output is consumed is + /// implementation-defined. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha384_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief The SHA-512 checkup routine. + /// In all cases, the data that is read is discarded from the operation. + /// The operation's capacity is decreased by the number of bytes read. /// - /// \return \c 0 on success. - /// \return \c 1 on failure. - pub fn mbedtls_sha512_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hash_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_hash_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_hash_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub md5: mbedtls_md5_context, - pub ripemd160: mbedtls_ripemd160_context, - pub sha1: mbedtls_sha1_context, - pub sha256: mbedtls_sha256_context, - pub sha512: mbedtls_sha512_context, -} -impl Default for mbedtls_psa_hash_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_hash_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_cipher_operation_t { - pub private_alg: psa_algorithm_t, - pub private_iv_length: u8, - pub private_block_length: u8, - pub private_ctx: mbedtls_psa_cipher_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_cipher: mbedtls_cipher_context_t, -} -impl Default for mbedtls_psa_cipher_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_cipher_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_hash_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_hash_operation_t, -} -impl Default for psa_driver_hash_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_cipher_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_cipher_operation_t, -} -impl Default for psa_driver_cipher_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_hash_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h. - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. the driver context is not active, in use). - pub private_id: ::core::ffi::c_uint, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_hash_context_t, -} -impl Default for psa_hash_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_cipher_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_default_iv_length: u8, - pub private_ctx: psa_driver_cipher_context_t, + /// For algorithms that take an input step #PSA_KEY_DERIVATION_INPUT_SECRET, + /// the input to that step must be provided with psa_key_derivation_input_key(). + /// Future versions of this specification may include additional restrictions + /// on the derived key based on the attributes and strength of the secret key. + /// + /// \note This function is equivalent to calling + /// psa_key_derivation_output_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for psa_cipher_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// See the description of psa_key_derivation_out_key() for the operation of + /// this function with the default production parameters. + /// Mbed TLS currently does not currently support any non-default production + /// parameters. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_custom( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl psa_cipher_operation_s { - #[inline] - pub fn private_iv_required(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_required(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_required_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_required_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_iv_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_iv_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_iv_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_iv_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_iv_required: ::core::ffi::c_uint, - private_iv_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_iv_required: u32 = unsafe { ::core::mem::transmute(private_iv_required) }; - private_iv_required as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_iv_set: u32 = unsafe { ::core::mem::transmute(private_iv_set) }; - private_iv_set as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Derive a key from an ongoing key derivation operation with custom + /// production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// If the key type to be created is + /// #PSA_KEY_TYPE_PASSWORD_HASH then the algorithm in + /// the policy must be the same as in the current + /// operation. + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] params Customization parameters for the key derivation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_key_derivation_output_key(). + /// Mbed TLS currently only supports the default + /// production parameters, i.e. + /// #PSA_KEY_PRODUCTION_PARAMETERS_INIT, + /// for all key types. + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// There was not enough data to create the desired key. + /// Note that in this case, no output is written to the output buffer. + /// The operation's capacity is set to 0, thus subsequent calls to + /// this function will not succeed, even with a smaller output buffer. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size is not supported, either by the + /// implementation in general or in this particular location. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The provided key attributes are not valid for the operation. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The #PSA_KEY_DERIVATION_INPUT_SECRET or + /// #PSA_KEY_DERIVATION_INPUT_PASSWORD input was not provided through a + /// key; or one of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_DERIVE. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_output_key_ext( + attributes: *const psa_key_attributes_t, + operation: *mut psa_key_derivation_operation_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_hmac_operation_t { - /// The HMAC algorithm in use - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - /// The hash context. - pub hash_ctx: psa_hash_operation_s, - /// The HMAC part of the context. - pub private_opad: [u8; 128usize], +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value in constant time. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the expected number of bytes from the + /// stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to the following code: + /// \code + /// psa_key_derivation_output_bytes(operation, tmp, output_length); + /// if (memcmp(output, tmp, output_length) != 0) + /// return PSA_ERROR_INVALID_SIGNATURE; + /// \endcode + /// except (1) it works even if the key's policy does not allow outputting the + /// bytes, and (2) the comparison will be done in constant time. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected Buffer containing the expected derivation output. + /// \param expected_length Length of the expected output; this is also the + /// number of bytes that will be read. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but it differs from the expected + /// output. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// One of the inputs was a key whose policy didn't allow + /// #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// \p output_length bytes. Note that in this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_bytes( + operation: *mut psa_key_derivation_operation_t, + expected: *const u8, + expected_length: usize, + ) -> psa_status_t; } -impl Default for mbedtls_psa_hmac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Compare output data from a key derivation operation to an expected value + /// stored in a key object. + /// + /// This function calculates output bytes from a key derivation algorithm and + /// compares those bytes to an expected value, provided as key of type + /// #PSA_KEY_TYPE_PASSWORD_HASH. + /// If you view the key derivation's output as a stream of bytes, this + /// function destructively reads the number of bytes corresponding to the + /// length of the expected value from the stream before comparing them. + /// The operation's capacity decreases by the number of bytes read. + /// + /// This is functionally equivalent to exporting the key and calling + /// psa_key_derivation_verify_bytes() on the result, except that it + /// works even if the key cannot be exported. + /// + /// If this function returns an error status other than + /// #PSA_ERROR_INSUFFICIENT_DATA or #PSA_ERROR_INVALID_SIGNATURE, + /// the operation enters an error state and must be aborted by calling + /// psa_key_derivation_abort(). + /// + /// \param[in,out] operation The key derivation operation object to read from. + /// \param[in] expected A key of type #PSA_KEY_TYPE_PASSWORD_HASH + /// containing the expected output. Its policy must + /// include the #PSA_KEY_USAGE_VERIFY_DERIVATION flag + /// and the permitted algorithm must match the + /// operation. The value of this key was likely + /// computed by a previous call to + /// psa_key_derivation_output_key() or + /// psa_key_derivation_output_key_custom(). + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The output was read successfully, but if differs from the expected + /// output. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// The key passed as the expected value does not exist. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key passed as the expected value has an invalid type. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key passed as the expected value does not allow this usage or + /// this algorithm; or one of the inputs was a key whose policy didn't + /// allow #PSA_KEY_USAGE_VERIFY_DERIVATION. + /// \retval #PSA_ERROR_INSUFFICIENT_DATA + /// The operation's capacity was less than + /// the length of the expected value. In this case, + /// the operation's capacity is set to 0, thus + /// subsequent calls to this function will not + /// succeed, even with a smaller expected output. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active and completed + /// all required input steps), or the library has not been previously + /// initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_verify_key( + operation: *mut psa_key_derivation_operation_t, + expected: psa_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_mac_operation_t { - pub private_alg: psa_algorithm_t, - pub __bindgen_padding_0: u64, - pub private_ctx: mbedtls_psa_mac_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// Abort a key derivation operation. + /// + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_key_derivation_setup() again. + /// + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_key_derivation_operation_t. + /// + /// In particular, it is valid to call psa_key_derivation_abort() twice, or to + /// call psa_key_derivation_abort() on an operation that has not been set up. + /// + /// \param[in,out] operation The operation to abort. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_key_derivation_abort(operation: *mut psa_key_derivation_operation_t) + -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union mbedtls_psa_mac_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_hmac: mbedtls_psa_hmac_operation_t, - pub private_cmac: mbedtls_cipher_context_t, +unsafe extern "C" { + /// Perform a key agreement and return the raw shared secret. + /// + /// \warning The raw result of a key agreement algorithm such as finite-field + /// Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should + /// not be used directly as key material. It should instead be passed as + /// input to a key derivation algorithm. To chain a key agreement with + /// a key derivation, use psa_key_derivation_key_agreement() and other + /// functions from the key derivation interface. + /// + /// \param alg The key agreement algorithm to compute + /// (\c PSA_ALG_XXX value such that + /// #PSA_ALG_IS_RAW_KEY_AGREEMENT(\p alg) + /// is true). + /// \param private_key Identifier of the private key to use. It must + /// allow the usage #PSA_KEY_USAGE_DERIVE. + /// \param[in] peer_key Public key of the peer. It must be + /// in the same format that psa_import_key() + /// accepts. The standard formats for public + /// keys are documented in the documentation + /// of psa_export_public_key(). + /// \param peer_key_length Size of \p peer_key in bytes. + /// \param[out] output Buffer where the decrypted message is to + /// be written. + /// \param output_size Size of the \c output buffer in bytes. + /// \param[out] output_length On success, the number of bytes + /// that make up the returned output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p alg is not a key agreement algorithm, or + /// \p private_key is not compatible with \p alg, + /// or \p peer_key is not valid for \p alg or not compatible with + /// \p private_key. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// \p output_size is too small + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p alg is not a supported key agreement algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_raw_key_agreement( + alg: psa_algorithm_t, + private_key: mbedtls_svc_key_id_t, + peer_key: *const u8, + peer_key_length: usize, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// \brief Generate random bytes. + /// + /// \warning This function **can** fail! Callers MUST check the return status + /// and MUST NOT use the content of the output buffer if the return + /// status is not #PSA_SUCCESS. + /// + /// \note To generate a key, use psa_generate_key() instead. + /// + /// \param[out] output Output buffer for the generated data. + /// \param output_size Number of bytes to generate and output. + /// + /// \retval #PSA_SUCCESS \emptydescription + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_random(output: *mut u8, output_size: usize) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair. + /// + /// The key is generated randomly. + /// Its location, usage policy, type and size are taken from \p attributes. + /// + /// Implementations must reject an attempt to generate a key of size 0. + /// + /// The following type-specific considerations apply: + /// - For RSA keys (#PSA_KEY_TYPE_RSA_KEY_PAIR), + /// the public exponent is 65537. + /// The modulus is a product of two probabilistic primes + /// between 2^{n-1} and 2^n where n is the bit size specified in the + /// attributes. + /// + /// \note This function is equivalent to calling psa_generate_key_custom() + /// with the custom production parameters #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// and `custom_data_length == 0` (i.e. `custom_data` is empty). + /// + /// \param[in] attributes The attributes for the new key. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key( + attributes: *const psa_key_attributes_t, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -impl Default for mbedtls_psa_mac_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// See the description of psa_generate_key() for the operation of this + /// function with the default production parameters. In addition, this function + /// supports the following production customizations, described in more detail + /// in the documentation of ::psa_custom_key_parameters_t: + /// + /// - RSA keys: generation with a custom public exponent. + /// + /// \note This function is experimental and may change in future minor + /// versions of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] custom Customization parameters for the key generation. + /// When this is #PSA_CUSTOM_KEY_PARAMETERS_INIT + /// with \p custom_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param[in] custom_data Variable-length data associated with \c custom. + /// \param custom_data_length + /// Length of `custom_data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_custom( + attributes: *const psa_key_attributes_t, + custom: *const psa_custom_key_parameters_t, + custom_data: *const u8, + custom_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_aead_operation_t { - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_tag_length: u8, - pub ctx: mbedtls_psa_aead_operation_t__bindgen_ty_1, +unsafe extern "C" { + /// \brief Generate a key or key pair using custom production parameters. + /// + /// \note + /// This is a deprecated variant of psa_key_derivation_output_key_custom(). + /// It is equivalent except that the associated variable-length data + /// is passed in `params->data` instead of a separate parameter. + /// This function will be removed in a future version of Mbed TLS. + /// + /// \param[in] attributes The attributes for the new key. + /// \param[in] params Customization parameters for the key generation. + /// When this is #PSA_KEY_PRODUCTION_PARAMETERS_INIT + /// with \p params_data_length = 0, + /// this function is equivalent to + /// psa_generate_key(). + /// \param params_data_length + /// Length of `params->data` in bytes. + /// \param[out] key On success, an identifier for the newly created + /// key. For persistent keys, this is the key + /// identifier defined in \p attributes. + /// \c 0 on failure. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// If the key is persistent, the key material and the key's metadata + /// have been saved to persistent storage. + /// \retval #PSA_ERROR_ALREADY_EXISTS + /// This is an attempt to create a persistent key, and there is + /// already a persistent key with the given identifier. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_generate_key_ext( + attributes: *const psa_key_attributes_t, + params: *const psa_key_production_parameters_t, + params_data_length: usize, + key: *mut mbedtls_svc_key_id_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_aead_operation_t__bindgen_ty_1 { - pub dummy: ::core::ffi::c_uint, - pub private_ccm: mbedtls_ccm_context, - pub private_gcm: mbedtls_gcm_context, - pub private_chachapoly: mbedtls_chachapoly_context, +/// The type of the state data structure for interruptible hash +/// signing operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation = +/// PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_sign_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_sign_hash_interruptible_operation_t operation; +/// operation = psa_sign_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_sign_hash_interruptible_operation_t = psa_sign_hash_interruptible_operation_s; +/// The type of the state data structure for interruptible hash +/// verification operations. +/// +/// Before calling any function on a sign hash operation object, the +/// application must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer +/// #PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT, for example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation = +/// PSA_VERIFY_HASH_INTERRUPTIBLE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function +/// psa_verify_hash_interruptible_operation_init() to the structure, for +/// example: +/// \code +/// psa_verify_hash_interruptible_operation_t operation; +/// operation = psa_verify_hash_interruptible_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_verify_hash_interruptible_operation_t = psa_verify_hash_interruptible_operation_s; +unsafe extern "C" { + /// \brief Set the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note The time taken to execute a single op is + /// implementation specific and depends on + /// software, hardware, the algorithm, key type and + /// curve chosen. Even within a single operation, + /// successive ops can take differing amounts of + /// time. The only guarantee is that lower values + /// for \p max_ops means functions will block for a + /// lesser maximum amount of time. The functions + /// \c psa_sign_interruptible_get_num_ops() and + /// \c psa_verify_interruptible_get_num_ops() are + /// provided to help with tuning this value. + /// + /// \note This value defaults to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, which + /// means the whole operation will be done in one + /// go, regardless of the number of ops required. + /// + /// \note If more ops are needed to complete a + /// computation, #PSA_OPERATION_INCOMPLETE will be + /// returned by the function performing the + /// computation. It is then the caller's + /// responsibility to either call again with the + /// same operation context until it returns 0 or an + /// error code; or to call the relevant abort + /// function if the answer is no longer required. + /// + /// \note The interpretation of \p max_ops is also + /// implementation defined. On a hard real time + /// system, this can indicate a hard deadline, as a + /// real-time system needs a guarantee of not + /// spending more than X time, however care must be + /// taken in such an implementation to avoid the + /// situation whereby calls just return, not being + /// able to do any actual work within the allotted + /// time. On a non-real-time system, the + /// implementation can be more relaxed, but again + /// whether this number should be interpreted as as + /// hard or soft limit or even whether a less than + /// or equals as regards to ops executed in a + /// single call is implementation defined. + /// + /// \note For keys in local storage when no accelerator + /// driver applies, please see also the + /// documentation for \c mbedtls_ecp_set_max_ops(), + /// which is the internal implementation in these + /// cases. + /// + /// \warning With implementations that interpret this number + /// as a hard limit, setting this number too small + /// may result in an infinite loop, whereby each + /// call results in immediate return with no ops + /// done (as there is not enough time to execute + /// any), and thus no result will ever be achieved. + /// + /// \note This only applies to functions whose + /// documentation mentions they may return + /// #PSA_OPERATION_INCOMPLETE. + /// + /// \param max_ops The maximum number of ops to be executed in a + /// single call. This can be a number from 0 to + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED, where 0 + /// is the least amount of work done per call. + pub fn psa_interruptible_set_max_ops(max_ops: u32); } -impl Default for mbedtls_psa_aead_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. This will return the last + /// value set by + /// \c psa_interruptible_set_max_ops() or + /// #PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED if + /// that function has never been called. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \return Maximum number of ops allowed to be + /// executed by an interruptible function in a + /// single call. + pub fn psa_interruptible_get_max_ops() -> u32; } -impl Default for mbedtls_psa_aead_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash signing + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling + /// \c psa_sign_hash_interruptible_abort() on + /// the operation, a value of 0 will be returned. + /// + /// \note This interface is guaranteed re-entrant and + /// thus may be called from driver code. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_sign_hash_get_num_ops( + operation: *const psa_sign_hash_interruptible_operation_t, + ) -> u32; } -impl mbedtls_psa_aead_operation_t { - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Get the number of ops that a hash verification + /// operation has taken so far. If the operation + /// has completed, then this will represent the + /// number of ops required for the entire + /// operation. After initialization or calling \c + /// psa_verify_hash_interruptible_abort() on the + /// operation, a value of 0 will be returned. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// This is a helper provided to help you tune the + /// value passed to \c + /// psa_interruptible_set_max_ops(). + /// + /// \param operation The \c + /// psa_verify_hash_interruptible_operation_t to + /// use. This must be initialized first. + /// + /// \return Number of ops that the operation has taken so + /// far. + pub fn psa_verify_hash_get_num_ops( + operation: *const psa_verify_hash_interruptible_operation_t, + ) -> u32; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_sign_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Start signing a hash or short message with a + /// private key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_complete() is equivalent to + /// \c psa_sign_hash() but + /// \c psa_sign_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call \c psa_sign_hash_complete() + /// repeatedly on the same context after a + /// successful call to this function until \c + /// psa_sign_hash_complete() either returns 0 or an + /// error. \c psa_sign_hash_complete() will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// It must be an asymmetric key pair. The key must + /// allow the usage #PSA_KEY_USAGE_SIGN_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash or message to sign. + /// \param hash_length Size of the \p hash buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - call \c psa_sign_hash_complete() + /// with the same context to complete the operation + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_SIGN_HASH flag, or it does + /// not permit the requested algorithm. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation has previously been started on this context, and is + /// still in progress. + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_start( + operation: *mut psa_sign_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_verify_hash_interruptible_operation_t { - pub private_dummy: ::core::ffi::c_uint, +unsafe extern "C" { + /// \brief Continue and eventually complete the action of + /// signing a hash or short message with a private + /// key, in an interruptible manner. + /// + /// \see \c psa_sign_hash_start() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_sign_hash_start() is equivalent to + /// \c psa_sign_hash() but this function can return + /// early and resume according to the limit set with + /// \c psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function call. + /// + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_sign_hash_abort() at any point if they no + /// longer want the result. + /// + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_sign_hash_abort(). + /// + /// \param[in, out] operation The \c psa_sign_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_sign_hash_start() called with it + /// first. + /// + /// \param[out] signature Buffer where the signature is to be written. + /// \param signature_size Size of the \p signature buffer in bytes. This + /// must be appropriate for the selected + /// algorithm and key: + /// - The required signature size is + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c + /// key_bits, \c alg) where \c key_type and \c + /// key_bits are the type and bit-size + /// respectively of key. + /// - #PSA_SIGNATURE_MAX_SIZE evaluates to the + /// maximum signature size of any supported + /// signature algorithm. + /// \param[out] signature_length On success, the number of bytes that make up + /// the returned signature value. + /// + /// \retval #PSA_SUCCESS + /// Operation completed successfully + /// + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p signature buffer is too small. You can + /// determine a sufficient buffer size by calling + /// #PSA_SIGN_OUTPUT_SIZE(\c key_type, \c key_bits, \c alg) + /// where \c key_type and \c key_bits are the type and bit-size + /// respectively of \c key. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_sign_hash_start(). + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_sign_hash_start() with this operation object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_sign_hash_complete( + operation: *mut psa_sign_hash_interruptible_operation_t, + signature: *mut u8, + signature_size: usize, + signature_length: *mut usize, + ) -> psa_status_t; } -///< Client -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_CLIENT: mbedtls_ecjpake_role = 0; -///< Server -pub const mbedtls_ecjpake_role_MBEDTLS_ECJPAKE_SERVER: mbedtls_ecjpake_role = 1; -/// Roles in the EC J-PAKE exchange -pub type mbedtls_ecjpake_role = ::core::ffi::c_uint; -/// EC J-PAKE context structure. -/// -/// J-PAKE is a symmetric protocol, except for the identifiers used in -/// Zero-Knowledge Proofs, and the serialization of the second message -/// (KeyExchange) as defined by the Thread spec. -/// -/// In order to benefit from this symmetry, we choose a different naming -/// convention from the Thread v1.0 spec. Correspondence is indicated in the -/// description as a pair C: client name, S: server name -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_ecjpake_context { - ///< Hash to use - pub private_md_type: mbedtls_md_type_t, - ///< Elliptic curve - pub private_grp: mbedtls_ecp_group, - ///< Are we client or server? - pub private_role: mbedtls_ecjpake_role, - ///< Format for point export - pub private_point_format: ::core::ffi::c_int, - ///< My public key 1 C: X1, S: X3 - pub private_Xm1: mbedtls_ecp_point, - ///< My public key 2 C: X2, S: X4 - pub private_Xm2: mbedtls_ecp_point, - ///< Peer public key 1 C: X3, S: X1 - pub private_Xp1: mbedtls_ecp_point, - ///< Peer public key 2 C: X4, S: X2 - pub private_Xp2: mbedtls_ecp_point, - ///< Peer public key C: Xs, S: Xc - pub private_Xp: mbedtls_ecp_point, - ///< My private key 1 C: x1, S: x3 - pub private_xm1: mbedtls_mpi, - ///< My private key 2 C: x2, S: x4 - pub private_xm2: mbedtls_mpi, - ///< Pre-shared secret (passphrase) - pub private_s: mbedtls_mpi, +unsafe extern "C" { + /// \brief Abort a sign hash operation. + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function is the only function that clears + /// the number of ops completed as part of the + /// operation. Please ensure you copy this value via + /// \c psa_sign_hash_get_num_ops() if required + /// before calling. + /// + /// \note Aborting an operation frees all associated + /// resources except for the \p operation structure + /// itself. Once aborted, the operation object can + /// be reused for another operation by calling \c + /// psa_sign_hash_start() again. + /// + /// \note You may call this function any time after the + /// operation object has been initialized. In + /// particular, calling \c psa_sign_hash_abort() + /// after the operation has already been terminated + /// by a call to \c psa_sign_hash_abort() or + /// psa_sign_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized sign hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_sign_hash_abort( + operation: *mut psa_sign_hash_interruptible_operation_t, + ) -> psa_status_t; } -impl Default for mbedtls_ecjpake_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Start reading and verifying a hash or short + /// message, in an interruptible manner. + /// + /// \see \c psa_verify_hash_complete() + /// + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. + /// + /// \note This function combined with \c + /// psa_verify_hash_complete() is equivalent to + /// \c psa_verify_hash() but \c + /// psa_verify_hash_complete() can return early and + /// resume according to the limit set with \c + /// psa_interruptible_set_max_ops() to reduce the + /// maximum time spent in a function. + /// + /// \note Users should call \c psa_verify_hash_complete() + /// repeatedly on the same operation object after a + /// successful call to this function until \c + /// psa_verify_hash_complete() either returns 0 or + /// an error. \c psa_verify_hash_complete() will + /// return #PSA_OPERATION_INCOMPLETE if there is + /// more work to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. + /// + /// \note If this function returns an error status, the + /// operation enters an error state and must be + /// aborted by calling \c psa_verify_hash_abort(). + /// + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first. + /// + /// \param key Identifier of the key to use for the operation. + /// The key must allow the usage + /// #PSA_KEY_USAGE_VERIFY_HASH. + /// \param alg A signature algorithm (\c PSA_ALG_XXX + /// value such that #PSA_ALG_IS_SIGN_HASH(\p alg) + /// is true), that is compatible with + /// the type of \p key. + /// \param[in] hash The hash whose signature is to be verified. + /// \param hash_length Size of the \p hash buffer in bytes. + /// \param[in] signature Buffer containing the signature to verify. + /// \param signature_length Size of the \p signature buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// The operation started successfully - please call \c + /// psa_verify_hash_complete() with the same context to complete the + /// operation. + /// + /// \retval #PSA_ERROR_BAD_STATE + /// Another operation has already been started on this context, and is + /// still in progress. + /// + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_VERIFY_HASH flag, or it does + /// not permit the requested algorithm. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_start( + operation: *mut psa_verify_hash_interruptible_operation_t, + key: mbedtls_svc_key_id_t, + alg: psa_algorithm_t, + hash: *const u8, + hash_length: usize, + signature: *const u8, + signature_length: usize, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Initialize an ECJPAKE context. + /// \brief Continue and eventually complete the action of + /// reading and verifying a hash or short message + /// signed with a private key, in an interruptible + /// manner. /// - /// \param ctx The ECJPAKE context to initialize. - /// This must not be \c NULL. - pub fn mbedtls_ecjpake_init(ctx: *mut mbedtls_ecjpake_context); -} -unsafe extern "C" { - /// \brief Set up an ECJPAKE context for use. + /// \see \c psa_verify_hash_start() /// - /// \note Currently the only values for hash/curve allowed by the - /// standard are #MBEDTLS_MD_SHA256/#MBEDTLS_ECP_DP_SECP256R1. + /// \warning This is a beta API, and thus subject to change + /// at any point. It is not bound by the usual + /// interface stability promises. /// - /// \param ctx The ECJPAKE context to set up. This must be initialized. - /// \param role The role of the caller. This must be either - /// #MBEDTLS_ECJPAKE_CLIENT or #MBEDTLS_ECJPAKE_SERVER. - /// \param hash The identifier of the hash function to use, - /// for example #MBEDTLS_MD_SHA256. - /// \param curve The identifier of the elliptic curve to use, - /// for example #MBEDTLS_ECP_DP_SECP256R1. - /// \param secret The pre-shared secret (passphrase). This must be - /// a readable not empty buffer of length \p len Bytes. It need - /// only be valid for the duration of this call. - /// \param len The length of the pre-shared secret \p secret. + /// \note This function combined with \c + /// psa_verify_hash_start() is equivalent to + /// \c psa_verify_hash() but this function can + /// return early and resume according to the limit + /// set with \c psa_interruptible_set_max_ops() to + /// reduce the maximum time spent in a function + /// call. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_setup( - ctx: *mut mbedtls_ecjpake_context, - role: mbedtls_ecjpake_role, - hash: mbedtls_md_type_t, - curve: mbedtls_ecp_group_id, - secret: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the point format for future reads and writes. + /// \note Users should call this function on the same + /// operation object repeatedly until it either + /// returns 0 or an error. This function will return + /// #PSA_OPERATION_INCOMPLETE if there is more work + /// to do. Alternatively users can call + /// \c psa_verify_hash_abort() at any point if they + /// no longer want the result. /// - /// \param ctx The ECJPAKE context to configure. - /// \param point_format The point format to use: - /// #MBEDTLS_ECP_PF_UNCOMPRESSED (default) - /// or #MBEDTLS_ECP_PF_COMPRESSED. + /// \note When this function returns successfully, the + /// operation becomes inactive. If this function + /// returns an error status, the operation enters an + /// error state and must be aborted by calling + /// \c psa_verify_hash_abort(). /// - /// \return \c 0 if successful. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p point_format - /// is invalid. - pub fn mbedtls_ecjpake_set_point_format( - ctx: *mut mbedtls_ecjpake_context, - point_format: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Check if an ECJPAKE context is ready for use. + /// \param[in, out] operation The \c psa_verify_hash_interruptible_operation_t + /// to use. This must be initialized first, and have + /// had \c psa_verify_hash_start() called with it + /// first. /// - /// \param ctx The ECJPAKE context to check. This must be - /// initialized. + /// \retval #PSA_SUCCESS + /// Operation completed successfully, and the passed signature is valid. /// - /// \return \c 0 if the context is ready for use. - /// \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA otherwise. - pub fn mbedtls_ecjpake_check(ctx: *const mbedtls_ecjpake_context) -> ::core::ffi::c_int; + /// \retval #PSA_OPERATION_INCOMPLETE + /// Operation was interrupted due to the setting of \c + /// psa_interruptible_set_max_ops(). There is still work to be done. + /// Call this function again with the same operation object. + /// + /// \retval #PSA_ERROR_INVALID_HANDLE \emptydescription + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The calculation was performed successfully, but the passed + /// signature is not a valid signature. + /// \retval #PSA_ERROR_BAD_STATE + /// An operation was not previously started on this context via + /// \c psa_verify_hash_start(). + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has either not been previously initialized by + /// psa_crypto_init() or you did not previously call + /// psa_verify_hash_start() on this object. It is + /// implementation-dependent whether a failure to initialize results in + /// this error code. + pub fn psa_verify_hash_complete( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Generate and write the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \brief Abort a verify hash operation. /// - /// \param ctx The ECJPAKE context to use. This must be - /// initialized and set up. - /// \param buf The buffer to write the contents to. This must be a - /// writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number - /// of Bytes written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \warning This is a beta API, and thus subject to change at + /// any point. It is not bound by the usual interface + /// stability promises. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Read and process the first round message - /// (TLS: contents of the Client/ServerHello extension, - /// excluding extension type and length bytes). + /// \note This function is the only function that clears the + /// number of ops completed as part of the operation. + /// Please ensure you copy this value via + /// \c psa_verify_hash_get_num_ops() if required + /// before calling. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up. - /// \param buf The buffer holding the first round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// \note Aborting an operation frees all associated + /// resources except for the operation structure + /// itself. Once aborted, the operation object can be + /// reused for another operation by calling \c + /// psa_verify_hash_start() again. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_one( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \note You may call this function any time after the + /// operation object has been initialized. + /// In particular, calling \c psa_verify_hash_abort() + /// after the operation has already been terminated by + /// a call to \c psa_verify_hash_abort() or + /// psa_verify_hash_complete() is safe. + /// + /// \param[in,out] operation Initialized verify hash operation. + /// + /// \retval #PSA_SUCCESS + /// The operation was aborted successfully. + /// + /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_verify_hash_abort( + operation: *mut psa_verify_hash_interruptible_operation_t, + ) -> psa_status_t; } +pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// \brief Generate and write the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Open a handle to an existing persistent key. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up, and already have performed round one. - /// \param buf The buffer to write the round two contents to. - /// This must be a writable buffer of length \p len Bytes. - /// \param len The size of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Open a handle to a persistent key. A key is persistent if it was created + /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key + /// always has a nonzero key identifier, set with psa_set_key_id() when + /// creating the key. Implementations may provide additional pre-provisioned + /// keys that can be opened with psa_open_key(). Such keys have an application + /// key identifier in the vendor range, as documented in the description of + /// #psa_key_id_t. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; + /// The application must eventually close the handle with psa_close_key() or + /// psa_destroy_key() to release associated resources. If the application dies + /// without calling one of these functions, the implementation should perform + /// the equivalent of a call to psa_close_key(). + /// + /// Some implementations permit an application to open the same key multiple + /// times. If this is successful, each call to psa_open_key() will return a + /// different key handle. + /// + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. + /// + /// \note Applications that rely on opening a key multiple times will not be + /// portable to implementations that only permit a single key handle to be + /// opened. See also :ref:\`key-handles\`. + /// + /// + /// \param key The persistent identifier of the key. + /// \param[out] handle On success, a handle to the key. + /// + /// \retval #PSA_SUCCESS + /// Success. The application can now use the value of `*handle` + /// to access the key. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY + /// The implementation does not have sufficient resources to open the + /// key. This can be due to reaching an implementation limit on the + /// number of open keys, the number of open key handles, or available + /// memory. + /// \retval #PSA_ERROR_DOES_NOT_EXIST + /// There is no persistent key with key identifier \p key. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p key is not a valid persistent key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The specified key exists, but the application does not have the + /// permission to access it. Note that this specification does not + /// define any way to create such a key, but it may be possible + /// through implementation-specific means. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Read and process the second round message - /// (TLS: contents of the Client/ServerKeyExchange). + /// Close a key handle. /// - /// \param ctx The ECJPAKE context to use. This must be initialized - /// and set up and already have performed round one. - /// \param buf The buffer holding the second round message. This must - /// be a readable buffer of length \p len Bytes. - /// \param len The length in Bytes of \p buf. + /// If the handle designates a volatile key, this will destroy the key material + /// and free all associated resources, just like psa_destroy_key(). /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_read_round_two( - ctx: *mut mbedtls_ecjpake_context, - buf: *const ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Derive the shared secret - /// (TLS: Pre-Master Secret). + /// If this is the last open handle to a persistent key, then closing the handle + /// will free all resources associated with the key in volatile memory. The key + /// data in persistent storage is not affected and can be opened again later + /// with a call to psa_open_key(). /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of Bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// Closing the key handle makes the handle invalid, and the key handle + /// must not be used again by the application. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_derive_secret( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Write the shared key material to be passed to a Key - /// Derivation Function as described in RFC8236. + /// \note This API is not part of the PSA Cryptography API Release 1.0.0 + /// specification. It was defined in the 1.0 Beta 3 version of the + /// specification but was removed in the 1.0.0 released version. This API is + /// kept for the time being to not break applications relying on it. It is not + /// deprecated yet but will be in the near future. /// - /// \param ctx The ECJPAKE context to use. This must be initialized, - /// set up and have performed both round one and two. - /// \param buf The buffer to write the derived secret to. This must - /// be a writable buffer of length \p len Bytes. - /// \param len The length of \p buf in Bytes. - /// \param olen The address at which to store the total number of bytes - /// written to \p buf. This must not be \c NULL. - /// \param f_rng The RNG function to use. This must not be \c NULL. - /// \param p_rng The RNG parameter to be passed to \p f_rng. This - /// may be \c NULL if \p f_rng doesn't use a context. + /// \note If the key handle was used to set up an active + /// :ref:\`multipart operation \`, then closing the + /// key handle can cause the multipart operation to fail. Applications should + /// maintain the key handle until after the multipart operation has finished. /// - /// \return \c 0 if successful. - /// \return A negative error code on failure. - pub fn mbedtls_ecjpake_write_shared_key( - ctx: *mut mbedtls_ecjpake_context, - buf: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, - p_rng: *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief This clears an ECJPAKE context and frees any - /// embedded data structure. + /// \param handle The key handle to close. + /// If this is \c 0, do nothing and return \c PSA_SUCCESS. /// - /// \param ctx The ECJPAKE context to free. This may be \c NULL, - /// in which case this function does nothing. If it is not - /// \c NULL, it must point to an initialized ECJPAKE context. - pub fn mbedtls_ecjpake_free(ctx: *mut mbedtls_ecjpake_context); + /// \retval #PSA_SUCCESS + /// \p handle was a valid handle or \c 0. It is now closed. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p handle is not a valid handle nor \c 0. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; } unsafe extern "C" { - /// \brief Checkup routine + /// \brief Library deinitialization. /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_ecjpake_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_psa_pake_operation_t { - pub private_alg: psa_algorithm_t, - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: u8, - pub private_buffer: [u8; 336usize], - pub private_buffer_length: usize, - pub private_buffer_offset: usize, - pub private_ctx: mbedtls_psa_pake_operation_t__bindgen_ty_1, -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union mbedtls_psa_pake_operation_t__bindgen_ty_1 { - pub private_dummy: ::core::ffi::c_uint, - pub private_jpake: mbedtls_ecjpake_context, -} -impl Default for mbedtls_psa_pake_operation_t__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl Default for mbedtls_psa_pake_operation_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_driver_mac_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_mac_operation_t, -} -impl Default for psa_driver_mac_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_aead_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_aead_operation_t, -} -impl Default for psa_driver_aead_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_sign_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_sign_hash_interruptible_operation_t, -} -impl Default for psa_driver_sign_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_verify_hash_interruptible_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_verify_hash_interruptible_operation_t, -} -impl Default for psa_driver_verify_hash_interruptible_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_driver_pake_context_t { - pub dummy: ::core::ffi::c_uint, - pub mbedtls_ctx: mbedtls_psa_pake_operation_t, -} -impl Default for psa_driver_pake_context_t { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } + /// This function clears all data associated with the PSA layer, + /// including the whole key store. + /// This function is not thread safe, it wipes every key slot regardless of + /// state and reader count. It should only be called when no slot is in use. + /// + /// This is an Mbed TLS extension. + pub fn mbedtls_psa_crypto_free(); } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. #[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_mac_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_mac_size: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub __bindgen_padding_0: u64, - pub private_ctx: psa_driver_mac_context_t, +#[derive(Default, Copy, Clone)] +pub struct mbedtls_psa_stats_s { + /// Number of slots containing key material for a volatile key. + pub private_volatile_slots: usize, + /// Number of slots containing key material for a key which is in + /// internal persistent storage. + pub private_persistent_slots: usize, + /// Number of slots containing a reference to a key in a + /// secure element. + pub private_external_slots: usize, + /// Number of slots which are occupied, but do not contain + /// key material yet. + pub private_half_filled_slots: usize, + /// Number of slots that contain cache data. + pub private_cache_slots: usize, + /// Number of slots that are not used for anything. + pub private_empty_slots: usize, + /// Number of slots that are locked. + pub private_locked_slots: usize, + /// Largest key id value among open keys in internal persistent storage. + pub private_max_open_internal_key_id: psa_key_id_t, + /// Largest key id value among open keys in secure elements. + pub private_max_open_external_key_id: psa_key_id_t, } -impl Default for psa_mac_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// \brief Statistics about +/// resource consumption related to the PSA keystore. +/// +/// \note The content of this structure is not part of the stable API and ABI +/// of Mbed TLS and may change arbitrarily from version to version. +pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; +unsafe extern "C" { + /// \brief Get statistics about + /// resource consumption related to the PSA keystore. + /// + /// \note When Mbed TLS is built as part of a service, with isolation + /// between the application and the keystore, the service may or + /// may not expose this function. + pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); } -impl psa_mac_operation_s { - #[inline] - pub fn private_is_sign(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_sign(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_sign_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_sign_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_is_sign: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_is_sign: u32 = unsafe { ::core::mem::transmute(private_is_sign) }; - private_is_sign as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// \brief Inject an initial entropy seed for the random generator into + /// secure storage. + /// + /// This function injects data to be used as a seed for the random generator + /// used by the PSA Crypto implementation. On devices that lack a trusted + /// entropy source (preferably a hardware random number generator), + /// the Mbed PSA Crypto implementation uses this value to seed its + /// random generator. + /// + /// On devices without a trusted entropy source, this function must be + /// called exactly once in the lifetime of the device. On devices with + /// a trusted entropy source, calling this function is optional. + /// In all cases, this function may only be called before calling any + /// other function in the PSA Crypto API, including psa_crypto_init(). + /// + /// When this function returns successfully, it populates a file in + /// persistent storage. Once the file has been created, this function + /// can no longer succeed. + /// + /// If any error occurs, this function does not change the system state. + /// You can call this function again after correcting the reason for the + /// error if possible. + /// + /// \warning This function **can** fail! Callers MUST check the return status. + /// + /// \warning If you use this function, you should use it as part of a + /// factory provisioning process. The value of the injected seed + /// is critical to the security of the device. It must be + /// *secret*, *unpredictable* and (statistically) *unique per device*. + /// You should be generate it randomly using a cryptographically + /// secure random generator seeded from trusted entropy sources. + /// You should transmit it securely to the device and ensure + /// that its value is not leaked or stored anywhere beyond the + /// needs of transmitting it from the point of generation to + /// the call of this function, and erase all copies of the value + /// once this function returns. + /// + /// This is an Mbed TLS extension. + /// + /// \note This function is only available on the following platforms: + /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. + /// Note that you must provide compatible implementations of + /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. + /// * In a client-server integration of PSA Cryptography, on the client side, + /// if the server supports this feature. + /// \param[in] seed Buffer containing the seed value to inject. + /// \param[in] seed_size Size of the \p seed buffer. + /// The size of the seed in bytes must be greater + /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE + /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM + /// in `library/entropy_poll.h` in the Mbed TLS source + /// code. + /// It must be less or equal to + /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. + /// + /// \retval #PSA_SUCCESS + /// The seed value was injected successfully. The random generator + /// of the PSA Crypto implementation is now ready for use. + /// You may now call psa_crypto_init() and use the PSA Crypto + /// implementation. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p seed_size is out of range. + /// \retval #PSA_ERROR_STORAGE_FAILURE + /// There was a failure reading or writing from storage. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The library has already been initialized. It is no longer + /// possible to call this function. + pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_aead_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_key_type: psa_key_type_t, - pub private_ad_remaining: usize, - pub private_body_remaining: usize, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_ctx: psa_driver_aead_context_t, +unsafe extern "C" { + /// External random generator function, implemented by the platform. + /// + /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, + /// this function replaces Mbed TLS's entropy and DRBG modules for all + /// random generation triggered via PSA crypto interfaces. + /// + /// \note This random generator must deliver random numbers with cryptographic + /// quality and high performance. It must supply unpredictable numbers + /// with a uniform distribution. The implementation of this function + /// is responsible for ensuring that the random generator is seeded + /// with sufficient entropy. If you have a hardware TRNG which is slow + /// or delivers non-uniform output, declare it as an entropy source + /// with mbedtls_entropy_add_source() instead of enabling this option. + /// + /// \param[in,out] context Pointer to the random generator context. + /// This is all-bits-zero on the first call + /// and preserved between successive calls. + /// \param[out] output Output buffer. On success, this buffer + /// contains random data with a uniform + /// distribution. + /// \param output_size The size of the \p output buffer in bytes. + /// \param[out] output_length On success, set this value to \p output_size. + /// + /// \retval #PSA_SUCCESS + /// Success. The output buffer contains \p output_size bytes of + /// cryptographic-quality random data, and \c *output_length is + /// set to \p output_size. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY + /// The random generator requires extra entropy and there is no + /// way to obtain entropy under current environment conditions. + /// This error should not happen under normal circumstances since + /// this function is responsible for obtaining as much entropy as + /// it needs. However implementations of this function may return + /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain + /// entropy without blocking indefinitely. + /// \retval #PSA_ERROR_HARDWARE_FAILURE + /// A failure of the random generator hardware that isn't covered + /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. + pub fn mbedtls_psa_external_get_random( + context: *mut mbedtls_psa_external_random_context_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_aead_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +/// A slot number identifying a key in a driver. +/// +/// Values of this type are used to identify built-in keys. +pub type psa_drv_slot_number_t = u64; +unsafe extern "C" { + /// Check if PSA is capable of handling the specified hash algorithm. + /// + /// This means that PSA core was built with the corresponding PSA_WANT_ALG_xxx + /// set and that psa_crypto_init has already been called. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the algorithm. + /// This might be improved in the future. + /// + /// \param hash_alg The hash algorithm. + /// + /// \return 1 if the PSA can handle \p hash_alg, 0 otherwise. + pub fn psa_can_do_hash(hash_alg: psa_algorithm_t) -> ::core::ffi::c_int; } -impl psa_aead_operation_s { - #[inline] - pub fn private_nonce_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_nonce_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_nonce_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_nonce_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_lengths_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_lengths_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(1usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_lengths_set_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 1usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_lengths_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 1usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_ad_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_ad_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_ad_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_ad_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_body_started(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(3usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_body_started(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(3usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_body_started_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 3usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_body_started_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 3usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn private_is_encrypt(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(4usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_is_encrypt(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(4usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_is_encrypt_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 4usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_is_encrypt_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 4usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_nonce_set: ::core::ffi::c_uint, - private_lengths_set: ::core::ffi::c_uint, - private_ad_started: ::core::ffi::c_uint, - private_body_started: ::core::ffi::c_uint, - private_is_encrypt: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_nonce_set: u32 = unsafe { ::core::mem::transmute(private_nonce_set) }; - private_nonce_set as u64 - }); - __bindgen_bitfield_unit.set(1usize, 1u8, { - let private_lengths_set: u32 = unsafe { ::core::mem::transmute(private_lengths_set) }; - private_lengths_set as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_ad_started: u32 = unsafe { ::core::mem::transmute(private_ad_started) }; - private_ad_started as u64 - }); - __bindgen_bitfield_unit.set(3usize, 1u8, { - let private_body_started: u32 = unsafe { ::core::mem::transmute(private_body_started) }; - private_body_started as u64 - }); - __bindgen_bitfield_unit.set(4usize, 1u8, { - let private_is_encrypt: u32 = unsafe { ::core::mem::transmute(private_is_encrypt) }; - private_is_encrypt as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Tell if PSA is ready for this cipher. + /// + /// \note When using the built-in version of the PSA core (i.e. + /// #MBEDTLS_PSA_CRYPTO_C is set), for now, this function only checks + /// the state of the driver subsystem, not the key type and algorithm. + /// This might be improved in the future. + /// + /// \param key_type The key type. + /// \param cipher_alg The cipher algorithm. + /// + /// \return 1 if the PSA can handle \p cipher_alg, 0 otherwise. + pub fn psa_can_do_cipher( + key_type: psa_key_type_t, + cipher_alg: psa_algorithm_t, + ) -> ::core::ffi::c_int; +} +/// \brief Encoding of the application role of PAKE +/// +/// Encodes the application's role in the algorithm is being executed. For more +/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX +/// constants. +pub type psa_pake_role_t = u8; +/// Encoding of input and output indicators for PAKE. +/// +/// Some PAKE algorithms need to exchange more data than just a single key share. +/// This type is for encoding additional input and output data for such +/// algorithms. +pub type psa_pake_step_t = u8; +/// Encoding of the type of the PAKE's primitive. +/// +/// Values defined by this standard will never be in the range 0x80-0xff. +/// Vendors who define additional types must use an encoding in this range. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_primitive_type_t = u8; +/// \brief Encoding of the family of the primitive associated with the PAKE. +/// +/// For more information see the documentation of individual +/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. +pub type psa_pake_family_t = u8; +/// \brief Encoding of the primitive associated with the PAKE. +/// +/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. +pub type psa_pake_primitive_t = u32; +#[repr(C)] +#[derive(Default, Copy, Clone)] +pub struct psa_pake_cipher_suite_s { + pub algorithm: psa_algorithm_t, + pub type_: psa_pake_primitive_type_t, + pub family: psa_pake_family_t, + pub bits: u16, + pub hash: psa_algorithm_t, } #[repr(C)] -#[repr(align(16))] #[derive(Copy, Clone)] -pub struct psa_hkdf_key_derivation_t { - pub private_info: *mut u8, - pub private_info_length: usize, - pub private_offset_in_block: u8, - pub private_block_number: u8, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_output_block: [u8; 64usize], - pub private_prk: [u8; 64usize], - pub __bindgen_padding_0: [u64; 0usize], - pub private_hmac: psa_mac_operation_s, +pub struct psa_crypto_driver_pake_inputs_s { + pub private_password: *mut u8, + pub private_password_len: usize, + pub private_user: *mut u8, + pub private_user_len: usize, + pub private_peer: *mut u8, + pub private_peer_len: usize, + pub private_attributes: psa_key_attributes_t, + pub private_cipher_suite: psa_pake_cipher_suite_s, } -impl Default for psa_hkdf_key_derivation_t { +impl Default for psa_crypto_driver_pake_inputs_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17057,126 +18119,97 @@ impl Default for psa_hkdf_key_derivation_t { } } } -impl psa_hkdf_key_derivation_t { - #[inline] - pub fn private_state(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 2u8) as u32) } - } - #[inline] - pub fn set_private_state(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 2u8, val as u64) - } - } - #[inline] - pub unsafe fn private_state_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 2u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_state_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 2u8, - val as u64, - ) - } - } - #[inline] - pub fn private_info_set(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(2usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_info_set(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(2usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_info_set_raw(this: *const Self) -> ::core::ffi::c_uint { +pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = + 10; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = + 11; +pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; +pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; +pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; +pub const psa_jpake_round_PSA_JPAKE_FIRST: psa_jpake_round = 0; +pub const psa_jpake_round_PSA_JPAKE_SECOND: psa_jpake_round = 1; +pub const psa_jpake_round_PSA_JPAKE_FINISHED: psa_jpake_round = 2; +pub type psa_jpake_round = ::core::ffi::c_uint; +pub use self::psa_jpake_round as psa_jpake_round_t; +pub const psa_jpake_io_mode_PSA_JPAKE_INPUT: psa_jpake_io_mode = 0; +pub const psa_jpake_io_mode_PSA_JPAKE_OUTPUT: psa_jpake_io_mode = 1; +pub type psa_jpake_io_mode = ::core::ffi::c_uint; +pub use self::psa_jpake_io_mode as psa_jpake_io_mode_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_jpake_computation_stage_s { + pub private_round: psa_jpake_round_t, + pub private_io_mode: psa_jpake_io_mode_t, + pub private_inputs: u8, + pub private_outputs: u8, + pub private_step: psa_pake_step_t, +} +impl Default for psa_jpake_computation_stage_s { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 2usize, - 1u8, - ) as u32) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub unsafe fn set_private_info_set_raw(this: *mut Self, val: ::core::ffi::c_uint) { +} +#[repr(C)] +#[derive(Copy, Clone)] +pub struct psa_pake_operation_s { + /// Unique ID indicating which driver got assigned to do the + /// operation. Since driver contexts are driver-specific, swapping + /// drivers halfway through the operation is not supported. + /// ID values are auto-generated in psa_crypto_driver_wrappers.h + /// ID value zero means the context is not valid or not assigned to + /// any driver (i.e. none of the driver contexts are active). + pub private_id: ::core::ffi::c_uint, + pub private_alg: psa_algorithm_t, + pub private_primitive: psa_pake_primitive_t, + pub private_stage: u8, + pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, + pub private_data: psa_pake_operation_s__bindgen_ty_2, +} +#[repr(C)] +#[derive(Copy, Clone)] +pub union psa_pake_operation_s__bindgen_ty_1 { + pub private_dummy: u8, + pub private_jpake: psa_jpake_computation_stage_s, +} +impl Default for psa_pake_operation_s__bindgen_ty_1 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 2usize, - 1u8, - val as u64, - ) + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() } } - #[inline] - pub fn new_bitfield_1( - private_state: ::core::ffi::c_uint, - private_info_set: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 2u8, { - let private_state: u32 = unsafe { ::core::mem::transmute(private_state) }; - private_state as u64 - }); - __bindgen_bitfield_unit.set(2usize, 1u8, { - let private_info_set: u32 = unsafe { ::core::mem::transmute(private_info_set) }; - private_info_set as u64 - }); - __bindgen_bitfield_unit - } -} -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_tls12_ecjpake_to_pms_t { - pub private_data: [u8; 32usize], } -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_INIT: - psa_tls12_prf_key_derivation_state_t = 0; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_SEED_SET: - psa_tls12_prf_key_derivation_state_t = 1; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OTHER_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 2; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_KEY_SET: - psa_tls12_prf_key_derivation_state_t = 3; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_LABEL_SET: - psa_tls12_prf_key_derivation_state_t = 4; -pub const psa_tls12_prf_key_derivation_state_t_PSA_TLS12_PRF_STATE_OUTPUT: - psa_tls12_prf_key_derivation_state_t = 5; -pub type psa_tls12_prf_key_derivation_state_t = ::core::ffi::c_uint; #[repr(C)] #[derive(Copy, Clone)] -pub struct psa_tls12_prf_key_derivation_s { - pub private_left_in_block: u8, - pub private_block_number: u8, - pub private_state: psa_tls12_prf_key_derivation_state_t, - pub private_secret: *mut u8, - pub private_secret_length: usize, - pub private_seed: *mut u8, - pub private_seed_length: usize, - pub private_label: *mut u8, - pub private_label_length: usize, - pub private_other_secret: *mut u8, - pub private_other_secret_length: usize, - pub private_Ai: [u8; 64usize], - pub private_output_block: [u8; 64usize], +pub union psa_pake_operation_s__bindgen_ty_2 { + pub private_ctx: psa_driver_pake_context_t, + pub private_inputs: psa_crypto_driver_pake_inputs_s, } -impl Default for psa_tls12_prf_key_derivation_s { +impl Default for psa_pake_operation_s__bindgen_ty_2 { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +impl Default for psa_pake_operation_s { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -17185,1462 +18218,1629 @@ impl Default for psa_tls12_prf_key_derivation_s { } } } -pub type psa_tls12_prf_key_derivation_t = psa_tls12_prf_key_derivation_s; -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct psa_key_derivation_s { - pub private_alg: psa_algorithm_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_capacity: usize, - pub __bindgen_padding_0: [u64; 0usize], - pub private_ctx: psa_key_derivation_s__bindgen_ty_1, +/// The type of the data structure for PAKE cipher suites. +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; +/// The type of the state data structure for PAKE operations. +/// +/// Before calling any function on a PAKE operation object, the application +/// must initialize it by any of the following means: +/// - Set the structure to all-bits-zero, for example: +/// \code +/// psa_pake_operation_t operation; +/// memset(&operation, 0, sizeof(operation)); +/// \endcode +/// - Initialize the structure to logical zero values, for example: +/// \code +/// psa_pake_operation_t operation = {0}; +/// \endcode +/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, +/// for example: +/// \code +/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; +/// \endcode +/// - Assign the result of the function psa_pake_operation_init() +/// to the structure, for example: +/// \code +/// psa_pake_operation_t operation; +/// operation = psa_pake_operation_init(); +/// \endcode +/// +/// This is an implementation-defined \c struct. Applications should not +/// make any assumptions about the content of this structure. +/// Implementation details can change in future versions without notice. +pub type psa_pake_operation_t = psa_pake_operation_s; +/// The type of input values for PAKE operations. +pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; +/// The type of computation stage for J-PAKE operations. +pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; +unsafe extern "C" { + /// Get the length of the password in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] password_len Password length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + password_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the password from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] buffer Return buffer for password. + /// \param buffer_size Size of the return buffer in bytes. + /// \param[out] buffer_length Actual size of the password in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Password hasn't been set yet. + pub fn psa_crypto_driver_pake_get_password( + inputs: *const psa_crypto_driver_pake_inputs_t, + buffer: *mut u8, + buffer_size: usize, + buffer_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the user id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_len User id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_user_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_len: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Get the length of the peer id in bytes from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_len Peer id length. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + pub fn psa_crypto_driver_pake_get_peer_len( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_len: *mut usize, + ) -> psa_status_t; } -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub union psa_key_derivation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_hkdf: psa_hkdf_key_derivation_t, - pub private_tls12_prf: psa_tls12_prf_key_derivation_t, - pub private_tls12_ecjpake_to_pms: psa_tls12_ecjpake_to_pms_t, +unsafe extern "C" { + /// Get the user id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] user_id User id. + /// \param user_id_size Size of \p user_id in bytes. + /// \param[out] user_id_len Size of the user id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// User id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p user_id is too small. + pub fn psa_crypto_driver_pake_get_user( + inputs: *const psa_crypto_driver_pake_inputs_t, + user_id: *mut u8, + user_id_size: usize, + user_id_len: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s__bindgen_ty_1 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the peer id from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] peer_id Peer id. + /// \param peer_id_size Size of \p peer_id in bytes. + /// \param[out] peer_id_length Size of the peer id in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Peer id hasn't been set yet. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p peer_id is too small. + pub fn psa_crypto_driver_pake_get_peer( + inputs: *const psa_crypto_driver_pake_inputs_t, + peer_id: *mut u8, + peer_id_size: usize, + peer_id_length: *mut usize, + ) -> psa_status_t; } -impl Default for psa_key_derivation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Get the cipher suite from given inputs. + /// + /// \param[in] inputs Operation inputs. + /// \param[out] cipher_suite Return buffer for role. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BAD_STATE + /// Cipher_suite hasn't been set yet. + pub fn psa_crypto_driver_pake_get_cipher_suite( + inputs: *const psa_crypto_driver_pake_inputs_t, + cipher_suite: *mut psa_pake_cipher_suite_t, + ) -> psa_status_t; } -impl psa_key_derivation_s { - #[inline] - pub fn private_can_output_key(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_can_output_key(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_can_output_key_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_can_output_key_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_can_output_key: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_can_output_key: u32 = - unsafe { ::core::mem::transmute(private_can_output_key) }; - private_can_output_key as u64 - }); - __bindgen_bitfield_unit - } +unsafe extern "C" { + /// Set the session information for a password-authenticated key exchange. + /// + /// The sequence of operations to set up a password-authenticated key exchange + /// is as follows: + /// -# Allocate an operation object which will be passed to all the functions + /// listed here. + /// -# Initialize the operation object with one of the methods described in the + /// documentation for #psa_pake_operation_t, e.g. + /// #PSA_PAKE_OPERATION_INIT. + /// -# Call psa_pake_setup() to specify the cipher suite. + /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the + /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs + /// to be called depends on the algorithm in use. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// A typical sequence of calls to perform a password-authenticated key + /// exchange: + /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the + /// key share that needs to be sent to the peer. + /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide + /// the key share that was received from the peer. + /// -# Depending on the algorithm additional calls to psa_pake_output() and + /// psa_pake_input() might be necessary. + /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// If an error occurs at any step after a call to psa_pake_setup(), + /// the operation will need to be reset by a call to psa_pake_abort(). The + /// application may call psa_pake_abort() at any time after the operation + /// has been initialized. + /// + /// After a successful call to psa_pake_setup(), the application must + /// eventually terminate the operation. The following events terminate an + /// operation: + /// - A call to psa_pake_abort(). + /// - A successful call to psa_pake_get_implicit_key(). + /// + /// \param[in,out] operation The operation object to set up. It must have + /// been initialized but not set up yet. + /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully + /// characterizes a PAKE algorithm and determines + /// the algorithm as well.) + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the + /// PAKE primitive in \p cipher_suite is not compatible with the + /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid + /// or not compatible with the PAKE algorithm and primitive. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, + /// or the PAKE primitive in \p cipher_suite is not supported or not + /// compatible with the PAKE algorithm, or the hash algorithm in + /// \p cipher_suite is not supported or not compatible with the PAKE + /// algorithm and primitive. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_setup( + operation: *mut psa_pake_operation_t, + cipher_suite: *const psa_pake_cipher_suite_t, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_key_policy_s { - pub private_usage: psa_key_usage_t, - pub private_alg: psa_algorithm_t, - pub private_alg2: psa_algorithm_t, +unsafe extern "C" { + /// Set the password for a password-authenticated key exchange from key ID. + /// + /// Call this function when the password, or a value derived from the password, + /// is already present in the key store. + /// + /// \param[in,out] operation The operation object to set the password for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the password hasn't + /// been set yet (psa_pake_set_password_key() + /// hasn't been called yet). + /// \param password Identifier of the key holding the password or a + /// value derived from the password (eg. by a + /// memory-hard function). It must remain valid + /// until the operation terminates. It must be of + /// type #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow + /// the usage #PSA_KEY_USAGE_DERIVE. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_HANDLE + /// \p password is not a valid key identifier. + /// \retval #PSA_ERROR_NOT_PERMITTED + /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not + /// permit the \p operation's algorithm. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or + /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with + /// the \p operation's cipher suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The key type or key size of \p password is not supported with the + /// \p operation's cipher suite. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must have been set up.), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_password_key( + operation: *mut psa_pake_operation_t, + password: mbedtls_svc_key_id_t, + ) -> psa_status_t; } -pub type psa_key_policy_t = psa_key_policy_s; -pub type psa_key_bits_t = u16; -/// A mask of flags that can be stored in key attributes. -/// -/// This type is also used internally to store flags in slots. Internal -/// flags are defined in library/psa_crypto_core.h. Internal flags may have -/// the same value as external flags if they are properly handled during -/// key creation and in psa_get_key_attributes. -pub type psa_key_attributes_flag_t = u16; -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_core_key_attributes_t { - pub private_type: psa_key_type_t, - pub private_bits: psa_key_bits_t, - pub private_lifetime: psa_key_lifetime_t, - pub private_id: mbedtls_svc_key_id_t, - pub private_policy: psa_key_policy_t, - pub private_flags: psa_key_attributes_flag_t, +unsafe extern "C" { + /// Set the user ID for a password-authenticated key exchange. + /// + /// Call this function to set the user ID. For PAKE algorithms that associate a + /// user identifier with each side of the session you need to call + /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single + /// user identifier with the session, call psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the user ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the user ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the user ID hasn't + /// been set (psa_pake_set_user() hasn't been + /// called yet). + /// \param[in] user_id The user ID to authenticate with. + /// \param user_id_len Size of the \p user_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p user_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The value of \p user_id is not supported by the implementation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_user( + operation: *mut psa_pake_operation_t, + user_id: *const u8, + user_id_len: usize, + ) -> psa_status_t; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_key_attributes_s { - pub private_core: psa_core_key_attributes_t, - pub private_domain_parameters: *mut ::core::ffi::c_void, - pub private_domain_parameters_size: usize, +unsafe extern "C" { + /// Set the peer ID for a password-authenticated key exchange. + /// + /// Call this function in addition to psa_pake_set_user() for PAKE algorithms + /// that associate a user identifier with each side of the session. For PAKE + /// algorithms that associate a single user identifier with the session, call + /// psa_pake_set_user() only. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \note When using the built-in implementation of #PSA_ALG_JPAKE, the peer ID + /// must be `"client"` (6-byte string) or `"server"` (6-byte string). + /// Third-party drivers may or may not have this limitation. + /// + /// \param[in,out] operation The operation object to set the peer ID for. It + /// must have been set up by psa_pake_setup() and + /// not yet in use (neither psa_pake_output() nor + /// psa_pake_input() has been called yet). It must + /// be on operation for which the peer ID hasn't + /// been set (psa_pake_set_peer() hasn't been + /// called yet). + /// \param[in] peer_id The peer's ID to authenticate. + /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p peer_id is not valid for the \p operation's algorithm and cipher + /// suite. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The algorithm doesn't associate a second identity with the session. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// Calling psa_pake_set_peer() is invalid with the \p operation's + /// algorithm, the operation state is not valid, or the library has not + /// been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_peer( + operation: *mut psa_pake_operation_t, + peer_id: *const u8, + peer_id_len: usize, + ) -> psa_status_t; } -impl Default for psa_key_attributes_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// Set the application role for a password-authenticated key exchange. + /// + /// Not all PAKE algorithms need to differentiate the communicating entities. + /// It is optional to call this function for PAKEs that don't require a role + /// to be specified. For such PAKEs the application role parameter is ignored, + /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// + /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` + /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) + /// for more information. + /// + /// \param[in,out] operation The operation object to specify the + /// application's role for. It must have been set up + /// by psa_pake_setup() and not yet in use (neither + /// psa_pake_output() nor psa_pake_input() has been + /// called yet). It must be on operation for which + /// the application's role hasn't been specified + /// (psa_pake_set_role() hasn't been called yet). + /// \param role A value of type ::psa_pake_role_t indicating the + /// application's role in the PAKE the algorithm + /// that is being set up. For more information see + /// the documentation of \c PSA_PAKE_ROLE_XXX + /// constants. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// The \p role is not a valid PAKE role in the \p operation’s algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// The \p role for this algorithm is not supported or is not valid. + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid, or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_set_role( + operation: *mut psa_pake_operation_t, + role: psa_pake_role_t, + ) -> psa_status_t; } unsafe extern "C" { - /// \brief Set domain parameters for a key. + /// Get output for a step of a password-authenticated key exchange. /// - /// Some key types require additional domain parameters in addition to - /// the key type identifier and the key size. Use this function instead - /// of psa_set_key_type() when you need to specify domain parameters. + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. /// - /// The format for the required domain parameters varies based on the key type. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// - For RSA keys (#PSA_KEY_TYPE_RSA_PUBLIC_KEY or #PSA_KEY_TYPE_RSA_KEY_PAIR), - /// the domain parameter data consists of the public exponent, - /// represented as a big-endian integer with no leading zeros. - /// This information is used when generating an RSA key pair. - /// When importing a key, the public exponent is read from the imported - /// key data and the exponent recorded in the attribute structure is ignored. - /// As an exception, the public exponent 65537 is represented by an empty - /// byte string. - /// - For DSA keys (#PSA_KEY_TYPE_DSA_PUBLIC_KEY or #PSA_KEY_TYPE_DSA_KEY_PAIR), - /// the `Dss-Params` format as defined by RFC 3279 §2.3.2. - /// ``` - /// Dss-Params ::= SEQUENCE { - /// p INTEGER, - /// q INTEGER, - /// g INTEGER - /// } - /// ``` - /// - For Diffie-Hellman key exchange keys - /// (#PSA_KEY_TYPE_DH_PUBLIC_KEY(#PSA_DH_FAMILY_CUSTOM) or - /// #PSA_KEY_TYPE_DH_KEY_PAIR(#PSA_DH_FAMILY_CUSTOM)), the - /// `DomainParameters` format as defined by RFC 3279 §2.3.3. - /// ``` - /// DomainParameters ::= SEQUENCE { - /// p INTEGER, -- odd prime, p=jq +1 - /// g INTEGER, -- generator, g - /// q INTEGER, -- factor of p-1 - /// j INTEGER OPTIONAL, -- subgroup factor - /// validationParams ValidationParams OPTIONAL - /// } - /// ValidationParams ::= SEQUENCE { - /// seed BIT STRING, - /// pgenCounter INTEGER - /// } - /// ``` + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \note This function may allocate memory or other resources. - /// Once you have called this function on an attribute structure, - /// you must call psa_reset_key_attributes() to free these resources. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step of the algorithm for which the output is + /// requested. + /// \param[out] output Buffer where the output is to be written in the + /// format appropriate for this \p step. Refer to + /// the documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param output_size Size of the \p output buffer in bytes. This must + /// be at least #PSA_PAKE_OUTPUT_SIZE(\c alg, \c + /// primitive, \p output_step) where \c alg and + /// \p primitive are the PAKE algorithm and primitive + /// in the operation's cipher suite, and \p step is + /// the output step. + /// + /// \param[out] output_length On success, the number of bytes of the returned + /// output. + /// + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_BUFFER_TOO_SMALL + /// The size of the \p output buffer is too small. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p step is not compatible with the operation's algorithm. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step is not supported with the operation's algorithm. + /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_output( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + output: *mut u8, + output_size: usize, + output_length: *mut usize, + ) -> psa_status_t; +} +unsafe extern "C" { + /// Provide input for a step of a password-authenticated key exchange. + /// + /// Depending on the algorithm being executed, you might need to call this + /// function several times or you might not need to call this at all. + /// + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. + /// If this function returns an error status, the operation enters an error + /// state and must be aborted by calling psa_pake_abort(). /// - /// \param[in,out] attributes Attribute structure where the specified domain - /// parameters will be stored. - /// If this function fails, the content of - /// \p attributes is not modified. - /// \param type Key type (a \c PSA_KEY_TYPE_XXX value). - /// \param[in] data Buffer containing the key domain parameters. - /// The content of this buffer is interpreted - /// according to \p type as described above. - /// \param data_length Size of the \p data buffer in bytes. + /// \param[in,out] operation Active PAKE operation. + /// \param step The step for which the input is provided. + /// \param[in] input Buffer containing the input in the format + /// appropriate for this \p step. Refer to the + /// documentation of the individual + /// \c PSA_PAKE_STEP_XXX constants for more + /// information. + /// \param input_length Size of the \p input buffer in bytes. /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - /// \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription + /// \retval #PSA_SUCCESS + /// Success. + /// \retval #PSA_ERROR_INVALID_SIGNATURE + /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. + /// \retval #PSA_ERROR_INVALID_ARGUMENT + /// \p input_length is not compatible with the \p operation’s algorithm, + /// or the \p input is not valid for the \p operation's algorithm, + /// cipher suite or \p step. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// \p step p is not supported with the \p operation's algorithm, or the + /// \p input is not supported for the \p operation's algorithm, cipher + /// suite or \p step. /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - pub fn psa_set_key_domain_parameters( - attributes: *mut psa_key_attributes_t, - type_: psa_key_type_t, - data: *const u8, - data_length: usize, + /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription + /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription + /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription + /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription + /// \retval #PSA_ERROR_BAD_STATE + /// The operation state is not valid (it must be active, and fully set + /// up, and this call must conform to the algorithm's requirements + /// for ordering of input and output steps), or + /// the library has not been previously initialized by psa_crypto_init(). + /// It is implementation-dependent whether a failure to initialize + /// results in this error code. + pub fn psa_pake_input( + operation: *mut psa_pake_operation_t, + step: psa_pake_step_t, + input: *const u8, + input_length: usize, ) -> psa_status_t; } -/// \brief The context for PSA interruptible hash signing. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_sign_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_sign_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_sign_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_sign_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -/// \brief The context for PSA interruptible hash verification. -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_verify_hash_interruptible_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_ctx: psa_driver_verify_hash_interruptible_context_t, - pub _bitfield_align_1: [u8; 0], - pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>, - pub private_num_ops: u32, -} -impl Default for psa_verify_hash_interruptible_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -impl psa_verify_hash_interruptible_operation_s { - #[inline] - pub fn private_error_occurred(&self) -> ::core::ffi::c_uint { - unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) } - } - #[inline] - pub fn set_private_error_occurred(&mut self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - self._bitfield_1.set(0usize, 1u8, val as u64) - } - } - #[inline] - pub unsafe fn private_error_occurred_raw(this: *const Self) -> ::core::ffi::c_uint { - unsafe { - ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get( - ::core::ptr::addr_of!((*this)._bitfield_1), - 0usize, - 1u8, - ) as u32) - } - } - #[inline] - pub unsafe fn set_private_error_occurred_raw(this: *mut Self, val: ::core::ffi::c_uint) { - unsafe { - let val: u32 = ::core::mem::transmute(val); - <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set( - ::core::ptr::addr_of_mut!((*this)._bitfield_1), - 0usize, - 1u8, - val as u64, - ) - } - } - #[inline] - pub fn new_bitfield_1( - private_error_occurred: ::core::ffi::c_uint, - ) -> __BindgenBitfieldUnit<[u8; 1usize]> { - let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default(); - __bindgen_bitfield_unit.set(0usize, 1u8, { - let private_error_occurred: u32 = - unsafe { ::core::mem::transmute(private_error_occurred) }; - private_error_occurred as u64 - }); - __bindgen_bitfield_unit - } -} -pub type psa_key_handle_t = mbedtls_svc_key_id_t; unsafe extern "C" { - /// Open a handle to an existing persistent key. - /// - /// Open a handle to a persistent key. A key is persistent if it was created - /// with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key - /// always has a nonzero key identifier, set with psa_set_key_id() when - /// creating the key. Implementations may provide additional pre-provisioned - /// keys that can be opened with psa_open_key(). Such keys have an application - /// key identifier in the vendor range, as documented in the description of - /// #psa_key_id_t. + /// Get implicitly confirmed shared secret from a PAKE. /// - /// The application must eventually close the handle with psa_close_key() or - /// psa_destroy_key() to release associated resources. If the application dies - /// without calling one of these functions, the implementation should perform - /// the equivalent of a call to psa_close_key(). + /// At this point there is a cryptographic guarantee that only the authenticated + /// party who used the same password is able to compute the key. But there is no + /// guarantee that the peer is the party it claims to be and was able to do so. /// - /// Some implementations permit an application to open the same key multiple - /// times. If this is successful, each call to psa_open_key() will return a - /// different key handle. + /// That is, the authentication is only implicit. Since the peer is not + /// authenticated yet, no action should be taken yet that assumes that the peer + /// is who it claims to be. For example, do not access restricted files on the + /// peer's behalf until an explicit authentication has succeeded. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function can be called after the key exchange phase of the operation + /// has completed. It imports the shared secret output of the PAKE into the + /// provided derivation operation. The input step + /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key + /// material in the key derivation operation. /// - /// \note Applications that rely on opening a key multiple times will not be - /// portable to implementations that only permit a single key handle to be - /// opened. See also :ref:\`key-handles\`. + /// The exact sequence of calls to perform a password-authenticated key + /// exchange depends on the algorithm in use. Refer to the documentation of + /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type + /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more + /// information. /// + /// When this function returns successfully, \p operation becomes inactive. + /// If this function returns an error status, both \p operation + /// and \c key_derivation operations enter an error state and must be aborted by + /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. /// - /// \param key The persistent identifier of the key. - /// \param[out] handle On success, a handle to the key. + /// \param[in,out] operation Active PAKE operation. + /// \param[out] output A key derivation operation that is ready + /// for an input step of type + /// #PSA_KEY_DERIVATION_INPUT_SECRET. /// /// \retval #PSA_SUCCESS - /// Success. The application can now use the value of `*handle` - /// to access the key. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY - /// The implementation does not have sufficient resources to open the - /// key. This can be due to reaching an implementation limit on the - /// number of open keys, the number of open key handles, or available - /// memory. - /// \retval #PSA_ERROR_DOES_NOT_EXIST - /// There is no persistent key with key identifier \p key. + /// Success. /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p key is not a valid persistent key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The specified key exists, but the application does not have the - /// permission to access it. Note that this specification does not - /// define any way to create such a key, but it may be possible - /// through implementation-specific means. + /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the + /// algorithm in the \p output key derivation operation. + /// \retval #PSA_ERROR_NOT_SUPPORTED + /// Input from a PAKE is not supported by the algorithm in the \p output + /// key derivation operation. + /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription + /// \retval #PSA_ERROR_DATA_INVALID \emptydescription /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). + /// The PAKE operation state is not valid (it must be active, but beyond + /// that validity is specific to the algorithm), or + /// the library has not been previously initialized by psa_crypto_init(), + /// or the state of \p output is not valid for + /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the + /// step is out of order or the application has done this step already + /// and it may not be repeated. /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_open_key(key: mbedtls_svc_key_id_t, handle: *mut psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_get_implicit_key( + operation: *mut psa_pake_operation_t, + output: *mut psa_key_derivation_operation_t, + ) -> psa_status_t; } unsafe extern "C" { - /// Close a key handle. - /// - /// If the handle designates a volatile key, this will destroy the key material - /// and free all associated resources, just like psa_destroy_key(). - /// - /// If this is the last open handle to a persistent key, then closing the handle - /// will free all resources associated with the key in volatile memory. The key - /// data in persistent storage is not affected and can be opened again later - /// with a call to psa_open_key(). + /// Abort a PAKE operation. /// - /// Closing the key handle makes the handle invalid, and the key handle - /// must not be used again by the application. + /// Aborting an operation frees all associated resources except for the \c + /// operation structure itself. Once aborted, the operation object can be reused + /// for another operation by calling psa_pake_setup() again. /// - /// \note This API is not part of the PSA Cryptography API Release 1.0.0 - /// specification. It was defined in the 1.0 Beta 3 version of the - /// specification but was removed in the 1.0.0 released version. This API is - /// kept for the time being to not break applications relying on it. It is not - /// deprecated yet but will be in the near future. + /// This function may be called at any time after the operation + /// object has been initialized as described in #psa_pake_operation_t. /// - /// \note If the key handle was used to set up an active - /// :ref:\`multipart operation \`, then closing the - /// key handle can cause the multipart operation to fail. Applications should - /// maintain the key handle until after the multipart operation has finished. + /// In particular, calling psa_pake_abort() after the operation has been + /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() + /// is safe and has no effect. /// - /// \param handle The key handle to close. - /// If this is \c 0, do nothing and return \c PSA_SUCCESS. + /// \param[in,out] operation The operation to abort. /// /// \retval #PSA_SUCCESS - /// \p handle was a valid handle or \c 0. It is now closed. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p handle is not a valid handle nor \c 0. + /// Success. /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription /// \retval #PSA_ERROR_BAD_STATE /// The library has not been previously initialized by psa_crypto_init(). /// It is implementation-dependent whether a failure to initialize /// results in this error code. - pub fn psa_close_key(handle: psa_key_handle_t) -> psa_status_t; + pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; } -unsafe extern "C" { - /// \brief Library deinitialization. +pub const mbedtls_pk_type_t_MBEDTLS_PK_NONE: mbedtls_pk_type_t = 0; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA: mbedtls_pk_type_t = 1; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY: mbedtls_pk_type_t = 2; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECKEY_DH: mbedtls_pk_type_t = 3; +pub const mbedtls_pk_type_t_MBEDTLS_PK_ECDSA: mbedtls_pk_type_t = 4; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSA_ALT: mbedtls_pk_type_t = 5; +pub const mbedtls_pk_type_t_MBEDTLS_PK_RSASSA_PSS: mbedtls_pk_type_t = 6; +pub const mbedtls_pk_type_t_MBEDTLS_PK_OPAQUE: mbedtls_pk_type_t = 7; +/// \brief Public key types +pub type mbedtls_pk_type_t = ::core::ffi::c_uint; +/// \brief Options for RSASSA-PSS signature verification. +/// See \c mbedtls_rsa_rsassa_pss_verify_ext() +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_rsassa_pss_options { + /// The digest to use for MGF1 in PSS. /// - /// This function clears all data associated with the PSA layer, - /// including the whole key store. + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled and #MBEDTLS_RSA_C is + /// disabled, this must be equal to the \c md_alg argument passed + /// to mbedtls_pk_verify_ext(). In a future version of the library, + /// this constraint may apply whenever #MBEDTLS_USE_PSA_CRYPTO is + /// enabled regardless of the status of #MBEDTLS_RSA_C. + pub mgf1_hash_id: mbedtls_md_type_t, + /// The expected length of the salt, in bytes. This may be + /// #MBEDTLS_RSA_SALT_LEN_ANY to accept any salt length. /// - /// This is an Mbed TLS extension. - pub fn mbedtls_psa_crypto_free(); + /// \note When #MBEDTLS_USE_PSA_CRYPTO is enabled, only + /// #MBEDTLS_RSA_SALT_LEN_ANY is valid. Any other value may be + /// ignored (allowing any salt length). + pub expected_salt_len: ::core::ffi::c_int, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. +impl Default for mbedtls_pk_rsassa_pss_options { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_NONE: mbedtls_pk_debug_type = 0; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_MPI: mbedtls_pk_debug_type = 1; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_ECP: mbedtls_pk_debug_type = 2; +pub const mbedtls_pk_debug_type_MBEDTLS_PK_DEBUG_PSA_EC: mbedtls_pk_debug_type = 3; +/// \brief Types for interfacing with the debug module +pub type mbedtls_pk_debug_type = ::core::ffi::c_uint; +/// \brief Item to send to the debug module #[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct mbedtls_psa_stats_s { - /// Number of slots containing key material for a volatile key. - pub private_volatile_slots: usize, - /// Number of slots containing key material for a key which is in - /// internal persistent storage. - pub private_persistent_slots: usize, - /// Number of slots containing a reference to a key in a - /// secure element. - pub private_external_slots: usize, - /// Number of slots which are occupied, but do not contain - /// key material yet. - pub private_half_filled_slots: usize, - /// Number of slots that contain cache data. - pub private_cache_slots: usize, - /// Number of slots that are not used for anything. - pub private_empty_slots: usize, - /// Number of slots that are locked. - pub private_locked_slots: usize, - /// Largest key id value among open keys in internal persistent storage. - pub private_max_open_internal_key_id: psa_key_id_t, - /// Largest key id value among open keys in secure elements. - pub private_max_open_external_key_id: psa_key_id_t, +#[derive(Copy, Clone)] +pub struct mbedtls_pk_debug_item { + pub private_type: mbedtls_pk_debug_type, + pub private_name: *const ::core::ffi::c_char, + pub private_value: *mut ::core::ffi::c_void, } -/// \brief Statistics about -/// resource consumption related to the PSA keystore. -/// -/// \note The content of this structure is not part of the stable API and ABI -/// of Mbed Crypto and may change arbitrarily from version to version. -pub type mbedtls_psa_stats_t = mbedtls_psa_stats_s; -unsafe extern "C" { - /// \brief Get statistics about - /// resource consumption related to the PSA keystore. - /// - /// \note When Mbed Crypto is built as part of a service, with isolation - /// between the application and the keystore, the service may or - /// may not expose this function. - pub fn mbedtls_psa_get_stats(stats: *mut mbedtls_psa_stats_t); +impl Default for mbedtls_pk_debug_item { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } -unsafe extern "C" { - /// \brief Inject an initial entropy seed for the random generator into - /// secure storage. - /// - /// This function injects data to be used as a seed for the random generator - /// used by the PSA Crypto implementation. On devices that lack a trusted - /// entropy source (preferably a hardware random number generator), - /// the Mbed PSA Crypto implementation uses this value to seed its - /// random generator. - /// - /// On devices without a trusted entropy source, this function must be - /// called exactly once in the lifetime of the device. On devices with - /// a trusted entropy source, calling this function is optional. - /// In all cases, this function may only be called before calling any - /// other function in the PSA Crypto API, including psa_crypto_init(). - /// - /// When this function returns successfully, it populates a file in - /// persistent storage. Once the file has been created, this function - /// can no longer succeed. - /// - /// If any error occurs, this function does not change the system state. - /// You can call this function again after correcting the reason for the - /// error if possible. - /// - /// \warning This function **can** fail! Callers MUST check the return status. - /// - /// \warning If you use this function, you should use it as part of a - /// factory provisioning process. The value of the injected seed - /// is critical to the security of the device. It must be - /// *secret*, *unpredictable* and (statistically) *unique per device*. - /// You should be generate it randomly using a cryptographically - /// secure random generator seeded from trusted entropy sources. - /// You should transmit it securely to the device and ensure - /// that its value is not leaked or stored anywhere beyond the - /// needs of transmitting it from the point of generation to - /// the call of this function, and erase all copies of the value - /// once this function returns. - /// - /// This is an Mbed TLS extension. - /// - /// \note This function is only available on the following platforms: - /// * If the compile-time option MBEDTLS_PSA_INJECT_ENTROPY is enabled. - /// Note that you must provide compatible implementations of - /// mbedtls_nv_seed_read and mbedtls_nv_seed_write. - /// * In a client-server integration of PSA Cryptography, on the client side, - /// if the server supports this feature. - /// \param[in] seed Buffer containing the seed value to inject. - /// \param[in] seed_size Size of the \p seed buffer. - /// The size of the seed in bytes must be greater - /// or equal to both #MBEDTLS_ENTROPY_BLOCK_SIZE - /// and the value of \c MBEDTLS_ENTROPY_MIN_PLATFORM - /// in `library/entropy_poll.h` in the Mbed TLS source - /// code. - /// It must be less or equal to - /// #MBEDTLS_ENTROPY_MAX_SEED_SIZE. - /// - /// \retval #PSA_SUCCESS - /// The seed value was injected successfully. The random generator - /// of the PSA Crypto implementation is now ready for use. - /// You may now call psa_crypto_init() and use the PSA Crypto - /// implementation. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p seed_size is out of range. - /// \retval #PSA_ERROR_STORAGE_FAILURE - /// There was a failure reading or writing from storage. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The library has already been initialized. It is no longer - /// possible to call this function. - pub fn mbedtls_psa_inject_entropy(seed: *const u8, seed_size: usize) -> psa_status_t; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_info_t { + _unused: [u8; 0], } -unsafe extern "C" { - /// \brief Get domain parameters for a key. - /// - /// Get the domain parameters for a key with this function, if any. The format - /// of the domain parameters written to \p data is specified in the - /// documentation for psa_set_key_domain_parameters(). - /// - /// \note This is an experimental extension to the interface. It may change - /// in future versions of the library. - /// - /// \param[in] attributes The key attribute structure to query. - /// \param[out] data On success, the key domain parameters. - /// \param data_size Size of the \p data buffer in bytes. - /// The buffer is guaranteed to be large - /// enough if its size in bytes is at least - /// the value given by - /// PSA_KEY_DOMAIN_PARAMETERS_SIZE(). - /// \param[out] data_length On success, the number of bytes - /// that make up the key domain parameters data. - /// - /// \retval #PSA_SUCCESS \emptydescription - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL \emptydescription - pub fn psa_get_key_domain_parameters( - attributes: *const psa_key_attributes_t, - data: *mut u8, - data_size: usize, - data_length: *mut usize, - ) -> psa_status_t; +/// \brief Public key container +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_pk_context { + ///< Public key information + pub private_pk_info: *const mbedtls_pk_info_t, + ///< Underlying public key context + pub private_pk_ctx: *mut ::core::ffi::c_void, +} +impl Default for mbedtls_pk_context { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } } +pub type mbedtls_pk_restart_ctx = ::core::ffi::c_void; +/// \brief Types for RSA-alt abstraction +pub type mbedtls_pk_rsa_alt_decrypt_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + olen: *mut usize, + input: *const ::core::ffi::c_uchar, + output: *mut ::core::ffi::c_uchar, + output_max_len: usize, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_sign_func = ::core::option::Option< + unsafe extern "C" fn( + ctx: *mut ::core::ffi::c_void, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + md_alg: mbedtls_md_type_t, + hashlen: ::core::ffi::c_uint, + hash: *const ::core::ffi::c_uchar, + sig: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +pub type mbedtls_pk_rsa_alt_key_len_func = + ::core::option::Option usize>; unsafe extern "C" { - /// Convert an ECC curve identifier from the PSA encoding to Mbed TLS. - /// - /// \note This function is provided solely for the convenience of - /// Mbed TLS and may be removed at any time without notice. + /// \brief Return information associated with the given PK type /// - /// \param curve A PSA elliptic curve identifier - /// (`PSA_ECC_FAMILY_xxx`). - /// \param bits The bit-length of a private key on \p curve. - /// \param bits_is_sloppy If true, \p bits may be the bit-length rounded up - /// to the nearest multiple of 8. This allows the caller - /// to infer the exact curve from the length of a key - /// which is supplied as a byte string. + /// \param pk_type PK type to search for. /// - /// \return The corresponding Mbed TLS elliptic curve identifier - /// (`MBEDTLS_ECP_DP_xxx`). - /// \return #MBEDTLS_ECP_DP_NONE if \c curve is not recognized. - /// \return #MBEDTLS_ECP_DP_NONE if \p bits is not - /// correct for \p curve. - pub fn mbedtls_ecc_group_of_psa( - curve: psa_ecc_family_t, - bits: usize, - bits_is_sloppy: ::core::ffi::c_int, - ) -> mbedtls_ecp_group_id; + /// \return The PK info associated with the type or NULL if not found. + pub fn mbedtls_pk_info_from_type(pk_type: mbedtls_pk_type_t) -> *const mbedtls_pk_info_t; } unsafe extern "C" { - /// External random generator function, implemented by the platform. - /// - /// When the compile-time option #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG is enabled, - /// this function replaces Mbed TLS's entropy and DRBG modules for all - /// random generation triggered via PSA crypto interfaces. - /// - /// \note This random generator must deliver random numbers with cryptographic - /// quality and high performance. It must supply unpredictable numbers - /// with a uniform distribution. The implementation of this function - /// is responsible for ensuring that the random generator is seeded - /// with sufficient entropy. If you have a hardware TRNG which is slow - /// or delivers non-uniform output, declare it as an entropy source - /// with mbedtls_entropy_add_source() instead of enabling this option. - /// - /// \param[in,out] context Pointer to the random generator context. - /// This is all-bits-zero on the first call - /// and preserved between successive calls. - /// \param[out] output Output buffer. On success, this buffer - /// contains random data with a uniform - /// distribution. - /// \param output_size The size of the \p output buffer in bytes. - /// \param[out] output_length On success, set this value to \p output_size. + /// \brief Initialize a #mbedtls_pk_context (as NONE). /// - /// \retval #PSA_SUCCESS - /// Success. The output buffer contains \p output_size bytes of - /// cryptographic-quality random data, and \c *output_length is - /// set to \p output_size. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY - /// The random generator requires extra entropy and there is no - /// way to obtain entropy under current environment conditions. - /// This error should not happen under normal circumstances since - /// this function is responsible for obtaining as much entropy as - /// it needs. However implementations of this function may return - /// #PSA_ERROR_INSUFFICIENT_ENTROPY if there is no way to obtain - /// entropy without blocking indefinitely. - /// \retval #PSA_ERROR_HARDWARE_FAILURE - /// A failure of the random generator hardware that isn't covered - /// by #PSA_ERROR_INSUFFICIENT_ENTROPY. - pub fn mbedtls_psa_external_get_random( - context: *mut mbedtls_psa_external_random_context_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \param ctx The context to initialize. + /// This must not be \c NULL. + pub fn mbedtls_pk_init(ctx: *mut mbedtls_pk_context); } -/// A slot number identifying a key in a driver. -/// -/// Values of this type are used to identify built-in keys. -pub type psa_drv_slot_number_t = u64; -/// \brief Encoding of the application role of PAKE -/// -/// Encodes the application's role in the algorithm is being executed. For more -/// information see the documentation of individual \c PSA_PAKE_ROLE_XXX -/// constants. -pub type psa_pake_role_t = u8; -/// Encoding of input and output indicators for PAKE. -/// -/// Some PAKE algorithms need to exchange more data than just a single key share. -/// This type is for encoding additional input and output data for such -/// algorithms. -pub type psa_pake_step_t = u8; -/// Encoding of the type of the PAKE's primitive. -/// -/// Values defined by this standard will never be in the range 0x80-0xff. -/// Vendors who define additional types must use an encoding in this range. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_primitive_type_t = u8; -/// \brief Encoding of the family of the primitive associated with the PAKE. -/// -/// For more information see the documentation of individual -/// \c PSA_PAKE_PRIMITIVE_TYPE_XXX constants. -pub type psa_pake_family_t = u8; -/// \brief Encoding of the primitive associated with the PAKE. -/// -/// For more information see the documentation of the #PSA_PAKE_PRIMITIVE macro. -pub type psa_pake_primitive_t = u32; -/// The type of the data structure for PAKE cipher suites. -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_cipher_suite_t = psa_pake_cipher_suite_s; -/// The type of the state data structure for PAKE operations. -/// -/// Before calling any function on a PAKE operation object, the application -/// must initialize it by any of the following means: -/// - Set the structure to all-bits-zero, for example: -/// \code -/// psa_pake_operation_t operation; -/// memset(&operation, 0, sizeof(operation)); -/// \endcode -/// - Initialize the structure to logical zero values, for example: -/// \code -/// psa_pake_operation_t operation = {0}; -/// \endcode -/// - Initialize the structure to the initializer #PSA_PAKE_OPERATION_INIT, -/// for example: -/// \code -/// psa_pake_operation_t operation = PSA_PAKE_OPERATION_INIT; -/// \endcode -/// - Assign the result of the function psa_pake_operation_init() -/// to the structure, for example: -/// \code -/// psa_pake_operation_t operation; -/// operation = psa_pake_operation_init(); -/// \endcode -/// -/// This is an implementation-defined \c struct. Applications should not -/// make any assumptions about the content of this structure. -/// Implementation details can change in future versions without notice. -pub type psa_pake_operation_t = psa_pake_operation_s; -/// The type of input values for PAKE operations. -pub type psa_crypto_driver_pake_inputs_t = psa_crypto_driver_pake_inputs_s; -/// The type of computation stage for J-PAKE operations. -pub type psa_jpake_computation_stage_t = psa_jpake_computation_stage_s; unsafe extern "C" { - /// Get the length of the password in bytes from given inputs. + /// \brief Free the components of a #mbedtls_pk_context. /// - /// \param[in] inputs Operation inputs. - /// \param[out] password_len Password length. + /// \param ctx The context to clear. It must have been initialized. + /// If this is \c NULL, this function does nothing. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - password_len: *mut usize, - ) -> psa_status_t; + /// \note For contexts that have been set up with + /// mbedtls_pk_setup_opaque(), this does not free the underlying + /// PSA key and you still need to call psa_destroy_key() + /// independently if you want to destroy that key. + pub fn mbedtls_pk_free(ctx: *mut mbedtls_pk_context); } unsafe extern "C" { - /// Get the password from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] buffer Return buffer for password. - /// \param buffer_size Size of the return buffer in bytes. - /// \param[out] buffer_length Actual size of the password in bytes. + /// \brief Initialize a PK context with the information given + /// and allocates the type-specific PK subcontext. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Password hasn't been set yet. - pub fn psa_crypto_driver_pake_get_password( - inputs: *const psa_crypto_driver_pake_inputs_t, - buffer: *mut u8, - buffer_size: usize, - buffer_length: *mut usize, - ) -> psa_status_t; -} -unsafe extern "C" { - /// Get the role from given inputs. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param info Information to use /// - /// \param[in] inputs Operation inputs. - /// \param[out] role Return buffer for role. + /// \return 0 on success, + /// MBEDTLS_ERR_PK_BAD_INPUT_DATA on invalid input, + /// MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Role hasn't been set yet. - pub fn psa_crypto_driver_pake_get_role( - inputs: *const psa_crypto_driver_pake_inputs_t, - role: *mut psa_pake_role_t, - ) -> psa_status_t; + /// \note For contexts holding an RSA-alt key, use + /// \c mbedtls_pk_setup_rsa_alt() instead. + pub fn mbedtls_pk_setup( + ctx: *mut mbedtls_pk_context, + info: *const mbedtls_pk_info_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the user id in bytes from given inputs. + /// \brief Initialize an RSA-alt context /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_len User id length. + /// \param ctx Context to initialize. It must not have been set + /// up yet (type #MBEDTLS_PK_NONE). + /// \param key RSA key pointer + /// \param decrypt_func Decryption function + /// \param sign_func Signing function + /// \param key_len_func Function returning key length in bytes /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_user_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_len: *mut usize, - ) -> psa_status_t; + /// \return 0 on success, or MBEDTLS_ERR_PK_BAD_INPUT_DATA if the + /// context wasn't already initialized as RSA_ALT. + /// + /// \note This function replaces \c mbedtls_pk_setup() for RSA-alt. + pub fn mbedtls_pk_setup_rsa_alt( + ctx: *mut mbedtls_pk_context, + key: *mut ::core::ffi::c_void, + decrypt_func: mbedtls_pk_rsa_alt_decrypt_func, + sign_func: mbedtls_pk_rsa_alt_sign_func, + key_len_func: mbedtls_pk_rsa_alt_key_len_func, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the length of the peer id in bytes from given inputs. + /// \brief Get the size in bits of the underlying key /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_len Peer id length. + /// \param ctx The context to query. It must have been initialized. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - pub fn psa_crypto_driver_pake_get_peer_len( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_len: *mut usize, - ) -> psa_status_t; + /// \return Key size in bits, or 0 on error + pub fn mbedtls_pk_get_bitlen(ctx: *const mbedtls_pk_context) -> usize; } unsafe extern "C" { - /// Get the user id from given inputs. + /// \brief Tell if a context can do the operation given by type /// - /// \param[in] inputs Operation inputs. - /// \param[out] user_id User id. - /// \param user_id_size Size of \p user_id in bytes. - /// \param[out] user_id_len Size of the user id in bytes. + /// \param ctx The context to query. It must have been initialized. + /// \param type The desired type. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// User id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p user_id is too small. - pub fn psa_crypto_driver_pake_get_user( - inputs: *const psa_crypto_driver_pake_inputs_t, - user_id: *mut u8, - user_id_size: usize, - user_id_len: *mut usize, - ) -> psa_status_t; + /// \return 1 if the context can do operations on the given type. + /// \return 0 if the context cannot do the operations on the given + /// type. This is always the case for a context that has + /// been initialized but not set up, or that has been + /// cleared with mbedtls_pk_free(). + pub fn mbedtls_pk_can_do( + ctx: *const mbedtls_pk_context, + type_: mbedtls_pk_type_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the peer id from given inputs. + /// \brief Determine valid PSA attributes that can be used to + /// import a key into PSA. /// - /// \param[in] inputs Operation inputs. - /// \param[out] peer_id Peer id. - /// \param peer_id_size Size of \p peer_id in bytes. - /// \param[out] peer_id_length Size of the peer id in bytes. + /// The attributes determined by this function are suitable + /// for calling mbedtls_pk_import_into_psa() to create + /// a PSA key with the same key material. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Peer id hasn't been set yet. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p peer_id is too small. - pub fn psa_crypto_driver_pake_get_peer( - inputs: *const psa_crypto_driver_pake_inputs_t, - peer_id: *mut u8, - peer_id_size: usize, - peer_id_length: *mut usize, - ) -> psa_status_t; + /// The typical flow of operations involving this function is + /// ``` + /// psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + /// int ret = mbedtls_pk_get_psa_attributes(pk, &attributes); + /// if (ret != 0) ...; // error handling omitted + /// // Tweak attributes if desired + /// psa_key_id_t key_id = 0; + /// ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id); + /// if (ret != 0) ...; // error handling omitted + /// ``` + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param usage A single `PSA_KEY_USAGE_xxx` flag among the following: + /// - #PSA_KEY_USAGE_DECRYPT: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_ENCRYPT as well as + /// #PSA_KEY_USAGE_DECRYPT. + /// - #PSA_KEY_USAGE_DERIVE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type. + /// - #PSA_KEY_USAGE_ENCRYPT: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_SIGN_HASH: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_HASH as well as + /// #PSA_KEY_USAGE_SIGN_HASH. + /// - #PSA_KEY_USAGE_SIGN_MESSAGE: \p pk must contain a + /// key pair. The output \p attributes will contain a + /// key pair type, and the usage policy will allow + /// #PSA_KEY_USAGE_VERIFY_MESSAGE as well as + /// #PSA_KEY_USAGE_SIGN_MESSAGE. + /// - #PSA_KEY_USAGE_VERIFY_HASH: The output + /// \p attributes will contain a public key type. + /// - #PSA_KEY_USAGE_VERIFY_MESSAGE: The output + /// \p attributes will contain a public key type. + /// \param[out] attributes + /// On success, valid attributes to import the key into PSA. + /// - The lifetime and key identifier are unchanged. If the + /// attribute structure was initialized or reset before + /// calling this function, this will result in a volatile + /// key. Call psa_set_key_identifier() before or after this + /// function if you wish to create a persistent key. Call + /// psa_set_key_lifetime() before or after this function if + /// you wish to import the key in a secure element. + /// - The key type and bit-size are determined by the contents + /// of the PK context. If the PK context contains a key + /// pair, the key type can be either a key pair type or + /// the corresponding public key type, depending on + /// \p usage. If the PK context contains a public key, + /// the key type is a public key type. + /// - The key's policy is determined by the key type and + /// the \p usage parameter. The usage always allows + /// \p usage, exporting and copying the key, and + /// possibly other permissions as documented for the + /// \p usage parameter. + /// The permitted algorithm policy is determined as follows + /// based on the #mbedtls_pk_type_t type of \p pk, + /// the chosen \p usage and other factors: + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V15: + /// #PSA_ALG_RSA_PKCS1V15_SIGN(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_PKCS1V15_CRYPT + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA whose underlying + /// #mbedtls_rsa_context has the padding mode + /// #MBEDTLS_RSA_PKCS_V21 and the digest type + /// corresponding to the PSA algorithm \c hash: + /// #PSA_ALG_RSA_PSS_ANY_SALT(#PSA_ALG_ANY_HASH) + /// if \p usage is SIGN/VERIFY, and + /// #PSA_ALG_RSA_OAEP(\c hash) + /// if \p usage is ENCRYPT/DECRYPT. + /// - #MBEDTLS_PK_RSA_ALT: not supported. + /// - #MBEDTLS_PK_ECDSA or #MBEDTLS_PK_ECKEY + /// if \p usage is SIGN/VERIFY: + /// #PSA_ALG_DETERMINISTIC_ECDSA(#PSA_ALG_ANY_HASH) + /// if #MBEDTLS_ECDSA_DETERMINISTIC is enabled, + /// otherwise #PSA_ALG_ECDSA(#PSA_ALG_ANY_HASH). + /// - #MBEDTLS_PK_ECKEY_DH or #MBEDTLS_PK_ECKEY + /// if \p usage is DERIVE: + /// #PSA_ALG_ECDH. + /// - #MBEDTLS_PK_OPAQUE: same as the primary algorithm + /// set for the underlying PSA key, except that + /// sign/decrypt flags are removed if the type is + /// set to a public key type. + /// The underlying key must allow \p usage. + /// Note that the enrollment algorithm set with + /// psa_set_key_enrollment_algorithm() is not copied. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_get_psa_attributes( + pk: *const mbedtls_pk_context, + usage: psa_key_usage_t, + attributes: *mut psa_key_attributes_t, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get the cipher suite from given inputs. - /// - /// \param[in] inputs Operation inputs. - /// \param[out] cipher_suite Return buffer for role. + /// \brief Import a key into the PSA key store. + /// + /// This function is equivalent to calling psa_import_key() + /// with the key material from \p pk. + /// + /// The typical way to use this function is: + /// -# Call mbedtls_pk_get_psa_attributes() to obtain + /// attributes for the given key. + /// -# If desired, modify the attributes, for example: + /// - To create a persistent key, call + /// psa_set_key_identifier() and optionally + /// psa_set_key_lifetime(). + /// - To import only the public part of a key pair: + /// + /// psa_set_key_type(&attributes, + /// PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( + /// psa_get_key_type(&attributes))); + /// - Restrict the key usage if desired. + /// -# Call mbedtls_pk_import_into_psa(). + /// + /// \note This function does not support RSA-alt contexts + /// (set up with mbedtls_pk_setup_rsa_alt()). + /// + /// \param[in] pk The PK context to use. It must have been set up. + /// It can either contain a key pair or just a public key. + /// \param[in] attributes + /// The attributes to use for the new key. They must be + /// compatible with \p pk. In particular, the key type + /// must match the content of \p pk. + /// If \p pk contains a key pair, the key type in + /// attributes can be either the key pair type or the + /// corresponding public key type (to import only the + /// public part). + /// \param[out] key_id + /// On success, the identifier of the newly created key. + /// On error, this is #MBEDTLS_SVC_KEY_ID_INIT. + /// + /// \return 0 on success. + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if \p pk does not contain + /// a key of the type identified in \p attributes. + /// Another error code on other failures. + pub fn mbedtls_pk_import_into_psa( + pk: *const mbedtls_pk_context, + attributes: *const psa_key_attributes_t, + key_id: *mut mbedtls_svc_key_id_t, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Create a PK context starting from a key stored in PSA. + /// This key: + /// - must be exportable and + /// - must be an RSA or EC key pair or public key (FFDH is not supported in PK). + /// + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. + /// + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_sign(), mbedtls_pk_verify(), + /// mbedtls_pk_encrypt(), mbedtls_pk_decrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. + /// * For ECDSA, the choice of deterministic vs randomized will + /// be based on the compile-time setting #MBEDTLS_ECDSA_DETERMINISTIC. + /// * For an RSA key, the output PK context will allow both + /// encrypt/decrypt and sign/verify regardless of the original + /// key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. + /// + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BAD_STATE - /// Cipher_suite hasn't been set yet. - pub fn psa_crypto_driver_pake_get_cipher_suite( - inputs: *const psa_crypto_driver_pake_inputs_t, - cipher_suite: *mut psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the session information for a password-authenticated key exchange. + /// \brief Create a PK context for the public key of a PSA key. /// - /// The sequence of operations to set up a password-authenticated key exchange - /// is as follows: - /// -# Allocate an operation object which will be passed to all the functions - /// listed here. - /// -# Initialize the operation object with one of the methods described in the - /// documentation for #psa_pake_operation_t, e.g. - /// #PSA_PAKE_OPERATION_INIT. - /// -# Call psa_pake_setup() to specify the cipher suite. - /// -# Call \c psa_pake_set_xxx() functions on the operation to complete the - /// setup. The exact sequence of \c psa_pake_set_xxx() functions that needs - /// to be called depends on the algorithm in use. + /// The key must be an RSA or ECC key. It can be either a + /// public key or a key pair, and only the public key is copied. + /// The resulting PK object will be a transparent type: + /// - #MBEDTLS_PK_RSA for RSA keys or + /// - #MBEDTLS_PK_ECKEY for EC keys. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// Once this functions returns the PK object will be completely + /// independent from the original PSA key that it was generated + /// from. + /// Calling mbedtls_pk_verify() or + /// mbedtls_pk_encrypt() on the resulting + /// PK context will perform the corresponding algorithm for that + /// PK context type. /// - /// A typical sequence of calls to perform a password-authenticated key - /// exchange: - /// -# Call psa_pake_output(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to get the - /// key share that needs to be sent to the peer. - /// -# Call psa_pake_input(operation, #PSA_PAKE_STEP_KEY_SHARE, ...) to provide - /// the key share that was received from the peer. - /// -# Depending on the algorithm additional calls to psa_pake_output() and - /// psa_pake_input() might be necessary. - /// -# Call psa_pake_get_implicit_key() for accessing the shared secret. + /// For an RSA key, the output PK context will allow both + /// encrypt and verify regardless of the original key's policy. + /// The original key's policy determines the output key's padding + /// mode: PCKS1 v2.1 is set if the PSA key policy is OAEP or PSS, + /// otherwise PKCS1 v1.5 is set. /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param key_id The key identifier of the key stored in PSA. + /// \param pk The PK context that will be filled. It must be initialized, + /// but not set up. /// - /// If an error occurs at any step after a call to psa_pake_setup(), - /// the operation will need to be reset by a call to psa_pake_abort(). The - /// application may call psa_pake_abort() at any time after the operation - /// has been initialized. + /// \return 0 on success. + /// \return MBEDTLS_ERR_PK_BAD_INPUT_DATA in case the provided input + /// parameters are not correct. + pub fn mbedtls_pk_copy_public_from_psa( + key_id: mbedtls_svc_key_id_t, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature (including padding if relevant). /// - /// After a successful call to psa_pake_setup(), the application must - /// eventually terminate the operation. The following events terminate an - /// operation: - /// - A call to psa_pake_abort(). - /// - A successful call to psa_pake_get_implicit_key(). + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used. + /// This can be #MBEDTLS_MD_NONE if the signature algorithm + /// does not rely on a hash algorithm (non-deterministic + /// ECDSA, RSA PKCS#1 v1.5). + /// For PKCS#1 v1.5, if \p md_alg is #MBEDTLS_MD_NONE, then + /// \p hash is the DigestInfo structure used by RFC 8017 + /// §9.2 steps 3–6. If \p md_alg is a valid hash + /// algorithm then \p hash is the digest itself, and this + /// function calculates the DigestInfo encoding internally. + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Signature to verify + /// \param sig_len Signature length /// - /// \param[in,out] operation The operation object to set up. It must have - /// been initialized but not set up yet. - /// \param[in] cipher_suite The cipher suite to use. (A cipher suite fully - /// characterizes a PAKE algorithm and determines - /// the algorithm as well.) + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (accepting any salt length), + /// depending on the padding mode in the underlying RSA context. + /// For a pk object constructed by parsing, this is PKCS#1 v1.5 + /// by default. Use mbedtls_pk_verify_ext() to explicitly select + /// a different algorithm. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The algorithm in \p cipher_suite is not a PAKE algorithm, or the - /// PAKE primitive in \p cipher_suite is not compatible with the - /// PAKE algorithm, or the hash algorithm in \p cipher_suite is invalid - /// or not compatible with the PAKE algorithm and primitive. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm in \p cipher_suite is not a supported PAKE algorithm, - /// or the PAKE primitive in \p cipher_suite is not supported or not - /// compatible with the PAKE algorithm, or the hash algorithm in - /// \p cipher_suite is not supported or not compatible with the PAKE - /// algorithm and primitive. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_setup( - operation: *mut psa_pake_operation_t, - cipher_suite: *const psa_pake_cipher_suite_t, - ) -> psa_status_t; + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + pub fn mbedtls_pk_verify( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the password for a password-authenticated key exchange from key ID. + /// \brief Restartable version of \c mbedtls_pk_verify() /// - /// Call this function when the password, or a value derived from the password, - /// is already present in the key store. + /// \note Performs the same job as \c mbedtls_pk_verify(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_verify(). /// - /// \param[in,out] operation The operation object to set the password for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the password hasn't - /// been set yet (psa_pake_set_password_key() - /// hasn't been called yet). - /// \param password Identifier of the key holding the password or a - /// value derived from the password (eg. by a - /// memory-hard function). It must remain valid - /// until the operation terminates. It must be of - /// type #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH. It has to allow - /// the usage #PSA_KEY_USAGE_DERIVE. + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_HANDLE - /// \p password is not a valid key identifier. - /// \retval #PSA_ERROR_NOT_PERMITTED - /// The key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does not - /// permit the \p operation's algorithm. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The key type for \p password is not #PSA_KEY_TYPE_PASSWORD or - /// #PSA_KEY_TYPE_PASSWORD_HASH, or \p password is not compatible with - /// the \p operation's cipher suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The key type or key size of \p password is not supported with the - /// \p operation's cipher suite. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must have been set up.), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_password_key( - operation: *mut psa_pake_operation_t, - password: mbedtls_svc_key_id_t, - ) -> psa_status_t; + /// \return See \c mbedtls_pk_verify(), or + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_verify_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Verify signature, with options. + /// (Includes verification of the padding depending on type.) + /// + /// \param type Signature type (inc. possible padding type) to verify + /// \param options Pointer to type-specific options, or NULL + /// \param ctx The PK context to use. It must have been set up. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length or 0 (see notes) + /// \param sig Signature to verify + /// \param sig_len Signature length + /// + /// \return 0 on success (signature is valid), + /// #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be + /// used for this type of signatures, + /// #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid + /// signature in \p sig but its length is less than \p sig_len, + /// or a specific error code. + /// + /// \note If hash_len is 0, then the length associated with md_alg + /// is used instead, or an error returned if it is invalid. + /// + /// \note md_alg may be MBEDTLS_MD_NONE, only if hash_len != 0 + /// + /// \note If type is MBEDTLS_PK_RSASSA_PSS, then options must point + /// to a mbedtls_pk_rsassa_pss_options structure, + /// otherwise it must be NULL. Note that if + /// #MBEDTLS_USE_PSA_CRYPTO is defined, the salt length is not + /// verified as PSA_ALG_RSA_PSS_ANY_SALT is used. + pub fn mbedtls_pk_verify_ext( + type_: mbedtls_pk_type_t, + options: *const ::core::ffi::c_void, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *const ::core::ffi::c_uchar, + sig_len: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the user ID for a password-authenticated key exchange. + /// \brief Make signature, including padding if relevant. /// - /// Call this function to set the user ID. For PAKE algorithms that associate a - /// user identifier with each side of the session you need to call - /// psa_pake_set_peer() as well. For PAKE algorithms that associate a single - /// user identifier with the session, call psa_pake_set_user() only. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or PSS (using the largest possible salt + /// length up to the hash length), depending on the padding mode + /// in the underlying RSA context. For a pk object constructed + /// by parsing, this is PKCS#1 v1.5 by default. Use + /// mbedtls_pk_verify_ext() to explicitly select a different + /// algorithm. /// - /// \param[in,out] operation The operation object to set the user ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the user ID hasn't - /// been set (psa_pake_set_user() hasn't been - /// called yet). - /// \param[in] user_id The user ID to authenticate with. - /// (temporary limitation: "client" or "server" only) - /// \param user_id_len Size of the \p user_id buffer in bytes. + /// \return 0 on success, or a specific error code. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The value of \p user_id is not supported by the implementation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_user( - operation: *mut psa_pake_operation_t, - user_id: *const u8, - user_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the peer ID for a password-authenticated key exchange. + /// \brief Make signature given a signature type. /// - /// Call this function in addition to psa_pake_set_user() for PAKE algorithms - /// that associate a user identifier with each side of the session. For PAKE - /// algorithms that associate a single user identifier with the session, call - /// psa_pake_set_user() only. + /// \param pk_type Signature type. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \return 0 on success, or a specific error code. /// - /// \param[in,out] operation The operation object to set the peer ID for. It - /// must have been set up by psa_pake_setup() and - /// not yet in use (neither psa_pake_output() nor - /// psa_pake_input() has been called yet). It must - /// be on operation for which the peer ID hasn't - /// been set (psa_pake_set_peer() hasn't been - /// called yet). - /// \param[in] peer_id The peer's ID to authenticate. - /// (temporary limitation: "client" or "server" only) - /// \param peer_id_len Size of the \p peer_id buffer in bytes. + /// \note When \p pk_type is #MBEDTLS_PK_RSASSA_PSS, + /// see #PSA_ALG_RSA_PSS for a description of PSS options used. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p user_id is not valid for the \p operation's algorithm and cipher - /// suite. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The algorithm doesn't associate a second identity with the session. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// Calling psa_pake_set_peer() is invalid with the \p operation's - /// algorithm, the operation state is not valid, or the library has not - /// been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_peer( - operation: *mut psa_pake_operation_t, - peer_id: *const u8, - peer_id_len: usize, - ) -> psa_status_t; + /// \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0. + /// For ECDSA, md_alg may never be MBEDTLS_MD_NONE. + pub fn mbedtls_pk_sign_ext( + pk_type: mbedtls_pk_type_t, + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Set the application role for a password-authenticated key exchange. + /// \brief Restartable version of \c mbedtls_pk_sign() /// - /// Not all PAKE algorithms need to differentiate the communicating entities. - /// It is optional to call this function for PAKEs that don't require a role - /// to be specified. For such PAKEs the application role parameter is ignored, - /// or #PSA_PAKE_ROLE_NONE can be passed as \c role. + /// \note Performs the same job as \c mbedtls_pk_sign(), but can + /// return early and restart according to the limit set with + /// \c mbedtls_ecp_set_max_ops() to reduce blocking for ECC + /// operations. For RSA, same as \c mbedtls_pk_sign(). /// - /// Refer to the documentation of individual PAKE algorithm types (`PSA_ALG_XXX` - /// values of type ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) - /// for more information. + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param md_alg Hash algorithm used (see notes for mbedtls_pk_sign()) + /// \param hash Hash of the message to sign + /// \param hash_len Hash length + /// \param sig Place to write the signature. + /// It must have enough room for the signature. + /// #MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. + /// You may use a smaller buffer if it is large enough + /// given the key type. + /// \param sig_size The size of the \p sig buffer in bytes. + /// \param sig_len On successful return, + /// the number of bytes written to \p sig. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// \param rs_ctx Restart context (NULL to disable restart) /// - /// \param[in,out] operation The operation object to specify the - /// application's role for. It must have been set up - /// by psa_pake_setup() and not yet in use (neither - /// psa_pake_output() nor psa_pake_input() has been - /// called yet). It must be on operation for which - /// the application's role hasn't been specified - /// (psa_pake_set_role() hasn't been called yet). - /// \param role A value of type ::psa_pake_role_t indicating the - /// application's role in the PAKE the algorithm - /// that is being set up. For more information see - /// the documentation of \c PSA_PAKE_ROLE_XXX - /// constants. + /// \return See \c mbedtls_pk_sign(). + /// \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of + /// operations was reached: see \c mbedtls_ecp_set_max_ops(). + pub fn mbedtls_pk_sign_restartable( + ctx: *mut mbedtls_pk_context, + md_alg: mbedtls_md_type_t, + hash: *const ::core::ffi::c_uchar, + hash_len: usize, + sig: *mut ::core::ffi::c_uchar, + sig_size: usize, + sig_len: *mut usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + rs_ctx: *mut mbedtls_pk_restart_ctx, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Decrypt message (including padding if relevant). /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// The \p role is not a valid PAKE role in the \p operation’s algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// The \p role for this algorithm is not supported or is not valid. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid, or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_set_role( - operation: *mut psa_pake_operation_t, - role: psa_pake_role_t, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been set up + /// with a private key. + /// \param input Input to decrypt + /// \param ilen Input size + /// \param output Decrypted output + /// \param olen Decrypted message length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter + /// + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. + /// + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_decrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Get output for a step of a password-authenticated key exchange. + /// \brief Encrypt message (including padding if relevant). /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been set up. + /// \param input Message to encrypt + /// \param ilen Message size + /// \param output Encrypted output + /// \param olen Encrypted output length + /// \param osize Size of the output buffer + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is + /// either PKCS#1 v1.5 or OAEP, depending on the padding mode in + /// the underlying RSA context. For a pk object constructed by + /// parsing, this is PKCS#1 v1.5 by default. /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \note \p f_rng is used for padding generation. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step of the algorithm for which the output is - /// requested. - /// \param[out] output Buffer where the output is to be written in the - /// format appropriate for this \p step. Refer to - /// the documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param output_size Size of the \p output buffer in bytes. This must - /// be at least #PSA_PAKE_OUTPUT_SIZE(\p alg, \p - /// primitive, \p step) where \p alg and - /// \p primitive are the PAKE algorithm and primitive - /// in the operation's cipher suite, and \p step is - /// the output step. + /// \return 0 on success, or a specific error code. + pub fn mbedtls_pk_encrypt( + ctx: *mut mbedtls_pk_context, + input: *const ::core::ffi::c_uchar, + ilen: usize, + output: *mut ::core::ffi::c_uchar, + olen: *mut usize, + osize: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Check if a public-private pair of keys matches. /// - /// \param[out] output_length On success, the number of bytes of the returned - /// output. + /// \param pub Context holding a public key. + /// \param prv Context holding a private (and public) key. + /// \param f_rng RNG function, must not be \c NULL. + /// \param p_rng RNG parameter /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_BUFFER_TOO_SMALL - /// The size of the \p output buffer is too small. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p step is not compatible with the operation's algorithm. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step is not supported with the operation's algorithm. - /// \retval #PSA_ERROR_INSUFFICIENT_ENTROPY \emptydescription - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_output( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - output: *mut u8, - output_size: usize, - output_length: *mut usize, - ) -> psa_status_t; + /// \return \c 0 on success (keys were checked and match each other). + /// \return #MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the keys could not + /// be checked - in that case they may or may not match. + /// \return #MBEDTLS_ERR_PK_BAD_INPUT_DATA if a context is invalid. + /// \return Another non-zero value if the keys do not match. + pub fn mbedtls_pk_check_pair( + pub_: *const mbedtls_pk_context, + prv: *const mbedtls_pk_context, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Provide input for a step of a password-authenticated key exchange. + /// \brief Export debug information /// - /// Depending on the algorithm being executed, you might need to call this - /// function several times or you might not need to call this at all. + /// \param ctx The PK context to use. It must have been initialized. + /// \param items Place to write debug items /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \return 0 on success or MBEDTLS_ERR_PK_BAD_INPUT_DATA + pub fn mbedtls_pk_debug( + ctx: *const mbedtls_pk_context, + items: *mut mbedtls_pk_debug_item, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Access the type name /// - /// If this function returns an error status, the operation enters an error - /// state and must be aborted by calling psa_pake_abort(). + /// \param ctx The PK context to use. It must have been initialized. /// - /// \param[in,out] operation Active PAKE operation. - /// \param step The step for which the input is provided. - /// \param[in] input Buffer containing the input in the format - /// appropriate for this \p step. Refer to the - /// documentation of the individual - /// \c PSA_PAKE_STEP_XXX constants for more - /// information. - /// \param input_length Size of the \p input buffer in bytes. + /// \return Type name on success, or "invalid PK" + pub fn mbedtls_pk_get_name(ctx: *const mbedtls_pk_context) -> *const ::core::ffi::c_char; +} +unsafe extern "C" { + /// \brief Get the key type /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_SIGNATURE - /// The verification fails for a #PSA_PAKE_STEP_ZK_PROOF input step. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// \p is not compatible with the \p operation’s algorithm, or the - /// \p input is not valid for the \p operation's algorithm, cipher suite - /// or \p step. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// \p step p is not supported with the \p operation's algorithm, or the - /// \p input is not supported for the \p operation's algorithm, cipher - /// suite or \p step. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The operation state is not valid (it must be active, and fully set - /// up, and this call must conform to the algorithm's requirements - /// for ordering of input and output steps), or - /// the library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_input( - operation: *mut psa_pake_operation_t, - step: psa_pake_step_t, - input: *const u8, - input_length: usize, - ) -> psa_status_t; + /// \param ctx The PK context to use. It must have been initialized. + /// + /// \return Type on success. + /// \return #MBEDTLS_PK_NONE for a context that has not been set up. + pub fn mbedtls_pk_get_type(ctx: *const mbedtls_pk_context) -> mbedtls_pk_type_t; } unsafe extern "C" { - /// Get implicitly confirmed shared secret from a PAKE. + /// \ingroup pk_module */ + ////** + /// \brief Parse a private key in PEM or DER format /// - /// At this point there is a cryptographic guarantee that only the authenticated - /// party who used the same password is able to compute the key. But there is no - /// guarantee that the peer is the party it claims to be and was able to do so. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// That is, the authentication is only implicit. Since the peer is not - /// authenticated yet, no action should be taken yet that assumes that the peer - /// is who it claims to be. For example, do not access restricted files on the - /// peer's behalf until an explicit authentication has succeeded. + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// \param pwd Optional password for decryption. + /// Pass \c NULL if expecting a non-encrypted key. + /// Pass a string of \p pwdlen bytes if expecting an encrypted + /// key; a non-encrypted key will also be accepted. + /// The empty password is not supported. + /// \param pwdlen Size of the password in bytes. + /// Ignored if \p pwd is \c NULL. + /// \param f_rng RNG function, must not be \c NULL. Used for blinding. + /// \param p_rng RNG parameter /// - /// This function can be called after the key exchange phase of the operation - /// has completed. It imports the shared secret output of the PAKE into the - /// provided derivation operation. The input step - /// #PSA_KEY_DERIVATION_INPUT_SECRET is used when placing the shared key - /// material in the key derivation operation. + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). /// - /// The exact sequence of calls to perform a password-authenticated key - /// exchange depends on the algorithm in use. Refer to the documentation of - /// individual PAKE algorithm types (`PSA_ALG_XXX` values of type - /// ::psa_algorithm_t such that #PSA_ALG_IS_PAKE(\c alg) is true) for more - /// information. + /// \note The key is also checked for correctness. /// - /// When this function returns successfully, \p operation becomes inactive. - /// If this function returns an error status, both \p operation - /// and \p key_derivation operations enter an error state and must be aborted by - /// calling psa_pake_abort() and psa_key_derivation_abort() respectively. + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + f_rng: mbedtls_f_rng_t, + p_rng: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \ingroup pk_module */ + ////** + /// \brief Parse a public key in PEM or DER format /// - /// \param[in,out] operation Active PAKE operation. - /// \param[out] output A key derivation operation that is ready - /// for an input step of type - /// #PSA_KEY_DERIVATION_INPUT_SECRET. + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_INVALID_ARGUMENT - /// #PSA_KEY_DERIVATION_INPUT_SECRET is not compatible with the - /// algorithm in the \p output key derivation operation. - /// \retval #PSA_ERROR_NOT_SUPPORTED - /// Input from a PAKE is not supported by the algorithm in the \p output - /// key derivation operation. - /// \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - /// \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - /// \retval #PSA_ERROR_DATA_INVALID \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The PAKE operation state is not valid (it must be active, but beyond - /// that validity is specific to the algorithm), or - /// the library has not been previously initialized by psa_crypto_init(), - /// or the state of \p output is not valid for - /// the #PSA_KEY_DERIVATION_INPUT_SECRET step. This can happen if the - /// step is out of order or the application has done this step already - /// and it may not be repeated. - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_get_implicit_key( - operation: *mut psa_pake_operation_t, - output: *mut psa_key_derivation_operation_t, - ) -> psa_status_t; + /// \param ctx The PK context to fill. It must have been initialized + /// but not set up. + /// \param key Input buffer to parse. + /// The buffer must contain the input exactly, with no + /// extra trailing material. For PEM, the buffer must + /// contain a null-terminated string. + /// \param keylen Size of \b key in bytes. + /// For PEM data, this includes the terminating null byte, + /// so \p keylen must be equal to `strlen(key) + 1`. + /// + /// \note On entry, ctx must be empty, either freshly initialised + /// with mbedtls_pk_init() or reset with mbedtls_pk_free(). If you need a + /// specific key type, check the result with mbedtls_pk_can_do(). + /// + /// \note For compressed points, see #MBEDTLS_ECP_PF_COMPRESSED for + /// limitations. + /// + /// \note The key is also checked for correctness. + /// + /// \return 0 if successful, or a specific PK or PEM error code + pub fn mbedtls_pk_parse_public_key( + ctx: *mut mbedtls_pk_context, + key: *const ::core::ffi::c_uchar, + keylen: usize, + ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// Abort a PAKE operation. + /// \brief Write a private key to a PKCS#1 or SEC1 DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// Aborting an operation frees all associated resources except for the \c - /// operation structure itself. Once aborted, the operation object can be reused - /// for another operation by calling psa_pake_setup() again. + /// \param ctx PK context which must contain a valid private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// This function may be called at any time after the operation - /// object has been initialized as described in #psa_pake_operation_t. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_key_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a SubjectPublicKeyInfo DER structure + /// Note: data is written at the end of the buffer! Use the + /// return value to determine where you should start + /// using the buffer /// - /// In particular, calling psa_pake_abort() after the operation has been - /// terminated by a call to psa_pake_abort() or psa_pake_get_implicit_key() - /// is safe and has no effect. + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf buffer to write to + /// \param size size of the buffer /// - /// \param[in,out] operation The operation to abort. + /// \return length of data written if successful, or a specific + /// error code + pub fn mbedtls_pk_write_pubkey_der( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Write a public key to a PEM string /// - /// \retval #PSA_SUCCESS - /// Success. - /// \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription - /// \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription - /// \retval #PSA_ERROR_BAD_STATE - /// The library has not been previously initialized by psa_crypto_init(). - /// It is implementation-dependent whether a failure to initialize - /// results in this error code. - pub fn psa_pake_abort(operation: *mut psa_pake_operation_t) -> psa_status_t; + /// \param ctx PK context which must contain a valid public or private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_pubkey_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Default, Copy, Clone)] -pub struct psa_pake_cipher_suite_s { - pub algorithm: psa_algorithm_t, - pub type_: psa_pake_primitive_type_t, - pub family: psa_pake_family_t, - pub bits: u16, - pub hash: psa_algorithm_t, +unsafe extern "C" { + /// \brief Write a private key to a PKCS#1 or SEC1 PEM string + /// + /// \param ctx PK context which must contain a valid private key. + /// \param buf Buffer to write to. The output includes a + /// terminating null byte. + /// \param size Size of the buffer in bytes. + /// + /// \return 0 if successful, or a specific error code + pub fn mbedtls_pk_write_key_pem( + ctx: *const mbedtls_pk_context, + buf: *mut ::core::ffi::c_uchar, + size: usize, + ) -> ::core::ffi::c_int; } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_crypto_driver_pake_inputs_s { - pub private_password: *mut u8, - pub private_password_len: usize, - pub private_role: psa_pake_role_t, - pub private_user: *mut u8, - pub private_user_len: usize, - pub private_peer: *mut u8, - pub private_peer_len: usize, - pub private_attributes: psa_key_attributes_t, - pub private_cipher_suite: psa_pake_cipher_suite_t, +unsafe extern "C" { + /// \brief Parse a SubjectPublicKeyInfo DER structure + /// + /// \param p the position in the ASN.1 data + /// \param end end of the buffer + /// \param pk The PK context to fill. It must have been initialized + /// but not set up. + /// + /// \return 0 if successful, or a specific PK error code + pub fn mbedtls_pk_parse_subpubkey( + p: *mut *mut ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + pk: *mut mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -impl Default for psa_crypto_driver_pake_inputs_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + /// \brief Write a subjectPublicKey to ASN.1 data + /// Note: function works backwards in data buffer + /// + /// \param p reference to current position pointer + /// \param start start of the buffer (for bounds-checking) + /// \param key PK context which must contain a valid public or private key. + /// + /// \return the length written or a negative error code + pub fn mbedtls_pk_write_pubkey( + p: *mut *mut ::core::ffi::c_uchar, + start: *mut ::core::ffi::c_uchar, + key: *const mbedtls_pk_context, + ) -> ::core::ffi::c_int; } -pub const psa_jpake_step_PSA_PAKE_STEP_INVALID: psa_jpake_step = 0; -pub const psa_jpake_step_PSA_PAKE_STEP_X1_X2: psa_jpake_step = 1; -pub const psa_jpake_step_PSA_PAKE_STEP_X2S: psa_jpake_step = 2; -pub const psa_jpake_step_PSA_PAKE_STEP_DERIVE: psa_jpake_step = 3; -pub type psa_jpake_step = ::core::ffi::c_uint; -pub use self::psa_jpake_step as psa_jpake_step_t; -pub const psa_jpake_state_PSA_PAKE_STATE_INVALID: psa_jpake_state = 0; -pub const psa_jpake_state_PSA_PAKE_STATE_SETUP: psa_jpake_state = 1; -pub const psa_jpake_state_PSA_PAKE_STATE_READY: psa_jpake_state = 2; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X1_X2: psa_jpake_state = 3; -pub const psa_jpake_state_PSA_PAKE_OUTPUT_X2S: psa_jpake_state = 4; -pub const psa_jpake_state_PSA_PAKE_INPUT_X1_X2: psa_jpake_state = 5; -pub const psa_jpake_state_PSA_PAKE_INPUT_X4S: psa_jpake_state = 6; -pub type psa_jpake_state = ::core::ffi::c_uint; -pub use self::psa_jpake_state as psa_jpake_state_t; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_INVALID: psa_jpake_sequence = 0; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_KEY_SHARE: psa_jpake_sequence = 1; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PUBLIC: psa_jpake_sequence = 2; -pub const psa_jpake_sequence_PSA_PAKE_X1_STEP_ZK_PROOF: psa_jpake_sequence = 3; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_KEY_SHARE: psa_jpake_sequence = 4; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PUBLIC: psa_jpake_sequence = 5; -pub const psa_jpake_sequence_PSA_PAKE_X2_STEP_ZK_PROOF: psa_jpake_sequence = 6; -pub const psa_jpake_sequence_PSA_PAKE_SEQ_END: psa_jpake_sequence = 7; -pub type psa_jpake_sequence = ::core::ffi::c_uint; -pub use self::psa_jpake_sequence as psa_jpake_sequence_t; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_STEP_INVALID: psa_crypto_driver_pake_step = 0; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 1; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 2; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X1_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 3; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 4; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 5; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 6; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = 7; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = 8; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X2S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 9; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_KEY_SHARE: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_NONE: mbedtls_key_exchange_type_t = 0; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA: mbedtls_key_exchange_type_t = 1; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_RSA: mbedtls_key_exchange_type_t = 2; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_RSA: mbedtls_key_exchange_type_t = + 3; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA: + mbedtls_key_exchange_type_t = 4; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_PSK: mbedtls_key_exchange_type_t = 5; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_DHE_PSK: mbedtls_key_exchange_type_t = 6; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_RSA_PSK: mbedtls_key_exchange_type_t = 7; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDHE_PSK: mbedtls_key_exchange_type_t = + 8; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_RSA: mbedtls_key_exchange_type_t = + 9; +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA: mbedtls_key_exchange_type_t = 10; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PUBLIC: psa_crypto_driver_pake_step = +pub const mbedtls_key_exchange_type_t_MBEDTLS_KEY_EXCHANGE_ECJPAKE: mbedtls_key_exchange_type_t = 11; -pub const psa_crypto_driver_pake_step_PSA_JPAKE_X4S_STEP_ZK_PROOF: psa_crypto_driver_pake_step = 12; -pub type psa_crypto_driver_pake_step = ::core::ffi::c_uint; -pub use self::psa_crypto_driver_pake_step as psa_crypto_driver_pake_step_t; -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_jpake_computation_stage_s { - pub private_state: psa_jpake_state_t, - pub private_sequence: psa_jpake_sequence_t, - pub private_input_step: psa_jpake_step_t, - pub private_output_step: psa_jpake_step_t, -} -impl Default for psa_jpake_computation_stage_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -#[repr(C)] -#[derive(Copy, Clone)] -pub struct psa_pake_operation_s { - /// Unique ID indicating which driver got assigned to do the - /// operation. Since driver contexts are driver-specific, swapping - /// drivers halfway through the operation is not supported. - /// ID values are auto-generated in psa_crypto_driver_wrappers.h - /// ID value zero means the context is not valid or not assigned to - /// any driver (i.e. none of the driver contexts are active). - pub private_id: ::core::ffi::c_uint, - pub private_alg: psa_algorithm_t, - pub private_stage: u8, - pub private_computation_stage: psa_pake_operation_s__bindgen_ty_1, - pub private_data: psa_pake_operation_s__bindgen_ty_2, -} +pub type mbedtls_key_exchange_type_t = ::core::ffi::c_uint; +/// \brief This structure is used for storing ciphersuite information +/// +/// \note members are defined using integral types instead of enums +/// in order to pack structure and reduce memory usage by internal +/// \c ciphersuite_definitions[] #[repr(C)] #[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_1 { - pub private_dummy: u8, - pub private_jpake: psa_jpake_computation_stage_t, +pub struct mbedtls_ssl_ciphersuite_t { + pub private_id: ::core::ffi::c_int, + pub private_name: *const ::core::ffi::c_char, + pub private_cipher: u8, + pub private_mac: u8, + pub private_key_exchange: u8, + pub private_flags: u8, + pub private_min_tls_version: u16, + pub private_max_tls_version: u16, } -impl Default for psa_pake_operation_s__bindgen_ty_1 { +impl Default for mbedtls_ssl_ciphersuite_t { fn default() -> Self { let mut s = ::core::mem::MaybeUninit::::uninit(); unsafe { @@ -18649,29 +19849,23 @@ impl Default for psa_pake_operation_s__bindgen_ty_1 { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub union psa_pake_operation_s__bindgen_ty_2 { - pub private_ctx: psa_driver_pake_context_t, - pub private_inputs: psa_crypto_driver_pake_inputs_t, +unsafe extern "C" { + pub fn mbedtls_ssl_list_ciphersuites() -> *const ::core::ffi::c_int; } -impl Default for psa_pake_operation_s__bindgen_ty_2 { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_string( + ciphersuite_name: *const ::core::ffi::c_char, + ) -> *const mbedtls_ssl_ciphersuite_t; } -impl Default for psa_pake_operation_s { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_from_id( + ciphersuite_id: ::core::ffi::c_int, + ) -> *const mbedtls_ssl_ciphersuite_t; +} +unsafe extern "C" { + pub fn mbedtls_ssl_ciphersuite_get_cipher_key_bitlen( + info: *const mbedtls_ssl_ciphersuite_t, + ) -> usize; } /// Type-length-value structure that allows for ASN1 using DER. pub type mbedtls_x509_buf = mbedtls_asn1_buf; @@ -18682,6 +19876,23 @@ pub type mbedtls_x509_bitstring = mbedtls_asn1_bitstring; pub type mbedtls_x509_name = mbedtls_asn1_named_data; /// Container for a sequence of ASN.1 items pub type mbedtls_x509_sequence = mbedtls_asn1_sequence; +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_authority { + pub keyIdentifier: mbedtls_x509_buf, + pub authorityCertIssuer: mbedtls_x509_sequence, + pub authorityCertSerialNumber: mbedtls_x509_buf, + pub raw: mbedtls_x509_buf, +} +impl Default for mbedtls_x509_authority { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} /// Container for date and time (precision in seconds). #[repr(C)] #[derive(Default, Copy, Clone)] @@ -18773,9 +19984,9 @@ pub struct mbedtls_x509_subject_alternative_name { #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_x509_subject_alternative_name__bindgen_ty_1 { - ///< The otherName supported type. pub other_name: mbedtls_x509_san_other_name, - ///< The buffer for the unconstructed types. Only rfc822Name, dnsName and uniformResourceIdentifier are currently supported + pub directory_name: mbedtls_x509_name, + ///< The buffer for the unstructured types. rfc822Name, dnsName and uniformResourceIdentifier are currently supported. pub unstructured_name: mbedtls_x509_buf, } impl Default for mbedtls_x509_subject_alternative_name__bindgen_ty_1 { @@ -18796,6 +20007,21 @@ impl Default for mbedtls_x509_subject_alternative_name { } } } +#[repr(C)] +#[derive(Copy, Clone)] +pub struct mbedtls_x509_san_list { + pub node: mbedtls_x509_subject_alternative_name, + pub next: *mut mbedtls_x509_san_list, +} +impl Default for mbedtls_x509_san_list { + fn default() -> Self { + let mut s = ::core::mem::MaybeUninit::::uninit(); + unsafe { + ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); + s.assume_init() + } + } +} unsafe extern "C" { /// \brief Store the certificate DN in printable form into buf; /// no more than size characters will be written. @@ -18812,6 +20038,26 @@ unsafe extern "C" { dn: *const mbedtls_x509_name, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Convert the certificate DN string \p name into + /// a linked list of mbedtls_x509_name (equivalent to + /// mbedtls_asn1_named_data). + /// + /// \note This function allocates a linked list, and places the head + /// pointer in \p head. This list must later be freed by a + /// call to mbedtls_asn1_free_named_data_list(). + /// + /// \param[out] head Address in which to store the pointer to the head of the + /// allocated list of mbedtls_x509_name. Must point to NULL on + /// entry. + /// \param[in] name The string representation of a DN to convert + /// + /// \return 0 on success, or a negative error code. + pub fn mbedtls_x509_string_to_names( + head: *mut *mut mbedtls_asn1_named_data, + name: *const ::core::ffi::c_char, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Store the certificate serial in printable form into buf; /// no more than size characters will be written. @@ -18828,6 +20074,20 @@ unsafe extern "C" { serial: *const mbedtls_x509_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Compare pair of mbedtls_x509_time. + /// + /// \param t1 mbedtls_x509_time to compare + /// \param t2 mbedtls_x509_time to compare + /// + /// \return < 0 if t1 is before t2 + /// 0 if t1 equals t2 + /// > 0 if t1 is after t2 + pub fn mbedtls_x509_time_cmp( + t1: *const mbedtls_x509_time, + t2: *const mbedtls_x509_time, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Check a given mbedtls_x509_time against the system time /// and tell if it's in the past. @@ -18856,21 +20116,25 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief This function parses an item in the SubjectAlternativeNames - /// extension. + /// extension. Please note that this function might allocate + /// additional memory for a subject alternative name, thus + /// mbedtls_x509_free_subject_alt_name has to be called + /// to dispose of this additional memory afterwards. /// /// \param san_buf The buffer holding the raw data item of the subject /// alternative name. /// \param san The target structure to populate with the parsed presentation - /// of the subject alternative name encoded in \p san_raw. + /// of the subject alternative name encoded in \p san_buf. /// /// \note Supported GeneralName types, as defined in RFC 5280: - /// "rfc822Name", "dnsName", "uniformResourceIdentifier" and "hardware_module_name" + /// "rfc822Name", "dnsName", "directoryName", + /// "uniformResourceIdentifier" and "hardware_module_name" /// of type "otherName", as defined in RFC 4108. /// /// \note This function should be called on a single raw data of /// subject alternative name. For example, after successful /// certificate parsing, one must iterate on every item in the - /// \p crt->subject_alt_names sequence, and pass it to + /// \c crt->subject_alt_names sequence, and pass it to /// this function. /// /// \warning The target structure contains pointers to the raw data of the @@ -18887,173 +20151,29 @@ unsafe extern "C" { ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \} addtogroup x509_module - pub fn mbedtls_x509_get_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - cur: *mut mbedtls_x509_name, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg_null( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_alg( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - alg: *mut mbedtls_x509_buf, - params: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_rsassa_pss_params( - params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - mgf_md: *mut mbedtls_md_type_t, - salt_len: *mut ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - sig: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_sig_alg( - sig_oid: *const mbedtls_x509_buf, - sig_params: *const mbedtls_x509_buf, - md_alg: *mut mbedtls_md_type_t, - pk_alg: *mut mbedtls_pk_type_t, - sig_opts: *mut *mut ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_time( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - t: *mut mbedtls_x509_time, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_serial( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - serial: *mut mbedtls_x509_buf, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ext( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ext: *mut mbedtls_x509_buf, - tag: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_sig_alg_gets( - buf: *mut ::core::ffi::c_char, - size: usize, - sig_oid: *const mbedtls_x509_buf, - pk_alg: mbedtls_pk_type_t, - md_alg: mbedtls_md_type_t, - sig_opts: *const ::core::ffi::c_void, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_key_size_helper( - buf: *mut ::core::ffi::c_char, - buf_size: usize, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_string_to_names( - head: *mut *mut mbedtls_asn1_named_data, - name: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_set_extension( - head: *mut *mut mbedtls_asn1_named_data, - oid: *const ::core::ffi::c_char, - oid_len: usize, - critical: ::core::ffi::c_int, - val: *const ::core::ffi::c_uchar, - val_len: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_extensions( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_names( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - first: *mut mbedtls_asn1_named_data, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_write_sig( - p: *mut *mut ::core::ffi::c_uchar, - start: *mut ::core::ffi::c_uchar, - oid: *const ::core::ffi::c_char, - oid_len: usize, - sig: *mut ::core::ffi::c_uchar, - size: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_ns_cert_type( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - ns_cert_type: *mut ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_key_usage( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - key_usage: *mut ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_get_subject_alt_name( - p: *mut *mut ::core::ffi::c_uchar, - end: *const ::core::ffi::c_uchar, - subject_alt_name: *mut mbedtls_x509_sequence, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_subject_alt_name( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - subject_alt_name: *const mbedtls_x509_sequence, - prefix: *const ::core::ffi::c_char, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - pub fn mbedtls_x509_info_cert_type( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - ns_cert_type: ::core::ffi::c_uchar, - ) -> ::core::ffi::c_int; + /// \brief Unallocate all data related to subject alternative name + /// + /// \param san SAN structure - extra memory owned by this structure will be freed + pub fn mbedtls_x509_free_subject_alt_name(san: *mut mbedtls_x509_subject_alternative_name); } unsafe extern "C" { - pub fn mbedtls_x509_info_key_usage( - buf: *mut *mut ::core::ffi::c_char, - size: *mut usize, - key_usage: ::core::ffi::c_uint, - ) -> ::core::ffi::c_int; + /// \brief This function parses a CN string as an IP address. + /// + /// \param cn The CN string to parse. CN string MUST be null-terminated. + /// \param dst The target buffer to populate with the binary IP address. + /// The buffer MUST be 16 bytes to save IPv6, and should be + /// 4-byte aligned if the result will be used as struct in_addr. + /// e.g. uint32_t dst[4] + /// + /// \note \p cn is parsed as an IPv6 address if string contains ':', + /// else \p cn is parsed as an IPv4 address. + /// + /// \return Length of binary IP address; num bytes written to target. + /// \return \c 0 on failure to parse CN string as an IP address. + pub fn mbedtls_x509_crt_parse_cn_inet_pton( + cn: *const ::core::ffi::c_char, + dst: *mut ::core::ffi::c_void, + ) -> usize; } /// Certificate revocation list entry. /// Contains the CA-specific serial numbers and revocation dates. @@ -19245,8 +20365,12 @@ pub struct mbedtls_x509_crt { pub subject_id: mbedtls_x509_buf, ///< Optional X.509 v3 extensions. pub v3_ext: mbedtls_x509_buf, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName, uniformResourceIdentifier and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, + ///< Optional X.509 v3 extension subject key identifier. + pub subject_key_id: mbedtls_x509_buf, + ///< Optional X.509 v3 extension authority key identifier. + pub authority_key_id: mbedtls_x509_authority, ///< Optional list of certificate policies (Only anyPolicy is printed and enforced, however the rest of the policies are still listed). pub certificate_policies: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions @@ -19345,6 +20469,22 @@ impl Default for mbedtls_x509write_cert { } } } +unsafe extern "C" { + /// \brief Set Subject Alternative Name + /// + /// \param ctx Certificate context to use + /// \param san_list List of SAN values + /// + /// \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED + /// + /// \note "dnsName", "uniformResourceIdentifier", "IP address", + /// "otherName", and "DirectoryName", as defined in RFC 5280, + /// are supported. + pub fn mbedtls_x509write_crt_set_subject_alternative_name( + ctx: *mut mbedtls_x509write_cert, + san_list: *const mbedtls_x509_san_list, + ) -> ::core::ffi::c_int; +} /// Item in a verification chain: cert and flags for it #[repr(C)] #[derive(Copy, Clone)] @@ -19683,8 +20823,12 @@ unsafe extern "C" { /// \param cn The expected Common Name. This will be checked to be /// present in the certificate's subjectAltNames extension or, /// if this extension is absent, as a CN component in its - /// Subject name. Currently only DNS names are supported. This - /// may be \c NULL if the CN need not be verified. + /// Subject name. DNS names and IP addresses are fully + /// supported, while the URI subtype is partially supported: + /// only exact matching, without any normalization procedures + /// described in 7.4 of RFC5280, will result in a positive + /// URI verification. + /// This may be \c NULL if the CN need not be verified. /// \param flags The address at which to store the result of the verification. /// If the verification couldn't be completed, the flag value is /// set to (uint32_t) -1. @@ -19915,6 +21059,16 @@ unsafe extern "C" { /// \param crt Certificate chain to free pub fn mbedtls_x509_crt_free(crt: *mut mbedtls_x509_crt); } +unsafe extern "C" { + /// \brief Access the ca_istrue field + /// + /// \param[in] crt Certificate to be queried, must not be \c NULL + /// + /// \return \c 1 if this a CA certificate \c 0 otherwise. + /// \return MBEDTLS_ERR_X509_INVALID_EXTENSIONS if the certificate does not contain + /// the Optional Basic Constraint extension. + pub fn mbedtls_x509_crt_get_ca_istrue(crt: *const mbedtls_x509_crt) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Initialize a CRT writing context /// @@ -19995,7 +21149,7 @@ unsafe extern "C" { /// \brief Set the issuer name for a Certificate /// Issuer names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS CA" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS CA" /// /// \param ctx CRT context to use /// \param issuer_name issuer name to set @@ -20011,7 +21165,7 @@ unsafe extern "C" { /// \brief Set the subject name for a Certificate /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CRT context to use /// \param subject_name subject name to set @@ -20181,13 +21335,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20207,13 +21355,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_cert, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20334,13 +21476,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20413,13 +21549,7 @@ unsafe extern "C" { x_size: ::core::ffi::c_int, output: *mut ::core::ffi::c_uchar, olen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20453,13 +21583,7 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, output_size: usize, olen: *mut usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20490,7 +21614,7 @@ unsafe extern "C" { /// initialized. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p field is invalid. + /// \return #MBEDTLS_ERR_DHM_BAD_INPUT_DATA if \p param is invalid. /// \return An \c MBEDTLS_ERR_MPI_XXX error code if the copy fails. pub fn mbedtls_dhm_get_value( ctx: *const mbedtls_dhm_context, @@ -20618,6 +21742,18 @@ impl Default for mbedtls_ecdh_context { } } } +unsafe extern "C" { + /// \brief Return the ECP group for provided context. + /// + /// \note To access group specific fields, users should use + /// `mbedtls_ecp_curve_info_from_grp_id` or + /// `mbedtls_ecp_group_load` on the extracted `group_id`. + /// + /// \param ctx The ECDH context to parse. This must not be \c NULL. + /// + /// \return The \c mbedtls_ecp_group_id of the context. + pub fn mbedtls_ecdh_get_grp_id(ctx: *mut mbedtls_ecdh_context) -> mbedtls_ecp_group_id; +} unsafe extern "C" { /// \brief Check whether a given group can be used for ECDH. /// @@ -20654,13 +21790,7 @@ unsafe extern "C" { grp: *mut mbedtls_ecp_group, d: *mut mbedtls_mpi, Q: *mut mbedtls_ecp_point, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20699,13 +21829,7 @@ unsafe extern "C" { z: *mut mbedtls_mpi, Q: *const mbedtls_ecp_point, d: *const mbedtls_mpi, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20772,13 +21896,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20814,7 +21932,7 @@ unsafe extern "C" { /// \brief This function sets up an ECDH context from an EC key. /// /// It is used by clients and servers in place of the - /// ServerKeyEchange for static ECDH, and imports ECDH + /// ServerKeyExchange for static ECDH, and imports ECDH /// parameters from the EC key information of a certificate. /// /// \see ecp.h @@ -20863,13 +21981,7 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -20930,19 +22042,14 @@ unsafe extern "C" { olen: *mut usize, buf: *mut ::core::ffi::c_uchar, blen: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } #[repr(C)] #[derive(Copy, Clone)] pub union mbedtls_ssl_premaster_secret { + pub dummy: ::core::ffi::c_uchar, pub _pms_rsa: [::core::ffi::c_uchar; 48usize], pub _pms_dhm: [::core::ffi::c_uchar; 1024usize], pub _pms_ecdh: [::core::ffi::c_uchar; 66usize], @@ -21214,6 +22321,8 @@ pub struct mbedtls_ssl_session { ///< MaxFragmentLength negotiated by peer pub private_mfl_code: ::core::ffi::c_uchar, pub private_exported: ::core::ffi::c_uchar, + ///< 0: client, 1: server + pub private_endpoint: u8, /// TLS version negotiated in the session. Used if and when renegotiating /// or resuming a session instead of the configured minor TLS version. pub private_tls_version: mbedtls_ssl_protocol_version, @@ -21232,15 +22341,13 @@ pub struct mbedtls_ssl_session { ///< RFC 5077 session ticket pub private_ticket: *mut ::core::ffi::c_uchar, ///< session ticket length - pub private_ticket_len: usize, - ///< ticket lifetime hint - pub private_ticket_lifetime: u32, - ///< 0: client, 1: server - pub private_endpoint: u8, - ///< Ticket flags - pub private_ticket_flags: u8, + pub private_ticket_len: usize, + ///< ticket lifetime hint + pub private_ticket_lifetime: u32, ///< Randomly generated value used to obscure the age of the ticket pub private_ticket_age_add: u32, + ///< Ticket flags + pub private_ticket_flags: u8, ///< resumption_key length pub private_resumption_key_len: u8, pub private_resumption_key: [::core::ffi::c_uchar; 48usize], @@ -21579,22 +22686,30 @@ pub struct mbedtls_ssl_context { ///number of retransmissions of request if ///renego_max_records is < 0 pub private_renego_records_seen: ::core::ffi::c_int, - /// Server: Negotiated TLS protocol version. - /// Client: Maximum TLS version to be negotiated, then negotiated TLS - /// version. - /// - /// It is initialized as the maximum TLS version to be negotiated in the - /// ClientHello writing preparation stage and used throughout the - /// ClientHello writing. For a fresh handshake not linked to any previous - /// handshake, it is initialized to the configured maximum TLS version - /// to be negotiated. When renegotiating or resuming a session, it is - /// initialized to the previously negotiated TLS version. - /// - /// Updated to the negotiated TLS version as soon as the ServerHello is - /// received. + /// Maximum TLS version to be negotiated, then negotiated TLS version. + /// + /// It is initialized as the configured maximum TLS version to be + /// negotiated by mbedtls_ssl_setup(). + /// + /// When renegotiating or resuming a session, it is overwritten in the + /// ClientHello writing preparation stage with the previously negotiated + /// TLS version. + /// + /// On client side, it is updated to the TLS version selected by the server + /// for the handshake when the ServerHello is received. + /// + /// On server side, it is updated to the TLS version the server selects for + /// the handshake when the ClientHello is received. pub private_tls_version: mbedtls_ssl_protocol_version, - ///< records with a bad MAC received - pub private_badmac_seen: ::core::ffi::c_uint, + /// Multipurpose field. + /// + /// - DTLS: records with a bad MAC received. + /// - TLS: accumulated length of handshake fragments (up to \c in_hslen). + /// + /// This field is multipurpose in order to preserve the ABI in the + /// Mbed TLS 3.6 LTS branch. Until 3.6.2, it was only used in DTLS + /// and called `badmac_seen`. + pub private_badmac_seen_or_in_hsfraglen: ::core::ffi::c_uint, /// Callback to customize X.509 certificate chain verification pub private_f_vrfy: ::core::option::Option< unsafe extern "C" fn( @@ -21731,8 +22846,33 @@ pub struct mbedtls_ssl_context { pub private_cur_out_ctr: [::core::ffi::c_uchar; 8usize], ///< path mtu, used to fragment outgoing messages pub private_mtu: u16, - ///< expected peer CN for verification - ///(and SNI if available) + /// Expected peer CN for verification. + /// + /// Also used on clients for SNI, + /// and for TLS 1.3 session resumption using tickets. + /// + /// The value of this field can be: + /// - \p NULL in a newly initialized or reset context. + /// - A heap-allocated copy of the last value passed to + /// mbedtls_ssl_set_hostname(), if the last call had a non-null + /// \p hostname argument. + /// - A special value to indicate that mbedtls_ssl_set_hostname() + /// was called with \p NULL (as opposed to never having been called). + /// See `mbedtls_ssl_get_hostname_pointer()` in `ssl_tls.c`. + /// + /// If this field contains the value \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is unset, on a TLS client, attempting to verify a server certificate + /// results in the error + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME. + /// + /// If this field contains the special value described above, or if + /// the value is \p NULL and the configuration option + /// #MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// is set, then the peer name verification is skipped, which may be + /// insecure, especially on a client. Furthermore, on a client, the + /// server_name extension is not sent, and the server name is ignored + /// in TLS 1.3 session resumption using tickets. pub private_hostname: *mut ::core::ffi::c_char, ///< negotiated protocol pub private_alpn_chosen: *const ::core::ffi::c_char, @@ -21828,6 +22968,14 @@ unsafe extern "C" { /// Calling mbedtls_ssl_setup again is not supported, even /// if no session is active. /// + /// \warning After setting up a client context, if certificate-based + /// authentication is enabled, you should call + /// mbedtls_ssl_set_hostname() to specifiy the expected + /// name of the server. Without this, in most scenarios, + /// the TLS connection is insecure. See + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more information. + /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. @@ -21931,18 +23079,16 @@ unsafe extern "C" { unsafe extern "C" { /// \brief Set the random number generator callback /// + /// \note The callback with its parameter must remain valid as + /// long as there is an SSL context that uses the + /// SSL configuration. + /// /// \param conf SSL configuration /// \param f_rng RNG function (mandatory) /// \param p_rng RNG parameter pub fn mbedtls_ssl_conf_rng( conf: *mut mbedtls_ssl_config, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ); } @@ -22045,10 +23191,10 @@ unsafe extern "C" { /// \param own_cid The address of the readable buffer holding the CID we want /// the peer to use when sending encrypted messages to us. /// This may be \c NULL if \p own_cid_len is \c 0. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// \param own_cid_len The length of \p own_cid. - /// This parameter is unused if \p enabled is set to + /// This parameter is unused if \p enable is set to /// MBEDTLS_SSL_CID_DISABLED. /// /// \note The value of \p own_cid_len must match the value of the @@ -22703,16 +23849,16 @@ unsafe extern "C" { /// a full handshake. /// /// \note This function can handle a variety of mechanisms for session - /// resumption: For TLS 1.2, both session ID-based resumption and - /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and loading - /// one or more sessions via this call will lead to their - /// corresponding tickets being advertised as resumption PSKs - /// by the client. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// resumption: For TLS 1.2, both session ID-based resumption + /// and ticket-based resumption will be considered. For TLS 1.3, + /// sessions equate to tickets, and loading one session by + /// calling this function will lead to its corresponding ticket + /// being advertised as resumption PSK by the client. This + /// depends on session tickets being enabled (see + /// #MBEDTLS_SSL_SESSION_TICKETS configuration option) though. + /// If session tickets are disabled, a call to this function + /// with a TLS 1.3 session, will not have any effect on the next + /// handshake for the SSL context \p ssl. /// /// \param ssl The SSL context representing the connection which should /// be attempted to be setup using session resumption. This @@ -22727,9 +23873,10 @@ unsafe extern "C" { /// /// \return \c 0 if successful. /// \return \c MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the session - /// could not be loaded because of an implementation limitation. - /// This error is non-fatal, and has no observable effect on - /// the SSL context or the session that was attempted to be loaded. + /// could not be loaded because one session has already been + /// loaded. This error is non-fatal, and has no observable + /// effect on the SSL context or the session that was attempted + /// to be loaded. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_get_session() @@ -22787,8 +23934,8 @@ unsafe extern "C" { /// /// \param session The session structure to be saved. /// \param buf The buffer to write the serialized data to. It must be a - /// writeable buffer of at least \p len bytes, or may be \c - /// NULL if \p len is \c 0. + /// writeable buffer of at least \p buf_len bytes, or may be \c + /// NULL if \p buf_len is \c 0. /// \param buf_len The number of bytes available for writing in \p buf. /// \param olen The size in bytes of the data that has been or would have /// been written. It must point to a valid \c size_t. @@ -22798,8 +23945,16 @@ unsafe extern "C" { /// to determine the necessary size by calling this function /// with \p buf set to \c NULL and \p buf_len to \c 0. /// + /// \note For TLS 1.3 sessions, this feature is supported only if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is enabled, + /// as in TLS 1.3 session resumption is possible only with + /// tickets. + /// /// \return \c 0 if successful. /// \return #MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL if \p buf is too small. + /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if the + /// MBEDTLS_SSL_SESSION_TICKETS configuration option is disabled + /// and the session is a TLS 1.3 session. pub fn mbedtls_ssl_session_save( session: *const mbedtls_ssl_session, buf: *mut ::core::ffi::c_uchar, @@ -22925,7 +24080,7 @@ unsafe extern "C" { /// record headers. /// /// \return \c 0 on success. - /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + /// \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len /// is too large. pub fn mbedtls_ssl_conf_cid( conf: *mut mbedtls_ssl_config, @@ -23252,6 +24407,8 @@ unsafe extern "C" { /// used for certificate signature are controlled by the /// verification profile, see \c mbedtls_ssl_conf_cert_profile(). /// + /// \deprecated Superseded by mbedtls_ssl_conf_sig_algs(). + /// /// \note This list should be ordered by decreasing preference /// (preferred hash first). /// @@ -23276,27 +24433,43 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Configure allowed signature algorithms for use in TLS 1.3 + /// \brief Configure allowed signature algorithms for use in TLS /// /// \param conf The SSL configuration to use. /// \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms, - /// terminated by \c MBEDTLS_TLS1_3_SIG_NONE. The list must remain - /// available throughout the lifetime of the conf object. Supported - /// values are available as \c MBEDTLS_TLS1_3_SIG_XXXX + /// terminated by #MBEDTLS_TLS1_3_SIG_NONE. The list must remain + /// available throughout the lifetime of the conf object. + /// - For TLS 1.3, values of \c MBEDTLS_TLS1_3_SIG_XXXX should be + /// used. + /// - For TLS 1.2, values should be given as + /// "(HashAlgorithm << 8) | SignatureAlgorithm". pub fn mbedtls_ssl_conf_sig_algs(conf: *mut mbedtls_ssl_config, sig_algs: *const u16); } unsafe extern "C" { /// \brief Set or reset the hostname to check against the received - /// server certificate. It sets the ServerName TLS extension, - /// too, if that extension is enabled. (client-side only) + /// peer certificate. On a client, this also sets the + /// ServerName TLS extension, if that extension is enabled. + /// On a TLS 1.3 client, this also sets the server name in + /// the session resumption ticket, if that feature is enabled. /// /// \param ssl SSL context - /// \param hostname the server hostname, may be NULL to clear hostname - /// - /// \note Maximum hostname length MBEDTLS_SSL_MAX_HOST_NAME_LEN. - /// - /// \return 0 if successful, MBEDTLS_ERR_SSL_ALLOC_FAILED on - /// allocation failure, MBEDTLS_ERR_SSL_BAD_INPUT_DATA on + /// \param hostname The server hostname. This may be \c NULL to clear + /// the hostname. + /// + /// \note Maximum hostname length #MBEDTLS_SSL_MAX_HOST_NAME_LEN. + /// + /// \note If the hostname is \c NULL on a client, then the server + /// is not authenticated: it only needs to have a valid + /// certificate, not a certificate matching its name. + /// Therefore you should always call this function on a client, + /// unless the connection is set up to only allow + /// pre-shared keys, or in scenarios where server + /// impersonation is not a concern. See the documentation of + /// #MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + /// for more details. + /// + /// \return 0 if successful, #MBEDTLS_ERR_SSL_ALLOC_FAILED on + /// allocation failure, #MBEDTLS_ERR_SSL_BAD_INPUT_DATA on /// too long input hostname. /// /// Hostname set to the one provided on success (cleared @@ -23309,8 +24482,8 @@ unsafe extern "C" { } unsafe extern "C" { /// \brief Retrieve SNI extension value for the current handshake. - /// Available in \p f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), - /// this is the same value passed to \p f_sni callback of + /// Available in \c f_cert_cb of \c mbedtls_ssl_conf_cert_cb(), + /// this is the same value passed to \c f_sni callback of /// \c mbedtls_ssl_conf_sni() and may be used instead of /// \c mbedtls_ssl_conf_sni(). /// @@ -23319,10 +24492,10 @@ unsafe extern "C" { /// 0 if SNI extension is not present or not yet processed. /// /// \return const pointer to SNI extension value. - /// - value is valid only when called in \p f_cert_cb + /// - value is valid only when called in \c f_cert_cb /// registered with \c mbedtls_ssl_conf_cert_cb(). /// - value is NULL if SNI extension is not present. - /// - value is not '\0'-terminated. Use \c name_len for len. + /// - value is not '\0'-terminated. Use \c name_len for len. /// - value must not be freed. pub fn mbedtls_ssl_get_hs_sni( ssl: *mut mbedtls_ssl_context, @@ -23572,6 +24745,10 @@ unsafe extern "C" { /// with \c mbedtls_ssl_read()), not handshake messages. /// With DTLS, this affects both ApplicationData and handshake. /// + /// \note Defragmentation of TLS handshake messages is supported + /// with some limitations. See the documentation of + /// mbedtls_ssl_handshake() for details. + /// /// \note This sets the maximum length for a record's payload, /// excluding record overhead that will be added to it, see /// \c mbedtls_ssl_get_record_expansion(). @@ -23605,19 +24782,48 @@ unsafe extern "C" { ); } unsafe extern "C" { - /// \brief Enable / Disable session tickets (client only). - /// (Default: MBEDTLS_SSL_SESSION_TICKETS_ENABLED.) + /// \brief Enable / Disable TLS 1.2 session tickets (client only, + /// TLS 1.2 only). Enabled by default. /// /// \note On server, use \c mbedtls_ssl_conf_session_tickets_cb(). /// /// \param conf SSL configuration - /// \param use_tickets Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or - /// MBEDTLS_SSL_SESSION_TICKETS_DISABLED) + /// \param use_tickets Enable or disable (#MBEDTLS_SSL_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_SESSION_TICKETS_DISABLED) pub fn mbedtls_ssl_conf_session_tickets( conf: *mut mbedtls_ssl_config, use_tickets: ::core::ffi::c_int, ); } +unsafe extern "C" { + /// \brief Enable / Disable handling of TLS 1.3 NewSessionTicket messages + /// (client only, TLS 1.3 only). + /// + /// The handling of TLS 1.3 NewSessionTicket messages is disabled by + /// default. + /// + /// In TLS 1.3, servers may send a NewSessionTicket message at any time, + /// and may send multiple NewSessionTicket messages. By default, TLS 1.3 + /// clients ignore NewSessionTicket messages. + /// + /// To support session tickets in TLS 1.3 clients, call this function + /// with #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED. When + /// this is enabled, when a client receives a NewSessionTicket message, + /// the next call to a message processing functions (notably + /// mbedtls_ssl_handshake() and mbedtls_ssl_read()) will return + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. The client should then + /// call mbedtls_ssl_get_session() to retrieve the session ticket before + /// calling the same message processing function again. + /// + /// \param conf SSL configuration + /// \param signal_new_session_tickets Enable or disable + /// (#MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED or + /// #MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_DISABLED) + pub fn mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets( + conf: *mut mbedtls_ssl_config, + signal_new_session_tickets: ::core::ffi::c_int, + ); +} unsafe extern "C" { /// \brief Number of NewSessionTicket messages for the server to send /// after handshake completion. @@ -23946,29 +25152,22 @@ unsafe extern "C" { /// \param ssl The SSL context representing the connection for which to /// to export a session structure for later resumption. /// \param session The target structure in which to store the exported session. - /// This must have been initialized with mbedtls_ssl_init_session() + /// This must have been initialized with mbedtls_ssl_session_init() /// but otherwise be unused. /// /// \note This function can handle a variety of mechanisms for session /// resumption: For TLS 1.2, both session ID-based resumption and /// ticket-based resumption will be considered. For TLS 1.3, - /// once implemented, sessions equate to tickets, and calling - /// this function multiple times will export the available - /// tickets one a time until no further tickets are available, - /// in which case MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE will - /// be returned. - /// - /// \note Calling this function multiple times will only be useful - /// once TLS 1.3 is supported. For TLS 1.2 connections, this - /// function should be called at most once. + /// sessions equate to tickets, and if session tickets are + /// enabled (see #MBEDTLS_SSL_SESSION_TICKETS configuration + /// option), this function exports the last received ticket and + /// the exported session may be used to resume the TLS 1.3 + /// session. If session tickets are disabled, exported sessions + /// cannot be used to resume a TLS 1.3 session. /// /// \return \c 0 if successful. In this case, \p session can be used for /// session resumption by passing it to mbedtls_ssl_set_session(), /// and serialized for storage via mbedtls_ssl_session_save(). - /// \return #MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE if no further session - /// is available for export. - /// This error is a non-fatal, and has no observable effect on - /// the SSL context or the destination session. /// \return Another negative error code on other kinds of failure. /// /// \sa mbedtls_ssl_set_session() @@ -24000,6 +25199,17 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED if DTLS is in use /// and the client did not demonstrate reachability yet - in /// this case you must stop using the context (see below). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24008,7 +25218,9 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24028,10 +25240,31 @@ unsafe extern "C" { /// currently being processed might or might not contain further /// DTLS records. /// - /// \note If the context is configured to allow TLS 1.3, or if - /// #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling /// psa_crypto_init() before calling this function. + /// Otherwise, the handshake may call psa_crypto_init() + /// if a negotiation involving TLS 1.3 takes place (this may + /// be the case even if TLS 1.3 is offered but eventually + /// not selected). + /// + /// \note In TLS, reception of fragmented handshake messages is + /// supported with some limitations (those limitations do + /// not apply to DTLS, where defragmentation is fully + /// supported): + /// - On an Mbed TLS server that only accepts TLS 1.2, + /// the initial ClientHello message must not be fragmented. + /// A TLS 1.2 ClientHello may be fragmented if the server + /// also accepts TLS 1.3 connections (meaning + /// that #MBEDTLS_SSL_PROTO_TLS1_3 enabled, and the + /// accepted versions have not been restricted with + /// mbedtls_ssl_conf_max_tls_version() or the like). + /// - The first fragment of a handshake message must be + /// at least 4 bytes long. + /// - Non-handshake records must not be interleaved between + /// the fragments of a handshake message. (This is permitted + /// in TLS 1.2 but not in TLS 1.3, but Mbed TLS rejects it + /// even in TLS 1.2.) pub fn mbedtls_ssl_handshake(ssl: *mut mbedtls_ssl_context) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -24060,8 +25293,10 @@ unsafe extern "C" { /// /// \warning If this function returns something other than \c 0, /// #MBEDTLS_ERR_SSL_WANT_READ, #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, you must stop using + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, you must stop using /// the SSL context for reading or writing, and either free it /// or call \c mbedtls_ssl_session_reset() on it before /// re-using it for a new connection; the current connection @@ -24124,6 +25359,24 @@ unsafe extern "C" { /// \return #MBEDTLS_ERR_SSL_CLIENT_RECONNECT if we're at the server /// side of a DTLS connection and the client is initiating a /// new connection using the same source port. See below. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. + /// This error code is only returned on the client side. It is + /// only returned if handling of TLS 1.3 NewSessionTicket + /// messages has been enabled through + /// mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(). + /// This error code indicates that a TLS 1.3 NewSessionTicket + /// message has been received and parsed successfully by the + /// client. The ticket data can be retrieved from the SSL + /// context by calling mbedtls_ssl_get_session(). It remains + /// available until the next call to mbedtls_ssl_read(). + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24132,8 +25385,10 @@ unsafe extern "C" { /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CLIENT_RECONNECT or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24200,6 +25455,17 @@ unsafe extern "C" { /// operation is in progress (see mbedtls_ecp_set_max_ops()) - /// in this case you must call this function again to complete /// the handshake when you're done attending other tasks. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET if a TLS 1.3 + /// NewSessionTicket message has been received. See the + /// documentation of mbedtls_ssl_read() for more information + /// about this error code. + /// \return #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA if early data, as + /// defined in RFC 8446 (TLS 1.3 specification), has been + /// received as part of the handshake. This is server specific + /// and may occur only if the early data feature has been + /// enabled on server (see mbedtls_ssl_conf_early_data() + /// documentation). You must call mbedtls_ssl_read_early_data() + /// to read the early data before resuming the handshake. /// \return Another SSL error code - in this case you must stop using /// the context (see below). /// @@ -24207,8 +25473,10 @@ unsafe extern "C" { /// a non-negative value, /// #MBEDTLS_ERR_SSL_WANT_READ, /// #MBEDTLS_ERR_SSL_WANT_WRITE, - /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS or - /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS, + /// #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS or + /// #MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET or + /// #MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA, /// you must stop using the SSL context for reading or writing, /// and either free it or call \c mbedtls_ssl_session_reset() /// on it before re-using it for a new connection; the current @@ -24449,381 +25717,64 @@ unsafe extern "C" { /// \brief Free an SSL configuration context /// /// \param conf SSL configuration context - pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); -} -unsafe extern "C" { - /// \brief Initialize SSL session structure - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief Free referenced items in an SSL session including the - /// peer certificate and clear memory - /// - /// \note A session object can be freed even if the SSL context - /// that was used to retrieve the session is still in use. - /// - /// \param session SSL session - pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); -} -unsafe extern "C" { - /// \brief TLS-PRF function for key derivation. - /// - /// \param prf The tls_prf type function type to be used. - /// \param secret Secret for the key derivation function. - /// \param slen Length of the secret. - /// \param label String label for the key derivation function, - /// terminated with null character. - /// \param random Random bytes. - /// \param rlen Length of the random bytes buffer. - /// \param dstbuf The buffer holding the derived key. - /// \param dlen Length of the output buffer. - /// - /// \return 0 on success. An SSL specific error on failure. - pub fn mbedtls_ssl_tls_prf( - prf: mbedtls_tls_prf_types, - secret: *const ::core::ffi::c_uchar, - slen: usize, - label: *const ::core::ffi::c_char, - random: *const ::core::ffi::c_uchar, - rlen: usize, - dstbuf: *mut ::core::ffi::c_uchar, - dlen: usize, - ) -> ::core::ffi::c_int; -} -unsafe extern "C" { - /// \brief Set the threshold error level to handle globally all debug output. - /// Debug messages that have a level over the threshold value are - /// discarded. - /// (Default value: 0 = No debug ) - /// - /// \param threshold threshold level of messages to filter on. Messages at a - /// higher level will be discarded. - /// - Debug levels - /// - 0 No debug - /// - 1 Error - /// - 2 State change - /// - 3 Informational - /// - 4 Verbose - pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); -} -unsafe extern "C" { - /// \brief Print a message to the debug output. This function is always used - /// through the MBEDTLS_SSL_DEBUG_MSG() macro, which supplies the ssl - /// context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the message has occurred in - /// \param line line number the message has occurred at - /// \param format format specifier, in printf format - /// \param ... variables used by the format specifier - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_msg( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - format: *const ::core::ffi::c_char, - ... - ); -} -unsafe extern "C" { - /// \brief Print the return value of a function to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_RET() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text the name of the function that returned the error - /// \param ret the return code value - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ret( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - ret: ::core::ffi::c_int, - ); -} -unsafe extern "C" { - /// \brief Output a buffer of size len bytes to the debug output. This function - /// is always used through the MBEDTLS_SSL_DEBUG_BUF() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the buffer being dumped. Normally the - /// variable or buffer name - /// \param buf the buffer to be outputted - /// \param len length of the buffer - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_buf( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - buf: *const ::core::ffi::c_uchar, - len: usize, - ); -} -unsafe extern "C" { - /// \brief Print a MPI variable to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_MPI() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the MPI being output. Normally the - /// variable name - /// \param X the MPI variable - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_mpi( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_mpi, - ); -} -unsafe extern "C" { - /// \brief Print an ECP point to the debug output. This function is always - /// used through the MBEDTLS_SSL_DEBUG_ECP() macro, which supplies the - /// ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the ECP point being output. Normally the - /// variable name - /// \param X the ECP point - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_ecp( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - X: *const mbedtls_ecp_point, - ); -} -unsafe extern "C" { - /// \brief Print a X.509 certificate structure to the debug output. This - /// function is always used through the MBEDTLS_SSL_DEBUG_CRT() macro, - /// which supplies the ssl context, file and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param text a name or label for the certificate being output - /// \param crt X.509 certificate structure - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_print_crt( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - text: *const ::core::ffi::c_char, - crt: *const mbedtls_x509_crt, - ); -} -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Q: mbedtls_debug_ecdh_attr = 0; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_QP: mbedtls_debug_ecdh_attr = 1; -pub const mbedtls_debug_ecdh_attr_MBEDTLS_DEBUG_ECDH_Z: mbedtls_debug_ecdh_attr = 2; -pub type mbedtls_debug_ecdh_attr = ::core::ffi::c_uint; -unsafe extern "C" { - /// \brief Print a field of the ECDH structure in the SSL context to the debug - /// output. This function is always used through the - /// MBEDTLS_SSL_DEBUG_ECDH() macro, which supplies the ssl context, file - /// and line number parameters. - /// - /// \param ssl SSL context - /// \param level error level of the debug message - /// \param file file the error has occurred in - /// \param line line number the error has occurred in - /// \param ecdh the ECDH context - /// \param attr the identifier of the attribute being output - /// - /// \attention This function is intended for INTERNAL usage within the - /// library only. - pub fn mbedtls_debug_printf_ecdh( - ssl: *const mbedtls_ssl_context, - level: ::core::ffi::c_int, - file: *const ::core::ffi::c_char, - line: ::core::ffi::c_int, - ecdh: *const mbedtls_ecdh_context, - attr: mbedtls_debug_ecdh_attr, - ); -} -/// \brief Entropy poll callback pointer -/// -/// \param data Callback-specific data pointer -/// \param output Data to fill -/// \param len Maximum size to provide -/// \param olen The actual amount of bytes put into the buffer (Can be 0) -/// -/// \return 0 if no critical failures occurred, -/// MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise -pub type mbedtls_entropy_f_source_ptr = ::core::option::Option< - unsafe extern "C" fn( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - olen: *mut usize, - ) -> ::core::ffi::c_int, ->; -/// \brief Entropy source state -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_source_state { - ///< The entropy source callback - pub private_f_source: mbedtls_entropy_f_source_ptr, - ///< The callback data pointer - pub private_p_source: *mut ::core::ffi::c_void, - ///< Amount received in bytes - pub private_size: usize, - ///< Minimum bytes required before release - pub private_threshold: usize, - ///< Is the source strong? - pub private_strong: ::core::ffi::c_int, -} -impl Default for mbedtls_entropy_source_state { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -/// \brief Entropy context structure -#[repr(C)] -#[repr(align(16))] -#[derive(Copy, Clone)] -pub struct mbedtls_entropy_context { - pub private_accumulator_started: ::core::ffi::c_int, - pub __bindgen_padding_0: u64, - pub private_accumulator: mbedtls_sha512_context, - pub private_source_count: ::core::ffi::c_int, - pub private_source: [mbedtls_entropy_source_state; 20usize], -} -impl Default for mbedtls_entropy_context { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} -unsafe extern "C" { - /// \brief Initialize the context - /// - /// \param ctx Entropy context to initialize - pub fn mbedtls_entropy_init(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Free the data in the context - /// - /// \param ctx Entropy context to free - pub fn mbedtls_entropy_free(ctx: *mut mbedtls_entropy_context); -} -unsafe extern "C" { - /// \brief Adds an entropy source to poll - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context - /// \param f_source Entropy function - /// \param p_source Function data - /// \param threshold Minimum required from source before entropy is released - /// ( with mbedtls_entropy_func() ) (in bytes) - /// \param strong MBEDTLS_ENTROPY_SOURCE_STRONG or - /// MBEDTLS_ENTROPY_SOURCE_WEAK. - /// At least one strong source needs to be added. - /// Weaker sources (such as the cycle counter) can be used as - /// a complement. - /// - /// \return 0 if successful or MBEDTLS_ERR_ENTROPY_MAX_SOURCES - pub fn mbedtls_entropy_add_source( - ctx: *mut mbedtls_entropy_context, - f_source: mbedtls_entropy_f_source_ptr, - p_source: *mut ::core::ffi::c_void, - threshold: usize, - strong: ::core::ffi::c_int, - ) -> ::core::ffi::c_int; + pub fn mbedtls_ssl_config_free(conf: *mut mbedtls_ssl_config); } unsafe extern "C" { - /// \brief Trigger an extra gather poll for the accumulator - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) - /// - /// \param ctx Entropy context + /// \brief Initialize SSL session structure /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_gather(ctx: *mut mbedtls_entropy_context) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_init(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Retrieve entropy from the accumulator - /// (Maximum length: MBEDTLS_ENTROPY_BLOCK_SIZE) - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief Free referenced items in an SSL session including the + /// peer certificate and clear memory /// - /// \param data Entropy context - /// \param output Buffer to fill - /// \param len Number of bytes desired, must be at most MBEDTLS_ENTROPY_BLOCK_SIZE + /// \note A session object can be freed even if the SSL context + /// that was used to retrieve the session is still in use. /// - /// \return 0 if successful, or MBEDTLS_ERR_ENTROPY_SOURCE_FAILED - pub fn mbedtls_entropy_func( - data: *mut ::core::ffi::c_void, - output: *mut ::core::ffi::c_uchar, - len: usize, - ) -> ::core::ffi::c_int; + /// \param session SSL session + pub fn mbedtls_ssl_session_free(session: *mut mbedtls_ssl_session); } unsafe extern "C" { - /// \brief Add data to the accumulator manually - /// (Thread-safe if MBEDTLS_THREADING_C is enabled) + /// \brief TLS-PRF function for key derivation. /// - /// \param ctx Entropy context - /// \param data Data to add - /// \param len Length of data + /// \param prf The tls_prf type function type to be used. + /// \param secret Secret for the key derivation function. + /// \param slen Length of the secret. + /// \param label String label for the key derivation function, + /// terminated with null character. + /// \param random Random bytes. + /// \param rlen Length of the random bytes buffer. + /// \param dstbuf The buffer holding the derived key. + /// \param dlen Length of the output buffer. /// - /// \return 0 if successful - pub fn mbedtls_entropy_update_manual( - ctx: *mut mbedtls_entropy_context, - data: *const ::core::ffi::c_uchar, - len: usize, + /// \return 0 on success. An SSL specific error on failure. + pub fn mbedtls_ssl_tls_prf( + prf: mbedtls_tls_prf_types, + secret: *const ::core::ffi::c_uchar, + slen: usize, + label: *const ::core::ffi::c_char, + random: *const ::core::ffi::c_uchar, + rlen: usize, + dstbuf: *mut ::core::ffi::c_uchar, + dlen: usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { - /// \brief Checkup routine - /// - /// This module self-test also calls the entropy self-test, - /// mbedtls_entropy_source_self_test(); + /// \brief Set the threshold error level to handle globally all debug output. + /// Debug messages that have a level over the threshold value are + /// discarded. + /// (Default value: 0 = No debug ) /// - /// \return 0 if successful, or 1 if a test failed - pub fn mbedtls_entropy_self_test(verbose: ::core::ffi::c_int) -> ::core::ffi::c_int; + /// \param threshold threshold level of messages to filter on. Messages at a + /// higher level will be discarded. + /// - Debug levels + /// - 0 No debug + /// - 1 Error + /// - 2 State change + /// - 3 Informational + /// - 4 Verbose + pub fn mbedtls_debug_set_threshold(threshold: ::core::ffi::c_int); } unsafe extern "C" { /// \brief This is the HMAC-based Extract-and-Expand Key Derivation Function @@ -24992,8 +25943,8 @@ unsafe extern "C" { /// \param len The length of the personalization string. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + /// where \c entropy_len is the entropy length /// described above. /// /// \return \c 0 if successful. @@ -25118,8 +26069,8 @@ unsafe extern "C" { /// \param len The length of the additional data. /// This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT /// and also at most - /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - /// where \p entropy_len is the entropy length + /// #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + /// where \c entropy_len is the entropy length /// (see mbedtls_hmac_drbg_set_entropy_len()). /// /// \return \c 0 if successful. @@ -25602,6 +26553,28 @@ unsafe extern "C" { oid: *const mbedtls_asn1_buf, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate a string containing a dotted-decimal + /// representation of an ASN.1 OID into its encoded form + /// (e.g. "1.2.840.113549" into "\x2A\x86\x48\x86\xF7\x0D"). + /// On success, this function allocates oid->buf from the + /// heap. It must be freed by the caller using mbedtls_free(). + /// + /// \param oid #mbedtls_asn1_buf to populate with the DER-encoded OID + /// \param oid_str string representation of the OID to parse + /// \param size length of the OID string, not including any null terminator + /// + /// \return 0 if successful + /// \return #MBEDTLS_ERR_ASN1_INVALID_DATA if \p oid_str does not + /// represent a valid OID + /// \return #MBEDTLS_ERR_ASN1_ALLOC_FAILED if the function fails to + /// allocate oid->buf + pub fn mbedtls_oid_from_numeric_string( + oid: *mut mbedtls_asn1_buf, + oid_str: *const ::core::ffi::c_char, + size: usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate an X.509 extension OID into local values /// @@ -25679,6 +26652,34 @@ unsafe extern "C" { olen: *mut usize, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief Translate AlgorithmIdentifier OID into an EC group identifier, + /// for curves that are directly encoded at this level + /// + /// \param oid OID to use + /// \param grp_id place to store group id + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_ec_grp_algid( + oid: *const mbedtls_asn1_buf, + grp_id: *mut mbedtls_ecp_group_id, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief Translate EC group identifier into AlgorithmIdentifier OID, + /// for curves that are directly encoded at this level + /// + /// \param grp_id EC group identifier + /// \param oid place to store ASN.1 OID string pointer + /// \param olen length of the OID + /// + /// \return 0 if successful, or MBEDTLS_ERR_OID_NOT_FOUND + pub fn mbedtls_oid_get_oid_by_ec_grp_algid( + grp_id: mbedtls_ecp_group_id, + oid: *mut *const ::core::ffi::c_char, + olen: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Translate SignatureAlgorithm OID into md_type and pk_type /// @@ -25846,11 +26847,11 @@ unsafe extern "C" { /// \param data source data to look in (must be nul-terminated) /// \param pwd password for decryption (can be NULL) /// \param pwdlen length of password - /// \param use_len destination for total length used (set after header is - /// correctly read, so unless you get + /// \param use_len destination for total length used from data buffer. It is + /// set after header is correctly read, so unless you get /// MBEDTLS_ERR_PEM_BAD_INPUT_DATA or /// MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT, use_len is - /// the length to skip) + /// the length to skip. /// /// \note Attempts to check password correctness by verifying if /// the decrypted text starts with an ASN.1 sequence of @@ -25915,13 +26916,40 @@ unsafe extern "C" { unsafe extern "C" { /// \brief PKCS#5 PBES2 function /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs5_pbes2_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params the ASN.1 algorithm parameters - /// \param mode either MBEDTLS_PKCS5_DECRYPT or MBEDTLS_PKCS5_ENCRYPT + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT /// \param pwd password to use when generating key /// \param pwdlen length of password /// \param data data to process /// \param datalen length of data - /// \param output output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if verification fails. pub fn mbedtls_pkcs5_pbes2( @@ -25934,6 +26962,50 @@ unsafe extern "C" { output: *mut ::core::ffi::c_uchar, ) -> ::core::ffi::c_int; } +unsafe extern "C" { + /// \brief PKCS#5 PBES2 function + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params the ASN.1 algorithm parameters + /// \param mode either #MBEDTLS_PKCS5_DECRYPT or #MBEDTLS_PKCS5_ENCRYPT + /// \param pwd password to use when generating key + /// \param pwdlen length of password + /// \param data data to process + /// \param datalen length of data + /// \param output Output buffer. + /// On success, it contains the decrypted data. + /// On failure, the content is indetermidate. + /// For decryption, there must be enough room for \p datalen + /// bytes. + /// For encryption, there must be enough room for + /// \p datalen + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \returns 0 on success, or a MBEDTLS_ERR_XXX code if parsing or decryption fails. + pub fn mbedtls_pkcs5_pbes2_ext( + pbe_params: *const mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, + datalen: usize, + output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief PKCS#5 PBKDF2 using HMAC without using the HMAC context /// @@ -26165,6 +27237,25 @@ unsafe extern "C" { /// \brief PKCS12 Password Based function (encryption / decryption) /// for cipher-based and mbedtls_md-based PBE's /// + /// \note When encrypting, #MBEDTLS_CIPHER_PADDING_PKCS7 must + /// be enabled at compile time. + /// + /// \deprecated This function is deprecated and will be removed in a + /// future version of the library. + /// Please use mbedtls_pkcs12_pbe_ext() instead. + /// + /// \warning When decrypting: + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is enabled at compile + /// time, this function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// - if #MBEDTLS_CIPHER_PADDING_PKCS7 is disabled at compile + /// time, this function does not validate the CBC padding. + /// /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or /// #MBEDTLS_PKCS12_PBE_DECRYPT @@ -26173,9 +27264,17 @@ unsafe extern "C" { /// \param pwd Latin1-encoded password used. This may only be \c NULL when /// \p pwdlen is 0. No null terminator should be used. /// \param pwdlen length of the password (may be 0) - /// \param input the input data + /// \param data the input data /// \param len data length - /// \param output the output buffer + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. /// /// \return 0 if successful, or a MBEDTLS_ERR_XXX code pub fn mbedtls_pkcs12_pbe( @@ -26185,9 +27284,62 @@ unsafe extern "C" { md_type: mbedtls_md_type_t, pwd: *const ::core::ffi::c_uchar, pwdlen: usize, - input: *const ::core::ffi::c_uchar, + data: *const ::core::ffi::c_uchar, + len: usize, + output: *mut ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int; +} +unsafe extern "C" { + /// \brief PKCS12 Password Based function (encryption / decryption) + /// for cipher-based and mbedtls_md-based PBE's + /// + /// + /// \warning When decrypting: + /// - This function validates the CBC padding and returns + /// #MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH if the padding is + /// invalid. Note that this can help active adversaries + /// attempting to brute-forcing the password. Note also that + /// there is no guarantee that an invalid password will be + /// detected (the chances of a valid padding with a random + /// password are about 1/255). + /// + /// \param pbe_params an ASN1 buffer containing the pkcs-12 PbeParams structure + /// \param mode either #MBEDTLS_PKCS12_PBE_ENCRYPT or + /// #MBEDTLS_PKCS12_PBE_DECRYPT + /// \param cipher_type the cipher used + /// \param md_type the mbedtls_md used + /// \param pwd Latin1-encoded password used. This may only be \c NULL when + /// \p pwdlen is 0. No null terminator should be used. + /// \param pwdlen length of the password (may be 0) + /// \param data the input data + /// \param len data length + /// \param output Output buffer. + /// On success, it contains the encrypted or decrypted data, + /// possibly followed by the CBC padding. + /// On failure, the content is indeterminate. + /// For decryption, there must be enough room for \p len + /// bytes. + /// For encryption, there must be enough room for + /// \p len + 1 bytes, rounded up to the block size of + /// the block cipher identified by \p pbe_params. + /// \param output_size size of output buffer. + /// This must be big enough to accommodate for output plus + /// padding data. + /// \param output_len On success, length of actual data written to the output buffer. + /// + /// \return 0 if successful, or a MBEDTLS_ERR_XXX code + pub fn mbedtls_pkcs12_pbe_ext( + pbe_params: *mut mbedtls_asn1_buf, + mode: ::core::ffi::c_int, + cipher_type: mbedtls_cipher_type_t, + md_type: mbedtls_md_type_t, + pwd: *const ::core::ffi::c_uchar, + pwdlen: usize, + data: *const ::core::ffi::c_uchar, len: usize, output: *mut ::core::ffi::c_uchar, + output_size: usize, + output_len: *mut usize, ) -> ::core::ffi::c_int; } unsafe extern "C" { @@ -26286,6 +27438,11 @@ unsafe extern "C" { /// \param session_id_len The length of \p session_id in bytes. /// \param session The address at which to store the session /// associated with \p session_id, if present. + /// + /// \return \c 0 on success. + /// \return #MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND if there is + /// no cache entry with specified session ID found, or + /// any other negative error code for other failures. pub fn mbedtls_ssl_cache_get( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26302,6 +27459,9 @@ unsafe extern "C" { /// associated to \p session. /// \param session_id_len The length of \p session_id in bytes. /// \param session The session to store. + /// + /// \return \c 0 on success. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_set( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26315,12 +27475,13 @@ unsafe extern "C" { /// /// \param data The SSL cache context to use. /// \param session_id The pointer to the buffer holding the session ID - /// associated to \p session. + /// associated to session. /// \param session_id_len The length of \p session_id in bytes. /// - /// \return 0: The cache entry for session with provided ID - /// is removed or does not exist. - /// Otherwise: fail. + /// \return \c 0 on success. This indicates the cache entry for + /// the session with provided ID is removed or does not + /// exist. + /// \return A negative error code on failure. pub fn mbedtls_ssl_cache_remove( data: *mut ::core::ffi::c_void, session_id: *const ::core::ffi::c_uchar, @@ -26373,13 +27534,7 @@ unsafe extern "C" { /// \brief Setup cookie context (generate keys) pub fn mbedtls_ssl_cookie_setup( ctx: *mut mbedtls_ssl_cookie_ctx, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26425,6 +27580,9 @@ unsafe extern "C" { #[derive(Copy, Clone)] pub struct mbedtls_ssl_ticket_key { pub private_name: [::core::ffi::c_uchar; 4usize], + /// Lifetime of the key in seconds. This is also the lifetime of the + /// tickets created under that key. + pub private_lifetime: u32, ///< context for auth enc/decryption pub private_ctx: mbedtls_cipher_context_t, } @@ -26480,7 +27638,9 @@ unsafe extern "C" { /// /// \param ctx Context to be set up /// \param f_rng RNG callback function (mandatory) - /// \param p_rng RNG callback context + /// \param p_rng RNG callback context. + /// Note that the RNG callback must remain valid + /// until the ticket context is freed. /// \param cipher AEAD cipher to use for ticket protection. /// Recommended value: MBEDTLS_CIPHER_AES_256_GCM. /// \param lifetime Tickets lifetime in seconds @@ -26490,21 +27650,21 @@ unsafe extern "C" { /// least as strong as the strongest ciphersuite /// supported. Usually that means a 256-bit key. /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_setup( ctx: *mut mbedtls_ssl_ticket_context, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, cipher: mbedtls_cipher_type_t, lifetime: u32, @@ -26535,10 +27695,16 @@ unsafe extern "C" { /// \note \c klength must be sufficient for use by cipher specified /// to \c mbedtls_ssl_ticket_setup /// - /// \note The lifetime of the keys is twice the lifetime of tickets. - /// It is recommended to pick a reasonable lifetime so as not + /// \note It is recommended to pick a reasonable lifetime so as not /// to negate the benefits of forward secrecy. /// + /// \note The TLS 1.3 specification states that ticket lifetime must + /// be smaller than seven days. If ticket lifetime has been + /// set to a value greater than seven days in this module then + /// if the TLS 1.3 is configured to send tickets after the + /// handshake it will fail the connection when trying to send + /// the first ticket. + /// /// \return 0 if successful, /// or a specific MBEDTLS_ERR_XXX error code pub fn mbedtls_ssl_ticket_rotate( @@ -26604,7 +27770,7 @@ pub struct mbedtls_x509_csr { pub key_usage: ::core::ffi::c_uint, ///< Optional Netscape certificate type extension value: See the values in x509.h pub ns_cert_type: ::core::ffi::c_uchar, - ///< Optional list of raw entries of Subject Alternative Names extension (currently only dNSName and OtherName are listed). + ///< Optional list of raw entries of Subject Alternative Names extension. These can be later parsed by mbedtls_x509_parse_subject_alt_name. pub subject_alt_names: mbedtls_x509_sequence, ///< Bit string containing detected and parsed extensions pub private_ext_types: ::core::ffi::c_int, @@ -26644,25 +27810,12 @@ impl Default for mbedtls_x509write_csr { } } } -#[repr(C)] -#[derive(Copy, Clone)] -pub struct mbedtls_x509_san_list { - pub node: mbedtls_x509_subject_alternative_name, - pub next: *mut mbedtls_x509_san_list, -} -impl Default for mbedtls_x509_san_list { - fn default() -> Self { - let mut s = ::core::mem::MaybeUninit::::uninit(); - unsafe { - ::core::ptr::write_bytes(s.as_mut_ptr(), 0, 1); - s.assume_init() - } - } -} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR) in DER format /// - /// \note CSR attributes (if any) are currently silently ignored. + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the CSR is rejected. /// /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto /// subsystem must have been initialized by calling @@ -26679,6 +27832,70 @@ unsafe extern "C" { buflen: usize, ) -> ::core::ffi::c_int; } +/// \brief The type of certificate extension callbacks. +/// +/// Callbacks of this type are passed to and used by the +/// mbedtls_x509_csr_parse_der_with_ext_cb() routine when +/// it encounters either an unsupported extension. +/// Future versions of the library may invoke the callback +/// in other cases, if and when the need arises. +/// +/// \param p_ctx An opaque context passed to the callback. +/// \param csr The CSR being parsed. +/// \param oid The OID of the extension. +/// \param critical Whether the extension is critical. +/// \param p Pointer to the start of the extension value +/// (the content of the OCTET STRING). +/// \param end End of extension value. +/// +/// \note The callback must fail and return a negative error code +/// if it can not parse or does not support the extension. +/// When the callback fails to parse a critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() also fails. +/// When the callback fails to parse a non critical extension +/// mbedtls_x509_csr_parse_der_with_ext_cb() simply skips +/// the extension and continues parsing. +/// +/// \return \c 0 on success. +/// \return A negative error code on failure. +pub type mbedtls_x509_csr_ext_cb_t = ::core::option::Option< + unsafe extern "C" fn( + p_ctx: *mut ::core::ffi::c_void, + csr: *const mbedtls_x509_csr, + oid: *const mbedtls_x509_buf, + critical: ::core::ffi::c_int, + p: *const ::core::ffi::c_uchar, + end: *const ::core::ffi::c_uchar, + ) -> ::core::ffi::c_int, +>; +unsafe extern "C" { + /// \brief Load a Certificate Signing Request (CSR) in DER format + /// + /// \note Any unsupported requested extensions are silently + /// ignored, unless the critical flag is set, in which case + /// the result of the callback function decides whether + /// CSR is rejected. + /// + /// \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto + /// subsystem must have been initialized by calling + /// psa_crypto_init() before calling this function. + /// + /// \param csr CSR context to fill + /// \param buf buffer holding the CRL data + /// \param buflen size of the buffer + /// \param cb A callback invoked for every unsupported certificate + /// extension. + /// \param p_ctx An opaque context passed to the callback. + /// + /// \return 0 if successful, or a specific X509 error code + pub fn mbedtls_x509_csr_parse_der_with_ext_cb( + csr: *mut mbedtls_x509_csr, + buf: *const ::core::ffi::c_uchar, + buflen: usize, + cb: mbedtls_x509_csr_ext_cb_t, + p_ctx: *mut ::core::ffi::c_void, + ) -> ::core::ffi::c_int; +} unsafe extern "C" { /// \brief Load a Certificate Signing Request (CSR), DER or PEM format /// @@ -26740,7 +27957,7 @@ unsafe extern "C" { /// \brief Set the subject name for a CSR /// Subject names should contain a comma-separated list /// of OID types and values: - /// e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + /// e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" /// /// \param ctx CSR context to use /// \param subject_name subject name to set @@ -26871,13 +28088,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; } @@ -26898,13 +28109,7 @@ unsafe extern "C" { ctx: *mut mbedtls_x509write_csr, buf: *mut ::core::ffi::c_uchar, size: usize, - f_rng: ::core::option::Option< - unsafe extern "C" fn( - arg1: *mut ::core::ffi::c_void, - arg2: *mut ::core::ffi::c_uchar, - arg3: usize, - ) -> ::core::ffi::c_int, - >, + f_rng: mbedtls_f_rng_t, p_rng: *mut ::core::ffi::c_void, ) -> ::core::ffi::c_int; }

          &E)mRl4T714Ho;71uV9+=bHP6BKM~BlrlS2Y zUFMH%iI}!e5lqff!7Putg8jfecB#*NHwk9hP@?Ku#x$vEgZsRA!=Q>Q0JSY!I*_Zl zKD485ayg^5fim{F79pu77Yv9hS}o2+Ce2T9naLnsGcD#qGtqS>Bbh5ibEO%%{-nVX z|HN0IjNjiiXgKXSm!ORAx(JQBpC;81ZI&=M-+J-)OTZ`Kqdl}Q4V&861Z?wdfm^z5AV-h;1%mz9Q&K>p zeD-xJ=k{#A-EfyPf{5mKGTg*|@#p)hM}TP`yB@WVY1n*p=y(J{Mvr^Vlb;UAhwwOx zJ^6TgQoiSbZN7FXcX%729_3fqi2c|oN6@Y`zdTJT-!5RAk8Lkr`EhJy^BuMLsIPpB zKt?{$7`X;ufne?!MyYb?y_P_a>nSk~%bOBFK;mCZz_5Y*h1Cslj4_FdC zAFzM@@N#E9;6}^`Z2O$%1IG71AJEMCfRrT62dvw&JUk)b@x+}FSQ|4Tutg^X5QKYp zxE}9oLg2u&Iw3I2H6dW;IpRzRn0bK6gaF@XfL6Q-ftdM#mw!BU>n-))+e(@E?~Jkc{QaGMfr^r`jWgaHcE+9m zR`oCC+rRhE-??k$Z~u7WZ#RDUaZcv3%=2%!eD#5MzW1%IEAF^|=fhn$j;KC0=euQ| zkB>|lb;m1D{G|Bor+$692yz-?FO0K=~-l65YiYLBy`QxMB@oc_iV%ZOJD|bG4^3IL> z@A|^#1I$7B8UA=%l(#}<*W$QZmKaam6J;20jmoagakVWqp14QKFy1Pa-EzmZe1-8` zzM_L+*mcTohAgEq>`)d4AxYZ(RSAE$6n}d7wIN!oSM-#9dO-rje&791RRpF8OxQ_`n=Jbd<>=bkd@sdZ0}nq4z|)XC?Z zGw8WVTh?y)~nh#|`xJAXNN>D86_LoXQp zUgmcRCu`GQN~Um%!Aj6T24 zv0qU9{lN1CmjLtGJo5B4?~;ZE5feVH?F?T33-c}*>L${5&$~=19MEJ*JT*5JQ+3bH z#JRQaQj0V1LX8CTE+%rK8~ow957+&D8XuWoiOjo@EaIPd-i3Pq$h-^V_cQNelHjud z`iw(l-UUGeemDTSiRWFMz|UviWf2bCFJj*1Oc;^DZ2x zsAzuO^DdXbsH4KiE}eSJzkA*)(Y(ugiQ~tfQjT_|bU^biK-C~tc%;dVV_P;+HD!iUk*#mHaI;|18lkAN=h3JlaQ5J5+Bb{OtKW^7*ha zoc^@Ww5yi3NTb4&^V(|o5WRz)|L{67Q>K~c>wN=wZeBC=KfGN@34QiP#kqZVo0<(j z6|FPwxoKVgcWYDU!?uC6DOqqJJW1SNo64V-=PW`rfHqYw1*vVyc^4xk8S{K&dV3>} zaKZgRZ*O|*RhS#(qd<`mTvIt=$0A`M3Ikr#d&;JTA2A7&(f6`>f`lF_Z3n+o!GAn z*;>xGjzY~VTU!$h{u64uu6g<~*-2=?X}G>uBu2!&mibHRKg=G%-&Bj86qZL8$tHHpnvDmvI1AqV9b*lfPt79Z1B`)&fZ`7VJwo_!l#eEg=a z+J|9en6KHz*9bTBprZEG!^5`kh{eZzs(nT9$1i-(^DhYNzVwFEDkiCYT0$`76*#0P*7uDnX@>W-5u9vnzkKtNx?9(PqohIiKXQ_y2!Oz+D0rGXo_UnuJP=>H?vnnhKA4RF@ak&Z-Jlgen3RRl)gT zf4u3KA1W%ZwLSRUlFN(pWwuvQpe7WostDB<%`6Ypgd-Q1RhI^Wp^B=KK&W_TaeV(- zGvoW$2IKlyCD5N&8ZkU_}|j%Ob6JPGEj0Ft50@sB(57R9!PChBHc`q;vpENNyl%LDd(1wHS-~RdOsEpqf)!eI`o2&_MO#C0jiwR9zIT34jEpUmK__v5%!-uqqg;sSO4U zD7mnrBGRW-R)xadU7)fySXCVf11l3lUlyvlu)4Y`80q=gYvhOO@~4K6Sn-*hAMrul z;^6%1+Nw}-c^Sy#h0xkyWl?!3SUEc!UK1#v6{-!?L}Jv`l*0~gfnY8A<(itJ*;Zf5 zVAGcuS5;O9ifhZNDnn(F-Xwl-sJN=4x+ppg#IJ=(=$V3LMdf7|7m+Gr7m^87nmmPS zO9PdmilRu%XChkm2&h56*uez@(J9Oc1gb;T0R$E!D`m6Fii>IkQ7Hrim4Vq+wPmqs zR}{?)%?cLHu0Uai(AmzeEscs<9jroOqT+ogyVsHnXg}taiRRCB@T< zI#A4cE8g+OauC|s2mze)Dgr^&xBGzTGnz@K&!{Y#KvA%KeyF6VwkT9nc5!r}Iz_`a z5|y)}^6Kd7HLa+qvbHP~4B)_s91P($R2nERuL{+nfy{~%>a_F_4;C<7SQBkU4H_=n zCVI>{0qdMhax^)RhAN9H0->_X61EGw?IFxWofRmmy)bCC{drUKrt>((A%Xs{CgxD( z@FUVni)t$KrLS;#UKA{=#YiMvJTr@G0@Dg?k1~9Hxx(@&hNeO4zCS{N`fY_PzNpLV?g*&~Z?PL1Yh{o)wT$j!%nPn-LGA}Oc%PVYa%^7#jMOK`Ok|@Vi z%T-lohhf}SUR6BD3a<`S#8fx^+_jCqK9Yg(=_JZ4HcD}gZHgI5MzP==G1>OeakWK@ zn$Mq-7e!;8Hp1;HSO%j@Fso_N@!S+)GK2FdCtqEN_P|&@%7ZuGqdYitw>)rE7Ng19 zZGlH>aaGlvGPkF5NV{W~m$`guf^{w*bV-(v9_A4%%<+wm#8NU|#pq$2lfFy0I9Q$_ zpeC3gAc#&SZUXK)cTxtA27Dnix*pFK>tZh6obIU-o`cB^FYdnCk{sh6;u&u#aK2-m zxOxAK@7YnjGWo-u&e?LV$;*in2UYGZWiK)vu7h;{4(zwdQdy<9+$(#<%`6KG^ zz8P&HuE0K1@B-{PWkUbUu{U#mz&8N<#Q#3*vjy|rtsKEGU_VhX=Z-kvM4og^_;CJ( zm~)qfg6n{12<`y(3%(V&MDS05O9lT1xLokZz}13BApf<3rvuLud@(TR?3nI90WT1I zCvc2GV}O1;2(+qDRA!+TmZaV@GRgxg86O6 zM+L6{-Y@uO;3ow0zWPDIj{_eP{0HD?1oIyF^McO+eo^pj;Fkn10e)5RM&KiY?*)ES z@B!d=1^*uSs9?U+^P%7`<8b>#a24<|!5e@%wa0Sk0p>k&;={m$1%Cp}wn+aWgVFv4 zj|a{aTmn2o@FL*Rg0BYl3BDINTky|;a|H8SY7+&&2b?E33D1fY2tFCOP;d_L48hZZ z{esJZO9X!nnD02!<`&>`!E1my=THBefNKSB1LiY$^nU>O62VUZFA)4ZaHHTq052AN z6u4DzFL1lyFQN146g&oamEcLhYXlbouN6EOc)j2daF^hvz#9dx1HMu4jlj1G-Uhr$ z@Q;Bv3*HC3Mer|yw+nt5c!%Kkfqx`;&~a%0f=>Y6EqEO89>Imcj|wgY-Y<9_@DqYt zfDZ~@1AIvE4ZzO`-VXe{;61=E3O)e*lHmUUepT@6z()js4E(0x!RcuKf=>ZHD)>y` z4+YNz{zULaz{do)0CTdP_5M%5DT2QZJXrAefYSv(2+Z#SQU8~~Jcke;0cL+n{5Rmy zf=|RlPCmgC`M{I=Sr2ooP98CAZmREGi8bv#xN&CIB68nub1fv))LL)o!V9(PeY=Lm zO%0cZgsz|aZ_&ESpr(9&ci)^f$I+FCWfg9CJr{PN>;!Yq4c(WK0@>>h-L;X`_;>4} z=)JRhro)Y;`{YKjH z&#{k++K1>-eCZf`v?BAgkKMD{_c$>5CS#*)0#|@aA`IikINax9qr8lPPoo3Pzv`U{ q7qLna4Y5SSc%Re0Z^e3}Xws_3XQZv{c}l>y7Jdw8T{0g`;{O3a-+&YV diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedtls.a b/esp-mbedtls-sys/libs/xtensa-esp32s3-none-elf/libmbedtls.a index a972e52d28ecd59cc2c06ae25ab28c07f799221e..78dd0b591e4075e3284ba446a2802219f5299111 100644 GIT binary patch literal 446692 zcmeFa4}4VBnKyoCGWpA>NerVxSSJV=ls`!b5Y*ZP2nIovKO(rg!;qPfNJ3%~1X|q< zQ-ulD7E)RgYr7B;0~M>RtFhK?a4C&l*;QV5%l56i;?H+$yY0T<+G<;Me&6r8&zZUR z&P+nP`}y?!eSYtOllwjAdCqg5^PE5ToO93ITXI9Ny}t3ryqSKxE3*VmZ2jx^&#Rg% zEbHV`pnstM&`R8B>AjuMaF;8x2z9` zI-5HJq44_68v-5S&Om2ld$^;qwK-(iX>ILIn>qt69UD@{w}(4Z#;@PpkTSldttn-E zxV|lAe0_UL`3-?^eW)>>qNS}P&>jwk!tH^kO-+dumiUJDa5xozLpYo$v4wwwrC^rm z`qq|~)ETsg>zjj3E%7`$I+_FZ!TQFqU8O{{HHSnjsv?Dm_HawqiI8+ZDSzVJhD<`bMjcM64=}k z?m#QEWtBv4>)2>x*wPMz2I`xeP#=NDaC393ja=W_y0Ix$gD~S&H*9JNw{CW{0h63m zlOhhuHYa+Isw6Xk(k7JxXqEML#aTt6z=rnL&253s)&MHimQIY7lGGVQ8%j#i*52CL zTHo3nxDU;&sdbZ$fg?{_dqbdeTU&~xtmp97w$^qGN?@?1Wa+e->?*1<1v+6qdweKd z-@dJ_GhiK&l#OTuj2iW=?e-R~#>Mthe_ zp}A>8Bg)nu+|*$mOsLi7wh+u2Knn=8wPN6f@oW{*(7d^$k>oT&liG;cB2yHT-NuZj zv7rho$(9ui)(~dj#yDUZJE;hRnN-oy7g8J2q^523Y^v+Gag+((2Q6)7 zG`oEp4B@;BvGg`pRT^7NeRC^R-_+XK)UeG)P<^wZwY?>|?Q`^L+O)oPGfW?6vn3`6 z$}$p*s+m;HQfgevW7e%rI4J?M?o`Fwh@DOK8)LrOc&psnXulMk^}PFHw%gFuoWi_n zJOf9H{DZt_HreM~94^o^J2oX&$>wZIMW+Pv=ZutmoY9)sS?9C>Ep0A7;{%D!es&&9McTMzzJd|1ts`is@QxH} zM2}*>TJNX>rCFR>-?=qa+Lk~ICNn8kqbfC*OR!U8s`esFDSKt8RP~$N?@N_Jt;+2D zs-4JHSD$CXc9DGT%R1J%1)WTbBj-{+|vY6}Wk$KQ7QRB(?G^S^x=c+~4(QUzP z&8?0_hh{?$7=_E6;yUjYOrPo=rfa4n=-3z3gd|N8(*$%8`+iZJWHT;CdEDC4H}?c3 z>BiTI4jD*NEos(<7OXgvbY;`V7@9OEl=x7%A&BOb+^Uf#DH9I3YA3VJzU5_!Pud7H z_Yb8#HrXdVEnISoNDlHgn=!&nX0q9c=2}$^^8s#wIo3oLvMm{#fXQx3#$LJX)Hwu@ z5%;=)nL`tX9y39TyvS;mGa{oYkBgTP+2XCpTo>23H?`S&ytz{#H^8LL9PHjV-52JZ z%U-V>Wa@*>^?E32u@94&Sl}s!N{T%lbNsiNkJEjunbmGATJyb|!;X85>~f&zH8nKV zJ6FgufblMsiY&VyX{b`ApkhB6TR1kw6875C9&E$LE1NFoa;axMPIj9tvkc~bnB#6^ zYM7G5R$%V7>Nzg$hBxtSa7(!06HPGNaWBFV%d2CIbBwbRzxW{OJPYt0PV z$vQ9?gf?@Qh6Q~%psbZ5Pnl08tmIrdNfEH^z8ShD_(sZ~oAl)VeQYF2taUI_770bt zwRcl-vwt>)FsEwj#3RcH#9T)||x zt#Ou{t~^-E)nkJ+V7YTib5Bty^G1akY8dz65Jj5XohevT$W6f|!*H7WqF6{hg44GN zwGL!QX$j)F*@cKqUmUHYzU!rYJYp(gDtZBoiMldx*XcC`=LpYBSaI_7Pfd{mSRn=) z+f$AFYRjx`^Lh+|fvsCZI7^^BC3;<6;=sg=`Wdb3@0ppm2}SN`<zJ?XlR@oC!EZsNJ0Hp7!8_zDQQo?W@X)Mt$#Pf+w0Yw{&&!t?viF5b4j~wLLOy zyfgfZcY={ff3*so9)A0DaC`f4&#``rJeqwf>+KvPa^TahT?@RqyQ3?2?ere$uQPh; zTv2y#bfEX;j8mSsGJl!lr#4dbmW$jLFRg5N7h2-Z@~YwQwxn4vjmJ=+evm9_TX#ld;oee=g6=Z}hz z=RlFlvv>Qx0r#R?jrAputvJ509oZU2ISQHia`rE?-p-JW2e%Ig&)oaVOk~`De3mz} zxEP6F&g?FMYQC)espVsK>@kep(faO!@zL%*-j7hUzM7WIdCR+>?V6mwy5HjqXH*vu2Ab4`1%=lHB^`XY;wV*KsVXM6YDafLhU zC$Zi=UETSpWeO*#y7&l9HNr;pD9 zPc*}#GL2$wWR@yGd-D~tu?=U!;#)IOpKNTm_8-4oRq=}@P#%`-E?-;o78@1u@}q9E z0j(+cW#%W@%1U56nmJhVR#vneTwnaqWI0pw%S=U1lfBYp&H>N1nziMNOXe;2oxTXV zL@(;C@y)x4t>26MVE*N70%gp6P0i6vWbi=V{Nt0@1P#^TJulwNX4t(QB(ot7E*~yA zQ~pa2itc+dXKKNio%eU|uFCJKukpHzqus&#PqgokMT1>m$glod{y^rVkM`yoIn}$n z_OzYJj~t(L%|P^C{~#Melrpc6O#98wdD(}2^QPxyjWJdnpS0_V$bnBR9MJ-4C1$=f zxi8D*b+4(Z_}h=hH0*dcR$8z+$2H;H4LOmTDUq7V({P>Sty&LJhkEbrdNH1tP5-R) zRcEQi^l;AE{HA-?o?m?SmTX_77`Ck{_IZk7*}?J3vU3OASS9tV0JkM)%kl`yWL=RmCQID^l22Y;C}{y!oIG5oX-8%MKY?V2<9{%m{nK)eE8 z&KN#>=DZqW+K*R*rF^(#@gDT40$n?_c0#%~?J@Z`^9I+-_X+D#}OQfHmw&=lGK zTHT&q2hp})X4~=Ij8Sl)HyS;Q5khH+$Q`AIN{+Gho@g}3SCtzNu6b|l(wxYdoL$@d zhmGPfXcKRsS+JzuoTb0%`RANR_e2&O(ab5Of6{RI{CKkHN2QYNonZrcXJuJ(aM0LW zSR}|?n!tZTgUHM+x?u2{Fl&g!UTsCI)58Usc>_iDqx={Xy zcl{c0dn~rYjnF}a%zh*N7}-MNCR`6q|`rPIr{PA;q5IyKJ-VL68f zp8l&RcUbNe?K-v!fRg*)21`e1`ztL#gq#h>vZ(HJ*JxTIR?l5p7c5`#ck0T=fMy!Ow zoAQj>1qQKBL@U+Su9I)^Xj;nH!oq z8#k|?fkoNOuud|wx%s}9>6o|P6Rz)^0S-S%)6JBDin5B?WmOgPrY3c|pScrJ9^-uc ze#+Pk{QGC2dk}URS0$JgJ=+l;;|SYtoEgTY4*F$|@OVe~N=Mk4|0H8j^g~S;g+`{a z%~GCx#N|o2Q_*vc&pGJ5lEY#}zsOi8VP2R%DEu2-lwV-f<4QMCg|9HqnnB|pTnmk{ z#w9{$G}HfvKpevsvZ4=LB1r$N@cuL63ylfJ(?Y)<@r6c-qPoP)83+|w%A?~|U0rMn zqQ#3C0XH9>Sb~P;&q2J)OAf=}#YIKnm`zcp$?p@)c(x+OGaY{Lp|B*6%TzibvKVwF zUt}uzg@}YJf@i+7alKqH%gHp1r@nr{b-3ckEk;om{=k*N6EmM#f|<`9f|*aFU}k-v zVCK^!nE9U-%sh)>Ys&NkFA+>0I&CXmuBC`eDwi-bKkB~%SK=b+CKCly#$>^iQ7)J| zvmKJ3>F8|vvJ&7_zF=Mh%rv^bbiS&d84u!STqnR6F%jG~@Wj;N2Ein;-7%i>zAl*Z zUKY%vWz#0$NoSKS;Grz7kJ1f)x)7&ylkU#+E>;Abs&{D*s@|_K$<%*SX6x76bd+YCNOGiJ1hn}Z6@NcAHQ{+PmK zX~r@2_F!{*F86BK7%H@WYqWw_=u|+2{(vwNcV4MPa4BfhrBApN%sdz$oqmr-U*95 z+~VW%Tn>2)L1Wpp)B1gkLRj^CUB*m~KfDcU{r&}f*77a|ty2pVJ_b1tvdVkUA`dVw z@5{hec|!w+j(gc{Iu-#8E%acSxiCn&GYTUPpK_ymngN21HopO@h2K#8KWw zLZiGj4*PMg!F;vT@>V+PV-@7B0~6(OoF^aU&34GEhCI$uwbSy-9P*xnyscoOyaISF z?+mcDyaPzb`<`}M-v2-ZakUVp!DyUEP#))+THap+TjhNh^6o*Lc3R#uh_K3Qw8-PF zUCX-@!mRR2(b#z})=ta29ZXhv2O+NxOw^Cl4=r!5LtZuHaZazDmRI4B_Y25d1t!Yl zR7K011I*;Q|As(dpVLmu;|N1sEre=R<^V9|ajv4}(Uw+ukAc9xpq-Y-X}(q7dlq@T z|7&?qAgxv2Rw$aPe)ogPDsML$v94dP#n1>TQNO5zAuwRx6^!I!Cl2S zVBG)Fq5>oG^rt7W|Fyz5>~4(s?sHe)SHGtH&H>2AE-Pg}lDXkIciWDk?#SmJ>Tcig zTyEs)PZnih_o+JqU(r2rap64oboCqo`S!Yf+uQ>yq7}Y7-Gh-A1}AoXeQ55B*}d&u zeM58mmhF19&*K|w%*(tknw19yPUacjG0zMR4HQ0eWN7Yp#`u2a`c7Y;=QDXbTn2&S z-Svg;3UBTsxqb7Qjqm5i{;v#0p8j~z?_!asf4Atj`1|q6k7BS9@<+k88c}HFbx$~V z|NC*1C=1RB8opW7JY$X9_kGuUh0%$1^BY(A8eF{*Us3M9!OOZ14|y;7M$XAhD&)aU9|eO3~%w!OZlspWDKr<^7@&tx*mO=^^`SS{L_qGSsXg5tE_r($;W+*&!v0eXC9|$7k*d-7NX>eo|=U z#``MS$p00g->K*q8IO^q3m(FFfP$?II-=~ zSmX6z2ObwEGjLbK>-`#rT^uyvIR0rKj+0tG*WBETp`+ebLQu>Jw*lF4}C17$~HE4nML5 z)IrcubF^@!E1!Br!03Y1iv;2?BA8L1v{YeLUWgk+`?NGIqYRD5y3eSauWCmSC`~f$ z+Jt*UOk?F^d(=+j>kvU)Erk70g7##Q zCN)sbsvqZPS_YG9d;^$>s~HJ5XpzT$N*eY16NkJth?8w5poF|D9P&c~Tv0brdQvcJ(WUpmb< z1Yi~M36Uh|$*^|Nm=Owo_(* zaLeL)+1aj^B2GJ9Z@kj$`usnwT`h!e7t*fOK|H>x=mN*9S##&efHnGfRVDLcJziY} zi*+q`am{u^Y4=2|hPn%}%E78lTNmrOpmF-RI%1=a3ShCc`p0+(GdwWZ%QY2`Q%ui8 zf-Z!Z3bMAkOJXtKPFE0zBzErHJLYHx4sm$i&N6)W7+YUhz3@VF{I~2cbH*9;?5_1 z-f=gKfmCSsK%Vcz?A1QkHup&nRP$}gj=s?CMloO5_Poiz&o^i^z5wo{Tx&PI;LSRH zJO}v<6yW$s7BZNg2jb42xq~I%aoY_8OpoOG2He9X;2S9DcDSBcS3v*SFXS3Iq2CE zUZChj#&;e0Pm?e$Rfs2~_X+=G6`qiGjn4a~OZNFVMiJ&Ou2Ztu zABV?hqsh<36RFjYOlN4R`nkE2K9YpQ6Y}&@5X!6Ce%- zwBTv_h!b(k4oX53W$eJ`!tJg2HB4Hg+qtya@RpNK_1+|V@-#ZjYYpx7szoIfO7ZqX z{VQkNZ;aFJ9oIMQ2LF=;KN9O`!!HUfoeEo{GE#*fRITkDN@rvHVVAgq%y)>-GG zOVLq(ZW%xIP`QMC4W9j&F5O)8e$bqJs_&^((hq?H4!$act#=-shWi%8)$nu=BEYUa z5uWk%4D;-fHQ%L(<2axl`RLqWBCcitZZ`rPW+;zk)AIfe*eY)o!n}WJr{$eRgjL>v zMIQ6l@}>Y=<;hyaVu7d2b^89=vv1-eZWc%A1Cpl@7EmiegS#9K6v}m^0qqU@fiW`{ zyC>#F@4PW&V)L(lZd*QQUWFMm`dat(dB_0H9D7S~E>@SqjL(ocp&M7Mcd#<*!P0iE z$D4Z~7JD`pJ8KxnW3g9W%g0gwPsTjpZMo>DKJSVjjAgd?c2v?Gge&#zL&Y+@_omMoXqcC)RMFMMXZ|>D@DqsgYJ*G_dxqs^AE&g$YkfZ zF~?rbAISa2nAO)niO8!Tlv;ma2L21kr!>AI1%JOgXS-TT`+jId$8|+&dLAFzU7A1P zoL*>xC*sZ<6Ybd_+a1mK_U)XP3ypS1_cLeBWa z@M)gk3D4qvRT<36TR7ny>z4L$!F%8{;RjwbjKlCp;HM2?UlIN=b;U~eD!f!Ni zwhPxHcs8MLecNd<^~@20X5x!F4u#1@JZSm%z_}p8}r=e*pgT@c3^$2>%GcHu!G%&F}&E zdidq=OW<#X{|r3ub&uhC1Fl@dmjh3QzZiZx{A73!{C@b)!GFgvj2ifdfw#g(;XC2~ z41PWQZSXh4FN41U{%P3js9~<(zKZKt5Z4Fa3f~0(lwlap!|#RfLAV!w6MQ55w~+R* zVHi&Ue;e0F;J*y~Rrtg38{xz70|w406crW|_{5|j?_$>H*`0L@XgP#Zg z*M?y{2R|MDdU!Xy3x3QHuJA7c55muYe-{23_-XKTdR)lQgMBhQ8SDde7w4K`_6NEt z5@z3!u$%mPT)ai->^F3`#3@aAu|{KTpEh5@!FQ%gi}zHx+0+usgPm#B+N08u1NCZ zm`mrAFvm)|3Bu2@neIv{@5MtZ2>o+a`7e=hwuGl@dag<5xJ-Akgs&M=K_ffQq*q8d zU&0)l>57D(_X0Yf&^dn7O%OWo7j#z&-7}AY9aT`b`# zLkxjG&!o>7QbE+W8Rk8Mu1NSd52+yZGwD$YPY`;ygs&9(fXR;h%<=EAg!A*v@Y52` z6#BO%oGtW+H9gbhe?-$I%zF-9sg^&af()znaZtijgg%f6D?0B#bVWk{>W~Ved}e-M zlJEqfe_6s;3jK)5j`Eq~_qQaRpJ#@TNjOvJeu9Qmzinu?=gd@KQsK~kQq^` z6vDDj;2faQ3)4G`mamaC+VLuOm}gvdA~a<;ru)^%sB^LrqEw7gJ`cNeXoQwGtKZ< zHC@8JLuN#gr01N5&L`=6hEx#!%S`_j312DnTrl`!YubT`WVbLo%@BE5M(zE{F? zrM}zZbhEwOE#YdJ4=j%JoAZ^sBz&XHAL`=iO*-exbk#E6EE!Tkl+PTWINznaQO2j6 zhg1;yne>$su9o{6gC3D1^rOFX^VpEktPo8jhodNbT0;n~vP42Rpi zY2zlmO4(SobY=PUS<`E3S5B{(J!kq&3vQXdvaV)URi%|uUQwkfU~*Cxm}$~bswmGw zTToYn{}pA^Z@YEr+VWXtvn}-L{8@SJ^c5>>rr)u6Ro(Op;6;iH;=XXXx2;@q!MR@; zFY~@IPL}+_I894gO3xZ(JuR5OfEHyXi8&oitmaXfERv+|QVUCN8L9a!nM&JA&u4Fg z>G{y^Mkys4W>tC?RmPEI2tzs<3u;J+c_+SQre6tLl-+WlSAcXCQDw{fje2D5z7@fq{Y;! z6^nC@nsJ;nh3W0(h;veADm}rjCzxq#z`jXi*bN*_DYiS=3D`Yn+La(iuF?l)~z~*~RrrQ*%i? z7b?e5gDK@WYB7n&Vj^XqBnFFlMqrTINu4@gt4U<3z|?|;Xqo-QEg3htMSUomEGN!r zDTc0Pn>KMqN_5n8YQ_|`gsz;bz8&?Hf-8k~DYz_!RV7WqViA;z#a7CZ)rzxPL~6_N zCLXVgG_5*`CxyL|cq}CZyDC8v&xPtE#T!*fGDE!Rqp1^T98IS4jkVP7 zP|XUgy)THt(fgTILP8o{>1xazNiIk;r?fPxrD98|o87c& z%wfHW(zeVrr8E@8*2Yt`2D7ZG7)7EUkxQ}Q`% z$h%i^BXBh0)JzV|l9^Jdm6|DqPRVT~g-*##DRiFXckx4gf!6d={_o5qT=rjDh?*D}nAk5Nb$-X{9E(4SJ_Yt;KN8TCva z>DLO?yo~-nkV_o=mpa0iIl|)|;VT{Cs~q7{M|i3ue2pXQ)PK5zKEn~7=?Iq@T@rH# zu6&=#zlr^dRXA6jBNG;NM)e2{4M$B1@#~t+!hf|27Z^86eVO#J#sr}=O+I{%r1t|C z;>`?8*%;wU;Q3D4f0yt?6)rJOi99nr+2DH?=uG{XE9z0Ig{=CwP&vc}q?-Ba-#<|u z{mzt&1v4F48P9Y@g1xx1Mj21tCkQ5eg<$g2Y5AGJ`gc@HRyNL=DUJk>((?*463sCF z{?v;EJNZ>vq^T+Sxn|lipHR{#_JF z`dy*QRum@AQ>Wlx z;QF9oAKJ!V!E7f71vdgeC%6argkb&-;7!42f!`IJh5G(L@C;zS*MK^&1}+l(=fIN$ z^EZo?f`0(KQ1H)zR|y`2h8Ge%1GrQ0p8`K9I10R1@LvNT6#NeGbAoZ~&p08t6!=ZS z%Yfe%+zI@F;75Ty(1ZF90kbU=|2yy`!9FyqO2IY23k5d=uM)f)I3)Nv;7-A3fFBh6 zG4Ni&6VQ+j3ceBeIl+Gld_wT&fZr6n5BOcd&jWuT_+NoNC_i=1L0{tUB#CDLPZGQe zxKi)~zzYQ*0$wHfBydRZzX5j&&O)PnQ1BGsy@D429~8U}_&LGbfKLeC3;d?wqrmS9 z9tQqE@GpTqur+lqME~UbmxwEYCkb8+Tq*eTzzYTM2VN!k72uHIcY#^Ql!Ido>UT}b zCct|oekJfh!CQf!6WkAcLhx(AZwmf3@VkQj=>H!GUI^?#y;45kpUB^x5`P(ZlHlio zD+Rv=yil+Q1L!KjWxyf9cL8?_jsia@_&MOcg5Lx_DEI^5=L8pFtT`dL68KHQ%Yok& zyb1UN!8?KZyB6x)56pLP6TbvJN$@`b^EV@m{~ho`!G4Tis|42qhXmgP+$s1=zz+&O z2E14BKLH;U{9EAX1dqqP>V)7MfZr6n7WiGkTY*0i{8eBN+ADQ?4w&~A;;3)8$f}a9@ zSMck=9|%4V>_H!(4uyr#U-0$7lLUu=D+NCSyioA-z^erR2skA8Bj8TKS3vHAg0BPK zD>wjrQ1FAm&j~&Zd_wTw1HUQwe*?cOIKK$`3oZxtpubW76~MgT5^n{bB>0=a?9Yrp z0lZM~&w*D7F2F=JB)AH=Q*Z$ILBTtK_X<7=d{FS4z|RT(1o(vDDY)0ZDfm|4cLi?+ z{y^}4U=R8>bsGle@1Kd!0rP#b#Ft}|Qz`f}zzYSh2VNz3CvZscQ^1{q-vEA4@UMaQ z3Lbws^cP$WjN^>XxA5>y%83uinZI;azhsuTCR@M1jF0M)0pCyTu>KNT{}7hHXXWR) zt>0|cjH!N0n}XM_jU{hp+E;`kl4)v6XlnBUj6rAShaA8oZJ;rH{*?-h@b$B2o{ zH)zjT+OeexU*4O6*J?M16P>8Qt&IW>FX&~9%hO^NIjL*{?@?t;SfID zCbm=WizQ3%Cut*pf7UPVe$j#h5fewsofWSE{iNwCwvBg#$7 zoFvw&f$A$^y!lXdjZ~vTYVJ{MI8`$B1N%fr#RvM5-uN^l@pAae8I@4$4|-QTUkrk& zX595xVs4B$?XV0`j#qk2E0hD9&0)Hy+!p+G@?rRnJI&XQ7~*Q7d~}WZZZgWHKBQsV zW-NoZ%3F%?9q`&|d5aNYl~;N#?mdX3JQhdGdyDgGgmpO%0^?R4cUs;V@LA>E4|&vw z@-Q`t%RAjXpx60ZCt-*M|nR6jdsya%iG{6@9P$Mn0m(LRXgNyf9Gl~O!yeQ z-XZTj$eV6kw*FWS(i;-6!NqTkP{euR(Y!|^0;fM<^2z&$NzYJJd8jI1&PzL{~qyHdFw3l zxV5C^J?YSozk}B@C{p8ohknf#dE7gKno> zG5DBHJL*T5kHMAk6)FT-;N#x8cI2b~COrG0mUlVQaZg=4EpI9!C{L5f$Gvv#G~Xmd z5LXM~F_hPX4A?&~G{o(9r9;1A3_dlM8xr%P*Wawr`Fcz7n=r&{r}I_&O^DQdm0RLgE+r)`cN!u84bgLITrF-E zZ}pu)VxqFCz3GiXIspcrki- zn)hwKVAA)_$KLTumx<8jWRc;!+3-O;Rp!RWxT@8_Fh+g&2I`KW<~JQSEl59^ZJ9Atth!XI&Ej=;sV-! z@nVZ+9F_lNT#97+3K5PmePF9;*uTpP`b zb!yff36A|J$9Jnc^2D3F)<(t}kzjE*wPM0cRi4oxlm&%_&pBOE(0l%- z7u`GlIab{_^el$mHTnByyHEaOEV9rTztH!OMxm-1kJ@l3u*z@+{f_?6W-*w`f5Q}w_jmb^la}N z2y~yl_DD}j(UR^px!=fHJ@!NN#5!ZR=A_p!O?BWw$iF*JRnXDQ=y?dw+C$;PH7N0- zFU2DJW09L(-W-U(_DFPj*RG-7J-d7JclXxxEXC_fy9Nq&Kk8Q@SJ(L(@AbEMkF#BT zS*Z<`s~;MQ1ji4bzvH{^lb?&-_Am{(V{6RonP2OQlw2CAh20AyXT~hfx%R93z;kbG zx5?8QLmOOj`|0D&+i3yaC)$4;DH*>@MXNC;bC_SjMQ3^E3<(cKf<+M9dz|0IUX!6y zA1f)+eCz)Sd>C!EdGFbOI3Hi^80Yd{(O*)u>j+x%$|-heb1cvm0l*;^DnUcDyYSL;G6+1jbbO_52!7}I zU5PYiiWNVwq(CEwwq4yrD~3Py{mP>o&-{|H=mv@Qvk*P$Sn$#kcBW&hDo?pp3tSN_ zUh6vD|D1|DR&pt#J!U^EL8BcTJbk^{ahawGCs{WwM8Xx2xP(wIwA3fwk(I0;e z@>Oaz&hza=U`1p7Cp$tmJYfN(!^O{aacFwJi0zF|O}?(Vg{H3^xJ{@fZw# z%r7;IFnsjcc{`u8-Pl@K1CDGA&@Fl1$*2O4(X@PR&EfLHCDEGhg6MKJa>6dk?3CvI zBpYh4#p{ur;>M0>q~E{y4UNTxWF}WfiZDG7FfC-QzOiR?CYQE`cD2cgEhw%c>eS!U5}`N zZh^b&7X`b&sYaazIbDwyJkw|5%&u?f0dPUa*B^%*OhNFyo=j%SJGEJRy*c~){C(Ef zTqVk+ODkoA?eLba%&0q3I?Y#ikvV4W?>ehKj;%!EK0fz3ch(F81^IQO`{cEF0d;Xs zWC4cE?vls?V_x~jj;S?Dz(9`g&Wt|Sk~JlmAmJ5RZq&w>$_LsW92)<%eN~&+-(*C- z|M6hX_$^2A6>|)o_iS16&_L$hIjgVxWU&01okPO~-QLLXZ*kw*J&?bDpr(I`rz={p zKdMIjC7DqWKbE0+i5nD*J-inz$tcc){ZV`bO4)qH0KFv`>v~<*_ll|Fqi(wn#Nf0s zy6TC37Y`#~#hMNC**Ry82Qn8gzuO&|jN#XqUpjX6LVW6ce(6;(M@@H@81ScO&3={H zT@JNij_C5agYF&eMj7sEjqXKlhOe`*sU(7#+t$LV1>P(Aj_=-=-}kI{DlZ2%c6ghh z;Ni30>kjWB*xtYYw}MqYJS*B)=79|Pz|d~vrj)6Q|O(i*VhYgM~;K~^*$)x59D<<0QV$}cUC zKI|1oeDcL(ne_g!}<*ampthX8NR&PQF|%gZ?Mdp?sDUB0DiE523#d}%up zMQ(DjR&FvN-^}lmJVpoe_4MUH@maK2j+4D_T-$fjZA6cEeIegh_q)$z^}g|FN2JJg z?ZVYt&*Qy*(=&GbQw;rR!nuZ~apoX$;40V_cXBc8gma|@6VAPy>pip{O%i>~i2U7e zQ5b1K3p~gE?&IBGH#-~KjI^c&nO$Gh?Po#8i|1c-E%{HGFwE3-hk};v9O^CU&P6d) z$48|nTGxbgGjHz*w|C$>>Gh4lVDrq5_Ik(X)2GX$6n;uw14 zv6CPA*wmrEk|d88m<_(R8ffeYG=|y(ovi`9S-*Z`$L1Dea~nQY8cu|7_)ID#Rv^pP z7V~5G{te+x;r1XO%K00DP0isDK3E?{7+;r{m(Ti}LYh?9+R@1;4*r&=j+P)E<@h@r z!*RaOruvQH&T0NoQwJaL#N+YF`pqqE%wmRNwZ=3*iWb+zNMz^Ws&8%G*c5g|cD8l~ zoBjCAZ+KG&m2VDj+R)i}oqzJ@HrqH8EFHG^X@1zyZ`t-o(z42})BKY=3{Y79+FNd0 zwKlM#c3JIBx2{@Tvug3J%L0p+ExI+Za>2^g4q+QwJDIfz^mlAV)u+hNG;8~P;dZ~W zV_bjao`yZx+_ouE2uHS}Y2pd&hW6IYZ5>wFXS(s+%eTZ z{YDM{DBq;{EcR=(OLdO*A(u&g9v3%H=SlcI6)sTkz$3>+*yC~Ii%}i2QT16x=M#v8 zOFqZyq>o8317)bwfQhIK^)*;)xF8Ww{M=zrxD4ADtSIj?<59g)2sZ9R9hdSj6~kSY z%`1ivIKp3%@@alPr_ql5S3ANM@k+kSk^U`5_zFju`;6LA{y$p;GR$wfYR7PfL*Ip( zh%4!J4*hThDDFr}eG-&au$l0Po_)CtNi=UN-Uf7_Y+HF=pvqgKX4DiyZ%H$ zBT9Uwi616LzK4na7+dox`$Jlu2euE`3jcWYAqjc6m^Wjyd#fQN{um^>#Wz6IA|VtEKiJ;?tEuCEi9 z;t$-L@QnWnuG~W}g8k?)@+s`WHD54QohI0e>sJKhV)O|n@6QF}qP~4bnXLN%l=vbN zU^~Va15Og`2d)szd=?8X1Aag-pz#I4G|?9YvpDQ~lvxSJn0e>Jk1nfbbF@6;=Uf-qg z8eo1~p7D19-!2%?;MruxuLI_JWMaCP1UCZnJ9s+2P;fKi`8+oB-~U_`Se;EId53%)ELL{|&*zz)x9tjtPDZ@uw~EX9Pcn`2Q)m z2>7=a9ydA$<-d;j%LVTTt`Q7q+#>iO@Lhrjfd4}9Q)GhEec3}SeK|)k`?8lfAAjIr z&iHQ_N(D3B48crSE|}@)^cb$?GfvCD3uUm%XErW*2wzMrwC62?DdVexnde^$_Tx%No6u?fzX+X`{$dlW&XlWlR{D$1 zyuIn)POwPCl*ii%G38AZOr2K?rtGzXDSNMA>O3r%`OrD_{I)|+rXkP2BHm9t4S(QD z;a$@eH1DV2;rGNV84r9F+CUXC1;E_^uj`_k7(9G7sr2U{4M&+gkIgdD1jH=kY{4w! zJ%U-T4#BvnZ-A1Y**z`sEaUeC`*Hne!IN-R<2LyHfHOH}0yF;_!GOk1f?4EF!L;q4 zTX-H6T#fiI30??%NN^eOzgYO+6-+z*R50!IYr(XW{Ts;EbvTanmCp*8tM&ExRuFaz z0<8@J9JC8y;ocq&1$aypD>>Wh-kPc@gdG4Je8oA>)CtYwZ0h72SNCRK@l{*ET-2#7 z><8a2h}j{Q>&X#C#Tl$dNU>RwRAf;br$uo#(vpQkfkxRxuyE*ue2Mbdne=CttQw`; z9tnllZ^n659Et4=w1?AIin$XJQ2R1er6Z~ODx@Mt<}`DPFXZiF)cUm}fb+IC>0JAV z%xdNSjg!o?k#PgGwW1{9c71@^Y67#3;ZSw386Q##SoKVI_|vST6r8#WtnyPZCzG+4 z!3`MdhdmfuG1Kf)S!J-OaogeZQXLzUJ}9NxtrgqSvB8!T?A#8UrQb`#!Sjwr2g8h% zr+2N{tl!*V%jP~9+T3AF91Bfn>4Y-;aF%KaBOF^z#jOj@UZFn(MOnIO*i=)7tZ$P> z)fAGG$2g9RW4KmHmMt%n$3gE1<8x@zxzO+0n#0)mNh?7g$fb^Es~Y)~Z21gMIxf&H z#RLMktGFx0#9<>R72+^_E64j4F{WM0ah$h0-rMM6xK}#)&X^?iSM&WAe8km4E5?nF zzj5Un2A`e6zcmv^T_o)?*M?@T)_kKgjK%DW%(n!!YQm_o$meF$vTkH4|; zBThRlk9!$bdGA499pWetQ>3^&&RwkX_}iTK5T~7%_a-8&^2#7+9pWgD^GVWZzo+1> z^7z|5=Bu5S_aq{$@^(YegNUO%Zmno}5n!u4&QH0wsGXMg03xjNiZDqlLPE;3o{PN; zjgj*7Il>Yc_XSG_B#oZuo_S@PqdS8}8Zx2!tNC^zEwOet&=?k{Y5xg6>v=i$b2{or zr}lp21~ZjSoi zl6u&B!*KU}JV>liPo)t*Z@%UEG{U|@e$-a67BAV3=V0>LT2rv)FP`fjJ8n$#;@ne) zvHH3U@1y3UxR>+1#X8;UAG#DzB5d>{%@~B=#xuS=^&w-P)3ZDahYknuHRJa)ec#WF zW&rN2T-CLA==oQd^;V2Oe7IuwK+UtU*fU4+cMoqKI^yrIGoE=dzw4!fu09tZVh?UU zR+oW?)4TWos=v<7Q#Ez2!Hgwe>{e&A+@~_$^87OM6CN~EnWI4ZY@p*T;hX~~d(=|` z1!iB-_0Ul9tNW@7?#@_D^L!=`=|S<0!*fIL(i#{n1E*^|#_FGc3Y2v!oA{bfj~(Zs zucH~@u5+!v=92*rVv1iw9AcuL$Z&DDM}4lzdR8%J8X5MD9QSm)?!~rEzsI-P({Q2$ z5vPZXUpcN$RN(W_QWAV7>i!ScANOQs;kqc>Sn@amDw~&CP~UG6UHo^{M3p;x!nx>t zaQN1EdNPdu3|H5Yg55{_$FSr4Qo$=38C^edJ@c}E|F``62W#Gl#a@3Yf9NIu>qqjz z1|!3^u=7C0?nj6ARqgaS7_Q!a4$B!%>F4Z#+OLH|c4BQYbE<=raiHHpJ zPX4x@j^npG>D$7%(OO)pZx26Yp|h{INSNao_r$dX-UkbDH~f-CfAaIJx^@ifZ~bz8 zUx;rfU+dt%$ie?Dofuc9|3JbV#|!ZWhu;Z5^(w?a?pJ6>e(nWn$1wLGwPV;4RPz7C z5<&WU2|okOZxz$&{b~-?R{1WB-*g-o^?o(yNJTQHQywwtbb9Yd@yl4v8rAzkyoYHy zg}_CUkZXQo2B!&TInt?gHl=7Vp{{c#GQsU_UHxzm`Tm%^4U1KaFgJuAm= z51YW7{zq~aE}gn1WTvu&8(V_)SVJTK`1~JSDpoDH^sjT1f3j!FN5akcK=5d4m~57O z?Gg3(?67=lIL!}Y&D_)}h|zNsHpf?sExD`m@t4XSjYjGv;st+$*i=j{qeoZFWOFKF z9_g^!ziCrL>*&8Lm9{h5_lQjmZQmV66Y+*TKk!T6g3e}u@+>rzYxdw zh{!Od*qbqMeP9_o^{}Y=B{)V~`-Q;6G*&+LQ|&YkAcDAB2+ttEzIr7*^&ySn8hEQb z?kDmdq@9+>G0-aSyB2vI0<}C2Csuj4AuK}}kjcku3v6KJTZ1?mqDWTqcy)fCbr>04 zj(C=X{5oGgleWrR2by_T0e~YPT`l;Cs~LcM+aeFkn7F)u2e!()A7PGr+G%nJ)7q(s|F%C^KSo~p5AUlx=M|R3VmzlA-5<@_uhwh$I`8S2ck#}7i=6Rbop8?l z!?U24pd$RX2S{ylOTs=@0c>?&x$U)c6!aE}eGj{eg zsY+=F8wRtx%G$%yoW`}#;fxUW;(ktY!0k34~hsU@^kn5_8c8Idyd56Wvqf`SCj*-Z^J8H)zze| zZ<}3Sf$-Lf*|W>%8CxqWtBi(*P-D2FOru$4b1Tfa%CdQLOf;vwveHCV(9XDh*^*_q z-m%PR?+D^;D)k-Ze0qqC>=Ar1tc?R%8{zs860vYfF`Y0Gt@LCxlP988aTrY@N@_<( z09W{?PAxU6MBP@=4IBr2|gE_%6Ev@uw2Y--&UHg1_; zyAWU23anhYG*E}HKi!J6x65y@UAf9eS+I0*?Xp!SgN?AVcE#%273m2JYFDgUylC-) znpL%_(k-c78>n4_uc9rx$xgSVOR11G-@w9KmpM|K>RN=@GMCa^Q06Gz;zesyB{#JW zELeP79W1c&w%P@$xE3v5ws>V-?Lr$(v>!!+aHW*6XzA@M>jLv{U$m%p#Y&rO*m5C0 zm$sxfaL0<8+it(jMqE~VM_^^`%9T7-y=w7-CAIcywprCIxwbx%EweN0*0O2^&ub^Q znc8IwR;;~kRqaC5@T%Hn%+s!E?Xrb|TNedtYgQ~>8(3Jgs>Y_ORFb6*10&SMf|Y@q zMXOj3W`j&=G%XU$^J^E~x}r8v0To7T+Y6ksRl!s08t1%lnWI@TQJuG<__kd6rNh9i zz$kT^mMfszkRBoft813tZtq3NPc;-hh+2mVO;ge|G`Fo-6j1asU0lW8f3egyZiN ztS%$|)X!8a8sWv=ekw@&VlacBFfW#=T`+C4MKEo4 zzu;0_u|`t-Ww_G0(3je9WtoXtZkCgnda*pj)P*_`SK~^(iJ2$$AZDJl3voTJe! zHex(&Ks|`57i~dITT&-t+KlBSroC0Y1GC&L8{=ueYQeM_ZNzxi10C!4XV zsw}`$fK^$5F9B9%0saW-swM4NTvb^R|2lA;#D5RhrGnXROW^sOsv1|-K7l>J%$M;j zw`!BX%wM%P;C$e9@Z@3s_X?(7_X)z-*>0xNq0^Id4lp1^y6{ldfFjZ6~Eb7!T3|2Ob7!MvZd?kTez znC+GL4q&!R;tt>&1U~{?E%*rVLcy;B*9rbL@KV7(6!12|bAeY0z8!dt;Lii!C3paM zo!}n#n}BuNhk$h*{VlMrqYNf=zA-uVGfc}t;q=c-lbGanqa(an zHz|qjSuNjI+t%I?=)?+JZFvL_ig+^g}jC!97^%X_z!)nt}zQ^68^{Cb9g|z!V-ZYS2`0ZdLlj&0g$KK{;_xLOFqxVL=_%#{_hCynDsp+jC2aXa9()AD!* z$tv#z?oC=AhdeE>N#tRuS1upnI>EeXc_D|qA>6ypfKL4|e8uIxB=WRf)*#GrT{|uB zd564S42PGv?}|KK-gN+e(6!V0 z{i{P>GbRV?z(jeRc4&EXfx#MY2VIcIAzV8xuL2Ro)k1g;@;K&G9;X3X9?t_<t#(=-=L}YPA46Uln5dui{IJ&{k8_79S{SZc zUbaKtGzii1SVr=(JwFF;)$a__rLy0*B~3N1baz3Xwjb@I<$W30D(`K`OJzUKi>>AD zw8-Q7O3Uj(daJyT(&+aH;;r%?w#XZAk+;DikDWV}e(N3b4qD`KH$dyR0O_e8+ZWws z2rsZ0kTiNVZ^9K~mAea_Vyj?YD39(AcxySni+md)fbGC9G}hZs;3-$jdlT|FpV3as z`w=3n@+P73Z$KR7O%xjC4MC7q-g}T&jCk#|yqCadmA4M^IG$48BzV#&k7E+$vCYx( zn=~O4s=uVse<=BCQX>;v9C_%nVOQ%jecl)7m@l2?W}_RzvySk0IpK~Ej9ijuAPc7@Juu^@iM$tPhNa9 z>8$x4GxsMv65T)12Wr`|no|r}j-ji>D(&UoY~L9d7{SnRO_7MHIBUN9ibvD$|8P3a zGn?5Z{q3@zt4^XKq7U!s`Z}Ji?^o~L@{Yfk?~7arEtm5Q{Hg4>GmXUsd{gJ?1GQTB zQ`t&;ypJp=*Efha2C6gOIE{UZZvcHD&-a2y^jxL&{3II`+&rJ`2<|2;|*)aCKkX58$W(U@khfDm+L~g7Rwc9*FW*x z;_mg}RkYsAwv6+5s}`ZR3|>332*sepB;4&SSeL))v2C zo6|7vs`XRH`~JyQ+_ FaMuAKC0RIy=$Clt~7e~f4uuI^NVkO@`@`>VX+u&vFHk8 zeQk07_b0scSKINvRT|}`9X%PYp4!}=40lg$9?rW1biG)B1Mbh_7C$cYm44REEB)#m z{CE5Vo}RqiEq(51zB_arTL9%lzsn!U`|vyC4+js6*2u_g$E?N@o)!2_Ny8PM>%Rgq zJ(I@u=Vl+v&3Yx*b2>Nko!pG~bKUK^Mo+Hm+Qz2ayZQ>+`us+$pzA+e=l;WwSMc@m zm3u>o!%rBFxSl!U$IC$b#_sw8UhNC!NRG=;?+3+;NPEli7PanhQ?SY9T@r-#5_+7< zQf>16%$#Vrx1=xFy&SJ3q?NBXneIg!^S~I{#=P0l+k3;iy1Q$AO{k!r+}tTwxU;S? zXymC0BP&}T^&mmk4`P8ChOqTX0*#q}cB9yq#r4it5HkxAYdNci&QbiC1kaK2EK;UB{lqV53$iI&tPd7W zR4>b2Uvep8bBtF!#gVL^fVT6oOZ$WQk^TR&>-qi@6Hp5vs-LP{cYA+He#3QzABB)+ zcuLgwgWj6yo<}lw{E0DUm-kXc?woaVbk0YiQs23rf_#_I$ z;iKP#qN~0b?Oyf8ho)y%Et>ni2^GQedGc=PL$j>>CG20_=gYo4)E)9>t_V(C5iD5| z^dCDpDYCz7*Y^Hlc?F;fMTU(#qdhsEJNxmH>fMi)_0)OB-`?=hJEx}Ho`wId8x8LjUiTwzFzwvuK6xmHAz;Vtu)(E~(xRTnJ^OkmL_@e2`EthY`s*<- z9UEheiTcLGxDC*mpg<+x3r;lf={j5z{xgD20z1L0;DR%5(b_Y=-dxyF66 z(O7#HcQ1^s=T9H{9`s!S3+tCy&*=@})wvaH)wR{kH=!K9zT7EcNS%i7B|Pjl1rmiW_x?m z1&YcW_P}d7&kr9*1!u7}o!xa9jKh3MFiMNA{-`vDC-K`Xwgl7o;2ErnYp(`{tkPJD zGL`y13avTo|MEM&QrErXOc`N$)HIHLm)vW10f05fCwR=CILcFY(Z&6tA)uu zm%(2KT}Ry>|+TRjD8kLVHeJI&iVho|M%@*ChOVne%I|??|Rp})?Rz>!EnQ#)Y|@rmjpvJZQoDoYsP!R`C{k& zp4Dx!ttXRwt<8|{Zmo0k&Op8Ucf*dbMY}7`?dV+^Xx{1TZ$0ivY(0E?*g*p}FG4L)Z2Oko>&^w*2dC&w*FB`cFgt8ZtQe5-n4lHo zYxnWhmF^ zol~AC-p4F2bk@gHlgyPqD0>q-@A&F1y9Z-66ym~yp%R>e?_gNpxzmv!QJ05w)z^E- z!LVKr-@FcKwmUa|?uZ1tDJ`W{=zn817|&yV z71LMI{}#p>j+pZ3FQk4JI^JRxyYtxNNI=C-p(CT@OV!=&Th@BUH$Sj8y~OQt zXIMH;~H^=i_b=?5G!NcAtx zzdQL#J92vKD2lT$F%Ku!8(|s1;+XuNxq#u@8T816RlmX z{Ye)-xyCwJZ^ZuC_5hb_MIO{~R12+GF2X-S5eVew^CVg}l!nUyILbz&L%{theCF!0w**4!n-p{)R73 zAC2}r21cFhVtD1risNdqN|B3uQDzKLCr?-}oWq3+C73_&Vc$8(AtO>78tYpcnBTLk zujJj7lwMCl#o;2)*bN8zckS|f;sa;=9^?|+3g0J=zE3=TpRwZmbiYVh_BF$@$!Idb zi3Q94A~L|WgAp>Ayz!IzgE4)Mqes2hYe@%UItwQZ`y8M7S{=@O+o$b%6Qd++U+yc` z6=iQU-gNIfJ;j!tXK5)6IVA&>82Of_`pSBeWY zOkwxd%e6NGM4NROjn#AR2;~7K=>Emf*owpbKke^3ry4K)%mpi3Vw|tt>rr(bhpxSt z_1b%dk?053p|M_=Sr4v>9L|l5s_!}^ztzm|g<)^F#UHM9hlllsTL;1;PKAfR8yTBAm7cUOnpbfnES??;X_r?F}zFzBo@q+(4&Hv)3 z-j(n$;Hbl0_YPfXT`O}I%39emKE0lP#%B#2ZreX}B{cm=yQ&ZDm3($(FIhYzcg5p(8M>Vr*LrORxds z_gajyCwDBe4!%9?^WZxgm?2%+(Kk-&zH#u!;)(4o9Lya4A9}E3aW2ZWw@#G{Ze=8V z4e0P#P6JNuRi6!sI1zr)s*0?4cSKM=WjI?gKFoJ`Lq)&p@#kK!y`zZ1{(jEf-}Mux z*K$dJ-+LI@+tv&hobiRX{dDNcqT_2{uqhe#UFi!y>T6ZYOH_7SS8$RGfc3Gy5pwj8poYJxUs|Dyhv}J&6^kD%?tPDg?aO=-aLyp4-9s19-Vh@Uex2>!5F-P zAduiE4_=4g*qs;2mnP)d_|k;Dh^9cJKQF9l=Rf^`c4Bre4SppC65nltxHR~7zScLCpP zs@!}_^X*|*TYJL1DH*N1y(#IfhntmST^;S4((38qJ10=R{q64KnXD_l+`ce}!@#qm z9X&gok*n-ZuhtR;``lD$wYIMDpmX7U63|FxEKX_g!kV!d$unm+JjP5t-AQL>@~a*_ zyN5WOz}@m4zALLfcX)W)h1OiWH7}vc=yh4!e<2^m+)1Drvw}6 zzG*)17#@DxbpF2JROH)W(BVVY3dVax?$-UslWGo#YCz}1HD5<1c`!%wMXIkhO*o&H>im1WH*Lx%S=N@T^&tmIwyf69r%hSZ zjMbAF$2CpQy>N_;) zYYP8rMae2G{x85D_V+hFcOYK#9O%^ z%vBZ)`X`i>58~9Y>^wjDA!|(9)7HUdEZuaUw;Vm7H#mlnJAc636e9Z=*`^*9cP_RY0VTXYLF&3XD%a&@tWaPmAr|`;N_` z1tPn`ktWZD=_c_zUdef46o;zVX&1oKn1#|h#c`3ShS1JmcU-!a- zjiIlLN9t`okMGLC^3&k6!w>cTZRKWn`IN!!TvC$5J2mIeK$7$*5lfG|dGS8G|p5PTG8nY^r^ECz?Hfu5PRmM5&2=1lm(pCDnS<3G7 z;#(_T_af(o7`;cM3rmm2T`j#w=ME41-C5o4dA;tdxU%1MZ~v|f2dzdAy*d(t8*nf3 zy653@N3u;w@TqcUWP?XFjXn9_5I1B<|?6 z+#l(8XYTYJ@)jYd_-4q6<6KZB)OnbOl?7dG^?t=xLuK+~Mi`A|iNt%1a06phKj6od z!g&8o-R)C)GH-F9$J!l@Zyiqb7tKB9^A^qb7G3GA*Zg6pckyh7Z_uLoi>~w+&HpCO z7kG=Vaz3R6ru2-(yNk%Nz!>$Bo^zfB#i^Lr!-6UGm}M*c^A|eD`$l`9&Hie_5vKi? z*P8IxO;}V)D-WSbHL}b zzt-6i7>5P5HAA^@7E)A!B;VV^V1E#4-8tXMrk2?1u!V`1igUPl9EG|e`k_5Z-bgt4 zad7gT?}ZPI?~CkqFMteiH89>^l!dF_qJ=0uv+C=K*>zxl%(}z2Z0*@SxOW_@D*Bea zFVZ*OJM?kco=MIgi?fvP?P8@7>{i*VJ6xDBu4R$-+T&ff_pcu6_rLV<&Q-;~+r015 zNjnlI`aNSiM~$8Q9vg+K3gf7ni{gZ7tDFAmcQ5d+w5|5#DiG;)FSxP5o+I?A9HFCE zF32m0IqzQJ81j1J)ilnqA4cB*%WFM-n=y8VX|HYfn(E0K1$v^cJFq`0Fn-(ouXW~I0MU5SssTFfN@+0vphyd+MnEvPqNNLWycd)}VFIav z_~fJe_B#V{{(>?7z3=Su_32R&5zXXS1Ts`BIQHnOmg)FDMJ+g>stKggqs}1D-6)z~i8aj=L)QVOqCjIo}le?~Uui#^7V2ePOy5 zA^S+8B;y_gJX$!iZ=-+?1J8kYjw00`m(sVkm|AgyQ zv{gGD_il6;?x(-;N0*{Rz8h^jA06Hu9r20>MLm1KrTuGM(`gGXc0J+Rzqu!JAUbMA zvgJ{GQ)}F6e3=sS-P{!1z~(eJ*X>PPh%cAs&iCfJJ~;Z;fq~=dYl74k_-jS_%@CCA zjIMLKtAl$whjF)Lv|kpcv@xGjR!`@e%G}Bne5_D*2Y6ta#LtCO6NZ_@yjwiC zVEKa;6kkrcc;2){x58Ingya~`Lt7ce8R+`EBf9s=2^cZ%cML@iIHFF6L%OG<&z_Du z`oa4zINM%6<PbN5JCX;8s^K#;~MDeomjVILeWV z^hgReE$ObZ75^CFl_Ki_(H#m*QZ+lHw#< z9BIMge15HzWx@6O8dPgUa)la<7tAYAV$*Yf$K=45Cfy*FNpTrv4|Jte2NQ`_{=iyj18n^ z^`eq#_+qT|=3p;X{eEzduGvY`A2Bm3e|1DN8v%S`=ta5lVXkKUMU zNi{_~&s?(b(aaHpCf6`MnV1~22E93gyXkDMY!=m@{r-BokLq3-ZcFJO_r*o@4*FjB$~hcAHLT;EJ&p+-KeFZ&^dqyT z?HqWp?%VW$@wwMLi=OBK@gtc2VH4ȲiiG<+Jh;}rR=5IV2kAoyAd=SbMJYj}97 zVD{i&o6>*Ng#RdbNJ3*D;$P+bsKJZ8HaXv+>k{f7 zu-Z0jj+GrhXNXJP*jjfWuGenG%Y(5Ou-6_2rv|s6%BRCPw>Ecf?u_#_o7{Ib_Ru`U zIX^)EoPZ@TjL_X_SM;V$?rd&)xSufs&7GE}&-A-SrhYGLcooRjZ?|ckaozSvxF*=@ z*KOygbicGL9oeZn5AWIRkg(cnI2T(DQ+%7@R8U@O09XEz zDvbL{|D>}ka}f_;pQiE2V;fy};nSN@z#TvTdMo2xb=YQi?=*U zY;MEifaCX$XKcxu;}z~n`@yJviL7@D?ccrMN0f}4&zHMJ=(o)K#W?RT#vXfc5TBcc z*6;iqe7Gm6&#?pqXzauf9qJR?i0k8)?6SlduRG}vJ;wrzefYkw*FC}SPWtBl#hu+n zle>$q@E1+;7bSa(CK_JU?PE*@5U9#ggaK-N^8OteGn_3Lv!+AoeT7P{|Lr`0tMv|R zSz<1R3TI!KckkP6E&8CTD*XaoI`7^G+J5TY+tv2$%vES-Md@p6$*_C(KCcJ;42&Yu zmOHW*W-W9KHT}p74~<^t0|&PHBQcEO!8_W+n zikEiF)$2}k*d3ET8q=}Z@)4%!)Al_-rsLtuos%qsP)&PFqITNek@WY|mlfV0;TYpc z{K&pc>J0@7RUEt<;v{$eWiP3)dL~m4Bca*Aw z&($5J>JVkrAxi4tkBWrh9Y7r}b4)xPz2kYy>C1ZE(>fMsz8siWcwLwynpJylk>#W4 z{-OSNUhn^C%)Uo(a_C6^l20y*=syXqaXv$+u z(|!H#4E28${U#!f*?DjOl23OWx&F;ZZg75vMS_db`;rGPURL;X>wr7G8?{Wz=|9kX z>a};YNjci*yB(LkKg)9Pa!|GBcLTm~nIpOX4=#Vvv{S0xx{ERM652iq2N3oN z{+o#}_&^)>n@(Wkjq@KOoCX2=%)$vVN`laT8&rN(vSt@gYj{2rb|X+j-Xo@kNF zSP2hF$g96G$t>H{CYQW61^YC>8GegsHo6svI{0RB|Qu2He;nRYx z5iCvy9%(El#y3!2U2%VrEw`i+~J4x4ieZ;%>egQ6D|%`}fCWWC)s_?dOl z?#jcCa7Q|J8leu@tD*kKssFLwy*shu3fy{<|BmzDIoQ|MGkKnIez(i(o{s5dAZf=ahe=FDH2B4!U?v#A~)`P_}%V~zOOgE(mzn-?siXZJBlP}t=(=6@;d_@ z%e&o^uvG?+LdXKrb(Zs(PrKcE+Qy(P>!yecR|{$96-@^ZDvkuz?ULK0fo|@x=BIMO zV8?@2+pjn)02q8@cyOOpjcu3;+J1}Nr}*8e*mz|7l~&}Ab(YOPXzfi&7)Tj=Dkbh+ zY_*KkeDTu)5z~6CgW1^965m$l#n_oO+hBX^+y`gCh zn}5kYnU>!SLykMfSqJa3&O?@Ae>3|EdP8z;BXKHLH4?4)N6l@mH#CZIk7EK>q-;-F zu;PH7YM5JkG0Yf`w@{)Lu^8R_d*9yWE3mJ4)|y{!%_;2v&*fIz5-rc;T)f@uN#jN^ zwwh^5^*JmA^ zi(+|3^ca)SNbN%SYu~uhCHmsC=2EOPgSL%ne21aHCSrHsQq zCTMGGJ8o;VHtW$}E$dStVzGW>z>d-15y-UoKALzNv9Iz1?EVb2nk2Ng8}k4aqw z?d&e&_=Bw27E9o_#F$ z=z(3YHvOpoSpD}(;>2{}f9OZsL|K8Vk1q!h6H?+&QPLkIBYSkCw3wAt^6U8fWEfM8Yfk9{$?+cMyu((6t-b$p$X?d{RZ&}8~zo!_^WC7u%I zM3xlYA4^<$5X;o%UdsmXu*X|%anPif+UEPh3VW7Pr`Gx+P{pSG{pV9Aev)mq{fFlF zq5q{$FV%~{F5Bmk^q^6)XDbhFl9CcVl%C! zwES2}a?1IX3Eq^6R8y?|95?hcSG9e(hG#0BF&6KPgd)oZbrYl@xnRdbOJ)8LX$S+M zKP4Fw-m!=q41;SjEYq6d;lX>28OPn2abUjDGkAqIV3wux7u=L-#8b)YO@J`~sgASS zzM}=K{wU||_QH%SQ0)=hp=V*MM_DKLjB~6)WN3-=);K*uu>;`BUylcAC!hd}1DM!! z7ftN8G#u!}G-n3>UExOsVc!cd3?%teCbYGBiza(hF#mD4<5dPer8@fT(YToX9gBaJ zv}n z?#kRiUm!!(Wy>bywPT3@y(xJ(5byXs_rxF597h=*(Y)zbI{UQ1jaX*A5&K+Qj_V4o ztGUr8`Q_Yy!tpp}IR6RF*B)5Ywg@VM-E@4+Q@`neO@l0N%D6rccDnbbj6>149l>Dm z&chrG0=XCtaHdAbbHO#Bk#W^lsCnZHk}h02rkQ(}8r9_ftIFED_w}~zeniANv3KuK z+jjKsBX-9`6c5GOALhKyGLSN{H)VoO@J0Aj(A2FFA{*G*q+>@G@5kN^=rv9jAA#U{ zm1^tSJYZ>f^;j(Z!Il^0;9O4q97IT}6)!-IH?o;BeN$K`*JXN+t2#q@VsCCE9}mrbQIdy z^36-q0@dc$3RA->4*PcVw!;+{^?O9PPmy%ds4Jd}OVtL)i-s$`w~bo=HXi&uiA+9_ zOh)Y08u(!x+mdP0)KG_PP32Qz|76k|gDFM737nFAOGo0>$|oP>-6{99$=1P4u72aDF!6kSc^r+MkDaFD^;rY9 zl*;CSy9bx3SaYm{(CyI;Zwte+Ko0pHqg zG2Z;{qANq=%?rlEvnGh=b-SDen%nJ$Q88}kYJJk))PR1$uS$4O!fpvw8Z*lh$LO;q z)lc)|jTs4cN9v12BbPDmMkCwl&Mb>s*5VbTt+=Tl1**`WInz5mn@#OM!R-}O9_VX2 zSxS8cKfq)h+;f(T>)z?}{L`;$%INn_k9Q7P{psVJt=7PVozLewKJPykJMh|P&n}6a zHe-h4NXNsm0lU|J+7Z1k(dvICb~=`)b)slKlW{*{U55nOJf8O7QZ zLVHEh-zH(bgrx|t6O8@Aw_821;NQscML6v_CjEt7KNxX@%N#!VySVd}$~NO_LUnXu z+11`uEMQoauj?>f`0e76lXlEQoYul;BYfkMkM3{Zm&o;Xs(S-=g_pX)!Kg7W2-O*IdsAH-eJ!n{#^w`zV*Ctr zsP!ZtP)gp?dN{cPk4`-n-rDTQYV{zE);0W>>rG8`uCsKfs#iZnJA4tn>9eSNtR5aN zJ>xqGfX9Zqukfa(_*315w^#y)I|8xhYk9neNAv^pe9HsPSgROxX=j*5AD&8jD_02) z6GG4MaA8IUBp5h@T>@C+a1;!tXo1wSMPmaI{*26rj%YnsB^^C-RmXH|OPhvl;4a;v zc~d8QOI^Nkf%cB{D18eC3&*yw(|cZ_`BJB4SzEB^Cgn!6I9)Bd8a#e1-wu|57uh?b zY-JO^)15jQ5AIHzSZA`U`O`JWkUw=g9yiV3rt*W=R$$HF%3JhC--SeU1&9kA$8@eR zOMgw)NqtP>MO&(-r(XEi@NRol-hygNFY30(I&mpAxA0cneU5QX z4=?=63-|ZfQn~~P4+E6O63Q4NL9zM zc?b1RR2y}K&NfqU7{Z|QwxEweyHXHhQ(%7s)?U1K3sdfW+`QWtpZxsGGuHRHr!Bs< zH!9Y7eZ*O;BKcNt>Bkz&tv$E4=5@VvUEf@+J<}1Wj=t6F@A_a@kI#Cm@47xkbJ)w% ztv{WZ98yLO4lEYK`=jM{tTrdnuyzQ=MlUqeK)xpAJT~OqCFd3iKM`BFT+Y?}D5xxW zTO0ZppCU}bJ8L>(eUZ+BSQaeA84CKO#!f3Wt-x;45msZjsA`A&kAu^VS<%}rr1eZ& z(Ysijl&do0GR(d`+zYxODbO8w)T7%{&(4;J4fEJWi$@fU46*a<*^$>`;oW5p4X;`# zU+6B+at>(SY1po);k9yV5KaPC6+)!45hq*bC!!cZk%&B$qDUM3EJVgHna*D^nqgx+s+sY&nRqxAxs9Gv#<-ax5Q6sQ#9%qxn6`tk+=_Z(sqB6cI<`D1^9 zdMdd<_rt-*wZ+BWqU?D^YL|$r8{6i&mrm`nYijFn$NFk|tlm|d z;7cH`*ZMTKKU$x0%rGj0aL2?r6f*DW`=blL4KHjq?Xq3(O^B0MG<#m&Gq_ck_q3kY zJ#nV~Mc9PzbPKJ+bnVB2p+tNFAl9TCYpC$BQxU5BvX^k#zNHoGD7oAl*uTiLuy55Z zxsC;nbUZ|i(KvGN4Wc@Hf&`+8>>1Ymt&Adz|+x} z6jN4a`%OA_7MgTPF_|ZXERDY9%W#C*Zd-Rg73=Uh|6o1T)1Ucb?uw%sJC9{%XTLgt z&E$?NxIyBJ-Dgj`Vvd!?oWs`guBZD~WaELZ7s7G3z`1t#)!u;^E$8e8$0WyPN#Cm; z^Zs~C^<|%ZrcKV#F77`2y6a-3v+Rq3>orHrilak#wA}fr1@96#`lFpc%H8G16Hbm~ z?yPuw_ZtUXNxm}QIlQ4H^Pb$c?n5u;_IA-O=$feX>3(bGk8+>AXWX{)-Ce^k*iS^A ziqZBxdS%kFnAZzuVl}(#u~_Fu>n!Sh>#Wvd zUVnMlhkQAdF&jvccl@)7-6l-0c8Q#?FwyyZ%lo*f-v0=mC*)d__`!$dyjQ~KB)ne2 zpGnC4n(%COznte8bok6!f@evXDdAKJyCuY4Osq@7>HnS0o9=XOv3cE@t#k8uo8sD5 zPsV27=6UHkzRh*%Qyh67!^S|bdN#knl?IyfMeU1n7g@44pHzc2LGQ5s@NqlS zLDZ5f*I@5&VO#YF>Gmp^y6_vIH`+l@O(x-ARCgSjavNq(H>Sb=i9 z;$cZ)ckw)XRtg5vW{6Qe-qG|B&BAJ5?D=r5wLPObBhH7k^m?JfkwYGEXKhYFw;x%1 zR~42ydq#VP<@`%aO!u)4hOJwJ3LlJ|zWuy?$!8C3N$EJ6>}u=x4qaMK7|;9w;?lOI80*3CT_ z@dB+c_F{XNPsA&Lyvrvzvb@X3cz==Hy4x42QW!Vzo1EU`>8EWfzVlXF%JA^jk@>F- zo8DK+z1izhkSmthRogl)&!q*xbRt~CcCm3HN9+StGYrU)dqR;lmSN(}_tRj*tcZhE zyWOiR`n`kid6y@72jBNDPxLP5_}|vj)bvm9a%Vg4w?4!z?90b{mtW>zez|w>AE4=X zzx>N%M)qzjcQ{gW4V^kSJUlCGE{mpK#elVpq?5YbB2R>?wm+YiS-HECo6CcAc!<4e znRqaMhbsI<$2`9?k7EI+5TzPQ5UshU$?R~+(9tXcA@0I+N_@T~f+ z^>Yk*Rb^3~r*7+<;QM{?fl<6ozp}ct&ec%sN-c3!*K7J|>6T5Eb)_ZR)z`SpA0SX4 zn_pj7T3lOKqUnLFsIjc9v`)P=c$25DzEm!+uPF7DfNqXnQd(TMbyLH7MA4R9{naTW z*U}or%GB{SO;4HFwyxTRZwB01SyEcU5(|?`ugFv4k`mQ7)HN12G}e`VHFGJ_ zDmCI~yJ{O7HZ?Z5HhH#I)p|;_8&w5e#kDmJr8Nz%)NeN;w^~<~r>?wormNbsrLwxQ znq+P1%4J%f62M4aNZLpl#gsDP`vH1uh5EXtC1xb_yKxDNcdJgKRLgC%a$$L z%0gFTJ+7x$q7-#Co~n!yk`hOCWdq`8Xr7Xi%7)5XaJWi54IVuf3z54#cbQfcQdPXz zxvI3rbv27W(^XkhT-8`oiSMpux{9_ol-9dy%OD1%SW_M>RdMB}iqg9Ep2miX^@hkx zw=`&;G8D|HYPPGvQ?7lj*0uV^udNsnhN+cA5_J%EWlib-x?q%kuxJp9r=~=;NRajw z#Z~&F)mPLuR+YGFO7TSsSA}QOrqUX%v7Qw+G_0Wl;$S1(kh?Su%~9ImnMFBj1t7SJ zJypexRUXRMRpzOzLZ5)<8gZ$eP*%}vrL6y>9-2FWG)6k>nBiLDLbt1`EUs)=UwP+x zwh}L7xHJ8{E3X*V@)Iyu6_SK$-;)-CYg8DtG7^$gx5v0Z` zSGzKUF^U^hr=Z-;f`;77N|7>j7##_ly-HAh77H3|^e0+6+PI?1+H}aVu5@!_X+5;B z+*Qr~uewV^g$GSr*-)?5KsrW$t*mj?d#ZJo@;XoTOe9-|q_S1FudG4yl<6lkT{T7P z@AA~hC6v-!EZv+|cp{f)TE&szrvX-kP2~stDs)gCq}7&UeX7b>PmcsvbIL6zss}9Rl2FR zxT2mzj4Esy;?!4A$94VI%IZAj)hHJ=X{2ckNu;MXx~_4hHfETb?Mp_(yXq<%jL|Z5 zI1DW`>ZI5&&CM9Bf&)~xtG@EvrMh`H4^{jY^`+5A2DYz?*SHDYq;$O+`s*93)j%)B zQ|7cpQ9>*8RizD9L>~=QTw_e3HHG4EB-XEHqhplwV@@2dFj^Vk2EE$#&D6&1)W+Lk ztW3k%=*Vn3v~4YHf5Tn1b$9S;d9CXEVx@{}8#%PP?ova(vCfB7T zqPSF%*rpi3>cq5M!l2|sTP>rxNmLc}LAoYZ6Z-olDOBD$3v$02rl6vv?ox>Eawj^A zIjX2KN?lrcClW1dRKC_FY10tb)AH05m%3^iA%{B3EM1vd_Ksi*M#m|utF4BYRNo*y z6V0nP6>P?4(E)q`44;6iEn6?0mztrK)YWd<#HNL4XVsR?3T7+uA*f3d3JzQ7;HV8~&%OR@>x4GhaTt4mnWQXCZK&b|_Jo$5{Sa*HafDjT*!ZAz%Hda*rKrFHP)^bTaIRylk- zxK1IL*-Y7neby@LDLUBAs?mI|bSN48j|`ooxT+RS24}Id44LaW=~vh{N^44ySEcTR ztL#SP)d=ko2Q+sRooB_hjQ%^+O^x283aFV#RhSf1U5y?qIRa8WOdLj0f}fD|6OT2xBG zNx9+seo6LFQYBrfI<<_gV`43Cs6$&BIy>5C1yw`w^9&ZQqCRNkHr3W+wqrQ^+DI~- ze+GT>nV4xdsJT@|EqgZIcvo>%B|YUz_I1{RmQC+@MC@T)5z)I3b?6c?7|Jddk~LHM z9Ms?-1$mA1*HImSeFq<&guyVX6pS4bsiDz@1qBu!Yc;GLhc%gxXu4@P<~lCep+?Mn zz`(f@d@nff#h5bPQMt)w^4HD2yXyVW)6t%)RFQQ@K_NG!sdH!^Oq7b%IIGV+Mkf1I zg3-wsz8yyfSb0o)=-4Q4ts3bt)rwm51l6^IU4zSEqhe_PFVY!VxWN*XGRk@>w8ok{ zYHIJIvZx-ZTte72+Iho$##Bem$+KNF;dHEnHWU*E`crC3Z6qQ7o|*RFIOdsKQn!Tq z<#nYSu|`0pEUn&z;YIo;tu+1VQ9>ClMvjtj#EqhGBrZWU8lV6rBch+JNo|#j#>y?Of}qFNHTQ4v;Yu5CvOVV+g^B?J_w8TE6Z@8yZT3h}16ep5cEQ(PwLAja5}! zHP~rRXo0@Q1&pBeFopzBXxUIOBc^MXORaO}Nj1JC4ptqDt7gNXQ)@H6DrIOrYYn-n z)q`M3f;p-2^ed$%BGro(l;w@$wu};wxG*x;C+PBu0CIVobYb7%kmWTuKWASD4NfmJVle?Z#DAiB$+?Xwp4Z z96Iz>7v1XUg~qC`Yt}56GUcVw|G($!!MZZ~Da}|lmz?T1c`$>+5K~rHss>1-lp#W> zkH%tzOcS=UQ>&TYmq|!1cq$bys%)tCY|8k*CNrAtXxJ}(jR)%>kgz^+**X&yq9ZC6 zTg{oZe3|iyrek!`Z6j1g7r$Cwhpre?Cu1Sdm~)Rx&8TZ?J)69$w4qef*g>|IHn@zg zpbIak?YSeurg(!r$LPIk6{^C6X(3clSCZg*gSK4VOOOT%l3n`3ywO^ssk)0N#w>p% zD|UqXDh>o{I5f35?cs>{f(?3!f%)GRBd9bZy{=xF;Ku6z!%1s!aVB_&COATjaz@lT zEEaCKJUrsb>3)*(rfX_2ENLZ`^~Ih#brZxin~)JD-LQZrE@NU8%A!0|wVYgAW6XaI z&(;{~HF^ovo*H8i)cscY%q1?|ZZMZ6G#9L?XBb}1=s`%@G|#Z+QZ6c<8W4?vNNK=q zEnoTm!R8R|OF4~Ef>WYPO!%lgsX`+r(X41B|9@;3Wqj7Fs^=Xv@*|@+9P9c@F45`D zuOg}D*W=MjtMz_sc*npJy8CAcxJaz0Z(6Od~*Y7%3Lt)|GBGLKR`eWp{w55^HF%?l zGgsuazOp3bvNUdRAu;4KRm1}?u(rgtR81cWSTN0ngN`HT#!8|Dh5^Ld8*hZDEGtSe z)ia6$UrNfNR=+izQ&6%<$fZ4FC3bWb^!THqiZK2+v6Zw&JFH5Tjl8J3#@#RI{K)*s z)Yo|z*N_xfn|1qX+-yphTc}vAz-mp2Y;Tud05JO|~%nenA7b#P4Y zx`}HHwKZ!ii|@cNYedi&y(p7VmYK@kt>PsZb*|f&%r=$UNB|4f=pCvO8nTT2!jKJ~dBYtsbcm?=aPsmg#q(N0Dd3iPepRK1DaD!c|ht%y{EKR)LJ$5}MH~ z_00v?#{uyxpA*aM`l1<~N#j1y2=~a%I(Am91gm3tJ(f)&%`%utEOZ5DjPo*Q&z(Kj zm0r=%u&F+KPRPa+J<6P_synM^VeN#|oZ02@ak&pgkGXzc=De#iv*srp0LQ+w}8q;p5g;O*SzKOPKnCy_rAs`dBSN-aB)- zh4Ck8Yh+Ja4x(AL$y$<>Z-ct-9!U%+Y}6OhdCo7Yj~ro0&wPX-J@XN!xy+}CADaGD z?F{neQHP&Zo360&FHB1}pbEn-xjr-GdS=M^RUzk#G>gcSN@3Nm)r{{Fd`q1#4dK5! z9@?2l9)4CO6?Llqg=uR>PJqI+Z-kt$ z3pwZ4=SPk(ZNtb3P?%P%6^aUG@!3$T?ee=RGv^`Ne|5|nal71rp!?f>&oPRIm{GO2W9U{7}ewZ^-%6A?MG9oIf9O{P^|03l2%OU5lgq**s{axCR7ifxZmi{*zI9`j;ek|v+)OnQlnDM@1;V%(= zz^RIVuUrp@sf^dgY43&bmopO_ui_W4jnTxsC>k#{NqLT|>y6rX?dnqSdJ@t#4)PoC zUL}p^#{T14bkoLbxzpVa~HCnD$0LN8 zsvQw|%v0Cz&@PknR&`#ZRfV+2Cn8T4BVKFJ4odsaSMs}4J1Fh{U+VmBZKlYNmMvcU zzIH(J??k+KZL9Y65cw^X_}ZIt>ys?uxKPRRLiQ40>qedL z)V?M9NHNE2?b=^NUfb3A1KJ-$^w%BIA03h(`)$1Ti1xz}{XZt{hvZcIWXkpFs(gDi zj*~pf@r&1bw4)*VW)*o~sjfevofP?`s`G!*dgPpKAFn;BJvXX-pTWZ^xPU`%&m-D2 zIoJ7*X`jnEc}U}7`MMs`6cKZ*WHuIY7uW?8Bp#cOn7j#sjV26Dhjlck!$<29M1Rb>1TKVEW|w2|^dKxH?mb3-J#}I)3Egs5g`N zX8gmEi67~|L`d~XU?FiRIRNvN%|<%Ql_Hqsnkty(S}d65`kG(_O1_NCGBQhI7s3+3 zlq+RNI?Gir7y){WPG=dL1+EBbar1PcUWtp{KLWe zSiYs8uJcqV94wzun{(rh9w#y=d}@gsdD=sv-} zMw<5to`81PDL4^44+wSv2Z&4X562_;F`W$14+*xwz&DV;oz`J zjHvM1b<9f(1S3##CJ)nCCiG;4$Wp~+dK(1CBHS!E0pXxv1lsF@wt&H<*cLY@u4KEYFgy9EPkj|--Z|3&aj;8z4w-sc5B z0K9^I0cld+w+aT-HVCHdivA+ksAV2G}QE(=3lVCt?x8V7}{~|aGcu4RP;C~gI1N=L|fZCq~v;E%{ z%=-Sr#Pgqm_kjMXV7A@(@R7Pq7Q71dMS@oY-zs=5aJh-UTJSp1TLiP5kC^Z?CjMiB zZv)Su;0?g+dz4QJunm2~kgY>-1?ZOxX1%U4@vIhH#kjD|jJpYVvEZq|<$@c4zbzP0 zyIb%U;3mP_fbS8^ydD?a1pK04%HgkqSzjLP<2+Cmh5v>SMG5+o4q~yxvBI;8x=hRj zak%g^Y!u6F*tc|Ir2ioJsY8Z+rVjm|*x?*W=WV33jQAV)hlBNG`o9F7ZBN_@%(f@y z7{N9segpl0?Pu8A4ML~AEfLIdq(U&q4z>;BZU$!C5bs4gY!BkI$ct@290oeufS5M6 zN$^78?Zl<{hr@>-dFnvFPcR;=58C8b*Dcc+qPrhLGi6#?W*;4SY1N~8<-v)fh#Ph7+4WK7PjFe}h;GLka zG||5caLBf!insg;Aa_c63jC4pv~l=WC9$E zHe}w$d_mP6^!q?pb-zim>*EgSe*!&|{4#d1{7iEx+O0rv5qMS+Z^l0yYw;rw$B_+! z_kpKM@Uy@Tf`@>c1pgCwJ28zb4j+CNI>I=1;>R>Eg69EZPF`_z;Ya%AC=X>~smDJY zPvA$o8}vTGOA+@a!IOa_ffML-bL2-B!1k`CAHh!252OYjEZB_^J01^0uVCz!IlPVn=K{eoGSE)&mVf=fXEso=H1YVLsY=Kw!r;_nlD8|cRbZvcK-FlDRe z{vro8_Xn;3{rAGdwt7!6p!UAtZNPsO+ywlw;O)S6j!j6%1+2zO;61=@p#y5Ef_s3| z1wR3-)(WIN^nsX87U@g13OK=2_sG39RN>!hcbCT%gBs z%msZuuv2gVmV4d)1&?olQvB- zi<%*r_23a&o-HBeVI1-VKxdl7$ADeLVz;Lf--&-X*aqbBfoHzpmw}fFrftNZmcRiG z2g^;&y2J=3jmt))vo2EvBhc#tI_st656m)V;zxegOW99gmN#4IE`)~!v%E(IBhX$D zoQ|+xFzazbFaqrj!8r(jC75;kgWv*$|0WoLzSe;^}bq0$Fn(v&^`vwo`GfmtWj*1$YiPR5NzsK!cQ%Ai*0IS74%5oq@d zPDbb#>_Yg6V9F+*ZGm(s54F}Ld8xHx;B?T{S}`!?x7)=3Z-PPA{w$d7`xn71?}vgZ z*QK;qNQbgia~5FAY^TrxwI2yy2mFv=%5tBH=YZe>&<_e;1$;;_+k^+@&x7(Mo-%f{ z{!orazox9o6AzwozzGx@4$_I)UP*$P-W7t`UWJ00UXfq~TB%^RQH5ZpcZXoc-ZFy*#_`s~v6qEIl%+AV^iD%x#=!KSSjOqtc0_!|YMgT6)ZOkl2CF@4JNUj=6Y zza@AH@E--UJgR@W^#1!#p=W}g!oC1HkEw!lfYSuCO_X2c((8J)&{u(;Bbe=TyWq9J z&j<$8`UE!t9}`S@zbM!T{Dxq*=evRdwSN~}0{nsC3g8QZtAHb+Pe%Ep1#bduUo;iXy0Q0bH)x&V&@9Nl2EcRUWyA++i2tficd2kObL1GAir>q59ua2LXQ!3Z?E ziR9UXkSayYva|?BptTBq0^!dDPenK+cqhV>f)QxH7W@FhHwCk6ZlcVWa$!2HCFRSq&XkBU+8QTbuSon9%?=a+yt!V zgTUK?|71$@UBOF0|98PTz}yc+SuF$pLT~}Fg*E~7Rlt`ErcTWgycSs5DDd#uAoMEW zV!)|1!;Oqmi7Ax+AT z_!P=R*%|9mO+x2-6!pfiGxrHS8F3#Fyc2OBA)bYQIQHPjG`|I&Cj{RGo<6~6V1#k1 zB}~_4bE{wk+UZ=UUJ(ALL05efbjmV}`U!jpSosXVRlv1E-vHbucs{UNCy_MOItlP< z&;!D=7Wgs2S-{F?01w;tw9o;ycLa9<|C?a8xs~I%q#q%83Fzv+Gw3dch9>t9#Z+KLE@&#;t0pj!Un~m#yctu4rMohd7TIQ3lBSf z#2nup#NQxQ*L6##juQ|Vc7QHL0v!z;G(*Hpli3h6y*YxJo|+$l9t&J0bf(9{!od*7 zJp2+ENsiF64Im+=6>8Hm;Fu+oj`9cn7U18YvNK5+ABMU`o@h+ss2_&yS|;=+2x^t! ze&Dr&9|c|~c&u~8rcD4Y5&ECNQziIr(Ak#E>sjFKf~NrAC-^4doy51`9}eme`6Ez~ zF2O0lJ%U#PA0l3ke>nQ^BmY*=`-zz$jv@R=pN2ZVPW%m0^|c*i-{X5YCr><_#t#M0 z20lyd#XlSu@FUNINS`*1_!^{XH!%3QhGY2}xzTPyzXd$Wg1-lxF1Q<*`&*dKB+TpP z6Bp`nxlT^{LeOasiB|xx6}%pp^C{9>flCDM1>Pk12r%bRE?*Zo8IC+i( zb8VdX3)Ce?@Lzxn1pm7Oc3E(a3p!7Hzn<3yp}&lFtPp$>{F?;-JLnN$O_;0mv;Px^ zBgAm5Flm{5tV7Ap76VJ_pa}eGxcp1V< z!K)G02xk9Qemn9i0Nx^WiuYl`2=x0w;F$`%Tj=Qs2L;bW_)Ec=2tN^wK>JMae1sPT zXCY*tV!f6Cju%YbOcDG5!s&to2(J{p3gMH2nM|+XO~B6xrYWGVGX1xJm46P*kAM})os^q&YW0aoKac-ST%2pv%So8Ttk{}8+#IE>>U_t zCm2v4>k;>P)Ju)^z?5IL@UTy-u^V*CuT$u6Bkmte>HJafJK#AZnEn25g4yrG!bjw0 z6HGrVN-%A}SixtJ{!GCvvsW;n_I<$>z&^oMzz>>u0)nX<4-2MloHp^iBlrQ(|4ncJ z_#Y;o{}j9j^iKu%07s+4Q|3z1-}G*onXejLGTdhs|CLf zyi;%{cn+EPpAx(c^k)Sp1D`bU{95p8r1PfWwZQ){@%*RYb)bJL_%`6(cD=qxQrjaq z95UP|*bdw;nEm1pCjLJP=DO?|!Rf%~OgtY8-hjM55nKX1ESPOHCQ2^@ZSXR|EYAwT zRiIxdm}B*76MvCl`WH2VV}XAxI02Z?#I}fo(E(0?a*5AYci51*Z7I?JFN?+Y#f{=13iyx=U*KQqz!Tqol` z&&(V;X4&k5UBK~z>8nl@%)T&LFjzFV;1bYN1y=y43w|9uS%S&GSny2nEH%;bu`pGh z+dy9_n11nEg9n(;ZX4~sMev7^$#(>w1-?h{$G|=l|Gk1~6Mi6=Hh~BIb{^>Z3KwE- z0+!Kp;TCd?%!N0@*-pnftR=vCPe8~nLCk~YA%;t#-=hR({j!D5`sE3ZMYvZm0yQsY z+^N8i3!QcS7r~7Cyx^G#-w=#I-`jw=%Yc6?bjsk5f>$9_dji38AFx^*2j-E1He#--D`F)+)o*8PB8z-7V%s6X2U zdKNJ41>-IOW}hd{0lvq?-y(Pe=&gd;p7#l6UJnSa0Df37p!Q?I+kw@6f28mGf4F=1 zxTvmkZ+y>{0k%3IZb2{^Mk63BZcv$w@Nr_gQ>wUq z)|{NqM}AHrx=QD#v?QK|uy+ytq;8+h?P*U4=|arCP@IXs4*VDjNGX(X^rRnXE1r`$ zP2o@BG{rrK(o{gL)%*QxA8P6t8lf3`LX~J&hH1Tie zG^Je|rzsv}gno#R=*@^1$tv{2^tOXIby3K{G3*fF`}6+F>-wLgA7<$-;C6n(P3<>`8Al9Y#E)H>NAlB+KL69uIxZ z4)!k4oAD!l(%V0Cnq*}9fjyZv{D_Cb{2r%Cb}}SC8KJAU5tplU^)EUP$wd5@z{B*z z=k6$MvUeadOg|Jj45bIzXTg3R(Ol=n+@5q^#%a>|VorYt{P%Er323HUs&rwPZb3(M z3p%1(&?Nf={8B)}tDZkWlcD&NJ?Z&oPE(xNye{l1P8Hl94`~sn^YHv8rzuWeP8Z_& z45#tX&nyGyF3=QJ3X9^=&gmt1c5)gI=|xVv@Z8I3(q#{)NtZ`BO|r*RT>(te`9lb4hKz!)#0EiPOJ_GO*$qMo9>@MS)@BrMo34*Gb@RwHRz3?Nj|ba3VxD_ z=vL6^3P~w*@ec;gE~80)cwsd0PUSQn(sWL{@XX^hVN)Cg&O%OG@w|i64m?SZg6Dot zLj-&&LboT`YdKAEdW6$>=yeX{q;zL>4rogECj1DK_{mVb$WVAh)4V;o3H{s-I)xGf zhV)A`$;t8zX!6JM3~2I4`G9yxPT~{z3={ZtPbawve5U^=U;#t2iv6e=L>J>9%w+sb z0Y*mB;xKSXpQ4VMNp!W&Q%E!~%Vk6(+)u&3m}r`4gdsV}p7zx*=X6$bbZvAo=#AX| z+nLe+)i%&xvZu@rqv1z5-LP-t^l{M75zXs|UEKb%3+*+h74U?J-hqEGFX2Zxcf0ud z0%)o$dbxcb_+KM>DgMFq;U~^14-pOiHIVrfr+71r?WBD0=Q$Uw=VoUQ=fZQwb^Y04L$ zaGEe#Uj=eDf&QG^Zw5_cZ<3#Q(mCA;`UXz#27Rl6hsIIF|1#|7a=I6^kJDbzod$lk z_6q*>u;0t=H-ct+x_G$sZ5+aU7WVy|rhNBnPCo~l&Bt>7kGTCY*ni4tmS0fLMO>_$ z&IS+L>jl5lK(qZ_pyz>}VBnv~>GxpI=5jeto`L5UPQMKvs#7SeGoXt&od^0`2L5VJ zFM<8NoL&z40Zy+3{h)!rfzzvD|1hT;K+{=G3TrLs|HbJL=slc%3G|OSeGv33oL&j~ z7o4W_9pH2^=wETV4D?A(SAhOE13!J+iNd`L_G~U1^gW>2{4;3c|IonyCr)pJ{a-n) zf&Q4&q@S-1{3ZxR_$Od*<@71gahxW8GGZ+Z)~rq-JDJlbTqD%IKOhc1?)!#LKY&LH zXu?>@X$PLGI8AtUoOa^*9ZsjGm_pp0^$II1lYREhd`RlVwCdiGMJQ@gsR?TtI0|aWw~*VD4$ves92cIf zJq6EX&@3%LlUa!$g_VsbOAFAXn>E~?@_>)ic(6Kx`0oP!U2aeDX8knSlbl`L9uL+w z5&sg<`?&pbJXu{0dl%?maC_4IuQ`o}zDEu`6sNbjJ*CM-P8Z|(DW@q-*q$8lld+rh zcvXOAeLvV!TCw^Zv z?|8Y0=6R3wOZL66w}4J5#XlIrA)3M&%V`Im3a2T|G)@yQr48|?;K|aL`(LhttGM z#?+)gr{Ix7g20TyFNGR;7#0`Mj9Q7 z)WL)iX^{dUC*z&;e9J%ugy&j`I8f<1*tJbwaB;feYX;xhXm zK_Pb$&GS6vG2%Z4`<0xga{&#UrgK>9IURqa-Zvute+U0&vfqn;FdBYjZ$`LnoPHDZ zE>3?B^lnaM51t5-pjo^Iv#GM+5$VDAL| zO>R#*W9bNc(iz1|U_Q+0gLr<2(z`?au7w85?nd&J5$1x7kHkEASz3e5s%F;DWpd8*A5Io6YE-zTC~PUs$nj z<6{yFA@YUrYhA1@5RC5P8}^X!TEdQS``n5s`$%$M-^W$j7E7-+q z`bB5gN)7rBJ_O|V#0}#eNogap3-NeH(62N%WK|MdzsLh$vtL0MzO10DTt-mANL&J) zP#)DkqR*6o>&J1C+zebPKzAG)<42sht!~YuEAXB7^|%vWd{BOb5J%<{VdAEHx}?Vl zE}SS3e&3o%+Zg!kaiToqc8X{bql@UMg!5}F^b$C%@UoBf>$iRB(T{kBknFm0{o;*S zz0=J_k3LNIi^qt^QpMmZ#9jTM=P_I;jN8TNGycL?Bu9%Jz;7x63$B4+H`EL-AS@Ah z=DHT|Rpsqkm!%Ge7LrmB*YY8Fpd5C)!J{Lnlqrl|SFj#8E~CC2iHQe5ml|A$ONYWW zC)eTONW++-^*Kd`ZV6n$t}=ln%t@5NSXU7}W=|JbJc?*GUMrs>@maki7zFAtlo+0? z(nh~7hTRk&Bb*WDYOYAmVK;TM{L)DE7hTyF14OYIiAw}PiHTd`*GIDcD!tsSi`sC7 z;AY2R_f}j>GkVj)uN;(SjHH+tmS~CzsVGR?3bJ~|bzz2cjEth+=}k8xqD5Sfo8ajp zj^P=>80d)Xu?)z#xLJx_%t6&4U0@SYA4yK-`OyYkptgdp7JqELUO%H+WVISD*IGA> zon7*Qdw0S1$T|bh)h!TZIt0${aQ(ZC{H|9cUsOdTrXJVpU3WfQPye8wt8zJo!|pFz z!7eHrq1G@~#4NXS9tx4&6NlQC+oMPJ;EaXeymvaPpj8h?^oVR+hi2u`2BQtD!egwB zRWV)Ct4HxFnf2>iq6x`ZN6N}0GDh`m%sRRxhTIVie)L!b=1Im&3cFUYHuP! zJU!^Xt81y7JjdSmK3s1CjI=Wnw{S;b7`S~Wn)1Q}tB$V~K8wfjyNjuA@=CE~}th!;LKFu)9xgQ6a3a99&`oxnz9yb5mkSmHWxF^ocD zUi?-dy>)?v1JW%v8YI3BgN7DODZ7g_CdljYFyV;-1L4M6Bns-e6?7S+-po=TyK(gh zc>e(VReI5j{)mtwh9t=dY*#_)U8BDXH3HjJP`J?xJwMzs9_fz!UD&_lC8ASGtms|H zBf?UIufukgw5&5XB9c*sS96U3L`5_vWrt%J7)J2E>Txj&6?eH_AMM)wSAnz2gBR?7 z1bk$EV`Nz8apW7~u2I>O3a_gjIExTgvCGjp_f@gcGvO-aulfg9@Y?9n^$)JP4*K8m za#axe(B*#=#NY8UEC^H!)I458VBtzx8GW@G;KPV;W330zP3zdR@e!(0W~_R2<4l0) zFW|wQc{IiNkD6Ok^mQ}AfADSWQ-Yl^mGRjW#yh4>nH%||b3#VEV%W{VPZ)uh9fQ|vz@t4h#7B6~$KcU?^+@uy z#o)bXz@xQhf!7#=NAuRx@e_vl$gGROqmOM)hCRiX*8K$Dx1Gb|`x4xW@e@YiEd?LZ z#oS>s@Y+BVULt-1Z%z!}pWsG&b%YUkx5nVT47^KVBD_)f3A{hV#J3lT$)7TrN6jKE8Z!Rth3*~R6fb#Q@~7?WR~gEAZf zjPuc}Jtn`*drmJ$6yJ2tN9F3@k=Vxc*af^XWWkM)?_KZ_UCiw(fHxU5;bB=ZBHyCX z!|`51T~!QsVFX?>?2Y063GaD=2~WW{3iifu*FG05M=s7s@%S6$HsWOW zwJ~@veINOc=YuI=7I<{-%80iT>-b3Wh!J>n{($IW?s89uu4j@j8$W?Z=dX=;>w(wE z{m?_;?T^9R20U8NBfP1ckK+4(Q0R?#?*lIb_QD9fbKo<|*Jr?+24*4O>oItgiDwHi z&PT5UF?e4B?;hBbd^7M9c(jIVl&=tYi{UPekdMx~80EX`2l{$F;Zc4ScSL5s>q--0p9Cj;*U z_vG59%>bWK zzNQzW`l~eH*<$UMjdKzSy=9 ziLW~bZzJ#!<%kh@6Jzks81TMjz-x<%Zvc2ueZ&a7XJX=e33z$nBKfNDBReG~9v|Xo%vUbp9fX}Q0`GlT5M9h2mhaZTB~5yveJbQect`Lv;++B>eM4Os;v@4j z{ET=@_F%6R&-cr?8{s`06W?7qx<5EEBk)>c;_D1W6cV;8lR{*Z6(MfJb}9jCk8_*8K@c z!XWco@EP$g0Z)cK;jPDy+~}Rkpb<|4UMcK_5qLk1!TZvH*9c~T_fbr`od6z&E)gT} zo{S$J?m6)FN4TPK+6N(x^6k#k_c{tzf!7sNKF;K$-vpV35q!JAM|3fFa2$w^r=Nfw zxshJ}R}9`_6kfUmSr~!0DF*MggQy=dCMG>^!cXAs#`xJ7kBi0ncrX_4N8mHcmx4mx z2PVS%C;SB7rWm}Y68*c7U|~kcw=o9qZQyCp3*l|SPvFgn!P~e%chk|LG=1OCDBtp5 zMDx`@8}Pn}Nw+58jg${Q1D_GE!GO2bfH!IMaQ!_Cyh0%y=cCsfz-PqU2)wnhr}#dF zpNQ}0G4VYHydT0{7~&)IX-s_20k04Cg!eRl03e9eti!$$w&2!z&jR$S9rUA=7liG2)tj!;GF;-nh+M> zXE+}f1Dd}v#`ihkRg(ob0`I#qcpC?>=NNn>-*)_jeBVWVYQ(!(K63if_o zEs3dLmVggkvxpJ$or~!otOXycn1~U4zmMr39Q$Q-T;T_|h{vljc)NhNErJ%+Gkx=h z{1kJy)ML?cBc^sDcqT_oe9x2G8-UX!{lbGx1SAu*BqpUBJ62z&IbhehuZ5pJIA}DFa@B=L1Z2MDRWUpHaST zm6+!gLUBIwe<23%y+Q1$w&?NQWx!htA&q#u?i{&2uLqw|zL(#K#+T{^5#NO|crOEQ zGYQ0v5VbT0?-KB!8kQcNcnZ9%7`(i1j+`Fu7`(zaqxmIhz)Oh13jmM4T_}u@&lZDc zJ%MomPmkROJT#-j^mpuA`dN%vylLD|F?V?RWVC$jwH7LVur+9xmUKyYzes7G?zAr{E*HShtpT186d6!rPCZ!291Zc&mYT z3-?10f%oeeydeYLO9s3*5fNj21Hij!1iWAjUmy6KBk36H$y$sbnGE0wy}W{V5fAzcFYrc6-&e;B54Y_adigo{jPWQ&xGNDJr7ya8k$7~(;2i_rPv9;LVUT$~2Cox% zeXu9I{|`T*mqj3qdf8a5yMcunfmaTK=wjVkT6rp}=RVkx8|gg{gb}X^c-^oUhWN

        &E)mRl4T714Ho;71uV9+=bHP6BKM~BlrlS2Y zUFMH%iI}!e5lqff!7Putg8jfecB#*NHwk9hP@?Ku#x$vEgZsRA!=Q>Q0JSY!I*_Zl zKD485ayg^5fim{F79pu77Yv9hS}o2+Ce2T9naLnsGcD#qGtqS>Bbh5ibEO%%{-nVX z|HN0IjNjiiXgKXSm!ORAx(JQBpC;81ZI&=M-+J-)OTZ`Kqdl}Q4V&861Z?wdfm^z5AV-h;1%mz9Q&K>p zeD-xJ=k{#A-EfyPf{5mKGTg*|@#p)hM}TP`yB@WVY1n*p=y(J{Mvr^Vlb;UAhwwOx zJ^6TgQoiSbZN7FXcX%729_3fqi2c|oN6@Y`zdTJT-!5RAk8Lkr`EhJy^BuMLsIPpB zKt?{$7`X;ufne?!MyYb?y_P_a>nSk~%bOBFK;mCZz_5Y*h1Cslj4_FdC zAFzM@@N#E9;6}^`Z2O$%1IG71AJEMCfRrT62dvw&JUk)b@x+}FSQ|4Tutg^X5QKYp zxE}9oLg2u&Iw3I2H6dW;IpRzRn0bK6gaF@XfL6Q-ftdM#mw!BU>n-))+e(@E?~Jkc{QaGMfr^r`jWgaHcE+9m zR`oCC+rRhE-??k$Z~u7WZ#RDUaZcv3%=2%!eD#5MzW1%IEAF^|=fhn$j;KC0=euQ| zkB>|lb;m1D{G|Bor+$692yz-?FO0K=~-l65YiYLBy`QxMB@oc_iV%ZOJD|bG4^3IL> z@A|^#1I$7B8UA=%l(#}<*W$QZmKaam6J;20jmoagakVWqp14QKFy1Pa-EzmZe1-8` zzM_L+*mcTohAgEq>`)d4AxYZ(RSAE$6n}d7wIN!oSM-#9dO-rje&791RRpF8OxQ_`n=Jbd<>=bkd@sdZ0}nq4z|)XC?Z zGw8WVTh?y)~nh#|`xJAXNN>D86_LoXQp zUgmcRCu`GQN~Um%!Aj6T24 zv0qU9{lN1CmjLtGJo5B4?~;ZE5feVH?F?T33-c}*>L${5&$~=19MEJ*JT*5JQ+3bH z#JRQaQj0V1LX8CTE+%rK8~ow957+&D8XuWoiOjo@EaIPd-i3Pq$h-^V_cQNelHjud z`iw(l-UUGeemDTSiRWFMz|UviWf2bCFJj*1Oc;^DZ2x zsAzuO^DdXbsH4KiE}eSJzkA*)(Y(ugiQ~tfQjT_|bU^biK-C~tc%;dVV_P;+HD!iUk*#mHaI;|18lkAN=h3JlaQ5J5+Bb{OtKW^7*ha zoc^@Ww5yi3NTb4&^V(|o5WRz)|L{67Q>K~c>wN=wZeBC=KfGN@34QiP#kqZVo0<(j z6|FPwxoKVgcWYDU!?uC6DOqqJJW1SNo64V-=PW`rfHqYw1*vVyc^4xk8S{K&dV3>} zaKZgRZ*O|*RhS#(qd<`mTvIt=$0A`M3Ikr#d&;JTA2A7&(f6`>f`lF_Z3n+o!GAn z*;>xGjzY~VTU!$h{u64uu6g<~*-2=?X}G>uBu2!&mibHRKg=G%-&Bj86qZL8$tHHpnvDmvI1AqV9b*lfPt79Z1B`)&fZ`7VJwo_!l#eEg=a z+J|9en6KHz*9bTBprZEG!^5`kh{eZzs(nT9$1i-(^DhYNzVwFEDkiCYT0$`76*#0P*7uDnX@>W-5u9vnzkKtNx?9(PqohIiKXQ_y2!Oz+D0rGXo_UnuJP=>H?vnnhKA4RF@ak&Z-Jlgen3RRl)gT zf4u3KA1W%ZwLSRUlFN(pWwuvQpe7WostDB<%`6Ypgd-Q1RhI^Wp^B=KK&W_TaeV(- zGvoW$2IKlyCD5N&8ZkU_}|j%Ob6JPGEj0Ft50@sB(57R9!PChBHc`q;vpENNyl%LDd(1wHS-~RdOsEpqf)!eI`o2&_MO#C0jiwR9zIT34jEpUmK__v5%!-uqqg;sSO4U zD7mnrBGRW-R)xadU7)fySXCVf11l3lUlyvlu)4Y`80q=gYvhOO@~4K6Sn-*hAMrul z;^6%1+Nw}-c^Sy#h0xkyWl?!3SUEc!UK1#v6{-!?L}Jv`l*0~gfnY8A<(itJ*;Zf5 zVAGcuS5;O9ifhZNDnn(F-Xwl-sJN=4x+ppg#IJ=(=$V3LMdf7|7m+Gr7m^87nmmPS zO9PdmilRu%XChkm2&h56*uez@(J9Oc1gb;T0R$E!D`m6Fii>IkQ7Hrim4Vq+wPmqs zR}{?)%?cLHu0Uai(AmzeEscs<9jroOqT+ogyVsHnXg}taiRRCB@T< zI#A4cE8g+OauC|s2mze)Dgr^&xBGzTGnz@K&!{Y#KvA%KeyF6VwkT9nc5!r}Iz_`a z5|y)}^6Kd7HLa+qvbHP~4B)_s91P($R2nERuL{+nfy{~%>a_F_4;C<7SQBkU4H_=n zCVI>{0qdMhax^)RhAN9H0->_X61EGw?IFxWofRmmy)bCC{drUKrt>((A%Xs{CgxD( z@FUVni)t$KrLS;#UKA{=#YiMvJTr@G0@Dg?k1~9Hxx(@&hNeO4zCS{N`fY_PzNpLV?g*&~Z?PL1Yh{o)wT$j!%nPn-LGA}Oc%PVYa%^7#jMOK`Ok|@Vi z%T-lohhf}SUR6BD3a<`S#8fx^+_jCqK9Yg(=_JZ4HcD}gZHgI5MzP==G1>OeakWK@ zn$Mq-7e!;8Hp1;HSO%j@Fso_N@!S+)GK2FdCtqEN_P|&@%7ZuGqdYitw>)rE7Ng19 zZGlH>aaGlvGPkF5NV{W~m$`guf^{w*bV-(v9_A4%%<+wm#8NU|#pq$2lfFy0I9Q$_ zpeC3gAc#&SZUXK)cTxtA27Dnix*pFK>tZh6obIU-o`cB^FYdnCk{sh6;u&u#aK2-m zxOxAK@7YnjGWo-u&e?LV$;*in2UYGZWiK)vu7h;{4(zwdQdy<9+$(#<%`6KG^ zz8P&HuE0K1@B-{PWkUbUu{U#mz&8N<#Q#3*vjy|rtsKEGU_VhX=Z-kvM4og^_;CJ( zm~)qfg6n{12<`y(3%(V&MDS05O9lT1xLokZz}13BApf<3rvuLud@(TR?3nI90WT1I zCvc2GV}O1;2(+qDRA!+TmZaV@GRgxg86O6 zM+L6{-Y@uO;3ow0zWPDIj{_eP{0HD?1oIyF^McO+eo^pj;Fkn10e)5RM&KiY?*)ES z@B!d=1^*uSs9?U+^P%7`<8b>#a24<|!5e@%wa0Sk0p>k&;={m$1%Cp}wn+aWgVFv4 zj|a{aTmn2o@FL*Rg0BYl3BDINTky|;a|H8SY7+&&2b?E33D1fY2tFCOP;d_L48hZZ z{esJZO9X!nnD02!<`&>`!E1my=THBefNKSB1LiY$^nU>O62VUZFA)4ZaHHTq052AN z6u4DzFL1lyFQN146g&oamEcLhYXlbouN6EOc)j2daF^hvz#9dx1HMu4jlj1G-Uhr$ z@Q;Bv3*HC3Mer|yw+nt5c!%Kkfqx`;&~a%0f=>Y6EqEO89>Imcj|wgY-Y<9_@DqYt zfDZ~@1AIvE4ZzO`-VXe{;61=E3O)e*lHmUUepT@6z()js4E(0x!RcuKf=>ZHD)>y` z4+YNz{zULaz{do)0CTdP_5M%5DT2QZJXrAefYSv(2+Z#SQU8~~Jcke;0cL+n{5Rmy zf=|RlPCmgC`M{I=Sr2ooP98CAZmREGi8bv#xN&CIB68nub1fv))LL)o!V9(PeY=Lm zO%0cZgsz|aZ_&ESpr(9&ci)^f$I+FCWfg9CJr{PN>;!Yq4c(WK0@>>h-L;X`_;>4} z=)JRhro)Y;`{YKjH z&#{k++K1>-eCZf`v?BAgkKMD{_c$>5CS#*)0#|@aA`IikINax9qr8lPPoo3Pzv`U{ q7qLna4Y5SSc%Re0Z^e3}Xws_3XQZv{c}l>y7Jdw8T{0g`;{O3a-+&YV diff --git a/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedtls.a b/esp-mbedtls-sys/libs/xtensa-esp32s2-none-elf/libmbedtls.a index a972e52d28ecd59cc2c06ae25ab28c07f799221e..78dd0b591e4075e3284ba446a2802219f5299111 100644 GIT binary patch literal 446692 zcmeFa4}4VBnKyoCGWpA>NerVxSSJV=ls`!b5Y*ZP2nIovKO(rg!;qPfNJ3%~1X|q< zQ-ulD7E)RgYr7B;0~M>RtFhK?a4C&l*;QV5%l56i;?H+$yY0T<+G<;Me&6r8&zZUR z&P+nP`}y?!eSYtOllwjAdCqg5^PE5ToO93ITXI9Ny}t3ryqSKxE3*VmZ2jx^&#Rg% zEbHV`pnstM&`R8B>AjuMaF;8x2z9` zI-5HJq44_68v-5S&Om2ld$^;qwK-(iX>ILIn>qt69UD@{w}(4Z#;@PpkTSldttn-E zxV|lAe0_UL`3-?^eW)>>qNS}P&>jwk!tH^kO-+dumiUJDa5xozLpYo$v4wwwrC^rm z`qq|~)ETsg>zjj3E%7`$I+_FZ!TQFqU8O{{HHSnjsv?Dm_HawqiI8+ZDSzVJhD<`bMjcM64=}k z?m#QEWtBv4>)2>x*wPMz2I`xeP#=NDaC393ja=W_y0Ix$gD~S&H*9JNw{CW{0h63m zlOhhuHYa+Isw6Xk(k7JxXqEML#aTt6z=rnL&253s)&MHimQIY7lGGVQ8%j#i*52CL zTHo3nxDU;&sdbZ$fg?{_dqbdeTU&~xtmp97w$^qGN?@?1Wa+e->?*1<1v+6qdweKd z-@dJ_GhiK&l#OTuj2iW=?e-R~#>Mthe_ zp}A>8Bg)nu+|*$mOsLi7wh+u2Knn=8wPN6f@oW{*(7d^$k>oT&liG;cB2yHT-NuZj zv7rho$(9ui)(~dj#yDUZJE;hRnN-oy7g8J2q^523Y^v+Gag+((2Q6)7 zG`oEp4B@;BvGg`pRT^7NeRC^R-_+XK)UeG)P<^wZwY?>|?Q`^L+O)oPGfW?6vn3`6 z$}$p*s+m;HQfgevW7e%rI4J?M?o`Fwh@DOK8)LrOc&psnXulMk^}PFHw%gFuoWi_n zJOf9H{DZt_HreM~94^o^J2oX&$>wZIMW+Pv=ZutmoY9)sS?9C>Ep0A7;{%D!es&&9McTMzzJd|1ts`is@QxH} zM2}*>TJNX>rCFR>-?=qa+Lk~ICNn8kqbfC*OR!U8s`esFDSKt8RP~$N?@N_Jt;+2D zs-4JHSD$CXc9DGT%R1J%1)WTbBj-{+|vY6}Wk$KQ7QRB(?G^S^x=c+~4(QUzP z&8?0_hh{?$7=_E6;yUjYOrPo=rfa4n=-3z3gd|N8(*$%8`+iZJWHT;CdEDC4H}?c3 z>BiTI4jD*NEos(<7OXgvbY;`V7@9OEl=x7%A&BOb+^Uf#DH9I3YA3VJzU5_!Pud7H z_Yb8#HrXdVEnISoNDlHgn=!&nX0q9c=2}$^^8s#wIo3oLvMm{#fXQx3#$LJX)Hwu@ z5%;=)nL`tX9y39TyvS;mGa{oYkBgTP+2XCpTo>23H?`S&ytz{#H^8LL9PHjV-52JZ z%U-V>Wa@*>^?E32u@94&Sl}s!N{T%lbNsiNkJEjunbmGATJyb|!;X85>~f&zH8nKV zJ6FgufblMsiY&VyX{b`ApkhB6TR1kw6875C9&E$LE1NFoa;axMPIj9tvkc~bnB#6^ zYM7G5R$%V7>Nzg$hBxtSa7(!06HPGNaWBFV%d2CIbBwbRzxW{OJPYt0PV z$vQ9?gf?@Qh6Q~%psbZ5Pnl08tmIrdNfEH^z8ShD_(sZ~oAl)VeQYF2taUI_770bt zwRcl-vwt>)FsEwj#3RcH#9T)||x zt#Ou{t~^-E)nkJ+V7YTib5Bty^G1akY8dz65Jj5XohevT$W6f|!*H7WqF6{hg44GN zwGL!QX$j)F*@cKqUmUHYzU!rYJYp(gDtZBoiMldx*XcC`=LpYBSaI_7Pfd{mSRn=) z+f$AFYRjx`^Lh+|fvsCZI7^^BC3;<6;=sg=`Wdb3@0ppm2}SN`<zJ?XlR@oC!EZsNJ0Hp7!8_zDQQo?W@X)Mt$#Pf+w0Yw{&&!t?viF5b4j~wLLOy zyfgfZcY={ff3*so9)A0DaC`f4&#``rJeqwf>+KvPa^TahT?@RqyQ3?2?ere$uQPh; zTv2y#bfEX;j8mSsGJl!lr#4dbmW$jLFRg5N7h2-Z@~YwQwxn4vjmJ=+evm9_TX#ld;oee=g6=Z}hz z=RlFlvv>Qx0r#R?jrAputvJ509oZU2ISQHia`rE?-p-JW2e%Ig&)oaVOk~`De3mz} zxEP6F&g?FMYQC)espVsK>@kep(faO!@zL%*-j7hUzM7WIdCR+>?V6mwy5HjqXH*vu2Ab4`1%=lHB^`XY;wV*KsVXM6YDafLhU zC$Zi=UETSpWeO*#y7&l9HNr;pD9 zPc*}#GL2$wWR@yGd-D~tu?=U!;#)IOpKNTm_8-4oRq=}@P#%`-E?-;o78@1u@}q9E z0j(+cW#%W@%1U56nmJhVR#vneTwnaqWI0pw%S=U1lfBYp&H>N1nziMNOXe;2oxTXV zL@(;C@y)x4t>26MVE*N70%gp6P0i6vWbi=V{Nt0@1P#^TJulwNX4t(QB(ot7E*~yA zQ~pa2itc+dXKKNio%eU|uFCJKukpHzqus&#PqgokMT1>m$glod{y^rVkM`yoIn}$n z_OzYJj~t(L%|P^C{~#Melrpc6O#98wdD(}2^QPxyjWJdnpS0_V$bnBR9MJ-4C1$=f zxi8D*b+4(Z_}h=hH0*dcR$8z+$2H;H4LOmTDUq7V({P>Sty&LJhkEbrdNH1tP5-R) zRcEQi^l;AE{HA-?o?m?SmTX_77`Ck{_IZk7*}?J3vU3OASS9tV0JkM)%kl`yWL=RmCQID^l22Y;C}{y!oIG5oX-8%MKY?V2<9{%m{nK)eE8 z&KN#>=DZqW+K*R*rF^(#@gDT40$n?_c0#%~?J@Z`^9I+-_X+D#}OQfHmw&=lGK zTHT&q2hp})X4~=Ij8Sl)HyS;Q5khH+$Q`AIN{+Gho@g}3SCtzNu6b|l(wxYdoL$@d zhmGPfXcKRsS+JzuoTb0%`RANR_e2&O(ab5Of6{RI{CKkHN2QYNonZrcXJuJ(aM0LW zSR}|?n!tZTgUHM+x?u2{Fl&g!UTsCI)58Usc>_iDqx={Xy zcl{c0dn~rYjnF}a%zh*N7}-MNCR`6q|`rPIr{PA;q5IyKJ-VL68f zp8l&RcUbNe?K-v!fRg*)21`e1`ztL#gq#h>vZ(HJ*JxTIR?l5p7c5`#ck0T=fMy!Ow zoAQj>1qQKBL@U+Su9I)^Xj;nH!oq z8#k|?fkoNOuud|wx%s}9>6o|P6Rz)^0S-S%)6JBDin5B?WmOgPrY3c|pScrJ9^-uc ze#+Pk{QGC2dk}URS0$JgJ=+l;;|SYtoEgTY4*F$|@OVe~N=Mk4|0H8j^g~S;g+`{a z%~GCx#N|o2Q_*vc&pGJ5lEY#}zsOi8VP2R%DEu2-lwV-f<4QMCg|9HqnnB|pTnmk{ z#w9{$G}HfvKpevsvZ4=LB1r$N@cuL63ylfJ(?Y)<@r6c-qPoP)83+|w%A?~|U0rMn zqQ#3C0XH9>Sb~P;&q2J)OAf=}#YIKnm`zcp$?p@)c(x+OGaY{Lp|B*6%TzibvKVwF zUt}uzg@}YJf@i+7alKqH%gHp1r@nr{b-3ckEk;om{=k*N6EmM#f|<`9f|*aFU}k-v zVCK^!nE9U-%sh)>Ys&NkFA+>0I&CXmuBC`eDwi-bKkB~%SK=b+CKCly#$>^iQ7)J| zvmKJ3>F8|vvJ&7_zF=Mh%rv^bbiS&d84u!STqnR6F%jG~@Wj;N2Ein;-7%i>zAl*Z zUKY%vWz#0$NoSKS;Grz7kJ1f)x)7&ylkU#+E>;Abs&{D*s@|_K$<%*SX6x76bd+YCNOGiJ1hn}Z6@NcAHQ{+PmK zX~r@2_F!{*F86BK7%H@WYqWw_=u|+2{(vwNcV4MPa4BfhrBApN%sdz$oqmr-U*95 z+~VW%Tn>2)L1Wpp)B1gkLRj^CUB*m~KfDcU{r&}f*77a|ty2pVJ_b1tvdVkUA`dVw z@5{hec|!w+j(gc{Iu-#8E%acSxiCn&GYTUPpK_ymngN21HopO@h2K#8KWw zLZiGj4*PMg!F;vT@>V+PV-@7B0~6(OoF^aU&34GEhCI$uwbSy-9P*xnyscoOyaISF z?+mcDyaPzb`<`}M-v2-ZakUVp!DyUEP#))+THap+TjhNh^6o*Lc3R#uh_K3Qw8-PF zUCX-@!mRR2(b#z})=ta29ZXhv2O+NxOw^Cl4=r!5LtZuHaZazDmRI4B_Y25d1t!Yl zR7K011I*;Q|As(dpVLmu;|N1sEre=R<^V9|ajv4}(Uw+ukAc9xpq-Y-X}(q7dlq@T z|7&?qAgxv2Rw$aPe)ogPDsML$v94dP#n1>TQNO5zAuwRx6^!I!Cl2S zVBG)Fq5>oG^rt7W|Fyz5>~4(s?sHe)SHGtH&H>2AE-Pg}lDXkIciWDk?#SmJ>Tcig zTyEs)PZnih_o+JqU(r2rap64oboCqo`S!Yf+uQ>yq7}Y7-Gh-A1}AoXeQ55B*}d&u zeM58mmhF19&*K|w%*(tknw19yPUacjG0zMR4HQ0eWN7Yp#`u2a`c7Y;=QDXbTn2&S z-Svg;3UBTsxqb7Qjqm5i{;v#0p8j~z?_!asf4Atj`1|q6k7BS9@<+k88c}HFbx$~V z|NC*1C=1RB8opW7JY$X9_kGuUh0%$1^BY(A8eF{*Us3M9!OOZ14|y;7M$XAhD&)aU9|eO3~%w!OZlspWDKr<^7@&tx*mO=^^`SS{L_qGSsXg5tE_r($;W+*&!v0eXC9|$7k*d-7NX>eo|=U z#``MS$p00g->K*q8IO^q3m(FFfP$?II-=~ zSmX6z2ObwEGjLbK>-`#rT^uyvIR0rKj+0tG*WBETp`+ebLQu>Jw*lF4}C17$~HE4nML5 z)IrcubF^@!E1!Br!03Y1iv;2?BA8L1v{YeLUWgk+`?NGIqYRD5y3eSauWCmSC`~f$ z+Jt*UOk?F^d(=+j>kvU)Erk70g7##Q zCN)sbsvqZPS_YG9d;^$>s~HJ5XpzT$N*eY16NkJth?8w5poF|D9P&c~Tv0brdQvcJ(WUpmb< z1Yi~M36Uh|$*^|Nm=Owo_(* zaLeL)+1aj^B2GJ9Z@kj$`usnwT`h!e7t*fOK|H>x=mN*9S##&efHnGfRVDLcJziY} zi*+q`am{u^Y4=2|hPn%}%E78lTNmrOpmF-RI%1=a3ShCc`p0+(GdwWZ%QY2`Q%ui8 zf-Z!Z3bMAkOJXtKPFE0zBzErHJLYHx4sm$i&N6)W7+YUhz3@VF{I~2cbH*9;?5_1 z-f=gKfmCSsK%Vcz?A1QkHup&nRP$}gj=s?CMloO5_Poiz&o^i^z5wo{Tx&PI;LSRH zJO}v<6yW$s7BZNg2jb42xq~I%aoY_8OpoOG2He9X;2S9DcDSBcS3v*SFXS3Iq2CE zUZChj#&;e0Pm?e$Rfs2~_X+=G6`qiGjn4a~OZNFVMiJ&Ou2Ztu zABV?hqsh<36RFjYOlN4R`nkE2K9YpQ6Y}&@5X!6Ce%- zwBTv_h!b(k4oX53W$eJ`!tJg2HB4Hg+qtya@RpNK_1+|V@-#ZjYYpx7szoIfO7ZqX z{VQkNZ;aFJ9oIMQ2LF=;KN9O`!!HUfoeEo{GE#*fRITkDN@rvHVVAgq%y)>-GG zOVLq(ZW%xIP`QMC4W9j&F5O)8e$bqJs_&^((hq?H4!$act#=-shWi%8)$nu=BEYUa z5uWk%4D;-fHQ%L(<2axl`RLqWBCcitZZ`rPW+;zk)AIfe*eY)o!n}WJr{$eRgjL>v zMIQ6l@}>Y=<;hyaVu7d2b^89=vv1-eZWc%A1Cpl@7EmiegS#9K6v}m^0qqU@fiW`{ zyC>#F@4PW&V)L(lZd*QQUWFMm`dat(dB_0H9D7S~E>@SqjL(ocp&M7Mcd#<*!P0iE z$D4Z~7JD`pJ8KxnW3g9W%g0gwPsTjpZMo>DKJSVjjAgd?c2v?Gge&#zL&Y+@_omMoXqcC)RMFMMXZ|>D@DqsgYJ*G_dxqs^AE&g$YkfZ zF~?rbAISa2nAO)niO8!Tlv;ma2L21kr!>AI1%JOgXS-TT`+jId$8|+&dLAFzU7A1P zoL*>xC*sZ<6Ybd_+a1mK_U)XP3ypS1_cLeBWa z@M)gk3D4qvRT<36TR7ny>z4L$!F%8{;RjwbjKlCp;HM2?UlIN=b;U~eD!f!Ni zwhPxHcs8MLecNd<^~@20X5x!F4u#1@JZSm%z_}p8}r=e*pgT@c3^$2>%GcHu!G%&F}&E zdidq=OW<#X{|r3ub&uhC1Fl@dmjh3QzZiZx{A73!{C@b)!GFgvj2ifdfw#g(;XC2~ z41PWQZSXh4FN41U{%P3js9~<(zKZKt5Z4Fa3f~0(lwlap!|#RfLAV!w6MQ55w~+R* zVHi&Ue;e0F;J*y~Rrtg38{xz70|w406crW|_{5|j?_$>H*`0L@XgP#Zg z*M?y{2R|MDdU!Xy3x3QHuJA7c55muYe-{23_-XKTdR)lQgMBhQ8SDde7w4K`_6NEt z5@z3!u$%mPT)ai->^F3`#3@aAu|{KTpEh5@!FQ%gi}zHx+0+usgPm#B+N08u1NCZ zm`mrAFvm)|3Bu2@neIv{@5MtZ2>o+a`7e=hwuGl@dag<5xJ-Akgs&M=K_ffQq*q8d zU&0)l>57D(_X0Yf&^dn7O%OWo7j#z&-7}AY9aT`b`# zLkxjG&!o>7QbE+W8Rk8Mu1NSd52+yZGwD$YPY`;ygs&9(fXR;h%<=EAg!A*v@Y52` z6#BO%oGtW+H9gbhe?-$I%zF-9sg^&af()znaZtijgg%f6D?0B#bVWk{>W~Ved}e-M zlJEqfe_6s;3jK)5j`Eq~_qQaRpJ#@TNjOvJeu9Qmzinu?=gd@KQsK~kQq^` z6vDDj;2faQ3)4G`mamaC+VLuOm}gvdA~a<;ru)^%sB^LrqEw7gJ`cNeXoQwGtKZ< zHC@8JLuN#gr01N5&L`=6hEx#!%S`_j312DnTrl`!YubT`WVbLo%@BE5M(zE{F? zrM}zZbhEwOE#YdJ4=j%JoAZ^sBz&XHAL`=iO*-exbk#E6EE!Tkl+PTWINznaQO2j6 zhg1;yne>$su9o{6gC3D1^rOFX^VpEktPo8jhodNbT0;n~vP42Rpi zY2zlmO4(SobY=PUS<`E3S5B{(J!kq&3vQXdvaV)URi%|uUQwkfU~*Cxm}$~bswmGw zTToYn{}pA^Z@YEr+VWXtvn}-L{8@SJ^c5>>rr)u6Ro(Op;6;iH;=XXXx2;@q!MR@; zFY~@IPL}+_I894gO3xZ(JuR5OfEHyXi8&oitmaXfERv+|QVUCN8L9a!nM&JA&u4Fg z>G{y^Mkys4W>tC?RmPEI2tzs<3u;J+c_+SQre6tLl-+WlSAcXCQDw{fje2D5z7@fq{Y;! z6^nC@nsJ;nh3W0(h;veADm}rjCzxq#z`jXi*bN*_DYiS=3D`Yn+La(iuF?l)~z~*~RrrQ*%i? z7b?e5gDK@WYB7n&Vj^XqBnFFlMqrTINu4@gt4U<3z|?|;Xqo-QEg3htMSUomEGN!r zDTc0Pn>KMqN_5n8YQ_|`gsz;bz8&?Hf-8k~DYz_!RV7WqViA;z#a7CZ)rzxPL~6_N zCLXVgG_5*`CxyL|cq}CZyDC8v&xPtE#T!*fGDE!Rqp1^T98IS4jkVP7 zP|XUgy)THt(fgTILP8o{>1xazNiIk;r?fPxrD98|o87c& z%wfHW(zeVrr8E@8*2Yt`2D7ZG7)7EUkxQ}Q`% z$h%i^BXBh0)JzV|l9^Jdm6|DqPRVT~g-*##DRiFXckx4gf!6d={_o5qT=rjDh?*D}nAk5Nb$-X{9E(4SJ_Yt;KN8TCva z>DLO?yo~-nkV_o=mpa0iIl|)|;VT{Cs~q7{M|i3ue2pXQ)PK5zKEn~7=?Iq@T@rH# zu6&=#zlr^dRXA6jBNG;NM)e2{4M$B1@#~t+!hf|27Z^86eVO#J#sr}=O+I{%r1t|C z;>`?8*%;wU;Q3D4f0yt?6)rJOi99nr+2DH?=uG{XE9z0Ig{=CwP&vc}q?-Ba-#<|u z{mzt&1v4F48P9Y@g1xx1Mj21tCkQ5eg<$g2Y5AGJ`gc@HRyNL=DUJk>((?*463sCF z{?v;EJNZ>vq^T+Sxn|lipHR{#_JF z`dy*QRum@AQ>Wlx z;QF9oAKJ!V!E7f71vdgeC%6argkb&-;7!42f!`IJh5G(L@C;zS*MK^&1}+l(=fIN$ z^EZo?f`0(KQ1H)zR|y`2h8Ge%1GrQ0p8`K9I10R1@LvNT6#NeGbAoZ~&p08t6!=ZS z%Yfe%+zI@F;75Ty(1ZF90kbU=|2yy`!9FyqO2IY23k5d=uM)f)I3)Nv;7-A3fFBh6 zG4Ni&6VQ+j3ceBeIl+Gld_wT&fZr6n5BOcd&jWuT_+NoNC_i=1L0{tUB#CDLPZGQe zxKi)~zzYQ*0$wHfBydRZzX5j&&O)PnQ1BGsy@D429~8U}_&LGbfKLeC3;d?wqrmS9 z9tQqE@GpTqur+lqME~UbmxwEYCkb8+Tq*eTzzYTM2VN!k72uHIcY#^Ql!Ido>UT}b zCct|oekJfh!CQf!6WkAcLhx(AZwmf3@VkQj=>H!GUI^?#y;45kpUB^x5`P(ZlHlio zD+Rv=yil+Q1L!KjWxyf9cL8?_jsia@_&MOcg5Lx_DEI^5=L8pFtT`dL68KHQ%Yok& zyb1UN!8?KZyB6x)56pLP6TbvJN$@`b^EV@m{~ho`!G4Tis|42qhXmgP+$s1=zz+&O z2E14BKLH;U{9EAX1dqqP>V)7MfZr6n7WiGkTY*0i{8eBN+ADQ?4w&~A;;3)8$f}a9@ zSMck=9|%4V>_H!(4uyr#U-0$7lLUu=D+NCSyioA-z^erR2skA8Bj8TKS3vHAg0BPK zD>wjrQ1FAm&j~&Zd_wTw1HUQwe*?cOIKK$`3oZxtpubW76~MgT5^n{bB>0=a?9Yrp z0lZM~&w*D7F2F=JB)AH=Q*Z$ILBTtK_X<7=d{FS4z|RT(1o(vDDY)0ZDfm|4cLi?+ z{y^}4U=R8>bsGle@1Kd!0rP#b#Ft}|Qz`f}zzYSh2VNz3CvZscQ^1{q-vEA4@UMaQ z3Lbws^cP$WjN^>XxA5>y%83uinZI;azhsuTCR@M1jF0M)0pCyTu>KNT{}7hHXXWR) zt>0|cjH!N0n}XM_jU{hp+E;`kl4)v6XlnBUj6rAShaA8oZJ;rH{*?-h@b$B2o{ zH)zjT+OeexU*4O6*J?M16P>8Qt&IW>FX&~9%hO^NIjL*{?@?t;SfID zCbm=WizQ3%Cut*pf7UPVe$j#h5fewsofWSE{iNwCwvBg#$7 zoFvw&f$A$^y!lXdjZ~vTYVJ{MI8`$B1N%fr#RvM5-uN^l@pAae8I@4$4|-QTUkrk& zX595xVs4B$?XV0`j#qk2E0hD9&0)Hy+!p+G@?rRnJI&XQ7~*Q7d~}WZZZgWHKBQsV zW-NoZ%3F%?9q`&|d5aNYl~;N#?mdX3JQhdGdyDgGgmpO%0^?R4cUs;V@LA>E4|&vw z@-Q`t%RAjXpx60ZCt-*M|nR6jdsya%iG{6@9P$Mn0m(LRXgNyf9Gl~O!yeQ z-XZTj$eV6kw*FWS(i;-6!NqTkP{euR(Y!|^0;fM<^2z&$NzYJJd8jI1&PzL{~qyHdFw3l zxV5C^J?YSozk}B@C{p8ohknf#dE7gKno> zG5DBHJL*T5kHMAk6)FT-;N#x8cI2b~COrG0mUlVQaZg=4EpI9!C{L5f$Gvv#G~Xmd z5LXM~F_hPX4A?&~G{o(9r9;1A3_dlM8xr%P*Wawr`Fcz7n=r&{r}I_&O^DQdm0RLgE+r)`cN!u84bgLITrF-E zZ}pu)VxqFCz3GiXIspcrki- zn)hwKVAA)_$KLTumx<8jWRc;!+3-O;Rp!RWxT@8_Fh+g&2I`KW<~JQSEl59^ZJ9Atth!XI&Ej=;sV-! z@nVZ+9F_lNT#97+3K5PmePF9;*uTpP`b zb!yff36A|J$9Jnc^2D3F)<(t}kzjE*wPM0cRi4oxlm&%_&pBOE(0l%- z7u`GlIab{_^el$mHTnByyHEaOEV9rTztH!OMxm-1kJ@l3u*z@+{f_?6W-*w`f5Q}w_jmb^la}N z2y~yl_DD}j(UR^px!=fHJ@!NN#5!ZR=A_p!O?BWw$iF*JRnXDQ=y?dw+C$;PH7N0- zFU2DJW09L(-W-U(_DFPj*RG-7J-d7JclXxxEXC_fy9Nq&Kk8Q@SJ(L(@AbEMkF#BT zS*Z<`s~;MQ1ji4bzvH{^lb?&-_Am{(V{6RonP2OQlw2CAh20AyXT~hfx%R93z;kbG zx5?8QLmOOj`|0D&+i3yaC)$4;DH*>@MXNC;bC_SjMQ3^E3<(cKf<+M9dz|0IUX!6y zA1f)+eCz)Sd>C!EdGFbOI3Hi^80Yd{(O*)u>j+x%$|-heb1cvm0l*;^DnUcDyYSL;G6+1jbbO_52!7}I zU5PYiiWNVwq(CEwwq4yrD~3Py{mP>o&-{|H=mv@Qvk*P$Sn$#kcBW&hDo?pp3tSN_ zUh6vD|D1|DR&pt#J!U^EL8BcTJbk^{ahawGCs{WwM8Xx2xP(wIwA3fwk(I0;e z@>Oaz&hza=U`1p7Cp$tmJYfN(!^O{aacFwJi0zF|O}?(Vg{H3^xJ{@fZw# z%r7;IFnsjcc{`u8-Pl@K1CDGA&@Fl1$*2O4(X@PR&EfLHCDEGhg6MKJa>6dk?3CvI zBpYh4#p{ur;>M0>q~E{y4UNTxWF}WfiZDG7FfC-QzOiR?CYQE`cD2cgEhw%c>eS!U5}`N zZh^b&7X`b&sYaazIbDwyJkw|5%&u?f0dPUa*B^%*OhNFyo=j%SJGEJRy*c~){C(Ef zTqVk+ODkoA?eLba%&0q3I?Y#ikvV4W?>ehKj;%!EK0fz3ch(F81^IQO`{cEF0d;Xs zWC4cE?vls?V_x~jj;S?Dz(9`g&Wt|Sk~JlmAmJ5RZq&w>$_LsW92)<%eN~&+-(*C- z|M6hX_$^2A6>|)o_iS16&_L$hIjgVxWU&01okPO~-QLLXZ*kw*J&?bDpr(I`rz={p zKdMIjC7DqWKbE0+i5nD*J-inz$tcc){ZV`bO4)qH0KFv`>v~<*_ll|Fqi(wn#Nf0s zy6TC37Y`#~#hMNC**Ry82Qn8gzuO&|jN#XqUpjX6LVW6ce(6;(M@@H@81ScO&3={H zT@JNij_C5agYF&eMj7sEjqXKlhOe`*sU(7#+t$LV1>P(Aj_=-=-}kI{DlZ2%c6ghh z;Ni30>kjWB*xtYYw}MqYJS*B)=79|Pz|d~vrj)6Q|O(i*VhYgM~;K~^*$)x59D<<0QV$}cUC zKI|1oeDcL(ne_g!}<*ampthX8NR&PQF|%gZ?Mdp?sDUB0DiE523#d}%up zMQ(DjR&FvN-^}lmJVpoe_4MUH@maK2j+4D_T-$fjZA6cEeIegh_q)$z^}g|FN2JJg z?ZVYt&*Qy*(=&GbQw;rR!nuZ~apoX$;40V_cXBc8gma|@6VAPy>pip{O%i>~i2U7e zQ5b1K3p~gE?&IBGH#-~KjI^c&nO$Gh?Po#8i|1c-E%{HGFwE3-hk};v9O^CU&P6d) z$48|nTGxbgGjHz*w|C$>>Gh4lVDrq5_Ik(X)2GX$6n;uw14 zv6CPA*wmrEk|d88m<_(R8ffeYG=|y(ovi`9S-*Z`$L1Dea~nQY8cu|7_)ID#Rv^pP z7V~5G{te+x;r1XO%K00DP0isDK3E?{7+;r{m(Ti}LYh?9+R@1;4*r&=j+P)E<@h@r z!*RaOruvQH&T0NoQwJaL#N+YF`pqqE%wmRNwZ=3*iWb+zNMz^Ws&8%G*c5g|cD8l~ zoBjCAZ+KG&m2VDj+R)i}oqzJ@HrqH8EFHG^X@1zyZ`t-o(z42})BKY=3{Y79+FNd0 zwKlM#c3JIBx2{@Tvug3J%L0p+ExI+Za>2^g4q+QwJDIfz^mlAV)u+hNG;8~P;dZ~W zV_bjao`yZx+_ouE2uHS}Y2pd&hW6IYZ5>wFXS(s+%eTZ z{YDM{DBq;{EcR=(OLdO*A(u&g9v3%H=SlcI6)sTkz$3>+*yC~Ii%}i2QT16x=M#v8 zOFqZyq>o8317)bwfQhIK^)*;)xF8Ww{M=zrxD4ADtSIj?<59g)2sZ9R9hdSj6~kSY z%`1ivIKp3%@@alPr_ql5S3ANM@k+kSk^U`5_zFju`;6LA{y$p;GR$wfYR7PfL*Ip( zh%4!J4*hThDDFr}eG-&au$l0Po_)CtNi=UN-Uf7_Y+HF=pvqgKX4DiyZ%H$ zBT9Uwi616LzK4na7+dox`$Jlu2euE`3jcWYAqjc6m^Wjyd#fQN{um^>#Wz6IA|VtEKiJ;?tEuCEi9 z;t$-L@QnWnuG~W}g8k?)@+s`WHD54QohI0e>sJKhV)O|n@6QF}qP~4bnXLN%l=vbN zU^~Va15Og`2d)szd=?8X1Aag-pz#I4G|?9YvpDQ~lvxSJn0e>Jk1nfbbF@6;=Uf-qg z8eo1~p7D19-!2%?;MruxuLI_JWMaCP1UCZnJ9s+2P;fKi`8+oB-~U_`Se;EId53%)ELL{|&*zz)x9tjtPDZ@uw~EX9Pcn`2Q)m z2>7=a9ydA$<-d;j%LVTTt`Q7q+#>iO@Lhrjfd4}9Q)GhEec3}SeK|)k`?8lfAAjIr z&iHQ_N(D3B48crSE|}@)^cb$?GfvCD3uUm%XErW*2wzMrwC62?DdVexnde^$_Tx%No6u?fzX+X`{$dlW&XlWlR{D$1 zyuIn)POwPCl*ii%G38AZOr2K?rtGzXDSNMA>O3r%`OrD_{I)|+rXkP2BHm9t4S(QD z;a$@eH1DV2;rGNV84r9F+CUXC1;E_^uj`_k7(9G7sr2U{4M&+gkIgdD1jH=kY{4w! zJ%U-T4#BvnZ-A1Y**z`sEaUeC`*Hne!IN-R<2LyHfHOH}0yF;_!GOk1f?4EF!L;q4 zTX-H6T#fiI30??%NN^eOzgYO+6-+z*R50!IYr(XW{Ts;EbvTanmCp*8tM&ExRuFaz z0<8@J9JC8y;ocq&1$aypD>>Wh-kPc@gdG4Je8oA>)CtYwZ0h72SNCRK@l{*ET-2#7 z><8a2h}j{Q>&X#C#Tl$dNU>RwRAf;br$uo#(vpQkfkxRxuyE*ue2Mbdne=CttQw`; z9tnllZ^n659Et4=w1?AIin$XJQ2R1er6Z~ODx@Mt<}`DPFXZiF)cUm}fb+IC>0JAV z%xdNSjg!o?k#PgGwW1{9c71@^Y67#3;ZSw386Q##SoKVI_|vST6r8#WtnyPZCzG+4 z!3`MdhdmfuG1Kf)S!J-OaogeZQXLzUJ}9NxtrgqSvB8!T?A#8UrQb`#!Sjwr2g8h% zr+2N{tl!*V%jP~9+T3AF91Bfn>4Y-;aF%KaBOF^z#jOj@UZFn(MOnIO*i=)7tZ$P> z)fAGG$2g9RW4KmHmMt%n$3gE1<8x@zxzO+0n#0)mNh?7g$fb^Es~Y)~Z21gMIxf&H z#RLMktGFx0#9<>R72+^_E64j4F{WM0ah$h0-rMM6xK}#)&X^?iSM&WAe8km4E5?nF zzj5Un2A`e6zcmv^T_o)?*M?@T)_kKgjK%DW%(n!!YQm_o$meF$vTkH4|; zBThRlk9!$bdGA499pWetQ>3^&&RwkX_}iTK5T~7%_a-8&^2#7+9pWgD^GVWZzo+1> z^7z|5=Bu5S_aq{$@^(YegNUO%Zmno}5n!u4&QH0wsGXMg03xjNiZDqlLPE;3o{PN; zjgj*7Il>Yc_XSG_B#oZuo_S@PqdS8}8Zx2!tNC^zEwOet&=?k{Y5xg6>v=i$b2{or zr}lp21~ZjSoi zl6u&B!*KU}JV>liPo)t*Z@%UEG{U|@e$-a67BAV3=V0>LT2rv)FP`fjJ8n$#;@ne) zvHH3U@1y3UxR>+1#X8;UAG#DzB5d>{%@~B=#xuS=^&w-P)3ZDahYknuHRJa)ec#WF zW&rN2T-CLA==oQd^;V2Oe7IuwK+UtU*fU4+cMoqKI^yrIGoE=dzw4!fu09tZVh?UU zR+oW?)4TWos=v<7Q#Ez2!Hgwe>{e&A+@~_$^87OM6CN~EnWI4ZY@p*T;hX~~d(=|` z1!iB-_0Ul9tNW@7?#@_D^L!=`=|S<0!*fIL(i#{n1E*^|#_FGc3Y2v!oA{bfj~(Zs zucH~@u5+!v=92*rVv1iw9AcuL$Z&DDM}4lzdR8%J8X5MD9QSm)?!~rEzsI-P({Q2$ z5vPZXUpcN$RN(W_QWAV7>i!ScANOQs;kqc>Sn@amDw~&CP~UG6UHo^{M3p;x!nx>t zaQN1EdNPdu3|H5Yg55{_$FSr4Qo$=38C^edJ@c}E|F``62W#Gl#a@3Yf9NIu>qqjz z1|!3^u=7C0?nj6ARqgaS7_Q!a4$B!%>F4Z#+OLH|c4BQYbE<=raiHHpJ zPX4x@j^npG>D$7%(OO)pZx26Yp|h{INSNao_r$dX-UkbDH~f-CfAaIJx^@ifZ~bz8 zUx;rfU+dt%$ie?Dofuc9|3JbV#|!ZWhu;Z5^(w?a?pJ6>e(nWn$1wLGwPV;4RPz7C z5<&WU2|okOZxz$&{b~-?R{1WB-*g-o^?o(yNJTQHQywwtbb9Yd@yl4v8rAzkyoYHy zg}_CUkZXQo2B!&TInt?gHl=7Vp{{c#GQsU_UHxzm`Tm%^4U1KaFgJuAm= z51YW7{zq~aE}gn1WTvu&8(V_)SVJTK`1~JSDpoDH^sjT1f3j!FN5akcK=5d4m~57O z?Gg3(?67=lIL!}Y&D_)}h|zNsHpf?sExD`m@t4XSjYjGv;st+$*i=j{qeoZFWOFKF z9_g^!ziCrL>*&8Lm9{h5_lQjmZQmV66Y+*TKk!T6g3e}u@+>rzYxdw zh{!Od*qbqMeP9_o^{}Y=B{)V~`-Q;6G*&+LQ|&YkAcDAB2+ttEzIr7*^&ySn8hEQb z?kDmdq@9+>G0-aSyB2vI0<}C2Csuj4AuK}}kjcku3v6KJTZ1?mqDWTqcy)fCbr>04 zj(C=X{5oGgleWrR2by_T0e~YPT`l;Cs~LcM+aeFkn7F)u2e!()A7PGr+G%nJ)7q(s|F%C^KSo~p5AUlx=M|R3VmzlA-5<@_uhwh$I`8S2ck#}7i=6Rbop8?l z!?U24pd$RX2S{ylOTs=@0c>?&x$U)c6!aE}eGj{eg zsY+=F8wRtx%G$%yoW`}#;fxUW;(ktY!0k34~hsU@^kn5_8c8Idyd56Wvqf`SCj*-Z^J8H)zze| zZ<}3Sf$-Lf*|W>%8CxqWtBi(*P-D2FOru$4b1Tfa%CdQLOf;vwveHCV(9XDh*^*_q z-m%PR?+D^;D)k-Ze0qqC>=Ar1tc?R%8{zs860vYfF`Y0Gt@LCxlP988aTrY@N@_<( z09W{?PAxU6MBP@=4IBr2|gE_%6Ev@uw2Y--&UHg1_; zyAWU23anhYG*E}HKi!J6x65y@UAf9eS+I0*?Xp!SgN?AVcE#%273m2JYFDgUylC-) znpL%_(k-c78>n4_uc9rx$xgSVOR11G-@w9KmpM|K>RN=@GMCa^Q06Gz;zesyB{#JW zELeP79W1c&w%P@$xE3v5ws>V-?Lr$(v>!!+aHW*6XzA@M>jLv{U$m%p#Y&rO*m5C0 zm$sxfaL0<8+it(jMqE~VM_^^`%9T7-y=w7-CAIcywprCIxwbx%EweN0*0O2^&ub^Q znc8IwR;;~kRqaC5@T%Hn%+s!E?Xrb|TNedtYgQ~>8(3Jgs>Y_ORFb6*10&SMf|Y@q zMXOj3W`j&=G%XU$^J^E~x}r8v0To7T+Y6ksRl!s08t1%lnWI@TQJuG<__kd6rNh9i zz$kT^mMfszkRBoft813tZtq3NPc;-hh+2mVO;ge|G`Fo-6j1asU0lW8f3egyZiN ztS%$|)X!8a8sWv=ekw@&VlacBFfW#=T`+C4MKEo4 zzu;0_u|`t-Ww_G0(3je9WtoXtZkCgnda*pj)P*_`SK~^(iJ2$$AZDJl3voTJe! zHex(&Ks|`57i~dITT&-t+KlBSroC0Y1GC&L8{=ueYQeM_ZNzxi10C!4XV zsw}`$fK^$5F9B9%0saW-swM4NTvb^R|2lA;#D5RhrGnXROW^sOsv1|-K7l>J%$M;j zw`!BX%wM%P;C$e9@Z@3s_X?(7_X)z-*>0xNq0^Id4lp1^y6{ldfFjZ6~Eb7!T3|2Ob7!MvZd?kTez znC+GL4q&!R;tt>&1U~{?E%*rVLcy;B*9rbL@KV7(6!12|bAeY0z8!dt;Lii!C3paM zo!}n#n}BuNhk$h*{VlMrqYNf=zA-uVGfc}t;q=c-lbGanqa(an zHz|qjSuNjI+t%I?=)?+JZFvL_ig+^g}jC!97^%X_z!)nt}zQ^68^{Cb9g|z!V-ZYS2`0ZdLlj&0g$KK{;_xLOFqxVL=_%#{_hCynDsp+jC2aXa9()AD!* z$tv#z?oC=AhdeE>N#tRuS1upnI>EeXc_D|qA>6ypfKL4|e8uIxB=WRf)*#GrT{|uB zd564S42PGv?}|KK-gN+e(6!V0 z{i{P>GbRV?z(jeRc4&EXfx#MY2VIcIAzV8xuL2Ro)k1g;@;K&G9;X3X9?t_<t#(=-=L}YPA46Uln5dui{IJ&{k8_79S{SZc zUbaKtGzii1SVr=(JwFF;)$a__rLy0*B~3N1baz3Xwjb@I<$W30D(`K`OJzUKi>>AD zw8-Q7O3Uj(daJyT(&+aH;;r%?w#XZAk+;DikDWV}e(N3b4qD`KH$dyR0O_e8+ZWws z2rsZ0kTiNVZ^9K~mAea_Vyj?YD39(AcxySni+md)fbGC9G}hZs;3-$jdlT|FpV3as z`w=3n@+P73Z$KR7O%xjC4MC7q-g}T&jCk#|yqCadmA4M^IG$48BzV#&k7E+$vCYx( zn=~O4s=uVse<=BCQX>;v9C_%nVOQ%jecl)7m@l2?W}_RzvySk0IpK~Ej9ijuAPc7@Juu^@iM$tPhNa9 z>8$x4GxsMv65T)12Wr`|no|r}j-ji>D(&UoY~L9d7{SnRO_7MHIBUN9ibvD$|8P3a zGn?5Z{q3@zt4^XKq7U!s`Z}Ji?^o~L@{Yfk?~7arEtm5Q{Hg4>GmXUsd{gJ?1GQTB zQ`t&;ypJp=*Efha2C6gOIE{UZZvcHD&-a2y^jxL&{3II`+&rJ`2<|2;|*)aCKkX58$W(U@khfDm+L~g7Rwc9*FW*x z;_mg}RkYsAwv6+5s}`ZR3|>332*sepB;4&SSeL))v2C zo6|7vs`XRH`~JyQ+_ FaMuAKC0RIy=$Clt~7e~f4uuI^NVkO@`@`>VX+u&vFHk8 zeQk07_b0scSKINvRT|}`9X%PYp4!}=40lg$9?rW1biG)B1Mbh_7C$cYm44REEB)#m z{CE5Vo}RqiEq(51zB_arTL9%lzsn!U`|vyC4+js6*2u_g$E?N@o)!2_Ny8PM>%Rgq zJ(I@u=Vl+v&3Yx*b2>Nko!pG~bKUK^Mo+Hm+Qz2ayZQ>+`us+$pzA+e=l;WwSMc@m zm3u>o!%rBFxSl!U$IC$b#_sw8UhNC!NRG=;?+3+;NPEli7PanhQ?SY9T@r-#5_+7< zQf>16%$#Vrx1=xFy&SJ3q?NBXneIg!^S~I{#=P0l+k3;iy1Q$AO{k!r+}tTwxU;S? zXymC0BP&}T^&mmk4`P8ChOqTX0*#q}cB9yq#r4it5HkxAYdNci&QbiC1kaK2EK;UB{lqV53$iI&tPd7W zR4>b2Uvep8bBtF!#gVL^fVT6oOZ$WQk^TR&>-qi@6Hp5vs-LP{cYA+He#3QzABB)+ zcuLgwgWj6yo<}lw{E0DUm-kXc?woaVbk0YiQs23rf_#_I$ z;iKP#qN~0b?Oyf8ho)y%Et>ni2^GQedGc=PL$j>>CG20_=gYo4)E)9>t_V(C5iD5| z^dCDpDYCz7*Y^Hlc?F;fMTU(#qdhsEJNxmH>fMi)_0)OB-`?=hJEx}Ho`wId8x8LjUiTwzFzwvuK6xmHAz;Vtu)(E~(xRTnJ^OkmL_@e2`EthY`s*<- z9UEheiTcLGxDC*mpg<+x3r;lf={j5z{xgD20z1L0;DR%5(b_Y=-dxyF66 z(O7#HcQ1^s=T9H{9`s!S3+tCy&*=@})wvaH)wR{kH=!K9zT7EcNS%i7B|Pjl1rmiW_x?m z1&YcW_P}d7&kr9*1!u7}o!xa9jKh3MFiMNA{-`vDC-K`Xwgl7o;2ErnYp(`{tkPJD zGL`y13avTo|MEM&QrErXOc`N$)HIHLm)vW10f05fCwR=CILcFY(Z&6tA)uu zm%(2KT}Ry>|+TRjD8kLVHeJI&iVho|M%@*ChOVne%I|??|Rp})?Rz>!EnQ#)Y|@rmjpvJZQoDoYsP!R`C{k& zp4Dx!ttXRwt<8|{Zmo0k&Op8Ucf*dbMY}7`?dV+^Xx{1TZ$0ivY(0E?*g*p}FG4L)Z2Oko>&^w*2dC&w*FB`cFgt8ZtQe5-n4lHo zYxnWhmF^ zol~AC-p4F2bk@gHlgyPqD0>q-@A&F1y9Z-66ym~yp%R>e?_gNpxzmv!QJ05w)z^E- z!LVKr-@FcKwmUa|?uZ1tDJ`W{=zn817|&yV z71LMI{}#p>j+pZ3FQk4JI^JRxyYtxNNI=C-p(CT@OV!=&Th@BUH$Sj8y~OQt zXIMH;~H^=i_b=?5G!NcAtx zzdQL#J92vKD2lT$F%Ku!8(|s1;+XuNxq#u@8T816RlmX z{Ye)-xyCwJZ^ZuC_5hb_MIO{~R12+GF2X-S5eVew^CVg}l!nUyILbz&L%{theCF!0w**4!n-p{)R73 zAC2}r21cFhVtD1risNdqN|B3uQDzKLCr?-}oWq3+C73_&Vc$8(AtO>78tYpcnBTLk zujJj7lwMCl#o;2)*bN8zckS|f;sa;=9^?|+3g0J=zE3=TpRwZmbiYVh_BF$@$!Idb zi3Q94A~L|WgAp>Ayz!IzgE4)Mqes2hYe@%UItwQZ`y8M7S{=@O+o$b%6Qd++U+yc` z6=iQU-gNIfJ;j!tXK5)6IVA&>82Of_`pSBeWY zOkwxd%e6NGM4NROjn#AR2;~7K=>Emf*owpbKke^3ry4K)%mpi3Vw|tt>rr(bhpxSt z_1b%dk?053p|M_=Sr4v>9L|l5s_!}^ztzm|g<)^F#UHM9hlllsTL;1;PKAfR8yTBAm7cUOnpbfnES??;X_r?F}zFzBo@q+(4&Hv)3 z-j(n$;Hbl0_YPfXT`O}I%39emKE0lP#%B#2ZreX}B{cm=yQ&ZDm3($(FIhYzcg5p(8M>Vr*LrORxds z_gajyCwDBe4!%9?^WZxgm?2%+(Kk-&zH#u!;)(4o9Lya4A9}E3aW2ZWw@#G{Ze=8V z4e0P#P6JNuRi6!sI1zr)s*0?4cSKM=WjI?gKFoJ`Lq)&p@#kK!y`zZ1{(jEf-}Mux z*K$dJ-+LI@+tv&hobiRX{dDNcqT_2{uqhe#UFi!y>T6ZYOH_7SS8$RGfc3Gy5pwj8poYJxUs|Dyhv}J&6^kD%?tPDg?aO=-aLyp4-9s19-Vh@Uex2>!5F-P zAduiE4_=4g*qs;2mnP)d_|k;Dh^9cJKQF9l=Rf^`c4Bre4SppC65nltxHR~7zScLCpP zs@!}_^X*|*TYJL1DH*N1y(#IfhntmST^;S4((38qJ10=R{q64KnXD_l+`ce}!@#qm z9X&gok*n-ZuhtR;``lD$wYIMDpmX7U63|FxEKX_g!kV!d$unm+JjP5t-AQL>@~a*_ zyN5WOz}@m4zALLfcX)W)h1OiWH7}vc=yh4!e<2^m+)1Drvw}6 zzG*)17#@DxbpF2JROH)W(BVVY3dVax?$-UslWGo#YCz}1HD5<1c`!%wMXIkhO*o&H>im1WH*Lx%S=N@T^&tmIwyf69r%hSZ zjMbAF$2CpQy>N_;) zYYP8rMae2G{x85D_V+hFcOYK#9O%^ z%vBZ)`X`i>58~9Y>^wjDA!|(9)7HUdEZuaUw;Vm7H#mlnJAc636e9Z=*`^*9cP_RY0VTXYLF&3XD%a&@tWaPmAr|`;N_` z1tPn`ktWZD=_c_zUdef46o;zVX&1oKn1#|h#c`3ShS1JmcU-!a- zjiIlLN9t`okMGLC^3&k6!w>cTZRKWn`IN!!TvC$5J2mIeK$7$*5lfG|dGS8G|p5PTG8nY^r^ECz?Hfu5PRmM5&2=1lm(pCDnS<3G7 z;#(_T_af(o7`;cM3rmm2T`j#w=ME41-C5o4dA;tdxU%1MZ~v|f2dzdAy*d(t8*nf3 zy653@N3u;w@TqcUWP?XFjXn9_5I1B<|?6 z+#l(8XYTYJ@)jYd_-4q6<6KZB)OnbOl?7dG^?t=xLuK+~Mi`A|iNt%1a06phKj6od z!g&8o-R)C)GH-F9$J!l@Zyiqb7tKB9^A^qb7G3GA*Zg6pckyh7Z_uLoi>~w+&HpCO z7kG=Vaz3R6ru2-(yNk%Nz!>$Bo^zfB#i^Lr!-6UGm}M*c^A|eD`$l`9&Hie_5vKi? z*P8IxO;}V)D-WSbHL}b zzt-6i7>5P5HAA^@7E)A!B;VV^V1E#4-8tXMrk2?1u!V`1igUPl9EG|e`k_5Z-bgt4 zad7gT?}ZPI?~CkqFMteiH89>^l!dF_qJ=0uv+C=K*>zxl%(}z2Z0*@SxOW_@D*Bea zFVZ*OJM?kco=MIgi?fvP?P8@7>{i*VJ6xDBu4R$-+T&ff_pcu6_rLV<&Q-;~+r015 zNjnlI`aNSiM~$8Q9vg+K3gf7ni{gZ7tDFAmcQ5d+w5|5#DiG;)FSxP5o+I?A9HFCE zF32m0IqzQJ81j1J)ilnqA4cB*%WFM-n=y8VX|HYfn(E0K1$v^cJFq`0Fn-(ouXW~I0MU5SssTFfN@+0vphyd+MnEvPqNNLWycd)}VFIav z_~fJe_B#V{{(>?7z3=Su_32R&5zXXS1Ts`BIQHnOmg)FDMJ+g>stKggqs}1D-6)z~i8aj=L)QVOqCjIo}le?~Uui#^7V2ePOy5 zA^S+8B;y_gJX$!iZ=-+?1J8kYjw00`m(sVkm|AgyQ zv{gGD_il6;?x(-;N0*{Rz8h^jA06Hu9r20>MLm1KrTuGM(`gGXc0J+Rzqu!JAUbMA zvgJ{GQ)}F6e3=sS-P{!1z~(eJ*X>PPh%cAs&iCfJJ~;Z;fq~=dYl74k_-jS_%@CCA zjIMLKtAl$whjF)Lv|kpcv@xGjR!`@e%G}Bne5_D*2Y6ta#LtCO6NZ_@yjwiC zVEKa;6kkrcc;2){x58Ingya~`Lt7ce8R+`EBf9s=2^cZ%cML@iIHFF6L%OG<&z_Du z`oa4zINM%6<PbN5JCX;8s^K#;~MDeomjVILeWV z^hgReE$ObZ75^CFl_Ki_(H#m*QZ+lHw#< z9BIMge15HzWx@6O8dPgUa)la<7tAYAV$*Yf$K=45Cfy*FNpTrv4|Jte2NQ`_{=iyj18n^ z^`eq#_+qT|=3p;X{eEzduGvY`A2Bm3e|1DN8v%S`=ta5lVXkKUMU zNi{_~&s?(b(aaHpCf6`MnV1~22E93gyXkDMY!=m@{r-BokLq3-ZcFJO_r*o@4*FjB$~hcAHLT;EJ&p+-KeFZ&^dqyT z?HqWp?%VW$@wwMLi=OBK@gtc2VH4ȲiiG<+Jh;}rR=5IV2kAoyAd=SbMJYj}97 zVD{i&o6>*Ng#RdbNJ3*D;$P+bsKJZ8HaXv+>k{f7 zu-Z0jj+GrhXNXJP*jjfWuGenG%Y(5Ou-6_2rv|s6%BRCPw>Ecf?u_#_o7{Ib_Ru`U zIX^)EoPZ@TjL_X_SM;V$?rd&)xSufs&7GE}&-A-SrhYGLcooRjZ?|ckaozSvxF*=@ z*KOygbicGL9oeZn5AWIRkg(cnI2T(DQ+%7@R8U@O09XEz zDvbL{|D>}ka}f_;pQiE2V;fy};nSN@z#TvTdMo2xb=YQi?=*U zY;MEifaCX$XKcxu;}z~n`@yJviL7@D?ccrMN0f}4&zHMJ=(o)K#W?RT#vXfc5TBcc z*6;iqe7Gm6&#?pqXzauf9qJR?i0k8)?6SlduRG}vJ;wrzefYkw*FC}SPWtBl#hu+n zle>$q@E1+;7bSa(CK_JU?PE*@5U9#ggaK-N^8OteGn_3Lv!+AoeT7P{|Lr`0tMv|R zSz<1R3TI!KckkP6E&8CTD*XaoI`7^G+J5TY+tv2$%vES-Md@p6$*_C(KCcJ;42&Yu zmOHW*W-W9KHT}p74~<^t0|&PHBQcEO!8_W+n zikEiF)$2}k*d3ET8q=}Z@)4%!)Al_-rsLtuos%qsP)&PFqITNek@WY|mlfV0;TYpc z{K&pc>J0@7RUEt<;v{$eWiP3)dL~m4Bca*Aw z&($5J>JVkrAxi4tkBWrh9Y7r}b4)xPz2kYy>C1ZE(>fMsz8siWcwLwynpJylk>#W4 z{-OSNUhn^C%)Uo(a_C6^l20y*=syXqaXv$+u z(|!H#4E28${U#!f*?DjOl23OWx&F;ZZg75vMS_db`;rGPURL;X>wr7G8?{Wz=|9kX z>a};YNjci*yB(LkKg)9Pa!|GBcLTm~nIpOX4=#Vvv{S0xx{ERM652iq2N3oN z{+o#}_&^)>n@(Wkjq@KOoCX2=%)$vVN`laT8&rN(vSt@gYj{2rb|X+j-Xo@kNF zSP2hF$g96G$t>H{CYQW61^YC>8GegsHo6svI{0RB|Qu2He;nRYx z5iCvy9%(El#y3!2U2%VrEw`i+~J4x4ieZ;%>egQ6D|%`}fCWWC)s_?dOl z?#jcCa7Q|J8leu@tD*kKssFLwy*shu3fy{<|BmzDIoQ|MGkKnIez(i(o{s5dAZf=ahe=FDH2B4!U?v#A~)`P_}%V~zOOgE(mzn-?siXZJBlP}t=(=6@;d_@ z%e&o^uvG?+LdXKrb(Zs(PrKcE+Qy(P>!yecR|{$96-@^ZDvkuz?ULK0fo|@x=BIMO zV8?@2+pjn)02q8@cyOOpjcu3;+J1}Nr}*8e*mz|7l~&}Ab(YOPXzfi&7)Tj=Dkbh+ zY_*KkeDTu)5z~6CgW1^965m$l#n_oO+hBX^+y`gCh zn}5kYnU>!SLykMfSqJa3&O?@Ae>3|EdP8z;BXKHLH4?4)N6l@mH#CZIk7EK>q-;-F zu;PH7YM5JkG0Yf`w@{)Lu^8R_d*9yWE3mJ4)|y{!%_;2v&*fIz5-rc;T)f@uN#jN^ zwwh^5^*JmA^ zi(+|3^ca)SNbN%SYu~uhCHmsC=2EOPgSL%ne21aHCSrHsQq zCTMGGJ8o;VHtW$}E$dStVzGW>z>d-15y-UoKALzNv9Iz1?EVb2nk2Ng8}k4aqw z?d&e&_=Bw27E9o_#F$ z=z(3YHvOpoSpD}(;>2{}f9OZsL|K8Vk1q!h6H?+&QPLkIBYSkCw3wAt^6U8fWEfM8Yfk9{$?+cMyu((6t-b$p$X?d{RZ&}8~zo!_^WC7u%I zM3xlYA4^<$5X;o%UdsmXu*X|%anPif+UEPh3VW7Pr`Gx+P{pSG{pV9Aev)mq{fFlF zq5q{$FV%~{F5Bmk^q^6)XDbhFl9CcVl%C! zwES2}a?1IX3Eq^6R8y?|95?hcSG9e(hG#0BF&6KPgd)oZbrYl@xnRdbOJ)8LX$S+M zKP4Fw-m!=q41;SjEYq6d;lX>28OPn2abUjDGkAqIV3wux7u=L-#8b)YO@J`~sgASS zzM}=K{wU||_QH%SQ0)=hp=V*MM_DKLjB~6)WN3-=);K*uu>;`BUylcAC!hd}1DM!! z7ftN8G#u!}G-n3>UExOsVc!cd3?%teCbYGBiza(hF#mD4<5dPer8@fT(YToX9gBaJ zv}n z?#kRiUm!!(Wy>bywPT3@y(xJ(5byXs_rxF597h=*(Y)zbI{UQ1jaX*A5&K+Qj_V4o ztGUr8`Q_Yy!tpp}IR6RF*B)5Ywg@VM-E@4+Q@`neO@l0N%D6rccDnbbj6>149l>Dm z&chrG0=XCtaHdAbbHO#Bk#W^lsCnZHk}h02rkQ(}8r9_ftIFED_w}~zeniANv3KuK z+jjKsBX-9`6c5GOALhKyGLSN{H)VoO@J0Aj(A2FFA{*G*q+>@G@5kN^=rv9jAA#U{ zm1^tSJYZ>f^;j(Z!Il^0;9O4q97IT}6)!-IH?o;BeN$K`*JXN+t2#q@VsCCE9}mrbQIdy z^36-q0@dc$3RA->4*PcVw!;+{^?O9PPmy%ds4Jd}OVtL)i-s$`w~bo=HXi&uiA+9_ zOh)Y08u(!x+mdP0)KG_PP32Qz|76k|gDFM737nFAOGo0>$|oP>-6{99$=1P4u72aDF!6kSc^r+MkDaFD^;rY9 zl*;CSy9bx3SaYm{(CyI;Zwte+Ko0pHqg zG2Z;{qANq=%?rlEvnGh=b-SDen%nJ$Q88}kYJJk))PR1$uS$4O!fpvw8Z*lh$LO;q z)lc)|jTs4cN9v12BbPDmMkCwl&Mb>s*5VbTt+=Tl1**`WInz5mn@#OM!R-}O9_VX2 zSxS8cKfq)h+;f(T>)z?}{L`;$%INn_k9Q7P{psVJt=7PVozLewKJPykJMh|P&n}6a zHe-h4NXNsm0lU|J+7Z1k(dvICb~=`)b)slKlW{*{U55nOJf8O7QZ zLVHEh-zH(bgrx|t6O8@Aw_821;NQscML6v_CjEt7KNxX@%N#!VySVd}$~NO_LUnXu z+11`uEMQoauj?>f`0e76lXlEQoYul;BYfkMkM3{Zm&o;Xs(S-=g_pX)!Kg7W2-O*IdsAH-eJ!n{#^w`zV*Ctr zsP!ZtP)gp?dN{cPk4`-n-rDTQYV{zE);0W>>rG8`uCsKfs#iZnJA4tn>9eSNtR5aN zJ>xqGfX9Zqukfa(_*315w^#y)I|8xhYk9neNAv^pe9HsPSgROxX=j*5AD&8jD_02) z6GG4MaA8IUBp5h@T>@C+a1;!tXo1wSMPmaI{*26rj%YnsB^^C-RmXH|OPhvl;4a;v zc~d8QOI^Nkf%cB{D18eC3&*yw(|cZ_`BJB4SzEB^Cgn!6I9)Bd8a#e1-wu|57uh?b zY-JO^)15jQ5AIHzSZA`U`O`JWkUw=g9yiV3rt*W=R$$HF%3JhC--SeU1&9kA$8@eR zOMgw)NqtP>MO&(-r(XEi@NRol-hygNFY30(I&mpAxA0cneU5QX z4=?=63-|ZfQn~~P4+E6O63Q4NL9zM zc?b1RR2y}K&NfqU7{Z|QwxEweyHXHhQ(%7s)?U1K3sdfW+`QWtpZxsGGuHRHr!Bs< zH!9Y7eZ*O;BKcNt>Bkz&tv$E4=5@VvUEf@+J<}1Wj=t6F@A_a@kI#Cm@47xkbJ)w% ztv{WZ98yLO4lEYK`=jM{tTrdnuyzQ=MlUqeK)xpAJT~OqCFd3iKM`BFT+Y?}D5xxW zTO0ZppCU}bJ8L>(eUZ+BSQaeA84CKO#!f3Wt-x;45msZjsA`A&kAu^VS<%}rr1eZ& z(Ysijl&do0GR(d`+zYxODbO8w)T7%{&(4;J4fEJWi$@fU46*a<*^$>`;oW5p4X;`# zU+6B+at>(SY1po);k9yV5KaPC6+)!45hq*bC!!cZk%&B$qDUM3EJVgHna*D^nqgx+s+sY&nRqxAxs9Gv#<-ax5Q6sQ#9%qxn6`tk+=_Z(sqB6cI<`D1^9 zdMdd<_rt-*wZ+BWqU?D^YL|$r8{6i&mrm`nYijFn$NFk|tlm|d z;7cH`*ZMTKKU$x0%rGj0aL2?r6f*DW`=blL4KHjq?Xq3(O^B0MG<#m&Gq_ck_q3kY zJ#nV~Mc9PzbPKJ+bnVB2p+tNFAl9TCYpC$BQxU5BvX^k#zNHoGD7oAl*uTiLuy55Z zxsC;nbUZ|i(KvGN4Wc@Hf&`+8>>1Ymt&Adz|+x} z6jN4a`%OA_7MgTPF_|ZXERDY9%W#C*Zd-Rg73=Uh|6o1T)1Ucb?uw%sJC9{%XTLgt z&E$?NxIyBJ-Dgj`Vvd!?oWs`guBZD~WaELZ7s7G3z`1t#)!u;^E$8e8$0WyPN#Cm; z^Zs~C^<|%ZrcKV#F77`2y6a-3v+Rq3>orHrilak#wA}fr1@96#`lFpc%H8G16Hbm~ z?yPuw_ZtUXNxm}QIlQ4H^Pb$c?n5u;_IA-O=$feX>3(bGk8+>AXWX{)-Ce^k*iS^A ziqZBxdS%kFnAZzuVl}(#u~_Fu>n!Sh>#Wvd zUVnMlhkQAdF&jvccl@)7-6l-0c8Q#?FwyyZ%lo*f-v0=mC*)d__`!$dyjQ~KB)ne2 zpGnC4n(%COznte8bok6!f@evXDdAKJyCuY4Osq@7>HnS0o9=XOv3cE@t#k8uo8sD5 zPsV27=6UHkzRh*%Qyh67!^S|bdN#knl?IyfMeU1n7g@44pHzc2LGQ5s@NqlS zLDZ5f*I@5&VO#YF>Gmp^y6_vIH`+l@O(x-ARCgSjavNq(H>Sb=i9 z;$cZ)ckw)XRtg5vW{6Qe-qG|B&BAJ5?D=r5wLPObBhH7k^m?JfkwYGEXKhYFw;x%1 zR~42ydq#VP<@`%aO!u)4hOJwJ3LlJ|zWuy?$!8C3N$EJ6>}u=x4qaMK7|;9w;?lOI80*3CT_ z@dB+c_F{XNPsA&Lyvrvzvb@X3cz==Hy4x42QW!Vzo1EU`>8EWfzVlXF%JA^jk@>F- zo8DK+z1izhkSmthRogl)&!q*xbRt~CcCm3HN9+StGYrU)dqR;lmSN(}_tRj*tcZhE zyWOiR`n`kid6y@72jBNDPxLP5_}|vj)bvm9a%Vg4w?4!z?90b{mtW>zez|w>AE4=X zzx>N%M)qzjcQ{gW4V^kSJUlCGE{mpK#elVpq?5YbB2R>?wm+YiS-HECo6CcAc!<4e znRqaMhbsI<$2`9?k7EI+5TzPQ5UshU$?R~+(9tXcA@0I+N_@T~f+ z^>Yk*Rb^3~r*7+<;QM{?fl<6ozp}ct&ec%sN-c3!*K7J|>6T5Eb)_ZR)z`SpA0SX4 zn_pj7T3lOKqUnLFsIjc9v`)P=c$25DzEm!+uPF7DfNqXnQd(TMbyLH7MA4R9{naTW z*U}or%GB{SO;4HFwyxTRZwB01SyEcU5(|?`ugFv4k`mQ7)HN12G}e`VHFGJ_ zDmCI~yJ{O7HZ?Z5HhH#I)p|;_8&w5e#kDmJr8Nz%)NeN;w^~<~r>?wormNbsrLwxQ znq+P1%4J%f62M4aNZLpl#gsDP`vH1uh5EXtC1xb_yKxDNcdJgKRLgC%a$$L z%0gFTJ+7x$q7-#Co~n!yk`hOCWdq`8Xr7Xi%7)5XaJWi54IVuf3z54#cbQfcQdPXz zxvI3rbv27W(^XkhT-8`oiSMpux{9_ol-9dy%OD1%SW_M>RdMB}iqg9Ep2miX^@hkx zw=`&;G8D|HYPPGvQ?7lj*0uV^udNsnhN+cA5_J%EWlib-x?q%kuxJp9r=~=;NRajw z#Z~&F)mPLuR+YGFO7TSsSA}QOrqUX%v7Qw+G_0Wl;$S1(kh?Su%~9ImnMFBj1t7SJ zJypexRUXRMRpzOzLZ5)<8gZ$eP*%}vrL6y>9-2FWG)6k>nBiLDLbt1`EUs)=UwP+x zwh}L7xHJ8{E3X*V@)Iyu6_SK$-;)-CYg8DtG7^$gx5v0Z` zSGzKUF^U^hr=Z-;f`;77N|7>j7##_ly-HAh77H3|^e0+6+PI?1+H}aVu5@!_X+5;B z+*Qr~uewV^g$GSr*-)?5KsrW$t*mj?d#ZJo@;XoTOe9-|q_S1FudG4yl<6lkT{T7P z@AA~hC6v-!EZv+|cp{f)TE&szrvX-kP2~stDs)gCq}7&UeX7b>PmcsvbIL6zss}9Rl2FR zxT2mzj4Esy;?!4A$94VI%IZAj)hHJ=X{2ckNu;MXx~_4hHfETb?Mp_(yXq<%jL|Z5 zI1DW`>ZI5&&CM9Bf&)~xtG@EvrMh`H4^{jY^`+5A2DYz?*SHDYq;$O+`s*93)j%)B zQ|7cpQ9>*8RizD9L>~=QTw_e3HHG4EB-XEHqhplwV@@2dFj^Vk2EE$#&D6&1)W+Lk ztW3k%=*Vn3v~4YHf5Tn1b$9S;d9CXEVx@{}8#%PP?ova(vCfB7T zqPSF%*rpi3>cq5M!l2|sTP>rxNmLc}LAoYZ6Z-olDOBD$3v$02rl6vv?ox>Eawj^A zIjX2KN?lrcClW1dRKC_FY10tb)AH05m%3^iA%{B3EM1vd_Ksi*M#m|utF4BYRNo*y z6V0nP6>P?4(E)q`44;6iEn6?0mztrK)YWd<#HNL4XVsR?3T7+uA*f3d3JzQ7;HV8~&%OR@>x4GhaTt4mnWQXCZK&b|_Jo$5{Sa*HafDjT*!ZAz%Hda*rKrFHP)^bTaIRylk- zxK1IL*-Y7neby@LDLUBAs?mI|bSN48j|`ooxT+RS24}Id44LaW=~vh{N^44ySEcTR ztL#SP)d=ko2Q+sRooB_hjQ%^+O^x283aFV#RhSf1U5y?qIRa8WOdLj0f}fD|6OT2xBG zNx9+seo6LFQYBrfI<<_gV`43Cs6$&BIy>5C1yw`w^9&ZQqCRNkHr3W+wqrQ^+DI~- ze+GT>nV4xdsJT@|EqgZIcvo>%B|YUz_I1{RmQC+@MC@T)5z)I3b?6c?7|Jddk~LHM z9Ms?-1$mA1*HImSeFq<&guyVX6pS4bsiDz@1qBu!Yc;GLhc%gxXu4@P<~lCep+?Mn zz`(f@d@nff#h5bPQMt)w^4HD2yXyVW)6t%)RFQQ@K_NG!sdH!^Oq7b%IIGV+Mkf1I zg3-wsz8yyfSb0o)=-4Q4ts3bt)rwm51l6^IU4zSEqhe_PFVY!VxWN*XGRk@>w8ok{ zYHIJIvZx-ZTte72+Iho$##Bem$+KNF;dHEnHWU*E`crC3Z6qQ7o|*RFIOdsKQn!Tq z<#nYSu|`0pEUn&z;YIo;tu+1VQ9>ClMvjtj#EqhGBrZWU8lV6rBch+JNo|#j#>y?Of}qFNHTQ4v;Yu5CvOVV+g^B?J_w8TE6Z@8yZT3h}16ep5cEQ(PwLAja5}! zHP~rRXo0@Q1&pBeFopzBXxUIOBc^MXORaO}Nj1JC4ptqDt7gNXQ)@H6DrIOrYYn-n z)q`M3f;p-2^ed$%BGro(l;w@$wu};wxG*x;C+PBu0CIVobYb7%kmWTuKWASD4NfmJVle?Z#DAiB$+?Xwp4Z z96Iz>7v1XUg~qC`Yt}56GUcVw|G($!!MZZ~Da}|lmz?T1c`$>+5K~rHss>1-lp#W> zkH%tzOcS=UQ>&TYmq|!1cq$bys%)tCY|8k*CNrAtXxJ}(jR)%>kgz^+**X&yq9ZC6 zTg{oZe3|iyrek!`Z6j1g7r$Cwhpre?Cu1Sdm~)Rx&8TZ?J)69$w4qef*g>|IHn@zg zpbIak?YSeurg(!r$LPIk6{^C6X(3clSCZg*gSK4VOOOT%l3n`3ywO^ssk)0N#w>p% zD|UqXDh>o{I5f35?cs>{f(?3!f%)GRBd9bZy{=xF;Ku6z!%1s!aVB_&COATjaz@lT zEEaCKJUrsb>3)*(rfX_2ENLZ`^~Ih#brZxin~)JD-LQZrE@NU8%A!0|wVYgAW6XaI z&(;{~HF^ovo*H8i)cscY%q1?|ZZMZ6G#9L?XBb}1=s`%@G|#Z+QZ6c<8W4?vNNK=q zEnoTm!R8R|OF4~Ef>WYPO!%lgsX`+r(X41B|9@;3Wqj7Fs^=Xv@*|@+9P9c@F45`D zuOg}D*W=MjtMz_sc*npJy8CAcxJaz0Z(6Od~*Y7%3Lt)|GBGLKR`eWp{w55^HF%?l zGgsuazOp3bvNUdRAu;4KRm1}?u(rgtR81cWSTN0ngN`HT#!8|Dh5^Ld8*hZDEGtSe z)ia6$UrNfNR=+izQ&6%<$fZ4FC3bWb^!THqiZK2+v6Zw&JFH5Tjl8J3#@#RI{K)*s z)Yo|z*N_xfn|1qX+-yphTc}vAz-mp2Y;Tud05JO|~%nenA7b#P4Y zx`}HHwKZ!ii|@cNYedi&y(p7VmYK@kt>PsZb*|f&%r=$UNB|4f=pCvO8nTT2!jKJ~dBYtsbcm?=aPsmg#q(N0Dd3iPepRK1DaD!c|ht%y{EKR)LJ$5}MH~ z_00v?#{uyxpA*aM`l1<~N#j1y2=~a%I(Am91gm3tJ(f)&%`%utEOZ5DjPo*Q&z(Kj zm0r=%u&F+KPRPa+J<6P_synM^VeN#|oZ02@ak&pgkGXzc=De#iv*srp0LQ+w}8q;p5g;O*SzKOPKnCy_rAs`dBSN-aB)- zh4Ck8Yh+Ja4x(AL$y$<>Z-ct-9!U%+Y}6OhdCo7Yj~ro0&wPX-J@XN!xy+}CADaGD z?F{neQHP&Zo360&FHB1}pbEn-xjr-GdS=M^RUzk#G>gcSN@3Nm)r{{Fd`q1#4dK5! z9@?2l9)4CO6?Llqg=uR>PJqI+Z-kt$ z3pwZ4=SPk(ZNtb3P?%P%6^aUG@!3$T?ee=RGv^`Ne|5|nal71rp!?f>&oPRIm{GO2W9U{7}ewZ^-%6A?MG9oIf9O{P^|03l2%OU5lgq**s{axCR7ifxZmi{*zI9`j;ek|v+)OnQlnDM@1;V%(= zz^RIVuUrp@sf^dgY43&bmopO_ui_W4jnTxsC>k#{NqLT|>y6rX?dnqSdJ@t#4)PoC zUL}p^#{T14bkoLbxzpVa~HCnD$0LN8 zsvQw|%v0Cz&@PknR&`#ZRfV+2Cn8T4BVKFJ4odsaSMs}4J1Fh{U+VmBZKlYNmMvcU zzIH(J??k+KZL9Y65cw^X_}ZIt>ys?uxKPRRLiQ40>qedL z)V?M9NHNE2?b=^NUfb3A1KJ-$^w%BIA03h(`)$1Ti1xz}{XZt{hvZcIWXkpFs(gDi zj*~pf@r&1bw4)*VW)*o~sjfevofP?`s`G!*dgPpKAFn;BJvXX-pTWZ^xPU`%&m-D2 zIoJ7*X`jnEc}U}7`MMs`6cKZ*WHuIY7uW?8Bp#cOn7j#sjV26Dhjlck!$<29M1Rb>1TKVEW|w2|^dKxH?mb3-J#}I)3Egs5g`N zX8gmEi67~|L`d~XU?FiRIRNvN%|<%Ql_Hqsnkty(S}d65`kG(_O1_NCGBQhI7s3+3 zlq+RNI?Gir7y){WPG=dL1+EBbar1PcUWtp{KLWe zSiYs8uJcqV94wzun{(rh9w#y=d}@gsdD=sv-} zMw<5to`81PDL4^44+wSv2Z&4X562_;F`W$14+*xwz&DV;oz`J zjHvM1b<9f(1S3##CJ)nCCiG;4$Wp~+dK(1CBHS!E0pXxv1lsF@wt&H<*cLY@u4KEYFgy9EPkj|--Z|3&aj;8z4w-sc5B z0K9^I0cld+w+aT-HVCHdivA+ksAV2G}QE(=3lVCt?x8V7}{~|aGcu4RP;C~gI1N=L|fZCq~v;E%{ z%=-Sr#Pgqm_kjMXV7A@(@R7Pq7Q71dMS@oY-zs=5aJh-UTJSp1TLiP5kC^Z?CjMiB zZv)Su;0?g+dz4QJunm2~kgY>-1?ZOxX1%U4@vIhH#kjD|jJpYVvEZq|<$@c4zbzP0 zyIb%U;3mP_fbS8^ydD?a1pK04%HgkqSzjLP<2+Cmh5v>SMG5+o4q~yxvBI;8x=hRj zak%g^Y!u6F*tc|Ir2ioJsY8Z+rVjm|*x?*W=WV33jQAV)hlBNG`o9F7ZBN_@%(f@y z7{N9segpl0?Pu8A4ML~AEfLIdq(U&q4z>;BZU$!C5bs4gY!BkI$ct@290oeufS5M6 zN$^78?Zl<{hr@>-dFnvFPcR;=58C8b*Dcc+qPrhLGi6#?W*;4SY1N~8<-v)fh#Ph7+4WK7PjFe}h;GLka zG||5caLBf!insg;Aa_c63jC4pv~l=WC9$E zHe}w$d_mP6^!q?pb-zim>*EgSe*!&|{4#d1{7iEx+O0rv5qMS+Z^l0yYw;rw$B_+! z_kpKM@Uy@Tf`@>c1pgCwJ28zb4j+CNI>I=1;>R>Eg69EZPF`_z;Ya%AC=X>~smDJY zPvA$o8}vTGOA+@a!IOa_ffML-bL2-B!1k`CAHh!252OYjEZB_^J01^0uVCz!IlPVn=K{eoGSE)&mVf=fXEso=H1YVLsY=Kw!r;_nlD8|cRbZvcK-FlDRe z{vro8_Xn;3{rAGdwt7!6p!UAtZNPsO+ywlw;O)S6j!j6%1+2zO;61=@p#y5Ef_s3| z1wR3-)(WIN^nsX87U@g13OK=2_sG39RN>!hcbCT%gBs z%msZuuv2gVmV4d)1&?olQvB- zi<%*r_23a&o-HBeVI1-VKxdl7$ADeLVz;Lf--&-X*aqbBfoHzpmw}fFrftNZmcRiG z2g^;&y2J=3jmt))vo2EvBhc#tI_st656m)V;zxegOW99gmN#4IE`)~!v%E(IBhX$D zoQ|+xFzazbFaqrj!8r(jC75;kgWv*$|0WoLzSe;^}bq0$Fn(v&^`vwo`GfmtWj*1$YiPR5NzsK!cQ%Ai*0IS74%5oq@d zPDbb#>_Yg6V9F+*ZGm(s54F}Ld8xHx;B?T{S}`!?x7)=3Z-PPA{w$d7`xn71?}vgZ z*QK;qNQbgia~5FAY^TrxwI2yy2mFv=%5tBH=YZe>&<_e;1$;;_+k^+@&x7(Mo-%f{ z{!orazox9o6AzwozzGx@4$_I)UP*$P-W7t`UWJ00UXfq~TB%^RQH5ZpcZXoc-ZFy*#_`s~v6qEIl%+AV^iD%x#=!KSSjOqtc0_!|YMgT6)ZOkl2CF@4JNUj=6Y zza@AH@E--UJgR@W^#1!#p=W}g!oC1HkEw!lfYSuCO_X2c((8J)&{u(;Bbe=TyWq9J z&j<$8`UE!t9}`S@zbM!T{Dxq*=evRdwSN~}0{nsC3g8QZtAHb+Pe%Ep1#bduUo;iXy0Q0bH)x&V&@9Nl2EcRUWyA++i2tficd2kObL1GAir>q59ua2LXQ!3Z?E ziR9UXkSayYva|?BptTBq0^!dDPenK+cqhV>f)QxH7W@FhHwCk6ZlcVWa$!2HCFRSq&XkBU+8QTbuSon9%?=a+yt!V zgTUK?|71$@UBOF0|98PTz}yc+SuF$pLT~}Fg*E~7Rlt`ErcTWgycSs5DDd#uAoMEW zV!)|1!;Oqmi7Ax+AT z_!P=R*%|9mO+x2-6!pfiGxrHS8F3#Fyc2OBA)bYQIQHPjG`|I&Cj{RGo<6~6V1#k1 zB}~_4bE{wk+UZ=UUJ(ALL05efbjmV}`U!jpSosXVRlv1E-vHbucs{UNCy_MOItlP< z&;!D=7Wgs2S-{F?01w;tw9o;ycLa9<|C?a8xs~I%q#q%83Fzv+Gw3dch9>t9#Z+KLE@&#;t0pj!Un~m#yctu4rMohd7TIQ3lBSf z#2nup#NQxQ*L6##juQ|Vc7QHL0v!z;G(*Hpli3h6y*YxJo|+$l9t&J0bf(9{!od*7 zJp2+ENsiF64Im+=6>8Hm;Fu+oj`9cn7U18YvNK5+ABMU`o@h+ss2_&yS|;=+2x^t! ze&Dr&9|c|~c&u~8rcD4Y5&ECNQziIr(Ak#E>sjFKf~NrAC-^4doy51`9}eme`6Ez~ zF2O0lJ%U#PA0l3ke>nQ^BmY*=`-zz$jv@R=pN2ZVPW%m0^|c*i-{X5YCr><_#t#M0 z20lyd#XlSu@FUNINS`*1_!^{XH!%3QhGY2}xzTPyzXd$Wg1-lxF1Q<*`&*dKB+TpP z6Bp`nxlT^{LeOasiB|xx6}%pp^C{9>flCDM1>Pk12r%bRE?*Zo8IC+i( zb8VdX3)Ce?@Lzxn1pm7Oc3E(a3p!7Hzn<3yp}&lFtPp$>{F?;-JLnN$O_;0mv;Px^ zBgAm5Flm{5tV7Ap76VJ_pa}eGxcp1V< z!K)G02xk9Qemn9i0Nx^WiuYl`2=x0w;F$`%Tj=Qs2L;bW_)Ec=2tN^wK>JMae1sPT zXCY*tV!f6Cju%YbOcDG5!s&to2(J{p3gMH2nM|+XO~B6xrYWGVGX1xJm46P*kAM})os^q&YW0aoKac-ST%2pv%So8Ttk{}8+#IE>>U_t zCm2v4>k;>P)Ju)^z?5IL@UTy-u^V*CuT$u6Bkmte>HJafJK#AZnEn25g4yrG!bjw0 z6HGrVN-%A}SixtJ{!GCvvsW;n_I<$>z&^oMzz>>u0)nX<4-2MloHp^iBlrQ(|4ncJ z_#Y;o{}j9j^iKu%07s+4Q|3z1-}G*onXejLGTdhs|CLf zyi;%{cn+EPpAx(c^k)Sp1D`bU{95p8r1PfWwZQ){@%*RYb)bJL_%`6(cD=qxQrjaq z95UP|*bdw;nEm1pCjLJP=DO?|!Rf%~OgtY8-hjM55nKX1ESPOHCQ2^@ZSXR|EYAwT zRiIxdm}B*76MvCl`WH2VV}XAxI02Z?#I}fo(E(0?a*5AYci51*Z7I?JFN?+Y#f{=13iyx=U*KQqz!Tqol` z&&(V;X4&k5UBK~z>8nl@%)T&LFjzFV;1bYN1y=y43w|9uS%S&GSny2nEH%;bu`pGh z+dy9_n11nEg9n(;ZX4~sMev7^$#(>w1-?h{$G|=l|Gk1~6Mi6=Hh~BIb{^>Z3KwE- z0+!Kp;TCd?%!N0@*-pnftR=vCPe8~nLCk~YA%;t#-=hR({j!D5`sE3ZMYvZm0yQsY z+^N8i3!QcS7r~7Cyx^G#-w=#I-`jw=%Yc6?bjsk5f>$9_dji38AFx^*2j-E1He#--D`F)+)o*8PB8z-7V%s6X2U zdKNJ41>-IOW}hd{0lvq?-y(Pe=&gd;p7#l6UJnSa0Df37p!Q?I+kw@6f28mGf4F=1 zxTvmkZ+y>{0k%3IZb2{^Mk63BZcv$w@Nr_gQ>wUq z)|{NqM}AHrx=QD#v?QK|uy+ytq;8+h?P*U4=|arCP@IXs4*VDjNGX(X^rRnXE1r`$ zP2o@BG{rrK(o{gL)%*QxA8P6t8lf3`LX~J&hH1Tie zG^Je|rzsv}gno#R=*@^1$tv{2^tOXIby3K{G3*fF`}6+F>-wLgA7<$-;C6n(P3<>`8Al9Y#E)H>NAlB+KL69uIxZ z4)!k4oAD!l(%V0Cnq*}9fjyZv{D_Cb{2r%Cb}}SC8KJAU5tplU^)EUP$wd5@z{B*z z=k6$MvUeadOg|Jj45bIzXTg3R(Ol=n+@5q^#%a>|VorYt{P%Er323HUs&rwPZb3(M z3p%1(&?Nf={8B)}tDZkWlcD&NJ?Z&oPE(xNye{l1P8Hl94`~sn^YHv8rzuWeP8Z_& z45#tX&nyGyF3=QJ3X9^=&gmt1c5)gI=|xVv@Z8I3(q#{)NtZ`BO|r*RT>(te`9lb4hKz!)#0EiPOJ_GO*$qMo9>@MS)@BrMo34*Gb@RwHRz3?Nj|ba3VxD_ z=vL6^3P~w*@ec;gE~80)cwsd0PUSQn(sWL{@XX^hVN)Cg&O%OG@w|i64m?SZg6Dot zLj-&&LboT`YdKAEdW6$>=yeX{q;zL>4rogECj1DK_{mVb$WVAh)4V;o3H{s-I)xGf zhV)A`$;t8zX!6JM3~2I4`G9yxPT~{z3={ZtPbawve5U^=U;#t2iv6e=L>J>9%w+sb z0Y*mB;xKSXpQ4VMNp!W&Q%E!~%Vk6(+)u&3m}r`4gdsV}p7zx*=X6$bbZvAo=#AX| z+nLe+)i%&xvZu@rqv1z5-LP-t^l{M75zXs|UEKb%3+*+h74U?J-hqEGFX2Zxcf0ud z0%)o$dbxcb_+KM>DgMFq;U~^14-pOiHIVrfr+71r?WBD0=Q$Uw=VoUQ=fZQwb^Y04L$ zaGEe#Uj=eDf&QG^Zw5_cZ<3#Q(mCA;`UXz#27Rl6hsIIF|1#|7a=I6^kJDbzod$lk z_6q*>u;0t=H-ct+x_G$sZ5+aU7WVy|rhNBnPCo~l&Bt>7kGTCY*ni4tmS0fLMO>_$ z&IS+L>jl5lK(qZ_pyz>}VBnv~>GxpI=5jeto`L5UPQMKvs#7SeGoXt&od^0`2L5VJ zFM<8NoL&z40Zy+3{h)!rfzzvD|1hT;K+{=G3TrLs|HbJL=slc%3G|OSeGv33oL&j~ z7o4W_9pH2^=wETV4D?A(SAhOE13!J+iNd`L_G~U1^gW>2{4;3c|IonyCr)pJ{a-n) zf&Q4&q@S-1{3ZxR_$Od*<@71gahxW8GGZ+Z)~rq-JDJlbTqD%IKOhc1?)!#LKY&LH zXu?>@X$PLGI8AtUoOa^*9ZsjGm_pp0^$II1lYREhd`RlVwCdiGMJQ@gsR?TtI0|aWw~*VD4$ves92cIf zJq6EX&@3%LlUa!$g_VsbOAFAXn>E~?@_>)ic(6Kx`0oP!U2aeDX8knSlbl`L9uL+w z5&sg<`?&pbJXu{0dl%?maC_4IuQ`o}zDEu`6sNbjJ*CM-P8Z|(DW@q-*q$8lld+rh zcvXOAeLvV!TCw^Zv z?|8Y0=6R3wOZL66w}4J5#XlIrA)3M&%V`Im3a2T|G)@yQr48|?;K|aL`(LhttGM z#?+)gr{Ix7g20TyFNGR;7#0`Mj9Q7 z)WL)iX^{dUC*z&;e9J%ugy&j`I8f<1*tJbwaB;feYX;xhXm zK_Pb$&GS6vG2%Z4`<0xga{&#UrgK>9IURqa-Zvute+U0&vfqn;FdBYjZ$`LnoPHDZ zE>3?B^lnaM51t5-pjo^Iv#GM+5$VDAL| zO>R#*W9bNc(iz1|U_Q+0gLr<2(z`?au7w85?nd&J5$1x7kHkEASz3e5s%F;DWpd8*A5Io6YE-zTC~PUs$nj z<6{yFA@YUrYhA1@5RC5P8}^X!TEdQS``n5s`$%$M-^W$j7E7-+q z`bB5gN)7rBJ_O|V#0}#eNogap3-NeH(62N%WK|MdzsLh$vtL0MzO10DTt-mANL&J) zP#)DkqR*6o>&J1C+zebPKzAG)<42sht!~YuEAXB7^|%vWd{BOb5J%<{VdAEHx}?Vl zE}SS3e&3o%+Zg!kaiToqc8X{bql@UMg!5}F^b$C%@UoBf>$iRB(T{kBknFm0{o;*S zz0=J_k3LNIi^qt^QpMmZ#9jTM=P_I;jN8TNGycL?Bu9%Jz;7x63$B4+H`EL-AS@Ah z=DHT|Rpsqkm!%Ge7LrmB*YY8Fpd5C)!J{Lnlqrl|SFj#8E~CC2iHQe5ml|A$ONYWW zC)eTONW++-^*Kd`ZV6n$t}=ln%t@5NSXU7}W=|JbJc?*GUMrs>@maki7zFAtlo+0? z(nh~7hTRk&Bb*WDYOYAmVK;TM{L)DE7hTyF14OYIiAw}PiHTd`*GIDcD!tsSi`sC7 z;AY2R_f}j>GkVj)uN;(SjHH+tmS~CzsVGR?3bJ~|bzz2cjEth+=}k8xqD5Sfo8ajp zj^P=>80d)Xu?)z#xLJx_%t6&4U0@SYA4yK-`OyYkptgdp7JqELUO%H+WVISD*IGA> zon7*Qdw0S1$T|bh)h!TZIt0${aQ(ZC{H|9cUsOdTrXJVpU3WfQPye8wt8zJo!|pFz z!7eHrq1G@~#4NXS9tx4&6NlQC+oMPJ;EaXeymvaPpj8h?^oVR+hi2u`2BQtD!egwB zRWV)Ct4HxFnf2>iq6x`ZN6N}0GDh`m%sRRxhTIVie)L!b=1Im&3cFUYHuP! zJU!^Xt81y7JjdSmK3s1CjI=Wnw{S;b7`S~Wn)1Q}tB$V~K8wfjyNjuA@=CE~}th!;LKFu)9xgQ6a3a99&`oxnz9yb5mkSmHWxF^ocD zUi?-dy>)?v1JW%v8YI3BgN7DODZ7g_CdljYFyV;-1L4M6Bns-e6?7S+-po=TyK(gh zc>e(VReI5j{)mtwh9t=dY*#_)U8BDXH3HjJP`J?xJwMzs9_fz!UD&_lC8ASGtms|H zBf?UIufukgw5&5XB9c*sS96U3L`5_vWrt%J7)J2E>Txj&6?eH_AMM)wSAnz2gBR?7 z1bk$EV`Nz8apW7~u2I>O3a_gjIExTgvCGjp_f@gcGvO-aulfg9@Y?9n^$)JP4*K8m za#axe(B*#=#NY8UEC^H!)I458VBtzx8GW@G;KPV;W330zP3zdR@e!(0W~_R2<4l0) zFW|wQc{IiNkD6Ok^mQ}AfADSWQ-Yl^mGRjW#yh4>nH%||b3#VEV%W{VPZ)uh9fQ|vz@t4h#7B6~$KcU?^+@uy z#o)bXz@xQhf!7#=NAuRx@e_vl$gGROqmOM)hCRiX*8K$Dx1Gb|`x4xW@e@YiEd?LZ z#oS>s@Y+BVULt-1Z%z!}pWsG&b%YUkx5nVT47^KVBD_)f3A{hV#J3lT$)7TrN6jKE8Z!Rth3*~R6fb#Q@~7?WR~gEAZf zjPuc}Jtn`*drmJ$6yJ2tN9F3@k=Vxc*af^XWWkM)?_KZ_UCiw(fHxU5;bB=ZBHyCX z!|`51T~!QsVFX?>?2Y063GaD=2~WW{3iifu*FG05M=s7s@%S6$HsWOW zwJ~@veINOc=YuI=7I<{-%80iT>-b3Wh!J>n{($IW?s89uu4j@j8$W?Z=dX=;>w(wE z{m?_;?T^9R20U8NBfP1ckK+4(Q0R?#?*lIb_QD9fbKo<|*Jr?+24*4O>oItgiDwHi z&PT5UF?e4B?;hBbd^7M9c(jIVl&=tYi{UPekdMx~80EX`2l{$F;Zc4ScSL5s>q--0p9Cj;*U z_vG59%>bWK zzNQzW`l~eH*<$UMjdKzSy=9 ziLW~bZzJ#!<%kh@6Jzks81TMjz-x<%Zvc2ueZ&a7XJX=e33z$nBKfNDBReG~9v|Xo%vUbp9fX}Q0`GlT5M9h2mhaZTB~5yveJbQect`Lv;++B>eM4Os;v@4j z{ET=@_F%6R&-cr?8{s`06W?7qx<5EEBk)>c;_D1W6cV;8lR{*Z6(MfJb}9jCk8_*8K@c z!XWco@EP$g0Z)cK;jPDy+~}Rkpb<|4UMcK_5qLk1!TZvH*9c~T_fbr`od6z&E)gT} zo{S$J?m6)FN4TPK+6N(x^6k#k_c{tzf!7sNKF;K$-vpV35q!JAM|3fFa2$w^r=Nfw zxshJ}R}9`_6kfUmSr~!0DF*MggQy=dCMG>^!cXAs#`xJ7kBi0ncrX_4N8mHcmx4mx z2PVS%C;SB7rWm}Y68*c7U|~kcw=o9qZQyCp3*l|SPvFgn!P~e%chk|LG=1OCDBtp5 zMDx`@8}Pn}Nw+58jg${Q1D_GE!GO2bfH!IMaQ!_Cyh0%y=cCsfz-PqU2)wnhr}#dF zpNQ}0G4VYHydT0{7~&)IX-s_20k04Cg!eRl03e9eti!$$w&2!z&jR$S9rUA=7liG2)tj!;GF;-nh+M> zXE+}f1Dd}v#`ihkRg(ob0`I#qcpC?>=NNn>-*)_jeBVWVYQ(!(K63if_o zEs3dLmVggkvxpJ$or~!otOXycn1~U4zmMr39Q$Q-T;T_|h{vljc)NhNErJ%+Gkx=h z{1kJy)ML?cBc^sDcqT_oe9x2G8-UX!{lbGx1SAu*BqpUBJ62z&IbhehuZ5pJIA}DFa@B=L1Z2MDRWUpHaST zm6+!gLUBIwe<23%y+Q1$w&?NQWx!htA&q#u?i{&2uLqw|zL(#K#+T{^5#NO|crOEQ zGYQ0v5VbT0?-KB!8kQcNcnZ9%7`(i1j+`Fu7`(zaqxmIhz)Oh13jmM4T_}u@&lZDc zJ%MomPmkROJT#-j^mpuA`dN%vylLD|F?V?RWVC$jwH7LVur+9xmUKyYzes7G?zAr{E*HShtpT186d6!rPCZ!291Zc&mYT z3-?10f%oeeydeYLO9s3*5fNj21Hij!1iWAjUmy6KBk36H$y$sbnGE0wy}W{V5fAzcFYrc6-&e;B54Y_adigo{jPWQ&xGNDJr7ya8k$7~(;2i_rPv9;LVUT$~2Cox% zeXu9I{|`T*mqj3qdf8a5yMcunfmaTK=wjVkT6rp}=RVkx8|gg{gb}X^c-^oUhWN

      &E)mRl4T714Ho;71uV9+=bHP6BKM~BlrlS2Y zUFMH%iI}!e5lqff!7Putg8jfecB#*NHwk9hP@?Ku#x$vEgZsRA!=Q>Q0JSY!I*_Zl zKD485ayg^5fim{F79pu77Yv9hS}o2+Ce2T9naLnsGcD#qGtqS>Bbh5ibEO%%{-nVX z|HN0IjNjiiXgKXSm!ORAx(JQBpC;81ZI&=M-+J-)OTZ`Kqdl}Q4V&861Z?wdfm^z5AV-h;1%mz9Q&K>p zeD-xJ=k{#A-EfyPf{5mKGTg*|@#p)hM}TP`yB@WVY1n*p=y(J{Mvr^Vlb;UAhwwOx zJ^6TgQoiSbZN7FXcX%729_3fqi2c|oN6@Y`zdTJT-!5RAk8Lkr`EhJy^BuMLsIPpB zKt?{$7`X;ufne?!MyYb?y_P_a>nSk~%bOBFK;mCZz_5Y*h1Cslj4_FdC zAFzM@@N#E9;6}^`Z2O$%1IG71AJEMCfRrT62dvw&JUk)b@x+}FSQ|4Tutg^X5QKYp zxE}9oLg2u&Iw3I2H6dW;IpRzRn0bK6gaF@XfL6Q-ftdM#mw!BU>n-))+e(@E?~Jkc{QaGMfr^r`jWgaHcE+9m zR`oCC+rRhE-??k$Z~u7WZ#RDUaZcv3%=2%!eD#5MzW1%IEAF^|=fhn$j;KC0=euQ| zkB>|lb;m1D{G|Bor+$692yz-?FO0K=~-l65YiYLBy`QxMB@oc_iV%ZOJD|bG4^3IL> z@A|^#1I$7B8UA=%l(#}<*W$QZmKaam6J;20jmoagakVWqp14QKFy1Pa-EzmZe1-8` zzM_L+*mcTohAgEq>`)d4AxYZ(RSAE$6n}d7wIN!oSM-#9dO-rje&791RRpF8OxQ_`n=Jbd<>=bkd@sdZ0}nq4z|)XC?Z zGw8WVTh?y)~nh#|`xJAXNN>D86_LoXQp zUgmcRCu`GQN~Um%!Aj6T24 zv0qU9{lN1CmjLtGJo5B4?~;ZE5feVH?F?T33-c}*>L${5&$~=19MEJ*JT*5JQ+3bH z#JRQaQj0V1LX8CTE+%rK8~ow957+&D8XuWoiOjo@EaIPd-i3Pq$h-^V_cQNelHjud z`iw(l-UUGeemDTSiRWFMz|UviWf2bCFJj*1Oc;^DZ2x zsAzuO^DdXbsH4KiE}eSJzkA*)(Y(ugiQ~tfQjT_|bU^biK-C~tc%;dVV_P;+HD!iUk*#mHaI;|18lkAN=h3JlaQ5J5+Bb{OtKW^7*ha zoc^@Ww5yi3NTb4&^V(|o5WRz)|L{67Q>K~c>wN=wZeBC=KfGN@34QiP#kqZVo0<(j z6|FPwxoKVgcWYDU!?uC6DOqqJJW1SNo64V-=PW`rfHqYw1*vVyc^4xk8S{K&dV3>} zaKZgRZ*O|*RhS#(qd<`mTvIt=$0A`M3Ikr#d&;JTA2A7&(f6`>f`lF_Z3n+o!GAn z*;>xGjzY~VTU!$h{u64uu6g<~*-2=?X}G>uBu2!&mibHRKg=G%-&Bj86qZL8$tHHpnvDmvI1AqV9b*lfPt79Z1B`)&fZ`7VJwo_!l#eEg=a z+J|9en6KHz*9bTBprZEG!^5`kh{eZzs(nT9$1i-(^DhYNzVwFEDkiCYT0$`76*#0P*7uDnX@>W-5u9vnzkKtNx?9(PqohIiKXQ_y2!Oz+D0rGXo_UnuJP=>H?vnnhKA4RF@ak&Z-Jlgen3RRl)gT zf4u3KA1W%ZwLSRUlFN(pWwuvQpe7WostDB<%`6Ypgd-Q1RhI^Wp^B=KK&W_TaeV(- zGvoW$2IKlyCD5N&8ZkU_}|j%Ob6JPGEj0Ft50@sB(57R9!PChBHc`q;vpENNyl%LDd(1wHS-~RdOsEpqf)!eI`o2&_MO#C0jiwR9zIT34jEpUmK__v5%!-uqqg;sSO4U zD7mnrBGRW-R)xadU7)fySXCVf11l3lUlyvlu)4Y`80q=gYvhOO@~4K6Sn-*hAMrul z;^6%1+Nw}-c^Sy#h0xkyWl?!3SUEc!UK1#v6{-!?L}Jv`l*0~gfnY8A<(itJ*;Zf5 zVAGcuS5;O9ifhZNDnn(F-Xwl-sJN=4x+ppg#IJ=(=$V3LMdf7|7m+Gr7m^87nmmPS zO9PdmilRu%XChkm2&h56*uez@(J9Oc1gb;T0R$E!D`m6Fii>IkQ7Hrim4Vq+wPmqs zR}{?)%?cLHu0Uai(AmzeEscs<9jroOqT+ogyVsHnXg}taiRRCB@T< zI#A4cE8g+OauC|s2mze)Dgr^&xBGzTGnz@K&!{Y#KvA%KeyF6VwkT9nc5!r}Iz_`a z5|y)}^6Kd7HLa+qvbHP~4B)_s91P($R2nERuL{+nfy{~%>a_F_4;C<7SQBkU4H_=n zCVI>{0qdMhax^)RhAN9H0->_X61EGw?IFxWofRmmy)bCC{drUKrt>((A%Xs{CgxD( z@FUVni)t$KrLS;#UKA{=#YiMvJTr@G0@Dg?k1~9Hxx(@&hNeO4zCS{N`fY_PzNpLV?g*&~Z?PL1Yh{o)wT$j!%nPn-LGA}Oc%PVYa%^7#jMOK`Ok|@Vi z%T-lohhf}SUR6BD3a<`S#8fx^+_jCqK9Yg(=_JZ4HcD}gZHgI5MzP==G1>OeakWK@ zn$Mq-7e!;8Hp1;HSO%j@Fso_N@!S+)GK2FdCtqEN_P|&@%7ZuGqdYitw>)rE7Ng19 zZGlH>aaGlvGPkF5NV{W~m$`guf^{w*bV-(v9_A4%%<+wm#8NU|#pq$2lfFy0I9Q$_ zpeC3gAc#&SZUXK)cTxtA27Dnix*pFK>tZh6obIU-o`cB^FYdnCk{sh6;u&u#aK2-m zxOxAK@7YnjGWo-u&e?LV$;*in2UYGZWiK)vu7h;{4(zwdQdy<9+$(#<%`6KG^ zz8P&HuE0K1@B-{PWkUbUu{U#mz&8N<#Q#3*vjy|rtsKEGU_VhX=Z-kvM4og^_;CJ( zm~)qfg6n{12<`y(3%(V&MDS05O9lT1xLokZz}13BApf<3rvuLud@(TR?3nI90WT1I zCvc2GV}O1;2(+qDRA!+TmZaV@GRgxg86O6 zM+L6{-Y@uO;3ow0zWPDIj{_eP{0HD?1oIyF^McO+eo^pj;Fkn10e)5RM&KiY?*)ES z@B!d=1^*uSs9?U+^P%7`<8b>#a24<|!5e@%wa0Sk0p>k&;={m$1%Cp}wn+aWgVFv4 zj|a{aTmn2o@FL*Rg0BYl3BDINTky|;a|H8SY7+&&2b?E33D1fY2tFCOP;d_L48hZZ z{esJZO9X!nnD02!<`&>`!E1my=THBefNKSB1LiY$^nU>O62VUZFA)4ZaHHTq052AN z6u4DzFL1lyFQN146g&oamEcLhYXlbouN6EOc)j2daF^hvz#9dx1HMu4jlj1G-Uhr$ z@Q;Bv3*HC3Mer|yw+nt5c!%Kkfqx`;&~a%0f=>Y6EqEO89>Imcj|wgY-Y<9_@DqYt zfDZ~@1AIvE4ZzO`-VXe{;61=E3O)e*lHmUUepT@6z()js4E(0x!RcuKf=>ZHD)>y` z4+YNz{zULaz{do)0CTdP_5M%5DT2QZJXrAefYSv(2+Z#SQU8~~Jcke;0cL+n{5Rmy zf=|RlPCmgC`M{I=Sr2ooP98CAZmREGi8bv#xN&CIB68nub1fv))LL)o!V9(PeY=Lm zO%0cZgsz|aZ_&ESpr(9&ci)^f$I+FCWfg9CJr{PN>;!Yq4c(WK0@>>h-L;X`_;>4} z=)JRhro)Y;`{YKjH z&#{k++K1>-eCZf`v?BAgkKMD{_c$>5CS#*)0#|@aA`IikINax9qr8lPPoo3Pzv`U{ q7qLna4Y5SSc%Re0Z^e3}Xws_3XQZv{c}l>y7Jdw8T{0g`;{O3a-+&YV diff --git a/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedtls.a b/esp-mbedtls-sys/libs/xtensa-esp32-none-elf/libmbedtls.a index a972e52d28ecd59cc2c06ae25ab28c07f799221e..78dd0b591e4075e3284ba446a2802219f5299111 100644 GIT binary patch literal 446692 zcmeFa4}4VBnKyoCGWpA>NerVxSSJV=ls`!b5Y*ZP2nIovKO(rg!;qPfNJ3%~1X|q< zQ-ulD7E)RgYr7B;0~M>RtFhK?a4C&l*;QV5%l56i;?H+$yY0T<+G<;Me&6r8&zZUR z&P+nP`}y?!eSYtOllwjAdCqg5^PE5ToO93ITXI9Ny}t3ryqSKxE3*VmZ2jx^&#Rg% zEbHV`pnstM&`R8B>AjuMaF;8x2z9` zI-5HJq44_68v-5S&Om2ld$^;qwK-(iX>ILIn>qt69UD@{w}(4Z#;@PpkTSldttn-E zxV|lAe0_UL`3-?^eW)>>qNS}P&>jwk!tH^kO-+dumiUJDa5xozLpYo$v4wwwrC^rm z`qq|~)ETsg>zjj3E%7`$I+_FZ!TQFqU8O{{HHSnjsv?Dm_HawqiI8+ZDSzVJhD<`bMjcM64=}k z?m#QEWtBv4>)2>x*wPMz2I`xeP#=NDaC393ja=W_y0Ix$gD~S&H*9JNw{CW{0h63m zlOhhuHYa+Isw6Xk(k7JxXqEML#aTt6z=rnL&253s)&MHimQIY7lGGVQ8%j#i*52CL zTHo3nxDU;&sdbZ$fg?{_dqbdeTU&~xtmp97w$^qGN?@?1Wa+e->?*1<1v+6qdweKd z-@dJ_GhiK&l#OTuj2iW=?e-R~#>Mthe_ zp}A>8Bg)nu+|*$mOsLi7wh+u2Knn=8wPN6f@oW{*(7d^$k>oT&liG;cB2yHT-NuZj zv7rho$(9ui)(~dj#yDUZJE;hRnN-oy7g8J2q^523Y^v+Gag+((2Q6)7 zG`oEp4B@;BvGg`pRT^7NeRC^R-_+XK)UeG)P<^wZwY?>|?Q`^L+O)oPGfW?6vn3`6 z$}$p*s+m;HQfgevW7e%rI4J?M?o`Fwh@DOK8)LrOc&psnXulMk^}PFHw%gFuoWi_n zJOf9H{DZt_HreM~94^o^J2oX&$>wZIMW+Pv=ZutmoY9)sS?9C>Ep0A7;{%D!es&&9McTMzzJd|1ts`is@QxH} zM2}*>TJNX>rCFR>-?=qa+Lk~ICNn8kqbfC*OR!U8s`esFDSKt8RP~$N?@N_Jt;+2D zs-4JHSD$CXc9DGT%R1J%1)WTbBj-{+|vY6}Wk$KQ7QRB(?G^S^x=c+~4(QUzP z&8?0_hh{?$7=_E6;yUjYOrPo=rfa4n=-3z3gd|N8(*$%8`+iZJWHT;CdEDC4H}?c3 z>BiTI4jD*NEos(<7OXgvbY;`V7@9OEl=x7%A&BOb+^Uf#DH9I3YA3VJzU5_!Pud7H z_Yb8#HrXdVEnISoNDlHgn=!&nX0q9c=2}$^^8s#wIo3oLvMm{#fXQx3#$LJX)Hwu@ z5%;=)nL`tX9y39TyvS;mGa{oYkBgTP+2XCpTo>23H?`S&ytz{#H^8LL9PHjV-52JZ z%U-V>Wa@*>^?E32u@94&Sl}s!N{T%lbNsiNkJEjunbmGATJyb|!;X85>~f&zH8nKV zJ6FgufblMsiY&VyX{b`ApkhB6TR1kw6875C9&E$LE1NFoa;axMPIj9tvkc~bnB#6^ zYM7G5R$%V7>Nzg$hBxtSa7(!06HPGNaWBFV%d2CIbBwbRzxW{OJPYt0PV z$vQ9?gf?@Qh6Q~%psbZ5Pnl08tmIrdNfEH^z8ShD_(sZ~oAl)VeQYF2taUI_770bt zwRcl-vwt>)FsEwj#3RcH#9T)||x zt#Ou{t~^-E)nkJ+V7YTib5Bty^G1akY8dz65Jj5XohevT$W6f|!*H7WqF6{hg44GN zwGL!QX$j)F*@cKqUmUHYzU!rYJYp(gDtZBoiMldx*XcC`=LpYBSaI_7Pfd{mSRn=) z+f$AFYRjx`^Lh+|fvsCZI7^^BC3;<6;=sg=`Wdb3@0ppm2}SN`<zJ?XlR@oC!EZsNJ0Hp7!8_zDQQo?W@X)Mt$#Pf+w0Yw{&&!t?viF5b4j~wLLOy zyfgfZcY={ff3*so9)A0DaC`f4&#``rJeqwf>+KvPa^TahT?@RqyQ3?2?ere$uQPh; zTv2y#bfEX;j8mSsGJl!lr#4dbmW$jLFRg5N7h2-Z@~YwQwxn4vjmJ=+evm9_TX#ld;oee=g6=Z}hz z=RlFlvv>Qx0r#R?jrAputvJ509oZU2ISQHia`rE?-p-JW2e%Ig&)oaVOk~`De3mz} zxEP6F&g?FMYQC)espVsK>@kep(faO!@zL%*-j7hUzM7WIdCR+>?V6mwy5HjqXH*vu2Ab4`1%=lHB^`XY;wV*KsVXM6YDafLhU zC$Zi=UETSpWeO*#y7&l9HNr;pD9 zPc*}#GL2$wWR@yGd-D~tu?=U!;#)IOpKNTm_8-4oRq=}@P#%`-E?-;o78@1u@}q9E z0j(+cW#%W@%1U56nmJhVR#vneTwnaqWI0pw%S=U1lfBYp&H>N1nziMNOXe;2oxTXV zL@(;C@y)x4t>26MVE*N70%gp6P0i6vWbi=V{Nt0@1P#^TJulwNX4t(QB(ot7E*~yA zQ~pa2itc+dXKKNio%eU|uFCJKukpHzqus&#PqgokMT1>m$glod{y^rVkM`yoIn}$n z_OzYJj~t(L%|P^C{~#Melrpc6O#98wdD(}2^QPxyjWJdnpS0_V$bnBR9MJ-4C1$=f zxi8D*b+4(Z_}h=hH0*dcR$8z+$2H;H4LOmTDUq7V({P>Sty&LJhkEbrdNH1tP5-R) zRcEQi^l;AE{HA-?o?m?SmTX_77`Ck{_IZk7*}?J3vU3OASS9tV0JkM)%kl`yWL=RmCQID^l22Y;C}{y!oIG5oX-8%MKY?V2<9{%m{nK)eE8 z&KN#>=DZqW+K*R*rF^(#@gDT40$n?_c0#%~?J@Z`^9I+-_X+D#}OQfHmw&=lGK zTHT&q2hp})X4~=Ij8Sl)HyS;Q5khH+$Q`AIN{+Gho@g}3SCtzNu6b|l(wxYdoL$@d zhmGPfXcKRsS+JzuoTb0%`RANR_e2&O(ab5Of6{RI{CKkHN2QYNonZrcXJuJ(aM0LW zSR}|?n!tZTgUHM+x?u2{Fl&g!UTsCI)58Usc>_iDqx={Xy zcl{c0dn~rYjnF}a%zh*N7}-MNCR`6q|`rPIr{PA;q5IyKJ-VL68f zp8l&RcUbNe?K-v!fRg*)21`e1`ztL#gq#h>vZ(HJ*JxTIR?l5p7c5`#ck0T=fMy!Ow zoAQj>1qQKBL@U+Su9I)^Xj;nH!oq z8#k|?fkoNOuud|wx%s}9>6o|P6Rz)^0S-S%)6JBDin5B?WmOgPrY3c|pScrJ9^-uc ze#+Pk{QGC2dk}URS0$JgJ=+l;;|SYtoEgTY4*F$|@OVe~N=Mk4|0H8j^g~S;g+`{a z%~GCx#N|o2Q_*vc&pGJ5lEY#}zsOi8VP2R%DEu2-lwV-f<4QMCg|9HqnnB|pTnmk{ z#w9{$G}HfvKpevsvZ4=LB1r$N@cuL63ylfJ(?Y)<@r6c-qPoP)83+|w%A?~|U0rMn zqQ#3C0XH9>Sb~P;&q2J)OAf=}#YIKnm`zcp$?p@)c(x+OGaY{Lp|B*6%TzibvKVwF zUt}uzg@}YJf@i+7alKqH%gHp1r@nr{b-3ckEk;om{=k*N6EmM#f|<`9f|*aFU}k-v zVCK^!nE9U-%sh)>Ys&NkFA+>0I&CXmuBC`eDwi-bKkB~%SK=b+CKCly#$>^iQ7)J| zvmKJ3>F8|vvJ&7_zF=Mh%rv^bbiS&d84u!STqnR6F%jG~@Wj;N2Ein;-7%i>zAl*Z zUKY%vWz#0$NoSKS;Grz7kJ1f)x)7&ylkU#+E>;Abs&{D*s@|_K$<%*SX6x76bd+YCNOGiJ1hn}Z6@NcAHQ{+PmK zX~r@2_F!{*F86BK7%H@WYqWw_=u|+2{(vwNcV4MPa4BfhrBApN%sdz$oqmr-U*95 z+~VW%Tn>2)L1Wpp)B1gkLRj^CUB*m~KfDcU{r&}f*77a|ty2pVJ_b1tvdVkUA`dVw z@5{hec|!w+j(gc{Iu-#8E%acSxiCn&GYTUPpK_ymngN21HopO@h2K#8KWw zLZiGj4*PMg!F;vT@>V+PV-@7B0~6(OoF^aU&34GEhCI$uwbSy-9P*xnyscoOyaISF z?+mcDyaPzb`<`}M-v2-ZakUVp!DyUEP#))+THap+TjhNh^6o*Lc3R#uh_K3Qw8-PF zUCX-@!mRR2(b#z})=ta29ZXhv2O+NxOw^Cl4=r!5LtZuHaZazDmRI4B_Y25d1t!Yl zR7K011I*;Q|As(dpVLmu;|N1sEre=R<^V9|ajv4}(Uw+ukAc9xpq-Y-X}(q7dlq@T z|7&?qAgxv2Rw$aPe)ogPDsML$v94dP#n1>TQNO5zAuwRx6^!I!Cl2S zVBG)Fq5>oG^rt7W|Fyz5>~4(s?sHe)SHGtH&H>2AE-Pg}lDXkIciWDk?#SmJ>Tcig zTyEs)PZnih_o+JqU(r2rap64oboCqo`S!Yf+uQ>yq7}Y7-Gh-A1}AoXeQ55B*}d&u zeM58mmhF19&*K|w%*(tknw19yPUacjG0zMR4HQ0eWN7Yp#`u2a`c7Y;=QDXbTn2&S z-Svg;3UBTsxqb7Qjqm5i{;v#0p8j~z?_!asf4Atj`1|q6k7BS9@<+k88c}HFbx$~V z|NC*1C=1RB8opW7JY$X9_kGuUh0%$1^BY(A8eF{*Us3M9!OOZ14|y;7M$XAhD&)aU9|eO3~%w!OZlspWDKr<^7@&tx*mO=^^`SS{L_qGSsXg5tE_r($;W+*&!v0eXC9|$7k*d-7NX>eo|=U z#``MS$p00g->K*q8IO^q3m(FFfP$?II-=~ zSmX6z2ObwEGjLbK>-`#rT^uyvIR0rKj+0tG*WBETp`+ebLQu>Jw*lF4}C17$~HE4nML5 z)IrcubF^@!E1!Br!03Y1iv;2?BA8L1v{YeLUWgk+`?NGIqYRD5y3eSauWCmSC`~f$ z+Jt*UOk?F^d(=+j>kvU)Erk70g7##Q zCN)sbsvqZPS_YG9d;^$>s~HJ5XpzT$N*eY16NkJth?8w5poF|D9P&c~Tv0brdQvcJ(WUpmb< z1Yi~M36Uh|$*^|Nm=Owo_(* zaLeL)+1aj^B2GJ9Z@kj$`usnwT`h!e7t*fOK|H>x=mN*9S##&efHnGfRVDLcJziY} zi*+q`am{u^Y4=2|hPn%}%E78lTNmrOpmF-RI%1=a3ShCc`p0+(GdwWZ%QY2`Q%ui8 zf-Z!Z3bMAkOJXtKPFE0zBzErHJLYHx4sm$i&N6)W7+YUhz3@VF{I~2cbH*9;?5_1 z-f=gKfmCSsK%Vcz?A1QkHup&nRP$}gj=s?CMloO5_Poiz&o^i^z5wo{Tx&PI;LSRH zJO}v<6yW$s7BZNg2jb42xq~I%aoY_8OpoOG2He9X;2S9DcDSBcS3v*SFXS3Iq2CE zUZChj#&;e0Pm?e$Rfs2~_X+=G6`qiGjn4a~OZNFVMiJ&Ou2Ztu zABV?hqsh<36RFjYOlN4R`nkE2K9YpQ6Y}&@5X!6Ce%- zwBTv_h!b(k4oX53W$eJ`!tJg2HB4Hg+qtya@RpNK_1+|V@-#ZjYYpx7szoIfO7ZqX z{VQkNZ;aFJ9oIMQ2LF=;KN9O`!!HUfoeEo{GE#*fRITkDN@rvHVVAgq%y)>-GG zOVLq(ZW%xIP`QMC4W9j&F5O)8e$bqJs_&^((hq?H4!$act#=-shWi%8)$nu=BEYUa z5uWk%4D;-fHQ%L(<2axl`RLqWBCcitZZ`rPW+;zk)AIfe*eY)o!n}WJr{$eRgjL>v zMIQ6l@}>Y=<;hyaVu7d2b^89=vv1-eZWc%A1Cpl@7EmiegS#9K6v}m^0qqU@fiW`{ zyC>#F@4PW&V)L(lZd*QQUWFMm`dat(dB_0H9D7S~E>@SqjL(ocp&M7Mcd#<*!P0iE z$D4Z~7JD`pJ8KxnW3g9W%g0gwPsTjpZMo>DKJSVjjAgd?c2v?Gge&#zL&Y+@_omMoXqcC)RMFMMXZ|>D@DqsgYJ*G_dxqs^AE&g$YkfZ zF~?rbAISa2nAO)niO8!Tlv;ma2L21kr!>AI1%JOgXS-TT`+jId$8|+&dLAFzU7A1P zoL*>xC*sZ<6Ybd_+a1mK_U)XP3ypS1_cLeBWa z@M)gk3D4qvRT<36TR7ny>z4L$!F%8{;RjwbjKlCp;HM2?UlIN=b;U~eD!f!Ni zwhPxHcs8MLecNd<^~@20X5x!F4u#1@JZSm%z_}p8}r=e*pgT@c3^$2>%GcHu!G%&F}&E zdidq=OW<#X{|r3ub&uhC1Fl@dmjh3QzZiZx{A73!{C@b)!GFgvj2ifdfw#g(;XC2~ z41PWQZSXh4FN41U{%P3js9~<(zKZKt5Z4Fa3f~0(lwlap!|#RfLAV!w6MQ55w~+R* zVHi&Ue;e0F;J*y~Rrtg38{xz70|w406crW|_{5|j?_$>H*`0L@XgP#Zg z*M?y{2R|MDdU!Xy3x3QHuJA7c55muYe-{23_-XKTdR)lQgMBhQ8SDde7w4K`_6NEt z5@z3!u$%mPT)ai->^F3`#3@aAu|{KTpEh5@!FQ%gi}zHx+0+usgPm#B+N08u1NCZ zm`mrAFvm)|3Bu2@neIv{@5MtZ2>o+a`7e=hwuGl@dag<5xJ-Akgs&M=K_ffQq*q8d zU&0)l>57D(_X0Yf&^dn7O%OWo7j#z&-7}AY9aT`b`# zLkxjG&!o>7QbE+W8Rk8Mu1NSd52+yZGwD$YPY`;ygs&9(fXR;h%<=EAg!A*v@Y52` z6#BO%oGtW+H9gbhe?-$I%zF-9sg^&af()znaZtijgg%f6D?0B#bVWk{>W~Ved}e-M zlJEqfe_6s;3jK)5j`Eq~_qQaRpJ#@TNjOvJeu9Qmzinu?=gd@KQsK~kQq^` z6vDDj;2faQ3)4G`mamaC+VLuOm}gvdA~a<;ru)^%sB^LrqEw7gJ`cNeXoQwGtKZ< zHC@8JLuN#gr01N5&L`=6hEx#!%S`_j312DnTrl`!YubT`WVbLo%@BE5M(zE{F? zrM}zZbhEwOE#YdJ4=j%JoAZ^sBz&XHAL`=iO*-exbk#E6EE!Tkl+PTWINznaQO2j6 zhg1;yne>$su9o{6gC3D1^rOFX^VpEktPo8jhodNbT0;n~vP42Rpi zY2zlmO4(SobY=PUS<`E3S5B{(J!kq&3vQXdvaV)URi%|uUQwkfU~*Cxm}$~bswmGw zTToYn{}pA^Z@YEr+VWXtvn}-L{8@SJ^c5>>rr)u6Ro(Op;6;iH;=XXXx2;@q!MR@; zFY~@IPL}+_I894gO3xZ(JuR5OfEHyXi8&oitmaXfERv+|QVUCN8L9a!nM&JA&u4Fg z>G{y^Mkys4W>tC?RmPEI2tzs<3u;J+c_+SQre6tLl-+WlSAcXCQDw{fje2D5z7@fq{Y;! z6^nC@nsJ;nh3W0(h;veADm}rjCzxq#z`jXi*bN*_DYiS=3D`Yn+La(iuF?l)~z~*~RrrQ*%i? z7b?e5gDK@WYB7n&Vj^XqBnFFlMqrTINu4@gt4U<3z|?|;Xqo-QEg3htMSUomEGN!r zDTc0Pn>KMqN_5n8YQ_|`gsz;bz8&?Hf-8k~DYz_!RV7WqViA;z#a7CZ)rzxPL~6_N zCLXVgG_5*`CxyL|cq}CZyDC8v&xPtE#T!*fGDE!Rqp1^T98IS4jkVP7 zP|XUgy)THt(fgTILP8o{>1xazNiIk;r?fPxrD98|o87c& z%wfHW(zeVrr8E@8*2Yt`2D7ZG7)7EUkxQ}Q`% z$h%i^BXBh0)JzV|l9^Jdm6|DqPRVT~g-*##DRiFXckx4gf!6d={_o5qT=rjDh?*D}nAk5Nb$-X{9E(4SJ_Yt;KN8TCva z>DLO?yo~-nkV_o=mpa0iIl|)|;VT{Cs~q7{M|i3ue2pXQ)PK5zKEn~7=?Iq@T@rH# zu6&=#zlr^dRXA6jBNG;NM)e2{4M$B1@#~t+!hf|27Z^86eVO#J#sr}=O+I{%r1t|C z;>`?8*%;wU;Q3D4f0yt?6)rJOi99nr+2DH?=uG{XE9z0Ig{=CwP&vc}q?-Ba-#<|u z{mzt&1v4F48P9Y@g1xx1Mj21tCkQ5eg<$g2Y5AGJ`gc@HRyNL=DUJk>((?*463sCF z{?v;EJNZ>vq^T+Sxn|lipHR{#_JF z`dy*QRum@AQ>Wlx z;QF9oAKJ!V!E7f71vdgeC%6argkb&-;7!42f!`IJh5G(L@C;zS*MK^&1}+l(=fIN$ z^EZo?f`0(KQ1H)zR|y`2h8Ge%1GrQ0p8`K9I10R1@LvNT6#NeGbAoZ~&p08t6!=ZS z%Yfe%+zI@F;75Ty(1ZF90kbU=|2yy`!9FyqO2IY23k5d=uM)f)I3)Nv;7-A3fFBh6 zG4Ni&6VQ+j3ceBeIl+Gld_wT&fZr6n5BOcd&jWuT_+NoNC_i=1L0{tUB#CDLPZGQe zxKi)~zzYQ*0$wHfBydRZzX5j&&O)PnQ1BGsy@D429~8U}_&LGbfKLeC3;d?wqrmS9 z9tQqE@GpTqur+lqME~UbmxwEYCkb8+Tq*eTzzYTM2VN!k72uHIcY#^Ql!Ido>UT}b zCct|oekJfh!CQf!6WkAcLhx(AZwmf3@VkQj=>H!GUI^?#y;45kpUB^x5`P(ZlHlio zD+Rv=yil+Q1L!KjWxyf9cL8?_jsia@_&MOcg5Lx_DEI^5=L8pFtT`dL68KHQ%Yok& zyb1UN!8?KZyB6x)56pLP6TbvJN$@`b^EV@m{~ho`!G4Tis|42qhXmgP+$s1=zz+&O z2E14BKLH;U{9EAX1dqqP>V)7MfZr6n7WiGkTY*0i{8eBN+ADQ?4w&~A;;3)8$f}a9@ zSMck=9|%4V>_H!(4uyr#U-0$7lLUu=D+NCSyioA-z^erR2skA8Bj8TKS3vHAg0BPK zD>wjrQ1FAm&j~&Zd_wTw1HUQwe*?cOIKK$`3oZxtpubW76~MgT5^n{bB>0=a?9Yrp z0lZM~&w*D7F2F=JB)AH=Q*Z$ILBTtK_X<7=d{FS4z|RT(1o(vDDY)0ZDfm|4cLi?+ z{y^}4U=R8>bsGle@1Kd!0rP#b#Ft}|Qz`f}zzYSh2VNz3CvZscQ^1{q-vEA4@UMaQ z3Lbws^cP$WjN^>XxA5>y%83uinZI;azhsuTCR@M1jF0M)0pCyTu>KNT{}7hHXXWR) zt>0|cjH!N0n}XM_jU{hp+E;`kl4)v6XlnBUj6rAShaA8oZJ;rH{*?-h@b$B2o{ zH)zjT+OeexU*4O6*J?M16P>8Qt&IW>FX&~9%hO^NIjL*{?@?t;SfID zCbm=WizQ3%Cut*pf7UPVe$j#h5fewsofWSE{iNwCwvBg#$7 zoFvw&f$A$^y!lXdjZ~vTYVJ{MI8`$B1N%fr#RvM5-uN^l@pAae8I@4$4|-QTUkrk& zX595xVs4B$?XV0`j#qk2E0hD9&0)Hy+!p+G@?rRnJI&XQ7~*Q7d~}WZZZgWHKBQsV zW-NoZ%3F%?9q`&|d5aNYl~;N#?mdX3JQhdGdyDgGgmpO%0^?R4cUs;V@LA>E4|&vw z@-Q`t%RAjXpx60ZCt-*M|nR6jdsya%iG{6@9P$Mn0m(LRXgNyf9Gl~O!yeQ z-XZTj$eV6kw*FWS(i;-6!NqTkP{euR(Y!|^0;fM<^2z&$NzYJJd8jI1&PzL{~qyHdFw3l zxV5C^J?YSozk}B@C{p8ohknf#dE7gKno> zG5DBHJL*T5kHMAk6)FT-;N#x8cI2b~COrG0mUlVQaZg=4EpI9!C{L5f$Gvv#G~Xmd z5LXM~F_hPX4A?&~G{o(9r9;1A3_dlM8xr%P*Wawr`Fcz7n=r&{r}I_&O^DQdm0RLgE+r)`cN!u84bgLITrF-E zZ}pu)VxqFCz3GiXIspcrki- zn)hwKVAA)_$KLTumx<8jWRc;!+3-O;Rp!RWxT@8_Fh+g&2I`KW<~JQSEl59^ZJ9Atth!XI&Ej=;sV-! z@nVZ+9F_lNT#97+3K5PmePF9;*uTpP`b zb!yff36A|J$9Jnc^2D3F)<(t}kzjE*wPM0cRi4oxlm&%_&pBOE(0l%- z7u`GlIab{_^el$mHTnByyHEaOEV9rTztH!OMxm-1kJ@l3u*z@+{f_?6W-*w`f5Q}w_jmb^la}N z2y~yl_DD}j(UR^px!=fHJ@!NN#5!ZR=A_p!O?BWw$iF*JRnXDQ=y?dw+C$;PH7N0- zFU2DJW09L(-W-U(_DFPj*RG-7J-d7JclXxxEXC_fy9Nq&Kk8Q@SJ(L(@AbEMkF#BT zS*Z<`s~;MQ1ji4bzvH{^lb?&-_Am{(V{6RonP2OQlw2CAh20AyXT~hfx%R93z;kbG zx5?8QLmOOj`|0D&+i3yaC)$4;DH*>@MXNC;bC_SjMQ3^E3<(cKf<+M9dz|0IUX!6y zA1f)+eCz)Sd>C!EdGFbOI3Hi^80Yd{(O*)u>j+x%$|-heb1cvm0l*;^DnUcDyYSL;G6+1jbbO_52!7}I zU5PYiiWNVwq(CEwwq4yrD~3Py{mP>o&-{|H=mv@Qvk*P$Sn$#kcBW&hDo?pp3tSN_ zUh6vD|D1|DR&pt#J!U^EL8BcTJbk^{ahawGCs{WwM8Xx2xP(wIwA3fwk(I0;e z@>Oaz&hza=U`1p7Cp$tmJYfN(!^O{aacFwJi0zF|O}?(Vg{H3^xJ{@fZw# z%r7;IFnsjcc{`u8-Pl@K1CDGA&@Fl1$*2O4(X@PR&EfLHCDEGhg6MKJa>6dk?3CvI zBpYh4#p{ur;>M0>q~E{y4UNTxWF}WfiZDG7FfC-QzOiR?CYQE`cD2cgEhw%c>eS!U5}`N zZh^b&7X`b&sYaazIbDwyJkw|5%&u?f0dPUa*B^%*OhNFyo=j%SJGEJRy*c~){C(Ef zTqVk+ODkoA?eLba%&0q3I?Y#ikvV4W?>ehKj;%!EK0fz3ch(F81^IQO`{cEF0d;Xs zWC4cE?vls?V_x~jj;S?Dz(9`g&Wt|Sk~JlmAmJ5RZq&w>$_LsW92)<%eN~&+-(*C- z|M6hX_$^2A6>|)o_iS16&_L$hIjgVxWU&01okPO~-QLLXZ*kw*J&?bDpr(I`rz={p zKdMIjC7DqWKbE0+i5nD*J-inz$tcc){ZV`bO4)qH0KFv`>v~<*_ll|Fqi(wn#Nf0s zy6TC37Y`#~#hMNC**Ry82Qn8gzuO&|jN#XqUpjX6LVW6ce(6;(M@@H@81ScO&3={H zT@JNij_C5agYF&eMj7sEjqXKlhOe`*sU(7#+t$LV1>P(Aj_=-=-}kI{DlZ2%c6ghh z;Ni30>kjWB*xtYYw}MqYJS*B)=79|Pz|d~vrj)6Q|O(i*VhYgM~;K~^*$)x59D<<0QV$}cUC zKI|1oeDcL(ne_g!}<*ampthX8NR&PQF|%gZ?Mdp?sDUB0DiE523#d}%up zMQ(DjR&FvN-^}lmJVpoe_4MUH@maK2j+4D_T-$fjZA6cEeIegh_q)$z^}g|FN2JJg z?ZVYt&*Qy*(=&GbQw;rR!nuZ~apoX$;40V_cXBc8gma|@6VAPy>pip{O%i>~i2U7e zQ5b1K3p~gE?&IBGH#-~KjI^c&nO$Gh?Po#8i|1c-E%{HGFwE3-hk};v9O^CU&P6d) z$48|nTGxbgGjHz*w|C$>>Gh4lVDrq5_Ik(X)2GX$6n;uw14 zv6CPA*wmrEk|d88m<_(R8ffeYG=|y(ovi`9S-*Z`$L1Dea~nQY8cu|7_)ID#Rv^pP z7V~5G{te+x;r1XO%K00DP0isDK3E?{7+;r{m(Ti}LYh?9+R@1;4*r&=j+P)E<@h@r z!*RaOruvQH&T0NoQwJaL#N+YF`pqqE%wmRNwZ=3*iWb+zNMz^Ws&8%G*c5g|cD8l~ zoBjCAZ+KG&m2VDj+R)i}oqzJ@HrqH8EFHG^X@1zyZ`t-o(z42})BKY=3{Y79+FNd0 zwKlM#c3JIBx2{@Tvug3J%L0p+ExI+Za>2^g4q+QwJDIfz^mlAV)u+hNG;8~P;dZ~W zV_bjao`yZx+_ouE2uHS}Y2pd&hW6IYZ5>wFXS(s+%eTZ z{YDM{DBq;{EcR=(OLdO*A(u&g9v3%H=SlcI6)sTkz$3>+*yC~Ii%}i2QT16x=M#v8 zOFqZyq>o8317)bwfQhIK^)*;)xF8Ww{M=zrxD4ADtSIj?<59g)2sZ9R9hdSj6~kSY z%`1ivIKp3%@@alPr_ql5S3ANM@k+kSk^U`5_zFju`;6LA{y$p;GR$wfYR7PfL*Ip( zh%4!J4*hThDDFr}eG-&au$l0Po_)CtNi=UN-Uf7_Y+HF=pvqgKX4DiyZ%H$ zBT9Uwi616LzK4na7+dox`$Jlu2euE`3jcWYAqjc6m^Wjyd#fQN{um^>#Wz6IA|VtEKiJ;?tEuCEi9 z;t$-L@QnWnuG~W}g8k?)@+s`WHD54QohI0e>sJKhV)O|n@6QF}qP~4bnXLN%l=vbN zU^~Va15Og`2d)szd=?8X1Aag-pz#I4G|?9YvpDQ~lvxSJn0e>Jk1nfbbF@6;=Uf-qg z8eo1~p7D19-!2%?;MruxuLI_JWMaCP1UCZnJ9s+2P;fKi`8+oB-~U_`Se;EId53%)ELL{|&*zz)x9tjtPDZ@uw~EX9Pcn`2Q)m z2>7=a9ydA$<-d;j%LVTTt`Q7q+#>iO@Lhrjfd4}9Q)GhEec3}SeK|)k`?8lfAAjIr z&iHQ_N(D3B48crSE|}@)^cb$?GfvCD3uUm%XErW*2wzMrwC62?DdVexnde^$_Tx%No6u?fzX+X`{$dlW&XlWlR{D$1 zyuIn)POwPCl*ii%G38AZOr2K?rtGzXDSNMA>O3r%`OrD_{I)|+rXkP2BHm9t4S(QD z;a$@eH1DV2;rGNV84r9F+CUXC1;E_^uj`_k7(9G7sr2U{4M&+gkIgdD1jH=kY{4w! zJ%U-T4#BvnZ-A1Y**z`sEaUeC`*Hne!IN-R<2LyHfHOH}0yF;_!GOk1f?4EF!L;q4 zTX-H6T#fiI30??%NN^eOzgYO+6-+z*R50!IYr(XW{Ts;EbvTanmCp*8tM&ExRuFaz z0<8@J9JC8y;ocq&1$aypD>>Wh-kPc@gdG4Je8oA>)CtYwZ0h72SNCRK@l{*ET-2#7 z><8a2h}j{Q>&X#C#Tl$dNU>RwRAf;br$uo#(vpQkfkxRxuyE*ue2Mbdne=CttQw`; z9tnllZ^n659Et4=w1?AIin$XJQ2R1er6Z~ODx@Mt<}`DPFXZiF)cUm}fb+IC>0JAV z%xdNSjg!o?k#PgGwW1{9c71@^Y67#3;ZSw386Q##SoKVI_|vST6r8#WtnyPZCzG+4 z!3`MdhdmfuG1Kf)S!J-OaogeZQXLzUJ}9NxtrgqSvB8!T?A#8UrQb`#!Sjwr2g8h% zr+2N{tl!*V%jP~9+T3AF91Bfn>4Y-;aF%KaBOF^z#jOj@UZFn(MOnIO*i=)7tZ$P> z)fAGG$2g9RW4KmHmMt%n$3gE1<8x@zxzO+0n#0)mNh?7g$fb^Es~Y)~Z21gMIxf&H z#RLMktGFx0#9<>R72+^_E64j4F{WM0ah$h0-rMM6xK}#)&X^?iSM&WAe8km4E5?nF zzj5Un2A`e6zcmv^T_o)?*M?@T)_kKgjK%DW%(n!!YQm_o$meF$vTkH4|; zBThRlk9!$bdGA499pWetQ>3^&&RwkX_}iTK5T~7%_a-8&^2#7+9pWgD^GVWZzo+1> z^7z|5=Bu5S_aq{$@^(YegNUO%Zmno}5n!u4&QH0wsGXMg03xjNiZDqlLPE;3o{PN; zjgj*7Il>Yc_XSG_B#oZuo_S@PqdS8}8Zx2!tNC^zEwOet&=?k{Y5xg6>v=i$b2{or zr}lp21~ZjSoi zl6u&B!*KU}JV>liPo)t*Z@%UEG{U|@e$-a67BAV3=V0>LT2rv)FP`fjJ8n$#;@ne) zvHH3U@1y3UxR>+1#X8;UAG#DzB5d>{%@~B=#xuS=^&w-P)3ZDahYknuHRJa)ec#WF zW&rN2T-CLA==oQd^;V2Oe7IuwK+UtU*fU4+cMoqKI^yrIGoE=dzw4!fu09tZVh?UU zR+oW?)4TWos=v<7Q#Ez2!Hgwe>{e&A+@~_$^87OM6CN~EnWI4ZY@p*T;hX~~d(=|` z1!iB-_0Ul9tNW@7?#@_D^L!=`=|S<0!*fIL(i#{n1E*^|#_FGc3Y2v!oA{bfj~(Zs zucH~@u5+!v=92*rVv1iw9AcuL$Z&DDM}4lzdR8%J8X5MD9QSm)?!~rEzsI-P({Q2$ z5vPZXUpcN$RN(W_QWAV7>i!ScANOQs;kqc>Sn@amDw~&CP~UG6UHo^{M3p;x!nx>t zaQN1EdNPdu3|H5Yg55{_$FSr4Qo$=38C^edJ@c}E|F``62W#Gl#a@3Yf9NIu>qqjz z1|!3^u=7C0?nj6ARqgaS7_Q!a4$B!%>F4Z#+OLH|c4BQYbE<=raiHHpJ zPX4x@j^npG>D$7%(OO)pZx26Yp|h{INSNao_r$dX-UkbDH~f-CfAaIJx^@ifZ~bz8 zUx;rfU+dt%$ie?Dofuc9|3JbV#|!ZWhu;Z5^(w?a?pJ6>e(nWn$1wLGwPV;4RPz7C z5<&WU2|okOZxz$&{b~-?R{1WB-*g-o^?o(yNJTQHQywwtbb9Yd@yl4v8rAzkyoYHy zg}_CUkZXQo2B!&TInt?gHl=7Vp{{c#GQsU_UHxzm`Tm%^4U1KaFgJuAm= z51YW7{zq~aE}gn1WTvu&8(V_)SVJTK`1~JSDpoDH^sjT1f3j!FN5akcK=5d4m~57O z?Gg3(?67=lIL!}Y&D_)}h|zNsHpf?sExD`m@t4XSjYjGv;st+$*i=j{qeoZFWOFKF z9_g^!ziCrL>*&8Lm9{h5_lQjmZQmV66Y+*TKk!T6g3e}u@+>rzYxdw zh{!Od*qbqMeP9_o^{}Y=B{)V~`-Q;6G*&+LQ|&YkAcDAB2+ttEzIr7*^&ySn8hEQb z?kDmdq@9+>G0-aSyB2vI0<}C2Csuj4AuK}}kjcku3v6KJTZ1?mqDWTqcy)fCbr>04 zj(C=X{5oGgleWrR2by_T0e~YPT`l;Cs~LcM+aeFkn7F)u2e!()A7PGr+G%nJ)7q(s|F%C^KSo~p5AUlx=M|R3VmzlA-5<@_uhwh$I`8S2ck#}7i=6Rbop8?l z!?U24pd$RX2S{ylOTs=@0c>?&x$U)c6!aE}eGj{eg zsY+=F8wRtx%G$%yoW`}#;fxUW;(ktY!0k34~hsU@^kn5_8c8Idyd56Wvqf`SCj*-Z^J8H)zze| zZ<}3Sf$-Lf*|W>%8CxqWtBi(*P-D2FOru$4b1Tfa%CdQLOf;vwveHCV(9XDh*^*_q z-m%PR?+D^;D)k-Ze0qqC>=Ar1tc?R%8{zs860vYfF`Y0Gt@LCxlP988aTrY@N@_<( z09W{?PAxU6MBP@=4IBr2|gE_%6Ev@uw2Y--&UHg1_; zyAWU23anhYG*E}HKi!J6x65y@UAf9eS+I0*?Xp!SgN?AVcE#%273m2JYFDgUylC-) znpL%_(k-c78>n4_uc9rx$xgSVOR11G-@w9KmpM|K>RN=@GMCa^Q06Gz;zesyB{#JW zELeP79W1c&w%P@$xE3v5ws>V-?Lr$(v>!!+aHW*6XzA@M>jLv{U$m%p#Y&rO*m5C0 zm$sxfaL0<8+it(jMqE~VM_^^`%9T7-y=w7-CAIcywprCIxwbx%EweN0*0O2^&ub^Q znc8IwR;;~kRqaC5@T%Hn%+s!E?Xrb|TNedtYgQ~>8(3Jgs>Y_ORFb6*10&SMf|Y@q zMXOj3W`j&=G%XU$^J^E~x}r8v0To7T+Y6ksRl!s08t1%lnWI@TQJuG<__kd6rNh9i zz$kT^mMfszkRBoft813tZtq3NPc;-hh+2mVO;ge|G`Fo-6j1asU0lW8f3egyZiN ztS%$|)X!8a8sWv=ekw@&VlacBFfW#=T`+C4MKEo4 zzu;0_u|`t-Ww_G0(3je9WtoXtZkCgnda*pj)P*_`SK~^(iJ2$$AZDJl3voTJe! zHex(&Ks|`57i~dITT&-t+KlBSroC0Y1GC&L8{=ueYQeM_ZNzxi10C!4XV zsw}`$fK^$5F9B9%0saW-swM4NTvb^R|2lA;#D5RhrGnXROW^sOsv1|-K7l>J%$M;j zw`!BX%wM%P;C$e9@Z@3s_X?(7_X)z-*>0xNq0^Id4lp1^y6{ldfFjZ6~Eb7!T3|2Ob7!MvZd?kTez znC+GL4q&!R;tt>&1U~{?E%*rVLcy;B*9rbL@KV7(6!12|bAeY0z8!dt;Lii!C3paM zo!}n#n}BuNhk$h*{VlMrqYNf=zA-uVGfc}t;q=c-lbGanqa(an zHz|qjSuNjI+t%I?=)?+JZFvL_ig+^g}jC!97^%X_z!)nt}zQ^68^{Cb9g|z!V-ZYS2`0ZdLlj&0g$KK{;_xLOFqxVL=_%#{_hCynDsp+jC2aXa9()AD!* z$tv#z?oC=AhdeE>N#tRuS1upnI>EeXc_D|qA>6ypfKL4|e8uIxB=WRf)*#GrT{|uB zd564S42PGv?}|KK-gN+e(6!V0 z{i{P>GbRV?z(jeRc4&EXfx#MY2VIcIAzV8xuL2Ro)k1g;@;K&G9;X3X9?t_<t#(=-=L}YPA46Uln5dui{IJ&{k8_79S{SZc zUbaKtGzii1SVr=(JwFF;)$a__rLy0*B~3N1baz3Xwjb@I<$W30D(`K`OJzUKi>>AD zw8-Q7O3Uj(daJyT(&+aH;;r%?w#XZAk+;DikDWV}e(N3b4qD`KH$dyR0O_e8+ZWws z2rsZ0kTiNVZ^9K~mAea_Vyj?YD39(AcxySni+md)fbGC9G}hZs;3-$jdlT|FpV3as z`w=3n@+P73Z$KR7O%xjC4MC7q-g}T&jCk#|yqCadmA4M^IG$48BzV#&k7E+$vCYx( zn=~O4s=uVse<=BCQX>;v9C_%nVOQ%jecl)7m@l2?W}_RzvySk0IpK~Ej9ijuAPc7@Juu^@iM$tPhNa9 z>8$x4GxsMv65T)12Wr`|no|r}j-ji>D(&UoY~L9d7{SnRO_7MHIBUN9ibvD$|8P3a zGn?5Z{q3@zt4^XKq7U!s`Z}Ji?^o~L@{Yfk?~7arEtm5Q{Hg4>GmXUsd{gJ?1GQTB zQ`t&;ypJp=*Efha2C6gOIE{UZZvcHD&-a2y^jxL&{3II`+&rJ`2<|2;|*)aCKkX58$W(U@khfDm+L~g7Rwc9*FW*x z;_mg}RkYsAwv6+5s}`ZR3|>332*sepB;4&SSeL))v2C zo6|7vs`XRH`~JyQ+_ FaMuAKC0RIy=$Clt~7e~f4uuI^NVkO@`@`>VX+u&vFHk8 zeQk07_b0scSKINvRT|}`9X%PYp4!}=40lg$9?rW1biG)B1Mbh_7C$cYm44REEB)#m z{CE5Vo}RqiEq(51zB_arTL9%lzsn!U`|vyC4+js6*2u_g$E?N@o)!2_Ny8PM>%Rgq zJ(I@u=Vl+v&3Yx*b2>Nko!pG~bKUK^Mo+Hm+Qz2ayZQ>+`us+$pzA+e=l;WwSMc@m zm3u>o!%rBFxSl!U$IC$b#_sw8UhNC!NRG=;?+3+;NPEli7PanhQ?SY9T@r-#5_+7< zQf>16%$#Vrx1=xFy&SJ3q?NBXneIg!^S~I{#=P0l+k3;iy1Q$AO{k!r+}tTwxU;S? zXymC0BP&}T^&mmk4`P8ChOqTX0*#q}cB9yq#r4it5HkxAYdNci&QbiC1kaK2EK;UB{lqV53$iI&tPd7W zR4>b2Uvep8bBtF!#gVL^fVT6oOZ$WQk^TR&>-qi@6Hp5vs-LP{cYA+He#3QzABB)+ zcuLgwgWj6yo<}lw{E0DUm-kXc?woaVbk0YiQs23rf_#_I$ z;iKP#qN~0b?Oyf8ho)y%Et>ni2^GQedGc=PL$j>>CG20_=gYo4)E)9>t_V(C5iD5| z^dCDpDYCz7*Y^Hlc?F;fMTU(#qdhsEJNxmH>fMi)_0)OB-`?=hJEx}Ho`wId8x8LjUiTwzFzwvuK6xmHAz;Vtu)(E~(xRTnJ^OkmL_@e2`EthY`s*<- z9UEheiTcLGxDC*mpg<+x3r;lf={j5z{xgD20z1L0;DR%5(b_Y=-dxyF66 z(O7#HcQ1^s=T9H{9`s!S3+tCy&*=@})wvaH)wR{kH=!K9zT7EcNS%i7B|Pjl1rmiW_x?m z1&YcW_P}d7&kr9*1!u7}o!xa9jKh3MFiMNA{-`vDC-K`Xwgl7o;2ErnYp(`{tkPJD zGL`y13avTo|MEM&QrErXOc`N$)HIHLm)vW10f05fCwR=CILcFY(Z&6tA)uu zm%(2KT}Ry>|+TRjD8kLVHeJI&iVho|M%@*ChOVne%I|??|Rp})?Rz>!EnQ#)Y|@rmjpvJZQoDoYsP!R`C{k& zp4Dx!ttXRwt<8|{Zmo0k&Op8Ucf*dbMY}7`?dV+^Xx{1TZ$0ivY(0E?*g*p}FG4L)Z2Oko>&^w*2dC&w*FB`cFgt8ZtQe5-n4lHo zYxnWhmF^ zol~AC-p4F2bk@gHlgyPqD0>q-@A&F1y9Z-66ym~yp%R>e?_gNpxzmv!QJ05w)z^E- z!LVKr-@FcKwmUa|?uZ1tDJ`W{=zn817|&yV z71LMI{}#p>j+pZ3FQk4JI^JRxyYtxNNI=C-p(CT@OV!=&Th@BUH$Sj8y~OQt zXIMH;~H^=i_b=?5G!NcAtx zzdQL#J92vKD2lT$F%Ku!8(|s1;+XuNxq#u@8T816RlmX z{Ye)-xyCwJZ^ZuC_5hb_MIO{~R12+GF2X-S5eVew^CVg}l!nUyILbz&L%{theCF!0w**4!n-p{)R73 zAC2}r21cFhVtD1risNdqN|B3uQDzKLCr?-}oWq3+C73_&Vc$8(AtO>78tYpcnBTLk zujJj7lwMCl#o;2)*bN8zckS|f;sa;=9^?|+3g0J=zE3=TpRwZmbiYVh_BF$@$!Idb zi3Q94A~L|WgAp>Ayz!IzgE4)Mqes2hYe@%UItwQZ`y8M7S{=@O+o$b%6Qd++U+yc` z6=iQU-gNIfJ;j!tXK5)6IVA&>82Of_`pSBeWY zOkwxd%e6NGM4NROjn#AR2;~7K=>Emf*owpbKke^3ry4K)%mpi3Vw|tt>rr(bhpxSt z_1b%dk?053p|M_=Sr4v>9L|l5s_!}^ztzm|g<)^F#UHM9hlllsTL;1;PKAfR8yTBAm7cUOnpbfnES??;X_r?F}zFzBo@q+(4&Hv)3 z-j(n$;Hbl0_YPfXT`O}I%39emKE0lP#%B#2ZreX}B{cm=yQ&ZDm3($(FIhYzcg5p(8M>Vr*LrORxds z_gajyCwDBe4!%9?^WZxgm?2%+(Kk-&zH#u!;)(4o9Lya4A9}E3aW2ZWw@#G{Ze=8V z4e0P#P6JNuRi6!sI1zr)s*0?4cSKM=WjI?gKFoJ`Lq)&p@#kK!y`zZ1{(jEf-}Mux z*K$dJ-+LI@+tv&hobiRX{dDNcqT_2{uqhe#UFi!y>T6ZYOH_7SS8$RGfc3Gy5pwj8poYJxUs|Dyhv}J&6^kD%?tPDg?aO=-aLyp4-9s19-Vh@Uex2>!5F-P zAduiE4_=4g*qs;2mnP)d_|k;Dh^9cJKQF9l=Rf^`c4Bre4SppC65nltxHR~7zScLCpP zs@!}_^X*|*TYJL1DH*N1y(#IfhntmST^;S4((38qJ10=R{q64KnXD_l+`ce}!@#qm z9X&gok*n-ZuhtR;``lD$wYIMDpmX7U63|FxEKX_g!kV!d$unm+JjP5t-AQL>@~a*_ zyN5WOz}@m4zALLfcX)W)h1OiWH7}vc=yh4!e<2^m+)1Drvw}6 zzG*)17#@DxbpF2JROH)W(BVVY3dVax?$-UslWGo#YCz}1HD5<1c`!%wMXIkhO*o&H>im1WH*Lx%S=N@T^&tmIwyf69r%hSZ zjMbAF$2CpQy>N_;) zYYP8rMae2G{x85D_V+hFcOYK#9O%^ z%vBZ)`X`i>58~9Y>^wjDA!|(9)7HUdEZuaUw;Vm7H#mlnJAc636e9Z=*`^*9cP_RY0VTXYLF&3XD%a&@tWaPmAr|`;N_` z1tPn`ktWZD=_c_zUdef46o;zVX&1oKn1#|h#c`3ShS1JmcU-!a- zjiIlLN9t`okMGLC^3&k6!w>cTZRKWn`IN!!TvC$5J2mIeK$7$*5lfG|dGS8G|p5PTG8nY^r^ECz?Hfu5PRmM5&2=1lm(pCDnS<3G7 z;#(_T_af(o7`;cM3rmm2T`j#w=ME41-C5o4dA;tdxU%1MZ~v|f2dzdAy*d(t8*nf3 zy653@N3u;w@TqcUWP?XFjXn9_5I1B<|?6 z+#l(8XYTYJ@)jYd_-4q6<6KZB)OnbOl?7dG^?t=xLuK+~Mi`A|iNt%1a06phKj6od z!g&8o-R)C)GH-F9$J!l@Zyiqb7tKB9^A^qb7G3GA*Zg6pckyh7Z_uLoi>~w+&HpCO z7kG=Vaz3R6ru2-(yNk%Nz!>$Bo^zfB#i^Lr!-6UGm}M*c^A|eD`$l`9&Hie_5vKi? z*P8IxO;}V)D-WSbHL}b zzt-6i7>5P5HAA^@7E)A!B;VV^V1E#4-8tXMrk2?1u!V`1igUPl9EG|e`k_5Z-bgt4 zad7gT?}ZPI?~CkqFMteiH89>^l!dF_qJ=0uv+C=K*>zxl%(}z2Z0*@SxOW_@D*Bea zFVZ*OJM?kco=MIgi?fvP?P8@7>{i*VJ6xDBu4R$-+T&ff_pcu6_rLV<&Q-;~+r015 zNjnlI`aNSiM~$8Q9vg+K3gf7ni{gZ7tDFAmcQ5d+w5|5#DiG;)FSxP5o+I?A9HFCE zF32m0IqzQJ81j1J)ilnqA4cB*%WFM-n=y8VX|HYfn(E0K1$v^cJFq`0Fn-(ouXW~I0MU5SssTFfN@+0vphyd+MnEvPqNNLWycd)}VFIav z_~fJe_B#V{{(>?7z3=Su_32R&5zXXS1Ts`BIQHnOmg)FDMJ+g>stKggqs}1D-6)z~i8aj=L)QVOqCjIo}le?~Uui#^7V2ePOy5 zA^S+8B;y_gJX$!iZ=-+?1J8kYjw00`m(sVkm|AgyQ zv{gGD_il6;?x(-;N0*{Rz8h^jA06Hu9r20>MLm1KrTuGM(`gGXc0J+Rzqu!JAUbMA zvgJ{GQ)}F6e3=sS-P{!1z~(eJ*X>PPh%cAs&iCfJJ~;Z;fq~=dYl74k_-jS_%@CCA zjIMLKtAl$whjF)Lv|kpcv@xGjR!`@e%G}Bne5_D*2Y6ta#LtCO6NZ_@yjwiC zVEKa;6kkrcc;2){x58Ingya~`Lt7ce8R+`EBf9s=2^cZ%cML@iIHFF6L%OG<&z_Du z`oa4zINM%6<PbN5JCX;8s^K#;~MDeomjVILeWV z^hgReE$ObZ75^CFl_Ki_(H#m*QZ+lHw#< z9BIMge15HzWx@6O8dPgUa)la<7tAYAV$*Yf$K=45Cfy*FNpTrv4|Jte2NQ`_{=iyj18n^ z^`eq#_+qT|=3p;X{eEzduGvY`A2Bm3e|1DN8v%S`=ta5lVXkKUMU zNi{_~&s?(b(aaHpCf6`MnV1~22E93gyXkDMY!=m@{r-BokLq3-ZcFJO_r*o@4*FjB$~hcAHLT;EJ&p+-KeFZ&^dqyT z?HqWp?%VW$@wwMLi=OBK@gtc2VH4ȲiiG<+Jh;}rR=5IV2kAoyAd=SbMJYj}97 zVD{i&o6>*Ng#RdbNJ3*D;$P+bsKJZ8HaXv+>k{f7 zu-Z0jj+GrhXNXJP*jjfWuGenG%Y(5Ou-6_2rv|s6%BRCPw>Ecf?u_#_o7{Ib_Ru`U zIX^)EoPZ@TjL_X_SM;V$?rd&)xSufs&7GE}&-A-SrhYGLcooRjZ?|ckaozSvxF*=@ z*KOygbicGL9oeZn5AWIRkg(cnI2T(DQ+%7@R8U@O09XEz zDvbL{|D>}ka}f_;pQiE2V;fy};nSN@z#TvTdMo2xb=YQi?=*U zY;MEifaCX$XKcxu;}z~n`@yJviL7@D?ccrMN0f}4&zHMJ=(o)K#W?RT#vXfc5TBcc z*6;iqe7Gm6&#?pqXzauf9qJR?i0k8)?6SlduRG}vJ;wrzefYkw*FC}SPWtBl#hu+n zle>$q@E1+;7bSa(CK_JU?PE*@5U9#ggaK-N^8OteGn_3Lv!+AoeT7P{|Lr`0tMv|R zSz<1R3TI!KckkP6E&8CTD*XaoI`7^G+J5TY+tv2$%vES-Md@p6$*_C(KCcJ;42&Yu zmOHW*W-W9KHT}p74~<^t0|&PHBQcEO!8_W+n zikEiF)$2}k*d3ET8q=}Z@)4%!)Al_-rsLtuos%qsP)&PFqITNek@WY|mlfV0;TYpc z{K&pc>J0@7RUEt<;v{$eWiP3)dL~m4Bca*Aw z&($5J>JVkrAxi4tkBWrh9Y7r}b4)xPz2kYy>C1ZE(>fMsz8siWcwLwynpJylk>#W4 z{-OSNUhn^C%)Uo(a_C6^l20y*=syXqaXv$+u z(|!H#4E28${U#!f*?DjOl23OWx&F;ZZg75vMS_db`;rGPURL;X>wr7G8?{Wz=|9kX z>a};YNjci*yB(LkKg)9Pa!|GBcLTm~nIpOX4=#Vvv{S0xx{ERM652iq2N3oN z{+o#}_&^)>n@(Wkjq@KOoCX2=%)$vVN`laT8&rN(vSt@gYj{2rb|X+j-Xo@kNF zSP2hF$g96G$t>H{CYQW61^YC>8GegsHo6svI{0RB|Qu2He;nRYx z5iCvy9%(El#y3!2U2%VrEw`i+~J4x4ieZ;%>egQ6D|%`}fCWWC)s_?dOl z?#jcCa7Q|J8leu@tD*kKssFLwy*shu3fy{<|BmzDIoQ|MGkKnIez(i(o{s5dAZf=ahe=FDH2B4!U?v#A~)`P_}%V~zOOgE(mzn-?siXZJBlP}t=(=6@;d_@ z%e&o^uvG?+LdXKrb(Zs(PrKcE+Qy(P>!yecR|{$96-@^ZDvkuz?ULK0fo|@x=BIMO zV8?@2+pjn)02q8@cyOOpjcu3;+J1}Nr}*8e*mz|7l~&}Ab(YOPXzfi&7)Tj=Dkbh+ zY_*KkeDTu)5z~6CgW1^965m$l#n_oO+hBX^+y`gCh zn}5kYnU>!SLykMfSqJa3&O?@Ae>3|EdP8z;BXKHLH4?4)N6l@mH#CZIk7EK>q-;-F zu;PH7YM5JkG0Yf`w@{)Lu^8R_d*9yWE3mJ4)|y{!%_;2v&*fIz5-rc;T)f@uN#jN^ zwwh^5^*JmA^ zi(+|3^ca)SNbN%SYu~uhCHmsC=2EOPgSL%ne21aHCSrHsQq zCTMGGJ8o;VHtW$}E$dStVzGW>z>d-15y-UoKALzNv9Iz1?EVb2nk2Ng8}k4aqw z?d&e&_=Bw27E9o_#F$ z=z(3YHvOpoSpD}(;>2{}f9OZsL|K8Vk1q!h6H?+&QPLkIBYSkCw3wAt^6U8fWEfM8Yfk9{$?+cMyu((6t-b$p$X?d{RZ&}8~zo!_^WC7u%I zM3xlYA4^<$5X;o%UdsmXu*X|%anPif+UEPh3VW7Pr`Gx+P{pSG{pV9Aev)mq{fFlF zq5q{$FV%~{F5Bmk^q^6)XDbhFl9CcVl%C! zwES2}a?1IX3Eq^6R8y?|95?hcSG9e(hG#0BF&6KPgd)oZbrYl@xnRdbOJ)8LX$S+M zKP4Fw-m!=q41;SjEYq6d;lX>28OPn2abUjDGkAqIV3wux7u=L-#8b)YO@J`~sgASS zzM}=K{wU||_QH%SQ0)=hp=V*MM_DKLjB~6)WN3-=);K*uu>;`BUylcAC!hd}1DM!! z7ftN8G#u!}G-n3>UExOsVc!cd3?%teCbYGBiza(hF#mD4<5dPer8@fT(YToX9gBaJ zv}n z?#kRiUm!!(Wy>bywPT3@y(xJ(5byXs_rxF597h=*(Y)zbI{UQ1jaX*A5&K+Qj_V4o ztGUr8`Q_Yy!tpp}IR6RF*B)5Ywg@VM-E@4+Q@`neO@l0N%D6rccDnbbj6>149l>Dm z&chrG0=XCtaHdAbbHO#Bk#W^lsCnZHk}h02rkQ(}8r9_ftIFED_w}~zeniANv3KuK z+jjKsBX-9`6c5GOALhKyGLSN{H)VoO@J0Aj(A2FFA{*G*q+>@G@5kN^=rv9jAA#U{ zm1^tSJYZ>f^;j(Z!Il^0;9O4q97IT}6)!-IH?o;BeN$K`*JXN+t2#q@VsCCE9}mrbQIdy z^36-q0@dc$3RA->4*PcVw!;+{^?O9PPmy%ds4Jd}OVtL)i-s$`w~bo=HXi&uiA+9_ zOh)Y08u(!x+mdP0)KG_PP32Qz|76k|gDFM737nFAOGo0>$|oP>-6{99$=1P4u72aDF!6kSc^r+MkDaFD^;rY9 zl*;CSy9bx3SaYm{(CyI;Zwte+Ko0pHqg zG2Z;{qANq=%?rlEvnGh=b-SDen%nJ$Q88}kYJJk))PR1$uS$4O!fpvw8Z*lh$LO;q z)lc)|jTs4cN9v12BbPDmMkCwl&Mb>s*5VbTt+=Tl1**`WInz5mn@#OM!R-}O9_VX2 zSxS8cKfq)h+;f(T>)z?}{L`;$%INn_k9Q7P{psVJt=7PVozLewKJPykJMh|P&n}6a zHe-h4NXNsm0lU|J+7Z1k(dvICb~=`)b)slKlW{*{U55nOJf8O7QZ zLVHEh-zH(bgrx|t6O8@Aw_821;NQscML6v_CjEt7KNxX@%N#!VySVd}$~NO_LUnXu z+11`uEMQoauj?>f`0e76lXlEQoYul;BYfkMkM3{Zm&o;Xs(S-=g_pX)!Kg7W2-O*IdsAH-eJ!n{#^w`zV*Ctr zsP!ZtP)gp?dN{cPk4`-n-rDTQYV{zE);0W>>rG8`uCsKfs#iZnJA4tn>9eSNtR5aN zJ>xqGfX9Zqukfa(_*315w^#y)I|8xhYk9neNAv^pe9HsPSgROxX=j*5AD&8jD_02) z6GG4MaA8IUBp5h@T>@C+a1;!tXo1wSMPmaI{*26rj%YnsB^^C-RmXH|OPhvl;4a;v zc~d8QOI^Nkf%cB{D18eC3&*yw(|cZ_`BJB4SzEB^Cgn!6I9)Bd8a#e1-wu|57uh?b zY-JO^)15jQ5AIHzSZA`U`O`JWkUw=g9yiV3rt*W=R$$HF%3JhC--SeU1&9kA$8@eR zOMgw)NqtP>MO&(-r(XEi@NRol-hygNFY30(I&mpAxA0cneU5QX z4=?=63-|ZfQn~~P4+E6O63Q4NL9zM zc?b1RR2y}K&NfqU7{Z|QwxEweyHXHhQ(%7s)?U1K3sdfW+`QWtpZxsGGuHRHr!Bs< zH!9Y7eZ*O;BKcNt>Bkz&tv$E4=5@VvUEf@+J<}1Wj=t6F@A_a@kI#Cm@47xkbJ)w% ztv{WZ98yLO4lEYK`=jM{tTrdnuyzQ=MlUqeK)xpAJT~OqCFd3iKM`BFT+Y?}D5xxW zTO0ZppCU}bJ8L>(eUZ+BSQaeA84CKO#!f3Wt-x;45msZjsA`A&kAu^VS<%}rr1eZ& z(Ysijl&do0GR(d`+zYxODbO8w)T7%{&(4;J4fEJWi$@fU46*a<*^$>`;oW5p4X;`# zU+6B+at>(SY1po);k9yV5KaPC6+)!45hq*bC!!cZk%&B$qDUM3EJVgHna*D^nqgx+s+sY&nRqxAxs9Gv#<-ax5Q6sQ#9%qxn6`tk+=_Z(sqB6cI<`D1^9 zdMdd<_rt-*wZ+BWqU?D^YL|$r8{6i&mrm`nYijFn$NFk|tlm|d z;7cH`*ZMTKKU$x0%rGj0aL2?r6f*DW`=blL4KHjq?Xq3(O^B0MG<#m&Gq_ck_q3kY zJ#nV~Mc9PzbPKJ+bnVB2p+tNFAl9TCYpC$BQxU5BvX^k#zNHoGD7oAl*uTiLuy55Z zxsC;nbUZ|i(KvGN4Wc@Hf&`+8>>1Ymt&Adz|+x} z6jN4a`%OA_7MgTPF_|ZXERDY9%W#C*Zd-Rg73=Uh|6o1T)1Ucb?uw%sJC9{%XTLgt z&E$?NxIyBJ-Dgj`Vvd!?oWs`guBZD~WaELZ7s7G3z`1t#)!u;^E$8e8$0WyPN#Cm; z^Zs~C^<|%ZrcKV#F77`2y6a-3v+Rq3>orHrilak#wA}fr1@96#`lFpc%H8G16Hbm~ z?yPuw_ZtUXNxm}QIlQ4H^Pb$c?n5u;_IA-O=$feX>3(bGk8+>AXWX{)-Ce^k*iS^A ziqZBxdS%kFnAZzuVl}(#u~_Fu>n!Sh>#Wvd zUVnMlhkQAdF&jvccl@)7-6l-0c8Q#?FwyyZ%lo*f-v0=mC*)d__`!$dyjQ~KB)ne2 zpGnC4n(%COznte8bok6!f@evXDdAKJyCuY4Osq@7>HnS0o9=XOv3cE@t#k8uo8sD5 zPsV27=6UHkzRh*%Qyh67!^S|bdN#knl?IyfMeU1n7g@44pHzc2LGQ5s@NqlS zLDZ5f*I@5&VO#YF>Gmp^y6_vIH`+l@O(x-ARCgSjavNq(H>Sb=i9 z;$cZ)ckw)XRtg5vW{6Qe-qG|B&BAJ5?D=r5wLPObBhH7k^m?JfkwYGEXKhYFw;x%1 zR~42ydq#VP<@`%aO!u)4hOJwJ3LlJ|zWuy?$!8C3N$EJ6>}u=x4qaMK7|;9w;?lOI80*3CT_ z@dB+c_F{XNPsA&Lyvrvzvb@X3cz==Hy4x42QW!Vzo1EU`>8EWfzVlXF%JA^jk@>F- zo8DK+z1izhkSmthRogl)&!q*xbRt~CcCm3HN9+StGYrU)dqR;lmSN(}_tRj*tcZhE zyWOiR`n`kid6y@72jBNDPxLP5_}|vj)bvm9a%Vg4w?4!z?90b{mtW>zez|w>AE4=X zzx>N%M)qzjcQ{gW4V^kSJUlCGE{mpK#elVpq?5YbB2R>?wm+YiS-HECo6CcAc!<4e znRqaMhbsI<$2`9?k7EI+5TzPQ5UshU$?R~+(9tXcA@0I+N_@T~f+ z^>Yk*Rb^3~r*7+<;QM{?fl<6ozp}ct&ec%sN-c3!*K7J|>6T5Eb)_ZR)z`SpA0SX4 zn_pj7T3lOKqUnLFsIjc9v`)P=c$25DzEm!+uPF7DfNqXnQd(TMbyLH7MA4R9{naTW z*U}or%GB{SO;4HFwyxTRZwB01SyEcU5(|?`ugFv4k`mQ7)HN12G}e`VHFGJ_ zDmCI~yJ{O7HZ?Z5HhH#I)p|;_8&w5e#kDmJr8Nz%)NeN;w^~<~r>?wormNbsrLwxQ znq+P1%4J%f62M4aNZLpl#gsDP`vH1uh5EXtC1xb_yKxDNcdJgKRLgC%a$$L z%0gFTJ+7x$q7-#Co~n!yk`hOCWdq`8Xr7Xi%7)5XaJWi54IVuf3z54#cbQfcQdPXz zxvI3rbv27W(^XkhT-8`oiSMpux{9_ol-9dy%OD1%SW_M>RdMB}iqg9Ep2miX^@hkx zw=`&;G8D|HYPPGvQ?7lj*0uV^udNsnhN+cA5_J%EWlib-x?q%kuxJp9r=~=;NRajw z#Z~&F)mPLuR+YGFO7TSsSA}QOrqUX%v7Qw+G_0Wl;$S1(kh?Su%~9ImnMFBj1t7SJ zJypexRUXRMRpzOzLZ5)<8gZ$eP*%}vrL6y>9-2FWG)6k>nBiLDLbt1`EUs)=UwP+x zwh}L7xHJ8{E3X*V@)Iyu6_SK$-;)-CYg8DtG7^$gx5v0Z` zSGzKUF^U^hr=Z-;f`;77N|7>j7##_ly-HAh77H3|^e0+6+PI?1+H}aVu5@!_X+5;B z+*Qr~uewV^g$GSr*-)?5KsrW$t*mj?d#ZJo@;XoTOe9-|q_S1FudG4yl<6lkT{T7P z@AA~hC6v-!EZv+|cp{f)TE&szrvX-kP2~stDs)gCq}7&UeX7b>PmcsvbIL6zss}9Rl2FR zxT2mzj4Esy;?!4A$94VI%IZAj)hHJ=X{2ckNu;MXx~_4hHfETb?Mp_(yXq<%jL|Z5 zI1DW`>ZI5&&CM9Bf&)~xtG@EvrMh`H4^{jY^`+5A2DYz?*SHDYq;$O+`s*93)j%)B zQ|7cpQ9>*8RizD9L>~=QTw_e3HHG4EB-XEHqhplwV@@2dFj^Vk2EE$#&D6&1)W+Lk ztW3k%=*Vn3v~4YHf5Tn1b$9S;d9CXEVx@{}8#%PP?ova(vCfB7T zqPSF%*rpi3>cq5M!l2|sTP>rxNmLc}LAoYZ6Z-olDOBD$3v$02rl6vv?ox>Eawj^A zIjX2KN?lrcClW1dRKC_FY10tb)AH05m%3^iA%{B3EM1vd_Ksi*M#m|utF4BYRNo*y z6V0nP6>P?4(E)q`44;6iEn6?0mztrK)YWd<#HNL4XVsR?3T7+uA*f3d3JzQ7;HV8~&%OR@>x4GhaTt4mnWQXCZK&b|_Jo$5{Sa*HafDjT*!ZAz%Hda*rKrFHP)^bTaIRylk- zxK1IL*-Y7neby@LDLUBAs?mI|bSN48j|`ooxT+RS24}Id44LaW=~vh{N^44ySEcTR ztL#SP)d=ko2Q+sRooB_hjQ%^+O^x283aFV#RhSf1U5y?qIRa8WOdLj0f}fD|6OT2xBG zNx9+seo6LFQYBrfI<<_gV`43Cs6$&BIy>5C1yw`w^9&ZQqCRNkHr3W+wqrQ^+DI~- ze+GT>nV4xdsJT@|EqgZIcvo>%B|YUz_I1{RmQC+@MC@T)5z)I3b?6c?7|Jddk~LHM z9Ms?-1$mA1*HImSeFq<&guyVX6pS4bsiDz@1qBu!Yc;GLhc%gxXu4@P<~lCep+?Mn zz`(f@d@nff#h5bPQMt)w^4HD2yXyVW)6t%)RFQQ@K_NG!sdH!^Oq7b%IIGV+Mkf1I zg3-wsz8yyfSb0o)=-4Q4ts3bt)rwm51l6^IU4zSEqhe_PFVY!VxWN*XGRk@>w8ok{ zYHIJIvZx-ZTte72+Iho$##Bem$+KNF;dHEnHWU*E`crC3Z6qQ7o|*RFIOdsKQn!Tq z<#nYSu|`0pEUn&z;YIo;tu+1VQ9>ClMvjtj#EqhGBrZWU8lV6rBch+JNo|#j#>y?Of}qFNHTQ4v;Yu5CvOVV+g^B?J_w8TE6Z@8yZT3h}16ep5cEQ(PwLAja5}! zHP~rRXo0@Q1&pBeFopzBXxUIOBc^MXORaO}Nj1JC4ptqDt7gNXQ)@H6DrIOrYYn-n z)q`M3f;p-2^ed$%BGro(l;w@$wu};wxG*x;C+PBu0CIVobYb7%kmWTuKWASD4NfmJVle?Z#DAiB$+?Xwp4Z z96Iz>7v1XUg~qC`Yt}56GUcVw|G($!!MZZ~Da}|lmz?T1c`$>+5K~rHss>1-lp#W> zkH%tzOcS=UQ>&TYmq|!1cq$bys%)tCY|8k*CNrAtXxJ}(jR)%>kgz^+**X&yq9ZC6 zTg{oZe3|iyrek!`Z6j1g7r$Cwhpre?Cu1Sdm~)Rx&8TZ?J)69$w4qef*g>|IHn@zg zpbIak?YSeurg(!r$LPIk6{^C6X(3clSCZg*gSK4VOOOT%l3n`3ywO^ssk)0N#w>p% zD|UqXDh>o{I5f35?cs>{f(?3!f%)GRBd9bZy{=xF;Ku6z!%1s!aVB_&COATjaz@lT zEEaCKJUrsb>3)*(rfX_2ENLZ`^~Ih#brZxin~)JD-LQZrE@NU8%A!0|wVYgAW6XaI z&(;{~HF^ovo*H8i)cscY%q1?|ZZMZ6G#9L?XBb}1=s`%@G|#Z+QZ6c<8W4?vNNK=q zEnoTm!R8R|OF4~Ef>WYPO!%lgsX`+r(X41B|9@;3Wqj7Fs^=Xv@*|@+9P9c@F45`D zuOg}D*W=MjtMz_sc*npJy8CAcxJaz0Z(6Od~*Y7%3Lt)|GBGLKR`eWp{w55^HF%?l zGgsuazOp3bvNUdRAu;4KRm1}?u(rgtR81cWSTN0ngN`HT#!8|Dh5^Ld8*hZDEGtSe z)ia6$UrNfNR=+izQ&6%<$fZ4FC3bWb^!THqiZK2+v6Zw&JFH5Tjl8J3#@#RI{K)*s z)Yo|z*N_xfn|1qX+-yphTc}vAz-mp2Y;Tud05JO|~%nenA7b#P4Y zx`}HHwKZ!ii|@cNYedi&y(p7VmYK@kt>PsZb*|f&%r=$UNB|4f=pCvO8nTT2!jKJ~dBYtsbcm?=aPsmg#q(N0Dd3iPepRK1DaD!c|ht%y{EKR)LJ$5}MH~ z_00v?#{uyxpA*aM`l1<~N#j1y2=~a%I(Am91gm3tJ(f)&%`%utEOZ5DjPo*Q&z(Kj zm0r=%u&F+KPRPa+J<6P_synM^VeN#|oZ02@ak&pgkGXzc=De#iv*srp0LQ+w}8q;p5g;O*SzKOPKnCy_rAs`dBSN-aB)- zh4Ck8Yh+Ja4x(AL$y$<>Z-ct-9!U%+Y}6OhdCo7Yj~ro0&wPX-J@XN!xy+}CADaGD z?F{neQHP&Zo360&FHB1}pbEn-xjr-GdS=M^RUzk#G>gcSN@3Nm)r{{Fd`q1#4dK5! z9@?2l9)4CO6?Llqg=uR>PJqI+Z-kt$ z3pwZ4=SPk(ZNtb3P?%P%6^aUG@!3$T?ee=RGv^`Ne|5|nal71rp!?f>&oPRIm{GO2W9U{7}ewZ^-%6A?MG9oIf9O{P^|03l2%OU5lgq**s{axCR7ifxZmi{*zI9`j;ek|v+)OnQlnDM@1;V%(= zz^RIVuUrp@sf^dgY43&bmopO_ui_W4jnTxsC>k#{NqLT|>y6rX?dnqSdJ@t#4)PoC zUL}p^#{T14bkoLbxzpVa~HCnD$0LN8 zsvQw|%v0Cz&@PknR&`#ZRfV+2Cn8T4BVKFJ4odsaSMs}4J1Fh{U+VmBZKlYNmMvcU zzIH(J??k+KZL9Y65cw^X_}ZIt>ys?uxKPRRLiQ40>qedL z)V?M9NHNE2?b=^NUfb3A1KJ-$^w%BIA03h(`)$1Ti1xz}{XZt{hvZcIWXkpFs(gDi zj*~pf@r&1bw4)*VW)*o~sjfevofP?`s`G!*dgPpKAFn;BJvXX-pTWZ^xPU`%&m-D2 zIoJ7*X`jnEc}U}7`MMs`6cKZ*WHuIY7uW?8Bp#cOn7j#sjV26Dhjlck!$<29M1Rb>1TKVEW|w2|^dKxH?mb3-J#}I)3Egs5g`N zX8gmEi67~|L`d~XU?FiRIRNvN%|<%Ql_Hqsnkty(S}d65`kG(_O1_NCGBQhI7s3+3 zlq+RNI?Gir7y){WPG=dL1+EBbar1PcUWtp{KLWe zSiYs8uJcqV94wzun{(rh9w#y=d}@gsdD=sv-} zMw<5to`81PDL4^44+wSv2Z&4X562_;F`W$14+*xwz&DV;oz`J zjHvM1b<9f(1S3##CJ)nCCiG;4$Wp~+dK(1CBHS!E0pXxv1lsF@wt&H<*cLY@u4KEYFgy9EPkj|--Z|3&aj;8z4w-sc5B z0K9^I0cld+w+aT-HVCHdivA+ksAV2G}QE(=3lVCt?x8V7}{~|aGcu4RP;C~gI1N=L|fZCq~v;E%{ z%=-Sr#Pgqm_kjMXV7A@(@R7Pq7Q71dMS@oY-zs=5aJh-UTJSp1TLiP5kC^Z?CjMiB zZv)Su;0?g+dz4QJunm2~kgY>-1?ZOxX1%U4@vIhH#kjD|jJpYVvEZq|<$@c4zbzP0 zyIb%U;3mP_fbS8^ydD?a1pK04%HgkqSzjLP<2+Cmh5v>SMG5+o4q~yxvBI;8x=hRj zak%g^Y!u6F*tc|Ir2ioJsY8Z+rVjm|*x?*W=WV33jQAV)hlBNG`o9F7ZBN_@%(f@y z7{N9segpl0?Pu8A4ML~AEfLIdq(U&q4z>;BZU$!C5bs4gY!BkI$ct@290oeufS5M6 zN$^78?Zl<{hr@>-dFnvFPcR;=58C8b*Dcc+qPrhLGi6#?W*;4SY1N~8<-v)fh#Ph7+4WK7PjFe}h;GLka zG||5caLBf!insg;Aa_c63jC4pv~l=WC9$E zHe}w$d_mP6^!q?pb-zim>*EgSe*!&|{4#d1{7iEx+O0rv5qMS+Z^l0yYw;rw$B_+! z_kpKM@Uy@Tf`@>c1pgCwJ28zb4j+CNI>I=1;>R>Eg69EZPF`_z;Ya%AC=X>~smDJY zPvA$o8}vTGOA+@a!IOa_ffML-bL2-B!1k`CAHh!252OYjEZB_^J01^0uVCz!IlPVn=K{eoGSE)&mVf=fXEso=H1YVLsY=Kw!r;_nlD8|cRbZvcK-FlDRe z{vro8_Xn;3{rAGdwt7!6p!UAtZNPsO+ywlw;O)S6j!j6%1+2zO;61=@p#y5Ef_s3| z1wR3-)(WIN^nsX87U@g13OK=2_sG39RN>!hcbCT%gBs z%msZuuv2gVmV4d)1&?olQvB- zi<%*r_23a&o-HBeVI1-VKxdl7$ADeLVz;Lf--&-X*aqbBfoHzpmw}fFrftNZmcRiG z2g^;&y2J=3jmt))vo2EvBhc#tI_st656m)V;zxegOW99gmN#4IE`)~!v%E(IBhX$D zoQ|+xFzazbFaqrj!8r(jC75;kgWv*$|0WoLzSe;^}bq0$Fn(v&^`vwo`GfmtWj*1$YiPR5NzsK!cQ%Ai*0IS74%5oq@d zPDbb#>_Yg6V9F+*ZGm(s54F}Ld8xHx;B?T{S}`!?x7)=3Z-PPA{w$d7`xn71?}vgZ z*QK;qNQbgia~5FAY^TrxwI2yy2mFv=%5tBH=YZe>&<_e;1$;;_+k^+@&x7(Mo-%f{ z{!orazox9o6AzwozzGx@4$_I)UP*$P-W7t`UWJ00UXfq~TB%^RQH5ZpcZXoc-ZFy*#_`s~v6qEIl%+AV^iD%x#=!KSSjOqtc0_!|YMgT6)ZOkl2CF@4JNUj=6Y zza@AH@E--UJgR@W^#1!#p=W}g!oC1HkEw!lfYSuCO_X2c((8J)&{u(;Bbe=TyWq9J z&j<$8`UE!t9}`S@zbM!T{Dxq*=evRdwSN~}0{nsC3g8QZtAHb+Pe%Ep1#bduUo;iXy0Q0bH)x&V&@9Nl2EcRUWyA++i2tficd2kObL1GAir>q59ua2LXQ!3Z?E ziR9UXkSayYva|?BptTBq0^!dDPenK+cqhV>f)QxH7W@FhHwCk6ZlcVWa$!2HCFRSq&XkBU+8QTbuSon9%?=a+yt!V zgTUK?|71$@UBOF0|98PTz}yc+SuF$pLT~}Fg*E~7Rlt`ErcTWgycSs5DDd#uAoMEW zV!)|1!;Oqmi7Ax+AT z_!P=R*%|9mO+x2-6!pfiGxrHS8F3#Fyc2OBA)bYQIQHPjG`|I&Cj{RGo<6~6V1#k1 zB}~_4bE{wk+UZ=UUJ(ALL05efbjmV}`U!jpSosXVRlv1E-vHbucs{UNCy_MOItlP< z&;!D=7Wgs2S-{F?01w;tw9o;ycLa9<|C?a8xs~I%q#q%83Fzv+Gw3dch9>t9#Z+KLE@&#;t0pj!Un~m#yctu4rMohd7TIQ3lBSf z#2nup#NQxQ*L6##juQ|Vc7QHL0v!z;G(*Hpli3h6y*YxJo|+$l9t&J0bf(9{!od*7 zJp2+ENsiF64Im+=6>8Hm;Fu+oj`9cn7U18YvNK5+ABMU`o@h+ss2_&yS|;=+2x^t! ze&Dr&9|c|~c&u~8rcD4Y5&ECNQziIr(Ak#E>sjFKf~NrAC-^4doy51`9}eme`6Ez~ zF2O0lJ%U#PA0l3ke>nQ^BmY*=`-zz$jv@R=pN2ZVPW%m0^|c*i-{X5YCr><_#t#M0 z20lyd#XlSu@FUNINS`*1_!^{XH!%3QhGY2}xzTPyzXd$Wg1-lxF1Q<*`&*dKB+TpP z6Bp`nxlT^{LeOasiB|xx6}%pp^C{9>flCDM1>Pk12r%bRE?*Zo8IC+i( zb8VdX3)Ce?@Lzxn1pm7Oc3E(a3p!7Hzn<3yp}&lFtPp$>{F?;-JLnN$O_;0mv;Px^ zBgAm5Flm{5tV7Ap76VJ_pa}eGxcp1V< z!K)G02xk9Qemn9i0Nx^WiuYl`2=x0w;F$`%Tj=Qs2L;bW_)Ec=2tN^wK>JMae1sPT zXCY*tV!f6Cju%YbOcDG5!s&to2(J{p3gMH2nM|+XO~B6xrYWGVGX1xJm46P*kAM})os^q&YW0aoKac-ST%2pv%So8Ttk{}8+#IE>>U_t zCm2v4>k;>P)Ju)^z?5IL@UTy-u^V*CuT$u6Bkmte>HJafJK#AZnEn25g4yrG!bjw0 z6HGrVN-%A}SixtJ{!GCvvsW;n_I<$>z&^oMzz>>u0)nX<4-2MloHp^iBlrQ(|4ncJ z_#Y;o{}j9j^iKu%07s+4Q|3z1-}G*onXejLGTdhs|CLf zyi;%{cn+EPpAx(c^k)Sp1D`bU{95p8r1PfWwZQ){@%*RYb)bJL_%`6(cD=qxQrjaq z95UP|*bdw;nEm1pCjLJP=DO?|!Rf%~OgtY8-hjM55nKX1ESPOHCQ2^@ZSXR|EYAwT zRiIxdm}B*76MvCl`WH2VV}XAxI02Z?#I}fo(E(0?a*5AYci51*Z7I?JFN?+Y#f{=13iyx=U*KQqz!Tqol` z&&(V;X4&k5UBK~z>8nl@%)T&LFjzFV;1bYN1y=y43w|9uS%S&GSny2nEH%;bu`pGh z+dy9_n11nEg9n(;ZX4~sMev7^$#(>w1-?h{$G|=l|Gk1~6Mi6=Hh~BIb{^>Z3KwE- z0+!Kp;TCd?%!N0@*-pnftR=vCPe8~nLCk~YA%;t#-=hR({j!D5`sE3ZMYvZm0yQsY z+^N8i3!QcS7r~7Cyx^G#-w=#I-`jw=%Yc6?bjsk5f>$9_dji38AFx^*2j-E1He#--D`F)+)o*8PB8z-7V%s6X2U zdKNJ41>-IOW}hd{0lvq?-y(Pe=&gd;p7#l6UJnSa0Df37p!Q?I+kw@6f28mGf4F=1 zxTvmkZ+y>{0k%3IZb2{^Mk63BZcv$w@Nr_gQ>wUq z)|{NqM}AHrx=QD#v?QK|uy+ytq;8+h?P*U4=|arCP@IXs4*VDjNGX(X^rRnXE1r`$ zP2o@BG{rrK(o{gL)%*QxA8P6t8lf3`LX~J&hH1Tie zG^Je|rzsv}gno#R=*@^1$tv{2^tOXIby3K{G3*fF`}6+F>-wLgA7<$-;C6n(P3<>`8Al9Y#E)H>NAlB+KL69uIxZ z4)!k4oAD!l(%V0Cnq*}9fjyZv{D_Cb{2r%Cb}}SC8KJAU5tplU^)EUP$wd5@z{B*z z=k6$MvUeadOg|Jj45bIzXTg3R(Ol=n+@5q^#%a>|VorYt{P%Er323HUs&rwPZb3(M z3p%1(&?Nf={8B)}tDZkWlcD&NJ?Z&oPE(xNye{l1P8Hl94`~sn^YHv8rzuWeP8Z_& z45#tX&nyGyF3=QJ3X9^=&gmt1c5)gI=|xVv@Z8I3(q#{)NtZ`BO|r*RT>(te`9lb4hKz!)#0EiPOJ_GO*$qMo9>@MS)@BrMo34*Gb@RwHRz3?Nj|ba3VxD_ z=vL6^3P~w*@ec;gE~80)cwsd0PUSQn(sWL{@XX^hVN)Cg&O%OG@w|i64m?SZg6Dot zLj-&&LboT`YdKAEdW6$>=yeX{q;zL>4rogECj1DK_{mVb$WVAh)4V;o3H{s-I)xGf zhV)A`$;t8zX!6JM3~2I4`G9yxPT~{z3={ZtPbawve5U^=U;#t2iv6e=L>J>9%w+sb z0Y*mB;xKSXpQ4VMNp!W&Q%E!~%Vk6(+)u&3m}r`4gdsV}p7zx*=X6$bbZvAo=#AX| z+nLe+)i%&xvZu@rqv1z5-LP-t^l{M75zXs|UEKb%3+*+h74U?J-hqEGFX2Zxcf0ud z0%)o$dbxcb_+KM>DgMFq;U~^14-pOiHIVrfr+71r?WBD0=Q$Uw=VoUQ=fZQwb^Y04L$ zaGEe#Uj=eDf&QG^Zw5_cZ<3#Q(mCA;`UXz#27Rl6hsIIF|1#|7a=I6^kJDbzod$lk z_6q*>u;0t=H-ct+x_G$sZ5+aU7WVy|rhNBnPCo~l&Bt>7kGTCY*ni4tmS0fLMO>_$ z&IS+L>jl5lK(qZ_pyz>}VBnv~>GxpI=5jeto`L5UPQMKvs#7SeGoXt&od^0`2L5VJ zFM<8NoL&z40Zy+3{h)!rfzzvD|1hT;K+{=G3TrLs|HbJL=slc%3G|OSeGv33oL&j~ z7o4W_9pH2^=wETV4D?A(SAhOE13!J+iNd`L_G~U1^gW>2{4;3c|IonyCr)pJ{a-n) zf&Q4&q@S-1{3ZxR_$Od*<@71gahxW8GGZ+Z)~rq-JDJlbTqD%IKOhc1?)!#LKY&LH zXu?>@X$PLGI8AtUoOa^*9ZsjGm_pp0^$II1lYREhd`RlVwCdiGMJQ@gsR?TtI0|aWw~*VD4$ves92cIf zJq6EX&@3%LlUa!$g_VsbOAFAXn>E~?@_>)ic(6Kx`0oP!U2aeDX8knSlbl`L9uL+w z5&sg<`?&pbJXu{0dl%?maC_4IuQ`o}zDEu`6sNbjJ*CM-P8Z|(DW@q-*q$8lld+rh zcvXOAeLvV!TCw^Zv z?|8Y0=6R3wOZL66w}4J5#XlIrA)3M&%V`Im3a2T|G)@yQr48|?;K|aL`(LhttGM z#?+)gr{Ix7g20TyFNGR;7#0`Mj9Q7 z)WL)iX^{dUC*z&;e9J%ugy&j`I8f<1*tJbwaB;feYX;xhXm zK_Pb$&GS6vG2%Z4`<0xga{&#UrgK>9IURqa-Zvute+U0&vfqn;FdBYjZ$`LnoPHDZ zE>3?B^lnaM51t5-pjo^Iv#GM+5$VDAL| zO>R#*W9bNc(iz1|U_Q+0gLr<2(z`?au7w85?nd&J5$1x7kHkEASz3e5s%F;DWpd8*A5Io6YE-zTC~PUs$nj z<6{yFA@YUrYhA1@5RC5P8}^X!TEdQS``n5s`$%$M-^W$j7E7-+q z`bB5gN)7rBJ_O|V#0}#eNogap3-NeH(62N%WK|MdzsLh$vtL0MzO10DTt-mANL&J) zP#)DkqR*6o>&J1C+zebPKzAG)<42sht!~YuEAXB7^|%vWd{BOb5J%<{VdAEHx}?Vl zE}SS3e&3o%+Zg!kaiToqc8X{bql@UMg!5}F^b$C%@UoBf>$iRB(T{kBknFm0{o;*S zz0=J_k3LNIi^qt^QpMmZ#9jTM=P_I;jN8TNGycL?Bu9%Jz;7x63$B4+H`EL-AS@Ah z=DHT|Rpsqkm!%Ge7LrmB*YY8Fpd5C)!J{Lnlqrl|SFj#8E~CC2iHQe5ml|A$ONYWW zC)eTONW++-^*Kd`ZV6n$t}=ln%t@5NSXU7}W=|JbJc?*GUMrs>@maki7zFAtlo+0? z(nh~7hTRk&Bb*WDYOYAmVK;TM{L)DE7hTyF14OYIiAw}PiHTd`*GIDcD!tsSi`sC7 z;AY2R_f}j>GkVj)uN;(SjHH+tmS~CzsVGR?3bJ~|bzz2cjEth+=}k8xqD5Sfo8ajp zj^P=>80d)Xu?)z#xLJx_%t6&4U0@SYA4yK-`OyYkptgdp7JqELUO%H+WVISD*IGA> zon7*Qdw0S1$T|bh)h!TZIt0${aQ(ZC{H|9cUsOdTrXJVpU3WfQPye8wt8zJo!|pFz z!7eHrq1G@~#4NXS9tx4&6NlQC+oMPJ;EaXeymvaPpj8h?^oVR+hi2u`2BQtD!egwB zRWV)Ct4HxFnf2>iq6x`ZN6N}0GDh`m%sRRxhTIVie)L!b=1Im&3cFUYHuP! zJU!^Xt81y7JjdSmK3s1CjI=Wnw{S;b7`S~Wn)1Q}tB$V~K8wfjyNjuA@=CE~}th!;LKFu)9xgQ6a3a99&`oxnz9yb5mkSmHWxF^ocD zUi?-dy>)?v1JW%v8YI3BgN7DODZ7g_CdljYFyV;-1L4M6Bns-e6?7S+-po=TyK(gh zc>e(VReI5j{)mtwh9t=dY*#_)U8BDXH3HjJP`J?xJwMzs9_fz!UD&_lC8ASGtms|H zBf?UIufukgw5&5XB9c*sS96U3L`5_vWrt%J7)J2E>Txj&6?eH_AMM)wSAnz2gBR?7 z1bk$EV`Nz8apW7~u2I>O3a_gjIExTgvCGjp_f@gcGvO-aulfg9@Y?9n^$)JP4*K8m za#axe(B*#=#NY8UEC^H!)I458VBtzx8GW@G;KPV;W330zP3zdR@e!(0W~_R2<4l0) zFW|wQc{IiNkD6Ok^mQ}AfADSWQ-Yl^mGRjW#yh4>nH%||b3#VEV%W{VPZ)uh9fQ|vz@t4h#7B6~$KcU?^+@uy z#o)bXz@xQhf!7#=NAuRx@e_vl$gGROqmOM)hCRiX*8K$Dx1Gb|`x4xW@e@YiEd?LZ z#oS>s@Y+BVULt-1Z%z!}pWsG&b%YUkx5nVT47^KVBD_)f3A{hV#J3lT$)7TrN6jKE8Z!Rth3*~R6fb#Q@~7?WR~gEAZf zjPuc}Jtn`*drmJ$6yJ2tN9F3@k=Vxc*af^XWWkM)?_KZ_UCiw(fHxU5;bB=ZBHyCX z!|`51T~!QsVFX?>?2Y063GaD=2~WW{3iifu*FG05M=s7s@%S6$HsWOW zwJ~@veINOc=YuI=7I<{-%80iT>-b3Wh!J>n{($IW?s89uu4j@j8$W?Z=dX=;>w(wE z{m?_;?T^9R20U8NBfP1ckK+4(Q0R?#?*lIb_QD9fbKo<|*Jr?+24*4O>oItgiDwHi z&PT5UF?e4B?;hBbd^7M9c(jIVl&=tYi{UPekdMx~80EX`2l{$F;Zc4ScSL5s>q--0p9Cj;*U z_vG59%>bWK zzNQzW`l~eH*<$UMjdKzSy=9 ziLW~bZzJ#!<%kh@6Jzks81TMjz-x<%Zvc2ueZ&a7XJX=e33z$nBKfNDBReG~9v|Xo%vUbp9fX}Q0`GlT5M9h2mhaZTB~5yveJbQect`Lv;++B>eM4Os;v@4j z{ET=@_F%6R&-cr?8{s`06W?7qx<5EEBk)>c;_D1W6cV;8lR{*Z6(MfJb}9jCk8_*8K@c z!XWco@EP$g0Z)cK;jPDy+~}Rkpb<|4UMcK_5qLk1!TZvH*9c~T_fbr`od6z&E)gT} zo{S$J?m6)FN4TPK+6N(x^6k#k_c{tzf!7sNKF;K$-vpV35q!JAM|3fFa2$w^r=Nfw zxshJ}R}9`_6kfUmSr~!0DF*MggQy=dCMG>^!cXAs#`xJ7kBi0ncrX_4N8mHcmx4mx z2PVS%C;SB7rWm}Y68*c7U|~kcw=o9qZQyCp3*l|SPvFgn!P~e%chk|LG=1OCDBtp5 zMDx`@8}Pn}Nw+58jg${Q1D_GE!GO2bfH!IMaQ!_Cyh0%y=cCsfz-PqU2)wnhr}#dF zpNQ}0G4VYHydT0{7~&)IX-s_20k04Cg!eRl03e9eti!$$w&2!z&jR$S9rUA=7liG2)tj!;GF;-nh+M> zXE+}f1Dd}v#`ihkRg(ob0`I#qcpC?>=NNn>-*)_jeBVWVYQ(!(K63if_o zEs3dLmVggkvxpJ$or~!otOXycn1~U4zmMr39Q$Q-T;T_|h{vljc)NhNErJ%+Gkx=h z{1kJy)ML?cBc^sDcqT_oe9x2G8-UX!{lbGx1SAu*BqpUBJ62z&IbhehuZ5pJIA}DFa@B=L1Z2MDRWUpHaST zm6+!gLUBIwe<23%y+Q1$w&?NQWx!htA&q#u?i{&2uLqw|zL(#K#+T{^5#NO|crOEQ zGYQ0v5VbT0?-KB!8kQcNcnZ9%7`(i1j+`Fu7`(zaqxmIhz)Oh13jmM4T_}u@&lZDc zJ%MomPmkROJT#-j^mpuA`dN%vylLD|F?V?RWVC$jwH7LVur+9xmUKyYzes7G?zAr{E*HShtpT186d6!rPCZ!291Zc&mYT z3-?10f%oeeydeYLO9s3*5fNj21Hij!1iWAjUmy6KBk36H$y$sbnGE0wy}W{V5fAzcFYrc6-&e;B54Y_adigo{jPWQ&xGNDJr7ya8k$7~(;2i_rPv9;LVUT$~2Cox% zeXu9I{|`T*mqj3qdf8a5yMcunfmaTK=wjVkT6rp}=RVkx8|gg{gb}X^c-^oUhWN

    • +@EY}OK=imG2Valq@4!UX{gYmL0U#M za{E2*eJnraCtgeEP8YdCpUSxcaDtdk=z4zVff2oZbf@?u7_nT*Y3L(;G5e7B?%39H z``5LB@QfSSdrzP0fAJaW7tK3DDIT_$`L{o-5jQoQ8~^$wcC46M-rqVLQ{n^VR!xK* zi(O)Qxi)aRFPvPWEem}R+VIWnZhxu{xs|Z@O7cU;y&sru9Q+P$QYZgD#_H6?dtj|h z9pf4aY|=zm!XfR0(BI;ZFsy1}j>!JN*Ab}io-Edj217XP*MIWZrjrYO{?@%{k>hMo z?SWJY+($*Gy9T(x(VFnqNyw{EG>5|WhgNfq5DjYT{(cHjlYLSi*ywDVN@$;=a_ z#}*u2cq9)#fFrvHGh^@6eZBte2idG|o`RR{@X_f0NTp}P^K2J>o*@3>=UI=x_<6eU z7e9xu8?zPqdqmrXzhV5efnsm6*M*5~c(Jaz?hUcSh{d*0dktGyRaymji_=`-g}UwHkUQ}3Pp;Kc8aeRT9_@9fQYZH0%nW&c)u zudyJvPukY!`3j*c5ih?6@P9&rH#nu+^a1y6PBJwq*_#y7iex_ecH{3tb>?VC@H-*P zKcTf;D=*ee%j+u6RTM2fxHNOwj%CiTe>$(O>|9yV{DbooQDb~BWCX3UN$TWfB!zaG zWoz#yg&Iw+w0CRZ-%sg_mO?B1+^(X<=1AjjEyKvQMT`8Zrk?C?-HeSu=?Z-{JQ$jy zrK{`GsM{%pJF2TXGga~qSl^#qaBAVn#V3{>TY0qRNZsKzLoY(|cI!rd`*2UM&!SLV zj_*!ZkS9`K-dHiZ&XsuXx|F`set&C!l&z=SzKz;Ig4bcLECwePCi>UMGe^de1b=Jv z8WH6QVcr*eZgb!4;3VcJqG*bUh6!aWl=s~l-1rRMiX|4>p>db)J>y#4di z%N{QqF`vFiYPC`9G6P#wYWC8ItBgJsBRyozf{VSs=i@ACW{AyS8uH~P(%e6xu#d-E zWpkgqHx~8IZQ4L)Z*)DWi0 z@9;?frPr8aZ)l`{{cD)H41Luz`aq4nmgMiczZ#Ao`l?lzEKVWW>mQ0|!9Bwxd*b~U zUtur8`q2Br;CF^cdfb;++9~l>Lxqa9LqT#2wP@_k}MxToaVUSFv>B3PW@ z9if30?&$@NYN_!>U~f&~>B8A1`%7pfRZCfTWbxr;L(w*vtlq?MuTQpTLOI^nWEGC` zV-Kygb&@|lAgy3HDdP#($j&Dm8Qsa~`zgUmaie>*YBCQ zJK2(mUFy7V?uhO=;hqX8ww2HLHgc3Dq5KCR5eu`cFq#@+rD1NbzMG{lIIC@tUix^c zc#oJ`;F!AuK4mC5G&k&=iFcWQWK*1;^s~vH%;98D)^Kvyq2ST8DKmFaIMJyMcruZe zbv8N8>B$C04q==r*y`)s1{^@vSGO|{!>92U7Rna1_|EL^x@f%*zx{saJL$j5yioeq zf^!ScEIz&L^_8b;PS%}RbFBGjY`y6CmZcZy0lu?LFY&L>h#FlmZUWOP7q}U|mD>xZ zIXx2(tV9i0s%g8N8Jc5qXeIUH^JVwUms%DIyj1GiQaKRx^3SJiQmI3-FGSZJy%PDfGOOf$-F`1-Uqn51kJdE=-A&Q%}+j1;M!Dp#lI?9o4wV){pVOg{T?Gdy1Yx&N7m*&rT3sb@OgcaLK-8*h|}-n(#XJM)q9$x70^`{SWhM%1)Qfp1*%SeOKKYOL7Vw8NMq2`sf)l z(e3|78Xcu1v%J90^i_GX53HPeB$z>x8mk-Nca;CqWX+nPxty1;JQfJ|3}5G8 zbq;TG&tB(mouSbhvcH^Gy7S{^6!^Vy%*sK1$KM*l`oQf4`TA}zQO*rv_6x2fM;)xt z4=laE=iJUSdrzNu{nV+`C(oV8?sjDBqjIDCfw!@Hz_KyHtT;Yz_HTccg%hSuO+|m} zP7e3{_LpQmUD!K;ojdOQgs}yoxrclF?2qhdkL%4I%x2%mZ1ya)<;bXDW?`~pQuio1 zLw23RY^R`%uBEyiAsC)tX=(A>OZ*(dz# zKV?Om92rMaT#GlcG50RH*OUBhwk!D%^Q35+$El4-O|bMV*3Kc)#avbhI#8k`ZAJ{$6a`hDyL*GEDw$JDM9RiN!%7H z8cZzG{M*qg6AMRKyvEYJenumw|8>&5!MJ{SS(wvYny&F15eA5E5R#y^1Rlm77e{d# z3l?WE`<@l@W;%Y-=UX_GuFP1`UdhtRVXXSeW9Xxcdls19vm>K$lq0h{Ij3+z|AHN! ziLmBdlkDU#;>lSSXAEsXR>?N%upMk z+|MhyucjlFL$Q6E{-H=qni)D+o>{S@!nyR*lDg7!r2$yQSe*F&S@pbOE6x2XGz-gWT(nU(*HrLBypo23xsr<>qO(wyN5mBA6;+BC0div8(-80L`$OYri3@1 zxDq}auk8|j8J-L*ux5BC+GWGv7rWhHWk!A6`K+GXAN$>h9vEF8c2@4cXIxYd!umxt zzu3L-KUBMVJZY^jBz`wsbJFCmUeZn_z>X$UvU7q8z| zYu<~I;LyHMu}^#V$Z&L9hMiA88S)*Pt7;zUYOFTD3``5p@@JxP-|fVR`7&0RaG_GI`#+~0Y z>B_6-`Tzw zpYlu`GtyD4NA+mF{&_<6U+cZvp{(VN<*gMR%Ln5Rc=HnudIvWh^xA70?iurQ(gWG1 z82fzK`)k;5l?%t*03%Lv*T%p>e)W*lD!CjA7iFt?jG!6J-`k-)8o%? zdwbhseg2E&+jS?rKNM} za`m1^58K0D!8%HKV?2Bg85&HwUh}U{FjEG*)1v0O`Wjl*Iq`btQ1)S~#?%(|<&LZ) z@$jm<&t5ke`i$kn_WN58M)4bVmYxpzvWGH}|D5TAgyY@b4u>qOv%EMsu{!~E zNZR}4@?-u>@!Gj3V%7fg={{cy#yY$FYtMKl#wE}g;0jG=2YgdXw1Jn3{gmUz>h9~KU-#-8n=-!R8>!z=vwrW~z6_WLrQ-rL`>HtUQhYht`7dt!XfuNr?9 zj&nYT)$wu{DCV5WdaM2|PtL@68aX_<6XUxM#gxLosQlwyFO4ne4ZE;{ZE7UoH27EK zv!UOmo{R91Vo}|5O6|egz>H$(Rl>s+*-zQAx$k*K?FWPj%}Anst@#O;WAvLdXVm^i z_JPZ$^-ob+!^h;4DlZLmw-@#k2Y2gL;m{{oi@1zd(V19dwsS}M-~UBaen>eA6PCY( zV`iG#Y3Ww1aVYG3@E3NQDSa!9i3yI(P?BCq{kwLBD^$x~!O0=Ic_77H)zIE`g`Pm% z7$uH&hlm-m@Sc(jEdQmWG8~%8Ts;Tb0j!mER5sq@>Y2&#t#~6m7rw~7Y^U?>ZNa&#VSyiD?_uWpMjzSc`H%Y7 zzr_Y$d5d-ZI)CPG*eL1|rWFi2 zodr)n>U!lm7JkJU_sFB#ue*x$xu^@Mg*Q3B$RGD6>{$Xk+(W*yFKO_}H(B`Tr&sjg z;Nmyg+uK}k{;44Ufq2ce`Z|U+TeQakw8#4>>nzH;|91Q+lrSy#jzg+l>#Xnzm zeC2C3!*xGfbLgXYa=T-^326#Df0AsimN+sJM@G-)!_LoB@#erB3p`ngNl`rPwAzv;51lxYcgi8zrQy7S1x^pEBl;Ff5DagmP_xuF8jjhd5;BL`uwrk zCtZ5e*z6PMOI&)&*z992{l@FEPrrf#jN!f%R!t`;QnQZ+IvXB-BQ5uJKo_&m$lbz@ ztllJWk9Ug+7&mkloK&K9{VeQUF}V+%*I~z})NIW6-t|mOOn`hddhtg0Rru7$U@k6jX2(}6F&9$v(x4 zID<00BHcOIgnd*O@6-mn?=0|NtkuGsZfDTN8zRg6Xrs02LbSr&Nz3#?I?EI8OoMG2 z-Fquekh&5Q;Qu#o3V!Frik(k_^R!4Rvi0=1m*V`XwVGqNbZJ^|zmVvj%}b@nN#~!0 z-#hr>9(KNPM5WX~|Ed|9o^ z9-iE|DQR?~j&vlKyeYbr??7+EL!mUj)I9`IDqk1+xVCx@0h zCJrwTJDa9P%0lX%qcRci^mjvAZ(juiHo*y9arX9MAB*$cb$CN^afY^6x$)JL3GG2& zw%QwBtMl2b&_gRuy9zHxjjXy;-46J)fqrEqAkPiG`_@o|CA8XB+BdSb$DP>!me4WI z;tV|=E8G1vFUKy%BAj$d-fmb$VQD6krHO+@C_tZ_p*i*xF6XxWxg$#s&XxLj8S?sl zzFilkOtpc7=)*~eQj zoG(#z?|r(h__zM;FQW&Quo*>uj9OFp|Bj5|Wb*e)w2%%tU@d$P_BaT;5Bhh-rcXYW z7?sYK7~_&Ntk1wZlLPR-uscGh(sm=hN;kabXC!q83K_6DRim*nH6)v*Ej!9dVraS2zD$V-i;oV)wD*MR)bin^4Zw_hj z>*nKLVL!up7Uv6|tJm_lllqp+IRo^&bjRF+xcxgk=^rM9H)b-=#2+|4S;z6#{JhhX z^Jk}rz0WdzM}3Qnf|(`px!9G6b(P%b@n-sXf@eM62d$^Kl#gxlZ-?%3&I91Q6O=>X zt=||w97P!0r)*j3@EyR4MY?n8w!sh2vcWAF?`nzL&nHIq%u|Y$M{kOEg?`Rn(yete zvU=gp4A%9oE8s)t zO4KjIox|7M!&iLI`OvO-uLZ3lPYi7YdkF91#v=GZ&i$dhen*kcbVzTQYrJdir`V6- znSuzUw`Jz8x3YYTCfLXPdEG(5iWJXs5Xz7=#q)?MRaT z`={skg*$!Bll0vsuNdnxU58`{mMo(c@gFapN?0$K!11QC_RnGebWt&#w4pMbgsGO4gKKC@r1$!+F_d-z-a-|LKbPSPhIt%OdB3>4o>rkBURd#$GGV14cz@jbJpXl8l zwKc8P$ajj?Y8H7Y6n~cMo|pmAS}xw6;u{l<%Y(1!@Dsmdtsg=wi@oX$E}@uq`jfV5 z1I5K=DeNk5duOX_lzdFy4qJc{6M2bPv!4r&@OC>^9eqW;zFy@$Bv!DF>a3wNRD`kp zDf-TaKXnIo8pO_hpeU;BO|;w7T2(_2VjVxrOM1(9w!+R>5{%u_ zp*gYRFT*E|RkQc!MDcbJav8?#$LV#FXVmp>tbA#6)fG*?>aY&)Ld-Uam1l-e&BITt z$65u2P7N2UTye~&V)Gx0;6v>56swlBN*Ifa1CXmFMNS)Qxv?-iZJ0DOayi$JknfK) z+gs!8Zr)2SX+sGp8`?dJ-ilj$bZA$iUM+Le7j0g#ea}W;6Lx-93SBEz-|b2NJM2uF zN2}J6U$w!iWXf3|?G^F3E3gX!GXQ$~$ucyxp0QVtH_sy+%jQJOA?*C&Jhjzm_0(P? z`+nExJ&jba(lToW?H*qcJnDD{zZ+a*Cl>Uq(Cg|Q!>sp&`+6;_X>T2R6ZHLx>>=WP z!KM?YmGY!dM6K0R7uI`MXoK9p>%34FRc|wG{Cu^(k+rq&?Tt}Wtl>Wo3ep~ac^jOc zZ|8;VqO7s7jFNM*x0e^FZ!QwNWy_}))7v|JZt`2LL;md_uwYtTVnJOPUuVIN)%3U| z%w@*CoPc#|tb^j`j!V+slk`=}XYW?IHOF2Qg zR`WS-$8i?N&*Gq~H2Ut}9KC~*O6qS@^+(lft6#wK_M%tNh=3V^7}J&1cdhXIv@TKZ zhX;ck@A45J;n?YXg(oA9>r8jTxnBRpeaJ;C;HAns7e)fCkjEwD>oc%!zdIpUIX^~e zR5$GQNm$SyZTYEwdphvGtVEyx_Pq0Da<{nN80hS;45!?HwKaWv-U*lU;kvvtE@$%U zywm&i++$&V>zdq?Vf~J#+*9z5%Cle3DepRzRkor3bN(HU1aC0IH`1z=YEeY3@a7#B zuhJb(Jn|Tb#xKR!5R$8K`(L?=^FZ4W??E}z;`}OvsqxGRw=%OBUZa)Zy8bP zXWvE2NUE9hnFea9=w0hV>nXp6{o#c1hp5$*5d0>u)1oc4msUcsa+npDL=unHm-`=9 zdsu8OozY30S!*&2lrQCFmhLEZ&iljHYnGp0K6}Of6&bMV`{1WRGvA_B)L3O!uBF}U z0;dbBHL#1(pV zpC@Z~k~Pj{_ulXOxJ2r^q@Es6+2ix24+U!ft@7>`&t(=Y8t3;;)%@N8?DbTAR~q4C zaT=;sr4s4E>!$y%^1i<}7duAnv=T{b8*J?!r;aODkBH@;Q~u6iq?Tc>OJ^J-#)Yfp zeLtw4P87SCX?M3ePQ~Im4PW%3{$#x`)Fqk8qE1;X1Bdzp>84$&Mg zN;>fFKa4n^D(B_IgK|n8?`op*qQ1VZc3Ii6u)}hzsxjn~s=HM*^UJC(-KWd?xb*Hs zD_rQX!f|mj9M&1WCMx_iIS1XaerjdoAv7SZU1&|XXV$o0pQTe)KXqi_ z9q@hmq3?SAtr=Qhp*)uMm}Y@XQ^C0j zEL`*e3(bCHQT~&s+2>==KkDCJ#|B4?Ex_8~2H54p0xR#yZx`in{J90h8-#R=G8UX8xL=!_f)h)@bl|X(yyQG?K(8OpY-R( zqQS+(EVQ}n@aJidjO}`t=1H{sDOTIkw-0CqvatldC%$SN%r0~~a*iZmH(IhI`^YuH z$#JPst1tJ3ofF;@`>L&zfN~5BJ8w49PAhvUT>6m1zbd3f_v3jS+iatl<8Q|AR13#< zAr66rCD0K?s%j(#z1&b^xaTCtUS?wEht_DpdBcu(o*-`X^~M5M!i*@6!#z2_ zA%5R6cO!9|{JOma?!o+ydYjeH?E7Zrw+E;{gyYUeaT)G;n3uJ8<4Tju1n(X5>*wzc zt?W6Cv(g)$)D8u(f^Y4=Nb&u-@{z^6ocL}`@(*w>4BzeYhV|px!zK0ebB9LPmG0Oa zk~zhDi6~9OIPwEtuJwLSwn5l=oYyI{$9lhGrG5DCq%l@5Rexgn0byt2f6$jBNBFS! zQ!A)@Htoi-gK-%Ju2A6@d;2qY;GD=8u8q^L>`Hl_9qPJig9|6~cIo&kjuYRuiO2VB z;*T>=!g=NyiSS5-lh3ngtwH4rx^FzsNpH?54PVT;~N`l+N#?gyv6+fI%^N$N|}bHK%2Xx#hp>>Zfa)&46JKy zXbaS`JMVIH=;2qwcNMZS4UgxvD-;U5j`%du_nq z_F!vA6|%59?z}o>lp1K}s6?GLx41jns+-Ð2c2xHxBRLv5gzI5vskO1!VqN?v~Du*3J%hYxRSTE!DMbA+Mm@-_qO>Xzp-lJk*KOTHKA* zZL0%0?xyN>4NaX*6wT(86tdY|09IKbEh&RdgQw<}4v`;8EuE|D85#{m0->qeZwjfY zwyGX*)w*@-Sjl2{XFJlf8o)(cb9LinD~gMwsi6b;C$s9>+J=sX7GSt*t2?SiE@Gm< zS5U}mY*odF_ZtJv?mLP79Ct&rzp=Bnp?S4?s=MaFjzGJ+r4C{M#pcx}SN?|9`aoM% zb!SI?l@xhkT?ebK17otPv)moktJ#7Uclp8vb1h*gtz<}|4Z?0{4*boGk@QX0Ae8Fn zTHYdN+*R1+`or4mTRIzS-OT~qv*fO?Zfy-Tv(9#^u+*@QdWeG>VSd4!NobBhNA(nv zBP&LP+h5)2?`*6l`MT?>8ye9kpt&+HX(yD`&}*)&U#f>{Comc#i|RPpeTN&}uCc-2 z&{5T}wu)Mb5+=Kuf<{;nw32A(39BfW%bPxCv&llK*=*FH&ROn;wV=pLBmMSUlZ86gHVP1=`!IR|ni&YG66wH}%*^0SR|)3$%&UzNxyyUvF|{>URVi85x2F zqsBMg>7Hul@OSV|L2_3G4Y}6^Kp8rWj>Kl8|95h>puwuqAsbiI(2@l?wgv9*475Z0 zR=b<1|MTwBQD2RwZRluc&5(}luMN%a_Ua~qvbwFhDF+>+4y0!BZr{+1=BX1vj=Q<0 z>VfKJBMDrpYzcE(U)@gf<0iF^4CGpFcF_|+ud$QtE{yV&yF^-+Oq|TEF|ZhTtZlEa zzAxY=f)t}xu`SRZXs(SB1tZ+p*n$Fiy_q17D#AE6!?a}78a=B9#;>Kh@j>3P9tc1* zMiwyy)HQat*BeHXnjr#~+5nwd-BHiw17US`SQ3(T<4o37(Vs8lL3D1;3D7(29Eyig0KwCqH94+m`p`B^e ziK9oCCI>5XfSToQZ+Ivm%)2^N6;_ljiq38gY*)+I*@|uwsNzF^duJ0L=neL`ITiQB z*(-B3Zq15_(STEvV+vVQC=QLpB6Suz#%j7GkcKOaR>oax6y>Q>IqY8Z^RKvOjuy?J$&;S*G$ z%agevTfi1|G&DAXBcu0Juf@PnUDFtVDRTQe+uEpL6Is*T&x6m4=P+R5@X`vdOgPROB+WR}IvEcFhPg6ueTZ7ogklG;0ro{8oaO$D2A zzo7%TSrYdkw$xP_otHF&)wZ>?wo=nVv{PE@rkKSV`5~w%Lgv85Dbzt1P!*$JqgJuI z3(II%gecJsqnFW{n~Msf+8DN3duNScql2}#GzO&IVT-s&(mbgHgvcG4g+bEY)`FTt zSDRYa24WPz?J}26Mk}G=|192Wt!^~)o#Z93^0ol{@4zhg1Jy8akOjGbe3-LZMl#$E zq1{4EMl%CF7k!GT!i-H_SBD2}Ro&hmXo8YUmzK?^A=IL6NVuIk0emX63lo`}xkS+S zLB`Ba(-7)wqz}fVAz}z4(v5*C*>a@Z5$T3uGC9D#nAIJf?O+vtGd$41+J=_Sb_{B~ zP=gHhI+cm$mgXrY1*s*n3QY~Q;D8#mT2+lGe6y3xnX^dJ$f1^z-h${t5vj)H0vJ>C z)>#TX2gFwg=5UXD5j-o>=yuF^EJ34wM#nRh9dj}Ctf-7rP|qf`80KIltDC85V&Bt7)sTE#sO+#Zt$AeItT2ffSc6DQ*4PKn+KuWb%!?%O$WJ{)InkDTsYiK9Y z!EQE2;<>Y+Wbi*G3k-i_3z`hhVnZDY7bS@l>KlRP0Lp3*PB<^ll2<3R$8bOkTFH6l zScT-jL*4l39l;<|q8c$NXuK0W)+iA{QV#_~vSN-}n0upn++s%LZb!)xDk(-mQ$MID zS!O;)UeM)pW_OGObGTHT7juKMo0 z_d`!3JyoNMRCh26xq+s@VAYr?`T002<{s8$pOheyjP&hjWPp{&w1*rU?yWU}4pFUd zK~Laa%j_Do92Sv-{Ws`X3pZGT;zn6;!8)7oYi@afl!f<5?h?YTk)4ie;QcDtszo*9i6~}z)x{P&pzq~E525SVQl!2yJ3@=9CBr8q+bc9eM z#Ym$h9C67Cjl{L6Mh6t2))IX#Giu9Sq-yG-5H+`Hv#h#NMS&-rR%jBN)6z^sYn!A_ z4img8tY(tQf;-h%{UC}lxJ7p$O`rurT5tqbpw?7!8ro^Cqdfp`+;D*8Ou$gEl4dCc zncJ;61guDS(NaUnAc9(y_YD72X3u4HosEqTGT3RF&?2;e7BEcfA%_ISkYxj7GN*fr zo3C@uHmVUL4^|!hjkz%Bq_vZ;Mj2X9wT9gI>Ve6LSrQ*luPQY|q=GF|mJ1EHB|wmd*xbP6fAs5NQh-$F(#`%q>jBlOVVM79@V*W7qG9$B{1p6h{c(4uv35$u#gE^=WIiiNe=5uCNWX$*sO~>dWY$H@fh@UU7Ls#U~ zNiGD+Id=p#S=WqqYVyWFM}RTvAP)vQ+_EbO;hEZAUlb1#9Y) zrB@R<2pMfUTUv92FH$@{Aj*M=Yd|h5;=aGx90qnYrW_?`N)%U*=SsIA<>phDpCzEu%*^Lhfg1h zi7`f3ag*anb7L-13P=NpwKsYZ!i%KW!G@@4`MB2Lg|B`yz$7SRk&u@5OwI7`3#RU`?J)xzNlwdZiAI=>v;sjiIHvqQQS3hFO_GEP9bl>?k?h-EE{K7yOgPFuampNn1o0>ZLR8B=e|yL~b%$VEwQP?fbzn}}dss@}FXKd&LLby`(ZUhC8? z_vDEFQ%d^8YZ?0|z~k_fBjAI5Pi7O8OVqF!oEplHbVs2!66n zd;wcH0$#49KL~!epw7jJll(4F(uv=NHrV3VUVj0CxHkfxp_HEo zT@z0tdjPUri1e=*=~mkk#z=M}%6kg<5Q8bdT1w*2NUpEXNf7u+p!FT#PeGh)|A&-x zlGi31e8~piVaij`-)w_d+Td|EnD`aXNVWs*QGz~JfC$OY%Qk$g{YJ7sLLO(3f0Ba# zJq7;_2zDmYAy$*#kCpV_K>q&=={G9r?&C6TDo3hm$!v>*4xxEyu6L2`ll8WJjQHAA?_2 zevd2Zk^MP^eF}O1J2I>N`C&;8Ql#>0ZSar+{{zy$3SQLy{kW3;5gOt%z!~_-{x+bb zuYf%%L;kNS>9+wEPYNrAVDAG=V~)(fLrK3C?cWa=RW{SJOnnyoXWQU98(eR;r@&7# z^*4o0MEgGt`qVzM{3NqI1b&Z=-g`DUNumES8s=A^r`n5I#5{ilJVJUmF<_$qQw5*kI8(oc z{BE$pxLVD4MEY+P_(fFYe$-F;Q<44S8m|ADGCQO|8e+;kxfJtA# z9ZLFI=;s{dSNrop8@}Zqi2SK&U-1a|gbja*l70pHycP6Sd%a1)-wplzH>At{LHv(U z(g~hzgDrW9^1Zh7txEZne}QQq1pYz=ejEMkJ2v@!L&^UQbfm8$eIhC>?Mbqd-VA-L zLAq-1)+p&z{yrOAYlB}@_&I_8bP)6)7PGv!6#QF9qqDfBXx^abF54$@~B>DL;vdbkYA@6Izk81B8R?;K;qu{R&w8bOf3JHS$2O+Oh5T^9csJt~wI>F60_z4BB zLw)}P`7;qm?H^hGI93b#pMzhizxM#&1$!moNc{2a-;l5l_&_t|@r7C5cwxUxeIC#D zK_8w1zQ@3S5`y^=;AAC#jV*tNlAr2FSA_1WV`TebekuZVp@aO~99U4*E~PpV;6}75H}apVcTY197AuQy@Ef9>;G4tOm*F z2D3j1dUu)aA>eu&yx7LyGF$pO8@$(szug9Jv*Ew0z$c)OTfu)8_$B_IgMPdW7;0_m zr)3WXziVyuAF{!p+F;B6iTo#Q>Ethn$IUiCzu!^XuOIq94ETD3pGf@??YUNFNBho0 z`+GoxbcpJ+2>Nm@U|FBY{Gxr_W_|%%{qwpwABaT?@rX2+HcvlXiv6?4FSV$itrznE6qCNLJ#>X0q+d5itT%jii^u@vZU%yvoSU zfE|gSYlClLEoh(5(LYuH?y#Bv7Ea&l9|E?@6R?W0+f02C`QvOb&CSJg3%djD5Mu{H^sKLH`bg9`S3f zuZi?gw)AHdcs~lN0)1pN>(i*D=Rp5Afj_8$NQZq{tMGRK{CyYclD|lOnr73deBOS@ zVm$e_^cg%oT_(e8rTUO=i$}nvraX;w8$4a2BmXy0zY$51?fs&Xejn;H3+d7xQF+$< zL(oq)+h4#hE9EVLEFM69X&)#*&F{q{@Gbopu(duqgS9~zL+IlWp(%fBeR~Fb0`z`_ zbhy}Ny0soUgMF6F*!Pi6W`g?12((uZfNTZ-w+jDNkjF8kFHzFpQ__ilYkgbrYt6T2 zurkQYjWTB_`K|ejz_-@BXRra(?_Jo(n-qM@e-QY8vB_(hsedBfTE7(VN4E6o3Vb`- zqZ0g0R?6F~q*ML2+ThyNkd`j6)r^q+tyDsUwIuW|eeGhM&~Huzf#9GU-4p1;^k zw~uFkXXDSy@#{@|0oT~zLL1y@gTG;eA6MW={$}&?Hk;`J-fDxb{36{dU%>lq_#fEd zqc-@00!Q*w$o>=hcsMz7eaI@mkS#?2n~X8#E1)6A&ow5!LiTsC2Xm1QGG_W-*bwm) zvg?uN0u85;UV#3877C&E|IZ{kE9COYH0_Ci_k)Ib1e|M2x8^S*-FjamU~Bv?WVz7S zBn&n;fS|08_5MlVKVhT4-00I7NjZOGmHKgeN5+*ug{%<$XFX)1z8|vu36Vd}v=;() zEBPlwkVD9?&R;EmxRBj_E!KY^PnG@!MLxHn{C`0@{+acA)y97z`oDMz*$uD<9|9Rg zn)tc4`dv`?9RvQp0RB7$|4%mh)_S|B-)trSKIFX~KbRP^ymTe~CY1eeU}n0KK1-1g z$vc@c^QVw)0= z6#Ye}_oJ-OK=ZqZpz^mGynON_i4LMK<|N zRq$^@eQpB29M3+2{yk`;U#s8~y*eBGO&d(>Uy|QZ(DzLASGk@~`L`?S1aGkMHwNQ1qSP#kTZTCH-F^?|$(A2na}d&$i)zLxJBy-`ffPG8FuWl=O?>?H`aX+wVol z=SFmH8WSb`g9<+J_mE9LPukKKD(NpmK3=!wFHnB#eTZoPKiKkrVuPC%dXzuO1~=Q} zn`=vdM@gRxU3?$)1xsfAZd3G`=oi}HETupHBjkT8j2ZZCgu5oLXXPBN2iQO$fHb2Uk~1^KwtL9b!g9Cz)%5`9{EG!5&2UUdrR~; z+0u8|;BVOQyA?PQ`S+kabR%BgkYP)o13ZE?u@?-zZqP`?TS>J4>e(@08 zD@dmyjMB$L-*y9r*f{)0lzj*=nu){5Am3{-n8^ALfqpJvDSxWp7YcoX6BPSL@IeKB z74+{y{wW6i|1|33gbn@QoV^d6R9Aief0utD1mn#vBF-SL8$t-qY<7la`6J>6VM7oR z5s@He|8EwuESqIPf;18WNDvVTB4Ub&NGVd9VoFJhkswk;N+Tl16eC8A7-^)45z{n& zpXYwgGxsn+>+g47%*^{f_c@>Qx#ynyckV2mf(L^CM&MBxANUuw&-y34`sa|(y_h+` z&F_MEOW|4Q`Nu%BGA8&n_GeF_|Fr#`L`S}e=~2%AEEc?P@s;;?j(GJu5W6d;`#V4L z+31buUt->`kRL+i@?GrB|1J23n6LFW3-$jM`TOTfBfS0lJmmWg4Cc?ccqx3wr7AjJ zbmRn^#t?VKrb{)6C*zoJeE-#^cje6=$iWa5n?E~mdQ;x?8+p^ss_xobnLFNFyh(Zf zZr=P9I%X>RunI9WUbpAPTk6%Hg5~)F`qW<^hrIb&4BUUh{1Pu-e1F99Df8NY2iE`N zXy0ESPk8aZi+K+qUa^b!Cu}cIL(~46{X5-@_b#lzpTMvE_Yc7D#j8T~v9jKR^{xDS zV)_3I^R<03-d-=>kKnx#^Rur0%h*1ChW0rw*k4zUk8yd^Qe8oX9)nqyznKgIH7 z(1y16!-#)3rm>0S*2hWNan<)N%xm)eSGGSP_$G2)jQLugHHiPwVq7!3c%MT29hlbg zb9oQu;!g;^j%C}3`mp5Mf5Dqy4*xzc{*~=d3<|LzC%yTMUze*tG59n3`vT_cc)|I6 zKEukysJ|{~GME_r6zhxkU^CD(K8y4GW4!67u)NdYSAU+z`09>nzdvVqezqUqkC_;3 zhqo0k_1~4tHz{xZek5;ta+H71T>g{u=1+;{b1Yez5Ca;QejEN_o`0)1pZ*oz^dnfGe}Mlk&%e)`-wXZ<^qKa@7qR_xU|QSPmCHXh%7^<3 zD>gk&lYvcFW%c!)Iq#Y=-l3=l-)wrHmk;O1&vV%Pqj~;QdDE}uO~?1Ato~Xr z{xOW#uVQ(%|6+T`z4@GO$&FvDA73Ba^c#8p_o`1>A<*Ee^4Wz+HVQ#SoVUj6v`cUtfy z#?!KQ$LAx=H@^Oz7EHtT(i`*r{@?87$7}I2%rEu&qb#q#U(IX(Lf-V$Jb!#WZu!Ue z|7|+HzMdA~zk~{AqWuA`{WaJ>e&3ts@>F>JQ;+4D1&_9$r@-7tVli^-bBwoqtRFwW zIxU!o{nPEJqw_b;pXtTFALC;J=Hrwy7q7cFe+BkEm(ZT}Z(qas{yXGb?EGKGynn|_ z@vq$9*!CK4-!{Dzb*)SfnvvhJ;`sXD%K9^cOIXkcke`1(9&ZmbqU}B2KiPD%!Ur}T zpAXserM&rx0tq(1uQ&Y(EPwA3T(iTX{a1WGHzR1pvi}bKal1EvoL4_uA9>Ra-t-BK zheh7;=`?_m5t0>8ih7kTq{Vf}m=^L4x=@ALdu#;=LuPt4V?$=jdT z*HV0STUw~%S7wvSgySXf*ss{VZO#Q z+mF8wdmy^^ct3VtG=BSf#44KA47Zim&@k`&%Xux%PP#& z{%#}o&-Y_`p!45=@%E3H#*oO>kDsr8Ah?9>_Xn8&Zg2iMFaGVQ|5YrH;xm7o__*>w z@C$6;=TYC^UvKs1)89XLd_sR?+rJT=hi0RE3IIPxUw!ht2GV zJ}Sg0Ii0(=X7^CyXP0dHkeknEs0#6|>pQ!<;P_ztTvxm4<*xmWm@W(|gTK!m`^^80 z%LlWg`VSCXVZ4)h@n6bYp0DQCjn)5FUc4<{LX7u`Jbzu@^w-?-^+vmec&hv(N(P^- z|1KUVUE%bNdHMCvix>ZP#p)l-^FQGFpCK7+<6z@|};SCj{?w%Y(_Nf4`{tQM`%44!1m|k$+M!%}rbX zek7Rb#vl8t5WkFUb^Uufnw}C2b@BKcr9xZ}&dpo@-^*)%N#1z8$4wuL@|h8Ib@32B z$``xisO-dhAuqj28%;L_pGLbZ zqwy*XnuCwKX4U&U z_giCR=^Roiw;njILf3~lwB_<4%gcL!LWU0~%;mgfnu@+V7wl75`Cu#lzi11FtMmVOYN z=0HF>idPYT+~ioEbC^!`j^yA~d?+8XJQu;rhb;Xy`gsnALYDqIIO%k<^lsR`HHOL3 zInF~|=dcXKE6u@(QifN^lQWcZyp$VRb%%kK8(BK{p$Tr#C}ioC;H1;Z(kFwJ8(I2v zaGEFRD6{bji%E80FI602G?t_165A z*t-=1%4WR6{t*US@u7Cf@^1&LU9$9@^xuXz6teW);H1;Z()WYaS7hlNGezzP!2bB@ zk98g1j+rRDA0BcgqwrpW@+2z`pIKC%Wa<2_C~=3?B}<<|zthRmc`qW(9T-Y8I2>f$ zM*Tg;N5RU0th&d+%7HBX1pO(iOO}3$ey5YA^ZG~oI4q5se;H1;Z(s`Yy zJ||1(Id7`e;_$nx(4ExrK4r)a2xS;p%Scw;kzg$&S$ZY?8LLZ{K8Aj$lci4rr+Lwa z!sn0G7FizNw^dtY>HK~yk+r&H=`-nfI$8Q`u=;^4ozJ~$J6%8?U@_N&LucZ(WYIj^ z2a;8HH$Be32dwE{j!g)IFU`khXeehjSq$#VC6uTCj=`8vh-f`54E~v>AYW@bUIl& zuj7>iSvv1ms~`Bc6vW)MDIc=@+?6OFvUF~W3EtR3Axq~bk#ss)`UtS{Axj?(4k@6F z$4flb;~MgN@rKfXm+~YlPBU0}lBKuMKN4>!Wa(|-q|?dL7lV~2SvvRIMIGoc6n`K7 z45q_Tk!163yu=;^4eFQjNWpVghxbSY{(O~66mcI(De8|$r z(?8DYlBG|i-|1xOGr;M4%+F`+)fQQvIK1glGyzL|cflcnzhtIx^Op9ZJh_&Gt3I|m@ka{(NF$lB_} z{m;ah<>7Hn`TNJX5W4aw%ioLs4_h3v^gi@Eoh*G2SjS?r^a^ldlEooQ9|2A}oh*Gk zSaHbGXMhtQu{dPuHQ=Pv$g`GZ37* z*Yr_jo^+#3@;o)vKVdqDmzJHZ+}LGWcCvK-hCMOE>XM~DM8DI?()k^@#yMH~2C&BY zCUE#y7IQOL`HD%d_X?4lcchc{4vh;mmAz39sO=UPnN!cey5YAZvkun&wJczi!9G}u-YO^-$}oVNtV8wey5YA zKMht}hrw!#EYDG}+9FFoPJg}iEm`^r`khXeeg>>@NS1ycoM^B(Wa+$LoOC)_I=))T z#UV@YMV&hU6tZ+avyp1F`2E0IMzTC5U@aqA`T+WytS(vlAo`t7md@uNv@MgRkD>0y zHd*=vu=cT2JP%nO{>`G)eU`&)u<|F%(+XDpWa;hn^Mn+IEPVm}PA5xW2G)7bTCk4w zWO<&U{weEcvh>5?)GTZ3C|G%tCvtVtfWa;O@+DeSjZ0mw7|BIeZmd-D$bxa{kFQfi|#Ux7~0Zz4> zJ`$|HBFj?=R$q~&kD-5_)g?>k-`Gexoh*GCSnHH5y$+o2us9v`{IxAFS)OIo-L_Ab zz6P9fbvM%Ewn4Hy+dZ8ueK%Ogoju?*FA7lx;H7>b%RdOLejrOPrGEk5P{`7=;H1;Z z(no@|4NePSA)#mcA04bUIo3da(M6Ed3yL zcfCxOeg>?3$kNY(l@D3^IdI}3yrGb#p9d$MPL}=#SjRZB^d7uE`ZNTTo59L~EKea= zIgq9IrhiFPH6Tk*(C>7z^nqaY30ZmtIQ`caXB;?u*myG8>Fpjb1#90zR-EWM(Om=j z*NIQUqvayYzYnbCB1_*-|5D3=Ed2oePA5x$4y?Wa&(7 zuSw-2xlVv?o5Nx##{(!1mElU`%~=su_07X161W8eutZ=RW8^(R?zn!w7FEPXaud6K2` zE7inWi%FKw=95nMua}oW*Y-k|e=Rui1&c$Lz8;)(I$8QQu;P%V?*{As3|aafu4q5th;KVx1hb;XhIO%k<^q0WezmcW$Z|4?$8UhMgdNDZln8oi8R-cpQ83eJ`ImR}N%(rh}COS^7-+zi2s-rPtB#bh7kT zu=<%SeE~S!U~wKIf5~_$Sox6UUjbG=Wa+Eucl!{s^fmN5oh+Tdk=DNDWw6>J%kv6Y zZIPwFO8-X7lPvur{Z1!Ke-o^+L6*+v!qxwMz`Cv>%QFb9+{n^P!OD#+Jxl+WEjP0C z3i_Q+mOdJ+^+J|Dle*iFk)^kS!%Y@{4f!j^>%hvBEdK_u@+3>&M88`vWa*pfcRE@6 z4zSkOPO#b{%d;D-w#d@=(C@B;$kO-H?{u>C17MviJ`WBbw`F{p{5QrI$eWFMO{aXw zigOvPe8|$@px-ScSvsF((z27K^BPd&$G;v-K-c);-?UW@WYsMOD+jW4{!Qq_S1o_C z^nvs{oh&^IR-cRp>l|h>SmTx~e;ru)kfrmt^vZ`UeK!4DEFZG;R{EVzmcAIQJ|Roz zZ}W8@fGmA0IQ2D)za6aH$nxw2D>t(A-Sp44x@75l=yy6<`hKvE#fQM*R;zoO?Dlo% z$X_@8JXraV73Tt2`H-bwqTh`lvh>UJJDn`O6R#89`CAvT+9J!-9jvy<(tFbHwh^-Q zkbb9=r6<4|Cwyj2=NM#p%E8KkEPWVQIgq7C*Z4E7udcerce;O#KM{2`Hpq%I4Xk_A zWa%@&x<^fx-Uimbkt{vBu6O60{&oFocv9Oe&&OHUdC01}&GYP}$DMPM<>7U`;_z=R z=$w-*&olIV!`eDRkK0$1<#`UQekMyl306Oor9V&qc8f`tewu!#lcm25);PZe)_#C2 zPtWdgZe;1bz-hNF^hJ~54r{kRKGJ_@JP04DoyK*Zet`NnP3JYN+9fMKuQAiR%)|Q| zMN8})%)i$$40`wv=BdO-`U&F+_$YeV{A9(PMt!O2Wa&-RA2FRQy%n7LN4%l%mP!#% zcpc005T@l>0hWg>4^Qh;d+>%5-CJ00ar}D=hcHjql4R9A1`fZ4HG><^ z;U9xXA#q_xAL9#r{z-hPM z`yp3tgJgM1z}g1M(g)E0&v-*2OXs$bbUIl&$FTNwWa*>9seO1uslqFKDndN54Sw2q z20oMyowK$ho4uyPr+rG%s3&E-H!HB|peW}C7rQr0x8b{lmdv@L5?)Yqpu08$dOj@Cb>==}G z^7oAwkdGR3I|{ioLsEPXBgKd`!F>FeotI$1iOIZ1P8iLwQ(w#f2q z1FJ2v^d0p7o7E*t-$lRE$XN0uM8DI?(l3CO4_SJbPS8JVrAN>0xNY{T=XQQ%{j(Q-SnZOfpP~PhwM&+MmVT#`rSm?j+V$_L z^1f&hZ&IT8_egs{3V&kp6J)oom3TZ5T(lZ*C}g!&M$hwBw*su?BFi%ZtmPt0A4UI9 ztu9&mX!@N_mOcTT<^cg^64~WB8LW26@=pb;U9$A)^#6y&Axr1|-lWt0d%tba)t_Yf zd5MxfVR87iZqezO<>9Gq>Sw0&6jOPUZ^U=@aGouAoVlG$HB^tthy(_%8e}j6#c)jx@74u(C>7z^jE;jjV%2VIQ5dn39ye$ z|I)Y%xaf13i9(jYCphKCTL@OpWO?{}lydf;mEwKo#952)-*e_OR7t0k6^Hkbb&U4! zC-b=}_2+1?av-a26<9ftrH`loyOsl4`b7GjPL|Gl$jX5%y$Kxt%Hp(=e{9@NcH6}w zaQdL>yjQH8S9#nEv%_DTr!V=O@j!fNxyWia1=ezrrI*qF8@!>ArI&+~PA5wr1J-yT zOP>M`U%?y7OuWM1Mi`w}ryVy#N}o5K=hDiPtT?=`RGwt%i|GGPyrGb#KLk!Xoh*G7 zSb37A-wal}Wa))qwM&-XoBrS74TUT{0ZuxdES-I>cK!a(Qs>S9g)IL_aN+{hYy8H_ z>6Mr#|3t9jlcjS!Xt~JJ`+&7vWa%6;iHmqcAxkd?C!J1~&M~8Q{qa))J@tFMp>SEk zOA!W@_)tD%#o?GyKK}R_NBN|#A|p%AxobMPCA_|eKA=1lcjH^ z?tY(0mcA1lUd9{B9=yUoMHoCo{-g1W_$XRy>y)gzyk^m|``0hrJhbd&`Cp~~b-baF zrE@hTolchi1~~oSctd#;FSSLMrxVV5)fQQLH?Yp_$t2eLeaz{-Ivo!41fUb6Ho{cd^5(xdw%?pn;hPcj}JIbs)5cNZLJW2^(sXs>;?Mu@Ej3^xEsRCn8r#c(6ZV^ueP{@kO z{fTt4^#0&f7pvP3tmP%k!yL4{Wa$Iw=L$z5OCJPII-M-N0<7gFORoZlH&~qUVC6uT zhx;Yv;P0cjohG_lU9$Y#PLodex7j-A%7HBZL)34yIArN-!664P%0|4D8(E&m!OD#+ zeHS?FX?6FL-(q}(e6#UMaN?~otM2pAlTIf~KMhv?Wa-=|D1WkaZu@E1)@6D^Yl|!o zx8?8_)48Z&p)sqaij4c>L-&x$syh;#?q!})_z2%-%<&&`<3{0_PdT1W-Nmc{D`&D| z&Zho(8^dJj?cnh3ctcr$k8~g7mDJy1yoQ`GUgz;va3X0sSuwYRlTIf~=e-E^GgM$f_G%3-cg=a@Do4)BS7VS5Q~$h^#o5z{>eDSUHg8c>}B*$kGFJ zU*a~)fh@fXIO%k<^j=^c>&eoiefaGb=l|Dv)Ih7-7k#0a#o(mV$Ibs)R_g9t zf-HRjSbaj4z6h*7Axr1}FmZ?Fg&--C}in89)<6*_&gqk zDPtZxioR%m|2Q&|p0s&*91Kg1c`g^;X*>y>E;F7=-SG@?(FTi2Rt^pHWX#`8b~$vA zdE$V=K1n;~aY6C>fYqO5#pJqEf0CsagA?TzlPsOfo^(1{dMQ}_NtQke91gKKQT`Ri z$EXiAuEa+;%(w|3MGx7slNF~GoEmN(?qjtqWO=y1)v}PKFQR`0-cZQW9|9+xPL|I7 zv$hwq^bO!N4<;y^@R53-@#FYVK4kf~fRztf`ZoG`;($VyzJq?Jlcnzkt8dBDxo=O8 z!W+s-dfYylEKhgrH^TRurx2{MN|vWTJzNPWDe_&$<>b-E!@yehQPf>Oj3$4;JmWnN z_y6h>vf63^t53+%+vp!-amdm;=yy6}2Wv=)cG6lBM&0X42_o>1AMz z2eR~0V6CG{a5&y#R(Z^Ok~+U4tL{{KK4|{w;M4@;8DK37S^gTZmW3?6f&LF!U9$9M z`khXe&U=zt7P9mu;Pga`vkV+M=KV&U50K?w2TnN;cb&?aEYBveawbdPO#g?iEwc2j z^gEp_J-R>nUi0r}-7e9l6OiTE!@5o163g!0I2e^q0YEmn@z4 zD%CDo`m6MR#M&iGzevB+$(LR5p>Ha={1bjO0A}c2EZ-gJU z9Hw|Y9h{zGI^(CN8W)0#+#mKLD^3aZd(A_Zo&twFkw@u`m->e+PXes|AxrN^zq_AC zmd^OP&*ryP23_lgEPo~S+14jy=@Y@>CoDHEZ#W~)UwQiRd9A8E$%?~sj6}87_0Koh z|4FC&>tZByXN1J04JSJ zmc9?HJ|s&&08TesoP%KHK$hn)SUHfTAEn&eoO)9-Y$^iyCh`wQT3mbDvQ3-baL zC4rCde&c@lP(EbE;iZxCAxj@Xe+%AF$kGRalTIf~=iy&{LY6)roSuU>6dpp916dyK z=9B|jI(Gr;6S8z}(&`hkbgq8oK$gCay8FJHES=|6VJqHHj^ZOd*SJfkxId%wCD*ro zp{E@4`d7C5O}U~Q45ucY7UWa%5hTGwRhJHUxgS{$V^ZdO}L^;sd3S{3+w!;PhhSK4A4BS#|q@)rVy1 z#q|HR)g?>sPruX2(z9UoAzAteaQY#OQwdfMWO>Gbl>=G&IQm^%Wa&J&R1W@m=5*-F zfh>Om^>uhdAxm!oD<87-Hn8#`OYfln)3z*R={&bgI-M+i4LEnL=jl9e)P9VsTse?c zcMDiKkfm>164xU@aF}`a*DOwZ&NjRt{u&)`67+S^5V0KWBBx(l^oX zbh7mAVC6uTz84&>u{dYRpErKfyVP6$?>Wa+)={{r4n$kO|OlTIf~ z=doUSlBJh|(>!>hRN*6h%y<%cz3~)$B)%B4>hc(!bUIl&PkGZD%s&$!i7&-04^KUl zPA5yB4GuS&pNH_omt&TPhs>nY$2c>p zWO=$^V-CM+o*rQ3NtWkku<|5J=Y6Ea7OU&uQ|e8>)5-D=04qc{=jQ4_5+l`OX z^S8z)$WA{+{|?hHk=?qu8N1Zf-6Sp7hjeh#cL_9{4h(qdi& zt53-CzXn#Hkfpy)|36t>vh+9UcRE=*pL0__Wa(^E`S3T<;a-bbO8#f#ELgdbRks4H z+{n^L(9fMK3R(In`khXeJ^`%U$kL~SmD>!kav;l716B@X=?(NhZ8?yo^Y4Qtolcg% z5Ud=?()pa5o*N`f=QD4qr!4*&uyP~Ivkt7>$kI2^e>Uo#fGm9zSkDcTrSAai9GEQq z39$Ny_uoPuxKR4ymH2kd@)tu-I-M+i0JzBg?NGAxQgF(}9N~G$@^lA>-?6rMo|)!B z5~UYj;lWrJ^PDr~bjDY|krguwR=<&@SJ2;PG0D=IkFMGM+{Qy!zmesi3{HR7;_!Sm zeXX1o}jK5iVve9kzE`9tF<<_Y5{rt|Q-$kdNa-$_1c`~+kE z*!UT6c*^(?^`96QgS8&XTCV%1_?flqkE;dr zJDn{5GO*euOJ4)NY{?X#BBVRV&0#5uXX2sbCJ?V6^bl&Gw ze6sW>!MC`W(KQHH2+9l4!~ZtsJ;}ryF{|zc=t-xOrC$cCEwc0gLsM-Pf>VFCn7zS? z07ewD{0VT<>165sz^MZBXTgb1G0RiIx=trc9|2ZwWa(Al@J-8SGP$$G>;P*&LzaIb zSo;~W^u^$i7sn{8z=^Ig%d>`colcg%4y@eB(z!_|x>+2u^qt_O)5+4G0BgTNmd7BkG@g0x z9o}eu{+1-w!?=$6O~%phL3$c5fS!0u%!;`PdeZ4+=}W-MlPrBTb>5snAxmEm4&Q3} zR&XMWS)T3ClTIf~-vw4%Wa;~;^I{Q&Ed3BTyv5?5pr_qDWO@4GZ^fhw%`*_3D2iF0 z6!fIi$2b`z5tQg-I$3e}H-eH*&;NTt zYS;gJK?fQ09Tw*~#!SSlm?s(2>1658gB6o3{USI_TAbJEapQq3PxN{B=1oT(R z^aqEsO&jfI))Y_Ute~EE3IB{pp^0z=wI-M+?f2&71kfkpKr`@?3|5i_; z%wm$|Sqn}&oh*GlSjSVc^ey02#^US(hgoC(4IeT8R!=zC^h4kxez}K2R-6;`l$+-a zI58whCkI1Sk0L zCJI^c$AFVgCrcj(Rz76ulfdf#8Q{?U=c6suD=mHpb+^4Nr0(*32(16xj;xp~=)cSA zt_LSZ$1KlA=t-xOrEdmndnZfZ0S<>*oW02$L6qhR#|S^6n( z+Qsa1BieGu^a0?+7>iGqe-Jq7bh7kPu;P=YSAf&*e0~+#U8k%8>s;$3I5F1RBCGE6 z;H1;Z($9d^7Fqfw>h9P?mfocY`mM_1_W-BwHtq%1vpQt?`+)VV4q19%u-YX{9{^6f z>(dlC9B1)IfD`w`EdMCzNvD&gj{z$_S^7+Hf)|J=Wa)L_q|?dLo50#XkfkpKhaa>! zOUM(9*OJ|S;|cPIO+P~B1t`jM;PfQp)8NEMVpjY!(34IlOFzrH73O~xTr@dmd0waf zQPauN``m=KrkGBa-WQy7I$3%#IQ22}mw*#fW0q$C>pGn*y`27!o1ZLw82wHsOCJf= z`XWo82u@71IArOQ!AYl+rB4Mb4q18~Sm!5X=}lmrpOB@ufNycflqKNAy_N%6o@L;q z)5+3Tf|UbV`etx~HyBXJ(zk+>PA5y>4%XNsOFux}U2Bk~9|Nb{asLE8y4LVKuY$u* zSPpN1(=&`Kd!p`N8CQWr$CEss;_*z6XM4O5oS12G$jWUoIO%k<^d(^R6eUv9 zEPXRLQDZt;`c`n#>163Uz&aL?r9T1I@#sl#y4GSI04qLO{zG8JCrdvHR(!Jbm%xcS zi%FLLGC1jUvh-KL>Ibs)i(rkzPH#cXdW%VxryDrwbh7lG;9LI3t|JP;VT0A}=W!W0 z(P%nZb<4p?r<0`*11nFm^wD4)`zC|K4_V9_aH1(@`5T}oolchC3|4%y^o3xZ+bjmB zM_A0&)ZPAe6F707>15U23{E7z^kZPAk?|+2-#JR$F9w5@7WkS$aSE@3*>S=_T|#oh+UI zx3k(R1*nO>^bzzsoh*F}INfZyRe{wOS)TD=wMCXbk$xAGEPXQl zPA5yR0c$*vrMG}}ecD0K-`ct+%d-@$+{n^bfR!6r`YQV8*m9Ajuc6=RWa*p1+Sie# z9|o&kvh<^1wM&+MoPM|LWa%g9cRE@6X|VeLMX=f;%kvUgZIPwFOn<8_BU$<@^gEp_ z{W4hnPnI6M6*;t6oG#?K#y!Bwhb;fiVC6%WUPynN)g?>sO~2F0(ose&C|7+V~`^?f`n` znhgho7~W z{0=(h*3k*DawDtmDX?-QOMij>)fR^=ou^Gnr<0}g6iT^~rN0hVZk-TL-ES-l0<-ki*sI$8R5uyP163Vb}J59`ZntB zZ^)3P?*ga3Z1MSAnU;|(&y!#+BU$=B`ftOI0fj7mKUjZLg)IFjSm(xM=_kNxw_c*> zpt?Xnx#~G6r$3K*s>@?^Vw2@hmVO4DbUIo3d9eD2ES=|RT6VJZUSKUdSvtp3;&E%2 zEWI!NPA5wr2v)mf=@Y1b(~h%b>C-%&EWHMt_#11NEWH7obUImjG=4Ul|Elrh^cK&* z1gt#CinETo`%M#B`r}~r8(I1mu=165A*mHm9Fn{c&|JLF( z!LJ<1symx8-F8Zr-UbeLSlteA;_qUXXCdo4oh*F?Sbas7z8M_uv^a;rsc#w|1}itR z{71pcjV%2*{kyC#S^5e3olcg12CRI@(q9Fue=dL%e{V6#@>~KZolchC$vf{NOAo2L z`xs>D{lIE#JUHBKZB3{C55|kY+P9EZm*>gS{c~oX4{P7zpBt}(u6+wxaW>HJ_90~H zo9K5sS^93U`i(4oA6V;)EPX#%>x(S?0R2zcGLoh9xy_{0$0x zvh+ptJDn_j8CW^20;is_x~suzmn{EUu-YX{Ur+yctS(vlM*5vjmc9+FaYB~953F{{ z()WYaE?N2kaN>ZqOO}2JoOC)_`g35lOP2luSmPlCr+6Za(u@3E;{o9Cka3FqJ>x9d zc{m=FKUwi7ft5d5I>&?VJ(8tQqklZ!P{`7oz{;O2eJMD7*z)NQ4v!cQ@|bxlH?rzh zfR!6rI*)^i?^_(QbRGwjPWO+ATwdkoFZ&GW;ZciIN00k^iDbp(m{0w{JRIj~mp{jL z%GKq#Rh%VY{oQ7=;;aOxj#-@5^!!`Q@@#@09yfgp{r_&fojNacPvPX$@OTqfP zLuC1R?9(|IS^5TWc-rD@1*d*yyp6i!U0~HEt1j>JgfE(($FlI}#)rvgj8A|Qzld3N zPeD&QohCG4H*EFPq+*{A=U>-a|4NYMpG40qcte?jkF={ho%(N0Z@@?Dym1rt|1@s%criHf zs_A6KUjj}#oh*GBIQ=`kp{&M-`ihs+;%(r>1@n+qcLzA>bh7kaV66+XbRIIp|H2!} z5qu;r#w^b7B4E zN&V5dJK5vMc32@Q3@PuwPFPgb`StUO166R(?2R^3tHq|?dL zM}xKOWa*Q@T1QjBia!&a_-~6(mcI_1bUImj6Ik)d(ic#7=i6lI4}n8=9?A;x3&wnu zGyNlD{%%_PC9>-BchlN0k)`wTl*Ip7U9$A(H`GqQ>NnK)!-%rm^X~=g*t8F<9LS2f zAFLe6(ht!8rsY7Eeu#djlck>o>l&Oay-OGL2?sbzcd&9G%hMCA9LUn6|Knr3)xGNf z_;9-ae|+>q-SnT$KM1UL`TJ}2Uv!0P|0 zVC6uTXF6CpkfrnY(P4m&M2UVMT@bT8&8+Kmvh)RDjbXC%WnksAlHAE+^7qk+&N0i+ z-$y5%?*CSLBkOiC|Knbq9bjEQk`-sKr<0{W1J-pVS^7b+t}DsX57WQd)-PH5QTm-u zmi{7G{Xmv}0jy=e2-bQb%kvso>xC@+b^5#7vXiC1Nx##{(tGlE3U1pZOHY8cF8CW3 zHn8e?SXPf~x<;*g~mf|UGbo22!$+tCRo=IWa+$))0iPkUjR0M_qII>y+y&%hvHEPVt0?$}C}zKMRPlcjG1r+FfVvIDOo9`GH@ zvj@{*q3L_cMaBooy^Ifol_yzskAjsaS^9DM-)42m(ofLubh7lbV2uZ|^o!thZ;NvY ztQ^SlTm~x#vh+9Tf4kKsOAm1Ul5{#*dUU_k-MjYhm-5*OEW`K2VPL`j~VCcI% zvh+5va_#^tXRLK3RGVIO%k<^fs{87g_p3 zaN70TBCv8G%kvOeIgq7uf0%f;<>2odSJ3Ztvi$47>MOEzV34}i;@nKnQ!&ev@N}~D z0o2|92~L(Ctrw^J>!pf*cVCMve|K=|_PAYfKl<01PL`izEWE??o~-*GW9nMhWcfK} z!jySR>33WXPCMo}RR8CXN%em*Jbui?ofgv{lLO&NI-M+k1z7!0mR?ES{g#$2eKI&K zv-li)$}N8!D!2S`n8;Y&8ZTx8IO%k<+Tu7=Ze-~zsNahX9fd4?12`OP@i&vpjkki+ zS>tVBXM}& zrr+sg=_kSJAF}i=;M8!76M{qDT%ksOuW>ZSMj8);o_?S42>M1DPba_MxQ=z5KAU=_ z={)BN?=ohe7cGw2&nNtV>AmP5Ys~SS8e?2ct}-qoI}gWX>Tc8fk?%1s@tFCmpUG-> zBv}1SmR<=?jJG&s>0`i2r<0{m1*@OQ(r1DbAGA1R>Fled)5+31!1`ShS^5%iIKkp9 z18Z5x@~i}FS;*2?)Bho>OP0Qtey5YAKMvNikfm<}rzcvR?O^3VmS-neIgq9ArvJlM zmn?k`{Z1!KKLAz^Wa&r2>5o{POW<&_@nvwz@#~)64ZDEwqvp98tenY;SqN6nWa+)> zpJH{%(i8MMoh*G2IQ=p6j{vJJvOJ@}YKts=H2qVpE?GLy@sds_OP>l>|B$8EffFCM zIArNf;H1;Z(s?eYIR1GZ&)KxDSAexFWYy*Kv09e=XJr%9EC>I4kahGsovb)p!5Z^q z={!#h@3lAwz{-Iv55KQh4rJ*^=$~$N$C7r^QVvh;IcwM&+M9;|lB(l5|I z!`dZFzeK;&$%LK4j?uLKJ<+;*h0B-<8yx z-V-0{E3!PiTvuO_rSnoe(SSD;vUFaKCY?@}UII@472Z(V@S(QI@^paJ7Fqg2`rTM1 zOXp!*{YjR-4y^tpOWy=eG~x|~EPXRL>2$L6U10SmS^7S({+}tb^!;G{KT~As$G{rf zWa%$~_5b;jrN0c;|L04VehIAQB1?Y*oSuX?6n=l9<54iDaZY{PgF$I~V@qvmN8`ed z(m8dF4IM4>s^`sXsjhFCJFl_2b#BM3rU!%m3j=@NeT^N}_4C`?8(TZ7=XA^uqS`q} z{j9d;#`fyk`5n#Gjji?V54LqwBln&STV@G{+^{m!B3m3a#?)cmKCAUU z=T(Qh?u`1$Um)gDH@~T=v7L3A+8Z0I=e5keGS7L9^XAQ(+ZyHDfdxhe^>gRU!FtP& z)I6_x*1YPr_PK3XbxrNH_eCb2}eKdWO-?Y#S|{ni>9>*n8wCBf37 z(iJ(giu!skddAjt{oK~p#`-Ia{=&^~YpA_q0M6^E?U+B$PY_Cb$GmGS7RN~k2V-^H zT;$W(4%4+aH`mIQ)~g1T#hcaomxjBJll?I7leKNtjcs%5o0-$BdG!lQYdbpHXVuN` zXp9#wa$U;$L^-Rv3_nlx2xI) zMA2Hn5J2epZ8^aWs5!CX@@(fSZ*9B}d#&0I4E*aQV*8W@SRen3sU2BV{~sRi30=~S z3)`^AU_9l`q-e06QT3eKh0&H(-O_laC*HSxvc0x#ew%H~*dn71s%dWfoU204ncL6^ z+uS*x=jyG>4Zga$^RXX_gI(J=tMw{hycV@6?TvG4u_wR|r>*wEmbvI43^8mUwfD8x z&beN1vk&SXo|%X{`D+6l+vQA{v!H%yholDo6&JxQ}bpmYRm<|4!MH^uzFEr``ldmCrm1Re24d)>(X=&+q-E=eSQwGypyCts&iqhq)op5slh2_tlV zdz_x@m5vA7uA7=Wq|Cv=w)Vcp>d2}!fa*AtYK`M@adWNtJ*65nM43gW3^;N|QS(M8 zR^WUd;O@I_Qtp_{^MYJQT`}R#D(d{h#f9ua}z*z5m@~2ZR6J(}r`C+IIgm z^lCqI4#uhU?`P9bc{vqi$k2JI}m+fcgbG_rhsiTT5d{W5e~#HrVY%EjIg& zapUJPisvAfmUi;ji^(Mj`ZwfOd3`O;hwHEBwtlY1;KxSdM&G=)#_Rg+l;AJ(V_0y5 z57=qgmzN?aPE+t#Doai$;bt%mZAMVa#N@L0l%ZV{%hUUbWG8H*7rp%C>7*n=9 zCuU-dDLXixA7f0}Y&<_kk23Lm4|8I+EQgsGV{Q1bTtDO}Gc1QOWrpU&m@*YPF{aFr zoETHKJSS#ij43-fo*!dO*=#&NMvpS_d=GPCwk(I47-Mbt&|E*{C^IaFF=dA4#F#P_ zIWeZpkenD(wmc_hVvH#}IG!J4OxbKaKSqx-@q7<+Vzw-YnHXbjctx%sa+DdC!|8wlmcY;N6-*5CI#lsKotNK{?*sw=wm#$G zPb25z@$Z5A@k)^VlWfox#d`{xpWpfK;rEYtIE?Y|Cs}jxzLFR36griE*IPyLHsruclBh0Ber8({L|?fbnw1Iu_=q+GmpXv2?J{LUa~QZRff zzt6$v$Gd=sMV`le#_NL@=W%&4Jg$hh0`d4PgNouEfZ)eF@`oVcccYA#aPt_C-;4VB zh3~>|6rrmq-Y4Pn<5m7C2+Ck$Jakbmzkkac2MvfvpNirgfzOZEhIrf`FdmR z1wX&_h&K|ss3;zvA@JkvL%a!HEnYFqiuZ@S<$bOMe}7rQ@Tqtg@|L&DpD|952=hag zT)f+{?fdz)-irUL>l*P&;PdnAgIZd@{k?d9%-b#l%zX12%X=|zyS#vSBi(*zfEVwH zyz%$u?e<#^rKsioX5RQqVSu;5#N{36#T%NJ-)zhrsbKh2ylh^68xc?IcaRtFXL|PLT z>2B@b>E>}e8kyH_B5nIA%!-QI9h$d)9(YSZw0(0qGI+5q#(M?e=a)h}424`#ykEh` zI+botCE~F@i{N<>8 zXS_cc4YT6S%^O$!F-T_e#K0BBo1HhVb|KzM9J`p`7`zm37{;2P-%`vxtsw9T2gAoY zm3Xm~zqcUhz_!JBRd^}hg}mjRc{lzZBP+O~c)!hC-W{XkaWxKJ#pD0A;pf+acs(e% zqIk>m@;iWdeKC{yjmJyzs`V`?|c=ub8HLDZ=x4(Yu5MoxAKB@k-(I z<1PMBL2v**_TN;z6fcvvJ_ddW=eww@qUBBHt&fotv7dy-c+>Dwyqdi6yc?adU%~LH zc%R4{&reQ|_iKCxUhzJV7jO1QgWwoDz!k+Cl^5@cPZR{_5rp~8z)SJo0`~i_;$uOu z)5YS4;vrmAr;;Md<241repF;UK6kEox8OX&k9P*~Cb5Dmiq{i9)~R&*w7P=ab!ZJV z#d|$({gz>64RCe%p?E*c^G$^ht0PzB``}Gi=2r(F4mG(VUln|Qey5Qik8fPw2E3Ht zTl3mof1P+e;Pd14tdF;kCNJKD=sdsw4kO-Z%vVu<9WeRv`XJson3!KPUdrzydGWe` z{My^^ioEsK2fj;c6rXDM;k@-$gLZi?&vx(k+ILhtH4KzbWpQxp1go_~%;uc$W~b8)v$rc;^6qycWb; zjE#Z$J%E?ut>|s>G?re+Mpj*-Xf}`Sr3;Pm5tVyCZ86+rloMmV1~dH}b1Z)aUxQ)v z&Ut(taQ&iL&%);ydRT5kQ0(&CY$^!oi;VsIT>A(e zl;OmHb8$+9G7#7C1wm1_B|RP<`*vh-AC|Y^mTt#Ojtw|E{>a3`lMju0v|{DXWu3<^ zzj1lh;8oizi{`)n*2lUX=rXv=k2?)m-+j#PM+=@Ech`*%KlaJ4BMY`XeD|#RUl?1| zwd;lYn!UlzH`LesF(~S~ELdK3aQUbeUqXw&UV`?2aqH?aH{QCt|Ba7)?;Szs!#4(x z9KIvy{IA175?b0PzX7}`? z*+)xP4O&*QT(Ng9Yn;#aA3kub@_kKn)_l3CJ~$Qpef0jdruy(y@V>DnUFUr6v93X7 z{e^D?<}TQBYiaq7w-%4N32olQjJM|^7W|^9>zJv`sU$h z_bltYy=#wxgB8}dHT7pU1cSS+uY9aqai{v4Q^C`ZcK+V-8;dw9Zu(xQ(yw&B?SsL} z?{>cJrl4r*@`A^vb}cCS`10V^CEJ3pFF70B`tZr%>kl6a9zo2`-x%AYXw{e?Q+0w% z`0T|=byH4E8GY}bdrPLTo8IXY@5VAcwyJ-@;4V|{>gYax`Kje4-Y9Ax_t?j}7d-rn zqK~Z%Ze5A!E4vgFb^UDc?AY?|nW}s4E;&$fu=LQ0<=a=B`pl`7xh4KZ``DMp-qp2! z?KgsgvET1{>z1d2f-P_R*r2WjTjDh|@%ZFprK^55zi4IG3kAtBN-)B+ zLCFo@YW_*E{O*HY>bi|xQ`GrDmv1%qE-32Wec<3O4V?z9f268c(E08zLFcOe!6ReJ zgRR|ux@L5@m%5By^RYGcOO6DOz4rE?>zIe{e)y$=EvR*2bZ)(0yr*tF*F8sV(aIYO zo~@b@E≈qYhRa+OXp2XO70p{_LQYv$%acS0C=+`t9EJT)~#fW9!2q1(TN_T|P0_ zyMtDuPo@p(j`8#CUAJ^QTykj8vUhh?A99NjKh||gkCNqkDoe)PRiKf+bV)FF9-bz` z)5lH4^(}Z7rr14VTAVE_#aAH31DiWK+UAY8^UnKbbu`bf;{)4wHmb^9~)1x$rJNKNw#+$w}-VM?G zb-DRAJvwii=fPHPi0;9WH{jI?citI)tIfpw4SD(5{K>ibHeHuD&FcUwHh+O8UHpaK z^p*MF6t%xPH{YhWfVe?#P?opEvzl-t^76_TG}$-dm&g z>^R3tZw+oo|Hb8&yy>FcJxv@Uai5~|73cIkE`Q3k#e1oRSl_v(G0pkM@nT`lg;+mN zc?Qn^HD|iQ=|tXq_p|MQ_vZ`o&B)-q`SDn@_O`hByk}b&yd}D(@Z;a?Eic=9$@we5 zh3Jph^Wx*QC@8wsB9I3gM(0y0o}8eJz$=aOa+WH*LK;yf;3ej@SJ7=$ulzeM9E&OE z?*lHnoesPAueJtaI)!sZmMmT&?lG_o!%NJ5;Q#%~619u-YnG{arJX(-T*P1~WW{d> zEB+#|JY;#6dY+Z^;JSu|EYDgnuV-1F#7iEsJiV#A{v=Ch{wWSJlu3B;|2bk|o~c_R z47eTeyq9G$Ug}S>;&59mx&v=0Wa;a{X|8aTV!TqlNOq4~9QCc!qyBWf3cl3aB75)z zK8oHGv*Pcg$N3L4ZFs z+(iIcak$OO&)+MHSts=_zT35R5pRGyR$Znjoh+SQsr5^i9zTg{zd^$fAntE`5DyvT ze&WUlL_22H-;ZZq?`v$W=3M-^E&4@7e&zq~KVZAYZ>#(VY+bw2FR9#5q^|zujhE{+ z>gN3pCbyLMaZG96?;)=IU4dd<{XoC>n?L~{0lefEO;t9+l^B}Q=+`ZJi~p{FuZasJiaju+fTF(1zB ziPwAt^W%+%wiz!K#cPAfk2eMJrohB_Jgh0+5wIWc45s(vrJ{J>h2Y2I|G9k@8sp)% zKrSA4F@C(qF~R+oisHQ;f*)@+j(^LbF&+mTf^sxLRURcDoXaaBax!rms$;UqR@9l8h zvv7G?N$iG6Wv;~0{uPs4>NYSd-Q03ct!4@z2vtH^ItG1Tk=RI@Inb}Fu_IbX~ z^F0q6_H$@Q_`8{297yVC+hU#_+1huY{U8)C5{_fEuj`48 zWnKP=s~|Q_S}n>cGmVrJYclOsr@O$B)$a;ypw)R%%85{>y~+e1F&jr}JvTz_JT6yM z4N0J5tuZzK(0O{0XXhF#7mwwL*bBvr_}Vq6J)y9zAMKjz^Ez2z!#S+A{Ufy(+WeJh zVe65{k7!3Cx<4f^bc@7W$e(an>)}+f4)*gkuAtc)g0!Y~Gol%64ox*=ob*@rX5pWw z1`7Vl&KI`%`x9Hww)qDVsTRl7fka-@xem+o}=5HZsFbU#+&W305SSG7LtdmHj)&D`KW>9_7sv3d+U0PpT z#!D{U&X@HD-3hxKnJ>Al+z$UZruDTJX+2fV5vQJ{^`HzQ09JZ$yVi%O6ygEjD~c&C z)SzQ_1i{MV$T%8reb1_}zD0CupBhP!BYrvU+2PhcQCCF2Frqgs$MITA+tOc(Z#|qT z_z8*c+TloO3={41W$uRLwn~~z(uY=N#>G?n(4$Gw`V^WHV3jO9C6H9fZp8TZ;9a}W zP4in$Xm4n8$Dxkf*Bn_>yf&uI(49}CN7?M7bB@eAJSF_A@GYGOI`i6d*7dgM+1zHY z8Ry>_n%A)vF{{~YUs+rBsHi`!?0aP~)ATAU$|6hVtEguD(^MmRt|M?}2aDGa!iGgc zI?L&H7orV*uK8APh5Y&5JJ{X=>S5AX>wa`Oo*o@nn{#5`@dd|<+mE#0zHV}OFCw_T zodM=%+TmMlIrOfZXMdL|IWiUW#ke=<+S=IPJiA%lq7G2T%lQPb<5z`>w;IR zPcA-j-|=O~YzEZj zUR_WfdK>z4s$;ek_X|0boq-L{YHED-qiNOUua{4mzIQrBT8HYT>Z7-GQXlQ<%wA`; z|8?8qBHsD!)9fHPi?lmgaygxx^2Eop{DF1gNb7r|U>;(&)IYQBGP?6IXCSFv8!WlB za*{IH>8!$W#etT7W@(_-V|^=sX?06hA*2_uq)f3?C{^gf)UN-kc#iEE`8Ka<<@!mx;io>MOEsnvIv`dldG>SMmx*Vwk$R-6(` zF3t?ad|x}etDvGZ6E--lWA!F$WQutv^GG&P0YBDg$SR0N5vRX8!*8Yb!ZvBe7Shf} z=jK=sSm~51BUs>*N|HHV=yB!dCL9jngeOYml8>>rkp4Q*=avr;LNt26J;p=uH8#xF zde)*WN}wd{6G|e7;xjx(Udf$<{RE;gvqH=nbu?>@wq_`j&zIMJ_)bwaNM%1o9i}Hl zb-oJjWXz<&`aAY_WEH25v@uk7f;J${-myPe^ z@yWpl?Lt}t(h_`G_+;ZV-kE?|RN6=E4QG`Kf5frlC5MdSoLb)uTPBVjak_Svycssi z=3v)ur%}qdUvQOuf6wk1W38NcN4?Go6xCoYEfX{NLrNtUW@M;vyfx>?(%42>wlCr%xR2_(JC z96Q6#wtno?W%n=GH|b}rL*M4w&t^#SG0N@^xdT{>K2q^nMOi4JP9P0?MSZ)8*;*Kw_2(-kqgtCb17@OQ-_~fTt z41Rcb3hV6-#rQV#vp`Y>xQcW3ZuD(%GOE4ygzopn?u5_f*wOE%wAvHCSQmQ(Ru^_* z!%nubkp4P$>jsyt{t144@p~%^mv~$qA4S?-qa&^#Un*O3^&Npl7g>JACrn?f9j3j# z$Mob__z-`LGv@5DE_4a?I(NMsKzv|A@j+OfNQa9#u8m`XMenls*va3&`VOqHl2)(5 zUoUp&Vp*>7cc$^T!1%i;vgAhQS#kyQC0%5`M;xDV6 zi4?bW@3Ek#W8exwo$Q4#9wl?|zt=e&6o;#MKz%r949EXY!9#74um!b6mL!nRSzBTu z@hz(WykKN|^o!qhWTZ~Ca?l(%)SYcvdagC|!H1P>Qg(Y$VNO`A4SK_xt-b1Kr4{eb zDzXog#hkIW)#l4x;4VZ~_aEKikt@7P89rN-ey6t4^R*J8kc`=&@6jW zA?9+Qb3eS+ZTxR6efMSVPrx4i{#520zCRv#{C?;_KYi0Fy}mEEe|1a3z{~;seQoAz zt6P#@t9WhnKsm5)^#0-an@#1$zufTh4X=rslHRI#E8!2;TAREFa~*zoPkU=$`FxIA z`;rPA#T`t0C#%5W*Uh*EUv+6c#|vQdxtC$Upiah$naxDsul5d@b|E%4!OO&y5-4mIsT4+i}v~bvC%#p#R)Ld`|`qj+I9cW zZ7tUNeCaw%C~)@q(lWHxzMPKr{?@bZV_J{9K}+=BC>=^qIc+-4;Jt7!CXH_NDjV%~LLZcU#W>Tj{$`BW*}{ zc_vzMxmN2~VbUs79;LLdJru?Y1h&ipY3=F6td8gb{iUb}os`k~&^z(uml^+G2(-lG zJ>nn#9UjCNfkpeV-WNRv4-5HyX&d8DNpUE%9A>o#(Ef{;Ug@TFo9=(b?k!)sQ7-d_ zVe%;nt;~oL#FNAjEx`Yrt2S_DjX=mX9yS7JdfHL5eb=PZvN>cIbB@HnYQjmql?`fiFv+DxX-%l6#cI}vh7Wanc(5l7C zO>qt$-;jH`zCRc1tNKzpKXgR@OY1eofr0}p&RC0$G5%^jV~zhO6bCRrYsFm@FDY*I z*ZLnx^-M}-4|HjLVSi3&b&FmcvLjjKRb;ozx?fT_MSr06Nq^w*4tNa#wx4Y_{$lP! zsi%zZ&loF#R(~Sy;4c1#{JQ^a+o4F5`6gc-I3fJ@3z^ivL zPg~lhNbF2VYzd2Z9E8UnSrf~)eE*3%FjKn`EC;nf%U;%P`~@fY4o_Ks6)WYv3^|g* z!5j4?{V_e_)-jj2p1o0@N#D`em;27?QrWoR!C2(hClz4+H)@mb1`8rY z>gc6fl+?@Bc-i}Ytpwf|RsiqoH|hoY?pCZFllGn8K`leu|GB$^^9{a3d=Gthhrd@J zG9@7{$R#rb7m!>;4;CN>=N+Z_aHa|;(O?7Bod3F4^sjhO|8MiE_HW+dTf&n&_jXdG z(BstO#HHFQjOr7qf<6b7+!(2JS ziVN-TA|K?7)TLd*XW+Bq9?9-dyjYGF3wdaMi;^$<+2LAGc37lE^r)C|_V(dg-%h!8 ze%SjFC%SztzIemu!%7g}4WI9^;=qLis1X+B!s?dn4vbaT0i z$mykCbR4V1X~-Z>LpHOv7yT^FMW=i7Yd-f+_POuHhkOn5o8`ff|B+OfQ0nk+GQCM-UD>jO zS-nOc7`#g94p#1VMA!O8kuI7cExfwL*exm!!B>5?a5LuBQ_SJ-XOE;tnlFw>E=~>x zF7&fb*lHdd<}vqI=OzcWBaUJhdt{Vny&;;F4K9p&Ju4|U>K#P!)w!tC?&YGBdt znCJVM%v$|U{{HAY0u4U~CzCfhGLBs`ctBmAj*FKBpOI0Sc9d@Krj1hq7j~kBd%Ll6 zzhrR&d7M37_(&>zj0X4d)Z z?(~={~$s*HdvUNziKyoWQ-Wg6pIlkP@uCwLpKYr4=mcuGQ%|P2ghL$TXN~I z)46V|Cg^^g{%Kj1hiq$*p;1}TG|r<~xnQ+ou3NMtBMaJ&b+FcV9R5)_9Un*<;NuBC zEbSp#^YR&h)aAMHCD2;aprKggsxJa<|%p`!TrZz&$&fe10Zs(Qs0n z(Mj=b?q{98xHp{J;*L6f@!OpqXNA6NCNv@&nu3_mQOSq)#HZq(VTT|$tt>LE6ZJo& zc`DiO$x(3sPJcB{uH5TjrZuyN$hpx{jLC@`SF!%C8slbV5QTkL@g{Jv@v! zbnI{rBTQVk{bpmVhdld+W{ulav=e-79!8wK{)0bM?h7>=BRD*4L3dGuf*%B%ecn24-+p}bpCN{#FIw6)cxT36 zh4I(FF?LQjm+OAC)vtM+8R-9b#O01+|5ujlm&?X6aMWdJRt#hYE}zCq`9g(u#G}{P z(NnPpPWmp#v1or;Xs#T`A8I5})b2ogUVCHi$b`-02zdRHX$+~=4dU6qe^70>GOdE;H+2vPTVSK!P5 zxZI2qyHVno`V@UD^6#s|K1$q6dY}dTht_=_STsqaxVbn5;PdvnNCMXQb7aK3TaW9wyn=u{Qr)$g-5R z6|Z7x`Vk#1?0T(hdY3P|*X8hsnJ)qV7j1^zm}6T)rz@~1#NN9qaAqBgICtZ2Z|u&H z@GS#4w?y8lC$0kHCvziuGt^lSS8Vje;eOQSL~SD>nRMpa7-F;5=ZCTj0|g;?7_VW~ zD6fvuTk#|Vd1aionev}&PA-nLLq7`o(S~uLdNZiTp$%iu2FMe0QJwp>R7~;ed)b8apA~3fj+Thjn@Uv}9|fq2z`7ST75-9D+=UqcJSsU#SIG;^fQ)T6;f|>dQJ5zptquUggkZm|E85 zr`FAmYv7G%>EV&ybiAIkET}idRR*30Jlut;bB7oGUJ;o1^<0@}Y=# zRkJm+#k`n+c*ghwZu=11D_Cko7{nOY&bkZQ{5ZYir)PG?7qs;c;0(_WCg+g88#|vg zSGo%ve#{ya9fGHtfN~-7>EM;QODrEjD%Vp|V70b)jT#RmA0YMXVaW$5DM0)HaSIJ= z9f^ux>yc1jo4;sSE9@0{^Wym!DM!!HyvR9ZU&kDQhbe+bC$+!>Je}HdtuG6+7K@m`Daeq|Vp*^F1pWJ@VpJkQJ^FL8h_n~;~zEuwaO9wGAW`@ z(R^R}4T^l!(uPMkj@m6wpA9V?|2Vm2twrjJ*Xmmu4TfzsdbSOE%eB3v;LrX*0mf@a z(eN&R!cm(0td*hVaV8WgqX9iS6vxfuHRw3#&D?KWav^K-jE5?fFZ-ogNLvfgl;|4*>%r62ic<^)kPj@-#Fvw9P2(}#}w1eD6(U^xO2A}smHy0MTw#X z)^`!narlcyX=jno-amI_jInphoyomym|lX*_XYvgHcV<$l65U9-4-1C#; ziN&&)$OaSU+xOwM7yATr$>n&e^s#NI8Zx+9(E zkh{XDp|;3T+@Gk&qgu7=^=Ps@tRBtdJ^A;-KWczccHusxBU<}B;LqxD$}yDg zc9%Vd@pWR&9D5HL_SCPAFl)ZjB!7UPTit_G&L!}<$>YY1KVLhW7j|R3>F{nNPS*uG zLv5T&hwqkDcy1+~0mE623-p$Ol0u4Z4aL>|>BQA5Ysze{#`*&dyY0Epija*h9$O}? zr&z~$nqRuac?w{)>*(Lj+WLQqHFX#<&CM)Lf2pfvK3@SuT&0)t?>oTUZ z#01V1Ymv^EFqh5gc-7t|Id6t`u%hP54E z124+u@VIkxUtg2k56t`x62U@W3#7#R`Ux z-V@!9V>&yx(i2W)ly@8Q8a;LfYgUY6IlnQAH|HZ4Uq@JL?>4Nr98n~_fensDE4`u#d`7{)LV)O!2W-n zTj?AAZ2VJxOINXe$9n^Q33@Mq-e%MQ-dy?T&w=B)pkAj{K8jT`q7PwhYwW%Me#G^T zKG2nzn!nhkg^S-3#l=um z0Ana!AJ%%<(Tk@ZSUh`7vdr|%e;Ia6cUE99fox$)2;-}s^tWG!fYJY(~prTMeI zh+^V&=Ec$!^2L3lpLNTTnJjxXg&lCvtkY=KPSh-4VyH3ezgPC%;KSfNKIT#ac(Xi}Q&?pClsRLgv(>lVzXc5#LJevpC|L@CwDZq0jG#TIAC^L$y+`l3R(0 zO{%&=#4dx24Ht3Vx(9rj$tk|{))ZgbV<|rGSdTAfVzO_1VX`lKRE-4}WeZ}s>I)5|@2Qj%q_Er~{4Ew|sc#Mk?r)A#gmoPGXn z9qTmT_kY5CTh?hFJ$9$>>Hib&+w+rnU(a(1zV8i7@PzJ9pdG+5wiiU_&@HN2uz@Ve z;y=#6&G8gYi_^V`>j6ADw7}MO?d+3&8UenosB1Io-18jb5$)jG*YgvMvqScL*|uXE z^F93&dv-EP?fQ+2)@yA$h9Q=-gPp)C)#Aao^&4@%?Ze!@ozJ;psd0AWIqcQbeiNsC zx-*b;2)iU!eoGR*r=PRu03Yc4w%%jYL5x|MZ?nUWN}b`9k-xRfdbW$s%xFcPEmyL# zEhpOBD&v{s6l@0O+Zl+x37_wgN;>Zu*wD#B@saK;*@eX;(x zo&ut?T!_a=C(FetbBuSy_pt)H%;}l746$;u&MMXpS|LGl!w0WQt^F9PKjaVDC&IL| ze0(9H==pGAR}N zTeQoDvoP4z!^skOCi2rO)^jw?sW{<+G^-zTy6N;9)=t>}$}QB6G?lf!<1TE=?04g- zF`SBhq*6N)MkMzDdd0=?oYp%$FYRTf8Y>cOMWyvjvd^eKGDeU=wSWx*j<00+%8ty<51zok)Mq_*~rw$A1z{TRDJE|b4=#%`4;GimBU^K8u{ zS7msHn5W=9HD*Gp1-bcIrpVJ zIPN-zeMsYkFt|8Ag}3{w%5U*Z|jEqtVMj(a~l*Fz)CtG@@i+}LtE{VL&a8b&c)^bzDz&EZ)ss~Xej#r zYKcBPNr7blQHM4CXX@Uuna*g)@hhApfD9-WNbUD|cf$+#vL}?Xv1@vO?OnI0JzqZn z4}f-R9T^Eu$4iL7A03HjM$?%`@5kBKmKbqTIB@10nkO~P@|T8Ke&`#8fkivCG-rM= zT_fKh=4j@Vq3LnK!uul$6IdjEN6#Zy;l$%p*+=q2w-yF2Ji}(RJNo0`iBlZjvq{%x zb>-i;pG8JuE%cUC3rlBGve!Q5uMSxneX7G6BPZ-Y2p>N8Yx}u*XOT%fpRfATF z#N)ZAWa^lkaDK&Tub$KG8>Pn#=8Z~KZtYTe^1^FE?zspFDNq z^zrOChD-VpXPSzG!rCtpWdPbwTVZQ+f!r*yfLjVF(v^!1E%cw(9J z(6P3D=zPX+9Ib=mSO))xy5yQsYsA@JTT9-BQ=CnW=Fj~=?Oo^sl| z=(Q|@Rh-pBj;vvtBl9VqFiZ)h95GeYgVc!)|`98E46EPaZ%PkQcQ$s3(KwQZL(#>%Pn zm~E|<+h(O&+D>&fzbN;ju@l(YUTfuybbkEZwjHOh$H};QoJ@4!3>@Bow)%0S&8E+5 zQ47~aIzBr>oR@V7J7}dwI&SV)(=tN`W@c7ws&LKyq;zrFsj}i}L0DVIuG80B^;@Nl zUVnjl{T18VV9)6e$!G4FPCore`0OL$(~pEtp9-Je1E1alpWXwX-UFZBgLDtlJwESK z@cDn9ydqq@?nwCd^@lp~)MDqJuI#R+ew_T(v8py=Z@;qpf&9k6hTWLaXdYW;-zQmM z=fcKa{@(Ru0UiC%vN$}oIo3b)C=7i)zx@5bvVVO5Z-RWJ2 zXVjhWZ5Cm6Kn+7l>0DYDs4h6Mcb%m_X(t^;r6VKGKPUQzcfn&XP05t@e`N_z@)>2( zdueuz$EdL=wHoC|Y%|KIF1lR#ZnOOB(}+T~?GsvjLKltk{ji%(xy}x~)3JKXaxA5796BwHs92KV@te#LR#GFek{XGX)JUwPMq(x9!Ai=5m6Qi7 zDGydsDOgFRw2d!JaZJEUYeHZ01JF#-=e=tV;(6gnS0c0I7p{qPG^LaLmf7(sD=pH| zjuaX{lq#P073mw(@t#kdFQ)W&Yz-Ib+mX(tCev@5P=p9|+R4C%r`gX-d}-HczRW~c zQt*86y{-w1Ct}vA#anlJqs7Vh$_MZD;Zds(CjCtAFTL(VDw@m>A}hh^D& zn*TNe8i(E4K+-T4dEzS8?_e3b!UhjG8*Umv$USblUK0@qmI2#?h8H1_PJJSv*1S+#MpJLzs#u0k$aqv zRk7CWUFXYuhE@AZ3KLr+5B6&$vp`D%i}QOv{X!!-E_ht)A^!KQrRGAZ8Y-RvAB6Wc%#rWjUtp}Sp(SMXiXj(k99w!xz2(17)HFNvVMy$WTyA9V$crA?wX`<3 zBLzh5`QXy7aF8tAWALdhxnGW6M!webm|yH;TrOV-`2sC?iz+npb^ijpKe=Wek?%l8 zJ9}7VK0Ze;ejXoUn_}z>_L|_fWdq{07-;t47oY zO0?4=Vz~R_Z-9TFcNw~#HU04x-MAq6WIG1JQw2plHTB(dI4v`9eZH%*FkI|0PC%Vv z5o%R?Hs0Y&oT62Wup84w=gl&sBgjSQ2j?pr!|NlV_6Y5i6o1VSXcfh11#KnvFqTd5hM0?dr)R?_l+)1i*$T)!Q&d0 zbP*@F`eV+vdR$2{`><-A2^oxH75#yk2beViC_ZgT$u64-UdXGAvvlr z`)GFOkZX^ch^yxJVQIuW`nNNzJI?HYuAHf(XcE0G1LyFt+Yo{t#5+U9^xkUi9mlbA z0qq@?8)F3g0VBT8v9td!?VSdk*iM?F9ck@@B=2fHTR*q8?}x3iFHSBSm=aW+B!Ki+jtgMyj!@n$d{H4-D{nymN2+|yGw3AT1f2$?`NsiwR5#T zR;V4m#-Ci*JjPkHPv2b-ID==@GddGJr<__Z_JOgsHc&gB4&P=X+;8n>j?B))@}fxG zB$lsF*2LST9O*@4@dWIvS%qz- z8SoHk{zl{lds%~bcH=Obp1l~B;sF$+apQ@N9nzTEhcOkx(*TGqAXa3Z`@>Uy2Sy3FVS|!r%#KvoP+kAKjL*K3>N-C7+enuO}Vw3*7ausnUtKK91tIExnvY z%T|8cNG)y2mN+SsWJ}|1J!aC0evfOC5vgy>D0j~_X8yK}ld-h_`V3;Vr||wJ%g0L; zJ0DoD5y#eC5`Au1>&p&XDGpG5%UHb`RQu^I2!W)2qkkO57=4few^qs1hngoz|AL=J zVq3R?P5>t+zTZurTI=*k0&|C^g@dbBde(Kn?}`89$C3EVCq2&F@T4|b z;ghjBPdbVdv4#MJ;%jjBcLFHvt2xC2XEtj2i5rn`2Yk&$E(_=dS+n)X->gx*%Hr#^ z9eK25+IHP~hhxVuMD+1|Hng2|>11q)e`~j}UUa%ftOF=LG;M2lnG}WVZ4VUSJn)7J zSY5nb&*+ISt_du9W=M(b|1zm3C@wF)uC4qThgXl{f-_(uTndG-i+9x zXbt@RGA(#Nx&=v&%f;qf`)eJ7Zx=Y*hg>yJy01&#_tK9-i?q_AYj2Lq z>n^}stel8TI@_+J*5I7L(@yCAQ0>X6l~3Neai#~>^DNow@MR)G?=>Tyc%LV%XHiL6 zU#TX`l3CAt?)!KLYdtem%>%Xa9y?Br_xkUqT~2Tx3f*m-=gSVoM)dyJ4Ta_NZEHZGKMw4%KD2jtD4U?dk&1j>QvuAX9+X9c68D1DLscfy$kOF zD8+lK4wuZYofT=;lQP4tXCuvi^!&7AMcI$-a#i*sr2f{OWf&mC!;W7A%EwHWJ)GwypM zA(w_X;0>*(ak7rM@!W;=WI|Q}_R1E}2^_HlsLGJ$>&keUWBD11=o9@*{eLdCWUbQS zp3ud}(yfU-nO}6=1ZS2bISe_R?WugpV(gdmYc2WVR>XJ>78( zr%FS`I9X0o6Q|g%88G77Jq&T+^!CJweqZ|bB%BaWiiGI5aIE$f`rq>7Y?^T{ewLqp zKL^tE>o~bV5+-jWS~j=&pZ^NkJU>V_oDxZb>qs=kasJ(3L2>sWibPB6DJuBaSCsTL z#f-ILMd?dR*9OTReHX-&5JKWKr&wo0vkJx+;eA32aB_9H1Lx%MHlhW18_@!Xf8%gn zk6=f4n{)ecU#fGsZxlXPIET|*)NZEvkk$&>;_RFGrmFJ!xg~}!7ni@8dz7Bi74_0; zPA?UBs6Hl5yO=~{L#!g?br-FOs0X^?GiE>+t)9Oetzh!d_HKW&JlD}`a45N*Lrh%M zVOVm+dWEhJwr+9I^l*yMba%mcL-XF4?kP^iZ*QdWJ;6a%G2(hDCA!u0wiQwL<=U6( zQA=UYH&-9E^V^{NvyAmkLV@uHJG@cHTzM1^-Qu7@&ys4`KdxBtz}FEaOuR2i^bGaO z#9}&k64)@n^1910Dt~V84h?Ms&yAE@NGqINhf`!U(D_pDz&UWq1_-YCN?1q$r_Q2crBjSI4~zUXw(&$#q2sRp z80`g*>s(BCv8Qqki^N{M6gcw<^L*>CBLXewnBy)Ni*spzq!VRd7IQh!PVZmNZuj-L zhV&!`rpvb0ILo&vaHdqt?667OT1r(0)Bt@EkjpeHUj7f-RSpY%=aMl8xZ5?SB>%_(}MLf1q@GJ7rYF{k65 zj(KZ@ElnsfsJCQj9z3HRz-a|UU={^lrMRlz@|RRREqI3RB`u=35BziEf9%%by$0t} z>*ny(i$b{EF+a>(Ul&$Dgp8P@j3FcwZ6%+I^_+Fo$w7`Tpw zhvg?8!aG+`m(FGe4iiU71tu59|CEw6)4XH+uk{$e%{H2LN7AMSHVnOv&zLFO8UDL< znt%V)Na&eMo{pCh-|PU_@!%RyplEnX1kb;CPN5|+C-CIRAv{0p^B&ajrjGBnWsJ&= zoYP~rc@N}jJt_V#Khq=Ti5bW8+VO75usWXUJjKm-3ST&|Xd@!B8w+4xF6>~Qj&#IJ zjv@}@#Pbt)KD#@_D!Y<#hHN|A>Kf>xr}HzrfkitJ`%*bLXr6|Obj-c;@~Jd(yYG~DU3rWH`!?9`77-XRAMp1e zUamI7pZtpYE+U=wsA!Mp?t2qmkr4Jqdi!tP_VmE5+6!5QC%Bh5=(%IVgQ$>s?XTDa zTgGBx2Ve^ZTj2%As*h%e-G$hN8%DcuG)C!sUKiflvlFMf@y>=tb2JCyc#apbS{oI@ zJ9zS4b8rst6n>>J|NbAd1Kp8z$c4S}IU$;Jbv?i1Cj~?Y?-1+`ENa%;#(^%PsA8{^ za%Zof)81C(WO(c`=?VA-uY{__o@HO=#=xQ`lq|!OShQ1U$b1)0ahWaoGU*QB9mZdl zo_e<|q09BAYFYPAOEca$j!5eGn@478GG#2uWZYmS|%xt_(Yq-{O@xnjj*J^3h) zZ8{s9)6q+B8+2=DXh+?6pRRu=-Y-CBB6s*{-%38!oKOf|jN11mO%M6^;5`XG?{4-* zg?8AA+ZbAV#zJGU({IU%_JdF=Xq8b%U!l1MFFQ={xm4e?u9@#U=TG@&6(A}Rpm%if z=alKLwYF=1!1ZEUf94BieXqRz`tMJjKKcp=Sblu){Xg%II zxh`itp4PJCHNy6j-;j39;yb%Dzx_#VU)**)vHgnOn(TF2-<+fS;-_hI5S3YMkAwWs z7VUlM#Esjn7w@!7;n_F$J0W?e-|de6%~QAgw8#xU1b;YbCQ{6|c8F9SVK+`L*#3_= zv6mS-RFGY?r6|7ilevrMotjsC&w+a~=Wm+ty7!amrSOHfmQm!awJ86yGRNL&nNqF9 z@oD)PBH(&kW|V5liRTn=iQ!nJ?sFDtv+=g4Ezn;Lr+wEkL5H3fC2L2X%-%IQYsMEM zh7@SP9zU~pFg}_|5goFJRt|r)k;6VWxp$@?IfnLzZf~czj3R1^CueGHpVIO4ZyW*q z-ja6M@>XEQpI+zC&RAHrO5w%7bcOvQZZEW^H&l!FWs3IJGP&Pt+3TYB`m);v4~S3< zan_dFYI{~ z1GQCE_18D92q?c~JHh;2Hu_at>-&VpRgKqM_v`DbS5&Q7b-n$IP^_q~v8uX0=xuHc zdY3Qu-cefQ4L;ZuT-I2(d|3|jFZ+_jZ+>eT{0n*;}(b*yzO%=6RP^ zH3e!7f+DeQnK!U}+2Xn-ETi!jZ$@KQM)NpPA8z1Z&gIgEPRL=w2kRP}8kt?Ofmy?f zx@ApX>xb;>tClo+vvMEI$jy6j9GgHj)irwYn}0d1v37ZLeT{cn5Wg1et*vTk2rgq) z_4UgGSs4#Cd#hJ91slhC7gyEQ2WwbH4Hcu-Re4ud)z{T{E6VTmPRz;o28;jE*zAcOi8v+Jv8BTpC=lFi@QZ#zBqh zX1Cpr#x1L9tgX5~$Zow&0!UdATozoiys3_UR8S@sRpN4)z|@MSg(4N2!%COcfm*$& z1#(+SDPgjNfux*jTq@VO9N-g+vA_609S-xVfx~1m#82@)h`L>!r7N zq3I724X&g^WYeFRzS<4s7pyN<>HnEYHF7*3{=$zpxl8K z!6sHzGW{0sG_Nh8V4$WpDg*eeU%qTfkVcY0eQ8}&6A8ICh>?w(4>SiGjjk|$ZPObF zu4t-TTo)ky2M>++*EM(tr_ex_b4uU&=&f3@BsktnX5)7HYx75KHpnfs2h_r)jZ3Ji z!L>kyMsG(|Wid54#gY-#K_diz$aWCz!I?qZ<^WY!H8eNe;$2*~3?tRj$uCVGqC5*! z1!{xd8rVWo`^Ki_&_we$L75>)qHM_C9`^X+jp}r@Qqm(X88BDZSPRuN`rk&4->Spx zLR6cU!*qX3kn=V+1OtZI!^p2*-i)dY!$3yR8*EsPIq6%5!Kda&_0VD{c`b}5X(RMS z^p0Jt-8J@|>Z%%&pTVMcDSmstYKfsiT=Z57n;Bd|`t3D4YeIDunK(W&s+!1dVD7D{ zTLPt|Z!m)}M$>|;{10NPhaTH}F0CO0kKd%Vx}9#2{T1c{cbXf}1( zU5|BW%={9=;9ps0dIG5tnFKF5;HH7P30hcRT@|?B$_iJed4l zpbQITy6nM8xi|AWs}_=3VWe2HeaZ6QK_=B3Xog6}4Nh(*%@d7l9B1?*?BE@RUg%KW zGB(zGhp=+dty*ljM;W;{J;=TyPoO?nwE}Jn8JQ)^>K?+tlsbtmt$GkYE?l)_DU@U( zpFSA*EX|EDOWfw#lkUPLE0#AmK%p#Ml9Z9b9bMSCqN#z^qQ0i;U{w=Cm)DbpMmH?1 zuUZAYXu!`PFAprQUuZcmNHWL;YYZWp7Ts`%z{S!A(~XKwT-6Y?+8_yhq4D#`4P0~J zOoE+S_#rjM?^=VW`c(@Jvm%;<{v@Zlkp-47zrQZX8XE7X%+N+Yh8HefUK2#B=!Avz zJJ>Y*>TrK~UCqM9b@iAc8(9PNM4Bon+mK@7szQ|*%rUr3%V-X(Sy;QYD!>G94e)@P z7Lp07f~5#93#?ex083Yk-|41|#u%(YF+N9I)2#K&&fJM6j{_46oREit3+wC1Lf&C` zr6n|{lIsQu@bAXo*_e4(%{F^|M(|sA!a71e6~<45V`X9R5UlZAtBpok_vG&ujY{rI zv%>Q7Z{D?V=AF|P&i3C~IelhD={ILcH~lk9{L}rj3(E&5`wM56&s|tlSW!rx%{*yy1qMtTmtQL~uiEyBj1Ba*FI5q>IeT?S=OPx7%==L=LQ`n(GbECaNUt zHu>gWa76Ak#s&y4s! z%&wr~w9@1T8;)Z$f(T1cpFF{kw`q0-+47+?d94v-OzZ)ykGV&K)eSRhlcoVC#SUNx z7B4p>2DK+Ev6wtqGl!JeEG1f1Ek$s`E-h!cV|l|W3dA7hu?*vZ?3nPrOReQIg>t@W zEtUz8yCFp&M1aG48##h-lWUeQtPKZ^D{+El2FD3*9jzikQ57#ejfe zglAiYF=egI8x0kdEDPBkn%~Kk(qw^kFE41simLyqa%PEtrK*3elK(fqJ#)#dmVU1u zuRg%OA!B%8m<`8g1U~fJ^(pvx@EM6uDn8@z$;Rh8e8%H50iWyf$;D?PK6&`$aNdRm z#W|B-`NkiA_^t7yhj%!BaBbVx4`R3e`~LoWFDx&g{nFdl{pOSIyRR61b9d>(?|0vK zF7@@y(T{(wC#9}eU`#nw5#wxwij@}MWeoR826b*eTg5UrvB8f#Q%5% zgUV{87cuyxurr39P`_V+@1!@RTPf@?K3u=9!1rtL9j|3zh3pdh8vZApD`bZ$t9=ol zbXht>{Lw|c(M5dGMLf|({Ln?b&_()67x6$B)lV1IO&8UxUc>;k!@8`tTiE)ayhxUGQQK%NksL@~)E0|Be6=sDZT1c6i`7o)mhn{`pUGwhb(~sqQOo~Jn1n%% zrG~*6kRDKb3CeBMNNNtJPIB<#(;|KF)wsOo|5VnHlfRKnWMkc8Z=fC_7P9iRJn`n` z=1k0)=*_BaYHDb_<$7g@g%`QLzJBG>30OPa7YsDzEU9bq(uNB!xiBv`Z&L0}c{h(^ zh1dyTE8yX-WLi4DI+OGjEA#W}@){;CT$b23-~|evDdA{(!wh;&b~?v96?|C1Pbhegg11UIy1qoCzFY0|MD|nCeO%f2 z#IP5X{vBcDhltFJW1&VIw^+%TQAwUcejHPO^NZt$EQtKk{3RRZ#kl5J)St`-uH}WP z4`N^msXn2f$?O(t2ri!PQRsVEf~oKS0X>glS8LJrrz-icFz8!$kSy{=uR)%@ivKir zi&B1!QvNFTtZC$^k2Q9!lK&cm{$frNf3IO5m_{@WD29EVZGba!65q*=TH{0L2QPmg z()h*kF$;p;!&!`-2PXSW+BCEKLtkqZ)i_KzLyfjc#SSU zmVGa(z2mg6p}s3nAI%+9-%T0lFJSV$to9V+JHN&n_0P5-8>`6E$9{(Xo`CX}JWiSQ zC83PQvbCMC52Z+_ImDu0X4CU2^7bk8GmLbhe;MqjroIgajTm@_(fXFbMwT>~xNWJ;+h==PEc)!8a&)vO!<;2geO|eH_0b;iH&z z=0n(D$308lN2GL;m#{~Z*{$fG9^{7_*!e$_@~?$FGayXTe~aEGDV^y3Ny2sG8S4i< z^2aHEG19*+(VvI;;ZxuV61}^jAN=C&`Hq6yB|L@{7gre^gBW&`A)lwE^j-Kg!qddFPxq^#E^qy3|aHy_$CXQ=`$5vtKfD8=h^(+#PZ0w!Bv7! z47<{pZy%S^{{(%%5AvsBWyxQ(=O*?Rn45}pGNV@dYNQqqSj>7Od;|4^_~$se!aTP1uf&1Mc?Zc)bjtp>ls-f}Gb5sr`BBsfm8 z`|nnT-tDXb_C5sts6-jkk8X^Q)4(tjw!Un&>D_MB|0@Z5;JFH(r{H_o{Z3BoKKvKM?p4z7HR>1k zk7J>)9M7});TS{Ayf~h3LC~l1SEgVgFSY)K3O|b!T&3WEf@>5URPbU2FERML+U9SG zl3r(|-(sh8{DFe^DEL1Vd_cjcBpf|I-EY*l%ueUHK*6;VjxN7c;eVMyFW1h`vGCtH z7W&39RMfmUzQKZw<0%r3uD`*kFV9Zrc(Q_LC|J1&mAVXrv7N0s!w3jU#jcPV(gf`6glc?v&2Q}9tGzZfr^zj`JA!wP;!DKGpb zUj9QR{RySK@Hct>&z1bYQ1TyFuuH-3DEOp=qy2>@MW0t1`gylqKgaC~7WQJLQvN}s ze7T*U;}r_7mT>fVen_GBZ3RE9;71hv9R+`vHDG8@x{=R}ASMX+oU$@OK#|Uqj*JdUE z50v~rP|}|?(vz&>>`5j4M@G8WPUl$k|Bu*P@SpcV8Rhth@K1ikHsmly_M3RN)?Y#& zf5hfP8G4aUv1>{n4gdRulD|T#{~t&{BBe*`=Tip1V!q{A@cR@Sj`2emwOM1g8S6D+ zA9#LY|2bZ5l%PLPDe~E7)R%6jb38}EYb6}b?+&B<^m8Ts=LS6?e~yLyUk5u!fJpv)!~_fk`m0eM*1v^f`8Y9M4y<=ue(5;sqRw_zuS>ZT>i} zR_JZF;|o0fn3A93UHszdA1ZjYf`z6 z$Z@Tb{_sH40uV;hC`SWm5Sqh-W4M(>aL2_Uk#8lf~FwNSEg?F@B#j z_!stpV^KfHLjD||xA}RF9l~H(4Em$Y`u_{_*TYhM(eirUsPBMXp5r0~Kd9g%3Kr`f zUjA7neY=8NB>Y)AW9z`57xzeB&zrjW1aJ)dwKAT6&3=mf{}|5q{;mEJ`u1z~9rWkV zVQejW)PIkH7QcSYCIY8I_+;h>_fMZ8k8E4NOl%cr98Xd3A_ebJu#guoFXY4VCsO|C z{&~URC(TY*_aFO>bm4#Wvu~q)KY={0{bOqXCc8Y(KU2aFV7@(${N$Ef@@$dPsr(@c zhoIj&`pDYP=*0Ma2jzWI`CU?eD*vX0_o06%zHF7JbfN#8KQX>JzSZszjz5;@?SQ^F zgWg!PekaD`9l%!qj=^}F2Q0_y7fAF@V0>&sI?32-|3)dD`1?q~DQGXhI6o^CyhXv( zUOE3Q3T{{M4;B2hf{!Wq_Y(dS#>X#!hoi#5`u(DzFK)X%FS2XV|Kl+pxPNNy&sgj- zp1(!HQ%!%yZO|WY_%ouvdHyVkKFKdd!D7DT`Ne$rBFi@q>r}XC{9iEm-D|gx=kHbU z!wTM_;GGKoSi;fc?Ioi=!T(EaG59BW^Y(K26x;IP`Gx<=@d_nf%tt)^_fq&hgMTr;U&dQH8Os{U&*WM9E&A(a_C&l< z+&C+xu^gj6m+@Qp`!ahE0bHmL7xTmp+M*V-6 z(hd7#k5^vb9wnXDBmCm&znAcNT1eu$8Xt|_pnYV@2h9S`)3VI=^Zv?L_BVNd)er&W z`Yo$~J-rouYV9`=e;Cr{#q-axpxNJIy~)#ONa@k~^qQhiuPgXJ4f(a$M@Sh6(0fRo8WL^VG`tKC{rjg(3LYhgU+jH7TC)xAsH2a2m_-{0BXzX@H-oH2U zQyRa1&)P=uZ`6$%`!^;3+eUuUEq-xKwo=CEvM7up5QWW<7w+-$SynP|bbHPi^$GeM zXWRKX7W6o#vBs}63cYs}dK?RS91D6J=UU|0I|{u&DfBoN?dMp~jF^v<)-&HeNS@Sw394f`PI^ZbH7$AbQOh5q{neNmoc z;h%9V`itYo?e=pl<_C^nRnpUJ`}02gHjG0q6g0))pU+QXzUAdVP|ClqVBzob{J9eS z=>GV?Xx|1qonsLX;P_P~z0|&SS~Nt=e)jKrSfFIg@4G? zF>#p}$MFgtrQk&p{w?}@7WlW;m$N{BHSk!oJ<iyKK&5&C4fh2?;P}ZFEH3J@D*s^8enUE zK>d>>(fboJzN5%XoR9gCm4d%{C{J^eCC_%Ld_y|o&qxOeBRz=q(p~_#I0pU*{c#HE zR=gv+zqr4<40-v*ah6S=<0q_S(?33};6n=j4+;Ma^}mVA({Rt?|4N1a8M{AteZpVj zSi}b}u#X^*n_zsb{(1=dPzju9(q9aDR!jJg=%3}lviz#0`d@!g%U z{C%Y0GU|Ne;`HxUuvpLV^ed(GH0bBwVnut1ey<))Z-$ir*N_**H{s&j{JEucD*p?m z{1gQjD|ohoXR7oRyhXwIQ2_Je?fa92cZ1*mggnVjv-A%?jS!XpAqj6sf1gKwvNu-# zYAK!CcU-~gu4sCHm(pK{zWxLByb?Y97?pW(e#<2sJw87&?3L*++|2!off;KOne%^v6 zeGyOpl>HC%^)KjO@~N%q|g)Vt4~=^26P?$W6iJBpJM*x^^a1@Z&I*0FZn6^ zHaa5?^xP&t(enP>ke`qT$D+SDUTgEuv9PzFvqR~476A0oY@@x=^#9Io1^=^Wj21$Ba*!_D!|hT!@$-8Hi~V8F|4Ai%ime|!UF_#_?2^(SfP8L8 z{ZMP8eIMdW4Y1YURKL(?UVed8p3-Y19IYQt?OLQyfj)Un`UXATc>Hy0*P#EZrS$0X zF0BmmUyXFxUoE!FyA1tXtl*szE=K=sLU~KSss8t+^tx=Uw~#Kk_hTvj5ajbaq+9hz z^XJxXguVLzkPa8o){pz_@@{QbCSzY9eYli9!|pG)!M~XQI2QGD+-d8lTU!Z6hs8$6 z=P^;47tb%&UmPD%(%lM9SFo_Jy!?D6{Rs)DK%RGkA4|S&^yhM5OCB3A{%-@e{PAe{ z#cPw$zpYY!>YrMxIV|3gPrTiJj)i~1@jsOO#}zF4o97>`(7RH?6QM5=@MGCO;%AwZ zPFVOOoZd%D`r8T?{lW8#{lIvw0{XX0YJaqR60{xAze7kbM4K%8)?v3V!H`dmT_49! zOX+wmK1*jdNnfPka+`miU+6o>hm`z6zj*r3l=KY>?p3f@-}3TbQ|cG` zGg8wb&t%9$?oTm3M=IlQlp&x0ujDdX)F!9@&p*d5$*n7uoqao+9D@B*Tsi z-GcH3M*e!^4*lWz8x&kE;d0oQyHP*>+2i*?DLoGZ`pW!T4TM&Tq_+((gxq{g0F$3;Q+#gHfIjw@dlS{)zF& z>)$D*e}T?QM|u1+`ac`^28muK>{%(W{Qr$~c|StvPrA|mO?G`8KP2H) zl>Y?ft$0x~>KlQ|EPBz;XJl&8_*%^a{S3#8`1AzGXA^LO*`6I}|5o6UCjJ5Ds{_Cm z{bx~sKd{xlpQ8R#z?MA!kPZJ4*cu;rPbm8s82=1;&BDO@2LOh#fnNbX8NavPdkEO#ZzK2%1LL2O{_oc@wh_SEe|SEdu^$7&1u@e7 z;BODGwIAXGfBnE#{XYeNe*m`R^9J~N57?5=htR(-fUWpL1NgfFnXUFN27hCLE&jd> z{&ImW`VU=)XRU!PdF}##bAc^>J_A1uz*hO;z~2S7{L$$C9jEknw)P?N$0myY`3!=; z8rWLjh0wll09*A((;KhQo1owv1z)e=Tm?^5aGrwm6?}uX1^hjR_Trz>U%!U@pOo-h zkpFH;9``{0&jDNQnFaZu1h)FCX*^?Rfbq|uw;b~S0Kn3Z==M)i_?fIVqJIMD46A>S zLcU9ZF(eIog^=$fQu;mMe~pyh0{*`*rEdZMPf7S{@c$Dje+u}2PD=kb@ZT@tZ-D>b zN_YYIdrQJU1%Gr#%F_4o;O~84-Q+jAy*DcDy;;GxDEJ!+zD>cmEBN0OT%h1W1>d0^ zAVtOH#U}-CUz%y+GX~aKD;Xa1qCU7p3p4W~e47REKjDa3z5?G zy<*^DtcDzET({$sf?d6r%=wJ&5xvna`o=H9>oAtAi*UJFp6(I8f(!+&NAXF)sGdaw z-MlD$Jt?kv8Rf~bmhd<;Kh1$D&~oQko=9#@3amx}DLO8)FDaNM)|>Tt4SW^*6%obt z2|g)UC6tpQgc|KsupVyabti7!qL@!6_pXnwZj-!Y`N(!6Ij?hGAUPP}=!H+2YJJD?4O-A`XwqB|KmkKUW+A~gR?=uO! za$3`;uv^($MP5IqfsE@7d{UsL0W&|{BYuBw=BI8>VN=*@Ge5DB!ird|6JKy~>}SJJ zkHE!jfmxoXPi2S9@y6+u7-x+sKgXr)NwfVte;J}FHGy#Bdtf_Z+5r_W;-O?gtb6m}0QH^(#2 zzmWaR9G^5SQrIH)ikYA5V-?Fb^Yiin_ES?oIIdyeHs#CP7i8_ALl>vNn5CNZy||ac zmKbMODIJp&a2?xgwvT+u6m~!RZ&QA}{8HvL)60$YW$b2CK8p?9z+O!alNkl|ZVVb1Tj*?CeFTwGrs zX5TUUi{nR_J1YG<%x#V@ZXdtP?lA4+2GB@ht?Xq}ew==YHJRo4{LsO|rhIt%S~im! zfs6M?m~D!}ooqvtzOG|wQSx5T{yS=Xb+Nyh?dAME%Bs!r!0X$*wj; zV;4>RD8}s+7Gc$!%d{WV z%oMhn-DApwr~iPZnEJx&dy=`#@qz5d7=6%`&m5!tkJ!s*dpivL|8sUWa8jM+*`Gy{ zAW}SG5pgEs1~FoKX5Co`ArvE~h)5|#M2Zwymi@>sS(feYf&?+8ky08lMWl!kc`;Ig zF~%4XW5kG&rZG~C5oz8urZL5orZlDzBSwtxb)EaZ&Utp2A-+C8X6C=wT+e;(=i@x* zV|Itn=63ndHzhxRF85)dA6F+o#GmT#TmGNV-Q@e1<@beL zqxdgz%Esr{-ab|vk^9%&gMNIo_5RV^EPuZ) zdH=E8R)62l-yYBP@(q**JVxNo_A1Y3YVz}wxt(1 z*!xfChSeoM`p+kGf9~y{l=Sa2xnGy9=TCY2Sd0C4htH4QN&lY8t>uBp3*YCss_^F) z@Bf2||JmHz%KCF}+4;@aRT;0W|26M#%KUk2*?3;&?Tzu?2>kxhufGSv2;851h!Y8A6CNY*dE;sC&yHj~FRa;eY4UdN zRFdzInil_=Dz|^Yf9CJ_j=<+p7niLc?`-c{9Z4LdyYR39}ZGb!?H@s#M;;_s} z;zc!sy#M$+N+a->Px{@`HObE-YYyX;np$e zQHAa0^oTqscAc2ZpnmVJ4jlWsG7g;gnB)m~u#Cr};5u14=V5*bo>0ir**^u>$a7lUgzTO6|V<=}`1JCxOU)PBr7WO+7#^><7g!D=sA zo}0jGFIoD{^!q+XmcEsK*U8d%fz@8J^nGCEa64Ezkmb1(tQ^SF@2219Jz4qz`dueW zKMYn5Wa*qrk&chxm=gwNEFR)RYm6P6HQ5;0a|W9%4@G$mcF&itE9# zuR#;Zqws_>36I#f)&4=o_{b8S)N|7uBFz{@9V&Nu<{|x&pD}l zw$bD5BFnRz9zUPh16KSy0^Sd<-ER4iRrfw{%uezW*BK1OOYNl@%g< zBK1$&cFEE?1>-m331uW6wL8p1mWT5*8iywot~tDi&%!wIWeFy~&!xJPA*t?kaP6lo zCRzGyFz*er%*R80PL^jWIOa}(l8mGGc{q+ecu)Co9K}3LM3>_UWe6UTA6K|!u0YPbi!su``FHmODBM zS^i02tX&Jo;;I9AuA5M ztl&CX`do0#CzK_4CteLKdYvzTp*4}D;PL{u#-Uv^;$l^1H+Pzjc%!h~7+S^PgD`q|QeWsJ8v!81} zZ+h70)1k+U@r1&mt-akmWYuM}<)KyikmX@ND<87-wbVTyvh+>VJs-04E#UYActW`y z59LFaXE=5L10k|>_Id3WEq}7~%L1J&o&Btw$tyL{OR?Sj9N*|#V~(%#SqN4> zWYy(ZE1z)Om(t&XCzPdl$j=lDu9KyAgNvPbLg~Rn+ak-;57xHG($~<>$%R6ez7AY) zoh+U6N^1gH`d+ZMOP0<#rtOCF?Jnq17oJe|&%7HBX5peN3 zJfR%JBhQXOAHKUX<{+T(cbRnV zN|uMelNSG_dBz1EvOK(p8~2)LB0XOoocutR=W6QwgH{x>^qJKA5;;efJ`WuCo6g@e zRlh9+YaGe)F9vHI$0h&^Dwxu9#1G_>5qYHziRzYmi{#L1E!OupP~K*)5+2YaoqpWbh7lJ;P|g$L>Ug& zTqVmh0<5`8mOhGpb}9;4IzLk{xK5Tn9$fo1%YiJt0bKlu#c2d92eLeqz{-IveG2^> ztS(tP*N}qi;d(L)y7m{c{0pf2{S&hE_CO~~UmfUV>Dln{+H9(Ps0HC3E7V)RRAE z%b+YuQz|kko{{p!9DdV#N^M1SZApwsi zb74Taocs~v7_9k2*0%VaZ1T(un6+wlSzXSM8qa4)z{AL%TNLOc$vg0bG8zxny(Hi| z@-28m8HY#B&IIlEvp;PdQ~!+daJ*=)l9fN>>v&C;K9;&4ugTJ9faA~N31u!G#ak1! z`wV`b+yzN~P9v?iWa)dU-)s90S^8bz_;Ywdxf>51o5=DUr0)ANS^7hPpDg`Y;3rFe z3LNjj6Ur$(v@NncFH!exk)?BtY7bieWa)K*PL@6%oM%H($kI7R1=q>a8^HP7@PtB^ zJ`r4Soh*GOSnD2H`V#72w>-(x*HicLB1`A867Rzk%4R%t+$YPE97DZN!ec0#5q%y{ zD0kwaej}^y5$b(-LLo~Z1y+BOr6=>y`#GG4m&2p}B+Fk9R)3PEH`4F@MwUK_e%Hy; zXMxq9Wa)#bf5ZBdEPV)dKNgUsN8tFIctYVk5swM@vVb|((S3MAnSw{r>s|wnzD3nO zAF1_UfC|TYG2W~FzU4+%4z1w$5S~yv@X+y>EKe6$$6vDa9{RtHCls>uesIBcvh?*} z^&46G&0w`}l$=|^f$_P9n=X}6*;M#|+y=2814~`Gx35ETsI2>Q` z)PUKy(iyGxyLdt&E9Nk8{5`66&s@i>QTSP&WK21!QDQ#+CBfwXHI9!OGl$~$jXA#Y z!^T(RMf(d`F*&~R56m+cFRHsR;0wXZnXJ0ZKYk2PC`o@hNBCJf^A{)iKTfwDQ)1`K z@v}JTPuC|yFaDVBTy7d3k@M_;=Y!Q(WaYLL96y04l;wEnb11SrYrxUJ;|XO09^%bl z#U#tW0~|kzCzM<9P)xEscYu}i{(ujGF_@ z@QD5^LEEREF&<6*zm1u5(fxISei_+y=2<+2Clt=r_qC6wd$XmkHV! zoiXMZ<$sm2a%OG?*U8e8e12{IB%ia!Nj|?Z=Ga9q8PCK^@wdivs5>vC&YLkPt$4(| zfJ5oVqxcHr9&mht@mlH^8n2^1#CRih-|l8IFaA(=l7|`JO6J8M$^o)(_a1P3vFZ0y z=Y=53F|vD(gX7nj{v`EL#!pcnZOmy=^!7eWofn8G?BZg<_(gF1dgH-(DULB_lj1t# zi29|*451v7Yf0B+4El?@GWF-%YlHOCwolhTH|BN*;~V8QHJ1AQwt-? zFtU#w=aP72z@y2Y1NSL;>d4-2;{ttrz;VEw|EkORCgyw-PbK?UPb0t5^5opB@n1~m z+>?KHz;gqhAMnC}7YDqQe38ZHTuuIac)WIy`5)4vbdkM(IB&)M0k0u*kWto=UuV3Y zJkodr+2d>qcyqv80^Szzj(~TPeSCKZ`W~{+y?udxN5FRlyg%T30zMeouI;KzmSOcc>@XM8a(77 z%QFiczr{Rr>G8fI%d;rZ$JY&8W&o}0L5GVSAKzAO3H)=1qfNv+q z1?4;xKSw+ep>RG#?>A;!@{2N-KM%d&I$1jRk?1eXKc00LXDkorQo(hy^agP81Lo&G zm0yyvJnXlE>tyLu>2ESWS^6|^!F96qnc!%t`DcUk%^AzX{juOWSvvbLZZSXSSmazs z<_9t;m*J6b%UE?e2MVr-^I%Q#;*+IwEDElZrLP9-z6x17Fjsq#wS^q&@rNvavZgsF z>-mRG=NQG#$rw404Rr2b(GBLG2rjy33Rw4W$l5OFn__Z4)ba!zg)9$$j`<-f${6xT zjJe(72IG2g03M;zy02r@q~u+2Y#~r{NB4*`2@_*jMOf&{Evc_ zKj(ZcF9cD@^5ntsr%mUa)O~NVJR`x;XUtPaW{070zle4lFC%}}I5~E>z9#T+jww&F z;_nG`vh>HmihqWDtHtM>i9TmM6fZj8BdhKxdiIznPmllpIa!{|sr&DrlchI;qkqH` z3Qxsq`GvdA^30^}p9PSm&j%O1?L5U1F9An;@r1%TDSbIO@B1=YaX3Gca;EJ{s^7V2uk|F`uUA^LRozg%`zqp6q{UJqUA5@h=IO z->DaW!RlTP))=EG{@;s=pX?*vw>zo(9M}VnZ?|pj18ZAk#o=eN zv2W`jJ-$wo8ZEGq0o=*oo zx*iEU{C}Dh|5kAEix!{%KT~m^adKR{%b4d{u`|!3#ACsc>*K+-BW?bWl}|(9pF;na zE#~xqd2Ueq8mmiI-FaYbYXLo@%tMxE2|Zj~QM$=rF}?vDebqQQ9vv{g8G7w&Ee=_6 zwu6iAzl9$EjEpP~*AShPgzL#Z=sG7M%YO&`U$gC!rQb!r>tyNofptzomi`bpy2s)i z1;<}EK1ToTctRn|{{*n5GZ5$i;F9X*W%tKbp`oNRSy@L=?M&S`Vj{!&DG<_WP`;0mF#Fv9L zUgR`BSmRY6=#BJ$%i@sbpG3dwWa*s48ZWZ+x!~yA7H0uHwbn+mJWIgwA@eK)7wD)((-nTb_l>=Fxo59L~EPX5ehb;%P z^zHP!PL|GnM>&wC4+m?zWa%To+Adl8DEc3;?UJSE>35whopVFmB};Fl-iId?vh=Co z_@6EQ3~efdNPg=8TUZf8bVggb%9Qnz5%Sy-^tQBF8chPEPXTm{y95Y z`WE_KCrhu^=Lg`ay~O4xS$?iR@%OAP_k%SqWO*I{Yh1|EAEN(=)g?0Gb$ zdv0XuPlJoz|0lu9fh^A{uyP+^Z=mjNzY$#fdYdO?)#du2JZ}aoPqI8)!OD{?eLMaCYTF`9 zzlDC+$MwZU8&Oc^x$kIpC?>bpJ=YZx9 zSvtqM_6^o=Wa)Fk%7-kSug-e(z(XgUTS){-fpAr`IF_}4USJ(ZhPtRd+%g< zI6vc`n&$vL9)~Q?A$p!R&jW#nEYBm<$69V=>5o%?qv>SnTqooIw3yG*Vejhmgg~d4pRt{u& z4uh2gS^9(E{0ml>Ed2=mu9Kx72dlkLf}>wr-Dk*WjGqU`zcM}zRz76KIRjQcWa($= z|FzX6OV2?nxK5Tn6s&xPfwe8NJP}yiB1`A>SN<%XP{`6pgA1;crE~w)w#I?AEwVi0 z!P*vCdQAUs@PtB^-T*GRPL@6etZiKlj$gzR%5?He#xwAu9LTCW3#=T-(&y0sTRfqV zrOyKwTqjFk3|0=yz)|uECjOs7uqHkBZzA)L z8&G)9Cw`^z9d;Vm_;rT;6(&BJU(>?$4^{sZi9pkvxsqSR@{dcg* z(x-vri!J6%a5T!8`?bEWBizRqK-c$mkQHYsxcFMD%Y9$p*Fl!29jx!`AWQE7Yo4qJ zt50@=Yxze)C}jC>5B$lx;p25AsC%4s{oX8Db-7F{ezkQYxgV~%ip|UaM8Gcud=2&y zc@~kqKikQ#v;2F&ao%_}b>|zvS|7;Db0a-W1cl!%sd+_~X9qZby?J)iUohr6Q}pTqI{zU{Zv@9FCMOK{Ksk@&neLr=-W+6-Gd87Pf={ygNFSE8hM2~NaEYC6OzAdu!C#X-tPKiR6 z{tQ@tvUIM8nls_r_yTmz8M6FbGxKk@+{n^jqThA0^kG~#{CnHT((9=Ebs1Uug{Z5) zOCn3>9Lw`VGZeD)N#KI(Wa(4Ewf-fYWa-nvacpsBfb+$S<(UP&;5u1)a!pike$Lzc zTQintKI^(pmc9tAe8|$5fn$Ccj?#)pzLc>%9ncG|lcjfoi=Iz6>o!_lvOK-ug6m}I z$v)!!6YeAH;fW_$oEyRUi5aWzM(73C$s$a1 zm|t9p!sC9#50+7Q+>hRFd?&cJXnjRi-TT1#deh0$?*|uLCrdvHj^1H0d7cnmWBdd- z|Hm22{}l9s>tyM?+$ws`ybOq@SzVq+%8Ao9KUNl*CnVWR7^zq>MJyy4#9=|t8mggFJ=9y<^;33Py z^(}s{d6v-Q$0@Qr9rVmMPqG&Iu^?QFhO_PjYdcwWlYU-cb(6NZCu|GfjoxpbA>_X> zW}N)uj1_YP^n&YT>D-&5C0U$&Q^xWPV_nzD(&>zw&Cg?5yv&$6#4W~2TUw3t(4%%^ z&WE_on9os%G2`ev0m$0cP_VuefGnNcDt203wo7%xHZlj*C95v`GrrF1UIvbq8`lSV z1GsjwjS*RO>5NvG|M$wd+v@&aIrmuIBztF(-z=gy7v!R`WbNi_g42TSp7qmC&zP%iy*KB=Mu>|p7+B!=XkD% z=Xkv5tj{0A`_H^iDc)>3j3;j~o*3w3u<2;4>D^M|ZB_k-0ZWa;dG^+`AuN9g~g#U#uBF#WERr5^|DI*u&;X>hc|;&8m8 zPZ_@ij-A=(@hztF9$Mtg^W^x`rsv7-XFrQ$`aM1`YvY~f=RLRRAB?Ahi=Q!`23G%& zl_$@=)jwqE$-Q@%2K?<-nTsED(*9# zr&-F4thzkiQEp`EJY~s$0Z%Ao={)TyxK5VNLzi+ROXqG`ybVt%qw!D%jRhT3xdAao~dMWa*7ygMZfE0`R@R0?8wp&Q}@p}$kLAo zI$8RuKqpIok-A^clBM%lrq5r<(kFuBuUY<+!D>5Mo~dB9oh*GC{r6a1vh?ZnyH1wQ zV_fm;=3fGi?ltZP$KNpS1uF-#>aGSW2eS0F^dGdkWa&51?>bpJ??>tUiY$FQSlcB_ zzXh!AlBMsW|C_d5vh-W&cbzQ#Zm>SDBuh_@HTPMZbB;BxhsT-+QMdRl^B-qSA8WE= zJ^@x+$kLNzho5hpbL==|G0!=6xc<8wI|d;{@!J+>2ww8{XRI8CK`OXTmOdUFf5-eW zUX(vso(8bSf-HR^{fF^{LYB^BR>5_$^jTod0kZUY;QT+~356`3$Do4i;qi#KOB9DJ z|0b~VCrjT9R{mt^Tj+lPPbg&RJOwYfPL{q0thq#%&ZSWEfh?W7S@8g#P`FlWoe9_N zR_M`#=IH_#ziZq>zkk+DR?Icv_#yMGr{^bw@tn)8$3vdY;OKki;hGsAG3Gj1{1@Y$ zVD%MQb$5f+S7hmX!1<$Amn?lBxZpZj`aR&{_sxG8tnURP%X0)AJ#3z2z4dF)aJ_wk zo*$U!S@I*s&x4geSutM#D}S-suIR^9tp*LAY=`|0;}fGqt1`dueWKMvM@O_u%ySo_5ZuyP>F za}ul^$kI>I|ET3pmi`?5u9Ky|2rm9#^XKrQZIR^}4A!>D(udIh7@knb(uaWyu9Kzb z!J1=a>8;fLyC%reyTQtbEWH=3e8|#Q)BkUHLLp0E3of`$mVOgh`H-b=1?!kXmcAXV zV+vXN?O@G4vh=&b`N#2uLY962TyUK%{UNa8kflEY&i@!sC}io!!3EdJ(w_k<4q5t( z;OGfFp^V_~TKv25M6mjqEdOM%`k5?!D*ZpPx@76o=y#ngeI8i-OqRYB96e=mTFL)m zd?WdU@n&%Gr^egCx-UmooL%7fY4hw0JY;$9qUS%&vmdPXlI7v=x2V10@46hM|D@F= z%YTS|*U8fP`!L1-GXK-yh=YLg9CdHY^I+vbR^1oC%7HAMzYmlDZ;L~g{u2GJlcf(E zob@?b`e<{JNatY2#bKx(+4F&;Jre*P&$ThrqQntnFm! z4}#-gSj;0}jS*QMejTUAh%EgW{V!Nuvh+vkcbzPqUmd7a3;M#ZL356^Ve-%DHWBFVTRz75T_>sBtAxm$h z|5sL*EPWFFu9Kzn7P<17PJYtrE&@kf%utpF`ZBQcAuCQhSox5pFQ?!49kTRp`dueW zUjr_lvh8jHtAEJyYyro=HqSP&@*&H!1FU?=(s$DD{Xmw!n|{~H((eN6{DCa}KI(qG zMwb2nSmzZFgQK&S=cDw`#1jfx{wKllZ_IN7thSKlISE!<$kI>I|B}@uOMi}j*U8df z1Z%AMA9yPtvOGh;vFAJttbEAwL}2AZmOhex-!57DX!>0zOCJkXKI6dAZ>=p2;M#X1 zSroGTlfiKg3oyzxfrl*5EP6c79I)2mc>!}P(IAU6g!~HQVPM@iBP(VE)_pUw^pW7= zV5>U{tovGIdGcW0*CI`8>T>Gb%Cs}px1IMGxe?M4xlI3{-tUSrmAEN)Y zR+lXODE+RJr9T1IT0xfnG`Kk0;+zC42eLe;z{-Iv{Wwc-*0#vfhtTga$?>bp}9;|atvh>TqYA^3SMtRHUnn0gVE|}g6R-R8(2B)rss~q=)K&4-)X-i@H_-oo@B*2 z3Ra$E>Ac3Q{WIGxS^A6M$mhdwEJosy0gnOee2=WUSjKYE7;F1zaQp^it_j6D<1O@D zYP=1szY8WS&Tg>ULYBSL^JLq?vES>jiG&ji7M}oCovUIjZ+a*h9 zyYl0*HcGFf-*vL|da$-jmOd36y~*Nm-HV+UQNPUeCDh+++)5sA+zwXGWW`(#R?cMU z-Sof3>XN1R((gK1`Z{p&a`WE+j{nej135O{L@pX{4)|trz3Cj^_^rk}$PLCj!NrpC zt>i{yj<4EPKGtei`BC-?WC16>|^$SDI%p zxOkQEDf)d}$nu{Fbh7m1Ue?|uwd6}trStxk#)T|BxtHbRa?ZUh*TZ{Rb*QUxAuCQJ zb^mSwvh*q7c#5^=FN7yW-^`IDvh(C<1~`VC<94_W#quyWV}Rt{u&wtfJ(k}x? z)2zKo%!?qPoDlCX-QfHTt4o&7V?@FA@OZHwy7mRK z{9N;k@3J@#fa96QkAS0h8$U|VEaMYkKo@Dvwg4Lf3!IAgp zvVeO6<~ehIj`dIZ`E$YbweTqZda(YUkt}@^IQlb-vxS~Z(RnCjd3I6v?+GVM=kX<; zYjtm@$G6g*}K5G|Q`sMVyPL@6y ztlY@bXM&3hEY4hT^ykL&!ODj$|3a|xAxmFOzi*c;eJTB}lcg^Q7Z=*Ldco2AjW-6o zm;4u|?=G&Hu`;zk)`jT-*vL|ybp}^4Zfu+wLsZ^>ZGwJabsrb+Yt%^m|OQ^ab?0PL{qDtaW1SSm#<~=_kO^wHD_EdKTDmiY!kKl03t} z%9AWl1XiA8>HLb@{0fUtmOh$(*U8fPbzQ~T<{t;vw#f2~2Wwko=`sCWgiy%R8|ZhP zEd6S*#+NL87P#1Had-_9_jo?!zcfy+JA6K$bKT+kIoBOr2vN?tMsPj6Mwkwtaw99Z zx!_`-#hFj;H(mf%Uy>rSqOuewEcFOJ7F6>tyLYVC6%Wels{;ZE?1Ml>=EG zUQ;Lsvh?Ko;)7QAoa+nM!|RLNQCB&T73UtXaySHzJfFj0Cb{SE~mlzKWoVHoB`|qtRYJug7e1sddp!bSoxFX;kAbH53f5$ z(7)E|lI0&ozw2b_7tIZXX3 z)5+40fMc(F6s$Iq<#`0GHjZWMwb2<{jQUx^IAjW5?*(_2wgdhQ3$w#d?XtS`7umOd7&wveUA)b|g@Gjhj6 z`XsQf3&_%W9FIR?+nqs=etyLqf|Vy(`blu{ zGZyC*J^Y0)6tX;Lz`BP|mVP0RYX_|@Wa-1fx-UwWJ_4-!qGai#=)VntQOMHs^t(=$ zUJq7V$kHc))rVy1Q^4v&vh=Iz-(_tlOXt1Tg6rXZ*QL<4U9$Yck+-%>md>?E+a*iq zT9n^y+a*iS)9*T2`ek5kmn^-Jx_>VmSvuF5__G$D`;>AE_pgP}l^a=g7t?>M)g?<` z3NE-#mfis_e$Mcu;waR`d0dHvvDCy-%h{lWa)dr+Adl8esHwU;yeS6KX3dZ z`F0<7aPbSqqXxl$hcVC3Yd>IXCRs6K>i*d@S^7k9{6(wF`}S&Ycn^OnbhVePx;zip zXVYZq)9LrmrpeOhgLQ31mY&?7|B~gfh93XFhsg4*2gmN&09Kx4dHDIV@+3>&O#fXL zpDdl9I~QChOTPuIHDo7P+ak-e8?0@SrSGBt%eF1D^nLWZPL_TEtT{lIeh6H=)8gC@ zRt{u&_&J4gAWP@6OO}3=e%Hy;9|tQ3vUFYxD2HKKTa*J?o(QZQ$kIpBzu$5o zOCL?Y>tyNUz{-IveHu9as>PWORt{u&W`dOiS^8}H{TM-(&f}4e9c1ZCz?z?A>Fwa+ z0n4F_9{*gMEKff;{+fB#fR!g%o^@d5NtV7Itk1Q{(l>zhxi(q)Hn8#}OWz4D-eWoJ z0Y_gqzKeXX@gedzjCpJ-9yERstenY;c?7JS$IN$}vOK+DlGOL*#G!9H9Sp3?RzGf&WQxbia9$`%dl&?>jvQPtiT6 z8Ru>0Cu_Tdu@*(&F?}ewcBzd!S)LJK^(R?6kB{n4vh+Othb<;qI`3r_TqjFUj-meh zc;PX05G(r1G; z2guSFP`_<3o^v^}^j5I`&W-SQ+W<`!`LUGr=MD<85vJHX0^ES>9Q{voSNmcAQYaGfljQ&#yT*8;a% zKIPW}@%Jny*Hz_He*Uj~%FqAvN33pm{{IN#6kI1OpT~oIPJnAYAF@2B!12FWOs=cS zhb+%&u<{{GKSRH7mn{7({jQUx^IBW|lU#R9vwgGtx+6Yn`HY5N`H&Td*B8o%EWM8Y zkJ|hpOCLwS>tyK@!8$&YrC&{*ADp6)r6+5+uZQ6p&NW&7aD83_z4(1=3uDDUFdh={ zXmIpH)9c8`j4!9>5o4|c>Ibs&iNWdzvh)V}k6T@`^ojJlPL_TRSo=O%`do1IuNG%f zz)QjLqo#LIckUtoU(?r;A2Ys@{BOoLgVh$YwzUe9Svm83Apalc56=yF4O?)XEPn@BZ6r(Qu|EE>#aRa~o-n=<9R1YzCbGAY z*Q8=zhpJsW1D)5Q^6U#dcaeS09H8fEi+?Xz<4#s?_klI;Wa&JA$p5F+B};#Re%Hy; zkAc;8vUHwTD4%gy8pISx9`L64s^<~|kukMUM;(d%vltG#69vjeR5lBMsY z-@n_9EPXdv-&04Hz6YHDU)wHO`aW>Mb+Yukz{Tgye>YgUk>xo6R&HeJ_tNjVk)_{9 zzw2b__tWn=kfrmOtK7ol?=k2aJF@)GQ1|bnBTFBIIi~!{(s{g7{$%Mx>GwRz(udRU zI$8P%`aOTL^ilM?PL|GNpZazzShyYOyf~=TF z!5Ry)^hfCTc|w+coPO8I(jTM$LfaNu`V;iKPL_TWT)fEq&w!O1S)OOX%8e}jdHOvE zvh)||cbzQ#MfyDlvhV$uZ7( z8g#XhEdO+{+DMi@6PzDv+agP!O~318>5IVXf3oyl)cyOT$kKW49S^hkW5AJfJ^2qz z=YE|Zp0VmqhF)-;EPWcd=y7I%Yp=Cy9I`xf!11ds=2CKGybPQlk+J;k&N#b;;7N0mrX1o#U?iA>kZYLVc@w$g11Hx_Q%A)8pe#mS9qbN%X2XB+)od`Py~f657*fE65H0pU|m;| z<$0XCe|HC2`U!AxjMe3OSbT#q*FeP~%RdPFwc?PaC+nF1?nk(e@i-pUSLYANVOEli% zOa#YoF`fj@|6#`Rb3ZD$9_~|DLodeWpUya!8_!^zV#bOyi*Z~hOXu39HJmJc9{m^L z356_u0XSc8@yXH`feWsarE`7L8cvqpL%qx98(I1d)P0{NOXq$azty(8nI8WhezH8< z0?#e<`28rdJh#%rKVm@HhllnfvOL^p)hA@>N5Se7vh+vjZ?u?X>Bs4JohN(Ze;1xsr$SlOXnQcyb9;@ zBIxmzw%w)l_`D*kZUy!U&t!|Uj-I_4%d>;J=SG&ko4S8SK$d zV)FZpmy#D4x03(dm~*dYp>Y@a{l-1yMaIBf%?FH={#;_5^kA%4kn5((Yn9nuS zso?uX@en6%=`>F=H*CGB;dL z+P>2C`uKhCy?5|82H$t!FLY*&S3m< z_=;t1t^HknO)Gjjn|j-tTbq`3b~pE4pR4a}>uRp=Z(Gw}FH2uvS5seGUtj0S?xvQN zJ=f<}w5@2ti@Er2%gUA4b+$FNbhNcx*VMXd#fl1Vez3Q*ziq&q1LOBMt#0e>Y*)?j z&6btj?Rr;wOJ`3adVAZt`O7irltX7 zUFHgNvCVWecenO+G+)=&w4(3Y^KH-UeVx~0o98v!CI=YLm)ihi$+-(NPh zG&gm1_6-Kb`d4SP$#B zH}^MpVIYy%fH&FfuC~O}+0Burp=<|i?ny#m*KA_L!nea-=FZU5h5;)#C3{s@TXS#a zx5F6RT{`-jR(=qR)p<6Rj96+?fY!EUtFCS8>Fvbc*fKCrrm(7~wHb?8vd;CbTG7Gu}uys%bHtPG`C=HrV+J?#p2X?MvH@K23I_ z0ZP&gm(T4`-@#kEn>w%)^i|uWkH1fB*eZ7jP6tX8n%cUXmtil!aitq;TzA_C(-WTl z&X()ixRuJ)|39o6HAU38aT+CK#=}cfvIMmCX8pmpech@0zE$t+&T7{O)49jq_MT|E zws+;Ko~jMfyXV<ZI$2Woh*)huvi9#3@KyH_sQ(J34kEf)%KLWy{JgTC-iSEN4I9 z5A<;88nJ>U>!DhgIV%rX_WrqB^A=XL4A|JY#)>D+b{w(s#!AtAZPi}K8Q|(Rwyv|U zWp#aXe}8Z1vQ_<1!b!r@fF@gllLV?qOU{kusoKupB^3Ljqq(nx$yM%9+ktpwZ(GxX zmGxSj6|Tg&_<+>0Gov-w)q4lZerDLeGI^_hHVyT&>ywwt6HI%NjXKXiafaT8T9xfR zeYha8#Rn6`7QJfTuMrY>6h#f_`%-ho}gk2E;ev^w;~HQ z@QB#b)yYd096Sa(Y#L-?tNAhq`iWJy=-feXd0b*ob6*s`UYOgmK_-CdCVKw z7CX2079^+56(&CqL(4i>raj(s9gdvcO|2^{c)3Zx=)_Xr-FEHD{?6uptdCU(lP8wt z*2?=|)p#5?yCUz#?&W)0>#Clv&X)6U8x8X*S}i^9DXFD$S}U5@@Z6IJf%8R4Emfl6 zn3h_q?BN5CIO%w>`OLGotz~6zD;B37oPeJvn`DgAi+0=%sW6Uy>VZo#taKF}NtBm+ zpEGU+TDGjSzpJe~ht-ZRRpvI^VAq{EXIq1N56xKe&TsGR#yQsSWebsvG4hl(fGGmhP4PZT0V(^S&as z(2_MIyrRI($tvB1G41QF^k&j7zNKNnk+2Dl|7~QEzvpw>S@Y)p{-OGxnet zaRVle%=u^QKkvQpopaCNf&pP`t4$W0_8e!NM76i!ZY6eh^hpyg;&o`LR@Z!-^wvAS zOFy1lr>krAiYBZYIG|L`5=Y>4#1dQOV@m6?tdGLpU$&|}mz=S;S8EEo0Ugku_Ana6 zKIy~KlxnzP+@IXqSliaSl5bR*UN$nxd4E-lpH22PudW(K=aS_f4*r1m(wT^350hTq z+_kD|R2qWCq*{WsWsBzTPyrk5v^!|o6-u?>*;?M&je8Ni&y}o2Rg=ytaJNXVII6|Y z&Y7}-!(iHFb~=<$l6Au6Dg%kr6MSls+-vM?=c!fI1pTxUHzi-jX!ovp_fkfU9;P@u zz5n{2EOG01+?vuS69e8wBdWjC(zUX?YP#w4!3I10vZz{zCI_UK@z}BWWlU^cb}ZqQ zShz{fYP-;&561wWKm?}BD|Gc*>Q*`!F_^+0w(=6fq0z0=bh@P1Z$2Y%%EYsH9wg8P zJ9cmd!8yQ+W*k472ELWGn&X$g$r}q^IdddesHz?~f?EytnMWm$rI4&V=bFxGZ@O1i zIC|KzR-X(uV@W%=Gi;sX?SWN&&DT~nByHn;$;?@0fAfWtBVZBLJ?A+tpHn9s_~gTp z~>aSYd>^Oi6LwvN<+qtr}TBEtG-?VN!>Q_)Wan$C{(iCwGoZ zT6*lhaC(7r{yM%tCfhl`lll0fndA~~>AV@~4m2`??`6;2xt(l%MV)Xag@=VCi?a7I z$yRGcz(;aDU2Xks10y7BjISA)qss1O=LvRof;d%Nc9M{}&e^x@x*@#VgpWC}(zH~M z$zI^y0DjQm_f2}5ukTvfTr~^Tz}<}Btpc)QrcLJys>QP0!@YXId*iZR#;)15vL);+ zx|1DNeUwb3YtbRSodb-VUpTGD8Gyf4xhvan8hU*XrejB2H+rch#|@xveM>r7(o+C^ ztZE+=R9Jqvn&6fcK4?!q6l-c(R>72vpc?ES8zs)lH&qxjxjlWJXuKcJZQ-61&JFN- z{fgwZaztNdaf=4OVB>x3`_j4l2k+!0w&ebOed(&J{8oN_My1KAm{IAD^n^>PBEh^Q>`>9 z#f(Z0c%uc-#Nd0a!xcYWUB8wA~$K6QE6f-W>lJxiW!v} zQ<3Dme@kC~Dbq771(?0xkYXvrOuOm|C74lZaw=w2x-u0rDoskoj7nFeVn(HjsaTqj zVnS7K>G1$p;r4rdV`Cbilwm-n?EL^!v9Te=Qijm74xXr9DP5H!>18L`gvpg%<&&&} zufilNa|M$udB-OiH))tr>B>~hs5B`RGb&w?iW!wArebMAiW!v}Q!$`YDwYCF#m0sd zOBrU`RTI>Xj7pPJF{9FzshH8ER4ZMPVn(HjsaTqjVn(ILR1Bz;ilqQkv9Te=Qijm7 zc@iG1IiUxBTHl)7Q)y~c!%J7Cm{DnRDrQu=G8Ho_O-jX#N>`*}X<~*GQp~8-n2G_F zQn3_ZDmFHxSjsTdt}3Z@8I>ldVn(GaQ!%5`q*TnPbVVv=RGOHI8I>laVn(ILR17H< zOQisnd}Bi<2AHlII3SklX_+mT|6*DSLO2v#y zSEOP_rHQGSQE5UdW>jiS#ehnwSPC!|8yiwACD_1Ut^b|NZ{L{9*6|4;96GXIZ@Yh{x|KV?6#vo8o<}EZ#)C&zLHTx2Y`N!pC#DE|?gPe}boY zon`U(w~)&e46lmUS{Cnc5bu>iyfI*eNc;I2{BRUMt0>;6=Lg1n0Re7SFuW?>F!;iFrx5Q^ywChz z9mIR%YX`>LfWeJ7H!gz=OJ(t_y@h%SHO}u0L_F?CDvEand|`ekp3L?)%_YX$ST?@5pi-TJ;Z^bex@>&UKAFqS#QV&z zfLCsd@$SJN20=>a^SyZE1^ld{cwd1p%y0Tna=C-3$at8VX}r72^1BN=_gDqPtKxm3 zEWg};Wb+xjVj6G8(1H0qf_RnY^E==R^Xo#qLx{utE)C+n7ds!Mw7pBQU~a_ED#~vT zd||x!M7Dpt5oW%}{`>TZf$^S3yh`oe4qq5=@K5dg{g~gIf_THr_KzW0%!cEA73KHJ zvi)Nn;%R-xR8RB!eA)gns!F^)@P+wp3*x;ci1+rg_KrimSjpj4`K>7P&4q7v1z$&5 zzubZCvR~ORjH`YgQx#-s{TZ-Gg`|5sUHagLv0roFJw1U=IFpu2O#O@P++y z~@6XHfyA%80tXC*nHV>XH%Ww3lT(0#3i#IulcQMA3 z=_rpg$b!tJsQgD=c)-T&hMFon+irr=fi-G)iTc-VYW#$zz@6uf9Vx55|38}@v5 zoaTD2c%MbiVZ3W_kUXYfcvZZe@P+Xf|2&Jw%aNG$mZWQLA-Tk?Y$B46q`X6k6)t{wqsKj-vuy* zzMHG~7M8VRTNU4a9JIrDx4>7az5III(6^_G?~`K&`tGc<-A|+KVZ8lSe4i@I@7^lD z6Qc&kJ5m*Z7@_v2s}#(Nw-{7Z}G!8hRx=V@0k zuigW<=KTbmOoj1IAsCjTv?$&yp@+WH__@-0KNxzr-3{38WK`t-F+bRDYuWy`7bm6j z(yeCmxv6Y_JBX8^HSjUsf*{@lW#$R1|8-aMs(`Z@0EG>&S8}W9+$A0+$UKMW! z+85@x4)H3r_x6zkeK*2~e`!%W`2T5!@wUNK>A3oxviwd4?QIV78&{U!t%z5t|2~gN z8E*H^D!x@^>&CtCRhrK?AcrvC{qR-lmsgkd%Y*RMrM;4k$58m#=hO7wne6)LT4)-N zpW$LD-0n%lO9Zc{etrhNFkS=VO-DtJZ)Xtij`Dc;d9BCdi{jl@7O($T*>U>1Al^^P z)|X{ySEYV=33-R@=zwo_h3)N)=i^l#PxT^PR6gpl_(C7cMEJPP07Vkn_lvj#3sO&sDf)63nqIUcS?Fjp2Tun`Sf8(#P0Kd>F+5pPQxE$f%b z@P+Z_Bi?iHaoqkoh}T>e?;gaPRw3TvvUt<+-baFX|BU@6?B_FxS83e3%lhvn z_?A`JZYO+UI}T#IGkv=ogYAB#Y#myPd@F5t7Upx9Upsu2*5@r{zV0f%n_e+6-s&pb zy`*eiTUW*Rld|*O8>{$!QMP|82KT2is z#==)=zI>u=+{VLKX})xq`5NG>v>yDh>^f=+e3)u!Q9F*7T{lJ;H;ymI?NfNwdhouo zc|WVlcITEIf5!*$J{`mxhK+>%Hy`mT_47sWh4X3};x%}Fp9$jimhDF!h{yA06}5K- zd||vE#EX##+xvfDR(t=sY~J68cw7fm6z~4BdB1aTw*GwMPM{ZIuyei%& z%HnOlpeA<$?=!#81@S(JpYbo9OGgp!YW%FCc>M0=0qwo8Cb>RgynlpQ`3)XBFy1iS zT-~Z*cvZaLUOF(|VZ^ILEXKPnh&QP$-Y&$eG@ncGh54PhD4Tzu58`cr37bgUyBF~) z&HKNCFN}9Ki1&pcUR*X`?n1ozcwa^BeRJ7-89AgT{k-RkFmqcx&pCkenlQh?SZ`1@ zEsFPL_`>|wBcArRFTt&NkCnw6iFl7G2zKm>>3QeZ;8lLF#r_b+JM*So?vR4vRq;l^7sl(qxF&ZB6`9}H zgLoe+J09J08P1<8B?9G+$>-}fh`gi&@HMs{- zk@3D6#N&T!7RK8*-mVv5Ns8Lb|5`50@8D}|avdJ;TX3rX{;=$LIsGkmf5XG2{dXCB zVZ3p#t4Z$fGQV#J@%S~NVSei_&*kthEy|Dge8YH`6temEogm)Uvi)N(g85g+CNUN7 zV`cltLd08&PG^4q6vVrB?7;jUtk32A>*5E*TLxd4-#wS&_yK|O{yB(uC)Sg&y@wmo zUJ726-{;{AM^3*#L@Jl&W7mmuDc%k~faT42TNvPaAIkDg*pZUf@5z26VwHG{+U-idgX zjvv#@d>iJyMNR`-wyb2>me=jeG|TLyJxXo=FROs zidStnD%5gWDFEnBP-)Rele@VPL$Ch&NZk@Tz#pMjb0aejXoS{Sc?N-pu0$K(H78^-Iu0_PFf2IHLy;(Y*% zP8e_G+wl7bN(w&VLioaXXYu9CJFyls-m^ixV(q|q55FDfo$#qB-gx-Jcst%vlbeit zJdF2T5U;LmzKoku`E&6?*?f6;PBtFT2k{Q!I3KomF5+QVO^fpT27F zD*PMx!g!uYlVkGl7ducEs1|K}#TAt2g| zmr$Endrg2wOkzR+m9;idf`F7F1*#TJ!p#kdCLv7%MQd#!35udc15{nxrizqO*QNfd zb*&pHSc|U9y6W1lwdh*wy0jnGwXWNbYd^2oob#GF87{TE?H}LoJP3KtYu@L5-si`h zb7t=3PMPg5V;p~PoH;VSn^)j-5**hi*Z%@LH@>ac;=Y9~FTc;8$Jn1w#mUd)YL9}; zv(LXDhMnuLe?z!FILYzHcZ$3I&Vj$V3JUoMKLc?64a1+>BjNb_`-s158}MExW?(n@ zI~egdeq*?9KiTp38kosd-tjB(IZhUTzp!a)Z9cU(V0~rlkI((6{vHQ2x%_QTXMb+< z2N8b@Zwl9)6C8iLu$XfFUD|}_WNZxlrSjelJGcH$xjDSgb&BJ!9DT_3_dfh#2n;s) z`#9`ee{;SXwr`Q+FTZr8zquLnyq+A&UkrAxzh3xz8wYuQ@Vc7E*#BOS%ttw^vOnkc zN@PCjxiy@RPILUNkIY9CkK^we*tzj-cKoFre?KpYlo$Rmln0y2`y%XIe>>ohuhnIF zOB{c%AtjTmzueK{d7PiM$=@#^xc)Y8!+2o*O?3SIeTDHi)jHVR>Uo#qnnWA(;?KRf zzscY7|HhX+uSZ7s&AhmM8+LBK4}L8icR%jrdqc$Eifgm`dnRIc2zCjRmH)r;{YfO> z1Rgk<2n*I9ud8Xt{_;sX-m4sk;jh5=Wd36rx#eIkBg^g$*s0F_-06Pp3!KQj%9ckaiu-g?_h5hQSh~2xe>&#;J>qtMChJJ7- z?AQ;^#*g~J?RMP2GQrrrvPhrYZgF=ai;Kc?ER?bveW7#6#ZMIQ^3O`QF*1@O#uK z@20xJ{Mx*dfv>^WuX;T%-7qtjJE=cW7=Iu>b5{EBJzl)-zn7Kv{=mDt_d8zc`q5r) zU4J4TzkB_6Jld6R!0*ZZiR8c~-e7!xLVo%t_9wRGO&)$`Yr1z#)?A13-CXbRYT|d) zZmUZly~nGl+f)~yTiTn4Ja-^Z{9gZ{_mR5N4g0;j@h1gShHuX+sO_uU=Edixw;b^L z>XwdQzc*XS_M9{_kKDRB<5{vhYFV;mydhV)@JKv9xNHFVJ&62vc)4@uj86_M^_c5m ze9p;1$zWMfyDeTh92;6+mpk`>ci-07zHGTC#*NI~mayR=)T#0{rQ6{Z)aKS5KwhNS zP}Eyy%|P8?Uc6y2zw`7zbhN6(kE!l?#+0>2s*=aXbjyNt!?M^Vk(lzlKa|s$og$h%@K){0 zInU0SJ^%jsB@1p{5O3VjyM9hiT}^!YtmWHEQ{O>3XN}8$qGbQ%eG7)~>mNI-@4zp; z(xH5B{oWayrXEuoo-tL0@}60fjK>?&4O_kV=3DC04G-ddLzmgUyWjTRJg+qM1LP8` zyT7(%&aHED=Ff_4=pA{^;%x1o(jTiETf2Bg-+{td-x*Kj4{Y+Ic*TvM(a+cvtzpKr z_`_k#DyloY!GZZ+O+Na2!^4PdFkY3Dd|{Jkdf$VH4`ef4dTfwZHfmoete0P7mE(BaK7Di> z#^0xMQx~PZJk-E$@mjv;&XMJDUUsW8OMR%fx1hbvx+sx$aAN}W4ULXFt+cE8&5EYbACZd82}FZ3n{{-*SQ zqV5y(x>+AE27K>= zy?zUYV*p2hY*BChM>pyZj&3l2|37B!Rj7ftcm7X(P5kzsqyPBl;u-PSG37%|-t!$d zrrf&k1g+BB_yAgEU{ku6BgP3{AJ6E?H=cOPvK7mc0|&;8%U@V9nBRN8&V=K)*7W;L zYh76I(>ks*b0CWemZ4pGg?0I?{ z@Y7~1(eoSp-0F4*C2{)~>!PpjmuZ%&Z_{VlW7xB`887J2-q7Zy|% zT{^H~`|-<_c_vaWmIN!$K9tYImwO-&t7w+;`&j-D_U8p_YmQj8pT2Zpaxh0~)y*S| zM;!5M=nT}^oNXi0r!dNe>3u8Yj-2rv%SY=N+n;*o=S~XRj6DF}*-BVh_Z~p&#fHM; z93zvP#yjKW?oA7VF*DjuW|ZVSyz{z6*B=aKV$52jN=wd+<<_xvFc;-d|9x`C1n;4_ zrC&X;GL6rtzmIE^!Rtn06%qBxaiQ=z(>Fe7^!La30n>WOWz>N&@)pN=`rQ3Dp=Q@# zpq|ZHk-dcT;cd%aS~eJe=PQE)&!3gd-`F;o@72mKdr!f6{{VB^q~4yFj30)NyLBl!ykb_V?>d#?T{xtsZ_Wa?i$ z^4qMlDCfk(*MxPqZRzejw(*VjY(wj?RlH<=p;tN?d{2CAdN}T-YmdEl^w;$lW^bi6 z-*(5**icwbmW3r%?Px!D(t$Dmz9zYGnKxzoe-%zSm_B?Ud%1q-diH0fhU3*i{OiX? zH<-WFpIM@H#?o|tIjkAqbJfWH|J0~HobA;x|@z!&pq_}^x+5b7V}F7mXB!jXnMBmfWO{|9%1xb z7BbqAeI2W>2XCs|bU|3ITjnpR`)S>xZ5-!IEB|I}Y3jQt&8jQ)c4AEXbDZBiw+C?j z9_D!b-n;Bcw%qsZS;HA4?)|{u`}4%YerCoRf6T-f9Yz(cLH}&pb-bSRygy58WXhKI z`LAK8rDfAcMQ2ow+;e`)QoC~^ za-19wX3fF;o}Y5PGkIfdC~Oavn{l|KWZ`;uG->1-w?Ve9-93G@3-2mys!Qhg=7j#) zZ&?3>qYmU}i~8-|(Wq%#H%fU7=I4DkViC?raWf-rY)j^2R?2??vr_G+)Ee2(F4V$z z{g|-YGwYOF>J}H=G9Po^+>t41h5J!u-wozR#l$nBZs)Nhs6Prl9UH2io9;w^o$}PE znz0AbXUBTWw-4q|_R>dpddu(Zn|rF4dqKH3__dAR1ON6b?}1TkV>gXTAN{shGU}%{ zuiqD&bK=+~+t0@B;^gSj-uLl)aMNfHzQ@k>2J_b3T@&BzJutA@>$?E+#glQYu`WeF z*|~91(BDVrr5k!;JjZo*)oi>vHZXT|e!BO0f9;a3B@2g+caCp+@;GH3aQn!nx-*=y z&7UQ&Q7@=E$%(J*UxG00PX}G@K(&~!-xCn zhIhU6;euH10gOKfrg^zf%<=l3Sn92e?~8x>rsSrH7?GCU{J<*A&iHgEIR;@qsIn`Cd*q7WDmOVvd`p_M&8ghjVGk#&9f4#uF&*ca9nN{8{><YGBx>iv4J?&JGes^ zZBIr%Y4~_$y64AknYfbkEp2P~Y5UzPzdz5M$~$Ri#+Vb!Q!thj7(Yjh{HK(sp2FXjWwy?F*vT zgZU5oqrPh8_W9Y`+8;@9Udbvp^ilun>~!<#2gecg$y=Iv)&8#&*5Ax4_eI+m26z3k z&k*b%g+Gc7v9{mvTPOG9H=bCNf9|YXn)`MQuGq#^TYH-xUA6{ILELcCTayVz- zPG|necCVjar~gCt*1P8}*2|RJqqV?Mt6?rjt?>NMt@{W@_0e7l#+<#G zzcBX_unI@*_su!OJ8^X7HhHUwPnwlp99})M*7jU*Y$Vh@XFbfBydf{FU4Lvig>ANe z9D6Cp0Ia&b(!K-U-F^3Xm$2=za{ew>&i{PUC-AAsJ+95qd2gt%Zamtzrs*NCX5cSpr5gq?-}ifEMT^Ivg>q%di25e2Pv%aV zHE#E|vZAUn?vZ%~gK;krYP+wysV-SCE5^0L3(i_0cTy~=bj@1_$4NfrVSC4!`+e(Q8I0HFh3t*7cV|)8(HQ)3 z;;XTtKkn)@ej|I&Gux6I*W_?@ShI0jtZ(kxoZPw1ImxeW^e*~pa>8}qvYTh;$9^=p zJU=$>g7o3nz2qhNv4h(N2L^I@Un?4cKmIL=4Gj)ta@hM~^K1Iy^@622>E2OUt%pAw zo-;g$jyfxK|NMS8TApJ+EoHfXyD54$x}I9s__HA9qxQnzE=%KcUGxiQ-FC}y?u~52 zxz91=^!50(45LRb_}RLWZFlGT9`XkB4#dONT6kaR*|{9ymuwG@J-g|6WAHDBv!D0N z?unKtl^fQTUpI%$d^O^Z8R{bQBd);1J7!$xgehaMur9KHb~JrI^9-+@CjT!#G276a zt!FfhSnVELYWALC^q%isnCpLD78~v>U!P1Lz9UvMaK|jHurZ709>A6E0bH+?KQ*c( zp4=XfU3Al@Z<-xXUJ{SBd5MDX?p16rW~tyzkGV%=L8TZsRs$7aQMI-eFZjxY+QFZFAWcMs}frIVxfVGiHNxSaj& zu#T|43U6`yx#`z~arX7_&cU%Y&Au|U^wNQ6gKNy_44iF!#{8z=8XHpn(d&PX;={|` zoZY$Quzw`Xk>i?s-20rHk|WI6PhUR^YwO8R@y(htc7{D4Z=H#@zit>qFkAQ8fcIXYsD5`eeHI+rc#< z>*gW!>6dDCh3}TF>XJ*HK9S7p4@%DdyyenO7xH+xDqO$dl7&B9IC$dX+*z6AiG@eg z9-l{=h?NBHlf@svN+Nl~99+T9$EOQgUxa7#;OFA8bnSaydiXuu@nDn{=$YU4pMl!a zz?>AD`Zb>WK`#w^40|nmKzjJUy~}(LNjy;@A4B!oe6Tg-PwDZD19DGqxh}@Ok+}Si zO_z)}8e72O)sAGE>^T2}G5OeEY@yDm3{oxOc&iJQo)yn^w@7l}$XZBmt z+3agZ&!3fy|JU!AY)v2j?lGe(d%M>Z_IC7ZT_NLc;zj}`p^tL&};ge^4?rcO3o94_)_K*B5IDG!>csbxRP2_M_kV9$7 zCU0aOv+R?2_ivoiUr@(c4$qbrPQbIOh3GM_<4z>*P$r(o=j?^}>|lQ)EEQH9u&o*3 z)0+L`)XvAY8tc5_ti7xzc%)aY{zUhdg#p9(3dBq z6WhJA+T^A}+}$qq9%{JT+qN~3HeudBEK9AlJt6R7N&m-?TFeZE5^j3ymSf|Ibs-}<3r`PG>=3L4iUuVt8bjP-rYPPJlH2?WAeLp_-{>3dE-KK?p*f(M$ zo|m7psbE&$#P|v8hfl0acOLM^guW*Vv7%gd(^crN7$pu)Lg~_px>#>*Y$>9UZ@?oAU*u6tfR%y8qC^1&iDF$Ji*(PUoz^luNL0Cb#Hp{>shT+ zYc=ZXT#D5_x_#^3`)fINnZ7@H-<19`tk%L$L9(qy{Hxhk_bKk!5XKBA)!5qHUGWps zo$=W2>$26#QKSx|!Kb>oo++!vr?c^FS7%jMlsKz=+STQ|BTVfv#}5Rb+;Rk3JmUEJ zIgS;O=F%a{KF_?vdpV%aMJaItu$}NwY_=V0h}L%KqK`xSReVr6?Fq;<+U4 z@oD(6wd?nCHHKjGr zwO7r;EHw8WFMa{%>#9YuS20gbt}DREu`C}W20op|JwEd2{Maj4Rn%?hjpL_aelowd zD(xM>vqx1`ysAw;Kj8g$;g<^sfBXE0lG8KZ;6sI8`%N2qllfi))>(@m_L3XpyE-bHF1^OUq}A61y_yuJAvA=iv|aN`xUfX?%nqtsEqB!9nP@>b#4up)%H#5Kk*ct zm)3Rn|C0;EHxwFE)@5|+i?yI`blHS(3va7M{s zDZH1xCzG0l&&~Z(r&=<2cWimeyhu7VqTH$ArNG&Zk5dsJlMIF8@qclU3j-{x+~N3L8)v-r_2j!9c#Yi7;oZEMGRIqr%X$yCSAS8`}20*_SWun zWs4Uyv}xLzXxmiTr0z3P73T}RPn@6fUzv>X@OtYm)9AsQd)e*X7lx1Q1YMagtjVB? zn#xlv*Yu=1R`;Y@R(GuK$~2``US%D69jiMk!a(e+sq+=yJX6|I~0li?7j0ok*x@>qjDzc#>>n-tJ>WZUSXL+L#$lArlYAlRgp@y zw|2}-eZFelq;;2-+gQSV^gZp!kv&K7HgQx<4;sHcgKBPD6FH8z**C3jN3HZ^x+8~J zXukWpE7Q#g*+`!AX6+PTQJ%s;lA2UCZJl4o&5SnUMV$+$F?v-cyr5H!tb)+Qo7A1s zUQ1(lYGo$Vf!gd|)1GPa8qs2rlhB^ju)wSPC`Qq^}qCfpX zckJ~%Z^}%BXN1F1)-%1e17`}epU0_bIZD`k)e(v?0B=P(=tEZY9TiY-&m0@W0&+d_p zz~c4Pr&}`VD{*#(BURSYaisL~WeG=An?DHPyzHpBI@7gU!5+sXaDh`HrB#K}1TE=} zI0;f~I`G={Od4Z(r-JDj@a4LE7k5#x)`4#lkSMx(dc!|S>~_1I9wtC_-ONsBV^xN2-hE|j=g28)gas#A zzJ4~7ZfdE=WZZ~FTyxjz_WE=NUD)ZfZYuS6b@6P+QtfNH&9uBS;|I}+hRPNrPL?%o zO{tCy&I*hKot>EuPiJ~-M<*u9rpBH|^up96jMoU)Uov1}#3jRs*XDZN7>ycxFf@36 zNitYKb;D(MOE5TfURjS+ICI0(A!|&gL$O?3Sk!%L&b(B*v9obyTPASj*BGnL)S6pY zth?6c)-;#2WhU_&M0M`(L8`Uqs`?hJ>g}l%p6E?2?Pif= zqnI=A)2YrbtOUY=$e+Jb=V7?^aCByBamxI@K)){;StftYb!?%sN5~S@r7#?`c)@zk ztpI1G<4vYVT6f`-%E2x}Oz=W&Yq;FJo$Kbg_P?P>w@u^E4Z&}m>Ue1jDNE;3iK z!H!>lZlLX$CpjRe>`Z{kva`M0Yp(C=Smn8`%@*jnsx!kihCjvzF<`{7iP^nvwoWGv zhZDbdAJ>4Lm(u_iMjRHHAp>)Q@cg#0{!~ZEo}-#mFl0)R^+aUe_hgiR$JTJ_6p2+S71i1#C??%Z>X4*^?1wp^r~~F zo_mHj3*VpZbs@C1UTh*TFA?urTQjwFYG-wQ`_#^=`ZWK$y1ji(TXma7EJ@p~a<2x13cIu@Aoo(4-H)S25SCM*90;U+SdauP<4`cT+I`vCjUN@cmx@ z0Q(xp{$l4i?N4&{55qsp#_!@{`FK2G%Zw)rytz1j6^>1Ij<0pnAHnx^@x9ko&heej zar#^5?8guv-ycw7?SGEn+xb}%uRHbqpN{>Lk)G#{;y;y*?{CI`*#FJ`4jsm`SZtr&k^MI#`~2QK zvyJxl<9xdsKW=@`$q$dy-}U&*FxhkeF4(*K8_~wv9|r#$%E0d`Q~Z3#gN`#jziU(b z^RWL*)REi2o1FZ=h-0~UTFCWxQlvg+qyFTt1^#BB{_u5TLH^G;{vL+Eg*fi|OGNzL z?D#u?vYdf<;WqI1Y|>_D>-(r<&+>)+*|bNe(;sHQ-?{LI*S&=Poa0RYlCwX6y30qO zcH0LJi`vcjKZyD|DE{A^shPgU9kNb;=$MP1@Z5W z_^*nj?{xM%QJzZtxaCPi%JWWeQkn8>cJ?Qr{sxgAUn?BsKi4_V`kUgkH}^}T`-tCc zqrEXG|Lw5Rct!g=SU7((`8PQJPr&i7A>I-kSO2~~(jT4<&Uur*BXa)S7Kw-NtTdak zf6ehX7iFzOo(MC@@4kq?h3riJX4029`}0uNe@1^g4aXVp58&v(u&?uD0Q(2femc(b zzl`tpGn?^uII@2vl7Bga^EYE(8QJfOv@gHQTlR(E`RE_)@~Y35o#Tw>8T`ne`v)Wb z_)a|?zYNFkjr5PVv9IH=pgu0dzRv&cXsZ~~oDKu#{|@s03;1J^6;FfXpZULqAG3}2 zPDT1A1YhIW=Q;5Wt~Su?@=E2e19YoPxw8traj+s{13p_$0PM~Gfzf;8||HF$HGqR z=b%;@{|(OZgNXf~;4g*ajQ^kDZy)NzuoqG)``E2Cla>Z_{qU4nDJfh^rtZ> zdoIc}5y$E868QT8+QaRiufxV{__P(VrLoT;koG@9+AE!X`acQZRVw>wINpupI=^_F z?}pRyU)%n{@9NIMH-Yl_u1I}7={|Th+Kzxd)8D;$%>ikT{pXbyE(=T$yWA3kX`ok2& z^C8Ty8jpGWJSY8Fl)nSVQ`Y}yar|cNyZ!NUCqAaX)0w~CLwqIBN}c$Iocw8jxsxCF zcSQVcj_ju#|Km^>|A9QXhE{zxJMB$>VRE-DQK)h<+nUip7)&bo$2|mRkMxu#-pzO z6F#b(^shSpX}{Zv_feGZuTf?s3-Zfzj?=#1N#Bl&XhnHgj3BFh7I*zZLBvdNVGJSSeJZ{lR*Z=<~~yB6-ievbEXKi+qpc)n}bn&fh|itxb~^SKA%4E|UgPCH*q@B`0K0_B zGtsf9|MMqW_x5^lapd^hk^T3a{Z$zMKZ8Cm|0@t%3-)Qk{6?W}pF%v$g8May=S;+- z_SpzqzQ^U`_BhYAZtSP*KI6OGDL?o3NA?pm_BT_1cSVlh$*1o-d&M-$WlOgFW-V*QR_1 zzjH7PF#k5kp8Lxq{+@95d7*_rs}HUR`>nsreSgKizqcIw)6gF0z@8HGe;{TOtnlqW z?Aw<(`M-t!^(yL1?RyYy%k6Re-*3feEX#LRm6J}J|?V`P7(lb+=tiX493_l`dfKNQ(F{o{%tz1d$9+1EM1yG&z{|6YtKDcC6f%@O;x zk^P6A{V$<^y@K>?0;UH#ThjFJKr#ClJNrjacX=4I&xCet`a(Z_b6{`wcSrX3Is4C` zJ?6n5mpm%ZozC&gkl$H2uJM%ZGaG%`Y{q}NvtNkgm%}~<1Nuv2Ji8YAaFZoob3XIj zHJjOAs$K8H-gD?*_!6yPJQ`VFAMwi@rZ@Xx`j2?0A^rD|Uj1`qdNcl{g8a<>a%cam zXzyPj{bXpz*0&iC+1Jfx_NQpqj+epoYxjqo<6l63_!!!NOA6KhZO(C=LSEcCJ~IA~ z`Q?8kus8cdk^Pp){+!5u7{5vXzH|JuXt-s_pQoha`;Bw_RUAJT$2EVBjL+P!C=2XQ z_l}^vGw|~lj=!+IjD3@1&;E9Wvp>?mS&!8Q$4kA-;G1=N3N*!g#5qoX8=U=T5dS9F zvk%e!li2?@_L&d&_n>Tl?d)HN^xt>(N5*5;tF?juN#675|9=a6_xuUR2V>vk*#8CW zd5Lm5a{_y_AGV*_=Ui#Fk4MIrGyMJ%T&{X%KUmJ%{VFB5`;5hG#=bZaX&-Y51&E^-`?{fBI z=#S6BpRO;t7U2CH_1BT}Uvxg48krxb;k$ZG&b7ImgLA#lFi^W8G{hWk+;6e=RJng` z9tr&u1H#FepI?9%S7 zzbmpo6v^*XIKQ!Dpk^XV}NkR60|9dNP{J$dQ;XI~|@s>o&H#L&~ zry}tUM#{tY2x_Ch??#UAiR6DuWFKEV8f;AeY9yW$qveUj_kSYwGZ{V-HijwSB5P0P zJuq&ZABwF`mX6WKE3)MwOP@h|tCOYA1}Fc;1VEO)0GzPp4Ze;0vr)RO%$o4PeDjmOWk%8pKbQj@Nv8MVQC9k)`AHnqINh$4772CTfuvUv-vyvWku zq5XK1mMr~uw6{80`WTFt%4}Ni!7VnVC6-Yejn}a z{av#3`)O}=vh;mm<+UHIyvVY760E$)()m8^A}%Dck)BZ|Y-H)otJvyf=}Wz)o*k3 zZ-5miS$^&UD^9ZXowPp_|6wCb-wiIdI$8Sh=GG@+qq&JJ`9Umfi*~wmMmQC%6cgYTU@ud%(q3 zCriH`to9;HXS?=#w&MSaTxlz z^NpW(!HR*bwC{lx16jJ41N&N&mMlFFTx@l+^pnA=bF%bPss9F!v5}=u1Se+svNr{+ z*vPV}1S>YO^r^I;ZPJpZ&j1%&ohvbhzkyvWkIJ}FvY(vqd$L3^u{rSAf(9>~%krf$bTvUIL1q?4ulYY98n9kZ6O zy1SNm4rw(8lI7<`u*N{L^dsPL7n*YMnXKed(^tu|X`%k_Mkh<(MV*UoY-H(sz^Yra z^asJJTe9>=X#W`#16lfGw6{80`a!VjmMr~6a4;r=6~n8J&Ff&rKvvo}Y0pUs8(I2q zXm540^!LDufh>JY9{TfVjh|B-PJz|`$+9n_4Hpa8D#41GEF0eIP|RfMGiY!7Ia&Hl z+FPA0eGXXTz+!M>xyg4qSbdKy`zA*xOK$^fUM5TL1Z!R1A5{W;p(HX=)Zk@i+6OFs-&+r0)>US!$40ajjQ=|^b)c@rmD`cc|joh_G_0R%N{)Zix z9Gi7u#XwftYru+uEWMZZ^(KC@^nTh~oh(zC8(!ydKbaS8*fxX9R~z2y=yy0gMCQc@w)@CmF#I4` zWg#nuN5CozS^8tN?=or0(uZkpb+Yt>V72da;6%4c`#PByJ=l(t*BE{qta!-s^DbEN zkfpyz`?V%5SvntREVepX`bl7&BV_3lz(rp)e#p{`z{OT4OD_Y<4_W$o;G%WL4_SIG zxY+7s>5IVfLzdnEPF!XDG=s-oZJ3{LC4XzqS+eZ+(EdxtW*_+)!%u=MzHImq^=l3D zb2rVcWchj1(aF;JxrpXgvh;Vrnp?@ze@A;ehmxhgPkXDArJr07)&p7kIpD-sOw8wj zi+V$r4L_4AwmMn*9B{>YW6!^FQokb0W&v3JiY$E*?ORM*vh*cjjTL0+eC}}E24mj@ z*1SxXO&d7TXKcE_iia$lwP3|VmVPzuFEDAz(yyhx)ydNNjIPeRtzhLvmd$No4Tahp7Lj(aF+Z1Sk4UY%hbA7g;v^TuOP7rN2)50h5+2{Y~0iohWZ4`AD=)J2w`qT~NlTXgF72&OmYzQ*tP`^IlfV^U zHGcT)K$0K+U?a<>2%OkrY)WYJe~k@UHhhjDaf`8;O}^FeT(HVTmi+>-%0-sGi1vdf zEm`^!+FPA0y#cJYCQI)C>zcOY{BX2D0>PX>WD1^y|SDcI>?Y zth~swxf!gy$kK16J#VaHBTL^-d#jVBe*>)Z=q|AGBFkncSb349@236NOkQN^_tD5FLpO_P=^eF^QY zPL{p`to3{YSb33U(*#ytWa<2yf}$al7g>56?X6Chz7|~ZEo0vcR$gS;^n;ZbS^BMD z&A(*nk5jkz=*ZF!IyzbUvtX^+$kJZ`Yt2TM{xjO!wHaCZ%e1#TS^8UG^-r?&ys^;# z+w=#r^s(T?-KI`X2CGiUvY7x@osgyT*@vPXCM{X|X|%UGS$Y{*b1VOzI&qIld!EA! zz^YHO(k^#&vh>Trs!y`?m0;B;S$Z?=ZM~7DUqO4Tlciq^R(+DCZw2Ek-2Lqi+PrV- zmMk0ojjrmGEPW?f^+}e#oA%!}KFQMg{A01z$GxlWZuhQP?Wa+Qdez&nFOMjF0 zRwqk;7pyiSOD{MPZS-B^r-*#7;S{*yuME$iexKpRV8uz6pQT{MNtS*w?f=@OB}-pH zd#jVBw}BNWS^5U*b_^j)-{R9>K^=gHFV1gp=Jr4P~G_HDBC9kjPPS^6Vj#YvXF zADozG%FDk|FW+PMki*Y`lfO6T0$FK~IyzZ;!AY>^hi2Hw(i7ms_l*B4+Suoy$g<)0 zNT|KY(iec$US#QuXn())NtV8Z_EslLUkO${kfnEliykn3$kNw>i>*$U-Vd&L(AZxO zPCgW}Y_>pGS;*42f>jo>^xMFRhmD^*!A0K>SvEsVYjv{p`@kv}SvtSdMlq13^ZRcU z16lfh+CO6QB};#j_EslLe-Rvf_Uh-2DK$iVcu-2>ZffXBBHhjojv5}?cfr}nB zv5}=0(BA4~>8F5`IVJ|O^fGYK-xxn+>E+;JtCOYA1j`Ru`bz4##y?s572w2U#(yVR zWhBd{2dpxZrLUv?4^3LK^lNBub+Yt+u;$;J!HLIB+B?C?zYSUTJ7{y4(RVZLRKtAs zU2&3S{|H!dlBGXJ`+X)YS^6;TtxlGH5L{vBHGc1m@*>OT5LkJUr9Ve|d#z2D{vz$I zPL}>ExT4L(#_zaD{K)WopUe(Zw4oxG=8on|HN=VxZBF?Q*BxZ( z`)O}=vh-)cs&lgR!_@5u+EFOz>1A5n|Hv9jV%3lw13*v16lg}w6{80`q*({ zY-H)Dffd6P+VEi$Y-HKY11J8@d#jVBzYkU) zAWI*AGIYBRAxlqzi~iC0Crh6QF19*Z`Z-|L16leUaN;@RXC7E(B+F(YSY;$jUrhTU zla?%fDebLJmVP;S-1Eks-`%3T$g*h$D=)J2D`;%hv3-wUR^$g=4L zD=)J2e%ila;v`GIp7vHJOWzJw+mWU30P7st1y&4X+1v|O3}oqhXy0ODAWMIc_EslL ze;ll_@lCM$3|TgLNwoEg#^)IFPYox?KQnwPSohD#HAeQP(&nGd&J3{1LYB=;u*yP~ zem=P9C6ksceKxq*>SXB)!Q-|Xdw%DU@*>M-DOh=trC$uzJ!-P_6=25qbS z%|({}I9S(QWa-a>6(?ExVX(@cHy&$`mrYxYA^*bg$>hU^PXQ8H{D-%MJv^b*=zoh-c)tZOT> z^mD-D?lOM(J!6W2ESp-eVjxSOL;E8pEm`_J+FPA0eJNONM3%k+T=8q;rvaS!jp1gp z9nbM{+2Gk8veIs*&Hpj>w}KTvSvK3jik~d~4%(+pTC((S(BA4~>AS!cpECA)z~x5` zzXVQ>GUEnW_OH?A-;K>1V8uq3%@MF-BTGL@`?pM5vh=rUZ*{Wt_rZ#dUxuN)$g;@; zD=)J20@`mgd6A`$rM=b3(kFm57M%)KUS!#%z{-m(eIo7u!{kMlUPgPXlck>n4%T~) zz8su*+xWQxtQg2j+W}S#Wa(?ciQk&ESA&b*30XGRLNB&DS^D*0o!9)HHRVf|&COut zOO}2s?f=u{MV7vu_EslLzYDDMg)IGk>h^kyEPWVUG1d4#N}G2>md*Rr?PnQe>G>Z< zo&1-v9}8Bw$g<(z$*Ejq>Emf{KeHf9KZW*ICrd8@tFQ9AEtMBpHf3PtMV4Mp``?*3 z$bzmxoX!+XHG zuSJ&qBjCiav3bm~{~2}9+`E32yw}+L2CVqW^79s0@sp*$L;INVLzezK+FPA0{ghJ> zXMtU_fu&CcCvuIS*|ZsLY{;@%;MlC7%@|`tmQ9mm(@C2Xj15^f*HgED_f3|*mHJp? zPnLccIFVyw+X)_L>x$odsJbG{{ywnkiY)zp+S~D&Ed62HTb(R@7_4!7AGj#b#6XtK z6X0U2lcm1^);LU-{yKGg&x9=fZR+;339|IOkD%;vlkZrtuJ6dQDWPt!FUZm>9i1$F z23Tuavhlcl$T6Zxi$U0}5-SvG6I zYE!cGt7$*Vq$NwgmiAUBOTQjmG0&W9Tfm6|llB|n^3jHOlgAi-m^LREeiW?O$nyC( zSh10%@1wmPL&(yfpuN?}(hq?(w!8>V@(=y7k!5ojtax4nD;~0J-T*5evh*Xg|E4KB zS^81hTb(TZci@T>O$>QO$oC|}CE)T88J zS^7NMTb(R@30Uiji@}MLO}@?Kq~R;Tih-=O9bm;kmfl7C@g^-<`dZpsoh*F=SpA$V z{Z{IBt|Utz0&A|^MVmsC7g;uYz~#2T-49m$WZ66nR{Uh?kJ8?@BU$?6w6{80`qN;= zPnP}?bsIlf`s?6v|76Y_RTMk!5o^b^DwrS$Ye&{P!mQHn8F(%cc{oILXp`Xn&naOP0Ql z_EslL-vHM7jo-biyvVY-9<02`(l^uI&P`ERp92?Lohc>Fi+t2vO(k}*=SDLh!f{VUm(voF!Ik?#BWa%rx6=#{W{GM>N3t2WTV6_Wb zdK>MlOj@$^PTE_YEWL;J)yAGIeI4zsPL{qAtackz9*Jy9Y zAF}i}Xm540^tZrThx5D8i+WAIWZAq6F19*Z`g>r-Mwaep9U_PX8e$)mw=0{PL@6uEI(xF=Yxx;8$V>}v%$qyCre)pmLIb825|Y= z#?KYt#0v=KCj0-wZCl$mlnN70*_1g>BOzaM2QDLsr@y;9{$j zrSAeO2D0==sDC!*$3T`o3@*2M?E@=@L*SyNG2fmn`{%&LRwqk;5v+X4(qE&#Eav+m zOFsfuzP|x0-}k^p%VWMhS@vED^0hiydLCH$lBJKQ{yF1^Ed5ll@;wc#e9OT_7aM!B z?5n`VRwqlJ23Edg>2s)GV*HS$F9a*!MPTK-0$g;du_w#E0bFc#vh*gf@+C`O3r>8( z__-Rav6n2HYrz_O$Rlkm`gin-yTy30Zmr?Z0XKlchJ&-s)uO9pG^%n!LKe%8M+U zwP58%mVPzu?KL=A`n9yTI$8Qgu&&K-1(&Zh`ECd6JJZOr|Au387g({8WwR5k*vQg% z(|)$82eS10Xm540^vA%umqnI-5IpV&#?Lcg#Xy$LvtY$Qmi_|mhfG?s^qSXD! zf%S~#5pa3h)X%%%gyr|Zih-=O{9;YTK$e~dE^0D<$kGdFZ*{Wtlff0|8v7z}B4hY8 zaX3k}@^bKG=`*#~{PBAuQ+1v##Z#D7n zp#5v6&+GxqCt3E7fK^7a^vA#|BU$<|?XNKY$AG=9j^57XZ2Wa)2$b>HkAaCw`__jh3R!}r08fvmJSlfoFt((}PZ z?ZyvT`WV_q;RbI06(`ese@*+zwp}p0~(#yfhi?tLx%hXjK zd6D4)@*Kls$qNl9$Y&eIBYs}&BE$HI+lyUl7`KGI*ryGr$d?;NwRy2m8ZIMWX1JU@ z!*CUOnc->V>4wiC&o_J?*%qdj{5hlJah~9FbF#`?;^<`QQ^5M%oGiT(tk2EK(z#sF z=jLST3|*g_lcg^J>zpM^|Nl#zCn4tYZqu*WrimWIY)3KcA^8zAwzzdNlWDCzKc1Hj zS@po%ZRKl>&m~~>d9rMlgVpEB(%IFD)|#|r>FjF7Rwqku0atv{*tdZb>kRjR%daxL z7OWV^N_#a}F_5KSOZ%%$TC(&Fw6{80`psbV2eR~UP`6_^S^8t(3R^#8z=>;2UOey0 zEf+a@3S9AJW5a%~vXJF-GFW9HOK1Nty4Iv6OK1NtwmMn*Ot8vAmd<{zvXG@u04I8l z|I@(bmQ&>QVZMnChMAY*ck^W*Q~Yj!n?d_Nla{P}8C$W{-8kn$SNvqzFQ;zXf-JoW zT+wg*H-i-$SvFUI6&qQ42ki$;TC(&m+FPA0oqb8Mk)_{E-Nr_iz8kD~$kOivD;~1+ z`)P0Mge?7G+FPA0eHdJ^(Zs(WoVd>LVX!{$Aj|#@u;L+0KLS=fWa&p~f4%WZmi{*F ztxlGn15?!xS^5}o(I(@EEd3;KvDL}aQ(#?}k)=-otF8HwkIF)p4L?3nS;*3-(cab} zSvqeqt8U5Cc{@*KAxmFM-L^GZIxk%mTLJ2%{6+}a5)N~$uGnmJo@8g)iYW8JnFWekfj%Z%fA-J zoUlBB`fXv%i95m=%5OK!x>8x(daH!4vXGV6RNDWgNlTW_{!nanw{OgbuCkD2zl6Fi z3t4&txZ+OZerSAqS z90?~{eIei-IRqa{bAZ$oh*GHSn-ghKMhu$OaPaE)A%d`Cx#5O|A<-t;`3<# zEo0-Kr$sqXJkLE(7hykfx3Rextk1;BilG5qzQfqC&dcvI+yYjekY(QnR-KTgchdeI zla?%9%Z7C>n@7NkpDY`$#}q$V`Y^cY z+r~dxI_Jt_tCOW40xN#9^uyF`{AB5z;}qLi=!x%`yb@r=NtXS1u;L_3KZW+YOxmYwBF+;40y1uIUn{9F!JoMh>&hoT2eTC((J+FPA0y$h`RBunoFE6(e| zih(Sf&0xhqmcE7d51JUr(znvy>SXD6f%W%yWa)drMGqN2Wa$rri>*$Uz7H%vWa)>% zMGqT4Wa-a=i>*$U{wi30$kG$kKbnL8(LVT*?)R%ljQ{^tzxshmdrZHw`XAk|9yNYu zBevv2jB?~Vad;k;|BbO(2v(btRhGqIwJBNpQrbUe(vqcLOna-7r8j}qugKEb$0}@` z<7vYelwl*wrUab)n9<47tH9-tn;51#%=4?_Z;d_&oESFD^F=znmG3k97}{87JC^^* z=zcryH+&lP1BMwx;>U)|sXt*jpZZS>pF}=rm~keaGJGESX~TYOmRaYrUrzozW5aV< z_B>C;SAZ+5|4v6==kUqkWXjYVS@l)~F8_PupZzm=y0LM`y~)tkAIM5O1+4x+mR?Ew zL&hgrI@_h#>SXEXgVi6%(ic!KG4YV4F9DbTgYnP$sd&~f`HOnw+RgS7d#kY)2MZT{Kl9)2Y!nzE2(Qvfc1 z$=Hm=FO`KXn*>;8Axj@m`=8@KY-H)DfQzk8mRaf?IX-{`vV z#8NjSOdpd~CkkEPjP`4*Z*0qSjc7BQIND%ph%U5geP{QT^)0AiuQI*5 zon>No>CS|Hnp)cH(~WIuv~ar1(KG3$maGSwGAq}ts_*P#tGNkSF-_=2Ycus%X0GaX zqjKvG{j++i?NsTuR@QP$27Qtx?+$w8y6IKt);D$3ugXBo+97S>*@4=_bbi!GRF6t% zgdRznZpoytL`nUs@olr)ji|yu)(-V$y{Wvc+pbI_LNw7x_dU7?D!W>{(`zdmdwRNB zSFY*Fgau-)cK0+w!mlo`a$zNZ$q|pTg>Aiec4gWdyL&Pt4Z?o<#jeKAHJw4~bWc6U zj`mKsnq1dmO50NKE#t1$991em*xa=+r?T7ZZq|Nj{86MU(~()Vx~H|Vhht7_NAv0+ zXpB|q#*X@?P+>CT7#*I2RA9>^elmc>dv0l_SUO2*^j1MJ6jOi8V;muFp{#(MkG(K?r5%WX=EFt$mwH_cek#>ptQQZ zzVk}2vSW2mrt*SC%PL@;4*j_2WqW7q2>*C)E=R z?w@N{*7sc1nW@KkSnuYz>9iffH-} z$~Db_BVgPwzZ<~qOHPaIbQL?GoTeCb;h3*{L}G+6R@us zQ@6hC8Gw4#+`JQqo^srK2Xm=3KX2DhUpn>f#8TgeA1rtf1rlbd{+jM zb@eo^Y#VVDP0)c8COlTTu)e-|O-H)E-d_rg7#1RKM{3i8_W{Zv`PwTN}TnS7)v;ECJndgYgMK57cAY(Oh0LE?P%?8i5xPm5FDBqCd546wmKd7;W*aL^-1TNm2It|?oU724zPl4 z2lboPo+0(!otZE-jch+X)`$nq3~vVc%CyG`3q1|LuWI*y`%_rux#!x+tn!?I&JJis zK+^-77EpCffFV^+4aAVDs{_%Ysz40koFJTl&JJisK+^-77EpCffFV^+4aAVDs{_%Y zsz40j+_Qsl0y;aO839cXXj(wkH35cHJv9(Rs;&-1hpGZGfOBUA;RJMcKr;fG9?-Oa zs%ruasd{Q4hE!c0hz?Z+VgTn(55fuP?0{wjG(Dhc0ae!o7*h4rKn$t6IuISI3d8`; zofd=>(Afda2xxjh(*mll2{5GUseu?$b#)**R27H;oLduw6VTZK%?N0EK+^)Mt_d)t z>ZySkQgwA8I#d;iHNh~XVcVTBxK7|WQ9o6&o*U3P0i7MtjDV&GG%cX&ngBzpo*IZD zRaXb1Lsfwoz`4~5?3{qk4roR|(*vrW7GOx#HGvpX_0&KNsk%B49jXdNOeAK>jq$X) zlKO(B^K0s>6z91CofFX60nG?#dO+3F0t~6TCJ;lao*IZDRaXb1OBAb8{_T!G>c62e zo|o%bo_E;uzLp3D-0JW*KBh>{H@n_6`&+;4T`KSEfT&%qlY#7R1LPrbt#$BNtLO1O zj5DxLa~>OupMS!S>#qj~d!T8PKi)TU{au3_pSz&ZU)&y}zvcLG{k;KyFGJHNe|+rI z^*8Ygp0^kY>2H)hMt}2R8ZOZ41uyg(GdNQoP z6JacW7e@Tu0e?+$hTrlxH{x&cPeOkma{TRwV>iC{;qUP*{{9wrjG@*Zdl&vTBO%K> z4nI7`@_rJU>+i8MJ+A?}HpMp+My|j9r_ldkM1M*A$lsQTzf;RmUS?o7`Qu|suD?0| zkGgk{kE*)&zxQM^AwLY%uT=qBR4HoPl6c)3KS6#DMcUwfg(gMR;}8EWWq&4 zkpNz5ZOZK^rTnM}wH|AM5=uGBp;W2$SboS)t@U^;$Et_=c$AV>yT0qP*Is+io;~P{2^d@S*8~6Lk00+cyN;vUQqSYPer@viRKVY(|K@qm z!ifGZ#6S7_4D9-Q;~f6}+vX|9Uv8t1rTtxuwEXeDx9jg(+<>3P40cm|_ag1q*ZXDK zUoX3l{jm-ITz?zk?5=u>d|_)QjMWPF$7pZqOCpS%8EgTJ#WZ|URX zPT0Br)}Qda$tZ*V3LJl<0{)I&?Rm>O@Rtbqd;hice8uTV@y*A;bK@I7z&sx$m#Xg_ zuyfTQKc>oO znGMAuKaDQI*2n9QR7Gyqq5Olz2S)81(6GHByCR%OdXeE(_{oy~E5ln4p8p6ee^-k& zLSj==T(EOXx6uA0$^1qsp+rGTLp0PfYiTSJITLD`!N1XG%JVDNRc4H=2ra9f|BJGh zm%O~JHgs1(|J+LpO6o2x==boY1${2Rtf2Vn%L)oBE-T2t`LcrejLQo8-*pN0UxNLY z6!iJtB?ZMlyrf^#)QW4+(y^>8@0w2d+o_Wmscz27?7A|c80xPW<0TSrFR7aTu@~EL zh4&-$baOJ|_1}z-wi0ufDjcYkkqn z;li8yOpG;d^K$Qae&a>iFNBw^r_b%ngI-bB^OBCwP$J{7BFP*Xv}Oz+ecmR9)-B%C ziKP1$vq%dOWb2ABbO|_37LsQUea`u~9EOTD6KED65aADnL_2{>7 z-_T|CefM7)?pJqdeZPuJ!&inbt-o^rC1LboeM!Y7;nL70^`-lJ$3mg_g*c?{z;X5e z-UEBU8(EMa>K%+SGOIbO=t!HoC(?C~&)bc0_`Jvh%fW;qJO#a%-zy*M>i<&nog?KeA*V2*9ebp$Za{UfVtJ9%@)JUk1z zyVMuIe17Y?s~7g)7|XoZ%Rk&Dd)Xr$k0AEV(pt7{uw|OFCdAzFjU)DqZx?6< z)+71_w;r+1Kj;=2{Ue<3npbxAuE9JT%gOP6Gx|rM=2bb~HCXP)&O6Wh5&kwmbROEc z$qT)Snw%GUbAxk4RYiF;piR&oRbDdGV??NB@QC`tm$M#5nWu)b%(2VUZBhU8OpmS9 z@lf8UhU zzEm{PB)m1jYs9NBYRU??Mtlyp_VE9%j9ff?RH_Hl^A7tU$q27!nbT5!3yQmD7xe3z z9cn=dne}}mp>V&ZuE8E*U(MRsW~>&D@tQNcd-CIidaZO{sSC?+F(3|iV3cvc+=T)^up{lh@LsjE;V8)Ep{#TEx zQ+q_MX6N&$56r3#6?l8S%~<6# zl9ictZ-!c`_R(Xs-1_nV!cQbR&MN-jP)o2i*&na|o7*3`iQgo`IFI<}mG}?3eIZeR zlEQznmx5kRAMs4ru8%y^M;kDPs-k-^XKNNnCL+TlmFe`kkM-7L|KH4`Y>UlM=IWq>--b{{Jv><@rv|u5VYi+Tlkh+4(k3_Yu?=0{q28Dz0++RYN^MJ zju|%;OOEtZv-+Qp#O!e!#`xU!Giu{U%bT3}jmJgzi6bWF4&RhqwlTDy5lU-LKJDE+ z+*K!3#InlEnv=f|RZTzPb+4#8bI8wqIjq><{@ff~k)c-xKVn)lv_D+bdaFOrdUI}L zju937e|o*f6w1$xWwz$DwH{H?rD8-y|HJ)`WM`|U#}oJVh~bX;z(`B^@0;?Iq2by? zKik`_RX9T4-p(`12dQ~4)bbBmcbGFoH0c}>=Z<0UFa7rL^Mw1p+zDqEFL!vTB{uOP zT*q#~+)(Y$fAxt(Xv+G?@aFR>y-A0v*0%aHTdeWpZ`PNbxV~y_7q7mgwX6SkM`E%` zCp%TucJb;)J$&aiIQzvqclLA^JpP@?tXNKu?}oR&6k=>urydB^zp^@WVDf>A*y=*B zYI-shd$qwUsQtdTx%S&${nnQ35&E9%rR_$x)5Rao*!`q86{;G5X@u zk28k$vs7~S)~pWH1kTzx3(3RWrOjO zUh}Ubp@NJP-sX%?yn^sM-sbRLo*BEwCMCUshE{KL1I{KGTYV!1m=_C{@jMtAo-RK< zUPAk|;$hhzpNE)qeS!4gF6SEOMgG`QeP-GE{G;aHG1C~8Q6HJTs87Xbi1n%wo%dh=W3G;Z@2GJu0M`_(ax|} zMnbs>_DHz(`#7U_?ZS1(_YyqsJ?5WddiZ+_GIBUGbn|-@KN!@1LqYuIZUvk#kgqxN z_UFwX?>V1m^iU;opV{iqM$M7hT(h>Xdy^5?qyOI>X=WhIMcMURTPI~4o_lvJGwUM% zm_Yve2{<;eP6)pi@ha|k;KH5DtGsM);3sc+2O9e~{Ao>9?IEvzQlZz}snENjq3(43 zgd(qVr0x{``(yZ`_BCc3^~m5{qqgMQEwmr=cMfNO;5mk?%eCdXIIA34J~nlXu}>z9 zgq9rJ$ay(EV%2+o%a*5S7ju@ry0Yrb%68`he-&8KQNJ~36=F_yV#Rqh*4bU-ZEqNr zs!1?*clA)b;z%lbUMZJ`7#r5WSZRlcn{{x0R&&otXyTfin}$W2Z;OQ3hXsAQ=Cp4` zzjohD$F{La%UiCOm&9xue$v?8qb>PdL z!ow3@{qTui_=+ZfEazt>D|g><0&~J6UihijuU19RddW@&J3pSJ+WoZFka-Zs2zQ$hci zyA*J?uHE3TVcpeSBGLL+R&%YX)trvHg8b|KeskAr9UVu_S##^mQB+?P>6~%6Zhw7I zvNQf)+%*#`|IV?jWan7&P(*$?cXT`gTKDh>tEhW;Rx(mGz5Sg9j_I<0YTsMb@gB$y zSNyHdx?>ji*D@pibus3LziS=xD(d*d%6i=GX~EqdTp1NL<-{7X5;)V^Zj5qNB*V!> zsHNjsr)FrVC6d7UFta%;9*K3T$!zX)DziDWCQ`8MZCshXiYqgmgX_2Ams!tb7T`R! zxpu2pP`AO`T=y|&_RLr$IWLywWo$a<%o3T!BcoKo}`?h+{^>V}2iK|CxR0Yd0GwToi zQN3+>`W|FK{+LjD_ULFlv-f5-wK*>!t_|qTf7I$kSMQjgP%|D6v1BW**~>H1Z5A5I zT8~H+)IXg;t7C~+!@U{%Bk5M={&2rmFaPn>of^CH;#Jp@HEiEWjYm>5h0c4;jSY4m zuUOT792cgwe*`bh%R6};A5TTgc#IZrpsn(T_V-(bXgU>d;K)k1E^8L-7q;$T^fkTg zTwec5C#(y&f{1O%3{}+0WBdEJ5zKzS__2G22v5vRMX)`!29t-5XBo^@KMl30hUpgB zVp~MH{kFv&h=NcKt}wQHm)8~G|5URRvO$cty>Y$zEz{cCm)j&r_uV-dW#UQ%;|=RmoUseLX7<}iuMf{&xh9r8 znA0U&E!A-!as+*hUfh#7x*;7SZ9ATA*W!#3YrN1a*zxhyf}O2X!}v+b@bDt64F-GR zn`U|SH!bz*E0bQhas%!pZ}oWoE&h3VymOzfDvCRqYb!&jtADP+3KKKQ!=nd2^jJkKGA^TP`mB)JT_c9) zvVG2#mcJhJ?*i@4e5{={`>O0F-epeTS7m8!?@8BV+!pltfp>U6dJ=VS^pLBppsp3; z?^WFUC~Q|B`Yj*9b4PRM_U8|rede@1`-Be`W>lS8iC<`{M6DhQHLo0$5v&<~j>C%l zs52Y$h$?Tbh|pVl?xQ*`Q4u+sI=eY7h%35*$p-Y+;Eenynjx;W~yJ+Ini91`JBbWF5_WL8$+_~%cytwqo?i}Z@Gvn)bZP!N5c4%>@y(ez-oVVl3XXnr zCf=Rd{z{Zb(V4|*50OLx&YqiVw_tsUzja&CY9@cdvMt^Q-rvCa#y_`D-?W}bCwYvvW^TGHp1F7iEMBiM94>x2j5QR_zFFrfxMq;9MSC7Nk9X zwVg+Lpx02MzBK_qb?1yMUX%6{i)#-}~*>+bC13X~&mSfXoAzxC~o9jtmrHgj!}o^?X|ViOzSXBF;$V$^u6 zyx6KD+}9mi(e_%rvwtn#_R72ceAAqDaR;k_=Bz>g*_2r694G18bbO}eQ9k&8SQC!6 zHY*D3N$g`C(rch_Vb^Zv$~7PNrp*1U{_F4T5nKB4`OT4I=W{f2q~b0fKJ)*fe`WBG zS$*@aVB0o1cYPxN#`^eId;IL+%C6lC3PZi8rOry*8`S69lj-(h9i($*+s}Va;PuCL zuUuK)u7AJQob~;mv2D`p^e)-E!su_@Gfr#$8vIXJ`_#4jw7xm(Uk^4VdOIU(R4P7< z_-;JUH8=L~oFq3BQ%v)eL)* z``tOQ$Ao^F1@W%kHu>YdBm2b9g7%mL@L4N+A!yHeaF;VT#Uj(g1s-NV4>KUYupk%D`!7k~xr-l)n6Kkl%3MJVte)?PLKMfKriL>q*e0Cl#G^^wT_>2;3D5ITM`3fP*3`Y~=Elq)b!3sqk{4XXbZpTnZBZDs z!2M($^9K?!-UHA2@n5+f@N4d`aE4($T-4#(Y3tv$N=f>wlyiG4`hYPWNUX%VI^9C& zKJEwmcZgzL24xIf)es6Na&VT+^YSCR=kD=3<9_+m?Rt}aRy!s=dbp~H<0#e$>1YJA z9g-2XUYi+nE=Tt-{^VYR@w5H3zm8+aT<)(0IbL|Y;(9G&uGbpp$FgwEmURNxY~?p9 zD&I?opHU3{9pgH8i@xf&_}>x}Yq`~L|G(9Gk7@mnFUHkL1S_KJLY*_KYN|t>Q`e{( zkN#Q+t$y6O@4tI_13uC1gu0*o{3i)MuQhBvb0^zaQj+t)Xt832c=?ySvN?fU<4*q9o;o^$kxSsPrN5eVPYxU}{ zFmrRbPet$Tk91T*(NQ<*a8X5XjGS&}4(})`w)d&AIK$d|N_g}^) zNAWb$vQ()YL2YtYGfcvWF?ZIap#T%MC6}4*(9tGab^OB(vYGJPOdFMVFk7bp` z3wpL@6kNC`qu`=QMkq1+iQSQsP!q0(&YZtHYr9u}D9fumy}NO%PyDp6Gw$3E4%Ooh z7e1B2Y6Ihp%|KQ*3Y#?}A7)yWhtAM@A)&C+mhE zP2Iojc+TS(iufx8taLDAZ1c>gLA>`8>=%|6o!+*McLiFj;JgUhYWwY{7u49sNa*IKG5n10)<`H8iDy)m0;tBJT!TPF4nd09qP?LT{5Iq~lRJVE)-cwzx< zbj#o8D}t*`KGVpSHy+MR`ujYDTKqbE<=nZ9#kk4mw!l5G)GT3YNT1Uuo;wG}c|F!~ z&2RU>x{*(%b<|G2mnrA=!dwFzH@IhKzkQj{yY1ZhI*xbOU&s-R&$LO)t>-Qym?PaT zHRJzsuJ$$Bz3RS-Y2U6|n}e~#x}EwfqoloujDxO^^elDmBYW04*Z$L|rStPVW{&#c z5#Y}+({RKGK1HTJeH`cEg8UyuF%CR@X4$oF|Gea~4ZI@n$i8I;?P**0Wq`7jtRy<8N->9=UGwj>vWO2^{}@lc5NnKj(Qeln8yP`Mi-Rzq41j zzi!mDhVXE#H-}@rnKf|@pICA4B$%hp4pi2iiX^&}Cv$S~L}cglI_FeP|6+*cb@o3S z2qo}LOJ(fa{k&1%=6!ns3QG)7Y;eJAr$U#SPI| zq$fTb!PB;_c!CIL?N}1?aHJtubv?(Z>%=>z%Ga^YnNI0@`KATaY5)5*ael9c->JdM zDF4|g?g-{)9nF8K_{gZkV-Jl#IO)KYef?K$Um5Eh56@bPzRrvstE$9#Pg z1nY4{*o<|-!2f{S;~{TMQ>=R=R8iX;!IMr|)4TAfjjY6zQ(HS{;>oE=q5ZMWXEKn# z3qCQ(jItT z8I{agnV6KyjZb3nt)tGF1;s_UcXOWCIp^N)$&u+RShKR=s-x}at)cw|(Z{^bo&P7V zt}?WbxvEaxh8YF-!6P#mGg=9IT1-FoYrvHc`i*Pis|B;#!?T$x8Fw=*8VO3AKFTuB?;! zZxp{i>b0>a#=kP@_>^PQj?R2(_K|sq7aSU}vVX(&)%{a#!&P0lPomvX$r>ITFx&Zj zrT*2Iz3|p9cy50WzIF1Sc*1LIhq)uJP|W1{s#7Y^Kpgks`bpX zB{F&Y%Frp~_om-gRon3slxIrPart+B?6{ zJ2~F@{#AB4?)r8)>O`Jh&Zi4z4jZO+l(^?bD&`azFaw z)-K_qNZ0!Bw@w;xpx?m}siP+R>UlWNY)Uj#tUPa6B>kjNmAAp;zLoek8p|jvqgRa@ zwY^svI@P|1Xg_Wc@9DMX@Y%Pd|NjX7A1+GdaE%u1Q|35>9PFLmeE z+h^NXDxU4hv<1$UcxwB{INNsQD~|S7u8#KOi&Guu+cji1?)fQa+ci$Vm6a8-hVEW* z%JcS>>Ep4ZQg%(~w{H~Yqp>SCrS5JNk)ki8&@)!810et_eU|S zba?-KX&XaY%j-|T2S*JC`_z1dM4?K$PHKK(kkpw$lc^y+_}h1G3?_uHnGS?l-J z?cdaC;P01vJ=Ro}7l%SW>of9ba!BJ5o>Nd_ho0YT=lNLM@xtS-YAv6#NapNyR=uJ9 zPn37$@zv8!Tpg!IAXfopoyNB9v1@rYUR{oB*L|UurFUihJioR0XQTEXJ$d|%6R*Gi z+Q}2AUm3FUnUy;m@XX?sk<14s7KFd&ZN|TheOxiu7yaw4b^BLTa2?m$1uapO%fnaXWHv`u&gZw#c4r+c z-`(j<`M|7w<@>)iaMn{^V$JT~T^Rc9npmg*{^rD{o0}d;Ztj08KCzk+ZqAy4cNTbI zMK~?_e0jgh$18J2esbIFDJP~3|H|I46i*$Ab7->7)sSDuKFN&wKCQU^n&IUvZ-$pi z$xY5G7H7*2$M3|~+qD^vjH@Q%{lbf{nzb0O#+)(#s>O?{uDWCHk~vFf@(s+8Yf9~V z9$hY7eDC6`q|cu_bJ2`N_g%9Z9@T(c-@G(i>2wkKXk+#QoPq#?6}`Kq zRxO+#w{Hg?8vjaB_0Xc~uOgV5`7`dFRUJ1`mBg!2?HP-z=PtNIf#Qw5cpo`lPQA3o zyi1mEmgZZ5-7?~L4=jnNdg!mmk5{MOg+Q0a`^>rruiV7jLy_p~rCvvl7lq=jve&~P zC82J3Lph}sc{lp6)gHmOYNrhSHz~*Q>fm_#-KB1*C29o?v4sof-z(e2@d=}EiC^7+ zK%3f?#24Y!tqbpr&%Bp!tZwVgzArvLw>q$+YT?4K&7I|$KP=R|2N$nxj?bPkcm6Ec z`xb3?)y!DD_#C?ye{F6}4fpxAHp8qW?!4EPFTM}%#oJl&o?HKA(QdxD{{nf+i@n(k zmoBJ|-{QY3eC&)nXQlVqU2R@c-EJ@6r8{HE(nWZ`?fg3y;vM>P?p)m7Nbix2qqFAX z9nw{C|K+xS$pks1z%gR@av9(dZE?LF@Od{yDhk*FORudc&~glhvDss zG2Tkf z#SdyQUc4*z+;)7CK077uz9{{iUQ^b8^YCm_@}gOHEk(;OZc~_DhQT8`tj!+$HbJ%j zc6nEgV<|Wn$7h>((=T~g>k4!2AkIU$zhr?>pS{QpcIvo?4v4-HD)s z0I`1a-vy4tgFlyH*KcjkmS6Ylza*X-uy~(+H4o$tGP+*S5_1;fsM82aue{n?wOL=d zZ%223XQXWw9R_o&IU{h{hokRYCSK8E)Xp3??8}+65EJ@(DSkA^n}N9{kkdx(3^n*) z95k|P3(j~bzwDl(vH_C=HcJ-b2VI=ghdWiI+TC9;n`ID>_` z;BX4F3n#t>ekOhy0!tXYhMub}^HO&$tT^4ZS%;ffzNgly{?9$Qt!-avzXaW}_|CaY z(j9z`2>cChyqfFD#1M4k_zWN9Q@$NFC1NC^MWODW95i=)r^`pzgFQ_gFgm=YfS#o52j&Q`3d~$!Xh5m=|RpPLg3GF z_`d*=8v5ySvTN|OTEX=bFZ1jY3Qg-db>o@LUkD;3x8YPOe&~apz)Ns56T2q{ z%_MERydw+$%E~`fDi#mL;xc_y&B0H1dDaom)|F$^UEPtRR2;Tv&Aj2?uLuq+XBTp{ zxq;x0xKt-{Si8R!;@lc=?NfIMXzzQy-JHp8=dU)IpT{^y)>Kg(FYYg8`QzkE@zj35 zQ~g*v`n?S|XS*Qy8%}epx#nAPZ_1x<)zObTrL(vF5v;UsYS?Bk4gml6z0lx)y;WIN zw_VC8E_{3<~)ee@jK1v77E~XIbLk9=JC( zJK4b78~9z{`$wB8F_lxhsu#{$yx@u@ zW&-f5W0t7=;WQhhbMOTe_KUquls?Jw7T(gutlBwil{#z|%=$X!Gjm$Ci+Ghr-}XAd zKh)C)Vh5SLaEAZm*NMgE?#JwS)qMPXkCtKa0cHL1%L4H}bCxWrSv>Trz#C;IeB6e4(#bfwydX{;!&Op+aD0G_vUKfdl3a zsJZ&~I|tO1-Co82-FN4mOXpu*qgM*Id1xscpD=36^#1Gf8GXTe!(Q9`kw7}j`xtLd<@Qzl3*imZzr;I`$$S+u(=0C=@5(e=miK$^NNw5ve*V6x z*|NOJ=X>6_kiaYU{runQ=6P>{*&6bEbrf7e@(2dzgm=`{j@)p>H`zcNypy}ED!Nt zgbXTgeV{%Eo$}}}3-6G2{f}_ce?-~$!6)CfE`MjcwzYo?Z(%c=iD#XY{{iIPgMaxj zQ2zCS`s{G*8P5k!dJ|?OyyYOkE{AJGgJB{-A{&$tX40(qjjj(+C3rH3G9C%kUkt3pBb1RmH%3l{S+$e&KHGFJdF2D zz~85V^s@o`NoWuGXZ}kA?NR8YpMdQ&w68mVJ{ZW~&GG+7#Ciy6_xPL?IG!d4(&K|^ z=XgpWKF$F&QF||N_A~xf91Q+u+IxgUJ9 z#`d=?uP0(3p(Ng6$o=aB`Ny#{{VmJ;D(wFY|J?T2>+G*bUiNn!_KJT(pnRT_%x2pE z(m?%&1=5cqCf9ykVE>dr`i*#7`+0%=JRh6Ql)u_(f7bsco_zex?0+&~|6(A$BanVA zkpE~P{gPvU8`^6L`cLOGmj6Lue)_Xxe4V z<8#Dci1Jmx%)t0Q5QuL`Aia~${msNb%-O#X@eV`%HQ!tdegti%`aFjHkE4D(WL5r% zK>57`=`v^h@Z9nc{%QTf_Ic3R&-6V0aFM@ddA~qg+zoq5DsO&Zyfg;V+nw?UpuH|d zduhH+AbmaBoJGpt2hRC{<)3oWV^B6H%f62N{Z4$ef6qy8K*LOif0f7mIZpdB-6fEo z?exdn$XkPdT5k>pH{&0(DBj8ok?^-H?=p;y!`ROyt@e+0_GhF0P6x*0u0VS&V`2W5 zq~#Bf$=S_}mj)-^DX7oKXd@JpvOnm|cgqo91UnfL{f!16LA<=|V){eu z-+{Eo+YI=68R;Use;dZ$he*5Q{j^j5I_&R@{wa0JKj!Rbd!G!XC&gjxZ(07iE(bPl z`<@B(&!)IF$9m~m#NQkLT>JN(^97In@#u^)WKsKN1Wzr}ucJRf)b^LKvEV!s>jJT|Vsnf~nEr)~O)!2b6fe+BUOJ^XXW_lx=I z{0Gn%zeb;20ZH+`;2hs*9)IICN(SH5jrwh5=lWZg_g(ldfTsC|``>f&-xM~MY~u`! z67IhzZZxiE7odE$nZ^(IU*z=9c)J#R4_Pv>isAm3obrE#0H4H|blY>dlb`nQJN8U3 z3GB~v+AkCSzK8WNrxdlvivjzgjy?UIaoY1I82igmS9THe|1)CShct%()8E1V-=NLt zlIcrO{{rm4$|-LE8`IyiykBEK*N-JgE1p5lewKfKAU!pZKI_DH1$-^TKZKR?_h7*O z{XqJ|K>Dnc{yFNi7yjJiXPC48Z$NzSVE+)Oyh>+3<8O4*KSW@?F&_In_Rl%{zX_dN zHU4GbEX@3`Is5+uW%WcK_QQU)*F|w8{LLIc)12dj`4?T@cK>_vw&@Q7=?9(mWd273 z>BCO?7wGH3IObU-ZE6)Zs);=#?#l4ZbqHu|K(1` zlWCtzyceUdo+?}81JNub`bs+t`lkSW7X2QnJzaUWFyN*5mH9Gs>LjDS9 z90D3IC!G2(#`xwvM%RBP7Z?79`-h1C9?Wq(B$WTKv;QgN--!M0_0LcaPJc7~J^RYG z>5Wc*Gv3jTzemyj-*CpyEr_4jdt5@X{QhYBT$Jaoza}{Kp}$WZe@vfp(tkp{FT)uR zDb;6yv!C`SocKq={(ab^8GQRP?B_jKjfV>mFW39{mryR2d$!iTcTz&?b$7`|24<|Pf`B=L49?+ zWTGv&J&AuAcqX6zDxLhB(LVPeoZ?8H2Sl$JJ{ig%_bDaGn;hS3t z+AssN4)bR^`^TJ0Uh|#()8Vf_`d9PsoLsCQV6Wrx4;cUdjdX?0KM3h-v8K@V z3_n}S!v4$c{=w|H)RrCiye=n@Hplnql)Xu_u4XgoHA-SWxVI}lKScR)XsXWwXFuyd zIgsAyqx=4{i9R%CfyK7KM_d35=eg%NT=&({7p`^k4Zn{*w4j$@_p2gZKUxs$+0iSc=@$6 zo^HYT|8Jy`&9`sc9_IWoEal&%rv%dJ@z*2J9vAxUkHH?0&VOMb|HXd(`%~pz z?A7A<&A{SH>pk|zT4(eoY_Wy}Su%_&u<9<4uoOV}C3aZ!a$w z1-$}$%~z~Xt+Su$Re|&~f%KU`x-3J2DK9J49wwds{M)4S1N*l)`E$@7KkJ;H9~sXv zXa9H6et*V(E~(jme?a}O$Vu1#pOD6jgS^3ZKl5`fU^Y|!^MUl?Ksw(kkNNKlq@#iK zSttKzI3B)%^4;~p8OQzx?Eet$&r_<7ubIyNuVH*%j{5bn`}@Ma1^$#~Jck{7rnAGg zdN}`n8RLh~4`_a>#dscxbbsrw747?Vq&dg1{I=ukl0e$rA4tzEfne@M;>Soe!2g<)7kj@Ll^RqyDAg%?p zF}_JSw`yZLBT(M{fc^gj%KNQtANpYaTT^{w(w_(Rmj&`qw(X((mj}ul8?e7U&^}KF z>UT#V{$ybP9|QGW8Yq8kApc8&^6LZpe-%h~!rEIK+v7`t`Y#Hk6M^z)2Ffc8_}dgH z?^}WP7!zo})q(Wa1NJR}^1dC2?}I40CXP`gs4&>*xl{VIQK)@f*D^c5qad2#sF(41bKW-)X7rWKy zWa-y(pRLagw3%#d$g&v?F10aDaG2-FJX;sC?3uTh)m=ZsXm8t^Ec@ZKw>nw+cyR11 zCLXf%nc%2xvw7e=oX@$DWwQX>%j#t54}xP;jZd=l)s9YSXCPV6_8T`h(yo7n0akJG_z1 z1rfF`uIzLBNY-H)2Rumgq`V`v7O<82=Y=T}^Crh6XR@;)L^BO98x$(2Y z;WgxZqpt%iHnQ?=1S>YO^v7vmX!4S!KS_J5lchfe&Mh+b?|@@7@IP#1+3;Cu#Xy$+ zAy_exrGG;EKE@|m`lqzFI$1ie)zm&@>AX)K?Q8t-^BZwLu;L-hzCT#;kfjfxeLv%e zEPV*=txlFc9ISZA(#L}Jxei(ScyO;PjeoNA>0tRGORoXvl^A=n^d;b4Rwqke29_VP z^hc@N3uUtO7I0pv@lTe%1>DQ(Wa)dsu_|;3HnQ}C;Ans2=Up-{(6N00R{N7>{~=iI zPnP}(?aNGFvh+`BZ*{WtOq`!}Ec1I8DvKPL@88_Ct(4S^5InTb(R@5$&%r_GIaI)86W2>G#o|3odMA=?~K0>SXDS z;F6)nezn8vz_DsGKFP9w931_kvEN3%&hQR!>Gg&WfHk(s%KJKXyVfF0e+L}B!Q{=x z8c;T5*%UfDS^6Mw^q)-L>&WGXN02KFk8^kmSnE%+{8Uq)W$H_oJ|7$%X8hbw8yi1a zHoSH!{erQ19ISCmmd%r3ja#zxO|-8xdCAhZ(cbE0>Cb`{16leZ>UPaZmVVsP$Epm^L$Y*!KBT@TOP}xPWa&%5nsdm~?*Xf?$8t>Dy@k6_b}NeLL-~PL}>0SZzXH`mdzBf;wMX=23GuJ=`(3R-S{L+pG|wKlcn?Cr`nb*eFeB=hViosoIBI- zlhmsWw>bJU;ApkcpCivQe2_fb@L|WE-&a(<$SU_3SoI=He}(pU7(Zm`uhHJ>Wa+2D zrE`q^yWoJ$HsOUVHnM!?fTQz`eNS-7orZgp7Z@%B$L_R! z4OZS!)E5|?ES=A4M+;2e$zZh!SvFI_Y7?^b>9k*H@{*-j)86W2=}W-64?~uIKe)8U z_<4>t3r(D4+3@?r(YuVzQQFiP8?tOpI5uy9RTr{sPJvYyvh=rTzsUF}OXt1qUREbd z{}5bi?}zX~gy>?EHw#?4#4vvH#fvUAJcN9=;Ts$t?(kU0eiB&mlU42%u;M36=Vy?4 zUpM~A(r41%>SXDQz|nh+{oUmI3^zKw39R)qS$SWeZm(y_()pc}=sm{IQE;jC&+odc zE@aui0#;qf(qE(fH;f;$^fzd4b+Yugz@o2jVygNSh10%uLYOX`k{I2z*^6cWwQ~i^$b~h3s}bpzkixnXZ(<5 z!|ze|vN~D%E^zKLW6$ST6f;>i&w&*)S^5jKuQz$g()ZEc>SXCh!D>&k^f$nom)@m~ zUF(u%^O2*IrGEz2`iCr?4^?aZLzbQi*7}DmozGrt{X>@C8?2bg())v>4W{nbIXsG- zH2OGjX`|r@WP6@}%K|$@n2lKS_J5lcm24 zRv*0&jx93dlPsIF;F8V8X9nhV#Y2`&7Fh9+rRUIotI122&hHWRvN~CM9IW#xS^5xg z$u{F>C|EI&Wpe{qF_5M6`^95qan zf0Ctdr*7wYvh=-6So1tt`T?-!d9w6Fw8z-uMwWhr_EslLKM7WxWa;mNb-Z+o zqK|eMpFP2)TMYA^IBG+(^78v6YD2R0IPHI6@{*+&(%$N1>1ANWMwWgZSh4ZF4~l^- zn_*zZK$bq7_TMrwkfo2Jz17Lm`Mo^FK$bomtQh!RE5$&T&3v$8AWN^I{Vo#&S^5%i zFRPQKF9RzEvh)|I+cg+j`XR95Axq~w3KS1n`cc~d(8NQQew_AJCrdvCRy<_s?}1C7 zF@DZ~6$4o|AAuDES^8Pp?>2eK(m$iU)ydMcbJH=9rSn}M_}NZ>%O~$KJdC{8@F?<+ z3{L=;K4+NkfKkk3`J4h)%w*})X#ZoAmn?lI?X6ChUISLUk)=NfR=H&9%fKp^EWMHT z&zo||(pS;m>SXDUgLPd@mi``C<&vd;09LtV>HMC5-oKb~$+xNtVq^V8uz6evI}%HF?R>`5baDtCOXl1n2HE_V0qD`whPjR=H%^p8=~} zvh1Szgb+Yt~7~1CnQx@N$qO!=c$p)(|vh*%sl|`1$=Y~`kS$ZB=>tVhh zMP-p?!{>li7Fl{BIPZXolPtXtxR=$*(uaUGCdtw(!MS#wJPsWFnejOZtb11EfkyVG zIX2Z`#Y~pX9I#?0OP>$cJu9;G8nEtJk)_`U)>v%-NB@@zVlDZg;q_p}Kptr0d=#u0 z$kLwxYwb;z-U8Ozn=E|?xYVxkc7atESvJptRTf$LbKtx~CLpr(7r?!&PL_TMtTk=4 zJKEnqi%6EuMPS81mfjnz7|7D&wEww@fh@g{_EslLzZR@HmMop`n~WYdekOoREKhZK zro(*yWNe9)jnkD&w@NXFkD9#qQU5o?jbODWS$WqvI$8STV6`V%`jcR_Ct3O? z+S_&`OW#I&tCOWa4_14Ur5^`JkC~WH(Z-HjvTQPXLbv0bEWJBe?M#+_5m@a^mfoB8 zzcgi$rN?P+b+YsUV8u+9J`|jH-1s3&zX9CK>SXETz?wJ6(x-zGQy)uNr&4-%IU4mQ4*1kHn`gm_nJoP|+W*GnB};#S_EslLKMc;bYn4~P z(SJ92Pl99jn)u1Ge;2HH$kN{jD;~1+Gqiuh_#{jJi1t<|OV79v<=SVE$kMw}zt6-& zmL8}64WpB#_W?(LYs&2pR?KAC3;-);vh*ReKWXxkr4OaO)ydL_flK!pd%i<0?|-LR zHY1qV>SXDBr&``AV^5Yoj`mh3OP>Z-`;etCqkg|>2eS0l;Ji1Df3ozo;9gcIOMen9 z|77XgzKL9TMz47xF zZN6#ZB+KS~aP&Q6^C4Jql4bJ=SaFi2e@grRFnP(+|4e(Ulci^0oIck0T>(AANtVq; z;OP6t=cQo9LzYcGSn-gh7t`LZtI5*)(cbE0>4U&pZ#RNf7Fjl{z$%L@eGTpZ)5J-Z zzK-@*CrjS~)_5jM-vN$(VEpWI_(k#`jQ$e&zYHG(D^9ZfyaHC7Wa+Qb-d^XDrN2RY ztCOX_3s#(D>7Ri0{PUl|ih(SfjJ$LVWa(Mpybn$MWa&Ayw>nvR9$0G$vh)(_wPp;H zrH=(i|7iSA0xLGMY^H$KK4j_BX#bJPOO`&9_EslLzXzlh7Ct3Oj)NTA^>3m66^uJBH z7m&{y?g>`>WZCmsFvU-nektwkcq2>Cr@ht5(o4X(e==na1;^@4zmsJ%h59n1lcmoD zM?W=r=YSO_SvK>*ijyq8hW7uL$xD{L1l-H&Wa$lH&Anvl>%h^^jGv8Q#Xy$L<6y-= zmi{E||HtGdOW#C$tCOYg0_&J1OMecmWA*@TJ~uwevN-~ddLe(uF|gt!%jOlZ;v`Fd zjrJjvmn{7a+FPA0{T;BL{W}AWg-u?vY|etCnMVIJSn-f$lhHdJ4_SH^I4@%IlBMU+ z-s)uO-NB0IQgE!3$xD_^F*wQ}SHM;RRy<_cl!4VgWa)!w-`V6POTU)(Rwqjz2390?~n`vOhLzX_1_O@Th(r44&>SXCPV8wGESn-f$vkV;VYT{V| zRy<_ctOhF{vh=mIx8;(hucy7$$lw|fV{sykUWFM*>`i!8hnrq6< zxCFZW{FLt$Rt#k2%>gS0vh;4Wzrgq*OTU2jRwqlp6s&oMEWHG*d4}&HRt#j>3<4_# zvh-_dA2TtKrC&#TtCOXV04oNv^vTriiw(%qXM%ITXZrC$aMa$vS_UqiX>`83S}~KA zcLi86lcleweRmTxS^8SqTb(TZNw8ujOWy%5ecZ&r_pd7kvTU9KD+aRky|nLPVjxR@ zp7vHJOFslw3}op?!Ma9x4_wmI_&ftvJY?B_1Xes`>1Szwp~*{@{u%A9PL`g1X*wRV z^fGYiMaIt!;F60Cj|NBc3{NKaGR*f7D^9ZfOb07Yvh-@&+n2SFrO%5bGI%-Vx2eI2;uQWM+bv`HEpvTU9LM=vuryJ#ObycevxkY)coSal&wf06c=o4jP{ z2WW3~vh<^1)rBnmJ#eXw;f%u>mmxO$BC2e#Vk0YW7qDU@OOMjNz{EzD-ktVVCrgim z6&qQ4Ik>dY_!$K*DKb0`ta!+>p8!@oWa*P>Z(oW>mOhpCRwqlJ16Dj_>1(OmekV(R z6kKwJiS2RPG}?Z5Y&JPIJ7~j~2Vf)1&tdAzOC3>;5>ww5V3kFd z&1$g9B1>OO`YBmVPZ*V~i|)6m|Q&1X=oc zaI`GsahnWQ`;cWb6|D9lOP@~riGEg(EWMicRwqke09Ie{9q!SqLw@E4aBPJ+PRX)g zLw%*u$5a6% z*5oBiUqySXlclc*>$4}m=U-)!W%C4BWs#+~(B59Zkfm>-z17Lmp8>0X$yaZMZWa-CfZ_6S}e}(o|CrdvKRt#k6AAq$U{s^q=nzLZVLzew#V8uh0&KL3K zeZjOpS$Zb8m(|JA`F%3QLzX_Ay1gexmOcqwdWrEr1)O`vA9~(&+S?Zsl4U;!toX^& z=YthLS$Ylazi9lEr7xkq)ydKy1Z(`P2FIE*{D8=^Sr3k0XMDEM#(rOqESsljbG@;7 zmVATZ=fH}eEc+M0ik~cfAMH1pHX%ztNPDZ3r5^?7wiPL0YU%jN`FWs#-7PW$^! zUb6I)w6{80`n%v#dtWiLFkKc|HrZg6MV8)$_Wxwsge*Nud#jVB$HB2RrZ33S%fNZ% z#t&KgAaF0Mlcf&>%MV%lcyL~Y@k5qA3Ea!-Wa-sl`5{YR0?r#|{E(&J1MX#Yvh+r< z{E(%u1LtlqeX)f$_IosB+3WyEZ!~2+16E&?WwRHo_9sh!p7u?~KUw;Vw6{80`eCrX zM{^V$F!>SXCX!CJ%g21jo)<;KA(mn{22u*xM%??ZcAU$XQP z+FPA0eF#|XFbu5wy=2*p0!K%fc*cPh4_P)7z>0?~eKPGwn!IG`Q)zE?vh>+twZk%S z^h+i$f2&31l4ZXNta8cH*U;Y1EoABIXm540^e4eOzmTQxq+W042eS0N;N0KaaSm2& z{7oI%ya-loWa$TJ{~ME+Ed3DetxlGH44nJAv3~=svdFSI1y)&P>1V*Y)*ws&Gxcwo zdXc4P6{F4Vz5Om=l|`0K6s)qy(!0}sjOj13^owY3b+Yt0Sbbdyj;%HEkYzI(935+X zjt46qvTP=S6%SeZ6xx5;nw+3b2mBbzt=iSvHS@)h{hz#Y2|O7O>(WOMi;?w*AS{chKJIWa)ds>X&_B z#Y2|OVX)#k3RXO1*&GKe92ccI zxt%P%koHz5OYaX>oA7t%R2Eq_L%=GFEPW{LH~CHCk)_{2d#jVBj{xiZI{_TM%CzTt zu*xON{!y^XB};#T_Ejb?S$YfYtxlG{6Rcy9Ed3xjx4-ej-w;#`WZAp~Rt#k6$7pZo zXR`EHXm540^pjxC+o!;J)uvpsY~BL*vN~D%8L;Ltvh=gy(ox1wPQP^gWZ85BD}J){ z3&7D?CT~x0-t08XhVO;#Wp%RjVzA;NOTQMZc*?%b*nGk%@`N9P;fM4o4O2l-CJ&pZ4gSTU33^8i>elcgV`{Q~2MEd2=W ztxlHy3b=HkvHuVpTW8M2WZ8TQj@B3(51;=i9|zjmo^GCNEhw zBf!0^PL@6atT9QJUJcfmybm0`+xT1oR$a)lUkz4W$kNx+-i|}E^!2p2I$8P_u*N4@ z`VMe(j)`F(`5wb3$oCrlgnXZ2zN|m`4Z~UBy!+EEpE=NbS)DAsH|?{{{7jY}r@ht5 z(hF(-pz%+Z-iP*9Crd8@tIf&MucQ7=onXaJmi`Rwmm5E1>3eB!b+Yv5!HS1SB z`?tV~lPvvR+OIVJ$$3T`%7FaQmrRUK8Ark{xdN8rqslPvuS>dodH zN0z+nE6!)Yijyq+ySXB$z>1SB{V4VI#t&Kg39#aP z9jrLt0xM3k?B4||PO|j(X}`hvCrdv=d#jVBe*{*XWa*jxp>H&P$kMxj6Ncw>nw+RIuVCOJ6{Jy&02a>34$_XD#{brmO~V>EnjifE6=YdDnpzGgLf=ELC9xu)Egz_E=cFIjnCq5XG^ z&Ff&*i!7UyVAYE({WR^LG8ntQg4Bi)sHolb0;LAMLG9mOcoqbu52dTxF4E zGZd_{$kK11y}f=UOCLsitCOXV2J5>aQ^6&hO`J2yTMW+zD+aRi&I2n3vh)SC-)i!b zr7xnr)ydND2j@Oz)^!cwl1(P>DsXh0;k9I|uLmn0viv*>Ry<_sPtg9KjUTe~7TQ~# zEPXpz?f()u`jpB02DoIq;SZ?qF#HKP_JcIb&!1_()9C!cO1;N83taNQj2~>{f|spWa*F7 z-s)uO+rT=m$slcj$EF8Q&^dxkdlxhb-2 zKBI1*VIxb=x;otsWa&9zwF6mtH`+gM$|6g@fc91=OTQFc`Y*(%$N1 z>Hjx#?*boHdFTJ1lgWf6fDQ~;Oi*J25#vnE8o6t-k0a>IWDpGQpOdyy*%!R78 znvhH|TwHX7D$;I5U^QBo1wqTU{s{{dsil+xYpLskYu#?wcBw_%x~={{pYxpWIVY0@ z-Tl2@|KI<4WhU?QdA{fS+@Euqb6E!-^N5-!9|KETWU+YyENPKN-$HwH{wIsRmG-7i z7JUa;whPaLB`vbpyablC$fED2z3G!I`YW_Ib+YKMgC(t_U^%~W9Bl1}fF%!af@R&4 zV95hn^wYFIsOpw1`dhR&b+YL1fu&8!qFkQP!k-wrCw|8s$9f~KCzos~iyjU?VbzrA zUF1>9W(hf2aTWPW#kJ&5@rAG)A6d7-!A<0ED*IOQM#cA&&GRAbM*1^KZ+GZj4t|up zN!e_0=$jn;q=TPw@HPkclGiCeJIGHc9tHLtR?H^x98t_>5XR|P&C8d?A&{m2u#5PP zDtoq(^lh@(u)U;jlSOCSrTkE>OBTHloNDT1(aXU8W6FL$*z<;Bb_?He#dm=v4`f+) z30U$#7QG6b@*}k_S#-8b&MKQL$Ujv)4*xu76i>iEzo}0m zpH%u3hn~oE-%|Qmrfc$5)PJt@H0r-F*LCPdyPQ+H54zMjS@M|!mO3YkZuEb%&Ik2> zQ=jgzF9u7Ulf_Rtb+gXNqPK!2KV;F_zLKBVwoZ9lmBrcC?X)*_viRZLBKaYUz6In$1Vc}MviNB&pE6Tp%;vaCB1EO{e~o(7iwNfvz)So$Yfbk?)v%~|J#)Xlmgi#_KD z|9O=+w!7zD#VKIlzbQ7x<9mwP?!I3trhm`-iu1uzF0%Na4wiC}MW0D~RyG1z^g^(d zi!6E>*#GY;t$AQci!3$^z>*eO^m5vpX^}<0i}t2Y7QGfMbx0PymAYAnWYO1v{l8Lq z>jF#O$YR57ljMyoI{T00&DobW(ca7(S?srh{r{oT+QxM`h!MzQ(+ifg$fEB6OIl>n zp9f1?WYJ#%OFfW9KTO@M2eRm=z)}yV!IC$!*t`XnypctJoA$p}l zPWcVK5Xhp>1gDxhS@ii}`Av{4I-A`0Ul0&D&q!IwVsiyp%0d>M^Stx{vgjQ9(g(<* zbL>l5$fD;`H~Rot^g^)zqRJb`tmk)%D;&C!|KI=rIRBR%`Txj~e^ck&D9`64OWC<= z?)!tX&vI}+SlWmz_S3=AMr6@v(*BRi4_Wj=aH^@3MdutYZA2EGbuRf?O#YMdxdbfv zA&Y$#Sn@*_y%wDEiCUK|`f_lpsgp%-1xtR&qJIbM`?K=1gEnn(_|`PC*t`suypcuU z1D3pzMLz)c{6+aZME+FqQEWU(>k95c_(Ip@y~ zd$QOk!=3jTRYtPtW5H5Jvgn+Pq>QoiQi`Vh#Li2prtX}VvfxMRpDg}w1N+VXSqM(i zl~1zR6oXSuoh&-%AE}=O;FLJEE?I2K!KtQB7QF^6&-o#Xz5*=ynZ!CY?+qu5jSuXL zS7~wVNWGE8=Cb3+t=66CurCCsnmSqh3^$H=*z8GAe(K006t4hFe#qiyC0N>#EPAtH zuhu1tzS^)?I$88JU};CP=o`TPk;?utu;hU(Hcx;h4`k7|(4HGZ1hVK`!E(PLS@d0C z$pcyRQ`F7-^vR;11N%m)yuAnZj8@F?BK#rPyG`k2S@#pL?+T^IA&Z_X6(@q_eqplM zb1e8g%7)ut<s-V5t+b*mEpMojAuuHtol%b;)9%OM6o%i_UQ*bwU=s1nluDKV@La z16gc1jwBCc(HGKwoLZMGdIjxGoh-qgvW*V6tfWlt7;IqglIEc!!W z@3)mbS@aFm&HEq8qCW}tO;GmRY4aVM#ioxoS1bKBus=odQ3oFbds3DD9$4OQNEScb zz3@#`Hr$-ZF)~?fIAw?*b}8RA%AQH4Tx+w~Q%W^;{u4bNENx8|-3Ru4310}=_~*Y) zaSr}TyOYH}A1v)o7JWMH)9{5r7JVi-)zrzNmw^3A_(GV6f4=J#FLdx-4qgiOm}9C2 zEO{e~&pNQ=jVwA}FPg$aBalU32~IV2vgr4NC2yR{B`vbp@V0+Ri!AyE+GpSkfh;<2 zJxVoovgn*Xq<@k{-$nf?d?AoUe;MqXr1U-bC%@5<#pZSD=5I7)(T{?ClktUc0{>+0 zJqeaFlEwZsSjtEi{Vm#O;tPQ+`rF`CQzwi5E3ouEvgjAVk}g^FOJGTtEczd5e*?Y{ z$fExloNDT1(Gy&DJ0^l9Ewb2*0!vzC(LJ=EqS7LZK92ULP8K~KEM+8%o(1+ND?e8u z-|}n?ve=|Mbh7AKV0q>SS@djh>S%l+kVVf0%QH8~qE7{v0&d# zcAov5BoI>g;Xx1o<0JMwZ!C347M*2D@vC*oqG!_H)XAdffF(a<(Z_*3H!D9Az>){D z*h~aV9>}7nf#uyyWYM{AmijmNLU8VxS1@<0}wV_?YxS@bt)KUJ+u7X2jcO`R~6!2Uet zhyBDiUGcSG&n=46!IC$!tZVecLWnCJ4^9PV97sO{O<-!{>h@V&&aqSi~btz&AKIveiSVECyV|* z*kk7BL)w_XRguN!6R^+B=ci!FCs}N`e=hkXi=F^Z`HCtdS@dMun>tx^?!(JDF0$xZ z)H{_QvgkZ-CiOqd!R%L_pt7IJ{F{6WxkTxOVE=5za~%3S2eU7EOdIwSpUE{~Z?9UH zEcsbU`#DN)21{L$#bz~F>WVBn`;xRNS@ef#Z?-8}^hd$|QkB*^u%ty68}>;_i!AyR zv@cWZl11M_ds8Qiz5^`%hb;OYuz#-da}ey|PACHB9O1Xfw=4Z^u;i00e$Im>pJdVB z152HdMgJ98>Vz!%hhV9bOJGThEH-}xOIl>n|4e(cp2?zX=vR^!S@bKwQYU25v#Hmp z@{&bw0Q=^f^+TIyZ5Er4sW&K{Ec&Nh_pg;c5&yi~Z5A8uGD=%;*GkGx78~w@NZHAv zb5otN0AC1X(Ya|%HFdJ+oDQVyWYK9VdC;<(!wuEht>ODyvs+pkDx0dCTf&v0hWhZz z*2<=qdn@Z}LG`T$uCIGQn{>ZstUt7?mT*f;{i>Cf zt@WXM!>yG_C)V!k&GoI}%9ggKrd7?Y;o8ckRrN@_ZdG$*b!*E|E2uo$D=ceX)z)+w zOQacISqsmN%1Da9@~XtE8=6)cDLJE5GFH@(71daMe`Q^B^|D4*S3`K^vexB;{HP?B zSFfyXSzdi_7`a$B$i^&E{j$pHhGApF&8YFpmDP>m;cF#SUpstccx9;hfu`2V*5%=q zm5tS*LD{Gaw}zHi)~{@8Yqc7>HeA!Ttg@+@jS_0Mb##E*u;EY34y|fr4Or{2W~Jfl zSJn@VsB5TSwj7ygu3p*F$hdH0OV~E4UEWw3s%{9uL8#fGheNf?hm3G$(76ILQHw6R zI$U{g_<@!InQLpRtwyJ_8>OYSy0xt(wrj@rv;kdnXk)XE*^e9TG>yzJL;r`zYKP9k zHnLO1=!U&BBD=Z1CA2!by0x{rzNW1;jI0`C*4bf0t5()k8iO;mYSq2x-(bDU+%nC5VGEoaC95pdE{zsxqoGCM_0eJkb; zYjsu&Wv51$q57ufaM;G_vJJzF^Ru-Q4UD#L4mUMaKTsK39uD2BWv^V-8qS_Qe~}-} zk7cPB=a^}1s<(7{X{LL7P1_;Nut5ss8g-`nW;2E#v(BxE;s1;HjkQq@m@!o&T6ROj>c-0I z+FCT~z-+24sZu!O95q&1(^h8{&Ftb$4^-CMBATt0TfNE$!_BMe9}HX8tRz-MdfC9p7Hq}QLm1hJy$WY^U2{0rR_%5SiZI4yb2x;V zYe34Jhm6gR+N(jE4_C8>rP@I#)6USst^pYH2HKlIZaLEwm|6V2L&b@-5M(K%OPq6v(win*sq#bWn~ZS}HU$bS(WXGYCE66ovqYN$ zxt3^CAYh3O%CSTXX5?8}wh!ZEw)L}*T42z~)6qshAO@XPFXj7oT5^W0P zTcS;YJWI4GkZXxH1p=1npd3pCn8yv6@^iDP8zm1|MY3qRMS*D++7y^-i8ciaEYYSw zz9rfe$g@P70=brGQy^f84$84bXORNg)QuwLSVgjEx`E0K_islo1CB)jr(v+ zH2&c@RjN?DCn+UsjEEiHl*wCTwPr&W{Mt&GK3ZDbWoHN~R&=T>HApW*v z1*hE(7$oG1m7VUlVMpJEW>owdP5XWm&hcTHWn&!E{Rx2n#Q#h1^*oj((2n6afLzE0 zgo8L?%S#yPkNIRA{apia=C2$l7^N-|ZKd;RjNM|`eTN2Sko^1!cJy6n>aXF1Ft2Z6 zx@b}>UH&HHO!trQ$KM+yh`*f>oc_{2w*8GZ<5&*F?1$ zXxb7pe^)yE-3-m??*RN&4dIV@cKUk{C%XAN5z9LUAI33%2V?xDOx3hHCSV51A8#3T z`g;n`{eB*Kravz};_qK#{IyThv>I`S|Kjhh7=ML-L0%9~f8+5Hf2YCBj+ z;5nA#J%Eohe}%UW?XT5brx5=c-h#hP_)mYlRZ;xSOCIQN2mJjS@e(9|vtj4V-|~^V z#@`|6?|OX1AKTTLzsGLVv|r3^R`9EkfNp{hj)sQu)@sMx&uRbQ z%h0R+&*}X>#A;YWyShX?M@K#DtBbrF$?O&-FS1R`&?1_C(CvOFl5XjlPkP%vxe^`{ zy~#W1Wx*R86BA`E{X$}5)a~(9bf2)+P+Cr!H(`wL)ByE(WU;lJ)n$9>>(UQy@AA4~ z9}&-z=T|ZKqTLDFH6@u=oZcI5^Sa#^JJb4Sxlq@glZs}!Zq#RW-q>H{%IYZU%ql8E zJr#A{)L-cGbrg2`iVD#-Us=N>pW{fedtF@8?D+@NBfBCC zyBT-f%Fp1G?!K@4?Do^UP8~ma;>4*p&mKS2b=#x2^z83JO6#(^b{z|~Cu&~yoTkm_ zO<8WeH|jq9nfIfQt}H4EH677r)OizDKfHI*el60|(Vy&=TF>4*p-AsdOg!Z1A$qU3 z?b4M6rR zS-zz_;qH%1>&niSg;9rSuj3inWAZb69r+nqkLPDhxxOGHGff+wCVy? z((JCjuEYe4oOpZWJn9~}96Pe6Vcdi_BEQC{@&5OvD@O-Io)@+LGNW(ByDy@qB8QEd zy49$uYfw{DzdTe;b!NFW)Q$TWpGI#PuWe1%4<;s9H84BtV8x-#$aeG|wq=Li(*4d6 zp!en#6zY2ma`eWH`UP*Y?mOFqJSL)-7w!$esM%vhjjpsbPr_MiEXgQjty(pHL6xYe zMDP9GIPXW7uKYnT)U;3gHs+3kFYi6Gc~Fac(BcKD-l?ftNC#W zn{ehcZ`;RL_LpS$gqqH1-$VY}9^QNA$e{e2?SPUNj8`oY)5>m7e5h)NF%Aayx01R0 z=Nf%(WODp+?Sy0Ydlg%n==zbk0w>yiQ~X0(#lg(TakORnqvx!?%l1l69JpSzd*q0~ zY^VJx+rD>jdH=sHEz6pi=q%?nl+!zMq!ySRO?WYGVxnD6N4{Ck_<`$16MhjNm_3aB z5as;8)2;*CM%ol*?Y`GFOdDPB4(bch?q}Qs+w}ALz`cn#4%-K=xv%@g_BVGOKYr}Q z(Nl-_qo+sN(?3E_pUs~Bk=4`B4C?6`Mk+@%=Hh(J#qsRtdq3KtVb+NozbLfnjM`hc zSfF#p_a=`RHAUMKnQzSvGCSQkd#09d^yu{N`H$Ky{c&Mk@!8^%(*32GWs}iY2KQIA zV;8nE>-*NbvfS~m$;o&%#yCA<<$mX&+?(Sxa@w3Pr(p~4O-RtDVeij7 zVuaQcj3)F3mRj?VJFFk{x`W^292?x1wKddqkB;qsyt_*8ZPKEc_or)1v9*+0N5{+> z>oWqMCv%rZwy(9Udei4ji`U|U8)9uAhpm?P5PXVlla`L{|8Z>pMak;YFJNuW8y|1w zdn49s&s&PwXY|kXOtaCkRE%lBs&x+T3r@7l*C}Uw>?TcD4nC{LP`)vHnN4Fn4rp?nXCEEL* z`i0fO?bs*Sg&N-F*vA@vOY?Cst1H{8IsN?bmRVhMV(Rtd1$E_T%S-Owe|P5MEsGQG zNkR|5@4ke8PCt|Rv$CJg|H;B1SNv%48?$;|@403D%U#~JXFiLz{Q;vgYhCE#N7{_A z*WLDT-lAV>?jF5=of~6M!&X|$-u!vnp9zVX5xZ@M>!rO@b*a6Walw9haq7gxg%P`V zxsAP+M-!!mMq$QLdmOR*8-vFL{k2cid;j-qYt!xCs~?OVM;vp7u&~D*j}`2_gGUD} zrAH1d$SU7jo_zNwr7OzLm6grC9qqCq@qR56GuLrz?&8SHofDfD$6n5ig^}ad2-S=A z-UseWIGcVt^HkZ%`6m{>S#f;vv86|A4%Z#R*0v|ND|Gj^uA9iU&#TU-B>(7|cu-EBb-;=cX3#6HI ztFva)BYPI4mp@S+clU>-HD#yDX3gC*H+|j{^Ma_u5YDl%pS+|+MBIHs!Y@mI zw%1&YBhQW!Nn^M*cVkW0kyo@NjI-;5dT&usFV1-W1+8;3@{~}RQ{>L*eL>6E{yi;Y z2R^%!w2bH9z^vmu#>?uOQZ%Zxqu*5$jO%;@$3W}!L#|Bso%*59%;23vx7vaQ=~k&W zm-oSAM+xSaIPZv$9?ARV_cU+Poq>*EncdUSbB1c&gLj~YBR~JF-`MY#{no+TL)R1@ zKg4?2TpkJb#bd-HH@ob#diP!JeeG&oH5+Ts(VVt0-7x|>iZdhj5u+PDVM-$ zc;}P-;}`8MIH~<*e3rX$0JNPf35kKte(!B zuzlY-Qtv!6H_lbIS$n!?&D*HYGd~JN-J3u4ZgJ~HYo5gs(phZ7n?|YQqgUhOk~%I# z-TVHlsP2%vzoYT0(8VJ|j)1DlGOMn`ZP9r5A6eTSrI=OYqLKf8Brn{DJFFK4wqp)R zw`u|B3;JWrZ_GATWsbTEZA#KYo8nQoe+n{3A#I=bYP_B_XTUZRWxHygW7H47C2=jP z)~<1T%L}yaZ@aO*viomePba)|?pj~r?Y`$KZ(_#?%vo#gc~8I0k@3)dr+q26#^=6Z z->GKJd2sZW;+>u{OyB55-Pkz_wI`uoSavBzNOSWnlE(8yuUh9^BzEXrUR>&|@AntY zx9X(h;85+edj-!y+`0cwFZSdXMo!@Tj^jMSFg1Ms zE@wN(wwf{W?sZz|#oXs=Pmr3h+b}coY2nJ^cZ%nizFwML_MNgT=6-U|iY0!`O;_DD zRGk#wy+mWJh^MRWTH}EMI{5sp!GeYXHPovY%c%8Yo_lUeBxhiqbzuL+d5oCVHK{1J z=9$-njZ!y{&gm@OjFar@h$tOxD=|1$L0_G>B=46mXxmG?-IpHmCRGHyYl9=3H2XXc z&URuyz#e_`mT>D;R1#eq{1T5HK5q*qTc%ghx1(M016rbKRl4I$qO-1h2gK+>``D95 zoVDC;p4;`#!<#v0#d#CBWqt)mV-?s^=p`K`_O=3}a6@d*VvoI;#Ur)%tB(m(L*_QGr`f5;EE zxLRUq=Mjv+qIKQrk)?JWu*HX{DXn=xUT}1ZeT?L}Bac>;Zt%MQ{7BTjC~$H@dZglW zJ>iEJHGW5NtDDicK7L@iI_BxUQx|96?HxJy%H&6RzI!pw%r0E(I64_7kG*w6ZyU5_ z?2%{J&L4DMf%9CU5qr)N>)NrN+l8G!8W$b4VR6^DLzNLHy^S?0`}Mh9 zu9AIP5`Ih34?TK;Zi3I$ZdjhD*c4_ZzooHRIZ^`qiPdy+Ni^HVFVbYRjnS|5e zG)>)Wf;3ICHQcwAR#T5Vx0)HNNZq4STR!irX@TrKUz)m8E$u7zCF&K%U1^qqx}0~g z!Oe>h({gjT1(&f^H{9IP9J+Z~ee3eJ8s5wVxyf%{P48rX%L6Spi{4OQ(_G#Bz|C^$ zaGr6S5iT6Q^|mzUmH50mF3-5OybV|Qht1pODtVvEpeyTeNu7C@m~m-&sJXtWRkOr2 z<8}=50(GvRhWiE5q}kHsqWGD&{;$$k`3$dK)qu;^V{X2(%ZPgkSP0%Pq*_EPHtw-X z3syHbJdpNPW+9BGu|;xG%)GGm&a-7?*dhdVn$7Y~C|!bO-A`(rj&xj6Nw2MzWnZ zE6JF8c3Q~YN=E7f?jN(Q%pPrfQFYg%eZ{z60)yO~17s?d+q2@lX8jPZ+;W`;!=H$54Nt=je>b!QT5Fc3v8bOvB&ufJKPuAChEx6qd_gU3p zGmP7E(#+c(({gjNamjJol;y3hO)aHJO2t5$?Vt=ZW0rg59A)~w9U z$t}p4o;%}4t%whaFz$WT^hv;YkGpwwUT%GEQ=qajw<)JG#IFY%8`~NJd`C)bxCeW} z65_SrefEkh82??`9k^z<$-2x*Ew6AaKWp04jgF_o)Bd#OL)rTr_KfHA@9V z(X|`35$NCKo6KeQce^}l{SAmyK`n2UMO^hv`@5|Epq9@%;@?Dn?Z)zCe3)J}mR|(( z`fx5E!#QS#3iyb_RnIwy=XkgtAI9&)c>D!e@;9)&Uoz5Pf_N3wvR!{_d6z`PKlA%i z%rc*gse+0xj9LCbqOtzK^shGj+5J&1+x<~3KW443mY;MiccFZI#!wnGmY4bCvoKXq z_G=u=Uxj@pmO1x}{h!5LyIM;}d>P_19r1kLkP268ze`Z_yEFbNNBnH0zXi)_SV8>T z*VbRH{RQpA`2`mU8Sw+_Bh|=%gGvnFYWdNaWqX}eEffCG@aRc)dha;w47_g3 zcR1qjL_8ny&+Eq}zrS|Gvp!kBDyaOV#VkJ>v&`q;IPD*EEWe2Q9gqB81p`U%kRzVy zorqaJ=~%YQ&J?aO>dU7Rvz8aeEbot5E_WZG5d*<(C%(7kI z%Km*vd@20%@liLJ{wH9W&&wQoJYE+wKGKZxt+V{8WxIT8*={ej{I3@erycD<|Akmz?EeGf zVKSCwzWtIJR|A7M%nG#Ub3w)aW!RU&=2{4n{k%0 zIs8d~8H?p8meb7izJ>Dbbu1g{Io9WLyCXk!u>TpBCz}`#$Jc{yps9 zMgGKo;P_A1UPJr{ly|Db-z9N}QZfH8$1L0PLArK3*1r|&^Zp)|hxg}HIQ$JvZ<68f zVawkn?OBw61MF`!*JpZme^vI+JM0<1+p)X@>2;&LSD5S1!19w=&T#m%x39|IB&+|c zuD! z!*5K+Jt#6>E;-^iBK`LepKg|a36^m&qqR(b_V}2j-Gullh?nvA3Ah9w*`B=t4&fv7 z`*m3V5y$cwAS<$7ph_{gM&y)z+HrwZVuVuLWb$v$uV!d>@+m zV;U^~y)pLXj4%V^Yh?ldx%}N2d)~{-aMnowYV8|ldwy&zr)oDk`V-gxWz72T#MJL? zhBx&^d#}07elZrK+eM~J15Ft zfKyGKEP6TZFDZMn=sey{HFdJ+RbcN&%APE`anH8d)|rU*CMz4V*kpr!Jg7pLg^$>f z#ik4_Hr!sM`~hDGWU)yHreat#byH}A9uYi4oh&v_fTi8ZqHm$S*}i1ax6L1_>fh>9nSah=J6%L&&`f{*m0=^KM@$qnn5aE7&{3!-%?PTugBCviu z6Ad)pyXG^w7g7p$J`j5G5&t{DsisaA{bjKDKLGZzGa|f>5Bn!=$zp#9%>GH8Ec#nu z?;r7nKop?w;@5Ih`@j5Jy7CqVaIuXJOcG3P7iJj3m( z*i5G%(}pa53LQ3_b37by2t5Dd&rr;H!!t>7E$vO_oFMf~7M~4Zsb{k2tzhxF1}t+U zS!{ToLh6SsI?w0$CaXMb1|!rtS@7s6D0d?w!l zmO3Ge&)dLKCuGs*fc@F{La4&Wb2CZ3!`Q>g8(|$jl25X%%leTzan{uq=u#(SvFAJ> zbwU=M_2UcR3xVTZ(sGXdcc`0nLY8$|KYnvvqo0@&Mn5t6f7MU&;TXZ_Ck2XE;Gc(; zjqn&gl25Yahvk(zah9EZM(V`bfA-LiSuV2pIRN%e!xzF)d?YQh*t|>KT$e2RufekJ z$F%tkz7WV_GnQk`T$e05_nG}>y4S+qGlOfY_lWpR&c(9yF|w>X6)b&>EIRv}pPdn5 zF+QHZGEmhm8wX)IKK@$`)LQXR@=O*#4}n>?{Lhc*?O@g|HL~bWf~AaP(b=s%czy;$ zAwE8ni@{PZveoD=+ijW2{Id^|h|K;YPyxs)vS_k(3FC5!$T zSjIb9^etfD9r!}nhL1NM1vOc0c3|1hOd<5)8tTi#x+@N9t6v{CX4xuP8NMP zSmqP5=m)@_rT9WPh!4lwR+Gi%FqS#isFOuM2bN|rQ1a|%^TC4L&%=0Fb#V0o{%rkYe=o8rYIDinyqO;#ho}GO-6T0M?EcRKn zuU3A@qGy9sO`R;_9&$YS#fSjs{c{WaQ$)w*QSc?_6p z>dxcAt@-#WUU* z$YQeq?5n4W=jY)gelJ;gjlSMyGds8Qi&izc; zUnPsqO}^(o2ngKHdblw`;P%nqqSzSw=JA(v>~qY@F^+Tm)>5Z41hS;n0QR*ipG{yX zFIj9_!BSqb==amUO|457{UO?$I$88?u=KYLWV0>41D3pz#eNsq#|nhzhsk0*^Tq2u!9*bq)gNAIJ1NVJHG3Nx| zLyEKT&;L!uKKzsXlO^38u;iaCdOq#B@kbzwJ{_ED>SWQ2!P4i+qAvjZAHf&Ga(rZ8 zg)BBrU|&1F5ZDzYpJcIN6-YkGqO+*7uR<2R9W47QWYO1w{T=v1;J%87J2D8{@$s3w z3oQF)WLdWlEc<3;(O&`kJMo3EA0Np-S!@n~CI4j6U#EQ+z7WWw9|EVEI$8A7U>UPy z(ccD3J--i@Jdnla*I>y5S@hr1K7ua_(Ir$ zkMv2h*t`t({SCelcH<-YB#RB(UGhm5{WaPz#uoxv^zVbEPm)DH4wg10i+&31*@Q2I zv-o(-Jf8#m*?AG(#mBSGKBypwqx~i2lPr1)SdN>>qUTZ{gD(WK=-j6Go>YFyX){*Yki}*RZ8j?#?)ypp z$zoFjmi&`NucN)0PqOGMXm9Fd(YZa6{F6n05G;LzEc(M>=^JFx*U)~8$}?H?ZrYnV zS@ca{|F@L=Q((_iik}DjOnwP0^A%av-3^xciY)p8u>Wc0=MdTKS8sx)EM&1i36`>u zML$jZt;!Es^tWhl>SWR12g|%c7X7zi&*RF^hhV?i=l@9iczhv{#U2;)X`W}4J+FU~ zb|;HXB3Rm;Ecz(go9#;$-9vj*CyRa+SlXQ|dKx&TNacYn`XsQ_6iZ)DMVty!w6 zlSQus`@f^?TfveRS#0hHOIl>nAEN!=s&&btx6|I#$)axn%N$M?o!6~-dzBxu=-a`* zXO+GSEO{e~O&?hDMi!md8>MVl>ykz1JLXeO-TA)x??d-Lr|ge`J=}mGyao1|{5Dv| zCRu!*2g}$bi~eh{f2Z;j=Rz6HbJ}FFNe26NDVr<6Qbw}aj0H;>$)aCH`#EY|vgj$a zH+8b;lfY6&J}2G(m|C|C?ESONV!sf&@9&h(YcVBnWU*Ncmb{TgUrPJu)w*QSYiMuk zWYHVIk~dygC~1+!rWq`0kwsrk`xjJNWYHg_y{VH$-vE}mi!Az6;FLb)hb;OwaH^@3 zMSmGAe#oL90Q+84e*R3Gk8Kv4_;}d7r1V6vl$R_vycSE!OBS8iQl)%XtxFc2*I%ca zI$88|u*^SX(X+skE?M+!u%t^CJ(u>}nL;3oK9%;SP8PiwEa{R(FQ?9(Pz18*OR0}j z+X%AgYrv9EvgqAl$tPL#b+rEn<)1A2W3)GQvgqFdOFNQ9?*pgoQGUpxzYI<_b+YK+ z2a6xF=*Pe*dzBxu=x>5kO`RTn>tzaI@A+Re*U6I9x#g@7v zi~c(8`GvrLq8|dMnmSqZlVIuRWYOOOr~E(oLLiI&HaOMP$)f)nEOky6{TAw<;0u8) z`Yf=opDM0($4AOY7Mn7#l#wj@eA+L@7Xn%IgSWO$0{j07UkF|Jcn%wAoD21t{1hZU<7JV1ke*|9$yYZ2FAd3yBC#eUr z=&#ZKD83NLqJJNpYU*Us-vmorlSMxdPWd6e5YFQx`g`D1Qzwhg;Vo@V7CjDAmA4lH z0$KEAuiSlXH_esaM6vgkav z^_)=l#<6XY&0@0~Hd1e7(O&_l{6yK4MSqRtDnC5FlkJ-GSTCP8KT|f-!6`*Hi=Ua$rMzU(3u(_mfIt?#nD(Yl z7M<_bk@Av7UkvthB1GVQ7T&+uEH)2A_nlVy8nEP(EH>R>$tPL#b+kXD)+LMn80}4+ zEc#Pm{~OAl$8?f69+yeGIFHd@qs>p1{YlzSWPB1WW!efh8@n*!&SJX^}<$GwuIb<&!MBhU0=%Qzwhg<2#w($fBo! zQ{Ga3$f92hPBnG1=s95VLl&LyUh@51`T1WRXPr~)4m!><^)GUqwFP-d`GxXBmb`5R zr9p#5C`iJ0DQzwhA#lw%L<{z@?$zYl1$HJZOyz+S!{`oH`&cr|Om(;psSvMQ( zdso@y;GdjNBa2NwSk9-BMW0UlOZY+{i#`)9=hMid&jQQ&G_vU2&+-2oz7Q_yf6#xg zYmMQ?P}2j>*GUh4s1Y8mbNMG{4Saf6?316kT;FKCw3`p<$!-oeRA;y1A!OP1+0{pDJDsw4Z)=*;R*lTHa;tB`Lf0zhFYk@2#!F`;?pT+_y@j zA=QMEJ-9SOK3gywPa_Ox&z`@?j~)}c*P3peL#nZ5nU>8bZdF#-);71)FB{UTrmfD> zoA9hkJ|VF3!Ep1c`Uk^CL-F~Om1a2&p|Lt-Ejud5QUBEqp-Oo|B}|*cRtjc2vJETi znpZVewm#5g$JXJ=eU_=2hf3DafCwg}{1{JXRDSAfwMn(sx}oZZhE*ZQqXW@#TJV(4 zY&;CGwYmoXA80iG+Z%$x6%Qw&%Rjx-EDgpm#=5*@Ie&&wo<+G91uU{4f4a4TMY$FQ zEV96UwY~j5d&f)ct+&)$V82`5exbbME%MfD;w{LxUcYX?#@+Gmb}JTOzC=5FUJIW8 z8Csr=YHbJ)(T!!K3^^#X?U%FLZ)CS$!|r(Zy7h8(8|=52TjY4-xupTVXkG_w*|H0) zcZS>VA-7*X?s((4WoJQw^=@waec$#=zMXIOmM(x5?AMa3cX+eYX4`MvwqLVtzgye! zLhb+ItFs#t2EI3YHBJ;&B&q!~ew%xs8c)ZPVQvKO8#)6HUySe$_D^H&wu=*3h~3X& zhd-^*SPT1gAd(t0H&07BM z2Rr@E#Ckk8CPDnQKydoo1b+?C=x>A>$Ncg4bEiN4{%9WVAlA;`4`Jl=_hSi4MJsab%9hLC`6EK71Z(EGNyKaF2Z0T<#KH~2-tiaW!-5O9C7qKis{LKJ3^LN*+ zcxDe)q`%Slh`;A!{4IgwUx_pP7k|&i_-nY$_IIVjUsH^~VpQ(LAbY>S{(b;Er@yy~aXlpxWB$J6@W*3Yr@!B#@i|5$NdEpF zc20jYXQTcg(BIYgFpmAN4dC>57>)n&5dNBA$8`$vVc0Mi?}>*%f2sH|j{ewpoc<1= z@p(Q|g5(d)G{E1Je~oK!&GKGj#?fD5O#PkqsOQGS`rC;NIMcldJ3cQ%f~4CEJLa{} zjF_@e)6$S>mLm-xDMtv-oc_9Sz|C{O62u>`Npkv|Q>n%;{iWk0{%!#{{dJ>J`8%!z z@mBzia-kWKUyb_&QCaji2_MF>Ud8~N{+>W1)IgUY{+I^WDKsN?*QY9sXll3?7UJa;~wYX%{BqcNrOc&=|)LFGJ#g@%OhG_85h1#PRz7D>P!%m)QL`7HP+G91N2t4Sc=}zP69S|LiEP=5{SwvSQq|A}Rm16^0UIX73m zxI0Y+=YnGOEpPLlIwODTbi?%X-|PK-Tzkd*sBQWbtr$y1V-k+0AI?04cL^5#vaPWs z+U33&(vE1p!ce>0dgFj=O0m|rcF>zAYNOpxzSR@7-+{BFuq_y>`bhI`zQKCqQugM= zqPU1{!?!UFe&>=q98FmCbG_GL=W%O44h~R;UGs>s=AOdz;wOrW^e>^|mZ9}*U-|{7 zAN|6dB~$KTKF)kW|B-WCKh}S2eMGy9FGL)*A#eQ}yyh2EzJ<2>_jdFVyt_#6jSR@^ zP;X#j9e(t$%z^W*YK~eMq6||CU5j?c>HWWh_ut?XTPFJ4{EoAYzw0O=-@_)gvIaT* zzZ2x`8GQ3O-e7cNPf~xeP%&i z-08Tpac_m1!g^w1XK=GtVZEa!>dwgtdG=|p<5_WDcNX3~^^3oRF76!kMw(YKPe#{{ z(D;s@!mkc)M`t|WyC*p_`sm51JIytC9s1gIM~p4rjZ+mr;EhL^*<#;uTlGzQt;`|b z_L@0w%e;i!Km1x4bsJrOOI%*hT-_B+(mI29>Z_Y?-n(Pt?Hi+QkKjALC?Pjs{ z#-YBhP$6Cn84R`W&^pc!)mBY>b6HGDoOPz*4QZE)ZyF+=^_NyLa5TQVXdx7-eU&dS z+j!HCL2YWhIqA-xV%r|?tuLIngztp$;w_P$V;LPgwUhmhc+3!99n$JpT>bhtVSjwKCrHIXN=A18J?zVwXnmtE-)-kd_4~nXN;}V;dheVi8JR)-Rcw}>@B3md&cjP)_d9Ftw+78w zQsjOI@A#EgorbZ{IkYB8;kudT7>7H{%s9VNzFA3I9)*{7^GGPx#?*7g2*OC}b% zrUbQZM`CN3y`k_Py96%u`Uu{Ain-y)C~PBQ?OBrD4*Pn(NwGKTz8I(Xx`P>0b|kak zB_11Uy{d=obojQmj)TR8_AHv!QyP4u)GBSvs8Mt38*@0TI^THQQJj&Uuj{==&8J1( z?Z}67yMlIKUyAYk4c&F*My>P63@th?qWyS7Ucxsps<&v{-Fg2xxc4$O?Q7|gch+Xw zHSGS&BUvY&OLymlaEu&xIPPfNp%YI|JMxF?UUmQRy3FIz4aM3w$7db;%lPa!vHc4! zihH+2?>|)1jJGX?bG&WtxDfU|@*)ovZ47d*T^I~iwINqGAy$(Nw8*KXMQ$)JVNnrtF?=2l zuF!jDV*hGSFulb2F8g1$;hnG3`F31v7cu^F7d>vwm>F?Dh>J~`eRWf#-kZCqBj_n~ zl^oTR@J8jFLT|#ykGL``a$Zd+)S}%9uC~WQp0ip~FeC1}L;BEG>b>6_?=2XwHEz`V zG1CrX*R;}}V_m`9rOKhmL7lHeAets^MZbRS%z1d+l&} z-gNKae#N{MhPVcglI-Jwtif-u#xd)-Z9PG$88!b8-g-v6Yqt(MmNT|m&VAp(If-^( z+WNTT2+3}Pp~er7t|mV-_=v5;%3n{g3CHUWFBjOyv$vFM9P?5N{X%ZZ*ivpy?YGJ6 z7q(-$%-UiMoBns4TVeaX+C1)=QWyz77q>6&KO80E{(z%~2ki;6Op$N(1nna*zEiey za#H-bMROK;yCN&N$F}`4qq*wgf$x)z9jTmMc0bI0LFap)RZZEc>Q+saMfBMNYO0vI z+iuqkYRdV(T>XN>%MkAkHjas(c9w8ptzB@GowfDAeFmW(Exd#)##RO*a-Hnyi2XAROzLRFdip3?bS zygfH+;}W^&DRsf4&{@GecR^9s(_Z&~d=_04(K6bOSQk>dBgaeX!qgm8-v%QS5|b}+oIf(XR*#@dgTRh`zcxrjI&neegWMHazp9)8`Z%c~90xmxMMQ z(MA<^9@(jN^rQFd`?P(*1&ORVsW*-!9wFc@v55^ojm;}P7kt<0dEmbD=-|fB*>~PJ z?7s7?l2fIlgK=;2D0lvrjCLIN_RP@o2eoQVFdDg9E8D!+y|3_3R*B)Wd2HVtQ{y-7*htN0)7Nz$gF=X#TqtsdNSyLV$jdt{!k zu%q8~^dl|g*`n{hU4IvTcLfvmL!FBf(9%f>q4u2`IVqvzg6qsAttXym4MT1` zkoyq$zrg%o#p5pSf4kf78y`CVU9Dz)=M5u`efWc@!=>H!TeDr0M`BGa(ds=Hs9ay- zc!zaAYrlOC*R$Wy>$+(@@;VZ!u*|Zy>#ca4iKV@U(Z3XL-j$e6c%@}Da%7ZfdcUub zTE@%aJ4I6-VrLtA%qeruCm5HLkK8%2Nah?`RK-}}{mHP=FC-Q&zgzE5EYkb!QNr0} zV9%c%-1#{@f9J40UwW$KhI?x#ksB#hY`ihPUv`c{`?%9tO3d5~YRXTQ&$@fh-RX;Y zPVU3GHSV=>=bVECb-jhjP1||9b0ft&)@Id z%Q0v30ox_c&jmQYa7`)pcFeIRt$=O9Ue>WaC)hDNVq*NI&fd`1W7p8ob)wE6%zyN_ zRVO@yFlj)o#MVh{OE^m3Klt|x_L1?J<87*uuG5B^sz7h7Uuw(NKIRy$9u z|F*bJ^r`VZd-Hp>`Bu-$>iJE)eO4ycCwr58Rw+E3#r(*+5zP4; zPZ#vuzAoaMY?z-Qt_VFyl4E=n)l3FJ$h!X<~=(?&(L1bp3|_urej}R z|C2Tidph2c*wZo3D;p#3BtMJwETMjY0S`?;3kdP958^@7&< zcV#1F{b<6ZpAKBx>(=5j;$P5IkF-ZZ&0XF_k801wzYv$W()^Qtqym1`GqmP90(;I_hW;5PC`q%?|`{;@Lt6ZlOFOqQ^`}rLhU!CK3 z#{Fe{#`t}4AHiB?1Rl5Hbi)5}a2|#5*l+Q%rAKQHXZ3_G9??1vyESjucujvS)U;(# ze|gpMi(YSF@I2s*uL{^(Q`CHt+xSJV%u!eK9edwAVwyE~&)oER+z;}58$_@P}PfCQv9FB zg{oTh*nZD*Gv{+-@@M?Mbonx!9HPwhRh3s3IbrSf4nDdzYj}O0dw-$3C!=?SreCt60+t-szgZIl+reeljB@tW)CI4$vZ{I>8Oj{1r^`p39Kn<6+Ku*>Yq9I5xM zUmSTSvd8Lqp?2(-UkITuhw#*S93|k|KG%_Fw7hUc4{4M2p7_xD@*!)&ldw2)3fp7* zSjgELa^*rs?*sbK7MDM6%I$i&t8ZOi(*8l)AnpxZ%y<4CgCmH7P}P$-lNqXd0l%M4 z(r^R-WrtNS-fu;;yoMiYNgF~{U3%xP{^+ycjL$y&>ge`RUr%1-rNU5E7{8O?JkSyQ7v8)^98--Ot@pRvGfv-H?%8Wo zD=_btIc5RZ&g6K#zoE3_Lg&t8t#jv*MC_fM#qsB%9{1kW8@1}kLU^VYl^(Z_-xP3W zUE6!++ghZjqu=(6!7R2^@dwklz=3~D+UX9I)NV?UV(m&@Ix%1&OsJnKKj_*8* zHaU`lqlEiQ^?ySun(Kz6iTXdeDlqyEMbVFXl9NX4{otRq=#~vy-f#As?Y_6oujj4K z#F*Ky(Kcy>)pm=v4bgU^(RN2d`UPHPv{{?xZqLYDv{`fG%z12UHqBf)=$ACRO}z@ z=C_|)li~XZ=Cm1?kKZ(7rIlA>%WBN;D;?Xm|LJk8aW?|B7e% zhn|i5*2&gxbTD*&hgQ#{Q;epIan6x}U#HV9pGMV)7<;1@DhAZT;8~N~xG%Pq#Y6LY z^|>7fBZKBO*;jD|dG@JI*DrYQO;x||Cvv8mzZQGb_s%txUPH0Z|NLc~JHF$5M=|G- z=UidTBl1fNe~H)c%g7#cZHBMo+KjBnug#cp{dF0cf$K6R6aHJS>vwpZ<{iILE84i%{g2p|@6__Tci`+x2bLalF$HGw6WIgwI_EFc)QSs%ac?nw!>modo0XIlStu1Ou&b)sclH|p1Q z-q?SwE34z$&a9$qT{r31cHY!~jSH>R=_|U%<=3z2^!HE1a}?6nw5P`}3}!u@7v7;q z-KE+$?`EB(kID-_r0T)LkW$wa$|9nhURk<=LI|ghL56IP&}XV{be*GqEnR!f_t*n>e$#v|I1xymxVO z-Jn@ja*F=V>rrr?l(T6^NyheMZF~^h)40ha(9dVPf_hTt&Np3aDl#_gOc>w8c>Ee$ zwGUhKQP_GM(I3aQ8XWIB+7>qkzr7k~s&_8RNiX@`MxK=)6U3D(nCsEYkn1D5$=IK7 zi{o~l#{#a&i*jC_9Eaatd4?9hzHaZ+>LMp1vr3+@egkstT!&H2l5f_qSHt6~xYEBt ze{^h<)fORH%j{X&jZ*O{8|3{!u(L!@a+QopYWR7^s51%AjXIJL!u7sh_s$Vf_w`9q z7k2w)_NXfla;6Mlb4$CwdH2e1M@Khmxlcw%j?+RHZ`UK(gItfj>^*a{H-t9bu7@_Q z$Cg%&u6adukyFNblA*^|m2dEP;r`#jo9up$->4UbG#>GeiqDuh`Oet!XY4Qf9QJbu z`*e=cs!5lR-}E{0CqE}1JJo}>pv+^hBahg-8tI;nYtXFGV<>4jZ;x3wYrU;c!*yNW z_;~Axnw|=?>KyHlK4DzLWgKxBG4^aFXIFDvbrEN3w&%bLB9A~`UwOBl7(k+)DgW^SCRSZ-Xy><;d-W-m40o^WgtX?H)* zXka$m)gAXOoX1#;JqWjZN~rx+O3LxU&K_AFjdBhCEg$RWT!p+j z+UmR`*LE)KqtDOH1M4fO|I?JxcX0H~8q32u*MxXnTVnlsB}Z)BvxxP#8F||MrKLDR zwOg_iK3zK_$w|dJ=C>osyfV|-M)<`57M+vb$*#;`vRxmz&T{B7Pgok+?%Z|`(KdKt zhNEp9fUZYcQKCX=R7?kwx!uOH(f<<_8zX(IOBF3arSvS9uM7jU&249pUM1L z*-z*HWZ{o1esoLM{&jnLvU~8h>9~#VtaTyJtGG4|E$7xgy>EQ_<{x0sWS{o!a5Pfz z<-KQi8hif9ZoZou*YDsc1-~rOHtu%!^&5F*O^Q2G9NP4P7Hzw9WM%iG|qK{yNS zPPIK6`{3AHEtwPhJ2^*=HgP6AR#?Y(Qd^AkOk|AnmmZdD^#9A+*}z9t-ueDal8Jy~ zM+d1UYDeA#oQZkiMX0)gCWweErGSD+NG1~!3?U`~!Mc{WAW(2A0jp?Tia;r{t{0VB zYh7TGwJhbbTuZI%y69ThWnGt2>$+Z7@9%e>=Xd7GNzmPU@AJt_zUO!T&;R*9ujgeZ zC((3lyEg`(EB#knB<8lr2((E4VDCt_1r7|xtn>18Ji_rN3^Dpt9iN08# zKJ_y0k3N~R0_yR~j`P2s6FGPwnw>i&|;r-s1zt>GE%_}1vYrl?m zn}w44FFPM+)z5jG&!37<8#7_&EG?*{Z^d})}6A|ca7QGi%##RrW~9{txcZu6ot(pYlNV4z2$eBwbckb7zvd&38k3PRQ0u^*C4i z?AXLB_T7)-ob#gmWBrZ}I>NsT8L`H{H-`Ix`CX1f?5WD7oqGyLM2zlD7;Br#FRMtO zYRCL|ItTrQWA777x8u7M_`U2|j0oKM+u1Y1zuJhmR|M_7;zwwie4In%qddFjvYgB^ zx19coHNIcfX?J_165jIoox>G_`WF9c{S%3O#b?WFDo#}Jvy3QKEw@(tR`Qz?E5=pk zt$E(EgSos%a-h4?H?MWSn-;0;?3s5lac<++e4p3*!AEXR&lwSkLVXM|xPI0dCvMUto zVf(CORokjHzE$>X^3DTY{FtryQ6?{g-1lEnn;998S+! z<>6jcx(urcuUX>XU5o!^%wx_>e72-kIM;YyxS}29yYsyiOTYwg=%f6s2iNW8&*Wnc z|GFK0a~gf~g4ch=5$}l=h#>JBjIQEbm9VU0#lT*9ysFCGc}ej%*FUj!N3r{@9CKdd z-!F+i`)>y_W20l1{p%$>GV_ze&hyFthR(p~ZEV}f0l&SwoU8D7m$)|Ds&;Ihdc-SR z^+-9cYH^I=H`h73+*x(V!)M;p+HYh1`Y%6(R@@F{#cl1k^-uh?%k1Sj$Z@9>dQ^=$ zpSq5$OQsEtb{_d->|a6d4!%<{bY=H5XvahCm4lpPRQ50VmM^__T5G1I_1a8py1u%) z@!Hmw^tE#v+Ugh9@cB=Wn^X4TBQB>}m$Y6hy|JODrMhLwwb^H^z~iD!3m$3WKbHRskLE2Q>)i{S3`56xw@q_lSpS;+8XK_(g-7g_!{b# zbaBy?xd#tqYGu}{wubawnYM)2(6p$!v7y$)pBPx{{r_#U`FNI5QN0&Dq$g;n+Qi_2 ztwR#28&Rf@-VHaZCVo>TOjAvr_^m`qQE38C-AS}AZ03W+GPOls(}Jc{Nl{ti8@}y$ zwrZj=Q`eTjLv#{&mQJQ6VOzeTX|8wu4c)m$Y^~Uv@Sn+)sI6|R2BHU@cJrIIbKgyC z3c_GJvoRA3>Jo^vD0m1?cCa+GRt4r&*1VNH$mf~0azr#VakCXQ%GNKiOay)1C8+M* zdR^rNo(@xw=Te~=%RDm-P1`0DEqKDug82#aw5pow+Jw71F&{&vdTu6^#}1$b9{b~3 zCliegt!-=x^JpGa1|u77nQ6?V(PdWlRZNrOVT%(fwlzy_%*?G$FG=t@HE0ySMdxP_ zbLSGWZPDt%uBx@Zx&^ZV&lgHGwEE+tu^JHsEmq{!Em+u8oA{PLUnf=1&t&&?>M7I7 zW*#@ejQwHr2CbQx+p=I`v*RG!#WuUfW|eR0_px=t2>oE4?2{HG7Pj(vJ$4U=E$yo3 zwq!DVFkMlX4##d&XV-Ug>s@}n%wnu?O>;Ae`3q_@txiGVIO#>kRlc!P-B7azO=&Aq z-PqjZxOSi0WEz16jypW~stJ!;Ltj-l&Ru|&u7187TG#x@KvUnv-~@8x0amq%A)R^) zPt>ZaZ>_4YZQ&E#()F42U9Ah}dkdQ}fiv0daJ@TM%`buNt)}qXZFB<7S(Rz7M-Q}A zH+tO|eBn;y_S^-@PM`!A8g$Bh%(m*b1uZO9D|nIjEq{U}CV%Ueb4?M9mFzgwlH-r< zB5zV=?t-=k)Vx-U(dfh-oLzT%$Tq(k&xPtd_mX}c-G_KJ)ZQ>~v61};j-dl?7}&Vj zSxL-@&PMH_%mimjt(g|)u!lm2c<3E>kAFPm4y>$g3lc4vbf#euvT>~_@+!YkG5*?d z<0{5y-QZB*`>+<@dE@-K&Q`po^7h27 ze_T|&A*`1xogHt!NXsG2HYB3iZ+Lo|2xpw(emZfwV8{WW@Y&oE>JcFAD*STD>WyvUo} zVpow`KPtZhUJ$rD%kZc_&K-`^ss8alzh6VnI#a!d9M0)Y{X8DjWvT z$qRXmHu1~7sev`K4!9iS(RmH1vZL?-UcIobp6!WqC%^bAf7!6H@DQp&tQ8%HtRf!0 zzo<~QhH1`(o*Tzwa$R*pBhM62S?wO|A7b#3MXV{K6P@=2Lz8>zs(3b4m9FWu^6-4G zs?2}rD9$G{wF?_@5NboyRQb=kWaId!bLQxZ!H&~8yqnWGRN~w_r!L@_Zd#HUKV?d* zHw7mKZHer|N)tRdU{9xDc=pidJkhiYMpgAKEjZxv^t9U}ymRR8Y?ZEGfOC=1`qP@g z5{$Kh3vhNdH7BelyFG6W7N_8}#a~{}k*D*-GnP)s*_p_5hip|kZ6s}51}7JGRm`qg z8c4xv_${6(W73*KXtord^095*RmEA_(Dpco@L-WpVdenOH4lpwmOMAgWC9Cdr-dn7 zQpnJZhHjnuE1)}X&2w=5=a=#zhvP_<>4(LOYwP_1spD9v5F1VBHt!Tt6Hcq`DO!~# zwWhj4bb28e#%`@KUs`aM-8Eu8c`!KrHv<+!b-rgFTFAD-fgvz3!=48IsK;q*jlZz- z>^wWcf@`5{Ra&`Bn1H+8+pQSPSoh+|nX&%mm2r9wi*xV9a_#1+UWE0?e?VipO>n?< z+r>=CZ~2eB>^yWZyIcKH)6irF4VKV4ToGd(y9Jlk=|zbfoPmak+wH~k7Yt+nVAu=wz=P{Y{i-kf4E$3#C4kvSBcW%B0PFD zF}S|1t+{pdwV}IJCd;*avTzEwH|F8Wx(N5P61|f0 ziwpqf#iA{X%1Rqbn@g(Zmo^tyrTKR6{P_zTOPc+l7+5wfzc9;r-tRttH@gYS^?rxS zm*+^#^*+OAgG_hg74dHHhGRb&kFWE$X@7kL8-B|5ZgU$C-~HhJdhLe)a@_A_dJ6Z6 zb8sJ=`}s^wlXAUB@vulfQ}ka$IoD8C}tZ18`v zEG@$C9Pbi;|7vIdQ9f`IX(wJec(NtyyT#eh?cJg6r=0Dd;4^ck0@O3dyTU6& zpr2veZSS`od)(&s(-yqvV3g7S2hRTgu<`I&syW_Q{rv!&O#5EoZ2uDFox$a7M%_rZoyzKLG&34T3 z_dMF;TgcCKi}~M&|MRfz#+#kbHa;gm{pZ8pB(r}|XnR6vd#$s*67BgUwi9rm`0sP} zUy1k@VEcM!Kc6XVQcwT+z+^LjuQK(ubCmVJ1O3DQA>*zePdoV;KmQktNhbc?q5XNG z{YOLlkJ~ZL@)GcO5bg6-I8=RxI{EKK`|{iS_zCv&e{`B;%Ezz^wojq{V_=+wLVte^ z{};jDU2pk+O-$&wRNlr=d54_szd`@=|2^^< z$!edo9DIHu9mH3F{j~qg#%er~_-Z2vjx^Vi6)`f&g2&VFv+7a9-mJKJ&OKaKpTreFTOfY;C- zgPeG_JNDPw_C0|-Io>sXeHMq}-R*4u1N>cq{=drcH$Bv!XB_{Gx7gV~8ToHSe)o8B z$l1RS{dWiUyX)6>Xa8#Wdjk9W+43)keG9fr>~;yZ`D|YG|6AyfA7ESae;oE-hW=Fi zA7TGYY!9^gKSX>vuvdRCLH~b(ZS}`sv@id^tH#f}$d^s$d*fg~AMv{NYYYs|_pX5d zA7MWa^BN!7=VjyDfQauo?AQ9q_S^5|{|jV1hW(0{`!BV9$S1=evbJaZ`BLKd=LBc} z9+Z#Ay9Dudj=#6}AohP9=QQr|w<##Ux0gYDbFm*y9>o8Fvwsfa`91ur{Tbi;&VH>G zzUY^#4+-hDxNUoqo3v|SpM zXZ9zZ?VHfQz0k()dR6D_r~i6q`z_eN@08y;-iy3H$9VV}{JG;{Y!Ht*f1eZDel@f` zE41Adlz$QaS0T<#;9v8B@vRNnXXCxdJB{|8?ZneL-nidhr9pnP&Hs5|lG!eDws~>N zF{$>iLx21d+gt)TzDvmA>k^2=Wu+Fl*nek`=TA+)_S zw5>TI|Hnf6kB7D|2-?@glfB+C+X-j?!)X7TP`^Kd5C3?D`Lhb!Zhs$j>{;LJ^`r4O z$!SmSU*&8sfWIf;Z-n*F{ro?WCdIwU*!OL;r;e8|V*h4myL11V>#160$0+Z--(0`o zap5+Z?Hjd;Rryya?>Bf=K-2oQ)Y;GYUUIg-4qL8yTF*O|XRhBi1@>lpqO<)Y_#1}& zn(v+S7kdAK@irIx@#DwSdH)suc-kBIGuuZ(+iyGDE6|_4@Jc{a{rG<-A&Ke)b3dC#XqRc!OYn7wj=a0)KhV{##+6O<(id?@Y*FzGF}SABOgS z657T>ZugCT?*mjSHZ#el`KK~!6NmqE=(4I$Oul0!g z$Kw1)`?)>A+3o@R)3C=99<&FqFJ#|@egBSE%I@d?qZoiZaO2xoV*5I5^Awij;f zA7T4)yUp^l*Hfnc`8c02>59Qls54vqcSIlh73XXyLu(YcDB?f-C4e{;RG!P%~b z{cW(Tj;M4hQ+o_Pe3&?D5F#U#xKK^;&%}Kh6Htq3vw@nEfw=@;@Ca@6FKuGokI~ zkbU-eZu~C|?H}N5e;w`fc&NX3Ir07w^ZTcv{R5o+Y|rd^dbNKp^eXJNK6f5p=K8Tb zh~I2K6xzN&v^_ht-4fc~AKK1d9}MvhVm|&S;?eoZ{fPH8wjulDpYdng*TnNl$X~X- z%>L|n9TFNp*LZ{BxB%C$?)u#$Xm4}9IXJXEKD1pQ+RomeHTkpgneCk+`&FUs?0hx$ z+55+4`|*%{B2Nuq_V){I_YL~r?B5gGe>AlHerWrG;CNv2^ZzWFbdC4#_F9_v0CO;F z*+1F)gT_94etwPjAl9=ow71T;X#ZX)zN4Y?viBE_KmK1UmCyWhLfh|zwx>G&?(Ai9 zK7=;R@vimbo#*VQzk|;9hgdHsAl`n+rt_@7UsGNi;`s#ob$!EghsoH`{Q$=M zQZRl@e`U|7&Gt$7Hpy(aIQIKc{xbNx6b5RKwa)&@C~pDwqnm^M{6AVIS%1#q7 zex*}(Smjo${~bdVp=3 zv3@I2ks@sOv)i59+l-&Va%aa=O=x?nv;7Y|u|+c1n>YI7Z=;d$Zv1TsZSM?izvpbv zL!j?C@ju1(!Wh@_y$`mpaJE_h(LsBd^4db%b)oHz&UWYeoBKBp1^r>RTY~t^_PwF) zg1}#iw;l0ai2HZEg~#^ph3(6*ajo56Z*4gyb8wZ#_+NAKH=}>X!+w~x=l)lm{oKAV z6yImgetlMPF|-_9_0T?h{ZQilht111KF1sB@6UcdV(Qn&@qazW|4ziC`LPY-^CfI+ zeCk;6x?i7BzQ5B>{*%amAMCrI-(_AL{{9C02fFnIn^fj4!FWD{{p$bD{blMmLFTr; zGo9@n7@xgxb2tG_^E-RJYw~Bu-*9gz+G{-Qbv^MewufT-N}IoP`6Imz=-*oGA7b}^ zg#KHP?INeV?B{8wy{82IW!oRNCYkLs+C=}%g1?`^-$-bTzjOJfyy2|CrimCM z7h~c2^WfNFjtLK7ZYyDEc(>X0g&McZ2sUy1rx+Vb+^!9dRmT2Q$lr&yeCDD3_k*?5 zY`-4L|4C?n4`#H9`TK;*54slnxPOR~f!p(fxncJ6Nn}dg&;RqO#O>ap{Cz|1mHlkS z_}db)kLJsp**`S2{b!-}xhItWFGKtLVr^Dpe19B@w>`AY|EH-$`)4pVmAL(CX!{>S z_3Ixhzjw%fj-25){SD#5WD~ca57lQ>DE`kv{z^jq&(AuP=yLgn8P zivRV{{QG&x|9v6*_d@-L<;aWK7-p$LxGq3|76! zvf;fb)r%~BDY(G)6#K?HPd#y_&Es^ zS@wItihnOy@snk<53Kmf(qEwc#dt#^OMeMmXmzsmSHOz@RdAdG2Z=13H^K4Vre0*} z?}C%IUhjcZees6$K3;Kq@YhhW)%0*+mZHzphm)F!+pi5D1|th~HeqBh|mSr<$WHUv~%!9u-b|&oBd$56Q8%Mb(k4yu3zG z9m&!!r9Br^B(n6&X>WD1^r2vl2eNd2$1PrB{E($niP*l&BirKxe?@px0Ex?1geUMw zF}xyn9p(}ciBq-LGgkM{^?5;#l)y{&98!_1@P@>pAU#R$Pt|_zWc>`oc7!{Tc#M$! z_2i*cJ+B-u=@kx-Co@>2iFieL!vtwEUb3G`=8YAk+wqb<%i%d>d(5wO^m_6@ydgE> zrM%7LtEqZk8(xtjAN~8MI-YX*Q~UP=OD9Wb^$OSkNMz}BS7>#z^ipsEKa@ivOCJF) zv^rV(1hB>lSvq6T_;lmp5YhM~%ifQZ7gI=G;*Xm540^nmfK%moLwXl4#Y~pXX|Q4@OaFlOWAKJVmVOpoXmzsm&%la-EWJ+z z`o%d=aIFZIemPk2kfkTUiia$H0PV;6ZalK|!L+wJS^6-r;vq}F7o6mmCyHI8Bu?+$%HnMDZ zTvlxEF}jHMx0p63%f6KMRwqj@2kU%>EPXsUW!KEfw7J#zB+G{1sfbN7dJWl*t2(e^ zCd+;vSTU2OH_`r&jUTe~7TQ~#EPW|h^N1{+pQ)yJa7Nln8++4~EE|4~nf#`);rD4{ zwvNw|zh!j(9Y>4@cBEIx(+u-IuIfdW&*Na#i!A+B+D|um$q3v6;qZJXrCNWit`1c*xQx)BX;Vmn?lM?X6ChUIW&6CQEMwYdp7r z6$4o|i@=J3Ed5^E&oVKPrQc6`tCOW~0LMAek;u}wQU9vZ$mq7{b;q%>tMw|md%@B#Xy$+HtnlS3}or=(%$N1 z>1V(xo=_uw3|3iW*?bCCS!C&69_;7%S@9)pQgRl$za!!JptA=7g_oM+S_X@vh=~Uw>nw+^b z&+jJ0cmayE)Zw*Y^#xgZ9|Wr}$kI2`e!lTTmi`d!txlG{6Rf#Imi|0A)@1y=4Nmfc z80if4yAAX25n?Td`9=I#tKkBNuLs9@!vl#d{}r^EV(cfAd6A7YoxITSO!6YbbIA7? zZUn1M$nx0?R-2Hex6yvF$xD{LnD$mDOTQ1S{v}IaOMQv)Lzcb~9J|-(4}nwPHvAa% z`wVX<|B2x}WLuY~9s6gg-*0SQaBL2PRbR5oJpxvJ$4De#p{?fnzI;UJh2HNN7!A6spEd4m`txlHyCRo>TWa;mMb3wK#b+Ys;!Kn^o&%a?-S!CG^0IMvr z^ue_MzR63Lo}|6i$kz98rs_!$kOX*Z*{Wtd9=4Nkfk@#-s)uOi@}O* zH8}aOiE|xTagt@f0jxO5(l^oGjsddthiPwhvh;0Wjg6QR^#?NA~Vj#=rKCogSOJ7R+?Itf-`byecoh*F=STT^LKL(E37@nui z*X)|?*z5;iWbb(%0xM3k{Ja8IoMh=oX}`n7NtS+`_EslLe*>&I$SXCRf>qX7u*xFKW*k^$k)=5tLg>SXCV!K&9D zaO!cB_X7MSXB?!HR(_y@tB|oPsQU9ys+s@P^cgmtrH!rWvf*$kN+r zzZY*vWa*2+g;pm^UkO%hWa+#lh$qbYNtVvTcJdj#A@R_w*vPVB*D5x$^lh|%7H>#o z>0Gu7txlG{53F-qvh2xyr;zmd&fw`x%`q{S9#PIlLjA#w$+8NMzZZ19EoLOtS3ffYpW9t^uC9-tRsnpN$hSY?YVj#<= z1*{mz(ihR5gAs`={a$dP)ydM=fp!0uEd4R+cC3=6ZwDv;5^qR*@zPi&%ZAM@o5QrR zW0fqMV~)*9+Ssv5md%@v&D*ruk2fT;Y&b`f2dJ9wlc=pez_x78g4I@J=^ud$4&n`o zEd3L3q1DOKdvM&^?~r zLwG|XOD_c%TAeI?ELbsb7lD)Pa3qem z)GI!E_v2UW7lt?BSDasnKq4#e7I4zqKMPj-kY&T=M(snE&S_R~1aC-W>HEQjRwqk; z6|C`3mi{4idtZetJ&%2D$1_>_1>odg!w{(tZR~g^%ZA@ak`33%YL@|nuESrnLij6G2 zFYW&)-jK-B3&4d|Crcj;R%~SH*MVcl@rJ}PocvoK{WVr&Zwe&Y&!o)>W5cnUV#gxY zuPdKJEN+$LAE-C;t};M4HLGc7BoNvj!ZqHg(|CNn_sx zR%~S1w}2HJS^6T{zh?51rQb_?tCOX#2CF^E(g(mr>~-U(i2QekN0ZsWNac7bHnQ?o zfE62A`gm}`-{TF5EPW!l(CTFAlfeaV;th!`eJZ%n>SXD+gA4uvZ%Ab6v%rN`Crh6L zE;xlZq&av=uLT#L!W$A_9eROjXhaLarBL*V4U89ztJ>?ow;^73y(3Vv_w$?`cGTxfN&^l@OtK$boUtnovZJ_W4tLzX_B_J1(tlBLh2 zz17Lm>%l6QEd74!_C5w#`cAOoAxqy4Ry<_sPtpD(6AxMXUfNroEd51r>O*56!>@P| z1SGO-3cyJ&5=i~<(pVzPrr6QR(ys$+ERm&O57t;BOD_j&ERm&GfHjuL(r*W=J;~B9 zq<*cb3t9T5;N&NGL%JNVc(Jh|%Vq#L`M>doGz>5G3t2XdIc5Fa2v#4FWiuA6J|asW zNBd9lhD4S=0bFQxvh;J+u@N@$5)(gJ_VGOXqY_oMh?#JSsJDc9};JET~9V;uSA5He}@; z1Wxk6i!>B3^%q$-MPT(8S$Zk$@gHQE$kIoE3$0F;UIEtq9J2H&)NMPHrO$D6vh;ee z+L%eL^vh;bhx9vlg-b8z=lcg^Q zD}J(c)-idWX@>;4M|Qj=dm1i=uC^sB?=Z01mMr}`+Vdn4i7cJ#WTDl`(*3rw=YDQm zErv~ecn;pp`L^sgVmo=h@xKYI*vPVZ7_8XH(jTKeZ+IY)rEdinTAeKYX>h8yvEK_; zS!CJl1FI~u^cQG8HRd>us>gBFpAou*xD!KTZ3KOj%^)a!CGlN}i8C%VsThD+aRk2f+oGn7m}^8^MKECrf`Eocb!> zkhbEN>Pwc*cCgAKOW#F%b{Y~{`W|qh)ydNLgLMy+Ed4cb>@vI|y@_811zDC2uWJge zPL_TaoZ<~jq>ml`%wb-$$cEP)1-MY?0eklvq#yJ`tCQs)k{2I|Hzcz38^OthDR(Sb z?M9XjuP@YYWa$%Vf0fBgmd@*rLaURd&j#ywO_shKta8cHSAkV7S^8Sq_cP^^r9Vh} ztCOYsf7jL*0#f+z+6wv`Kf4_JJ@jLBvi!URR=<;_AEVw6Z%Ab6C&5WhZlu@2nvd^* zRbR5~-vg_@Wa;nIevt7)mVSozRwqmU6s-A3md?L-i(PH}3<4*)z##GeyeJ;B?2EvP zhb+C6_Criwvh)$Ow>nvRIXKnV*z@n#)DHX`wAfIi-wsv`WaXU&Rt#k6b7+5!$xD`A zOM9!6rMH09CS>VL!HS1}U#1w`zct$lT``cAcQ@_17$cFT^Ka7%txlHCzbR7;?%$W4 zhOYINEc*|@T5rkH`L|v2h`lIvh=s9+xy;R>8HW5fu`J#$@ZV2_)<0v2@gIyK4I&RSJQS?4K~_5yfi*VB(o1R2LXgPPM}YOcRS^AB%ufiJ=S^9WzYPgAQ0$8z;Witt^*vQhS(B8&ImOh>KRwqlJNqZXuS^8|+ zTb(R@9$4d(EPW|;dvA>_eH%D=ovF+7;Mi!xhrxPA2U+&VY4des^D6mz!>@r;HyA!e z-7?RgW%B`fl(9JrR=bhq|0A&4jV%2W+TUpMlBIt}d#jVB_kyX~fh?Uy}NHyNMzlgArg4o+G7m5#o_;fKiIF!o!(YEQDt zeH^UzBun2$`nw+QLx&REPW7I<&vcj1*=@Lbgp9sx0rIt(o1P?b+Ytw zu#RhF=@Y@RiN?OAp zT-cB}_hXiKgOk-pe~QdbKzg2>HvE#qZ-ZkQqrdOy9G|ILqo1Koone2hTIN{QSR$*A z`7l*kyj>;k1CFutk^FIMc@QLxF|zzz2UcH`rE{#RugTKOX+IBdNMz|1;6kgDrB48> z@5s`5Zzq1enImNBY|7YOctdK!uas@id#TSg`u&c+oO*-N*E;+VSoI>y{}!<7MV9_J z?HloiM3%k{TxfN&bdFoq%N@fUpD|8Wr2Y7nwBza!I5pqshw)3Xk>&FUSh10%AEUjU zM`YmprN2<COX_15UBAk>15G#YUFRX|Q4=OaFlOHU_fvv$VH5 zS^7t`w=s~Ve?oh!lcnclh^U>((l4iO=RR3_1z7QurH=Hd8rd+*)7k5mU6^=~~`F_4wF5v&-<(wk{-+lnl`jrLY2OJ7WT+g4=h_tDpS^8w!^B{mkmOd4% zzo{Whp99tyCQDyL-Hu_h^vA%lMW!xW!Kw>cHrv6f3t9Ruua&hijyq+BVffzmVS)(i%nj#^b@qVI$8Qj+AlHoWa+Qd z-s)uOZ-ZmsHump=llK|^7@YbO!@clJ{X$mWzTo7&#-<;BX_V%PrOyHD{G2Sk9voY0{4_bt@e^BS^mPvN{5i&hBofDo_$l%V zqqD!nZ<1FU{T;CCNLCE*fmKJc^!I815Z;i;($9eP_qJr|JfG1$d9w6;6rWmUV(5Wi zih(Sf3&4tjES={<8vkVJJTKDtCriJS_D`a4B(n6&X>WD1^g-a%19(Fkj9-e4ESn@) zv5}?o8bPsV^jRz|>vTP=T6&qRlWZK&p$kM0M z-s)uOx6|InMwUK{_EslLuLCQ#daz<6%cc>m*vQhGX>Vg7OK+pS)ydKq)858FmVO`Y ztxlG{8mx7IES=|pTA$r>LY~jWzKb`c&&cZxUy9>b{06)sk>zI)IQF2iNs|B6Fh92v zPbY6MI?owm-!t4q-e`CWINp(E`QHvbxyk6ez$t6L7p!(B%YGkN?M#;b0_`6%e#p}K zc~ha)-Orv5LRY(yWq%wT`@Zq>D*0iL3CM~yu{ z_enlx_(q2(I6M;^vo?H|V7$if7LTkr7t`hk#*hCDKz1^c`wYN`Y4c}B=jSi#i-Y8? zMn4ADXCGwwe~tQ$s5BB;I-j|h+HCT^4^|(MWy5FgsgKCgKcxK+OCa$aij6G27eAY` z=N0_lii(Xan;2NJk)`u_hKkL7wjn?7Q*30}Uru`)8(DgS_EslL9|~4%{6B??jVzmD zuwo-iA4dCKX3UeNUq^eZlciUHHRj3Er+_u)`MgA}t7O^K(`Jn+tI4q;%VrT+@sp+B z3s(GO>G#wA$HpgF`f}P^oh*F=Sn-pkKMXF|ZTyg>KL#$eI$8Q2u+ELi()WW?YmJ{n zw6Vt*vTTmiW|grSVApr9U1Zq|2CKeg=}BpF!jeLT3}&y63l z^oig?tCOYA1gqW1(s|g9J!SkfI^0J4KQhNwvh443Y*x|6J~Ngqo5#V)zc4;`(f(<} zd%zkSWZ6FrR$Gy!^L}saf0(>4f(!O$SvLEj7h0Vx{U})VB};!5oO;IiISE!gWZC%F zyjWA1+-qK5yA?cZ@{(o$Hn`C0Wa($Xih(Ts6YAxrZOPJe;5zl3@t==hvLVZc*Uqth z#-;$j6hB!uSAx}^Wa<5A{}a3+k);m;7h0Vxy%enY$mkJ&!k}nfRsH z$g-IYR%~SHHMIXJ-jK-B>%fIpCrjsbO6mo?A+_LF!OyZRn?;ZctxlG{9IUxdmcEX< z?H982hp5|ifGquSu{?+Ggg zvTV+R6$4rNN3`FAHzcz3PrzD#$kKbEo3;LsrC$zC{@nQC*W+TAhths5-jK+$F9pk< zyET5uvY9}emyFLzVAYE(n<-$`i!7bjcN#xr=`(3>#}8RLuK_g%$kLm^DO;Bouwo#~ zW)WC1kfq;C`@b~tlcnEJd#jVB^FFZp*S#nF5Os|=$Nq7!#t&J3wt+Q%$kLw%%RgEA z3t-i8KUj4n%jOVRbtFrFh4%d51&J*EDDACImi`7<BM}LL(e`E5J<&($6LaV#S$Jd~%oyoF)7o4*7Jq=b2WZ8TGRt#k6XK8=b#6Xt* z5$&x`mYxq&jTy4^3&91yG=9j^F9sJ{oh*F-SboUTOTn>Yctg4lzf%9xa0T__hIuSY zTD~2uaYB}#S>QrDPRP=0!ScBnto4vA8{T40{w>~+cx$P@ct z5RgVY%<(CGw!?McKfeWopmhO*F`+2K7K3Bm;aX#$uPH_A;ctaw~&r{&!>qg&;Uy7M58=k``X0mji z#ufY>-jK-Bc`8t7b+U9$T^+m0(%I!HJ1^b^C;uLANN4aX_NL(v@hkohSytXpA*D_k z{WIFUm1WuVK=&lA{|mvfw~ftUueeG;ttlBE~Z{vDH-EPWX5txlHCr9oqfES={$ z1-~_Z$kKV9Q)qRv^m$2IQ53H|A1^`yA(00T(ayh2diAN^aQxzwDCihJ^);3 zb+YtQu#Smj>E+TX-{SfiN9 zvOhxIwk=uuyWo_K|2?o`Bg^J}uwo-iKSO&iR7hm$AA$?5PL`enQ^iJ>9s?@|j%UR{ zmJRz?F@*cN;3E@5xUUPX?)G&#{3r&p{7;}hItTBapN%#Z+Xeq_{F7yWJGjv5Wa;%_ z`6o+X1de@d{48~NEBQZ+&d=hLmU-F{zs1BumY>74`QOH#{iwEb`}7!ewG~-;PtcwR z5G1nnli)(DlcjTP==epJ&U5CJtqac+G_J_9nGKHd0v)LizhuvKFUbQJQUWiW_d(md1DT^$heZa|FqxS_XezI%|z>1$N{Yu~7~TGWzhtS)NH zEN&~xM)7}R-I{4Z=~eZa#>NFzH4AE&cmo!DzGLqT%CNbbTTt8j>XuBc-vWrH`%KN% zEv=cV|DJX0!sg}$Ep2c;w`IY?=GLlndN#LhEF6J+&wK?2jWa?1e*xcmT)7@p_>vor|dBfbQ>c+X}$k^)a{em8?Z)q{3 zm^J#cwhpR(t}@M_YO0?9rLN4tYss{=EU9YA+`TZO2ES!rW*wEBgm3DN_p1GN}Ds)aQhVosRsMS>3Y2AG%Cz)JLEgRiZl+j-qp!EWoldpDod?gU-uPb#rqgPeHg2`Rg7AaOVO$+h@l` z_tu;a3l_H3ELezT_}nH9OgCGgUg zuJ0xoW2Uu)r*i&r)|mfSOEJqqs0{azh5^y3Y*eCC3xxM$x-_)bJ53ZeFfCb^L8U@g zMU9P%=2u~?Vjg4*b%Uu{SQiA-+*sYlK~;5crey&}W%mu+nrX~nX-YRV*JFAu#7S@9 zfQ!;1Ol=&>Fr*y=r|sOeC_6+sM*Nk(lP^=TU;)aWg?ArWr^UiK5%0!lmot=ZZ2Tpp zd0`D^UDe{nwe|M=xsxSFr&G}?9;P}Om@3T8G-X=YD4ZdtY%1)2yk9@0^BpEtza6%%y{7mmU7p zO*fm1f~p3b?6oYI&#N$SP#Jn~ThO<`erL#JLsKp6F-9?VZ`^4(1f~PBMW?HAA(ieF ziRrFxPINJ!=Qea_Yey1>GAccr9GaMv{l#O_mcVkZ~ruDh|W|Mhy!h3ut6O zBLW&8P|2_Wvs6+Rh*>Hr4a6*!lmwzf#eo>WsInlkfJO#1BB0>`l?)3oOC@E2n5B}^ zK+IA}Ngz5@9EbsoDh(nFXk%u-27AUaf>6@z6KYjQ~u^$AmNE-9@lHdO3`zhIA| zWR~uLMg}w@py2_P3=1$zC1rt_rIOM>%u-27Ai6}cIDtE$|FyLFLXUsu5~Ra;Hu*=q zach&gqwRTo>^nK%>ci}B{W5oCJ&*r~J8Wlf4g03D`z7r1pp;t&_uUPE_6_`EJluBy zUeWW6Kjm8rSPWf>c7B3gCx7?g|7#!+`omX^1AiUocaD$WgQ_te{CAbZ|NG|pdk2N? zf(8AdsKDQ78=u;Rf7A06@+!&S@KAi~@PF4o#f@$H>xq}@%fA(J+pou0%y&7%{zk#h zjc@hC_@CF%=#RzA-%mpE&5Pmx^soS%6yM%Zd>1^1XVPOQ{q@F6{`ft3H@=52!uPeh z@mB^rH@-LUp#r}HM}MeN;BP)+cKux#_x$Hm!o*LCuO4=;zpX#S=cLf+4Z zQy9xH$qDR){}Afm<7@n?`Ffk_4nA5_`4qLq(5W{;yWDj_tB;JPKli1xBMLl`MdO~?EJXQ z@wWwS;KuhDc5dm$-)7jk@h$xe^F1)eSLpa#1|!$s2zzzJ!S;=2!auD|D>#&;v} zVG{jaffx6&{r842{1x{u1>-M*8cIm;BuZ&Gq;0 zRi0-*-tXjZ3XI(N5(n^q7juojfsQ|ZG>V^K9e)jl?NLzBh5Y#5^*8Gf<}dn<@m=ls z>xT@kzm!Lx_3Cek0W1o7R5G3okSTkLrcQLst=rohhi z_u(ne<9Bc9?^?W6-LAC;X|+Q;y$EZ~P-ZC${}jf^GSG0M1;0F+4Y% zpPMVm-*Ona@xA|EcK-6SQ~Bfflw5!B!r#RdY?8kN0N3Au)A;*(*s;ERbh-TfKIHG? z5oR3<`{Q?$Tz|3m@xN}Yzmbl=55aDHbFMRgZxZ(RZ#GZ4-Ern$v-KTi_i_BO&s~3` zv2&cw!(XcJ1F&=B8;k;Q$n@*`b^KO+Z^ZG3{`i?R(^B}m<6^^n=RUrEjq@=6mj5?y zG536xt4#Un*mrgYQ&&X~D{`fz-=}+lC*ttpj9>o}f%VzDP9ml7V?DDZ* zJI(!Ft5-y0&!Ku!NI}yRcD4ShEpj z!$ytpZRYg)PUXaLk%&s9@81XIv&`{`jeE^G>R>#tKH@F8JO5!!?ISui3YzbY0Qfp)31u&G-5z&hx&HeE+l*`48-VU?h%l@%(&mB>Fmj-g(~l zDm(I{ZO_=rzyF+C&blu8@7?z=~Tody%bS zzw6;Q;rNYIMz%(7=~14|*Q0#Jp!Qz5SHIkA7JQ#z{Mldm`tE7e5L1 zdU;RaJ8%6XN4zH@uY3Ks{uC|M5b3VG#Et#hPdpIBwsqMp&rbb#YL}P~?48_i>c*)# zGtS;zGvUO9vA68KrQgKL>g7u}R>s@^?(-YQJ+&o0XQ$UI`V)-Kj`pZmw7JKa%3E^U z7v2)t8b3dlhK;O%Sg7mSEOoBBuc&{KKn zMf}Dq90|vewDiOD_s^q3UPj>v)B9X*}-#H|%qM|mAqwjs*F|8df@hn#%G{kj^Wym*eP_j>zQw;<|3qS6ab#=FO($*|JHCBfHZJ9eI3t$hlrdtC zI(;@`&E7Q?cNRG##+~=Mm76_`<(yxvk8J&uX&5P$h~V(1^Dfxm(Z2mWGoyatWm}(Z zKjZFIC%3)2^Td(k$Bvyidh*EYue^Eq?L*_fdvMK5Ye%mfv9@U4&^0*+`)}>xb>#p0 z^Y|Y=`pTG_Iu?HTm2~rOy-{=H=iPJvGt+O)iWXMA*X-Gq}9#@({-mO&FUXqQoU=fBzSjX|$Zcx}?jDX&gHG4uHBV>L(X zj?8<7eel%U-QVR}t}+qzfkEwOC)Z3pF?H;Wy)*jF+&DAmjq5v~iz--g`TL0e=NcI08@KQ$u~?={scYoCF3tBiC+pU#Q* z<&2!^b=2j@ez?5xh2%o!p(56tB2C@6K4IVqo5#xzj7|j7R4MeV98H<>k?jYO(@-*3te4zb2*@-5*tt_s_;3sX$wL6K{?G zA>;MilEz)3Y>moLmq#ku|J}91@r$xv*dMufyqu2bKl)k6CHaw#lhMdkH>J4ORjE#<2hV>#?A#?9|=kv&09nnWWi*Jrb z;?tv%bn~jnGrxM#YhRPbpYz9267!^+cc7>8;ENt3TbH1InaIfK(sbFhOeDI7DqA_{ zuwO1l^N%r-e_Z}Oza8TFyK$dwcKhq?$ATlvxn_ByPquv`TlZGPr+wG!h!*F@Pp-te zQ{lxQsP+2iVFu)F@#51T@H&3YGmKBr-X2emNJ2rB6o{y3-K7Q1nJZGFd$5zHK!MYQT#?0J8n__j%E5w{<$t zoMjbd(WzsmZ0?`El~+_=@g=@~Fy8eM z&Og6${+Hzc*G~Dniy>8+`Vt?14j(zkbB={;%e%B4xTIWzT9^Mxwx(+;W3jd#+3k_I zs*CsR>2dDj$kt`#MQc0q^LDgXW^?2Y?2VQ458qia@RE|wYHsCk)AW;7{W`%OXKn*u zzAf?=@_O|%Xwzd1-=|?5uSoUoG8)_Gb*!4XW{p$o4=amfQ)7;28}GdKkIL&RPF9S& zdEd>0COkAD|CY0N)XX|DYwVqS?;KeD)m+b;i>py5UpGBHymI)LwDNOZddl(WM-p!T zXr?3ox4YPG?%9fytD89fE2Fn-54AUTtormtx2?VxYOCEV*$*oQtj~>B@~n2_9amMR zn-@m5&B%Ruh_~Y9%e>sfIFmj+%Igv-QMyUD_$Ow^Sx+1dip=p&ClUX15bVL z(xM&t@9c2v(OpTIovuZyVg**wLBYB@bWQf^G@RS4$6SqfJ}_bRw&2Liny$xjBaf61s=e~wWRZdsPK`Ok2Mkl#EtyicvvWqcg(h$eF9wGRr;&CZpR-UlvauTKd2 ztZRK$4z2&N?7v@H$Ep_|{9>=q?ft*;`q*E(<8{y%9zAd+7dj^xRXOTQ`sk-vnZmhd zRL=O4T)**i_0B6>b#o-%J|t)N=3%khoueIA@bV~DC7jg{>>XJ#@Rzx-;E3AW%dNz{ zie+4ZXcJ zH{;kmpm*N3=rjL}64qSPWyVGC>d3!q`TEM<6X&%bd7xh~8shCHn)K41-q2TOZyGtx zi*-crSXp!g*9E->All5|4?T)2lQU)QL&v0>_jnyWZ}!rsMn`fhaXhNzaVY*!H1f^$ zx2_)>jo%TCl(mn>^>8M#Vq#A(x8gFK1+MeT8r!`eVieY_dONt1;nAdDURh>Sq&>q~ z&iSTsd}5sHtusWw1qVjYXPdNFrq5&|x#Mp3R*akBbzHK_`_=mRdH?cxdd^S0ZTZt4 zOyl#dW1Dj)Hh5R`e5QTim^IP#srHD6vzR=u{C_D`#;|7^i<2M-FYtA=UGN~3@g5BTGl=!l0NmM z_e}ef<4vJG}!}l6U#{M7nrIoj3blUw7_4?wT5T z>;0+A4ycs=+w=1K@65}OR-OosPX3C%_VxBD!J3!*^2+n3JQ`m(@GJedPd%^y&WiK; zuiKu_SXes8$PTX~?;1q+C?dmAsj?8QST^rDME7WU8h32EM29+8>|>qXd!uEmDk4xi zN3t@U7wx}~Yn*!qx$LIdTV(h0xb>Bf=W`@Qf^n1fZtfZbTBvfhyIMxJZoD(Sw71u9 zD&|1miVBY5KYSV$bY>3Khf8lgZ0Agj8CM(`kQ0x-j&r4HU0PSI z!n>2j)!Eh5KQHi)s^@Mg=1HKIs)2u|raaCnotT}q$*r84^o`S3zsyxrCF%+-_y17$_Tg1kciR6xNlthX_22=-gxb>t5MoXY z@5opu&;$XIK?+nUH3=sHf+2}{!IxSaNP>Xkph0TY`eYEPrD_>awAMPn2#;kbLm6c( zkK>?^!#Iw0sH2SIW9@U_d#!t)m7RdSp6mC|Z(moE&%XC}efM|0?zQ*XS*NTlW3c}O zCw%q#Q|^v9i|cK+8ZKRx700R9x17CP{BaCzDD%K28Sx1i4KS|vE%l$MHazD=%koD( z-5+z=V*JG&?uw2%YmWte*zeW;^%B>iKdvu}Uo{x@|E#wf_nP5&SZ1fgck~C{DFTy;%=FAARb=2{WTh)5!gt0Jk2(n#Bn7vuAgaQVCKVZlSFZ+}j6AaaS{5^=Yhu`Poi5Qo#TeN1@H z9nmWJTq)L@t$U8LHuoHneck)P>e4Su|6rSY&U9~e=gpC>9qk<}zRc4n&(Wgo@?U3W zZu>hge$V)fedncO^CNsdx-eZsXjRW+WbACu3Pxd$eO(x5My`F!nRBVN^5|aw=!v@* z2G`gc-lKGJ7Ld+ydS>88pTavcdM4!O!9E}Qviv;w(3h7CeY~@=H&2~wfA|A8{n=}i zJ+`5|w_MQggJ|Iz+0I>?^i$FA+%0m%p59_rd!mP~b9mtKqhE47)*qkTU8C0BQH9!D z+x!T7m3u{hw#PN6bL}gSbYNs}yL@9Np6>SH=#%-xJ;CQ2{ywgRQ)hKXU&kEwMQ=k? zXW8}Oy;J$*Vok>_vm#w1A71!~j<{{8b;*j3x11J~s#p=(-G9YY-jgrDc%!+`?yBdU z>uu)9^CJcAxE6Hm>ehzCXJFZQE4t5YG7l^+j<-ZJB5#MS+1slhb!W9-Qg8SqHS9yR zMqe%GIL^pQmiwbb7O$2aW%(CAw}d07+Erv9TSadzgT6m`!EMJZXIgSx8*p9cd6#?Z zrbhPNA5Fy`^g1UD_ICfvFTK_KSX;c-EzaO`(qCux#S@AL@ys$kOUZxoUN3W0X^(M` zy?s-+a!j4RHp1s6^cgM#=56lHPENYw{XN_lgzZ#Tv@gDy@xv}N(se!BOJo-2bQ!xb z&ujkU_g>p4Jcf2=Kl%$sIdZLg&!DSM+kt!f zOjv*2#{7GKnjOFOlM6euKlsJ{zO~vw=7^1%kE4YBacXX)i}l<#`Z~OOAd7W)} zrxPwG*4xhczw@8xxc5T&c=E;a{v^lrv(EnC#`S#>`rDu3`hKl_0yZvt5w7oRabL9i z-JbV=zVF%<9mk!kL%iej?-v~A6M{(_ruwttNjpmXx&ETfgBQflo9`7wIj{KkR5P#W zymuDP`v_W60qz*5a9(jU=M|6Oye&}sL(PHe+@;TtVt#N0^9yGthWW+r4R=QPiE*l= z1NZ%#Fmv68zu1p$LkmCUUh80uy9RvjW^DGJ)rL7dTA!Y+XxviS_vY8{DGg^&qq;XU z595J%Nb(u!5}Bvzsgo-rOUymForm)b6^)pS-tCOt@Zj_}ywmU{y{)#lamDSAt=%lr z=UjbF`mCKy95Ig8aRwA_@jQ}f zh;;dLrk$P9liBpMqQfm?%{$Bp`%k#O_2y;ME$)awFRB@n?$^#(&7=Q+-Q0J93fePA zmwC^$&kDwu9qZF~x#3b`tJpceU~eAoSmvzT9*nW2d%M36R5&&BVAR8#0Q={DC$hhA z;p%;Tr?!=??K9)Ll^X}I-#wwrE9zL&YTjKdXitBZk{3h~dAqRW-kEb3-#c}{LB4s$ z_s)#{$o;eS7POC=8t;eC%tzi>{QQU#@A>Q!Z{>Y|7?Rq1(2Kkij+!lG?<&W4S1Pv0 zyC1E9GaYgvw8J^j@J<`?F51)`$ zIDY)rn}~FMxxY=f=Q-D{^k)R=lzLY$VzJN8y&dxg+|O5R@iGtKGsy#k zaTV#rv)%<8dFL8`uwNv8V>A-QTZtnhnFU!{;gVp@dU=c}{RA;{ME~z7fB8B67e~tu z1tpa~YRBTpzU>{eg83*uU&@*Cot|ThJIe0-+PROP{#v>&(szM*?)`s9y04ixAHz9e zowgz;hk~a}=B_7QtLQ=NS$4bHi`xD2^Y8gHNA&Zba-}2ipNrrr7vIa-++$Y6^OW>S zj~wUDS!;IMGM%%YY3OyQW1GI4oYk!qOsg<$oU^g?sAlqZ{(YS3;L|y@gf_H@%#nDD zau7e~>%{vf*KO<^6pid_%^$XXVYvL*5@MyZoL-iWJau}T7um~_QoG>HI=t650`HEF zDC=KzkaOCCSK=MLy-V%3i=*F2pX19)rv$O->}M+-wGqCZnYNDXn~m4!$9t~whxxtN zL2+5y%6uMuQCZuFep&aOq-?hGA{ivzWv`6;&Z=<2a^)}kL4L>aDtp*#0@{H-XhEpehi06BJE}VG)Pp=LP z!uVijnZfvg&x3mNv=^RE1bylDS^KJ<@86pG-Js6%y8erAt?_g3-LLP!J8i4?;hHyH zb(8X1B5gQ6rz5qA@2@}Szw3s+RKeB|+1Ila+!oP=v&s`j`K+jYdW+VU#Su9b`$exk zGLf53ho>`H=IP8V%%A0r?@B?(yHb(T{7WaK@;Z9H<6ee#qiX=Kw`R29Siw(Hw&RnY z!TvZqz9fF}TJOe<@rygWwtqaBy79iwA=#1m8`+W6raqBRrl(G3N1o4a&EI`IJHq#S zF~iFK~;=S8cd{X6@={))%iX>5 z06rP|Dejt{gR1KtpPAfWwg}^7`d%sW_QtY-*DS(y>Nq~}n6qwm@QKdu=r8g47~1G% zi;Gp7(Q1x<3wAO^dfp#Fuaw24KDcYgf0(Ge{bv(TpZj>(GaZOZ?JwP$7jMoOy|!ja zV`by*SEScDF{`p*os*`UYZ?;Wmyk>ZYdAG|a~rFZsrtI5HOpGCLQ`VyH?K|9wZLs- z;_HbKRi1H^@E2hzOknY%n!06Y^;VduUs==KOcVMsYn>!&Yp^t7C;+?qQw`Re>-7ww z>H&s%DTmt;3A@)HEBSD_uHu(y|MWJwnMJO z5{pI4ya9+X@6IyL5IM~BSU~*kcZF5aSZFOSCym?ItCGZy1VW~JQJcg!# z1BsftM6ZQeH$7<8~_? zvttG<&)q3huSE1cI%A@KX=48DZx)48U`5la`jv?#w{u}kjWx~!S))c2kH2kn0&6W+ zuB^slq@m=g<@M;d2`9l6RvXeJQ0pv)C6!f)+UjMMsoT-lS8|0=u91l1Z(d$s)y-SF zV{~gDegT-?&6WAQrCdSqtONAfimv^KT~Z&UjGJ)8taenRIG&n2TBR~* zAzHW6F96emYpd&)H7`d)PSrP}OEjaNxC$TEanl9GTsvpli<5u(vCAEzg)OgdsjW)X zRpV5NOiR+sXFKaS2E~7lD(bmPaS*e=N;I2g z6$(s&z^AcK1Q?@CYqO5*QED74#4Ih7vsZ_*M#18b6x$d zb=}70BJWz~3gVB!{>X@nHkOx61eH;QhG2@iTXH{v@7ygSvwWOiI#^5cPgr4GYYYbi zwX+iEH~kgfcqI;wGK40-n(VTi2`t>X6f2Wsz`EJ1#)^z9vCd#E_sY|IEjIi9l?cPV z-!K!wn!f2eZ1OP9pW|q_Z3iyc3$=`JAi93d7{P_H)2cTrQM0VBo>Rcl?1A--Rf#4n zJBisFrgUk$M5?lmRkEZy(b5EC6wC6&%F5dkOB*Yfami;4XMXPpg7C_;UU8Y?vNlZ# zTpqAO<+8eJjCELg(A1des=>P5K^ZxVNa9LlR=f_1sJDY|WAN9HL}x|5yk&^LGSOQK z9^tery|`s?rf__YO|bsQ%V5^}2F*B0VvhlBlY$tL7xgw0kVLov;g9ChP*;rI<@qqHXqaC}<1491GW8 zFH3pbWwC2(uy$*WKUTGPAr0LiRb5@xl$eAI!R<{&I?k^xz(gA(P>`gqzAjZgB|ZPL z;hR6GYpiu?FIm<}x{LMb3O$2m7jJ^|-b>W`25(+C?ZRkm3ohv!qr>uIWM=X9UdcV; zmHx%I=3Fzc)Qb(mq8Y;y#U;ZM{@;teq249-gQ2f@{5FWtR@P)DFG~}tTCBdQxmIFq zaS;}6ON?6H+}zMK<%-aKtv}ycdIcB8O=7CM0$0%@-1#PW%WG1Wk1ZZMp?LDxD@S`% zi*QbVxpFTu9GDf0Hm({swq|U@nDUil8;Z+Q{B_65l`XYn8nifv6Xw62pWeyxe*Z@- z_v37tUT3D+ZN{Grua7rAjcoukcr<27VZCG4}sAnBV!K__sUfXMXHgp}`{4`-QV+3RiUFajxBDHWUA$(EicT{_)Vh z{hBb}KR)_(wy4*=eoTE}X&Jlq@%|a>oLmckgP|z?DLQQHZ@II73+yXk&uq}XyZ?TE ze%1!|{k*Rte~qxeuvh!@eEa@Ee$Mm0i}i-M-GrYE?|lFGhrYsJ#{TNi{%y|wm3RWh zZ76(Z;H=MMk(NJTpY4b74#0jsj$Lf`S^l&&+j*hz<^6z@|7;u|g7j>&I*#uSvYUzTl(YYR*fV~&yyrUceH#VE`0^cp zL!9G}qCV3EF)MkhUwk9W?;{R=|-dqVbSLin}_rFNBLz#U_9T!|Ioy+|5dyH zApn^muOEHV(=RVLFwm*(hqX>N1(nsV2_zvV7~-wgqdxS z_Y~Uy4{i;@Ho1%C8;y`xcI4dCR~b*IqT7Dc{qM z{XFF7cR23G_kwf2(K!DfQC?;|Gvn{bQ2jpX_`44Au{|T(!TINf&hIbe>IY=vS?C;p z5Akoo`E>of1N%>7-)%21JN7J}&1g?%8{`eg`A;BzT`%rItP^m}9{~fE@0+3YN1XVF z;C%HcKX<-W$BUi6nRvH3_B{U~r@mi7d9Fu#uI zwn1JC>=(hO+y2%#<iW#%Bc0>i|2X7t2GY3x)`j*D zh4$aGb3V56mk@t_=zNDm_6yk={LR$&L!tc_Li=xo_Fs0+$N1k2?Z?m_HF4Dxd$_J`PgrmqU6f7D6;E((fc zn8p*@f9#a+&(N2Djqxby_*)7avkmg@#_=nV-tDiSIsWPI4#)m;#BwX@#2qiPobz3e z;}7Gw#%HE4b?TS<6GQvUo%B3DJCxs3&iQ$Kt+T%rY3mVxFg{`bRn$qa58DqMd!}cZ zDgWHx8an=ID87P_eGx0i-%NX%6WV{)vA+`h3E~+6d$phA&T*dqv(Wj5IQvUc7w@BS zP*VEsq4HYe>`%3QZwu@*Fl(UyC!OQm9~#Q8z4t#K9!k3WFE`PZ-?ZTAn`{ zKM&=_u$AAskpDNs`;NbxQ4rhFo`*Z>?{n-2!~bOD&mHfcagH;dQ=$FSp?$w|+WgTz z=EVOI{2#*ki=Fe|;T)&^06j!Rd0zwj&tUJCcXP=8(a`=@XFmhwI|*&vtq8dR`^4*pnl%tWX|7Ad+5)^c7Gk(<52Vm zx=?*KI{D}M3mtpzuL&KW8#>+?+TR}9&kn^?5ZZsrv5(q&kv9=v23ifz|4hjKCTIV1 zYhU7DPxE~HU5>w}P&U^hzq+6N2U8Fpp9yB*DoX!{9s3VZ-kV`hN#%3OIZpd7=lt94 z`PcdWM*04pbdLXnJwDz)Uf>@e#KGL(O#N&Q`TyA2&p~|^hvF%4(qE1It-$dD_*1-7 zoa3u;j2qj32CgEEKjs|g{w!yIG4lU2q*42yg6k=_T0j0v{q!>&`&M4)gKbFY`NYuB zzIoo97ue^7j+^*67MN{V=(sumEFDIajDMc9Ux4!X9b)DXq4IdsIZpe9q5T`2{e5;W zg<$~c$N2tVbdGZ_emUmnYESg{u5MkFn1R?WfB(&$|otb2ZYde|A5= z880e=^O^n4q5U_U{jJDfC;X}WSfA^h`*$FYy|??rlELgfFrdmN5)g7PrwYeUDc3LT#u+OG=j<3x5F>Ai#Y_>VZh+h0D= zVLLt!aO_z=>F>cX@jMecp8ou0r1vdU^kwLe%HL7!N3hQ}$NY9LA2WWY#|N{|wr@7G zpFaO6?=7^atKrX`&%G~m^s;d{&gWfj{+@Dvjz5IELY<$q$xUu9@NC$t|6`D+X9*M-g>38h~i z+MkQ@OdI3v3YEt_A^ZOb`JWxCpT42`eydiRXb84_WpL!HS10eG%<3kK;y`eiQAjPL|Glx%k`og^et|8Jx7^M>}n7xshda zFSs!7C-ruMV}lIu0q5A~K4jUy2+p-SS^BHsB(BBWjyU|9!*4kJCODR3?B8+p_Z;TY zi1nF8w$Clt^u=sy5gRkJC#DqPBoW(C{6sim#WoB-5enE6_=(sUhLf#5#{t{&Qf|FmxFKmoi{f;b~QgC4czpzcmkK!cDW)@g+lBLg~{nzjd8(I21aIV$K(r*GQ zPO@}XPb?q5u(4jm)4*{y9BgFSF9s`4vh)hD;v`G20_U*uv5}=O2j^OyEd4gH`Wjg} zn@(&beqm!WG22P}GOC{cnZ4{;&V|enHa{UyO}rKO6Tdvo^3zBgdtSz) zyt}d830-+7D{U+7*(k8J;zxQrIM?cA=?{QaM`Y>GfOC@gg^etI7dY4IWa<0CDnqjL zBh=qDbxM~00XS*%h)I4>4rJMI>@6&UA+}-Qd}Q|g0m{~89pkR2LZ0zbM|lI4@t zQ#b~{u(2MKV|~Q;jDf8Yncuy~Z3cb{Ewk=&*vYVw<#P@=*Xm^HH-MA8X~V|4j?po; zRrnFF1IPabnZrg_TGmCOwciGgpE5RN**ry?EAb24PW-5ykY)2MSnY%?{RP@j!7prN z=`VqEtxlGH2ps=c69ZZLF>unx`5IU;kY)1*STT^Lze)Q)!!K-P=_kRtRwqk84OSZ? zOJ_5R|C@=8EWH?9_;vikwg^A5KljnAz@KD^;VS%5%w(lq4pz)$>9w?wtUBd zCd+0RSTU2OCul#@q$NuqPJ649r5A%0Gga1*lgoxE4a`yKWoal&gf*>?*QjoohUrUu4;=0js{q($~`d1``8W`Ucut zoh*F|SoKAg{unrE^LQGp7|62u7_1n`(m$pBjV1=N^v`K;b+YsUS%|^jyOE_2rEdEg zSvucUDC7kSTPav|!FOuK^T3Lkth5WkikU2(@5AMM+xR3)zlru%Cre)eR=JU-uLBn@ zHhwmNlixAS_pcQXS@v7Niia$n@8{&)WYUtQKSq12lcnzfD;~1+XTiyG<7Y2eF_2~R z3Rp3arN2u13X_&B{V?sVPL}=#STT^LzXvX?G=4q?D+aP`J_RcVvh>eszr>^^OUJ*( zc)3<5OCJDM3}opOsoSAd7fCrjs0n8S$}HnMaMXSr4`#!vjTiH$59&fj93^kG|zAH_+Q&1Od@OMeus_{q|{ zz>1$NeH&QulchfiR{Uh?&w`UH@eA7v_=*4C#7~yZLF%^5$AWJW#z17LmCxaFL)nJVSWZ6suYaAd;pHBN*kWp-8>9c5Wb+Yt1v~M)_Wa*si z=31RBozD_AZjhzdQU6c;!bX<93Y^nq{F9~M0nW8LS^8bzShKNj2Pany#|L2pnrQ{>OupYYfi^#~C;_vg|p3j{ld@-MREq=qjHE+SoCKth9GI zI$8Q!u=*fb`UbH2AX)l-w6}eYEd2r6Tb(TZF|hg|=i%{BP5flpaK5ehchcs+jSX2g zFVKbqIkuOnw+39z1}kfpx^POdY4PSM6*gUGV^ z5UjlT^M6|x?)*O+b5Ye1S!pi-t1igWd5@sFAWI)Ydt2sY={dBwI$8Qiu4#~*$)qJqKT3P6 zlcm22Rt#k6?}L-JOg^N|XQp3}Wpf6s_Qn@D)UL>~xxmrM(uaW6-pJB(z-n(~>6g;p zwkxvqJlb2GEWHS<_QwB5QyG$FGajrmBuk%6`%Y7aWa+#Y%e6XL`Yf=@kSu*6_5Wka zjV%2paBQ>jUjkz9TG~Ho(vqb&(BA4~>8)UmCuHgCz_BgH&%NXy7~TX{ zJY?B#1}h%2^oMBwkV#9H{wVFOPL_VQd$&EXN!oZ`04oNv(!K;%3}oqhY5%Z^fh^s> z*R#5NuXhYKsxPwaPg1vICRzH2j!u?-2COzrmi`%7ZI~?m3)e3Y{{~}3aqjvOE01QkBlF(^itYeoh*GG zSTU2OSAZ4sa&YW1q4OMe)w zILXqtf^}Z9bp8*7&P$fQgZ5j^dCAhBp}p0~(q97WykzNzsoSotL>4c zzYA8|BTIje_O^|YrGG$stCOYkAG#GMS^5QF)#D&=>~WL#Lh?4leBWJVNLJeMV3i?R z`efQaVbYSNUqySXlckr?e!H zGgvh=Jz zX`L*609fsuES>M#sGXCg52C$o&t&OCX>WD1biPBRILXraKjs(~nECQ=8$kK13z3mrd=}TyDb+YuOwBKpYMV7vT z_EslLZv?AM$kNwQx9y57eG^#mlcjG4D}J){hiJdc#6y<;DDACImfl5s`y7KTeH-nq zPL}>GSn-pkzXVqMe;KTp$+FoGR?KAS2WfB1mMr}c?X6CheuVbhO&-b8kI~-hWa%ft zikU3^40T)PWa(dk6+c;eM&ES&Wa-)9oaanDWa<5BZ*{Wti@<81TpvQ`BFkndSY<_) zK8*IZOvus`w6{80`f%FsF|m=QkD|TR$SXD6fYoNm((eVwUN(Ln04M*(@K&&5Bg=j}Sh10%@1Xr& zla?&~8QNQ&EPX#%pG%UZ9|Ons89$$r|JE@7K_m8x;e^9if#VsbY{~LdN}B`5elGc- z;Tyop7g_d;!O9m|`V!jzPm`7`eJSm&PL{p`ta2txzXKe5)%a;8|H|+d@*%^Ik^j!{ zPV!;Hd&oBJUT{3qts?XAyK;N-83{t;N^Lsr@| zV3iM9`scJiYSNOW^B=%-txlGn4UY2xGd8mH3&6?W7(Y4S*nY#sCFlg}DIYru+uESt4p#Xy$6f%dPNv}Eb`(cbE0 z=?{Yy16leGaO`#C=NYhKAj@VKSTT^L@1ecD4w9w6NPDZ3rN2yjdmSW8-%oq1lcjTw zg5>iiwqsz$MwZQSuwo-iKSBHBCM{X|TeP=2S^8OG=8!Nr1=8!8%7`Q z@F=k2B+E}BSaFi27t{W?#t&Kgc-mW?EPXmyagwFa1s9$$e&&<^mtn3U6Sx1&PL}-& z>e;5hkfk?*WBec#+nuzr?<$jJ^Du4x$=Gaj_$l&RM&Ix7L9oh%EI)_9DigBwBeef# z;Mm(n&p1CF8(B8lV8uq3-kHRh0|Z>9ZvCM{X|cG_E=EPW?9`ESOa>oqA(vTXK%6(?Exi?r9c=jbof z-s)u8@29=SJx4!Cd#jUWe*~=Y@HKGG`zB7ZY~BFpTAeKYEwHZLWa+2Cv41yyJ^&{_ zF#Iv~-x>Y_ta2bLZN>%Zav)332IqWe(vqe32j^OyEPWVQ{g*6#I5_7&j32V}QQ%yw zlci4q%MV%lZ0h`w85>#p4dB>m<9{*v_lE0eZ^u2d>{o$R4rJ+ED^Kl#Ed4Ipe`I`; zrLUpA)ydK~gB3qn`ZjRvKaHO!!HR(_8?G;+7|7Ch(%!Z`vh-(ZZ*{Wt7ij;nITu;_ zOSHE-S^BGBjRR!qC&0;1jGs5bikU2%lVHV6mi{j7ZER%e@6q1sWa%H!{){;nS^8<( zTb(TZbFgA2OTXYk#Qdr8!}Sz${yWXG83aAo>SXB&uzZrG^Z);1pBX>JV3h+|Hsir6 z2eNdop_}u6Oj@$^t7va^vh*2X#Xy#R133BD#!nq>`kB5!mdz?~Y_+jzCx34EKHA%R zf3obkKCE=I^lf0>Uz4Rj3D*5JS^877uQBH$OW#R*tCOX_0#+W$(vN}l?#F9jl`~m3 zZ-7WZ8TQR%~SHpVQvP zK$gybN>*%S=~-Z1Q^?Z$(%xQE$kHzY>zcy#^kRQ7burT660q6~S!rj`<_lv#hrG)0 zVzOtRdn^GbBZj%&p7KtXpXFfXoh-eU_8BHES$YHQtxlGHCs=KREd4&P`Zd=e%*ix9 z$+FoD&b2yO`gX9!WU};K)b0G4Ed6D0EX(*mNE>?{AHa|6WbQk$NleQhKdLhex9a!~3mVO`Y2bi>E z=?~D}>SXC#z^WIr^zGF9o3V&2{TZ<0+yzdaZ_f1sSaFhN&$UGrCt3O{v_ER{OP2mB z?X6Chegv#%2xRG8yD!$)#PAL{d4b_~!HS10`}e?#hb;XA+S|TNmVTP{RwqmUnD%x& zAxr<1_EslL=bCRCXD$H8E;Mlt1rL15lmpicRm^0iO@I|MS^99=$BZAc^ij08I$8Qe zuI-d?lF(ocg2+UG(Uan!|NQ%3{9y2l~Qeh_Vj7#pt9 zsl1S7GYqV}kfkTUITxF>Wa-1fxmG7jp9t3Vf-L=Na1LMG#zvMt4V-Irvh?|2`5{YR zPTkfWS^8a$PL|F!U1R)5Lu_0>G-p_vWpf|&T&t6%KLA$S=31nBcbY7lhrxPxnk@Y> zu+nlJSd}?hHrv4}bF%auV6`8z^k=|oKV<2&Z8$kJEP-s)uO&EVu9W4{Wl*vPWE1FYD{ z((j_Zje#tE4ehN?mcEwub{r#1-#~k-lcjG4YkcDx=!%Ujn@7QljV!&3_BIBx^lh}a zI$8RYw72C$mi`p&txlG{2dr{?0j$`_vUv%t*vQiN(%!~Emi`LutxlHyD(!6yWa)=# zZ*{Wt<6y=123WC?W%DLjv5}>pq`i%SEd5>DTb(TZJ=)tC$kIQcz17Lm&wv%%XJExf zmdzJn#YUDM8;t&CpZAib4+Y2aOdB2smQS*55@7ixOCL^qeqjnw+Sa6d6 zNQCVwaBPI(Qn1#bAj^I>ZAKcKMdZs2SAcW)k4M1$|zxk*cwzLxe@CrjS~)-{(b{V{N?(D-@M;g@Lt&qgQ9{wVeH%zX`6`WxU_ z(%8QVR$j=mISE!?$kN}X{S_uHS^9glw>nw+8L-A}vh**&$xDo%zC$qAEjHXAta!+> zzW}Uw$kH#O{TP#$EPV*=txlFc9ISZA(hI@KuNXf?V8uX|%~-HvAWNS}d)qh3(x=eg z>SXCx)85`Uk)=cEPPESpBKVk1jmMSB|qS^6Ecw>nw+U9>;rcUg}teGOR8SIN@v1tHpzQ{_u2dsRNrN2n~hfG?s^p|OGb+Yus zV6{oI^f$n|SA7p$INrqh0XR0!@Tb%#82*fUk>M}E$%%%uE{2We0btn-0>=lK@qw)K z4hJj0Wa*>8$}d@ZA?+ubbCIPN)86W2=~si5U$XS+;28hW6Wbi}m4@em6%SeV3&Dzq zEPWB}rSXCFz>0?~y%DT2>Nc{*f3V`=+WE4-3#@p^($~=5wr8^RwY0Z7 zS^5UrpE2!+Ed4&(Tb(TZA@IQeGWK0y#ktMlXTge@th6tH6*F1-OSHe*lp$IAUfNro zEd3Z**DSL1x4=2)XLx-P9$ET3;9RSdrJn)EFEDMAEd2{`;h&p$GKQw}LY7T7Sa~5! z?@#*@la?&~0@_=hEPWU__^jN~hl68Njh|6q_01yc(~QpVo=`cH<#Qrfv5}=uq5U^Z zTC()3X>WD1^x0swRkHMj;AE-svly%x$g-&bD+aRkD%zKsv}EbaX>WD1^gF<+YqIoh z)Gsu3N0$B~Sg{?Xjr|;lESuLHohJ#m(t$qWa;z4Ds!^* z72w!Ri{5u0Ur9eK9lP2}qgZ+G|*SkLFl@_CFlbBz64vFT5JzTu0=*3U3-e1Xx)@-v(^3ynSsEI(txDs!^zCxTVxWa(3A z|1IN(Ed6TQTb(R@8dza^c%pj8;!mgtT>l~6(?EtE5M4AEWM8Qi;N$# z^hVlSoh*G7SaFi2uLH-vZTvhyUTk;^?Z1;|**^w7d6UukogVS>G|OfO{Zts8-$N3+ z*6<5p<&iA=m%z#+S^8nH?j_06UjxS~jn5ObiJ9?)ESq=0h1TX2IGJng`8_X+fh_wE zz>0w^{WR_E^_MLDW7=DtEd5j3+v_h``scK_I$3&lZu+{+@0?L=WZ7H*R%~SH7t!9v zK$bp)_EslL&!N4Ifh_$}+FPA0eH2)827bSdVk66@7_8XH(x-t{cVy{v!1|1p--#oi zWZBFI%O_d-4YarUB1>OPd#jVBSJ2+(i!8m0_EslLuLCQ;{C*zAMwZPguwo-izk~KR z2D0?KXm540^fk1%F_5LNrM=b3(l>z>+oNFJr;uf{4P3aywDTuvA2Ixl!_R`1FS63U z09L-p(qE!|%J?Bm-%ER|lcgU5C##J85wOlhmd!D+&PA4foc7fwEm`^r+FPA0{avum zbs9YIQ!~Fk1CA{Qv>KDnN%S+^>3v*E?~6IpM#f^7X)IlSEAT8CL=kq!8Ttr;GA@ z^*;oxc{^EcDbLZ#(hIgQ(lj*~!v}feRarPv$Y!Y^!8Xw3?TL{+pK$c!i`&A|_ zS^9X|Tb(Su1g!j$rOyB-Z#8~c4zb$|&!v95;rR|P1?Svhbh7-c0OwkrEWH6-_+4Y) z3|1b=vSHg+9?8<#&U5ZGY01)C!MRo^OJ`G49?8S zvUFaClkND0Z3up1cN-oKE?j500307|VkRps$Ed;$#%4S?hl_+^BgtCM9v9ULEO?8(yE$5n1*>GQ!VH?s5_Xn&81nJj%V?X6Chz5=ZJB};Dv zC+{_W?sS-!*g~tX1;^GKn;4l3&SAstQNVfRzchNO!?S4@#V>4RotJr3zQXy<*<}2L z^P6jRH^0l_N6%8o^50C|{*Mw_dOLOdjwM<8CUD{X=DZx2^o}K2Hrv3-2aL^ju<}Kg z%?_~gMV8L-NB14>ShS1wPv93evh4SOHJ>L-e-W(tJX!iH;AE$X?I2jOk!5oTtk}rX zkI>%6K$d=t_EslLKTdmlPeGP`g7#J?OFsoxpCwEGocb3gX0r4lkQ6^zdJb6elciru z`_1@;jVzrXW9M3(EWH@4c*xSP2CIGtz*lSw1Z+7Dj{@ueKFCTto;E))_EX3Y8NM2< zypUx-4XnJ7rBA2*4^3LK^jWmGI$8Qcu<}BdeiJzPu<=s?Rt#j>RDl%(SvvcX+JoDt zYH4rV16lSBw132$i!7b}F4yXAA8duLn8~t#0Gxc(_}L6r%w*X-1Xj#s>5tO>MSXCpffWN;`hM!RO_HUvJtrSC{s(|#U4{oa%z9VMWTj=jE9P(;$oVVdC)@^d zt?ssg`S7Ed$@0&-*7tUir7s1?wi^E{z=e++W*zA}Zru91jW$mho4XtvvV5+k&30qc z1y26h@K&($PL}<4u<}lpzJvC*Es>>jY*ZTykCS@l5FRJ>%wdn?hjpj2BFq14;N+7g zW{zEonJgRDwPGeqe~b1%F=@%t-=V$L$$vHp6FKlG#9KLg{ zPL|H1)Le)xoyDh^8H!>c%Vrl?F_5M2q5V$$!bX<)cVk67vM6hBbOZUg6=SKhb;S6u;L+0ZwKc*Z~Ty@uLI{=oh*F|SZ$0feJ42fbK~bla3KpA+g|+W`yI%# ze-#}2g|Rv2@JaFuMt>Kav^J-}g)bTXJ?i#c?}L?Jvi!4;E5B}k|A_W>tRu_*4DGE> zmi`&-e`(H3mi`6ptxlHSAEqiFvUH9i$(N0vk@yq)8^ZSo5nq|bbqYa2Lao1{7G8&ud{z^^r1Kwv&^;{V+X=kN4R`QHjwJY?y-hN>-vucvBD;p?fMT|eXa*+u^=OuoqS|1wzdlcgU8Cpl1I zJBA;{OqR`Yuwo`lKSBFnnY3i-Z_(cBWa;cvioxw)9$cvXkY%3(jvX}q*`CF0tI0!F zhtJqy!xO=ZpDaI9z>1$N{c75?0I-pzPXp_JzR1$&fn!I^xfYTC-Z0yVcmr6U*OQg@ z0dV0_W510ycKsQ$Y<7ZUzcw~6fRz`rY+eE@FJ$RQ!1}z8Ed32|@;AmO>qtJyvhnN7 zwpF*j-l4r6$H=nh_^CEYmd-lWdKYf}a?I3v7i8Ig3Qis~v3SXC0W7Ss4(%JUZR^2gk3Urk-&k=bY0=6vjal?Jd zZy4qn82LxTKgfDNvL&lEYh#vI)L30xS=3y8TXRuUQ*C*3ZPS=><+nE0G*_3`R8`kC z*EHYmt*l;|YQUc*)m1oNp0>NW`u6gs)bi@8mfGs_rsm3J)#cTdjkUd*HZ<0!s+*e1 zQ`L>lHA`z!l{mqw>c*O-y&0SH_hQ=6R9RkC-PGJze|tGj?hU`q^JDKl8x56>O^B7PQ80 zJ)@zzuBv<~Dzg^ZMq}@Ga9MS8`SQxTD&+F!>hk8s%DSdhV@*T1rkE}nTBqvkmewq5 zVY6*$x*5AIb+GO&yc+b(UaOidw+UU@D@xU`TuE?i$@KVCB_m%{8f; zY28~TF0aI(kuHRDnV!utE56C~-ZTGp#Hp=8@suyGuC1*%iF#UoX)&V^ON<>}DUQ9(EloU|4cOz+o@&qR z)K)I3uI(){Q_$s0Yb%$r>}r})tBNX{n;UDEpe1xq!1G{y!?4^fhjo=J5%IFd`j!U2 z9B{a3b`h<5t>}jOre<9w(80U8Vgqh=`b+uJ`o{9Gky?{6UfHy)yteZ8>h6xz+N*i} zVTUpUeD4vtmjHy`bZbp>YI#v}<&xTJXUyzo)w6)p-Tl_a%7&H(|7yCj!9C--5~WO& zL}ycyvtBCFXX=*7zbN!P#nPI(%G#Pcs>`jh-{`v)de1)L2Av+J+={aoTjQ+PVM1SEB{F7u}Eswvc<$E23m_mVApE$nurvAQz2NOn6A>Z{$3*%sx;&{&ds|hPPzQ%s-+mR8gRu!U&KJu zdjqmV4KH`-lHCe|!Jw?dGA{_YkaEmH##23x(^W83@>+GXS5#NuTwQd{oCQgwNu|%? zUb0Xn-Og@uv9uc9-nneks>t@jbT7blp{oAYx@C=(Rn_Hn)ywLeYy3JXT3NXa5vGr! zMby;6Lv8JPEAqWofr)R-wOQmWUo()36*)-2!#{c)F5Vg8l&A z&6mlU`l2(Z>BY*91L=vod(w0Pm|-`VZS~^F?_UiqOVC`)Z@aB(xt);rV(DMkm{qnM zbABeUGxrp7x2(FCWXcc5wwfl~mXxo=1Os;^y_g!OXEj{fSlvC9A3OSYePdNOZ>G^! zmZw^9mw`+F()#kHjrA*eBZV8NZl+GP85#HcRO9WKRQWSb zG-))dUTke$`2}R#NqJL4b;?WElNs-eQXVhGxR~MZ?JNDi{>8cI$}8<p-qQ*nT4m>irfph*Eu3}`|?;{zHO(Aa>+q^UT-0Ir-AoGqY90Zj~O zLO|mK8W+&mfX1Y$IKTj|oEV%fph*Eu3}`|?;{zHO&{&WiZBk9mW4Om#b}OBAT5`6l za?u#NFjehPaUce8KO6RvVsuBh4QR}mG^VLIK*Fr~Gbfji(Rr^7XmUW40-6}m zgn-5eG%lbqV;q$0F~w;yX#5zh#uQQa!zeaTTu$IfR&-@RlLML*(8Pcy1T;RNaRH4D zXv~;2Iz%i^;9=UIxP6W_Ni!YW3*Pj+E8}UwJdyLf{gBAn_R#pWiBB1J{~It0+r2L* zu#w%>(D*E{#HOpN@;rWD-X!cZ9v-f(|Ojxj%iBlfxYloiiGsn2S4&hKd!&m;9!eQ!$0yz8`odf3eS5I z8vXUN$CzI}yLJ7oKpdA+u$%mGsX^D@Q}Fi??C9@2dyM{C`gixo?|i!nx;FW1fSv2F zv=(bjz=;0PM1uUDkIcLAokF6ay~NiScCNo|@W+pb=?_aW2L4XN$o2OHDr=2>?hUh` z{QezwuD|(po_8Axj{dNWTj1}VP<*W@45rhj{C+=V*ABZIhRG^@-aA71ID9MYW|{L2 zf;oM&oOfA&^8e;#=6jaqQ87Fn@;7`xzOxO9n2#a&k-vk8$1Ru5qdaekoZ+v|v(M(Q z#2%adO1fPQg(iRe4tCey8TcD%)9{b{;hDRiro5aM;i9chT@&f5S$5 zUNMeolfPB4W113sVCVs?fdZyK7PtJ3@7vwqZ1}6?3G60+SHRBoHy{4qKp&yMOYtLr ze}+nN<9nf?_kKAMcCNp|U*R)9C@N(H^ujRfa`DFAAV z;slJ3?LqN1A%W{}{1u+Jj)L9fuMXhG_ufCCec1Xy6AS$PI^^#qG?wwb_r& zUGsC2;cstDHP-{X>mMU;#~?>Lxb?S_uuE9xAEuAt=jYZ={=8{Mrwup8&h1&) zx%qhQf0_QqazWOEeEbe&&-1D;#^A3C``UPnKkxT9f2B9W&fRFk?K1RVxNIPq)+0!Etosqu(GdMp_`_f(Jd}a*||2` z`^xmZj$I{rr4N)&ja-a^TZYn$49q@~cX;HXS+CAHIPaB->vyd$+ECEGx=cPI`*yVV zcBWWXUdQ&}Op&h45v6^9Tb7DF=Ph5{Ru=VA_~N0}rEMeH`wxufcm2fs{owq>&%H=j zZ@wDfOXsU@>CB35`bk+{$H=wPMs|EuvZVA_>9m=t9uz7?TjWeXLTzD zQ+F9Nr$*MahRe}CS8?BSpQ{1K+xKsOaKPVoAnKX7tS-5&oTjA6}Eof8I zW`uLL5pnLlxU)}XB<(j7UkbB-W?N}H{b;#E&-IUVb#@#W z5YLWf$ma3$BK=2Q(iyFc%n92!a?-E%Vo-TWM4{JTGb5tbOnKiRV{49Z;@x>YG2rns1ZTbl!IPu5$C!bt6b^5V?N;Mqtu3Q?=UUk>* z1$(@X^{e;wkE%5mJ=k|@q-%8MY`ZKHi)SAga6`tN zj$>;_t~;?VD2cP=X6K-EERn8XmM!U+wf3!`4AAepzH`gkgIizOzW>nPId9E-bK!|a zZ`^cz$!klGtvFhDr1x>8xKL+(x~#bG{7^5Cbj_Q2KKjXs$U8GL51^kMxWv0|W4z^) z3wysBHhjg6FkB;U$sZk-w(Pw{hf{M5+nG$K8riX@WMt`<((IWZ-MD1Yu|?Cqz3ba~ ziyv5=@tu#ZtHkJ%d0@1cIr4C3+rcZn%z^<~@rygWQS*L#UnlBre{|ftucP-W@1{ny z*V#VPi|mb-bw*n+k=BOR|KxAdDdN#z{V~8v&VIej-*<* z^+>^XdU{09c1r!|rJa3RF*+-XN?xmD9CssKb2i7LpMAgJRhG-?KDW0_!UQYczrVNf zy7>8}7`H$9@z{g$=!hQ`yz)GbbZ+R6>-3LGQm3ErG7n^7wh%>a4)QV&4)>--w??nu zxEsAKb$V4~V^*r-N5;0I1*0K*{q~NVf_7GL&)Bk5Np&O-z5b_|U!-E^dD|aJReUcp zF8aNx9c4U2XZz*2M*j$BI1gvY_2Lh9csN5g&VO<{uH?VjIBojldD+FQ_uceh{Jar3 z+arkVX|MC1Ql$HCB=f*1`l7U3-G zaOPFlhub34Rg6s6%ZYZD0~)KqYVj&%9uv92?^DZ{h|)MZy^vXf0J#pY$n2|iu&->s;?BNUN(XMA@mOfaVYG{t+UE4O|_2Ltc#QWuX`QAMk z)n++!z`P$;x5WELD^e#fkBsZMeCo!sRK;_ci(lDejPm=*m^mHCgK|l=_D4%GsUPt& zw{5`eY`(X<1O1pYiv?Mc&IRpWe(N^x@z!U({MGGV+Y^Vpjaeg|^SAAob;-!h`CgXy zIDR^_hI^?^7^OOfPi-08xgZ*eFYG|nKgZEuq2hnyWg_44=qKNAyKHdr?)IvwDmzA3 zJT7_7oQ`xK&YS*p*_@8;K@G9DJpd(L_pDjQFE5kqU7g?i$EVADUdOJvdGjBbpK;?y zGndRdHf!3oyRI$6^(B2rRMcLuz9^`p9qoAmV>CqWQLdYwMQh!ZNO>sVs5jL9jd9)- zkN);=Fh_{?!`$rr>8XkXoffccai2!q~9(1MYw+`#Qj47?jJ_s z{$b>pi}Qz1y*NMb`it`umAIe4{X-${9}4cr{ls74e&VkO7xcKRWKJ7O)Yg9KU;opw zbCw_Jdgr>#(OFsZX017z!jtLD5x@FYW))q6Fs>N!Gi z@5l!;5ZtW{X)BmI1a~V#aJMoz6J?0ImBE=w z+`T0C4Y~yNt~k2gVPr-IJQ=CYNZ(&zE?a@w>UqD)$b9`gf2@tKAD!LVah+H6>Mc3* z4ozitgdYQ*DR^wBO_0ip{ zIwIp%t&OC-uvTa>;d^o0o0G%shKgj5G5) z`_2mbUF7Y?8LaQFuMdmmbu3(~UMBy2OB$~kuwcf5L9x!hk?f+q1^ZWYoI)?%f6dt7 zdfbK*+|lmzu)A09Wqro3?#&~QB)T0*kLH=LU+%3xk7Gf&eXtD`|9QH7_@jOTGeES` z?qde7B^8k_wSwn^Cq2p$y+>yDY^99rDB_YG+Xe0)7hsHQ{Ut`pr@ibO;|tbftbE#g ze04H1u-}sDzbwn^NY4)F`4|+Zbi2AgP3pam@0_l4{-$iMw_$BMh8>unxZ`n;R`^E`IY(!89C7QQ*XMA1kxIE#-Su`?&3fKh8nX58rrmlDw+`0b z&TG=CdOjcfjbAV6>kY@wblvn`FPpAa#C{E2PRQeS&yO;iN{3k)_D0{0l=A>(O z+9sV7KIJPc$t%nJ3F;4be10jSrH?J^>=;~?ZgXR&Gq34Z8F_oFpLgXY(xoe7LHqM~ z4%OM76+DOHND#X&-JewNe($@^t%2GZ=@?zBinChvU7Wr<>$_Od%vc<*OMkX7r|+Bj zMOo+JMj$nz-lnd*$lK0b%c9MOJ$bY{LcB659Me$lo8`HA5d=5?f> z>2d^JT{@~HKXXK8I3CtW#r5gjj_h`=|H>_Ek8C}>{ZK*ssHs`KKBXzXF`c&Uz-Di5 zUtWiA^U`W>?SLiTbt7h_3&zgK@B3HY<9#Due!qzKc)v(wVBcv6!%?!|RxBFUH|;e| zXY;>vQKV~B$^4mPrw>57HCxVR=Y894$0Iw=lq@YhUOEEpk!72%k&fvF?WxlTasP^Y z*Moy`cNqUccI3v53pU~@){W7~?L$%xBO~F+pLd@LFYY-myT=oY)4B57e~*!&d+o%d zF+8LGNv~Ivql@uh?Iq|b!JOHQOOdWb$@(Z}%R|zAYISM;@ZsO;?fK1=^?Ta!2|;_o zhPHxeR>rIO7e{(Mn^&oJ*%^Hs-?5g?M`twa^!{l4crEFQM#>a!L?(_2M&y$OB~71xqaRpFWymjCXvT4BK@jx1zp7ZnlmQcQ1-3cCkEHv{Ubabd8VxP zwa0_A@pN(6ReHL3#`vLS`LFkTsvq_XH_p8p67}&K8oQE3190v4F796Y%5iW-JO}QI ziU#ca)_~W}>~XKy>ldNPH{h-Kj>&m^Q&(NxG`XX_cJhkG&W5fUez^m=EoBQy>j*WVPAFjS$Y7==uJi6J6iS@`?6F!`pTd*=ZjuUR(}^9>XqW^>XqVZ z>Xm{#h3>T9rCc9<-V%1UhTaziA>QZi2=M^`Hg5F3e~6C;>hb+%@JGz`1%b1NGrg*G zuA4WyL-U4o7`?FUobMxT0Y3){ufKk7Xg~CbJe<8?L60}0`D(VS())NQSlEv59`Sa$ zKd!xR@%+(aUTSyWXmqui7w}L1RmREQasPZv^!k2iUVmq|hWIXIMQ6k1;rOob%5eOe zu3&z?ou68S^RK@uTT|Tu|E|5JYWCz=v#Mr?H~?TjGhY-$d$M~)9z{h0c2<1mnX~WL zQ`P4vL1RbQ*wmC?QQbuBYH{BQdas3>FU|VcKkVV4F2r{VE%?l=Js;wG&Q^RP+|XPy zzHHj+i6IKb*A-!FeSIDuDwYP<6uuP*7eycWULIcGJ9k(TGJiNR=%eVct~KA$a&c$a zT#e5!qFs)?7I5eHdxO0dM&H*3=0JgAhQot4V%v>&Kj-%#PAwcBdo??#sjl;PaJL6W zujj+#HCTrCst1{y9|e3Y@FzmCVWvGl!WMyR`eEH z-3VOw8Gl3U=nejn8hykK z5cQDPj$YZ74_@)(6MhHh748N_AH9rk8*00n_(6x+Mme4@qJHajXz~ogl8$^+ebx;9 zeBH#$?G}!5hb0=`+CoV0vmR}xpN;;0=dZU`U-0C}P5m#*@BikZofiyS^W#m+&f0$V z>(A|;y3M>7!*>q3D2xDvSopqAB^JejQBa)e(SK-y_uT@%V8fRKLoC;J@cY}2#`>_f z3E!>oP|puO!}79Hyw4n#G<0^hbzD95R9}JFaId`w+C_jmlu(LOYj2LGvEpvXM0`(n{ZaFf6flxz^{pXor+^g{jpQ#ct*_p zHD0_0_8HH9D&n&d$1900KVIvz!Q{uysEdCO_9GF;D{szzxtGrR>SFO>Xp;%1yo0fH zJ8cR~O#1Oy`mtDikyqY)_;VkgYv7eY=a2obw_SO&J^Lr1w!?m`XFttLr~j*CalVsi z!r8%4)b||n^SwUx_Xl1&^AERUob5S={o@a?zr?d|@zQC3w--Nw@h}c|gqVunm47+% zn{alp8|j}#IXL<2v)b|C{H_X=8bN?I^ ze2DgSVf)~}-*f&f0GluA5@KOc+V9gCmqw)dc*9QEIh`gurHf3J_(7xvFV z!O!soxEl83Jo`N{`-5IQ1%K{}`9I66pZ?wxiyw%^-;Tw%#o`NGe-8={VEpiISnc^e z;@?J`?{Bkxvk?Cc;;7cO_aZmGO#jVw+sDM4VsSj;v%#cy#`3=rOD~LfV?PY_n_%L* zV)jqR;-y~u*kAi&^&N_(zaER1dGSGL|L;-%1#m#yd$pI&^6!ns`^Ws@w<^B>`@HxO zjMsq}BkF&aw=mY;<+1pZSiHfD-v)nwhPZ$Ho#mzX++WTM`0c=VFh2bKWscm%uRHW- zRxHkMM@%s3OBJ>Db+P!$SiC6~FN|kX-o0M>d+;wr|LA;7e@bHYANB0N2768ksP^=1 z@A5f8ooI_~BFEz-Y=^l>)5=Xgs7$B^C+{^)qh{#oSuBN=V~!uci{+zk7l zpu7^VzQXoN2K|s;glE1yCUOMv^u4jh^$I)L`dHyiH8@`w@G-}@?ioy$~ulM2;QT}zY@}Kq6d-`)>@DAGB z2z!m+1j_pg;{48lm%nHEp9y9m{avK{<9~+B|Cz}D z8ZSNw_WXuL_C3o>2S?Dp5~Qnt>CbYPKONkM^sA9R9-8*YH@);FNMC{UQC|8%FMSl! zHz3`=KKsN=e*^vX0Mh;A=X+jyPk%>7?VIn?O?;ad=dW!)M0t~-$zR_8m|*M+oLg2z!mgW3KQB7e6U3F}c&yv&Vn6WUq9j>!ox1ZTI38u)hrUeP54`4*DVeI;3MW^wFNtk-vrQVd91B z$I-#F*uIOAAH}%*h4C>u_!`n{k*@onPX@Zi0>%bCf!__mZQ1>ik&#Fy`MYvHaJ> z?1y^=vizIirvl@*TKjD%w-}?KKGq*=WAT0*Xf`nagR$~&i}^Fu)>j0(;$U>}PAvV= z*!HpiWnxqV%U>94&kt;z({&c(dhi>u{`f&GKHJ9EpsZqy;tyl(uZ+dN5!H-iF7#qt zm2*yB1^P2N=Koo?e|Qg693+G7vHm$6v%kXHe~7Y*alZPlO+OIDFAVt3f&%NiHx|D$ zwmq)1^=*c2F`laIjHNHN<@1?MF^=MkV&z?Jk9TiJ`9}uN*!b?qepK-DSb4|g9RAY3 zKg8m{h?PIw`WM0uS5E;BCqa^pMkfmp6Z?_#;I@_DJy5IIIp{q~GvY!Rc+HE)woZv=7 zSd2x?^RsN)!19xD$1#dZiqYr5A$} z=TSBHz=^?zIUdB5$UMOzuXf7L2e8i+BS$Nfpnyup|-@2KVAm zc8K9E_@n+I%g?P~^$%J4cG~me8i6c*Cpc|&vh;_*Deg1~Wa$rs(^e--e+-FY@PtiH?s66X>WZXOFu+=tCOWaOMB}BS^8nxTb(TZWw5q2SvrqZ+SX+0JjTg? zvh*{-@}DgI9NJqy$nBe>qH#`^ z4achbfh;{5w?)hu1ii*>7|B7eacgyd+;SWydBKL@kI5?P1B^~qz4O7TGmTD`z7U+Y zI$8Q+aAtH=d^Ar&c8uW$=*hFNLLkeY_eavn(s`ei7;EzG17~<*MA%Q=@{`oZ8~thW z1jC0teuefWMt_s~#fFcA)z4(r%je%3Z)EB3(te`JOP0=S{O->hVc@LYjwx`0Cl&<$J|gDt=gC2)pUKM0-DOEnw9}mQ6cYb&;j7qP^W-Wa(>YZ*{WtTWN2% z7g_px+FPA0eG^#QaSK?!k!7SXC}fwL9H{vGlahKJ+)mOR&t2eRx#aOO&5GY+hN zAj^i&-P8|c=^5I8*5oBiFQdKH$pSAjL2=h5ao<0n}*eAcGpAuk2wCs{UQ z!19wUou{tURahaArE?cbTb(SOyOZ`i|C+6ey1mvS%YH66b2U~7^RZ-^h`{Ty#I+Gd z*HM{ShMVw5{*zTs8(996rFYW)b66perLP93txlHS4VM38>6^gW&trvfHx~Iomd!n2 z`9PMwh4yy8BTL^(d#jVBZ>RkntPsf3cY@PaCrjT8md|AAPgA$|r)25RgXKS2`Vp}F zCrf{c_Fu#bfh_$fIBj*Z^f$orhb*1<4w-on5X!(w`=FjIn=7d&utFe9p99WZ7sEA6dLmi>C# z+wDb`zJc~uCrjT9&VIr8wga5F-taE4{3OeMH&}j>rSGBrLX(#)eIMmUZQ^fll_l_`hwm?jzw^ExEcXm}SmIo#wWEAJlK zUt?_c)5e}p$+9^J&RUy8V6~Afn`gmlBUw7HRdfs?OMij(_83Bz{vz$|v4Sl9W!hVv zEd4dGjv>6Zk#GKW&YR3zWZFnpUS9vmH?nkI3&}UK^!I3QeIQH!fc91=OXoXq@{R8k z$v3iW&IHRhvh;Ik-(-9yOCL;otCOXV0P8qImdFdEdFLZ-d7g;tN!K#ZaeG~0%KaizwroGk4((k3cZ7*5+{j|3_ zS^7?}`e7GXzL90K8!X?*()ZBb`aqVxkM>q4OMi^^)(5im{j|3_S^6Qce0v%!-^j9g z4lLiu(x0cj^?@w?2<@#-mi`j$tq)}BM`>?$vh>%%^6f2ff)~pOAAohONS6I4VEIp$ z-XFhl$$zr+Gr_5wOqpcq=g{8jWa&e|*>+<;0xW+@!19MI`!cZnAxobImOo_aGih(@ zB}=cMz17Lm=YVyeMV7t*tb3DXWP7brPhM&KZv)F`vhuD5%V)CmwP5*7mcEYm);F^B zZrWR&Ed3s^d?riZ3eK)Dz74}4`9PLU3M?PU(s^%~>ck3xEPV_(ZFREr3|PlovUJ`~ zCsXD;OO{>*&U9ggz)R2U%@IbwQD%5UhQQ0O%qRqs}C!q&CR<2_*Y4_Ws6!0I2e^v7s_D^>_(>HEQHtCOWa3)Zy?S^5j$ z#9w2Da1@JtJMJ+b`Kc{r=$eNto%c0~ zRi>_uv`J%yK$cB(|6*+PF`emvh)eG`zlrl9JdJ$B7|vJ61PVfeJ7IGV3^}pHgmz*JB+@F`bNV` zsaxh{v}|UA)hA^6Pytq-kfm3GQyjbql~|6crv8bHGU_B=!OXq&1-;c=B-v?*Di50>JSomAg^Oj}v5#szUi8@*O zC*Uj}@GxLVsa<5*6oJ()vh;zp|CY&0md?kEX{(c^^A<(hlq`K5SoM;nmw;6-S$c-{ z_nCUh(#vRXb+Ysdu<9jC=W&32^$#eDES=9c*jLp3XB~Gz*RhK%d+z(v{o}wx&=XsX zpO29L#_)4swU?}No(HSFWa-DinZGr8UjrvBze$}Z0fcv`|DE9vJTB@F{o6(#Otv<~ z;OsV|52wD}a7g}+;S!I_Je~&5+H$U>Zn+Aa9D&La$nu}RXJxF-BH9czHe}hdCrkg3`e>t*rT51@W9ILT4}-y}T?Lj+G4!<6$Nm3N9|o)6$kO-Hez(a>mi`FstxlHyBv}1MmVOu5?wAIPdUjeHevh=s8^Ms5*mi`_%^Fyk59~+C>NS4iqV6~Af{RHhF!3u#a zori$5)ydM&1#8TZrStMP`)E{5z{9b8Aj^iX%ZK=Ng?xx#SICEqSI$hZd?2g*dDQ7F z0$DomP2>+*`Vz4GAxmFI`^QXM$kJzH^G@7V}*|$*Vfdqjpo#Q8S zh-wh5!IGS4Y{;_V_|b2~{#d#jy84_f`+LCZbF%a;wEtJE5XjQEg40$fOMeWkwveTt z3s${k=?SpvB}*Sd`)9C1AWI((PFtNU{bbv^3^o~_tPrMQ$^In5U>^P?FERZ_Rym8o z8EeCBA)o#2!hKvm`}_M!+CPUC0$F9YfYVkdOOLkQrw|bQZ8sQk)k~H=$Gqx|kN?zR zBqI3ZKZSVO>SUEO0jzCAmL83B`|hhh&Z}UP`6*Ti9Ov@QAMY zF9fHpPL{q5oc%Yf5ID|N7g;uI!K#ZaeH}RU0#*p?ut?|lPg~vJ7dXy!ed3S#ZPc@7 zY>-vXE^y{&SRw4jBHzfe*#nkuWa;~8e*`N8vh>HmX{(c^^SVp@z;4R?J5~rZRlQ`{ zzXVpjWa&p~{~}fhWa+Pf(^e--e+#U08Cg0nN3uVMfWR@C_>Tz9^T3x4m*J0mBP;JT zuzVv+pGo_nSRs(5SAg|94q197IQ5@cAyi_KUIk8Doh*GGILk&O%*P_%$g)`omTzR~ zi)n9tBTHXOd#jVBF9*vvvh+Hzd?QP518W~7OW#1l{3I)H zDeeCYD+IFia&X$}Wa$-P`AL>OmpUKRA&{jn2Pb&Jf>4ho_1_UjESr^((pD!+Uk}c{ zh84m_ESXxTE@PxgNdM}27D$@ly4JtQZm7~jY$|08hb4U_i-{^(f*SvDLN zdKN*JUIf;&2(olO4%4#;vh=}VJ&Pbq=d)97FaJ3zAH8XNk!2s!{@2E5vh?Ww$m;(6 zQ7LS)ZyNg>$e`O`}a^w zkym{}Ryp-x^$A(}O0fEbEWL&H$4$Lt>Fu<)I$8QUu#UH6>3qhk{uz$ql2aidkYzIl zEZ@k|xv$B$_>=bKL?!o4OR%;j}mW382u)av3x6} z%x{gp9)Ge{?*_|fvdZK>C7;RCH_`qbtPsf3H-pnwCrjT6md|AAkAbtl!wTVXEb@UY znj(^G(&I zotWvdR8uc{Gd;Gq)?yyMTy0@;N=*S<+TO|u2}}Rze^h^pX=G1XxBU<9`>1(tE?1A) zNOQST&(mm@$Ugk!48Er^@8`JHLDUIuBF4Ta!Sttn^t%hQNY>@*(H~8@>L$4CimA)j zbgjs>wKukOayCn+)AN%~w#uoCoAWINYd0BYV@qRauStnd*^NDBFU~h(5?JSh?^`?c zQp+y+TkY*$Q*}+gsRKRH*ipNxw7Rpiy|JbX6PLO^qdS=R6I*#j4bF7N*M0VY=E}Lwma`(QVtpM5iYy%Jg7idR{vTv072vnd3g)+~$hLXsxYo$nDhMhsDLJRish47&@<<9uDQD7#-0UWL)N#qHs{)I3`#K@Z@%<% z^KQsuoYeNTYp#p7cVrsPlzYkzWV%d)gomUYCgDZxn3LC4@9%r)2B$~ktFsz;3fnoJ zZsvcD8JyCk`aJ56XW%@k+!B~twP*dr1g%- zrygj1oF-14q1X8VJEA)=_#?>-o{qqz7Gw?F?VvR#wo-!YW3>6 zhG@*>SDTr<(G#b6wmr?#PUD=fS%z^?>FB6lkw2ZS(JPO(gFDF8x99V2ob-r9BcGH0 zwzgpCc~(p?{er_#YkQr`&IErFepN=Ddp^$~wO#G2@;FM=x0>;cKF>AQ1>*{(VE*H# z)>_xYej#Q9HRNG{iaOhG!TP4IdD$0v5<75SW*r9BtT(oXlhP2X6H z|7U<_5KIn@zqd5=Z*MR9oTk~HdrGHYCYt7Gs-tp8Qye*%KGS7&G}TeLqbZIYOuy7+ zbu`scxuYqL9890#vO1dTsNB&MM-HY>cUc`xbyV(XilYKdb6FitbyV(XiX#Wpr@E|; zraCHjG{upF>E$k~qp6O{9ZhlMVEPo7)zMT(<&LHl$PHwSD9n|u{4>f#(;ZE7G}TeL zqba1a5VsAd9qvAxGhY|N=61}lc5WeV?kMqF3V?j3O`29PiKxGgAL+wxsb?#@pTe#P zdZkTET#9G-&@Mro{xFSh;6KFfQ7`Y~ct56~@{YjHFK^t;AmBYZ%R`bYkMA2ncI}vj z$Xp6GsJtY=FK^vt=G$hLcNP};cOKX;?;hk^!bBTX-ay3t^7i3jR1^B1<>8MjZ#6pD zFYj%{x3K{>sJss7et9Ei1;K}KhUE>yBLBV@D{mt@mD@-`O>;TV;fc8 z)v@idc(D0hB3|AVvF&kUk(t|v<(==9cPH3y?~5q!Tvld-{Od-Xa;4Sp|1!Rz#D-vb z7hsWp{m{{Vd9N0u-aguU0(t%NnsPz#1_mC>OM2y98Y^$j5cD(B735zz?ELcP*W$M% z+kbo%EdMy)qVHcj5)Y^_{8f3|VCR?DoezSyk&*sg=#}?*3?9F{(qTcseMCX!Rl&|L zuWbdMz1Z?T17rEODCXajD6c;&utDX0Ddyj{2E21(+na{1$~z1F?E7~R&cCg~@K@#a zk8O{N8!^|SEpMb(-c7Oc_TXXH?mql$ij`N_jNhf;Gy89pSKj$>)c0>;3cmMI9^X}B zn<}v|>}d;v*I>u;Mq^QXe=*3ES56~@#psM>@I`?|b4l3kruIKRCI~_qSsO+xEz9mG z?5HWQUWUE4Ut~9YtocpUq#FOo+!t7XnN7&RuFf+5FpW#X?&s7PHp9*jv|$*DKE*%u zh6%KrtO)+ft{;vsXUzSy71BB;Z^C(ozO(-rWVZ$VqBc-Ji1OxRhh+Niu`o{p%l`wW Ce);YI literal 635878 zcmeFa3wT{soj1Hrl9Q$vO4?Hjv>>Os(Z(drNz$u`Nl8juN+~5&sMyowE<2}jVcyCL0vZtl9tx5T1UEQr6z47**jcNJa$=8BRXh^gq{VsWII|q-8rbuI=JK5g3+4JA09&c~h5>IyYcDE*b(j@g2 zoC(`ndwS!E)~=RhcTZnyZ!nQ3h&Ok4w#Qq&>T$9S%6pJ;hu1l%gOb@9#5)?={k{hk zPLhYG8sC)M8gFdvZA*6eis@-M#fkT{Zj5(riZ`^K+$pLBb*x&6_w^)u(93*TrO3N_ zHu)4j(Txg?C)!%k9`TlBTU)13oapS_)S9kCXufk8wzelb`vQGHi&I+Cm_xEY@2GMb zNhff;N#_81Wy0?`o2V(ivAeUcE8g1~N2B`EnaWBl>TN(DN=ebx-Pzlj=xmE`MmKBi z?C>dYXp^E06aj`qu)z+{zo?21Kj`XRTlf8)+9O_+xw!@&B?C@vY+}66W1!e1Q=;*Nr z6K3Ar*4NV#M+XSn>Fa7jJyR0z>cohQTJ^P%F`CjxbdO9^d>%HM&B}%=Xe6IS2sgtY z$5#w{U2Vx;YpA5NsJZ4OkA934*66C+sH5rRiFOU}=G1{ZLd`iADXd|Wz`XpUw;fC&{l{QTsnM(KU!|C2Wf5qF~g^lg^(3WazJ}-FE zGOgg_Gsia6NwTM>VPn!c4199-DU4o8)S%Hx6*o8ZHndsgYi?+5>+ALp#JYYG$PT&a z(JkK76&UqUPd$*HT**{bYe)L->C_AkkFh&2`(xu)4kZnn;i<1Y`q=J5p@XLyR-jMS zDUpwpXzPUg9i6?c&0Bo}=KyT(>~2rjeS6_-V`m?#*;Vr;<{*TF@nkAa#(nnJmseO_Mhdv{W*|6Fvx{Y&m z;B+rp%Yfq_j(t*JLpU86hn;hBO_ex><&-2<$T?{kL!+^wsl6eA*>~`i z&u)ryd&9==hW2<@Lt;~KjB{M`s)bXW)EOcUzlOfvmiEpj|FQ2R#vl|N{2YFFVB+pD zn;QKSXZqLJ>YvDx*WTNgT2yDuOXnd|IFqw@qA@j@w2QM~@`;(wNPYax4Q;K?jL4dk z`xKnASVI4?<47?M#44R-MRJQdy|Mn%XeM~3#gw+WwJlBcI^!8M(&XR3^Jc4mV#VPC zM`lllx8&7RCWoEY7;6DZ66wqtSyM;61@l6`^G24oXHYg)$7pHbjJ^RwPdvE9acVBe zH2DPCq8n^;)&Of-uQ1(##8-cQ9jhUIT4v6I5w5GJ!7t$%si_4=6pyRMKpQxoxza@M zmUL;`E*Y^`t*rYOU#Xgbn_L*G^=7vp>uq6CvRX6<^DpdZCN+2&=I#az{(+4EN7|O$*pS$Yp|~Tt5mP>N;lQ%S(fVt| z*jvFQF%ek%q?(C$VU+Fk&wv~)8Qk=V+}|pWLPzowGRB!%TpFc-mEa-8&SDnLSU+Q^ z@Q<==eSNT_YI^$G{4GSOb%bI1qmN9~xvwPydMUDW{ex+oWwEnQmA2uiqL;iU*TJ!a zhD$y3Fg^P&7sqBv+tskOtuwGR5H)nI%)~KYuz{@>Ym(*QzDL^;GVViW~|0C zO_{``qubesPiaoA;miy$Quut)rqhbFo2Esq?QWX)cMGp7&9->Tkmqz9ZNpt=r5upX zY>r2d-t-cWve$T@EjSdziY?!@!8shNmFYtE)T{#o3T1Tt+Zh4yU7ek{$t)wsN3PMO=VyGN*xZg zeTukJ! z?t~5$xu=s``8~pNmbl*abwA%ZP<)!sMP8euZ{|P=uoCUT970z>ldYoHpgxW>;n0Uy zDqoK;LB6wT=5tT?oUydiTd&kEwkE{<1g8LoV%3dxm)!g+U9$_Ts*K8p37@W8xil0C zDG4FG-LXBFy<1Xa)t9}LEi3<`Z?p15{-(Q!nzNzj}VYRdRyepSod5t#asA!@7;HCC9PcV%IIw4pG+?1p^E^C8dApZ#Uj;5YIQ@6M@V`kX8IzihYX z9zCn(n0mfV+y@|-%0gufB0TRKoDrAYK=sk~=b zJU2Y_?)%~7O=q#r4-bWE2Wrcn8Qy!A8lH3{V|b#9MkanEv|tiyW6~rQ8UJ>8_2a5M?UwVcTd85nU zUU!Cy>-lCoIv}B|+~iMDHs^?<+*_D@5-r zK<_KqUR+a<`N2@Z_75J(&qQl(FR97TEDhyvFFlfnUQl$ho{8Ro4ZWXJ zJN)}&@0abLR1?{}H&i*aDOCB&)94j#HN%_#aOPUCe!?G8i4#w%#Om8sXryxJI~W6A zyx@_cWR29Q_?RyLfx7pmHJo3zCp0qfdT1mPRv9=pGxM{*tnSJFhRPrJ4Yjwf1!Ief zmhFEe{Fpn^jBOJwlaKzEza4dq{+5samWTe9hnC4hf6GIEo0W){M`@l4qZBD`S2M>HatENHM?h`TE90uE)qUc&5=jy<&LF`kGbV2oanSo zWZaSJUkqn|+F!Skm-%qH*Q0NG1eo}8uB>eUTi46~6 z^m+RN&>I`q>8wO{++s{Hr zXoq8^PQ73pMvQUe)V90cLL2U_jbzm{ytPM0!10%777o6TG#4IwKN9}kr{{%_)UDs~ zhFc0shmyPZ-?KN2(f{7iP+cPTo9evk$T;YZTQ{WhkU9#Dj4c_%O>d^2h#iS;xwstz32aQNzTIv+`DBPRd*VYup zeJs%ytP_(R6I9(LwaXSquaw^|18!8Rt_RCJ+&9r2#Z9Sj+-%H8E6U4aWwGe&mfqg3 zp2c(LZfxys>1!;*l67uUlFV&u+uUA?< zZho5HV$tsbUxW1LBTD^MS#p+V6fzxj`acM%G+iFhpKZ}^0rx>4W?cI#EVaH~n?MI-IFK2l*#JU}EOTw}9?d2{s`nUo`14 z@~WvgS5zDNphJh%F3Wx{cvm1Y>_(i5qs}{al%o6wqtD}DD!l$Ml}(_0kHKv7sW^Uq zW$1^IZYuikw++o7>T@h%U_DGl``@EU=Rf6^dyamA#h`qGp?Qo>MSU~Oz1J5)ziG_bLaIUer4mffd{vi;HPBU;WJE;jJ zrel2obO}2H0)5Lh*zwKaa`43;VzJ3JzxYEe{Dr_`rxthyI|Bl-=qv-CY52s#=U5fF z9RCoAg-<#c>q>@d#N0E8lv;`?m~A3{5=+|Ez~U#d@ausk?FQf(lkpE>1ET0O0napi zV&QiKi=V{8-$%ab)WpK)7%zD}Kzt_tAv}vXBiDfr7X9bJnrZmN!haPwcdFL^34Tf< z8oz~~8Phy0`u`5rOv5J@{yV_pKe6zqp?{12#KJEEo^ciw5r~Cf3_R2DiG|N|hS(<- z{xXYCEc|PLbEj+jZN&P}QoX<>XKVg8;2Gz5SkmqQf2QFR3x6N5_&_ZDgTN)6P$2N! zDfLDyI*$TNy%7taW4G8O7Cvp2%;bO64`PWKXo@Xd1}y!PSkhJiOaCMmK9BueV`mBQ z44%Xhh((9}f2QFR3x5r;_(?4MX7aDZKLldocL2}eV1Pg@{BGcxhEFW~n}NkXvGAS# zZ|vLsA1W$0%Kzs0oux5-&NZ0FtYG>qb!Gd%7JR8IV#$|douqZj$V3Qs8M{Ew$aC0= zSkm?a&oq2u;qL~PG7<~_AaF@O{vq&KmgARLbRGhh8`G7<~_bHFp^;vWLB@V^K= z)9{If&%P9)g9yaJe+)P`My^s%AeK}(P(6vCQlsL zKC$q5E+{c+uLqWTCKjEWfpZsYn}ft$v>|+!`eytg7X1<6Qg$K)&J820JuEs;SUS%E z&oGlsV$pd4c&6bK3;$K%l119)3E7It>Q_0*kX~%_irp4vUQzhZ8tYyx2Nm)ZL z9+_>#Edo8NY-JfAwLC?3_CwQK=9MpsBY)hG*X-SskL@YBPq_>`M9H#CS6y9-dmr$W z=P7LS!RwQ&1fI3V{dmr0x>KZbp64s$R#F^KqTmtGji*Y$=P)<-bT|*aG>@(9Tq<^- zRWEDo=_%9KJ-r9m3!0RRf&~PhGL9*W1NL~F9z>KN z`OXX2TMc`IP@+99CB@!yVB5bpK<`GBAogm(V47+pI1YP{0@EJ%(!}1TfPcSi4~FgE?1)lPB&0pImDqb7*tWMA0-i4< zh`pbHVcT0a4Ycu(OH;AOaoe`{8&od$9wZ2y0)}mGB@(`C?4c@Mds#4M+j|F}zCF#@EAn1n#!Fyns`I>2nqTchOgkQ=SIUV7znR2K} zXsjmC5=4(_i6wNgQLP}djo`tzE)h|0t`PVYy=wq6SH9l~RzJl&E*V%}2GM&1Ky2KQ*+C4#lZ?Tsj>bq_e@mIt1v33zGq?t2RQT7Q@7dJl?$nwDcR5D z9VSLfBuV&zT+h^B>GG{-n68$;qoGTMuzgCsw z#?>Uc9#_{~?x5Vq)zQ!9N2iAdj^287U}vg53pNcJfFi)26K{3kv<#QRJ_buZT4{`9u~ zo37s0zx9UfSMrV*y|m)RRWGc0e(iJXo?ZV;<1x0uz>)lsES34eES10*kyE?9I4iV$ zPHiZ2PAy6?UgfS%^iNQUuBX+&Wt9^SRpWk$5!Nxek?;s|8>kDdcx2+!)s^G7)>KYf z9!hK|2~}oa7kXs=j?lmx(^e)BE&(4DV+hISnG_ir#q@S)%oG1+Cm!baAPFF6?8}hDShU%CGS4MyP@anw! zJL)s8eP?;&ikDU_x$NP~@>bTNb^aEvYjHg)A>DN?j$vNFeJ~yYG)`TC^yj%eP3HyZ z{s3JcpsNG)x&XaCK)Zt$^7s2Q-tmWXYaKMrbG1!Z3yCux{huA6Zw}BhHuDTg{g!~d zEkJwzYkkjOO>YS3HwNhI1N5Lp`^!7g@n^Ct$I;|sf-@X>)a7YQ0|u-ZgTbrlw-Xb+)m0 zheMBZ&sS9A`KXrwVK*YLgDi6>V#bN;K0|X~h}S({H#C2kp7W51S(Dmp$q5#p*j>8; z%e4vWmzaqx{VnB$4q-N;Tu0#gF*k=?y=Juc|0Cs^UyC2HzY;i?86vDfEafB&fqOEg zlN{*m-N~MR2l*!74B!&enW!pz>8y)f78Zei${un7F@*^9Q})cc^-wyET+9~`OU*vE z;~NW&uo_YJpB>-MaoCE-y6ho$0q2^%-%kOTGINA&h+=c6g|mQ5%$_Y(OD@1a1jo;) z1J!)|G5wUiJNj8_Ivwj%_7B%t{5JA0#6N^Bh$RNoXW{Pvj#S|v z0L`amH0XwNxP4; z91Qe_LF|1L*zV)cg041l_HXIqb7SU3$Yzg2dN9fKecXHM=2Xvwa8Hl^{C6Ke`Kcd$ z-1oTB|9LN0>Ppmiu%9=8CqeoLe;NPQ`}wsf!|C*M=ix8DFZMLY@~ZO63VleNdMsa! zNdxOr`uTKFFDE0}(M&uqbWVOWtX3Y$#V(WH+nYaFuVhy(bR=BIy*%#LO|4sbW$x8^ zLzcs5_)fzm%QRMC#g^pC$hfZL>X?cEhms&Ms@4#{Y zE!`d$tnDe@y?qXz7TUwztWfQ$Av{lVW#aa)s&zw$hSpowpRLFJ@vmnV?#5FN2UWO^ z&nOJ7@Je%d*R#h%BU(O^RvsETv3wKm3i;-4D3Q4{6WSl_YV8~ zL%TAn)C%lig_cSV&J$Q0cyIiHy0H69Qs_wW?!2YceaTIIcz5V^K1Gq}>I)66I8e97 zm3SyLGPEKz($F_NA)Jey&5^B{tA<{)$~&+kuP*<<^342$_h+mfO5HW%o|$gbqN9fg zcYF2pdPeQe>V!IoC!>~K9XgW89a78cpM4qoZ}mGzy=PTCBs;q72caX{X7S)MJY_bi zUdp~~wIJ4du%B$}uPk~I*}h8uk8Kg zzlB+dQa_Y|496YkA!fM=iXqe5BO{&VtP_Yunu0?X4*^ zE$4oYqO`}gy6F4;$#LY(BF1cw`ks!as{``E0KGFn^BSKHI=wfy&~$Dg8x64rdQ(yVPX_dP-AV%WX9nmS0`x3V#xM1`MrT-qI2HB(4Tr+LJ`O$Ez2ADV zL!Su^tcy4aL?Eto5Yu7}#Kkaw5hJG3h`*^0E-VVP{-`m5{u3&z_J(l26c=bV$t~xb~du14qolf>`usF6 zv1G61nlOg`20RG@Iph*&8v&0CJ7gGwV}DSO{ZxYJ-2{fMw+ysxQ}nigpM_YB$Z#AE zT!dc^edIIpxTjyXy-$H&g(yMnQOCBIi*rmpc(g|wV(&U&+un1ad0v$u_C5-RZLbOT zjzf?3a*T}rEdtNBcODF^0bhdHp=n(I-UGJnb-=(v@Fa-6KZ0S~ zdlL3GfJb}ui!%Ox716eL2nIOrNDzD5p=9el3IW?(g6Q#{Sv%kJ;5^%y`SO%1`Ep37 zJu|GTe}{o4&=M$Pe9im{e~sN~E!o|`5Ovvl>GrtZqMmgR5Bog>{bOLB4F3WkWgCKd0K`s)$vZ&x4(M?SJfY?T_v!U;@^MIpcjltqLA+~aSq;|op<2D7yu;axfK425e3MByIh(EiBIYQ4&odzLcmhOB*% zoH~8aQfA$~>ZY?IeZN2R-a5WpWJ36Hln(nSs%(Ew4e~>osI%44*>zH#K1b)vC)H^` zD>APRwU`+}UqTEaW+8?V?|UBibRr%`EE&adfcPc!r?2rBu>f&4;wFXTAHUNO7Xg1A zzxN>Cg186qCd3}ZPaqysO6^4aIB)~vRfx+GFGs9H{2=07#4jp5Q^H@we8dY8H!55Q z!fynz68J&<9zfiIxEt|Ph~0>r5uZ}9hj<p=b=i&Eu{N9e=I}tyJco?w_u?w*o z@qNU#KU{Bm500nb64j97|Th?s>qf_Nk16H2KX#9M*4Anru$MO=^Ah`1VY1>!2i zix3|~eSJ+S^*G{w#9{F6M(jjvMSMUh9DBGX2&eAlG2Zka;^Vl$S2K9OD zFkEirJZ?0dsWK6G3~3s7(IN17(sYJHvu-qvjV%QBO-<)GH2bNhvmKi4py_cAJ$_Wv z;S6nmf}zJ5I$z`%`)L1zhMsKb0?`j^d5NKO4gEDk&o=sB_vj4AUqcre`GX$q$h!?a z&B%KUJ>A&fVd(RX{1!uBVB`@)hck42a-3lpXXpz@9a4p}w0y3iCmVXUp~r=_yxh>a zhTd%GX-5AOhMsQZyA6H5k?%3|1xC&>ks&v%+w+T>ME}t=$1R4ip*Lw#jWcwmp~D$k zpJOP)I75GF)FIVuqkoS_JN3&klA*}R4~#k_X-EE)Ce<_}KW6CZhOQI2$#18~4gIN6 z%{bra-(=_uOnEu3G316rPXFRK#4s5*X|sQDJYvA!xkGdOV;E=XxtdgATy&@YJVTE& zG{;Pa*+!q^BLirsd>r!_ij17&8v|%Z&T)=mnvst>6z&BxG{-=OX(qoxO{(dJ=2*#a zzR~B{%y5Az@8nU3g#Y6m|Iak^I7817d6t%QTxOVT=;Bd_RO7;0&hr98uAwhAuMl`#jo_^Zdgw&B*tUIwZ=c^SjN^=NtLo z8TtYvKdjYJK0SVa)zG=nIT|fuX}$`h2y}(Bs0Io+t7QP0ts( zp+9HnX(s*W4L#kYe?aLlIZL1KzGmp$u%*s3pQb-M zsu|Nvdd_JWrknJf%P^d8(DdVPMq+)b}(&c7KhHs{ZkqYjDkYxxa^USQh0%a!Z?@^M2~ zoB6i zzN<6z0z*Hyon_kmxZhB2O8+x8O-c%s;b!_UucYIX+%By0f zm8CUxSCv-Gn_qhAC6||8wXCLcVU;b3RV)+a$pPv7q9t1dh3+)q!Jd7qvpOMZHqx~8ns zvjy2smn^x2HOfXZ)frG?GoMn)vSivWy|L7ukzUWr)by>f_56KsY(4b5QsGE@USn7Ln3d%!pH5A<%BNGkt}-pBtvmO48oQ79R4f;*+ViP6 zRik^FzsMW z$ug~uIh>KL(_Se$Rw>8Su`2D9Moyw&j;Hi4xW{9P*vWmYv_@!-Ltk3A$}RWP7SUBa zRb9A>mc`Wax>}aGlW5Ua;6O-U44Mn{a<_Yp(QAD2G#RDH1HHv3w~7Pkl*lI!R*Fw( zB~DH02u%y8rgD3RPvqp5E{zeG9^s~OTg7rSr5LV~`sj1x2&?jILeMXRp*w5a`6| zl>(lnDy4BNy;2&VQu|06pHh|5_~cg_!>3dw%O_q=2w5@9y1qa@Lxzc>M;*bGOAwy? z{w+K`70(p!aeoh$;ucq(4{XfX)LJ`WjR`@1YU;?r}=312SKp&|6S{7lD@a55gb5uR-+x1OD7$(U*Yc^IU}{{UH2% z-J*G4Jm2-G>;GI;0J_Ygd*R<&i#`T_Zno%Ypn1>tEMq?b|Gp18-_Uo%zqc&;&*0BQ zw28>eK$n3oHTs?K?_(DIUHG%pqR#~VO^c4hzc)bVoAh6YKe!a_((gltSJAokw+jBP zvgkqh*K5%~fIpwJ=yO4jg8rbfzYhNWn?)anKhxoZ$o~XfW6>*s+Yk#(dfL9-qThml zk6QF1`1h(scf!9vgO>Vz6#kr#JcY(>8R}xt=NtQVtUu5f7)Bgtis{$?kd)T7O zK)+(qH^bjQftK;$1^74fOppEm=!-y0`P<>&wV-8uxCj1ivE;voKl?5DLeP(bo@4ym z3jcm;(LaDc*_iN%{9Mp;ExHx{T?4wvr2jVjx!Iz}gFXm4-^j0lf8V$0+u+|@pg(Bj z{|JB1n&Q#|X)@er(ZSf=-JktLBKMP8wy=s@JV3b>AA_y8i` zF}jciL70!oZ>>G%Q2HN+0o88wiyirR_0NXZ`V*b+Q&F4qalT`;*2u|Y`g@K20!MzP znrh^lo}xa2`ex8{#Cab%X`EtU4;>3ZzV||0$$to}1Nq(yvGCDdTzz8U)1K%P3!grg z&;SD0aWl|A7>GrOtu)i{iG`mBJOllWHi(7KV|S+E6AOPau)H5(39!8Tpcc3k#{t6{ z#1fp(8P+1Qe>1E{lzJc*n@zy-O*vxWvzqA}1F`VQqHhfR5kAWx?^$5kfbRPd{;!si2L*ytMoxGTW+RqzvV*|7jr`Jq4i-OI7I_ye{mJFz0fALE zBTA&P=uZbdGfFPjMu@_9(&jmAoi^XYqT{4B{FJmD^bnkUSqOuDX${{_%fl(e0Rw^c zAL3*Jp#U*d;y~va@=&S9wd9v+Tu(e#WA^7zxyHT3F^va_D>U9mY#cgBT&4Ms63^54 z81a0Kj}tG@_)X%48ox`tNMqcJu0lLm5%}Jl(1$cGAihXrKK~v1u*S8-7i(Nk{1J_t zh^sa3C9ctUka&s4`-m^m_#knu#*Y%$X?%=$sm8~NFV*->;$<4YOT1iT+-j{tD>R-) ze3`}t#49zfBEDQ>j@hAA8rKtFp>Y%OYK?n|uhe*uc#X#Uh_BN4AaT9Mj}l+4@iF4H z8XqVAsK##+U!(E6#Mf$!Tj5n`oyL5>XXs-Z7Z6{kaTW2$HLfM*pomaU9M`ysc!S2h z#0?q`5;tnRk2s<6LEK;uE; zZ5r<*-mdXM;z5lcB_7iF81W8`j}zab@teduHGY?Pm&ROkgm!B@jd+j7+-nQns&N(Z zUX5#sZ_~J*`0q4sBEDVYUgFPaJV<aTD=~#=XQ})_9QkfX4fX z@6q@m@j;CrCB9eVW5kCvK2H1`0E-s5kI7HFYz}t9wdHP<9)=BXnc_PQH>uZ{-(yqh#%AVIPv2eze)Tpjo&5y zw#HfGfuGQL8u52DE+BqVW9~_X{vVBNiJ#KAp7^^OHxZ9&+)I2!<3Zx18t)_ip2i1> zk7@iU@zWX~BYsBXgC5`tH|D(nSiH~cX{ZAq58*lP{qMp94uFme>WRv|acJmpo zL~B<|vb(3RwKs{+p5bjrt-YcO|-f^RxLb$-p=o$YbB*V>Wx18;QCb4k}Dz6BS@SL7Pnm_mQ;tZZe^Ct7AjYN4Z{J*lj= zj(2q@o0Hwij>MQIY;7mM)~3_V4Vril)L8GM3igF0-p7CHma*M&x)72Dx?@k;H%#&4 zc4dp)Z}2U2(E=C6=DW~Cv3V}jL$NBC>7iJq%k)sJ!ex3W7IT>vDtDP4a6b^Z&_xSe z6r1lt55?xWOb^AXT&9O&l`hjmxN|_h|L38Y_r*dBmAjfQSmb`aaG{G9xF|N?g&vB{ zbD18BRk=(L#VTE4HV>cOMtJXn~7j^Ihnn*gTi%p;(p6^iZtQWqK%9 z;W9lG^FBmrp>kK#1&iE|QsVJbQ)>%c6r1lt55?xWOb^AXT&9O&l`hjmu?m;zp_uoT zObeB}ngHGxFssU3{v!7SnhRaDz(uk7F7!}rp3C%5tjcA2C|2n*Jrt{OnI4LHU-Yz4 zxvS}dMef%<7rJPHi(>O#=%Ls=m+7HcmCN){tkPwAC|2PzJrwgkH)^4BPgA28cw^E%` z%t9B%7P!zuvH333L$P@-(?hW;m+2uqUM(4UC|2PzJrs+%OdF9|9@R6`)BE3z^*sLE zF!vJN=YjdHgpdJQ_$9{j%?VZJSAH@K=*4eP&n)>J4bkJ$pEj!+Ty-~>KBT5i^rBJf%y$gG7 zP@+970bP3=k-)b12gr&MC5XL70NdV%MYui$CECN1#g{pd%duC5tL}} zOhn3P??(Z9+$T(D@A-hehb((jEPHr8l+V9!jbZOSIBNU%8_QnAvd8v>3Af+>1O)w- zAmu&4eE~2ljNsQGc(0%Y=EZm+BK1VXy(!*9D1kZ*d5FZ-hzzqo1R861^3O)3jD9@N z^)P-V-+idunsdM~filM1@Q=Te@2hZRw$b5_~aYFquyL0@GE-r zQ2_hBne>F4QG!mw zkiLBGdiPD2d+QHFllqx;*+_j&b^d+-rWOxv|Nee8RC~@diQDf|nHOf4gns_))x+T( z3nJMnW80n1dpU6;;k!1)Gg@99gROffhE~=hm-4b5iQJdf_CtGAWXJE{`|w8-UBATD zfq|p=(#O%zQoLKU=GB_~`@X77{!6n}Wd3w@)AaV+s_F-h_98O3;q2;i+9Bp!LRTLP zp`;Vlw5ylFqpZ-_-kg}Xe(2CGQdiou;V`Xz6W{J&iNma~doMe4dtuhZ(2;>7uI`c0 z$ae6pZ(Y1TRJS^3T8>w9tOMBm+Qh7vmS-03RZEr+hs(<|p5gmHSqH=O=9LdWcNR)F za3pOjEbwe4`-Zc^Z-+)K??MAB@Q%;&$O^~8iqMK=AKE@EydkmS+qAE?*X>80l$U$o z9*JcA>wEZ8?t6(1LwKX<95o!?>$I2m<&2;od(mdOABg0r47;W>@BLxsGJGZFEPNgK zQRVoyA()c=FnY09f})|vs*7sxtj%8j&b5u}URt;0V-J5U@47p#%lP;^mp3$Q>(3v! zKVv)WzF4>F?#SSxj3Z&MZnuBshnbo8eP30g(;gWY%!xjZT;S!zvS*^~Lv?J&?H8U= zGVs03Yc4NImu@s_rK`WZ1m7I4)#XWSXbn|{Tk!?wgK9WyChjuAu`{~8@Qjk8p*;7S zD3yB#(SAjH{Auw1)(zjpyGfl^C>;uIf8Y!ineaii=4hgSlFB&tnKQJ0vwM_nM{nDH zXkzI0y5hn0L)Lp{U-xPub9SvNzLlkYar%1qO}27${nG8n{HAqfczKQXBCoD8`G6`u z7J2zrl;NC&BxSW6rqndb;{~@ocYtq>Q%po375sJEHG_-SHEq z);%)raCPM6TaeFJ!TV1&v^|~8{&P-lGh7#$RIGl{r@ft^@@JoM^Y9@1^)8famnl~y zYlW)9(RN_S`<8S9ulj7PE8drue_7t=GwMP|D0?lCM)#PfLvPfbyQ}Q;q1RDo^F~zV z?+@eXPp6MO99vAc?DFBO&r*;4;_A@Qu7TI}*RjV+!!KtqH2EJ`Dr1T9+Ol}oF6O&M zrFzPoE3@|0Y@HSwja)s5ntlK^eXEjp6iaVlFF7%1J-(rI!0i{dOchi1#w~d}#fx>f z;z;?lv=`H_E)HKhRJ(pCv`ln#J?&SOSr^qLa`&q#S@|P-CVQsz=1X<7`kB24_MgmV|3#sZqrMVJ`bl-;mqu`2$v^Nz#gSn7GX&t*I`!mJc%);6;1sCr~_Tk;x8xkk( z#>jK0dSvMC>cojUe9?X_M*aC}csXWZ9Ay$ z+4iW)-wxUK<7zu>M~3#fZ??{lE)Rw3BsY8+zOKA_dr|hMU*4NP`>~sY-{<1nt+r6en#{tXi7a#I$oyRudmh}Ku8c3{c;_&bYXZlDk6|qMSk2weNLy2vk0a}z{=;Z3 zyt}SoXkt$F@Sf{ob4u1P`Xal-8^qJZhEIkL4~E0|27L`%Aiw|fDBH33hbHoP5Urf* zL!Y05w|iF(eXJ%wdcSHtYxru`$rGp(S7Z1*^ zdGOZIk*3QBPUKW?FL*kK-?U0sKe^UC#MIA;yF-;jcboc2pmn$ZI1BwMa%-Eq`?AL| z6(8O`K`p>CGBRJxo6j;N7nvW4ecH{`r&QzX7%DbGp|P5jwEpRT;jwxLzypU zq5u8jFGs^i2IehIy#2J>qe4d#CosMb$@uPQvewm;7~vjJq<2k}7Rr1zOC7$2qf~SX zJ(VLu^^uZl zuZOG|dS`WG{Y&*ru6_90ymfc1%lOzkmo=_@Y2}j3AHIAR=0$T`I@^IeZnCGV)LbJP3zzn6?U^e&ZLN*n4c%MkI#*fRTJaSUTwnR{#nDf6W=qz#_@T=#HOCUcGcI_)PPH(E`8C5(>c-68C|pL(r8zA=jPU?WRqG07dqRc zjaz$@J<*Lx)I$R=r$(C_TH7E_bSFV~Y>b-kphR1nM6|54riA~Agl4w(F53e7({O%-t?P3;X%C4P~D2nQOqP*+^T8YliO|7^}XH{%Tw70Xj zp)HC}+9W%A=zLqUV`Fd2;%MQGeLhW3rN_rFiK0%U*2OaA5-sdekg)u9m#?nB zHom5ARo$gm)Gx28Uw*}^`0`atuZUlD$yI9u#x{2LGHYWn>Re(?lcBEG?#;>Ws8f%w z|Hyp|^@g^t4zCb_Y>lVhW$TUIoqb(BmOdSG#ZgB*n+2VtR-qxAE~P#*kIs%3Zi#~1 zsg%i(Nxiqguw)wMh_vX1+8#A2GUB1w`vUaw0R5sx|2^`1Mjf=j_XX%D0`yY>dQzZ%rOmmMHHiE!g8mZApMrq?Y>U1I z`utXo?f)+=`HxV(pTL&gf1a`AA42-Ok)C_dQhwfVsDmzFhedw?`UjzZmZjfi$yr|q z0`vy>VB32wAg{ON-v{QNCbsKbe;O@0?cZn7hk)}@oWq|g&5p~ez<+D^aeWyj6Td`CT^2orI0H%M?l9PToK)(~9bLFCp>Ce9o z$XhIV2r_>6k=H2LK5wFYKL^b%V`;C~EPdvmh229PG8HzxR6B?$qUf)+AjpKhji|$T zH4XO1<9M@=|1Vhb|AqR#0P<-_!2DkWT?tyolWNdjn5g{pqyT+JfId@w%+$qO=mUJt z=YP6&qx;CGU0*akD3Qu;0_BAP|GjgAw#WP6B~bsV0L|yR zB~bogfX1xKeZGenmo%J^hyU{260z`$fM=L85(}T>*G$7F7Je0QR1r81$umsf0v4Z%#paX1;xn=EM}cRU&Oj{u zW56>FpIG?3jaI(>`V(OJe(PJrJopjbMwDldI43NPkc;Q45lc9LAp8+g_?*X;@?tXr z-%U|s^m&X3E&$FwTkCLMmV1uIyslqj@DgG(kzWcd^*}8CuK<>MAQt{A>T~c!AQt`_ z>Ki_>@HYTQy0t#B@cHfxX}fOVTn>N;oLk9vV0RLqr}?{y&)4`?;7E^$#U{sn`Bp67 zZ&GUXzexRFtxqiahp2yn=08Lo^PB{+=ynf#tX$7XE|`&(B=o+yZSgkNiT7%gHy# z&Jy4V4=e;?v9rd~X`;?2v<|W8aPA;wBo=-bu#}Nl_`TFG(sqc2zlHjSPb~c1z>zIl zpIG=`0M5No^A7=w55%Iwdt<~0V&OkX{n-T&-JBc+RkQR>2Eh%csFo~x$$5hu+%59 z*ckyXHRU=CEOs8X@bkpwIA+Hl z#KPyfSL%>h_?&mlFa)vi^QdnKV&U^$Inu|7gcJEPSpV#AjmR-v%r`f7ZfJ0*gPyqCW~O{tyfQ z81)xue~5+uEcFeaSop_*#UEnfzX2@%{KmpLn5zqas)h4_BMWuD#A1i-g;F85!XD#(V|sgEwUqetS?XV`bq*7M zMB@j5ORF`0koq+mKLH%M$-`pvD0R#^@j2opT8HmOirnmB(LZ77zXe=k?DIK1!Mr&v z@@buxSkmSIOJ37~d2bOz0kHHFV$q)sEd7L7_?)ZGsMTqSg8am5DR}L@Jz!e7XEr*8TW{V-v%uH6AQl!So|jz{x;x9zs{Ff_;&*5F4g=4)EV%w z=Ki_>@DBq^y*&&Z*`a+S7M&-6#kUuTO`E=A;hz9U zZqaFpCGDHQrDm-AHSt8PlY^geA{PEvu1o$>l2GUryw&8pIG?Sz*0tH;qx%ay$1gf_#?O%xa3-L^2V${#G4PD_IxVsA*`_lM-)>*liPROb=+l+lIQ}6tBMQErcmw_+bR(8DIM8|D zkN9~bSYqd9VDXb!_}hSIG~youvG7^XGYy|u_)a~WeI&b{*~fC5@DJfJ#N4C<)pHhp z6}ZIke*!#%1wtSe`zL^B8a}b`-vTb(h<^ybL6p4SwlMcegwMU%$Zl%m9(7=`Ga0zV z_?b(6Q@7kp5nKfv*`w1EOWKvdGg>sCSoo`fXBs}S@auu4O^Joy3|x}Xc6f~}w^ic~ zU}-yI(dRyiv>mbVH&dS-0fAWfH&Wm5iG{xdSo|Rt{vE)jrXD_L;pc$GA7ase0a*MY z7XC}r-=zH^7XB;LH+*8@bI(NPQN+UMUWXi~#KKqY$@WCoR`0oT`=MXlMG>ns_g^%& zb~Gisd*YqVeAG9NTQR!v$T=U<#;-m~AHCT|HyaW~EFC1dFD$!|PPt-VQSzs20uzs+1Q82 z%JCd}Z@fD>c75u5IpWSuGR&nXrRFP4d!1ZU=j7f+(SwK4T6+?k%Nly|EPP`hZg4RV zhbi;yzFi32z<8TLLtE>OxQoWQzeM{4J82(k*Olzkv@L2e?(X0%Da;agrT9uV#(g}t z4L&#T7AW4{(3AQ?08zJVJ9sxyPj5qa@5$~q!b=o-S^^4XX&Q3K- z#p9E6_K8aFE14;!bArez!`+l&eXiht4D(LlRGc_llg_m&1D&4? zLtG6I)Z?{J38J?e09mVQBY5*1yub5IzUf^1L)j$655t&k?*ln{USg8r9t0iuET(O* z1(WDEA)-ANN9_F+*tYj4*qcg*31W|PBHP|dtk0s*qdgW!>N&N_s&b=p>gUw((1(*B*GOD_;Ta@VGbQ_( zyko_KcY*V(e$0EqqnY_dSt{q*hpY2yYeL)lC;ebse^Bd3b$LTtem2U#5jCan6n}U} z*)7F`CC*b_^M^9-3cWtXy@U4fPv@^83#Y-P8Xo+yT51cK|=GCM}8FQm4*2I{lWTw}}5`L)-d;_jW(HyLd2%Iq^A` z6Nl8U+is}i?^C-L@2=S8dA^@d+r2&orF+G_Ga1jL481h8%Dp>X>#S5>s?h71h2!yk ziyPc$N(O4lxgpHE*NXyo81t@T?{56!!DXs=G^w928-3!I`M2PyI@Dbv_mC>vH7$3- z4lkeg>O-$b!pnU*g)ay&ldVyxFZwCmvsQ9yC)NeqZPu=^RXTyJ3!~C zQrN3^6>o8fp zBZHB{$PLg_)e57ThhN^q(`ab^aBMo;&>XAy?q06R7_@%2b^oN+ztYN&>7R78@&0%G zPDSbE-MnN|{xX3Hq<0E|U($WXUJLM43})PSkU;ruf&5AWv_(4hG7aN%NIMnv^-D2^ zU)p2)M5bvbv8)3fzNrkGKZE)>zcUbv{&e6HGof&F_z%I>nGHH(?nNM$wB^8(b}@C% z!#@OK(OCj4I&4Gnfmn1n$B_5^P6p1U;|TOYF!L46Hj40sjX*4Rn7v%PDzGs9jC=t9 z5Qs(pB4Bx+a4m4e?0XW6&Pq#%$CKy~i_Qj1r7XBd+i;mM4 zXE_VubVSx1ktwA4>I=$GHgQl#Cy49}ul+8YvB zT4OooE?A)DaGfPz+9h!M#jME@ruw>UV}3@WH_pA4_O7wk#Kw&C5K79s>w=#1-F-bR zD*ZyUtF588xwE@Heq*w`6HD?_?Cy2dcP_p&bL7Fb#??TDWw*~of zjAFj@nKI_fePi1mkJIZAB}l&C0K>M&Yv6<6(H@6YvDX>!?^VcJ5G9B`?!nsj&Vy6S zphSBU5XIh~0`{swk3cR#?EOAquL<@>p+tKur`UTB7^-f&odEGU&=SPnAHlHwD?op_ z4?NnNY-F@MACdN0w+y^zw@E|iKV^*P;U9k`{7f=343T{aH2OuCt(R^M#(V$mH5mId z1N~zVdxgly&WiU)Rf9o!1d(Ora6Na?g1>4FhF4<6<~u1)y#{*|_sB56DnzcqW`W|f zm9eFX4UehaVR;6#Z2zPh!P|yh)Q{(b-~J3%A@`~Y;m6VMuqIMv`*UhCEFDk#|DVVy z`u~N0SS@ZyjNZ#tV|C(1=XbTHbE^~To8XsM^KBAdEewal{l7cw{FJ)(*I($!a5y(= zEJTAAa#tJ4>J-TaBiZ1Wc=`W-g-%`BzpqQYeXmth{@%5%|L{-*Z)_3&*;n!Qm-q1` zZ+T+FE53f4Q?sofJ@lm3@C5it@RHj^PmC9OkdL3i&%gRKkh4lAnvjTPbNrHo9@}w~ zY$o^EPHD)d5yxszPaMC_H6}M}i|6KU@f-)5bjg!VEV@|gf|gwdkcMU3F)Y^wDSAvC zZE1+9j?RuGD`*vK=<+3Xwe>5nieGir%J{Onl`F5n1Fu(JU3XQzPjbo1<#ns-wSrG@ zRo$Akb!)~JTvE5De)-bnm(($Yc5$T{}8mJJ-7Wy5a>zu)y^T zyw}Cz@)gf7zP`v?7(vsu|0fc3u9y;hbIYzTDxX#6^LZCtA0ZpIEWEy`V2-!^hD8Mn z$`(Wr=X-A`zutTO_4FunY4LS)yphcuVO3spVSQwqAIU7drF0QJBpvND-uc%pTC$+j zTZk4e_0FdREsN|$C{J^gSfN7DH0hHg)QTYGN02DcELh|#pKtB3f&j;*a3%*Oi9}IU zCKb&og!|mM03Kf+Bd3LI&CR?2g6}RWEvH&cE}vI$J@=sN7Fqg*g%w8E8<_j<_1>?M zgR??g6sY;>*T^H>$mr6giwb;*rttEwkz4fU|5n@zykk2c+Xi#x}id6YQ()3Zao`| z$GxWUMjm;&rkQc6x@X&{&a(Zzo&_4GX19#eJbSfdnuHNGdsxdljyJD zrcMiRIsXEQPVeEOdvbKkNR&_a5&30f^j?~WfynvIds=vp7vyJI==FMTx_d>>@iqXb zY76;v7Jy$i_BrZ*BanFf1bv-OrTmve{s!Q3`5PsA4g}MEE}6bnqSG_!TP*ZGiT+E- zr(+v({@oJ&e&i>6%JgR?`W?tmXN&}WCiwe-%l14Z@l*R8mhh>_KUvC8^y3o!Bgnhj zLjScy{|fbA0bI7iHF^nrgE1%Ad@GFj82K!_{Nor$}|3yL8%QNj8$Ev~q9QgUY zd)}Y+Nc=wo{V%{}eSRm=>74WkK0-7u3LO$_-s&iBO1R-x8_+@+0{b_#1 zu_>TeSjwa4vIKnuH4wq-k^~%Le`laC+?z)#q1e?_u}} z{1oas4mcePBYHLP8NgjSZU??p!hZz+qH_flvxt8g@CT&)$-tkJ_-;(GJz|R5C z)bqQ5UqU|}e*?6ufD8Ibl)qe}F9UuDa8bW6P~LsOFV*uu3j7)1qCSg&zYctoPPYO7 z61YpppQXG=yG+Lez-Iy%^&1VG>L~Pi8TzdQF614BKK}vy3O)ZK;O_&^*6}ld>3tId zzaRKy;8*JOBH(`Dbo7wy`8mp?_ach&=)EU9fRm3AJ+i$=u_Vyn2VL0jCFu8sB#++f zkm@kyN9G^Ria^f;UHHRC(5G19?*>liSA>3Kn;!rd_WfTd|A!JDDSs^M1N|k?FW2>7 z2>fH<6yvEr^j)Gf3|3Qgd;t2-2R>8BpND=MC446EBfvd6{nyYZ5y4I1k>y+a$0Zi~ z{R`U;Idq-DkIvkR_sC_V&s>anm#0y=zg&!{J`(!Tm5blS_yW`-4HNW>*fl!crO`)f zah1-w(1nm-yt9qqd`iSc@khL~jbM>J7H}HsOBcZ+o!WYwo=&hxPX|o4q>EsYo(XuI zo=&hxr#2AhO|Jr+rk^(@Snym8c$}V2ut@h2KMiuY2o~ujfXC_S1dH?qfYbCdmjsLS zQsURs2^Q%z2TY?u3>U#7eL3K9dOE=(y$Y~+PaDA^y@vQ{FvCT#NUsN+=A=}{2o~v0 zfXC_S1dH^wfYVa(2N%I2{Z7E+^mKwn`Z~aAG>GFOSfqCX9;c@hEYdduPNPnUi(rx7 z19+UCPOwO)IcA!EUYTH#{t)r&=>&`PKEP=dBysiOC(?HS9;c@hEYf!aPNPnai(rxd z6yR}sI>93SS-@!&L~#);(w_%BPERLTr2iCf8aXL0f<^iPz~l6Ef<^jaz-bxygNtC1 zeiZOHJ)K~YejISx1pL88ut+}%c$}V2ut@(k;IxVOgNtC1ehTn7J)K~Y{t@6b3Tn6r z7U{nSJWfw1Sfm4FiktrOb8d=*!}0h}8Oz}$f-m843c>UT*C_my@fyhAN1MrEVpaZy z!!CleIZUhyWx|z(pF)3d<>04KA-MAJQ!ds(9(xlxd=;g;@CVn`_$i|`ka-AB<8UFt zBRFiwe<`^fCebN05aOcZ#e2C(Pw~zw(k*2&{@^0D#JjQx7PcZi#k;Zy7U?qpr%b^g zTps+=aF&lQ4}OA&bQ`Cq6D-o_0~YU;B3Ps^BL3<4gNtC1ek0%iK} zUH?@`N+YFk5iIi710JWR6D-o#0#5l?{K3_RpRhv*;50HeE`kOB2EgO=bb>|t7QiXj z;18~c@Dp-=2smvfrD9CRPw;O8JWfw1SfuX)oOUh#;38P0KLL20o=&hx-vc&`P*8!(p zhd;Oo7U^#S9;c@hEYjZvoaV(JTm*~s_W_IdJP|C?e+M|thd;Oo7U>@Y9;c@hEYd#( zEZ(0)ut@(i@fYC_E`mk+Uje6;P%3}lr%3-h@Ns%N!6Kd3QE79D8*_NTBAwoEF-}h> zSftasDs4XJCs?GX5Wk*Iut=wMR@ws2Pq0W&BYr)dV3F=3{zaUhV39ta`1N#xMLKaR z(>TAK;CUR5CwMl8lL#*6a0G+^;=8-hjpe^>qp2g`bsZ?@)%{TlU)_kLi z!{=UHDH~#bL6iatnvE2(IIB4#BHAoJVjyho=zS zz~QS1ZshRQ1mDVG55Y|wE+n{_!$kzQaCk1ktsGuJ@EQ)65_}tnZzOmvhpCyB+c~^~ z;5#@>=1{)JVXCTfCx@vT%3T~L6_xLEn2J|^z+w8Uv~xHq3Gg}&rw|Df{*K-)`OxeKU6oR`rOn;SoIIQK}$YCvSH;1*nn>eiHy_dtI@SoDdVXYlEbJ%?0 zi}ZX|)GI(@KmUa1rSO7~a=ghwe!53Iu|%KVX>6)4Z@Ink!c6oi5WTjdN`Ef}KF(u` z)8CUI1b!Xf+_~j=w5YzhC0EX6Dwy)nPxy!4QPr1Abnzd}gXp56p7O|iXNaI*g0BuZ$@J*yJ?Yp3MuH1C=|eOc1OE*_k|*-fT)7Ci zxQLIgt@z3E9>`?uZKS#IQ*|22dkOhTp3tuj2<>BvOO!+JwwL8KVm~AY2`(_k;YT!* zN8i7p>>?lS^SgkHi}>hzA55~mhq3>$0_iUN67Uo9vH_Dkq2Kcsd7_*QJ&y(!c*G^-%|?PO z?-b+-{VvjJN%(&{GRX2WFCdSe{gvg-on*=zDapGZjZN|<<3|_0`=*2@R{BLW`n|0G zFZAt!(ex>$#z|$-bpSuP+~-kl4FtH5PIED$Q9WiLjpPb>@kpfmTjCP(rh-Y9=R$uQ z4<;9WG}jmM&I6X^U4qFTl_xGC?+YZz@(Ll3=G-p)XnrW<-3ei`ygU#u0bN`|-fdu# z<+VXxDVSXNrQs*!(Ylc2<>5!yT*#~9p!Sz&^rP<~(Es9knv{|*L31JvP1Pt!#D}7d zOYqTm5#;A+DPGa#(*Bxd{Rn)bEr@gq@}5RVBRReJQ9V-dqbUns8JFwNZKzyzh3lWb z%ji2-O`ZOApQBw{uW04*SeeCc1IFJ{lzCuxN6kECe{Re#?=G-shRm-k@0$Dfx#6<$ zEWMN7X0(OgceLJs+Hw}Q?-y@A%9^*X7vJWlr%4e$oDK&QUoWNahUQ7%J-@3A-;edK zYs34C^fxG7dTZygZAbf$965aK(B!VC@Qv8#V4^UNjtCj_UDE{)^INteon)_Yq~j~M z$JUn^Uww}E(3jGc{VjN#&@t(&*s;FFOcEBvrHA^Bufi&Q+Ixfks`S-)+V?lgZzS5k zJEqMBA4h-R&!w&WN@ZMCGvB^1YG<&1FeLucr-($58)$L5Y`97k| z&^b?a;mJZ@@xI~=ygNu4={S~tH1kNw;rWLa9b9~1>EOPO$z9r4hJE-Ryf612KRd~i z3zfb}g<*9(zFz<1s5VdoREqlE$RcPd)igMJIKFJ{?)Z$k@o@lu%0AXurW^?1+p>=_ zXZ%UXN>Hr&s)4X0^c$tmdG_Ut-tf{By|FmTPKCS?-#1p(Q}P#-x0DQco)++W*h2d&M}?rolVaBJ6UM< zl1=`Uv#em{?PGqtDZFnq3wJtP`JIP6wp}Wlm6dG@`ZA#1RJJYd=6eq~D%G;? zH@cnij0 z!;qKyA8I)S-G)Zt8_Ed@>1uw}UbO#b%(kP;;ok9}!)!Y@Qb>NRR{roKxs~yqVO8x> z`mCIxs&MD;Q11MY`DJ$7iG&1It-al!vLi}zxO2)!UEsbSG4em#U@JA@dH9=}0NJUx zcK%}9YyGbtdF9y4$A?b-{N4S_e^dEh^{-aFQ~%bU?%b~3QQz9`g6BWIK*;j9C9~k; zuQ7ic{Ap*h65KIQ@vrEGe|0Nrx4$vko2lopg^LYsQcJV#>7lPY^@Z;j&M*FHac;>E zOGeE3;-*#0-d$F5^9wgmf>)Oq+}U^A4!x$>yssqJw$R(hoT2yN=bt1CeU#J5-u?&u zDfj|+MlrKxcCp}N-HJbDh<(~Yb^hW!+Vj*-eE+*xqXe^FVb0W1%zx@JmamRdRMmgx zu_z0Y&aW?9EZJM>yVUDnaW*C=E4{2}aVSQ+K}t$J^@n-Nv5rR*PLH`vb?<(Xxu5uw z*|HN9|C!lQy^2asDO(&eeHGu|wyPg2efgo;1!1*#*s%B44X!)je&R{i#%jh2J2*q| zdas??4%u1A{!F(UcPUl7zh?&vW+tdkb!6OsrPOyWGJ46h8>eH8aN5l=Vlzr^TpW%Y z8Hais@0GJ<6&s@nahzFv=UACe*0yCOD97#>{f)R%ZiwK4pV)SRFB5GrAwdcDzXqS| zN|<)T%m)TSQws(w9$SCR=&Q>9=x^MUm7czFu{6?Zedl%R z4N6~j8F?ecBfRfU4Xd6!f+;PqCSQHpbF9~CcbuX=89a3MJiTW?RriG259F(T9tOB<{6F-XqU^UJ--oTcA0(=?L)G%x4t;(;9Qqvjp6XJ}d_$_1&)R>f2YJ?*JwU-& zlYn@++xXVHupN!2gEub@Ej8_*@rtH-SGW6#m$bID!GfYaMe9#16%w>ITFzT>X{Q-4 z!ow5nVR*rEscrFw!2WJ!ImUP)M>$4DJW%y#hXd73%CfcKH${9a5u57zKnZR-uG zqBQCc`QHn%a7!wps(L1W-%fVd==_#`79Kv1DRcde&$5Aytp(|!j|`6(2qC`0%d@+4 zL+=`?nxxj9ifYe(*uUagRvCKVpymH<2U}`jwjJHdKufElZcOmHpXg?OoV}vS+% zyI1H{LvQz#a2r}9VIy%r7w& z{(3W_W_QGHN7iJqGkQmG0(_nw3%xJJPV%rCW_nou)IN4sYX0{Eism`S94yk0{3)0r zVtudlU3shHH|g(X{;K4i`EM;cvG|uu-&p>O%Gau2UG+-+%QNoTclVwSjKlX>y;d8C zbA*-rEP=HT9xhb&Zzwui&-v*5#e!9( z@0OM)5b|v_Dp%Q$uL&@*BI%-U# znB>Y`j%ZzPMD>T~jtpSz#V8z0)3)4^HKtBlq&cJXr5~kue(Vv7==q5+6;Kb*Xe<2K z8>&3w9Qw=o;7|v?M|GBc;L8u4gC~7)-i;Zye?_O_>=?uHL!GSMTWLhs%KL7{?0pAo zJGy9YeLX|ko zR)2V|;2@uPUCS@(eYkLAkqv7Rn)y)V8VKzz7+6oysaQ=)2|E_5GY2aV%s807{?qlJ z8hztJGoH4Y)Q5y@YT+bCbFcc|fjG6mYGZ9CfE8 z*S^}`{oYrHi#E=!NPSd2e0bwgYZ(;3+UA@3&@9N7k%&3_E9e{by-9|*1ScRBBmJlM zTV-f8cTmY@8R$Mm`5K4<8hnEit%i1mT0=C|%0*46Etnu>_My4#tQ ziaydEvk&zYTp(J`Q~JVFFJT`%c&zuShpAuGZw)28SwHjlJfe^`m6|sGwnTQgh+5v? zI26<3XJ(l-;c+Z>iG8z_zT@5Dq+(?$#^QAkWq0^fuwI4a4~p|cuXxPyIrvyIEQc9; ztUaVcL@UF`G>-%~d7?9Zzw%M&Yt2Mvqs?|Evp;LAed@bMi&Wo02=4{yJ$iV<(M4W= zV?SEt6*i!D7ijO`vS_09{G!Ya(6qT$yTGZDXi-fj@Yud5r3i^V zg@}Es$(RG!vOBTX_2ljD^7rgxGafpIS+vbdqx)TD?sbo|?fAKa_#Z!a8~(@7-H!k9 zvw1tP7NP$SD%$R|RO_+wq- zgOK<+By@49Z9DM)eOPVo0DT8ad{!$(*{?~zF;cqoq^fKWf~(_q*pGUXxkGk^q;E$q z_c};ecMzq1hP|SL%9Hl6`le!9nsm?X4VT@`Xbj)Zyh_-ffm%3`vb`NL*A*(g_WaP4 z0(zslygNoaW9Hk;=O0^ibn%g;hnF9!JXn2T)!R!vT?GVkW+un!*YN?_BmiSJBIWZ}Cz)`^iWe9wLBK5WfRc6O<6 z=Wl$%WA2ImzC$@Zwp96flBcM&v6M;;_74poP|vZ-PP|3GuddXVc`&|oK~d?R-pbB( zTX%O559u(!^CV`zrY1b?{m!N9%`wv7hMDakek&fcPU;eD-t<}9jU*02q9|D@E-~I=|L5Y$lH(<_=Ioi1K6lI9Ve{yn_7dm* zShCn%CPys#;P*{>ddOTq6?y)sMQ8HI5SzConR0w#x0Y_^(q?L1R@u}>scp2& znb{RxOQN<0L-36L^_7NyVs38MJE}Gm^HY9ca?D$j3;R*eTHyJ_hgHkqA(rF8n?|ud zNy7g_!#fJHAGGR45&vn}#PmDz=%UiP(vr@8&5O+vFoTM!7iqBqTFCqNSvELzbApYGsmMIny0?4|KF(e8FzFFl03l)>LgpgH_3nIWoGMF zll*NjW2QU!ZTGkK=2`1U<>ieG#|?hltVfn6A<5$(#FL3Ty-A&M{!`Dfr`9WdbQdW2 zm^aCtbvDN;i7dq~Hl>(%isUf{F%YrDnSfZL@27`q!=0aO>hhKtvu{%d?%e2H;m(Qo zQWP+`@GS{XW#RF{S;c#bDe}st@H;Ni@s^_8!HzDk=q>RJu+x@RIKq!7IYn#}`l$gC z^}>lmA?NVaPFqGt5_)@baDshASNBu*lRk?OsY;C5aS$A~%)$|)(88O$DWY+ncRT0H zk!wK@=1VAb#RDuq{sE6W-F}fDj|}lxZp*YMVO@{aeNN#Bb#kwJ{Ej5kB37$Y&lp0> zSkuFupLI}w5jEAnsu9IU`O8A2rQmEYjFv`Rdpmjm6MXdT54jD}OT^uwlmgrAt(b#^ zl0vh?j%m0<@fSA9;Z8r1+1I`GY{bFC7!}Up@pe;W=H!e^Dd|Lt0zleUw*9eX!Vg*hwBf;_KQ(H zreB~3cuz33*x!~BHJV_Y1gBXpcr(0{dJ3*|xO4XAxO0bcWZHH|hGLr-nnb<$ow*C= z2`>u;o+)wOb9Qsk+l3i?FZOT}u>Qf`aPh(6xZ{8s{m`UmRCO-JP~k(OFGSZJy%PD9 zxn{|`JNzEZ)=7HGPNjVizMHI-f%&`0pXIUnu(L*YFmi?_xpNODxn0kW$bDGp^PehJ zs9w+s{K3nICOK8#d4EqSW`Ta3UNFlsAzB?^mee`K2D)GM6ZMWe%D82IH)7hu?%dEM zTV?{=)9YXHA}sd`Yv12fKSNc|S^(z5a)zSIXId#?2>Ji~7K z^PI}L$LG$Pw`U%Gk;fcMatdu3-dulM^xB=|PVMfF=m+4=^ya$L_vYpu3}%FKZJ9&4 z!OV^kwh0GExW_*`!ktO~pU8D*ewdq6X#LhwEX~huq!Rdv1My8GInM9y5bd}*kljW5 zkt1udCpf}?W};%w=$($U=Qjt!okL^jtIQr z>3pjbE1(at0y+VYIXEJiS(s#-&@n=+s+=dW!dkRmahAnlg|!cBokLjbY{d%e91EAN z#|rBswSH=xgo(1M(!Gnw0l1;XuYV7N*VcYCO_m1_< zQa^B%b>~+v#$EdR+0EUd*^>`vAMv-HW4;ZxjDyL}#T(eD8*aS8o%AT%p0uC2lNH77 zP==*Qr!8Wg2_fsYJ`w5ZO5eq0(KBn}9MU+2_aJ_H+YwC;CfR)Zhq-f~O$w`T7~kwl zUrIJ|y9zIo?Udv}^r6u{If#=D37bN`fdrr8??J1KFC1aU#aQ0g%V_lUzfRsaVDH6D z3+tFOQxxrcT74up2uslVQ-g7O!B&*Yf<+n3dK!UdG^75b+q-Bm9p@25eb8P>BEDk0 z`j5@%MT|XJXH9rtXn@W_w{~Xy1a&(ygVA zCFhE(OHP&q5E)}>^5N6+>>KfNl4u1QL5FhO*=mk9F1YsQx|y0~dWO7yLW{(|qpg%` zmf5^2!xAihVa*GX{Yc&LWK%!A3co!&{W54vf8vL7SC{@tM>uX6g}P;^^{9pC8+dH2sY z+micgw2xwb4NjBKoYO?}o^Hj6*^lo)rce$!mb!QMMy>D3pU&Pb_q=F{m=iuGbI_c0 zq{HnR8qw}md}0O{LLWSVapj|5(71vf7*~GhkSAQ$sqeTBF*8z8l#4H*lc8vfc=QwW zqs>MBQ)85xWwJ*dP}A|1#}nO8J>VWcYPbzAV2P>Si}H*WBNpWHz85LYHaoybVsLgV zPJr5cAvPiv6eX0AcTFO40<-u-N#w$6h>dt%| zyAbB?Ebg~uh1Gs)wUP9$0uaFGx5tx$fmZ7^e?V$vX8!slULyE&0t&9uI_xC z{Iz)tv(zq%YzMP~nTIC86SKNExpPluiWo;J0(Pg{v)tqH%d}^SISl4Q@$OvwTxy~_ zT}{OIcng9gUWc@wRk!uwQv>n7!cyUNzJ4NU)-wf~%E9ayC% zhC9`-{DTgbU$zf(a9f6&m|uo(D-E4J?{EyH?ql=1zpvgEGWE(c_3~yyFRXTaKIpQT zZByUt4$iKIj%(Nlj#-EW&}&oKCVyM1GVt8Ub;tMCLC`-kAT3MXxP> zb?Gb1U#=Xg{`so?pT3{l5q(ZbT^)9O`Db$n&9-y+@aUCS*m2EYy1eH7XZNn*iLv^5 zYXnz&VFS(-ryo;GrsMe-CmyhNs*^s?{DqW`I;&;xy}7js#!0uADW zJLe?O`HA4};dZ*ePZq4~{9v(|m56d}JLj;+wGr|eZS`OqO3b1;5a&M-ga6gIH@xm` zKY@;O65P1c>F$TVyYXvF%;LF@N9DpEpE~?`?Tqgeq)!s7?+80qE1W-uPPDGUsLfY2 zVaJmf;B>dmoycqdYFu#Va664sHg6fuePc(}F|ZmZ9Zp@N40K#m;6F8932*og3p;MM zMV9*MdUK6SvcesS6V*aGGaqhEMRXb2H62fOIpgCo+p6CXeC$Zhw)?}5d4G$PBJ8Q! zpRxN>#w)g=lC0FOUT)K!cV~%t2R%o?=N$u|>}12r{41s^&m?eJANZ`62tIaqR=3u2 z#|@gPEqPiHvavqe_A1)rUlZ^fZhmPS{rd5H5)sGGXCDkZUW%%>Inp_M$FnW=u8jkC zKaBmCk}T(0oIA(ftmJ*ESk0e1c+nf(?sYF@Z4Q)ljx5$@HM@>Zcr@TYm8$FsZJVv^ zcb=He!e?(|15=-7lY4jfUKYq#QwyHzpczNz0e{am3i?1?m-jN9nw#8Z_Jf~x2@5U{ zZSg*3?9t(AA1VpD?CC-saHls`?@_(|-R2tBy<@lL!$H``-T%TwX>S+UtJm#Z33Qhq9DDuECxdK2E;Dsav9`JUzN+P`?dQzwM!Z zJKT;Da=iEQ_Ce?#Z|g@N#z-2R7`ogxe&}*U!qKtoZ#yv@cTRV}yPv!O2jYPP{^IEB z#u)*}$uZcCJ~dV8m%hvH?uY-NADeBC(?gEc7mycrJTm42x=1zJ>s9)C(PE-)X&x1J zTzY9Jq7}_mgotPueW0tY|JC>w>6ABmIQ9+cc`wAl6d%r(5AV_AAdf9OD7M%U0SfH; zYIWiTT?Z%Zo6UWZPC3AnzQuje^gu($zJ2JmJ}rv6cmD)2eJ4eY%XmMu_E4qI zTDvbVLk!nrBI1NAvaV(+#M3`}T2a{X$4_F931~BW`~F?U!QuitW?^_XV2CZmiOR<# zqPx}v$2EV7UGBD0+2cNJ#f>@@Dgijzlrc-i>a(h+g=)=&2O+psXjyt;tu~(DVgPz->RaqS7 zVPjZXH_a4nm?_e{3pC8Y=5?2CLZo3hRqjYmjMT|&wMpJ?FZ|LG^cC1`v)k1@y|~-D z?N{;H_lM&qF!zq1INZB_ncBm3g9^=52GPl|Jfj|qgaW{sZtPGFF-3{y_`%mq|UI5eS$wMN&f1;z9L@}c*T-SJ7Z4;TMOszV3bWP= zP_}i`3?lf}@Ptqt;#^wn{JhssN{j8w6wCK{Rn`5(v)S&ac4V77L+;%>vX%Y)-f6}P za+)`|^WX%W(0gh}rs#R(o!#ieUZvs&rSC~!^6Vh|G>DcsSvdLrX3`=*EVI4$gbNH-s4qNT>dxqE&#GsvMqgUg9?4`S0 zHX2*J*p5$4kGeLHqZ z+APj-m%|$2Dg8ZdUI|;_9$FrM+Ul`6koB6yi$qxz(OyjqtEuqYpCop9wXf?s9{DtO z$)XKtG)GR_DN^rB)$eV(u34=reWDYV>iemD-1&QC_pfGea*d$S!@TG;zrn z#j8r*Eh(Av!kp~656w-SckbqS7r28mRgJBes*Oy-R!ZL<+Fimd&ZDftpr^R$n@{reQ zXZk#QnQ4jG?bM2ybgUY9FOQvmA}dO_Q?SbrRwWLPgXS&mr(?+rr zVPgMWvD`Jw?$A8_j4~LH@^No&1l<)h&neK!EVV-9rgt?&-TPP-c9i77-%8|r8)AMO zb}Y@Kee=loHDHe~`GlA5mAhS~xC=a0p_J|Tu7h0H*t@Oo<`It>HKJ`1b|hXYw>Irg zT5A+}mmtcT*adzNGDI(5=nX;zq&tSjN*-}%JAQ5j|KrC`71Wf5e7Gxsn0I<{st+?E z?^Iv6Z}-;Sn6WSLOnEcs?Yg(KeqHlx)v;hOmbPc7$}MEw>BinOR-$!f>g;69wLW4M zH}s;6Nxr?9Z{^;fyLDghRVVV^X?!Q=y}I}Kjxg^2WU5KHM}qrU?(suObqm9B(^zuR zlSO-xGpu&9mW35Jb{FB!Xi_-T$$EWz);r@);uK`=15Z8h6fAw#I1A~{{tzb~@f)wk z)tzu>rN+6lQ{$$**MhQeA`Cl{xFa5q6Odlv??@evyAeGhX02-|fKyI0yA6**#4n(T zPrNvbfcqHU1b^ecnE6`qBo^*n$*O z6^!h=*XMXq(W!dT;51oZbng6EO;h45n>AU&X&O_S{_8&MhIRE`c zzh3pX^F4m3>UUFJs0QL_?fz*Y49` zj?KqfiF(?EKcvym3^+Dj+ZD;MYo5{(f3nMeYBzGxPH~B}CxqyX`-S%S ze06Gpd;E_0Tb^thwuY{V5?O-UA;TZq`ALAiNG8@f6S6 zPy16^BSsN11EW=mKHkF`+N>Y@;*g7V4R-E(0!rgDo6mteYSmhP;Scg^I0-$cSHVnZ zXDG=(sImoxVaI4zdeFasPLH(WzVcj;+qENpwKgx3@1jwg()uZNgdKI%Kq#t%f zw6d|vLWCs^Mj{qm=?mhX9(ksmlBmb;qwY0uKO>zKoD?-V%{^ujfkT)>cpQ;BlRwZp9=lvw_C%_+C`pd>-g4Qq zV|&Nm#iXaXpD;hP&y!iWwa`)g=OvX(k1w5d)1I5smu*=#?B+kutH3&7H|8vulfF%R zezD3tf%UH7X~#M2*j#&Wq*Bd!M8EXx2xjY;(aQBWag$sRj6n%%W9-_b&WRj1xql%? zGQBBh51z7<<>MI8B57(pWX~-X#0IrUhi~?xy<2;%~hf=LEcg zHQ{7O55)t1K5VmAJJsvX+7a^(T3Lx)gIm2tgPQgisPE1Nq|>LyN$gm9c=1e+%=0O1 z9XS)FyV`&B`aSwnKhPB?2#4VH`)wG5@=71|@%3|f6rMp>x3d0T=iNg|`CVH*$ED{w zc6V*N56@qZkkkC0JjL(n!pQ@rdab_ikc^?NEg#XmA>d$exbbBD(y2%;HM$!l&Czm#L~I7g36Tl4bk?{JGMWb zSYg%hSch0ch}aS9$tJ2@pc11e)&Ml4zHdbPAiO{Mh_qKHx5EWx_=(GW-swopcGw$` z+d*CnkQa#cJDsf1>pDnlp(yKMP4Hvv7MNBQYh2PnG4|pv)FP=Xt+uk35O&nAl;vCJ zn<@><*{uRfT<>YDab%d~$t3W|(6<&_}0vQJ<;M~dOo4c`=Gfr^e3C3(OdkbO* zp3dbsw|27PP0rL#tRKp{{XHMD{ejO@pV3Yyfe&|OYe`AKyT_~RM63^wF#Xhfi{?zQX;j^Dz6e&YU z_;S=;Wi&cP_pNYe+WF|zQ1xbqYzyojEJ!ciQaWsj`Lw1N9_{=~D^q^{sBd7yM;_3^DTczOpx?;>7@y^R&cA>+T zb1)t!rjl&g2QLavw5LSvVB8XR-1Hhhn`u5#Bu445;})HETsk4(R0nPT6(J?M58tD4 zi=G$VidyVDAxAgu+AE>#uroT8{BJxBR1 zjn{leGWc?$F#`&B7VFf^4euIzq>#G)h|OAVs4m=@^b0C?slk~aTBQW%4B6hlkF?EK z>k6FlQ=>Evch+h7-Z$nFT0DN;S_0KfJxM*m>}A+FiRugVC}omf_A9wX*ux zFE_M|_gp=%W?p}2dFOFFbGhz*Wq-g|5;|$D|B}6*m)*5^y94hlNcu6JEy4R@JYn?} z<<8=odAWllt4p@t9TGYD?tGM|VGQ|PE7!ayCE6hDNYLt(*=gS4FliItB9Ae1$^H{- z#0fi!kwfVl=EZqKrJ(we)JsPX*fR>8p~A2Fdo#C&J6pbTuAg##d-CIKfBR+YoOrrt zyNb6lIPgw|IJ`$8?iJ>ae}}n;10D`I=^YmBHE5sCgp=Vo^+sw9({~KLJBv?}rY0pg z!7e>rQhSp8q@>f_cc-Ucv9d_Yq-Xlqn{s}v*~XNk^l2wRu`hi^O~dNI6-}-6^?{}< zZfj_|<%&Ra<0SpF1s8%RHQ(NRh2W{Ht!%1jy8Q~{?YyixfX^q?t`0Q0S{hs#Rj$>| zjH7|IjkQgIDt66Gm;7M_e@(!DOLNQr9&gvUnElm~m&D9M}t6li&!kXHuKox1MGimZF zE2><&MtCiJtG}hSDR5!t0AvM3{u!=@)|STB7FT1%?R5Do(x2~pSc3p8Ho241REDNHAWT>g@gpWM%{2(>7uB>7HhSew% z467^rhLKiRmDd0-U%PfKD_-nsZ3aE77FsmbSJX{3lQeUzu5Cg7iL9cksR>NRMb~#En=iyKwZs$SaVH7Yh9JAK7cQcxN0gI8w2&MwV5g`JglV#=AcHHS8&|~ zG)JJNViMVr6(Papuc-64)>V*wUDXw}b?6iDT#=W&6V9spwdSn<)DPuOpf^Sq)p4Th zY8Sd)U9G>irMz}cIkgfICc2o!MqDtoMAZF+l@`p_nm%T;i9)H_EYjf4S+3eOkf@bL z{_Qu#U+%gRnq|2z*K~8Cu!(GSpt-qXWx%Cb4Jrrxh9Bz`h;UUkz?;bJS68(7YYeRn z|Bg^2BZI4;*Z8t)TzN(ge~Z>B$nLVCVfX3)B*TZ%k=QKs|5i;cc(5FFD8^ORHe|t$ zO@Uim1I_Thm9Ev)|F!PYQd5DZt!-&$^{|fUueJ5A=8DyvWo1*v>Kt^8YKWSlb$fg# zr!G*Z)i4QKTYnz+V$yxJl z6^*VyV}rk@nT8lm*=pozuAx}X{hL)cRjgbMy~vZyrV*CN%4l`XbY-+ol$tHZXn0#w zZHpK!t;3;JY1Bz$k1kCNR>lA|!_{1SM}UWSd8jHZoqK(Bc5`66P`=hibdx~2HuN{Q zuGR*6T|F(F@(&bQD{~=jjf(KmK$9lM6pE&B92$u^bp|@dO8UGL4ObYg^shw$yD6h} zMn>z+2v*W?7MYov4sF|j*xy3aC8Dlu(E7d}rTh)8G_<;I(}sxKnkpJKbygx^GzC^y zpwa7Bmg{qZa&&nL7ZeNF^)0n^bLB`mlNvKA1qAGgVM6F_bJd5lHf}aoZ zG+s5gHqv*+c<5`wELQhM!#Sw-`Ybmh=92m90_8$aYK;iG-jfU~rD?xTY_ml4eASkr#5c<(Vr6 zO%74yYr?r{E*s4*>VTmVZ~m{LKC4C9+oV+*sq3OONNs(k)-5RuScj!~4B z&oHs5ca#V&Iaa|KAcdds$)>J6e6=z_hST*%tcg)PoK&-}UUl*^Y8{Ey-_nG(5u&YMPDk)Y#CBiM5zlGE)pKb&Tm>4i+^n+BCkVfqFL07+wClTAGyAQeUT9 z)Hl>m;ysTb>S46_=G}*UD9Q}N+4a~)HPigr@L(eaWtsgoq61LhDc8ynRWfp0GPSh2 zuy!Tou`NKggS%$vQ(wk|vY1x85I$Qm$p!;W%Q4Jjp6JKy{Fd5Amozn$r-@qcho44H ziu5W{-JvM#2AQ0LRbWo;m)5Z6x{{nAQjC~J&`8W@*faoZ6NA-|LsDxR&=a(-WpoYN zd5Oru{tx7sdj#0+(1J4N`7~s=*56X!a2q*`)+4pq2a+kyi$!ZFR!B5EILFB%Rpxf5l=uoYF%w*@U-W!gBG z>DAI^G!@hrVN)%5%`huLH3A=>MZsm*b@;q0#?U4qonj#7wb&t}*whqgtgE;k#cTF2YsP{5w&zrDz0CJ#W!_9k=rGW{LIIvb;1=X^2M6Y zWgr^qh3B&B*1Ede83Hmbk^s%8MX?bkL<~d90Cq0+{P z7?z@7s5d28>Z=-Vqs};q+?ZFJTH@=7;d=>`S;`1U)HM+eMze2yEvFBdfwles#S(G_ zOrx+LHHkI^Ty?cr+G-&stD=qu3BHu)%V@4NwhCR7Cb_hr9Z39tz1#|HR<3T;7G$ew zAEUXk0&5BkCe=*=Z7394T8z+~h!t){b2Fxwm>I(&+S((Qg|uBX&BrTiTUJ*zPW->k zW)z?k5vlmb0T$P=u&z-KVhc?<_1LT}#F$TCgXpe~afC-fxC%GFwr2}p5sMG8yCfEJ z5z<6mGn%Q%>jEtS#;Awf9%yliuE33Fczc0qY%;IeNp)G;)<#Xm8f+6pEn=Bh+o0AP z$Xwg<-CogJx~KBVoF2`5W>M4;n(HX!YXhIu;uH`~^BD~q6=A-f8iv!Dy^hvX`r_T# z!8f9P#0)~)r^CXYwhzte7oXf{Q()X`@wc!leDJ%XN!uismH_(bkR_s-#3hz!Ru*kK zscknl)RPZsqozI`72`9bp?!5lJuL!>&L^9g=vKL~9WCo(Ed_h76Jrl3T$0}7jloBY zvfAJ#wk)*9%w;}p!fser*E5<^M0{GuL`CC>GRYgv=qCFNCI3Gh;)J2K3h=Uxcx@Pi zVK&@cOItX+`L#@1^P`VqM}q>cwjWG81L%G5tcF`^!HqGJ79q_!0P82TV7Y`lWKwQz zIgWL1gyZq$NfmuW9mUmPhn9=eR*c#hLff{BF=wd0eUZL*s~3osgC>%u9oUZ6#(r&m zkBxmTg>ely`wYw*=tcr9H&Ie~ZIy+rH?FbKWFb?Ssle2&p~`igHs>!Q#h42h&Gu+P zt67u)5zDZ#LmTB}4i=Dd2D)9UfS#@K4o!pwWB4?Re zi;A+yb;aEg_`JEOk@`B_ymL<54h6qlhs%Rp9m&m|O zUXg_DMYx^jX}a^v8|jf;l2_usRAoTxQ`Dq)%@09L~@R{3q!`?3szYQ zZ3SbULOZtlo`~2FX2RY1U0vKjM@6(Sfz46Ag+voBu>o&#n|Dd57vL7Mc6pnz{RjJ0 zBmQ7l&R9Q9&dbFY&RtnGEiH}BGp@K|C8qGLmAPn5y5rBYTv1oIX7wcOB+yzQ7aT4+ z7{GIuPtKb>HSem)-Nr)&ar||5Ia-(H;%;ZQHuyPi@^E~aM86gKp2M#QX+q!m5}ov2WWh~+t@Y>l`x5_3)MqAaD%zLiEigU~ z&H2ws{HsvEE#M!6G@;KCiB9?Hd*A%x`Ku*-H5%@5vIFh{{Z-5CZm3pMAEL|n!oi66#PGetjEBQPp2FFYb83_qtk+$ z{>J5*_U8Bo!+soJX2C~W@C`=&hO?((?_%_!0!g1e7XB6qe+u?{6Zt1d{JSOk5g1|` z=%W3oJ}*f0XW-j^1N~Ad|F0$b$M}W#l3|9T$X#a1a{e=A=L&J@QzIfS@X20Di z&jp;a3IF&AaSrWb;`r+Ze2!EIX zT$J}3^eF+q=ufZ1{uRK5KT>%!Ec$Jc@O$7tKLZXkYV{p}eeMPhF&e%b{(rxOlf3a# z`C&B74$#Nx{6t?S(Kn%eUkCj%iGEO`zYIk$gT5%nu=fWNo#cIC!Eu0Fzqq}tEcj## z{(U@a$uG{IBjKA-@jpR7*RUj>|B$?Okk&s%`g7$Nd+mFS&Xwgs=Y;59~jaDLODli8nO&j%rYnj}BbXb;ZcX_5DV1y7XZ{~m^>{w()@)1SG# z$wq%kW`9KcoB=<~pw;gT>}i91m|eqv4@a90T#o-mWDM;}X1_#1O`yAgll@+Wpe?|K zJZj&MB!0pllJFyt-vxbyfBYvL>le^R^e5uqE!B_k0~Y+K1;4~%zbO)a4DGoS`dzN; z`v&a)I`D-$PV#>$@e^)0{F~eF5(|!x+2|Lie=Om@M0~gv^%L`-$o_GW=Kq-@JFGzE z?Xcig7CamF;TPvO{rMsmDSsrp8-~Rrgob@dzE5OF6eIkHhCGfpO7tEy#C6Co_n&7i z{HDG-2>Eh6?2!2HMEm>(bf~HM7wP+z5U=Y$Q{pFjjs?Hk zg0HjaXO16SU!T!GMzUu3_hT0Ot&#F~qyKyx^zo8@4v8K{`&WW4$Cnino%HRq;7cud zpQO(kbgX@l2RAnCaa7`OLjO4nx)`5He!Y~R@J72Z;7Im8v~N26{W3}3Xo>!P=zksP zQ+4{qx-B0DJ`BB_G(xTr!iB9}4O8D)l$YJn{@tEl2rSb{SmGHH&_eIc0 zjxRM5J<|WVe$}G7y1u0nekbhp9r&1--%xq0Bs$^s7W_U5{{iZI1M+7gjpAQq`Kjz? z$o~@hLX1XV0e&aqgTN#C$FNrPhqd5GHluw_e;>o+h2hU*SOpC60QlWHe--Tc6X0kz zBY!1ee)0U~e3IidJ_`DB`1=M+`DXta!&aiM_!x&VUPbEvElt14LLB3Gt_8o^f-jQr zNO|Kld1ii&Q{DJA&SLLNnIHZ!5%!hi)keXNS#LG`y-1?Jr2FCz!7~iGsJ$OD`qQNv zzDvqa^fMOxGYfuB!fT=IN|cv@H1ZFMWpr)9Zy0(V$-Bhp54=1xo^ia!XdjL*w&=Ii zLSJja`z`!E7JQS1|9J^tLGc;-XF*@mzZm}UEO5Ai;a}gk$TQ<3*Y^$!{hS5gZNZON za2lWabt(HU{QG^W{pP~|hk$=e*C*0{czdo9+0niswEre3Pd-HTSqFc)3%ICHWPaX0 zE+aq3&G{?G3oUfhpE-T0h5mgDzR7~ONqD3_ZZ-w>KZM{e$A=Pw->vymy#+sKv?r&R zSn!7>d^+rT(jtGOL??eeY4|IbchEvFG1`mM&HVz7=UM18Ex6BuoAU)Xn}PQK2>M-v zI#T;xgNAcs@hQjew=MaTEczBocs>kSfc)cic~rkniB9%zgZr~SLnGBX)XMhTkssV2<`JF`lmd2FK)A{crs{3Q!%4CEL6o9H7X`ZUzs zAJ^wjiJ$WS)PkG)eUq73i_w@gj7?#e!GAA<{47bI-&ykimxO1a;jTyhW=Z_R41eVM z z{%Xm86?~pw*Rq=+eMXU*f0!WcDvkFSXDwG5nd+cUj7xqR;Ue^j!vje-k>$`|aj@iRV9Lk!S9gUCYW~ z=uxnTyq+=p-?gmpV%!BmjFIKnN&3u2`B|W&T1NfN`8Y5CWAsOUUCXXP|D6eb{4@9m zC3$3@Ek=C5mU*Dx^B}wnM$|#jivfQZGJk{wD*t6&H}c_OtVZ+S2PF9up<6o!PoW>_bDu;f{3@w_i_kuQ zfRi9c7Ok4FFbchE(9K9Blb zgU*a14Ed`heyUHp#b4Vjbh||FMSHD4Fvfp|yoW9PJ1ls=1s^TRqw-(0(6z$>kWcZB z=%+07M#=u)M*mPzITyHv{eEYW|FH!>D*69UVE-FnA9MpP|1$tq0vGL{gNptL{V83i zUjci*20TY9Z-W%?NZ)5I_!+6ZXVE@CfPB$EpF>?92QH5%EtdQ{q$ zu;=HnkMNIN)NeHCP+Oz_3H*~WIT!W)4D#m#7xt(6-6!=A!XL2Ub0vHH1@f08|0G@h zZ}s{(5L1U?r}a|kvmE_FtOrP5jg;Ssf^P>sQ_t^%ecnPmU#sK9e^TOq3Gh3xpXh(j zg7+)nGj;w)VA!kCKgLV>mrC}J2me0QN2X`X{*3arg6@*?kC5ouD1RO3qWvy`?Ei%R z^8DzC#P30QUqI%1U0x3UH?IP%e^K4}#c^~0gyVIBj8g?q%B_)i9K5pPL;nk4@eI>IdE5%E_=+w_Bfnx6k7_~%;C zh5o-q`OAQd{z3B0{m%k64E?1A`6ui7&jT+4o}=URzj<9}S#Nl?_B&@VaGZRXUtacW z)aPN8k7Bj@{RZ;)0GH>BZwhwiWgnnEZ%F)+<_yn?=inFi`Z?OK8Mth(#g_cbB>ZQv?>pd+UB5Y+ek7Y;94B6Z zN7`ea#!tS^FOFX&P&Uuv58u`J(FFSST?>7oMkin6*Ftsxx}L=^9|>YScuJ6Q*E`bw z3)v9bJ_~gu9R&Y23xB7CABHk?Ppd%Ue_o>h4F2#a=;X5`Zx`C1d{p$mNPAqb>0|mg z$32ETj^|qNMhl)N;gRyoH2I}A!BEEf;BUj=6Ex)z^}Sn=8Rs|UbG%NX|5=~wyoj`6 z>;_G~X)n$%?wK-O-a#op**{Oxhj24K^ZZ9F{3k8=ISX#CuXuj*JY5;v4u7XJl_I`T zdFK6Y&TslV$Ibgm9B;AcyW8j=oNn$Pa{N;Z{VPlUJiDj>=Qqa}j#nG;xs2TpU;Yxo zUX16Y|FaUEaIxnl?7h??|CptG^E?kP?+c5(4VL^rw9uDX@Z}c#umxXh!8m8 zX236@eBr+jL4G>w??MLZzYl{x13#f}WdG;=vr(6hm4wz`*Gc#TG#)^Hwk|I+{}T4^ zh-WnB%JXY;zO+P>x7Luy@fr)>Z^1va;AuvG;rTC-@VgK{??ru!kw?UJ#6TE6Kg~K{1p7MKiwhGgRrL^J_D6BeLDfW z@e}-!@^9AU&o}blY#HCmE%*uxUZLfuw&PcYh3?nrW|@8qJ)qI2iR_Hy=6D>i@UOJs zHS9|GW6oIf{v_FZn<1};U5@tI20GPIwBIU;PW;bX@OLGAN)q;8kpDYU{-Y9|_6pB{ zK0~LQbtR@%milp=c=^Tg@dDNPms{{^3vT)|&u_LL$G2Gc&HlE^V!t{~KXgC+;yBzZ z0>4_IjMJ~O;AZ>RS>)Gi@=bl~+1v2XEKJZ~GOay+1>f`lr(s>Rk7?g}_6C%h4Z84W zYOfEB{!`DsK>Oc=#p@I)|6xNvUVf4h?>U|$Y{-8$fwv6QR$$68%lY$7;|; zyn74r`X1m}I{$m{mp6c?N%_t3uAaRKfBXaJmr3-GCHY?>|Ibh#A)oZaL`T2s*-P-Z zBm{RkzHgK0#6R8`Z|m7!#EXewMmDWJ?*TXu`EDI2esg|M&rX0p9r`(R`e)Ghci_iA zEq~D1Yd`|xew70#d!YUaSOj;YCXT$>wEzC#W;0aZj7Z|o;h}M{8sRZi^`uL zFECEO-%_7@E&2tFv6l1qNeYoXyRjF>>GLf7ITrbIEb`Av?L+d+d)r*zV%;9J$9OSL z{Vp`s*X;SfbbKw!y%=}74_NG%XVLeUdizu(-~Ywg+rUXxp6CB(_Kg=24-6uip?0$i z8zeL9&ay5@2wBMPibx0{NDLvuvMesRz-Czp8ftjiMLKODr|kpEdvMI`?zUISi2Y_kTXjneSZZdhX{w&w0-4oE`e(Ta0U6 zKKzcmKSt@#Ts$5F`{P^dX1D&Q1^!QXpK{Av5qwU1pUYW(-Mh;R@+tNDj>rQZg@5|nAU4AXW=b_%cF8-L{^QXM4U4OL(pRe&wxc)5;K7ZQVfp?bIgXKwi zYjgVdcg~O98rm!ObZ#{y_*~)5bnUN3zx2ml2|XLLH<(}TeZ%#a)gSF$>&DXu!Tis9 zkGlHrVn5R#_j`A_`CUQ0ao!v5bMK&k>%5Ab{%LjdQ62R^?{&HScLtwt@Sby@cLnut z^tQP5Qy$E}$@`4^Z2k8I5C8RNP}tY~y)WX|iS6^5;PaQfHW!b71JWPYUx!`$bg|Ai z-TKkzJ~{JWbn*C1M}P0DUQJGaWA_x4ZcO`oU-NEv>vKx*`Rm@KobmHW&gXruf64;? zEN{L0jNLBc&Gvrc@~aF!H+tVj9xUVW>W}l2uei^){I^A(HL>MmoRsS`dJ--kc?4c8 z+!rUEPL|GNV#4J^mX6)AmvlN=`fzaEJxoHD&LO40A>p|4T_5vMqI}5m^H`;P$kKTX zOt}6dOE00{>162~Gs=f7eH1wD#xe6z4rFJzTd1di=2 zWVKrjPCA_|eF8ZCIa`rr>C?d}ZcHe%@rvVofMqsb@-%}}T;V7!cxidb^0b1rykzO^ z^y8d}g)DtJIO%k<^tIr4jpa#}z6qR;V}h~`FY$J8ih~ZN3$OS%t4mhhJz#kr0V{v9 zJdc8vKUw4(5+4g{3rc*Wfx2ax4?3!EB=3Cg>8DIc;t?}3#M zS^E3*7$!^SIQQ{A0?RPG(j1H^6?pkPIYOzzOSzF%cNAE; zk)@BJpBpp^S$YjP>2$L6sbJ+smOcZV<_R*&0=)cU63@=iZ^a}VOVU^1v;WCJ_EzFe zIg=H$1FW3M($|3#>8uP)h=0jH#jjA z6BM%az2KzN$c_RfvmdEf|UbV`bqjzR+lXO6#Y&o zOXu~6_H|_GAAl2Si$j+F5jg2|vUFZ&sn5yM`8=BM#%CqD++tRf-3i=iu$Gamy8Nz9 z%Se_!o_=n8C}in;mO1HkvUHvYr+LwYGM!vzya4QHjCr3hUTb56thycaIR84Z@+8Z% z5v)AP(l^szY4OR@x6U@EYho1(XSRiKj*QRx)oOq0GTc zd6E@>9$0yjr7xg=G$try>5ITgr<0}M309tD>3gWx+1Msa=f2S&g9*wpyyEW539>xT zfm6p2eNct z|0h0gb;;68=yy68IPJ#IbM(05FIgUbXXW2yZSj6rd{W5r@OviZ zPnO;nto+H+`_umgi$j(^kbb9=rSm?Wj)P?BRp7*Ai$j*qzhg)`oh*FtTgQQjwW2Z_SJ&6hs`PTg!ezoSh}H|8aQJX5KE z#q_ygEhAYu@E((vku05mCy}_t>XN0m((iP#^c7%@XR>tuy^_ZB2C)BCi@6D`e8}?i z`Ca8hmcEVt8CI7peLMY5CrjT0Rz76u{C-v23t9SUaN=tgpDg_hIO%k<^s``%H?s5s z?5pAvAfS+?_W`G7T73Quvpi&Zu8w$y&~u~3A(md^X88XI?ll>=FxyTHnU zEPXZoZhuaezLtKclcjG4Yd^mOthUJVbb-|tS^6&eXW8165q!5SN6>4(6H z*%pT^{U|u;bh7kQV8tOzf1CPEw%*Co-vg%_EdDvLmXR#a2VgBDS^7ux&#}5>>3p6& z>2$Jm-doo8MV8KcavE=B=_O$8--bs#WO>GdQ;n8G4Osb;<*5ZLf3oxm^v|`rWa*RW zcRE@646x2I=7DvbCCjsw`XuXTvh*F`RFk#U1y-J9d3J%7Ct3O)`gzidLYDpr{Z1!K ze+sN^hb*1HGoo$hIM~0o>AId^XUd6rTCqSYl!-vsts ztnPMtrkIB;Pj^HoOFu!~onMiqe?0Yu3$3l5VD&j!o<3mpIa#_-KQB;F z$kGSU?{u>C60pVwS^98rda=bBLk~{`P{{I3qVDz~Wa)FMyW<5}dRs&%OTQDW;|PD7 z$*;9`SA)}EHZH@P`hl#v!@=qYvh;HLzkvw~Svqe4B%Mx{&eLV>i^$TMirC27$4&JhYhJSSSHQ}LEd6z`@*zuq z3!JzE6BM%acfd)flcj$I)-jGOy*ICM*fA)5!ODRw53iAx16g`-z5Fe!d%^Xx)1%kR z!%$a!LROq=aC*7LnE>{=LQtlXozCk=F`tdlzJ;tfk5G5lab)R_gSA{_>AVKia*?G! zP5+-*4rJ*E=yy6Mo1(CRq9B<%P^^KrKu3daw+7`rB5Q&%XOB zjmMK$8BZjyHl7UDGLn_sRIrwjEPXotYpgC=I&V`=lz(-jC_B)Lifz>Wq zaoWIYmn?l5{VqOP`knMUoh+UAIo0kqu#ORAd3e34^L(=Oec;qu%k$}ohb+(Gi03#x z?plB>&&i1A6g}=*fGkgNjd{1V^)@|j-%gh2J+S(UEd713`id<5L;AT>K_N^3n0}{| zrT5H7U#&O)5U{odvOKk5e}j2$rDsye^2~#-Jjv1*fR!g%`Xc)8u{dPuZS*^xEWHD) zeGysuW^iJo#UV@I3QjtmEPWSPamdp5f_0CDEPWqX_gKi%kAfA4Ed4of;yacPS^5j$ zq|?dLUju9ZMwULP0QxitC}ioy;M69I&udThIa!`zVD&j!IECQQkfqO|-|1xO!S$)zPe!j#m%-!TYjN%( z-)FoUtbE9d!|P4uLzd3p;MBf_EPWIGYb+*N`U7C?Tiyh#EwVhk?o(UQYruEu-(oSz z^7Gm->2$L6kHH!nWa&M5KJSikgTUHm$@1{pO}UY!mxGlXS$ZY?Jn29oORuKi>165S z!5aT$>9Ip{o5^nvh-o}JDn_@ zzY(iG;on#5d}bc;K4j?&=>Idzhb(;&{Z1!KUjbI1kfjILp6-4^ z^xAVLJgFTPe>YgUkyV%1q{=ONeadG-bw7bD|33QXSxmC@r@=ZF9|rq>Zk{t_x37DP z{GjRYfRztfan6F34_W#-`rY^;OaFj=r<0}U@j9`?+A096EwVhkc2--t*U{Q`a<8Mc z?L@Dm6Ku;}XQjY8#~`b%DzI`OOCJSR4rJ-Prq+Gw==F6C{WEO2$nsAHYiy9E-vZYC zXR`E}VBLQvOK$~h-$<6;LEYVdCQIK4PW^@Dvm@dm%d;!u>88h>bCTuR7xC<;$DMPM z<#~plE^F%;J#Jr3mghOJ`k5^K1+e;=Ed4b7e`ztv($CQEbh7j}!5Zi1z}gRx<>B*` z%8e|2066Wog~4djf5_S$g17W8W8SYwJ#0KDq935X+jL&Ts$H_;^BOb#SLV4IZ|VoK zJSAZD16g_*{ols~g)BX|m*Vv3y_70=G~USaj|Hc?F+mxRm;cuR2EYC9KVp0f-jo|z zb!UQ=8(I2naN_@9f-)N~>2twJr<0}gmR5Q%CMZ1B@c$-2ZzcIr<8|a881qzH`H&Td zr*z7PES;wm+CPw`^DwFX16le`aC#pmD0}cyTV#3IHEN42o#`eX!vuva{c&*8>164L z!CEh5>Cb_E8c|N+r5woeyaZMbWa%%{{}?7HWa+Pgl>=G&+u+0#n4plQzY9(}oh-e8 zPh3_;Pj7-Cxf-TWW}6A-93{@mc9V&KV@|nk^j~> zxZm=$@k;9ZjXS{VE3)FO1FNsd()nF~;_s|3S^8%Bolcg{@9xvjnEyer+9J!d6Rft# z(s$GU_g0rIy_ zhb#`CF-ZN`cr;l3Lsp!zVC6%W&U;zfZ;++)89D7Y$kL~R)jwqEw}Q34W`mUjSsvcM zQVwM4&Gfr*NS4lL8#F$n&p9lIt{lkn@1*XwS+ewQaO#Nl&m&;vMwW-q(J42w^vCHx zYIVudpQPXEWa+$@rQFEUPk_}fSvsGQP`lCRC0?Nan6*om|1|whCrf`Ftai!L&r)}P ztU;Fk5!nB!#qWdRrTx!<2=lp%_*XDNA**f)J;$x?FtC=3EKdroOH|J>q`rB9{b>1641!Rk-4^cHZM2QidZ zdY%ngp5@R}|6ux^VC6}c=Pt1FBuigSKM#y3Wa(?^cRE@6ePHEDmi{1Eebo*2pSPHg zQ$J~Z0Ib}|s(To$+{n_8(f^NDmn{7R{Z1!Ke+jJI$kJa2r(Uo)XTj+gjnC143nnOJ z`9A`u+<5Z}!ko$S6o8d8S$a?Uc|w6gmd165bbF~}o|4Qm#we5l|{}^!MHB3;*(rds;r<0{m1}i>U zI>&>Si!6N*Sj$D0&M}jC9TOC?^kQ(*>162~Gioaq*8>}2T-r)4Kgf0zDuFhLcjxwG=>x&)H?s60;I!+XGO%(W%QGCT9LUnk z>37RTmR?D})5+3nz{-IveIi&nOadzhvOH73%7H9>8vX2S6teVN=yy61FhPfC&m&`fza4>165LuC=^m>Gfd$zc4|Wh?jC8%QG3Q9LUnA(*GeQ zC}io}PLob2OP>Q)4rJ+fQUAY~ppd0+2K(GNP#(Zbxsm1B0ak8g>5qW@k1;`c8ZZC% z0S13J;d@x&C@h3uf zvh+cDh|dl~Axj?&PCA_|y%?-}*JSCH)LneCbY3s}S6F;r3#WYJc5u3%@mg^FR_iyi z>TaUHzj?NS{r?Wq^mfqi`k5^MF8br<-vds&vGFL_A7J_cu&y7;s(Xz7E6u~}R&6h2 zd3fEb?IrgbHo*e|O7t4`4E;_gD^Bn%hr0(7eU{@KJj(e4uyP=)?nhwdK$h;I`w~}K z4rJ*C;H1;Z(g%QbtS3w7zSsYR#rgkr9>s^VPzK|rn8o0v)5+4y!5XV%>5Hhla|yEa zWnlFQS^Aw|^$A%z_lJq3|7v3% zJL0p=A3ctYp@;wJBnpp%ezEZ+@+Xa_fYT+$)2Tb2363{dOtNyAOHZl!o5?PRb}~;) zP}nDF$2=}5{vfdWldPCrcj`~F^kQ&=Cp9R=cuD87C!J1~UI|uzlBJIa`=5&BJk0nx z>em?8;>{m!9PC%WY|EazUrl}5JlwBpS;%VZPOz4REd4I}Q<$KTrLP7jolcg{eX_O} zvh?lXbU7v{58^F#t#KFLln+_{U0~%ymcEC6p6sKLrE?#y`rKXw}X>TCrj@J>ljCt zew@17FOj9c1NN`C_}s^)Mi~zT`=gB$U@bdYb*~0%*~!v*Pcrctt4o$%M!(a^(yPE) zcCz&GV6CHCu+I}86y8e|PXX)vimbXk#QL8#KM&8TvBuoBX<5kf&jo8)$kLnX|D4q& zOXt1Eq|?dLSAexFWa%B?bdAMX2lgFrqTihlkmcv!nx&j)J6JiB<#`aSoXOI6(m&4H zB1_**zthRm9|fn==HCZaTV#3mgVh#U`cw3ex4LBM&(QC5vUJ{)RR2WpPreOZ?ULnx z7p!*4(%+;1^VTj|`up@doh+UAC$)^hF>xklqC}60<@g+LG@Y!vqp7?5_GIbY<@t4% z!?Xy`0H^CsXZ+Lz38?j$kG{K z_t~OtRY2EzArW2zSDw-MyjE47WX0h*M&e6WH+sIo{!cnR zx-P~*SDs|W3G$h0ad=JYf7v)V58;Io%1pdcHyh6b`_qkEs5=hMJsdBGu4N&strcJ` z3t9R~u#SUd=^bDl2g%Ymfzw~H93BAsyl6w&ftT7P%ijf7yJYFRz=^L~U9$8&;H1;Z z(w_vY56RLGfYUQ9&LOaJAj@+UtQ^SFkJInY0m#yyrQhjf>8HS2_Lso^*R0*%c=Kl( zC&*tnz8Y`JhpadyVC6%W&QrR?t(c&Yr4I)uolcg{LyP)^ES;NQdKM-qlklb-$nyNb zdsA-NIRxeBYF3|+rOyK^2eS0w{B64Jm!juyJlFDPV}f!VZ|Mf(g1oRldq#LLIOY18 z*S}g8vf3H~R)3PE^PDO%$KsQvr|5S&S$Z`%-Dv(Aus_#$BDu+!=U3wCU|mO(6^Gwt z`|J#qxnSi?mZur4oXOI8o|d@H>XM}g=WI@op0nKvk8)nYx&=YA9$9r)g4GsTdI$Z@ z))ra%I{KYXmi_=(>zXWm4>&R3;*h030!})eEd434&iBaDk5a$Q#td2dv*6SMi+?)e zAh7K}S$Ydt z`H-czf|Ucbh7l*V6{t@{u)@z-W&ZA zp9cYjEDwgZ=P$Fi29cK=^W4e5!+1Pc`IA+*9<2Py(kIgYEvrkG&U2Nd)5+3jf|Wm6 zI?qr16&7bZ`A>`=kMJ|(yG%a>R-R2$Jmp5iM9vUHwGrdMNvG6Qd^PGjyO{k6s%cD~cuW$C+3XElGF zG2i0rLstCFkWy|L?*nTY$?|LiYZ=MXx6{7?6BM%a2f<0Flcn<>j+T)u{c&*m9!yZ4 zB)jE(2JCM%{Se-i8(DRaf|VOt`f>Wdg9!>*`m^Aq)5+4$fR!6r`rBaTa}Mlp!UW}G z@}C;#<%PMCRksMN+{n^<)6b4aAxrN|zthRmdETYm$kK;{m0Jp|{vpd#0agxV=~eV| zC8Lm~kD}k{Wa$&Y%7H9Bc!uy6+aE@sA)EnE>RyY_b1>ybR^2&ZC3^oKS`F(^DFfaubus^md{{t;{K53FNU6UI$3%dSihM@mR=4{xtOCP9C!ecsT1iW*qeoS#^2eSp7qmUQPcTi%FKwc6BZt&4I@b^-uIT!t31h0~UwJ z3;%n@bHFLbZLI6=Es)jLTI%kaf-HRpSTTEo{Xesq#o(0VDzN^3fvmbU)ZIA`S$YvT z#T^L>m&^YPv>weex<+{vL7&= z3r_uw#i<7?2eLdI56U4rHYU^msMRIQ&oPs9I$8RyVC6uTz5uLt$*Y zwHqC8%jkDHS^f^N+9gZh1n&2k#n}c{4rF<@gOvkW`bqkEP(mR~KLt)Yoh+T_5~=;> z{}Al|&^QloJ`ZRp{qd&lg{-Id`+L)QD&rq8-W*}>R;2F&Ck~p2 zthTs0C7n)|&do;alq{W#=kwr?!Y2J68y_PdHhuwbi6bGa?rBI#r<0}gSg*Fo(s^7? z`~(6DS$c4cc6#&}-5(ysAC$kKZvUH^HDGk|=`nBP75zc3yTPH>>1kX5%HoOC)_`b4nWB1^v& zocN{1AxobFPCA_|y&0_i16ley>h3-aS^8#hnkUXEyTOTHEOSnJoQT zu>VgM=LLG)bq86Vv-G&J^dXrWA4*;U*4M9$2ZQ~Wjrq*B|IfyJ9y{?$$coA5v6D`Z zKASxjy7DB;KZ*LQ7Kbc-2H1bi^abF=zl1CgpT|x*oh-c#thUI~S5kNP)5y{{g8kPm z{&srYIwH&SIyn7?dHCB1i8n)*hrf-GbUIo3`(Wimmd@WyNdMa6^ugcDC*BHK9v^zr z>162xz=}zhJ_M|NCRzG0aMJBF$07~yNtVvvOz{8R;_&wnw0@(% zjc||O%NIIP?oxg#g zwxYj>a1MIf#pLfBXx&AB>wy1pTPn}m;_n!w-?w}QgA@6tlhsx+IO%k<^dVs7K$gzm zF-W^}A^zq-qQGL3<*5ZHolcfM0j%R4S^6|^s?g%h2KzsFS>163Uz*=6i^u1vJa*OjM*^R?P?p+>_wMAd63y{}edsbh7l9z=}_n{u(&#&UvbPf!%e%Xt2(OR)Z6t zu(rsmyB3^uI$8QAu-YO^-$~t_OOU1S1E+XVg7PFdoisiK*7xsZ`HzD2T{Btwad7%y zZ9niF*dJ_hUIr)rC}jCxgPwFcS^8UGY z*y5Csi;XMEZvQZqTx$9Pa*1&pI6cJpE^uOK$cn!jdeZ4+>1$b+7mg_Rf#YQ%%kv=h zPnk}Z{xmqj3q%yM^aJ3e)5+2ggHzX-|0p;yJY;!}v#!(0(ofU>Y4ek%pP}FBWa+Pf zwZ6#G-vcLj;~9l4{e5uK>1632f)$4>z2Guj_qk)iAaEjWG0E}_1}B|PmR<~2OtSQ9 zaH8Dekfo0XC!J1~J{GL8M3#OFb$1R=mOdApa>wfh^tkPgEYC);@BZV&`@m`5j7NC^ zoXQx#M33XwBm8!R&qdhl6Z-pt6O|T+takf@lTIf~9|%@ok);FX@!bg<%+<(~moe6sY}V8tg(Uk*-GTTHU_72u@P z$%ba^4}cRREhbr>9pI$X$NWclBRo^(1{`iEe}Crj^rIbynFeP3|8uf@EY zy4!!Iz=_Y8PFCFtaMI~y=~ZC0MV3AutmAJjSodtn@=O5ho-JAWB>E==o0LbEK81d# zlcnDZRt{w83&3f2-?#;wa`!pg!2SXPA5x$2CTLYfYlaR zp2J|ZMV5Yyezz{j(ofLubh7kQ;Pe>F?KD_zk>xo9R$FB0uh8#elBK^+zthRm-vetr zkfnbN)^%l3UwHU%4GLMF0bu1umOcoq+{n@g(?8CZi!8mEey5YASAeyzBTK&ptai!L zXM)u(S^8}H-LjLV&!yk#Wa*2*>i<@-+9J!-4pv)a>C5RKZ_7xQzJh+IlcjF}tN+Q; z?*pf6EY3Fa=Z$xOl@D3|F0k?;OW#F*t<@z<-$TFC$Q6SFNB*Mm0&seYF~76(zht};tiB>Ew+^uSiY$E{ zI5E}glBI8?-|1xOJHYBIvh;mm|H~F?gQw)xO!^Qwv?G6K{ zoo6^$%TAW39IRz0ORuE=E0zOUdNut{CrhsZr*AR;c(B?c%To_lTV&}I>Hn(LB}<=7 zzthRmZvm^V8DO~^f2PGDOMj4lr<0{W0#wUln+_@yI|$R+u6#2EDvuVD+jW4-f~Ltp&=Bqbl##(I-M+? zm)y#MESw=S(z&}yG+=^4md;Hs>2$L6d0^#0mfj9lKP&?)2eLeOf|UbV`d#$T!32dY zeKk1gbh7l#VC6uT{vcR66d_jjoC++@AaJS)MwG!3E+KP)P^$6L-@cJmcRX0jMV4L< z)^d@hPo)1gi%FKw<6zS1Wa+cPS}wBmW^kg};*h1cfRj!qOTP=OIArO&sPoHS6teV3 zz^VBbpU)j>8OicI4%RY~r9VmkRoGBa$kLw%>u==A(s^9dIcM}3$LC?vZoRw!Rt{v< z<*`pWkfooYe}Uysmi`Jj>2$L6cfjf&vh+S+wM&-H^CGoNmOg;~7HgL*eGvUlCrcj! zR=Z^Blc>9Azsb_4gOv|i`V6r0Axpm%oLXr4%mybGg)Glp=t-xOrStqs>xC@+PH=j$ z#aRJPw1zCtO6W8?Vv^-~51e#5S-OYalVXyk_oeQxyUEfAgVoj~ zu)o6EnnwLkjN8EK2eRre1FIj%((k072R9V5^t@;uOP0Qs{(G%1S^5L? zJDn_j7g+0sEd5Ea+9gYW8mxB7(hq4(8dr<0{W2Ufde=`Vpb9(-_WtHm5Z zzTfz2u)ocC2>H9l!^zH53s(MQ#pn1@{<&jG_pEZqlI~eeiNxWUQT}AbUk*+`5Xo(O zBsa&E@F+L3>Q;l58(I2j`v1)0kfo2M-|1xO%wM@hmt`h&e}~1HLl6HD5QVI|9P_C^ zHxI{o+U3l#opNiWIBw&A5wbknq5EB?cY#xXX}p{IPUAma9`!G&3`NO)c-M_3-%qig7v!xWYt|k z-JRQzrFVe+y%uLPIQ2Ki_fdDe9jv-!)!j+Yqvr1>|G@Zh@;>9I$&VTH+CTNU@iFR8 z7@v&rOJMaOS#7-xRv(h3^AX0xev3nv&c_FnPA5x$2b}()`Okv=CyhUha1kW`N2d2C zKV>|K{I|x%cvC-<6~COGr_ECp;n86I4mMf-@$~#1CMflIOS`(0!Kr6VpN2R8?~P~R zEq%b4m%hI9EC8ntn$A=0)FES@_DSdITI$E9^OVAO%tLbPcT6tOMeNRbUIo3%V6b0mi{hvcdkg5{yx}0h6&2YWG*yH9=bdIuyG%- zawe;;4_3}(>3sG(@l&fymOhAnr<0|Zft52^dO2A8^9rzXAj?w)Rt{w8qv$_wIgq9E zk@}?5$T@o%7H9T2Ut0frSo}mU0X$;E#F9gyTv5SzYU!Jndv*h zYBzZPydYRD!L#V{2hX27J^K9lUer~)Wcm3ly4sCCmwpJkmYppB39$PAS+JI!EYC@> zmYpp9G}z|=M>zvd{5)iNUSVCQlcm24)_5RG{|KynJ_aivvOIiFUipxv7l9McS`K9C zz3F#4S^6Nbav)1D1E>DM;*^8a+*na6BOE-3|GeqBzmcAFdh|K`@vM8&{PmGIQ^Ec} zntluQ7mR0swd`c&#@|TSvXiCHq5nmzOO`&5ey5YAw}Z9pWa+EH>i@N5x9l6h%7-lf zCb04$OTUl)p9S6Kk)>~=-|1xOU0`h&-C*CfyFbDQz{-KFx`)Bafh_$P{oJ9VkfooX z-|1xOFM-u3Wa;mK)ephnAmB3#S)TX6%7HAMe|M1hh2=n&{vrKNCrj_mXU=Od*ip#R z`-2nkv5=(?1gl-L^aTB%qEyA1Rey5YA^IA+}hAe#R?cMU+vs=4db0HG^gEp_eHS?Ws^zl>9KXxfHCdj0VEjR&&y_rU32Tby%X zlckTMe;g(#Wa(qT`aMRn^m=gmZOdmWIQ1LjnP6RCljU!w?!Ip#OK$}$=XS7iCd;!N ztenZxSJ3aiZz4-yNx##{(l>+E&t&Pm&Q-f)=?{X{E?GLSg%j`C@{*5qdo z#>mq9qpwrEfIt}-;Xz>KLzaIqSox5p7lRZ3ZgI%chk%n#CrhscD<87-v0(qK#hE}) zt8KGnd3YZzC3@s*Kc=%l>=Fx zyTHnUEPXZo?^zCH>1*kCI$8RCVD%MQI?zj$^p7_`S^l2j)CXY>;;ZR*zi~m9pJUAb(ENQ^_akHKTGwRxIcEI-HcvVIj;p|F z#~g?1|J*UD{x60n8Z+V9vP8$^FnE$qC(BKF6MN%N>Wx zEq5Fy@~rOcNX)t5q|?c2YZ+L%k)?M~zX=;U3R(JAuwP*DcaRH>yTIvucOTW{}()WYYJA!MH0xerJcG=eB`9<7@}0f_oa$%#2I~Ed z9|XszgdEMs=gk$A0eJZXjR%8MR~i?SuQIM6I}gWXiZ@_TxUHoU#w8JE{_1D4+8qN{ zKa-``fD=iJLzZ3(PCA_|eL7hEOqPBtI5F7bkfpP)l1?W}ZwKpdQpnO*g8e_TI2~Xu z3t66ZU@Z$-`bPS%wz_2Lo9TBtS^5sJmW3>R7dZXL7Kh_sIpl5&${}}KNEBP$=(eyA zagt6atE~fI9VlnA+TwQy ziJ?|E_j`n-(-RT@aB!M8{7^=-Zb5(nE9O|}YKts=JpG@tx@74*$4fe$EPXmy{X>>M z2b>sYamdo=fs;-rOXs>Ucx5oTr=_#<;%D9!Y^zi}hW!`sKHjCs1i>69_Qk5JBJ`FDerGg&$>vlEq8mn?lR{Z1!Ke+H~| zM3#OOtUf18=OwZFoGhKUZ`9{x>AWmYjIeyj(%%Fpolcg{Q%~hXmd;bC_&SS2md?X- ziZ}I9c!*VBk>%l`RDDI3&O>A3I!sW=(s|fRI-M+?yU27oCMd0VQ(I(t+QDjzEPXls zZmg1}^H!1ilPvu{u=tG`GEF$*d(yT4pu2EMC$yYtiEN`Sb4ZhAj7@^KNTupVhdut*vQM`>ciS zOTD0W*3me>wYjNnR>RWv=2=aP8r$w@ZJ&kc7o9)1DV%?aM84TJzrATzbHk#!OPU*Q zZ<@7m$!$TnOW5bNEM3w(Yw^zaIxnuUOK0xX;xcPdt1Yz zB@5@b&uX8)unFO^>C@HLw4`a#+*!>{EiH@j;TubvmY}f<`mmLzc@6CiEwdV0n%XXz z4;K!N(msFDZO*F>cikEEQ*?ot$DF0}<~6mk&b+p!rddl`7N4KzlBOj~<}Y3p6_@To-X9Eoll{Zp5ev z#@4LG^X75Jg*_7tv$m$zmWDelxor0?M7J(%Xmo01B?rqpzkOlDlG|rRTbtW7XX$Oo z97~5v7cQ9V+r{V!TeFRe7cFXPJkJ(xo7K7) zSv0j>((GdYKUfj?VnNv%OTO9AI;*L5abq*vo4=%SS$RWyd)xduOWT{EOe$Z}-gc?1 znKK9WB@K) z7Pe-UUZKC4y}&Z`?H@3;A(>hKgNOSrmwVIlR&3*pr}UW= z4YvE3wXk7%ur17LX*%B%?v1|L*3i1N)iytDL%}97Z*kkg3qmejJhut9#S0^z3%3id z7c@R+@lxzL!eAFS&R=waFWi@FQQDdoHq2kdT|{fc9W9H|K^RgP;SIO7H7vYTZ?g~P z+<{>-hN1b5uyu{K-vybtbJ9cY(W^z23*>@zOa()kDW zY-8x%+}Obu6`TfOcZJiVC9MsO=PdvYIQ?pCz(Qic2HU>vh-^1_sT6Fa{9%vnmH)7( z6^HqTw&)q$g?{G91#>4fO>^BY`ckRqFp*b<1(Gb;EbrXrK!DX?xoB& zTJ4-CG)Eib{*ng^9@s4{?QJg=lS|+YnVVg+jSV=JY`m1)`neH993$TivL&rem-O2q z`XYWMjj_P9ERP+J9b`Eo;cTJ3VGiE!SQxwq=MUwX>#ujG66GOfMrFm2G9$BMNSW%a z7*giCtQb1;tjJ;}#8A6_WOm`Rlo^%9 zkTN5)Vn~_ltQb<}x~v#drYb9jR5>CmWVuUi`{0L^n%8D#zLJYO*tFsHA zrOc=-hLjnZ6+_BYXT^{**JZ_!GF4eIq{T?#gH;1vtme@>Z}-2=DMsHQl=^^hEzEsD`r9rsj@PhA7X?u;rs|@#mb5- zW$4bAW>i)TDKj!FhLow!iXmmL%Zedos1;tjJ;}#8A6_g!&<*%&4pwQf6dU3@KBc6+_BgmlZ?GRAt4GDo13+ zOo$;>R)+IKj8G<=AHl3xS&_v|h@p0UWp?4Slo^%9kTN5)Vn~_ltQb<}x~v#drYb9j zR5>CmWVuUi`{0L^n%8D#zLJYO*GuegDQf5>ZL&}WIiXmmHvtme@>#|}< zl~q|W6Jkh}Bf|M1hE!P@&JQt4;rvVlwRDvgp%}sJz5wS$nexzbeT6E9lo^#3L&}WI ziXmmHvtme@>#|}6bHAD|5uYM z@Sup@Z8rOaTVmd|1H-ELIw>eOVM;Etk6x8~*Bic~2+D5|EY~+hCcMkXd*S>Fv&PLE z^r$^cu?(M?59c8@uMZ#^uLIfyyi^pg2Yjqk<7VtYJbu5-czE6t zgRY`@$8yHYnK$tN$HT;USfp&cBj9L$Gn1aj@3&PH?*N2oeviM2e!+&pcvrc3%x?~~ zXuLNErGH3mc{v-3{#v7coerF;cw@b#uB4y)U zg9M`aEkL|6$VEl@4FN>++l6?O-1dPg*?2$9S>D~np2z2YR1|Mt&hno9cYL>rM3~OCEAGQSNlo))~=@I~8g|1a!!ds@3GH;>!VZ*$r`HynQ-0$oMz@^|l}@do6@yg@K=Im+?U za_j&^^DFwa=M7OXyer;!;bWZ|H!p>F%!l!~eR3W@PtO?#!x3+_f?&SzOF83U6yov! zl3=__ycCbmgGBRtB<*=qF<(XT_}>OZ^E-hZ=W>`BkLLi2SCq3|evEj07E49(_~>Rd zUTx2q_Yq8tSB;nAJ%x79%MYD9Q^D}Ac>I~?XuO(UvFtb<6^VCy&hqxW_TuZ8{~tuO z-2{9OT%_G`Ipbg*+U0(i%kh~=yVqc>MdR&5ybmrCZwP$Rp?evPJRu8~M@xTY-3kF_Zb#MdEGG z*`3a!sWd`XMgp;wK1<5?K0jCk$A^*;=PA>yDpO7k(_v5CKenA8SlnOyzgN9 zi1yz$B#)t=Em~ea0u)`|F;!vz-4uz($9JOf4kI4Nm5Sn3T!O4HHdfSBJl>n7hT@vh{tit{`*oS-WxDQmv=B$ z)}0rL_X>Q`c!Ng9yaVtt-k0&>Jm%YyvwpWB-e~MkRkXaf<*eV+h&KiS81H7h6z`p! z<$Z1v&a)K^?~3>9oaG%*8}28+5{dT@Iq^1PW%1cV6~#NA6VI=UdHj1!=J!>+l;7px zX#d@UmDR0acvn1ZZs+yiM|f8MX;fsqueo{bzowk?jl3ziUVyHmc(ZfPH=e}v^&K!V z-q-O`evhE~%1Z4qy(RdwS4Ev=84(0c&oc#J@Cs4$h zt|;DVKs4S7#9M)lf%z@MOYsKdqL2A$EDgd&dzu#>u5cb-em{Hf@AR_>6lpf_@bmjH z(_i6y=ir;`m~V=Ax9bNoPS#$In zFaIakdpirC|IVSJIX!;4>BaB#Iq+W1oZ6GM<8Rz|W68wAhSe+2&*`c4mFvql4DYD! zRNU^4rlo9q)qxW=>3U{RI4@pQwDqx@_j{e|R~=keyQR?c8_z!MnJ?B=I=re^X$rZN z59!4`cV}b8UX2$XE{J|E>0DK(mSP8UbL*@t={#RkPu}s3qEjU=l%1UT+}@7i9lblz z&v{{_HDw*W@`oPowWScfx&HCIlJE7aKi;`|TkKWM*$~u#a#2v>=ipyZT&dA@s(}fh@!1ETZ)SF8fTyKo?4%Oq_9{1?z&#V zy1(qjyv;u@|Fis|m*M}~?Tl@iUKopirPC{2xyyTKm^QAx=fuuaoh6ac(l%ks z%{^nQUX9=M7)R`*)n zxWdNG4|}n?pB9#O{m6@TU3v5H!dO?hP9{G)^+frGHG4?eFTBnh4i(HPs@oLLUs>>2^T1fVXU}0H3g+ew-@2xLfR}$mftO!D#9LEaa|!GYMmXQUE}ZFIA%`o7f}c6X9i0@ z`M}si)rYsOJ%0D`aM=$IUpJrI!gG!O9g>S{Wrq(t3*TtrG9`Br-?cL$)&?mPH z?-}bF*RSYk$>HH0{R-8C+ycZHOT9}v_tlitj*Dqzdv#0j5DcC_ombr0f=4)t-6M*{ zl@;aqdZBn&b9;O1lF`>*d)xf>=B0D^i0-vbs&Xx#G)v>b+y!`MwH%IO%t~9$S@<63 zx{6Vi*I(m}<0*ac5U3X$0xa+g+m?-}oL||RnYFO8wPIEyCwDGfxU?nHs$D*OVHqCT z*%o-e{rz>}EKt68{^vsP2KcM99{bGeV=MN#Lm$1uoccY2`Wv(J?K2L!uJrIq9IeB9 z9`0zfy&am3JLc!-WAi6w=iBEQIiDxxeCGLt74!3aK%dW#e_2kx_PI-T&psDr4<(o7 zczdP%<&%1Lzx95Bg&*RPie$IUUU6_^2bK1MY`&49o@{acTpX1qklDwAgkM$eo zX6J9;aAF7mkhtTpWI59asqew59{>i^o!=NtWrocUjIpZnmwKl*P(&it`C z^}F2s0fGN=kAI)2!uWk7%gfKNIX};r`r{jd4|C$dwcQ>!{-#v^;oz8`;NKn(u1~e zPRud|ue9^b1;@*%+IgE|@*GrkIiBPp%d;ZlSxrxGOi;-3YyhWl4a%|?FL}uF45aS* zkSx6#oZ^Ka$^^VpeFF^s<~GHZgE9}VG|p977U88nBrDEc)IWs@3R(JEaQX_Wo>z=l zDo)}VTF6}QzSG&C;$XQ3KtOpEulO|q2CVo`LQ>2F5q=9CAC3tMS^l$N`9A>rS7L%v zfH9YLIq)8nn0=MHDzMn^^*H99TlyHV&w+!o4KE+x6S3^XE5$EZP5vtN+o}BhBitL-xI57&%g<$$PL|H@ z(>f(f49DdG5+f1yyu87VhSEJ&F%X6i{>r1=Zk|!v@i7-w5`WWK0O_6 zO^e3AUf?scVVW0xZndHqqw0TGM&{YG0dn*IL!1On1;acjqc9~G*~d#htHAS_T%X(Z z1vM4=ZhYb)rY2B5?;~6jb5rMT0~eOTygqneieS-ryMv%v0VmuzQ6mL6xtgiJ|jLzlxgNowapA&C6c4Q}D zVmuzk6z@z@10ZU-vOyyKfI&oxcs{Ny~6rN|A_Zc-s1yS9o*mXLyVa% z>w9@4F`(l;dU)Td+fwvskCMnWUv$oaV9xQo%d*#wJ!|rZ9Vu$u%xmo0{>MAZve$~p zBX8?~Sl37lJKR?}uZ5L}^Ia^*uUDcMaW~>(9=~Tv=kB}ZvU@P$JrmyHv1`!sjy~ho z9KmwkP+DBzHEwyCHRU zts2Jc?nH0haKFcxO-nm(2>RInop*ZNzunMS^E>aYack<1T)yhnHFYmu&Q|hoc=2*; z>5VHcY)R3%td@1zp@|2|u}-vn@uHQ<5?pKRbNZM} zbFqWsHSi6avbpX=)8T!+r!mMxD3slw@<(K`mNbdZ) z8+*hKuBwf7H7wmyQ0T|H5dX4pU3GWF4&ts7uIuls&AV}23}ft|?gV6G3@x}!JZzc> z`D6Lczawz|2rcjE#$C6ttu2LTuNb~QdjBnU_<$2a;ndn2)}$MbQQvrAOo zxv#T&?Ne*V-hJrq`gM70f^qc0>XnDqja~QD>gv1qt?j=1%DVEk&vb6PTlYVr^ZMn? z+frDO-}uVI_(jbh;y|^fv(PKQzvnpgPo0fO^5z>9<)G_v+>h=3@FSL6@qu0}m9T*+<<~=jA9F3SitT4OvmK`WLG`;gA_7BI` zzI-?C;l8r7BaAS-o<#R5dFSfn#PK)nyNUO&R3}>FVovpP zufo5pyI4<-M89G!d#hJocxUt0XXl)lcYMLIMMuZ4e`fvY4f{7#-m~|f;Tu=gj>N7# zj-LzoAx;~%Z0zHW#9=Ug`Q_e!eqqFm-}4IBFIX2lIB(tHnmL^>cg|RQYVFj>UA4}F zeg%!2ACKkUy?pPcIg?IK8vliTU*LVri>;+OhevPVI@-Ho_&r+wli58X?k0ZgCGUsG zY)eOh*Kg8D9HryEdwU~ZyayS@4(_O#fjgpHKU1@H3JdNnX!JW`7xrAqB=$1*pTovo zS>L$wh^G-4>k>`+>FSlk#-aBr)yw=;m(eGV#Hw-euN1|$d}Xco!o<>oA9xQHyy}$} z{?>b_@SvCS`qi)AW}`Be{idM0qjEj=RO8~Oiei7c`j#6@i%_fRpjX=CdGDbftMF}l zzxuMyyzjT+b6SUj*W{KRaEpj(C8h(QMjgp$NqKWIL*g8*KxNK_j;em zZsVOe2k81ztZN%Z(3yfjquuL=-58!%y&-V+0T7kYYnbr4xKM(!__?xyA7JeskRPOpdq6V=rWqUTJRTD@1 zg2JYFQQ>#WBHyOPJ8QFBdc3nByQOLmf9x0>*)y7W=i$p0k1c(tu5{Joo|JHj_jCSiesW}8TsXcsDq3s9I9yUiXM3ex(a%54#~DXgA`^iNRt`<*=-aZULr z)BbDP^>xQPH;*eUSYHr3bZ=qf>|Hnx4)E4z_hC5SJFsf}4{>d~WnEA2$_eppCEmns zgT^0S+vxR(J#j<*+W)?4)sH7l+)`8&t6m$NU!N-Sa87-Hf3N%g&b-piN4!RV8Zzru z(7m;EbAiVUnx8GKEA6ox=S=uEuP5g3WTgd9;GFFt zoAw}=4u7H#zW;sVO0Tr<6TR`d_zCRijzB9dS{*s@-H1KZ9KuROcgjvZWAvu0@FWjOW? ztqZ1|y;mK~A9@7WMzPv(Eui0izIx@Kub+fz>X-Zuxvq!SjJA!52e54%tX#jhqpf z^UMy5ec#Xj|M~nspZ|Qan{(!zIdkUB%$e)+EY?@F#xj&~a8BR6!v{Jr|3=$)z*;*y zF-B#T45IHgSPCr|->97=ns4y`9|u~Jm?!+#e_}lRGO&0r<~VkZ`7*bG-7=qd zVy1(Sz7yp?_tnvETD7?RN3GiO5Rtg5Mk?rztu}bqyk*{Yv()hN7vuP$T)6tHISbwW^U(-JhYmSv>eR(u~U{;Yp z-!9DRIFz|J!I$l#xJ<-lQ(TmOZMj%e+Pjgod)XVcd)YeGkvVmUanQCwZ`g(%SyQcf zQR~4-IBNGY_vyjLp&iPeyy3@fz9C1ueJwPPMO)2H94!5)+#%UDl}a@I-EkN*RZVGp z%kNxUO!~H#c%0L)za2?*eH=+j{n+-77?VE^oGv$dH+W7s4dYC5(NJgWnbxVkys3j` z#uzmmS>Yk8Tj)k+GV-JU)A8Sz#Ak0DaW0;AnwdHv(PJkHrh>hJqxQo1BRjKNIH9ao#T}(7V4h}+O6xR#J}%) zyKDDv-NqYTs2{9(Pe966A@O38oA*Zj8xv?2n7MbDFS~yjW(T*no|%4Y>!IJzUfptU zIqY;O;Z}TTMqom6oMOiFTNGb+0X^IY)1pMoO*) z&)2hpxRLL95|7PCo;b;gxIgONalHX1z1FdJ!PJmHM!fX`fDCYMP>2#&HP0lfLJM4aG9LjC8u|ScF z1?s~racy962OHgC^yK2B&&;uJ;of^P?6=dQ{U*BpJ}qj#YPA&Ja&pk3gf8|v0&53z z6=576RunqY&RXAh_=n@Zb0GDE=o6Sx(%FL49Q|$~R;(>zwofZFI$OwZw^uF3p;$Y} zlRNfx6twkrwjOfbC~mQ?Zb|oFd}HAB)7JiOda3Pw(w%|R)!1p6hMm4)cusa3%WvBq zt}dpS!hJ8GmC^cT_jmW<8Hy9uZlK3i?+Tp$5mp+VEK-g=37kG}McUBz0qikMU_N6H zT3V7pD@0i$#K$4dfjDb#6S=sN-oU+JM)!iZChl?ilHPP~P3m*{25obCoJ}sr_9UEO zIsLSskfh9HJxS^CfZU(JcJOE6ZCoevT9FfNyewOxm(SS1NJa|Q#MAwwm6>?<2FLaR zckhNs+c0~aZCj40xsZ?)ua-bq;!Wh*$F?Hv zP^Tw6468EOsy|7waR==FC~}xKi1LIdpBCyHi1*M;yT04>k|=TiwD|2#<4g#79p7;4 zJl8tf6X|g7=#I1nA@xySN?8k{w4`@ululbw8@{+Vaq`>8d=Ak27sPL+|3?PmBZD?D zpR*6Obt?WgtMyU7#-URig3UhfCboMoKCb7mf8biYyzBgv1b+qkV*fz=ZQYUbPH40j zZNYDNoLOiyNw8iL&JpKWvx7PR)@F_q1Jo*@^B(9d>@Tcu9QL>>tvw0*M3s7mx?@A9 zm3B>CXy22@!v)wMcd>nK1#P*V1sws5s=Jdm!2Z}%#@a5|aQGAP%OszF6@iCG`N#Q2 z_p*79(yBr3jDr`wf%7l^F+BLiEaV@msg4znI;XQtI<2xuFGiev{B@`;kKjQfxwsr(IKA zTfn`$8aw`pFSr6N(A{;%7lFkS4cf7_&yjuJUN@Cn_Dx4tl3QJC5)Jzah*dcxOd1$H z-E(`L@G$j%8&TNt|jjBt~a`1&%9nYO3St;;eW{{l#MxjgFD@U#bI{qh`{0pSj71>Vo$~I z2-`D4vI5O1J&AMC&$7{`cZWNR5=*%z2m6tm6S)n8#WI;^LzvB8TNutQ4itqkw|E0< zJ#{VX%jr!b+oZ1d34NE_Nr5!Hw&lcO{dWw@A^Z8vy6Nyj_}H95O0u@sWr z0pyNzcjP{wU7Q$653@JAcDLsi`?3#!wh#Hw#(LJ?@kD!qCv;>Fpsr+H7(Fw2{#}0B zeW2DFLJM@1j$vk72x89@@=_985Akw=>+2;tvf$UE%e0vEv?Yg1uVQw)oZZFSHO9jV?9SBZmhItqteEnQJpJobLB z>Ss%WR#>grCyl8km>r{rLa0&NI}NlP!3_3b9-Y0l~GP#5} zzh2w$((S{I9xiRxUdu24yEG3C*UJ~J{rS4c8lv6c^XjNN;(q&Y_Bqo~e<-UhWqzqI zzYixL+XmCx75iz*EYv=MLyI)efg|pzf7i9LX&rx8Z7nSw-Fl`S^cDx0ljU}V{J(+S zS`SrCm#q%BteheLIfm01%Iy7QU}Zg$on)(0cVFeYC1^%{=%S}BjwjM4IomTKM zgzqmWm&rAIP02C8aX40<=a42=eE9|9wv?;vH?gr04WQM zgoQ(sNX8u8b&@gyI7^N5=Wa%NtY)^cs*;H7>`<)loO3Mij{8Z@ni5BUe+tIql-|uJ zyCa=v!9ADfP*vh6?N4zfAzg}{rm7@_8ztRko1UW`!TnO{uA0CA?MkR>C_N zQ}A@K--vX+hH-9Q`*Ews(EP$a8@K&j>{)Qa!o0Esf6c+XzM4Lqxm&kK#5@kCN0=Yp znO-=t$J*JsH@)yK%o(k_RAO#ryj=Le7-Qb%Lf4J3Aal}6A$8%%qN^6Vn_{m> zMDHEwb{ugr)KW(}_71Kt-U?n>W8fch)bbFHF?~*l|Lv6CO@-ilh_7Qp{fV$MR?-I< z2|LHAwSLr^drJJ4`1$MJ?b^NcEv&bEd3zFk`EMqK`d@>Lw;|&X;Qw5ck!Uzxx!4H3 zGR6q?UuBSt`RlgC3mKmKr_#Q&cMooZyouG}A4wnVeC_?$*%iLQdy<}1^nBWI9C^VA z9eEA%HW^!>=lkx$-=9T}^C7+3C|?&kvI=>07+d0ReekgRebNFx(YgpM>_~%bPodJO!^bF6zbHdJQaVX-0mmW>U?zV{N!EE#ga`|4RG)`<_s zA`6b?!^$V9mZ3cyIft`naJZ-8ZW(Ov3|HUj%O0BM%WO^ajeaQ2=N;wo<&Pig%PSu0 z%bh*cms2s+mwo3@(1(IPbQ117;|6}`6}ai_NlwNdN)5C3yD>*G&mU+9ivgnZ;?2F-BTw%%P!<+}5F?+~T2*%Z;I- z%MYbG@>)|vdBv&a6*$Fd>ttKoZa0k6iGH-fFh;~R2UvKz$Ca8YeY&(IR(jW6yUf>n z!0CHtzA$d#Pzy?SZiePJ$1nC+j6&=sxuKg&e{w|FZ=EKe z4I-~$lz290uxXnI+Ct??%yAOF1gBUtvBPH11n(`UTZV!4oh+Ob>CRvS-8iXXt!MNZ z!0HyUUvK}n{Q_p|%Khg)3x*%UEt=5(=#~psSk{vu@E8_M_wwl0OV!Q#Itx8&@cBK; z)++1|Tlcw)Gc=!&^+oqha8}ne5xqsO)Nz)Wj<(|PO!BkAu1Gk2T;YlB82=6yE$>R{ zSluG_behv6NZaY6(>L5(!D(M)VvxC9w8y@@3pdJ&5Y|4o`wkw$I(lW=0@D#e+7Y9Gec?Wk3<`F4Ncbo6sM$;EU_ zhb3U|3wI1;JD^>HM9lMc(vH9PY4+t@+8c9WcDBvxefG}ysM7ON24y;R7U+VXQ+1q7 zr+OVj{oQlP4`A0FUcrNwMklD<$PqB+@H-go$tPL5sn07UMLqlA!0p)xo^P;ujWbE% zEmq14?S$>EQRS=8R>YF;AFs&A+}FnRvi?u4t-)78 z=%Hs?&JL?C=PP&D7hg4RqE<^gLdj0}OYCh0*6%g2lS45mr5`i35Ij6?uel0W+-~eX z7c>GbIR8LgqO0``?uQ#j&orwA^xm)P@^GotMYj9Vr5@LC_A}l~LdetY-qr2f;d@iot}h|B9(qMr4Jzy4{g z(YS@TD(2d@{4P~G#!cLv;pKJZcl$1O#htGkm8}1+E?p-t#u{+Xzq9@1mN$1CA2@dO z=<(N24xD;5_ko;Z=TyCfiIB2)Q-|MvuFlbqlkD68hvDzT#rWXZ@XfF zwHl4(k;q2D$HLIk=n44;a6bpPGaNMX)!^NVk)%Ux0e_F!`6n(s<$6jf+s&l1^KC%S zL~mbz52RRJH-s{i;v}chW0v&_wQQ0qTRi1;_A#|4X;lbyd7hO!3kizIeljT?=Q zncy`1UX9le-hGFF}3@e9WSXrcFW#Pff z!h@BC2P+E?Ru&%6J)nDh-Y2p0_&-A%I!Ygy(s|w51D%uF@N8pOZdX&kFURG=J^ ze95vd&5Z-8y%^DG9ILhB$rgAr%EG(+y=!TX;^^PQ67l5YDF6Arkjhi;4*REtKe`{M ziGE+sv*2&D=G)}Eb6=-ECF_=AdLQ5?0DjlEFghTISXSDb*afM#4eWYArgW4{9TstZ znBp7Uh1J8qKa zzrH7dZpO|Gzu&%k^M!iNIqc?6iyBKque8N1Z5HM`p;tD$xODlY+pkTp9EA5x;#M-z-?!SgO>Y8S*iDtc#LqC(deQhl zWz&m&qc1Uh*(q#n>3ED4{cNbe^~O+Eis8$AmUVP_)?f#4?gaSOl=DUrYKap)UH;n+ zsuuS&|6>T+820c2se@SLu@S5(!Et#P+xOV+@MEm7eFbjN6vfR3#~?Oopy1V=U8sk# z*addYaJWj}v#d^gbSciL81xp|CS(aohwVe)bsitV>Ulo99^V~)ob7h6FlLva-(knd z%x7)vzSNwq*0t!N_L{%j>`~Mx)(ExWQJ$9)<44v*W8Qoo3!7#mdfF{d_eHp~6PMX*R>7j82Dd)~d^O)UwR&I$k4w*3VxoprI% zbK4rDr!agk=2<^>6ejE~;_G>|4)SlMkHog|M4W7;;+eva!uCncg?e!J#nC;uigp65 zy$L!4#?uY(U=R826O#+cO3yHQ9*SDi#BM>&;0v_iJ)UTT$Njfi^(WfkVKoMpp?NuO z2=RLwL&bU&a}|0ch+Xm zoq?!YwDZwdCLVZIUk`3iYVS+wsKo4`y>B~t9eQhuJx7;)F4F$ycGAy&izeCQe_O_W z?CXrSbiMG3i^>?a-okqBe^JJ`3zzXXPoj)*7b@dlpFF>e`pwkbj?7|5uQNN+*>*MU zOoyH>$quYf#M~2~+%R^{5jUnkiSBA$%_xU&sKVsmHZ>)B5w%6#ngv-JS5G2`B`cgdY+pey`y%6v9|4z!eA5o9n zVvQblE0#4*KBfDIvE%nXqx#SExw)9(cusUMtW>V|wO|jkWwH_Ycp{y^(S4mB-tN{q zCvRQ5ZE~b@+jU0I6hA-9Yr$C__(QmcH7j5iG@2WG*! z?{FpKsk7wWC;H>USgq32U7nNaZ2!FS@;ACX?eoebC$rdzuE&W`=2u9kQ|I@ztLT?v3|F%SKN6hseW;hde zcPKUH=-vT2kB+^?xsO>uN)Bx3gxHP~{;`sr`k+TKH`?@yN8qe;A7sk!y z{%qs@dfehqonjnrJrvsBpWS+ibGdw@X_uw-2A!Yh zwnuGoRKuh%@;*aaSIsvLv0~%kCH{x1&t2>+*&TkmC~z9jx@UEycuqQvUYz!0KZ0Xz zc*1n&OQl^)9k|wf3SE*sYZOV~Zl3o}tF^tpH$9ZaZ_g9g5Zo{|w1eX?> z*Uq+@urJil-u9C$U;YcYjr8>3v3?)h0goWd7RJpayNzFH#0>9`9(`l?`TqTCeUkUj z?vBJyj4_uEqlKmK8(L-O%xBY!)zL`2-Tdp`Vngpk3Eh~*QsCue`^H{vN3bIi5c zXl10m=`D3k$tg;}(=FSTwzeB>joyTwTtv@Ky7<_Q=M-tKiqT)aWpg3>?0s9my9I4< z+YN0IcMx&2APG_#&7v_=S%{fSLd_exrjhnNQF^wPloh#LWe1I(@qUkcB0q<~j(@^@ zu3ybUI&prM-}uY#mb1nb`y2@z&> z<#=`lyZc(rQV%Tu37&i8XYT>LpqHMN3iW3(y2+f9@Jo-8Z`^^A9s|dU{!+jrI+9a^H`+cU3n6BY&IB$U3=iuw__Fy zAw>?lIeR9dB#;_3x-d(T8reIS(h82t+Z@;{!D$7a5=ZOoW;F}T{2z7O{g`eO+50Rt z3tcyU)UB??dfNgApGKXdr(;hL`?aWxdq)NqKO55y-F>8wJtvE8Z~sft_Qq@ib2+Iq zxA-x;N7@j2rS@j}=yy9wJIFpqHPhWsXGykn-s+t-ZvHifw ze*1svWqJ;CH(4g$`WEBO_RTnNdn&Mg8|LHBVOO%5aJ;jgaOT3;>h6hCeMBq`vihR? zIMoXIhn%A1>7g+$yafRJg)vvd-LFyYNS$zN5_K9YhZ9kJ2}O9HlM_3OPTcOso5@1G z{>vOsQJ!?yArcN>#_#XthT|iy{`mF96XusKbX-<4Bogm;$6@V#(#kQn6KB*hdQaBR zs6_S~w>+-bl9kaMW7%uT7bsh*iyJnmzkQV72F3PqzgN{k?3rA1m&O&}wfwo6&{m?a!1g ztePEZcBLL~YdsTb_T$v|lOVWT{(xsEMB9pG>Hec?&SEzKvn`zE#Nyt2NaZGvN}PHd zEn9fc?ADiKrSJcR+TLR4aW;yF+H%=KpEoN$mb~zmPRc ztN2~9uRGJm9HGP&vpt+edRvQx60rxG=uf~59XI81KbPJgGHanPcc1m13Hv@-xAc$IdZqD1KA(_NgcGZ=bX&(hhtusxJ?O;8 zs>bSb63eYqYw3kMg6K=1bot8;Uf4RZ?z2-p?ZML-vYztFY#YJX6@{|fQf{8%z*7d1 za4GJYQ)$mXafq}J`&2D$D6=hPyx*6(EfxMRH4>&@J&`#S```Ba^7ruD^0WQ)ODV92 z--X*5V$2o$hQ^s|Y4(IUk1pQ}gN3KWce!}?Di2De}mJ_U? zI}fe*|JXNWV)pil{3#k~Bl6$J{KP-~pzU|;Ru;33e5uZfs3qw;T?<~t8-zM{;jKBno!41o zw*9u>HRt!zJ0k8IbGrQY-7$M+QO35Yw>DzzHb>lp#=r+ybCC^EQYzv^@MePMm;ctYs`N{IF zhsG5<%Cq^q14|td+++{5;9hLGn68|&!Bfn(e8-_`O-dP-^FG{vPZrju!juEJm5;n!Y*yePX_Q)IYQg^#C3Th=!~YvS{FkV3%5t%P^bLXavDbCmXQ-Y) z{7RSM-+MzO{Onhr_Mc(jryW`+LF+H@Jj5wH`7wa!Sx}O=0X#QxfQ>8idG{NkEcf>! zXI*i=oPGBhJ!$^0U(KmI_62QtGhT<@R_I**g<1AYF0gn5cBwX)H;g>(nOIr(VI}Uw z{c=2M+#P1+T|;pfX&c+(KG8)_oo9C^x;p%Y@%=@CkI!PwJ)DJZ$OiS@b&>lgA@$$z zZgV#?UcPQ)VDS!izL(r@-l~bTzdh^1RGKlR&sO)L#Tu7x%cyH@>E-D+^~lrf<(0Yd zH4NU>`gQbX&}sJ%>n7*Tx29m%9&c*f(x1F_+lgf3<(%Sy3(S{DcJmxn*Z#RX;lEfs ztx#fl-rJ5W>C5d%D8`AxAX>pt|D=0fcnTCZ<073|h?$4yIB=lz3RW<~!+1WR&^-_L zxlZEu*b49XA=}p-c>r8&5bny;Na}JGw*RPzvor`7P?Sv z>fUtMjidS7pIb|Oc~{|7`0F%CpGQ42;&h?MevI{u+8gK%3b~#11|agF^zUrY)F6ET6*dK9Sg%boPP7tsk;li5&@Z1sg;s~D5^0ng4 z8m)Mv#cI6KV)ZuW3uU4|cMkD{o0#&>DeMF%IdN+6J;}d<~yCm+%KmHtKfnixOZbeFDXv~n(uVKGP*zeD@7`5Ro$|zkJzSj6{_;#!PB_y~?cUTgzTbJ;DSUtHdYBNcc#(u|hnj z>=e+>)_MU>aip&Dn~2LZCTi3Vaay+P#-oeJN#ME z(vp)UrBnA!&7QV#n)}8qSW-W$PQ2qG|47`C_~{4ov|8qtQ{pea;?=63%GTL)S^3=E9*?we8-;Tor2WP%F z=bd?{7QFTUhBfdG%R& zE`C94#+`4?2hLu=n$}H8+nPT;d%iWlRaLh<_^pQK+S*{lx9+NIxPyKxbFBG$Q5S;8 zHm+*?mgK3aUeZv}uc)yCH9>E4W6)c-)O-EZ5^r#2Q?RzNx~?{#`D?$1 zc+*|A#Lp;AO|W)ZQy_Ybz@T_vohv5t8b{TZStDG`?a*DVp*d%XWYuHaRn>Ku(6a= zb)y%*OP0?XtLmC-D!sKq{5Gk#s-nI=Sj#GEYU%%uDYVe&IM+xy{ySw2OG08sfQVf-=C|m2{ysJ-wrk) zRdr*q5=Cuj4m366$78(}kd3qr!HUXNY;IMsAxM>gYO1WRUFNN>MS21%E1D|KC)YJM zEvvK0H`Ugx;`Sg3jm`D-bq$m+kCs18i+a;Z#s1!7VDyx<+3RKht(A)zJ!6sHxHe<5)Mz3X|V4$)piUE4o z)YUEvQs3gzmsdA6k&&x{=<0~PvpLwvD~JC?pf?a~XsTXX9iSco9UAYbuJ@i#p{}iR zDzNC!6%EURd0z4(*U`77AC;Mlv%A=$<&DcItMhY#33+WtWhIq5pCWBUc~GCh7kLws zeLgc}Tb&$PSJXGxPxdaYu0`LKt@LZ@G19X@MW8C^t%P%=j?mathn8smkRjuSB+1QA6L=496xp~cm!VM-1jh*XbYpOpe`Nrsfk;`)%PYy{ zE5EKu5#*6=cY&DZdK5V-k{0!=RQBB1vln%dm z-c%Q;t63xmWg1aQT(EMH;$iqO4=tA0o7016;;QpjixJL}7cLx{MR8v2{p3k<*Xk?%%2`nIB{yhid z$ErDIt{8wEuVdgpnEB$g3-N>%DO{2n6M!A?Hvf}B}Z~D%nS>L{K z(H#G`%V*4*JN2fSN~C{QnSX|VPVw~f$^POw)8{WLDV|%*ZmOq-1n&){tCz0wl8wDo zLp0&x^VSuZ$?{1(O%2Hf^4TjdF`u_`++3I8OeXGoNu8)1XxdP=YDt4Kt-jn;v4G~zTs6@zWpOO+NYdA2E>l}& zF8CVe>RLWa$~Tt*W5@%;)4&u<#+uW(M!6!8eprmQH2a2k4BXM!yxbnLqURXa7#|&N z3Z~(U|JpC6k7#H)S>qtBYR+9S0Xzhaze>smgt(Oj6DN+pimjY5 z;Yztmu?9J_sw^C%B@NnMdw@j4@uH7IEhf24+>5~)vqV11+x%D#G}rKfI9d?dIy#2h zB#A<4qC^9iqJ>xRqEs}6#0(Mc(2UD5eFP?ksL5dE7|WMnSxd84nTk(BL|=n>xF^7b zsCg3($qIBCC?izNEX2Cx2EPKo==G@Wrx-*U}k-OYBFhk5Q;(@bo{8fBh671 ze{D@uuBVpkZK^`s;z_TcGnbOn;!F5?%$%CBtX>AQsACgNx6HaGv9X!tRAE4C$EO3q=);SUGkh%nmV@rf)PA7ZxywN~-OeB^7}?B&+R^{#^o|zp$GaXk-_z zzhhA_fHgB(LvsTLTkp*B>C>5RtQ`OKw3P7%nlUhpIiK82Gd_D#(Kv?Bo=^kV7n2pM zYuPBTG9pBmO6*f)jk|KCI#R^q3DjV;X3DMuoafRy-t4l(#Cs`CbxjV1*vy9kL6jw5 zj%^JqwaRdPUHvNB!ohAyEgTa$e|wrfRj#~g6X+(n&L)KHqikOAU$y63Bi?Ii#)$cJ zW!-YIwZeIqV7KKCf-twj_C|A_7b|)Tu3lk*7}ZVKn(7G?Xp>+&5<+9JqV4gCFQ2@q zD^PSVxNuBPE8u73^16|CBE|WVYo^H!Iei-Yuyhp(c_EklkJ6bb{x@0u?=t!S=7&nY zGP9-M$;Ru0a26+iN1T2Oeh5DFo7rjjc<>p95B=`;7<_W^xg4K7e8%GQEqun|GaeuM zo$*3^@Nhd$+!z~<&o}V#;X}W}t_KGguS0fUnc=k|r?!l$Iy|B8$dU(I-WmDEn7Ek< zoy%TtiW~IOj;lS7j-EX&Vb!_`&UgRZeev#}O}>7_xXY84f4XSc6*rxkxP1BS!~Wld z_pVrS+kHp=I(^C?c3kn{9fQ7FxbLs-{U3gGEOK1P- zH@94SnBDXIlY#$oJ#wmS(#Y~(Y_1;uA5VRm`SV4g;H|!Qwm!RYdA_=yu^ z;_EkVT)r%M;>>9;KH~hOsU~6IqEYu0tiP=^f6~#bfBnQ=c^3_CcRYGoXv?4Cw>-GF z|JIM|rq6lpy~}_4S@+G~xag|xsrP))ef!z;2px!v0?2lJQQ5|qR12C@C zl01%6os!@*b{gNJo~hoxVd7Nx#F)ko;+xCm?c^IKehK36$Q>(YqBUI#7(c=b{2-SP z@Vr0-UKo=ib=DcFoK#*4WE0Yx%1ZX2K>1ReC4H%kWIHOK9%8jS$wT&w6{rkqKNxB< z>HUH1`~NtQF{rRqFmyUE{W!9aS4(*SIcso3QQ(LeE_ za0%zU6!ytLdm(F38vIg7f-3w{N z1?4Rmmp?v#yf>$+sj0qk^0&UV3_F+2OY*TPLT4Ky$+v21RxBTj74q%DKvOh82Yc)dltA7cDQSAGat#Uw1EG-dr=j zp4`lN;m2M(%E>lU~Bf7ll8vi%AeCbEYYjm5P;TXgi z?3-Hpi?#G4*u&&l5vYz0HcaEcgv(#bIq2&W)^BDu8dx0rChN;)>~+9YUfDnF_94>W z4w?u8KO#}c`vdItd*Gx7rC$a&VW8|}W5T1$|4psD-(>qteTq20*LVl^J&8Uo`)hRi zQLH|yyu%Ir;0*f)@}seb^4pGrT?(A$NU}VofJGR^^PeM8HcGRnkENk~jYWECk3D97 zsYqiWr!@G7si4ysB<0)v-KW{xr^(Oabi4g!u}jSMHW>2aFoTP3Z&|F&Y;S^onI=!i z$7uA+H9U{YFG5}-5@@Ch0|iOaX^L*Vt6e1RWO@L8zO zie!eCYTKLIn+Ssc5s9)%>=ihg?cgV~%KAw~eTguM&B|u%CR84^e@SnbWTYqikBpNM z0w0hl=pSG_8GwA6M^pNrpgrJ49Z~sxq400R`0=Gee*^V78u^bk(^Gy675(zio_*lI zPN8p8=)~Wv;0N3yv*DOn#<458{^WZ^5c=;_@NDRRJ8B2=J}1}`VLd*l;0!`&(?4^>PiHWe}hK0H2g*lpRVCEH2fwFpT+IVi1#b5zf$!AlFKYNc4S!$3qx<7Bp5ID~E^ym^0&h_0(dnx-{cq>;;PT8M zaC`g^_!LQI0>=;>#XnA>CY{DU5pLJ=tKs?C?LpuLk{$0XB>!udN8q+Rf!pm};4`)K zcKfT*@~`FcCt3UgxAUuI(=Z>fLp|rW%P06>wHO4RW{o!j->BgaYxrpmx5s;tzEYDv zQsd9l@Oq8k9-oE0DH{Jh8h@EaU!&1&e&|O`|`r;R`f?Kgg*9sL*O52@*dODKcnGaX#CG>^j9_9t>N!$`0EP3)N2U`P_MP; z2Hrkzwpaw-rs1^;9_3uUUEsF=5cm>>9-V%Lrq5j(zEZReZLfzl{)aVr8#q1H zO20v)Z{&2ZMHjd|o@`{VVSTX+{Yl+Vu;&*WS$H&KZ-7oZ%k@c#B5xZ8yQe{?{cxgJ zV4?Dw#&6G$H?kWt89SuVqs#jU*LQ*?U*NXBkFY+ou~C@~Hkz+b?Dj4AZT~Is)r!36 z{5JFappqE`K2M@d;A<2-I{jlj{Y4gC;C6o$xILZ<+@22!-0shhY4!I6mtSMa7kH6| z+x77T`xN8z+pzB_@SHzC?$P9L;qvYFxJ9FH<8<5q3EVEvHjRG=s~j$rb7GAa$DY#Y zPjPv+y#=0Yl}F%Z3LY>!hl`hI1g~#<{v!B4RrqOsWRD+${(Fr+81@lC&{H-1sD>ZY z@Rf1V=}R>FQySi`;V)_U5>4K3H2OOl9;flI)9?cd9^GDhS-Dr}-plLf8D1aue6?4r zFF~JX=uA-hW4k?z z{4%Wa3f$Itr&hnuas78$@&#`9M}c=LbT{_bu7Q29C1vGrkN1MVQsJlmxKzRaiG}-A zC4D+F8w8xr@6Y#FyI2^Fa~|mG_;kdQw~Om<+gIR=HM*^jpl?y=k74`^LO!`I%0CCr z>AOmPw(Tg<9?f0?FR|na+^$c7zogM?HT*dZ@6qu46nwgmu}Aa10Kir zY4wYDQG)+JQCW1(E!&H&-##`T_B{;eD&dlPt$ zOwI&eq~Y^4+%CW1@6+h}H2m)h9<9#-t`Af;gMJ?OBB$H)ix*ivm}!4eo~KgzH_GHp z@Xu24cQL-c0{#rdNqe>^bV`3f!RcU-#zMKj|1R(|NRMi<(m$o}Q~I|Q`~ZyUQ_>SX z*|N9LFH^&>(eS@2^6p1_Z-Ts0X8ylJf1CnbwvT$Whxx$O{b<|YzQ{c2AKjqCY?l5z zmHhrAS!9;L=@;|yIvM2^LFk*O;cGQ~kA`1|{M7VwHT($;e_q3nX!vOj|4hNJ@G-U@ z_+Vs6^&8#3UgGU1!7A@d>?yQ|chNsmO@6AMHKw+V3H}xhx9eNba};@$K25`yXgHm3 zi0~2{lO~`EZtDNP z7xxkD@lfzLN%fh)?eRt60~+0Kzk)te$?sLz|7S{m(fS?M{9zw^gBB_XOYkvRrtvma zGy?g=ICg}W=Vl&5Uwy0q?fsv)h(v1;+26ORbktXag6~29dJX*Y{EX^ztwMhg{p%sn zuT>)E;Qu~^4sbh`Jz-)q2>y8zHS2?H zFM^=Ylql%Y_5G@bzoy{>+#Y3CdV$w!c#DSH^*f-+d!5V6xAHn@KPvEvZf!p!~Zp(XDllLnw&$hq7?el?Ov9+c!s&fPHKcf1z z%PaVAv&t{<#Ts6(;0^G1@4^4d{U4IIQla01#&<%aZ&2vb_C3S(x63c^2^PP=?eYoy z5sm(ih9A@L(U$)@!xmxuC`N}$1CR9Y_V_F0|4B=KT*Gq}c~pM8OlK6B68)N&Z@tAY z@aHuAn1**+`3e4$3VpN>_ko;@Q6HE3U#HMXpDQ)oE}xKRkEa5+=OY5Q&-;JPN-@6U zHAehSqs(uOCjZJfsqnAazo6gmQ2%tTfcW`dhnD`YT6$VviXig0?+*wZ16>q7NyCS0 z_+ka$jrv}K{N;M{CvZLy;G-as^t0=ZvN+35W4*fvbanl?#LS)OKhG4%Z}2aUeaOz4 z_)L^3jt%Ag>u!br3)2}3{y#D=4TK1Se+cKd_cPA2k>I}-nalM9)#vjf3BJ$r_H@*; z-&s})e*6Gy)OyCg4)gB||#dhT#&H3{I4S!L=M)Zc@^X_`j%`33Cxn1auS{htP|+V3`{eE)&=JVB91^^>O1 z$DuvX1|4SR^6x->?*}gJ`5+4RDsY+qKT+Njz>}2nwxBv)zA5Mo^z4Mxmp`DO*sD^>KNa;o z8vMf*{^<&x^m#_Zoo+4+U&8+HD0Da4>y?n_RpgD+`12Gzx_|zG`zz8#1c9T;N8y)B zlnFZd9ufYaji-NP_rgD9q(+y|o`3w2=V#A11aAA|KeCOm&!_Mwa(r5V%mzUoqPTsd z_5YAH!v61osM^!c??Wv=f!q0gsOkS_&Tp4b;Md6FGJ((1aJxKaddr^(e1XP~f|x=V>{u77#z6cSreZ3{gCck~&A>`TX!#}g}@E@a*UfPq|*96P|2>#(p zenhwZp`ia(p{GEf49H6`^@*;JPc(ZA+-^StUt{SnaNGZX!k&PCyBhLo7^d<@%l`{| z3iZ7NbhW>2v*i7S=YOAuuha1L3jR~Hx4R%O198&6&ntAYN4ti1YWNcxzEQ(BYxr>u ze^bLJTlMo7_8=PLL(mUhz|t?yst-}#Bn_|9@L?Km&(B19d;dz{_IcM|*nv#O-dF6s z3l;Mu@KL5d(e-nV+kc!@o^$L?w3ojr>B*j_6guInHQct3kZ0G&IW`jQIUD{=?GJ6% z_#pVNvC1oOr-s|-k>}XoAuk#7)cXHO)8`8Xk2jqo4FLvj{*(UOwER1@{9e`Y4>a7K zKMQ^B{ho8|2e4lmDqk&cy_Vl-tG$TyGd22^8g8Gb3I4xo^ki#%6ZCg9`UgsWFT;L| zq2HC<9%6s-H0&vYNKgCiDn3t>pP{@*J$`)1^+aQvF{*18WYIgzZ=EaBgh=lR{kXl|8dY?0e`kaU#ieY zLcb3|m+3oDG1oyqb$ob2;ivL!)9_vekM?JOV-d8!Z$q9}$^T}+BK(c*Lwjgc=+Wsv zXLqALL_k;Pvr}Yp_Br>LOEi3ofTtmXyMWF97Z+y6X*vsS>?C)LmWK6CYc;RPekRrPs4jHeFgo1g0Dq;T?P4a|ANx* z(bC)PMWnA+()0W@JXgc*`G&)om4o#H@{|6Y((lsv?fxk8dtafSg(3DJ{V3BO(e`o~ zU&67S09`%*-e8r-#qG08!ymTf3;OLE-JU-S`e==Rih@5M2Y-tE(d?}HI;P3{t%iT9 z;NL}KNK3TG*XZ)abN!E4`~n})@DDV6g@!NI@adNRLZ02;1#bIqf!pm%;LmCD)@yjL zhTH2;k^WLGf4lv}8%IDJ4ST5dY4^`~ZM~Ps?en~qU!u{C@#D)Ke+7L&p+}cb>__KX z`3roUhI8#LjO;+&mM*TAsYHY;Hv+4Lg6QS9Mte01s{s^?;^e2 zkG>D%c7-$5dnCNXndIQ0?NA>?NRQ}zB`Js<-n7{P4>PF_F4s8&c7~$J-UD+ z3r?Sg!afEZQ&^5)J%+JoflGUhhdzga%S?PB>hqt#W%*a2 z{x1geMJ9bS^c}C@@z8H7aJV=wKOXwc1}^o>%|-cu4>IW^#xQmVaJm0K6#Cr<978%! zzX|$i+ulle!>yI7N#VO#?KDx{b8D26?n6g&ufv;dd-9lsp&OW;!eag={6 zaB07DsGt47rM&-yJzfSb>nmEH5ylDd4@3WiNk#pE|5D)6U%UwWTcfqtGLl*Qwxb&~F3qcvIgWLcd3WyG%T~ zd?Ph`U#j8X)NrqckJfOX<(ZKkbKt&Gbbgt}qC}#I_Y={5rXm>D4P4ka)3^ly*;e8g zp>AlcA?hpBxD4r0M6qxK}NUsnzY%>sktwivj@Iq7GT)=6lg&`)sgyV?}&6$Uz93R9kp@AOZI(*XL zC9A!Ji9qt+riwEI;jLr{GZ5}F(^C}T>D18?Hsh0qUVK8+cQrAYfxu@?`Xs<<=r!AD zqKZIfNP}0HL>&Wx#HL}FJZQ@Ia(o2aLyiLBGkntERYPX|uH*P9c0W}lLOVWbn3a5= zIwk^|Iq)o2K#s=@q|enRJr8gic9E)0d^*STScZx3;&?uDne_#fm;Yzfn9M-(ex=Dj zs@ZQ;g5(zI3(WK)zj62#rD*z}wfY!r@}rAE-vU-0g->8Fn)&6#5q%OntK~OItG^FS zoYwqlI60r8mFI2^KcneK@2Zf2%Kr=W9||<5PeV@`qw!anEfvPQyeTPjUAqay17PiCef0RucTgVc5`-<{a zur@AT%3s0;nex3{et`YaEDzn;PGdp#l!;TiG`5W0X4+5aSIxdK`(qiW-_Cww+DG`i z8g@wQf6trg=?+aAt7ZQ*?Y)MlZ(#Rn{Q+!NprXpP`3i#ZmZfGhKVl;Kk|_JFVAn?3 z|1Oqo){kf}E7>zq_$qdT>AwX1ZdPpiyKOwb@3NOodx`Sj%YJ0?i}K#bzGvD?&|6rk zSw3O^R<0@gm1$4np)|FoJ?3%xM)tB|oC(F=lCv`VfNQ!9N)wKq;x>aZ?@JyAJp&RX}Dhs8he8cH|YXD&eF{BXdI{if_-k%ui^L!c8y7&!0}(Q z73Tc2jN@;!_e@;S|C>D%g}=)lHS16KyI--PT74F1_(i6@=u9GwonfDA{{Ah~9>|{C zbGg|cdU$>On)PVy`PZgDl>AP!zFy?~XW1dm{*Tc>X9lXD7bJrJgn!5McN9%{p;rG# zOnM$@X}G@=XUZ$%`Tdzar_GmM)$lc1`7)`Z%s}})X_n_zz-jCgw$!xGbT0od?3n3~ zC<*aDXwoU)G9j?ZhrkjDPTJ}}Eidyr{3UmIuoN7`dg zWB*_d6PNPlnK<2wx;0glQN`HQTNiu)G77 z30R)z5?qK61=4?nDVty!Pwgfn0bd9N%lL7CN0{*h%lPX6dzwV06D;FP0cV)Lj9?i* z4e$svo?scj5U{6N$RSw9-wrr6310{+@bRn=JOoRgHo#-ee%B6ImX~13(+OCXmtYyc zj`+6VG==T7o4{3GtY|huWv-9>Jrw)tf2)UJ*~QOuHDcl)sdC?h`x& zOP&V6W6iO2CGnHN5L)n&`VcJnsZC0KHV}_lE`lXb5Am4e+cv;b{xb@^2e9XRLLY)< z+Lr+5k&(=h=M_K_{&_~(u;iy|ljR~<#(R}`f@S;!ifP~i}g@sV=KJ|oO{ zf@M6}XY5#fA&~tusAD0hbwSN{gc(n;n$|OpxP{ICUAz-~sU{P(hYT`20>LsZ^}!Kl zJi#)a(t1MlEvEkeE}qh6T*29yDklw5Bg}Y$r5xTit`hvz6!J`%Ozfc!jX<#Ep9EOy zL$Hi50xa_-SjLwCmiZDa<7WcSxEfyw1k3n2fJd0|1k3nJz+uP!xzHC_+?-8Bef`e+sZ1 zM+lbjM*wFO;R}Ia89xAcL=nCa2$u050hV$ImhsdoQm5bxAqk(1>p6ISyE5YkgDlft zMEq1C2n5S`a-$>6c!Fg-b)k$>d?64lMSw?`@dV3wYBPD$@P)7#A5S}3L%@=U+C%D89?iV?moeRjB~K=zMwsyg z%lKTt(&hxqc+xpz2EGt<{YRMbs{T|x8Kf)%!BP&HY=jw4u#BGtIFG&%Zo^0FK(OSw z9dPPR_(Dj)CzU!1LNY!X-{#=?KG2L$1zE}&26*gT!9N`TGRkdO@^Bw$#;ZQi4OUO5 zusOk!|3dKv;K^Gc;x`CA36}9>b5FO3Cs@X3EAa%&c(Sw9nP3@DHj(iJ%XnU2X1)afyZAKlq%Of1 z0_l?);2`f`63!vo1=c=tex3&&nHTAqS}Ekvn355+VaYQYQ6tQFf@M6FW$aSHPxYI+ zOu$sXQlFavOMM8IX{oNIK5D%$CjKgXAuPs6@{@`q%y@!jd@bOy)%ZfF$4BNxu;gh1 zEb}5*#;+uPYFr2e%lLZ$k1*p2mhsfCq)#AN#?!bnwgz7aPvDcfoP%r&{z-iZmi#*a zOMM8I@zf?Ws6Ys6``ih9gc(n;&Qqz(kj_|bs#8igFX_atGu*OO|-)83hc ziximdjY*vemNMzSmDHJF8Bh1xGN>^k5G>mhtSda_|15NWqcoCS$71>_%|uuToVy2<4-H`1k3nTWSK{u z8zBuJkNIFE!II}vz~Nr?|b+{D8Wb8 z3&E0SF5tWtd?75vNAeIXdC0}&wc-nbs!;L}EO}M~&Z92`@=+3Ar@$Kl%khq2nf4ha zo?sbIenyU81k3n7C7xgz|2p7|5WWxymhr~`k1*p2mhqupWV68BcxR(Q$7WNf>TQvg`%K(OSQ1X$`ou#BHf{P&Br1j~3jUmIb@6D;GW0hWD) zU>QG;;>|unu#8`-#1kyzS19oW%XsS7sU1R}*NNu`!sY}^9(qnawNvnX1UPT4fIp@9 z2L$|2z_JY!EYmvUz)y`A!A)?NfazJk3~I;-1WW$GfJd0|1k3nK0jI7P{B)-y?_mKK zQ2avzrsor7Je?z?J}Bas03I6=@Jfo`AmIBHxE*kw8Bb>^d|&Mo|Q^G!7`qz%JZaXGX%@{ zM*!zNfiDCqs`SYOOP*~MZ?<8AW&AFMpI{mPqQXzGj2{4;_XB((yory@i(tt^K1b$7 zu#8Wo_#UA@!7{#p;?4Oy!7~0DzQ$k$=ic3gkktd_)-PVR^V}fQ}^NvVKP2r z&9qYhr|zRzv9IpgBXm&9MdO-huZSmD>QD(dZ$G{es_>D1l3>YG16cY=f@OR?@js6* z1cGIJ6W|eMJi#))1+es!1j~48ld>#)tXw7ZRL9CEz$5LGMDPK8A*A7xYQh-`>;>#G zFAxzd^U497_hWn^kUgcGNeax{k13OED|tvO&p~`45G-XT1I{~4v0_hE`j+9qB@eID zmpKdHQ_AZT@c-rRZQ!gb%k}>~%nL7qE!lvyhiv36q_wBnFd%x!1D+W~LL&~68aWIz zgFpjJ!$9aE0|rP43tG7l-5dCVVjz{rSWre+?Gk*S%Pk*S%P{jY1?&$ZSw zo4v8qIls^U^Z6~Ey}w-RTK985FY8&)T6S;sQ}@JD#T7PY720RNWG{KZlJKc+hseV=CNcqINUj@r}dk(5 z!0}+P^bzF$#0$1+d?^RA;&9w52eR}Fsk_gu$kJzl!>93rZ7#mlCS-Zqz*(11H*okf zykP5ruiz-jK1U0FZrl%V!L!B#@s@S|L7vWf1y1Mq$^HT_*rGB2obe>QNk18!KEx5* z^)tI@e6oSDMe%=W9K~k?V`IAozlzX44|>U%V>SD0<66AQ!yE$VIoI<{_IM^Zd>Jp; zc)kR$L})qu)|feDjwP)291f|{>1655A^WQN$Kfsby)n=C;5Fkq^6SP?K5rPaPXotu zz}Y{T-i){KkH(9rzh&G;{cYnbssGt{1@*reucPkD<$07X!GaOnc5|Hq_HO=H&@JuJO3mV~#iZ$CF)O zPaxwzZXA0hyvf7Hu_ymjkEeM&!{duRp5^gu@;i9J#<5!RrwF5UNC|Hiv9;n$WpUh! zJ3L-a?r#1SWOg{VmG~+-$#@Ofwe!^;Z}fPx$6GzV!Q<^@H)eKt`cASNd%HaSc8~XX zyw~G?9V0LONiJiz!7@|#p`ja`y9eK7u={y|x!lQrkmcsf}+ z=bZFm^OL1d0*93rlXH$dWO-)NGsrybYn4luXRfD{rAKql`|Q{Oo`)>YP){dIA4UC$ z|PnCJ5(c{{REYGE$PL|Gbm_6N&4ZtBELSXBMFMW>zS$?*E zaE5t8aCW3|Ejaw3@i?%KCF|Ha>i^yEPY5mMY#!^@0A$5%1&912ve?@3r8NLqo~U13 zp4UKE&g_?vlPES`$CWc#$BqRDeCUF00=`1WlgK&KyMY5fXu(Df>x?VN^~T&6o@dNn z7DxK|p6<8@cBFr0Qn$He5!yM;5&e=_4Zt|EWj^x@zPFPPZKipeoh>2!ZQa6E^Xn4e=Ha2)04{A9(6a&x+$ z8_&Ve<*)2lolK~IzE z9K&I=anz43#=W7ZU$%3Nth%t>(!Vj?Z^J6+;pKKL+b#WD^Z4VZ8hS9#JUmB&`ANBf zJC^O4b<8#t*MapMgRFcegY_JPES=*m!-XC;vh-=-N~e>hUk28546<}!D*bD#3)$Dh zg%+QC#XP6N#ip|_#8F>3eXytVJPO*(&+A3jdCmr>-7^!i%4M4$7~ zF0kT|73Y3WCrf`B9ImiqkAbtFHGYHoRmN|Eb+rmy`R$G3u{I`RHHRjnzUTb_9Z&}ArQeS8Kv(#N~FM-3W zO@9M#!RL*;bxY#R0IOWG%AE}k*PB0jmcGGwkLM@LA3Xzi`Mkzs9lz!I$?|vOb8qM2 zI8Sf1_+)vaF~7-ljzc}OCCd}d&tFVD!DizSp5Qv;=$f*{_(D&gmE&gld>y6(5Ykfu5vAwW6*k&Hy(&&4G$?}{=-FbX;W!je2M0Ic1=}o7=OriO&R??P@RCsJbh30#i|IEkAF}jz zaCjqLu<+%Hx;7>KC$NzDmz_ykL71Z;JU2`C8NYIh5k_vnO#4IK0U` z{N3m3BeLT2=PlGnQ|NKuFHM$*=ZIo%^mrH9jRBq`;a9AzyP$C7pIbg;^r zNzYs6A)MhAh1s zLIk&296oLccN<67#9NF5yrti7OwalZ(g zEDx`(@msXC^&=uy!EJ6OG$%nP(34>|Mrl!OEE|{{pabCQIj-&+N5h$>%GsecA9*vQhyfx~+({<+}bJH}Hyo=LvXboOcX z-;CS9>5_81cKytBIsP5qZ=Mxk)t9VtSAtbvvh+3J%y;crvUK)crPImMxwg^w%#fw; z0B2pjZU!p{vOKqfl>=G&Zu%dv9LUn|px^0a>Gy-x=49ysIOO6NTR)EnfrAH4XCDRo zjce%ncjNJ3U2DjSIf?!Q=HdOF+Mg`X3~+eRJQssicd|UQz^Xf0`fRY;pDeu@toA2M zZv|%`va;I2!S{?;Pt%q_OEgyOJ`qaeqeFP(g)J-bh31g0gWHB zboO=H{ZeJJ^l4z_LzX@RtbEAQF9wIa@xpc~zA`^dSRS6&l};y1Zw0H}$kIE&*&`Nb z894JF3CnXO^h&3brLP04zGUfa+u%nQhwT$SYCMR3cV9r3zlNS4o2SwBWe(z(`B4rJ-kI?C1EUq|&~S-h#j#<8J$MzW6OwNEk0(m8&Dr|npd8J#cw z_^E=f^M$Nqc@Ad&%Z~NW#}V{9oh<(-aP}GVj|GQ6Gad(4xn%jrgH)aQY=Fx z17PJqmVOAF`K298mVTIir<0{W0aksFf`b?BSe`qhkP)A?KONUAF|@S306L2 z>2K5jvK>p7&U3BO>Hc}w3%c^*d8e}cbCCBtD$Bq3=|}%>@Pdu3vUpEa>2$L6!C;j& z6s)qy@{9nhEVA^F{#WpVjV!$eT&WB%O8+mGk+CW&r->zOuL@gJd|mBaQ7IP2Qs zMR53M(_aBAXR?lc3#{=#mi`V{RNPuK-s%oh*GISii4>EWMVx`+i!o z^wUs>Foj0KHrV4@aNzWFJf7llH0L|d4CtyCS@ACht6pU3v*<6ea>>$XgDag*mfj9l zy~xs6fCE05$Hui>*5wn;+iv_HH*Y)LpSQQ+SUrO!EB;O3kb@W7t@u*>JHcw7=RAHD ztY`9M#d!-HmRlUojd~`ZKToFn*tN13JUVt9{qFma$)avhSe|l<&!4T3hb&L@a}#b1@OK}{|Fp-ic{~BX7=>Dk5W_ny-kmcc;P{)#`@1*X^B1^x+^OL3DOZ`gg zYqIqHo}Vn8>qEuQUn?q~Cp`aAaCmAryyEYU;Y($a74v24t{uqI-voyP?bx^Jalc!J zEKd)f_Skxqj35BunS|P2)3vEth$(F>cXKjX`c!cEVLO)j=vcBm(VXCp_2&eh*CB7nuyx=| z@yR;&DscGs=DCI*mm680sJ`wOdHVH@`eLFT%f3iE4_U`@Z%}6*zJ`;HE6C>?GiJzd zG{6?c{D?8zFu1^&eHTtO=4FZrqRgEHIAdw@(?5gq~?lSmTgmwbJQi>0`m!h2|gc@wwpiP#e!=`KN%x zMdqJH|6=1g;GoTTE;#e)gmvr!=#@?~$W_gn3 zUjq(1EDq1*V43kC@@I^rcHOYsJq`2MV3CD zy8As*Wa*cJ!+)}vY^(GKEPt{*Y!i7{-?aPVr}=dcS6G~t@Mv94Rvfm2*41R`SA#R3 zwPVTBH`4EPvh;1>>{aH!5v+C~%d?ZZYX`FQJE^;NAWOdwtU5kKk820AJV)sHoR#|+ zJ?{63k>xo?-L(%{`kUZzl^y#wSnWfWCt3$~hrkVM73tAB(6z&H>p-Xb>%f6HR-b#4 z6{iZEU1>S+ekZ%ynD;EwPeakc8q+x+ig~VSZAn&4j-_C&`R91tN?vFBHRP*}_kzXFphNLYB_<*O>A9;xPT|Ehbt1N9cDtS^5)T-HVZ>zW@$4SRD3O@CD;{z@cNd zdAQMZK3fYM2h=y2o*_Fw+gZ%}N5vmY{TlO+qyBm0@!;$ijVFNBK4j&|HN4t~ES>9l zwU7V2?qd2kTTHV2v*>p^S^8|S+J`Ki&**|{EzWAP%Xu9*d!6YUJpCF^-wamHWX0SH zR?cMUH_*SuVv?ov-l5XzWa&HT-)erc^qurOohCee}B=$kGqc?{u>CBVgtB2sqegc|Jz{pN)B6qnyb)mLD@KXR`EX=y$o1 zr9Vr*)5+3bpx@<2mi`j`PA5x$6Ra^qmd;0$=?~gDPL|GFo#4w>7v74fE@XKofK?Z= zbS~dB+wp>pES*dFN~e>hbBU?k$kMr_%ie$&Y+TZXu5Gzo$lho=FaOGotYdlER&HeJ zyd-D7f){LL>AXZ$I-M+?(}!{+OTP)6{SscV4aApnAj`uwgK{8CuL5WO#f~LQ9}2E? zI$8QCuyP165c^xtBBvh-#2JDn_jD>%H> z{M*3lJF+}npQ!KrwaQKOf8CBH%YQTdPA5y>16JRWr5~d1zGt2+{V7i;OF!o6Wa+&2 z=^mUcy@uy|Ps@`meH=Kv&GhkL)txNQ1hDE(mR?8yZabDNeKP${Crh6R&VIxEbHKsv z#_izno5st)%7Lt7uLLUxvh=Iyzr&6tOXu~j(&=RBo55ONk)_`VR=H&9H-S|yS^CZN z|ErZtmVPV!PA5yh2dvLA${x#(g^h&3b<>%*R*>9QuDX{vQEYGuG)rBmb z*9Fxj{~D3G(_;G9h*#)$I$3ev25StHrB@(C_AZOl8*iDt3Cj~es&qP8`Ur4%xA{Z7 zDSxs&HDKjWmR?K$J$S)JmdvUJYXl}`8P?Z7+N$nx{vME&T0&Q%LN^N__S z%g=ef(&=RBQ^6WbWa+Kc-Svnpy#t*2p2a6iUk&s z?$5(_LJz-he$Jn2bAK+qkH@-uaI#`PK);&@$kO-I?{u>CN5ML;$%2G$Rt{u& zo&zffvh)|}f7tRTOMjVur<0|>0nYxw{G4M|mOtO7uv=x3b!-_pbJ&h0OYZ@$bUIo3 z0I=qBvh>;1-S2-OOJ4w1K4j^Oz{-a#y`BCa;sqO7`Z92()5+4W1}h)3^k|;k3jy14 z^Q6=Ld2$!yxW8dUR-8TH%n^%2md+5BPA5x01Xdif^hdy%|G*12vh>Hml};y1e-W%W zWa+Pg0|vm>gWsF+Bje#HEOh|1>|pA0~L(_yy{&F8tmYSvvo2VCKIp4q5tZ z^gEp_o!`r+Hut};?_}uNpIMx~^knTGoUCIF2kRboQ7mTk4>pqk$|3B9&3tzH)_z}4B zAi?4x#U9XNQ|c#5Y_1uGx2;!Fc8AF}ir z^t*G1Ed65oolcfM2b_Jz%54R!eaP~3fWzOIXE|8;kmXqcRz76uE9rObK$gCSey5YA zZv|`pK$dOz+15Lk5~OFvBi zF*}wl{So?|PL}=@SbcpItbEAwya*0m&M$+N4_TgLVC6%W{u=$RT(a~x>32F=dbf%s zpE7XpJF80oPUm36MwWjdIDFMSgFO#fo{{vpIMray!~9$AVnzsfp~lvO{JL>(u%4Td z6*B6mX$l39`~6YS)O@ddH8%! zpUsiwSw_#FEY1pg+~;~^dA5VqCS>V5z-kk+^qt_$pDiX?`Yv##)5+2w0Bc=Gmi`bp z^Nz(KOMe(#>2$L6C&6l4vh-)c*|#mu|7yRdurR@PT)#X0|60G7Sh=%NcF}%!o)h*v ze<=>O|EK%C)ap10^$g0B{t7CLYp8cO9_R5nWZq0*t0VU`ou<|5Je+HaB)5;}F=kuJvjfY;C z%Ef`l8L;lx$U3$H`33K_x(@`08Dq`~*-GQh^b9iI3fAuvAS=!eu!NbW(pj&}`;$6KucF`SWa-sll}naB9voCz z9L{^8<4dWZZu(`^2OBq&hZxTVD`&D|E&wZMvh+pt54B^-(%b2GI$8P(aCVsauL6gB zz=LfK`2)sRlSdeD^!OU`8K$#;Lp}t;b_4l?#@oT!(D-I@)|maPdgb@E>XqNus+Zr_ zdk{zUBCB5agVh&g>5qVw!((9OK$ho8uyPFC+7SXj5eKfm(ESHVm8x1$~<$y*;?Z}=`XV!$nxJu{}}T; z09HGY<%yn4yXV;cbLofZcfTuxEI;QZ{SFO(j(Q5Zu1#e5p9QNg_>5XPkmcbsYV`$K z`pfi>wfxD_kJ0aRvh;Vr8V_XYJuts12hM@YfhGsI_{u8 z-t;Ry59f;D!=|qTr^nkEBP(V!Kb&J8uA@{hvOHW7Lmfj6xQhD|Q2QJTk9#?tHbx!6yE0?S|Bf*tUCrhsZ>*qkp(xWxfWQ%hSJ*Oin zY-D++Qg^?TkSv|^Pk6o^doevL%A#Y*^2`MXQ_RElRqzqx)#RzhSA(+`7;gZp{mF{M z&+OFx{^xhs(SK!BY>F)ZHu{}Tmc9$D_9sifm->fo43njEepA030xLJNJcq%`jV%2U z`Y*J4k)=OIzthRmIUg!Fvh-urU2bIQoX4^swfGg7Pl9R2T-Pa2viv85l_yzxU;14> zWa$IwcRE>m6*&7bD{BNem~K4Y<5}bxrq3f^WPBxgrtxZz*O5PN`etzGc&n#x2diFW z<+B5WO;ZAQ4VD3oSHTE$kI7=YV47v zbEv70$kOLfcjpLMdOLOZyLQRaS5S99Yets76RiBn(szNCKUw=J?B1`W_zblI@eIWf#Crcj=Ry&iW zkEQO$30Zm_Saa!AaKJ%?Z3guw<5`~G?CJcxQZdPj$!}Xx9m&%9WAmybSvrSfrrF9O zOJ7aD)5+5L=i#;HAxr0v@dxg@a1*)3V(tcqbB*_al^a>d?gcA1vUGm#nYrAKB}?b$ zo|R4~OXrXEs{P5*p8#j)S)3=q%7HA;(_rO5mVT7}`F1Q>IzI!gbUIo3t6=3omd+m) z4i;D(e$JTvlrfjE>2quiK$d?JIBYe~WUz83%QF?MoXOIs(ZA4+B}<<{zthRmo5AW+ zvh;T91Mz~5Ed5GwxX9vfpy%(+LzZV7I9P0+?H=z0r%%HRHnRM;gB6pX_o=>QdF}_R zzGUhAOfb`CWs#*Hpx^0a>5qcdM`Y>zyf1L|;^%JZA$Y+?mM2w#JU?w^@$)$4NtUMq ztUSrmd(qDe0yeVrlj(OlS^6Nb@+3EvE#wYjVyfv{T&vE zEWM6?r<0{m2P-$S^x5F-Qj60J4we~T0}dVENdAoJJIKq8cayI$-UH5FX?!PGbs?*) zd%&s-S^9nS|C1d{mi_?!PA5x03|3vp(w_utetw4R@;M4tK4kfy11lf0^cU%0Vfm1y zzf8Z=$FdDRdh>4thpUaRBX=5aBd;;uPQM#VH+#Ix<2yX= zh517HlU44?VC7Gi-k1J$Ru)!@AekoXWBul>xtU8jV&!PWnD~l|BF8xj?OJ50A9m&!Iu*xM%?*~@7 zWa$Ix-(cmEr4ORt>1636!77(5o$VHU!Qw>iw$V6hA1=_a<+qR8&2OJY@P(V~*mjTk z3{Cn~9aO`{;Ln z+nOx@ez5W+OMeKgJjv1@rhl`=Crdv3q2K9b=>z!erNhPmS$c2A!MwnYES=+4<>rs!%vLKme+*YT z-5n;9tuyP~IGZU=b$kH#Rf14dkmdOxk`Ltxc~Ed4P3U$!`8 z>5tIwbh7kkz-ni*^jE;ac8fC<{T_bBxR!jA@i=hyUyP@LgB`{*!Rddnu}W4&nGg+R!VC77f&gZL{TP(i+to45SolcfNdIo#5`TwS8u(#T= zk9aZp+_lo_WR+Fy8SKmOsC`}mtG;9%`zl!VB};#U{;yjOWa)3w?{uA%g&B}*SbzthRm2ZL2ES^7EPaJR)d7pxq}@=O9N2eR}j^t(BP zES>X}<`%Ma&OaKT{#-PdI&aFck>y_m4!>c!wS$!#S)OHJr3$Ho`o#`+tgRu98Q)#0OK>b)5;wTPS;yskmcd$P2pYU3BjrtS)LlO z>P41bOTWvXES+<#>P41539PY7mOhiZd%j1O-V9bBaqd-aWO){Vl^a?5BKlo!Wa*rr zm770TuY|7L$ntNd?s6kb=X|T&IIrp&N|xt7aJbjn_5e7z+nDoVc#rX6aQ55AoYTZd z>A%Nb&VJX*x*DA3gJEoBc{YQ?2h6h-tbEAw+yGWS zWa-=K|37vtS^5rerPImMcY~D==fLy^%ZDrv=e=;B#pGP4eDdc#<&!_}WgfI+{dw=239^~>2K2S$|XyGn|`O0rC0Dgb^XK{--|_-K9v5?+PET1=iIAnoIekrL*0E( zJ6ZkYD{AB6N!Px^=7c@gEe8{*5`FqBF!NK>92T?y{%yVCLCo5(MR^7?c zYv})h9ZQy8OTW{}($59!d?!nv1`ZBeoJ&2P4Gw>3`aJ56+sH>uzmohP#;eJX7<2ug zx{y`Ybzs$nEPWgOKeA)V(r={S>165mgY`S0$kKT(sE%amN5R35E&hw-$Bd7WA2;T> z4W2MALqCc+R>cAP*BzUo?sx<^bj)=^@Dq!}F(#f0R?cMQb{RPHr1{Cx=YT7nPL@6o ztU8jVUkMH$wKyxl*`FG(1_w_WZy>umUgz;P`d$9pJ$lH+>QL7sk;!^_=kr=;8Cm zJg0(Zjjsb|-LYH2sxMjj@EWK3lBI8_-~FB|vh*Eb{r)Sm^qt_$3sx>!`Yv##)5+5J zfV00e|D9mvMwaIuuyP|yzmI;G8(I1T^gEp_eLwv!2eS0&Uc>4BHTN-i)OTe0U!v}Q zHy2rYH;ggmPnOPWobo42??u1MlPvvY`khXe-j{xtCt3Oc`khXe&g-4pb}(4Ek>wc< zR&HeJoTHQ*S$Z}7E;q9DQS`eU$kNBs?{u>C31H=RDL8cFbB@Pz!OEGeV;6vxGgJ*zG~b~{h0BU zZy58O3SKil0M7o=_z?Lm_(jTSYjT5r;C+K%NS^87-|H;ZCOMixb zr<0|>2+qE3{+GbYjV#YAVC6=Z{wn=02eR}x=yy6<`djq79LUn&q2K9b>0A$J-XKfo zd8c{9KL@99jJbB^bzgPy*8tO?t1e{4oI$_KnJoQc`khXeK8t>rGgwN$kM0M?{u>C zOTlV?vhw>{`!cfh)4*X#8D3MV3HXwSEKfCccP~tqK92fkJC-bc0yr!+ zopscGJy{;Ex7D6x>2s*N??Wa_Zv}^C7PFlm_xC=?@~op?;IoNso=%p3Cv|r(PnOPk zBP_SF_R`~i)|)KP{ho(&NcsZ1rz6Yri065No(s)GmggCI_{X)dJ%=ydPm$$0M%_KH zBTIi1ob6%9zC-S5+zn$`ame!Xx~Vv1=~dL-=gVa2lfgkRi^=mS{ZY%`Kc||ZtF2n; zaqU1>oDR>!^|{)CEYE7svyL8D7FnKaJkK_ITv=p!Zt^@_x2r6&JhywEz2Jb~oQREU z^{|ieez3+8S;sz1|4HU~1f1<|%()_Xk8yNP@f#blRpBesH(|vY3cb?lWa%To*|hn2 zu7#%<*MKwq5|*FW;!3BJrJoJfIZKv)E?DytS^6Zf<|VT9DfIWZa>>#!q~Gae>9fF^ zm&nrRQg?F&S$YR`cMg)JuK;tP!$kGph)h1-=JjXNdwV3|-ewcozljVOFte@E@OE1It$z&`JS$Yp}rPImMGhoFb zOCLeq%@1VhHQ-F8#V1Rz1y?$qEd5-t`i?A}*XZm(ixZ9W_Zdgy{50b#)a$=J&a3R$ zXq>;_`2W{&e!Asw+&Fjo|Fv;G*vdWOICq{Cj`JZF=YMsa53`uZjdQ2}KR3>YT75B` zQzave`C4*@aS!rHqVYWPxyG&Je=u$%*BJv-CFdDO?K#;vYR~gMo?#rd+eOAvo6Izh>icoys4f>9 zM|oai9OZDS@d}pv3FD3AS;pJRpESOme3|k6}5{^_Py zhZp_hZDqU5c9ws&ytCw%@|(+FE#2B{ORqn4`(=;R!Z|I?9j!|m7PifAXm4q3ZkRKF zQDgfRsp|HY*2e0NmgODQvMgEB+OVW$$&&et7d133Zo4A2uw`Kr-ps|lO^X+QYJN*Y z)4Z0ZPc<|zUAVBo&d;>Z?`Y|=vupg0hGi}7^XKYFe`nL;MRT=Rdei*2c`fb8tK(BG zSESmOG&VH1Ea_-pd_@EQeS8I?7*UNI7j>}8ZLN*)6|SwB=QXr7wl^+pXzEy=8oIog z_wtsGhNh+M?JbKs8WwgeEl@OaO!gEDW6jgp+P0_xZC}iVgqE~4B(A9q4Re<+YHDcc z(ph;fH5q%#ika8AsCmh}#!t00EL?K=iOMtklKGdT%o7@|$S%ec<<`YmxDQ;!mUaw_ zhDD7FTP)8LM$I$(6`$L>bjiGi#Y;QdmZEi!8{binC(Y6^e_;!}#f;Gj^DdsImi7(| zvrjiPH8!-)U(%&Zy`E@kZCy;;QjFeWz24rkq-9Za!@REE!gc6qZ(OvbZE<@?e1@~I zHXc8>v7@mS9f`!c>}0iDTO!Z=MeJ!ByfcFV8rz}}IJX*DF@Lw;$~+m`TF_znCdO!L zZE0*TyxWh#(`DY0hQ*)3Y;%I5q8^J)3eem#XX)h)ZSC`MHa2z5lPN51Yi`6W6irl1 zmM&~q($Uz}q&PIQGTxA2!#1_gZ$sq^H$B?8Z7~Wi);O9&*_|B?k+Es>9^%$YR+N>QPstB=cD(UTjn+vG|XQ#KRL|Jnvv%9uwQFsc_L3V$mT9? zUx-?G(VOQvp-AX1=9Z@Bd3JaaH#-;;PktWknWR^`gk0F%H6L2%w$8tNUPnWe@j~QU zr0=3D!<@$Eg^f)(TWQ2a4&Bt{M2Spxe0+nt6S#R%!#oV~CB=$#{p$uUY=s+SQOjrI)knwtrcbpnVqvSAT{bm5$3fKS z7#_R?G(@LqOM6l$I^5jQWk2;cJJjXbaC!UUrENu1aC^PumMq1(XHI-rk&9h4Vd28x zvWUy96SkRM{&C)SEN)ud3M;0x#_H;+4HvYuU*6JuUhCpHjgY+*l)Ag>+CD7)a-;Gq z7dwizu&o5TM0XX84`sn!g6A8G3_+W;t?zK!HeOz|k+Ixb*1|TLzocndbz?_I`}{de zJD~U-&TDRi&391(#iKWqf zHuH2%0T&{!cMu^OZEU6`IH0k0{*{=ka4NIfSfMl`Oks~wavpV6av_VBwme+Bk|qAq zwqluMuE9mY-IqAf zYFyC1Yb4+IuC)Gg`{g;Y_0EV8m%=83}(*lbLKCOTfFU4 zxEw8NXkJ{v%OV?ETP|;Gx&qVhqL#}Scg%0>!1PwMGr1bew-!F1ipFEV*?s6DoG$Ln zXR?`UmV zl)~)Aw<2Skb+DT?EQFRf%x!PP6n0|!{6$!}{8jEK-M=QRO`p13D9|*G%~;bdX_(jC z-hkOTF&6GL=jL?$SGX6qVaCPu`mSM<$;D)ob2{IZNlJqIK}x6VwLv zm>V|~l4I4DV4{dMJlgDt?#{1lX{JC6<6s@>D_~fH68P#qWT&!-#6>Uj6RtwzN&Ry(gaepsTE54_xb@8I2 zS;QTO0_QDW(!nRN#hNLanBT?2#FObVKbo#GqoWF9n&UOnGsR2WC7+q!(KN5Rqj64a zOLg(1)M9kx4I~$~@OjBr$LSS4Qj7aHzD2>B3?ESNQ34mLOu@B?OAj**uXPI>kz#}P z+oC+FI(skP$&DUG zo(Fc(qkk01TIWHR1EPV)=fTk|+hrH$wiCtcV&;c$U4-Z{UKfQ$;i`b^7N5R+f-Go6nEN1<($~beB87b<>HrA zEIN-#X1l0`^yH%GL~z_O{z&q!NE}7Z zBD<2?IvR0`xa=~XxQ;uwY-#L27inn0RlL2acucke?_2qd+TG!|HD1xWxUpy!Is*6I zf87DdikUW?D5&Pdd=Jm+F8hWit&CH%b#as5SR6K3$>RFF2q!jn6>g!HMNREjv|*IZ zYgvTKH$@M&acp%{+{f_+S|5hlquT-zIZ5D|2tFQ-KI&*_np40Ob&TraK1+z4h41Pa zGkP|9f@ple%Chj#0~c+)U$HQHFC5X$o_I!p?`v>P=2i**u+FnZ4}`08XPxDq4Ob_W z8yAZS<<5-7gmPnJF`?X;SWGBa8;c3$M#o}8xlys0P%amX35}{r!~_%VtZ{MOV#E~Ca2c4=0QE?tFv$9<>3anUq?>3Dbku}H&& za<#FTP;PWACX^c$izIi}H!bPNQMVq59l1#4q*9&GsG4Mdf{Aw480D8xZd@!TlshvP z6B-+9xiK*&l&g)!gmR-}F`?Y3Sd7T37Hhd&f-#M%i7}TTw4|A8Rk_?*F_PYOsEi(0 z*p)w23it{Pl{}X>RH8j@sIW-GgmP!bVnVsGv6xV9Oe`jptBu9n=ok~qjfzE&a2Q%+)41I>v}jxLhpo@j>;dQE`A= zf*$3P{T{~RsG1ma2|`Q8mw$!k>Z|K#zRl6Y^oCJtu-sWOCX^c&iwWhMvV%T7|@e_P1{CAJg7oZUY^Wi>z&-P3BMr^;_8PJa6OPk_751$`zC*qZ1C*$#_^Wt5N{c{uy?}}HJ7q8z>l6XD6c>Eb2goxYuCH&(E{;f^% z-V4F6?@Gj*1~2nF$?aqNom$y7-n|HLj)LJ`@%qB&$9v?-B)>jhy!W7!{QUUmY;PP`22W-{xhks#uDq>kk`Nb(U&R(!@J^Ln%BRz zh{vC0VSX4&aeePVXZ!i_M;_iN5brkl{QOoR-u*a`@o?(I@z&?%$G-3 zpC7OJnN;dYm>6#e-WBg!3~oQat1tlc;;G;GyAc$xDKFlHBJnQEi?`K_SL?;Q z2aW32_d>+u->K3j{1$wEeQ!rR{_PI7ALo7Lw>K}pWjJ33V6N1rc>kK0-&yQF8 zn^bBS_A?&mbH(HD`uF3VjQJ2%jyJ_S4?aKM(}<`3<#k>0`0L^Pcmoj+O%-p7$6vYU z`%Ww3!!YmS8(PHo$Gmz zK7U-j=8dZhVAi;L8H)u!ztxC`Q$5}k?=N}v-2h*q`SdOL{BnE0g1={m0(gE*^U8g3 zK-Y4|qY~5OQj_!T7x4M<>VBKdr}V2Huc7h%dR&8e+^0?TxFm1hxDLKT=TR!JU2Z56 zZx0Ib%iRtiro?ztx!-_~`Al$o?ngazo_`z~_wl&ldGU53-U4?F-xQBOGVjNG4Dq&O zKil~dyel5t)z7alu6Kp%yCZMiIS{_SEYNK#cYR)dBjH1r$D4d>^73mtmelu?a4Ww| zUVh^cuTc9`?HYZtCRs^Z!v{gKLBk6(@Y z*1*U9Xu`Yd`#c)eFZU|egM!=Cen;WsF%z7AFXHj{!Z2P7G{w6)FWv_HdyPAWZ;JPo zymduHpN>9pP%0&h&Kp3ncpIKmERs0 zPsi=Wb>c|{b3Xp_8+q|wejUFz*u`seK927;ybdqkte|VW4Tz_{W?02LGjBfKT*OzE zH$QKK4^q4--mQ7Q9YuT-^X~I@7xDcaCRx8-_QJO_E;XsgSor*Qc^d74Q!Z-ff5N-k z`MVfLe!PouT%mTkB`?3r;G0vR+#PxMp@-i}?z=fhsoX1Y{`%$aD^l)+ym9pqe1+z} zb$PxcMSLI0TbDdhq}(l4UGsaoh;Mb?y7<{5zF+5!zZc=d|M8~r@&bH*zxDf*T|an! ztb<$aHysx#zx{Z9FVt_h<@qX#_&)vquJL*o@qIDxdej%bNpUTb@%I2a$vek9c+Kz?8VAo;b@jEvSLnRlns@)P3_dh{ys1CFn0J3vh5lf_u|GEBUH$Qq zyz#uQNV${X^ZR$47wR;elo#*mza-;thZnCNg`$Xf4tN;x3XS^-@cH?@ z=Eb|&i#IrLygY_@Gq7Kq`s00hJcx~9p{C0WqK3LVY{l=r+M=2QI6>m6ve*2|L zOXBC=yWvxQABE5Fk41>*{#*`RNxUiW`SHdh-Wt?{`P~km;@#P&YrKI&@O*{^xJ~(e z6FxuQzKW7~y>9`#;&rd; zn%}D-=5e%@HpS}(pPygddrMOMb(5^`128MU%k$dr*&3`T3$)*yy!N~JeW)+WWxRb} zylauO-+pyCc`?-DP5Etv&(CjbRWiTq_u_pTld&IfI^qpi5cq_x@cHp>M?8K;$ovj? z@qV0lek`vod_Qv}@BA1)6!QV%Fy2F6yhgB}-z$iRRN_tf)#dr#DB^oCuRq>_Z(AHK zsqg)H{jm@E9fObgJ&bp@1;_KHdG{4t$Jp~}?20z!cM*I%W`fD7J;Rdmd>ESI-Px~e zeUBjCY3>-lDc&U9$NKH^GJJgt_$I>Vm-{lxW!|jEf8br^mgJTD4&p(IHKSYd(N^2qwn+ zDc%+D$-HzKkh;^&qzsnGBC-!So zeP_Yv*LNx^s&)3yU{-zm=G~`c#^G})7T`9;>yvk%vV3GoY6o_*{eBLw;++G{&u`jU zsmPZf?=1NI{03&RjzAfV_X{uHJ9+oN$NmnViz_Mkgnxw3kGEq~NoqUhV#a&ki#G%( ztDoQP=b(S#)24W*!RN;te^yCq9M(RJ_e(F{KCBD_@9oJ+yx(~7 z-p+e|_1GkwZ)!C7gnxj~kN4V?k`(`R0Q38;7w^l^{Pr7kekyec`?V?FHu(H_$1W^M z?SqN&eusDNt4M3@}2`9{l~)3G4IZM4*Xh6N&Gzf4_>_IP-(yY=FPx$i-Oyf z-_PLl>pSgoj3HfA-?dIHPNR4_t!#@8`fgT=DkIwso32EUqv6$gl6)t4dObVPbwg-9E$VJeC@#p@5B zpWldeC8-y&ll6U%7w@-2yT*IAxp2If;Pc}J>yvn=c=7)3gBB0B6VX;P7vGnIv8#=# z@@vC;?OplK#>1u#nefiCxUGfHFZazaB=Zoz?}z)?Z}alvJys;%?Rmb*|J3z4jmrIc zUb!w~U}wu=$3hhx5pf9#%b#Px+QI?#C;gWD(b;>})R-#=@6 zlS3}ZtH(U}j>?30)njsAJ(i;$+p(YZ806LChr=zl?jR@t^C;%~#|0y#Zgd=VKlDwLER_+I8vYMD|V(w*$SRvC?M$ z!hIxsAJRYYF5hU}&y-I6%VJ0?x%)A+%OJe7-?+(l)#*taQ{TvPan0oZc2t)2WxIR` z-x*)!ZT>%u?R9KzZR8qTGisF4>|UR%pE{|eL?trz@8j|jIyLzhR$eXtfz}?4y(Onq z92tCg_`_2UUHH)S12gxZz5bpJqc+^Je&m`}bwjGUr+U<{t?#z4DY!dzCZ_ImMMdgN ztZLHTyQenQZ>iW(HhAqnBi1ih;?wxqXP1-?TNCszzpMQ0iA_guNtM_C`Jy2!zmxjf z%G**yR`pDk)~^Z5%fGhjwiJCsR^xs6njpRQlGK*+1A*dn4qX#mUp9Q-k*!TDdlfA8 zScPBejj7S)H%_>|zUkO4scilF`tnIbR+gd6ohTFUtM;beTR&v=fz;Plm!(GT`%+nt z37z%Vr^+WaZ9bUlte??u)q{mhu%soi;eiss3^1RIo+b(#Pj??Ubh3 z7nNL+ms45lL?s;?f|91(dgF$5gV#Q>cKSNCPRWD2*W_o9+$)X^JyEo_6Yiajvbxpp z{_D#cHhAr=pI1i1*SJFB^~zOs-Reh|kC{00`XN=fp`H^@ zsd#Acf#Lh7?7L%4?}?oUpHB_hQIT5p;Mnz}j;jsNn700k-m)}ZUOu~N_SRJS#%t@F zX75dv)PK^A-2-mymZgSNeFvqK)ZaN_aNTuv-Ois_vU+9LbM}rkBiHnpICWNOegBfq z+YVN+{1TSGA-^?Q{>oF6UQ`A*rnam-KQ+1nV|(^J$YM)*O}F$D>r*z;_97RYJ*#R< zrp~(kqEjXfsro+Z*R--{>e{kGCF~eDcb*}%AaAN-{{BO% zzS@6C^|#U^H_e(j5$*SSYD4!kaTP$Trp~#($HZ=HSJjo*b7Ec)&rz%D?BAVL4-P0r zIh{i%4k$gNWI*Q`5B4t|xvGEX$cg<+KUmVg^MeoeD-Bom>kKFME6tYl>&!lwUfOtS zX)1L&RuBu;{?Cpt9oDC;^o;V7Az?}1{1z;4*-|lV_4@jrbxGEx^|xUjS^AfzV{0*U z{;;&_V@;_t)bl{^_4OJ}P59}Z(qRXBcMdD-GxFi;!;^bx&lUZjtuGzkr!0-1Y8_p^ zW5TaCrOO}cQ$9)idF1hD9`m?p<=XlM-ub|`i*g@XUQ&8SpWdBkZ0dtL1jp5(c}qp@ z57y&Ym61^4(zaAQ_5()GkF*{mcF&aLXy&7sg(F2X#*{*_zB1|73O}b+bsu)40>Gj)HR%v}bzDut>HL-rk;BOw+yX71wKlaOg_xM{XntxoVcNuHvt^eIv zkKM{x|I;4O`Fvcv@*KL&&xvQU+I3~)U1-;}>zh{c%ECasaZUUY!nWwFe|{8e)j90o@KrxYy;3h< z!hdg`*o6E4!xPETSixQTdUs^@?hOwHxba`LULpqD;Sy1@x9RW%25i zGslDr7OWi}UwO1{<(_F>_C#^d_+j_X^RMr6d=+M! ze7-x@42Amc?jM)zc=vORW9r}|TQr+h@z;Yf?kH-JSYcH;&*w zWy2p%_pGm&5?=*&ueI{+ym>G7+#2_I;Zj+RwUP+>u2mP zWAAKo=LxRLJbzQ^ivFn~!@;+#?cKDmJk>Pe`1>ZtdgLR8`)AnK{oX0rk<^oQVNKOK z`giHD`jdXQG>ylvBe(sr|Hy}%jut+vZ~3ktIl3auE>zQ~4YnVj-Ij{yzFf%9+N}I+ z(lSxx8h_;SZ0*E(nyYWxd`r|yod=`)uay|%SPgFKb=T){uNMBU?;Tr5UwzAjg1z$j zP4#__TM^y;7p|H^%p%EI%62Ifq5svzvfn(F*>)Z0TPn`qyQzNtc}cylJ%4)rPwOwd zo-_22>hJa*QuWP~aaBv*ie9-OWoP7C+<$#?bSKW_v)sQfNUbf$ z9qi!mrka9--paL5omzGs-%sqnwO?m^%>)IH{0h%ujV0E;lykNlW4u4c*ycRMKEgb7 z$JWk+b*avWW~6Q|zw1|zr!L&q6rkomC`)zzpkJ!<;i0M0hiePA`9+>%Wd z+|z`g_+M4mr}y-2XX2@1x@XVSxADGZea}>ROS)`QYRgIezc#vjd+M(8t*OrQFy9_3 z$LeCi+9~UvS$AQ4N4vhP>1cBaS{qM~>^vF0Zb8Y~Nj)o?Rz8k3SK+L0`4`r=VMiQIHYfR z$U2pxPPW3axj9|Y(v8;?&fqd=GS zJ8NPm{_btl>^DG*KY4F!p-@@}b)rqT3=dkjV zN{82mABw&C$F>C7RhQVy3a#ggeYmf6evRJo;{kPQi z$Frj$t8GPBg3)krc*)OMr+Jr@JUDrx#-`U2Wqej**QbNS`Q8b4;q&J49Vij)l5QE6 z`bxC2v^gfps8G%8zvSo7R`_r|%J0Fa%K3hdiXAx5bNDJpo8N|YjMZ{W_wwWBvMm+! zzrk5VwffTeh1!@gQy9&1mF#$5boD*mtqXA0Vk}%cm#gew4On{(?+`ECHZ^|AQ+O_B z&m7#(@zp2wV$`;!AK27qbj4W{ubtbuYi+l~h&6WG>D{+f^ol?E8+x}a< znYz$Z*=VFZQn>Z&Z)UrU{8E0KagLZhiE~79)|J-37jtOO)L@+H54NP2zW%c@=l$sT%ziWJrV9T|VrHrG zB(rD@5JaOXzP{Kxtk{)hDOMV4AODQJ=-=_|`{9xu(|WAOmBU*L;m7_Cz6u4UUy8f2C)@&$AuNjJ!`>MVp zdU4KORj<*@`|{3%{m`>_VU;y{?H49C&AvXmu8zn|>xGeCDrXb2=^VByT{>*yDZ8&9 zk*VqB@0r|VOL;0twB5K5NcWgn!fW!Q-Zi;&SV>yPJ-ao%aVV}UttExdvuNyo4K3zf zMN-kI9DcPTaPIW4k>&N}b^jl2Zv$UNd8Yr*NpixAfF~YMnqZ2M)bgXgP}{XGP@tAo)}?B#Yh7epYprXk zKe5(z^?zOSJlD*Vlf!DazyEv)`OY=>b3gaW_vI)F_!X*yS9~Z#2xN-CJ6nE zO(n%c);s6z*~caOXY2|yPd$)K9pinrwgPiMXyt32(aOA#y}tJT8)_!Z1p3X;%k=W@a$>ynlX{~skJ$|Qe`bp%9(YL|Ra!N8Qqpyo{w`V> zPaSKGjP7Wig!4|Uwz&sS!`xBi<(53#Ye+P{IU4!W`kCt|N8?vTBlTXa_w-;SM)qMf z3HM%e_gD*<-Q%OC_lXvlJa9&Q?a%s6?>HJ*^LYCOE93EwUw@oxI@zP=`XlD9o~58Z z$UpNAYdo_yc!#mcU*&U?pUr7celcfAbo7$Py*WYdyt3+j7(J#V^zs9o-*&F+etsL9 zx1{6BHR08B=WS!UpUe8kU%h2kFn6_&#N72vU(DbA{HyC++@r!BnB2%~w@yjLl98wJ z|JX>pBQNr*bKM(x&0LT7Ebk96Px5{u%e`%b+ha`+?ToV5hS$SAJ+R$3%w5uPG&tMN zT=PyfPanJ!qZ6@*D{nEL2q@ka}0w@$f8e<@Bp&{CGxZ|Jk{da1}l1M9Sln9v9*4 z<+FDEkFT48_4tZNZW1FqSwwXa&M+!J^iq32#2o;}R*I{Z@A%J@Y*;}5ib!j6XY`Ah znGv(&Lk3$FsIC!AJ@pSoj7y-Qo)r$G{t2P#LTKNsUUa6 z%J^rJC4J}jp1$VAHAjNkwdeTr*MmE=&0wAR8#hw-=cOdhxv^RWB|pWpF1u^o_1Vmm z*?hAmV_z}eXT~D_XKd{UAGddCdejK4cc(E&3^$)w?7_WdjK2+7YcihcqTlk`o~7(u zGiH-J_h+4*${A1laMT{w)!A65U&MXi$TXFC=jzC7v|!qD=S(Lv2G;1wZ_={oEXf&Y z?;=xfp5Nj8b06l94Lh@z8a#oMxv}lv!W2sT>hL z)nnQw-1ndINtow{`1DW*?z}&SD@+r8$JCJ+NiX8rF+N2W+1HLdc>gGZI~v(?@4|Xa}TSL1_hd67fW+u+dyZs}FZwaq9Pg&EjRL@}P6S?8OUkY3um^Q?-ny<0_UO@Xr zk~6Ns=SMpa_RU^5U1gycdhJ;^YQOHjf8+Zusf6z}=qFkGMtS-F&i9}QEC7~Wsk3EboX>U zTTAsiqOy3v3;o)E+Vg7uPR?#)LO<*ok#5iDj$GS&Qv1-3(^l^7pXBo!EMfbhK{%tD zxBdq7Rw##up>#acZ>x;#?OZz+cUnV_)Ms^UaqgK%_O(^snHM>htu8iPI=x#DY|9Dv zRTrjbX6WddS^ZrS+L^u=?q`n6A^y{r#U*P8m|nhd(&%0jy}tU5L3eE2mzw>0R_nxajVz6%Nb*OUH|~3+k~5d-`NQ{*Ts;D3GvPh- zY*+YPkrvdsPmM;pFk?8W`c>xc=;)tnibi(ck}dLMNF7FlPXKY2Kccd;S291_HA`a2 z5a%qIcF|t${8HZIc(RXsyt3Qzl~aaygeyb$av$uksIryYUv*l#mpd#+_EqWx?B!F} zGub1UzIW8xvei3RFtm1TgfL)?@9LC8|m`f`h8Pg^CWHgB&vswba?+g=%zuPCto-{J~r*~ zsho!OtJ-j1bOFv#X7BOhYocvmJJZ}>i|5A{@UwNKUcl$jeY@HG3SR=X1T@N58fQv z*O_;)Uq{ld-4T`T!&dhnSeZNg;LS%jAlF(ib-`Ys4GMF8=z`=Ibs_w=|X7H+-CmOIvPexmY&!bqkxTn{T+7 zFDSxWU@AscrRwX_jjecl871>7x$dty#M{@LV=c>?__{K@V6$myU1KX>T8#ILw(tdd zjuqZBn4#$P<_*YIw)EO@cx#6%5WDqGj+ zzh*bV*J!5`!|-{lU+To-G~NPNk}$7?Omr)EB6uZWcH>i2#3v>D!WC0K$s|iveNvLl zy8A@?pfamlTGM##bUM|XZvCWGwxSc}9dwR0Uss5CY9=xamewXrODBe{Smu51vV{K* zLRjH_k8~xrTW-@eC5eU0S`&C_d1CR>#-(_5c4FZT)}hz9 zw6Qd3_=J50YocZu-&ESYZM}unHQmCHwTG7yrt6l&t=}^e=G~o0>}T&?`nhaHaLZG| zBrSM5sApBXo50(D5~z=bOP4j)v?NLsiH5qyiHWb2Uq9^nua?+Y!hLiB?Z}bss(3vo zs-_if(2$;(7*@Y5<2c>|TeGwQwbGhy$vDJ9^JS8FUoay?YK(*MrPB$%nK^;+oETO< z=6b)5YZ+~Z7qxL+4I8%%UeLDPs~|M-hP5QLhZmS97N*mUsLhsT4e1)M8ZDNQGKE(= z!@`LQ{t->4nJq;E?>1)ynK5Q{lUW_DOIxe!!%l3wswt0O@a}ykwDio;|9O}io9?6C zX#c}lwFaLwIE|UDSG?;nbzQfyYY%6isCyKny1uE=5tlVy*N8XCh6;KFIsvL>Sz<)p zB8)kVrVG0b+Zwzs6EA?pi=|q;`t+je)D7Kh4r3N0`#O%orM0z*V2FC%#<>5=Str|u zI`mQ`8G*TJS#$crtgiiD$~Sp_9sTKlbjM!LaWle1cwsmlWgY2tjTkA+ei~PZD^bGQ z8|Iip_Pf{~P3y7aobwC!eCmeMVL^#0qqG4^bJnzmZ% zR-`?X#PeTOny9U=tH;DNVi@NoB^)nJR1PI8*xhvV`5L&7TA? zE*nc%q??y2*i)DUE-(}lwawLwxVS4#xO{dS1c_yhc;RU}#W&t|KVa8rZ(d89GiCRK zjp;>8TkEiR*LYtx%Lk78aRx!yaaGC}vzE@B^o6i5W!Tx_m1ywSKFm)UYhSn8(d^Y@ zl=-JWoGuXneAN3z^5>$)rHO6_>oB1$ZD_!n(9QFt8M9|OF?Qdbn1Gj{Xn2oo>(bQH z`mod52^V7yE>aj$i_&cKmh0-8x-U`PEV#(}Z!S*NEXIqlo2zjy<-eeqZ$Wn#MK_iD zySjL`V~K`kEoNC>nD&EcLPKSX5rbt}eNCbruaM`jrn4Frft3oyyx#4ig8k6ZzEEi8K zl3$oIEs?5js$N(hzN+1S5jv~R)S6pYth>6}x)jeWN0`KXQT2sh$mkX=Zj!83ID#+b zt*gNhs%yQWYB5f(?NAB_I$!4QpCs8Rrc9feXlllpKsXWk>sR7ZOxGTcPE5>BnBSM{ z_fUP&olP0^HjH=FS|VH0FKcN_ zd|7=UF{yqLmL|LwK3K2HM_rF|hf&viQ)VSto2Z$xku70Y$mTigIjXsYa4N^lsl2cV zqRo0{XcEGwe_55V*Boxu25rHXZK%F3UDdQ~VLe_x?YG^0wb}e`cB$(6ls#iNc3(^c z$Ne^S9qILt{sA{7dRs!h&F?<-OSwQdC%*jU892$Vt;GNhm$z=#Fk;W+67|U`6@WjO z(ZlW80@hl#slcnx{nvbR#pbGfhu9=&N=qGnZ!meBoKiJ<*Vc zsd!mSx+GCk*OIDk?sl11R}+q=p80uRvc+6$)S~NSh0>)_VpMq<-c*?wvADIhsb%8D z7cauNUAC|cizM%1_?IWO7uVM>Zz#pWw*(7o87vaK)nQUr;XR*Y%O{MwoEUo@SEF9 z_{s5l`TokC@*KhU*Y!jFoQva%_Z;VV_x@nwsii}Ii+aC6{$mgyzK$|Tzt|q-Hwtx6 zZ}NXSINr;fhV)C2p52)F{}A!qjs0PEzkB*Ve*EKt`1*K@P(R^zntyzDAQ=0j_>MWV znf>|N#gjg)--Q|bP53S&vzg;zdCdL}9k%J;aQ3f3{1J>Pw?1!=%D|*w7Zl3uZ^d8n zn9b}zhdR-I6XI)zPken*P`~-;Gdj-rw+7>>P$HHd8;?#R0S7G{(; z2lX%iBjNAI*gq43`p20_ujAi>zn|l{>yPgg&~e5$%klSl_~UmA@w5n++x&Me$UhW@r zj#r>9PD5eb`o7GmZ`$+w>EwS5%3qB%MGzGKI~o43ckG$|31|Oe>_3k5Zh6kgD9`&D z<+;n*--Y}OF-Ne8l>aQ}IP+`Hh@bDuG@EIkd*MU-TTr(bp!}MDnEnJigTER3TF3vh zXurYu8G_@=|EY}ec?RM$n@Qi4Fk#IuK;$={6qOOC%N;`up#IHZ){?hJo-;JDdL z`Wk2d80vZ<+Iz4~|0V3VVPE6nT0f)87#%KJM>y z+MoL$IQ;_;jd?RrhB7C*Sq%DX!amPY zT>E#Sx&B8w@vyul8T-eb_KU;URP4vCf7%a)=KAAzm}>td%H9C`VGtNkE%y0tKezo> zIq{F+K*F{YKRMooe*N!u`qR%4+d9<8P#mYf%iymPKW_glcgpuBm_HoywEqhD9cQ2M zKjq}lzV`u+Ykcwetxo>`Y5NDhrVsI5 zyIHyZX8b+j*uRGOdcohtIL`9WezkL)`}O!vL9?0kjn4iHNP80Yif0(?2cym}a{TSi zh-U+ATz`C*qW1SA9)4%C=40mnmXm%f%6}5a6G*^#2Vs8@`ls6;`#JG3{X5S3^)U8# zJfuc1DE4Exd6z6t4fVxL*6|MMMgX6xgv#__9=8C~jlUPk;2&kF6CUyZZR_gmbI zJj*NJZq>Tevz6p{t`?aIjSWhcHl@O=XD<6mIEGsFKbUR?THAMdwtd^#G- z9WO(icp3l1jQtNX_A8zIXQQpTt-?Y z_VINV!SRpLUtdIq z{{p-J4UESRu%B@JJ>{gQzoAZjaG&qmFqlV6InMFB;jb6`QKG-q*55V0zq5RQ(;WLfXpetF`PKg)jhF<+KJMFJ z@7Qla{&lct2=xCb+KSs#_{s75`}S`*@%9uX_&7Puu*)sXV@>#*x%#q$B}+9 z(rZ2gI@{@f{RPFtSpv&DKd?C6TaEU<4T&y-#{9ddFYxVa1ADW-Gh=_hvtNt4{uemm zlCJXH=NvzY<9l#i^Cjb%9Fc+X&-dM!t-$*QI^u6&pMXGr)36^k(^Qst&3Fuk7tU(@ z_O;%4ma`i9#gKl4^#|9^HpsUR)0_RdfyE&2SLhEDkY4?xdwMf}gz3$GnEotp7Sh)u z{c!l~S>I+pTNvbL_D5#ypOdlQ`%$q592rKKXQ)$9_{}M@*f6G@xARFUxEI(7spw~p7mqyAB+g>&-GTLJU@od z&pQ6X`Zo48jy?Os5@)}A`OW!LWpMmF?>NXTKKqG5oL((Eb-l zTZVn+!~JR4ALs1<5dHZwXTN(q=6td;@PEEH682MJ?~b2velYf}j{WZuUlr`L_g8a1 zHX*P#`(b^V{cD}$-QyeP_m|-E39ZWd2u|t^F8hzk7b>d@vjj zX8*>(-t33-t=XTQalGEy@9zIXKmPf_@e93)7_Yp?jA8}tf3tI(0Mzw&;T=4+-8=SO3|%d!6f+HNdtumlD9Z*Yz?J>N%RHj_S_PtE=k=lDG+%T-9D z`C$b7e-``duie+T%=NA;WBn_~_kfz5D{&oi2JYHUV4!w0=Lp&}=M0OjJyjlGlxL3D zqZ6Eg^T&_iM;nhht&RK941aAI`A=~gjP?x~>Hj8Ue{Dv7 zKhB6J{Orq=?|8=X!5Q`QHyQDa#<`j{#>2T<8~58Xjz5sGe>lTGUKbT?O#gmHd3kQ5 zjmO7l9KR_e|FbiW|1Kl{@fqd$Fr&WqW!V2bqkhXX(m$RN-#=v7Kbv8X?j39_&*d5U z{VJnBJe*OUg&Fq4GvasOK}7#$8S%t1Uufg;;~DXDozlkRk7uMW%E+%IBc9HT_y=Vi z|8BeHH{WCM-JDw5WA2RyaaFj{U7jT{~wDx4)bK=JNU*#lA9|h*M zCpWV6ao{4Wlci4v$A4)8AWP?b8?)u)TrOTm``wSvsGI zD8yXPjVv9n9rlW>PL|F!MRAg)4+Y1thH=BI8UyC_r0SL|`{m$L8*>|2pM|UfD}J)< z@w%-bezNp+w8uKdjVzs?8x&ccEd5@v;wMYr0*-OuVSCu&Bj8edUz*SRC^oXvJ`Yyi zlBK^ydwUW@mi`LutxlHy7PvHSVt5;@yvVY72duov(%+-~K$Dg%{R7%toh-dC=11i< z5L{yKrJe~^zGT@Kf|V~>`e54gq7EBb`ViV%oh-c!tokQQ9|w-v`<;~zUkNTf+xX}6 zOp1-HwAX+Y8(I1S+Vg}M8(De{?X6Ch-U?QotOCdF2`gDP>%b-UzTq8U#Y2|OU0}sS zmcE(xynw+*mVPhotxlG{6|8vpY?bmN%VsB7d6A{>qP@KzN0$Bw?X6Chz8|c-4uF*x zSvF6Dl^0q1GqmT4A~v%0=V)(rvh-tM<@Gi=Zts(kW%C}mB;mXCJ^(8ovTQyAD;~1+ z9ISP^*GQJ04=y_2_#{go2#)_71_w5>^vl4dLySGUa>-D`Y%0Y=mVE-Oc*xS3tZ*3q z!$y`q0$gNuvUIL-8YAv{R|!4Fg%sN~{D^D7rB-LSC3J?3zZ9qIzXZDCBrD%?+FywO zu#u(nx~s_QWa*V)#YvVv3mmgCTywTz7?!E$dJ-v_I%$kIQg{W$!GjVv7(jb4$}$03vT3A#+~{QKJU56xow9^9}>SXD6gEjWa(!0O~> z-93N!2=)b&jD1c{m={?-^TEoCES={Vgj@z{-m(n>k?RMV8KUn8Il$ zEm`{2w6{80dM#M>K$hMN*4(m-Hoq}-LYB?j)L%C`S$Y}PviNU}PL|GRj8zu0^od}V zg)E(GV&M!^7P9oow6{80IzI6z{Vm#Coh}2T)+FPA0eFRu_!e@<@7g;uZ210p}rH`Tgd=n>G`UKir zoh*GSSoJ`b&d==CH^|bj2FI>4{uh818(B6rV8uq3zL@s5ykzP1w6{80dMjAkxxE(fbV$A)MV}A!Yw#e{ZVC74e{bsQ8 zB}>1T_KQtgvh@3DZ*{Wt9pHjGWB&*^w#4vWho2!|XY}X6CH011arEO3zd>#=Ht&%e z4Sxt$S;&fkA7ZF1Wa)X}!lfoHS$c2UTb(TZ46xew9B{13q%9+V%`iWQh&3C&6s&m2 z@>2;`JY?xpXy0PelBG|hz17LmuLNt1kfmP>E^IY^$kG>ri>ywT-UOB(vh>y9!ezz} zS^BNuBCC_7ZwAW`S^5reY`O8X3taGZ!*9}_CzaU9vVWiU*BhI@xIY@Z!7%TYmaZ^- zHub+VTuHvs@Dy<2O(DzYH0VWECrjtw9F*Q{?D_W_YA>>E=77~+Wa(GZK5f#HrC&{Z ztCOYIfJ^`0*z;LW>g0G=pPp#^!pk;vviCMzG=`OK+on(xfFzUrl?flcnDQR)4-1 zth~swxgV^&$kKO#WZC>0th~t5-=O^}la?&~ zE!tb1Ed5=u%Jl(Q>qUNV#P**iHnQwX9Gxtk&&R}haf6L4eKt7OZsNHTtg?`0b2V6H zAxpoO_Nz@=vh;nvRJy>Po-|r|dvTRzx%8M-hdfIoGyvWjTq`lS2($|1BSMzV{ zlowexcYu`_S^8bHUt{tjOW#a;tCOW~0c)-xOWy@9wb#Xaz_DA5&m-hp4Ig#*MX=%| z%g@VT#YvX_D(%-AKV<30X>WD1^tZsJylI5(ZLsnp%jO-h@*+!rkM_5jv}EZY(BA4~ z>Am}ebwZZT&tyt(H+}}v#(wxkmd!cf*m`3#lr|?!za`72gf_gHAvh*&n#t}c4S6*b<>;Nk-vh;^( zztQAHmcE|z#elDfWy&=nH3T?h+bUuft`XtL{23Yk;mOh*I z_nEY0>2qmsb+UB+O_=W%CkPd6A{RLi-0yTC((Gw6{80 z`kP>_Str1;Ehgr-j>1TC!~T%y5y_ z$4F-w}E3jjGw#64;j82T)NZn z!_>cPcrRFSlI7)n+;&q z8(I2BuBqsbM~$D?!G({7ESoo(*6L*G?}Jq?vUGm0gJK{{?+aE8 zWa$HF|G3GQEd31HTb(R@2w0!#kfo2J{wLE1$kHc*b)LiLFclkFHq*h1jVyf@?SEim zBTJt{d#jVBF9gTmH!+ZsD>kxxHi8u!S$Z?=516!M>HHhf zBCC_7-w)O}B}?A{jvX|9_+*51@*>OTb+GaxOMjF0Pn$T&(%+`N)ydM|2dh7P09IaP*?a_6US#Pxr^DW! zuac$bgLNKDmOc=yIwwmXLfy_$Wa;H#jSGISgkmGhW&&8Tk)>Zs`=6P5AWN^Lz17Lm zXMq(PS^5I7VyLH$U6;wSSqF|CHhJAme#Yy4*@Gqvh?A!{}Z*{WtyTJuVO~?z4b|!zJvBwCrf_>ti1SLIm(MH zn;(Id7g_pKwEww@lPrBd?X6Ch{v23sN0$C7SYzZkSTT@g^Ey~Dkfpy#`?QIHEd6cT zTb(TZeQ;^5u^&nw+7O>im zEPWTa)Si3ryHNBw8d)}vf%Q2WS^9pke3GTV2$s+Hz$O1?;{1^Ois8I7z`rug@3@Hn zmzkr;@{<6^UNtr&94-f!{=3on{U)k6veJ$NtKP`cC(`~dla?&~GO*TSvh-SXD=z@xS1@sOn- zq5T^sEm`_e+FPA0{Z+881<2Ch02kQv>bJm(fh?O7V8uX|{x0o*XJQ~rf1mbNCri(Z zhiycb-Va>*rtuR4$9`}4OtPJS#(?!~0C}`A@h+v!TV`i6Sn-o(GZn1($vh-bG#m4U}QeI@)JO)-?Wa&?U3-2;{k)=Ng))*&CKLpkoe+I0)$g+73 zth~t5p9dG7FnN)szXUF_I$8P~V4a_krRNVsyZ_Pn;omeU2C{4hgB1f=`fzaU9g}t> zxbXjmESoZ>wK`e)1hB?6zbi-il4WxlSoxBrPp195CNHw|so)~3lcmoAYfd9eUr61a z|C6ORflEgj|GQ{o?;(?Avj-eIX>6VZD}J(U_JS2ZS^5FmKVZ_5r9Vx3tCOW41*=c; zd&ra*SvD_$l^0q1E3|*lcI9M^0rH`cj2PQ39dKvAlPL@6atk1Lfy;#bNESt-~%8M+0GVSeo3t9S9 z+FPA0eKxrCWfR+6@_!k=7OeX%WZBn(V?Q=FOC0-Ksefqn+sRKEz8kFg$?|g_Sn-pk zchUa8OIRFful>Y~FQj^3R0L$Hs;%n*m_? z;omC7y&T^USvI4n+rJqkOTUbI#MqOi&j80h^4)l|!3DOi_?=a%E3)k8gH=~#>DSQS z&d+4&3ute3vh*cj&CmS)u0qe0mn@qmaFNx?(%ZnAZ^_a(P`B6eWa;-)xA)A+(szMl z5tHv8+SqGVvTUBA&WFUYk)=Nmj^&uNFN0NAWZAq5R$Y;$AE$k;NlTXgI_<4amVN?U zI@Pq%``}ofNt=Hb*6yg`GsyXd2ZLk14D-9c6dPGShl3RxS^7xY+p$TOUPgPXlci4p zYs^-HWD1^abG3J|>1G;8u>UXiafyZ zez0O7EA1h$VjxRDO#9PKTC(&bw6{80`paO=31sPSQn%|4S^E26tW1X(wETQ>SXDyVBL?s8?1X2WZ67M-97_G zmi`pD#IA$;!HSbCn?qp5NtS+?_Nz_V$Bnhr z=XtX9*J*Ecvh;VsYE!cGyw8MfN|t^GSbg#wuwo<2CIMD#Wa;H#J;Okjei`*#yCypN zRIonBnE_T_WTl-AR$gT3b7_C3=^JF}^J#B&vh>AZea1(Y&hL0szGUgUz{-~_{Sn%q zW%4CU-$Q$=lcgU3tNzK-p8=Qt$@Ce1PorWW%jPIpF_5LdNP9a6lBK^)d#jVB{~D~h z@dP+_wu%3J@@EX^6oxzk94|CFS$@jFB}GObN1Jm(md$03%@o?4Yi!7}nE{RsHhK+h zj)g3ndfJ?4^y|q9!#9FeS7h0@fmK&z>8ojP=Q^_VTWN1~vh=&aI$z@VQ7SL8Z0-gt zFS7LeXm8hUvh*(6Tb(R@C%E8c(+75g^~?-eHcx;R16lf$V8uX|zL)mro4O)PKR|n{ zlcgU47yO5b;W#*+XT~X6HYdO(LyXV&XcILyWZ8TKR-9z%IYnWdWa;_f!eZl-EWI!7 ztxlF+2-Y|vOCJs{9BTZKrH=#`S)DBXQn1cx$*`a1}+bbc4C%1)NPfcAMN z2D0=T+LxNV$kG?n-s)uO%fV_Fvh1FR$vh;&-O#drUtCBMpoKJu-4^fu<|9# zW;s~-lBKVp{aBMPS^CYiw>nw+?O^pKvh=&bh2xALvh@4FMOG(E-vyQ*vUGm$acqL| z^9uPA!*7!(8h(fTS;Oy>FE#uT`E!Q*4Msedg)ILu=tWj1OCJbUJY?xZsej)1Axkd- z$106p4lekyX|FNVCmDSrd9vZjWEPL|KP;3BJ&rOyW|HnQ{@>Qjs#vh;ee zVrv2`w&m25#(o9a#&avUaH`SC@^d@5$m(S28^DT(Ed4&}mm5E1>07~yX9rmE?4~}= z*gr3ta#o8m)bUc4_r9I z*pQX>18|Ym$7YnHb&y7tRY= zHt#_%vN~CMegZ!2->Q(M$H1{Gjh~^k>0{P?vTVv|Gs^R~abT65ESrg7m7Og8GTQ&G z@lTdMnf6vEOP>Q)oMh?OQa@(=kfqmxWAlw(Prl0Va@z9?RIrg{zY46s7rPf6Kh4;X zWwQlbdbRPh6|C}-WwQgU@{*-LOnbYglcn#bz17Lme*`Y*WAb_mth~sw*$-A;Wa)=! zZ?CDz(ht+#>SXCh!MfId63rrrJo5d*kkMq!HR(_o55hkK$bp)_I7-cr4OgQ)ydM!!Fm>M z0=VRwh@bHkaLn>Fuwo!9?F_JDAWNT3`>#fPKV<21!9`XlOTQLeIy&Op*Mei$8eT%K zGTi8JGg$GE=3hKic3ygsHumMNWZ4`8msCgmw8y~(uleY`4VF)` z?B4^cjAZE_fK^7a^p9x2FycEUOV1esd#jVB_X8J9GBNPo3neL&mhWXyzGT^-30A&j z>4mg!HGas_2h-l_Wa%Toy2mvJTvB85od8xJyA-S#$VyuYRt#k6Q)r(ye#p|N(cbE0 z>2tv9OMFj+@*>M-K3I8?rC&q)T9X%9`U2Wpoh*F`Sb4FQB4wtoc-bHMqT$};$%gT# zHeTck!+1p0i;OjlMEB?;d98-4JXK7F+7y~Im08!R~s%Nk1zc2kvwEd5MyY`O727+hjG zLH>G}Z|r)*%uDgR`Le$$ezN?Jqx}sgEm=BaE3 =Tzv5pDg<;soS<7ORoW!t}y;< z!HSJ6n?XsTchd3|)POEc-dsZJ#GgUjQz>%lKaiR%~S1a2{4{Wa&$2Z?C_|(i>@Sb+YsoV8uq3 zzK*($jVyg9Sn-gh?*c0xvh+u2-)YK1mcEDfRwql}4^}*6>Cb>wCuf37HW{CV;Miuv zB@VOxrC&<>ZyFnaoDRr=g7*{QNB(DlWA_-F`CxtCN|wz6aLK*KhIL+Yx8cQL)d^Yl z^Cb@`KUw-Q>Nb9|bgprVtsnH*KbX8?V8uz6{Xnqd zBuhV=_FX0|Svu#jBCC_74+ob%VC;GB6x(9>GO+R`%YHIg`I4oxUnyU=k4>k&&6h0u zxnR`~S^7e7>4Ra}z1A6D%oaiSQf?UmMZ~WagybKD7bLDNlTVK0$gNuvUH9q z-A5uzXPuOO$M|7+<1rJbTXvQ!w!_$54OX0F`MDOXILXpk4}}kzv}EbEw6{80dNWw{ zNtWIQR-Ctj6$4o|w}TY}S^5Ur?=&%xrEjFY)ydMgfb};}Wa+!Xh2J%P$kHDJ7g?Pw zeLq-!$kLw!7d~wKkflElF0wjV`f;%Qkfq0{7v$i7v=4ry`~7N{@&CW-SO3SP?a{BS z{;B)bZsTV%V$=7BkQFD#QOWm>%?z;Glq{RsV6`b(`dr#SV$zbO&!@fB$Q`jx z>|>=i&VjT!!_+5PHbbb#jZT(c4la4j#4yTXj<3?kjm~it+hh0|N2j-vCyd^gHkR3r zB|kK}-;O^rJec}F8fFZ!9~&;A{-oi2>i=YT0C}%r#u?jZ_)_wI!&4k)oy-18@=uHn z$Fl4>PQ^>WrPhCwqhIgv8Q?fy2!oBRdgHoZa?to^|BMeZHe}fh2dh7jrH=%wKai!D z(f*L}NtVubDY80Q`ek7C2eS0()Xy~WkfqN7m;BWDXZ@5uZJ2#bak~ADZLK)T^0R>U zYw#bo1^AK9KB>^iou;HH$&I6xMbP0kHrp~a6ah!@d_k%d`bqHp{^!&l;N*V8uz6 z&COuNNtV8f_D4)wvUD~{k=4o4H-fcplBGWhE_u%QIYgUdAvp zJRB}LYHafGOJyO;rZ-q+AxrN^`=8@KY-H&%aFNx?(hI?*|APOpor7P>i!7T2Sb349 z52ZaT1{+!W2-;hnES>ig)V^ftm0-2+WUyi&%VsKAF_5KCr~UKz4;xwfEO3$4$6Vtd zrHxgsb*bypt=a6Fs+(K>0=s2RO-q|w5nR*Ky2jS3+NI46)vYbr9Gd_TS-Pg!m`i__?nEO|@NBd;G@eo0kLW7VQG#H=0C7M>lbAx!5- zjYL(bglgy+NmGl{sq0WuziNEj>~`I%@YC9%zN|Numv!5mu11I^8tJ}A_dr>5T}x_t zS#@h`bKSyat!V^4qpYR1Ij9d-E}PO;a8q--p}M6t-Q6JUkY8`EZd%q9q)xR~agu0g za_d9E&~=#7HVJ&oxOpk3kFrlTcP-4Ab=%j?+AobiT{Nc~(~Fk2)>XH1a;a;qT^a<9 zNhwv`SXC1$OlBOTXLB|RYACTGVz+RZA<1oa%ABrEU>spQQ~| zP1kv4jZ0h8WtY#IR|?})=*Jy^4NZ03{5RBKny@aA&Envolc=_e{V&@QPGoL7sh(JH ze^6al)p|oyx(X9tm75czMz&sAef{!=s_L2=w9cX+1Exk}264H^{FREXTdTtaPOMc6 zm(>Q2SRlWT_`$TG6@o)e_0_FhLaJ7zo0qx=n7JACsbv`TK?3T_tLy8~x6zhivvo7D zy%^JOU2R33U~u@MkotT#^GdTzQ+*XyxYC>V@^)j-s*}(Y3>4 zWizU(YL_*ps;d0ex!X*Ic^A`Y3Zr>Z=!7M0;VR;73_bf`QK1Gr>-5Kchj0~#05*nq|aR53chkSaz6Vn`Jg zf#^_qAO>*BxFDQ>#s@Smps@js38-RpfFV_k3dE2qDgx1=@<0sWlCeQJ0gVr6TtH(3 z8WT{(=m0~i7!`;iRa69`L*;=Oz$IgXZ~_`1(71rc1~ew1iqQdvR52>{jSXl_Koz3{45?yNAcj;?5r__z2jb{p8seP5Y1>^FxNvixs2ZhM zF9~QuK;r`%7tq*%#spL`I>3-BMg?L>6%~Q#P5327*a(=AUaeYida3&i7zJ6iZbfc=Uy?os$9Wc63~Qz#s@Smps@js38-RpfFV_k z3dE2qDgx0ZiscFamcpm{uduJ@yPg)Y=x#x{*FR${XKS_=k0(- ze^Gmk{&=s`^~d-Ay#!60{Cx?6>+hO+ymtf%>93bPMt`GVZN^0y(w z-yQH*!wl@E_-@PaH}{`BZ!X%7{tECTf8WdS_s)f$$NSaV?^+Q zVAo&%MV`m|wAxhO2Ouy_r9E%}{@y}DmKR@*5coSEn(Oa*_{*bUH~Hf|R@dL|L!rMS z*eX8$Nww?mr4rBMeSdB8$FDUq5XtWEwJVCVYV z`ZLd)kAw7g9)9F+dWOGB+|*wsXZS6D$qauV{Nch{<4*KHtgK^ zW;}~|1AZ7^vE%PNOb)KUQ5SpO1RU3<_zGd?`g;QY=E8{nhT%u${ny^z{VjpNHXPR` zf6u_q_16!bY6Fbu4^v3sZ%9V{y$OFi~yAS?$+xo*04gCEU3Ec8-Ecd)S zDA-N@jsx8IW;_Q2Y!>pp6H){&G{ivKxYRT4m?)8u;6A zzKP`}7_lx`tcxqgk4ZRNc@H+qxG~0T{Fw0*3@zyU_sJPkBN63D-~YE;Su4+t`1@w< zAK{f?Z&E@2p&>EZ^~7y}W2mXa1DlYm zJEC6Mrrwj{>+|O4bVO!GlWeHmZT<6dlSwayGmC6q-_2W_Yz#`9yKQ~{UnUEt7Vr9T zzhdtoQ+w^(*Y|JV_H6FZFO8TNU$fmSSoEXK*LzRquG&bSJ8#MKib(T29G{V7&LKsT zcSWW(OIGt=-C{Vn)q5zJI=0R0j2^2V{lYdcx|TWRB8CxPA~klb3~GY=BiHxvn(oX$ z`5|*{>}XHyJ1=+W%JbS$@3|L7&TGGL-{9PlD+jlaoHRK1qR8O(i}szHi#BL4nRIS$ zY2@7Y(tYQ|Bay^e7!r#xF8+ECYyA>OM4YCF?e` zW;*jX4sd%oM%)SCE~6G$j>IKyIpS--Hy}FW2U!0)*Y@$oW1fun?d$z=#t%T9>-u`* zPlIyWY2FX;yYsfw(C62Ck=HgkqbU{RNI-3%CQ@EUWYDxo*Vt+8Tc6Fp6S?i3$lPY# z64pZdPxHL>IMVi69+?x?&cQq{726ca-8QpVdlEjAgS;)#M}ND`xArcj^_78j`%edY zxla%EkCpq!t`3d`(Zo97Z9Tk3z4mSE^K%bIea<~N$p5`I`kATIgSHFj9M*mZBm5lm zyf*M#yuE+#;+_3_N4k&$#!v3f_5CwjBAQ13-_*U2&P4A0^PE#LEU4-P}jso3MT z&bFcdZuKslnp&_2^XswdN9XOabC_vIcs ziE?cBy1o=S=9hVBvUdt=S^K;^uXFVZ`~?@sX`j4!pYrnGUDbJ7WqG`xx1h71H@pAL z2UdpVjl72VBDwQ^{c);oSR}P!StK?4Va#>Wwm%NStQYBw#ulW!$Dx$_zaw3p^E$lW z;MiCkJNfa+dpb{^JbmSBeNLl3dQDBF*xTbh=xz5S>65qewMbWLFFnR8tsnn4{6u53 zt>XWVbY-j0dC$1@S&;l?G8Zd=zan&fZ@?wVV&sHg!&>oF%bU=GtmUwj9m(j_=#+5( z)MG69?EioBS9E||mdMP{B~5Q?zc3ofEPF>y=bF6NTziz^6HCy!=3UhHU%y6#H5KXV zJG^e%y^a_l_tGxK?x*oF<$HK6+>z%oRy>#HbY4ZxEZs}OHIr5tJ zJ3AiozBYB$X459wd%@$IO-)7i%yNy zV;xSfJ#`F^KkL_rpCHgep&qNqoYQasB_UCWU8y&rAQvCLz*zbtMUs#O@zKaOHg}k20i?6=O8`3d6 zIA4AAw2hbp8#|`2If|8G%PqriRgJelJY&%Ddl^IaJ`nw|r_P!B#HBs;gH!MCcGlPb zt37SlmeC{b2#d^&bd5^34_kQ-=a|kHQJPA-eY?qCY@2UU-iniy3_LU z?e6-HGyVS2F19~sy_vnE(W|C%b@9)Fwms{wpP%#3iO|+w`$7K#cu_P`fNPuY4ahzCU95%u z`*Fp6AjuWu9)ETpC5pxz;BWKLAd59?s|4WF=qj!>x};96Z(Ur&Ozm9Eo zcFz*CjynFEGl=Sv=PZ$Z?GLT*%W<7K|M0A;ys`l6z~NhF1tW)TGWQB-9kbS8X5AO| zIJF*YwyDzZGw%7-@3wgb>1Z@{?4cg>H&YzDER4%90eW3#L^%8GcD)pt$$lC2&v*Qm z^yetE9#>3BomiVSr^-oLJg@m-o7?XPeRX92o>r{EgU4Mve|&7nZW+DbwH%Th-SOSZ z?q?KZ?HL8e{|oE9t2aHE_qbOaofpX%)2lP@G{dN=9`)ui= z{)(a=;KyH{%`W{@Mjx&`Oa9kaldIZBB_r#Lb06~J*PlGSM_zTE`9EB_KDi$KY)i1t zVP?dvch%JX>x*|i+picSGnp)I+vIWX`E=)3o%vU+igab~owFyJ+G-!x(I@8+$7}nr zWMBU`uIz9=+9#fWuur^WYQE};<8oxyc1S)F>1w|mS2P*-E&MBwNnxMnyk~l5Zt^o& zD=+kNr(WVsj&6z0TtB+zVAk}p$!?vrU;Y`)3B7t)`r{3jiq$V0=FN^v;`v@qct0mI z!f2W?KE5vA+skqD;Rxq-5w3MHljm-IHh0F9mHXP!yKcXVzt?*!UklG_*z3-|s`poC zPw9;2MOwX_Z$@70J>{rBYYquws>d})TT!^b*xwKDW%P`#Gk?&Uj5E5t4vd$_y>5B? zk+S7@kEAkLkz@}E>%woh?Dt4+k90krJhCaYJ=I)R`T6W4DfxYOd}Ac#@tzp#gJ)N! zt>YcP^onZtwk znQn~8Z9CWTXLFUo^Y} z!Q;6j4|>Dz)tOr`|1arW)AtT@-W85$9qn9GXpe2bWk|PGB^P}zvhN2tOX<9&m)En# zIO|2*xx(@KIMOA{(DOv=StG%Z5m$=Ek-oS}-07XavKaqU?VXej&L!-5QRkYS8R^3# zhwYJ-mn$7>XlATqO1#h2xHjI@V^nf%bv1{*>!x`R=HQw-_g>_`9_Mv^{hH4`xIUI2 z#R`^(xO{$)w0(Unj^CXf>kGm$Lv_@~&W>kej<#)mY~;pB*YHiOy&$%IBiEsny@qe% zI1XcATleUPwZB6jiFEC{rTzI{IG5mAM|@LWWYS7`%W}4bIs1w|?)sC9I{|@xaNZ^b zBdf>U*_r>lf3!1IuY^&vxc} zpKw;#nLqS*ZvXdJyXQCxaDC~Y$KjlHYyZ5Fo9~|Y%Dg*k*WMBDIMBa7D9Nd3{bf&v zBiF3A1-KgppSTuG=7;UGlXb!N?BBk<{{WU?+~!tXqo`(1ox=-{F!FHx_~%5sQ?ac* zuHHE=HvPA7yv+RGJ2`x#dSdSO zXLBR_&|im5Jxy9WX39SPr$o8ilBY%XovIXx#?bRs8Kubc3NX7AkIe5I>53$acSifR zvkZq0dYHHNpUUIzrJ={K_V7p#^cqRFA56l}%2P&G{VB2b$G=L*xF+Z^nmhCF>BRN+v`3@2;_Cc| z_R~GC0_{_iUhd`dFw?E~SaVzQAN}p?usPu6?l@SI+R!V~(W`j-$&#KcE_;plg~pB} zw`>Vk>Yi5Y$9tW=6^|~+E%wlZJ@jDo$!L^!Yl|a~c@IXQ9GW>W9-ZqI=N!QLHuDVC zb?$+g0|(^|ITSIosIw+?=C}TCeR8d{B82U6>X~huKNE1g#2sIpBMv^vb_iGU+^ziw znCp!pxSlun0LnHt42my1d3tB`xzjnGIM#ldIdwc8|IFUupRw`o z=6CxKC>|O)=h|Q;*tuFYv9lvAA7hZtm3gH9dEm?UJi2ymWsg2~U1$D9ds()_!F5!< zw>uYo4tKvoZRBeIlavuFdweF>ng7Lo>ytM+eLDQq0zGE{*RjqugSQOSZTJ$M*&K)#&WL|Ms{{chRpK6Xi z_)nSk>{+^7kTr)t(-%h!&!z@-I}6y^5$|)LUsxL~3;IOg`06QMs;Q<GUbd=X~GW zR&%ED2tG-`dB#TGG5X$s&R&Ol^*C$BJ^0o~%~`WrJQuyUvsW@dJP%!+)gsy}wAh%{ zqN8_cu{F~I_pVII`{zB9^zXOj|L_yetk_m3-({*%xZ5x+>p4lsUvvhr%|8P;wYRjt z=0B2Li@Tkl=FBE-)^@!7t9a|llH%5YDKoA+qVi#^(z_sE{}XZ1O^ zZV%?jR4fnk>y!xEPuGIDZoPBH=-cj@6pzl%Ni9hCs4>p9CoX4=KALw=kE5Jp7fj>l zyy54Y^xlpu&G4Fx>vi#t@8Mdmy!`2Xe7YmPdT5WB>1*~Cyz1}l)APz7_YKDL3}{O* zGvyu_nv*)V7T-@e1(AO@(z$j_PUiUW)2Oa1ln=KlUgA>#FICJ!cSH@0wAUIqTOkzAH|;R~7BJ`y9@* z+2`%f{Iw_T$iO+gu0W>dcSd>j!K;wUFKDdNLzXM0H11>k`hOlLC;guPY2x9id%+(E zpW50V1?{NecduHx|LMt*eUbf~i*cs6=IP1p!_B7;x!>tO;Lb&zxBTF&7r)uQqa){; zc@sBJyf@x!xcBHSmrrWK+b1TSQ?~bT&|-dV^|+#AbYl;)teL&T@7ow9sw@9G%wM0g zS?)zIm*v`IJbyu6xSw8@&A*@X0e8Ol@5Xdxv+bz;mET7&R(fsUlzRyC!NIZKko-sM z_IQtWti`z9hMB#8-oTk=?bK(5nUVT4U{2N?(AO%RPfuy{{TW$$E9~$G71S4%og>w|Bt!%kFTn_v;I#K5-}oP2vSWbz4EIV zZ()HC?HxYNUgON(Nc$Td@Mz39qS-P>QG7< z26-IDaj0Xh<5(ZcQ0q93ebzdkz0Tb^1ZSRqzOV0jiFxm}*WUZH_t|HkbI-l^+(UlU zS!f9}u&l8Y{zF>@P0~VK0kedcLz4$9h0B*ICr*BPmcj-L=x9D{+MKM z$oTcB&d+6B*sG?cHsiu`Mv_N=;tNe($GrD3e)M&$GcR9&Uyl0VPd}}!IfeCqD@%8s z^F9bmx6DYln3p{Ot5RJCu54QF=`r5ZGw|+c_B(&d`oS+R$QylW&_BB+DBL#WTT{D^ zb*-L!B)U55>5e1!P)AlcN*7l4xXzxsDZb8L9E`tt_0QJw&g_fY9~t{}#^=#D<7U>F z?nBS(9ov2-Y+JSXb>M@v(R+yee9z{a)AeO+Uwrdg_Zg!j_$xa-}+9X8aGtnNN``(mRoG%Fip zuxo49OSq%^(tuz{_K)s(CYZgoCUH-Ych9i%j?2lf&rV-;tjY~C4`fW5P?wi|>FL7# z7vpntw`F8iUWKcK&#}hZXM(&Ua{B7|_S&LUPTYhsXUXAl}RX1Vp zr9U5GqrlepeL}?Nl-kY`PyauRQ@Wk)x1K-R^UW`|w&3>jm-9z7-O{Of=PzM1mh+Xb z$Im^!*i@^Q^`+kN~Thkt*|#&7qe)u*y6`&4x0 z_QPlDF1+Z%+?oZS%Rqam16Poh_+-bVyzdkSQ@_KzS6K(Mv1VNwtQ~O?>ioNVYc}sa zZ=E~!#EAAvq{(rwcmitVw zW|e&dVfVVi&fb-{cRivrk(WIXSKIhR<#*+r7;=2Xv8hL=ADMZ0_My2i&p){E zK=H=H4SBtiS#=%QTfMT6*0k&ma4zqIBjKj}Ag`kUsqK9-e!cdl++fE=qu#wUBQHCJ zzPyC{T^IJkXM2WcyqMSPbSBDN+|Yp<&Y34&mFas*8^Gz$jF0HrJ!8nM`)6g|e&)u7 zQ;$uZc+>8ihD@uhUbAY;+(A5JpV}2XGqo#sL*?vfFXL6+2DUu3c=YfZe6R4r+)ar+1U-Dxiz~?X%evQ>%u1)j zW8mnyad6eDxIFF4*gmo%Z^NZH4-M`8Oz~sAA1J|<<<*D0D+qmBQ)@SCD9Im!&xYwJ z_H!!2oI~E{Ff%I8R4klyY|_LVci)(exvkliejTIo>{G(~1WC_x2cICW$f|tBeflEY zhlP8?cb>E#Ke>ffgVMeKq!xY?wNO$qG-ofaAu=k}LgigUNAw#sblB=aLx+5G(9q-+ zpWfYByrHmjWOPTlcSYkZt6v;>OU8>MD=@a1=YG2-Jbw%x;@$0Ay|4GAb62}?yg!qU z8Q=IBgm3%|!Z&^f;Tu1LmSaqNS1iN#mr}vhbvxJL(>X8h@*=70(45+mojtN<)gD|| zXTM#u8FSZtDuOKp$&Brj<{h0hvUk~`EnU4bv~SaA(kb&&;U{{OGZHKLssg3dhF@pP z73rwMQNZ=-&`f*+Bzld>mXl~%r8omBlKz-vY`^xdoY#lEHsa*eSErwtd3^Sb%~9W2{W+_`I0vA;Urn>DiXoTHNMoGz>P-kDqb$}e&MqfbW7f@gxYulx?5 zt@(bBrAkKCr)$R=6z^wv9HM58!=<+sW}lg{aMrO|6K~&r`;fW!&&~YOnVS|)J2q|N z&AV^D0{bd`#^(FGeZq4HulBQU!^(=kvHYMBuRMHpEz3Nf{n=d`GESjA5IlBH5aLx&3}>6yCRHy#7lj$hG$>A_Ag%=UbesRz?A5S z$$I4?oMU!Wc23xE(ZuZZXH#l|2Lk48xG3Y-Y-2_VYt@X=xZ{xkr_S9w^y6Z5J3jk& z5kA*8JUje6JW71fzM~-KW=}ilHOAM#T3x9m&%4$ol(h*9OJ2t1Io` z_4Lr>PjIH~sjdayUg|0TG@|KA-#4Zn_u|!_&W$MmVrtrNC%jo`bLxMGUO z$Ga!Pe}z$eDF^pu2I87zRP8Ic@81<{+E>%Evq%5;f8}2(+4;*_w(p(tswXcSpS+3A zJ6Pw=`F?zjUj^68CrKPVm*i&8!EUSE~GvjAl zD}I!HqN3}Dntea+u?LsF-qTE5iHHQIA%W|h&!gE{`C*R zhMcYYYJv-cOYf_x7?F|jvynIM=o+)`5LfwMpF1zu`v+b>r`GU#OW)t+u~3uv39etW zFWT$9&zAAx!xcS6`OH7xizuf?_n>&rEV&>S_gJ1CH&x*E-oA|O9e3sYe8@{9em3>R zBd;HO?ZnBGufBd_%!b_?p6c9nPu5l0z5e{Rq1lfHkKteD{u(?ZW9{%?j9C5R`Ux4h zs(Oi6-rv6{XvF7GrO=Z#;uj+__V4b>+Ep2?7+W?D!@7O@Iq#%}v+sD%qw~tKuFCW~ z@^!rGeU@Y1EBJJF-oRIa>NVlFT5x}E%dF8s-XG3h!dKX%x*o#XJi5o0UOG=p9mmgU z=_q@aweuHQd{1x2#JucBb95ADRX&QV_aEX;<)b-kC;u>~{|%-0K67v0dfo)Xx5hON3-&Bf-Jntmo=t~a{~Fj=6-wV&e31n^3vHq<>hR^ zyI79~qb_(H@AKgG)D0J4Ze0-6edBlE`0_V?biq!1x8}D&)(Vk%*@JWN_pyBh^CBx^q zCGAmd$?yTF-JaT1U)Ns4XC1b5vOuFZ3j!S-NcXsc+}$Zy4s{gl}gs)$)(k;wGB;+ z6eyl?iAVL~xvd>7_H;!)bd}H1^xH@-9hFK(1C@^d6Fe@~j^KQKL`OQ3SA0HM^4~h( zy9(y>`tZQSyTaN=)-A&m`0y}6xUUSN=K|xofp|jb=TS{0Av!!Nm{LT+_2Khvr||K% zkuiMIX%dh2Or{@Y=yy7$G1t6mZfaaEZ(DNKv|E#<#bw>bGL>w_6FHlgBo{8{qhq_* z<{sRfY^aT8)HFBW*-#hQA2w>wxWr>sll9dNjdk#cj_z44)opF($!fc^p{0d+VXtjc zr;^@d9{B|7crG5+h^JeI4|Da)CBr8(6nledNs?VXN?XQuO9R=0=9o|DTb zXjZp(wBoU)jf++MF;e)G_?!ndP)QIOuNBi7O ziE}*H-#FCUF+ zuXqajg;BR-00W3|Yg%+AkMKG?;JKF5u&VOr8MAJ$npru$@`f+Wx^cp+8^18U>c;7l zzmQDZx@9JBz5dqO$=VK9h2_J0@Ndvqx2U>id3Q0DT!=@J-bphKxAaJ7%y4x*yTu!r8-|<`{5y z1*o47%1uVIol`U!mGE?|RYl3R#mya!wc&^?uEz1(6pa6TPiH4|rwC7IuffB_V|x!B zuWv@PO+|e8uI75TVKs|?z+l>1XAyI)TPUGnsJk5$Hk6cbp5YMI2Di0^!`jW3)Qmv> z^|t&VKX7y37GyNEqC-+^-5udjkMrjoPGPP@Lt8i?)g3$vp?Nw^2o3Q^##$+RHY@gG zxSV0huBidmcQj)C<`aCIQ4C80)@kzx8u~gczSw8s;J3Ff=Kyz~0Ygj5mnBCIZ@V(^ zbWZhfhm4EP7(M55!iDoPwzi$8GT1Tei|}N7#*0Tsp5Mm@U2~@-{f8i*H;BmnKc1f5 zT5heos{;P~toZ~6hw-jJf-;YCT{S-osr z7ue4cT*(pQ;l0Q|FZEog`>Dk{+`R~T2oP6`;iG|Zc<{OP?rO2y+43u4|J#$%gvF(3 zEf3@#3SyjQPQL;BxOr&M?(6RAcD><0JlX#NfbKhv@g5hoGtsO_)w+rhK6ZU-ve$67N##$3A>7w?g9_nw4o7}YqS3tC1vTS%s z*_@cCy&1o>;GItVr6bx8;pMtr7V*fws{;qO>Tws$xaP-Ya2qaoxTLuYDLy26A)e%p zOBy_-npa=;%x7I_arx`^D!`ry9bF}dk7xHs+dc8R9lN7#Nke;jho2|H|8`-jsm8O? z)s?W4RMJkQ{yK>(#OU%YX71tFGdwRI=8orWC)=BwlUTYM8)Jp>;CQZm-B$LVEuV0a z)O||1Ds{A;_nN84QksG8q;S4IN7wP)f6Bz`cQkWcGh8yF=d|k~z247E*z?f2h;Wzk zy1M&;+^u~4DEBjyBl-Iw7}P6+C3q2`E8+A+=_w$0k>axOLmx}AnuI3;&&?MwmDf+2 zlB}t2>GsU}up4~nFka#E7dWuoz!fI&Q1(_H*Xc>l=cMze7QzR_M^iuj^mMCY(v+LW zCFdlA@b3)w_Xho)!zQ9DlkloNyy9VWl|lG_yOs}^1RXx<$I>@8SErxj?meL0+HS$` z-Ndh___EJkQekKVuWvlFg%^eh$sahiipTwPC-4SIAMLoV_PaPw(oUDvIK8d)C&C@TNt4T6tM0)$R6$KjWgE$Z75Wlz{i5 z-S?#OJSPbL<_gY| zxCU%r9@Q7RdipVzbn))LPLtNHhuv~<0E9ohg8~2VN0nXmdlGi_hTGF~uG@v%ZSGaw zj9YKQ>wnh^cX;FH3UH?LCWY#ldFzC3b2q)Wy~~vFcER#!b#j59YY2DUIdZhqTk3E+ z;8Idui{DM*jBan%85PqP#|mGxhew;W7?o63ZF5~)(`Val0SLQem#q9nBNwE1@WmAF z7k85?eUjyUypA?@?YzB;4x6UBuV6j1)2h3uS8J@>y)Fn3_4I+*L!qq93_kX=vdwOW z)F*2i@f#kx3QLxi6yp)($&riO+gsYkU48W;+{EZu$X|5gy-QpdwKddV&EH-r!c`q# z*c8K&&6Y!+kApEtVAY&M?S0cN0>8P@XvX;`SC1ouoRWmBCb9i?-^bW>jmmhMy%s6BjCEz0kY{5z4)=PN6Jq?gb7`bLji%?UmW|M_0_+2YThldhM-5U4M`Kp)UVt z7{B*D{}zl*C1M!t^8W>SHAr(v6wmfpJbn2P-EhkZ?!j2%L0*yn*C@#6cl-0}SZsVx zd-H7s^1cDT;(r?P{S;|7$@c$%x_<%Y^Qf8LhiNSD7F4fA&b{rNT# z&&RaQ_Q#x9dcD^lj_=}F{vEOO{fNo04&JPt8?+1^TlY?fdg* ztC!Dsp78c3(=QokT=VH8FQ4r{?8SEi^WiTszDduY!lz+uv+->5(m%u4H6fF`Q1x%~@^8UdOh^0v z_#XAzWBc!Tex_5g@g9PGWSh1Bnzw&%My!L7Kf-JO@mTqlJQ%_)C&)$pe}!QE<9%SP zem+-Re#UbmmfjijuZtaDAIAK6lRB#JNqB4U&tLzZij~Kkx{<#CdB0#Ep=f-2$L4=- zEZr-XF80Q&7JYvY|2Rce-&8N3{p}x%=d`!}G@|Y~SpTnZ<;NlY4%k0`lzaZ(Xs8eR zT=d;#NA%Jkp393<75#rBBTK(&c9gp)7zil?3 z7R1skV&iwvi)vw3-$)Atyp8qiR&(c`_ z!PxQ89!qz6<=H-uFSWm()Xe44e)C{*^IGy80{&ZXOaIs#K$S5`B&)0e-jb>|GStU6Y>rW#_h$}+3Adc!9po3IOcBy*|E$*^ z_Ak@(GyPC(Jf7oZ4Y!;i18s5t@b}DB-%~OFA+P@Bi2p;30sch(N4)v+E#&1QlT%dn zjrZ2W-58Hc5R*T?>%Dxg)mNarpTCTgFWhW@uZX34^Wb**U&Yw$L=66Xs`dJtkMUz0 zpM_uXt@4g1WQW^$921#1OLP48c=i7g^^b(6<2{^DUill`YlAVEAeop|%%AV|?;yte zYtXd6nSatNkH^}F8?Om6v1&2@9k2bXQ2sH@S^s$K?d>1>bCXsFUk@`qCYC?e%jdPl zHe7FU3Tr%8#{6?U|1`AyI>uM?m-Wx)&I-4j;A#xumoP>tq*dP>FQ5MHvGl4~`ZaI= zehu+`9rdBvsJn`47GP>oHyh_*dwaALsR-{=KpEfGb?3ZvU=N zc2B>{#UtEoJhmoX68=+Y>on%}NJ#Aeji~=Y^jGU2+uP3iA z^srd@>tg99FU_$VhcQ?C^@!!mNaMd~|J=vSaI^O3$NIO^%P&Vf3G5S{-}&0)acD|2 z-g=(wy!!BA&u-}*UV0zK>jl)umn0moY@~TTqx5a4|A?3V4C?1=K;^T&m9h4YckrG9#nKDB^lHSj2p*N^x$Fk4JtZz)mjBrEGo9e#6K?K!iOr|+Ub+#n zeGm0DdC02#V7}N4H*0?q7h^9y!^)xzuKk0fc*DRr{>Qch%XCcjA4lC zAL5M<>u-vs$9d@mD9_(X;~}T`_IdFXqWnF`=aQuSGIl=PZ2yem#hjPk=9M3gc>fFi zK{a9d3E1B`sE?Nrs&9qoXS`=(=~rXvBVPO0qwkmCFFn?Y}{F?v2>t(S#f@hm_-n`Hje%*0lRdNXm9--Y>7iF{5W=I0}J zZV%#LChk&C#C&ESwBCF%%*B&c!}6C0|9Mdmd=vS)p3}X5zGlzFs?~|{{VD3y@o^LU z--rJS)Wi1v1wL*T@1?=L7{4p9Kh&RNh@ba=m1h5Yd-L;C$Ztk|De7Q-%ujgvOy3bp z*L!I$BvW&64eOO(;LXo5h<6b3i@p34UU}Ake=L1CmVP*vKH#NqK;7I%VvI5|O04e% zFQ4g2Y&_g-z8A*Qug21+V&&hCr7w&5`+Mmk?C)8KsT}QbJeOgA>_pl>pFZsQ8Q*Cy z{nNfd@HgKCDN+j*m?E-$iuace$~&9dFa3B9>;~Y_s%zO5*t3gyZjew4a2g_?x_Z_IFM!z0FJi9pbG)`Jt}- z^-&(-;&A_#M4F`+$I?&6(w(vN{jv13v2?yWrqteuSo&1V-^a`E9`7Y#ywP%l^??27 zv1*&8qswuZe}}S>z5?U14&$NoefRopJ>$93HcQV?(ye#t@$MJfzj

    ;1_rQ9#1C8P0#amO1{gI@3dsT?^C4g zn?(d(G=4i5zrB~<&PqSeP50YV$&H@9k`Gw&eoOY-?>y%k>0h){08b+Oi|pn(-&w9@ zHe7?6_V?2N-kJ0%%I^%S@${(`QL(Wbq5BmU~G)Cv|OZIS4*H8b2WNV)G{WOg(`d z10UA!%gKw)Ukp8Y(VsN*z61Dh9t=U`#Xc9jv?1qTiRH}z zpV@)dj+2e8Ctrww$a{Ig_tJVE1ES}-r{@Lu0g)FyyQi1dlNUXktS4WPfXIuUAmo<3r0WV{fyx1%=^yEdq8ob2#K4|a{(LN79Ao61WJa}mbrpa2z z9EWl&lNWoozpPPAz3@2(e;Ih`FY=PN$k3A)eTktbFZyYQp1kO18hY}gXS+$ilNbF` z@R_~v17cgrccR%=GA7B3{lnlTuD98+Aul!?!HdmS+UR+Syx6>8*zBf_?rZX5^D1rn z;s?a}O8T0-*c>(V`8|Ivc<%gi25T`uYT;rX7jy2F78z0Fwn!`hi6)8qY_KTXh~{zo zOa=Iyd;KcGVTPzE7%I^0T$a*WE{2ZA2ztrZRTRW?)hT=CocX0CrMWpnN1}Ze&Md1e z%l_K=uKb4iN=k?3Tsr)ll=sc@m6Q%2Jap(cDes%*D=8g0_|n{OQreigRf>epyVOD>=>?TqAt~yA;UuhiSY791b0`OSy9(unZx= z8w|aPcM=yRU7$;Wp&4^k4jF0>?=%F~O-S&jLt)}2<3z)kIL-i)~#2OaUSbEz*2 zqC%6fHMSiZP10y8d^_YPFL)Qhu38ceyL`*;-_e1FnaBUaDwpv>9=L(`p>2l?f>?ML zWAK>%{fHM1#sHT*{J+sCJ2aZ4A&195V%e>e#-$NR^8CiO!~Kz@nRc_Fq+Z%@J?xCj zCU+drz6?g}syqsy^|)5O4Eq#p-LWx^$Hxm+JGZofw;gsS-Z29YL&w9r!@@h-2Hqj$ zVLfuNkv@UlOvSptOyhPOKimu5z>7D7B<&(FXu=9fqTL`7uot@zX=khn)*Fq-E=ke0 zVwaBwmNsV63gA`fx{ZX)wxBD6hUO0YXJXMt=F0ktU%g)9B(yR88H$bnk;rc*tGKF+ zI(+9b=zLk#bx6aL&W{jPRpCZewNJ$QH&}Tq=xkoQB7bRpIG7Ol0rLK-8c0~v$CTW4 zxuP`D=}}T)T1tW&UBt*D0DdJ&{8w=cRzt~0BpWy{$7*qOH@h zvXtLWc3N90vCHt07{TX9%mtd$Qu?D#ek;iORA1ScFp&0SYhq=mFRQv`JoKX?M$$b~ z=f}_Gx@{M(PY5(c_iQT-R)6DnIo)-h@Y^c=YiJ5P z9_n{xWcqKN#zcwt+wstvF-sfrgMN#fyc$Csfu=S#Z+?CE>v$H3TGtF~nqiH-%Pj}3}@|oq4iuasflsDB^-LvKJVW)n1%}%r3<1_f3YOc;TtZR5wSEpxtMwDUI zy6t9;}>6?Z49Ds-Br8%wEi{S(o!GjmX^}5ds_D3u4$S1UDGnI>58?$>fGo`#1^)% z$8(de{?U-u{D{-Oew`n+c)UI0TKyHY0+9EirTjIL%-B@Mp4O)9>=uubYy0PSi@!L~ zt@h%bUE?!qy4GgocdbGVI3MFO&{$7Zof}i2%fXh1jpxb~Y(gS4{a@i7VFOP*n)r@T z&R0qm?_ila_kVyze$}w&l`PZw{8G{>-zp-`ppjSn>^)%xAHR;+RsZwd^h_h2^?%Tk^&>)P z72b7L`oordlOYSp*9TmC#Rzmo4VoAGG9vWk1zQ-(|^p zmi>=$Q$kvYjq4-r&@y!_|F|Wewq)Kf3(@{{EB!>AO0C3>>mMas>E1hgq%%MNr$~r$ zUrWBylG|&1KF{a(Nq;Gsv1fk!d#G1wdzvx5%98or5h13RS@KV`{20>sJ=31p%RB27 z@I7^Vke7E2{lWLrdh(*r1utvakQY6luVf|S2b70R{zsa;*o*})HpSp&O{MYF^O*o> zA~yNIYx0tp=PSuOoi_S}NnUI?hltGr+FXqv5P7ko9N^6y--!T;Z4#<*s7x?hCw1|!wcolM(6#|i$yobO`-lO2d zdJ-WoHt*AhgB^4No7j*Sn={mNaDm8+-i;0D?W!HFjV0?nkr$iJ;AP#P{8 zOwWEkFaD%L)l2Kii+(70S#O2B=r04Gm4+XXI}Y`QfH@8)AWdvaz-JDiwd1Z;l$Ead z8?Y087I<0LgS?c*<5X}sKEu=T10pXr)!@aZ5xlG|LSAgZdhaFOHXlfhT6aF6-*vie zuKje|T=Q<5vtdAPn`_=}^ZrVof?YuK%p1y7dUkD3{SK78_`@OCOY6yto=p>u;0Hur z^x5ELjULVwvJMD&u^DC9jHOLEen8~KhJ7J8lfcXR9puHv?HBz}Z#r#e;|DYyo7l_) zFJqg$=)pPxIt6mud9dQ$v8|2VcGm6VwzKBlc4kFEZaZt817LMPC3uYb1U^Q?O-T>auQqWqpw8P>KB<@F4<#DzM4-Ntc3` zwOy8h?|B)1K;$Lw3h=$Op1kNE125mJB`^B*;AKsar)hHwen8~KW-EBHc>%n9o0YuS z>^5v(rH#J8BQG|G44b30;lT$YFE;OhmwqQN`VYX%IyGROKt6x<7|3&3bv_-V_zu_w zzO8t73~1gR13DhV9Rr&0O?w^pm16Mju`pNRn8yN(ku{jei=XZ_MxnBwNShfxFE-Pl z%G5S9X~PZ&krx~GyUhROMSnZ^%p&}d{Lik$UdDn;Qk0rs;f(Pz+O+Y$D5Vz(Su&?A zci8agbwcLP92TvB(Xhd}t#pHa)}?UfTApw zF08e7ux;rVsEu34I!NhJp$BaQK)B6>_yzA{oozLxwpp;SvON3B36rx>dgK=ULO1HG zl8hj5QRS1JU;Vl_+T3_WEH$w)MX%demn2$trKQsC+gdx=w)ERq{Ezx_*twb!!>j_I zBRglKM16|1t+v)iQXgGQOUqhXDqYLg+QGJ^UrTL#&U(#TxIk*vmdg>>#_~8?Nr$5~ z+TT{n!IquxZ7WkA$I%fm?0l?9;~j0%^_C7DZ)*G^Ts4-D;h57Oh~xN-6+1J&c+$9` zr8$U605e3GTww+aljAZuDemO<^?n{shP>O6ECRK zh&K&jrhhzl@|lW|lrtGR6K@6Z5|BtdGj8E7jVJlIPI4^&ZnN-K5jB>Ch*ol7Lsx*VQ2bx26&8zCLV8{O{qZA>C;ht>36DW9B<=8+ zRo|lkp&k9>t)t-aexk}7fO!5yXze*xq?Yr^Isgd{N?Qf{`X93 zCnq@ZQ~EpY@Ew+}Ig!=;c9WCPl+gTf1W$gzCv!gnI9P!u#rRedz7FQ21dbD<*!Z%F z)MyjFdc}9YK)Ck~uMM`&;yo z%3o9%*8pGQRLe{;T85r7l7YXlhz~ShQy6G|EjXm`7Y?HzdNOk2%TrzV0Xq`o9Wu&G zPTQCfh@5x?YXOCmoaEkUo#+)<8Vj(xPjgL6`zU?;`Ypk=PJB@it1r)rPjg;&g6Aoba((|!T{R*J$KmStFt&qng2m&@UqfhfT_``WYj~Zp!p`x8 z7LG58(&2G9by35Sb%!<_+;?FA{)4X`+4tt&+~sckNdtVsd~kQSxvQ{RQwm}uLPtaFFTjc z3Mbxr&z8yCRNRFTD-?eTk3BUfgin2j=nM62!tlS>zaanV)f z7<dYu^Op})ksCGMk-=8(h#fB53w5k5UbHIZD3iywDd*&ik9zM{$eA( z<9Gk&`}t)_H*O=vkK16(MtZ|r4b!5>7d0zjVfBq#`aO6>%Acjl%SKxR}LHvL~T3X700FT8y9E-Anbtw4v!6c zdmHv+knU4E*Zzd3(B&ES#N+!8MJnBlxnTNrhJTkr&J%Ool`y@?%3o~B6D+yHlDirB z#H+T_{r}}v{xw+X&s*}_mRw}v7h5vdW>l2qeB$xc;Br8xsNH#%e7;-%@t%#6`3zIh z`Idc0*FHs(ahLOm_H`2Wari%T*1x}z9$mglpW~$~d4eVT_o^y=la>CgAvfys^PuB8 z1T4SBNT=M_YfptY#*$MEIojW_RbM5id-zJe!IJ&@gst}L>f){O?3L{2SMp6(`bI;J z?%(cKfA_HDp3WsY?_Jn4X5$@WeDGewA4}@qgZG(2O!s|J>3`RWY$tw`iuWx-wC|1f z7NY#R2-s6Dx8w&cIb!+eb&bx?_nbn+`+;S@Stlz0&U0SV=@X&nH>o7%fM(2pO5<^k zWlTjs3$K$UzpCwTcJ0H?cP)SJ)%LsH^sY{O>@#(naGsU_!{;#~-}xag&+aq9|6lgr z1-z>2%o|@jIVW7z$bn!{X$+Fu6f&3tK^cdCpg92|P-I9Dlv@trCIk!#UdH+bNP2k^ZkB%@AvF|Hu2K0^M9WI z{GV?{7CQ57q~-52U|IJ- zEIfet-YV~=5&A$_Wv@G47u85kw!rY6QTCRP2bQ%C#PaMc@^CT*W+5*5h7$c1ybf5_ zKoHBbj{?g#rb@}f2*D5w&lX_WA6^SA>ko*9XD8{*a2R5tKMgElcotaV#rZb*-qb1L z0l2}O#Wlo7WMYx?7VOtsbYh`@3@qyvJ_nXGCl(%-U-37d_-Z)9@az$Jc8CLWZ@=uR zz72SYrFSP5nf%7z^%k92=5R04|;P{(N{-?<^)yBeeggi+mo%KlcJhQflY!+sX({BHY|1AVp6TSV@@odLg8LI&Wshx>VAe;C6KpWo;gU5L^hQe{RjEW=8Y?Tz&A5dB7Ges3 z8G%b=j&k79#Fl)vIl_Mju_Zr)*otGO12dU~&McR;BdofDXE}K8cHn!7tuQZi;KdHS z%z;-DGXY@M;1XO!%t*sLh)eJz#CB)hV_SzTQu6I1CR4oCVGaeBbveXR22x13+7@D= zGp*uDfMNPb*&`Mn=I@A+xWO=+ee85#h=qsAF~XW;q`$IGf}-Q8D1c#piT;~do*fS? z-xSIs&n(ey+tP$`qRK8$KnRF7nk^T99X{BL@fNT1COvQXULO-8w|1VbOFnEcrE}-UJwh< zCk`IP_9Pbs8b^CVU4zKsx^4*%vB=@Oi>%c!)>>toVw`KOCi7Vnd2p1+zRz`5_jW%$^a}8U>a~`Hm2=@GvM+28e~8K{_ijOa?BY z8)c?9spdLJq0fbV!~}zE^!3taE(A$^PuUZt8MGx);4Z-DWmgUQrP@(KEm#-F}w4NXCL8%Vr9(3vwqezKfvKor|)vFdD zbf%s?Z2=DffWqC>vyVzNs?^uH^~bvfei3s4jn)hY0Zp4>`079$XIhQE%Yw!q`(GLk zliYld7%t{b_!43D;L5;7vlZ_ePvZXuT=br9>}TJ@<&^gv>{b&7#JLL7yoEofJdW=; z#GpK{FgfLALf$L{jPjg1^|6*bd2SSVN<(Ppiv&@Iz(QZOWqb_{t6L>f01|4CGRDSn@izNc@Q0u_YfWcYa~A|LEa(Q#fUt< zBQOjZmct#WN6!OO9z;jvZLq>8&%KNal>v7#ltD8A7yTVY3(TLvx7dWnoo>8-h8zFI zEM(zy7;!5B4OzcNoXBSlPYsgr-GP8Pb>M6dXc!L~;Ts5H5(m<^(qDv;?vrsb9`U&T zX7pG~r|r~xJF)2;(ShH3+i27Et99VFpn}uC(YUzR{u{7GfA=M|G-Y#4d(3Mw$77Dg z9E~{=(-Lzirfp?!TbHGsn;P%5^^dYmRSq|3kD|YyauYN*9|gPt(d7(FYJ^5;)Mf49 zwj7%Zty9H@D0@o9#^KqjFl%5`I0od7hTXAK_*_ixEKnR;RfIsR*QTtWGCiWnv9;Z{ zwv0Sl{eVDA0NU!l(Ei5{OKeobZr+E`L4%HO-oyshtFi#~?y-S?RIivQ=bsexTJfZ& z1*mV`V`z@g2fh)Y2EN_6gKnHv@Qo}x4B9!HYKI4F5WYU|Id5QCGQybH7kiZZCOG19 z&i2QaO|6{0yI%K{CD`W#+?{bl=G4sLS(RBfZAM1_%#_l!NUCvXvh0EvZL1a#is)QZ zN+(a~pDDT9I|K3Qi!}@J!;(BmO^>l|p-*7)A!<>Pa)X2u=Pn=?o&=w_G{Hf`Ituzg zEp7D9_1u=Z2bxSRt(9NQqj44Kn^Pb627)Df)Q!lYpFmq%ngG40rpI{_WcNLEoP*X+ z5?{1)lQX|>X;ZJN7?!j`6$jy%j5F4kZNDGe+#5fsE1wN6oH}wl|hC_I5dE`Qf*Q?0DNb z;YSc166#r5XOA$*xA*K`5pwqOZ!I`LC;UC!1^8%m5P;;knV>8{n^ zpUeM6IVRUa_-Fd+^Bw>Wu3V1KBd*Oa#A{P5^gaIrRK6-!I%o7Y)cNKb{f^vX)o{4q zD^~Qjv`0Ez%Rb-be%@t|lMdG6KjU(@^(LnLE{FRo=#y#C4WlQ#*6@FeL!RtgHQfgo z?)x0>`z_2k@a*yE_<0Tf8T7y~UX@|-KLUFUMs?Bry$pVPtl7)u-p6p~7}GSSopV!8 z`*UK&D4FS5>$2~2*;6C&G5MQa?sj^b?(e$XZ5_1fKEfd{I)43(@Ywll+HD@wZjU`p z`?`pKru{RQeZR}j`7P6!{Kv$Km9w^ABwl5NCq3eB+O26R!#$e+8iRjCgx|DhyX&f33?tz-9Nj>;ql)1Y`V9S$x-^PPEK1AdLt8 z?_BmpF1vFL2l+pCgpc+gy6p2JWx*WVe&1!!bMgN(WY8?c#eMLXUHreIqh$>LT<+&x z;VpH^U+uC>T2n91v&4VudY(EKG4yYk>v@N>F?O%Cm^pvSeemCP@l)?2hVp!t*PZ)#KL3D zb)p@iDZ(Y^>=Fx4DX{Dv-|XNa7M^Vmo*fPzV&U0E9_xMVIr3!S216`7oPQY6n^bdO zvTuToh36q!t*e&oSRN8^bNowlUV4Rfkk(?1z2Pf3(rlEO93mo(5ovJF(FB0*g#yp*I7I%p>ICqzeqO@VrJItL&X1&v#88V&OUC zpc4!IU0^8>M%~XcpCuNan}L0kOggd9N0UC;q!SCB?ZyaB=D^U|H^6{Vdye~)KE{3*a9a|rlkZ9x+8Fg|Ja9V0BvJdJ08f?0wqez*aRb2#J-fFh6tZv~cc5{tjP zf#bi08%!gv_*)EU%-hL&6sC{xzYIL`+a}K;{E42GSa_I*5=Ua8p9LOa$v4u?D%;L< z>kA&yTeCPy86XxpOdlxnL57TqMV&_@7|;0=cJv{D9$g{MDoyfukCkl30SWR}N| z!VM-Fm*}m@8gD&(8!;;iOa?CDnL#`nHyDY}2e!sU6`VoM6Q2}kJ{#lxs=&y0t)i*s?|a=d_>v0{1_e&uy{ey1FNqHfN`e3?fez-Td*>} z;H%>Jl{|~qu6k>Z zI!EpJ72YV~!}*1)mp`1p0I@Rn2Y*TWuCdZ3qD?kyqB+~MVEJMf-JJg+9h-|Kz`;c; zSFR2^bBJZB2fb+O)KQ5>L-I9mgFMl?&OiB-N&!s_x*@~N!JRnHw0@zk^Awoee0&!b z6Jvo6(CAHuWq%E0*w^tc#i0fM3^%sHFS+FL{fh0S7?Brt$$J`OyOm&~JWRPqGorXNg8;}h*{_~q^ zPQLSB!1tE*jL3Tzd@N65D1)XA7x5@sV15U_#U?cFbmMghg5()Ge9sv;i-+`KV1hqu zh-t`Y4H*o($T$IcPF>*eH<>PABqrkiMRVr-Jnx{ z=)}>w#M{%xrkSo^txJ3z<5l`+4q0x2zEe|9Elql9TE*Uq#!_!U_m=b$eM|2H+QA6U z_+kF$9{; z_I$p$QHITVV}rXQbqEcfW#BQ2Z9SL}nnDdq9l z953cYM0#2#<=Z;YjXC|)bnk@q!|EGVD)yMo#L2(ekv(ROr8cLHaC-KPq*>c$#mxC= zN?vw*_QX2_&|5gucIKgR70nfCrT)I1>c%DaSI%sq{%eNegM>t@kG5k6ZwB_bh6bwO zg=cV$*23N$8A%RJjIrOf{E3Y9*m=uc%l2+mTQ3L=RUbZe-0|FW@H+NbLX-1^vNbVD z+0?p3hu%y(rrfMZ%58(bQ9E~SzSrB}N~IKNktJ3(N^)p>Oh2y7rMArzE5>i$SJ7M= zolDw5=r-@v>PM+$?9&t3pnyI%Vz&`=pFQM=?H;_)sC*vk?|c_M7hW8s;-C*36;v-M zXh7q9<;1Pjkzr@+3u-RXOUn{pwR5|&MDIHnrFQ0~%14n4n{b8U9L_o4IVgYhIA7`h&{E~q3P|l zHCWQDB5?uM^Sy~L#>J{V>nr1eTRW7FbHJfPjN|Uu{w+b(q1GQvjijFV8;su#JubDX z-1*7$U^)y-j8jY>AM|RXA7Ic=I zb>@tt);P<0a!YEdo>QjA#`RKH#r>?(+z-F1QZKrAjoqGT2g?F%4P{M(Q}Zjdo_d1$ zZFz^%A3r~9W3E@-h}LUZy+;MNHmJ6WiJSL7KCZ&i!ez64v32$~GE={&G)70+nSiqK5^RG0m3m;H##ZjWuv=l46@qy0l2fPZr% z?p_t`-pg>eriH*|+A|{jroF&rf6Qfn+GVeI+4nl^(f;=_{2w22@8b$zKUernyPbah z6xT`8?7$U+w*tmDGT_Bq2kn^#2XCgm)Mf8<*%M{JYw;(z>@f~|bbL(zlOys>yPdwK zopaizG3}3v)e3)+%Ug86BO*RZU2T^XuZ(A4kqg6o%1Ywm$UcUo9}in*uso=J-+veA%BJ?k2Knky6j$;o$sh( z$p50t{j}pnneL?)Gyl0CdcI|68c=utdl$d^O!ucOe*RJ3O)mT6uIIny3XdbW#`Ds4 zEQTEF^2b`wCxel?_`6*4&bZ{&yX>VdyY71a0hc}AvU4A*aYnr>KAI!IjPF9r&NgiT z>eK&nxu?7Azp(7oD-Xa5>GLjkIgfzeQvMKJqE93C($#zuEd7l9+`O zm-tlzEPH#2g};XMS-8Ov3;ju82?Mdv8-PWx+en@q++c`>=K!$ml_M5<66w~!fmrC& z`G`I_jXYMoh=s>UE2|N5rq#XV=cFnOvG5z|GuI$TrO!~1WPkcCz_Le@Se_jPJd%@j zFt_27J$=N&GZ9$!i8D{*IT;5t9haPyPw(Yia$43* zgPvIEUzFD=;E`{K8|ge41Q;Woud}hpVLFRWn|-K+fmnE0TqF#{LN6qp1Q=qWKMWji z>7O?MkF>(DmGm2MgJGE$yqnnCBhPW6oW)EmGMj;AkNiI1Awk?=h=qsk{q+`|Sm^A_ z<(zb4p`QRAY3aI8lP3>17-Hdh3t0T^0v3OXh39=>@t0WWp8@;waf2ZiI>(A4ljAN) zLt^1!TP)?1Sm;B6MdyDrv6Z$1AwT{m`lM7MF44oYjU71*HyD-;(aEPfa27EcVOTUp zCx0*S2o_$Lg}CI5cw!09GSZjg216|LHNc{u=U8UsEx5rvf=lpbVDalq%QFKGW0dFb znD|S}^9YlN@fvCIX9G(*6H7RAfkkh>gqV#b49m0Nhl#C8@={Rm>TH2GO{;?qscpiA3GEc|x> zj~Hw6WZ-Y)?It$zZk&my;!pC9Se~5)Ea&XcCy&*B5(|$}KCSRO%jY&eOV43yaY?-< zmS=YWOT8u*`qRL2wmz}YpCjGsQ;3EB60q!HXS*bEAr_vaz!LXP;P~;l!JNS*>l}%N zzl(IsFJhs804#o80G4E5-(z*bN#w}4}e(cTn9ALTC>SAAmL<_A#DP&@Q(l< zF#$IiCb5)rV&O5$#&^kKou$BxwXpCo2}WcZWb-@+D}PB6p6S3+K8b~%3p{cXZZHqx zk~Ak4o>Jg=7BrX|T=A0)Xw+XxH)s8Q63&ut#3JWeVBc!!e$9h=qO@SiVni9$3OmEIce55@u&P`3!X58r)!rg`a)XNNbH= zP*(DYcE6B|XzmNHz17+s+`bfqeN7u324Z zt_J!NF02|7E@!Yz-+T6&)Gv`}`HKKzIa2gmBc~4t;#$Uk?OHi5ApgOls1z^-MUn7O z{@Mkr7v-;6kY5lid}z%VE>2ps_Muf+9aM-Q2&dC`GueA`ad@#f|Lb}ooL71wE~)PI zPpj4}cYP`XsbMUJ!pa{k0YVbH7d46Ws1;0Kk`pUeFIv2yFn>*9{#tA>T2!=rb%8rI zB@1}yLX?}CKv86dIB$6omkdcrSkAc2$4UFDr9W4$%#spo9UH-;4!*2_83#ldOwM2+ z$*^{7@#5tLOI2!*ry#6aY=m_!7Vxkpu3Ej$UKs?p< zEW`W>cj7qH`h{zM=Ehvf$97c=oDGu$KyNZkt2%&p&}Hy|uQsu`=++YkJkoRZMD34PV5Q$m9BX%Hwo{gl{frd|b-a zUSt;E$;61f9MGKceF^VoXF;PpWKBdK_aZvw9fIJQA`Jf`?{io9wtvGMPf;F{G9vF^ zA?lHEPcAoq)XEpiv&89+CHF(D?W$OTduc(dC71ye>j8|HV8CKBp14 zRPZ4x)@TFu1$@@)l))~1%faMabMznrMmL6!M)+nT5)voUpMyNk$Uy%6KYmQdJGx|3g7gxCVrtN>gM%eEf;Wcm6MP@kc%%x~M z3c9f-Sw%(zS9bEL?!$zl`ZBByW#?gxOIG86r5^f%s1SUah3y@RNW^fyBp9*T<%9Xc zOX{ncM>eCB9k!9=lX6bJ#WtJaM)xFK{1>xbfb}nKEOQ87q@0tlr*h8sUuQXIJZKmm z8j*Jou!NQLBe*hf(Vb=7F6aLAzoeXx88dpc$^X^myabV=e^SnGg3T9q5$DmX3}f{| zfCFl1zY@Y9H!FO50Z**K`k1{~75LaOtO`0HGRJlv zI~Fc`KEoH+d91Q5T-F*h7IAF~^*_KbHas@90%sn)ppH!SdbNW`jyYFt@MH_0mn#Mz zo2nh84_hyB1)8~LBW4Ouk1%7A%CA+ZjjcGtAkl-hO1mPfA9Qa9PWgDjp!>WfkR{&; z;M2a`9EFreD&hS9xRRJ~oDn+i^;b=`+oxAd^2PD_%j)&)VEo(a$aIAAoG)%GPj;A5 z4?Y!x=M~mTsXmjQoF3fzjyjzkR2S9v6ZG=(80|ctho5ouS<5$v>?cj*WDj5=;Z;;R~5L+7pvlrOWxZ}VwsB8f zx9`%$YqXZF6TQ9eJ`lWcM9nzX^jPphKFXWdJNbxKUlubgah3|6%~x9{mc1(`8koQ4cF|aW{>E^?@_jNsQy5A9TH|<3(yYy{*Q=z;9 zm-{l8-A-SVf3Cy5K7t9ZHssmqYuZOdc&>JZH{N9*;IjK%_JJ<@Aj7|*5&5Rw&VSQB z&f#7k!32Yi=My3{({88#V3&X2F!*na@SFBLmp#*Ex6{+)zt`nn=(2Bc*zIpPka)d{ zw%_2g4~?9g&N{<&8WXL7!_|h}qY^DU$HW6L8aj@DF&wM>&a$-Oe*ntw^Ol`;VgSn9 zK$I66mcaqY?-E*IFx-YcUe#FgJ%)XNYPal^&2QIB+3joC2O7FtKx3^N*9|PC1;+Gm zuv%h0zYVkjI1!BV&SEH&W(Ym=8Za_v$#EX{pO8-MH=T|8Wbnh@-$AD=`F=gI@FxSy z`31y6XBm+*;29?g1F`V1+({USg-(C}k}zBce$oFk45GKcg_tkRFe$i1$36;pgr!TT zzjBTM+XXq-ocS;3WX~ez%Pq`&Tyoa?LSP9ev4npyu%s2S&{=LpPARbL{oV{LXSXvS zM-0FXW;-rPTVjz@4?Mz$8_aH8BD2wf_X5j#^DKLk{=_1O>1>1(Wx$!&1NkgpZef_V zz61jrSf0HZB-uC4^c0;c<;UY4nTB#CeTd~*%9QjW7CQ4Teh6+bBX9{GO*<N(Tm1BW~gy&+)P_<03j_ zwz-0tR+5jz5(dUmo&?fZ!oNn5(Z*< zmhFh>Pl$ycN4k~o#6o8~Df_FLC2}r!5^%hw!=#tu7qL8>PWu0Y8w|0~DO1i(AQn2) zO7hg1ZnuCgc}gt&MqOrMgkfAp+-g8$enZX|p9PZWc<&`<;euI+YvdRrbM2Dg0@&re z@P{3^oY;C%^*AT8`R2~qa_%0*w$A&g99gh-xbIgnxZwFIE`5~%}$nI?VWk|$M*T@4=`?twKy~y%KE4lSn(kzNcrs5^! zILR6x)b3$&C6c=9AZ_s??1`s5WQM67`SQsZJ8z<%UV|;@Ox=PYv<49mmP4;aKMW7B ztJjr_t~}wSKLallJ1i8d78NX7n!gIFn;vF)QuEfXO51@CK` z$ry_`=YFn5_zKOU<=f!?$h)dpl(5B)NBk~5hpnH3+$A)1{StIVnp6EAUNec*Voh)B!UhYk;kw) z z2c7cn#dAy#F(R)R1gE@NkjFkU5f}R`kyiy_PI-&1aDc@yBJY@sZy6jYM~v{X3_0aJ z2nVLG7~z`?f|G9p9I}K7|HAiOU}rp5A|A|-L|hyuNjw$-JLMgLfS$?$`yHpew;*pN zXo7hi5JTy|Hb@S1X~1gdjtSZYn*&N&GGIh-_-8a;42|7*RoPZA}uh) zG&2wni978h5bzRQbiW-JpiwUVX3Sr97IXS-w^>udUp>dmI!^!0w(|e#GA2#W8Ho-# zc%Mrz@9Of3Ru`hX>!GVdQhqISH@KX|jCz1&jwhKXH2mkqwv^_J`n3PA>oXQ2?9Q@& z1ojMEj2p|jUDj{^i}V@)S8wKQcV$^$Lq{)+UDql#)PKVL#XzGrlzDTKy_7_G+Bs92;TFH4#Q1;E`d?=K z-!1+cuGd-A-Wy7!%=~x$e}B-e2zvwO2!>O;W@yLKYa=KWKQT7IuU>0eT43uzge>kt zOfaKCP08X}3iF`<;+fj2KTpg4Hg#QbDwZz3xOjYvoo*Mdq1$k}5zjEvHlC-$JP@ZcnW(+%fwTRd>Pk#5+TZ+>z6)(XS+mT4P98^d7oUrkwkz)#)VO}M^+ z>ndE=;_~96zAUw@DWZ22-CW?$rsnMa`{Pa~btL~L``6QdHS^WnU-~>HpK1s9Zobj0 z&%$}^Ji8+v=P-EJ+{ANFe4dO?wfgZm3B$ObkVzv4doOH5pM#`)mv--~YY|4u4Q`yrN^}L%N=bBWcLbn|D;>`Fqlz{VP$j=(( z>xZJ~hOb}7r#w+1{CGu1c=Hcb?x9?qs8ELj`VLBKY*}9w#DO^evhPet z4jDSwz{lMUPyDF5@8{kv(?cnTe0>LE{m4;D|czo^^ zr+}De9=LOD?klN>kZYwrPqC3#J}<(0woF}B;v0e-TsTQ%o;7U_mmPwCGkDH^tb|-U zhm`GiP^}Nxu}KPS3#?JQBC%trc4ch~G}cyBrXNae@y9)`(#u@#fwIcfP%u76TZ#Oz zW$`-!Q#9(gOFoUxkL){{BR+3EQdzq;?s(F%$>0ReyIDyZsN7wYCYVm@9Qq90#Ee=-Ku6? zw|UU{KXjM;+e5e>#0A>RE4xen1$-~B=vMz`zSEqg2sF|qxcI&*n4Jg3AHZc8xF5hZ zfM(RFQ4EfU2vd?naIrcD(`Fx&OvASr5BR{yJGdjNgjQHFV;qRxOxA+-GP2H%t zu9Al8CQS`>rO%b$HIL5Us|Zw zFzt_uvnAh7&nv%sPXF!r4>H1Ir`I5rVacM*7|h;~|5!x+AXofN_uC@wrrj<-rhTT% z-7deT`(lTCbou;-tGo_z*{^rmZ*bXfblHcx?B8_RZ&JBvV`(yQQJ*gR;D;D?ukjr? zK;xTaJXhcsR{dZd=f3`TEc+qDewF&YB`?viU!y#hJFLc>PLt(+!EnD8b;>sJfWLGQ zXus3-e4fjWA-`eTai@Mg-Q~X3a_1lA{l>BrUyIqbr!0Ga!#+g)+_JMwUW@ez|7qD1 z4f_p>ZK<3!z-MHiKIM(D=HeJ8(VgE+Y%Ove;h+OX^wz8s@s^(3kYi1DVptyeraAo@ zg84KWV!wglj{oZ|IuK)i_}ZLzx;EY{O8F;DHW&9WfnYm_8yW zk=UX$zVa;Vg1i7lP?3}PQ{ zFpRJ4xn>-PSbMICC9N3r>n%F5&?$PzP~2dMh0eNhy+tP$I{QJ{TW$Dz69_QOPSGV( zzU)V4ddePTrkm^wW?Bgk(awK??fk&-$eR1i z?XMy)YN-Jnxi+A9Exol?4Opsq>zmIE(wA^W^!rQm3-Yi4nm+(ij z_DUZ6qtJhu)YSjeuSY}g8xyU6dVK)S1jm?Pj0`{7tr5pr4x@#^`iB_9a6N&WFT--< zpYYuYCJ*cxB*K*TH~VmQ)%2cjAgPC3@`^wkf=i6ZD{{#@hKFwk6XkIjD)M-y0e+Eq zQ~|HRB}U|FE_oLm;p6aC{+?vxM)QOCELChpcD#C-P3a{2jEV5eAgFw z@8Ef7_%iTZBHYD@Je~*U4BtwOx32>ei0yeT%zW#a4E)ng}g_tXZR=b#sD)68MtUhpS z#L$gq6E5OWw7_VnD2q*K+DXH8o#n4M&$*U^?IaEJ zgGTsDz=vPN)WF{hhzs4P;$nQ6KZRJ3xN7mO>7y*g-&g7VZuQ@4ZSebQy7SX- zw_uiz`}GcZ*9Ri|v!L}m;1wI@+2Ja-7l#Lyj%|MR!xy{uZ67;3EnY7hG|CrO`_iyP z>{LsFdZ~3r>x*x<|H4<^^(#GY=_H(}{LT1RX1&t?RqB~m-9Ie(+W28Nug6!G|1o}8 z;!W2c|Bv?HcK-XRH_n_q-_iA(_kaDtuNn_*{DoJ=9vh@K9vcp=$`}=UB%oq{k)t;L zDqqFEQmi%}FH^CvhVYf*Ju3Fl3u@z$R;YJ6)W%odR@PaBjmO{CHva0OmUMMX zpS*s%u4++vz5Mw@wZ`NA{J+&2kA>fxriE7xMhLwz8xIePiESMo6MJY(Owu(ieb4tZ z!x3JxKs6r?cip2k9|t zwst`7+mLxNW}+uAZbDUBdu&^4Op>=HF0a>Jl_|&lD^IG})w zLE_rUc9xcUoBSN}4)cEGh2u5ZU~ zY`w^5^XPis>wmLD#ZB7yonBh+J5x?<{F_PIb}#eO~LE^vCY-2Mil!hTkL_r0w^IGR#weX}a^}%s}+`nk!YkjjIZ7`&r-=t23{NB~t!;gQ~k{tSJRXQa8sr%I` z{bat@==FbiQRz9&T0-2fE3@AyeBz^!FL#WVj?(GR8mx`1%C7Z+Pp{jf!XLb&hJu{$naY-s zo(n01_aOaGs-d;#H=oxV^joWk)-msYjkI2(rNo7Umz1wFr0w+ny3&_BSR3DKPE}jz z_;!DwLmOF{g%meK;(zlUHNWgepwnI{IN$InhlJhF{leOATl&Em8R;~Ts zB|F2dW3+#*L`t7ns`*05qr5V;vo<-q9ceNKY2s`BygR4TcVdaw80UYlT zNjxRrt+|>P+ovvj1oxk+77VcN0HcSgwkJK8TN}uKT zdbGxxhwJ?1>DsO*{DJxE*2?K2->fB?p3s1tELT6T+#k}jKIwh~Ik;3y>E#bz#%$Fd zZHRXc$~r^+M&+eYR_OhT_qY4A)~Rn-W!3snW>^wfo_<=@`~yAfkKO)vIuJ{22Z`Ws5h7X_A{;7JuuFqbq`3CJ);rlKk9t|O;)kBqL zJi@CHkCPj$&G3DrA7;mgA{ zvhK~(lk_1WJ%{BB zZNqGacuwWI?3pLm?eLd(Xb*?N#TPZy)SM-nZ*YSO7rdzSR;1PgFCdLr^ZW%bs6TA+ z1uk{_FaAUYP?nRP`mA>Rj+r6-M7q`-*IK2|Vr~Q~n*yo7n)~Zrfz;m=bR7NR(c19G z>r|jx&-}dm;uhU19nEUj4-4wD5F+GI0_y6A&1!j-9=O;YzSyLGT{->n4neJ9JbUC84{YyA(jX>V-tP5Pw!{%SqfsEf-xRp(Qz8{yJo&DXhD(?h$J|IJpF zU#Yi#44M1Yv`W3>DQ)L9eRG?RhTr}-wPQx(g3pgM{b2tO=11D0ogx1vuQsR3clgt8 z|EF)O&!(9rh3(`A`Uh>h^r5wSPL`I25`%KVb_QV&zuBhV+v3Z**zI5UD;22f+O~gN z)3%QwYmDY!nymTSK0!WVose1T-pBV@I@qU#-)>TKcP1g9^jWNJf$DH+haLJ4BB3u1 zBlPEY?%%mCG_fvRJec_u_^dlzh&;++UC7RDI?fzRm~!-BRUq|v+V-UFEhznFE}K2U z8&wY*sqJISxa>uQ*i7xPYOOq8>%W|(`IpRAzQdn)7gy^>dk}uVR;_qy{8OKWx}Mne z#PnL-XfN3|0jH0`fawf=#}G&6(#xx z!LQXJwPHuoj`q+Ws*Lhj{ItrcY@Tym->(l1*`W++L%lg@6T+ABwQ$!Gr5}RS?hwLk z)|Zefzq@VcuAP@^!=6@6??7#1sR_QI@~eC(HU5jc5MsR}OKXbjs4QTOLWl!e8e05L zB7V6z##O8xKb*@UEgjihuOrbBj{9Wz0mHH&q z?aO~e>Ib#P*zmi$I$!${+KyapFWZh2W3*4aPW%t=k(_r)nER zY-xQMpRn)A4kd+rS(mz}Rr#~Jw6u_~6Q#2bJ}x_~{Fibyon`*=Zxq5cn4u#9s87+`ry9c$k4P%!a zEfpoXeZl8?yY6edY{Vo^LkpLiuBEen_bStT9ZSuT=Z6g{Vcv=-lb-YiE_cs^%rRPC zsL)L3fvA&jzJ=OarX?Ys^LNhNX{Rj49w*tSy;14!h4untMIT0<{(_L2k3LC1e7XCL zYW9;m>cXX7_$O^QRvmWySliKSUS-QY^S963uA}Eczlbqj3)0#gxnYEWnqZ9e-aV|c za+}aj`LZr|PciajdaZxcAk;C$fTPp**jhGdL(q2DW;Jhb-|lPsxO)yb*P-RoXC-Un z;sRA{f!Xh}{|LW-Q8lA|U@8U><5q1Q@+KFpH{yWNcz79BNahUJ#-aXoZEN4ABV~Sz z5az2|gpj4@*Od<&AvD_D`wpvcIck0_{bdN_wDj6=IodTx8!Ej^-0Xc;uH=9-ow+ib zxiYT`bq1x-s15)5u^NZ|gW;Qo@a1TQ2;UNvcPo5Bw4l}qyFj0bJigRD57H8}A;{wd zZM-pdW?RDWh4JQ?J|`PJhm^&94K0r+UGs4qQj3;xHRN@^pw%K?=X0B%Xn%sGCIE@K zYC1{+Q*cgIr#)iDsH++6poFhX%MJNAt=2xT^k2P6HD`r4;eD#kzwrlJlHT>b@aF%} zcJ1(c5;Px2O9}9A8T^~g^qo`rKJyDBpb6FfNe`&3x|APCpQ+Ef4<+g+D!e?Te5ghK z{GTX)AjGurpg*(n61`FmN66DEn~j|M*eFYHYqg=2Cw(1kdoVu8S*iI3K8v#XywU@B zSId7H?@S%qexzzK-h_~<7zO(8D+A^e2P?DYy^mbd4}IMI+b!Wk9&KlhzbvGM%RkiG zYyIU)E3ckeduif6_!y2|uA!ElU>hCSqR&DO4%(yq?}t>Uy>KT+;dK~=zk3qp3N;6%!2kAM#Jv^i z%yE{E)+qcwO8x8?v;@8z;GLlZb!{o$*>s~Nnuj_*MvKI3S();Cx|ILo=ZZP&Uw0J! z-`I7l9@hKU7L?B@f1>M&=@>&GchJiFgB&4V>ON?+T71`GAD)A7G1MKEr$RWr2=&=) z6~lQyRu`*{Ug+Y}>Xm9A`Z)hPsN;b@cCW(w2Ycj$l`D2G+4)hOf6{CXZzd;R)N1+W zIqO9&0i$Yv=_D=E!@OCi^6J75yh%yObBv|YuHc5KP&WW zhd%Ab*bw=R5%h{O^=SE{dZE6f)?e03Bh_fT-rS^?S4;oMP?@s=ZQpxz`;zSw@xJvf zZ5%?ow>EtF4b_T~^k*1J`_O9Oo$cLn^+BirZ+QDd3Fdn}+d7m9-RLzsDv>s55yO|x zAbw5Ty0#^RKErroAH#+b^zSj&Ge$!wiTW(owLoQhR@zgA7~AV77>?E|jHwV(-@rX+ z0csf1O!VYMI>z)3cb?I^^r3afYr{patKV+X(SIVBjgaMRDSzUlCyv+Xxj)v1;7!tZ za-g=~!!d5BG1k)2qJ+;kM@Hx`VT?PoE`0HQg|PzWSC9|JdtMlQZPU&!jD54qvv(9? z)F*9%^w37X0$%nj;ew0kAN4I?+3hG1opneR)IYwv zyisYC2#iA?&>DLE7V&0JFs*u5ZTR9F>Q#h*p+e7rnt}ZLU9)<$rjRo*o_91IZ!X3g zALiQd=7N60%r`yvW^J73VAc6~1y3z`3Vq6KmbNL?J8S*LzcFePMz$X}7~{UixbXW8 zsy1h@{t?E*;W)N|W?SI@kYk~+R%^Uz;$7_UC5)mzK`h%*E^6z-p3~a-5`S5Z=HKkq zmh1?}+^B`Cw`rK4+xWKDrBAQ(ult?4Ym3i_*{`d8Z5S;*g7FDP9jGsh534iC@#!_; zij$Zl%2$PTVefM7qfp!Y&Yd6a^q2oorS0_P?$(BQCRF)OEJyqFj4@|4q&9pBy$n*? z|M6q$U{zzS|Kd^Q&wp0=(6aj1mg5cEc-LN8uEwEf<#-&kKIp@kXE_)p^DU5Xt(>C_ zUwQ>6G+^xYz=vo7{Fl*EEqzm^@6faU-2GmaRTG0{Y9CT@pO(dWtn;d^D~d4=VSYdS%}%}Q|DAAhti(% zulo^s+t4O2MF~V7n}WG3jMsC}z9;-M#>fq-5V`l3=F7yGzUVQG%!i`&=lBpQY{U$0 zZ``bBd~sbT@@gi|o%v+ilQ&i8)$y(WAl`cyYbl;^@B~`y9MwFxb6Ys;o7z8B)nX)r zGQ@X^JoJY-oLA)h2xl(es2UPVpPHwq>CaS;*L|4Fl36uBYfbHZ%zmBF##Bzks2u58 z)1cT>`Lyw|;l+BS7uj2LwBl%}DKxw~6*D29cZc6WZ;4S`qsRZ@^D68aq^)@T{q5nl zT(zePbD?lC-l~?pfY7idpHuny)<@AlnQvA8KBu%xp{A|RRF~HoZ#R+D@}su>)0UrZ zIa=fEKz-w=6=~+{Fj{WRa}{X~p4RH2q1t=9^d|k=oZrj*WA`gtthC0{wRO4E-rweL z^%}D{9JO%{HH=!T=NN4g-eg&iaw@U6LnVbi3gzxh+xgQi$vfF{ylUlf_`|m`3OI@R zyfYzvw%HEO+oI2|g5Ds!^mB~fI3jAT{H(6vskEp5wF>R#p>B)^I0|d*<;NJvzsakW z&zX+Y9i-jP)J0om%)Xw#h?L{oMF&E{wl}A8$!{+`*|>8@Xs&*$Buz(Hbf1yN91XL? zO{=`AIvhBub)kJJKwE+Se)UO=lD?~@#j>1B`!%#K`R{iiU4CA@6X|lX`wgUv(L=I^ zln>If?m30|()sFz%Dvm!67kK2GYGzu>~-f=Kl;N*>-3Y4X}fxd-}wY{HM{E4e)#h( z$v@OHF$0JG%&76fO)A{hrTuHw2k24J{?;IMSMxn!nwEBzf9dZdu`8@=yK_F$77~oK z#T=d~VObr<%4kEk`SAuYvU=Y()+^2c`|)0+&mOO(TWP#Y+Yu9fYny7Un;ts8B`x%? z#@zBJ-DqD=FrCBiZBqWyx3nQo?Z9~CqV`XfpP_zZ96u2C{{x1}97h(;^Y^++OG8`t z52~rAA=|%kh?b^@W5#Js+a{uIF-N!lxYOF+ozGP5tJPc4DlL5hCC2E%QHsNXn>CIK zQ)_)EFair92R`J8kZ)lJt9D{GoUOowDu3ypw5F%VR43Q@Fl&jnz~~jjZ`P{tq2pTk z(8pSGjeZiXK@D4jj}cqW0nMwa?73p_bb8P+Vs3V=*}ohlYlB&AL?6R+D*X+pLzF&+7Kq^gfb# zB>qtOFWzrW&uKi|{>lfx?0j{|FW0>~_urTN$IxFq+&cd7xK~YQF+1@doqFxM{B;muV^zv z+*>C8W;?#ud%VW)89l-0Ri5C&-AeCsAvU|L!QLC^@%&jY^>~73E0lIX3uK4x_coLz zMI_nhlqTT|)6|4YND;!){u5?Ea!IV-*`ZyHeo3z#qjZEhy)ErX@GR;rzDe$ndm%&4 zm$c7AU8!!$vTeOH@#R>&!Fx6IYid}@ZuO&*6KdG{L+VHCpI4KkT{pmW16()4b>s7@ z_vEN&OW|4ySM2)wQ5l|%b}ff%Ib1ivbrYVQ8ujdBaD5D}6>zOU%MM+#9Y!r+rUiFk z&AGq4bJvN6_M@-i>+48|$(9~k(tj*;%`d+2>W5>YYkn~|E#BuHG)gZEy@dYkS9DOc2?Y+e1zln`{T|e zolZWL{rdFInJ04F=e{=oc;2y;3hmCa%onlzMz83jUc?d({qcTkEL8M7qxPn$WBUU2 z?Wi?*L~PvC54+{;cu!V$W!XCrwR7HnL9FbV83|voq*TKRthkqXe%BV-xr^eH>-Wt#5qlKlICuk8*|S`cjisK z32{qIoH=DiU|Qx#EG9@S%3oWQIBfXhafxaTK2?#wSS?wEt=rBO5~yaP^6{aFrTK}AmoG)C{Ppq_Lby18$wABmwdj`Kb&tM#adOk}%3J%L{^7{s_l`J%4|Dtdd0t$_hf~@=d%N(Z^*vR9*^zZKZ z;Vt>$HI*+9sQ>%hvY+h#*jwKEmESu3@s3k@zx&Q}=ld1hny@&g{P*KF?YV!{Lrvej ztKtX6se##lcjxUN|NC#!?)b@ue+#DF_oots@vk!f1I~xP(XoK3r#+j!qY}WY{sH{V zOVeDrhccSqz2~s6Yfo8!Lmt<_amOmz+JzHLP;>EX$$DCl)y@ud;86Sm;ZD837vGCtQel7xr8I5bm00SCWc-Y5WZ_$Z`&OG;}nf$~;=UPpn6AS$U z=~lWC3!QaU@`zaIcav_(Cl>l*(k%Won4EpO0ARiNM!ebYh|33_K(O zHyC1}Gp(+-=)^)F0X$?dZZO0`XTD!=(TRng4m^Yrg&`I?%f|H%`7XB>Y5kqi;G4g_*SXg-Oh26&thana^>yvLRsb<|0I@43m-CYMPXYD=$?7Iy& z7-Hcs1&$v|s#&*XFC*L5_(W38GmYh}-6vs}^L6WiV2DNj)4TTT{#fON~uKvYEwZ#1^7L<2=(Vgkcv}eqjO50JWLd6s`_pxQ?J+xy#7hU}N(# zu-L&=h|@#OJNNA=2(kcp7~xvxBj@^gfOSP ziJ-;f5+m}?fXOMZHyYNP!9;m@sgKAz;F32JZuCct$om(UJf4@$CYACy29xlu26l#T zKJ08;#fUr|1ScQcDUNN#2p`9U&Uj=x{N*q}{C(0DkIx{B?UWdiSLceyy^zN?jPYQ+ zMcycvyaq7z^zE|mxa4tMPLk;9D1ZMb{ z&mu1Y*eNd!gW=Pli4l1mf;i=U40+r)LU{u$H^%#Wpiy2LE}E+o@$EbVnK!!eI&S@o z{LzW#I|ImuArH+2OCJ58c{xd`L<5;OhRLv7d?N2O`07m-<1X^P2S6-*j|{WZh>XI= zE|Zw!0-Be>x7dWnoo>9Y$BqAD5^ok{{)^kou%iC05m)kA!##r}e9HlxdvR_UVb)uw zGmY@wiU>#?NS^_D_3(i1DY!hin9s)NDb3^ejPp{zYA?>{wDffIWYw?Ui&Il;`e(LT zx8QphntJH|xXz>#$?e&%O+VgLnu;0hTOzZ5Nk?|o^zJ>QH&5ZRXP>o$DWzKd#6Wuh zr)Xi;_x@s^$NNc=;{>n(W&(Tn9)(lYB6Ei4@&ej9(3FD)IksQfHgCPpQ-N`xJ)5Z= z{6n#?)cZ+F4Q9LRZThgJXK;>Nl+1JY7wdhzpZL6eH0Rfs{GKtIcEI+Ha@sZ6lqeqUnwIAwiIdx$EnY`0WPOW&o zpfjcPCU44XcAQfxeYX#Szn++s6E?N6(&sIWNojXbD#GvoRQdn*IW0W89{iSSp*pxO05ea!2Yn|njRR0 zbq66W{MpM`nFPH29xa^z4C|!V`w32%fS6~v2fu!L71)l`vO)>SsHd|aiS z)5($apL}3?`HD?xmEqenH2=kMnszX`>`d85naSl{<>NL-o;ax0kK61Ua|2c!jM4nX zKT#iLY6q7k;h48N6Ws9L-r7wr8>DK z`#?&CosRIM)O%Jt$F|09QFK(n;KCQwgg)7hoU(Wi+Vu$E+yhs3nO%~7!@XwhfYkT4 zB$qkAv8Nq0!+`I(dA$)mBl6mbJraMG9tV!GvB!y>Jdu))XT1)7Cw9t@oTx+ZV}U8!vHnN|ER6+%od-6K6Z9 zol6VcRB4_usu%6K;#|kvmbnMADq1SWZ{D}LxisZ*v}B&g9pywjXP22_Nk36+Z~DbF zl;t`~KI@*(`*=*dL&vL~+ct|WSxhcm9BtY90~+en`U6Rz_tTtxB*NZ98y9mYQ<$w; zbo-mOc`weR>>H`eo6FgPYgv*`M!rqa>id?@EVEnJlnS1k+1KD*AH{1+3Lfx4e|Wsi zmepvSlA8Pkso9Zun^c~F>hyu~kJdESxP2x)<%!K@Ns#OC`CN4PEG{c9{PtlaK0R_u zOuh!^CNq83XML5-%@Iy5;yZiO9z$xy$Lar-yp5&);q}VztOnE}9XN^j!uv7eK zsa>C%rcjgbteZT2G`*s!B6V{k`YdO=#*vbC&{yVhemN5MQit6fPm!xsv!6Adin6l| z>t!C~rJdsJLG-fH*y&Ch$~5>qcAayK+3L*^BFZW?#~FEW+m z7cujB%24ZEA#}vUh=JQ46$7M$(~j{Wd&VG+bPHlSIk>eCdc?je*U^$|=YpyqV-qts zDuzsn(wH7nLhB(VG)GFDlT`?2thZ%bwKwV{S>$9zqqF92N;Ycl`YgM=86)p(yMzQY zJUGEN>ZD$yPO|oqE_ufKGqVPxXViNqJ!LapHkTzEwa-~vIcjwAMoR0V%9I_D6p=oY z<+k*zayGRhWpm~PGe0F2U~K82L~(i?oEh~PadOP+pyBEDXn*fF-cqJtQ5$+* z8?xl+iX#PWS&z4D9=~PZIlY?^yveP_ac6y=JW@(H0HdsCp_5GYLWJ- z6Q?yz}YO}pk%o?|Viz7{Ui)zQ1EsDrBT6~Omo$V4@f7H5)$msF@B9sn~2Y$2F z)E(n1(?_~3--0*&jHJwMndbMSo#PLlPTpARC`$*;)>f;Z9P#6|46d4zP?>WHzS2^h znP^klD&0TJe#VgUI@Y^J`VRJm8=uKkzH*P|+f?eA484qf%C~loYq9L~;##kWk7rp% zitmp*oYb29i|m8P&$OTJJay{zGo9y8bhW2Ej+%*)Y_PXeR3mQ!~+LZg4&Q^it!{S zIk{3xbCPpH2oOSu3?L=shJl6J`XzgxcYW(!-@5L#*IN7L__jJ$;xi^9 z9=Al)cstO49kj9i`rCEB-m{K{`0LgsZSIe4;J_r`fjOABnMWtx?nupdrWzwRx0IT! zL~BR4YwJ(X-C-vkedW{5otxuO!F|@|Zx4Ha^K--Tz4o`4aWsVS?y-d%c5KP$*;|?! zc_1=i!h194%{now;+8$PWX#?+djjhIY_i+RawB$~J#+Uk-~OIxHFEgcs_FMi+566% zO+JNOK5z6=XOnx}{t{m!ABbadT>?wTVD++e+|n{jrs=)})WeZvw`^6rIFju0si_1< z(m^+BCGM=1SaHf}|I`Kst&2Mh?aMLR)~nu*&RccDNwsay|Ay7!v>-cd(!lsi|0Jg^ zQP)?<*5o7Sgj^Tjn%owXzCgc$iIrC!Nv`pqiisDcli2D%lH8H}a*Y0P@}#ReV&Xl_jyt95 z>owOpYmZESKCe4_&7iW(wb>45<*a6F#~P!hI!9!y(LedlY~GrJyLu}fU*DP99&-h& z%5-6_+?PeH5!9sBZK{i#`ObvKs^e8rwCnim23Y>mUE_yV?&vwOs@iGA)W>J^x2`JP zWc!@Bw|cdd@p7!(U1;2}V~y(5mLI5CQ?_>B`myWwtlPCAyF32d6Z(k_`9*)cVKXl6 zzxF_&Cll)#IFG&GGFj~k0y|GzTA`1ow4e5r}g;GkdcPbN$o1Pb*lbS`OnpxcOf4=di=zRTUFk(9YahOy*kqdnLxWb;Y43 z&WP4Eov!lLt}`s284%MWVusN3hBc(ZDFwLOj3dHc|0oz~?e1yzWpC}UR#sqI^3w#& zqJ~*N*qDxc#S@cucJsS1zTQWB;-haTBqr`&yCD3neh(*5k9(Zavc1Rbtiy8-H6EPz z?9TO>XxBfx*`Cdv{<(!U=XJc-KCo(!)pYtfYuwuOu6~%?4YKyG3H96@UK72n;#<~U z%o;Lr&(?F+;^93LGuLlUC{0SNn1$KjiU(Il6RhQDHut>yNmEy+Z)Z1GWFGCo_c+cZ zCIk{c{Dh<7bSuH0F9s5a;ma@XY7g(-uU!>;JeN(}H8E|{rb*F;*w*0d#c|b>_)PZJ z^YK@7?OQ!|^`3k4XC{ts>Uzyu{_?(6W%nMsSL|?3DA;acZ>{JG_!w-2*52Hc$HClh+??M5)ce*;;J*&fGp@jveZ_p=+Jd zX}xHaHIMDHZ1trQF7_D6=)v`r{OG;w99 z->aqnwqf(P6RnSiFWk6!*%ek|!p?0?{&y{3^!T=(X#AlhJo$GE-oVli+m*iWZ3rbj zS=zIFcjA+!GdKQh!$&EcjB?q&A+$;&pbYDz5KxPiuh(QR94ZC}`v%ImN zyn(CecMqRnza?e!vf)-@KbFwn_yS3@KiQr5R%xj98SD7krn%2syVe%o`|x-?0b08I z&~L1dR?vFSirq=aN`JoL#Hwq)@=*_-6vmU*|GD8;8$Mbd>L(@nZyR>EJY#*-vm0+3 z`NOa|J-h#Ki*L?4K8xP6A@mAYA9hE7ZmroE8|I^)g?KN|A3pg5u3X%W8j-x=8T`6G zghQ`(Vz!j)tVU<_1g)3xzLh%r8TW<_p|ywfg_$~5 zhx+kc=bjaXhrVF_-8VPkjt?DY=^$%&;)A|5iA`_udS77c)mGD6JG8H_w}0Zi^>l~U zKM=m->S~N;jIzfS!^~&Ja^}I%h6lo-o;Bf~=z^`AFZ;tM9HUhAyoo+7?i>2rBl>V( z?}GiI4I6xOFa~PJ2xP&%k2s??TqTHJvj$g83vgww=LdNEz#l$|tJt-50s6c&mvxc# zk)csZ)5Za>Ke+O_{#MU`P|uE1eD&?}(9L+lG-?09g&WelzKdtDj$nlJB1SVuF?PJr zs7LB?Wm;mt#PX*58m*OS(SEyMK8~{+zO;h-5^lxa52{RA^YLR6`}LGH`Da-1W1{^+ zttW8~O}5qh;*ZC}Or9a#R8$7cA>>@O|s+1oP?W5Oz@ zEU@l)Aa*5DR!fhRCOYL1u0y@AF*Rr%Ycr7Z=@^B%qh{Zk42)QeFMOd59VvBJYmbz= z;~?LD^iGNXIJf8YVFoBA@9RAV?(?pjD;o)k$EdGD91ah?ZQmo7u~^f_8t=Lt>*Ah` z!_}TSP8bQB*{#l`zWr-^YAn~k$-fS3VVkNJFWa4Xi|^q?)O$aBjbbjI3r@tlLwfe& zjQcd6HsrV1n&vL>Ew7r@6H3@onuV*B+cCd<;gih?*IS8Ej@7?qeHWqLx;z8zSYi(0 zDnL4B|4m(3i9?6KJLwi5-ojlX zx9fJT+u6NiZE`Zouhdg@tvmR-Ge5D z`3AThTONII^V$zTd3kFF+Rbs}$j9h#_)Qkm7E1hfSo*ew8~*d^^yG)phi~!iPMj3} z&*AaUCE#fIXn0S;@-we>)5Vc1u6e!H#4lT}8fM*n^X^s8V`TPSv;e%Np`R~2iz_=$ zAH%WA=0soE{3;^XH+gRh>>QrI{@nTWSbUWb*H+hNcE=rwJ37uOYmPQFS2_G!)YNX|c=7Ga zk!OAU^GtK$?2a6O=65?XxzIyY&!_m9UCeM zp^{=kLF3+M!rsO0DLgCrk;i7dF(ZADI!#~7zf5BC?nJ#rn6k?U}bT!&-iI=le&{7V0zabJjD zOL~9DmgT2?y>8#Ptu)Hzi zI{Z1QaIL%>H^V=BNJFLBkHu#k7*;u?ZG_aH?||2456;FHvVoK!_g*`8iS&AHdELXE z_SA-)4>Q(&&zC*czP*>oc77Y~LAgO5A7QIr=!<-y4GW z{-JcAmHs8WdpGW$l2S{@cqh^RUawjY3}fX0Zv)6H$tx--&Mye%6ow+jIiX0T5W9kC zQBhH(sJOT|8p(|mlvRWZii!(!OL8j0c@=q~Xjyqqaei?)8jeK5C3)rH!g2;K3+0vP zM{;vY%Az?Hp~6UEI9ik&$|)-;k4B2Z<&lbl{PK$OqJn~gaCvTiG+GueD+z^*ONw(t z6^NodzoIy&urQJbQ#lny<)Pwmac(#o$}P#yE6FX&&k0pj<%P;&B^)jb7nDW9$W&f=PHuTPl3NlD=NIRPi;M6Z zDk>@r6-AK|q_ey%FDIv;gdQE^#uZc(VLq@uVOjq{1ZxecOXuI(p4wL+cx0#ID_!&F z-Qk$D^t&o{{P0M8oX`4%G9)cDVBnx5zoJ-w0pB}*j1Mbm;j{Bk%fkq^F5a4q2SE7T zgc9X;pJ!6;O7X^e0QoaK?lQyu0Urp0&_*2QljLu)HQcH2cX{0Rc--!@F^a#-Jzs}=s^|FIB$XNQv?<<9W9<#}>``HA&aJo%9X#_+MuGKkoQn=JCJW_UE%PN|f7uHc7epT(9ZxwpZoPwrKjh?MwOZ7jJwC zDmMK??D*Yh*p&Nzhp*hV9=BV6%HORo<#y{+xmS6@Kjm@v8t&Ni1?=<{I{wN%$KyWc z)R*#q(&Ind<9^A*f8OIhYPe(5Gu%$ke#f42@A0_Z@=*S6{VTUyzRJDN2p=2Ym3Dm2 z16r1HuWun`;?(wEG2F4~8DXc#ZSTtM_OHs#=jfCu_Yra8 zd&fNf-29I4w8xRQf0|SN%AMqKU*&OMZMb98dyQ?+tqvH1hThvIgZ1d zE0~^}4F2Y1Wt?>$hf!5*e)4U8o)f>hV z5NAa^{t??=wUb`uZgd@mFrQzgOw^f6Bef<95%-%72f?-#tIp zc-o6p768m@E;DtCnng1vIP$FFj)_xRs$xYH0H<5~`##CO>6PlEpnkH337 z&$j*-#!vBavFUZ&|7`1Z_$Oezm1Nj=&sQpa?(sU?Itl&&@UJxZ&mw*$ihrNs{ul5^ zfzNXU(|-tV3SY_Pvl^^i?Pi_DS##|2d(jAgIr8^)gy(5P@}GnJD4A`Q!~b)JefDQp z8~${+dfa?3qJ%$#_%|8$uLA$`aGUwtYw&3=75)B^6P(EGcaJ3Xk9E)V_}`+>FJv)Yz1qDKcqpC` z%cF-D`Zsy(-LKtmAsu|Tp^S}JfIAd-M;y}UdzxVQc2E58>#}8^z;`EJo=m0^^7rut zM_TB9!V|v2sS9QQ88&1s3Y*?Uj>bIdRlUjmnRKfY<_ zH(*_%<3Dcu54X}i>0jYV@2j5ljr5e~i@H2Mu-4PyTOlzw?9ytCQiZ{kw?rERT==8n^J43B(Ypkcd zTRrg&^VIj}jpL2!`7e+CuY2n2Lr;BGd*W;KxL@>y&-B=T#;7pHAMdgMX-|4vb$PK5 z9*U!Jil@G6J^87JO%dAf?j|{cO zTCZt0`{<#Vzr5|S@7Lv*Wc!b^N<8sR@bEvU`K7k~QmbB-S6Dab z^3Jr~l~%2GC)nj%Wqrw0o^77;sP?#vJ^U|gdo{NGYO6uVKfumUjrE}?{foh)jK($; zZ{d}()iK*W-TFs*LbygY6jy4hZ5Q6>Wv6$R^#g6c809(?m;X8al1@)6c=BFf_C;c!SnS*Vl73m>Ht2(VxjE!PY|>W{3;%K8 ztZT7@*nNw}cKPTsG|Oi!cv7~+VrP<}Cl>tzLr*OFE<;Z&`b~zOSoGTsJ+bKb7nd_|-%Bi<9CBD- z5cWBN8tgO{P6avF*=mbbo~3PaJ|KGbErF@nL5L-68#$WKz9N{R?A#9=sKpLKEc{-B zbC#S>D?YJs216x!V$s{j%k_%SECr?^5QJDbIlz2ZDaCFZb&6xQjY{|hHOFoz+K$;y zrh_AP*!}}ID?7vz7oZiqfqV5$2I(uzG^fB%^u!XD#Uy%S(dQX@V$qK?^u(g)u`G6o zMbGq$o>=sahMrjT?S`IM^miJ1V$rWM^u(gKj~6y5$T`Q0)|r}>0#A1ha8r1J* z9|N4FUruV*FL#g{Y!a4O!p;B=W@87LjV;K6gv`Sh&>xr}7JetNUvq8;4(4J9xeJ>d zQ^dl*pL(9OA;hBZ1(tZ3$DsCj99ZHd7XDsfzjo{+U&s4A`TD#@Ec}z?=yG_89DQCR z7S1aM=Ureaw`-{{zz&juP0~XwVOeCsLhK+c4#_*QaM<>OMc6@j9Elxb;jk{mPA#y% z7(2)uY{DlNKI=mG3xNG4*gj z4zbwT1|0k>c91>TvNXN|SjPFp!ney!FOr;7Zl41Yl8-H`l!#ZPVCNRqPKd=$1+YJi z9fai*&^C#MGYdFah8<)sHaV7wh0_Y`k6;H`f-S(opvJ2Oh z&K$)d7S5yOM6rYH#D+(xZDF}d9*Kp&57^I)LXKdQJQ54%1>j&gc955_i5+6$yaFtC z-Xo`8rHxoP9|Mb>BzTJ*V&M!17CWirXgkEh83QbKc-|B{#KI{C7CSsd#SXD>c-j*? ztXi={ESyGQvC~P8P7kqg?jlE*&nj|sTOt7D<#0|PqWL@*_$Mp= zBlr>f#A1I3a8Pre0?yK9^&)iQ{;4*!%U19`hMr~XXD0_)i%rUhSZuN{3TiuBfc?|3gFJ*y z_{7406j=C=0sHH)gY3d4d}8761r|Qb+}P>NUc@GRV&T6G zEc`3T(d$LT!pWpwAMeDX&jSw5zz#ANn;dt>x|9Woest0!#luEPVS|m<qYDk3&(EfnzNrA-M0`6 z=XqdBPYOADUPCM#_A~xD*g^8K3BCzfjtgSpR~ejIa`e1_SU9tQgW4vu>ema%t>o*u zC$aEvBS-V^AxGOJ7S1YQv3Vak+77XB9s(9ScDZRgX1VP&?Cde@5R09Ih8?zBiHle` zCk)PMgF`HwH-RNR?;9Lq;aKPj{d1v!BmigWa9{c*2MDViTL}uY%gn4q*SS*g@?2)qJyl_rXv2`+@yzj1Z2g#6Gdue*rkC zIqw4d=VM1fQiM+|{A6Is3+qne;@ByR1qShx^96-D77{zeVyBFJov$QN16(kG5DRB8 zu)m#JwLa!wq;Lv;f*M~79GIuV5=+<&a&*`{;H(bpAaU4aO@LVVe(LpHiCFZs8N3ZU z$Y^Y`=0Gf*Ah2-Q#|GL|dWeNHot!UX2VuXFrEM}+>41@C&Ke^J`+!j{^?ggB`?9PnQkV`Kyog)WO@oTybXON6rz%Vskz99jbhY zMZX0&_+{)M4`P${Ni3YlsMqHmV$nYd99)4NUuw?JbOTd*yVYz!u#+e?Uq>V90K;QR-7aF$-d4;lBbLT!S6t4Q#ST zN-UgrfrIR@As=E3EKzNSSU5a?3CBKvooB5TFDkL+YVf7~5R07*Lr*MvdoHQln>m*p zYw(GM&!r`?Pb~UsLr*OF8HS!%^gM-#9b(b53llxD=x;Oh#G>yq^u(e+Nc~dmAjG0S z0UYE(33-{EPQ@V>&gm|wTUN^*4DAQnyyIjfZYS>$N@#KLJbI19+pb4g<1 zEHOA;U4zX}{8Jr)Hqw_^9oP!4E7&&(+JH)~{ zX>eX4N5@4hoHq>4d*tZ2h=ud9!Qnl15*M*>h5}38)5y_vO)Q*DgEQ9P5DTZw;7lUt zPL(fW;nW$Nx#Z|H6AOp;qeyy|kfZCJSU7hYoNjWo9b)0EH#pnK(dA4moQDj~ljP{U z6AR}VgR`F;eQqTd&SBu-S5#X)1}uH-N%HSgdSc<929`X&K@K|-2(fV91VxKqfRvh!ZISYQmnF}1y9AdH4 z3M`yuK>hDo$BNqKp>c6b?#G*e5oV5iz$Y^ZA zZ8o%@UzRa2#~8vd1r97fPx4`<30~~x9J4him2}>-T2=zTGEV1Y(0S6z!4l*5EV3pz!3ui9%_bNTH=-JM*zKtDZ zH8yE8#KK{f$Q+GW^xJ{`k75U5o%$cMp;}v8t>QA<_Fi}gzoj_O;wP|1afrp{^9JX* z!66pTiw5U3Ict?2V&R+xmbhLA_J0>U{(|afVj*@L_&bHiQ2!l;vw^diIml>i{wHjx z){!(GNBvHvuOt3@g?YRLnQ2HTHveuL+H0P{?92dlr--FcaHcTvfmRpui^8jG~_pyTv#uj|WhU)&4b*c=nfJ(xq0S7psgAj|p z64=kmgv`JuxD{C1HnH$KsMmcFvFN*iB`k-7g4xCbi&ebD!hZxf_(SXeX9=bP9;h=s#86Qp6tyV&HIA{I^@k|=s&(a)lOqe?%q=y^)^@1sS0 zGn)7x6n=$xzrybkA5i#X;H)1j%zHcq^ZxbVvr6v=mi9m_adCVr{IQ_=Sul_)Y=T*L zQqIH@wvn9Yu!AtU{zEpjScd+eD%^^+1@6NRLM&ma3Vc=RiA8@uu>Y_M`v^I@ZzmSc zQR;QyMJ#%|-9E3v+U@qA6lPlud<8^^*={qb-=OrwVkd$6f5r|%Ec(&F{(qrXjU@!z z{VFpJslg^~n^?lyWvJV>S%z%?L2YvZu-IHe{m-z2+>T9b5{u0)>a|T`(XR#$@_>eH z#OD838`}36i2X;Xe?jTlHD~EGJWl=3m41(*XA>9x5n$=(i6!0_sn_?w5R2YI5eH8| z0T}=+aa{`>_=VCF3qON=ot_9e`aDi7oJr)IRAJl6(eV-sXFv72e;^ip5`y`eK*&&R zg6(#q>)mW8$>h95HqHgu1g8K?J0TYPY$w4}*g-O|1^?ZK_835LF;s!mN>40d%YcJt zlzt9=0$)SIA;iM5+l;o^0ljdDg~N6dd>K2)Dr`~?#KK|Q2>u#7$TnXUo-$2gH4V#V&Ugdua7li(U$@Te~TTY5?kN_ zl{RAG)ByW6rw&;7t%knSz^ps}>)1i=!j`4O-UICa9krIV9-H7Dz*4rv5--aipF*+a z9qgqXh=r4a?B^xT$uQyn4`pW%eu5hFc=5BM zAlG8^zimUce!dL`AgmX$nGft|!Xaa^$#F+4oGR*d8zUC|Y~bL#*g<$4`Tt-;tKGmX zXKDY$61E#S_#SqU)!4Fh*!zL~Y*3H~u?7FrhE^|rr2PSkUiw~Q zvBT+f@Q;em=I;Mc;m4@|SmB+-A1S<#9BuOm@h3`u%+Q|#mU98I#Pu3EI<9xf`6hM{ zV&Npmx%H9?KPfk2;fw(e`c&9#a=KkCoSUfE^Cn`^M;Mj`2C2jrSnXor@E8})4080G zg;+Rq4Nj}UAr?-D!MWYw5DTZv;H)A?&ufTvF|eO{~*zm!amHW%vy3=yMRU z*g49ugOwe-Y=4`OaJb^L zE`&oY9QLKcVO3{IoLAr{U8gTuNIJH*0aT}WK33=XkyHX5A! z4GytzdJPWGgAy09aCRA-9~m5C;T$wLtW&W=ESwVt=d{5g7S35<$=5puhgditkaLBq zFOHMtxhi7ej0VoSQgPURWc`y^IBXko?jsg`HgL)a6_!}^dB7vJo>=r_fdk)Cd}7g; z0S7rifK+0WwMt^))KagX3nLc&ZPZt)u*9Oj2RL}G(yu1ITH&?8S)WpPBe2}JLo8ug z?5u}w@ z;E`HSEczFKB@M))e+gL9@G?0%4aCBEot$(P*IUFo4etP_uz^5`h5sJ#NUbLp{l~zP z24c~(yO%VuOO-Sb3x{Ka;C0wR*c2oUOiD_I(i01x)i6@)iA6sKSkgc&dX6n64Ta?B zav&DYIC4IX9V9}m%Yjt6*PU4SHNbvdzjfp@LdbOdq+IV};m?942M4&Y#>(%a*xFSuAZcNv^}h;LAwF8rhfT`c@=s77i%vFKL=OWKG3D$YyzNy&4u@J~ZEQtOFD z{|c~_C$Z??0G4tf7X4emQVztTx8h)D6BHC+(Q~{S3@QCka`c#%SU6ml3+5{hpX-+L zAr?+5u#^w6=tl!f`4Edf8(7LG2Uzk#ES!8`$qTXQBfyduV$oLvOFi1xtaV<_xn`~F zWghrh1u9>yz$rYqA;e;{4S1y16N|nBSn@?I`rCn1ij*B<(cc9;QtOFD-vuo7ODy`e z)X!6Ph(&)t^(&N~SoFQX!D6M~4(z{1;m3fbzKDhYIIz?gvFM)!mV6P5{u$sbZF4WM z)EBXE_5n+M5sUs9aNrv%J;b6v3GCPX(o4X>62&_A#~%hxfE^NqSoqfhOFQRvd`Sg_*Fx|AtkUm{vlceCGx-1^&c3ob(MP(1tn-sdyf)Y{VYh5C*q^KZio$S*=#)_4JqDzuIZaylB8EN!X3 zFh|+BKt#$238Qb1shwMwEc)X4a?o;n$D$>j^-CJg%b36LVhmkW%Np(CGGnsq*)GVY zMeS?>mfa3airFNj8lC#Cw}bTEehf0-<9;FP(w4S)^_?wC5q;mbR4JU#SCzo|e02#n zE$MU$o!Qo}tZ%9JdNj8*FKbfj^P~pBTb9-@YG~=G*YCDJU)+kRn=_jIMd*rn5t0$R zes}(*#(ojHid{%j?+r`abL($y>8zjM?iL_Bo2G>wF*=*54gxQADVmy>! z=`CDzTT6Xg%REHXvT$ijYZY-|eradJ5<|l*I!z2me#640sHXW#n{LZ) z=4D zZXTQ$qdEQdg~+P?T!^8|x~-)>CebKWtDe)xgY043)Zu=5uvCkYmC&qu|@; zFKsmwh65O_x23+d0eZ<9E!v}yrD*)^x0-yRu-MSX>pKv$O*v;s!uEgzp`i`o+uCkh z$TTiNgL7hW%A~Wwqf{Le)#!2BJLfq;a2&Dp=HJ;;Ki}0N7Dl!dYKO@z#3(x28an4K zTCz|KoG()>khYf2mh<`RKG2P*xqev(K7e9G%}#CJqWXDD7A>sryrUz=6w4X4vSj{3 zBLLEhF4eBsW$jBF=EZv1hk#w0=u_*LvDWd zh!}2d!r`z84fD48Ma|9DXqVX3(AKu7DJBl1*TA5$ZGMx5jAVm@*5BFCh~GOF+P_N{ z@k2M+*^}s#U1DiaET9m8KDh;=aX`Lkazla$$j-|XO|F9+kc*V6SV7IrhEqkJn*)@S zirK}b$?Va^4`Jh+)2`Y{>r_KUSw3Ik@`V(&k|Gwp4uR_{5Wy+p&_I|yK=uM_TF@D~w# zzXvew9fQ3f0@5C$a?-b{f2_R>B%W(FB4Td?c&5D%r{G>?Z4X|Ky+P11xRmo1Nc;*h zhF`JQ4GDh)&;SAk&ZaQRhit z1ro~jU=gu5#go1lrm6e2n7+%gi9MDT{+;~Zgu>-oxro^NoyXoyH@o#Q1Z1&yyT=~e z&zp=ui`ZN0vDZ2s_XnWvn7#luvFC@5!I4c{UPfgd*O)(IZynfB>ewr%>*^W+Ni@{sq9acXpO#aV?YfuEZwxa-cKq@pwKh#_%ilxD;&Kdvdm0 zzatEL#h&zSM5XIxL))s@3whG_?&lG&PTxqw-ce8bo<(C~yAlz5|L95I3-zwOYYcnW zqWv#-c+rTr^m)hv&_d2j8egEXK z*LI$Ge}gb)ydB_eb7FPN`DJapRQnYp-ur-AE@QAsyj+Vm?ImGhtX+rU54>%;48Y9C zVZ&Y~7-H`$Xy>NAPT1R{ZSY6ztp(4tH>1h2QW22p3t|&{yFC4PCOQ?qzg9%-J>luc zZ*PVj^f9!TjZN$g^Q12ooxqD?48LOUa!>lUf5AO2a}0Zpo_^>9*wahPwpFpm_hOs* zJ=^B?yLpDa4W9Nl7oAGPwxo7qZ?&i0*PzmF0)_eId06rrMH!g&u^sl(jKy>(`QBK7VAU??c$*wGZyYUWv!vwODX2g};c{%lFtj344_w(OxMwu{YCGzjI)Z;{g$|SLdnU z)K0e_Dg#;UZS>e%0DEi)B4Tfi$6hh)NqdPH_EsZ+S$=t`>Rwr|y_MiG4W;67n|gMd z`K`bv>ANl|*4~U%^~{X~lk}y6XWGj#?6Dlh-XxE`6|k4kM}Eh9?9GKeX)jfVy?^tZ zXI71}tOb48djUK%eg50samggZ-W{Iwy_Kf!JqN`W$#178eQkGG7P=U_y;S2@@_P#c znDtSbj`Nln0Z-s`05g3jVJ`u?dEnF-_CE6T&s8|7?Sa3D*n8j8Kfm-PcbteJt&=`< zvoY!8jn$*Y7=Fbb(_yAB`EIxWW?V()Q`Pmvs)t(1^wQib<^GI*0dSp-%WnWe}t)5`Lr2yYMaA$hPp zkkGCaVB!7?u?$JJzqmge$$1oVbmnTKh1FWT4^5tR_ANsmCkq0E0Z7X zNn0gWd}k_?CnYCVIPL?PYx)Z1>vb(`9-insupGHOklF2OkPb*|)>e4YM_1Ll->g5AIH?t-QyJ4 z(7xU~7AKuZdm-a^)v@ZMwMQ1$Eq``Tcix(vYckgs8tuh*AgyOtOz`AbG?Iqq2Tof(7jbX%qG%%J2Pv{R?V z&m<>PW4isx%cGCF`8(rJ&ggmG36a^|SFFC?33c9*nEw2%!{gSBU02whw|3{69c$e* z`t~zbCmfr;GdVam%v3jFHOZUu9BY=r+0osEZ^|s+@9X7n6$2~Ga1vS3i1*N{- zUwRrbH+2oPDw9w2)H?C{4rH!#k2p8n;$?w^#M4dII&0PzU$5C~yuB>Y4IlI!Jnr3E zp!NP1bJi1e+l0&RiB>smhOX{$LklYrrQ&MYAB75Xe4%B_e7=b9fU@l##S)6WT5PMV zOg`FE<>t}bBb{lDsY@O+?6YEzxJtAsCwB)H+vU+$Nu~9?Q`1;?ysm8Ku9<1GHqDB= z<(-M6P+zfWkT~3)f*Pj7Z9~F2e>wsM!>zZM-94N&Fn|5|TkkHk-b|zQ4sc4|x4#Li zB5bE_yuLF7dLA*_BHe3y%p+`oc~qZaOJ`ksTl;{X7cbokN^~!ui@&^b&AP2$ z`{uX4^Th6_|KY%MKmFH#|MjcC{g1c*%Ze`TSkkg|>HK-AO>GVBx2EC-qNVc}wWsFg zWaFYl>X_Ef&W@#HZ@lr=`JJuH8hKa1jV%)7Mqd2O>R7U9K}%C-HW;b!%2FZg^K$YE za*FdxuD8NmR(-{5_rIF%u}&To{{xRd?~fF|<7F!n?f5Y~*P`59%TS`+NlqZ;ep9@0^~CYAb^UC6 zRgS-MulBexZPlXuF>H---ziQ@`R_2?vGMh{<9pEYS8hyWwJ0~|VoH?TEnnsCa*Qgs zTYt*^xZ&?W+u%Suem6hLeNdu9ufh5q>;zKoA9?(bc-+|@KCdk)QQ>D8?!R;DmW<1+ zSodI$+i!nQflS`(%J0q9(4mEMfS)+F)ttc1i*o@G zOFr+-6`{M%<8BsD{L-J-enja0dykuaCuIQiL(yJ;uAKIs{BL;dkMg)nG=C?4`F%UC z5s5Ioex%LvL(lK$4cDHXc6#Y{DTH&JtkZ@R$nZVFw`=&I(}RtOXW3#KPHRa2_B>+aVUtBL?R&a82$IR)53h=p?!IG9AOWu3wnV8;p}7S35<(G!dQEnxYc-Mi!z zVFw`=4%gx2J63E%fnu9twX(zK)kz`1g^IH5dvXCy;Lj+0Scy zM(MrJYe*V)(xy%WvDn;0o4imA*+|2Y4jkRCh=r33jNz&+_Hz@ueR`jp5YA}Y`K;m-i=Cihr;wNn zP>^xt>+}-~zk(cHN9_9q&j6NhJn_AJfpN+Xv4mYfj!v^5-p=>GfF&;WKf=!-XDD_M zniCGOa4LZPL$HHXV-pUsaHazbXO6)k77o{>Bt329lwt=V77ov&{s6W5-DTS2F1UrW z3RwCUV$pA*Ue_bB=s7kB4#N(z9h-27h4VPDaGoM3j2(nnI6P+y=OD23SH!|OVsK87 z!-9km3+EKD*m(^&P=+0ZSUB$hOMgWy`VS2~vFO=HW$8LfHgGEWnnW!8F~IVjuN-o8 zxe*J8-CXcW>>#Dsq-_%mrxI8=RlxqMu!GcL6Pv`spA9VhW^(lLLM)tiVE+j0AWN{x zx5GMtv$WoBC%lmW(uFM$AyQcEtcP35kXZDrYq66`j`koHPNtzJ7Coyoh;>X#DK`0z z81pXefmrypz`<*=gUrAt=^++QqoF4jeFv~V6*~y?o0UqWkBeLv3x6$C{!vQ52|v>B z5etXs>!9X5NSuZpc`UqXaM%H`V!r{4C?3^V>ALGQrdCTCuPmazbv2X^*q0Ns{ zWtEDbKjk=OGm>w>F{}Oz>>%T?Nxq0Bt_t8Fu6a@HbKH0r3uii1!kGgs`63q1JcH9l zj?NdcaM+Ip*#SfBe(ZXM@5GO!vm02_Ni1R414|mVkfYN{EFAl|)_K`ZjxK*<;XDp3 zc6O1Y(@89xz2xY$Jqw(bi5=v5Y=Vyf`*H1zasr!Qb6zy?E5Op;h{gUJz>$LK?H(a0W4{_*1(y-lI9#>IbMjx4j(%dJ+bI{pPrNtvFMio zi%mZ5b-|~qoX14?B+_|qoi-jyk~^w-JG%E79O`)AzWK0?ecQTz0O!KiFYQ^Ji#|ca z2<=B?&J&xH-}62ebDn_iBSU;bM($$Ho>Y%#72B7_KD`*j&9-ljcOSR0i==h_Jly(j zWuNC!404+1-xmA0gD!ITxwnZ!=Y7(GVf%WdLLQ&!`{4zK;_c-O*>YP;I~;tX<<{6c z-D7XKM-Y9Re@ucrH>;aXMq=Pi?4}+;cvCxXxNm6dtZ!{;>%fXE?pZfUZA*FYy5}DD zKjo%z9EW@cST9Z3$K{79mh~!hA~JF4ejAVv}11u!ZNsodkKjzgj+;R{}2jd&MPQGll#6eg0CWyFyxuv zq^Dc_Mgbsu92(m~USIb`1duTEz6iEI3iCk`dndt@JW&4_>~*04=+88>Ed1D(wl?Hu zH)StsTyUd(yF-q;>A}ECBlksw3Ui7T<>L26+>e4~eEHaTSF9hdsf$LHb!z&UhNJbWD*UIWr#?J2J^Oo8GS|9Sm6u1> zRQ+sX5t?gY&>(BWr0?Tc+q~g2s|XD*(7(U+ef(}-)87iL8-^>S190v0Mdyl~YsGh_ z>ApJO*%6x){YinOu5p3Oy2i=XuH@u5Mo=ei-wUE=uRky~K6Clhm6_qG@i+LUuDszuO?+^9&B|c7 zCO*qovoh_j>j@Z&{ z&1;z7hM$JUCcBaR$vXsW#(xX`=i&cW{I}wNKK>Wr{|oqU!~a73x8r{i{yXr$_)m_= z2!P|%zQ^_~z<0ksu5f(P@&$XxUAOr5nrGV{Ja+P%-S>}+T>Y8j?R$4tJ^Y_juYdK` zijKGQcYN)p7Y@F-{k>~{cf&8A_;hYdzHiZA!d1kZq(ecT`?`k6d0E6Mn|P=HQL04e zUd5ZB@S)Xxths+@yOXVNYB$dfKJ@Hg)^40W;O=M9ew)_u%tUvW$35Cfqw?SH@qg6g zKIL(DdBSrJtt8R91AuAaIZV>C+VE$3xR$I$#m_Oe>E;+++|z*BWs5!i+7RvE&x&;? zd))m!?g1Y6K#%(}=U(}_h=JF{^i;%-kNy8N8>t=L0Vl2M{P2RuU%xWS){;M5`)@-y zUW4MCMTGw2#erYCH+tNhlZw!Pl{oNAH%|Lj;98|54k>6~YYOP~26~G=16Zy>aZD0O z#STI&9G=gG!*&@Mg&l-gIF-PGG-}m7q@uU^Iz1-83cM7(K20oq=5M6d6N|o%e2i5n z#G>c=*+{K7*V1M~pTb51Ar}5z;E`HSEc#|(xmH6g`c`1MRzocM4q$ZLw%m?=V6=;c zvx0hE=ES033moJi3bG!XTnBgvIB*@cY8_7aJK>gkAr}1}V6n3oSgv*K1J2UdSY7~@ zu*4GfC145rGC8_ViG}mJ!Fi7yHWmo6a6SeO%JmbpWj`Asg!A$gjFANkKN4BR)r`P&4>H~_C0qh^9F#C~|D_kr#xt=#t>xo652P|nI z7CrlPY1_o2XJ6*m2lOi7EFJG!^2exniG{z#;3OqpaHW95OgtX%yeP%{nhe`t&CS&t zD`H+yp+c)yRGj-73j3*H{T#6S<_Wy|2XB{FqmTN=W%KOUHON!MOqlJlblJl5 zPN(hQ@~(iGXZQPz!26WG9o+L!yfVq>&oOVMqpt_7?dPHKsPwt-m0<`sck(E7PO7S< zOWT*D{y3Hq8I0rqUg$&wCO|=~yQTBaW#@wA<;@ji_>I%}7LaJORJ)sD_Bc1#cb zI3DoM?Y2P2^NfhtW4C46dl&Yuf+2=y*DLmx>h$Gl1DP-|N@M=eG&lAK{1y8X0XSX} zp&w-{Hj~HqbTQo`jF-Yb&g3N^Z9I2~h`k^b#5vld6uf33X+QcO)L6W>v(O9?d$&Rd zFLv#=kawdv@GHEtz~-EC5DJueXZcZtHxWR}g!&g??>;E#&r3(lFS|>$&Afs_cUF0^ zIc0uP@g>hG`P?Ss%g4q!<#4!$EME2RkNoP*vm%&!hjA2TYD zo{<|!9~};)r%er{r#1xAvlkD6{}A{ONgwm@ko1i24cWOabItMt-$zr~ync}7>lGA8 zv`TxTJrSAVHKFxpZZKxWk-*kltj&qIki6{%Yjctnw`Ou^?YB#JuRT;Mchd(3aZcLb zzEio;xo37j&nahyig~I3DWA+rH}~%vx4`im(8F2j>yF!Z=A#k3cN6o{;iIkZ<6zp{ zlW1kj{4{ZUoXjdrrN~49;Z(n9Bw*mknSp8^Bz4DCV+5F_#^Rx$IEPWrtucI|Ost zA(+b!!Ccm#i(2l%OqMx!XR^F!yT_^f^!|6J z)PdK(*06TsTc0bNF`{zUo7KO0f(Nd(_x3CP;VZs>c|9C1J@xsWY3WbKH+*Z`m3Kb) zl>d{4cdX%0jNY)I;doN&qI^vcZUPe$GP-W$JvVZ<+!4*c^^+h>1$ z*ne$W{_sy1>hizUJGXLVv55{J@B}=$;FtM7it434g;Jw297q?Hzc; zVHO(e-_N#J;e_vJ=~w>Rarm%O%J?{sQPR(f*9PW7;ltUF{u>>m{j7d)Q#h35J;C(f zWNWxn@jd2oHyYu|=eS*o;vW;I4u6%w|DE>ZdDw?D*sa=6tv3v|~XHmGrZ} zgU7UTN+s!i#qcNpO^^F_kGs`y^Bzgw&SBbn#PI(ka2ou1`v>E5yx`_a_pTVlK#zNn z$9xL&ZzPKVm@-2SM?{UsxP^#6><{gB69s>5^4#`S`y zJ^tp}J?%Z9`TU`q^E?r{9~K9G>Hez6-U}Xo8BeMB``cmU9#LEpu(CLafv`>jnKrbs z%z3h@zd`AVMPCRk_xOz?hl4o?v2b`?31<>;APYMPv2Zx&5702god2WQSpha82(j?T z0?R#(98;z+V-RBDlmd^`dScN>faShBrY(gB4TM-YRlp;)o>=tLfde_%L5M{^2iULY z>hpl542gxa7C2=vb`WCGZv-Bx^~9pz1}yXNUSPRqO)Q+psn_*FEc&N_<=(tKzwE0hT#A$IdcWe-k)G&!34U>^s0CwVqh?acHYDpC=YQ z@AHxQJhA8p154V7Mb9+_NgLNLrCkvVhijz5vF{Vm9_D=l#pGOx1VXrmDfhgM15VNR zrxAr^ zQtOFD-vKOXAQt_d)MqO@#G>z}zCh`TMZX?6ORstHye9YmYywV6ReWOMbACEf>xo7G z0I;NoSoEiWys9kqaS?#d30x@$Y`iccPr>*~*Q3x%4+ zI&X+P->Q!jcOQ#BjNh~D6LSNEM4?xKat~ZX)m>&A^ z)Wmb3X>U8+1F(sRJs#esy{oX^dKGlEXRZ@*-NUrE6Yh7Y&?5F2hiNYd_C7?yXpg6A zNgvONroCPm=qr6QJ@)uqfuxU1!(xxuXlPH;u>)W(+#-_H|ANBg4M5uF3Q7CX$@?$J z)2Bmg0eGLGhZg#AtH+MN67RRcDOdwb!5Y|zc+?Qqz(!yVYy{T8t}3~NHLzd( zeZj+<8}8hDB)oLO&eU-3(APewUi0019vSe^o3Bm0`ClIxwdw1bpPq8yvBJGKrGM+= z-~Bi`Ig;Ld)7in95B%elZ%^9(w;Q*9W7&(p4!pSj-9L^Q_TjM4edUXH9Qxhge)-`g zU*Gw}p4InVRddalhbCBmd?hsU>!%JrT|V}w|9btKdw!KsH)q?cx7<7NxBY)}Rpn;~ z{bqi1b#~cLe>D85rj4Jv|9hWFjf|O|_gMVje|PEcPF?;^D8~+n)VD^Fh-`Md^7v9~Xf95OK`~|iWx4F=dcf07Hh03+C z-B#kZ7y9w;7yYwXxfU<6m5Y}wr5}De_0O{ZMiT$bAnb$LdGo%Sf3lW+F8ZxG>z?lY z?ED7~)%5#xFz@dMpZZx-%DTC;%0Ic~_g$;{-SF^lj-=1n`^Llhhp+pNH|qYOL7_hm z8GrV(BX0cZihmwCe%g?cSAOO*iN|m3?OOHgC;vF~!=L^%<>q^`elYJRzy08=opVdP z;lDZfs{V_cJO3%UePwm-fU2v1KkT6gt#>MG?^ts5xsFMhxAc2v_e;fZ9Q@tRul?%e zmp{9v#~c3tm$k;xPR7*Q;sTGGV;d!Z{#v7~CGLkouHA91ty){>h)UKXmA_hxv@QIfUTb91-8Dsbt&x$r z`tz?fl6SE?%r3On$nY0gYqX;{?^+{#&wC465pJ*Jr#Y~)c)mJuKE(0o-IeBDYy8RJ zKX0v(>vkMwm}`<8Z;0?*NBKQS3HU9g1M&tI+&EU`S{~;m^c#fDyO#G1beFQ0w*@3w z%e&B8ATQcBfpKgA88a}*;2e~i1(n- zE@chz2jFqMEF$pNP!J@W}P9HQpo* zM{~uVcde1UOId5&k8);vV!NVo4FnJi>w&^wZqf`@-Oxvg93N`V=dPub*H`;agI;XY!u{MCB7RtQX8O1s zV+(nGwQpWCFxS$V4~m{XIC0fNCuybsVQi(?NawN4jd6Ci@;htzfSPXP7j56g!nk<* z<~3x-_t*CAeQf-k_H9(df4`AWL0Nm-cs+C?x~bT8Lj0HB#{UL+xTH2df1%sJ@i48l zU_Mu?u-eNrw}0)!|F87now^$S+YNjY>f77CXG`P8@BeS@yY3R(w|*I}GfcTy`_9eR zFWpbQcpu)00yq2c!EhBNCdK1<=b9B=-^aA4R{%#<2mvTO5J$ZSo zR}ndvZh^w&jf0zQNJMyFfr9m1sy*I7ph{rgj!Hc@HXq(+W7?~MyDxj}?@W97h)C?Q zS&6;hYI}M3r8Ht2ZX>m0T-^AWD1URXQND<+*+yz7yf4E^Eb>bM`d9o?;6{CPh&OqC zjnSVb&-j)K>y5&4p@_Ycz}m~!4}!;O?az8)e*M^PEDV)!tRix;{=LK*z+Ak4KbWr4 zBV%;l5g#6sbSUj$#e*GA7TFYun-KP`=t5@xDt|43ODuuOWzh(R4E0uJczU!xJZ-X7GbvnGF{O5L z{p9H6DYY|Q_pE5`lnJvynp9`u)hD?Ect@z#aW$4O9GzBQJ7scxUASygbedH@p{6og zTR(Y9BwAlyRvzoFD2sL1)yBA|c>HJ7IreJ8k;sJV@%1$m%cm7dAW=@KMoOzA^-T3S zA#A1XJt0*tZ8()cf`*$jj~9 z1CdWWU*zZUC@4JFqpSwibZ!h~HGQV2tOhlCF1!5Z+Ue1}f`Z%guP|)J>R-LW@ib*GHmt(b~xqsGm@7O^nX0kIpEs3|Ehj*4Ip%=!A{&h*Vy{6J{^u zU5hx+YnYx=r{~0YUQZR{MZ8sR`!vq*^%wIu&DTt*Fhid(_n`>&O)Yd^& zJ}tL?IzDTzQC_Z915SDE%$m9>_2rW$Ah4-nVrr|ylj>`$$6M3zIkEb>=rr^U(f4)lppblFTKst|$etHYC{ z|GT=gkFnw^!}y$1T&blcfe31C7AUpI*PZ*h7pd&-y}(}fE=%{LP^GX)`6wV_3l@b^ z6e?S#l~UT0xF)qxJ1enf%9|8V=pp15pEUF5|NWt9{f}!$hiak#)sw239lf`~5$@b0UC401v!l?14uD z04((is+x7;xwEsqrb3#A4yo4?>h8KdAv8^pHjj$53p6k|eG{pm#mTnO9Q8qt?yf)x)UdLyrw5M#O`16ekl9?((^lh_rT$ek!NtV ziNka_$4_3_f_F$nJy#0z`qFzXL!)sRpXZ%Cr(*e!;T&chnCFhvIGu?~U@dk zJBN5)f@a?zjJFT^OrT#uJXd3yn!gqLL(ua4VMFu-a5m64f!W814xfPdcu!LGPQ-J6 zpf4aEzGJ7u?}p|#a#X*Dc#Z|S9r{nuqmy`#ARa!0sCo+Y^+>Au?()shJkRF*T@T$1 zJtom35Ffu?q4j+a;#&zlDjEJ4#IqS%iwAZ1JF7@yyp8YXkA|XHuiJSI)4`t&vEFFB-39FeJ05NCjE#( z<2wUJpDY$%4Lk`+uH!UBhcWJqKu?11fYx{h5YHOuiOKYaL+^#=H5$(UR>b#HXt@s7 z5S>Fj??P*P>VqDNHm2+UDU5d=w9d~Tkas-v2b1ze}i~_8|VV`AE9;o zwIA{P4Vw3gS>9;q^U(P7x*zep8|1%;cpNh8^!ZJg>!5XduOpt(&{|#{`bG$y-Z7Lr z5t`S*IlW&Xo)}uE$7Ndz^Z??y6&im&|8VFkgpSW=TOI5WHr|c=sc|ok9N5&<{iF^!pLtlhAPc{1*}5K#-sB z^*tTv*Ad@=VEj7tv(P%dA0xgO0zDP_C1@>w8sd8yTI=^w40tWjS3&<3TI=gx#CJB( zrxDLTp>_H7LjNZi|L2Hj7)I9eOVFdBb@?AaJY%6XUhZ3_Kx_T8f5jX$iuCod1@TOW z*6E!^Je5E%hOP(tWyI4P=w|4}&^kSCyH`VNJmaA63-n`%X9u({AMOhu2{hO3eSuzy z_?`~*NyKvyTIat8{T#HeuZI!Ou|Q9P{(Yba5YOMC@yL;%|KZU5uC|W974e`uW7C%& zpEL}5Hst+-^fmrlYbe@3x5E2BHHyS|%+aa>|EXDT+V3W{-uofzJsWPT^xh9y{oJOH zd=ft}viiq?walA140VWVipZMh7BKtZq@S$*sbKAcldS$MSo`24tG@|6GN~l8`kTR% zQLnVwNE%NYcnTX|VvY?H#yA`s1&pIPE?}5%SNwsoP8=H+%x}NB5Mg7G9Cr|~8;~3` z!Wxkr7c7kP?zj_!aem!MkN$q3V_~oilH-m9mPc~jiNH8tjyqV`3?#=1!kUpB4@6*9 zB*%pS<2*X zjrZvL0d|}@*m@*4!DF<6e6#Q-^2da?kXZq+ZAfk+3F{=1`?$xbpFBx;7kRSqZt@i2 zy<|2J*gho39XMlfoy-Glfr)n}y#Xw+NpmCoAt;6+fRBbM3;s-{k7TBgh@Xqsa4w z$B;XP*}sXKFWgAJO_=8qu1ok9a<}kga*r_IMR2{sc`{F&V0}sqkIo&j_y~FB4u%zDsyLdATr; zv)u~eP2`orTga<~w~_A_-a%e1+)rL3yokw^TOXD z-y?j0e6R39@&@5U)QoQMkS-7QNbv0lrxI6hAG9dIRna=GleFL!Kh?ZG%6V7jpCePN^#blDaEll z1In1wpv+e?_%WNQO-3c7qEW#pZxrVYQ;M_ZOev1d8BoTY24(g+BjFg8jEY9Sj~bsZ zZ@xHZm{OcIXG(Ew&VVxJG$>owH%&$*qoPs4C~p+!3{#4;=1eKZ4Iq7{CZ&v_K^a{* zC$(c#GAbGsjPgct&M>7oYtEG7*qi}n%xO^0SvW=|qoPs4C~p+!3{#4;=1eJ$%^6U} zoCf8rg=17QDjF4x@lFv=U@mW7U-Qk*qsN^xw?km$@bCOek@{qOt8 zG9<{h9_ItR9;JreqqnQ^OV&YoaoaC;XWn?|FgRaw80Lp-J|3R1%x3S!dr~;h;j!qo zNQ{TW$UFsLc{(0Fhm7(L=+Q(qN1WQ=136CIY%6ZK~Rze^Sa;wDrQH}RoATRnsp4j z?&=BxDk{1L4C|V6&N-Z`x~FHldj|L2^FH7C&i9=&zo*x!`>v|4_^+#~dw8n1Rwbw- z+d4Gx5Pup9g4}oEe?2_>nlx(Il#MgOfe_gcLc*{7XRenag#5$BG~Y@7+t;9M!u%($ zN$!NOk>Rqgy5K)|wYDPGC0!G~5bJ+)t&1hr|EcR$OJe;mFS%C;`Bzt~ zFe3k-y}~_-{NG&rtcd)7rJgxLSDy4E@n`+vHQEFt!muD3#PvR)OlHL$U={31GaV+W5CJ@Jxu4R72@&8``ziNZh z6^E1m($!)oDg95^z+6(Azd}Ed(*Gx3>wHM*f4YucBBd=|j{-^Q5-uml1Y&l1?j%m% zy1IB1r+;&4-Vi5CS9~#X`loAcTjKQp^5tB=h?rg7s}g5=4NWjzabd)nzh*2T&ipku zHYQ9Ho)n!Js?sEeM#V-Y5uqU>L8B2F#wS^bMU7@L6E#VrH4{QLv1(BU26MPZY^GV1 zkV4=RrizM9(j>&HqS=DuE(sIjO=TB3kxJyGHDxWK8g-bcaGX^gCN3LiMKLVJjRN7PsS=`878^)l7q$)?-$Es6ba5|Ji@5Ws#X?I6 z%#unAJi>}lvxS-@#x@EasYwcr*2J1B%^QYx4NE{lQ94#rFF`>9w`6?RSmhx3aONv8V z3PuaJp}B{~s$w+Zq2a0|mAH%&XJ~Yka4^xLSc(yv7^#YmjvFV*D=Id;#2bxEh)U9! z_a$dG>rKv_pc)q%mK+hG5sZ3TB+hHrS)AFtojH44RJgdfoEdEvhoVKsghqvHVw0jG zqAcIdd~9*)%|;hzHXmP{9W@<^j<7VKxCqHf5zW8hj>kYuQiVlh*jX5ph9aq&e8bC) zgc1fdm%%rkaq1)tHA{C-Oo~geIMTvYiJGR3DdOY8P0NJA3L06kn)3kNEhZ8*h-MBo zj7$)WN@_@qM2n3!_B=JIfwJvv&tA2V7-qt$4|FqQ7Ar9R;{ z(C9PY3QAnUO|R4?-tI}gf-RrXWxh1x9vdMFc~Op>Rb+}lNfIMPCVCsHWa&vkD6kqT+`G`szvW{StCEulXqU7cZM*1cw?7vTZ7*0_4H01sjR$3^OaKSX z3McI_V^*P2rX|mi7uImW{>otFdrvSaxjdx9kh4lVjk9u6Pc$Vt2Pa4@IYdW(hO)4o z%6GnIyh*_b{e~$Fb!6rb*U;i6Ma9LMbwXlte0*F&l15NXh&xRTHaMoSnH0*3>KIj` zY3HiOrW;$wP^posmv6_$DVi{AHWzxF5vmy@v>P*u7SzX3k|>kxMLCQyEeQ& zP|75)O)j)uC_6|+1wbpr0~Ha{f^qh^hzQZJNeYdOQJGF)X`!ezE>ZQEoMw`T)t%8v zQmqOL%~haaQGahnoJ(jPpJr!n(ZkGeRr(QonJ ziZD*2GO>iFMV3fpYy*=?^e9GP7V1Tql{5!GdS8H2n2pI{DTT766s$v%!ouShS|Ia> z4s3bMwX47^)U7lR3q3~9fQ8C490tR|pKxIEW=l3P(`ZcgAOk(4iZLw()E=W6t)V?8 zwbP!)A*NsfHsz8W79AyMYGW?uc5HaS9z4$ytg|#9@!*01CBP#LxJ*3=t9j#S)ZvkI z(-RsVXN<|(a6A+mFD?KVH!dbV86q1`3V;c58c{2=u~BP5jaieZsI0|Old%p=z_Y8Yi4{=E*Jj!!aPn(o-@K0{9Xex|5xnbP+Ktyd?m{hpLkk zkf-Pop++4KT*c$znYo>dZramu@dWqcb2LSvFBk}()6v|exzOiVqCDs%7j2hlDz3vM zT~CV&vPwrpJZ%Cxz|0+neiy#oz}1*$BN;=cY|I>@Cr+je%*+)2^w3mPzof&;>>|>LOmo!=&V~&PC5v~!O zm&?>VB|Sm6j4F&4_TU+3ietsY+UQ9RlRAWlleAz6)06&^?!dW4Ex@jU7H&!H{LrF% zBC|vWrzN|{#x|j}++6cWt%e4`!8~mQQ7$;f$Ieq^vOLeZ9*K?<9Hj69UOb}=s$M+a z4My6AiE+sZf-M1`iD9cBql!%yXnEc{Qk8`B5mPbwnr3TDRVOz5%@lg~t8LB2|Ig`~`C2Epv@uWE@!#C`3bRPU*2sL{D~`dH039UR*_vXNv?-Owuuxpl#5Bb>A0*K+iS)@L zlpwdurcX;^H4qjFqeH_c;0-fl<}{|rL!%0liei>90-|H$@E#wxZ4l2ikw;W~&Jz_w z8OA3SPDswrF|K4k)$!mvHYSFmVew#!aOfjCB39W4~0Fo?A-HHcvbi)2Ejl#$(OqEy$Y9nvu(dqQJB~8?qMOing#w{&IB}^?Vbt zETu7|eNW#G6Fnt z{u_ofK`yPCJAO3H(#&i~Re~4i@z|b~l&AzR|1`wH-7tE;Q3wGz_)1BKJ8x$X+WkV~ z!|=S;!hP@>FLt{0oL%&WE(jnVXw<;%ZN%@BQoCrBQG;QRB#Aj%lH+JeLh85p_zq1j zrY&!v&k|58)0~Gxa-0OqH_mp9USr1@EuzO#u+p{N;-1Ff6Xw9i6&^Anj@d37Hk{Uq zo}R&EcxWcf&9Ea89^e@Ale~1s<`|Z28oGvPqWMYhVOdt1d1&(r3qmz4ZE>^eQKM+B zz{^XR*XAaifl7?@1W;r$bg9^A8pML~-~o~!nh?7*6@7*x@&LnOnnXV{8^p37w^)d~ zN1aGh7`>8o<`hI*aVNicV+WE(sH2Q7i$;@b65NB|{+nfFI2K^-w5sN5XggbUaHR^x zbhMmE=zyrh-o+SCJf9)<=(!!8f|y)1qGa9*A_&f)<9TzEMwJjAH_p^QIrz#&Y2NyJRPwPvVqHL3f*_6gbUOHf{WkdkUR+6Qhx`A=OKQHJH8w!CJ-b z##<#?!5CYj35<4$FfiJMk0^~s)5xTglVe{f-B%hbgxv*ov2)&N)TrrlMbF^kBB-0t zD0ue5ig>ykNlHjo(<5zefd*%|eJzc~4gtC-bH6O0+n2=XxFj|UdLYLx={V-a#DpS3 zj|%(-HP698=t$7S#NlX^9nJWS1x6TshY`kv32esWph;P;@m5&zu{C7x#>Sw%N|RGv z5*3CgCyA`tutPB1k^Lc)#4Ze)W+yGUS!|P=O=PMK8{{j`2H3s5DvX{N(MDr~+#+TS z8U}zdZ0LAn*syythSl5?Aya z1nDGJVew3{*ut^*j)5qK&cm>YicX4(HFK~ALy;`S6}wEy*`_til$`^#B@D^TVhQYQ zUaG_iF)|7o!Co9rqIi_23sEL zfdDh66O@V73qqeM6$=ze{b}PzYp?;Qg)>Dp4FO@+rVNBuQ5Hf6mkIxC#c$VM7|T=) zVLgR0gm)<^jwu(e*uwNCpRw?k-R4yg-r784q1R&8!U(2DHt2c&#V6CmGB^w)$e?Cv zOBx(F=+-1qrsBkznvG$@`x1hvW_QC~_+*CM1XI{x5lmHsh1Z#aoQ30CMSoKxjKdmA ziXo_wFrL(GtQGsR3ODQ6-|o<9K;K_6nM}20Go*FoUqq!PW{q4m>0780lPN5yH=Bg( zHrCHBHAe9$fThGi$E8{ouTs-@N9c_tep<9|`Qwt4sE*+d0WG9A_>pS~xkFP~NEQ|Q z&0IORFjLh?9CgRwJQc4^(_aOeAS|g64H_e}x26fiR^cq84I~(*#!jXwM2o1dXo5thKd>pXiKny={{V&A(R-A-5ykqcipC4~_G!JmNL~oCl5btvn2~H!&GM24&;1tziNU8#GNG-fLTiM3F=h7OTX&2_t>$e!_Sq-jN>+hTSLoGB*E`6ZiXk z3pKHj$WmvCRwxVENH%i`X`yLZ|2Mi)n7-tW6z1{|u}mvwNu{AN_=U5iIHvXU+c7M4 z6z=}xY2&gYjEF2RwZG=^xk5j*Kq5#us0QdP!68#0De5!p}%(U(j^%$q6_pry*fG&{9ET8*0STgMDz1 z-yS5gzs~3Wz#N+cjc0Dfqe;sSJc^+&XR!~7xCWySXA= zIvs7?48rl4$V{2Qp2Zs*2yqSbMjDqhi;^2+ss&tU?=O7hNDUwyHp=V|ibd(^FtPYU zW15IMC9jt7W_r3MEV1!LXyG`dkuAR>F7Qa-ou)2sxf0!gzF&%IwaSLWhRSQ-sE-jcb*DP2QEk&i82v4tL@#LO9JhGGwf3*-^p$C8P6YsZ1 z8*OxM<2Aj|NKG_VL3~tx7#aqk(T*j+5QQ6FCH=peG;Q3Nji7AY!jJnl!r}Yit|1J= z5dOoEm&6nzWY=WEh8wdHYLhMqDQr^8qz1dm2pLIagvrs#Q_Aq6sVNE@;wAJ3l(8xB z%=1a3u@)hhyD5Yyf|^8I(1fhE)!!XJ0&Q;C^qVtmj?1Akw)5p` z7dK{0u==2!Srx1%zmUqoz2tl4gy_=cWUn3moo+`I)6=aM22=>pdZvGsdF6lAA9_P{ zZnlh~{4}ELKaEjLdFy;#tD0Jn9kRS&QAoD-uq}~=*x;TvMAqGj=nuano;GdfeaIoA&%HwwwsK}@j!S;ue6QO5NXvBfJUPRx+!3sHq2(E4p*(Vw zN9!v`>NiB8b7FM5IYe<~4x@Yf#aYo`%jk-=OvrMj_8keyF39G~qV3>BWI-~bEXXCR zZE|hHWKHJi504}}=4w6VU$tJrUuC{r4d=`CD4(+63{iF{B13b^<@e05a8wy`6J;)D z(AG@PqvcNUC1v_eO_4Q7NACq&HFH8QIysSM7zGNMj414i7_GMx(R#^=ws!hgttZ;A z;0~i(Bx4kdv_yfD>R!L3?Wc9mUXrzBk^3UH{W=)hFkepg&+)WHugQO%vtzc*JN=8S zR{j@lEtJ?d_^a~d9-<66NgB=lb*`7^ZN?>kV1DJJiZ^eab=l~lMbpT2RpO1osy zl5F=yd|SwnKfRB#pa^ZzWKN*%4cj(z%Q&@|qYo+1C=Z_|`VQlWPA<2iH63`O@}Iux zY8NMl37(n~HO9-kOj)lQsb#%9=a=>JsIKtxZB)i@hHu)&w2tg7(Afu&)L?#8d#$!6 z9m(qS&KbPLX9jcKGq`MsgIwntLb_-9W|a!=8(g8&&`$FX&dNKRxA=%IJ&n11#J;1- zRqb!X?6tv2%&;MQt?=(uD`V^KMJwyHGQzj|&gqP+B16tp=%pKn7AS`nC^wC$w0jm^ zPf?{bU9@Lm(}lFw+B|C_YmW=9kZGH}DAU@(+QD{N(2|8!7bYx9^C$ilg4WHgKDW)> z#X0lkW#sC4`9zWN?yK6r0^<@eFQ;d~sT`N!dHEfKkK}hmE170+=X9+{PFWe+Mq4AG ztgH@GR$C{hOh47s6mGtI=XO5mi#bm`Hm0e`9*h~xXqWXwF{nJz^$Q`ZvlQuRWlSx_ zT=!0=Ek}v4puJTm6BU?#CfonhxmOvJQMCH_`oh8^MFpqxigPa=9DXJ2a>S)k7h;Qd zrpRj3u^r5@hBD`HO(M%{f>wsDpdXPP(h%*TWa4RyIcL4vMjwW`ANz_ZpJXFWI^t## z+2M7FyPE{cZpb{XF&b@@H`PS1UWgd^$nhMxI7fE)Hqqw42FLQ}+V{|{s7(-0esQ+a z_BErtHJs?f4>9_CW0CJ`Qn^Fd4&}ONeLFDvj7^{wEqveh3e zVw!<@3OhTZ_P@p04|=C3@uhv?3YCi1x6{2TXqRcr=jfi5omG&%WD(8NE}i1sH(qAzH`DDyip z`uxp|K5rh;pUfb7|8tD8=r*%|mhSCWXT`-4SO=aE-Ir(1iqKfhs3nV*1u4$nBDx9S z@uhI0FC57z{(4Gu(w zS$Q&@Q544!Whc<}>@|{UuNzy~PM3U))_iOMo5PYHXltV8*&z#M>+A__(Pcp{fy7@K zoJ@Al))(w$s)O^F7-jngj6P^L+Bl8Ll;>v63Q(Mz%QTszD^9^E*^Bu%2W^{alPM3( z%FVV5$jzd8DZ8!33T11hKXiuZyX+yJSeJexHm4F!d!Jq4ulRy-5gJ1jbX;7V$>@?l zJL|5hiQ>{jqPsMUQM^I_7mp^o^N)z))kkLsr%btnjf1t`8e`Q-Pn1rFh^J21Z#L=~ zO%&*1+A_MYXq~U9AL^*jSWU85lwYxPf#RH&QD7`(+AAg&w##%-yg%G7Q?47A*G^HX zCRRG7yg3uHBzH;34|@Aw$brQv{<8ur2U!OOE|t|j%;>vf#$o(7v&IOwwkF#8PzIaP z*Xx~$wx$D-ZA5=JK)43Nwd~RVxO`6Q97(8%KWROCgR^_d`|1irxRT{Iinl*+F6y_v%~eN z*He_v$k!S1N}VNo$Awq{i*R|POvQ}fSzSM_EDBc}-06+;>MWEc)iZnbBE8dEV%Md8 z7nv`{egW#%!4c~~DIz-tEfI8%$nwz!1&%~ph}D-Wg`;ahEnOvRM%x}*CLb*kf*6OL zv1V$6F-P*yUb$$SB736mc!22hZ;~)aeaJV}gt zcpK4O#dyAuL6n8zjJ}{hqs*I5>detyvSxIH(uwkL1knfgMXMDsx&fI?&eZBDy52U( z=N#je5>M8oJY&34dopWMpAp@FX-rP4qJKKmyP)L}??RvBUQ<1oHB$-Wr9DN~XrGbm zDPCzV%$l?m;+4LgtVy3oyfUsaYcd)#UekJ#HPa4~NUUJQieH)^*UKFx0%^z!lw*#TvRvz629>riS=+Ef- zV=XA02A+T~SPOJmcPJ@zL+H9=S_|mPLYd011=$Nj1ZzQ>e>s0;Hw~j_*Mdc0x@0Y= zXTBC_u@=ZE54M62+qktrPuGGD`;mSnYL!j&Cop1*&NF)d+l=D1a5caRc{Pr3Dh zw;G^Moi*%gph)Id1D#;kYF{NzMt(bb^)Iih>>46DI3M%Oo%teUMj z`xtA10&9VSt_3!H&6oUuRUm6gHm$k#Cwt-&Nb{k3PJehDX*63|kj>Pbr7yU|=!5^j z+C7`ew9ZAlx0zjij&8slMtMA&(A7Y9b}o}?i2f-`g_I0sEJ z7AwH_p#Rsy&<*)e3zYv`7wFDGcl1ZU55T&DafB9_gcexhgEb=`D*;_CbW3WHkcE0% ztOQE~m*{6~AWEzSI~S+wbv)$6kUaSSWG^_<%z&or3vUPMV0RI}G zzkR{BT43CId$1pCffsnW)(Yzdc(=iU^86&mbsz{#l|lY)b~W%V(!BxO7s(mL!gO*y zwP%nr^DOotsuaC;7tzmnMU*qrK)2)UdhnXA2mR97^*{l}d&(66M@9tRU+bDd!+Qc9zPJ{jc9KV!slVFupz7EiXW^QS)LtYqXn@xX!B%Xzy9PWlzAIk=MQqj zMjtdCd*DD@#o{!^(;=|b4Xa%H8&3MXnvAmG5YY|9dT=qFDBB02j!hW-(X-gm<)kQv zV~q$&!+bl35o^onhNqE$R9*25MlsNqQFiE00;Vd?PGh{%o`LWlj2Gy>CjAt~a5~en zpzV?Fg}%pCTCb_#{ZtpM2rIE7U>!&qfi>h5){ui_P3kqQ2k~T0#zCwHgjqA~)W2L0 z%Ud$Ess_L}39)LwELn&Q?bB zAUx%CTqb6#SxRSl`oq0|)IKUzHUU5vumDQKmUn;y%RDAku@##ya zt`yxkey8xkktYTFX3IPH9PusWdzM+*OisS)jO*b@z=|w z^veh--yy?c%+%_cI@@?VW$|I+bJn-G>4lb;^o50_|K;9SiVha$*0!rxAvQxB0`-RR z@hjTv9NH^gF1Jy;WRZq;jqL)1Pa97v)Gl&TyFxv?!5OrDWgWN_#YApH)2LlC2w%Dk z2SvyCUlrLEL1UDcEvLfPk;y4d%c+o8A^IqslBGK`w9E>dQdq^0FssWj}~M|8

    ^+O`s|QOiwRBIt`fb`+oQ0iW*k&{=~xx|@NE^mCDAyvH0q{@^4Im>I?(sYB%>}dv~Q=% zp6C0=UiEU4Q6G$rKN(znD#=`sbh5a)Z|n|ZX0IIe8aa;n&KS|1s9cp09j2eTg;7eKS`Wp|f$uJ4@r+wM_Eu!y2Kx z#v7sB?aCa6)F^TGQu83z8+~9oYP%Bai~7EfF@nP?jhTx>Qt4hN+c%PcNBrVqW zkL@aWaJ~xd{!Ez%=NqRNf4?MDcS>=!bl)e<4d3{0aV~wZB(!Ues$JsCe;ehwMZK}4 z`~GPMdL8V0*jM?v5%D}D*Haj5s$$HU*Q-!Pl?o>3DKn6(4y^GtU8sVw`(xh=6h-_r zkQ)<>^}4xu=taBq62H%PGTAX6^cgb@GcdrrFz|=`g0Rhm09UwOh5qQ%x#*YjjJ2l6 ze{S25F2hz1i@oj4fN=$f3-SkU8`!0AWnt`~QmpZ9v`E|6WpBZr!Mlgv3K@ z6la)!#(8o6T$1@jf?@t;p%I+^ZBp>Erf7vlhB@PG(y1p-J$@>f_P9B0zL68mdDxe* zTBWTvTj7j4IL`KqRcO&GDt~4E6TNYcm@zT%fprOKP1E9zmj@5Q zHf)Y5U$-ihfHNd70iGPI)-CrXe5C4dexL`$C%Dl&lW^8VTONveIV6F56c z%6H(5*oiYD7i(JYO5j=b`403G_0|~_nlfMYZer9&W1wDn9<=)L9K!jRn*hH}i#rh$ z`VgMiCdL@F)Hh|9ihe#8Ym-NxEbkYOe&&3V8QtV$TFmW>PsE+@_&&Q$`93{o)Fp&I zo1;P}0;;Y_sH7f#i=JlY&4zE+XE>wc4c|u#mH9+Kg+Bd81&7T?pAgz%8le*>jL=sH z4d3kXD)?vgBu{vZ(7!)|2KuVOOV|&T{6_h9-J&e58ElcW@ZKkv`to0f7Fq@MYmS1q z^DG!%sY0g@q4sd5$NFZCQzp)N-;A4$(B$RH_nUskpQ_EnIOk^N8=<^6t+OMsc5hDh z5_37u-mm%@p&iJ7$4vEVbz$w|{B<#Ti?f%6(1V9|3|B8yC+^srkJW_7eTaVJu<=H9 z2)`mPR2S};mU|+1=zzKb-3!(gv>Z5Zpa(u^etpIW#;YjvXpyQdHht|>XhD2-uuYcQ zy0UzIEb1}pVk<%aL<0V7mAUYSASKO1RrzVRO_-}qZpFv?>D<2qnm zTW=L?3k$0ry~$_B8RhFe$~-b(1rOsWXCJ{Yj=2iQarTI@F7EcF!bv1?PEAn$c&Hvg3nQu_wzr z2kOhy^XkjH?5K~)4jzGDtV9j`4gFrMd9*?Wk5(AI`W}XPFdFMRpHb$@Xu~%V$M`V# zucoNbnIibZL9{RYZT5{=Yx#%~Jd9uHq|o@k8@@9=;S)WKTC_U2*z6@-=Q*_FEfw1S zgc`mCnmAv4gFiRSBQb_Ae~&Vk$DqDYPp5~g?4_Z>XRJQ>P<61V(y)4nw%E_=Wm!eP z56`Mya{H3dO)sn8F1AX~-^e2Y+ctgyzJkSo5ju@>RJ{*SM!%AocpuGaAo`N>7%W|;#HcI@jc;oh^zQ0$5ugRjf ze~g~#w5p3b5gYoXNJV2{U@$3QUH??|hfPoDqkwuDw{O9DQ7ZItiRz6j7!$AFd=qyW zay8@osEZ*z^NywPjU~-bno0FZmS=4IWz!ygZ~OVmynVhAy#K4DU~BwldMnhJx#sNCNh?<#pL@J)+Hzif ztXaY9k8)hEu365WFek=0;YAf}?LpZ?|2U|EZ31dcnK^8sacWJQM}or^qtzB0(;i#- znEBpZqs^-0Wyj}DThU>8`5yGu1DnFi%~Xdq(SzcU!{aN<2YJxfA|K?y z>y&8p?94NId#pN=@34Juo2);KT>$d+@nSVv!RrrN6AH#mvcPjKf8Q%oT15R6V&paSoPG>;0*XdN{nH)M?W&M!Z7d0ulwcj6YqRAru^~c=D|fq@Ry5? zHIJI#olQz>>YH#ijw8-Ek&u(%n>fNSSIk$(%R4+4JXDQ7Wv-FDs(eq3nznr9BjtM& zRfk8dU+%IstD*-sQ>Rc4UcFkr^3P=gZk|W^?iyg6NHml2 z%N0}C)O>h8dV{*y(D-5a<$MHQnB(z%T8fs$m^p8qhkM=~r^D%l!{N{cEomK&(Dn2x$FMe%8 zA9b?YX%T*77GX8}RVtMG9PShXc3b0DC0OJ!YL}X=@P7%t0v@qzHu|PV!rlO1*jZ%w z-og2XD^UD48BbPQzpZC`!&}hyalSp<@Lf&b(%@ms7J5e73aHzc29Gc&^vg@7cUtDqfN8*%v6N+*ldC z3trYQRs~``u{SJDpZl>2cuJOSR6_&%0)xX>+1dF82+J>hZA@*G+7zsDzYG@FT6PES zTNs_U7uSpL<7)H^+>w2UzHBipKZ-lE=iuY7<5x2$7QY*xJ*7gQ?Sy6_v__(rn}ihi z;R@HfpO4M)6vy7aG;i^tYU{49UwifQ>gfCoSh*fLA1r~5n7k#SPvhZ@gR1d++=hU?SkS%|)!_p}}rtZap=$Mm_csX#(HW@hrl+^}F1t77v)Pa*53D6r1q7dPaEJR7WXcw&RI z&LpvZ%T5G6t=0XlOGdwr)@`anfqM-8j(y+C(=@X>9pC7B5&}(w-+rsgju|N9J;v4{ zX~P~G7IoXH0mTIe3UUT+9hg>_huZFZcY0QfcIg>q?b5qG*e?Cbj+do(x%RU3PT7~G zr~Ul0^wcqzrDxsU7V&Kn-!}cqC)=iXd7*9Bg`1Rp4oTY@g;j-SjEa{h4!tqd#ca|< zy^MXZ3i|}?7bd9Q7*%05ZK__zKDelV5o9`}YZwJ{}_a>rPERi2cS#~Z}) z%H5+JZ|}~T*S}mkVNUOrPrdl^;o~RW$8R<}eJoi0(gw5XtUH5?df|g_)Cpc>m>!Rc zl#sR1C0q*=>n3j>vGb1I{o{k4As!QtYNQmKa5c~HFf}rM@O)wW$CHcH>4i1*-^p=p zLc<&-zp}hESB^ivPVr1C2K5^4uGO-_Cb?Fvy1d6-tG)5U)J#kad)1Gv)qOvzR_E18 zy&hDz;(0{2al&<^d%`~Vv3cDv}SjdtZ%*S3vDKU$uV-8MSYXj`6H+valgz>Yp8*I296&+n^!`HHlJ<>$?3 zKRdT(^0B*KDA@aW$K9#*SH5uQ-?yLG^4EuYU*56H-={`*S~WA~vv-=8+&BBzr+zhM zM>k{q)#r~qJ8RFpckVxTTfdXPJ-F_7k8YS&^YZt>F1>zsc5jcTKK{?$?_S$FW>@;# z?N)l$#I>Az;vZLRo!O*3BROUAh_yq1dN_2|hu2j6;!o=5+;yxBhYe zzc+t-(;#0U@0+OK47vV^O+R1nU;5BveNMl=?Y)lP`Y#XsA<_I|)T-RJ+n;{mhOxI_ zHhpy2&F`mmUA7?qU$3+}dPh?%y45#fKy0Uxb$@=Y_`ww)-Sg@0-gi|W8vM+pqOU$L zz4!U}*XDH2YQOQtou7R$<0k{(ShR5JjW3PsAAP3zn4Y)1T3LJfk9T3H=CG${h&pEy5ro~|9WxN zn^(U+J1hFnm)%x-d2IHthM#|XKBHT(V$fA4}mBg?y9+3&Bf>-+ zFF%`jWP4Fgm$=oV|FZ4X7XB|%7r(Lgor;(N>HoQT$WP4o->rH4mJi?lb?Hx|mfrYT z=Z8LS{lWKbpLy%xng@1VH~##r$8LK1`2N#(o=WL4)w6!#p?fMfb=&##fgLtpai-^i z$(`EF8};5NGuQn)V{7{-Zl5wYVOs7Zla@98rSJX`L%$sJBUe|Fzp|7>;asTiC;bP&)=lY`rQY8o8CHpLG0T- zn;DB1*L^Z7s?*HixDFqm81}Ar-@Tv3XS7_^{n;0Z3`>Q|w_ObzQ z{CwrVKH8N1Ui}}2SN3{y%+RlY-+W&G32Tn^dwgWfz#gsd>GJf^tDb-8NX6d|ymtGS zJGQ*F;iq@!=3o8YKc*Zy)9UfJUhwed-|zk4U-d`YeS7%Xv4ztgduG&6Kgnx5r%Udm?L2?|baUqo zckb)b_wjqax%$YiCtl9F=IW($Ygc7<`cAphyTeHxGOr&vV#1vHxL$kv!10q@jAb)~ z``<&j-wWaX0|-}NVLbPYA8@$c=obbw@jm+RW@*oKDeH0WZ%=H!_UC^eJLqbN6Emq?k_y}Qtzq0*u>Vq`{a-5s|Nn!`te=o6_5RV&ZxmR|7K3JU0?p^*h(yJ zl3sbJ)!*O#blPo4ANrt0RQ}frEMYRbg}|YN{ZTv47;k<&;Abrs^-lfxr%xYl-KR(FmM0QC>r~Bs9Y5)vl->7s zv$NVbFJRm^=EWYnUf#1Z@RaxN$_|4DX5W4Gva7!uFl_mO>0_=Mn>2FJ{Abpg;|iDe z?|0wiy{YDH)vLy>$b9$h%B5{ToP1`=y92wF_w#HyRdeFj>Vn@iQ7e0%TJ-7-i?989 z>K7fF{x$yUap(M*f2oUlvs+?b+dr**VNl`m=Wf6MGtb($+TXH!*pTEiNl&&~bz*(q zWk;VZdi=qUU)uZpHDA8<&a>6!m_eDTOl=ZhY_?6rHpoRu*7Py4?5 z)5BeEeE6}Wt>QC(|8!B)dp7KRvFMel_wSqelhwoivmp4lZc&rEuN>E^ZO68Y9%ue(*9Sl@ip#Pz$E-sV3!;>f?UkC^>_KW)s1{r{u>2aJMJ>Osc<8;*nG zn7oKYt5@;lA~Jr+4lm}w8%yl)U>UH3Cmb9LOyQU!1EavpbzBAbDCJR=uxAN)L$z09 z8-y=cGaH0c)T##IWUD;Nkw3qIpm5x36h;uSyvrQ%4UflT&3S1hu>RTlL&8LyE53Sw92> zy28)7!hKxf{;u#WSGdvI>HU}Ypc5Gy66TS zLv;*)ca&;{f1-Y^(|WCNsw#m0Yyq~%>UB`RK)4OU+zi!0-K_0N*z$kG+0xcJz6uFq zzGTLC!czce{JRp=@$JLyW$S0T!l|xsA4m9FJ7PX3gx{9@$^S${8UH0WzQ9!;R;8-g=(u3b>4RQyIAG>!lnP7 zBh0mNZgu4!?$c1dB*ag4#dAI!TkQHh;RcSg!8lW+XfMq=@uRTI{23OeOa%=8&Kz*Z=H2b;co)xTYtw2+5edSQ*Dp9CBB-w zSEql#veyE~91-fA*6}+neN&Cm3Y)BOYc*1sWil9uK_AVUYGBeT5yr)D@o! z9k2Fx_RE615o17O<%Y9TN+`7?|@+P>6+J z2AraKV&RulAI}jf#KLnP@D$Ax3;!tf@syfEEc{yPYo1tm`UJlbq!0_=2RKFZ#KNCM z{mF3=3*Q0tXY#{K2(j?p9Xzq{oR>=UiG{z_!4nHV7TAmDrIcw79b(a$OJ4uT5ev_6 zmNNB)4BK6fmsoW8J0QnPEIfTf>XTS_UYALI5)04YZ)q=L;jgE@ZZBftpQFBRcVgkU zP+#-J!fyli;yXEt7n^yn1uZN(?HFg;d@6A(8y6C@^M>4tP3Cjw_p73_5x(JVOAULi zI;pF52#fuVz*1Ml!aolzbww;Zufe3Qh=qTR`uZ4&g@2R!nkN>1C-rq55)03BR_c~m z_^;rf-eeGvGxPy|I0}iyX8y*478ZRn8T@z?V(DmKA{HH*^YVjCNE)`xR3fFiV$0}g zLF@iRc=~|M$=(;(n{MljCGKqF$=I3qN3i5|ANhGUPb~amU~eazUxr<#w)qfwjro0% z*d&&;`E1`S?6mx5Tg%v31(h=2bQ(CAb@K1`it29b1OJ7_*Ky)1s9hJ1GOP z*q;dO&A>khk3CbToeC^=W)bTTJRSfRJH%pV6RT8}@__@F`M>*@$ti(SEvFNM>mOhPG_zmRsIYKNv`xA3M z{y~U^e+}5{$3MuM*u2>mRNJvLnIVK&^!Ecxd5DESN}dM+Ar}4%U?~r=@aM?u@(>Hp z>4&8}{3c1}BIh-Rl!sXK+fe5w7=R=LXXe_N_fOtD8}q!DdEqmtbED0712(H7SZw;i zC+FKdvGDv3K1K7y!uO|sKU<$z_(JMyo>+MH8_E4`ePZExkDsD>V&U(kzWAqupG1A} zPX|92*gL?sUjdvvFoMPA0;bhGvG7ZPrG1Ho=QWb}oAY{U8+rX3K`i=v$(Pyr5)1!6 zdEM^B!hZxT?fw~Yp`G?$)YpDUEc$1FlLy&4#KNBgPSHHE@OUs4J}zS6o0HdmODz1A zX|apNWM(MgCsf z4zciw(cpEv6ARDv5Y2L1pICU_TT8nW3-1S(cE?8p%3EZo<+CJdcVf{W3Y>h4twSt) z5pas;iG?2tEXPGG{6zBlxQK$&y-v&@WJn$L zwLcS!{vP0r+iab^z?ma#%;zr|zqIlDz+V2~Lyl4B7dHL~Sp1n-Z1Q?Fd8DmFEd1BN zDVir1{yXYxzav9qczn#1;C$aFy$XD3; z5(|Hlye=oP@LvN^BHC|GCHa&aF z#jwU08Xq@h)SM|7PP2H)ISu|-W>d8C;#7*55J4u=%PJgY&mtL_=96lX2@$iVH9mo0 zL#>M*^$*N|NGrNxI9(xv7n!dxqS)wsg!W{44dxxRs&?9x8P-ICmu?el=1`e&FFe~| z?{FoRIAC32zICW9^{h-Lp-=j3rqBZoTKwhl+^aRRE;@I%3O}2!qQ& znAtNf5!?MR=CsHDoA0be1kQny)831Ccu@l-+C%piw#PLsoc6}XHJn>X?EM+QX>SIe zv#>n0ha_QpKX=(njfXvEphfHzy6nw`z0uI2y(ZY?cpr1wdmoW}hae*MR=eySgS~g5 zM0-uKiM$em&gd$ISq%ic$L z?zRc>v}a-ydt6u7S-umnM?Dd-R|F;J@h--*wMkH-z1G;o9xwTw_7=9pxQIsD_vbo| zAA8Ezu(uWsOM868EcU+B<&$!>N27IP0xi^|EX7I1d_}L2jY~p{z`NXfeC{ie4(Og! ztT5RT>3}2M_EH>?4!Bn9bq7Z&Y;Qk%vO{(eSPYzA4UQw>a-~v5NyjlbU1K@kuF!M( zsT>mL6C@VBzR+{lpXjB#>`lB#z8&>(pjjRHQzH2U$@8>SPJ?w)$M_ z>z-=K56{uE9On@8>w%3kD`p|oKHE3{v>#ucpDP)1OqFBFfs&e7d_U9{Uw232d((Dx zE2@1jeXM+*wf^875561=o;j0*FV*9MQLohhr>NxQ0Tqm|`37HnP5n$6{nAq+kX5QTF7O^|iwqq`qiumkM#MdNLriH&TFpfv%1@cO~ zFJaDyL_fcT^7X1w%W49i#2RBQE%X1eZ?^i=av#dgHkc2~zO}MRzT_`?;_D_yuKZHW z&T#>9?Bd9AULI|f)h_dw$HrQlCQ-)82c}^Q&7{rs%wQe`}v9o zt68rlL$=_%u2@xV)xIazTay;p=&))WkM7b$SuIeP=r=uQ>eEx7vAz*|EI&Q!9ej_v z6R~WINc%($U<$0|2Iw; zc^CJ7qt?#DpC_%K7BG(S>|o6^u2)_6?L4Q`)39~I)&(Am9-ue+F3x*m#-2R7D~wur^V(b^eO(VDeM2WB*E(BA zeJu0doeeJ8NWQgBj=(2pKqUEk@%*p}ieQ3Q1-*AR) zA7}dVrv|9>4bP~o6^t)Ym>&wMZSC~bS5apJ8cWp~sX9q2UtXS}J$(i}{e`^9SE)v> z?Hf@w{IY0a_{?SR_Yl6Wd#T>nbFJ0$-CZ5(xkU}CX76pz44~h$T1K}z{3_fE{rk%? z1aa7D0ow0A`GX66WC$>`UI>U){l*?a6|hZD?KiqwAkTJ62u*6L;W~Qe{eY74(rF; zVD0d&uJ~d{xS_o!>UTPB3-(dy{~E?Owess9PH%@J`P<>4uK39D+VQho@%phcSUY}` zEB+xzxM6vkxyqMhm9H?YZ-*o0vBUcH2(*%1>04Oo^&?Bf+u=xk+2Ltn`z>7QO)LF~ zaJ(Ik9G@M&&lMjjj~&0n75|emiO z>bJ8?{|ZY#Qh#>1W!SzQzS0%$<_NzZ6%GJgr5c8>ww`@ZV+J;kNA05Z@z@JtkGfXh zDBWp=!lCY>6ip&*(69yx8(}_(m)KGW9oC{MXuE0`@JjD!?*VJf90vuE*9Av;6Zt zD}`;^QgyV-!LV&VU0uNd#4b-~HCpT2@mE;KVQbjsOF+P@b=YoR-cUl=Mwy!T1Izjl z{T)30T+&V?<^w~>WNexGSx+pmmk<6R^gB#0U`ZSNH~H`fLhQ2;;<1-8ob*F4AId@K zL!wVC`YdM#4MTXIc=23~!ai5Va}IT2_NBt}P)$7Nq7aKss~${?R>|1OxW_KQQU+qt z&jQZi!!HQSAeeP7<0o^-^FSf_*fQH%&@QJ=TMQ~gcL1!<3_iPp%)ushDuKoRTJkI) zWFxjrZRdFhzT`3D84HEJ;^jX`S8Q^O#Bz+?fiv_o5Bj2c3;scfMW+BbQ|k=6I zBmP0suzC3p!nTvVh{aAHU>PTA)tgRxD|i{ZI2t%p^NStWvfmj5gy)EiQKUaeUc{2u zFyIV*($Ib;8x~T5O~x@=_BFqRJSzsW7Ms}L3@rAE#r{^{3_2`i8#Wo!_@)Ez1s0vd z}C25I8r-Oqh7T)qzT?S&|t-d86gq938 z2!wfwePYqKj&T4rY@LjOHYV>KWMiug<04qn@-)sEZ1X&>44wqsW6RWh&+r0$cTJrz zYFg=-v7?G7Odd1s9)+bM8+)~lXRp@!e4{3hxvO;SC~I}aNfWRr<@7tpOqw)hwoKmN z$Q#&;CB0}q<4b4Yg@1#E8~N;a6!{rr#*at-R`kUe3J5P@7=8mEUfog*St}V{q_oVa zbn?u*E?L6jDN`n0T4BNrywaU8dHkr!GbdeIb<8ADa*qbMLTDOQar}T=!1x|w9f_WMM}g)7l&knhAqi5k&>!} z&WRBRP|~jsoW%-zRXF{WaidDO{-Jvv#K!%Ixj9Yw^W{y zKTa;kHLAW$wGy(tS} znb?>;B7rmCP2kw?h={!u0H?i?&Gj`n6g}9)-qkSXw08h;cZxCW#U8)&b=q4D zdy^2)@;Tq@S0U`Q*B1enTSV+tfNyGwh zaim|n5}*gdB4UsC@=W8`5%0nt>xK3@ViSA3JagI`344vT2XFtJ_A**U`oDCCJ=%8K zTLXKI`Ad73y~VKC4IInYS;z7G9pO6OS1wY%;jZI-9romSdAlda`!+Dk$Gj+KU~jAq zt^bVU#_x!^7a5_Sbx2s^_JTmxQ-!DAH4?yH^qQezobUg6f6q7`FGch^!l^=fpzZNGL^Xq|)Phz?ugztOfH&=S{ zN=AR8y3g-e?(rBOuFh$;v}DNBc$ewNJNU&p=KRz3tLxS;-EqF-JmW+abYD_nV^7CL zV&=_ll^qIf!yEc7Di}CZpIEzo>CW?>JicM475hCS-lj4hb& zUr=Y%Y<0||iT6Wz!!2(j8@~6$JEDrN3%iHkx|MfMz|5Vn30uMITC2?u`vL)f$!N@5 z9O#*yp86Wz??z^=#rwaif(CE?_+C5uP%h`0$H;+bSVJ|alKmc(5O#P(p3`_={hC^z zLrzL*OBa1Y?O6t~N1o-Lt!7Hlr(^L1T^-B+(H=DFpn0>dh6-HWY!~0p3 zbI38g=|5B74s{xPzEzIYn~8dhuWOyRe(A>ZO;B^rquyKV6xJKje7{b$3X4 zs?*m#qsmZsk=Zv(YGTx2l+nSkj88RbP{uAR9?nl+`;N1WRmR#b4eEw96X+*z0qr*I zQddyJcXVZMzgA&N#)o){zEI*T>iJsGd4sg*TUFcz@@Z zjS?l>yqrwK(jt9j=WMCZE-Qj~d+&wiL+9b4Ygvo*4S5GhuL{MztZVnAGJCaA!ML;a z_qTbpZhg|O^Q&`wvG6svPVCwGWp$o>o3%U;?Q43@)-SL$o1xyT8W~T)RSkMoWi8xX z<-vTP{%@jDn;}mgN~pa9?}^tZ;S8z749NZ(#dyn$YVfYDm9h3hUC(*W{u`M&*775( zjcC>OqcprhW(#$$55~}oHdl1Hz;mCuNNKy`-FT2^1w7`pu*ZC?x>vzxQa8hAwmIt@ zK1085*a~jH?y|!6YLv(F>do+&ja7p$C{wTbTPv>(my4l64MMktLuGa5{8^Y?zPAd+ zpTTNRU)PU$r1jF!EuSg#Y+Ge~_62Jej8VgyZW zTP6Nk7Pjgd^bLJ3Fw!6wP7KAnqS6^yAUncGCg_b*XB4Nsn9*3#O|6_K$8=~wnJa(9>DMS`)`lgE(; zP7Aph7ZMq#5x?E2J?!vDrez*Z>-~2dwd}9s_ok;V#7GOSGtxx$@4v@U`^H*l{xMh+ zBL=z0=St3wu~6ulE*uf^KVy7B6|OHtIKH5x1gw3u`Um21>7>OD4Ec{UKp}J6!Av4|atk_h(I9_L^Gu zx`*|fy5gHz@w3A5b~tkVZii>M;=>n%7-8P9K9XGF7MA_|aC$qeABTdq!;$ja;e`(U zhW1U%UST-ibmiANe6P9zI#GCk*)V-uE4_Zj1Pwdisfal|)Fe}$DkqHl*I{%40H{%40H{&$7zc(1bT-5So%4%fNDLtSA$ zBeTWUe_n!kf6w#x3s?A(=f+BaSZOs*LpXyE1R+;qGjFz_h2@VzEPC%+Mzq4%b~z3nY%jY$;D zdd}23ES5RU)*%*~q(px-u#}%zbgXvK_E}D^9?!4l^$2X_LBM}mb8`R3-J#^Ec_B+Z(p)Xt;Qxcp9jv=_FIu>CXiHYf?0+P zJtpCj=QR%+l7mgkKrCe_0G6=_JYB{9WZ+DluXSE)+#bAHjDHYfu|s#v$R=y|y)qwB z7Q!;`5Szg)p@x0kE@`cHVIx4Sb{QMNqB9hf%u~d2X6D;EcVH(riA8@LaE7)?pA;Qp z(Ycp8{qPSm7n`&lvFI!Y_VUDqEXO8xh(+gd;0!&+U^B2+myPWx_!VHWPb_I`faO@W zQ%4^=vFIFh=)CLDAr_qz4xU)}2E!AqhrTjCfv@(b+QSrPl+I}|NT9(xS342jZco7@ z<2&yfHDPS&l<>W7mxHu}Ie_~XVOT;X=7%ODxNuRT#KaFAr2Q(r_(y6_DVc%s9QII* zA24i9w=kx762>N2BR76PT|2{%(w#YDT%R9jb;6jQVZ}+4X5BSv%-FHhrcb~yjf)Hh zu`3USX>is|pKxz!n7HKV2|N9i31c~9gq%c$#Z-a}j+HW9J64N6XXdtvWIDAAsCEClD4bJ}|p0cTx{J+4vUv^O`& zz6YW`=U52$yU+bdS1EsP#;@c2u*bGzdgoY(QW$gE<2(DoIt_PXZ#0yg<$E9Y zIw79+Ol*wf@$&k?X^;1^jUDe8oyL#7B`8!o0NTST6}HFw45vNLUA6(7h?K7!gtL6@ zU~djM+T-n)lrIOyoc7LKq5Y;Gv(;gEoM1CStz6AhIdz)ZS{KYvI z;#HTug-8U~4~y7)(Pghs%Sin>$3ooUvbXvo_HJ|88{)9XTR4`T?faq2-o}gA;~aTR z5-%PT3(6_giqtda6WGk9mrSUL2I1V=MSO zND*DpdklJVOpN~m_J-h?8DEHv$Kl0RJZ5@nuO50}MQUp54~?zp*{k=Do?D?C+JgDn zzYABQzcN(gE2@sGn^?28%6Pl)!md@lU)sFc^t`m$*YoKp^OvpFJr9pq;qyH0=l8oK zR+vQ}8%Evz!>w=q*YcfNg2#HtH5Fq378<$D@=B&|R(lqejLyZ(3jDtK8NA6J{XO1~ zw@y)AAKA0W7r=V3TtU3BwJI;{td3Tg!!wn<`AVPrtTKles(YIShyT_XR4x2^@`om= zX^Fw%&pG(?GVrIr3$Nw*VAEzX>&rH%lF?(0b!$qd<{Huem4LNoiOTmRqr7DW=J2Z< z=69$--P<%c{8@)xE5D}uqfO8LXr?t+>@g;kNoj(Cfr>e=FZ-48{30VS6u3H@UuCDy zZK@huBle-fs6kvOHoHaI&Mw;v>IT;YqguywonLxWFnVT8*Q(k(&G>H7!R9;aHwVn- z`=d9{4>s8nWhNbqHfNtr3MGB$H=|ERn`ciYnP*ht7VZZd>v}^`EL| zRu8IXPTh0Y<+dC!&zcM2;`1F$-nnfd);eC8RR_;nY~+;3q?UH3Hj9~1U`jWXT@kV?(R%nh>0jwUo3O=>9q6EL_ zp~^KXx-u5AkNQhSKaF_{wi(fwwW0)1@k{2eFnVIP3u3dW|9gf@{Fn#B+snXsnqydd znBz4VgU86`%ri;Su6!$wxe1yguVWR+3o{<%m0^6yiHcC*S$}nvC*QWWLj_O&RFxeM z9=ckYhf`G6%8+NH|Jv%b{KPt*CuXl?b$7Md6n=laWgbU699TRQYZRjf^8PZwOxPdY zVqotWKUQB|uEteG@4#50*wXrvWA7+m(O%_QXw-e*Dv(fijK_d)?w6N_{WZ`uR0{82 z_A8@opn1q+n1?aGDE2x$jekb1SMOlW?^iL$fU&koUJ1?^oQ=zP-aMtM%FNiSwAQN_ zZ($$5vG&0-({ma4S5?=lv^>mc;(0hbQ|7byb?0wJTy(w(dkt`-McTeDdkgjq-aT|@ z(e@E_!D!EST^H6CoAGNsX7i`M-Mlauzcwz|e7Nem$c$bV9c+?kY_2quwnPP!S{r5) zc-&WCCIu@_ePhmoM}K)f$vh9Qo_!A9{Ix$cZW|Wen*IPBL3axb*hCGeWRYwnud0qBR|)8U+qwW+B&)~`@1J|LJf z7T-;z&M2Keqi?FR7a2?l$B!*-G+vDxGhtFGZesgSE}CCF;*Gc3{$<_vw#mlwe=hCN zB6Orl;Z5M@`><8N8#3@u*{`j*c0|)v1$lSQ zEJ6Wpnb!T9{Oj(TFej&EO!kOjGbYaIF?9NMB?Y;K#Z&Y8^_kH7&LIP*&o0RyJAHDm zLAT5vFnGw-gJ<70yGM53kf}ulrL%_T%^Ldi;=79m6-_CeH2VfT_5A<-a&bC8*=W7cV+o95!O>Pj>0^d8RFP{3!|Q^ut`~=Q-lXXnYWR zu6@VyagKRgYSLn}eNtG=69S zb^L8sd^0OPay{NejYd3erCRY#t@zh~ZL#y0I^vU#TcMwgNM5cpf7Z`Nt?!N_Ccw*sse8Lk8|E_~47XC9}uYRZgFJk==Z%YlOCSsFs;3orTwjqmk zp0Ih_Sx~X>^U{GKmDmI?Ax^F(yk5$ku!^k>1FiS-G{`WJp1 zaHf8c`MQJO4s7ao%*1l+dmTE5iB0^2yoW6_l}M=**aV*fmb}gZ%lbndP@jU+Sm(OT zUCDQZBBX$Px{di;k)iPj;xwBd37p9X3y?dgukkowDL=84e+G5ffRN?D^4@wi`7Sp9 zIB`cC^Lc5e#;+6Wa?UQj8TCl`u#1y0dCvG6=EX=cD;ETc23? z*MY_6o50CEY#n0JsRK^YJhAXQfirdB>P+h+?~A=XwI2mJCv%tYtS>qtI^GNENwV$F zz{8V_m&_QY&EcAURLPxVrdgBG-!)ZbxnCVNc+;h)JUJUn4|Wb$uR(6w2Z>HEL+ z-EV*NBl@Qqt%r4;@XT7~%3&DMmc(crtHZkabtv-u?~je>Js?I97o}6|!Jan#I{Z3* zN7;Y2M407a9Q(3gVqgci~J2g1&L+u?UQ29eB{c}TvS zfSvX#5b+&25wVv9!l^eG&yIJC6856UKH8aYdn8=0^L4)KngC<8r%zecABF1gu*W!V zS7<%4zYKbQmmY&jF1`KG<8`YDZBf{T5_e+&auqH{$J)^P&p2-7dT){VSIvu7hlsuF z!J!?eN)+{U7i>|Y7o?tJ{@yL{KOPg?gCcrE0OVN7zs`J7p^WEm3G3F2t$4zC%&G9> zpE3LTbnk9IhyLO3_rAixGe6t+uT)bIDlaNk(ML-0lh0&Yvgt6AERr#S(wYfqpbgeRuN3R&5%2(tnU+i4JXRa@1uK(wYgGFEAyPANfSEXcbi@LV~i|RVphSvsWL_*S$5wvPk3Q7$fD9peBHnlUu%tX<6tOXK{iOL93i~neT z-k5?gAVknOLQHCNh>bR-sZE{4qN`sq>i-L=HwmE!IlTP9@hdM9>;uKBf< zBJs85SUq;X*y-u8L^7rc``43%%W@cRXAP@wdyV&g)HQx!oQ2-)GrspnG1YTy-m$*+ zv9)%KW&J=UT|>-oNrdeXuCzZIFuWmxcL(V`x~2h&O^Q`tlT(ced^%!Rn40|Ay|*aY zk#<4vycyryq9cdI3&N|dZj7~bvFc@C3*`~#kTTMYbm{h$5toJXsTuDnCT7e=xixyK zIwRE=y%sC-E9`FD)J50TR^tltYvQ}Oj+VXaX_1(YJf4PicY~i^u~=O99Yvld4lkGa znD!s~(E`S|=@h&J7Y<}+TEyG|{Oyax>gNZ%J@2Zs|I}K|Tqc#{yWPt9=;LXwMl|mUzL@p!G(td?n(G-Zqua{Omrgt@6 zmR4c!nI?2U3bEazzyBxScI7u3cY4owCwdoqZ3C49dj{S@Iq0>8-o6aSj?veGwp2~| zVmz|F>Th1WLmB+37~5s9`VX(YHeKu-$WD72@4_0(n%a4WHFV*qz#DSI#bW&v&hBKd ztLg<|X-C;3ea1F&5XU9%dfbz8QtnkDv?cOpCCc_`T+OGtc6nRJ*puBmz2RWArw6NB z)7_3}#%@v7wUctJKN9}(Rk_H$$D!HOHiR-I;VU;yOuRW`{FlBwE-Cq|lW&}mZnuq@ zl$vI}!IFX-Vb}MkG%15kxWb-c9q(;A-;^G;9v0&)O;`(gYop6@%Co7nQ1jZm5;l8_VC3oj#jO&q;_zqBXJJa{thG@%RNr(K-(?f zx*Yjdx^Q(qsH}?B^MOELd&u@O?k4<)qTtR)8ScA1An0yKU$>zKj)VhYzfq>TNcGBC z6B4t>itNlp)ZoX}x8s@uxQCWd;C=h?TV_3eTeM}Na(Vo3W+fg;!n@!}mqSa(;QBe% zbhdu-ze5);LAU#J;J<13v(UNsvHtT>#a^9`x-zLp_@WuF;~vkWmVqu;+deTKcT>TO0+jO> zzuteMr@**Hd}9qkyM-pZ7dg4BJvNfdwn+6pQhmv5zvEqRaaVd*IOxRs_x5`y2K0ACJ3KZ4wt(SEoi_mO0@x9`VtEmB+|B1h3G z&<{n5QxwKGS|Xd$kwc*ieJJ^#ie(6I2{c#D5#G8j83}{AM?#H9#mN?|-`?_NwM?=b ze=06d^5V_@K9P9m_eBU-F_qiw<4eWBtQRq%i)>8*Pb5SpOc#kcH;9=%iRk;ImZ!zC zbXWBO5!rm{OQFVerD_Li^$70aZSCo4K57-;?#SrLZhRiAgj>arv2RbZ+@_3dnYe6x z2$u*Ie|95gA>ks-W+EyUbpE~)Sh`#O~odQ*8(tj4^JoI~t-msO^z?ei(aSU-CE{P=ci zp;S}kD&BH76RFC<{a&}$YZ*s&YPES2@2C|A+nnK-!!uj?NTcaF z*XRv(nwjOd9E#Nw%9*TgdruW+9;k^`RborK90Lrwsm>F(U1J_Wsh1-m9phkYve)>w zI<-?84Vy7mHVxXm_Q!I>jGpxw6McB+J_B>I^K@3B{C1}|GU4lJ73(vm_?rH>Wy1Ol z<&TzGp{1{j(7AU7g<3x$Y`u&*oXxw}JEJGM?L9HYmv|sqgqB`{U+BWCV#}TA^Je+N z*FD-WjoEu}v>Y+>vGo(Cl;da_>nAAZUH1+n9-(!^B5`5>S8}gM=_MVV z;e_T3CFB|N55~xqEW8{i>JdWo&#AGr%#thX+lMcDBg234{<8DYPD?Pqzat!ZH$&v3 z$NN2cJS;>X>#4LA^$k5by(6ECJ}xAV3TH>CahejsvjWC3qq%YwwRnsPP5t!tI`#Ul zr04K`3-0;HC8>Qs`tJ(VT5hq*fId&+H3FJ%8H;`^1*5~su%YK4$nA)xGc3o&2CvnJ~N+?aLqx79#<@}cMAEhhjFpeebU%RlUpbr^PdT9p5N3@R}!1)yAc5~%Q z)Nd+p>aW?(W!PytX9?Ib=LKs{G~5z5v%ySpj$yts(ARPGOmP89GT~T0)_!QNdde_^ ztiHzcGwPRGt}*9P=S)arGisSShurmmlGU2i#_6EBd1876${y$1kL*uqs>lXI>E-88 zDh5uzefq88vuEFUd-(jBcTazC>dz5csGZp7&ASd4L|lKT0TjvG(^=ozs+)~2Zi zB<{ZvDa`KuIa2g2o>|pvD9x#Uk69e8+wqUgRjJ%$d9|ZY8H+Zk&#Q3Fpe0A0w~Qp| z=M`4WfVUpmcZ_PwGK0RRYHR<#LDG&S>TF+?#h>t2*4rxEpig)s>+Fi;Uj{fo`3awt z*_Rg9EgD`FyzB5?Ig5K1TkpPfyY|#iZ=~X)@{AZZ#Rk=y$dvUmMdt%;~dD9M~ab*v;4!J>BgtYJiyarV}3NB?kesPDvyWW#7V zK+ium`Kd+IIRo|f_SY|YBd@>f{Z-fFU6$M2{T;25_a+E8W+ES9CNhG1j+~EI&qU-r zJfYuP+Yv@@gtMc$xT3*)`TQk)qibI*#>$9yrDbeKdqV%b!3wbTc_!s(IGBTx%{X4s z*ksa;7{8@Op{SNEtkOqa8rPITdPX!H3<=EY)On`-I@xybZg02)Jp#t-reITGJVuf? ztMV~(Yzpr6+9!TpM7F(pCEAv(>?ybJu_}@3F^X?YwC)YzZH`_#mN002v+JV?ghD$f zD9sqVBl|7FRdP!Ft+Qz$Y900{y)U=9+w_&9t~EB+oTwX`**>G?@FULcG)g8M@zy%f zf92zvO}&^A%fXK-L-TuaK0?=wEbY{uA1kl+RiSfz2u-u5SeZaW z99&;EX!|-I4KM>MEj_|lk1+GY=t@0R+?8VVf^^=m*I1GV(8sPYj2_fiM!IvwqF5Zs zKax6N;Pkargq!-WW({p`-k&NG56l&*1M>%H6*E0{W~%-6#kskW@cw+RM?m%e0seP`TkNZMC_BvqadEdn6y$t7GLH5|x>-gq#5el1#a~7SA^OjNBR3qZc6W7r@ zkax#(hbaG&V`CU*aE7*s`$1JB6vvFGME0bogdO8~U$>EsnS?SuR?CzTAI;!m_w1U~ z`I`gzl?DAsj3@P}$qQm-)z{)v%W0WmW}QVd?&JAG)PhG0qT6BkF?_IyLC8W_0|`0^_`yIcK0L(t->|-fCqC` zTn$hH`-1if)nYHMJSgeWF+UNHTATjZ1S?VN1<&QKk{59ef6RpMMO)uZ_|L5+xFc&H zGe*4J(|pV-qU{H8_sAE}ziUZ0Q3D4L8QNP`U@(wat>@Cdz+jN%+%|Xk<=CibOD@9N zi1Blt(9$wxUi$*WN|rdAFYx=-^W(-T!$^;oPqoun#%Nmy(AuYA{$ITc^=w|-P^>qj zRVL&62`X9r=yc~tjzM(Abw#W$DI>G6F48(-m`|YHU)}Gg8PDIYS)1s1YVR{ND;d4d ziTsnZghOu`1OI{+UvKOw;_~KDJKfon{ZT@H?%;G`Tpd*zNeMgfoI%``gO;oNrUZ&5 z`aP=i%M7u^*9T*LXe^$`lPR7<`6p7s`W04XU^e18T{wiHhaXYX72}id{A7JjOR+1! z)lEa}Mp9ZYS63K&)40?wIB^K~*D1ZR-Wn}6H95Zg6JJ}7nZh;?k4$uT8?hUp(TV$f zOGU!qf+MrUNyDm(w6f#X*MgN^x^ho(%89j-+!kZb)KpO3EI8(^t*6lmz1u928Y@8> zo0NgMC_z2E(o4Bzx>JNZn=94%L)`reKg}qTa5wXD^k?z+-f~+|?l`ATz}a-dsoc{E zCvs16-%53%M7z_MJaHfp8&5`9JKc6IZE~D;dUEPSTkPxw@0Vy6rwc<^nuGP1;8`3z zQ6TiIK^F8~%4}biTBi(Wmsxbyi8D;Ke@*C!jdTfB31_l~RklG}gEQKMQ(31~wxO5y z1rknVomANdZ5FYQXI<5IC!ls`T~)i0d&ngk({737PfpyOIl9)br;YP)da^_B2d;WU z2k*%A#xs=Jq~jdYt)wQ~CXSEgE}bo1D}Rmpl(3%fr2ji{8%a*?h>dl)Qgtruca`Cm zGww`ZBQ_HYY~yW8?8~;s;~LBR?;lqUsnrKgZG4^(Bff6^zk4)u>aISzGW$h53KnS} zD{ic4-rs&@y53$9x90u-az&qSP~319pKLR6um)`GOkWwXjQ!=CFP}lf4RH7xZLga`U5^!5w=pVGgwsMFAlhc&lxBQ1pTg(f|6oiS+Kwr z43?Fam6wzk7Zf921+F5$)9Z4&N(&2cghFRYpu`s}bvui_MZuynZ*kBSaFzs%{N7TZ zzqqWtsKoE~d%ZqyQF$rI(D{nXoy8??m(%GC27=|~!E#rruM`&D?s8{YKok_X-QL2o z(!x@Ad0}aJVSírd~e8o;@NwL#gR_ZG7xy#B5-GO3Pad~O5ps1v{u+&?MJS=i~ zi_409ZePIfEb$_1{H{WOk+;|xgfF7#Ee#e6cY)LED+!c?TH@9E=7a}8l$Tb&^S6b>vxp=+BZnw*aj41T`$`F6Qv%ILhI9TK?335YExXOH`-U26%A1E$!1q*yW zpC6`!g@N**yQHKLMHnnCC_+J$7kXU<#pT{0O5GPMbQP4AAUE9Q?m~Z{7&W5+Rl@5m zDk||77vfR4%-iSBR$sNt%r4BFzIs#r60Fp73*NhP7Q0c^TrPJ3(pc<7%$!c-N>NEs zNdd~O%v)9@-0nhG(CIF8qj+5YU{Pslpsd_qR9aqM=yH~qcniGcWv=oPq>xfsQ05F2 z1*o2sxKMvlzGZb`8b`}=93(EY?(n1t-X~19LR5Pc{UG73dDG0hzvkU!YMTnXY71QVS7WvCu&SJl_ z$nW;L%2Ce>3xb6O-h#5Ax1iMPD=mpTuq$(V?fvVPtX{jEa;2cag;aS1em|;mX;HAe zpu}GqEDMyo11?|CUtI3;`@AJ+k8YRSGD?{c4yyZ^6zqBY&US5oHEJ1}YFY*_Z z1qx6|fdXHkq@*n9^atIAafdF-oW61m(ku^cEUMzn=^IzBURPh6d2dLKmwfv%b6G>? zwB;$HY7L@X8)~Rso>{wL!`cmw%nh{-n>MV;#H*9FncvQwR#19pijZ$s3hl*7JU{sY z?)xvpMz5#5gVB3A9u%Dde8Vq)muLOM{7ibr^8W{~F^V_o!ClSKn$O>7LER?`JDzFY z9n&R>cz?W&4ga2)zmz)+ay%dRR>5Bt^OrKchajDl7qckFn2v}0KnTA#<}c-)208wC zH<-ews^N2Ed?{18NtbHk-=y*%WN)l+LdVzBC*|oT|5B4Y(@RfuNvwz$?^F+Nj?6gSP&`GGy2j=S&#oDQ}`(+ z`DT-xsoM9ejh`$^In5-?&O!GtF!?8-Uy)9RA7oLpciJSsZIVAQ$+;$bHKyY^P4Z5Y z+-s7bHOVg-Ff>-~%L*UMAN!eDO>#sPA81pw+5>hTY%8v2ubdPh(? zDW7Fg^Z%(o+Ki30N6bJwBVm zmCks+^w-Nv%KjK%%6k8pYYOi$*>{-y^G$MrNp`B?gR$dDS?@ocCVr91*V}uM$=|K| z>-~k4Z87^&mhV!KQp$RNCFNBnzTV$Se?7iZ*2hD)DL$p9_()lgkCgTJNLi1Ml)GZ_ zk+NPsQr7Fcloy!zyG?ShNv66YoeZz1ztohT87BEwQ~IQ=*C#3K`6K0OJ{-QDM)kA8 zBrh__51M3s{FC8-ZSaq;-!oPF?wG%nb4>C~lYGh~zh#miGReIr`HVr1kB`Tcf3m;T z$7d<){h5?KF?&+h=L=HaW$=$bp5Ju5ph=#k=Fi+%cqvae$xBVL-akwJW|P0iBsZ93 zy}V@jCrtj^OtM~oC4aBUU+>SQ|0^bcy*#D=`zC*V{GVmYp9(d9=-q4Sq)clk7-f22 z+9*2`;$=O4GJKASKi|YpHp$yf{OKnDUX%YJlRRXS&za=En&cXj{g1UVg<2}L*G7|n zzezr2lHV}Nv=*c>zj93Wr<>&WO>#z3eE54zGOzW(@vSlV$G4BUrt+Srrmu(1V-*Za zFU^glld|6bOL;4MYy5QvIsSO_RePB+e<|zjNy<}A{!Wvu_g|8)_qS5^8Tj$XUm#{D zOV6Dsg9JQD67OHB#_yq6eUS1SF?&+h+mDn#H2Ldmg-CyWzAEJ`lYO5_US*Q?`I8L4 z+~iMd7f2`l>Ag*(yuc*CVv@6B^-+eWH5ZNHX{}46thWzy{#Bdu^G-EC_3=&0OWB-| z@;;M%z$70w$?uxvBPRK{Nj__mKQqZU$MQqQXR1lo`zz_6Z}OjMlJ)*n^6xSE*PCQo zlR`Slf6^qMFvu5Egvez2Rp*O~)cn@ZH>CVaWkYq^$RcQr6EWq+AiRC*>NGywf1Z$EQX;o<4t*@`EwHlszVS zfl1cWBl%Al{Ns;@=h|<;H_BuFQudkTR+FrcCzAh+$-mwtuQAEPCi$#Ej*nlR__q{! zF53hSpU>*YuMR#J}uMu&5)@*{<|T(-ahNp^gjnb>7=aZSDl!R@V8*R zr7?<+ueT@3*ZV6e>+Mgf&V@5tC2oh3V``f8~iE0dVeLu(;7O`)rl7o{+|rtJ&;%9_)|4|C6FJ5 zyhM}9o<2U+iLsC`nBqGVvUKuzvrMwbB>PPAB7^(~96tr~E#vWjZSe1h|4R59^Xr7c zzX$%!@Ly(#|BTrDtxh}u|91@G>mYvtnU)pe{H!qWf2P@%`Lj~357h>L%Ac1_@?nF# z81^S4zi-m)$6s$;VY>df(j>1k$@OBJ79W}u(z<20#nLX+?s#2D%-_}+VQefIbHltlQ*dH z1d%`yf%9WaL#=s2i!Y@m4R>IEZi@d!E3xIb1=8?^f!}B{&B@Y4rZ{TieOWr`*Yc+x$4SHa&U>2twCZ0fzDf;W zb7X&^CNBU^!}YZ;lYfE6mHrO#FQ)QzYW#_6_t?ef|G#PFNn;L5SNyByS)|G{#6*pMN|kRFkD2OgiRS;I>OWJQ zH~I57^vEn7&#&dbte+kcij)1~4y`<7c?AVt&{y4DwY+8tpDBG-Q+{nXmH)40aCQBZ zG`zz%O|y3Z`ZS!c@i+IVe@GJx#H(6$ zTgdSLu7w|u1EgWa`Z6v2DK-6fiq)q0RGRG5(;Vd9Q2C3*>sotR3SAmj?EH(V{Y=pE zljg{2;vSJ}%HJPo_MTMzmx@DL{Qj)UHR3obA*+lACV?AjtzgqcJ29*?!C zZWm!KzGR2jeas}R#cMjS{b5-N2(z66V273$G{1Fd_0UKBA4oo7=2w!wQR)e^z79A~ zvjZq>S_eSwpVLT~`I*2DZQVyTZdyKE6*rC3N_Mu&;}T{&fWkoq0!N2*&QCt4mF^Q40Kn$7uyDWPz8V&gm{%yC#j zdMytLvwjchwR|AVdcfE^krYM#)?pT5ZCyjP9H$Udevig>v&4Sv*d}4NITzURRmqu$ zU0$Zd6i;5qQH^Jt%yVNr*Af3~lHY=zUE>gD`@2c6)gQvFr=sHc5N18i%N$ej2bY75 zZ4zdV6`0q0q_DQ>_=BT7$-6~`YFPe;Af=J@ltx}(uo{@-K$z`Q`{HjJE(PYWNu)2p zAKXpY_*;P!2^W%9u0h7@AUYwlO*b&FgGiY5$-s8)L$8EcpK8z(WdLn&_FedcBg{7GdI#s{1>yuHpD=U&YT$eU%-=(_CIH_i`Dwshmk4v%Nx=MF zLYg1vc_p8&!!xF9{*2S$&EFrSrs$X>`MHFtlcPPhyxA&L*TJ)Cn5r7*KVgo82iQRk z5ss2)Z$%>p1@|S zQlWajHK|(19G^a@CTn`atUn2C(-tK>1MJZ7FyTA#2locHyhSQh*QaLv=TO=1kb1R! z-6e4blE>vjn2(hS?9ez4U>kKLaPvq{oh4i~u)PO=8s@O~5Qk32;nX(unB*AS)Mf*R zrbo7=DqT=p%UdS#USK;lI5@&=pRR>C?v@;CclO66hcI(q2F}y+`4z%iT8;oawDLLu z%>4ji4x0(n{Ebe+tfxBTSdKrq3T*ZtB9MlelLFaMr>ZfRM7r*k_-5?5P7-Fm+NM@W z4h=Kh*AZrp+IF-)kTC11n7J(wW_>2Qs#Kw9x{;No<#s5cF$KM7&`#(!PVGgV6 zpSoHo-Pnh{Rz&09W;M8`cwOM03^1#ormKa)metdO&lHli9uTs?fwC|T3%3D5` z%Gs!M92%ZTVH>2L^4zgWV#;&IPQsg|-i@8@K8a@#zF*>5*f}1QnDUu9O9^WiOQ^{6 zw6JP?9)bdn;_1+^8lNqyTKx{8<6()__-I&-&kv-Y^2*UDu^OKyiGA4RZI#%Movm5o z`3Aij&lah_hd5!0>#<{-bV!?Khp4tT$=Qw_+uu$4R;k}(z)u=D`wW=Mo!cy7E+eWN zwhsKkO~Ph-M1}I3-5Q<>757DiIjovL6e&10PdX)@i=AVK#Fd1*B)${7JdICj=Qcu^ zZBltTcH$3i8#en-WxXQI9P)N(cAf^d?ZO}2v)I@sVdg&%%={r>+oSk{qkcP2i}OTa z2W2YUbZm_C33roLuA7?IBe7cUk4fyoj*m;2k2?$4L4^ai0GsV`70Pd{Yj_=0JSQj2 zVH<&MPv8%ZOmH7Xm^o^Ce!!`mts1d+Xu`z$NG)@PH(@vP}P@T6Oz#kmxZO^Ds zUE|o%C$SGZ2NeR`ENqUSsZbq{@-)tTsJI;wX8SaRJANYh)E4r7F7a~gm`|Ably=8Y zC1(S6%zu#d2c^D)@N*LHB>W4BshIPADKTXY*IUADpQ7u~;&8~oAprFI}8JG6~K8>iPie4 z%}>nr)Ao|&)L_STk}%s`1#J73nGmNb zHO!nTP_dm{U>-*ZGl!nbu)U%N6|;yF)G>4BL(g{TIf}gBNDj?c^Ztj#cLLk`C9VPH zbP;AdtAN?g{lwAogfMfq1KS3qo!!LI&T$AcXD_fr<5034zm@zxV6LBpnNM?9#}UaH zG;jzr=M-^{O3oVw4q@iJPaG;hxC;gjVdhZhYd-`9Ibhb)^W2ws<4xZ(B^9+LQ3;zwnC2s8gU zasH>|oCMB0A#rjd`0bKUnE7;#mfKDSVH&L9rUK{vFNx_sAfLYz=CD5EYiXf-e_U4y zGl#Al+kPkQ+(R7gIsjqj)DcIsvyM1gJ`-ln{RU18akM&5m^s@GoF|F1N2ZrBa}E&a zl#I_o;%If1FmveM0LSMQ;%M<9%$#Ee4qY?n_z-5!Sp(s1% z(SQJ#jLr7%Dpc>CI5a$-^yj4hX6*7tB&NK|J1;Ti72_IU+aIOA0Xv7re~>sDwgTJ# zBsqjR&PAlx(n6T^Gl6aI;Sa6?8{>O`nNOJcbq0<)Mr-4mag3%@JGMjl#$z90wxi~u zcHAE59q;20ZZ9_bi?W>(WuJ1p{0IKvsLQZ@ph7W-o#X$KcnCWl%LsE= zYC?_=C1)7By#JK=E$p~&B+UGGiKE4t4#W5Y@n4d0Cd~Z50z3YUKez;V^SDNsIVr$- ze~}z@4xrf~%pCQ)6B&k^Zm>g`IR#|rBgqL8M{DndnKKXA@v-FGNgVBZFJa~^1-5DN zSwVa)z4Zp%0L)Me{dbx*bZT~vkRER zs%=>dyT_p4Yrwt0c~|fUw+|bKrM7GnGA-1WxegHKV+{g36v?5s>`0QB+A`Nk!pwh* z^aGMZnDy@f=V|ezc5Smrj@p(V(lPVZwoDBdE*U%SiwHBv2JEm(&Uox>VuPC59*kYMQzrWD)lvlZ4a6dzsZRP+w=wU?KV`Gl7e$p7koVmo& z@|-Z+sWfmF8#siSL-m&J)DuT*Uxb;n8Q4Yz0{0NMymX0MfSFI2`Rdq|Avsi^IsSy1 zL-p1%L2~+tqxGePnM3u~F;Q};-ZFYP4IaIU`s`zkQ4IIMEq0<0_9%BIyls<*am$)S47 z^LE0_9|q3T_*pmx-yka}usd3h4=CVs1qnZK7fTKp+3 zoJPXTQOk%bI2@&g(@2;(w*os{lH(&>EO7<#wfGZeKBdLsmYf;`hcI)tlU_?BVb)Vx z93?U=je~hb688ezpVKk(X-@0V;@?jkZ9YJlImdySqmFmld6RLxJ8R(37{_)9vz-rt z^R#18U(N9+%$$5+TbYcf8`wbu6r2Z}<69EXB1|0#T%`f4d8O4uV_vNy&bK9hoq>Np zFy}vEjzc4Go@Sr=XU1xtAD4EFdHxbOoEE}trytnnk^CdT4zI)~fbIXHW9FZMK92@r zxHkxYN8)q9JWdg2{`ixiz0y<_6mCx5(lQ8So z0JF`_#L?M< zPm=S2fkT)%pAl!i4!~tfnDq;Qxn2=w{c_U(FKLr7>+69zuhs!ix>s@tGp7M~vZg1@ z`iFqIObN5T1(GvM4V2($hGuuaR) zK48u_!pu1c%=t!`^@o5t-w3n*W#GJ3GS2HCsHm^tTxCu@4btp5O*^O-Q~KL%!-mw+Ah(&k@*C#}{o^FN1vvZg1@din@1=QCl} zr;=VvFJab?2j+aH_dPhD2{UI3Fy}L2)@K59J`-j=y~96gjf^v4);oYFYkI=0F97B^ z6J~uWaNb&JXC`s9_!DMM5ZI=b*IeL9>lF3cIbr6^2cE3y3A27NFkiDJ%=+cPTo!8# z9Ky`mY~VB!=eIJRgqgF=z}ZEdpGXd2<~#xH*dX=2#9uG*)1==hG2L(Cav{uN`+&Jz z2(zBr^%3Ak_VhVQRjbMKP+m8)wg;592d z)sAJOdsF#d$D4{#^`4u*v0($nIkaNghS83-p?2fS2Wyvv>T5^mY+SLju3^cBt5Y?q zN5fhy)42v=YS&#Is&2#D)w=i9)o9~=%dQbBw06z%C92mbxwdgx9nukFT~!5CuVouI z;>+u!Wrl9z`aD$R`r0*Dr%cl$+sS*Bc-F0~uV1oZ*_!2RS6^+x=s8OG(SnYqM}r+L zDzg0QuZ{+Lj1q;7D>kfL^L>%OW^F@l{%!NB@-{Xs3qihib=DTD9nG6+JKEQ1-r5?x zqk5w+yiRCpE7$R+wqo+85Z6!}tCJjzP|9e@qs2=djF?hizj^f%7~X)&C)OcYL)~cM zs5QpQV_p5ShPt&IR;xXf>QTFT_1ev~qXjmOl1u7Gr5OfFVi}XB4g}K7wS3f&qZ`(i z=Uq~}xpoak1FGfsjv5Q@5;v`(W_NWg{+>S#8M2dcF41g^QUTf0+I0;p*REMsU;n_8 zxI@-$s2w$ysvqYN4HVQ{qVXAGLKdXVO>nsj~YULuMLSBbi12Y=ZCJ24I0~Mrs_As z3yr8@8SNifO?xhjSeCD@UncU^u`a)iK`Dd65+GQ}ce-OL9Tl@K1`3N1d*Wvlns30pOf;JHd-UWXpgQ_9>B(q?cEEW(VidnDnTN97Hn*9Be2mPof16= z9Xqy1;f(h7z+MYFIUVo9n9*JXJhHA~Zv-Txy$0B$cvCvk z4fb9&+3P`|4cD+YXtLJ`d-a;V2?l#VO_A~Ayhuj*cntO^?wQy=Mn6>!JZAC6u%s7Z0~zWpD})~pq?#YW7xC3dEgo2cMdn~xE)P5*jr+1zc!39 zHP^7W2t1>`Dc{xm-CTn`!p8V*fW2$QZ<-dygFU%k*yH#)Aai;hrt}_xJ*ubdIK5vt zrS~n^Z#)jWYgFtB&oRf@F-} z6m))EzB4pGL`9^T^6zEXqpp@;y_p7kGfn-$<}Y1)9#LlM5BwM`IlUf(y@yQp8ewk_{Mm8*?lak240|U)qV)Q( zaeD7I*_&v)cKq%%*_(cc9zVaq9^FnhmTwm9U8_Hx3z9MaJO+C~gFPB3jrQ(@JqpW? z)BC?o_3uvDdk#EGFVAhLz6_e`^V8$x+}3RGHzs?@3(=25NA@rj$MWwmurYqNjBD5D zUut1I*pvGlod%chT*zD=Up1xI4|@mH5b}@HI|)2v{*7OPca=b)_|3z{_UN%SWBfjV zy@#YJ^`GtC1d`ES(o(&@pKq{dK>(w@I!uCYx`sV!C`NnRV2{&_t|k`0a*U5gdkwI+ zlOqKl!coPcDXz<2TOKJ~AoPU)yuV0$=-54J*dAPqO*GGd|bsWE)kSGowRf}^*7#N8B7bL2@QjW)Vsyh%ter-AgD zx%fk!CjSTUM@hF~`({CAoHL3N%YS!Kk;*G{<6ChmTAK2Mz}%ps@Da)Of5nau(_(Rv zJRWv%)5UG@jZ~$JlIp6e+dCtc>MDEnH1XX|dv!ql53Bzc1sZ(&+g_b6KI+7`{#B6Q?yEOyxIEr|>Gqa^X;GV$QKEd%Tf5T7|u;Rf*njRcfr!Psb?H z^FI-hJKDs)WLI5=Vy|jbNPBl@^u94l&6s^-?%v_5s}>78vkxBlV&}j|>GswjzQ6sN zz>$J`ywThKBrZ3*k}r6|&CxLzJkj^YC}U@h-Ep~XOK0TOPp@p*v9NPXQ)sDGv9|?8 ziuF*pt$f^==$L+wWvk2D@435cOY85uLbeyxvWi-s^SCU%p4&U^(=1|3dR6Dv#=cf% zmJ(>XO&N?#$Pph+h;F+mqFXPC=AR_v+u;dfOGY&Csd#+H<)*0hIZwEWY`oTaIlOvD zh@aUVUA-wq5dUX^vXYc`VJYG3PvQcG+J= z*w%|XBF8RWiEe&F{9D)Mt3JmIZT>nRVU)=fKH?;l3Ke3Yh~-`W@wFW}qQDOOkV zQL)E6#p`ah2QOXOv|~%x!YBfoOE}W?YCcp{jg91hdf#SUH*jGUL4E# z#q7f^&h~2^tqETsjyygM-$d5GqTJN)3P0}2>K-zDKiFj{Qr4%3mWIW+q=8!dHp_*q z*5;feS0;KRueXZG8Pvp!R^_}}6OZnQRH7bQUPG%uE&L=&IocI%P-|gQV8_38zS)(X zf98wSf%WO*l0xf_BG$%la-${gnI;Ceg_gb{4sQ!xuqu%~ZsBf=-1q90zQ^{KM=owt zqOYNzUA*|ErV-1Sr;9}KGXRc^% zI)^W=Ug#0_ZnrobrV`3}Y+`xjzOdrD<5OY3@6#_Se+*lwl%5xdTbl6o^`<~h&z6kH zrK4B&_3ZZ9!6g6a@VkiTFj_-sXSb<5sdnh~C%+|9RV{McLrb3*k%mi3$o9Nw>bGZ1 zRcnr35BMABc8f>|Ej@rVJnsqNY9-aNq1N2CXxlNdw|vWly@QY9EApXrVUc2~=q6u1 zUz+-re$>D8slsKQrjR8|=lYECzAfWjulI;IJEJ`ZMC#!BjKg8&oPOl^8c1K!j#O3) zJL1~ZKd&`(p-8cJ-y$O2h;jG&bZYPOTBFt%#BSe~jPa-)p>s#nwiw?MD4Y_YP#t53 zy5~J^x8l{!uH9bOW36b#(cxoa8`_&Y9NIZeiLY16ZB2t6XxXocz25P@an_lSMN2-# z7wugyzAMI~ZO?p6w(c2W#GLx6*E0n5645ai&{N1h;d1Lyh2gKoB*}Zp&S-yw= zIePfC_^c=D{8NI<@}~rMx9dBviM~kozWc=Z;AgvBFZ@_!bVm=pn-Fb%7h$8(1H%1e z_S3H_vw~0Vin`wxJ%+GRH^M#%+Xr4(L`CzD$0&&hZ&MO~(WW&2;#I}1N4HQ_MQ_wOS6;HQeaJF<05LdaGpT+J3QwfjiVbP-J+7E^qQPbY}z z;r9}vZSN)YJ?47hCpcEb8Wb~kyWF2(+>NyPM0W31@yb?rYiMT%T27)+dVAVJm`in7 zQj()#i}#i8o#oE%ZNGhVjH~#l2>24|ob_uR zxjo;$?QmPvdH^N%n#a|8EFm&HL4=lmigw(OnL^om>)Tmx<(#c}W8UzBGu5XTox0~_ z&5639RmayH3vTyyywdSoLr%-fP75(#LZJ#Wb=#S43~T zRhj5X+<${;o|X#he@e*jcHJ0AtO>sxzNhtUEbb)dv<|nfYGW(oQqhmweyubGT$Wpv z#OW6F5@pKy){3^hzDAGhg%?HVj_3<*qG?B8_mtm`8}n$=qt=k^RpdGI5%Q=-iDJfJ zX_E7XE#aYXO>0wdUfaj>YbsAy`W7Bqn6+rvqJ+CXo>MdT^jzQVhi?DcGVa^BS3KB~ z+Y*kYP8n%_Z8_Fq&kA!)m65FQKEtS{49MP!N|v};VV2qQ1M98BS!Z%iSDc!6a>0q} zp+(2(MvA-0p5a)Y8{sf8ra$b;FRSDX=J(Yt>J< ztPS22>jFdWN5iX>d5BHId zRa~2TM2)p}$K5+<%+0c37CPLj{AtJCUC~c_#Chw!G5^-Ju(PTw`{2+Q*_nN?_h?FJ z-ODtJ%+IRaRhh8xyPSTdWDg-I3O#SM04*XoSMdcspjsN_x|PeOS(ne=ldo!_x#t|KWi8A6EY@3N)C> zMZnZ&#*cQoF1;q&n=Yy|<3rtcggF$O8DCUq#?kQ6gpsBjJMk6yK*X{Mv*C3Z$qoy9 zQty|P-Us~le=Qaxk4GQb@1eT62<@yQRyUOqS%0|(Y#FcgF9@Fx*TqVvucanDY>=ay zFzyCJjWjP&dS_Q%op)Jtcg>~z>#^9a7m_F@VK6%b(exJtwOeO*ez(Q4wK3Q=xJ{YG zHR&tsTTkvgabRfZ_{n3Zj|>lbEwE2 zRU-1>MJ4jXI}o!ANi)xcmTpokex>(De>A;aBu=}5?#3jH4R%-t=jIO{+#5+x7mr$= zYVYe-d$iX57{7)+(eU9|j~4dZr`#g4hFnjy2v_HJ#g+7&XK?mBw3wP$X=V35F6M<# zhS#(XwJvHKYRfv6we5p#T)O8UpBMhvz{X6)5<2%YVIN;6e1Y8Ek)#i=4iA}-&q^hP>AyRxrpLD2rfB+=e!@1BN{EZJ+hF*1I#a8`B+s~1m`XGuUm!v%q5H|pI-5`z1x;lzP&t4J)^m}{iDvK zo!c?KjT;l%d7omj)a(h_0t%(4PD{_$%A8ovQu>|#KX-(7jun?Yb^c+0aQ5NZITbw> z);S;FRkQf?V&C0|?w*ELLAAc5G&k3t{LDVC`!pZw>)GRd)Dj)@s)y!4G-nj*g!EH0PIooEo9&Tfc)Z@Pb?cp|OnLkmaD9WJbC<-~ z4*QgE2z&Y*kvkOGohzIRE5e5idxE~ zA9dy*vxkSS-3 z5_E?T1Sfi%zdlyDie44tcDUT1im&X*>e+*HgmGi(Tz0ck7d~J}pL1bal`>F){@3Q+ z?VZ;~=f1AZZsl)XRk8D5^sBw`q3l(kc_aI86qnOopY0bp>X^@^SQAhNG6DxwdkZvs z!8m(WN=;SB7RLPT281={w$huUg}io5suU&Yt2!GV@4cLE$1Hzg*B4eB&N$qyO(T>B zz1(_kUlTrHkk=rN`lz1UQh~l?QR}`~KVc1ge0NA#MAoUMAmybs@Ig2SdAZl?DtcX{ z?}(~7xvyv9Ae{vuCv81SjvupJ%cwPN%V-LG67wkbG>wCwTX-1d$MxZd*cnBBPA^m40m z-WP11cI?W-mfJhC^ACKnpfW2irx(QKa~5XIi(0onevU zg9{HY%vsd4$a>eMIdyY~=LT;-eEV4RKO(Sk9Ujl#xUw!YRF5YqGdI`b0n)W=GMxqa zcx)_l`ih2zbsJ}V^PBgsY*?|Wh92AhW-SN#COvbSw{FAQRkfjpd@wTMl_x_kaTYj> z3rd}3w+L@OCeZ5R>q40dm}IkT*z9tybgnC0vf8<>U`dGn9$by5a0}NJfM9ap#`Rrx zN#dg`*(|90L|g$dx+L*K@H1j6DQ`E(@qDYwUlH?{vL4=QvY)K-=f(I^b{ph)`zb2_ z>6pKi>Hd;*DJJ`=DnEz4ac76pL-%*2OEvLtQvLPgOIhdNWa8UYeioa<6>74-)Fjh= z5$U8q-FId=K7DCwcq&)vq}<1%kn%God9F#;kC$eO?|4)Cq^y^Zl()w0NqMq}&nSkeM~eRf0F92hnKQ17GBDFeo48}w(j^}5Z>`Pg&un&rwSL5u{x@DbF{_ z^p3UBzuF|z``AYR7K0pLK5kR~ma6%w_ZL#OvN=2f79W0w%1?{=OF7vf$MbJBg`a7X zJ*vI@Sa>Px{kN2#Hu;}TWQFv%#`0InJto;>lAkuo_nYK*O!9G){Dn!rIhNn@_@yQ} z!6Z*L$tO+ep?Bw{llJHtcB6d3B%d+KStff{lk7Li_nTyT@7Z`fTI1I!(=&}M&p>~v zJD-S`{pz#+AkZziQ#@RoNz0hDo z-vT!cZ%Ay=WNK4s_$pGNmj9Wme}Nd*j!$Di8lHZ+qS>c0n7&7q6DpfF5uyH; zo;M_yi7jseA^F@7e@`zTvRxav3A=~@=f=hyDr4K1Nh{w4u;H0BaulCDtzu6FHhwpc zZ5BY!HmU76s6gQS*zAW@sAA?UfXasFdB{DD&4%Z<$kA9~`X^D@Siw~lP7r(@YD zQgAb{*(g$QOR?Fe5t99bEl1)F*l|1wa~vq^`8#-If;ohlLwV)Uo_V6<=21l8)cpU3 z#PhLp)?6_6(E3xBm+&x72+ftu^o#Q(aQ(4$N603Tj#FSK9xj`S0 zSmje@z$Ia`%~GLk*Rv&_i9Wzak%9{no+EK1;kgpi^Kmx3D?)A?aNazLx07DO2MGU@ z)MsMH=_SnRoes?3I-|U@zk)wF!pxzl@ORIs%JR3)s7Tl*Vdhg7*sAddw+b8EB+MMj zPu3G={Wf6!jv0+vwmb0$_iJo+(^3bLYNR&-^bP%|=u-T8R zP{kaFcc606!Qno{X8)B6Rm_}AP&rmgy;?56&@pr9nQc2o1dcH4r%?U8SL(BX^R#1G zp|X8n>Qk}HtCyJccFF)a!fZ!vYwJ|Cn2()pgTypm@VCYKf%7&>y_)t0iO*qY+a&S3 z*yU}O_-2aReG*f9;sZRnDzCfKP>fxSx@tB{^l5+^K)3j%y|ab@qi3_ zm^hjp!pwP>^aGMZnDu`Kw*5D$r+2yX9+EgK0s1Wx=NPa9IPYPpcar`G68nMqxP;mM zJmNP>&SK(km3XNEKS8)z>hU0sur*117?|Tsm~9>-&V!OeWzFSFm^tL@Xr+I7ZI{1e zhM>aHuBz2%`}zB0DNymT2(z8>20dZcPY1Sj;SbJ_EtYm*=1@1pb$~GIYk+M#@CQfL zl*1Bc4i$rKC;s3l8El6zb9Ni_gjs(On7=dTrt*zI0Y~-CMnt$eU_LHk4omMU^Eb!n z8kDU^@^=I0(F5Rcdx1GDVGjF}K~I?V^q#5XF&Xw8ux*dTR1f*PWFHWILh7j=a(W4~ zozH>uekeJ#?wxI~#BN~6k0hQ6%yA>kVW}Rno-pgFPI5m(nDuK&e@NOS%=!m``CDXL z3IDU?(Desfuf&Id?Z4JBhwUf5);0;V{se`6O7cG>yiejwz|1Gie4HW*$B!lFW?lxx`X(7xUIyYoJ zVb&iby_TPZSw9TS-_X0p>P_m(5~2DB1=d#zY3pOr5>KNo&Y<$KtV8XZ#C^hTJZ`~qbxn4lH(Se($;)3F8-h{^mIJ~a?PjfG0e+9nU`_8URYjK zZ(F<>;5n! zgk@{g7Pe&NsH*^}=4mCOze9eM|g$FTc*mJMqx5!!WM89Q+fuN>P2+TZ8HjL!Ro0W9BW_{AkC#uK^f&G|kYa zP%4{wQvi~n@u*t7LzyMtj|@U4J#93Xq)Qk^d($D%`6xTK=YYa!&jEW=p(A^gHnx|K zvCe337lbKf-w?lKklEhvfQ|P43gG}7!=CLO*TQ%-zZC|1G}mQ&e?xeq zJ-TN?^IUdpkLF~?_%*`bRFEjWly7YB4<>swZ!cwI*t5NpCVNjC?A>Ir_nImHzJLLm zGqYoRr%d^G9QGtbWrv%T{GMthEFdV1;l zAlv&Y!W->9XvKW<8uliEXS9bGn$&nv{H7S}b(+fK0PNj*4SU;6KoYujM>{^ir+lgvtA>; z9j5s8!U*-_WRLnIjvuXeWsF}XIy1U{!;aJYRq!Z`NAoE7y52r=p<{b=-NI<^And)R zg`pkW`woE7-t(|`Kl~|vRA1R%y~$n&?wxq9k=}bv_8ds$3C$jc&X~P#AgnQdL&)Sz z__O2q<$z?2-(O*m+AYPe02{~e6oAp*2e3!|EjzaNKfyEFv)!WGbArtFzGt%cSJJY`jqj@Cbo(S73)%=h&@fU1HdubS4va~R?V|yO}8|`Hp?9I^p$X*kS8SNFp9*r;T z*xo}R8SVWa_TD`%s%rfoUz=gLiHeS(g6YU8DFUf@%d!9&L`5@2Q}YG`1cqn=UOJr) z2!n!x+K8H&DPA)3c*-g5bkYMPXk=#QEi+R~v$C>ME4%o8KYQdS<_WXMtb#^9hhDldITBz-+`P?&~?Uz!5tGsV%-UhM}QwT~W>nm{rX+5kXw zmO=?Za(6L-|16gdA?6AAl^WBiXxZhm zaJl)u)qV9Xj(r>bkahn8!Vg{g0i^qZ(eVpW)>f@oR9BWw3K>bg7QK0??`)0`mP9)bWUPw(fGP=-I%&-?yY@8$p3&tp)x?(n~JFNb^PN2l7dW@V<&{vY&m zWz1dQ&r{vTy6%J2$N#_3&*|Ou&-8O!%8c~v?5vb1Thz?d>36C3aOIZW)cw5IfZqKS z{vY4ZkKW(-e%=!`Yx0U|RcPh)g;I^f7}JWW1qE4;S;AViwsa|MZ3$i8+G6f(vPAW2 zWr>JwWeI<;=)>YB7U*{BCI2;##*(D{osh8AIvq!zkr}R+n2D66`n0UyVi72_x2) zy()ZK?M8QZ*p0&EBQ-Cozi`t4k2pp9>uwh9J9e|m%X#UdFzh!9!@fXasP8I@>iddX z&-31OOGCZJR>XOxddDtxUTiB(fX|j=zXjBEHg1qT;9T;d@}2c@m*}!|shy$$nxL_0 ze_s*mRqK`NJ-OlotO5+EhSvk6-6YbaqOQi@3}MEbFPHmcEvPM^Qka_6c$@rUeX@Ng z+DE%q(ohZcD1+cVXEk zVe+f-$!;I-J6f~G^Pm)_$$8G;k}*M3woGw6HB9vPL3{c5h&}N=;iYN32(IsVV0Oct zgASjUJPq+iAyu2MUX`4I4&hws5YcVdiD=J)80U#1v8UYmP=(l2;XF|x1}$~2LQHaz z*s#6skl2QA)XMOv04oQ!=JHVc(#HZUM`U9qVTwnA7n1L6ZSi z?vt&A=N0G5H(}u+;aqh{u`;w#R7nf^EyvZ?Ub!!{k+OxV>#$e**_M44ydhi;*U;17eUh zB7oc2B)73_VIC|D+9;w|Z4}P7I}{61PpCcAA!-kGh}v6$7_>2JZyRcFJ8EyowciSA z2EoD_`O0zE-j3A{`vHTg#K(Ah`yRCN^&4&9=CQ^vx@2NZROPUhsC8U{a?kKqdIt52 zc7s>f7>#t5Dc%cA#_C^-%r&hIxNjA8iEVA@F10S|Uen4DUf8NAJhqjght#U5M@_(3 zteb2Tn;5$~_FydccJ7C}akF+{BEdf^BFi1eN+gG)M3@}#$~5;{%jg!biThTY90}uQs&?VMz25 zMRhp#dyAq3gD8Si?o{tuWArB%;EQd6ROMak<@{{F^g%_txFSme{F^y1_(;x2z9+8| zEA7I0ah!N{sp*)vI!+k8>=;p!FpPVO_6#7kQ$O?F@ZwFev}R)52tbvHZ2?zFe7omAV|D<#kta9kL| ztnl+;ze#aEvCHa?)~$Z)z+2tWmt$ISj-mFZ+L79=u@{eirS=5d75K(L%S-Evtf=FJ zAYm91CW?miLtQ5bL;N^V6rX{5o+Cn0x95${RCts5&C+`0~ zq2A6*ZKUYTMey@v7*Y>?$B`aSjfCr>*89A{`Pui7bbhi=(7ir7176tD#t3IxJ1P3o zZc)_TD3W5^SjStPkIWGPL!AfgxMHG*cuRvS68810A9$d51Nl5K`N0>SXPw8d?H%^w z-?|C+Gr(c@yx9}0>A5Ble^VPzaqcH2V(|^4QEEw>n(|tdRAud*Ser0<$mvnlNy|pf zDF0yTo(ji9*Ca3FUo}N+r!t49NT4{Y%;?9J) zA)^z{dBVSgr&W@yYh$Y82QA%DG4OzC{6fhwdZ93l@s>`FEiy| z7w|b}T#p{Jw{+l=ex>9Sh&<9r@#l+8f$<`>GS+wq{eMe|VZRsph?lT?8NCKAwG>={ z2RhrbEog(|@TuYUa1@&`44x6V&1yVrd}~6Cc=pn&a#{26LuCf*LG-iJ=t-B+tA0Vh zTLRr{(Yv;zm%afHa&cbgy`nE|7S2oPch)3GO%eucHc~txa9{9D^{n!WGp2e?UTR%( zth^|}AL%>5AEY560$T2c%tsZ_;c2aKe&!>^E*$~yI1YGuI8%#Ls8R4y)6tbdIkO4Up*m9;59MV-+KQY)`R zp$Eenh8-ALPadNtR`)C2hO3n7-*$GFFm&-1dlGDCOGIti-r|8}g*8%b^x}O&I%~I% z#2d*GmtE1uGTbRWQF^0rl(Z2qms<*67j{1jd=?r#2QAuFY+IHg!86Eh(i@Q02^~~6 zO5Yu2YoPS-E}%(|_smk!*fW*KaN{j^8pRh<>b@PtMLoR49`vbvwNLdfEv$|!BM%$> z;0?)`MD=60juXY&wQz<&M1Cu zV{8^#Zo$qOMn8Kq$Im~D!m|>roG)p6yyDj=RQAkclBAFEzHY|*x*6~5X1uR=#`}6F zysvk{`+6t5uXn=xdMCtpLVPESc|#{l)XR5-mnY(>O1}fRjWa{=p6lVJrQy5r!3p;R zu^S(V9ZUSh^aG~k5Mi1h0>2$;!co@D$0nMK{`edLk7amg^L63=coT;gA938(g9?Y5 z0{aN#h_JFP&zRt3-O=1Au~hh4N96=@rZO`m$JGO#@=f%~4jETs3-A?eq3lBo&rCx? zAbM<9Tt$6x6pe?S6P*3X;+~193%bgc}q>sucRK%8B!rlwAbbC3-5?&Kz ziP#Wy@o8zj%PKoOfi+=O5v(#avZ~5uRh?{Ak;bYxScRt$tg0!u{x_{U|Fog*EnGJr zptpUF-#0(u*GVbfHl7wm`(D8Bo`0(MnJRC-(@b7kR5uio6Cjl(40ZESJ9MY1^-eX) z_nCTMq-`%Imly5t4y||N`BztgSUfM>_Zdr6O&j#9AWP`EAWN5TgA#qNw7weL;A;Cz z!I%AF6S%(MRaBVr?-2H((g?zFBd8Y{n{jVoxg*8xt+s#{aThf|s-}eVM~QVU%f!S3ns2k(xfdLpXvT z6{er=K#y&@_d4u;K6+~`VTEli-IlktgcqU*EDy3o6$V<&phH1-SsvsFd>9_F?!o;w z)+;lF%U~+;^PzsM?Zxh%BaJY%87|6)MlUXlah5$QO?ie(MDm8NH9qfdD{&p#xb zpA@54(A{ti+IkzbypDIvI76y8T`lLmouB$h(T_YL-YYlMH=q}sf-jSz{a+xb8-jeV zp}jq8mPTJ3Bdkl0l~2aiP=l-C9Iggj5x5$r*roNbHW1bZ!P+2L8&p&a?|S<~U}+EN zxd+w`hqVvG+DBpSUz)I%dY){pZ3V1d3~Qf(wJ$=;ziw;o+pzXS+1f9W%g;?(>j)Zw z+!|XPZTt{#h`90-@GeN#{g7+8lh|<=!F?hg_X+E(g6am|gd1J6R!HEgPDn?pe4)Q) zjYu0P-$}aSPJ(X&P2EYN&`M@l6Nr3>x<&E5Iz!L_)tjzdjWyUY7 zPWWZj3BRm5;g?k>{Icq3h$!q>6cO9e5Gi#mimbT$x$m(okQAK5`5_>H_-7HS_^HdR!%X+GhOX zdKJCRDvI7jiycZAMThc*;a#IBdN)uMRilO8?klRi;=IpO8{@4j`r>E!g@r2x-#H8; zATt~?N%%(ObKaxM5ZB^-i>j8+OReF3+J-CYkQDvNHR&_f95SYQhI-fH3zYNGS48xqk4OeQ zi;AqrMD*oVkh&m0jjD{%U)kxdY_yg~XW*H3@uYBmItITyazylJA4|^9zLcEl*-~`+ zX2}wPZ+21i&F;N6mQdUUqRs_d%-?oEU+ZA$vH^$GhVDjq&ilCTP?eFcI*+Opv5plp zgtIs~mhM2@7F#MW1&6wx%!xiPdGrY$fF5h|scBo~y30H5Yth^2{AZ+_)*Uwj{vqkE ztiC_6m4WaQ`vSBp|LwliZ*2k1!EyI52_E^@ugmz`JqMR9-u3vU@k!fqch-N?|E|v; zSg<$w=9tajzCW`=z=b<+oXL#5;|V^^wvS-}&aZ z)32|dliZsI{2G1H6_SU+$Jeh}*qvRvwrvv_6ms)s@XaQIr_syXzj=$60j*k_ZnkTG zvr~sVIyND8lk^R`@BVu!E~H(1v|i^>!jy-c78qHD5s&l@yl24Otc&u9jT;;TGul#o zk8a(=0oxF6Z3<}B3`$xeQTyPKc6W5_)PZ;uN5O0!96Q3Alr%Ip(mFUUvTJmjxm(xV z?gPytE!`&4b8JE*F*t6pRze$-JUX&h?*W{47Bw&tMauQ!8EWShTvV)?p(`MyTO&jBxX>G;Ie$xF_BJ!EiSsynI!sw=9S zAn$jF4)6D`E6sPj^s3=NuNSMnd-su`?%&LdsoVVVtKNwVTY3eJ@_Bdh;)%BLw$$YN zlEV{wzBqB;hN_qeV}I>j`L1K~#FA&;OS%x3_Ty7qK8kwtSpWAYyxC`UzmvtE1pNKu z%zZ;IzPoX1bq~|95fRNE>A(HHQ~lolGI!6Y;W4vb-hHM==PyTn5BzSl5ilzHp+oD_TapVnhC6?JDbjxIQ6 zEr_`6ytDekr}l^Xe&N3(*7D7x4r}|(oxf`Fz{oq&pW0LM+CP>)@nxq&_w_tIbxK{c z;4SCwZa6k%@}Li-iN_xtmpx)}^EDYiAABh?uXPXem6wa3{y6FF+CERtG0xciLa+DQ zdY))AeqhR(kX9Xfw_F=Errmd;zs0}1^UYTuU*5&%($;CeWR2Q(c>P~Dl%}pqez;@h z*_&xc0``f-jX&gnSZ26*%J=?{RxF%Ut*rzy16C=x0ub9q3F$e#vt=Z&Y-@_S3Gretl)aywzUQKTCM*^`l*1j9XMyeq*-xKga&~^>)90 zL&G!g9q{d@m~QX?7$EJ4r@x*=4J~8c|d*4_b)Mvz-vnyY$c>Qsw$18uY+J16P+u*(j ze|S1&;-xO*V$RuoqyN2nl|A#9%YLV3j!E4Z<@1kjFXh$l=@&X6t>fJhTY6rI|8>!G z=?fpdYDo-u@4@Pyj;tTMA@;^#)4sd5?z*=}&CLUw@xyf4kZ-=&9q9GWtF52>SNE2$ zd3!#yqI1T@LtlM%&u@RL+tmN%q~$r~a}1GZR)+nxe$xBjJ<$IC)AR2b{pI&Fru>|> z^GYxOqwg*`pZ~(Jhl*QSL#}<=B6r)jA5CbJ{Z#Vdd9ywlS}^MQ>vJ6?MdAA&{`~8u z(x3scL32KEO#5zj?Tc&jy&hV>{D)WHs#&&d@2uE4^vvK%C-&cWZRsPO+U5M? zuJiWhW3H@C|6=2gb(aewAKluc-w=!Vf$+&~xgk4ApzW<&DyFNU+ z`qE;LFa09!cxh(&q89BJj%@aV|NK^e3;k@uxl@A)^@pE4fdo!v=y4W@G>3=%^^3$PzfBabYcd|`s&)A-= z9=>~X>C~6oUVY>Jgm?Q-8M5NWFAuN!ZQ}NOlMH>ox4bra`cua`$3IyA*Sm{OZ+l|y zIAh4Bz&;&2{5aa&=JP!teY)Xn*|*0Z|JNrm56p^iR)6}?7dtGES~q|7z#UJO{NssE z_nn^7Y|GupCVw#T!R*Crets#h$Ccub-|jPK#tZLxwi$S)RqwT9zWeRnHy`hEXI-L@Y@a{>+#B70y6csBUY|X7^um%XeO|_w|qc#?iiWi;?MjUR(O*p`KIgg3mP!86+Ja zH==pQ!N}I;m!D3mebTtQSKAZgQ$jkl3~Cn|zw_1QK3jhob@;EPs~)brd1PPW4<8y% z-M?az$FS%}zW>|#XTtj5vvT;}sQF8BDz5GNb;9cD39omJtGeMm_G`bPnFBU;`^#H3 zpIqI)uBj&-ZVP`p+>*XkXmtG8jJbbS!R^v7dV1Tx4u16Y%|Fu9dSs=psT{CkHXxZz^>E|Qz+I})-+Sx>X>X)DG^v>J)UoN_&4z}|BF0vAuAcOi`u z6#6wLG24suZPCz`sy+0Wmqc4RzFreg@-%-~2}=5r8hV0<67x0wdEmDb$(Ly2iN2zv z-_X!ODmEj%gjuyD-%iy@v(t#Cb+}6K7F|{O^XR3l9j(L7`*38q=R@;@`*hH4f3rJYdB>w{JQn{SA#g`|?_bG!iV2QdLir zX^g$1JU#iEMfr)&)X_B8UI~HXd*DzITwaoYMH5f-8ycEFH7L)APO^SlqtE(Cei05W z?e=G<*b}O&kM%nGULCznM~~Cd2^zWqwoFFmT%YUs_5@5*l!_*r_es3vi@a0su0@a7Zob`cbDU9HSv`Hk2?Bm9gWAT z8kG9Hs*Cs2#J}b0JCvlYXiT@$(d~6~u#OJV(H%s(Y6;bYgv|;Y>(|pAb@82av{^@Y z*3qFl+M=Vo=;*FGI!s63siV8;=Fqib!$N!#nYNr3Jo|~X$ycO)$3*%Fv}2TnRUSI z=kOK6>UH%xFzwZeCK7~MelKu{$|uZxf7B8CMGOY!G7@H)M3SMK2Eru5SVu&G-aSmz znN-a3PiXjrnNMrR16nHbYc(>2S%!S^vQEOxCx1}vo3Vkg>W}f1MxHRsU()aiGyfOh zV0B>{Vdm4bBShsBWT_Ft_}A6*p0CIqB($Yh$1runEg6#BK{o;e;;A9f{zkbf34EYk$AN>x+?dPzB={jJpD^>+0kbd19fa>x(!K&5*$|uZxs@C90oDc{zpQG};(`GlF@4VbSN!p!eS{3@If2s1whIHD&`2#avApUJJjrVYeZ)~d5Sbw~Cm zN!=o{4@qFJbQ}SFWhhSKA73woIqfA4pD^=()bI&2-wW3Q>mkg1`pwIH!pslT@Ch?N z3OJxY6eG+6j-(1ec!KZ%1yfnrUu7t8l!B>9tdlV7oCX}B%E)c> zAQ%W`I3ga9p^(d^K8v;G8jWbarUR4U5S34u(^9$EZ)XK?u4DhrfoPOtjEFpH-Lj5#tDHi^Q(bFR6b$m9|q=rOPKj*fdlAA3c{y2 zOq*mVW0skRz8yJ5;Xe+{_d3EXv(^KA^?D@C{B6X4QAtaf`Q&$weSXq6uK;Rfgnfjk z$xt)^2dB6(r#%FIh{`9-{3F07>fi{3nSTa2V64JF4;-1Q;4d`%uZeF{_}>AW{_e)C z=NIsUsdFI^WQ&Heu$sBYBlinECet2Rx$4#{hGmB+N4Lz}zPZ zGd~eHfI2ur5-|5k!YnfinENDQ=8q@&EF~>r=1(Gdl~0)Y(}1~85@!BN;%`*+5N7@s z;DG50e;diDeT*>6>;#T{RFR?I{M^R~vkdvw52hO-0%7JK0S;05gqeRFI3P!nFY$!_ znF>B=g#ImV%<`v*ul7~K%s&szzG}&DOu!5!?RSJ{Dfl`t_f^82_69KbRl>~w4Ve2X zVdi6^sH=|=X1*UV_c6lEZ$a|uiVcLB-se2jRX=nB~KO zIbXue4<~t5KVjxak-W+$%=`hs0l7+E_W?&{C>TqAL3=Z!E+UP!pwgOI7HRcd|eY}nFGLlT@z;hL16ZIdl;CnYr-sZ6qv7T!px^{MZr%fb`oa(X_8m@ zgqeR9n6GQX%)bg8{8vQ}Vdnn`9HR0GGk<^&^i(PGgqa@?983>h1j5Y6vL6wm@(DA4 zJTUw0odg_QASV@sS!Nn=h{`9-{OQ1aFCxtR1;pQ~=poGf3gE~>g}<6)Ho7s(yhQx1 z3ZF3ZUjt^_2s8f;V784g^Xq~6K0}!Khk+v&DEf~82NWszI56K^2($btV7|8yX8svq zzAgwe{}OOOv7+-baHL(qSBPJt;OoR!{WISne!jy0jri(y>fsCh>UBhz_4@;}Oo23y z{h&t8o|%@Cht<34GTy0q>A87RZF#e&KAJus-v646O||__Y`QH~j_oo}=#(N^)*SZF zajR2LmvnA=c7|-n?ed3pv*5Y)cl@lnbYZc&m~|U@8x+pUPRYvAH5utq z__r|xb(fu<1Ffz?yGoRio|T)Io-Kag6~!$0CC$rl`8Y*pc^NZj&zSmn`s|rmkEd%j z-%_0!v(wYbW2GkdTV&Ag=*UxP7T}){qX~n*C#E)Fs?AkT4mYWw1O77lKF3`&rkLN_7;XJs zhCUj5;J|P=ni|5t8WqXU4b0wqfg(guUsuJr)z;o6vY)NFA5eUAlzD}uonyDVpL53D9()I z4gkWe?@7q52hD-vDBQ1;>lj4d$J~MC2CMn@R->>Sx=H_52Xy+jL2jB`ooo}47u51{ zIsDo-zJ4iRx}Klc=?jM3GE$%hw(m!s+&0KHReyie$(_259A4QP)t_IxruFqi1(OY2 z&-X%(?oS-3eJK>`+BXq$uFBBBAhn)ZUt)Vrqz3xx<$^Vl8u*Jo-w;it2F9z{m2U^- zJ_NQLxSqp6Y0K+_ag=F_NF%wcI=M{9HPvogbaFr5M(#~jj@xum$EN$=bhSNXV{p0* zIc?x_L;|2{W^o+J(KX3|C%ua5wl_BY!*s-euSWk9HMxzvA9l zL2XQkvhQ-Ov)NWWVr*gc!I)o5V-sx4>afzW)G*Q&J5u8zK&o-CZKhSt_Joo42CPli za$ULB#J2Ln`pEENlhJNig%4ctLQ_fD%?smfvyO`q zW3{>$6oeOBx*3Hf97hzqBYZH(`cJE|++J?+c|}+-MD26Z;oC+ctHNCCivq?++n?6> zqcB=GwuB!WV;iBB%A90M4-}cFL+#oe*+wo)=H%w3;q|A?=(uKYc`oq1a+B8&H{Zj`>sN&Irj$@evU8zr z+Hv>}pnQ!|=4q@ww@T|1$IpMdRMtrKXDLu|r$_|d3xl}f6~p5(Y- zl(J7NwYi|cbiyti-e+6d&VD9*hu8`(ir68xX(xo~hae$+GH-Igdr9xLIc5nndN|VW z6xknf*+z_Q+yb=HzISm{>9(@$$)@W@2^O4(pPuV>A)Pl}x8iKrGR(s^tpsZ&v4XTd zm^>|ryUUjwX~q9Gu@NidEjwQKf)9<&4IU(0RcV{H3;n9h5If8Op09CGsnc^?jO}c( zs48~aw~4UI=#p)s0X`D2o(_Hz*gt|DzJ0KU4QaMiTDH9IVG~x#uo<~8+YEmKehWv! z-+yV3x`@$T4YF68spv5o4&oCKNvg8yAuvgMjfyqa*(s zdU2g_mOUPO=IJR<+m`u>LafHyR!j$9G2KLsYwdQJeOF9a{K|N*q2EnNop@wo+`~H` z4xRMWB#+78jYvW3-s;a|VDYYE_#7(>FY`Fy(cp2=HLmjN4_2Ryux!yqYBUYkHQ@WeQcMY`jQePc+K&YqD$&< zAMwI{#Ar0lK|SFv5}OceFSJ&bglby5usRHV!tHm*66NVd{uoG-OGS4alhOPW-9es; z_ZS*0EhtE+s9kj5qSqJpTe!1i!N}GRM3t1go+OR^mhAE3>!q_xcNRNZ)VMrFNawP}NUhy9!!*xD>sYr+ehY|Hx%?;U#g$UDd1KK0g_{pag0zWGH>&d2Bp?UZLX*AM%`$ZS_?b!b-E zN;UR)8{RMU>sqDt_N4xJ6*c+$3;jB6*J^3Jp*YI0Y8tO6F}7hTW&#DEk$ zwb+hCdZ*C%@-S@j6Nv#~rCT(0QWWVY41b4zhfU3J?Zk@EXENK_tqz}94^s&6fMN@>}lL%4%D-T^wk~vB(qeEKEt&?)AZRN3zFzG_l$} z%)WP2RPwsy788COnltRou#v;}4v$J&m(*g!jmb06KVq<~Hr|>rBys4l;YlM#K7bXk zgGUTBL6TgI`Qd z^$DK)l=q+sgF4ke@bB&KxJ5tNDZOxQcktuSbok=(JF7lxmNIAC2bgSr5 zo_Xk>S+4rrvydcS|)GFzqy>>09Sl- zoqa9k_$#h>g?4`@Q|NKJcz1b}cz2l01&i8$r6!)} zQ99aFNB7gw<8(BATT_BkKKFM&h0f5$(>??&-?)Ai`{>)N5)|59KML*c4<=pv1j^-e z*Ox+fVRiW8M&+&0(NQ{jq>dh_qi1XA#`d>$tz)Z#j0e`SHI8pD=kMkzbb(8sUOq&Z z{tkJ6T@oi7Jwzv6d?#6d3<=0VAKzIgZxLDQ{fzGSlISX@pQa?n*&@@Qy4uSk&ZwB4 z4Uz~GE7bIqM#3tVk5rnTEs}^7KQy8v1kGEapu~rZHyhF2Tn-+Fd2);6JT%*rJR7!GoohHuy>x@8gb^+bBq_p9oo>x1f1#94Nn8YI?eUTH|@A zQ75N=Qzu`c3fwEpHy6EC{Q=<9x`|I!`NJ~ZO5CN=Yh?LA@vutcb0_56iiM5n5TQ=H zl=quzjdd{|YCObcd-&O*r0*>6bwY8TkZX%jkps-@D#&!^ zlRb>ffKBRr5W;NFQ@|0b9=bjP$S4HaP8HKX=63+*brn5Ti_aCO!o6S46>Q_T%^zk2lMYEY$2}Fha)>H zI3E94CW$az90-{>0!T3ewH>dwSWCDYah0($+W(4zT;6a6@4`PWBVjHhl{bPO3@PnhMyNrpNFLT|zt zYoriE@@hXM%<^>aXPbv<^vW1CCJfJPoEb*#Xoz2y}1e^)V}e zBl{}+)f&7NnC}mS*|q@?Wt#~zKMptozilau!olk#rUM7uOb0gqgnxI8wEZ>^BX@34t)nbOSccC9X1d%Y4~ptHK|Mf2POXm}TVp zRAs1KroSjMgjr@ZFt5Fs25h369KtjlERzWwk$@8d-78Fgm0_d%@a^oE`9l?XZMoW! z9<{uLIWIGC#BiJtIAH)fPFw0Z@hp2qQ%pV7AD#i(cF!QGXM~)({ z^85;>L@H*P4A3DepD^>OPx9Ik!pzSh`7t;l5N7^tU|u^ynE7*ndF=>c=2I689*YwK zVdhhx4^jDqnZE!ymC?1 zm#Fo>9_d-<4q)y-gqgor!zaxABgCJF69Qr8-vH)yDukK;8!)d^AY(HV< zCzHHtCt>D~CwY}mnE9!|CiT8SnEBIz+5S9|QSB$pGPK5yWeNySQOZcqui&X}%<}Y2 zBShsBW_}s4i8>$xVdhr>^ExN_8Alffg7z7=i_+4?fk2qk?gfsRCbLB?$t-kZmN^JM zU*kteUcKIr0`q)l!YqFhI3z{ULzwxef!Th-%pdvC!;?k}Wv_VG^iO5Z>QrUYCMFoV zW|g`oR@!DX5sNtwQ*9~Pw*2gry!5FVS+g;PS#~ak9pkU5IBoH6QSM5p#{Ay2XXK%s@hnejzFjq zGv?27>&}}>eSu~u=giDYj~X&^Y-Da;itW+c8JK}`=4OhhMw>U@t}xVgm;x+MzfQ?X zo0^yM$nEs%#r|l5va9LjEykwi&%$*2rl&2VZPZv@8hIY`ZA|~YI7Qpklr)+IEzkS8 z?JQ%O11(Q6r^)^(x-zRgYfcl)+3C4Wa3PBB&_o2>x7{WNm3*6+l(e+l#E`aI?My+7 z(Xs@^czM3FYnJo>bRP1924%jLa_17_F|!a8Jei_zbV`_ke}uhMx{vyw|9Pk&4nlgl z7A%DSEH?;3lue8pch%%x7Y~!fH9q4{*RO3ir z0F-O>y#}88QxeFnuNmaD`j$c8y@)4$^ht)|NFO~5wfa5mbJ)HJUHxT10euVP!20gg)nA7oWnMGsYl(yP(fU`deRGhGz9n*CeIEd5?Yjzn zKSGZ5(dQ%9=K-EpA12l`nit9XepS=N;6H`S_yLrR|D?}^gY|XS*>@cJ)*zk(>+7Pk zF9zRxsv$)BP?auyV|Dsw;ezUbcn+*@lujQxQsUoe^y!K1>!d6166mX9W%$qf=$%tr zf9;@eE8@vMnCjA3hy>dDi$Z5_%DyLb_El@_qfc6F-_yWaeZy{}Z-tsB2LCCX)abhd zH0!$vtkstReIqG>8o0dYKx@l;1^T9eN9CnYWvs6jSgY@q+t{~9O%sFv6h@(t+#a1l zv%Y!2T78G1kG@rNV3-Sr*1k;W^F-ew`z&f4UB4-~9!MXjJBph{0B8;rN5KkZgnP>r z*2_bVF|jC)4*k65AU~xXBtwDq{Y#f`Psouy9LRPGb9Hj}>f~5ol};{EC&&6aspa7E zCPNOlN>^Zg-{|yZ-bUXsom}2+^rS zijJq7vLdc4)pEkNe}4Nx3?1e$MdA=+8}%S;Gi!^cYxwqc;UsEGjv=kI>R{HV!mT#2LP zVuH#0&i5S)hddNelU&oTZc?409=kx)cg5}!eKE_`sO|`&?(zASp&t7_)TbjhAF?p(rO2}72z7q14l$}V_eBVR9h)qXq zK4PtnVn-pi60vr~Zbs~@h{fKf*yCdI(g_s-$B-{#FCg}sR8&`|rhTvcgNkG2Nyj9s zd!}P}ali+Lx@4(h=| zuF;F_u_p8y+q4(OuziI|rZPWIQ*(b$NAoKNQ)RZ8UKw5bf*6PSj@+*doBa$%qh;$h z51IuTT2h1@sAi1VF_h=s+5*BP%uw?*HEZ^Z$rJq&JL=i}ZD(glp+jwWuNsFLl`ef- z{0z~?QpssAmCip6>$Wy{M3-ctjf~KXy~K?6W-h&$S#4QA-B&+9^}FGzNk@|6M(iBX zIfYuV{bMC(s!ne?)o}9A@gql%A31gS%%SrKFE)H};OlzK5--i9xq+VU9qYauzF=x= z%)aeCvUcQ=r1K-b8($I^G&n4=_r%(XN5-U1?LK14y5H8FT6_N4zuw`jKOjZ#KO#A; z4k$a`k`K&X( z1@in_IP2aJ&i%g%$MIr`c5FF{odOq1q2AV|j-z&|%2-$KIJyvfXx6#%bjAlu(fi6o zbRG6GO?Ve6S4itTopQ<*Qb#$@N~xoq=Sry~@(f+KZQahb_0Kx@?}xRN?`7n>2PwU! zTI`y2LO4!%O0}MKOC8BnUdo%wTUTC-G7em`V~ulPk%+eb1Nk+G=zYPG<2aSh`3+gy zxO|RessZbgC*?e=>lnJ}HGl-3!Y-&_!mu~f?FM_(1Du~g3J>@C7{Y^Ai$%lYLN%rI{*44W|zbn{SL zC#9lj%UdFR-44{lu4fI;`$|R650#2Gl}d(9Z%MB|v-i2MXF}IP9y9ibVzof22jo3Q zS01nIxbntI$QvMUFl;I{6m5FTkg#gys!&JR>e=;k4rDas9Gr6K$-@(mq#g}F9(A(! zseY#ip4nTyrnYupw%jM(`weE&$`jY!{Q9Vj2Kxizpr*+^)AeFR`xp8>fG8W zhuvkfQuOu=n7BHn=x;!FAY27~YDf1<$ce_YM@Ai=#WfMzGeqSUwO1r;r zYChtjar;Ksk32BFA=C$ZYk5b{I3PK*eh`L+c&Vr%8F%M2+`IFnDnqURdF)Yyoq~+f zmn>5B=gTDLC%dHR9J;3#<1Vp6Dmu7HDthM?DbzpCaNZ--%b9Z;I~1h~XJ(LOcypg* zs5=TvK9!30U6tZmo^M&@M^A$)ujp^Sk(}QQlcK-Cu18<&!oEYExNEk-3W6@!ov4pM z&dud}wkKpSKPyGs(uMP@eZqMevI+6npD0-vtZ7J>CuEJDamMq;$xEGQk0O0B;#Y_f zRy$#zz8jJ=brN<|njxYeS%tlf z0>ww=*h%tG@5B9$nDCqrt&2OFa6IT_@TrODGux_n)KXh+bFoFXA^#yr|#a<)l``*9F_6Hw6cpB zSGm00S@O1s_C6?<#fibEDxJkE4AI`tV%5;M!o9M{X@3^)Ki^`;HkVyGXUe0UwO|u| z4bVP}u9%_rcR<3v#U~Je3-q+ToZ!bze2G4R|t0h3c>DQ!PxyPxF|d} z7`uN3WB0H22Gk99|7wrjzuIH>uXcB%Rxu|!GX;OWdz$InleufYSt!$`&E00^=i#Gf zcb+FrFM0oiz;CX470O#I#m3;6dpj|Gvj3z1w`(9aXTCW%KXpb{Zf@4h9CO}Gb6#e; zd8jox!3^gW>2MN~W=@?iGY8Mi$(x;(nx8jwwi$jb%(L=Sv$Jd|d6X_C*PN1_Z6+?h zyqjlcm{W2TEknuIM^1WPWc=)u48+Vfk4_kj*fbo-IuBozXQb!knP;S=rJLtw^U(2D=P|MWIpVG5NMkcLupAk1abN znarG>lHHiESPDlcR0p{cRGPWzC=UIfot1}bkPS}HPKWcDnK@ZDWItm@K7d^MT*dg5 zJh@1DSu-dPGu(aH(j&}sGqYeu%ItJAz6|60GdA8rEzf!F?BCaaJ7`(V4RUp8rW__hc_4Q%G&vL zdddHGH~9aFzKuU$`Rn&L?mF{8|Lm&!7Ua%~oi_Qo2OfB6&yt%FcMP9D_Hy{D6^q}W z-97NY_wV=r;r&_07VB0XAF}(+=f<7w)i7mO*XA*CXYaIMzI6 zeNPrXUvIiAuEps2qvH15n45d@1!J2b&h8z~#dgT_OdlJ*WuI~PoDowN?%g`^aLeMM zUoD+|_;~7z#<1lL8F9l8%!vH4#imY!U;L^6`(2;ixAXAFuaspkzx$&TKV)Tm-tA)F zvG+WmJ!#>yf9ZR4-Oh_Wd>(seyRG!@^Ha(?w)p8-x0YKQdN1zV;odnDO5c8W(6+_d z2M7M+xx44T)uX@pmqn*5zbf9a*SI$A>3{xO)$g-Q?Oqz*?9H_u7e3nlp5Ml1<=?-k z^^)qcZO_==+c2}>o36#A4Xlgw~qGF(SCAz z`rf1jg&x2p-VjKCs*Y}_lRv48e^Nu!*aZdJN5KPM_ekF+g@v=C{}&D2xO|HIXjiZC&sCrU<#7eVOb@3>1oDR|i6GHmAyvAq z7^b}N zU|_O^zPFJ*KfB^6g`PI);@jxxKph>Vquc7}b~-v(?4)cF2H>E%=<780kc~VynlQ~p z=e|p2A|Lx-fKQr}uqxey}_}1W=q9~U1Dc{ZshvHy9Vg5!+aXfe1OCv*=WoB#mgqaWM@^Me~7l2<5 z6ei)|dDhc_Bk@au!gL%wCwd7m`>iI-I$t9h8Vo}?goAzAA0@2nIStHd33FQNhwOvC z8_B2Fp`J;eCR6b$m zCj$q!!wG>f^Tz{+sC>fAp9UOE18NA*_Vs@h zn0@-61P(Uigg}_(PXmXTaY7)>{IkHO0XQL?#lif`z!4pALiid7&o{pc%>3)b55)=L z295xW3b{=0~Q2St>!X?kH za=ScKM^|{VmS*~u>Nt_+b11)~UDHwIIUZR#_-WnbF~phW>Co~RELc!#WSaV$8jW;U-tD#o+F!@Ev3$ea!*&|5i4bC z+pY7Y8qI|IqiIXOSFYcg!^A~r*Nbcuxj{rB@>0mr;rto$f4B2N_D$$^J^0`A8R(1q zq(SM1^4TBv6B-xffG#VC?l=>s=Nbj|(pCtZImvcly_|X}$g(W=JSa~bF)|l(O4=yn zpLB_mJrw7U<6|h(>ZAKs01ghU?-Ycz`d))Rx->~2K6<(I`2cJ6JwYjCRa z)9Isq5b2$p1H-90eakR$BpE`akL+T7g}@MXwJ-Udrgtn344(i)Yu~5PHxE40*FudW zy$|Ei>LY){^p3`X^^F5Vt8WsXuiFtx`ly}Rz9{f0x%$|b=OXj~&4J?RIH3M#{Vh>x zG2n4v6Yc^a%yJJvj@pd_%e7bYRbP1o%?Z%6woc>!#?}w8p7$c^=pwTSQy{sf<^+_IT++>%5Gf!z zAKVY9jMN?!IImVHo2Gc;67;P{1{5EOgVK;GclEzp8RA#Ze>^8Zb)9DZ<2eDRVH@Sw z2M5gw=n6`i6A)g!3Y^ah@EkVAyT1Bkl({*1MNvF%@%X>w@^tp+(<~_9)NW5x@XS^$ zxyBo$bAEOjS9SYfp%DtdlCqL8*Jv-k%iH69%G`8Kc(I>dJ1P}wXTM0~1xbpxZ1wcF zY{Rh~#|}?_qt&v0QwvK~mzL7{qA+6%;}F}jivp;*;ZAFF=fZm7+;u|qTjlVw`dGSM z^S6Xw@b715+fBym8w(1wzH>$&q)~Ku$m(ir;qbb4)0ja1iFOp*0_udJt7r34tLgD; z!eV}<1&tG!jLXF!jh7j!>l$lxi8a=N7_Lp}oS|!R^P;Z%nj6C6TR6QcMf9s%L{z0E z;;6qRYLmZIOX&`2JibZiLNNw1vZO&Xf|L}S!4^%sf?N+}E zw=X~G9My|^Tvw{07UY~w#`QN?Gu4XqF-ush4wf#39W0^CJ6Oz}?+7oJYIqFGePwO+ zWeuPDx$E5ITNs>zyxelT@gm@`8--h5s`)ips@`U2ozi;ta?~FmXiVPTqCal#CLbT9 zF?pH2UmoJ{ktDwgw@$qVwnQE!>wrMx9;Zj*|RaYV4IniKG57X z%TF|#_}@f4jqBxO^r72aj9ffo=HWdZdqnJD*N|U9;ew)Kd&$B@rDcnklvgZWw)`o_ ziprI%RzJPwnYGWZdkzgE*z?k;2S<;ouBm-9fuAXXcw{=48*uDczix1?NpDBc;p8&x7$1 z7^2F_wZSENj(M(}EH&Mnl^6AXaCx7!ifJGIrQ{!PjQQrt+D(7|>cQ?gKEJ(i{?+IE zeVuxI(B4f`mb~yt>jgJ{&N}tf?8U*4o$*`e)vUYm_~uMr|LSA{6lYmhd@2#VKW%-dVoeE9A z50s$LqnN~u_{RA)lhgD2B+YPd9N%1y-|9-Q(5X6lyN-TCN1xTujrGIN1u)8-t1oC|Bl!_(9B-2IU+qe-&~ANt`9N7d!6hH4)7Msx@8*hc zD>kYxi!|4o_J`-RW|1$yt5Fe9AeY5k=V+6tQgJOe}<9GpH?6YoTPA>!yxNAU|(eIOC^bg(Wy zL`Qef(Rb+Rjyk%NjyCJ)P;pT)ME(s%-}>9QY*)%m-^n;o9fa%Rzg7Dq)j5p?kpFoO zB=4)EsU0cM?<*QBa9g1^$6f(dkzc!EQ^53JA z@1>)+>1e7q)BUnaxeoa|B=tX2jKU|(e7d)oVii7N<`ajJqY3SKyPJca7YG=jK_{|T1w2%5)Vx)7!hBnbU* zFpdM}vJmF9xVGQY|_YV0cPJh z`!w=|S^l6#{y52~b`oZpGa8xmz>%sA)V>iWoDhO=X#M2`(4r=UE;!hi4E31^l`pri z+CR1JOWlZVAj~$I)8GmdVq|EFl^7!A_WEIuKvAlQ8qi zP9A58Aek{ZArNL6vXf;70`s*%m}T0Kj2R~cYRBNtGHi712ZI%&@(FWVGq7naP6%ck z%$Kht^?pT|`TcBcNWeKJJlYy0ODB;QSuC(QB% zz#%H1F!PIngXv>E0%7Ja0uE96gqgnfA9|g>I5@!BH;*VGK5N3WFFxwvrU&z=y{I+9gv+!wxM?PI^ z{dwrj<=jFu5K4RP{jUv?s=5E+AgL_Z*dxX7xt5Uam(wU7CQ=n|4#c6)Fsk1PmCNIT zf6g0)TeUi*%9Z9)uH(DZtNbR$S(_YFW$XS+&L-T}sXixevF=a%qHwFyyP44RC8cn3 zO*i^*CH~uEy0R{v?+I7c>iDjz{i9J}S*bh@d~1Es#(d0mDO6oqXu7>T{@r-^KLy?_ zG;qgtYpuLLWW%Ngw^>p*Yev1%=n@ivlqKd=9LS)(mU)t!<&`B7HOs zjrFZW0r`0zM>DD8j1M52qA+5fn_w|sHg3$4F6f*2%Wy|(6grJB-F}f6ZKb@}??Vnoxq0^4^))z?#v35HynOG?R$ zWcT63X(;+hy0|rg;}!!T>scH{a_Z}>%wjnjx7UvEUq<7jC~~`zAj`c7Wn9O^e+l}Q zp-m{B+KSqj%B8p$;}!pAbw4y^u)nALPdWGN(?_Oy4d~ThS@i$MHM@zS z$el*X3|6C%&dI1NPz{f&^+!QWUf5=(c2TUuD?w~9_A9~ouWL-tvffKhZ?{@7^2_6G zSpTo4ONuM3q4B?>EndP_utoIp@&~6Vto~+a>|=#dRJ(gU{IF`|i%Os!SgK>B>hRK+ zJ$+&{W4tv5F&jLkYK%R{D?6s~4m~`wm^`?!wwE`LFBWZ0z*^!(lH-T{-nFaN4qiLh zw(NOuux{}O?|W^_c8gjc$B6^jjcUJWGq|&N;rV{B#^e=)83sHu>z>KbEmrn%;IRrV z^jQI(T$7|4|Cpk>eBroO=gsBaS-B+k;MfI~4r7ext-HDvs`DbkYH78sk`wDQV3nsS zzs{R$KC03u)@Q6#<579wH1;~O7NFc&`B-UqWkG@b|B`zhzi|ldYSu1RdehKth;X#c z6t-$_tQY5!?iZtK+SH97Y#(APz&i3EZ|U0w*MiE2*v^9Tit%u3#*R83DMh>+jcM+F z@B3D@8~pmpwQ-4)7c6W%b{|0l5^iW$3trsir0!TYug%?wN@6sK`iLraqKQC{eK{b;&X$y9#Qd-voJ5aIBO6%j= zLp{zY|9{kdd3+T`)^>H0n*?OJaM=WxKmZYwKyumLZbA|Q0wSUUfakPb>%iX@4SC}Z~cDv)>G%4 zdg|2D)ph%JSHBQIo6uYLvhzm#(lp%dSv+lB?u<^nC+JKpr(AaPZWZ+otNg7+o7a^K z^scq>WxUNTIVnN(k5vEs1CEw@c*9%9!qCcqb<@0dX!S?M+44Jpwx?&^@3E3s_p@j` z^H`>FP2+h)=A!JKBj_#^{jQUJ{j#oDe?^=AclO8qCsj1U>CTkEPG6h3J4fun{S~_^ z2Ui`a^0VSr`%i4UtCpqF7JNtS96|NiC-0j1tx{y)yhkJELTkc|+07oxMGa0B9NsSK z#?$;qZ+YsrGME)p8T(|pKud`yQN~$fZ}!eXH5E@q3UJ0KIGkg(UvX7{>c*qZ%Go_= z--_LPt=0Pnss1lm7B6aM-V;l)wfaaY&$%=UQ5%cCJ4b{nvtz0&%VYLc;Ak9VZIU^0 zWY)Hh()-?5XNEKV~_->o1!9&;dI~s8)-)%g;s(P~}pY z1FLpbDK=_v@>sUW=$8fgUUSD&k0Ybwt!PE`!Tf9-qgSBZ>`>RHVouZWtt%|tMP`NLCT3#S z5HZ~8jh%yruh_Y_AUM&YJD`?Ds1C8YGqHQ=_5{6`V>@6jgePrO-R`DVD1#qs;KR#k zGn_(xN6=?mHB-?0`OVg)|E!=HcwLBHsF@G*tP{>DD;~#gF1_ zjGZn{J}O>F=#O_k7KoF$`{qRb@U=TcV4<~{=X`55+09V%GVV#En$^iEnEMEgQoJoP zZ_wv6RJ-6lpZ6v&wpQ26R+^#N)|PrBaQBl{dZhZDZsMB-g9gRil^Cg)JtQ;q-%=~46wYq=y z0F;^-IR|xA63pDVTkIvlcQ&o>OJ{-7oPIb~AJt}jNULbJjoI2oyLYZl&ZR8zXa~;h+rJMI>T{`ZkC3VKpeSdiO+34rcCJO`Hzr5CXX64H(mS-)> z9J0OME_-f2HE(Xg+-;&X_m7J+R?vE=A|CZ_7zoh2K4CK}l$dY=V{LOd5xYy|ojU!@ zyzN!t9oLCDWi_#fBZ0DT!r@3w!7O17teN+1B=qignKjeVYkf|h4xjv3!1mZDWE(@a zHGR;#un&*BPSnJlh*Xr#sj5jh5ve(Lov3~+LHyD@{0a7*nAbG3bW>^X2dbJ?)#RKM zzm$d>JR7MftqD9E34guK%3WHsY zzIjjq`#*&x+7e+%=h36LSPxi^e|-$=oL@6*ew~HUEfRmMlC_xiov8WYYwN?sq1f|9z0GCYVnp=? z4bUcY&VOlfIDuQ>{l&jj)co*{725GDTKKrAIet{sd^Zc;j2Bj)54w#%FjeaLg?hlhRHN@k4~`CRy^D=a9Z}VU5C*8A5Paa2v}vC z8;J1IYa-3cl9N8e&O9|@&b*q~jgi2-aQsH}_e^2shL;pZs^9r8GyGklsNRNrGhP)n zg*DV)vE*$y_gX=HR&x}4gv3zZUn(efxae9DY9BA=G^-i^JockVgx|d?|5a79ZHEXa z{un|2c&_bRsO?uv75j_W{o|L?*j(AmPJ3WaA@p)hg5+;X{3Dmlsr+Vf&GDvIAOYt@ z%Wahmyq|Vk#9b+u_QCkJYfe3fQI{7=#8?QtD1Tk#R`pz5)&_l7^>`#u8m@ReGHmgj zijj+-SQ2}cTa3M5nzq=yuB!A1l@u?i{X15vBh%V~Su3X=##KCyru9{6^Mje6 z&%lvfYOtyv3R zUC?V`H~dC%S=_mn*3t9k&d2;rXVdl-YvjGI`g?WD+SL&;8~3ajB)s=#H_nlo+_V*H z2L5Joa?%qbjB)Lrja*M&o%eECw!OS*8Mr1V}HgCvFMd2Uc6@Qk!TXXaiv1xJX zk>?8YM*gxmz39)2Yq~xwnpJMD%*DCC{e1S$@QXQ)zCwF6;%`LZPRsLA{ZPj`6SI&3ZVzshp3H|1ZnRvVF zv?|Q6j(%N5Eb8B81=TIh`K>~2MtvUs@dcreIvQUE!L4F(**A9-1W($f6YsZ`=T)t& z%AJ3Y!z@Q5#w3mGSIb_W*KNuArNPYn-h;CC_1QeI=eV1eQro;MYL0$u(M(ZFeV;)6 zoVFCBwF)I+W~&K|j}#n!RfL+yTj$+$0}N_NUyM_eF4YdH%q!F z;26A}j^0hVp{fRGjkiVpc{eRASoWs$Bmzji%}?(ww$Vz#RoE5_Lulqj;q<>G1B_j4K`R;KO05+POTwub%^E$!tG z$ow4~y-L%)1}X%cccH0tg0$yrk#wb;{Bg@y>2o+c^xpF7Nc%iTuhPwobe5L(=0D5e zt1tQbJN7E=`mfUN_4WEj{)RGt#L2JHy^OT$uhI|H^j`lONj}$qm2TtMtF+sHD(&($ zGW-ikzIjf5m2PjOD~&W=UsOTa&*dbpd{ck9*JoAwZbQGzNS`p$LB7ao^U;6sDkwhs z-=5Rn_Gv21$6pV2Xlm5AxzxM;rP2{L$CYvNzuZXQuBE-@oh|K`IC_;{Zln(x>Gejs zu2UbCKif#V?WgqgpS}tz{iuDftLKi9B7Wa#q^{TGHl!_YS{(hH6BWk&jYBi$v|>t7QiooJ+cXz9L2`+58ST-lzZ znI88rQ+x7%26T5crN9hJB*p z4?PF3g0iQ3TJ*I0Jg(ArHuM=<+S^{|%l1fOI^2Wp)wh;6GWDX zh-r5JsC1Tyk5hU&N5o)PZ7+YasnZKQpzn#qgy<@M^9~y`uhP`EDqJM!-LMpn;}e4?NxkixD)WCTE$B<7-T6q}}7ct5IHe$#_VmY80iCA+FSpg z(w_`RuhMOdwA+6@jrv?H^HX1`pweSGDOB2RKb3a((du9((d_Kr5|wkReGn9e%VOJJLO+0yyuV0jda9FXBp{iBc1C!Uo!+{(lZ`E zIAy8-d!M!EM{HjWGK=$;m6bdvSG{&74^glm^W%$rD9$`C8GP0*4=A*!7!+ zc5aMkf*vyJyTM5JHq!fTzFd?;??ygt*QY(oYK-$G{-}{5Po`Uo7w!41Sf;y*rgs05 z5&3t}XpiN#JTN0da_KVa}%wm)P;eD1NQ(j;%G)j3Q81S+i zwxO}z%9aymd1GLHe>0sUC@=95W*a)!P+pP~W;vaMTW-V`0%4XX0k_(SFN7p~Sl$^p z#qMjGk5lb&*aet*2(x_;VCEsr@(3`u4`G()0-s~I4`G(~17?20ET`j{`3bWeP__fb z6j(0X-)=*_{i&T(>PS<0Ul6x{JuNTwGq*os=A?G!eb=ZBnWrtui5Nlh6BzV6g+2OG(aq#x|jfA`nH(Z4ye%d1>smvgL$X zPX6$IZ!{hlUq;yGr2b8zo7@m+NQHJtC^7SpgrDP~cH{S3Q(2+cNlVA8Tdr*X=29%* z7t21AKg^i|%svxlc{Xrp7rqb(vz*c?_A@cm*X$=@wxPb}vIw)B%H^_jA2J~4cVp9W z!O!kc`=nAO5NOKb_iZNv^RqQnU*6~JJk6#f;Us(^5GUgZaB6FOAq>KY{UpqO4gqFA z3A0>|y<`Xw$gLn%4uPW7b`r|>=en0eR;Lsj?A&ka{%Nh@y zVsjP)r`n6a5@3Em_iY+}fG|}WVJ$vEdt;x?z@axuDg3L+?nj{4LLU<(TQBzB>v7@d;icq5OTs zflaQ5-p3aLVYZ*|%rN{!*3q zc@4izHW4L%6`0$WF!O8%=C&ow@(+Mh>7Yb744guphH#wZc3EEnGbdrrdjgm_3A4N& zCaKi^iig&?oR=`$(EF!2FJYGV0OmSg0-Q<%2O$E?JcQYv_7!6u!Ym&F%siuknP)68 z^AKkH@xaVOnB|qg%(DcT+k~z&2I*vlK+kgX`*&%-G44mg%=02JmrI!CuK;togjr5& zVJ?@h5eBbPW&KQeu)=h|cgocY#{;L@@;1Qi17YUu3>+My?7NY@-M_iO>>FXW?+47j z5oUQlF#A>v%sj+wWhs7|yDa;;=S0GNl)N6{0SX5R+decQe5I1N(Bw4Nu}u=;zW73* zyeZd7D9`Equ4S5+SWeSTaG0`@^AAln2sH1dTrZ*g&5&x#iy&e=4LE4q+^orOBRLTu z%)=)*QbMs35$C;+|^61IKV3mhy^a+=?`U-Y?-raA5x z!rU*XfKzOqp9#~XP65YeN}+=Edq0&bicpX6D23@aPRcliTabLb!qj)64_wS;$@ZV9 zOqxR`m`L)6Na6J~iwvY)E#3A3E~x0Nj?%yO~}Ql}v_ z!zVahLb+~CnW-?Er3(*RW|1kzE9yx5C!j7IE(ND3im^lYTFZkaJ7<;Cj5}X;}LPWgt=TA zB3#xjWb+BW5D2pkHDBs#d?8SgTzA53^Efc`JWDn<4`H@>k!;rB3t=lh{5yg$+w2DB zy6o5R2ZSHQ7Xr0U=nV-yztfW-N?EJqT?jv_a5kdQdoJd(sE<+}QSuRFLxms^W}C6V zY%>=))wZ9n;kLj*Y5)W}22-ApP(CXZ`pm`5IU1tiIwhZoDD_E&ZzlOu3g1rnX@&1W z6guW&=AouceMZS&CY$3fW}7b{3Q{K^e2-7?PZG*?IO8Um-$I`&IbqIA{}nMm{qL1( z=RJpb)+_rCh*D}4?u;mPgTlQK;f8)0I+Iv zhgRrI7qbmjFZ7j?6K44_KOt`lKf7Ei%VwDnP*j6cUX(9 zJMrj?vyZjA;j;7asd}}${opn|r+p@yQ4?kgxf%8u%;Zzo{0K1K;PYFiV++-jz-Km{ zG+}y)@z||=V%GDFH&<#LUPm8Qffvbp75=rAPKmTLJvFYHPVKOrKYe=I^cls)Q>T>_ zj`chl?q3An22>ceQpOYER2@S^6){Ef;oywUwdBgpv4!*`H@&QBy4#M#QdmOos~=Y~ z9-DRh_Wgt@MN>x=O`AG-)XXuHW)za?gy{t{)5esjS3*fi;iNIfPU+6zno%sUEq1}= zVz+GPId$%}Dd^%+H_jS0W6G>)V_ZWPOJUlSsU?MJeFk2WirN?4=(0IaMvvkL)_v<@ zJn2rY`(`lA{Xri{~@Y8+bdmcnUMr;jSeE1se#v8mxG?271bglwaJmyvHV+=k>! z@r?yhU7=F^bd+z(RKE(SVyOxkDbb9G+Q-PVbG!clD;Qr`aO0?wF`ky?TB&CnN71{u z3Z;#saJ!vn9P*NA920b}pN_g-O+IEWyu7Ofdr(f6wVH5?`NY5Wu)aPLoHEt8_v|uY z?-(E5gr($=xo3eZ@^3wNc$UmA)|^#-MOtK3?_za81gWpI0B)EK!b13zaQ<(&Z3Hvgjvr={aP3H^rjO-~<%omcvI zPEx1w-}QY>f_&cCu|15%$9l*(Uk1ny8~Xn`H-dH!-4tmvStro+cxUIS>l7r;Y$U%?%xLJvX~4p z^L2oo?%xLRl|xT_)I6jk|5A}b=lc<|{`hck_yBai9?9x`0K``ZALh#gna-DmL<1&6 z%zX6zD4lOV_*y_ud}raqe9h2dI^Q59213t)`5M7a=lc?T0P!`{_=sEQ`w@xpka1wXL3sX!tMNg6P4OWe@ioEV(fQVb zZyDqqn6Dx1biTvjD~A#BHOGhf@{Qx83lwxu0SD$AX&fJ8FAyRLw#0WfKFn8U^Krh% z;YV90v+XE(yTMm}kr0z0C%#trFy9_y{OtxG-Lt@f%X!@xe<#4l{c*0w_Y*Sc?bjFw z51Pga%tzO4$%lxo8Jeo$c6*+^)>vv4SeM=BHPyZFdqTkKRnDW z|1&cA{*6AOJP}r;xyNrZWX$&g>~y~Sz(>CkIk1248hkCl*BM6SUpsu5?;eA1d0n;F zrOCI#;LFqe!_aZ~W*B_0f{%VXb724ITD4x^(VBl3!kGQL9zd_}5KLw;bprEU3p<@} zndTpcj>Ff@;F|}&;|`lUU!@y-k8A#+s~x`AjQUQ*K~2A%Ik0~(8})rp^RE+($#j{mFbw48Gww0nl|34$QZ};ClspNf;Q!*Bu|`J0CKAy!2=geP1NH zH<|K8@S*Sl4vuAriLWO<%tz-koez&uYI{Gs^}X886G2R25<1}oV&c0PALc6q*7-hb zsP1WkSO%^yU4zs886J(h#-667PkERC-h$cT^1qL2i> zu?os>($QxZ3Z$4rIqdYnx~pM_HYsKu*mk*@y>HHaMXJ0mD2LvQGsLn4 zKkxRR#`N@Fo2`MI>cHGacY*ELT+I9B^xh6m@y;>4SBU%W9oBG}>npldGXA}>TYluf zF8}wI$#(ynWv{PHt6bph)Z;RXL~h6bajSxPmBUQstZ-6P4)a$BPW;P$o)OQJs+|Os zAJ|7Hh@Z)L3Yl%~Jrn|QCuk1^yf+E`u;{IDd0(k|aUvy?V zJhzK+?!KvuJ#b4D$-h;iyQ3CcnseGb%!fSR^SPDgcnbKbBLhyAGT_u81D%H{U`Z|m zmcBCdv12;tQRu58`MaDToyRF)=_5lwJHEn>ahj0m~}9sR&Oks}Ql{Ogql9{!p^o72A)|NrI>ACJG~H|zgXd!7e4|8K=S zfBcpm>;F^x|KHmGKlSH7wdZ#FpT?OvSEr_D^hnL=oh2mhnc?7!uH76=HodcYJ2s5T zhOxBC%|hgwxk+j1Cdv59T(?lhWX4z$4jJsS*;rDs96UpZTrF)#&Y1G{={>;7%b08! zOMcC!w~Zw~%cBcQC*{*FNU zg~oOT$U?2`2xMuxKxR>`>lmd|E<+|W8Zwy|&FRgk3uG=`Kv}32Jy|>g%Hk2oQp_yW z;tq!_MHkpvqO>X1OzRYr!pV_2SnC0muv=dys6;vP*-Q>)nXp^jF>^IEAnbAMSZZlm z3oXs9>y+M`MlR))mYm=gb~Ch3%YEaFk4PH_co5*=#DTO69P4fjI(oe z9Ci}a7;K>7uo|R!nZ5HeGdc@=OOQI~%KpP>vwwB)p#846&N+^3NN%uH8Vu4b6jmno z!XVgK&6L5AIzt4Ts58;BHtLMM47-w1Sk_jZ(UxVX73s3DT9Gd6qE@8Kvic~y-fBg< zEL*Kemkq|nP|AO`T9GarqE@8K*7lQ2sAZ2|A>-ow268D^T+mR(V}mN5*Is5QF1tX* z8j#nx~fd=-d)8RJyaa-sp2lZR6O`%6<@8MhF>=1QkgE!zf3ND ziwiDS@z{up=Vdk`-r}+>6_@u`@txT!uFg^M@?04wHcIM1_KA(#w3TtFZ4$+Kty@cZ zUYleo&r5D6mU{HyGq4x4_5L1t9$%kcvIy_ z{=tGe(jG>O?S(K64(#FQUL2%GK$@Rm4EvCH(ykB91~K^8(#zM>dB$7$)7;QEcb+{}`m+uF*`nOj9<2<0E78Z( z9_JeRb48k`J2l_@mOUKYhd`&-~EW$lurSr?0r$(;rtD_E(6n zJoCc}{?(TOFU*8~W?TR8M=1H1s0{@8O{Gk23V5#Alx4e~h6YBi``%S77K1 z#9B}P78?3Oqdf}60#E;rGwjC+-fv4CPZJFN1o54xyc-SujYfGlig!HaO*ZT&i`Aav zd#a(IDh_+}HyQeyM7FIDqMKsGbVEN~#CY^G4E+qT$WxzLhJKb&pIKs>r#`a{``Lot zRYHMiW5lh7{#MCHZL7kqBH-!YIfnfl@uf%q2Sfh{@mG)krG~!L@V`_%Wc%M14#bEu z!@kV0FB4bV{L0@7QAQ1oK;zlMUh?^J70T(S#U~#9pTv5*vdaF?;*a(PZI!MOjXmk- z#Q4UN-sXQn^a|gSc6{|(Vt{hYGXZ;JIE{aa$1NB_3SP(QnD`**}XkN#b8 zr$_(3xJUkq;`0A4nt9S6ijAK7ek30B^v@CbAG=%sPsBex{c}|8@wDeLaiu5yxp>mk z{{IkjJpJ>PXyQr#Q^b4P^Bb|@g z3q0-F)Vki&e$B0KJ^Hh)W1jKb%6iPxe&@KezsP#UqffQAdfKm(74f9gtt&k38MX>N>8_UgwaeqXyLF4FJ$qWqJ?V?B zX`c4H)Oyv^ewSObJjZXQwcL~LZN2A7=UC5s(tWJYJ?+`o>f~v!E3A5+^Z={I?w`&$ z$ShH1%%4@_ls#UQeu1H1AO_g|t@L*o`a8rb5C39AzgT?e;a_U#mx?qG{~rzgA4SA& zUsZm!p|2L_dGsp`{R;80-To^7U55THG1`-Vm7!lHx_Rn%uc5zJ{K2EY-_YMLHhb#- zprL)U;UrN-MA5#&h^pr|5<#8A3xMr(e*XrE?hsL3xLt}&x!X?ejfC67}l=O z3!($`*ZJyS5@qnO$XEXtaR~m+fIfQpe--oKU#YMDHL(TdFZR`M5+UeU`RccbDe&(R zU;Q@mI{f>yuYQM^4FCS>tAAZQgYsYZ)&EWWit^v_)xRNzL4U+o|E4H_e_#3P-x5RN z-%q~!x5X;>7r>Z}-u~~1&ryCOU;Vox8~Sshr)6jD@$tSG2>;T3^?w(=;a`rg{zFj? z|As+Nhkb4SkHmhIKhalzM0A4wR$u)mq9^=YKM^B2ARV`3`&qkUtd>pvH- zq5RjNkKR825G|p9+gJaUXbb<2`Re~E&W3;g_AUP#F&zHUelgMg`%XNE^3V0v{~&_U zr}^qnik9&2a$o&Vq9Obnu`09TVPon&3zWUQ59{Mt0y=4XA-*V{bvT^P4 z6Ke(F-_ySOfRzjXw)^U_enj~nK~Kw|+Wd8_pHcpozWTGQcLy! zu5W044FBk_qv-lZRtEG*zWR{082;1qQo*SHH?@w#ze|1f&8+>{aahJ;NKs8^~u(YDE|RpeLE`=dV0TRbp8vh z0{Hi$ul_>oRrp8y8b{B6k(Ces_CZgVv1*T>RO?}sf6Q0k$@&iE|Lm(zw+2Gr2-g^B zSyP)oYz>8fXG0%-{_koHfPd|vkM4hWYYF_Lf6}7!_p}b7eEO#>I{(F1Pv~=f`7gD4 z!@sMcr)7F=|1YR*cHuzjXJ{bXfzr#2^wUQ9O^kG<;qNxXzqbwl<{AFc z^AsGY{3AyBTaEHAGSaJ!@@fAz4#f8lqx^e}^642A4rKqGQGO095tII;k=|?Ae_{XL zA~UidYS?EP<+U>UM^nrE^NjqR?dydkCjO6%_Q*BT2}XUNH`4lZn8a7d@F&Tzf73{p z8s!}~^p6-e&kR-~CjDnd`ZdEIhrbiZ{vIc#@)sHQL$wAc`-O(T zJq>^VWboZ;@X^|p!rfRSG!hk}q1|5*$Qp^qL^r#A`@^o0c!EqtXua!1SW47asK!UW z!AJg_kDN9~w1bCV+ko36f3dbb&6lB#zbZLlmII0qZQ^JLkDM0m(c~L_nL_?)2AP z=nZ90_;>kmvF5`bA0OWQ?|ty|O^(&QieDeAG?(yRrqqVPKFUv$hu%{5gt?AwfqCE2 zGq(8^ibsyOeLnT2AE*ewr_H5rgA}LqZNHCiS1Fq_`Zh$_NZ;P^@$JCx_f59#yUJc~ zTPh{=o{|&hHk9)BedGsg%g@s!KSh|n z5H{drJuRVlh43>9ZzXImI(HL(R>}7h{x- zh2zjw)(Z;PBmAPmv=5~9lEUW@ep%tRg#V&&3Sn{i5I3YQb!q3|NYI~86|m@eca+(&qq!fOft zP2r~qQ==kmApC~HuMpm&@K(ZaD!iNUUWNA)eoNsG2=7z)Q^Id6{3T)PD1`3`zoYQa zgbyejhlAOAS7EyDYrUs1?E!ARukbm94=UW2@ZS|qAxxc*(1q}a3SUC_kiv97j`fkk z{RtmdcnIMm3XdTCvBF~sf1>at!Ze@|N(diS_%_0yDO^tYn8J$)A6GaIk%cq`nlmjD zAk@RhikDFSp0h}a&;%dL{_i%4Fc~7W#mBP$qwGMK7AXiR_*fwc<#Yd*{X0ySW&ehg zWu2{TB!4S~lMq?B&O<@+pRcgwZ>_N8CnW;8Znc+C)rAZZB!5SRB|l|CNW#ZTBV_Y; zR#@_9C@lHADx8GK>aMW#$HvmWr;?mi`ngEd80Ta1tVGhQiX`#?pS4l1uwr z6iz~9-KMa#xA7V6Z`bT?d`A1Zn*BV5rG2@=(w{1YY3*SxP&kS3B88=IOB9xQmnkgs zRx3>3*5?Yx5&nn5iG;sWxE|quDols8^^L;vIQmXu>BA2S%Q1OU;Uq-XPYO$a{;ja| z=NE;gKc^L@!_UG#9Td6{j#an^;ef)I5Kd4SP*`VaxPgX)8m3L+?O-+0a5D|l=J9N! zU2L?@(d6f8I7!28G~8Ch?KRv%!yPr8qTw_RYZv^i3{Boe!`(F8L&Lo^e2IoH({Mz? z+Qm-1Tb`RiSh*U`({Mix_t)@14G+@rU=0t^@U z*YHFQPtx!d4Hs*8nubd>JX6CrYxouo-=^W)H9S|t^E6zp;Ytn9*YH9OFVgT54KLI1 zof=-Q;guS`Tf_Hg_&yCkpyAaTUZdf)8h%v6k860HhM&^#GYZGV#V6LS*B}^b+WhQR z=bqoXZTk)#Q_?zTbnV{rlFK4lIeq&N9DL1n!>%7WDt~Oz_=%II6i=Tq>z3PYpKHyt z%B?DEfwjn5VlA_(taYF?U&aTdS;l ztb48dtoyA8tOu>t)tSoH^@#PT^_caz^@O#~deVBzdfIx%`jhpn^=E6nRby?i zp0l2}Ua(%YUb0@c{$jmi{ndKadJQ{%Z?ZO9Tdb|tHfy`J!`f-RZtb%EX6?4#u=ZGQ zT6?XxtbNwo)_&_9>wxvH^`7;S$PEHvqwN4djw;qO&H^q6pWc%IBAk8MOk6Pj%(`W zgHLKFVz}$wJC`eHZ-%Sy;~ixa?*3`mpxWszs=uNw(52*jZLw1WSEcQgi;cO7O?4&j z(XHvVez9%ThTZNq++GG#OKq+dV5+GH&Y+gLsaif|%j{>+Q+}uZXW;lv8}3~n4!1*S zSelh|wdk(eT2HstQai3W-B;Vh@vdZA;h4#_^mJs{j$_O0T557x>w{<}zopi?AX;{( z4rlN}9#YVUF;CFW-nHChgN!p6a5eGrfm->EYDP2Bsu@+SRWq92tY$PDu7#}TnG9q# zeGK?0&#zreZLCGpYGW;m+Npp&)}ok5|NYf&@l%WPYjpuK+pZTD)YiIrqiS8(qp1zo zqnT)~M^n4S7Zl}V4})6X%aem$_2?Fc6SaBlZN#-nm9}{Io*2jvD&9TwMYF($1ixW{ z9XNi=0;SMV5#0wWA-a~jv34H&JWyM~2VQLrpB!py_`FbCL(LOiN{vPnY!oex9e=gc zZT==yDmBO%`2E!mzrTs>badDm_^Cgms~vuS6Jt;nM{6XziuSnkGtq{XuL(MWy7mkm z5nb(8#Gk?TGCF}gM5&dds~vuS6YhxU1d^XxAiCP&_c!5=P)pBRN47Iiqc)$*PeVPb z3GvHe7F|pH{%VKc--O%8r*!E*4b-T`JN$B>Mm5pfhu(xkuP?!SKh89ksH`)ay5-vK zc4l+E4S&N@Z_hKEIzDjQp4nV)=iji@+x*O?jt|`azhUnFCX??PseL@F6B%Ak%3+UJ9|Z3n_7)*Ix5x5y0(Q=uw111S#fXs(#V43;ps==6m&)_?$cNysf>51rFmY_y!Jip^DR<&O+fyD~4Ox zQF5#CFFMc5xTqFXOOMc#ptkV{D2qoxHTDRosvd!?qetRY&Lfqz@<^Ohyp*QV3lX_K zwcg{^)_uWN!I(*trWWXL_A&-WExkQ5YRP$M)KchUqn45fM=b@9j#>&H9<>zC_^73E z+K{@smev^|wKPtfy7{_a?zvW(@w3u!%j z;3ajWOY7mF?hfkap!BW|bWwU2N9dyTup=m+={8ws-rRLW@~M4u^?c_ zU6h{g2sPB%5jvn}H_qI{LERnH%|Yp19q6L;E{@Pe>0w9cqVx<$=%Vy=N2sCBj?e); zyEsldsJnx@IVioW16`Ef#SywFJ?scwl%C-TU6h{g2sPB%5jvn}hU27zx;rSnn*&{x z-qjJhD7}j#bWwWP5xOWn!x6eDJ>3y%sIwykurI@6sHe+!G|EBWlity&hQEWlJ1D)I z16`Ef)e*WVy^AAs5q6+ub{C~%pIW;}7p12=LLHH?bCPrW#BYKhanD<r~^L>A06%0%}x|fH8eVd<{2RpjoCt@p#ajzTQ!*ewPsPBs!UmcBaG%ByR z-w+?Z>tUz+w^!pkOXF(;Bb{%A58t`4)A^2TeDr)U>8L;IpfPp6u|9lpu+#bI=5Fra zh8o{~JQSw$O@b~39}YZT-h`db*8+Sr7HGUQLd^cXfSbZ}zPq7I!iNL%t%se?Hw1ii z?-%if5HsH+M*qGD9kl}o=38y_Z@E_ArZ8r{FO2rv3SG4EeAH;a`!v4h8s7!Rc;4;9 z*Txvn8#F#l0givS8{==k58rHK{O#8G=+;@TZzh1=A0PPe(GJU$CxQ=!Pc=T8j+n25 z(SDyo7p?u0jrRLl`~|zZ<1by~Yk|o|uP@zdmjpcr9)BU&>Gkao zJ|2HKRGjg5D>CSO8<1$gWQdt>CV8B8sA3a_~?jyNzijZQii`6#|M5a$mbX6{B}7kxV~)+zJ4IUsox3Acdo%V z1bjSRGBv)NjQ*wPKce;TB%^=J!N>jETjLwp)Z4$0gD=VP&K-Y!VW+p>M$Nw*jgQ(N zP2kK2JCTl7-{z3(d?z%%J{n(9GcVu2kS|(&$G}eKOTr-L`u5fM1{mYHJ=#49dJdqM zAzaH0qy3Dc_3vQV z>Hd8QKJMRZG`_CJcwPy;hS%?U$MqVkK(X@6O8e)9emNo-&kY3%-8rvYJATa{?YzQ(Z=5shJULy zK6)gG{X2~Odix#p;rlz}di%Yo@r}{=cECvI``CwXGwgJ}y&7ME#`l0RzkC6{Xyb2{ zF~1xKACJF6jjzm@Uz)**BCEEGzI@sy; z9Rj`<$WP~^2^!y5Mt!r9DO!Dx8}*$8KCbVL8sD2neT%`D1U(0??=GXhk8Aav3}f=0 z>U)n--(^rltM3YX#KI?=#Nw2 zv-mVuAwq+k0}jmhDC9a{9v01$U_^XXh?(yMEwG2P_;wx|=mKUy30-LLWeQRC}@$yl#%o)2Fbc6xo|GTrf4t?@N8_-^*$ zYh>_6z{l;kLgTwPuvW@!g^x?bQsPB6k-@_W;NQ3W`4WY5po)Tk0B;II$x&aynv!bEIt&*gHL-L*Wvr|95t>o zl$o@v;ld!JF-M+i#Ny>Yzt*Z5x0_%e+7bchdMsxhAq z)%af0_+B^s8{xyZ)$nhu#`hPE?{lO5#`^GmYP4Um#`jl^uO0H!al*&%Bp<#c$m3ua z!H2?a8sBS3laBf~!Qdy7e07@--z&y^wOr%dqVbjDe5Tj8+=uTr z*ioG#_)u7_@ohtzbX4Eg2HzqdzHAD8sE1GUjLT+@O=e4-M<$#zSlLrpwWK! z`S6`(wBJ^Z?{6AkKb$Z0_FL=2mjgT9zr7mY8ya6-%M_`2H(# z<9p2TZ>$gB8pFR68s9G(-#BBwpX9@rZ_M{UYka3Qz667>#D_1&;7iPP&u_F{7SAsq z8GN_-@EtVxnrM8qkh$BV+%5GW=WX!$;>moo|rF zS6}1XX`GLq^5NTJoR3Cmd<`|e$BgsG1|PmP#`$Bs#z*h4;`(+l_+IhhOE&mQG`^6= zS8AM(w)*hhW}J`aYJ5#KzN?M%$8I0KfyVh`k;d0te7|4gOV;@4`k~GjhklH9{@r5ucUa?Vr}51< z{Hy1~S7!M4rN(!G#+PTz_f35GdK>foDUI(!jqkYO-#I>fpBVnd^>NQf7ioMO4FB5t z@cqf~kM`h)NM8R-)%ad9&L8wXi)j7vf^q&hN8{_H@%1qHy7=&g4ZaQH8jqg&8?|I|=G0BJT z&&K)VHjVFcjc;m#w?9gJ_$IAk8s8D)e6-w$?*rp}^rFVsSL3_DnD6iN;cH{e_ggi- zD>S}1gKw=5-)Y0Yy&B&Djc+!NT_m0V1fK%mSfn|Sjy}8Xamw-_(t02p3bg$v{yQpG zDcq|9yH1=y%yu6@9^3!)REXx1`UCja0809Qh63CDdbT^akUWBXozGYL^)R9_jHya= z!ZUSATIgI0D@nI5U8E+XYYzpIM%VpAPXAoqBbdst#CJ~lls*-&%IiW2(E0fq<9sWpG%FnYS)^wE zHc{3)QIzcoh-OQkU)pSG&5k#%U&?B>+%CfLCn6PPH3=soHDB)#_f%EHR0P5ee$5QM z`)g)+=1D8m=j7?|tgpqeC3EJ58*GdO=7o10vuYZgj)dbkM&^`-i?&ZheL@5!&l$fa{o0@;ursjBeFPsHpcp_xB6ylQbEv0zzKOL<+o zskC=^{n4oylH7D_s7%WnOl^9 z39KEqq(!CqcyaZZ4Wtl6}p|Zw2KUxg=Ta5Z$T@mTk9U`!s;; zI#CguEcS?kWi?{n+>Y~~sVd$4e3i8&ly~ZM&HSUH3=d$%?nn@yFA2{|u-;#iJog>+ zLPbI#Ue%#s^t&QF{~b}2_=9+U-ujA~ZP$pJm}esur8R+PBjHc35!E^0o&KewbW8Q- zA5MpoW5t}%=CY1UWB0_0vVjdn`1UPU%?~$-nxosSWbv8^G^~g%2%c|M#G{pp--S=s z=1|TLr_)xJZ4bZ;RX+9oytyK0dhxWv>C-0^B^68>Gi6-T%))8YCrq7^l+ig24<06U z7++FSJiS+^PU9w&jGvL8hCNX`6>^qNw0%Qr@wBNE3kyopV37n>s>(Sk0~^+M?vc^+ zLXnwF`82TYv z+Usu}$>*MzRNAe!N@HrXLmk7Pvt<6!ti~HCss6NHR6(VOa?;l0mP|XGW$@LP`RRU0 z6;#^wufCw);BIJWq#KD@wz4DQ#^{gbcKUgl4v6#Y^b(m)5cD4cg$#Te;|-jdG9^U5 zOrPbvyRfB9WATZQV*klcvLH>QcA$I0DLjQwFhN53m4b5$g+cfPv0kSz6Q7{nQ1c1n z{6vB1Qn03?K=n?+dWb>_K0&vmMbPe)4y4093KXcHgH0tABM65Srtg&I3X^G&8@TrN z!rD%@{P=l6$*9SNlP6D|SvYD^VNr>`MTOU-pm;X+Ix51p2e6?dENx6l$+QXiGfE11 zFJHN(iIHn^@fj#57mq3)Gp%I8m`Nh-jQh3tI!<0qDDo-dmcnUMC)|Slwu%Jy;wYFp z1si-#DH&BVVR9k1AfShvz0du3PExJ-`@WMfR_&o8Gi(e9LB9bwFr+>w%=1JSHn8Iu zJH83AX-DIn1KUl4fH)(z;(H{h%V{`}Kcu6fN5_E9cLUONoN!>i1rX?b^-vGy19bRE zrt>vHg392)eB_7D*A^r+=a8HZ8}{!lV4aV)HmBp11M}^MK<66*zP6ANA02wkcQLTe zw;zdo$T%=xHwbjTn>GLF@MXSlfOWoZAfP#c1M__efzJ0h__+OOMqxgh0*H_2UwWtb zSfn|Sjy})WG0Qh_LAHQwC=AC(UsIA@v^C|cWT&kuX`E7^_M^aj9RT#AK1Cvk59wRs zL-n93s$lY%g0zCPsreH-$u;9|ttqirK!&pU?KS1kT~&GN80jFoqx8&1@!Q*M?N~lx zMko+CVQnnk)Fe{6xgxhs#a-~`*j(h;v_8@%I}>ZPdJ$z+x~Xhip$JtTJ-s-$VDteI zijTz5DkP9o9f-uZ`8sUel;fmwtkp92aclMLo8k|&+24L&zr6$Z4Bmb1uHidx*q*<& zX!E)SioalP9g()6U@q3VkJJ$q$F8drS0L(&^>^&fjBQsprutt$Sk|U+<+?~g@l0#* zip;<+$KQgvbwxNZ+}c+Wi&YX*2_l(u1|Rk8zoOrYeHBHO zYDE|jf%unrH5Pm{Y8f?mT%UR1zKXa&T*2Y7R>9n}1eHpje^zmW>q|}=by09y3(8P(;G;kYh)qHY|uawK!k{JfysOL>Vd z?jIbKc&*c_v5(Y=2`#K+6%<#9(wsq}CjL-d#)?Dj`Wi< z?rp!?Ca5wCW(QbH2LW2y89rwmTrD^LFtxW3o;gtm-h?PY%pG|aoWW?GF}|47_8N6yf{$N&y(KcSg%71aW9}n z2eluva!CBJANv;dJJ2upibB+^=S}g4+I-OdV88bU9vHm;+I_?Kx*n}xXl?Gb(Av^% zLE0U4a+t^3v~EFWPC@WV5u3MFl;!LfvALh(ciQ(DW91k@%SBoCS`nMGL97X6#eW>X zCLw%0VAUMoj$fr^x!JH7f?Q*ft3+&$%MYwc*c`}@&sqH8lCnN=$lFA`wKz7nt%%L; zBG$xhTbdQ0AD6kL=F>!L*y48Q0lt?jqdv5J;EWv!0c8M7;9cg&u8iJ^Fr zxDd0=n#$o->@SVSg%zY3SaG1TU)4TMQ@6tHx%L&`4$2?0Z%Ed#^~2f>zjJuZ^{vr9 zJXgPfb4+zbKy=5VClntqy5qzjN=U$OU6Ht;Pi7vMRuBvbKie0Or@Bhzsgt)U&mAde z%7qf@Ek+5y&sr;^Uj6^1jNl*tCuIa1dCIVk_|=_iQJoNpX|2`6-&(IlC@~WA(C^Ci zzgdRc+IXqT#tYripToy;*PG(sZ1YC@zx8{4;EuuDuH7+CQanXbs1#|0(nu@+w+UAPvrUOFt0;dY*))(C|zOWj=vF*-D z9fCZnIs`v+IIJTbf)%-ka6Ve^IPKi5*M${&$7ecyWv3o{-S*o_fFZf zeL>cOR~Pjve|}-c9naj+abcFzMjff0@tdI{J5(R-i&YH!dq`{F7LnUTe#Jqw93-5AQ?aXY%%=OxXl}4kura5R&w8(hzS;auN zhmJTo@Wa_!T@9~ro*H1SrjlImm}`o0_RG3{{q=1|+&Lm<590_dW|rSmRqG)U^N0A*Ou#ZL#?^> z+bi<>@9R%9?55lTtR^1HEeIYElk+f^5{nZ{vqA~mPv4(cQ+ZU>Bpem7Td+3S(oDqe zX)mf9^bt2TFWcTtv}v$8Ha|8z<&dZ;nl5TS+iq3H*L-%Zs2=>C6?(hUs(!mtgbu}9 z$#chvhv)9Fl1pcahfCiT1&80WN^{G$1w_V*`%A;|e6=vP&kv{HTKr2z%?|vk4^8>yIQ1OPG|@ZhBJh0hzs%rq9TS zE-AU)*j`D(6?2+sq#d}E1`W=&4RH+uR|Ib^ESOP3R}_oJOqf(SR!qNfLUA$T;xW^w zBeJCz-QKiWhiCRZ`sB%`^Xt5MLh#xarl8(;^S9{QT0}8%?in-tn2#h1Z=I`_z38yfF2toIfqOs`JisavvV? zX``e6-gI`$x`Y4ury~1-N543GXYymO-CQ>3Ux%(b@#<^0Uwr?a zKld$ZKD*l`zb={n?8$=-#tz;Y{O+Q;%Vrbp;)2UQ>wW+J zgKJhUX!3l|_G?xSoU^;?;wPTVNqK9|N4Zb0d*f*OuB~Ng%5o7RN6hO=2o^I)M>@T2jj24 z^zTDQb`4wgvR1zzvmpP+R=1vd;O85!IX`#Y`(+&-i@7`}ZRxzfUh(bXMcucIXgcnK z4-#))-Y@2o^ABJA^yKOzt6DD`^5B$rCQM8TOiCXTw32hiEqL;cf7+47>H7QrcFU#n z=fB_Tk(J-y+NjZbG_m}hO6{G5&+I*eA3It3#OU2ER=;r1x0x4joZS8PH-cwRxbN+* zbANh%z`rHWI+s_KVkO^Sa;#^#`O1yGKHoE~s8i~_bDn*B&QIO84eFeH-#0&`71f#a z;ANlQdHIbWugbc2?`yN;j^gF6v2lU;gv2^^&#G6yLBp^9M%NsbFZA2r)CU_i4wXNg zw|4EwoV(jPGL=p-(*2F}BrWab3rIfNFG>ZKrfV5`dJQM> zE0fB<%}9?o(sZ3$1!YgyQ1tXJPTG9k4EuO3?e#Z7mhZk^F+nuKH5LlD;1h$h0r|IC zO6W`3yZ);5LPLMIkzQ`3*BR;KM%wjP@$WVCCyaDQr+x{-TR-JLUAI<2r8{!ct{+{$ zR-uk_4gYZnV#L`7AI`UEk6bp#e+-oFWuzlo+Urk!Y45h5N*6o!^^NixO8dG_{Z#rD z$6lqk8tKoB^sidl>rW$b)b8&@*jTu-HrTeMbA%<%5uI#(l1!f~-;+%yMer#GSM8|& zjcps+6>yD>RsQouTif@D%%3Dq+WKZPe^b#7`KfF!pT->pb$z$B809Iyjo{aOMqp#% z8cIv#r?NPI5io@$d@LN#-Xe^s9j z;#HeZr7sjQwmu1YEYVSX3BF`t=4%g3LGfKA{_5dN5r?Ig{Y@3LHw}f|_{50jvVG~g zrwWaX@uAwkp3R9Bp|tPE=5{(?OMe3Y(vWVB57n3YuZ@v^k7iGL?nC0IJ^sp}=k_MO zJ04Z}8;tzf27hBMoq+s{U{BZL*`HiZPyFtD8WKOi|7yeDogYKuAoNq9Z)Wp($9q#* z-viL8pwii#6e>MJOQ)dx9Hdo$w-W8aPa%Sjg@5?SzxgDPLFIpulQ!SSMtY@@cIQKt ze~qF4z(^l9(m!fxZ+)AKyKH|u!^RTnqK7@c>dAB`flD6Z8erVQA>04Ywmq#CER2-3 zcAC~N7XB@u`VItEL5H8tLCQ$v-AHE`=`P|AF{(RC5Yd0+G;eUAe($HX2c@61$0ylP`ly{A zj5(n();G@7VC%OU_OwSYg=x}0LELL+$b+mgX63PVd3VZmeWAUkS*_CzzOdonCOe%Z z`SFLjq32`2CF%`nw*(H|gD(WaVTmxW zBTljX>q6M(jsVkfPl4JcXv^u`AG(*MLaqatXE@S)zrkqWkbS@tW}At?sW#6v4JQH9 z^R*P{T*x?0!`%qm_bucCr_{w4LVtYtUWIFcL-xc#n9IF^Z0KZ*a5Fx9p99S^p$ADS zLlf{dopBsBW_mG{*+*`yajl=DdVC@3+95m)2B4>Kp`G1MvM4bZ%om33J}| zz^Qh*X&TM|4mMIev_|0jD3UasqG9Sswuu09Ul8W9sNGmjnB~-uAsRRcgjr5~$Mv;8H&DarUk$i^qsRziu{hWd+bhG;f~*(RUl_u&hH zFw1FprH~^C_3&X#KBrtjQZ*-VUUHZ7((%Z0!YuCroZ10j2-LMH9VL|aHZdk1##B6G z$@#Fd*ExGZ6k4m~gt@FN;FOD$ydR>_Di^a2%~5PKoNVq_HiX%R+JtS!lg(;;ArNMp z65!AyBo+9-(UrFZPDv%HP<6DitfP&o2||xa6Rh~%ycxhLR8a(Kx1fCk#LK{`ok^;W zh17I~4Ud$FsYte=He{a( zvz(42_L(rtBf#u4VV2Xe){+Pi2(vs7xRos@%yK#gTlT~k0%4X90&Zo?3A3EeL7`sw zLLkiYB4DoLMBtVe;|qZ>+e`s&Wy=Y(d>U{|svH7gmd^xkWy=Y({1)Jrm*NY7Fw1WT zZe_~}vwRUS_X}Z`F9&9y?*?X{3A4?8!0a<&mahh8p9!;^4t4gKFv}kY=6)f}@~6n& z?ia!=f0pbo!xsW!mTv%VWy=Y(d^0fj3t^V;0_HmI0d9FYz7Pnr%|75(wwy4_4*<7} z;0u8;%jsBd6~Pw*VU`~PZkb6^AqcblW8hY{oG{Bz0CT?(X89>#_W5UE_L(r-(BhbV zCd~3UVD_0X%M-~y0s;iWET`)U+%JS#PUmIr7yTSf_ujS4Qaps&z6IIaa>6X9wGj6U zVV2XmJH?(8Is>=ttvCs@O&8!+wwy4_=^8;xI=B%Cv-}dWx8;Oc9wGZ2WlxypbgiP5 zEho(KA;8=(gjqfUn0=<}sO&Rgw#f%(p9!6XXkL>#@ zd%`SVP4>2&Fw57HeLrPSnB|X?y)7rq@)v=*UkI~&BQX2C8JK-0%r@JB*=NEm-$nMe zZ-iOChwN=RVV3VBd%OJ!v-|+r+j7DzKS=ghs5%m6`605m<%C)OH8A%JVV3_0%ys-1 z+4NVOgxMx0#c%`zZZU|nb@IXW@2fLWnngKW8Z4hmkU?CD$+deX&Q?yDrX*Or7?z7se&NZId3lsZh| z{fPK?8DX~n062vj3E@+GLgWYnVYc}am~FlXW*fq6L+1##`4zb3_4q;{%r-F?Gp%en zVV1`O2Zu^?Q5QJXt~<^DsUwuU3E7NPxW)ft@7?38sLuW2HMtQ&fK3K41jJ1O5n~d8 z%}t~>iAe}CB2qv^%Ow{s$|XR+OVtK)(F6jP9l%=Z35e+7sK*k4*3()-0VzdlsbaO( zg7sF9^;SgNWA*p_t~Jk|*+bCw_j%tx&gXrfWM;n4v!3;=XRTSYX7#y}gfiF`9~np4k-#pVOR{T(^6$R7j_ z+=3lwJ2okEV$s{>VhzC=!xmdHXdeQB(%Wt2(Qt1G%PGs~Ibyrj^ znm3zWqZ9{IF0NX_p<8~>t8S~tkjkpc*%+G%+tC_kh1>IJNRG~Df#J;ESB2}P+V zc`#+ZaLGb?6)6T^ur3w&uE(YMGiQ2}aeSI5L}$tki5S+FSX{Hu7dXFaN!9YXHB}x3 zV^@m8jp)i*1f9v5b&*%Etm%9ZohbtC83wN{*IKUW#TZUIcRok%Ety}lz?aQ)1J4*|VCgcimVMHe9rayC~vS zWKG#&LDSg&6Z`MRMUSiecid>d74JsGW27d&4kk`8tiJC$P#<_tAl(k&*K=;kI$ZQ> z0FboG(^92&q?vCjqrt~wV^}h_KZ5bv<9%p~I0Y>BxWH`!pG0l@3u(1A+-9;1IpVv`=I2t_dM*)K{)Mo!zT7-0eJ1@g5QX6A+dJ@@; z!#~GfACJBJa6Y~ERwbFfP=5c`LeFcjBp1(9j=c*!_SOS??Qu>@UL!(?qNxdcue}+# z&c{Q>{PuIgSbpC``P1GAY@~N#kI$1r4CBVhWGT|TFJ^$MYv+KC?5n)2%11ifG< zdN)DIt9R#l(w*f?mvex1X78K6bYDG>-gsZSpPwgP{$BF>H@-*b`Te!e-c;yyc7FHz z{Hyfo$@%!ZFWnmGb(UW=V^RLKp2xpEKK~x`rOP~$eus@1Zfg4JdD8uNU;TR(dMQpE z9>m@-=lT_UA3_gRFhY{wtv-97L$7y4%eA+`r^h}TxHKaq>HZoLVhPKGUS&kfgfTqN z@lS$wu(9=!*!wLq0M%*<~3^wVpj`M454pNsfl6HdXy}D=% zJhT583Im?0{;_H(OkM159MNi51I%~L+p>aFm!dSy?K zv%+0F`eF29Y(~e&PsPjk`-qZ;5s+7BoWV`MDKrEYNk$kuM#N^X9#NN_KLX`A zYEA9xiFQ(}m6sMy%I{-$Q!%^NW~5sw8H2H9VjF6u6vm!d$8nM+DLWftG432Q3MkAd zpfKM-JmwS#G^ma^yCM0@_C1fOfAnep{9)v~p=ff-)D+1PMs2onMuD=F{9=(cbbTmx zct5+Ln^ke@7HfezmW1+)ln=+??oSJMg+CZI-B6U?xII$p3=747AEV&5M{;gA#KF!; z%POzO0 z2NKG={GsLL^)I$G#D`BdSoTW|D*RHs#WD8}sk17>dP_ZI?Zq4s9O1dF&+5|+MWv`A z-q{uMlk9lpa?XubQbTg8DZ#F833lbkeLW^R;GRj0>xRePdf*>}UvMMG9wrC!Ju_9T zF2p#-;tSA%%|}}|WLZXTuhfj})u|a--%HIHI;dYp=J0+QgY)}kq+i!BBRIETRUQddD38^J@kJR!cPXn)+8P;4Kdxyn#_>PV z%+`fhs+*&@vW)Dhc1CWYz4}x*PQ}I@i_MC&*kYDZGg2op(sFW=viHQrHpDg5hT_}u zLU(M!yavZH;@>^r(c{+HUR}7X@%Z**JC7bca{Ta#gC`HgB&U6t*eYTVGWB;G5 z&6E7Kx#(nl#i?DYqp%e7h`8gU+nXQA%lv-DeM#tHt1tq3**iRU-aBB| zjs*Amx@+35OTA;$Y_ga+Zyx43F~xz(XQi^d1oAuG0I4#i`zOk zOk~@1{P}m(BBmZkZzVSj=}hj9yI-K=h`x3DoygteTtEGO`*Z8fDf1DVnV-7r_!B3# zzrdIoLG-(R{h!YleOX;(6}vT#l5_KTKB<(RFNYoH=4(=?S2?fjuPP09Mu625tv2%{ zlX;+Y|A_kB#xeN)S~s{WW?$K)MxZWB`DV6e1e-Xg4CeOPSQs;r^ZNvYS52KVyKqXu zgy7K0Q-a?JPMtEX=#t>LAchM2LW=XtzEyMyLZV0iDs^xMJkuA5Q*d`Wrv!{`vFwJ^tafH(jw~#l?SoZt2c( zx7}ndEPv!57vHn}>a)*G_+U)kNBiC@?vhbaSK8kSeSBc-_kMqEubqw8eSGD(wHLh_ z`=gD|zJ2feKR)%&6@R_t>Q|nd^ZoyRpkN>>w4!!fBrD$e)Yd#9>{jwp@lexHCGsYjMd}0Tv5F0jvo{9`-5-yqV>D@ z_(UJyRmaEAF^3F~*Lx8@+Fmzb{A3-U-xm!ft2>+@K0zE~@D+^y4V7R#mBu^aUqBXv zUqK8X=LwHa&&1D*gd09herP%N`AyA`37_N(KP*T>)K$@+a?)_^U7ad>Q_3iSC5E{+jRyec|uer%-t4eyq>;ivfY z6Mg#geBmGZ_~kyn#>fBE$FmQMA(KAeyLkC5Pk40x(tP}aAyvAbC%bopVNPO90sdOd21T~+bRpEqYCcomOLweoGE8Ad>nL8ZGy9sah@n1MR>q`nsZLU+6 zhEG&24xg^WyQ&wX!n>&_ocP5$JXu|gqY(Yu>M39H&-nO}4v*JiNIykg@9@o<@2hTe z_%fuMg1686ob*|bQ&6i4a3rO|j})BW1&%+IF}*fR=|J6_0$=J9cVMQ04pYl*IyuALp^tZ?# zv<92VSq_0LN}aKj4rV!s&%|PLC*{sHPAu{#fMqP(Q`B*;abnS7xn*Z#2Re*R%8FQY zbeZH(!x;lu?qbmy2~oE5k)sq?&I_^VOrg#&>_Aho1%_*=pB7VV#t*7~cBHKn1huLREK z4FSa8F;d@%MW+N<>Kn1h`K+0Ct%*x4^2yY9uWXY=L*;%`wI`*RRDZK{zIi~bSd{*Ihj>vUXjW4ryl zz1=_0+ksl*YXu~z`%ss!Sb<*U=mhO7_Th9*K5yS)(-YQo9-qBrY4!3*=g(@a?-MO? zGBY);Y&FuRX2%l}o0a+k3iv z(b9@roKD@dE5D-Sw8znNobdIJX7^&<)A_677=`nn94re}xv+vWw{j4|Lax$M!A{nZ zp84l^VT$4_Rao|4sbEgv>|3$g)a<#Hm0Ti5(qXPpYcK=@6$hQNBRzzoG%A+gUX7Yn zQGRZBZQV6`l+%5BID1xewV7OWsCGJX|KD_sMqBa%-pk-WLZKkuzr;mY-l{bX$DTOB zu;=X?&F3kP?r=be>|-ze5?}9-rPW$kG|$kl0%TJ+FUH z!M{}K&_8^xjQA&g5~ZAvIbk?x5_^vVc>Q}Gp~a3452E)FfHz&PFSrQdOg9-D!+2z0 zb+0}4{|$-}gbUe7<<5B6F5iTVDmHGS|3g;F@f+Fk+9_me<}u*yFn>A%SBc@Y*Yck$aIB`ZvG{qaUpA zUVEc)Q8+)r5#pX->UixPLm&P*kkKBWnIykoIOR72GEz0{6&R@Zw8QP+uq9%Hx~8X~ zM;k(dM?jhSk}v92ixQ3uBc=QF2BVS&b%@!CUcjeU2)(>c^v*!WIFfEX^qijzT3hVB z?$dkWJn0_y>76-Gx*Q5l+rzMtMxu{=rGa|SFm9!AOnhL#{m}E0gzbS4WgICo>N&5e zw7TfcggtLx-0YzF2E_AA61`VpOv;4vBd}MCI>_+3*m&Lo*f5|{y5R;%U)L9R#IWI` zMrh5i?~8lnDwEzwq{Fvi#Yi1}fD%_1Nq;5u5ky~6;n0sYL7`ur@H#YAxHYw5tQIr| z7XsHesVl}xKx=km)yo9TMaxx#*k^D}?Y1JXhW%1sHDXKbgf3XW^DXqmjE`S^nrorP zV{`k&WHsd%?n8lu>*Lg*;>?Dlkv^1G$6dX*#aX8;tdtX9(Baa#~K3R&G%U8aR(C16I<%q-&}%~1Xig~A zC4A;!Z20WqSi9z6ti9qFvEjdB`{Yn;X#NFOXaiP6ZQ7{X?>(W~H>^>8!<)lTYz+6g zK!vB@inKme_S9Rg@YIV{c-A8-e8a`ovO314z3`{cYMa{r7sq46fBR)@QkVAbPpcD~ zPi&de8cKLTwI{t|o%sH^2VyVosrw?;J&e_8AML4nbZL$Yeei~AjBkIZk5xA~R>eMo zl~5m!QL#f4)q`)?;DrDVcYyCRKn4h*V|pb_;O?Xi!FA-`(KVY+K z6?$Q-3SIb~YM-@Lwg3Gk)&8A7DEp!_R`}oER^d(aRe0kT75?1?%Kj}%>08$*`?l@@ z`-X3$#IR<^0~c8KYZs%3^*2@fnV(ysrJGgwkMmXgd(Eo-lRl{HLDhctfO>9y=)K=t z_NuNi;WJ&W_Ht;omSPp3fC`=cF<0{${Fim@@4R7!H)W~(s`i?PRQ&wVU;o54fCB9+ z-sLeSRP(+Hy?aufNn^UiA?^oQdm{!Zjj|54gwJFrwx8{*LQ7vzcI#tmUqT|% zenqu^fH-{@siSf2@7%B2Yu-?yB@e>m@rorM-t@UTQQCfXx)rMUtqRvPs`l46DqKrJ zc=V?l6+WA6g=(I%UP%ZogxxdAF$HmsBstKU07URsIpFlr{!4RYifUew+j6!!?MqI z3Fan*=KWfIukOzq+W+(=uH|Ob`~Oy-tZRSc`>MG|_>)QS{Am?>JJAZCO$c_Zx2HaC zb-g$A#u^ox_X`!iwR^Dr?Z3kA4^{Y+_&k)z)Nfl&_qJC)s9s(_u)BTzKdk%>-(DZS z;7%3(v`c_JpnroJSYFh-!%k>W@!iTgMqst3iokyq_73r zf|l{^T2wQ%F6?h7V-7@a#~$Mlw|-as?nv8* z-oA<9_@;;jyP**L!Jc*_JZdZq#9n;(%hdg;1#|n(*iWzOE1P6i;!gLe2%tB$r-z~Vx~swM{eM1hMfYFISAA|%biTSG zAN8Jm#RbAxBP~+mI-e5*$ma#&gkScw?{nIWM?=+!_fOh+Yh!{ds@P0&&1jT-KRkO_YvVrF^JwewEi+qBY^u-Oia6`? zPi}54czDCMme7R1sGqI>$@g6BYjOY;5?&dCGq2E%ox6tyjgOBShWf-Eqh2rqFUB4t=Lb z$M3_)fh{LC*X_V8^7*M(wHCBLdyf@5*n(1gc*9Rx+7EBWS;&uXKlY-+2ph|Oae(?F zIrQdZ@b6))9sZ`3)6#zEVdS@u`U3YmjM-5CzP|nJNo!Qg_5_sK$sw9wrADA-3Z?Pojc|uJQa9q1D*-uEw1(W5WcZwSdAF}u~TKl zBv=o{U_3}H#)HISJV;UWIDnWN%^FJu*X+KAV*+kJ&kCTsn=ZsUe^}=VqX4d4hcOH5 zvYO+uiq*q<48`iw(zW)cajJCFp!nCZ`sORnI+0jsG9f+z>qOSRsaN^ji8Z5MZzzxS zb&f4Uc^3`9Du3B{mK=}qEoB(raue3~TZEPU?o@-i4N5-UFJsMn>Y+8CtBks>>Y=)I z7{~M&R%-gG%2<62D>c2U8j>pR!y4Xg9L-@}{d#k3(G9S=5LR!8)rl%So@)nAYpE;l ziWK_kl>;w9I+v^TE-$ag>VsXrz23gy3RS)(9Cwdu|L=$KTz3+l9`%d@nb&aAtXhgE zURkviPrLVRQnntUg>f0v>v6AJi;+0ptc==q@bDNs{3$$qOxZ84RfD>2OJZK`v>saX z81jNV)xC;4miE2KT}jfvg6LPZL|ONa*@L!d1ll6IXU~16Ejk`=+MrELmu=Cr z=9!mmQMg-T;y$!N;ksD04=+Q)>wBm%Xop~cD=B*0q#o^+xsf(0J+8xTle&~Ah34a# z2EWU=TA1DA;a%Z1BSLokUq7_#{@#=A)5|S3+NYciSqB&5`bg=5s}=Rxej&jc1ik>g z{n8LMYD4JO>#^o&QkS1Vzd`f!!KZ6pw?rHEpd~tFg`Rs;@j9Wb{Vy*@+QWhd`=)E~ zbo87xAb&=FEZU+vv_xee#=+@(#PHdjO zrEW(u+9S59?azLQrN!3j_6Q|b{D^LkLeH^1T4{xo69e{(XeHrO-6OEL<7yTAA8S?Y zW4}^2w1l4BXANoz--?o&DybviEGKyRAj@epTj17$aLp&NEZ6X~DzyzyZ*Qs_Rq;%`?)+w7#Zi>A)S=GaXb@}awpGVp7t}z5H@gB6h9o^cm*@NGtKd|h? z#8i62dq~|QXp?r7p>)=%y8k$)UPkFWVm+)&Cydgur}5nA-)%az2e+JUy<-z=Lt=jT zEK3Kq2p$e;F?S(dItfze=o?CBGwKjZr?sFSceP2aD(@%jA8z?Z%eM8STIf^g5K0GU zE4&#s=&MWT(0_SKC;UI&(uvJ>OQ*S;w{(vFz$qQn1gCUxZ*)uNVU|vENS98sWly_M z-Q7J@^*HWjdvGs1r0->W&bgP(!@bLUFPr|A_pg2;;l8u16pl@j&4d!98@eZIoc1axgyVFpvkplBOzFs6VFh3?-{pN zIA+gtAM6`7{Wke+GNwD?b?>g?BP)Z3yT$(`+%zOV{AzDqnpm0r)DBN++Mo1}l%mxk zRM+)(LSwAo8yh8CijtjlaMocd-FJPZd$YGhQQ9u=E5kUJ;Z~I4pyH7# zHE{smeMWMP@?dFp9&%T2>r@ziz7kc295ucG=j`USZi+moH?NKI(5K<^scT-sq?TFr z#;=AVNniXjX>=wpC^}JeSHGK&q#w;{$*r$IH}0$>xku@xl;N%@Z{@trY>_L$I^B5< z=;y3TE60Yy&gzNP)=;>h8|rAJHZH&~dAG*u@zCQj9(p{+LyyOJ=zfIyLImou>17w zmp0%cER&jfNmlk{!$*u9GxiG1b$C@#@x;=yYpVveEQk{{NoGDp)VY|2-E{~3iJ`kx(I(gtRBw6 z!aMC#)<@Py&cU+2Fn`X$y6DtJr+R$U<0Bj{!lB1SUtIJ>5B%Yv!Kp7!een_gaL|Co zrN2F3XF0&41Pol$!Q}Wy5d#Q$AUVaYRZJvpP^)MiV_!!#k;Js&@&bx~pg5Hmh$9M6 zmPZjW4-y7H=r{Gv#`Lt$aa@`w2x(A9&chLyMgsq-zIrbpRfP)NDc?N46+7@j>2Xcg&I1YxGaZGy9HF2r0ZRqrfsY6{;csv?i z1Q6rEI7ov$L7v_@VOp-Ve_E_{p{LUbTESYiI;iwktCXrGuWFUWEeHV#GH$E6X#w=` zr*(8VchskpWa8EaVV9T^U>(Y1(6vPw?I@27>V_bbcw)!WdaxUW9cZm4k0aAiK^|cb z$675HtU$!I*psjiVh=u88=#PX#0U#82wQ-`wZJ%12OF@_baf!7F5)7@kVcLz#Mine zjJibHmbR~BP?zbch#eQausAQ1HE3v@xX-03V}@5CkV*a$ipVOmk!sMU}-y*TW&9MIIt}AH(`Gu3A7YC>(Vm4Mi!JS}9Kj0U0u443=geN%0&>>nu0I(y#k#Y#2 zOBryYjtjYtKpV!E3De=!r&%4KF?DG}>(Zu4+oVG^2AFVdmMoQ>IK~gHr{(lP`$eL4>%4A)M20w(mN6~&Smu66MNZLG1vx`PmBFDyR&Xkc%Bl**4uukYRl!x>;OLnuWPNj4?_Aa; zA9LybKc7I?6t*k6uR zi_JpM7}{sQC_~+R`rUOnUJ*NF_)K9{cb|UGNZ+hl=x_~K+Gl?=Lp?P=Oju?35gtA| z|Gm`hj=y=(;hMCIqxccp-n)*BvzIcxf!GWgUT#tnp6LmXPS5t`r;oPB{$qyv_`)xU ztO33T3S0v`+Fm~$-|b)K5AW~Ozc8}C`+9BfB47AL+TJ9`8>Rf=gM9iK>T1a=%E&^G z{#&B>k!oEOKPs|@FO=~=TFs6MAERoc__6B#DE@Nwizt4a_BRMyhBAEq4bkC)B^cxR zdH!yT=o|j0zVKDPaJPJoeu+>2ppPHmiN7rpMsTrCKRps|_)_QoBH;@n*YL%@{9NM8 zkKx_?7~ai~;obZg-p!BU-TWBd&5z;T{9NMm=Th}Yl&4EM>YGm9*k{v1&*i%u{sPTk zq5Z!%65&$KKkwsr`1nUX{If`pwwSDinH6|G-TYpv9tF=~(BAOZJn^Z|K9Gh?`tJ#= z44>u;|JWD)xsU(M#}D?!PxSHZlWfSOH`>RS`uG_>evyZ7aq5aG?{DbxsPTk<;M6S> zex(k7B2vFh`rAGF*P?vb&mCP5Bjw96RECT`$B_%qHM(irP>xy=<Ddarr(S^im( z`fluf>fLJ$9<6W5&oJbgZPdcv9C zAU1FOEFXWwqkjd$I0RYh$DD|7w2-5s`OAF#FdskM$B*#wAs;`|$B**yqka4sA3xT| zU+&|_`S>e*{CFS#4Ih7{kN>8R&-3y5KK?4beltsw&t#lmWmx1|;IDPGT~2uub3PUK z+A`q-9eoqOi<%Ur-!(GkWU!9kE%I!ZrTOlP;~z;^VoSmE(>h=JvverNnxYJs}wr=X?2FDm>(C3V?^4^n@1^f}%o1wDv&Is8WW zm4f?uZ>O$~!?%hQ++Tkc6@H1HQ<^SwF8vf-&oBA%Gs(x-`*?ijiLCQX9HKFYWS$kR z(`JNTov)0`3kY<+xXe}>`g)OwCEY~e{*IhjyxucB`&e(FfEDe^^nB@O*PNUTp{Ck42_BPSO50AN`|iCE-=fwOyI2Vy-;ooGd@697Ge--t$Y)UBkrRvjeVkWWOPphM1gD~KW&V-@z%nPwU}6>w2r#lH z8?o4A`P+|R2lAeavEXGc6aKcbd2&F+5|^g!HtayeB4=@kO>fzzd*sBTzZ^Ia#152< zP0}J3oixhZumcf`T>F-x#s9DPHUg$4FT|4W-N1n%CSC2bm`#W-C zk*@(x%f=2wEb>O+{*Ihj%b z3u%`@03sGSpZWVca$=G5St~Hi=<^!S9$_%+WR9c6WCA0NoWU};%1y*$jGSd_KjC7r zzn40rjr?gGaz+{aQ_3A2fIkwKSmNda%iJoq*d;b6N`Kiu*}gyEb?k#nWKeR@Zn~wp@ydcCPXYt8evQGia92>-< z^J8F{V}n@aM}X~i>_EgKe;ruX1SS^wyTCFp#fQYxumhdNChNg|0W9}HVu`EgH@X1= zP%_#Fxi=AuPH$kb&vwst?oHk{FpKgwZAQ;eDRKEbUe=7wqmI+Q5sOX z;W=1zW3oQGuP73LLoF$lHK(cyWXH zjzZ)+DW7lTyMXOIE*3jKg*%_ zeuDaroLJq?+~*w0DTB7Ytr($RIWQ>iTeexTzAAG=jS9@tCsJe<+>vl9e#(B z>yB9DY1Ch8d>|G%$BFlM|GTk6Ebu|q668>w@vk#7dhVZ#a9LH!@OSo9zB=j~-)H2TD%{|a@!W8|+>$NB9*EIRK}=PsjjhB{8U z5sOYtEaYuQhgjq(z=2vLPp6JkCd8tX1uSdTW&`J}Hu~eJ@01C#=ofhOrvL}OYxHLU zr>$|Z=$Av@-;ooGoNMh#84`=U23W3BVv%#6Rk==yMSeH+o$HHO@;Zv>Y1idf{Efu+477I_=6tYy6eIEOb|(4!vtW0W@-`ID448vGP+ z+C457n?HuUzau9W`A>nx2V#*Q1kQ169;Z&5u}LgC9A_?aVv(oELGHAl#3JXr4Y5gU z79V^-5G!k@hWa9R=9Vwwv`EH1+SI3B#GRIxnR=;H|3YTsCQN&Do?7FX0jYD15GP5} z%U`oo!&m5-Wu&!^ao#;E73CFrjwQ*K8-j_IoRCg)=6J_06zRw0B0QGw(VN zp?BxEJKM|+h0LATIadQ&&OM)=V@OXjb)K{Mb<tVI|-Qjw}WY z5D{V?s|dzaRuLTX;HY(hOQ%j8F>E%L1CFSE)zZL5dl;^@VL{XK{d4ydixO@+O|P@=tfY+{e^BfR!_tLn@@8%kb#w|V^Q;<3kPSFgP} z2C2Vk$W^YQOK|L%mnVU9iN)4=?$$L96#AndJy zOi27|g23zFW3VUng;TqWe`UV>7NY`Xi!mI<-UMHM-|_e-eJbc5e`9(5TMm1j<+lNP zUjI^&S;_B(9{*MWd+lw7J(hux__quKue}l&<6|bz2m1s_euw(>cv?mxhb6GynGc{M#|o_3sjo zz5fLE`uA9h`5r57h=04BIC)M$*(l6go@nyR*W%*e^T4zx@m}rg&hN#j)Fb^0n>W9C zXw>e5jO8b7E$j2AFy^(FjEk`rav_G10!YxSx9&W8%l!6m6U@^V%uf8P^68bGNAD^` zh)S0?RSFyudlh~?HUgdK)%*3*I@jCk*JC5liM{LndILJwyUnl1MxYaW_xbe(cCIJu z+e{ z+Ear%*Sp1MFZDcn&-v^PJCEM`@R8}F`O#DYy-El3z%XuM?06J*&xl(26Bz{P3_ zr5-adYyzoR}!NlDY<1s_aB+N_Vm53iQhZN?I zYFwAUa%HH?-n^y>^sOTAQ_KJokJ*U&sHXVzF71_{s_yHP_gBo>tVVlN@AzaT#twg& zyUA)x&fB>udB2$E}p=eu-+M>x)$$@jLPL|uT4en%BdB2lw0IkNws2fn_9Ut z92ftY)wa6OwUX)Nhq>!~{u!)0yEdzST;ntDh~Lw0I$7)NZuM$r#E-1za8kWB-Q}CY z^_Rkrot~LzQ1;W-sn=UGYX1W>wP4nk`oXZUy1 zI>JNxe717cKl)%U#CJYw$=%f1EG|XJRd`yHI@+3{p2FNbgRS<4n*5BmpD3$MN|kkE z%0ayjFv`~*oxH2T)UJyCacVVI*Oi)s^`Whb4|k|i_%o&Pxa(0{sm_Bd`Q@|4h5$y>*DW-PPpOgacR$waFb(&()sohORM3Ju9MyNA*z`PR~pju?eeqpLrN7 zvb!F!&P12u^aC^Z?`k&IS08w$X{F8Y&PN3d%g{6{QhFReZ#Q>~nbPoDM7FD$WB1*wCfwA`3fHfV{0qD2kSJi}Ohu*TybTC!*plz?C~IQm?e7`n56kJ>6n?MNevcEfR+E zYU~!5jyfc%Sf|OkvB^tVR%1r+KVZR~-E&v7nBmMX0u>x--yngEI;`v<E_i*@Vtl*00&tk#mm?cR3q zw4KldT~7_b)o<6wAIWO9QTR1Eed@-kF*mSv+=pK?-ZiX;Dm$^m+SzDLSRGlV z+Um%vzf0d~D*`*z@SUP4yy$2p9P zKa$yMIkCt;j9TKchg8fO=~?ygDM8`+LE>Bc4Qu1Dz&TzPy5%FNWQ(f90b%x%o7Z*l$VFlQXI>lU*XN1y*3QbEy#iIakbCBe!0 zQ}VAVnp!mFTUxI4zGzZmXJHt+S8`1dA5!KnuEM$w!9`2wR*nlgi%ch}d2<&os;V>= z&S$@S(lrw&l;kg+P>^3ba`@$i1x44+UwqxvJC=@GHe=DKdDm4;x_s)Sk)uZ4ddszC zV}^|yQF6y^w@sOT&Fu?rSbXbs74u71E$E&!e8t@1W9QvIZ_4G@E}UL;%?n2TFIO_T_mtA$~^n%KgsRgAK6K0m)e*5H61)*gXcZ5cCPr7_@ zS?Sd)D;G^)Svh^!b+_FzYT2~XxszvJcH7G8JBCfVed+Y-RSQ=xEVy>!@cEM#j$OLy zTQjb|BY%F;Ro#=mqIkOFH~#;E<(<_AK72dG@ql`#1#~8eoV)|{4jBiP! z?O&k7-ScI5_k3UA)9m%tIzShUj@$k|9T&Uxpa>`IC!@J|L41dfQ z?v{@U|D7*R{UaS)-_^QKKc|r_-TNoV4^Zkktd459>BG3LuLgW)X`6plDr1w5> z3fdQk)lnFJyD$C)zW6UY5ytBH7pPmE@EMx#r=~jm1Dfxz`aAlceVPr>7zmFh zDvcKuh*)%3r~5l{Vv)0s<#fdk6vQTYum=zIVAfgtM(jYuVu!rt*x_lic#(j3u<$;R z#P{v040x2};3cGY~{9_UWgLJECu*Lo7P{E+jgvlcGZ`I(gKgVbC0G zwoPQP=rFASKMI1FN5SKO?Qc_R+BwlL055AXmjUNEaaqpxEbKtuGG}{i&(>nyHjAB1 zh_X|SoO!Y5xL9;XLKNV)0MK}B_FN4$7M((fWG(4Qz%uq}D)q~aKC$QrDW_AQAU2Wn zyl3;hK9AU>?h%WQ_Q9!>#3E-oh(58%=TKgW9cT_VkuLz2wAKKN4zcJodvtbqbcjXg zG3xN92YL@%4!#G=nU1_ogV%I41FdSLPGe(KoRfrv#X8Cb4OVv+Ou%Dxyo&;V?r zLo7OUQP!B&`dJWww7zqG{ra*FwJs~?y6~2jzGhjdAeOU~C$XeU{eYu0o;pkfL@YX` zzyW^b1F=45=W3|?CP+P*0g>q64V>fH3AJ{?MSi76PAqb^38GId^64HqvB;SX(I*x;i%I0fBEQWeCl>iS%6UP9 zh(*pe(_T)gd7cqDo3rf8wOHx<`#6I~<6y6FvFJ08vUYqKb!v5?IzUCKmaRfwK#+10BE?xJpAkt}MqX&*vc$`~tA#kyz}oy~_C}cA!(( zWSrq!!18QHEc$0CufYyPEOO{3I4Txzusa zMF1w`cLA~JqylG8F!p&($yh}1^)(Q38H-3PanphA+pq%>i=4N487oCB@?2mUD@82w zvB0u^H?hd`fU|iaf_U1}uGUav(J6+gzau9WIiuOP8+~GtPX*3l#Ru_P7C*h$^-Rdc zPhyG7TZQ;ZEb?k#vB_&e)`j<87powbb>WF6?j6A5C$Y#IDR-_NVv+0fNJY>&=kZ!2 zXW7bc0dF}^j4Z;txO(C2TQTmTYIga;C3BZ!(d_c7%9=$hW;0-U)!fR?A7NgV}bLPvSzo_?O*Il>3UW4V&Dug17uKY^CfoFI^k5& zV_3u(t51}GUY{eVx($W3)LqbLtJ<<0&v!!YlzE87ScnkBF=Vj*$?d+5hrDh)r?P;~+i> zD)lC0Lb!cuD#xBU!La8Y2l4Yx^m;gPc!+WE(>OAjJcs{Xig}m7pQEwZ7?zB!Cn9*$ zEr2W$n~>N`0`S`V&|?oD#v}F$efD@??9ARbefAP<*FV1Q6aT&oXTAPSL0ADcA(+v0 z2lTxD1!1oqA3ULJejMtrY-uYh?U;X>ly49LCy&B43HH=sm&$a*BdXMFZJhIy|T!%^&g z;ImiQ*R{vjmQsGd_1WY2Tt4p!iM``KdqeT@N6s(51Btz508ouwmwRDvh8V+9>@9*G zIH{sAWr4`Od3RWVfVo))>Yc$t4p!R@g`n- z<8X2F9fy$E<9K+ly&d=gS_T>I4Z*GGFpoG{uu0wvlTfsHg4_U340b`0Y-7CRor{{7J7 z_eLRxk$!}Yco-Q_IH~h~)Q4b5;!y8X=y^%P_`U_Fjz1?fQSUNga1^~vD0%x)p9z{U z=9eUTKSX{d50no@5at3 zH?~1=T(vv8$K|-D(apQ{y0xPlpLToKdHOB0PbqrAHXgLtKQX;=$~{N#u}a)toZddC z{yvlJ!MV47cXMu&x92f?A!at7gr(!Kv<2S1U8@v(ATMzHvvn+HZ)2>&vf#pm+1gkbGg0@Mjr1Z+ENZ~I z#(S`4)4@m%f!#FYJ!!^!(u{Z0%s{Qlz(fEUgX8qdxJ<#{<9csBd*lX+8jAn2vLbL& z4J)z^)J;TB(xgLJ)9Fw`IH{=16s(N-bmNuxNM5Yd$%#{NUU#}@|8zl7sLKx3e$S4) z8my&x68$M%?E^(4ig$0y2(k~f-4LHBy#YU-$ki{|C(x~7rqBGn`CZq$=gm63yU0DG z*6G+GP0Ex`AkU8fCH(wlVteDkJWqenw#Do{m?(9Q_0fA?5&P63#U9Ni`E^6Ej%bJO zH{F&QIltEFb%pVI#Z#=uoWNd)IOB=#xspDXCLLFf+SK5l8TKwdm=KQdn&4_kOgGQ$ z4L<$A=qA+q`ascNRyGu)W+ZlcHsW|TGNaDMt_G_k*V9Lu{gIj9Dd;IY2|d532`(5N<*i(0k|y}hOG#bzdPwKrTxrD%!7M~N$?@Ks^|8#?+) zKQ^}7?B~b(g-fye{^9a*>J;ut?!7tA7oMQQ%OepC@7hf8=_mU5u0Fn-k4HZ|q(3KO z-|&+>yqgw<=ywPG+DN$J>pgt5KKj`~-+i_;Jb&*P>gDqX{pz4UU4q%q4*XyrFV78p z>Sp*&zHmM#8M1x$(a#S0WfIJOec&mv2gTp(>__!CQO1$_k2&`5)ZyJQ4#y>i z|H@^xexav482)P~eO?3Xhqcw`PrHww;-tstd(N}`b6@_PPvbgO+F#{_S8DxU>a@?E z^C~=|f0?6ypVqg}=@+)n@xNY&_fedeh{QUbg5G%DocPBy-%oKa1|j-0*2hafTIw*| zlO4?ufXp7sP}4skWT3ugIM)z~b=1B@Lybj;-z043gnPeFjP&Rei~g0s+0M(H0_tRA z2O<_7UK?2aRuixD97msRfbBeJ6N^5}-Oj}hL@aVfvz_ns#3I)|JB-)oEb7x)5V7d9 zZIwI{i(LEfFEc!DkcfLsziyTmS=XI9(p8HaN3`5O2Dx#kb-X5#PQQv-8 z1X2#fqCd_fCl+}z<&GUP>H9Sp*mizg5{nM2m+0`+25js=CD`mM zHPl%2CqtBzV&pw=kiKFp6X_GibY+femXGug%LEo5h{Yz)h4cf{KJdj1h~+7LzjV3f zQ5s!ti@@7?l$!ZG#AXe6v3W1BTo=Tm69f+Mr3i@rWIH$ySk5D{=$8U#Gozq8vB^0i z7MqvFHo~&UX4~v2IA8tst=U&C>o1f&j$RVDo|l5sRH-VCf@8-)tHK z5sMDn2kF1H2G}mb4n!Dml@5x0ne)civ7$f9>2&!u zDq2kc&Nm|&Uq?iJx9j9_ zfA80e^C*g51=8^9@wR$M|_pSV@w(&&a!Hh9zT5_t|TOtQMP)q zg%a&CZ({FDMDY5@cis#W5__j1@am<4;eA#}^j?L4@$;O3U^nwUis|B&a3tNGi0`$R z35NG8A+fg&a<9Fyu*drX?EyyY{Spzp_O^p57h^bzy@LQ=dq+I>x_j)EA->mM9O7;6 z#NGrbdF{=>NfQ6~_{A`uw`!lg2Vk$V6MMJ#?7f4?w?U8j?S)P3UE;IHF&j)*2&^Xd zZSwjz2btWD5Zbe`iM>W&z2f|>^#~Udd#io*Du_xj6-u<{{cgoIWsr2_I!Zx8e3ldv zdk_2U)xh3(DAC>p*u=khUw#)L;FuW0QS32M#>sQSo`k)pfN9VB-HO)@{TqgjG!h?u zD-G0phH>i(!#oPz&yT|%lCTW`$V#;YQSUNga1_0Mu;={_!FGs5|45?uI~a@P3GySb zSBs1>JQEx97{G?+am8HEhlsEH4l#V#@ZtaLd@c(Hne;{?9X>T)jMTr~XYu#>hHp*n z4a*u&Zhv9tiKEXSKYrra$)m3vdF}A)2j4pI?*1jO<*wURpO{bGzi>o)B1iHcnZbQ= z(}A`6+d}h*wGBn1BX0<`-dN6E5?)srJH6qpNJz!xcr|@m){)|AS%*sk@|m63H_uZ*E{du3!U>xJ-M2=8^c>B^?3oA<6A(VVqzaDMLEf=KF| zso;lk;a5juMg&PAv6rAliL;_gxGb?8XUtm{7A3y5sU*>R*29|zsKj2?-uV^q#ly14 zB%f&WdZ_)8v|WEJd=253vCM|LU`I+U@?1AKKPC1O zE2Zv|j$W}@t9#XD<@buc)aq4tX-6P7dv%~LJ3lbZId=yN`tBF|rtHit2|JG-J#zf; ziGwE(yt04RYtJ-e=9Q)qYoAz)Zz_>5Rwbztb3x<^>Z~^1o9AA$R>zSUR!2k8lt>xt zYc!~@(Wb)KDc(6xaPI&0)XcmJCku-w?wy!fy16vr>W^<6g4{L~xnB<4G^cyhLz_^R z%IoP7nv)d2t{Ke6ZNq?O3 zhv~nc`SPrn%3rLgO;m^L3!1KMe!6LI^X|2|n2BjpSz@Ga4~?ALa6(){a^f&mzCXQT z);%ZhnR)Ndd&N_HneFH-j$0F-$;&N#u&~F(zu$24%vWZX-uU#5SvM`jIk4k@V_`;( zM7QM|+AHhW(8Mt0!y;+#s%LF5(m=#F%0h9Q9J%{7(5sDkJtFg)P(QOZtF@xK8DE!h zg#@fNc;5DU(Iii+w7M`O*rZH5a_+StrRn{yI-=xrSsT24f|1i zxUoLrHaz|FYrH$36~CUB7Y%CJGtGR>+ZEql!}*Qe@1*!5S)Wxe=QO%?4#&qO*a`Is zm}jf8^qzBDUe^l0`Onp#2s z8@|*1%<~M#?{r7?^Ns9cRWu)`UWERA@?eH1FY;}o?(pn~X2^u^64nXl^S^{2a~|w! zA&9{fa&&qL+Wr7Xn@`Y8&w1Soso}GI;gfy5`&-IyKhc+7lD7YTB);KK`uH;*KHA@8 zpS>R1-u{Tb;n(~4-}!is#WG~{@AmNG$>VsXF~qF^Arn^e4~9&+zfCKdC-@X*xcC0~kv4g%8l-<0Tj) zN12{$-|((K1AOrZYW<{0{DHpkpn4kiTuS%xgH$ zlh41tKKsL+^!w5_dJhkB{N+236wD65cT+;NcfHS^ht=s-`t)z~)|)9<1F>MK9a-77?Y?s6DB_`=_SVjpnQFdaYTob_y9^7&Kf{|L?8r~_@t64QuXK362TH+AFt8WY0&f7Pf-G6C0W~BLF>YcAAzVb7gd{)=6e%F0 zMMxk;M4&MuQndlHfrLwe1xu0Ih(MKEY5^^!)*qpONRd)hRJ4{*OA*mpTQ9X$|Ic$~ zzI$d*g0}Dbf8WpN9XKb?_dCyg=RW7Mb7q7yn;hNd<^s#_@HOO*P-!C;KCiX%8y&Ie zmm7Lw(X(Ir`SKMm4Tt=8M=YF7VEJvFzYY2?!wJrA!#rs${IQUOd;tr`Yn8NNV&O~! zmfyE)$kD(15ew%5;4E#2RV%-f6APz+`ZAp03UG*i6tMi}%swT3fmk?GslNdyIAYPy z0S=T?+s5y`0i|c!q#Y7V*m~fg=Byz{+aVUtMuW4JoH01T5etWXQ0(jiPGO%q}1f4j}-@yBd4L4=Vq zCl;IehMrjT1%{qj^sHL3Lo9mMSFjsSa1}TN&jOZyL@fLT!2a$y!7afdZIW0xjleP& zz^*&pzs$PZ#IVIU!4XSX)}82yMZeR~6N`SYp(hso8`SG@fLQbwfF=DOkTVn~IAY;^ z3M`yB_IEu_5)0=t;9v?vs(UjT-*}%UoGT0t?`vdyBNh(7trk1^ogDxzlnTZZrjPxV<5b|l6s0E?J8ZYY zvB$KDiervx)X17t#1b}zdVNntEP5tI^u(g)_$KQi5Q}~|u&fI-3OFkhC%ADq{MXpf zzAu$}WHu!13}Dd{i+&09x8VdwEc!;^;MLTsXD#8ZgDjj)z{1%9EbW$9IIQ=ePUjI| zNwc5)={Ug=3%@&XFpF9}x2VFw!nq8p05btcEPD2lp#H%v68 zv2cb02Xm-ZX^{1TiXaERWvip+JhGg#`YS!pvQ|tCu<(h+J~@HeJS!*qv6q}k66Imf zjBu?#;7reGHG3&a!FeT0G4sw!EKAV#^pd-#-?m_8_3c&8`UbXrV;a;Y!(pye)HJC} z67h{V=H_5N3O8~zC(y{c2LH`WDMUGc`t8-1m@6gLXWcoy^0pb(72o=@DOAY2x%NTp zog2lP6p4=e(nVQSJ?~ELo5&PK<@Byuw^!BN=IChgl9QQ`E}6~L=Bz3Bvq&Qm*x%i& zNonS?1Wp;qx&f}aQIfsLcl&5E5uy|4X}TMR}-)t zo+RPU8E8{g^Dv_eEy12mW)zf=lm*rAqGp#}k{jtl=3KNdXPZnX;?^_TE@{P86#rR5 z?GYyDvg(zJtuuXYDOH}Pn5!`?k|~EhdvY)h*n&SIGE{GGwozPoSucz z#<~nSsWQ@k_1{ByW;b4CS*vhwdRjlnGc;~PZ1;l3aazvPf8`IaH+1a*7{=r!+CJ(e zJbs&P@_4WDq(lZRykhY1-zvaCw-Iw!n&6oMOg)bz9Nfd(wD%r_TIj`zy=DN@-r!_4 z&zJU?X0dmT%O3YE=k;Ek*voL)I|F;Xr=UIFtBJjy0A~95zA&SW{B{M8VG3~2eFA&4 zz@t5uqu6^D*tEyFPi>{|MIEL9f9a-mcGAak6MKI}c+=i~$j`Qsz6;Qs>03y9&@p|y zHxhgI0Gsw6K$~KDh?DZGhQhSB2G7b;e!Nc;dtA@nv{w&%Ic=n`5j@l0W3aapJf;st z8L?OA%J0*0ZI>U{&M@ue^>EUMtVitq)Mf7&?6s9&t^;k_D>v-1{^-YgIS63p_a)dn z3cWZfKd$?2+M5A;eAZxoS&m}wXTYYthw+}WRE*)T*xRAQ6llMNDQa#U?EyyY9e^>@ z-dnJDs}93IV(-@=nd#dDBb(t*d%bW-`sSfNO?w3>JeGqvu{Rq$)806YSA9UDy(@5t zy}MlLD~G+d>SL}eeKoKr?Jw1^*FoFUx9Qdd7@GlqaZEdp8YGl|#qBjCg;M;&0B8#H zO`d*~uvNm#1j(Gcw-V{2AM;BmycbX|QbyFDN4!tQDgQx`SuX5PGb?A$$8uMZ*?V6# zcQ3d9kb(KBbYH!Oz)NK+K6P!tn(IiNnhTIwm!9ggI{Chj6#S(Yt4H*~41(w{+9NYL zpidB9z*pSf!3UEZTzr{>4;r|*BWDaa``|cx^F*iM|4!_!zlYAmssisW;>@;iT_V;i zz}zyfsZclPL~dl(gQwZMA2~PX@nGhguehT*gTsTF63#pc?o5^ViF;=%evi#L6QR<| zGf!KY^`4U8sU@|TH-zu7m(=bE`3n{H95_+vIS{+8q~p7HbDpKWIsv}!ZoOi_lp~pS zvG}PeoKRxTx^Zb{U0fj18xtyRSlt*WyV>M#@D>Kz9ZbkRJYdBk?(buNe?6)GWc~JK zrXWO-e$PpFxLt8P@^{&nvv!s24&7bIbq}J~ort;RgBvQ!PnH*r;R+N3 zza96xv==gdTlW0e=f)pWbBD5jW6Y9^%m4~B7F+mIJ}z93*q0qln1huToHSh=x43zE zfv>c~YROY#+^!8zPS{*H_6J}m)u0{<<4=Z;8s(pY67Cx*Va}N43^B}C^EmT_IP0vf z)TD(zEtp+=y0~ogzR{Uw9gvgciA(z?TKwAn;yBLq!rZj(o+fi<)c9kQjt=F#vO25? z(BRB%nuYZooSe+Z%=59KlcDYPry?^OJuRX=S?|nuG}j1mcA0Y4mAKSg;p`Pl`^H<9 z@9$OfzR(9t>xx!B+pup1<}fzyXxv@Dw_r+WU#KWD%MWwN{65Rsv+dm)Pjk4=JJ{1? z%xsK|Urx@PSzEDvlQ5fgEBd?_@$HV=S}?~y#oVKi^PZZ>Qggv7=ZCPeMHeeQ^%-kv zxzDPsO|m+ytem#qGs`mPi!wwN);)N_TIdhQ7wWz4j@G}qY^+h!<(Lz;5H0#mqx3K{ zF@8>Do}$bX#5}arw^#nBxyrc2?BAJa4{et|W)`ZMqL>#JADJK8FH&~SyuomLwD-7! z3E?=566l#p-JSBs*b#^R7gyXd(5@~vK0Z`(YT0-rzrlEad}r_{Ej#J7A(Zf!$Jlmm zn3q}OLM3BYvTX;^3dTmw|4b_%yLs$GmGf6%4!D{{m@{E_yA_4O_&jhcocLR2jmw!3 z>7BkE8@80j7sNj1v(7%4f4Fn^?(xIoIikE7nzH)T>hZ>Sv$z;zp>H6@lEJepYiy^g1p5kbZN{IAwFrc#hrkoW2;lVYD^C*EcqO-Q(~% zZp=5wT<%Cb=8QzH>7vHvw&n>}yis*}_N(ZB+tB~!KO32M`DxvPy6VQmn592_C33PV zw_(T1w%UXfr$0Uq^Vu(i(w1#EN_a3zaIsZ|xzT0y7wXS0n`*R))_LdrRVS~3xEo^0 zaWt_%POx^jyHF5}pMbt&j)};98!gsJT}Fs|w?)q}uDJE&twrDL%aO8V>9z!}R?_r1 zzHgBDsLMQX=Yp^|&R;ogAKL!=9V@48w+6)RD+tGRu_~vX!uXF7q3L-my>^>LesZZ3 z-qW(U*tG0v>hbORH@Cd8{q)gSkDogE(y5d7^{{SN-Hyii!tBV-v=V>(e(o}AkK2Av z)A>lcE@DiH{_-GpTcY=JU-;&M)_IIkk3`KqhF>J4@^j|9XVy7ZF$;TK)r3Q0qMl2jTfF z(5{^|t83rVRi(ck>CCa_wM~5Edxc7rzgVJg8`ki&fxE~^-X#32u1Vc7%R05ja`tni zh1}BkUP+PhK03xrg`h1n6%q$6wH?Q$LO>sn5HWeKREfp^EY+SC;kT6nPfKoT8de+H zZpC*`ii{4Pmai^5xh4$4(;D`gMGZ-=JuPlOqlP1X@x20ZO`ThZnbq~u`r63aWKJBk zGtSXBJLxcDZM7GsulQ=`?ybpJoEE}&CPnzpqzJ8a#FE;tD6AEbsO0S z^()I9;r(8Bc)!;v4cha2oz^btX{*jrhhLE%v*osB!EWncktT9lw~97P8_#ZS>YF?V zT91}f4`Us#hCz5qIA~@MEB2a1JoCIfZP15vhlSgJI53cqXmu*tQdc=`tF^XxK>J%_ zr#_UPI@`lN#xo*gl5geqA9&8VpR;!1Ny}5>ewN*Zd$_Q--d6YpBi@*8w+-~dkd@DRoPF2PHu8bRu*J$ zSiXNYz8U16!c*`K%y@hQleYT!>axha+m}80p?AEQp4}-mJ-9eEJ#%epdcWSi(=+<_ zPVZCLJ3Z~j-s!2+d#7iA`%3s<3I8ig8;VvAU$JjxKCa;S&Z;5c`Xl|_+K z&TM?lI)(3(w%4Z_c@SMy8@efmZada!8&JQmU@g~a^H&z&eq&OjCp@VUb1D+CYkCRp zI}Txg^gmnai(j@LU0mX+Jkx0H4mB23o+aRnZAUT&Tijf$a$9YU5=;4 z@so1RtPkQ{fk?Q^ufG9b`#D!?j4Zt|vh-exGQt;Zz3~NGD!yP##TRU;_<}7JU$9+? zFW9cc7i?FeeA8szKfD3x=i|K%^L57Od3yQodSBs&k(K*DvO2}@Ugj&DVCCY8ue83% zD35g|{(|tSkSFj8p2c4AdD5|m+@sbTp>{f2ZU?=Pq5l zb?=eVv)AQUT-keiMdgf{Ro|L*`|LaB+&OpN{BKv^Rde@(dlufi=sWk_|G;+_f0cjp zf!`cFbojX=&maBmu@{d2?!@m;zWCD1r(SvWwbQS^@rO76*iz_y;&-07zlOfI<+UCI z0;RQ67CyCN--*4&e}1l^-@TouFZ)AA)lYxC_*dWU6sYc-(%`SSvU1Gd`aLn~Pm4dB z`_H&`{Xbg2wa|O{iC=%Sr0V%+Ups#PUp!Bp&yGKT!(HAgPvb9RpL_V1OS+}y?{BVd zeCvPin%*Jr&Eh_D|Nh$kDQWrts@gvJ`kK)>D}Hi3wfgg}RadWjJN?$a*0r5}K5p6G zs|KGLw*HonxBTFnr?1$UH@VRJ!1h0F9W{T@<7ZxfWnIOtV^Ov}i76W=NS%V#t1{z=C<-~Ih>28K61R=ID`#kIfq(=|^9esxWuck719FJ}M# zoqu=l`m?XU|IoyL?>RbhS5wv%_x-HXy%)aLGUS%Dz0)5o==$ltkAvTzwBfbu$GrdN z9^ZZY{esG|FMoeV_?~6Yram*~y-MsvGSukzhFqu=LaUhB8$(V2hi|Bw8Rf3JVFv|+`;JzbU_ z*w*8_GhbO&R5K@e+r`AMe}3&%iFYSn{=KKVriRDVyffm@WB$?Svj=nLc)I;hAm!8l zS@Zad*LT|Zny<&8ft?GzJrdi^@A&Br=XPFx?|U8Nc0N`7!jwPkc=nI;KdBhddq8l) z-zUERug{-b`tHDozuErdL5n&bys+r_$YGm1T~m1MrIbUnCnXnp^Amer81V0NgVIzMGs}1X{qAeSP5mzK`L}=hr``DagX-XK<;|DVz`$Jjk+PeF*(*8L7&$sQ!{MzoXo&5coiA{^{n||?Mt7%>de$?gJ(1H7By^wHh@4@c*@oVq9_4G_>ZP$eU(3m>@?Ut*5H72#A=gJwXE?Ul9v`r+#jSjmrVzIMn}_x^K6LFct!uJfFHNG7dG>^+Gg<7!4w1@|P580%`Azs1(@)X~N7WX;p% zd!Nk@xcHrHd0iyDlFME4R+oI#CBJIO(fL*JIlq+#TEerz?JCzdpk6;qvck#~+ONEBW6p`3;xsd|RpbZyNs5^>w*ze^|s{$(s#X z_6ptyT?|%LVR@`E{G;tDf2TcP>B>)UJN)=a_}(u6blYG3#!6DU#r-bmdg1V3)@PaS zKOJp3&*oP}ejHZeo%Wq>?-~3ZaM>*w{t*D$x=PFc(DoKU=HBqk-|#sU* zY>yu6Ix7jknbU2<;lav2Oz#t}{BtcN<uYxSe66ED?G+euw7sir|B8tJ zRn}tNp9Vu0gB5`o-ihxjS9;WV>GU5ZJN@@+7ylaTZ#u5Iw*4&IeqN+KxW^CWUlmDT zmdl<>pVOYNwGwpws`4nX?Xx{9cdd0!w;v_;6&)oQzr;>f-Nq@%3j#G;iBa*5Nrn zifcX})P1XuEw{H0YI|F3xr6lsEkA3^9j%)*|BNknvSe>~h_?Nox$?Wzm7cyX{{@l0 zt-}9ar%&t!wf|&<;~LD5yZB)jKfz^xt&7k7ZN#xW^IbBwd5AdrU+ya3GME2emz)|2 zt@87>PS2CjCu3)utuFpFSNSZ};pf}@-spplV|wJ?AO?1lF&=Wi6LIt(;3|)!E_t>~ ze$0q~;f>Fi?D~{%xfuujFT)X7Mk)IH4bB$}EVtG6+%fqsg4Z$86N{c>vgnCLUu5Ws zML*Wi6N{er)`13`;D|+E1uS}E(JwUg#G(hZWX)~nGq8dhm1p5_+zhO=)%G=A^!*Gy zvFJGt3!hl@1%{qj^yP-0SoD*rUxgDKvFK+2i=J5Y3k*H6=(_^T_uj0pEDrK;K^%ea z+0e$qXPV`k=i%h6Q5<67l#-*rIUGmMTE!t24$~Y=RQjp-6KHg>a9Br@o+SombM+@F zK1~GK0O9yYFw>vHN`oU7n>oNewVqh?ydMm7!U>L8^lU%!{qTHX;SdXlZALi5fF)jH z;S>N%yu_lP1sv#%6CAPVX+Nmfrd|y!9Ae=-XmGldqx&GSaMGw>juRZQ=!Pg@NOA#rP$DVlUT=V_g_6$5KCD0*#Hv)M=bgr zU|CPwF2f&?(Z*WY`rFP4@C#@TvDleLz3#unqQ3%IzJX-C@=azDa9|ToaKyqd2llgK z;aD$$hin+thHr%`n6C5{_#-yizocyti_Q6lo>=s(I~hNTMPFy=iABE#Sia9>QA)g9 z$=7)y7XA~!!M-@bJ&7ahDjQnQ;E!M9V+KBH;M2e|&Jc^uv%tX&oak^}lf4y)g%b}f zoUY{P`XUz26$Z!NXL_?TY3?&UjA3;v`yfiGFJjSW z8+u~V52jwXZDP^eZBqArvrXFVBojn9yZ`EMP+Rq1&Ec>Tc-W>}#A2WI9tD&HjEkv%AgX?cyb<99AdFE#o$zsqwNq2XSTt4fE;#EIAY;60!tkci#`?DpNA7% zCXTFuHdJY51A!~TA^dV+DFs>dOHoLD%kfraxR zIXdse!eLVu&USKmg5w|I>;x9hUSKI7V&UvJI48+z!U>L8I2@ybgQ&HvGdQG=5DVu5 z^|~(*i~b*mo>=t#(8dBkh60XQ^c;))901^o4a_k|^s|5ik0}nZgq;s8`K<-c(sr%@ zRqhXog`YwF4rPZ}^z0sfHe@*d$-2&lYQG8HHiknb{IS6DEj_X5CjkfbIz(&(l4fGz z*zG}c7LudyV~K^sC<8yi365Cw>w%>%h(+Iv`Zn$p?EGrIncrOUH{t|GEOwap;Mb_t z*K0k-j)yFqDZs*+4=mRsV&O0^!l@^RjTeqsIO~9={Sb?umoCv0i{7qNT^DAZW|Kb* zCpco^4+ahvQmglH`Kg12GXW|oPh!#gsb^y0h((_QEP7(mrvV2?-~`8OUrMnJZ7iIA zQ1#S$V$t(b6!@9q6N^3%IHg4CiAB$R_0)P|(U$@TR^tRmEPA$2KNWDSN3m(vDch~s zB$luu8;J}lLPb~T+z$v4Zo>=s( zlAc;mEc!-ZDMMn>vt6Z>;RHu4`Uin~YCW;&w*v<@-~>l3`kla%-@U+r^*F&13uiyD za1H`Xyu`ve0xa!(ccOzc_9}43}8v;Tyk_?h=sENIH==Y2rTgu3+FyyiI-UPD}g01#G+phEH*a* zOB%M2|8tc`V&U&F_)ieupg22$rB4wHe;2UyDPqw-4J>_%SoHj!H-$GcaKxfN0NhjS ziA8@HSo##P=#K-Zj8S%oMSl{wr`8jT{uKEfgy4upf0}%)Cl>t~U|Ii*SoG(Cr93YH zr;JlJiG}kXa8Io#7X1h0>lcN@qW_3|ttS@!zkwwU#G?1cIBAFjP8qM#KrEa@;GSAf zEc(vC(tn9X-wRmsbp>$BHPTSU5w0dulzg z=!=1+j}VK#99V3Q1y0dx5)lh$JaA8~Cl>v!z+#hF^fQ2ilT_Mfk<;j4;Zz%XV$m;R z*qappKH!we4i-)=^gXqnSoC$k(np9zzlQo<$_}yUHv(r(QTiudV5Y+3Ar2wZ)qXvI*2tN(D=QNz)h((_ZEP7(m4+ZvD-~`88hhEc&qVK(V zDGKbd)%Ln+5|&*eI9=&`k+asp!s$cK45eqh!f~fTIJ~`1nW^~1VuzRZo?1^VdJc>7 zTt+PVX~4lMoZuGV5SzrpSp+OLiAB%bQ?W@b`cz>5ES%snab(?YLwj#zd1qp#jhCgM z=CB9?O^Qz}Hs=5fXC<(_<02LgZ3dpg365Cw(|`ka-~=}fhv=Ea;2fObYH$dLSUC3q z3un2(Ar{UWgVO};*ESCt_?UrD0ZTg}7CYyu*Y5|2MgIx)`uza0=q=o!aSaJ~wQ zOOTcFZ3m0}c&K`6J+bKf0sE^JKZrjPmRLABz`b->V$lOy9#$-z7l-F=8(L*EOU8^H zcjNePOqh7ft&w%TxLTT85=yN}_bG}uXz0m5jP;JQgWrpsWIj72w*d$4URA#W2o62=mIXK&6 z+9lG;&(5#%`frxi(_2Z-y*+w`zDsXFs>;J$KTp=nVs*^H*As2!jN576HM6oh+E+qK z{`G=#Urj_TveV|g>N}^`SlG|vwC+U1yEA&5Q`MfSZ8N!dRWG=$<{s>4+E!lh z0g3i(W4l(fp<-9rxih|sYPT4N>15nlq7Y?dt}JLTxpw;;?2L*JVCLN!RVt|AFDu5% zSu-o|XuV5oTk9OEjOey-MJFz*uj0d3`mc|}IyXAh3q zB(+hD3v-14&?cdOM32<=&xTmeWcSYj$VpWf{Quyb*v_)>Xc2KA7FpIGp%aH&A=~{5 zXW}>|T6y}f{Neo#-71jWyjt5worJd>B;K18XurLEEbCQZzW!%==$C}!Dnw}7+XG!K z4sl{H4LsA{n!c9x7D%+`!y)$WK>*Vp=l9l$G5i&Kd>>=ltI1G%pVA(SN9-lJ?CpiU zu5H+B=d#!DDwRLlOEB#5In_)b-$V9k!`?5!Gt-v`d)>jKz4oR(WZtyLcZ6HovIm}N zuN?LkYI_|Fd-$$B%HDe9>)AH!t#;WvXxQs$*t^k{-|>*ov|+E@mEU2wK^}~}lz`jG zuy=dA==9|xQ+%!whveFB26$$EYpzz`Hqc%G2mRRoe&=d`JK@3acf^UkqptSn#ls-q zf6`tT9AYoSmER!3O>VK;Ik8=)}P@$dJdmcQ~-u`TS8vq{j+Y^V_<9<%2y`5<6Pl_@86?<=j zWZHWI4>a$?pY|@tA@TCr<30gThQ-uOhWRDD9!EMC^UXmA+IA7K6nY{))W?uJlcYJ<0F2hQ0Z^ zJ|x^^*h80#IHrm24p)7gfW7X}Gks{?ndMn)cHzM zJhpdn!sEKf=K8Pai}(esYR}{fFB$DX%9#4eh<6&sN&460V16;=;C6m~WbIe3>iSjd zzYfgppOZ)8f3W`Rk=-i3JjBCU$r}+nSH$2-QCJBGXlV)7n$nuZk@b|qKA&epX&~-7 ztWdQqaeZ^=qW*DfeU<)m_9__xEcKk87U%Vqa{ZA)A6G6F8(m5(t*5PVCH;M#vs_8T z@rj*OVnzGOuC!b^br6ap;PqPZ#oL|rMw&+z_xEDOCahtkcAe#3;pJl%H;=lJ>m&LQ zGvkmIZNHB^{-u_=tBb6I74UgI(d*9&yVdHmMwnucW9y)SizDkGVYONV7e{t6hCVhB zR}izfr0rN8yWThl*BRK`&d|4uw&JXvYjBKoyYq_jX_ith+n?Dmt1whjX+4D!dfo^% z+Q{Ma1|DtX@OcA|HgY>UVkfq5gU{0(+xK~#vBqsN<%|uIPU?N$7B5#jqL1itS00Cb z=OcRx%MQX$%ANg+QI|$J{ikIn?IYtrHg>$1c(ImEs1EBNIW0wYRAw6sguI@xZaM3W zwTo94O8TS~g-Q&Iux7~3s_wXpw%5~Ednoidt6;G`tNq-izP=*0NWV&BB!2Ecj&+1p zSuz)5sce6K!%lPW=oa>n?NKWzIyIou8?xK)y5gA8&dSYgt#D?n!T~4%srQ+|!J>TRcsbc*69Qq}L{(p3-$cP#E8D(Ylzfc ze8D!XqKDP7H(Y0Z)}<`uDV3CwXQm4)*hWg)S5mp=C&KXy&GSAFDa)009@+j{qI-wjw{xqGF5CQ5cv2L* zv^#5Pd0P5ezS2_>F69QNEw^yB*5jd5^`4PV35_-4^b}WGeLZ8NYB$qZw-r}8SFV_+ zgprl+pHpjPVU6%!MS*4AtnLSvKG)7#{F~3ZR-XCD+8y_?)%gI|N|XAPp1-dyzivnU zop<|2+HGXoa|jby*4g^3TYhMZQQt`g>9u>Tq=Jx7t)0a&Z%OUD3p$Jp*T=@R44U9H%W8Cat`-x`EFa;}rOx%u6Dw#0?IwDY{Y>a|q|e9eo) z_3gUH-c*X~{x7V_rTybPf65OnsZA=9bpD@+!PB(3G^r@5nK8*qbzE(1!${R~Dr?($ zdX4DcZtyEYHx??T4?pQ0X2iA(~fwkg#V6C_wSSzjv){5%}|8DT_mfr7?Zs{36?`E&~ zx@y;oovSie?lRg@1y;_Dv>A+)Wn8nd2Ub?=ftA&IU}d!)SXr$*R#xkdmDRdqWwq{D zS*;sZR_lh9)w;!IdAcplYVLYDT1#x-W1dR9H;nCD9urPH<_WYfkKw4h$~qm1VeWBH z^U}UaUaV!9EU^X>3Ik;k#L)D5&cjb1e-FtLx7dE${WjEhfAgeFkJ zHGY3-C5&EN9PaSXFMPfMb-%X4UA(wx4S0DQxW1CzDNlJ?jL`$Dv#-cFns&rf;wcVy z8EAF&by&6A`xDE_1@Af}ExdvY_IU$$|D$8&w27XwW3!UKUFwvLD)rVm=4#6l8u2!a z@_#U z?hRY9%JHF?z=t1pWG=#8Ct9mk@Akb=Fu?n|wYbH%IFdKtPb{adJS`La6`?IyQ#X>X z7GH;$NtOOzdpxD#&pz!KDw&lWesCbZ+ni|m;?DWHe6MBkl<#+M?&PaH^OR>!a)pzl zmazu|?N)pq8aebpV8b9>eQv^R#gSI{!Ead&tJba_;QbZS_zP>d?-gtK;lQeH*8P`P z;yEnrt^YjS5c+&FQxZwXaja|UY4$YbmQ?w|H-$XOBP-AR0%;2PR(Qgp&%UThUVgwA zw>EA%u0w|`GaagBZb55`y=JA4_Yde{xWi=|SzBzkku!U&hT=f|KfVZ+?%s6R+O@&w z%Ra&u(z+$F9fgW_Z`$KwTSAMPxE1Y)JYRR(3VSEwF2J@I`o|Z((%mWBu`YGykpUAo z#AKdu`iIjO0^ai2G~*hB`+HogGmcF)bm6=%)~w_=jj}x-vnA?!KP&lSjI-vb%Ci&4 ztmJ8tp2_yKeTCz9B(gs3`3MRpHFpks>x`C>QO9v&lz+)Y?CdZSy$@}nBJ^HpO8tdM z9kC4`ObjG8cX6yc{l?i_VODb6t(^9pdzj1yPYX5D5+OHX?8bNy+n4o-yAAY+@W3u8 z-$-jlPn}}y;V~WS*sjOQ)MBF&zjqj;815z$ts{|=3B;8{YA88bKX#dfC@S`}gfZ5= zgqEG{Fm7C^-PWvRC;&S|fD6l5&5iRl7C>>OTBpM?(!#@Lp)Hk*?U0Uh85^ zMRdKi{3B+ei<#MA-<9I-{Ql0BYnU3A@7RNLj|W1lBI8@QLpj==QwNm=KFD*DjTq4< zGmb7UUtBz3)kB`Dx>?CvBBdR3)6$X-)_^V>tdMuis&wn8*3k8p{vTMOq{=lHt;MCW zrG+s8-;FW5eSgNCh|k)6&nwn1R|lT^=!e)v;qfcTSWM3a&zok@4kgf28G3@WWQY^Xo{)v^f+pupy_Az0E@Bgsl zoaE{fBNr`WL))Xuaenf`CwXiXcgfAsq0g3l)`ib1$C6JZ zvyDi+o)${c_2q6unGI-hO#yFvPhi9K)`J~(*Zs6$%X(*oRxR3Y9ib1#I5orC%WOEl z%G1>PPN(gCBhDSTuphgItQW>^9zM$ojqgoSiHZJXkYUauH5g96L55 z^|Si;TlHou=&!QZ@Rcy0mMT1-OsRKPYWK9{;4?&OPZ}jlS;Azl>WBA9&Yg;VmtZ-m za#G}^X7(j^&xjktJtsV!;*O^s%Q#wgWbEOm>vHS3x5KDNTQ|pGPjjfmDRWQrXA@0{ z>pOE72+v4ko#iIB0ZF^3#Yr7{mCMKAeVJcN?}Rer8nB}-92#wnvdrh=0r_h%1Jj8M zJIfgPaaMKqA@^-P`&S&yU76jO*$omV|GtjOZ(#rW9G#+;ro~H3w)!6-%q!@CCUKYZR9Z@@igd0{Mm&b8+ zIBm2R@}|~1_XrrNj&oI4@=07#oY6*f{os)N^V|-43a&&Hcyu)+y zPF@&qN0{3!Z9KWN_M~p2o`##pe`QUcw8w!juWz$ojz5@Pm)Q_#^m)cdwX?)XsfFW4 zTa6)4iTP9?PN=gQ>)Argnr{px)>A9x?P;MDeRtbBRH($cQ`u4H#EYlW;^^JL*sG*m zqI(zK)ine{KI4tgyLaP`v(7g-`V9el1>UQA_{=jJW3Sn_Fe-!3D{i=<&N9oLx)61nWu%Tggf_-xQ5o5;c!L5URJo$N6K<(-vsXu zeXADVxgg+;8(ev28&c!k#W00SuTC)Hj*mA+y_QZ1@$p9^w#bf;N1BYD=4s*{L{f8= zn~JnTt5RCXJNzZwe8=@UA<7U z=18w|)M8pPuP9FxaMzkj{~OGJ9)~D2al^naQ@QxDCP*?lB;R!=Miw>TE_4Ag_%45FYzv*!PYx(xTV)c zj~tT@V8^jK+2LlFz4t&Q-l%;L)|IjEF5aJpzA_2B)MP9>zRbB=rj^lO;y?}AIUl;5 zy zeQ5V#Uu|sVnqTUeYGc1DCSS4J()&GqrOvg1S558&Y41^nQAFxZMg!hoay-C0B9vZQ zee0SI_)`DrX1l#}#8KSp3}M@m-eU-j%GcyEu`@YFH5 z@bY#Ymhz2rdXrDJ8~>8prITjHZERkApd7!wmfwgL9k;ldJw)2DYG3^2DD|I9YE2($ z_n|mbH1|-}{!- z_WyR=AJhJj@p{>7V_zBn@}w81{64d8dF0u^d5Q{r$+Mkv2M|bH>~UItpuH!?d8gvs zRV+7uJ8kjoml*|8^3lJwgcF;6@^*i@#hv3$nfunX`~tHt!pquOE3F(XFqDR!2gMFr zc`Mt|?C$YqX|$?wr9qU_Ork8gx8YXIrlYf#pBeF^OWk8t5c?Jm8WOF zvkw&7*|^ygPERPidEd>MQ#MUWyya@Nvj5fHQ7*l+&)mb$)?xQt{Mv~tMZ+LWV+$lD zS!+h5rzK&BVH_Dr*aI=&Xq{4rlW;Aa;@W#Cvu^PXY^zdM&a;kt4>o5H*Io85u1kaE zR&3TvYiZUoYppkQ!E3*Pl|1oGgWA^vW|-*Wuj;0d)~>+OL% z%AequEhl}E`bY20ti#(j{Efbf;#XkY+wU^2h30(&?<#OV&tHS%o=2N?uCsVH^^S(d zX)U}nB*VPx_B3_C-BMJjgwa-Pmtu=|^3iW7$TP3Wyocnojr076Q8aF}C)!@81oLi8 z(qP%DXiqI2&mj}~`%;VM{P>?&7J3Ge)4xBKvWM0(R9TtB1BN$#BF`rJm2kV1D%u9VoN z;^fBU2Ao9IQGpdw)?KcE4Vkzry~_yfM5Y&QpY4xSY4@Xoq!WD8a94 zhk>LztHOTM5y=6{pu%{@^E6lBO^#82EwNn=+ASf_-s=gh;=7}Bq1lnV;eMr!_d@H+ zW5)0)cnab&ZA~##h_)YYU+0oJn(O7|P@nCI;${BF2-(Z&xa0h0!y4?>NczK1+1&w?EAZ|0$C^ z?&l^orYxSc$An9lz1)*X|0vsUzrCpQdBSlem}?XLzN8HGl3|up)bkCW-&)`2isd$X zo(|2iL2H&; z*n14`p3Cum+8K-4lB&=G(<0@|-y;KYi5}W?t_Upka9xszZ)cqGnOa)Ra9PYic}80_ z-=pw4(w6-I>{q~&yR9%K=KjQtwE}6bGFk;w9d2CdVHEyZrY z%mkDIW65y6KV&S9HMS61Bh%+dod4xWoE7D? zuS<=C90fTW>&-Ubsjf5L!Cva_ZD(VsB(t&d%pq$j=247y?Q$!3SiK`}HgZ=yQj+VW z6SLW7MXo;Kp4VB&9~v8S{{mCvq3vd$b2p2(0V|zwZG|wnd|FQO^{cvM+E51Ge|^Dg z)Yyjg1!eWU6Pn|qpVaT~yw>YE6G#H9%P{NshHzXNMyYJ0E&>hhzesFH|J91%LHm?|%Ph-|p3-kJjuLhw_`*SeGoI0n5$%|&OmA4hz?nhuR zowy@X)~2qvPppcz&=)EZ-Hw&a(fz%q_dwoilW?yiW9zPZj;isF;SMWc6(zSLcj{VY?*-?#!@zV8X&vdt523|ZklJyCyA_ueg> zNjxd){$aZJ{+^%ptn|0H0;lf9`|*>JRJ7HHRsT)&VBT%3`<#+UpTlJdyE`S=pB3<1 z8>~}fV}47}-Kw=eJ-~x6zGG7u-!ovh3;UA;)V%$Dr_I5HJ+8B3V;bmUoxxdsf7w}M zdIqfhRAZh4_lej~i02*qyEZ#4zk9gC+HYg}iOc!#Tz{*yZC8?;Uz%GwqW_?r()=NL z`T2!|@`_7JiwBRe29^}&mkt;_q;SCCqQONY2KO%+ls{etM&#!8&(9k$Bxm5@{K0v-C4>9t7Z1uEoKu)Lq@*;zxHPY%uq3|- zilWlNR$l+Y+@hTRg9i4`hhOf%ypsNQs>RT ztrAOR)C5zxd_t)&a?# zICtj4`7~{~Q~Tx&o}6f5C6xL29H_d#RZ%_t z_PO)t&6_iBVEn4t}yT!yyUxq09a^&cX(fuLKMJ8)qC zA=bjYJWR%ze)}AxwqM`7uTGTBYh^h2ul{;0^%Wuio_S}{eb*K4-Pv{0pFaKDj}Fd0 zov`Yi&AC7StiHn6^|sM_t=l$lc;?Y@EBpNX#Lp*gUi#Ntyv4U3oZM@5{i|tX|8U|* zoo>RX%+~)4`%7NKfmA#0FS)`V)kPC){hk9q9KYxDSanvkzt8%i_8(>Yud`zCL1ZZd z*bYApK<+1^<#UB^XZ!Q|pq!HNIbB4KjxWLH^O~TXl5stW$kF`vuK1OV&mFZ>vRzlU zroAhD9qjOz2_3UMqwRNe$(>wsz$JIF?a6n8y!u7k>t_4!jl`$q*)F-sC3DR+<+{1- z^|0-+Zj|fc^6zQ;JN2Vv`3{y>^XT+l?vk&x!}k&M*zb__9W>zZxYc`a+6CgcF6}^@=Go`&Sl?OOW`V4`mVOq z_gEynl6Sh~JuX>&Q%R-bCr08^GS@g(PRX-fa<(DgrTaVc5QDG4S%2?KaM+J7f93D2 zU2%=|OWprJvcu1|!|#fOS9~Y^*SPFu*?gyeDVg_(%4NCu*V_DH;*I?bqtn;l_MZ^( zSF$r6DS5KtA02*x9sbsczmlEsN}go+M~5G1hwmKmS8}RLcKZK7SNaFp;hphqko6dE zs^MOZXZ;Lu@rSt5tK^L;2+m5L>XNrc>RCZJaOnJY{pKB(Y{_|b(QJ1{NC9iYI54z-i zx=%=cpKoAy?+>dme*;Qyu}sYBt!nE9xP7U_U733DqQ71+2GTDjZ1#oC6~GS>j9U) z-{s%WB_DCg+;dhrRo-J=@+6nM+K_c|S+y__gZEcV|5?MI@|!OCyi4A1lt-yf$ppJS zSKIbZ8veBRpi6$jkh$&(-4q-#cy|^({$FR?bH?xMT>jVF{ugWuJSlmaA-C6c|2cFq z*#DR5dD`%&yw8xM<5zrVyjSwV2w%zTUGiB&j<%=z`;3Ucl9#yT0$m#Q8&sJT3lO*t_(*Ec6OqFjo}}iUe%u-vqSKtWas`)$xix4xaz0G zC6Bb@8yc~vT>cLla=pIU zVw3h*EA0F|X831D`LDA5Up4%r%X_r#Uo6SDlw9tTn_M!-QsorixnEJTbN@KnRUbFl z@#RZ!OUc7s@*0=C*^r~tKgPD_gjaGf!dJ4>{>Qk|^L3YeqiruU68=V)|2J&^DH@@UP^ZEpOx(7Psvp-`yA_(Q~u6)qT~hQZ7KP( zNPE%tT(Wcjr~GFb{?YYwlbzq(hvJooWT(89d{MkDB|Fb+N`A}b-^;KU9sg~1 zd?^wBZLai8cgYntKP|#nvQxfFcG|O&M;ZL+_-EMmrbN=GWas)c!>Yn~^aRHHfw1AR z>a9CCaKW(+#8_2UuD)Kf4S1|&)=GV^8HCLk>{83?g;PE=tVGyrfjy>?_UNB$#Q!et z_qxCa#{l}ziL&2d^J@(L3GfTS&oJzrF#MzQTV;oL%BRZuLg&Y8hhJ;^_X1X~%2oa< zKeNPJ=WmNkp5v0281h@l|KE{b-quR~o$*%L?-NPClKZ*jR6|aRgCQiIw_LOronQ4n zASV*Pl2cvsT$fz#l6SadCqK&G377u|h8&$9b$`sdQclTEc`JFNc;ok1wvT6AvNIkj z|D!Jdu`apZB|GD#3h(4^j&+^B-(eZVVAZ|o^v|`^QxvhMWaoOK7a-aG|R_)%$}{;;r8&IQ>JvUvT-q>5|vD zo6^0y)T zwOj>xvElz7t`92=|GkhOGW>6ayv>lgk^RpM{-0p)e+>V_ke@f?-H=~2h)9(NX?uT>fsp+kY)hM_ep+$&60VI_nlr!hl1TaICW`Q8&2!+Xv-4A;%l? zJ&@TX$)SG=1hzen$&{n*hh6dp>jKJ#j_o%Yt7Im@9$guZWVDKp_4ShXu*qmO_iCAa zFc~vOmh1HL9z7Xf*KE`62cn&hQth8?`**O$FrjeSIFhlt>kchb$8?9a%xicuR?+^G z%YUAhOKtyvHH-;|<2^$%e(%Hdt%#$&?`e6T?cdG%hRgp93sXDt@6i5bz{!}AlgNsI zQ*uwMrqw%^y<;>ynq8iGqhx|8wy+wWZdzjLK$siNCwrvFo2e^gNZF#%ky zZSQL9kP_`P{kyUtw4?khm;FvIx!BcSPP@XFyV84Hmk;mpld%f&kF~7Y!?jkUw#P9k z8Kcy3-Cn2J@&Kz+`;W5af!3a=_BqIsYd7!7lJUOf5nbQ^u=6|8ddOA3SGnqAo=bLq zdr;-~f-AqPG+*_P>#WyxdUy|(jQ5wLT=C7-GK(b{D=inh;=5U=_n7T}gLRY3{|aq? zj_p6j>Z8-6+TYhLuH8;I7Duvmqt#cB532or!}4i)uARP#)?1pt+~(h89n${eZ24yE z1}!W5w^%>Wa;hEvo7Pi0KWR4qHfxKnFE*28Yr4ff1nDN>NXC`sS}mWm!_TmexZ1}s zSNZpwDMpw9RKPLXo?1^Vditg4XJTT} z+kCAz`AnYhiG|N%?Wy_1qGy`9zCRt?oTQCdI9-7yZN#F_0hZq;*#9J6V&U+*Bk>Z8 zz6iLNP7kr@*&HMd#G+>sB@M))XI}hzjOYv;)b07dwZqG}ANLM)%wtfuLzZC>_vmy~ zN!r|HC~0GPO4_;u2lUGcV$r7p2Rq>emw_Y5KyXZRFknObnjUyjbtbbOnMctRi%r@Q zJ+bJSFVPc=p8Zes#G=2H9bQj`Pb_@iYm1&(^c){VPb_-&ThSAXelGPdtNap+o_P(s6bt#4HqTHmTJw7ykcXuVk%6-blhi&)andI{=>tr`Q@0ta4E zbwn)uHNbvui~+Y1M}QkmYb=~6sefJRiA7Idkegt@+2#M5;`}G&pN24!eqyniZRm+b zUts8oMbADS;HDpNW`DQGnclVCOc7Aywg=>}Ht8KN)ujaJMujb@{ z8qgeKvClLFGnE}bIph+`271+a?RZIqv*XqHe<@xL25@$~-%yyU zENzn-<|RpaMbcnDH)*~3+|(I7|4oX_Tb$q|h5JxHSz(@o%n%&wE^vztZ7g|Y(+~Vx zl|QlQS@g1>JChjrOmT>XL(@SvaJbDl{L_f=dn^vwuY3=%Tw94H?6c%l;skdPN7f7* zT1W6l?uUtmf6CAki~g*kCl>uhLr*OF&ka4X=sEuQXF>sIk3Z9FXmy8P?uCej&*y*H z_uL+%{s0A>IY#k!C*kA)%h*UPc7_?8QiDS*oUy?EZ>jW5B1iX4V&P0P^u(g)ZyUlV z7JZGOCl>t@Lr*OFmB9YnRT|b1-=^?J;NWb9A11C)cnffr=Ik)=lfcp*h{gUh!2UZ_ z*n`A#6y_~>)}0EUqn?8$++}FcfzP4PSnPC#J~+=-TRG(Dv6@&o!wfyK=tmiPV$n|m z_Rm)~E6CB$eZ<1yoHL1wSo9A7`@gNi){~>#39)ci0|%=Whx2HqzKDgh71)2b;ygyY zK;fOh!Fv>b7C396!bgbjRrmz?ixmEpd|pi8_^w>iLo9K11`gh(I9HIv4gKJVg_B`$ zg24XoC=TCu`5#btGH~F#4wkUfjIis;U!pkM$zSSV;qM}UvC{7W&Z<**Kd`@6;a7=6 z3ZDU%c!|Z%d2;F%=Y8O;8ihZie!0S*0|y%vPV_?GsBjQltRc>~zbn+v$N$kF2uv2flu^u(h71X$WCf25N#Ar?-ep(hr7XG2dc z`V2!)EczT^|2mb62QE`ZcvkN#&bDjmpvg5XUgM9r?gIM_I$l0Vg7s=7@ zG>C=6`QRb1$&}A!RcWSn8Bm_*YPG-)UgnF!cR^gS=UQ%OmH9 z4wkTd2QHj4gF`Hw@xcCvRoH3d=z1g;&TMj;6lWpv28Hi4a4m4wBTBy-SjKi@v9pQ% zEsE1bzWy0>C-pk)9_qFIW56f+~ZGhFJLJjVzCpXo)=X(V$pM-NdIV7X1W6Pb~TwhMrjTyv4-wytdUccosJEwSj+sMqfm ziAA3Y9Au*4a&QQTSU9Ys;Q!zRHynp>h=s%Y3hu`V&aN;0tZLTRt?l z$H{SQv0ya7ft_3!lTHjG4ru-v=Cg4ktL85Du|$?6TFI(*}oFIA?*y&U*%j zSU4XU91EA*!1GYh0SkxkAH+^qgF`HwD-2E_a&&(r7ETb@e^i<0dr`?3v2cojC9ZJ> zhgdk14NjH8Ar=njQ22HEEHXI6!r?mv;WUz?pHqm1v(DgbBIma%{lvoI`vkGGlN@~= zBo@xo2Il}dx}1rHbJXCRGC0J-VG<>-3kHW+IDCyOoX^S8=^++QT#Um>1{Myna8eA; zaB_5-iG@=}y{>Cw(T@iX9#dsChaCN$oLD&PsJ~xvh((_QmDnT}eHw7^xZ-D!qptSUA%R4zX}%0Sl+v;1COEk-_0uEpZVGXQjbe zN6uMP4ji#?9tM`Nky!NGfwMROXczFJ@U#<7cgRwP#G<#$@I^)DH7@wF!o|d=6fVOb z2}>+tCj3-=a|EL|q&f#o+lV&Q)d zEcuONf7JbjSU8sf3#U6dI={ri;aDnTlzUtazK%%X?031k%-!#D{eMuLQrgk)TZqN} zSYWZk@iyxX#h*mJPBXFarvm#~7;rO)|ETaR;FL2C7XBRQdulzg=&OOHoe+z@7C6|V z>?{FJIqP8I)I;A>>xo6rcfw+mSoG_G#pY&mI9S3F3uh}ie^PPnAV=Sy5DRA)u+;lL z;ugi<4=nK#3!h_n)@zFMhQT2g4wE8wE(10AXT|SKd`{s@jg5Wa?f;A7WaE#dfmrMp z0cWvc!m(cq9tSMXq{PCX3LMmYyT8AK1j4!dyKv^iFVHT=<`9dW2Y~%=+iLs1$bUiM z)%YXv5(}SwKd3nm14}yh7}!tFMV#Qe;t0NLLn{@3zlRfC9*!)HhZ&f8 z52$4VEn*4FaWAO(Rpk6#l>@PG<{F#@=VY5C}I2C`yKCy)D2OQM=B69Sz z46$%%N5T?|J_9)TZ=B$=aRfiJq1{e`pDSEIy+_qM(=6C-GkShSt2Ps(__uIi&!`;GD%Moa26jv;F9sjpP+CW z{zzVkC2S_Jgv}*K=Y?1}Lk&)`!66n-xxuloecDc|Yo9K+8Q^E}feCI7v2IJ3K@PT8 z`mV&x5FGoR%nKrxc=Lg?cq0He42Qp?!o|dXg+~Erby9dN^%_qw@KkcNoms##--%e_ znhzXgp~BVT2x@*EaR;TZ2NpYV!2Zrk-;10s3a1ixRk$B`tTH&n!m-Ooe~`jHn5Atl zBLAdH53%rBZZfx)SoG_tKco1>qTdAU@1^uR$r?29q5oaiD_oFu*Ec{%9p9k!}N^y9Nlj{Pp@a;CE?X#as zJrWBim3n&e?y3Pb_@KC3<4fv;T^oSoFMJh@M#V_Vq%?YhEuFlCR5< zSopQT!K+m{EFtD#3CFgYa*cz9za09WT2CzcmB4{+F*sY;CCJfl1eRx5V&OLdOT62G zQ-UfkV&Uun?y2>}qTdTFZH8F%`+>#g0pOG@Ws_Jqhk<))J+bK77XsOe|NpV~9Z*d* zTiYjeQ7O_D5CIX99*Ux3f^#p_AT8BK@^PFe)?AbGOa*`0h*nS^jtoabI28+{)@OaH( zjQLNIeFEDK7~6Xg#_<7+?XdS@KLKNVAHvvAz}OD^Aode5w(}#5{e&eO&q2VL!+ib7 zp0niFk8*IX7W#t>csv#T zK?N}8z@9sSZ71))i;x}n9WdrQBdiK9YEfB+9)#G~1L5(yEIVM#_d$39+YT7pVUNar z0gUYtU}vvsfU!LW?Ck3Qtw*I8Zx&#xTYlK4hQ3wgbj?WrT$cSbSB|xqvZ86Jcrg zxqz`9&c)wp0*vi&F8)pvS;q+3@#ob6W4YUdo=C~dB5&NcH9@hnBRji)_jYw&|H>&KM4<#FdwQGqO&+-0K-Itdh{^f zWEf+8QDmCHwgbj?=9(kL$~W?w1M7?$JD#wfsKLU33alX*!#<1e*8#?wvIwi1vG_WG zEm+tP_;7O?6~LHpim<9Viv#11ub0R<;E3!(^H>}Y;IKbG02u46Kv>n1#esZKV{5`# zi%ej(OCI-iz-M!k5XSmxz<{}lR!!@3W zG%Hqs@wwv>R<&WB3+sR?EbyqPqeEyh3+o_^?;`=m=hA><$Ko*8frTu*2<#3lyaZt! zbHMmq7++O32gVo295CjD0>_@E6OOPNTOY<3#{n?rCjg(#*#sPRJON|QHiU(oSeh{I zYK|A_%E5Mk~97ouYQISUn?mJ-2Q9)P;HfmIuW6I7Y@|ey-b*e5b z4$NgWwx&43__`M`Srgyi1AT1QMp)I2r30FHjsV6SV-m-P!~u*s&R}n6=>W!dAB2V6 zS$1d(#{@9u7$B_b$>Km;I3|EG#|mK~Zx+WMIP91J#++pct9r3GZV0QfHDN8n_w4~= zKIEz@T;QM*fey@HhcF&%z?h$au!g2lexCA=gY{oMQ8;}X8?3Q4P&gsg-og|S#}=ufcp#k7w#`$ z%!hqSH30oVMH)El{sP7vMc}Y~gS|<}AN@fEE~juV0mgjT#xNh2RLlX4Ik3!O&Jq#_ zFy_GZD&|0wSO+lXgp)YYBo1KANg{F5fx~{U7BJ>)Cvgq}hrN#g#++j$P9<=_SyTXH zPA$Sh>{wkPaR6h^O%kUQIPA6nV@?l=(+?cB&ww#!ki>!8%~%I8=D>T_*dJLE2QcO+ zkvLW)4q(iYM*YO^9RtR8MTAv@kRzzTK81Y%j5&G;s|K?;i-7ZZ7-P;ju(R_SFt#(- z(ohy(71@PWu`sNYIG+Jy{w#!5!&n^VI>XNAk?V{qBn~R`(V@oXgKrqiAq@KqA9@6g z^`XD8zknSuwnKkme*ybn`o5ag77f+m_yES|njK2M1A~JKV9Z&9Fy^d47_Xmz zF((u_Ygjt#fWuyA0Ao%9!m3d$P7=au>~^;SpPh$*F`v1ggnDY%` z>>EF#Vh&);8HX_D$dWjKF-M8S(FP8C?gPdg1B9_Zvk=DqGuJ?NZvSNsgoO%~MI^o> z!nnVHvA!F^sxjyfD$9Yx9t*&j1Jexm1%^#%1NwtX0(!uG2aNe!fWsc&9N@&FKd1o4 zoZTeON#L;K3>b5&Nt}A%us;g~7;`QmtjcZ+)KM!W_6AfOP<4jvR@j0vz@_3>b5?NgU>Pl-L~dca)4tocSaj zz*q;quY~<^0}i`ifH7w|i4zJOc3XfkXAOyy1RS;wV9ZG)ak7BJ9xuR{vx~$j1kOVg zU{nBOPBDpdlEeXwIn}_4W1ZVa;sC}RS)?ljiHQmg9r*LKfH7x2*aul0z}ODghpLGz zyEAZZ3}eg*CfNaF`x=CWl309L4{;v>V@?{vs>v)4T>If`V8EDDNU{UQcDN1{+Qd5d zByc*0G3HbwyV_=!y$?9-@dAuF0|=|8us9s(K@}!0D&pt?@5_KOUlurQz6!!ZY3L6s zuts5hz?g4@Fy`BkIDj$7k;GYou-aDi2NhVCaNGc6KCDYvGXgm5egVduXc7n9#T>wx zlTPC7B5?p?&VGc2*!?XdaR6gZ4T*CBI1^CFmT1Xs7cgz8dIk3Iqwmtv{7AI5y zW6l6@HnQxn<_M*-FkG9dvF)Ph91-?j4;Y^-jj(D4ix1Zrct0gyZ!oWgGFcqBzQX${ zV60;ZI@?$r8p3L9O(BFuU|~ZAFy>1lteVZ@%OQ;01&le$2n*%1INHEr@8f_m#{gl~ z92RF5!fI?yW`EgpliXi<(0R(@1I9W!U}x`}fU%v~uRIpt1~@;5G3GGWfp(T1Ft#%_ z*?h7l_^ApBg^DRUuqI%9F047218a`ZP8Qz-`0Ve60mgi|HdD=KadrWRohN`XhYw-O z9u`Lw@Lm>{16;tuFxHep7M>1x9}61;hQvn&;y^jT!q8vJK^9&P_z(++11@6W7{G^F zcnjcS7Tyl{2n!=fP)b;s3oyI@LWSw`aTXo}_7f}&xkM>tVP;?80)bs9FcDE<>YQR> zrcOBvGj%Fhn5k3A!c3hi7KZaFFp1fPa+ZZlI5;~gk0~{rXF2OR3H4BKe|Pn8@5pd< z^aF#gq3(fRK>>biyj=q#*Nm(T3t3`h|PDdiVvphei>&Iw08Z*9wwrm@_O9>h13JI|Z`+4+6fSL95`0C4-~L9V9ow ztiuNIYa|)`7>>pYcTd*<_rO2O`FaPs28a4Ztn~gP#dEp0=gNPRw94aegrKdzsb)p~ zZwSoz{Y`zCceraX8fibzf8ET#=7p_x_3}oM@pg?O6eIsQ9IW81@?ZvtU}o!|xI-Ou zMJfF!lIN;W)TF;(*dH0bp~0?xUVlpo^Y-^~4fp=D2KoijpwMt4V3j}XS4;^n4~$@z zFn`&U?BS3gYnG6!a4tgL!Bk@Pk~x|Fj>a5J77HsdvpE2DE)aRfo|s?*FGt$I%aOJ) zGzwr-_Y4XM@CGovfMC7hS?U+)_eTawvS4?=P^9)}4r{718CV>g{fhyz(gVqmNxs!`&at4K3EFsnF%v%5H?|%&K6>Ja3d^km$hh z3-gRncMlH__48PTa`u;Kz>vCoAeL2Fcqsa-&V2a&u(FpI7&r)^=W_SZU$vI|`GmV7 zmEWH}oV(1C{W}^ncUdgtk7q#epUA8&1qgURAVtF5eY|0uyj;UpyZ`ZA$eT6Zp+SGr z_6uWG|6bWWEX>b0@Rw#$68d}pYVz^(_h;{`zff6Q?Vnmk8Az^zVTGg&MeB`wXt+CU zwP+f8hX%U)|Dqbk9DtFwP`|*HgnD35xVO65d^ih)%-qnNty2ozefFMUbt&` zRPb=q&@Iw-q7I9fs~1`z{-nU#o%{lQf?Rz6Sd-8v)O+}3=953r@!J1)9M;>%qj3U3NRafUk%wYa=>Ag^h5427kZrkK*V8#t&P1k z{?=>Yg2?b1%GCRPVvlT{m8%43gbi&ZY$GW`P|xhPU!?c1(f0L3YebNjUtol5kk=pm zW2NNKFo7JaOa4LbUWDSXq^G;Te~{Ju&Z>2DNKZ_ndRwkc>L@- zc)+|z2*AAn8W>Tz;K2Gn1aKP#{DC^SC%}WAklTfOKbGjg1?y1|kF56v>GdKK=%Kge zhV&2lb7`Lwd9kdVQ#F96E5pdNW7pJwo(?iKi?r$%80{1#`!FpPV2j|e(6~XB9 z{I&>#o)|i?-o_Dn@<^bXeGWWey@U~ZjYv-wwGDa_=)ij3BlPYg0ZR~K7p&(tLa!Iy zBuqdY(33(3*5g8Lkoyb&FYb4G@HHwphlUO);V$TX0Q3lY6VQS69wSWF3r2d#m7#+D zdw?uty_-l+64^jchFu5w@&+wHWW6;=kB02HV7(s1BkR2;`8N@fv43OHWG3rXBfa0P z2YiS}*0WkR?B67kUg-$`ZX&(k#jj+9e_lur&tC3{IRW>2al!qKLOim6 zElAG|ksyAP(SiGm%)jUbq6&FvfL*X2ny$a-X}YrBa|XRB>^c~a0(6l5OGk@s%y0DI zo;TUQ?QR4C@7IFfRCXQc1t15=dhojsH<29|>>s=jO4dvFAP8f&-ZVtU{k?$VPu6>i z^vHV`)@wjKvffQk*7wZ7KQ)qG!3aG`6n9hX9D2lhyGG~-CM$+Z#2!zs)7-Egzv*i}XmtJJes# z5qekF46n~7Bt3Y`j@;i1NUskJ?1H-vZ(ox8`xNQbvioa>xOhC^y=<~x4cbi0u^4*9 zdLbk9_D2(h9I`?DEJ%8bN9cv3&FIQ+^x$LYWd9mB499OCNl$V_{u!dp+5b0sA|vvz zH)eSLT9fqPe?p?Bhh7I1Bfa14mr^6v1LN4?@mN68J2#@gjYtpPXT=4_uX;p(osr%w zM1uG&L!Tpi0oQLkHG_&k?}sC_Kz^30>TzurWMfy}KjymM5_C0Q4Ntf%VRz6Ucgt zWPg8s0H47j`=^sQ++V!cqbWp~jL<7YdcPZA+6cWYq=&E9mXiF-9HCc(^yI){c0tw5 z0-r}B`&WYW;H_ThFS>La>hE#nB)Px$(Z!rROM>|q>lGs&S#Npr@cN7{Wrp;2jo2>- zksh3f3)ZtlbD!KUhaBto0!H#o5RcsM7SwJ!B0)bq&;fN2=cyy~9Ock&HT)(niX-%- zQL=O*5zzBO2iEgOiz3-SLll(hs2&&G4>!bvb7<^}fi1(=5kAO<^^!*T7lHKP^#?9k z4}N2mtQVe&UjL#>@NYRfupWc^SN{qX2%;a0p+~HD4DrZ%>08nDA8Hr$R*>{Qq8Ab5 z{%%(!h_>J8y+u5-o>vCz^FE;GPtwyJkq0X#v;N;5mc;&Pj<{}8%^Z$jAW0AAH`%{( zq!)w5&?D9Z4%xr`NDr=+!M|X39pnoQ9b`Q{CA2*|gM{;rWq(>Y)zu<(2?TPa9z<+cnXBIxK>o zLtAjDjA(bS4r|{+Rm_4G82#`^CQ~!~EA9mDcFzXqMhf;N@U|uzHj??OA5UPlQ%Ch~e z`=&4+P%zIH%?~`bV6Q~&3dytTFC!9ipZS?g4K1p^9I0sj1+y%AIy%f6EiFyz3_XBu z{2NTHOeqxHB4~dcY9HG4vY{}aqoG4ZnQ-Mm&xLue$zM^rWO?COf=U8-{X7O`Pa;Ml ziG4pyO}J`3I}Z^2+!ZJ)nTgzldNv=OBT*kc6G1Obl^ZeYGR2Gv6z5FzqPhabCo_eQ zs6csOLx@65yln{b>cT_U55i9{32p~z9X zGPwx>@^fxe%fw6nLH+Q#=J!#Hlx!1HYut?-iN8EI=D@Yc6V6QT&I!;Swo$rp1eA#o z(_yP7LH5ZL-99Kz815&z_jsJTjIk2@R`kC!Htwb{GJhOxG;%|V|8jH)4iP?d2%tld z;P{FP|7|N-_Jz$KlBR`#y3YA4fz{L5>T3x-XN9Tk;q6;W+;L>YPaZ z4>A3Jo8ckMEP_}lF=K&qIM!Gx@dM4nxXsweg4;bV21i-B5oYOEG)pI!Veao|X|Eu8 zo>-5VrNeb-7NVJjbBq4V?8@Y>75sI+!Hhld%MATx#?}=l46m}3y&~Mh^EcL5gu7Ev zxfZOw6O?Po^ARo3|8b!U^EAshD%D%o7AKSrd8D$@Q;3_On8mky5%Gmw=$kjnM53v9 zq7Yr$IRL*B;ZHObd&GeF_jWWX}2x_t~L8T(CdSM=lS!`#lS)#FC zvd~;&UgjrJ;$$wh{5(;Z%P31Gq#GE?jf607tZ{5ttTDH#Uh58m#;G!* zFpFBAKyWoMxXKZWVoK?vm{Ajb32xIZM!Ob?go_jExeVP3V$}c20>r0Af3gbAk)a9k7lq44-esd z0a*wInKD8_U6jJjry%x}!{(-fG8d(En}UT&ODQf&aBSjR8Hg&vY=LQQKYs|ley^Cnbe9W z&`L6cpjNCVyJZZdW#xV5Hqjnj*oiv7iKf&PbrNJyhJ>;&SIa*|FJ+_T;>LkHP zs;8XIrk2|i>N%npJ!w3IK@LN=8_wjer9tL0xKGdwa;W;v6e>?MUDP@+_2hPH`2`fQ z<-|#pYZ4Uo97pDvdg#pC_{>w~%rlWq&xfG$`p`J-{fO+;1EvPssX9G`dKP1H43p87 zs(}8pp(gkc485Dg*&K$xC>lXgdVU&1Kb)X)h0_4Rs5UZf zPYFhHKTT>2QRi99i$)Vg7G(sA7EdpYp?8~^KTK;Py5cv9mrvxdabc8Y69;n`$#w+H z;qq+AHwMbL>{Leic?u)>JRQ(;B5y0xf})hM^)a_|UFMxcx@RpntVHF>%($X9bjwg1 zCuqo)=s?g+7!{wu>trzs*8Y>CG|DP&ln3a1mKsulK10Sct%(wpzo;c4Pb>O~v)PQ~ z2z1^Z@IDE(z_L{|6B%jwsSrU%5)U1a50RfrSTK@&XpgyVn=)^+dw`;x#OwiT3wpqd zdXU3N1kGDa|5xGI467$MQ*evVu@^`mw4o(?)DjJ~WRF@Bz4)(M0xeccO*m3XL#oN$ z!+jfS$sV<2&umGYg8F35ND`-`KK;viy5S7GeRbEy?~a2}xfMMY68M|pr&mGVzSbq+PT ziGUefo*j?o8qC>lLVJ5Pnxkm8>N}#=9BGG*(VQ(uBb_Wk&r5|B12Qoq743M;Ow3Eo zKy8ZLOr#IbPv@&+T0J{+(Cjqf*u*1})coTw^Hb>GpP$cuGe5`B9qI9CB}H?T8?BAp zoElBs{n?C)TNFkDWOfKNRg37Cu2if0fTw9ZlW zKcm=m(u|#?VFq#^%%+xQqm_}GfMy`dJ`@q&rxdDAGEtaK)wx5V^4_7xrc!lyDd;aR zFWs?@noxl>xlz>mnDIt4qsMXI*ofxJLtf*k+RA}OqwiusFMWbGr&EP?vRCI%CGMZ0%%(=#c)L6C(G*^-$ zXfS51%mma;$xCGY7QVdXkS)ODu%AYblK`V1b4%72)?71HDoEO$l z)GEqZv=700nZ>9`V8%P0HniGgF_NBAtgNS-Fv@b^Iw}b?Zo}Hc+fBgr9@?pre3|pq zFsD3|QGSDIS&S?ZgdtkLZlg8sHeDvogGa6f9Fs61$QFGsVFx0a@! zLfV;By#@l!KAtDY;)5&b zt2~>U#7$x7mIIsTHU;eJIaUkxb~E%If`59u(fWOxM&;Q}6KeIW_@T#_{guK_-OHVUW6uHB%*)fMN>_5y?6`!<6`>veb~QrK6%pBOFzxW zcrtozh+n%&nM$CWd%oxnAGXN+#WHEgG9!fNq5OTN4$JoWw~G@vZM})fCZ2Bl33t&+ zs8@;Tl{31A;-l-BeXXgwX>fYJ#LdsF2$c!CL%dp6ndP3cmbb+ zL1w$Im6glQ5u!{KLL#Qpop% zC|w37=-WGWDhC%O3&25dh z>pN;8&Yr>Ox)SB6_U7V^`rI7o6(yP*{9bf!ZuNGR4v}nr3O!cuzJhEWM@NFE+YxlH z%p66fmSebYoW&^CQqu^_9Vp`HPIcQ*tT%EgOw8c$4Bm{!LWNjFin+3+s-%$Qa6B|6 z=O4<)DS8V(5_< zhXkL;?0P1}J;`gF(9gIZ{6G7Ml!Cdh^V?>sp@0GZiz!j zzjfDOf4~dC@Hm_oc)b6~4^~{@@9*OCKWE2d0E&P|?iXMqmv<_!Z@jsXsFL5RzA1Hv zee;rJ5u2@iqMYOCv4erTWF)23zC2mUowohybHm4nG_)8M{1Ktkm)RQlPqjPe@`1x{ zx{7UFC;hY2_ML||d(4yx3_mLOQTBXknm+gDv+|dci(Lg?rmvHkyCy$2TIO1*8-HzO z?H9ME{ad?=w8Hnr)>3aQtx*Bm-wesb)1$46@V zeX-V_=gB^kG4zwdeD|IFi1Q8Jl_%SoPk+Pz$Ign=KXLePivxKs{9j?1DsyaB-kfOi z?!Auc?371gy1eH~XP&8DB)&E?`t`yYQubY=-lt`3EUWw|#>iV5+EMtHmRP=b(vEEt zcSxtXR~cr*XM%msJge7=j{dsSXhmWj!<_oC=x5=SI+;Obr|0ihFPm3TJ==Pv+i~SD zlTOXyo)PP{%cv|{!RNB!?yE1jxGH$k5}T2RjZf>Ih^(_IwEED(q~KY)?z~6mP^xU2 zXi9y{@b?yEpIBW2ZAG zYClUo`F#8Pr8py<>J4x9@I`+v-4hXVxc5?m`|Gxz`|L%P2$r8Ez8=@&D?8#y!-yKYV!QY?fjDm|NG+& zE&Mgk1hIN?;6xd75jkZ!rCSR9GXq0Y^xOGA^Y6AJEzI#cxYeSab~fx zLA}D6CtXt>RvoX19ndhJr+V2T`f}B=w#~VITpH(XWt?r(-l&O~tggQ(<1RYh^h@rK z#*PNvFVVJ#?9FrI1Z2}cA9O#pZ_SJ?AtU_zeZTOv8ovL4AOHWw`S*VQ_xrQ>HLsQk zVU`>+UM79&p&KO%!WA2&I!ect+1tJu6`~>bh~8}z9poaY958)foNUz=CFN`K56%~H zy}D^&V;Os3li=5k>UZ85BFR%uE=VgpTfg@>_ceaL&{<=|w#;shYgj96W%Dg3slp)Z z;=OE+8D;BkdAu?_AdsSducdVL5VHTcpl&)WiR7a5FH&C9$47pcd(Z_e4=_~Kq={)6I6Sp%!B zOX{9io&PZHkc9AtQx|q@zW839zrbK}(Gr(8YBiqQUtXf?6bXrcot^sNa#oX-LWxO; z_T!B+-8O6O(~MO3EFR-|W|Z=SXVuFpY-rnk4f*c>Cz|qKs%l2b>uz4YYz58CCSaZG z`l`&e%Uf+yZ?-&+oH+Am+NhSkw;nUg>csD!3f}W3F>{60E_LlmOT6x?x1V`>EOr}T zyMdtW)kq%O-Xe`@ms*c`PTABx@6ys`=B}0&5AUB8j-8mYw29a|e(eE8;`68vKjb5? zA3pc8_O-UBz0356>-~tsyW(<^Pd(^x;fuXdDq|*8vO&r{i7usd*oy9KXczo1;>XGt zA!fo*nBR7R>j1p|jI`st`p5qJxcw6!R$Tsj;sBZcpS~BKyZecoQ)^>=#u@oLYP@I4 z!&R^0bx;D-9^n>6;nRVzA3g{@cG9TH?)Fv zN9~ z36HXOPNw(W?rv2)@q)fTIbx&8O@Wi&#O?3%d$g76oP5u7@{L`S*(qKziGGc&h6lD9 zKMvm9a`>9HdeuDBD<|zPoHRJ5^=6~Dlid~m*6~gKFXxUK7&HF+-V4Dme=H6PI9GjK z?Zo={oF|v_g97bT8ipgTVv4bTln! z51VEvp%1%BJf7w=knO7b+3~uqXPyJMNk|ak>dj}i-9sfkz_+=^WRrCYzwU18u5}V) zzI3gz;Mi}>vvqW^Mo8kk%U{!0bWE5!w_wgSi8gJQv2Ffw`p*U|XZ39>+mxM{nDd@r zM*0S;A{Tzdsb?k&A3xB-MsWz;`TxA4SO=q{t(uh zEh^%)sz;M@d8hQ>eGUL-^51asfD&-QNhi8t>!yqICqetRarbaKUtSDNi`3yL@z6~3eUbbWo< z(u2Nr8PC0XA5D*wQnk9&sy?F$>hts>=O0_j5h2>Y`Agrnl}6RpA-d1UsBYhRVB#^T zKQ2A*(b5kKE4af;moy6sxc4ZI@;E+l&tz^_j2+a^iW@xI@a%fKVxfmbMDLPshLz7s zDtx9F=l)1yw(oRf%&btzPl8v{@4VT{VQd_8O+F>6$eoKxLo^y6O5x-@a+n zr|C+3dOqgxx7E&PI;rSGQ>Z*Q%#mN*_2O)&NKJwGYs&Z?#KkoYVFygQ`j*u}eNp!9 zyV{!5T2>p4;&xYwjtfgDrJA&VYLU=jw@eG3%lP>q;Waj(-ol(V(0bB{|Vi z$Mm`d)O)%X`J2Yi{r2r}rf@m0L-=Zye9n#0cV?~K;&C17ja5aQu6#?_y|Bu>#^F3; z-2ne|MRfz^$u<0QE1}+L@{zi?!LzzP-ZPQ0j9I1IGtpXY2Y27)l|sEspk6n->%Lf0 z!`j#Pr?lD^h>mp{eS7tMO7|4Qt;{U3xzUyc797;5?GL65Hj|6)#YkG9bfKW4%CmqiP{ z?Ug*s%c;_J=Y;>>hpn|InmrY-&ZkaSErt5GSJ%sp87yfSmAj{~+~o7xOL-sLWkzk-`}5cHEG$v(;fi`;I_G`zB%sIwNkMr1hd{lf)vE!lUac6_GBAz^5zy4j)&nNm1?j>#Jo3ids ze}=8qwqb$%?AGpC2Oi6v zTj8=u_s+RvOA62C^nKxI*e_>c`;rlNPyOCYj@DJu9=(ZuyRGie*ytJ1=+MsTA|Jd# zZBfw0js^K%-^vE}H{Mavuc|F}YTi7@@$MVPJnzpb>y@@xe&ybiAGYJ-bJP38hZeg> z1pg8+n;|suzvI64Ba-Ob;6zrbNu*rg!Ud5W(*35cB~V)5#QhQCHeC} zK>FDYbJk3|BXV8)gIZRA(T}4$p12yFPIxnrJvFSr*O23hrmb!o{{vsnI|aG!Grx@a zK%M1ir=zeh&qdsIZO!Rx?r-OBs#|!)X5v`u35ykE7#%9peHJBjWiQnRCDY$a$mfOqUGfpq`D-_Q3ULcryMoF-z>hkNAIt{b)pSs8j z-7Dw2sznc?3KBZ^$)KgWR z7xx`YF_m3?HJTw*KB?vAK5@Rc1(%8#=ceYRwSM5PyY7-Gxc?l}GH5|zpvfs;Xp(PUH(f2=h`EpqozjcT(xG_IkNm5>6&rcaEuk&^s zbDp$wq@Qkhtx4MxwT9QXKZe7x%2$-#INQaK}DG^FAefIZjGM( zMD_-u)jej9vHi*7A1Pvw7Fp>|(K5bTyL|DNi~}KA2`bwzw`9IZ>3FKxJVV@NpKL%i zufCF=%AniAnvX3HZ3c2<)Om!&tiOGp;_bK8r*M_}E^%VX3C+pljlL%t#nd%MER~5* z%c8i(&Cm~iH?g4i-U^|m*BW;Q3E2n>D=x5#a+fd&tr-k;ocq81nH|$@=%@7VP1Kk8 z_^N{Eb9v3|8rAFVZx%mav}*0XBMqvF&+;Sb{SgTzw)Q=X7?+FA1bjHQzkK6_4vOG4 z>2>`!R#valyRFaPT+?cywuzGGmgO3=bLWZ^ym#vh-#VSmu2JaDw?F3eed6}(B^fcv zMS+f*e24h5vN(_bf2lZc>$v;+I|Lb+{sM5N!Z|oDd`#VlX&6py-Amr&xYqv4` z?9NEhzDcPpvHl`Ex4!pzcdwQ_PSfmIKWmX7?}?yMGenBr#PT#Hh|A5T_j1#_zqwT^ zK3#v~!74`Z$@tQp`=0n;rFyKfPtm+DxaV|b@xfdCZn0HO;>N`qw?BkEdi8N__(jIj z?0^!kS7H}jiT+bIa>}ig5TQ#6_f%lj- zwua*0zFU?>E!o25GGSUr&5rPeCH9|P7cL*&+$mEdGQWhg;!{(1TT1oiZvx5+j=taC z?v9z)-uOuD>3adkZdIpx&YenA^2DdfkFNf>wLxX)!1Mw2_}PQIXHDR9xT;oXG5u7w z(Prw#i7zR|G9q_uP8+^z+p(z4c3tj=PHNzryU8|9OLU{fX=3q})M@*VaAv$5tTUVO zj@zjv{hZ?12;s$i$0uq$IAdd8`Yc8|!7fttRsY>(h6j)LpXYim{Mh>vJ$vS{`1WpV zc^?yAl`#D@ea^{JmrK$qQ~f<(+%d1Ld4DHwOFeg9 zK=-n^fM?OS*1CUNPq|m_DctNhqpvwm!EDKz7{05;?Hya1=gc~=yzlg}`>ai`zrsMI%3podgRoOpX$W}{8YhXHB3@K+DF&Dk}5 z8;?{A2}GSX&seP=`p9?QZgpV9h5NV408{!YndVfxE@?;-ArEl}--;G`3Ue7FXOn-TbE3d`R z@`L=|S3gXWUG~Rn4}5#Objs=dD^}B;WeQ}A7xW4-Y(|BPi0)3m(|zwu@PeXN9#yIN z>dOaozuCAgUiIdKYyGPk$t(A8KbFs2FutgQb9cbH%PoE>MKg9Ae0jHg@Uh6g$wL8=gn5!FYd%$ z^6G|@`l@x5EmdU)?y66g%G9&OHlPJ2h_n11Aob<_j0Ud@2{QUi-$RG?P&nbw9lS`sePc zyRIbLc*oQ@@jD6hD(V)R_KrEDRGaT^@8K(Sx?XXvy1wnE&)0MZR)3tcN+;)*WkmkU z%9(;Mi^h$X_nG6OCVg}F_x0)z&IcYjet*l!wPSX~r#WdZOy3rzE!FUL>ef;k7h)eNWOAlQ(nnbrTw)WE6cs-%sCHKHA z$zH(&Khl<%sjhS6P@|QOuI`|2@x7)nH!oqaS*Y>Er7Fkj?(Vlq@swQmVU=GP(Wo^q zUFOkvqTP?XbfbAuu*bXTO?EbG-))*TI6=W&!84QJVEWY_#c>Ws ziOrLiholx-`jql_*Cvh0%3qdu^4d{O+NF~WO}p?&^C>#AkByFnE-k4GcoOGu#PssZ zW%EW4@Ex7MaF5EO<<9G^ZeM@E(H^1HxmoD$I?Y20^IhAFBwC;Cf4zE=jmsJkTiTC@D_GknXwNnlosb*f`_1f*>yPczKkp0k z()+QtPVA+NcAHt&Mzw`6G)s6ccyoR8ubS}L-D2^bpW1U{Iu4eWeBq*G>t34_z+*ag z;p6raQ3sizsJ&MYKKibA>FB53^q@5|yJfP?@5d?~s1Q@FZ%#4_Ef&6iv3!od*CCHt zM{b(0Fm89NEsBYYa2)3_Yolr0g7|BfD_c}|BygQL`s&*wo&61TH5>pL@&I zIWE@zQhV@>YDI6igVq(LpeavmrFCvd)OvU`?@OY6{xiRCM_iTax}$B)wK z%-cG~QrtK`Omf1_tf?MT_p6oWhim(u>nk0j@3GnE;?Iu9y8FtFGA#1Eo8E}Oi!$2r z@zDIBX>0kTYwyhGwY$AW%kN;7m`+h==>9oXU&c&ZrJY##P=8!a?bz#+>HGV34xBV^ zNQ|F1?d)hrwKY3Dnm)!#P6%J1`gra>e(}xwWGy9Q*QOTgu1;#4qx#%6kF$4LMfuSs z_CL9Z{pJ^Xs?YTloDx}bHE-96?4tvZqn{7vtZdcETkJVnYSU_$X-6o^^AlTcS;Skr z#WrVX&LobnF*xSV+g1MfV)k76;Lh^i17*3#j&4lZP5++&aS>9iOP}ct8}#e90bE6*F0IA+Wz`}2iMUfI-5p)bc|}B>dAT8X8Zw*gt7X>@}}EufK%Qp_vbGjyDw=tpSU17ZxbPAOp zCg)4GMQH4lzK#GoW1OJe9vvs!x!ZmUb+-5{h^jq6IsiSPd=B)*=wt^`>%93TIh~S zrAPGE>U}tKeZ^bFqwqJPWDD!$ti0?j!W?#_O<^<>;i>C|skb_#=|81JGI=Ly`@ zy|-hENo;4zqN5U?h4X4$O1CL*iN9-j!>A*V(?F~Gg+Z$sTSiytsv0qN8k;K}#>7(&_b+^2 zIf31;s)J%_Ms9@x0c?M|o%$kYxs_TP>L;wY|6#{^+KwG!dY#kMUQgd; zGh0?at|F>;+lS4PaT1+zvN3VI_vf#b z*IumVmvTzTFQBgoomX~$wC>!;Th5MsQupfU$HNDg7sP5jHXn0uqEV}?+fJ3Xx>>be zr`r1a1LcF+{c4`A87U-5Uzj5!-5C(ynz@#9^d}8}uI>JYw+6J98oaWJ)A&C4C1OUR zQpYa6PnoS&&jZ`m$Bt^g!THtET(R)&3zj>?gs3rTE3-c~_6a#BbI!QF{AlmzI^O+# zbF_OnHhMRP>XoIu%<&!V@~CK)ThW>DN6Q1Bh1mGEv~}Macy@mEi49xcv;E0U^1C{A z#~B|-iJH?+iR%SYiy}&54u^JzN7g;IKK^yq(cHA~#(5_bU$*yuJg%|mS++ypwYPKM zxUDyx{!s3RljI$?jFf=z_n(T!#yT}dZQu8C-Zt+Bt)r_>EwIkG`S|2Qwod3M zdX$XySn6pl$?Cly0;4mRS}!<$aZ7=D-Y%Zy58J2iPt;VpXKzaly`gV(WZsm* zp8ZM%3ruz$zPzV8@iIHke9;rU`g#u7eU>|X>Ep&{UGZ-Qj@;$1;^hl6U3WF|C%4~` zkR@413!!Uc9WLb}b*E;Mw&`TTlt>xt11)uW@@&b}*&2-#=X6FRzN@Y0f_OV1BHnYGTU zfa_4z&dgd3y7{~`?WW$9CyaROKD-ZIDywh1E2Yh&xQ^{lz0{_Sj)j8vC|9gOU;W%c`?Znxj%KS-jf>`#%LetWpYq^%mazEisQ9DDOy_T#D7D`E z{-~dkVkVy2PtRqvL^^iZn1!)*6duz0>18vsn^QZx4)^N1blc z>-D{xdBoBLE}d$7m20zJYrrVe>RxV?@uyvddq-a|*!0z%J?>F9+jc8Xylizt{9@DW zCC76mpX5F*vgwaDamY1_+-5QMz$*{M?_0I6e;lJ1xV5Jzt^UTk^Qm*3yHb{Z`0Y?hc;!Y;U*&`; z$6}UH&k8>&_Zt7`Mq-BV7WwLyGgtP0o<%YEnSXxenDbs`PV@K3C$jx1(BY?N6@94a zzxlK`*CgQ5)``{ugL@kjWR#t0r@e0)Z7)jJl{46AeEY|OBWkTJwMjk1fZw7ox4L%Z zb=}`J=Pvu_=8189+wWcqyLGrqweyf+#+~HlTqkTt^@Ubkc&mJ+$0ky4YzAk z(HF1sEwn!v;Y-~j;W=pEayO*7zd_Wj>5x{aRZM@O!yy-8#@a6$U50Dn_XeOS^?hBr zHvN(2#JG1J1y+kMb>~G;s#67RkM}u-*$+Ng*MIG6Pk~Ou(owGWSIlnTU{v3?u(Go5 zj>fU|j;%K*SS#FM$q-f9kBIh353@d-&1yJFS?nS!F<0TtrH~K7)q)G|({0b*o}m=H zSX)w9+mtugz@d|Jd)tC*k0!?`Ee+bi$vv;t%!TdGWJ;)Jy2L`c@b7eQ=Q6doK3A_6 z)32Q7y?Kp~-}6P`&)G$jHmq5?GgfHjMq~aBiLUD(u9I^1R&u{n;xX0oeM>A}H?#>_ z@~gv+_Qw~F{%Nnfkg>LeFDs~smsK;-y81UDzUY9*F2A`qZR{#7n`^K zpc?DA=16QXI{SI-O?JP&Pn{vcmzrVLAN5t^F#q-2N0Qg$zCddx75S9 znJ;gQ-r~LT{71pKWdC+`g%30GErPWk9$)kJL`SeEyI&FWRcwBw)xKIJxGuu8eWS^1 zwW|4jZxgTAWjp7%6g!Q+bgylB+LA1{yBz0M@2Rr7sCK{hdaP`t|FkRmN%tRnh2CQO zqpDfzB$vNkdG(n5FLL+Ot4sIxJvZF7yYSTH!V|Vv)u}J<8l8wav2XgGLG&NCeohH6 z$Um53usKMye8$^}b4nL@YO!?!?(F{Art8ajX@Qu_lb*#%+deC9FT5gRJOpOEw}vj~&awRKur*gVu^trYqad@@IGa1`j;5O!Tj=#M+b4rU)Ehx3AwWS_se#h24((MAl&q_m)9p26VH1)-)43E;-+cCQg`m@ zW6OLavMYhPN?N)v1h32MK1g44WLfZkb;+=kqrCU-Fc^d^m2>hvm{3-U+I& zT#MNK`*XWZ^G$P0Op}$nO`%ath1uc1fy!Urj|9yqE;M|(5iInF9U}zuyPa>j=W>uc zts+8FS%b6sRjNZ>=J~a_WhN5dwU@|dAZ9w^C22eLL(xB2D3+=y>=e$u0YHVd8^bFWto>3most$7es_V*Sz3gc0{_ zvrOT+kgba!s&`}kyt~q!n0WiL+*bu3X}F}ISH67HMKkS|==_NL6yM1tvrT@Y6$&C3v8}6UI)4VdCM}#*S)G{Yz9PaSPi``!`fV9wV z>PMOV%PwJSp2V+*4!)>=m5z?bx!mk9l{Fc+^jT6i^{c&MszM^xqr^^WivE?=#BI)B zJ1ouHj66ofqy}8pwj;h)7uz;_2A!F8W3YL7HG@*1pcdWEWcc>b{qrGa!HxMIRPNgA zEW|n2(rtW$GL1P2SZKuq?nm{T5%_Q2ExRZjK;q;0eIz?{WcK@(((f74x-hk%_fzP0 zX7x)JtP_TB@Tk8xPt%DOucw;7-}S03Nqj7c?(b1g*zQEtJO74B39-JY_U*un^$M)I ztd&*Vf^9RyL(PFy8~^GLXK8Mz`JLXEYSICAIgYY*a-HfsA!QE?!wlrFFUvJOj!e*y zQo8wIb%ylpVrD`?%aifL$v>7a3bp(he{}P!7U%BY^w@26gz9CfSJ$a7y@bzwTh*IU zj&=}WOXJU*AWtF^aCOh*YOiUGXUp@pbT{A&N)HgiQ`sr}kbB*0{^K2b$!o7BMUc%v zBX>{nbg{gzAi2lK-rM$5A*t)JRT}G{h|nsYTDLPM9x7#&;_?l@VB>q6 zjTfb^zE4t`K zT(1{gIi_-fYkW)i^@qCN^K)hK(+ywk*k5FQS(cEDrbAyuc*@E;R2_R=y7ql zR$Q+#G+cb>7=9-Bx>>X-h4#3J)x+rvMG}{|M6)u+mBP02g{Yk(@5b+>W|LT(U(dNz zDQR|@wHQC5qa;8n5#3I0%rmjA>wLWVcvmbk$sTg%VpKyK${LRlE~q_A);`aB`tkEO z)67@X5`-AM1cQdFAE;)0EcL%#r9JE{^!dHo$1U`@Dt9tTI60?dU1|8JnQW*ydqN!X z9=84@Xl*Co;#QOYMe44fB2hhXcRtL3Gry;e^Y@cKB@<2&0$vGZ?LUlX&&{FR`G5O< zO^?fRhi<49m)Hw`~K>~AA?;Vo(z9! zOP_As>OYcrxXh&MCbM7L>ZOQi-dH}(Paa}VEC!NY#tI|5GFq>ZP+onvcH+;MXOi-* zAvQAx1t*;|PB&dk9SpCw6e!3%#*#FzgB|%PFL0Q3sXaM{A&C?Wv>@? zzo%aRWJ+^dkNq93p#SPQ(f$aDwDI-vrAMSyE&`SF0##j+fez-T6L)M>zJ{gEOCG5{ zI>~N#Rc`jp?`Xv(m3#o+wS2XyZTNflc*Iy;~I%z1X>!cQwj z%v)7vjr`69ho<&)AyqwwNSYmS6TdQTzxY1kvOi7Ji58LCT?}*3{0T;9Zz7Wm#XPn4 z*V!pHoUh$FACmP{_2AV%{mWw$g416~mc3;H@xF4(ml{z^79AVRE6Y8y5pFdgI)Bd7 z&cB-=zDL9+QI&d*gQv$;&g{dnq0)N1d`2jFBV)QpN9fs5P5aFX4+Vnxj5`|I;sd%F zY}+XhI`L`@6%^iPb-&h!7{eitm*oqweFH|r?L^JPj!(|8$StL~y0yB7P%UOTc4IyS zly>oUa0GOEg}?f0LMuu55>knIA7w0Cg3BUCeZBNg%u^9%h9a_^Y$fPzj zuvBR`<0sXR6u&yjxOz*jNVVUu_E^HU2wc0gF*~;Tq5h~+S0~|c z_VmRFYw6Ls0m+dW@sjPAx2s-NJ=UfhR=rX=Io9}Eb!Oz!@wiL#1HXJfJB~Qac*?%4 zwEShvrL$nBTumo#RPko~IL*NFEDa$w6?53{!i|IRYmOIeAH+}o%9xLe9K9xzUcsPU zCmYaDUx2-D_&>deb@!6}KfRB2w?EaDlT#tOB2YNtbL4sP%Cx9TVsYMY_zTPW+k3yi z*7iCp_NT3Zi1aAAwE@qYl;0d{OpjSsukH|hxU;)H1&>eDm!mf4C6nlHwWpQ!RE=Jq z7^lWh!TjOeD;Z_>D<+al0p+Q%WZ8YwbM~8l)Fm3_f73*-c{uE@uWhlc&|WynDt6za zpOVMnMu1OozW|klWJC1<^J z^oWgCz2)3r2U_20$uEC*`&ZKz?YfwnFMqHUD@p8@|~A#fvSW5?0lG+J-Hn zyw{HI_8ncmJqw@O46U-~2KI{CGA7yv@jpQ%>UB>5w8z0eRFi>8} zNbYzi`I{lrUg;-Vqi<4qK=+{c;gaC+AGs^**zeu`?$hUc|74Nun8jSkx8s*tP{@89q2v64koXp* z)NX$^JslPO7<6^!5|`_}V~;nkc}+cR)X~**SL50HQH9WwZxuGNQmjb&`?{QV@O`;y z;CAR*mYrx5)5Pxjjnfk}M}G~{e5D%yZhG^=SDplUapJjtvQOeicRx@Lq8xqa@?1GT z$NGe>wP(&;A1$rBC44Yu^G447jNN|s7i*Imy=m5B+9vgrZiTv{r)ue^j(OO#=3m(T z=nm-e*KGyFd&H-zWT=PNpN)(X_WGOP^McRT&6}jKwePd@nEWxn z_OErPM0jK;Zp*ban3K&~(7^2k@9KuQ{!sS^jrF!mXDEHZ-hvdJiNB;;Y`uD9-q@^d z=ZoRcv!`7x4HvkmHTdmRs6IY9yL7&V_-UI%>47GRzaoamBZ_KRo-%|v@+vhG6I{<9 zHyY4ow|(#>&hvG!m-%+~Qa`f+b?BE>k|v`#jx6^m1NU=3ep}wy3YXU?Ek69)u#0G< zkFloxy;=5P+#!+53u){4H?#}49fI1WZ+v>X{A|uEKa)nVA&PIM#h>OUBUuCNAa=PZ z{};jQQhi98^~_hNm#yOse?FbKc_sO5Vu8LPU5)#k<+rq>dR`wMEpydhsmo4#2Jt?c z@X7teBBUMsG4P0JnY~r#J=T2AUTV|J7hXwxPHoD{6x8Q0j-D`|8(V@iheulGRFO|Q_%oJd9jevW>E0(6|rje5XsW!L6zBObI-q-h@RxW z8c;cN>WhI_i@46~hj+*CJbpIrN2ET-EKIEa;&Lrslt(?SWBvg1&w}{?n0rGxD*6!N zH;mx#6w%cxf+Ie61ax^1%oI&E(-FK(q&ncTHYNAbQus_>I;ZRj33GNXEoT*fnu-hS zgHP*QbGWZYeU8VQuNE+)%vqv2)N$qS;31ae6K01!RrndFjquYv9~XtrCEklQZwSur zGU8FrTsr^3VU_7VTlB^FPbKyO@hQn^gjXy~4s5nr9+teD(cf~Bk>JbItnglQ@tSjM zcCJgwqd%-|FTBE!>dIoe+b}8;aFuJuvi?+kT-{ynMsk~gZ{@9S3`TSL#{98K)zdFK zo>3hNm=wTxwA|CqXD8}D?)9QDex9u+typ8`^5@bL!U4IvB1iPZX$Jsl*2hx8v zCrL(!+^o`*dGLSx9(38<1--7AsRHk=j>uDqfp3zj^sVJD5x*jd@%=^Iekqh-oTPAJ zu|vxDeT!y6oq)R%J5@LKSJ)pw-d=HmLUl)uIpic#@SmfPqM)Q|dRUt%Ydm})oFFfK z?RJv&0O^FpMgkSNMWiQ_)Lh!U%vOKLSVF^^$^c>QH9q^#&s~ie_{c89VVP29UduxT z@d6XABa5}%?@~Sr2IUyqO3yz&Q~R!dih3a=&vmv!qQ3VqX5-rRz#!H0vpQC)v?gV# zB2TS#U+hp^!B03hQF6tf$M-z#{WZ9)QGthin!i~iGty}N&E>c1)#DNoTbXPoR%cQ= zVtXU3g*Oye8_Faz=J+-*m)=V!#b*yKvKLlCrpRcd6B$H~FX%(rkyRe#a zm@j=?lsR-Y3~ULQ+lhDwZ0GOLv}-7Oc0W)F!f8ihyeEq2m;pX1&6dEYT}tF}J*=U0uXdz!`{ zMG9HXeuoSVmYNd>t~5t?vdU~wGX0iyi#e?O)tTkOpMxvH>!-dOrWz?09gR~CJFeBv za9Y>=(yQ_1=cf1Zrs<_QqW>7)jd#iQRTcjsqeLt`@b;3rQsh8L+_!AK6&DdB=#f$0 zO>HLGKY6KlAIsU1h_?^xuc|X!@g7ms-U>9+@2;n{H@k6nxJXrDI%*7p6gW(B#P^%0k3?yj=5v3%$%Jeo*L;b!e}rL*McB@H~UT-rWe@7mYJ ztnnRZxdb(@4tp72WldD6~gWb5koY!r)$|lgyDep{LQhl#bF3m1>70N?D^g zj^66!%g=}|xla-Q1mCd^R*)i|BgyM7lw5VaS6nN*7$-Nj(6QE@^!>)~@aFj;yT**s zv`IeQXWk0ZKYZWtJQa14cva~=>L!v>t$X8_fLdF5D_?`T`Z?n24|-| z8r#A`{=fcAfW(oT28!=4vP_;_;oKI~#Dfi|PAvQAnY3YV2f9P_@&?@L(}wspjz@gB z_!Wf!HK{+?4fdFJh(sP7$lh{j+JhPuM?8h^`8G5?WY(0K$XyIF!f+-yZcNstZkMCn0K`|HS z1R9wKOcvkYvoja5SbLX@+d6)eS@y?9OtsdNTW1-?B`PJOO#KvscKt(UhRILz)95C#bc8b96u_$_SH>Y({1a$ z=Sk)*9W4uoFqVSq&rsd_9^;=9w>qTRw?*!ZJfTN!!F+KhW8%~?M*4YYI$dmhJH z`M4oPiLc<`(c6^jHN)&_@^3|Qo^<0Km9#r8jQ3ShL#b&em(h}t1^)s5C$4gSITdyB;&TXy49t0+WTLOFYm-q4m)QwTb`J!Idk}$Tp6>% z5rs~SD$Ql6rHkOlWf=!EY1V1_kB@S`)^~b+&lveV=urAX$zq1#$?NAFP9{8C!}L6m z*^`@M-~HOtWh?b(?ZsP`_{JOwUQUqux8G3DZX&0U7tHP-4E!yT_}8l1J$2Hi9Dhc= z(qhUWaG@}hf#mos!QIni^*8R))JZv^r#g7it5O#iQMg{kkV?vN25v!I{4BTSa_lZf$m zaN5xWt9;Fi^k>9q^D4JmqSR(`8$UiTAG5cXByZbvEYFo;j`uetIw+&)PR-}je08Ce zX56}cj2-r-R5N7l2wJz1Th5w&CMTqqrxD#Zsjq6mvEKKr^G*qmlBmp9VRo$M{lj?Q z9=Ne?Em|F{Jumy*oFagkyGb$2YYDTFE79>fDoylH`k*(7piCfh|k-)rn7Ya(Us6l{z7)dv~phX_=~98VPB0S zwM!0@jYkX58qRrKb#l+9xqH%QaQ1=e>LJxnvRqKoT)E_-vth4)oPttWdi|w4F1`;_ z>8uwnHJ>^W+RaMG&&L`RB;)aS|pmC zdhStot-Ibl9s^sUYbLXJWP)>NPFGar3)k!3uZ98*#8PWLCdyUPG!?aVnam%Ah>Oh~ z^=a`JJN;85a_i$%$0F&*yhQ|^nrOYR;*Z7PC(U6~hU+ey;UDUUXdY$V9AXk;B(*$f zJ-K5#Jw#^H7OBsakY^AFy>U56#&=8T@yXMVv;FJMF~*NuRA|bVZpUf!i|Ky%uNt!?E!7dgiNc)xgs@<*fqNYO(S0ytyXRooZ2?k!) zdv!E-G;rFZAp3=`S=02{X4b5s+2?X~A}V->6r+W=ICbbN{JU6`yLH6X2hW7Zvj0pH z{?=5(P(7$t5&hd?DDtAX`V|I=buTN|2+2o z*db=29$|yX(1+fgk9G6HFW0@PEUCF=zWH)h?`He?0*jM+JKqSDE?+-N9OoU;(O$1j zyS_r__+rQ}vh0r6_v>NtpQi=MD06IlCyPa=r>?)zJ^!`0PQcOQ>q3{kTjb~4y0^FQ z>yvHfscUIW9tq!sYyPT-y^;SFtm6G?=}^7Ahb%;H*=OZ_tgdGSkI3DmmsdtySBI_J z()e4HVY53yNR`{ly+UVcE>gwRos&5{-;;!sLa8*EUVVFduCzk%L;peMYCQ?{!HCp0 zHkko=Ge)0tYXUDzifE~HLQ)hR9^%Ebv?}$kw+r+r#$V~V)uYH?acSW^!}A9ZTnO_* z>?zm|ewQU6=w4k=>&2X-qLZ~Pp08F88h;cFU5Ha0{qj5hH5miH$@O62&yqQZR)lQ> zI9fM7*c|)6r--RE{@O^3{_XtNk;U##!>IJrk?PL!n=y$yKlwJLS2s7>Z}0?0MQaZQ zj8J}@*I`!8clqEeR?ONw@SA4wZ^dD)JTGPY^}F7#;+t{YBa@9{;mJA5c-ku`PYQQm z_@UIR#^pQW9hY}q$v4JB@35RgrlPHrzm~B6-P(&%dc|2`BHW2N9_~(mgf;B~ba&uE zi3KC+lQTb8ZhRAe*P5;OBwD72lUWtx8u&1W$=SxxsQ#ua!;M2x+qJrLIw7+}38rRm zG%4?oBy*qlJ(vDH-7uu~<|`Qr7poIQ@SOUE=@$h;Kc0x%o?a&;EjY~^!YSfgM&5Il z+IqX{={@xVW|o_FPC?{7m)9GmH*~_&SCgCi-6nGcHw2P8;*5^N1QtE4jZahZgQudW zvLE$I-#?WgW)&En@>nmHT}}r7j!9V_PpvvhI{5`}hqqGvHeub*U$R^9<%JcoAJ1R; zb|q5f&aqSy58HWRpGzMY30pqq9wia-lNJ$FQcPK~lZXA18Tke6?;LbKHxpGB@ z&FvpQ*_le~6f;cof5n}g@>=uvZnh^Og}WvBUFpu+T`=j(i>tZcw8krCXv-qw&LCM+ zn#!pXeXK4xrcka(e%6yvX{>PS1(jipocWpK!Skv&7FDlO<11#$-clCw{k{4m>Ne3) zVmzL2Y0>kY*7SZY-SYNcrKy&_15oDHWfM_XFQ1 zuyS^Li`vuobz)?S#wUpCo{)2Tt{~p2fWJQ*+HUYK_H9R0^*&Xs%O1JU@$>Jil_YZ}n%BH4TJ5utZTtkBhHm&!qIy>JybkS(TE0^%> zaMR8$ZM9D+TP__>DDn>JmB~=P{v#^x|kiFymtI$;$(23qKcnO#iH@? zS*LfG-U_MJkz@^aiy|E25?*YAh_Ait4Y%jRt_N&aMLVa(ThS$+qkXhNVO^fFHlltXRM$6TS`4$&1Mk_)Z<0U4lap2D&9u)aW**|M zoKyJgJa*yN&0w}a_XATo4(d$(?z>@GR(g%%x{-6-rJwqz{{Q|ApKo&)V>~jVlpD`R zBp023Bbo7FbFt_*S>cqzQl{HG(Gyb(=V^=>W1aICv}HEE{4P2?zr;+_^0@c2$*UO& z7Cq*Rv4Qh>w}u|F51|2H}qNjoO%)^y`cqy{_&?D^m*+ZOk?0O7B}G#O=K$MTMxWfaVva= zc=Jq`AxUhRPD z+_$7_^j3X->jfU{=SE8^B3Ed~)e}x0PX7I{V@OXgrf++bi{ZfZY6Y?4Re=$MzK2GC zZ$4bl#KV&{Pb52f6#D7;)Zj!a8D#!fQ&sTC1<`)IUnje~D-JHbF|9S>eJZT7ac;2X z>#-eE)~M35#*ypKR9E}Q`erNzJUk(R?CAw1Tl_~sekF{P^Y zur-nGwzPw$I<7qv&!Y6A zAqQVdmIn8auKUC|1YY%>;4y0Cf`NFXmeT&`sA-03f3azV$qm|j`6TT7I z2Sg0))KU8lJU`IIlezhs?cj!QP0WHB#~jJ{FYOVAj#UZi&aN`EP3QdVi!pbZgS;e+ zgPT?R>R8e(zP(G_G7At14r{${QBuuQuTpleCP|oX!1|OJjR`GKE$G> zsV7Kk#oU+vSW_q+zbm%#>qI|aTspot|oA7JFlC+4?gIZrm1Kcm-b;7eTwe9vg6ZKF2qwl&+e&RQ`^-Nz&Z6_gR-3%@L7xRmn2m zhwmTx*0g>rZ1BjklSmK}@K+!Z2r8*|lBw009IaYsP0c-+G#q zy)Krwqw+B!jlpL{l-qdTwvA>gQ-PeynkXY3T04Ju>q+DW?Li0gt88t256>L>o!rg4 zsCh&n`s!n+m-OcCrSur$MfQwuc11M0gI6s3vxhd5@CabMa7yC? zU&6hNkawD+oqEq5#0ah?=!+z7?_|@tRK*{t(R0gCI5o8bt5TDVEKuIoT8PkKikgT$ zI&<#`2jzpyVK$_dl$%c!Y-a>KVnZh!f1iGItB&~BuwZegfCxs#i&*`hOtjl3&eZg7o$kXpRHlyggm@bLFk&m{c*p}W6jb@Z;8yOIr4)v!YYH*FKJSYZe)uS0x~Xg?z<}&P-lBc2+7w>pL5z zpFmluV%r?qT$xJ=OP}P%iwyoKGR54yrJ#&U;i!9VB!i@v2TGPv&`p97$gTX`E2J7 z)Jn;=$)C-4zj6GC-l6i2_9{*0Ya-`0q^d7^9CPeE{E=fJ`n7ONVa0q#5kEc|HEV=X z`$;xU5mmjm?|SY-r;jI}a*BPb^rfPuqLr zq-=guuvs5NXg!xo*a`_=J)zy&_Z6Nh3O6q*p>nDh?yN5DppxmZC^BQd4fw5$SGf_0O*Ba?E}Fesv;Pc=oyosXbW%X=+*56IcGC z3nqtxGKtH@;vbF0^*Js~C0ZREW)r4A9Fn21?jLAC&6za2blgZ>FiQV#W$+mqvc8^x z*{qn3QM&QV?l*nzwG!RqIJs_F{NnN3u<+%XtXFsZNL#8a%w}?rG}#9 zCClRTcg}S6W!z<_$L7@x%q>0C(uTdA^KaH1lDO|c`kkxg#bB+~*LImFN0mNhYzNCL zQ#>(jIw@t&?XXGUgU94dneRZA9E8z2{rIC>%A29$$=|2zZ?DD>IME7tH>rP}a6LUd zac4d@l)x^kwC;;1OFB*CTv~&@xx?+K-z#m=xpX4>(_4bqYKp$>JUJfl;F$`^S{;eM zRvbmev(sbr{%1M|>6H)rW*(unJL!{~%6o~xSHg0Drs{YZ(Sz+YyyrumEe~0K9Q5%? zoe7E@5Zj)-&n?#}ab16mGq~T@kc#qQtC%)#LKy>HijsAP&<-`-ua61#Mu(aXECsp0 z;OFo?AX%iZeN*sfhovG!z`l)4#SzB5WE4Lb_x%o=xSrhPc+e?XW_LvBmPR3sP zCRTmoEr+(v)a_NmTLRBIs@`t?&S}MSIZE}rWXZ4=`>|bV2BIy5%8$3#-o0m!ZW&~n zIGtBDGjF61o}ebU^SS6GoA)RJR+t5;iYBDwL(|cJB2U)HxeKBbH zbrbK*M2$Wa^6;ipVK!ZrkB2E)JHP0ZvYp@7RyKp-O&xb}gV1}ltgn8g7YMv*{OMUv zT|SbW|J>rkkP%VXoV~-PGb&x;k%T_|VsA~tXq9pUOqGapuaMB#y{NEo>sVNMH^)^o z)X1GTo)@M1!^u(lj!)w9CBEo#(N7cWaXm)HrCoj&!^&^_EV7ADJgm>pOy-HWYt8c0 z-omQ8lhuBqpU8?mUxfZB$9Z;n?kg=jXd( zESg?q{hD5@fdzx{AfBv|ATAbnr~z_M^t1hdCon|%SM|^2%QMRrKh9~b=^j)g-z@R`czwLgVJBjeG9#w$z`S3TVEjeV` z!!6!xwE8`uFWU*bTN`@Oqn)Vbc0p+qt9*3ljlv6QReH>Q3U9V1?yfP^TRc@M78FcL zCuAxyY6#Gu>&qSR&5b%#m;*q48PZZ-V&VQX^URc&nH3-PPJv+jfNAlaUe>L97o>u9i+vA_LPtRvO-|41K z)0Ub(Vyh<*YvS?)&YL1 z*mentNBq*loKmI?TH+LKoMg*Blmw3|^3O9^J5U8|c@u|AoqPBpqPXFB>e2R_TkT5K zogOkH>z_$l{2p?eT-o`R`iJ_#G*ft(66Xs!j!%;L*}_sGujT3#gr#Kz15e&OSD~OD zD8ZgJUh?{Kr$39`hiv`ME0RGDhIikbJ55&d*i=efq4i}K`La)dvNgpS73WZIZzWI4 z)C;3(q0)Zta(^Uge?6sdG%Xa5W=u zH*^FVUDx}&5j4j}lxwI;tKKHV(qtCj+>rjOal1;#(sxn6>ek3DdLO1_&V*q{!gB6j zm^_qglGpNMW$d&OE4jTmTSiW8iXjW4yeM6%+rC*~vC>rkC|KSn)0nc}g zUnh@x_6=G8ZREK2=I^oP^jnNdB81BC)WZ^1UdMICC%P1J&b=cUYj>thy7HYlFC)^z zPBFJ7(uB6zT{iZ0tZq+#-5pXX``+UsD^AoDW)6-CB1TC^(qK9ETW=0MXq`U$(dI#Q zzFIXiIbEX4W!q*pI^FXr=7ddiyv+B5*8g%mmp1&oy;}S_ne6eSaJd=HpOgo?OqFFi zBE1$j8Hz41hFK(k(_EY=`E@qV$H`HNgW!qANN{iWRr@ z5_$d%#Es446R31=m_#Q&zhZjLl{W~1a7*TJ@5 zu|&01LA9L5z z-x*WcGMfD!Shy}eMt8D`tM=T{E{~6ia&MqnHSPgk4=Pxe0oDd$`!!`U+u}V8?a|B5PWTiinDfNQp`xg%pLbJN9<=vAqPr zT-Y!1DG0nToe*^v^*nCrCh93-X}kNMKsPr(*W;f5ei<9P+`o1g`BNc##D`XP1Tp`5 zcK?s9so39!BgFsrJv@kI@3-UrnP9K~f8WA`N>3tvwb%*3Ktxc=-fw$BP$`8V0Uh1_gAv$O|RPhFc3L(2Iu^r zg!s_;*}ZgONCKKc_m5Z-`uBcQwCcDdb#SQ@HC_m5a+Z~qkNHh1Tv3TJ=b&{ecg z0lN(ta)p-B`A6&q$>G=?dVwB4((eKFV%OVk3fKn>c|ru}`9SQow||>``%gfR|2uX& z7>E=K!I^(S=sdbC``-5WAX;?)NFI+u>FE9u^Fw*q<#rol0cadOe#FQ2_WuO^-oHH5 z>>Cds&i-v6GMxRJK~3oX*|Gb8A#Wz< zwa->K=f?$-MaP4jPdn%xIv&LK&=yWU9H20Cevp1gC<+}9Vkf8_-4|l#z46%X+y5AP zevtY}3t>=)Vz&!JdQdAm9%O#CAXc2~R~rgJ$G5vl7}9}A(d;A3pM|J!&Yv!H2F(jH zKj)xp=f(*gSv0c-#`VV`lw zkIdihxkefZ1f$1`oF8A{cuDt;?|*-a3-SMs53$X^&0(+K-T854aWZ-UoQ^eGggxf9D%9!+*z%*dK5NV9bBxN0z4m><>5s@Fd{> z%@49Yq5tLs@xL1U@A!Rz{%e4r0DcJ=1I#A{V5@z`y`Cxe=AZ7r`9*va@G-!_`;5Ci zYKR%#*KQeyAtTH|blKhe91O$;WsHK0ER@H4;%_N|Zm{KNs_niKF5z+8a20rNl}lE}`H`)5BW z7CjimmmpoS{r#6Acc%UJhjP$2AS25MKu>qSz&6Bz&=2&<5^)ejfrb}xFrxV;yNA~yM zfI1HBcLY?%vEPwU_inJU4Ou@5a+lukXefq#zi&ckCHDIkv9TGtEg*XFJNAra^6ADK2g*XekkLC+;HgpZm7vdZ!8_gHu zTqp|77vemq5X~3jeCRfsFT@2<8JaJ|h0t9zUxFf|6_;*CttNt56&upEf57xzMeutIQeRY=y3AY28rS1>lwt1ldpD2 z1}9$~5GPK)o;pFQzq>huXH;^MvzTQIj`S-6s0M%n( zd);m9*ar*^0(p=CED2Z&ury#9z$YONw0`YgCNMMvokH`4_#K2n>lfl-h#jq8h({oO zG+&6{LtbdU5PyL3(R?8ug`T1LLOcfjM)QSu9HK_+7vhhQDw;3E6ObJRcA(gX_!Fds z<_qy>$OX+8;z>vk%@^V+$P>*M;xCXfnlHp(p-X7K5KluEXuc57K*4Cf5YIv^X#GMw z2c2Z!8y-5oZ_r;fUr7Hv#EjN2#NVL_G+&4pplvi?h!-J|-7l~W@e-ti<_qyM6o%#t z@d}iM<_qx;=q;Kr#6O{BG+&5+LD_u!xBnYzA>Z#+sE}vB*PxC=`@Ig8aqag8)J?kI zo6sZlW)s=p7WA5AfBzrI54}E-{%t6cZGZn?=seE+?LfZh^@%JG!IC)h2g8Oq^M`?> z(CZUf9uF==@6Qn9!|&1OPs9Z98czNQVSb$XBZAd%=8qT_!I?i2SO;hR4!{yP^G6CB z;LP7a82c`Uy@u@n5Nv`oe`K%{&is+XRygxV0TbZNA0>PQXa1<*X`Jhq8pg+&KN=YK zep?Qx5AuLd0agI42v`X!KdN?1gFNhi7VYI#=J`Ddx z>kDE=m=8U_h?!tj^!y@bh6B*^iFJ3t|!Y09wBhABXwS z`i)o=Hbv_<;uCNHdVhde3|`~gzkP9-7H57X;BEB!K$e$;nQ-P;3dX~kUul>FXMSa1 z5}f%x3G?F2uPoeyULVNz<=}7V^?_I(E=TJN;#2S|^!h-o0N+OI3t~mM46QGSmEZ}S z{3*lRIQcsbi=g!xSzZO!LF+SORX7Z-FNn{;S!jJhtOiH&?Vmq&xB#s$NWTUgi!*0L2M3Bp!Ei^1x$sWZ^V|c2ztH|Tfq!`$oWQW z4NIWs8?g<{ik@%8wy-REz7gBOT{2;unyp}fOP?%1FQ!Pp?PD+9s>;d!9Q_+KDz|h zqIpC5FT;a4KmYr~L}=cSe(dL5pm{?a2pgk$LmUKOLi2_=7%oBchWHBHiRKOQRd^G9 zenT7rGoX1x9125d-VleutZ3d4UxNwJydl00bD?=d91b5u^M?2a%#Y>`aRf|-<_&Qq zEQ00@aTGj)<_&Q)yt?}Zwy|R$Fmw}cK=X$97Ceme^M4F{AI%%m9}Cyx{QP?xo=2bG zkp4R`$!<`vjUD@dp*UC;%^Tu)*aXcR;siJr%^TuG_yL+X#CL(b836e(1biN_5nyA$ z7XX_;%{X~Wf=6-kmJDa&(udCvW-iFPzr{3ScUn zycNQmXuU$#FM=6x@>UE##mQRrjY@ED3fLn0#RtAUR$?CvR1-B2L~O!M-?otA-PB@>T=n%?!wgIbaLGmVm7QTLZR% z@Nn|>80NsqTP^$rXFlp+3{KwaVR4+iHNg5f*WVL30%txN;e4F=Xo81v=A#+@jWZuD zFdt6dp2Di={Utkg&S9t(7Q)F}8>~gPdp7=^k7uwLPTtyKJ@o#P9lHz+b-*$>d3z2U zqxY9c{|i_FCvTmw1u=F-Y-7hhVCW_MS87-P+yyhU?-A|qh9|`L`xU&6-aqXw217k? zE6(#nFZ>bbdhLTLaq`v=3*+SNHEbiefBSFXQ1t#2+5TI&8oeJuJOIDJxn2i>yx9Ty zum|h_*b%T3U}wNCkTjaN-NVAZ9t9hrc|-gTW<={7;$c_{%^Tto_#&D&#P8u~G;fGM zz)fi05Rbwi(7YiYgAbwg4e>ZEfYvv}A7KkLZ-^)0UR#ILp%*%Li2`r2EL2t4e=~2fz~&~bFjhgiN!X=-(Y&Q zz9F86#nJkP_&dCg<_+-zOo!Gt#EY={?ic@UZwYop^M>>ED54(d!j4gwe&BKN#bVUav?$29tw6 zzaqxNJVl>h5#wWi;N*`0LxD4YgcxO<`6I$uqt`34J~2ieXZ}bqjyUso0CN^+{zx%y zIP-T9V~8_rz!mm0%@Gk-J~+}ERA zf%@PE*d4G3U{AnafW4tewB9ISGmU+H3R8gA8^m-NCv?1s=`j&#y+O=?X+Y}@;=`C> zwB8_Q#2i4+H)19XA9}tKGh{AjT1`H;9EW_jiMhZ3@^23<+cE(Rzbe1T&A; z8^p&kBxpTHEQ*mu?;jAKz?h)*2C*1s1ifAmi(^*N>jkj{<|BH&AeO}ZL9Z9YQkXC3 z^@3O$^Y0f-5X)e`q1OxIlNe&0`IW_#qt^@4FNb-BUN4B{F}KlrgZLDt482|uD_}g( zdV^RI6N}ax#7dY}oct+cKH}u>G=>sq{!}o+XuUz!SH;+%^#<`7Oek7!5UXLFaOO`P z``M<@UPJmdFzz_>r-_NdnLjOzFV6gFV-nDMgRHNE3B;MdvzQdL-XQ(D7&)BzJBKmF znLj-YE6)7sV`OpW&j6@5zCeBO1AGbaWx)P`0{{mC4gwqu_zK{wfI|R>0uBRw4e)iq z;ec-djsP49I0|qy;G2MN0geG23-~tRJAmT=#{*6PoCx?X;3UAwfbRiL0h|i>KHxOK z>3}l;X9CUwoDDb!a4z6H!1;g+02cx-0$dEZ1aK+f2Y|}}mjkW=rUCIUmIEvg_!M9Tz>0vC04oDN z4Oj)RD&RAK)c~sl)&Q&tSPQT=U>(3`0qX)j2UriVK41gDhJeolHUex6_yS-Pz@~uB z0Gk800Bi}^3a~X`8^E@J?Eu>Yb^z=M*a@&RU>Cp_0lNZr1MCji1F$DxFTmb_eE|Cc z_5*wg@MXaMfCB&r0uBNk4EPG*tAIlQhXM`*d=2n*z~O*z0FD402{;OHG~k_&(q?!0CW90A~Wu0-Oyv2XHRnJiz&Y z3jh}aE&^N(xCC%1;0J)q0G9)<09*<9A>b;&j{sK#t^xcQa4q0E!1aI|06ziT2)GGw zGvF4$PXV_AZUg)ba68}*z|R4{0Ne@qCEzZ=-GE;K?g88jxDRkY;MaiP0DcR20PrB- zA;9kd4+910{k2BD&RH1>wq@^Zvx%|{0Hzh;J<)(07JmPXTX3lfbjt1 z1111W2$%>kF<=tF2LO`-J_z^_U^2kufGGe|0;U2?4H*3QXIh}24lq4n2Ec~_GXiD; z%nXa0el>=DBu%- z#Q=)~mH;gI|FHMwaZ(jm`*^R2xQz~O112quIFgx>RnZv3zzhN+@&Xz)Cc`k@Fe9@$ z3xcoFL4ml3xI|)Hh#8d-V^DEPVhkEIXxxKJjBkQU5{*lUK|_qo?|JU2(_Odv7Wn;r z-+#WJPfC0GsdJt>b?Ve|>n?q9^5dNRF;4ziC;vq!f1H#5l9NB)$$#0&k9YDlPJV)u zpXlUkoqU~>pXB6EaPpI#{1hiY)ybdeH%gN7l^0S=0dq4OT zM}Ml5|B918&B>qcdzQVgzL~m}F2Zd@L&$NnlOZyuk?m;ZyKf5OS%yj$46o1OYD zbMk!LrSu(X6tQ`nB=|i+>ANE5BRMMP;|lt|uxj8k6AxnL@R5o^Moz5qEFMm0wPN3H~4vt9%9UAR{MM`AXn2^Xv+-%5Naw$ca_H3b@QXD@3gFKHxz{ zPOS3Pz-6WQgG8+IJAelnIkC#u0+$WMA0%RxuLB-rLOM- z-+MR6$ca_X_q~;w46({DCEsL-RemM;W5hnO%C92d$ca_{9rDd{lf){&o_r%GR{2fj zA0_sQRelTkMoz5q+sHT1T@$N(4f#e+tn!C|b^TlqTxOm*CRWY{;6X-Ctnw$wKURDr zR{7K98#%GcUnKvF!Y5Yw%j6q5vC98I{&B)5Ryp6nH^|6|RsLu4za)HOmH(A|BPUk* zyW}4)d}5WqN4}90tNa7XN zPpt9``9@Bx@^bPg3ZGczd?)ZABPUjQC2(1-@QGDE0(g*-6RUg-`E|l4R{1#cjhtBJ zeD7fyH|9vhDj!e2krS)Dmi!ZhPptCEg+2%lKxTgf+aVwJx^{%OJ|R{7iH8#%GcQ`nB^xaGS$t4^1)`vI4IwSbj>0OW&= zoLJ?bBmYd{6RUg(`9@Bx@?qqEP58trA5OlJ6RVupGRnR#d}5W4BHze~Relut^};7s z`LX01IkC!*Cx4FciB&#as>DORStG;6X-C ztnxPUv%)72+)c}{;|J)a_0PKm`i zh@AIe0Et*R8H-a+jyazqR?aBkvJUZwSmj3n4>EFMl^+kR=Q6}9p9HM!nn8{^hay(a zX%=S=Ip#c$SUF7=r^Dh9D`ycoXN%A0lVh&?5i4gou&!5^lVi@Ch?R4L#ktMm5G&_S za$2M={*5Eg#AwGS2Qb#3c!c0RiN^^pAwEd(K;r)rOi}y{!Gnp%3(gR?3N9xeCb)ul zuHZ`Iy#=$%cm{uvC@SS3GFbg*T_xRtIL5=%s{vC7MUOD@76q*{DRXbg$nteEvyEu%CRqq<~y0Ap9; ztLmGAAENwX!5b;RMDRzHUn;mC+Fo^;V7@oKdP5Ji(_fJ56gW&yut8NtBN%>8J&!hZi!CNU`C79@IuDq4#B)eRPtlNF}Cqe!v`+;iQ!YeRxr;`OYRc9h4Q-v4`F-n5nKse zwN7vo<@XBiq@0c;-AVcVg1JwwdO+|8l>byP7rv^W37!mG@^itb0c*^OHJ*IOdr6;g zTF5amCsxkhP?!8dI0Nxj#o!@v`78Nl0At7FtMo$@LL%0(Q-MqWEplR&bDmZjJ6Yh8 z_4tF-jgR_Cto#cp|48f*s~j*^_6Yw*~bH zNnou|&H!MwL#&*jf1gJoqzZgWHU%(v7f9uA1s^~;okAkN>ZJh2Cg7`Nv)~!{QvZq7 z{#lfp7!s>|5pc=x@CRurK3bMoIag8sX$pU1F=CaoFDi`>w*c$hBv#HEi}N6G$;_>QB78;1c2`l$v)CasnY`@QLpscm(mDg2xf>C3rIN-hyWk?<05)F&l@} zM7*!yMa26F?jws1qXdGMDTcWh6)b)qFiv$7l#QB`hqtzk%GR^ zf7}lFc(us;6CWwKgm?-5ARUBHe1ym|#3KcdARZ-n9PwzulZmsS$h?osR>cuC1jNlc-#|mCa{6)d5iTRJlAgv|-lHm2k#|z#_{AIzLi5VoME%?N1 z1aBjrAb1DyM8QE{)CvyzqE2wo7n1}BeQ|=|pf4s14*Ft>;Gi$23J&_>M8QE{OcNaR z#YuwULM%R8aDU=c1eXvmq1N=psUpuHAODKr5yY$nX&mwCf+rK7A$SJyR|U@@K2vZL z@z(?|BL2GIUgCPeD~RU^UP;^_cs21{!E1>d1+OR03f@SZ6TF#tp5QIS^964sW?+zZ z5H}0%kFWSyf`h(TAUNm?Zr+h9$Y~WE^hKNCpfB152Yta{BL#hNw&0*Ic+!j%^hKB8 zUVO#71z$|uBX}k8Lcyzu&k?+qc#+@-h!+dqNX!#Qq-Tl$Tksa*^8~*^{0+f7h|d?y z^N#ohf=h_$6w*P&O9WRCUnqD4@kN5i6E79ad$sXpf_YyxzFhDe;%^G(z0o)uinNIM z62TV}Un+P7@nwQn5nnENHSraKA0WO`@Ot8J34WG%h2YJ^-xmA^@l}Gi5nnBse#EaA z+@JV+f=h^(P;2JG4IiRn1f3gYJk zuOfb4@M_}U3Vwiili>BlF9?2?_(j2+iC+@@2JvRW+lYTBnDxb972KcrHNhpsOQi4PXMnYc{w7UDsIw-FB(yo2}MIQ9U6v07X zOcfmT#fgH0zTkshNI_qmBsl1c>4K??pDMUN@mB2Yqq1;Gi$A5ghczwSt4b_>SP9FRl|D^uq<;5UeG6TE}? zcEK@x#a9dF;UxY;!Cd;|YXnyi|41;G(fA#L#}ofp@MPjU1#=q5eAol;B0g zPYdoPen#*LVm1hACGm5DR}()kcrEd71+ORGBzPn73xYQjzbJSM@k@fY5i>|gJBWWL zxIf3n%YsXYe=j&g{EFZT;{Opmj`$CP#}ofi@C@QDf=?rURd5sWYl1t7Ul-g{8z!x62B#Q3-Q~6-ynWR@DAd41;_9e|C`_v zVh$FhgNXkwxPtgS!6S(OA$UCTcEOX0-xquu@dtwE5dTwf2k{QUi-`Xv_+sJ@1+O6f zx8PO89|>Mf{ITE%h(8g$p7>M2&l1OQV-RUGaa`~l#0kOMh?9c*O&NL2!G|~Q({^b8 z-3RQk=WZuXJ8AmKQ%8>(d(_dRzIfc1j{owpg9ab+xzCp!G5iaaRn--_dGni^&&uw* zU+KX84=9;6`;=3^a@x!@zxMU|ISpT(FtN67(g`(7a4PaTPBs37(~7^~6yi;sF1&?P zgLiNm@HcGv|BmhbKd_a5AKUhSVvGJSY{&nNt@p>+W`Bx9&XUB%iAxffCN4`{p12}$ zW#U_j6^U;ru1Z{;xF&IJ;ya1!5-StmOxr$2KPCR0_)FrA#G8q~Cf-WCop>klZsKo=ZHd1p-b?%=u|4sA;)BFL6FUfOOh8RFG?;=E=w*?elvM-@{;7G$;*7Pu`OJL9#D-Yx1__?a9^2A12o%f0Vo<`QzlB$)6PHzi+4zL5ONq(B_O$`gZE7)YYkLQrD)wle#XoGWFfm^{MZrZb;pjx+!&YYE|m{ zsasM%NcE*|P2HBdJ@u2++SFaCyHoe1)}`)E-IuyQ^+4*Ush_2Oo_a9#i_}A@U#8Zl z9!@=y`c-N}>e19=sb8lyrXEi{k@`*Q$<$M+r&BMcUP^6F{Vw%#>i4NvQvZ|sL+X#I zEvZ*iuccm3ZB6|t_2<-IQg5W*O#LL01?srOSKr#?x2 zn(9q2Nne=0D7`ejEWJGa&Gg0TOVXF7FH2vZz9M~P`djH0>2Ig6N?)D6CVg%CJL&7v zE7RXiU!VS7`iAt4>6_9wr&p!FpS~sigLGf|*7R-Z+taJlKTNMl|0sP&`p4-z(?3bC zP2ZKiJAF@jUHabied+tt52SyZ{#p9x=?Bvr(vPMeOaD5(G5vV@iS%#MPo|$rKb?Li z{cQTV^z-T8rZ=TuNWYkVDZM%UyY$QH-=|+m|4;f4=|85oq+d9^DGq~A^dExj%M_w;+|f26mk-%o##{%3ke`d{e})BjF?l>RvVN&3@t zZ@(q|F6?(vzmB1g;IaxXpj3C}S{kambBnsGbB!JKt?k+R1?_WNn!C@9wa(3DyIZ>I zTRWQTJ97=$`nk<*4V{Z)t-035j>Rb1o^9xEsP00!QDcwl99ciVAe`IT(A?J1-rh2! zNJakWabtY^B2{32l*6ZRCSb9C=Jh z>bCaoT=falPpRtaZfIN(;%r*kYMzfi$*<|!W9Wa`PLyn-}Kt{l>0rZ_DLtB2gykyv|%fOj;oD*p?zK?G0H|yE!=6^%rsSM;%L3 zo{iCkU^sPEH^!>Fx;wiY=Hh#CYw%rk)Pc^(3jHYKrl2W|n}V#smT^#)arGpwC#40LJeXmj_QhCsI|UOX}i86h4%co$m*iBG^cJvmx|J| z)Tm%NpIvX4qFj64mKXQDt+kuv%C+Z<WWhw1>SFSy8%L~@DO}5rft$kvp%?qt^ODYP-H7h4%bWJMDQ}OLOX_EiVp= ztz{|gc~`DIZ_5kTv`x0wZjvk4o-dM{o_FQi^R8UmILcNO+}ed&y$+SO-7Zq7!I3+! z&!g7*LTbCdB8B$+*q!#gt))5j(v}wo#n!Tv_Pi_Cp10)%YuYATYd6W2YtI+SP0zb> z?Ri(OZ5(AQ3U2K}tzL&p+in*rv?oSJ*B7a_`@&OB{S2w?-Y8ONcZ3v$hHJ}0YP)4c z3hj|%h3S$ah4x92LZdKdr^D6O+99&#g$8MaY^@z2SFZ7~GXU8vRTP-)xkB8B$E$msea)plQa%Bi0rwcQ&<3hj=NqR?<{Sx9ZS ztVp3fQmoM7YB!mtv`>ml1eZc)*N@)maJ98|h-`VGK^h@jYX``cYkX{Z!J3B0*4oi= z6x`Z{I`6ezI^?#i$d5-`QK&CcZTH2<=yK|3NNx8< zkwUv8q$oI|EeombmK7?DZ74d9JRclauCa0C`Or9WZN+H2@ddYbq1H|fmA2h3QmDaEJFm~9*7`zfyS^et ze*8z*7pbN}^>bu&xkxq3>6uHY92NQQk2a_+D=H^??RESH}ic70T6 z_j?R#%R*|qWkm`d0mTYkAtPLndE+WH3dhu+w$nQt1+5*T=u#RXTWbf%m1}%#d0`xC zcxoE7u?!~TD=aHw%smLs6pI{*jarZwbmC>+w~PG zwCBe~Ru`qEIrTESRFsybbZXe8DA%61<%JMyn{2J!Bv-CIUnDm@@5;63UAeXbw<31d z6CSmC9a7tF7b&zp+=|#)eIB*e7gF2x6)CiDkB+P^N=tL`a){Ez9NP8 z?NO1{MQLeHy^JmurDZAYdAk(l+Vi%&xaV!H-6U78Jzpd@J@3l3=UutB0=FV|))OAJ z_C!c+yIrKv`fw{^XZ3m1T3<+Q*H@&_z8xD`U6hvQ)XV5nQCgPLp0`U;u03zdi+kSI z+D&rh+Ve$n)AO!ed)}36D{w1fXFcIjYfpsKw%bJtjWw?7N7Wapra|@7Q!Y}?a@rfA za#Uz{gcQa75mMVND^h5W6e~=Z6e+Y%iWC}!F*}Wst+hjB%L@(C2-#XYK(1WlW6KNH zwBv299UWJ$!6}lP*tl{HjVsqy;8sM`@Y#i0y$+SO-7ZpSPvEM4RDF?ZyDvQD)X$LG z?u{aac1K82+#eye-LfKu_DHcphpXLWn$kWgE|I^(v9lPBwjyYU$d(rxq!F^Uc7R;D z#>bWytZB#FT01(fT!T|2H?eW$8X8xwt-!5_sL<>}tzL&p+in*r^5ZeOzDTv*7q}a+ zGe1LWyElpy+8rT9aesu=cFT$s+9SmZ9j>=4=VLWA-> z>6FsLk6p?**U2k+w!C01-|>z$y(VUtqBRXpk=(?_m1}5RdA=34qTtpp)OoM%(sVEH zwyV%s^IK zk-x*S(->J1428&&M?}cdh63cs^YO9d1#9{6SXx@kN5_%pgX79IHjX?W8b_|<5w{|u zLbD6CdL1flyIrJEgSZv3v-&)0tuLgu>nl>^r$=;sk!l)LKXGGWXMTp%ET@ZAks{yy z(FV0;Mdk7Xz%Ccm6g-t4+{h?+Xk5@c9AQO%3`CgfPl+YR4p?>yrlzJl~Lly@7<(9_=T_*Q$DJO1_dkHySu+-NRu@0*T)t6{G{0#AE;SoUfido2TEu~qV_ ziIBZ7JNDM%J;oRcfxW#fd){ttLeN++TM1@-Uhr2x!c&=2V8CM0E{(zysX$y z-f!*NOM_>}ZyesCto^&MWpA6~-;h%NJJE%t{=Mb+w+Z$pgU0xwNZ!8}9eZOu_MUU> z4aR$&)!zP=y$2n8lRWnBckE>?dk0$f&UEaZ278^*Ytr_9#j$q>?CJPB7-a2_O2^(4 zu=hE3kV$IqaL3+3cz1QL>EA)%s=b#n`Rx9E19QAqjp1AEy#SuwzbovHJXABR}> zIL~Z*l?d)}5<R+j|i9&V-QmK5yBZi@89q`q6ZNylV)eAkhZXp_tb;uh+xl>qKqd zN)Io1XAtaay=y(ZH{pP7Z=;8|;@B{63wXUOXp*+$GVtuU9EA6YUk)DQG7Mbmxb9AO z;xgx;SS$m%CbhSh8yD~fD+%Aqy9Ra89c}Lo9^UuBv3U=8crU=P&D-SRo#Vu18+g4e zXp;KZ>BOb)!$MrDz$K4y;VXyidOONuu?*yz)ZSefs5Wnfhc^Z!o43}(!*mPrp7rn+ zJ8{|O;q7*8*j@=HZ7&@$N!yVCk9fS1kNBt%7aoVHV_Y)Mcv*o#Fv67Km)iTI6PNWK zUe<}rHVUv}cs%f-h!UTQmzb>i~i$A|-XoJZ^{jmrur zF1?xX`lt3zcIMFr509^#wcFAE&}e&G;DgPZ=HVS^)@PlUD?Gf7PFyyD7ZsOZIdRzt zFElO_P(IPrVM!%I5x+v2Hr0GzY^`^dxlvJ=094v)n$`BoJC`_LJGDK4i$XH^;+U3}d#v6&_wMe6@M&J-nYg@!RI%o#wb|e7oK)9^Rwy!RBQ~Mf=Bp z2F&Ko@$i1=#BUXNQSs|@;#aa)A%2}EE}Xyra@LJiV+%2ZIv>CJM~D6E0}os1e9|~C z`&^j!pocdZn?}36n>@UE*pJ%0w>`Y?BK|fnbyT!}_rqzMH`v4bE5@bG8{^^i$N81b zo95wtu`|d^FNgCIoA;!LS1~%w+v?#>Dhu;I^6(bpAZ6D(a9ni1U3XxZSLxwB zf#Zd3uhzrkbt9X1riV8O$7P$>?cp7>Uzm5fhj%jKVB6~h4_%p0y8g8~>)!?sZ-le{ zZT0Y`JL_Kx<1DJ)CC>U+?%~~hP`Dkn9^UiL`j_?aw(TFbx75QM>a2f#9$t;J{%!E^ zx}EiJtA}@$v;L)UT#Sm}xz74m?%}O;*1uX0uh&`svL4<|&ic31!&~mGe|;WapR@jL z@bE4_G~91nJ-ju}`j^6aX;l19Lj2>H4LB_fQn`n>AQR^Cz63=1r1PlSS^u&g-ZW?Z zTk7HMtC&hmvGj5tTxqT{!}yZ(82quuq-!<*->e;(dacm4D5 z?sxj5&%=Ac>5mN_UVnG}^YDhb>)-Lw@!Q*7|2(`(cm4D52D#-Z-a-o?Z_~1tB1F@yZ()jj$e(t{&{%y?)vB9T{S%HU)IB0yKk7c)WbX2 z-T#4yLqI<1aqH;Mh3#$f@IG|bzf?`My@LjY?Tzv9PIT74tcTa^tbf;dcsDrf-v$rw zXU_V!-NSpwS^vr>M7MVjXa6_b!#mzt|CV}qXFBWOIuEbbS^u_rcypcgZ{Wn}c1(5F zzgiEk$yxupJ-iw2`sd-bIqTmh5AW1N!{aJd8{Lj>XZ;)F;qCA2|FRz5=uEiYYdpLU zob_*mhd1z$u)Xab-b>E3Yrx7b<#wt9HiIqToR zNzv_i!dd@nJ-j!Z^{?B*TUil~bDxKIA0Fz7V^vI;m2s1Ychj&iFLgq6J09FC%p2q3 z^_7QtSr6}#J;J+ryjg%#WoWUW>Co zSm)s#>CBI<9^OgL{1`YTx*fgF{-D;wyXk;%d%Hcn=iKWD9^T)aRXg)zgNHZGnIGFdyfM!FC_gc}y)&KpG26pC)|nqm zJ-pL)565Mlhxf6wzuM~I4RYqkz-iI#_=9tOt=7Z)$k|_Ydw4fG{`G-}DUweqgMRMp z|K9fS&UgG9b5gXu8yx@6^YET=_J12Zymy@a-=5Q>>&-axceaOjyfc4q@bJ#A43C4Y z9^SW{`CEB%w11Br5w_Ru;capDe-C6`@eM_-j4oZdmnjtH#z&i+L_V*J(vmGyWGROz`5SE z$-}$R+5Zim6izfxzuo#)~G+c~~% z@bC_H=G&fMiLN*9%(vMd-she9c7un<`#|=-c&mr^nsa=sJT2P4TgQg&b$fWfa`t}@ zdU(r6h3%zIkFK}R+5b)R@LqC`AJ=$z?;jAZ_Z1JXqAJWQKO@?|Ndv>Y77uUn@Gx(k zhj-n+Vctg`-UZJ5sQqfRe>d(Ews*OQx6GLzn>@T9>=m{*_{`{fFLUNc*2DYZ9$|ZT zczEA-_J7+wyq`GxzvI3Z?cZ!?ek}FyI-U9Pq=z@wnI8kc9$oLO!Qu9v>EZq9=rFGj zyo2()zru4eNyonjJ-o-pgzate@U}YpzqdWS1Ks&sAMM{*XZ{ZM@S2?YJI2FX?#$n5 z9^Ox#{a@C@d#N-Wm-9Tl0nYrr#>1;{=I4R+>lxrcYGGk=fs@P;_^ceaN&-kHBG9^RYBg!^r&hqs%v@4Ugod*Z0Dy>%Ym z8_xdkNe}Nwqr>*LdU%hQg?S%&cpo|YzkvAyp*&4^?7(hob_*mhc{qIxE)(Pyb5RiOJ$?u z_pG!2;h)5eoFDIE(!?=s5@zbudU$s^>tEKxd&XJ+mU?(sIqP4ahsWQY+5T*4*tS^t)Lc=x*NpNIEbcm4D5zT>Wc z9^N{4{hJpZzrVQapNE%r*FO($oV)&cc&EDSpNDseyZ(82x4Y|~hxf9({&{#ioa+&( z`O)#);;w%l-Y3rWh*}Tt&xeKQQP#stx$B>Y_x8}Ry*>|bfV=*Ac<&t=wzt*8D{g&)x-PH>5tS|(ebNt*FO*M zMCW)^>*1a6^hegiyTR#?r5@fhPJi@yc<(s1%2 zdw7cmhIzFf-j9Zdd07wdap(MKsfRbx-T#4y5ad(Jpp%{TZTvuvczDk{>)&<{FI^e7SKc1o-l5L^Z?=bbs3Yrcc!!cZT0ZZ-8%xBcU6RWeIDL3`-FL$ zJiPmdg?Xv&=ytrYSC}`(!}~>fn3whNe!oYUca4YlE9d&q1`qGm-NW{_dw9#;{XtK3 zd;2~gwl~|uoA2xomU?*0oc+N%4{!3QaJ^eSym`+4VBo^&c6|59u)SIj@BRbAylxNg zug>wK&%^6KFl=v=hxbKiex%NcZpZ2ShV6~<@M@g-k@fKEo%wN%hj)TAKQ?%HIcI)s z_wY_~=12LW==Lsf=ErOgZrBoJN`K)Y_HbC z+uxZV-5%ZrM~Ch8fj2(C`zzf4z0ukKZT0ZxIR2HN8*T4=XaAS=@a`Jv_~+q0b5NMK z)x%3T^SAuJqy5V`^Ed0^&2s0jhj(_V{ztcSP8+5h!yZ`g>HaYvhtsdTk&i=3b{AmAPcJ_Z+5AT9w!g22N z@NRVWe_K7gIY))=i$|tg?U>&ysMo3UwLn|e`^m6+sk@* zuRHs{J`XRxf7squ4{yvD!o2b&(f-YJ_J3Iq?^);g*5~29>m1*7QwX#Zl)e9L-xw>rnSJ`e9#pAXl&)x%ppHq0wu z8tq@-;4m-i;mvpUe|;X_vV+6+wt9FExW|uW(f+;Y9zQ(1-QD@&;T`Vm|F(K~XE^)6 z^5xO~EpqmMSr2cHJ3lZO1D{C8TuRWcH*Hcpt~Jv3Kl1gn&K9Vs#TFf@0{wzq zT~|kEuB)qgUZ%07p>2LXDg>rta>Ju49ipa(;7nQ_tM$#`e}D zb6VucmX?LBRUMt}XXP5ZtHH=XRV5|sM~xUYcEq?*#~cx>sYZ33&0UQPWASppR7tvX z;pkD#qdG>`w~p!TYOU5UXZG>Kn3Iw0(Z8JR8HmjZxp& z)44F$Ro|97r@Ap#-PPUM-7pv5i(C2qS<`F~F^=+y@37D2bA|E2e&GkhBuLUnCW9|C zoPu}rlc!-K&$UPW5PbNpX{7@5t-2EA?Qu?C)HugsG&IiH4yN7YD__@{$g8hZZNz6h zKBRMu^TRsPFP-fji>n)}+vlEjWG1uAaXx13Q8E>FJ^#VffOK z>C%3^2QR6+4nF*)7jas4_xK^THSq%xg!za>{9$1Zdt~_1$#oykZj4gCVXX}yP>z5MB0p1kdeCpJF)*z+5XT6*`=J1@C9U6LAp zY2%jrVpVy6ukP0nE8V>zcH6Qc%hiMUtEH(}D!yviCCS5{hz(7SO#dLcBo%-7>U2YD z_enGJ-p5~^x$FtM+^T}zHOpo$i%%+8v`Rg^W@%}A#-&=$cFVPl-R=IAc{TJ|#Z2bm^2t z|MAP}8cXhtrKcnhPkov^toGByBbBkzezE?uV~OkHuU<82$sQpTFI|6^#EUlp5{R@77 zIR32Kmusg^`Pr1=Q}=@3YnH}WoqqQ67jM~g+w)I6`}EV#Kl$PlFK_(AW3O$fM*L%` z#%+(rN>k%u>+Va2Us}3nT_Rog+|<%Nwk5CLqoicbQY%icUUb-ic;k$aO0dG z#Y&eAj5V(4j!SJ7j76$2PAg+}O$A&)pQ$fj4Pu-sl#0JvC?~oxF^yLI;o%a$e7_G_ zcHfL)v%fRD-{~JrnK$*tsgq8;@5Eu#a)@IxX#1+z*#n-d8=by4G4tA?nE|o?8qip> zCRQ1nx@>x3wARK~mB!<*46WXG$k56qLxv9j_K=|!hYlS&Y~;}4m#lW$?Z%-I|C-3r zSmI05>AatlcMs3$inz9*fa0&7Rrgd~gD}n_rTM;udSJsPH%dA z=pE_Uisy#jl1>bNsv`be-P+jI=mE79f4E?4S#6XTN95<|uw@rz9v+%3Uo!Nf@|vN^ zBjQ6ZI^y9WXmk06y-R9W#lAnKB7R5E&b;+kD`I!Vl8>ch7fnjXPPuYu?9o^{y)4~W zvMjbN)wp5|R+Ct&GGN3X`Nsas((zXd{wxXk6JMn(7*~<%Wml(HCA6N@`gmPowaR4b zrq7;v@{H3nI3{)VQUa;wGKAi8`yhI9@)bAbnGVZkHgw8 zN%DnbEtU#Z1>d^`d|XN}X*Wl|d+bVc9OQ8>fq$7MTz-$Be61FTp7r10|KT-rBD z__H-@%CEQb;rjN94Kn`R0Zt;ekK@liLH)QiYLeu8H48rd%Q$(QQko?C<(f78xlVqy zlfT%>f5*y){ogmJe^_2G`QfHbv6$qKb@XM9zTltmxhIh%`D-+5>S^5;>%~XL;BDQ~^|1gm7kJ$TzmH#IA2O-aWm)d*M z(zE}dFiFZE;N-_y`J2JSrGUJ>aC`QTO*Q_B!2_NAK~BCbHr3S3_UwoG#}gw>-1pUM z2H(tYGQJ!SydVB0t2gt$iT*4nUvB)tWq0s*i@k?$CS1Noe)rf<9R8Or|5@LSj{Zd! zHi>#%md_{V?>9NdWxv>7vD1vbPT1KGk(=n)v$8?^2AlF<5BR0AMvFlEg}E;6ecJH( zMLj?Kw-uO(ak)208T>6Z3mLJ>0b`ZiWFrOTajaxI0H0C@8Hrf=oZF>erZg5KRyo^S zVm9~vfJ=ABA0%Ss;F5Bz1lLuVGWe8EAQG$`uC1jL195QPsdBnriF*W0ELMflIB!eM;z_J!acIhyZLv7S%IOBKGWHjdV|*i44%dm&I{ZN*R{52{>f2SorIYXn ziC8(;16MM@NVnmmF(g*bW58AW;EzeA`zb1LD5@MNa({22k=XXCK>>`NPdr%gQcKRZYg>rb<{EMgpI;@P z!yhF2S%qs?O!QORNUUWUzRE-K2Z?@`3<+TDJmR5(d+}9ik@BZm$m5i92*V4YLMD&I&s1CKbVf?Kq(>(I07O?U=AlLX0fm-8FtejDnoLJ?@0+$TOA0&pp4EJ%Eh?O$|nD4h{ zB33!WSIU8dM6B{tfz=0MmCvF4IQ&7HgOAG30@m?KtnyCa%1Zn};v6Y4xEHt#*XNmf z@lihK%OE2sR{0uWosYySzZ9C10SvHm)2#43tDM(vN+*k)Smhi)8ixwt5~HXlW@jSt-=b5_1mZCwp9HM! zB37F-fVEw-fy;3Hnu%CBrvVQ#a$=QpO!E16rv32Iz9v>qRjf7F+Ssu;h6g{)WxwFx zkPZHM)YiGVYm{FS?aFn>I(qOx znWe*J#7;;et~5@=g+u(CrM!M<|J$ZoR$ZIl(A|{lq}|4*hR%@bTz5~$&WiSQWE;A3 z^{owUJq;~3F>D+Dcjr3WNO7)ysxN5cJT$VaDHgsS+R=%k^YT7*v@~?jYwv8WKR4Ie z-h6H@s!H)GUj&wmCCzQ~+Uw_awzt-IFYX9gQHQhv^Ez`m+g6a5e=Au28C?C&3>-tKa$&y-e_QVdSZGw*L zt|qm25lFVZi(#)4GTH;o+q(O_O#4+qgV>3I*h$i$kg5^C~MoxU@%3E=YN4@`?nnxX#BXnR(sz<9kgc-ZL!I) zXST9|C)DwCl=(J?-q?KbvH?T>C~q_Xv8LZ}uvgp38skEyl(pZiR%v{x95H zG)JqB_Li3ai#v;QuFUmW6Zdj+HG^**AN=NLSH}ykrR3>2=hiN2oDVTPd^p3NysJ`~aBeZdQRS&pUdPk(yB)yv-Bt@R4r!%C0et#Qk(u>t8~eth44 zPY-!=*b`GXPJe9XhWI0+mR4V~23PnCcZo`0*k1F)%ST_@H@+r^J0v^q>0T3CvfjGe z^YEJGM`IYkOWc#WWm$Zcox3f6kLD1TUewszhkGrbUQn8Tf46%UuZcDG?v7G=FCmWm zg7>8R#_wO(xb4>1d*kQUK3_Xw%H30jOikl{(CGAcV`^JVT#*{~-Sp+3)tjf6hi&Se z#fej9Os<=msmjc5%4M*l$D;?iY-V1rp}VIumuc?GV0W8oScrQV4Rc#^u{?c3LpIag zh7ES6qoK2*HHXb`S3x@|xaX1SZqGEdw6r&3L!H5iMSJJs0%b~2n7g}7V|!b7Lvvdf z3@&VFY0koAHrtG+CmPyNNmr&b$0s6i4<%oFZLYC%aYr|wtZ1K?nTskGfOU3HGakOk zG-T%Ww6ut{P^6{@rvz=?&2WarpG&qXFTW_o_(MX#_JG(Jt(O@Y||!&c@rC28hdbdVxp|Bb|Ln;?l6_X zs+lz%Pq+jfYK9F@Yw(x|##3W^XD7O_WwB{ijf@IoS%yZ~BAb&zsL$za#^6Ew=ix3| zm@+HZ-Ob?8G4x(fOAq=UBW8ZCE!Wx5jl!ncbrWZJI)o#19!^Er#+cC9l({|g=H)us z?cMF|nXXn0Vlu^-?skjGL5DNoolKd^42M{L#L(G7q2Qqyon>7;9UbkR9Ong3@BmF) zXetI1#1Kvjrj$;x!l*Xt6C@5M$ejpHd#enH%1l>JV^anrHrLUVYelqLG7EBx;i}xL zl=`RWZ0u}a$Qg`gn85d63pU)@AGhMZa)V>n!6Z1g>{9a#8^1FgPlbu zo7*yY_-Q_$pQ_9>GUg5Qu`FcH!Lw39CwF0;v1bapgq1e8_2gnF)qdtRETBeB&(LTH zSd+Z#SfGaQZNc>HM4#s8v^`R1)Nw7C-ku?70tds21G61ZO!2FyEgKUK|Kc>4=FIeA z_blp=l}|W+cSJvPR!wHgsahVPYsxLEl38eKIi)Q>%Gl$XTw8u2ZD^U_j>*>4st%cM zCylqV&uQ<(L~dw1yc^42CfC}5AHhhqCp0h2vF~JP%BZR}%trq~$H1Mw{D=slkaWUhJ|*XPk(x@Xnb)I~$iyGOf*+ z@wjk=%5ez7`h}))Xqeh%JT|mt>L%7A-kb|T+0Rx#*R>-f7q!5M+dt;{L8(C}BqQA2 zfTKdEOlQ%a2x-0#IR<*HzOHC*YgwG(_}~gzH!;(IS(qORM~HvT+*aez zW!dKWIG%GnIXhp5mj(Y<8geuYaXiS{YzLogxB`yDCKf6lh%q9AgD#t)wG(HC9-V(k8M}Wz;cL0WB?b!sdlhRwHmQ7|Dau5! zQ)W?Ih5kP&zsq^MOAi`zo!!mzxUJ8H7RAr%MIBFXgQhWR2wGv^l5c4=C)as6SE_mK zd7hlpn8hnE-PvYWV|i+>QyRgIkR0aogXWsk)0#`#XruRQDF>6+}= zVqAAV!#W_e|34>UQgT*1&ijJFCi})rwkO!Xm<_nucs2w}pp@V-%5ZT&<*p)#c(7k= z?p~b1;({|dbGFmcJh!s}r;JjRQ7CLbGwu0pqu8@q)?sWXG=_BONDlr&4H*7-vRHL+5jd; z6An`a_k)9Cet%q@ncaz_eXu>o8CtH>lxL6%XBXbHc&Tic#|fc@hNkJ7R_xIm(CCwD zCh9qZX#ltJvi+w3Cw<&C^4u6Ohkat!@)V0k8@9Ky_s<4XIE(#BrtaiP`FLnejqN=x z*&y8cg$Tn9Qy!NXGF^*t0Re^@Gr`3wQy9DMnbS`QD#v-n!saaI3h12T^es4L%oVte zEzMl~3hN2|Qm=7pkCP`B6&g9gc>#|e^Az*wFifU8Fw5r9l89VuE7xN#u;iu3)+C|NHX+xSq%P}$jaEkxWN#> z>EgU*G%wiU>xwUZiq(A9^eHB~3=nQV@q?viIu?97v--8*4VVgzU!9xgeb*QJ48;;>&0uP5a3XE~jbU2gC{&l-e56ZB0DO>ujDs9~;3enr6C@ z^g`6kg%aBZIu;6zXHdvVXu*`BO>DqH7)P^i9AJ2KlWP<*V!S8MqMqE)nLUU5kcP%a z>?O@*9lgF*7#G0>9ebtTMZvBG%^e*WPe*22a`U)1Z*Mb~khET%NV*mVp0gUPO|8vs zN47RB%FN}(mWIye&>C0>d|PflX1aZG*aXB(y$lX7oO_%oX6I!HGvrcha2{)4Kgd+% z=2xPp7r=GvY!IdKP)Zw)o}38$xgdfK3Qo#l;s|5(l(q$JT%cvi!qzB1bONh0W}TQ< zX^|=Bi4-#>1D>_sa&ZZ+>9=KgF|M!;FVB3 z6vH_gELMzyv?Hs9turoNp>Par<`0|VC#E-Qt-QgEJys{%af!ZKMn#mD-Eag)Q^ z87%VH)phYIt+6$+a3CGwidU*-c&}L&w74~x7&8=J=d(;TEruBR(3WE^p2KKmE zFKj;K3TUDFnX#iHvGjn={gqYO*|+THtxW|t~6LmFg}8Kd{JoyRq&Xh zOs)nTYO(O3?R zBc0qIm~rA1W2O+L40b(1{|3DPd${={tuUKzv#Y>P2)6@+`$#O@iQ6dXFtqga_MVJc z5P~~L_J#;&CiOaeu{F!zPRe(f-J5fBIO-rod;*n?YY0YkVVi)%L4H72^t82LU9x)H zoCsxlI(Q@s7B=1<#?iWJZUfE>oHInukY?P7%ikrz!?qYAZGlC)oZ$#NqB=8WUS=^` z*o3&_0t61v*wnyUF!XHigXyfdxX~}{jQsf+52wLY<&_q6IxIq9Iy+(`85OrPJ2KNx znKq64S9X9^cQD*I4T9@w0G$mu-^7su8-Dbr*~817Kn4~o68aM7H0W&v99NQ#%>-9K zti1rN=n4l*`Hr&|5}u>;G&?i&qzQFgcI&a))t_27bIPRC>u1*e*C|tG*41VzvblK; zJuTgcWL3sK1#>LXeL49ck+a7vUHJ~$#o)>pv)5%T>%ldSkc$(iO{uS$HtpoE)PJR} z=EVAmbu(vAnKWf$&Fnhyo^Z;^)9b%7W%lHgPnlgm`Q%x%r`McRmp`bBpRv=%jyMLs z`Y#Cc>e(*tpBWo7^OwX=#t{m!=#f3B*1>p8oH_f*i8H4iIdRs^|Kp3-rW)4_#%ypn zE57<{SB#O?jB5bCyE~TcU0zbQ&B_XH-AiM;^)jkuG`Q~i87eQ_^A3~Eg;~pDaQP=_ zc$isKy&ZC%eBh{HUl!8vwe?`l>(sW*%0D+y2uDSGa~5Z&p&Nrc;dfzK3Ko#yQb~2D zq6>%IGaEC<9;=J%B8t1{IVt2HovA(aEV%;3|iCPxb3~zVe}K^ zA)&$(LV?>n^`qY)>C;e!fJ~^FRd>`FiKKNKH*X@ACum<_z;t3ag>5Ge*g;3eCQQMb zcKB3D4Yub&ymXjxH-QU&yZ}TOf;J;g>JmbUN8`XKnAqhlfP7_GwQ-b2l+b$`_>glP z#khHjC*kBNmO>>c8Z~9uwQ{12C#vjvq@CCm%BdA-OM6KYN2Mg&$$>z0*SSSL=d!T+O1U=(SsvPxh^ zW55Z>1J;a_r=1QSd$Dl2q;RHcVuw=^p5}1FC)-zZErmPjZag& zG!~T4UdB3{hTC5^bLPo>+V})Mo0z{}r_$ht0=lFD>jlm$WgzKo;2G0uW=}eKCTBwN z^mUcDaBWW4N~Ce{yFsZlmT0 zwq9m6!?iGe5e^<~vA}bm5VH$S2@d}G!I-J2GgHGJwMT@CczejU%K+*G2+y)^qb47Ea$SXm5wEm=xyU z!bUM-Uup4VFmN=(raXY&)zQFJ0wbkxEdtg}p&*1u`a6lHa4yQ{)PrR(xD3Iz$9S@Y zy^)+Ualw*1CL;D5jB#BZIeG-2DcZ>zJZo|dw_f;eJ z-GoOZ{SeI@8$2aOi$q@LDbr7!e)3nQXJm3tJh`?mQ*qdcF{d37JFF{~!TXK=ll~Kd z|3u(F5%^C8{`VsA|G@iW$LJ3T(Q3XU&dNfPj2(^NyUXwS7?x!0A$}p9m*j8#2IPN# zDAIJmuape_rt`m%V^+c8}HI zNAlEt&gjp;kJ$P8k)bBvg&%Hq0P{5`EPpwEark3kzO#e*TjBo}V7L_IAA)22jrv5B ze+mB1LY}WGB7a*V7HdQP3no7h`R^h>+~g00|G%>Ghr+*ikmqm1S^ik~w?E2g`C0I9 zJn~w93;g5n&4(C1exw<@3VChMP4Mqt10`CEt`m-H%k41it(f|n6v!(z#H+= z_FV^C|3H42(f=I&9gH$s-yh-MIONs;*Wgb*^5usAHvGBB%BPXP9r=vWe-8fr8u=k6 z&)<2ziM-Z719%{08joi9ay;@U82*LuZyEA@?*#q74gPIFUj2Cj{=J2~j<2WS-|ndM zIKzJl{?s8q%;dKLFTh9JNA9Kg9AflCVC#0|)!rB3-=oNDJZHnd-C*+w!*7LuBaokD z^52Gk3z45}^7q2OhmhCyJ^=sTM84MO9|5j{Y@Ese9(CoAuQB=U@aHz8YKNQrNATw(OV7D<6kY_v-u=WF$t=X)=Hfc!9%UkLvmM_%nMX8e#p z%;+zIfBWxKD1QU|n}NLc_r37%V&umg{?qVpBl1-y{}=f4KJsdx3-jQTg8pFmHwF14 z4F5~;uM>IouL1t8L|)g|Ec|-``AWlYgMaaT3+vA};a>ytvy6Tf{9A{-mj5aI`#bX5 zzt6*;F?iR6#_KKkGY|QrP5Bh^H(L1$__qo9JB4)}Kg^4xQe~ zImqk$-Us>fk=ODS@b3ZS)qV~9dmDL;{~7S_2y7lsH1@mTUpMmFzRTg?~z-iYN#rCDE}|xw69OVq2#A!*LMlP0GwF$XEA|QGI z5vj$1h?H7O6fIRt5DGp9;8TnsWbt1C&TUUC&igRSScWW3uD029r= z;0*3uA?7(GD-I+RgTaFeWHtt4q>1Le4C6Y@3uqsqc@gL8RvFzi zCy+1F%)Y)1?hGJp$UKRM@P3ey34o-MduV3A#zvOrZsefmOma`n+@BddI6#WY+@K-s z*WVbXxtv_Cnb#}EP|fVG)+p0lK@MwXzqCfFX7)>KT%&n1d5Gp|w0 zsU%;ec>$RRCCDQ3V9izJNt$cPlQl0TPtm-LJXP~bazyhg@-)qB$?G?_ad$aCcTG(S(~K?bsmyj=4h z@-oc_$@gkLOm5VCl-!{Cb@EcpZ;_X1K2EOJ{4Tjp^9STw%^#6#G@m9f)_j&+t@%sx zOwBmWQN}FIydPoQqB)s-tL8T3*_wI&V$9K;N}j8^8~HZPndC~%J;}Fg?oFPjIhQ{ClNV_oLH?fR3i6$rd2i47zUGPKyEIQG->tcle2?Y@ z;&^sd*Inq~;3p z?=+7m|3UL)^1GVvB0s6Qiu{!3TJlddFC*{Kyo$V6^Ct36&D+So(EK#{JCiA5M`2{A5=|6tvtea>4^N}w!RZM7| z)7$1L02NeZtpownT^`c)7xymSw8s#2U>m9=Z6N^=uoJ?ZFDG9 zWE&j{^|Or*h5Fh?heCz6(Vh9@g>0ik1$`W&gN|)rf60eKp#iqhA$0gGo(_eI zY@E&fkl#ehe88vqeG$ow$Y(b zk!^G+)Xz3L6zXdm9SRlNMu$QLw$Vi)+Zb}8Z7k?xW5_|rHn5+)m^Ot5*yvEGzio6V zRAd_+!bgN9rbD5=w$Y(bp>1?1RA3uj6tayW7uv>xJ~oCNbZi6haRh5;V^e5=jShwS z+eU{%MYhqQP(Rz~P^hnMbSPA48yyN2*hUwHY-7lUwy~g(jUfje+rUD5F>MMBu+gDV zf7|F#sK_=t6zXRi9SZfejShthZKFe>0^8`KkZlaP&^8wIu`%SJV;fjtFQ!eQ0X8}m z>Teqz3KiK#heG{qqeG#-w$Y(bp>1?1RA3uj6tayW7urUAq*|6Ep0k!1Su_XdlLsX+FR!u6Q79E>CJ7@P4V>o`xb z+xx+6rZGJQBmRo4f}dL?jkk2L9xEk{ewT}aU)vAh{w4zJABD?H5x-J^lpXDR5RYw9 znEo*aE{7k(&5=2-FCu*XHxY2i8ZaP}^7Y?D*i@|N*BA5QQ?-1|9bd1;SJt~=QTbK% zfww2Vo%L4so5Nopd2IC2aYrT`zUdIYPTY{wfbSY7hbBa-Hsg!V${$gi_}eDp-=utH z`S?P?gNXQk72@M-1LY-mH?){v4R^jmFuZQF<8z{}Yf&B zA!SF(f<0R$1hX;p#*l-d=M!y$**|X+?EOlcV9pzDI$RUze2t2B9-{(d0;+7yzBTdt z>s8H5YgEnd&8lY44i&#=pNijmOx3)6O4aN=qv8*hsrX-yQ#FTXsQ8!fP)$igd{Yye zKYms<-?B;7ypo71I;(g*YOi^@NbQcFn%opOr2W)(&C~yE1RnX+XlmE|=Rd3NNkbA& zw#rIre)j=Y`0*IkJav%@j9qIK-uk!-to__*zV!=LcuT2K_-=!W{^lX0@VzgL=sT$@ zTJa+l_-#icdL-Rwe*ZNi`gVp2Oj@VHReP(02{Vk138z%hw?=LBoiPG8bW**lo2R{O zoTv&W!j?Er1(P@C5mo+K6Xa zLF1IM(Ku!V<4)m=Ry**G`ZH={{ALxwZMjFofz@GES6#N+Us6$$7M>UmjITEWN9&QZ zdKEpIXavUKcMN`ST7q0IF#_)_QPFpjjG(GR^wo$yR&B)1uIRWWDj4T8HpVT)9HwIq z_;&j^_$9oCrTNSV`rb1(`aV;^#J$GG#JyO8*RTZdsp=EaxCURVktOBTBLkgAs=}Hr zs_?!h6^*Y;tSjqW8(2M3bzePv^|~cZwO`c5znrAv_a&%-D}q&fRh_Rcp)M)1@-eh% zENNeoP}dG$bT<;)MT*-Q#&BbUx8}#~tKN;8-yFuV-51{2`iaiQhR|4iO?_;IYMCDB{Iq&D@$YKkif0p5 z623HY`ok4-mPb21ZM?cX(7CUgviMueuUpON%f)}fl+pQ&haT|(gVPgKXGvIpaXLvbXG&reblhxSj#)4}9q z75(cOb^qePgD)HR*EG-lEw;QvM&ZY2@cR<#>qu1}zdKrkrm)SC->SgpaqXkyu2H*_ zp1H5N{sWcsU^H%tult^>_T91n&I5y0{7YD;FDGIh77o2x1*_gyT&LqyG_KA!Fq~79 z6)qULd+6w)&Gpl z!n?~x4-Jg3!xGgQ(bwx#^tV1EI=T+~GyIOhcK0^6$+zoO;GINl$@SQh&tN<2Y;26* zfp6eo+rt^dMl}Q5<2Y=O*rSh4GJ=Wwu&tdkf=S1WjY-E;FyRihF<~?IEIY7gIi=>6 z@@p}%U$z;yd%~`QhWy&C4K=-do#L~@oto==8HLa6P=(m%H1~g5eRyAJZ1o?aH~iMX z_;b{i#)dA{FO`G~Q$8z>OwKWeHx?#;p(1E2)m)FgU(x_0khG*r(~_D!C<8S8?X^5u zwHYPAwR{Sl6GZ%56t}K%_7`w!9&6Ppe)F(Sg>_-0u+^}V(W{#KJ)@cvdl}nT7e2dL z501kTOdrc4l`pGHu|FuNUHMW3XQV|9PvZMPp|O$Euc>C=z>>)EI#u&n zZEF0MJ*mz0b*lMUmgrekSd?Vky&{5U8dsJ@)XORg-PjP_(fO-LRiY|<&u17X;`b(W zy0XD&iPqJ2$*#+{mqOx2zxWK_2TDO%7N(3XiA-)(S&bu9HcIqJ{m3N;mdJJ=@%z+~ zbtv(bTk$od*jPq5ezTQ3Uzt(3W3MV$TbNK!Y?K!w=R;Pvlr{I; zfo~}VH|jlE;aiWbjkAV_DxM3yZlw`{d~UY zSk&)vsN3UwMzHbe&Knz#b`IXVr}M^pH+3GNTFSEPj52qAjT70iYb~{S`836pjB%n|wS=XdjPUkRSrrdd#NGJGu&Kk33=f}Yy-(PGRqf8&9gWyl8n-sY z?Th;AI&(jJ#9li_OU}J5Vb>RzHpK63NIS63I1#OD=u%kM%Q&_=8+(19iXWP2?)6{8 zUdV?%!!xSTmt%}u*Hjme)EXS`d^plceUA9U1|!v(XJY}x%6Vw(y7+J_sl)0CQC$aVXw$Ye#-*@hdK3Hq~X<1Xk-ut4d_Zo!@f1$E`;pNfP zMx*(TovJBu?~3NncB+#pO}^&$cB>fW`W$nt|oxi6#?5qvr#BA(0oh39{I9G{3aI90aSf`AZk`9Ucvi9WE zibvF^x@OgFFU~40G307waaF)DeizK{&@A!E;k~Wa z_-)-<1yYWmeHI+Ox3zi}Y0-vO>RDW5Mwhiw{qY-U(?&hp7W(qGXk!xhdd|UgUo^p& zJZ^vff$SsshYH3zbKP7wWE{@#RJ1>t(5)e3XK}!LE|Bg58;ES$pQz zpQ@j_Pv}(f0Bxum^QNhX}_!?&SCV}h`%4sCwd!BEN8vbV`MFTo-ukG6=?&~T86r(j;$s1 zZfam1`M)pMjulPk*|yHDAss7p9chXwwcbYczg)J?Rh{e=bh$|xM{7~SbxsLqpQnUZ zD|ZRIw=9WioH&0e8z;6Xcg;0U#FpUX4hf%x zTYT7aCQJ!GP$7FyUi0Gnl%BnIRjK9?AS#xPiFg~X`Sd&u{jK9nX)?C(-6`xz3Rg+ti z6`yBh)#SDGz|o}F;;PI{baIx5-c#~=6;8_x_L_#yC+1%|C{v-AU4`CQ)VU7xD`%tk zDa$Q0lRdAXJC5mt(3#Av*$eW}aR+)#)t|UAyZO#nmG}V3^l8fK2vu1<$lxB?Ka{Wj z{^0}l)8}`abIX0JZthc)?A5J_d7rQt!(i6{G==vQW#Iir-XnDnxF|QL!;dZE&tJEs zLXp93|5x~pP(iP=wTbUNc4Mo(Km9CwUH#)vjOo<(^EdI~^(z}gjq|zu0z8>9ehEPu;LH^8JD7KRq&5=IPEWdHl&Q4}Eb@pD9H@xafvW?}sP+ zc<#`nxgP~y_-xS4+dJOy!aLVZ%=zmjznZo=_pcLPxNP$mPk;NB>z^;^@!0QHeevOh z_dBK!E$VpW{YS1ysvDPaV)(YEFaK-G`n^y7{j1hrl;wOnxbs7YNBydBd*jRVKfiWE zyI23(@rIuLF8^$KRs6t9e!Sw-qvIE*p8nfIJs;mcetyv}f0h<^-E%h&Pwmxp*ovyZ z485=a&ap4dxn#<+>2K}*!LO$d>e=f0gPYp+D?IzwXEXkOX}4a#cy8Q%Fa73@&2Nlp z-}twe!$m)TBJ%WK_WalUdk??5|M7<&y7hGSx7R*%wDIR%pIY_i-Z%Q*{=!G;qp~Xh zaB%h=U(P+$eq@)Kzj|lsm|x_L%@|a8_bi!MOcRg|3Y9S=0`_KO#_-f~i zUmW_~Pu@OocIiJqHO`L$S>Iv37`t-)gujoTwe^-eR}UC-{oRkg`%?UojcJefereY$ z-x^o7df=C*PYzjk>*$KkPyX(+4R7Ca!{+|Y5C1Fk^G@^CpT0Qs_D^2?Sbl%}lQ)le zeg41HW9 zI^M74p5Ue19?kFZTI%+S8PRTc-*?M|ZM9o{85>&;-wre|KK z^t)n2@5Jcv@BZMki<@$Wj-B;z&h6L#YTw!ZGv523@6TQkoL@Cdz5An{+b?Uiu=Hrd ztwV-2Jagi|x3y2&eRX&(r(bq**xIS%I_-$xP`K^UtDjr-;{6>Td#S0zmYvx-gAd%3 z`?&G$6Py0FY4FN}Z*8wWy6mpoj`d!6WZR}L@gw>^X|>>Elz&~;zTfk%q|;xObj!Zy zn%bw%{L_I3Rvl98h7k#?TqbJti{oN~Z-*#`W zZBu@jwtx85L(@){-h25UdcJY+%}e~-esXf$zcW2E+ur}#LrFJ8EBddbnFZ@&7a>t zyRLy4OE$@zMc%&vcJO zcix%u{3~asHdJ-`$-gr_^ZL>qd4D;u= z8Z-TooXkIO-=6c+x2JX8F#gBa-?re^PuuT$>Dj7JO2c^@|NAd{U(bEJsifh-%ywt< zOP{>wYEG~I1NwF0d#fVs*M;XTj>LP;M|`S19){{?l=Ra2UG@Z8ztf|y^5~~LdUrby zdV03Q*P`_oJv!UbOL}a6lg#{0mSj9lXMU%7^aT54N~foJ^z|P9%^uxq@(gQ|dc;cm z5;5X%=ZNz=?(&b#pHAm_o|abXO+4MDWMVMzHYTTc%2WH}M8OiRe<7+hzsYv~TY1)3 zYcpQDov!t#?di2X+M`>|;$hY4Gd<}}esubmp7etr{jf)O%3Dt#=gMDfd9^k3pJ`98 z^;5RL*5CE$P7Iws!!!LY9^I**+TST(tvg2^t#5HnKgpUmo1Mq0_GW%xccpWEe&x~Y zJ^AhK(O-Az&ayCwj$dlW)B1BBeXd6z@6qq@=xjftMaSD9D&`kE{|@Hz4Y$*^?!?#n zJUjndcTPUF-p7+(>Cq>+^w{|a%=u5W=O6IoualYX)aOo~^e$$4wmp3pPkL7~eT1Ff zRb7m{6hrTY!9Z_HKa%Ygb^~u)_ptOTtY-u5Hg;M2rZm$(sP40L#xU@vghH15E-FhVgrmpI9D;{5w;`00%IvLqF zb=KE5cKPe+x8nYR7Oj8e(r3oxuZLP}=~bA(z}xA3e~40r!9ec-jQ>a1^wd+VWnxbD z!+$z_aqHB~&#TZc0>jPDU%Jbm(;so^zl47e`0@bG{^?_M_b)WfX?M8WT+xA1-g6U)!gWJ80g3AAdmeE^?}7uJ1r6hb7K2 zn518VPr&}p+UHCBh(B5U{ip|0R%EermFMzc2H~=#^I!sTFIO(~49iZIX;~Hg=@>zH z%<*^A%<~67clwY!$r+ma;wRUvFbBfd=`WK19cppU*~cM135&0EB|EiKSm!b=3Df6Nc)q;CkG~}^JKBJD02sE zf6hjxC5z7xaNd>LXE=UxuhML;BYk&3HNxaC*7jB863yGm3;;3bRjQfAlxs1Qr5wmI z-%((H7$XSlOdfYCkUKEs4mD9#;YX$=%d{(LUxN{ZEcPaFt`&#J8-F=H(7zGO%~}^^ z@vorIFzv&2=Vt*xx?u>cHqm79?+H`x2yN#o3Gm?)ge*RNsarngva`ZM+{0BTPS?u-T49iXydm}jg+ZaK}VqXEyu}SA%`)EbqY#7AOlV1N+)2x!o5zTGL(==y+)2BNu z(`Lh-VcE%IFQ@+u?N1gv_cIxm-M!BlP5+yEmxDvhb%tqpHO_BqK|bROBSCOX}9(RWU=oD`)BF-9t5XzgMg65=P)?K zvXjMr6dc%Kx+}8Sd5=uiDOv0vfu)X-#eNzrb&M=_Ubm#*s^gQz&ikJkmYpni+!V9x z7+LJe;Jn#7PDlD!^^Gh(S+raAjV$&Yu&kqU`dIsOviOX0`Ancslb#n@e5TUJT930` zK4kG>zck`=Cw;8-NEV-^v|Hkt{xI!LlC7VqXuI^+*=`HrlPS zB8&ZLaQa+5FS6L517}!vvek;~|)6NAF}v7M<1)+?s55$#pj^Q=LmhQdP^3cKBBf?Sd>m-RLt-=d-8Fhb%t4 zuOsK5WU==F%lRi+?Cj%T&OgawA58!8dR}C)7t{YnZ6}Mpl>U~TEcSBxTjz~rv5%m? zWhaY$6#cF9MzYu|=x^D{VjmBdGMNaL{Qy~fZlT@U50J&a0G#_>y)1WtWj{a`ANJEN z`vJ1p?*YqxfGqa)V7Xo(i+uxFt{2E+-vsva!UD1doVQ3bpGl;D&tdUrKe`!~oh

    oVL}~(AM#lh%e|Fnyx1H#A0iGm}VYsXsJ7{8n`?W_QK_jt1d2!y`groH;%`K z)VmqNzPOq}d#AL+nME-;>xF{$I@nBGlW8vV^lz^9OldBwb+CoD7SmE&!@s4hW=cyB z&l@Q51xlQY5?9a?TY7kHNBG` z|F57|yEJuma^BRkI6XZMCIMNuPi zzZ^fOFc!_Yna5jbo2jzVr*&l_=(@4yJ>627<(#F^*h9+Ht_)pG#JZ8~IOj>_6m|z& zTsC@XUR(Gk-++6e==8F4v^xSCl+@OEibIf(UytSm?`WgGp zv?`U>t1VL zb|n0Fz90A+C@xh*?{zf#3$yqb-Lho)c~Ct#%cD;V4!k%cGW@9c~vgdd*`-dG9kbbe2cmgH1eq<~H$gJKfB~ z-M_hqXG$CJq>YF7jW*y*8-8VBZP@WWOUL#ybb}*#nx=5AZCt~?S;W7hz0$t9e?eA6 zIg`$qR-%FJ&Z@tb<<^yW4LxP^xtu0WK})c-x?F?Q&;!hJ?%y;A;cT(9Lmlz-oUbL* z&bZ?lSZ~}34LcyepduE5RWV?n?-9!R3a_4_7j- zO1PTfQcoH?@#U!4yavpOI$tkr98)mm=no$Uwtv3)+{&#>R>vRM^F`;`r0u)ojn>?G zG5TUdSL?$bhstNm7ul9hzWJ!ujwE|+-HMfB1}*Q^vPfV1R{hl8r^yqy&)Wx&Jhs1i zr!E6do_e<7Q(#wRTF?ipAA7V~w!Y^ozuEJCZuaJn-IuGoe0z1~Lc3E*zFxx)2H&-;9j7HoL+*$lf}s8u$M#{a}@)H{LHS6?rLh{^F`r z9~AcWx;Asg^pbzx4T$jnsh;z;KEIdk`FdTC$^M$&70azY)S}j~?3Nox9jo?p(2GqU z2W;$oOQv&c@UidaG0|_Q9Un9Ija8SL-S1rZoacS)f@kA)$-6>V&Az&QP{*2kD~$+x z=(KR?*8?{W)lafY>GHhvtl$N!MxFhTFPj~5&vo9CtUseCJj&`d@bbC++Ij;LtDo(7 zJ+gM@(If4Wa;A@bojHEoPXpSFs`cCGzxUthzWe#K&E<}|Z3_RPu*FXGwNB;lRBSk9 zK~LrI(B3}=Z4VoJ{r6E@Qop7wul&KT&iuFz5d&rieW@`2YSh$T6W{OIm~hr3zO&WM zTh(Uw5AVCtd&eU$+xok5Wa)Vm7oBZtx2A#D)R!KAuGwKF8@cyM*(pOZPFAk7Zv4)9 zuWVmF?-qG;h34|>6E^bw=TA2Zt(Lp?YeplV-aoH=)pxl(wU3+o4S%*_ z*yv?8`(j*rwyB=+A^UHe)_=E=Z|Qn>U+~;Mvv!Tn9V)lBITt&;hwHZr3qRE;+V^0= zbicskBQ7l+yX}6!KHKRtrroPBxY_t4Pybpm$)WwE0OtqqQ>z}ubR_o4=~~}9PdZdB z6}KsBP<*#9PTxK`r#0)>ddvB$P3kqT<=}iNEMmyo>Wc^WIbEZPPm2-`Bev`M-*evi zH2X}Y#dDV?AIR&jy5hES(AdtAl}lGFdsDa9;lOh5JFVQW2bQi>u8Na=NynEn4sWiv zd;M=^s{V4M|BDJ~Ta#?NJpJkK-&g%O{L4GWbJ>viH-EGXZ<#mv)8s}o0&9;s=8=D8 z_mj^NzutbKzR>VWL4Z2VMX|u$FEziETUw_YKb-l!_4_R!d`lg!y&}5G()yjR>}c?+ zWO}d1V-MasRYzYo>X*3RekwJ;!^idy!ra$?o|(J+dE1KpeyDrVT{-93)Q;T_Uut&x z;LL)RUl*QpY_j%E%E>hou6kYGlj+%Z^Pj8hw)pvWk8$%#jtn`zxXGsi@)V9b3KI zdNj;mGrvLOmEi{xyZzDh^OSN0X#rGs^={Ti(4`Qy*S9$GUq8xQ?BH8J6nqrZ=SM3q7F z{yNj^flEJSbWwZ7q6?~-O;?ndFz|hu%twk=(+hv8^>mNwXyY4|?>w2%etWAWXRZzG z`!b-0N^tKZ~*{F1^{LQ0388<5dgqK0N@4y zU!7zF_Q4FK#00LlRX z;Q+u+0H8boFa-b@4gdrJ0M`M4Q~;nd05Bf_7ytlN005=}0DAxc4*=jM0MH)*@CE>E z0RR~Qum}KH0|2}P0CoTXdjWtU06-l8U>*SQ8~|7W0Gt2-&I16|0Duet;Aa3}IRM}b z03-nb%>jT70Duhu&=Uao006WG0JZ=C!2rN606-1^!~y`{0Du|*zybi^H~=sf0N4ir zOalO#0RVpi0PO*Q2LQlP0D!K4EdbB~0N4ZobOQiB0Ra5~fT{pMEdU@40H_WCoCW|| z007$o06dzxcLo4h3IKEm09FD3kpMth0KfqNxB~zL0svJ207n2|GXU@#0B{5VNCN=6 z006%O0AB!rWdOh*06-o9&0|2)HfRX^fVgMi%0LTFV?gIeB0Dw0Dz^f(05Avu z=mh{M0RRO6FcScn003kH0Mh}0rvN}>0N@D#&008^}fYAWJRRCZK05AstPyqmO06-!D5C8zI0{}Dt zz-jfC&J=Kmb4s08|G6A_0IS0KjwrU_1cO1^^fh0CWccHUj{g z0Du+%Kqmm8ApoER0Dc4j#sUCa0D$EHKpg-e0s!~|07L-*?*V|b0Du($FdG2a2mp8i z0674_L;%1J0GJ8@tN{Q<0svD0fXV>CP5|H~0B{okcntvT2LM6=fUf{RZvdb#0B{2U zcmx1E1^}J`0LuUX7XTmw0I&f70|2rCfVlub9suA50CWZbDgpp|0RV3R;5q^5i0I~o81_00l0Ji~vg8)D(0I(YX7ykpG<_|J@+}H$(nUgZzI3`QIJ#KM(TX6Y_r-Yl2Kldn z{I`MpKMnbx3;Ev&@_!}dzZ~*^HRQh|zXRld1myo>$p0FU|0N**b&&r%A^$5u{wG8Jt04aeLH<{U z{J#nLe*p5o736qiK{ND=s{}l3n73BXr$p0ab|Lq|E2SfhP zfc!rO`M(?T|5wQW3y}W-kpBwE|5V8TG|2xmkpEjC{|`g{SAqP$0{LGO@_#Jke;vsG zUm*WWLH@Ug{9h0GzZ~+vALPF~&MLjJFX{9gn4e;M+>E#!Y)$p0RY z|05y)`#}D`h5Vlb`R@byKLzrC8RUN?yZCS z$p06R|NfBwKSKVOgZv)@`5y@Re;o4vHst?O$p0>o{|6!egCYNahWuwB|35SyApdVb{!f7XUjq5x7xKS6e{abD z5Xk>)kpJT#{|g}he}nvQ2Kk=@`Ck_D{}0H2FUbFIkpImg|Lq|EFGBu@LH>@ELrkr@71f{-HwmXUVPxd;G{i!a&CP2Qn|HG zx221x=g6ogO$JSF+t&ZhyLVRF0_V$&kXthfR)UBJ?sA5H*CY37HyAl(#W9Ohj zPX{kw{%LiuUT?>=Y}s{BQIYBgy}qzl?b;LnzICh3u=@2!D^gPztnJK8pgD*l_2`r%z?m0|WCGb?tf~T&e6^DlKh(Mo`en2OmDTSX)`y zeEspql;u5oJRjGpRlAzYmhJ7le*LYLJ$t?yx@y(eWIw+H^4YU9+RmG|x%$sP{}I=$ zS%(*I-dL;u_~Y8x-MbHNy?i+-pn7$+n~O_>JKw%l{POCR)1PO~M5mlM(WQKe5@kFU zipGZ?Kd!$&B;-cp1q)VAYuE0$Pq}itE}^7G`$Qzo=--Tp{e*rvThhu-t8 zP@&G@^E@IKz&lUvT2v(a(dH0{jb;DW#t|M%9Lrf?&{U?e+(OTv#g_ImCb+sHRiAD*IS19`u0m~(V|-!2ZyTjI(Gc4gpG|u zhZ;4aejPI8_OhIuq5ICBjS1Ye=~-@Q=-TFU=dN#sHmNr`t|$x>h){elMf%(EYN7SzMe24 zv;CGW4_xf*%E#{Ad;a;janm~0tQkAR$0xp7<;pesuU-2hVdu`n3-a@O9=m_vW5wTp zPr9F&xTHlA+qPrt`}Fx7{rm4lb<37*u?7H01ps~m0A>LIB>{ka0Kj$tpbr4h z0|1Z#0KWhLKL7v~0Dw>c;4T2L2mlBI0DcAl`~ZNd0Dvn1@CX1n3II3)0FMEH5dgp! z0N^12@FxK94gkmo00sj9IRHRq0ALFMFcJV51OWI009F7%cK~1r0Pq?BXaoS*0RTDx zAOQgA4FI$S07?J=y#N3W05A*y@B#o<007Paz%Bs59sp|E}09*wC&H(`T0f0^bz$gH~8vwWi0F(s) z@&JGf06<>=U_JnF5&&=k0Bit&6ae5k0MHHq*b4yM0svkC0AB%s0{}n<0I(SV_yYjw z003A60M`J3g8)Dh0H6i{8UO$l0RSfeAQ}MZ0sxc&02%`T^#Onz0KiHB;5Y!#902GK z0K5bMrT_r#0f0>az&!w<4gin^04xUp76JgL0e~L?fN%g{G61j<0MG&e1pq*80N^YD z&C6#)1P0B`^Rq5y!~0KiZHAO-+<1^}!D0M-Kl zs{w$f0Kg0Yz!v}r1ONsC0DAy{nE*f-0B{BXxDEj91OPq)0JZ=?O#omk0FVg)JOBX7 z0|4g%fN20gEC3J>0Mq~gUH|}x0f3$WfCm6D2>@6E08|G6{ssW9008L#KpFrr2LK2F z0CE9<4FJGJ06-1^FaSVl0ALjW5CQ;v002$_0CNF=0RTWP0N^(Opcw$5008s=fD!=s z9RP>}0Hy-~>i~e=0DwCHFb@E50{}V#0N((BaR9&s0AMx%@E!n21^~(d0G9!Ph5$f5 z0PrgSa0md{1^|o&07?M>#{huO06-A{&;kHZ0|1i%fUy9;L;&C=05A#why?)h0DuMn z00RJw008O$0AB%s3jn}I0ALINPyhf-0RWBy06zc#9|3@Y06=>H;5h)W82~s30IUQ6 zwgLc40D#p1Ks*3&007tn0DJ)ebO3-S0MG;gXbS+m0|1T#0F3~EH2}aJ0N@1xFd6{3 z2mmw$09*k8YXIOd0N?=t90CB!0|40ofE)l=1OV6q0HpzdWB}kM0PqL^s09G*005Ez z0DAyH3jovw04f3il>mSk0ALURup9vB1pu@J0Ez$rJpfP}0JsGJ)CT}k0f62Bz-a)0 zuKyuuA06;SU z;0*xq2LP}e0JsbQR0jZD0Dx}*z$*aY3;=Kf04MzXAYd z0D!9iz%T&75dioL0JshS_yPbe000L7pd$ca0|3+j0EPenIRL;}0ALdU5DEay1pu-D zfZG7TcmUuY0B{5VXbJ#C0|2uCfb#%AHvr%l03Zqg=m!A21^^xc02%;b0sycD0I&l9 z_5uLo0DzhRfDZsr830%d0PF++@&SPR0Kne>Kq3H84FKp20PF(*W&i*g06-i7&;|h5 z1ptHt0384T836DW0B`~TQ~*F@0H8kr@EZV-4geek0IC20O96lz0Kj_yU?Bid3IK=% z04@OlnE=3i0AMiyP!#}}3IIF+015$sz5sw10B{WemX8>Ru0MG{j_#FT!3jjd==R^L#hx~sE`TrL3{~P3g5#;|>$p5*J z|HC2wtswskA^-b9{@;WA-v#;K74rWvJgI^1n3Xe-+680g(TVApe^{{$GLo-wF9Y81jELfZ zKS2KXg8cs*@_!iQzXI}qE#&`i?D_`)ApiX!|8GJ5kB9u<4f%f#@_!cO{|Lzcc*y_x zkpBxI|F=Q@r$PSz4*8!4`QIJ#{|V%OI^_Q%$p3K2|5A|u8Ib=EApfl)|Gz^1FNgde z2l-zU^1n0W|4PXJp^*Q{kpFVX|F)3-)gk}mApc)L{;MJX$3p&Zh5QeI{C9)=zXSRI z1@iw-$o~|`|MHOko{;~CApiG6{x^pFp9cBw1NpCm{O=3-{~7Xs0_6V@$p5{N|Gtp_ zcOm}|K>k;N{9g+BzY6ld9prx>$p4m*|BjIVGa>&EL;jC~{P%+VUkCaB2jqWQ$p6id z|9?ULhe7@)LjIS5{GSK;Ujp*K1LXg&kpIgd|Mx-u2SWbmLjE_0{BH>Pe-`rpCFK8k z$p0CT|1psNmm&Wd$p7t-|4ShMJ3{_ng#6zG`Tq*?|0Lvp0p$N{$p7|`|1OaKv5^1I zA^$r;{ttotZwC3_AM!r|@_zy3|1rq_6_Ee;A^+Pz{%1q}t04bNLjF5L{$Gdup9J|o z8uI@*qiD{9gn4FN6Fa2>EXh`Ck$8 zUjzAn0rEc;^8Xa%{}jmo+K~T)ApfgE{!fJbUk~{o4f$WUm;K1|4VtWJ_NU*fr75p2 ze42Et`IN==zfEnF8Q3oO>Vso_CeHU=o8!^?X_qX=fRBf|+4-yp_qtSL$C$w@J4Vkq zT{Hgu+pzSAg=NpJ9&&uBX7{|PxDGwOJo)YNFxTMz>t_9&I_Kg>GV_nK4)1OckpHR= zvN=_^>g1^QOn{33b{~et)IU{n~WSKQrEK(O(C?jyo~vb+y0OE2r5WZn(X)%fMR6 zk3)v{{PC9xyE>JucW1&f-O(k_mS1n#b&L0#ZATvc-b&m1CsnyR)|2;+E%Lk(Sw`Kr zdWj$0-28)j*9!^^s8>^&_*5g1>D<@W+z~=L`%86gmyY;DCm{&CKoHgGD(R zBKPT453%{|Ipcsnz0HhnF|mo77H;gHzpWP;<3|6gBl|Z;*uSUdL+GD-*MyO975=bD z7-{D}GUxQ0Rs)o>xsyjdcyztPt*T3Fjwt_fUhRfUD!drHT0ZmSm*0;yt5+?y-+-YR zovt40BCmVk@~niQieE!y`)mLB>TQzu{R`Ss&7S-BvuU`!%#86*kL#8{9r~@o&WF|2 z(W^feG`+s#wbPYueNg+7)|Z+K%JX zXFqS*_L9$@dYj#pjXJ)+-|ADRBWr`2F4zCk_Qb6do0nC-Gs82f+K5%hw)<^Qp7~etr}be1=sG_ zZ8p65w(Ax1!Cd^_~-Men?uCmRRw(!uM_sLtFRV zetYz&gZpp#_$|wR(0X#I1YJ4rE%h?`SCwsAvUE@Erl75vJsTXU9K34C?NWC>9js8% zq1Usw%W4E&>%O?$<~sfp??yFsA&iyGT5e-&XYb%xqNJ0vv_Hm9?=h?F+}W}>t$JO~ z>vpl`0zY}xB_WUB2DW>*-hKF!;|;oKyxtBxJT82V%cX-wTZT#d<8#i8SzXlHN%r^4 zk%KPQ%&bL=9v*l*Ft+cK=&oA_u6Y@~%+0QUK~$S1n|gJ=wCSj~v_HB(x-!D=jAM%< zvqxU^?!Il-=#A}{r{9lx^6KZxgZD1TwPQTXR2lJV;{D#U2hF(WcRTgJ-5-QBp!=xd z!;q-me;w%4a^U3-m++<>{z%PrW@4?eKep{uF8w(TZ;9yjzO>7T>U%hKMQ7(f-QquPtZRZhYrD&HiNfR?_k^6Slp(>=f4P zh|8-w$#cfv34QN;1W$2B>>Xvo7YuUvZ9++kZ^n5K7R z%!nwB8~guX?G~LdLg=&jU9xsvN|jcWaV=Y}e1(dYDp#pm%`DA7#CNOi?qQZjU{KP} zcfuqnf&KyCgvf9=b(AV*gqz_HOS$H$LVfTD8tZHL zB=w`B#zfb{Uz8lFQ78H!h8tYZ=4I4ma*@s>6IRFUB$m-uZZVS6@yT|PQ~%OK9rk@dS7{am=RB)pWqP|AKdzdIkq zZv|+5=)0uchYP>vg9d*FeHoSgIFfmW_R>kqkXj_2Z$HXlh!>mR6hmxcNWW52erZW~ zzaT7bUr9DUC!?PWe>LV`lAJ>Q*$?W$klG|$6!s?mqHrBjP86=o=D$dgAMKBog0Q$g z&TM@4WhXWc7w%z<&xLyl!s7I$B4LDh{Az6ZHH>~PY-6lH7q*s!P33d`i<0yY1z~Y{)!Fh) z^NkC$4@lWGTsYL2o(r3{1upC-@Qd^JVDmR^_*{67F+La0kc3U`;rt^d{w{*BxV)Nd zc`-(RO;Q$PO$As@TnzEWZ`lcP#do@lX?UA~7t}_>_YG^Gwvi!9QVaeq_-f;sI7|?JhKf}|@qB-r6t%Z8=_?91VcVA}NKfnkha|jB61K*ea38MzE|PFXNqCqf zyj~LCCJFBqgpV1@K7axl(v-Lw!hUSH8C(CSg7~!lUWPW(Swq8R1>w8sAIjhIYh$v~Yaq;rN#!ZAo)O`?>lBk%5M`aejZ2APW1j z^_wrqpZ3pQNqCzid|eWLDhUTmc+o);9wG@R3&J)ie;3+9v!wjAGR{>PpqIsAFG;wz zB^yfCas+CQa1a|tJ zx6>l=rw-T;WwMI{_q`1LPEQu`sfeo{b>c(sP5JMG@ZAN!h^L?7xLjy~_=Mwfab~}g z82nR_b__oBJ6~=*zE?8X>37~vwR^=<_zynxJ8z$W@0AR8`kl8w#dnv|_zylWan&=F z`xf6_6x2!xy`SgnK)>^8>3t?&2l}12Q~l4^fqv)h4m7@@4)i;3Ux@E6w8QXOg717C zHsCv7F8$8O--7Rax%4}4-$COW@~7W<`)(TFV5i@CdphQp3*G4O@xsN=EBc*}(}LO` z;XnA$@4USozSk{Bt=zb{P=SRH9Sgn=(sAMIARU*ARAA#H9GA%mS2Eb?_y57(yMR|! zoNdFilI$deKsGE+CP+g95iv=T%}G2o!6cjlMGS~k1+qB^Mb02vwF$`%1PCCTlX!}p zRBElV6_mC%iJVF)rIdrUmIC6T*4I)hs8q>+-)q*h_sSxm?{|Iw^FW+dMQz{$z@2O$=|0yxFyiG}CAN-{r4h7b$C3^>K+iG^PYoNPa!A{KrP z^=+P5_;bMC4)_PTh|SB3aY!rFvm8gnqTdp6-c)KJA8g)^7F5~zk$NT;{a(PCXzGvE}PCl=mnmrM|l<~V0~vot;cEdEI> z`iFqUKZ%7ugX<+}M`Gb?U{3s&Sa_>`Y`?v%er*4|tbT0%vih<8^RoJ}`OE6Z_Rq`e z$L24qANwhNBKFtY4Lbp`>gUD?mi@Bo$L5{&^Rc6Th(#Y=i}Kn5FL4iTlih^*&j=R% zR8UzxHBZ+x&qlE5Fs-+@=2P*L)kkBxOXf`)b2o%%w70M3Zy~-}xf;{Ov-)YwUG?6sF)86k0ZW||i_N9L-hBLnu>6@e=0%aWz@k+m zu#}%z(y~v(T-ug&C+@HD3gSGCR}r&=f$%)#9jGzSL79UzK1P19#utbSHRdx1$(LC2 zO$5%g^X&rc9isK=;@%%>O#cx~f5;rB`R>GbXw0U~yi?;G{7C%}OI}ley~FVjG7Vdn zopuJW*qKK>0{q@Wpd{rJFz9twV;JX|1D4{Hcu@49$@o7TAx_>Gr*ZVfFK`Y zGe5PUg+=EaD6f4Jbpbew6$$wgn_Mpui$0&Vi+&qm=|hM`hxcyYhiL`J9q~gNTYdG{ z5iI(>sPhxe^IeOVjRxrlEPg^P`i0b)rFDh@XFaNMk%MR7p7ogK?*TUL2ZO|7hkd^I z8?o?HfW_a4g`YZsc-Yd!dFngRO=H9zZf{h=81)` z2F@(g`kR2gbY92{z~Vo|qW==G_z$u0uK|ny5DR|}*c;F`FHpz!A7asoib6eCXdUaE z@{b4>9X`(%pW(A?FFPK{6kwAMXk*czMIGCJ<^yLg)H)^9xBZ7$^cPXz_8&gy$gI@* zD}d$rB^Lcvz;gT&3%?Fn{Eb-n4Zz+7+9sbTWU(`VY<2K2lV76wZNTDh#A4?FaPm^E zLoECu;1ruD7XAqJtF%6`@b6IH=81*J<0F;1T+SsPmdn{eMTW=q~`DwMz3#9XiCKvz7dLtwSvQHeku?E$Y~Q zODsBjsAK!>0pQHl+Ri~>@mpfiKMX8>ODy~`VDVdG;ZFd2dEp5;4V<-BW4>?kuG9Dv z@;r$_J_8oNB^EpJF(}UyT8CKpMBo&gCl=mI{qwZoB^JIKSbS*{aOShR%&$=Y-w`bOJHcmFYkrqQhgft@ zkpDvK5DWhyu;g`)I=0^ui_S&r*nW#g(kk;gZ6^v?{FYes`A$UqmRR@%VDVdG;adWG zH)xw}fU`Dg%=c`Vj@yzB)X-w!zR1+AY4EPhKYIs<^kZ;6F31opnD(+&d`za=&YssEDJCl>xO>f1cA@H=CXukFvo!q)+d zkL@G=xwd&2IQiuW7X4%3Q*54C_)mbv|A~c)XKa2XWYkgwj=TYD0iG_cd`rEZWvG9*k z-{y&hUqJmGTAx_>3hLWDvG9wj|Ay8l7JeD^ZJt>8^}v}swfyt7X42h`d?G$-&%)QbXvxP|6KFL!Y2buUK!M}eV$l!x>4sXowmCJ_W%~3Cl>ua zz~b}7!ruZcK2I!s9&pxgw0*v3&$N%PLBQTOH9w4ejmAa5;`78}=RWeEXdPnV?+4DR z)%-NzOdHPtPOj5DvFOhMPO*7n;pYQO`H6+EApfzpLoECO;H(EVKYeD2QEK30PU8t< zz43;z!`NbMHntlID;fJ|JfyN`O&>pQ&baJxSSo$agxPb(%*T4WT&4Z82>+Z}jYmwM zSZqafnyrjD~HfO@DY2&71k>uIo<=eka z58oTjdT0hSbnO(&-WbnfHpcrW7UMf3D+&X=xmfY#Hd#@ux-oO7O}^qjQfcy4;;lF| z#q0@<{8B5s|IiUxSd!cSW0lPz z^kc@2ACI-lCn>D!K5fp#@S5l0CAJ@)Fl+kchbLUAq^$LcvnE_I-iqrq{%Xn5AUF!> zc~{bEpyBqnV!xf#6*0kId^MXaxNVo;&Nbri`oOWurZrp{_>ps?5zP52HtohO_VXCd zzGBu|4GwsvvS|fmrn2EmbH?%ap$DvA`=A_tCll*p7dY_n+kZF|4#;HLH(lL49KFxC zYTy7Cb79asoU?!SoEv*-f6wmTBTNr3@`Z5$F%O9B?gUoBBC*4Zx;r!@m<<%}NN3FP zT_MJA#b~1umElD<@` z?IojfIsQyU?C}=GX)k_k#9nJVj`sM>$Z4-D3f~L7h}g@8p3`2Jagq9K3uVU9-X&N4 zjfK4h%)l10_m!*u9)Z1h=&?Pn!6x?J2gl^Hi>F&E#qn|?0#886S-$dOJuZg!Qm~1= zy#P*o*{F;?Vhq1xuMT=nd+Ypomw0(g$E(nXz2IVoAUMBRc zgjQ?>?!)orv}cWH5+l$RxXi7W;fQp=o7{R`9gz;0 zY{Xu^Td!~9dMR$b+ZxxKg*+P6Uq9%PutngTwmlY~l6gD64baf~Pd#oYah&s4+V^AV zb+a_|Ke5O65l+2!d5!Dsb?FVbg5D69-ux@*y^Tzr`Mvhy*HrOSUq=i+57kk zdedF@+V$7Rzb;+G6>+QIAm2{V8!Jk79D_f${YCbp{0e$^xb)6kL62_k+~2$bjprML zl2dOJ^j5GywlI$JS8Ptb9s?WKyU}HD7xWsd=PtIM#C;CE@m5ayAM@hI_qF^L8O09L zAri;;$#Cfz5=A{!O;|*a?`oq9>p6m>gps>&{fsW!>US9yy(#chX$$hzuy+y{LX7_a z8=@^g#qGqj$=Uww>BUpNp9<;5f3|3>|M%+A!(w}P6OFM6Kg};JFbv6&w*MW@ALi8~ zh+?e1cJHF%8Tudm{rm0QDO>pcdyWLG-)Pk^3`e&gPemT_@SFSw&qJ>IbOKKh?B==b zX177kR|^bAB>XBYsb~URx`&1BL*XyCSOy?hy5EXJ9QDNSsn?j_r`dY=v1FY9`&aVy zBJA{g>NV!~JP$ejp8G*zc_?DI+DeZ8!n|J(cf99(nqIFtT93!%GbRvg=KWXs|GhYlV*eBjvr zclVvxb9&c@b)VD(u_EBsO20aW^=6gVueR_PYfEpz3g;fIu85To_jbnWiak~IzI?2z zI0CCIPEgUi=Gv<#hE8w6y69Nna8CeQtC4CmQoN3J(d%N0V>ZO~;|hmZH!*){=;Pzi z*p2i@)!kLrnvHv8g~QXae_rOBbSG9fjIq{5H=7v7UzY{rRAS$njJmG7dhLnY7qvg? zK-5A1*bB&`wNbXGvk|?wr%|>S>tlQBVvFPMtt#7_Zu%4pc@C&uJ1 zA5nGha_p;@tF8OJ$6#YMY;1;&*I^^zu(2C9j#@T8z}mp)Z5yXOf36x)_1CJd2eJ>E zF|l8U*ZV9Qugnoe>PAm`$&1Py*-4FDvpA5jcu-(}ctt?7S4?~$rr&_W15Wpwb$f3- zcru$eS3A(*2Fs$=4upftnk!#SP0oa+W}7?}?9mCUSdUy2idm7u(2`|p%QL}M)LLYi#};AL@-pL8NrzRwMQ^KT)@%vx zKqnn6k5OrH8{*PD8$9F6PL+)-Jyn{qcFS5{)h6XDdkw2-CZgrB;(8ue@@|T`K|&uN zRcSGysk>C7H+okTRLaRAe=xh%E zfcDU4Xq{--i$)4F7-Q7M)h-X33(-b*SD9^NjnmE3Vnb)%F?}h zAAX_o-TrU2AA zU{z1wmoY}LsKS`LG&Fsc3bv{+d_xbaxy#aGegD{{f=3pr(7unAd1Rq+e(5*MLUrfV z>9`HCz7LxlzDfVVvGmtvp}q4}?J{4%+bGXn>etJ5DTxUTG4^hY0+pkK;2s!dPM#qGl~iq;gx-hE-<#6iaf6%5`! zIHPb)VeF6zSXtX>k#;cSz@Ys@_YL1Oa@Xj(`)Z!bE!&W>MXIK%uCj*Ckdlgwum4D-*6jo|G6 zBn7W&idI-+m~*~JI`{0kXU+xFo-vCS8vTO(p715CQ)%nWRyd-LEHHv2mg5+yG|VyO zMrgr06d#{c$6sCo{5CD_bWG@dcwUACSXBI2-*?C4x%wss_<`o#B{I{&5BeC{CzuaZ!DjdC^_cubjk^kdmUc+NA{> zV)B>fE(@Ut5A7bIUad;peV_nq_)dHu{l+ol*Hs~$MP98c+&wGrbl&iRbpyK(+Ayf) z;01#{@Imv-3q~+rMVTi?s@h`H*G`2N#pedwWUFm!$~MNL9;41aYKG>UM(}W%GXGR& z_`W!7go-CAGf4a=BQ4H1>3!v!be9T7d5mCO2W4LBt%7Y~VeM15`^-3_Y@RKts9#`Wn8_)#nz~c_EAQ&}Jnd=6q zP(_rnXJN2)f!e?NkDgu&+my%O9+MMa6Z3Y9m=G~O!!VCTV>RUq%3Kp|_@-bVp8)^)bQQWV68>-m?F)Z<@HVV)eB1~g z!x=g$H0ke#??O-bL=U4Dtqv|WcNte#4(jZ--esZNcc`B)wMx%(oelZE2UZnoKtQKdKJ;v_kN2@}6(2Bd?Qt4ff zUP{lLdnrA8_oc+zT(p(PF!Imk6z3hz>o;)Qz_da1yPIalo=AHyw*iSROkc0>WwQHGdf!NrtCH3YQ}da!;qeN_j35gvgT*ar1~Vw zGq(KUQuOml^<|rWSRcK4dHw5EzW)7<&P#8t3SKy$WL=A_52)a~0mHhoX^+0Q{X%8l zyU++e`gu~YHO`sday72ReDHkInl-0NPLMtCykxu8l&U_du@`I#Xl>-(85+(*L5& zzo73b{8X7w<9F}ZD)e=4!#AkEVSaHwiFx?u9yLM_Y*OZG5B7YGV%?l74Smtq*pS#^ zEv_aPtY01aXp-R@|1_?bGL7hgacb7;HEYWDdsOXm->zTc2u((tpqBT?s?E!TbKnOl zF^1V5{m4D#hWRMY?$^RkybIO1vS(JAN0u1DA1yW3KV^RXMN(Q*-{c#xA92R%gnkLW zDWeT@^+I*3ti#j6qgCirN{r;SW&2~)tW|5CEIW{>Iy_~axl7ltjUL=gokKZz^=kRn z?{G#gOjPGqwOMUlqoUpEdDeM1-=lmF3^YzBn#nkG#nd%5pIC_Ape{BvsR(DzC*g(t zJid=6pk)i_3pk6G<61HF!F9OTIj;O?<8kfX4F1y0c&;?KYN0Ym2b6ht0Bx55pE-_N zOE5zJsKE7TPxLz0oMVbEL)miMacy12B~Uy`7V!9&Z<)`Qj1)w!N6fk71;Dx&woulmQTTbHMoe5eAk zp4foLzha9T9@r2_3tv;`77RjI&g-=?xiPiLo~B&I-l(QsGp30Vy?YmWrz5zIJOfYt z9Cz>KxO-oP>&Z>%yJDxvQ`6k|ptDQLO?)_+0c1_p1zPq~b86MaY7#c43 z(7^scbODbXj|zBtE=yOtl?VG5P>TcHr^p`FCf7Ex_9uVau(YC;MNxO38(2K(@SuK! z^U(qguW&}zjjricS<>&<1^%-YxF*R#J=ZOMtGw^xt(B#b^pgEd zU9#DkIzK(NQaR7?D+fhcSC^Oj$bEZ?cfDL*c0;WCb-w@XTtn|g_sY_mev5Bgva_;R z`PRjrLjQ`UY9v}dQlq!#hdi6Ca(H5c^DZQ%m+V%hr-Po>>e1HzvA@DOs;LSE9>Q}B zkNT#Sr)gGIy4tEd34x};|NKXlo-|O#hYWWeZyTIe$a?NPGd;USyY$S`cIjOoZGRlJCT&M6R}D=xU+3w$zPIa9cPK^oA$W(i>ZzAV~QN3 z`ucq5{sytXa(5{E+q-ktEjuPmp5J@T=GS%{J9XB*|7NrECxcb5Z!(+CyFa+3S0?lA zjTacE$D<-8WG!TbJ$Xvqv|Xe3+_!H)e9$w@W8zVal;QbutJ z!S7V73+kj^kEl_2-jHjYcJ1l@u+M$By1i1q4eOTqvUVlc()|6dd{18`U!w+nSxq4E z(N{O@fA;ak_0vv1@amug&ve|ETHoc>qyN13^ecZ^+56g#8GoM<-D&OIn2&$k-2cdf zKRNf~>ASlblWw?l{Acs_FZk`F7w_(W_UA`7{NkxivubvH6U^xKgD(#B*!;o2X1;S{ z>zKXiZ?{|HSs&N3co9bv6xlggn_Z0?y39JOT~|`KJ(B=`+7f6b#&;9 zQ%8RO$%Kbrj^8=Ib9VbJukHExuXDaP_}5Do&$#XNi36f9G#}UVt~V=cuYKm!m+M+g z{`0a`Pj*=N_k$z4{B7xTmCb(hVZZxxpU6sjrRbM!P7f{mdR5(^1I5jz6x=do$sg~# zIR1C9t$pi;Up<%|{ikd0uDv!k_s1j7J~8=|r`o;j|Jz5uRI?}kXH8+?Oy4H?Ta!NX z{v+$BpI`sdAAbIL)%<;{zxw{c-^V|^sLwrRUAy%E%Nu)xn_Avkzp(j@y*iE>U@YrB zr~CfDzq;dRiN|-1?3WR@ZtS18zu6+^)6}KEuKsO#%)s=2{cza#%=g}@dFHP7-~P#j zo1>QB_HpNxAGH4KH*H`1&5`ww?Y?Q!rFl=^{`{#!=kGt4(qo2aTH2sn9(b2>IJ?^|fOfHg>)C zKiiL`?y4%CaK7?)Pd~WluG>epJ(80=q{ct>{T=(pPq}kzpLL0!KlxujO`G?NzxHi9 zYSNko#`^??+VhdTZS9FMrv5!GOu@PxgQ2o|wTsT0fNW{E6#dUU|Iy z?}vBZ`|sVa{ASb5GxG{=`1&8yk6vhX>5&;3?G=Q7wj3I+6CV^aKRoIi|+*-thIj6WxB$;bh&)b<+?WO(#5Jijp*8} zt=n+L9`}kbm#rGnBF&dKV&a2~p4j@!1AqOj{&>6p9Q)b$!r4#1IOgUL^V`nP$a|`t z=Pw^^?Y!y!gBg9FdFZPfj_-YTNA~w`SYA@QHmlRu%9Y+7PU?_#%iz(I=P$(d+S`Xu zo#i4YTOs`YC4|2RApHF+gsYk`p1+JAc&y#nR|hunKK0LLX)k7!_PF@BXSdyW$KS_~ z**Vu(@|V_qUibCz5B|-gg-2fRJ;N89*!mYA{vmzs;5%=b)OA7e_)q4K8T!MY&TqE& z-~T$f28)KIR~&8i_qRWqb@z#te{B&}|Fih19ftQ^Tr%auj{h3*&EcwF^*HsjpFG*` z_O9=2`{$d}(qH{S!ZdUXfujkBqIO>}-uhtR4_Ykgo%+Ge&mU{ur$_87&n9>_sG3JQ ze%L!Hx9`1XXSHQPz<6ZbYd!Yv*uN&Q**mkM!;rzbGrzdzhR+8UtvWn=-1Xy=?isT1 z#SP}f!c_zMKQiq=s(E+S+KH>P-g&!XdE57=U6}sP;Eb~Vo>$J*oE}v*=%-E8nx5yD zym{-=8^4_KX@{nNiN9gu#hk1^*G0Y6Eiu3CAJ@D(r0~>B_dfcur}{VT@7h;1Ecrsx zbFJ2%-k5*QiRVT>^Y{m^A9(ru|NhN$zgasbf9B^)PCY)ZXTjU?#rM2$Y2;Ja?0op& z^Ae{0@!;owd?MqvC!RjhDn9F%&yQ^S(55}FjeKLqqX*}HZ(Y&976t#-Eoy4_H4|I4 z?bvq76E)BMYunk$Ih}v-lWvu#H#UD^%Eo=m@6I_p`uJzL$Ibq~oHg$K0sm6}gGWUv z^|)ie4aY@s>|R8o)th)?5gAXU!%I03#}XYLDg$`%WP@YjC>&#CV6=Fd9aj!MN_kWT z>{$ZdQ0>+D2H|Vf+y>zkwYEVx*(#56kK$a5upYbDLEVXP8-%$Ts)PEWZBN3M z|07OITWkNyC5U;C8Q%#{2b}TmNYIXNA8tRbpX~}q+E>T-am1gqZLtmwd`)nJ9Zt2v zX==3{*8AVdD$g26dX}%;5za+86KS0L7jGZ)3g!Ji;@SSr_!*9P%bqJd#}$rzGu76b z=a5Cz<ZKcb1 zo%#jh)&*SW%7T;Z;&hwWQ0p-ni?I=_JsVVUl-<9`LdCC)D!?eHelIpmIh#kGJf#z&=NWI_K^98eq<=KF(Hn!3wul`1H?`6;}Rj9czf_ zG3sj_25B$SSLpcVuJ}~wcx``Yzbv>LvF)e(iESTij`V_u11H;qpowM9gOR`~Hcu@4 zJYdrvgiI{_Qee(OK_M1?1#pVZ6AQnJ`gp!bAr^ie^=+P5_@}6!p!JD`ucp4u6AMqD z;J1VnV&VG$r`SBP@MlqfvR}l)cR>A_{6G^zEPQtdPb@sYKNNjp;YT@mV&TUFd+{8V z!f%x%EwSj7khf2A#KJEI&ay9L*zU5w#G=FVfb1`^@bnF-Ph#PDT_*KOEIiNO(q6>E z-$H%6y@-W>iTZZC6AS+e^=+P5`0c=6d{0O5VlyAMpoK-J9pg;RrxLf)xR98gH)Iqx znV0=OVq0eme8bz88hQ;lsjCeLi+x@*NnH^O|1z-D6|wN!sBilovG6;oZ|@_q@NZGy z=81*hLw&mriG}AeD|JgO{O9mbZ!!qT1^NI#FoncoGkR%kD=Ni1o*vmIF|$Su^d?Gua6AnJ71I+o9{;E+^oS=SRO)fHPN|M8cb zebLpOIE$>FvtP>47h$nK9@xu7ko&P^*=f0tVrK^N_wf%hADh@A7CRe&z1jE&>4439 zqXn%x&tgF!RypkieGvBcv}o)4O>Fi9B{uH^&a`zVQoonhUqqe*gUcD%YdbQiG}C2koX(1@Y~7T z=K^Bk50Ed_`4S8N9(lXniG@D{Ebaa=aiLE88TD;HBo_S(z{x|j4zchTfm3XrSa>{u z3hx)O@Xg8FeoHJo=dG9hA{PEO@})XoV&R99xA%)!_>sV}U-u9X)oF{VZ|@he=yN_} znHPT=aMm!b&--TY9U4DIJV@gO)ETI81+e%tvDjP#oIG6X5DUK^IK}3Pg@1f3%xEc{OD+dQ%GZ&Ba&TVmnssBiPc!XE?n-l@y~E^zXQ2o{|aOl$MR z!k+;aec+-lvwy`@?|<-V&PvQZ~HT` z@NWRie*KD=CuB$+^=*G97XAIevSz{o;H=SFpU+t`f28qyz_RwjN$T9G`7^-c&%|Pr z*QLq#XdPnVzXVRPd1B$eroQdB#KQAgwfHl!@G-#R&&0yVQ{VPyV&N01Z~HB=@VqA$ zexT*3SeMKOq*KzT|B`Ar`)f zyzM8%!p|UIu5A(vUqasY6Jp^P0cYlDecnIHdK4?DZ~FQek*yqoW#QK zB5#+ISoo9V%XPlQ!k;B?my=ldFM*|;UjuuKb=oLA!;o?ki+%zyKB}~Ya}s5Z*O<>a zyc0C;Ks;9CH0s!GkwJc<=DPwXPl{l%pAA06=81*x4lLy%7CwjkPqZCk;mgU}*EYn$ zF9Xi9%WzZQKK%z248P~HIVJHet2Gzejbk|bT!UF9C8~RP>c|Ll)rlji=A1dwp8rl# z>#Uq}I!a7;*L04T&yYyXMki#9m~cn$N zmsHQRr>A2KYmB4uiPOi-pMLoij8~n@;D2SNMJq2(v)GAKDe8vEE*yh7Ag9fq6PfCh zYLUqjvu8CvxnM)BEAI8T%#KJacExZiLjslMh-`3WjGP>?tV-t~BkSRf@^8BU1)i#Oz`hF?n`mYCu~fLdevC|BF)u zDqe%(^cR+rzPRUe5V%~ngtrC6u{!8@$E*pMu_PP7t@jf8P!Z9)9)NU?9q~dJgu!JZ z%Tf? zv#>n0ha_Qpcew1O#={;nutn@~o;9bv`LH(@I<(gW8{=sIX_vkC5XpB1B4Tfy%icS% z_YRb3uPHXM_bRY+e@iegO>=M}V(%po&hotiL+!xP9v?xAy;Csew6_fQyoeVOd%TZx z+S><1ouEW}ND{WkcY98I&mfZbxguhZb0|6OeF{UezkGBn<@=}0UKAp0#29|X-X|`5 zyYSrY1;n#_CN{Chb#R^KtAjo2iHNY2Q2S zG&%UCyaRjHXjt0gqhzu7wOu|b$JdDL#ss!dkFp#G74sFnOg1hFTLeDf*5mVCiFCln z+!Ds0YtAHG7qpSbk4LT`m- zS^txKV*s4?`gUks?~u#h{wwHhwDqJeMt`sIxrd&y^OYjK1wE%o`ECV3)y$AM>h+fZ zenszP>N)1znve4l+njz+5j{Q&kTxS9pNiuHij3#20sY>KZQSf>H_jM0YqrckBr|HI zLK>TMtB+LdpXV|`Ob(Qb+^UCL`&I!)*TWHj zb#X^AGs;~^=bO~d`15k3+Ok^G(kScS78b9At;ZWpUl+Tsr+s)!560 zALRIloke-Dhbt~9Ph2|;Zr5MSnI3f!U(k6@ezl+^w?*upv|X6pr93`2RIwRp4ykSB z{30t*z!_RRp7@%CinQ=o4aTXc{6N0n`#NTkNX+54SH4~~YDG=JlUQR^(=z{`{AycH zTHeaMT!Z=4d}UN`t7uXn`AeSop30GH8S>OQE<%nOjvN={(?)6Sik!08SgXBC>jDLh z=Z5d(Td$}ot)-?XwzMv|1+BZMje4|Ai~jzxJ8(a_yWZFPB)$$Wt>brBG0@t!x~$+r zeVS)Q&4?;bYYvBaG212gbt;aYg%M-T;Ppr2l4d3-etQx1H zGny!?1?m!WOwWb-^wbxvuhO0_NRRq0zHr@xShhu^eWC`kh1hoKo!&&bvRB8~;9Jk0 z{Bq5lyBWGy{uZ8Xmt9_2#d39DT88g$O?(*>Y$9YMlHO#I?qVo(8EaI)XB)Rj@GeXiRa1O2MukGtlPRc9v)a(g)av! z58PHMEzMT$Rq64hS8r7b6(iw`QaYoyYdO3u=Hypt0jK?y*6a$=n-f&!Qva|Om^a0v zq6Vc`zp4Dgatwy9DPSsE?z-Nr7>M47)<@#2(Xj1POkcKnpi1BLqRL*)c)!AoQ%J3~ z(^KC>oegX(RcEB?B&mG)`G)Q3bLi=>=10DLHS)A?MAh(Hrp4hSm%ZOge9!lKy{~7r z)$`4)3iW(N4XNV!!kimGzh||K-RkhGa4QTLAo~!+Zl?vb4@jRFIqqX}OKZB8FD+b@ zmsley_Jz|%`o)->Qp=BYFDrhghDaK>pRt!8RAba`E6;|X49M|&SF89u=U0qIttvE5 z;v2O*UAmQdx_|heJR#kC#oLd+!|^Y;;#WGt4a?KaRlX#ve1&0s9gdVohwaxm z&`NTpZ(*gkAFU!@ha>f+!?VKnTe#AjR{GK5cpZ-HpAJ9bijR~>$1iimzv~J|>O<=v zbi_BTADp-0&yn`g;fR0eaKt}ayY{E8l^(Zjw&*ZUMB#A5{H{@4Yke>!}t`- zUbdyde>$Aw3g3*WoU%aHK!GPQ4cu zjs&>g6}~~8wWB}8FUQAb*!p-phpU>asnI2!wzqdzO|~geo46nTT84?!1uuvwrNY%Q59PurL_HYb)6m7<>{=(+WI>FI%_{{ z6{~y+2zYHBwwsqXzL0*{WG#yU#C&K88H!Exd7KKK2ApL($}IAHC<&R5O>`DG@C(4A z|FVPM>EP=e{2B80bFNtOd`Jmtj!nj(wgEQpB&)~6`!uxn(@RANecQ_ih>$MWM4wpn z>7SWwJP40H8QaNzJj>>XJ23la;aPpAiGL7cv1!#UALK!jvB{Xv3}7h(vFK+5XST&Z z2+JUt?I>eG*+$lLIQ$l1ld+UmIqkH?)ZsHT$P{du%p791i>*_Eu-LB#_Szl57T_#f zhixSIs{3d^zoGwmQ}GYNV^#K%SoX0yu#C^7f17vXAB0$R1_5VvB&)~u32uk5jKfSL z?nDiJtt5G|9mP%`;LLPtXx|n*3Sk*-PnmVNuc;&JDtvp`tSk{7Y$#dA&O z_4o&&{VZF*9N3HJ>=ets%`Zb(#$;9#+x%8wu}>`aw*kxe&+XKwvq0X$Cinob=o}-D z=hKw;ut|C7%3f9ygiS7EIGMfVODy?PHIt17vFg*tc?b*7dXVv-!yOnfJccs?*u0O7 z!rUbh`>lXw{3pwk+#CNO#8QS-;1ruD7M^7@e}sP!V&UoTnKzMDDixbK7XKir*hD82 zII}PQL3n&+-E2W!C%050W zJ-imz!}tqJGjw7L90a;dOZbkJI93O*IHuu~M)W?k)9@$C#vkA}23w9D-qc+8`8;(q zd&aS!O+^A{z8s_86}*VpO961&8-?p$o*QY8m(pVI2Bde|%R|8K<}8z9kKZyo?Ja`6 zskS}d9*Dh4V5hy85Ma4Q#9lcFr@hZ%uN^p+kGBtE??qszy*Che1)PZ3+XTXCFVU;i z0dTa(+Xb=5do8EE`(dE5@_C@-wD%6|N%@*N>~a5`_BbY?81W)fzUN)`&cdG5A8$#d zdm9M&Gq=gT;}4Z9PB_ zghj+&7W9}V$BsAxd#o4Q>xfP4-2?2jcM$d(Ymd9^G&%UCbb*tM#V_rpV-tI{?X;JO z&ZjYdX>X^=!7pVI?1{g0Mp*2PcI|Ih*lVnOBV7CY2JFfHUgxm)HZaS_yeRj>-gphI z|BU0tZ>9MwasYZxk+=gOk@XCTqh5ar;8*mTp<$e39};oiVjSy_B6^)+Oxloqt9Xp{ zK$|fBPHe0fFE*Y^ADlHAYjW!~$G&y!Lr;6*vF|YUp&M?@n4k75J@z3Odp6F0a*t}2 z8wza4oBmfYHzmgzoK4cKZ{hZw%6xwg-;!UbZ&$l<`JPLya?Mz8JhVo}8l|UOBr`Tk)$ID;SGSTFqcbl%)x?1lPPuoqj;Qs=}+%9M>!9Fe^a1}@YmT6^co z=lF!2@HhyJNT_I+ONL_wLLQX;WB_A97UnFf+vb?{RNmgX-@)SDT6x#S-NSDy%Q|Bo z;3lvJE5VyutF2G?0)ZU=Sj-?D=$V_Ix)blkBlF1Oy=mp325(F`9$-<99&Zs1TV)=M zkvQZ*$zTQT7xbLRTmGGDW0L1mpb6(Ej#%^OV2)p;@l{Z_1|#*)*AHD?S&*K(Uu|4| z^pe@6wKA%^R_Hdh_IcPz-STxCm&aae)la;{M195Awa(wTe9NUKs4?d|;;ohOxz-+z zeO+zG-iJJ|qt1>hPgQ#Li)x$W-MPOeMh!&?BeSMjCEVPkK?yTfKT(ig{aZ%~Gb&Na z2KCZ#l*CT!eWvkt8s;@#3y=S(L@8R{x{6H0+!Awq6`gaXHZoRYj7_w+hPC1G7}bbf z*jcx}RTJmy+ab<#N%MYkf%En8HLQuvmn!j&n6;)yy688h^qx@M4vY~%n`88i*{hAB zmp|I(sXF@kx_-V`_!L_s_KW%zb)EvvTAqgXG(BI`FS0b7p`I%n8Fj+dBzje5V^(Dk z=3&kGDjM|{^5kQmY;VBZ^o>coFLkW&#Q1Y+6yq(gslmI&Rz~&Zx}Hm%l{qr6b);2j zRr^gE-m|k!I@bqd=rvo*GcNPf7q3v-t{6cOkdCGjZr}D+&_?+<^a0|0BJ@@YPiXD=hCfn{;Mh(BLRb8>Gi;IQQaz|Iz;VcRJdgWnfKWF7C>0=xJ5% z%ZrT~8Ow0Y;Wvggmcf(Hu@=%Ra9m0rM#e-&s>JUyYMrUlyYw*pB~6qkKQa&PfPF?S z``-8i>8XoRON@`l_`jZpQww97$|EB@XeV!Q9x!0PqaBQDhhEnhSd7n;5;{hW zVGPFQV`u&+kHk>wZd@0Ma4beg30S|;>KVl2lFAkxeocb7LSy_{S2%JVuH&b<;$L=! zce=tC9pQ%M@mTrsepHLcy5^P;zcOHXAuc_{`<2K+lR$ zI8wjYxYDP%!q>XO-*bgKTKVOL?dx!cD;%jm9Up0b9q!}MZ@7Qymi=wvcpZ-HpANs` zh;Nv_vz0!wzd9W8Cmo&@PT$$Jf7e;*BjwZK$bF;^_Xwxg;fVk1@Htof$F6XRD}2Hg z-tGz?bcH{6g!{vvBXYfJ7`{PWup=+wmt!T)+BbRJCytfaW5;u!TcSUR_^!U+d)&|p zHCB8R73av$3(k(Vlo-CxCRj(Di>#ZiUv7n)si38))EXgw`0uH|*!D(R`W;os4znIw;)y~N zTVI#AvnsL6&v#-iF_Pj8^hCJ7{I*_%;dZWY3^*C*hJ?gV9Dzh@_djAc>`M(D;5%qO~y=cKV)n~I|pXj z%whNkA@*5Fpa0C^I?%?!Tl+#|5c-4H#(BWPjdwRL7a8Vz-t@S4NRM3CXwvh1|?0gKKo2QH@$AC^I^x=OX6)$U#!TQ+UX!^TY0I>b^2QZkmp zs;f>~ryqGb2!!>Mb)5zESRy`%gN(-}`$a4^S#L5P!t!}re;N2J8?y|Jm4|gG<1MVR z*<&wQSJJ-3k{6Fb8HbTa9oyfCMW>KD_5-z1#J0_8z%rK>>sD|qusIt4AjD$lzsobd zjIm(T3TCy++*p~!cBk46IE#${xeZ&Uow2oFV=P)Z_iHF9)8>h#oK~OEN9)tyyf(J{ z!5&w^Hj?@zmb4Y*?K&hDo^9u4Wkc3s6PqssXW90xW0RRcQn7h$oDD2_5sOXB-|Vpz zIn=T9B^Dj)*kolutYg!*$ueiz*g7_C+#Y;p4*o$>v3cpp5bGE$j$pA*U&_2)^DIwh zuExyL^hdDh7f^?d02zi&bcjWVt|Q|u#!`ookg?cAhvoOu7-SAMu|q66j{(aVi^afM ztPIFfY%;IYN@AN|4=i?w#m)v`Df0`|8IOMuV$s&35 zu!&7#(RmM8bWS>Sh(+fU2Tv?~gP|AJ18o_5!C?zC^bm|W6XrJ<0MX!mvQE_45D6Xg z-3Ccq={>);fpG!T@v!~=2gXbuKVjOO$rC3}Xnev4zJJ$AW{rDrO!3@_6QTGm12DAy z)rMebjjImA&?;9QhM`sT@Qd#_vO*`h+Sm#^Um4wT#kc-;=GJ(b;_s+E-9HCoPxP>n zZ!v65i!rWvD#lS*qfEX<-S&y^q&s)c#6I86>f~`f!-`X<&U;|Yxbfp>&7O=QC07`@ zqALZ3X>b(Gp8W8HFmct99y$>TY*ha41+Q65%&Hs-$A4>V#spk*<1Z{r+bFEr7!HQ-Q96M#u*KR@Jt8U=in7CJ@$1&R$dEx+Bm5yolKQ0KjSQDGUH$dfM|~6MHqlPJ6=;uuqYQ ziM+@AC9u=p3$WJ>9PRN|LhLO;dZ#_k(^rFd5h-5Sil;-u8&Sdr<&q`8Y2Z>t004Hwu7ha_oq5*eeHS`J7`jDqZ$E;o!lc z85Xg}IbWRi;!$Z*f6lQP?)hgpFIHpr-1E<*I_x>eW`tbj!;8O0?Y-=~Zxih8X~f0gPPhaj?^A+gl!F9H0D-feP;X+Y}^lYb*gyW>3+Nmp41tt@zrQ2)=jC|R%yK5cX8Ls-mh=nYIg)M@l=-99>Y*n_ul9MK&*7KI zqgR_FKQN5CM@Qi6-Td_GCd#Nz@L2DkX5hX2Vk56vzJJD6wSS3!Y@T6M^GoR$@wR#F zH+YBLIz@GTa{m%v0Bh-Tb@js5s;scHI#F(p$Wm)j&W}nkKB(kpcy>~#9&Q#K@pEHH zmGB$MADyaZB?d>lz&gD|W&4v+ z-qJzlh#MN_cXW_?xM^_2&m4BG{F)w$Ha&-;nbusr-JN>dd)zogzgb_3=W_=$RGy}7oHS{7Sb z^~5q?V0X^bu~iFttu~vE{buEm4TW4+*FScvGHOZ(8bgf2k*n?=XeJzrZZSA8ct=c* z+8nc?FnV_aMxIQl_m6#3g^s?a0$AZWklkz>F>NM0le{VuZWgj#FQ>X~$u|HjsC@rHsJNoUVE6^9I5%OC9k> zb!uuqt5-_Jfb{9(F%Ca<&V<=>`lc$qU|&Kw9_#ou7Oy6bn>=*_ZZrl=8@aG}^sj%@ z_Rkx3wM{lw{nzpiEkeheByRt^cY4}q=KfHeXWnlw-Z(YBM}1Y@)IRF=zZb3j#jwGD z%-y;A#?ejJ4$8lO?nq>C*R1Z}FSzM}$@Ba9$K{SLnloj7kKwa#@(;=@ES{0yzt7~} z_YWI9`$2!f_}SBX4Y}*VfkTJgF!aF(9_*2uKWxUxK@;YU$e%a-j^ddkhm4$FIQ79> z@pS2b?$U2QIl-X6 zz!lGV+qG!>oTJJaE^vgy&{FVN`?D@g>TsSU#~l{;cbF^8bGa5BKURXa{v21Bb6086 z`p-zv)<5P7zvI&Xl`H-YSNsuI{3ciYNmu-9uK1T+;cQoUkSpBJ6^^uzT_3J^-Xm(! z@k<@yFtilntor8jR4sAV^H*YC%Nw|(Ot%x{Sm6XqpU)k&#Hprs{M{f7ylZ6pMXuXm z4`JF$wc?vt@qG5EMd$yr1aZDBgnll`y+>SUf+FUhfi4X9<{+0Z@1_0Gqr&Y0*+wjkb?VHsviFw0AL7iqb(~$QPVxL&- zq&j$F;d=nf`_kJSI>e&G=RNWsl6|VYpBzPO>U_r%+l|P6Q}|iHS*`F7!Zwue#4Cu~ zl2vLkHo+^2+mY4JHRRpnQwV1zTeM=oBs%nQZ;Ix(Ixvq7udV-@gXb|M?*?mtnI(W`ynq}8H-BG>`r#mKh)p-$1*?9b?*gUcDbPMwb_y-{tp2u>s{T`B7_*CE& zn^rgW>wq&^!H}o0W!`8(>v&A=9>Jo&0aS|36AQlu*v!@X#KQjy zSZuxpoZLg}5Q|P7aEi?n3%>_A%MRR-WqpKvr8i*uQG;`$b@>kXij$S&U4T7-b>x-7 zoH4c`+#QVZ-#;$$&dU9wsKI*;*JR}Wuo>J$jF~rX>f8y9z50k`HGTZm6s$Xu29uWC zDS79DPm(!5xt`42$s<+x0nFtuKCJn=!xMN%CgVn>+?b7-xBpx3J8nVWVV|baVmQ}( zm6{1oL?BP!#IbgS-Q=Pcex~$xBYM0B5s9(^eTX)5>~IV^u6v+|?5*-Jj(ye{Y|ebQ zA;4=E5wZ6-5Kenzaf#F(k+g?Lj#eD)@magm-U{seK5!ypkNv3A-Xl1lud?m&noi1h zFO1QieOM{3U&#JRgmK(bY(24G4ZR#uvUM1YcIlmj9fC_lki>scYn_4>)pLuAL}XPx6gk&YJtvA`)U_87P$xV6Km74z(qP9o z$2^5bZDG#h@H39cm~>Bmd`)^<3{u1>nYYq89)D|PlL@BBGc&h{UwFJ+9*wyf{dns5 zcz$HALVnp)wz*Q3)<$m`s1jl$Gc9r^$7sYva%M=Lsu+3c8=k;SkJsaQ8D}MojELtq zK+aNhEw@W?H%oyp0?uw$W}D7xW}B_$kG3{yTjgzAv#Q_BHl=m`ldDn6hNatDnV45v zYp&^pFO($j!kqZLNU0+AVGPWxN$=FdaDJ)9(ljicd=27Pud7^pj@>~uFPC?%+?Q+A zvSeEWkGAfPCsHf&($9*IWBk?K`!rcFQcKdiF@p92p4bhgn5W4MQzC%V3W9DmO9DSMZ{0vdo;& zTCJ#!ugM5F^BR`hCf0v;w~EgIG2H#xX^MQ)%Vv}O%v`n^y;cUh>-Dm7x+3f5RnFmTOf zwb;;$%DUv^D~)(%6qFW3cL{K%*C=y!hU&MveJ-9LAAO$BH&1yye(wh=5NovYuV`bi zoGq#rloaO1=Sxeol^K@SxYpCGRL=%_@63ul8+L7}+g~&E#PIh{uu zcjC$W-woqb@aRo=*8Y&UG|42Bgjze3%!Cjlr4*tf%F6%+8s0&z zk8}xSLV|!uNL1=}Sqju(liih)7w=vaBL?T_3QPx_x|H^zo&&MSkD!ea>~? zXKr5F{yzK9p3mo=`Cixgp6gua`uGpYv!6n@^^d^6*ZA|~srPV}`4wNVaR}OWc$Zb(GxQCdr+&oWyD7YGhc$Tr zxxv0)`L-Kg#eLg7e&RWuI%f>X!?UXS@veB*_>bbv&bl{an6w2ZrFVz0Ys ziBQ6kxftVgiGE!F_^tkijsZSjp9Joj&h(#4o|^3I$V4gppP&>gfjj>Qj8fS6^W@pM zug*H0n&doJg){80e;oVqhV~8Y)%k}C4$nF=_h^GPF*{Xjl;!lfYjCc6GvC8}EF&5C zJ3N7@YFv5+_T%`fDSR_CM>OB|`IGT)yvO%Ith>D#Z+aYd(E$ z@X{g8r+6)(pVg5XY>ZRB(|oGZv42`d)IdDg_xI;_yCq1lp8aumg!7%|Xw31}><`$l zpc%Ox^|!saC9p&{_ z$1CXh7#lju`}+i6>F-!M1oe_U+l?0fu{9H^{dgDos>XtY8HX|sCs)5>9c{rA%PrT~ ztuS)+kF9gVV|Z(Jx3zXmTzBWt?4)*j5VzP5g7*T~hcS$%4=aP8uN)t>1ecY4^lA<50(w$A0O z%1LgR8n5RjHhU9n@M?=+tboa*$9w^3X0Z2Qc~^NhXj)9BpziFob!z2o!i zyXv!U{phY)(~eK8zI)HzqtUh;?bMu5isx^;TRNuXTfvnPJqDRGzd80FiMGY-TX(d& zI&<`-y@HnJ-ly%i6F-Ny6LUs(%gU9AZ@ck~oSwrtN4Z+Q6cc$CN47s&+MgyCuQMKKV}cVJoBK zyTA7(XZ+Zjh;_{Y)Jw;ZeCz=nAC?a3@jnyo$$HM(TD@xM;NGP}lBW(}g^)fg+fN}P z?M}>cNNtZRd@_wNjY_{mE1BVt!5E_b0}D``PMGw`M2I zCr&xXaXy?JYu+D71Ru?}#&#_onp2IZW`|gHdq8n$$( z?^ofuZ@^D~U2?`7R`S#tiz$~5OJ$wI8ZD4`A~CkBr|mb^wbgxgXIse`pCT@K_El@u z9T+d`s#BNF?-=}i4Eg0-w>-LZ*tIptZ|KrtzIVdkK4JM@PA)lN^%;ZfqucpD{I*y) zdwUe?CTJeR)6SMJ8SVRLdJ@jIV&Y2@=dqI$Pubr2>!8Ir89ea`RwX~(_{hehgH2X& z?og}rP~>pYkpbDVFRD?}>?3@(wE!by(t5=zU7uV%+Ly$cY;%5DJE|Td2S=9XeSJo+ zx7e29%x9wRJTWlSo+&We*JDqRynMZGYs!wEgIj)qh1 zQO;iZt*Ol9jJ@!}uy&fOh{nzVu}AucTNA!O??Au5o-9@Nyd(LC>ksi+bC5N%GIk?NwsZKH7Y8_(gQw{j*5#Cx(j;Z4HVUO+`{e*Yr3mXICTp6d8v6b`QTFifwI#Zjv-FiBWE9ba_;vZ0w2JA7N)}2$#n&Z5d zy2KOSeEUP6Zof4EPx-%@(c|BnQP7^;=SR(%Pqh1x!^qt6K8|E=joNQ4!1LGXOs*vS z^{OR}wR>7y(xY&H?1bCTHOg4TK6UAN`dp**3e^KIcJ~9?jqeyp6ktZpIHK31tMR7( z)i?Uq-o!r0`wG^g2L`)tvi5X-IAn9o_s+QyA7VDdwfgPZ+3q|0gZ+J&(eT_eR#cL6 zupho?03B8vqsF5zb1l!&-mx_JL#%iFi6GX#VBOl2TH!NSE}oT4Z})n4#hC5vVT~8L zKfwO7#6{LU><{*;5v!i&eYnG8{RnG)CVMS=A@`HK&YT$D-(j6dz3t4M193OUR`k~^ zEIuQ?b~N5*k=m8P6-hI`Y`|4s`O>U^&ih6FKh^(y!mE>BX?%HV@7r&`^VXR+e|z$S z6OooZ>oI$_uQ`;8w`K1>w)=SZYa0R)rPc_4`{y}p3g7A7iAX}yt!h7Kf1$)zf8w^?xAtsU6$^fU z8hm)u@d<0`4SzVlen4CH5ocef-&u*d7*X&ojo!BG4cW&mx1VC4+5RtB=W!nMwERWa zux49w#ay3qYs7~q_1l~ta>(((tqHeeb=g04%9Wq`Jh~wMX1spw_GkU)7^dZaL57?T%?Yk4ry^(~w`UMVH?#`{fc%#pf=dp^yyFZX(?XJZ6qQhsluHDsgzUT<8 zmfpJP`yJQaWECAPerBJ)YNcyW8~F$(RuCEb6U-3~KwcM|$oD90UZ$m2Ih@D>>C+1#huqfVd| z=O)}0IvL%EHe|bVwe~muUiOY-JM8`1jq~-gw=~B`=C*Tm<7(lJPh+WZ|FG%tO_75u ztl+nYSz`~~ayW8iu+vl3SZ&@XsMfL>2mOgAs{lu&TwA#B9#VIK@e4saoYBg6+K+qH zdaaCu^@r*YPXOOtsV7l~soH$ZN#;z$S;eC}ZGOv#sc>i3_B*Gz_tzz`H~9ARPBnZ( z%EEfPu`jq4aX#(Jr%W8J~? zTWdOU`ubMo1mDQ=?avDT<~^%-P58c7GphUka#Q%TgBc$V<6EUR#5#82ZAg(*)+ZaA zd&7OtM19+rF3ox)@AdqDt^bz^|2*jzjsGy^1LFX;W?Z5(B8*z-`)Ll|*S z_!I933QiWhS@hO`9CyV1aB_0ucC_~fd}|3`lxgQao6fz*8OK<|Yj@oW_CwAn(r8$;(F}~`8LwrW$j-q%Vtw4B9&ZjE z{FF_z~cLPw?)*6wt={yuW~Yx=SSuY#;`WU90`3`7 zjsZ-)&F^|n-Ft!e18xq~(8I`-gHswCxwapfhkI5>{TyRM+P((f(8R&U#>TZjLjU^F z1}lGZcWTnDQ`>g5NeQxZ-goMVc4tiyZYsX}t!HvlwcV+yZFvXX6v?xbeZe8at&SmM zv5s!Q8rsS!+S=hCYPl^(OL?g#r@bgo#+hHS-JL3Eom97{PP_=FuEV-K;p;ej?mYWP zN9S$U@onuJvvZ0%gPE_`b&~R@+wbtl&!=m$b_{KbcX4sE6DGk|e?MVE5W6=T3uz?NMtd_sj7T(8oN~PK1 z%;A43f0mX$;H^i0q33ytEPug)@X7?%;!K;Wb!V?Xl`B0pdQ#$P-IL6kSv6%pjtO>I z1B|(ovs@pHka&X<+Cq(}zTQ<+3QlI{1mJ_W$&JQA-it z=H~RTdq25)0%j_aF)rcm>z`tLS#O-N%(K5Y<~{q4qcnA7qsCnOoS{4F(2seRYnk## z@#cM4Kh>^jw66`|+)Kp1HV}U8N0z_McS>Cwz}E(cBm-TR56A!E?B}Aa4V0ntInfPimrZm^`j7q_y zIW^7W!jnI#lW$8Eo`^G8kJhyZ>OA;_{&rBY^7M?2nw&VmpB^VY5J6b z`F~%3@UF6={r*IQRdAr-U=cpHY^>9;-ry10B&Rp?y4u?OddzuvHemO99KB6gcX*xD zFW>AFtQ5B8h_ydm(tz>X6;-p=bSc=`RD^c;8C>y8~bvRrd?2aYV) z9LmFy<(mCF>{Usgy+X*d*CToMev)VJC+`Jzn{P6+zw@^g$7TM+Q#svlb-!KETl6yK zHfNsj^^TwH&h3YsmVeUe8}1swogv*7LY>pMFW$!H5gCuc+S2_yeaJXQ@SV=iaaTLO z({%w;dJ@N#Qo~&Hxa%(*7iXK&JTOzv8{0TO1p7Dly*IHI>qTBEJcB;%_UPJ#9`#NS z71aBr^%U+GOg|Etm(!H9*>kkB7nW*`y`vTKP($`@-!a9^D`Se}HOa|~d*TIoVK4ON zrS?$QZ||O2Iz^YS_fU3&(<YINLyC$C$Ab)o7Heb>D=@^G?k1T%)U_l`+|F zkKl1l$T*tA5zf-q6FXkpef;pTqeqV)u~+ceYt|g@#$L1LKmk_N8E+S0{ho2M0BiY- zZs zpgPCe7^gkwIeTcfgX)|VzI``3-sh+GPRyU&H970fPsh)#pJR`a6}ZO*cY-+lF#-2n z_k~a1;Mte$=?q_-x(lr|WuLVsJKo}{99^4fWp}i7Ms2cH-5QboJ1y7K^RgQpkI^$u zrQ+eT)m)40yU>&O@yzn%9G~+YR@%RqH-9=`JEf<-((8ka^j80`&COf73v>64e;zmD zceMAjuB^v7(DQCTp(ks1{rtS!U#NKxU-eqz^c%&&@sL})r~UnY+AkTvx$g_=mMg`i zm1&7r?pn{cy||<_Tvi^bsH}=r*TfUGR-!ghTv}378YwHUjhDo0$}1y@NL5K?S**4! z7A{G|%WKQSiK=jQc`cIG#>z?}mBp2jit1QNNpVTIq^hi}Hc?SkUYaN^FR2KJD=I3B zYpRRm)s@AGNJ%V~sHmxo$7>=r@UR6_85s$=UvFcb^O(n?CRhQS4mRCf=rKP2{iQ1Z)+L~}>btNoDA~mH| z39Gm`5{Z>mRhCpnYDy|=N{XvXYs(Yys_OF6(u(rZSXE`XxH?i*RT4>*hs$d!Ym3V& z%1bI^m8iqAaICzltU6Mih?iExP&M&zNxUppURsM-xEQOfEw>`YrLpRYL=C7Fv2Z+6 zT^?Z>OW}M1o|IQ5D$6Spv8wV|ak#t$6Wb1tWm#n`Tv-!Kl+;AZYbz=f<&ju5+Bi{C8V}bLhpVb9 zW5uP&KT%#4t}U*vu8zZWZAqf0Hd0Yhf+no3EG|Ps)Re@+#pN}zTC{p~ZArMevI4ac zsfm=t6Xoa`#pn{T(z3FOSb0gp%FVrP;&}VMoJ=Ro^ZUjtgf1Q|X-_!Zu_t8Xa z5pUSlfzKv>M+E!7kCiTGTCLgYn}~|0v$XD9_M1_vGt)#cl)pk7lrwUhl;s@ICITDSx3$T2%JhEGU6+gxkKf{pI z^AFng-22~^JlNqY`Ff9BX~^mJhIsrR=8>loA*b8B&eI-WvhBO+mHacuUnRTwE7{$@mAt{pPsv%H^dB4X zztUwL2%Qg41F*fijd;p?Jn|ur{H{lK>sRIP_8%ql`8XAn{ESC_$|EoH$b7$vq))HU z8?1A>JokW*f%oLne|J2)!BgKVzCg@re$*qo`{PJY`q3WyqdoCo_Q*GS;qbI)JBfI`6{sW$PcYIRuZvQFw_*Y^3=lY{$cm1N| z!;XC=%kxW?rR3wDc(*^O_|2a9eIEIkA*a`8mB(K-p5Nl|mF(_6N_NKwCA;;jWVb(j z)nor_9{KAYIcC?_WG8IpNe<;uae#IUCFhc^bdMucm7rU9iDi%epS5N{z`Vo z3nhQ#Nq^8IS3Bde;$Q2L`RuX^D!$Q>)7!7ct}i|tt%8#Ie6%TV@yPFcyfFty7^zU(Yd%5GElDCO@Jmtsv*X^%LZt=t~GvxIA#@p%hoOmU> zVXc;@$mA#Yc_!^!#tN^FQOXx02s?_(~3V;(zCf&-BFey#Xqy^zQzm zWIoex#%DS0tKye<;@5cO%^vwJk3837Z?#8u*S{*iVo&^0kL>nG#pin)P5*a#Cvb)W4FKID92f^vF{^@(Pda&R;71YaaV;9{v`O-0hK{_Q?A^vOC_Z z{Em3y_j~d`>xnP$#Jl6Ovghs}O1|F1caI-b{A^FWdpxM(-Q!s$^F6OBD0!Mk-r$kl z;}6B(VZ^7m?>FuC9V_PX22=JwcYas0+n(R_jGy1K`R@AoTb}qScKid5eI>i=0VTWV zW0btj!~fVLyT^ly@6LBhp5g4@N_O8xrDV5$l&8 z!kokHb;eTZC7ig^NXR6))Ul{Q$-z=n8L6z?wL;eu< zN1(p1()Oo8cEg=kx;)h*-{q0-wtlMXj`sNOuII9pwMtvgwEpPKed-+wf34%m3Sj## z0YWRbL3m@wbi*IU&t{|!lsCh7hMm|3;r#QrY)QSZY!J>5k8BQizux8#uw?B# z!IrPIWUZfT%U4^!(B)ZT%LA=PwLdr8a?skP?G3QyA=V2{-KzZlk1j9!!ys!Ip6~}i z$c110ZqqRj|8o^>pCcQD^MB8K%3rDdDFSa0dd0)q9@k)l@TKZ&bo>K${CMjnT|amU z1mbI~f7ddP$p%>^)(}tqe?!X??f4t47EgRJ^b9I~v~|i8KSs-g!QpqJ_>N-<0RYw$ zgNnb=!lSuPVEj_;AJ+hbtedPGbp7Poa-mi3sV|NN3`?*Lvc6*dn=Pq1auD9=^Nfx^ zX2+L1-;N@U`Tetwf5(omum40`kDcE)EqCp#?6Kc4a7{1>dsn$9zf5h9W6U6Hiu0~LzMFaw=9^#Y^3VqT z`>igI$b9Fy1jgrh>Ys7){yp}ckhV7nIH(U~h~?c)*HXV&RT8o2hXTtx`f`bNJB$Gi z>X!x)3%?jxzB9(LD}=i#7^<-a^$BBQ;ZLSs`$H`H8Psckh(*5)xKNkX_U#HN5a_eK zi?0AU#DNr{3|k2A@nPWkqyS$Agb>9h{u7J+I^dAD$+0cO%0+0zCjJu(e>U~ne`3)u zqF(z?Ecz#?*9VHkq6c)|>BoIM6r={@9k!5ur(Y2CwBL;u;)^X2Z2woPb~pWRLR_KdtOgEh4zbwZOucSXV$rk8#2;eOb1V%tpsXs4C;_}S&s`UXUYXbgdUNqis{`_q6!Bk_a4eOGMS z`R3bd+rGR{k9}Ld6;@3AWyK*s_@JscVzHlX=!r#7)AEfk?iT?zCIbBr{*|&rEPVE{ zfPQBk{S4{%<1Hay_a9>6-%k!5L|BbYIK;wf0~SsfIl4`Wh0_fjD8UcH5o`e+agw-< zTCB6M1(X)A^EIcx1-P^Ikuj`$XZd93C1A7Dv4063&MLxJVnWy1}8y@3NT7m6yIdBoKUv)_hd z3K!t7Fsg6}e*ukIRH<`f@qyWgYVd;)#}?#)lg7fa_chI7{|q)O4zY0N0T*h{W&5q> zw9=05lf+^tmwH{##G)SsEZ-=z%Qy}S1iM^%-!#ib-{f0lwr`q$FZJV@(y|`JCf@|x z1RS`PTKyhW78+qYw&AxCDJ=f%ggip)iABF3I5ZJI2nVr+zG*|;B?$Z9Q1~qI1cftE zm4%ZO?hh>WPb@YE1BWz+=g|Y-Qv9*hPf@rUIM{+81Y${BPfnxaOd}_yIK;x4ZE(0x z1#VY-?xKZvD7*nU*oq$nVoA&M5+M${2;0e7r#QsI=>{&;_4zchF3YpPvX2uBKNq&- zn}@`rxBK~BP$1M{3$`PX#=_|jIdr$Jw%1Ytb_4`YMbh7hg-@G>JWxg8{v!Sm3x~Uz z=!r$oYL$J8SoFEnPsI;HE;iBI{?DXV`~T2|{trN0P%mJKC9SQ0Sn*B$Q1W&ECl9wZ56*4h9Wj9A#8=(&m+Kr4r+NV2x;})O)P2ifCJyh4?+lAuv6J577ptnM5ho~4}}_6 z0|z@4pIG?Z7Xm-P4?-ih;G>E|EFAU+u{i@c@Ync3VBaXzcoDFqC6=`J0*C$vKL{JJ z37_S4;n*F}ZTD9k=7V;!;BVgC$p=RjbcOaCMm4*OEzdHf)-FG*Vv z3+H>lffw+D(27ks#KPGGES&A+=;J10;jp`ev>m!G9Ae=xS~#qKsY7Dnyh**bPb~U( zfFH4*Uat5bSmAW>loc!m-;(`*}U0rEZCZlMfvDnVr(^!upS=b(s1|65=w`^V(y`X?67AAzO3 zyj~+5V&U+dCtkd2hpT`Kb$bm04)rQMuNBIgjabt1IznK-;!Gw!pzti<;17^F0^ERb^*5IjfZq#KOrVN891|Poxfsg;Qp5qU7j4Oe~x_gENgBeQZT6oY~|YR{rps zjPyNX;jAD>`|}_7X9yl#pZxaaCH3;3uiEJ=%})v16;UI;ame> z50xDA5=+`V>a|T`(H8&*{slh>5p0r{SU9%;hd3!AOu{C1h=ns1IPe;N5I8SLof8X( zb42K0@q@tiTcNi30I=|hg}(+^@@*qW`%f&K&A@@z@q^HXO>9yQy}@6#P79n=I2(U~ zUn(3ha1QaCN}r3r!hchE6!BXMhYUOmIPmXEzYKpN&A*=KAZI!1t;*o@q;h{ zn_$|MG7?J}7Z{v-$v2a!!oDBwtSU6h^4wsw39jYG^3x`9D%nQV#XZ1(W(N6#lol$8g8ysTcOfxtq70Tgcb*DY5W382rb`(Q^l}aJCzqZgO;4h=s#@V)@o`}BnOM@kNxt^^Q*wT&>Va4|8O9tzEPCE!B5B8vqtg-#r-K`VSn8H`bYA8>+eSM&FV3No7qR5^EIHcFOXTRhh=p^|;Mnt~&dZ!P ze@o8)Q|0<2@h1x75pyfR0R~|daEJ?YgfY~ArZBG+hcu1=2Y;vZ#Nxv(X(31V6Jp_P0xo<{akc`7zEF6(fu9DJwFI%G-3u&!z6e~X z)8@iNaHrY_iG^QG{Vt^^7JVgf$fxvC;DDuYKCt*qEc_yJ`Y2As;1COk>nq{JfkT;! zKZCfh!n4WYB#F>O>{pm;kHTz)xpoTlQ}{995GPUu&hG*JLCBrN{gwVn;KC~v?xy}K zg`XkTc3w2_KH$Qu73U!J0fpZImU)3#%Ec)#G*EFkOoVvTA_B7yabibcmVqG(+jIS3 zg|Ee5;V^~s@F#0&VzD0r4&^9LoR}XaLa4)EKtF&nkyzgV)d*Zj!wA#xCpL-2<~-{4 znvGcW97Y4z;RoRXa`gE(V&SX-4(Yb0iO}`ghAK>qZPLIM_pd;{wSPk@WlsWvDp9| z(spK$)2(b03uhGd+CH)9L%@MAD?azT;BFTSX9e`3F-m_waAASM4-(&`@Fu3!_K78J z7jTFj8G-w$)H$(mb{l$P(Q`i)KC$Sz&x)Q{^al(*vFMK)dScO^H1x!xf5*@hi~fB> zPb_*4L$Zz{7Cm?M(2c6>++C#~5(|f2K{%{p;SdX_*x*DA4zX}ly{$%bW7XHtGC9gvUhgdkr49*GQP$_;8-ol^wKrH+-O~ zLuL3u_#^(rCb94bWPnqyI75lqfC#z3QZ8cQj{%l)*~cdOypwrsa}u|q7JcYwvWkI2zwBo@x+h5Qv2n1sSEzELO(+5iA8@8 zu-GIP{aj$NIS+VvOxYwB4(Fy3T2Cx`&P`&ISo9A9i_I2t{#w~27S0BP!#Qhswc?ob z*B0nUXg#r{-3BcA5{rHZaHvMv;anEt0F3Y?w&Ard7XDMvkI;Hz(eD8c{=MQ8i~c3* z7b-om=nolsV$mNr^u(fn%g_^x{*0j~7X4X6Pb~V+4Lz~wGvH!qobodZf5E3+ESy|& z>Xe@I;PCM-7EV4?Beb4a^jv~S{Sb@Zo*!GGK)7IjtXFz=&EcF35r`!%n`(sCoAV}J z4E{v%iG|O3voN9bci>OI(6{h|@FM<(Pj<2JUxI3c))R|xo6rYk5-t#G(%Yi_K!-&|S)ADe&-VE*5?S z`Vm@BEc&s)QvbxFuccnsKe6a100(q^P6C#CBNk30u+$r|=%)fpy%CFk7H}ay@Qc7T zjO0r!oF%}4Zz#?K>w(Qg5kdL|bAHej*IHBV@| zvdQzY!)Lfy_&cE=q4mU~=Nd`snOOACQm^ZoSoA*wmU`X?EcHw*oCCm8&%~lX1T6JT zEc#=>!)Gd=iADb!@CdCZ7X3+J@tIikr+^D*DLZG#(f$()=L2AAuaAL;Cw+M0&9aDv z^E==XT2CzcOst@U}-O6(cceTc$>0wv5&0djg-^xTQ+~ioawXXFPgdRyO-iDn=^CvpP(cc zFZr&uaL&Rc{zlz@DMR00w)j4)=u+RQr#s8%G|ipPZ?|8{1YcG;f6*nQlM9zzE}HM* zyi97m5%O};GiP5mdily(cIt(*=FDEvw4CqMoSs~~Y|eCvC`v9~xNr`fzksoD@uC&V zxA`a@&PDEv7okYYm*eB?m+}*B+B9cTT2i|+X+28H=u32px$~Qv zrZ1bhX!hcT7g{hQFOmLINiU_>{r6JtsA_Avbo8?Mi@swOEn2){PSLmtQwo=_n3;rp z@eZ$FS9_^w_9g6jmx|VJ;=N=vMu5wtW>36KG<%{ankg=#Hur8d1fxOcFZ%YS{IZ8& zp)@t!yKp)TFGK&amLS=RxtB`E-s$v!B~3F|%w4=};q(XQEL&_x%vrc_@x5~{mDrpc zrZ-)ZW=s!cnMJdEtTJ=47(1mAF?ZRVOXgz7UBdRPi{z@jx}-V%0^l@n^QN&zJmK(J6$8gW!EDi@stO3Fl4W=)^I5_{I{`C(C&IEcWuTI$3($N?oK zP9zGbrUE1?DRTA2U=-)t%bh>#=SO`l3riR$9Ko|44{md_oX?>agmp?2q z?Z86^FYhWL;a_+^fgzJujkwB-@Vddvgg&a{#w65pMbjZu&usv<<=9Mn4?u3kCPDID z1chmD3G6)q9qqAfVvpDHO?wn}B3^>nOM%BUQ5`X$Ry}7*d#pyr(ZAcUnf7=dU^jFU z#9kc~roEGfz5Y6m_PBmE?bXA;^`b~RRV-tI?dhDHmy(Jg1$MYAaz4u|SN!uG}*n0&18C0jA z)}o$nzKFdI;F0^GI3Ht0=zZLpVv7?yVkHYx9~aUX)| z-zKCRZd*`4V(%1qragRk*ReOuu=n>Kdr!h%t{4GN;FBJEFTma%h@^kl81_B}HvKz< zbluQN5PQ7k$@GuUmA(rd?TyfJtfx{KGwm(IPF4iH1hL0U3Z}h}VNdGsI*=Jhd+na` zZihXdpOPTY`8;|s+e|&GyL@|bcu@?u=wD&vg(Ck;VcLO%D z_ZbqH_Kv_F&+AJNdmjOq_R6qRwtz%?Be97+UQ0La74*Bff1`DpDE=8PP&$&QsoxVNcrQ%b<#Xpr!e@=@Rx>2D7{azTw)t(XjU&kj(P#fW0G# zmmvPl1<$lM3ih4_iS>6AHpa2MBd|Z1_7-6f&4pfq*yDK))80wg8wC>W6=D;64#F^=WsZPBK^ zZCBu&3Um_0-Z3aldt1Nhwg=B`h`nx4c@M%K(@GF~y8ujkPr+U`9HD>Z*u>t?J@&fb z^gCh<|6-5l+)R7VPIAjzVc6rnXl8lu$7F>nbb{FXif24{=38!gs|)%3;y+g2f1U#1atA@RAdF%zQy10K6JodIucKze!Q>i~*nlQ^d9QKM3FG0%N0FqgM zPZ{>U4zk$$6u`7s2YdPyu5D86eF&au?*Q!m3<+7@m|^b)kG(4*cX`=XNh);9tF9BKX4e_+c$FTRLokIPHf4nD> zX`(uA8tk0~rhiy^IQDpZo9W*ZgK@8zPQyR3cNIvcy@tEp@qWBv&yNJAy`fk<@SRT* z#2yWs_Kv~cPONF@AEr*nzXp%J<5+B<>6{?;#(C_mnB%UqG1WQtYLSQOUp^-L{$d0? zfidt*|9%F0JkX$j7z!PGZ+XV&VodfIn=jw+jL$!tr^-Ql7-}4Q*CJEXzfG|BJ;X~8 z|Av8Q`p4)0n?RyH?8=V4FFf<*04%b39$A9e`@Ltrd=U1y2&KI#*q9glb0;>_zeP8o zzg)!LW}POAe})GaW8TNWMtiqo6MGA>zM#EQYz*&>vaGuqsRQG<@j4Ly#oxLc)%>Pu zwmsq&kjN|65l!ID)|h{cD&RBkY?;PJ~ zeHmXLO{`hn+#BqgVs&(l=63`$y1Rn-M*6uS&Ao$bmJag`ZQhUX)qyoQhHr;w_!7x| zS=RG@YxQ@>b<^66&#Y8)&u6b&%`b=j+oPqOw71^h-TC1VekVMbm9S!Sg4zDFds_SC zA3Xn9tmF1pD>$Xq*K>cCZ&p^%XMKG=@BGN>xP6_qBRf2Is4qBWosZhPH}>4u*Eg&0 zj=pz49G=@~-MMk()4RXe-235>U~8?FJo~z}W_4^}*1^03`TOzR-Ifipg4Uwcp46i# z`)^ibMV?5WdKTYf4t9;Q^123Q4vr4Ye0^gwaKQ3yhc-UMDss5~_SnWf(Y*MUc+9tE zbISDgF|mbZd;={(VoxtTJs;i z`{Bp-;xoPmeftiosJHiJnl~=}i=H}XrwCrgKp2)X0uJ4H)vm#x|v#(e) z@nzeBb{|@3v{j!nz7@L9mq01*P5IUy%(Q}^y>h<((Q9kMT?g?s@l@vBn*uN2;7@K& zS-ymsm-&_2y)C8f7t5^~UtaBad^Bp#{eorlzHsXCXkO>xRDP?}Z`fbvTRJ2;BV`TD z?41*A^PkOYU7LU4d`_(6jaIAUHMH<2S-yAd7JlX7j>%|W|LYq&8qvBRXZl{*)U(2F z-OR+p|Gx2;n?@GB_QinSr9%d0CYQVdugx#vu2~&?Y_zq%Eji<)wYM#KHp|!XSj38~ z>$vaL^WBd=QPc5Bo3H2f=dF%UKDoO2w7>7)W+wyhfytUpuFkfatDDD_uIu;&?9M(v z^n-_9$e5KjX zR(jUj+k(9e?U~=TYG}u&ubkh}wY543CgXcfoPnPwtW`skn>#)2$=>1ipQ4tIDUDV^ zdveCJR>z7@eaQg&|GwbRQFhO9`+@Z7px??!&e)AIJR42oD209OaBIQ3o^=PUCu&v= zdt(11S-xK-m!z!z{`yYFy7kh$&$kc#Z^$SsoHg136`mAvF>(&#o!PNt^Zh5q);xp^TuJH3`tiinl{kJ^&h#y~f z^o>oK_3ho;niJgLxUc1R4URsB{p-cf@bka6p6=>-Zm+d<-y@kXcA_V3K7f7v(z*A% z@Ehy#hr`dmVRb%S`{=dEePEWGd-s~6w&bbTtqA&2-ocK>N~`1k`%(YN)mc_oR=Cdz zt7~1KuVh(kcVt*=e>l$S^Yl7v?bEMXJzxLNjGnCj#5fxMU%RcnTSjib-Kwkp-rw}> zJ#Ky8)l>TGjIjUL8IjKL*I&1~J4Wuf&l+6&`Ihi=KeUE+_Ut*6(bIYcX?uEhTah1( z-1(}nuJ#98dLnOIT}IlT2-5xlws*hbv+CFWu&=Mr)8l-7ezMND_9w6U!p}WTTcz)2 zgfrjGDA*b<-)ZgW82RLV*5vx3o#AKKT6soJ;pgm}x^c#90#YHTh$n5{-;8|fH@?Y; z4VOKPwBcvPOQy~1I zJ)&ptZ!&t;{U)RP(eQIWLS7wNwbm_L!;z1z($0=`)z--EYpj>nL|T)ZhoT4f!D!uu z@wkt*-rqmFC*_a5)VaB)w6pEyNBV}#U$K&#pSMcwQ9C=X z!wU{AI#}CMz5b>47a!WYzVsn}?K;?10h_hP_?ujf{a7F~m_uwnvbDghktJ&aLUvnbt-|5Sa)&F%~>*3a%>a{<* z!s;n|-n#PPp7PJE>mJ_S`55-ZN3Ix{mE64B=i46a#2nL^jZvy_V~72<`opQb){iF6 zntXh6^__d}%$vGpYQ|k3-8!q`ctiDVdv3d7rtI-DR-jBRsf3K=zSBpd+x&UXZ0I|k zm)c>B^uAuT4{;nk63x?lRLmzn-8w>nlvte)~`tf#-9T(ZKq6r&S#vP&au&+-e{*B-M62)D58u71 z=d&*Bova;w|9#V)8>eg<`Sjs0M&@?I-Xr~!OJ3x-Ix%nZmdP1+el&g-zI$GM>z-Tr z?emM3ZPtOg`)_GSNjBi?>+8EWl&1DNb=Tovi8ap>jH`RCj?C>>`?mi+9{jg*>-6J2 z5ABN1wfh9W^zPO@b@w=RaBgt(zDcPwsacMupk;3AgdzL(aXr`E>)Sql%7s4XHEe01 z-(CJ-*4Z1AOZHliC(vWE&R#{_sc{{0(XT0i#S-i<{^Iy!H+I*?Pr zL&>vyt!wI$m!Ek(XAMypc|B+Ofd|(2OH67>&gi!K#lw$ov`P;RsOBEqzwee?$L@Ra z`@t@?-xlfpb}vTJ^!?VK2tHA0K!A6KapIL@CCPh%^H*_*cNR0kMoCHCc#3z zwy>b>jFbAEt*Zvl+U7g8;PBidQ&U?EE55jId~|?nc*o3pTGU*8^Zs$-j}p~ZY2X(TE6(2 zhC$==;EmWxt{z}LCo(&sf$<6H+J-7!R>~FZh2Y84!fZe^({CHP9 zYy3xd&YF6BYV}=v?#i3CWm?AFAKf++y@zvjch_UFNBli~UyX8R3`bstKd)P*n3u6a zZ1pA9`}cHm2A_g8^!#pW++{5A1Z{_fN-&VE^~AhU54#*U>2%r?PZVG7jAxIX%7KPM;^ymXdKQM+YV2 zurEz^&qJyB28q_`-RqeuzRrkG&%dvo|2!vN$wLh}o!`&qyY`jr`lIBrPWpcK`}rKv zy24KHmhTEr{FQb*PRZ$@WVd`ucJsT^lm2Quy<4A3o+0LN1(5CKp65~W%|?8Bc?a73 zQBJ&)yFK!g9@+I*@!k9edi)LA_9ISuCA;;nXF_0Qt?|n@pCXeMrT{>LjslO36->q*YyZh$|5C1xkeI>j0uk-M~Wb@s4C09GAgp};| zZzc0N0u_|3Z~2Ex$(ud#-5zX+`~%0nlAkc- z^zz(f+jr*!CA%CY4|mcl+3inCmUE)K!sw=DqC(rgyT2%TvSUxlwI12sUsSw1J}LQo z9)7OVKUBPXQc}rdJ@NXsXU9MNh=L>Yc^DN``ZqoDCXcKizp&G%m;Wnv`Q7?ca+a9K z_c+q|B{tt3UzP0cZzUdn*dv!)|B&ez2dMDKRra}dGDczJ_h*)5P?GPJ_?>$~7C<)$ zUn%0f_2f>@Sb$LFv<&jplPOs`~wDqqf>p*{bAA|(Ti#_!> z$|HAZ{#)Skdoll0%c?$ZwC^o3?a5diwfQ$$tF=F0*!~w@@O>1vGsE@R_&h=oHrki%c~JqxkJvI~c05AX&fggR^iJxK5` zz{*3&#a4*xbPS`gg_sC|^%LA=LmP|D2vowE3LN;7;?P{+28G#fh5SLVZH`o!{aI`h zi_J=4`PN39oXz+_AQsLf;DENXlXx_K5ID}scQjZ(f(wA1IsruwgMNb-2nRw^cDC)u-lQ9hhX<}jcHDNBNpFo0haGau%8E583^}a3-QJY zgc;a`vj|x15R09AfkWJB5bnn&csude@PoiU9QwKq?LH8QDop>SuM&$*yZ=-xP85HE z8ij2;358kD@{NW}Vs>hT9BlHSyKcWl2A=i97UW3_1Y+Sl04#c9(YFEzCgTU;S!@Ab zv_^OVTOm6L!u!}{93YmoS5g0c{2&mEekgG04r*232tMIr;jmo7DFP1uwc-#9hh+@i zsq_=@7yN;Xg=4qNT}sbgtB@TTA&O1vidgt8s_2PDKNmQp)3V+I8ZR>NKH|IagD?hL zFl9p{jdSLnHLIFA24zY0Rsn_`ui=M}Vp%uzLAD=E< zsjxjJ+^euXCfuj+7TVeAVzI+x#K3oz{z-E5yi6<{J~JM;Uvc<+xA;RW9NsepM0aCKd{&&7Mp_&J+bI7^)QD0+()wM0rR28%RRVg^YPfn zoJF(e&s;Qp#p3Dn7GL@)Mw`vYg6xM8y^jUrsWLt>%zJo`arZ>%BIO~$n z_NkiiJa2cwV|5pQ63kAEnr0{^>{j zY@U9e?{batXFRZHo6=9`UCxv|sAqNwc{)#YW@#7BT>hQ3hme-f`%9kHv)xktc#i#K zoaDj&&8Kbcr{&U~XSyCq?Q*{Hd9+cp^;2f{b7gqc>~aY()Ligr+2#1^DYN2S43vLn_-$tT zvsx2xz?ntAn;1j79e6lF%=w(5O#L~(T+cEv-pdZ}~_MS2P>u1=jMgr5`JP4dWC5XMR0hsnOuW{?|3Xr9|e?)rI z-uED|4kd`a&!9K$je)(JL1O*!6oS~}yL3%^Cm`tMmu*t){nAt3*{~<=!BY=nuMxns z$MU~mTT(w_@0;K;O;pFd0DJcX)4ze(#NI!6{QDdRT6G%!i9Nng*tAzXT$O|Ng4o1f z34rO}YNYF;AsxgX&)1mto`Ag;aAH2f2Lk9g|u6zmlv zp8f$k_Wl{^P5-K~GhWQU!yf;59!LD+X&m~_`aAEjw+Qy+JR71N|33HF8v}byh^K!% zwIlYp|C|0@kDZ(4kRav#Arwp#)e&1^kN(i!4cNpU-@9Vkn*e(s>ooimd;bbx+S?9$ zn-NcYBe99S3;@$!b@s)_mvf%>;63jx+TLix-bRmqkHOwsh?gM#wR!w|7WQO+`!dMl z-*X;&D=?V7Aja@7_MY+Bej!GR--vWD^(PtRnf{o<}VEal*RjwJ-ef~kAE+pT;tfP5H@(A@kTYjc}$2{*p zOurv*FYaR;&^xi$yzhTwBKtsc^|QN_%Xf6sf1SFP;u?|SuUXVCxLt9*`Oo^{k^ot}iJ3U0IxJDUEfCdV3Tul{1TlX(8G zIgV!!;tdDrfp7bVlihnR^Hb)%e7u9NIi8ouIFNma_s*FuH|fCB?cFU$s+Ue_?k#OU z7UkVneRhw>-C6k0SO1ZgVCN8AJ9{J{W%TtHtZ$31-PI4Ae%6lGNzNUJlbllca7SQl zirdX-Q0?TBQ1^6s@2xFrDOleS ztE>KSYI5@~s}4RtXYFapjymaj4>`D?-SoP<{ZQQOMSVv1$6dCYqpw9Dt2^qHp&515 zJJq*+L-bfQ<6y?2jKdj6=2`8vV!wO6@3cx;TD!mYqj4FxPjK$&qn_GjMbT#5 zZff0jMe9xN7;>XE!KpnLHKx+<#l7MGXD#-@OC_eEu777`$K-yxrN(mzMJ?Se4KenE zY0>27Ppr1+4#ykwp52CMTlC1j9T(iUo8GG$_fOqdu)Z$#;bdQLQOgmu^mEqO_Py`PaWl4E>aLa#m4(p26^~y*%W`X z%~n55&+`-#C~I@Jit?SF{PuX{^*X-?!5xIN6cM9-nEu-yf4IhH;JRuM?iZcp;q$nL zf#+}rq5qi2F|_v|cC7lL{8f)X>x=?0{-8%bqxmZTp!KpR{Y33=4$=<7S%U(P|JQ4O z>+JYp*5{t|zxL$Ea~}+C*m%DVk7p#%zt=tX^(!iE3gbC;$^9w0z(F3kAmn0`>o8-0 zLxvyxrjG=c^%J(NQgs{oIFw7=cL9Oa9!f${athCkkceX{}Xy}PWKO0!?saauQ z_Ss++eh`R--vS)s2`z+8*n%t^0dAyyIC~5|vFKj} zmV0^j0n5EShYfrTI9Q4w1Y$}1F>oO}48l-sA^sp-i%stL8D(I*o;8QX3$mdQh{a|# zaA+8{>bO4mbr%bVF13t=!e(bKnJj9PULRqPCh%;&%v za101Zu4+639i-AL$Z}*=#8R`8e3R%iaENSb2L#!}_iP!=>>4ngUEpWXJ)%_O< z7fae@P!;l|7Q(&Q3bhYyz(F2-BM=LJ3vehGKL|Uq1vz0L5DSO>A*k~r7CqZNs1LA- zMgJ!Cx^EDR{vBZP?R|1|1hH^FrJfarKrH%f;6NU=>K+imcH3#a-FD*@hgi~P0SBl+ z7=SH!s|{@|oB&iI4gd(YO^w+M!P{)L-G_xwb0IxRM9G<;IK;x?*e&;GvDpGVxrJc& zc@A0#5o|#=G6J!rjRH$rnht&wKM2IanF=g6X9EW(;Rk_OI8DGIo&;lXU+!yO!&7hc zz4+x>^)}sm<%Pd;mHQIco$RZDi)XKFTDcro#qmO0GaLKLSo*bY<0ZQnr>l$H7g+gI zSGLUr^l915`{2*L)A63og>$C=S=Y49qTr>uD=&Fr+P07P(av6pmjv6yi{)-!;Wp## zO1V^|xSoF5`-0?`jur#SnTr-LnveHd@}34L?FQn-_6uxX0LE_)fr`DF+M)7}GGk3Ty|zFbe6_D;ec)6*W8&SLKyz^1)c z$eg1jh`o9!OndJd_WJ5L+UGkaO?%s*W+E3i)IHEr7Cl3nbzAc1M`0|*a_G5m|YzXCAry@kSUMm+7|RJ~(wF-WF8 z-bY~e1+ljPJkwqijNGj4nb)arfX=kXZ%gnvQG(dx+QGEhxIOnY%ea7`*f?ER<5zqepd+Sj~J9YaFeE7k^%z}{>z zrsEjTcH+N;V&nLfI*EG&7)4xS^7Jy-RtfKE*fXyqaU5b`c^QQF2>g*UQGY-3W!{W0 z!iH%39LiV173O86+&^_4sl2M}&%Tb-fDXs}RKFTy?B^l*!EcUTh)D@to6O*yx&RrU(nL+ zc$?SBbiC%|Jx_j13(kwT>}kilAJ+G)y(Q&d8R~d!l(plr#?iIroCjkQU<9jLuF88~5yme1m| zUQEw%4F=czviu$WhFFgz+^ZG7-tHFWd2QVtb@eH{;mNr&(t-DkxUJ_R?{y-c!~d`I zLwT{=xwi9{cp-KA;=0JX(w0E=wY1fqU@wO9hA7L5!z7nxm+EUay0JY@W zW1V?h>0-U@zw^}%%es$)j1IiMA!CzL;q5#UY5)5@a$oBh(vNXCO4f(G&?=e7uPP{c zqKJr3x8KjUH`Iw&a;_n#^RMuv$NMxKF2U6vd7wuQdgLLV{FOZ1u{p%UA7=A;ysd(g zr-_K!E#04MJoc6B+P}ubA7S(FaO^4B&2NN3r!%N{zjex}5XLuX`z#Z$FFc9~Rs!SS z@W>&F#6RQ5>iAK>e14W|Qwfa!M~~d0^W*%=>k)rvl#l!`JpS*}@?e{PrPb_-p8-7s z*L1vIu)&tp5A99Y`8V3}1C48e%Kx(-{|0M+c$_f^cNv<`c+%b^U4Lv-p8tOd{|pPT z4MKmL=PA$IcC7kgdcJR30%fi#B~V_UX8#)JdDVG{?JnhGC$1(5}(;)P(`JVdW z_rn;fvGMs{iotwp)Y?bRN7;JaafwBL6|g+>$~FjO;Rk{B9W1cnh3DURP=mm13bSo! zpIZy+^IhyiVxQ|Cc}A9N=AiCi#KLI+7CZD!u1(OiT$`YuL3SzxVoA&OwOkV+7QM|c zfdawg(`PwHN-X>V)T>3By;c@I_ba((K`i<_>MQYsKrH$Rz;aE2SoCarxn4jldfSfn z)3kF7`TATgvGCdb0)y~_K!4T~|KpEXKPEH*Fe=bt#AUky9r=l{pvx5q_Q zb${=}FvCSubOd!U9T_D=AQf*}79fLnGeuML0t}!SUQ*QTsUC0`5){C~&RH{uBWCaK{r&TM-**dxi0VAIy%S~~3g)@UvB05LoIrF*LfgwwzUO!kWPQ5a-aZ_v zjOntO)oV?d)1vFna>6X{Lvl(GM409BE^+dNDsCg9_9eMV^QQBnyc#@z=`YSo;?^Z^ zqnoZ7_XZFCw`MT0^_#WC-q1|@Ck^1#ws!L-S=mzk;9J2HwKX&Gst0nVhFa-NNjxo11T8V0!jsZ@Z|sbkvzm zoZlN-s&8TQ)@{<-UW^-)S7tA1cH;6n##5!(vm08H2w@D4bbIKOv5Pit>D z8lNd`vZrl_E`yTRULC^Y*%%1Uc55RCfzmrb(0QQ)-pPHXI;2~-ZF>q}#zwDvlHp>GN%wwI z)7r~{y(y{>^pDH$H(;&30kFsZ(I+OCANixTcL4kdGNcmQ>j$8;E3yJdr#Ud;ty$CtX0fZNZT-EjuqSHzVE= zKO=MM9k*uQRT`0nE^>lJm*_VW3h+8k!ztS?#uYMYIrfsWHJh$%tN z&HmR6Tl|sQVys>7Sh`7=gR27bTBih!(5%C~A3XrRl;`#<9vMDy%S886gG8@D{L%^x z6mO?=2~9AL5th2PduQ#NyWbu7vcDk(t+JKo%a7$#U8z8i$8y@P4(OUMq?6IA8#SKjl#GKsks*h z;u+;}z3ErC!dz^Z{upg|(kL9_m}rv}958WJn|EABl-tr;)E_06J4dEYJUTIFk_Z0v zO^ps+W^7wGYwz5BkM1`c;AM^MC3Y?Ftb7L^9uS^Y2NW;U%Ejh#&*5^>afv5wiP*fv z)8Ye>aM&q2F1E!SftTmtODHatZzf-#qYbH+gZU5<7K~-OPSS8;%zS7&i+U?qFFc$|JZ|>jycD{cTT-*HC1Sb@a zON?JJXeCM=cc5G|0+gCT^`ce3)m506gmh}L<~pqwUipX9TGiZu=a#cWQgcHmskyUL zRWn0OVKZk;QZqwmshP8LRp==6F||kKsZwk!a2YwG6SlO37? zA9cZwOY+pt5g(WLC=09}Qhl@Mxv~>RwEQk`2Nh~|-^-ep=I5k`t`bP<8|DGu8RAERNEu1MiDCfB%5@mbV=*h&c4WAzo&VI$v zS_$nf!fD?rD*W;M4~z`(TxcOBOj(G1M-2VzVDBj6-6`XI-DY-S)}5 zJp@aV+rQTDkJfHi(Y0vddlI`{{@1$*-#j{mV;yi`IEDG%lnBN9+!u=2k~TJ_wQxv< zz1x85)Ditp4zC=tbojKgkC(h%?tb7W$z+^RHm5wnZj{^){4AMF6UqlJ-cWXDxx2{U zKfWfWt|z>e)>jPJk(%6pMCuuTX}#OuE=l&aiIpjRmux8Sv)4T4Ny$CpNnsutAe~G! zpThm}5%x|vVnTkq?V~*u%xT4Un1*rc&yqx2PaSTIR8zhA{hzpsSNP$D)O z-W3UTt7+#2_yP-Q2>1UAJ8(TMY)0rA-xW5~yV6F}8^RVaUu+EcSm@_C>gNg49vs_C zU3SN%QIb+Wx-E(+HP883U~C~-GwLR4U2O`q(uAQl3o-KX z6i5y@8&F|NHfEXQegX4tW>!_Y@>NX6Gnol&@qJ<8QDDeU!>Cn#5}hdf181<5(G z*Po9_dxOxNMD6H+5j8abuV=|N+?`bNj?+7Zp+k^(JJoTzSX7tpF6vW?JtwLY7S#yp zv?+5l@wMc zm)^4odv{D`puYCL3J;qJ4Cq|Qd?$1qa1+}8^tlJodu_=!9w}iot z-C11oC1*itltQ zzSFJvPH&Iz^mh18Z-?*ncKA+jhwt=u2ych*b~fvVcDDFeZi^`!fVU}q|MT^o5`phq zKOZj*-i03~cn*kN_+8^(93rOfHK#=g^ZW?mj>r=3(nf&}jBmqEaCm!|aQ_5(aW8y< zn~g?s)LVNB2b#mWW0#Gn(k;)J+oTD1W23}cF>Bo`#)?xbrbJBl)_|vi1_b6sj4pPB z26<;fCm8RR40u->Qp4~}?ue&$4?Ml?c)pLq^En$&@Hs;H{*Lrdm|~JVQ;vzMC5HYk zXskf2&4~3Hed`+|{pn7tElXPBOsPfa5izRVnR*V_;wS9lXLiG&b_#PTu-jICK}<7u<^)iC$q%n(hhyG`i72G;m(dyOG8vrOD9ryRtMuMS#TX=a83H)?J)>%k8#5A&Qx6I zM};kFLkrZ=7O0~wY_T78hX|k8r*HtCl33A1Ulhj+9Nn-B5+Q;SBBu+!44N zCc32c@HPzIhQr%%cpL7lZiI9q;Av;rxeMM7hPMyG+lS!o-x~0iYM$(^V>!HC1aF^# zw=crVzi#U7d+_!X+1vjhmERil)*U_+snz#5!T1Tj3~}eD;v10e`~E-SN#ep&1kZ^S zJSXh02`U@x7Fq9}wL=4Ub!s+Z%@O*0)`+-a@{^<^o+M}sXy{22kE>*bH<2j24jFo^&yx~jSYQP%?zo@MEMPx@lmYlxHD zI^(Kt!<(u7f&$I`IVTB+`FD~5Zy#s>QK&E3xb|~Iwa9D~*|@qD zHsFw2(9;O-`9SXzYDJv4%;Q&xB=_=Z!c&xn)f#-)V#|sPmPqfLc|hRHe%&p-QDe=4 zRV{trydKwD)HXW*6>YxG^=&5)#jb4hR93$q*vl~NlK29wEB{?VRBz?otk(PL7xv3q zzkXfL-|yPLbkWX7FN_(oZT613?|R+w)qM+gr(GYp`TLJ%vota>-{feq@KXo?2}7geE+*^C*NE>H?3PJwVi5Pa)sn)2n-5t6m@%tjxAe+ zg-2Y!Zn@q7`5R3EA&r|f4Q+Ray*0uq)>twI*J@?*CVG*rb4NR8vT;{X*IMVX(QsgcI(Y? zXJ*Wvot-6eGII0qZ}Q}>z0+3a&JKLQG#I+9 zmpossyfWCOqJSfrESg>r&(GFTZBk+x5kYA3m5I-s!tX z5^Fbq_FBMzC!3nWhX;PJXwf*w7)NH>J!vrmy1Y29Wgp-p)@d)9xC3V!+4v z?g4*V`rGaE{(kSEmc^Hd-#%r;mFA(7_YeMM^W0JMeq8rN2h$@hubw{E@92Sc-9|2R z%w4wIFmbqb>r2x!T%CShe^Tjlup(*)95WZhUi92vdF~6>13kVD*`8$k?jg6m_2%~9 zG`VlsZP`z~UHtk#mpt~Lb_ee1a&pqd+D4WwXYSm0r2mAzA4}to-ak5T=%U7Ja(>(Y za$J7%&elt>6g~afkoT&)KQY%hZPyE3KWyoLti_l<8K)wewdvM$ZTQGmKSW+j`C!L8 zuRXe~L*Rw2>A&X=-*#~Q;~PpcSEW7JcE#!IS%*Sv#DI;z%=x6$aQ;Nly`L_Ba=g>; z{Xt6;W>5b4$7lck@3SMGIUcpQSKVEOD`yNg?{>t0HUIg=&rN@;ywgv=?!4oVSI0iG z+BEgc)Q8_Z-0{Wag%xF2X9c`5>dLn-1@{~nGv)5y-)~Bc{^)Q2dbeLy*ysPaJa13I zy3@unA5R`u_};sXwog6MYQlol&yL<++HG+1CvDcP?X$1r-x@zWsoj-h_dNSp`Ww67 zS`^-W=sUAkyjcF`qaMFk|55SM@ii?iJ@)_dbjG*~9Y!afaRep&d-W>Ul;1A~pO`T+ zb7OqqKcipHuYS8{WbdrDcgAk%axUeMh0kR_`OszCfY1-`ul)7U`cWH_uJ$w6+_81% z-JPqh@7;_arc3*O_w}wY)BCSAf8t-An!X<3|IG6CIp+_2^W|OF{$9JO*DFJoO)r~k zh >hZeqAN_D&>w8bmziq^Sew;S(x7;0eservLMfv#!P?FRjh~dgJzW7YpJZ+S z34i2_S=lFOMd%~PllOlYbuPnl?_CRaesXyAg++e<368z(J@@UP zcjBw0^Bo5~{f6gnzaIGaXAgIJKhK=?jN{qL!Miq>OnRl|<+nac{h-&x{>!ia{@|)> z<6gRZh@r=iw$~?2ed6%*zteeg+hg-a8zVM_b#L3|$_Q(VuipOjiw&nszd!ou zzdldAZ)U8g@{0$)-fnxyzWJN`ZhNZupO3Y>=j6mjTkbqE;p1`l=Pg?E+spZ#FBN_E zUiZ1vUii?zMW0j6x~(1g!?h3Id9=fY^xSRhH)N)@J)IRQHqI$MAN1*y&i9wj{`uK| zk2t=!u5gCg@zwLsz18X0J6?Un^yR~cUtCx=>y0Zf^^Cdu`^1m_)i3NH^9mMRy#1W3 zM@Z6l?$+&_49kA|^(Fr~&}CAs<;=eReWjzLhc?dHAJ^Ra%F{!tpD^y~+Va?#jEFW( z!&^nB?09Wi;MU)VAAG!I)q^XpAF3Jf%O{2t_bwmrHz;B9kAFY=OjNJCRu0}BKY#J` z@}GA8F?RLT)HgdOS6mGk^=#`81%t?ckA`bXTSW*i6&Vi_J;o0xnSx1 zbD3AZJ~Sfsp}(~}v^~uNPe$uWHdQ<E!dV`7J*mnSPqO zvFp(*&$fI2y*d9`ct_FNvqN1U%wBtbaOd&Q&i?+sxCzf5SY7h|XTytEY9oxqYUp{{ z*37&aj)$z%W>40JHHdX@NBWweF9m#LMBrnDy3^~^E%fnWVyhS7fAFrGiRj;FqB$v< z%*g)@qCRhw*XW_Kx(cE1hN1i)du*ZIY=Kv%@H-(>Na1M=iI(5OEJh}+Q2n9Tzl4z@ zWUo#WPJ9#(E`UDq!!-O@KSlXl{PV+aDhe;wgcE;B$G@fF!&PiWdarFaN@V=_%}6trW~73L863xfn5nJ z@$#BWVDQ&LG~>83-%DStVnNsg{S%13Msrg3>+eb_dOgHK1ZjY!qHWI-}og( zf1NJ8wm1@H4r*D?ir@Ez(!av0<=I~JY zFV^wC^p)^DUHC8!Uq8Jtc}*z_uEZf>&pLV*Sb^!_=fiYhg~H_Yw=yfjL?8HL0gr#s zkC4NC*DFlWdge6V%^R+kJ;fpYgDRgc^KIn#zUQHm9*q%HNa35nM=hUds?UF+3I7Q9 z*JuROm{9ibk|vzWlh-Yy8R`F2(^@L)xAl(gOqY4|#X`Re-?Pvseu|E#v5*Rdi64O@ z!Ek;_|5Z&m@o#B(Zh}zW5A9_8M>XN3Ph(5jKJk6fqN3#^b>*>M$KS2vx9RxNIzCmy z?}INBkQkRIuR*8yYxS-zuasYm?EhPu_~h>e9e-TIpM-t-z~k}?Rdc4;Z!dbQ*N%qc zNhn#eM`M!}3KPGpNJ+nw9A2#nC;clr{#zZ7*Q(bZ>0j1`2W!IL_0}bd(o)ptTj}`L zI^Lq=BXoQlk*#_{s7+)ef1`=C0Kc95N7?|z!9pPFv~+wMm%?t z)`{Uf5@wwNq(cu4(0IZ$XdXoSW061&y3A%YO&9G*{vhW;wk(B2+nHmbU?pRVNi>0`ojdTBF9I z&Wj|>`qP0UR5@Xm7XgR1RMK5eI9$PN3Aa*kHE=9Fyg`AuH+ap%Xu|4;W^ckY2pu#L znCBjDBDuN_VGUuctRfB*R)59P`+?^q(nm$CP0>jO=Joor2zONE`Gh+t_)%a>ln-;h zo`5_;l@n(9I$+-KbUWeOmAJ10$8}OLRbNYIALh7J)gn|mVV2W9Zi!X&3A3CoPlPHb z%yKGLOB_xh!Yrqvj8Nr-Sw05X5|0yzFw5!wjZo!;Sso3{_X}Z`_au1*P9VZ8PXy+@ zRTlz>s&hQI0-HDB1R~7(R2@TAhN?wecbq`gI6`~KP#niUzF!D)+zT2xVU}Of$O*ID zgnNPQ5N0|3=4ClymPcvigjpUB%zMMm1dgKu06j*yw}M;YAMg8W1&+H*k;mX4@8jA< zBd2Jg>YU}f3EzVgC)#+1icyCUyKI90)v-`D{PrexR$ z!fZbeIJCc_GZX*f)VNd*Z08ZegA|1IMa5Q-FEj+ES9=hZ9K7*KEp4<1!VUuQl>- zN$ybOKLDHm;lpg_cgQVNxj=+jj!$cWfq)7Dv%CecC0h{_W_c^pSLK9Rem8LFWJRCa zV!2KdW}OsZu9JjWJ^+~a=B0h_xK0vgo#DV-CkeBB4C&`8=@Mr7c+ywpgjt>r%yp75 z%U6gjt8ykB@su(V^e`T*nBr&H-QxJqSUBS$+sOLX{I{ z`BC7|>56`_KkUy?@O~rgZ}DN)KS6S}t`cVXS>V`7ivC65&}j<(f$&TP{|wA^l`zM> z3e0ttFw3t2b6q9Oatt8#)-l2?4+iEsMwsPINIzTgfiTOPlfEh^%2>0D1RGP6f8iRpf*@ z?jYa@RZf`Y!+^OA3A21W$u}r=2(!F`lBv%DNQu27M$ zCY_Bw%sMZVe5)cS%<|WP**C&0e+!s>Bh2zTV1CXJX8A$j*aeFHL%^X<1s?_GXA5E0 zKLO0o7Q!q)1%HhD#_<4_!`Oc73_z$2fmL8 zv;7cY)+vx4;pNTaXU)jU$j5A6bz1MF{OsAZS@x_+4`t8CipLFxW;*^PG~1CWhjw^G z=!_y-u6K3x8y7wHYR}Hj%aQ%KS^Ds9CbskblLgkjwv?sPv!`LT@jtQV$QLu`y2WD|em!aIsaJ{DJ*J#)rvQW_FJJAW2*v-2|IX`!EZUPr_0jAPdP znR4NJQ}70Piye!PJF>AZ(46V{*<|fz7r>D_bIMH>=o+XB$d_YE#w_`IPoss|Z)Oln zu;fnHT{5zx$Zrx4S0XQax;E3^9OY!^&d$%qO6GsMR5@0epPrxNU2^2FtOMgqVODlF zZ43QpMULx^iad!%2mS>$8c6tOYU%~dba>0D;T2W9E-DdFj1BBYtz3xIkqA>S%E*EJ zhbB$xHy~-m$iL!7PA0}NqTZp}#dr0BUTRH@2jGi6JHKmB76YhaB;8%hBxsp#UdAyy zKLMOvz2m*0t2Z3UcZ~=8zqc;=!}$KgpO+S)-QfXz2Qo=2pjR_tyuxJauKwqL_|%u_ zL!9+`P1G>@$9nsLDVanZL?JOsd(<7kvuA?yzW#h)el0qC%VFq}YOkrr9{ujo`d1X(aDF%F>=kuU+6Bo!YW8OT zCc>E3-Y^u#HiR>Ae#b&do8MTpJJQc1vS-G@_UQGmwRZ*fsPBb|?G-?vwYM7fEUt z*Bp9F$$(01?}|>Z0(uRVAFY2wakyL#-9!(cZ1wc~S~YC13k+%Pb%!23pP18W=i?RwnWHOG+JsRW*F821r%00jHZfPJbza`a7`hKvI84`Y~btC0t0K_nt8G!`LJFM{LoUPo90di2amvHdMDl zKh444Q5sX)WrBOINkZ*7OY0oC=N8la^SP-wJEKZXj?<$hgFP7evk3RGV$rv(nduFz z0cuke#E#h?RaY?+yADD5Qke zG;xc|u@qiGi(-RU|a^ z<4mOMgll5G{g9-+Boxn)*@ic?Q}N*_&{ z_%vNr+P570J>#Hz)hI=u)Or!++L;)YvNFXq@Q1OP;|`5WesITwk>j5l?>FIxp&7WU zH?H#0r-=5?*p9mHcfe2GubZA&Zey^Nl$tLd3B+n!-gN|GN~9{(s{l&b7P}2K>BO1} z%$@hgyyIX&>o05)Mt@hZ%ij^&U7DgPpFz5vxcwe%4}X*=N>ufr%5EhwMbQ(?bB&U8 zc6*U~jtkGe!ZWdHg=g}H7glu{Bk!rMmX_OiS+W(NUTDfFDK*knXs^IdAAEJNs8D4T z>V$749y}XOv{D0UdbMyTn2pw7m0c%jKaT|kspZuR?^#GYSL`TWFs%7~@x^7{wcZ+9 z-{NZN+>#$kQcIJIb}#C-Xj@Uw;y1l@L^?x0j4M7`PjU)x4X+1h?iNwFi^rj^j`Mk6 zb>q4fc9d8Yp6jEF8w%rR*^S=2yx!j!R^koQ=Im<3LIjQ)=FRd{+2((K4$$CF%}e!N_^zPI%K z4;LS+II`uVeIFk9;L!U=-#hW{sXb?F&%g6^)%4F|iWaKxbS^bsJ7b|JvAZ?1a-}L) ziUZ#r`gyR@de@L%_(U~_gb4k-Ztv`Be7U$wG0PgCEwp+^WVKYucFudh7NSElQhoJ@ z)_>Bj{bAS?ETTiBO15aOurm%%<9}d1h)r0{rct4Yd}blmI&lXU`k9-6E8c})q3&Xn znEvE0{Frt>86c)EJW(FCg!78$QZcPmbk^&Gbf&%+3k9rU6h6=eX&nQ<)^9E+eN4a(n zk55~d)@1Cpfzt<_8Z>P1?!oax)(vSg^y-9Zs8flUhMQtf?LT1Pput0i4!aLCWcv;6 zW0iMhw5qdVWm#O3eWcaaaZVqrs6SVhX4hbv@9mhv+c`Ea{*EqPyCrn*(X*HDTal@E8!nx`|LaMaftGns z1@s-;w_V+R|9dQ8eq28LW)FL$y1v|*Aqwr%ieEs+VvVM#=9QTVC6A03U2YG+vR3Ow3EkgD6 z8_D|gQ&J&?_x*%Ycy0rr7A5j`4XdmCY8^jI$EWM~M|6C-hOh5mV>!Lv-tfjc|C`F; zzk9d$Fye~~9zS`XfErl=A>F?0-bvpi%j=!SeeQA-fne6{g{!yv&DPDag ze1MK$t<#^V3!kpzPw4oCI)1y3uh#MFHR%Pacqw%J&_YJ_fySsRr1(2V$9sP?tNFV} z7d}GAQ`?=^UXG4mtmA1comQX5#xh^OycK^(aIosXue_9SUwtv_>RXtc-(qikh3}x_ zOLcs_jvu7s`{;O|KViD`TMC{xr`*r2b>XdL|9p8?_yVtey?%r){%wNqoh-!h!(KQ( zTV$l2Y`=@wp2A1!c;Ef1kKbNr&nA!4rRemYkwiz?emV(cvdR1x-s@=-r&LVuBncz& zc%ECj%*P8F(?Ue=G)csXi}mXQEa(XxP)q2s%X0czfwAOke-g4*Mms7yPl zOg{e8yo)Wm@QZ$|tz3g|bm8<3!$kHPspS<5O!G8ooqQ$==Vu9BW7?}rV@|%tuj};7 zRfW4{{l?;U)qWGmX&%SNs{T=#ZzejZ{7P9rObl0fG`~W>rFg6!A0eKDoJa}3P3%=z zm2WSeP?airh|IB^e2Z1(U4S`{gxS8VLm2|m_ae{7hyspP<*|e@9hPN27NaNY^CZ#BTN?QsI_$HDVMjuWQ- z70}l>;;4dvzQqxz`b_@wybkg?7H#ZA-Epw|9>SyuO2!dKHvuRG2kQ(Wd^<^%eH22~ z2N_lCP`Xh-YjA|p!yHtBBa{jZv<*in`h|&J$H93d%z3N?j*Z6&M0w=>+X%DHVPKw9 zaSE8{R9w{P6K4I(8vW*YE`(A6fZ71_{X&@aqe=dlqC=SF-GF&+Mjygdcp!S#b6yCu z{%~N<3w;an{EgATJV#<2$$KhxpZxqM z%<>}OIMoO8-`pQ35MkD#A~ruxQstS(a(ZsW4wS|69&F|UA7&l7JXM`R2sRfgI)qtg z1Tfo42R1Lj36ze5b*2FGybij*%ubv@gjwfi{>$>AvUY$I!0?wxr_(BFs8epCi(70%_~^ zdhlHSgjs(($<=Qg!YtpdkrQV5A(B(3L4;X;6`04@5@z`|;D`*IK!jQDFF~I!GKetC z1A!w{IboL5dx!5e!YsD{$2t@{9Y}`?5=5AFXdW8tbSE7(zl2$55HR~snB~KO*?+<; zr+I7aKVgy>@q@(&zn006#Ap2iHI7`Xn0$`p$K$!K5 zfqDJ_VV0Kyn-?i@3A4NcICP>S-%2`<_%Q2GTNFQ|2(x@Qa4g-FplZ@t?8B_HA9B9O z50U<8MdvWEWwH;m{&C17R5@Xmp9E(A39~$HLPq8oF)e$VW9EGC5LIPd?IdMjDF#8_ zINaAUt$|RC%fQx>d5$@G8Tr|ha&l*3n6VZ`Ie*G*{ng2xo-;$)Safbi-kgSqaMQS1byzEn{#HgwXJ%*R=gn3JPt#?bGgGbr zG;~@&kh$SYpM%WJo+9G&^5&v2v$AH*&YgVI9MA>B*kpNJc*gXsN%+49(TnuP%GltIzC za~lxO%AVbT6so8L4Fq7lxtoNbkZ%$~yOQ4A+Kql@;EK_F3B`GNAhvh-_5a}j=~RO< z4orE9VJv5ReCPQyM{RWqO~XIJCYA55{^x&wDoBQsUatu&;Xmv3g%Tx`sD|a^1F;n_ zJrm)Q92SEAHXK@e$>8&GFtNS15NPc!hP@)l$R0JnP#D=W!noGnPRL?$FtI&yLTfKH zOj&1#>;>Rpd-VR(+B=J|t!xbc*OvLBAo2u(s=C+(%GAZ z8>$V$nb@9PXK%H|cYh%3UVH6y`7MXN3O0uSY>&P(wf?;fdsI)!Ke+0(Hy07K`R#(r z-jII}>--yob}znvsR@kB?`dGIy&*TTw_J^ri2p=0HTG@;&-Ts(Ywb;ey)25L66f~} zcx`?c!XDpm7}DysR}HMSxBn*oy{)r%S>s=OjXnDG)Y`iMd(?)_#BeqQTK_^&$o{BX zbUkcp7(K5>tM?nnyNHKHDCA6(77?v0N4T5JVQxC~7?X&?=(wh{7ay!#H_{Iz6_xN~f2u(_?!r)O>J$^Pq=ExtG}97dm?wkl3JqwEh~!VS9^j zqF1QXTMfN*Z>qj>=?-ILuZtRX1$tRJJqiy(g7lwhJUx^(#9?&+NO~p*kzRjh@SpX1 z!Jc;fHm&JH?=`9~M65Rq#yGDe#{eZkb4n>Z9|x5))gOF@;;&m59>jgC@!P$-s@tnt zZ#{l{3hoU`uR9KEF}n>Mj|+?`!VZZ3Zhzsw3SnOs;Aw00_a_@%X z`$iy-gj-P1t9WL{t{iJZuU?t+cTKiFWHya1b{C&dH3!`Ok^9O14}?~wRkf-eUu&qt zt`&71G4{3xcEd2LJD8|@k-lrF8->tpgw8>zyM-X}r zp+6zCwqEFPgoa5-S3WrACNk`w+!T+ZLq@&c4{pPJZY$1fzZteMgD7%e>pDgZiKie`Fd%u zAzd@c?z?J^0;9NbWa`8Nnfr70P2D@aZf6O`?3YSIunTOUyOGh~Y`kRHSJbnJ#>Ubv zZWC7;Fm9UmU#k&@Ey01t5Tn1*WLv*45aUpnx-jZCVUa7zj9TMJe^CsoDI8)h4fZ!T z4)J$4zGN`3$P-gnB$T`$Mq?Bv*DJ&3V1v;!`5=O}R zn;SLy-RzHgiJkvkA&%42q{xA^bKPjyDWAP9!G;7^iR3YsNN1mhcU$-QB^2l48W~aI zjbytt%GlKiyX0Z~ylwr|pd0s!%N%lONb=AfL)&N26>R-*@u`ZFTTbjde&Fb#!$%LD zIC$#7+5PADeZBYFx_HcTm_lO{{SSD3_+jvZNzE}HxZAMmVTXpC9s0wV;^gptQ3JY- zs~&e~Wagw!Lnp4gw(i8*v(G+$o2PECl(6TJ+q1GWKq%M)%qf?}A{+=m^h52xb zv;#Z)xYO)XH|)ydPD_=#ne64M>nhf5Tf5^~Pf8P{`K|EOz9l?+{t)h?MH1~Wa~L}s zJ}E^8*q68uyQB(ZZJGP)Eph-cq_3k?z}w86Z_-m#ZOU(L zSvB(5XU+CCo*Jh}u>TY3?Gp(#7Rh~-a_9Muyse)nl+xBxfAnubA;oS1Bh*`HC<*@Tv!}CFs^Z9|2 zb5n_A*z~US<}Z+Bi zBHdA|XVuN!o3n5F{)q>kI5_T5=HZy5@yENJ=y|fwsoj-ps;g`AZrI+b`yvCe7g#{Tw7rri z_ZMNY=7upd{#{*DHFJz1U$;Pur?4f!3Fya>>e7P7}=Cq@HQm_*z?ikvisj4jDix(tMR*;mC z^8|K>I)q(e+hJe9tCA;kJa&MZhW#~H(f*p^)3V6@Q3tvm?0LwH_k3h+^5N8@;m0i} z#-Yw^tK42q^<%4d20~31q8#MOKu`%P;j0=A7 z>fotEP7E0|^v$82P>0$-Y>RJZ!G2E`Tg)dn>8cC7XNT- zgtta`Yg_b&*0!iuTE~BUmnCYYb|0AtIEzK@ag(*=k zr?n~qyOl*?x3UQARu+NX$}HHe%;JnmvS7C|3wA4OZ9v&zx3bpQt*kY6D{FNpN)=u?l6lwl#XjoP0E7cH(i`^pW>}K>X#ZH=%sRQfMNMc{fwjNBjT$ ze|HHaO`mU_JtuQo?(EsQGp1YfXIS&6WLpQ?(^9QiR3jUUmtx2U5cVC|Xk)j{MxYx%u<0xw9#Fc5YVo zEVzf1B4vlY4#K0zc(P`yUuk zHm}3!dtX03sMpkfuU`&pwV};BPwvd!@ojeTe|I(bf5hI#-!47= zef{2zGkyqvqv|7(x%;g@;%eVIy{vWjKb~Jx{PX$M2ab(>=lU~Q^AeWy-Sq4Gt`=WE zy=s&?M z;!~dn(IwdNL#rCu+oXtaR`h?@@b&Yj=#TJ*hv@uoqT@rwK~*;q|1r~F^itEO_GAgI zf7GT=gk~)8VImYfVde)@Ac)rQltj4brLZdBQVdk%Q#+!B(ZrM=YNu5wROS~li`Fp; zzoO$WY4|9FcL0y3U9UazNg*XZwYO_|8ehnKKVb5O+TqBb-@IX@q36xI@D@5gOvi`o z_?9}pm5#TF9h5AnHx3%BPU8oe$VVPaO_;{2bKRvp(OC1ZRpnASJWw7-L89Jrcrfzl zBeLW<|vg_nh2ynM#rB}_30ml(>O~e#YcQO$19TN_{VLek-#h` z%yQD?vEC+)4q?`rrI8b6IiPn=D1W3dCYY*>8JsOS%=no;qljR0kaNa*4amLwG0Wf zoJ1@q%<{W6a>6YC9saOBVU{-```w@jBFyqOnsf=XoNV&i`&#>nkn`I6gjqiY*n&Ps zBEl>m034yp3A20%u%#tVAi^vk4jiG%39~#6*wP9o5Mh>&0gh1Rgjt>rY@v=eP&y8l zX8}j3a>6X10&GDa9T8!c=K)8ka>6X132Z^TI}u@)=L1Kma>6Ws1enL97XX`k;sh$d z!8)%3o4ex#BFyqSV6*y=CCqZFtGqYCVc<~eXagO`VX+eO^#Kz;i6g>FNWpC9GdeMzz<42X0~UN?E}>B1InNq5QtCFUy^d zpWF=&tMQrqvte7T^%n+Cv8p_JiigU`j$stdY-I(@hDPgfJp5pz(NuB_b%9Bh<55(9 zvd|?BbCK7kq?Ilk8aahga`O6;-jQkClcfxEyK(qby#Z3U8qM@)`TCQgO`LUkv=R+Q zQU$bZBQlYnK?^g^pC``AQ+Y1EN+Ix(2NT3qi`vSaHZ#5YDMqy&T&mhpIdl~7rf{fCov^d?j z5MOIA5(elShl%a&f=p{KL>-$$_UQ9~?Pclg(Y}rJ&CSGclFr^%*h_;F*`xAhdxgMI z^5!dY5n^h_8x(Z>@`ut$nJwUwDxFyWco&9Vtb<@(Avw#`}HLRl0CZ4 z>|Z=&6kUDoi!acU+8I0(h0(EB{m=HBqRSU>?*JP#<3bUlbzuNm^D$(}rrYCRI5@HiY4 zhg`X%$DNwh-K^GIj}_?JQ;Bfvu>u$28>QDB2aOfz2u>L*5L2`Yk}nJJ9yX?Udjrt> z+?ZBtslVcyZ*8`}9%n%Tk1Fu3jD=q5BFWniA)N_!QGcs%Z5Zmg2re!yj`H@vqP^ag z5?Jcvt73|RUD_V7NEff*MC&z4DYmWtA+~KeUc#~6Kg4Lat>4tdR?(rUwB8wIY+~&1 zSbAOnH8$LCZ|r%pPIz`66FpbCP4+-r^iLtSm~$aLUF^HrSb23pfp(>z5&N-z7uH@f zbTl?`n|``(Om(Cm72Aub58BYtzj2A({OC`@W_`5@^&gmx%S2zz>Nix@RrZ8pdy*R= zT$<7uL&u`V&W<&W4N)mgJf;;Q;k7LyeuXXeaEL8_Q;1Ye@ea6r>&{7MB3)Zt!;1H5 zdNycXrpl|nHHR_>(W*l?>X9w&8g|kdTHQ?YuKBl3&YM&fUs7Ush}W?44y{~g*yP_> zT5s4?)VS|LsWRAAFITumNvTq~<~p5eESI}svwvgf=9I>UEy&-Nn#M7e@zvdGde*s% z=&B~AYOge{)Z{G@IWN4*8m+HZetT z%YA9%t1f(TwAYWV#lMpjl;zf)6Nw`WL3R&F->i_itsA3Z;L)c-@>JaVs3UdHU%#N2-8 zoqenWbF2fAg*kay5andgvd*6|$2wzr-h7<0t@*h#<$frNmoq0H&c~uFYx-;lmUN$P zohL`j%(mv{$A4rg>z-Af{>k5p|M}L)@1CgM^p9`u?=(H|+6!l2d%owlnMeEX-ZXLX z3zM5KxcXb}iKk{QvOIh$c%7+HC*#r0JD+&}uAWbQ`u5-B<}F&h+OYle=%9!(S3MoR zxO#NX@=>mWMFYAXd+XlIr!JKbe)QRMa}Q+~AE+Cg5pFrtXzYDKXQw`~H2%GV>854> zlUu-rScLBeCTat}j~V&DLDc7s;$!G5?|f1)>cRtbe2}a^%xhEO>34)e3O}4#jHs`l zUL!d^e|ORd`TF6F=)#w4 z`1*zAB@AfT?_Z<=IkHfv33mJe1>8_^TTIZs3XNcM9!OZLi0-@y-#M zC5PW8+do7RWNIm|k3&sfRvhGCI{p(W`fX+XD~br`mf~6Dhkoa@#6kMxkFSltrC6Y* zPv6TD))S&|n!~A3OF`qQr-5mKgX3pv!nY#45MlI0r0{vFJ+L4>Z_$NE==e4|{x%)o zR>!x~@m3ulDb6d7$iLmFkD!IucjY$%wXZQz8N}$q&#U#5%AEQTT4?e|`n-=Y*&v>- zD-r!Jqdo@Ty`qFCsrF0d@E|c;m)<*?A2wv~L0$MXUHDklpWd>)M&dJW=@jDa@}J&JzLDlikvXZNy2?0!NBGek|^yKtb?ET!fcnt=xy`GjU~Bi zlQ8R(CeM8)%yPOe=7A(pt|`l@%wp+A07c?pn}k`XJIM#(1R~7xyMZ|_xo%cF2MM#z z5YnLn1JONgCIN^r>nsG0L;D1g2?zJP$mOQKh_vO_mUPs9nhu1iAqCVE2V*K4&I@5q zYYfR%n}k`O4$N!a6cDBY1C`=neZs8&6fo8O4ZW}Q~woIr$GryMv=wIkP0dI5n5vkv)e9zasX zf0oPst9>oxb0}pLG!6&*Lzwk5fn!zuJkn8Ls)Si5U!${_bcW*uBFs9Gz-HA?!Yrry z$^9|+0CRr~6)Vdr8(jYhbKDlB(;g=fT^@nnB}K|&7*MwoyNiP3&6aF(nZ3mpWgyo?!XB|nDu`Ej!@-< zS^hI{To;@`S8!Om%239v^E*Tls+=&({Ux7ogjpT}9NSH?L;ddT8}$WRR3&Y{U^wIv zs+=&}q3=lZ1BxBOERO_^Q}Y`|Iw^_{VbqNgD0T?5JPVlpw_*9_IGU^O?YHwT0wDL5%|tT=_lnjJ z>DGni`o2i*N*2n5{{L$CshavNJ5Xi4`YTub*%B1KoGB|&WGbsZkQHi@QP-zXrQB!u z*H*3YnO3`7xzN1Eb#kwHRo*}!?4R|w{)I&;d@iYLQ{3RvUtY7qXG*^ug{A^2Ig&3) zy_PHSU+(0UZRysi@Rp}e?k&$-bqmWz<&NPS%Y$|nWU1Gny5xnXM#~-I^~VEbVATsv zS=2Y8$;Tv8M2~d6duLh(b{6!OaYLQd@){G|KkZ#>;=gHEzSa1xrT*NK9~w=}`Dy&u>#2`rS%dXH0q2h+QI=v{4Zhb00C&Ja$x~Pej?;*s zwMX9uJ#jF3?Ez@*y$pM4P$GLq9BhyL*V?1^a3BsQwnsWzd;U$7{!Fq*KZn@fT~O58 z+k~)E987GlCzQ1I+Q1&Y>&YJdv|)QAk$J7Xcrd-$82+<8np>>3R|9)wiw+vz#`YE= zg4Q1W#{B}}Ol+?hfZ`;o0T*D8+7-wi{gh&R2O!hhqcs%Pt8wTb+j|#ET6@1Y6`~U1 zWDn45kNbnUUVRM%tq{({_F4dF?Y$N1yB^J;%>MO(Ls} zT6?tTctd)5h^W=;3B6ftObsKJK3TMSTW_NGs4iU#Zbn=>FR_1zRC`_2kQnG?d9{?Z zNcRn#I1UAu)6K0R4qF6(q-Syv>Gfv@|5?w3g46c*2jY2(tjO1m)LCymjBy#0{5b3_ z#WkVudvVb9rFzIkOYHuY)L$;y^<_MyCUh_L(Fa|U&lhM{ zG3_o&F~u#Ca_3-9;-$js!^zl@z%@xa&7bm6Fh3s2U zAjiA1pa7#AuzOppBOZ`yMXjUYXOY(Lr|`1=j?uqa4m6%}tnG6_Kf(Ex%g;ErBJ zqUiOy1O$v+L_|eIL{LHW>J_=Nxbi=5RabX)WjcEA_xqmb|D7kDK6TDpZ=G7Yx~Es` zdNAF4Lf8M7(C8O;0F=>P58?bo=Jzh~?4)}sWN#K^BqjHWG1lU%Jf)f7aW7>ZSdk{)6f-%Cq)vlQQ>an}&j*6Yd!%Oy+xS?dr{3qCi5FbZ$FHZGX#JiW@ zBlAZk@V4KN(a_PDHut9{t+FWkv*8Jw*%Ggu={Bugn!YF!^K=oTHepXwo781{GODvH zBhQ44t>MF&M!S_)dr>Pnj*QG**?U*++GDKUlP!8T?2BW;dH2O&ZLA$Igbl17>o3mm zR1_C^_C}1g)!D`tj-+jCz>rWT+PZ@L{*ofk@M3OLa`;O!sD8Uk1}*liz;^}VA2qak ztf;f+UTI@P1rIoemFz4LXtWMWMEv0iuP~HddDk-`|I!R2XXS3?t9=w_CgLda9EeOV z&aoKijUR0CnnPC_%ZaB~x5+_Hi#M*qtAqx61t)#MqCC2nFQGImiEU^25~(*Uk`;{KZbpzqzp(Te&<6!u3bG3N{??=-fh8;) zRT)E3y%obMd!AsyFHW+`{@1XImzptu$(eJN^Iu}0E^EBCaBB?PQ4*Yg9s8|G<$z|! zeT%~7Uc-OtOoNKKXBwoGIb%bsSHyV_BgWw3?IGH$PB_jwt@8G-h&z2Q(mz;yj78%8 zXU;T8qGP)7gm@!$NC8t7_FP>t}w^ru9Oh-Kl z%*d*wnu-=X#(rx`trhoSS-8BK`A?mS(purX%`9zYuy}jOK2lLjlr3ZQU)ZEF9&JK> zL2dH!^2?X|dp2VWo6T7M@v`5VG~RkeNx_kVEYxm8u^6WXTaB$WO13V_-&B&i*hhP9 z8lfkQt&KD3*no~GhV)%S`=Jl{U7!QTb)zrb8d-gmEtEkL}2Gie->>k07?cujejoLOJ(LTS~Lc*lu)f z3ia7-)kowSr0m`K3>)j+GnLuz`Qh6p9d%$^Gia~xJo@Qd`g&=fB|T`~ux57UyT&-? zSd@<~7BgVG$a;RK;2zWZRFJYBOzo4Z%%`gMTz1Os|`ySS`cx!PM&CKl< z+xH#X$3o98tBfQX;S(<~+8X%Yd0l3(FoE{^n;9KXm2alrO$sC$k<6^BVO!7N*0=a{ z@yU{l7Oz@t)p)HyoKOC(k$LpJ&RHc7l{B^d8zM1O%VAWXr|6hpjbTxKHR%h4V={r2|X zI?ONH!-w`bX;dD~rP+j9G9LYyx}3&f36(TqDy#HP4TTTC&MsQrs(&zn^!#J21>Y71 zj9dEVMO9f_Z!7+t>a(iEF8gov?M>OX7xA{8w-~c*x*?BBkhgEu`BvVGthl$2>{No| zHy#V^{hRmo$5Q?0g(=eX41Y-+9Ss+v{^jpd{g=LZ8`ZsO$yRD_+1eF!UndWG_Ji0@mk-N66tu3m*;747SUP0NM9hcliyihqE?PaKIhA@@FH#3U!>*v6PyKf@-^W3hgkVVdbpN0FGZ2H0e{~m+^D06 zwPK&gASJHJd+1G@Xb)Ty7Scc~uOavMk#4$=2Y9=G8nPkgcxX%*gU)z0AwNWtk+$=T^bRY(NZ+TWPipB7R{aD%U-RQStq|c~tflRDJG5k36u&JO@_2`9csz$D zMDXDq&uY4ZmcCibZ$IxZ@;B1(8#TQBK3jpub8%{UUux++S{l!FtN0U|e~#vVK})aD z(u=jU{Vlte>|15N#vP^3{=b;FXGn%a_ibXl*z=D_+v7{52Wa>`T6(gUw$F`={3A5~ zwOYDdOWWg7A1h`9->pl6K<7{A$-vr0w}% zr0xA#62m!aNGDo6^fZ{0uPra%#*1`Qo&*2dvfIu4nA1G;ol9r__B_8mABc3Gm0zSU zP|~AgMIx2+b=3Geaz1C3eA7%e?PNjvM?o%3B}`9<1pFOjy}Q>5+fQKaqTGm+k`@om%6 z_V&|VtA9@(kG+2v>DE?$k+#QMPc46Mp5Go1BAsL97wH?d^bRfkfR^5;rC-s~uWD(Z zH6QoZ;=7c`XYYSS`c^ByNdKy(S83@gExk!gpHME{%-5zHZ&aZ{-q$^So98=-G^`N=^_2ub!7P0m{B7e|K3q1YeH2HB%(}=E; z&(q4IlR8{5MjO%bZfmnV7_l84*V1_=|74DDz^*s*XYh1GejS-qeqTc)yh{lQ5*(A@ zzVlDD^6{*?6qM)F>Z7B6jG3Xh2}3b z>wB2uXhhF-tkLTKjF!GsOP@32{}*vLqW$?sbH19&(?Qn6>_5bS@(*bBU25X@a(s8T zRP)R4RAbCHqSn2E))3s!*NF9IFKYM%ExvC}e&j*){Kcw*+ zT6KruvD7K|(hc4|2q^tM;pZ~hZfPK8gU@W&Z?a-wi`-Eh(zSsvLFZiHK zOmota7k22U_y0mv8J=q*Pm~T_e<7CWDk_WoP_aa^LK$rFq z>9T#GOM4dS_=X7ty0l|oA^D+8`!LcaKXhp)mA3=d5NYS_Z?>V@{%GgqL=NTmHpup` zr{u*rknIm$a-yB(JEzcwlBW&qASU7bAS1!*KjFtVF2DI3Al<)}{*eS|kuh{2U1Cxd z9sMQ05lpI8E_9i<);2*!NifFbyQ?sMq<#@}6Vr}#`K@6L5&w4jM*>}zg|vLu0PP^Z z3k-h$TkwjqBp&VQujXdQ_~d0Z6ZXr1G4n!~c{#s%e?DTC@j#at-friUfdp;kGoK6S zLHhY9oCLbWyMy1&vL@$1@5cK~u_a7Grx!NrqL#Aa%?q$tm2-zxV3H z04K?y#b@4gjy9CvJ045A{~h{A0$tW+66wh%|Ba-}`_gYF-G=~4=FuYcRnWV_DxT$$ z-!H~-oPRerGw70k7wqo}J9KH^N4hNcAav7lm~>f}W2C2`q9n&@k>4!-k#zqaSQ&rc zmgK}cvt;{VpC$DG>HhZw9=gP18<*cTJ`Z|tf#KUS1~Lhn#{U6Vxi0g^54Zz)A8tE&lyn<+?2E8`wVtz?=MgU^n$ciXBK}puopMA1?F+=);6w4>~pi5+5yw$*0T9QrsM(8)eDxMWj zo-Xv4X_YcV=-4(>CJTKVt&%YrkW|x>GLx(PpYIl-H>H(tmeAv9l{`o2Xn(1A^sEfV(D&^*3eT&`d$gkA@BQwL}A zN?~tAE1#*K4}F!eC)3LRsjbTx`j9Eb#AlH1!zD-(KE_rH9c|@5Wa~2T4P=seo0Fb= zpTJ=JC*Lo0#P54R=$Ao%Q0OQt#l-V5{IIZJ3(Q)fgI|^lU6wnQbXgY0w*N5wBY`e4 z=$;gl6XRLd9lFFkM7rd89GJuOj|95JJWG1=I#?M$29U>}uTWZIwvsOEvQyFbKt~}Y zXdnMBt~!2~1;~{Ah_H8q{+Q6wKK_qvU6wTjm`8LidWwmkr|4}+ z_dP-XNV?FH{3KWTF{=LyTbG<@f8SHWj`mO4Aau03?`fff-}j8r@1d3dOIw#b=<<}m z3i~Etj@r7!93qqNIblBz9i2e(FIuFIV_tN7_@zSk!G5>UFSv02?fFKLQEDtT?l#^qtar9X zc}P)w-PrsZH(uLX8)p2pdDeSfYd-HNsQ6Qa^657EibXAq>H~-4YllvsHhYftL>Ye= zOr@~=Q}oYpTThYc4)@yriTBBh`ii&7=FFa*I(u$j-ppBZawj>SbaXF*zKD? zj;M}iqK`t?F!AT!@KC9EO|4aD5$2>^Jfw&ZmM9m zP`A4I(B;l2Yh^C_aLpY0zRwI^t7*6C53wrGpVl(1IUbxf--;{?5RV|qugOa*0@5GD zwN37=XAjFc3-at>UB4|a+Vc{D%x0F|cde z_%5V%35Y%IpZk9{jz8~afnQB!Y-GHZWOTU11wY}T6Pycv*^+6IBKh7RoXUsyu9Oo9eB`qDQixoQ564!0 zX^|rNIuK6fTT6UJ1OgwLN5+>z8B{(TS4E2t=Rs7yHUV*b2);yx59f+hKD>|OJn~DC z@!@+WDqnd({GI?`U0P&(KWpuW^H{)0k$k7L_Iom5$5)@glJ7>XzBnf}S(4FO^5v4E z#@DzNV^!ow*$rrsd@bUf^*u;@8RVBD`5F^W<@^ z`EabN@{MXOp5q0d-}GVpb)`k+n@R*7U@%4Uq0d#mXNYeO;lS6#^nq^?*;KxA8fQ(( zE=BS!B#_D%Xd|`<@HL|aKJeiQK$Y)t;=?u~Me=PToXVF>d_@ETUkh3!-xzJYq>|&X zBq5wsM{46`Bk`>zC-_<_e7Bo?GM|q&9)eneav}3HzU=n)_`^>P;85S6h)At(H{$yj z*`>&Gek28XLZ;(Y;!B{6h>td9i|?#9AGD@{Vg3~2IVIn}wfSIM2YY*KrSKip_^u$n zF`P;KlYAd(d%r$zEzOg6Q?lWAvlt0befGJW@fY>2P7=|g`M(xUSHNJgAjk|O!; zB!kM=iw23DUoJI$;LD-Bw2AR!8d|YmX$PgyaSqrs;)GrD1J@W1Q&1MK9pOZ=0%hv`S3o(XnYBTQ~C0UPj2TS$}jo)5E=MT7NiaFO%f{q4<8nMw+d@1 ziwUQS^j$+Z+C=iC54ip^L2HSdO#!IyS$Kxx^N}C@29Y=%l*zinzK8g#Xo3GVT2K$< z>)f*^e`|vL*F`F{7P|P~qnmiULbtSF?=+72zxY*K~;WxWahzh#zf@n_d|twR6fUP7%_ zTJ5E!B0Y-#Y)lgO|2nocj@XpcpNP$lg(dutd;dQxulfJ9JlURdjk-wA3h#-Z&8Paj z-V=CAR&I^-<_sU5i=ZcECDwd0+#7oWPlnSsRR}Mh;aS%pOz)&d(5{qH97?IJcRZyd_Jy1LJ{f5K7sE)_&*yU{q&QB z?^E(km$b_@?TWd-%EeE+B(YC2`DH%2md6G8F8S%ulGmZi#ZQM~;<&OTW3}m%MUKyMKNjAfMI{#Dk`iew>FuA6C%<(fz=|FU!~c?Z|~b%%=sS``eQZ z{wi7^y1xV2;CJJvLwtU2C?6OSJwF{{bAJ__B)b0+vSAFl@#DM++9RJ9Rb=}#A|w1& zs*`l-$9WPy^!Ps;B>gzvMAzh-E@_u*oEL$=%Egc0X}oJqewk0Mn~@*ecs?xtQc zPh5vb*XPrsifn)UPKCcpb&@XqI1cAS#~eQrCjIzbTHE;SVfw4gj542G_cZ;o{iR*5 zdy&7k@rmD^wT;g{rr(VpzcXtapZFbD+xWcP^tQd|DvVF4t|z27eVT5NVg|A!Nfb zirPO)k`1K<_VI51VdO%a<0uP_f^DVE+K=B3Ar7 zB~;Ao5X|2YalS;HCqx?aE(G%{1oJ2a^CblHA_Vgv1oIpO^BDy576kJXB*gzSmTs>5 znrqA-kPNY6m=7RXV#NaHy0y7(W3I7XLa_Zou$@7Mh!x*%pkn)gU^{?hixtDThG6_c zFiurT&%7q3Yg(_A%zk|t*L$Z~dRq4$mJUq6zWpqW)Pa#Y$7J=Tl?}6#9BC&3zADQu zRO*09ofD22ZnK#>r;>K!88zY>j)7h3$lJf)P%E$0fss1rS1|odo%2gOD&B8sr<7q= zrHn}LZ}I6iGmnMqmp(Le$dG~QR_odZvxzMOvZDPh1CNUu+cr=Zw6bO3rKtvWW;Njc3$sJTEn;GoxzYxl{wPpcNfi90p`@7QM=*& zYGvkN!tt($#n>0=c)P~1z2@K-ey`^DvU+A?3xB-kk7rjq_!BjMBAaXu9+AJU=C8{- zn1e<5>udh{tbrrG2AaPCd&WEf#&N5Mj+*m$z2v`!Y&0F{%40qpRWCOWpaUH5*YJKe zz>F8P9=hAd$=8JQ$zy!n4divi-%P_dWAc3kqJAwje+#zU5r0d~-%^XeC7W%=kK9NLX?(5N6OQ&v((p;Fz)@aX&EJ+Ca+KFz z^S9T^YtPwH0 zd{WX7omg*>f zpynUQ&N#-`V9h^RYtO;#BS(7<)$l|4eQ+3WqP?!t{8zCm$9TV5^Iy$oI@9Y^4wNXv6W zNDp+>f3}u?wpRbytevC&b2a>2*4iAuBA)r0f4&xvNZawuXID7J*8(m70xg~etgT~w z-LBzpXBlQZKHfeHHUC29arpnD`TxRhaKuxf`3tmo3Rs3Co@$O;h%Nq`oEMOZ77 zA2vqmCk>%tzBE{}QHg;|(uEd-r5HKpiM#+$muUG**bj6<4tZt%FC68SYWPyNn(#Qs zC-IvwF_8plG1y%i{w_9<@NLK^@pqdiCI!As!5}?IkcWd~&*;v94ARlPaUVY3Hn*v{<;VW2u!e6K0-*fP<)bK0W>$I^=R`5SK z;=fnJ-^(r{{9MAz_){G1zedBaVOP=dWPyTj;K1Ln;qPZ(QTvxE__xjR5g?nv9@Ov; zvSox{qu@);6Vw9#u!et_T}k-I6nsYqew~J2$4*dtKCj?^HjjS<|05dy5w?!-uPOLk z$N27SG5CO4gUm-A^eBrll}1*M|oY1M&^llk^ddzxe{!NbZp4RYBv&Mw~PQlM|@c&iA|CMD@|No@m*Er$}8fgfeBtVP7p40L_ z$3CV0@)~yi_BzUYUc*1niU{9O!QbQHuhj6BtUKW^Bs``yY+v`87b-+NFKYM~*)eMG zt_r@X1OJkSe~H~o_)G;~&royw#T;X>?#9E8`SI^s{=c)I zsDJPd6`4Qaz`v&9Ut=2xf4hSJ-Z4MEq2b?PbqK#y!S8m=7h5#^7IrE1Ki#V#TI`wG6X1OK*$f14eo z{`gA4$2sPUe`xrBurk8`qQsAT?jZqM4EBzOe}`Q`_?*>iD)ut<*Y`-6C`9EfPlz*0zzkvh)iH4^%;R_Y~R}TEA8vawZm-+|q zf5vGdY>(eNw)f98{Aa9?@PAeCH#zV}H2e|Pjqp1Z{5r?{@P&r|f*qy){EYCRMLcKC z?OV(bmm2wIT8y`&TK=Oflk$J7@-yz&mGC~aBn#zK#Re?*6?4m_SFAz zbj&XC&pEdDe`@%DvNxzd{0hE{1OJ_d|Bg*2d_cjMI_8J(HT?Ii8R7BVBbpWMb-iPI z|3Sn5z^bV~@ZCp=Kk4BAw}$^WTR`}s3jQm{{{57OKgBu`ew-5j6OQfujD|nMKB4}) zQNj0j;D6HaKe0;*KVQM;IkwkdH2g2@Tk2n&W03u|)iItfH@Y~s-`}+Szp)FczwcJ^ z?{SoOPQ#yLFH(Ozq~OaP{D$HDy`;F1^#~Ae~|I14L6OQt{ z8s2NXPW^*-Ud#4))xjUH;p2^&gx^be{A|Sd+J=lI0a^@}sNoZh0O7w<@F54ju7=qE`1(dy!Z)Pf=op5Gr-$QsE8WO-=`2D-GYuXixYe1^=~UzDd&XNydH}FUtup$4h6&_TN^+w>1)JeB7_#>pAf4HGF$x z9rf1}3f?(Cbky*dXz64vouZ{XYw509I;f?)Yw4a^y0@0TR7+p3rLWY|=~}ve@si?t>H5@{~0a4Uc;}_ z+UqwhzNK3G;vE1|5btYR{ibXA@vNv6;J0h#|3xeRn3jK*R{nO4?=h|X5n6sc_bCPC zS8C;7qm}=PmVds+-%j&yljO7p|4fbld5yohmOiQRuhaPPP6#RB|3u^eSj)dy%m0nJ z{{RQ_kAh+f(tS1l?=*hJ&GRpknQ4vu9`k%F%t+Jjz!IeIvr@v}OXJ6Hd&p`!hHuC^ z8u(T>WC+KK{-TS0vx{B%NPsLC`xpPq0uNo< zQJrM-7#%~|kB^;`K$jToGW~ejD+zRIM_2m)F6_{yotldI%znq^8UL#S16^WBW&YQM z9lFE*dQE$+@tZf5^7wHwgG7xV>Eu@UFYdebR|yPuow8h>*Q|@0m&dN93(hcf7Eed~Hr)FIchyOhn z`(772PQsbu;Qyeez1Ft6Mv(Bf`cUMp(N_C}{eP{kJ`(&j+G>Bzx*%Hr$1e5*HSM+5 zeUei5Pek4tbvF+v{!HC@zke!tYSiUW&DeNdK69}ju4%8eF1ILkIU@4bsLSWV{%7jK zWBa0J4BY-@O*^mqQDIl>j(x0rk22!-Ed+zu*ZPkMJTP($w;?^{P9Vf@BG-LZfxz%_ zixbQwHR^j@*#As@d2Gdk6Y==Jc8RS-U~27)B?7}^!^_Y~YQ*->KOY<7_kUXx?`E$x zwhA7O*f)LW5*uFHPV#5l%~&ls>8B<$)(9Oj7!SDEA9k^?cd_GwBS{VZCtd7MyV##~ zu|Mx(f5FB6l8gNn7yD~2_9_?qn=bYpiv2C2^LF0pVt+@m?^f{dx!6B&v45o4_bWV~ zxY!T5*pIl_zjU#GX3;p0|~GseYk zzAUH)KG6kV&&A$AvHOJ1+sE%>H(z?h%T@6$6ukLEne*U+udJ7954hNqT>XX~ z$%;Ki=sX_tM<|b9wFh1BJzVU)UF?^+*spZ4n?G7>#Dfdjvfb1;2e{Y=yV!@h*soUX z!-dY8}RPom<_^}Glco%z)i#^xHKGns3lZ*Xk#XeK$yk4^u`)tKNPqEKe z?6)a)m1m)1S9$UkyUJ6j*o%bD<0(<>ixvA_ihZeKU+!YR$Hl(V#lG6bet%6nj?Ii! zd>D#z&i4r&r%8+lh0e#rTA|~3%y>lT$tY&j>vOx_Q!Y2=qzR)o}84ZP=0Ucx{L!dVk z`UvPPg^o?yxJc-eptlnGbm%CMWDfN9LcargC!rTXPZj!7=v{@r0(v*0KLEX_&>w}~ zN9fN$zg*}qKo1H1Rp|YMz72Yo(04%}DD)4Y4-xu7=vN8-OX$}K{afhQ3jIguqlNw} z^l?JRx3G-~LdSh0Mp)>Lp-&b%zISa*6M7ry(}kW4Jx}P}pwAKdWzcUGI_@VmZWsCx z=ywWz1oQ%-kA)r)`XuP3LZ1%3Oz3lLuQmRD3f|Ofjo-XT z!sG8R^78lx3Z2J4Sm*&-8AFB6>R&X=p28S&;ztG z%7o7G%Z1MIcMF~4R|wq`8<$Y0-g!QMlji4NaB=H4?K@tQ+9j=9k6wK)yE46BX8(bM zhhBB{h-*iU8GFNooZKnXZkj=#^O$$*?SENBA5&Ru+(mQFa{8dk3Yu5$GafY78jl!{ z8&4U}7|$7-j2DfUjlUbO8(WNRMz!$|<6UE~@uBgtanSh8_}n;Z95=o-zBf)9r;M}4 zFUIdifv3n*;#uM;^W5!O;knmyzvm&(I?tn?Cp;TG&w8Hsyx@7s^NQy+PnG9Q&koPq zo?V`IJ@0$=c|P`h>N)KB!gI{?wdY&U3D1w7vz}i(zk3Q|A~B^gWijP36)~$~*2Jta z-ZFL@`;C7Z<(~UIfA#G39Q1te`M2kcrzmD|%+eU^{rO@04gB=_{+n_aSRVQ54b6-f z?rWxS6qEHm5O8P6pkJHdhMJ-ROZ@+&nj`WyTjZdo6zCx9VRD#~)&3@49f< z9fD!0M`?ShyJ~tJ-B!bGg=TeMO^6lUoLRXOXVmax%P<3{uc6d%BV?ryqCx)1t#m=O z>{cCWiGpuZ_n%gcuJUNG6AyOlHzH>0E9vz_tQIp5~?2Iz0;_E%m9RuP(@%ElC8iL*j@&^cd z0nQ&Gs1$4!(PKaf(Y@4=QSzAkftqA;!>j3$JBOMcxnHR1LGwhnqR}wHM)6|oxVx=x zbBCZ*G)OJ{?rw|U9l|@EI;<9c^k;Op#qSQ$2320PMl!2tjypGqGOS!7)Dh^~S~?=S z+pdT^gBfLX0=|i&m7}{Yes_rMi0A~IA1x5wZSlK9WJicY&l+2{HBh5ApUsb<9u)$9 zKFp$f!SC+2_}wA0eOyZC@nfJyE#Bhi12rl{Z6AEZ5MQRFPrB7MmQYshP`g~S-D-!c zZTJUBwLNQxS~1ABtsSnm^B*A9Hm@CO#UR`N58(W`l7H_mXX5PKD19JyWc0mB7eDqC zxs#&hgeOeL7d7VynJ2o}8Xr;fitQ7f9Mx^t-xXr@eN+N#e)$7_-p5fH%-RKABDA_a zYG!Nt`Gewl_eN)+X2)I*M`tygURK`S3+CuvUNJhVtH~-m6bD^3y|P1HynJv|z|q}~ z4vh|xb#n2_4LG{n;zx%@hgcmN-7P!R#Vfbn=x(ccG<$Ric0_zw)NEPIi!Lq~Gsvtm zqZ8KVwojGR*sqzx&O9QnNi9Y;wn}kiT@zsy%n#DsP_nmOX?Q_=^K_%I3aS+)`?dCh z_=fn01=WhO##fXkk-z(e>*kqra#Q;c8<|40diW-m>iGJqb-GFB(LXh6&-MDJL6u)C z;W@XC*WGm7AI*%oquJ%JfoMK7YBW0^mr;tw2#<#6ogB?!^=&jKMNHFjv|?nNSx(uS z@;4f96KO;(P)mo=kwDux49MazpvDdZs_HQCIyx*?)5TzFI9qmtSzT zzR=pn{={l{;`He=!|Eq*wSiH?Z;p%_b~!X^IMlIG!zl+x4Tl^ZH5_ty)NokiqlU+7 zLv(cwuQftyc&s+H^T{@q!@)lHWu3=GLqstnM>I2b7E$b0%u#$iVzSG#YHHCzkjb-Y zmO~4d&Oli%C0y04gzGRX;i`5$T-E0YH=0A96?4R7osP1s2q}sc5!EzX0o8Qzcx zUO7nZVQJkht(&C}m0^z3EPSz32X>t<=eUQy~Rc9gcmuCnIQYHfPO6_8YV zySAxywKPlV*;6`uSXy^W>t<;|OG~q~u9jviJuEs)>uzb?EG=khX_nU2(k!KCcZ<%_ zx?5T|OAA_Bnx%EMG)w8(&7!lk?v~cg(t?(jW@%k5%~E;>EjmlD%91yuS>$Mj{^g>d~^x z>*T|&9?|&TBAm*1Lg6Eq#TOUvj*6KUNg)d91Z$RNo zRQM)P<<<7X?I6+Wdp+UQ_T$IIlSP%M#rc$bRG_bu_YAr$y<3zpj9TYyA0xZ5#tv~RHK(ziS()uGre6l}UDtt4v{=jXK zZOAW0w%=5(KkiWYFdZRw^e?|BkJhv~altK)=5261E%~k^MXm44N_}yQo8)^#tM6sR z7p=apX!YHr#MesUTc_0*w@?RoWa6KU?*Xm8^{DaW_)AjwZl?@HVbvG6D@UvEJgvT$ z5uco|+A4hewff=~#c1_?U#ss3;*G45`j#v8#jS#}KelP} zDISH3wtc*z&8JmLeJ@e?5;ZjlZSDC$~2` zRIuuMfHJ7@-9YJR+uMg^SL1tCsV_|p7T@n0AMPEF#)o&0seB(Oe56`@k7?uiHp+*2 zQ3@rwtkuTzw+bI_k(K@Xjn==#L=bJf9M$?a_6mFar7L{xwe4e>3tww(`?x^i>!lVfeSE9U&vy`?+&%^?eD7)72gY}R{8A{%WtX;nyi9y@`xr_H8Q*=BL2bXE zDIIM*uOz$Le#e#iUZwE8qVXkAKStwwQRBmhzvTYyYK3o_wtX}uzG&OWByIa>uJF-M zAgjL5YW>@q_@ZqePig(zMd2H%@ExZ7YWsC^;roQ_YWodP_^wm<-Xf67m*&E^m2fKG z1ch(3!k4FwzdpnlZT#J&jlWxoPmaIq6~2+$_?t|80rE?sZsn4#jlUO&PmaHFgh1@* z$FH>hEhfHb{rkDrzh5f#9k1{uYkc>(v|oFT?^lIyqQdvM)*tt|@U7GOqjAU{&tZkH zOdEgeUHBGj<1bm^%T@R~YWv>}#22l9+i3gW4C0ghJ4NA(ryn=!_}fQ(0rE?c{p%r| zI{xxQcK_m$0olJ1t^H2B)Hh#izm3Ev=YyLRzUf-~{qDjyMQgumg>Qz!S4H{N`o>Wl z0rE?c_5C~HP^XaTI7~_#((!w6CavMaxW#;;^0gy}`6vu|?eirUYJ9QjcKh8zILX&f z>)%o2h}OSXX#Lxb_+g}83R_bzUOQ6 zRlUA;f80(u86S>E)%vz3K3^2R-h@-@dl~V`@w`ysO{hU*e0_e%EO2H=X!o`xPjBS7_~bvrGH+*4pn$;*;}zp~81NH5S^>Lkpx_<3k-G z^9ZNbcfV5K2>Ic|_BMu27O8w2UHC>4PUSnH@RcZhpJ?&zapBvi#h1{}?%z^{Zv!3t zsPW;uIsx)ak@bCyaB6%3h3_r`%lekm$u^bGM*}Ay$xIxQMTArNdMSKmCJyaaN8{__ z!spfavK7AN3g3iA&iJxj_^v0M8sAif?{0-JjZWUF_04nPOCg-fm#^?uD12{g@s+#q zZPVggt?;c>_`cTKZ=(y}msy_}c2@&xJ3bjlXJzZ;iqiukoF5;qz#GhZVm2 z6}~NWu&nlnkAC+B$S(zb0C|;gYJZ$n_#Pxbd>DTPiB7&QE_`n{vcmUQ@&kwQ*NOhA?bpSHuPxz_CqxTmkHYsHr6u1^Exv3QzU^9k#}&Tk z6}}}}e0eT>5iLG^7+W51R4RP;)OXgm+=Z`)$S(zL2Jvfrw<>(E zkzbCNue9TXE-rkZYsUxW3f~(F-wthmlm1y&QwhP}Pva9h;Rruah`1)(}X`TyTUu{0kSNPsn_`cHOD|g}hT#IkD!uO%V z_k(FF;1E{^!`sTUt^&^~G-ztSK zM&UcI#aHga_k|YUeudAg@V%hLx6y^~IW4{u3LjqcChPku}r4HD|~*1Z>h#t?!s51@vT<) znkalXYWt&&E_}J#{%E7ZhgSv4{@ASTKlZrrJ+JLQsue!GK34M0jCZ!*2^YQ_38%K- zVTBK`FO+;sH9jBJD}VuK3UH7Tjqj|&hu7FjKAc~oq}9Lpj$Qx+rbxbjXnejw_V#wM z!uPDkm+iv$l*ZRV;lpbgWqd~xo$=+l@Es%^@`TK|LkeG#!q=YWaY|bCEqCE-O*oZr zl)~3m;fvMyHoEYg)8flh`0%<(Szo+{RgG^C@!=aRQhr4rRCl?odH`;uiBu`7epDz&QrYX2e=_DIs!tykcVJ$Kn7t)R=rxM=;v;Dd&eDNAzJv!*@LO3b1KRg;=wGtm*St|RZ zoyK>W3tuaZ@2tXy*GWsh6Waa=-=T^Y-#@keQHN~1zLzR|uV{P^xbVHG@hv7kl#B6) zSFy_YKGgVjx$y1L_+D1{@H%YCm#U4IUtRb*YUAZN@eMHJOIP?t(f)#x*7la%B6|B> zLpa0`q6O0BYMZa0!gs&6e;ezwxg7>bwja{nYt?GtvFUl4;MwemoN9vKht1zStKr8zMU<~H!>IH`@1(` z3!Btj*Dv#Do;tTMvM4{L446gv!5xpW`ehYar_aqT`=M-T*}?*1*pgbDMi^sDFkw&V zx2AQxsVgt&yE?t{OuR97`MBk)x7_V*NToeS`HyD$pYsC+6;)(z100 z728jptDL==zASt=#vfn(Yi041q0;4@?)`ZAwD^yg`QuN-_=_9;TIqcxl(@Xps;ifK zk1bx^LyvUu3J>G15s6EojC`-b&H7i^l4A<*qf~4)Qg_0%RZ!d z{c}$>Sd_md*B`gm>rYr4?~kV!ea3I}R76hwl(;N$dFk>ED=Uh%XT4v$0iujRC z#Pb{JnMTF-ljqhI{8pCft>}N2A|Ac$!?O3v7NY%{~m zTH5KZg!I(1duhacmCxA9%rJYARm8GbV=etph-q7w6{g(9q<_PbIuWTClCMt0$dYN} z$e74Ck;%ns`cPz$o!-)^$j;q5ayonRh z1-aH}7`MCiu68>IRS(;dR{CtwuJletvV}I38b|7dDw?)n2^oGGy%F!~Q01BJY)@!u zhByAFWuGqlt!d+`omLA}hlYg0c`veh8UChiS!Iuav1z5h`1H9I=|3!6v1LTa>%H3> zp70?X7C9Np$=I9Gci^UhUTRD9X?nxB9j&*u+d8NUQFNj>WE94cA)$6k^f6DyvI_bz z;{~DYP(sGijEWs+&v_Ff@s%fO6wYsM1i$*6Eo|1jYIO)P2G2AzKBhQVC~+E@n?kKK z?#b{BOgF>~!{?y^MrK8`cI<~{m5WcY%EHsE@QDOg_*e{E*z||y!MDh^=%rAw@Kgxf z@K0q6msg(I%PQx+&ps`q5(<7>RC&~E_}@BpE_nPy_S3SFWk2|h&jtU8^!@4K@?)%V z`s#E)JskA6Wk1LH-#=|s&W z-TwYS`ofF+{r`Qga@KKHxucm8EIAuGwH$K_?}tS}#BzKxtIV0tk^@C-tkUx$3m;y|jQ#}~74dCZ%$xBHW&6AN zS^9E+?3r`HIdfP}?85v={Q4E)^6MC8dVkMm%vf8H;q4#%>NxWk6`g~%;<_J=%CEm- z;rv9lb&0XIa>>fjsq>%jAFMMfJ$#sYB6kVELb6mMnsjqJB3F%-#+-Tz37;F6_e@=gGZsxN{9ftQbf-2X0O~roH%2qP^QnC9VU%3 z){uATAVf+m`{5iN4k;4Dz9WBY%OcV?CWimUwA{?ArQ@`8yp~ST(urESj+U;=X>TmvNK|eO4`J=#*j$=8F zbUZ6D`RVi<;S-qo$rj!(jaVY;!FTKvdF0$pOz9}=^Kbcum3F&NXy0s2R>nil`{T;;mN?1bH%K%q_7%+$UZx9&h67!>iIZe7RNnkJ#d~Jo^2s$=U66||??S$T%bXhOxk`te5 zlI7w(2ENt;-vf9v2Ivxhg@W%3%y@x^E-~2dCFclW%r=KEF=G|XBn1OqV(=*?$ukQW zGal#?gU_@{4CY7w1Q8E(i76&M#T)||tNt8;fi5u@k)GT^*fVJ558JxLWRuBfV)CGO z6d3&XT_SYsFC{;8nV0h?3k zV-mfzbsD8}XVB~7)Ytz>`Y>hWWzw5rCj%oLly&NiiQ)0|11EY;loy^kE0@Zn7cWNR z27;U%=pe?Mi}@#2YJ4gM-;a3rAeILfV`L)6KB&aMRk`IMRYfBS>e)NPHIIkY5ZgwUbCmVG~%q; zcw=7PP2t&H$It89ojy>LH*wOWX*W;NUT+$ua@0sX@@bRpc9}GOO75KT2&-mY%yB|* z9UMPz;`F(>YA)?%sWh;`GiO1b0~MY=^X4eTRx3~@m6X4JlU}eHJ$7t4j5?PFI&F}1 zrp?GrrI&Bkc+X##fVtWKnboIsY(#&SO!YH%QZdjp!Ue}p(BnkX^*v+wjGvA(cegyJ z$IOrG)3Kz7%=D!5#C-tRWutib>d}%;8B{*(HWO%(BKh?9@#GL78cu&t5$5)2xB?17 zEq4~->c~QAEz501AQg9q3m}#b+zF$aDaoDd!i|;hy)b_iB+7Io8_QNr^ zY`=Y4d~3 zd^qfte62}G_AazQn$rD5lZ49u!-oa$w^52=w-HVi>H8NMsY`Jv%muh;*I|znpL!h@ z^DYGOK_uT%A|t3J+lX&1O~UXGpau2t(GsS8Luxp6X3mYB`E^$FBCDbci@XlowR^8% z8u$M3b=VLcAEP|69d%$mDJ8GIbSj!A&TCf{Y-t=S*c!=dtz3CY2qmOfc#oc|pY`>e z@Zs%rg(Bn$`(9+;Ola2ink^lwwq#nVOgcv%i9OE$pAgqwaMfkOEphu=f6#94pgqHO z58rj|&N0>^QFgLMa|M`HKh zA3i+72-EzHQbeRL0^`5}>#29)=Gfd~kQcJ&{TTw(dYOBJh z>cpZI+0X$#yDtVL*!mD(cEYt*%f&pF=ovr|QNc(l8^VSaQ@;^M99<(53=z7b^Ej(haxGoMY+bzD zYQYUf#*snXCdZmvU6a-(dbVT^w`#j3bC{*Ki);?H%UG2WH}K@>oH2XHOr+LU$0l8k zEbUY@mDw$q5Q-f-oz0=1Zyjl8MPnS9PUA~WBQ`tj>_ z+l^Q?B5w5Qfs+UA83iR@6SC zuR9gJM0>u9h?n)Gy@5Y2j`gHHgFl|Gpb~Fs|MUT}w6M?1+^{cEo(j6f7kLr~Y#CsW zl-hC;x?UNT@aND<8TIP_CuR8V{%^|gHFT6=9C52VYEcm%^0ZRw;f_{o;ZF#8*8Qnm z|1Zn1TiZBdRCTmRf2Q1)yWbM`ZtHj2{bSJE!`>Rc{n|IjY&mr3^Ml6@e6#;w`*45E zE2W#4Y`QD;t_@{ZSX=LgrPJny^Xsw7$Uq}?Yb2w|P=7t|*>HY+)|18;U9qNZ+n$p; z_~fYS;5%k<7)LtzB3Xyj`$y=`nEJFuK1B>|;wv+Y4BTy1@nRD;w9MEdnNf<(C$&gy zxcpJWSlhvuoY2McQyB@n9kWaac2A}{>sYMxC<+}r@a?cuky;aDturl4v};BCos8Cz zpF=lh9LN|n@Rfm`2HiKP&fwG6PaeB(Y}UBVFZ1T6m4FTcGt6abz0KbYNJkQXZnQ_$?(^w_NC(v8Sf#beVd2wU^#R*(6z-c(NRQhQR1Ol8L+!<1Rt z%HgA{T5BsPD!Qv;sIe9$+0jX^o3*`O-|IJB-+JslV?E4E0v7U6W>W__OFVSH}MQI}INk6Flb?UH}XkD?S4l5hdlYYAT>(-_H;^S7! z)eF6sHHr;aM%RYBj3Wc+9)`~?4BaP1$1wI?N|D&~dJSnDtuP7((=iD7WNl@AZm2Q0 zo*bMrWbY8nuv@aibR@DaE9~3HW(=UQl#rKT^sh)beJ&W+#HcK3VpMoeoh#fC&x+$d z=Eoc{Z^hF+KNlAM)-3G1mKj-vG%shZETrSV2Ma1sd5ss#lIV^lzVD6mp1{3@>6zCA z=(9zPuY0HQHGN%(1vAKz7QpAWxfm_$KY1-l0y^lYA zrpe;Ocdxqamw)YR-u;%~hi&{LY56E1GqBHf70m7sWjDz(X(1d?xd`Wmk8pz98$7v0pYk`pcFU=hqqj{pp9> zWPWzl{muS*N&4-_ruW2;7ZR)*(-NZP?-x$%`1RZ`@kA@aIEUpLqR^J1>3ko?i#fX||xpWxp?*z46R} z^Ck_i_Wk>k{PG1ybIyLVcX;wmw`VN5{(_3D2e-fCSic89IIwi9u-GfHGzH2}Bl;)gn zdHdOie!Xer#aUB6F6{7x=gQ2~<%?b$e6nn5&o{?5nbQ7X!mTR?c`m#7@TGs9QE_BV ztMU;K-~8dU8V~NtshhpMK|ib7jbM{k{LV?efKoKW_QhsvmD}*l-gyvDMxI z(iiL={=}K$rzY%bzV@a2PNrX4HKXU9@Az6wd*J=<`9EzQ`U~gTVDpMnjHCzWeAPSH zY*kgCuXoRy+&Sg`g&W^r_*0MV*m0v* z{E!ERH$Jub$;=yuq;#zRP{Y(u693is;&&%iz0~>g|I2qz-HIRcrr_Qw^}HI+Dh#7N z@>B^h)8^$QvI@U_?n0z*Q1DJZFXwA6Pc+c)LGYiarE&gIi15#nNfU4L3;%J=|E!kg zgOA$;9@k@qcpc{v@ihm;Gsg1Avxer05X9i2IUW8gGq=R!8nzITf3ZxOe5EHBdLumZ1JbfYi(Trs>tvz&>7UknT=^`76X*WV4c{v z#Fs?6$UVj zEqz!^pH|Y&`Zivaa?H7 z8G6)r80kX9_bUT@(s1eTuB~2%b6luwv z=?k>sj}D)?wDHnLV=(K6h`QyN}P^ z*XO>_=g#%HFY>wbeC~XoyTIqZ*yrx&bNBbT3w`bZ>ico#bntnBeM8x9i156R_LK+R zKehFf9J=}Kg~C2y>`NMH3ZSF^9v`1;KT#HFemnIe8(1dTJYj40 zmp`f@#37B$w>#k!LMQz$`MkpGo>Gd=rlfb)A{2jOYU>!YFW?;%)UvsTZ0t?0GQ7Q^@2914}Y$>@nCE?&#hcU9Nb z^@iiEt87n%!@Ro>7!I-6nd#xM4!b`#9Ae>AQ@`2hiAA3YoR@3#tX_h39<81ScZ=Z= zOV~p4FEVWM|)7udB9V$m}x zfdSY-c#t#`3x{PWX(kpuuNO(P_u45U-=>*Z_`IevZGT~6(T@VovU+0Ck0E~$b`WCG zj|a}OdScN}1$GBx2O$>yEMUpwO~9GV1cX>P3xKn%o>=sYfio|`4ni#YWx!chPb~V| zfis6<2O$>yUBFpZPb~UXz;a%QMc)i8X}%v=(o8Izjlhy-V$rt%OPYyA&r3zpOf33G zf#tjqi~ce4?Rg;<{S)M0iXDVl^iKk3Sv|4nd9BHLAr}1sV9Dbl;7nE`2(fSu17}%1 zvFMKiXWG8u#G*e&zSR?p{tfak#|}a)`nQ0yte#l(p8(5wAr}3Yz>?;#fhEnv!r{ZN zq?uUs3BZzOV$rj&x}=#{^t{i?dGX$J1LWKDLM(hft7O_f@5G|#d&(@UCl-BgU^y?u zqUSSv9vc7%f1_s>X{fPq20))>^~9p*Z~n|;!zUK~FyJh!Cl-AXaAt|&6N{ej9S zSo9Nt<-8D!{zhO)^Hg9-GqG@H0!x~SML&!DVv`19(cc6tX(kpuf1_j$H+*8zFDBpW ziABGRd^UIxV$pM~NtV?Ui@p(9&I_^V*8)o(n}IXSj7?(U+z*^(^~9pzNd5@JCl-AR z`BqOX`Yq&-G<;&wKT5vU6N~;CU^y?uqTdNDY2FPiX(krVK43{RvFHzwZ_`FB`a|Sf zJ+bHylW)tPSoBB9w|ZjHA0wYP90;-K-yq-WiADbru$&iS(VqmCJbp#amBuEqaJXir za1w||8%{E?yETf1p9hsZ+YpO>2ykGG;nPH5oWVR~ULD24p8!>s)f0>U24MFQ!zUJf z1@$dPPb~T>>NgoZvFL9F&Kqy^D{zqCv&6z_Bhi1)tp9NhA3Ni1Ra0|&-p2RVo>f3k+^2oCc5i&*%t1Ls|5 zIB%2llPDI>haS!e4~JMdyhn(gQ^1*1u!9f_Ck}Nc%j$_mp9GAl7PO=S=T9`4?SKCD z26rZhClitZocWz77CYUb&$4=A(FcL^Z#4X#z+$H_aOQW7o>=&Kz*$yLEPCEAujU8gqmjFxp3*aqvo>(|TfdkV_ST>h|83ywb&72v=s= zfHTXngAj}UCg3cqCl>tzVEMg3EP7rG0bVqaJFo>RHPr9j12ha-g)J~!L*1ue^y{I@ zyw>Q6#pVORQvZoX{~&N+4t5Y0tCTshaJB;nreg+?5I|#Ap`vGTJJ+bHq z0B0`34ni#YA;4KyPb~Ujz?qA&gAj|p2sq2?iA6sGSk4i#=tl#~IU*K4n_8*=#G+@F zbsxeGLM(a~Sza}@cy7Tab%t0tcL58h1~{-3J4gdIIY-38Zw3x5!4AUuoKItrjo1Pf zw*X6hAeOLOfTcbVi~dnyiHlhDalipyl#pa>f!j3HYq93vZZOL^@I8a4;E;cZ!Tk%% z2M)Sq=%trkenoM~@X`?@M=e^65rJkfs0_C&pIbGja`7|_TV$W3g2f9fW>n88sHj{L znihg)+G*NCzm~)C(A_A8NgcW~ou=!5NukzZD5__S8wW2;!!$G1bF1dvHf`o@)0Qed zuF%Vgq?g2Ky&F5pN}f66Owt->TYl@%Op3fr*^or^OuBu8iSXYS7C z&z$=GBY7}ot_RV2ioxftOGO6C`ZH(xfh}nxQ&FGFc{9xLOl^t9HSJ8Evnv-=E}l_c z=^>aHr6{5Sqk0xWTY6?)^i@msklaX8+R9^O;BM6Pd`y5eV>U(sS1y=cJ;#^L(>+fc z@jHgYBE8ioS_HRL&zWW_y+Y#j_+MY5%n)8)Cm5_N^$MNou0m>5fp6IAx12v2%F20} zrp>6Rz*J7NRn=mQsGj9bo<2D!YhFh>sa1=kV^pi=&8VKWaPjB-;T>rw>=P zmo18SqPMKadL37_Wt=rrii+)zDj0)vUeJFq0MCBGAOQocS7Asr1f&!eil%=A5oo{u z5x*#kqzVj7#sx;dplNLXgZ=jt^w_Wn^Y0fcb!}qAsqh%7g+FPClZ?}jyRr@(cu%0* z2H@w}TdejMUNr!sRz+Hi=ju%J8)FdM@!05>hV3tKcZxsARB)|88^V+M1y|>{{ zdmXURkLTn60C?@KhC4`w6|wg;^bAvE^;0e|{o-h^6E^zM-gazWdynH}@msNoz@I_k zwU-fuZ9II?-Z|Ef_W1t5Yi~bJ7T-OIh`ql-=e0MbuTm%ANqa6fN#Cc?dF>V8WS!fF zy$`|j+8cxKBt_O<7mvOBQ2t(frK#TjdeQT7FL+*itMGk={hpXUewvi@tp@hm<9FZ+ z=tK}i%S!CM_BP@==QA4Zb+vvhzbjDwv{#6YQVn~2o)n=UH$MOJDE2!dZ~$%*`ce9T z;N^7(FQ|RYPI%psI4|#V@QT{tJ>aufG=)F%QC4n?|t^(1h1|0`?N28T!X~Rlk@SFFJAsw2tp^qG*Qs(#H23>UR&vV%9lRQ z)$NT}?7ix=@YMhY-~Lu@%|AR0JTcI$QvmR9EGb5KUDIlCg^5)&iLaH8rQ z9r2b@`R_>>i?%3j|ENf~F)ysBNqcccO>RScuX@+n?YR0<&>oz zSWz#cfr+r2nHS{oU?hY_=@qH!k2BW$MR z`JPm72_$F26*()(>Cw@t95qPh=*TFnS@pHST?67#HnlyA2gG0K45+>&GkKJ}}PS8ou z$;Q?bTW=>lA$~%gv(xP|R?Wm1{ z45{+14j4b#5~{!5NlPytA=>(shn)Uh-TL-U`I|R8ebuT|lwzd3I2yJl zGn}I0w$;&IcEjdK+0!qS_(P0G+Z-tg%wGUI1Dxe!oR;$!H5}S}aO;5s`w#6qyyxid zV>_q5QP7yXat=oAs`%*`Juhj%Y|<$yapBZ|VhkK&y0>`J(RycBJVv)CCWV)s?8KP~ z5)=R31+y$*Jo;!)8l24+~*PNckU30Rp>6#Oq(KWYGjdgJigcEAME}ven2Hop4aaQl` zD?^Eu#pToYVkUxAj)%^OmPKvvMmN6K0k;vge8u{3!p^Uq;aDPrnz3at?a44tGTz?ut6x6?M2P z>Tm|?a0cpd2I_Fe`6v&}K3$g6cbjrrq+OBG>O)sPjgj(?H?k!`j^d&@N*I%qH_^>0 zD0P>=iJ9o*6As4bCOB*z$LRASDZp4p%th@!l@MQ_P+t>DY$*!ez78`79Ksnt9I17& zBg5G?`RiFhBl1;ZLb%c z@|_Q37K$q|bB38QVR__AVVk*pr_|K5)zOI<$LX0Z|9Ej(@4E6gx2WRMF&NJoZM~MS z%6?$^n`4rrH4Im1DN~Y|nA7(sC}qqBfziLw5NNf%Y>YM@m5kg*+U-%E*%vS`e@vZb zeO^Ao8F}{lyR9yz5@U!Lz0Y&wy_==%N{XiQ&Pm%2Z9cMmr+;*5e6Qk+9eBFWX-VYu z75DgIT%l##4pHYFvoE835lg#hD_egh+mu5uy>G7A1g2JM2YuSoM@O#fb|pdh&hhsn z_mHPS4l4Hm_n{xo0bl=$QKDS2```sYI_YP*>0}7{5hpd!}Gcl69)kQxkhP=LA<` z27EJ5jaeTc7#u!v!nD!}B_o4<$4>}e7MwU?QrU&Up+OAT_4$k_9&>Hkh46_TgR9hm zDgXZLm$&@x$|G-n=dDY|zt(tD>)wn1QvGuMnm;^SG4XqU>c01bo;$xvyRS=1aBWH9 zpt7<%gUfFI{pK$FFaEDz-E&3FAM$pb`-hqbkH64*Pgakzk2ih)(EhapC*{6&{_6B0 zk2&LpWGvhG+0#edr}J*v`QE!}BTLskcSF^>zb!AC5cVKD7qZ{}QHQTz zy6qFSub=qViIiC%gev+K{h_GSySLmu^vjexF8JFgardkL#k26Y;?69>aij&}(8qW^ z1}mycR2}exL4ITK4PGq2ozIQ65Tb#BQgrx^5uI^&^SERA?S0|Xboe0=eww=7{9C=%Yd`MuPLakq#Q;d#EE^SMv>+&ew)*!a%X;rTwzh;iR4PK>^z z{W%_YZ1@cAAB^}LH~X3xF>ZM$$2TIhH$}Xy`*ojtp3lA0=U(P>-|lnY=W~DUb3f*D z^IRCo@STrLpSzn*f3$vdQ_tIwnK*J>>=x@rHsS7}`O*Az!xd$O*H|3h8nN#Sg)cN5 zm928EJE+|`Iz0Qv8R@3`@emhb89RBdo=(KzUyatK8KrWlk}0#{*y+! zDJh%rP&k+|?*r=-)b8GxyTeG4cK6Zo@m;kMQy%;lA?^1Y`P{vI?mj+uU!OZSGXEpnbdGzw-{zEu0Jd2^_gglv zY-2diZC@nshTrIOpR#V&mvofc3|p4QovfOyJ6rpwsF!2>+pEWI_z~JaP4&T1gz4Mp zDPOvu^SK9DH(q%m{&aPnbvJ7Fx$0KyW}mKfT(3K9{H(|6s8uC6QZkT^bo8>BW79(& zlZgdScPvN4;%mh(-S-u#6SkNzQ!iAUm-MXFqTrUyec!VRLO6 z5)0>b>TO<#MbGv^^u(h7(xWF9eFDz6@QFpwHZ0(R2;p}s;SdX_1~`u=AJRfTzHL%| zMgD>)7C!q9=bdZx`+@WM!3e^>z*1J;e!*`;FJtCDA;*>#vDo~Q9BVTTbzR~m77p7x z;RMOC=Y?1}dE~G%LJEOpd|o!(a^8uBe>reo5Ie{OY_cZ7jlhxyV&PYi(*rvQqYtoR zLK?8i8VqZJC6B}s_5olSqqc<{d)|qKbAWoAFJjRj0nYD<9R%4@Zf^}W77nikS?7S) zg5V+#9tSMtKrCVTEF$B~c*Ca~*kiOVtod%i{J?og1IkDJb`O8`klY#RFV+WazP2wdM{!PHr zx1Cia?-J}Fw`0p2rlDF*%m)R?{n(@q6N{Y|;5<8ahv!Asd)N*v=aE?W&yhbAJIEev za=wU#a}Zc;9s|y|<6vH=eh7Aux3NimAeOKn0!!G>$gyocv2ea3$J#klTNhy4G7Cfq zv4l;4+qL~biACR=`kB~4h(*uSDfa?m(U$<{aR({ICSxFog)<5`YdCfgV$qKQcB`q4 z9b-2IZW*&eEc_dRyU{R&SoF+ZUKzEf{gH7StPjFrU6pYg-g?XEWvmIY@NXr5Bz6#D z(cb|q<2HyzUjr=THi$*v2<$RK2(jp!fdf}kYsMnTx!4M~aM&gYhxJW3#KPGJoM-Lq z2hQY03?UW{>tUAF6N~;RuxtCw5{v!~V6piYIThGJh=ub3aNbqaD)k|@%rP2jESyiE z%CdT5(VqZzml-~>=)VTe9BcH%qQ{Q~m1XtBqStkvCk^7gzjG{t)L~-b^WA~eVPeq_ z0+#wlEPDQ4lKSQyH*h)hd2Fa4r3^bFiY4qQ=%v09i=NM*GFFCI^yA6D+Snl$J)dba z#~VGd=%wkr?;_5ESx($oJMkN`#>z5wH^+ii-bcgoJT#J zZNQn=n7D|A^Ehyp)f0>U8DOcC#G>B`EaP?f8#V7*V{;F1=ENu#KA*v|te#l(2Z5#T z5sUs4>TNwI7X6pNd6SI&uYjeV6AR}Qu+(#6(evGq#6>K6{VaEjvFUx5I~Sb%YmL4m z4pJwHC2TsdjN2m?eRp8FPZ5j0FR;{MV$q{h`RJ?1U*qkdDcugDy|l5?PW9r2Sb@m) zJ!kK4t{dYG73ocCJ1s;*NBejShh0C<*m+vQ$1G7abIB6Khz`(pJtEsJ`HcOBO;2Rg zaeUf>g;nfJY;;vvjWt$dGdFF?!ljGLD`Wkv1%G&t+ZP%>kzUER1F~<09n+_S9rmSI z*-QFcin1EXT7blT8*}lD1r-bDo3rCt5XloKJEWseJvuN~F2Ypri#n(5Q^-K41K3f<=IP=NDBEA)K z%Q@dF2O!MlqCMqU3aE`<(vk{O6lbNd?9WOtCve&=SR0t#%~j8eNcU~#$_(@1%2!Ix zKtXv7qkQpgRj66zGf(fTt-D1JwB4iovsbn5XN}I(_S*Qr=@gB&!n%T1$WIiIa@;jQyhdJmu#NvSD~Y^QeVQC!;CSF0{|C=?|6%H`7DEG;FUUfY;tl z&<(*RBKBSZ@Y=f(_J)B(d-z-$vG=9V-e&8EgBG#(9YpGlcPo57#S+QK-9Fwn@Uo4m z7<((g^QP~9q%Q*urVpPtBk7a=h*Hi6tsf3rBz=zpc+>Y1d`DOg55jv0z#H!qh<6_R z8E+ak`texpv&Z)+{01Zh~?RD#n=UeD#kM}sS_l>VyxE3m(PesHY@4;SseE)I~ zB-#sL6MF>+@6B%z9;spsN3q9ww7mAdggq%|-fP8P4gz@X<-+4s8}_(nkk=m98|8B? z(}%1_>|Nta9~ObvzZJx!q;HHbeQ8MCJZle0jo4f4v$q}g@|a*NVsF0B-mS3r1b9pz z^DX)P1$5s0zJUssCdP0Sdyj$S&2Qh#X!!v~?D5+2+WP?Z_)b?uAbgqk?Ft5xwgVMEXiPyYB3~DZzQuDRWv9%e?()&bHEmb5(s& z?ekb)>9<`}?V(;O{+g256Lu%hOm3=eeP@AceRr7(RlMzlW@k8`-urS> z@tV**pQ-S5BUS5{y_}z|d1uY9o7T3wY)$x!&sF$Hr3xQKueu|Zj{C=fD*VT%)QihQ zw+wa~+l5c;i4ULL7w=Z@iFcR$Ha`3hY@hFq56wQ$39b1|g;uUrt@j*Ot!q}ObHnSy zkFO1PIZuTr--5WlQ0~NAobbdxDm?WO6~4ZYv#6F~X)pZ6^V+7if9g3OF zcoqLhysCXTPQ~|4Ru3j*wkuoHT5*B1KJm4ty-n%KTrDU5kq)Z4WaIFJB80}O2Mz7^ zuE{8=-GbGmwqW(BUa6{ky9W}=*8F+(xe3KmBc_(AV#%Mco(g3D*w}6zt#8K_%}%1^#te?!odmE1lhCtw$@J`o{8_B=z^w#F5)a zv~KuNg^p}gq4Pgfty4Fu)~{Yst>62zaxXaHg#YV36<#-6h1YIS;aAU7?jKP~*N#>0 ztsMgH_1{H_VU>&r&U4&1`k+7c6{_{bZ=BG=^(y?A*{b!!M%DUx7u5BjYCXAIy|_B` z;h!9L8T#LzNO4+cg4H}4>*fSh=;Sk8Kd0y4SGB(Xwi8~LtBNaIs~=K{vqS&*D_7kK zv@ZF8$GA}SM=JEuJ{4Y{saB^BZkK?tA7izPIK(v2+1nI8k(b~^Kctp9)kEtC= z$%y-yYW)~t&Yh2({#vcVC)1oz^^?xAq|jX0J&_hyk`P+B1}lZs*x8 z#5+~^L_%CyW9WlDs`dT-PI&U4)$!G#Ij^F|osV~^2}PlbS{0s@@BCn8>s#AZ=&w1B zd$L`yASpEK_v#0=e_PY~*KcqwH=^GExB7fl>)St6jUB_Ek3-6zRiXEio$$$|;I7r~ z#Gg4S_k`YFp+d8MtHQT*2)4fW57_;&3V)thgc6zfU1#MztrZWd*H(A$;9mD{r+CeG zSBKBLLxsO+7x;72Ypef&8aT78^DZ~3UM034v#Sv6Bb5jKk8)c6R+=($^9b}}jaiM$ zzb*+|pbcml->X42L+ipduVlP|=-tFU?ZSzrX!G{O*Y@7~P5dK!zsY(0+qUhvJQNz7fxAcQH)_|M_}`;z@e8=m?8ANL`GKnTKpE~alT_{Vm8y2{Qss6` zOpe@N@J!&w$E(d~BX{6iOL$EuRgyBZQ)|V=4*QV0DJg1myFWL{8aO2hZ>6@r*BDs? z$4&n7lYeLIUH#{#@GB$K&(^el(azzWCbS3b-bt)Hb6tY-)EZeQ$6fQ#ws7s`p>W5q zI{mt7ce_n%+#|izWvfEf)oRn4)Pzkc;vS3p zE$zLwy0M*m3$7K|rM1=(udDSNLTP_htxaoGYx`fS@FyqZ!!OTL?kn%A*H&yC9*+(Z zwLj~CJ63!AE@Bv_ohdqWA4U>vIJ~}g3ud<|&KTZY()#?}PH0aPO7Y<}zievVw;pGq zII;EM%L=W4hpom4sT@2ZF5pGNBxJ1!vZJ7!g*lCj&za*V)jZLFcW zedYOBRS&C5VMGAd2*cV{xs8cfGwNYIp2E3mbe-GfQZ;&AkHoDQN3j{JG2*Gqtj1XL zuBuPMYK&Odaw~fDZ}#+yjvs}U^G0>XntDC)9610h@tJk@;>#+q)*fnS0@|srIV(O; z53Tr0<P-}3`hcDvVBW39h--(4O0?}t_E%}0^Gt)9^cqw9}G z*5|BGlyNd#pVNK$UMKu=d&fO`FUtI0$Gxt-lT&j$(se-PEPod1+NRt|_aX;O|4q(A zE4Cs1$Vcrl)gwixw=B9=qjyctv$Z<8_Y8gt?M@-u9k)}b9j4tmlxW(WJ-v`yJm0e2 zdEPwVvfT-{Pfp%}_9k2#uXf{$wZYinc%PW~PQ_ zYqxH7);xt)XRi}_@g2o$g1XkfzZ_}%O6uJk z$KpxoMWz(ZduKBx~4{SKxe004+>r+?MTrzG$ z#&BHit3!Lv$4a9;*0hdAi@R?=>>y1WUUb|OXibjHQsI|r@4IMS!(W(|ht@*Rf2g`Q zpWF~?{~Hxr^%oVs_a3+4d}T!fD9?_hqz*NK@@2u(;(a75~$F zRs3VWQ`a|zp5Nj0XbRtglA0*7Bi}41r1C+Q(|WeH%_ZUL&*NFH;YpQh6Q0!GQP(eL z`7|czmJuP`rF%Qwwc$YXgyzZXGEhdC1fclPx>d!!*7RsX``q+YQ|QHqRj6z}Y?$-r z-tu{T__|6wMbg^KO{r+_(ZaHohOO4JU#adJPOkrIL+IY0EB9+~(VDw2vo)^`w$r~a z;(NANscAf?48fF)-gu~a!n&jD;`^kjI;3D#aqGU9P&T|n^g^rq6x!Hb?OVq_h2Nh) za@^$P45o(ni`qxf-ftO$(pjZye|k{8hSGV&d03ZD7^UM*;HZeK zb%tS7^DvBR9)?lRmtoZNr5N>mDMmeCic!y(V$}1c@V^xPmtxfOr8xz^xMW+?;HAOp z9ZPQsx~c01g&W^FF{izGHzmIV=5X|(XVmBN(j9n*7QVN=k|*56(jShIXJz;0&S*8T zbsdOjlMZTSS^1k!Vtie{c&uNE(P=yI-im8xa-B`VnTesqUd8zJ7#|(?>aOdlrmjma zp1gm;fw=lP?TW@9s6VWWiaZYnldH0dO|Ef?=OexM zj9)7q{M3sd?-)4wR{6~_7<~oZ4joitWR1;m`@~;{SN19nzusAwCRZ=t;weq{^Uje{ zbaqL3y6c81cl|t-vf52*i1(+4B|91=J8sX^eNws~_)7Pt21&aq=cwCPh6yagjVQw& zcz(=C?uK`o5|ZV?(rnx3&d$!8VWjg|Oc`?2_Z*zFo9>Oq2u=H&?u|*IkKs#GN>S3d zrm1x%UG-%Wzog5=(U!iX>~PtgU2oc-eIU1~pspO!kT z$J?#}UG4g=a;z_HtDZP5^`&##qmD*u;~b8djnr5@?s*u-JrBdU=V2K4JPhNWFU7d$ zOEK>GQjB}P6l3>?V(k7mf^A$HQsvXwBTjS|4^K`gm%g8J9G@V zUC!;A+3f->TH5=<+`NnX7Y-Oa1hW?w4KEvU<>)b2Uo&CibyL3c-KjHXR?MDr^ZW%> zOO`IX?e;sqUsGG(u(EO0njfrf-f;hqe*EC3&08LM^rt_2{E615p8n;tzxvIt-Fu$j z|GO6tz4XVIkG^*7^}oFN*LU9i+Xo+h{OM;WzWDNA|32kdIc4PnNJq$ahmIGVy5Lkt{NbR%o2TA9^(p>v z(169IzbRnnSm00t2a=|}>Ea(%^dRJcVvAc-OdxGgQ#8le*FjAnF>PE$0mVN^f+`9m z5Cy0!qKX)L_(2ChF64tFu>QDFLn@i9i7ZiHc2xOG^a2k}EXm~QgT#`tua6S$O45Za&)T!bSqjRp*c zQw4#cDWY-s0Ye7`^w>kF0}j$l6&b8;Xj`-i4)pLdVJwE4VN87Bny}<+8#+E>a>zA> z$D`rGgBS;fK^$}w6zQGy(|V=Tr`4JZo{l5v1Z&jtpwe57QmTe-RihkkK`1EDaa+z! zE5O5_=4gNJ$fuTK!qx;~mzWx0?aN~@YKuDBQ63%WMxc{$V#m=u*bTxCSj*|gk#VRX zkFbYhjn)fR5aJr_DcA?GhdWpkppt*Y@C(ojTY%m*z&MhF4cIWF9O%hKSoj#x$l5}9 z%{6}H5@}o7z79by<5LkkHa>Ex$6pW#Jf;O)NDX&73)tJRbXyxii{Yn<+D46rr4YcE-(kY&ygi(?oj?yd2JAkIhjf z%!Jk{Rb+I@JW>aLV8bZ^MnH0)SDHgi9yrPL$EN*wG=A&?pyQ%mV;rzUG1a&m=2_iIahJ|Od=&X#xX&(0uNxTz>#_= zz@-j2S%-yQ2cQjO%lK)3@@ZCkXiP3`XfADdT2Gsd8?{01p^i!bPQXnQM^-inP6`3_K&ZL<^Yom5DmQJenmlLjJ6+E2_VR`g>UuBvSL@ob|JeIfN%+{{isEM% z&RjUXF}$ou0XD&8C0O`gGIy zPCwlKV#Tum&GR(8g?G0ioTp)vIP@`I#kv#K-*8UZzs*RZ&%d3|o#NxC`25=|_K%~~ zU~|;Pn$LbvM%w%M9kf4Q6I(Iv-r`gpeEd$4zF0NjaQ#-MpZ&{>bkgpA;>1j)^e^oCx2zpYi!e=bJVDgM9v_KKD+ayQ9bcridRwA02;o#NW6_+xw3A&xu^aeSG=3 z(3cqxmuJXnu@4njhni=Et~qM$&BD(fnNKOV35>FLFL~n0$4G%^Uk@I_Rl< zr*)sF-Iwb0-xINak#@i2b8qpvAN9DOM|`x!XdTS3!1MVlkN=}^b2zlu{|%47ZVw{m zZ{q*Z=b!2G|IFwAwa@*f&)w4(KH2AHA7mpYeva$%x<~um97E;xpXYHm*}7uN`!Zb~ z)gJ$kZQU~dmuvsWBlXL~zuCjT8U@Gtfi8!U@_p3f&+^;uadUlb+BTA}mc*pz3LW1Y z9zMh8M(VqX|1+QeNuQhJkc?cU79u>l#_BpC=YN>TpZ1se+|ldH#5c$1&%T*rpW$V$ zAf*idexLt7U->=Z^S{UEf57Mewa?A50N(ghec?a!`KSB**@xU4zSQG>*@iXezet~t ztsZ~oH;By}o_)r>?)@JArSRiWWT_w1BWYuZd==}y*yrx&bNBbT3w`d8&pp8B9_Vuq z^0^25+(UfsOMLF3KKG?Q_b{LPGN1c$pZf}*yU6D*_PK{+no?8pd?w>OEBzwZ0)NGu zITFYq=DaG=Ys=`m$AoXE#@X{@_$iSwCOvid_L08wx!T=9al9kta%|~%ep=;=f2#Jy z*izI3t_Qxr+V8CSZe)G%5!&5FJ!$=o{qxiWTbJ1HIUOzaeKG#$E2+!IzlZvV<#T*X zI(iImv+lc)u5{ebJKMTC6yGq?aew_?jQ@q|Rh!-do!*PoE57`U^SSGMZhZbx?t{h% zamd=^LFQZ0oEGEZ<(xGvFCfU7!ZKT#=-WjhmU!{QQ)O8_vFN)4%R1vMQVB~e9L6PK zz3F7zfR9F6g4lcKe95$9`&l2wPC9Uw)f0=J&#|&*AF=3r0_UBB9fb8DkChQpfGwW} zAY-s)vJydvCG2?MEUPCL{Y2nQJ68*_=%Ab^qep@_vM%inzjJBasO41rtbG~sU>mnR28EMaNdZNUygEP57)*z}fdwntAa z{Kde5Aa;;6Y!Vl-a5%n2;vyEkPFoHXkpDN*RtUS27h;L`F5o~f>>xVLHVywtnkOJk zW?vmt&;KGeCqtEG^~9pTf&2>%pIG!$fwQchSoE`iGjp+n5R3jM;4G^r7X32d%!{yt z5R3kH;4G^r7X1p~%slKM#G-Ei&a!%9(XR#0%*PHwEc*4pSyoRh`kla;ys#iUv59^U zaF*2*i#`L_LgvL#K!`=(4LHl{iAB$6tw2A^$03g=7Q!l?Z%HgBSqqp^${Z_GhzDZ_ znTgGPTtkh;{&uKjj+Li@^9LHvGt^tmd!&RVmaswKfSqGyCh-sxR<{+lZk*OuSUuAw zc5VcgIzue_>A+HFh(%ukEOmxh^mBlv&Jc^fihNr)h(%vbzSR?pz6Mz846*3zfThk5 zi+&Zb)EQ#Y-$%Z!GsL3bNWQHb#G-EjmO4W$`u}O2DPf(lbKFeF{W&lU#vpek0NZ(O zGT_d$bI|CzR78fkUj&K`)^(}GV4kl)slmD~JrTu{PFRQH1RUgffLP+vX?W1`J^FdTGA9eM@T-7jP8MR(^SozXi51q?;)-*colGFWfTklKIpToo>=tFz%DBYgjn<&fdf|= zeG72@EQ2?D^joQ)ZS>oK-KU~h?EDJ)%sEC+Ec%_mSyoRh`aR^^>x)?Q`^mR@V$mNW zf3C4lEc(ObTRpMp-vSQYZ20dJvoU~t0-QhJU_O`1bw?~=PXWtyM=W}NX3AS&!tx!o zTzAC6;rA)I?ubR7N&Z3;mRR&07oKJH#G=mzmg|&Q^hMPF#MmJg{V3r4MMgiK9D5xR z3ug*BOALqa4dj|777l-3%C$x;dcLEPbx|A1`MI$}ES$CE++y_Wf%DmLLbj0qizpWU zV;=r?;Jl@V^BnnGqgeQy(=^Xs3;TidZ!?_3A zzTr;=&Rh}2!k-C!memuBejc!tA+hMIf#o_S7Cq-%mFtvP^mmbOuPJ|Q!2#+g8r+%qI|gSER~g)m_zr`E#MK7(B<2q$ zNMCHuVh!~?2+mywce--=%(=J`wK4AvhQ)I&;A!P^Dlvl(QPqsabE~-s@o6iG3YW7U zot;ojN8i#Mo7Hgr^Gf+AS~_#7n=^Dv<&2wEL0i)? zNhzGRP_3k5VMT>KZPTh}%$&z*kWBJuQ=fWKw^?3hs--s57cvty^=xxiBy(1{u(h7? zsO@?c;-pA=scUw2I19%t8Lc@c@zJwVKC|4$;P=5qN@s~%=3`=4i?hV6Q}-<#ojSwu zr-7+!+lQ$;v)yTCE+_;)W8$I=6h^_Bc-D}fRO$?8@!O`Ix+GF%t}T(JesQ$b=-Lvj z`WwNKg?|AeO3Ygo!I-)#ff=5U#Td*fiGR`y3ef4!4ypA>u4|p`u@&)#crbxSR-^IHIw)y<& z%=FMN4O<=pc;hXBj`s`^vB$MXz4l6BuO~>fmxxX5@qL8X9&c4`rOyS)Yj2JxeeFE< z`0VPnHywU$rEj<|eKnr+rFiTW0(vNPZDKCVg9=7zQ2l+ur)I{CK{+_L|}5 zJ2w%rM~*kYZ^GUv=xDEl^`pHt4mwnsh={$1K=Rt_TVUpRqPtJON-bm2k_eKcX71-xnN5Al294F z_9nvK2y2T6vFCv2wKod(dcvRS>w-<}J?=~21F+ZD`S^)1ee+%sG;FBzGY{GJaxQhv*Tz4kW39?L*P(zgf-ue~8K#>Y(Nmwf`nUSD5+b8&IEmERm+ zeph+Y*TZA)?>>8zVUOPFWcX*xTz%UlK0Hw$iuLm%io! z(ez#DvG;ReZ~E%e@$HY1S&{T@gWH?FVFR(IH-2O=zZY3Q*1wmq(Vm2R@?6h+UY3W0 z`klo^bU^x{QM(UE+LN}H_P&5Iuf4ZnuLgP%`cVRi(95g9MO&kN%uaZV0KB}n!7K9c zB((~! zRzHu8KpXb%^Ygm5&6Bn4r5;qU5op8SOV%Fm!<333?nfG#9fNQij2(|+@6n*Se?X;$ zew2E9eF$%7ux;LZAb9P)dIsLjK6{^>f%l@%UUHANaSLO| zqexv3LFOoa*8(7kRpLwDNO9mOycftD^UXr2YUsTa*BhEjeZA2wyb#WZlpXa4VQ)Ix zEc*W#8@%=NR>hq8|D!qX`WN==HzY{;59YW-gU9&LWI_6(F9PSdt7#XV<4)$UlVg{W z<3RvfbScKyez~GXN7m-f zIVb5*_QBoYjA-g^k)9Cs66P@C&}N5{Ax$4aRfdmN+N^;yx((!-@C zS8l&D5wo(4!)$n7jif~8jl!H!4XcWmE)BJNx@hG{rmno`3(N$9d03wBqE;qmw`;BV zLUmZ3wzIrwy&B|=eb?tpF|PQNf^|+yTG7^ZX*~6zauPe)<>u{IjaV`&Q(F(hKe2ZGTG@Ow5rPH#!G-{={%@1?e)|@jl_h9YWdvoiC zHazDksi@uDRc`w|>V`->xsBn}(zwY{_sVeHMM%fi`k9{a?xa=ft>&DXpQ?vyFmFp; zPgvMoKOu(Es3w511&mTBoX}HEh7HdewY$Q-x_r5G*}uDB{=@e_Z7NuI`b;j_W6F@L z@T8UMKywbhp*^H}I<589#W^j%R8EVOD(l7s>1qMa!^qYNYfy zw%%=QA3ve~jfierBge5vXJqRe8Jitmi8+YsewV~m-lOH;8*4y|iy__ms}k$WVm0lP ze42)<66dJHk#Np&tPifHdg_W>_q%xa?t2sF;d&a^@P^l?p?y*|YLdj@9H%Q9wj96g zw>3H~?kc8ZW|X&UX8l_+S0>%ja5x`z#DAt(4#lxTFG(`}7W zTjlqqqL#7LnG$cQd*d#zAFZ=u(XIJmT zt-zxK{Q_aEGcMMhj`FUq-8b1y-W9jC!5O(cvVOLMwZiYzclh$a7F9UWX<1zQR%!N8r^ORPOFG)v zde4A|o`FV-3+BP>dpau2D&v!~wJ>_{kHi%C+ zGv-%f1&QFig)=IK2JQ0KscP1Yx$`P3jD<7V?~pq7%8{dr7mh3`9zCG{C8Z^0SI?e* z&BWUm4qP;4-oRPcl#jb);)uYa~U zt$%NyJNoV^MP1>GFE;%h)Li?+Xew;P;jJp;D~Z_apxxs=?ib>XV~*yZl5r5<6J7Xip9gW`~pR4;;llwHbIJ_lg`X4uev3IrmsL%bJ#~qs< z6Mk#N-?*dcGj8VHNEdaDMT2mR!&@@O-(q!qYa46-JnbJnU&dV!;h*Q@ch&r8d35#p zXKDYsNOju-q@kjiYClUY{9pm3ljgJ>!6Q2EID5coa(Owp6m)S9V zgDo%CiFACW;;Ts!`oAX*9O>r!A`!azO+x1&Zn_BFPkRc8?j_dqejGVI z>q;L#su?g>$Kqhi=E(;b}5cx!7wL?>8y@-r#TtVfi^sAfz)k zhaY7j>DXL)LWspa(<$Sqm^R@M3y04d!eN~h4zX~G$f04#bZo9mWUz1;SAZWmA-qNf z4+VB-P;1&b;g`TIYfO&;&bMJ%&hAX?Al@=(do1f+5{sSQz&`@LHu*?Je zwgDN2&8^f>W8suS6<{VHWM|qau7bT=%-W91`aYEo9L;MxK;oQhgdj`9?ljIhgdj|k;9uFb_{5oJs+x_IYhC?izH0tfONi2F^UwM77gLK0t9Ae=xiL$1)=JTS5Xudta ze!i@!t;=eL;d{%9RZ!N&W;siF5=*?~2UzfsVc4V|5({TEaDX2zA*|1N1sdwU7E({9 zKqdUUfb*@*Ah3+t(&@B$@uqW#hf@kHWlJnJ8L!yU*O9%hz1PuHhP8TP3A>njdz})C z{&wKJ{@6iku*rEL7S27u0X9OAwb)#KVS*3~=K)~hYylPyv2Y&qaGoKj3Ofj~aCQRA zn%(<>Wer(k;k@MGyhV2~IRFV&S9#%ec36;C%kDfp9#E zT+775?+GmHlIM|Q<0Tf(0CH@34kKrgu}LhPQV(Z5Io1xbaHe=T)5)=Rh=ntU9P7~I zQEa@`4IX%Ch;cy&=)L~-bS5R;55Q}~uaKJjMfTd2-nyh8t5m>?! zOIWstq9+zT@B5-B7Cozi=!r#txkpbddbX3oCl)<_qluna^fNtrV$m<~=!r#tt4B{P z`c>3dV+SD?eP>`^ypQBvh8=|Y&0{7Yyu968G}Ku5^p^3FW5{9T5Mtp>1QyOz zVBru8ho>{I2s;R?yL+348Vg6a$t6aA7dcC!SUAm4WtJK}vFPsy&a!%9(QgFKEW-{$ zEczDUEUPCL{S&}069OR?{WHLMBdAqsH@3h?4fWW;d|RF`K_&PIu;h_g?7U9SaO@y& zVhfBSQtDl7a{nS0{t4=BnG=g%d9GPv(I*4Tn&#=i`NaqXITu*s3VQTxw)rF3l6Ann*H?GwWgT#037ZY<-hmy2SoFETvfe$h=nH^ly?bKO z4*{07(TPQ01T5>(GaE9#jaWE5oie_SSoHc@z7q`YK?t$?HPK(h&=18L*6{BNqMbz^+XvvFID9UxFQkSoHcl^1_0gb{?-a zdX}yHKJu3H*vP`l^Q-1gy9HxgDyPkyyI{s*EQCI@vZ8w4l4(GN>$uaFtwysKES(=?Y}VX)^K7Mw(aTcrZRZMQw4`zx?5YCa zI3Y>sj3o>D>kJ^pF@{;e{JQx|=bf%wSfO>XLyAr_Up-^Cs#=U18(rI-Wwd1O?Uj*e z+ZcG%=DA|gVbS`fvJSf)+97euDe+SD0`K%NgP>4qvn6!Q+V7<3aY|y0)h9;5RG+4p zyI|S0`3s|qw3AeMD+&<0GYo1%M5d-MojGrA+e2=oI#d}7(#EklsN5K4h2w4W^--_q z9vLiyfiPx0_sA%i=-8LY!tNO65}Niu9p$n*A$E+*Yq)v60i6hLn_6aKPn=|&XB^}5 zn>KhIZ5STnEPfV8MpIPszBFJK| z)Mt z@Z)od2zitr`RrA9Ht&sSkFQ9@UJVlGP2Usnvp;o!qUYm#ATdl4m5^V-ULB6K*8!W@ zX*?_8zc28rpzsfncTgwNhV79qtF(uvY>-!xUM+dtk2)nB~Xr?eydI+r^jP$Kb(lHX;H8zWk;kQFFkhz4Nh& zy*GUIr8_Rh^hAiaFj+^53=&{2*Bd{y*p=A4G$~_y%BOANdR5;tK4sJ!yxo z9Mrg7uR%Ph;n`@vN>6`u_7z6&=7zdB_BPFKm~i)jyPZ+7{e`6$V6+e5xT6z}Og_w> zxlh+^Z!B2Jer_9(j`wOX0_v{1w;JoCz5BL#te`jU z_?Z(APb|59`}Ns3ti6H#{m_%HV{{CF>B-i6_voEmi#V|?rzSxi+l2e>`@*vqe6)6%aS-u_ljdYH0FN>Z{=XiXtmCBS( zporrnu<~{L)`mSro?gH$^Vv5uS?U|>qW8Qa^qYGXd#R5quI+`DVRz}i@GZR~=hr#D zsx(orUJL8V?Bj_u-adM+r0$w{qI%ROPiL8ebPE z`}@-R5vUo6vyHQnz_Zai=4@=McXk!T^wM9euRX3)I}W}1C*#VKa@c+)d!Q#qdhtio zz}~lMWr-u^-&TGf&V15d)q5Y#fBPzo1M!XsC@f2C>e0j+jQX3Hl03f&=M+bYfh8Ta zYI25_qH!Cn&tIB2f@g&>d^mpju0eI-#y!eixu=8MP}d%9Me<}%KWFE7^qiMhZBemj zRC2PS=Kb;ENdwjSD?60gV6M%@W&H~7)}b%M`7N&C-?1TgNX%_JW`+2>C6xzn`0=@EOzJMMlTGOM^B$yo*mdrgZ?-A{Q0b8 zB;A+a&YC|)ywUrE;ir4tvFSNi`}0}Jh;j2bptxiC8NT!w_X45gml@-G!sEUS?x8;nw$srI=t-ad?|g1Pmx(a^?`?dnZ#+bkxt^`112zF^(hc^Yle4crk~e9 zI_eYWuA;CGr>k>SdmH|sc4sKgtsz4DLws)OhfEIrJ=xLjZqT`X=xh2%gbdWzNFFN* zgmu#GtD(li;r9nO*XW5wKY)76Cl>wXz-5{ad(+RhPV5j1 z{|4%-Hi^dqRZc8EpK z`Ve43Ahe%nG1~>VH?`(>o$yQH&f^Oe$T)275DhgJ&Sa>Ba}zn27!I*;7JE2%0q0wr zx*RSwd}87AJWBt#p1^KD!yy(9tBY`04+H6jGYSWn8G;ZCe>`wLU*G0<|n$!@~Ub2Q=GimCo@Jt#_Y-k)9{sISsMrs1I$nNxid8dxXPRM-uOMQ+(Y5i7Nprm4 zPboHs;HdIrr7ms&A``evYD&U%VDqE~%cuZ!VbePU7^} zGknU6_%WP0&oSSLqUSkAO-ovFrt=fSrV*BqE^S>v)8@80X`VU#3+LlYY~{2ib7m~Y zcsxmbG$kCjcZLsC+JL?u&iH{!Q@-URmgbncVeC-R=4Y&aL0r)Pp=`&qmVMmPA*SFS z^t?wQ&ra9DmpIAVWxMW`IP2g$c|R|~Llj;a;_&i#3%#)oUJ-Z%d-no$*}5TO92r zTR*0c^FDj+ahwkCGa{0{P0)Mo@i~d@Iqe~-k@UTQ0A721hdWb@;VAa@0C?^F%41KL z8@N1rPZ;r3NaDLr7_=||Wa$o)Hj7&}hiT3zxAof=I z>~UTzJ_Cw~y}Nz(=D^-CkZ6z3dSWlpm){C_928?Xiank*hAFasTVU@=VA^9n6nnfL zK#hDe=!Xxq6>y8tk6Q{1^C;5H54j!@zcm2JN|kt#H&Prp3a=~ddA}L3eW5UY6yfn3 zS|m@x>AD{UDQ1>?ARa95o z@Jw<}2m$0I0~i8oNFauI5+MlzY^6y^0t85r0)>DG2_PUKVnDQN1LOn}f<*%sskJEr zRcfgMQcJBR6cCZ}SVUB+mRL&_e`>9@t*!dr_v~3S`wYRK_x-N#x}FVZa<8@TS^Iy_ z|Jp`nY1WbQ(yYUo$#Ms9Zb(qPi$=P4?pKsr>*``~XE6{QkX=??d&r0ca}GW>_LEDh zYr7Z=LK(R8eN?-X9Zp^h-MRYQ5eG(i&mhdUaB@{-j>fBsc%E9!*3Q@`$`?!9nD~rH zZrOn{$(z|$>GNz6AL<;c)GSgS=jI#UH$n@}ll2@d2vtVqC7y?lKXu~dsS~H4d+qpBjqs_{ zkh^y0+8vrNs5Nel9C7`EwAZWF6nZm(+4|;4vo%sW-mPJKcWO@Aycz2&m1w!rp{|JTV!N(zp4Izw)}4Uvqzsf{`84Mr+$07b^0HxUahW;HxAbo zHwhb~`9liHVP-k134;k_^He_w6UfhUhOc)^{vjsVC*)p+0o0C?Qq^C9*Y8E+v zEJ$tYPqK3xcH;SQ!O6V3vqq+yJMXDxW@w!4%f=hqX6w64;V~+H2YkS!O}uAf&PIBV zdAH`RKzsY^PqO(GJ2Nyun`)evr1;m#;p5-u0~TS-xun-t7){;8Rgu z!{?+8Zau+!Qk{uDC5()SXMJVuiW2%Wl3HI`E9igo(>lDXrJXbKdEHU_d`dR4MzkC- zj)Tu{iBwSX4iRzY$N2rec%I{`pyHp>;`zQ9LoI$WxT=dzFV42tn*=*3nb)5xC^;-5 z_GkLze6n}#=C>d3OE1CR{~dRKC7<-kA82xPemnc@U8L&64$vjC)w#QbL}hHyH-^43}3ugUn-v8lBl5M6itp!znd@p9zHqQ&QH0R!&ML4 ztI#J;_Q_s;l7044?EN!beu^)?w;lg=H(tq}eIFwM9QhWadcmGR$@u|jcFTbzZIaSy1eBLU4CpahZdFtPN^+%u05?H=F9D(yvHeah=nsj<4n^y#KM`SaTbu{)DN+6YBbL6I|bx8a~-j8hH0EKatduT2C;A| zG|nV)96Q9qnXYm8e99WH><|lQIXUu92(b8GswMwhicc*3HRShJ`t=%r6ZuXah=t!m zev0C6C+8{;3&)lzOW$DU&^Q~DfooH0TyoFST?SoEB)WDF9E-X067P#|zD zNdF`j&H_zOEczPY>@;i;TJW0(**ArHr@e?p&#Z`^SoECVEH(}TvFL{Zi_fQ#z}Z>YAdJH=bcGF-|EdxX z%f7RqlJ+GQ{YvVuQ+#64Hv)(IEB!tABOGGkY}PnC$Z`5Dv2fT2!cIPq085@jF8uI43^XAlC=jmwif-hl55V7n(!FWl+w z6}&nS{|CPJzNC2nSMCk8)}Dn9v}|^i(*rF_=!b4j*(dS2e-xFvnOHQ{&!eLb>e_!h z&CN4?CPWoPRfMkgD&pqZv*CYa>6{Cx>`Qnb*^$AGccQC5XLN0NvhPOI^Ft9`h{ruJGBT zeIDl}h`kJ-J-*k@a|znxIhxq(1)%5e73|knDi=Jl*8@E6Q-~i!ChScEkM>xPV(%qj z-5w*_%ir_PK85(pP=|NzC4a0pvG-Thscw(?;C*EYlD~7{ai2mb;(pq5+JomrV(%7U z-QG#`Db|Msv9|;Y-QFH#PV&d|GqLwQ0Nozn+ZxbL{u;s4?Hz-$Ch%B)Nt(SnUwJ#@ zyO{Rsk3K+jdy{b@E%`&!xcU2;&t4krwO3yH_SWq!*6cBT#<5)v0_f%C`kY6hmmu}` z8}M{{YhaJp7%VUIDfWI2tlRq#_R7Q<{))XF&OU`s-2J#lAA53#%3X20`tya4Km8V5-xJ?X^1Rw%>d{Mi$zb~ z2odmCcv&Fn?=?P({4tK@Wf0zB)Qi*+^^;-m(Kr=97&7aH<7syF{KatB<-XbYMejA{ z4jh{QW!DQlR<6=h$A(PwFVj$OG-TDKrv{D0;P;V(ztqADMp_^~`s@6I2@;1DlUy$V zR_^$P_mS}aUa+LQ{w50F`0(EM;M!>k|MIV$#;?oy?nk7o z`pjMMdqAi> zl2sRrM`O($OO4om!T42KCGl3m!I(%{!(EMWviecM#z2wPA1-2km8tLN@s&UPKa5M8aLBp;%%{e;%h`nlE!%n=96?+BpoS^a?8!m}&?tC!D>Tu9X2+C?sIU8fM z!Rb&JKmG9Tx@YmuU@KNKJcTzA&(_ahlX2IHyDGlt<-EDW!33*AUANC??JC_JSz1J2 z4$*!zVy1pDx@ydcF~wu~F4Dl8;{KTSYQ`VRU#@s@{0r($sGR3By*F^(x7V!362roq zNzL_0eRZJA7hTN9b6*oQAux~Bi%WT}yxV!#|!pg|L zNU{6oBHoL`!!B=y!FOxS*5wG$fzOWaMtbU##;P$vqq?@U(WR++#s)J!UVn#~d(44HhezO*s5!pK zS())@{cEc$w6$E$SSq0lUh}1N^cC;u-6X)ZmVdyUOAVV;>3{uism6dAgN1r=> z{KTVpu3J{Or15aWfwjY$P?B}I4Lh1Xe_Vy) zYtXOHMbcJp*J^orJjVjx`!26PSO5Cz=~~}7zwDhcI;1@8S1gckaISDc zd}Dp3_FgED#-E?NjL6<`858cE5I5zcQFF>qm6wg)J33>`y<_6W&PK0_DP4tng+CV5 zs#lBDW$jiaU4(L#!cN?b9d0JythHGVr$aDR=B-;k{xWrQr?9Xp9`U{eMZV>t4OQl{YniT&DSGdQM_R zdU!PTfKaIUcU;K^!Lu+T7o5M5qv%KO?*A`P0KXL zt*rfmIxB4s8ZkVwN=Y->w(hFAUs&hZKNRrq9}0LiNPD4x*W2CvwA1Ej!!O8BRL^b4 zg5B4@AW!6+-z(a!ZCuHseG&Oem57JZTn-!S-GTd1y*tGpV^NjyUz6;k}W~u+$ zb{Ed#ngfR{wwLY~4lAs8qmEv~ymqh>FbBgwUvtNUG13O~)ONhyn<>om{UZhsCV1>} zo2`2(3%Z`#{IjrkMYyxcJJZ0Nh2z_84Iecusl)d>jhL&~;%l|0taWoDdm~rXKUKeM z^~c(|#HPaC9o~S)zB%?)p;wyR(x$?kjcfML$M=<0_`0kTU-pd0mpy5B9lxvGJ!|{C zD?p5n*D!~tVh&GD&$>G`J+n`r^o)Uh()$+mNl&|`PkQRiKIu6(U55C}5Pw-&Lvhov zwfmY1>UP!P>#+ta__x50gUty=mleCUoYnXczOkAPzk_L78ALay9bKiS+YbM8dG-4W z@1_sBP<0{BG$u8g&667OZbgD=)s^Cmjze;u2=)#;ld=NsPFMrNBAmsKCe-2$(6t@>vJ{8CXgm{Iy*M(MK(b%XEm z`rv!KRD6$@x+<$E72o5f;(NTyVo^`{9`7>LYnu2n#65t_AkS)8o-;vn@0#89!J>^L zs`r0nB*yPv9W0t)&!Or{DohOWo1A}oq%()kLM~q+0>1j0ApPDiFpNqb3b@=C?yxqh^pQVoCHz|>6jKs9yl%tf={ zHsXfa?a^{Un+<3Bvlms*j%HRbm^T}%65Kp{2_6AD>p{zM&^2@U1kJu-$efrlv4LP* zhxm>OojP~9sB0)O$?Dd<$HmD#Q+oBj2+I`PGQS#@f8!~V0Hgol>8FPO2lNG=EZlblM zUrIx$>ayywf6IJit_gAJB{AbSg$ye8m8nE`K$5WSl z+G9@td)`W)*3Y;y@v(8MpSXO;nXhk{`p+%*U3>b{P5G0H0(Wlz)7FuT2S0q~4=>(R zwd>gB!*026z<-kqHyeRPiTr=&BS^L)o7tYH3bnMHSw>>!f zZv#Ip==%5im&zK}9^BJ?)q!n2zdQTI)x|XnlD55*@Xb%JygXrP!X@8(yhm#D*qXP8 z|9R|(eLuN(zykB)-&iRh|7QKe&tILm>E&S0!GpRL1$riQSlspF(PwvFa_f6t<90q? z^1I4ccRcmS#s8|x>ysCr@b`)D|L4=ESG_yvfonVcbMS3l51za2_=vCHpLj*lv6Cr> z=1)p03KS&tK9~33vqjx!O+K^r+<~5N%^i4l=aXx8|9$C|%`KUi^!nR>LNl)U!@V0G zI`wANw!d0^AAI@sz4SfBg8{YlJjMhQTXMfcFsmOsl=KikZu_q2D z7sTIv`?RYIfAq-EPd|P0$|d(ae`A;QGZXLrM(MUIBCj^4j(@AI|F6cTb~P{SIdagT z?Qd?L-1!Ga?7k1WRlW08%F1Iy{_x7q8806i^Y@eAowBLq5BF@F_p85bx^(Ev13#(x z+6OtC{=H|&KYKoZ@bA|I%%8sX!P8gW*X`NMYX9@YKip{~J#_z-LodJe-?Iw4Ej`yd zFmw3#+LDS+wf_0K@6@i@@XY?pAIvZM$Fo2FbivbSlP>=4YnSgaj4aHs{QYnK@)4J9 zZs2#1Pq-36ti4vBrwSTv;NR&gg1-0;c6_QEujEBOdA?7c=95=ya&&$=+V=VENrjHS z^gG${X%dYU4x;z(Vtf}@LJWLIR~-3HJpAJN=`7!Ro54*N-~L^VfAQfL!lU@b z82xSjR$IeOS06voSmxC4?Ka=C`P*H7qAlO+lPi4kLq7SqPkv34qsyz(^Xk{~u?FQ!e5nuT?Yw}BoUkNUg zW&X*(ON*!M`Mymz3Z1xAn}4-21AiHc@H6pdFZu5{dBEAful-d0EwT6Drk}CH!5jvr z@eOQP z-<-4-+4i$-`(d{~_~#E5KgZ2qw$Gl*pEtg)biXxI^-*ZsXMa@TO5Hn(WMBLp&UmRu zd=grz$j9I3<2#=l(VT5B$=N^I-oK-9&>35OZMl>2tYdGhEq5_m9C^PjcQwB4@Xy+E zqVaRb9z@&z&wb@>^yR0YFMgRjw$=W>_t^_O@vP@0<6`4sAHUhh@949Cw~tRBa1vPG z1wI)|TDXDneSP&??u+L;WfI6w6#;)KzvbkI^Jx-}cUyh@>wWdJ%GsZDOp?(DW6%q< zC+7w+u#<%O@P|HodA|BM>XYaDDVc`>tzEIN>i++rzCl>u=>epd|KrH%Mz@jG>J+bElpJVFkB*7s~^W8t%16wLgmu+b2R#bz#WFGo)-`U${RA~p!b zqMrsV-x4nY77np+Zqqo!fF)gG;jrIIx_Td;553h58w6tE)4uriW)%yESU8(BPBJ;p z7$g=>8ue?iK_C`A^JZO4t@>6<^ktC4G=RYV7IwamWt~X5^!k|$y_Abs?AZOysZYJX z-AS8{{SCm`c%PMl=c@KAi4GP!TOrGLn>)yH#vrk9_E7JPL1NLL1Qws*uK;JKV1w`m zev+;|ex133SoYuT)@E!F^!~#(3bA1k#^Y!Gz=ly{Z5mYJbfvGtAF*lAhfd$n=flO|NS`5= zys@9l{7Ec&j!n@Mi=KT|zT0F~O1f-QDGRai9{~>c!v^6|{IV~%q46aCgdBWK!zVO+ z8d&BTVzK!;a5w`S1{~L9?FVAv!~+Yb2RTlA5ew&1jl=H_toxNoV&Qz9dZ!-}i{Abg z+R^LZLXRWg=>x>VuhjI!qVJ0&rCo?cZ_m|EJL+@Y5b~YAO)Px7PdZ~??~`^v$pR69 z^N*~7K`i^S-Q~MbCTTr@4Fa)n*zVylwaPcK)XBY&h0_8odScPrW8A3|eT<(3C&a=b zoWalf5s|{O@0*Y%Z|?(#t|Y@SKE^LQ+lEGG)@_T2WnaGYFZ;5sWv(L@P8zVxb;P0{ z2`uX?5R0B|DmHoVNAkeoD(yln{9NjPtnx-I`m2D$R3H@NXKk@z)I3lQm2k$B^Pu7o zi=9f1Q$>zrhgdlCH4f)$ivtvaSU8Qq(r<}Hp9&nx#|9w_zwALaRC#v#XE9X59|J7) zKrH%6nx0tn%$v0h8w6s}F98l0P^;EJmoZ)sSvYqA3+G;7DLb)n*p-E|og8iu_(wQ9 zfraw~u+$H+aQ17Q6XdjDgFq~t)4<`u)H?mynIFzT7S1_fsb^x*f2iq+MW2a2X8i;T z1Y*&1E(&o1Kq%2L`={vV0$UF$4zcXJ7+A_%3!LrPxfE1uhvE|pKNC2_4vUbBU-s8* zXnzkca~GRR_+`NIEj_X5D}cj}k0iUVI(a*VJw2LM?uxXLZZ` zLoE8<)VFg!kfG^`h0ij|c>=NM?J@feC=kZuCvz#WaP0BuaP0g$#~nTY%fSyjoO;?} zCq*C@JNE!fKOq)94^g5g7QNke&Un<@j?=5O1+nniLSgBm`pN@ElS&oVO)i zeGcdSUrCo(_T}7eJ*;dJi{75+%and3^kS1(IAegtCb8(J0ZUnkML!Ez^0|l{r!2(6 zSq2<-(xs0cNtakSw*yPM#G-Ekma-6w-uAQR*xU@gkEt>e3x5Z&-k; zUk5B>gjn?Jso$mS5Q}~jaCW8AKLRZC1F>)(1(x}NSoHgWWqu$Q{SjcP&*y+;emDu7 zGF7ETEc};%dpUYy(Z3EX^9ix&&jE}5cYr0&#KL(WSn^CPdOQv?tVdKHh(#X{EH*>H zlIL!~DZCIzAQnD-1oU$B#G+3FmOK-Sp5Hx-{d{tEE1Sf^`8u$ag;?~3z)}`s(T@X` z`X?6sWMD~a2C$Tc{&}VTiG|NKeWd=0MZW}C%0evq+knO9oxqZ3V&SX=mOK-S{vKed ze`3*Z1{RxJHBA2kQvbxle*{?SpIG#JfhEtxqJIil>>mIQU#se$&(`D^L@fLxz;X;C z7X2|`8DGSrKSjMW#)(CLM$;3Eo_;5?r>H!=r(0f(xvLEvG&_Y9)wb8jAstUb2c_M0aAa!7<{Dt&Kq?)I>7 z`jRtC>6xx@{CN-#Pp?yED?YK<;i0{kqbC+Ur$xCgBNqJ(;P4!55SHO5Hi?CE8?e|U z7Clc-#U`=nQ-MQsu|defFMFO1?R)idZ$!@<4@+T(!z!>^6rWgZE&vuz6R_ONA{Gv9 zT90FcKrH$hz}5}eAk4r|^vq&-0X7IV_z8ztIJW}}XN|@o7S4K&(*hiFY#!9`F%6#r zmVQDkcHX4kxj#TG`hQXH+#etoJ?{@o-U2*_*?~v|V&NoF@ANlf(Wd~*zJ1Brs`e!o zP7+k1MM}?WaKU!}bgr+@>z@vvdxaOPeQ~HUQf~6F*pG**m!l^ZeI{^diQ>GskhjaUEZ%cb0jileYGqfZ4C!JISaeAr&{u(t_)&bCw%@m#alK zKhMz3vlq;<6V^$RAypXoY*VF;uGQu( z!0N8}(B;O3QGF0C{CU+_J$H8X4d<^k+nzr|RS>5y+~6j{#MzDTH(K{q{Ret!O23;s z^X9pF=G{Sh-I7Ju`y38prQ=04bKD$oSLNZ4O9Dr&kIM|(3eBUQqCo7RR zc#-xj6O|qG+nF`d>*m7orZ}0ru4?AZUSxaD2iqAU>~l9RqHn`?BH8CuaGpns`rvtE!SsA{Cgry7Mfa3XyYRA1G24>DsXBNvDETEwM zCS0C>0exP3rD0i7P{i4DWDZH~RO9koApo>X80hMe+krU{$1vLi2LKF6Rmc4=vrX*4 zFDkt7=VHS+3!Ma<64~Kb*b>Jn(O!?TN}&_?QeWi* zpSSy&AI5dYF9!+g_Vz$mi=PCs*B?CH-lP50dnB|M#82$qf*o{w`4H;G82*Yq-ha{U zZOBmT!O|Y9N9=X>+1m$u$?e$d;IlXKa#cRs>!{h|b*Y}e6A=2gWAB&X>G_)gdrX)1 zI%)O}q42sr-uv6yj=lZh>Gl@D-g3uY7tP*gpFO@uzP}xN8-4cP(Cl^9>|Nt4Zzbfj z?bsXREAKR%C=WqdO2JLk>@DsPUEV?ziq|m`kX<|60G?jn4gJ+OHneBq$2j)CQ*qJu zo z(q6g~M|=N3!|L`nWAO0)gaonoK6tvlgTvH2d$iXNKgQAC7N5OPNbwM52eJ1A) z#{C8uw1=VW+WP>8_53{odym?d)JE*R3m)@O=){!($ozt#=i00G*_(#JJ)H?SLF`TU z*?Y1O{`$dV{;t4}X|cR-J39{tx7Ng}xLA9t9iukFTkqqgUV!&4AFuENys!CqGcLee z9#rL#{MCY2E}23W1y1$xj$%@7kM|cC;yz-p8zx(Qz7l%@XC4>cli+P@r(TBm?9D`@ zrMAPH44t0t3h;{B;cazzNZt+y!IM5hh2R9Iyuv$j0bU^zWxAMd?LdFRvmDGnjN|XL zQ(o#A2JoPv1#%d!L3u%4tR%%7Ap-sikN%EzzppP9^UGG%pGg;9PxJ$+W9pY9-5HoC z8DEbd%Zn)o=ktqQpRZV?KJ|1ntwXvG!AtSD_iRd4@;9Xwp;`k_J^9X)*@A=--PGuPvMURhB; zty0V7`?DG{uZfga8;_%gI%*|+M#BwSX-8?L?dX;;w%@1@W@~J}25jNMwuExVM#&HL z!9a6eNeulLF-~HdgZn#_JM9=V%JT#4<r$FYx$W$G zu3C3qTILIKi~OrRy6JPBba)A7s?4)jZmw~?Q(xn{jbmYZls81R7h6E(H)8kHdrI^+ zY0qbs?H~C&)r;XXIMNB;QQ_mr@e+$Z>yEe1lUKB6HH@5QwpzhP)Pwk)pd|oc@ z24^qcp6iJ@n{1}KJ93p-@wsj7^m3oKQu;V+ul}*RyY0!5o}?#5yuS7B(%@+LO-`;3 z%|^{ma*r;QJ%5~BOWyN}MPIAIvQsXXa)Z~G+vs`qc;r;QIl`-<3N1~uq}u3bRz$UK zmga-i?+01=VC^`f`u(%Y3l==BV%{mKaFk&=>1IE zSLTp?bp>@h>K85zjIYWW5p>zbbFnKOH)XWY~i@jVgWGd=ak zJ=1d@yLedLRq%woYi-WDtfpOBf2h*Dp5gqZp@QBNQ{ek71-{Qx;QK5EzR!BX_gPQ) zKI;kJXFcKjEE&GflHvO-IX2r&UX|T?@wMp5@C_YXjXQm@{f@d*$W8mpB&l;HVn zGutwgbSY9g-?e78H3!z28CuU~PT>{Y&5M_h_VdtA`s+KQtesI-mUt1otF9Quxwg4u z5HnSCunGPMrKBu7Q?!EbUrf*ZF~^$g1{rscS~u2up|6p3yw7ONZI4fc#wvx+-7~*5 z8b*P$?%$sUgS+c~jhQTfla#y{wt*Wg&Fl3zj`f8x&7BKlyxgMo8Z(Zh9X3nNlHGxg zv8Oh8J`#E6AbH_YSa2|4E&Z@-^^DnO#nH^9o65Y|=0deT$=6?;5@(t%^A9d5-M#K- zG1awQ40CLx#OhcWv!pC<;_qU1Z`=xh!iQq4fBd6sUZ7v>?%?kVCv8~K7F@9#UY<{F zOmpjr$BAyCs>l|2u9ZAe7wl3U`n746S-1YDYoshQiKWk5y*DNpcQ$U)_uEz`w$*hM^&X?4#H#=Bvq)Lq4-Ol< zHU@(^M|Qsoe|hJ%2-_o47A(s>miL3bCfg+#%zI%g+Jr}@qn|{|m@lhCZ6IrZUj5#f z-I22~yVo5xvhLlnvEYDJ*TcA@o4LO^aQG8z-JwsCQO@_=Ql5inN*?c%O6LTdCq>Md zQnAHyq2!VBnC9TWKg&;Ab08RZcbpY0jiGlxy~L_dv)u8a_WNs9DMsef|8z~yn${sb z{7Br15^n@}BhCsO3#4gd1?Sp0nr0lGuIa3y-Hpto*WB7R+a5~Tq8*WoOE?}MN$}2U zRPMY~GLur>(N~SJO+e*#*PRYi|U&1 z_)pg=_~)Kf@6{~(z`45itb3L-lg_WNjCITvt$AfI+c@h`H@<$Cc2+@+^jG#cH4DV{ zW53&Bu*RElww$w(ZMr+~c+9B{leCpJtN^YuLK|?j7aP?$-_vF<^u%B?duwxGB4!7> z$3{ND#u%O}+Ig#s&fSiN@ude!tIur1ajheIb@_3t{t^Q{q@#(e zJ4x}xsOlN{=8DlPN_Ka?)tp|JnY6{t&8kD4jlAv~jYweZy7bydj71x&*WYJEI#sX# zmARrUw#*k$Ftk%X$~c5d5~FvQ2)(V)&nFTu#G4q;wuVe8C4Xa#@g&4*papeK9nS6vu{98Q|= zj!m=GY~eT?@9R}*W3h%p_OW2b@jE6~8$W~Zeb0(j^N+6Kq%?TKml`(PGTQ z(x{xbRYlUqdO2mCWUMn=&Og)edvZVh(rc$)KY8}Vx#zH=MpOKhcb8i0u^2_p z#k1{P*N3*%aRt1pN*S6v76m;ItaFW7$>)tZV?pv9+qSvPH445S@y|VHy3wcd}j-Wmn$zvUT)?`+Fw~B?pk_^HxuKIrya{UT7IPB@ZP%I zI<9w+;HIa~lxAxLXPJ@{v-OjSx%Tp7U}p?M%~sX*U$_h|ESXPy_M@jfrEZD7Z8 zZKmE)*BlvTBt*?(c?Ij?1Kvx^=l{L1s^mmT@u*#+g6&?ROg~(8Ft;hEF{{D8^VTnD ztREi*9PikxunQtRoOcJ3tRGpJr8_- zdq>~h$*Id~uo@%g_^6&Y*PG|#Mj3OX*1LjdaJ+fT{-L+~0^B;MR%+X9qokjaDoylW zky3A!B&^fnriyDq%-ni8*rTP#MwbA0yc(=X1XuTx_Pa}QzE&3;5`CRb3$gt=+E*UW zV5^TT%*o*M7}nfy5Lfr!5uQ3LVU&@f&6N&&To6oe2CatdmB5?n7N8#VK4!LY4)J`s zo2^+|$rCVUkr!MGc_V#Qzh{C!46a+TaG4c|8^UuEJ@3rns{S3dwCCcUpVWofme_Hw zanzN`o{J~I`q`P;GFQ8wSv{`B=!ZKt54%_HUa3^c&DLMwnE|iqy%@8VR)b}3x>2RF z@1_NULzq&dn-^Knh;`3(t@M0yt+RKR-qBs+O)gZ+?gJ8?TS__?odEK;yp8wmXW()aDZJ?xX*`kr2dD3 z%@c;={4ov3x`O(B?kt7t@{Re1Rr>GGc4$|DW?Qg~_X8#8W*d*O+Fd;RKDFeJ>3ea_ zcIkd;m~9QV-n&aIV@^Msk3Tr+09N9vla*g~*&g}bbfZ=WxTl;)!xj6}Fj6LA^_Gm) z$5-ns12A6FuxkJ%ziJKZ%ZiJ{>|DJoGOYfUKo*GX*c#xVIg5umjeT z!P+-&E)kjx*v0}|%CawmvvoWhK2lJMcMy)EgYFk3=!lf%(S8Y2Qy8_4MU~()p zJcm1qtyOol18ZKJ5ABu0$TM3W$1|5b2Jfxz!JP~P*PjpL3!9@Ixc0*MsP^I`%BeqSn+#Gzrt6y`bEAOJz##XQYrISi+>{m+#R(l1@ym^^x6`3uQqUr>9^CL&y zXEg1tZfLKvh4JpSm>Rb{59G+jy_F6;uRFh0>|TI+TT{q7oQK%c1SRJ=$9F$MLUD`a|W*(_iHJgYiZ0 zE^X$Fi`MOAua393F?TJWJ6R2Dv4oPZj2rJWz7csE?=2uRL8@K6T&Jc^se7vsFVbo}h(_aw5Cj@?g$EJzr?F zHAm{=+k3iq%}w<$Zh2w*^GAPw{C`gT?$ooVpTUZ9?(@8O?V6`G)|+#iaRuaEWq9>u zC9J@CiqwqNsYttzm*DD;U==vwpxyV&vuV*KMD%<4%?Yg?WaW}0@e7OuoT+Ko8EwD7 zbNpsF$~_hzN^Y!A!)kS6r#;)z?B#}5Uv2G``~2J;iQlH>KH8q1I{L-_>gNK6l+HWi zx0jArx9!!dSEt^6QLjGD{r%k>q5q7_nef1bi>7=!YEk)XvgOdDj5`RlB^^KX=*df36CTF=Dfuj8)mkjJpGo(d!GNbKupN*(NDVZ_;}a?sao! zF>x;yf4AZ982sI6MmpUc=xIMe)AQ%{FpNs9Kh_e&-{@l%o-*RBcb9iY5OvJu5f@M5 zP0X@!9nCat=H?y!QRtOkZ{ax;8T$FC+0q4P65cTodvzRT#24}mm**62{#wb>k9s_} z;yJ%}RfM@Q?in-MT4G22JVkP#osr_s5$?yk#|}Or=Uh~vl~)}%_=M`sab_#>W|u>9 z_Q;re+}Yk{yfZE>vT~!@c6Z=HxsNWluO{03HHD*1eTiLPk`iWtQl1URZpZ!hxb&7o zI8H^^k(|}Yk+7Z8Ab*<6s?xqn(S3^;>aPiX+MZ{Rq$A6@3LZ=_psVsyaC5!2JEibyzvMsbH=BG`6vM zZM|8H6`S;D&dqh@sKGDlfmY{(xMR#~f42mvgQ}?BSA}~UTKlzeomKV&t5cn6t>fL4 zvl0D%q<%fg6^eI_P8)O2n3%D=GOR>ex~)n*hv@fM=`?1#&z{+$-^DOnr{ms-ZX=fG z6Ufh`^X{BXLTdWG3eFxJH{KlvYF@|HynZKzGfbLK!@YFQ%mk}G!6Y-<7VivrqmuU^ zCi(90h)%y&rLL{xmt~U2wZEjrltt$GM7#GnRNc$jxQvhT{q_}o9aeUVEA@@FaOO6Xrx;!Ir63AH8UH;##6|Mc=lt^Ur2 z**Yn5O3N87;d;v+OH3uhcQ=ixc-HJXXlydAPDhdcDU3639blEGQ*M2mZK_SYyK_n- z?SUiT+A%Rz7{8OWG|BPKAt;?fDbIRsV{0bqj@;XI|Dt=HA@jsWCWipL6?YRh^RyKM2 zx3`CP-fKT+>>SLTbHO~~?m^(+pYb?#eC>w9>Gh9wYKt2m)#7(_yE|Z>Y3}sz&#aAC z;5~!UMqXrFVZ}x(uH4w+m8#9^xc1Z6H~%fAx)xV>foF^`Y9<4BLA>@^wH+mab$xY5 zoKv)9>aEts@;(;K$KE;GzG1xmOr2O`?nm;wI1(@dx&|<9yWrFjgbtuOu8LhM|{rHAD*G@ zY{+WVu4K_q=Hgyr^ch-nqycUaqTASNcn0^?*+29%H+8q&YkA&V=bMb)ET}a4Ui$s@ z=yN-LPT;vvd&f8XYOIb=udMFhH=Cz!Gn*R^8O?ioA>F8}2b@(N#JPoj9>gd0cl7$C zS9Pe9VV$}a_rp)PwbLeHG6)00zWM_=DYRDMy>rS zJ}%$!U6;amzu&mnc}1V!#Po15J}EI$983en8qw)Kh=0&fa@XbC&X2y z{hgPc7QX|y)Yxxh#z`3P)xtodto=}$TTqr;HhkdV0c8b4^9u@!2IrTQmX!<{ZVW0d zDk#evGPEdfNb!*3;X?+N4lWoxcu-#Pz(GYtg9a50Egd*`NN#D~fTH5k!6mtajQp>b zr2)p^_Ood3aM6I$p#yV^^M@AX6&DnvDf0`E zga5bi)tkxJenX5@tZ_On^;_R|mN>;Srqwqtf_H&MHK{i)zOEWBBx=H`^e2#Nf0~~< zLRK}^cEX~j?d)`8&D_~b)Lz~`V{cqkbN!7AXD_)`C3yahwo)itwcrOsZm z8x@1vm^^LP;r(T`fZ@`er2?jibEFP3QaLGWUYRSxbix%H_2x<=!?sHy<3LfkVYM5Om9P2MroH)L5RMKg5_bbKU~v zHnZQ-{t2>pt4s%9`Y$IE`KC_CXWqW;_OBH^v9rgdKYjeSA03>3y5qXH@6UbgllrP) zkLyM~VO)3r#wQ;f*VOm1=N_AQ|Ej-E4U|kfIJx&-^)IDWy!zaa62Fa4e2xFj>nz^R z$=eBBXYp!#))!5zF&)=m4E+AhH105>uB?N%uqqeINrE&wEa%L^p%Xy1D&8`yA5qkCtrG9?EO&$Cv@?} zclF7MKH2ig-EDjFogI&k(fPgDj^855;Rwt68}E}FeR7p1N89UZ@6WbTp{FmsUUt0K zK1!DFMtQW4ws(n7zRcdgub9WWf6Q-KlcV?VyKeerpA{A7uS*EHs@*e84A zEzh_AAe-OK6+2~+{EhMLzsx6Z_Q|=tn6QJg_mVH3{)Y8< z`bO5}^}hJNK6!yp-sF?hc#&fVmHwMfpO*4`?BhS;lh63%OEr57orBwd!HF?$wA(XY zEAL>ZEGc&UO?LdfT0Hw_U(Fun`M&rMefgc>i?8tQf159UyH9@7C%>l2d+^;g1AV^4 z;Olhe$MD(jjJ~Xbs?Stke1=cn;miLRU;I{IJpHfe_6yw!L#6kWFaA?aUgxw2$3P5L zd}aPqeES#p(wn5o-JJbv?EP=C_ixeSX>Wrj=Q(_i!5HIKW1J)Jv*qFT{%>e}?tjE5 z$NBO{e>5tn^1k7dpYzGneexWie7{eo9}(UDFyHu|;FD!7X&EnTw0NhuMlB4+7}wk7 zy-SO?>&qt((E3lAlamQ{f179TKVFNs+fS3}M}&cMe2j5}Z$AB+y}vjAe$5wuwH<%X zw!n>&XK3;!r!Rd9T@2Q#W%_%yc*<;B6|VN#SA1{2R`PP8JN7pC-#J0$d zlE?Vu2Ym7tpM0-RepHjA+h??$UV$60>})mF$g&vA*(u z(;@;$P*n7xu~C`JUo`-539o&;B%D zJbfFhp!WBCCw|)A+9OFX!0CJ`rPFYsk98tW(pdHF`SdR_p^Y#&x!RuRK$Ysj$}ud-;w%&bPT* z`oj?49X2=ynBKnw00_$dO50wI#_t1u5%?M4kWYKhY4OqZbFCfEv{ks)XmXCVOvW@C z?fBjjjq*kBugWvmjaRZapD1~OFMg#a4?_O_j{G9qZhm)Z@ytJccB`Q5W%}e)O}>xk zR>(Y?h2@XVueyHq`h${Fm2qs9yvQee{a?j<$15d!RZWP|5Nf4LdWr%_2ZRC$%lRMUj9|QmtQ3>@$t87@+;2qo;G5P*}nYGw$m?m`AWXj zCl_jRbbDNH??2g%SMp*_j^?ZLL+^Y{$)0^BSGoHu**l&odATp%J07a|*M0Hc`GAVg zaQmB*<9)Js|7D)9zHYF~>m4tZ?A4$Dd{&)*dHqAlUjId9_Q_uVQ~Y6W`IWrICwudgil5+%zg?57o&Lr$#27c*^>s?iUvz&^ z*V7~2{3-dMPpDB+ z^~qj;x!Je>QoFtiUA~gN{-R{>{A#Ihe|5d<9p7*9#oub%_vRxdKjNl$tB zB`(RclI z)1M>d=<xy(&$f4Y^s9M?z+Q7ycEH|Dnmz_G^uc5YPFm2pp#WALQ?P zO@0mXLz>(Q`7KQzh5Th)U^=@n*b=Mv;*IT7&CE1%UaZ%zJ^Ph)f@lr~+5sfd0w8H^kvb=fBC9 z-dzTLQ8TdrCc$gseU4mi%R%ENr@yDzat9;DkvV3Q@Ww=UzBGZrV@49beaVfpMSH`1 zJnxhz$&T-0`*37rjxBdJ=q*qJ`KgY)3^)m1l^6Ts|BLc6l;M|zw>X}0($BT!?nWL9 z;so03?Z{h!lkhz2jKe2|@e7^&iTp1oUX{P6y-p+Jl-$ec#fEVL_kYvDOeP6lg3oC4 z1LJF*`Y5#HFEeiOm8ZptSM}S+Smu-ubUS|~PP|G#-Dq&{RjK$yC;#JY`~8e7edU=& zLkMZecam|rG0hi0&6l55if(V2|JA_6Zu-|wCIhGv-F zcUX~5p!~A0yi=Y1c}D~*et`cnOCpfS>Ek7?i};d#sZPI@D4d5}@$ z9_TA&82fCeqd`RmC=D*SxpW>89rS~;su9H5` z(UNe#uf$jW-#O{A*^=OCmp;BF(Eb!Bf5(86jM2t_eevGCS(U$^I_=28-T+9I=!r$2sp*MD4`_s0*$5n8 zAub|-V7G;1|Gc(v^m?1xZQ);gxr z)yJb#6lH{fB)Z+z%TBw!7tU zh-Ke2;4l+M;QT2ZV&TM7&qY)ah(&Lg_v8i2+ux?E@;aRJ%Ik1A&sz?MSnM+o;Vfl` zQqKK zBQDH~LWE-c!i+>H$4}~tSnQ7n4(DToFaf_XZ*U__$1hZ1L%fBLeP32(B$j>eq5ibe z6N~-2{^>gg>V)>>yOF~v2fl47CRr253!m*PeOqs9wr{9})(wMAE*xUn zmsKDfd;B`bUw!;e;=ZNWAP~#G(}88(X129;2AM)27S1AI;nVm=g@brTB#$ z90s;tQ8tNX-yYa5!Lx1Z=IpC=Ri3l7Pb%HpM>Alw*@_ zCmzwEaf-vaS}>;}IoBl?oB6m+A8_Nk%G&ML~?*S?l< z^!l|-H}FCe6}dP5geNH6m-?8w+7b4=Bk{qX>5DTXfSk{Za3po2G#lM$$iNY&xLjF>PPXdcgVzK!O`O6gNO>%DW zuyEejI3E$$C{8lwo6vHFQ-Q5pJuLf%p%34t^aFsizoT#g_q|==LgG6Vt{}cs;ko30 zSK%7!YZcx=z0=lQ2Qj=#>5l_jbsm;HoF>O9<14_~D;4K`;Lr+%69T{yg_D4#EW~0b zg`9fD$s)%YU&O-6Cufb~3?Xh%co=ZFQQ>jG(g%oT-%3qSEc*G>JI7gK(boWn)+(EK zY8+zW+(rE{)&Ge_e=l&jN$vXpInFVfSU3-9oJYxdSJ@#J&J)0)b;{0ua-2FL7S1tE zPb~VAz*0Y_$#KR7v2fnd^u(h7K+_Y8J`nWm5R3jI;L!I}KC#$=VXgPDa0WmhzFX;s zkmHnvSUAO+o>=r_G(EBCD>Xf_=w|_knpIl!iJg8@L;eP(Cl>zgz~PNbe<%6(D%?mu zKl?@?7XCdNe-k;I6o*(iTY$5jbaw)W?o*tjeI&giK&5BeB>iAm<*%;rf_@hXH5*Q0Xgx zWgaG$eJ7Lufa1(2N5+@NsUxRFaTynPHT^D43A zAqMw-!w;%`c@J3nB(ZRkHBMi0>J*n`9JZn@C%`rJd7lVC(a1O!Wjpg zJxl2)5j*uvP54oz$05DlbN&o+b}3F+!$Zh-=4xU|t4z}qi=LMp!Y39zvn6_B(eo54 zv>O`)o;p~2Y-nTQ@DLt;T~b;e&}(We6Qc^~z}qR#~8^FHc{ zMIQzZ{~8;FtMHTj6APypILywAFa|&25DSNG9sUhA2$lE=hgdjl>+pVT5bE*EK43#* z3;sym5(}TxhxJ>@Qw%J2#%Ua4;qcmAICC@( zv2Ydvhgwxy_Vu_^hx+ySN{!R_f7pBTxSG26e|VoxGjfPZlvI+OQk@24ib`b)jixjb zl~gj*T&4_-GKZww*l8dnA%r9(37IkzQpP;jb@pDhotyjf`98nj^T+dj-Rt$*XTQ(2 z-uu0;b**cywa-2iVDef3G11w?;$$GFjMhX=UULQFUXEKVtMm^dRQoN^YY zn#Dm(IQLncmn;rq!ui1Bv?7P`2QlH`cS1>gx&kH~#Ds(2sU#c=!sOicbZ#u?5G;E|XhCOUqAiB2$!gP3p@u{cpI4r0Q=xti!~Ku#s?Gh)Ko zigsphL`>{^0PA0d2c{^#r;o*_grfqO#1JvDi(*)TOnSZJSJK!TcKqu!c7Po@7BM;2 z4KVK-&GBJz5ED)Si-U0>*UX3sCyvEQWN{D^PAZEdiUZTv>^NlMv5XxtIko`pO#dP# zcAVn*Rqz0%3^ww90b;_z(C}}-1C*Pvk@zDfocnBbry4`xWBzD!&>|0tN4dl9(eV#|{I`tD!lz$YJhj zASRsgfQb&yxB9nfz6^&JfVq#wlm}nv<_GG|B6YsB*_k$1<&K~4oCqv0WP8mEf zm~e8zMEbo5G2>?m@|o9(hzY+MIhaIH>R24ag!2J8jE(~E`1Q!9sBW6ZJz&so%P-0-?JrzM}E$qm75fgqgU_Qgy3Yhqb*GL5Okn;>4peVt{#{maL z12)BG+6Tl$Qx7oj1w248flZ&m!&n&GuGm5!id7I*1A95Ma_4j0y4W9E*>b@HNr?iS`*Wv13g5ui*iT z1#JAcB1lbx9eJM%G2zbvtpA4QbVbf*S`#thV6Kw)0TB~>FTniw@BqaYHgYUtHisOG zd}7xD%=-urPz+(?H;JHVedm9ou_f9+(-<`go&=b@AB~u3PC?EWcz}X=uK!I0DIXS| z4Vd?xwqyVDnrV!E%KJg%IM|W*_Yo6)Q9pjAIjP8D@&Pg7YzNF|I9V(XV#2|`CY%Bm z2QlFkvp5%79K?iE$>LN4)^CLeD0Q&$eu^N4sX*F-m>i4YCO%*|NLvsSjwGZ4;dBH{ zIEV?S8;hgP;vgm*9TrCquzm}i1d1W@@gkSOgg*rNA4O)$5;@FVjhJw}0P8ax1)%ad zV1S~8Sc1kl7RcvV5R+pE0oKRHL9u|1Cq-jh#L_f&0IV-VW1Kg540d7RnaE*ua2%1( z=O8BM3IWW=7h6!G5HoztD?XRDCjcfo8fcfN?K*&Y3`U>H{EwLEqtApd8W+qu^|x`s z==ia85EGqX)agKgZWR|irgdHd)@RQ90r|{5 ze8hw=8Y9f-57}b`^PC)uxkuWLm>jDPnBRpymkx5Sv}3|CKu%ZMJ{CF5eH+AtBhtqg zmr&UH8t|N4TOuZW)FgJq#6FB=M@;OtEIVRicVgKQ6T277j+od3Sa!t3z6kA1ZXhQ1 z2*7-tNT7(uNOu}zUa2azW5UPr(vz_xCib;}6-A$jrbO2v#Ga0J=Cv4NV&4gvoHq-w zsxo~p#DtRrxF=&rOzg)1lN?4&>?MGSW+`A*yx50=m~hGf_hjsdi5>G+u?NjZOzd@l ziROL8sx+q_uqyNAAH;>7aiz2E_gChSzz+A-naI?|J|BPMn|z@%M>iQNqCOuiu| zb_>A7Ph3+}aS%gcuP@eM>dDvC~TdPU?-nRMojn)fcgDsAI1VE^9f?YaRf}}6U4+m z12CCS5EHu}V7@M`8334v2@WL~Hq`;`nDE2E-jlH-CU#uANnRl)_H$^jrgab#`xU@^ zecE0Pn6w2k;oy2o+QMF2>%mUif|&51116ep0rL!K{bm+!Wno#U=J9DxN5lhZ%!8dO zUOXZfc0?bSke-YkF|mv090@w#*mDlfGx|(CaX!)S4-Zh#L@=(ipvj;im^s!lhi4RAR&)lO!O!&Ay z5+6#D!)PKVoN^YY3OP4veZ+)=ImR1I+n*rkZ968M*I?%lqV1St#5cT_Be*Lb%Y2Ct zF*#NhFn=h0EY1V`;WXw0=2_6#7%;gXf|wkOea*9^Id*{g!)QDn?IUUI0+_@cF*$Yy z@)-_}cM>1OgcF1uD_SQQus)-|2>DDL5EFg`VB$j@a+r7`CY(gTJZoBW6JY&OG#2$c zzL@~!Z~e}kHyi43&Xj~bVxoBfFwU81M@;OwfbqRNv?C_=0>Gp#CjpcAASRr1fcYb6 z->$IuU6Ie^5@Ny^_2X!ouZbL{?T86S4=~T3=HU1xF+@x_!vOQ`Xb$$TKBI~A0J*M4 zO!%lt?o%Nqc4NT&F|-b9k}-mqaI9GzoD&EKG2u)@JG0g!CU(pd-dI{6&qZQ_m~e&w z=8va2crFqX#Dp^zFwc?ZV1AOAASN79u1=siGr_LUXa*pkx&Mrq@Nq8UPo(+bEdDa& zGxHB(!jD1zWSYMgIZXc|CLGZm#hf<-?7T@d{{V}RnDFxe^POl;4RVy@&}%5~}$wG)EeCBtE!)k@g}c{BD5xZtwu57jl^PA|@QX zWFfxc+Qf5(2PimAlRQC8_&8M&KBh0>ASN8_X2O}m;vgm*yj~@o02T)^;e@d`D_9)F zgcHZ&Y(UOAk^2;4!bxXwvXH~9BZvv-5Q}pRIX3VB1u@~20Om3Mc!kA5OgPxJgj0_k z=3Iyg=Q)ehj2y;i#Dvqz;>g2vNpuhs4!-wF&ZW-cASN6g7H2GrgP3q|P9yJuA|`fC zz0D~#h*^|MRVp%8jI!`X8itbo|!>& zMxrK@&xnbp18REEoUwrQ89w?(um)gUUu0pAm>jDO7}poHBPMnOz_`Ak9Wk++0p?>O zL$QR7#0N3q*a7Bw)0|1jk&%E$`ZwkYX9_$goH>BW{D7EnLXhK2>xkwzW}f-m{N_V* za4ptn&btXUnLI>HG&4|>;bbF+i6>&hIl|(cL=H1|AtoG5U*0VGycNh{d_zn))qwea zGzaHK;@f@XGkuMi@NsVB&!+hwki+TtlZzZC&WH)8h{Y*IPMJuCLQFX2fceb1 zFhz(CV#29oaULOu(Lqc&FIk+=$YK0JOgMNOj+_fGC5aAV!ckyx@cSu52QlGjusC|i zVdi1Pgk#L&3}bN+6ApfFh4?d`#X(FsE-cPW0Dq{dfy#ei3pmwqwF61-pJYZU2rOroRvqjwDp`Lun4qUHpYK z)`lHfmk|>_A2|%)3@~poJV3F99nnWj_;|@e_|sS%#DwF+;`jm9Ujh$M0$@kthM4ff z029q9FiUV*!}IoaR^p)@L+%fEDS#l@t9w6XB~MKZ53KAm?T~CLCR` z^RNS<7{f-+i8H4QhYNEZ0<|8ILCTM5YO~k}5YF7-+7hO-j zX~%>!4Uc8UDPm&BHWD8Y6T9fzwVBrW+qG*PZMVc@nH)w;j>YRYKEuJeh;R@S&I}f3 zHj9IpaDrK!B`gkN!ii#W*0MN=2`3%xOxqC?dnRCBJlz&iY?-*RV~hR8$3Y3j7B=$v zYQ#hb=U&2b1I$}R^L>z?3=dEc6Mg_-{u-LI9WWU$hzUm)FlQaj>4rFw#u|v%(-`}O zgD={k3_`q-#@2{8(HQfAlSE_ecTO^mG0vP68iyfHrEvt}G#X|^n9@`EBe_5h93B)E4u_c%G+1KcBA${@ryz|$bicTt!D{F$3ah-Z+`yg>gYz8-;# zmWWpd%?kh5` zFe-3C0R8ukl#drdn6je3bY!2uO^{Amb`?nsOajbnI;Nt`{wJC!vNVe*h*B#M8W#kf zF{1=+=%u&~y%e{FLV(d`;5{!e&=*1bXeN5?L&iVI|Bnpl@nBE?5K#LwhaNW~1`$VR z|7HmF4TF*SYl~(Pn{Oag|I*k1Gz2dQ3;mP#7>&@`(0ktPq>y<&o?)H_24g*->)@X` z4TwkB+_t_mfNaH%4}#bb`Tz3BK=y%Np`m!HalRq5e0@d-%=7XLAaZRpC!8u|HnB1% z5jnFU7&Ffoatsq48UCT(;Rc>zVIlrr3m|8Ii3WD5rx&oshK7Z}qk(Am`)*~%I(8fe z(0jIL$gf(n{r$o`K;`#`x96^?Xa9*N%3YcT{&)ul|A|b`??@mWf+-T}>F106f_^zIBw>K>uO>hLfBHu+Dh=0&r${=W7n6JU;@y`07;XU`4!ytSf z5Vl`zc)q{c=D}Jk#uKf-Vm8bvct z-5?+!JP_CZ5a>pH_VfIf7qG9o8zeFSC_tls&;z@urr~hvo ziEONGpD_P{C@xDUCWRWIZL0=jWc3}^i`wJA$oG#<&`H*oSa=NGhXM0EeJE|8wi<8G zfPi`4><$y1A7^anOy7_&54gM)uWo;t@SDnCE{w&GWL_rVVQ?OUzbV5c0Do}}i$$Op zg=-(ouCQMmDB6owLj&W%%(`d*|1(XmkOpnQcn~oewV^g(Y~EJchT4F!8L4ao@E7rn zzEK-$1I8w8m2IdE7z^4e+YkWJY{t4cp#LlzrZ6Aom60)U=u4a5RWa=c5{-=75FUpw z z1O2KMem747UKfK|nyE5rr-%?#i^}}p@Z^~~+z}pr9~56-TcQz4f;0Ucj}3s)AFRXI z*-2u0cwfl@Hd2Tl-YaM89Rs~aAfX<-<=3V+x5KaPNPs$3*hnFIe!yevWy6gkJ0PK+ z3~a=|Zen_wP}d7KQixt>F}+5Xo*a;gUT1j1j&m{8nGrGA6Fqt0vHct53io)S9{qz; zwdq}jn-6TgCaCKQ8!1HZBJkLHdq5B4k9wV8BmUil&SC3G!xIA{2797+4R~z5BcMm( z*O{fK3M96k2|Nk^jb3-)vGqQKUJ3Bfzb>$09s1iW<{#dI!TVyQ5dYqb`F9L%k}U!f z>M6oT^v;U)M zT@2`b2aI~kuo1lvV*ZtZ!0*P#8!`VPrqJKXL%kj>JxOqm?H>=~^gBKL>JZyM$*B}I z6Kts0lc~f0cmx|;Zwlx^)7lDYFMgGit>*)JDqurBHKq>rmcRtW*7E^9OR$qd^cDb* zt+$NjUvD6j_+^Oc?E$^t%?BxBdUY)S`mprycb3@x;cv11E`Ec>^qN2~0CcduS}eT| zV&hj99Cw6zQb>EH#m4VUxUo7DNT}BrHqzc1fZ6`JL4_t7m_qa*-F}H*3FzT_*r?Z! zsl)!*1shv$2~4&TztP*u9AgQ4EV|$bz88#o{b3{i^#%vndidK=H}L?b5dZKu3h)?9 z#;!4wqO2Lc0bnC~&JcgLUIk3v?6r&NIRcNZ=i^CH!$1f9(`V@!i0Mf{+-;$r6r$H( zOm8PkZy=C~e_h1#1%IdLck^jSv3#jx=^3%~MvARR;h+ay*H(ys!^PGk6|eUE!~6Zj zKm3g{cKoV9&#q0aeZG1MJa+tIK#$CSrYyaoV)K|GtA>CBy*r2E#_$+f7U_1{Rm!`PW%Y?@Ca+e?wV%USjP{ z1wC1Gm?^}+>0<3|1U-BU68#$v8}V-w0Csz~gLAD!4E98C9q{lNOQy~zn4<9gQPdj& z8__!?mM>dj@yj40z$0+KSiU%hzqR(gi z8^zMQAm(2q=&`!D&A(DH{}wH5Uq5VEdRyQeZ2vxkUK1LaLfVUOJ+b}U0D2`%dq)G8 z#4lV-?=>u1c|;8ML=Qi{z}9nIN>LhM!}!^=^d^hx?S#eo%5U`WvjA+p;AQRc8^hAu z3&8?v+jV;YEN%h6(c1|;w%*p|?c;YGOYbkS`Je{$ez#s`iOmO%phwp82`s(SV(t9^ zV&i|~AAWX;?Vs$5_W5}tOYf(co@GyXpA!SX6w)7G#q_K}&j%{8KPJP5=YkZa@UsSZ zI848yvZojPrX+)LNA&K9>19XI{f2t*Qlw4K1`c5B8NkJj1{#<`^eh3e+Zz^1Q73_i zdake$|89%vjaR4pOq(4eD=)4z+zyr}!03JJj&q1#j zRHA<#un|2=v3!2r2j&AJ#?l)qmd}!F;JO4HK|N2FUNT(Vg1ODVdQJLw@W3Q0#J}~x zWBXULmj2Eg>UqOP{HqqzJETSbjuEZa-rnnCdOH)_~i`wDsyL=5)CKjg6e zQ&~@c&jbCN#nfTGSi;8ETcQp5M?|2GK(ZzxA4?wS)j%JioA=Nx7!iX#(UTL4UnS_p zKs~k>mf|)&eKEZZ&?|;|Qiz_en4Z&i`Z^5t7Q;sTix<;#GoYv}A_jY+7bT`QZ3pce z>cP_9rsu-UFXT9CApKn^B8lh4GEr=Pc@28dC8G8&hduF6M}f{4V>}2-Ht5L^5qOTd zgj*rla8J&AL_n{&UM%InLu`ppps4Jkc^Kyy*su#CR$uzvsm<*I_W_iOL}05e+mD+!yiys1)H11D>7e2>OBW%7B3VVaU`W z&xggsI@}h+x{7;Jb^?!GNL?tL7bJs89r8w#C$J~H(cm0+>`$D+BCy(U7kz&a`vVK% z?S)Puxrg@WptncMlU7}SkEHh4oECPim^>UkJ?C< zc-QZxpN4Pww`vL<2@&Ec9LV;Rgxqri8dWrpp)XHssE&>C{0Op8QsP1w|df+l5Kkb z!7oMND$2s909$8ENw%J%lq6@rZ&K{u)g(IJJSm8PH5F@PWn0L2I<|y&&gmRs=w4Bj zijhdMAu)QI1duUC##Do77 zD^FXD)E}b{k!(}^kI|we6lGykfUPqn@jL&Lq$%$IK#vQ0T+ri!9=BZ&a-zKt|NESf zRFt8hKVegVtuysYf078k|F5$avuwWI{PFWAn3d?2YQ{#|az_8+V|(QOdmkmhN3kes zX-L9{!;&PWRDMx!kK=!@&IR>9#Pt7c#LX9F5ynDC6pQxk)rtLJ>1ADIJadv_}Yg{Qx)pwo^qX?$C{};uoi*%XhIlY*pZD+&L%(3O_#!wO^5~Wf$rLoCY z>En_XcBjlz1*X;1kW`^r1GV9dATEpAD8;dfd>m;5thn@%TU`{xx>H3dg8Zjcaf+bu z6ScNfD7BB;D9y3q)C;4|Q%SN3RIF`TY`RraixMT2cBO>54OH@(jZ%@ek&ii}Vr^{W zdyS&TD1Pcr3FBr_!u)0`GgVj^M|C?Zh%ThM$VA$39&$#<+LXm7jEb0`*xa4cOB0yx zqcqcmrtwtzSwZ|>Y9q29MUIxTE{jdD+AuLGyc?C1Cdl7M<)#S=E>K&~2xUaRTSq?1 z*rdpn^v*HO<;EP7&Is zmn<;dLm4Lv%+65}X9SWA>v5!QYMOj}W|~DwtW7Djfj3IAsXLXED#*{Ga#Mx*WmNLn zjWWWxy>wgarAA{L6vLG%fy^yRXts|^hiJhFh4#tE$J%h=<`1L6v{0CTfzsOfnc65T zgjk3oR$rVdWfR?(ODTrKzmUhGPClijv773`g`Rn&#jk-G{~~9iZDd;(aBOldHLa~U zQ4#H{>G(3en6BEKyIjgvjb?;@xHL#(g4Pq&7|MQetQc;q@4&jIbN@#L}668VNt(s-2x>+Y#XzovC zr3p z$vfz=cb3AK6w9J?p-iHsKr+HoQ23nENfYKRq=eB6Ero^g)bg0jG@aCq>lLe8tcte_ z3tOp9iNgH196{n+D~r@liAm1QR;sB&b3dv)r8p(&_9rU=_ZTHG;c|*oGgFgpH(QmZ z3i6aV7HOJkNv#UAtH?q}9z)t1*( zR9D@suBxrPU-9TlL;1^#Zz0#t{L-sjy%;K5!$E@EceMn!U%5oIt~{5k@4)5iuI5G? zlykXS4ir~sHI;jgt5Z(pmI`B@Qvyjfj<8dAN+^-d5pthW!eiYyg19{#f%zVeu;3t7 zP$HC(UgYT22xB{P1W)I3^ll3BQ#g86g8Y1rUWFhw-%77q7<-!| zFcngI7X?y6OTGJo{7;l#8Mm*zgz#iMC6o!Ha5fQ2-Qo!HK2d_TpDd&M$y0*UdnxG@ zp()G{X-ONpQKjpIlF}SO@i}Nm8YPHJvotOj7Ve{@w+Ri^AS>bMp+7i+PCu-Krw>zt z1W=0p#1Y0Gw~Uihtp30ezJxq3$fShpGc6T2ccnCKgeP`Gi*{QICGKzp$2B>^!VpRr z6=ErjF6Ka1bK)eE?tSD4-{f&Nt}EL5$X+0A&M`|BO0KtzaxvR3kX5nDwJq2xJ;BRq zNph)e_qA0n!nkm&k*-A>rX*#$b#*OD4;ejVhs);T&4;!LW6xRY*y_O=l0^wST(lA> zBwGm*vcSigmJkUJSKEOTt-YEP-LIS@On7dk_@I>&rx3?&O%k32A0m>dN83|vU#1$n z4oOi;77BwYVNoJSu%?v~oXX+|O`cK$xxrQfb0_NURv693cR5M7zgc~77A7v>%t^{h zAF{b2$z{ifG(ll8^>velXtW3v8mQ7VfmsCw8SdI_1#L5{rZUosQH`12_<4N+=ELuS<(&!rX6ruS7SQF`179|Tz8mJ`a7LHJ&!BSAr z05NZ{9Fig|ctQzcVl6kW6PUq@oobP)2=ht7c45JNsz`**whPS&F4!b2r~*wbjSNal zvzDW!UCz_-YvqlbF8|;Pa2;&sR1vpp8bF}nS zIa>TVl$Jpe#c7)}6s6=P@Vb<}9yL4qIaNE^x)-?XOi7(0J+*m^-`MK0w&M!M$-xyF zeI27y>QJJ$>gg}@Ms(j*)CQ}YR?&y0xZG?hspxDQDemF(QY&CqZRQ9hl{mOYTciqL zCJ>s(0}`4);|OJ%Ed|ogtTw=PPBZ0QA_H?kHO1K}kZH6OLIj11P~4VFO$(2@2sXG0j#z5`|`P2I*?hm9(k^-P@om4Z6*s zi+aL>+qCZPSZy{pgEM+bC%ME~)tnc^gV&bewRsCh z1H8s7DxpjXv`U$C)1G@sN>X6nKv|>-Wt2Er2N8(B0FiCM$jU$q3ZH?kc!!|yr>L$o z)^V^7&MK-C6wacA@v|&@B*Jr!F#Z|D4v`=R5qRPnXBBY?y(oa|x!WQ?8o`e;N+4Zg zS&$}-bEVS9MIW}26c#q)S>s{s0T0?32V;P-g)=r-bqiWWb?Q)8jh@6e!0I647l7yS z7uwoiCps(i31k4%db10nvlfYtsu>r3C{~i33w&qJRZaBpnpR{hND>y@5S?{0Si;du z$P-~)vy~dt!sM&i!XmiNd`4Ob=Mq8-i_#ix(kH^TY~BU9Iu^uWbemxOY99_vui^UG1*-vUoI`ozKbI!1eH;(o}RmdrC@XqqO(T z7RuXET2x~IuTYXMwEXOKwu_86529dw)Yc$ga#XCOP= zaQ{UT=10l)`BB&MzGRYf3I+3O@AK<)O9D#H+iJ#UvX0`|XlY7HvOOWMLwndN!)?J? zaBq-U)c$7a(`FewU;4ggoldPo&G_n^7)z_ZHr_M$P@diT*mwuW!Yh3GsxQG>QBF!C zsfRZF^Lcsf_%`1iVk2$ZpCwrDwF!prUeA=sY-7MRqNA5nmD5P~T=zaOv(KL|eOvRE z&JBm_#?;q5D~b;n7~^tr5I<^+U||4Tt_(`r~Sy`HhPz3<;2u} z@ubL6&nd%6-ueUs%z0M3OYqfkV#D%r0aWuC}(dFR<5fNOkB7(V?iHOlc*6*&jV_d*=21W3Bdv+97|v*w^`4 z#MY-hr26=D<^7EMA^)?9O4v2(mB#61%^M7lC}giw>0-B7eb>S-p|`GT&wbN{=e?-* z;?I-;J!Fh@tMZOsn%m9n^Zm{2Q{Y`{c%dsQ;+WjQ7Pqtc%%P(D*=#!-|I4A@Utq_C zjsO21AL2hduMnd>@29iYsKFij71f-+U3kRW(Z$&6(_cc#jT=@@*WvgEMdOvH^X8uFs8DFKf{NW7dCS^ow9J&93r1aSc%V7|~PznuTQ@nL5Z>1W(y?qJ=RnN|HP zhE)u0J~H{r5otBwlX25VH(@w!F{mA9qg&!>Uct348 z`FZq6{=*N~mFIq%c-nlnWx?f&8Afwm1r-C7ws&6U@akFOmX)flk48S8FtM-q_tNs? zA7i#F?>qRl;Uw_~eLyUp)9k$bH^2Y)=H);2JLU$K|AvD(M6>C962IQSdUkoI_xi@0 zi?Mp!t{bdgH`t|YO1z@udf9H=u2zw)L0i>Sdgy|5hCR4pj%pvFh_3r7>prPdT{mdEFKD7@UTOl{PX zZILU~Dvr*SFFDqjuV_^JVp+Eg-BW5!pZnKs+H^X7`}BEyom7YW%4VVc&tI9-`W-c~XDbX~Rv4ji~;-H-cW zb8P)PD}Vo>!`8()jD4SojoI@Y+s?-550-z@p&9>j*l}ay|3Akk@agaK6qi_R7kq4( znzpB~K*4uK=lu(UpS+m0$A6dZcf$vp8^;Nz+U(lv8R&d>O!*`CQ%6c#dOU8a{#G6} z(xhnRn;o(%T8{1rpTEDcJjU~N)$=-%jdZl|8E))*6KqV_|HPq{{#oZ=&i~%{4E+A* z+$H%7ABv{Zl|L&@jr`z#N4G-%?)NPcG9BV8QoMFLA2?C>Wrbhy;$t^?-_}=--rB<{ zHp?zg`A4>F7lrTN_DuIZw_9gn?GQUFE3?YAGpbGx-D!8Yq3%!-d;Z1q{8Ntpo5%lq z^Y5Sf{eLp=ESwzFTg^^ULsvuRmR9r7ppbRZ+cwDiS)APecGq3kZ~O1$8-BDNxT+sa1)sX*vf!vhk1u|=Ys?=SXTk)`ET7RXOl+(*@pI{&3Wn7VQ zYO?i^Qms>uANIR{{BU99_kng}_?KN*Tt0rNYE7EIpaEG)gG=Gjfv z_H){gbG2tpKd*4w=VF%@rJ%l{CCf8^_maVD=ZpFGPjUD+|NqT@_PWl-WQPuhr45(7bmc zTk_S-A&w4_dslbW6QRev}*kF2}ao%%ooD z`E%Z>j;-Y@?>?UJe#NuhqZ8(iI8zuoBrEf$&9&K$KE2esPadXY#f=)-C354!KDM?B zy8SnPnIN_Gp^w|^*8Uv|y(ZndmXi4D=(IhhUo;k|6|eU7m3$##oG_GkcIDi|1w*dw z>nnL6AV{gV@DJ_9F~q)S#>VXN#kR9CiSs|{{L7)oDLZa#{BL~zjSo8?*!X{YZhW*G z;^s0lM>n=CN`K(bNZp2r-3@xXt{xgWyKD=!W!&=lvV!39t=`oNRhNXqb%vK^zF!g? zYPdOK&AAtMk8Qh`Q=a^N;kW~5o*lpNVZc7+E-UjdW~{mN-avlWkiOYdroYiY>7D+v z+{z@Ir}Sm`x_g(C&yUqQU^CzN(W;>{*BI?KT%^^a6ybeJPWRr^q8Wvbmg%!BWb6JX znwp=FpOn)yT{C;e9Lv#;fy+FWA5U63`?}-0o0X3i^&a{&QLeJ-t=G`JGfH>zgLk}% zO`0=ytATN!DL!`$YEC^l6uC*ZW=LoCtBa(a8nXuuD8GKlyWi@XG38Td*m*eE->=K< z64^Up>UnCX>e9X1REyk)ADWA>q12&B8hOKg18`ZT!A57IDm;|Nq3HkNo?wZ2rHTf8)c>2R8mUH~!6y z|LJE*)3!gJ>3;oO>BduUs8c8-5; z;GOH^9D-8SmHmtdm$@!)*tFBE)aDE2mG{owwr=K~_1Z^XSnY`qU!{0cA@{42OP#z| z)lrk&_tLp$~;k1ubV7v#*>m^{!n%a2l)Z9QNl*EMa( z1y`G^gZgf!n$z-pwuCh_?0&HIig8o;Ef2jPv0f1?ES^5E_I`9wJ$SLj@aV+uCxj#C z>{_er@aQu*BQU; zym9YOH?p6k*!emix-)&p9L-&&YCH9vI}edbsk>&MjB7?_JlJ z_VRSA@}p}nz3+!jyrgtLFZZ5%ao5|sw0BugzjMP^>+XqFT))q> zhg+u~KYL!Uepj@l@@(F_!G1$p_ii;Yw70x}ez1=8V~+Bp0e;_8JWN~Mt~q&cc9pW3 zKacY8l^vb#rMDq)R@q6L)#DQ6O}7iSE>rIK`QZ|Ki9OcR>pKJwoF6;p@|VOpwLSZf z+BKp=xypEYr>cM`^QYe(hBa-OVH?^k`KK>ZLH&Zds->XZUVKSFGQmG;Mv(o6c^h&yO-mlF}Rd*R5LU`N3ftpB?BvVrW+ng)a3 zH*dSX7;IBhJygC|eBqo|hBbH#pE|fWETiE>X=&cntXXF^KJ#gOFes`Ae{A`6gTd#q zezV!4@rR~Lgm-IR^SNo$+>u4&=9@n2$WPz0xA!5eKiq4~gQ*`T7D|O3ol@3W!SlJc zoY&#+cWp*JjKH6WqlQJb9z6T>T8(z5mvVUHl&==Yo*pRl8=qWPxe&&*e2v!Ftn_hjrcK&Mtjj*YCQ^u5O*& zJ5(~ z8JutNP5SLVOUv-y59WLRSW_Ia<}diQIf}YuBFsCv~$S=C3r zTyRgMewcx4m1PC)Q_caK61iqyoxcvV^#5SlVRw4P z;cPpJPQAK%Z8o&-4ST1T!l=6jcV9|eU(m~|F}7*@*t)^1yaUg<)^Mk52CvkgH1AUFgl#@w z^IG?uyRBz_yd=lHY|RL_J8#@J`?e%3*IDcEMQX>k(2PsZZ0o2GmCg?+`A-gWPP;_v zYrM+uaz=O3UyrX_YMU&!aoyXM`}W$g6)l@m*A3^a?WFbLv6Q>Ppge$9N{mU5z@H7i?CIpTkSH18_~_rKgYLx58P0^a>SAW zw-v7$f6z}39Qos5#$%6>Ct}`wPw5}JYnFw?V?!s?MEQHOxVLwuc@F*D@q=KPo3n}5 z?#MZG_L1lEj3}S-XOn8F%MIwZi$wUoN(|!=bt03g7#25#zK4|PgVd3Law~}urqxx=rU@BvEsz*T(@3q3~6V(^5y&Dm&n((|s|NP_imv$dY zuvK4pb%l^u(5Ld|ZY9~byUMeLr~7YCy#7Jz%(dwo?RIeN??yfF81hhh!@eBktA)5=3?OLmkC)T=HZNa*L>czkQU(Y?)ao?o^Yr&_rU`Z7iDSgJzq*fWdx z7i2g0&@Ob>eG%i-pmcAL;oV@qeCD!g+g{wV?cfpJVdfa~<;O40(Ed1l@yY;|l}~$3 zn5o^O_on92#+9q=H>K?}ST{#FI8t#{e#WtNBe$-zX&5tNf_m@KzBAl4uY`EKPg3ot zZgPIA_lLc1)4Cg!HLWain-Vk6<6xHAin^AEvn0pmymbv9a%21o9TiQj9Y58^`do09 z81cA9V#A5EuMI7C%=2kd^0(Xb)p~16$K|tTSZ`cYQ+fN@quyWayyj&mO@BFLv&5|q z!yl{Ppo|(i?yz>r&H0hg{lTQMru~epua?Z7{CVTv`N=VQn=V%-y-28iqFpvvY5H#U zz#nuO^>9$2y&EYWzoLrty5?;ahK6w$ZZ5fQufLkJd1kUl#Fi~{j>z08&3x-#oN`jDVVlb#_iw$^ zuN~MJ5uY98W+=N)Hre?5tR4Ng$22_+TH)O1xTE&xtrturIi=qgTHL1wy?uOP+v}`? zglnU|Zkmz!qI}fnq4p~l^m_J6*(R>^;U<4qg%$eZj`(Bxfg{u4xZo)_ja2jIXYdXr+I5rm}im7VN1i><-;a*mN_y{Zm?p`%X!ttwnD&$9H|{ME2Ioc}-Lm^}z*T|Q5|;$Sy3RXJ9LveNB|kIr_<1GkoPpIJ zLLa>PxHRmNaB5260m)b0FM3eT`HmX8*Exq9bpt0DMGj21vmIDd;JxgH7c05`hNRf2(&hRNlMPP6Ha*HaA2Zr$UxQFgFC-OK3tSGB*VL=XtAoY ziP6#}Q>HK1k5276riWa8q4R3jx8s9Wyza8izfM?NBRkuk%N5Mib(ns4pVZoqQ%0^4tm^%elcT11+wp|OtE!AiRZh#&KGX|>-rR|IJU_*Bg_33W z=wpHbd;a2XeA#+t^x$_=?v)!(Yj+CoGFkR;?}7JDIoch48qq7pc~Q4l&39&4WF2n4 zAo;AzBj0kXl%a>BYZ}IBO6z}J*;g+|*EVhO-R>?imrGn+?kdP$`gC)9gIA^MGR0dm z%MVVjH}12uK3WP@Cwfhks#K5KKY!oZey7WF3Xfm*wRv#dR@wH`pb@!8r2Z zb3HP|=H9?04Q(g2bzc{4n?Gy1eR|i63SHLKulILfxj4Y1@Z`~ihtb2jo_L$8S9-3e z)%@eiN8X-LTjiMW;d?LVuvhmtjo3P9lXQzdo_4KIMLl3xZc$qJ`xzgX^gXYdxKWyTs?};@2{`KwDekbrPmgjqD*Q{CzC#OAE`gb5WVs&8C< zyY9h=(82=`qzfX(Mc$d*{gdJY#U5$NvR{M(zo>I6vEg1NYdXX!~L4DDV*i${OcI_~6f{Wpp;o5tY+@%h@y5VlHU>Rra@w~lv4Em3aQ<7RB zA(Vdm*RmapH@=^s<(s}N=HXAnh4UYkdN^C2y6W#6KjK`ewyT1n{LJpxwe4It-zhkB z^sw5Nh_{)Y!;XLCHgq;W!`rOxd2rkG2u@b(kqjOavn!-*RE^5rqbAX?~lYOqxs9+B=jwh zb||V9tesV%HEMIrYNgP^D`8rH-z$%MSK> zw_>%k-L4uPX< zGUW#wt7&;&jCQ zlddk9XurYispJ6bvUk(oDk;iD=NpE*mu2>lx=~iJCR<6a@MU%I+ir*Re^kCxSyn#Z zBFJw+v5~@vryI|$OdMWnkz(#PfYV!o`|;gdKi#RS-v?cNuHDsjWNcZV+4I+BI`|!x zZzzfDn7nPq=G=;dT+8xYp`mlwBD;Pj>W@Yq3YmJ~OyJ`v*S~Bpznn3q!*|((<0tOW zn>2gc^0C#|?n%^y>(sB|-C1V1PiwqK)kx**PxriD*vCY7S~uU94zXtk_NcM!7utP= zZ}W-CD>_?Vy!q0+N9emLGbFc$4zOQwAZ=Rr+_UNm&#L;YmaV>bpii~Mex2gLzz>5) z$Oahgvv(Y_>g?vSPgSLcQ}muRuUV7!BKKaO!cO12J9Y4l?zQLY+-)DKpO3YBlH;G$ zZ%M!J=BcVn=RGsrdri@H+S;1KVOrx{VvL7dck7uJ-S~C%ZI2)6gIacn`k4J#dZzo! z>Bd!~lUM0ad|`M%`l7Go*MQ?aTRiP2-~MSlDxx;)=z-6YoD|cFK7rDpMCq zSx1Me^t_qe->d%~{iEB$jAxy0I@;0PYmMKfpS6!ncNdJ@XusL_{2Qfri$`XB+&6yS zfTi*)N^Xyrajsrs%MoVdCXFb)m>z;z{J?!wR7mAC66bst9e~lD|zrQlhtw`-4@sM_vT)9R9)#p zHD@gv6g#VfWi<1~;p$sen&+sYMYoa^mc~vzD?L2R!^vJEa*^hXxkENR3sIZrp}T!! zzl6u{bd7{DtGZllQTDQ6}i^-$UheF{887?$`zMDU_Ma732E1+|r_R{Y#$& zX=|*Lp1X4Cmm|j%)s_x>*khNLgx=%Q$t5z1`(;|qOn1z1uTXPd6?5`kW@!&>6qFyT zva|A@X}$^9c@R0wqgQSHxJr3D=_b2SmBB67H5RU0wBB0r@}e$X1dr@rj#?}`m~*`* zls|uPz#0-d!Tj?Y)^SGZ3vlYhPT(x&mY99W((m@{`|#{T57#?6;g8QG}6?o7q@IrcNV9z065>{?=!XLUC2s)mDd zTmYk!{@0q(>vFQDo=a;ysb9A(h7)%rEVrq7)`3$89%Ja$)@qd#zFQnS zM&YLE-Hd)Vk@X3a4k~+RjyXB~=qBB@(RVCvjI7)3@ z|9a3?$KmScQH6^eH+@*65~W-pr5+JA=JwYU?sHc!w6fgy<>oPmsB4z^KO0!o*IwKb zvc2WYv5FT9<$JitY};iuCuB@sT?f-qkJc79!H@g1X77p|_{gr~-QFXwtIyn` zS9NAsiBEo2b90bpFw?HG;f9NNDpnIy)q2$jMqf`_%I)xJV1Q(LfW@uvMpK8pa*P`I zt@U&G;8>m7t!AH+u8(~dRJA-(uIvW)i<_Nx=GzyvJ580}A?RYr9;f>Ri)(a<%%s+iz^)@*F2tQg=Cu8#Q zLGoeydaMmwkzkuwEC0N9Z?W2jX)Q-PhJ2G-^hoQOZQ=hz+dgHJWpueP-ek|At z8TaG=X&pjY|5JD+NUziTS?;D{yj2Hx*}Ye)%5lT9FYmy9+%P4)DU`3=XyPVm%-V4B zPcTqct>}r)mP<)Pv;8v0l7;f^RXWgIZ&N2IXIJGpVCt-`(atRtV%o;=>w}N%wsPi84I58uj4*==}xHKc8C4YeG%W5sJWTc z74!95(QiJZ`Qb+2K5}865BeM)w+TCxAN-C&BYKS8`|8v3Q?&=&hmr|OlTW>+|D@$) zVZ9TM+%tpc-CHd_gP!WW($LkOx1#zLPf6yUelJwp_LtFlD(Mw3f91upIsL&Cp25w_ z{7z367azYF^6QSdW%$kB(%v1{yI%i29M7G-wHMS1hS{8(Tk;0(#pGQZKXHIEjS}Q~ z>y=J6B|c%!_U8hh0(4mlf&?vl1O!`eI%FD*M^V%gj$@2{@~687$3x^gFZ!`^q2C~g z?iahH%={e#>AMlgHq0SR<$?M)TJh#;Ey-qv9>v*2(>8u+>C4&?0fmp#yYF7^wye=p z$vnBQFXSkj_mV_n;YQu|@b}+OWgL5-P$@h9&FT!HU^WzQvKp3rRv5-dEgT{J`AD^d z{o{wW&_&?TPJMUe+w+ufQ)#!xQ(!;%7|+Ig-A9TVu752MiyIBIMXA)p+;XdXx60hN zsOCj|B@Wqh(w6?d&sXi2M)*Uou1M-d&DgwZ{n+<|Tf;}TdII*-7o+!z9A~Ryob%)L zuVW}{rCXzomAU>s{TO$&^F3{DL=#*5)&4N8Sux0_Pnc8*Sg5ni?LF6TEf z-_vJSoi@g;y}Q1#Gh9@`Yv$QX8ol!=o?v4Pj%LM{uDkZ%X}|4(y~S+a4g*Y+DSOee z0LeF7ck1igM>)$M=zbg~SEd_++yD(pGr$&ej#Xt(A@hs9 zL1k<8(O`R$VX{%N9#-$yRiKgR7ukU9zDD|*UwG9SQb~>>234~6~TDpzE@m%Ms z(xXm)#(e*B`Y!cUY-3f{)`D1CM$RjSoJ!4pjvGJ6B`X6fa|JX1rpJgMGdT*U=Z6bN zITO|jty0~pQnlcQ{Wy+h9Dm}oLGD#0GMZb|2#w#Nf0pwe&lZh?;alR{+~lvpPK^sv z43#8SHS+Exe42U&&E}y>?RBXeNjXh9d{(bvKW=*Fm5P)#V^_2WD(xCAaGmTzCwU*( zT27$#YDx36H98D;iuPyN<=vA0{+fGUJkwuw|K8leQ*4a3mTPjAj2}M1`MKuHv%ldO z@;HkInc@nqmJP|CBy!rD_l>*R$>ZsG&aKDdI?LkhZFro?O{$!9h0MY%k7!<~nWObQ zh#w5QOuN?u`_adK!DBF!Ho}xFa6O!lD_gwA?s&N?5u-=Tw5(W{FkIw#C22c06f0iuJ?$nWCqYUnrrS;viI5v$NL8~ztYt*H zhfmxtz$2YUAI;gumQ5MA%Sz(Vk8<(dhPOb)(WeQe8-;e-=6T<9C0*TVB8h`?2(_O0 z)>rI=o<4Kh~$ubs5?_vA@YNnRebmZh&i7G1i1E<+(Ak=AIUzYclp9&jRQ);nY`; z^fXW%B$=M<2pINx~Zgx(aJnt!6B1M%D0@` zD7AXm!)eBt@Z-wmuKM?Ba6EQphNSpr*bG9dSXA=<{Xw!ETxOFPwy6?c71bE+c0W2z zjM{aa$9M&Y?01ere^eJ*w7B@*UUVcef9Ic$$M&KY_A?uDH1b?Kz|gNL&l%rId6xns zJ2=hU!#6{h7L|gC&-;1!pdqT)L1O7$PH#+in_pvDfn$rm4kZ69VATc5`Hs)Qeik)~ zR?Ol@A2G_08>Om5@YUllKks?pp2RnmboDQb3ut+x>a$nFEI;o+c*l{?-Fk6KHOh)A z2KM%a(UBG({JnqmhqgE;(CA73J2@e5%WNBwI?-fRfBU9*QqL>XRLUt2g9d{KSudl1-}opwFLcAP$*Aq{6QPlqh?jzx_|*iW z!F~F6CZ->XWB;xf6l!D5?Xt8@W!R?K)oR0`fmMvPj<@xlWlHh*#2U6h-KYCacZCSX zh$cKx}MR`Qo9y|d%JXrfvL&sHYa>sTt0`BfA8>w{sO#5WDvg_O_+d%imHB;b#_{@-=%?GX9i?00#f76UY`?(AMdMKZuu4m7 zwbCZ!w%sdA$ODPkNrr^l8bUgFFrb+pxsALtBx1ldP=GB>n2`$N6jisqq{n zuI#>})g`j&Uy8jRS1FI$aeNz>`*HvuSH*D#CN1rJi~}Jv0l7IoZC`*5a%I~lYFh`+ z0fU^_7M7F7GydwK#N{AO+PuDY+CPnlMKiXcY_9Rx9UHofca~s3|8IYOFe`p_=4~_{O17WM59>*93&zCr|GabK@cSD9v9s!iBlWL&36T2?}-*}A7yra1C^xl^U5>aE_~$W>N3*1pmYt7^Ye9)2|-lvbzy zOvLWBeTQc-ls|QPcY5t5R+T+l#WGt}PneIjk-^LpbD1AOsmlU%)hx5rmUMTW{!&PM zOEvQyzo(OXiQu~)k++kATu5wbcUt|Q%`aKm6uCS>MREEnH{KVWdeERoFmG8w3aF!l6&nFm%Dff^p0n0bY?A*}x^$HnltsYY2?%4%LX$NG! zmc8tMIQV;NhJF4A=5IG)ALJjjV#PWH0tMHHb4zpR_CidDc$V+DSbFuM#`STTC&&^k z(J=Noh#F2@A1SU!&Labo_tNM4R5;#@)O19aJBy<(r$13p<{MH=r#gC8(v4iBB`*Fc zv-g7rKo$Zxzbjjb85q(T?LcoCwQ0OfA-eX=!LiLD0Dm>prWa|#ySRs`lg7K-HRSyd zeIfz0##bXGO4(L!4jUFs_IAy#Gxv6%DZ99&PA!nQ9upa40{XRqK6PK44voFiB21BO zABu7)P2ZHKD|~;GY&%M{Kz8t6?e+L0F0giOZ*gjWqMk*vryFfFYyNJinb73Ykiggi zU(wOK$5rpEUMXK4m3>e#JJs|-c45quJJxe~Xv^c9&6xFqi^#hQlPz6(l@&v&>Z^P@ zFQEIiW zFR~B#O9~I&r&iq#5(ZB9-@W(2Iw`c*n)oNnReQl1 ziLo4h&Z#Ejo#6<*v+w8i=BA|A-%qEwlpuAx%W&_g81R;~tY;8o(X6>~y8rlP$=HWj z+$NeF0T>B3*`H!_Jis=>G-=q@Y7&vF%mLed!pU8 z@2l;vrTuxBUY^>wo=ciXF>2D#Kk~@(E?jL5eaXM zW1FJTMr!xVjceHbagGlVQ# z!-PNZr+*nl>iuAh7vsZN8pQs}$8vhhX8>>Vv;AACylk@@YGy9kO9MniPA1^x=>138 z&rhD-2>?!AJF^P?sb;*&`t`Gp`D#43YKiBrJ6loa>7Cv>3%IZ9C*SY1EP~oYRj2%{ z+eYc=8Ff+K0aBcj}m>2L5~uS&$Mw!k}~7U-2R^Msog%8!)K~M zqsT8aDCFgpzuaaKLkz|^LRy$P zy7oQCfqgf}Pwh`Itc>56$h}+jj%veevlEov;wt;VUQ)1Web^NHi#l-=XGo3OqU3w5%LhMKqob^~!E2fX zf#0_=n{{GoGM&OTo$hS>F?nMqJ7<@_US z-wvTiUtj-zv*enWLCD?^&b;30MYu_Z-2hti-Y>}8Lj6#z0SHmv{$cyBZMxy`>y5|< z$*Ku2G_E(=j&Q}T!Wxp>zbUdY2rrl2|^Jx1C z4DRc_=l_<{oSDI{!CDw*Vwp)sI)6XISLoB^qmYq@-B)y-ZmAQ|*pgz|_D~*tQlXI- z)#_vTv&SH#DN}`0RK3$5n1_NoOc~x;OyV!2SUUbPyUo?8C}*80-^3wQ)d01*u1m#@ zB5>D`n)TbPpB#s6aKN%j&P|3%9_4V!Rj2$~M{_S)DrK=y-Hzo(vWOcbG!&@|Sn0KIx(6 z1nX#H@~kh;xgq!d;P`z&LfZJKh>nPx3fuEXRcM1#%#g$V!=Bt*5uYaQrx+@`B{Y%n z?&jl}53`d#;H{<(5GZaLmRWqW^!BGd&rJq@?}~+6-!)xZ`BXksCQd(j^=A4Wy8O~L zP7L|3`?bj7&hMqZPTqZ$wS6WGCZASgyA_{JOp^o54T)TO9IoHJc$`_8Q@p&If;o zuTUi4FeG)6VI`Z_K}mIaRS>w8@HED#!7r;vhfykHO?$$6oBTOd#ND{BMOJKa&yrKo z9vJIi+HW@@6-Z1UY`sf{`u%lgNWT$Z&7B=fhqdI%4KoY9_bA~#ndFHLlU&~Z^b02S zx9Vf-5*eCs%)Nh>wK+g{lacnbfW2?0cpPzkU_s!O_5L$k9yY_Sa9KlLJ zuESzEe|PZ}|GT=dcZka=`tEhQGVjVLIHISwzTE;(Xb0Xz~qArb1U z-GslEn2tA}+hiQn)+cZNP?&qFsQZO0pVIJ8z{qg15r)rtOGG!N@E#ud9}&lBQnep; z6ncl3*Ex4@{nAR&ktkq^l?vik>L8I;GxB^t{rj!KbL4qqA)1Iot;9I{91mH(4Pi+P z&Y@49@{(ag0kJ=`)Yt8~bbyySxsl4`B8RytiLXR0G5I=1HMZrinKIEyC?EJ3YV_6< zSs6Y`94!^--t{kcz||PT(|jg9xBgu@Uy*r3Cu94=GG#H>kiBlIa)G;3t&Gv_?G=GF zSLMQ2@@B>|+X`#g)gi(bZXu2uh6P<5B^k>&Pr}rgYsw9uDLms2?Y-05Gkau2wfJTv zHm)<|cjH?J{c4qiuR4o&v10R&(jO!3N<87-*WbQTx-_@_Rbk;%h)RDBE#WY}-wI6~ zjs`9u6^Gpu1?(QvumEhiE{}t@cA9Wn8B!J-ed+sH?6&Wr9ovD@j7qP4Xw*`$|5cnolci zh3VQkUPq|m*$6dM$dQH?Q-;&9MD;W0rAHJ!$Bk=5v8e;a1u>Q|b9?gzwjG`p){3mg zicYO`?sO#mdh{oxWqHK1DSa|^mRaqMo4C-1$4AE3JhuGrE8Hd>xt>+4J=$WEYcFeK zZo+FcpmiwA{$bcdAuTh!IPcul9u)BZ^*u2X#v(N(KHsI7y}3?%#IA@8YR%pF?XIrh zezF|s4N%V=aw1M0VO8J`ow)l08J&XTj!(t2xx8)CUl0D?5x;r+(_#3p&e%8gB&%qx7R+`__W9Ympew%)x_FrOXg4E#-Md>$Sn$afIv_mA?kGO*Ujf zt4!}SXMM^iu7B`&9$V}b)n{^5ymaM(Kv?Os-Ks#PXcWme&#sqo+3~gUZ~&ar(ZAcS z>Y|VKn`RqS9QY!m8hg9HBOVY`G&Xo=ihao}-On6@;rBDw0Aj|`heP`!zg^ISS#BF* zO4V5rVHXvM?Qi~~o$#V%({4kl3-(Y>)+&>BQGhzyi>e>Z8Cm%m zByMmOm!XuEc;nYpr*HJ#CAOw(L;9=ZPc4nOjCWp2q^}I%kabB|ns1PNn+qngR!p6x zM{yI%@?*P`qZ@Ai4N3Qt72%RnFxS+#(y(%FGM`7P$&`!t#G#U4bQG1_|BDc`&B#6r?%fWbZaS0RO8+(#?xsqw*?q!nL*ve{O4HE&6K zbnB`X84Yu*cub{iw2BVo?Jf4y#a@Z=9J|yW#h3Xp--^vV@fwx!Yg;${d&lEx(Fb}M z&9nXDCV6&#ILa$J9*n!(ymp|XWNaNo@uK=0P&eMEyU8EbDMWq5l}KfZ+%#&c<0fK0 z?V7Y?R%zg4VjJ`}ma^hi!!t?d7nfNcvF9MP?DOl;%YKA)z4Ie4ImO zf<}Q-g7THVj8#;I*oI0>V|N9onp{Wo4YJXuMIo z^cIsFOEtGigGEcPiPMR9Bgqop2U>ejH|`5t8wyd*6MuP`{iD9y^;i1XpJD6bE=l7B zlEx2jX>9cw4@QX@0mH^f-e31R(nKmW7OnVN*O;elP~Xj9d38LJ&uYfO6=TmD9QOIc zpYYeT+9_q$ybNVQzQTA;(`O|=g9MX%5j9bIs{TSmrf*#brFO-g$tAef7^|^VcyQ}ye#+;nC)gO* zjfv-;aAId~qLcmcOJ%vV&D^p|e4Cdjx8k5RTy7z!>C4-)DJwGpoc4X2vK--Sab8;J zmxU#q2$cKPh6A zcP%@UceYe;)J{GA`dQ+W>4hK-1Y=4r3{ zGJ*rG3TaGhj(EKe`U#hplNl>GzjHm~Ygg*xqB2C$t6n_hTefgWqv${k(bAZe*g;EHO{hmBi6 z3Prz{Q0Lw8AeruZ&SImv8_`a=^e-nB?byfHyHg`8Y`$G@5EqEM7j*p<9Wq-5Cuh1o zHEvPJgc(-^HNn!$-dZR1Wn>bne20u{d|~l+-Pt|i6s-a!TQ&~8D#ugrA+fRQ*Vqy?r?qRpA2LxtLijQ> za)g|N49n!Q+3c~w{0O#rdzc1!e6D6J@X`JVJ&sjo zeCoQu$Q}YI~6a66Yw~Q()Xud+?FOadn z7)-sx?sH%LJxk7{&%E=CtS&Xf=6Tf?%FL0)x1x1iGRRuEllf7!D#YbpJrq*CDtz+8 zw?ks6H^2;E?#{&-K#qHNyq`qu|D>|*F*1DPbXsLywQkL*iQ zI7&EBAopOiaY~V>zo@bJhE{iJyz}U)sixF}FEfe?mG3K6q7&O^AI+%#{`o4^Wer#R zjgZmi_3`Uhu5t8nYK8??x^=%&%MH0-_pzd=Cdz34-L`sUhxQBOo9f3uQ6=v`WWk7a z3+?QvS0>tBziQJpaxbj(iR-V2L2=*a*|G7m%{^uddFJOHepJ)`(O<`AGv}U z^Qoy&^_uAZ4A*LLLJg>LTz{HxCq$1Wk#c-9oAFl?XHp=(0{Q!&ukRF>vri0OzE-Wy zFFzcb(oQ8jBxXqFerJd6T~PrMzDmF|3F}JaIEpsO{@o6?K8d&oeNlZ9tmU37+9YpF zO6<{c1FUeVF8>liMeW^Qk?TjggMU@TqHwud%6IyuAD|a2G5P&Z+y`tDR{e*5oZkep zudH)gc+<4)J5$*V{(8nM)3mjh8u7>OuMLIelZHv5*JIV)Ws%Vd$D7RiLfiX$9gi4& z!XuPNyvOjqEUR3T&9k5I;4P$V8Tv!G`nQ}^Dc4oXYB$l%fp0&SVQjXEHzYY*3R!vm z=1tCCy$#8JIeL#Vx7gf=k{;2{>ZGFL84?z@UP_!AiM4kH)eAF&xEK<$otachY{PX$90qz8A)|H@$%lF3Ic7cfH`)Xymbw-bKTDAJ#zom3j=ds4&VC{nA{z5oBOpbd(T}^+H#Vusi|ZuP4f3{PZ_c^yc)7J$VPb*30;~>KRW0@O2XbR;o;U9>32IqT2s@Do z)D)-C%0yhR^NY?GEf8CDL6e-ypXiP`h|z71#@(GsSe9vGo=JH;3-2Qw!)VH%>wLChPtq}+(JdI4g}i}c z?o+XNbU@(Z@gX7XnZj29|0#!ES`It%E$_dZ4egIuR|k$ltNLF{)Mbr5r`i1bem%(x z#k8&{CuEV*npN{oOVs15{A*_Ht2bp#!m|kQcj$_`$`lmPL4$gaD%Itdk-Iv3t~qF` zqs_-r%5qW}?cgeMgetPj>*28K?nPhp3 z@004cI%`M``rZXJ-3`0lMk8YPKu||bU5P|Q+9$7%6+Cj1P?+cNF`G)LxptME09^hG@v%dTg} z)#6-hDsl_>`HHs=zhR++b(dmX^8RI4r(d96fi`knj6+E_(stdQg#?so~Zem)X1_w378b-5R9 zKYM=SkgLPY9PZ^UGF-5fGV00D%~UI~J$4KWXK%!R9rIv##<}`lo|d~KalB9+fq=8I zlxsmRF*(mdL#5YR*2Kf-AsaZ4a%!pEtT>!x8k9u-+DEh9Pv)n!^&wDrYJr5?Oo@j4 zq+!+4b~P%Z$YpYX$Tz6RCB~fR-h}M#o^Y#HW}44a^W}YCPc^KD57%G;; z|JqIIZAJP~9X|I-p}DLw_h;adNojE~?n52BSkFz3TmOIGL+R(z-Dv0ZaH%HM(BuN` zj{@l>`>O?iu=D4{*D@SG^W2zQ(I(U(i?PdFQ5N2Jy?598t>-nu)>r-C^xrS=Q>b6N z8{@N_8#Pi%l`FAZno;6`KWBC2+FwkzTfGFg-tPJTx^85_oF6e1*OPS1CwTb&9B)%R z53pq|*{I9?kvNl;R-M17Kkx;+SDbXofa~$)R1$h!K7AUV1oC|5U7x4rQ6UQ$`?q_v zFk?zNLh}BocaH0#rWd?(eO(=26W<>H>#l+vySK6K54)O2jK7wghS8qcGKLA}e8Sox zHXXRP`@)&}&SX(}*gDa)eEdz)D$**Elf29dXJ_PCW_Ui)ZJtIzbBQ)chZaO;oj#|D() z#idPS58udc4^9mb)vOK5%1#<5a$~*p5ows4!*i9O=?6)eilS<5{c z=6YP?5c<`cf%HnO>tBdyG~+{J>i9(egsEc zW+^l;pR^jy!08QRb@m;YO3kzyE@N8hz`z-_S=x#>96gpud(SAqfQnz{ZV}s^f*z`~ zkXQvMzIaViv}V7r)QP#ldAT@R80BY#LtMiH2jPX>U-Z6Lvl(en<{HE`TorxaMD*v> zH58^F0m4)k5)MuJy;L5oqq7co3*>qzNy`e_{Z*Yl?vRS0d0ZEMOQ(7nvocUY#e)|^ z+CO*tpf3jB>6<8)AW4-gQo@_Oo(S<-ss&?Pwa4WV;PB<;@(EoR`i<`<&fOHB6`ZYA z<0?U-`kMPJvJhW!;j*!j+*&!;pZfu( zq!qu?4|~T+zmsbdnKX~y(4&&lyWTah+M5?(G29~FwoMu#MZFyV6Wz)?bm+K_;NH;N zOFfJk``@T8?|IZjuNcxSVNP!;kCAk4^9yzNlp5~an22BQk<=6T7IC^&$nU85B){~zN1biZ=&Ur9shL4;3-bIfmzGzw03BQ zE6JV6yS{Z}kU2ID_sd>*nD26rb^XNtglIl-)^GD*4IV9I&KEoiq&jQo9d+ zU@uAyoxH5{9gAICVJIQ;7168}ekk_K8VTk0_uo54?KN5$N^u65n+JX%d^rJFV7Ayl#2I#yL#^8(CR82;6o{C7go%m;n0QI(g{iNHkcT&- zmSTQJ$uSLadxw&UF}!knGHUa?Sc3tdq{&!q;OBL&>Cc4uk5&uD%)ZOBQu-~i{}K+< zjzhk$tc9&UT)eYi`4+_pPpE3av+OfLvw)FD|C=5;LOQNpS%Fff%JG*THEloh8=NyO z`Qtg*yu?x2e2c1Wg=-aNC+jJ1jPgb?$gD*S6!w4z*uJxSca-omO~2bbYT*(H5t3%S zQNdBq(I=8u<*ui48B-yWJ|YPJxXH;?fXsSzr8f0y3ktQ-!Rw@~UEbVdnJ@9FB<|}x z47$q}?Syj~;yCzb=;>*|jyCB*W7rMOzp{NtY}8Rq zjD)dDo&M9ZfKYAtfyrRj$o_6Y*A!v2XUiorl4nzu78Xc#BL@0icdAAeiG<9I40*m~ zxR4Lru^c0LsGjPWlc%Lk%A5D|kgG^5aE^#SstN5K1@V=#tJI%=_ib8ed}7j{l5M$C zmQ2HmXG(NO;pdIH1i_Jq#aCkU`>Kwb$Z&3IzSDH}Ceyp6Fu@%EG(F(6;$*k_TWela z|9B0qgrnoEtM*lKmul1<)5UMit%I@z*kdbrkCj$J70AP9VptZQ($V0R+z&Fxs=(WC z6t`GlbB+m|vH2tYGO7+^Ym~jPn~e)e#uY>Usc^5__8Zb@;)YZ)_aqAWT2no__hX-n ze>XTpl%y2yu4PB5pppJcaY;fM97(K3V&O~htFF%=@02n0e|;|qXKImt<`?IKhK;BZ z`_!zjsyuT{!C$6(6$^BuGM zlDw#U?`7FbY2Q=6Wi_Z6hV~DCy$*Q%Fv?|lfBFP0Uehij5g5*3wphAUD=5+~rkdyUh?`FRN?B(| zmEyHvE^P(D>buU@ZMsRn(5ys!;B3t=UrsMzMZqSZ4AtqlNu|gotKR-g-DyOcJNYIf z(|y}Q8!w?n+s9sY(;K?AqCq0njGfn`Uo_DFa9@3nR5WgHWx8oTw{(CWGJjLnD)ZZu z%az|yg434?UW;bQ<#=E)dU}*#u`F^qnIQA}2@WW`?cEf~YxXl7APKCemkCKKhDL6Tv%4vFR)Tddm0^B3-t7__-0^~@y5NJiXE_7nM*Le zJW9n$Od60bzU$?qNkE&lxW=u+#~!Znx5Do>A@)F@_hM#r=j7Gt`%aPWPutL+(%jrN zDeQXnDJbOkLgxD?_b~0THOl5yU7mKAKDf0fVqb$>^p0Zn?Pt5I^`#7@(o@TFnnoth za;c+kc6pICSNNY>WBsCU?HaB%{m~)Z$RhbQ{m4&D3b#?K`KF)|gY`bDJ2JT)UY<36 zvM-X7^s6t9&pwV6&i;|Ef4m)yYD>iC)-3;H#zA^?=E-tQAgX0}aou+piZsHerPKy1 zBkRZEf7aV0a;|b|%pb4^*A#p|ZshhZc_V|lQ-|rL6pLH_MtX|a>vs1ru@tFC1|5;* zP4}D>CQnokev=`>D(+JBlA~1QwsBQ4?U@=4AfPhRHb3iXmAkV6b_XlZ zoRsCggM%y*twK6eAi61a9v5+BT==Ct)CVMa zrFw@ZdE8M9RzlCGh^{KyHtG>@#vBd3)$WNlZtlw5n%}7b+5M0K#>_EadI~3?0dPvV zXEA}yHiGq6_Hg#y?ce1aca(P2F3X{@&am-3!}d3mFhXMbdoOf`o{g)DmWTW={Trqo zFXz#t?^#}bKikykr3Khj19a!#xCls%6!3`z){{9Z;sd_(`2s{OA5wdZg9ZoE=Auk} zG%imlA{WF+(dtwHY&^edZKuXlQd*@_#Hd^)wq6}g^QX^JD}CgkLQ9sC^Nf@)4ZBRH zRhT=hbI&h7M5u?L$#i_b$mPq!>7HLb<6_crw!XEQj~sV2`Galm=I8zxmYt*%n+oys zrRODF2?#}Z(CJM=`>T%cZKoabQQCw?xFf`PT%qk=332IhP-1Q1UFQz;*2gc3n<>R2 zx*z51rB1Qythqw(dap^dT^9+<|u6D*JYPoMMSY&2i6Ig8M1xm+nU`4cV> zW{vNC;D!+*c&BnAw6K9Yg{33%phL2{+gW&Q_Zw#Gy-HgB2gh3}hXf__E?aE-vrGPn|hk^x=ND7lq|SmPYpj0bgsa#E*BRv5Q_A z2=a-yz3ajG?d~mQhI?DaF3`JqY>*Pjd( zvuj-=+eI4pm8h^Q-PPnK%$A6p|DxN_>7(;d{qLUd5*2!mmMoEcyD&wwVO&c?+E&w1 zm5PbSszz1RSQN24c`|MMs0~^fLqCWUNI%PD5@mL6;Db%?Fjm<5^bPAh)Xx+@?s~V# zNfv)3RG-tRQ5)t7aTuI7MFn$v%gI=!5{x#|D6^^Cdq{+^;teBe*Hsi zPh5h1KJC(H%&87Lyrc)euH~kO8Cy!^w1(*uwK$2ye27u&8?1YRC1};p&9!bzfNN-N z6VIiSM3)MRQb&EfQqnfB`o+AYI!~_p8qU=Onfn$kR9DrspBbSwFEL$v?z{V!=B<#{ zx1;UC56RfCUWSM+C~o3i?lF)O?hJEX-6tuyzZztm{8Mptrf5sm@1<1c@C={DZHCAf zqQ`ki9Z7g2xLzOG>RPccE$Qri9Xo8^>;ym8EO^Z#IW!RDEjl_cR`&G2&Y`rJRt=?1 z{khnrCOae55X^oFoo8JoNuvC*dIIC&Q0&w)3aU)+o_<8a+h7Y7Eec@_KRb2#r4=1s z7t5tmC54|1OG{WO3wuS^=`Xi$#h}+#mD%p|ea|Q#|IJQD@EB>6v%Qst2ggYd>Jt+?w5JIV7Y`qoAde6WAR&7ag`1tbg(m=>ewhvh z7uC)429F(&3%7|Qj|-QH+37or(|10Oj`tk6Pv4lCIXXjc9NgS3PTu`HlK=Ua>)%7D zPJIIF$3#f~V>^Ay*qfUt_pLiQPN*RR4JZ6R4fV`^_T|2_jmUs3Y^Oc(g9M-hyl3A` z0|4<81_63N0`^66(jNqw9{cgKm$NWU`^l){9SJ9GrJb> zFVv8MQaHZIlMP4!9^e4S7kJ_a1jGSncwgxg zI|$qaHsO3hECT%d4H3kmzz5hf#A3i#6lep)x6b0Bg^%GhKLhZ1_$S+t0P-{YCwQMz zd+W)(oi_247YJw}al$r;wUJKqt$D8hDOaBJACHiK0-z2d|8hVHe0(+05s-~x{ivEbSGS?9)AM$nrJ zpasu|_=yh?um_^y{6l;f7>CD)*a0Yq$A{Pvcy+ShX%jzrfq)ax1&xN zkH7204-$X{kR#}W4Pb}kp+57+2vou2Upr$aAOs#CVrJm%MxiG*h*^LPczlRi&&EHU zYp6l>O&T8KRPUV#^KT0LfMcaT*#QLf0bMvB5E}q?2zoFCgy47}yU|%5PId(#HU_le zu^~1&iznyY_=gDdZwnB>Hfa9L0XKMjh%JDp2zsyt?BMYsyA|MaI`~P0*cu3d$A{SF zZ2YZr<9i{TuS7rw!hEO!PvO2$J{5pQg!5AoAV**&;NNfEp#I9hJ`@f-KPmtQe7;hj zYzF~VfD%5Q0b>zonLm?|HjhT3!2TCF z?*g}7;GgFh@pz&9GXED3CJ+wK$7vct!0keQu+H*R|DQjI|NY(*I5~e2{a-ojfBnDt zgP7zTBlgER>;LbZ1ptU`|BDY|j|<#(fzNJceYOqif9bz?A-;NnJuh(Z1^#=1FaM_x zIGzg}e1X4S;MEJv_22mi`4hXqo)@2^F4#%W;xYX%9*7w)u=zPg^bf6p}7h$47A%-~afB`0{`LA%;uhiC2jKC*Ke|{Wl)Or5AYh0-yaD=WH9rg?dSKfvGPr z%>|~tz;qXw9>5ZS28Y&b?f?trdG-K)o&ECZ-+JyIaEbi9-4hUnf1C^Le;+V7eRI+v z_5vProM&&Kl;}MB05kA{4eIX;9O0k0`vF{Mzij&F?*X8Kd*1F3@H3s~06-J_JO=_I z4Cgrr(1!&LjTa0^(w(WG3^=i$=O;ik{HY!49}B#O zPj-mofa#OZ(5DUJ_zQYqyueHsnE3*;TwvA<%m!@oL*r4O`~w0B03NI_h!cTfSYHq) z0UKl|9Zwqd$qNLM0R~uK5I+T^P6Iz_)F&?xcm{aF`hqwGNQCtT@pGUX))&O7zzPl88W4`Z4j4r^{(9gNg1#C6W(0jT0tN{B zY683w^wkWMG6QD~il+tW#W~Ndz)SdI2iac(AFiCYw*mF^=eZsDjCG#h0Ijs=xdWKO zJkOm#C-r%L3(Ufw4^B6OKo<~%ps#Kqlj?l`cYry9zIuQ_1by`aQV9Bb511k7s}D%z zJnyd`czN|a4*)-|pXWgU89`qk0Dc60eFQWS^!4e29(XS>-v#EszycRo@B#|~EwH{$ zWdZ_2z$C0Mh=+j;SYHs20L`$zApQ)joxV9~5RU>^;Q9se7$6So3*vFW7}giW6F?lS zFNi0B3RqtdPXV*Az963d?;&##e*qR@eL*|}puzPE;;+CetS^Ya0hi(W1@SDf1?vmq zIRGE7Ul4x>_NmVf4?eyh00~^bAp1Pf0P73l1z;4`7sQLeb68&xF9G$iz99Yy_`>>v zco|56^#$=Spbyp;#4Es0SYHsY0u*rlf_M$M3F`~u-+&XWFNoKHXjoqmZvY|)`P~Hc z;qw==Zvm1B`TYZ!!sjn!-v;Cm^1B0A!{;w#-vv|<^1BB(z~?Vy-v^*yPXE)-0lnG&z7+6Qp9{|!LbnqvF{xHB#@bwe2V}idC^mhpygRh^E9Sht>(BEb73w-^A z>{q};1pQ%y+3@-nvg3fS;q?c^xL`0s{_wyoczp}m@j=ADSKPc%A4D#&=mi$Lz_%{2 zI3NMXCwG!I5Fh|e;P@aW1Zm;;ASMFE;rJlF3cADd3o$Vm2hT6WBw#08Umzw0XW{w+ zF&Rh%&o9K};0<_wA-)D$!}AL<1sH-0%`e21paVR=5L1DX@ccr2@_Q0^ej%m-W8wLQ zm=^Sc=NDo+Fd3d-i0MIpczz*f0MjtekIx873Y}*r(3JW-GlO(+{f72u0VUx24KXW- z0@rVd*+5#jenWg6)H)TyNrRXjbcfdm5OaX}aD9Q86YPZR3&dRD4qRU#<_3x2`VBD; zn81AA{|>t}l?C7fgZc3&eb29b8`^<_9z3`U0^4*aFuVhy}qHaD9PT2<(9C3&g^p zEnJ@=z6plH^#x)PP#&(&5Q~B~aD9PT3}l7tGsL$*Ik-MUEDrj@^#x)HFa@qJ5KDr6 z2>O!(eDY1cM;BCRq!f8{?x#6g!A_fxPx&1s$Zxtk{9ZO)CHElz%mzD_5$C& zz;ZwY9PeqFIQjo;U;)DCeNE6Fju*0Pf#Gnx5Nm@?aJ_+82OK|rbJ8Hz1uw(%4Y3}` z3ePvh`k)a!-w+#szVLiQYzUUa^#)=iun(>`5F3LvaJ_-p1pEZo8;DK8M!4QUYzB_O z^#)>dunpn!z6JONt~Zd~66}KO4a8R9cZ~DLXAQ={^#-!rfF;!D?Y5v3TyG$|9T*MQ z8;I>eRk+?jd>3?t>kY&XU>00&Aa(>>;d%qH6Sxl78;G4j9JroC>;g){>qUrNK~uQi zK>*$|tT%`sfqk&vAPxmR zV7);c2F9PhIcd}ECN;}G)E40ginBWV6wz*%^G1aT|a3$KqL zehn_d>m!KUzz^{H2;z2d6$?0P5WfLG!|Nl6JHRb?eFSkQICc8wq*0%|K;SL7kA6!3 zxC?wPc%Hk#dU*XreXs`TgI6KJfYz>fZ;J!Rrx-`@#1J z*M|Y{FT(jc2wp?b+XqmU^}PR&pd-Bgg#3NFpf~di`mngbmKWIS0$X2Tn+t3UjKF$3 zmCecDqrgpAZx9cIwXohG9s!48y+QmLM2G7e#G@bsT;Cub19f4&K|Bt6!g_;v0xW{{ z2Js}=4eJf!DR3Xw8^qHf2`-es|Ha;$$46CUZ{xRbcO#qH5l^WpLiu`qBmQydB|YAVe-i5SJx}>Gv|f)lD*r6> zqVIXi=b_8=c%$+!Lig(NM*PdrM|!*w|92>?=QHvDghuK0jrdognR>ht?+l%%#~bml zL$~PhM*N%5@xJ(e8*0?^naaNl{n7tCDzr$?XDa_8l<+@~3Z0|pGnH=-&GSEx3N6#~ znackg8sdxJ&!LIF`0WVw@WtVDxHf8E?}zW8-_zxIv49`2sL z`1N#u^o_sW-9Enf?cqM6_b24vp6)iiKOr7-uhIJx;(NId>-`DwUatRn)Tv^9m@jy> z;5CBR3SK98y)!`jTd3BX47W)8OT4!m(f$(eHetK8{%1RADwUF{oIK<-^BNGD`Jj1i0|)C)A=TTfLpEC8{%_kzQ|zAL54fdQLpY9fbn}jzai>_eZ)j^?E}*&pl7CH^hg!x9IhT zc)q($uQ$Ypxj*RjhIoP7q}Lnb!`(~ud?7x4e>+W>-Bsg zKH6Qb*Bjzv+?(}$AwJffq}Lnbhq?3gdPDqhcZgnZh#%oj)awoLBi$ap_#NdA*6R(G z7rH0w^@ezndxlvsc)awoL@$R#}@mK8r>KlJ0Za-iACb$t_{El|}`{Fmz?e2@; zBsbd^zsYXQ7r$fNJYW2#xP5)`o9d46#c!JXx^Mm->;CAQzoqUYzWIBcyUjO$r;GKb zL97prf;S1?EcgP!PZxZl;EM!5L-0Qfex~4O34XTV=Lp^+_+r7A2!5{MO9fvh_;SI| z6MTi>=L>#;;1>$MQt*oezgY0U2;M6AC4yfn_$t9K6Z~?)uMqr7!B-1@mEczkevRPQ z3Vxm7*9-nv!Pf|WgWxv`ev{xg3x12>w+eon;I|9@H^J8meuv=e1iw@8y9B>m@HWBk z5&T}k*9(51;P(sufZz`b{*d4g3;u}Ue;52w!T%xnV}d^}_y)nB5d2BO|0(!J!JiWR zX~F*`_$I-h5qz`Y&kDXp@aF`7Uho$LZx{SU!Cw;mWx-z&{8hoX3jUhl+XR1I@HYg1 zQ}DM0e_QZ(1b_I06+Bb$ zEW!H;zMtUx3x0s$alsE1yuaWB1Rp5)L4pqw{9wVe1s^Q<5Wx=-JV)?c!Se(kDtNx& z!vrr7e7N8v1Rp8*D8UaEe6-+W1RpE-VS*nn_z{91Dfm%>7Ybe^_&CAG3tlXEiQp3i zKU(mKf=?2Bvf#%EK1J}Uf=?6tSiwsLKTh!Jg3l0qrr^g5euCg93O-BllLY^R;C~eS zWWoO=_$h+V7JQE23Bl(IUM6_C;7P$N1fM5(rQlV9pDOr#!K($Y5xiFLI>GA&KTYrk z!5al{61-XP1%jV0_(H)K34Vs)e-`{q!Os%>Y{AbFyhZTEf-e#LT)~$LzD)4tf}bb& z3c=48`~tx*6nv%N7YTl`;C~UkRq#s$zf|y5f?p>1<$_-!_?3dM7W^u~uNM3o!LJqk zI>E0O{I7zq5&Q2mMzasdnf^QZ4HNm$D{<`3A2>zzv zZwdak;O_|juHYSlzbE+nf`1_Rhk}13_{V~OBKW6*eef*&gQXu-z_K34F<1V3ExBLqKE@S_AT6ue0Aae|K*yjbuO!6yiQ zwBQp3pCtHX!H*Gqir`ZPpC;^?Sn*v;9%jYdd1LZvdRB-^+uT?Hd7SX**)Jw*$`A z@11%HaHf8r5MtJB1)Qbrh}r%Y>h=4w5VO4laF(_sX8WgrGxhsy5VQSDz**XknC+dY z?+3r&K+N{<0B31CVzzGwoT=YOhM4U;P_ONX*$!_Ub29b&f)KMEzegua+Yz(9E9&+8 zun@ByzZWM<+Yz%p4w%O|e)nPKfzUV{h*>iTaF(_sX8S0>8QUUCkC^R80*>`pW@j?s zO#MDR#H^VHI7{0RvwarejMu47#B8rbyKW0H+v@>yTW1;?#H?9rXjY=;4XPh8YgPl! z97sMRX8W~(v$P#C+wr^oat|Usey3xmelH_p*4zg;OWP5%{Snk>)47P*{ut`D9WmQC zqF%q34Kdp{pKSjN^BWC-TsK<*Q9EjQ8iF$2E%=TXa=j!(g!WUsVnZxK@#H@(` z&eC?oZ10Zx0@5R9`yQy*cEoJ&i+W8EvmL(|FG~}|Y~LUCBdC7FY{&0_&C+(nY#)Sr z{k}=WY#)MpZAZ-ZJk*b(`Vq6e0QK6AnC+ubuitlwnC)XxukDE0J`FIh5BS}jnfg7m zh*>ieaF(_sX8RvdKbCw$%=S}IukDE0UV-|Z{pbdqh8w)vwaZik0m`~whuwQwj*Zy zIKa83q{r`v&7AIG)=b26wH-0rOHn_A^oZF$6ZP7TnC-JrKa=!`*?uzWwH-0r=b-+0 z(j#VjIqJ0?G21Iqe*)f+2N6hv| zP_ONX+5Q;n|3rGkY=08<+K!m*Pow@6(j#X3X4GptVzxhz`q`vM%=VX1ukDE0z7_Rz zNROE9Z=hb=5wrapz#QlA0B6pna}l#lIJ2De zh}pge;4E!N%=TV@Gn1r8%=W&3v$P#C+wnO;W(DaHvweTmYdd1L_ecFa(j#X3Ak=F+ zVzv)KeI@A;vpo;>+K!m*1*oqgJz} z{t#gH4Kdp{0A}Ad85+c_X-7>RwY3#B_zMpF!M~@Z^XwDMpNh{!u=2z5{@IDPk12WL4>mrCkW>t-h(hU z8H&R%IJ(16#+%@*#_WGD;IRf}cE-Vc&&ee8YXShyt&B63@ort;4zJOzxOgQlJ5W7%8 z2bZ(lm4qKa`$dEwL;J;q9q>8!7s6e!U#*0z(S8ZxCbVBl_#3pZBD@3bml3Xn+{G>@ zjQ0__R}jYiXY5MC@1T7(;el{1h+RcE4{+|)gil5LHH2|*kb5oRHnd+y7_Y6l*AxB$ z?SCcgU<}s~o(MR01L0E;-$)qOMvm12#5a+BIpCaI2w#l$n+fl1Y~-1Q1Nqu@`*yI7l}F#BAL zcD-&OX8SC(>zE^EdvCz8`{5TH*j6r12sm)5jXkKK`tC=z9}Xt2A2HW66Ybg`#B8qw z9D4|U!O;Le86D&^V%D4iI7hdO(~Rpu%o-fl8Sl}#h}nKCU_SRQ)ad#Vvj(eX&7**0 z55q4wHp3711u^TlpIt9lF z_=){PL3M3n-^PK7&pjD1#|JUnRh)4Fg9GCkdt5%o2&-Il5{|48exrh>0x#&Vz%039DRW5>~m$BHV)Y^dqct zu^(ZTi~R|!TpU1Hu*wC#Km>=%#Q?%87Xt~aTpUDL&FgjFuk zSvXWK4kN5`aX8^Pl=*UT1ld(CjwGydaTH;di$cOG7e$0yu%2;*RW8O8R=Fr9ta4F8 zSmj~@;SN0aXu>KN6A7zaOd_mufiJkhp>lByVU-I^0vswAQwghFOe3svaV%k#i&DZW z7snA+xtLB^#$39DRS<8Y{4oJ3gV;tzx;;yn5z;hBg} zCR~m9PlOjDK80{A;@O0+MLdV_eTWl;Hz1x%7@r%5$_RgmxSTLP`wb-tcZEH9sDf}D z@jSvgh${)>v(Qi#VSKh3I+ZX!R}9T3jQjskHDUa}??N?%S0k<^jQ0hhI>L`4#)QD} z3gXiUcOY&cjL)V*jf5i+z)ghvA#Ns|jd%g!Ld2&No`QHG;c~=_2;={a7CM8lnhT2w ztGTd*a2$N{&4qKxuI9p0!fGxoBdq4aa>8mZoJY6?>sdiq&4u#`-;DMP2&=hpAz?Ka zRub+&%|(ROT)3F9nhSp+tmZ;1VKo;nA*|-YrG(X7SVdUP1sv>fVCX}a6IOHK3c^?% zx{|P(3#$n~g!ZcltGRGBVKo=7A*|-YwS?7NxQ?)z3;3`B4mB74N?6SWYy=K97j7V| z=E9AH)m*rVu$l`u6IOHK7Q$*S+)7x@h1&?Lxo|sSH5dLySj~mCgwjj|s5a35hc7w#vl=E4Jn)m(Uxu$l`P zcsSHtc$l!73y%<1bK&oV)m(U#u$l}1Agt!XV}#XQc$~1B3mXWlxv+__nhVbmjzinN zxv-h+YA!rWSj~kkgwQp3#rK3;u$~_Xt6cm@Smk0nVU>%Y2&-KDmv9H3`!ivciyeej zE`A}ba`7u+m5bj9t6X3(;83{;5mvdt2aRy3T!aa$Tto<~Tto@0Ty!Cm5Z)~ zRW7;_R=Ma-SmmMzVU-K~1&7MT?u1n?_8_cs(U-8w#omPDaE>n*`;cAbVqd~47ny`r zF0u%#T=XN{g7xf2Smk1W!YUUB5LUT}6IQu6kZ=c{+n=z?#Q?%87uX>5LUT3l5iaA_2uFyva4Ja5>~k=BCK*Tjr7ZV7pTpUeU=XcA$Si^+slE{-9raxsOl%EeT|Di_lTt6b#$39DSpBCK+85@D4Kd}9k7Di?nw zta5QOVU>$=!YUU@!f`mqmx~Irt6a<@ta4FFSmmOMu*$`$gj=wl`Gi$2stK!H)DTv= zz&FUip>k12xC3~op0LWrX@pfS@PRiRDi@7}RW6zct6Ve_R=HR}Smok$!YUWI8G%FP zVi94L3w)yu94Z%oCaiLCCSjF}vk0qPoK0Be;vB*%7cGQUE*2A3xmZG2<>FkzI0QpW z31j+0%Lrr0LdyxGyP@+4w<2Ca_*%s06TT1e1%x*szL4-X#48DZi1;GHI}l$?SnZwu zLRjscun{=a-suv;YVUL@VYPQ!MOf{fE+ee=PL~r_d#5W1tG&~egw@_@HDR@Px{9#c zJ6%m!?VYY6toBaWQ8?7z={mw{?{qz3wRid}VYPQ!Ls;#dZXm4oPB#)(d#9TStGRFo zVKo=l5spK9zPWHG+0|UQi?EstcN11~p^dPb3-=Ii!Fui`tmeXc!fGyH(%?{Y;eNtu zE<8ZE1Ij`V5>|8JA;M}dJWN>4g+~ahx$t+wYA!rVSj~lh5LR>HF~VvtJWg261sphV zsJZY2VKox9)@c!RK-3vUuubKxz*YA(D@Sj~lZ2&=j9E@3qnItZ(|@E&0` z7v3kV=E4Vr)m*?%z@g^CM}*Z}_?WPo3!e~HbKz6MYA$?6Sj~mc33r(^Y|Op~&)u{7 zz^>i8_vpFXF;k{aJ9hH$5hF((T5#CmM;v+7*sOm0?SDY#;30?P7b62?MyBD|@x+~p_ z+>71I-7DNH-PP_@?$z!!?zQf9?)C0p-8JqF?v3tE?#=Ek?yc@^?(Od1+_mlyU~5hecJt(yUBgV-RwT=ZgHP; zpLbty+uax4m)w`#SKL?Kt?p~?HurV+4fjp=E%$Br9rspW{7Lw$aA)}I@HgRa!{3F!5C0JUF}ywe zQ~1B(pTj%Czl47c{}yhEERHORoEuphSr%CyIWMvza(?83$c2%Wk&7Z1N3Mum8Ce~< zDspw?n#i@0>mt`j{u)^mxgm06Bzq#n7MZ*I@_FQo$d{3SNB$G}D$*JG zI`U2A+sJp3?;}4%evE97{1o|bUKYJPdPVfg=<4WI(W|4^M6Zor7rj3E*XWw)4bdB; zH%0G=u8ZCoy(@Zmv@Lp1^xo+D=zY=qqYp$Mj6M{7IQmHR@6ku2|A;;oeLT7$`b6}} z=s%+yqfbSjj{YmUDf&!wbM)EhmgsZQ=c6w~+oLZ=Uy8mQeI@#8bZhjr=(gzV(Kn)R zM&F9Q9epSIZnPu%UiAIw2hk6sA4NZoeiHpO`dRezXie>afonr|hTySDUPH1vk=K-5 z*p!zntDjv{S3Y}w-Q4P`rZb$HWKCK9B2d(oCz=v@jZj`Na#X{x+4DT(+=fI|ZGBx` zb!l1=>W7aWVbiA-srn0q9*x7s6xb>mIZPCxeq_Ngzh2cma@2gE=eoIcBQ%$8)V*7n zibh(;y&|kx_s%nV`m`eL3Ht2m(WpD_8NEt$$Gsxd>yG=4;5l|j7z;+E8+FGQIs+Fv zHFJ~YP1TLFYwD|J&ugeV-BClt$t$a?sY%v0rOKgIEN`x#T~%8J=44G{(ksQYtI?3x zP}NwrATQC>)KE3IxhdJ0ssJU4^77eyIr3To^Ino=F8o1>CcF0ib|; zC8(ybdNxljOH|z|;GP<76mZYx)j$FFN>EJ!_uDAo!lnZ5w^6`reSxB(S?%Q2)-@&b zj-GaWZevrTY`#xZ(_D>n$7jP~j<&q&>IF48=o=cV=IK=8G^ndhru3LvnpYJKNzaV3 zG(%ZkLlUcl)TP#PPOMi?bzOoLdO_c*CUr$1FVxus%N?vwO~uB%GAFOGsi7$`7yd4) zQGe5}6i}vZUW#Z)cqQJD@NAx%hJ;t*4GF)EhJ$Em3TwKZ=)e0Y-&jOZ8Rk2 zrc#ADQ7NdYPFTAeR6<<~Dj}D>64hz7jtiS|&u=65{5A^t%-LgRpJesWU+N{rZ}-AV z-up|vLn`OPRRe!9ovw}+TtOB)C&zxex%u zo*opl6wl(!OFL)Yw0pI2pUhITOVZAnPqXXHOFL&?+PRMfW`XC{E{fS}-`S?yX$4&2 zu${MODdzTk#b$eH1)TX&JI%aViq)}~rae6F^bJ9p|3;ip`#-6>vt<3v^1-3OFZe1ssJDI~}fOsTm^E z?sbSGWR{u%l6H=dY4>X5@R+4$bflewlV;bkk#-J^v~w>C%mUA?T@eE8uka3cQYU&wRyZ&(aDwBk2V^T+J?HRh*ObGt^U#nX`xQ zbhw(OW{6C?*CCFOS!xDI+BrU^-K&kmW0soHk#-JFnq9|6+Br1R&b=rw3p}@WQOsWZ z&NkgnD@cvU;PwKG&0Gu%K9BwM6`R>eE8uka3cQYU&wRyZ&(aDwBk2V^Tus-pD$Ysz z8G5)D>~y%ArDljsyVoI(kXdR5NZL6*rroQJ!(*13(UEozPMTfEM%pU;~ zi{g~m=Gi{CWkG5@ngw2afyHJnh6SI;e)@{dY@`)%I(!A5Biu7zvDve<0?tT!0S{Nx zb*zeWl75CBuETaZT+LEnhyu?_MaU@i1xVOa@iFWH;W0{m(Gm7kaHO4MBkZZr2s`&; zxY>Entz8szQhjHeZl@J+g#|lr&r;0o`HIc<(h5@JKe)ZXVyuw;92R_DU@@M@cP_s3 zuppKG;0n2CY3I=k3^Qk^6{JRhS)q0TUVjTXBQ*xn&d}2%-xwU;7~mM0rDljsyLT2x z$SgGjB<&m@)9%&A;W10GHja+8b8yn^dU{AZheq1D7sJg0&#he)v)8_}O}EnuxWa;+ zw`VEl_I$-=duaun+hM`&1r}q4?5E|tz+yZvH9gGsuz=HVsgQf-D>i$UR=^`5y?|H9 z02gT9$O4YSnAx*-`U;0vYKAEIERK*_Y6eK!IX^e5m&eKEM zxfk$Kgx7h`tz8te*S@n&x6=x^LU<`+XYE;vxjkR8*^j= zGcWDj3wSAFXPK}Rb0&PnrrT)++#b9Xv9tCp#oV5+*laJYfO9)4u(_a8td6}5J}amc z&*IFRXQ7=lZ`#u{Z1ASOA$M3 z&r;0o`HIc<(h4}YBLkZYD#hy9%iyzuO7Setym=PdIrFAHJ@aO%*(GV`%%|CP=B1r8 zFYVk5cqw9MnXnXdCVa)F+i3+HYj~<3)LvjQR>*!@&I>HY^Eey6^RR%^;VVebhp*V| zSy};SB)veVB&~pRl2*V`7_rkBnWbikOuN@1j*wYu21wdDKBnEPjT3K{n$eMV4o;d~ z$41&YG}6w!fR`eIhR-gF*=yg~rrT)+oC$cUAJkr8v6&0YdF-dJ*vv*+0jI-Pke&}; zvDve<0?tT!0S{NR%UBiXB>jxkD;ztE(QqSzW{6C?*CCFOS!xDI+BrU^-K&igZZLced$vT0v?&2DcYjY~})94cM8VzG5>QX$71P zUqO04e8pzZ(h4{u=>)1#;hep~{y)X+rw{}sS^4dHb-AlPG3pm#BRDWlw z@D-c6@D-%{=_^)o(r-0PD@YC3U`M!TY3Fgz(h4{u=>2y})9uko|-g7Ix;RuNcqc#VV~JmHyxgxo2tT zr3Qd`o@zZLced$vS^-xGFGcLEJxejS z=PNebODo{q!s`G*?FANNh3u#0yue~SFEu^P_OO7{Z>f-b<|{UPmR7(cAiaQB$N(4k z6%LFAexN7qQ#CXF1>Q)|k@6QCk@6RK=jllKi;YO77wAa&3%m+-r2NH3q|ys?qyh>k zQt1VHw&;S?=atk4;@~4{fp%!cVjmf3hrk5dVFU%*!KXmG>RoUNb}z6*^)Ijl)*B~p z%H)}o@@MA*$d9Wp4EUYDj_Bez@HKv^7k^$igIIq*HUGeLv(^?<)zU&mO# zfA2tJ_*^~HpL*?Tz7+JO3c2>)(}`kJ60=--}3eYcAGUV<@j z0XqkO*}oe^ef@rRoTX5X_3dTUw^G!1at8h%u-?J-ohRyB1NBYR^}#8r_%(?7YAyBE zi26P?>g!|FH%rvlVySP2s4stq=ilB&ecMHTFNON*p_~uy@3$hq3!y$9fBS+MQ;73z zlc>+_4e<*YfBzKqeF*h&ezT1FaJ?|+M{fwm{sHx&$sB*P;JcNJ!HD_Y&!}$Zz3)|A^H7S1bxu93Z>$5i0%i*1;2vGZ1+(ZoN=)8 z!Tp^o;_{Y7*AFT)>)T<`4S)trT|WqNoEwF|-0oNrm%}Z(o5uL-I~jCAak(CJSa+dr z>ps_uOMz||i=xer=|S+vxv(Ui%xz26r9ZCWrsyK12kq_at;V?w^GFA zWQ*=i5to&qYvJHRTMV~~xD>({Z1sdWgYyWAln&!EPt2p917RHkJ0D!%7a}gD7Tpuj zS+l>FS#;_zy1PaECW5Yz zlLMXMeykPoo7LT$Z@8b}`29u1Z$(b}x-Y>2Q@75dJ4?iG3+RHz-$D_;`rWGZaVY15<5DW(mt)Z-MEs^$bi<%gv)yWoZZtSz>Q-8G(`5WCx<|!zVGHPj z;`gAqF6`LDi{BjZ3FFceetL-U*K=g>b?a0Szr!uMzliu%TXYE#ziTbJO7PK)-xiDR zOcB2w7TtFuemSF@!0X3XB7Q62%PRT0iav4tri%EjgK=93<$RzHkEJ4hUs`l8iumOm z7F-{G?YtS6YKsp4%Pv#5&Z2uv#P3Usu0+h=oWq0TS19K1Wf@-l@IH>?w?wbI5Jq*Z zEA-YfG;sXFhx+@`20FMENFA&@5cX$ge>Yil9}f5HIxIRj%dgvR(TyDD*Tss0{hI+! zoBm~6bj$Pnx)I{4DezpzZ1+=(ZUpQLO`S6?I3Lqt5j1uCSaf3t_;vXf-K_3@-9(G7@Ib$AjzxD$ zSHEtdMdyljt<|E7$Nlx)Zqa=J>!%r)4HjJp9%7ifZ5G`|xK5e6PK)mSef_$waQYq#iPV*Ts1=<>w+7b^*lUth8QAd7vsnM? zExJ$Pd6ijTt3`K*SpV8Ax@W}t*KX16fcqx1-A;=xQ>=fnqa6oAkUAn7O%>~3zC|}* ztbe5z-SuMqtGDPL73*KCMR$%||17%e#Pz7%qMIYvKa1{cx&BQIj^91vdX#U`y&&>Y zYSFoJ{j=!ea{aUDX2|u=qB~8le-_=%*<$=zbWiT-*Tp6U$8YT*zb@aR+qAo1S8CC< z4fN~kExPA>_;sxo-2?sox;BgMm2Q4ryG8eC+^_4j=-$}PuZv9%j^84={#kTa!gFME z-6*x_{vg*si*BJ@|17%0Vdnf>Ur=+?sPPo^$*OmO_(hUa~zF5ja2 zIm53jwdnGO_;vLb-4wb0S#$6prfUx!6^g;@V$Q-bTePpp517TqUe z{j0a=qGJEI#-bZ7*1vX(?gX*^Ia7oCasDCxeB@hnw~6&{jz#x|SpQlry6s~9+hEak zi1n}2qWg7se?Q{Wg8TciSpP~bx=2rdeJvK0J*VkdueIwSt*s;O=h;{YX zS7_1QBi6rqi|z%n{;jd-E*0xvyG7R~)<66YwS(qmqgem)ExJp@`Zvd-+c?x8msX4J zeX;&+u;}{a`s?eo=!T2^U;Mb>{#JP1n7_VGi|#XV{fN&D?r%RaKT0jSv0{F-SadZxe*fAmx(hS>x(_?D*h*ycP573N5;g2m5vP7Tx=M_;qV6y3Ggqb?p}2r{enIoDkfPcJcfm-=h1E zxPHvB=(Zl{_pjBW`%YXxHdu65iPsl8ExHHA^R@Vi!TmjBgx|kXi*B`eeWAso8zcN{ z1Kq^b?$3LjyeKgNs-yDnX zjXr+e?H1kcV*YkobccxfJNgg7{+%M`Z;M5DrkKB*EV^GWu3paHlY{-cSj^vr7Tp3de>Yfkmx=k?^-sa=jveD42c;I>EV1ugZP8_o z^4Hg4(T&;9ugg9q*uNbGeqFsqmnrVI98`5f7>m(OT_-KFcIwE-D3Z@!lJuU?El&= zy8FfcZ=bor?OrGLe{(Flzl;6f?H1jf(f&AhT6AY0;Ma{V3-+&Qq+i!!(aje7zfBfh ze=$E|<-zS1?(1)NmPOYn_J3-*HA+bFId`N?4a-WS)8g%({OF+Vm~bi?=Z z``5K1xZNxaZDfU;b7Tq3Ver&VoUKIPQcvY}}UuF5@QfbjG7XGz?4z^OMBcjn?#r|)T zMK@RY*J07M2>-TQbnC_bFLr9Me=mytU$#XT5%aguqU$f_?<|Y%crkzLExJZAe^*#^ zw+{B_ZH+~@QSAR7vgp={{a?F9w^{7}KDFrX75hJDesDh8#r|&}i|(NT{{H4$bX&Xo zbrUVR$He|`jz#xYSATsAExKi5|JQ2K-4yrNce_PbA@+Y8EV`v)|F_MeJ9@ak-A;=x zDfWL|tAq2lTI~Pg7Tp74|2NvA`%LWrN-etG#Qj#KMK|^ke}7vnx>;iXx7wnslItJn zAeE_u*T3_``qysJO&054r$tvO*1uRyaJ$!t^)KI|dswW0r54?n;{LbZqU$c!zgCOx zh#Y@D+AO+1iuJGEqPtkEf1MWHIhbQ{I`7pn`7U$t2O@-4axVA6zO*0_4+lv;FC#rjuo z(ajg@U#mrzC)U38+_e@iX81I7AR zZ_ynk*1uMZ?l`&rS#))B{j=!cll{JN&}q??%JuKG;P{;@*FTHy2D$!Obg$(3{j0a= zz7f}>R*UW+x&B#nmV(5pw;r=%&l{&!X!y+@H5L zi*C4F|17$Se1CnN7Tr?0{xt>1??Ji#S#+<;_0OW~D%U@YZcs0OKUyuiD@8uqEV}ze zKH4q1g(4rF7TpyhAF<}(_&p=?k#Es`BJxpc(Phf@&!QXMN5s#fn=kUwX3?E5^3iV5 zJ(}%rx6`6~V^6;>wjeluPm1SF`4(Nr?*95pExJwed6Px=aSwletrp$$;(1e>MfYVl ze|_y1-78`p>a^&-+09>H?DXLHT{_yY%eUy-#Ph3Ci>`5`zrK2l?h^5Qx7DJXS>Ug) z&7x}%&v)A`x?6_&>+7`W{@K^Bi!BU}-w$GckZ;lT?(MIy)S^3jh+kK4(Ixlt>sl?k z=SKN;ZJ>iCCw1`s?-yeI>#*qV66;@VQE+`*#QIlg(fuaYzj}*qzkU4uSYy$ZiuJGE zqO0xWug^InxF0u&^)KI|dt9u4b1b@V#QN82(ZynZ|29~3+r|3VY0>o+`@i^~gZuld zSpP~bx_)B+*J9B{o4|y9Tr`8vHy#m8QhO-vHvTy=r)h`$GP63`&6udYb?4u z#QN86(LK}8->!33a6j;K-{yUHzD2ioU%zgSMfbK?|5`1&pT+vO!J^9(`@c?$Zi-m{ z;%5i<_Z+eQm0EPyiS@6=qMIt_Tbo5UU+gzJEV>zDzQxW7?#F3jzfow>oh0U4y+wDr z*l(<{=w^%kM!Q9Kme_ANEy4ZhFXl(SMOS!$7=IRBSj>-Bi|#-%KQ>r&9}e@k+iB6c zVt&LI2lscRm>;DU-3&25S}eNdVt>$P(cPTk??;D4_nLTq5L*)5kMG6xqtK#zTRcCg zx9ENr*N-(8-3Q|NLAym467$13H@F|4iR(wcMYo%nA9F0auMYIbxz(cEUCfUS7Tvvv z`s?eo=-T)9>*7m;`@3p{Usr0;-IL|lwODjn!oN1q6*}G#(Qu6LuhXL2A@+ay%Yy66 z6#ms)bW_FrZL{d+i~V1xMR&c}|K%?a_U}=#|Ess?z7qStHj8d|F@HNPxn*woV*a*Sbme0Hc3N~(4)Twy{1w6eohtT!^%mXq0si{hEV_EJ|Le5qW{LTm ze}1rk3%dH-t+(j1#`tw@7TuV*U)O2T;rGXcU{1MuUgcj9>|f@7eqFsq_qN#owOMpO zi|bpbMVBY;xAHFx_HWAG!as}d9I^jvv*@nt?XR!XqH7=G*X6Ga_U}Jp|5tC(RcHI_ zYqRJs5c|JQi>_gizrOs7g8ge1*SC6$Zs9|deS|J7S`VL3l6x&!6>u;^wE^~WW@HQ2ufvHz>L z=x)jJ*Vksz{Zn2)EV>^C`|HcUB-p>+a(-BJJLL7lqRZUV-)^Tx=gRqUX|R8BIX^7A zu5x}@bc5vlu;})X^J7)8e>rk~SadJS{gp-cmE2!hboYw=U;bsm{~eF-}AKn))Apgw52o|xmH?r0|Pmvv20UwF!I zbzo}2;x&Ck&i>Fz{N7bOSXa`;+e4sz#1)Q%pT))US3wW|oEZEhYnvMC>KEme<<-qS zb!a@EANLNz^n28Z5vpL+u+aqKbGn~XGG#(2#4Tdo-=^A!s+~0%)ZPdrPBwh+bjT^% ztIN~|b0I+8e?#4`M=R40>|N z(ym3n%q(**cQT@p5UU4dM|x*Oi~FpKI{UIMvH@$j6zW*gGGxWM+0i~zOUg?7gfgP> z9ZOn5B`+Sm{=Dt(vaU~FIUswVJ_FW1*n7abfAt=)=C!^9Zv3S0l9qdy=PiG+gxlZm zwB^s=xaHQ(n>RiG^h+B@ExmX7UFWZg#v(&5D4TPilhGyNWOPe7qn6#cZ1Dv4AoN~F z#EFE~j507A`9(i{0-;Cxs7={1!f__&4{-9O#SFb*AH98G7&1 z35%ax)%@Q*^BvQ}UM1%qwDh;U%LnA#{A>7@ZhfNNkBgKQu62fwjEBzZv#M$2j?kJ_ z5l8*bhu>?LW~0YlJ&*recxv$*#givJGHJ-<-NECvOG9f;I&JyZ8(+EgrOoZnKmXE} zt()K2^v=`oZ_I-jJCU-^r(lc}LS6TszxINRo+W*wCC5$9=+PNo)gu;LyYvJje&^oO zy-!(bn-eM-zPuzn_ljjD?=KJEw*0qqZ+rT;mT~J3{n7bl?_VxDtM~dtTL7K)mlwN? zy}YdTX=m{hWpnOuGM4pr%37O3)LJ&iBI1q7j0?Jla-8W#YaTX{cSh(v70-xQ8hTGf zBa-hJ^nv#TAasM)wZSHg2g!Rjw za@SstbLhAzW-`Z_ylk2`dWu79GD4w$4H&f7=m7&4j~>wflF%Pq2+cNkc6b^-TCLWtU)Ru!C9TdXh&i_xdcv!7 zS#gj@gG*RDXxX{(Cq{>%pXUxN8XX=S8h!5ICk}=Fk6F^PxVXi+VN%!7O4VmRBlKSP zWh!x zq1Dw3YI5rv>P}6THRXXK4n?_i=Iny}f|2>73&sp~iYCA++fdb5w!jG;4lojnHY^xk zP*qSrY<5jSeg5nOqB2Bh)YLRr4?~bh)YK8EZfGn61SiVl7=8Ugd&K$rH}e{dS2jP7 zIv0YTt_yeuEE4!9b?m0fdl}qc-px5*Uv}1l#)bc(!(ZM*osS))gZOf$pvU%)6nvrJ zr3UxczkBNcaJUOJF8mK1{_;Il{b#1mC%#1R{({3+Umv7j!4&F8e_@FD%CYZsP&wSP z`}k_6Y5wh{>Kl|QCk|iLs}JI1nZo}Fg6;n*xED_t+l7 zu=WMVd@q=9&!>FT`#`~W*Z$xf?FC+crt8~7@or9y;VO)?yCtL|jz#RM^H)VW8X!hbIIG1f(y)&K95p_7d!J{Nt6btetZ z`;0;lvj$_I1NWtPpo_UZ6?Aai=fM3h9;d)hMv;OF^SKpZ;&W>a4Pw?T0GzAq$F(YB z9Q=X96r&cR^7(F#8qy1$57gJl^QbbYYBH}D+2h-2Jh86+5lxDVk%_>+T$a1_H& z&fW^DK62c!zg*`DsKJQ|M>YJ!un{=UfS+7=MuSHS{N!SQ;aCnoY`6Kp4mDbj<1B{1 z;1~!$x$vA751cpLN5t&U1i<)zZs0KmeqwP%6vNnogj?WGPMq)(_!H|-_yWZH6NbkP zPVNB0*TNqjtBAQR^fRM`G>F-LA7J+3A=DgB8pN!5674vM;6Tjw=K*ux5wm?OV6L+R zHF}I8X3eL7S@Rug3gH(Vh*`4(a1I6%4qR_}{2*pc4&c~9q#1`82M8Saf1qSwfHh|Q z31H_~VJJCPh*^W{BHIzO9YYYyhF@@C9y8&27#?O$#{tjMcEo%xx{@&we!+p5?SBBw zZ6RiRIofs15wpD(?Rvf-X8QubIk>36aW?$KG+quk^ANPscxFA0pDb-h%=QNW^V~tq z_QwF{@=<&wP}{^0vT@j%S=yaG5&+Yz%Jua6m%;1?W-+5SG@ zjLB$q9K>wzjrlEBW(P6b@&5$kIE(-s8%7$uM#S<7Pc$^s5Mz?zm=2ixg_!F+88G*2 z4&Y2(fS5JqfU`6~%=Svax$s;Uk6!S@xkk*IL!6pqO&PrVY~VsC5C6AB^S>6XnVT$c zs&1UEAGXYHOjcLS#(Mw^$O@)W2KXaH#D;o<>hb> zG|#DTfYU2d()#K|Q$<}v&FnLh4Ruv#B!ikIzfz~@z-jAF`cu)6OvU2{X3&j%Sz=mx6>mYdE>VMTLonfFZ2!7Mc;=EC1aHR>;BFK>i!4=SvK93)T; zH;Vt`|FiOVm;R4P9N&2Cz875U!Nvy+e|6wi0dW_i#{C-^_!OMdQm3b<60+_nU=jE! zR944X*PY(e&<{8~{8ME;;qQ8=%&e~hY`9+Y!S&q*BD21?pgz15Vtw#9BURsSaDrLi z%}_Q1e)!<}TmWW$`#=EDAFL1W3$P6N2k>Lohil&+@WTh!_YN4$`UXOM`+yDW>!!=F zzH^~6v%ZhPwibT);QG!6ky+p2P~R31VSSh@_U~c9W__(d^p+G#@P3Gn`{0jRUsrI3 z{lo1h*N68#W_`H#zf0GFf4DyUKcvk1;!q#9f&RhEL8`B0zULaO?(41Y%HzxtBr91FT~rJ!G|8v+0^ zAM0_j8wZ!cOA0uz>bVGYL9a2C!U^VU3_T%GSO>-h53cV|&=2lA+IK*GZO}<99}Pd) zUkHISbQnA#HV%44feeJ{H^0VkX#Qxe-t}t?OQA7rkLGVSjB8;34?jp74}IYSpQ9Br zQGdgZpF_a)X2aV@;KM!N6<=I#{TEia9P!1hzOK4DuPp7F<8xrAWIB|>_(~mdNX6U~ z^TrM43x9TX9ieA0-uv7z$3f%2zpfAdsADw){TJK91IMB{{!te+{&8NK;~)Eh2l|5t z*N1z3bNqJzFN7Z~$Fa}jKiSYw*N}RJZP%}{6%-sgie|*F$A9PX)E)}mKL~>dN}RmQyB6WAVoO@^ zJUr{c=x^t&TK4^JH5b9FI?=-2$~tawx<}LXp}o31-+#-X&677xdwTlD(31sA^Uhxj zPr$ub2r^#%uIO(ohhK1WVNnuZP1wG^X|1z(gYlZk6Kj_r3c~=rgx4=_TozhmvRhNH zXY7Y(FDz@h8D5w8?VOD0_q(lMwALwW=>})8Q`UBe!Z?8bhk};$&IFqWUI$d7-W%J{Ovp5319etKb!gcp_fWTwP68@06luxFx7FWPYTjR`DfH{cC#uVu;Z{XQnO$v!*e9F(QVdqnjA`&Pk4mT>Hh7N%H*YYW z%IX>#AcfV7bhnCVROp&%X!vWy?!+O~r#Do=;DP>Ez^hDt$&6%E69xwzgX}d|H$(1W z#LP?9CL0n>aI)@p$@o%BLU4rQO$+wXAsKdMZgWLNvH{cHR96>otbsv{O7f+t&QRi@ zgFE4!OqrZG4zbjTL1(>_%9N)yiu)- zkES^2AU8m0>S|~}FI;%Sy)diA8G9FQ2F#3 zMe#`|@c9tB%H+aanuWTR<7-o+3^N{2)}|KHMD@Hnm~53b?2t}7%J8M$)9V^wA}4AO zZh~bmo~)^FTBManS1m|l?r50!^yPK1`lw3?jsP_k^jZ)vPp#o8-%{5Zz5wOKlX>&< z;+2WUN(jtQ!&}%f&aHx}ffJWHzsro49s{Yc&KXrYb5T94B~>uv;lU9!4woQUzo4r) zG<54U9uu|klJUh5Z=4J2+~3zeu4_XB7d2Ih%#VH%om$`ti4kr}z*V7vrZbfu1J+ay zaSSvYxz4VutzHzz@qsI3$@q8zW?^b545k`NgEA;HjzRqYpKz=NS6Wz5WN*-Q-U$3I zx3M0t<7Qxts;Gx0)zww7Z77SU7T)wAO`9}hCY8hGBp^!1*V=|DhPS+`5jRS(g@Wv$ zAvHdX3(Nm_sieUP{j6(l!aY~O1qwPie#Wo@i0khdh*~*8Z}WV6JU!>kz!>wcu?#O5 zUSp->O3W+2s>xip*s1>uLuUMpk-xWhC_KKFS5L!1{F-&#v%d2n$0^8Mi6Rt?y5#>FeYafG&+C@#cR>td^;0ZWf zHesQ{3o(pHbe2bUOF05Get=EEix-|!Puh1x0OskIe# z|C94~Id6CAL0Ph)sj33E^-15N_j26Azubt?nKSC(zE2G{+Be3_o7MhBZ@~4&GohA1Is>m!S_>Cc+*PQEtNmhC)1o*m zE^sHO?{=!I<~AhYmXS`yD0th?cwK7SNcEX2<1)4r8HRMgFdY0|L=fH-b9}ZA-%GwYm5rP@^+r#uP|dQCw}uU=y6EuY}8# z=f1iqruN5q@tF;9wO89?xI;@e=<_j1-ra@uE}k0O<#mE&zM-j8Qv-YS1ax|8(RjXR z&>g^SJZ=Bc05^TOYs7nFfJxXVmK&bJqEQRmTiW}Vt0`O#`;&Odu@h49;FikjnybrI zxKj%e3^$na@Q5MaxCkB~Kt*M7^{`5x47={>(~ee+!+phqs&besAjc_=zNuTrq^B*b zuENF7TTjq0_8M;O;pPcXB^liM!(|vlt)?K{*I-$~|BL}2Dd_sgQ{}1ZpqKDqAz6z) zH74OEumSe!utnx)A-EQS#&;1$J-(yTbGc|r=`bVh&90-YN8tY@cT~#|8!(&?7+Bz zApp0F6;;qZwZrEXpK=PT`HX3kbaXL5=mQQpIs=|Acwse0Zex62ovNq~uaRZdb$E@W z*-+Y0SB7ti#mg~0>ltrct>DsJ4#A#}&&DVedikM~hrk|%rc8WV^7I*4PhIWIs zGu4d^EO@HR@QN_GF%4F@`Z{PFcC|Qt@J2VDOf<8p=<{ z3t6J93^pVBxd1<)fu`Z1B<^I?69IFo@8ZP9`BnAxaNf{(b+Q6CcXhS;83eb>nc&H! zRvK&u26s(W?a-RU!uVXgTTe7p`6iK<#MA>q?KWonMPHoW?v{ zTT^R~swL% zEB5JdC8K`eqcnJ%1v~+w(TY)^ew6dc#+IF@1gv8-)cQD4Esu~6*cN+{)}1Y$Ic0`k znd3FhFgIYRzy%V6M$4*smDlGK1>Hr_2v^e%X9f-91iP%ygp~z{KF(?HVyiala9fGH zc9qre$iqPHlObU_QglZRSd_ zRA0XEtu-(Rp*VpVr`o-%7d=ArnujF@FVOnQRCQh5{6_us4zF)|{pTgy@WsCtr-oKl zEnUX354g9Xh1;B|u$WgR;YtpPOodflqN{58!4Sk930&*o!75yl)oiER8FemS!+5yn zs%INKVANB`YFgQ0@KiK6G~tbqF2>Io@RHnEsYWO)+U2kwn4N?DL|J7+9qi~D{aY~H z?!l8Mc=nGGUIcGnq6Or4x#IOV(EwXis6efcx(c{B>N`;=!10`0fv>Bio;Dd1ar~s> zpe+^D;O!UbQj*#t`L4V$8Pq2;AkYxzimG|dw9=+JLmN2w4I3;-6!wvX&a9F7V|IG~ ziJSFZJg(DqOi$f`9}E3~q1H?*7PoHp({x!6 z*+Lk5v&&!$2)&+-m2++8rpjFC^{t71rUK(A2Y0M6>b2OU@FIy>Ja0Q)L z3vbbb<+L$g3@?iTTlU}Z>+^SZzpo|sr@&fJ3=g67&-b{dtuX~9vNf7f`$sX*@nx@TzCs3-@z4?%z&vqN#DNVZlpR{JFltI z@fWB|UzK|GHn5zE)ZVaY`Xv8@2-C_91=KfV+A#3sShxbgC03Q64zJy&9@4;&gclq2 zYmM-lNpl&#SnVhq+(Tm#4syJ)fb-P==1Z7e-K~8@3C26JL(6Wy78iCMraV zx`=7#`&#ZaIavg4!$P5D^xO_#2!^}GRGa=YigD`z%bl)|-L`IxwXfsoHA(LUN#!b?^B56D|PF3Ng1e^;PFb!}c4cALp_EjRCag*S^uJ|GrTweUc zEPi?=z9!4Be5pP|oY*CGXO6Fhc~$K4i9@O}ShewamRf!|@IL1-H}I?$UU;V$&Adk7 z)SxMYJ3HD|!3(%%JJe5jem1We?~T0l8>!!1TixMR!(>b_T_8M^q1QqBX;59WvvKrj|^Z z5;XUW63%)0{2M>s_67!ie!{n84oQvoR=`SWJR#Ey>-dR9@UI{rMiIA4t3>K;583$E z3#BSOcFIYh!z_B6Yj0npV+UK|nkx0y0!Ryv1-45HF6+mC`jr~JK7jW)`{u%X!o`Uck8Ez_5O`!$ z4pX}h-g2(|Q&&>8jN{Wr^K879;4r1ZO;Z$tqGn#PTGBC=Mwazeou`#vo%qAOx$*J1 zrohDk_M>S%#&yEhRi=?#lzRs76{)1fdiI51mGM!UahV??9{zm`V=D7E*DT;8QcljUnraiPi<2J zn{UeXaP`J7gaaR3!2+*tL(P*Wsf&MVFvhb>^guC3?O?||#hM{ggaHf~b1;^sOvSAU z_Fj!+9KmW3(X7EMO>G=Csdb4?m;vvepoe$JaYut^HaAsO!=q5x(!pCyV1rNvYrgU3 zg+|>Pp5kp31NN1MPTy^zBe1Be*P@S_a`w zQ2GTtyjg<15#2K3f<;24!P}tV zfeJi%aGA1MP@@xv zuN(N^<9{RYzY+M~2>fpZ{x3z~|KZP>;OA=jz|WZ&6wG0#FMM{6K2w0Iu!El+#^cN| ze%_#a>N5~zjVgT(5%?WVeNN*Qs5k_llJnQUo6=vK(i3kIe5S$s!G|wyf)8Cm^H5he zb^ctVJPaRbJ0Hq3jq<0Ba_rAKgO7wy9o!0f{EPim7dzdmpdpI-p}6$0n> zj{*PivvB>jz8w6!6gc;11^9PAaE`}=;NOS957zoO0rvnK`-1~)B=9-9d@J~KIq(BD z?*M-u0FIx7!+87z{=5pjQ1f2E`#_rmH9rLW8v}ft=Es76e+G^*$MYKjZ-O80-;Ge$ zx4;MK@~6SSec>E#?{n~PG;sF+3Gi<=@PS(YEckb>!9N6lZUY|I<-dSG{{r4$^S;18 z1J3P_1>75K9FJ4Lmm`56t@Rgyf6IX5XJXO+d%(Yqz}cTy!M`tn^Y~f^{&fQ%4%hkz zz`qjUgEW5u@O=2;{(TDPUH}}w&I0QX0ly76*LM*3_Y`oB=OplNH>h*4)-MGA@_|p# z{95o2zax2~<{QAj$AEKxuLS=-1757lZvdPNHvC*5w*LsUl>}a-`ODzXt-v|nUxGiI zfpffKz`p}NUh7AIe}{Ib&tYPHW#Hdz;FERvdEnpQfDhLE4)E_K;N0IOP**2#{7M)+ zeH{JS4` zu`X`_|9%2KQ1dImzy07tw%MB3fPW>x>9efeoYTR-KLTfcEBJQ~aQsXr`u{iZ?;7Cv zbrZ;+1pi(Iez4{rgFicr^6tP#!RKA^vu>y#1O8P4$FGDyj-Tzk3HTt*7lVJ#0O$H< zVf=s}q|4`me|_LXy?p+k!M{@AobSuPzZJj>wf;`>E$Af>b0?*O|elYkq894W+5d1q2 zIQw%F__qQ02(3R0{QC|#kJokJU*6u1`VJi&f9>GU8Nk`U?;w6R0O$GpEco|0a6bQ4 z@aHGsT>pQ-pWJ;se|7_YD)3`;`*HB^e&F1{V(_o~zWkZ%ZcZimR|tH()?W$!oeO-N z=6?tOo&r8m^LN3&-C^_5U-JjRzoEc6J{!QlM&NN>{yO-x3i#2Qe*^x!0lYx-9>9CT z#eRt9L&3jMzXY2AM;NOJ?zZLvjZ=Amw{CnFt{|4}{J1ia}_4#*ze@6k& z*L)-RR|kBW=5K>P{{Vih=0AWxJ@@n0`%K`60*4`@#>VO}p`6b|A zEAWFgzaRX25co{ZSAu^%AlVRNRo@lh-$3AT&F=>PijDG3;NPEs!;n(?_rRY<;M`sm z_+`Kk)#Zc1zh{9TqWLWF?+4)HHOJ5BkAca>`B($~%?A!cOx1rn__qXjT=T`?-;Kb> zYJN5N_ZDz&e?9p33-E!ud<*zQ{9@pTIn>^G@b4Mmod0>?-w(hi z{2%V#1+a?h+8>@tazY5N11CU807DXDj7iE#LI4Yx#3Y0WNHHLymB#@D1q?4At=fd- zL=xTv5RrOgc&La}38GT91ObstDRL3fS_;%>uUfQ<)NAqk{btXanKJ~n?f3t_fA30W z&Tp-~_S%oxvu9@SJ!{PHMabVkBsRq4Cn0}T;N^JEK>nJ*Cz|0wj{N0; zA7F;xfc)J9ez3`xBY)3IVJ+ z@X|jFLjHaY9wv?QPelGsf|vHwANl(Nywpbl^4ATF*uM$+%L89v#-E4$@!PjjKTABC z_P9g;nFvk$9e9{D(u+WT{t8~sKl=YmMP%t;>HF#?@K7=I@yMlBfEWAG$lqo#elt7? z`Fj)mAd?@6{KX)%sU|-<672)Lq&Lf>X|uuSnc*vuzh}Tp`))@54uD6KFw%by`TGdG zq~98R2N)Or6!Oy-yc~}|BR}IEeCYF1wCnk)t&4B(;=S5$kq;8@C!GEc*}mz|@N))& z=vR#X3UMj52)6;6?Q7EX0{}fCh9_Y2qRb?gDGv2PBIYq6v25|CoLJoC2 zElI?pQwkh!%85lj3OJ)3b|Ch@am*BmSaik$$D49ukxv5loy87BEb?+-uUW1N2d)A3 zeTE%~SoD_yr{n&Qv=$q`Ur2fyTO97gNW`MQ132E46N~(LV95`$$PZBd33ec2kskpT zABD$&rQV1|=LE3S8?new0cZHI1D(Mp^+qf@?*mJ{5sUl+u;i0iYxg2hNEZvRuiwq4zv)P{*VE+#l-6rUQYb5!mEhaE6iy6FBPUpe?;L1 z;{Q;1BQXV_$Fb>;8qgTS(Hj+Jd(by1yn~pLK+j{-HyKcSk$AJhyNMrDcrP&xgV-MQ zCk&{4Ow1DkbQYWb69XDP4fT-01m4fdB3aM-bzFh7?82&H!ZiPQrZv ziQ_wZ0stt6xR=7Q#EA;i7oMJ^Z~}3%!tBplKbAE>pNW@o0q;h{q_LOnigFyl2qIDx6Myqr!cN$0?jce3QcciEmbTAn{KX&Lh4> zVUGFfYZRVGyjo%259>UMK^4R?3Re?%QFtLSZy-R6iDMOBPTWo5Rm5=$uO*IGxPiD{ z;f=&A6@Hv}g~D5jmn-}<@iK*X5c2{8dY*WR!Y>lDLjvt4UZn6|;yQ&75!Whwgm|IC z$A}+L_ylo{!tW3V6+T5=t?;|VRSJJdyg=cPi7OR8OI)GwdE#Fv{0;Fmg|%?t=?e26 zQNK;$DB{}{Zc98vVcxUoGZl^@o~3Yi;yV;hATC#!<0$%Ug;R;=D4b3_SK&Uy^Aye@ zp099!;yV={NPL&VdBk@sJdF4rh0BP4rZAtc^q(tyGx5C&&m+E1;k$|NSD1VKsKOD% zFDM*E{FcIPiFYaNC4O6BHckE43bP67zgL)Dv;LyO3B>OxoJ{@>&`ZX=TYZZ3g1iow8F;qipNY@0e*={AueF2O}};8KW_O_u|iC%oZc}<1Hh`ei(J8m z`lg#Z3(J1!_LWZRln=FwywhbGo@_Jy0|uB*Z8L4;?{5ih`b&_;g0CA3jiA6sZcTQ;D-RW=Lx`&-aP{(hFwM*dt&Xd{1LOK2m1 zjwQ5_Kid-8$e(2iZRGb`LK|iEv4u9YWdr(IWwVgKzXfgN?`H{ZG{8^UJMt;8~v{6ZwYOb)yEdv(3TD8Du-kfNAwm0(`Ftv(zL798i`K8 z%n!rbVq;vVy&2&9U=tF1*$_DGZFJc4m|?W{F*c{Y_24`3iiARWd2&2 zVYGKeYh^DBnA8YcTlny25>0dCtv`Ro{;)K)1`Z;Fm==kT7tVCg=40Fs2{K(C7KSn1 zo3T0V9mv2s0SZhKdpCf0+B=U2M~*$v9_@%d+GcdA+x0(c*++6TlpM*}5fGOoVH}#l zaV$54+`;e=i*e{7g40Jb+aHPfBZ<920I565OJFadg9_&{WjVaqZVk+Icu4+!AIZ3- z>hnW=B;TE{(#t_QoDs`J?(oG!e92IJ_}()+@_6F0l%u6bMjRe>2;cFmO{>Kh0Hgfl z0u`I_9YoC=&^Ge7ZNR%x^Au;oSMh_e^+5$J!|!m^@MhzCnzlFM(%@!W<8-jNG3RHBNNM3mWAE;`OrzFMetD^wkK?F*#58sVF%Okp}rh#tY+IwtJ6>CPiZX5 zD&A8(Y6!d`pRK>4MyoHY(X;1m)+R;zP6W036G8o>Wld)u)SAB7q@D33Mq~$SG+)^R zTGL&RYuO)m)qP_g&>JI~{daXXHHX{3jaJ@dPwr$bk6~(VDOG<7Xk(7chxi%^(CA> zDdi(?zbNgrZ*+`Szv?Uf{)nO_zBOO!!Kz^8>&tvyzS4cychz2BQokx!3of{?I{U5& zJ$uNlT6WD^ZOy8vJvZ-Jy!*uNwCc(;zVO!VS{HRL*;3`}*%#pl^rqk*y=t3BJC+|+ zP*@OGGq#|6L3YG`z3;N7SKrjT?;g85{PN=SRhLJe?-kj5*%Ql>623T}l=$xXfOn_n zTkX>Vr^0o;RBsqCJMv`WJ1K9Mo)~d_)Uh!~!}eG1*;$7#H`b-q*0&CJLCXkpetR`3 zd1yC(5lR_@QpO~uVoPfs6Ii}Q^W*!i_EGi}ZD{jE7rnth8sFZ0W1QAJ#kXdc_FUw* z+We)@MQW|!Yy0d+OJ^>rU%g9z9kp_mHgUmEmJDCQLY7A=NI2?NTm&bK5|mo(XxUYx8ImJZsoXMXp4Hs#KS3vN)L`W zFlzspz2o-i*M`6PCB7;YZ0idTMhsfizE!s8L#-+5Pg+cVRZ@{w^{XhYYGaA^lIOW7 ztZZ2rr8O6XANFVge2Jp|{tKG#+i$h{KVGN#9^9+@R_)h)Zxm|vZx*AKyrMVV@s*xE zeWTX&(Sut14ollNMV!#rJ+eNpYD=LOzNNhuzG;M3{2$@T9kizXf76-@d+WY8uh9x3 zdM#_Z<_5j#y03NLEh9AFo3OrmuU`M)etkv7iUmGep7ox#Z`tU@?b~O!I-tir5_8Si zYr=cC*Q%07Xpb)Seetc)))_e8(d6`Zt#8Nw^wq(B9XQ^e*}a43hfZT&5+3 zjnOuQZN~S1r)nF*k0V|OJqay#Lqv_1g>AJ@Qxm>Ww-jhR)wWw;d?z=(DUfBB<(BB(<-pMNZ-5$J=XG_Xa#Qv$60>X!&6$r z=FrYf$XWKzeOlJ)rn+@`nKgPtW?hqKjILz)#Yw3z;4F9|CUEK?W{m1v*LHpB+N0IJ z&V|~j)%l*o!IYY+{b;>IBGCfT5-Z+7>H+U&S4(V;YmV?l1Ww(gvjyu7N2{6V&FjL8 z+Gth#*zz;b@}Ix9tJJ%sedjn&=zM3z;y{~iN)DFxAH={Sxi$ilZB6u`7$|_lY zOn#gE)`3%tFv{%<-qUqZ@iRs2ZMN5VTKVq$3O3&}Y@Rc0z5$!G*yt+lG_ASFDtl3A z&l7gj=hw3Lxwy>_uHIF>vo5PPvu;am*#3G?unYUJqgLMZ=Cno4MGjy74dI(=WA)S7 z!7K1B-(c6KV403qi5jq4C29bDDy|Nt>l)W3qQ8wc`djI3gAtzSfOoV`J3-^>KH?#t zr?#unFBeB>9=l)mqIF(7F64U7_Iat+Ik@(!>MgZZX~CGP4$py28AzFO8@l{d+z8&l|PyeYG+5tA4C4jsET8 zLACAMTpSzLIwuB8t@_G-?>4<@$~tZM61~~?Mm4Wi$I+vWS)}=HSftnAP{(gWoSnHO zdm6sLJ*H0oWNFif@1s|%(>}o+#;fSN>-3q+e!8sw!D{`J#f=gBmet2B(zECPT1)g4 zEvb*G)0^(xr8P$GTiW#HF6~Toqo?V;U0Txzt@P}vo%QOP?3UY9=+`R7>?y9@Q~PptR$W?k zZp|*sx_)}WxJ0C9e@naWfyCfJoCU{gMmf&e#2Z%LP*;;^-QzjG4YAVr;)Jse7gz78 z9=veZ1Gx|2+w!$XZ`?B$=f>{DJ(+tei|k{fH`_fN+YZj~-S}MED&7UKKMi{NF8#?8 zexEvs_QCJP%Xu^aeVpE`zC)c>Ez)|A)-5r}?@#CJa;LkX0^h~{J-!Q`oRnOdjPHUc zCnfaijqiddC8g&lC8hl&DJgYgQc}w7B!nj+JSi#R(WIozXL@ZxU)K+hWX`XG>qT5A z$ghYz*ABl++G+i8L+^`-(4NDCNqt?k=8HaczF!;2+O*O1;bAAzj>LKDBRo;F4rLzB zJf3niRabZ7l4pL?LsHosEEt13C*%9!65hDzwpCGiT|C(}Td=09wkYeE{gsfk+JLtR zXFKlFD>iBYEI-QjJgG|#|Gc^%Z1GDYx2+MYe_qoM&uBg@4!-Td?s-*d9&KTMczUF^ zxFGz>R@%B&ah`Ra=kT~yzqqZoW&Lv~NByEU+O~)J=7BFdS{uABRSylO8zvz_^7+7fPN3czNM*?NjvpBJm7eSw?AUY<}_f(IPb@)|b>%bsj$} z%uz2QbJyK>)tlbn)@JP`jve^Ey%|o2ALt959+VTIXw$Z7q zv4ykh;?~irOtp_jR~=UVQ}z1kCF-@l8nqg1XVq$oqgM6PtgqF$FSP5_c@C-Yi|bQA z{kZ0ApZe+0v#iCQ>2&HpaNZS+_IT1xbZnP3I^UCa9KBw|#G;jD((?tpPa)58F3M59 zr8*3;J}*LF8F^+n;>5Nq4tVz&-!QtONVN2!dINf~7SDCj3GEk3gH;L5$>HeBtCI7R z!>`bjtFCBH3Qwy{s!GdG3cpfMs=Bf{F+9C8u_`@3F+4+0tjcKag=;|X1r=$v`YF93 z0blRAJ_BwqGJ0oEPDtuK8D0bCUU5}|24{L2+-PVQE6gpQ0k=V>T0#O{X26fal&jzc zWcrMG8SuC;ogV%Sm#Or?lBv;A^_0n)=|)sDU4L*m=DX;^w;!#nnKHNg%-fc&y0uSL zl$-yqxc?u9ar`O|+d#(#Xb{K2WaBs($L^dP9+r)G__0Xz`Rk+@FtR!2{|tW1pVj+( zb>w@SZfw2pS6`;At9k5+>pSOs^>*g4K7;D~b#uB8Y`c2(wAR=E=y&athi-nh_cOPB z^5vFx@87U1@bdw2zdAblpGot7V;twPA|89@o5Nq<-)Ca(FM8at@q?mqPtF>0Ed68O zOJ81f>-J7Jy!6N6H>dse^50J0oc`BwFI~C$>m4_}cHN6vy*B-R)z=@5`=C?Yklap3 zKX~NFt%76XPnT|O{N_I=uHU!q+Y4>JE>8PmV3&uEjQnl(_PST+esyg_``7>4>4xOK zKl*Y>MfiZrpIrLIv9a@G&i>Cs$&VcvJ2&??&%}lefBx3enBLunF0J@%$g+OBM!z)k z@`;P5ytD5YzngSba_j33ZEV*!`}{j!PW|?Z?!ABg{Fr60{MVhE-@3j--T%B=l>5RH zfgPXi{m;3Jj=X;0v4U)SG~ROt(@5}eH=G3vHVYmX59JBtiv5f zbe;CwKQ6rf*BPVZugbpfH^q;w+zr*M zp}XSp%!!5x$%?NiSHBH2)bDPLeUna=sbB51`c3$|`pq-fgH70{_zF&DfEt#l-`!8B z-&5wA9>x9h`-2yDz5Mmz-#>No;Q59BjFoy{;!k<*jb6Tf+_$5qZ@KMftNUMn-F=U~ z`%3uH4Y7}Z+OXA0KcKB}zCw%>o*aPqbrHur0K_@7Dde_NajpL~7z zg}Wd+sgQVb9urSzI}MY&J8R7n!4wO+1oGN{g39gpsMGdUU$t)zIINp z=c3T6Z`&nSZZW_>0Q70^0LOXA)}{1oHqNq-|j!(Z|Zx0`}vG{NpmZv zYw!L?^7boR&o4Yydwapq+GkJy_tp-r_FP@GmhlM=1Tn9e)H8?v`PdiC?GUS82@ z(<_Y~AK#UdHt^v6>5u8}KC$tCHV#~V=$-AA#}?mv$MMwpN4IY58a^y%+k1@vuhQBN zlJ9MG_CkL5l>4u#e)`-$Y;His!8QZ65A**!^6R}1q+NbP@R9C+-u#!hswV~OceH)< z^!oem8l*KB?(4mE;xA(llwLg~_DtcTAN?u$twV2L?%n#-nKA!Ld}g+T_sfU2#XMT} zNpjPy-dV$+-#0ao`T4J#uB#f7+F|d=@*DpC&J}-LH{`PU`={g|JNEYLuYGh?w@phI z4Y|7E?4++4|LFY-r*;2R^1zZlUB)eY=WpNk_~_9S@9!A$mswvuw>EX^tfI;fmUsG9 z&L7@7bGF~uhp)(JdjH<=TZ_I<{NSVK`u&*k|5ZBtSl*!F6K4OY&_`S*l*5M$7DAB=J1~1rf}E2yhpo$$@EN1LGklk{2Uiw?wVt(=*~IzR?x`aR>j1iR)k^ z3?sEn?;S^YXnnQT-b6U50-KJvU8!G4fk7(1xx5>a)~@okG4$>FQhbgX8*h*s;bUBU zo{P7Shtjui>JZgooBgJ0rj5Z7{SH|FRWd@mzbZ zNbz~Xn)}3%QZcO zPc+KY;7FhO<@<<=x@j+gp8|$!-&nr=;Clc&%NJ#)$&xevZU?^ud@tzp!q4~&=X-LB zl>RM{Ir;Uj{6t5FhF7@syD&2bDSN3de!Gi5;^GTj>D}$%pF~<5Mu@^D`Ny&plT>;; zUHoPT--!4;|E2x{R@rGHUJK>ByZ9b1zNd@7%*7|T_+BnP(ZwgZ_+%H~+r_82_{&{< zs*AtE#b2pO-`5_cryqt_SPdp|9P|nke~dOrzYL#9AbuI%$x(mgGpx3%!g-v87=F?f zF4r1fL+Izh5p38WZrV>U!rN%#*zlOax6}4HBGCTbCeQnoPFhFf-7ltJj;#~CNX#Y! zQhaC4Z`x0VtP{Ltj5I=#ceL?NIDdFu6rz3m+O5i0;7Y%@i|480Td6D%bA2o+4x86( z_lXXiMr^iM_S?Qy*nx;8F0TpcrcNQS=(Atj)-C4Vs3% zk5dvLV$oqerSoI~t;6P9Yd`~w&PIqNKg&`6bn~FU1MH1f`tK5BjV|fWz!_%#JAqGc zYlscsCQ?^C9%8>3*o*mS5|59M837TC4$G3kMhu#SEdy&(NxYVOI~q{iMa%?2d$IX^ z1~jnPISP^Zs`!*RM(Lc#kLVMNep{49>V#P2S3xJPi;7Du^1;CIrkq&hCBR-@L_iU& ztF8*O9@66!&cu&5Ug7@4-4z~1%!>eM95!!H0~*f-lIO_~Nm|vw8OD>JSw9I%{{Vix zY>Xh*gTy74xTk=(!RmXU5iZ5Dn+|4!ia3?;vxn3V@wh)v2xEafuV3D#PZ zHe>VlF`(gl!soZK=P6>qM> zqktt3#FB?`)Hm}mi8?-|Pb@m+z}~(}&im4IHXP7W;;R&!8}-e! zc2MV+N}pJCc-Z7zAQm~RCY=Wp#3UsyvFH>4XAHs)RDvy?CkN;@Y+g0WU>rMd9;NVI zip`sEKy4c_4S_EgKZv;*^?c||;yetr?l=bGbvFP)ddWS0cEaFmyc^dm3va#r=K$JdA$=OVO<}3oS z=&;y6Hfj*D$Qe!Ivb?@Wumcf`j&U6S!w?%jl0|NG1~2+XJ(%r{SmbO!>1Eh~*u3J*SxjQl$pelz<-{Uq z{(T#;0}+dy#fxKQfQUuTEXJF1Vv$o6cLR1HXC1Om;!QcR=(B#}#$pE|7WpLLcvDU+ z@~OaaH)01O7CFz0cvDU+@;Sh9Ob|pY@;ia!O*yg1*8s~kmssSF0DFIm9f<8Yj+q4! zi_T`?cvDU+@@>Fz>@;=nRRp}FpJcs(GoLJ<%cEn9n`otn1Onp;MEb>C?PgnZH zA}^u7DJK^BZNNUWPaqcg9AGaSAn0D|Y_hTFEToQkTvj@Ch(%|eL#Kf{=6x)&=pnOP}VDZ>PTWX%6{L zU^$M&V&`Sx4D%uM0CmhZMl3q?Pb9~YSmdXG6be6iA8@Db>=A@`UVnx`Uc9FujDg;B`so!OP@iK z*1g1LS_`TFh>A-r`pcQR*6OaDdlE+AQt&KU}>wwBL5m#+A6Wgv0U5g zbBIMA1uT6IvB=v3OIsxtIepe<+@;FclR9SJh()Il<@HL3SmgbI<(L*y$Gndv7M)=Z zoiWrg+bXf>Orp-+%Kn|yG4E-KMdyC%m~C|-@m!_f;Ls-){l|gRP5rG7{ilI5?on}f z14~-O688YG#61KoX`P_H*;a`~|CB@jL+Y4ql~{DnQpaqo=N&r4qJyC~>pqZJsH>3EXHC6hJU`Vs-uS#X zV^5zOxHEI&ym@n`iQ!W|fyTX*U@e?Q0=NHUp1}^saWqLS6OEa3ucz!ewxx0hEnbYqaKYiBZ zDR;LJR6g&LLHLyBCBtBmtuZti*t%F4Xi13Z@O0LKHcYe}z|34S#QdUZ3-)kiol-Wz zOv6`|0W2p@1ctIDw zTZ_$UuMC;5Yr$T<87B|Fq`hfsY?Ss|W0Ud@L4KU}P9h+o1$zb1bC$O)#?TMJ4(;Jp zILqGO5Z7t%0xIKJ3--Q%%xUig?45#)_S!k@jev~Nr5zkaWgG-AB*$Z@%ii-aR1GEC z>wt}EvHs?`?5&S#x&CIl>a2uPZjO zR|@RRUncBvzEeo-6+z%EZ)zWmm9|s%x|v}-9)CgmrM)a{q`|0M^Y+W&8OH5ivm9do z1?cTIG}Mkdq=BYA(Yv>kI?q+8$`kQQm%UY&&`WaJ+j2* ze{L=p~2|hrQpq^qxjzszA69P8Wj=AICsa-acJg z&fgtwduU88m7~2&uMZkY1sjk_lGQr!#Ar?iJ>A2(hEatv{HNGS94f}J!*-B_wF5xX z=BSO*8`6Rvzp3K%aWn(hEjD|eA0)9i4;3PHLix=|w;bm%!&hKqk-XUO>Evm+&6s+J z>FG%MFG?^-VYScA$uVSEIr!kaK@*~XQ8cVr*Cj>T{;QQfOl$WdV+>W-%vAI*x+ZTv zFVBC*qwk^rjqrWJZx>XEJbd$f%?|Nsc8DX!CXb2{wgkQsp4EczIw9{-w=Jk_u1eYe ztv@obe6yArTu@Q(S^iaE_a?30)90%IeAXB|V$GaSk41Q+y}91g@D=SClJj^Q-J|_& zL50D6xS+x~E@3Q(H_xcIFkS~^fN@C)V;vKtJ%-`C(pS7~KXh#lj}-0O_i2hx7V~B}x)hV}jY5IOZyO_if+bUYe;1$S;&UDR>lP+x zr-kzEUA)(r&!c86Hm-G=M+Ov!jcc2l3{JvZS$!+7wVhC&|1rb!3?3IvP#hXA+bbzs z{TO__DQB3-d99RnGORbRL@$$A^+S=QAsUD{`w#F9_85$2O}Vv)0+)2Rqbz~<#m9EfF+H952|YjW5&y*}(f z3E0xj#+m{w@)mq;xA45qx0f@Aj2NAPNB#hwz-P?3b0!`_C(ps>>sxy8wR-aLw@#Ti zel8!HTX^yg)tZFQ+TSj^>S5JTFdTG$cl7eP6V-^rOyjxOvfJX*u{8`LkK{8ak2kz$ zD-*Ew-HAcn7~L=w|Dh+nQ>b?wR*U+hGrq=g5)0(^%kSv^N!eOZj`; zWv|R(kEf#8i-R$zz55ZCicLuJ*BMHTlV=932QvYf<#j&ieF@%aZ!`EjY(ir1ECfz_ z-+tqxVz^6go&) zp5i!;u_EYh^s%t%F*BovQ*qy=MM$i~;JLi1g~tnvhwdDjQra7S zg+kLgzGraluG-wXtms+dknlGCBkPJQxTh6s`ZBH^XbP&-<=X- ze~ppC7%PwP%T-;d=?(K|N4}c4FXffe=EEnCzH|KTw@;ire&*QwNB?}})5BY;r_cAn zR-mGlR#5lyqN^6=F3zgmR%@3ufUE76#eoS=z@K1S?M$8CAYMGOf4VL_+w)6oTk^8| zHfU+T^m)#92$XNql}){2VU*;0VU(xX_SeYTjEbT^6A2ICo}hBLuWxtlzRuY{pQ3w; zwp4Fu^{BQm>afFemVSC+RNJUoRxI+z9iC;#*LyyLmr${*V%XfMnt=98ZE8*1s9UUh z@&#kG?C5p*??3$hlEA5rx?TuRAk}u>qhQl{On2p_6|O6c9(wM^spF21E52#xO({38 zxjFKu=Y|i(5&pM+#ZH?dCo0-K?{lN@Yg4$!=duz@5bn6grO;!97hBK;l zADUh(!yd<^6e)hBuo$Uhe#Sa@b85@zPxvichKr0Nd*pLn_PAz8kqX}_tf|knJI?SJ z2S3Wf)M%}R^3g87t+7^@n$xiHzLtGGX&yG-*Z$Gq)Q6 zAMMBw!=2Yy@|7wo0De`pia_@c>un%JvBx2Di1kNz;#d$9x z_vn*>C2z!{KZ81^{v6nOiW$%#e23Ru1axt=;^-4ct= zMqpWUzlS;r*nx;e=OD0r*YPN@uNQV8V$pdUSai++iw?2q{Mn)Ng+qr}biQ%uaPY#H z2my##bfSSJt@gn3d=g9jB&AO*`svi^sN`9|@_s^p>hpkuh(*7caJVljqHtJ06b-(`HT#;NwHaBxwr|RmL=uQ(w(| zX1X4>+y;N>ye99?oYt);F)?__c}>Z>YwFT?@M(G4l4+p^$}xk=iAhPpG-Tc=UUH`L zpP4qBfn#WPRmQP~LuG9_WI_UY>Jpn>!6l!i4z-{+O^o3;%*3zaHv(Ip$={26X!bii zwV5A=v5R2e;!Kz4=R9meV$TnO)82=$R}C5M@%CKou`N68dBN~{BP8~+A#>WBfr58O zAnmbh6nk7-%II090j?Evm@_bWo?`s%W9t0^dXr7eABJ&TY5wBJpg&25OrAO<)+y?# z++eVy-VkB%D|#;gJD*i}d`V^(YU#~G1ZPsbesNtT?R3S)@_Mlu=i=l!lWzTiW6J{u z?N4Qx7ShqYEl-oLzIg@!0002ag;+ zeDu)qgKr-=xj(BG{_^v;)yn;FT3vSEK6+E%1iij)ua^DuXW!<5I&qR2Nof`Bso&xXa4u7iD3bCSi+oSQtcA1WyYIqS+@zl@%vcm??qwrKc z-@GsP!EWgN_|B0jWoybJZ#*}2YU%OP;%j$aJB1!xJ4PN(Jd|><^uUPyqxR<3Zm-=| zomTC9GVn$3b>uJ&9%XGGlzOw%tE>n1?DD471RdUv6OD3*YKzC$%3?viXD4NLj7>_f zj7>^g5u23St6Nfvzgtprez&B=pL9z~nAk0MQC3}M?UuTPp^3rDJ-*H{THu;veC`su1CqCGq&cF5t?zT@4r z1#93tdsDQ>Q@Q0K`tl86ydXL_Vl{p2O3fdAs4h6h;e!{?o2NZRNt?GsM5Cmll|tW# z-QfGM8+;#jgYUy`@O>By--ogAeHaVhhp{~_ItF9*jN8rUUHFn-TnhIoKcP6m8LRqr}a;K(LzRPZ2bxzh2ZS_u!7#!;!jbA%BpDd?vw zcl+8L)KaSHV}4Av!`JrdQSc&fdpm_^PVjcTTfik+$F_2DJ-g=B#(kS#IoLenk7>27r_{Ih%x+yI`Ae&Q zJSwyo8}Sxv!0o}4d{Tl(li4rvA^dn$V^AMbY58+)!Ar8?4fKb_4dS^!SeWwW<5B4x ziSe-9l2dwxy_8($^f2>>SQ0~T{>QE9r!Qga^yAh@ij6K+Q%*0@7uW9(u1lm@2_N^) z7TQt`z~^fV^>xXTGzSY?%6Cfe<-E+oM+(~y{rbk~=sE0C+Nh;?w*S^j96fbqOxaVq zJF7agrXL1mtCCx5O`g?Smg6i)S(TJftKpjl@Xo!mFl=bPzMvu@p=5aeHRB6M6%0v8 z9XTptP(s<9`BSb)xGF)rIH-8yjJYbz^sQ?9RBd?e$+4fEd2i#%!7p9+)!_9vP5#S? zgJFx$cP!adePQ~O<326eGQ6PcgolpZ;(PF&yx}z)e*Wc+W%H;1&>$le)d@2r++o;$` zX8-xdmlLZ>hebz!`%Jspt3GSq^t-uVdyM+w@UCdUiu_M>jnDl%`29XH!EpXF$e?Zs{nD*X$lHb?pxo@%y1 z;rafWqFBvurpGp{!;1~|IUgnA*Pp} z<2)plUN0lOzayOK-R9s!k4K#LD}>wB-NpBC@jYGqWiCF!#rJaYi7q}_n`S5VQ=jX6JK=As8O||~PVmMp z;{bgOzKiy?EC1I(PMQUIC$v|-&nLwEac!^=`R9efFZnVvJ&MWy*u`_az-M-V#4_&3 z_Uapk9f(-udBDEm*n#q}iM#|@#;ZpH`$k{~A{L#oz@jq=SagU*=QfAV3}9I&dZ$C5 zSoH6A=(8X8U56crSag;GOS)@;easYySaceIMdxu~$s4igJnhigNgXpSV$pfop>r5m z*4!Kema+O%z&>-*f>`3lQhq&lAYzdx0Hjh_jtjBqyi&*4?fz#QzL8Guq zTw>9gK)Kllh(&%c<=0{dA{IHDoR19{L@e@5U|D~|bY=Zbi367bOIpMdm&aPh?dMS6 ziydeoHj%FcmND%$4%`Ur8;u=^SZrmzP6FlEV+TsWCh}BZ zStpbZEcHn&I(d|v$AVboCBW&Ou>(!UCiOrpI(Gu6cfk(yGi>6QX8~{q8wF?~Hm^DN zv;|m>1+mykpnMp1pag6pXFkPWPZqHF<>B?!n}8iC51Yt~fzx|o2jVF${(8m{oARl^ zk_Tc*YZh?2IY%=GI3o!=5bsaKkI&r>%reUHA{IM!z+z`HaWZzGRoJ{K1~mLGNx!rn zB8j^ZSmJI4mh+lebaps&c2UPXuZcxxk3;7mb<8|i(>-; z5sS`M!11P>SmZp%eG{+)5sSPSI4*-yO(Pb0DR6gFPAqb^t2lNZAYze^0**K3#3CO9 z9B1D65R05u8E?voMLreSM@0~^$Y%kk_n}k`xX1ZzEIMqf@ur+u!@#*mssRWfu$aZMZS{yW_gK4zJ~gyoLJ zZZg||Gjgy4?ZzhUlUVc*0E>^O6Am3>(K+SNc^5b?7dsHK=zItqZ_0^9{yDI35_TYB zk$(*={;IwK&ghFBi1VS6Ph!#U0xZ6+`2LjW5Q|PGaJpGuuAz{85{nMkPDnn9Mb32% zl22lhbN*CpmQv?tl}}>P;eDCNiA7Fdtls`ge*$pa02_8E$D49uk>3q0=QXj&7gEj>7ep-bmB7-@iABB!SlT(U$k$QdZ0E!xe*{?C zIkCtassCe@F0sfrQ{R*mi+nq^LbVJE@IK=yr%SB z#3D}s_DxjzAr|>nl$&jpSmcEcIkCux0gJD+k-*YciAARjSlTMF$j1Up9*9LgiSmHT z8?ngw4yg1??GY^PjaYO#0mqxy7h;k31eWVHvB-HHl=ew1^2{IQ{& zm&?abnKf_D9ejmdy~%E`kGS}4>lUK7_};lJ3$XP=7FJA}I~VV#<4xi_rcULn=b|pl z5#~&>UPyNbecvJrd4bm~)c9FsB~d zj$*<7r1?|buf)UR_b(@DX{C&1`Qo)DM$t{NBdViDRB;1$%&}j=M@DRa1M}`FZ}~j~ zD^=swdPlXWSM9&!aFx%QGI@G{-)LiPPe(hO75JVs)KU5FgUfpTZVh$#$KN#_z8vtP z1y|KrHPO;*4aPg`d}ZBucinnPJ=<#K|I8vA^cgQ>dPUA+g8nmeXEIM-AUFRrZ|gZ1Ry=XZ}uti56q{6?=R~*J!zZ;CsAh_@YbA<5qaSN@K{-fk$d z{@P&^d(kd?^ex3OA+dK8^6jjbRhQ6v%%!*X5_%7~(p?WeiV2t`=`Jwi=b7?VKF#oH z&2pefRylb8=gi+m6vDinGGdCoDk!mhd4?2g4l({A$1Mgjsh2+>g3}&-Bbkq8Moh7H z0>Ei+B}PJ5>iiDRfj0(qz-NWS2dL|Ceb` zf^y7pPvNOUI))8(Qf@HVQE!Ma_!T|gZ#&n?9l`Nnf5ziM621K}CUr;oy|9;ugU;}w z*jUeAY%^xwF>kKprJnD5r>9@`4__xY84Zrh#rx|wSoO;K4g7HRmkI@S%24VAgPFe3&-$y=jcX(w{SJcm~sPTHw?r_2ON(HQh zs$EeuXmnu0PJC$`UsZoKMyq-?SqtBrqn(K?X!X|8##YVC{;)JD?Jaz3oPG>qncM-pBoi6e`x>{E&=azS`^ka zXEFiPx-~pRa*6)HhNT4N5@()SqBsq)!HEq?|rRa?o`nr@U_hg^Lbz~q^tq&Dy*y-wcZ!qM)yT5KUd!d>9#xD0q=~3ZHnGfUEg`M zc4oEDQ#l0j!Xziz!H2c*;W!6}Q5w)*((B);M$6Glohw4ght?Y<9g7{SHcuyYSTS@% zhZSf=dTG7q^iXH*ZD{}KP$hqTsB;~tv!+zIV@26%kuYcVk(EOw&$gwiu{rtMQGqdXG0OaB2t6WY!bkIAcm;k2QpKg;ot+ zd~EDBcPb~L$3e9@r$wa|T7PVJ)M=^ZQSPigRWiQkcVB1Uot{F5w{^7Xi)t~la)`ZN zl&76{nN1 z;&c+ewmmT%=PFr@j0fY$m7y)WrX7v#w5kdJr!4-FupmQ4IRbjiMq+# z_pPm5_FKF7HZH!MVgC`!p5hB!yg5V+X**Z^4o3X7mcHT}Ts+6<6shoy!eYGz%lEj8 z-|FI@cJVtMd}#f5H0%wt!WDl&Znp7u2h*G63hypAjR)*yP(K)UR`e|BQ(_>_6`crypr&_~S0V#!(C8WUMcMC;=8!`t}ect_7k%%c#d%W(W9pA zM1%Ke_nGz!4ZfB2t}4$t`ds;&sm~wgbC9XeXSPmQPx!i3*DCxLDuT9P>xB012sYx& znDQPYyo2U3?G>Po_`RqljtETe&n~{n#XkTYA)_8$;hkK39~Y0ud4p=O=l7}ByTTbL z@3``LTGp=^ay$=_ShwN>hKE|dv&1@*_d@w>FYkr&IaJ-se12PY%T>aa$=Di zWx==riG9156$47dmd?U~O0Y>>Vu@SfkQ0l1A+W6BSWawSG}ZuTaKRvGJvLeY(FmNu ziU)1RCYbF`Fw2;3cAm_G*IausjyM53&@^l!pW(oF155oAJM-zIVG#2ya^_jqg{%ek znGfH@qSN5eVLnBNSah~Kbanv8u~I?AqVqg(yeTIZ`EFpbNi6aMz>>Fj96H3J^R7eZ zV}}m0=zQVO@!~x3u~I?Aq7w@&YgrPg!@&X&vFM}%$CWBMvB>$3ZoDZc7CFz^ICI?< zvB-0%Z_0^9J`h;e`Vfn}5Lk}&2x4<>N*QoQipme?kL9=%OI*G`D&NjpM;-HgAr_sd zsdI(0^D=eJc0w#V`+?KV^(9BBW404w(K+GJ;oPd|5Q`4`MX__ip+hV>kzuw@7hthN zEIK_MIynv2A;^SBd>&KQTz&D1fEJF)0Y1@@+?`r$fOsY7DXSxTLBrL&GW zRpCc~UHtdRsY;#G(`H&`Eaa5Q`44V`3*0 zSk@d6i%u4>tT`YSIp-TBU1E_J0*lR?9XiCKGufeYFLliJLo7Pg)G^oSET)dxeuzbf z_g!-Ah(*pZemQo;B41B^^B56}yn*_roLJ?NNSv&6@`(E=+!jCSeHG@tRyr@*AYNMq8`oA-o&dRgkB&`5a2c@A94IH2 zJl_l~cBWBh1a=@|(YZFUG*jm59W$sh-)Ri(j=yutoas|r^g*w}@fQCbbLNdNpFe5F z^uYK_xT{yH(`UL>tyKc_$Y!`Y#9TAJ#dF>~(tSySfSb;q3B$4|Nk^Zw)K-7$Xt zEI5>#rRKE1a|waUfSF0>Dgq`9L$q!q=sm5}_SkZwQsRxN}s4{$knu(Vp7pO>R|k+%jb+QoC`5=YfiVB(Cx{26dj?>MOA z16W=#{ZfAGLu%KUBggc!A#7>t`Qim3R_!}H<(Z2u3davGy8in7Aw}b_xo*VuW%(n@ z#uwaJR&>2JPhB{EOaPVns4gv8!42%Pr1a8QefHRca@#?2EqWJiG{@8*HCiWn}AAQkH$!Q ze6*ANF|SU0_d};fjNw=8MVWE(%&>280jdV3Js&o)w-ym-PvS-3;0uP>2;=VyF1^T0 z=>4Y|$GjYBQP7)A112#oZX2-Uuh0xOItNME&jE10luHoxh6saS(R+n@4xfe8~~=5 zgN>sDUBLMwFE#t<^o?Qo#i;FQ%?dqKG^mUt^M{vV{_rx) zAND|a4}|x?{9zBwANEMA4lfFZzf?vKirZ>SN{}+@HHveXM*Z#{_Y`XSF>U9ftXf}P zv4$Ehwdb+|-qCtgNkAK|KdNRni%+h$k5ad51Kufm$D)(gyy~!$Ep>qkdQQZQlHrkJ zix!nPEYDk5R+zRsb5GXZ-2L9D6-6DdwP*FBO41I}j;~E#addECEaxWZ#pP(txCiVR z3eNo@_n7%x4bO_O9;xMxS(6@{6J^gqm6Qa$t2w(;8=cp$jTY7~8ht`^v?jhH9~$1f z&8DGkOVXBL&ZJ_K<~MS=ySRRSH|>_y^=&Kl%I37iunn|jvG2xi+Cp#WjMhT0bH;R` zH@~>iD!YDqMbXny_U!jU@79pn)P>&G#WLe$&%2bAOgHCI7kbY)Y&qrcUqYT9^@TO} zwWWHYSFE;!U!0@C$(hcT|F_^)f01FJu%nS6LVcXFxS-sb6q_!*VO}aUEML) zm9U^<%Iu^Rc$!JBj7>^}r)&2hC60Es?d`$Kfd_3jQ8i znlW_GRYyDKpB*!Sn3*osrRJle=4l75I!>$puGwh2wP7YO7PS+L+KEN&#G-b(qISC8 zi2h{3f~u;2=UFmMyWVjz;XK*hMxQRbaKp!+a9oiS8s19Vg!uPb3awn>t&Q-XS>cLb z;Ns1pP)Jp{eLtZ1I+y-Z7r)ZQuXXUD`E6t5r`#&D;_dt>-cDcfPh0jBzr)49>*D!t ziz20OkM+0F-jp!>hT+bQ^~W(Pr+$g(U>?H=ck$y~{B172+{O2F*q?1;{^+<Cl)!=m3b*+EQvS!phRr)4m6)n zeCD_nvBWj_E(eVAhFXwok!E{g}tXSwHg}I_x`TKCA*bqZ4)@_K9*_h^1VsfW`iL zhYqpmJWd@ScA#z8GI&5hJFrRIBfwJs#1i)%>X>tE=cto|9f(+TE&z+2NVHd(hieO* z(Usa5{{$A_y~GkXnfl$7P8M*SITlGQI=R5{rkq&hS5ZG##U&Q`VCtK4Vv!qjE#?E3 zG1t;v#pV1;dJl!C0cV&OsC$9sTq71c3n}lX^od2j99YI@*HVWK7DOyM4Gx{hsbjWn zV$s=2xfz#O*anv!79kJ+4quh*3Eb?+-u|Eem z&Ybfj7M(kR<4rlS$k{K6O=6MrzC~=Vb?6X_PJ=^-=ey55F2tg0Y5V})?evUmc@9#)C>c`qk6rPiAJ>EwPiQX#^@SZTw4A_bR?pR=6)}3Sf?0cQ| z3J~7bjKd$XmjU3kx7T6MIksPhI8J*bz%QmDlf>S2;GOo~fj!=TF@GFpWf=3p+g_)= zx5013CM5P!AaL575UswyN_)<+{fow?VVw8G*qr&h%M98U3&DF)RNvVGfp2y24zBT zvVz8*X>ki;$6uk9Jg5$mFn*U2)le=$)N5(1dlU5>W8KTq?pa2bmn8NkBGb-%zXN+m zkO0GZ4QCug)n-l(8S4Jtv2K5EcE4O>u>1SRx*Kp2VtVSFOVzFecVB0WuF^NMN5=Uw zS4ZXJJ)fcl74-g^l!z^v-&s`S&0LS(HovmDBu{TXl>hh6-HQ1(OPxnN%x+)3IDdgP zE~Ph!S8W;R(;L1EmE=iiRH5G7Hm_>mYOTg&%LF}Bg!SFm0E=DKP@aAwuJ^%Bl@LT46y?5#D)dFZnFl ztv3q};Gs`%Fv4R*c5%3wqM=t|)%V4EhMjhow!`q?HTtv&JZI_cKD>7{N)~=a9em%n);RYWUc6ch zl;`T9KGionJmBl6)3s!HWS9Pe@7BQ*Y*Y;mYK)&9@tRienGkNzKp7ecVLxK`41tQ) z+UAE!gPVil#U8xv$+wUCE=|(*X&z5td0#!e2yYnfi_n4*8B3D1jhZJSuskOuXJVH= z+$BHmug>WWs=OC}eNJ!YSshbUxyRj>oi(<_?71s;697MeUcx?38&D3+aXBcJ#-vHgv_-V^OsY+paxA`cOTmAmbF#2b`Giu_7| z>SygMs5(1Eda)OOy;*&8Z+l&4^_F1R-mv{)2U0`67?-LwIz8$)Z^2jntg@nR@$J2{ zXptim%T|_!-T3)X`pW0~S&2oT%&)KZoYk8PiuC4G?Py3FN_EV0Njn{0*jF1hbY#)+ zLVs=_?fQ~@KX+MKImS=lT>fPDH@Lq3EOOE>@cze}r#Rk!$C#M+W`gvh=-V#E~6K$l=vMN%1PhruYvVImg_$xy4-_{5p=m@8Ng^TC-og!s#tgxp2 zsV;t=gAdJrTUY+u8|g<|jacyY-xybZySVb(MQb0D-&j|EmA;){#oO&k@x@m9iXZ9VL-P~s%1@jtKXIBTBtP9< z`BD0IeiU!#NAY%k6mRDz&UL@fi~3?%v?KheBm6MJIsV3OT;g+#N>QqI7s5IHC-!%O_kqWc zrT@NC#y(Yh3ITDh@UxEajR^1M3YRi7{xXE8I>JNCpXRE+G*|tk8{wSKQ>1ugG=wh~ z7PH8#uTNe4VHe-%;-7c$q4~=+>~*rjGhO-XV}##pg)9C}2OnxL%h0#aAI0Zc`dKdf zIflM{eks1d(pUU#F22yk+x=UP%YLq5pKU==uIqg0@8Soz_#eCYK`#F4|A)Fafv=*- z+J~#NvTEc4YT|NP#h74j0tp~$Si&YC0s%!4LJ}a#CM1fE&VVFgF$s*91l(p2g+W}# zF-p{N0b~=GK?Gbz9d*>1ah%cd6?Ghy?|G`~bocE9X1@RT{@>sCo?p7}b55N)b?Q`g z-J9;}ssKMIzz+%V1p$6|fFBXyM+NxNxC>=!at1y)mqWg5c};NcM!mh5f1&v#waL4< zRSIPL1N>6~{=ESIMS!0k;D>m@)%IVs{;kmEw^46f9;{Ax0{K4=q<0RapBvy$i=!p1 zcZF-D14e>=ys#~?ezS$aC;8d{@AYMqes3VXF~IX#IEj6pdl)QnuT7Ib8sNQoLni%! zK>D)*zS_obiniZbJspVW9|Qb>0RPVb-#!q}OZm?L$kzF^0cDaqT=W{oBi)Is%Db8LN9X+BH6V^sB= zpbq#YINrvuL8tdoqwV!#%FET?gM4?8#P3vDuYg#d1#|33v*i+toHk_7WX3}<{gnNd z`M;IS=i%>~R2l{mi=D2(X;w}w@(kcm6ekd|$oYFHlMj(V7vTu4)v(z*>!LG)I`u|} zSnP}g7M=0bVUR$?qQmP#bglvp@kRlNSafCrht^XXyN3D#@EHsS=q4PYJ2cc-@>WuA z^Ad}ku82Od$N`mO=Ss0j95x7u{omn(Fc8~9FpGC60CmJ6nC;@6OsUD65i*#~Aeg2F z>vp68P%j)ZAE`HRYG+FEEDMMDnGKv~<-{V-2M*nZ6DS{t$k{Hkhr?Ll(A_wJh(%`- zu;}QvxQ80CZBYVVbglso@rw>bEOr(Gi_T);&@XWU5sMCahZh-0$2rYl9p_UG)^WC2 z$N6+4*KxL3$N3B+?|=_?evS|8c!rHm7CutDcv$@D15uil6N`K(aOhs6Pb_lAEu))} zkHbf3qlZQ3a)?s88#&{d*~8!xe27hA(Vqt_HWyImKAb?rqQe-9&6|P6W+ky*bD;)U z>=R2~_H(hno;vsA1R@rl4Zvcb$zuN@V6jOo`rClT=9ARfgcFEZbhZPF&0WA^^JQSM zNi6zDfW_vU)Y*&^h*)&q2bMJjJ_Qy##G>;Ra7H>#pl@+Ve7*+`-A*ai%f%u3!oIu1P&jk)WKxynA8iT=ywra5=7JWSqSh;^3xSaYA8hv8XFQMGpCl)#T zZRjDKK*S;^@7TGZth-|qbUf`OWgX9KY9byuoGcB^Sjr0#q~qDwV4gGj8LZ=Jv5u$3 zI-d52Nwaubd9!#vVr=^3$>Kx5Hgf-%puZCzHF9F9?+EJu#>k09KA!T&jGS2HlsE&8 zT*t?*$FJivz{qucEY|U{a|k;!uf;k(bi`7|AOm!KEY|U{m@!FZM*tCvKf1qJd9(OD zuGM4un~u*DM&2ww+l;(fe432BS$v)}@@DZVFmfHAVFv5?3^7>8$6_6yp+>IbW3i6U za3kkAW0b*d@R4FM^UC@K#1a$Qk@X9RMcy4a^fXQ&Vv(~sL%*fetOq3W(cnYRXt5#| z`BgqSvBlltP zSjX@(gLMqqIF>RB1tFf3J)C-lhs6h$n`Y(2B4;~hTxs;_Ln;FRA{HI`lV;`qc47Yv zy?_(Q-&fB9pD|U7RTv+sS9@4&vc1x*oLJ=Pz+#hF~& zrDpA8kzWK}Y!Zu{T{(3ZP9S2Dj{;7!a$=FQsWOUi0{o6DLp&j?`HiYAiZyAWE}xVv#ohi%nvY{{lFJ6#{L*ky=J%u;|o{tR%Ml@p76Cvc{1(>*@C4>*+q5V7dL44h`=#3DZcEOrh8 zr|!iGL@YW-fYYp;Smd7or?L;RaGI49i~L() z$@?8}>VBL+#G>;faGI49i=1nHOJ0ao#YK!Drzk!{YA1DeRb_EF3BGHPm~H zg?{B>v40Un84HYj7(PM|dsuYF`gA5yr_tyTi_X<^6B>hmO2uP&Oo2eDC*cYA{L$T zJ{`7&=n#v}OrOpi>NMg6A{L!;;7nVW6yOXtAV}BI;?uxq{6vfO^K9|?42Z-I`=R9R z2Q2;&i;lK`3j`p>B(#CZVA0X>`Kgg>I~)K&emnW#Gk!*?`A(7laoC^54*PKCQfes0 z?v=5G$lPBQ%woh(V#!+#oMC;aq0aAc0uhVOTHs8p!?cWLJR5SZ5`^C&SNrgEAGY5$ zlsNV~LSs9&Yi!44jrZ_uf7|RbxD`H}eFnE9wqp_F?CdvkwxeUm+Ev& zIWIcyA(zeRH{gf8X zF3Rqki+yu^vbiOFV+BycY?fxSNUUUG*@Du!C72gu#ietx($R71qqnc&<~UR^J1;G& zSilveu-;Qi*(~h*wCFfl-R+%9=M+g^U*%(xV>a_a)pfB}L-N=N1f+~XKxCuPTp9^# zdXcco%~yl!J-RnG;W=IvOUo-3*fbj*@fMXZ>qjAX@!aDmxs5t={_(7^g^!nt?3lxJ zVg*cjI$( z&83l`rdKbk+;UC4U98Z`W%FjK-gD+$KbKoSEyR*&$LTcxM|*IgJH@OR);w%6$t{L0 z@N$t2TR_UN1w=M%&83l`rWZD=+;Z3$f#YrarN_OQ^UWG$J|$aWY?X!GwTfr=E-#uf zr_|kI?RdF@aVVZMf1d0F);xqJHPEeMg$z%u#73u?FcQ%7Vq;W~ADVeZbG^ON%w}iJ zS8GF!eM!yhq7wsEiIM5+V_~URl3X1D8Lkb##H)s{_&}JCHt2)rqUwM_RAw81+ei&5s}`M zkD55L-?S_P@&x1x=qsR)fE)qY01^T>l(3T(Hordpv-7NEGnZ7fFF6m-&iLcT68gw?l|x# z;Sdsg3*newk3ao>AxiiZy}8iym%9(;mLns}W!y&mi&7rVDEnX(0aGX<8UoX;U+o_s6+7WVRy$ojHf#9j(y%r5y30kq^_Tgd(P`km?d$KTRo z?-UrLJ+=|)3*@`rKz){S+6DZpfjzbz{p)~3?De+xB;Rawx|aOoeqw(AR-EPe$KUs2 zuL!{JAJ@N~f^;D%=PKy=?Y#qgFGGp`b;cp~eroMWzW0yg-;Du#Tkw2N+L!-xh`n^= z_xtz#as2B6IrHS>Abk&e;vbsYwKv?_6aOwprk3J2IACvI*z=G2;$J(ALw^6tk+25o zLQ)Q1Zi?~mj4tNB5aWkXy7szSdy+2!*Fj7Eof)v#uB+!?*k|ut_~Z94412y|((UJX zZ7#;Y>9EJ^jQ#<-{+(y9U+K@izzc?&Yp*Bdj8Q&?pgBH!-N7@B_W8fD-#@;S%JD)d z&Vt_f^xInuds&dtzn(UY_P(<1D?at3A1uI<*!w)tzFT0g9}1v7erJe(wBz@0AOvEY zCdD3g{QkY)(~DoaO{0Hfpy;cDkooO>27BWmqkkDV#J_t0{Pw1xU$DOm ziM{pE^V=JUN)Ch)?e)eX_GSj+R}Oot#27xsUQr-^i(&6gq|+YTMeH2`_WSoE?2Us= zNbJ1^f#1Jz=PETFGTO_wX^h`!jP!+Zy4h5xAzh3 zLFAIy8w8=>-U>7-{h@!kIKG^eODg{U7oyiwD;LI`5(nNct%b?&d zcdf77{z#W{zYf^TIF7x41nh0_+2bQqvG+#6UcckmI~cI{kk8(QK6~{6dqa<7Z%x47 zlRkSF`|R}%*c*2odszW{yL|Qr`RtVk>|J#nd-DVK4*2X1@!8uJus8cS_I?wv_m0nA zfzRHT!2bSH4trt9grvXB$9U)0TMNCGzCW(vxQNX8*1(@pu6+NFfK2+qNMPFIHBEXH z_DT%YXQuJ!WXBCj>exn*`J@i%2mn+U7!JP?p*LI@e2QLYIN)D1U?6_qpNw=~ZzR#1 zkLwK~bm=PC%W7}Z*Feg8q~O3mLotg6nALF23b+QFv#gKXuWw%Vf4V;IR|qiu;kd$Y zk2ArAl9nWTZ$>*iqKQiq<-JJm-RW^nJql*!ZF}YOrca(;AFb+?6-sJ&QdSjcw|m^~ zro!x$Q1vIji&m8mPkC|li(GXea$V9Ny1v`<_oLn#`^NaglU|?l+SR|C@yg7Xu6c3Z z-t>2ty@2;WU+kpfU+SUa_w>c?aRn;=g+dkoyHd66cNJ>ct5s^*%k^s6u1(kp^a<=N zw_C-(dRWEp|5z=1>8M(^KhatCN+)O8_8w0B-oDPVodr((i-k`7%cV~ID;3Vh)`Q#5 zNXq&6MwR|{PU%c1{mo@BR5{D`);saLH(^)MC!DVFgHQhO-5~2^Vb_x&fLw|FRvgDp2scQTN)R?yCSY@{LYi29alSD6Luz{l)3Rv&Zmc* z#_1iMocV9yo!Kf_t&fY}w&;Nv|cZ$awxbg9Od&Do>+c&;zQclScr8WNkCwNte)B>cI z#>eleh~F5O^Ou82g|%6qpoIGPWjm{ox+y+>_Y?6OlXCt(iK&T=Ge3sq!${qYl#k<= z?LG?2jb%tp{4nvw+VO>hC*{oEtg;KcPHMbnv+7V7H>nZ)uvcdkj33rGW3w7ukUcD? zc(dwS&|%nRwdwnFO6NN1FXzmC+G(77wwh5Ge_oZEa^&)Y`1C|4{`>-`@%`JJrU$Qi zqw%w-llR2lKR5pImn!f2aQB?g>QvsLXLscMl?LkS=KJ-Ymx@1myNB#to+pJ zSwH^G#>x>+&xWU~2OMgw{7`jX-E(d9P`&eu#ND-xl^^5%->6Dm@yNQyf=|`Quu)yH{y8P7NezLl;szyDsu4hBEkRH+R zk5pr2l`5@^tj;@f)yh!PCqHSdimKiXPd7vlH#omYI$YbhrxLaJTV3Cprp{}wjaK*U zkdyoj)==nLADYa_Tv3~|m+y~1p^8>NRg-ta`X55cd8g+ju2kvkHm?gE{zmOdo?6>D z{BhNoP^CUz{qX9hf*UtSt3K|RllTkO*y;&&5o$(%ShGsiv%ah@Qj^#D@sXjV&bNNO zq;dHp(Ad}zeS`kITh}-ov98*z{Za~zeI2UoKB=+#X_dS7qIJADJn#QVwYGZw*_M-aejtDr%cPx%bUzW#`$A)jz7u4P9yn!0+8^JpD$y=M;RS z%4+fw5B({cQ1whs;vW&S3v1xhA^K!{^6rn+54BBie9$FSIqSW~b93DIGKu*;w@F=rp6aT3iZ>?96)x*|BC*I)nOfFd6n1KGe_bYm|`Sb5X3Dp-b9Fmh1Rb3k{ zgh!z_=+Rqsja3b*aZkNEy1FT8{;W`CLuO;rvub0*rqzr#V}xiYKY?gBp|3SfOs|br z-oGy=@iVn`?Zc}Z5NmqG7Qxj%T*qkmcgLd3&sm#;Yh$a4(P74DOl{Zt#)2yC^>xef zojE(F`eF50eHVIjgx(a^HO;(duDK#`Wmo@E4MQBI+5NK)HV(M7+3nP zB?IaosC%xVG5Ha-8FAU;+@6&4QG;sw>bd))l|%1OU)xx{QoXvGt$pt5r|Uy+6grP2 zzEzv|#(S59lGlB=u|BglyMAX~PSTSKBf;cEXE1t0-sInYjTKF{W!5y}`s;y+=Oo^v z&|BVEr`}7Ry1Hra^Up<>C-2=<+Y>e0R^M3tsd^4q(r)MW#CL0(mfzJYx_s7WPt|ao zK&v)1;;MZPah&AzPMTWRbk4n>MwkEUXI)lzZHTNMQ2*YoIm=&CxXN_tQ)`>@K0g#) zKDku{rK8`}Y;4F${H6NtHnhYW4eC8yt4-&uNPxzH9(9`=`qp6=^Q7P7T6W8S3GR{<_A*Rl5AiPH%eutKWZu+`qWDuIsv|>T>HFlRi`1aE-I>g|$u98_$kb zSO2a*O8*$8cWub2T7zpkI;lZj&9<5J(5`6pq?tWd_k{OP*XJa^pzd7Bp2XTCvge%p zRVaCQ_ute!R{wC#=5>vgkEy5EhTfR$Ji@Y*&l{3i*Lz+6y6pPAo@*ZrRo?K=oqImn z_xAozUmkGJHEZ1%{3`nWQ@B1KKy;gCURfGC`T7AL9@+oqmv85^dPEKWW#~w~dJorI z)9dY4hgPhM=a}-?-80uWef#;bXu&tfUaNheb~D;*lXEA0YMND96*`-L zg<6dbRlPYpTJZI;-T0RJ4&zxT=Q&>U%Q